agent-threat-rules 3.5.12 → 4.1.5

package/dist/enforcement.d.ts

@@ -0,0 +1,233 @@
+/**
+ * Enforcement policy — the two operator switches, and the one precedence rule
+ * that governs both.
+ *
+ * ATR separates DETECTION from ENFORCEMENT. Detection always runs; enforcement
+ * is what the engine is allowed to DO with a detection:
+ *
+ *   lane      Which rule maturities may fire at all.
+ *             'enforce' = stable only, 'alert' = stable+test, 'hunt' = all.
+ *             Implemented by the lane gate in engine.ts (see passesLane).
+ *
+ *   blocking  Whether ATR may express a blocking decision. OFF BY DEFAULT.
+ *             When off: the Claude Code hook contract omits permissionDecision
+ *             entirely (the host applies its own default — ATR does not vote),
+ *             and the ActionExecutor refuses to dispatch any response action
+ *             above the OBSERVE blast-radius tier. Detection output is
+ *             unchanged in both modes.
+ *
+ * WHY BLOCKING IS OPT-IN
+ *
+ * The load-bearing requirement is SPEC.md §5.5, which is engine-wide:
+ * "Engines MUST NOT execute response actions automatically without an explicit
+ * configuration directive from the operator." Until this module existed there
+ * was no way for an operator to express that directive — no CLI flag, no
+ * environment variable, no documented config key. This module IS that directive.
+ *
+ * Two weaker statements point the same way but must not be quoted as general
+ * rules, because they are not:
+ *   - spec/atr-method-v1.1.md §5.6 says "Engines SHOULD NOT auto-block ON A
+ *     HASH MATCH without operator policy explicitly enabling it". That sits
+ *     under §5 Signature Method and is scoped to hash matches. An earlier
+ *     revision of this comment elided "on a hash match" and widened it into a
+ *     general SHOULD NOT. It is not one.
+ *   - docs/QUALITY-STANDARD.md restricts blocking to `maturity: stable` rules,
+ *     but that section is deployment guidance addressed to consumers, not a
+ *     normative engine requirement.
+ *
+ * WHY ATR NEVER SAYS "allow"
+ *
+ * In the Claude Code PreToolUse contract, `permissionDecision: "allow"` is not
+ * neutral — it is an affirmative approval that suppresses the host's own
+ * permission prompt. ATR emits a permission decision only to RESTRAIN an
+ * operation (deny / ask). "No rule matched" is not "I approve this": it is ATR
+ * having nothing to say, and the host must be left on its own default path.
+ * This holds in BOTH modes — advisory omits every decision, and blocking omits
+ * the affirmative one. See toClaudeCodePreToolUse in hook-handler.ts.
+ *
+ * WHO READS THE ENVIRONMENT
+ *
+ * For the lane and blocking switches: only the CLI. `resolveEnforcementPolicy`
+ * below is the only function that reads `process.env` for THESE TWO switches,
+ * and `src/cli.ts` is its only caller; it hands the resolved values to
+ * ATREngine / ActionExecutor / HookHandler explicitly.
+ *
+ * Not "the only function in the package that touches process.env" — that is
+ * false and an earlier revision of this comment said it. Ten files under src/
+ * read the environment in code, including `adapters/openshell-filter.ts` and
+ * `adapters/nemoclaw-preflight.ts`, which read `ATR_MIN_SEVERITY` and block by
+ * default. Those adapters are outside this switch and stay that way; see the
+ * scope limit in CHANGELOG.md.
+ *
+ * `grep -rl "process\.env" src/` returns eleven, not ten: `src/index.ts` only
+ * names it in a comment. The correction above was itself first written as
+ * "eleven" off that grep, which is the same mistake one level down.
+ *
+ * Library constructors take `laneFromConfig` / `blockingFromConfig`, which
+ * cannot read the environment — `resolveLane` and `resolveBlocking` require an
+ * EnvSource argument, so there is no overload that silently falls through to
+ * `process.env`. This is structural, not a convention: an embedder cannot
+ * accidentally opt into ambient configuration.
+ *
+ * The rule exists because ambient configuration crosses trust boundaries
+ * invisibly. `new ATREngine()` inside a VS Code extension, a Mastra pipeline,
+ * or the `/openshell-filter`, `/nemoclaw-preflight` and `/mcp` entry points did
+ * not ask to be reconfigured by a shell profile — and `ATR_LANE=enforce` is a
+ * VALID value, so the old behaviour produced no warning at all while narrowing
+ * those callers to maturity=stable rules only.
+ *
+ * PRECEDENCE
+ *
+ *   library:  explicit config  >  built-in default
+ *   CLI:      flag  >  environment variable  >  built-in default
+ *
+ * An invalid explicit value (config field or CLI flag) throws or exits: that is
+ * the caller's own bug, reported where the caller is looking. An invalid
+ * ENVIRONMENT value degrades loudly instead — see resolveEnforcementPolicy for
+ * the measurement behind that split.
+ *
+ * @module agent-threat-rules/enforcement
+ */
+import { type Lane } from './quality/rule-contract.js';
+/** Environment variable naming the detection lane. */
+export declare const LANE_ENV_VAR = "ATR_LANE";
+/** Environment variable enabling blocking (the operator directive). */
+export declare const BLOCKING_ENV_VAR = "ATR_BLOCKING";
+/**
+ * Lane used when neither config nor environment says otherwise.
+ * 'hunt' keeps every maturity visible — advisory breadth, which is safe
+ * precisely because blocking is off by default.
+ */
+export declare const DEFAULT_LANE: Lane;
+/** Blocking is off until an operator turns it on. */
+export declare const DEFAULT_BLOCKING = false;
+/** Minimal read-only view of an environment. Keeps this module testable. */
+export type EnvSource = Readonly<Record<string, string | undefined>>;
+/**
+ * Parse a lane name. Returns null for anything not in LANES, so callers that
+ * want to report a usage error (the CLI) can do so without a try/catch.
+ *
+ * Trimmed and case-INSENSITIVE, matching parseBooleanFlag exactly. The two were
+ * asymmetric: `ATR_BLOCKING=ON` worked while `ATR_LANE=ENFORCE` did not, and the
+ * pair `ATR_LANE=ENFORCE ATR_BLOCKING=ON` therefore turned blocking on while
+ * silently widening the lane to hunt — the operator asked for the narrowest
+ * enforcement posture and got the broadest one. The fallback direction was
+ * exactly the dangerous one, so the fix is to accept the spelling, not to
+ * document the trap.
+ */
+export declare function parseLane(value: string): Lane | null;
+/**
+ * Parse a boolean switch value. Returns null for anything unrecognised.
+ * An empty string is treated as "not set" by the resolvers, not by this
+ * function — it returns null here so the caller decides.
+ */
+export declare function parseBooleanFlag(value: string): boolean | null;
+/**
+ * Resolve the active detection lane: explicit > env > default.
+ *
+ * `env` is REQUIRED and has no `process.env` default. That is the whole
+ * mechanism keeping ambient configuration out of the library: a caller must
+ * name the environment it wants read, and library constructors pass NO_ENV via
+ * laneFromConfig. Only the CLI passes `process.env`.
+ *
+ * @throws TypeError when either source carries a value that is not a lane.
+ */
+export declare function resolveLane(explicit: Lane | string | undefined, env: EnvSource): Lane;
+/**
+ * Resolve whether blocking is enabled: explicit > env > default (false).
+ *
+ * `env` is REQUIRED — see resolveLane for why.
+ *
+ * @throws TypeError when the explicit value is not a boolean, or when the
+ *         environment variable is set to a value that is neither truthy nor
+ *         falsy by the table above.
+ *
+ *         The explicit-value check is not decoration. `blocking` crosses from
+ *         untyped JavaScript (and from JSON config files) as often as from
+ *         TypeScript, and every non-empty string is truthy: without this,
+ *         `new ActionExecutor({ adapter, blocking: "false" })` TURNS BLOCKING
+ *         ON while reading, to its author, as an explicit "off". The lane path
+ *         validated its explicit value from the start; this one did not, and a
+ *         switch that fails toward "more enforcement" is the wrong asymmetry to
+ *         leave in place.
+ */
+export declare function resolveBlocking(explicit: boolean | undefined, env: EnvSource): boolean;
+/**
+ * Lane for a LIBRARY caller: explicit config, or the built-in default. Never
+ * reads the environment.
+ *
+ * @throws TypeError when the caller passes something that is not a lane.
+ */
+export declare function laneFromConfig(explicit?: Lane | string): Lane;
+/**
+ * Blocking for a LIBRARY caller: explicit config, or off. Never reads the
+ * environment.
+ *
+ * @throws TypeError when the caller passes a non-boolean.
+ */
+export declare function blockingFromConfig(explicit?: boolean): boolean;
+/** The enforcement posture a CLI process will run under. */
+export interface EnforcementPolicy {
+    readonly lane: Lane;
+    readonly blocking: boolean;
+    /** Human-readable problems found while resolving. Empty on a clean read. */
+    readonly notes: readonly string[];
+}
+/**
+ * Resolve the posture for a CLI process: flag > environment > default.
+ *
+ * THE ONLY FUNCTION IN THIS PACKAGE THAT READS `process.env`.
+ *
+ * A bad FLAG is a usage error the CLI reports and exits on (see readLaneOption
+ * in cli.ts): it was typed by a person at a prompt who is looking at the exit
+ * code. A bad ENVIRONMENT VALUE is different, and this function degrades
+ * instead of throwing. That split was measured, not assumed.
+ *
+ * MEASUREMENT (Claude Code 2.1.76, hook dispatcher in the shipped binary)
+ * A `command` hook's exit status is mapped as:
+ *   status 0  -> `hook_success`; the renderer for that attachment returns null.
+ *   status 2  -> `hook_blocking_error`; stderr is shown AND the tool is blocked.
+ *   otherwise -> `hook_non_blocking_error`; the tool RUNS, the attachment maps
+ *                to [] for the model, and the renderer prints exactly
+ *                "<hookName> hook error" — the captured stderr is not shown.
+ *
+ * So for `atr guard`, which `atr init` installs as a PreToolUse command hook,
+ * exiting non-zero over a typo would: lose all detection for that call, let the
+ * tool run anyway, and tell the operator nothing beyond a bare "hook error".
+ * It buys no visibility at the cost of the entire product. The only loud exit
+ * status is 2 — which BLOCKS the tool, i.e. a stray shell variable would block
+ * every tool call. Both alternatives are worse than degrading.
+ *
+ * THE TRADE-OFF, STATED
+ * Degrading means an operator can believe enforcement is on when it is not.
+ * That is a real cost and it is why `notes` is not optional: the caller must
+ * print every note. It is accepted because the degraded posture is advisory —
+ * ATR emits no permission decision and dispatches no action above OBSERVE — so
+ * the failure mode is "ATR does not act", never "ATR acts wrongly". Exiting
+ * would produce "ATR does not act" too, and silently, minus the detection.
+ *
+ * WHY AN UNREADABLE LANE ALSO FORCES BLOCKING OFF
+ * Falling back to hunt while blocking is on is the one combination that makes
+ * the degraded posture MORE dangerous than the requested one: the operator
+ * asked to block on maturity=stable rules only, and would instead block on
+ * every maturity including draft. So when the requested lane cannot be honoured
+ * the process drops to advisory. An explicit `--blocking` does not override
+ * this: the flag says "you may block", not "block on a lane I never chose".
+ */
+export declare function resolveEnforcementPolicy(flags?: {
+    readonly lane?: Lane | undefined;
+    readonly blocking?: boolean | undefined;
+}, env?: EnvSource): EnforcementPolicy;
+/**
+ * Is this response action enforcement rather than observation?
+ *
+ * The observe/enforce split is NOT redefined here — it reads the blast-radius
+ * ladder in src/quality/action-eligibility.ts, which is the project's single
+ * ranking of what an action destroys. OBSERVE (alert / snapshot / shadow /
+ * escalate) changes nothing about the agent's execution and therefore always
+ * runs. Everything above it (INTERRUPT / DEGRADE / TERMINATE) denies an
+ * operation, alters session state, or destroys the session — that is
+ * enforcement and requires the operator directive.
+ */
+export declare function isEnforcementAction(action: string): boolean;
+//# sourceMappingURL=enforcement.d.ts.map

package/dist/enforcement.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.d.ts","sourceRoot":"","sources":["../src/enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH,OAAO,EAAS,KAAK,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAG9D,sDAAsD;AACtD,eAAO,MAAM,YAAY,aAAa,CAAC;AAEvC,uEAAuE;AACvE,eAAO,MAAM,gBAAgB,iBAAiB,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,YAAY,EAAE,IAAa,CAAC;AAEzC,qDAAqD;AACrD,eAAO,MAAM,gBAAgB,QAAQ,CAAC;AAOtC,4EAA4E;AAC5E,MAAM,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;AAErE;;;;;;;;;;;GAWG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,IAAI,CAGpD;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,GAAG,IAAI,CAK9D;AAED;;;;;;;;;GASG;AACH,wBAAgB,WAAW,CACzB,QAAQ,EAAE,IAAI,GAAG,MAAM,GAAG,SAAS,EACnC,GAAG,EAAE,SAAS,GACb,IAAI,CAuBN;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,eAAe,CAC7B,QAAQ,EAAE,OAAO,GAAG,SAAS,EAC7B,GAAG,EAAE,SAAS,GACb,OAAO,CAyBT;AASD;;;;;GAKG;AACH,wBAAgB,cAAc,CAAC,QAAQ,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAE7D;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,OAAO,CAE9D;AAED,4DAA4D;AAC5D,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IACpB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,4EAA4E;IAC5E,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,wBAAgB,wBAAwB,CACtC,KAAK,GAAE;IAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,IAAI,GAAG,SAAS,CAAC;IAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAA;CAAO,EACzF,GAAG,GAAE,SAAuB,GAC3B,iBAAiB,CAuCnB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAE3D"}

package/dist/enforcement.js

@@ -0,0 +1,316 @@
+/**
+ * Enforcement policy — the two operator switches, and the one precedence rule
+ * that governs both.
+ *
+ * ATR separates DETECTION from ENFORCEMENT. Detection always runs; enforcement
+ * is what the engine is allowed to DO with a detection:
+ *
+ *   lane      Which rule maturities may fire at all.
+ *             'enforce' = stable only, 'alert' = stable+test, 'hunt' = all.
+ *             Implemented by the lane gate in engine.ts (see passesLane).
+ *
+ *   blocking  Whether ATR may express a blocking decision. OFF BY DEFAULT.
+ *             When off: the Claude Code hook contract omits permissionDecision
+ *             entirely (the host applies its own default — ATR does not vote),
+ *             and the ActionExecutor refuses to dispatch any response action
+ *             above the OBSERVE blast-radius tier. Detection output is
+ *             unchanged in both modes.
+ *
+ * WHY BLOCKING IS OPT-IN
+ *
+ * The load-bearing requirement is SPEC.md §5.5, which is engine-wide:
+ * "Engines MUST NOT execute response actions automatically without an explicit
+ * configuration directive from the operator." Until this module existed there
+ * was no way for an operator to express that directive — no CLI flag, no
+ * environment variable, no documented config key. This module IS that directive.
+ *
+ * Two weaker statements point the same way but must not be quoted as general
+ * rules, because they are not:
+ *   - spec/atr-method-v1.1.md §5.6 says "Engines SHOULD NOT auto-block ON A
+ *     HASH MATCH without operator policy explicitly enabling it". That sits
+ *     under §5 Signature Method and is scoped to hash matches. An earlier
+ *     revision of this comment elided "on a hash match" and widened it into a
+ *     general SHOULD NOT. It is not one.
+ *   - docs/QUALITY-STANDARD.md restricts blocking to `maturity: stable` rules,
+ *     but that section is deployment guidance addressed to consumers, not a
+ *     normative engine requirement.
+ *
+ * WHY ATR NEVER SAYS "allow"
+ *
+ * In the Claude Code PreToolUse contract, `permissionDecision: "allow"` is not
+ * neutral — it is an affirmative approval that suppresses the host's own
+ * permission prompt. ATR emits a permission decision only to RESTRAIN an
+ * operation (deny / ask). "No rule matched" is not "I approve this": it is ATR
+ * having nothing to say, and the host must be left on its own default path.
+ * This holds in BOTH modes — advisory omits every decision, and blocking omits
+ * the affirmative one. See toClaudeCodePreToolUse in hook-handler.ts.
+ *
+ * WHO READS THE ENVIRONMENT
+ *
+ * For the lane and blocking switches: only the CLI. `resolveEnforcementPolicy`
+ * below is the only function that reads `process.env` for THESE TWO switches,
+ * and `src/cli.ts` is its only caller; it hands the resolved values to
+ * ATREngine / ActionExecutor / HookHandler explicitly.
+ *
+ * Not "the only function in the package that touches process.env" — that is
+ * false and an earlier revision of this comment said it. Ten files under src/
+ * read the environment in code, including `adapters/openshell-filter.ts` and
+ * `adapters/nemoclaw-preflight.ts`, which read `ATR_MIN_SEVERITY` and block by
+ * default. Those adapters are outside this switch and stay that way; see the
+ * scope limit in CHANGELOG.md.
+ *
+ * `grep -rl "process\.env" src/` returns eleven, not ten: `src/index.ts` only
+ * names it in a comment. The correction above was itself first written as
+ * "eleven" off that grep, which is the same mistake one level down.
+ *
+ * Library constructors take `laneFromConfig` / `blockingFromConfig`, which
+ * cannot read the environment — `resolveLane` and `resolveBlocking` require an
+ * EnvSource argument, so there is no overload that silently falls through to
+ * `process.env`. This is structural, not a convention: an embedder cannot
+ * accidentally opt into ambient configuration.
+ *
+ * The rule exists because ambient configuration crosses trust boundaries
+ * invisibly. `new ATREngine()` inside a VS Code extension, a Mastra pipeline,
+ * or the `/openshell-filter`, `/nemoclaw-preflight` and `/mcp` entry points did
+ * not ask to be reconfigured by a shell profile — and `ATR_LANE=enforce` is a
+ * VALID value, so the old behaviour produced no warning at all while narrowing
+ * those callers to maturity=stable rules only.
+ *
+ * PRECEDENCE
+ *
+ *   library:  explicit config  >  built-in default
+ *   CLI:      flag  >  environment variable  >  built-in default
+ *
+ * An invalid explicit value (config field or CLI flag) throws or exits: that is
+ * the caller's own bug, reported where the caller is looking. An invalid
+ * ENVIRONMENT value degrades loudly instead — see resolveEnforcementPolicy for
+ * the measurement behind that split.
+ *
+ * @module agent-threat-rules/enforcement
+ */
+import { LANES } from './quality/rule-contract.js';
+import { ACTION_TIERS, actionTier } from './quality/action-eligibility.js';
+/** Environment variable naming the detection lane. */
+export const LANE_ENV_VAR = 'ATR_LANE';
+/** Environment variable enabling blocking (the operator directive). */
+export const BLOCKING_ENV_VAR = 'ATR_BLOCKING';
+/**
+ * Lane used when neither config nor environment says otherwise.
+ * 'hunt' keeps every maturity visible — advisory breadth, which is safe
+ * precisely because blocking is off by default.
+ */
+export const DEFAULT_LANE = 'hunt';
+/** Blocking is off until an operator turns it on. */
+export const DEFAULT_BLOCKING = false;
+const LANE_SET = new Set(LANES);
+const TRUE_VALUES = new Set(['1', 'true', 'yes', 'on']);
+const FALSE_VALUES = new Set(['0', 'false', 'no', 'off']);
+/**
+ * Parse a lane name. Returns null for anything not in LANES, so callers that
+ * want to report a usage error (the CLI) can do so without a try/catch.
+ *
+ * Trimmed and case-INSENSITIVE, matching parseBooleanFlag exactly. The two were
+ * asymmetric: `ATR_BLOCKING=ON` worked while `ATR_LANE=ENFORCE` did not, and the
+ * pair `ATR_LANE=ENFORCE ATR_BLOCKING=ON` therefore turned blocking on while
+ * silently widening the lane to hunt — the operator asked for the narrowest
+ * enforcement posture and got the broadest one. The fallback direction was
+ * exactly the dangerous one, so the fix is to accept the spelling, not to
+ * document the trap.
+ */
+export function parseLane(value) {
+    const normalized = value.trim().toLowerCase();
+    return LANE_SET.has(normalized) ? normalized : null;
+}
+/**
+ * Parse a boolean switch value. Returns null for anything unrecognised.
+ * An empty string is treated as "not set" by the resolvers, not by this
+ * function — it returns null here so the caller decides.
+ */
+export function parseBooleanFlag(value) {
+    const normalized = value.trim().toLowerCase();
+    if (TRUE_VALUES.has(normalized))
+        return true;
+    if (FALSE_VALUES.has(normalized))
+        return false;
+    return null;
+}
+/**
+ * Resolve the active detection lane: explicit > env > default.
+ *
+ * `env` is REQUIRED and has no `process.env` default. That is the whole
+ * mechanism keeping ambient configuration out of the library: a caller must
+ * name the environment it wants read, and library constructors pass NO_ENV via
+ * laneFromConfig. Only the CLI passes `process.env`.
+ *
+ * @throws TypeError when either source carries a value that is not a lane.
+ */
+export function resolveLane(explicit, env) {
+    if (explicit !== undefined) {
+        const parsed = parseLane(explicit);
+        if (parsed === null) {
+            throw new TypeError(`Invalid lane "${explicit}". Expected one of: ${LANES.join(', ')}.`);
+        }
+        return parsed;
+    }
+    const fromEnv = env[LANE_ENV_VAR];
+    if (fromEnv !== undefined && fromEnv.trim() !== '') {
+        const parsed = parseLane(fromEnv);
+        if (parsed === null) {
+            throw new TypeError(`Invalid ${LANE_ENV_VAR}="${fromEnv}". Expected one of: ${LANES.join(', ')}.`);
+        }
+        return parsed;
+    }
+    return DEFAULT_LANE;
+}
+/**
+ * Resolve whether blocking is enabled: explicit > env > default (false).
+ *
+ * `env` is REQUIRED — see resolveLane for why.
+ *
+ * @throws TypeError when the explicit value is not a boolean, or when the
+ *         environment variable is set to a value that is neither truthy nor
+ *         falsy by the table above.
+ *
+ *         The explicit-value check is not decoration. `blocking` crosses from
+ *         untyped JavaScript (and from JSON config files) as often as from
+ *         TypeScript, and every non-empty string is truthy: without this,
+ *         `new ActionExecutor({ adapter, blocking: "false" })` TURNS BLOCKING
+ *         ON while reading, to its author, as an explicit "off". The lane path
+ *         validated its explicit value from the start; this one did not, and a
+ *         switch that fails toward "more enforcement" is the wrong asymmetry to
+ *         leave in place.
+ */
+export function resolveBlocking(explicit, env) {
+    if (explicit !== undefined) {
+        if (typeof explicit !== 'boolean') {
+            throw new TypeError(`Invalid blocking value ${JSON.stringify(explicit)} (${typeof explicit}). ` +
+                `Expected a boolean. Note that any non-empty string, including "false", ` +
+                `would otherwise enable blocking.`);
+        }
+        return explicit;
+    }
+    const fromEnv = env[BLOCKING_ENV_VAR];
+    if (fromEnv !== undefined && fromEnv.trim() !== '') {
+        const parsed = parseBooleanFlag(fromEnv);
+        if (parsed === null) {
+            throw new TypeError(`Invalid ${BLOCKING_ENV_VAR}="${fromEnv}". Expected one of: ` +
+                `${[...TRUE_VALUES].join('/')} or ${[...FALSE_VALUES].join('/')}.`);
+        }
+        return parsed;
+    }
+    return DEFAULT_BLOCKING;
+}
+/**
+ * An environment that is empty by construction. Library constructors resolve
+ * against this, so "the library does not read the environment" is enforced by
+ * the type system rather than by reviewer vigilance.
+ */
+const NO_ENV = Object.freeze({});
+/**
+ * Lane for a LIBRARY caller: explicit config, or the built-in default. Never
+ * reads the environment.
+ *
+ * @throws TypeError when the caller passes something that is not a lane.
+ */
+export function laneFromConfig(explicit) {
+    return resolveLane(explicit, NO_ENV);
+}
+/**
+ * Blocking for a LIBRARY caller: explicit config, or off. Never reads the
+ * environment.
+ *
+ * @throws TypeError when the caller passes a non-boolean.
+ */
+export function blockingFromConfig(explicit) {
+    return resolveBlocking(explicit, NO_ENV);
+}
+/**
+ * Resolve the posture for a CLI process: flag > environment > default.
+ *
+ * THE ONLY FUNCTION IN THIS PACKAGE THAT READS `process.env`.
+ *
+ * A bad FLAG is a usage error the CLI reports and exits on (see readLaneOption
+ * in cli.ts): it was typed by a person at a prompt who is looking at the exit
+ * code. A bad ENVIRONMENT VALUE is different, and this function degrades
+ * instead of throwing. That split was measured, not assumed.
+ *
+ * MEASUREMENT (Claude Code 2.1.76, hook dispatcher in the shipped binary)
+ * A `command` hook's exit status is mapped as:
+ *   status 0  -> `hook_success`; the renderer for that attachment returns null.
+ *   status 2  -> `hook_blocking_error`; stderr is shown AND the tool is blocked.
+ *   otherwise -> `hook_non_blocking_error`; the tool RUNS, the attachment maps
+ *                to [] for the model, and the renderer prints exactly
+ *                "<hookName> hook error" — the captured stderr is not shown.
+ *
+ * So for `atr guard`, which `atr init` installs as a PreToolUse command hook,
+ * exiting non-zero over a typo would: lose all detection for that call, let the
+ * tool run anyway, and tell the operator nothing beyond a bare "hook error".
+ * It buys no visibility at the cost of the entire product. The only loud exit
+ * status is 2 — which BLOCKS the tool, i.e. a stray shell variable would block
+ * every tool call. Both alternatives are worse than degrading.
+ *
+ * THE TRADE-OFF, STATED
+ * Degrading means an operator can believe enforcement is on when it is not.
+ * That is a real cost and it is why `notes` is not optional: the caller must
+ * print every note. It is accepted because the degraded posture is advisory —
+ * ATR emits no permission decision and dispatches no action above OBSERVE — so
+ * the failure mode is "ATR does not act", never "ATR acts wrongly". Exiting
+ * would produce "ATR does not act" too, and silently, minus the detection.
+ *
+ * WHY AN UNREADABLE LANE ALSO FORCES BLOCKING OFF
+ * Falling back to hunt while blocking is on is the one combination that makes
+ * the degraded posture MORE dangerous than the requested one: the operator
+ * asked to block on maturity=stable rules only, and would instead block on
+ * every maturity including draft. So when the requested lane cannot be honoured
+ * the process drops to advisory. An explicit `--blocking` does not override
+ * this: the flag says "you may block", not "block on a lane I never chose".
+ */
+export function resolveEnforcementPolicy(flags = {}, env = process.env) {
+    const notes = [];
+    let lane;
+    let laneHonoured = true;
+    try {
+        lane = resolveLane(flags.lane, env);
+    }
+    catch (error) {
+        if (flags.lane !== undefined)
+            throw error; // a flag is the caller's bug
+        laneHonoured = false;
+        lane = DEFAULT_LANE;
+        notes.push(`${error.message} Falling back to lane "${DEFAULT_LANE}". ` +
+            `Detection still runs; this only changes which maturities may fire.`);
+    }
+    let blocking;
+    try {
+        blocking = resolveBlocking(flags.blocking, env);
+    }
+    catch (error) {
+        if (flags.blocking !== undefined)
+            throw error;
+        blocking = DEFAULT_BLOCKING;
+        notes.push(`${error.message} Falling back to blocking=${DEFAULT_BLOCKING}. ` +
+            `If you meant to enable enforcement, it is NOT enabled.`);
+    }
+    if (!laneHonoured && blocking) {
+        blocking = false;
+        notes.push(`Blocking disabled: ${LANE_ENV_VAR} could not be read, and blocking on the ` +
+            `fallback lane "${DEFAULT_LANE}" would enforce on more rule maturities ` +
+            `than you asked for. Fix ${LANE_ENV_VAR} to re-enable enforcement.`);
+    }
+    return Object.freeze({ lane, blocking, notes: Object.freeze(notes) });
+}
+/**
+ * Is this response action enforcement rather than observation?
+ *
+ * The observe/enforce split is NOT redefined here — it reads the blast-radius
+ * ladder in src/quality/action-eligibility.ts, which is the project's single
+ * ranking of what an action destroys. OBSERVE (alert / snapshot / shadow /
+ * escalate) changes nothing about the agent's execution and therefore always
+ * runs. Everything above it (INTERRUPT / DEGRADE / TERMINATE) denies an
+ * operation, alters session state, or destroys the session — that is
+ * enforcement and requires the operator directive.
+ */
+export function isEnforcementAction(action) {
+    return actionTier(action) > ACTION_TIERS.OBSERVE;
+}
+//# sourceMappingURL=enforcement.js.map

package/dist/enforcement.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enforcement.js","sourceRoot":"","sources":["../src/enforcement.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyFG;AAEH,OAAO,EAAE,KAAK,EAAa,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,iCAAiC,CAAC;AAE3E,sDAAsD;AACtD,MAAM,CAAC,MAAM,YAAY,GAAG,UAAU,CAAC;AAEvC,uEAAuE;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC;AAE/C;;;;GAIG;AACH,MAAM,CAAC,MAAM,YAAY,GAAS,MAAM,CAAC;AAEzC,qDAAqD;AACrD,MAAM,CAAC,MAAM,gBAAgB,GAAG,KAAK,CAAC;AAEtC,MAAM,QAAQ,GAAwB,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC;AAErD,MAAM,WAAW,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC;AAC7E,MAAM,YAAY,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;AAK/E;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAE,UAAmB,CAAC,CAAC,CAAC,IAAI,CAAC;AAChE,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAAC,KAAa;IAC5C,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC9C,IAAI,WAAW,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7C,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC;QAAE,OAAO,KAAK,CAAC;IAC/C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,WAAW,CACzB,QAAmC,EACnC,GAAc;IAEd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;QACnC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CACjB,iBAAiB,QAAQ,uBAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CACpE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,YAAY,CAAC,CAAC;IAClC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QAClC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CACjB,WAAW,YAAY,KAAK,OAAO,uBAAuB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC9E,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,YAAY,CAAC;AACtB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,eAAe,CAC7B,QAA6B,EAC7B,GAAc;IAEd,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;YAClC,MAAM,IAAI,SAAS,CACjB,0BAA0B,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,KAAK,OAAO,QAAQ,KAAK;gBACzE,yEAAyE;gBACzE,kCAAkC,CACrC,CAAC;QACJ,CAAC;QACD,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,CAAC,gBAAgB,CAAC,CAAC;IACtC,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACnD,MAAM,MAAM,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QACzC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,MAAM,IAAI,SAAS,CACjB,WAAW,gBAAgB,KAAK,OAAO,sBAAsB;gBAC3D,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,YAAY,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CACrE,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,OAAO,gBAAgB,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,MAAM,MAAM,GAAc,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;AAE5C;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAwB;IACrD,OAAO,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACvC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,QAAkB;IACnD,OAAO,eAAe,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AAC3C,CAAC;AAUD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAAuF,EAAE,EACzF,MAAiB,OAAO,CAAC,GAAG;IAE5B,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,IAAI,IAAU,CAAC;IACf,IAAI,YAAY,GAAG,IAAI,CAAC;IACxB,IAAI,CAAC;QACH,IAAI,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACtC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC,CAAC,6BAA6B;QACxE,YAAY,GAAG,KAAK,CAAC;QACrB,IAAI,GAAG,YAAY,CAAC;QACpB,KAAK,CAAC,IAAI,CACR,GAAI,KAAe,CAAC,OAAO,0BAA0B,YAAY,KAAK;YACpE,oEAAoE,CACvE,CAAC;IACJ,CAAC;IAED,IAAI,QAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,eAAe,CAAC,KAAK,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IAClD,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS;YAAE,MAAM,KAAK,CAAC;QAC9C,QAAQ,GAAG,gBAAgB,CAAC;QAC5B,KAAK,CAAC,IAAI,CACR,GAAI,KAAe,CAAC,OAAO,6BAA6B,gBAAgB,IAAI;YAC1E,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,YAAY,IAAI,QAAQ,EAAE,CAAC;QAC9B,QAAQ,GAAG,KAAK,CAAC;QACjB,KAAK,CAAC,IAAI,CACR,sBAAsB,YAAY,0CAA0C;YAC1E,kBAAkB,YAAY,0CAA0C;YACxE,2BAA2B,YAAY,4BAA4B,CACtE,CAAC;IACJ,CAAC;IAED,OAAO,MAAM,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;AACxE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,mBAAmB,CAAC,MAAc;IAChD,OAAO,UAAU,CAAC,MAAM,CAAC,GAAG,YAAY,CAAC,OAAO,CAAC;AACnD,CAAC"}

package/dist/engine.d.ts

@@ -12,6 +12,7 @@
  * @module agent-threat-rules/engine
  */
 import type { ATRRule, ATRMatch, AgentEvent, ATRVerdict, ActionResult, ScanResult, ATRLanguage, ATRSemanticJudge } from './types.js';
+import { type Lane } from './quality/rule-contract.js';
 import type { SessionTracker } from './session-tracker.js';
 import type { ActionExecutor } from './action-executor.js';
 import type { SkillFingerprintStore } from './skill-fingerprint.js';
@@ -79,6 +80,15 @@ export interface ATREngineConfig {
      *   'alert'   : maturity stable + test (analyst/correlation lane).
      *   'hunt'    : all maturities (advisory/eval; default, backward-compatible).
      * Deprecated/draft rules are always skipped regardless of lane.
+     *
+     * This field is the ONLY input: the engine does not read `ATR_LANE` or any
+     * other environment variable. Leaving it undefined pins the lane to 'hunt',
+     * the widest and most advisory setting, no matter what the surrounding shell
+     * says. A CLI that wants environment support resolves it itself and passes
+     * the result here (src/cli.ts, resolveEnforcementPolicy).
+     *
+     * An unrecognised value throws at construction time — that is a caller bug,
+     * not ambient noise.
      */
     lane?: 'enforce' | 'alert' | 'hunt';
     /**
@@ -95,6 +105,12 @@ export declare class ATREngine {
     private rules;
     private readonly compiledPatterns;
     private readonly semanticModuleInstance;
+    /**
+     * Active detection lane, resolved ONCE at construction from config alone.
+     * Held as a field so every gate in this engine sees the same lane for its
+     * lifetime.
+     */
+    private readonly lane;
     /**
      * Find bundled rules directory shipped with the npm package.
      * Checks: ../rules (from dist/), ./rules (repo root)
@@ -111,6 +127,8 @@ export declare class ATREngine {
      * Keeps experimental content out of the auto-block path without deleting it.
      */
     private passesLane;
+    /** Active detection lane (config, else 'hunt'). Diagnostics/tests. */
+    getLane(): Lane;
     /**
      * Load a single rule file and add it to the engine.
      */
@@ -348,4 +366,27 @@ export declare function conditionLanguageMatches(condLang: ATRLanguage | undefin
  * corpus without dropping a single legitimate rule.
  */
 export declare function isReDoSSafe(source: string): boolean;
+/**
+ * Compile a rule-derived pattern with a ReDoS safety gate. Returns null (caller
+ * skips the pattern) when the source is syntactically invalid OR exhibits
+ * catastrophic-backtracking structure. A dropped rule in a security engine must
+ * be LOUD, not silent, so a rejected ReDoS pattern warns to stderr (never
+ * stdout — that carries the hook protocol) with the offending source.
+ */
+/**
+ * Does this pattern need the RegExp `u` flag?
+ *
+ * `\\u{...}` and `\\p{...}` require it by syntax, and so does a literal astral
+ * character: without `u`, JavaScript reads a surrogate pair, and a class range
+ * written with literals -- [<U+E0000>-<U+E007F>] -- is a SyntaxError rather than
+ * a range.
+ *
+ * The literal form matters because it is the only spelling the three consuming
+ * engines share. `\\u{...}` is JS-only: Python re needs `\\U000E0000`, Go needs
+ * `\\x{E0000}`, and neither of those is valid JavaScript. Sixteen conditions
+ * across ten rules used it, which made those rules uncompilable from the Python
+ * and Go channels; they are literals now, and this is what keeps them working
+ * here.
+ */
+export declare function needsUnicodeFlag(pattern: string): boolean;
 //# sourceMappingURL=engine.d.ts.map

package/dist/engine.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,QAAQ,EACR,UAAU,EAGV,UAAU,EACV,YAAY,EACZ,UAAU,EAEV,WAAW,EACX,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAQpB,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAQlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AA8D9D,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB5D;AAsBD;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,sEAAsE;IACtE,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,qFAAqF;IACrF,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,6EAA6E;IAC7E,aAAa,CAAC,EAAE,gBAAgB,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB;;;;;;OAMG;IACH,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;IACpC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,SAAS;IAwBR,OAAO,CAAC,QAAQ,CAAC,MAAM;IAvBnC,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA4C;IAC7E,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAwB;IAE/D;;;OAGG;IACH,OAAO,CAAC,mBAAmB;gBAeE,MAAM,GAAE,eAAoB;IAUzD;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;IA2BlC;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAMlB;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAMnC;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAK5B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,EAAE;IAOvC;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAkKnB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAuH3D;;;OAGG;IACH,OAAO,CAAC,YAAY;IAyDpB,qFAAqF;IACrF,OAAO,CAAC,mBAAmB;IAY3B;;;OAGG;YACW,iBAAiB;IAgC/B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAgC/B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IA8C/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA8G9B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAoC/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAiC9B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA0FhC;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAoBnC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAgC1B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;OAGG;IACH,OAAO,CAAC,6BAA6B;IAyErC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IA4BnC;;OAEG;IACH,OAAO,CAAC,YAAY;IAkDpB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAsC1B;;OAEG;IACH,OAAO,CAAC,eAAe;IAgCvB;;;OAGG;IACH,OAAO,CAAC,eAAe;IA4CvB;;;;;OAKG;IACG,mBAAmB,CACvB,KAAK,EAAE,UAAU,EACjB,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC;QACT,OAAO,EAAE,UAAU,CAAC;QACpB,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;QACvC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;KAC/B,CAAC;IAiIF,4BAA4B;IAC5B,YAAY,IAAI,MAAM;IAItB,2BAA2B;IAC3B,QAAQ,IAAI,SAAS,OAAO,EAAE;IAI9B,uBAAuB;IACvB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAI5C,4BAA4B;IAC5B,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE;IAI/C;;;;;;;OAOG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE;IA4BtC;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IA2B1D,8EAA8E;IAC9E,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU;IAa7D,6DAA6D;IACvD,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAajF,qFAAqF;IACrF,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU;IAiB9D,8DAA8D;IACxD,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAenF;AAcD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AAiDD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBpD;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAwC7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,SAAS,EAAE,WAAW,GACrB,OAAO,CAUT;AAwDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA2BnD"}
+{"version":3,"file":"engine.d.ts","sourceRoot":"","sources":["../src/engine.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,OAAO,KAAK,EACV,OAAO,EACP,QAAQ,EACR,UAAU,EAGV,UAAU,EACV,YAAY,EACZ,UAAU,EAEV,WAAW,EACX,gBAAgB,EACjB,MAAM,YAAY,CAAC;AAOpB,OAAO,EAA+B,KAAK,IAAI,EAAE,MAAM,4BAA4B,CAAC;AAEpF,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAE3D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAEpE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,wBAAwB,CAAC;AAQlE,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AA8D9D,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,EAAE,CAsB5D;AAsBD;;;;;;;;;GASG;AACH,MAAM,WAAW,WAAW;IAC1B,uEAAuE;IACvE,QAAQ,CAAC,WAAW,EAAE,CAAC,MAAM,EAAE,kBAAkB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3E,+DAA+D;IAC/D,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,cAAc,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CACrE;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,yFAAyF;IACzF,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,eAAe;IAC9B,+CAA+C;IAC/C,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,kDAAkD;IAClD,KAAK,CAAC,EAAE,OAAO,EAAE,CAAC;IAClB,sEAAsE;IACtE,cAAc,CAAC,EAAE,cAAc,CAAC;IAChC,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,gBAAgB,CAAC;IACpC,mEAAmE;IACnE,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC,0EAA0E;IAC1E,gBAAgB,CAAC,EAAE,qBAAqB,CAAC;IACzC,qFAAqF;IACrF,eAAe,CAAC,EAAE,eAAe,CAAC;IAClC,0EAA0E;IAC1E,cAAc,CAAC,EAAE,mBAAmB,CAAC;IACrC,6EAA6E;IAC7E,aAAa,CAAC,EAAE,gBAAgB,CAAC;IACjC,2EAA2E;IAC3E,QAAQ,CAAC,EAAE,WAAW,CAAC;IACvB;;;;;;;;;;;;;;;OAeG;IACH,IAAI,CAAC,EAAE,SAAS,GAAG,OAAO,GAAG,MAAM,CAAC;IACpC;;;;;;OAMG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,SAAS;IA8BR,OAAO,CAAC,QAAQ,CAAC,MAAM;IA7BnC,OAAO,CAAC,KAAK,CAAiB;IAC9B,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAA4C;IAC7E,OAAO,CAAC,QAAQ,CAAC,sBAAsB,CAAwB;IAC/D;;;;OAIG;IACH,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAO;IAE5B;;;OAGG;IACH,OAAO,CAAC,mBAAmB;gBAeE,MAAM,GAAE,eAAoB;IAczD;;OAEG;IACG,SAAS,IAAI,OAAO,CAAC,MAAM,CAAC;IA2BlC;;;;OAIG;IACH,OAAO,CAAC,UAAU;IAMlB,sEAAsE;IACtE,OAAO,IAAI,IAAI;IAIf;;OAEG;IACH,WAAW,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI;IAMnC;;OAEG;IACH,OAAO,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI;IAK5B;;;;;;OAMG;IACH,QAAQ,CAAC,KAAK,EAAE,UAAU,GAAG,QAAQ,EAAE;IAOvC;;;;;;;;OAQG;IACH,OAAO,CAAC,WAAW;IAkKnB;;;;;;OAMG;IACG,aAAa,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IAuH3D;;;OAGG;IACH,OAAO,CAAC,YAAY;IAyDpB,qFAAqF;IACrF,OAAO,CAAC,mBAAmB;IAY3B;;;OAGG;YACW,iBAAiB;IAgC/B;;;;;OAKG;IACH,OAAO,CAAC,uBAAuB;IAgC/B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IA8C/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IA8G9B;;;OAGG;IACH,OAAO,CAAC,uBAAuB;IAoC/B;;OAEG;IACH,OAAO,CAAC,sBAAsB;IAiC9B;;OAEG;IACH,OAAO,CAAC,wBAAwB;IA0FhC;;;;;OAKG;IACH,OAAO,CAAC,0BAA0B;IAwBlC;;;;OAIG;IACH,OAAO,CAAC,2BAA2B;IAoBnC;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAgC1B;;;OAGG;IACH,OAAO,CAAC,aAAa;IAiBrB;;;;;;;;OAQG;IACH,OAAO,CAAC,yBAAyB;IAmBjC;;;OAGG;IACH,OAAO,CAAC,6BAA6B;IAyErC;;OAEG;IACH,OAAO,CAAC,2BAA2B;IA4BnC;;OAEG;IACH,OAAO,CAAC,YAAY;IAkDpB;;;OAGG;IACH,OAAO,CAAC,kBAAkB;IAsC1B;;OAEG;IACH,OAAO,CAAC,eAAe;IAgCvB;;;OAGG;IACH,OAAO,CAAC,eAAe;IA4CvB;;;;;OAKG;IACG,mBAAmB,CACvB,KAAK,EAAE,UAAU,EACjB,QAAQ,CAAC,EAAE,cAAc,GACxB,OAAO,CAAC;QACT,OAAO,EAAE,UAAU,CAAC;QACpB,aAAa,EAAE,SAAS,YAAY,EAAE,CAAC;QACvC,UAAU,EAAE,SAAS,MAAM,EAAE,CAAC;KAC/B,CAAC;IAiIF,4BAA4B;IAC5B,YAAY,IAAI,MAAM;IAItB,2BAA2B;IAC3B,QAAQ,IAAI,SAAS,OAAO,EAAE;IAI9B,uBAAuB;IACvB,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,GAAG,SAAS;IAI5C,4BAA4B;IAC5B,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,EAAE;IAI/C;;;;;;;OAOG;IACH,SAAS,CAAC,OAAO,EAAE,MAAM,GAAG,QAAQ,EAAE;IA4BtC;;OAEG;IACG,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IA2B1D,8EAA8E;IAC9E,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU;IAa7D,6DAA6D;IACvD,kBAAkB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;IAajF,qFAAqF;IACrF,YAAY,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,UAAU;IAiB9D,8DAA8D;IACxD,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC;CAenF;AAcD;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAIrD;AAiDD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAuBpD;AAoBD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,MAAM,GAAG,WAAW,CAwC7D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,wBAAwB,CACtC,QAAQ,EAAE,WAAW,GAAG,SAAS,EACjC,SAAS,EAAE,WAAW,GACrB,OAAO,CAUT;AAwDD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,WAAW,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CA2BnD;AAED;;;;;;GAMG;AACH;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAOzD"}