@lannguyensi/harness 0.63.0 → 1.0.0

package/dist/cli/pack/auto-approve-path.js

@@ -1,462 +0,0 @@
-// Step 9 of the understanding-gate PreToolUse decision order: the
-// operator-opt-in auto-approval attempt (agent-tasks/74b4b17d, slice 1 of
-// docs/decisions/2026-08-27-ug-auto-mode-approval.md, "Option A").
-//
-// WHERE THIS RUNS, AND WHY IT MATTERS. `hook-pre-tool-use.ts` calls
-// `attemptAutoApproval` on a call that EVERY branch above it has already
-// declined: the signed-marker check (step 3), the read-only Bash
-// exemption (step 6), the recovery-commit exemption (step 7) and the
-// escape `ask` (step 8). So the auto path only ever acts on a call that
-// would otherwise reach the final block. Three consequences the ADR's
-// decision-order table spells out: the session's first `ls` or `git
-// status` mints nothing, `max_age` starts counting from the call that
-// actually needed an approval, and a bare `harness approve understanding`
-// keeps whatever the interactive prompt resolves it to. The negative
-// controls in tests/cli/pack-hook-pre-tool-use-auto-approve.test.ts pin
-// that ordering; moving this call site up is a mutation those tests
-// catch.
-//
-// WHAT IT IS NOT. This function never returns an allow of its own. On
-// success it consumes the report, writes the signed SESSION marker
-// through the same `writeApprovalMarker` path `harness approve
-// understanding` uses, records an audit-only ledger fact, and then
-// re-runs `checkOperatorApprovalMarkers` — that re-check, and nothing
-// else, is what produces the allow. The gate's decision input stays
-// exactly one signed marker (invariant 1). Every failure returns
-// `approved: false` and the caller falls through to the existing final
-// block with step 3's `markerExpired` / `markerForged` intact.
-//
-// FAIL CLOSED ON EVERY MISSING INPUT. Absent opt-in, unlisted
-// `permission_mode`, a forged marker already detected at step 3, a
-// failed session-consistency check, a missing signing key, a missing /
-// already-consumed / foreign / invalid report: each one declines with
-// one stderr line and no write.
-//
-// TWO CALL SITES, ONE BODY (slice 2, agent-tasks/57058364).
-// `hook-codex-pre-tool-use.ts` calls this same function at the same
-// place in its own decision order. Everything that differs between the
-// two runtimes is an ARGUMENT, never a fork: the `harness` segment of
-// the minted `approvedBy`, which session-consistency evidence the
-// payload can be held against (`sessionConsistency`), the ledger fact's
-// `source` verb, and the stderr `label`. Claude Code carries
-// `$CLAUDE_CODE_SESSION_ID` in the hook environment; Codex carries no
-// session-id environment variable at all (measured live, Codex 0.150.1)
-// but does name a per-session `transcript_path` that exists on disk at
-// PreToolUse time.
-//
-// TWO ALTERNATIVE KEY-ONE SIGNALS (slice 3, agent-tasks 37ad0b05). The
-// ADR's "Decision: two-key design" makes the trusted signal a
-// disjunction: a `when`-listed `permission_mode`, OR a valid delegation
-// for this child session that the CALLING HOOK has already verified and
-// passes in as `delegation`. Both are only key ONE. Key two, the child's
-// own strict-session `pending` report, is condition (6) below and is
-// identical on both paths; nothing about a delegation relaxes it, and no
-// branch here reads a delegation file, so the one verifier stays in
-// `understanding-before-execution/delegation-markers.ts`.
-//
-// ONE BODY IS NOT ONE OPT-IN. Sharing the body would otherwise mean an
-// `auto_approve` block written for Claude Code opts every Codex session
-// in too; `auto_approve.harnesses` is the explicit per-harness
-// allowlist that prevents it, defaulting to Claude Code only when the
-// key is absent (step 1b below).
-import * as fs from "node:fs";
-import * as path from "node:path";
-import { autoApprovedByFor, autoApprovedLedgerTagFor, canonicalReportHash, checkOperatorApprovalMarkers, harnessAllowed, listPersistedReportsBoundedWithSkips, MAX_HOOK_LISTING_ENTRIES, parseAutoApprove, permissionModeAllowed, readReportFileBounded, selectNewestStrictSessionReport, writeApprovalMarker, } from "../../policy-packs/builtin/understanding-before-execution-runtime.js";
-import { signingKeyExists } from "../../runtime/approval-signing.js";
-import { clearPendingApproval, readPendingApproval, } from "../../runtime/pending-approval.js";
-import { ApprovedReportTooLargeError, renderApprovedReport, rewriteReportApproved, validatePersistedReport, } from "../approve/understanding.js";
-/**
- * Source string the CLAUDE CODE hook records on the audit-only ledger
- * fact — the verb that actually made the write.
- */
-export const AUTO_APPROVE_LEDGER_SOURCE = "harness-pack-hook-pre-tool-use";
-/**
- * The Codex hook's counterpart. A shared body must not stamp the Claude
- * verb on a Codex write: the ledger fact is an audit surface, and an
- * auditor reading `harness-pack-hook-pre-tool-use` on a Codex session
- * would be reading a fact about a hook that never ran (reviewer round-1
- * finding on slice 2). The `approvedBy` segment already distinguishes
- * the runtimes; this makes the ledger row agree with it.
- */
-export const AUTO_APPROVE_LEDGER_SOURCE_CODEX = "harness-pack-hook-codex-pre-tool-use";
-/** Default stderr prefix: the Claude Code hook's, byte-for-byte. */
-const DEFAULT_LABEL = "harness pack hook";
-/**
- * The `<mode>` segment an auto-marker carries whenever key one came from
- * the DELEGATION rather than from a `when`-listed `permission_mode`.
- * `auto-mode:claude-code:delegated;delegated:<parent-sid>` reads as what
- * it is: a child whose trusted signal was the parent's pre-authorization,
- * not a permission mode. Used unconditionally on that path, whatever the
- * payload's own mode says, since that mode played no part in the decision.
- */
-const DELEGATED_MODE_LABEL = "delegated";
-function decline(reason) {
-    return { approved: false, reason };
-}
-/**
- * Attempt the operator-opted-in auto-approval for this PreToolUse call.
- * See the module header for placement and the fail-closed contract; the
- * numbered steps below are conditions 1-6 of the ADR's Option A.
- */
-export async function attemptAutoApproval(args) {
-    const { stderr } = args;
-    const label = args.label ?? DEFAULT_LABEL;
-    const note = (msg) => {
-        stderr.write(`${label}: ${msg}\n`);
-    };
-    // (1) Opt-in. Absent is the ordinary case and stays SILENT; a
-    // malformed block already wrote its own single line inside
-    // `parseAutoApprove` (fail-closed: malformed means "not opted in",
-    // never a partial default).
-    const packConfigObj = args.packConfig !== null && typeof args.packConfig === "object" && !Array.isArray(args.packConfig)
-        ? args.packConfig
-        : {};
-    const cfg = parseAutoApprove(packConfigObj["auto_approve"], stderr, label);
-    if (cfg === null)
-        return decline("auto_approve not configured");
-    // (1b) Per-harness opt-in, checked BEFORE the `when` allowlist and
-    // before the ledger thunk below, so an unlisted harness resolves
-    // nothing and never reaches any evidence lookup. Two call sites share
-    // this body; without this check an `auto_approve` block written for
-    // Claude Code before the Codex hook existed would silently start
-    // auto-approving every Codex session that runs in a listed
-    // `permission_mode` (reviewer round-1 finding on slice 2). `harnesses`
-    // is absent in exactly those older configs and resolves to Claude Code
-    // only, so opting a second runtime in stays an explicit config edit.
-    // Diagnosed, unlike the silent `when` miss below: an unlisted harness
-    // is a configuration mismatch worth seeing once per call, not the
-    // ordinary state of an opted-in session.
-    if (!harnessAllowed(cfg, args.harness)) {
-        note(`auto-approval declined: harness "${args.harness}" is not listed in auto_approve.harnesses`);
-        return decline("harness not in auto_approve.harnesses");
-    }
-    // (2) `when` allowlist, exact string equality against the payload
-    // literal (hardening item 2). Absent / empty / unlisted is the normal
-    // case for an opted-in repo whose session simply runs in a prompting
-    // mode, and it fires on EVERY such call once the opt-in is present, so
-    // this stays SILENT (no stderr line): a per-call note here would echo
-    // the configured `auto_approve.when` allowlist to stderr on every
-    // ordinary prompting-mode call (reviewer round-1 finding).
-    const mode = args.permissionMode;
-    const modeAllowed = permissionModeAllowed(cfg, mode);
-    if (!modeAllowed && args.delegation === undefined) {
-        return decline("permission_mode not in auto_approve.when");
-    }
-    // Which of the ADR's two alternative key-one signals actually applied.
-    // Logged only on the delegation path: the `when` hit is the ordinary
-    // slice-1 case and stays as silent as it was, so slice 1's stderr trail
-    // is byte-identical to what it was before this argument existed.
-    if (args.delegation !== undefined) {
-        note(modeAllowed
-            ? `auto-approval key one: permission_mode ${JSON.stringify(mode)} in auto_approve.when (a valid delegation from parent session ${args.delegation.parentSessionId} is also present)`
-            : `auto-approval key one: valid delegation from parent session ${args.delegation.parentSessionId}`);
-    }
-    // The `<mode>` segment of `approvedBy` records WHICH key one applied,
-    // so it carries a payload literal in exactly one case: the mode itself
-    // was `when`-listed, i.e. the operator wrote that exact string in the
-    // config and this call matched it.
-    //
-    // On the delegation path the payload's mode is UNCONSTRAINED (that is
-    // the whole point: a `-p` child may carry `default`, or nothing) and it
-    // played no part in the decision, so it is replaced by the neutral
-    // `delegated` literal wholesale rather than filtered. Filtering only the
-    // encoding-breaking characters was not enough: `approvedBy` is a signed
-    // AUDIT record, and a payload-composed mode carrying a newline or a tab
-    // survives a `;`/`:` check, lands verbatim in the signed field, and then
-    // shows up in the doctor listing as a permission mode that never
-    // existed (reviewer finding L2). Nothing is lost: the payload's mode is
-    // not evidence of anything on this path.
-    const modeStr = modeAllowed ? mode : DELEGATED_MODE_LABEL;
-    // Resolve the audit-only ledger writer NOW, not earlier: this is the
-    // first point past both the opt-in check (1) and the `when` allowlist
-    // check (2), so `args.resolveLedger` runs only on a call that has an
-    // actual chance of reaching the ledger write below, never on the
-    // overwhelming majority of gated calls that are not opted in or run in
-    // an unlisted permission mode.
-    const ledger = args.resolveLedger();
-    // (3) A forgery detected at step 3 is never laundered into an
-    // approval (ADR condition 6). Declining also leaves the forged FILE and
-    // its distinct `forged/unsigned marker rejected` diagnostic on disk —
-    // `writeApprovalMarker` would atomically overwrite that exact path.
-    if (args.markerForged) {
-        const forgedKind = args.forgedKind ?? "marker";
-        const forgedNoun = forgedKind === "inflight" ? "in-flight record" : "marker";
-        note(`auto-approval declined: forged/unsigned ${forgedNoun} present`);
-        return decline(`forged ${forgedNoun} present`);
-    }
-    // (4) Session consistency (hardening item 1): the PAYLOAD's own
-    // `session_id` must be present and must agree with a SECOND input the
-    // hook reads for itself — the runtime's session-id environment
-    // variable on Claude Code, the named per-session transcript file on
-    // Codex. Compared against the payload field specifically, never the
-    // hook's env-fallback-resolved id, or the env variant would compare
-    // the environment with itself.
-    const payloadSid = typeof args.payloadSessionId === "string" && args.payloadSessionId.length > 0
-        ? args.payloadSessionId
-        : null;
-    if (payloadSid === null) {
-        note("auto-approval declined: event payload carries no session_id");
-        return decline("no payload session_id");
-    }
-    const consistency = args.sessionConsistency;
-    if (consistency.kind === "env") {
-        const envSid = process.env[consistency.variable];
-        if (typeof envSid !== "string" || envSid.length === 0) {
-            note(`auto-approval declined: $${consistency.variable} is not set in the hook environment`);
-            return decline(`no ${consistency.variable}`);
-        }
-        if (envSid !== payloadSid) {
-            note(`auto-approval declined: payload session_id does not match $${consistency.variable} in the hook environment`);
-            return decline("session id mismatch");
-        }
-    }
-    else {
-        // Codex carries no session-id environment variable in the hook
-        // process (measured live, Codex 0.150.1: only CODEX_HOME,
-        // CODEX_MANAGED_BY_NPM, CODEX_MANAGED_PACKAGE_ROOT), so the env
-        // variant has no counterpart there. The payload's own
-        // `transcript_path` is the second input instead: Codex names the
-        // session's rollout file
-        // `<CODEX_HOME>/sessions/YYYY/MM/DD/rollout-<timestamp>-<session_id>.jsonl`
-        // and the file already exists when PreToolUse fires.
-        //
-        // Three separately-diagnosed conditions, each fail-closed: the
-        // field is a non-empty string; its BASENAME names this exact
-        // session (`-<sid>.jsonl`, or a bare `<sid>.jsonl` for a shim that
-        // drops the `rollout-<timestamp>` prefix); and the path resolves to
-        // a REGULAR FILE. `statSync().isFile()`, not `existsSync`: a
-        // directory named `<sid>.jsonl` is not a transcript, and neither is
-        // a socket or a device node, yet all of them satisfy mere existence
-        // (reviewer round-1 finding on slice 2). It is deliberately not a
-        // content check: reading and parsing the rollout would make the hook
-        // depend on Codex's internal transcript format for a check that is
-        // not a boundary anyway (see SessionConsistencyCheck).
-        const transcriptPath = typeof consistency.transcriptPath === "string" && consistency.transcriptPath.length > 0
-            ? consistency.transcriptPath
-            : null;
-        if (transcriptPath === null) {
-            note("auto-approval declined: event payload carries no transcript_path");
-            return decline("no transcript_path");
-        }
-        const base = path.basename(transcriptPath);
-        if (base !== `${payloadSid}.jsonl` && !base.endsWith(`-${payloadSid}.jsonl`)) {
-            note(`auto-approval declined: transcript_path does not name session ${payloadSid} (basename ${base})`);
-            return decline("transcript_path session mismatch");
-        }
-        // `throwIfNoEntry: false` covers the ordinary ENOENT; the try/catch
-        // covers every other stat failure (a permission error, a symlink
-        // loop), which fails closed here rather than throwing out of a hook
-        // whose caller treats a throw as neither allow nor block.
-        let transcriptIsFile = false;
-        try {
-            transcriptIsFile = fs.statSync(transcriptPath, { throwIfNoEntry: false })?.isFile() === true;
-        }
-        catch {
-            transcriptIsFile = false;
-        }
-        if (!transcriptIsFile) {
-            note(`auto-approval declined: transcript_path does not name an existing file (${transcriptPath})`);
-            return decline("transcript_path missing");
-        }
-    }
-    // (5) Key precheck BEFORE any write (hardening item 5). The shared
-    // write path would otherwise mint the key it is supposed to require:
-    // `writeApprovalMarker` -> `signMarker` -> `getOrCreateSigningKey`
-    // generates one on ENOENT. Key creation stays an operator-side act.
-    if (args.generatedDir === undefined) {
-        note("auto-approval declined: harness.generated/ could not be resolved");
-        return decline("generatedDir unresolvable");
-    }
-    const generatedDir = args.generatedDir;
-    if (!signingKeyExists(generatedDir)) {
-        note("auto-approval declined: signing key absent (never created by the hook)");
-        return decline("signing key absent");
-    }
-    // (6) The report precondition: the NEWEST strict-session report, and
-    // only that one, must be exactly `pending`, parse, and pass the
-    // approve CLI's own content validation.
-    //
-    // The directory holds files the gated agent can write, so it is listed
-    // through the bounded reader (a FIFO or a huge file cannot block or kill
-    // the hook), and an entry that listing had to skip declines the whole
-    // attempt: an unreadable or oversized NEWEST report must not let the
-    // selection fall back to an older pending one.
-    //
-    // Bounded by entry count and by bytes as well: past `MAX_HOOK_LISTING_ENTRIES`
-    // entries, or past the hash scan's byte budget, nothing is returned and the
-    // attempt declines, since a listing that cannot see every entry cannot say
-    // which report is the newest (a hidden newer one may already be approved).
-    const listing = listPersistedReportsBoundedWithSkips(args.reportsDir, {
-        maxEntries: MAX_HOOK_LISTING_ENTRIES,
-    });
-    if (listing.truncated) {
-        note(`auto-approval declined: the reports directory ${listing.truncatedDetail}`);
-        return decline("report listing over the bound");
-    }
-    if (listing.skipped.length > 0) {
-        const oversized = listing.skipped.find((entry) => entry.reason === "too-large");
-        if (oversized !== undefined) {
-            note(`auto-approval declined: report invalid (${oversized.detail})`);
-            return decline("report invalid: size");
-        }
-        const first = listing.skipped[0];
-        note(`auto-approval declined: report listing skipped ${listing.skipped.length} unreadable entr${listing.skipped.length === 1 ? "y" : "ies"} (${first?.detail ?? "unknown"})`);
-        return decline("report listing incomplete");
-    }
-    const newest = selectNewestStrictSessionReport(listing.reports, args.sessionId);
-    if (newest === null) {
-        note(`auto-approval declined: no persisted report bound to session ${args.sessionId}`);
-        return decline("no report for session");
-    }
-    if (newest.approvalStatus !== "pending") {
-        note(`auto-approval declined: newest report for session ${args.sessionId} is approvalStatus=${newest.approvalStatus ?? "<missing>"}, not pending`);
-        return decline("newest report not pending");
-    }
-    // Read exactly as the gate-read scan reads it (`readReportFileBounded`):
-    // a report over the size cap there matches nothing, so a marker minted
-    // from it would bind content the gate never finds; it declines as an
-    // invalid report instead, like one nested too deeply to hash.
-    const read = readReportFileBounded(newest.filePath);
-    if (!read.ok) {
-        if (read.reason === "too-large") {
-            note(`auto-approval declined: report invalid (${read.detail})`);
-            return decline("report invalid: size");
-        }
-        note(`auto-approval declined: report unreadable (${read.detail})`);
-        return decline("report unreadable");
-    }
-    const raw = read.raw;
-    let parsed;
-    try {
-        parsed = JSON.parse(raw);
-    }
-    catch (err) {
-        note(`auto-approval declined: report invalid (unparseable JSON: ${err.message})`);
-        return decline("report unparseable");
-    }
-    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
-        note("auto-approval declined: report invalid (body is not a JSON object)");
-        return decline("report not an object");
-    }
-    const validation = validatePersistedReport(parsed);
-    if (!validation.ok) {
-        note(`auto-approval declined: report invalid (${validation.field}: ${validation.reason})`);
-        return decline(`report invalid: ${validation.field}`);
-    }
-    // Success sequence. `reportContentHash` is the canonical hash of the
-    // report as it stands BEFORE the approval rewrite, exactly as the approve
-    // CLI computes it; the lifecycle fields the rewrite changes are not part
-    // of it, so the gate-read cross-check (some report file must still hash to
-    // it) matches afterwards. A report nested too deeply to hash would mint a
-    // marker that binds no content, so it declines like any other invalid report.
-    const reportContentHash = canonicalReportHash(parsed);
-    if (reportContentHash === null) {
-        note("auto-approval declined: report invalid (nested too deeply to hash its content)");
-        return decline("report invalid: nesting depth");
-    }
-    const approvedAt = new Date().toISOString();
-    // The parent linkage rides in the same signed `approvedBy` field the
-    // source already travels in (ADR "Audit and doctor"): no new signed
-    // field, therefore no `SIGNING_ALG` bump. `parseAutoApprovedBy` strips
-    // the suffix, so the doctor listing still buckets the marker by
-    // harness/mode. The parent id needs no escaping here: it comes out of a
-    // verified delegation whose own writer already refused a `;` or `=` in
-    // it (`buildDelegationApprovedBy`'s `rejectUnsafeSegmentValue`).
-    const approvedBy = args.delegation === undefined
-        ? autoApprovedByFor(args.harness, modeStr)
-        : `${autoApprovedByFor(args.harness, modeStr)};delegated:${args.delegation.parentSessionId}`;
-    // The rewrite below pretty-prints the report and adds its approval fields,
-    // which can carry a report read just under the size cap over it. The
-    // gate-read scan reads no file over the cap, so a marker minted for it would
-    // deny on every call: check the rewritten bytes first and decline, before
-    // the report is consumed or any marker is written.
-    try {
-        renderApprovedReport(raw, approvedAt, approvedBy, args.sessionId);
-    }
-    catch (err) {
-        if (err instanceof ApprovedReportTooLargeError) {
-            note(`auto-approval declined: report invalid (${err.message})`);
-            return decline("report invalid: size");
-        }
-        // Any other failure surfaces through the consume step below.
-    }
-    // CONSUME FIRST, then sign. If the marker write fails after this, the
-    // report is spent and no marker exists: the call blocks and the same
-    // report can never mint again. The reverse order would leave a
-    // still-`pending` report behind a failed write, i.e. a report that is
-    // mintable on the very next call — the direction this design refuses.
-    // The rewrite takes the text read above through the bounded reader instead
-    // of re-reading the path: a report symlink retargeted (to a FIFO, a huge
-    // file) after that read can then neither block nor kill the hook here.
-    try {
-        rewriteReportApproved(newest.filePath, approvedAt, approvedBy, args.sessionId, raw);
-    }
-    catch (err) {
-        note(`auto-approval declined: could not consume the report (${err.message})`);
-        return decline("report consumption failed");
-    }
-    let markerPath;
-    try {
-        markerPath = writeApprovalMarker(generatedDir, args.sessionId, {
-            approvedAt,
-            approvedBy,
-            reportContentHash,
-        });
-    }
-    catch (err) {
-        note(`auto-approval declined: failed to write the approval marker (${err.message}); the report was consumed, so this session needs a fresh report`);
-        return decline("marker write failed");
-    }
-    // Audit-only ledger fact. Never a gate input, so every failure here is
-    // one stderr line and nothing more.
-    const tag = autoApprovedLedgerTagFor(args.sessionId);
-    if (ledger.write === null) {
-        note(`auto-approval ledger fact ${tag} not recorded (${ledger.reason ?? "ledger writer unavailable"}); audit only, continuing`);
-    }
-    else {
-        try {
-            const result = await ledger.write({
-                sessionId: args.sessionId,
-                content: tag,
-                source: args.ledgerSource,
-            });
-            if (!result.ok) {
-                note(`auto-approval ledger fact ${tag} not recorded (${result.reason ?? "unknown error"}); audit only, continuing`);
-            }
-        }
-        catch (err) {
-            note(`auto-approval ledger fact ${tag} not recorded (${err.message}); audit only, continuing`);
-        }
-    }
-    // Drop this session's `.pending-approval` staging entry (decision-order
-    // table, step 9). It is tier 5 of the approve verbs' session
-    // resolution and is otherwise cleared only by `harness approve
-    // understanding`, which auto mode never runs — so leaving it would let
-    // a later env-less operator `harness approve ...` resolve to this
-    // already-auto-approved id. Only ever clears OUR OWN id.
-    try {
-        if (readPendingApproval(generatedDir) === args.sessionId) {
-            clearPendingApproval(generatedDir);
-        }
-    }
-    catch {
-        /* best-effort; staging is not a gate input */
-    }
-    // The verdict comes from the same marker check every other approval
-    // goes through — the auto path itself never allows.
-    const recheck = checkOperatorApprovalMarkers(generatedDir, args.sessionId, args.packConfig, stderr);
-    if (!recheck.matched) {
-        note(`auto-approval wrote a marker but the re-check did not match (${recheck.detail}); falling through to the block`);
-        return decline("post-write marker re-check did not match");
-    }
-    note(`auto-approved via session marker by ${approvedBy}`);
-    return {
-        approved: true,
-        detail: recheck.detail,
-        approvedBy,
-        markerPath,
-        reportPath: newest.filePath,
-        reportContentHash,
-    };
-}
-//# sourceMappingURL=auto-approve-path.js.map

package/dist/cli/pack/auto-approve-path.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"auto-approve-path.js","sourceRoot":"","sources":["../../../src/cli/pack/auto-approve-path.ts"],"names":[],"mappings":"AAAA,kEAAkE;AAClE,0EAA0E;AAC1E,mEAAmE;AACnE,EAAE;AACF,oEAAoE;AACpE,yEAAyE;AACzE,iEAAiE;AACjE,qEAAqE;AACrE,wEAAwE;AACxE,sEAAsE;AACtE,oEAAoE;AACpE,sEAAsE;AACtE,0EAA0E;AAC1E,qEAAqE;AACrE,wEAAwE;AACxE,oEAAoE;AACpE,SAAS;AACT,EAAE;AACF,sEAAsE;AACtE,mEAAmE;AACnE,+DAA+D;AAC/D,mEAAmE;AACnE,sEAAsE;AACtE,oEAAoE;AACpE,iEAAiE;AACjE,uEAAuE;AACvE,+DAA+D;AAC/D,EAAE;AACF,8DAA8D;AAC9D,mEAAmE;AACnE,uEAAuE;AACvE,sEAAsE;AACtE,gCAAgC;AAChC,EAAE;AACF,4DAA4D;AAC5D,oEAAoE;AACpE,uEAAuE;AACvE,sEAAsE;AACtE,kEAAkE;AAClE,wEAAwE;AACxE,6DAA6D;AAC7D,sEAAsE;AACtE,wEAAwE;AACxE,uEAAuE;AACvE,mBAAmB;AACnB,EAAE;AACF,uEAAuE;AACvE,8DAA8D;AAC9D,wEAAwE;AACxE,wEAAwE;AACxE,yEAAyE;AACzE,qEAAqE;AACrE,yEAAyE;AACzE,oEAAoE;AACpE,0DAA0D;AAC1D,EAAE;AACF,uEAAuE;AACvE,wEAAwE;AACxE,+DAA+D;AAC/D,sEAAsE;AACtE,iCAAiC;AAEjC,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EACL,iBAAiB,EACjB,wBAAwB,EACxB,mBAAmB,EACnB,4BAA4B,EAC5B,cAAc,EACd,oCAAoC,EACpC,wBAAwB,EACxB,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,+BAA+B,EAC/B,mBAAmB,GACpB,MAAM,sEAAsE,CAAC;AAC9E,OAAO,EAAE,gBAAgB,EAAE,MAAM,mCAAmC,CAAC;AACrE,OAAO,EACL,oBAAoB,EACpB,mBAAmB,GACpB,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EACL,2BAA2B,EAC3B,oBAAoB,EACpB,qBAAqB,EACrB,uBAAuB,GACxB,MAAM,6BAA6B,CAAC;AAErC;;;GAGG;AACH,MAAM,CAAC,MAAM,0BAA0B,GAAG,gCAAgC,CAAC;AAE3E;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,gCAAgC,GAAG,sCAAsC,CAAC;AAEvF,oEAAoE;AACpE,MAAM,aAAa,GAAG,mBAAmB,CAAC;AAE1C;;;;;;;GAOG;AACH,MAAM,oBAAoB,GAAG,WAAW,CAAC;AAsHzC,SAAS,OAAO,CAAC,MAAc;IAC7B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAA4B;IAE5B,MAAM,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IACxB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,aAAa,CAAC;IAC1C,MAAM,IAAI,GAAG,CAAC,GAAW,EAAQ,EAAE;QACjC,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,KAAK,GAAG,IAAI,CAAC,CAAC;IACrC,CAAC,CAAC;IAEF,8DAA8D;IAC9D,2DAA2D;IAC3D,mEAAmE;IACnE,4BAA4B;IAC5B,MAAM,aAAa,GACjB,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC;QAChG,CAAC,CAAE,IAAI,CAAC,UAAsC;QAC9C,CAAC,CAAC,EAAE,CAAC;IACT,MAAM,GAAG,GAAG,gBAAgB,CAAC,aAAa,CAAC,cAAc,CAAC,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;IAC3E,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,6BAA6B,CAAC,CAAC;IAEhE,mEAAmE;IACnE,iEAAiE;IACjE,sEAAsE;IACtE,oEAAoE;IACpE,iEAAiE;IACjE,2DAA2D;IAC3D,uEAAuE;IACvE,uEAAuE;IACvE,qEAAqE;IACrE,sEAAsE;IACtE,kEAAkE;IAClE,yCAAyC;IACzC,IAAI,CAAC,cAAc,CAAC,GAAG,EAAE,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QACvC,IAAI,CACF,oCAAoC,IAAI,CAAC,OAAO,2CAA2C,CAC5F,CAAC;QACF,OAAO,OAAO,CAAC,uCAAuC,CAAC,CAAC;IAC1D,CAAC;IAED,kEAAkE;IAClE,sEAAsE;IACtE,qEAAqE;IACrE,uEAAuE;IACvE,sEAAsE;IACtE,kEAAkE;IAClE,2DAA2D;IAC3D,MAAM,IAAI,GAAG,IAAI,CAAC,cAAc,CAAC;IACjC,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACrD,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,CAAC;IACD,uEAAuE;IACvE,qEAAqE;IACrE,wEAAwE;IACxE,iEAAiE;IACjE,IAAI,IAAI,CAAC,UAAU,KAAK,SAAS,EAAE,CAAC;QAClC,IAAI,CACF,WAAW;YACT,CAAC,CAAC,0CAA0C,IAAI,CAAC,SAAS,CACtD,IAAI,CACL,iEACC,IAAI,CAAC,UAAU,CAAC,eAClB,mBAAmB;YACrB,CAAC,CAAC,+DAA+D,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CACrG,CAAC;IACJ,CAAC;IACD,sEAAsE;IACtE,uEAAuE;IACvE,sEAAsE;IACtE,mCAAmC;IACnC,EAAE;IACF,sEAAsE;IACtE,wEAAwE;IACxE,mEAAmE;IACnE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,yEAAyE;IACzE,iEAAiE;IACjE,wEAAwE;IACxE,yCAAyC;IACzC,MAAM,OAAO,GAAG,WAAW,CAAC,CAAC,CAAE,IAAe,CAAC,CAAC,CAAC,oBAAoB,CAAC;IAEtE,qEAAqE;IACrE,sEAAsE;IACtE,qEAAqE;IACrE,iEAAiE;IACjE,uEAAuE;IACvE,+BAA+B;IAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,EAAE,CAAC;IAEpC,8DAA8D;IAC9D,wEAAwE;IACxE,sEAAsE;IACtE,oEAAoE;IACpE,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;QACtB,MAAM,UAAU,GAAG,IAAI,CAAC,UAAU,IAAI,QAAQ,CAAC;QAC/C,MAAM,UAAU,GAAG,UAAU,KAAK,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC7E,IAAI,CAAC,2CAA2C,UAAU,UAAU,CAAC,CAAC;QACtE,OAAO,OAAO,CAAC,UAAU,UAAU,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,gEAAgE;IAChE,sEAAsE;IACtE,+DAA+D;IAC/D,oEAAoE;IACpE,oEAAoE;IACpE,oEAAoE;IACpE,+BAA+B;IAC/B,MAAM,UAAU,GACd,OAAO,IAAI,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,gBAAgB,CAAC,MAAM,GAAG,CAAC;QAC3E,CAAC,CAAC,IAAI,CAAC,gBAAgB;QACvB,CAAC,CAAC,IAAI,CAAC;IACX,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,IAAI,CAAC,6DAA6D,CAAC,CAAC;QACpE,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,MAAM,WAAW,GAAG,IAAI,CAAC,kBAAkB,CAAC;IAC5C,IAAI,WAAW,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;QAC/B,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;QACjD,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtD,IAAI,CACF,4BAA4B,WAAW,CAAC,QAAQ,qCAAqC,CACtF,CAAC;YACF,OAAO,OAAO,CAAC,MAAM,WAAW,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC/C,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,EAAE,CAAC;YAC1B,IAAI,CACF,8DAA8D,WAAW,CAAC,QAAQ,0BAA0B,CAC7G,CAAC;YACF,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,+DAA+D;QAC/D,0DAA0D;QAC1D,gEAAgE;QAChE,sDAAsD;QACtD,iEAAiE;QACjE,yBAAyB;QACzB,4EAA4E;QAC5E,qDAAqD;QACrD,EAAE;QACF,+DAA+D;QAC/D,6DAA6D;QAC7D,mEAAmE;QACnE,oEAAoE;QACpE,6DAA6D;QAC7D,oEAAoE;QACpE,oEAAoE;QACpE,kEAAkE;QAClE,qEAAqE;QACrE,mEAAmE;QACnE,uDAAuD;QACvD,MAAM,cAAc,GAClB,OAAO,WAAW,CAAC,cAAc,KAAK,QAAQ,IAAI,WAAW,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC;YACrF,CAAC,CAAC,WAAW,CAAC,cAAc;YAC5B,CAAC,CAAC,IAAI,CAAC;QACX,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;YAC5B,IAAI,CAAC,kEAAkE,CAAC,CAAC;YACzE,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;QACvC,CAAC;QACD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC;QAC3C,IAAI,IAAI,KAAK,GAAG,UAAU,QAAQ,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,UAAU,QAAQ,CAAC,EAAE,CAAC;YAC7E,IAAI,CACF,iEAAiE,UAAU,cAAc,IAAI,GAAG,CACjG,CAAC;YACF,OAAO,OAAO,CAAC,kCAAkC,CAAC,CAAC;QACrD,CAAC;QACD,oEAAoE;QACpE,iEAAiE;QACjE,oEAAoE;QACpE,0DAA0D;QAC1D,IAAI,gBAAgB,GAAG,KAAK,CAAC;QAC7B,IAAI,CAAC;YACH,gBAAgB,GAAG,EAAE,CAAC,QAAQ,CAAC,cAAc,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,KAAK,IAAI,CAAC;QAC/F,CAAC;QAAC,MAAM,CAAC;YACP,gBAAgB,GAAG,KAAK,CAAC;QAC3B,CAAC;QACD,IAAI,CAAC,gBAAgB,EAAE,CAAC;YACtB,IAAI,CACF,2EAA2E,cAAc,GAAG,CAC7F,CAAC;YACF,OAAO,OAAO,CAAC,yBAAyB,CAAC,CAAC;QAC5C,CAAC;IACH,CAAC;IAED,mEAAmE;IACnE,qEAAqE;IACrE,mEAAmE;IACnE,oEAAoE;IACpE,IAAI,IAAI,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;QACpC,IAAI,CAAC,kEAAkE,CAAC,CAAC;QACzE,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,YAAY,GAAG,IAAI,CAAC,YAAY,CAAC;IACvC,IAAI,CAAC,gBAAgB,CAAC,YAAY,CAAC,EAAE,CAAC;QACpC,IAAI,CAAC,wEAAwE,CAAC,CAAC;QAC/E,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;IAED,qEAAqE;IACrE,gEAAgE;IAChE,wCAAwC;IACxC,EAAE;IACF,uEAAuE;IACvE,yEAAyE;IACzE,sEAAsE;IACtE,qEAAqE;IACrE,+CAA+C;IAC/C,EAAE;IACF,+EAA+E;IAC/E,4EAA4E;IAC5E,2EAA2E;IAC3E,2EAA2E;IAC3E,MAAM,OAAO,GAAG,oCAAoC,CAAC,IAAI,CAAC,UAAU,EAAE;QACpE,UAAU,EAAE,wBAAwB;KACrC,CAAC,CAAC;IACH,IAAI,OAAO,CAAC,SAAS,EAAE,CAAC;QACtB,IAAI,CAAC,iDAAiD,OAAO,CAAC,eAAe,EAAE,CAAC,CAAC;QACjF,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC;QAChF,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YAC5B,IAAI,CAAC,2CAA2C,SAAS,CAAC,MAAM,GAAG,CAAC,CAAC;YACrE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACzC,CAAC;QACD,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,CACF,kDAAkD,OAAO,CAAC,OAAO,CAAC,MAAM,mBACtE,OAAO,CAAC,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KACvC,KAAK,KAAK,EAAE,MAAM,IAAI,SAAS,GAAG,CACnC,CAAC;QACF,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,MAAM,MAAM,GAAG,+BAA+B,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IAChF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,IAAI,CAAC,gEAAgE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAC1C,CAAC;IACD,IAAI,MAAM,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;QACxC,IAAI,CACF,qDAAqD,IAAI,CAAC,SAAS,sBACjE,MAAM,CAAC,cAAc,IAAI,WAC3B,eAAe,CAChB,CAAC;QACF,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IACD,yEAAyE;IACzE,uEAAuE;IACvE,qEAAqE;IACrE,8DAA8D;IAC9D,MAAM,IAAI,GAAG,qBAAqB,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;IACpD,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,CAAC;QACb,IAAI,IAAI,CAAC,MAAM,KAAK,WAAW,EAAE,CAAC;YAChC,IAAI,CAAC,2CAA2C,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACzC,CAAC;QACD,IAAI,CAAC,8CAA8C,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC;QACnE,OAAO,OAAO,CAAC,mBAAmB,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC;IACrB,IAAI,MAA+B,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAA4B,CAAC;IACtD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,6DAA8D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QAC7F,OAAO,OAAO,CAAC,oBAAoB,CAAC,CAAC;IACvC,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QAC3E,IAAI,CAAC,oEAAoE,CAAC,CAAC;QAC3E,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,UAAU,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC;IACnD,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,IAAI,CAAC,2CAA2C,UAAU,CAAC,KAAK,KAAK,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC;QAC3F,OAAO,OAAO,CAAC,mBAAmB,UAAU,CAAC,KAAK,EAAE,CAAC,CAAC;IACxD,CAAC;IAED,qEAAqE;IACrE,0EAA0E;IAC1E,yEAAyE;IACzE,2EAA2E;IAC3E,0EAA0E;IAC1E,8EAA8E;IAC9E,MAAM,iBAAiB,GAAG,mBAAmB,CAAC,MAAM,CAAC,CAAC;IACtD,IAAI,iBAAiB,KAAK,IAAI,EAAE,CAAC;QAC/B,IAAI,CAAC,gFAAgF,CAAC,CAAC;QACvF,OAAO,OAAO,CAAC,+BAA+B,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,UAAU,GAAG,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC5C,qEAAqE;IACrE,oEAAoE;IACpE,uEAAuE;IACvE,gEAAgE;IAChE,wEAAwE;IACxE,uEAAuE;IACvE,iEAAiE;IACjE,MAAM,UAAU,GACd,IAAI,CAAC,UAAU,KAAK,SAAS;QAC3B,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC;QAC1C,CAAC,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,IAAI,CAAC,UAAU,CAAC,eAAe,EAAE,CAAC;IAEjG,2EAA2E;IAC3E,qEAAqE;IACrE,6EAA6E;IAC7E,0EAA0E;IAC1E,mDAAmD;IACnD,IAAI,CAAC;QACH,oBAAoB,CAAC,GAAG,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;IACpE,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,2BAA2B,EAAE,CAAC;YAC/C,IAAI,CAAC,2CAA2C,GAAG,CAAC,OAAO,GAAG,CAAC,CAAC;YAChE,OAAO,OAAO,CAAC,sBAAsB,CAAC,CAAC;QACzC,CAAC;QACD,6DAA6D;IAC/D,CAAC;IAED,sEAAsE;IACtE,qEAAqE;IACrE,+DAA+D;IAC/D,sEAAsE;IACtE,sEAAsE;IACtE,2EAA2E;IAC3E,yEAAyE;IACzE,uEAAuE;IACvE,IAAI,CAAC;QACH,qBAAqB,CAAC,MAAM,CAAC,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,IAAI,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC,yDAA0D,GAAa,CAAC,OAAO,GAAG,CAAC,CAAC;QACzF,OAAO,OAAO,CAAC,2BAA2B,CAAC,CAAC;IAC9C,CAAC;IAED,IAAI,UAAkB,CAAC;IACvB,IAAI,CAAC;QACH,UAAU,GAAG,mBAAmB,CAAC,YAAY,EAAE,IAAI,CAAC,SAAS,EAAE;YAC7D,UAAU;YACV,UAAU;YACV,iBAAiB;SAClB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CACF,gEAAiE,GAAa,CAAC,OAAO,kEAAkE,CACzJ,CAAC;QACF,OAAO,OAAO,CAAC,qBAAqB,CAAC,CAAC;IACxC,CAAC;IAED,uEAAuE;IACvE,oCAAoC;IACpC,MAAM,GAAG,GAAG,wBAAwB,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;IACrD,IAAI,MAAM,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC;QAC1B,IAAI,CACF,6BAA6B,GAAG,kBAC9B,MAAM,CAAC,MAAM,IAAI,2BACnB,2BAA2B,CAC5B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC;gBAChC,SAAS,EAAE,IAAI,CAAC,SAAS;gBACzB,OAAO,EAAE,GAAG;gBACZ,MAAM,EAAE,IAAI,CAAC,YAAY;aAC1B,CAAC,CAAC;YACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,IAAI,CACF,6BAA6B,GAAG,kBAAkB,MAAM,CAAC,MAAM,IAAI,eAAe,2BAA2B,CAC9G,CAAC;YACJ,CAAC;QACH,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,CACF,6BAA6B,GAAG,kBAAmB,GAAa,CAAC,OAAO,2BAA2B,CACpG,CAAC;QACJ,CAAC;IACH,CAAC;IAED,wEAAwE;IACxE,6DAA6D;IAC7D,+DAA+D;IAC/D,uEAAuE;IACvE,kEAAkE;IAClE,yDAAyD;IACzD,IAAI,CAAC;QACH,IAAI,mBAAmB,CAAC,YAAY,CAAC,KAAK,IAAI,CAAC,SAAS,EAAE,CAAC;YACzD,oBAAoB,CAAC,YAAY,CAAC,CAAC;QACrC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8CAA8C;IAChD,CAAC;IAED,oEAAoE;IACpE,oDAAoD;IACpD,MAAM,OAAO,GAAG,4BAA4B,CAC1C,YAAY,EACZ,IAAI,CAAC,SAAS,EACd,IAAI,CAAC,UAAU,EACf,MAAM,CACP,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,CAAC;QACrB,IAAI,CACF,gEAAgE,OAAO,CAAC,MAAM,iCAAiC,CAChH,CAAC;QACF,OAAO,OAAO,CAAC,0CAA0C,CAAC,CAAC;IAC7D,CAAC;IACD,IAAI,CAAC,uCAAuC,UAAU,EAAE,CAAC,CAAC;IAC1D,OAAO;QACL,QAAQ,EAAE,IAAI;QACd,MAAM,EAAE,OAAO,CAAC,MAAM;QACtB,UAAU;QACV,UAAU;QACV,UAAU,EAAE,MAAM,CAAC,QAAQ;QAC3B,iBAAiB;KAClB,CAAC;AACJ,CAAC"}

package/dist/cli/pack/hook-codex-post-tool-use.d.ts

@@ -1,25 +0,0 @@
-import type { Manifest } from "../../schema/index.js";
-import { type LoaderOptions } from "../loader.js";
-export interface PackHookCodexPostToolUseOptions extends LoaderOptions {
-    pack?: string;
-    generatedDir?: string;
-    reportsDir?: string;
-    stdin?: NodeJS.ReadableStream;
-    stderr?: NodeJS.WritableStream;
-    manifest?: Manifest;
-    /** Override "now" for deterministic tests. */
-    now?: Date;
-}
-export interface PackHookCodexPostToolUseResult {
-    exitCode: number;
-    /** Did the just-completed tool match a configured expiry boundary? */
-    matchedExpiry: boolean;
-    /** Was the session marker actually cleared (false if already absent). */
-    markerCleared: boolean;
-    /** Was a task-scoped marker also cleared (harness/1ee26e77 parity)? */
-    taskMarkerCleared: boolean;
-    /** Was the persisted report flipped from `approved` to `expired`? */
-    persistedReportExpired: boolean;
-    diagnostic: string;
-}
-export declare function runPackHookCodexPostToolUseCli(opts?: PackHookCodexPostToolUseOptions): Promise<PackHookCodexPostToolUseResult>;