approval-md 0.4.5 → 0.4.6

package/dist/src/core/harness-version.d.ts

@@ -73,19 +73,56 @@ export declare const HARNESS_BINARY: Readonly<Record<HarnessKind, string>>;
  * forever. So the write boundary takes one line, printable ASCII only, capped.
  */
 export declare const HARNESS_VERSION_LIMIT = 64;
+/**
+ * The longest leading run of printable ASCII, U+0020 through U+007E.
+ *
+ * The one place the recordable-character rule lives (APRV-419). The run stops
+ * at the first character outside that range, so a non-ASCII character, a
+ * control character (a newline, a tab, a carriage return, a BEL) and EVERYTHING
+ * after any of them is cut, even when what follows would be printable again.
+ * The schema's pattern for `payload.harness_version` (`^[\u0020-\u007e]+$`)
+ * admits exactly the strings this can return, so the rule and the write
+ * boundary cannot drift apart.
+ */
+export declare function printableAsciiPrefix(text: string): string;
 /**
  * The one spelling of a harness version this runtime ever writes or compares.
  *
- * First line, trimmed, and nothing else: `claude --version` prints
- * `2.0.14 (Claude Code)` and a future release may add a second line of banner.
- * Both the hook (which records) and doctor (which compares) call this, so the
- * comparison is between two values normalized identically — a row that failed
- * because one side kept a trailing newline would be a false alarm, and a false
- * alarm in a health check trains an operator to ignore it.
+ * First line, trimmed, then its printable-ASCII prefix ({@link
+ * printableAsciiPrefix}), trimmed again. `claude --version` prints
+ * `2.0.14 (Claude Code)` and passes through whole; a future release may add a
+ * second line of banner, which the prefix never reaches. Both the hook (which
+ * records) and doctor (which compares) call this, so the comparison is between
+ * two values normalized identically: a row that failed because one side kept a
+ * trailing newline would be a false alarm, and a false alarm in a health check
+ * trains an operator to ignore it.
+ *
+ * ## Why a prefix rather than a refusal (APRV-419, option (c))
+ *
+ * Until APRV-419 a line holding any byte outside printable ASCII was refused
+ * whole. Hermes prints `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`
+ * and the separator is U+00B7, so no record ever carried a Hermes version and
+ * doctor could never compare one. Carter chose, on 2026-10-17, to record the
+ * prefix instead: for that line, `Hermes Agent v0.21.3 (2026.9.14)`. The
+ * upstream commit after the separator is lost, which is why the fail-closed
+ * floor below still reads the raw line.
+ *
+ * The SET of recordable values is unchanged. Every value returned here is a
+ * string the old rule accepted as a whole line (one line, printable ASCII,
+ * 1..64 characters), so the schema, the read side ({@link
+ * readHarnessProvenance}) and every record already written are unchanged. What
+ * moved is which part of a line is recorded: the line is cut at its first
+ * non-printable character, and the 64-character cap then applies to that prefix
+ * rather than to the whole line. So a long line whose printable-ASCII prefix
+ * fits the cap now records the prefix where the old rule refused the line, and
+ * at most 64 printable-ASCII characters of any line reach the log (SPEC.md
+ * §11.1 invariant 3).
  *
  * Returns `null` for anything that is not a usable version: empty output, a
- * line that is not printable ASCII, or one longer than the cap. Absence is
- * always available and always honest.
+ * line with no printable-ASCII prefix, or a prefix longer than the cap. The cut
+ * at the first non-printable character is the one truncation this applies; a
+ * prefix still over the cap after it is refused whole. Absence is always
+ * available and always honest.
  */
 export declare function normalizeHarnessVersion(raw: unknown): string | null;
 /**
@@ -109,9 +146,10 @@ export declare const HARNESS_PROBE_TIMEOUT_MS = 10000;
  * the log (only {@link normalizeHarnessVersion}'s output is), and what needs the
  * raw line is a diagnostic that must be able to read a build stamp a harness
  * prints beside its semver. Hermes prints
- * `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`, which the log's own
- * rule rejects on the non-ASCII separator alone. Capped and stripped of control
- * characters all the same: this is third-party output on its way to a terminal.
+ * `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`, of which the log keeps
+ * only the part before the non-ASCII separator (APRV-419), losing the upstream
+ * commit. Capped and stripped of control characters all the same: this is
+ * third-party output on its way to a terminal.
  */
 export declare const HARNESS_RAW_VERSION_LIMIT = 200;
 /**
@@ -119,38 +157,41 @@ export declare const HARNESS_RAW_VERSION_LIMIT = 200;
  *
  * One line, trimmed, control characters removed, capped. `null` for empty output
  * or a line past the cap. It keeps non-ASCII bytes, which is the whole difference
- * from {@link normalizeHarnessVersion}: a build stamp behind a typographic
+ * from {@link normalizeHarnessVersion}: an upstream commit behind a typographic
  * separator is exactly the fact a version floor has to read, and it is exactly
- * the fact the write boundary will not accept.
- */
-export declare function rawHarnessVersionLine(raw: unknown): string | null;
-/**
- * Run `<binary> --version` once, uncached, and return its raw first line.
+ * the part of the line the write boundary cuts.
  *
- * Every failure is a value rather than an exception, in the manner of
- * {@link spawnGloss}: a missing binary, a non-zero exit and a timeout kill are
- * all reported on the result object, and all of them are simply "no version".
- *
- * The child is STARVED, for the reason the gloss runner is: this is a
- * third-party CLI spawned by a process that may be holding a bot token and a
- * vault passphrase, and it has no use for either. Nothing is declared, because
- * reading a version is not a granted action.
+ * Never the source of a RECORDED value. Removing a control character glues what
+ * followed it onto what preceded it, so text a `\r` hid on a terminal would
+ * reach the log if this line were normalized. The recordable form is read off
+ * the untouched first line instead ({@link installedHarnessVersion}), where the
+ * control character cuts exactly as it does for an event-supplied value (APRV-419).
  */
+export declare function rawHarnessVersionLine(raw: unknown): string | null;
+/** Run `<binary> --version` once, uncached, and return its first line as a diagnostic may print it. */
 export declare function probeHarnessVersionRaw(kind: HarnessKind): string | null;
 /**
  * Run `<binary> --version` once, uncached, and normalize what came back.
  *
- * The recordable form: one line, printable ASCII, capped. Exported for the test
- * that proves the memo below is a memo.
+ * The recordable form: one line, its printable-ASCII prefix, capped, read off
+ * the untouched first line so a control character cuts here as it does on the
+ * event path. Exported for the test that proves the memo below is a memo.
  */
 export declare function probeHarnessVersion(kind: HarnessKind): string | null;
-/** The raw first line of `<binary> --version`, read at most once per process. */
+/**
+ * The first line of `<binary> --version` as a diagnostic may print it (control
+ * characters removed, non-ASCII kept), read at most once per process. For the
+ * version floor and terminal output; never recorded.
+ */
 export declare function installedHarnessVersionRaw(kind: HarnessKind): string | null;
 /**
  * The installed version of `kind`, read at most once per process.
  *
- * This is the only entry point callers should use for a RECORDABLE version.
- * `probeHarnessVersion` is exported for the test that proves the memo is a memo.
+ * This is the only entry point callers should use for a RECORDABLE version. It
+ * normalizes the untouched first line, never {@link installedHarnessVersionRaw}'s
+ * stripped one, so the recorded value follows the one rule in {@link
+ * printableAsciiPrefix} whichever path supplied it. `probeHarnessVersion` is
+ * exported for the test that proves the memo is a memo.
  */
 export declare function installedHarnessVersion(kind: HarnessKind): string | null;
 /** Drop the memo. TEST ONLY: a process reads a version once, by design. */

package/dist/src/core/harness-version.js

@@ -90,30 +90,67 @@ export const HARNESS_BINARY = {
  * forever. So the write boundary takes one line, printable ASCII only, capped.
  */
 export const HARNESS_VERSION_LIMIT = 64;
-/** Printable ASCII, no control characters, no newline. The schema pins the same. */
-const PRINTABLE = /^[\x20-\x7e]+$/u;
+/**
+ * The longest leading run of printable ASCII, U+0020 through U+007E.
+ *
+ * The one place the recordable-character rule lives (APRV-419). The run stops
+ * at the first character outside that range, so a non-ASCII character, a
+ * control character (a newline, a tab, a carriage return, a BEL) and EVERYTHING
+ * after any of them is cut, even when what follows would be printable again.
+ * The schema's pattern for `payload.harness_version` (`^[\u0020-\u007e]+$`)
+ * admits exactly the strings this can return, so the rule and the write
+ * boundary cannot drift apart.
+ */
+export function printableAsciiPrefix(text) {
+    return /^[\x20-\x7e]*/u.exec(text)?.[0] ?? "";
+}
 /**
  * The one spelling of a harness version this runtime ever writes or compares.
  *
- * First line, trimmed, and nothing else: `claude --version` prints
- * `2.0.14 (Claude Code)` and a future release may add a second line of banner.
- * Both the hook (which records) and doctor (which compares) call this, so the
- * comparison is between two values normalized identically — a row that failed
- * because one side kept a trailing newline would be a false alarm, and a false
- * alarm in a health check trains an operator to ignore it.
+ * First line, trimmed, then its printable-ASCII prefix ({@link
+ * printableAsciiPrefix}), trimmed again. `claude --version` prints
+ * `2.0.14 (Claude Code)` and passes through whole; a future release may add a
+ * second line of banner, which the prefix never reaches. Both the hook (which
+ * records) and doctor (which compares) call this, so the comparison is between
+ * two values normalized identically: a row that failed because one side kept a
+ * trailing newline would be a false alarm, and a false alarm in a health check
+ * trains an operator to ignore it.
+ *
+ * ## Why a prefix rather than a refusal (APRV-419, option (c))
+ *
+ * Until APRV-419 a line holding any byte outside printable ASCII was refused
+ * whole. Hermes prints `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`
+ * and the separator is U+00B7, so no record ever carried a Hermes version and
+ * doctor could never compare one. Carter chose, on 2026-10-17, to record the
+ * prefix instead: for that line, `Hermes Agent v0.21.3 (2026.9.14)`. The
+ * upstream commit after the separator is lost, which is why the fail-closed
+ * floor below still reads the raw line.
+ *
+ * The SET of recordable values is unchanged. Every value returned here is a
+ * string the old rule accepted as a whole line (one line, printable ASCII,
+ * 1..64 characters), so the schema, the read side ({@link
+ * readHarnessProvenance}) and every record already written are unchanged. What
+ * moved is which part of a line is recorded: the line is cut at its first
+ * non-printable character, and the 64-character cap then applies to that prefix
+ * rather than to the whole line. So a long line whose printable-ASCII prefix
+ * fits the cap now records the prefix where the old rule refused the line, and
+ * at most 64 printable-ASCII characters of any line reach the log (SPEC.md
+ * §11.1 invariant 3).
  *
  * Returns `null` for anything that is not a usable version: empty output, a
- * line that is not printable ASCII, or one longer than the cap. Absence is
- * always available and always honest.
+ * line with no printable-ASCII prefix, or a prefix longer than the cap. The cut
+ * at the first non-printable character is the one truncation this applies; a
+ * prefix still over the cap after it is refused whole. Absence is always
+ * available and always honest.
  */
 export function normalizeHarnessVersion(raw) {
     if (typeof raw !== "string")
         return null;
     const first = raw.split("\n", 1)[0] ?? "";
-    const text = first.trim();
+    const text = printableAsciiPrefix(first.trim()).trim();
     if (text.length === 0 || text.length > HARNESS_VERSION_LIMIT)
         return null;
-    return PRINTABLE.test(text) ? text : null;
+    return text;
 }
 /**
  * How long the probe may take before it is killed and reported as absent.
@@ -136,9 +173,10 @@ export const HARNESS_PROBE_TIMEOUT_MS = 10_000;
  * the log (only {@link normalizeHarnessVersion}'s output is), and what needs the
  * raw line is a diagnostic that must be able to read a build stamp a harness
  * prints beside its semver. Hermes prints
- * `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`, which the log's own
- * rule rejects on the non-ASCII separator alone. Capped and stripped of control
- * characters all the same: this is third-party output on its way to a terminal.
+ * `Hermes Agent v0.21.3 (2026.9.14) · upstream 913d4098`, of which the log keeps
+ * only the part before the non-ASCII separator (APRV-419), losing the upstream
+ * commit. Capped and stripped of control characters all the same: this is
+ * third-party output on its way to a terminal.
  */
 export const HARNESS_RAW_VERSION_LIMIT = 200;
 /**
@@ -146,9 +184,15 @@ export const HARNESS_RAW_VERSION_LIMIT = 200;
  *
  * One line, trimmed, control characters removed, capped. `null` for empty output
  * or a line past the cap. It keeps non-ASCII bytes, which is the whole difference
- * from {@link normalizeHarnessVersion}: a build stamp behind a typographic
+ * from {@link normalizeHarnessVersion}: an upstream commit behind a typographic
  * separator is exactly the fact a version floor has to read, and it is exactly
- * the fact the write boundary will not accept.
+ * the part of the line the write boundary cuts.
+ *
+ * Never the source of a RECORDED value. Removing a control character glues what
+ * followed it onto what preceded it, so text a `\r` hid on a terminal would
+ * reach the log if this line were normalized. The recordable form is read off
+ * the untouched first line instead ({@link installedHarnessVersion}), where the
+ * control character cuts exactly as it does for an event-supplied value (APRV-419).
  */
 export function rawHarnessVersionLine(raw) {
     if (typeof raw !== "string")
@@ -162,7 +206,12 @@ export function rawHarnessVersionLine(raw) {
     return text;
 }
 /**
- * Run `<binary> --version` once, uncached, and return its raw first line.
+ * Run `<binary> --version` once, uncached, and return its first line UNTOUCHED.
+ *
+ * Untouched means no trim, no strip and no cap: the two readers each apply their
+ * own rule to these bytes ({@link rawHarnessVersionLine} for a terminal,
+ * {@link normalizeHarnessVersion} for the log), and neither sees the other's
+ * output. `null` when the binary gave no answer at all.
  *
  * Every failure is a value rather than an exception, in the manner of
  * {@link spawnGloss}: a missing binary, a non-zero exit and a timeout kill are
@@ -173,7 +222,7 @@ export function rawHarnessVersionLine(raw) {
  * vault passphrase, and it has no use for either. Nothing is declared, because
  * reading a version is not a granted action.
  */
-export function probeHarnessVersionRaw(kind) {
+function probeHarnessVersionFirstLine(kind) {
     let result;
     try {
         result = spawnSync(HARNESS_BINARY[kind], ["--version"], {
@@ -191,46 +240,64 @@ export function probeHarnessVersionRaw(kind) {
     }
     if (result.error !== undefined || result.status !== 0)
         return null;
-    return rawHarnessVersionLine(result.stdout);
+    return result.stdout.split("\n", 1)[0] ?? "";
+}
+/** Run `<binary> --version` once, uncached, and return its first line as a diagnostic may print it. */
+export function probeHarnessVersionRaw(kind) {
+    return rawHarnessVersionLine(probeHarnessVersionFirstLine(kind));
 }
 /**
  * Run `<binary> --version` once, uncached, and normalize what came back.
  *
- * The recordable form: one line, printable ASCII, capped. Exported for the test
- * that proves the memo below is a memo.
+ * The recordable form: one line, its printable-ASCII prefix, capped, read off
+ * the untouched first line so a control character cuts here as it does on the
+ * event path. Exported for the test that proves the memo below is a memo.
  */
 export function probeHarnessVersion(kind) {
-    return normalizeHarnessVersion(probeHarnessVersionRaw(kind));
+    return normalizeHarnessVersion(probeHarnessVersionFirstLine(kind));
 }
 /**
  * The memo. Holds the FAILURES too: a harness that is not on PATH is not on
  * PATH, and asking a second time in the same process would pay a second spawn
  * for the same `null`.
  *
- * It holds the RAW line rather than the recordable one, so the two readers — the
- * provenance field and the version floor — still cost ONE spawn per process
- * between them. A harness whose raw line the write boundary rejects has a
- * `null` recordable version and a readable raw one, which is precisely Hermes's
- * case and precisely why the floor is not read off a record.
+ * It holds the UNTOUCHED first line rather than either reader's form, so the two
+ * readers (the provenance field and the version floor) still cost ONE spawn per
+ * process between them, and each applies its own rule to the same bytes. A
+ * harness whose line the write boundary cuts has a shorter recordable version
+ * than its raw one, which is precisely Hermes's case (the record keeps the build
+ * date and loses the upstream commit) and precisely why the floor is not read
+ * off a record.
  */
 const probed = new Map();
-/** The raw first line of `<binary> --version`, read at most once per process. */
-export function installedHarnessVersionRaw(kind) {
+/** The untouched first line of `<binary> --version`, read at most once per process. */
+function installedHarnessVersionFirstLine(kind) {
     const memo = probed.get(kind);
     if (memo !== undefined)
         return memo;
-    const value = probeHarnessVersionRaw(kind);
+    const value = probeHarnessVersionFirstLine(kind);
     probed.set(kind, value);
     return value;
 }
+/**
+ * The first line of `<binary> --version` as a diagnostic may print it (control
+ * characters removed, non-ASCII kept), read at most once per process. For the
+ * version floor and terminal output; never recorded.
+ */
+export function installedHarnessVersionRaw(kind) {
+    return rawHarnessVersionLine(installedHarnessVersionFirstLine(kind));
+}
 /**
  * The installed version of `kind`, read at most once per process.
  *
- * This is the only entry point callers should use for a RECORDABLE version.
- * `probeHarnessVersion` is exported for the test that proves the memo is a memo.
+ * This is the only entry point callers should use for a RECORDABLE version. It
+ * normalizes the untouched first line, never {@link installedHarnessVersionRaw}'s
+ * stripped one, so the recorded value follows the one rule in {@link
+ * printableAsciiPrefix} whichever path supplied it. `probeHarnessVersion` is
+ * exported for the test that proves the memo is a memo.
  */
 export function installedHarnessVersion(kind) {
-    return normalizeHarnessVersion(installedHarnessVersionRaw(kind));
+    return normalizeHarnessVersion(installedHarnessVersionFirstLine(kind));
 }
 /** Drop the memo. TEST ONLY: a process reads a version once, by design. */
 export function resetHarnessVersionCache() {

package/dist/src/core/harness-version.js.map

@@ -1 +1 @@
-{"version":3,"file":"harness-version.js","sourceRoot":"","sources":["../../../src/core/harness-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,aAAa;IACb,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;CACA,CAAC;AAIX,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAA0C;IACnE,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,cAAc;IACtB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC,oFAAoF;AACpF,MAAM,SAAS,GAAG,iBAAiB,CAAC;AAEpC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC1B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,gBAAgB,EAAE,CAAC,GAAG;YAC3B,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,SAAS;YACrB,wEAAwE;YACxE,4DAA4D;YAC5D,SAAS,EAAE,EAAE,GAAG,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,qBAAqB,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC9C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB;IACnD,OAAO,uBAAuB,CAAC,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;AAErD,iFAAiF;AACjF,MAAM,UAAU,0BAA0B,CAAC,IAAiB;IAC1D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,sBAAsB,CAAC,IAAI,CAAC,CAAC;IAC3C,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,OAAO,uBAAuB,CAAC,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB;IACtC,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,sEAAsE;IACtE,QAAQ,EAAE,UAAU;IACpB,4EAA4E;IAC5E,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IACvC,yEAAyE;IACzE,SAAS,EACP,0FAA0F;CACpF,CAAC;AAmBX;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO;QACL,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI;QAC3B,IAAI,EACF,KAAK,KAAK,IAAI;YACZ,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;aACtB;QACP,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,IAAqB,EAAU,EAAE,CACjD,IAAI,CAAC,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACnD,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAiB,EACjB,YAAY,GAAY,IAAI;IAE5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}
+{"version":3,"file":"harness-version.js","sourceRoot":"","sources":["../../../src/core/harness-version.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoDG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,MAAM,gBAAgB,CAAC;AAElD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,aAAa,GAAG;IAC3B,aAAa;IACb,QAAQ;IACR,OAAO;IACP,MAAM;IACN,MAAM;IACN,QAAQ;CACA,CAAC;AAIX,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,KAAc;IAC1C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAK,aAAmC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAC3F,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAA0C;IACnE,aAAa,EAAE,QAAQ;IACvB,MAAM,EAAE,cAAc;IACtB,KAAK,EAAE,OAAO;IACd,IAAI,EAAE,MAAM;IACZ,IAAI,EAAE,MAAM;IACZ,MAAM,EAAE,QAAQ;CACjB,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,EAAE,CAAC;AAExC;;;;;;;;;;GAUG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY;IAC/C,OAAO,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAChD,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,MAAM,IAAI,GAAG,oBAAoB,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACvD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,qBAAqB;QAAE,OAAO,IAAI,CAAC;IAC1E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG,MAAM,CAAC;AAE/C;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,MAAM,yBAAyB,GAAG,GAAG,CAAC;AAE7C;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAY;IAChD,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACzC,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IAC1C,0EAA0E;IAC1E,oEAAoE;IACpE,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,MAAM,GAAG,yBAAyB;QAAE,OAAO,IAAI,CAAC;IAC9E,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,SAAS,4BAA4B,CAAC,IAAiB;IACrD,IAAI,MAAM,CAAC;IACX,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE;YACtD,QAAQ,EAAE,MAAM;YAChB,GAAG,EAAE,gBAAgB,EAAE,CAAC,GAAG;YAC3B,OAAO,EAAE,wBAAwB;YACjC,UAAU,EAAE,SAAS;YACrB,wEAAwE;YACxE,4DAA4D;YAC5D,SAAS,EAAE,EAAE,GAAG,IAAI;SACrB,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnE,OAAO,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;AAC/C,CAAC;AAED,uGAAuG;AACvG,MAAM,UAAU,sBAAsB,CAAC,IAAiB;IACtD,OAAO,qBAAqB,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAiB;IACnD,OAAO,uBAAuB,CAAC,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,MAAM,GAAG,IAAI,GAAG,EAA8B,CAAC;AAErD,uFAAuF;AACvF,SAAS,gCAAgC,CAAC,IAAiB;IACzD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC9B,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,KAAK,GAAG,4BAA4B,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,CAAC,GAAG,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACxB,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CAAC,IAAiB;IAC1D,OAAO,qBAAqB,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,uBAAuB,CAAC,IAAiB;IACvD,OAAO,uBAAuB,CAAC,gCAAgC,CAAC,IAAI,CAAC,CAAC,CAAC;AACzE,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,wBAAwB;IACtC,MAAM,CAAC,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,kDAAkD;AAClD,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAG;IACtC,sEAAsE;IACtE,QAAQ,EAAE,UAAU;IACpB,4EAA4E;IAC5E,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,EAAE,EAAE;IACvC,yEAAyE;IACzE,SAAS,EACP,0FAA0F;CACpF,CAAC;AAmBX;;;;;;;;;GASG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAY;IAC7C,MAAM,IAAI,GAAG,qBAAqB,CAAC,GAAG,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC/B,MAAM,MAAM,GAAG,8CAA8C,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACzE,MAAM,KAAK,GAAG,oCAAoC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,mCAAmC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAChE,IAAI,MAAM,KAAK,IAAI,IAAI,KAAK,KAAK,IAAI,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACxE,OAAO;QACL,MAAM,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI;QAC3B,IAAI,EACF,KAAK,KAAK,IAAI;YACZ,CAAC,CAAC,IAAI;YACN,CAAC,CAAC;gBACE,IAAI,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACtB,KAAK,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;gBACvB,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;aACtB;QACP,QAAQ,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI;KAC/C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,uBAAuB,CAAC,GAAY;IAClD,MAAM,MAAM,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,KAAK,CAAC,QAAQ,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7F,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC3C,MAAM,QAAQ,GAAG,CAAC,IAAqB,EAAU,EAAE,CACjD,IAAI,CAAC,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACnD,OAAO,QAAQ,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;AAC/E,CAAC;AAgBD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,IAAiB,EACjB,YAAY,GAAY,IAAI;IAE5B,MAAM,MAAM,GAAG,uBAAuB,CAAC,YAAY,CAAC,CAAC;IACrD,MAAM,OAAO,GAAG,MAAM,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC;IACxD,OAAO,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AAC/E,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,qBAAqB,CAAC,OAAgB;IACpD,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,CAAC;IAC3F,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,IAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC;IAC/B,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,MAAM,OAAO,GAAG,MAAM,CAAC,iBAAiB,CAAC,CAAC;IAC1C,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,uBAAuB,CAAC,OAAO,CAAC,KAAK,OAAO;QAAE,OAAO,IAAI,CAAC;IAC7F,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,CAAC;AACrD,CAAC"}

package/dist/src/core/policy-load.d.ts

@@ -58,6 +58,7 @@
  */
 import { type ProtectedPathEntry } from "./command-class.js";
 import { type DelegationBlock } from "./delegation.js";
+import type { ExecBlock } from "./exec-code.js";
 import type { ReadScope } from "./read-scope.js";
 import { type ToolMapEntry, type UnmappedToolMode } from "./tool-map.js";
 import { type ValidationError } from "./validate.js";
@@ -276,6 +277,13 @@ export interface Policy {
      * display surfaces reads it. See `core/delegation.ts`.
      */
     delegation?: DelegationBlock;
+    /**
+     * Amended SPEC.md §5.2 (APRV-510, proposed; 0.4.5 candidate): what the
+     * operator attests about opaque agent code. Absent, the `exec.code` class is
+     * closed and every refusal is what it was before the key existed. Read by
+     * `core/exec-code.ts` alone; see there for what each key opens.
+     */
+    exec?: ExecBlock;
     /**
      * The approver roster (SPEC.md §5.1), and since APRV-324 the operator's
      * attested statement of which transport account each of them decides from.

package/dist/src/core/policy-load.js.map

@@ -1 +1 @@
-{"version":3,"file":"policy-load.js","sourceRoot":"","sources":["../../../src/core/policy-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAEpD,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,GAEjB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,UAAU,EAAkB,MAAM,eAAe,CAAC;AAC3D,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,iDAAiD;AACjD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,0EAA0E;AAC1E,8EAA8E;AAC9E,gFAAgF;AAChF,oDAAoD;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,8EAA8E;AAC9E,OAAO,EAAE,aAAa,EAA4C,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAwB,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAEzD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,cAAc,CAAU,CAAC;AAEzE,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD,MAAM,WAAW,GAAqC;IACpD,EAAE,EAAE,CAAC;IACL,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,WAAW;CACf,CAAC;AAuEF,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjF,CAAC;AAqRD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAqB,MAAM,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,MAAM;IACjB,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,MAAM;IAC1B,QAAQ,EAAE,KAAK;CAChB,CAAC,CAAC;AA0GH;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,KAAK,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,OAAO,CACd,IAAyB,EACzB,OAAe,EACf,MAA0B,EAC1B,GAAa;IAEb,MAAM,IAAI,GAAqB,MAAM,KAAK,SAAS;QACjD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;QAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACzC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,MAA0B;IAE1B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,yBAAyB,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,yBAAyB,QAAQ,CAAC,MAAM;iBACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC7B,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,6CAA6C,QAAQ,CAAC,QAAQ;iBAC9E,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;iBACjC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,mDAAmD;IACnD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACvE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;QACvB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,0BAA0B,MAAM,CAAC,SAAS,CAAC,+BAA+B,UAAU,EAAE;SAC1G,CAAC;IACJ,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,mEAAmE;QACnE,iEAAiE;QACjE,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,+BAA+B,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAChG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE;QACvC,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,OAA0B;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CACZ,cAAc,EACd,eAAe,OAAO,CAAC,IAAI,uBAAuB,YAAY,CAAC,KAAK,CAAC,EAAE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CACZ,cAAc,EACd,2BAA2B,GAAG,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,OAAO,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,uBAAuB,KAAK,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,IAAY,EACZ,OAAO,GAA2B,EAAE;IAEpC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEhC,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,0EAA0E;QAC1E,mEAAmE;QACnE,yCAAyC;QACzC,OAAO,OAAO,CACZ,UAAU,EACV,GAAG,QAAQ,CAAC,IAAI,wBAAwB,kBAAkB,8CAA8C,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,UAAU,EACV,GAAG,QAAQ,CAAC,IAAI,cAAc,kBAAkB,qBAAqB,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CACZ,iBAAiB,EACjB,GAAG,QAAQ,CAAC,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,UAAU,kBAAkB,+CAA+C,CACzH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,IAAI,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAElC,MAAM,UAAU,GAAG,QAAQ,CACzB,QAAQ,EACR,MAAM,CAAC,KAAK,EACZ,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,yCAAyC,EACzD,UAAU,CAAC,MAAM,EACjB,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAe,CAAC;IAEtC,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,uCAAuC,EACvD,YAAY,EACZ,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,0BAA0B;IAC1B,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,+BAA+B,EAC/C,UAAU,EACV,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,kCAAkC,EAClD,iBAAiB,EACjB,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC;IAC9C,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,4BAA4B,OAAO,2BAA2B,EAC9E;gBACE;oBACE,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC;IAC9C,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,2BAA2B,QAAQ,2BAA2B,EAC9E;gBACE;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,0CAA0C;IAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACtD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,iBAAiB,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,6BAA6B,cAAc,2BAA2B,EACtF;gBACE;oBACE,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACtD,IAAI,kBAAkB,GAAG,0BAA0B,CAAC,kBAAkB,CAAC;IACvE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,gCAAgC,WAAW,2BAA2B,EACtF;gBACE;oBACE,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;QACD,kBAAkB,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,MAAM,UAAU,GAAqB;QACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,0BAA0B,CAAC,SAAS;QAC5E,gBAAgB,EACd,MAAM,CAAC,MAAM,EAAE,kBAAkB,IAAI,0BAA0B,CAAC,gBAAgB;QAClF,kBAAkB;QAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS;KACtC,CAAC;IAEF,MAAM,MAAM,GAAqB;QAC/B,EAAE,EAAE,IAAI;QACR,MAAM;QACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QAClE,SAAS,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE;QAChE,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;KAC1B,CAAC;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,kBAAkB,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,uBAAuB,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACjG,CAAC;IAED,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CACZ,wBAAwB,EACxB,GAAG,QAAQ,CAAC,IAAI,4DAA4D,OAAO;aAChF,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,GAAG,EAAE,CAAC;aACjC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,6KAA6K,EACjO,uBAAuB,CAAC,OAAO,CAAC,EAChC,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC7D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,4OAA4O,CAAC;QAClV,CAAC;QACD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC1D,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,mGAAmG,OAAO,wIAAwI,CAAC;QAC1X,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAE/B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACvE,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBACxE,MAAM,CAAC,QAAQ,KAAK,IAAI;gBACxB,IAAI,CAAC,QAAQ,KAAK,IAAI;gBACtB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;YAC7C,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAC/C,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;gBAC9C,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,kBAAkB,CAAC,QAAQ,KAAK,IAAI;gBACpC,gBAAgB,CAAC,QAAQ,KAAK,IAAI;gBAClC,kBAAkB,CAAC,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,cAAc;gBAC/B,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,iDAAiD,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAClK,CAAC,CAAC,GAAG,aAAa,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,6EAA6E,aAAa,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACvQ,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,oBAAoB,UAAU,qNAAqN,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,iGAAiG,CAAC;QAC/f,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,aAAa,CAAC,QAA0B,EAAE,QAAuB;IACxE,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,KAAa,EAAc,EAAE,CAAC,CAAC;QAC1C,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,OAAO,EAAE,eAAe,KAAK,6dAA6d;KAC3f,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,KAAK,YAAY,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAO,GAAsB,EAAE;IACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,cAAc,CACnB,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,IAAI,EACb,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;AACJ,CAAC"}
+{"version":3,"file":"policy-load.js","sourceRoot":"","sources":["../../../src/core/policy-load.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAyDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,MAAM,CAAC;AAEpD,OAAO,EACL,yBAAyB,EACzB,mBAAmB,GAEpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,wBAAwB,EACxB,iBAAiB,EACjB,uBAAuB,EACvB,gBAAgB,GAEjB,MAAM,iBAAiB,CAAC;AAEzB,OAAO,EAAE,UAAU,EAAkB,MAAM,eAAe,CAAC;AAC3D,6EAA6E;AAC7E,6EAA6E;AAC7E,6EAA6E;AAC7E,uEAAuE;AACvE,6EAA6E;AAC7E,iDAAiD;AACjD,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACxD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAEvD,0EAA0E;AAC1E,8EAA8E;AAC9E,gFAAgF;AAChF,oDAAoD;AACpD,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,8EAA8E;AAC9E,OAAO,EAAE,aAAa,EAA4C,MAAM,eAAe,CAAC;AACxF,OAAO,EAAE,QAAQ,EAAwB,MAAM,eAAe,CAAC;AAE/D;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,EAAE,CAAC;AAElC,6EAA6E;AAC7E,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAEzD,0DAA0D;AAC1D,MAAM,CAAC,MAAM,gBAAgB,GAAG,CAAC,aAAa,EAAE,cAAc,CAAU,CAAC;AAEzE,sEAAsE;AACtE,MAAM,gBAAgB,GAAG,+BAA+B,CAAC;AAEzD,MAAM,WAAW,GAAqC;IACpD,EAAE,EAAE,CAAC;IACL,CAAC,EAAE,KAAK;IACR,CAAC,EAAE,MAAM;IACT,CAAC,EAAE,SAAS;IACZ,CAAC,EAAE,UAAU;IACb,CAAC,EAAE,WAAW;CACf,CAAC;AAuEF,8EAA8E;AAC9E,MAAM,UAAU,eAAe,CAAC,IAAsB;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,QAAQ,CAAC;IAC9B,OAAO,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,cAAc,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC;AACjF,CAAC;AA4RD,2EAA2E;AAC3E,MAAM,CAAC,MAAM,0BAA0B,GAAqB,MAAM,CAAC,MAAM,CAAC;IACxE,SAAS,EAAE,MAAM;IACjB,gBAAgB,EAAE,EAAE;IACpB,kBAAkB,EAAE,MAAM;IAC1B,QAAQ,EAAE,KAAK;CAChB,CAAC,CAAC;AA0GH;;;;;;;GAOG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,IAAI,OAAO,IAAI,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IAC1C,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACxB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;IACtB,IAAI,MAAM,KAAK,SAAS,IAAI,IAAI,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC5D,MAAM,KAAK,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7B,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,OAAO,KAAK,GAAG,KAAK,CAAC;AACvB,CAAC;AAED,SAAS,OAAO,CACd,IAAyB,EACzB,OAAe,EACf,MAA0B,EAC1B,GAAa;IAEb,MAAM,IAAI,GAAqB,MAAM,KAAK,SAAS;QACjD,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE;QAC9B,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;IACzC,OAAO,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC/E,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAChE,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,gBAAgB,CAAC,QAAgB;IACxC,OAAO,UAAU,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;AAClD,CAAC;AAeD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB,CAC/B,MAAc,EACd,MAA0B;IAE1B,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC;IACvC,IAAI,QAAQ,CAAC;IACb,IAAI,CAAC;QACH,QAAQ,GAAG,aAAa,CAAC,MAAM,EAAE;YAC/B,MAAM,EAAE,MAAM;YACd,QAAQ,EAAE,QAAQ;YAClB,YAAY,EAAE,KAAK;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,yBAAyB,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAC1F,CAAC;IAED,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,yBAAyB,QAAQ,CAAC,MAAM;iBACxD,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC;iBAC7B,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,6CAA6C,QAAQ,CAAC,QAAQ;iBAC9E,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,OAAO,CAAC;iBACjC,IAAI,CAAC,IAAI,CAAC,EAAE;SAChB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,mDAAmD;IACnD,IAAI,SAAS,GAAkB,IAAI,CAAC;IACpC,KAAK,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE;QAC7B,IAAI,SAAS,KAAK,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,IAAI,CAAC,GAAG,KAAK,QAAQ,EAAE,CAAC;YACvE,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC;QACvB,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC,CAAC,CAAC;IACH,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EAAE,GAAG,OAAO,0BAA0B,MAAM,CAAC,SAAS,CAAC,+BAA+B,UAAU,EAAE;SAC1G,CAAC;IACJ,CAAC;IAED,IAAI,KAAc,CAAC;IACnB,IAAI,CAAC;QACH,mEAAmE;QACnE,iEAAiE;QACjE,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,EAAE,aAAa,EAAE,eAAe,EAAE,CAAC,CAAC;IAC5D,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,+BAA+B,YAAY,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;IAChG,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED,0EAA0E;AAC1E,SAAS,eAAe,CAAC,MAAc;IACrC,MAAM,MAAM,GAAG,iBAAiB,CAAC,MAAM,EAAE;QACvC,OAAO,EAAE,aAAa;QACtB,UAAU,EAAE,gBAAgB;KAC7B,CAAC,CAAC;IACH,OAAO,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;AACrF,CAAC;AAED,SAAS,WAAW,CAAC,OAA0B;IAC7C,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC/B,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,IAAI,EAAE,YAAY,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,EAAE,CAAC;QAC1E,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO,OAAO,CACZ,cAAc,EACd,eAAe,OAAO,CAAC,IAAI,uBAAuB,YAAY,CAAC,KAAK,CAAC,EAAE,CACxE,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,KAAK,MAAM,QAAQ,IAAI,gBAAgB,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;QACtC,IAAI,CAAC;YACH,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,CAAC,SAAS,EAAE,MAAM,CAAC,EAAE,CAAC;QACpE,CAAC;QAAC,MAAM,CAAC;YACP,SAAS;QACX,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CACZ,cAAc,EACd,2BAA2B,GAAG,gBAAgB,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAC7E,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,KAAa;IAC1D,OAAO,OAAO,CAAC,cAAc,EAAE,eAAe,IAAI,uBAAuB,KAAK,EAAE,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAC5B,IAAY,EACZ,IAAY,EACZ,OAAO,GAA2B,EAAE;IAEpC,MAAM,QAAQ,GAAG,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAEhC,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,0EAA0E;QAC1E,mEAAmE;QACnE,yCAAyC;QACzC,OAAO,OAAO,CACZ,UAAU,EACV,GAAG,QAAQ,CAAC,IAAI,wBAAwB,kBAAkB,8CAA8C,CACzG,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,OAAO,OAAO,CACZ,UAAU,EACV,GAAG,QAAQ,CAAC,IAAI,cAAc,kBAAkB,qBAAqB,CACtE,CAAC;IACJ,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO,OAAO,CACZ,iBAAiB,EACjB,GAAG,QAAQ,CAAC,IAAI,WAAW,IAAI,CAAC,MAAM,CAAC,MAAM,UAAU,kBAAkB,+CAA+C,CACzH,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACrD,IAAI,IAAI,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC;IAElC,MAAM,UAAU,GAAG,QAAQ,CACzB,QAAQ,EACR,MAAM,CAAC,KAAK,EACZ,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;IACF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,yCAAyC,EACzD,UAAU,CAAC,MAAM,EACjB,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,CAAC,KAAe,CAAC;IAEtC,2EAA2E;IAC3E,0EAA0E;IAC1E,4EAA4E;IAC5E,sEAAsE;IACtE,2EAA2E;IAC3E,2BAA2B;IAC3B,MAAM,YAAY,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC5B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,uCAAuC,EACvD,YAAY,EACZ,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,wEAAwE;IACxE,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,0BAA0B;IAC1B,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC1B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,+BAA+B,EAC/C,UAAU,EACV,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,2EAA2E;IAC3E,uEAAuE;IACvE,4EAA4E;IAC5E,4EAA4E;IAC5E,MAAM,iBAAiB,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjC,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,kCAAkC,EAClD,iBAAiB,EACjB,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,YAAY,CAAC;IAC9C,IAAI,aAAa,GAAkB,IAAI,CAAC;IACxC,IAAI,OAAO,KAAK,SAAS,EAAE,CAAC;QAC1B,aAAa,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;QACvC,IAAI,aAAa,KAAK,IAAI,EAAE,CAAC;YAC3B,uEAAuE;YACvE,kEAAkE;YAClE,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,4BAA4B,OAAO,2BAA2B,EAC9E;gBACE;oBACE,IAAI,EAAE,wBAAwB;oBAC9B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,yEAAyE;IACzE,0EAA0E;IAC1E,+DAA+D;IAC/D,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,EAAE,cAAc,CAAC;IAC9C,IAAI,eAAe,GAAkB,IAAI,CAAC;IAC1C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,eAAe,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC1C,IAAI,eAAe,KAAK,IAAI,EAAE,CAAC;YAC7B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,2BAA2B,QAAQ,2BAA2B,EAC9E;gBACE;oBACE,IAAI,EAAE,uBAAuB;oBAC7B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,0CAA0C;IAC1C,MAAM,cAAc,GAAG,MAAM,CAAC,KAAK,EAAE,gBAAgB,CAAC;IACtD,IAAI,iBAAiB,GAAkB,IAAI,CAAC;IAC5C,IAAI,cAAc,KAAK,SAAS,EAAE,CAAC;QACjC,iBAAiB,GAAG,aAAa,CAAC,cAAc,CAAC,CAAC;QAClD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,6BAA6B,cAAc,2BAA2B,EACtF;gBACE;oBACE,IAAI,EAAE,yBAAyB;oBAC/B,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;IACH,CAAC;IAED,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,kBAAkB,CAAC;IACtD,IAAI,kBAAkB,GAAG,0BAA0B,CAAC,kBAAkB,CAAC;IACvE,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,QAAQ,GAAG,aAAa,CAAC,WAAW,CAAC,CAAC;QAC5C,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;YACtB,OAAO,OAAO,CACZ,gBAAgB,EAChB,GAAG,QAAQ,CAAC,IAAI,gCAAgC,WAAW,2BAA2B,EACtF;gBACE;oBACE,IAAI,EAAE,4BAA4B;oBAClC,OAAO,EAAE,UAAU;oBACnB,OAAO,EAAE,6DAA6D;iBACvE;aACF,EACD,MAAM,CAAC,KAAK,CACb,CAAC;QACJ,CAAC;QACD,kBAAkB,GAAG,QAAQ,CAAC;IAChC,CAAC;IACD,MAAM,UAAU,GAAqB;QACnC,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,IAAI,0BAA0B,CAAC,SAAS;QAC5E,gBAAgB,EACd,MAAM,CAAC,MAAM,EAAE,kBAAkB,IAAI,0BAA0B,CAAC,gBAAgB;QAClF,kBAAkB;QAClB,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,SAAS;KACtC,CAAC;IAEF,MAAM,MAAM,GAAqB;QAC/B,EAAE,EAAE,IAAI;QACR,MAAM;QACN,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE;QAClE,SAAS,EAAE,EAAE,aAAa,EAAE,eAAe,EAAE,iBAAiB,EAAE;QAChE,MAAM,EAAE,UAAU;QAClB,KAAK,EAAE,UAAU,CAAC,MAAM,CAAC;KAC1B,CAAC;IAEF,2EAA2E;IAC3E,6EAA6E;IAC7E,0EAA0E;IAC1E,4BAA4B;IAC5B,MAAM,OAAO,GAAG,mBAAmB,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IACtD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO,OAAO,CAAC,kBAAkB,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,OAAO,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IAC9F,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,KAAK,GAAG,wBAAwB,CAAC,MAAM,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,OAAO,CAAC,uBAAuB,EAAE,GAAG,QAAQ,CAAC,IAAI,KAAK,KAAK,EAAE,EAAE,SAAS,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;IACjG,CAAC;IAED,yEAAyE;IACzE,8EAA8E;IAC9E,6EAA6E;IAC7E,yEAAyE;IACzE,wEAAwE;IACxE,MAAM,OAAO,GAAG,iBAAiB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACrD,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,OAAO,CACZ,wBAAwB,EACxB,GAAG,QAAQ,CAAC,IAAI,4DAA4D,OAAO;aAChF,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,cAAc,GAAG,EAAE,CAAC;aACjC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,6KAA6K,EACjO,uBAAuB,CAAC,OAAO,CAAC,EAChC,MAAM,CAAC,KAAK,CACb,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,MAAM,UAAU,wBAAwB,CAAC,IAAsB;IAC7D,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,OAAO,GAAG,IAAI,CAAC,MAAM,CAAC,eAAe,IAAI,EAAE,CAAC;IAClD,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC;IAErE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;IAC1C,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QACxC,MAAM,WAAW,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;QAC/C,IAAI,WAAW,KAAK,IAAI,IAAI,WAAW,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,cAAc,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,CAAC,4OAA4O,CAAC;QAClV,CAAC;QACD,MAAM,OAAO,GAAG,yBAAyB,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACtD,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,aAAa,EAAE,CAAC;YAC1D,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,sBAAsB,OAAO,YAAY,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,mGAAmG,OAAO,wIAAwI,CAAC;QAC1X,CAAC;QACD,IAAI,OAAO,KAAK,IAAI;YAAE,SAAS;QAE/B,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;QACjD,MAAM,cAAc,GAClB,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,GAAG,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;YACvE,CAAC,UAAU,CAAC,MAAM,CAAC,gBAAgB,CAAC,KAAK,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC;gBACxE,MAAM,CAAC,QAAQ,KAAK,IAAI;gBACxB,IAAI,CAAC,QAAQ,KAAK,IAAI;gBACtB,MAAM,CAAC,QAAQ,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC;QACrC,MAAM,gBAAgB,GAAG,OAAO,CAAC,IAAI,EAAE,aAAa,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7E,MAAM,kBAAkB,GAAG,OAAO,CAAC,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC,CAAC;QACpF,MAAM,kBAAkB,GACtB,UAAU,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;YAC7C,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;YAC/C,CAAC,UAAU,CAAC,kBAAkB,CAAC,gBAAgB,CAAC;gBAC9C,UAAU,CAAC,gBAAgB,CAAC,gBAAgB,CAAC;gBAC7C,kBAAkB,CAAC,QAAQ,KAAK,IAAI;gBACpC,gBAAgB,CAAC,QAAQ,KAAK,IAAI;gBAClC,kBAAkB,CAAC,QAAQ,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;QAC7D,IAAI,cAAc,IAAI,kBAAkB,EAAE,CAAC;YACzC,MAAM,UAAU,GAAG,cAAc;gBAC/B,CAAC,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC,gBAAgB,EAAE,MAAM,CAAC,QAAQ,CAAC,iDAAiD,aAAa,CAAC,IAAI,CAAC,gBAAgB,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE;gBAClK,CAAC,CAAC,GAAG,aAAa,CAAC,kBAAkB,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,QAAQ,CAAC,6EAA6E,aAAa,CAAC,gBAAgB,CAAC,gBAAgB,EAAE,gBAAgB,CAAC,QAAQ,CAAC,wBAAwB,CAAC;YACvQ,OAAO,yBAAyB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,0CAA0C,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,oBAAoB,UAAU,qNAAqN,IAAI,CAAC,SAAS,CAAC,WAAW,CAAC,MAAM,CAAC,iGAAiG,CAAC;QAC/f,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,+DAA+D;AAC/D,SAAS,aAAa,CAAC,QAA0B,EAAE,QAAuB;IACxE,OAAO,QAAQ,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,GAAG,QAAQ,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7E,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,SAAS,UAAU,CAAC,MAAc;IAChC,MAAM,KAAK,GAAiB,EAAE,CAAC;IAC/B,MAAM,GAAG,GAAG,CAAC,KAAa,EAAc,EAAE,CAAC,CAAC;QAC1C,IAAI,EAAE,kBAAkB;QACxB,KAAK;QACL,OAAO,EAAE,eAAe,KAAK,6dAA6d;KAC3f,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,QAAQ,EAAE,QAAQ,KAAK,YAAY;QAAE,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC,CAAC;IACrF,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QAC/D,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,KAAK,YAAY,EAAE,CAAC;YACzD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,UAAU,CAAC,OAAO,GAAsB,EAAE;IACxD,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,IAAI,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IACtC,OAAO,cAAc,CACnB,QAAQ,CAAC,IAAI,EACb,QAAQ,CAAC,IAAI,EACb,OAAO,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CACxE,CAAC;AACJ,CAAC"}

package/dist/src/daemon/git-evidence.d.ts

@@ -71,9 +71,9 @@ import type { LogHead } from "../core/log.js";
  * because a module that resolves its own package root differs between the source
  * tree and the build output for no benefit at all.
  */
-export declare const APPROVALD_VERSION = "0.4.5";
+export declare const APPROVALD_VERSION = "0.4.6";
 /** `user.name` on every commit this module makes. */
-export declare const GIT_EVIDENCE_AUTHOR_NAME = "approvald 0.4.5";
+export declare const GIT_EVIDENCE_AUTHOR_NAME = "approvald 0.4.6";
 /** `user.email` on every commit: fixed, and deliberately undeliverable. */
 export declare const GIT_EVIDENCE_AUTHOR_EMAIL = "approvald@noreply.approval.md";
 /**

package/dist/src/daemon/git-evidence.js

@@ -75,7 +75,7 @@ import { PAYLOAD_STORE_DIRNAME } from "../core/payload-store.js";
  * because a module that resolves its own package root differs between the source
  * tree and the build output for no benefit at all.
  */
-export const APPROVALD_VERSION = "0.4.5";
+export const APPROVALD_VERSION = "0.4.6";
 /** `user.name` on every commit this module makes. */
 export const GIT_EVIDENCE_AUTHOR_NAME = `approvald ${APPROVALD_VERSION}`;
 /** `user.email` on every commit: fixed, and deliberately undeliverable. */

package/docs/README-extended.md

@@ -341,6 +341,7 @@ semantics: SPEC.md section 5.
 | `audit.skew_tolerance` | How far a gate-typed event's timestamp may step back before verification reports an anomaly. Report-only; default 2 seconds (§8). |
 | `audit.checkpoint_keys` | Public halves of the Ed25519 keys permitted to sign a `log.checkpoint`, base64 DER SPKI. The private halves live in the vault and never in this file. A list, so a retired key stays listed: a checkpoint signed by a key the list does not carry is refused. Absent, empty or unreadable means verification skips the checkpoint check with a reason and never reports it as a pass (§9, APRV-220). |
 | `delegation` | The judge's bounds (a pinned model that may later review samples, advise on cards and decide manual cards in named classes). RESERVED in 0.4.2: the block is validated and loads only in its off form (`model: null`, every list empty, `max_autonomy: manual`, `daily_cap: 0`, `advice: false`; `{}` is the same), which changes nothing. Any other value fails the policy closed with `delegation-not-supported`, so every class resolves `manual`. Absent means no judge, exactly as before the key existed. Cores before 0.4.2 refuse the key outright (§5.2 proposed, APRV-500; `docs/cli-reference.md`, policy check). |
+| `exec` | What the operator attests about opaque agent code (`python3 -c`, `node -e`, `deno eval` and kin, an interpreter running a file that is not a skill script, Hermes `execute_code`). `exec.code.custody: attested` opens the `exec.code` class, which then resolves like any class and is recorded by the program's SHA-256 and length, never its text; `exec.code.execute_code: hooked` beside it opens Hermes `execute_code`. Absent, those calls are refused exactly as before the key existed; a policy that names `exec.code` without custody refuses `hook-exec-code-custody-unattested`. Cores before 0.4.5 refuse the key and fail the policy closed (§5.2 and §7 proposed, APRV-510; `docs/hermes-hook.md`). |
 | `delegation.model` | The judge identity, `model:<name>@<major>.<minor>.<patch>`, or `null`. Reserved: non-null is `delegation-not-supported` (APRV-500). |
 | `delegation.classes` | Exact keys of `classes` the judge may act on: no wildcard, not `human-only`, not `autonomous`. Reserved: non-empty is `delegation-not-supported` (APRV-500). |
 | `delegation.max_autonomy` | `manual` (default), `supervised-live` or `supervised-retro`: a pin, so every delegated class must declare an autonomy at least as strict. Reserved: anything but `manual` is `delegation-not-supported` (APRV-500). |
@@ -740,9 +741,9 @@ and the reference phone channel is one app, Telegram.
 | [`backlog/`](../backlog/) | Implementation work and remaining acceptance criteria. A task's existence is not a shipped feature. |
 | [`index.html`](../index.html), [`features/`](../features/), [`llms.txt`](../llms.txt), [`llms-full.txt`](../llms-full.txt) | The website and its machine-readable companions. |
 | [`metrics/`](../metrics/), [`brand/`](../brand/) | Agent-hour badge data and visual assets. Badge activity is not an adoption or security certification. |
-| [`hosted/`](../hosted/README.md), [`judgy/`](../judgy/README.md) | Hosting scaffolding and reviewer/demo pages; separate from the core runtime contract. |
+| [`hosted/`](../hosted/README.md) | Hosting scaffolding; separate from the core runtime contract. |
 
-The hosted directory contains a policy builder and tenant launcher, not a complete account system or managed multi-tenant control plane. Judgy's pages render supplied data and retain simulated/replay/not-run provenance labels; a visualization is not a new authorization path. Neither should be advertised as a finished service merely because its directory exists.
+The hosted directory contains a policy builder and tenant launcher, not a complete account system or managed multi-tenant control plane. It should not be advertised as a finished service merely because its directory exists. The judgy reviewer pages that used to sit beside it left the repository under APRV-393; commit `49574e4d` is the last one that holds them.
 
 ### Running the checks
 

package/docs/cli-reference.md

@@ -3424,9 +3424,13 @@ The checks, at length:
   **fail-closed version floor** (a build at or after `main` `118984d7` of
   2026-09-20) FAILS, because `v0.21.3` ignores `fail_closed` silently and every
   broken hook on it proceeds. That half is read from `hermes --version` rather than
-  from a record — Hermes prints its build stamp behind a non-ASCII separator the
-  write boundary refuses, so no record can carry it — and it compares the build
-  date and the upstream commit, because the two builds report the same semver.
+  from a record, because a record keeps only the printable-ASCII prefix of
+  Hermes's line (APRV-419): the build date survives and the upstream commit
+  behind the non-ASCII separator does not. It compares the build date and the
+  upstream commit, because the two builds report the same semver. Since APRV-419
+  the unverified-change half compares Hermes like any other harness: the prefix,
+  for example `Hermes Agent v0.21.3 (2026.9.14)`, on the newest hook record
+  against the prefix of what `hermes --version` prints now.
 - **live-draw** — whether a daemon is answering `supervised-live` draws for this
   log (APRV-208). SKIP when the policy declares no live class: no draw is ever
   made, and a missing socket is nothing. It FAILS in three shapes, all of them
@@ -4595,7 +4599,7 @@ to.
 
 | Command  | What it does |
 | -------- | ------------ |
-| `/queue` | Replies with the summary and a numbered list of every pending request (action key, task, class, age), marking the one this listener has selected. Derived from the verified log at reply time, and it works while a request is selected. |
+| `/queue` | Replies with the count line and a numbered list of every pending request (the agent's summary and its age, no action key or task id), marking the one this listener has selected. Derived from the verified log at reply time, and it works while a request is selected. |
 | `/skip`  | Selects the next request; the skipped one goes to the BACK of this process's order and comes round again after the rest, with a fresh card when it does. |
 | `/next`  | Selects the next request; this process does not offer the passed-over one again, and sends no further card for it. |
 
@@ -4609,7 +4613,7 @@ it away from you.
 **`/queue` is a list, and it says so** (APRV-256). The reply carries no decision
 buttons of its own, and it names no position for the ones it points at: a
 request is decided on its own approval card, wherever that card has ended up in
-the chat. The marker on the selected line reads `selected — card sent earlier`,
+the chat. The marker on the selected line reads `sent to you earlier`,
 because that is the whole of what the listener knows. Delivery bookkeeping
 records that a send returned success; the Bot API never reports that a message
 is still there, and a card can be deleted, buried, or lost with the chat
@@ -5652,7 +5656,11 @@ semantic-version-shaped tag, `tag <name>`, `--tags`, or `--follow-tags` is
 that DELETES a remote ref — `--delete`, `-d`, or a colon refspec such as
 `:refs/heads/x` — is `vcs.ref.delete` with the ref names bound (APRV-352), and a
 tag deletion keeps `release.publish`; ordinary branch pushes retain their branch
-or trunk class.
+or trunk class. Flags are read the way git's option parser reads them, short
+bundles (`-ud`) and unique-prefix abbreviations (`--del`, `--m`) included, and
+`--prune` is a deletion too (APRV-517); a push git would refuse, or one naming
+a far-side program (`--exec`, `--receive-pack`), is `opaque`, and a word the
+shell may expand is `vcs.history.rewrite`.
 
 `git tag` splits on its flags since APRV-397: a LISTING (`-l`, `--list`, `-n`,
 `-n<num>`, `--contains`, `--points-at`, `--merged`, `--sort`, `--format`,
@@ -5715,7 +5723,12 @@ its own flags are not parsed as this verb's.
   ONE inline script is classified by that script since APRV-380, so
   `zsh -lc 'git push origin main'` is `vcs.push.main`; a script file, an extra
   word, a redirection on the wrapper, an assignment prefix and a nested shell
-  all stay opaque.
+  all stay opaque. So does a shell that is not the system's, named as written
+  (APRV-523): one spelled by a path outside `/bin`, `/usr/bin`,
+  `/usr/local/bin`, `/sbin` and `/usr/sbin` (a relative path, a Homebrew
+  shell under `/opt`), or by a word with an expansion or a backslash in it.
+  An assignment-shaped shell word with a quoted or escaped name is
+  `hook-unclassified`.
 - `hook-unparseable` — the command line could not be tokenized.
 - `hook-rejected` — a human said no.
 - `hook-revoked` — a granted approval was withdrawn.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "approval-md",
-  "version": "0.4.5",
+  "version": "0.4.6",
   "description": "Human approval for agent actions. CLI runtime for the approval.md convention (pre-release).",
   "type": "module",
   "bin": {
@@ -59,5 +59,5 @@
     "better-sqlite3": "12.11.1",
     "yaml": "2.9.0"
   },
-  "gitHead": "2b8aeb3341d59c66f55730b57f1d1991cc512d67"
+  "gitHead": "539cf3b6b847b0446730ed110b7f188660f2a9d7"
 }