@cleocode/core 2026.9.19 → 2026.9.21

package/dist/decide/site.js

@@ -0,0 +1,181 @@
+/**
+ * Shared plumbing for System One call sites: the `off | shadow | on` mode,
+ * the generative-fallback opt-in, and redact-then-clip for state text.
+ *
+ * Every site resolves its settings the same way, so the rule that an
+ * unconfigured provider means `off` (and therefore zero network) lives here
+ * once. Heavy modules (credentials, config registry) load lazily: importing
+ * this file costs nothing on a path that never asks a decision.
+ *
+ * @task T12493
+ * @epic T12486
+ */
+/**
+ * Type guard for {@link DecisionSiteMode}.
+ *
+ * @param value - Any config value.
+ * @returns Whether `value` is `off`, `shadow` or `on`.
+ */
+export function isDecisionSiteMode(value) {
+    return value === 'off' || value === 'shadow' || value === 'on';
+}
+/**
+ * Redact secrets, THEN clip to `max` characters, marking the cut.
+ *
+ * The order matters: clipping first can cut a secret in half, and a partial
+ * secret no longer matches the redaction patterns — `decide()`'s own redaction
+ * would then let the prefix through.
+ *
+ * @param text - Raw text.
+ * @param max - Maximum length of the result, in UTF-16 characters.
+ * @param redact - The redaction function (the memory redaction patterns).
+ * @returns Redacted text of at most `max` characters.
+ */
+export function redactThenClip(text, max, redact) {
+    const safe = redact(text);
+    return safe.length <= max ? safe : `${safe.slice(0, max - 1)}…`;
+}
+/**
+ * Resolve a site's mode and generative opt-in.
+ *
+ * Unconfigured (no explicit provider/connection and nothing stored by
+ * `cleo decide config`) always resolves to `off`, whatever the config says,
+ * so an unconfigured site never opens a socket. Never throws: unreadable
+ * credentials or config fall back to the defaults.
+ *
+ * @param input - Config keys, explicit overrides and wiring.
+ * @returns The effective settings.
+ */
+export async function resolveDecisionSiteSettings(input) {
+    const wiring = input.wiring ?? {};
+    let configured;
+    if (wiring.provider) {
+        configured = true;
+    }
+    else if (wiring.connection !== undefined) {
+        configured = wiring.connection !== null && wiring.connection.apiKey.trim() !== '';
+    }
+    else {
+        try {
+            const { loadDecideConnection } = await import('./credentials.js');
+            configured = loadDecideConnection() !== null;
+        }
+        catch {
+            configured = false;
+        }
+    }
+    const needConfig = (configured && input.mode === undefined) ||
+        (input.llmTierKey !== undefined && input.llmTier === undefined);
+    let configMode;
+    let configLlmTier;
+    if (needConfig) {
+        try {
+            const { getConfigValue } = await import('../config/registry.js');
+            const { getProjectRoot } = await import('../paths.js');
+            const projectRoot = input.projectRoot ?? getProjectRoot();
+            const llmTierKey = input.llmTierKey;
+            [configMode, configLlmTier] = await Promise.all([
+                getConfigValue(input.modeKey, { projectRoot }),
+                llmTierKey === undefined ? undefined : getConfigValue(llmTierKey, { projectRoot }),
+            ]);
+        }
+        catch {
+            // Unreadable config → defaults.
+        }
+    }
+    const mode = !configured
+        ? 'off'
+        : (input.mode ?? (isDecisionSiteMode(configMode) ? configMode : 'shadow'));
+    const llmTierDefault = input.llmTierDefault?.(mode) ?? false;
+    const llmTier = input.llmTier ?? (typeof configLlmTier === 'boolean' ? configLlmTier : llmTierDefault);
+    return { mode, llmTier };
+}
+function allConfident(answers, min) {
+    return Object.values(answers).every((a) => a.confidence >= min);
+}
+/**
+ * Ask one budgeted System One decision for a call site, auditing the
+ * heuristic's answers beside the decision's in the same `decisions.jsonl` line.
+ *
+ * Never throws. Heavy modules load lazily FIRST; then the deadline starts, and
+ * the provider is never waited on longer than `budgetMs` (request building,
+ * redaction, the audit sink and the client's own setup are inside it). Module
+ * load is excluded on purpose: in a cold process it alone can exceed the
+ * budget, and a budget that includes it means a fast provider never answers.
+ *
+ * @param input - Site id, budget, mode, request builder, heuristic and wiring.
+ * @returns The decision, or `null` when the heuristic answered (fallback) or the answer was invalid.
+ */
+export async function askSiteDecision(input) {
+    try {
+        const [{ decide }, { auditAnswers, createJsonlDecisionAudit }, { redactContent }, paths] = await Promise.all([
+            import('./client.js'),
+            import('./audit.js'),
+            import('../memory/redaction.js'),
+            import('../paths.js'),
+        ]);
+        // The wait budget starts now, with every module loaded.
+        const started = performance.now();
+        const deadline = AbortSignal.timeout(input.budgetMs);
+        const req = input.buildRequest((text) => redactContent(text).content);
+        const heuristicAudit = auditAnswers({
+            answers: input.heuristicAnswers,
+            source: 'fallback',
+            latencyMs: 0,
+        });
+        const isValid = input.isValid ?? (() => true);
+        const wiring = input.wiring ?? {};
+        let sink = wiring.audit;
+        if (sink === undefined) {
+            try {
+                sink = createJsonlDecisionAudit(wiring.projectRoot ?? input.projectRoot ?? paths.getProjectRoot());
+            }
+            catch {
+                sink = null;
+            }
+        }
+        const base = sink;
+        const audit = base
+            ? {
+                write: (entry) => {
+                    const answered = entry.source !== 'fallback';
+                    const valid = answered && isValid(entry.answers);
+                    base.write({
+                        ...entry,
+                        shadow: {
+                            mode: input.mode,
+                            acted: input.mode === 'on' && valid && allConfident(entry.answers, input.minConfidence)
+                                ? 'decision'
+                                : 'heuristic',
+                            heuristicVerdict: input.heuristicVerdict,
+                            heuristicAnswers: heuristicAudit,
+                            agree: valid ? input.agree(entry.answers) : null,
+                            ...input.shadowExtras,
+                            ...(answered && !valid ? { rejected: 'invalid_choice' } : {}),
+                        },
+                    });
+                },
+            }
+            : null;
+        const remaining = Math.max(0, input.budgetMs - (performance.now() - started));
+        const outcome = await decide(input.siteId, req, () => input.heuristicAnswers, {
+            ...wiring,
+            audit,
+            timeoutMs: Math.min(wiring.timeoutMs ?? remaining, remaining),
+            signal: wiring.signal ? AbortSignal.any([wiring.signal, deadline]) : deadline,
+        });
+        if (outcome.source === 'fallback')
+            return null;
+        if (!isValid(auditAnswers(outcome)))
+            return null;
+        return {
+            answers: outcome.answers,
+            source: outcome.source,
+            confident: allConfident(outcome.answers, input.minConfidence),
+        };
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=site.js.map

package/dist/decide/site.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"site.js","sourceRoot":"","sources":["../../src/decide/site.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAkDH;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,OAAO,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,CAAC;AACjE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,GAAW,EAAE,MAA6B;IACrF,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC,MAAM,IAAI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;AAClE,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,KAAuC;IAEvC,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;IAClC,IAAI,UAAmB,CAAC;IACxB,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,UAAU,GAAG,IAAI,CAAC;IACpB,CAAC;SAAM,IAAI,MAAM,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAC3C,UAAU,GAAG,MAAM,CAAC,UAAU,KAAK,IAAI,IAAI,MAAM,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC;IACpF,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,EAAE,oBAAoB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;YAClE,UAAU,GAAG,oBAAoB,EAAE,KAAK,IAAI,CAAC;QAC/C,CAAC;QAAC,MAAM,CAAC;YACP,UAAU,GAAG,KAAK,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GACd,CAAC,UAAU,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,CAAC;QACxC,CAAC,KAAK,CAAC,UAAU,KAAK,SAAS,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC;IAClE,IAAI,UAAmB,CAAC;IACxB,IAAI,aAAsB,CAAC;IAC3B,IAAI,UAAU,EAAE,CAAC;QACf,IAAI,CAAC;YACH,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,uBAAuB,CAAC,CAAC;YACjE,MAAM,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,CAAC;YACvD,MAAM,WAAW,GAAG,KAAK,CAAC,WAAW,IAAI,cAAc,EAAE,CAAC;YAC1D,MAAM,UAAU,GAAG,KAAK,CAAC,UAAU,CAAC;YACpC,CAAC,UAAU,EAAE,aAAa,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;gBAC9C,cAAc,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,CAAC;gBAC9C,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,UAAU,EAAE,EAAE,WAAW,EAAE,CAAC;aACnF,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,gCAAgC;QAClC,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAqB,CAAC,UAAU;QACxC,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,IAAI,CAAC,kBAAkB,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7E,MAAM,cAAc,GAAG,KAAK,CAAC,cAAc,EAAE,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC;IAC7D,MAAM,OAAO,GACX,KAAK,CAAC,OAAO,IAAI,CAAC,OAAO,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC;IACzF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;AAC3B,CAAC;AAoDD,SAAS,YAAY,CACnB,OAAkE,EAClE,GAAW;IAEX,OAAO,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,CAAC;AAClE,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAA2B;IAC/D,IAAI,CAAC;QACH,MAAM,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,YAAY,EAAE,wBAAwB,EAAE,EAAE,EAAE,aAAa,EAAE,EAAE,KAAK,CAAC,GACtF,MAAM,OAAO,CAAC,GAAG,CAAC;YAChB,MAAM,CAAC,aAAa,CAAC;YACrB,MAAM,CAAC,YAAY,CAAC;YACpB,MAAM,CAAC,wBAAwB,CAAC;YAChC,MAAM,CAAC,aAAa,CAAC;SACtB,CAAC,CAAC;QACL,wDAAwD;QACxD,MAAM,OAAO,GAAG,WAAW,CAAC,GAAG,EAAE,CAAC;QAClC,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAErD,MAAM,GAAG,GAAG,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC;QACtE,MAAM,cAAc,GAAG,YAAY,CAAC;YAClC,OAAO,EAAE,KAAK,CAAC,gBAAgB;YAC/B,MAAM,EAAE,UAAU;YAClB,SAAS,EAAE,CAAC;SACb,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,CAAC,GAAY,EAAE,CAAC,IAAI,CAAC,CAAC;QAEvD,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC;QAClC,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC;QACxB,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;YACvB,IAAI,CAAC;gBACH,IAAI,GAAG,wBAAwB,CAC7B,MAAM,CAAC,WAAW,IAAI,KAAK,CAAC,WAAW,IAAI,KAAK,CAAC,cAAc,EAAE,CAClE,CAAC;YACJ,CAAC;YAAC,MAAM,CAAC;gBACP,IAAI,GAAG,IAAI,CAAC;YACd,CAAC;QACH,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC;QAClB,MAAM,KAAK,GAAG,IAAI;YAChB,CAAC,CAAC;gBACE,KAAK,EAAE,CAAC,KAAyB,EAAQ,EAAE;oBACzC,MAAM,QAAQ,GAAG,KAAK,CAAC,MAAM,KAAK,UAAU,CAAC;oBAC7C,MAAM,KAAK,GAAG,QAAQ,IAAI,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;oBACjD,IAAI,CAAC,KAAK,CAAC;wBACT,GAAG,KAAK;wBACR,MAAM,EAAE;4BACN,IAAI,EAAE,KAAK,CAAC,IAAI;4BAChB,KAAK,EACH,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,IAAI,YAAY,CAAC,KAAK,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC;gCAC9E,CAAC,CAAC,UAAU;gCACZ,CAAC,CAAC,WAAW;4BACjB,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;4BACxC,gBAAgB,EAAE,cAAc;4BAChC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI;4BAChD,GAAG,KAAK,CAAC,YAAY;4BACrB,GAAG,CAAC,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,gBAAyB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;yBACvE;qBACF,CAAC,CAAC;gBACL,CAAC;aACF;YACH,CAAC,CAAC,IAAI,CAAC;QAET,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,CAAC,QAAQ,GAAG,CAAC,WAAW,CAAC,GAAG,EAAE,GAAG,OAAO,CAAC,CAAC,CAAC;QAC9E,MAAM,OAAO,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,gBAAgB,EAAE;YAC5E,GAAG,MAAM;YACT,KAAK;YACL,SAAS,EAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,IAAI,SAAS,EAAE,SAAS,CAAC;YAC7D,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ;SAC9E,CAAC,CAAC;QACH,IAAI,OAAO,CAAC,MAAM,KAAK,UAAU;YAAE,OAAO,IAAI,CAAC;QAC/C,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO;YACxB,MAAM,EAAE,OAAO,CAAC,MAAM;YACtB,SAAS,EAAE,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,aAAa,CAAC;SAC9D,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/dist/decide/transport.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Abort-complete HTTP transport for decision providers.
+ *
+ * The global `fetch` cannot be trusted with a sub-second, one-shot CLI
+ * budget: aborting it rejects the promise, but a request still in its CONNECT
+ * phase keeps its handle — `TCPConnectWrap` for an unanswered SYN, the TLS
+ * socket for a stalled handshake, `GetAddrInfoReqWrap` for a slow DNS lookup
+ * on the libuv threadpool. The CLI's success path relies on the event loop
+ * draining, so each of those kept `cleo add` alive until the 3 s teardown
+ * backstop (measured 4.4 s end to end, T12492).
+ *
+ * This transport owns every handle it creates, and releases all of them when
+ * the signal fires:
+ *
+ * - DNS goes through a dedicated `dns.Resolver` (c-ares) whose `cancel()`
+ *   ends in-flight queries. IP literals skip DNS; `localhost` and other
+ *   hosts-file names are answered from the hosts file, in file order.
+ * - `.local` (mDNS) names are refused outright unless the hosts file maps
+ *   them: c-ares answers NXDOMAIN, and the system resolver would then wait
+ *   seconds on multicast, uncancellably.
+ * - When c-ares cannot answer (NXDOMAIN, SERVFAIL, REFUSED, timeout — e.g. a
+ *   VPN's split DNS that only the system resolver knows), `dns.lookup` is the
+ *   fallback. It is the ONE step that cannot be cancelled: a hung
+ *   `getaddrinfo` holds the process until it returns. That residual risk is
+ *   disclosed in the T12492 changeset.
+ * - Every resolved address is tried in order (IPv4 first, then IPv6) until a
+ *   connection is made; a refused or unreachable address moves on to the next.
+ * - Requests use `agent: false` — no pooled keep-alive socket survives the
+ *   call — and `req.destroy()` on abort tears down a socket in any phase.
+ * - TLS verifies the certificate against the ORIGINAL hostname
+ *   (`servername`), not the resolved address.
+ * - Every listener converts a throw into a rejection: a response the WHATWG
+ *   `Response` cannot represent (status outside 200–599) is a rejected call,
+ *   never an uncaught exception that kills the CLI mid-write.
+ * - The transport never consults `HTTPS_PROXY` / `NODE_USE_ENV_PROXY`.
+ *
+ * Provider-neutral: it knows no endpoint paths or wire shapes.
+ *
+ * @task T12492
+ */
+/** Request options accepted by {@link decideFetch}. */
+export interface DecideFetchInit {
+    /** HTTP method. */
+    readonly method: 'GET' | 'POST';
+    /** Request headers. */
+    readonly headers: Readonly<Record<string, string>>;
+    /** Request body. */
+    readonly body?: string;
+    /** Cancels DNS, connect, request and response; every handle is released. */
+    readonly signal: AbortSignal;
+}
+/** Signature of {@link decideFetch}; `globalThis.fetch` satisfies it too (tests inject stubs). */
+export type DecideFetch = (url: string, init: DecideFetchInit) => Promise<Response>;
+/**
+ * Perform one HTTP(S) request and buffer the response.
+ *
+ * Rejects — never throws out of a callback — on abort, on any network or
+ * protocol failure, and on a status outside 200–599. By the time an abort
+ * rejects, the DNS query, socket and request have been destroyed (except a
+ * system-resolver fallback already in flight; see the module docs).
+ *
+ * @param url - Absolute `http:` or `https:` URL.
+ * @param init - Method, headers, body and the (required) abort signal.
+ * @returns The buffered response.
+ */
+export declare function decideFetch(url: string, init: DecideFetchInit): Promise<Response>;
+//# sourceMappingURL=transport.d.ts.map

package/dist/decide/transport.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.d.ts","sourceRoot":"","sources":["../../src/decide/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAQH,uDAAuD;AACvD,MAAM,WAAW,eAAe;IAC9B,mBAAmB;IACnB,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAChC,uBAAuB;IACvB,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACnD,oBAAoB;IACpB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,4EAA4E;IAC5E,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC;CAC9B;AAED,kGAAkG;AAClG,MAAM,MAAM,WAAW,GAAG,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAC;AAyQpF;;;;;;;;;;;GAWG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,QAAQ,CAAC,CAuBvF"}

package/dist/decide/transport.js

@@ -0,0 +1,350 @@
+/**
+ * Abort-complete HTTP transport for decision providers.
+ *
+ * The global `fetch` cannot be trusted with a sub-second, one-shot CLI
+ * budget: aborting it rejects the promise, but a request still in its CONNECT
+ * phase keeps its handle — `TCPConnectWrap` for an unanswered SYN, the TLS
+ * socket for a stalled handshake, `GetAddrInfoReqWrap` for a slow DNS lookup
+ * on the libuv threadpool. The CLI's success path relies on the event loop
+ * draining, so each of those kept `cleo add` alive until the 3 s teardown
+ * backstop (measured 4.4 s end to end, T12492).
+ *
+ * This transport owns every handle it creates, and releases all of them when
+ * the signal fires:
+ *
+ * - DNS goes through a dedicated `dns.Resolver` (c-ares) whose `cancel()`
+ *   ends in-flight queries. IP literals skip DNS; `localhost` and other
+ *   hosts-file names are answered from the hosts file, in file order.
+ * - `.local` (mDNS) names are refused outright unless the hosts file maps
+ *   them: c-ares answers NXDOMAIN, and the system resolver would then wait
+ *   seconds on multicast, uncancellably.
+ * - When c-ares cannot answer (NXDOMAIN, SERVFAIL, REFUSED, timeout — e.g. a
+ *   VPN's split DNS that only the system resolver knows), `dns.lookup` is the
+ *   fallback. It is the ONE step that cannot be cancelled: a hung
+ *   `getaddrinfo` holds the process until it returns. That residual risk is
+ *   disclosed in the T12492 changeset.
+ * - Every resolved address is tried in order (IPv4 first, then IPv6) until a
+ *   connection is made; a refused or unreachable address moves on to the next.
+ * - Requests use `agent: false` — no pooled keep-alive socket survives the
+ *   call — and `req.destroy()` on abort tears down a socket in any phase.
+ * - TLS verifies the certificate against the ORIGINAL hostname
+ *   (`servername`), not the resolved address.
+ * - Every listener converts a throw into a rejection: a response the WHATWG
+ *   `Response` cannot represent (status outside 200–599) is a rejected call,
+ *   never an uncaught exception that kills the CLI mid-write.
+ * - The transport never consults `HTTPS_PROXY` / `NODE_USE_ENV_PROXY`.
+ *
+ * Provider-neutral: it knows no endpoint paths or wire shapes.
+ *
+ * @task T12492
+ */
+import { lookup as dnsLookup, Resolver } from 'node:dns';
+import { readFileSync } from 'node:fs';
+import { request as httpRequest } from 'node:http';
+import { request as httpsRequest } from 'node:https';
+import { isIP } from 'node:net';
+/** Upper bound on one DNS query when no abort arrives first, in ms. */
+const RESOLVER_TIMEOUT_MS = 2_000;
+/** Byte cap on a buffered response body. */
+const MAX_RESPONSE_BYTES = 1024 * 1024;
+/** Statuses whose `Response` must not carry a body. */
+const NULL_BODY_STATUSES = new Set([204, 205, 304]);
+/** c-ares answers after which the system resolver may still know the name. */
+const SYSTEM_FALLBACK_CODES = new Set([
+    'ENOTFOUND',
+    'ENODATA',
+    'NOTFOUND',
+    'ESERVFAIL',
+    'SERVFAIL',
+    'EREFUSED',
+    'REFUSED',
+    'ETIMEOUT',
+    'TIMEOUT',
+]);
+/** Connect-phase failures after which the next address is worth trying. */
+const NEXT_ADDRESS_CODES = new Set([
+    'ECONNREFUSED',
+    'EHOSTUNREACH',
+    'ENETUNREACH',
+    'EADDRNOTAVAIL',
+    'EAFNOSUPPORT',
+]);
+function abortError() {
+    const err = new Error('The operation was aborted');
+    err.name = 'AbortError';
+    return err;
+}
+function errorCode(err) {
+    return err instanceof Error && 'code' in err && typeof err.code === 'string'
+        ? err.code
+        : undefined;
+}
+function asError(err) {
+    return err instanceof Error ? err : new Error(String(err));
+}
+/** Hosts-file path for this platform. */
+function hostsFilePath() {
+    return process.platform === 'win32'
+        ? `${process.env['SystemRoot'] ?? 'C:\\Windows'}\\System32\\drivers\\etc\\hosts`
+        : '/etc/hosts';
+}
+/**
+ * Addresses the hosts file maps `hostname` to, in file order. A synchronous
+ * read of a small local file — no handle survives it.
+ */
+function hostsFileAddresses(hostname) {
+    let text;
+    try {
+        text = readFileSync(hostsFilePath(), 'utf-8');
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const raw of text.split(/\r?\n/)) {
+        const [address, ...names] = (raw.split('#')[0] ?? '').trim().split(/\s+/);
+        if (!address || !isIP(address))
+            continue;
+        if (names.some((n) => n.toLowerCase() === hostname) && !out.includes(address)) {
+            out.push(address);
+        }
+    }
+    return out;
+}
+/** IPv4 addresses first, then IPv6, preserving order within each family. */
+function v4First(addresses) {
+    return [...addresses.filter((a) => isIP(a) === 4), ...addresses.filter((a) => isIP(a) === 6)];
+}
+/** Resolve through c-ares: both families. Cancellable; never throws synchronously. */
+function resolveWithCares(hostname, signal) {
+    return new Promise((resolve, reject) => {
+        const resolver = new Resolver({ timeout: RESOLVER_TIMEOUT_MS, tries: 1 });
+        let done = false;
+        const finish = (err, addresses = []) => {
+            if (done)
+                return;
+            done = true;
+            signal.removeEventListener('abort', onAbort);
+            if (err)
+                reject(err);
+            else
+                resolve(addresses);
+        };
+        const onAbort = () => {
+            resolver.cancel();
+            finish(abortError());
+        };
+        signal.addEventListener('abort', onAbort, { once: true });
+        try {
+            resolver.resolve4(hostname, (err4, v4) => {
+                if (done)
+                    return;
+                resolver.resolve6(hostname, (err6, v6) => {
+                    const found = [...(err4 ? [] : v4), ...(err6 ? [] : v6)];
+                    if (found.length > 0)
+                        finish(null, found);
+                    else
+                        finish(err4 ?? err6 ?? new Error(`could not resolve ${hostname}`));
+                });
+            });
+        }
+        catch (err) {
+            finish(asError(err));
+        }
+    });
+}
+/**
+ * The system resolver (`getaddrinfo`) — NOT cancellable. Used only after
+ * c-ares could not answer. An abort still settles the promise at once, but a
+ * hung lookup keeps its threadpool request alive until it returns.
+ */
+function resolveWithSystem(hostname, signal) {
+    return new Promise((resolve, reject) => {
+        const onAbort = () => reject(abortError());
+        signal.addEventListener('abort', onAbort, { once: true });
+        try {
+            dnsLookup(hostname, { all: true }, (err, addresses) => {
+                signal.removeEventListener('abort', onAbort);
+                if (err)
+                    reject(err);
+                else
+                    resolve(addresses.map((a) => a.address));
+            });
+        }
+        catch (err) {
+            signal.removeEventListener('abort', onAbort);
+            reject(asError(err));
+        }
+    });
+}
+/** Resolve `hostname` to every candidate address, in connection order. */
+async function resolveHost(hostname, signal) {
+    if (isIP(hostname))
+        return [hostname];
+    const name = hostname.toLowerCase().replace(/\.$/, '');
+    const fromHosts = hostsFileAddresses(name);
+    // `localhost` keeps the hosts file's own order (the system order).
+    if (name === 'localhost')
+        return fromHosts.length > 0 ? fromHosts : ['127.0.0.1', '::1'];
+    if (fromHosts.length > 0)
+        return v4First(fromHosts);
+    if (name === 'local' || name.endsWith('.local')) {
+        throw new Error(`refusing to resolve ${hostname}: .local (mDNS) names are not supported`);
+    }
+    try {
+        return v4First(await resolveWithCares(hostname, signal));
+    }
+    catch (err) {
+        if (signal.aborted)
+            throw abortError();
+        const code = errorCode(err);
+        if (code === undefined || !SYSTEM_FALLBACK_CODES.has(code))
+            throw asError(err);
+        return v4First(await resolveWithSystem(hostname, signal));
+    }
+}
+/**
+ * Buffer `res` into a WHATWG `Response`, capped at {@link MAX_RESPONSE_BYTES}.
+ * Settles by rejection on any failure, including a status `Response` refuses.
+ */
+function toResponse(res) {
+    return new Promise((resolve, reject) => {
+        const status = res.statusCode ?? 0;
+        if (!Number.isInteger(status) || status < 200 || status > 599) {
+            res.destroy();
+            reject(new Error(`provider returned an HTTP status outside 200-599 (${status})`));
+            return;
+        }
+        const chunks = [];
+        let total = 0;
+        res.on('data', (chunk) => {
+            try {
+                total += chunk.byteLength;
+                if (total > MAX_RESPONSE_BYTES) {
+                    res.destroy(new Error('response body exceeds the size limit'));
+                    return;
+                }
+                chunks.push(chunk);
+            }
+            catch (err) {
+                res.destroy(asError(err));
+            }
+        });
+        res.on('error', (err) => reject(err));
+        res.on('aborted', () => reject(new Error('response aborted')));
+        res.on('close', () => {
+            if (!res.complete)
+                reject(new Error('response closed before it completed'));
+        });
+        res.on('end', () => {
+            try {
+                const headers = new Headers();
+                for (const [name, value] of Object.entries(res.headers)) {
+                    if (value === undefined)
+                        continue;
+                    for (const v of Array.isArray(value) ? value : [value])
+                        headers.append(name, v);
+                }
+                const body = NULL_BODY_STATUSES.has(status) ? null : Buffer.concat(chunks);
+                resolve(new Response(body, { status, headers }));
+            }
+            catch (err) {
+                reject(asError(err));
+            }
+        });
+    });
+}
+/** One request to one resolved address. Settles by rejection; no listener throws. */
+function requestOnce(target, address, hostname, init) {
+    const { signal } = init;
+    const https = target.protocol === 'https:';
+    return new Promise((resolve, reject) => {
+        let settled = false;
+        let req;
+        const settle = (fn) => {
+            if (settled)
+                return;
+            settled = true;
+            signal.removeEventListener('abort', onAbort);
+            fn();
+        };
+        const onAbort = () => {
+            req?.destroy(abortError());
+            settle(() => reject(abortError()));
+        };
+        try {
+            req = (https ? httpsRequest : httpRequest)({
+                host: address,
+                port: target.port || (https ? 443 : 80),
+                path: `${target.pathname}${target.search}`,
+                method: init.method,
+                headers: { ...init.headers, host: target.host },
+                agent: false,
+                ...(https && !isIP(hostname) ? { servername: hostname } : {}),
+            });
+        }
+        catch (err) {
+            settle(() => reject(asError(err)));
+            return;
+        }
+        const active = req;
+        signal.addEventListener('abort', onAbort, { once: true });
+        active.on('error', (err) => {
+            settle(() => reject(signal.aborted ? abortError() : err));
+        });
+        active.on('response', (res) => {
+            toResponse(res).then((response) => settle(() => resolve(response)), (err) => {
+                active.destroy();
+                settle(() => reject(signal.aborted ? abortError() : asError(err)));
+            });
+        });
+        try {
+            active.end(init.body);
+        }
+        catch (err) {
+            active.destroy();
+            settle(() => reject(asError(err)));
+        }
+    });
+}
+/**
+ * Perform one HTTP(S) request and buffer the response.
+ *
+ * Rejects — never throws out of a callback — on abort, on any network or
+ * protocol failure, and on a status outside 200–599. By the time an abort
+ * rejects, the DNS query, socket and request have been destroyed (except a
+ * system-resolver fallback already in flight; see the module docs).
+ *
+ * @param url - Absolute `http:` or `https:` URL.
+ * @param init - Method, headers, body and the (required) abort signal.
+ * @returns The buffered response.
+ */
+export async function decideFetch(url, init) {
+    const { signal } = init;
+    if (signal.aborted)
+        throw abortError();
+    const target = new URL(url);
+    if (target.protocol !== 'https:' && target.protocol !== 'http:') {
+        throw new Error(`unsupported protocol ${target.protocol}`);
+    }
+    const hostname = target.hostname.replace(/^\[|\]$/g, '');
+    const addresses = await resolveHost(hostname, signal);
+    if (signal.aborted)
+        throw abortError();
+    let lastError = new Error(`no address for ${hostname}`);
+    for (const address of addresses) {
+        try {
+            return await requestOnce(target, address, hostname, init);
+        }
+        catch (err) {
+            if (signal.aborted)
+                throw abortError();
+            lastError = asError(err);
+            const code = errorCode(err);
+            if (code === undefined || !NEXT_ADDRESS_CODES.has(code))
+                throw lastError;
+        }
+    }
+    throw lastError;
+}
+//# sourceMappingURL=transport.js.map

package/dist/decide/transport.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"transport.js","sourceRoot":"","sources":["../../src/decide/transport.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAuCG;AAEH,OAAO,EAAE,MAAM,IAAI,SAAS,EAAE,QAAQ,EAAE,MAAM,UAAU,CAAC;AACzD,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,IAAI,WAAW,EAAwB,MAAM,WAAW,CAAC;AACzE,OAAO,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AACrD,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAiBhC,uEAAuE;AACvE,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,4CAA4C;AAC5C,MAAM,kBAAkB,GAAG,IAAI,GAAG,IAAI,CAAC;AAEvC,uDAAuD;AACvD,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAEzE,8EAA8E;AAC9E,MAAM,qBAAqB,GAAwB,IAAI,GAAG,CAAC;IACzD,WAAW;IACX,SAAS;IACT,UAAU;IACV,WAAW;IACX,UAAU;IACV,UAAU;IACV,SAAS;IACT,UAAU;IACV,SAAS;CACV,CAAC,CAAC;AAEH,2EAA2E;AAC3E,MAAM,kBAAkB,GAAwB,IAAI,GAAG,CAAC;IACtD,cAAc;IACd,cAAc;IACd,aAAa;IACb,eAAe;IACf,cAAc;CACf,CAAC,CAAC;AAEH,SAAS,UAAU;IACjB,MAAM,GAAG,GAAG,IAAI,KAAK,CAAC,2BAA2B,CAAC,CAAC;IACnD,GAAG,CAAC,IAAI,GAAG,YAAY,CAAC;IACxB,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,SAAS,CAAC,GAAY;IAC7B,OAAO,GAAG,YAAY,KAAK,IAAI,MAAM,IAAI,GAAG,IAAI,OAAO,GAAG,CAAC,IAAI,KAAK,QAAQ;QAC1E,CAAC,CAAC,GAAG,CAAC,IAAI;QACV,CAAC,CAAC,SAAS,CAAC;AAChB,CAAC;AAED,SAAS,OAAO,CAAC,GAAY;IAC3B,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,yCAAyC;AACzC,SAAS,aAAa;IACpB,OAAO,OAAO,CAAC,QAAQ,KAAK,OAAO;QACjC,CAAC,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,aAAa,iCAAiC;QAChF,CAAC,CAAC,YAAY,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,SAAS,kBAAkB,CAAC,QAAgB;IAC1C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,YAAY,CAAC,aAAa,EAAE,EAAE,OAAO,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,MAAM,CAAC,OAAO,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1E,IAAI,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QACzC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC9E,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACpB,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,4EAA4E;AAC5E,SAAS,OAAO,CAAC,SAA4B;IAC3C,OAAO,CAAC,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;AAChG,CAAC;AAED,sFAAsF;AACtF,SAAS,gBAAgB,CAAC,QAAgB,EAAE,MAAmB;IAC7D,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,QAAQ,GAAG,IAAI,QAAQ,CAAC,EAAE,OAAO,EAAE,mBAAmB,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;QAC1E,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,MAAM,MAAM,GAAG,CAAC,GAAiB,EAAE,YAAsB,EAAE,EAAQ,EAAE;YACnE,IAAI,IAAI;gBAAE,OAAO;YACjB,IAAI,GAAG,IAAI,CAAC;YACZ,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,IAAI,GAAG;gBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;gBAChB,OAAO,CAAC,SAAS,CAAC,CAAC;QAC1B,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,QAAQ,CAAC,MAAM,EAAE,CAAC;YAClB,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACvB,CAAC,CAAC;QACF,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;gBACvC,IAAI,IAAI;oBAAE,OAAO;gBACjB,QAAQ,CAAC,QAAQ,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE;oBACvC,MAAM,KAAK,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBACzD,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;wBAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;;wBACrC,MAAM,CAAC,IAAI,IAAI,IAAI,IAAI,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC,CAAC;gBAC1E,CAAC,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,QAAgB,EAAE,MAAmB;IAC9D,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,OAAO,GAAG,GAAS,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC;QACjD,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,IAAI,CAAC;YACH,SAAS,CAAC,QAAQ,EAAE,EAAE,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,GAAG,EAAE,SAAS,EAAE,EAAE;gBACpD,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC7C,IAAI,GAAG;oBAAE,MAAM,CAAC,GAAG,CAAC,CAAC;;oBAChB,OAAO,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAChD,CAAC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0EAA0E;AAC1E,KAAK,UAAU,WAAW,CAAC,QAAgB,EAAE,MAAmB;IAC9D,IAAI,IAAI,CAAC,QAAQ,CAAC;QAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,QAAQ,CAAC,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IACvD,MAAM,SAAS,GAAG,kBAAkB,CAAC,IAAI,CAAC,CAAC;IAC3C,mEAAmE;IACnE,IAAI,IAAI,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACzF,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,OAAO,CAAC,SAAS,CAAC,CAAC;IACpD,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;QAChD,MAAM,IAAI,KAAK,CAAC,uBAAuB,QAAQ,yCAAyC,CAAC,CAAC;IAC5F,CAAC;IAED,IAAI,CAAC;QACH,OAAO,OAAO,CAAC,MAAM,gBAAgB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,MAAM,CAAC,OAAO;YAAE,MAAM,UAAU,EAAE,CAAC;QACvC,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,qBAAqB,CAAC,GAAG,CAAC,IAAI,CAAC;YAAE,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC,MAAM,iBAAiB,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC;IAC5D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,UAAU,CAAC,GAAoB;IACtC,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,MAAM,MAAM,GAAG,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC;QACnC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,IAAI,MAAM,GAAG,GAAG,IAAI,MAAM,GAAG,GAAG,EAAE,CAAC;YAC9D,GAAG,CAAC,OAAO,EAAE,CAAC;YACd,MAAM,CAAC,IAAI,KAAK,CAAC,qDAAqD,MAAM,GAAG,CAAC,CAAC,CAAC;YAClF,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE;YAC/B,IAAI,CAAC;gBACH,KAAK,IAAI,KAAK,CAAC,UAAU,CAAC;gBAC1B,IAAI,KAAK,GAAG,kBAAkB,EAAE,CAAC;oBAC/B,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC,CAAC;oBAC/D,OAAO;gBACT,CAAC;gBACD,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACrB,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;QACtC,GAAG,CAAC,EAAE,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI,KAAK,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC;QAC/D,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;YACnB,IAAI,CAAC,GAAG,CAAC,QAAQ;gBAAE,MAAM,CAAC,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC,CAAC;QAC9E,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,IAAI,OAAO,EAAE,CAAC;gBAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACxD,IAAI,KAAK,KAAK,SAAS;wBAAE,SAAS;oBAClC,KAAK,MAAM,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;wBAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;gBAClF,CAAC;gBACD,MAAM,IAAI,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;gBAC3E,OAAO,CAAC,IAAI,QAAQ,CAAC,IAAI,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC;YACnD,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,qFAAqF;AACrF,SAAS,WAAW,CAClB,MAAW,EACX,OAAe,EACf,QAAgB,EAChB,IAAqB;IAErB,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,KAAK,QAAQ,CAAC;IAC3C,OAAO,IAAI,OAAO,CAAW,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,IAAI,GAA+C,CAAC;QACpD,MAAM,MAAM,GAAG,CAAC,EAAc,EAAQ,EAAE;YACtC,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,MAAM,CAAC,mBAAmB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;YAC7C,EAAE,EAAE,CAAC;QACP,CAAC,CAAC;QACF,MAAM,OAAO,GAAG,GAAS,EAAE;YACzB,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC;YAC3B,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;QACrC,CAAC,CAAC;QACF,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;gBACzC,IAAI,EAAE,OAAO;gBACb,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvC,IAAI,EAAE,GAAG,MAAM,CAAC,QAAQ,GAAG,MAAM,CAAC,MAAM,EAAE;gBAC1C,MAAM,EAAE,IAAI,CAAC,MAAM;gBACnB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE;gBAC/C,KAAK,EAAE,KAAK;gBACZ,GAAG,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9D,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnC,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,GAAG,CAAC;QACnB,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAC1D,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;QAC5D,CAAC,CAAC,CAAC;QACH,MAAM,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;YAC5B,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,CAClB,CAAC,QAAQ,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,EAC7C,CAAC,GAAY,EAAE,EAAE;gBACf,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACrE,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,CAAC,OAAO,EAAE,CAAC;YACjB,MAAM,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACrC,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,IAAqB;IAClE,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,UAAU,EAAE,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QAChE,MAAM,IAAI,KAAK,CAAC,wBAAwB,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC7D,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,SAAS,GAAG,MAAM,WAAW,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;IACtD,IAAI,MAAM,CAAC,OAAO;QAAE,MAAM,UAAU,EAAE,CAAC;IAEvC,IAAI,SAAS,GAAU,IAAI,KAAK,CAAC,kBAAkB,QAAQ,EAAE,CAAC,CAAC;IAC/D,KAAK,MAAM,OAAO,IAAI,SAAS,EAAE,CAAC;QAChC,IAAI,CAAC;YACH,OAAO,MAAM,WAAW,CAAC,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;QAC5D,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,UAAU,EAAE,CAAC;YACvC,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;YACzB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC;YAC5B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC;gBAAE,MAAM,SAAS,CAAC;QAC3E,CAAC;IACH,CAAC;IACD,MAAM,SAAS,CAAC;AAClB,CAAC"}