auto-mode 0.5.0 → 0.7.0

package/dist/{render-verdict-FdG6gahX.js → render-verdict-CAg3AKWH.js}

@@ -252,7 +252,7 @@ function safeExtend(schema, shape) {
 	if (!isPlainObject(shape)) throw new Error("Invalid input to safeExtend: expected a plain object");
 	return clone(schema, mergeDefs(schema._zod.def, { shape: extended(schema, shape) }));
 }
-function merge$1(a, b) {
+function merge(a, b) {
 	if (!b?._zod?.def) throw new Error("Invalid input to merge: expected an object schema. To merge a plain shape, use `.extend()`.");
 	if (a._zod.def.checks?.length) throw new Error(".merge() cannot be used on object schemas containing refinements. Use .safeExtend() instead.");
 	const newShape = {};
@@ -5218,7 +5218,7 @@ const ZodObject = /*@__PURE__*/ $constructor("ZodObject", (inst, def) => {
 		return safeExtend(this, incoming);
 	},
 	merge(other) {
-		return merge$1(this, other);
+		return merge(this, other);
 	},
 	pick(mask) {
 		return pick(this, mask);
@@ -5569,6 +5569,171 @@ async function loadClaudeRules(path) {
 		hard_deny: (rules.autoMode?.hard_deny ?? []).filter((entry) => entry !== "$defaults")
 	};
 }
+const PRESETS = {
+	jev: {
+		protocol: "system-one",
+		baseURL: "https://api.typesafe.ai",
+		model: "jev-1.13.0",
+		apiKeyEnv: "TYPESAFE_API_KEY",
+		reasoning: false,
+		maxTokens: 3e3,
+		timeoutMs: 5e3
+	},
+	spark: {
+		baseURL: "https://api.meta.ai",
+		model: "muse-spark-1.3-contributor",
+		apiKeyEnv: "META_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 45e3
+	},
+	claude: {
+		baseURL: "https://api.anthropic.com",
+		model: "claude-haiku-4-5-20251001",
+		apiKeyEnv: "ANTHROPIC_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 45e3
+	},
+	glm: {
+		baseURL: "https://api.z.ai/api/anthropic",
+		model: "glm-5.3-flash",
+		apiKeyEnv: "ZAI_API_KEY",
+		reasoning: true,
+		maxTokens: 3e3,
+		timeoutMs: 6e4
+	}
+};
+const MESSAGES_DEFAULTS = {
+	protocol: "messages",
+	baseURL: "https://api.anthropic.com",
+	reasoning: true,
+	maxTokens: 3e3,
+	timeoutMs: 45e3
+};
+function findPreset(id) {
+	return Object.hasOwn(PRESETS, id) ? PRESETS[id] : void 0;
+}
+//#endregion
+//#region src/config/normalize-config-file.ts
+function normalizeConfigFile(json, path) {
+	if (!isRecord(json)) return {
+		file: json,
+		isLegacy: false,
+		warnings: []
+	};
+	const legacyKeys = Object.keys(json).filter((key) => LEGACY_KEYS.has(key));
+	if (legacyKeys.length === 0) return {
+		file: json,
+		isLegacy: false,
+		warnings: []
+	};
+	const currentKeys = Object.keys(json).filter((key) => !LEGACY_KEYS.has(key));
+	if (currentKeys.length > 0) throw new Error(`${path} mixes the old keys (${legacyKeys.join(", ")}) with the new ones (${currentKeys.join(", ")}); run \`auto-mode config migrate\` on a copy without the new keys`);
+	const parsed = legacyConfigSchema.safeParse(json);
+	if (!parsed.success) throw new Error(`${path} is not a valid config: ${prettifyError(parsed.error)}`);
+	const legacy = parsed.data;
+	const warnings = [`${path} uses the old config keys (${legacyKeys.join(", ")}); run \`auto-mode config migrate\` to rewrite it`, ...legacy.transcriptEntries === void 0 ? [] : [`${path} sets transcriptEntries, which has no effect; migration drops it`]];
+	return {
+		file: buildFileFromLegacy(legacy, path),
+		isLegacy: true,
+		warnings
+	};
+}
+function isRecord(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+const LEGACY_KEYS = /* @__PURE__ */ new Set([
+	"preset",
+	"provider",
+	"classifierPath",
+	"rulesPath",
+	"transcriptEntries",
+	"onFailure",
+	"claudeSettingsPath",
+	"minConfidence"
+]);
+const text$1 = string().min(1);
+const positive$1 = number().positive();
+const legacyConfigSchema = strictObject({
+	preset: text$1.optional(),
+	provider: strictObject({
+		protocol: _enum(["messages", "system-one"]).optional(),
+		baseURL: text$1.optional(),
+		model: text$1.optional(),
+		apiKeyEnv: text$1.optional(),
+		apiKeyCommand: text$1.optional(),
+		reasoning: boolean().optional(),
+		maxTokens: positive$1.optional(),
+		timeoutMs: positive$1.optional()
+	}).optional(),
+	classifierPath: text$1.optional(),
+	rulesPath: text$1.optional(),
+	transcriptEntries: number().nonnegative().optional(),
+	onFailure: _enum(["defer", "deny"]).optional(),
+	claudeSettingsPath: text$1.nullable().optional(),
+	minConfidence: number().min(.5).max(1).optional()
+});
+function buildFileFromLegacy(legacy, path) {
+	const hasClassifier = legacy.preset !== void 0 || legacy.provider !== void 0;
+	const decision = {
+		...hasClassifier ? { classifier: getLegacyClassifierID(legacy) } : {},
+		...legacy.minConfidence === void 0 ? {} : { minConfidence: legacy.minConfidence },
+		...legacy.onFailure === void 0 ? {} : { onFailure: legacy.onFailure }
+	};
+	const policy = {
+		...legacy.rulesPath === void 0 ? {} : { rulesPath: legacy.rulesPath },
+		...legacy.classifierPath === void 0 ? {} : { frameworkPath: legacy.classifierPath },
+		...legacy.claudeSettingsPath === void 0 ? {} : { claudeSettingsPath: legacy.claudeSettingsPath }
+	};
+	return {
+		...hasClassifier ? { classifiers: { [getLegacyClassifierID(legacy)]: buildClassifierEntry(getLegacyClassifierID(legacy), buildLegacyProvider(legacy, path)) } } : {},
+		...Object.keys(decision).length === 0 ? {} : { decision },
+		...Object.keys(policy).length === 0 ? {} : { policy }
+	};
+}
+function getLegacyClassifierID(legacy) {
+	if (legacy.preset !== void 0) return legacy.preset;
+	return legacy.provider !== void 0 && legacy.provider.protocol !== "system-one" ? "spark" : "jev";
+}
+function buildLegacyProvider(legacy, path) {
+	const preset = findPreset(getLegacyClassifierID(legacy));
+	if (preset === void 0) throw new Error(`${path} names an unknown preset '${legacy.preset}'; known presets are ${Object.keys(PRESETS).join(", ")}`);
+	const override = legacy.provider ?? {};
+	return {
+		protocol: override.protocol ?? preset.protocol ?? "messages",
+		baseURL: override.baseURL ?? preset.baseURL,
+		model: override.model ?? preset.model,
+		apiKeyEnv: override.apiKeyEnv ?? preset.apiKeyEnv,
+		apiKeyCommand: override.apiKeyCommand ?? preset.apiKeyCommand,
+		reasoning: override.reasoning ?? preset.reasoning,
+		maxTokens: override.maxTokens ?? preset.maxTokens,
+		timeoutMs: override.timeoutMs ?? preset.timeoutMs
+	};
+}
+const PROVIDER_FIELDS = [
+	"baseURL",
+	"model",
+	"apiKeyEnv",
+	"apiKeyCommand",
+	"reasoning",
+	"maxTokens",
+	"timeoutMs"
+];
+function buildClassifierEntry(id, provider) {
+	const kind = pickEntryKind(id, provider);
+	const base = kind === "messages" ? MESSAGES_DEFAULTS : findPreset(kind) ?? {};
+	const fields = Object.fromEntries(PROVIDER_FIELDS.filter((field) => provider[field] !== void 0 && provider[field] !== base[field]).map((field) => [field, provider[field]]));
+	return {
+		...kind === id ? {} : { kind },
+		...fields
+	};
+}
+function pickEntryKind(id, provider) {
+	const preset = findPreset(id);
+	if (preset !== void 0 && (preset.protocol ?? "messages") === provider.protocol) return id;
+	return provider.protocol === "system-one" ? "jev" : "messages";
+}
 //#endregion
 //#region src/config/read-api-key-from-command.ts
 function readApiKeyFromCommand(command, options = {}) {
@@ -5624,73 +5789,24 @@ function readApiKeyFromCommand(command, options = {}) {
 }
 //#endregion
 //#region src/config/config.ts
+const SCOPE_SOURCE_KINDS = [
+	"cwd",
+	"session",
+	"globs",
+	"atc"
+];
+const DEFAULT_PROVIDER = findPreset("jev");
+if (DEFAULT_PROVIDER === void 0) throw new Error("the jev preset is missing");
 const DEFAULT_CONFIG = {
-	provider: {
-		protocol: "system-one",
-		baseURL: "https://api.typesafe.ai",
-		model: "jev-1.13.0",
-		apiKeyEnv: "TYPESAFE_API_KEY",
-		reasoning: false,
-		maxTokens: 3e3,
-		timeoutMs: 5e3
-	},
+	provider: DEFAULT_PROVIDER,
 	onFailure: "defer",
 	minConfidence: .8
 };
-const SPARK_PROVIDER = {
-	baseURL: "https://api.meta.ai",
-	model: "muse-spark-1.3-contributor",
-	apiKeyEnv: "META_API_KEY",
-	reasoning: true,
-	maxTokens: 3e3,
-	timeoutMs: 45e3
-};
-const PRESETS = {
-	jev: DEFAULT_CONFIG.provider,
-	spark: SPARK_PROVIDER,
-	claude: {
-		baseURL: "https://api.anthropic.com",
-		model: "claude-haiku-4-5-20251001",
-		apiKeyEnv: "ANTHROPIC_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 45e3
-	},
-	glm: {
-		baseURL: "https://api.z.ai/api/anthropic",
-		model: "glm-5.3-flash",
-		apiKeyEnv: "ZAI_API_KEY",
-		reasoning: true,
-		maxTokens: 3e3,
-		timeoutMs: 6e4
-	}
-};
 function resolveConfigPath() {
 	const xdg = process.env["XDG_CONFIG_HOME"];
 	const base = xdg !== void 0 && xdg !== "" ? xdg : join(homedir(), ".config");
 	return join(base, "auto-mode", "config.json");
 }
-const text = string().min(1);
-const positive = number().positive();
-const configFileSchema = strictObject({
-	preset: text.optional(),
-	provider: strictObject({
-		protocol: _enum(["messages", "system-one"]).optional(),
-		baseURL: text.optional(),
-		model: text.optional(),
-		apiKeyEnv: text.optional(),
-		apiKeyCommand: text.optional(),
-		reasoning: boolean().optional(),
-		maxTokens: positive.optional(),
-		timeoutMs: positive.optional()
-	}).optional(),
-	classifierPath: text.optional(),
-	rulesPath: text.optional(),
-	transcriptEntries: number().nonnegative().optional(),
-	onFailure: _enum(["defer", "deny"]).optional(),
-	claudeSettingsPath: text.nullable().optional(),
-	minConfidence: number().min(.5).max(1).optional()
-});
 async function loadConfig(path = resolveConfigPath()) {
 	let raw;
 	try {
@@ -5705,33 +5821,141 @@ async function loadConfig(path = resolveConfigPath()) {
 	} catch {
 		throw new Error(`${path} is not valid JSON`);
 	}
+	const normalized = normalizeConfigFile(json, path);
+	return buildConfig(normalized.file, path, normalized.warnings);
+}
+const text = string().min(1);
+const positive = number().positive();
+const configFileSchema = strictObject({
+	classifiers: record(text, unknown()).optional(),
+	scopeSources: record(text, unknown()).optional(),
+	decision: strictObject({
+		classifier: text.optional(),
+		judge: text.nullable().optional(),
+		minConfidence: number().min(.5).max(1).optional(),
+		onFailure: _enum(["defer", "deny"]).optional()
+	}).optional(),
+	policy: strictObject({
+		rulesPath: text.nullable().optional(),
+		frameworkPath: text.nullable().optional(),
+		claudeSettingsPath: text.nullable().optional()
+	}).optional()
+});
+function buildConfig(json, path, legacyWarnings) {
 	const parsed = configFileSchema.safeParse(json);
 	if (!parsed.success) throw new Error(`${path} is not a valid config: ${prettifyError(parsed.error)}`);
-	return merge(parsed.data, path);
+	const file = parsed.data;
+	const warnings = [...legacyWarnings];
+	const classifiers = buildRegistry(file.classifiers ?? {}, (id, entry) => parseClassifierEntry(id, entry));
+	const scopeSources = buildRegistry(file.scopeSources ?? {}, (id, entry) => parseScopeSourceEntry(id, entry));
+	warnings.push(...classifiers.dropped.map((line) => `${path}: classifiers.${line}`), ...scopeSources.dropped.map((line) => `${path}: scopeSources.${line}`));
+	const decision = file.decision ?? {};
+	const policy = file.policy ?? {};
+	const judgeID = decision.judge ?? null;
+	return {
+		provider: resolveRole("classifier", decision.classifier ?? "jev", classifiers.entries, classifiers.droppedIDs, path),
+		judge: judgeID === null ? null : resolveRole("judge", judgeID, classifiers.entries, classifiers.droppedIDs, path),
+		scopeSources: scopeSources.entries,
+		classifierPath: expandHomePath(policy.frameworkPath ?? void 0),
+		rulesPath: expandHomePath(policy.rulesPath ?? void 0),
+		onFailure: decision.onFailure ?? DEFAULT_CONFIG.onFailure,
+		claudeSettingsPath: policy.claudeSettingsPath === null ? null : expandHomePath(policy.claudeSettingsPath),
+		minConfidence: decision.minConfidence ?? DEFAULT_CONFIG.minConfidence,
+		warnings
+	};
 }
-function merge(file, path) {
-	const implicitProvider = file.provider !== void 0 && file.provider.protocol !== "system-one" ? SPARK_PROVIDER : DEFAULT_CONFIG.provider;
-	const preset = file.preset === void 0 ? implicitProvider : PRESETS[file.preset];
-	if (preset === void 0) throw new Error(`${path} names an unknown preset '${file.preset}'; known presets are ${Object.keys(PRESETS).join(", ")}`);
-	const override = file.provider ?? {};
+function buildRegistry(raw, parseEntry) {
+	const entries = /* @__PURE__ */ new Map();
+	const dropped = [];
+	const droppedIDs = [];
+	for (const [id, entry] of Object.entries(raw)) {
+		const result = parseEntry(id, entry);
+		if (typeof result === "string") {
+			dropped.push(`${id} dropped: ${result}`);
+			droppedIDs.push(id);
+		} else entries.set(id, result);
+	}
 	return {
-		provider: {
-			protocol: override.protocol ?? preset.protocol ?? "messages",
-			baseURL: override.baseURL ?? preset.baseURL,
-			model: override.model ?? preset.model,
-			apiKeyEnv: override.apiKeyEnv ?? preset.apiKeyEnv,
-			apiKeyCommand: override.apiKeyCommand ?? preset.apiKeyCommand,
-			reasoning: override.reasoning ?? preset.reasoning,
-			maxTokens: override.maxTokens ?? preset.maxTokens,
-			timeoutMs: override.timeoutMs ?? preset.timeoutMs
-		},
-		classifierPath: file.classifierPath,
-		rulesPath: file.rulesPath,
-		onFailure: file.onFailure ?? DEFAULT_CONFIG.onFailure,
-		claudeSettingsPath: file.claudeSettingsPath,
-		minConfidence: file.minConfidence ?? DEFAULT_CONFIG.minConfidence
+		entries: Object.fromEntries(entries),
+		dropped,
+		droppedIDs
+	};
+}
+const CLASSIFIER_KINDS = [...Object.keys(PRESETS), "messages"];
+const classifierEntrySchema = strictObject({
+	kind: text.optional(),
+	baseURL: text.optional(),
+	model: text.optional(),
+	apiKeyEnv: text.optional(),
+	apiKeyCommand: text.optional(),
+	reasoning: boolean().optional(),
+	maxTokens: positive.optional(),
+	timeoutMs: positive.optional()
+});
+const CREDENTIAL_KEYS = /* @__PURE__ */ new Set([
+	"apiKey",
+	"key",
+	"token",
+	"secret"
+]);
+function parseClassifierEntry(id, entry) {
+	if (typeof entry === "object" && entry !== null) {
+		const credential = Object.keys(entry).find((key) => CREDENTIAL_KEYS.has(key));
+		if (credential !== void 0) return `holds a literal ${credential}; name the key with apiKeyEnv or apiKeyCommand`;
+	}
+	const parsed = classifierEntrySchema.safeParse(entry);
+	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
+	const kind = parsed.data.kind ?? id;
+	if (!CLASSIFIER_KINDS.includes(kind)) return `unknown kind '${kind}'; known kinds are ${CLASSIFIER_KINDS.join(", ")}`;
+	const base = kind === "messages" ? MESSAGES_DEFAULTS : findPreset(kind);
+	const model = parsed.data.model ?? base?.model;
+	if (base === void 0 || model === void 0) return `kind '${kind}' needs a model`;
+	return {
+		protocol: base.protocol ?? "messages",
+		baseURL: parsed.data.baseURL ?? base.baseURL,
+		model,
+		apiKeyEnv: parsed.data.apiKeyEnv ?? base.apiKeyEnv,
+		apiKeyCommand: parsed.data.apiKeyCommand ?? base.apiKeyCommand,
+		reasoning: parsed.data.reasoning ?? base.reasoning,
+		maxTokens: parsed.data.maxTokens ?? base.maxTokens,
+		timeoutMs: parsed.data.timeoutMs ?? base.timeoutMs
 	};
 }
+const scopeSourceEntrySchema = strictObject({
+	kind: text.optional(),
+	paths: array(text).min(1).optional()
+});
+function parseScopeSourceEntry(id, entry) {
+	const parsed = scopeSourceEntrySchema.safeParse(entry);
+	if (!parsed.success) return formatFirstIssue(parsed.error.issues);
+	const kind = SCOPE_SOURCE_KINDS.find((known) => known === (parsed.data.kind ?? id));
+	if (kind === void 0) return `unknown kind '${parsed.data.kind ?? id}'; known kinds are ${SCOPE_SOURCE_KINDS.join(", ")}`;
+	if (kind === "globs") return parsed.data.paths === void 0 ? "kind 'globs' needs paths" : {
+		kind,
+		paths: parsed.data.paths
+	};
+	return parsed.data.paths === void 0 ? { kind } : `kind '${kind}' takes no paths`;
+}
+function formatFirstIssue(issues) {
+	const [issue] = issues;
+	if (issue === void 0) return "invalid entry";
+	return issue.path.length === 0 ? issue.message : `${issue.path.map(String).join(".")}: ${issue.message}`;
+}
+function resolveRole(role, id, entries, droppedIDs, path) {
+	const entry = Object.hasOwn(entries, id) ? entries[id] : void 0;
+	if (entry !== void 0) return entry;
+	if (droppedIDs.includes(id)) throw new Error(`${path}: decision.${role} names '${id}', whose entry was dropped`);
+	if (findPreset(id) === void 0) throw new Error(`${path}: decision.${role} names '${id}', which is neither a classifiers entry nor a built-in kind (${Object.keys(PRESETS).join(", ")})`);
+	return parseBuiltIn(id);
+}
+function parseBuiltIn(id) {
+	const resolved = parseClassifierEntry(id, {});
+	if (typeof resolved === "string") throw new TypeError(`built-in kind ${id} does not resolve: ${resolved}`);
+	return resolved;
+}
+function expandHomePath(path) {
+	return path?.startsWith("~/") === true ? join(homedir(), path.slice(2)) : path;
+}
 function resolveApiKey(provider, options = {}) {
 	const fromEnv = provider.apiKeyEnv === void 0 ? void 0 : process.env[provider.apiKeyEnv];
 	if (fromEnv !== void 0 && fromEnv !== "") return Promise.resolve(fromEnv);
@@ -5739,25 +5963,27 @@ function resolveApiKey(provider, options = {}) {
 	return readApiKeyFromCommand(provider.apiKeyCommand, options);
 }
 //#endregion
+//#region src/policy/resolve-shipped-policy-dir.ts
+function resolveShippedPolicyDir() {
+	let dir = import.meta.dirname;
+	for (;;) {
+		if (existsSync(join(dir, "policy", "classifier.md"))) return join(dir, "policy");
+		const parent = dirname(dir);
+		if (parent === dir || dir === parse(dir).root) throw new Error("auto-mode cannot find its shipped policy/ directory");
+		dir = parent;
+	}
+}
+//#endregion
 //#region src/policy/load-policy.ts
 const RULES_MARKER = "<rules>";
 async function loadPolicy(paths = {}, framework = "classifier.md") {
-	const shipped = findShippedPolicyDir();
+	const shipped = resolveShippedPolicyDir();
 	const classifierPath = paths.classifierPath ?? join(shipped, framework);
 	const rulesPath = paths.rulesPath ?? join(shipped, "rules.md");
 	const [classifier, rules] = await Promise.all([readFile(classifierPath, "utf8"), readFile(rulesPath, "utf8")]);
 	if (!classifier.includes(RULES_MARKER)) throw new Error(`${classifierPath} has no ${RULES_MARKER} line, so the rules cannot be placed`);
 	return classifier.replace(RULES_MARKER, rules.trim());
 }
-function findShippedPolicyDir() {
-	let dir = import.meta.dirname;
-	for (;;) {
-		if (existsSync(join(dir, "policy", "classifier.md"))) return join(dir, "policy");
-		const parent = dirname(dir);
-		if (parent === dir || dir === parse(dir).root) throw new Error("auto-mode cannot find its shipped policy/ directory");
-		dir = parent;
-	}
-}
 //#endregion
 //#region src/model/anthropic-client.ts
 async function sendMessage(provider, apiKey, request) {
@@ -5946,12 +6172,38 @@ function buildEvidenceGuidance(name) {
 	return "";
 }
 //#endregion
+//#region src/model/classify-decision-answers.ts
+function classifyDecisionAnswers(request, result, minConfidence) {
+	const entries = Object.entries(request.rules).map(([id, rule]) => {
+		const answer = result.answers[id];
+		if (answer === void 0) throw new Error("Decision answer missing");
+		return {
+			rule,
+			answer
+		};
+	});
+	for (const tier of ["hard", "soft"]) for (const entry of entries) if (entry.rule.tier === tier && entry.answer.choice === "block" && entry.answer.confidence >= minConfidence && entry.answer.probabilities.block >= minConfidence) return {
+		kind: "block",
+		rule: entry.rule
+	};
+	let uncertain = null;
+	for (const entry of entries) {
+		const answer = entry.answer;
+		if (!(answer.choice === "allow" && answer.confidence >= minConfidence && answer.probabilities.allow >= minConfidence) && (uncertain === null || answer.probabilities.block > uncertain.answer.probabilities.block)) uncertain = entry;
+	}
+	return uncertain === null ? { kind: "allow" } : {
+		kind: "uncertain",
+		rule: uncertain.rule
+	};
+}
+//#endregion
 //#region src/model/collect-decision-contributors.ts
-function collectDecisionContributors(request, result, verdict, minConfidence) {
+function collectDecisionContributors(request, result, minConfidence) {
+	const decision = classifyDecisionAnswers(request, result, minConfidence);
 	return Object.entries(request.rules).flatMap(([id, rule]) => {
 		const answer = result.answers[id];
 		if (answer === void 0) throw new Error("Decision answer missing");
-		return (verdict.kind === "deny" ? rule.name === verdict.rule : verdict.kind === "ask" && (answer.choice !== "allow" || answer.confidence < minConfidence || answer.probabilities.allow < minConfidence)) ? [{
+		return (decision.kind === "block" ? rule === decision.rule : decision.kind === "uncertain" && (answer.choice !== "allow" || answer.confidence < minConfidence || answer.probabilities.allow < minConfidence)) ? [{
 			rule: rule.source === "shipped" ? rule.name : id,
 			source: rule.source,
 			tier: rule.tier,
@@ -6041,89 +6293,466 @@ function parseReference(content, prefix) {
 	return branch !== "" && branch.length <= 256 && !/\s/u.test(branch) ? branch : null;
 }
 //#endregion
-//#region src/model/pick-decision-verdict.ts
-function pickDecisionVerdict(request, result, minConfidence) {
-	const entries = Object.entries(request.rules);
-	for (const tier of ["hard", "soft"]) for (const [id, rule] of entries) {
-		const answer = result.answers[id];
-		if (answer === void 0) throw new Error("Decision answer missing");
-		if (rule.tier === tier && answer.choice === "block" && answer.confidence >= minConfidence && answer.probabilities.block >= minConfidence) return {
-			kind: "deny",
-			rule: rule.name,
-			reason: `The action matches ${rule.name}.`
-		};
-	}
-	for (const [id] of entries) {
-		const answer = result.answers[id];
-		if (answer === void 0) throw new Error("Decision answer missing");
-		if (answer.choice !== "allow" || answer.confidence < minConfidence || answer.probabilities.allow < minConfidence) return { kind: "ask" };
-	}
-	return { kind: "allow" };
-}
-//#endregion
-//#region src/model/send-decision.ts
-async function sendDecision(provider, apiKey, request, signal) {
-	const input = {
-		model: provider.model,
-		state: { ...request.state },
-		questions: request.questions
-	};
-	let body = JSON.stringify(input);
-	for (const field of ["delegatedTask", "originalUserTask"]) {
-		const context = input.state.taskContext;
-		if (Buffer.byteLength(body) <= 1e5 || context === void 0 || context[field] === null) continue;
-		input.state.taskContext = {
-			...context,
-			[field]: null,
-			omittedTaskContext: [...context.omittedTaskContext.filter((item) => item.field !== field), {
-				field,
-				reason: "budget"
-			}]
-		};
-		body = JSON.stringify(input);
+//#region node_modules/.bun/ts-pattern@5.9.0/node_modules/ts-pattern/dist/index.js
+const t = Symbol.for("@ts-pattern/matcher");
+const e = Symbol.for("@ts-pattern/isVariadic");
+const n = "@ts-pattern/anonymous-select-key";
+const r = (t) => Boolean(t && "object" == typeof t);
+const i = (e) => e && !!e[t];
+const o = (n, s, c) => {
+	if (i(n)) {
+		const { matched: r, selections: i } = n[t]().match(s);
+		return r && i && Object.keys(i).forEach((t) => c(t, i[t])), r;
 	}
-	const requestBytes = Buffer.byteLength(body);
-	if (requestBytes > 1e5) throw new DecisionRequestError("request-too-large", requestBytes, "Decision input exceeds 100000 bytes; refusing to truncate the action or user message");
-	const controller = new AbortController();
-	const stopRequest = () => {
-		controller.abort();
-	};
-	signal?.addEventListener("abort", stopRequest, { once: true });
-	if (signal?.aborted === true) controller.abort();
-	const timer = setTimeout(() => {
-		controller.abort();
-	}, provider.timeoutMs);
-	try {
-		let response;
-		try {
-			response = await fetch(`${provider.baseURL.replace(/\/$/, "")}/v1/systemone`, {
-				method: "POST",
-				signal: controller.signal,
-				headers: {
-					"content-type": "application/json",
-					authorization: `Bearer ${apiKey}`
-				},
-				body
-			});
-		} catch (error) {
-			if (error instanceof Error && error.name === "AbortError") throw new DecisionRequestError("aborted", requestBytes, "Decision request aborted", { cause: error });
-			throw new DecisionRequestError("network", requestBytes, "Decision API request failed");
+	if (r(n)) {
+		if (!r(s)) return !1;
+		if (Array.isArray(n)) {
+			if (!Array.isArray(s)) return !1;
+			let t = [], r = [], u = [];
+			for (const o of n.keys()) {
+				const s = n[o];
+				i(s) && s[e] ? u.push(s) : u.length ? r.push(s) : t.push(s);
+			}
+			if (u.length) {
+				if (u.length > 1) throw new Error("Pattern error: Using `...P.array(...)` several times in a single pattern is not allowed.");
+				if (s.length < t.length + r.length) return !1;
+				const e = s.slice(0, t.length), n = 0 === r.length ? [] : s.slice(-r.length), i = s.slice(t.length, 0 === r.length ? Infinity : -r.length);
+				return t.every((t, n) => o(t, e[n], c)) && r.every((t, e) => o(t, n[e], c)) && (0 === u.length || o(u[0], i, c));
+			}
+			return n.length === s.length && n.every((t, e) => o(t, s[e], c));
 		}
-		if (!response.ok) throw new DecisionRequestError("http-status", requestBytes, `Decision API returned HTTP ${response.status}`);
-		const probability = number().min(0).max(1);
-		const answer = object({
-			type: literal("choice"),
-			choice: _enum([
-				"allow",
-				"block",
-				"ask"
-			]),
-			confidence: probability,
-			probabilities: strictObject({
-				allow: probability,
-				block: probability,
-				ask: probability
-			})
+		return Reflect.ownKeys(n).every((e) => {
+			const r = n[e];
+			return (e in s || i(u = r) && "optional" === u[t]().matcherType) && o(r, s[e], c);
+			var u;
+		});
+	}
+	return Object.is(s, n);
+};
+const s = (e) => {
+	var n, o, u;
+	return r(e) ? i(e) ? null != (n = null == (o = (u = e[t]()).getSelectionKeys) ? void 0 : o.call(u)) ? n : [] : Array.isArray(e) ? c(e, s) : c(Object.values(e), s) : [];
+};
+const c = (t, e) => t.reduce((t, n) => t.concat(e(n)), []);
+function a(t) {
+	return Object.assign(t, {
+		optional: () => h(t),
+		and: (e) => d(t, e),
+		or: (e) => y(t, e),
+		select: (e) => void 0 === e ? v(t) : v(e, t)
+	});
+}
+function h(e) {
+	return a({ [t]: () => ({
+		match: (t) => {
+			let n = {};
+			const r = (t, e) => {
+				n[t] = e;
+			};
+			return void 0 === t ? (s(e).forEach((t) => r(t, void 0)), {
+				matched: !0,
+				selections: n
+			}) : {
+				matched: o(e, t, r),
+				selections: n
+			};
+		},
+		getSelectionKeys: () => s(e),
+		matcherType: "optional"
+	}) });
+}
+function d(...e) {
+	return a({ [t]: () => ({
+		match: (t) => {
+			let n = {};
+			const r = (t, e) => {
+				n[t] = e;
+			};
+			return {
+				matched: e.every((e) => o(e, t, r)),
+				selections: n
+			};
+		},
+		getSelectionKeys: () => c(e, s),
+		matcherType: "and"
+	}) });
+}
+function y(...e) {
+	return a({ [t]: () => ({
+		match: (t) => {
+			let n = {};
+			const r = (t, e) => {
+				n[t] = e;
+			};
+			return c(e, s).forEach((t) => r(t, void 0)), {
+				matched: e.some((e) => o(e, t, r)),
+				selections: n
+			};
+		},
+		getSelectionKeys: () => c(e, s),
+		matcherType: "or"
+	}) });
+}
+function p(e) {
+	return { [t]: () => ({ match: (t) => ({ matched: Boolean(e(t)) }) }) };
+}
+function v(...e) {
+	const r = "string" == typeof e[0] ? e[0] : void 0, i = 2 === e.length ? e[1] : "string" == typeof e[0] ? void 0 : e[0];
+	return a({ [t]: () => ({
+		match: (t) => {
+			let e = { [null != r ? r : n]: t };
+			return {
+				matched: void 0 === i || o(i, t, (t, n) => {
+					e[t] = n;
+				}),
+				selections: e
+			};
+		},
+		getSelectionKeys: () => [null != r ? r : n].concat(void 0 === i ? [] : s(i))
+	}) });
+}
+function b(t) {
+	return !0;
+}
+function w(t) {
+	return "number" == typeof t;
+}
+function S(t) {
+	return "string" == typeof t;
+}
+function j(t) {
+	return "bigint" == typeof t;
+}
+a(p(b));
+a(p(b));
+const x = (t) => Object.assign(a(t), {
+	startsWith: (e) => {
+		return x(d(t, (n = e, p((t) => S(t) && t.startsWith(n)))));
+		var n;
+	},
+	endsWith: (e) => {
+		return x(d(t, (n = e, p((t) => S(t) && t.endsWith(n)))));
+		var n;
+	},
+	minLength: (e) => x(d(t, ((t) => p((e) => S(e) && e.length >= t))(e))),
+	length: (e) => x(d(t, ((t) => p((e) => S(e) && e.length === t))(e))),
+	maxLength: (e) => x(d(t, ((t) => p((e) => S(e) && e.length <= t))(e))),
+	includes: (e) => {
+		return x(d(t, (n = e, p((t) => S(t) && t.includes(n)))));
+		var n;
+	},
+	regex: (e) => {
+		return x(d(t, (n = e, p((t) => S(t) && Boolean(t.match(n))))));
+		var n;
+	}
+});
+x(p(S));
+const N = (t) => Object.assign(a(t), {
+	between: (e, n) => N(d(t, ((t, e) => p((n) => w(n) && t <= n && e >= n))(e, n))),
+	lt: (e) => N(d(t, ((t) => p((e) => w(e) && e < t))(e))),
+	gt: (e) => N(d(t, ((t) => p((e) => w(e) && e > t))(e))),
+	lte: (e) => N(d(t, ((t) => p((e) => w(e) && e <= t))(e))),
+	gte: (e) => N(d(t, ((t) => p((e) => w(e) && e >= t))(e))),
+	int: () => N(d(t, p((t) => w(t) && Number.isInteger(t)))),
+	finite: () => N(d(t, p((t) => w(t) && Number.isFinite(t)))),
+	positive: () => N(d(t, p((t) => w(t) && t > 0))),
+	negative: () => N(d(t, p((t) => w(t) && t < 0)))
+});
+N(p(w));
+const k = (t) => Object.assign(a(t), {
+	between: (e, n) => k(d(t, ((t, e) => p((n) => j(n) && t <= n && e >= n))(e, n))),
+	lt: (e) => k(d(t, ((t) => p((e) => j(e) && e < t))(e))),
+	gt: (e) => k(d(t, ((t) => p((e) => j(e) && e > t))(e))),
+	lte: (e) => k(d(t, ((t) => p((e) => j(e) && e <= t))(e))),
+	gte: (e) => k(d(t, ((t) => p((e) => j(e) && e >= t))(e))),
+	positive: () => k(d(t, p((t) => j(t) && t > 0))),
+	negative: () => k(d(t, p((t) => j(t) && t < 0)))
+});
+k(p(j)), a(p(function(t) {
+	return "boolean" == typeof t;
+})), a(p(function(t) {
+	return "symbol" == typeof t;
+})), a(p(function(t) {
+	return null == t;
+})), a(p(function(t) {
+	return null != t;
+}));
+var I = class extends Error {
+	constructor(t) {
+		let e;
+		try {
+			e = JSON.stringify(t);
+		} catch (n) {
+			e = t;
+		}
+		super(`Pattern matching error: no pattern matches value ${e}`), this.input = void 0, this.input = t;
+	}
+};
+const L = {
+	matched: !1,
+	value: void 0
+};
+function M(t) {
+	return new R(t, L);
+}
+var R = class R {
+	constructor(t, e) {
+		this.input = void 0, this.state = void 0, this.input = t, this.state = e;
+	}
+	with(...t) {
+		if (this.state.matched) return this;
+		const e = t[t.length - 1], r = [t[0]];
+		let i;
+		3 === t.length && "function" == typeof t[1] ? i = t[1] : t.length > 2 && r.push(...t.slice(1, t.length - 1));
+		let s = !1, c = {};
+		const u = (t, e) => {
+			s = !0, c[t] = e;
+		}, a = !r.some((t) => o(t, this.input, u)) || i && !Boolean(i(this.input)) ? L : {
+			matched: !0,
+			value: e(s ? n in c ? c[n] : c : this.input, this.input)
+		};
+		return new R(this.input, a);
+	}
+	when(t, e) {
+		if (this.state.matched) return this;
+		const n = Boolean(t(this.input));
+		return new R(this.input, n ? {
+			matched: !0,
+			value: e(this.input, this.input)
+		} : L);
+	}
+	otherwise(t) {
+		return this.state.matched ? this.state.value : t(this.input);
+	}
+	exhaustive(t = F) {
+		return this.state.matched ? this.state.value : t(this.input);
+	}
+	run() {
+		return this.exhaustive();
+	}
+	returnType() {
+		return this;
+	}
+	narrow() {
+		return this;
+	}
+};
+function F(t) {
+	throw new I(t);
+}
+//#endregion
+//#region src/policy/deny-reasons.ts
+const DENY_REASONS = {
+	"Data Exfiltration": {
+		tier: "hard",
+		harm: "sending sensitive data, such as credentials or private code, off the machine",
+		clears: "No instruction or configuration clears this rule."
+	},
+	"Secret Persistence": {
+		tier: "hard",
+		harm: "writing a credential in plain text into a tracked file, an image, CI configuration, or a shipped log",
+		clears: "No instruction or configuration clears this rule."
+	},
+	"Policy Tampering": {
+		tier: "hard",
+		harm: "changing auto-mode's own configuration, policy, or hook, or the settings that decide whether it runs",
+		clears: "Only a direct user message that explains why this match is wrong clears it; bare consent does not."
+	},
+	"Audit Tampering": {
+		tier: "hard",
+		harm: "deleting or rewriting logs, shell history, audit records, or git history to hide what happened",
+		clears: "Only a direct user message that explains why this match is wrong clears it; bare consent does not."
+	},
+	"Destructive Payload": {
+		tier: "hard",
+		harm: "writing or running code whose purpose is damage or spread",
+		clears: "No instruction or configuration clears this rule."
+	},
+	"Irreversible Deletion": {
+		tier: "soft",
+		harm: "deleting data that no backup, remote, or build step can restore",
+		clears: "A direct user instruction that asks for this deletion and names the path clears it."
+	},
+	"Uncommitted Work Destruction": {
+		tier: "soft",
+		harm: "discarding working-tree changes that exist nowhere else",
+		clears: "A direct user instruction that says those changes go away clears it."
+	},
+	"History Rewrite": {
+		tier: "soft",
+		harm: "rewriting history that others may already hold",
+		clears: "A direct user instruction that names the force push, the rewrite, or the remote branch clears it."
+	},
+	"Default Branch Write": {
+		tier: "soft",
+		harm: "committing, pushing, or merging directly to the default branch",
+		clears: "A direct user instruction that names the branch clears it."
+	},
+	"Publish and Release": {
+		tier: "soft",
+		harm: "putting an artifact where other people install it",
+		clears: "A direct user instruction that says publish, release, or deploy and names the target clears it."
+	},
+	"Outbound Communication": {
+		tier: "soft",
+		harm: "sending content that reaches another person",
+		clears: "A direct user instruction that says the message is sent, and to whom or where, clears it."
+	},
+	"Remote Code Execution": {
+		tier: "soft",
+		harm: "running code fetched from a source the user did not name",
+		clears: "A direct user instruction that names the source clears it."
+	},
+	"Obfuscated Command": {
+		tier: "soft",
+		harm: "running a command whose payload cannot be read",
+		clears: "A direct user message that supplies the decoded command or states what it runs clears it."
+	},
+	"Network Exposure": {
+		tier: "soft",
+		harm: "making this machine or its files reachable from outside it",
+		clears: "A direct user instruction that names the service and says it becomes reachable clears it."
+	},
+	"Unnamed Destination": {
+		tier: "soft",
+		harm: "sending content to a network destination the user never named",
+		clears: "A direct user instruction that names the destination clears it."
+	},
+	"Shared Infrastructure": {
+		tier: "soft",
+		harm: "changing a cluster, a cloud account, a remote host, or a repository's settings",
+		clears: "A direct user instruction that names the environment or the resource clears it."
+	},
+	"Destructive Database Operation": {
+		tier: "soft",
+		harm: "deleting or overwriting stored data wholesale in a database that is not local",
+		clears: "A direct user instruction that names the table or the database, and the operation, clears it."
+	},
+	"Persistent Configuration": {
+		tier: "soft",
+		harm: "a change that outlives the session or widens access on this machine",
+		clears: "A direct user instruction that names the file or the setting clears it."
+	},
+	"Credential Exploration": {
+		tier: "soft",
+		harm: "reading or searching for credentials the task never called for",
+		clears: "A direct user instruction that names the file or the search clears it."
+	},
+	"Interrupted Action Retry": {
+		tier: "soft",
+		harm: "running again an action the user interrupted",
+		clears: "A direct user instruction that asks for the action to run again clears it."
+	},
+	"Security Control Removal": {
+		tier: "soft",
+		harm: "removing a control that protects someone other than the agent",
+		clears: "A direct user instruction that names the control clears it."
+	},
+	"Mass Modification": {
+		tier: "soft",
+		harm: "changing many things at once with no way to restore them",
+		clears: "A direct user instruction that names the scope clears it."
+	}
+};
+//#endregion
+//#region src/policy/build-deny-reason.ts
+function buildDenyReason(rule, basis) {
+	const template = getReasonTemplate(rule);
+	return `${basis === "matched" ? `The action matches this rule: ${template.harm}.` : `The supplied evidence cannot rule out ${template.harm}.`} ${template.clears}`;
+}
+function getReasonTemplate(rule) {
+	return M(rule.source).with("shipped", () => {
+		const template = DENY_REASONS[rule.name];
+		if (template === void 0) throw new Error(`No deny reason for the shipped rule ${rule.name}`);
+		return template;
+	}).with("configured", () => rule.tier === "hard" ? {
+		harm: "an action that a hard deny entry in the user's auto-mode configuration covers",
+		clears: "Only a change to that configuration clears it."
+	} : {
+		harm: "an action that a soft deny entry in the user's auto-mode configuration covers",
+		clears: "A direct user instruction that asks for this specific action clears it."
+	}).with("replacement", () => ({
+		harm: "the harm this rule of the configured replacement policy describes",
+		clears: "The replacement policy defines what clears it."
+	})).exhaustive();
+}
+//#endregion
+//#region src/model/pick-decision-verdict.ts
+function pickDecisionVerdict(request, result, minConfidence) {
+	return M(classifyDecisionAnswers(request, result, minConfidence)).with({ kind: "allow" }, () => ({ kind: "allow" })).with({ kind: "block" }, (decision) => ({
+		kind: "deny",
+		rule: decision.rule.name,
+		reason: buildDenyReason(decision.rule, "matched")
+	})).with({ kind: "uncertain" }, (decision) => ({
+		kind: "deny",
+		rule: decision.rule.name,
+		reason: buildDenyReason(decision.rule, "unresolved")
+	})).exhaustive();
+}
+//#endregion
+//#region src/model/send-decision.ts
+async function sendDecision(provider, apiKey, request, signal) {
+	const input = {
+		model: provider.model,
+		state: { ...request.state },
+		questions: request.questions
+	};
+	let body = JSON.stringify(input);
+	for (const field of ["delegatedTask", "originalUserTask"]) {
+		const context = input.state.taskContext;
+		if (Buffer.byteLength(body) <= 1e5 || context === void 0 || context[field] === null) continue;
+		input.state.taskContext = {
+			...context,
+			[field]: null,
+			omittedTaskContext: [...context.omittedTaskContext.filter((item) => item.field !== field), {
+				field,
+				reason: "budget"
+			}]
+		};
+		body = JSON.stringify(input);
+	}
+	const requestBytes = Buffer.byteLength(body);
+	if (requestBytes > 1e5) throw new DecisionRequestError("request-too-large", requestBytes, "Decision input exceeds 100000 bytes; refusing to truncate the action or user message");
+	const controller = new AbortController();
+	const stopRequest = () => {
+		controller.abort();
+	};
+	signal?.addEventListener("abort", stopRequest, { once: true });
+	if (signal?.aborted === true) controller.abort();
+	const timer = setTimeout(() => {
+		controller.abort();
+	}, provider.timeoutMs);
+	try {
+		let response;
+		try {
+			response = await fetch(`${provider.baseURL.replace(/\/$/, "")}/v1/systemone`, {
+				method: "POST",
+				signal: controller.signal,
+				headers: {
+					"content-type": "application/json",
+					authorization: `Bearer ${apiKey}`
+				},
+				body
+			});
+		} catch (error) {
+			if (error instanceof Error && error.name === "AbortError") throw new DecisionRequestError("aborted", requestBytes, "Decision request aborted", { cause: error });
+			throw new DecisionRequestError("network", requestBytes, "Decision API request failed");
+		}
+		if (!response.ok) throw new DecisionRequestError("http-status", requestBytes, `Decision API returned HTTP ${response.status}`);
+		const probability = number().min(0).max(1);
+		const answer = object({
+			type: literal("choice"),
+			choice: _enum([
+				"allow",
+				"block",
+				"ask"
+			]),
+			confidence: probability,
+			probabilities: strictObject({
+				allow: probability,
+				block: probability,
+				ask: probability
+			})
 		});
 		const schema = object({
 			model: string().min(1),
@@ -6208,7 +6837,7 @@ async function classifyWithJev(payload, config, options = {}) {
 				requestBytes: result.requestBytes,
 				elapsedMs: Math.round(performance.now() - start),
 				minConfidence,
-				contributors: collectDecisionContributors(request, result, verdict, minConfidence)
+				contributors: collectDecisionContributors(request, result, minConfidence)
 			},
 			note: formatClassifierNote(`${config.provider.model}: ${verdict.kind} (${Math.round(performance.now() - start)}ms, ${result.inputTokens} input tokens)`, key)
 		};
@@ -6260,10 +6889,20 @@ function parseModelVerdict(text) {
 	const rule = RULE.exec(text)?.[1]?.trim();
 	if (rule === void 0 || rule === "") return { kind: "allow" };
 	const stripped = (REASON.exec(text)?.[1]?.trim())?.replace(/^\[[^\]]*\]\s*/, "") ?? "";
+	if (stripped !== "") return {
+		kind: "deny",
+		rule,
+		reason: stripped
+	};
+	const template = DENY_REASONS[rule];
 	return {
 		kind: "deny",
 		rule,
-		reason: stripped === "" ? "the policy blocks this action." : stripped
+		reason: template === void 0 ? "The action matches this rule." : buildDenyReason({
+			name: rule,
+			tier: template.tier,
+			source: "shipped"
+		}, "matched")
 	};
 }
 //#endregion
@@ -6321,6 +6960,11 @@ function toMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
+//#region src/policy/read-denial-guidance.ts
+async function readDenialGuidance() {
+	return (await readFile(join(resolveShippedPolicyDir(), "denial.md"), "utf8")).trim();
+}
+//#endregion
 //#region node_modules/.bun/tiny-invariant@1.3.3/node_modules/tiny-invariant/dist/esm/tiny-invariant.js
 var isProduction = process.env.NODE_ENV === "production";
 var prefix = "Invariant failed";
@@ -6557,12 +7201,9 @@ async function classifyAction(request, config, options = {}) {
 	if (config.provider.protocol === "system-one") try {
 		configured = await loadClaudeRules(config.claudeSettingsPath);
 	} catch {
+		const guidance = config.onFailure === "deny" ? await tryReadDenialGuidance() : null;
 		return {
-			verdict: config.onFailure === "deny" ? {
-				kind: "deny",
-				rule: "Classifier Unavailable",
-				reason: "Claude settings unreadable"
-			} : null,
+			verdict: config.onFailure === "deny" ? buildGuidedDeny("Classifier Unavailable", "Claude settings unreadable.", guidance) : null,
 			note: "Claude settings unreadable; classifier unavailable",
 			status: "failure",
 			unavailable: true
@@ -6579,12 +7220,28 @@ async function classifyAction(request, config, options = {}) {
 		note: `${request.toolName} needs the model tier, which this run skipped`,
 		status: "skipped"
 	};
-	const outcome = await classifyWithModel(request, config, options);
+	const [outcome, guidance] = await Promise.all([classifyWithModel(request, config, options), tryReadDenialGuidance()]);
 	return {
 		...outcome,
+		verdict: outcome.verdict?.kind === "deny" ? buildGuidedDeny(outcome.verdict.rule, outcome.verdict.reason, guidance) : outcome.verdict,
 		status: outcome.diagnostics?.status ?? outcome.verdict?.kind ?? "failure"
 	};
 }
+function buildGuidedDeny(rule, reason, guidance) {
+	const sentence = /[.!?]$/u.test(reason) ? reason : `${reason}.`;
+	return {
+		kind: "deny",
+		rule,
+		reason: guidance === null ? sentence : `${sentence} ${guidance}`
+	};
+}
+async function tryReadDenialGuidance() {
+	try {
+		return await readDenialGuidance();
+	} catch {
+		return null;
+	}
+}
 //#endregion
 //#region src/request/parse-action-request.ts
 const userTaskSchema = strictObject({
@@ -6635,260 +7292,12 @@ function parseActionRequest(body) {
 	};
 }
 //#endregion
-//#region node_modules/.bun/ts-pattern@5.9.0/node_modules/ts-pattern/dist/index.js
-const t = Symbol.for("@ts-pattern/matcher");
-const e = Symbol.for("@ts-pattern/isVariadic");
-const n = "@ts-pattern/anonymous-select-key";
-const r = (t) => Boolean(t && "object" == typeof t);
-const i = (e) => e && !!e[t];
-const o = (n, s, c) => {
-	if (i(n)) {
-		const { matched: r, selections: i } = n[t]().match(s);
-		return r && i && Object.keys(i).forEach((t) => c(t, i[t])), r;
-	}
-	if (r(n)) {
-		if (!r(s)) return !1;
-		if (Array.isArray(n)) {
-			if (!Array.isArray(s)) return !1;
-			let t = [], r = [], u = [];
-			for (const o of n.keys()) {
-				const s = n[o];
-				i(s) && s[e] ? u.push(s) : u.length ? r.push(s) : t.push(s);
-			}
-			if (u.length) {
-				if (u.length > 1) throw new Error("Pattern error: Using `...P.array(...)` several times in a single pattern is not allowed.");
-				if (s.length < t.length + r.length) return !1;
-				const e = s.slice(0, t.length), n = 0 === r.length ? [] : s.slice(-r.length), i = s.slice(t.length, 0 === r.length ? Infinity : -r.length);
-				return t.every((t, n) => o(t, e[n], c)) && r.every((t, e) => o(t, n[e], c)) && (0 === u.length || o(u[0], i, c));
-			}
-			return n.length === s.length && n.every((t, e) => o(t, s[e], c));
-		}
-		return Reflect.ownKeys(n).every((e) => {
-			const r = n[e];
-			return (e in s || i(u = r) && "optional" === u[t]().matcherType) && o(r, s[e], c);
-			var u;
-		});
-	}
-	return Object.is(s, n);
-};
-const s = (e) => {
-	var n, o, u;
-	return r(e) ? i(e) ? null != (n = null == (o = (u = e[t]()).getSelectionKeys) ? void 0 : o.call(u)) ? n : [] : Array.isArray(e) ? c(e, s) : c(Object.values(e), s) : [];
-};
-const c = (t, e) => t.reduce((t, n) => t.concat(e(n)), []);
-function a(t) {
-	return Object.assign(t, {
-		optional: () => h(t),
-		and: (e) => d(t, e),
-		or: (e) => y(t, e),
-		select: (e) => void 0 === e ? v(t) : v(e, t)
-	});
-}
-function h(e) {
-	return a({ [t]: () => ({
-		match: (t) => {
-			let n = {};
-			const r = (t, e) => {
-				n[t] = e;
-			};
-			return void 0 === t ? (s(e).forEach((t) => r(t, void 0)), {
-				matched: !0,
-				selections: n
-			}) : {
-				matched: o(e, t, r),
-				selections: n
-			};
-		},
-		getSelectionKeys: () => s(e),
-		matcherType: "optional"
-	}) });
-}
-function d(...e) {
-	return a({ [t]: () => ({
-		match: (t) => {
-			let n = {};
-			const r = (t, e) => {
-				n[t] = e;
-			};
-			return {
-				matched: e.every((e) => o(e, t, r)),
-				selections: n
-			};
-		},
-		getSelectionKeys: () => c(e, s),
-		matcherType: "and"
-	}) });
-}
-function y(...e) {
-	return a({ [t]: () => ({
-		match: (t) => {
-			let n = {};
-			const r = (t, e) => {
-				n[t] = e;
-			};
-			return c(e, s).forEach((t) => r(t, void 0)), {
-				matched: e.some((e) => o(e, t, r)),
-				selections: n
-			};
-		},
-		getSelectionKeys: () => c(e, s),
-		matcherType: "or"
-	}) });
-}
-function p(e) {
-	return { [t]: () => ({ match: (t) => ({ matched: Boolean(e(t)) }) }) };
-}
-function v(...e) {
-	const r = "string" == typeof e[0] ? e[0] : void 0, i = 2 === e.length ? e[1] : "string" == typeof e[0] ? void 0 : e[0];
-	return a({ [t]: () => ({
-		match: (t) => {
-			let e = { [null != r ? r : n]: t };
-			return {
-				matched: void 0 === i || o(i, t, (t, n) => {
-					e[t] = n;
-				}),
-				selections: e
-			};
-		},
-		getSelectionKeys: () => [null != r ? r : n].concat(void 0 === i ? [] : s(i))
-	}) });
-}
-function b(t) {
-	return !0;
-}
-function w(t) {
-	return "number" == typeof t;
-}
-function S(t) {
-	return "string" == typeof t;
-}
-function j(t) {
-	return "bigint" == typeof t;
-}
-a(p(b));
-a(p(b));
-const x = (t) => Object.assign(a(t), {
-	startsWith: (e) => {
-		return x(d(t, (n = e, p((t) => S(t) && t.startsWith(n)))));
-		var n;
-	},
-	endsWith: (e) => {
-		return x(d(t, (n = e, p((t) => S(t) && t.endsWith(n)))));
-		var n;
-	},
-	minLength: (e) => x(d(t, ((t) => p((e) => S(e) && e.length >= t))(e))),
-	length: (e) => x(d(t, ((t) => p((e) => S(e) && e.length === t))(e))),
-	maxLength: (e) => x(d(t, ((t) => p((e) => S(e) && e.length <= t))(e))),
-	includes: (e) => {
-		return x(d(t, (n = e, p((t) => S(t) && t.includes(n)))));
-		var n;
-	},
-	regex: (e) => {
-		return x(d(t, (n = e, p((t) => S(t) && Boolean(t.match(n))))));
-		var n;
-	}
-});
-x(p(S));
-const N = (t) => Object.assign(a(t), {
-	between: (e, n) => N(d(t, ((t, e) => p((n) => w(n) && t <= n && e >= n))(e, n))),
-	lt: (e) => N(d(t, ((t) => p((e) => w(e) && e < t))(e))),
-	gt: (e) => N(d(t, ((t) => p((e) => w(e) && e > t))(e))),
-	lte: (e) => N(d(t, ((t) => p((e) => w(e) && e <= t))(e))),
-	gte: (e) => N(d(t, ((t) => p((e) => w(e) && e >= t))(e))),
-	int: () => N(d(t, p((t) => w(t) && Number.isInteger(t)))),
-	finite: () => N(d(t, p((t) => w(t) && Number.isFinite(t)))),
-	positive: () => N(d(t, p((t) => w(t) && t > 0))),
-	negative: () => N(d(t, p((t) => w(t) && t < 0)))
-});
-N(p(w));
-const k = (t) => Object.assign(a(t), {
-	between: (e, n) => k(d(t, ((t, e) => p((n) => j(n) && t <= n && e >= n))(e, n))),
-	lt: (e) => k(d(t, ((t) => p((e) => j(e) && e < t))(e))),
-	gt: (e) => k(d(t, ((t) => p((e) => j(e) && e > t))(e))),
-	lte: (e) => k(d(t, ((t) => p((e) => j(e) && e <= t))(e))),
-	gte: (e) => k(d(t, ((t) => p((e) => j(e) && e >= t))(e))),
-	positive: () => k(d(t, p((t) => j(t) && t > 0))),
-	negative: () => k(d(t, p((t) => j(t) && t < 0)))
-});
-k(p(j)), a(p(function(t) {
-	return "boolean" == typeof t;
-})), a(p(function(t) {
-	return "symbol" == typeof t;
-})), a(p(function(t) {
-	return null == t;
-})), a(p(function(t) {
-	return null != t;
-}));
-var I = class extends Error {
-	constructor(t) {
-		let e;
-		try {
-			e = JSON.stringify(t);
-		} catch (n) {
-			e = t;
-		}
-		super(`Pattern matching error: no pattern matches value ${e}`), this.input = void 0, this.input = t;
-	}
-};
-const L = {
-	matched: !1,
-	value: void 0
-};
-function M(t) {
-	return new R(t, L);
-}
-var R = class R {
-	constructor(t, e) {
-		this.input = void 0, this.state = void 0, this.input = t, this.state = e;
-	}
-	with(...t) {
-		if (this.state.matched) return this;
-		const e = t[t.length - 1], r = [t[0]];
-		let i;
-		3 === t.length && "function" == typeof t[1] ? i = t[1] : t.length > 2 && r.push(...t.slice(1, t.length - 1));
-		let s = !1, c = {};
-		const u = (t, e) => {
-			s = !0, c[t] = e;
-		}, a = !r.some((t) => o(t, this.input, u)) || i && !Boolean(i(this.input)) ? L : {
-			matched: !0,
-			value: e(s ? n in c ? c[n] : c : this.input, this.input)
-		};
-		return new R(this.input, a);
-	}
-	when(t, e) {
-		if (this.state.matched) return this;
-		const n = Boolean(t(this.input));
-		return new R(this.input, n ? {
-			matched: !0,
-			value: e(this.input, this.input)
-		} : L);
-	}
-	otherwise(t) {
-		return this.state.matched ? this.state.value : t(this.input);
-	}
-	exhaustive(t = F) {
-		return this.state.matched ? this.state.value : t(this.input);
-	}
-	run() {
-		return this.exhaustive();
-	}
-	returnType() {
-		return this;
-	}
-	narrow() {
-		return this;
-	}
-};
-function F(t) {
-	throw new I(t);
-}
-//#endregion
 //#region src/request/render-verdict.ts
 function renderVerdict(verdict) {
-	return M(verdict).with({ kind: "ask" }, () => null).with({ kind: "allow" }, () => JSON.stringify({ decision: "allow" })).with({ kind: "deny" }, (denied) => JSON.stringify({
+	return M(verdict).with({ kind: "allow" }, () => JSON.stringify({ decision: "allow" })).with({ kind: "deny" }, (denied) => JSON.stringify({
 		decision: "deny",
 		reason: `[${denied.rule}] ${denied.reason}`
 	})).exhaustive();
 }
 //#endregion
-export { classifyWithModel as a, DEFAULT_CONFIG as c, resolveApiKey as d, resolveConfigPath as f, classifyLocally as i, PRESETS as l, parseActionRequest as n, parseModelVerdict as o, classifyAction as r, loadPolicy as s, renderVerdict as t, loadConfig as u };
+export { classifyWithModel as a, DEFAULT_CONFIG as c, resolveConfigPath as d, normalizeConfigFile as f, classifyLocally as i, loadConfig as l, parseActionRequest as n, parseModelVerdict as o, PRESETS as p, classifyAction as r, loadPolicy as s, renderVerdict as t, resolveApiKey as u };