@intutic/gate 2.4.0 → 2.5.1

package/README.md

@@ -15,9 +15,11 @@ eve's per-tool/per-connection `approval` policy surface — Vercel's
 filesystem-first durable-agent framework, a pre-1.0 **Preview** product),
 `@intutic/gate/harness` (Vercel's `@ai-sdk/harness` sandboxed coding-agent
 runtime), `@intutic/gate/workflow` (Vercel's `@ai-sdk/workflow` durable
-workflow agents), and `@intutic/gate/managed-agents` (Anthropic's Managed
+workflow agents), `@intutic/gate/managed-agents` (Anthropic's Managed
 Agents — a session-confirmation responder, not a hook, since Anthropic hosts
-the tool-call loop; see below). LangChain.js has no dedicated adapter planned
+the tool-call loop; see below), and `@intutic/gate/trueforge`
+(`intuticApprovalResponder()` answering TrueForge's `tool.approval_required`
+pauses, for a process that embeds `@truefoundry/trueforge-core`). LangChain.js has no dedicated adapter planned
 and instead uses the generic `wrapTool`/`wrapTools` helper directly.
 
 ## Quick start
@@ -42,6 +44,32 @@ implementation runs — this package's throw-based refusal contract, the same on
 `packages/mcp-proxy/src/policy.ts` use elsewhere in this repo's gate
 vocabulary.
 
+## Fail mode
+
+`GateClient` fails closed by default (`failClosed: true`). When the control
+plane's hook gate cannot be reached, answers non-2xx, or answers
+`GOVERNANCE_UNAVAILABLE` because a check it runs (the SOP register, the SSO
+group policy, the MCP server registry, image provenance, promoted findings)
+could not complete, there is no verdict, and the call is refused with
+`HOOK_GATE`. Pass `failClosed: false` to let calls through during such an
+outage. A request the hook gate cannot read (HTTP 400, `INVALID_REQUEST`) is
+refused whatever `failClosed` says. intutic-clawde's `GateClient` behaves the
+same way, held to it by `packages/shared-types/fixtures/hook-gate-response-vectors.json`.
+
+Each hook-gate answer names its decision (`decisionId`). The gate reports the
+call as `tool_blocked` or `tool_allowed` with it as `gateDecisionId`, so the
+control plane files the decision's incident once and exports it to SIEM once,
+as the hook gate's own record. A `GOVERNANCE_UNAVAILABLE` answer keeps the id
+only while failing closed.
+
+A `GateClient` with no API key (what `fromEnv()` builds when neither
+`INTUTIC_API_KEY` nor `~/.intutic/credentials.json` has one) is local-only
+(`client.localOnly`): it sends nothing, the gate skips the SOP register and
+the hook gate, whose answer is an allow with code `LOCAL_ONLY`, and the
+snapshot, SSO-group, MCP-registry and image tiers still decide. A key the
+control plane refuses (401) is not local-only and fails closed as above. Both
+SDKs run `packages/shared-types/fixtures/gate-client-credentials-vectors.json`.
+
 ## Public API surface
 
 | Export | From | What it is |
@@ -50,15 +78,16 @@ vocabulary.
 | `install(gate)`, `active()` | `gate.ts` | Process-wide default gate, so wrapped tools don't need the instance threaded through every call site. |
 | `IntuticGateRefusal`, `GateError`, `GateConnectionError` | `errors.ts` | Thrown on refusal. `.reason`, `.code` (a `GateRefusalCode`, listed in `GATE_REFUSAL_CODES`), `.incidentId` carry the structured verdict; `.message` carries the `[Intutic Governance] BLOCKED: ...` text. |
 | `IntuticGateHold` | `errors.ts` | The `IntuticGateRefusal` a hold rule throws (`code` `HELD`) after recording the hold for approval; `.holdId` names it. See `hold.ts`. |
-| `GateClient` | `client.ts` | Control-plane client (`hookGate`, `emit`, `GateClient.fromEnv(...)`). |
+| `GateClient` | `client.ts` | Control-plane client (`hookGate`, `emit`, `localOnly`, `GateClient.fromEnv(...)`). |
 | `wrapTool(fn \| tool, opts?)`, `wrapTools(list \| record, gate?)` | `wrapTools.ts` | Generic wrapping for a plain async function or an `{ execute, ... }`-shaped tool object. **This is the integration point for any JS framework without a dedicated adapter — LangChain.js included.** |
 | `intuticHeaders(opts?)` | `headers.ts` | Headers for a proxy-pointed HTTP/OpenAI-compatible client (`x-session-id`, `x-workspace-id`, `x-intutic-harness`). |
 | `loadSnapshot`, `evaluate`, `Snapshot`, `guardDisabledFromEnv` | `snapshot.ts` | Tier A1: reads `~/.intutic/hooks/policy-snapshot.rules`. |
-| `parseRules`, `firstMatch`, `fetchRules`, `SopRule` | `soprules.ts` | Tier A3: SOP-authored `WHERE`-clause rules. |
+| `parseRules`, `firstMatch`, `fetchRules`, `fetchRegister`, `parseRegister`, `SopRule`, `SopRegister` | `soprules.ts` | Tier A3: SOP-authored `WHERE`-clause rules, and the register they come in (rules plus the workspace's intervention mode). |
 | `checkCommand`, `checkImages`, `checkWrittenManifest`, `ImageVerdict` | `imagecheck.ts` | Tier A2: container-image provenance on deploy commands. |
 | `McpRegistryRecord`, `McpAllowlistRecord` | `mcpRegistryRecord.ts` | Tier M: the snapshot's MCP server registry and allowlist (`Snapshot.mcpRegistry`, `Snapshot.mcpAllowlist`), decided as the hook gates and the MCP proxy decide them; a byte-identical copy of `@intutic/shared-types`' module. |
 | `classify`, `isDeploy`, `isTest`, `touchesInfra` | `actions.ts` | Command classifier shared by A2's deploy trigger. |
 | `canonicalJson`, `holdKey`, `holdMessage` | `hold.ts` | The hold helpers: key-sorted JSON, the tool name and argument hash an approved hold is matched on, and the message a held call carries. |
+| (internal) | `chaosGate.ts` | A chaos run's plan, counters and faults, which `Gate.guard` applies when `INTUTIC_CHAOS_PLAN` is set (`CHAOS_FAULT`, or `IntuticGateHold` for a held call); a byte-identical copy of `@intutic/shared-types`' module, as the hook gates emit it. |
 | `COMMAND_SIZE_LIMIT`, `ARGUMENTS_SIZE_LIMIT`, `GATE_DEADLINE_MS` | `limits.ts` | A command over 256 KiB or arguments over 1 MiB are refused with `COMMAND_TOO_LARGE` before any tier runs. `GATE_DEADLINE_MS` (9000) is how long the hook script `intuticSandboxBootstrap()` writes may evaluate, from process start, before it refuses with `GATE_DEADLINE`: one second under that hook entry's 10-second timeout, so a slow rule is refused rather than left to the harness. |
 
 The snapshot must carry the `#digest <hash>` line the sync daemon writes (the
@@ -69,7 +98,7 @@ dropped, the SSO group policy still refuses, and every MCP call is refused with
 `POLICY_SNAPSHOT_UNVERIFIED`. A hand-written snapshot for a test needs the line
 too.
 
-Full reference: [Gate SDK](https://docs.intutic.ai/reference/gate-sdk).
+Full reference: [Gate SDK](https://docs.intutic.ai/reference/gate-sdk). Every export, with its signature and defaults: [API reference](https://docs.intutic.ai/reference/sdk/gate/).
 
 ### A note for sibling adapter phases
 
@@ -236,7 +265,7 @@ ordering gotcha.
 
 ## Subpath convention
 
-Eight adapters exist today, one source file each: `@intutic/gate/dsh`
+Nine adapters exist today, one source file each: `@intutic/gate/dsh`
 (`src/dsh.ts` — a Cordis plugin; see its module doc for the veto contract and
 `services/sync-daemon/src/harness/dshHooks.ts` for profile registration),
 `@intutic/gate/mastra` (`src/mastra.ts`), `@intutic/gate/vercel`
@@ -247,7 +276,8 @@ per-tool/per-connection `approval` surface, plus the observe-only
 pre-1.0 Preview product, see its module doc), `@intutic/gate/harness`
 (`src/harness.ts` — see above), `@intutic/gate/workflow` (`src/workflow.ts`
 — see above), and `@intutic/gate/managed-agents` (`src/managedAgents.ts` — see
-above). Later adapter phases follow the SAME convention (also
+above), and `@intutic/gate/trueforge` (`src/trueforge.ts` — embedded mode
+only; see its module doc). Later adapter phases follow the SAME convention (also
 `services/sync-daemon`'s existing subpath convention — see that package's
 `package.json`):
 
@@ -257,10 +287,12 @@ above). Later adapter phases follow the SAME convention (also
    ```json
    "./vercel": { "import": "./dist/vercel.js", "types": "./dist/vercel.d.ts" }
    ```
-3. A matching `typesVersions` entry so editors resolve types from source
-   pre-build:
+3. A matching `typesVersions` entry pointing at the built declarations, so a
+   consumer resolving with `moduleResolution: node` finds the subpath's types
+   (only `dist/` is published, so a `src/` path here resolves to nothing;
+   `tools/scripts/check-package-entrypoints.js` fails the build on one):
    ```json
-   "typesVersions": { "*": { "vercel": ["src/vercel.ts"] } }
+   "typesVersions": { "*": { "vercel": ["dist/vercel.d.ts"] } }
    ```
 4. Each adapter file imports from `./gate.js`, `./errors.js`, etc. (this
    package's core, already built) rather than re-implementing any tier —

package/dist/actions.d.ts

@@ -80,6 +80,7 @@ export declare function toolIs(name: string, group: readonly string[]): boolean;
 export declare function classify(toolName: string, toolInput: unknown): string[];
 /** True when this call would deploy — the trigger for the image check. */
 export declare function isDeploy(toolName: string, toolInput: unknown): boolean;
+/** True when this call runs a test suite. */
 export declare function isTest(toolName: string, toolInput: unknown): boolean;
 /** True when a written path is infrastructure-as-code. */
 export declare function touchesInfra(path: string | null | undefined): boolean;

package/dist/actions.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAe5C,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAA;AAED,mCAAmC;AACnC,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAO7C,CAAA;AAED,sCAAsC;AACtC,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAqB1C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAS9C,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAclD,CAAA;AAED,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAYxC,CAAA;AAED,kDAAkD;AAClD,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAAqD,CAAA;AAE7F,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAmE,CAAA;AAE5G;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EASjD,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUnD;AAUD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAsBvE;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEtE;AAED,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEpE;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE"}
+{"version":3,"file":"actions.d.ts","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,eAAO,MAAM,aAAa,YAAY,CAAA;AAEtC,0DAA0D;AAC1D,eAAO,MAAM,eAAe,EAAE,SAAS,MAAM,EAe5C,CAAA;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAS7C,CAAA;AAED,mCAAmC;AACnC,eAAO,MAAM,gBAAgB,EAAE,SAAS,MAAM,EAO7C,CAAA;AAED,sCAAsC;AACtC,eAAO,MAAM,aAAa,EAAE,SAAS,MAAM,EAqB1C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,yCAAyC;AACzC,eAAO,MAAM,iBAAiB,EAAE,SAAS,MAAM,EAS9C,CAAA;AAED;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,EAAE,SAAS,MAAM,EAclD,CAAA;AAED,qEAAqE;AACrE,eAAO,MAAM,kBAAkB,EAAE,SAAS,MAAM,EAO/C,CAAA;AAED,0DAA0D;AAC1D,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAYxC,CAAA;AAED,kDAAkD;AAClD,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAAqD,CAAA;AAE7F,kDAAkD;AAClD,eAAO,MAAM,WAAW,EAAE,SAAS,MAAM,EAAmE,CAAA;AAE5G;;;;GAIG;AACH,eAAO,MAAM,oBAAoB,EAAE,SAAS,MAAM,EASjD,CAAA;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAUnD;AAUD,wBAAgB,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEjF;AAED;;;;GAIG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAGtE;AAED;;;;;;GAMG;AACH,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,CAsBvE;AAED,0EAA0E;AAC1E,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEtE;AAED,6CAA6C;AAC7C,wBAAgB,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,SAAS,EAAE,OAAO,GAAG,OAAO,CAEpE;AAED,0DAA0D;AAC1D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAErE"}

package/dist/actions.js

@@ -245,6 +245,7 @@ export function classify(toolName, toolInput) {
 export function isDeploy(toolName, toolInput) {
     return classify(toolName, toolInput).includes(ACTION_PREFIX + 'deploy');
 }
+/** True when this call runs a test suite. */
 export function isTest(toolName, toolInput) {
     return classify(toolName, toolInput).includes(ACTION_PREFIX + 'run_tests');
 }

package/dist/actions.js.map

@@ -1 +1 @@
-{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAA;AAErE,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAA;AAEtC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,mBAAmB;IACnB,YAAY;IACZ,eAAe;IACf,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,sBAAsB;CACvB,CAAA;AAED,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,mBAAmB;IACnB,SAAS;IACT,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,kBAAkB;CACnB,CAAA;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,UAAU;IACV,cAAc;IACd,WAAW;IACX,eAAe;IACf,WAAW;IACX,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,QAAQ;IACR,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;IACV,aAAa;IACb,YAAY;IACZ,KAAK;CACN,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,qBAAqB;IACrB,UAAU;IACV,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,aAAa;IACb,SAAS;IACT,aAAa;IACb,YAAY;IACZ,eAAe;IACf,aAAa;IACb,WAAW;IACX,aAAa;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;IACR,OAAO;IACP,OAAO;IACP,YAAY;IACZ,iBAAiB;CAClB,CAAA;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,WAAW;IACX,KAAK;IACL,UAAU;IACV,MAAM;IACN,SAAS;CACV,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,MAAM;IACN,OAAO;IACP,aAAa;IACb,YAAY;IACZ,0EAA0E;IAC1E,iBAAiB;IACjB,2BAA2B;IAC3B,mBAAmB;IACnB,UAAU;IACV,SAAS;IACT,MAAM;CACP,CAAA;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;AAE7F,kDAAkD;AAClD,MAAM,CAAC,MAAM,WAAW,GAAsB,CAAC,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AAE5G;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,WAAW;IACX,KAAK;IACL,MAAM;IACN,aAAa;IACb,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,UAAU;CACX,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;aACjC,IAAI,CAAC,EAAE,CAAC,CAAA;IACb,CAAC;IACD,2DAA2D;IAC3D,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAiB,EAAE,QAA2B;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,qEAAqE;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAE9B,IAAI,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAClC,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClE,IAAI,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjE,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnE,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACxE,IAAI,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACpE,IAAI,aAAa,CAAC,KAAK,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,aAAa,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAA;AACzE,CAAC;AAED,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,SAAkB;IACzD,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,WAAW,CAAC,CAAA;AAC5E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAA+B;IAC1D,OAAO,UAAU,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC,CAAA;AACrE,CAAC"}
+{"version":3,"file":"actions.js","sourceRoot":"","sources":["../src/actions.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,SAAS,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAA;AAErE,MAAM,CAAC,MAAM,aAAa,GAAG,SAAS,CAAA;AAEtC,0DAA0D;AAC1D,MAAM,CAAC,MAAM,eAAe,GAAsB;IAChD,UAAU;IACV,eAAe;IACf,iBAAiB;IACjB,cAAc;IACd,cAAc;IACd,iBAAiB;IACjB,aAAa;IACb,mBAAmB;IACnB,YAAY;IACZ,eAAe;IACf,mBAAmB;IACnB,YAAY;IACZ,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,aAAa;IACb,cAAc;IACd,cAAc;IACd,eAAe;IACf,cAAc;IACd,gBAAgB;IAChB,UAAU;IACV,sBAAsB;CACvB,CAAA;AAED,mCAAmC;AACnC,MAAM,CAAC,MAAM,gBAAgB,GAAsB;IACjD,mBAAmB;IACnB,SAAS;IACT,aAAa;IACb,eAAe;IACf,oBAAoB;IACpB,kBAAkB;CACnB,CAAA;AAED,sCAAsC;AACtC,MAAM,CAAC,MAAM,aAAa,GAAsB;IAC9C,UAAU;IACV,cAAc;IACd,WAAW;IACX,eAAe;IACf,WAAW;IACX,YAAY;IACZ,SAAS;IACT,QAAQ;IACR,kBAAkB;IAClB,QAAQ;IACR,MAAM;IACN,OAAO;IACP,OAAO;IACP,SAAS;IACT,WAAW;IACX,aAAa;IACb,UAAU;IACV,aAAa;IACb,YAAY;IACZ,KAAK;CACN,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,cAAc;IACd,qBAAqB;IACrB,UAAU;IACV,aAAa;IACb,aAAa;IACb,WAAW;CACZ,CAAA;AAED,yCAAyC;AACzC,MAAM,CAAC,MAAM,iBAAiB,GAAsB;IAClD,aAAa;IACb,SAAS;IACT,aAAa;IACb,YAAY;IACZ,eAAe;IACf,aAAa;IACb,WAAW;IACX,aAAa;CACd,CAAA;AAED;;;;;GAKG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAsB;IACtD,MAAM;IACN,aAAa;IACb,QAAQ;IACR,YAAY;IACZ,MAAM;IACN,MAAM;IACN,MAAM;IACN,UAAU;IACV,QAAQ;IACR,OAAO;IACP,OAAO;IACP,YAAY;IACZ,iBAAiB;CAClB,CAAA;AAED,qEAAqE;AACrE,MAAM,CAAC,MAAM,kBAAkB,GAAsB;IACnD,UAAU;IACV,WAAW;IACX,KAAK;IACL,UAAU;IACV,MAAM;IACN,SAAS;CACV,CAAA;AAED,0DAA0D;AAC1D,MAAM,CAAC,MAAM,WAAW,GAAsB;IAC5C,MAAM;IACN,OAAO;IACP,aAAa;IACb,YAAY;IACZ,0EAA0E;IAC1E,iBAAiB;IACjB,2BAA2B;IAC3B,mBAAmB;IACnB,UAAU;IACV,SAAS;IACT,MAAM;CACP,CAAA;AAED,kDAAkD;AAClD,MAAM,CAAC,MAAM,UAAU,GAAsB,CAAC,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,WAAW,CAAC,CAAA;AAE7F,kDAAkD;AAClD,MAAM,CAAC,MAAM,WAAW,GAAsB,CAAC,UAAU,EAAE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAE,YAAY,CAAC,CAAA;AAE5G;;;;GAIG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAsB;IACrD,WAAW;IACX,KAAK;IACL,MAAM;IACN,aAAa;IACb,OAAO;IACP,YAAY;IACZ,gBAAgB;IAChB,UAAU;CACX,CAAA;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,YAAY,CAAC,KAAc;IACzC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC,WAAW,EAAE,CAAA;IACzD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;IACjF,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAChD,OAAO,MAAM,CAAC,MAAM,CAAC,KAAgC,CAAC;aACnD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;aACjC,IAAI,CAAC,EAAE,CAAC,CAAA;IACb,CAAC;IACD,2DAA2D;IAC3D,OAAO,EAAE,CAAA;AACX,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,KAAiB,EAAE,QAA2B;IACnE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAA;AAClD,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,QAAgB,EAAE,QAA2B;IACtE,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AACnD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY,EAAE,KAAwB;IAC3D,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAA;IAChC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5D,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,CAAC,CAAA;IACpC,MAAM,OAAO,GAAa,EAAE,CAAA;IAC5B,qEAAqE;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAE9B,IAAI,MAAM,CAAC,QAAQ,EAAE,WAAW,CAAC,EAAE,CAAC;QAClC,sEAAsE;QACtE,kEAAkE;QAClE,IAAI,aAAa,CAAC,KAAK,EAAE,aAAa,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QAClE,IAAI,aAAa,CAAC,KAAK,EAAE,eAAe,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAA;QACjE,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnE,IAAI,aAAa,CAAC,KAAK,EAAE,gBAAgB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,CAAA;QACnE,wEAAwE;QACxE,sCAAsC;QACtC,IAAI,UAAU,CAAC,IAAI,EAAE,qBAAqB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,CAAA;QACxE,IAAI,UAAU,CAAC,IAAI,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,YAAY,CAAC,CAAA;QACpE,IAAI,aAAa,CAAC,KAAK,EAAE,kBAAkB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,CAAA;QACvE,IAAI,aAAa,CAAC,KAAK,EAAE,iBAAiB,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,CAAA;IACvE,CAAC;IAED,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,GAAG,CAAC,CAAC,CAAA;AAC9C,CAAC;AAED,0EAA0E;AAC1E,MAAM,UAAU,QAAQ,CAAC,QAAgB,EAAE,SAAkB;IAC3D,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,QAAQ,CAAC,CAAA;AACzE,CAAC;AAED,6CAA6C;AAC7C,MAAM,UAAU,MAAM,CAAC,QAAgB,EAAE,SAAkB;IACzD,OAAO,QAAQ,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,QAAQ,CAAC,aAAa,GAAG,WAAW,CAAC,CAAA;AAC5E,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,YAAY,CAAC,IAA+B;IAC1D,OAAO,UAAU,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC,CAAA;AACrE,CAAC"}

package/dist/chaosGate.d.ts

@@ -0,0 +1,166 @@
+/**
+ * Fault injection in the gates: the part of a chaos run (`chaos.ts`) a hook
+ * gate or an in-process gate SDK carries.
+ *
+ * A hook gate is a new process per tool call, and parallel gates share one
+ * run, so nothing here keeps state in memory: the plan comes from {@link CHAOS_PLAN_ENV}-style text each call,
+ * and every count lives in files beside the events file.
+ *
+ * - `<events>.gate-plan-loaded` — created once, with an exclusive create; the
+ *   gate that creates it reports `plan_loaded`, so separate gate processes do
+ *   not repeat it.
+ * - `<events>.gate-counters/<fault index>.seen.<n>` and `.hit.<n>` — one
+ *   empty file per matching call a fault saw and per call it hit. A call
+ *   claims the next number with an exclusive create (`open` with `wx`,
+ *   `O_CREAT | O_EXCL`), which the file system grants to exactly one process,
+ *   so two gates deciding at once can never both take the same number; the
+ *   claimed number is the call's 1-based index. A count is the number of
+ *   files, read once to start the search, so a claim costs one directory
+ *   read and usually one create. That is `FaultCounter`'s `after_calls` and
+ *   `times` across processes.
+ * - `<events>.gate-counters/<fault index>.held.<key>.<g>` — a call a
+ *   `permission.deny_or_delay` fault in `delay` or `hold_then_deny` mode
+ *   held; its modification time is when. `<key>` is the call's digest (the
+ *   tool and its input, as the gate keys an approval hold), `<g>` counts the
+ *   holds of that call, claimed like a call number. `.released.<key>.<g>`,
+ *   created with the same exclusive create, ends that hold: one retry, and
+ *   only one, is the one the hold lets through or denies.
+ *
+ * A permission fault never makes a gate wait. It holds the call the way an
+ * approval hold does: the call is refused as held, and the identical retry
+ * (same tool, same input) is refused as held again until `delay_s` seconds
+ * have passed since the first refusal. After that the retry is allowed
+ * (`delay`) or denied (`hold_then_deny`), and the hold is over: the next
+ * identical call is a new matching call. A held call's retries are the same
+ * call, so no fault counts them as matching calls. A test moves the clock by
+ * moving the `held` files' modification times back.
+ *
+ * Only a call governance allowed counts: a fault never applies to a call the
+ * gate refused, held or asked about, so such a call is not one of the
+ * fault's matching calls either. Every fault whose `match` covers an allowed
+ * call counts it as seen; the first one in plan order that is due injects,
+ * and the faults after it do not spend a hit on the same call. A `tool.error`
+ * on an `mcp__<server>__<tool>` call is the MCP proxy's to inject, so a gate
+ * leaves it alone; `permission.deny_or_delay` is the gate's on any tool.
+ *
+ * The functions are self-contained on purpose — no imports, no module state —
+ * because the JavaScript hook gates emit them as source
+ * ({@link CHAOS_GATE_JS_SOURCE}) and run them outside this package, and
+ * `@intutic/gate` carries a byte-identical copy of this file
+ * (`packages/gate-js/src/chaosGate.ts`). The bash gates and
+ * `intutic_clawde.gate` run the Python transliteration,
+ * `intutic_clawde/gate/chaos.py`, which the sync daemon emits verbatim. All
+ * of them run `fixtures/chaos-gate-vectors.json`. File access goes through
+ * the `fs` argument (Node's `fs` in a gate).
+ *
+ * @module
+ */
+/** One fault a gate injects, with its defaults applied. */
+export interface ChaosGateFault {
+    /** The fault's position in the plan: its counters are keyed on it. */
+    index: number;
+    id: 'tool.error' | 'permission.deny_or_delay';
+    match: {
+        tool?: string;
+        host?: string;
+        model?: string;
+    } | null;
+    afterCalls: number;
+    times: number | null;
+    /** `tool.error` only. */
+    message: string;
+    /** `permission.deny_or_delay` only. */
+    mode: 'deny' | 'delay' | 'hold_then_deny';
+    /** `permission.deny_or_delay` only: how long a held call stays held, in seconds. */
+    delayS: number;
+}
+/** The fields of a plan a gate uses. */
+export interface ChaosGatePlan {
+    runId: string;
+    canary: string;
+    /** The faults a gate injects; the plan's others are another component's. */
+    faults: ChaosGateFault[];
+}
+/** One call, as the gate decided it before any fault. */
+export interface ChaosGateCall {
+    tool: string;
+    decision: 'allow' | 'deny' | 'ask' | 'hold';
+    ruleId?: string | null;
+    destructive: boolean;
+    policyHit: boolean;
+    /**
+     * The call's digest in hex: its tool and input, as the gate keys an
+     * approval hold, so an identical retry has the same key. Only a held
+     * call's retry reads it.
+     */
+    key?: string;
+}
+/** A fault to apply to an allowed call. */
+export interface ChaosGateFaultOutcome {
+    faultId: string;
+    /** `deny` refuses the call; `hold` refuses it as held, as an approval hold does. */
+    kind: 'deny' | 'hold';
+    /** The refusal text, carrying the plan's canary. */
+    reason: string;
+}
+/** The file operations the functions use: Node's `fs` provides them. */
+export interface ChaosGateFs {
+    appendFileSync(path: string, data: string): void;
+    mkdirSync(path: string): unknown;
+    readdirSync(path: string): string[];
+    openSync(path: string, flags: string): number;
+    closeSync(fd: number): void;
+    statSync(path: string): {
+        mtimeMs: number;
+    };
+}
+/**
+ * Decodes and checks a plan: base64url JSON, version 1, with valid values in
+ * every field a gate reads. Returns the plan, or why it is not one.
+ */
+export declare function chaosGateDecode(raw: string): {
+    plan: ChaosGatePlan;
+    error: null;
+} | {
+    plan: null;
+    error: string;
+};
+/**
+ * Whether a fault's `match` covers a gate call. A gate call has a tool and
+ * nothing else, so a fault that names a host or a model never matches one.
+ * `tool` matches exactly, or by suffix when it starts with `*`.
+ */
+export declare function chaosGateMatches(match: ChaosGateFault['match'], tool: string): boolean;
+/** One events-file line: `ts`, `runId`, `component`, `type`, then the fields that are set. */
+export declare function chaosGateEvent(plan: ChaosGatePlan, type: string, fields: Record<string, unknown>, now: string): string;
+/** Appends whole lines in one write. An I/O error is reported, never thrown: it must not decide the call. */
+export declare function chaosGateAppend(fs: ChaosGateFs, eventsPath: string, lines: string): void;
+/**
+ * Claims the next numbered file `<dir>/<prefix><n>` with an exclusive create
+ * and returns n, or 0 when every number up to `limit` is taken. -1 on an I/O
+ * error, after saying so.
+ */
+export declare function chaosGateClaim(fs: ChaosGateFs, dir: string, prefix: string, limit: number | null): number;
+/**
+ * The open hold of one fault on one call: the number of the newest
+ * `<fault>.held.<key>.<g>` file that has no `.released.` twin, and when it
+ * was created. Null when there is none or it cannot be read.
+ */
+export declare function chaosGateOpenHold(fs: ChaosGateFs, dir: string, fault: number, key: string): {
+    g: number;
+    sinceMs: number;
+} | null;
+/** Ends hold g with an exclusive create: true for the one caller that does. */
+export declare function chaosGateRelease(fs: ChaosGateFs, dir: string, fault: number, key: string, g: number): boolean;
+/**
+ * Reports one call: `plan_loaded` the first time any gate reports to this
+ * events file, then `gate_decision`; for an allowed call, the fault that is
+ * due (`fault_injected`, once per held call however often it is retried),
+ * and `tool_call`: ok when the call goes ahead, not ok when it is held.
+ * Returns the fault the gate must apply, or null. `now` is the ISO-8601 time,
+ * and the clock a hold is timed by.
+ */
+export declare function chaosGateCall(fs: ChaosGateFs, plan: ChaosGatePlan, eventsPath: string, call: ChaosGateCall, now: string): ChaosGateFaultOutcome | null;
+/** Every function above as JavaScript source, for a hook gate to emit. */
+export declare const CHAOS_GATE_JS_SOURCE: string;
+//# sourceMappingURL=chaosGate.d.ts.map

package/dist/chaosGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chaosGate.d.ts","sourceRoot":"","sources":["../src/chaosGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,YAAY,GAAG,0BAA0B,CAAA;IAC7C,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC9D,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,gBAAgB,CAAA;IACzC,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAA;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,4EAA4E;IAC5E,MAAM,EAAE,cAAc,EAAE,CAAA;CACzB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;IAC3C,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,2CAA2C;AAC3C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,oFAAoF;IACpF,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IACrB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAA;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAChD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAChC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;IAC7C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5C;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAuEjH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAMtF;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAItH;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAUxF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CA4BzG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiBjI;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAQ7G;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,WAAW,EACf,IAAI,EAAE,aAAa,EACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,MAAM,GACV,qBAAqB,GAAG,IAAI,CAyE9B;AAED,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,QAWpB,CAAA"}