@software-dlc/cli 0.157.2

package/dist/local/source-evidence/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../../src/local/source-evidence/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,wBAAwB,EACxB,KAAK,iBAAiB,EACtB,KAAK,SAAS,EACf,MAAM,eAAe,CAAC;AAGvB,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;kBAiC/B,CAAC;AACJ,eAAO,MAAM,oBAAoB;;;;kBAqBtB,CAAC;AACZ,eAAO,MAAM,4BAA4B;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAGvC,CAAC;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,4BAA4B,CAAC,CAAC;AAC/E,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8BA+B/B,CAAC;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AAClE,MAAM,MAAM,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAChE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEpE,gFAAgF;AAChF,wBAAgB,kBAAkB,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,aAAa,GAAG,SAAS,CAQ5E"}

package/dist/local/source-evidence/schema.js

@@ -0,0 +1,99 @@
+import { z } from 'zod';
+import { context_id_schema, context_repository_schema, context_text_schema, context_reason_schema } from '../task-context-schema.js';
+import { task_context_observations_schema, task_context_error_schema } from '../task-context-observations.js';
+export { SOURCE_READ_LIMITS, permittedSourcePath, SourceReadError, filesystem_request_schema, filesystem_result_schema } from './protocol.js';
+import { SOURCE_READ_LIMITS, exact_path } from './protocol.js';
+const source_path = z.string().min(1).max(1024);
+export const source_mapping_schema = z
+    .object({
+    repository: context_repository_schema,
+    root: exact_path,
+    common: exact_path,
+    ref: z.string().min(12).max(1024).startsWith('refs/heads/'),
+    head: z.string().regex(/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/),
+    policy_id: context_id_schema,
+    allowed_paths: z.array(source_path).max(20),
+    descriptors: z
+        .array(z
+        .object({
+        reference_id: context_id_schema,
+        path: source_path,
+        start_line: z.number().int().positive().safe(),
+        end_line: z.number().int().positive().safe(),
+        summary: context_text_schema,
+        inclusion_reason: context_text_schema
+    })
+        .strict()
+        .refine((v) => v.end_line >= v.start_line && v.end_line - v.start_line < 200))
+        .max(20)
+})
+    .strict()
+    .refine((v) => new Set(v.descriptors.map((d) => d.reference_id)).size ===
+    v.descriptors.length &&
+    new Set(v.allowed_paths).size === v.allowed_paths.length);
+export const source_budget_schema = z
+    .object({
+    file_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(SOURCE_READ_LIMITS.file_bytes)
+        .default(SOURCE_READ_LIMITS.file_bytes),
+    aggregate_bytes: z
+        .number()
+        .int()
+        .min(1)
+        .max(SOURCE_READ_LIMITS.aggregate_bytes)
+        .default(SOURCE_READ_LIMITS.aggregate_bytes),
+    git_calls: z
+        .number()
+        .int()
+        .min(1)
+        .max(SOURCE_READ_LIMITS.git_calls)
+        .default(SOURCE_READ_LIMITS.git_calls)
+})
+    .strict();
+export const source_failure_reason_schema = z.enum([
+    ...context_reason_schema.options,
+    ...task_context_error_schema.shape.reason.options
+]);
+export const source_result_schema = z.discriminatedUnion('status', [
+    z
+        .object({
+        status: z.literal('error'),
+        reason: source_failure_reason_schema
+    })
+        .strict(),
+    z
+        .object({
+        status: z.literal('observed'),
+        observations: task_context_observations_schema,
+        outcomes: z
+            .array(z
+            .object({
+            reference_id: context_id_schema,
+            reason: context_reason_schema.nullable()
+        })
+            .strict())
+            .max(20),
+        counters: z
+            .object({
+            working_bytes: z.number().int().nonnegative(),
+            recheck_bytes: z.number().int().nonnegative(),
+            baseline_bytes: z.number().int().nonnegative(),
+            git_calls: z.number().int().nonnegative()
+        })
+            .strict()
+    })
+        .strict()
+]);
+/** Pure admission shared by the standalone reader and its internal composer. */
+export function parseSourceMapping(value) {
+    if (value === undefined)
+        return undefined;
+    if (typeof value !== 'string' ||
+        Buffer.byteLength(value) > SOURCE_READ_LIMITS.mapping_bytes)
+        throw new Error('invalid source mapping');
+    return source_mapping_schema.parse(JSON.parse(value));
+}
+//# sourceMappingURL=schema.js.map

package/dist/local/source-evidence/schema.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.js","sourceRoot":"","sources":["../../../src/local/source-evidence/schema.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,qBAAqB,EACtB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,gCAAgC,EAChC,yBAAyB,EAC1B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,eAAe,EACf,yBAAyB,EACzB,wBAAwB,EAGzB,MAAM,eAAe,CAAC;AACvB,OAAO,EAAE,kBAAkB,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAC/D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,UAAU,EAAE,yBAAyB;IACrC,IAAI,EAAE,UAAU;IAChB,MAAM,EAAE,UAAU;IAClB,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,UAAU,CAAC,aAAa,CAAC;IAC3D,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,iCAAiC,CAAC;IACzD,SAAS,EAAE,iBAAiB;IAC5B,aAAa,EAAE,CAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,WAAW,EAAE,CAAC;SACX,KAAK,CACJ,CAAC;SACE,MAAM,CAAC;QACN,YAAY,EAAE,iBAAiB;QAC/B,IAAI,EAAE,WAAW;QACjB,UAAU,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;QAC9C,QAAQ,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE;QAC5C,OAAO,EAAE,mBAAmB;QAC5B,gBAAgB,EAAE,mBAAmB;KACtC,CAAC;SACD,MAAM,EAAE;SACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,UAAU,GAAG,GAAG,CACrE,CACJ;SACA,GAAG,CAAC,EAAE,CAAC;CACX,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CACL,CAAC,CAAC,EAAE,EAAE,CACJ,IAAI,GAAG,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI;IACpD,CAAC,CAAC,WAAW,CAAC,MAAM;IACtB,IAAI,GAAG,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,aAAa,CAAC,MAAM,CAC3D,CAAC;AACJ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC;KAClC,MAAM,CAAC;IACN,UAAU,EAAE,CAAC;SACV,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,kBAAkB,CAAC,UAAU,CAAC;SAClC,OAAO,CAAC,kBAAkB,CAAC,UAAU,CAAC;IACzC,eAAe,EAAE,CAAC;SACf,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,kBAAkB,CAAC,eAAe,CAAC;SACvC,OAAO,CAAC,kBAAkB,CAAC,eAAe,CAAC;IAC9C,SAAS,EAAE,CAAC;SACT,MAAM,EAAE;SACR,GAAG,EAAE;SACL,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,kBAAkB,CAAC,SAAS,CAAC;SACjC,OAAO,CAAC,kBAAkB,CAAC,SAAS,CAAC;CACzC,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,4BAA4B,GAAG,CAAC,CAAC,IAAI,CAAC;IACjD,GAAG,qBAAqB,CAAC,OAAO;IAChC,GAAG,yBAAyB,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO;CAClD,CAAC,CAAC;AAEH,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACjE,CAAC;SACE,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1B,MAAM,EAAE,4BAA4B;KACrC,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAC7B,YAAY,EAAE,gCAAgC;QAC9C,QAAQ,EAAE,CAAC;aACR,KAAK,CACJ,CAAC;aACE,MAAM,CAAC;YACN,YAAY,EAAE,iBAAiB;YAC/B,MAAM,EAAE,qBAAqB,CAAC,QAAQ,EAAE;SACzC,CAAC;aACD,MAAM,EAAE,CACZ;aACA,GAAG,CAAC,EAAE,CAAC;QACV,QAAQ,EAAE,CAAC;aACR,MAAM,CAAC;YACN,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YAC7C,aAAa,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YAC7C,cAAc,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;YAC9C,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE;SAC1C,CAAC;aACD,MAAM,EAAE;KACZ,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAKH,gFAAgF;AAChF,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,IACE,OAAO,KAAK,KAAK,QAAQ;QACzB,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,kBAAkB,CAAC,aAAa;QAE3D,MAAM,IAAI,KAAK,CAAC,wBAAwB,CAAC,CAAC;IAC5C,OAAO,qBAAqB,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;AACxD,CAAC"}

package/dist/local/source-policy/loader.d.ts

@@ -0,0 +1,29 @@
+import { type SourceMapping } from '../source-evidence/schema.js';
+import { OperationError } from '../operation.js';
+import { PolicyError } from './protocol.js';
+type Result<T> = {
+    status: 'ok';
+    value: T;
+} | {
+    status: 'error';
+    reason: PolicyError['reason'];
+};
+/** Private embedding boundary; callback is trusted read-only work, never request data.
+ * No environment policy discovery or public transport activation. No source/registry reads here.
+ */
+export declare function withLocalSourcePolicy<T>(input: {
+    evidence_refs: unknown;
+    cwd: string;
+    trusted_policy?: unknown;
+    excluded_roots?: string[];
+    signal?: AbortSignal;
+    timeout_ms?: number;
+    on_cleanup_timeout?: (error: OperationError) => void;
+    read: (context: {
+        mapping: SourceMapping | undefined;
+        signal: AbortSignal;
+        deadline: number;
+    }) => Promise<T>;
+}): Promise<Result<T>>;
+export {};
+//# sourceMappingURL=loader.d.ts.map

package/dist/local/source-policy/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../../src/local/source-policy/loader.ts"],"names":[],"mappings":"AAGA,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,8BAA8B,CAAC;AAEtC,OAAO,EAGL,cAAc,EACf,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAoC,WAAW,EAAE,MAAM,eAAe,CAAC;AAiB9E,KAAK,MAAM,CAAC,CAAC,IACT;IAAE,MAAM,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC1B;IAAE,MAAM,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,WAAW,CAAC,QAAQ,CAAC,CAAA;CAAE,CAAC;AA0EvD;;GAEG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,EAAE,KAAK,EAAE;IACpD,aAAa,EAAE,OAAO,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,kBAAkB,CAAC,EAAE,CAAC,KAAK,EAAE,cAAc,KAAK,IAAI,CAAC;IACrD,IAAI,EAAE,CAAC,OAAO,EAAE;QACd,OAAO,EAAE,aAAa,GAAG,SAAS,CAAC;QACnC,MAAM,EAAE,WAAW,CAAC;QACpB,QAAQ,EAAE,MAAM,CAAC;KAClB,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CAClB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CA0HrB"}

package/dist/local/source-policy/loader.js

@@ -0,0 +1,209 @@
+import { createHash } from 'node:crypto';
+import { z } from 'zod';
+import { context_evidence_ref_schema } from '../task-context-schema.js';
+import { source_mapping_schema, parseSourceMapping, permittedSourcePath } from '../source-evidence/schema.js';
+import { SourceProcesses } from '../source-evidence/processes.js';
+import { currentOperation, operationSignal, OperationError } from '../operation.js';
+import { readPolicyFile } from './process.js';
+import { policy_path_schema, POLICY_BYTES, PolicyError } from './protocol.js';
+const configuration = z
+    .object({
+    path: policy_path_schema,
+    sha256: z.string().regex(/^sha256:[a-f0-9]{64}$/)
+})
+    .strict();
+const references = z
+    .array(context_evidence_ref_schema)
+    .max(20)
+    .refine((refs) => new Set(refs.map((ref) => ref.id)).size === refs.length);
+const envelope = z
+    .object({
+    schema_version: z.literal(1),
+    mapping: z.record(z.string(), z.unknown())
+})
+    .strict();
+function freeze(value) {
+    Object.freeze(value);
+    for (const child of Object.values(value))
+        if (child && typeof child === 'object')
+            freeze(child);
+}
+function parsePolicy(text, sha256) {
+    if (Buffer.byteLength(text) > POLICY_BYTES)
+        throw new PolicyError('invalid_request');
+    if ('sha256:' + createHash('sha256').update(text).digest('hex') !== sha256)
+        throw new PolicyError('pin_mismatch');
+    try {
+        const parsed = envelope.parse(JSON.parse(text));
+        if (Object.hasOwn(parsed.mapping, 'policy_id'))
+            throw new Error('self-declared policy');
+        const mapping = source_mapping_schema.parse({
+            ...parsed.mapping,
+            policy_id: sha256
+        });
+        if (mapping.allowed_paths.some((path) => !permittedSourcePath(path)) ||
+            mapping.descriptors.some((d) => !permittedSourcePath(d.path) ||
+                !mapping.allowed_paths.includes(d.path)))
+            throw new Error('invalid descriptor');
+        parseSourceMapping(JSON.stringify(mapping));
+        freeze(mapping);
+        return mapping;
+    }
+    catch {
+        throw new PolicyError('invalid_request');
+    }
+}
+async function discover(processes) {
+    const text = async (args) => {
+        const raw = await processes.git(args);
+        const value = new TextDecoder('utf-8', {
+            fatal: true,
+            ignoreBOM: true
+        }).decode(raw);
+        if (!value.endsWith('\n'))
+            throw new PolicyError('source_unavailable');
+        return value.slice(0, -1);
+    };
+    const root = await text(['rev-parse', '--show-toplevel']);
+    const common = await text([
+        'rev-parse',
+        '--path-format=absolute',
+        '--git-common-dir'
+    ]);
+    let ref;
+    try {
+        ref = await text(['symbolic-ref', '--quiet', 'HEAD']);
+    }
+    catch {
+        processes.check();
+        throw new PolicyError('detached_ref');
+    }
+    let head;
+    try {
+        head = await text(['rev-parse', '--verify', 'HEAD']);
+    }
+    catch {
+        processes.check();
+        throw new PolicyError('unborn_ref');
+    }
+    if (!policy_path_schema.safeParse(root).success ||
+        !policy_path_schema.safeParse(common).success ||
+        !ref.startsWith('refs/heads/') ||
+        !/^(?:[a-f0-9]{40}|[a-f0-9]{64})$/.test(head))
+        throw new PolicyError('source_unavailable');
+    return { root, common, ref, head };
+}
+/** Private embedding boundary; callback is trusted read-only work, never request data.
+ * No environment policy discovery or public transport activation. No source/registry reads here.
+ */
+export async function withLocalSourcePolicy(input) {
+    const started = performance.now();
+    const selected = references.safeParse(input.evidence_refs);
+    const timeout = input.timeout_ms ?? 30_000;
+    if (!selected.success ||
+        !Number.isInteger(timeout) ||
+        timeout < 1 ||
+        timeout > 30_000)
+        return { status: 'error', reason: 'invalid_request' };
+    // No-evidence requests do not inspect even malformed unused policy configuration.
+    const active = selected.data.length > 0;
+    const config = active
+        ? configuration.safeParse(input.trusted_policy)
+        : undefined;
+    if (active && input.trusted_policy === undefined)
+        return { status: 'error', reason: 'source_unavailable' };
+    const excluded = z
+        .array(policy_path_schema)
+        .max(30)
+        .safeParse(active ? (input.excluded_roots ?? []) : []);
+    if ((config && !config.success) ||
+        !excluded.success ||
+        (active && !policy_path_schema.safeParse(input.cwd).success))
+        return { status: 'error', reason: 'invalid_request' };
+    const controller = new AbortController();
+    const deadline = Math.min(started + timeout, currentOperation()?.deadline ?? Infinity);
+    const inherited = operationSignal(input.signal);
+    let cleanup_timer;
+    const stop = (reason) => {
+        if (controller.signal.aborted)
+            return;
+        controller.abort(new PolicyError(reason));
+        cleanup_timer = setTimeout(() => input.on_cleanup_timeout?.(new OperationError('cleanup_incomplete', 'context')), 2000);
+    };
+    const check = () => {
+        if (performance.now() >= deadline)
+            stop('deadline_exceeded');
+        controller.signal.throwIfAborted();
+    };
+    const on_abort = () => stop(performance.now() >= deadline ? 'deadline_exceeded' : 'cancelled');
+    inherited?.addEventListener('abort', on_abort, { once: true });
+    const timer = setTimeout(() => stop('deadline_exceeded'), Math.max(1, deadline - performance.now()));
+    if (inherited?.aborted)
+        on_abort();
+    try {
+        check();
+        if (!active) {
+            const value = await input.read({
+                mapping: undefined,
+                signal: controller.signal,
+                deadline
+            });
+            check();
+            return { status: 'ok', value };
+        }
+        if (!config?.success)
+            throw new PolicyError('invalid_request');
+        const { path, sha256 } = config.data;
+        const processes = new SourceProcesses(input.cwd, controller.signal, 8);
+        const before = await discover(processes);
+        const request = {
+            path,
+            excluded_roots: [...excluded.data, before.root, before.common]
+        };
+        const file = await readPolicyFile(request, controller.signal);
+        const mapping = parsePolicy(file.text, sha256);
+        if (mapping.root !== before.root ||
+            mapping.common !== before.common ||
+            mapping.ref !== before.ref)
+            throw new PolicyError('repository_mismatch');
+        if (mapping.head !== before.head)
+            throw new PolicyError('pin_mismatch');
+        check();
+        const value = await input.read({
+            mapping,
+            signal: controller.signal,
+            deadline
+        });
+        check();
+        try {
+            const after = await readPolicyFile(request, controller.signal);
+            if (after.text !== file.text ||
+                after.stamp !== file.stamp ||
+                JSON.stringify(await discover(processes)) !== JSON.stringify(before))
+                throw new PolicyError('changed_during_read');
+        }
+        catch {
+            check();
+            throw new PolicyError('changed_during_read');
+        }
+        check();
+        return { status: 'ok', value };
+    }
+    catch (error) {
+        if (controller.signal.aborted)
+            return {
+                status: 'error',
+                reason: controller.signal.reason.reason
+            };
+        return {
+            status: 'error',
+            reason: error instanceof PolicyError ? error.reason : 'source_unavailable'
+        };
+    }
+    finally {
+        clearTimeout(timer);
+        clearTimeout(cleanup_timer);
+        inherited?.removeEventListener('abort', on_abort);
+    }
+}
+//# sourceMappingURL=loader.js.map

package/dist/local/source-policy/loader.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.js","sourceRoot":"","sources":["../../../src/local/source-policy/loader.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,2BAA2B,EAAE,MAAM,2BAA2B,CAAC;AACxE,OAAO,EACL,qBAAqB,EACrB,kBAAkB,EAClB,mBAAmB,EAEpB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,eAAe,EAAE,MAAM,iCAAiC,CAAC;AAClE,OAAO,EACL,gBAAgB,EAChB,eAAe,EACf,cAAc,EACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC9E,MAAM,aAAa,GAAG,CAAC;KACpB,MAAM,CAAC;IACN,IAAI,EAAE,kBAAkB;IACxB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;CAClD,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,UAAU,GAAG,CAAC;KACjB,KAAK,CAAC,2BAA2B,CAAC;KAClC,GAAG,CAAC,EAAE,CAAC;KACP,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,CAAC;AAC7E,MAAM,QAAQ,GAAG,CAAC;KACf,MAAM,CAAC;IACN,cAAc,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC5B,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC;CAC3C,CAAC;KACD,MAAM,EAAE,CAAC;AAIZ,SAAS,MAAM,CAAC,KAAa;IAC3B,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;QACtC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC;AACD,SAAS,WAAW,CAAC,IAAY,EAAE,MAAc;IAC/C,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,YAAY;QACxC,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC3C,IAAI,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,MAAM;QACxE,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,WAAW,CAAC;YAC5C,MAAM,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,qBAAqB,CAAC,KAAK,CAAC;YAC1C,GAAG,MAAM,CAAC,OAAO;YACjB,SAAS,EAAE,MAAM;SAClB,CAAC,CAAC;QACH,IACE,OAAO,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;YAChE,OAAO,CAAC,WAAW,CAAC,IAAI,CACtB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,mBAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC5B,CAAC,OAAO,CAAC,aAAa,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAC1C;YAED,MAAM,IAAI,KAAK,CAAC,oBAAoB,CAAC,CAAC;QACxC,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC;QAC5C,MAAM,CAAC,OAAO,CAAC,CAAC;QAChB,OAAO,OAAO,CAAC;IACjB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC;IAC3C,CAAC;AACH,CAAC;AACD,KAAK,UAAU,QAAQ,CAAC,SAA0B;IAChD,MAAM,IAAI,GAAG,KAAK,EAAE,IAAc,EAAE,EAAE;QACpC,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE;YACrC,KAAK,EAAE,IAAI;YACX,SAAS,EAAE,IAAI;SAChB,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACf,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC;YAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC;QACvE,OAAO,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5B,CAAC,CAAC;IACF,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,iBAAiB,CAAC,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC;QACxB,WAAW;QACX,wBAAwB;QACxB,kBAAkB;KACnB,CAAC,CAAC;IACH,IAAI,GAAW,CAAC;IAChB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,IAAI,CAAC,CAAC,cAAc,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;IACxD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;IACxC,CAAC;IACD,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,MAAM,IAAI,CAAC,CAAC,WAAW,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,CAAC,KAAK,EAAE,CAAC;QAClB,MAAM,IAAI,WAAW,CAAC,YAAY,CAAC,CAAC;IACtC,CAAC;IACD,IACE,CAAC,kBAAkB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,OAAO;QAC3C,CAAC,kBAAkB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,OAAO;QAC7C,CAAC,GAAG,CAAC,UAAU,CAAC,aAAa,CAAC;QAC9B,CAAC,iCAAiC,CAAC,IAAI,CAAC,IAAI,CAAC;QAE7C,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9C,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,CAAC;AACrC,CAAC;AACD;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CAAI,KAa9C;IACC,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;IAClC,MAAM,QAAQ,GAAG,UAAU,CAAC,SAAS,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC;IAC3D,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,IAAI,MAAM,CAAC;IAC3C,IACE,CAAC,QAAQ,CAAC,OAAO;QACjB,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;QAC1B,OAAO,GAAG,CAAC;QACX,OAAO,GAAG,MAAM;QAEhB,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,kFAAkF;IAClF,MAAM,MAAM,GAAG,QAAQ,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;IACxC,MAAM,MAAM,GAAG,MAAM;QACnB,CAAC,CAAC,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC,cAAc,CAAC;QAC/C,CAAC,CAAC,SAAS,CAAC;IACd,IAAI,MAAM,IAAI,KAAK,CAAC,cAAc,KAAK,SAAS;QAC9C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IAC3D,MAAM,QAAQ,GAAG,CAAC;SACf,KAAK,CAAC,kBAAkB,CAAC;SACzB,GAAG,CAAC,EAAE,CAAC;SACP,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzD,IACE,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;QAC3B,CAAC,QAAQ,CAAC,OAAO;QACjB,CAAC,MAAM,IAAI,CAAC,kBAAkB,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QAE5D,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IACxD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CACvB,OAAO,GAAG,OAAO,EACjB,gBAAgB,EAAE,EAAE,QAAQ,IAAI,QAAQ,CACzC,CAAC;IACF,MAAM,SAAS,GAAG,eAAe,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAChD,IAAI,aAAwD,CAAC;IAC7D,MAAM,IAAI,GAAG,CAAC,MAAyC,EAAE,EAAE;QACzD,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAAE,OAAO;QACtC,UAAU,CAAC,KAAK,CAAC,IAAI,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC;QAC1C,aAAa,GAAG,UAAU,CACxB,GAAG,EAAE,CACH,KAAK,CAAC,kBAAkB,EAAE,CACxB,IAAI,cAAc,CAAC,oBAAoB,EAAE,SAAS,CAAC,CACpD,EACH,IAAI,CACL,CAAC;IACJ,CAAC,CAAC;IACF,MAAM,KAAK,GAAG,GAAG,EAAE;QACjB,IAAI,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ;YAAE,IAAI,CAAC,mBAAmB,CAAC,CAAC;QAC7D,UAAU,CAAC,MAAM,CAAC,cAAc,EAAE,CAAC;IACrC,CAAC,CAAC;IACF,MAAM,QAAQ,GAAG,GAAG,EAAE,CACpB,IAAI,CAAC,WAAW,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC1E,SAAS,EAAE,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/D,MAAM,KAAK,GAAG,UAAU,CACtB,GAAG,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,EAC/B,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC,CAC1C,CAAC;IACF,IAAI,SAAS,EAAE,OAAO;QAAE,QAAQ,EAAE,CAAC;IACnC,IAAI,CAAC;QACH,KAAK,EAAE,CAAC;QACR,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC;gBAC7B,OAAO,EAAE,SAAS;gBAClB,MAAM,EAAE,UAAU,CAAC,MAAM;gBACzB,QAAQ;aACT,CAAC,CAAC;YACH,KAAK,EAAE,CAAC;YACR,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QACjC,CAAC;QACD,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC/D,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,IAAI,CAAC;QACrC,MAAM,SAAS,GAAG,IAAI,eAAe,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QACvE,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC;QACzC,MAAM,OAAO,GAAG;YACd,IAAI;YACJ,cAAc,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,CAAC;SAC/D,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;QAC9D,MAAM,OAAO,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC/C,IACE,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YAC5B,OAAO,CAAC,MAAM,KAAK,MAAM,CAAC,MAAM;YAChC,OAAO,CAAC,GAAG,KAAK,MAAM,CAAC,GAAG;YAE1B,MAAM,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,MAAM,CAAC,IAAI;YAAE,MAAM,IAAI,WAAW,CAAC,cAAc,CAAC,CAAC;QACxE,KAAK,EAAE,CAAC;QACR,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,IAAI,CAAC;YAC7B,OAAO;YACP,MAAM,EAAE,UAAU,CAAC,MAAM;YACzB,QAAQ;SACT,CAAC,CAAC;QACH,KAAK,EAAE,CAAC;QACR,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,MAAM,CAAC,CAAC;YAC/D,IACE,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI;gBACxB,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,KAAK;gBAC1B,IAAI,CAAC,SAAS,CAAC,MAAM,QAAQ,CAAC,SAAS,CAAC,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC;gBAEpE,MAAM,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;QACjD,CAAC;QAAC,MAAM,CAAC;YACP,KAAK,EAAE,CAAC;YACR,MAAM,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;QAC/C,CAAC;QACD,KAAK,EAAE,CAAC;QACR,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;IACjC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,MAAM,CAAC,OAAO;YAC3B,OAAO;gBACL,MAAM,EAAE,OAAO;gBACf,MAAM,EAAG,UAAU,CAAC,MAAM,CAAC,MAAsB,CAAC,MAAM;aACzD,CAAC;QACJ,OAAO;YACL,MAAM,EAAE,OAAO;YACf,MAAM,EAAE,KAAK,YAAY,WAAW,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,oBAAoB;SAC3E,CAAC;IACJ,CAAC;YAAS,CAAC;QACT,YAAY,CAAC,KAAK,CAAC,CAAC;QACpB,YAAY,CAAC,aAAa,CAAC,CAAC;QAC5B,SAAS,EAAE,mBAAmB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACpD,CAAC;AACH,CAAC"}

package/dist/local/source-policy/process.d.ts

@@ -0,0 +1,7 @@
+import { type PolicyFileRequest } from './protocol.js';
+export declare function readPolicyFile(request: PolicyFileRequest, signal: AbortSignal): Promise<{
+    status: "ok";
+    text: string;
+    stamp: string;
+}>;
+//# sourceMappingURL=process.d.ts.map

package/dist/local/source-policy/process.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.d.ts","sourceRoot":"","sources":["../../../src/local/source-policy/process.ts"],"names":[],"mappings":"AAEA,OAAO,EAGL,KAAK,iBAAiB,EAEvB,MAAM,eAAe,CAAC;AACvB,wBAAsB,cAAc,CAClC,OAAO,EAAE,iBAAiB,EAC1B,MAAM,EAAE,WAAW;;;;GA+CpB"}

package/dist/local/source-policy/process.js

@@ -0,0 +1,53 @@
+import { fork } from 'node:child_process';
+import { fileURLToPath } from 'node:url';
+import { policy_result_schema, PolicyError } from './protocol.js';
+export async function readPolicyFile(request, signal) {
+    signal.throwIfAborted();
+    const child = fork(fileURLToPath(new URL('./worker.js', import.meta.url)), [], {
+        execArgv: ['--max-old-space-size=64'],
+        env: { NODE_ENV: 'production' },
+        stdio: ['ignore', 'ignore', 'ignore', 'ipc'],
+        serialization: 'json'
+    });
+    let answer;
+    let failed = false;
+    const stop = () => child.kill('SIGKILL');
+    const fail = () => {
+        failed = true;
+        stop();
+    };
+    const closed = new Promise((resolve) => {
+        child.on('error', fail);
+        child.once('close', (code) => {
+            signal.removeEventListener('abort', stop);
+            resolve(code);
+        });
+    });
+    child.on('message', (value) => {
+        const parsed = policy_result_schema.safeParse(value);
+        if (!parsed.success || answer || failed)
+            fail();
+        else
+            answer = parsed.data;
+    });
+    signal.addEventListener('abort', stop, { once: true });
+    if (signal.aborted)
+        stop();
+    try {
+        child.send(request, (error) => {
+            if (error)
+                fail();
+        });
+    }
+    catch {
+        fail();
+    }
+    const code = await closed;
+    signal.throwIfAborted();
+    if (failed || code !== 0 || !answer)
+        throw new PolicyError('source_unavailable');
+    if (answer.status === 'error')
+        throw new PolicyError(answer.reason);
+    return answer;
+}
+//# sourceMappingURL=process.js.map

package/dist/local/source-policy/process.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"process.js","sourceRoot":"","sources":["../../../src/local/source-policy/process.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,IAAI,EAAE,MAAM,oBAAoB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,oBAAoB,EACpB,WAAW,EAGZ,MAAM,eAAe,CAAC;AACvB,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,OAA0B,EAC1B,MAAmB;IAEnB,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAChB,aAAa,CAAC,IAAI,GAAG,CAAC,aAAa,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EACtD,EAAE,EACF;QACE,QAAQ,EAAE,CAAC,yBAAyB,CAAC;QACrC,GAAG,EAAE,EAAE,QAAQ,EAAE,YAAY,EAAE;QAC/B,KAAK,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,KAAK,CAAC;QAC5C,aAAa,EAAE,MAAM;KACtB,CACF,CAAC;IACF,IAAI,MAAoC,CAAC;IACzC,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,GAAG,EAAE;QAChB,MAAM,GAAG,IAAI,CAAC;QACd,IAAI,EAAE,CAAC;IACT,CAAC,CAAC;IACF,MAAM,MAAM,GAAG,IAAI,OAAO,CAAgB,CAAC,OAAO,EAAE,EAAE;QACpD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QACxB,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;YAC3B,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;YAC1C,OAAO,CAAC,IAAI,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,KAAc,EAAE,EAAE;QACrC,MAAM,MAAM,GAAG,oBAAoB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACrD,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,MAAM,IAAI,MAAM;YAAE,IAAI,EAAE,CAAC;;YAC3C,MAAM,GAAG,MAAM,CAAC,IAAI,CAAC;IAC5B,CAAC,CAAC,CAAC;IACH,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,OAAO;QAAE,IAAI,EAAE,CAAC;IAC3B,IAAI,CAAC;QACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC5B,IAAI,KAAK;gBAAE,IAAI,EAAE,CAAC;QACpB,CAAC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,EAAE,CAAC;IACT,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC;IAC1B,MAAM,CAAC,cAAc,EAAE,CAAC;IACxB,IAAI,MAAM,IAAI,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM;QACjC,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC;IAC9C,IAAI,MAAM,CAAC,MAAM,KAAK,OAAO;QAAE,MAAM,IAAI,WAAW,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACpE,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/local/source-policy/protocol.d.ts

@@ -0,0 +1,27 @@
+import { z } from 'zod';
+export declare const POLICY_BYTES = 65536;
+export declare const policy_path_schema: z.ZodString;
+export declare const policy_request_schema: z.ZodObject<{
+    path: z.ZodString;
+    excluded_roots: z.ZodArray<z.ZodString>;
+}, z.core.$strict>;
+export declare const policy_result_schema: z.ZodDiscriminatedUnion<[z.ZodObject<{
+    status: z.ZodLiteral<"ok">;
+    text: z.ZodString;
+    stamp: z.ZodString;
+}, z.core.$strict>, z.ZodObject<{
+    status: z.ZodLiteral<"error">;
+    reason: z.ZodEnum<{
+        source_unavailable: "source_unavailable";
+        changed_during_read: "changed_during_read";
+        invalid_request: "invalid_request";
+    }>;
+}, z.core.$strict>], "status">;
+export type PolicyFileResult = z.infer<typeof policy_result_schema>;
+export type PolicyFileRequest = z.infer<typeof policy_request_schema>;
+export declare function within(path: string, root: string): boolean;
+export declare class PolicyError extends Error {
+    readonly reason: 'source_unavailable' | 'invalid_request' | 'pin_mismatch' | 'repository_mismatch' | 'changed_during_read' | 'detached_ref' | 'unborn_ref' | 'cancelled' | 'deadline_exceeded';
+    constructor(reason: 'source_unavailable' | 'invalid_request' | 'pin_mismatch' | 'repository_mismatch' | 'changed_during_read' | 'detached_ref' | 'unborn_ref' | 'cancelled' | 'deadline_exceeded');
+}
+//# sourceMappingURL=protocol.d.ts.map

package/dist/local/source-policy/protocol.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.d.ts","sourceRoot":"","sources":["../../../src/local/source-policy/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,YAAY,QAAS,CAAC;AACnC,eAAO,MAAM,kBAAkB,aAS5B,CAAC;AACJ,eAAO,MAAM,qBAAqB;;;kBAKvB,CAAC;AACZ,eAAO,MAAM,oBAAoB;;;;;;;;;;;8BAkB/B,CAAC;AACH,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AACpE,MAAM,MAAM,iBAAiB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACtE,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,WAMhD;AACD,qBAAa,WAAY,SAAQ,KAAK;IAElC,QAAQ,CAAC,MAAM,EACX,oBAAoB,GACpB,iBAAiB,GACjB,cAAc,GACd,qBAAqB,GACrB,qBAAqB,GACrB,cAAc,GACd,YAAY,GACZ,WAAW,GACX,mBAAmB;gBATd,MAAM,EACX,oBAAoB,GACpB,iBAAiB,GACjB,cAAc,GACd,qBAAqB,GACrB,qBAAqB,GACrB,cAAc,GACd,YAAY,GACZ,WAAW,GACX,mBAAmB;CAI1B"}

package/dist/local/source-policy/protocol.js

@@ -0,0 +1,48 @@
+import { z } from 'zod';
+import { isAbsolute, normalize, relative, sep } from 'node:path';
+export const POLICY_BYTES = 65_536;
+export const policy_path_schema = z
+    .string()
+    .min(1)
+    .max(4096)
+    .refine((value) => isAbsolute(value) &&
+    normalize(value) === value &&
+    !/[\0\uD800-\uDFFF]/u.test(value));
+export const policy_request_schema = z
+    .object({
+    path: policy_path_schema,
+    excluded_roots: z.array(policy_path_schema).max(32)
+})
+    .strict();
+export const policy_result_schema = z.discriminatedUnion('status', [
+    z
+        .object({
+        status: z.literal('ok'),
+        text: z.string().max(POLICY_BYTES),
+        stamp: z.string().max(32768)
+    })
+        .strict(),
+    z
+        .object({
+        status: z.literal('error'),
+        reason: z.enum([
+            'source_unavailable',
+            'invalid_request',
+            'changed_during_read'
+        ])
+    })
+        .strict()
+]);
+export function within(path, root) {
+    const part = relative(root, path);
+    return (part === '' ||
+        (!part.startsWith('..' + sep) && part !== '..' && !isAbsolute(part)));
+}
+export class PolicyError extends Error {
+    reason;
+    constructor(reason) {
+        super(reason);
+        this.reason = reason;
+    }
+}
+//# sourceMappingURL=protocol.js.map

package/dist/local/source-policy/protocol.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"protocol.js","sourceRoot":"","sources":["../../../src/local/source-policy/protocol.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AACxB,OAAO,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACjE,MAAM,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC;AACnC,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC;KAChC,MAAM,EAAE;KACR,GAAG,CAAC,CAAC,CAAC;KACN,GAAG,CAAC,IAAI,CAAC;KACT,MAAM,CACL,CAAC,KAAK,EAAE,EAAE,CACR,UAAU,CAAC,KAAK,CAAC;IACjB,SAAS,CAAC,KAAK,CAAC,KAAK,KAAK;IAC1B,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CACpC,CAAC;AACJ,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC;KACnC,MAAM,CAAC;IACN,IAAI,EAAE,kBAAkB;IACxB,cAAc,EAAE,CAAC,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACpD,CAAC;KACD,MAAM,EAAE,CAAC;AACZ,MAAM,CAAC,MAAM,oBAAoB,GAAG,CAAC,CAAC,kBAAkB,CAAC,QAAQ,EAAE;IACjE,CAAC;SACE,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACvB,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,YAAY,CAAC;QAClC,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC;KAC7B,CAAC;SACD,MAAM,EAAE;IACX,CAAC;SACE,MAAM,CAAC;QACN,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;QAC1B,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC;YACb,oBAAoB;YACpB,iBAAiB;YACjB,qBAAqB;SACtB,CAAC;KACH,CAAC;SACD,MAAM,EAAE;CACZ,CAAC,CAAC;AAGH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,IAAY;IAC/C,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IAClC,OAAO,CACL,IAAI,KAAK,EAAE;QACX,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CACrE,CAAC;AACJ,CAAC;AACD,MAAM,OAAO,WAAY,SAAQ,KAAK;IAEzB;IADX,YACW,MASc;QAEvB,KAAK,CAAC,MAAM,CAAC,CAAC;QAXL,WAAM,GAAN,MAAM,CASQ;IAGzB,CAAC;CACF"}

package/dist/local/source-policy/worker.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=worker.d.ts.map

package/dist/local/source-policy/worker.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.d.ts","sourceRoot":"","sources":["../../../src/local/source-policy/worker.ts"],"names":[],"mappings":""}

package/dist/local/source-policy/worker.js

@@ -0,0 +1,100 @@
+import { constants, openSync, closeSync, readSync, lstatSync, fstatSync, realpathSync } from 'node:fs';
+import { dirname, parse } from 'node:path';
+import { POLICY_BYTES, policy_request_schema, PolicyError, within } from './protocol.js';
+function stamp(path) {
+    const stat = lstatSync(path, { bigint: true });
+    if (stat.isSymbolicLink())
+        throw new PolicyError('source_unavailable');
+    return [
+        stat.dev,
+        stat.ino,
+        stat.mode,
+        stat.isDirectory() ? '' : stat.size,
+        stat.isDirectory() ? '' : stat.mtimeNs,
+        stat.isDirectory() ? '' : stat.ctimeNs
+    ].join(':');
+}
+// Fixed child-free worker: all potentially blocking filesystem operations stay here.
+process.once('message', (input) => {
+    let result;
+    try {
+        const request = policy_request_schema.safeParse(input);
+        if (!request.success)
+            throw new PolicyError('invalid_request');
+        const { path, excluded_roots } = request.data;
+        if (excluded_roots.some((root) => within(path, root)) ||
+            path
+                .split('/')
+                .some((part) => /^\.sdlc(?:\.|$)/i.test(part) || part.toLowerCase() === 'sdlc'))
+            throw new PolicyError('source_unavailable');
+        if (excluded_roots.some((root) => realpathSync(root) !== root))
+            throw new PolicyError('source_unavailable');
+        const parents = [];
+        for (let p = dirname(path);; p = dirname(p)) {
+            const before = stamp(p);
+            if (!lstatSync(p).isDirectory())
+                throw new PolicyError('source_unavailable');
+            parents.push([p, before]);
+            if (p === parse(p).root)
+                break;
+        }
+        if (realpathSync(path) !== path)
+            throw new PolicyError('source_unavailable');
+        const before = stamp(path);
+        const initial = lstatSync(path);
+        if (!initial.isFile() || initial.nlink !== 1)
+            throw new PolicyError('source_unavailable');
+        if (initial.size > POLICY_BYTES)
+            throw new PolicyError('invalid_request');
+        const fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK);
+        let text;
+        try {
+            const opened = fstatSync(fd);
+            if (!opened.isFile() ||
+                opened.nlink !== 1 ||
+                opened.dev !== initial.dev ||
+                opened.ino !== initial.ino)
+                throw new PolicyError('changed_during_read');
+            const bytes = Buffer.alloc(POLICY_BYTES + 1);
+            let offset = 0;
+            while (offset < bytes.length) {
+                const count = readSync(fd, bytes, offset, bytes.length - offset, offset);
+                if (!count)
+                    break;
+                offset += count;
+            }
+            if (offset > POLICY_BYTES)
+                throw new PolicyError('invalid_request');
+            try {
+                text = new TextDecoder('utf-8', {
+                    fatal: true,
+                    ignoreBOM: true
+                }).decode(bytes.subarray(0, offset));
+            }
+            catch {
+                throw new PolicyError('invalid_request');
+            }
+            if (stamp(path) !== before ||
+                parents.some(([p, value]) => stamp(p) !== value))
+                throw new PolicyError('changed_during_read');
+        }
+        finally {
+            closeSync(fd);
+        }
+        result = { status: 'ok', text, stamp: JSON.stringify([before, parents]) };
+    }
+    catch (error) {
+        result = {
+            status: 'error',
+            reason: error instanceof PolicyError &&
+                (error.reason === 'invalid_request' ||
+                    error.reason === 'changed_during_read')
+                ? error.reason
+                : 'source_unavailable'
+        };
+    }
+    // Success is published only after close. The parent also waits for actual process close.
+    process.send?.(result);
+    process.disconnect();
+});
+//# sourceMappingURL=worker.js.map

package/dist/local/source-policy/worker.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"worker.js","sourceRoot":"","sources":["../../../src/local/source-policy/worker.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,QAAQ,EACR,SAAS,EACT,QAAQ,EACR,SAAS,EACT,SAAS,EACT,YAAY,EACb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAC3C,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,WAAW,EACX,MAAM,EAEP,MAAM,eAAe,CAAC;AACvB,SAAS,KAAK,CAAC,IAAY;IACzB,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC;IAC/C,IAAI,IAAI,CAAC,cAAc,EAAE;QAAE,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC;IACvE,OAAO;QACL,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,GAAG;QACR,IAAI,CAAC,IAAI;QACT,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI;QACnC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;QACtC,IAAI,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO;KACvC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AACD,qFAAqF;AACrF,OAAO,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC,KAAc,EAAE,EAAE;IACzC,IAAI,MAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvD,IAAI,CAAC,OAAO,CAAC,OAAO;YAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC/D,MAAM,EAAE,IAAI,EAAE,cAAc,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC;QAC9C,IACE,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;YACjD,IAAI;iBACD,KAAK,CAAC,GAAG,CAAC;iBACV,IAAI,CACH,CAAC,IAAI,EAAE,EAAE,CACP,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CACjE;YAEH,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC9C,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;YAC5D,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC9C,MAAM,OAAO,GAAuB,EAAE,CAAC;QACvC,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7C,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE;gBAC7B,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAC1B,IAAI,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI;gBAAE,MAAM;QACjC,CAAC;QACD,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI;YAC7B,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;QAC3B,MAAM,OAAO,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,IAAI,OAAO,CAAC,KAAK,KAAK,CAAC;YAC1C,MAAM,IAAI,WAAW,CAAC,oBAAoB,CAAC,CAAC;QAC9C,IAAI,OAAO,CAAC,IAAI,GAAG,YAAY;YAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC;QAC1E,MAAM,EAAE,GAAG,QAAQ,CACjB,IAAI,EACJ,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,SAAS,CAAC,UAAU,CACjE,CAAC;QACF,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;YAC7B,IACE,CAAC,MAAM,CAAC,MAAM,EAAE;gBAChB,MAAM,CAAC,KAAK,KAAK,CAAC;gBAClB,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;gBAC1B,MAAM,CAAC,GAAG,KAAK,OAAO,CAAC,GAAG;gBAE1B,MAAM,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;YAC/C,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC;YAC7C,IAAI,MAAM,GAAG,CAAC,CAAC;YACf,OAAO,MAAM,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC;gBAC7B,MAAM,KAAK,GAAG,QAAQ,CACpB,EAAE,EACF,KAAK,EACL,MAAM,EACN,KAAK,CAAC,MAAM,GAAG,MAAM,EACrB,MAAM,CACP,CAAC;gBACF,IAAI,CAAC,KAAK;oBAAE,MAAM;gBAClB,MAAM,IAAI,KAAK,CAAC;YAClB,CAAC;YACD,IAAI,MAAM,GAAG,YAAY;gBAAE,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC;YACpE,IAAI,CAAC;gBACH,IAAI,GAAG,IAAI,WAAW,CAAC,OAAO,EAAE;oBAC9B,KAAK,EAAE,IAAI;oBACX,SAAS,EAAE,IAAI;iBAChB,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YACvC,CAAC;YAAC,MAAM,CAAC;gBACP,MAAM,IAAI,WAAW,CAAC,iBAAiB,CAAC,CAAC;YAC3C,CAAC;YACD,IACE,KAAK,CAAC,IAAI,CAAC,KAAK,MAAM;gBACtB,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,KAAK,CAAC;gBAEhD,MAAM,IAAI,WAAW,CAAC,qBAAqB,CAAC,CAAC;QACjD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,MAAM,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC;IAC5E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG;YACP,MAAM,EAAE,OAAO;YACf,MAAM,EACJ,KAAK,YAAY,WAAW;gBAC5B,CAAC,KAAK,CAAC,MAAM,KAAK,iBAAiB;oBACjC,KAAK,CAAC,MAAM,KAAK,qBAAqB,CAAC;gBACvC,CAAC,CAAC,KAAK,CAAC,MAAM;gBACd,CAAC,CAAC,oBAAoB;SAC3B,CAAC;IACJ,CAAC;IACD,yFAAyF;IACzF,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,CAAC,CAAC;IACvB,OAAO,CAAC,UAAU,EAAE,CAAC;AACvB,CAAC,CAAC,CAAC"}