@yadsh/dsh-qa-surface 0.1.1 → 0.3.0

package/lib/resolve-config.js

@@ -2,15 +2,17 @@ export const DEFAULT_QA_SURFACE_CONFIG = Object.freeze({
     enabled: true,
     route: Object.freeze({ path: "/qa", matchChildren: true }),
     branding: Object.freeze({
-        title: "Assistant",
+        title: "Помощник",
         subtitle: "",
-        welcomeMessage: "How can I help?",
-        placeholder: "Ask a question...",
+        welcomeMessage: "Чем могу помочь?",
+        placeholder: "Задайте вопрос…",
         logoUrl: null,
+        disclaimer: "Диалоги могут быть видны другим пользователям сервера и используются для улучшения качества ответов.",
     }),
     session: Object.freeze({
         policy: "browser-persistent",
-        storageKey: "dsh-qa-surface",
+        storageKey: "dsh-qa-surface.session",
+        cwd: null,
         workspaceId: null,
         fixedSessionId: null,
         agentPreset: null,
@@ -20,20 +22,93 @@ export const DEFAULT_QA_SURFACE_CONFIG = Object.freeze({
     }),
     ui: Object.freeze({
         showHeader: true,
-        showReset: true,
+        showReset: false,
         showStop: true,
         showTimestamps: false,
         showToolActivity: false,
         showReasoning: false,
         renderMarkdown: true,
         maxContentWidth: 900,
+        showSessionList: false,
     }),
-    suggestedQuestions: Object.freeze([]),
+    suggestedQuestions: Object.freeze([
+        "Что ты умеешь?",
+        "С чего начать?",
+        "Помоги разобраться с ошибкой",
+    ]),
     interaction: Object.freeze({
         approvals: "blocked",
         questions: "unsupported",
     }),
+    lockdown: Object.freeze({
+        enabled: true,
+        enforceFixedAgentPreset: true,
+        enforceFixedWorkspace: true,
+        enforceFixedModel: true,
+        sandboxMode: "read-only",
+        approvalPolicy: "never",
+        permissionPreset: "qa-read-only",
+        allowPermissionChanges: false,
+        allowSlashCommands: false,
+        allowSettingsMutation: false,
+        allowSessionReset: false,
+        allowSessionRename: false,
+        allowSessionDelete: false,
+        allowArbitrarySessionOpen: false,
+        toolPolicy: Object.freeze({
+            mode: "allow-list",
+            allow: Object.freeze([]),
+        }),
+    }),
     embedding: Object.freeze({ frameAncestors: null }),
+    accounts: Object.freeze({
+        enabled: false,
+        allowRegistration: true,
+        sessionTtlDays: 30,
+        showOtherUsersChats: false,
+    }),
+    entry: Object.freeze({
+        redirectNonLoopback: true,
+        cookieBootstrap: true,
+    }),
+    sources: Object.freeze({
+        enabled: true,
+        collect: Object.freeze({
+            parentAgent: true,
+            subagents: true,
+            persistTurnEvent: true,
+        }),
+        display: Object.freeze({
+            sidebar: true,
+            footer: true,
+            groupByKind: true,
+            showDiscovered: false,
+            showOriginBadges: false,
+            maxInitiallyVisiblePerGroup: 8,
+        }),
+        webSearch: Object.freeze({
+            promoteSearchResultsWithoutFetch: true,
+            maxPromotedPerSearch: 5,
+        }),
+        dedupe: Object.freeze({
+            normalizeUrls: true,
+            stripTrackingParams: true,
+            mergeFileRanges: true,
+        }),
+        filePreview: Object.freeze({
+            enabled: true,
+            markdownRenderedByDefault: true,
+            allowRawToggle: true,
+            maxBytes: 2_000_000,
+            maxMarkdownRenderBytes: 1_000_000,
+        }),
+        subagents: Object.freeze({
+            inheritSources: true,
+            enableReportToolFallback: true,
+            markIncompleteOpaqueRuns: true,
+        }),
+        legacy: Object.freeze({ parseAssistantSourcesBlock: false }),
+    }),
 });
 function optionalText(value) {
     const trimmed = value?.trim() ?? "";
@@ -65,6 +140,15 @@ function uniqueQuestions(values) {
     }
     return Object.freeze(questions);
 }
+function uniqueToolNames(values) {
+    const names = [
+        ...new Set(values.map((value) => value.trim()).filter(Boolean)),
+    ];
+    if (names.some((value) => value.length > 200)) {
+        throw new TypeError("dsh-qa-surface: lockdown.toolPolicy.allow names must be at most 200 characters");
+    }
+    return Object.freeze(names);
+}
 /** Materialize defaults and enforce route/session/model safety constraints. */
 export function resolveConfig(input = {}) {
     const routePath = normalizeRoutePath(input.route?.path ?? DEFAULT_QA_SURFACE_CONFIG.route.path);
@@ -73,6 +157,16 @@ export function resolveConfig(input = {}) {
     if (policy === "fixed" && fixedSessionId === null) {
         throw new TypeError("dsh-qa-surface: session.fixedSessionId is required for fixed policy");
     }
+    // The cwd pin is the no-registry alternative to workspaceId; both pin the
+    // session to one directory, so together they are a configuration error.
+    const cwd = optionalText(input.session?.cwd);
+    if (cwd !== null && !/^([a-zA-Z]:[/\\]|\/)/u.test(cwd)) {
+        throw new TypeError("dsh-qa-surface: session.cwd must be an absolute directory path");
+    }
+    const workspaceId = optionalText(input.session?.workspaceId);
+    if (workspaceId !== null && cwd !== null) {
+        throw new TypeError("dsh-qa-surface: session.workspaceId and session.cwd are mutually exclusive");
+    }
     const provider = optionalText(input.session?.provider);
     const model = optionalText(input.session?.model);
     if ((provider === null) !== (model === null)) {
@@ -89,8 +183,81 @@ export function resolveConfig(input = {}) {
         maxContentWidth > 1600) {
         throw new TypeError("dsh-qa-surface: ui.maxContentWidth must be an integer from 480 to 1600");
     }
-    if (input.ui?.showReasoning === true) {
-        throw new TypeError("dsh-qa-surface: ui.showReasoning is not supported by the safe MVP surface");
+    const lockdownEnabled = input.lockdown?.enabled ?? DEFAULT_QA_SURFACE_CONFIG.lockdown.enabled;
+    const rawLockdown = input.lockdown;
+    const forbiddenCapabilityFlags = [
+        ["allowPermissionChanges", rawLockdown?.allowPermissionChanges],
+        ["allowSlashCommands", rawLockdown?.allowSlashCommands],
+        ["allowSettingsMutation", rawLockdown?.allowSettingsMutation],
+        ["allowSessionRename", rawLockdown?.allowSessionRename],
+        ["allowSessionDelete", rawLockdown?.allowSessionDelete],
+        ["allowArbitrarySessionOpen", rawLockdown?.allowArbitrarySessionOpen],
+    ];
+    const weakenedFlag = forbiddenCapabilityFlags.find(([, value]) => value === true);
+    if (weakenedFlag !== undefined) {
+        throw new TypeError(`dsh-qa-surface: lockdown.${weakenedFlag[0]} cannot be enabled`);
+    }
+    if (input.lockdown?.sandboxMode !== undefined &&
+        input.lockdown.sandboxMode !== "read-only") {
+        throw new TypeError("dsh-qa-surface: lockdown.sandboxMode must be read-only");
+    }
+    if (input.lockdown?.approvalPolicy !== undefined &&
+        input.lockdown.approvalPolicy !== "never") {
+        throw new TypeError("dsh-qa-surface: lockdown.approvalPolicy must be never");
+    }
+    if (input.lockdown?.toolPolicy?.mode !== undefined &&
+        input.lockdown.toolPolicy.mode !== "allow-list") {
+        throw new TypeError("dsh-qa-surface: lockdown.toolPolicy.mode must be allow-list");
+    }
+    const permissionPreset = input.lockdown?.permissionPreset?.trim() ??
+        DEFAULT_QA_SURFACE_CONFIG.lockdown.permissionPreset;
+    if (lockdownEnabled && permissionPreset === "") {
+        throw new TypeError("dsh-qa-surface: lockdown.permissionPreset is required when lockdown is enabled");
+    }
+    const allowSessionReset = input.lockdown?.allowSessionReset ??
+        DEFAULT_QA_SURFACE_CONFIG.lockdown.allowSessionReset;
+    if (lockdownEnabled &&
+        (input.ui?.showReset ?? DEFAULT_QA_SURFACE_CONFIG.ui.showReset) &&
+        !allowSessionReset) {
+        throw new TypeError("dsh-qa-surface: ui.showReset requires lockdown.allowSessionReset");
+    }
+    const maxInitiallyVisiblePerGroup = input.sources?.display?.maxInitiallyVisiblePerGroup ??
+        DEFAULT_QA_SURFACE_CONFIG.sources.display.maxInitiallyVisiblePerGroup;
+    const maxPromotedPerSearch = input.sources?.webSearch?.maxPromotedPerSearch ??
+        DEFAULT_QA_SURFACE_CONFIG.sources.webSearch.maxPromotedPerSearch;
+    const maxBytes = input.sources?.filePreview?.maxBytes ??
+        DEFAULT_QA_SURFACE_CONFIG.sources.filePreview.maxBytes;
+    const maxMarkdownRenderBytes = input.sources?.filePreview?.maxMarkdownRenderBytes ??
+        DEFAULT_QA_SURFACE_CONFIG.sources.filePreview.maxMarkdownRenderBytes;
+    for (const [name, value, min, max] of [
+        [
+            "sources.display.maxInitiallyVisiblePerGroup",
+            maxInitiallyVisiblePerGroup,
+            1,
+            100,
+        ],
+        ["sources.webSearch.maxPromotedPerSearch", maxPromotedPerSearch, 0, 50],
+        ["sources.filePreview.maxBytes", maxBytes, 1_024, 20_000_000],
+        [
+            "sources.filePreview.maxMarkdownRenderBytes",
+            maxMarkdownRenderBytes,
+            1_024,
+            10_000_000,
+        ],
+    ]) {
+        if (!Number.isSafeInteger(value) || value < min || value > max) {
+            throw new TypeError(`dsh-qa-surface: ${name} must be an integer from ${min} to ${max}`);
+        }
+    }
+    if (maxMarkdownRenderBytes > maxBytes) {
+        throw new TypeError("dsh-qa-surface: sources.filePreview.maxMarkdownRenderBytes cannot exceed maxBytes");
+    }
+    const sessionTtlDays = input.accounts?.sessionTtlDays ??
+        DEFAULT_QA_SURFACE_CONFIG.accounts.sessionTtlDays;
+    if (!Number.isSafeInteger(sessionTtlDays) ||
+        sessionTtlDays < 1 ||
+        sessionTtlDays > 365) {
+        throw new TypeError("dsh-qa-surface: accounts.sessionTtlDays must be an integer from 1 to 365");
     }
     return Object.freeze({
         enabled: input.enabled ?? DEFAULT_QA_SURFACE_CONFIG.enabled,
@@ -108,10 +275,16 @@ export function resolveConfig(input = {}) {
             placeholder: input.branding?.placeholder?.trim() ||
                 DEFAULT_QA_SURFACE_CONFIG.branding.placeholder,
             logoUrl: optionalText(input.branding?.logoUrl),
+            // Undefined falls back to the default notice; an explicit null or
+            // empty string hides the plate entirely.
+            disclaimer: input.branding?.disclaimer === undefined
+                ? DEFAULT_QA_SURFACE_CONFIG.branding.disclaimer
+                : (optionalText(input.branding.disclaimer) ?? ""),
         }),
         session: Object.freeze({
             policy,
             storageKey,
+            cwd,
             workspaceId: optionalText(input.session?.workspaceId),
             fixedSessionId,
             agentPreset: optionalText(input.session?.agentPreset),
@@ -126,18 +299,118 @@ export function resolveConfig(input = {}) {
             showTimestamps: input.ui?.showTimestamps ?? DEFAULT_QA_SURFACE_CONFIG.ui.showTimestamps,
             showToolActivity: input.ui?.showToolActivity ??
                 DEFAULT_QA_SURFACE_CONFIG.ui.showToolActivity,
-            showReasoning: false,
+            showReasoning: input.ui?.showReasoning ?? DEFAULT_QA_SURFACE_CONFIG.ui.showReasoning,
             renderMarkdown: input.ui?.renderMarkdown ?? DEFAULT_QA_SURFACE_CONFIG.ui.renderMarkdown,
             maxContentWidth,
+            showSessionList: input.ui?.showSessionList ??
+                DEFAULT_QA_SURFACE_CONFIG.ui.showSessionList,
         }),
-        suggestedQuestions: uniqueQuestions(input.suggestedQuestions ?? []),
+        suggestedQuestions: uniqueQuestions(input.suggestedQuestions ?? DEFAULT_QA_SURFACE_CONFIG.suggestedQuestions),
         interaction: Object.freeze({
             approvals: "blocked",
             questions: "unsupported",
         }),
+        lockdown: Object.freeze({
+            enabled: lockdownEnabled,
+            enforceFixedAgentPreset: input.lockdown?.enforceFixedAgentPreset ??
+                DEFAULT_QA_SURFACE_CONFIG.lockdown.enforceFixedAgentPreset,
+            enforceFixedWorkspace: input.lockdown?.enforceFixedWorkspace ??
+                DEFAULT_QA_SURFACE_CONFIG.lockdown.enforceFixedWorkspace,
+            enforceFixedModel: input.lockdown?.enforceFixedModel ??
+                DEFAULT_QA_SURFACE_CONFIG.lockdown.enforceFixedModel,
+            sandboxMode: "read-only",
+            approvalPolicy: "never",
+            permissionPreset,
+            allowPermissionChanges: false,
+            allowSlashCommands: false,
+            allowSettingsMutation: false,
+            allowSessionReset,
+            allowSessionRename: false,
+            allowSessionDelete: false,
+            allowArbitrarySessionOpen: false,
+            toolPolicy: Object.freeze({
+                mode: "allow-list",
+                allow: uniqueToolNames(input.lockdown?.toolPolicy?.allow ?? []),
+            }),
+        }),
         embedding: Object.freeze({
             frameAncestors: optionalText(input.embedding?.frameAncestors),
         }),
+        accounts: Object.freeze({
+            enabled: input.accounts?.enabled ?? DEFAULT_QA_SURFACE_CONFIG.accounts.enabled,
+            allowRegistration: input.accounts?.allowRegistration ??
+                DEFAULT_QA_SURFACE_CONFIG.accounts.allowRegistration,
+            sessionTtlDays,
+            showOtherUsersChats: input.accounts?.showOtherUsersChats ??
+                DEFAULT_QA_SURFACE_CONFIG.accounts.showOtherUsersChats,
+        }),
+        entry: Object.freeze({
+            redirectNonLoopback: input.entry?.redirectNonLoopback ??
+                DEFAULT_QA_SURFACE_CONFIG.entry.redirectNonLoopback,
+            cookieBootstrap: input.entry?.cookieBootstrap ??
+                DEFAULT_QA_SURFACE_CONFIG.entry.cookieBootstrap,
+        }),
+        sources: Object.freeze({
+            enabled: input.sources?.enabled ?? DEFAULT_QA_SURFACE_CONFIG.sources.enabled,
+            collect: Object.freeze({
+                parentAgent: input.sources?.collect?.parentAgent ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.collect.parentAgent,
+                subagents: input.sources?.collect?.subagents ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.collect.subagents,
+                persistTurnEvent: input.sources?.collect?.persistTurnEvent ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.collect.persistTurnEvent,
+            }),
+            display: Object.freeze({
+                sidebar: input.sources?.display?.sidebar ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.display.sidebar,
+                footer: input.sources?.display?.footer ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.display.footer,
+                groupByKind: input.sources?.display?.groupByKind ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.display.groupByKind,
+                showDiscovered: input.sources?.display?.showDiscovered ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.display.showDiscovered,
+                showOriginBadges: input.sources?.display?.showOriginBadges ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.display.showOriginBadges,
+                maxInitiallyVisiblePerGroup,
+            }),
+            webSearch: Object.freeze({
+                promoteSearchResultsWithoutFetch: input.sources?.webSearch?.promoteSearchResultsWithoutFetch ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.webSearch
+                        .promoteSearchResultsWithoutFetch,
+                maxPromotedPerSearch,
+            }),
+            dedupe: Object.freeze({
+                normalizeUrls: input.sources?.dedupe?.normalizeUrls ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.dedupe.normalizeUrls,
+                stripTrackingParams: input.sources?.dedupe?.stripTrackingParams ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.dedupe.stripTrackingParams,
+                mergeFileRanges: input.sources?.dedupe?.mergeFileRanges ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.dedupe.mergeFileRanges,
+            }),
+            filePreview: Object.freeze({
+                enabled: input.sources?.filePreview?.enabled ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.filePreview.enabled,
+                markdownRenderedByDefault: input.sources?.filePreview?.markdownRenderedByDefault ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.filePreview
+                        .markdownRenderedByDefault,
+                allowRawToggle: input.sources?.filePreview?.allowRawToggle ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.filePreview.allowRawToggle,
+                maxBytes,
+                maxMarkdownRenderBytes,
+            }),
+            subagents: Object.freeze({
+                inheritSources: input.sources?.subagents?.inheritSources ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.subagents.inheritSources,
+                enableReportToolFallback: input.sources?.subagents?.enableReportToolFallback ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.subagents.enableReportToolFallback,
+                markIncompleteOpaqueRuns: input.sources?.subagents?.markIncompleteOpaqueRuns ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.subagents.markIncompleteOpaqueRuns,
+            }),
+            legacy: Object.freeze({
+                parseAssistantSourcesBlock: input.sources?.legacy?.parseAssistantSourcesBlock ??
+                    DEFAULT_QA_SURFACE_CONFIG.sources.legacy.parseAssistantSourcesBlock,
+            }),
+        }),
     });
 }
 //# sourceMappingURL=resolve-config.js.map

package/lib/resolve-config.js.map

@@ -1 +1 @@
-{"version":3,"file":"resolve-config.js","sourceRoot":"","sources":["../src/resolve-config.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,yBAAyB,GAA4B,MAAM,CAAC,MAAM,CAC7E;IACE,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC1D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,KAAK,EAAE,WAAW;QAClB,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,iBAAiB;QACjC,WAAW,EAAE,mBAAmB;QAChC,OAAO,EAAE,IAAI;KACd,CAAC;IACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,oBAAoB;QAC5B,UAAU,EAAE,gBAAgB;QAC5B,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,IAAI;QACX,eAAe,EAAE,IAAI;KACtB,CAAC;IACF,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,KAAK;QACvB,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,GAAG;KACrB,CAAC;IACF,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;IACrC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,aAAa;KACzB,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;CACnD,CACF,CAAC;AAEF,SAAS,YAAY,CAAC,KAAgC;IACpD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACzE,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IAChD,MAAM,SAAS,GAAG;QAChB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KAChE,CAAC;IACF,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CACjB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAC3B,KAAK,GAAoB,EAAE;IAE3B,MAAM,SAAS,GAAG,kBAAkB,CAClC,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAC1D,CAAC;IACF,MAAM,MAAM,GACV,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpE,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,OAAO,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CACjB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CACjB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE;QACjC,yBAAyB,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/C,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GACnB,KAAK,CAAC,EAAE,EAAE,eAAe,IAAI,yBAAyB,CAAC,EAAE,CAAC,eAAe,CAAC;IAC5E,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC;QACtC,eAAe,GAAG,GAAG;QACrB,eAAe,GAAG,IAAI,EACtB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,IAAI,KAAK,CAAC,EAAE,EAAE,aAAa,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CACjB,2EAA2E,CAC5E,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,yBAAyB,CAAC,OAAO;QAC3D,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,SAAS;YACf,aAAa,EACX,KAAK,CAAC,KAAK,EAAE,aAAa;gBAC1B,yBAAyB,CAAC,KAAK,CAAC,aAAa;SAChD,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,KAAK,EACH,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC7B,yBAAyB,CAAC,QAAQ,CAAC,KAAK;YAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;YAChD,cAAc,EACZ,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE;gBACtC,yBAAyB,CAAC,QAAQ,CAAC,cAAc;YACnD,WAAW,EACT,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE;gBACnC,yBAAyB,CAAC,QAAQ,CAAC,WAAW;YAChD,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC;SAC/C,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,MAAM;YACN,UAAU;YACV,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;YACrD,cAAc;YACd,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;YACrD,QAAQ;YACR,KAAK;YACL,eAAe,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC;SAC9D,CAAC;QACF,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;YAChB,UAAU,EACR,KAAK,CAAC,EAAE,EAAE,UAAU,IAAI,yBAAyB,CAAC,EAAE,CAAC,UAAU;YACjE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,IAAI,yBAAyB,CAAC,EAAE,CAAC,SAAS;YACxE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,IAAI,yBAAyB,CAAC,EAAE,CAAC,QAAQ;YACrE,cAAc,EACZ,KAAK,CAAC,EAAE,EAAE,cAAc,IAAI,yBAAyB,CAAC,EAAE,CAAC,cAAc;YACzE,gBAAgB,EACd,KAAK,CAAC,EAAE,EAAE,gBAAgB;gBAC1B,yBAAyB,CAAC,EAAE,CAAC,gBAAgB;YAC/C,aAAa,EAAE,KAAK;YACpB,cAAc,EACZ,KAAK,CAAC,EAAE,EAAE,cAAc,IAAI,yBAAyB,CAAC,EAAE,CAAC,cAAc;YACzE,eAAe;SAChB,CAAC;QACF,kBAAkB,EAAE,eAAe,CAAC,KAAK,CAAC,kBAAkB,IAAI,EAAE,CAAC;QACnE,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;YACzB,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,aAAa;SACzB,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,CAAC;SAC9D,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"resolve-config.js","sourceRoot":"","sources":["../src/resolve-config.ts"],"names":[],"mappings":"AAEA,MAAM,CAAC,MAAM,yBAAyB,GAA4B,MAAM,CAAC,MAAM,CAC7E;IACE,OAAO,EAAE,IAAI;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC;IAC1D,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,KAAK,EAAE,UAAU;QACjB,QAAQ,EAAE,EAAE;QACZ,cAAc,EAAE,kBAAkB;QAClC,WAAW,EAAE,iBAAiB;QAC9B,OAAO,EAAE,IAAI;QACb,UAAU,EACR,sGAAsG;KACzG,CAAC;IACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,MAAM,EAAE,oBAAoB;QAC5B,UAAU,EAAE,wBAAwB;QACpC,GAAG,EAAE,IAAI;QACT,WAAW,EAAE,IAAI;QACjB,cAAc,EAAE,IAAI;QACpB,WAAW,EAAE,IAAI;QACjB,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,IAAI;QACX,eAAe,EAAE,IAAI;KACtB,CAAC;IACF,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;QAChB,UAAU,EAAE,IAAI;QAChB,SAAS,EAAE,KAAK;QAChB,QAAQ,EAAE,IAAI;QACd,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,KAAK;QACvB,aAAa,EAAE,KAAK;QACpB,cAAc,EAAE,IAAI;QACpB,eAAe,EAAE,GAAG;QACpB,eAAe,EAAE,KAAK;KACvB,CAAC;IACF,kBAAkB,EAAE,MAAM,CAAC,MAAM,CAAC;QAChC,gBAAgB;QAChB,gBAAgB;QAChB,8BAA8B;KAC/B,CAAC;IACF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;QACzB,SAAS,EAAE,SAAS;QACpB,SAAS,EAAE,aAAa;KACzB,CAAC;IACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,OAAO,EAAE,IAAI;QACb,uBAAuB,EAAE,IAAI;QAC7B,qBAAqB,EAAE,IAAI;QAC3B,iBAAiB,EAAE,IAAI;QACvB,WAAW,EAAE,WAAW;QACxB,cAAc,EAAE,OAAO;QACvB,gBAAgB,EAAE,cAAc;QAChC,sBAAsB,EAAE,KAAK;QAC7B,kBAAkB,EAAE,KAAK;QACzB,qBAAqB,EAAE,KAAK;QAC5B,iBAAiB,EAAE,KAAK;QACxB,kBAAkB,EAAE,KAAK;QACzB,kBAAkB,EAAE,KAAK;QACzB,yBAAyB,EAAE,KAAK;QAChC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;YACxB,IAAI,EAAE,YAAY;YAClB,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;SACzB,CAAC;KACH,CAAC;IACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,IAAI,EAAE,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;QACtB,OAAO,EAAE,KAAK;QACd,iBAAiB,EAAE,IAAI;QACvB,cAAc,EAAE,EAAE;QAClB,mBAAmB,EAAE,KAAK;KAC3B,CAAC;IACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;QACnB,mBAAmB,EAAE,IAAI;QACzB,eAAe,EAAE,IAAI;KACtB,CAAC;IACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;QACrB,OAAO,EAAE,IAAI;QACb,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,IAAI;YACf,gBAAgB,EAAE,IAAI;SACvB,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,OAAO,EAAE,IAAI;YACb,MAAM,EAAE,IAAI;YACZ,WAAW,EAAE,IAAI;YACjB,cAAc,EAAE,KAAK;YACrB,gBAAgB,EAAE,KAAK;YACvB,2BAA2B,EAAE,CAAC;SAC/B,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,gCAAgC,EAAE,IAAI;YACtC,oBAAoB,EAAE,CAAC;SACxB,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;YACpB,aAAa,EAAE,IAAI;YACnB,mBAAmB,EAAE,IAAI;YACzB,eAAe,EAAE,IAAI;SACtB,CAAC;QACF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;YACzB,OAAO,EAAE,IAAI;YACb,yBAAyB,EAAE,IAAI;YAC/B,cAAc,EAAE,IAAI;YACpB,QAAQ,EAAE,SAAS;YACnB,sBAAsB,EAAE,SAAS;SAClC,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,cAAc,EAAE,IAAI;YACpB,wBAAwB,EAAE,IAAI;YAC9B,wBAAwB,EAAE,IAAI;SAC/B,CAAC;QACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,EAAE,0BAA0B,EAAE,KAAK,EAAE,CAAC;KAC7D,CAAC;CACH,CACF,CAAC;AAEF,SAAS,YAAY,CAAC,KAAgC;IACpD,MAAM,OAAO,GAAG,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;AACzC,CAAC;AAED,MAAM,UAAU,kBAAkB,CAAC,KAAa;IAC9C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,KAAK,EAAE,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,MAAM,IAAI,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;IACzE,IAAI,IAAI,KAAK,GAAG,EAAE,CAAC;QACjB,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,KAAK,MAAM,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,SAAS,CAAC,8CAA8C,CAAC,CAAC;IACtE,CAAC;IACD,IAAI,IAAI,KAAK,UAAU,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QACxD,MAAM,IAAI,SAAS,CAAC,kDAAkD,CAAC,CAAC;IAC1E,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IAChD,MAAM,SAAS,GAAG;QAChB,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KAChE,CAAC;IACF,IAAI,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CACjB,oEAAoE,CACrE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,MAAyB;IAChD,MAAM,KAAK,GAAG;QACZ,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;KAChE,CAAC;IACF,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,CAAC,EAAE,CAAC;QAC9C,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC9B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,aAAa,CAC3B,KAAK,GAAoB,EAAE;IAE3B,MAAM,SAAS,GAAG,kBAAkB,CAClC,KAAK,CAAC,KAAK,EAAE,IAAI,IAAI,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAC1D,CAAC;IACF,MAAM,MAAM,GACV,KAAK,CAAC,OAAO,EAAE,MAAM,IAAI,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC;IACpE,MAAM,cAAc,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;IACnE,IAAI,MAAM,KAAK,OAAO,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAClD,MAAM,IAAI,SAAS,CACjB,qEAAqE,CACtE,CAAC;IACJ,CAAC;IACD,0EAA0E;IAC1E,wEAAwE;IACxE,MAAM,GAAG,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC7C,IAAI,GAAG,KAAK,IAAI,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvD,MAAM,IAAI,SAAS,CACjB,gEAAgE,CACjE,CAAC;IACJ,CAAC;IACD,MAAM,WAAW,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC7D,IAAI,WAAW,KAAK,IAAI,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACzC,MAAM,IAAI,SAAS,CACjB,4EAA4E,CAC7E,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvD,MAAM,KAAK,GAAG,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,CAAC,QAAQ,KAAK,IAAI,CAAC,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,EAAE,CAAC;QAC7C,MAAM,IAAI,SAAS,CACjB,yEAAyE,CAC1E,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GACd,KAAK,CAAC,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE;QACjC,yBAAyB,CAAC,OAAO,CAAC,UAAU,CAAC;IAC/C,IAAI,UAAU,KAAK,EAAE,EAAE,CAAC;QACtB,MAAM,IAAI,SAAS,CAAC,oDAAoD,CAAC,CAAC;IAC5E,CAAC;IACD,MAAM,eAAe,GACnB,KAAK,CAAC,EAAE,EAAE,eAAe,IAAI,yBAAyB,CAAC,EAAE,CAAC,eAAe,CAAC;IAC5E,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,eAAe,CAAC;QACtC,eAAe,GAAG,GAAG;QACrB,eAAe,GAAG,IAAI,EACtB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,wEAAwE,CACzE,CAAC;IACJ,CAAC;IACD,MAAM,eAAe,GACnB,KAAK,CAAC,QAAQ,EAAE,OAAO,IAAI,yBAAyB,CAAC,QAAQ,CAAC,OAAO,CAAC;IACxE,MAAM,WAAW,GAAG,KAAK,CAAC,QACqB,CAAC;IAChD,MAAM,wBAAwB,GAAG;QAC/B,CAAC,wBAAwB,EAAE,WAAW,EAAE,sBAAsB,CAAC;QAC/D,CAAC,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,CAAC;QACvD,CAAC,uBAAuB,EAAE,WAAW,EAAE,qBAAqB,CAAC;QAC7D,CAAC,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,CAAC;QACvD,CAAC,oBAAoB,EAAE,WAAW,EAAE,kBAAkB,CAAC;QACvD,CAAC,2BAA2B,EAAE,WAAW,EAAE,yBAAyB,CAAC;KAC7D,CAAC;IACX,MAAM,YAAY,GAAG,wBAAwB,CAAC,IAAI,CAChD,CAAC,CAAC,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,IAAI,CAC9B,CAAC;IACF,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,IAAI,SAAS,CACjB,4BAA4B,YAAY,CAAC,CAAC,CAAC,oBAAoB,CAChE,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,EAAE,WAAW,KAAK,SAAS;QACzC,KAAK,CAAC,QAAQ,CAAC,WAAW,KAAK,WAAW,EAC1C,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,wDAAwD,CACzD,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,EAAE,cAAc,KAAK,SAAS;QAC5C,KAAK,CAAC,QAAQ,CAAC,cAAc,KAAK,OAAO,EACzC,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,uDAAuD,CACxD,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,IAAI,KAAK,SAAS;QAC9C,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,KAAK,YAAY,EAC/C,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,6DAA6D,CAC9D,CAAC;IACJ,CAAC;IACD,MAAM,gBAAgB,GACpB,KAAK,CAAC,QAAQ,EAAE,gBAAgB,EAAE,IAAI,EAAE;QACxC,yBAAyB,CAAC,QAAQ,CAAC,gBAAgB,CAAC;IACtD,IAAI,eAAe,IAAI,gBAAgB,KAAK,EAAE,EAAE,CAAC;QAC/C,MAAM,IAAI,SAAS,CACjB,gFAAgF,CACjF,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GACrB,KAAK,CAAC,QAAQ,EAAE,iBAAiB;QACjC,yBAAyB,CAAC,QAAQ,CAAC,iBAAiB,CAAC;IACvD,IACE,eAAe;QACf,CAAC,KAAK,CAAC,EAAE,EAAE,SAAS,IAAI,yBAAyB,CAAC,EAAE,CAAC,SAAS,CAAC;QAC/D,CAAC,iBAAiB,EAClB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,kEAAkE,CACnE,CAAC;IACJ,CAAC;IACD,MAAM,2BAA2B,GAC/B,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,2BAA2B;QACnD,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACxE,MAAM,oBAAoB,GACxB,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,oBAAoB;QAC9C,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,oBAAoB,CAAC;IACnE,MAAM,QAAQ,GACZ,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,QAAQ;QACpC,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,QAAQ,CAAC;IACzD,MAAM,sBAAsB,GAC1B,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,sBAAsB;QAClD,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,sBAAsB,CAAC;IACvE,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,IAAI;QACpC;YACE,6CAA6C;YAC7C,2BAA2B;YAC3B,CAAC;YACD,GAAG;SACJ;QACD,CAAC,wCAAwC,EAAE,oBAAoB,EAAE,CAAC,EAAE,EAAE,CAAC;QACvE,CAAC,8BAA8B,EAAE,QAAQ,EAAE,KAAK,EAAE,UAAU,CAAC;QAC7D;YACE,4CAA4C;YAC5C,sBAAsB;YACtB,KAAK;YACL,UAAU;SACX;KACO,EAAE,CAAC;QACX,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,GAAG,IAAI,KAAK,GAAG,GAAG,EAAE,CAAC;YAC/D,MAAM,IAAI,SAAS,CACjB,mBAAmB,IAAI,4BAA4B,GAAG,OAAO,GAAG,EAAE,CACnE,CAAC;QACJ,CAAC;IACH,CAAC;IACD,IAAI,sBAAsB,GAAG,QAAQ,EAAE,CAAC;QACtC,MAAM,IAAI,SAAS,CACjB,mFAAmF,CACpF,CAAC;IACJ,CAAC;IACD,MAAM,cAAc,GAClB,KAAK,CAAC,QAAQ,EAAE,cAAc;QAC9B,yBAAyB,CAAC,QAAQ,CAAC,cAAc,CAAC;IACpD,IACE,CAAC,MAAM,CAAC,aAAa,CAAC,cAAc,CAAC;QACrC,cAAc,GAAG,CAAC;QAClB,cAAc,GAAG,GAAG,EACpB,CAAC;QACD,MAAM,IAAI,SAAS,CACjB,0EAA0E,CAC3E,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC;QACnB,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,yBAAyB,CAAC,OAAO;QAC3D,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,IAAI,EAAE,SAAS;YACf,aAAa,EACX,KAAK,CAAC,KAAK,EAAE,aAAa;gBAC1B,yBAAyB,CAAC,KAAK,CAAC,aAAa;SAChD,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,KAAK,EACH,KAAK,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;gBAC7B,yBAAyB,CAAC,QAAQ,CAAC,KAAK;YAC1C,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,EAAE;YAChD,cAAc,EACZ,KAAK,CAAC,QAAQ,EAAE,cAAc,EAAE,IAAI,EAAE;gBACtC,yBAAyB,CAAC,QAAQ,CAAC,cAAc;YACnD,WAAW,EACT,KAAK,CAAC,QAAQ,EAAE,WAAW,EAAE,IAAI,EAAE;gBACnC,yBAAyB,CAAC,QAAQ,CAAC,WAAW;YAChD,OAAO,EAAE,YAAY,CAAC,KAAK,CAAC,QAAQ,EAAE,OAAO,CAAC;YAC9C,kEAAkE;YAClE,yCAAyC;YACzC,UAAU,EACR,KAAK,CAAC,QAAQ,EAAE,UAAU,KAAK,SAAS;gBACtC,CAAC,CAAC,yBAAyB,CAAC,QAAQ,CAAC,UAAU;gBAC/C,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,EAAE,CAAC;SACtD,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,MAAM;YACN,UAAU;YACV,GAAG;YACH,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;YACrD,cAAc;YACd,WAAW,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC;YACrD,QAAQ;YACR,KAAK;YACL,eAAe,EAAE,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,eAAe,CAAC;SAC9D,CAAC;QACF,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC;YAChB,UAAU,EACR,KAAK,CAAC,EAAE,EAAE,UAAU,IAAI,yBAAyB,CAAC,EAAE,CAAC,UAAU;YACjE,SAAS,EAAE,KAAK,CAAC,EAAE,EAAE,SAAS,IAAI,yBAAyB,CAAC,EAAE,CAAC,SAAS;YACxE,QAAQ,EAAE,KAAK,CAAC,EAAE,EAAE,QAAQ,IAAI,yBAAyB,CAAC,EAAE,CAAC,QAAQ;YACrE,cAAc,EACZ,KAAK,CAAC,EAAE,EAAE,cAAc,IAAI,yBAAyB,CAAC,EAAE,CAAC,cAAc;YACzE,gBAAgB,EACd,KAAK,CAAC,EAAE,EAAE,gBAAgB;gBAC1B,yBAAyB,CAAC,EAAE,CAAC,gBAAgB;YAC/C,aAAa,EACX,KAAK,CAAC,EAAE,EAAE,aAAa,IAAI,yBAAyB,CAAC,EAAE,CAAC,aAAa;YACvE,cAAc,EACZ,KAAK,CAAC,EAAE,EAAE,cAAc,IAAI,yBAAyB,CAAC,EAAE,CAAC,cAAc;YACzE,eAAe;YACf,eAAe,EACb,KAAK,CAAC,EAAE,EAAE,eAAe;gBACzB,yBAAyB,CAAC,EAAE,CAAC,eAAe;SAC/C,CAAC;QACF,kBAAkB,EAAE,eAAe,CACjC,KAAK,CAAC,kBAAkB,IAAI,yBAAyB,CAAC,kBAAkB,CACzE;QACD,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;YACzB,SAAS,EAAE,SAAS;YACpB,SAAS,EAAE,aAAa;SACzB,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,OAAO,EAAE,eAAe;YACxB,uBAAuB,EACrB,KAAK,CAAC,QAAQ,EAAE,uBAAuB;gBACvC,yBAAyB,CAAC,QAAQ,CAAC,uBAAuB;YAC5D,qBAAqB,EACnB,KAAK,CAAC,QAAQ,EAAE,qBAAqB;gBACrC,yBAAyB,CAAC,QAAQ,CAAC,qBAAqB;YAC1D,iBAAiB,EACf,KAAK,CAAC,QAAQ,EAAE,iBAAiB;gBACjC,yBAAyB,CAAC,QAAQ,CAAC,iBAAiB;YACtD,WAAW,EAAE,WAAW;YACxB,cAAc,EAAE,OAAO;YACvB,gBAAgB;YAChB,sBAAsB,EAAE,KAAK;YAC7B,kBAAkB,EAAE,KAAK;YACzB,qBAAqB,EAAE,KAAK;YAC5B,iBAAiB;YACjB,kBAAkB,EAAE,KAAK;YACzB,kBAAkB,EAAE,KAAK;YACzB,yBAAyB,EAAE,KAAK;YAChC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC;gBACxB,IAAI,EAAE,YAAY;gBAClB,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,UAAU,EAAE,KAAK,IAAI,EAAE,CAAC;aAChE,CAAC;SACH,CAAC;QACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;YACvB,cAAc,EAAE,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,cAAc,CAAC;SAC9D,CAAC;QACF,QAAQ,EAAE,MAAM,CAAC,MAAM,CAAC;YACtB,OAAO,EACL,KAAK,CAAC,QAAQ,EAAE,OAAO,IAAI,yBAAyB,CAAC,QAAQ,CAAC,OAAO;YACvE,iBAAiB,EACf,KAAK,CAAC,QAAQ,EAAE,iBAAiB;gBACjC,yBAAyB,CAAC,QAAQ,CAAC,iBAAiB;YACtD,cAAc;YACd,mBAAmB,EACjB,KAAK,CAAC,QAAQ,EAAE,mBAAmB;gBACnC,yBAAyB,CAAC,QAAQ,CAAC,mBAAmB;SACzD,CAAC;QACF,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC;YACnB,mBAAmB,EACjB,KAAK,CAAC,KAAK,EAAE,mBAAmB;gBAChC,yBAAyB,CAAC,KAAK,CAAC,mBAAmB;YACrD,eAAe,EACb,KAAK,CAAC,KAAK,EAAE,eAAe;gBAC5B,yBAAyB,CAAC,KAAK,CAAC,eAAe;SAClD,CAAC;QACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;YACrB,OAAO,EACL,KAAK,CAAC,OAAO,EAAE,OAAO,IAAI,yBAAyB,CAAC,OAAO,CAAC,OAAO;YACrE,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;gBACrB,WAAW,EACT,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW;oBACnC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW;gBACvD,SAAS,EACP,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,SAAS;oBACjC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,SAAS;gBACrD,gBAAgB,EACd,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB;oBACxC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB;aAC7D,CAAC;YACF,OAAO,EAAE,MAAM,CAAC,MAAM,CAAC;gBACrB,OAAO,EACL,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO;oBAC/B,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO;gBACnD,MAAM,EACJ,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,MAAM;oBAC9B,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM;gBAClD,WAAW,EACT,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,WAAW;oBACnC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,WAAW;gBACvD,cAAc,EACZ,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,cAAc;oBACtC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,cAAc;gBAC1D,gBAAgB,EACd,KAAK,CAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB;oBACxC,yBAAyB,CAAC,OAAO,CAAC,OAAO,CAAC,gBAAgB;gBAC5D,2BAA2B;aAC5B,CAAC;YACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;gBACvB,gCAAgC,EAC9B,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,gCAAgC;oBAC1D,yBAAyB,CAAC,OAAO,CAAC,SAAS;yBACxC,gCAAgC;gBACrC,oBAAoB;aACrB,CAAC;YACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACpB,aAAa,EACX,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,aAAa;oBACpC,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,aAAa;gBACxD,mBAAmB,EACjB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,mBAAmB;oBAC1C,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,mBAAmB;gBAC9D,eAAe,EACb,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,eAAe;oBACtC,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,eAAe;aAC3D,CAAC;YACF,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC;gBACzB,OAAO,EACL,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO;oBACnC,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,OAAO;gBACvD,yBAAyB,EACvB,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,yBAAyB;oBACrD,yBAAyB,CAAC,OAAO,CAAC,WAAW;yBAC1C,yBAAyB;gBAC9B,cAAc,EACZ,KAAK,CAAC,OAAO,EAAE,WAAW,EAAE,cAAc;oBAC1C,yBAAyB,CAAC,OAAO,CAAC,WAAW,CAAC,cAAc;gBAC9D,QAAQ;gBACR,sBAAsB;aACvB,CAAC;YACF,SAAS,EAAE,MAAM,CAAC,MAAM,CAAC;gBACvB,cAAc,EACZ,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,cAAc;oBACxC,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,cAAc;gBAC5D,wBAAwB,EACtB,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,wBAAwB;oBAClD,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;gBACtE,wBAAwB,EACtB,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,wBAAwB;oBAClD,yBAAyB,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;aACvE,CAAC;YACF,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACpB,0BAA0B,EACxB,KAAK,CAAC,OAAO,EAAE,MAAM,EAAE,0BAA0B;oBACjD,yBAAyB,CAAC,OAAO,CAAC,MAAM,CAAC,0BAA0B;aACtE,CAAC;SACH,CAAC;KACH,CAAC,CAAC;AACL,CAAC"}

package/lib/secure-session.js

@@ -0,0 +1,212 @@
+// The `types` subpath keeps the client ISessions Context merge authoritative;
+// the package root merges a conflicting host `sessions` service type.
+import { SessionId } from "@deepseek-ai/dsh-session/types";
+import { WorkspaceId } from "@deepseek-ai/dsh-workspace";
+import { QaAccountsError } from "./accounts/store.js";
+import { QaAttestationError } from "./attestation.js";
+import { qaToolDenial, qaToolPolicyPlan } from "./lockdown-policy.js";
+import { QA_REPORT_SOURCES_TOOL } from "./provenance/host-store.js";
+/** Grace period in which a fresh session may still be pinned to the QA preset. */
+const FRESH_SESSION_BOOTSTRAP_WINDOW_MS = 120_000;
+/**
+ * Compare session cwds the way the host records them: separator- and
+ * case-normalized on Windows, so a deployment path written with either
+ * separator or case still matches the session header cwd.
+ */
+function cwdMatches(headerCwd, pinned) {
+    if (headerCwd === undefined)
+        return false;
+    const normalize = (value) => value.replaceAll("\\", "/").replace(/\/+$/u, "");
+    const left = normalize(headerCwd);
+    const right = normalize(pinned);
+    return process.platform === "win32"
+        ? left.toLowerCase() === right.toLowerCase()
+        : left === right;
+}
+/**
+ * Host-side QA policy admission boundary — the only browser-callable operation
+ * that turns a session into a locked QA session. It verifies the immutable
+ * session composition against the effective deployment config, refuses to
+ * adopt a non-QA session with user history, validates the named permission
+ * preset, pins the scoped tool restriction plus the monotonic execution guard,
+ * and returns a sanitized proof. Every refusal carries only a coarse reason.
+ */
+export class QaPolicyAdmission {
+    ctx;
+    config;
+    logger;
+    accounts;
+    appliedPolicies = new Map();
+    constructor(ctx, config, logger, accounts) {
+        this.ctx = ctx;
+        this.config = config;
+        this.logger = logger;
+        this.accounts = accounts;
+        ctx.on("agent/disposed", ({ agent }) => {
+            this.appliedPolicies.delete(agent);
+        });
+    }
+    secureSession(token, sessionId) {
+        const config = this.config();
+        const lockdown = config.lockdown;
+        // Account identity is checked before any policy work: an invalid token
+        // must not learn whether a session exists or how the deployment composes.
+        // Independent of lockdown — a deployment may gate users without pinning
+        // the policy, and the gate itself no-ops while accounts are disabled.
+        if (this.accounts !== undefined) {
+            try {
+                this.accounts.enforceSessionAccess(token, sessionId);
+            }
+            catch (error) {
+                if (error instanceof QaAccountsError) {
+                    throw new QaAttestationError(error.reason === "session-owned-elsewhere"
+                        ? "session-owned-elsewhere"
+                        : "auth-required", error.message);
+                }
+                throw error;
+            }
+        }
+        const agent = this.ctx.agents.get(SessionId(sessionId));
+        if (agent === undefined) {
+            throw new QaAttestationError("agent-unavailable", "agent is unavailable");
+        }
+        if (!lockdown.enabled) {
+            return {
+                sessionId,
+                enabled: false,
+                agentPresetMatches: true,
+                workspaceMatches: true,
+                modelMatches: true,
+                sandboxIsReadOnly: false,
+                approvalIsNever: false,
+                permissionPreset: "",
+                toolPolicyLoaded: false,
+                toolAllowList: [],
+            };
+        }
+        const expectedWorkspace = config.session.workspaceId;
+        const pinnedWorkspace = expectedWorkspace === null
+            ? undefined
+            : this.ctx.workspaceRegistry.get(WorkspaceId(expectedWorkspace));
+        // A pin that resolves to nothing would refuse the cwd comparison anyway,
+        // but the precise reason saves an operator a round trip: the surface
+        // stays closed until the workspace exists or the id is fixed.
+        if (expectedWorkspace !== null && pinnedWorkspace === undefined) {
+            throw new QaAttestationError("workspace-unavailable", `workspace ${expectedWorkspace} is not registered`);
+        }
+        const expectedPreset = config.session.agentPreset;
+        const agentPresetMatches = !lockdown.enforceFixedAgentPreset ||
+            expectedPreset === null ||
+            this.ctx.agentPresets.composedPreset(agent.ctx) === expectedPreset;
+        const workspaceMatches = !lockdown.enforceFixedWorkspace ||
+            (expectedWorkspace === null && config.session.cwd === null) ||
+            (pinnedWorkspace !== undefined &&
+                cwdMatches(agent.session.header.cwd, pinnedWorkspace.path)) ||
+            (expectedWorkspace === null &&
+                config.session.cwd !== null &&
+                cwdMatches(agent.session.header.cwd, config.session.cwd));
+        const options = agent.options;
+        const modelMatches = !lockdown.enforceFixedModel ||
+            config.session.provider === null ||
+            (options.provider === config.session.provider &&
+                options.model === config.session.model &&
+                (config.session.reasoningEffort === null ||
+                    options.reasoningEffort === config.session.reasoningEffort));
+        if (!agentPresetMatches || !workspaceMatches || !modelMatches) {
+            throw new QaAttestationError("composition-mismatch", `composition mismatch: agent=${agentPresetMatches} workspace=${workspaceMatches} model=${modelMatches}`);
+        }
+        const permission = this.ctx.permissionPresets.resolve(lockdown.permissionPreset);
+        if (permission.sandbox !== lockdown.sandboxMode ||
+            permission.approval !== lockdown.approvalPolicy) {
+            throw new QaAttestationError("permission-preset", `permission preset ${lockdown.permissionPreset} does not resolve to read-only/never`);
+        }
+        const currentPermission = this.ctx.permissionPresets.current(agent.session);
+        // History check over the model-visible surface: `user/message` is a
+        // surface event, so any adopted conversation shows up here regardless of
+        // window pagination.
+        const hasUserHistory = agent.session.surface.nodes.some((seq) => agent.session.eventAt(seq)?.type === "user/message");
+        if (currentPermission !== lockdown.permissionPreset &&
+            (hasUserHistory ||
+                Date.now() - agent.session.header.createdAt >
+                    FRESH_SESSION_BOOTSTRAP_WINDOW_MS)) {
+            throw new QaAttestationError("adoption-refused", "existing non-QA session cannot be adopted");
+        }
+        const policyAllow = config.sources.enabled &&
+            config.sources.subagents.enableReportToolFallback &&
+            !lockdown.toolPolicy.allow.includes(QA_REPORT_SOURCES_TOOL)
+            ? [...lockdown.toolPolicy.allow, QA_REPORT_SOURCES_TOOL]
+            : lockdown.toolPolicy.allow;
+        const policy = qaToolPolicyPlan(policyAllow, (toolName) => this.ctx.tools.get(toolName, agent) !== undefined);
+        if (policy.unknown.length > 0) {
+            throw new QaAttestationError("unknown-tools", `unknown QA tool(s): ${policy.unknown.join(", ")}`);
+        }
+        const fingerprint = JSON.stringify(policy.allow);
+        const prior = this.appliedPolicies.get(agent);
+        if (prior?.fingerprint !== fingerprint) {
+            const allowed = new Set(policy.allow);
+            const disposeGuard = agent.ctx.tools.guard((execution) => qaToolDenial(allowed, execution.name));
+            const disposeGuidance = agent.ctx.systemPrompt.section({
+                name: "dsh-qa-surface:structured-sources",
+                order: 950,
+                text: "Source provenance is collected automatically from tools. Do not append a manual Sources/Источники bibliography to the answer. Delegated providers that cannot expose tool events should call qa_report_sources before finishing.",
+            });
+            try {
+                const disposeRestriction = agent.ctx.tools.restrict({
+                    allow: policy.allow,
+                });
+                this.appliedPolicies.set(agent, {
+                    fingerprint,
+                    disposeGuard,
+                    disposeRestriction,
+                    disposeGuidance,
+                });
+                prior?.disposeRestriction();
+                prior?.disposeGuard();
+                prior?.disposeGuidance();
+            }
+            catch (error) {
+                disposeGuard();
+                disposeGuidance();
+                throw error;
+            }
+        }
+        this.ctx.permissionPresets.set(agent.session, lockdown.permissionPreset);
+        const effectivePermission = this.ctx.permissionPresets.current(agent.session);
+        const sandboxIsReadOnly = permission.sandbox === "read-only";
+        const approvalIsNever = permission.approval === "never";
+        if (effectivePermission !== lockdown.permissionPreset ||
+            !sandboxIsReadOnly ||
+            !approvalIsNever) {
+            throw new QaAttestationError("attestation-failed", "permission attestation failed");
+        }
+        this.logger.debug("lockdown.attested", {
+            sessionId,
+            permissionPreset: lockdown.permissionPreset,
+            toolAllowList: policy.allow,
+        });
+        return {
+            sessionId,
+            enabled: true,
+            agentPresetMatches,
+            workspaceMatches,
+            modelMatches,
+            sandboxIsReadOnly,
+            approvalIsNever,
+            permissionPreset: lockdown.permissionPreset,
+            toolPolicyLoaded: true,
+            // The fallback reporter is an internal read-only provenance capability,
+            // not an operator-configured QA tool grant.
+            toolAllowList: lockdown.toolPolicy.allow,
+        };
+    }
+    /** Detach every pinned tool policy; wired as a disposal effect by the entry. */
+    dispose() {
+        for (const policy of this.appliedPolicies.values()) {
+            policy.disposeRestriction();
+            policy.disposeGuard();
+            policy.disposeGuidance();
+        }
+        this.appliedPolicies.clear();
+    }
+}
+//# sourceMappingURL=secure-session.js.map

package/lib/secure-session.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secure-session.js","sourceRoot":"","sources":["../src/secure-session.ts"],"names":[],"mappings":"AAGA,8EAA8E;AAC9E,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACtE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAmBpE,kFAAkF;AAClF,MAAM,iCAAiC,GAAG,OAAO,CAAC;AAElD;;;;GAIG;AACH,SAAS,UAAU,CAAC,SAA6B,EAAE,MAAc;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAIT,GAAG;IACH,MAAM;IACN,MAAM;IACN,QAAQ;IANV,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IAEnE,YACmB,GAAY,EACZ,MAAqC,EACrC,MAAoB,EACpB,QAAyB;mBAHzB,GAAG;sBACH,MAAM;sBACN,MAAM;wBACN,QAAQ;QAEzB,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACrC,CAAC,CAAC,CAAC;IACL,CAAC;IAED,aAAa,CAAC,KAAa,EAAE,SAAiB;QAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACvD,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,kBAAkB,CAC1B,KAAK,CAAC,MAAM,KAAK,yBAAyB;wBACxC,CAAC,CAAC,yBAAyB;wBAC3B,CAAC,CAAC,eAAe,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,IAAI;gBAClB,iBAAiB,EAAE,KAAK;gBACxB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,KAAK;gBACvB,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GACnB,iBAAiB,KAAK,IAAI;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrE,yEAAyE;QACzE,qEAAqE;QACrE,8DAA8D;QAC9D,IAAI,iBAAiB,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,aAAa,iBAAiB,oBAAoB,CACnD,CAAC;QACJ,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,uBAAuB;YACjC,cAAc,KAAK,IAAI;YACvB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;QAErE,MAAM,gBAAgB,GACpB,CAAC,QAAQ,CAAC,qBAAqB;YAC/B,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YAC3D,CAAC,eAAe,KAAK,SAAS;gBAC5B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC,iBAAiB,KAAK,IAAI;gBACzB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;gBAC3B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAErB,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;YAChC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ;gBAC3C,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK;gBACtC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;oBACtC,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,EACtB,+BAA+B,kBAAkB,cAAc,gBAAgB,UAAU,YAAY,EAAE,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CACnD,QAAQ,CAAC,gBAAgB,CAC1B,CAAC;QACF,IACE,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW;YAC3C,UAAU,CAAC,QAAQ,KAAK,QAAQ,CAAC,cAAc,EAC/C,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,QAAQ,CAAC,gBAAgB,sCAAsC,CACrF,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,oEAAoE;QACpE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,cAAc,CAC7D,CAAC;QACF,IACE,iBAAiB,KAAK,QAAQ,CAAC,gBAAgB;YAC/C,CAAC,cAAc;gBACb,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;oBACzC,iCAAiC,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GACf,MAAM,CAAC,OAAO,CAAC,OAAO;YACtB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;YACjD,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YACzD,CAAC,CAAC,CAAC,GAAG,QAAQ,CAAC,UAAU,CAAC,KAAK,EAAE,sBAAsB,CAAC;YACxD,CAAC,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QAChC,MAAM,MAAM,GAAG,gBAAgB,CAC7B,WAAW,EACX,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,SAAS,CAChE,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,uBAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,MAAM,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE,CACvD,YAAY,CAAC,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,CACtC,CAAC;YACF,MAAM,eAAe,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC;gBACrD,IAAI,EAAE,mCAAmC;gBACzC,KAAK,EAAE,GAAG;gBACV,IAAI,EAAE,kOAAkO;aACzO,CAAC,CAAC;YACH,IAAI,CAAC;gBACH,MAAM,kBAAkB,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC;oBAClD,KAAK,EAAE,MAAM,CAAC,KAAK;iBACpB,CAAC,CAAC;gBACH,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE;oBAC9B,WAAW;oBACX,YAAY;oBACZ,kBAAkB;oBAClB,eAAe;iBAChB,CAAC,CAAC;gBACH,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBAC5B,KAAK,EAAE,YAAY,EAAE,CAAC;gBACtB,KAAK,EAAE,eAAe,EAAE,CAAC;YAC3B,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,eAAe,EAAE,CAAC;gBAClB,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC5D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,iBAAiB,GAAG,UAAU,CAAC,OAAO,KAAK,WAAW,CAAC;QAC7D,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC;QACxD,IACE,mBAAmB,KAAK,QAAQ,CAAC,gBAAgB;YACjD,CAAC,iBAAiB;YAClB,CAAC,eAAe,EAChB,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QAED,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACrC,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,aAAa,EAAE,MAAM,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,SAAS;YACT,OAAO,EAAE,IAAI;YACb,kBAAkB;YAClB,gBAAgB;YAChB,YAAY;YACZ,iBAAiB;YACjB,eAAe;YACf,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,gBAAgB,EAAE,IAAI;YACtB,wEAAwE;YACxE,4CAA4C;YAC5C,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK;SACzC,CAAC;IACJ,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,CAAC,eAAe,EAAE,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/lib/typert.host.d.ts

@@ -0,0 +1,3 @@
+/* Generated by @deepseek-ai/dsh-typert-generator from FaceModel — do not edit. */
+
+export declare const TYPERT: unknown