@unbrained/pm-cli 2026.6.9 → 2026.6.11

package/dist/core/diagnostics/remediation.js

@@ -24,7 +24,7 @@
  * intentionally excluded here (see pm-0hnu: "all non-extension checks").
  */
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="88ac4364-7d22-5199-8b9b-c6f40eb50d8b")}catch(e){}}();
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="0913b502-4db3-5424-9ec5-b66ccfb7fc20")}catch(e){}}();
 export const REMEDIATION_REGISTRY = Object.freeze([
     // --- pm health: directories ---
     {
@@ -75,6 +75,11 @@ export const REMEDIATION_REGISTRY = Object.freeze([
         command: "pm health --check-telemetry",
         summary: "Telemetry events are queued; they flush automatically on the next reachable command. Advisory only.",
     },
+    {
+        code: "telemetry_queue_high_retries",
+        command: "pm telemetry flush",
+        summary: "Some queued telemetry events are near retry exhaustion; flush now and verify endpoint reachability before entries are dropped.",
+    },
     {
         code: "telemetry_endpoint_probe_failed",
         command: "pm health --check-telemetry",
@@ -148,6 +153,11 @@ export const REMEDIATION_REGISTRY = Object.freeze([
         command: "pm health --refresh-vectors",
         summary: "Some items have stale embeddings; refresh vectors so semantic search results stay current.",
     },
+    {
+        code: "vectorization_embedding_identity_changed",
+        command: "pm reindex --mode semantic",
+        summary: "Embedding provider/model changed since the last index; run a semantic reindex to rebuild vectors.",
+    },
     // --- pm validate: metadata ---
     // Note: validate_metadata_missing_author has no entry on purpose. `pm update
     // --author` sets the mutation/audit author (history), not the item's
@@ -330,4 +340,4 @@ export function buildRemediationCommands(warnings) {
     return Object.values(buildRemediationMap(warnings));
 }
 //# sourceMappingURL=remediation.js.map
-//# debugId=88ac4364-7d22-5199-8b9b-c6f40eb50d8b
+//# debugId=0913b502-4db3-5424-9ec5-b66ccfb7fc20

package/dist/core/diagnostics/remediation.js.map

@@ -1 +1 @@
-{"version":3,"file":"remediation.js","sources":["core/diagnostics/remediation.ts"],"sourceRoot":"/","sourcesContent":["/**\n * Shared machine-executable remediation registry.\n *\n * `pm health` and `pm validate` both emit stable, colon-delimited warning tokens\n * (for example `history_drift_missing_stream:pm-abcd` or\n * `validate_resolution_missing_fields:3`). Agents that gate on these commands\n * previously had to hardcode the mapping from a warning code to the `pm` command\n * that fixes it. This module is the single source of truth for that mapping so\n * `pm health --json` (per-check `remediation_map`) and `pm validate --fix-hints`\n * (per-check `fix_hints`) can both surface executable remediation without any\n * duplicated, drift-prone lookup tables.\n *\n * Semantics of {@link RemediationEntry.command}: the suggested next `pm` command\n * an operator/agent should run to resolve findings with that code. Per-item\n * findings use an `<id>` placeholder (callers that have the concrete id may\n * substitute it); findings whose only fix is a manual file edit point at the\n * most useful diagnostic/repair command and describe the manual step in\n * {@link RemediationEntry.summary}.\n */\n\nexport interface RemediationEntry {\n  /**\n   * Stable warning-code prefix this entry resolves. A warning matches when it\n   * equals this code or begins with `<code>:`. Registry codes are mutually\n   * exclusive under that colon-boundary rule (no code is a `:`-delimited prefix\n   * of another — e.g. `settings:id_prefix_empty` is distinct from a bare\n   * `settings`, which is intentionally not registered), so `resolveRemediation`\n   * uses first-match with no ordering dependency.\n   */\n  readonly code: string;\n  /** Executable `pm` command (or imperative) that resolves the finding. May contain an `<id>` placeholder. */\n  readonly command: string;\n  /** One-line description of what the command does / which manual step it covers. */\n  readonly summary: string;\n}\n\n/**\n * Registry of every non-extension `pm health` / `pm validate` warning code and\n * its remediation. Extension findings keep their richer, contextual\n * `details.triage.remediation` produced by the extension health triage and are\n * intentionally excluded here (see pm-0hnu: \"all non-extension checks\").\n */\nexport const REMEDIATION_REGISTRY: readonly RemediationEntry[] = Object.freeze([\n  // --- pm health: directories ---\n  {\n    code: \"missing_directory\",\n    command: \"pm init\",\n    summary: \"Recreate missing tracker directories (pm init is idempotent and restores the scaffold).\",\n  },\n  // --- pm health: settings (read/parse) ---\n  {\n    code: \"settings_read_invalid_json\",\n    command: \"pm config list --json\",\n    summary:\n      \"settings.json is not valid JSON and pm fell back to defaults; fix the syntax error in the reported path, then re-run.\",\n  },\n  {\n    code: \"settings_read_invalid_schema\",\n    command: \"pm config list --json\",\n    summary:\n      \"settings.json failed schema validation and pm fell back to defaults; correct the reported key in the file, then re-run.\",\n  },\n  {\n    code: \"settings_read_merge_failed\",\n    command: \"pm config list --json\",\n    summary: \"Global/project settings could not be merged; reconcile the conflicting keys in the reported settings files.\",\n  },\n  // --- pm health: settings_values ---\n  {\n    code: \"settings:id_prefix_empty\",\n    command: \"pm config list --json\",\n    summary: 'id_prefix is empty; set a non-empty \"id_prefix\" in settings.json so generated item ids are well-formed.',\n  },\n  {\n    code: \"settings:locks_ttl_non_positive\",\n    command: \"pm config list --json\",\n    summary: 'locks.ttl_seconds must be positive; set a positive \"locks.ttl_seconds\" in settings.json.',\n  },\n  // --- pm health: telemetry (advisory) ---\n  {\n    code: \"telemetry_state_invalid_json\",\n    command: \"pm health --check-telemetry\",\n    summary: \"Local telemetry state file is corrupt; pm recreates it on the next flush. Advisory only.\",\n  },\n  {\n    code: \"telemetry_queue_invalid_rows\",\n    command: \"pm health --check-telemetry\",\n    summary: \"The telemetry queue has unparseable rows; they are skipped on the next flush. Advisory only.\",\n  },\n  {\n    code: \"telemetry_queue_pending\",\n    command: \"pm health --check-telemetry\",\n    summary: \"Telemetry events are queued; they flush automatically on the next reachable command. Advisory only.\",\n  },\n  {\n    code: \"telemetry_endpoint_probe_failed\",\n    command: \"pm health --check-telemetry\",\n    summary: \"The telemetry endpoint is unreachable; events stay queued until it recovers. Advisory only.\",\n  },\n  {\n    code: \"telemetry_endpoint_probe_http_status\",\n    command: \"pm health --check-telemetry\",\n    summary: \"The telemetry endpoint returned a non-success status; events stay queued until it recovers. Advisory only.\",\n  },\n  {\n    code: \"telemetry_schema_version_behind\",\n    command: \"pm health --check-telemetry\",\n    summary: \"Client schema is behind server; upgrade pm-cli to emit the latest event shape.\",\n  },\n  // --- pm health: integrity ---\n  {\n    code: \"integrity_item_unreadable\",\n    command: \"pm validate --check-files --verbose-diagnostics\",\n    summary: \"An item file could not be read; restore or repair the file at the reported path.\",\n  },\n  {\n    code: \"integrity_item_parse_failed\",\n    command: \"pm validate --check-files --verbose-diagnostics\",\n    summary: \"An item file failed to parse; fix the malformed front matter at the reported path.\",\n  },\n  {\n    code: \"integrity_item_conflict_marker\",\n    command: \"pm validate --check-files --verbose-diagnostics\",\n    summary: \"An item file contains Git conflict markers; resolve the <<<<<<< / >>>>>>> markers at the reported line.\",\n  },\n  {\n    code: \"integrity_history_unreadable\",\n    command: \"pm history-repair <id>\",\n    summary: \"A history stream could not be read; re-anchor the affected item's history chain.\",\n  },\n  {\n    code: \"integrity_history_invalid_json\",\n    command: \"pm history-repair <id>\",\n    summary: \"A history stream contains invalid JSON; re-anchor the affected item's history chain.\",\n  },\n  {\n    code: \"integrity_history_conflict_marker\",\n    command: \"pm history-repair <id>\",\n    summary: \"A history stream contains Git conflict markers; resolve the markers, then re-anchor the chain.\",\n  },\n  // --- pm health: history_drift ---\n  {\n    code: \"history_drift_missing_stream\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item has no history stream; re-anchor the chain to rebuild it.\",\n  },\n  {\n    code: \"history_drift_unreadable_stream\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item's history stream is unreadable; re-anchor the chain.\",\n  },\n  {\n    code: \"history_drift_hash_mismatch\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item's content hash no longer matches its history; re-anchor the chain.\",\n  },\n  {\n    code: \"history_drift_chain_mismatch\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item's history chain is broken; re-anchor the chain.\",\n  },\n  // --- pm health: vectorization ---\n  {\n    code: \"vectorization_stale_items_remaining\",\n    command: \"pm health --refresh-vectors\",\n    summary: \"Some items have stale embeddings; refresh vectors so semantic search results stay current.\",\n  },\n  // --- pm validate: metadata ---\n  // Note: validate_metadata_missing_author has no entry on purpose. `pm update\n  // --author` sets the mutation/audit author (history), not the item's\n  // `metadata.author` front-matter field, and there is no CLI flag that writes\n  // that field — so emitting a command here would record an audit entry without\n  // clearing the finding. A missing item author must be restored at the source.\n  {\n    code: \"validate_metadata_missing_acceptance_criteria\",\n    command: 'pm update <id> --acceptance-criteria \"<criteria>\"',\n    summary: \"Backfill the missing acceptance criteria on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_estimate\",\n    command: 'pm update <id> --estimate \"<estimate>\"',\n    summary: \"Backfill the missing estimate on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_close_reason\",\n    command: 'pm update <id> --close-reason \"<reason>\"',\n    summary: \"Backfill the missing close reason on the reported closed item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_reviewer\",\n    command: 'pm update <id> --reviewer \"<name>\"',\n    summary: \"Backfill the missing reviewer on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_risk\",\n    command: 'pm update <id> --risk \"<level>\"',\n    summary: \"Backfill the missing risk on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_confidence\",\n    command: 'pm update <id> --confidence \"<level>\"',\n    summary: \"Backfill the missing confidence on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_sprint\",\n    command: 'pm update <id> --sprint \"<sprint>\"',\n    summary: \"Backfill the missing sprint on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_release\",\n    command: 'pm update <id> --release \"<release>\"',\n    summary: \"Backfill the missing release on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_custom_profile_missing_required_fields\",\n    command: 'pm config set metadata-required-fields --criterion \"<field>\"',\n    summary:\n      \"Config-driven finding: the custom metadata profile has no required fields configured and falls back to core, so configure the fields rather than mutating items.\",\n  },\n  // --- pm validate: resolution ---\n  {\n    code: \"validate_resolution_missing_fields\",\n    command: 'pm update <id> --resolution \"<how resolved>\"',\n    summary: \"Backfill resolution / expected_result / actual_result on the reported closed item(s).\",\n  },\n  // --- pm validate: lifecycle ---\n  {\n    code: \"validate_lifecycle_active_closure_like_metadata\",\n    command: \"pm update <id> --unset <closure-like-field>\",\n    summary:\n      \"Clear the closure-like field the validator flags on this active item — the detail row names it (resolution / actual-result / blocked-reason) — or close the item if it is actually done.\",\n  },\n  {\n    code: \"validate_lifecycle_active_terminal_parent\",\n    command: \"pm update <id> --parent <active-parent-id>\",\n    summary: \"Reopen the terminal parent or move the active child under a non-terminal parent.\",\n  },\n  {\n    code: \"validate_lifecycle_stale_blockers\",\n    command: \"pm update <id> --unset blocked-by --unset blocked-reason\",\n    summary:\n      \"Resolve the stale blocker the validator flags: clear blocked-by/blocked-reason when they linger on a non-blocked item or report a resolved blocker; if instead a blocked item is missing blocker context, add the context or move it out of a blocked status.\",\n  },\n  {\n    code: \"validate_lifecycle_dependency_cycles_error\",\n    command: \"pm update <id> --dep-remove <dep-id>\",\n    summary: \"Break the dependency cycle by removing one edge from the reported cycle.\",\n  },\n  {\n    code: \"validate_lifecycle_dependency_cycles\",\n    command: \"pm update <id> --dep-remove <dep-id>\",\n    summary: \"Break the dependency cycle by removing one edge from the reported cycle.\",\n  },\n  // --- pm validate: files ---\n  {\n    code: \"validate_files_missing_linked_paths\",\n    command: \"pm <files|docs> <id> --remove <path>\",\n    summary:\n      \"The check spans both item.files and item.docs under one code: restore the missing linked artifact, or unlink it with pm files (linked file) or pm docs (linked doc).\",\n  },\n  {\n    code: \"validate_files_orphaned_paths\",\n    command: \"pm <files|docs> <id> --add <path>\",\n    summary:\n      \"Link the orphaned artifact with pm files (file) or pm docs (doc), or remove it from the workspace.\",\n  },\n  {\n    code: \"validate_files_tracked_all_strict_forces_pm_internals\",\n    command: \"pm validate --check-files --include-pm-internals\",\n    summary: \"tracked-all-strict scan flagged pm internals; re-run with --include-pm-internals or a softer --scan-mode.\",\n  },\n  // --- pm validate: history_drift ---\n  {\n    code: \"validate_history_drift_missing_streams\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items missing a history stream.\",\n  },\n  {\n    code: \"validate_history_drift_unreadable_streams\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items with an unreadable history stream.\",\n  },\n  {\n    code: \"validate_history_drift_hash_mismatches\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items whose content hash drifted.\",\n  },\n  {\n    code: \"validate_history_drift_chain_mismatches\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items with a broken history chain.\",\n  },\n  // --- pm validate: command_references ---\n  {\n    code: \"validate_command_references_stale_pm_ids\",\n    command: 'pm update <id> --replace-tests --test \"command=<corrected-command>\" [--test ...]',\n    summary:\n      \"Correct the stale pm-ID inside the item's linked test command (the check scans tests[].command, not the body). --replace-tests overwrites the entire tests list, so re-include the item's other linked tests in the same call.\",\n  },\n]);\n\n/**\n * Resolve the remediation entry for a warning token, or `undefined` when no\n * entry is registered. A warning matches an entry when it equals the entry code\n * or begins with `<code>:` (the colon boundary keeps sibling codes such as\n * `validate_lifecycle_dependency_cycles` and\n * `validate_lifecycle_dependency_cycles_error` disjoint).\n *\n * First match is intentional and correct: registry codes are mutually exclusive\n * under the colon-boundary rule, so at most one entry can ever match a warning\n * and order is irrelevant. That invariant is enforced by a test (see\n * remediation-registry.spec.ts \"keeps every registry code mutually exclusive\"),\n * which is why this stays a simple linear scan rather than a longest-prefix\n * search — a longest-prefix tie-break is unreachable with disjoint codes.\n *\n * Accepts unknown input defensively (this is an exported helper SDK consumers\n * may call from untyped JS): a non-string `warning` resolves to `undefined`.\n */\nexport function resolveRemediation(warning: string): RemediationEntry | undefined {\n  if (typeof warning !== \"string\") {\n    return undefined;\n  }\n  const normalized = warning.trim();\n  for (const entry of REMEDIATION_REGISTRY) {\n    if (normalized === entry.code || normalized.startsWith(`${entry.code}:`)) {\n      return entry;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Build a compact `remediation_map` (code -> command) for a set of warning\n * tokens. First match wins per code; unknown codes are skipped. Used by\n * `pm health --json` per-check details and as the source of deduped executable\n * commands for `pm validate --fix-hints`.\n */\nexport function buildRemediationMap(warnings: Iterable<string>): Record<string, string> {\n  const map: Record<string, string> = {};\n  for (const warning of warnings) {\n    const entry = resolveRemediation(warning);\n    if (entry !== undefined && !Object.prototype.hasOwnProperty.call(map, entry.code)) {\n      map[entry.code] = entry.command;\n    }\n  }\n  return map;\n}\n\n/**\n * Build a deduped, ordered list of executable remediation commands for a set of\n * warning tokens (one command per distinct matched code). Used by\n * `pm validate --fix-hints` for checks that do not already emit per-row\n * remediation commands.\n */\nexport function buildRemediationCommands(warnings: Iterable<string>): string[] {\n  return Object.values(buildRemediationMap(warnings));\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH;;;;;GAKG;;;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAgC,MAAM,CAAC,MAAM,CAAC;IAC7E,iCAAiC;IACjC;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,yFAAyF;KACnG;IACD,2CAA2C;IAC3C;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EACL,uHAAuH;KAC1H;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EACL,yHAAyH;KAC5H;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,6GAA6G;KACvH;IACD,qCAAqC;IACrC;QACE,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,yGAAyG;KACnH;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,0FAA0F;KACpG;IACD,0CAA0C;IAC1C;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,0FAA0F;KACpG;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,8FAA8F;KACxG;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,qGAAqG;KAC/G;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,6FAA6F;KACvG;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,4GAA4G;KACtH;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,gFAAgF;KAC1F;IACD,+BAA+B;IAC/B;QACE,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,oFAAoF;KAC9F;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,yGAAyG;KACnH;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,sFAAsF;KAChG;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,gGAAgG;KAC1G;IACD,mCAAmC;IACnC;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,oEAAoE;KAC9E;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,+DAA+D;KACzE;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,6EAA6E;KACvF;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,0DAA0D;KACpE;IACD,mCAAmC;IACnC;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,4FAA4F;KACtG;IACD,gCAAgC;IAChC,6EAA6E;IAC7E,qEAAqE;IACrE,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E;QACE,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,mEAAmE;KAC7E;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,wDAAwD;KAClE;IACD;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,0CAA0C;QACnD,OAAO,EAAE,mEAAmE;KAC7E;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,oCAAoC;QAC7C,OAAO,EAAE,wDAAwD;KAClE;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,iCAAiC;QAC1C,OAAO,EAAE,oDAAoD;KAC9D;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,uCAAuC;QAChD,OAAO,EAAE,0DAA0D;KACpE;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,oCAAoC;QAC7C,OAAO,EAAE,sDAAsD;KAChE;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,sCAAsC;QAC/C,OAAO,EAAE,uDAAuD;KACjE;IACD;QACE,IAAI,EAAE,0DAA0D;QAChE,OAAO,EAAE,8DAA8D;QACvE,OAAO,EACL,kKAAkK;KACrK;IACD,kCAAkC;IAClC;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,8CAA8C;QACvD,OAAO,EAAE,uFAAuF;KACjG;IACD,iCAAiC;IACjC;QACE,IAAI,EAAE,iDAAiD;QACvD,OAAO,EAAE,6CAA6C;QACtD,OAAO,EACL,0LAA0L;KAC7L;IACD;QACE,IAAI,EAAE,2CAA2C;QACjD,OAAO,EAAE,4CAA4C;QACrD,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,0DAA0D;QACnE,OAAO,EACL,+PAA+P;KAClQ;IACD;QACE,IAAI,EAAE,4CAA4C;QAClD,OAAO,EAAE,sCAAsC;QAC/C,OAAO,EAAE,0EAA0E;KACpF;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,sCAAsC;QAC/C,OAAO,EAAE,0EAA0E;KACpF;IACD,6BAA6B;IAC7B;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,sCAAsC;QAC/C,OAAO,EACL,sKAAsK;KACzK;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EACL,oGAAoG;KACvG;IACD;QACE,IAAI,EAAE,uDAAuD;QAC7D,OAAO,EAAE,kDAAkD;QAC3D,OAAO,EAAE,2GAA2G;KACrH;IACD,qCAAqC;IACrC;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,qEAAqE;KAC/E;IACD;QACE,IAAI,EAAE,2CAA2C;QACjD,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,8EAA8E;KACxF;IACD;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,uEAAuE;KACjF;IACD;QACE,IAAI,EAAE,yCAAyC;QAC/C,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,wEAAwE;KAClF;IACD,0CAA0C;IAC1C;QACE,IAAI,EAAE,0CAA0C;QAChD,OAAO,EAAE,kFAAkF;QAC3F,OAAO,EACL,gOAAgO;KACnO;CACF,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,IAAI,UAAU,KAAK,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA0B;IAC5D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAA0B;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC","debugId":"88ac4364-7d22-5199-8b9b-c6f40eb50d8b"}
+{"version":3,"file":"remediation.js","sources":["core/diagnostics/remediation.ts"],"sourceRoot":"/","sourcesContent":["/**\n * Shared machine-executable remediation registry.\n *\n * `pm health` and `pm validate` both emit stable, colon-delimited warning tokens\n * (for example `history_drift_missing_stream:pm-abcd` or\n * `validate_resolution_missing_fields:3`). Agents that gate on these commands\n * previously had to hardcode the mapping from a warning code to the `pm` command\n * that fixes it. This module is the single source of truth for that mapping so\n * `pm health --json` (per-check `remediation_map`) and `pm validate --fix-hints`\n * (per-check `fix_hints`) can both surface executable remediation without any\n * duplicated, drift-prone lookup tables.\n *\n * Semantics of {@link RemediationEntry.command}: the suggested next `pm` command\n * an operator/agent should run to resolve findings with that code. Per-item\n * findings use an `<id>` placeholder (callers that have the concrete id may\n * substitute it); findings whose only fix is a manual file edit point at the\n * most useful diagnostic/repair command and describe the manual step in\n * {@link RemediationEntry.summary}.\n */\n\nexport interface RemediationEntry {\n  /**\n   * Stable warning-code prefix this entry resolves. A warning matches when it\n   * equals this code or begins with `<code>:`. Registry codes are mutually\n   * exclusive under that colon-boundary rule (no code is a `:`-delimited prefix\n   * of another — e.g. `settings:id_prefix_empty` is distinct from a bare\n   * `settings`, which is intentionally not registered), so `resolveRemediation`\n   * uses first-match with no ordering dependency.\n   */\n  readonly code: string;\n  /** Executable `pm` command (or imperative) that resolves the finding. May contain an `<id>` placeholder. */\n  readonly command: string;\n  /** One-line description of what the command does / which manual step it covers. */\n  readonly summary: string;\n}\n\n/**\n * Registry of every non-extension `pm health` / `pm validate` warning code and\n * its remediation. Extension findings keep their richer, contextual\n * `details.triage.remediation` produced by the extension health triage and are\n * intentionally excluded here (see pm-0hnu: \"all non-extension checks\").\n */\nexport const REMEDIATION_REGISTRY: readonly RemediationEntry[] = Object.freeze([\n  // --- pm health: directories ---\n  {\n    code: \"missing_directory\",\n    command: \"pm init\",\n    summary: \"Recreate missing tracker directories (pm init is idempotent and restores the scaffold).\",\n  },\n  // --- pm health: settings (read/parse) ---\n  {\n    code: \"settings_read_invalid_json\",\n    command: \"pm config list --json\",\n    summary:\n      \"settings.json is not valid JSON and pm fell back to defaults; fix the syntax error in the reported path, then re-run.\",\n  },\n  {\n    code: \"settings_read_invalid_schema\",\n    command: \"pm config list --json\",\n    summary:\n      \"settings.json failed schema validation and pm fell back to defaults; correct the reported key in the file, then re-run.\",\n  },\n  {\n    code: \"settings_read_merge_failed\",\n    command: \"pm config list --json\",\n    summary: \"Global/project settings could not be merged; reconcile the conflicting keys in the reported settings files.\",\n  },\n  // --- pm health: settings_values ---\n  {\n    code: \"settings:id_prefix_empty\",\n    command: \"pm config list --json\",\n    summary: 'id_prefix is empty; set a non-empty \"id_prefix\" in settings.json so generated item ids are well-formed.',\n  },\n  {\n    code: \"settings:locks_ttl_non_positive\",\n    command: \"pm config list --json\",\n    summary: 'locks.ttl_seconds must be positive; set a positive \"locks.ttl_seconds\" in settings.json.',\n  },\n  // --- pm health: telemetry (advisory) ---\n  {\n    code: \"telemetry_state_invalid_json\",\n    command: \"pm health --check-telemetry\",\n    summary: \"Local telemetry state file is corrupt; pm recreates it on the next flush. Advisory only.\",\n  },\n  {\n    code: \"telemetry_queue_invalid_rows\",\n    command: \"pm health --check-telemetry\",\n    summary: \"The telemetry queue has unparseable rows; they are skipped on the next flush. Advisory only.\",\n  },\n  {\n    code: \"telemetry_queue_pending\",\n    command: \"pm health --check-telemetry\",\n    summary: \"Telemetry events are queued; they flush automatically on the next reachable command. Advisory only.\",\n  },\n  {\n    code: \"telemetry_queue_high_retries\",\n    command: \"pm telemetry flush\",\n    summary:\n      \"Some queued telemetry events are near retry exhaustion; flush now and verify endpoint reachability before entries are dropped.\",\n  },\n  {\n    code: \"telemetry_endpoint_probe_failed\",\n    command: \"pm health --check-telemetry\",\n    summary: \"The telemetry endpoint is unreachable; events stay queued until it recovers. Advisory only.\",\n  },\n  {\n    code: \"telemetry_endpoint_probe_http_status\",\n    command: \"pm health --check-telemetry\",\n    summary: \"The telemetry endpoint returned a non-success status; events stay queued until it recovers. Advisory only.\",\n  },\n  {\n    code: \"telemetry_schema_version_behind\",\n    command: \"pm health --check-telemetry\",\n    summary: \"Client schema is behind server; upgrade pm-cli to emit the latest event shape.\",\n  },\n  // --- pm health: integrity ---\n  {\n    code: \"integrity_item_unreadable\",\n    command: \"pm validate --check-files --verbose-diagnostics\",\n    summary: \"An item file could not be read; restore or repair the file at the reported path.\",\n  },\n  {\n    code: \"integrity_item_parse_failed\",\n    command: \"pm validate --check-files --verbose-diagnostics\",\n    summary: \"An item file failed to parse; fix the malformed front matter at the reported path.\",\n  },\n  {\n    code: \"integrity_item_conflict_marker\",\n    command: \"pm validate --check-files --verbose-diagnostics\",\n    summary: \"An item file contains Git conflict markers; resolve the <<<<<<< / >>>>>>> markers at the reported line.\",\n  },\n  {\n    code: \"integrity_history_unreadable\",\n    command: \"pm history-repair <id>\",\n    summary: \"A history stream could not be read; re-anchor the affected item's history chain.\",\n  },\n  {\n    code: \"integrity_history_invalid_json\",\n    command: \"pm history-repair <id>\",\n    summary: \"A history stream contains invalid JSON; re-anchor the affected item's history chain.\",\n  },\n  {\n    code: \"integrity_history_conflict_marker\",\n    command: \"pm history-repair <id>\",\n    summary: \"A history stream contains Git conflict markers; resolve the markers, then re-anchor the chain.\",\n  },\n  // --- pm health: history_drift ---\n  {\n    code: \"history_drift_missing_stream\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item has no history stream; re-anchor the chain to rebuild it.\",\n  },\n  {\n    code: \"history_drift_unreadable_stream\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item's history stream is unreadable; re-anchor the chain.\",\n  },\n  {\n    code: \"history_drift_hash_mismatch\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item's content hash no longer matches its history; re-anchor the chain.\",\n  },\n  {\n    code: \"history_drift_chain_mismatch\",\n    command: \"pm history-repair <id>\",\n    summary: \"The item's history chain is broken; re-anchor the chain.\",\n  },\n  // --- pm health: vectorization ---\n  {\n    code: \"vectorization_stale_items_remaining\",\n    command: \"pm health --refresh-vectors\",\n    summary: \"Some items have stale embeddings; refresh vectors so semantic search results stay current.\",\n  },\n  {\n    code: \"vectorization_embedding_identity_changed\",\n    command: \"pm reindex --mode semantic\",\n    summary: \"Embedding provider/model changed since the last index; run a semantic reindex to rebuild vectors.\",\n  },\n  // --- pm validate: metadata ---\n  // Note: validate_metadata_missing_author has no entry on purpose. `pm update\n  // --author` sets the mutation/audit author (history), not the item's\n  // `metadata.author` front-matter field, and there is no CLI flag that writes\n  // that field — so emitting a command here would record an audit entry without\n  // clearing the finding. A missing item author must be restored at the source.\n  {\n    code: \"validate_metadata_missing_acceptance_criteria\",\n    command: 'pm update <id> --acceptance-criteria \"<criteria>\"',\n    summary: \"Backfill the missing acceptance criteria on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_estimate\",\n    command: 'pm update <id> --estimate \"<estimate>\"',\n    summary: \"Backfill the missing estimate on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_close_reason\",\n    command: 'pm update <id> --close-reason \"<reason>\"',\n    summary: \"Backfill the missing close reason on the reported closed item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_reviewer\",\n    command: 'pm update <id> --reviewer \"<name>\"',\n    summary: \"Backfill the missing reviewer on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_risk\",\n    command: 'pm update <id> --risk \"<level>\"',\n    summary: \"Backfill the missing risk on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_confidence\",\n    command: 'pm update <id> --confidence \"<level>\"',\n    summary: \"Backfill the missing confidence on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_sprint\",\n    command: 'pm update <id> --sprint \"<sprint>\"',\n    summary: \"Backfill the missing sprint on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_missing_release\",\n    command: 'pm update <id> --release \"<release>\"',\n    summary: \"Backfill the missing release on the reported item(s).\",\n  },\n  {\n    code: \"validate_metadata_custom_profile_missing_required_fields\",\n    command: 'pm config set metadata-required-fields --criterion \"<field>\"',\n    summary:\n      \"Config-driven finding: the custom metadata profile has no required fields configured and falls back to core, so configure the fields rather than mutating items.\",\n  },\n  // --- pm validate: resolution ---\n  {\n    code: \"validate_resolution_missing_fields\",\n    command: 'pm update <id> --resolution \"<how resolved>\"',\n    summary: \"Backfill resolution / expected_result / actual_result on the reported closed item(s).\",\n  },\n  // --- pm validate: lifecycle ---\n  {\n    code: \"validate_lifecycle_active_closure_like_metadata\",\n    command: \"pm update <id> --unset <closure-like-field>\",\n    summary:\n      \"Clear the closure-like field the validator flags on this active item — the detail row names it (resolution / actual-result / blocked-reason) — or close the item if it is actually done.\",\n  },\n  {\n    code: \"validate_lifecycle_active_terminal_parent\",\n    command: \"pm update <id> --parent <active-parent-id>\",\n    summary: \"Reopen the terminal parent or move the active child under a non-terminal parent.\",\n  },\n  {\n    code: \"validate_lifecycle_stale_blockers\",\n    command: \"pm update <id> --unset blocked-by --unset blocked-reason\",\n    summary:\n      \"Resolve the stale blocker the validator flags: clear blocked-by/blocked-reason when they linger on a non-blocked item or report a resolved blocker; if instead a blocked item is missing blocker context, add the context or move it out of a blocked status.\",\n  },\n  {\n    code: \"validate_lifecycle_dependency_cycles_error\",\n    command: \"pm update <id> --dep-remove <dep-id>\",\n    summary: \"Break the dependency cycle by removing one edge from the reported cycle.\",\n  },\n  {\n    code: \"validate_lifecycle_dependency_cycles\",\n    command: \"pm update <id> --dep-remove <dep-id>\",\n    summary: \"Break the dependency cycle by removing one edge from the reported cycle.\",\n  },\n  // --- pm validate: files ---\n  {\n    code: \"validate_files_missing_linked_paths\",\n    command: \"pm <files|docs> <id> --remove <path>\",\n    summary:\n      \"The check spans both item.files and item.docs under one code: restore the missing linked artifact, or unlink it with pm files (linked file) or pm docs (linked doc).\",\n  },\n  {\n    code: \"validate_files_orphaned_paths\",\n    command: \"pm <files|docs> <id> --add <path>\",\n    summary:\n      \"Link the orphaned artifact with pm files (file) or pm docs (doc), or remove it from the workspace.\",\n  },\n  {\n    code: \"validate_files_tracked_all_strict_forces_pm_internals\",\n    command: \"pm validate --check-files --include-pm-internals\",\n    summary: \"tracked-all-strict scan flagged pm internals; re-run with --include-pm-internals or a softer --scan-mode.\",\n  },\n  // --- pm validate: history_drift ---\n  {\n    code: \"validate_history_drift_missing_streams\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items missing a history stream.\",\n  },\n  {\n    code: \"validate_history_drift_unreadable_streams\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items with an unreadable history stream.\",\n  },\n  {\n    code: \"validate_history_drift_hash_mismatches\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items whose content hash drifted.\",\n  },\n  {\n    code: \"validate_history_drift_chain_mismatches\",\n    command: \"pm history-repair <id>\",\n    summary: \"Re-anchor the history chains of the items with a broken history chain.\",\n  },\n  // --- pm validate: command_references ---\n  {\n    code: \"validate_command_references_stale_pm_ids\",\n    command: 'pm update <id> --replace-tests --test \"command=<corrected-command>\" [--test ...]',\n    summary:\n      \"Correct the stale pm-ID inside the item's linked test command (the check scans tests[].command, not the body). --replace-tests overwrites the entire tests list, so re-include the item's other linked tests in the same call.\",\n  },\n]);\n\n/**\n * Resolve the remediation entry for a warning token, or `undefined` when no\n * entry is registered. A warning matches an entry when it equals the entry code\n * or begins with `<code>:` (the colon boundary keeps sibling codes such as\n * `validate_lifecycle_dependency_cycles` and\n * `validate_lifecycle_dependency_cycles_error` disjoint).\n *\n * First match is intentional and correct: registry codes are mutually exclusive\n * under the colon-boundary rule, so at most one entry can ever match a warning\n * and order is irrelevant. That invariant is enforced by a test (see\n * remediation-registry.spec.ts \"keeps every registry code mutually exclusive\"),\n * which is why this stays a simple linear scan rather than a longest-prefix\n * search — a longest-prefix tie-break is unreachable with disjoint codes.\n *\n * Accepts unknown input defensively (this is an exported helper SDK consumers\n * may call from untyped JS): a non-string `warning` resolves to `undefined`.\n */\nexport function resolveRemediation(warning: string): RemediationEntry | undefined {\n  if (typeof warning !== \"string\") {\n    return undefined;\n  }\n  const normalized = warning.trim();\n  for (const entry of REMEDIATION_REGISTRY) {\n    if (normalized === entry.code || normalized.startsWith(`${entry.code}:`)) {\n      return entry;\n    }\n  }\n  return undefined;\n}\n\n/**\n * Build a compact `remediation_map` (code -> command) for a set of warning\n * tokens. First match wins per code; unknown codes are skipped. Used by\n * `pm health --json` per-check details and as the source of deduped executable\n * commands for `pm validate --fix-hints`.\n */\nexport function buildRemediationMap(warnings: Iterable<string>): Record<string, string> {\n  const map: Record<string, string> = {};\n  for (const warning of warnings) {\n    const entry = resolveRemediation(warning);\n    if (entry !== undefined && !Object.prototype.hasOwnProperty.call(map, entry.code)) {\n      map[entry.code] = entry.command;\n    }\n  }\n  return map;\n}\n\n/**\n * Build a deduped, ordered list of executable remediation commands for a set of\n * warning tokens (one command per distinct matched code). Used by\n * `pm validate --fix-hints` for checks that do not already emit per-row\n * remediation commands.\n */\nexport function buildRemediationCommands(warnings: Iterable<string>): string[] {\n  return Object.values(buildRemediationMap(warnings));\n}\n"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAkBH;;;;;GAKG;;;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAgC,MAAM,CAAC,MAAM,CAAC;IAC7E,iCAAiC;IACjC;QACE,IAAI,EAAE,mBAAmB;QACzB,OAAO,EAAE,SAAS;QAClB,OAAO,EAAE,yFAAyF;KACnG;IACD,2CAA2C;IAC3C;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EACL,uHAAuH;KAC1H;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EACL,yHAAyH;KAC5H;IACD;QACE,IAAI,EAAE,4BAA4B;QAClC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,6GAA6G;KACvH;IACD,qCAAqC;IACrC;QACE,IAAI,EAAE,0BAA0B;QAChC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,yGAAyG;KACnH;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,uBAAuB;QAChC,OAAO,EAAE,0FAA0F;KACpG;IACD,0CAA0C;IAC1C;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,0FAA0F;KACpG;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,8FAA8F;KACxG;IACD;QACE,IAAI,EAAE,yBAAyB;QAC/B,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,qGAAqG;KAC/G;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,oBAAoB;QAC7B,OAAO,EACL,gIAAgI;KACnI;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,6FAA6F;KACvG;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,4GAA4G;KACtH;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,gFAAgF;KAC1F;IACD,+BAA+B;IAC/B;QACE,IAAI,EAAE,2BAA2B;QACjC,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,oFAAoF;KAC9F;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,iDAAiD;QAC1D,OAAO,EAAE,yGAAyG;KACnH;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,sFAAsF;KAChG;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,gGAAgG;KAC1G;IACD,mCAAmC;IACnC;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,oEAAoE;KAC9E;IACD;QACE,IAAI,EAAE,iCAAiC;QACvC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,+DAA+D;KACzE;IACD;QACE,IAAI,EAAE,6BAA6B;QACnC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,6EAA6E;KACvF;IACD;QACE,IAAI,EAAE,8BAA8B;QACpC,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,0DAA0D;KACpE;IACD,mCAAmC;IACnC;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,6BAA6B;QACtC,OAAO,EAAE,4FAA4F;KACtG;IACD;QACE,IAAI,EAAE,0CAA0C;QAChD,OAAO,EAAE,4BAA4B;QACrC,OAAO,EAAE,mGAAmG;KAC7G;IACD,gCAAgC;IAChC,6EAA6E;IAC7E,qEAAqE;IACrE,6EAA6E;IAC7E,8EAA8E;IAC9E,8EAA8E;IAC9E;QACE,IAAI,EAAE,+CAA+C;QACrD,OAAO,EAAE,mDAAmD;QAC5D,OAAO,EAAE,mEAAmE;KAC7E;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,wCAAwC;QACjD,OAAO,EAAE,wDAAwD;KAClE;IACD;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,0CAA0C;QACnD,OAAO,EAAE,mEAAmE;KAC7E;IACD;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,oCAAoC;QAC7C,OAAO,EAAE,wDAAwD;KAClE;IACD;QACE,IAAI,EAAE,gCAAgC;QACtC,OAAO,EAAE,iCAAiC;QAC1C,OAAO,EAAE,oDAAoD;KAC9D;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,uCAAuC;QAChD,OAAO,EAAE,0DAA0D;KACpE;IACD;QACE,IAAI,EAAE,kCAAkC;QACxC,OAAO,EAAE,oCAAoC;QAC7C,OAAO,EAAE,sDAAsD;KAChE;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,sCAAsC;QAC/C,OAAO,EAAE,uDAAuD;KACjE;IACD;QACE,IAAI,EAAE,0DAA0D;QAChE,OAAO,EAAE,8DAA8D;QACvE,OAAO,EACL,kKAAkK;KACrK;IACD,kCAAkC;IAClC;QACE,IAAI,EAAE,oCAAoC;QAC1C,OAAO,EAAE,8CAA8C;QACvD,OAAO,EAAE,uFAAuF;KACjG;IACD,iCAAiC;IACjC;QACE,IAAI,EAAE,iDAAiD;QACvD,OAAO,EAAE,6CAA6C;QACtD,OAAO,EACL,0LAA0L;KAC7L;IACD;QACE,IAAI,EAAE,2CAA2C;QACjD,OAAO,EAAE,4CAA4C;QACrD,OAAO,EAAE,kFAAkF;KAC5F;IACD;QACE,IAAI,EAAE,mCAAmC;QACzC,OAAO,EAAE,0DAA0D;QACnE,OAAO,EACL,+PAA+P;KAClQ;IACD;QACE,IAAI,EAAE,4CAA4C;QAClD,OAAO,EAAE,sCAAsC;QAC/C,OAAO,EAAE,0EAA0E;KACpF;IACD;QACE,IAAI,EAAE,sCAAsC;QAC5C,OAAO,EAAE,sCAAsC;QAC/C,OAAO,EAAE,0EAA0E;KACpF;IACD,6BAA6B;IAC7B;QACE,IAAI,EAAE,qCAAqC;QAC3C,OAAO,EAAE,sCAAsC;QAC/C,OAAO,EACL,sKAAsK;KACzK;IACD;QACE,IAAI,EAAE,+BAA+B;QACrC,OAAO,EAAE,mCAAmC;QAC5C,OAAO,EACL,oGAAoG;KACvG;IACD;QACE,IAAI,EAAE,uDAAuD;QAC7D,OAAO,EAAE,kDAAkD;QAC3D,OAAO,EAAE,2GAA2G;KACrH;IACD,qCAAqC;IACrC;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,qEAAqE;KAC/E;IACD;QACE,IAAI,EAAE,2CAA2C;QACjD,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,8EAA8E;KACxF;IACD;QACE,IAAI,EAAE,wCAAwC;QAC9C,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,uEAAuE;KACjF;IACD;QACE,IAAI,EAAE,yCAAyC;QAC/C,OAAO,EAAE,wBAAwB;QACjC,OAAO,EAAE,wEAAwE;KAClF;IACD,0CAA0C;IAC1C;QACE,IAAI,EAAE,0CAA0C;QAChD,OAAO,EAAE,kFAAkF;QAC3F,OAAO,EACL,gOAAgO;KACnO;CACF,CAAC,CAAC;AAEH;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QAChC,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;IAClC,KAAK,MAAM,KAAK,IAAI,oBAAoB,EAAE,CAAC;QACzC,IAAI,UAAU,KAAK,KAAK,CAAC,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACzE,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,QAA0B;IAC5D,MAAM,GAAG,GAA2B,EAAE,CAAC;IACvC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,KAAK,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAClF,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,OAAO,CAAC;QAClC,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,wBAAwB,CAAC,QAA0B;IACjE,OAAO,MAAM,CAAC,MAAM,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACtD,CAAC","debugId":"0913b502-4db3-5424-9ec5-b66ccfb7fc20"}

package/dist/core/extensions/extension-policy.d.ts

@@ -1,4 +1,4 @@
-import { type ExtensionCapability, type ExtensionGovernancePolicy, type ExtensionLayer, type ExtensionPolicyMode, type ExtensionPolicySurface, type ExtensionSandboxProfile, type ExtensionTrustMode } from "./extension-types.js";
+import { type ExtensionCapability, type ExtensionGovernancePolicy, type ExtensionLayer, type ExtensionPolicyMode, type ExtensionPolicySurface, type ExtensionSandboxProfile, type ExtensionTrustMode, type PmMaxVersionExceededMode, type PmMaxVersionExceededModeSetting } from "./extension-types.js";
 import type { PmSettings } from "../../types/index.js";
 interface NormalizedExtensionPolicyOverride {
     name: string;
@@ -17,9 +17,15 @@ interface NormalizedExtensionPolicyOverride {
     allowedServices: Set<string>;
     blockedServices: Set<string>;
 }
+/** Concrete per-layer resolution of `pm_max_version_exceeded_mode` (default: block). */
+export interface NormalizedPmMaxVersionExceededMode {
+    global: PmMaxVersionExceededMode;
+    project: PmMaxVersionExceededMode;
+}
 export interface NormalizedExtensionPolicy {
     mode: ExtensionPolicyMode;
     trustMode: ExtensionTrustMode;
+    pmMaxVersionExceededMode: NormalizedPmMaxVersionExceededMode;
     requireProvenance: boolean;
     trustedExtensions: Set<string>;
     defaultSandboxProfile: ExtensionSandboxProfile;
@@ -47,6 +53,13 @@ export interface PolicyExtensionRef {
     permissions?: Record<string, boolean | undefined>;
 }
 export declare function normalizePolicySandboxProfile(value: string | undefined): ExtensionSandboxProfile;
+/**
+ * Resolve `extensions.policy.pm_max_version_exceeded_mode` to a concrete
+ * per-layer mode map. Accepts a single mode string (applied to both layers) or
+ * a `{ global?, project? }` override map; anything unset or unknown defaults to
+ * the safe `"block"`.
+ */
+export declare function normalizePmMaxVersionExceededMode(value: PmMaxVersionExceededModeSetting | undefined): NormalizedPmMaxVersionExceededMode;
 export declare function normalizeExtensionPolicy(settings: PmSettings): NormalizedExtensionPolicy;
 export declare function serializeExtensionPolicy(policy: NormalizedExtensionPolicy): ExtensionGovernancePolicy;
 export declare function hydrateExtensionPolicy(policy: ExtensionGovernancePolicy): NormalizedExtensionPolicy;

package/dist/core/extensions/extension-policy.js

@@ -1,6 +1,6 @@
 
-!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="3a8acf74-cc81-5417-8ee9-30d80fde2102")}catch(e){}}();
-import { KNOWN_EXTENSION_POLICY_MODES, KNOWN_EXTENSION_POLICY_SURFACES, KNOWN_EXTENSION_SANDBOX_PROFILES, KNOWN_EXTENSION_TRUST_MODES, } from "./extension-types.js";
+!function(){try{var e="undefined"!=typeof window?window:"undefined"!=typeof global?global:"undefined"!=typeof globalThis?globalThis:"undefined"!=typeof self?self:{},n=(new e.Error).stack;n&&(e._sentryDebugIds=e._sentryDebugIds||{},e._sentryDebugIds[n]="5f65a8a3-c45a-5178-918a-32153c97cce6")}catch(e){}}();
+import { KNOWN_EXTENSION_POLICY_MODES, KNOWN_EXTENSION_POLICY_SURFACES, KNOWN_EXTENSION_SANDBOX_PROFILES, KNOWN_EXTENSION_TRUST_MODES, KNOWN_PM_MAX_VERSION_EXCEEDED_MODES, } from "./extension-types.js";
 import { isKnownExtensionCapability } from "./extension-capability-aliases.js";
 import { normalizeCommandName } from "./extension-runtime-helpers.js";
 function normalizePolicyName(value) {
@@ -57,6 +57,37 @@ export function normalizePolicySandboxProfile(value) {
     }
     return "none";
 }
+function normalizePmMaxVersionExceededModeValue(value) {
+    if (typeof value !== "string") {
+        return undefined;
+    }
+    const normalized = value.trim().toLowerCase();
+    return KNOWN_PM_MAX_VERSION_EXCEEDED_MODES.includes(normalized)
+        ? normalized
+        : undefined;
+}
+/**
+ * Resolve `extensions.policy.pm_max_version_exceeded_mode` to a concrete
+ * per-layer mode map. Accepts a single mode string (applied to both layers) or
+ * a `{ global?, project? }` override map; anything unset or unknown defaults to
+ * the safe `"block"`.
+ */
+export function normalizePmMaxVersionExceededMode(value) {
+    if (typeof value === "string") {
+        const mode = normalizePmMaxVersionExceededModeValue(value) ?? "block";
+        return { global: mode, project: mode };
+    }
+    if (typeof value === "object" && value !== null && !Array.isArray(value)) {
+        return {
+            global: normalizePmMaxVersionExceededModeValue(value.global) ?? "block",
+            project: normalizePmMaxVersionExceededModeValue(value.project) ?? "block",
+        };
+    }
+    return { global: "block", project: "block" };
+}
+function serializePmMaxVersionExceededMode(mode) {
+    return mode.global === mode.project ? mode.global : { global: mode.global, project: mode.project };
+}
 function toSortedList(values) {
     return [...new Set(values)].sort((left, right) => left.localeCompare(right));
 }
@@ -102,6 +133,7 @@ export function normalizeExtensionPolicy(settings) {
     const policy = settings.extensions.policy;
     const mode = normalizePolicyMode(policy?.mode);
     const trustMode = normalizePolicyTrustMode(policy?.trust_mode);
+    const pmMaxVersionExceededMode = normalizePmMaxVersionExceededMode(policy?.pm_max_version_exceeded_mode);
     const requireProvenance = policy?.require_provenance === true;
     const trustedExtensions = normalizePolicyStringSet(policy?.trusted_extensions);
     const defaultSandboxProfile = normalizePolicySandboxProfile(policy?.default_sandbox_profile);
@@ -147,6 +179,7 @@ export function normalizeExtensionPolicy(settings) {
     return {
         mode,
         trustMode,
+        pmMaxVersionExceededMode,
         requireProvenance,
         trustedExtensions,
         defaultSandboxProfile,
@@ -189,6 +222,7 @@ export function serializeExtensionPolicy(policy) {
     return {
         mode: policy.mode,
         trust_mode: policy.trustMode,
+        pm_max_version_exceeded_mode: serializePmMaxVersionExceededMode(policy.pmMaxVersionExceededMode),
         require_provenance: policy.requireProvenance,
         trusted_extensions: toSortedList(policy.trustedExtensions),
         default_sandbox_profile: policy.defaultSandboxProfile,
@@ -212,6 +246,7 @@ export function hydrateExtensionPolicy(policy) {
     return {
         mode: normalizePolicyMode(policy.mode),
         trustMode: normalizePolicyTrustMode(policy.trust_mode),
+        pmMaxVersionExceededMode: normalizePmMaxVersionExceededMode(policy.pm_max_version_exceeded_mode),
         requireProvenance: policy.require_provenance === true,
         trustedExtensions: normalizePolicyStringSet(policy.trusted_extensions),
         defaultSandboxProfile: normalizePolicySandboxProfile(policy.default_sandbox_profile),
@@ -478,4 +513,4 @@ export function evaluateExtensionPolicyForRegistration(policy, extension, surfac
     };
 }
 //# sourceMappingURL=extension-policy.js.map
-//# debugId=3a8acf74-cc81-5417-8ee9-30d80fde2102
+//# debugId=5f65a8a3-c45a-5178-918a-32153c97cce6

package/dist/core/extensions/extension-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"extension-policy.js","sources":["core/extensions/extension-policy.ts"],"sourceRoot":"/","sourcesContent":["import {\n  KNOWN_EXTENSION_POLICY_MODES,\n  KNOWN_EXTENSION_POLICY_SURFACES,\n  KNOWN_EXTENSION_SANDBOX_PROFILES,\n  KNOWN_EXTENSION_TRUST_MODES,\n  type ExtensionCapability,\n  type ExtensionGovernancePolicy,\n  type ExtensionLayer,\n  type ExtensionPolicyMode,\n  type ExtensionPolicyOverride,\n  type ExtensionPolicySurface,\n  type ExtensionSandboxProfile,\n  type ExtensionTrustMode,\n} from \"./extension-types.js\";\nimport { isKnownExtensionCapability } from \"./extension-capability-aliases.js\";\nimport { normalizeCommandName } from \"./extension-runtime-helpers.js\";\nimport type { PmSettings } from \"../../types/index.js\";\n\ninterface NormalizedExtensionPolicyOverride {\n  name: string;\n  disabled: boolean;\n  requireTrusted: boolean;\n  requireProvenance: boolean;\n  sandboxProfile?: ExtensionSandboxProfile;\n  allowedCapabilities: Set<string>;\n  blockedCapabilities: Set<string>;\n  allowedSurfaces: Set<string>;\n  blockedSurfaces: Set<string>;\n  allowedCommands: Set<string>;\n  blockedCommands: Set<string>;\n  allowedActions: Set<string>;\n  blockedActions: Set<string>;\n  allowedServices: Set<string>;\n  blockedServices: Set<string>;\n}\n\nexport interface NormalizedExtensionPolicy {\n  mode: ExtensionPolicyMode;\n  trustMode: ExtensionTrustMode;\n  requireProvenance: boolean;\n  trustedExtensions: Set<string>;\n  defaultSandboxProfile: ExtensionSandboxProfile;\n  allowedExtensions: Set<string>;\n  blockedExtensions: Set<string>;\n  allowedCapabilities: Set<string>;\n  blockedCapabilities: Set<string>;\n  allowedSurfaces: Set<string>;\n  blockedSurfaces: Set<string>;\n  allowedCommands: Set<string>;\n  blockedCommands: Set<string>;\n  allowedActions: Set<string>;\n  blockedActions: Set<string>;\n  allowedServices: Set<string>;\n  blockedServices: Set<string>;\n  overridesByName: Map<string, NormalizedExtensionPolicyOverride>;\n  warnings: string[];\n}\n\nexport interface PolicyExtensionRef {\n  layer: ExtensionLayer;\n  name: string;\n  trusted?: boolean;\n  provenanceVerified?: boolean;\n  sandboxProfile?: ExtensionSandboxProfile;\n  permissions?: Record<string, boolean | undefined>;\n}\n\nfunction normalizePolicyName(value: string | undefined): string {\n  if (typeof value !== \"string\") {\n    return \"\";\n  }\n  return value.trim().toLowerCase();\n}\n\nfunction normalizePolicyStringSet(values: readonly string[] | undefined): Set<string> {\n  return new Set(\n    (values ?? [])\n      .map((value) => value.trim().toLowerCase())\n      .filter((value) => value.length > 0),\n  );\n}\n\nfunction normalizePolicySurfaceToken(value: string): string {\n  const normalized = value.trim().toLowerCase();\n  if (normalized.length === 0) {\n    return \"\";\n  }\n  const segments = normalized\n    .split(/[.:/]/)\n    .map((segment) => segment.replace(/[\\s_-]+/g, \"\"))\n    .filter((segment) => segment.length > 0);\n  if (segments.length === 0) {\n    return \"\";\n  }\n  if (segments.length === 1) {\n    return segments[0];\n  }\n  return `${segments[0]}.${segments.slice(1).join(\"\")}`;\n}\n\nfunction normalizePolicySurfaceSet(values: readonly string[] | undefined): Set<string> {\n  return new Set(\n    (values ?? [])\n      .map((value) => normalizePolicySurfaceToken(value))\n      .filter((value) => value.length > 0),\n  );\n}\n\nfunction normalizePolicyMode(value: string | undefined): ExtensionPolicyMode {\n  const normalized = normalizePolicyName(value);\n  if ((KNOWN_EXTENSION_POLICY_MODES as readonly string[]).includes(normalized)) {\n    return normalized as ExtensionPolicyMode;\n  }\n  return \"off\";\n}\n\nfunction normalizePolicyTrustMode(value: string | undefined): ExtensionTrustMode {\n  const normalized = normalizePolicyName(value);\n  if ((KNOWN_EXTENSION_TRUST_MODES as readonly string[]).includes(normalized)) {\n    return normalized as ExtensionTrustMode;\n  }\n  return \"off\";\n}\n\nexport function normalizePolicySandboxProfile(value: string | undefined): ExtensionSandboxProfile {\n  const normalized = normalizePolicyName(value);\n  if ((KNOWN_EXTENSION_SANDBOX_PROFILES as readonly string[]).includes(normalized)) {\n    return normalized as ExtensionSandboxProfile;\n  }\n  return \"none\";\n}\n\nfunction toSortedList(values: Iterable<string>): string[] {\n  return [...new Set(values)].sort((left, right) => left.localeCompare(right));\n}\n\nfunction buildExtensionPolicyOverride(\n  rawOverride: ExtensionPolicyOverride,\n): { name: string; normalized: NormalizedExtensionPolicyOverride } | null {\n  const name = normalizePolicyName(rawOverride.name);\n  if (name.length === 0) {\n    return null;\n  }\n  return {\n    name,\n    normalized: {\n      name,\n      disabled: rawOverride.disabled === true,\n      requireTrusted: rawOverride.require_trusted === true,\n      requireProvenance: rawOverride.require_provenance === true,\n      sandboxProfile:\n        rawOverride.sandbox_profile !== undefined\n          ? normalizePolicySandboxProfile(rawOverride.sandbox_profile)\n          : undefined,\n      allowedCapabilities: normalizePolicyStringSet(rawOverride.allowed_capabilities),\n      blockedCapabilities: normalizePolicyStringSet(rawOverride.blocked_capabilities),\n      allowedSurfaces: normalizePolicySurfaceSet(rawOverride.allowed_surfaces),\n      blockedSurfaces: normalizePolicySurfaceSet(rawOverride.blocked_surfaces),\n      allowedCommands: normalizePolicyStringSet(rawOverride.allowed_commands),\n      blockedCommands: normalizePolicyStringSet(rawOverride.blocked_commands),\n      allowedActions: normalizePolicyStringSet(rawOverride.allowed_actions),\n      blockedActions: normalizePolicyStringSet(rawOverride.blocked_actions),\n      allowedServices: normalizePolicyStringSet(rawOverride.allowed_services),\n      blockedServices: normalizePolicyStringSet(rawOverride.blocked_services),\n    },\n  };\n}\n\nfunction collectExtensionPolicyOverrides(\n  rawOverrides: readonly ExtensionPolicyOverride[] | undefined,\n): Map<string, NormalizedExtensionPolicyOverride> {\n  const overridesByName = new Map<string, NormalizedExtensionPolicyOverride>();\n  for (const rawOverride of rawOverrides ?? []) {\n    const built = buildExtensionPolicyOverride(rawOverride);\n    if (built) {\n      overridesByName.set(built.name, built.normalized);\n    }\n  }\n  return overridesByName;\n}\n\nexport function normalizeExtensionPolicy(settings: PmSettings): NormalizedExtensionPolicy {\n  const policy = settings.extensions.policy;\n  const mode = normalizePolicyMode(policy?.mode);\n  const trustMode = normalizePolicyTrustMode(policy?.trust_mode);\n  const requireProvenance = policy?.require_provenance === true;\n  const trustedExtensions = normalizePolicyStringSet(policy?.trusted_extensions);\n  const defaultSandboxProfile = normalizePolicySandboxProfile(policy?.default_sandbox_profile);\n  const allowedExtensions = normalizePolicyStringSet(policy?.allowed_extensions);\n  const blockedExtensions = normalizePolicyStringSet(policy?.blocked_extensions);\n  const allowedCapabilities = normalizePolicyStringSet(policy?.allowed_capabilities);\n  const blockedCapabilities = normalizePolicyStringSet(policy?.blocked_capabilities);\n  const allowedSurfaces = normalizePolicySurfaceSet(policy?.allowed_surfaces);\n  const blockedSurfaces = normalizePolicySurfaceSet(policy?.blocked_surfaces);\n  const allowedCommands = normalizePolicyStringSet(policy?.allowed_commands);\n  const blockedCommands = normalizePolicyStringSet(policy?.blocked_commands);\n  const allowedActions = normalizePolicyStringSet(policy?.allowed_actions);\n  const blockedActions = normalizePolicyStringSet(policy?.blocked_actions);\n  const allowedServices = normalizePolicyStringSet(policy?.allowed_services);\n  const blockedServices = normalizePolicyStringSet(policy?.blocked_services);\n  const overridesByName = collectExtensionPolicyOverrides(policy?.extension_overrides);\n\n  const warnings: string[] = [];\n  for (const capability of toSortedList([...allowedCapabilities, ...blockedCapabilities])) {\n    if (!isKnownExtensionCapability(capability)) {\n      warnings.push(`extension_policy_unknown_capability:${capability}`);\n    }\n  }\n  for (const override of [...overridesByName.values()].sort((left, right) => left.name.localeCompare(right.name))) {\n    for (const capability of toSortedList([...override.allowedCapabilities, ...override.blockedCapabilities])) {\n      if (!isKnownExtensionCapability(capability)) {\n        warnings.push(`extension_policy_unknown_capability:${override.name}:${capability}`);\n      }\n    }\n  }\n  const knownSurfaces = new Set<string>(KNOWN_EXTENSION_POLICY_SURFACES);\n  for (const surface of toSortedList([...allowedSurfaces, ...blockedSurfaces])) {\n    if (!knownSurfaces.has(surface)) {\n      warnings.push(`extension_policy_unknown_surface:${surface}`);\n    }\n  }\n  for (const override of [...overridesByName.values()].sort((left, right) => left.name.localeCompare(right.name))) {\n    for (const surface of toSortedList([...override.allowedSurfaces, ...override.blockedSurfaces])) {\n      if (!knownSurfaces.has(surface)) {\n        warnings.push(`extension_policy_unknown_surface:${override.name}:${surface}`);\n      }\n    }\n  }\n\n  return {\n    mode,\n    trustMode,\n    requireProvenance,\n    trustedExtensions,\n    defaultSandboxProfile,\n    allowedExtensions,\n    blockedExtensions,\n    allowedCapabilities,\n    blockedCapabilities,\n    allowedSurfaces,\n    blockedSurfaces,\n    allowedCommands,\n    blockedCommands,\n    allowedActions,\n    blockedActions,\n    allowedServices,\n    blockedServices,\n    overridesByName,\n    warnings: [...new Set(warnings)].sort((left, right) => left.localeCompare(right)),\n  };\n}\n\nexport function serializeExtensionPolicy(policy: NormalizedExtensionPolicy): ExtensionGovernancePolicy {\n  const overrides = [...policy.overridesByName.values()]\n    .sort((left, right) => left.name.localeCompare(right.name))\n    .map((override) => ({\n      name: override.name,\n      ...(override.disabled ? { disabled: true } : {}),\n      ...(override.requireTrusted ? { require_trusted: true } : {}),\n      ...(override.requireProvenance ? { require_provenance: true } : {}),\n      ...(override.sandboxProfile ? { sandbox_profile: override.sandboxProfile } : {}),\n      ...(override.allowedCapabilities.size > 0 ? { allowed_capabilities: toSortedList(override.allowedCapabilities) } : {}),\n      ...(override.blockedCapabilities.size > 0 ? { blocked_capabilities: toSortedList(override.blockedCapabilities) } : {}),\n      ...(override.allowedSurfaces.size > 0 ? { allowed_surfaces: toSortedList(override.allowedSurfaces) } : {}),\n      ...(override.blockedSurfaces.size > 0 ? { blocked_surfaces: toSortedList(override.blockedSurfaces) } : {}),\n      ...(override.allowedCommands.size > 0 ? { allowed_commands: toSortedList(override.allowedCommands) } : {}),\n      ...(override.blockedCommands.size > 0 ? { blocked_commands: toSortedList(override.blockedCommands) } : {}),\n      ...(override.allowedActions.size > 0 ? { allowed_actions: toSortedList(override.allowedActions) } : {}),\n      ...(override.blockedActions.size > 0 ? { blocked_actions: toSortedList(override.blockedActions) } : {}),\n      ...(override.allowedServices.size > 0 ? { allowed_services: toSortedList(override.allowedServices) } : {}),\n      ...(override.blockedServices.size > 0 ? { blocked_services: toSortedList(override.blockedServices) } : {}),\n    }));\n  return {\n    mode: policy.mode,\n    trust_mode: policy.trustMode,\n    require_provenance: policy.requireProvenance,\n    trusted_extensions: toSortedList(policy.trustedExtensions),\n    default_sandbox_profile: policy.defaultSandboxProfile,\n    allowed_extensions: toSortedList(policy.allowedExtensions),\n    blocked_extensions: toSortedList(policy.blockedExtensions),\n    allowed_capabilities: toSortedList(policy.allowedCapabilities),\n    blocked_capabilities: toSortedList(policy.blockedCapabilities),\n    allowed_surfaces: toSortedList(policy.allowedSurfaces),\n    blocked_surfaces: toSortedList(policy.blockedSurfaces),\n    allowed_commands: toSortedList(policy.allowedCommands),\n    blocked_commands: toSortedList(policy.blockedCommands),\n    allowed_actions: toSortedList(policy.allowedActions),\n    blocked_actions: toSortedList(policy.blockedActions),\n    allowed_services: toSortedList(policy.allowedServices),\n    blocked_services: toSortedList(policy.blockedServices),\n    extension_overrides: overrides,\n  };\n}\n\nexport function hydrateExtensionPolicy(policy: ExtensionGovernancePolicy): NormalizedExtensionPolicy {\n  const overridesByName = collectExtensionPolicyOverrides(policy.extension_overrides);\n  return {\n    mode: normalizePolicyMode(policy.mode),\n    trustMode: normalizePolicyTrustMode(policy.trust_mode),\n    requireProvenance: policy.require_provenance === true,\n    trustedExtensions: normalizePolicyStringSet(policy.trusted_extensions),\n    defaultSandboxProfile: normalizePolicySandboxProfile(policy.default_sandbox_profile),\n    allowedExtensions: normalizePolicyStringSet(policy.allowed_extensions),\n    blockedExtensions: normalizePolicyStringSet(policy.blocked_extensions),\n    allowedCapabilities: normalizePolicyStringSet(policy.allowed_capabilities),\n    blockedCapabilities: normalizePolicyStringSet(policy.blocked_capabilities),\n    allowedSurfaces: normalizePolicySurfaceSet(policy.allowed_surfaces),\n    blockedSurfaces: normalizePolicySurfaceSet(policy.blocked_surfaces),\n    allowedCommands: normalizePolicyStringSet(policy.allowed_commands),\n    blockedCommands: normalizePolicyStringSet(policy.blocked_commands),\n    allowedActions: normalizePolicyStringSet(policy.allowed_actions),\n    blockedActions: normalizePolicyStringSet(policy.blocked_actions),\n    allowedServices: normalizePolicyStringSet(policy.allowed_services),\n    blockedServices: normalizePolicyStringSet(policy.blocked_services),\n    overridesByName,\n    warnings: [],\n  };\n}\n\nfunction resolvePolicyOverride(\n  policy: NormalizedExtensionPolicy,\n  extensionName: string,\n): NormalizedExtensionPolicyOverride | null {\n  return policy.overridesByName.get(normalizePolicyName(extensionName)) ?? null;\n}\n\nfunction evaluatePolicySet(\n  allowed: Set<string>,\n  blocked: Set<string>,\n  value: string,\n  notAllowlistedReason: string,\n  blockedReason: string,\n): string | null {\n  if (blocked.has(value)) {\n    return blockedReason;\n  }\n  if (allowed.size > 0 && !allowed.has(value)) {\n    return notAllowlistedReason;\n  }\n  return null;\n}\n\nfunction resolvePolicyCapabilityReason(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  capability: string,\n): string | null {\n  const normalizedCapability = capability.trim().toLowerCase();\n  const override = resolvePolicyOverride(policy, extension.name);\n  const allowed = override && override.allowedCapabilities.size > 0 ? override.allowedCapabilities : policy.allowedCapabilities;\n  const blocked = new Set<string>([\n    ...policy.blockedCapabilities,\n    ...(override ? override.blockedCapabilities : []),\n  ]);\n  return evaluatePolicySet(\n    allowed,\n    blocked,\n    normalizedCapability,\n    \"capability_not_allowlisted\",\n    \"capability_blocked\",\n  );\n}\n\nfunction resolvePolicySurfaceReason(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  surface: ExtensionPolicySurface,\n): string | null {\n  const override = resolvePolicyOverride(policy, extension.name);\n  const allowed = override && override.allowedSurfaces.size > 0 ? override.allowedSurfaces : policy.allowedSurfaces;\n  const blocked = new Set<string>([\n    ...policy.blockedSurfaces,\n    ...(override ? override.blockedSurfaces : []),\n  ]);\n  return evaluatePolicySet(allowed, blocked, surface, \"surface_not_allowlisted\", \"surface_blocked\");\n}\n\nfunction resolvePolicyCommandReason(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  command: string,\n): string | null {\n  const normalizedCommand = normalizeCommandName(command);\n  if (normalizedCommand.length === 0) {\n    return null;\n  }\n  const override = resolvePolicyOverride(policy, extension.name);\n  const allowed = override && override.allowedCommands.size > 0 ? override.allowedCommands : policy.allowedCommands;\n  const blocked = new Set<string>([\n    ...policy.blockedCommands,\n    ...(override ? override.blockedCommands : []),\n  ]);\n  return evaluatePolicySet(allowed, blocked, normalizedCommand, \"command_not_allowlisted\", \"command_blocked\");\n}\n\nfunction resolvePolicyActionReason(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  action: string,\n): string | null {\n  const normalizedAction = normalizePolicyName(action).replace(/\\s+/g, \"-\");\n  if (normalizedAction.length === 0) {\n    return null;\n  }\n  const override = resolvePolicyOverride(policy, extension.name);\n  const allowed = override && override.allowedActions.size > 0 ? override.allowedActions : policy.allowedActions;\n  const blocked = new Set<string>([\n    ...policy.blockedActions,\n    ...(override ? override.blockedActions : []),\n  ]);\n  return evaluatePolicySet(allowed, blocked, normalizedAction, \"action_not_allowlisted\", \"action_blocked\");\n}\n\nfunction resolvePolicyServiceReason(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  service: string,\n): string | null {\n  const normalizedService = normalizePolicyName(service);\n  if (normalizedService.length === 0) {\n    return null;\n  }\n  const override = resolvePolicyOverride(policy, extension.name);\n  const allowed = override && override.allowedServices.size > 0 ? override.allowedServices : policy.allowedServices;\n  const blocked = new Set<string>([\n    ...policy.blockedServices,\n    ...(override ? override.blockedServices : []),\n  ]);\n  return evaluatePolicySet(allowed, blocked, normalizedService, \"service_not_allowlisted\", \"service_blocked\");\n}\n\nfunction resolvePolicyExtensionReason(policy: NormalizedExtensionPolicy, extension: PolicyExtensionRef): string | null {\n  const name = normalizePolicyName(extension.name);\n  const override = resolvePolicyOverride(policy, extension.name);\n  if (override?.disabled === true) {\n    return \"extension_override_disabled\";\n  }\n  return evaluatePolicySet(\n    policy.allowedExtensions,\n    policy.blockedExtensions,\n    name,\n    \"extension_not_allowlisted\",\n    \"extension_blocked\",\n  );\n}\n\nfunction resolvePolicyTrustReason(policy: NormalizedExtensionPolicy, extension: PolicyExtensionRef): string | null {\n  if (policy.trustMode === \"off\") {\n    return null;\n  }\n  const override = resolvePolicyOverride(policy, extension.name);\n  const name = normalizePolicyName(extension.name);\n  const trusted = extension.trusted === true;\n  const provenanceVerified = extension.provenanceVerified === true;\n\n  if (policy.trustedExtensions.size > 0 && !policy.trustedExtensions.has(name)) {\n    return \"extension_not_trusted\";\n  }\n  if ((override?.requireTrusted === true || policy.trustMode === \"warn\" || policy.trustMode === \"enforce\") && !trusted) {\n    return \"extension_untrusted\";\n  }\n  if ((policy.requireProvenance || override?.requireProvenance === true) && !provenanceVerified) {\n    return \"provenance_missing_or_unverified\";\n  }\n  return null;\n}\n\nfunction resolvePolicySandboxReason(policy: NormalizedExtensionPolicy, extension: PolicyExtensionRef): string | null {\n  if (policy.mode === \"off\") {\n    return null;\n  }\n  const override = resolvePolicyOverride(policy, extension.name);\n  const profile = override?.sandboxProfile ?? extension.sandboxProfile ?? policy.defaultSandboxProfile;\n  if (profile === \"none\") {\n    return null;\n  }\n  const permissions = extension.permissions;\n  if (!permissions) {\n    return \"sandbox_permissions_missing\";\n  }\n\n  const hasPermission = (name: keyof typeof permissions): boolean => permissions[name] === true;\n  if (profile === \"restricted\") {\n    if (hasPermission(\"process_spawn\")) {\n      return \"sandbox_restricted_disallows_process_spawn\";\n    }\n    if (hasPermission(\"env_write\")) {\n      return \"sandbox_restricted_disallows_env_write\";\n    }\n    return null;\n  }\n\n  if (profile === \"strict\") {\n    if (hasPermission(\"process_spawn\")) {\n      return \"sandbox_strict_disallows_process_spawn\";\n    }\n    if (hasPermission(\"network\")) {\n      return \"sandbox_strict_disallows_network\";\n    }\n    if (hasPermission(\"fs_write\")) {\n      return \"sandbox_strict_disallows_fs_write\";\n    }\n    if (hasPermission(\"env_write\")) {\n      return \"sandbox_strict_disallows_env_write\";\n    }\n  }\n  return null;\n}\n\nfunction buildPolicyWarning(\n  mode: \"blocked\" | \"violation\",\n  scope: \"extension\" | \"capability\" | \"registration\" | \"trust\",\n  extension: PolicyExtensionRef,\n  reason: string,\n  details: Record<string, string> = {},\n): string {\n  const tokens = Object.entries(details)\n    .sort((left, right) => left[0].localeCompare(right[0]))\n    .map(([key, value]) => `${key}=${value}`)\n    .join(\":\");\n  const suffix = tokens.length > 0 ? `:${tokens}` : \"\";\n  return `extension_policy_${mode}_${scope}:${extension.layer}:${extension.name}:reason=${reason}${suffix}`;\n}\n\nexport function evaluateExtensionPolicyForExtension(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n): { allowed: boolean; warning: string | null } {\n  if (policy.mode === \"off\" && policy.trustMode === \"off\") {\n    return { allowed: true, warning: null };\n  }\n  const reason = resolvePolicyExtensionReason(policy, extension);\n  const trustReason = resolvePolicyTrustReason(policy, extension);\n  const sandboxReason = resolvePolicySandboxReason(policy, extension);\n  const extensionEnforced = reason && policy.mode === \"enforce\";\n  const trustEnforced = trustReason && policy.trustMode === \"enforce\";\n  const sandboxEnforced = sandboxReason && policy.mode === \"enforce\";\n  if (!reason && !trustReason && !sandboxReason) {\n    return { allowed: true, warning: null };\n  }\n  if (extensionEnforced) {\n    return {\n      allowed: false,\n      warning: buildPolicyWarning(\"blocked\", \"extension\", extension, reason),\n    };\n  }\n  if (trustEnforced) {\n    return {\n      allowed: false,\n      warning: buildPolicyWarning(\"blocked\", \"trust\", extension, trustReason),\n    };\n  }\n  if (sandboxEnforced) {\n    return {\n      allowed: false,\n      warning: buildPolicyWarning(\"blocked\", \"extension\", extension, sandboxReason),\n    };\n  }\n  if (reason && policy.mode === \"warn\") {\n    return {\n      allowed: true,\n      warning: buildPolicyWarning(\"violation\", \"extension\", extension, reason),\n    };\n  }\n  if (trustReason && policy.trustMode === \"warn\") {\n    return {\n      allowed: true,\n      warning: buildPolicyWarning(\"violation\", \"trust\", extension, trustReason),\n    };\n  }\n  if (sandboxReason && policy.mode === \"warn\") {\n    return {\n      allowed: true,\n      warning: buildPolicyWarning(\"violation\", \"extension\", extension, sandboxReason),\n    };\n  }\n  return {\n    allowed: true,\n    warning: null,\n  };\n}\n\nexport function evaluateExtensionPolicyForCapability(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  capability: string,\n): { allowed: boolean; warning: string | null } {\n  if (policy.mode === \"off\") {\n    return { allowed: true, warning: null };\n  }\n  const reason = resolvePolicyCapabilityReason(policy, extension, capability);\n  if (!reason) {\n    return { allowed: true, warning: null };\n  }\n  return {\n    allowed: policy.mode === \"warn\",\n    warning: buildPolicyWarning(\n    policy.mode === \"warn\" ? \"violation\" : \"blocked\",\n    \"capability\",\n    extension,\n    reason,\n    { capability: capability.trim().toLowerCase() },\n    ),\n  };\n}\n\nexport function evaluateExtensionPolicyForRegistration(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  surface: ExtensionPolicySurface,\n  method: string,\n  capability?: ExtensionCapability,\n  details?: {\n    command?: string;\n    action?: string;\n    service?: string;\n  },\n): { allowed: boolean; warning: string | null } {\n  if (policy.mode === \"off\") {\n    return { allowed: true, warning: null };\n  }\n  const capabilityReason =\n    typeof capability === \"string\" ? resolvePolicyCapabilityReason(policy, extension, capability) : null;\n  const surfaceReason = resolvePolicySurfaceReason(policy, extension, surface);\n  const commandReason = details?.command ? resolvePolicyCommandReason(policy, extension, details.command) : null;\n  const actionReason = details?.action ? resolvePolicyActionReason(policy, extension, details.action) : null;\n  const serviceReason = details?.service ? resolvePolicyServiceReason(policy, extension, details.service) : null;\n  const reason = capabilityReason ?? surfaceReason ?? commandReason ?? actionReason ?? serviceReason;\n  if (!reason) {\n    return { allowed: true, warning: null };\n  }\n  const warningDetails: Record<string, string> = {\n    method: normalizePolicyName(method).replace(/\\s+/g, \"_\"),\n    surface,\n  };\n  if (capability) {\n    warningDetails.capability = capability;\n  }\n  if (details?.command) {\n    warningDetails.command = normalizeCommandName(details.command);\n  }\n  if (details?.action) {\n    warningDetails.action = normalizePolicyName(details.action).replace(/\\s+/g, \"-\");\n  }\n  if (details?.service) {\n    warningDetails.service = normalizePolicyName(details.service);\n  }\n  const warning = buildPolicyWarning(\n    policy.mode === \"warn\" ? \"violation\" : \"blocked\",\n    \"registration\",\n    extension,\n    reason,\n    warningDetails,\n  );\n  return {\n    allowed: policy.mode === \"warn\",\n    warning,\n  };\n}\n"],"names":[],"mappings":";;AAAA,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,GAS5B,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AAoDtE,SAAS,mBAAmB,CAAC,KAAyB;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAqC;IACrE,OAAO,IAAI,GAAG,CACZ,CAAC,MAAM,IAAI,EAAE,CAAC;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU;SACxB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;SACjD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAqC;IACtE,OAAO,IAAI,GAAG,CACZ,CAAC,MAAM,IAAI,EAAE,CAAC;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;SAClD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAyB;IACpD,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAK,4BAAkD,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7E,OAAO,UAAiC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAyB;IACzD,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAK,2BAAiD,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAgC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAyB;IACrE,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAK,gCAAsD,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,OAAO,UAAqC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,YAAY,CAAC,MAAwB;IAC5C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,4BAA4B,CACnC,WAAoC;IAEpC,MAAM,IAAI,GAAG,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU,EAAE;YACV,IAAI;YACJ,QAAQ,EAAE,WAAW,CAAC,QAAQ,KAAK,IAAI;YACvC,cAAc,EAAE,WAAW,CAAC,eAAe,KAAK,IAAI;YACpD,iBAAiB,EAAE,WAAW,CAAC,kBAAkB,KAAK,IAAI;YAC1D,cAAc,EACZ,WAAW,CAAC,eAAe,KAAK,SAAS;gBACvC,CAAC,CAAC,6BAA6B,CAAC,WAAW,CAAC,eAAe,CAAC;gBAC5D,CAAC,CAAC,SAAS;YACf,mBAAmB,EAAE,wBAAwB,CAAC,WAAW,CAAC,oBAAoB,CAAC;YAC/E,mBAAmB,EAAE,wBAAwB,CAAC,WAAW,CAAC,oBAAoB,CAAC;YAC/E,eAAe,EAAE,yBAAyB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACxE,eAAe,EAAE,yBAAyB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACxE,eAAe,EAAE,wBAAwB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACvE,eAAe,EAAE,wBAAwB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACvE,cAAc,EAAE,wBAAwB,CAAC,WAAW,CAAC,eAAe,CAAC;YACrE,cAAc,EAAE,wBAAwB,CAAC,WAAW,CAAC,eAAe,CAAC;YACrE,eAAe,EAAE,wBAAwB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACvE,eAAe,EAAE,wBAAwB,CAAC,WAAW,CAAC,gBAAgB,CAAC;SACxE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,YAA4D;IAE5D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC7E,KAAK,MAAM,WAAW,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACV,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAoB;IAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,MAAM,CAAC;IAC1C,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,iBAAiB,GAAG,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC9D,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/E,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAC7F,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/E,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/E,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnF,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnF,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChH,KAAK,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,GAAG,QAAQ,CAAC,mBAAmB,EAAE,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,QAAQ,CAAC,IAAI,CAAC,uCAAuC,QAAQ,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,+BAA+B,CAAC,CAAC;IACvE,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,CAAC,GAAG,eAAe,EAAE,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,CAAC,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YAC/F,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,oCAAoC,QAAQ,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,SAAS;QACT,iBAAiB;QACjB,iBAAiB;QACjB,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,mBAAmB;QACnB,mBAAmB;QACnB,eAAe;QACf,eAAe;QACf,eAAe;QACf,eAAe;QACf,cAAc;QACd,cAAc;QACd,eAAe;QACf,eAAe;QACf,eAAe;QACf,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAiC;IACxE,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;SACnD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3G,CAAC,CAAC,CAAC;IACN,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,kBAAkB,EAAE,MAAM,CAAC,iBAAiB;QAC5C,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1D,uBAAuB,EAAE,MAAM,CAAC,qBAAqB;QACrD,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1D,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1D,oBAAoB,EAAE,YAAY,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC9D,oBAAoB,EAAE,YAAY,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC9D,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC;QACpD,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,mBAAmB,EAAE,SAAS;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAiC;IACtE,MAAM,eAAe,GAAG,+BAA+B,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC;QACtC,SAAS,EAAE,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC;QACtD,iBAAiB,EAAE,MAAM,CAAC,kBAAkB,KAAK,IAAI;QACrD,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACtE,qBAAqB,EAAE,6BAA6B,CAAC,MAAM,CAAC,uBAAuB,CAAC;QACpF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACtE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACtE,mBAAmB,EAAE,wBAAwB,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC1E,mBAAmB,EAAE,wBAAwB,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC1E,eAAe,EAAE,yBAAyB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACnE,eAAe,EAAE,yBAAyB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACnE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClE,cAAc,EAAE,wBAAwB,CAAC,MAAM,CAAC,eAAe,CAAC;QAChE,cAAc,EAAE,wBAAwB,CAAC,MAAM,CAAC,eAAe,CAAC;QAChE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClE,eAAe;QACf,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAiC,EACjC,aAAqB;IAErB,OAAO,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,IAAI,IAAI,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAoB,EACpB,OAAoB,EACpB,KAAa,EACb,oBAA4B,EAC5B,aAAqB;IAErB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAiC,EACjC,SAA6B,EAC7B,UAAkB;IAElB,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IAC9H,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;QAC9B,GAAG,MAAM,CAAC,mBAAmB;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,iBAAiB,CACtB,OAAO,EACP,OAAO,EACP,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,MAAiC,EACjC,SAA6B,EAC7B,OAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IAClH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;QAC9B,GAAG,MAAM,CAAC,eAAe;QACzB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,0BAA0B,CACjC,MAAiC,EACjC,SAA6B,EAC7B,OAAe;IAEf,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IAClH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;QAC9B,GAAG,MAAM,CAAC,eAAe;QACzB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,iBAAiB,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAiC,EACjC,SAA6B,EAC7B,MAAc;IAEd,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;IAC/G,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;QAC9B,GAAG,MAAM,CAAC,cAAc;QACxB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,0BAA0B,CACjC,MAAiC,EACjC,SAA6B,EAC7B,OAAe;IAEf,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IAClH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;QAC9B,GAAG,MAAM,CAAC,eAAe;QACzB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,iBAAiB,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAiC,EAAE,SAA6B;IACpG,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,QAAQ,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,OAAO,iBAAiB,CACtB,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,iBAAiB,EACxB,IAAI,EACJ,2BAA2B,EAC3B,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAiC,EAAE,SAA6B;IAChG,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC;IAC3C,MAAM,kBAAkB,GAAG,SAAS,CAAC,kBAAkB,KAAK,IAAI,CAAC;IAEjE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACrH,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9F,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAiC,EAAE,SAA6B;IAClG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,EAAE,cAAc,IAAI,SAAS,CAAC,cAAc,IAAI,MAAM,CAAC,qBAAqB,CAAC;IACrG,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,IAA8B,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAC9F,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,OAAO,4CAA4C,CAAC;QACtD,CAAC;QACD,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,wCAAwC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,OAAO,wCAAwC,CAAC;QAClD,CAAC;QACD,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,kCAAkC,CAAC;QAC5C,CAAC;QACD,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,mCAAmC,CAAC;QAC7C,CAAC;QACD,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,oCAAoC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CACzB,IAA6B,EAC7B,KAA4D,EAC5D,SAA6B,EAC7B,MAAc,EACd,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACnC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,OAAO,oBAAoB,IAAI,IAAI,KAAK,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,WAAW,MAAM,GAAG,MAAM,EAAE,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,MAAiC,EACjC,SAA6B;IAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,4BAA4B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IAC9D,MAAM,aAAa,GAAG,WAAW,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;IACpE,MAAM,eAAe,GAAG,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IACnE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kBAAkB,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kBAAkB,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;SAC9E,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC;SACzE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC;SAC1E,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5C,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;SAChF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,MAAiC,EACjC,SAA6B,EAC7B,UAAkB;IAElB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM;QAC/B,OAAO,EAAE,kBAAkB,CAC3B,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAChD,YAAY,EACZ,SAAS,EACT,MAAM,EACN,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAiC,EACjC,SAA6B,EAC7B,OAA+B,EAC/B,MAAc,EACd,UAAgC,EAChC,OAIC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,gBAAgB,GACpB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,MAAM,YAAY,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3G,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,MAAM,MAAM,GAAG,gBAAgB,IAAI,aAAa,IAAI,aAAa,IAAI,YAAY,IAAI,aAAa,CAAC;IACnG,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,cAAc,GAA2B;QAC7C,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;QACxD,OAAO;KACR,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,cAAc,CAAC,UAAU,GAAG,UAAU,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,cAAc,CAAC,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,cAAc,CAAC,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,cAAc,CAAC,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAChC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAChD,cAAc,EACd,SAAS,EACT,MAAM,EACN,cAAc,CACf,CAAC;IACF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM;QAC/B,OAAO;KACR,CAAC;AACJ,CAAC","debugId":"3a8acf74-cc81-5417-8ee9-30d80fde2102"}
+{"version":3,"file":"extension-policy.js","sources":["core/extensions/extension-policy.ts"],"sourceRoot":"/","sourcesContent":["import {\n  KNOWN_EXTENSION_POLICY_MODES,\n  KNOWN_EXTENSION_POLICY_SURFACES,\n  KNOWN_EXTENSION_SANDBOX_PROFILES,\n  KNOWN_EXTENSION_TRUST_MODES,\n  KNOWN_PM_MAX_VERSION_EXCEEDED_MODES,\n  type ExtensionCapability,\n  type ExtensionGovernancePolicy,\n  type ExtensionLayer,\n  type ExtensionPolicyMode,\n  type ExtensionPolicyOverride,\n  type ExtensionPolicySurface,\n  type ExtensionSandboxProfile,\n  type ExtensionTrustMode,\n  type PmMaxVersionExceededMode,\n  type PmMaxVersionExceededModeSetting,\n} from \"./extension-types.js\";\nimport { isKnownExtensionCapability } from \"./extension-capability-aliases.js\";\nimport { normalizeCommandName } from \"./extension-runtime-helpers.js\";\nimport type { PmSettings } from \"../../types/index.js\";\n\ninterface NormalizedExtensionPolicyOverride {\n  name: string;\n  disabled: boolean;\n  requireTrusted: boolean;\n  requireProvenance: boolean;\n  sandboxProfile?: ExtensionSandboxProfile;\n  allowedCapabilities: Set<string>;\n  blockedCapabilities: Set<string>;\n  allowedSurfaces: Set<string>;\n  blockedSurfaces: Set<string>;\n  allowedCommands: Set<string>;\n  blockedCommands: Set<string>;\n  allowedActions: Set<string>;\n  blockedActions: Set<string>;\n  allowedServices: Set<string>;\n  blockedServices: Set<string>;\n}\n\n/** Concrete per-layer resolution of `pm_max_version_exceeded_mode` (default: block). */\nexport interface NormalizedPmMaxVersionExceededMode {\n  global: PmMaxVersionExceededMode;\n  project: PmMaxVersionExceededMode;\n}\n\nexport interface NormalizedExtensionPolicy {\n  mode: ExtensionPolicyMode;\n  trustMode: ExtensionTrustMode;\n  pmMaxVersionExceededMode: NormalizedPmMaxVersionExceededMode;\n  requireProvenance: boolean;\n  trustedExtensions: Set<string>;\n  defaultSandboxProfile: ExtensionSandboxProfile;\n  allowedExtensions: Set<string>;\n  blockedExtensions: Set<string>;\n  allowedCapabilities: Set<string>;\n  blockedCapabilities: Set<string>;\n  allowedSurfaces: Set<string>;\n  blockedSurfaces: Set<string>;\n  allowedCommands: Set<string>;\n  blockedCommands: Set<string>;\n  allowedActions: Set<string>;\n  blockedActions: Set<string>;\n  allowedServices: Set<string>;\n  blockedServices: Set<string>;\n  overridesByName: Map<string, NormalizedExtensionPolicyOverride>;\n  warnings: string[];\n}\n\nexport interface PolicyExtensionRef {\n  layer: ExtensionLayer;\n  name: string;\n  trusted?: boolean;\n  provenanceVerified?: boolean;\n  sandboxProfile?: ExtensionSandboxProfile;\n  permissions?: Record<string, boolean | undefined>;\n}\n\nfunction normalizePolicyName(value: string | undefined): string {\n  if (typeof value !== \"string\") {\n    return \"\";\n  }\n  return value.trim().toLowerCase();\n}\n\nfunction normalizePolicyStringSet(values: readonly string[] | undefined): Set<string> {\n  return new Set(\n    (values ?? [])\n      .map((value) => value.trim().toLowerCase())\n      .filter((value) => value.length > 0),\n  );\n}\n\nfunction normalizePolicySurfaceToken(value: string): string {\n  const normalized = value.trim().toLowerCase();\n  if (normalized.length === 0) {\n    return \"\";\n  }\n  const segments = normalized\n    .split(/[.:/]/)\n    .map((segment) => segment.replace(/[\\s_-]+/g, \"\"))\n    .filter((segment) => segment.length > 0);\n  if (segments.length === 0) {\n    return \"\";\n  }\n  if (segments.length === 1) {\n    return segments[0];\n  }\n  return `${segments[0]}.${segments.slice(1).join(\"\")}`;\n}\n\nfunction normalizePolicySurfaceSet(values: readonly string[] | undefined): Set<string> {\n  return new Set(\n    (values ?? [])\n      .map((value) => normalizePolicySurfaceToken(value))\n      .filter((value) => value.length > 0),\n  );\n}\n\nfunction normalizePolicyMode(value: string | undefined): ExtensionPolicyMode {\n  const normalized = normalizePolicyName(value);\n  if ((KNOWN_EXTENSION_POLICY_MODES as readonly string[]).includes(normalized)) {\n    return normalized as ExtensionPolicyMode;\n  }\n  return \"off\";\n}\n\nfunction normalizePolicyTrustMode(value: string | undefined): ExtensionTrustMode {\n  const normalized = normalizePolicyName(value);\n  if ((KNOWN_EXTENSION_TRUST_MODES as readonly string[]).includes(normalized)) {\n    return normalized as ExtensionTrustMode;\n  }\n  return \"off\";\n}\n\nexport function normalizePolicySandboxProfile(value: string | undefined): ExtensionSandboxProfile {\n  const normalized = normalizePolicyName(value);\n  if ((KNOWN_EXTENSION_SANDBOX_PROFILES as readonly string[]).includes(normalized)) {\n    return normalized as ExtensionSandboxProfile;\n  }\n  return \"none\";\n}\n\nfunction normalizePmMaxVersionExceededModeValue(value: unknown): PmMaxVersionExceededMode | undefined {\n  if (typeof value !== \"string\") {\n    return undefined;\n  }\n  const normalized = value.trim().toLowerCase();\n  return (KNOWN_PM_MAX_VERSION_EXCEEDED_MODES as readonly string[]).includes(normalized)\n    ? (normalized as PmMaxVersionExceededMode)\n    : undefined;\n}\n\n/**\n * Resolve `extensions.policy.pm_max_version_exceeded_mode` to a concrete\n * per-layer mode map. Accepts a single mode string (applied to both layers) or\n * a `{ global?, project? }` override map; anything unset or unknown defaults to\n * the safe `\"block\"`.\n */\nexport function normalizePmMaxVersionExceededMode(\n  value: PmMaxVersionExceededModeSetting | undefined,\n): NormalizedPmMaxVersionExceededMode {\n  if (typeof value === \"string\") {\n    const mode = normalizePmMaxVersionExceededModeValue(value) ?? \"block\";\n    return { global: mode, project: mode };\n  }\n  if (typeof value === \"object\" && value !== null && !Array.isArray(value)) {\n    return {\n      global: normalizePmMaxVersionExceededModeValue(value.global) ?? \"block\",\n      project: normalizePmMaxVersionExceededModeValue(value.project) ?? \"block\",\n    };\n  }\n  return { global: \"block\", project: \"block\" };\n}\n\nfunction serializePmMaxVersionExceededMode(\n  mode: NormalizedPmMaxVersionExceededMode,\n): PmMaxVersionExceededModeSetting {\n  return mode.global === mode.project ? mode.global : { global: mode.global, project: mode.project };\n}\n\nfunction toSortedList(values: Iterable<string>): string[] {\n  return [...new Set(values)].sort((left, right) => left.localeCompare(right));\n}\n\nfunction buildExtensionPolicyOverride(\n  rawOverride: ExtensionPolicyOverride,\n): { name: string; normalized: NormalizedExtensionPolicyOverride } | null {\n  const name = normalizePolicyName(rawOverride.name);\n  if (name.length === 0) {\n    return null;\n  }\n  return {\n    name,\n    normalized: {\n      name,\n      disabled: rawOverride.disabled === true,\n      requireTrusted: rawOverride.require_trusted === true,\n      requireProvenance: rawOverride.require_provenance === true,\n      sandboxProfile:\n        rawOverride.sandbox_profile !== undefined\n          ? normalizePolicySandboxProfile(rawOverride.sandbox_profile)\n          : undefined,\n      allowedCapabilities: normalizePolicyStringSet(rawOverride.allowed_capabilities),\n      blockedCapabilities: normalizePolicyStringSet(rawOverride.blocked_capabilities),\n      allowedSurfaces: normalizePolicySurfaceSet(rawOverride.allowed_surfaces),\n      blockedSurfaces: normalizePolicySurfaceSet(rawOverride.blocked_surfaces),\n      allowedCommands: normalizePolicyStringSet(rawOverride.allowed_commands),\n      blockedCommands: normalizePolicyStringSet(rawOverride.blocked_commands),\n      allowedActions: normalizePolicyStringSet(rawOverride.allowed_actions),\n      blockedActions: normalizePolicyStringSet(rawOverride.blocked_actions),\n      allowedServices: normalizePolicyStringSet(rawOverride.allowed_services),\n      blockedServices: normalizePolicyStringSet(rawOverride.blocked_services),\n    },\n  };\n}\n\nfunction collectExtensionPolicyOverrides(\n  rawOverrides: readonly ExtensionPolicyOverride[] | undefined,\n): Map<string, NormalizedExtensionPolicyOverride> {\n  const overridesByName = new Map<string, NormalizedExtensionPolicyOverride>();\n  for (const rawOverride of rawOverrides ?? []) {\n    const built = buildExtensionPolicyOverride(rawOverride);\n    if (built) {\n      overridesByName.set(built.name, built.normalized);\n    }\n  }\n  return overridesByName;\n}\n\nexport function normalizeExtensionPolicy(settings: PmSettings): NormalizedExtensionPolicy {\n  const policy = settings.extensions.policy as ExtensionGovernancePolicy | undefined;\n  const mode = normalizePolicyMode(policy?.mode);\n  const trustMode = normalizePolicyTrustMode(policy?.trust_mode);\n  const pmMaxVersionExceededMode = normalizePmMaxVersionExceededMode(policy?.pm_max_version_exceeded_mode);\n  const requireProvenance = policy?.require_provenance === true;\n  const trustedExtensions = normalizePolicyStringSet(policy?.trusted_extensions);\n  const defaultSandboxProfile = normalizePolicySandboxProfile(policy?.default_sandbox_profile);\n  const allowedExtensions = normalizePolicyStringSet(policy?.allowed_extensions);\n  const blockedExtensions = normalizePolicyStringSet(policy?.blocked_extensions);\n  const allowedCapabilities = normalizePolicyStringSet(policy?.allowed_capabilities);\n  const blockedCapabilities = normalizePolicyStringSet(policy?.blocked_capabilities);\n  const allowedSurfaces = normalizePolicySurfaceSet(policy?.allowed_surfaces);\n  const blockedSurfaces = normalizePolicySurfaceSet(policy?.blocked_surfaces);\n  const allowedCommands = normalizePolicyStringSet(policy?.allowed_commands);\n  const blockedCommands = normalizePolicyStringSet(policy?.blocked_commands);\n  const allowedActions = normalizePolicyStringSet(policy?.allowed_actions);\n  const blockedActions = normalizePolicyStringSet(policy?.blocked_actions);\n  const allowedServices = normalizePolicyStringSet(policy?.allowed_services);\n  const blockedServices = normalizePolicyStringSet(policy?.blocked_services);\n  const overridesByName = collectExtensionPolicyOverrides(policy?.extension_overrides);\n\n  const warnings: string[] = [];\n  for (const capability of toSortedList([...allowedCapabilities, ...blockedCapabilities])) {\n    if (!isKnownExtensionCapability(capability)) {\n      warnings.push(`extension_policy_unknown_capability:${capability}`);\n    }\n  }\n  for (const override of [...overridesByName.values()].sort((left, right) => left.name.localeCompare(right.name))) {\n    for (const capability of toSortedList([...override.allowedCapabilities, ...override.blockedCapabilities])) {\n      if (!isKnownExtensionCapability(capability)) {\n        warnings.push(`extension_policy_unknown_capability:${override.name}:${capability}`);\n      }\n    }\n  }\n  const knownSurfaces = new Set<string>(KNOWN_EXTENSION_POLICY_SURFACES);\n  for (const surface of toSortedList([...allowedSurfaces, ...blockedSurfaces])) {\n    if (!knownSurfaces.has(surface)) {\n      warnings.push(`extension_policy_unknown_surface:${surface}`);\n    }\n  }\n  for (const override of [...overridesByName.values()].sort((left, right) => left.name.localeCompare(right.name))) {\n    for (const surface of toSortedList([...override.allowedSurfaces, ...override.blockedSurfaces])) {\n      if (!knownSurfaces.has(surface)) {\n        warnings.push(`extension_policy_unknown_surface:${override.name}:${surface}`);\n      }\n    }\n  }\n\n  return {\n    mode,\n    trustMode,\n    pmMaxVersionExceededMode,\n    requireProvenance,\n    trustedExtensions,\n    defaultSandboxProfile,\n    allowedExtensions,\n    blockedExtensions,\n    allowedCapabilities,\n    blockedCapabilities,\n    allowedSurfaces,\n    blockedSurfaces,\n    allowedCommands,\n    blockedCommands,\n    allowedActions,\n    blockedActions,\n    allowedServices,\n    blockedServices,\n    overridesByName,\n    warnings: [...new Set(warnings)].sort((left, right) => left.localeCompare(right)),\n  };\n}\n\nexport function serializeExtensionPolicy(policy: NormalizedExtensionPolicy): ExtensionGovernancePolicy {\n  const overrides = [...policy.overridesByName.values()]\n    .sort((left, right) => left.name.localeCompare(right.name))\n    .map((override) => ({\n      name: override.name,\n      ...(override.disabled ? { disabled: true } : {}),\n      ...(override.requireTrusted ? { require_trusted: true } : {}),\n      ...(override.requireProvenance ? { require_provenance: true } : {}),\n      ...(override.sandboxProfile ? { sandbox_profile: override.sandboxProfile } : {}),\n      ...(override.allowedCapabilities.size > 0 ? { allowed_capabilities: toSortedList(override.allowedCapabilities) } : {}),\n      ...(override.blockedCapabilities.size > 0 ? { blocked_capabilities: toSortedList(override.blockedCapabilities) } : {}),\n      ...(override.allowedSurfaces.size > 0 ? { allowed_surfaces: toSortedList(override.allowedSurfaces) } : {}),\n      ...(override.blockedSurfaces.size > 0 ? { blocked_surfaces: toSortedList(override.blockedSurfaces) } : {}),\n      ...(override.allowedCommands.size > 0 ? { allowed_commands: toSortedList(override.allowedCommands) } : {}),\n      ...(override.blockedCommands.size > 0 ? { blocked_commands: toSortedList(override.blockedCommands) } : {}),\n      ...(override.allowedActions.size > 0 ? { allowed_actions: toSortedList(override.allowedActions) } : {}),\n      ...(override.blockedActions.size > 0 ? { blocked_actions: toSortedList(override.blockedActions) } : {}),\n      ...(override.allowedServices.size > 0 ? { allowed_services: toSortedList(override.allowedServices) } : {}),\n      ...(override.blockedServices.size > 0 ? { blocked_services: toSortedList(override.blockedServices) } : {}),\n    }));\n  return {\n    mode: policy.mode,\n    trust_mode: policy.trustMode,\n    pm_max_version_exceeded_mode: serializePmMaxVersionExceededMode(policy.pmMaxVersionExceededMode),\n    require_provenance: policy.requireProvenance,\n    trusted_extensions: toSortedList(policy.trustedExtensions),\n    default_sandbox_profile: policy.defaultSandboxProfile,\n    allowed_extensions: toSortedList(policy.allowedExtensions),\n    blocked_extensions: toSortedList(policy.blockedExtensions),\n    allowed_capabilities: toSortedList(policy.allowedCapabilities),\n    blocked_capabilities: toSortedList(policy.blockedCapabilities),\n    allowed_surfaces: toSortedList(policy.allowedSurfaces),\n    blocked_surfaces: toSortedList(policy.blockedSurfaces),\n    allowed_commands: toSortedList(policy.allowedCommands),\n    blocked_commands: toSortedList(policy.blockedCommands),\n    allowed_actions: toSortedList(policy.allowedActions),\n    blocked_actions: toSortedList(policy.blockedActions),\n    allowed_services: toSortedList(policy.allowedServices),\n    blocked_services: toSortedList(policy.blockedServices),\n    extension_overrides: overrides,\n  };\n}\n\nexport function hydrateExtensionPolicy(policy: ExtensionGovernancePolicy): NormalizedExtensionPolicy {\n  const overridesByName = collectExtensionPolicyOverrides(policy.extension_overrides);\n  return {\n    mode: normalizePolicyMode(policy.mode),\n    trustMode: normalizePolicyTrustMode(policy.trust_mode),\n    pmMaxVersionExceededMode: normalizePmMaxVersionExceededMode(policy.pm_max_version_exceeded_mode),\n    requireProvenance: policy.require_provenance === true,\n    trustedExtensions: normalizePolicyStringSet(policy.trusted_extensions),\n    defaultSandboxProfile: normalizePolicySandboxProfile(policy.default_sandbox_profile),\n    allowedExtensions: normalizePolicyStringSet(policy.allowed_extensions),\n    blockedExtensions: normalizePolicyStringSet(policy.blocked_extensions),\n    allowedCapabilities: normalizePolicyStringSet(policy.allowed_capabilities),\n    blockedCapabilities: normalizePolicyStringSet(policy.blocked_capabilities),\n    allowedSurfaces: normalizePolicySurfaceSet(policy.allowed_surfaces),\n    blockedSurfaces: normalizePolicySurfaceSet(policy.blocked_surfaces),\n    allowedCommands: normalizePolicyStringSet(policy.allowed_commands),\n    blockedCommands: normalizePolicyStringSet(policy.blocked_commands),\n    allowedActions: normalizePolicyStringSet(policy.allowed_actions),\n    blockedActions: normalizePolicyStringSet(policy.blocked_actions),\n    allowedServices: normalizePolicyStringSet(policy.allowed_services),\n    blockedServices: normalizePolicyStringSet(policy.blocked_services),\n    overridesByName,\n    warnings: [],\n  };\n}\n\nfunction resolvePolicyOverride(\n  policy: NormalizedExtensionPolicy,\n  extensionName: string,\n): NormalizedExtensionPolicyOverride | null {\n  return policy.overridesByName.get(normalizePolicyName(extensionName)) ?? null;\n}\n\nfunction evaluatePolicySet(\n  allowed: Set<string>,\n  blocked: Set<string>,\n  value: string,\n  notAllowlistedReason: string,\n  blockedReason: string,\n): string | null {\n  if (blocked.has(value)) {\n    return blockedReason;\n  }\n  if (allowed.size > 0 && !allowed.has(value)) {\n    return notAllowlistedReason;\n  }\n  return null;\n}\n\nfunction resolvePolicyCapabilityReason(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  capability: string,\n): string | null {\n  const normalizedCapability = capability.trim().toLowerCase();\n  const override = resolvePolicyOverride(policy, extension.name);\n  const allowed = override && override.allowedCapabilities.size > 0 ? override.allowedCapabilities : policy.allowedCapabilities;\n  const blocked = new Set<string>([\n    ...policy.blockedCapabilities,\n    ...(override ? override.blockedCapabilities : []),\n  ]);\n  return evaluatePolicySet(\n    allowed,\n    blocked,\n    normalizedCapability,\n    \"capability_not_allowlisted\",\n    \"capability_blocked\",\n  );\n}\n\nfunction resolvePolicySurfaceReason(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  surface: ExtensionPolicySurface,\n): string | null {\n  const override = resolvePolicyOverride(policy, extension.name);\n  const allowed = override && override.allowedSurfaces.size > 0 ? override.allowedSurfaces : policy.allowedSurfaces;\n  const blocked = new Set<string>([\n    ...policy.blockedSurfaces,\n    ...(override ? override.blockedSurfaces : []),\n  ]);\n  return evaluatePolicySet(allowed, blocked, surface, \"surface_not_allowlisted\", \"surface_blocked\");\n}\n\nfunction resolvePolicyCommandReason(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  command: string,\n): string | null {\n  const normalizedCommand = normalizeCommandName(command);\n  if (normalizedCommand.length === 0) {\n    return null;\n  }\n  const override = resolvePolicyOverride(policy, extension.name);\n  const allowed = override && override.allowedCommands.size > 0 ? override.allowedCommands : policy.allowedCommands;\n  const blocked = new Set<string>([\n    ...policy.blockedCommands,\n    ...(override ? override.blockedCommands : []),\n  ]);\n  return evaluatePolicySet(allowed, blocked, normalizedCommand, \"command_not_allowlisted\", \"command_blocked\");\n}\n\nfunction resolvePolicyActionReason(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  action: string,\n): string | null {\n  const normalizedAction = normalizePolicyName(action).replace(/\\s+/g, \"-\");\n  if (normalizedAction.length === 0) {\n    return null;\n  }\n  const override = resolvePolicyOverride(policy, extension.name);\n  const allowed = override && override.allowedActions.size > 0 ? override.allowedActions : policy.allowedActions;\n  const blocked = new Set<string>([\n    ...policy.blockedActions,\n    ...(override ? override.blockedActions : []),\n  ]);\n  return evaluatePolicySet(allowed, blocked, normalizedAction, \"action_not_allowlisted\", \"action_blocked\");\n}\n\nfunction resolvePolicyServiceReason(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  service: string,\n): string | null {\n  const normalizedService = normalizePolicyName(service);\n  if (normalizedService.length === 0) {\n    return null;\n  }\n  const override = resolvePolicyOverride(policy, extension.name);\n  const allowed = override && override.allowedServices.size > 0 ? override.allowedServices : policy.allowedServices;\n  const blocked = new Set<string>([\n    ...policy.blockedServices,\n    ...(override ? override.blockedServices : []),\n  ]);\n  return evaluatePolicySet(allowed, blocked, normalizedService, \"service_not_allowlisted\", \"service_blocked\");\n}\n\nfunction resolvePolicyExtensionReason(policy: NormalizedExtensionPolicy, extension: PolicyExtensionRef): string | null {\n  const name = normalizePolicyName(extension.name);\n  const override = resolvePolicyOverride(policy, extension.name);\n  if (override?.disabled === true) {\n    return \"extension_override_disabled\";\n  }\n  return evaluatePolicySet(\n    policy.allowedExtensions,\n    policy.blockedExtensions,\n    name,\n    \"extension_not_allowlisted\",\n    \"extension_blocked\",\n  );\n}\n\nfunction resolvePolicyTrustReason(policy: NormalizedExtensionPolicy, extension: PolicyExtensionRef): string | null {\n  if (policy.trustMode === \"off\") {\n    return null;\n  }\n  const override = resolvePolicyOverride(policy, extension.name);\n  const name = normalizePolicyName(extension.name);\n  const trusted = extension.trusted === true;\n  const provenanceVerified = extension.provenanceVerified === true;\n\n  if (policy.trustedExtensions.size > 0 && !policy.trustedExtensions.has(name)) {\n    return \"extension_not_trusted\";\n  }\n  if ((override?.requireTrusted === true || policy.trustMode === \"warn\" || policy.trustMode === \"enforce\") && !trusted) {\n    return \"extension_untrusted\";\n  }\n  if ((policy.requireProvenance || override?.requireProvenance === true) && !provenanceVerified) {\n    return \"provenance_missing_or_unverified\";\n  }\n  return null;\n}\n\nfunction resolvePolicySandboxReason(policy: NormalizedExtensionPolicy, extension: PolicyExtensionRef): string | null {\n  if (policy.mode === \"off\") {\n    return null;\n  }\n  const override = resolvePolicyOverride(policy, extension.name);\n  const profile = override?.sandboxProfile ?? extension.sandboxProfile ?? policy.defaultSandboxProfile;\n  if (profile === \"none\") {\n    return null;\n  }\n  const permissions = extension.permissions;\n  if (!permissions) {\n    return \"sandbox_permissions_missing\";\n  }\n\n  const hasPermission = (name: keyof typeof permissions): boolean => permissions[name] === true;\n  if (profile === \"restricted\") {\n    if (hasPermission(\"process_spawn\")) {\n      return \"sandbox_restricted_disallows_process_spawn\";\n    }\n    if (hasPermission(\"env_write\")) {\n      return \"sandbox_restricted_disallows_env_write\";\n    }\n    return null;\n  }\n\n  if (profile === \"strict\") {\n    if (hasPermission(\"process_spawn\")) {\n      return \"sandbox_strict_disallows_process_spawn\";\n    }\n    if (hasPermission(\"network\")) {\n      return \"sandbox_strict_disallows_network\";\n    }\n    if (hasPermission(\"fs_write\")) {\n      return \"sandbox_strict_disallows_fs_write\";\n    }\n    if (hasPermission(\"env_write\")) {\n      return \"sandbox_strict_disallows_env_write\";\n    }\n  }\n  return null;\n}\n\nfunction buildPolicyWarning(\n  mode: \"blocked\" | \"violation\",\n  scope: \"extension\" | \"capability\" | \"registration\" | \"trust\",\n  extension: PolicyExtensionRef,\n  reason: string,\n  details: Record<string, string> = {},\n): string {\n  const tokens = Object.entries(details)\n    .sort((left, right) => left[0].localeCompare(right[0]))\n    .map(([key, value]) => `${key}=${value}`)\n    .join(\":\");\n  const suffix = tokens.length > 0 ? `:${tokens}` : \"\";\n  return `extension_policy_${mode}_${scope}:${extension.layer}:${extension.name}:reason=${reason}${suffix}`;\n}\n\nexport function evaluateExtensionPolicyForExtension(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n): { allowed: boolean; warning: string | null } {\n  if (policy.mode === \"off\" && policy.trustMode === \"off\") {\n    return { allowed: true, warning: null };\n  }\n  const reason = resolvePolicyExtensionReason(policy, extension);\n  const trustReason = resolvePolicyTrustReason(policy, extension);\n  const sandboxReason = resolvePolicySandboxReason(policy, extension);\n  const extensionEnforced = reason && policy.mode === \"enforce\";\n  const trustEnforced = trustReason && policy.trustMode === \"enforce\";\n  const sandboxEnforced = sandboxReason && policy.mode === \"enforce\";\n  if (!reason && !trustReason && !sandboxReason) {\n    return { allowed: true, warning: null };\n  }\n  if (extensionEnforced) {\n    return {\n      allowed: false,\n      warning: buildPolicyWarning(\"blocked\", \"extension\", extension, reason),\n    };\n  }\n  if (trustEnforced) {\n    return {\n      allowed: false,\n      warning: buildPolicyWarning(\"blocked\", \"trust\", extension, trustReason),\n    };\n  }\n  if (sandboxEnforced) {\n    return {\n      allowed: false,\n      warning: buildPolicyWarning(\"blocked\", \"extension\", extension, sandboxReason),\n    };\n  }\n  if (reason && policy.mode === \"warn\") {\n    return {\n      allowed: true,\n      warning: buildPolicyWarning(\"violation\", \"extension\", extension, reason),\n    };\n  }\n  if (trustReason && policy.trustMode === \"warn\") {\n    return {\n      allowed: true,\n      warning: buildPolicyWarning(\"violation\", \"trust\", extension, trustReason),\n    };\n  }\n  if (sandboxReason && policy.mode === \"warn\") {\n    return {\n      allowed: true,\n      warning: buildPolicyWarning(\"violation\", \"extension\", extension, sandboxReason),\n    };\n  }\n  return {\n    allowed: true,\n    warning: null,\n  };\n}\n\nexport function evaluateExtensionPolicyForCapability(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  capability: string,\n): { allowed: boolean; warning: string | null } {\n  if (policy.mode === \"off\") {\n    return { allowed: true, warning: null };\n  }\n  const reason = resolvePolicyCapabilityReason(policy, extension, capability);\n  if (!reason) {\n    return { allowed: true, warning: null };\n  }\n  return {\n    allowed: policy.mode === \"warn\",\n    warning: buildPolicyWarning(\n    policy.mode === \"warn\" ? \"violation\" : \"blocked\",\n    \"capability\",\n    extension,\n    reason,\n    { capability: capability.trim().toLowerCase() },\n    ),\n  };\n}\n\nexport function evaluateExtensionPolicyForRegistration(\n  policy: NormalizedExtensionPolicy,\n  extension: PolicyExtensionRef,\n  surface: ExtensionPolicySurface,\n  method: string,\n  capability?: ExtensionCapability,\n  details?: {\n    command?: string;\n    action?: string;\n    service?: string;\n  },\n): { allowed: boolean; warning: string | null } {\n  if (policy.mode === \"off\") {\n    return { allowed: true, warning: null };\n  }\n  const capabilityReason =\n    typeof capability === \"string\" ? resolvePolicyCapabilityReason(policy, extension, capability) : null;\n  const surfaceReason = resolvePolicySurfaceReason(policy, extension, surface);\n  const commandReason = details?.command ? resolvePolicyCommandReason(policy, extension, details.command) : null;\n  const actionReason = details?.action ? resolvePolicyActionReason(policy, extension, details.action) : null;\n  const serviceReason = details?.service ? resolvePolicyServiceReason(policy, extension, details.service) : null;\n  const reason = capabilityReason ?? surfaceReason ?? commandReason ?? actionReason ?? serviceReason;\n  if (!reason) {\n    return { allowed: true, warning: null };\n  }\n  const warningDetails: Record<string, string> = {\n    method: normalizePolicyName(method).replace(/\\s+/g, \"_\"),\n    surface,\n  };\n  if (capability) {\n    warningDetails.capability = capability;\n  }\n  if (details?.command) {\n    warningDetails.command = normalizeCommandName(details.command);\n  }\n  if (details?.action) {\n    warningDetails.action = normalizePolicyName(details.action).replace(/\\s+/g, \"-\");\n  }\n  if (details?.service) {\n    warningDetails.service = normalizePolicyName(details.service);\n  }\n  const warning = buildPolicyWarning(\n    policy.mode === \"warn\" ? \"violation\" : \"blocked\",\n    \"registration\",\n    extension,\n    reason,\n    warningDetails,\n  );\n  return {\n    allowed: policy.mode === \"warn\",\n    warning,\n  };\n}\n"],"names":[],"mappings":";;AAAA,OAAO,EACL,4BAA4B,EAC5B,+BAA+B,EAC/B,gCAAgC,EAChC,2BAA2B,EAC3B,mCAAmC,GAWpC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EAAE,0BAA0B,EAAE,MAAM,mCAAmC,CAAC;AAC/E,OAAO,EAAE,oBAAoB,EAAE,MAAM,gCAAgC,CAAC;AA2DtE,SAAS,mBAAmB,CAAC,KAAyB;IACpD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAqC;IACrE,OAAO,IAAI,GAAG,CACZ,CAAC,MAAM,IAAI,EAAE,CAAC;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;SAC1C,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAa;IAChD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,QAAQ,GAAG,UAAU;SACxB,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;SACjD,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC3C,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1B,OAAO,QAAQ,CAAC,CAAC,CAAC,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC;AACxD,CAAC;AAED,SAAS,yBAAyB,CAAC,MAAqC;IACtE,OAAO,IAAI,GAAG,CACZ,CAAC,MAAM,IAAI,EAAE,CAAC;SACX,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,2BAA2B,CAAC,KAAK,CAAC,CAAC;SAClD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CACvC,CAAC;AACJ,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAyB;IACpD,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAK,4BAAkD,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7E,OAAO,UAAiC,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,wBAAwB,CAAC,KAAyB;IACzD,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAK,2BAAiD,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QAC5E,OAAO,UAAgC,CAAC;IAC1C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,6BAA6B,CAAC,KAAyB;IACrE,MAAM,UAAU,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;IAC9C,IAAK,gCAAsD,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACjF,OAAO,UAAqC,CAAC;IAC/C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,sCAAsC,CAAC,KAAc;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAQ,mCAAyD,CAAC,QAAQ,CAAC,UAAU,CAAC;QACpF,CAAC,CAAE,UAAuC;QAC1C,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iCAAiC,CAC/C,KAAkD;IAElD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,IAAI,GAAG,sCAAsC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC;QACtE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzE,OAAO;YACL,MAAM,EAAE,sCAAsC,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,OAAO;YACvE,OAAO,EAAE,sCAAsC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,OAAO;SAC1E,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC;AAED,SAAS,iCAAiC,CACxC,IAAwC;IAExC,OAAO,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AACrG,CAAC;AAED,SAAS,YAAY,CAAC,MAAwB;IAC5C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,SAAS,4BAA4B,CACnC,WAAoC;IAEpC,MAAM,IAAI,GAAG,mBAAmB,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO;QACL,IAAI;QACJ,UAAU,EAAE;YACV,IAAI;YACJ,QAAQ,EAAE,WAAW,CAAC,QAAQ,KAAK,IAAI;YACvC,cAAc,EAAE,WAAW,CAAC,eAAe,KAAK,IAAI;YACpD,iBAAiB,EAAE,WAAW,CAAC,kBAAkB,KAAK,IAAI;YAC1D,cAAc,EACZ,WAAW,CAAC,eAAe,KAAK,SAAS;gBACvC,CAAC,CAAC,6BAA6B,CAAC,WAAW,CAAC,eAAe,CAAC;gBAC5D,CAAC,CAAC,SAAS;YACf,mBAAmB,EAAE,wBAAwB,CAAC,WAAW,CAAC,oBAAoB,CAAC;YAC/E,mBAAmB,EAAE,wBAAwB,CAAC,WAAW,CAAC,oBAAoB,CAAC;YAC/E,eAAe,EAAE,yBAAyB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACxE,eAAe,EAAE,yBAAyB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACxE,eAAe,EAAE,wBAAwB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACvE,eAAe,EAAE,wBAAwB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACvE,cAAc,EAAE,wBAAwB,CAAC,WAAW,CAAC,eAAe,CAAC;YACrE,cAAc,EAAE,wBAAwB,CAAC,WAAW,CAAC,eAAe,CAAC;YACrE,eAAe,EAAE,wBAAwB,CAAC,WAAW,CAAC,gBAAgB,CAAC;YACvE,eAAe,EAAE,wBAAwB,CAAC,WAAW,CAAC,gBAAgB,CAAC;SACxE;KACF,CAAC;AACJ,CAAC;AAED,SAAS,+BAA+B,CACtC,YAA4D;IAE5D,MAAM,eAAe,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC7E,KAAK,MAAM,WAAW,IAAI,YAAY,IAAI,EAAE,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,4BAA4B,CAAC,WAAW,CAAC,CAAC;QACxD,IAAI,KAAK,EAAE,CAAC;YACV,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;QACpD,CAAC;IACH,CAAC;IACD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,QAAoB;IAC3D,MAAM,MAAM,GAAG,QAAQ,CAAC,UAAU,CAAC,MAA+C,CAAC;IACnF,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAC/C,MAAM,SAAS,GAAG,wBAAwB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAC/D,MAAM,wBAAwB,GAAG,iCAAiC,CAAC,MAAM,EAAE,4BAA4B,CAAC,CAAC;IACzG,MAAM,iBAAiB,GAAG,MAAM,EAAE,kBAAkB,KAAK,IAAI,CAAC;IAC9D,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/E,MAAM,qBAAqB,GAAG,6BAA6B,CAAC,MAAM,EAAE,uBAAuB,CAAC,CAAC;IAC7F,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/E,MAAM,iBAAiB,GAAG,wBAAwB,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC;IAC/E,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnF,MAAM,mBAAmB,GAAG,wBAAwB,CAAC,MAAM,EAAE,oBAAoB,CAAC,CAAC;IACnF,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,yBAAyB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC5E,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,cAAc,GAAG,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,cAAc,GAAG,wBAAwB,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACzE,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,wBAAwB,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;IAC3E,MAAM,eAAe,GAAG,+BAA+B,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IAErF,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,GAAG,mBAAmB,EAAE,GAAG,mBAAmB,CAAC,CAAC,EAAE,CAAC;QACxF,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;YAC5C,QAAQ,CAAC,IAAI,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;QACrE,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChH,KAAK,MAAM,UAAU,IAAI,YAAY,CAAC,CAAC,GAAG,QAAQ,CAAC,mBAAmB,EAAE,GAAG,QAAQ,CAAC,mBAAmB,CAAC,CAAC,EAAE,CAAC;YAC1G,IAAI,CAAC,0BAA0B,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5C,QAAQ,CAAC,IAAI,CAAC,uCAAuC,QAAQ,CAAC,IAAI,IAAI,UAAU,EAAE,CAAC,CAAC;YACtF,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,aAAa,GAAG,IAAI,GAAG,CAAS,+BAA+B,CAAC,CAAC;IACvE,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,CAAC,GAAG,eAAe,EAAE,GAAG,eAAe,CAAC,CAAC,EAAE,CAAC;QAC7E,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,QAAQ,CAAC,IAAI,CAAC,oCAAoC,OAAO,EAAE,CAAC,CAAC;QAC/D,CAAC;IACH,CAAC;IACD,KAAK,MAAM,QAAQ,IAAI,CAAC,GAAG,eAAe,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAChH,KAAK,MAAM,OAAO,IAAI,YAAY,CAAC,CAAC,GAAG,QAAQ,CAAC,eAAe,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,CAAC,EAAE,CAAC;YAC/F,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;gBAChC,QAAQ,CAAC,IAAI,CAAC,oCAAoC,QAAQ,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC;YAChF,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO;QACL,IAAI;QACJ,SAAS;QACT,wBAAwB;QACxB,iBAAiB;QACjB,iBAAiB;QACjB,qBAAqB;QACrB,iBAAiB;QACjB,iBAAiB;QACjB,mBAAmB;QACnB,mBAAmB;QACnB,eAAe;QACf,eAAe;QACf,eAAe;QACf,eAAe;QACf,cAAc;QACd,cAAc;QACd,eAAe;QACf,eAAe;QACf,eAAe;QACf,QAAQ,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;KAClF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,wBAAwB,CAAC,MAAiC;IACxE,MAAM,SAAS,GAAG,CAAC,GAAG,MAAM,CAAC,eAAe,CAAC,MAAM,EAAE,CAAC;SACnD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;SAC1D,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;QAClB,IAAI,EAAE,QAAQ,CAAC,IAAI;QACnB,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChD,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,GAAG,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,QAAQ,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAChF,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,GAAG,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,YAAY,CAAC,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtH,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,YAAY,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvG,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1G,GAAG,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,gBAAgB,EAAE,YAAY,CAAC,QAAQ,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3G,CAAC,CAAC,CAAC;IACN,OAAO;QACL,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,UAAU,EAAE,MAAM,CAAC,SAAS;QAC5B,4BAA4B,EAAE,iCAAiC,CAAC,MAAM,CAAC,wBAAwB,CAAC;QAChG,kBAAkB,EAAE,MAAM,CAAC,iBAAiB;QAC5C,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1D,uBAAuB,EAAE,MAAM,CAAC,qBAAqB;QACrD,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1D,kBAAkB,EAAE,YAAY,CAAC,MAAM,CAAC,iBAAiB,CAAC;QAC1D,oBAAoB,EAAE,YAAY,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC9D,oBAAoB,EAAE,YAAY,CAAC,MAAM,CAAC,mBAAmB,CAAC;QAC9D,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC;QACpD,eAAe,EAAE,YAAY,CAAC,MAAM,CAAC,cAAc,CAAC;QACpD,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,gBAAgB,EAAE,YAAY,CAAC,MAAM,CAAC,eAAe,CAAC;QACtD,mBAAmB,EAAE,SAAS;KAC/B,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sBAAsB,CAAC,MAAiC;IACtE,MAAM,eAAe,GAAG,+BAA+B,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC;IACpF,OAAO;QACL,IAAI,EAAE,mBAAmB,CAAC,MAAM,CAAC,IAAI,CAAC;QACtC,SAAS,EAAE,wBAAwB,CAAC,MAAM,CAAC,UAAU,CAAC;QACtD,wBAAwB,EAAE,iCAAiC,CAAC,MAAM,CAAC,4BAA4B,CAAC;QAChG,iBAAiB,EAAE,MAAM,CAAC,kBAAkB,KAAK,IAAI;QACrD,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACtE,qBAAqB,EAAE,6BAA6B,CAAC,MAAM,CAAC,uBAAuB,CAAC;QACpF,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACtE,iBAAiB,EAAE,wBAAwB,CAAC,MAAM,CAAC,kBAAkB,CAAC;QACtE,mBAAmB,EAAE,wBAAwB,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC1E,mBAAmB,EAAE,wBAAwB,CAAC,MAAM,CAAC,oBAAoB,CAAC;QAC1E,eAAe,EAAE,yBAAyB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACnE,eAAe,EAAE,yBAAyB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QACnE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClE,cAAc,EAAE,wBAAwB,CAAC,MAAM,CAAC,eAAe,CAAC;QAChE,cAAc,EAAE,wBAAwB,CAAC,MAAM,CAAC,eAAe,CAAC;QAChE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClE,eAAe,EAAE,wBAAwB,CAAC,MAAM,CAAC,gBAAgB,CAAC;QAClE,eAAe;QACf,QAAQ,EAAE,EAAE;KACb,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB,CAC5B,MAAiC,EACjC,aAAqB;IAErB,OAAO,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,mBAAmB,CAAC,aAAa,CAAC,CAAC,IAAI,IAAI,CAAC;AAChF,CAAC;AAED,SAAS,iBAAiB,CACxB,OAAoB,EACpB,OAAoB,EACpB,KAAa,EACb,oBAA4B,EAC5B,aAAqB;IAErB,IAAI,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO,aAAa,CAAC;IACvB,CAAC;IACD,IAAI,OAAO,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5C,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,6BAA6B,CACpC,MAAiC,EACjC,SAA6B,EAC7B,UAAkB;IAElB,MAAM,oBAAoB,GAAG,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC7D,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,mBAAmB,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC,mBAAmB,CAAC;IAC9H,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;QAC9B,GAAG,MAAM,CAAC,mBAAmB;QAC7B,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,CAAC;KAClD,CAAC,CAAC;IACH,OAAO,iBAAiB,CACtB,OAAO,EACP,OAAO,EACP,oBAAoB,EACpB,4BAA4B,EAC5B,oBAAoB,CACrB,CAAC;AACJ,CAAC;AAED,SAAS,0BAA0B,CACjC,MAAiC,EACjC,SAA6B,EAC7B,OAA+B;IAE/B,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IAClH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;QAC9B,GAAG,MAAM,CAAC,eAAe;QACzB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,yBAAyB,EAAE,iBAAiB,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,0BAA0B,CACjC,MAAiC,EACjC,SAA6B,EAC7B,OAAe;IAEf,MAAM,iBAAiB,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IAClH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;QAC9B,GAAG,MAAM,CAAC,eAAe;QACzB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,iBAAiB,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,yBAAyB,CAChC,MAAiC,EACjC,SAA6B,EAC7B,MAAc;IAEd,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAC1E,IAAI,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,cAAc,CAAC;IAC/G,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;QAC9B,GAAG,MAAM,CAAC,cAAc;QACxB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,gBAAgB,CAAC,CAAC;AAC3G,CAAC;AAED,SAAS,0BAA0B,CACjC,MAAiC,EACjC,SAA6B,EAC7B,OAAe;IAEf,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACvD,IAAI,iBAAiB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnC,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,IAAI,QAAQ,CAAC,eAAe,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,eAAe,CAAC;IAClH,MAAM,OAAO,GAAG,IAAI,GAAG,CAAS;QAC9B,GAAG,MAAM,CAAC,eAAe;QACzB,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,CAAC;KAC9C,CAAC,CAAC;IACH,OAAO,iBAAiB,CAAC,OAAO,EAAE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,iBAAiB,CAAC,CAAC;AAC9G,CAAC;AAED,SAAS,4BAA4B,CAAC,MAAiC,EAAE,SAA6B;IACpG,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,IAAI,QAAQ,EAAE,QAAQ,KAAK,IAAI,EAAE,CAAC;QAChC,OAAO,6BAA6B,CAAC;IACvC,CAAC;IACD,OAAO,iBAAiB,CACtB,MAAM,CAAC,iBAAiB,EACxB,MAAM,CAAC,iBAAiB,EACxB,IAAI,EACJ,2BAA2B,EAC3B,mBAAmB,CACpB,CAAC;AACJ,CAAC;AAED,SAAS,wBAAwB,CAAC,MAAiC,EAAE,SAA6B;IAChG,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,IAAI,GAAG,mBAAmB,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG,SAAS,CAAC,OAAO,KAAK,IAAI,CAAC;IAC3C,MAAM,kBAAkB,GAAG,SAAS,CAAC,kBAAkB,KAAK,IAAI,CAAC;IAEjE,IAAI,MAAM,CAAC,iBAAiB,CAAC,IAAI,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,iBAAiB,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,OAAO,uBAAuB,CAAC;IACjC,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,cAAc,KAAK,IAAI,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QACrH,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IACD,IAAI,CAAC,MAAM,CAAC,iBAAiB,IAAI,QAAQ,EAAE,iBAAiB,KAAK,IAAI,CAAC,IAAI,CAAC,kBAAkB,EAAE,CAAC;QAC9F,OAAO,kCAAkC,CAAC;IAC5C,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,0BAA0B,CAAC,MAAiC,EAAE,SAA6B;IAClG,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,QAAQ,GAAG,qBAAqB,CAAC,MAAM,EAAE,SAAS,CAAC,IAAI,CAAC,CAAC;IAC/D,MAAM,OAAO,GAAG,QAAQ,EAAE,cAAc,IAAI,SAAS,CAAC,cAAc,IAAI,MAAM,CAAC,qBAAqB,CAAC;IACrG,IAAI,OAAO,KAAK,MAAM,EAAE,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,MAAM,WAAW,GAAG,SAAS,CAAC,WAAW,CAAC;IAC1C,IAAI,CAAC,WAAW,EAAE,CAAC;QACjB,OAAO,6BAA6B,CAAC;IACvC,CAAC;IAED,MAAM,aAAa,GAAG,CAAC,IAA8B,EAAW,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC;IAC9F,IAAI,OAAO,KAAK,YAAY,EAAE,CAAC;QAC7B,IAAI,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,OAAO,4CAA4C,CAAC;QACtD,CAAC;QACD,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,wCAAwC,CAAC;QAClD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,aAAa,CAAC,eAAe,CAAC,EAAE,CAAC;YACnC,OAAO,wCAAwC,CAAC;QAClD,CAAC;QACD,IAAI,aAAa,CAAC,SAAS,CAAC,EAAE,CAAC;YAC7B,OAAO,kCAAkC,CAAC;QAC5C,CAAC;QACD,IAAI,aAAa,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,mCAAmC,CAAC;QAC7C,CAAC;QACD,IAAI,aAAa,CAAC,WAAW,CAAC,EAAE,CAAC;YAC/B,OAAO,oCAAoC,CAAC;QAC9C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,kBAAkB,CACzB,IAA6B,EAC7B,KAA4D,EAC5D,SAA6B,EAC7B,MAAc,EACd,UAAkC,EAAE;IAEpC,MAAM,MAAM,GAAG,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC;SACnC,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;SACtD,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;SACxC,IAAI,CAAC,GAAG,CAAC,CAAC;IACb,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACrD,OAAO,oBAAoB,IAAI,IAAI,KAAK,IAAI,SAAS,CAAC,KAAK,IAAI,SAAS,CAAC,IAAI,WAAW,MAAM,GAAG,MAAM,EAAE,CAAC;AAC5G,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,MAAiC,EACjC,SAA6B;IAE7B,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,IAAI,MAAM,CAAC,SAAS,KAAK,KAAK,EAAE,CAAC;QACxD,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,4BAA4B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAC/D,MAAM,WAAW,GAAG,wBAAwB,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IAChE,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACpE,MAAM,iBAAiB,GAAG,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IAC9D,MAAM,aAAa,GAAG,WAAW,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,CAAC;IACpE,MAAM,eAAe,GAAG,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC;IACnE,IAAI,CAAC,MAAM,IAAI,CAAC,WAAW,IAAI,CAAC,aAAa,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,IAAI,iBAAiB,EAAE,CAAC;QACtB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kBAAkB,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC;SACvE,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,EAAE,CAAC;QAClB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kBAAkB,CAAC,SAAS,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC;SACxE,CAAC;IACJ,CAAC;IACD,IAAI,eAAe,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO,EAAE,kBAAkB,CAAC,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;SAC9E,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QACrC,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,MAAM,CAAC;SACzE,CAAC;IACJ,CAAC;IACD,IAAI,WAAW,IAAI,MAAM,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QAC/C,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,kBAAkB,CAAC,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC;SAC1E,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;QAC5C,OAAO;YACL,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,kBAAkB,CAAC,WAAW,EAAE,WAAW,EAAE,SAAS,EAAE,aAAa,CAAC;SAChF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,IAAI;KACd,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,oCAAoC,CAClD,MAAiC,EACjC,SAA6B,EAC7B,UAAkB;IAElB,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,MAAM,GAAG,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC;IAC5E,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM;QAC/B,OAAO,EAAE,kBAAkB,CAC3B,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAChD,YAAY,EACZ,SAAS,EACT,MAAM,EACN,EAAE,UAAU,EAAE,UAAU,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAC9C;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,sCAAsC,CACpD,MAAiC,EACjC,SAA6B,EAC7B,OAA+B,EAC/B,MAAc,EACd,UAAgC,EAChC,OAIC;IAED,IAAI,MAAM,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,gBAAgB,GACpB,OAAO,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,6BAA6B,CAAC,MAAM,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACvG,MAAM,aAAa,GAAG,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7E,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,MAAM,YAAY,GAAG,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,yBAAyB,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3G,MAAM,aAAa,GAAG,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,0BAA0B,CAAC,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC/G,MAAM,MAAM,GAAG,gBAAgB,IAAI,aAAa,IAAI,aAAa,IAAI,YAAY,IAAI,aAAa,CAAC;IACnG,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC1C,CAAC;IACD,MAAM,cAAc,GAA2B;QAC7C,MAAM,EAAE,mBAAmB,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC;QACxD,OAAO;KACR,CAAC;IACF,IAAI,UAAU,EAAE,CAAC;QACf,cAAc,CAAC,UAAU,GAAG,UAAU,CAAC;IACzC,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,cAAc,CAAC,OAAO,GAAG,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACjE,CAAC;IACD,IAAI,OAAO,EAAE,MAAM,EAAE,CAAC;QACpB,cAAc,CAAC,MAAM,GAAG,mBAAmB,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACnF,CAAC;IACD,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;QACrB,cAAc,CAAC,OAAO,GAAG,mBAAmB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChE,CAAC;IACD,MAAM,OAAO,GAAG,kBAAkB,CAChC,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,EAChD,cAAc,EACd,SAAS,EACT,MAAM,EACN,cAAc,CACf,CAAC;IACF,OAAO;QACL,OAAO,EAAE,MAAM,CAAC,IAAI,KAAK,MAAM;QAC/B,OAAO;KACR,CAAC;AACJ,CAAC","debugId":"5f65a8a3-c45a-5178-918a-32153c97cce6"}

package/dist/core/extensions/extension-types.d.ts

@@ -17,6 +17,20 @@ export declare const KNOWN_EXTENSION_TRUST_MODES: readonly ["off", "warn", "enfo
 export type ExtensionTrustMode = (typeof KNOWN_EXTENSION_TRUST_MODES)[number];
 export declare const KNOWN_EXTENSION_SANDBOX_PROFILES: readonly ["none", "restricted", "strict"];
 export type ExtensionSandboxProfile = (typeof KNOWN_EXTENSION_SANDBOX_PROFILES)[number];
+export declare const KNOWN_PM_MAX_VERSION_EXCEEDED_MODES: readonly ["block", "warn"];
+/** How a `pm_max_version` violation is handled for an extension layer. */
+export type PmMaxVersionExceededMode = (typeof KNOWN_PM_MAX_VERSION_EXCEEDED_MODES)[number];
+/** Optional per-layer override map for `extensions.policy.pm_max_version_exceeded_mode`. */
+export interface PmMaxVersionExceededModeByLayer {
+    global?: PmMaxVersionExceededMode;
+    project?: PmMaxVersionExceededMode;
+}
+/**
+ * Settings value for `extensions.policy.pm_max_version_exceeded_mode`: either a
+ * single mode applied to both layers, or a per-layer override map. Unset (and
+ * any unset layer key) defaults to `"block"`.
+ */
+export type PmMaxVersionExceededModeSetting = PmMaxVersionExceededMode | PmMaxVersionExceededModeByLayer;
 export declare const KNOWN_EXTENSION_POLICY_SURFACES: readonly ["commands.override", "commands.handler", "hooks.beforecommand", "hooks.aftercommand", "hooks.onwrite", "hooks.onread", "hooks.onindex", "schema.flags", "schema.itemfields", "schema.itemtypes", "schema.migrations", "parser.override", "preflight.override", "services.override", "renderers.override", "importers.importer", "importers.exporter", "search.provider", "search.vectorstore"];
 export type ExtensionPolicySurface = (typeof KNOWN_EXTENSION_POLICY_SURFACES)[number];
 export declare const KNOWN_EXTENSION_SERVICE_NAMES: readonly ["output_format", "error_format", "help_format", "lock_acquire", "lock_release", "history_append", "item_store_write", "item_store_delete"];
@@ -39,7 +53,15 @@ export interface ExtensionActivationMetadata {
     commands?: string[];
 }
 export type ExtensionPolicyOverride = ExtensionPolicyOverrideSettings;
-export type ExtensionGovernancePolicy = ExtensionPolicySettings;
+/**
+ * Extension governance policy as read from / serialized to settings. Extends the
+ * stored settings shape with `pm_max_version_exceeded_mode` (pm-k5e8), which
+ * relaxes the default-BLOCK on `pm_max_version` violations to warn-only —
+ * globally or per extension layer.
+ */
+export type ExtensionGovernancePolicy = ExtensionPolicySettings & {
+    pm_max_version_exceeded_mode?: PmMaxVersionExceededModeSetting;
+};
 export interface ExtensionManifestEngines {
     pm?: string;
     node?: string;
@@ -65,6 +87,15 @@ export interface ExtensionManifest {
     activation?: ExtensionActivationMetadata;
     legacy_capability_aliases?: LegacyExtensionCapabilityAliasMapping[];
 }
+/**
+ * Author-facing `manifest.json` fields recognized by the extension loader, plus
+ * `$schema` (tolerated for inline IDE validation against
+ * `docs/schemas/extension-manifest.schema.json`). `legacy_capability_aliases`
+ * is loader-derived, never authored, so it is intentionally absent. A
+ * governance test keeps the published JSON Schema's `properties` in sync with
+ * this list.
+ */
+export declare const KNOWN_EXTENSION_MANIFEST_FIELDS: readonly ["$schema", "name", "version", "entry", "priority", "manifest_version", "pm_min_version", "pm_max_version", "engines", "trusted", "provenance", "sandbox_profile", "permissions", "capabilities", "activation"];
 export interface ExtensionDiagnostic {
     layer: ExtensionLayer;
     directory: string;
@@ -745,6 +776,14 @@ export interface ExtensionDeactivationFailure {
     name: string;
     error: string;
 }
+export interface ExtensionDeactivationOptions {
+    /**
+     * Maximum time to wait for each extension's `deactivate` hook. Defaults to
+     * 5000ms so a hanging teardown cannot block host shutdown or reload. Set to
+     * 0 or Infinity only when the host intentionally wants to wait indefinitely.
+     */
+    deactivate_timeout_ms?: number;
+}
 export interface ExtensionDeactivationResult {
     /** Count of loaded extensions whose `deactivate` hook ran without throwing. */
     deactivated: number;