@vinaes/succ 1.4.0 → 1.5.37

package/dist/lib/guardrails.js

@@ -0,0 +1,502 @@
+/**
+ * LLM Guardrails Module (Phase 3)
+ *
+ * Uses any OpenAI-compatible API (Ollama, OpenRouter, etc.) for:
+ * 1. classifySensitivity() — content → SecurityLabel (feeds IFC layer 4)
+ * 2. evaluateCodePolicy() — code → policy violations (OWASP SC2-SC7)
+ * 3. detectInjectionLLM() — content → injection classification (Tier 3)
+ *
+ * All functions:
+ * - Use LRU cache by content hash (1000 entries, 5-min TTL)
+ * - 3s timeout, fail-open (return null on error)
+ * - Daemon-only (not used in .cjs hooks)
+ */
+import { createHash } from 'crypto';
+import { callLLM } from './llm.js';
+import { getConfig } from './config.js';
+import { logWarn } from './fault-logger.js';
+import { stripControlChars } from './content-sanitizer.js';
+import { makeLabel, BOTTOM } from './ifc/label.js';
+import { SENSITIVITY_SYSTEM, CODE_POLICY_SYSTEM, INJECTION_DETECTION_SYSTEM, SENSITIVITY_LG_CATEGORIES, CODE_POLICY_LG_CATEGORIES, INJECTION_LG_CATEGORIES, } from '../prompts/guardrails.js';
+const CACHE_MAX_SIZE = 1000;
+const CACHE_TTL_MS = 5 * 60 * 1000; // 5 minutes
+class LRUCache {
+    map = new Map();
+    get(key) {
+        const entry = this.map.get(key);
+        if (!entry)
+            return undefined;
+        if (Date.now() - entry.timestamp > CACHE_TTL_MS) {
+            this.map.delete(key);
+            return undefined;
+        }
+        // Move to end (most recently used)
+        this.map.delete(key);
+        this.map.set(key, entry);
+        return entry.value;
+    }
+    set(key, value) {
+        if (this.map.size >= CACHE_MAX_SIZE) {
+            // Remove oldest (first entry)
+            const firstKey = this.map.keys().next().value;
+            if (firstKey !== undefined)
+                this.map.delete(firstKey);
+        }
+        this.map.set(key, { value, timestamp: Date.now() });
+    }
+    clear() {
+        this.map.clear();
+    }
+    get size() {
+        return this.map.size;
+    }
+}
+const sensitivityCache = new LRUCache();
+const codePolicyCache = new LRUCache();
+const injectionCache = new LRUCache();
+function contentHash(content) {
+    return createHash('sha256').update(content).digest('hex').slice(0, 16);
+}
+// ─── Config helpers ─────────────────────────────────────────────────
+function getGuardrailsConfig() {
+    try {
+        const config = getConfig();
+        const gc = config.security?.guardrails;
+        if (!gc)
+            return null;
+        return gc;
+    }
+    catch (err) {
+        logWarn('guardrails', `Failed to load guardrails config: ${err instanceof Error ? err.message : String(err)}`);
+        return null;
+    }
+}
+function isGuardrailsEnabled(feature) {
+    const gc = getGuardrailsConfig();
+    if (!gc)
+        return false;
+    return gc[feature] === true;
+}
+// ─── Llama Guard native format support ──────────────────────────────
+function isLlamaGuardModel(model) {
+    return /llama-guard/i.test(model || '');
+}
+/**
+ * Check if the guardrails endpoint is a local Ollama instance.
+ * Ollama wraps safeguard-family models in reasoning mode, so they return
+ * plain safe/unsafe text instead of JSON. On OpenRouter the same model
+ * (openai/gpt-oss-safeguard-20b) follows JSON instructions fine.
+ */
+function isLocalOllama(apiUrl) {
+    if (!apiUrl)
+        return false;
+    return /(?:localhost|127\.0\.0\.1|0\.0\.0\.0|\[::1\]):11434\b/.test(apiUrl);
+}
+/**
+ * Check if model uses safe/unsafe classification format.
+ * True for:
+ *   - Llama Guard models (always safe/unsafe format)
+ *   - Safeguard-family models served from Ollama (reasoning mode → plain text)
+ * False for:
+ *   - Safeguard on OpenRouter (responds with JSON normally)
+ */
+function isSafetyClassifierModel(model) {
+    if (isLlamaGuardModel(model))
+        return true;
+    // Safeguard via Ollama = reasoning model, needs Llama Guard format
+    const gc = getGuardrailsConfig();
+    if (/safeguard/i.test(model || '') && isLocalOllama(gc?.api_url))
+        return true;
+    return false;
+}
+/**
+ * Build a Llama Guard prompt with custom safety taxonomy.
+ * Llama Guard expects a specific format with category definitions
+ * and a conversation to classify.
+ */
+function formatLlamaGuardPrompt(content, categories) {
+    // Strip control/zero-width chars that could obfuscate injection, then escape framing delimiters
+    const cleaned = stripControlChars(content);
+    const escaped = cleaned
+        .replace(/<END CONVERSATION>/gi, '<END_CONVERSATION>')
+        .replace(/<BEGIN CONVERSATION>/gi, '<BEGIN_CONVERSATION>')
+        .replace(/<END UNSAFE CONTENT CATEGORIES>/gi, '<END_UNSAFE_CONTENT_CATEGORIES>')
+        .replace(/<BEGIN UNSAFE CONTENT CATEGORIES>/gi, '<BEGIN_UNSAFE_CONTENT_CATEGORIES>');
+    return [
+        "Task: Check if there is unsafe content in 'User' messages in conversations",
+        'according to our safety policy with the below categories.',
+        '',
+        '<BEGIN UNSAFE CONTENT CATEGORIES>',
+        categories,
+        '<END UNSAFE CONTENT CATEGORIES>',
+        '',
+        '<BEGIN CONVERSATION>',
+        `User: ${escaped}`,
+        '<END CONVERSATION>',
+        '',
+        'Provide your safety assessment for User in the above conversation:',
+        "- First line must read 'safe' or 'unsafe'.",
+        '- If unsafe, a second line must include a comma-separated list of violated categories.',
+    ].join('\n');
+}
+function parseLlamaGuardResponse(response) {
+    const lines = response
+        .trim()
+        .split('\n')
+        .map((l) => l.trim())
+        .filter(Boolean);
+    const safe = lines[0]?.toLowerCase() === 'safe';
+    const categories = safe
+        ? []
+        : lines[1]
+            ?.split(',')
+            .map((s) => s.trim())
+            .filter(Boolean) || [];
+    return { safe, categories };
+}
+// ─── Guardrails LLM call wrapper ────────────────────────────────────
+/**
+ * Call Ollama native /api/chat endpoint directly.
+ * Supports `think: true` for reasoning models, which enables proper content output.
+ * Falls back to null on any error (fail-open).
+ */
+async function callOllamaNativeChat(prompt, systemPrompt, model, timeout, maxTokens) {
+    const gc = getGuardrailsConfig();
+    if (!gc?.api_url)
+        return null;
+    // Derive Ollama base URL from api_url (strip /v1/chat/completions if present)
+    const baseUrl = gc.api_url.replace(/\/v1\/chat\/completions\/?$/, '').replace(/\/+$/, '');
+    const ollamaUrl = `${baseUrl}/api/chat`;
+    const messages = [];
+    if (systemPrompt)
+        messages.push({ role: 'system', content: systemPrompt });
+    messages.push({ role: 'user', content: prompt });
+    const response = await fetch(ollamaUrl, {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/json' },
+        body: JSON.stringify({
+            model,
+            messages,
+            stream: false,
+            think: true,
+            options: { num_predict: maxTokens },
+        }),
+        signal: AbortSignal.timeout(timeout),
+    });
+    if (!response.ok) {
+        logWarn('guardrails', `Ollama native chat error ${response.status}`);
+        return null;
+    }
+    const data = (await response.json());
+    // Ollama native format: data.message.content (may have data.message.thinking separately)
+    return data.message?.content || null;
+}
+async function callGuardrailsLLM(prompt, systemPrompt) {
+    const gc = getGuardrailsConfig();
+    const model = gc?.model || 'gpt-oss-safeguard';
+    // Reasoning models (safeguard) need more time — default 15s for safety classifiers, 3s for JSON models
+    const defaultTimeout = isSafetyClassifierModel(model) ? 15000 : 3000;
+    const timeout = gc?.timeout_ms || defaultTimeout;
+    const maxTokens = isSafetyClassifierModel(model) ? 300 : 2000;
+    try {
+        // Use Ollama native /api/chat when configured — enables think param for reasoning models
+        if (gc?.ollama_native_chat && isLocalOllama(gc?.api_url)) {
+            return await callOllamaNativeChat(prompt, systemPrompt, model, timeout, maxTokens);
+        }
+        const result = await callLLM(prompt, {
+            systemPrompt,
+            timeout,
+            maxTokens,
+        }, {
+            backend: 'api',
+            model,
+            endpoint: gc?.api_url,
+            apiKey: gc?.api_key,
+        });
+        return result;
+    }
+    catch (err) {
+        logWarn('guardrails', `LLM call failed: ${err instanceof Error ? err.message : String(err)}`);
+        return null; // fail-open
+    }
+}
+// ─── 1. Sensitivity Classification ─────────────────────────────────
+// Maps Llama Guard S-categories to our sensitivity levels/compartments
+const SENSITIVITY_LG_MAP = {
+    S1: { level: 0, compartments: [] },
+    S2: { level: 1, compartments: ['internal_infra'] },
+    S3: { level: 2, compartments: ['secrets', 'pii'] },
+    S4: { level: 3, compartments: ['credentials'] },
+};
+export async function classifySensitivity(content) {
+    if (!isGuardrailsEnabled('classify_sensitivity'))
+        return null;
+    const hash = contentHash(content);
+    const cached = sensitivityCache.get(hash);
+    if (cached)
+        return cached;
+    const truncated = content.length > 3000 ? content.slice(0, 3000) + '\n... [truncated]' : content;
+    const gc = getGuardrailsConfig();
+    if (isSafetyClassifierModel(gc?.model)) {
+        return classifySensitivityLlamaGuard(hash, truncated);
+    }
+    const response = await callGuardrailsLLM(`Classify the sensitivity of this content:\n\n${stripControlChars(truncated)}`, SENSITIVITY_SYSTEM);
+    if (!response)
+        return null;
+    try {
+        const parsed = JSON.parse(response);
+        const level = Math.max(0, Math.min(3, Number(parsed.level) || 0));
+        const validCompartments = ['secrets', 'credentials', 'pii', 'internal_infra'];
+        const compartments = (Array.isArray(parsed.compartments)
+            ? parsed.compartments.filter((c) => validCompartments.includes(c))
+            : []);
+        const result = {
+            label: level === 0 && compartments.length === 0 ? BOTTOM : makeLabel(level, compartments),
+            confidence: Math.max(0, Math.min(1, Number(parsed.confidence) || 0.5)),
+            reasoning: String(parsed.reasoning || '').slice(0, 200),
+        };
+        sensitivityCache.set(hash, result);
+        return result;
+    }
+    catch {
+        logWarn('guardrails', 'Failed to parse sensitivity classification response');
+        return null;
+    }
+}
+async function classifySensitivityLlamaGuard(hash, content) {
+    const prompt = formatLlamaGuardPrompt(content, SENSITIVITY_LG_CATEGORIES);
+    const response = await callGuardrailsLLM(prompt, '');
+    if (!response)
+        return null;
+    try {
+        const { safe, categories } = parseLlamaGuardResponse(response);
+        if (safe) {
+            const result = {
+                label: BOTTOM,
+                confidence: 0.9,
+                reasoning: 'Llama Guard: safe',
+            };
+            sensitivityCache.set(hash, result);
+            return result;
+        }
+        // Use highest severity category
+        let bestLevel = 0;
+        let allCompartments = [];
+        for (const cat of categories) {
+            const mapping = SENSITIVITY_LG_MAP[cat];
+            if (mapping) {
+                if (mapping.level > bestLevel)
+                    bestLevel = mapping.level;
+                allCompartments = [...allCompartments, ...mapping.compartments];
+            }
+            else {
+                logWarn('guardrails', `Llama Guard returned unmapped category: ${cat}`);
+            }
+        }
+        const uniqueCompartments = [...new Set(allCompartments)];
+        // If model said "unsafe" but no categories mapped → indeterminate (fail-open → null)
+        // Consistent with evaluateCodePolicyLlamaGuard which returns null for unmapped categories
+        if (bestLevel === 0 && uniqueCompartments.length === 0) {
+            logWarn('guardrails', `Llama Guard sensitivity: unsafe but no mapped categories [${categories.join(', ')}] — returning indeterminate`);
+            return null;
+        }
+        const result = {
+            label: makeLabel(bestLevel, uniqueCompartments),
+            confidence: 0.85,
+            reasoning: `Llama Guard: unsafe [${categories.join(', ')}]`,
+        };
+        sensitivityCache.set(hash, result);
+        return result;
+    }
+    catch {
+        logWarn('guardrails', 'Failed to parse Llama Guard sensitivity response');
+        return null;
+    }
+}
+// ─── 2. Code Policy Evaluation ──────────────────────────────────────
+const CODE_POLICY_LG_MAP = {
+    S1: { code: 'SC2', severity: 'critical' },
+    S2: { code: 'SC3', severity: 'high' },
+    S3: { code: 'SC5', severity: 'high' },
+    S4: { code: 'SC6', severity: 'high' },
+    S5: { code: 'SC7', severity: 'high' },
+};
+export async function evaluateCodePolicy(content, filePath) {
+    if (!isGuardrailsEnabled('classify_code_policy'))
+        return null;
+    const hash = contentHash(content + (filePath || ''));
+    const cached = codePolicyCache.get(hash);
+    if (cached)
+        return cached;
+    const truncated = content.length > 4000 ? content.slice(0, 4000) + '\n... [truncated]' : content;
+    const fileInfo = filePath ? `File: ${stripControlChars(filePath)}\n\n` : '';
+    const gc = getGuardrailsConfig();
+    if (isSafetyClassifierModel(gc?.model)) {
+        return evaluateCodePolicyLlamaGuard(hash, `${fileInfo}${truncated}`);
+    }
+    const response = await callGuardrailsLLM(`${fileInfo}Analyze this code for security vulnerabilities:\n\n${stripControlChars(truncated)}`, CODE_POLICY_SYSTEM);
+    if (!response)
+        return null;
+    try {
+        const parsed = JSON.parse(response);
+        const validCodes = ['SC2', 'SC3', 'SC5', 'SC6', 'SC7'];
+        const validSeverities = ['critical', 'high', 'medium', 'low'];
+        const violations = Array.isArray(parsed.violations)
+            ? parsed.violations
+                .filter((v) => validCodes.includes(v.code) &&
+                validSeverities.includes(v.severity))
+                .map((v) => ({
+                code: v.code,
+                severity: v.severity,
+                description: String(v.description || '').slice(0, 300),
+                line: typeof v.line === 'number' ? v.line : undefined,
+            }))
+            : [];
+        const result = {
+            violations,
+            safe: violations.length === 0,
+        };
+        codePolicyCache.set(hash, result);
+        return result;
+    }
+    catch {
+        logWarn('guardrails', 'Failed to parse code policy evaluation response');
+        return null;
+    }
+}
+async function evaluateCodePolicyLlamaGuard(hash, content) {
+    const prompt = formatLlamaGuardPrompt(content, CODE_POLICY_LG_CATEGORIES);
+    const response = await callGuardrailsLLM(prompt, '');
+    if (!response)
+        return null;
+    try {
+        const { safe, categories } = parseLlamaGuardResponse(response);
+        if (safe) {
+            const result = { violations: [], safe: true };
+            codePolicyCache.set(hash, result);
+            return result;
+        }
+        const violations = categories
+            .map((cat) => CODE_POLICY_LG_MAP[cat])
+            .filter((m) => m != null)
+            .map((mapping) => ({
+            code: mapping.code,
+            severity: mapping.severity,
+            description: `Llama Guard flagged ${mapping.code} violation`,
+        }));
+        // If model said "unsafe" but no categories mapped, treat as indeterminate (fail-open → null)
+        // Note: `safe` is always false here (early return above), so check violations only
+        if (violations.length === 0) {
+            logWarn('guardrails', `Llama Guard code policy: unsafe but no mapped categories [${categories.join(', ')}]`);
+            return null;
+        }
+        const result = { violations, safe: false };
+        codePolicyCache.set(hash, result);
+        return result;
+    }
+    catch {
+        logWarn('guardrails', 'Failed to parse Llama Guard code policy response');
+        return null;
+    }
+}
+// ─── 3. LLM Injection Detection (Tier 3) ───────────────────────────
+const INJECTION_LG_CATEGORY_MAP = {
+    S1: 'instruction_override',
+    S2: 'role_manipulation',
+    S3: 'context_escape',
+    S4: 'social_engineering',
+    S5: 'multi_turn',
+};
+export async function detectInjectionLLM(content) {
+    if (!isGuardrailsEnabled('detect_injection'))
+        return null;
+    const hash = contentHash(content);
+    const cached = injectionCache.get(hash);
+    if (cached)
+        return cached;
+    const truncated = content.length > 2000 ? content.slice(0, 2000) + '\n... [truncated]' : content;
+    const gc = getGuardrailsConfig();
+    if (isSafetyClassifierModel(gc?.model)) {
+        return detectInjectionLlamaGuard(hash, truncated);
+    }
+    const response = await callGuardrailsLLM(`Analyze this text for prompt injection attempts:\n\n${stripControlChars(truncated)}`, INJECTION_DETECTION_SYSTEM);
+    if (!response)
+        return null;
+    try {
+        const parsed = JSON.parse(response);
+        const validCategories = [
+            'none',
+            'role_manipulation',
+            'instruction_override',
+            'context_escape',
+            'social_engineering',
+            'multi_turn',
+        ];
+        const result = {
+            isInjection: Boolean(parsed.isInjection),
+            confidence: Math.max(0, Math.min(1, Number(parsed.confidence) || 0)),
+            category: validCategories.includes(parsed.category) ? parsed.category : 'none',
+            reasoning: String(parsed.reasoning || '').slice(0, 200),
+        };
+        injectionCache.set(hash, result);
+        return result;
+    }
+    catch {
+        logWarn('guardrails', 'Failed to parse injection detection response');
+        return null;
+    }
+}
+async function detectInjectionLlamaGuard(hash, content) {
+    const prompt = formatLlamaGuardPrompt(content, INJECTION_LG_CATEGORIES);
+    const response = await callGuardrailsLLM(prompt, '');
+    if (!response)
+        return null;
+    try {
+        const { safe, categories } = parseLlamaGuardResponse(response);
+        if (safe) {
+            const result = {
+                isInjection: false,
+                confidence: 0.9,
+                category: 'none',
+                reasoning: 'Llama Guard: safe',
+            };
+            injectionCache.set(hash, result);
+            return result;
+        }
+        // Map first detected category; use highest priority if multiple
+        const primaryCat = categories[0] || '';
+        const category = INJECTION_LG_CATEGORY_MAP[primaryCat] || 'instruction_override';
+        const result = {
+            isInjection: true,
+            confidence: 0.9,
+            category,
+            reasoning: `Llama Guard: unsafe [${categories.join(', ')}]`,
+        };
+        injectionCache.set(hash, result);
+        return result;
+    }
+    catch {
+        logWarn('guardrails', 'Failed to parse Llama Guard injection response');
+        return null;
+    }
+}
+// ─── Utility exports ────────────────────────────────────────────────
+export function formatViolations(violations) {
+    if (violations.length === 0)
+        return '';
+    return violations
+        .map((v) => {
+        const line = v.line ? `:${v.line}` : '';
+        return `[${v.code}/${v.severity}${line}] ${v.description}`;
+    })
+        .join('\n');
+}
+/** Check if model is a Llama Guard variant (for testing) */
+export { isLlamaGuardModel, parseLlamaGuardResponse };
+/** Clear all guardrails caches (for testing) */
+export function clearGuardrailsCaches() {
+    sensitivityCache.clear();
+    codePolicyCache.clear();
+    injectionCache.clear();
+}
+//# sourceMappingURL=guardrails.js.map

package/dist/lib/guardrails.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guardrails.js","sourceRoot":"","sources":["../../src/lib/guardrails.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,UAAU,CAAC;AACnC,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAC5C,OAAO,EAAE,iBAAiB,EAAE,MAAM,wBAAwB,CAAC;AAE3D,OAAO,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,gBAAgB,CAAC;AAEnD,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,0BAA0B,EAC1B,yBAAyB,EACzB,yBAAyB,EACzB,uBAAuB,GACxB,MAAM,0BAA0B,CAAC;AAoClC,MAAM,cAAc,GAAG,IAAI,CAAC;AAC5B,MAAM,YAAY,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,YAAY;AAEhD,MAAM,QAAQ;IACJ,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IAE/C,GAAG,CAAC,GAAW;QACb,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK;YAAE,OAAO,SAAS,CAAC;QAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;YAChD,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YACrB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,mCAAmC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACrB,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,OAAO,KAAK,CAAC,KAAK,CAAC;IACrB,CAAC;IAED,GAAG,CAAC,GAAW,EAAE,KAAQ;QACvB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,cAAc,EAAE,CAAC;YACpC,8BAA8B;YAC9B,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC;YAC9C,IAAI,QAAQ,KAAK,SAAS;gBAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,KAAK;QACH,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC;IACnB,CAAC;IAED,IAAI,IAAI;QACN,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;CACF;AAED,MAAM,gBAAgB,GAAG,IAAI,QAAQ,EAAqB,CAAC;AAC3D,MAAM,eAAe,GAAG,IAAI,QAAQ,EAAoB,CAAC;AACzD,MAAM,cAAc,GAAG,IAAI,QAAQ,EAAsB,CAAC;AAE1D,SAAS,WAAW,CAAC,OAAe;IAClC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACzE,CAAC;AAED,uEAAuE;AAEvE,SAAS,mBAAmB;IAC1B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,SAAS,EAAE,CAAC;QAC3B,MAAM,EAAE,GAAG,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC;QACvC,IAAI,CAAC,EAAE;YAAE,OAAO,IAAI,CAAC;QACrB,OAAO,EAAE,CAAC;IACZ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CACL,YAAY,EACZ,qCAAqC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CACxF,CAAC;QACF,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,mBAAmB,CAC1B,OAA6E;IAE7E,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC;IACtB,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC;AAC9B,CAAC;AAED,uEAAuE;AAEvE,SAAS,iBAAiB,CAAC,KAAc;IACvC,OAAO,cAAc,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;AAC1C,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,MAAe;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,KAAK,CAAC;IAC1B,OAAO,uDAAuD,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,iBAAiB,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC1C,mEAAmE;IACnE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACjC,IAAI,YAAY,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,IAAI,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,SAAS,sBAAsB,CAAC,OAAe,EAAE,UAAkB;IACjE,gGAAgG;IAChG,MAAM,OAAO,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,OAAO;SACpB,OAAO,CAAC,sBAAsB,EAAE,oBAAoB,CAAC;SACrD,OAAO,CAAC,wBAAwB,EAAE,sBAAsB,CAAC;SACzD,OAAO,CAAC,mCAAmC,EAAE,iCAAiC,CAAC;SAC/E,OAAO,CAAC,qCAAqC,EAAE,mCAAmC,CAAC,CAAC;IACvF,OAAO;QACL,4EAA4E;QAC5E,2DAA2D;QAC3D,EAAE;QACF,mCAAmC;QACnC,UAAU;QACV,iCAAiC;QACjC,EAAE;QACF,sBAAsB;QACtB,SAAS,OAAO,EAAE;QAClB,oBAAoB;QACpB,EAAE;QACF,oEAAoE;QACpE,4CAA4C;QAC5C,wFAAwF;KACzF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAOD,SAAS,uBAAuB,CAAC,QAAgB;IAC/C,MAAM,KAAK,GAAG,QAAQ;SACnB,IAAI,EAAE;SACN,KAAK,CAAC,IAAI,CAAC;SACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;SACpB,MAAM,CAAC,OAAO,CAAC,CAAC;IACnB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,KAAK,MAAM,CAAC;IAChD,MAAM,UAAU,GAAG,IAAI;QACrB,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;YACN,EAAE,KAAK,CAAC,GAAG,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,MAAM,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC7B,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAC9B,CAAC;AAED,uEAAuE;AAEvE;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CACjC,MAAc,EACd,YAAoB,EACpB,KAAa,EACb,OAAe,EACf,SAAiB;IAEjB,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACjC,IAAI,CAAC,EAAE,EAAE,OAAO;QAAE,OAAO,IAAI,CAAC;IAE9B,8EAA8E;IAC9E,MAAM,OAAO,GAAG,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC,6BAA6B,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAC1F,MAAM,SAAS,GAAG,GAAG,OAAO,WAAW,CAAC;IAExC,MAAM,QAAQ,GAA6C,EAAE,CAAC;IAC9D,IAAI,YAAY;QAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC,CAAC;IAC3E,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,CAAC;IAEjD,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,SAAS,EAAE;QACtC,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC;YACnB,KAAK;YACL,QAAQ;YACR,MAAM,EAAE,KAAK;YACb,KAAK,EAAE,IAAI;YACX,OAAO,EAAE,EAAE,WAAW,EAAE,SAAS,EAAE;SACpC,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC;KACrC,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,OAAO,CAAC,YAAY,EAAE,4BAA4B,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC;QACrE,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;IAEF,yFAAyF;IACzF,OAAO,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC;AACvC,CAAC;AAED,KAAK,UAAU,iBAAiB,CAAC,MAAc,EAAE,YAAoB;IACnE,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,EAAE,EAAE,KAAK,IAAI,mBAAmB,CAAC;IAC/C,uGAAuG;IACvG,MAAM,cAAc,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;IACrE,MAAM,OAAO,GAAG,EAAE,EAAE,UAAU,IAAI,cAAc,CAAC;IACjD,MAAM,SAAS,GAAG,uBAAuB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;IAE9D,IAAI,CAAC;QACH,yFAAyF;QACzF,IAAI,EAAE,EAAE,kBAAkB,IAAI,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,CAAC;YACzD,OAAO,MAAM,oBAAoB,CAAC,MAAM,EAAE,YAAY,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACrF,CAAC;QAED,MAAM,MAAM,GAAG,MAAM,OAAO,CAC1B,MAAM,EACN;YACE,YAAY;YACZ,OAAO;YACP,SAAS;SACV,EACD;YACE,OAAO,EAAE,KAAK;YACd,KAAK;YACL,QAAQ,EAAE,EAAE,EAAE,OAAO;YACrB,MAAM,EAAE,EAAE,EAAE,OAAO;SACpB,CACF,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,CAAC,YAAY,EAAE,oBAAoB,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC9F,OAAO,IAAI,CAAC,CAAC,YAAY;IAC3B,CAAC;AACH,CAAC;AAED,sEAAsE;AAEtE,uEAAuE;AACvE,MAAM,kBAAkB,GAA0E;IAChG,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,EAAE,EAAE;IAClC,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,gBAAgB,CAAC,EAAE;IAClD,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,SAAS,EAAE,KAAK,CAAC,EAAE;IAClD,EAAE,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,aAAa,CAAC,EAAE;CAChD,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,OAAe;IACvD,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC;IACjG,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAEjC,IAAI,uBAAuB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,6BAA6B,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACxD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,gDAAgD,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAC9E,kBAAkB,CACnB,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAkB,CAAC;QACnF,MAAM,iBAAiB,GAAG,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,gBAAgB,CAAU,CAAC;QACvF,MAAM,YAAY,GAAG,CACnB,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YAChC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAS,EAAE,EAAE,CAAC,iBAAiB,CAAC,QAAQ,CAAC,CAAgB,CAAC,CAAC;YACzF,CAAC,CAAC,EAAE,CACU,CAAC;QAEnB,MAAM,MAAM,GAAsB;YAChC,KAAK,EAAE,KAAK,KAAK,CAAC,IAAI,YAAY,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,EAAE,YAAY,CAAC;YACzF,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,GAAG,CAAC,CAAC;YACtE,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACxD,CAAC;QAEF,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,YAAY,EAAE,qDAAqD,CAAC,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,6BAA6B,CAC1C,IAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAE/D,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAsB;gBAChC,KAAK,EAAE,MAAM;gBACb,UAAU,EAAE,GAAG;gBACf,SAAS,EAAE,mBAAmB;aAC/B,CAAC;YACF,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACnC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,gCAAgC;QAChC,IAAI,SAAS,GAAkB,CAAC,CAAC;QACjC,IAAI,eAAe,GAAkB,EAAE,CAAC;QACxC,KAAK,MAAM,GAAG,IAAI,UAAU,EAAE,CAAC;YAC7B,MAAM,OAAO,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;YACxC,IAAI,OAAO,EAAE,CAAC;gBACZ,IAAI,OAAO,CAAC,KAAK,GAAG,SAAS;oBAAE,SAAS,GAAG,OAAO,CAAC,KAAsB,CAAC;gBAC1E,eAAe,GAAG,CAAC,GAAG,eAAe,EAAE,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;YAClE,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,YAAY,EAAE,2CAA2C,GAAG,EAAE,CAAC,CAAC;YAC1E,CAAC;QACH,CAAC;QACD,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,eAAe,CAAC,CAAkB,CAAC;QAE1E,qFAAqF;QACrF,0FAA0F;QAC1F,IAAI,SAAS,KAAK,CAAC,IAAI,kBAAkB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvD,OAAO,CACL,YAAY,EACZ,6DAA6D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,6BAA6B,CAChH,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAsB;YAChC,KAAK,EAAE,SAAS,CAAC,SAAS,EAAE,kBAAkB,CAAC;YAC/C,UAAU,EAAE,IAAI;YAChB,SAAS,EAAE,wBAAwB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC5D,CAAC;QAEF,gBAAgB,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACnC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,YAAY,EAAE,kDAAkD,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,MAAM,kBAAkB,GAGpB;IACF,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,UAAU,EAAE;IACzC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;IACrC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;IACrC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;IACrC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,EAAE;CACtC,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAAe,EACf,QAAiB;IAEjB,IAAI,CAAC,mBAAmB,CAAC,sBAAsB,CAAC;QAAE,OAAO,IAAI,CAAC;IAE9D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,GAAG,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IACrD,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACzC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC;IACjG,MAAM,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC,SAAS,iBAAiB,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAEjC,IAAI,uBAAuB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,4BAA4B,CAAC,IAAI,EAAE,GAAG,QAAQ,GAAG,SAAS,EAAE,CAAC,CAAC;IACvE,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,GAAG,QAAQ,sDAAsD,iBAAiB,CAAC,SAAS,CAAC,EAAE,EAC/F,kBAAkB,CACnB,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,UAAU,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACvD,MAAM,eAAe,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;QAE9D,MAAM,UAAU,GAA0B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC;YACxE,CAAC,CAAC,MAAM,CAAC,UAAU;iBACd,MAAM,CACL,CAAC,CAA0B,EAAE,EAAE,CAC7B,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAc,CAAC;gBACrC,eAAe,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAkB,CAAC,CACjD;iBACA,GAAG,CAAC,CAAC,CAA0B,EAAE,EAAE,CAAC,CAAC;gBACpC,IAAI,EAAE,CAAC,CAAC,IAAc;gBACtB,QAAQ,EAAE,CAAC,CAAC,QAA2C;gBACvD,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,WAAW,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;gBACtD,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;aACtD,CAAC,CAAC;YACP,CAAC,CAAC,EAAE,CAAC;QAEP,MAAM,MAAM,GAAqB;YAC/B,UAAU;YACV,IAAI,EAAE,UAAU,CAAC,MAAM,KAAK,CAAC;SAC9B,CAAC;QAEF,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,YAAY,EAAE,iDAAiD,CAAC,CAAC;QACzE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,4BAA4B,CACzC,IAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE,yBAAyB,CAAC,CAAC;IAC1E,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAE/D,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAqB,EAAE,UAAU,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;YAChE,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,MAAM,UAAU,GAA0B,UAAU;aACjD,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC;aACrC,MAAM,CAAC,CAAC,CAAC,EAA8B,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC;aACpD,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;YACjB,IAAI,EAAE,OAAO,CAAC,IAAI;YAClB,QAAQ,EAAE,OAAO,CAAC,QAAQ;YAC1B,WAAW,EAAE,uBAAuB,OAAO,CAAC,IAAI,YAAY;SAC7D,CAAC,CAAC,CAAC;QAEN,6FAA6F;QAC7F,mFAAmF;QACnF,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO,CACL,YAAY,EACZ,6DAA6D,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACtF,CAAC;YACF,OAAO,IAAI,CAAC;QACd,CAAC;QAED,MAAM,MAAM,GAAqB,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;QAC7D,eAAe,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAClC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,YAAY,EAAE,kDAAkD,CAAC,CAAC;QAC1E,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,sEAAsE;AAEtE,MAAM,yBAAyB,GAA2B;IACxD,EAAE,EAAE,sBAAsB;IAC1B,EAAE,EAAE,mBAAmB;IACvB,EAAE,EAAE,gBAAgB;IACpB,EAAE,EAAE,oBAAoB;IACxB,EAAE,EAAE,YAAY;CACjB,CAAC;AAEF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe;IACtD,IAAI,CAAC,mBAAmB,CAAC,kBAAkB,CAAC;QAAE,OAAO,IAAI,CAAC;IAE1D,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IACxC,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAE1B,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC;IACjG,MAAM,EAAE,GAAG,mBAAmB,EAAE,CAAC;IAEjC,IAAI,uBAAuB,CAAC,EAAE,EAAE,KAAK,CAAC,EAAE,CAAC;QACvC,OAAO,yBAAyB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CACtC,uDAAuD,iBAAiB,CAAC,SAAS,CAAC,EAAE,EACrF,0BAA0B,CAC3B,CAAC;IACF,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QACpC,MAAM,eAAe,GAAG;YACtB,MAAM;YACN,mBAAmB;YACnB,sBAAsB;YACtB,gBAAgB;YAChB,oBAAoB;YACpB,YAAY;SACb,CAAC;QAEF,MAAM,MAAM,GAAuB;YACjC,WAAW,EAAE,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC;YACxC,UAAU,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC;YACpE,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM;YAC9E,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;SACxD,CAAC;QAEF,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,YAAY,EAAE,8CAA8C,CAAC,CAAC;QACtE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,KAAK,UAAU,yBAAyB,CACtC,IAAY,EACZ,OAAe;IAEf,MAAM,MAAM,GAAG,sBAAsB,CAAC,OAAO,EAAE,uBAAuB,CAAC,CAAC;IACxE,MAAM,QAAQ,GAAG,MAAM,iBAAiB,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrD,IAAI,CAAC,QAAQ;QAAE,OAAO,IAAI,CAAC;IAE3B,IAAI,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAE/D,IAAI,IAAI,EAAE,CAAC;YACT,MAAM,MAAM,GAAuB;gBACjC,WAAW,EAAE,KAAK;gBAClB,UAAU,EAAE,GAAG;gBACf,QAAQ,EAAE,MAAM;gBAChB,SAAS,EAAE,mBAAmB;aAC/B,CAAC;YACF,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO,MAAM,CAAC;QAChB,CAAC;QAED,gEAAgE;QAChE,MAAM,UAAU,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACvC,MAAM,QAAQ,GAAG,yBAAyB,CAAC,UAAU,CAAC,IAAI,sBAAsB,CAAC;QAEjF,MAAM,MAAM,GAAuB;YACjC,WAAW,EAAE,IAAI;YACjB,UAAU,EAAE,GAAG;YACf,QAAQ;YACR,SAAS,EAAE,wBAAwB,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG;SAC5D,CAAC;QAEF,cAAc,CAAC,GAAG,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjC,OAAO,MAAM,CAAC;IAChB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,YAAY,EAAE,gDAAgD,CAAC,CAAC;QACxE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,uEAAuE;AAEvE,MAAM,UAAU,gBAAgB,CAAC,UAAiC;IAChE,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACvC,OAAO,UAAU;SACd,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QACT,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,QAAQ,GAAG,IAAI,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC;IAC7D,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,4DAA4D;AAC5D,OAAO,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,CAAC;AAEtD,gDAAgD;AAChD,MAAM,UAAU,qBAAqB;IACnC,gBAAgB,CAAC,KAAK,EAAE,CAAC;IACzB,eAAe,CAAC,KAAK,EAAE,CAAC;IACxB,cAAc,CAAC,KAAK,EAAE,CAAC;AACzB,CAAC"}

package/dist/lib/hook-rules.d.ts

@@ -17,7 +17,7 @@ export interface HookRule {
     content: string;
     type: string;
     tags: string[];
-    action: 'inject' | 'deny' | 'ask';
+    action: 'inject' | 'deny' | 'ask' | 'allow';
 }
 /**
  * Match hook-rule memories against a tool call.

package/dist/lib/hook-rules.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"hook-rules.d.ts","sourceRoot":"","sources":["../../src/lib/hook-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,CAAC;CACnC;AAmCD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,QAAQ,EAAE,CAgDZ"}
+{"version":3,"file":"hook-rules.d.ts","sourceRoot":"","sources":["../../src/lib/hook-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAIH,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,oBAAoB,CAAC;AAEjD,MAAM,WAAW,QAAQ;IACvB,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,MAAM,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,OAAO,CAAC;CAC7C;AAoCD;;;;;;;GAOG;AACH,wBAAgB,UAAU,CACxB,QAAQ,EAAE,MAAM,EAAE,EAClB,QAAQ,EAAE,MAAM,EAChB,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GACjC,QAAQ,EAAE,CAmDZ"}

package/dist/lib/hook-rules.js

@@ -12,7 +12,8 @@
  *   *       → inject (additionalContext)
  */
 import path from 'path';
-const ACTION_ORDER = { deny: 0, ask: 1, inject: 2 };
+import { logWarn } from './fault-logger.js';
+const ACTION_ORDER = { deny: 0, ask: 1, allow: 2, inject: 3 };
 /** Max regex pattern length to prevent ReDoS from user-authored patterns */
 const MAX_REGEX_LENGTH = 200;
 /**
@@ -42,6 +43,8 @@ function typeToAction(type) {
         return 'deny';
     if (type === 'pattern')
         return 'ask';
+    if (type === 'allow')
+        return 'allow';
     return 'inject';
 }
 /**
@@ -79,7 +82,10 @@ export function matchRules(memories, toolName, toolInput) {
                         break;
                     }
                 }
-                catch {
+                catch (error) {
+                    logWarn('hook-rules', 'Failed to compile regex pattern from memory tag', {
+                        error: error instanceof Error ? error.message : String(error),
+                    });
                     // Invalid regex — skip this pattern
                     continue;
                 }

package/dist/lib/hook-rules.js.map

@@ -1 +1 @@
-{"version":3,"file":"hook-rules.js","sourceRoot":"","sources":["../../src/lib/hook-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AAWxB,MAAM,YAAY,GAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAC5E,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;GAEG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,SAAkC;IAC1E,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAQ,SAAS,CAAC,OAAkB,IAAI,EAAE,CAAC;QAC7C,KAAK,OAAO;YACV,OAAQ,SAAS,CAAC,KAAgB,IAAI,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,KAAK,MAAM;YACT,OAAQ,SAAS,CAAC,MAAiB,IAAI,EAAE,CAAC;QAC5C;YACE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,IAA+B;IACnD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,QAAkB,EAClB,QAAgB,EAChB,SAAkC;IAElC,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,OAAO,GAAe,EAAE,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAE5B,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,WAAW;gBAAE,SAAS;QAC7B,CAAC;QAED,0BAA0B;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB;oBAAE,SAAS,CAAC,cAAc;gBAC/D,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACpC,IAAI,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;wBACzB,eAAe,GAAG,IAAI,CAAC;wBACvB,MAAM;oBACR,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,oCAAoC;oBACpC,SAAS;gBACX,CAAC;YACH,CAAC;YACD,IAAI,CAAC,eAAe;gBAAE,SAAS;QACjC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,aAAa;YAC/B,IAAI;YACJ,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEtF,OAAO,OAAO,CAAC;AACjB,CAAC"}
+{"version":3,"file":"hook-rules.js","sourceRoot":"","sources":["../../src/lib/hook-rules.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,OAAO,EAAE,MAAM,mBAAmB,CAAC;AAW5C,MAAM,YAAY,GAA2B,EAAE,IAAI,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACtF,4EAA4E;AAC5E,MAAM,gBAAgB,GAAG,GAAG,CAAC;AAE7B;;GAEG;AACH,SAAS,cAAc,CAAC,QAAgB,EAAE,SAAkC;IAC1E,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,MAAM;YACT,OAAQ,SAAS,CAAC,OAAkB,IAAI,EAAE,CAAC;QAC7C,KAAK,OAAO;YACV,OAAQ,SAAS,CAAC,KAAgB,IAAI,EAAE,CAAC;QAC3C,KAAK,MAAM,CAAC;QACZ,KAAK,OAAO,CAAC;QACb,KAAK,MAAM;YACT,OAAO,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,SAAS,CAAC,SAAmB,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACjF,KAAK,MAAM;YACT,OAAQ,SAAS,CAAC,MAAiB,IAAI,EAAE,CAAC;QAC5C;YACE,OAAO,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED;;GAEG;AACH,SAAS,YAAY,CAAC,IAA+B;IACnD,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,MAAM,CAAC;IACpC,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACrC,IAAI,IAAI,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACrC,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,UAAU,CACxB,QAAkB,EAClB,QAAgB,EAChB,SAAkC;IAElC,MAAM,WAAW,GAAG,cAAc,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACxD,MAAM,OAAO,GAAe,EAAE,CAAC;IAE/B,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;QAE5B,2CAA2C;QAC3C,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3D,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACxB,MAAM,WAAW,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;YAC9F,IAAI,CAAC,WAAW;gBAAE,SAAS;QAC7B,CAAC;QAED,0BAA0B;QAC1B,MAAM,SAAS,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC7D,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzB,IAAI,eAAe,GAAG,KAAK,CAAC;YAC5B,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;gBAC5B,MAAM,OAAO,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBAC7B,IAAI,OAAO,CAAC,MAAM,GAAG,gBAAgB;oBAAE,SAAS,CAAC,cAAc;gBAC/D,IAAI,CAAC;oBACH,MAAM,EAAE,GAAG,IAAI,MAAM,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;oBACpC,IAAI,EAAE,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;wBACzB,eAAe,GAAG,IAAI,CAAC;wBACvB,MAAM;oBACR,CAAC;gBACH,CAAC;gBAAC,OAAO,KAAK,EAAE,CAAC;oBACf,OAAO,CAAC,YAAY,EAAE,iDAAiD,EAAE;wBACvE,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;qBAC9D,CAAC,CAAC;oBACH,oCAAoC;oBACpC,SAAS;gBACX,CAAC;YACH,CAAC;YACD,IAAI,CAAC,eAAe;gBAAE,SAAS;QACjC,CAAC;QAED,OAAO,CAAC,IAAI,CAAC;YACX,EAAE,EAAE,GAAG,CAAC,EAAE;YACV,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,IAAI,EAAE,GAAG,CAAC,IAAI,IAAI,aAAa;YAC/B,IAAI;YACJ,MAAM,EAAE,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC;SAC/B,CAAC,CAAC;IACL,CAAC;IAED,0CAA0C;IAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAEtF,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/lib/ifc/file-labels.d.ts

@@ -0,0 +1,35 @@
+/**
+ * File Label Assignment — 4-layer label resolution for BLP IFC
+ *
+ * Assigns SecurityLabels to files using conservative (highest wins) layering:
+ *   1. Extension-based (deterministic, instant)
+ *   2. Path-based (deterministic, instant)
+ *   3. Content-based regex (deterministic, requires file content)
+ *   4. LLM classification (Phase 3, opt-in)
+ *
+ * Label assignment is monotonic — higher label always wins.
+ */
+import { type SecurityLabel } from './label.js';
+/**
+ * Scan file content for sensitive patterns and return accumulated label.
+ * Short-circuits if content is empty.
+ */
+export declare function labelByContent(content: string): SecurityLabel;
+export interface FileLabelOptions {
+    /** File content (for Layer 3 content-based scanning). Omit to skip. */
+    content?: string;
+}
+/**
+ * Resolve the security label for a file using 3 deterministic layers.
+ * Returns the join (LUB) of all applicable labels.
+ *
+ * Layer 4 (LLM classification) is handled externally in Phase 3.
+ */
+export declare function resolveFileLabel(filePath: string, options?: FileLabelOptions): SecurityLabel;
+/**
+ * Quick label check — extension + path only (no content scan).
+ * Use for pre-tool checks where content isn't available yet.
+ */
+export declare function quickFileLabel(filePath: string): SecurityLabel;
+export { BOTTOM, makeLabel, join, isBottom, type SecurityLabel, type Compartment, } from './label.js';
+//# sourceMappingURL=file-labels.d.ts.map

package/dist/lib/ifc/file-labels.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-labels.d.ts","sourceRoot":"","sources":["../../../src/lib/ifc/file-labels.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EACL,KAAK,aAAa,EAMnB,MAAM,YAAY,CAAC;AAgMpB;;;GAGG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,aAAa,CAY7D;AAID,MAAM,WAAW,gBAAgB;IAC/B,uEAAuE;IACvE,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,OAAO,GAAE,gBAAqB,GAAG,aAAa,CAmBhG;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,aAAa,CAE9D;AAGD,OAAO,EACL,MAAM,EACN,SAAS,EACT,IAAI,EACJ,QAAQ,EACR,KAAK,aAAa,EAClB,KAAK,WAAW,GACjB,MAAM,YAAY,CAAC"}