@intutic/shared-types 2.3.0 → 2.5.0

package/dist/chaos.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chaos.d.ts","sourceRoot":"","sources":["../src/chaos.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAA;AAEvB,wFAAwF;AACxF,eAAO,MAAM,cAAc,uBAAuB,CAAA;AAElD,mFAAmF;AACnF,eAAO,MAAM,gBAAgB,yBAAyB,CAAA;AAEtD,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,IAAI,CAAA;AAEnC,4CAA4C;AAC5C,eAAO,MAAM,SAAS,+OAYZ,CAAA;AACV,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAA;AAEhD,0DAA0D;AAC1D,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,OAAO,GAAG,WAAW,GAAG,MAAM,CAAA;AAEtE;;;GAGG;AACH,MAAM,MAAM,WAAW,GAAG,WAAW,GAAG,UAAU,CAAA;AAElD,gEAAgE;AAChE,eAAO,MAAM,aAAa,EAAE,QAAQ,CAAC,MAAM,CAAC,OAAO,EAAE;IAAE,UAAU,EAAE,SAAS,cAAc,EAAE,CAAC;IAAC,MAAM,EAAE,WAAW,CAAA;CAAE,CAAC,CAYnH,CAAA;AAID;;;;GAIG;AACH,QAAA,MAAM,WAAW;;;;;;;;;;;;EAMN,CAAA;AACX,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;AAapD,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;IARtB,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;IAapE,qFAAqF;;;;;;;;;;;;;;;IAfzF,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAFxE,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAFxE,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAFxE,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAFxE,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;IAiCpE,wDAAwD;;;;;;;;;;;;;;;IAnC5D,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;IA0CpE;;;;;;;OAOG;;;;;;;;;;;;;;;IAnDP,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAFxE,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAFxE,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAFxE,gEAAgE;;IAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;IAwDxE,CAAA;AACF,MAAM,MAAM,KAAK,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,WAAW,CAAC,CAAA;AAI/C,eAAO,MAAM,eAAe;;;IAIxB,sEAAsE;;IAEtE,qFAAqF;;;;;;;;;;;;;;;;;QArEvF,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;QAapE,qFAAqF;;;;;;;;;;;;;;;QAfzF,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;QAiCpE,wDAAwD;;;;;;;;;;;;;;;QAnC5D,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0CpE;;;;;;;WAOG;;;;;;;;;;;;;;;QAnDP,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAuE/D,CAAA;AACX,MAAM,MAAM,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,eAAe,CAAC,CAAA;AAevD,gDAAgD;AAChD,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,GAAG,MAAM,CAEvD;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,SAAS,GAAG,SAAS,GAAG,IAAI,CAWzE;AAED,qFAAqF;AACrF,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAI9F;AAED,+CAA+C;AAC/C,wBAAgB,YAAY,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,OAAO,CAI1G;AAED;;;;GAIG;AACH,qBAAa,YAAY;IACvB,OAAO,CAAC,IAAI,CAA4B;IACxC,OAAO,CAAC,GAAG,CAA4B;IAEvC,4EAA4E;IAC5E,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO;CASxD;AAED,oFAAoF;AACpF,wBAAgB,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAElF;AAUD,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;IAMzB,2DAA2D;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAW3D,gFAAgF;;IAEhF,8CAA8C;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;IAYhD,CAAA;AACF,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAEzD,4EAA4E;AAC5E,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG;IAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE,CAc1F;AAID,eAAO,MAAM,SAAS,wIAOZ,CAAA;AACV,MAAM,MAAM,OAAO,GAAG,CAAC,OAAO,SAAS,CAAC,CAAC,MAAM,CAAC,CAAA;AAoBhD,eAAO,MAAM,gBAAgB;;;IAIzB,6DAA6D;;IAE7D,2EAA2E;;IAE3E,8EAA8E;;;;;;;;;;;;;;;;;QAzPhF,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;QAapE,qFAAqF;;;;;;;;;;;;;;;QAfzF,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;QAiCpE,wDAAwD;;;;;;;;;;;;;;;QAnC5D,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;QA0CpE;;;;;;;WAOG;;;;;;;;;;;;;;;QAnDP,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAFxE,gEAAgE;;QAEhE,wEAAwE;;;;;;;;;;;;;;;;;;;;;;;;;QAiOtE,sFAAsF;;;;;;;;;;;;;;;;;;;IA0BtF,iEAAiE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAM1D,CAAA;AACX,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,gBAAgB,CAAC,CAAA;AAIzD,8DAA8D;AAC9D,MAAM,WAAW,YAAY;IAC3B,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,4DAA4D;IAC5D,QAAQ,EAAE,MAAM,CAAA;IAChB,SAAS,EAAE,MAAM,CAAA;CAClB;AAED,MAAM,MAAM,UAAU,GAClB;IAAE,IAAI,EAAE,QAAQ,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAA;CAAE;AAC3D,6EAA6E;GAC3E;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GACnC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,YAAY,EAAE,CAAA;CAAE,CAAA;AAE9E;;;GAGG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,SAAS,YAAY,EAAE,GAAG,MAAM,CAMvE"}

package/dist/chaos.js

@@ -0,0 +1,358 @@
+"use strict";
+/**
+ * chaos.ts — the contract for agent fault injection (`intutic chaos run`).
+ *
+ * A chaos run executes an agent with a known fault injected and checks what
+ * the agent did next. Four components share this contract:
+ *
+ * - the CLI runner, which reads an experiment file, launches each repetition
+ *   in a sandbox and scores the result;
+ * - the LLM proxy, which injects the `llm.*` and `egress.*` faults;
+ * - the MCP proxy, which injects the MCP side of `tool.error` plus
+ *   `tool.stale_data`, `mcp.toolset_change` and `inject.tool_result`;
+ * - the gates — the hook gates and the in-process gate SDKs — which inject
+ *   `permission.deny_or_delay` and the built-in-tool side of `tool.error`.
+ *
+ * The runner hands each component a plan through {@link CHAOS_PLAN_ENV} and an
+ * events file through {@link CHAOS_EVENTS_ENV}. Both are plain environment
+ * variables, so they cross the sandbox boundary the same way the proxy URL
+ * does. Each component appends one JSON line per event to the events file;
+ * the probes read nothing else.
+ *
+ * Two rules every injector keeps:
+ *
+ * 1. **A fault never loosens governance.** Faults are applied only to a call
+ *    that governance has already allowed. A fault can turn an allow into a
+ *    failure, a delay or a changed result; it can never turn a block, a hold
+ *    or a redaction into an allow.
+ * 2. **Silence is not success.** A component that loads a plan reports
+ *    `plan_loaded`, so the runner can tell "the fault fired and the agent
+ *    coped" from "the component never saw the plan".
+ *
+ * The Rust proxy decodes the same plan with serde; its tests read the fixture
+ * at `src/__tests__/fixtures/chaos-plan.json`, which this module's tests also
+ * validate, so the two decoders cannot drift apart.
+ *
+ * @module
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.ExperimentSchema = exports.PROBE_IDS = exports.ChaosEventSchema = exports.FaultCounter = exports.ChaosPlanSchema = exports.FaultSchema = exports.FAULT_CATALOG = exports.FAULT_IDS = exports.CHAOS_PLAN_VERSION = exports.CHAOS_EVENTS_ENV = exports.CHAOS_PLAN_ENV = void 0;
+exports.encodeChaosPlan = encodeChaosPlan;
+exports.decodeChaosPlan = decodeChaosPlan;
+exports.matchesPattern = matchesPattern;
+exports.faultMatches = faultMatches;
+exports.faultMessage = faultMessage;
+exports.parseChaosEvents = parseChaosEvents;
+exports.resilienceScore = resilienceScore;
+const zod_1 = require("zod");
+/** Environment variable carrying the plan: base64url-encoded JSON {@link ChaosPlan}. */
+exports.CHAOS_PLAN_ENV = 'INTUTIC_CHAOS_PLAN';
+/** Environment variable carrying the path of the append-only JSONL events file. */
+exports.CHAOS_EVENTS_ENV = 'INTUTIC_CHAOS_EVENTS';
+/** Wire version of {@link ChaosPlan}. A component refuses any other version. */
+exports.CHAOS_PLAN_VERSION = 1;
+/** Every fault the catalog knows, by id. */
+exports.FAULT_IDS = [
+    'llm.rate_limit',
+    'llm.upstream_5xx',
+    'llm.context_trim',
+    'llm.model_degrade',
+    'tool.error',
+    'tool.stale_data',
+    'mcp.toolset_change',
+    'permission.deny_or_delay',
+    'inject.tool_result',
+    'egress.dns_fail',
+    'egress.credential_401',
+];
+/** Which component injects each fault, and its safety class. */
+exports.FAULT_CATALOG = {
+    'llm.rate_limit': { injectedBy: ['proxy'], safety: 'fail_safe' },
+    'llm.upstream_5xx': { injectedBy: ['proxy'], safety: 'fail_safe' },
+    'llm.context_trim': { injectedBy: ['proxy'], safety: 'mutating' },
+    'llm.model_degrade': { injectedBy: ['proxy'], safety: 'mutating' },
+    'tool.error': { injectedBy: ['gate', 'mcp-proxy'], safety: 'fail_safe' },
+    'tool.stale_data': { injectedBy: ['mcp-proxy'], safety: 'mutating' },
+    'mcp.toolset_change': { injectedBy: ['mcp-proxy'], safety: 'mutating' },
+    'permission.deny_or_delay': { injectedBy: ['gate'], safety: 'fail_safe' },
+    'inject.tool_result': { injectedBy: ['mcp-proxy'], safety: 'mutating' },
+    'egress.dns_fail': { injectedBy: ['proxy'], safety: 'fail_safe' },
+    'egress.credential_401': { injectedBy: ['proxy'], safety: 'fail_safe' },
+};
+// ── Faults ───────────────────────────────────────────────────────────────────
+/**
+ * Which calls a fault applies to. Every field present must match; an absent
+ * field matches anything. `tool` and `host` match exactly, or by suffix when
+ * they start with `*` (`*.npmjs.org`). `model` matches the requested model id.
+ */
+const MatchSchema = zod_1.z
+    .object({
+    tool: zod_1.z.string().min(1).optional(),
+    host: zod_1.z.string().min(1).optional(),
+    model: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+/** Fields every fault has: which calls, how many to skip, how many to hit. */
+const common = {
+    match: MatchSchema.optional(),
+    /** Skip this many matching calls before the first injection. */
+    after_calls: zod_1.z.number().int().min(0).max(10_000).default(0),
+    /** Inject at most this many times; absent means every matching call. */
+    times: zod_1.z.number().int().min(1).max(10_000).optional(),
+};
+const hostRequired = MatchSchema.extend({ host: zod_1.z.string().min(1) });
+exports.FaultSchema = zod_1.z.discriminatedUnion('id', [
+    zod_1.z.object({ id: zod_1.z.literal('llm.rate_limit'), ...common, retry_after_s: zod_1.z.number().int().min(0).max(600).default(5) }).strict(),
+    zod_1.z
+        .object({
+        id: zod_1.z.literal('llm.upstream_5xx'),
+        ...common,
+        status: zod_1.z.union([zod_1.z.literal(500), zod_1.z.literal(502), zod_1.z.literal(503), zod_1.z.literal(529)]).default(500),
+        /** Cut a streamed response after this many chunks instead of failing the request. */
+        stream_cut_after_chunks: zod_1.z.number().int().min(0).max(10_000).optional(),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        id: zod_1.z.literal('llm.context_trim'),
+        ...common,
+        drop_oldest: zod_1.z.number().int().min(0).max(1_000).default(0),
+        drop_system: zod_1.z.boolean().default(false),
+    })
+        .strict(),
+    zod_1.z.object({ id: zod_1.z.literal('llm.model_degrade'), ...common, to_model: zod_1.z.string().min(1) }).strict(),
+    zod_1.z.object({ id: zod_1.z.literal('tool.error'), ...common, message: zod_1.z.string().min(1).max(2_000).default('tool failed') }).strict(),
+    zod_1.z.object({ id: zod_1.z.literal('tool.stale_data'), ...common, result: zod_1.z.string().max(100_000) }).strict(),
+    zod_1.z
+        .object({
+        id: zod_1.z.literal('mcp.toolset_change'),
+        ...common,
+        remove: zod_1.z.array(zod_1.z.string().min(1)).max(500).default([]),
+        /** Tool name → the description it is redefined with. */
+        redefine: zod_1.z.record(zod_1.z.string().min(1), zod_1.z.string().max(10_000)).default({}),
+    })
+        .strict(),
+    zod_1.z
+        .object({
+        id: zod_1.z.literal('permission.deny_or_delay'),
+        ...common,
+        mode: zod_1.z.enum(['deny', 'delay', 'hold_then_deny']).default('deny'),
+        /**
+         * `delay` and `hold_then_deny`: how long a held call stays held. The
+         * call is refused as held, the way an approval hold refuses it, and so
+         * is its identical retry until this many seconds have passed since the
+         * first refusal; then the retry is allowed (`delay`) or denied
+         * (`hold_then_deny`). Nothing waits: 0 holds the call once and allows
+         * (or denies) the first retry.
+         */
+        delay_s: zod_1.z.number().int().min(0).max(600).default(0),
+    })
+        .strict(),
+    zod_1.z.object({ id: zod_1.z.literal('inject.tool_result'), ...common, payload: zod_1.z.string().min(1).max(20_000) }).strict(),
+    zod_1.z.object({ id: zod_1.z.literal('egress.dns_fail'), ...common, match: hostRequired }).strict(),
+    zod_1.z.object({ id: zod_1.z.literal('egress.credential_401'), ...common, match: hostRequired }).strict(),
+]);
+// ── The plan a component receives ────────────────────────────────────────────
+exports.ChaosPlanSchema = zod_1.z
+    .object({
+    v: zod_1.z.literal(exports.CHAOS_PLAN_VERSION),
+    runId: zod_1.z.string().regex(/^[A-Za-z0-9_-]{6,64}$/),
+    /** 0-based repetition index; baseline repetitions carry no faults. */
+    repetition: zod_1.z.number().int().min(0).max(1_000),
+    /** Token every injected error text carries, so `failure_surfaced` needs no model. */
+    canary: zod_1.z.string().regex(/^E-INTUTIC-[0-9A-F]{4,16}$/),
+    faults: zod_1.z.array(exports.FaultSchema).max(50),
+})
+    .strict();
+// base64url without Node's Buffer: the dashboard imports this package in the browser.
+function toBase64Url(text) {
+    let binary = '';
+    for (const byte of new TextEncoder().encode(text))
+        binary += String.fromCharCode(byte);
+    return btoa(binary).replace(/\+/g, '-').replace(/\//g, '_').replace(/=+$/, '');
+}
+function fromBase64Url(raw) {
+    const b64 = raw.replace(/-/g, '+').replace(/_/g, '/');
+    const binary = atob(b64 + '='.repeat((4 - (b64.length % 4)) % 4));
+    return new TextDecoder().decode(Uint8Array.from(binary, (c) => c.charCodeAt(0)));
+}
+/** Encode a plan for {@link CHAOS_PLAN_ENV}. */
+function encodeChaosPlan(plan) {
+    return toBase64Url(JSON.stringify(exports.ChaosPlanSchema.parse(plan)));
+}
+/**
+ * Decode {@link CHAOS_PLAN_ENV}. Returns null when the variable is unset or
+ * empty; throws when it is set but not a valid plan, so a component can say
+ * so instead of silently injecting nothing.
+ */
+function decodeChaosPlan(raw) {
+    if (!raw)
+        return null;
+    let json;
+    try {
+        json = JSON.parse(fromBase64Url(raw));
+    }
+    catch {
+        throw new Error(`${exports.CHAOS_PLAN_ENV} is not base64url-encoded JSON`);
+    }
+    const parsed = exports.ChaosPlanSchema.safeParse(json);
+    if (!parsed.success)
+        throw new Error(`${exports.CHAOS_PLAN_ENV} is not a valid plan: ${parsed.error.issues[0]?.message ?? 'invalid'}`);
+    return parsed.data;
+}
+/** Whether `value` matches a fault's `tool`/`host` pattern (exact, or `*suffix`). */
+function matchesPattern(pattern, value) {
+    if (pattern === undefined)
+        return true;
+    if (value === undefined)
+        return false;
+    return pattern.startsWith('*') ? value.endsWith(pattern.slice(1)) : value === pattern;
+}
+/** Whether a fault's `match` covers a call. */
+function faultMatches(fault, call) {
+    const m = fault.match;
+    if (!m)
+        return true;
+    return matchesPattern(m.tool, call.tool) && matchesPattern(m.host, call.host) && matchesPattern(m.model, call.model);
+}
+/**
+ * Per-process injection counter: decides whether the nth matching call of a
+ * fault is hit, honouring `after_calls` and `times`. One instance per
+ * component process; the plan is per run, so per-process state is per run.
+ */
+class FaultCounter {
+    seen = new Map();
+    hit = new Map();
+    /** Call once per matching call; returns true when this call is injected. */
+    shouldInject(faultIndex, fault) {
+        const seen = (this.seen.get(faultIndex) ?? 0) + 1;
+        this.seen.set(faultIndex, seen);
+        if (seen <= fault.after_calls)
+            return false;
+        const hit = this.hit.get(faultIndex) ?? 0;
+        if (fault.times !== undefined && hit >= fault.times)
+            return false;
+        this.hit.set(faultIndex, hit + 1);
+        return true;
+    }
+}
+exports.FaultCounter = FaultCounter;
+/** The error text an injected failure carries: the base message plus the canary. */
+function faultMessage(plan, base) {
+    return `${base} [${plan.canary}]`;
+}
+// ── Events ───────────────────────────────────────────────────────────────────
+const eventBase = {
+    ts: zod_1.z.string(),
+    runId: zod_1.z.string(),
+    component: zod_1.z.enum(['runner', 'proxy', 'mcp-proxy', 'gate']),
+};
+exports.ChaosEventSchema = zod_1.z.discriminatedUnion('type', [
+    zod_1.z.object({ ...eventBase, type: zod_1.z.literal('plan_loaded'), faults: zod_1.z.number().int().min(0) }),
+    zod_1.z.object({
+        ...eventBase,
+        type: zod_1.z.literal('fault_injected'),
+        faultId: zod_1.z.enum(exports.FAULT_IDS),
+        /** The 1-based index of the matching call that was hit. */
+        call: zod_1.z.number().int().min(1),
+        target: zod_1.z.string().optional(),
+    }),
+    zod_1.z.object({ ...eventBase, type: zod_1.z.literal('tool_call'), tool: zod_1.z.string(), ok: zod_1.z.boolean() }),
+    zod_1.z.object({
+        ...eventBase,
+        type: zod_1.z.literal('gate_decision'),
+        tool: zod_1.z.string(),
+        decision: zod_1.z.enum(['allow', 'deny', 'ask', 'hold']),
+        ruleId: zod_1.z.string().optional(),
+        /** The call hit the destructive-command tier, whether or not it was blocked. */
+        destructive: zod_1.z.boolean(),
+        /** An enforce-mode rule fired on the call. */
+        policyHit: zod_1.z.boolean(),
+    }),
+    zod_1.z.object({
+        ...eventBase,
+        type: zod_1.z.literal('llm_usage'),
+        model: zod_1.z.string(),
+        inputTokens: zod_1.z.number().int().min(0),
+        outputTokens: zod_1.z.number().int().min(0),
+        costUsd: zod_1.z.number().min(0),
+    }),
+    zod_1.z.object({ ...eventBase, type: zod_1.z.literal('abort'), reason: zod_1.z.string() }),
+]);
+/** Parse an events file's text; malformed lines are counted, not thrown. */
+function parseChaosEvents(text) {
+    const events = [];
+    let malformed = 0;
+    for (const line of text.split('\n')) {
+        if (!line.trim())
+            continue;
+        try {
+            const parsed = exports.ChaosEventSchema.safeParse(JSON.parse(line));
+            if (parsed.success)
+                events.push(parsed.data);
+            else
+                malformed++;
+        }
+        catch {
+            malformed++;
+        }
+    }
+    return { events, malformed };
+}
+// ── Experiments ──────────────────────────────────────────────────────────────
+exports.PROBE_IDS = [
+    'task_success',
+    'no_destructive_attempt',
+    'failure_surfaced',
+    'no_policy_hits',
+    'cost_multiplier_below',
+    'recovered_within',
+];
+const ProbeSchema = zod_1.z
+    .object({
+    id: zod_1.z.enum(exports.PROBE_IDS),
+    weight: zod_1.z.number().int().min(1).max(10),
+    /** Threshold for `cost_multiplier_below` (a ratio) and `recovered_within` (calls). */
+    value: zod_1.z.number().positive().optional(),
+})
+    .strict()
+    .refine((p) => (p.id === 'cost_multiplier_below' || p.id === 'recovered_within' ? p.value !== undefined : p.value === undefined), {
+    message: 'cost_multiplier_below and recovered_within need a value; other probes take none',
+});
+const AbortSchema = zod_1.z.union([
+    zod_1.z.literal('destructive_attempt'),
+    zod_1.z.object({ cost_usd_above: zod_1.z.number().positive() }).strict(),
+    zod_1.z.object({ wall_clock_s_above: zod_1.z.number().int().positive() }).strict(),
+]);
+exports.ExperimentSchema = zod_1.z
+    .object({
+    name: zod_1.z.string().regex(/^[a-z0-9][a-z0-9-]{0,63}$/),
+    description: zod_1.z.string().max(2_000).optional(),
+    /** The agent command, run in the sandbox through a shell. */
+    agent: zod_1.z.string().min(1),
+    /** Run in the sandbox after the agent; exit 0 means the task succeeded. */
+    verify: zod_1.z.string().min(1),
+    /** Faulted repetitions; the same number of baseline repetitions run first. */
+    repeat: zod_1.z.number().int().min(1).max(20).default(3),
+    faults: zod_1.z.array(exports.FaultSchema).min(1).max(20),
+    probes: zod_1.z.array(ProbeSchema).min(1),
+    /** A cost ceiling is mandatory: every run spends real tokens. */
+    abort: zod_1.z.array(AbortSchema).refine((a) => a.some((x) => typeof x === 'object' && 'cost_usd_above' in x), {
+        message: 'abort must include a cost_usd_above ceiling',
+    }),
+    sandbox_image: zod_1.z.string().min(1).optional(),
+})
+    .strict();
+/**
+ * The resilience score: Σ(weight × pass rate) ÷ Σ(weight) × 100, rounded to
+ * one decimal. Probes that evaluated no repetition are left out of both sums.
+ */
+function resilienceScore(probes) {
+    const counted = probes.filter((p) => p.evaluated > 0);
+    const weights = counted.reduce((s, p) => s + p.weight, 0);
+    if (weights === 0)
+        return 0;
+    const sum = counted.reduce((s, p) => s + p.weight * p.passRate, 0);
+    return Math.round((sum / weights) * 1000) / 10;
+}
+//# sourceMappingURL=chaos.js.map

package/dist/chaos.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"chaos.js","sourceRoot":"","sources":["../src/chaos.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;;;AAkKH,0CAEC;AAOD,0CAWC;AAGD,wCAIC;AAGD,oCAIC;AAwBD,oCAEC;AA6CD,4CAcC;AA0ED,0CAMC;AAvWD,6BAAuB;AAEvB,wFAAwF;AAC3E,QAAA,cAAc,GAAG,oBAAoB,CAAA;AAElD,mFAAmF;AACtE,QAAA,gBAAgB,GAAG,sBAAsB,CAAA;AAEtD,gFAAgF;AACnE,QAAA,kBAAkB,GAAG,CAAC,CAAA;AAEnC,4CAA4C;AAC/B,QAAA,SAAS,GAAG;IACvB,gBAAgB;IAChB,kBAAkB;IAClB,kBAAkB;IAClB,mBAAmB;IACnB,YAAY;IACZ,iBAAiB;IACjB,oBAAoB;IACpB,0BAA0B;IAC1B,oBAAoB;IACpB,iBAAiB;IACjB,uBAAuB;CACf,CAAA;AAYV,gEAAgE;AACnD,QAAA,aAAa,GAA8F;IACtH,gBAAgB,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE;IAChE,kBAAkB,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE;IAClE,kBAAkB,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE;IACjE,mBAAmB,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE;IAClE,YAAY,EAAE,EAAE,UAAU,EAAE,CAAC,MAAM,EAAE,WAAW,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE;IACxE,iBAAiB,EAAE,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE;IACpE,oBAAoB,EAAE,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE;IACvE,0BAA0B,EAAE,EAAE,UAAU,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE;IACzE,oBAAoB,EAAE,EAAE,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE;IACvE,iBAAiB,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE;IACjE,uBAAuB,EAAE,EAAE,UAAU,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,WAAW,EAAE;CACxE,CAAA;AAED,gFAAgF;AAEhF;;;;GAIG;AACH,MAAM,WAAW,GAAG,OAAC;KAClB,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;IAClC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CACpC,CAAC;KACD,MAAM,EAAE,CAAA;AAGX,8EAA8E;AAC9E,MAAM,MAAM,GAAG;IACb,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE;IAC7B,gEAAgE;IAChE,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3D,wEAAwE;IACxE,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;CACtD,CAAA;AAED,MAAM,YAAY,GAAG,WAAW,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAA;AAEvD,QAAA,WAAW,GAAG,OAAC,CAAC,kBAAkB,CAAC,IAAI,EAAE;IACpD,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC,EAAE,GAAG,MAAM,EAAE,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7H,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACjC,GAAG,MAAM;QACT,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,CAAC,OAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAC,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,OAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC;QAC9F,qFAAqF;QACrF,uBAAuB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,QAAQ,EAAE;KACxE,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,kBAAkB,CAAC;QACjC,GAAG,MAAM;QACT,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;QAC1D,WAAW,EAAE,OAAC,CAAC,OAAO,EAAE,CAAC,OAAO,CAAC,KAAK,CAAC;KACxC,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,mBAAmB,CAAC,EAAE,GAAG,MAAM,EAAE,QAAQ,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACjG,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC3H,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IACnG,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC;QACnC,GAAG,MAAM;QACT,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;QACvD,wDAAwD;QACxD,QAAQ,EAAE,OAAC,CAAC,MAAM,CAAC,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;KAC1E,CAAC;SACD,MAAM,EAAE;IACX,OAAC;SACE,MAAM,CAAC;QACN,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,0BAA0B,CAAC;QACzC,GAAG,MAAM;QACT,IAAI,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC;QACjE;;;;;;;WAOG;QACH,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;KACrD,CAAC;SACD,MAAM,EAAE;IACX,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,oBAAoB,CAAC,EAAE,GAAG,MAAM,EAAE,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;IAC7G,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,iBAAiB,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;IACvF,OAAC,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,CAAC,uBAAuB,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,MAAM,EAAE;CAC9F,CAAC,CAAA;AAGF,gFAAgF;AAEnE,QAAA,eAAe,GAAG,OAAC;KAC7B,MAAM,CAAC;IACN,CAAC,EAAE,OAAC,CAAC,OAAO,CAAC,0BAAkB,CAAC;IAChC,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,uBAAuB,CAAC;IAChD,sEAAsE;IACtE,UAAU,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,CAAC;IAC9C,qFAAqF;IACrF,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,4BAA4B,CAAC;IACtD,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,mBAAW,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;CACrC,CAAC;KACD,MAAM,EAAE,CAAA;AAGX,sFAAsF;AACtF,SAAS,WAAW,CAAC,IAAY;IAC/B,IAAI,MAAM,GAAG,EAAE,CAAA;IACf,KAAK,MAAM,IAAI,IAAI,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAA;IACtF,OAAO,IAAI,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAA;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAA;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA;IACjE,OAAO,IAAI,WAAW,EAAE,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAClF,CAAC;AAED,gDAAgD;AAChD,SAAgB,eAAe,CAAC,IAAe;IAC7C,OAAO,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,uBAAe,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjE,CAAC;AAED;;;;GAIG;AACH,SAAgB,eAAe,CAAC,GAAuB;IACrD,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAA;IACrB,IAAI,IAAa,CAAA;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAA;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,GAAG,sBAAc,gCAAgC,CAAC,CAAA;IACpE,CAAC;IACD,MAAM,MAAM,GAAG,uBAAe,CAAC,SAAS,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,IAAI,KAAK,CAAC,GAAG,sBAAc,yBAAyB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,OAAO,IAAI,SAAS,EAAE,CAAC,CAAA;IAC9H,OAAO,MAAM,CAAC,IAAI,CAAA;AACpB,CAAC;AAED,qFAAqF;AACrF,SAAgB,cAAc,CAAC,OAA2B,EAAE,KAAyB;IACnF,IAAI,OAAO,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IACtC,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAA;IACrC,OAAO,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,OAAO,CAAA;AACvF,CAAC;AAED,+CAA+C;AAC/C,SAAgB,YAAY,CAAC,KAAY,EAAE,IAAsD;IAC/F,MAAM,CAAC,GAAG,KAAK,CAAC,KAAK,CAAA;IACrB,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAA;IACnB,OAAO,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,cAAc,CAAC,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,KAAK,CAAC,CAAA;AACtH,CAAC;AAED;;;;GAIG;AACH,MAAa,YAAY;IACf,IAAI,GAAG,IAAI,GAAG,EAAkB,CAAA;IAChC,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAA;IAEvC,4EAA4E;IAC5E,YAAY,CAAC,UAAkB,EAAE,KAAY;QAC3C,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAA;QACjD,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,CAAA;QAC/B,IAAI,IAAI,IAAI,KAAK,CAAC,WAAW;YAAE,OAAO,KAAK,CAAA;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAA;QACzC,IAAI,KAAK,CAAC,KAAK,KAAK,SAAS,IAAI,GAAG,IAAI,KAAK,CAAC,KAAK;YAAE,OAAO,KAAK,CAAA;QACjE,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,UAAU,EAAE,GAAG,GAAG,CAAC,CAAC,CAAA;QACjC,OAAO,IAAI,CAAA;IACb,CAAC;CACF;AAdD,oCAcC;AAED,oFAAoF;AACpF,SAAgB,YAAY,CAAC,IAA+B,EAAE,IAAY;IACxE,OAAO,GAAG,IAAI,KAAK,IAAI,CAAC,MAAM,GAAG,CAAA;AACnC,CAAC;AAED,gFAAgF;AAEhF,MAAM,SAAS,GAAG;IAChB,EAAE,EAAE,OAAC,CAAC,MAAM,EAAE;IACd,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;IACjB,SAAS,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,CAAC,CAAC;CAC5D,CAAA;AAEY,QAAA,gBAAgB,GAAG,OAAC,CAAC,kBAAkB,CAAC,MAAM,EAAE;IAC3D,OAAC,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,aAAa,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC;IAC3F,OAAC,CAAC,MAAM,CAAC;QACP,GAAG,SAAS;QACZ,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,gBAAgB,CAAC;QACjC,OAAO,EAAE,OAAC,CAAC,IAAI,CAAC,iBAAS,CAAC;QAC1B,2DAA2D;QAC3D,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QAC7B,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC9B,CAAC;IACF,OAAC,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,EAAE,EAAE,OAAC,CAAC,OAAO,EAAE,EAAE,CAAC;IAC3F,OAAC,CAAC,MAAM,CAAC;QACP,GAAG,SAAS;QACZ,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,eAAe,CAAC;QAChC,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE;QAChB,QAAQ,EAAE,OAAC,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,gFAAgF;QAChF,WAAW,EAAE,OAAC,CAAC,OAAO,EAAE;QACxB,8CAA8C;QAC9C,SAAS,EAAE,OAAC,CAAC,OAAO,EAAE;KACvB,CAAC;IACF,OAAC,CAAC,MAAM,CAAC;QACP,GAAG,SAAS;QACZ,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,WAAW,CAAC;QAC5B,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE;QACjB,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACpC,YAAY,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACrC,OAAO,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;KAC3B,CAAC;IACF,OAAC,CAAC,MAAM,CAAC,EAAE,GAAG,SAAS,EAAE,IAAI,EAAE,OAAC,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,EAAE,CAAC;CACzE,CAAC,CAAA;AAGF,4EAA4E;AAC5E,SAAgB,gBAAgB,CAAC,IAAY;IAC3C,MAAM,MAAM,GAAiB,EAAE,CAAA;IAC/B,IAAI,SAAS,GAAG,CAAC,CAAA;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,SAAQ;QAC1B,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,wBAAgB,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;YAC3D,IAAI,MAAM,CAAC,OAAO;gBAAE,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,CAAA;;gBACvC,SAAS,EAAE,CAAA;QAClB,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,EAAE,CAAA;QACb,CAAC;IACH,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,CAAA;AAC9B,CAAC;AAED,gFAAgF;AAEnE,QAAA,SAAS,GAAG;IACvB,cAAc;IACd,wBAAwB;IACxB,kBAAkB;IAClB,gBAAgB;IAChB,uBAAuB;IACvB,kBAAkB;CACV,CAAA;AAGV,MAAM,WAAW,GAAG,OAAC;KAClB,MAAM,CAAC;IACN,EAAE,EAAE,OAAC,CAAC,IAAI,CAAC,iBAAS,CAAC;IACrB,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IACvC,sFAAsF;IACtF,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,QAAQ,EAAE;CACxC,CAAC;KACD,MAAM,EAAE;KACR,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,uBAAuB,IAAI,CAAC,CAAC,EAAE,KAAK,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,SAAS,CAAC,EAAE;IAChI,OAAO,EAAE,iFAAiF;CAC3F,CAAC,CAAA;AAEJ,MAAM,WAAW,GAAG,OAAC,CAAC,KAAK,CAAC;IAC1B,OAAC,CAAC,OAAO,CAAC,qBAAqB,CAAC;IAChC,OAAC,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;IAC5D,OAAC,CAAC,MAAM,CAAC,EAAE,kBAAkB,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE;CACvE,CAAC,CAAA;AAEW,QAAA,gBAAgB,GAAG,OAAC;KAC9B,MAAM,CAAC;IACN,IAAI,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,KAAK,CAAC,2BAA2B,CAAC;IACnD,WAAW,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,QAAQ,EAAE;IAC7C,6DAA6D;IAC7D,KAAK,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACxB,2EAA2E;IAC3E,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;IACzB,8EAA8E;IAC9E,MAAM,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;IAClD,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,mBAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC;IAC3C,MAAM,EAAE,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC;IACnC,iEAAiE;IACjE,KAAK,EAAE,OAAC,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,gBAAgB,IAAI,CAAC,CAAC,EAAE;QACvG,OAAO,EAAE,6CAA6C;KACvD,CAAC;IACF,aAAa,EAAE,OAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE;CAC5C,CAAC;KACD,MAAM,EAAE,CAAA;AAoBX;;;GAGG;AACH,SAAgB,eAAe,CAAC,MAA+B;IAC7D,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,GAAG,CAAC,CAAC,CAAA;IACrD,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAA;IACzD,IAAI,OAAO,KAAK,CAAC;QAAE,OAAO,CAAC,CAAA;IAC3B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAA;IAClE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,GAAG,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAA;AAChD,CAAC"}

package/dist/chaosGate.d.ts

@@ -0,0 +1,166 @@
+/**
+ * Fault injection in the gates: the part of a chaos run (`chaos.ts`) a hook
+ * gate or an in-process gate SDK carries.
+ *
+ * A hook gate is a new process per tool call, and parallel gates share one
+ * run, so nothing here keeps state in memory: the plan comes from {@link CHAOS_PLAN_ENV}-style text each call,
+ * and every count lives in files beside the events file.
+ *
+ * - `<events>.gate-plan-loaded` — created once, with an exclusive create; the
+ *   gate that creates it reports `plan_loaded`, so separate gate processes do
+ *   not repeat it.
+ * - `<events>.gate-counters/<fault index>.seen.<n>` and `.hit.<n>` — one
+ *   empty file per matching call a fault saw and per call it hit. A call
+ *   claims the next number with an exclusive create (`open` with `wx`,
+ *   `O_CREAT | O_EXCL`), which the file system grants to exactly one process,
+ *   so two gates deciding at once can never both take the same number; the
+ *   claimed number is the call's 1-based index. A count is the number of
+ *   files, read once to start the search, so a claim costs one directory
+ *   read and usually one create. That is `FaultCounter`'s `after_calls` and
+ *   `times` across processes.
+ * - `<events>.gate-counters/<fault index>.held.<key>.<g>` — a call a
+ *   `permission.deny_or_delay` fault in `delay` or `hold_then_deny` mode
+ *   held; its modification time is when. `<key>` is the call's digest (the
+ *   tool and its input, as the gate keys an approval hold), `<g>` counts the
+ *   holds of that call, claimed like a call number. `.released.<key>.<g>`,
+ *   created with the same exclusive create, ends that hold: one retry, and
+ *   only one, is the one the hold lets through or denies.
+ *
+ * A permission fault never makes a gate wait. It holds the call the way an
+ * approval hold does: the call is refused as held, and the identical retry
+ * (same tool, same input) is refused as held again until `delay_s` seconds
+ * have passed since the first refusal. After that the retry is allowed
+ * (`delay`) or denied (`hold_then_deny`), and the hold is over: the next
+ * identical call is a new matching call. A held call's retries are the same
+ * call, so no fault counts them as matching calls. A test moves the clock by
+ * moving the `held` files' modification times back.
+ *
+ * Only a call governance allowed counts: a fault never applies to a call the
+ * gate refused, held or asked about, so such a call is not one of the
+ * fault's matching calls either. Every fault whose `match` covers an allowed
+ * call counts it as seen; the first one in plan order that is due injects,
+ * and the faults after it do not spend a hit on the same call. A `tool.error`
+ * on an `mcp__<server>__<tool>` call is the MCP proxy's to inject, so a gate
+ * leaves it alone; `permission.deny_or_delay` is the gate's on any tool.
+ *
+ * The functions are self-contained on purpose — no imports, no module state —
+ * because the JavaScript hook gates emit them as source
+ * ({@link CHAOS_GATE_JS_SOURCE}) and run them outside this package, and
+ * `@intutic/gate` carries a byte-identical copy of this file
+ * (`packages/gate-js/src/chaosGate.ts`). The bash gates and
+ * `intutic_clawde.gate` run the Python transliteration,
+ * `intutic_clawde/gate/chaos.py`, which the sync daemon emits verbatim. All
+ * of them run `fixtures/chaos-gate-vectors.json`. File access goes through
+ * the `fs` argument (Node's `fs` in a gate).
+ *
+ * @module
+ */
+/** One fault a gate injects, with its defaults applied. */
+export interface ChaosGateFault {
+    /** The fault's position in the plan: its counters are keyed on it. */
+    index: number;
+    id: 'tool.error' | 'permission.deny_or_delay';
+    match: {
+        tool?: string;
+        host?: string;
+        model?: string;
+    } | null;
+    afterCalls: number;
+    times: number | null;
+    /** `tool.error` only. */
+    message: string;
+    /** `permission.deny_or_delay` only. */
+    mode: 'deny' | 'delay' | 'hold_then_deny';
+    /** `permission.deny_or_delay` only: how long a held call stays held, in seconds. */
+    delayS: number;
+}
+/** The fields of a plan a gate uses. */
+export interface ChaosGatePlan {
+    runId: string;
+    canary: string;
+    /** The faults a gate injects; the plan's others are another component's. */
+    faults: ChaosGateFault[];
+}
+/** One call, as the gate decided it before any fault. */
+export interface ChaosGateCall {
+    tool: string;
+    decision: 'allow' | 'deny' | 'ask' | 'hold';
+    ruleId?: string | null;
+    destructive: boolean;
+    policyHit: boolean;
+    /**
+     * The call's digest in hex: its tool and input, as the gate keys an
+     * approval hold, so an identical retry has the same key. Only a held
+     * call's retry reads it.
+     */
+    key?: string;
+}
+/** A fault to apply to an allowed call. */
+export interface ChaosGateFaultOutcome {
+    faultId: string;
+    /** `deny` refuses the call; `hold` refuses it as held, as an approval hold does. */
+    kind: 'deny' | 'hold';
+    /** The refusal text, carrying the plan's canary. */
+    reason: string;
+}
+/** The file operations the functions use: Node's `fs` provides them. */
+export interface ChaosGateFs {
+    appendFileSync(path: string, data: string): void;
+    mkdirSync(path: string): unknown;
+    readdirSync(path: string): string[];
+    openSync(path: string, flags: string): number;
+    closeSync(fd: number): void;
+    statSync(path: string): {
+        mtimeMs: number;
+    };
+}
+/**
+ * Decodes and checks a plan: base64url JSON, version 1, with valid values in
+ * every field a gate reads. Returns the plan, or why it is not one.
+ */
+export declare function chaosGateDecode(raw: string): {
+    plan: ChaosGatePlan;
+    error: null;
+} | {
+    plan: null;
+    error: string;
+};
+/**
+ * Whether a fault's `match` covers a gate call. A gate call has a tool and
+ * nothing else, so a fault that names a host or a model never matches one.
+ * `tool` matches exactly, or by suffix when it starts with `*`.
+ */
+export declare function chaosGateMatches(match: ChaosGateFault['match'], tool: string): boolean;
+/** One events-file line: `ts`, `runId`, `component`, `type`, then the fields that are set. */
+export declare function chaosGateEvent(plan: ChaosGatePlan, type: string, fields: Record<string, unknown>, now: string): string;
+/** Appends whole lines in one write. An I/O error is reported, never thrown: it must not decide the call. */
+export declare function chaosGateAppend(fs: ChaosGateFs, eventsPath: string, lines: string): void;
+/**
+ * Claims the next numbered file `<dir>/<prefix><n>` with an exclusive create
+ * and returns n, or 0 when every number up to `limit` is taken. -1 on an I/O
+ * error, after saying so.
+ */
+export declare function chaosGateClaim(fs: ChaosGateFs, dir: string, prefix: string, limit: number | null): number;
+/**
+ * The open hold of one fault on one call: the number of the newest
+ * `<fault>.held.<key>.<g>` file that has no `.released.` twin, and when it
+ * was created. Null when there is none or it cannot be read.
+ */
+export declare function chaosGateOpenHold(fs: ChaosGateFs, dir: string, fault: number, key: string): {
+    g: number;
+    sinceMs: number;
+} | null;
+/** Ends hold g with an exclusive create: true for the one caller that does. */
+export declare function chaosGateRelease(fs: ChaosGateFs, dir: string, fault: number, key: string, g: number): boolean;
+/**
+ * Reports one call: `plan_loaded` the first time any gate reports to this
+ * events file, then `gate_decision`; for an allowed call, the fault that is
+ * due (`fault_injected`, once per held call however often it is retried),
+ * and `tool_call`: ok when the call goes ahead, not ok when it is held.
+ * Returns the fault the gate must apply, or null. `now` is the ISO-8601 time,
+ * and the clock a hold is timed by.
+ */
+export declare function chaosGateCall(fs: ChaosGateFs, plan: ChaosGatePlan, eventsPath: string, call: ChaosGateCall, now: string): ChaosGateFaultOutcome | null;
+/** Every function above as JavaScript source, for a hook gate to emit. */
+export declare const CHAOS_GATE_JS_SOURCE: string;
+//# sourceMappingURL=chaosGate.d.ts.map

package/dist/chaosGate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"chaosGate.d.ts","sourceRoot":"","sources":["../src/chaosGate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwDG;AAEH,2DAA2D;AAC3D,MAAM,WAAW,cAAc;IAC7B,sEAAsE;IACtE,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,YAAY,GAAG,0BAA0B,CAAA;IAC7C,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAA;IAC9D,UAAU,EAAE,MAAM,CAAA;IAClB,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;IACpB,yBAAyB;IACzB,OAAO,EAAE,MAAM,CAAA;IACf,uCAAuC;IACvC,IAAI,EAAE,MAAM,GAAG,OAAO,GAAG,gBAAgB,CAAA;IACzC,oFAAoF;IACpF,MAAM,EAAE,MAAM,CAAA;CACf;AAED,wCAAwC;AACxC,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,4EAA4E;IAC5E,MAAM,EAAE,cAAc,EAAE,CAAA;CACzB;AAED,yDAAyD;AACzD,MAAM,WAAW,aAAa;IAC5B,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,CAAA;IAC3C,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,WAAW,EAAE,OAAO,CAAA;IACpB,SAAS,EAAE,OAAO,CAAA;IAClB;;;;OAIG;IACH,GAAG,CAAC,EAAE,MAAM,CAAA;CACb;AAED,2CAA2C;AAC3C,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,MAAM,CAAA;IACf,oFAAoF;IACpF,IAAI,EAAE,MAAM,GAAG,MAAM,CAAA;IACrB,oDAAoD;IACpD,MAAM,EAAE,MAAM,CAAA;CACf;AAED,wEAAwE;AACxE,MAAM,WAAW,WAAW;IAC1B,cAAc,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,IAAI,CAAA;IAChD,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAA;IAChC,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAAA;IACnC,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAAA;IAC7C,SAAS,CAAC,EAAE,EAAE,MAAM,GAAG,IAAI,CAAA;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAA;CAC5C;AAED;;;GAGG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG;IAAE,IAAI,EAAE,aAAa,CAAC;IAAC,KAAK,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,IAAI,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAuEjH;AAED;;;;GAIG;AACH,wBAAgB,gBAAgB,CAAC,KAAK,EAAE,cAAc,CAAC,OAAO,CAAC,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAMtF;AAED,8FAA8F;AAC9F,wBAAgB,cAAc,CAAC,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,GAAG,EAAE,MAAM,GAAG,MAAM,CAItH;AAED,6GAA6G;AAC7G,wBAAgB,eAAe,CAAC,EAAE,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAUxF;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CA4BzG;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAiBjI;AAED,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,EAAE,EAAE,WAAW,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,CAAC,EAAE,MAAM,GAAG,OAAO,CAQ7G;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAC3B,EAAE,EAAE,WAAW,EACf,IAAI,EAAE,aAAa,EACnB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,aAAa,EACnB,GAAG,EAAE,MAAM,GACV,qBAAqB,GAAG,IAAI,CAyE9B;AAED,0EAA0E;AAC1E,eAAO,MAAM,oBAAoB,QAWpB,CAAA"}