@yadsh/dsh-qa-surface 0.7.1 → 0.7.3

package/lib/enforcement/tool-grants.js

@@ -1,3 +1,4 @@
+import { installInheritableMask } from "./tool-mask.js";
 function describe(tools) {
     return tools.map((tool) => `"${tool}"`).join(", ");
 }
@@ -10,9 +11,14 @@ function describe(tools) {
  * subrole was configured with. A skill file can therefore ask for anything —
  * the intersection with the role ceiling is what it gets.
  *
- * A restriction may only name tools the scope inherits, so a grant is verified
- * by applying it: a name the registry refuses (agent-local, unregistered) is
- * dropped from the grant instead of breaking the session.
+ * A restriction may only name tools the scope INHERITS. The QA tool catalog
+ * attaches its tools to the agent itself, and such a registration is visible to
+ * the model without ever being nameable in a restriction: handing one to
+ * `restrict()` makes the registry refuse the whole call. Every restriction this
+ * class installs is therefore installed through the mask helper, which admits
+ * the inherited names and leaves the self-registered ones out, and a grant is
+ * verified against the same view — a name no layer holds is dropped from the
+ * grant instead of breaking the session.
  */
 export class QaAgentToolGrants {
     options;
@@ -28,6 +34,20 @@ export class QaAgentToolGrants {
     effectiveTools() {
         return this.tools;
     }
+    /**
+     * Whether the tool is callable for the agent at all, masks aside.
+     *
+     * The global view ignores restrictions and the agent's own view covers what
+     * the agent registered for itself, so a tool some layer holds stays grantable
+     * even while the current mask hides it.
+     */
+    mounted(tool) {
+        if (this.options.agentLocalTools.has(tool))
+            return true;
+        const tools = this.options.agent.ctx.tools;
+        return (tools.get(tool) !== undefined ||
+            tools.get(tool, this.options.agent) !== undefined);
+    }
     /** Grants currently held, newest last; one entry per activated skill. */
     activeGrants() {
         return [...this.active.values()];
@@ -54,14 +74,18 @@ export class QaAgentToolGrants {
                 accepted.push(tool);
                 continue;
             }
+            // A name no layer holds cannot be granted; an agent-local one is already
+            // visible to the model, so it needs no mask of its own.
+            if (!this.mounted(tool))
+                continue;
             try {
                 this.applyRestriction([...this.tools, tool]);
                 this.tools.add(tool);
                 accepted.push(tool);
             }
             catch {
-                // The registry refused the name (unregistered or agent-local), so the
-                // tool stays out of the grant rather than breaking the activation.
+                // The registry refused the name after all, so the tool stays out of
+                // the grant rather than breaking the activation.
             }
         }
         const denied = requested.filter((tool) => !accepted.includes(tool));
@@ -124,9 +148,18 @@ export class QaAgentToolGrants {
      * unrestricted, and a rejected name would then leave it that way.
      */
     applyRestriction(allow) {
-        const next = this.options.agent.ctx.tools.restrict({ allow: [...allow] });
+        // Only names the scope INHERITS may reach the registry: a base set that
+        // carries an agent-local tool (the QA activation diagnostic is one) would
+        // otherwise make `restrict()` refuse the call and fail the whole
+        // attestation, and a name no layer holds would do the same.
+        const mask = installInheritableMask(this.options.agent.ctx.tools, allow, this.options.agentLocalTools);
+        if (mask.refused.length > 0) {
+            this.options.logger.warn("skill.tool-mask-incomplete", {
+                dropped: mask.refused,
+            });
+        }
         const previous = this.disposeRestriction;
-        this.disposeRestriction = next;
+        this.disposeRestriction = mask.dispose;
         previous?.();
     }
     restore(before) {

package/lib/enforcement/tool-grants.js.map

@@ -1 +1 @@
-{"version":3,"file":"tool-grants.js","sourceRoot":"","sources":["../../src/enforcement/tool-grants.ts"],"names":[],"mappings":"AAwCA,SAAS,QAAQ,CAAC,KAAwB;IACxC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,OAAO,iBAAiB;IAKC,OAAO;IAJnB,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,KAAK,CAAc;IAC5B,kBAAkB,CAA2B;IAErD,YAA6B,OAAiC;uBAAjC,OAAO;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CACN,SAAiB,EACjB,MAA+B;QAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC3C,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;gBACtE,mEAAmE;YACrE,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpE,IAAI,UAAU,EAAE,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,SAAS,+CAA+C,QAAQ,CACvF,MAAM,CACP,uCAAuC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,KAAK,GAAiB,MAAM,CAAC,MAAM,CAAC;YACxC,SAAS;YACT,MAAM;YACN,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACrC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAChD,KAAK,EAAE,SAAS;YAChB,MAAM;YACN,OAAO,EAAE,QAAQ;YACjB,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,CAAC;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,yCAAyC;gBACzC,EAAE;gBACF,6BAA6B;gBAC7B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;aACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,KAAK;YACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,IAAI,CACF,SAAiB,EACjB,MAA+B,EAC/B,MAAc;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CACT,SAAS,EACT,MAAM,EACN,QAAQ,EACR,UAAU,EAAE,aAAa,IAAI,EAAE,EAC/B,EAAE,EACF,UAAU,EAAE,aAAa,IAAI,EAAE,EAC/B,MAAM,CACP,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,KAAwB;QAC/C,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC;QAC1E,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACzC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC;QAC/B,QAAQ,EAAE,EAAE,CAAC;IACf,CAAC;IAEO,OAAO,CAAC,MAAyB;QACvC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,MAAM,CACZ,SAAiB,EACjB,MAA+B,EAC/B,OAA2C,EAC3C,SAA4B,EAC5B,OAA0B,EAC1B,MAAyB,EACzB,MAAe;QAEf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CACnB,MAAM,CAAC,MAAM,CAAC;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;YACT,MAAM;YACN,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;YACzC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YACvC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"tool-grants.js","sourceRoot":"","sources":["../../src/enforcement/tool-grants.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,gBAAgB,CAAC;AA4CxD,SAAS,QAAQ,CAAC,KAAwB;IACxC,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,OAAO,iBAAiB;IAKC,OAAO;IAJnB,MAAM,GAAG,IAAI,GAAG,EAAwB,CAAC;IACzC,KAAK,CAAc;IAC5B,kBAAkB,CAA2B;IAErD,YAA6B,OAAiC;uBAAjC,OAAO;QAClC,IAAI,CAAC,KAAK,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;QACxC,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;IACzC,CAAC;IAED,uDAAuD;IACvD,cAAc;QACZ,OAAO,IAAI,CAAC,KAAK,CAAC;IACpB,CAAC;IAED;;;;;;OAMG;IACK,OAAO,CAAC,IAAY;QAC1B,IAAI,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,MAAM,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC;QAC3C,OAAO,CACL,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,SAAS;YAC7B,KAAK,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,SAAS,CAClD,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,YAAY;QACV,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;IACnC,CAAC;IAED;;;;;;;;;;OAUG;IACH,QAAQ,CACN,SAAiB,EACjB,MAA+B;QAE/B,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,MAAM,SAAS,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;QACzD,MAAM,UAAU,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAC3C,IAAI,CAAC,OAAO,CAAC,cAAc,CAAC,QAAQ,CAAC,IAAI,CAAC,CAC3C,CAAC;QACF,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,QAAQ,GAAa,EAAE,CAAC;QAC9B,KAAK,MAAM,IAAI,IAAI,UAAU,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;gBACzB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;gBACpB,SAAS;YACX,CAAC;YACD,yEAAyE;YACzE,wDAAwD;YACxD,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC;gBAAE,SAAS;YAClC,IAAI,CAAC;gBACH,IAAI,CAAC,gBAAgB,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;gBAC7C,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBACrB,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACtB,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;gBACpE,iDAAiD;YACnD,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;QAEpE,IAAI,UAAU,EAAE,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;YACrB,MAAM,MAAM,GAAG,UAAU,SAAS,+CAA+C,QAAQ,CACvF,MAAM,CACP,uCAAuC,CAAC;YACzC,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;YAC1E,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,CAAC;QACxC,CAAC;QAED,MAAM,KAAK,GAAiB,MAAM,CAAC,MAAM,CAAC;YACxC,SAAS;YACT,MAAM;YACN,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC;YACxC,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC;YACrC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;YAClC,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;SACtC,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;QAClC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,uBAAuB,EAAE;YAChD,KAAK,EAAE,SAAS;YAChB,MAAM;YACN,OAAO,EAAE,QAAQ;YACjB,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACzE,MAAM,OAAO,GACX,MAAM,CAAC,MAAM,KAAK,CAAC;YACjB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC;gBACE,yCAAyC;gBACzC,EAAE;gBACF,6BAA6B;gBAC7B,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;aACrC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACnB,OAAO;YACL,MAAM,EAAE,WAAW;YACnB,KAAK;YACL,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;SAC9C,CAAC;IACJ,CAAC;IAED,yDAAyD;IACzD,IAAI,CACF,SAAiB,EACjB,MAA+B,EAC/B,MAAc;QAEd,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3D,IAAI,CAAC,MAAM,CACT,SAAS,EACT,MAAM,EACN,QAAQ,EACR,UAAU,EAAE,aAAa,IAAI,EAAE,EAC/B,EAAE,EACF,UAAU,EAAE,aAAa,IAAI,EAAE,EAC/B,MAAM,CACP,CAAC;IACJ,CAAC;IAED,4EAA4E;IAC5E,OAAO;QACL,MAAM,OAAO,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACxC,IAAI,CAAC,kBAAkB,GAAG,SAAS,CAAC;QACpC,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC;QACpB,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,OAAO,CAAC,SAAS;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChE,OAAO,EAAE,EAAE,CAAC;IACd,CAAC;IAED;;;;;;OAMG;IACK,gBAAgB,CAAC,KAAwB;QAC/C,wEAAwE;QACxE,0EAA0E;QAC1E,iEAAiE;QACjE,4DAA4D;QAC5D,MAAM,IAAI,GAAG,sBAAsB,CACjC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAC5B,KAAK,EACL,IAAI,CAAC,OAAO,CAAC,eAAe,CAC7B,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,4BAA4B,EAAE;gBACrD,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,kBAAkB,CAAC;QACzC,IAAI,CAAC,kBAAkB,GAAG,IAAI,CAAC,OAAO,CAAC;QACvC,QAAQ,EAAE,EAAE,CAAC;IACf,CAAC;IAEO,OAAO,CAAC,MAAyB;QACvC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACnB,KAAK,MAAM,IAAI,IAAI,MAAM;YAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC;IAChC,CAAC;IAEO,MAAM,CACZ,SAAiB,EACjB,MAA+B,EAC/B,OAA2C,EAC3C,SAA4B,EAC5B,OAA0B,EAC1B,MAAyB,EACzB,MAAe;QAEf,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CACnB,MAAM,CAAC,MAAM,CAAC;YACZ,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;YACnC,SAAS;YACT,MAAM;YACN,OAAO;YACP,cAAc,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,SAAS,CAAC,CAAC;YAC7C,YAAY,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC;YACzC,WAAW,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,GAAG,MAAM,CAAC,CAAC;YACvC,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC;SAC5C,CAAC,CACH,CAAC;IACJ,CAAC;CACF"}

package/lib/enforcement/tool-mask.js

@@ -0,0 +1,52 @@
+/** Quoted names in the registry's refusal of unnameable restriction entries. */
+const QUOTED_NAME = /"([^"]+)"/gu;
+function messageOf(error) {
+    if (error instanceof Error)
+        return error.message;
+    return String(error);
+}
+/**
+ * Install a scoped restriction over the names a QA session may see.
+ *
+ * `restrict()` filters what a scope INHERITS — the global layer and the
+ * ancestor layers, a preset's own tool rows among them. It refuses, with one
+ * error, three different things: a name no layer holds, a name the scope
+ * registers for itself, and an empty list. The QA tool catalog attaches its
+ * tools to the agent itself, so `qa_tools_selfcheck` is exactly the second
+ * case, and a single such entry used to make the registry refuse the whole
+ * call and fail every chat's attestation.
+ *
+ * This function therefore filters the self-registered names out first, and
+ * then gives up whatever the registry still refuses, one round at a time: an
+ * entry the mask cannot name costs that entry, never the session. The caller's
+ * execution guard is unaffected — it keeps enforcing the full policy — so an
+ * entry that never reaches the mask stays callable and denied, not allowed.
+ * @param tools - the agent's scoped registry.
+ * @param allow - names the mask should admit, in policy order.
+ * @param agentLocal - names the QA catalog registers on the agent itself.
+ * @returns the installed mask, plus the names that did not make it in.
+ */
+export function installInheritableMask(tools, allow, agentLocal) {
+    const refused = [];
+    let names = [...new Set(allow)].filter((name) => !agentLocal.has(name));
+    while (names.length > 0) {
+        try {
+            return { dispose: tools.restrict({ allow: names }), refused };
+        }
+        catch (error) {
+            const rejected = new Set([...messageOf(error).matchAll(QUOTED_NAME)].map((match) => match[1]));
+            const next = names.filter((name) => !rejected.has(name));
+            if (next.length === names.length) {
+                // The refusal named nothing this mask carries — an empty list and an
+                // unrecognized failure both land here. Stop instead of looping.
+                refused.push(...names);
+                return { dispose: () => undefined, refused };
+            }
+            refused.push(...names.filter((name) => rejected.has(name)));
+            names = next;
+        }
+    }
+    // Every name was self-registered: the model surface needs no mask.
+    return { dispose: () => undefined, refused };
+}
+//# sourceMappingURL=tool-mask.js.map

package/lib/enforcement/tool-mask.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tool-mask.js","sourceRoot":"","sources":["../../src/enforcement/tool-mask.ts"],"names":[],"mappings":"AAkBA,gFAAgF;AAChF,MAAM,WAAW,GAAG,aAAa,CAAC;AAElC,SAAS,SAAS,CAAC,KAAc;IAC/B,IAAI,KAAK,YAAY,KAAK;QAAE,OAAO,KAAK,CAAC,OAAO,CAAC;IACjD,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;AACvB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,sBAAsB,CACpC,KAAuB,EACvB,KAAwB,EACxB,UAA+B;IAE/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,IAAI,KAAK,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;IAExE,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,IAAI,CAAC;YACH,OAAO,EAAE,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;QAChE,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CACrE,CAAC;YACF,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC;YACzD,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjC,qEAAqE;gBACrE,gEAAgE;gBAChE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,CAAC;gBACvB,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;YAC/C,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAC5D,KAAK,GAAG,IAAI,CAAC;QACf,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC;AAC/C,CAAC"}

package/lib/provenance/extractors.js

@@ -216,6 +216,31 @@ export function createWebSearchExtractor(maxPromotedPerSearch = 5, urlOptions =
         },
     };
 }
+/**
+ * The Host's web tool opens its result with an envelope — `Fetched <url>
+ * (HTTP <code>)`, then the untrusted-content notice — before the page itself.
+ * Both lines are dropped here, and so is a first line that is the page's own
+ * address: the card already prints the target URL, so a snippet drawn from
+ * either of them would only repeat what the reader can already see.
+ */
+const WEB_FETCH_ENVELOPE = /^(?:Fetched\s+\S+\s+\(HTTP\s+\d+\)|External web content follows\..*)$/u;
+function fetchedSnippet(value, uri) {
+    if (value === undefined)
+        return undefined;
+    const target = uri.replace(/\/+$/u, "");
+    const content = value
+        .split(/\r?\n/u)
+        .filter((line) => {
+        const text = line.trim();
+        if (text === "")
+            return true;
+        if (WEB_FETCH_ENVELOPE.test(text))
+            return false;
+        return text.replace(/\/+$/u, "") !== target;
+    })
+        .join("\n");
+    return snippet(content);
+}
 export function createWebFetchExtractor(urlOptions = {}) {
     return {
         id: "dsh-web-fetch",
@@ -239,7 +264,7 @@ export function createWebFetchExtractor(urlOptions = {}) {
                 ? meta.title.trim()
                 : undefined;
             const titleExplicit = explicitTitle !== undefined;
-            const sourceSnippet = snippet(firstText(context.result));
+            const sourceSnippet = fetchedSnippet(firstText(context.result), uri);
             return [
                 {
                     id: `web:${uri}`,

package/lib/provenance/extractors.js.map

@@ -1 +1 @@
-{"version":3,"file":"extractors.js","sourceRoot":"","sources":["../../src/provenance/extractors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAO5E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAIzB,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAuB;QAC1B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,IACE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GACR,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,GAAG;IACH,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,GAAG;IACH,KAAK;IACL,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,KAAK;IACL,OAAO;IACP,IAAI;IACJ,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACxD,OAAO,SAAS,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9D,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,MAAe;IAChC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YACxD,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,IAAI,GAAG,KAAK;QAChB,EAAE,KAAK,CAAC,QAAQ,CAAC;SAChB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACnC,EAAE,IAAI,EAAE,CAAC;IACX,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAoB;IAChD,EAAE,EAAE,eAAe;IACnB,OAAO,CAAC,OAAO;QACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,MAAM;YAC3B,OAAO,CAAC,QAAQ,KAAK,WAAW;YAChC,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,OAAO;QACb,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,OAAO,GACX,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;YAC5B,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClC,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAC7B,CAAC,CAAC,IAAI,CAAC,IAAI;oBACX,CAAC,CAAC,SAAS,CAAC;QACpB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,KAAK;iBACP,GAAG,CAAC,MAAM,CAAC;iBACX,MAAM,CAAC,CAAC,IAAI,EAAyB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,KAAK;aAClB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;aAC1B,MAAM,CACL,CAAC,MAAM,EAAoB,EAAE,CAC3B,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CACrD,CAAC;QACJ,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,aAAa,GAAG,OAAO,CAC3B,KAAK,CAAC,MAAM,GAAG,CAAC;YACd,CAAC,CAAC,KAAK;iBACF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;iBAC/D,IAAI,CAAC,IAAI,CAAC;YACf,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAC9B,CAAC;QACF,OAAO;YACL;gBACE,EAAE,EAAE,QAAQ,IAAI,EAAE;gBAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACrB,IAAI;gBACJ,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;gBAClE,SAAS,EAAE;oBACT;wBACE,IAAI;wBACJ,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;wBACjD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;qBAC9C;iBACF;gBACD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;gBACzB,KAAK,EAAE,GAAG;gBACV,QAAQ,EAAE;oBACR,GAAG,CAAC,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ;wBACtC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;wBACjC,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,IAA+B;IACjD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,OAAO;aACT,GAAG,CAAC,MAAM,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAyB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;QAChE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,oBAAoB,GAAG,CAAC,EACxB,UAAU,GAA0C,EAAE;IAEtD,OAAO;QACL,EAAE,EAAE,gBAAgB;QACpB,OAAO,CAAC,OAAO;YACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,QAAQ,KAAK,YAAY,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,OAAO;YACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAuB,EAAE;gBACnE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;oBAAE,OAAO,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBAClD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAO,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,KAAK,GAAG,oBAAoB,CAAC;gBAC9C,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;oBACxD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;oBACnB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,aAAa,GAAG,aAAa,KAAK,SAAS,CAAC;gBAClD,MAAM,aAAa,GAAG,OAAO,CAC3B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAC5D,CAAC;gBACF,OAAO;oBACL;wBACE,EAAE,EAAE,OAAO,GAAG,EAAE;wBAChB,IAAI,EAAE,KAAK;wBACX,KAAK,EAAE,aAAa,IAAI,kBAAkB,CAAC,GAAG,CAAC;wBAC/C,GAAG;wBACH,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;wBAClE,SAAS,EAAE,EAAE;wBACb,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;wBAC7C,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;wBACzB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;wBACzB,QAAQ,EAAE;4BACR,YAAY,EAAE,IAAI;4BAClB,aAAa;4BACb,GAAG,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;gCACtC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;gCACnC,CAAC,CAAC,EAAE,CAAC;yBACR;qBACF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAU,GAA0C,EAAE;IAEtD,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,OAAO,CAAC,OAAO;YACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,WAAW;gBAChC,CAAC,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CACvE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,OAAO;YACb,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,MAAM,MAAM,GACV,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ;gBAC3B,CAAC,CAAC,IAAI,CAAC,GAAG;gBACV,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;oBAC5B,CAAC,CAAC,IAAI,CAAC,GAAG;oBACV,CAAC,CAAC,SAAS,CAAC;YAClB,MAAM,GAAG,GACP,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACpE,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,aAAa,GACjB,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;gBACzD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;gBACnB,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,aAAa,GAAG,aAAa,KAAK,SAAS,CAAC;YAClD,MAAM,aAAa,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC;YACzD,OAAO;gBACL;oBACE,EAAE,EAAE,OAAO,GAAG,EAAE;oBAChB,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE,aAAa,IAAI,kBAAkB,CAAC,GAAG,CAAC;oBAC/C,GAAG;oBACH,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;oBAClE,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;oBACzB,KAAK,EAAE,GAAG;oBACV,QAAQ,EAAE;wBACR,aAAa;wBACb,GAAG,CAAC,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ;4BACtC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;4BACjC,CAAC,CAAC,EAAE,CAAC;wBACP,GAAG,CAAC,OAAO,IAAI,EAAE,SAAS,KAAK,SAAS;4BACtC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;4BAC/B,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAoB,uBAAuB,EAAE,CAAC;AAE5E,MAAM,CAAC,MAAM,mBAAmB,GAAoB;IAClD,EAAE,EAAE,iBAAiB;IACrB,OAAO,CAAC,OAAO;QACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,OAAO;QACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,EAAuB,EAAE;YAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBACzC,CAAC,CAAC,IAAI,CAAC,OAAO;qBACT,GAAG,CAAC,MAAM,CAAC;qBACX,MAAM,CAAC,CAAC,IAAI,EAAyB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;gBAChE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,OAAO;iBACpB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;iBAC9B,MAAM,CACL,CAAC,MAAM,EAAoB,EAAE,CAC3B,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CACrD,CAAC;YACJ,MAAM,aAAa,GAAG,OAAO,CAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,IACnC,CACrB,CAAC;YACF,OAAO;gBACL;oBACE,EAAE,EAAE,QAAQ,IAAI,EAAE;oBAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;oBACpB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;oBACrB,IAAI;oBACJ,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;oBAClE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;wBACrC,IAAI;wBACJ,SAAS;wBACT,OAAO,EAAE,SAAS;qBACnB,CAAC,CAAC;oBACH,QAAQ,EAAE,YAAY;oBACtB,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;oBACzB,KAAK,EAAE,EAAE;oBACT,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;iBAChC;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,OAAO,uBAAuB;IACjB,UAAU,GAAsB,EAAE,CAAC;IAEpD,QAAQ,CAAC,SAA0B;QACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,GAAG,EAAE;YACV,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,OAA+B;QACrC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3C,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,oCAAoC,CAClD,oBAAoB,GAAG,CAAC,EACxB,UAAU,GAA0C,EAAE;IAEtD,MAAM,QAAQ,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAC/C,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"extractors.js","sourceRoot":"","sources":["../../src/provenance/extractors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAO5E,OAAO,EACL,yBAAyB,EACzB,mBAAmB,EACnB,wBAAwB,GACzB,MAAM,iBAAiB,CAAC;AAIzB,SAAS,MAAM,CAAC,KAAc;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QACzE,CAAC,CAAE,KAAuB;QAC1B,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,UAAU,CAAC,KAAc;IAChC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1D,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,KAAc;IACxC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;IAC7B,IAAI,MAAM,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC3C,IACE,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ;QAC/B,OAAO,MAAM,CAAC,GAAG,KAAK,QAAQ;QAC9B,OAAO,MAAM,CAAC,KAAK,KAAK,QAAQ;QAChC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC;QAC3B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;QAC7B,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,EAC3B,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IACD,KAAK,MAAM,GAAG,IAAI,CAAC,cAAc,EAAE,kBAAkB,EAAE,QAAQ,EAAE,MAAM,CAAC,EAAE,CAAC;QACzE,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,SAAS;YAAE,OAAO,MAAM,CAAC;IAC1C,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QAC5B,MAAM,IAAI,GACR,MAAM,CAAC,QAAQ,KAAK,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACrE,OAAO,GAAG,MAAM,CAAC,QAAQ,GAAG,IAAI,EAAE,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED,MAAM,eAAe,GAAG,IAAI,GAAG,CAAC;IAC9B,GAAG;IACH,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,GAAG;IACH,KAAK;IACL,MAAM;IACN,MAAM;IACN,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,KAAK;IACL,IAAI;IACJ,IAAI;IACJ,IAAI;IACJ,OAAO;IACP,IAAI;IACJ,KAAK;IACL,OAAO;IACP,IAAI;IACJ,KAAK;IACL,KAAK;CACN,CAAC,CAAC;AAEH,SAAS,QAAQ,CAAC,IAAY;IAC5B,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;IACxD,OAAO,SAAS,KAAK,SAAS,IAAI,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC;QAC9D,CAAC,CAAC,MAAM;QACR,CAAC,CAAC,MAAM,CAAC;AACb,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;AACxC,CAAC;AAED,SAAS,SAAS,CAAC,MAAe;IAChC,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7C,KAAK,MAAM,KAAK,IAAI,MAAM,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,CAAC;QAC3B,IAAI,IAAI,EAAE,IAAI,KAAK,MAAM,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;YACxD,OAAO,IAAI,CAAC,IAAI,CAAC;IACrB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,SAAS,OAAO,CAAC,KAAyB;IACxC,MAAM,IAAI,GAAG,KAAK;QAChB,EAAE,KAAK,CAAC,QAAQ,CAAC;SAChB,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;QACnC,EAAE,IAAI,EAAE,CAAC;IACX,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,KAAK,EAAE;QAAE,OAAO,SAAS,CAAC;IACxD,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC3C,OAAO,OAAO,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,GAAG,CAAC;AACvE,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAoB;IAChD,EAAE,EAAE,eAAe;IACnB,OAAO,CAAC,OAAO;QACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,MAAM;YAC3B,OAAO,CAAC,QAAQ,KAAK,WAAW;YAChC,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAC9D,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,OAAO;QACb,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,MAAM,OAAO,GACX,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;YAC5B,CAAC,CAAC,IAAI,CAAC,IAAI;YACX,CAAC,CAAC,OAAO,IAAI,CAAC,SAAS,KAAK,QAAQ;gBAClC,CAAC,CAAC,IAAI,CAAC,SAAS;gBAChB,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;oBAC7B,CAAC,CAAC,IAAI,CAAC,IAAI;oBACX,CAAC,CAAC,SAAS,CAAC;QACpB,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE;YAAE,OAAO,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,yBAAyB,CAAC,OAAO,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;YACtC,CAAC,CAAC,IAAI,CAAC,KAAK;iBACP,GAAG,CAAC,MAAM,CAAC;iBACX,MAAM,CAAC,CAAC,IAAI,EAAyB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;YAChE,CAAC,CAAC,EAAE,CAAC;QACP,MAAM,OAAO,GAAG,KAAK;aAClB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC;aAC1B,MAAM,CACL,CAAC,MAAM,EAAoB,EAAE,CAC3B,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CACrD,CAAC;QACJ,MAAM,SAAS,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACxE,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACtE,MAAM,aAAa,GAAG,OAAO,CAC3B,KAAK,CAAC,MAAM,GAAG,CAAC;YACd,CAAC,CAAC,KAAK;iBACF,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;iBAC/D,IAAI,CAAC,IAAI,CAAC;YACf,CAAC,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAC9B,CAAC;QACF,OAAO;YACL;gBACE,EAAE,EAAE,QAAQ,IAAI,EAAE;gBAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACpB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;gBACrB,IAAI;gBACJ,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;gBAClE,SAAS,EAAE;oBACT;wBACE,IAAI;wBACJ,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,CAAC;wBACjD,GAAG,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;qBAC9C;iBACF;gBACD,QAAQ,EAAE,MAAM;gBAChB,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;gBACzB,KAAK,EAAE,GAAG;gBACV,QAAQ,EAAE;oBACR,GAAG,CAAC,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ;wBACtC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;wBACjC,CAAC,CAAC,EAAE,CAAC;oBACP,GAAG,CAAC,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBAC/D;aACF;SACF,CAAC;IACJ,CAAC;CACF,CAAC;AAEF,SAAS,UAAU,CAAC,IAA+B;IACjD,OAAO,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;QACjC,CAAC,CAAC,IAAI,CAAC,OAAO;aACT,GAAG,CAAC,MAAM,CAAC;aACX,MAAM,CAAC,CAAC,IAAI,EAAyB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;QAChE,CAAC,CAAC,EAAE,CAAC;AACT,CAAC;AAED,MAAM,UAAU,wBAAwB,CACtC,oBAAoB,GAAG,CAAC,EACxB,UAAU,GAA0C,EAAE;IAEtD,OAAO;QACL,EAAE,EAAE,gBAAgB;QACpB,OAAO,CAAC,OAAO;YACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,OAAO,OAAO,CAAC,QAAQ,KAAK,YAAY,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;QAC1E,CAAC;QACD,OAAO,CAAC,OAAO;YACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAuB,EAAE;gBACnE,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;oBAAE,OAAO,EAAE,CAAC;gBAC5C,MAAM,GAAG,GAAG,eAAe,CAAC,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC;gBAClD,IAAI,GAAG,KAAK,IAAI;oBAAE,OAAO,EAAE,CAAC;gBAC5B,MAAM,QAAQ,GAAG,KAAK,GAAG,oBAAoB,CAAC;gBAC9C,MAAM,aAAa,GACjB,OAAO,IAAI,CAAC,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;oBACxD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;oBACnB,CAAC,CAAC,SAAS,CAAC;gBAChB,MAAM,aAAa,GAAG,aAAa,KAAK,SAAS,CAAC;gBAClD,MAAM,aAAa,GAAG,OAAO,CAC3B,OAAO,IAAI,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAC5D,CAAC;gBACF,OAAO;oBACL;wBACE,EAAE,EAAE,OAAO,GAAG,EAAE;wBAChB,IAAI,EAAE,KAAK;wBACX,KAAK,EAAE,aAAa,IAAI,kBAAkB,CAAC,GAAG,CAAC;wBAC/C,GAAG;wBACH,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;wBAClE,SAAS,EAAE,EAAE;wBACb,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY;wBAC7C,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;wBACzB,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE;wBACzB,QAAQ,EAAE;4BACR,YAAY,EAAE,IAAI;4BAClB,aAAa;4BACb,GAAG,CAAC,OAAO,IAAI,CAAC,WAAW,KAAK,QAAQ;gCACtC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,WAAW,EAAE;gCACnC,CAAC,CAAC,EAAE,CAAC;yBACR;qBACF;iBACF,CAAC;YACJ,CAAC,CAAC,CAAC;QACL,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,kBAAkB,GACtB,wEAAwE,CAAC;AAE3E,SAAS,cAAc,CACrB,KAAyB,EACzB,GAAW;IAEX,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IAC1C,MAAM,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,KAAK;SAClB,KAAK,CAAC,QAAQ,CAAC;SACf,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE;QACf,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;QACzB,IAAI,IAAI,KAAK,EAAE;YAAE,OAAO,IAAI,CAAC;QAC7B,IAAI,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,KAAK,CAAC;QAChD,OAAO,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,KAAK,MAAM,CAAC;IAC9C,CAAC,CAAC;SACD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,uBAAuB,CACrC,UAAU,GAA0C,EAAE;IAEtD,OAAO;QACL,EAAE,EAAE,eAAe;QACnB,OAAO,CAAC,OAAO;YACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,OAAO,CACL,OAAO,CAAC,QAAQ,KAAK,WAAW;gBAChC,CAAC,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,CAAC,CACvE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,OAAO;YACb,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACtC,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACtD,MAAM,MAAM,GACV,OAAO,IAAI,EAAE,GAAG,KAAK,QAAQ;gBAC3B,CAAC,CAAC,IAAI,CAAC,GAAG;gBACV,CAAC,CAAC,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ;oBAC5B,CAAC,CAAC,IAAI,CAAC,GAAG;oBACV,CAAC,CAAC,SAAS,CAAC;YAClB,MAAM,GAAG,GACP,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;YACpE,IAAI,GAAG,KAAK,IAAI;gBAAE,OAAO,EAAE,CAAC;YAC5B,MAAM,aAAa,GACjB,OAAO,IAAI,EAAE,KAAK,KAAK,QAAQ,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE;gBACzD,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE;gBACnB,CAAC,CAAC,SAAS,CAAC;YAChB,MAAM,aAAa,GAAG,aAAa,KAAK,SAAS,CAAC;YAClD,MAAM,aAAa,GAAG,cAAc,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,GAAG,CAAC,CAAC;YACrE,OAAO;gBACL;oBACE,EAAE,EAAE,OAAO,GAAG,EAAE;oBAChB,IAAI,EAAE,KAAK;oBACX,KAAK,EAAE,aAAa,IAAI,kBAAkB,CAAC,GAAG,CAAC;oBAC/C,GAAG;oBACH,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;oBAClE,SAAS,EAAE,EAAE;oBACb,QAAQ,EAAE,SAAS;oBACnB,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;oBACzB,KAAK,EAAE,GAAG;oBACV,QAAQ,EAAE;wBACR,aAAa;wBACb,GAAG,CAAC,OAAO,IAAI,EAAE,UAAU,KAAK,QAAQ;4BACtC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE;4BACjC,CAAC,CAAC,EAAE,CAAC;wBACP,GAAG,CAAC,OAAO,IAAI,EAAE,SAAS,KAAK,SAAS;4BACtC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE;4BAC/B,CAAC,CAAC,EAAE,CAAC;qBACR;iBACF;aACF,CAAC;QACJ,CAAC;KACF,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAoB,uBAAuB,EAAE,CAAC;AAE5E,MAAM,CAAC,MAAM,mBAAmB,GAAoB;IAClD,EAAE,EAAE,iBAAiB;IACrB,OAAO,CAAC,OAAO;QACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,OAAO,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,OAAO;QACb,MAAM,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;QACtD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAC3C,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,SAAS,EAAuB,EAAE;YAC3D,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;YAC/B,IAAI,OAAO,IAAI,EAAE,IAAI,KAAK,QAAQ;gBAAE,OAAO,EAAE,CAAC;YAC9C,MAAM,IAAI,GAAG,yBAAyB,CAAC,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,aAAa,CAAC,CAAC;YACzE,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;gBACzC,CAAC,CAAC,IAAI,CAAC,OAAO;qBACT,GAAG,CAAC,MAAM,CAAC;qBACX,MAAM,CAAC,CAAC,IAAI,EAAyB,EAAE,CAAC,IAAI,KAAK,SAAS,CAAC;gBAChE,CAAC,CAAC,EAAE,CAAC;YACP,MAAM,OAAO,GAAG,OAAO;iBACpB,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC;iBAC9B,MAAM,CACL,CAAC,MAAM,EAAoB,EAAE,CAC3B,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,CACrD,CAAC;YACJ,MAAM,aAAa,GAAG,OAAO,CAC3B,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,EAAE,IACnC,CACrB,CAAC;YACF,OAAO;gBACL;oBACE,EAAE,EAAE,QAAQ,IAAI,EAAE;oBAClB,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC;oBACpB,KAAK,EAAE,QAAQ,CAAC,IAAI,CAAC;oBACrB,IAAI;oBACJ,GAAG,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,aAAa,EAAE,CAAC;oBAClE,SAAS,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;wBACrC,IAAI;wBACJ,SAAS;wBACT,OAAO,EAAE,SAAS;qBACnB,CAAC,CAAC;oBACH,QAAQ,EAAE,YAAY;oBACtB,OAAO,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC;oBACzB,KAAK,EAAE,EAAE;oBACT,QAAQ,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE;iBAChC;aACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;CACF,CAAC;AAEF,MAAM,OAAO,uBAAuB;IACjB,UAAU,GAAsB,EAAE,CAAC;IAEpD,QAAQ,CAAC,SAA0B;QACjC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;QAChC,OAAO,GAAG,EAAE;YACV,MAAM,KAAK,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,KAAK,KAAK,CAAC,CAAC;gBAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;QACrD,CAAC,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,OAA+B;QACrC,OAAO,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE,CAC3C,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAClE,CAAC;IACJ,CAAC;CACF;AAED,MAAM,UAAU,oCAAoC,CAClD,oBAAoB,GAAG,CAAC,EACxB,UAAU,GAA0C,EAAE;IAEtD,MAAM,QAAQ,GAAG,IAAI,uBAAuB,EAAE,CAAC;IAC/C,6EAA6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,iBAAiB,CAAC,CAAC;IACrC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC,UAAU,CAAC,CAAC,CAAC;IACvD,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,CAAC,oBAAoB,EAAE,UAAU,CAAC,CAAC,CAAC;IAC9E,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,CAAC;IACvC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC,UAAU,CAAC,CAAC,CAAC;IACnD,QAAQ,CAAC,QAAQ,CAAC,yBAAyB,CAAC,UAAU,CAAC,CAAC,CAAC;IACzD,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,CAAC,UAAU,CAAC,CAAC,CAAC;IACxD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/lib/secure-session.js

@@ -6,6 +6,7 @@ import { QaAccountsError } from "./accounts/store.js";
 import { QaAttestationError } from "./attestation.js";
 import { qaToolDenial, qaToolPolicyPlan } from "./lockdown-policy.js";
 import { installQaSkillPolicy } from "./enforcement/skill-policy.js";
+import { installInheritableMask } from "./enforcement/tool-mask.js";
 import { QA_REPORT_SOURCES_TOOL } from "./provenance/host-store.js";
 import { qaUserWorkspaceDenial } from "./user-workspace.js";
 /** Grace period in which a fresh session may still be pinned to the QA preset. */
@@ -305,7 +306,7 @@ export class QaPolicyAdmission {
             try {
                 disposeTools =
                     grants === undefined
-                        ? agent.ctx.tools.restrict({ allow: policy.allow })
+                        ? this.maskAgentTools(agent, policy.allow, sessionId)
                         : () => grants.dispose();
                 disposeGuard = agent.ctx.tools.guard((execution) => {
                     const subject = execution.agent;
@@ -385,11 +386,34 @@ export class QaPolicyAdmission {
             approvalIsNever,
             permissionPreset: lockdown.permissionPreset,
             toolPolicyLoaded: true,
-            // The fallback reporter is an internal read-only provenance capability,
-            // not an operator-configured QA tool grant.
-            toolAllowList: capability?.policy.tools ?? lockdown.toolPolicy.allow,
+            // The deployment's pinned list, not this session's effective one: the
+            // browser answers this proof against the lockdown config it holds, and a
+            // subrole narrows that list — or the plugin adds its own internals to it —
+            // without changing the config either side treats as the contract.
+            toolAllowList: lockdown.toolPolicy.allow,
         };
     }
+    /**
+     * Mask one agent down to the policy's tool names, for the account-free path
+     * (a capability policy installs its own mask through its grants).
+     *
+     * The mask admits what the scope inherits — the global layer and the ancestor
+     * layers, which is where a preset's own tool rows live — and skips the names
+     * the QA catalog registers on the agent, since a restriction cannot name
+     * those. A name that is neither, or that the registry refuses for any other
+     * reason, is left out of the mask and reported instead of failing the chat:
+     * the guard below still denies it, so the effective set is unchanged.
+     */
+    maskAgentTools(agent, allow, sessionId) {
+        const mask = installInheritableMask(agent.ctx.tools, allow, new Set(this.knownDynamicToolNames()));
+        if (mask.refused.length > 0) {
+            this.logger.warn("lockdown.tool-mask-incomplete", {
+                sessionId,
+                dropped: mask.refused,
+            });
+        }
+        return mask.dispose;
+    }
     /** Resolve the deployment facts shared by creation and full attestation. */
     deploymentPins(config) {
         if (!config.lockdown.enabled)

package/lib/secure-session.js.map

@@ -1 +1 @@
-{"version":3,"file":"secure-session.js","sourceRoot":"","sources":["../src/secure-session.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAiC5D,kFAAkF;AAClF,MAAM,iCAAiC,GAAG,OAAO,CAAC;AAElD;;;;GAIG;AACH,SAAS,UAAU,CAAC,SAA6B,EAAE,MAAc;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAcT,GAAG;IACH,MAAM;IACN,MAAM;IACN,QAAQ;IAMR,gBAAgB;IAIhB,gBAAgB;IAMhB,qBAAqB;IAhCvB,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnE,gFAAgF;IAC/D,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1D;;;;OAIG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,qBAAqB,CAAa;IAEnD,YACmB,GAAY,EACZ,MAAqC,EACrC,MAAoB,EACpB,QAAyB;IAC1C;;;;OAIG;IACc,gBAAgB,GAER,GAAG,EAAE,CAAC,EAAE;IACjC,8EAA8E;IAC7D,gBAIgC;IACjD,0EAA0E;IACzD,qBAAqB,GAA4B,GAAG,EAAE,CAAC,EAAE;mBAnBzD,GAAG;sBACH,MAAM;sBACN,MAAM;wBACN,QAAQ;gCAMR,gBAAgB;gCAIhB,gBAAgB;qCAMhB,qBAAqB;QAEtC,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;YACzD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;YACzC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,OAAO,sEAAsE,CAAC;YAChF,CAAC;YACD,OAAO,qBAAqB,CAC1B,SAAS,EACT,MAAM,CAAC,IAAI,EACX,IAAI,CAAC,cAAc,EAAE,EACrB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,4BAA4B,CAAC,KAAwB;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,GAAG,EAAE;YACV,KAAK,MAAM,IAAI,IAAI,UAAU;gBAAE,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,cAAc;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CACC,CAAC;QAC1C,OAAO,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,SAAS,CAAC,SAAiB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAC5D,SAAS,CAAC,SAAS,CAAC,CACrB,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,YAAiD,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,kBAAkB,CAC1B,KAAK,CAAC,MAAM,KAAK,yBAAyB;wBACxC,CAAC,CAAC,yBAAyB;wBAC3B,CAAC,CAAC,eAAe,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,KAAK;gBACzB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,KAAK;gBACvB,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,IAAI,gBAAoC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACrC,IAAI,YAAY,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAC7C,YAAY,CAAC,EAAE,EACf,eAAe,CAAC,IAAI,CACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,uBAAuB;YACjC,cAAc,KAAK,IAAI;YACvB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;QAErE,MAAM,gBAAgB,GACpB,CAAC,QAAQ,CAAC,qBAAqB;YAC/B,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YAC3D,CAAC,gBAAgB,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB;gBAChC,eAAe,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC,iBAAiB,KAAK,IAAI;gBACzB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;gBAC3B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAErB,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;YAChC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ;gBAC3C,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK;gBACtC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;oBACtC,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,EACtB,+BAA+B,kBAAkB,cAAc,gBAAgB,UAAU,YAAY,EAAE,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAW,CAAC;QAEpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,oEAAoE;QACpE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,cAAc,CAC7D,CAAC;QACF,IACE,iBAAiB,KAAK,QAAQ,CAAC,gBAAgB;YAC/C,CAAC,cAAc;gBACb,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;oBACzC,iCAAiC,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,iEAAiE;QACjE,0EAA0E;QAC1E,uBAAuB;QACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAE1E,MAAM,eAAe,GACnB,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QACxD,MAAM,qBAAqB,GACzB,MAAM,CAAC,OAAO,CAAC,OAAO;YACtB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;YACjD,CAAC,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC/C,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,sBAAsB,CAAC;YAC9C,CAAC,CAAC,eAAe,CAAC;QACtB,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,WAAW,GAAG;YAClB,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,qBAAqB;gBACxB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;SACH,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,WAAW,EACX,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,SAAS;YACjD,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAClD,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,uBAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM,CAAC,KAAK;YACZ,UAAU,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC/B,UAAU,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,wEAAwE;YACxE,sEAAsE;YACtE,2BAA2B;YAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,YAAY,EAAE,CAAC;YAC1C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,kBAAkB,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YACrD,IAAI,CAAC;gBACH,YAAY;oBACV,MAAM,KAAK,SAAS;wBAClB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;wBACnD,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACjD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;oBAChC,OAAO,YAAY,CACjB,MAAM,EAAE,cAAc,EAAE,IAAI,OAAO,EACnC,SAAS,CAAC,IAAI,EACd,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;wBAC/C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;wBAChC,CAAC,CAAC,EAAE,CACP,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,uEAAuE;gBACvE,gEAAgE;gBAChE,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBAC5B,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACrD,kBAAkB,GAAG,oBAAoB,CAAC;wBACxC,KAAK;wBACL,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,UAAU,EAAE,UAAU,CAAC,MAAM;wBAC7B,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,OAAO,EAAE,UAAU,CAAC,YAAY;qBACjC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE;oBAC9B,WAAW;oBACX,YAAY;oBACZ,YAAY;oBACZ,kBAAkB;iBACnB,CAAC,CAAC;gBACH,KAAK,EAAE,YAAY,EAAE,CAAC;gBACtB,KAAK,EAAE,YAAY,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,kBAAkB,EAAE,CAAC;gBACrB,YAAY,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC5D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW,CAAC;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC;QACxD,IACE,mBAAmB,KAAK,QAAQ,CAAC,gBAAgB;YACjD,CAAC,kBAAkB;YACnB,CAAC,eAAe,EAChB,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE;oBAClC,IAAI,EAAE,gBAAgB;oBACtB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;iBAClD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,gDAAgD;gBAChD,aAAa,CAAC,IAAI,GAAG,gBAAgB,CAAC;gBACtC,aAAa,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACrC,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,aAAa,EAAE,MAAM,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,SAAS;YACT,OAAO,EAAE,IAAI;YACb,kBAAkB;YAClB,gBAAgB;YAChB,YAAY;YACZ,kBAAkB;YAClB,eAAe;YACf,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,gBAAgB,EAAE,IAAI;YACtB,wEAAwE;YACxE,4CAA4C;YAC5C,aAAa,EAAE,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK;SACrE,CAAC;IACJ,CAAC;IAED,4EAA4E;IACpE,cAAc,CAAC,MAA+B;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAExC,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GACnB,iBAAiB,KAAK,IAAI;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrE,IAAI,iBAAiB,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,aAAa,iBAAiB,oBAAoB,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,UAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC7C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClI,CAAC;QACJ,CAAC;QACD,IACE,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW;YAClD,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,cAAc,EACtD,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,wBAAwB,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAC7I,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,UAAU,EAAE;YAChB,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;CACF"}
+{"version":3,"file":"secure-session.js","sourceRoot":"","sources":["../src/secure-session.ts"],"names":[],"mappings":"AAEA,8EAA8E;AAC9E,sEAAsE;AACtE,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AAC3D,OAAO,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAEzD,OAAO,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAEtE,OAAO,EAAE,oBAAoB,EAAE,MAAM,+BAA+B,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AACpE,OAAO,EAAE,sBAAsB,EAAE,MAAM,4BAA4B,CAAC;AAEpE,OAAO,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAiC5D,kFAAkF;AAClF,MAAM,iCAAiC,GAAG,OAAO,CAAC;AAElD;;;;GAIG;AACH,SAAS,UAAU,CAAC,SAA6B,EAAE,MAAc;IAC/D,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IAC1C,MAAM,SAAS,GAAG,CAAC,KAAa,EAAE,EAAE,CAClC,KAAK,CAAC,UAAU,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,SAAS,CAAC,SAAS,CAAC,CAAC;IAClC,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,EAAE;QAC5C,CAAC,CAAC,IAAI,KAAK,KAAK,CAAC;AACrB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,iBAAiB;IAcT,GAAG;IACH,MAAM;IACN,MAAM;IACN,QAAQ;IAMR,gBAAgB;IAIhB,gBAAgB;IAMhB,qBAAqB;IAhCvB,eAAe,GAAG,IAAI,GAAG,EAAwB,CAAC;IACnE,gFAAgF;IAC/D,oBAAoB,GAAG,IAAI,GAAG,EAAU,CAAC;IAC1D;;;;OAIG;IACc,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAC;IAC7B,eAAe,GAAG,IAAI,GAAG,EAA+B,CAAC;IACzD,qBAAqB,CAAa;IAEnD,YACmB,GAAY,EACZ,MAAqC,EACrC,MAAoB,EACpB,QAAyB;IAC1C;;;;OAIG;IACc,gBAAgB,GAER,GAAG,EAAE,CAAC,EAAE;IACjC,8EAA8E;IAC7D,gBAIgC;IACjD,0EAA0E;IACzD,qBAAqB,GAA4B,GAAG,EAAE,CAAC,EAAE;mBAnBzD,GAAG;sBACH,MAAM;sBACN,MAAM;wBACN,QAAQ;gCAMR,gBAAgB;gCAIhB,gBAAgB;qCAMhB,qBAAqB;QAEtC,IAAI,CAAC,qBAAqB,GAAG,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;YACzD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC;YACzC,IAAI,OAAO,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YAC5D,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO,SAAS,CAAC;YAC3C,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;gBACjD,OAAO,sEAAsE,CAAC;YAChF,CAAC;YACD,OAAO,qBAAqB,CAC1B,SAAS,EACT,MAAM,CAAC,IAAI,EACX,IAAI,CAAC,cAAc,EAAE,EACrB,MAAM,CACP,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,iBAAiB,EAAE,CAAC,OAAO,EAAE,EAAE;YACpC,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,aAAa,CAAC;YAC5C,IAAI,MAAM,KAAK,SAAS;gBAAE,OAAO;YACjC,MAAM,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;YACxD,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;gBACzB,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC;YACvD,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,gBAAgB,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,EAAE;YACrC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACnC,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;QACxD,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,4BAA4B,CAAC,KAAwB;QACnD,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACpE,KAAK,MAAM,IAAI,IAAI,UAAU;YAAE,IAAI,CAAC,oBAAoB,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QACnE,OAAO,GAAG,EAAE;YACV,KAAK,MAAM,IAAI,IAAI,UAAU;gBAAE,IAAI,CAAC,oBAAoB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxE,CAAC,CAAC;IACJ,CAAC;IAED;;;;;OAKG;IACH,mBAAmB;QACjB,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;IACrC,CAAC;IAED;;;;;;;OAOG;IACH,cAAc;QACZ,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,aAAa,CACC,CAAC;QAC1C,OAAO,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;IAClE,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACK,KAAK,CAAC,SAAS,CAAC,SAAiB;QACvC,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,CAAC;QACvD,IAAI,IAAI,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,YAAY,CAC5D,SAAS,CAAC,SAAS,CAAC,CACrB,CAAC;YACF,IAAI,CAAC,CAAC,OAAO,IAAI,QAAQ,CAAC;gBAAE,OAAO,QAAQ,CAAC,KAAK,CAAC;YAClD,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;aAC9B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,wEAAwE;YACxE,oEAAoE;YACpE,wEAAwE;YACxE,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,gCAAgC,EAAE;gBAClD,SAAS;gBACT,KAAK,EAAE,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QACD,MAAM,IAAI,kBAAkB,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CAAC;IAC5E,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,KAAa,EACb,SAAiB;QAEjB,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;QACjC,uEAAuE;QACvE,0EAA0E;QAC1E,wEAAwE;QACxE,sEAAsE;QACtE,IAAI,YAAiD,CAAC;QACtD,IAAI,IAAI,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,oBAAoB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;YACtE,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,IAAI,KAAK,YAAY,eAAe,EAAE,CAAC;oBACrC,MAAM,IAAI,kBAAkB,CAC1B,KAAK,CAAC,MAAM,KAAK,yBAAyB;wBACxC,CAAC,CAAC,yBAAyB;wBAC3B,CAAC,CAAC,eAAe,EACnB,KAAK,CAAC,OAAO,CACd,CAAC;gBACJ,CAAC;gBACD,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;QAC9C,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC;QACzC,IAAI,CAAC,QAAQ,CAAC,OAAO,EAAE,CAAC;YACtB,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC7B,OAAO;gBACL,SAAS;gBACT,OAAO,EAAE,KAAK;gBACd,kBAAkB,EAAE,IAAI;gBACxB,gBAAgB,EAAE,IAAI;gBACtB,YAAY,EAAE,IAAI;gBAClB,kBAAkB,EAAE,KAAK;gBACzB,eAAe,EAAE,KAAK;gBACtB,gBAAgB,EAAE,EAAE;gBACpB,gBAAgB,EAAE,KAAK;gBACvB,aAAa,EAAE,EAAE;aAClB,CAAC;QACJ,CAAC;QAED,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GAAG,IAAI,CAAC,eAAe,CAAC;QAC7C,IAAI,gBAAoC,CAAC;QACzC,IAAI,MAAM,CAAC,QAAQ,CAAC,gBAAgB,EAAE,CAAC;YACrC,IAAI,YAAY,KAAK,SAAS,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;gBAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,4CAA4C,CAC7C,CAAC;YACJ,CAAC;YACD,IAAI,CAAC;gBACH,gBAAgB,GAAG,IAAI,CAAC,QAAQ,EAAE,aAAa,CAC7C,YAAY,CAAC,EAAE,EACf,eAAe,CAAC,IAAI,CACrB,CAAC;YACJ,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CACvD,CAAC;YACJ,CAAC;QACH,CAAC;QAED,MAAM,cAAc,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QAClD,MAAM,kBAAkB,GACtB,CAAC,QAAQ,CAAC,uBAAuB;YACjC,cAAc,KAAK,IAAI;YACvB,IAAI,CAAC,GAAG,CAAC,YAAY,CAAC,cAAc,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,cAAc,CAAC;QAErE,MAAM,gBAAgB,GACpB,CAAC,QAAQ,CAAC,qBAAqB;YAC/B,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;YAC3D,CAAC,gBAAgB,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,gBAAgB,CAAC,CAAC;YACzD,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,gBAAgB;gBAChC,eAAe,KAAK,SAAS;gBAC7B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,eAAe,CAAC,IAAI,CAAC,CAAC;YAC7D,CAAC,iBAAiB,KAAK,IAAI;gBACzB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,IAAI;gBAC3B,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QAE9D,MAAM,OAAO,GAAG,KAAK,CAAC,OAErB,CAAC;QACF,MAAM,YAAY,GAChB,CAAC,QAAQ,CAAC,iBAAiB;YAC3B,MAAM,CAAC,OAAO,CAAC,QAAQ,KAAK,IAAI;YAChC,CAAC,OAAO,CAAC,QAAQ,KAAK,MAAM,CAAC,OAAO,CAAC,QAAQ;gBAC3C,OAAO,CAAC,KAAK,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK;gBACtC,CAAC,MAAM,CAAC,OAAO,CAAC,eAAe,KAAK,IAAI;oBACtC,OAAO,CAAC,eAAe,KAAK,MAAM,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC,CAAC;QAEnE,IAAI,CAAC,kBAAkB,IAAI,CAAC,gBAAgB,IAAI,CAAC,YAAY,EAAE,CAAC;YAC9D,MAAM,IAAI,kBAAkB,CAC1B,sBAAsB,EACtB,+BAA+B,kBAAkB,cAAc,gBAAgB,UAAU,YAAY,EAAE,CACxG,CAAC;QACJ,CAAC;QAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAW,CAAC;QAEpC,MAAM,iBAAiB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5E,oEAAoE;QACpE,yEAAyE;QACzE,qBAAqB;QACrB,MAAM,cAAc,GAAG,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CACrD,CAAC,GAAG,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,IAAI,KAAK,cAAc,CAC7D,CAAC;QACF,IACE,iBAAiB,KAAK,QAAQ,CAAC,gBAAgB;YAC/C,CAAC,cAAc;gBACb,IAAI,CAAC,GAAG,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,SAAS;oBACzC,iCAAiC,CAAC,EACtC,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,kBAAkB,EAClB,2CAA2C,CAC5C,CAAC;QACJ,CAAC;QAED,kEAAkE;QAClE,iEAAiE;QACjE,0EAA0E;QAC1E,uBAAuB;QACvB,MAAM,UAAU,GAAG,MAAM,IAAI,CAAC,gBAAgB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,KAAK,CAAC,CAAC;QAE1E,MAAM,eAAe,GACnB,UAAU,EAAE,MAAM,CAAC,KAAK,IAAI,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC;QACxD,MAAM,qBAAqB,GACzB,MAAM,CAAC,OAAO,CAAC,OAAO;YACtB,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB;YACjD,CAAC,eAAe,CAAC,QAAQ,CAAC,sBAAsB,CAAC;YAC/C,CAAC,CAAC,CAAC,GAAG,eAAe,EAAE,sBAAsB,CAAC;YAC9C,CAAC,CAAC,eAAe,CAAC;QACtB,wEAAwE;QACxE,2EAA2E;QAC3E,sEAAsE;QACtE,gCAAgC;QAChC,MAAM,WAAW,GAAG;YAClB,GAAG,IAAI,GAAG,CAAC;gBACT,GAAG,qBAAqB;gBACxB,GAAG,CAAC,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,CAAC,EAAE,CAAC;aAC/D,CAAC;SACH,CAAC;QACF,MAAM,MAAM,GAAG,gBAAgB,CAC7B,WAAW,EACX,CAAC,QAAQ,EAAE,EAAE,CACX,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,SAAS;YACjD,IAAI,CAAC,qBAAqB,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAClD,CAAC;QACF,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,kBAAkB,CAC1B,eAAe,EACf,uBAAuB,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CACnD,CAAC;QACJ,CAAC;QACD,MAAM,WAAW,GAAG,IAAI,CAAC,SAAS,CAAC;YACjC,MAAM,CAAC,KAAK;YACZ,UAAU,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;YAC/B,UAAU,EAAE,MAAM,CAAC,cAAc,IAAI,EAAE;SACxC,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9C,IAAI,KAAK,EAAE,WAAW,KAAK,WAAW,EAAE,CAAC;YACvC,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACtC,wEAAwE;YACxE,sEAAsE;YACtE,2BAA2B;YAC3B,MAAM,MAAM,GAAG,UAAU,EAAE,YAAY,EAAE,CAAC;YAC1C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,YAAY,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YAC/C,IAAI,kBAAkB,GAAe,GAAG,EAAE,CAAC,SAAS,CAAC;YACrD,IAAI,CAAC;gBACH,YAAY;oBACV,MAAM,KAAK,SAAS;wBAClB,CAAC,CAAC,IAAI,CAAC,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC;wBACrD,CAAC,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC;gBAC7B,YAAY,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,SAAS,EAAE,EAAE;oBACjD,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC;oBAChC,OAAO,YAAY,CACjB,MAAM,EAAE,cAAc,EAAE,IAAI,OAAO,EACnC,SAAS,CAAC,IAAI,EACd,UAAU,KAAK,SAAS,IAAI,OAAO,KAAK,SAAS;wBAC/C,CAAC,CAAC,IAAI,CAAC,gBAAgB,CAAC,OAAO,CAAC;wBAChC,CAAC,CAAC,EAAE,CACP,CAAC;gBACJ,CAAC,CAAC,CAAC;gBACH,uEAAuE;gBACvE,gEAAgE;gBAChE,KAAK,EAAE,kBAAkB,EAAE,CAAC;gBAC5B,IAAI,UAAU,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;oBACrD,kBAAkB,GAAG,oBAAoB,CAAC;wBACxC,KAAK;wBACL,MAAM,EAAE,UAAU,CAAC,MAAM;wBACzB,UAAU,EAAE,UAAU,CAAC,MAAM;wBAC7B,MAAM;wBACN,MAAM,EAAE,IAAI,CAAC,MAAM;wBACnB,OAAO,EAAE,UAAU,CAAC,YAAY;qBACjC,CAAC,CAAC;gBACL,CAAC;gBACD,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,KAAK,EAAE;oBAC9B,WAAW;oBACX,YAAY;oBACZ,YAAY;oBACZ,kBAAkB;iBACnB,CAAC,CAAC;gBACH,KAAK,EAAE,YAAY,EAAE,CAAC;gBACtB,KAAK,EAAE,YAAY,EAAE,CAAC;YACxB,CAAC;YAAC,OAAO,KAAK,EAAE,CAAC;gBACf,kBAAkB,EAAE,CAAC;gBACrB,YAAY,EAAE,CAAC;gBACf,YAAY,EAAE,CAAC;gBACf,MAAM,KAAK,CAAC;YACd,CAAC;QACH,CAAC;QAED,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,gBAAgB,CAAC,CAAC;QACzE,MAAM,mBAAmB,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC5D,KAAK,CAAC,OAAO,CACd,CAAC;QACF,MAAM,kBAAkB,GAAG,UAAU,CAAC,OAAO,KAAK,QAAQ,CAAC,WAAW,CAAC;QACvE,MAAM,eAAe,GAAG,UAAU,CAAC,QAAQ,KAAK,OAAO,CAAC;QACxD,IACE,mBAAmB,KAAK,QAAQ,CAAC,gBAAgB;YACjD,CAAC,kBAAkB;YACnB,CAAC,eAAe,EAChB,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,oBAAoB,EACpB,+BAA+B,CAChC,CAAC;QACJ,CAAC;QACD,IAAI,gBAAgB,KAAK,SAAS,EAAE,CAAC;YACnC,MAAM,aAAa,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC1D,IAAI,aAAa,KAAK,SAAS,EAAE,CAAC;gBAChC,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,SAAS,EAAE;oBAClC,IAAI,EAAE,gBAAgB;oBACtB,mBAAmB,EAAE,QAAQ,CAAC,mBAAmB;iBAClD,CAAC,CAAC;YACL,CAAC;iBAAM,CAAC;gBACN,qEAAqE;gBACrE,gDAAgD;gBAChD,aAAa,CAAC,IAAI,GAAG,gBAAgB,CAAC;gBACtC,aAAa,CAAC,mBAAmB,GAAG,QAAQ,CAAC,mBAAmB,CAAC;YACnE,CAAC;QACH,CAAC;aAAM,CAAC;YACN,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;QACzC,CAAC;QAED,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC7B,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,mBAAmB,EAAE;YACrC,SAAS;YACT,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,aAAa,EAAE,MAAM,CAAC,KAAK;SAC5B,CAAC,CAAC;QACH,OAAO;YACL,SAAS;YACT,OAAO,EAAE,IAAI;YACb,kBAAkB;YAClB,gBAAgB;YAChB,YAAY;YACZ,kBAAkB;YAClB,eAAe;YACf,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,gBAAgB,EAAE,IAAI;YACtB,sEAAsE;YACtE,yEAAyE;YACzE,2EAA2E;YAC3E,kEAAkE;YAClE,aAAa,EAAE,QAAQ,CAAC,UAAU,CAAC,KAAK;SACzC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;OAUG;IACK,cAAc,CACpB,KAAY,EACZ,KAAwB,EACxB,SAAiB;QAEjB,MAAM,IAAI,GAAG,sBAAsB,CACjC,KAAK,CAAC,GAAG,CAAC,KAAK,EACf,KAAK,EACL,IAAI,GAAG,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC,CACtC,CAAC;QACF,IAAI,IAAI,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC5B,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAAE;gBAChD,SAAS;gBACT,OAAO,EAAE,IAAI,CAAC,OAAO;aACtB,CAAC,CAAC;QACL,CAAC;QACD,OAAO,IAAI,CAAC,OAAO,CAAC;IACtB,CAAC;IAED,4EAA4E;IACpE,cAAc,CAAC,MAA+B;QACpD,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,OAAO;YAAE,OAAO,EAAE,CAAC;QAExC,MAAM,iBAAiB,GAAG,MAAM,CAAC,OAAO,CAAC,WAAW,CAAC;QACrD,MAAM,eAAe,GACnB,iBAAiB,KAAK,IAAI;YACxB,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,GAAG,CAAC,WAAW,CAAC,iBAAiB,CAAC,CAAC,CAAC;QACrE,IAAI,iBAAiB,KAAK,IAAI,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAChE,MAAM,IAAI,kBAAkB,CAC1B,uBAAuB,EACvB,aAAa,iBAAiB,oBAAoB,CACnD,CAAC;QACJ,CAAC;QAED,IAAI,UAA0C,CAAC;QAC/C,IAAI,CAAC;YACH,UAAU,GAAG,IAAI,CAAC,GAAG,CAAC,iBAAiB,CAAC,OAAO,CAC7C,MAAM,CAAC,QAAQ,CAAC,gBAAgB,CACjC,CAAC;QACJ,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,oBAAoB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAClI,CAAC;QACJ,CAAC;QACD,IACE,UAAU,CAAC,OAAO,KAAK,MAAM,CAAC,QAAQ,CAAC,WAAW;YAClD,UAAU,CAAC,QAAQ,KAAK,MAAM,CAAC,QAAQ,CAAC,cAAc,EACtD,CAAC;YACD,MAAM,IAAI,kBAAkB,CAC1B,mBAAmB,EACnB,qBAAqB,MAAM,CAAC,QAAQ,CAAC,gBAAgB,wBAAwB,MAAM,CAAC,QAAQ,CAAC,WAAW,IAAI,MAAM,CAAC,QAAQ,CAAC,cAAc,EAAE,CAC7I,CAAC;QACJ,CAAC;QACD,OAAO,eAAe,KAAK,SAAS;YAClC,CAAC,CAAC,EAAE,UAAU,EAAE;YAChB,CAAC,CAAC,EAAE,eAAe,EAAE,UAAU,EAAE,CAAC;IACtC,CAAC;IAED;;;;OAIG;IACH,YAAY,CAAC,SAAiB;QAC5B,OAAO,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;IACtC,CAAC;IAED,gFAAgF;IAChF,OAAO;QACL,KAAK,MAAM,MAAM,IAAI,IAAI,CAAC,eAAe,CAAC,MAAM,EAAE,EAAE,CAAC;YACnD,MAAM,CAAC,kBAAkB,EAAE,CAAC;YAC5B,MAAM,CAAC,YAAY,EAAE,CAAC;YACtB,MAAM,CAAC,YAAY,EAAE,CAAC;QACxB,CAAC;QACD,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,QAAQ,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,eAAe,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,CAAC,oBAAoB,CAAC,KAAK,EAAE,CAAC;QAClC,IAAI,CAAC,qBAAqB,EAAE,CAAC;IAC/B,CAAC;CACF"}

package/lib/types/client/components/QaHeader.d.ts

@@ -38,10 +38,20 @@ export interface QaHeaderProps {
     readonly fileCount: number;
     readonly filesOpen: boolean;
     readonly onOpenFiles: () => void;
+    /**
+     * The signed-in user's settings entry. The sidebar carries it next to the
+     * account name, so a deployment that hides the session list has to hand it
+     * here instead: without either, a signed-in user cannot reach their own
+     * profile, starter buttons, skills or integrations at all.
+     */
+    readonly settings?: {
+        readonly label: string;
+        readonly onOpen: () => void;
+    };
     readonly panelLauncher?: ReactNode;
     readonly showReset: boolean;
     readonly resetDisabled: boolean;
     readonly onReset: () => void;
 }
-export declare function QaHeader({ logoUrl, title, viewingSubagent, onCloseSubagent, agentPreset, roleSelector, administration, agentCount, agentsOpen, onToggleAgents, sourcesVisible, sourcesCount, sourcesComplete, sourcesOpen, onOpenSources, fileCount, filesOpen, onOpenFiles, panelLauncher, showReset, resetDisabled, onReset, }: QaHeaderProps): import("react/jsx-runtime").JSX.Element;
+export declare function QaHeader({ logoUrl, title, viewingSubagent, onCloseSubagent, agentPreset, roleSelector, administration, agentCount, agentsOpen, onToggleAgents, sourcesVisible, sourcesCount, sourcesComplete, sourcesOpen, onOpenSources, fileCount, filesOpen, onOpenFiles, settings, panelLauncher, showReset, resetDisabled, onReset, }: QaHeaderProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=QaHeader.d.ts.map

package/lib/types/client/session-sources.d.ts

@@ -19,6 +19,15 @@ export declare class QaHostSourceBridge {
     constructor(sourceApi: QaSourceApi, token: () => string);
     /** Leave the chat: drop its bundles; merging degrades to the projection. */
     reset(): void;
+    /**
+     * The Host's bundles win the turns they share with the projection, with one
+     * exception: a bundle that collected nothing never erases a turn the
+     * transcript accounts for. Both channels read the same durable tool results,
+     * so a turn the projection filled and the Host reported empty means the
+     * Host's collection missed that turn, not that the answer had no sources —
+     * and without this guard such a turn loses the sources the reader could see
+     * while it ran the moment the Host answers for it.
+     */
     merge(projected: readonly QaTurnSources[]): readonly QaTurnSources[];
     /**
      * Fetch the Host bundles of one chat; a changed payload republishes through

package/lib/types/client/user-settings/GeneralSettingsPage.d.ts

@@ -5,10 +5,11 @@ export interface QaGeneralSettingsPageProps {
 }
 /**
  * Placeholder with a purpose: the section exists so the dialog has a home for
- * the user-scoped preferences that follow (notifications, integrations,
- * privacy), and so the thing it must not become is written down — deployment
- * and chat policy live in the Host settings, not here. It shows the account
- * facts a user can act on today and nothing invented.
+ * the user-scoped preferences that follow (notifications, privacy), and so the
+ * thing it must not become is written down — deployment and chat policy live in
+ * the Host settings, not here. It shows the account facts a user can act on
+ * today and nothing invented, and it names only what is still missing: a
+ * preference that already has its own tab does not belong on this list.
  */
 export declare function QaGeneralSettingsPage(props: QaGeneralSettingsPageProps): import("react/jsx-runtime").JSX.Element;
 //# sourceMappingURL=GeneralSettingsPage.d.ts.map

package/lib/types/enforcement/tool-grants.d.ts

@@ -25,6 +25,11 @@ export interface QaAgentToolGrantsOptions {
     readonly baseTools: readonly string[];
     /** Ceiling for grants, already narrowed to tools that exist right now. */
     readonly grantableTools: readonly string[];
+    /**
+     * Names the QA tool catalog registers on the agent itself. A restriction
+     * cannot name one, so the mask leaves them out; the guard covers them.
+     */
+    readonly agentLocalTools: ReadonlySet<string>;
     /** Normalized `metadata.qa-surface` of every discovered skill. */
     readonly descriptors: ReadonlyMap<string, QaSkillDescriptor>;
     readonly logger: PluginLogger;
@@ -40,9 +45,14 @@ export interface QaAgentToolGrantsOptions {
  * subrole was configured with. A skill file can therefore ask for anything —
  * the intersection with the role ceiling is what it gets.
  *
- * A restriction may only name tools the scope inherits, so a grant is verified
- * by applying it: a name the registry refuses (agent-local, unregistered) is
- * dropped from the grant instead of breaking the session.
+ * A restriction may only name tools the scope INHERITS. The QA tool catalog
+ * attaches its tools to the agent itself, and such a registration is visible to
+ * the model without ever being nameable in a restriction: handing one to
+ * `restrict()` makes the registry refuse the whole call. Every restriction this
+ * class installs is therefore installed through the mask helper, which admits
+ * the inherited names and leaves the self-registered ones out, and a grant is
+ * verified against the same view — a name no layer holds is dropped from the
+ * grant instead of breaking the session.
  */
 export declare class QaAgentToolGrants {
     private readonly options;
@@ -52,6 +62,14 @@ export declare class QaAgentToolGrants {
     constructor(options: QaAgentToolGrantsOptions);
     /** Whether the model would see this tool right now. */
     effectiveTools(): ReadonlySet<string>;
+    /**
+     * Whether the tool is callable for the agent at all, masks aside.
+     *
+     * The global view ignores restrictions and the agent's own view covers what
+     * the agent registered for itself, so a tool some layer holds stays grantable
+     * even while the current mask hides it.
+     */
+    private mounted;
     /** Grants currently held, newest last; one entry per activated skill. */
     activeGrants(): readonly QaSkillGrant[];
     /**

package/lib/types/enforcement/tool-mask.d.ts

@@ -0,0 +1,38 @@
+import type { Context } from "@deepseek-ai/cordis";
+/** The registry surface one mask needs: a single scoped restriction call. */
+export type QaToolMaskTarget = Pick<Context["tools"], "restrict">;
+/** One installed mask: how to lift it, and what it could not name. */
+export interface QaToolMask {
+    /** Lift the mask. A no-op when the registry took no mask at all. */
+    readonly dispose: () => void;
+    /**
+     * Names left out of the mask, in the order they were given up: a name the
+     * agent registers for itself never enters a mask, and a name no layer holds
+     * is dropped by the registry. Reported so an operator learns that the
+     * deployment's allow-list names something this session cannot restrict.
+     */
+    readonly refused: readonly string[];
+}
+/**
+ * Install a scoped restriction over the names a QA session may see.
+ *
+ * `restrict()` filters what a scope INHERITS — the global layer and the
+ * ancestor layers, a preset's own tool rows among them. It refuses, with one
+ * error, three different things: a name no layer holds, a name the scope
+ * registers for itself, and an empty list. The QA tool catalog attaches its
+ * tools to the agent itself, so `qa_tools_selfcheck` is exactly the second
+ * case, and a single such entry used to make the registry refuse the whole
+ * call and fail every chat's attestation.
+ *
+ * This function therefore filters the self-registered names out first, and
+ * then gives up whatever the registry still refuses, one round at a time: an
+ * entry the mask cannot name costs that entry, never the session. The caller's
+ * execution guard is unaffected — it keeps enforcing the full policy — so an
+ * entry that never reaches the mask stays callable and denied, not allowed.
+ * @param tools - the agent's scoped registry.
+ * @param allow - names the mask should admit, in policy order.
+ * @param agentLocal - names the QA catalog registers on the agent itself.
+ * @returns the installed mask, plus the names that did not make it in.
+ */
+export declare function installInheritableMask(tools: QaToolMaskTarget, allow: readonly string[], agentLocal: ReadonlySet<string>): QaToolMask;
+//# sourceMappingURL=tool-mask.d.ts.map

package/lib/types/secure-session.d.ts

@@ -101,6 +101,18 @@ export declare class QaPolicyAdmission {
      */
     private liveAgent;
     secureSession(token: string, sessionId: string): Promise<QaLockdownProof>;
+    /**
+     * Mask one agent down to the policy's tool names, for the account-free path
+     * (a capability policy installs its own mask through its grants).
+     *
+     * The mask admits what the scope inherits — the global layer and the ancestor
+     * layers, which is where a preset's own tool rows live — and skips the names
+     * the QA catalog registers on the agent, since a restriction cannot name
+     * those. A name that is neither, or that the registry refuses for any other
+     * reason, is left out of the mask and reported instead of failing the chat:
+     * the guard below still denies it, so the effective set is unchanged.
+     */
+    private maskAgentTools;
     /** Resolve the deployment facts shared by creation and full attestation. */
     private deploymentPins;
     /**

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@yadsh/dsh-qa-surface",
-  "version": "0.7.1",
+  "version": "0.7.3",
   "description": "A focused end-user QA surface backed by native DeepSeek Harness sessions",
   "repository": {
     "type": "git",
@@ -174,8 +174,8 @@
     "tsdown": "^0.22.14",
     "typescript": "^7.0.2",
     "vitest": "^4.1.11",
-    "@yadsh/dsh-plugin-kit": "^0.1.0",
     "@yadsh/dsh-config": "^0.0.0",
+    "@yadsh/dsh-plugin-kit": "^0.1.0",
     "@yadsh/dsh-plugin-scripts": "^0.0.0"
   },
   "publishConfig": {