@dzhechkov/harness-core 0.5.0 → 0.5.2

package/README.md

@@ -150,9 +150,25 @@ is shared with the Claude Code path rather than duplicated:
 | `codex-hooks-assets.ts` | the two emitted `.cjs` helper bodies (the `generateAgentdbWriter` pattern). |
 
 `runSyncCodexHooks` (in `operations.ts`) is the I/O shell: refuse → read → merge → back up → atomic
-write → helpers → **install-time liveness self-probe** → arm trust → manifest.
-
-Two runtime facts it encodes, both MEASURED on `codex-cli 0.147.0` and both load-bearing:
+write → helpers → **install-time liveness self-probe** → arm trust → manifest → **live veto probe**.
+
+The last step is the one that decides what may be printed. `runCodexVetoProbe` drives ONE
+non-bypassed `codex exec` in a hermetic, consenting workspace with a nonce-scoped sentinel, and
+`classifyVetoProbe` grades it; the report's `ready` is `installed ∧ executable ∧ trusted ∧ a
+witnessed block`, and nothing else may reach a success word. `verify: false` (the CLI's
+`--no-verify`) never yields exit 0 — a refusal to measure is inconclusive, not success. This is the
+independent review's CRITICAL finding: the classifier and its exit map existed and were never called
+from any production path.
+
+Two spellings that are NOT the same fact, both MEASURED on codex-cli 0.148.0: a trust KEY embeds
+`pre_tool_use`, while `hooks/list`'s `eventName` FIELD says `preToolUse`. `sameHookEvent` normalises
+both — pinning either alone matches zero rows, writes no trust, and the guard stops firing while
+every unit test stays green (it did; the live probe caught it).
+
+Two runtime facts it encodes, both MEASURED on `codex-cli 0.147.0` and RE-CONFIRMED on `0.148.0` at
+the independent-QE fix round (a capability grant now records the runtime version it was measured on,
+and a grant whose recorded version is not the installed one is reported `stale-runtime-version` —
+inconclusive until re-probed). Both are load-bearing:
 
 - **Hooks are trust-gated.** A written entry is silently never run until trust is recorded per entry
   in `$CODEX_HOME/config.toml` as `[hooks.state."<key>"] trusted_hash = "<currentHash>"`. Both values
@@ -168,9 +184,36 @@ Two runtime facts it encodes, both MEASURED on `codex-cli 0.147.0` and both load
 `runtime: 'claude-code' | 'codex'` (absent ⇒ `claude-code`), and the compaction aggregate carries a
 `runtimes` set union so provenance survives the lossy path.
 
+## Run a plan without the Claude host
+
+`runWorkflow` (`workflow-run.ts`) is the PURE scheduler behind `dz workflow run`: it INTERPRETS a
+`loop-plan/1` plan instead of executing a rendered script, dispatching each step through
+`workflow-run-dispatch.ts` (`codex exec`, or an isolated `claude -p`) over a single injected child
+seam. Every one of its 24 failure reasons has a named producer, so the taxonomy is reachable in
+tests without a child process. `loop-run-semantics.ts` is the single blob SOURCE for the gate / join
+/ failure constants, which is what makes "imported, not copied" true by construction.
+
+**How far the cross-host equivalence claim reaches (MEASURED 2026-08-20).** `dz workflow run` writes
+`trace.jsonl` from the `dz` process itself on BOTH families — instrument-written. The rendered
+script under the Claude host cannot (the sandbox has no filesystem), so there the trace is appended
+by an AGENT the script asks to run the flush command — agent-attested. The host's own records cannot
+close the gap: `journal.jsonl` carries `type` / `key` / `agentId` / `result` and neither `seq` nor
+`ts`; the per-agent transcripts carry `timestamp` and `uuid`/`parentUuid` and can order AGENTS, but a
+join, a gate redo and a typed pause are steps of the loop, not agents, and appear nowhere. So the
+equivalence proved by the committed `pkg-audit-1` fixture covers a bounded fanout, an all-activated
+join, a dep chain and a gate — and NOT the gate redo route, the typed terminal route, the typed
+pause or the file deliverable.
+
 ## Status
 
-`0.4.8` — staged, not published. Adds the Codex hook carrier above, the shared
+`0.5.1` — published. **BEHAVIORAL:** `parseTrace` orders events by `seq`, not by file order (§42
+`CANNOT_ISOLATE` semantics unchanged from 0.5.0) — a stored verdict computed over a non-sequential
+trace is not comparable with one computed here. Adds the plan enactor above, `qe-bridge.ts`
+(cross-family QE hand-off with reviewer isolation, 17-reason taxonomy) and `named-lock.ts`
+(`withNamedLockSync` for read-modify-write file stores outside the worktree). Full detail in
+[CHANGELOG.md](CHANGELOG.md).
+
+**0.4.8.** Adds the Codex hook carrier above, the shared
 `mergeManagedHookEntries` extraction, the `runtime`/`runtimes` provenance on recall-usage, and the
 granular `hooks-write` / `hooks-shell` / `hooks-prompt` parity capabilities with an evidence gate.
 

package/dist/codex-hooks-assets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hooks-assets.d.ts","sourceRoot":"","sources":["../src/codex-hooks-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAkGH;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAoDhD;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CA4FlD;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAElF"}
+{"version":3,"file":"codex-hooks-assets.d.ts","sourceRoot":"","sources":["../src/codex-hooks-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAuIH;;;;;GAKG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAoDhD;AAED;;;;;;GAMG;AACH,wBAAgB,yBAAyB,IAAI,MAAM,CA4FlD;AAED,iEAAiE;AACjE,wBAAgB,oBAAoB,IAAI,QAAQ,CAAC,MAAM,CAAC,MAAM,GAAG,QAAQ,EAAE,MAAM,CAAC,CAAC,CAElF"}

package/dist/codex-hooks-assets.js

@@ -48,9 +48,17 @@ const ERROR_LOG = path.join(CODEX_HOME, 'dz-hooks', 'helper-errors.jsonl');
  * surfaces a hook's stderr in the transcript ONLY when the hook exits 2 — an exit-0 hook's stderr is
  * swallowed. So a warn that lived only on stderr would be unobservable, and "the guard is live but
  * not blocking" (G-J) would be unprovable. This file is where it is observable.
+ *
+ * The log is 0600 inside a 0700 directory, ENFORCED on every write rather than assumed at creation:
+ * \`mkdir -p\` never relaxes an existing directory's mode, so a helper dir that predates dz (or a
+ * permissive umask) would leave the record world-readable (independent review, finding 8).
  */
 function note(stage, err, extra) {
   try {
+    try { fs.mkdirSync(path.dirname(ERROR_LOG), { recursive: true, mode: 0o700 }); } catch (_) { /* exists */ }
+    try { fs.chmodSync(path.dirname(ERROR_LOG), 0o700); } catch (_) { /* not ours to tighten */ }
+    try { if (!fs.existsSync(ERROR_LOG)) fs.writeFileSync(ERROR_LOG, '', { mode: 0o600 }); } catch (_) { /* raced */ }
+    try { fs.chmodSync(ERROR_LOG, 0o600); } catch (_) { /* not ours to tighten */ }
     fs.appendFileSync(
       ERROR_LOG,
       JSON.stringify(Object.assign(
@@ -61,6 +69,35 @@ function note(stage, err, extra) {
   } catch (_) { /* the note is best-effort; it must never become the failure */ }
 }
 
+/**
+ * What a note may say about a COMMAND: its hash, its program name, and a probe nonce if one is
+ * embedded — never the line itself.
+ *
+ * A veto fires on exactly the commands most likely to carry a credential (\`ssh\`, \`curl -u\`,
+ * \`psql\`), and the note is a durable file in the user's home. It recorded the full line
+ * (independent review, finding 8). The hash keeps the record useful — two notes are the same
+ * command iff their hashes match — and \`probeNonce\` keeps the live probe gradeable, because the
+ * probe's own correlator is a purpose-built token (\`dzprobe-…\` / \`dzverify-…\`) and not a secret.
+ */
+function commandFacts(command) {
+  var facts = {};
+  try {
+    facts.commandSha256 = require('node:crypto').createHash('sha256').update(String(command), 'utf8').digest('hex');
+  } catch (_) { /* hashing is best-effort too */ }
+  try {
+    // The first token is a BINARY NAME or nothing. \`SECRET=xyz ssh …\` puts a credential in the
+    // first token, and a synopsis is not worth one byte of it (fix round 2, R2-8): anything that is
+    // not a plain program name — in particular anything carrying \`=\` — is redacted outright.
+    var first = String(command).trim().split(/\\s+/)[0] || '';
+    facts.commandSynopsis = /^[A-Za-z0-9._\\/-]+$/.test(first) ? first.slice(0, 40) : '(redacted)';
+  } catch (_) { /* ignore */ }
+  try {
+    var m = String(command).match(/dz(?:probe|verify)-[0-9a-zA-Z-]+/);
+    if (m) facts.probeNonce = m[0];
+  } catch (_) { /* ignore */ }
+  return facts;
+}
+
 function readPayload() {
   try {
     const raw = fs.readFileSync(0, 'utf8');
@@ -159,14 +196,14 @@ function main() {
 
   if (mode === 'block') {
     process.stderr.write('DZ-VETO: ' + hit.rule + ' — ' + hit.reason + ' — command: ' + command + '\\n');
-    note('veto-block', null, { marker: 'DZ-VETO', rule: hit.rule, command: command, mode: mode });
+    note('veto-block', null, Object.assign({ marker: 'DZ-VETO', rule: hit.rule, mode: mode }, commandFacts(command)));
     return 2;
   }
   const warnLine = 'DZ-VETO-WARN: ' + hit.rule + ' — ' + hit.reason + ' — command: ' + command;
   process.stderr.write(warnLine + '\\n');
   // Codex swallows an exit-0 hook's stderr (MEASURED), so the warn is ALSO recorded where it can be
   // read back — otherwise the shipped default would be live-but-unobservable.
-  note('veto-warn', null, { marker: 'DZ-VETO-WARN', rule: hit.rule, command: command, mode: mode });
+  note('veto-warn', null, Object.assign({ marker: 'DZ-VETO-WARN', rule: hit.rule, mode: mode }, commandFacts(command)));
   return 0;
 }
 

package/dist/codex-hooks-assets.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hooks-assets.js","sourceRoot":"","sources":["../src/codex-hooks-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,gFAAgF;AAChF,SAAS,QAAQ;IACf,OAAO;oEAC2D,sBAAsB;;;;;;yBAMjE,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkF9C,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,sBAAsB,EAAE,uDAAuD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD9G,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,sBAAsB,EAAE,yDAAyD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0FhH,CAAC;AACF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,CAAC;AAClF,CAAC"}
+{"version":3,"file":"codex-hooks-assets.js","sourceRoot":"","sources":["../src/codex-hooks-assets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAE1D,gFAAgF;AAChF,SAAS,QAAQ;IACf,OAAO;oEAC2D,sBAAsB;;;;;;yBAMjE,sBAAsB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAuH9C,CAAC;AACF,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,sBAAsB,EAAE,uDAAuD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAkD9G,CAAC;AACF,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,yBAAyB;IACvC,OAAO,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,sBAAsB,EAAE,yDAAyD,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA0FhH,CAAC;AACF,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,oBAAoB;IAClC,OAAO,EAAE,IAAI,EAAE,uBAAuB,EAAE,EAAE,MAAM,EAAE,yBAAyB,EAAE,EAAE,CAAC;AAClF,CAAC"}

package/dist/codex-hooks-verify.d.ts

@@ -42,8 +42,29 @@ export interface VetoProbeEvidence {
     readonly transcript: string;
     /** Per-run nonce embedded in the probe command; guards against grading a stale transcript. */
     readonly nonce: string;
-    /** Did the sentinel side effect land? `true` ⇒ the command RAN. */
-    readonly sentinelPresent: boolean;
+    /**
+     * Did the sentinel side effect land? `true` ⇒ the command RAN.
+     *
+     * `null` ⇒ the state could NOT be established (the stat failed, or a transcript carried no
+     * sentinel header). ADR-002 §2 row `sentinelExists === null` ⇒ `inconclusive`: the QE fix round
+     * found the probe parser DEFAULTING a missing header to `false`, which is the difference between
+     * "the command was blocked" and "we did not look" (independent review, finding 4).
+     */
+    readonly sentinelPresent: boolean | null;
+    /**
+     * Did the `codex` invocation COMPLETE? `false` ⇒ inconclusive whatever the transcript says
+     * (ADR-002 §2). `null` ⇒ the caller LOOKED and could not tell ⇒ also inconclusive. Absent ⇒ the
+     * caller did not report completion at all; the other evidence still decides.
+     *
+     * The three-way split is the fix-round-2 correction (R2-4): a recorder that cannot find its own
+     * completion fields must say so EXPLICITLY, and an explicit "unknown" must not be graded like a
+     * caller who simply never spoke about completion.
+     */
+    readonly ran?: boolean | null | undefined;
+    /** The invocation's exit status. `null` ⇒ the process died / was killed / unrecorded ⇒ inconclusive. */
+    readonly exitCode?: number | null | undefined;
+    /** The invocation hit its timeout. `null` ⇒ recorded as unknown ⇒ inconclusive. */
+    readonly timedOut?: boolean | null | undefined;
     /** Did the transcript show the model actually attempting the shell command? */
     readonly shellAttempted: boolean;
     /** Was `--dangerously-bypass-hook-trust` in play? `true` can never yield a pass. */

package/dist/codex-hooks-verify.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hooks-verify.d.ts","sourceRoot":"","sources":["../src/codex-hooks-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,WAAW,GAAG,cAAc,CAAC;AACjE,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CAAC;AAEhE,mGAAmG;AACnG,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;AAEpF,iFAAiF;AACjF,eAAO,MAAM,cAAc,aAAa,CAAC;AACzC,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AACnD,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,uCAAuC,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,mEAAmE;IACnE,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACxD,0DAA0D;IAC1D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,gGAAgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAAG,SAAS,CAWjF;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,iBAAiB,GAAG,eAAe,CAqFvE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAI5D;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAE1D"}
+{"version":3,"file":"codex-hooks-verify.d.ts","sourceRoot":"","sources":["../src/codex-hooks-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,MAAM,MAAM,WAAW,GAAG,OAAO,GAAG,WAAW,GAAG,cAAc,CAAC;AACjE,MAAM,MAAM,SAAS,GAAG,SAAS,GAAG,eAAe,GAAG,SAAS,CAAC;AAEhE,mGAAmG;AACnG,MAAM,MAAM,oBAAoB,GAAG,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;AAEpF,iFAAiF;AACjF,eAAO,MAAM,cAAc,aAAa,CAAC;AACzC,uEAAuE;AACvE,eAAO,MAAM,mBAAmB,kBAAkB,CAAC;AACnD,sFAAsF;AACtF,eAAO,MAAM,oBAAoB,uCAAuC,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,gDAAgD;IAChD,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB;;;;;;;OAOG;IACH,QAAQ,CAAC,eAAe,EAAE,OAAO,GAAG,IAAI,CAAC;IACzC;;;;;;;;OAQG;IACH,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;IAC1C,wGAAwG;IACxG,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IAC9C,mFAAmF;IACnF,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,GAAG,IAAI,GAAG,SAAS,CAAC;IAC/C,+EAA+E;IAC/E,QAAQ,CAAC,cAAc,EAAE,OAAO,CAAC;IACjC,oFAAoF;IACpF,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,gGAAgG;IAChG,QAAQ,CAAC,WAAW,CAAC,EAAE,oBAAoB,GAAG,SAAS,CAAC;IACxD,0DAA0D;IAC1D,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACnD,gGAAgG;IAChG,QAAQ,CAAC,kBAAkB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAClD;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,SAAS,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED,sFAAsF;AACtF,wBAAgB,aAAa,CAAC,MAAM,EAAE,iBAAiB,CAAC,aAAa,CAAC,GAAG,SAAS,CAWjF;AAED,6EAA6E;AAC7E,wBAAgB,iBAAiB,CAAC,CAAC,EAAE,iBAAiB,GAAG,eAAe,CAqHvE;AAED;;;GAGG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,eAAe,GAAG,CAAC,GAAG,CAAC,GAAG,CAAC,CAI5D;AAED,iFAAiF;AACjF,wBAAgB,cAAc,CAAC,CAAC,EAAE,eAAe,GAAG,OAAO,CAE1D"}

package/dist/codex-hooks-verify.js

@@ -58,6 +58,35 @@ export function classifyVetoProbe(e) {
         };
     }
     const trust = classifyTrust(e.trustStatus);
+    // 1b. COMPLETION (ADR-002 §2, row "invocation did not complete"). A transcript from a run that
+    //     died, timed out, or never finished is a partial reading, and the marker can appear in a
+    //     partial reading. Decided before any transcript evidence is weighed (fix-round finding 4).
+    if (e.timedOut === true) {
+        return { verdict: 'inconclusive', trust, reason: 'the probe invocation TIMED OUT: a partial transcript is a failed observation, not a clean run' };
+    }
+    if (e.timedOut === null) {
+        return { verdict: 'inconclusive', trust, reason: 'completion evidence incomplete: the timeout state was recorded as UNKNOWN — a run that may have been cut short cannot witness a block' };
+    }
+    if (e.ran === null) {
+        return { verdict: 'inconclusive', trust, reason: 'completion evidence incomplete: whether the probe invocation completed was recorded as UNKNOWN' };
+    }
+    if (e.ran === false) {
+        return {
+            verdict: 'inconclusive',
+            trust,
+            reason: e.sentinelPresent === true
+                ? 'contradictory evidence: the invocation is reported as never completed, yet the sentinel side effect landed'
+                : 'the probe invocation did not complete — there is nothing to grade',
+        };
+    }
+    if (e.exitCode === null) {
+        return { verdict: 'inconclusive', trust, reason: 'the probe process died without an exit status (signal or kill) — evidence is missing, not clean' };
+    }
+    // 1c. An UNKNOWN sentinel state cannot be graded: "absent" is half of the two-sided witness, and
+    //     "we did not look" must never be spelled the same way (finding 4).
+    if (e.sentinelPresent !== true && e.sentinelPresent !== false) {
+        return { verdict: 'inconclusive', trust, reason: 'the sentinel side-effect state could not be established — evidence is missing, not clean' };
+    }
     // 2. Stale facts are not facts (AM-10).
     const recorded = e.recordedCodexVersion;
     const probed = e.probedCodexVersion;

package/dist/codex-hooks-verify.js.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hooks-verify.js","sourceRoot":"","sources":["../src/codex-hooks-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAQH,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AACzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AACnD,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AA2BzE,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,MAAwC;IACpE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,CAAoB;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAExE,gGAAgG;IAChG,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK,EAAE,SAAS;YAChB,MAAM,EACJ,kHAAkH;SACrH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAE3C,wCAAwC;IACxC,MAAM,QAAQ,GAAG,CAAC,CAAC,oBAAoB,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,CAAC,kBAAkB,CAAC;IACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACtF,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK;YACL,MAAM,EAAE,6CAA6C,QAAQ,qBAAqB,MAAM,yCAAyC;SAClI,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACnF,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK;YACL,MAAM,EAAE,gFAAgF;SACzF,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK;YACL,MAAM,EAAE,mGAAmG;SAC5G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAEtD,2FAA2F;IAC3F,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK;YACL,MAAM,EAAE,uEAAuE,cAAc,+CAA+C;SAC7I,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,cAAc;gBACvB,KAAK;gBACL,MAAM,EAAE,yFAAyF;aAClG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,KAAK;YACL,MAAM,EAAE,8FAA8F;SACvG,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,WAAW;YACpB,KAAK;YACL,MAAM,EAAE,oFAAoF;SAC7F,CAAC;IACJ,CAAC;IAED,wGAAwG;IACxG,OAAO;QACL,OAAO,EAAE,cAAc;QACvB,KAAK;QACL,MAAM,EAAE,gHAAgH;KACzH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAkB;IAC/C,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,OAAO,KAAK,cAAc;QAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,CAAkB;IAC/C,OAAO,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;AACxD,CAAC"}
+{"version":3,"file":"codex-hooks-verify.js","sourceRoot":"","sources":["../src/codex-hooks-verify.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAQH,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AACzC,uEAAuE;AACvE,MAAM,CAAC,MAAM,mBAAmB,GAAG,eAAe,CAAC;AACnD,sFAAsF;AACtF,MAAM,CAAC,MAAM,oBAAoB,GAAG,oCAAoC,CAAC;AAgDzE,sFAAsF;AACtF,MAAM,UAAU,aAAa,CAAC,MAAwC;IACpE,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,SAAS,CAAC;QACf,KAAK,SAAS;YACZ,OAAO,SAAS,CAAC;QACnB,KAAK,WAAW,CAAC;QACjB,KAAK,UAAU;YACb,OAAO,eAAe,CAAC;QACzB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,iBAAiB,CAAC,CAAoB;IACpD,MAAM,UAAU,GAAG,OAAO,CAAC,CAAC,UAAU,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC;IAExE,gGAAgG;IAChG,IAAI,CAAC,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;QAC7B,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK,EAAE,SAAS;YAChB,MAAM,EACJ,kHAAkH;SACrH,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAE3C,+FAA+F;IAC/F,8FAA8F;IAC9F,gGAAgG;IAChG,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,+FAA+F,EAAE,CAAC;IACrJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,uIAAuI,EAAE,CAAC;IAC7L,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,gGAAgG,EAAE,CAAC;IACtJ,CAAC;IACD,IAAI,CAAC,CAAC,GAAG,KAAK,KAAK,EAAE,CAAC;QACpB,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK;YACL,MAAM,EACJ,CAAC,CAAC,eAAe,KAAK,IAAI;gBACxB,CAAC,CAAC,4GAA4G;gBAC9G,CAAC,CAAC,mEAAmE;SAC1E,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,iGAAiG,EAAE,CAAC;IACvJ,CAAC;IAED,iGAAiG;IACjG,wEAAwE;IACxE,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,IAAI,CAAC,CAAC,eAAe,KAAK,KAAK,EAAE,CAAC;QAC9D,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,EAAE,0FAA0F,EAAE,CAAC;IAChJ,CAAC;IAED,wCAAwC;IACxC,MAAM,QAAQ,GAAG,CAAC,CAAC,oBAAoB,CAAC;IACxC,MAAM,MAAM,GAAG,CAAC,CAAC,kBAAkB,CAAC;IACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACtF,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK;YACL,MAAM,EAAE,6CAA6C,QAAQ,qBAAqB,MAAM,yCAAyC;SAClI,CAAC;IACJ,CAAC;IAED,0DAA0D;IAC1D,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QACnF,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK;YACL,MAAM,EAAE,gFAAgF;SACzF,CAAC;IACJ,CAAC;IAED,iGAAiG;IACjG,IAAI,CAAC,CAAC,cAAc,KAAK,IAAI,EAAE,CAAC;QAC9B,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK;YACL,MAAM,EAAE,mGAAmG;SAC5G,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,UAAU,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;IAEtD,2FAA2F;IAC3F,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,QAAQ,CAAC,oBAAoB,CAAC,EAAE,CAAC;QAC5D,OAAO;YACL,OAAO,EAAE,cAAc;YACvB,KAAK;YACL,MAAM,EAAE,uEAAuE,cAAc,+CAA+C;SAC7I,CAAC;IACJ,CAAC;IAED,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;YAC/B,OAAO;gBACL,OAAO,EAAE,cAAc;gBACvB,KAAK;gBACL,MAAM,EAAE,yFAAyF;aAClG,CAAC;QACJ,CAAC;QACD,OAAO;YACL,OAAO,EAAE,OAAO;YAChB,KAAK;YACL,MAAM,EAAE,8FAA8F;SACvG,CAAC;IACJ,CAAC;IAED,kDAAkD;IAClD,IAAI,CAAC,CAAC,eAAe,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO;YACL,OAAO,EAAE,WAAW;YACpB,KAAK;YACL,MAAM,EAAE,oFAAoF;SAC7F,CAAC;IACJ,CAAC;IAED,wGAAwG;IACxG,OAAO;QACL,OAAO,EAAE,cAAc;QACvB,KAAK;QACL,MAAM,EAAE,gHAAgH;KACzH,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,CAAkB;IAC/C,IAAI,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,OAAO,KAAK,cAAc;QAAE,OAAO,CAAC,CAAC;IAC3C,OAAO,CAAC,CAAC;AACX,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,cAAc,CAAC,CAAkB;IAC/C,OAAO,CAAC,CAAC,OAAO,KAAK,OAAO,IAAI,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC;AACxD,CAAC"}

package/dist/codex-hooks.d.ts

@@ -22,8 +22,16 @@
  *
  * @packageDocumentation
  */
-/** Bump when a helper BODY changes: a changed body changes codex's `currentHash` ⇒ re-trust. */
-export declare const DZ_HOOK_HELPER_VERSION = 1;
+/**
+ * Bump when a helper BODY changes: a changed body changes codex's `currentHash` ⇒ re-trust.
+ *
+ * 2 — the independent-QE fix round: the veto note stopped persisting the raw command line and the
+ * notes log/dir modes are now enforced on every write (finding 8).
+ * 3 — fix round 2: the note's `commandSynopsis` is a binary NAME or `(redacted)` — an
+ * env-assignment first token (`SECRET=xyz ssh …`) carried the credential the redaction removed
+ * everywhere else (R2-8).
+ */
+export declare const DZ_HOOK_HELPER_VERSION = 3;
 /** Seconds. Probe-proven (spike S2): `timeout` is honored, the unset default is 600 s. */
 export declare const DZ_HOOK_TIMEOUT_SECONDS = 5;
 /** The wide matcher (AM-8). Narrowing needs a recorded live probe; the guard keys on the payload. */
@@ -132,6 +140,19 @@ export declare function parseCodexHookManifest(text: string): CodexHookManifest
  * in `unattributable`, and warned about. A hand-edited managed command therefore survives.
  */
 export declare function isDzManagedEntry(entry: unknown, manifest: CodexHookManifest | undefined): boolean;
+/**
+ * Rebuild an OWNED entry from only the handlers that are NOT ours — per-HANDLER attribution.
+ *
+ * ADR-001 §5 promises that dz deletes only what it can prove it wrote. Attribution was applied to a
+ * whole MATCHER GROUP: a group holding one dz handler and one of the user's was removed (or
+ * replaced) wholesale, so a foreign handler was deleted by a rule written to protect it
+ * (independent review, finding 6). One dz handler in the group must cost exactly that handler.
+ *
+ * Returns `null` when every handler in the entry was ours (the entry itself is then dropped), and
+ * a rebuilt entry — same keys, same order, minus our handlers — when something foreign survives.
+ * A legacy FLAT entry (`{type, command}`) is one handler and has nothing to salvage.
+ */
+export declare function retainForeignHandlers(entry: unknown, manifest: CodexHookManifest | undefined): unknown | null;
 /** Cheap resemblance test — drives the `unattributable` COUNT only, never a deletion. */
 export declare function looksLikeDzEntry(entry: unknown): boolean;
 export interface CodexRegistry {
@@ -211,6 +232,21 @@ export interface DriftReport {
 export declare function diffCodexHooks(currentText: string | undefined, entries: readonly ManagedEntry[], manifest: CodexHookManifest | undefined): DriftReport;
 /** codex's snake_case event spelling inside a trust key (MEASURED from `hooks/list`). */
 export declare function trustEventName(event: CodexHookEvent): string;
+/**
+ * Compare two event spellings the way the runtime actually spells them.
+ *
+ * MEASURED, both on this machine, on the SAME response shape:
+ * - the trust KEY embeds `pre_tool_use` / `user_prompt_submit` (snake_case);
+ * - `hooks/list`'s `eventName` FIELD is `preToolUse` / `userPromptSubmit` on **codex-cli 0.148.0**
+ *   (reproducer: `listCodexHooks(<temp home>)` after an install — the rows are printed verbatim in
+ *   `07_code_changes/probe-results/fixround/trust-diagnosis.txt`).
+ *
+ * Pinning either spelling alone silently drops every row: the fix round's first cut compared the
+ * field against the KEY spelling, `hooks/list` matched 0 of 2 entries, trust was never written, and
+ * the live probe's ARMED leg stopped blocking. Case and separators are therefore normalised away —
+ * the spelling is the runtime's cosmetic choice, the EVENT is the fact.
+ */
+export declare function sameHookEvent(a: string, b: string): boolean;
 /**
  * The trust key codex uses: `<sourcePath>:<snake_event>:<groupIndex>:<hookIndex>`.
  *
@@ -219,6 +255,24 @@ export declare function trustEventName(event: CodexHookEvent): string;
  * nothing while reading like success.
  */
 export declare function expectedTrustKey(registryPath: string, event: CodexHookEvent, groupIndex: number, hookIndex: number): string;
+/**
+ * Split a `hooks/list` trust key into its parts, or `null` when it is not one.
+ *
+ * MEASURED shape: `<sourcePath>:<snake_event>:<groupIndex>:<hookIndex>`. The path may itself carry
+ * a colon, so the split is anchored at the END — the last two fields are the indices and the third
+ * from the end is the event.
+ *
+ * The INDICES are deliberately not predicted: they are positions inside the user's registry, and a
+ * foreign entry shifts them. What IS ours to require is the rest — this key names OUR registry and
+ * OUR event (fix round 2, R2-7: a row carrying an arbitrary key was selected on path+event+command
+ * alone, and the key is what dz then writes trust against).
+ */
+export declare function parseTrustKey(key: string): {
+    readonly sourcePath: string;
+    readonly event: string;
+    readonly groupIndex: number;
+    readonly hookIndex: number;
+} | null;
 export interface HookTrustRow {
     readonly key: string;
     readonly trustedHash: string;
@@ -234,8 +288,24 @@ export declare const DZ_TRUST_END = "# --- end dz codex hooks trust ---";
  * nothing else.
  */
 export declare function renderTrustBlock(rows: readonly HookTrustRow[]): string;
-/** Replace (or append) dz's managed trust block, leaving every other byte of config.toml alone. */
-export declare function upsertTrustBlock(configToml: string, rows: readonly HookTrustRow[]): string;
+export type TrustBlockResult = {
+    readonly ok: true;
+    readonly text: string;
+} | {
+    readonly ok: false;
+    readonly error: string;
+};
+/**
+ * Replace (or append) dz's managed trust block, leaving every other byte of config.toml alone.
+ *
+ * The fence must be **exactly one well-ordered pair**, or dz refuses (independent review, finding
+ * 9). The old `indexOf`-pair logic was satisfiable by a damaged file in three ways, and each one
+ * eats the user's TOML on the NEXT sync: a lone BEGIN made the rewrite append a second block, so
+ * the following run's `begin…end` window spanned everything between the orphan marker and the new
+ * block's END; a reversed pair did the same; duplicate pairs left an orphan block behind. Refusing
+ * costs one manual edit — the alternative silently deletes `[projects."…"]` trust rows.
+ */
+export declare function upsertTrustBlock(configToml: string, rows: readonly HookTrustRow[]): TrustBlockResult;
 export interface HooksListHookMetadata {
     readonly key: string;
     readonly eventName: string;
@@ -247,11 +317,24 @@ export interface HooksListHookMetadata {
     readonly enabled: boolean;
     readonly timeoutSec: number;
 }
+export interface SelectOwnHookOptions {
+    /** The registry file dz wrote. A row from any other source path is not dz's row. */
+    readonly registryPath: string;
+}
 /**
- * Pick, from a `hooks/list` response, the metadata of the entries WE wrote — matched on the exact
- * command string, so a third party's entry can never inherit dz's trust write.
+ * Pick, from a `hooks/list` response, the metadata of the entries WE wrote.
+ *
+ * The match is on THREE facts, not one (independent review, finding 7): the row's `sourcePath` is
+ * the registry dz wrote, its `eventName` is the event dz registered the entry under, and the
+ * command string is byte-equal. Command alone was not enough — a project-scoped
+ * `<repo>/.codex/hooks.json` DOES load on codex 0.148 (MEASURED, see ADR-004's addendum), so a
+ * shadow copy of dz's own command line could supply the `trusted` row that armed the user-global
+ * entry nobody had approved.
+ *
+ * AMBIGUITY IS REFUSED, not resolved: two rows claiming the same entry drop BOTH, because the one
+ * dz would arm is then a coin flip and the trust write is keyed by the row it picked.
  */
-export declare function selectOwnHookMetadata(hooks: readonly HooksListHookMetadata[], entries: readonly ManagedEntry[]): {
+export declare function selectOwnHookMetadata(hooks: readonly HooksListHookMetadata[], entries: readonly ManagedEntry[], options: SelectOwnHookOptions): {
     readonly id: CodexHookId;
     readonly meta: HooksListHookMetadata;
 }[];

package/dist/codex-hooks.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"codex-hooks.d.ts","sourceRoot":"","sources":["../src/codex-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,qGAAqG;AACrG,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAYlE;AAED,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAEzE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAEzE;AAMD,mGAAmG;AACnG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAO7E;AAMD,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;CACpC;AAED,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,EAAE,SAAS,aAAa,EAGvD,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,SAAS,YAAY,EAAE,CAU7F;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAM1F;AAMD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,iBAAiB,CAqBpF;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAUlF;AAQD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAIjG;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIxD;AAMD,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAyBhF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAEtE;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAkCnE;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAsB7E;AAED,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GACtC,WAAW,CAoCb;AAMD,yFAAyF;AACzF,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAE5D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAOD,eAAO,MAAM,cAAc,iEAAiE,CAAC;AAC7F,eAAO,MAAM,YAAY,uCAAuC,CAAC;AAEjE;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAMtE;AAED,mGAAmG;AACnG,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAW1F;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;IACvE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED;;;GAGG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,SAAS,qBAAqB,EAAE,EACvC,OAAO,EAAE,SAAS,YAAY,EAAE,GAC/B;IAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;CAAE,EAAE,CAQtE"}
+{"version":3,"file":"codex-hooks.d.ts","sourceRoot":"","sources":["../src/codex-hooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAOH;;;;;;;;GAQG;AACH,eAAO,MAAM,sBAAsB,IAAI,CAAC;AAExC,0FAA0F;AAC1F,eAAO,MAAM,uBAAuB,IAAI,CAAC;AAEzC,qGAAqG;AACrG,eAAO,MAAM,eAAe,2BAA2B,CAAC;AAExD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,sEAAsE;AACtE,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,CAYlE;AAED,yGAAyG;AACzG,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAEzE;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAEzE;AAMD,mGAAmG;AACnG,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAE1D;AAED,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,MAAM,CAO7E;AAMD,MAAM,MAAM,WAAW,GAAG,YAAY,GAAG,cAAc,CAAC;AACxD,MAAM,MAAM,cAAc,GAAG,YAAY,GAAG,kBAAkB,CAAC;AAE/D,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,QAAQ,CAAC;CACpC;AAED,wDAAwD;AACxD,eAAO,MAAM,mBAAmB,EAAE,SAAS,aAAa,EAGvD,CAAC;AAEF,MAAM,WAAW,0BAA0B;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;CACjC;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CACzC;AAED;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,IAAI,EAAE,0BAA0B,GAAG,SAAS,YAAY,EAAE,CAU7F;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAM1F;AAMD,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEpD;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,cAAc,CAAC;IAC/B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,yFAAyF;IACzF,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC;IACpB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,SAAS,sBAAsB,EAAE,CAAC;IACpD,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC;CAC7C;AAED,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,KAAK,EAAE,eAAe,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACtD,QAAQ,CAAC,UAAU,CAAC,EAAE,qBAAqB,CAAC;CAC7C;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,oBAAoB,GAAG,iBAAiB,CAqBpF;AAED,wBAAgB,sBAAsB,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS,CAUlF;AAQD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GAAG,OAAO,CAIjG;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GAAG,OAAO,GAAG,IAAI,CAS7G;AAED,yFAAyF;AACzF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,OAAO,GAAG,OAAO,CAIxD;AAMD,MAAM,WAAW,aAAa;IAC5B,kEAAkE;IAClE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;CAC3C;AAED,MAAM,MAAM,mBAAmB,GAC3B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GACvD;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEnD;;;GAGG;AACH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,SAAS,GAAG,mBAAmB,CAmChF;AAED,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE,aAAa,GAAG,MAAM,CAEtE;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,OAAO,EAAE,SAAS,YAAY,EAAE,CAAC;IAC1C,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,CAAC;CAClD;AAED;;;;;GAKG;AACH,wBAAgB,cAAc,CAC5B,KAAK,EAAE,mBAAmB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,IAAI,EAAE,cAAc,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAsCnE;AAED,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;IACjC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;CACjC;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAC9B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GACtC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,sBAAsB,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CA2B7E;AAED,MAAM,WAAW,WAAW;IAC1B,qEAAqE;IACrE,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,UAAU,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5C,QAAQ,CAAC,UAAU,EAAE,SAAS,WAAW,EAAE,CAAC;IAC5C,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,cAAc,EAAE,MAAM,CAAC;IAChC,oFAAoF;IACpF,QAAQ,CAAC,OAAO,EAAE,SAAS,WAAW,EAAE,CAAC;CAC1C;AAED,2FAA2F;AAC3F,wBAAgB,cAAc,CAC5B,WAAW,EAAE,MAAM,GAAG,SAAS,EAC/B,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,QAAQ,EAAE,iBAAiB,GAAG,SAAS,GACtC,WAAW,CAoCb;AAMD,yFAAyF;AACzF,wBAAgB,cAAc,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAE5D;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAG3D;AAED;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAC9B,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,cAAc,EACrB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,MAAM,CAER;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,aAAa,CAC3B,GAAG,EAAE,MAAM,GACV;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAIzH;AAED,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;CAC9B;AAOD,eAAO,MAAM,cAAc,iEAAiE,CAAC;AAC7F,eAAO,MAAM,YAAY,uCAAuC,CAAC;AAEjE;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAMtE;AAED,MAAM,MAAM,gBAAgB,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAY7H;;;;;;;;;GASG;AACH,wBAAgB,gBAAgB,CAAC,UAAU,EAAE,MAAM,EAAE,IAAI,EAAE,SAAS,YAAY,EAAE,GAAG,gBAAgB,CAuBpG;AAED,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,WAAW,EAAE,SAAS,GAAG,WAAW,GAAG,SAAS,GAAG,UAAU,CAAC;IACvE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,MAAM,WAAW,oBAAoB;IACnC,oFAAoF;IACpF,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,SAAS,qBAAqB,EAAE,EACvC,OAAO,EAAE,SAAS,YAAY,EAAE,EAChC,OAAO,EAAE,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,WAAW,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAA;CAAE,EAAE,CAuBtE"}