@intutic/sync-daemon 1.9.0 → 1.10.1

package/dist/harness/dshHooks.js

@@ -0,0 +1,569 @@
+/**
+ * dshHooks.ts — DeepSeek "dsh" (developer preview, `@deepseek-ai/dsh`) Cordis
+ * plugin registration + LLM egress routing.
+ *
+ * dsh has no `hooks.json`/shell-script gate surface at all — it is
+ * plugin-first ("Cordis", DeepSeek's own extensibility framework), and the
+ * blocking gate for this harness ships as a real TypeScript module,
+ * `@intutic/gate/dsh` (`packages/gate-js/src/dsh.ts`), not a generated
+ * string of shell/JS this writer assembles the way `grokHooks.ts`/
+ * `museHooks.ts` do. This writer's job is narrower than theirs: merge-write
+ * the ROW that tells dsh's own Cordis loader to load that module, into every
+ * dsh profile this machine has, plus the LLM egress override.
+ *
+ * # What this phase confirmed against a REAL install — not the plan's guess
+ *
+ * `@deepseek-ai/dsh` and its Cordis framework packages (`@deepseek-ai/cordis`,
+ * `@deepseek-ai/dsh-app-boot`, `@deepseek-ai/dsh-tools`, `@deepseek-ai/dsh-base`,
+ * `@deepseek-ai/dsh-llm-pi-ai`, `@deepseek-ai/dsh-home-paths`, ...) are public
+ * on the npm registry (first published 2026-08-13, ~161 KB unpacked for the
+ * `dsh` package itself) — reachable and installable from this sandbox, unlike
+ * Muse Code/Grok Build in Wave 1. This writer was authored against a real
+ * `npm pack` + read of those packages' shipped `.d.ts`/README files, not
+ * solely the phase brief's prior research (see the TD entry this phase filed
+ * for exactly what was checked and what is still genuinely unconfirmed —
+ * dsh-permission, dsh-settings-local, and dsh-fs-policy 404'd as
+ * `publishConfig.access: restricted`, so the exact settings.yaml schema
+ * dsh-settings-local enforces was not directly inspected, only inferred from
+ * `dsh-base`'s own `cordis.patch.yml` comments and `dsh-llm-pi-ai`'s README).
+ *
+ * Confirmed facts this writer relies on:
+ *
+ *   - `$DSH_HOME` resolution (`dsh-home-paths`): an explicit configured path,
+ *     then `$DSH_HOME`, then `~/.dsh` — {@link resolveDshHome} below mirrors
+ *     the env-var half (this writer has no "explicit configured path" input).
+ *   - A **profile** is `$DSH_HOME/profiles/<name>/` holding a `package.json`
+ *     (the profile manifest) and a `cordis.patch.yml` (`PROFILE_PATCH_FILENAME`
+ *     — "the user patch layer inside a profile directory, hot-reloaded") —
+ *     confirmed from `@deepseek-ai/dsh-app-boot`'s shipped `profile.d.ts`.
+ *   - The patch-list format (`@deepseek-ai/cordis-plugin-include`'s
+ *     `applyEntryPatches`, read from its shipped `lib/index.js`): a top-level
+ *     YAML array of patch operations. `{ insert: [...] }` with no `id`
+ *     appends the listed rows to the array; `{ id, insert: [...] }` inserts
+ *     into an existing GROUP row's own `config` array; `{ id, name?,
+ *     config?, ... }` (no `insert`) looks up the row by `id` and overwrites
+ *     the named fields in place. This writer only ever emits the first shape
+ *     (a fresh, self-contained `insert:` block naming this row by `id`), so
+ *     its own writes are always recognizable on a later sync regardless of
+ *     which shape a human or an older version of this writer left.
+ *   - Plugin resolution (`@deepseek-ai/cordis-plugin-loader`'s shipped
+ *     `lib/index.js`): a patch row's `name` is resolved via a plain dynamic
+ *     `import(name)` when it is not a relative path — a bare specifier like
+ *     `@intutic/gate/dsh` resolves exactly the way any other bundle package
+ *     name in `dsh-base`'s own `cordis.patch.yml` does, subpath exports
+ *     included. Node resolves it from the profile directory's own
+ *     `node_modules` (the "two-anchor" resolution `profile.d.ts` documents
+ *     for out-of-tree plugins) — which means `@intutic/gate` must actually be
+ *     installed there; see {@link mergeProfileDependency} and the TD entry
+ *     for why this writer cannot run `pnpm install` on the user's behalf.
+ *   - `settings.yaml`'s `llm-pi-ai.providers.<id>.baseURL` path — CONFIRMED,
+ *     not merely the plan's assumption: `dsh-llm-pi-ai`'s shipped README shows
+ *     exactly this shape overriding an EXISTING catalog route's endpoint
+ *     (`providers.openai.baseURL: https://proxy.example.com:8443`), the same
+ *     "override base_url on what already resolves, don't invent a model
+ *     picker entry" shape `grokHooks.ts`'s `[model.*]` merge uses. `llm-pi-ai`
+ *     is NOT dsh's default LLM route (`llm-deepseek`, the native DeepSeek
+ *     adapter, is — see `dsh-base`'s own `agent-default-model` row) and
+ *     mounts **dormant** until a `llm-pi-ai:` settings section exists at all,
+ *     so this override alone never redirected a fresh profile's DEFAULT
+ *     egress — it only added a selectable route.
+ *   - **TD-370 follow-up, closed this phase:** `@deepseek-ai/dsh-llm-deepseek`
+ *     (registry-public, `npm pack`ed and read directly — 0.1.0-rc.8, the
+ *     current prerelease at the time) IS the adapter `dsh-base`'s
+ *     `agent-default-model` routes through by default, and its own shipped
+ *     README CONFIRMS the same live-reload settings seam `llm-pi-ai` has:
+ *     "the plugin registers the `llm-deepseek` namespace with this same
+ *     `Config` schema ... so a `llm-deepseek:` section in the user settings
+ *     document overrides any field without a restart." {@link mergeSettingsYaml}
+ *     now also merges `llm-deepseek.baseURL`, touching only that one field
+ *     (same "override base_url on what already resolves" discipline as the
+ *     `llm-pi-ai` merge and `grokHooks.ts`'s `[model.*]` merge) — this is the
+ *     one that actually redirects DEFAULT egress. The `llm-pi-ai` merge is
+ *     kept alongside it (a selectable route remains useful), not replaced.
+ *   - The `@intutic/gate/dsh` veto contract itself (`tools/pre-execute`,
+ *     `PreToolDecision`'s real `'deny'`/`'allow'`/`'ask'` shape, Cordis's
+ *     `waterfall` `next()` semantics) is confirmed from `dsh-tools`'s shipped
+ *     `.d.ts` — see `packages/gate-js/src/dsh.ts`'s own module doc for the
+ *     full record, including where the phase brief's prior guess
+ *     (`agent/pre-step`, `{kind:'reject'}`) was wrong.
+ *
+ * HLD §3.14 — Harness Onboarding Matrix
+ * @module
+ */
+import * as fs from 'node:fs/promises';
+import { existsSync } from 'node:fs';
+import * as path from 'node:path';
+import * as os from 'node:os';
+import { isDeepStrictEqual } from 'node:util';
+import { isMap, isSeq, parseDocument } from 'yaml';
+import { createLogger } from '@intutic/logger';
+const log = createLogger('sync-dsh-hooks');
+/** Mirrors `dsh-home-paths`' `DSH_HOME_ENV`/`DSH_HOME_DIR_NAME` constants. */
+const DSH_HOME_ENV = 'DSH_HOME';
+const DSH_HOME_DIR_NAME = '.dsh';
+/** Mirrors `dsh-app-boot`'s `PROFILES_DIR`/`PROFILE_PATCH_FILENAME`. */
+const PROFILES_DIR = 'profiles';
+const PROFILE_PATCH_FILENAME = 'cordis.patch.yml';
+const SETTINGS_FILENAME = 'settings.yaml';
+/** Stable row id — recognized on every later sync regardless of which of the
+ *  patch-op shapes (see module doc) a prior write or a human left. */
+const PLUGIN_ROW_ID = 'intutic-governance';
+/** Resolved via a bare `import()` from the profile's own `node_modules` — see
+ *  {@link mergeProfileDependency}. */
+const PLUGIN_MODULE_NAME = '@intutic/gate/dsh';
+/** The pinned `@intutic/gate` version range written into a profile's
+ *  `package.json` dependency — dsh's own preview-software stance (stated
+ *  breaking-changes policy) is matched here the same way Muse Code/Grok Build
+ *  pin themselves against a *tested* version rather than `latest`. Bump this
+ *  alongside `packages/gate-js/package.json`'s own `version` field. */
+const INTUTIC_GATE_VERSION_RANGE = '^0.1.0';
+/** `$DSH_HOME` resolution: an explicit env override, else `~/.dsh` — mirrors
+ *  `dsh-home-paths`' `resolveDshHome()` (this writer has no "explicit
+ *  configured path" input the way a booted dsh process might). An
+ *  empty/whitespace-only `$DSH_HOME` is treated as unset, matching that
+ *  package's own documented behaviour. */
+export function resolveDshHome() {
+    const configured = process.env[DSH_HOME_ENV];
+    if (configured && configured.trim())
+        return configured.trim();
+    return path.join(os.homedir(), DSH_HOME_DIR_NAME);
+}
+/**
+ * Every EXISTING dsh profile directory on this machine — one containing its
+ * own `package.json` (the profile manifest `dsh-app-boot` requires; a bare
+ * directory, such as the flat `profiles/node_modules` fallback dsh itself
+ * maintains, is not a profile).
+ *
+ * Deliberately does not invent a profile: dsh's own CLI requires `--profile
+ * <name>` on every invocation (confirmed from `dsh`'s shipped `bin.js` — there
+ * is no bare "default" profile dsh falls back to), so this writer has no name
+ * to seed one under that a user did not already choose. A machine with no
+ * profile initialized yet gets governed on the next sync after the user's
+ * first `dsh --profile <name>` run creates one — see the TD entry.
+ */
+export async function listDshProfileDirs(dshHome) {
+    const profilesRoot = path.join(dshHome, PROFILES_DIR);
+    let entries;
+    try {
+        entries = await fs.readdir(profilesRoot, { withFileTypes: true });
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (const entry of entries) {
+        if (!entry.isDirectory())
+            continue;
+        if (existsSync(path.join(profilesRoot, entry.name, 'package.json'))) {
+            out.push(path.join(profilesRoot, entry.name));
+        }
+    }
+    return out;
+}
+// ─── Coverage-gap detection (TD-370: the silent no-profile window) ────────
+/** Markers dsh leaves under `$DSH_HOME` even before any profile exists —
+ *  mirrors `tools/cli/src/harness/dsh.ts`'s own `detect()` list, minus the
+ *  `profiles` marker itself (which is what "zero profiles" already answers
+ *  for {@link detectDshCoverageGap} below). */
+const DSH_HOME_PRESENCE_MARKERS = ['settings.yaml', '.credentials.yaml'];
+/** Is `dsh` (the binary) reachable on `$PATH`? Best-effort, synchronous —
+ *  same PATH-scan convention `dsh.ts`'s adapter `detect()` uses. */
+function isDshOnPath() {
+    const pathDirs = (process.env.PATH ?? '').split(process.platform === 'win32' ? ';' : ':');
+    for (const dir of pathDirs) {
+        if (dir && existsSync(path.join(dir, 'dsh')))
+            return true;
+    }
+    return false;
+}
+/**
+ * Detects TD-370's "silent no-profile window": the stretch between `intutic
+ * connect` and the user's first `dsh --profile <name>` run, during which dsh
+ * is entirely ungoverned — {@link writeDshHooks} is a documented no-op with
+ * nothing to register into yet — and, before this function existed, nothing
+ * made that visible.
+ *
+ * A pure detector, deliberately: no logging, no side effect, so it stays
+ * trivially unit-testable. `watcher/settingsGuard.ts`'s `warnIfDshCoverageGap`
+ * is the side-effecting caller that actually logs the gap.
+ */
+export async function detectDshCoverageGap(dshHome = resolveDshHome()) {
+    const profileCount = (await listDshProfileDirs(dshHome)).length;
+    if (profileCount > 0)
+        return { dshDetected: true, profileCount, gap: false };
+    const dshDetected = DSH_HOME_PRESENCE_MARKERS.some((marker) => existsSync(path.join(dshHome, marker))) || isDshOnPath();
+    return { dshDetected, profileCount: 0, gap: dshDetected };
+}
+// ─── cordis.patch.yml: plugin row registration ────────────────────────────
+function buildDesiredRow(workspaceRoot, workspaceId) {
+    return {
+        id: PLUGIN_ROW_ID,
+        name: PLUGIN_MODULE_NAME,
+        config: { workspaceId, repoRoot: workspaceRoot },
+    };
+}
+/** Finds this writer's own row wherever it lives in a parsed patch-list
+ *  (either an `insert:`-wrapped block it wrote itself, or a bare `{id, ...}`
+ *  update-in-place row a human or an older writer left) — see module doc. */
+function findOwnRow(patchList) {
+    for (let i = 0; i < patchList.length; i++) {
+        const item = patchList[i];
+        if (!item || typeof item !== 'object')
+            continue;
+        const obj = item;
+        if (Array.isArray(obj.insert)) {
+            const inner = obj.insert.find((r) => r && typeof r === 'object' && r.id === PLUGIN_ROW_ID);
+            if (inner)
+                return { index: i, row: inner };
+            continue;
+        }
+        if (obj.id === PLUGIN_ROW_ID)
+            return { index: i, row: obj };
+    }
+    return null;
+}
+/**
+ * Append-only fallback for a `cordis.patch.yml` that does not parse as YAML
+ * at all. Mirrors `injectGooseAppendOnly`'s exact reasoning: a parser that
+ * cannot safely represent a malformed file cannot safely round-trip it
+ * either, so this never touches (or even parses) anything else in the file.
+ * Best-effort de-dup on the literal row id substring — a false "already
+ * present" here just means the fallback path stays a fallback for one more
+ * sync cycle rather than double-inserting; it does not corrupt anything.
+ */
+async function mergeProfilePatchAppendOnly(patchPath, existingYaml, desiredRow) {
+    if (existingYaml.includes(`id: ${PLUGIN_ROW_ID}`))
+        return;
+    const config = desiredRow.config;
+    const block = [
+        '',
+        '# Intutic governance plugin — auto-appended (fallback: this file did not parse as YAML).',
+        '- insert:',
+        `    - id: ${PLUGIN_ROW_ID}`,
+        `      name: ${JSON.stringify(desiredRow.name)}`,
+        '      config:',
+        `        workspaceId: ${JSON.stringify(config.workspaceId ?? '')}`,
+        `        repoRoot: ${JSON.stringify(config.repoRoot ?? '')}`,
+    ].join('\n');
+    const text = (existingYaml || '[]').trimEnd() + '\n' + block + '\n';
+    await fs.mkdir(path.dirname(patchPath), { recursive: true });
+    const tmp = patchPath + '.intutic-tmp';
+    await fs.writeFile(tmp, text, 'utf-8');
+    await fs.rename(tmp, patchPath);
+    log.info({ action: 'dsh_patch_written', path: patchPath, mode: 'append_only_fallback' }, 'dsh cordis.patch.yml updated (append-only fallback)');
+}
+/**
+ * Structurally merges the Intutic governance plugin row into one profile's
+ * `cordis.patch.yml`, via the `yaml` package's `parseDocument`/`setIn` — the
+ * same "parse structurally, write-if-changed, preserve unrelated content,
+ * fall back to append-only on unparseable input" discipline `injectGoose`
+ * (`mcpAutoWrite.ts`) established for YAML in this codebase, reusing the same
+ * dependency rather than inventing a second approach.
+ */
+export async function mergeProfilePatch(profileDir, workspaceRoot, workspaceId) {
+    const patchPath = path.join(profileDir, PROFILE_PATCH_FILENAME);
+    let existingYaml = '';
+    try {
+        existingYaml = await fs.readFile(patchPath, 'utf-8');
+    }
+    catch {
+        // No cordis.patch.yml yet — `initProfile()` always seeds an empty `[]`
+        // one, but a profile this writer discovered some other way might not
+        // have it. Falls through with '' so a fresh file is written below.
+    }
+    const desiredRow = buildDesiredRow(workspaceRoot, workspaceId);
+    let doc;
+    try {
+        doc = parseDocument(existingYaml.trim() ? existingYaml : '[]');
+        if (doc.errors.length > 0)
+            throw doc.errors[0];
+    }
+    catch (err) {
+        log.warn({ action: 'dsh_patch_unparseable', path: patchPath, err: err.message }, 'dsh cordis.patch.yml did not parse as YAML — falling back to append-only text injection');
+        await mergeProfilePatchAppendOnly(patchPath, existingYaml, desiredRow);
+        return;
+    }
+    if (doc.contents == null || !isSeq(doc.contents)) {
+        // `cordis.patch.yml` exists but its root isn't a sequence (e.g. `null`,
+        // a bare scalar, a mapping) — nothing safe to preserve there; the
+        // documented shape (PROFILE_PATCH_TEMPLATE, confirmed from
+        // dsh-app-boot's shipped source) is "a top-level YAML array", so this
+        // replaces the root with a fresh empty one, same as injectGoose's
+        // `mcp: null` handling.
+        doc.contents = doc.createNode([]);
+    }
+    const patchList = doc.toJS();
+    const found = findOwnRow(patchList);
+    const desiredNode = doc.createNode({ insert: [desiredRow] });
+    let changed = false;
+    if (found === null) {
+        doc.addIn([], desiredNode);
+        changed = true;
+    }
+    else if (!isDeepStrictEqual(found.row, desiredRow)) {
+        // Replace the WHOLE item at that index with our own self-contained
+        // `insert:` block, regardless of which shape the existing row was in —
+        // this writer only ever emits the `insert:`-wrapped shape, so a later
+        // sync always finds (and safely replaces) exactly this shape.
+        doc.setIn([found.index], desiredNode);
+        changed = true;
+    }
+    if (!changed)
+        return;
+    await fs.mkdir(profileDir, { recursive: true });
+    const tmp = patchPath + '.intutic-tmp';
+    await fs.writeFile(tmp, doc.toString(), 'utf-8');
+    await fs.rename(tmp, patchPath);
+    log.info({ action: 'dsh_patch_written', path: patchPath, mode: 'yaml' }, 'dsh cordis.patch.yml updated (structural YAML edit)');
+}
+// ─── profile package.json: @intutic/gate dependency ───────────────────────
+/**
+ * Ensures `@intutic/gate` is declared in the profile's own `package.json`
+ * `dependencies` — the "out-of-tree plugin" mechanism `dsh-app-boot`'s
+ * `profile.d.ts` documents (a profile's `node_modules` is pnpm-managed).
+ *
+ * This writer declares the dependency but does NOT run `pnpm install` in the
+ * profile directory — the daemon has no general "run an arbitrary package
+ * manager in a directory it does not own" capability, and every other
+ * writer in this codebase only ever writes config, never invokes a package
+ * manager on the user's behalf. Until the user (or their own tooling) runs
+ * one, the `cordis.patch.yml` row this module also writes resolves to a
+ * MISSING module and dsh's own loader reports that row's activation failed
+ * (`assertEntriesActivated`, confirmed from `dsh-app-boot`'s exports) rather
+ * than silently no-op — a fail-LOUD gap, not a fail-open one, but a real
+ * manual step nonetheless. See the TD entry and `apps/docs/integrations/dsh.md`.
+ */
+export async function mergeProfileDependency(profileDir) {
+    const manifestPath = path.join(profileDir, 'package.json');
+    let manifest;
+    try {
+        manifest = JSON.parse(await fs.readFile(manifestPath, 'utf-8'));
+    }
+    catch {
+        // No manifest — an existing profile always has one (dsh-app-boot
+        // requires it), so this is defensive only; nothing to merge into yet.
+        return;
+    }
+    const deps = (manifest.dependencies && typeof manifest.dependencies === 'object'
+        ? manifest.dependencies
+        : {});
+    if (deps['@intutic/gate'] === INTUTIC_GATE_VERSION_RANGE)
+        return;
+    manifest.dependencies = { ...deps, '@intutic/gate': INTUTIC_GATE_VERSION_RANGE };
+    const tmp = manifestPath + '.intutic-tmp';
+    await fs.writeFile(tmp, JSON.stringify(manifest, null, 2) + '\n', 'utf-8');
+    await fs.rename(tmp, manifestPath);
+    log.info({ action: 'dsh_dependency_written', path: manifestPath }, 'dsh profile package.json dependency updated');
+}
+// ─── settings.yaml: llm-deepseek (default route) + llm-pi-ai (selectable) ──
+/** dsh's ACTUAL DEFAULT LLM route — `@deepseek-ai/dsh-llm-deepseek`, per
+ *  `dsh-base`'s own `agent-default-model` row. See module doc for the
+ *  README confirmation that a `llm-deepseek:` settings section overrides
+ *  this adapter's config live, no restart. */
+const DEFAULT_LLM_SECTION = 'llm-deepseek';
+/** A SELECTABLE route, mounts dormant until this section exists at all —
+ *  see module doc. Kept alongside the default-route merge, not replaced. */
+const SELECTABLE_LLM_SECTION = 'llm-pi-ai';
+async function mergeSettingsYamlAppendOnly(settingsPath, existingYaml, proxyUrl) {
+    const blocks = [];
+    if (!existingYaml.includes(`${DEFAULT_LLM_SECTION}:`)) {
+        blocks.push('', '# Intutic proxy route — auto-appended (fallback: this file did not parse as YAML).', "# Redirects dsh's DEFAULT LLM route (llm-deepseek, the native DeepSeek", "# adapter — see dsh-base's agent-default-model row) through the proxy.", `${DEFAULT_LLM_SECTION}:`, `  baseURL: ${JSON.stringify(proxyUrl)}`);
+    }
+    if (!existingYaml.includes(`${SELECTABLE_LLM_SECTION}:`)) {
+        blocks.push('', '# Intutic proxy route — auto-appended (fallback: this file did not parse as YAML).', `${SELECTABLE_LLM_SECTION}:`, '  providers:', '    intutic:', '      displayName: Intutic Governance Proxy', '      api: openai-completions', `      baseURL: ${JSON.stringify(proxyUrl)}`);
+    }
+    if (blocks.length === 0)
+        return;
+    const text = existingYaml.trimEnd() + '\n' + blocks.join('\n') + '\n';
+    await fs.mkdir(path.dirname(settingsPath), { recursive: true });
+    const tmp = settingsPath + '.intutic-tmp';
+    await fs.writeFile(tmp, text, 'utf-8');
+    await fs.rename(tmp, settingsPath);
+    log.info({ action: 'dsh_settings_written', path: settingsPath, mode: 'append_only_fallback' }, 'dsh settings.yaml updated (append-only fallback)');
+}
+/**
+ * Structurally merges the Intutic proxy into TWO `settings.yaml` sections:
+ *
+ *  - `llm-deepseek.baseURL` — dsh's ACTUAL DEFAULT LLM route (CONFIRMED
+ *    against `@deepseek-ai/dsh-llm-deepseek`'s own shipped README this
+ *    phase — see module doc). Only `baseURL` is touched; `apiKeyEnv`,
+ *    `thinking`, `models`, etc. round-trip untouched, the same
+ *    "override base_url on what already resolves, never invent the rest of
+ *    the section" discipline `grokHooks.ts`'s `[model.*]` merge uses. This
+ *    is the merge that actually redirects DEFAULT egress — see the TD entry
+ *    for why the `llm-pi-ai` merge alone (below) never did.
+ *  - `llm-pi-ai.providers.intutic` — a SELECTABLE route (mounts dormant
+ *    until this section exists at all — see module doc). Kept alongside the
+ *    new default-route merge: a user, or a future sync, can still point a
+ *    model at it explicitly.
+ *
+ * Both overrides preserve every other provider and every other top-level
+ * section untouched.
+ */
+export async function mergeSettingsYaml(dshHome, proxyUrl) {
+    const settingsPath = path.join(dshHome, SETTINGS_FILENAME);
+    let existingYaml = '';
+    try {
+        existingYaml = await fs.readFile(settingsPath, 'utf-8');
+    }
+    catch {
+        // No settings.yaml yet — falls through with '' so a fresh file is
+        // written below.
+    }
+    let doc;
+    try {
+        doc = parseDocument(existingYaml.trim() ? existingYaml : '{}');
+        if (doc.errors.length > 0)
+            throw doc.errors[0];
+    }
+    catch (err) {
+        log.warn({ action: 'dsh_settings_unparseable', path: settingsPath, err: err.message }, 'dsh settings.yaml did not parse as YAML — falling back to append-only text injection');
+        await mergeSettingsYamlAppendOnly(settingsPath, existingYaml, proxyUrl);
+        return;
+    }
+    if (doc.contents == null || !isMap(doc.contents)) {
+        doc.contents = doc.createNode({});
+    }
+    // Defensive per-level checks: `setIn` auto-vivifies a MISSING intermediate
+    // key as a map, but throws on an EXISTING non-collection value at that key
+    // (confirmed empirically against the `yaml` package) — same failure mode
+    // `injectGoose` guards for `mcp: null`. Reset only the offending level,
+    // never the whole document.
+    for (const keyPath of [
+        [DEFAULT_LLM_SECTION],
+        [SELECTABLE_LLM_SECTION],
+        [SELECTABLE_LLM_SECTION, 'providers'],
+    ]) {
+        const node = doc.getIn(keyPath);
+        if (node !== undefined && !isMap(node)) {
+            doc.setIn(keyPath, {});
+        }
+    }
+    const settingsJs = doc.toJS();
+    let changed = false;
+    // ── llm-deepseek: DEFAULT route ──────────────────────────────────────
+    const deepseekSection = settingsJs[DEFAULT_LLM_SECTION] ?? {};
+    const desiredDeepseekSection = { ...deepseekSection, baseURL: proxyUrl };
+    if (!isDeepStrictEqual(deepseekSection, desiredDeepseekSection)) {
+        doc.setIn([DEFAULT_LLM_SECTION], desiredDeepseekSection);
+        changed = true;
+    }
+    // ── llm-pi-ai: SELECTABLE route ──────────────────────────────────────
+    const llmPiAi = settingsJs[SELECTABLE_LLM_SECTION] ?? {};
+    const providers = llmPiAi.providers ?? {};
+    const existingRoute = providers.intutic ?? {};
+    const desiredRoute = {
+        ...existingRoute,
+        displayName: 'Intutic Governance Proxy',
+        api: 'openai-completions',
+        baseURL: proxyUrl,
+    };
+    if (!isDeepStrictEqual(existingRoute, desiredRoute)) {
+        doc.setIn([SELECTABLE_LLM_SECTION, 'providers', 'intutic'], desiredRoute);
+        changed = true;
+    }
+    if (!changed)
+        return;
+    await fs.mkdir(dshHome, { recursive: true });
+    const tmp = settingsPath + '.intutic-tmp';
+    await fs.writeFile(tmp, doc.toString(), 'utf-8');
+    await fs.rename(tmp, settingsPath);
+    log.info({ action: 'dsh_settings_written', path: settingsPath, mode: 'yaml' }, 'dsh settings.yaml updated (structural YAML edit)');
+}
+// ─── INSTALL.md: the manual pnpm-install / `dsh plugin add` step ──────────
+/**
+ * `$DSH_HOME/INSTALL.md` — same purpose and shape as `n8nHooks.ts`'s
+ * `buildInstallMd`: this writer declares `@intutic/gate` in each profile's
+ * `package.json` (see {@link mergeProfileDependency}) but cannot run a
+ * package manager in a directory it does not own, so the row it also writes
+ * into `cordis.patch.yml` resolves to a MISSING module until a human — or
+ * dsh's own forwarding command — installs it. See the TD entry.
+ */
+function buildDshInstallMd(profileNames) {
+    const profileLines = profileNames.length > 0
+        ? profileNames.map((name) => `- \`${name}\` — run: \`dsh plugin --profile ${name} add @intutic/gate\``).join('\n')
+        : '(no dsh profiles are registered yet)';
+    return `# Intutic governance for dsh — installation
+
+Auto-generated by the Intutic sync-daemon. One artifact, one manual step.
+
+## The blocking gate is registered, but not yet activated
+
+Every sync writes the \`intutic-governance\` row into each profile's
+\`cordis.patch.yml\` (naming \`@intutic/gate/dsh\`) and declares
+\`@intutic/gate\` in that profile's \`package.json\` \`dependencies\` — but this
+daemon has no general capability to run a package manager in a directory it
+does not own, so the dependency itself is never installed by this writer.
+Until it is, dsh's own Cordis loader reports that row's activation as
+FAILED (fail-loud, not silent — \`dsh-app-boot\`'s \`assertEntriesActivated\`)
+rather than silently skipping it, but it also means nothing is governed yet.
+
+Finish activation with dsh's own forwarding command, once per profile:
+
+${profileLines}
+
+That is equivalent to \`cd $DSH_HOME/profiles/<name> && pnpm install\` —
+either works; the forwarding command is dsh's own documented shortcut for
+exactly this case.
+
+## Default LLM egress needs no manual step
+
+The Intutic proxy is merged into \`settings.yaml\`'s \`llm-deepseek\` (dsh's
+default LLM route) and \`llm-pi-ai\` (a selectable route) sections on every
+sync — both take effect on dsh's next request without a restart.
+`;
+}
+/** Write-if-changed, atomic rename — same discipline every other writer in
+ *  this file follows. Regenerated every sync so the profile list here never
+ *  goes stale. */
+async function writeDshInstallMd(dshHome, profileNames) {
+    const installPath = path.join(dshHome, 'INSTALL.md');
+    const content = buildDshInstallMd(profileNames);
+    let existing = '';
+    try {
+        existing = await fs.readFile(installPath, 'utf-8');
+    }
+    catch {
+        // First write.
+    }
+    if (existing === content)
+        return;
+    await fs.mkdir(dshHome, { recursive: true });
+    const tmp = installPath + '.intutic-tmp';
+    await fs.writeFile(tmp, content, 'utf-8');
+    await fs.rename(tmp, installPath);
+    log.info({ action: 'dsh_install_md_written', path: installPath }, 'dsh INSTALL.md updated');
+}
+// ─── Public API ────────────────────────────────────────────────────────────
+/**
+ * Register the Intutic governance plugin against every existing dsh profile
+ * on this machine, and merge the Intutic proxy into `settings.yaml`'s
+ * `llm-deepseek` (default) and `llm-pi-ai` (selectable) routes.
+ *
+ * A no-op (logged, not an error) when `$DSH_HOME/profiles` does not exist
+ * yet — dsh has not been run with any `--profile <name>` on this machine, so
+ * there is nothing to register into; the next sync cycle picks it up once
+ * the user's first `dsh` run creates one. Safe to call every cycle: every
+ * merge below is write-if-changed.
+ *
+ * @param workspaceRoot - Absolute workspace root (stored in the plugin row's
+ *   `config.repoRoot`).
+ * @param proxyUrl       - Intutic proxy URL, merged into settings.yaml.
+ * @param workspaceId    - Workspace ID, stored in the plugin row's config.
+ */
+export async function writeDshHooks(workspaceRoot, proxyUrl, workspaceId = '') {
+    const dshHome = resolveDshHome();
+    const profileDirs = await listDshProfileDirs(dshHome);
+    if (profileDirs.length === 0) {
+        log.debug({ action: 'dsh_skip', dshHome }, 'No dsh profiles found — skipping (nothing to register into yet)');
+        return;
+    }
+    for (const profileDir of profileDirs) {
+        await mergeProfilePatch(profileDir, workspaceRoot, workspaceId);
+        await mergeProfileDependency(profileDir);
+        log.info({ action: 'dsh_profile_written', profile: path.basename(profileDir) }, 'dsh profile governance plugin registered');
+    }
+    await mergeSettingsYaml(dshHome, proxyUrl);
+    await writeDshInstallMd(dshHome, profileDirs.map((d) => path.basename(d)));
+}
+//# sourceMappingURL=dshHooks.js.map

package/dist/harness/dshHooks.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"dshHooks.js","sourceRoot":"","sources":["../../src/harness/dshHooks.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2FG;AAEH,OAAO,KAAK,EAAE,MAAM,kBAAkB,CAAA;AACtC,OAAO,EAAE,UAAU,EAAe,MAAM,SAAS,CAAA;AACjD,OAAO,KAAK,IAAI,MAAM,WAAW,CAAA;AACjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAA;AAC7B,OAAO,EAAE,iBAAiB,EAAE,MAAM,WAAW,CAAA;AAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,MAAM,CAAA;AAClD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAA;AAE9C,MAAM,GAAG,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAA;AAE1C,8EAA8E;AAC9E,MAAM,YAAY,GAAG,UAAU,CAAA;AAC/B,MAAM,iBAAiB,GAAG,MAAM,CAAA;AAChC,wEAAwE;AACxE,MAAM,YAAY,GAAG,UAAU,CAAA;AAC/B,MAAM,sBAAsB,GAAG,kBAAkB,CAAA;AACjD,MAAM,iBAAiB,GAAG,eAAe,CAAA;AAEzC;sEACsE;AACtE,MAAM,aAAa,GAAG,oBAAoB,CAAA;AAC1C;sCACsC;AACtC,MAAM,kBAAkB,GAAG,mBAAmB,CAAA;AAC9C;;;;uEAIuE;AACvE,MAAM,0BAA0B,GAAG,QAAQ,CAAA;AAE3C;;;;0CAI0C;AAC1C,MAAM,UAAU,cAAc;IAC5B,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;IAC5C,IAAI,UAAU,IAAI,UAAU,CAAC,IAAI,EAAE;QAAE,OAAO,UAAU,CAAC,IAAI,EAAE,CAAA;IAC7D,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,iBAAiB,CAAC,CAAA;AACnD,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAe;IACtD,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IACrD,IAAI,OAAiB,CAAA;IACrB,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAA;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAA;IACX,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAA;IACxB,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,WAAW,EAAE;YAAE,SAAQ;QAClC,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,EAAE,cAAc,CAAC,CAAC,EAAE,CAAC;YACpE,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAA;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAA;AACZ,CAAC;AAED,6EAA6E;AAE7E;;;+CAG+C;AAC/C,MAAM,yBAAyB,GAAG,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAA;AAExE;oEACoE;AACpE,SAAS,WAAW;IAClB,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACzF,KAAK,MAAM,GAAG,IAAI,QAAQ,EAAE,CAAC;QAC3B,IAAI,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAA;IAC3D,CAAC;IACD,OAAO,KAAK,CAAA;AACd,CAAC;AAaD;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,OAAO,GAAG,cAAc,EAAE;IACnE,MAAM,YAAY,GAAG,CAAC,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAA;IAC/D,IAAI,YAAY,GAAG,CAAC;QAAE,OAAO,EAAE,WAAW,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;IAE5E,MAAM,WAAW,GACf,yBAAyB,CAAC,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,WAAW,EAAE,CAAA;IAErG,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC,EAAE,GAAG,EAAE,WAAW,EAAE,CAAA;AAC3D,CAAC;AAED,6EAA6E;AAE7E,SAAS,eAAe,CAAC,aAAqB,EAAE,WAAmB;IACjE,OAAO;QACL,EAAE,EAAE,aAAa;QACjB,IAAI,EAAE,kBAAkB;QACxB,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,EAAE,aAAa,EAAE;KACjD,CAAA;AACH,CAAC;AAED;;6EAE6E;AAC7E,SAAS,UAAU,CAAC,SAAoB;IACtC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,SAAS,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAC1C,MAAM,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;QACzB,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ;YAAE,SAAQ;QAC/C,MAAM,GAAG,GAAG,IAA+B,CAAA;QAC3C,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC9B,MAAM,KAAK,GAAG,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAK,CAA6B,CAAC,EAAE,KAAK,aAAa,CAAC,CAAA;YACvH,IAAI,KAAK;gBAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,CAAA;YAC1C,SAAQ;QACV,CAAC;QACD,IAAI,GAAG,CAAC,EAAE,KAAK,aAAa;YAAE,OAAO,EAAE,KAAK,EAAE,CAAC,EAAE,GAAG,EAAE,GAAG,EAAE,CAAA;IAC7D,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,2BAA2B,CACxC,SAAiB,EACjB,YAAoB,EACpB,UAAmC;IAEnC,IAAI,YAAY,CAAC,QAAQ,CAAC,OAAO,aAAa,EAAE,CAAC;QAAE,OAAM;IAEzD,MAAM,MAAM,GAAG,UAAU,CAAC,MAAiC,CAAA;IAC3D,MAAM,KAAK,GAAG;QACZ,EAAE;QACF,0FAA0F;QAC1F,WAAW;QACX,aAAa,aAAa,EAAE;QAC5B,eAAe,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE;QAChD,eAAe;QACf,wBAAwB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,WAAW,IAAI,EAAE,CAAC,EAAE;QAClE,qBAAqB,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE;KAC7D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;IAEZ,MAAM,IAAI,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,KAAK,GAAG,IAAI,CAAA;IACnE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5D,MAAM,GAAG,GAAG,SAAS,GAAG,cAAc,CAAA;IACtC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,qDAAqD,CAAC,CAAA;AACjJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,UAAkB,EAAE,aAAqB,EAAE,WAAmB;IACpG,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,sBAAsB,CAAC,CAAA;IAC/D,IAAI,YAAY,GAAG,EAAE,CAAA;IACrB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAA;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;QACvE,qEAAqE;QACrE,mEAAmE;IACrE,CAAC;IAED,MAAM,UAAU,GAAG,eAAe,CAAC,aAAa,EAAE,WAAW,CAAC,CAAA;IAE9D,IAAI,GAAqC,CAAA;IACzC,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC9D,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,uBAAuB,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EACjF,yFAAyF,CAC1F,CAAA;QACD,MAAM,2BAA2B,CAAC,SAAS,EAAE,YAAY,EAAE,UAAU,CAAC,CAAA;QACtE,OAAM;IACR,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,wEAAwE;QACxE,kEAAkE;QAClE,2DAA2D;QAC3D,sEAAsE;QACtE,kEAAkE;QAClE,wBAAwB;QACxB,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IACnC,CAAC;IAED,MAAM,SAAS,GAAG,GAAG,CAAC,IAAI,EAAe,CAAA;IACzC,MAAM,KAAK,GAAG,UAAU,CAAC,SAAS,CAAC,CAAA;IACnC,MAAM,WAAW,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IAE5D,IAAI,OAAO,GAAG,KAAK,CAAA;IACnB,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,GAAG,CAAC,KAAK,CAAC,EAAE,EAAE,WAAW,CAAC,CAAA;QAC1B,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;SAAM,IAAI,CAAC,iBAAiB,CAAC,KAAK,CAAC,GAAG,EAAE,UAAU,CAAC,EAAE,CAAC;QACrD,mEAAmE;QACnE,uEAAuE;QACvE,sEAAsE;QACtE,8DAA8D;QAC9D,GAAG,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,CAAC,CAAA;QACrC,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAM;IAEpB,MAAM,EAAE,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,SAAS,GAAG,cAAc,CAAA;IACtC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAA;IAChD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,SAAS,CAAC,CAAA;IAC/B,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,mBAAmB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,qDAAqD,CAAC,CAAA;AACjI,CAAC;AAED,6EAA6E;AAE7E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,UAAkB;IAC7D,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAA;IAC1D,IAAI,QAAiC,CAAA;IACrC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAA4B,CAAA;IAC5F,CAAC;IAAC,MAAM,CAAC;QACP,iEAAiE;QACjE,sEAAsE;QACtE,OAAM;IACR,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,YAAY,IAAI,OAAO,QAAQ,CAAC,YAAY,KAAK,QAAQ;QAC9E,CAAC,CAAC,QAAQ,CAAC,YAAY;QACvB,CAAC,CAAC,EAAE,CAA2B,CAAA;IAEjC,IAAI,IAAI,CAAC,eAAe,CAAC,KAAK,0BAA0B;QAAE,OAAM;IAEhE,QAAQ,CAAC,YAAY,GAAG,EAAE,GAAG,IAAI,EAAE,eAAe,EAAE,0BAA0B,EAAE,CAAA;IAEhF,MAAM,GAAG,GAAG,YAAY,GAAG,cAAc,CAAA;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAA;IAC1E,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAClC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,YAAY,EAAE,EAAE,6CAA6C,CAAC,CAAA;AACnH,CAAC;AAED,8EAA8E;AAE9E;;;8CAG8C;AAC9C,MAAM,mBAAmB,GAAG,cAAc,CAAA;AAC1C;4EAC4E;AAC5E,MAAM,sBAAsB,GAAG,WAAW,CAAA;AAE1C,KAAK,UAAU,2BAA2B,CAAC,YAAoB,EAAE,YAAoB,EAAE,QAAgB;IACrG,MAAM,MAAM,GAAa,EAAE,CAAA;IAE3B,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,mBAAmB,GAAG,CAAC,EAAE,CAAC;QACtD,MAAM,CAAC,IAAI,CACT,EAAE,EACF,oFAAoF,EACpF,wEAAwE,EACxE,wEAAwE,EACxE,GAAG,mBAAmB,GAAG,EACzB,cAAc,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CACzC,CAAA;IACH,CAAC;IAED,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC,GAAG,sBAAsB,GAAG,CAAC,EAAE,CAAC;QACzD,MAAM,CAAC,IAAI,CACT,EAAE,EACF,oFAAoF,EACpF,GAAG,sBAAsB,GAAG,EAC5B,cAAc,EACd,cAAc,EACd,6CAA6C,EAC7C,+BAA+B,EAC/B,kBAAkB,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,EAAE,CAC7C,CAAA;IACH,CAAC;IAED,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAM;IAE/B,MAAM,IAAI,GAAG,YAAY,CAAC,OAAO,EAAE,GAAG,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;IACrE,MAAM,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC/D,MAAM,GAAG,GAAG,YAAY,GAAG,cAAc,CAAA;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,OAAO,CAAC,CAAA;IACtC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAClC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,sBAAsB,EAAE,EAAE,kDAAkD,CAAC,CAAA;AACpJ,CAAC;AAED;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,QAAgB;IACvE,MAAM,YAAY,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,CAAC,CAAA;IAC1D,IAAI,YAAY,GAAG,EAAE,CAAA;IACrB,IAAI,CAAC;QACH,YAAY,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC,CAAA;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,kEAAkE;QAClE,iBAAiB;IACnB,CAAC;IAED,IAAI,GAAqC,CAAA;IACzC,IAAI,CAAC;QACH,GAAG,GAAG,aAAa,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,CAAA;QAC9D,IAAI,GAAG,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,MAAM,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,CAAA;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,IAAI,CACN,EAAE,MAAM,EAAE,0BAA0B,EAAE,IAAI,EAAE,YAAY,EAAE,GAAG,EAAG,GAAa,CAAC,OAAO,EAAE,EACvF,sFAAsF,CACvF,CAAA;QACD,MAAM,2BAA2B,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,CAAC,CAAA;QACvE,OAAM;IACR,CAAC;IAED,IAAI,GAAG,CAAC,QAAQ,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QACjD,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC,CAAA;IACnC,CAAC;IAED,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,wEAAwE;IACxE,4BAA4B;IAC5B,KAAK,MAAM,OAAO,IAAI;QACpB,CAAC,mBAAmB,CAAC;QACrB,CAAC,sBAAsB,CAAC;QACxB,CAAC,sBAAsB,EAAE,WAAW,CAAC;KACtC,EAAE,CAAC;QACF,MAAM,IAAI,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAA;QAC/B,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YACvC,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC,CAAA;QACxB,CAAC;IACH,CAAC;IAED,MAAM,UAAU,GAAG,GAAG,CAAC,IAAI,EAA6B,CAAA;IACxD,IAAI,OAAO,GAAG,KAAK,CAAA;IAEnB,wEAAwE;IACxE,MAAM,eAAe,GAAI,UAAU,CAAC,mBAAmB,CAAyC,IAAI,EAAE,CAAA;IACtG,MAAM,sBAAsB,GAAG,EAAE,GAAG,eAAe,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAA;IACxE,IAAI,CAAC,iBAAiB,CAAC,eAAe,EAAE,sBAAsB,CAAC,EAAE,CAAC;QAChE,GAAG,CAAC,KAAK,CAAC,CAAC,mBAAmB,CAAC,EAAE,sBAAsB,CAAC,CAAA;QACxD,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,wEAAwE;IACxE,MAAM,OAAO,GAAI,UAAU,CAAC,sBAAsB,CAAyC,IAAI,EAAE,CAAA;IACjG,MAAM,SAAS,GAAI,OAAO,CAAC,SAAiD,IAAI,EAAE,CAAA;IAClF,MAAM,aAAa,GAAI,SAAS,CAAC,OAA+C,IAAI,EAAE,CAAA;IACtF,MAAM,YAAY,GAAG;QACnB,GAAG,aAAa;QAChB,WAAW,EAAE,0BAA0B;QACvC,GAAG,EAAE,oBAAoB;QACzB,OAAO,EAAE,QAAQ;KAClB,CAAA;IACD,IAAI,CAAC,iBAAiB,CAAC,aAAa,EAAE,YAAY,CAAC,EAAE,CAAC;QACpD,GAAG,CAAC,KAAK,CAAC,CAAC,sBAAsB,EAAE,WAAW,EAAE,SAAS,CAAC,EAAE,YAAY,CAAC,CAAA;QACzE,OAAO,GAAG,IAAI,CAAA;IAChB,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAM;IAEpB,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,YAAY,GAAG,cAAc,CAAA;IACzC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC,QAAQ,EAAE,EAAE,OAAO,CAAC,CAAA;IAChD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,YAAY,CAAC,CAAA;IAClC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,sBAAsB,EAAE,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,EAAE,kDAAkD,CAAC,CAAA;AACpI,CAAC;AAED,6EAA6E;AAE7E;;;;;;;GAOG;AACH,SAAS,iBAAiB,CAAC,YAAsB;IAC/C,MAAM,YAAY,GAChB,YAAY,CAAC,MAAM,GAAG,CAAC;QACrB,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,IAAI,oCAAoC,IAAI,sBAAsB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAClH,CAAC,CAAC,sCAAsC,CAAA;IAE5C,OAAO;;;;;;;;;;;;;;;;;EAiBP,YAAY;;;;;;;;;;;CAWb,CAAA;AACD,CAAC;AAED;;kBAEkB;AAClB,KAAK,UAAU,iBAAiB,CAAC,OAAe,EAAE,YAAsB;IACtE,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,YAAY,CAAC,CAAA;IACpD,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;IAE/C,IAAI,QAAQ,GAAG,EAAE,CAAA;IACjB,IAAI,CAAC;QACH,QAAQ,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC,CAAA;IACpD,CAAC;IAAC,MAAM,CAAC;QACP,eAAe;IACjB,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAM;IAEhC,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IAC5C,MAAM,GAAG,GAAG,WAAW,GAAG,cAAc,CAAA;IACxC,MAAM,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,OAAO,CAAC,CAAA;IACzC,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,WAAW,CAAC,CAAA;IACjC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,wBAAwB,EAAE,IAAI,EAAE,WAAW,EAAE,EAAE,wBAAwB,CAAC,CAAA;AAC7F,CAAC;AAED,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,aAAqB,EAAE,QAAgB,EAAE,WAAW,GAAG,EAAE;IAC3F,MAAM,OAAO,GAAG,cAAc,EAAE,CAAA;IAChC,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAA;IAErD,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7B,GAAG,CAAC,KAAK,CAAC,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,EAAE,iEAAiE,CAAC,CAAA;QAC7G,OAAM;IACR,CAAC;IAED,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,MAAM,iBAAiB,CAAC,UAAU,EAAE,aAAa,EAAE,WAAW,CAAC,CAAA;QAC/D,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAA;QACxC,GAAG,CAAC,IAAI,CAAC,EAAE,MAAM,EAAE,qBAAqB,EAAE,OAAO,EAAE,IAAI,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,EAAE,0CAA0C,CAAC,CAAA;IAC7H,CAAC;IAED,MAAM,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAA;IAC1C,MAAM,iBAAiB,CAAC,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;AAC5E,CAAC"}