@letrquan/book 0.2.0 → 0.4.0-beta.0

package/dist/chunk-UCFJ43OS.js

@@ -0,0 +1,520 @@
+import {
+  normalizeRemovedSettings
+} from "./chunk-HOZXKOE3.js";
+import {
+  collectDeclaredDirectories,
+  partitionProjectDirectories
+} from "./chunk-4DKHLZRI.js";
+import {
+  partitionProjectAllowRules
+} from "./chunk-MV5PQNIA.js";
+import {
+  createWorkspaceProviderGate,
+  droppedProviderOverrides,
+  emptyWorkspaceProviderPartition,
+  modelSelectionsOf,
+  partitionWorkspaceProviders,
+  profileOfModelKey,
+  providerIdsOf,
+  unaffectedModelSelections,
+  withheldModelSelections,
+  withheldProviderIds,
+  withoutWorkspaceProviderOverrides
+} from "./chunk-B5FC3MYZ.js";
+import {
+  collectDeclaredHooks,
+  partitionProjectHooks
+} from "./chunk-WV3O5PGX.js";
+import {
+  defaultTrustStorePath,
+  loadWorkspaceTrust
+} from "./chunk-HFB74CLM.js";
+import {
+  ADVISOR_OFF_VALUE,
+  DEFAULT_SETTINGS,
+  HOOK_EVENTS,
+  SettingsRepository,
+  bookSettingsSchema,
+  writeFileAtomic
+} from "./chunk-REASC2QG.js";
+import {
+  projectFileWriteRefusal
+} from "./chunk-IDYWN37T.js";
+import {
+  resolveBookHome
+} from "./chunk-ZPSZZUWF.js";
+
+// src/settings-loader.ts
+import { readFileSync, existsSync, realpathSync } from "fs";
+import { join, normalize, resolve } from "path";
+
+// src/env-boolean.ts
+function parseEnvBoolean(raw) {
+  switch (raw?.trim().toLowerCase()) {
+    case "0":
+    case "false":
+    case "off":
+    case "no":
+      return false;
+    case "1":
+    case "true":
+    case "on":
+    case "yes":
+      return true;
+    default:
+      return void 0;
+  }
+}
+
+// src/settings-loader.ts
+var LEGACY_PERMISSIONS_MIGRATION_VERSION = 1;
+var SANDBOX_DENY_LIST_PATHS = [
+  "sandbox.filesystem.denyWrite",
+  "sandbox.filesystem.denyRead",
+  "sandbox.network.deniedDomains"
+];
+var CONCATENATED_ARRAY_PATHS = /* @__PURE__ */ new Set([
+  "permissions.allow",
+  "permissions.ask",
+  "permissions.deny",
+  // Straight from the list the hooks schema is built from: a hand-written copy of
+  // it went stale the moment `Notification` was added, and a later layer's
+  // notification hooks then replaced the user layer's instead of appending (#295).
+  ...HOOK_EVENTS.map((event) => `hooks.${event}`),
+  // A later layer adds to the deny lists rather than replacing them, so a
+  // workspace layer shipping `denyRead: []` cannot erase the user's entries
+  // (#373) — and a later *trusted* layer still can, which is the one way to
+  // narrow a list that turned out to be too broad.
+  ...SANDBOX_DENY_LIST_PATHS
+]);
+var SANDBOX_DENY_LIST_PATH_SET = new Set(SANDBOX_DENY_LIST_PATHS);
+function mergeObject(base, override, accumulateDenyLists, prefix = "") {
+  const result = structuredClone(base);
+  for (const [key, value] of Object.entries(override)) {
+    if (value === void 0 || key === "__proto__") continue;
+    const path = prefix ? `${prefix}.${key}` : key;
+    const existing = result[key];
+    if (Array.isArray(value)) {
+      if (path === "additionalDirectories") {
+        const combined = [...Array.isArray(existing) ? existing : [], ...value].map(
+          (entry) => normalize(String(entry))
+        );
+        result[key] = [...new Set(combined)];
+      } else if (CONCATENATED_ARRAY_PATHS.has(path) && (accumulateDenyLists || !SANDBOX_DENY_LIST_PATH_SET.has(path))) {
+        const combined = [...Array.isArray(existing) ? existing : [], ...value];
+        result[key] = SANDBOX_DENY_LIST_PATH_SET.has(path) ? [...new Set(combined)] : combined;
+      } else {
+        result[key] = structuredClone(value);
+      }
+    } else if (typeof value === "object" && value !== null && typeof existing === "object" && existing !== null && !Array.isArray(existing)) {
+      result[key] = mergeObject(
+        existing,
+        value,
+        accumulateDenyLists,
+        path
+      );
+    } else {
+      result[key] = value;
+    }
+  }
+  return result;
+}
+var WORKSPACE_FORBIDDEN_PATHS = [
+  ["mcp", "projectServers"],
+  ["permissions", "projectAllowRules"],
+  ["hooks", "projectEntries"],
+  ["commands", "projectCommands"],
+  ["", "projectDirectories"],
+  // The decisions about workspace-declared providers (#418), at the root for the same reason.
+  ["", "workspaceProviders"]
+];
+function stripPaths(settings, paths) {
+  for (const [parent, key] of paths) {
+    if (parent === "") {
+      delete settings[key];
+      continue;
+    }
+    const container = settings[parent];
+    if (container && typeof container === "object" && !Array.isArray(container)) {
+      delete container[key];
+    }
+  }
+}
+var WORKSPACE_SANDBOX_ONLY_TIGHTENING = [
+  [["sandbox", "enabled"], true],
+  [["sandbox", "failIfUnavailable"], true],
+  [["sandbox", "allowUnsandboxedCommands"], false],
+  [["sandbox", "autoAllowBashIfSandboxed"], false],
+  [["sandbox", "excludedCommands"], null],
+  [["sandbox", "filesystem", "allowWrite"], null],
+  // `false` (the loader default) is the read-only git dirs; a workspace layer may
+  // tighten to it and may never opt itself back out (#373).
+  [["sandbox", "filesystem", "allowGitWrites"], false],
+  [["sandbox", "network", "allowedDomains"], null]
+];
+function readPath(settings, path) {
+  let value = settings;
+  for (const key of path) {
+    if (typeof value !== "object" || value === null || Array.isArray(value)) return void 0;
+    value = value[key];
+    if (value === void 0) return void 0;
+  }
+  return value;
+}
+function deletePath(settings, path) {
+  const parent = path.slice(0, -1);
+  const key = path[path.length - 1];
+  const container = parent.length === 0 ? settings : readObjectPath(settings, parent);
+  if (container) delete container[key];
+}
+function readObjectPath(settings, path) {
+  const value = readPath(settings, path);
+  return typeof value === "object" && value !== null && !Array.isArray(value) ? value : void 0;
+}
+function ignoredWorkspaceSandboxKeys(settings) {
+  const record = settings;
+  const ignored = [];
+  for (const [path, tighteningValue] of WORKSPACE_SANDBOX_ONLY_TIGHTENING) {
+    const value = readPath(record, path);
+    if (value === void 0) continue;
+    if (tighteningValue !== null && value === tighteningValue) continue;
+    ignored.push({ key: path.join("."), value });
+  }
+  return ignored;
+}
+var IGNORED_VALUE_PREVIEW_CHARS = 200;
+function formatIgnoredWorkspaceSandboxKey(entry) {
+  const json = JSON.stringify(entry.value) ?? String(entry.value);
+  if (json.length <= IGNORED_VALUE_PREVIEW_CHARS) return `${entry.key}=${json}`;
+  return `${entry.key}=${json.slice(0, IGNORED_VALUE_PREVIEW_CHARS)}\u2026 (truncated, ${json.length - IGNORED_VALUE_PREVIEW_CHARS} more characters)`;
+}
+function applyIgnoredWorkspaceSandboxKeys(settings) {
+  const record = settings;
+  for (const entry of ignoredWorkspaceSandboxKeys(settings)) {
+    deletePath(record, entry.key.split("."));
+  }
+}
+function sanitizeLayer(settings, trust) {
+  if (trust === "trusted") return settings;
+  const sanitized = structuredClone(settings);
+  if (sanitized.defaultMode === "bypassPermissions") delete sanitized.defaultMode;
+  delete sanitized.shell;
+  applyIgnoredWorkspaceSandboxKeys(sanitized);
+  stripPaths(sanitized, WORKSPACE_FORBIDDEN_PATHS);
+  return sanitized;
+}
+function mergeLayer(resolved, layer, trust) {
+  const candidate = sanitizeLayer(layer, trust);
+  if (resolved.disableBypassPermissionsMode === true && candidate.disableBypassPermissionsMode === false) {
+    candidate.disableBypassPermissionsMode = true;
+  }
+  if (trust !== "trusted" && sandboxTurnedOnByWorkspaceLayer(resolved, candidate)) {
+    const tightened = {
+      sandbox: { ...candidate.sandbox, autoAllowBashIfSandboxed: false }
+    };
+    candidate.sandbox = tightened.sandbox;
+  }
+  return mergeSettings(resolved, candidate, trust);
+}
+function sandboxTurnedOnByWorkspaceLayer(resolved, candidate) {
+  return candidate.sandbox?.enabled === true && resolved.sandbox?.enabled !== true;
+}
+function workspaceLayerThatEnabledSandbox(layers) {
+  let enabled = DEFAULT_SETTINGS.sandbox.enabled;
+  for (const layer of layers) {
+    if (!layer.document) continue;
+    const candidate = sanitizeLayer(layer.document, layer.trust);
+    if (layer.trust !== "trusted" && candidate.sandbox?.enabled === true && enabled !== true) {
+      return layer.path;
+    }
+    if (candidate.sandbox?.enabled !== void 0) enabled = candidate.sandbox.enabled;
+  }
+  return void 0;
+}
+function mergeSettings(base, override, trust = "trusted") {
+  return mergeObject(
+    base,
+    override,
+    trust !== "trusted"
+  );
+}
+function loadSettingsFile(path) {
+  if (!existsSync(path)) return null;
+  const raw = readFileSync(path, "utf-8");
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch (e) {
+    throw new Error(
+      `Invalid JSON in settings file: ${path}
+${e instanceof Error ? e.message : String(e)}`
+    );
+  }
+  parsed = normalizeRemovedSettings(parsed);
+  const result = bookSettingsSchema.safeParse(parsed);
+  if (!result.success) throw new Error(`Invalid settings in ${path}:
+${result.error.message}`);
+  return parsed;
+}
+function settingsLayerPaths(workspace, overridePath, paths = {}) {
+  const userPath = userSettingsPath(paths);
+  const projectPath = paths.projectSettingsPath ?? join(workspace, ".book", "settings.json");
+  const layers = [
+    userPath,
+    ...sameFile(projectPath, userPath) ? [] : [projectPath],
+    paths.localSettingsPath ?? join(workspace, ".book", "settings.local.json")
+  ];
+  if (overridePath) layers.push(overridePath);
+  return layers;
+}
+function userSettingsPath(paths) {
+  return paths.userSettingsPath ?? (paths.home ? join(paths.home, ".book", "settings.json") : join(resolveBookHome(), "settings.json"));
+}
+function sameFile(left, right) {
+  if (resolve(left) === resolve(right)) return true;
+  try {
+    return realpathSync.native(left) === realpathSync.native(right);
+  } catch {
+    return false;
+  }
+}
+function isUserSettingsFile(path, paths = {}) {
+  return sameFile(path, userSettingsPath(paths));
+}
+function emptyWorkspaceProviderGate() {
+  return createWorkspaceProviderGate({ partition: emptyWorkspaceProviderPartition() });
+}
+function withoutStaleAdvisorOff(local, project) {
+  if (!local || project?.advisorModel !== void 0) return local;
+  if (local.advisorModel?.trim().toLowerCase() !== ADVISOR_OFF_VALUE) return local;
+  const rest = { ...local };
+  delete rest.advisorModel;
+  return rest;
+}
+function resolveSettings(workspace, overridePath, paths = {}) {
+  return resolveSettingsWithProviderGate(workspace, overridePath, paths).settings;
+}
+function resolveSettingsWithProviderGate(workspace, overridePath, paths = {}) {
+  let resolved = structuredClone(DEFAULT_SETTINGS);
+  const userPath = userSettingsPath(paths);
+  const user = loadSettingsFile(userPath);
+  const projectPath = paths.projectSettingsPath ?? join(workspace, ".book", "settings.json");
+  const project = sameFile(projectPath, userPath) ? null : loadSettingsFile(projectPath);
+  const localPath = paths.localSettingsPath ?? join(workspace, ".book", "settings.local.json");
+  const local = withoutStaleAdvisorOff(loadSettingsFile(localPath), project);
+  const override = overridePath ? loadSettingsFile(overridePath) : null;
+  const trustedProviderIds = providerIdsOf([
+    { providers: user?.provider },
+    { providers: override?.provider }
+  ]);
+  const workspaceProviderLayers = [
+    { path: projectPath, providers: project?.provider },
+    { path: localPath, providers: local?.provider }
+  ];
+  const gateProviders = (layer) => layer.provider ? {
+    ...layer,
+    provider: withoutWorkspaceProviderOverrides(
+      layer.provider,
+      trustedProviderIds
+    )
+  } : layer;
+  if (user) resolved = mergeLayer(resolved, user, "trusted");
+  const declaredProjectAllow = project?.permissions?.allow ?? [];
+  const declaredProjectHooks = collectDeclaredHooks(project);
+  const declaredProjectDirectories = project?.additionalDirectories ?? [];
+  const userHookCounts = Object.fromEntries(
+    HOOK_EVENTS.map((event) => [event, resolved.hooks[event].length])
+  );
+  if (project) {
+    let withheld = project;
+    if (declaredProjectAllow.length > 0) {
+      withheld = { ...withheld, permissions: { ...withheld.permissions, allow: [] } };
+    }
+    if (declaredProjectDirectories.length > 0) {
+      withheld = { ...withheld, additionalDirectories: [] };
+    }
+    if (declaredProjectHooks.length > 0) {
+      withheld = { ...withheld, hooks: structuredClone(DEFAULT_SETTINGS.hooks) };
+    }
+    resolved = mergeLayer(resolved, gateProviders(withheld), "repository");
+  }
+  if (local) resolved = mergeLayer(resolved, gateProviders(local), "local");
+  if (override) resolved = mergeLayer(resolved, override, "trusted");
+  const trust = loadWorkspaceTrust(
+    workspace,
+    paths.trustStorePath ?? defaultTrustStorePath(paths.home)
+  );
+  resolved.permissions.projectAllowRules = {
+    ...resolved.permissions.projectAllowRules,
+    ...trust.permissionAllowRules
+  };
+  resolved.mcp.projectServers = { ...resolved.mcp.projectServers, ...trust.mcpServers };
+  resolved.hooks.projectEntries = { ...resolved.hooks.projectEntries, ...trust.hookEntries };
+  resolved.commands.projectCommands = {
+    ...resolved.commands.projectCommands,
+    ...trust.projectCommands
+  };
+  resolved.projectDirectories = {
+    ...resolved.projectDirectories,
+    ...trust.projectDirectories
+  };
+  resolved.workspaceProviders = {
+    ...resolved.workspaceProviders,
+    ...trust.workspaceProviders
+  };
+  const providerPartition = partitionWorkspaceProviders(
+    workspaceProviderLayers,
+    trustedProviderIds,
+    resolved.workspaceProviders
+  );
+  for (const { id, declaration } of providerPartition.approved) {
+    resolved.provider[id] = declaration;
+  }
+  const withheldProviders = new Set(withheldProviderIds(providerPartition));
+  const selectionLayers = [
+    { path: userPath, trusted: true, selections: modelSelectionsOf(user ?? {}) },
+    { path: projectPath, trusted: false, selections: modelSelectionsOf(project ?? {}) },
+    { path: localPath, trusted: false, selections: modelSelectionsOf(local ?? {}) },
+    { path: overridePath ?? "", trusted: true, selections: modelSelectionsOf(override ?? {}) }
+  ];
+  const withheldSelections = withheldModelSelections(selectionLayers, withheldProviders);
+  for (const { key, fallback } of withheldSelections) {
+    const profile = profileOfModelKey(key);
+    if (profile === void 0) {
+      const topLevel = key;
+      if (fallback === void 0) delete resolved[topLevel];
+      else resolved[topLevel] = fallback;
+      continue;
+    }
+    const entry = resolved.agents.profiles[profile];
+    if (!entry) continue;
+    if (fallback === void 0) delete entry.model;
+    else entry.model = fallback;
+    if (Object.keys(entry).length === 0) delete resolved.agents.profiles[profile];
+  }
+  if (declaredProjectAllow.length > 0) {
+    const { approved } = partitionProjectAllowRules(
+      declaredProjectAllow,
+      resolved.permissions?.projectAllowRules
+    );
+    if (approved.length > 0) {
+      resolved.permissions.allow = [...resolved.permissions.allow ?? [], ...approved];
+    }
+  }
+  if (declaredProjectDirectories.length > 0) {
+    const { approved } = partitionProjectDirectories(
+      collectDeclaredDirectories(workspace, declaredProjectDirectories),
+      resolved.projectDirectories
+    );
+    if (approved.length > 0) {
+      resolved.additionalDirectories = [
+        ...resolved.additionalDirectories ?? [],
+        ...approved.map((directory) => directory.realPath)
+      ];
+    }
+  }
+  if (declaredProjectHooks.length > 0) {
+    const { approved } = partitionProjectHooks(
+      declaredProjectHooks,
+      resolved.hooks?.projectEntries
+    );
+    const approvedByEvent = /* @__PURE__ */ new Map();
+    for (const { event, entry } of approved) {
+      const entries = approvedByEvent.get(event) ?? [];
+      entries.push(entry);
+      approvedByEvent.set(event, entries);
+    }
+    for (const [event, entries] of approvedByEvent) {
+      resolved.hooks[event].splice(userHookCounts[event], 0, ...entries);
+    }
+  }
+  const settings = bookSettingsSchema.parse(resolved);
+  const providerGate = createWorkspaceProviderGate({
+    partition: providerPartition,
+    droppedOverrides: droppedProviderOverrides(workspaceProviderLayers, trustedProviderIds),
+    withheldSelections,
+    unaffectedSelections: unaffectedModelSelections(selectionLayers, withheldProviders)
+  });
+  return { settings, providerGate };
+}
+function applySettingsEnvOverrides(settings, env = process.env) {
+  const startupAnimation = parseEnvBoolean(env.BOOK_STARTUP_ANIMATION);
+  if (startupAnimation === void 0) return settings;
+  return { ...settings, ui: { ...settings.ui, startupAnimation } };
+}
+function startupAnimationEnvNote(env = process.env) {
+  const raw = env.BOOK_STARTUP_ANIMATION;
+  if (parseEnvBoolean(raw) === void 0) return void 0;
+  return `BOOK_STARTUP_ANIMATION is set to "${raw}" \u2014 it decides the splash at every launch, so ui.startupAnimation will not apply while it is set.`;
+}
+function migrateLegacyPermissions(workspace, home, validatedSettings) {
+  if (!validatedSettings) {
+    resolveSettings(workspace, void 0, home ? { home } : void 0);
+  }
+  const legacyPath = join(home ? join(home, ".book") : resolveBookHome(), "permissions.json");
+  if (!existsSync(legacyPath)) return false;
+  const markerPath = join(workspace, ".book", "migrations.json");
+  const localPath = join(workspace, ".book", "settings.local.json");
+  for (const path of [markerPath, localPath]) {
+    const refusal = projectFileWriteRefusal(path);
+    if (refusal) {
+      console.warn(`\u26A0  Permission rules not migrated: ${path}: ${refusal}.`);
+      return false;
+    }
+  }
+  try {
+    const marker = JSON.parse(readFileSync(markerPath, "utf-8"));
+    if ((marker.legacyPermissions ?? 0) >= LEGACY_PERMISSIONS_MIGRATION_VERSION) return false;
+  } catch {
+  }
+  let legacyRules = [];
+  try {
+    const raw = readFileSync(legacyPath, "utf-8");
+    const parsed = JSON.parse(raw);
+    legacyRules = parsed.rules ?? [];
+  } catch {
+    return false;
+  }
+  if (legacyRules.length === 0) return false;
+  const result = new SettingsRepository(localPath).update((existing) => {
+    const permissions = existing.permissions ?? {};
+    for (const key of ["allow", "ask", "deny"]) {
+      if (!Array.isArray(permissions[key])) permissions[key] = [];
+    }
+    for (const rule of legacyRules) {
+      const specifier = rule.pattern ? `${rule.toolName}(${rule.pattern})` : rule.toolName;
+      const effect = rule.effect;
+      if (!permissions[effect].includes(specifier)) permissions[effect].push(specifier);
+    }
+    existing.permissions = permissions;
+  });
+  if (!result.ok) return false;
+  writeFileAtomic(
+    markerPath,
+    `${JSON.stringify({ legacyPermissions: LEGACY_PERMISSIONS_MIGRATION_VERSION }, null, 2)}
+`
+  );
+  if (!result.changed) return false;
+  console.warn(
+    `\u26A0  Migrated ${legacyRules.length} permission rule(s) from ~/.book/permissions.json to ${localPath}. Delete the legacy file after verifying the migration.`
+  );
+  return true;
+}
+
+export {
+  parseEnvBoolean,
+  ignoredWorkspaceSandboxKeys,
+  formatIgnoredWorkspaceSandboxKey,
+  workspaceLayerThatEnabledSandbox,
+  mergeSettings,
+  loadSettingsFile,
+  settingsLayerPaths,
+  isUserSettingsFile,
+  emptyWorkspaceProviderGate,
+  resolveSettings,
+  resolveSettingsWithProviderGate,
+  applySettingsEnvOverrides,
+  startupAnimationEnvNote,
+  migrateLegacyPermissions
+};
+//# sourceMappingURL=chunk-UCFJ43OS.js.map

package/dist/chunk-UCFJ43OS.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/settings-loader.ts","../src/env-boolean.ts"],"sourcesContent":["import { readFileSync, existsSync, realpathSync } from 'fs';\nimport { join, normalize, resolve } from 'path';\nimport {\n  ADVISOR_OFF_VALUE,\n  bookSettingsSchema,\n  DEFAULT_SETTINGS,\n  HOOK_EVENTS,\n  type BookSettings,\n  type HookEntry,\n  type HookEvent,\n  type ResolvedSettings,\n} from './settings.js';\nimport { SettingsRepository, writeFileAtomic } from './settings-repository.js';\nimport { projectFileWriteRefusal } from './workspace-files.js';\nimport { resolveBookHome } from './book-home.js';\nimport { collectDeclaredDirectories, partitionProjectDirectories } from './additional-roots.js';\nimport { partitionProjectAllowRules } from './permission-approvals.js';\nimport { collectDeclaredHooks, partitionProjectHooks } from './hook-approvals.js';\nimport {\n  createWorkspaceProviderGate,\n  droppedProviderOverrides,\n  emptyWorkspaceProviderPartition,\n  modelSelectionsOf,\n  partitionWorkspaceProviders,\n  profileOfModelKey,\n  providerIdsOf,\n  unaffectedModelSelections,\n  withheldModelSelections,\n  withheldProviderIds,\n  withoutWorkspaceProviderOverrides,\n  type ModelSelectionLayer,\n  type ProviderLayer,\n  type WorkspaceProviderGate,\n} from './provider-approvals.js';\nimport { defaultTrustStorePath, loadWorkspaceTrust } from './workspace-trust.js';\nimport { normalizeRemovedSettings } from './settings-removed.js';\nimport { parseEnvBoolean } from './env-boolean.js';\n\nconst LEGACY_PERMISSIONS_MIGRATION_VERSION = 1;\n\n/**\n * The sandbox deny lists: paths a command may not write and paths it may not\n * read, plus the domains it may not reach.\n *\n * One list for all three, because they are one rule applied to three keys — and\n * because the rule is no longer \"these keys concatenate\" but \"these keys\n * concatenate *for a workspace layer*\", which both the concatenating set and the\n * deduping one are derived from. A second hand-written copy is how\n * `Notification` went missing from the hooks list in the first place (#295).\n */\nconst SANDBOX_DENY_LIST_PATHS = [\n  'sandbox.filesystem.denyWrite',\n  'sandbox.filesystem.denyRead',\n  'sandbox.network.deniedDomains',\n] as const;\n\n/**\n * Deep-merge two settings objects. For arrays, concatenate (used for\n * permission rules and additionalDirectories). For objects, merge recursively.\n * For scalars, the override wins.\n */\nconst CONCATENATED_ARRAY_PATHS = new Set<string>([\n  'permissions.allow',\n  'permissions.ask',\n  'permissions.deny',\n  // Straight from the list the hooks schema is built from: a hand-written copy of\n  // it went stale the moment `Notification` was added, and a later layer's\n  // notification hooks then replaced the user layer's instead of appending (#295).\n  ...HOOK_EVENTS.map((event) => `hooks.${event}`),\n  // A later layer adds to the deny lists rather than replacing them, so a\n  // workspace layer shipping `denyRead: []` cannot erase the user's entries\n  // (#373) — and a later *trusted* layer still can, which is the one way to\n  // narrow a list that turned out to be too broad.\n  ...SANDBOX_DENY_LIST_PATHS,\n]);\n\n/**\n * The same three paths as a set, for the two questions a merge asks about one of\n * them: whether the layer's entries add to or replace the earlier ones, and\n * whether repeating a path across layers stores it once.\n */\nconst SANDBOX_DENY_LIST_PATH_SET: ReadonlySet<string> = new Set(SANDBOX_DENY_LIST_PATHS);\n\nfunction mergeObject(\n  base: Record<string, unknown>,\n  override: Record<string, unknown>,\n  /** Whether a deny list from this layer adds to the earlier one or replaces it. */\n  accumulateDenyLists: boolean,\n  prefix = '',\n): Record<string, unknown> {\n  const result = structuredClone(base);\n\n  for (const [key, value] of Object.entries(override)) {\n    // JSON.parse keeps `\"__proto__\"` as an ordinary own key, but `result[key] = …`\n    // below would go through the prototype setter: a repository layer could then\n    // supply inherited `shell` or `defaultMode` values that sanitizeLayer, which\n    // deletes own keys, never sees. No setting has that name, so drop it.\n    if (value === undefined || key === '__proto__') continue;\n    const path = prefix ? `${prefix}.${key}` : key;\n    const existing = result[key];\n\n    if (Array.isArray(value)) {\n      if (path === 'additionalDirectories') {\n        const combined = [...(Array.isArray(existing) ? existing : []), ...value].map((entry) =>\n          normalize(String(entry)),\n        );\n        result[key] = [...new Set(combined)];\n      } else if (\n        CONCATENATED_ARRAY_PATHS.has(path) &&\n        (accumulateDenyLists || !SANDBOX_DENY_LIST_PATH_SET.has(path))\n      ) {\n        const combined = [...(Array.isArray(existing) ? existing : []), ...value];\n        result[key] = SANDBOX_DENY_LIST_PATH_SET.has(path) ? [...new Set(combined)] : combined;\n      } else {\n        result[key] = structuredClone(value);\n      }\n    } else if (\n      typeof value === 'object' &&\n      value !== null &&\n      typeof existing === 'object' &&\n      existing !== null &&\n      !Array.isArray(existing)\n    ) {\n      result[key] = mergeObject(\n        existing as Record<string, unknown>,\n        value as Record<string, unknown>,\n        accumulateDenyLists,\n        path,\n      );\n    } else {\n      result[key] = value;\n    }\n  }\n\n  return result;\n}\n\n/**\n * How much authority a settings layer carries.\n *\n * - `trusted` — the user's own global file, or a path they passed on the CLI.\n * - `local` — `<workspace>/.book/settings.local.json`: gitignored and normally\n *   written by the user, or by Book on their behalf.\n * - `repository` — `<workspace>/.book/settings.json`: checked in and controlled\n *   by whoever wrote the repository. It may never grant itself trust.\n */\nexport type SettingsLayerTrust = 'trusted' | 'local' | 'repository';\n\n/**\n * Settings paths that a workspace file may not supply for itself. Most record\n * a decision the user made *about* repository-controlled input; honouring one\n * from the workspace would let a clone approve itself. Experimental capability\n * flags are included because merely opening a clone must not opt the user into\n * unstable runtime behavior.\n *\n * The local layer is no safer than the checked-in one here. `.gitignore` does\n * not stop a *tracked* file from reaching a clone, so a repository that\n * force-adds `.book/settings.local.json` ships its own approvals with it. Both\n * workspace layers are therefore stripped. Trust decisions come from the\n * user-global store; experimental flags come from a trusted user-global or\n * explicit settings document (or from a process environment opt-in).\n *\n * An empty `parent` names a key at the document root, which is how the\n * `additionalDirectories` decisions map is expressed: the setting it decides\n * about is itself top-level, so there is no container object to put it in.\n */\nconst WORKSPACE_FORBIDDEN_PATHS: ReadonlyArray<readonly [string, string]> = [\n  ['mcp', 'projectServers'],\n  ['permissions', 'projectAllowRules'],\n  ['hooks', 'projectEntries'],\n  ['commands', 'projectCommands'],\n  ['', 'projectDirectories'],\n  // The decisions about workspace-declared providers (#418), at the root for the same reason.\n  ['', 'workspaceProviders'],\n];\n\nfunction stripPaths(\n  settings: Partial<BookSettings>,\n  paths: ReadonlyArray<readonly [string, string]>,\n): void {\n  for (const [parent, key] of paths) {\n    if (parent === '') {\n      delete (settings as Record<string, unknown>)[key];\n      continue;\n    }\n    const container = (settings as Record<string, unknown>)[parent];\n    if (container && typeof container === 'object' && !Array.isArray(container)) {\n      delete (container as Record<string, unknown>)[key];\n    }\n  }\n}\n\n/** One `sandbox.*` key a workspace layer supplied that the loader will not honour. */\nexport interface IgnoredWorkspaceSandboxKey {\n  /** Dotted path of the key, e.g. `sandbox.filesystem.allowWrite`. */\n  key: string;\n  /** The value the layer wrote, so a report can quote what the file actually said. */\n  value: unknown;\n}\n\n/**\n * `sandbox.*` keys a workspace layer supplies that only loosen, and therefore\n * never survive to the merge. The second element is the one value the layer may\n * set — the tightening direction — or `null` when any value is dropped.\n *\n * The sandbox is the boundary between a command and the host, so a file inside\n * the workspace must not be able to widen it: a checked-in `settings.json`\n * could switch off the sandbox the user enabled, exclude every command\n * (`excludedCommands: [\"*\"]`), or open a writable root (`allowWrite: [\"/\"]`)\n * — and because those arrays *replaced* the earlier layer's, even the user's own\n * `denyRead` list could be emptied. Turning the sandbox on, adding deny entries\n * and refusing unsandboxed commands stay available to a workspace layer; they\n * only ever narrow it (#373).\n */\nconst WORKSPACE_SANDBOX_ONLY_TIGHTENING: ReadonlyArray<readonly [readonly string[], unknown]> = [\n  [['sandbox', 'enabled'], true],\n  [['sandbox', 'failIfUnavailable'], true],\n  [['sandbox', 'allowUnsandboxedCommands'], false],\n  [['sandbox', 'autoAllowBashIfSandboxed'], false],\n  [['sandbox', 'excludedCommands'], null],\n  [['sandbox', 'filesystem', 'allowWrite'], null],\n  // `false` (the loader default) is the read-only git dirs; a workspace layer may\n  // tighten to it and may never opt itself back out (#373).\n  [['sandbox', 'filesystem', 'allowGitWrites'], false],\n  [['sandbox', 'network', 'allowedDomains'], null],\n];\n\n/**\n * The value at a path in a settings document, or `undefined` when a step is\n * missing or is not a plain object.\n *\n * One walker rather than two near-copies: `readContainer` used to be this with an\n * extra condition at the end, and a loop that differs only in its last line is\n * how two helpers drift apart and a delete lands on the wrong object.\n */\nfunction readPath(settings: Record<string, unknown>, path: readonly string[]): unknown {\n  let value: unknown = settings;\n  for (const key of path) {\n    if (typeof value !== 'object' || value === null || Array.isArray(value)) return undefined;\n    value = (value as Record<string, unknown>)[key];\n    if (value === undefined) return undefined;\n  }\n  return value;\n}\n\nfunction deletePath(settings: Record<string, unknown>, path: readonly string[]): void {\n  const parent = path.slice(0, -1);\n  const key = path[path.length - 1];\n  const container = parent.length === 0 ? settings : readObjectPath(settings, parent);\n  if (container) delete container[key];\n}\n\n/** `readPath` for a path that has to end at an object, which `deletePath` needs. */\nfunction readObjectPath(\n  settings: Record<string, unknown>,\n  path: readonly string[],\n): Record<string, unknown> | undefined {\n  const value = readPath(settings, path);\n  return typeof value === 'object' && value !== null && !Array.isArray(value)\n    ? (value as Record<string, unknown>)\n    : undefined;\n}\n\n/**\n * A workspace layer as the file wrote it: parsed, but not required to be\n * complete. The sandbox rule is about what a document *says*, so the reader\n * takes a partial view — a layer that omits `excludedCommands` entirely is\n * describing itself, not supplying an empty list. Every key is optional here,\n * including the nested ones, which is the whole point of the type.\n */\nexport interface WorkspaceLayerSandboxView {\n  sandbox?: Omit<Partial<BookSettings['sandbox']>, 'filesystem' | 'network'> & {\n    filesystem?: Partial<BookSettings['sandbox']['filesystem']>;\n    network?: Partial<BookSettings['sandbox']['network']>;\n  };\n}\n\n/**\n * The `sandbox.*` keys `settings` declares that a workspace layer may not\n * supply, with the values it wrote. Pure: `sanitizeLayer` deletes exactly the\n * keys this reports, and `book doctor` prints the same list, so the enforced\n * rule and the reported one cannot drift apart.\n */\nexport function ignoredWorkspaceSandboxKeys(\n  settings: WorkspaceLayerSandboxView,\n): IgnoredWorkspaceSandboxKey[] {\n  const record = settings as Record<string, unknown>;\n  const ignored: IgnoredWorkspaceSandboxKey[] = [];\n  for (const [path, tighteningValue] of WORKSPACE_SANDBOX_ONLY_TIGHTENING) {\n    const value = readPath(record, path);\n    if (value === undefined) continue;\n    if (tighteningValue !== null && value === tighteningValue) continue;\n    ignored.push({ key: path.join('.'), value });\n  }\n  return ignored;\n}\n\n/**\n * How much of an ignored value a report prints.\n *\n * `excludedCommands` and `allowWrite` are globs and directory lists, so a\n * repository can put as much text in one as it likes, and every host that\n * reports an ignored key would then print a screenful of it — pushing the part\n * of the diagnostic that says where the value belongs off the screen. The head\n * is kept because it identifies the value; the length is what follows it.\n */\nconst IGNORED_VALUE_PREVIEW_CHARS = 200;\n\n/** One ignored key as a report line reads it: `sandbox.enabled=false`. */\nexport function formatIgnoredWorkspaceSandboxKey(entry: IgnoredWorkspaceSandboxKey): string {\n  const json = JSON.stringify(entry.value) ?? String(entry.value);\n  if (json.length <= IGNORED_VALUE_PREVIEW_CHARS) return `${entry.key}=${json}`;\n  return `${entry.key}=${json.slice(0, IGNORED_VALUE_PREVIEW_CHARS)}… (truncated, ${\n    json.length - IGNORED_VALUE_PREVIEW_CHARS\n  } more characters)`;\n}\n\n/**\n * Drop every loosening `sandbox.*` key from a workspace layer. Deleting rather\n * than overwriting is what makes the key harmless: the merge keeps whatever the\n * earlier, more trusted layer said.\n */\nfunction applyIgnoredWorkspaceSandboxKeys(settings: Partial<BookSettings>): void {\n  const record = settings as Record<string, unknown>;\n  for (const entry of ignoredWorkspaceSandboxKeys(settings)) {\n    deletePath(record, entry.key.split('.'));\n  }\n}\n\nfunction sanitizeLayer(\n  settings: Partial<BookSettings>,\n  trust: SettingsLayerTrust,\n): Partial<BookSettings> {\n  if (trust === 'trusted') return settings;\n  const sanitized = structuredClone(settings);\n  // Project/local settings cannot opt a session into the most permissive mode.\n  if (sanitized.defaultMode === 'bypassPermissions') delete sanitized.defaultMode;\n  // `shell` names the program every Bash command is handed to. A clone that\n  // could point it at a binary it ships would run that binary on the first\n  // command, so the key is honoured from trusted layers only.\n  delete sanitized.shell;\n  // Nor may a workspace file widen the sandbox it is supposed to be confined by.\n  applyIgnoredWorkspaceSandboxKeys(sanitized);\n  stripPaths(sanitized, WORKSPACE_FORBIDDEN_PATHS);\n  return sanitized;\n}\n\n/**\n * Merge one layer over the resolved settings.\n *\n * The layer's trust decides two things that are not visible in the layer itself:\n * whether a deny list adds to or replaces the earlier one, and whether turning\n * the sandbox on costs the session its auto-allow. Both are stated here, next to\n * the sanitizing that already reads `trust`, rather than left to each caller.\n */\nfunction mergeLayer(\n  resolved: ResolvedSettings,\n  layer: Partial<BookSettings>,\n  trust: SettingsLayerTrust,\n): ResolvedSettings {\n  const candidate = sanitizeLayer(layer, trust);\n  // A trusted global safety ceiling cannot be disabled by a lower-trust layer.\n  if (\n    resolved.disableBypassPermissionsMode === true &&\n    candidate.disableBypassPermissionsMode === false\n  ) {\n    candidate.disableBypassPermissionsMode = true;\n  }\n  if (trust !== 'trusted' && sandboxTurnedOnByWorkspaceLayer(resolved, candidate)) {\n    // Written through the partial view the sanitizer uses: `BookSettings`\n    // declares every sandbox key as present, and this layer supplies one.\n    const tightened: WorkspaceLayerSandboxView = {\n      sandbox: { ...candidate.sandbox, autoAllowBashIfSandboxed: false },\n    };\n    (candidate as WorkspaceLayerSandboxView).sandbox = tightened.sandbox;\n  }\n  return mergeSettings(resolved, candidate, trust);\n}\n\n/**\n * Whether this workspace layer is what turns the sandbox on.\n *\n * `enabled: true` is the one `sandbox` key a workspace layer may set, because it\n * only ever applies to sessions that had it off. On its own it narrows nothing a\n * user chose; with `autoAllowBashIfSandboxed` it stops the session from asking\n * before each command, so a checked-in `settings.json` would turn a workspace\n * where the user reads every command into one where nobody is asked at all.\n * Setting it here makes the pair equivalent to the auto-allow alone, which the\n * loader already drops.\n */\nfunction sandboxTurnedOnByWorkspaceLayer(\n  resolved: ResolvedSettings,\n  candidate: Partial<BookSettings>,\n): boolean {\n  return candidate.sandbox?.enabled === true && resolved.sandbox?.enabled !== true;\n}\n\n/** One layer as a caller of {@link workspaceLayerThatEnabledSandbox} has it. */\nexport interface SettingsLayerForSandboxActivation {\n  path: string;\n  trust: SettingsLayerTrust;\n  /** Null when the file is absent, which is not a layer that declared anything. */\n  document: Partial<BookSettings> | null;\n}\n\n/**\n * The workspace layer that flipped `sandbox.enabled` from not-true to true, or\n * undefined when none did: the file whose `enabled: true` cost the session its\n * `autoAllowBashIfSandboxed`.\n *\n * Two hosts have to say so — `book doctor`, which lists what each layer changed,\n * and the print/SDK notices, which have no other channel — and both were asking\n * the raw layers \"does this one say `enabled: true`\". That is a different\n * question: once a trusted layer has enabled the sandbox, a repository repeating\n * the key changes nothing and was still reported, every session, as a decision it\n * did not make.\n *\n * The layers go in resolution order *including* the trusted ones, because the\n * trusted baseline is exactly what decides whether a workspace layer is the\n * flipper. The walk is this function's own and reads only `sandbox.enabled`, and\n * it asks the same question through the same {@link sanitizeLayer} the merge\n * applies, so it cannot disagree with\n * {@link sandboxTurnedOnByWorkspaceLayer} about which layer that is.\n */\nexport function workspaceLayerThatEnabledSandbox(\n  layers: readonly SettingsLayerForSandboxActivation[],\n): string | undefined {\n  let enabled = DEFAULT_SETTINGS.sandbox.enabled;\n  for (const layer of layers) {\n    if (!layer.document) continue;\n    const candidate = sanitizeLayer(layer.document, layer.trust);\n    if (layer.trust !== 'trusted' && candidate.sandbox?.enabled === true && enabled !== true) {\n      return layer.path;\n    }\n    if (candidate.sandbox?.enabled !== undefined) enabled = candidate.sandbox.enabled;\n  }\n  return undefined;\n}\n\n/**\n * Merge a settings layer over resolved settings.\n *\n * @param trust - what the layer is (`trusted` by default: the user-global file\n *   or a `--settings` path). Only a workspace layer accumulates the sandbox deny\n *   lists; every other array behaviour is the same for all layers.\n */\nexport function mergeSettings(\n  base: ResolvedSettings,\n  override: Partial<BookSettings>,\n  trust: SettingsLayerTrust = 'trusted',\n): ResolvedSettings {\n  return mergeObject(\n    base as unknown as Record<string, unknown>,\n    override as Record<string, unknown>,\n    trust !== 'trusted',\n  ) as unknown as ResolvedSettings;\n}\n\n/**\n * Load and validate a single settings.json file. Returns null if the file\n * doesn't exist. Throws on parse/validation errors.\n */\nfunction loadSettingsFile(path: string): BookSettings | null {\n  if (!existsSync(path)) return null;\n  const raw = readFileSync(path, 'utf-8');\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch (e) {\n    throw new Error(\n      `Invalid JSON in settings file: ${path}\\n${e instanceof Error ? e.message : String(e)}`,\n    );\n  }\n  // A setting that was removed must not brick a working install: an obsolete\n  // value of a surviving key would otherwise fail the whole document and stop\n  // Book from starting, with a schema dump that names no remedy. Removed keys\n  // are reported by `book doctor`, which reads the file itself.\n  parsed = normalizeRemovedSettings(parsed);\n  const result = bookSettingsSchema.safeParse(parsed);\n  if (!result.success) throw new Error(`Invalid settings in ${path}:\\n${result.error.message}`);\n  // Resolution owns defaults. Returning the source document preserves the distinction\n  // between an omitted field and a field explicitly set to an empty collection.\n  return parsed as BookSettings;\n}\n\n/**\n * Resolve settings from all scopes: user → project → local.\n * Priority: Local > Project > User.\n *\n * @param workspace - Project root directory\n * @param overridePath - Optional path to an ad-hoc settings file (--settings flag)\n * @returns Fully resolved settings with all defaults filled\n */\nexport interface SettingsResolutionPaths {\n  home?: string;\n  userSettingsPath?: string;\n  projectSettingsPath?: string;\n  localSettingsPath?: string;\n  trustStorePath?: string;\n}\n\n/**\n * Every settings file this resolution would read, in layer order.\n *\n * Exported so callers that need to inspect the files themselves — `book doctor`\n * reporting removed keys, the credential error checking for a stale `auth`\n * block — resolve the same paths the loader does rather than rebuilding them.\n */\nexport function settingsLayerPaths(\n  workspace: string,\n  overridePath?: string,\n  paths: SettingsResolutionPaths = {},\n): string[] {\n  const userPath = userSettingsPath(paths);\n  const projectPath = paths.projectSettingsPath ?? join(workspace, '.book', 'settings.json');\n  const layers = [\n    userPath,\n    ...(sameFile(projectPath, userPath) ? [] : [projectPath]),\n    paths.localSettingsPath ?? join(workspace, '.book', 'settings.local.json'),\n  ];\n  if (overridePath) layers.push(overridePath);\n  return layers;\n}\n\nfunction userSettingsPath(paths: SettingsResolutionPaths): string {\n  return (\n    paths.userSettingsPath ??\n    (paths.home\n      ? join(paths.home, '.book', 'settings.json')\n      : join(resolveBookHome(), 'settings.json'))\n  );\n}\n\n/**\n * Whether two paths name one file. The lexical check covers a file that does not\n * exist yet; a link to the file, or a workspace reached through a linked home\n * directory, needs the real paths.\n */\nfunction sameFile(left: string, right: string): boolean {\n  if (resolve(left) === resolve(right)) return true;\n  try {\n    return realpathSync.native(left) === realpathSync.native(right);\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Whether `path` is the user settings file.\n *\n * A workspace at `$HOME` (with `BOOK_HOME` unset) has `~/.book/settings.json` as\n * its project settings file too. Read a second time as the repository layer, the\n * user's own file would add every accumulating rule twice, and its hooks, allow\n * rules and directories would be withheld as if a repository had declared them,\n * then registered twice once approved (#429). Every reader of the project layer\n * skips a file this returns true for.\n */\nexport function isUserSettingsFile(path: string, paths: SettingsResolutionPaths = {}): boolean {\n  return sameFile(path, userSettingsPath(paths));\n}\n\nexport type { WorkspaceProviderGate };\n\nexport function emptyWorkspaceProviderGate(): WorkspaceProviderGate {\n  return createWorkspaceProviderGate({ partition: emptyWorkspaceProviderPartition() });\n}\n\n/**\n * The advisor `off` a local layer wrote, which outranks a lower layer's advisor, is honoured only\n * while a checked-in workspace layer still declares one (`/advisor off` writes it for exactly\n * that case). Once the repository stops declaring an advisor, the `off` is stale and would keep\n * outranking the user's own, so the layer is read without it.\n */\nfunction withoutStaleAdvisorOff(\n  local: BookSettings | null,\n  project: BookSettings | null,\n): BookSettings | null {\n  if (!local || project?.advisorModel !== undefined) return local;\n  if (local.advisorModel?.trim().toLowerCase() !== ADVISOR_OFF_VALUE) return local;\n  const rest = { ...local };\n  delete rest.advisorModel;\n  return rest;\n}\n\nexport function resolveSettings(\n  workspace: string,\n  overridePath?: string,\n  paths: SettingsResolutionPaths = {},\n): ResolvedSettings {\n  return resolveSettingsWithProviderGate(workspace, overridePath, paths).settings;\n}\n\n/** {@link resolveSettings}, plus what the provider gate withheld and dropped on the way. */\nexport function resolveSettingsWithProviderGate(\n  workspace: string,\n  overridePath?: string,\n  paths: SettingsResolutionPaths = {},\n): { settings: ResolvedSettings; providerGate: WorkspaceProviderGate } {\n  let resolved = structuredClone(DEFAULT_SETTINGS);\n\n  // Every layer is read before any is merged: whether a workspace layer may speak for a provider\n  // depends on which ids the *trusted* layers define, and the `--settings` layer merges last.\n  // The read order is unchanged (user, project, local, `--settings`) and nothing merged between\n  // two reads can throw, so the first broken file still names the error, as before.\n  const userPath = userSettingsPath(paths);\n  const user = loadSettingsFile(userPath);\n  const projectPath = paths.projectSettingsPath ?? join(workspace, '.book', 'settings.json');\n  // Skipped when it is the user file itself, as it is for a workspace at `$HOME` (#429).\n  const project = sameFile(projectPath, userPath) ? null : loadSettingsFile(projectPath);\n  const localPath = paths.localSettingsPath ?? join(workspace, '.book', 'settings.local.json');\n  const local = withoutStaleAdvisorOff(loadSettingsFile(localPath), project);\n  const override = overridePath ? loadSettingsFile(overridePath) : null;\n\n  const trustedProviderIds = providerIdsOf([\n    { providers: user?.provider },\n    { providers: override?.provider },\n  ]);\n  const workspaceProviderLayers: ProviderLayer[] = [\n    { path: projectPath, providers: project?.provider },\n    { path: localPath, providers: local?.provider },\n  ];\n  // A workspace layer reaches `provider` only for ids a trusted layer defines, and only with\n  // `models` and `type`. The rest is held back for the partition below.\n  const gateProviders = (layer: BookSettings): BookSettings =>\n    layer.provider\n      ? {\n          ...layer,\n          provider: withoutWorkspaceProviderOverrides(\n            layer.provider,\n            trustedProviderIds,\n          ) as BookSettings['provider'],\n        }\n      : layer;\n\n  // Layer 1: User settings (~/.book/settings.json)\n  if (user) resolved = mergeLayer(resolved, user, 'trusted');\n\n  // Layer 2: Project settings (<workspace>/.book/settings.json).\n  // `allow` rules from the repository layer are held back rather than merged:\n  // they only widen authority, and the decisions that release them live in the\n  // local layer, which has not been merged yet.\n  const declaredProjectAllow = project?.permissions?.allow ?? [];\n  // Project-declared hook entries are held back the same way: each one is a\n  // shell command the repository would otherwise get Book to run.\n  const declaredProjectHooks = collectDeclaredHooks(project);\n  // `additionalDirectories` widens the roots the file tools serve, so a checked-in\n  // declaration is held back for the same reason a project allow rule is: it\n  // grants authority, and the decisions that release it live in the local layer,\n  // which has not been merged yet. Released after the trust store loads, by real path.\n  const declaredProjectDirectories = project?.additionalDirectories ?? [];\n  // Released declarations belong between the user and local layers, matching the\n  // relative merge order ungated layers still produce.\n  const userHookCounts = Object.fromEntries(\n    HOOK_EVENTS.map((event) => [event, resolved.hooks[event].length]),\n  ) as Record<HookEvent, number>;\n  if (project) {\n    let withheld: BookSettings = project;\n    if (declaredProjectAllow.length > 0) {\n      withheld = { ...withheld, permissions: { ...withheld.permissions, allow: [] } };\n    }\n    if (declaredProjectDirectories.length > 0) {\n      withheld = { ...withheld, additionalDirectories: [] };\n    }\n    if (declaredProjectHooks.length > 0) {\n      withheld = { ...withheld, hooks: structuredClone(DEFAULT_SETTINGS.hooks) };\n    }\n    resolved = mergeLayer(resolved, gateProviders(withheld), 'repository');\n  }\n\n  // Layer 3: Local settings (<workspace>/.book/settings.local.json)\n  if (local) resolved = mergeLayer(resolved, gateProviders(local), 'local');\n\n  // Layer 4 (optional): Ad-hoc override (--settings flag)\n  if (override) resolved = mergeLayer(resolved, override, 'trusted');\n\n  // Trust decisions come from outside the workspace, so a repository cannot\n  // ship its own. Layers the user controls may still carry them — the global\n  // file and an explicit `--settings` path are trusted for everything else —\n  // but the store has the final say on any key it records.\n  const trust = loadWorkspaceTrust(\n    workspace,\n    paths.trustStorePath ?? defaultTrustStorePath(paths.home),\n  );\n  resolved.permissions.projectAllowRules = {\n    ...resolved.permissions.projectAllowRules,\n    ...trust.permissionAllowRules,\n  };\n  resolved.mcp.projectServers = { ...resolved.mcp.projectServers, ...trust.mcpServers };\n  resolved.hooks.projectEntries = { ...resolved.hooks.projectEntries, ...trust.hookEntries };\n  resolved.commands.projectCommands = {\n    ...resolved.commands.projectCommands,\n    ...trust.projectCommands,\n  };\n  resolved.projectDirectories = {\n    ...resolved.projectDirectories,\n    ...trust.projectDirectories,\n  };\n  resolved.workspaceProviders = {\n    ...resolved.workspaceProviders,\n    ...trust.workspaceProviders,\n  };\n\n  // Providers only a workspace layer defines: approved ones join `provider`, the rest are absent.\n  // Their keys are never resolved here or anywhere downstream of an unapproved entry.\n  const providerPartition = partitionWorkspaceProviders(\n    workspaceProviderLayers,\n    trustedProviderIds,\n    resolved.workspaceProviders,\n  );\n  for (const { id, declaration } of providerPartition.approved) {\n    resolved.provider[id] = declaration as BookSettings['provider'][string];\n  }\n  const withheldProviders = new Set(withheldProviderIds(providerPartition));\n  // A `model`, `compactModel`, `advisorModel` or agent-profile `model` a workspace layer set for a\n  // withheld provider gives way to what the trusted layers alone say.\n  const selectionLayers: ModelSelectionLayer[] = [\n    { path: userPath, trusted: true, selections: modelSelectionsOf(user ?? {}) },\n    { path: projectPath, trusted: false, selections: modelSelectionsOf(project ?? {}) },\n    { path: localPath, trusted: false, selections: modelSelectionsOf(local ?? {}) },\n    { path: overridePath ?? '', trusted: true, selections: modelSelectionsOf(override ?? {}) },\n  ];\n  const withheldSelections = withheldModelSelections(selectionLayers, withheldProviders);\n  for (const { key, fallback } of withheldSelections) {\n    const profile = profileOfModelKey(key);\n    if (profile === undefined) {\n      const topLevel = key as 'model' | 'compactModel' | 'advisorModel';\n      if (fallback === undefined) delete resolved[topLevel];\n      else resolved[topLevel] = fallback;\n      continue;\n    }\n    const entry = resolved.agents.profiles[profile];\n    if (!entry) continue;\n    if (fallback === undefined) delete entry.model;\n    else entry.model = fallback;\n    if (Object.keys(entry).length === 0) delete resolved.agents.profiles[profile];\n  }\n\n  // Every decision source is in place now, so the withheld repository rules can\n  // be released — approved ones only.\n  if (declaredProjectAllow.length > 0) {\n    const { approved } = partitionProjectAllowRules(\n      declaredProjectAllow,\n      resolved.permissions?.projectAllowRules,\n    );\n    if (approved.length > 0) {\n      resolved.permissions.allow = [...(resolved.permissions.allow ?? []), ...approved];\n    }\n  }\n\n  if (declaredProjectDirectories.length > 0) {\n    // Released by real path, not by the text the repository wrote: see `additional-roots.ts`.\n    // Approved entries join the resolved list as their declared text, which is what the merge\n    // above normalizes and deduplicates; the file tools resolve it again to the same place.\n    const { approved } = partitionProjectDirectories(\n      collectDeclaredDirectories(workspace, declaredProjectDirectories),\n      resolved.projectDirectories,\n    );\n    if (approved.length > 0) {\n      // The approved **real path**, never the declared text. A consumer resolves this list again\n      // later with no trust store in hand (see `resolveAdditionalRoots`), so a relative or\n      // symlinked spelling would let a relink move a root the user approved as somewhere else.\n      // The user saw the real path when the prompt named it; the repository's spelling is what\n      // would be dangerous to re-resolve (PR #334 finding 7).\n      resolved.additionalDirectories = [\n        ...(resolved.additionalDirectories ?? []),\n        ...approved.map((directory) => directory.realPath),\n      ];\n    }\n  }\n\n  if (declaredProjectHooks.length > 0) {\n    const { approved } = partitionProjectHooks(\n      declaredProjectHooks,\n      resolved.hooks?.projectEntries,\n    );\n    const approvedByEvent = new Map<HookEvent, HookEntry[]>();\n    for (const { event, entry } of approved) {\n      const entries = approvedByEvent.get(event) ?? [];\n      entries.push(entry);\n      approvedByEvent.set(event, entries);\n    }\n    for (const [event, entries] of approvedByEvent) {\n      resolved.hooks[event].splice(userHookCounts[event], 0, ...entries);\n    }\n  }\n\n  const settings = bookSettingsSchema.parse(resolved) as ResolvedSettings;\n  const providerGate = createWorkspaceProviderGate({\n    partition: providerPartition,\n    droppedOverrides: droppedProviderOverrides(workspaceProviderLayers, trustedProviderIds),\n    withheldSelections,\n    unaffectedSelections: unaffectedModelSelections(selectionLayers, withheldProviders),\n  });\n  return { settings, providerGate };\n}\n\n/**\n * The environment's say over the merged layers, applied to settings that are\n * about to be used rather than saved.\n *\n * `BOOK_STARTUP_ANIMATION` is here, and not in `loadConfig`, because the layers\n * are only half the answer: a reader that resolved the files and stopped would\n * report the file's value while Book acts on the variable's. So every path that\n * produces the *effective* settings calls this — the startup config, the\n * re-read after a provider is removed, `book config get`/`list`. A path that\n * computes what gets written back to a settings file must not: the variable\n * decides the next launch, and baking it into a file would make a later\n * `unset` look like it had failed.\n *\n * The returned object is a new one; the input is left as the caller resolved it.\n */\nexport function applySettingsEnvOverrides(\n  settings: ResolvedSettings,\n  env: NodeJS.ProcessEnv = process.env,\n): ResolvedSettings {\n  const startupAnimation = parseEnvBoolean(env.BOOK_STARTUP_ANIMATION);\n  if (startupAnimation === undefined) return settings;\n  return { ...settings, ui: { ...settings.ui, startupAnimation } };\n}\n\n/**\n * What to tell a user whose read or save is being decided by the environment\n * rather than by their settings — the `BOOK_MODEL` warning in one sentence, or\n * nothing when the variable is unset or unreadable.\n */\nexport function startupAnimationEnvNote(env: NodeJS.ProcessEnv = process.env): string | undefined {\n  const raw = env.BOOK_STARTUP_ANIMATION;\n  if (parseEnvBoolean(raw) === undefined) return undefined;\n  return (\n    `BOOK_STARTUP_ANIMATION is set to \"${raw}\" — it decides the splash at every ` +\n    'launch, so ui.startupAnimation will not apply while it is set.'\n  );\n}\n\nexport { loadSettingsFile };\n\n/**\n * Migrate rules from the legacy ~/.book/permissions.json into the local\n * settings file (<workspace>/.book/settings.local.json). Runs once on first\n * load when the legacy file exists and the local settings don't have rules yet.\n *\n * @param home - User home directory; injectable for isolated migration tests\n * @param validatedSettings - Already-resolved settings from the startup preflight\n * @returns true if migration occurred, false otherwise\n */\nexport function migrateLegacyPermissions(\n  workspace: string,\n  home?: string,\n  validatedSettings?: ResolvedSettings,\n): boolean {\n  // Direct callers must observe the same fail-before-storage boundary as the\n  // normal startup path. Internal callers pass already-resolved settings to\n  // avoid reading the layers twice on the common off path.\n  if (!validatedSettings) {\n    resolveSettings(workspace, undefined, home ? { home } : undefined);\n  }\n\n  const legacyPath = join(home ? join(home, '.book') : resolveBookHome(), 'permissions.json');\n  if (!existsSync(legacyPath)) return false;\n  const markerPath = join(workspace, '.book', 'migrations.json');\n  const localPath = join(workspace, '.book', 'settings.local.json');\n  // Before the marker is read: it is one of the files this writes.\n  for (const path of [markerPath, localPath]) {\n    const refusal = projectFileWriteRefusal(path);\n    if (refusal) {\n      console.warn(`⚠  Permission rules not migrated: ${path}: ${refusal}.`);\n      return false;\n    }\n  }\n  try {\n    const marker = JSON.parse(readFileSync(markerPath, 'utf-8')) as {\n      legacyPermissions?: number;\n    };\n    if ((marker.legacyPermissions ?? 0) >= LEGACY_PERMISSIONS_MIGRATION_VERSION) return false;\n  } catch {\n    // Missing or malformed markers are safely rebuilt after a successful migration.\n  }\n\n  let legacyRules: Array<{ toolName: string; pattern?: string; effect: string }> = [];\n  try {\n    const raw = readFileSync(legacyPath, 'utf-8');\n    const parsed = JSON.parse(raw) as {\n      rules: Array<{ toolName: string; pattern?: string; effect: string }>;\n    };\n    legacyRules = parsed.rules ?? [];\n  } catch {\n    return false; // corrupt — leave the legacy file alone\n  }\n\n  if (legacyRules.length === 0) return false;\n\n  const result = new SettingsRepository(localPath).update((existing) => {\n    const permissions = (existing.permissions ?? {}) as {\n      allow?: string[];\n      ask?: string[];\n      deny?: string[];\n    };\n    for (const key of ['allow', 'ask', 'deny'] as const) {\n      if (!Array.isArray(permissions[key])) permissions[key] = [];\n    }\n\n    for (const rule of legacyRules) {\n      const specifier = rule.pattern ? `${rule.toolName}(${rule.pattern})` : rule.toolName;\n      const effect = rule.effect as 'allow' | 'ask' | 'deny';\n      if (!permissions[effect]!.includes(specifier)) permissions[effect]!.push(specifier);\n    }\n    existing.permissions = permissions;\n  });\n  if (!result.ok) return false;\n\n  writeFileAtomic(\n    markerPath,\n    `${JSON.stringify({ legacyPermissions: LEGACY_PERMISSIONS_MIGRATION_VERSION }, null, 2)}\\n`,\n  );\n  if (!result.changed) return false;\n\n  console.warn(\n    `⚠  Migrated ${legacyRules.length} permission rule(s) from ~/.book/permissions.json to ${localPath}. ` +\n      'Delete the legacy file after verifying the migration.',\n  );\n  return true;\n}\n","/**\n * The one grammar for a boolean environment variable: `1`/`true`/`on`/`yes` and\n * `0`/`false`/`off`/`no`, case-insensitive and trimmed, and undefined for\n * anything else.\n *\n * Tri-state on purpose. A flag that reads \"unset\" as \"off\" cannot tell a caller\n * that wants the default from one that was never told, and every such caller\n * then hard-codes a second grammar beside it. `BOOK_STARTUP_ANIMATION` needs all\n * three: it has to outrank a settings file when set, leave that file alone when\n * not, and say nothing rather than guess when the value is a typo — a wrong guess\n * either delays the first render or hides the input bar a script is waiting for.\n */\nexport function parseEnvBoolean(raw: string | undefined): boolean | undefined {\n  switch (raw?.trim().toLowerCase()) {\n    case '0':\n    case 'false':\n    case 'off':\n    case 'no':\n      return false;\n    case '1':\n    case 'true':\n    case 'on':\n    case 'yes':\n      return true;\n    default:\n      return undefined;\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,cAAc,YAAY,oBAAoB;AACvD,SAAS,MAAM,WAAW,eAAe;;;ACWlC,SAAS,gBAAgB,KAA8C;AAC5E,UAAQ,KAAK,KAAK,EAAE,YAAY,GAAG;AAAA,IACjC,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;;;ADWA,IAAM,uCAAuC;AAY7C,IAAM,0BAA0B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AACF;AAOA,IAAM,2BAA2B,oBAAI,IAAY;AAAA,EAC/C;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA,GAAG,YAAY,IAAI,CAAC,UAAU,SAAS,KAAK,EAAE;AAAA;AAAA;AAAA;AAAA;AAAA,EAK9C,GAAG;AACL,CAAC;AAOD,IAAM,6BAAkD,IAAI,IAAI,uBAAuB;AAEvF,SAAS,YACP,MACA,UAEA,qBACA,SAAS,IACgB;AACzB,QAAM,SAAS,gBAAgB,IAAI;AAEnC,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AAKnD,QAAI,UAAU,UAAa,QAAQ,YAAa;AAChD,UAAM,OAAO,SAAS,GAAG,MAAM,IAAI,GAAG,KAAK;AAC3C,UAAM,WAAW,OAAO,GAAG;AAE3B,QAAI,MAAM,QAAQ,KAAK,GAAG;AACxB,UAAI,SAAS,yBAAyB;AACpC,cAAM,WAAW,CAAC,GAAI,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,GAAI,GAAG,KAAK,EAAE;AAAA,UAAI,CAAC,UAC7E,UAAU,OAAO,KAAK,CAAC;AAAA,QACzB;AACA,eAAO,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC;AAAA,MACrC,WACE,yBAAyB,IAAI,IAAI,MAChC,uBAAuB,CAAC,2BAA2B,IAAI,IAAI,IAC5D;AACA,cAAM,WAAW,CAAC,GAAI,MAAM,QAAQ,QAAQ,IAAI,WAAW,CAAC,GAAI,GAAG,KAAK;AACxE,eAAO,GAAG,IAAI,2BAA2B,IAAI,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,CAAC,IAAI;AAAA,MAChF,OAAO;AACL,eAAO,GAAG,IAAI,gBAAgB,KAAK;AAAA,MACrC;AAAA,IACF,WACE,OAAO,UAAU,YACjB,UAAU,QACV,OAAO,aAAa,YACpB,aAAa,QACb,CAAC,MAAM,QAAQ,QAAQ,GACvB;AACA,aAAO,GAAG,IAAI;AAAA,QACZ;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF,OAAO;AACL,aAAO,GAAG,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,SAAO;AACT;AA+BA,IAAM,4BAAsE;AAAA,EAC1E,CAAC,OAAO,gBAAgB;AAAA,EACxB,CAAC,eAAe,mBAAmB;AAAA,EACnC,CAAC,SAAS,gBAAgB;AAAA,EAC1B,CAAC,YAAY,iBAAiB;AAAA,EAC9B,CAAC,IAAI,oBAAoB;AAAA;AAAA,EAEzB,CAAC,IAAI,oBAAoB;AAC3B;AAEA,SAAS,WACP,UACA,OACM;AACN,aAAW,CAAC,QAAQ,GAAG,KAAK,OAAO;AACjC,QAAI,WAAW,IAAI;AACjB,aAAQ,SAAqC,GAAG;AAChD;AAAA,IACF;AACA,UAAM,YAAa,SAAqC,MAAM;AAC9D,QAAI,aAAa,OAAO,cAAc,YAAY,CAAC,MAAM,QAAQ,SAAS,GAAG;AAC3E,aAAQ,UAAsC,GAAG;AAAA,IACnD;AAAA,EACF;AACF;AAwBA,IAAM,oCAA0F;AAAA,EAC9F,CAAC,CAAC,WAAW,SAAS,GAAG,IAAI;AAAA,EAC7B,CAAC,CAAC,WAAW,mBAAmB,GAAG,IAAI;AAAA,EACvC,CAAC,CAAC,WAAW,0BAA0B,GAAG,KAAK;AAAA,EAC/C,CAAC,CAAC,WAAW,0BAA0B,GAAG,KAAK;AAAA,EAC/C,CAAC,CAAC,WAAW,kBAAkB,GAAG,IAAI;AAAA,EACtC,CAAC,CAAC,WAAW,cAAc,YAAY,GAAG,IAAI;AAAA;AAAA;AAAA,EAG9C,CAAC,CAAC,WAAW,cAAc,gBAAgB,GAAG,KAAK;AAAA,EACnD,CAAC,CAAC,WAAW,WAAW,gBAAgB,GAAG,IAAI;AACjD;AAUA,SAAS,SAAS,UAAmC,MAAkC;AACrF,MAAI,QAAiB;AACrB,aAAW,OAAO,MAAM;AACtB,QAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,EAAG,QAAO;AAChF,YAAS,MAAkC,GAAG;AAC9C,QAAI,UAAU,OAAW,QAAO;AAAA,EAClC;AACA,SAAO;AACT;AAEA,SAAS,WAAW,UAAmC,MAA+B;AACpF,QAAM,SAAS,KAAK,MAAM,GAAG,EAAE;AAC/B,QAAM,MAAM,KAAK,KAAK,SAAS,CAAC;AAChC,QAAM,YAAY,OAAO,WAAW,IAAI,WAAW,eAAe,UAAU,MAAM;AAClF,MAAI,UAAW,QAAO,UAAU,GAAG;AACrC;AAGA,SAAS,eACP,UACA,MACqC;AACrC,QAAM,QAAQ,SAAS,UAAU,IAAI;AACrC,SAAO,OAAO,UAAU,YAAY,UAAU,QAAQ,CAAC,MAAM,QAAQ,KAAK,IACrE,QACD;AACN;AAsBO,SAAS,4BACd,UAC8B;AAC9B,QAAM,SAAS;AACf,QAAM,UAAwC,CAAC;AAC/C,aAAW,CAAC,MAAM,eAAe,KAAK,mCAAmC;AACvE,UAAM,QAAQ,SAAS,QAAQ,IAAI;AACnC,QAAI,UAAU,OAAW;AACzB,QAAI,oBAAoB,QAAQ,UAAU,gBAAiB;AAC3D,YAAQ,KAAK,EAAE,KAAK,KAAK,KAAK,GAAG,GAAG,MAAM,CAAC;AAAA,EAC7C;AACA,SAAO;AACT;AAWA,IAAM,8BAA8B;AAG7B,SAAS,iCAAiC,OAA2C;AAC1F,QAAM,OAAO,KAAK,UAAU,MAAM,KAAK,KAAK,OAAO,MAAM,KAAK;AAC9D,MAAI,KAAK,UAAU,4BAA6B,QAAO,GAAG,MAAM,GAAG,IAAI,IAAI;AAC3E,SAAO,GAAG,MAAM,GAAG,IAAI,KAAK,MAAM,GAAG,2BAA2B,CAAC,sBAC/D,KAAK,SAAS,2BAChB;AACF;AAOA,SAAS,iCAAiC,UAAuC;AAC/E,QAAM,SAAS;AACf,aAAW,SAAS,4BAA4B,QAAQ,GAAG;AACzD,eAAW,QAAQ,MAAM,IAAI,MAAM,GAAG,CAAC;AAAA,EACzC;AACF;AAEA,SAAS,cACP,UACA,OACuB;AACvB,MAAI,UAAU,UAAW,QAAO;AAChC,QAAM,YAAY,gBAAgB,QAAQ;AAE1C,MAAI,UAAU,gBAAgB,oBAAqB,QAAO,UAAU;AAIpE,SAAO,UAAU;AAEjB,mCAAiC,SAAS;AAC1C,aAAW,WAAW,yBAAyB;AAC/C,SAAO;AACT;AAUA,SAAS,WACP,UACA,OACA,OACkB;AAClB,QAAM,YAAY,cAAc,OAAO,KAAK;AAE5C,MACE,SAAS,iCAAiC,QAC1C,UAAU,iCAAiC,OAC3C;AACA,cAAU,+BAA+B;AAAA,EAC3C;AACA,MAAI,UAAU,aAAa,gCAAgC,UAAU,SAAS,GAAG;AAG/E,UAAM,YAAuC;AAAA,MAC3C,SAAS,EAAE,GAAG,UAAU,SAAS,0BAA0B,MAAM;AAAA,IACnE;AACA,IAAC,UAAwC,UAAU,UAAU;AAAA,EAC/D;AACA,SAAO,cAAc,UAAU,WAAW,KAAK;AACjD;AAaA,SAAS,gCACP,UACA,WACS;AACT,SAAO,UAAU,SAAS,YAAY,QAAQ,SAAS,SAAS,YAAY;AAC9E;AA6BO,SAAS,iCACd,QACoB;AACpB,MAAI,UAAU,iBAAiB,QAAQ;AACvC,aAAW,SAAS,QAAQ;AAC1B,QAAI,CAAC,MAAM,SAAU;AACrB,UAAM,YAAY,cAAc,MAAM,UAAU,MAAM,KAAK;AAC3D,QAAI,MAAM,UAAU,aAAa,UAAU,SAAS,YAAY,QAAQ,YAAY,MAAM;AACxF,aAAO,MAAM;AAAA,IACf;AACA,QAAI,UAAU,SAAS,YAAY,OAAW,WAAU,UAAU,QAAQ;AAAA,EAC5E;AACA,SAAO;AACT;AASO,SAAS,cACd,MACA,UACA,QAA4B,WACV;AAClB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,UAAU;AAAA,EACZ;AACF;AAMA,SAAS,iBAAiB,MAAmC;AAC3D,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,QAAM,MAAM,aAAa,MAAM,OAAO;AACtC,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,SAAS,GAAG;AACV,UAAM,IAAI;AAAA,MACR,kCAAkC,IAAI;AAAA,EAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC;AAAA,IACvF;AAAA,EACF;AAKA,WAAS,yBAAyB,MAAM;AACxC,QAAM,SAAS,mBAAmB,UAAU,MAAM;AAClD,MAAI,CAAC,OAAO,QAAS,OAAM,IAAI,MAAM,uBAAuB,IAAI;AAAA,EAAM,OAAO,MAAM,OAAO,EAAE;AAG5F,SAAO;AACT;AAyBO,SAAS,mBACd,WACA,cACA,QAAiC,CAAC,GACxB;AACV,QAAM,WAAW,iBAAiB,KAAK;AACvC,QAAM,cAAc,MAAM,uBAAuB,KAAK,WAAW,SAAS,eAAe;AACzF,QAAM,SAAS;AAAA,IACb;AAAA,IACA,GAAI,SAAS,aAAa,QAAQ,IAAI,CAAC,IAAI,CAAC,WAAW;AAAA,IACvD,MAAM,qBAAqB,KAAK,WAAW,SAAS,qBAAqB;AAAA,EAC3E;AACA,MAAI,aAAc,QAAO,KAAK,YAAY;AAC1C,SAAO;AACT;AAEA,SAAS,iBAAiB,OAAwC;AAChE,SACE,MAAM,qBACL,MAAM,OACH,KAAK,MAAM,MAAM,SAAS,eAAe,IACzC,KAAK,gBAAgB,GAAG,eAAe;AAE/C;AAOA,SAAS,SAAS,MAAc,OAAwB;AACtD,MAAI,QAAQ,IAAI,MAAM,QAAQ,KAAK,EAAG,QAAO;AAC7C,MAAI;AACF,WAAO,aAAa,OAAO,IAAI,MAAM,aAAa,OAAO,KAAK;AAAA,EAChE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAYO,SAAS,mBAAmB,MAAc,QAAiC,CAAC,GAAY;AAC7F,SAAO,SAAS,MAAM,iBAAiB,KAAK,CAAC;AAC/C;AAIO,SAAS,6BAAoD;AAClE,SAAO,4BAA4B,EAAE,WAAW,gCAAgC,EAAE,CAAC;AACrF;AAQA,SAAS,uBACP,OACA,SACqB;AACrB,MAAI,CAAC,SAAS,SAAS,iBAAiB,OAAW,QAAO;AAC1D,MAAI,MAAM,cAAc,KAAK,EAAE,YAAY,MAAM,kBAAmB,QAAO;AAC3E,QAAM,OAAO,EAAE,GAAG,MAAM;AACxB,SAAO,KAAK;AACZ,SAAO;AACT;AAEO,SAAS,gBACd,WACA,cACA,QAAiC,CAAC,GAChB;AAClB,SAAO,gCAAgC,WAAW,cAAc,KAAK,EAAE;AACzE;AAGO,SAAS,gCACd,WACA,cACA,QAAiC,CAAC,GACmC;AACrE,MAAI,WAAW,gBAAgB,gBAAgB;AAM/C,QAAM,WAAW,iBAAiB,KAAK;AACvC,QAAM,OAAO,iBAAiB,QAAQ;AACtC,QAAM,cAAc,MAAM,uBAAuB,KAAK,WAAW,SAAS,eAAe;AAEzF,QAAM,UAAU,SAAS,aAAa,QAAQ,IAAI,OAAO,iBAAiB,WAAW;AACrF,QAAM,YAAY,MAAM,qBAAqB,KAAK,WAAW,SAAS,qBAAqB;AAC3F,QAAM,QAAQ,uBAAuB,iBAAiB,SAAS,GAAG,OAAO;AACzE,QAAM,WAAW,eAAe,iBAAiB,YAAY,IAAI;AAEjE,QAAM,qBAAqB,cAAc;AAAA,IACvC,EAAE,WAAW,MAAM,SAAS;AAAA,IAC5B,EAAE,WAAW,UAAU,SAAS;AAAA,EAClC,CAAC;AACD,QAAM,0BAA2C;AAAA,IAC/C,EAAE,MAAM,aAAa,WAAW,SAAS,SAAS;AAAA,IAClD,EAAE,MAAM,WAAW,WAAW,OAAO,SAAS;AAAA,EAChD;AAGA,QAAM,gBAAgB,CAAC,UACrB,MAAM,WACF;AAAA,IACE,GAAG;AAAA,IACH,UAAU;AAAA,MACR,MAAM;AAAA,MACN;AAAA,IACF;AAAA,EACF,IACA;AAGN,MAAI,KAAM,YAAW,WAAW,UAAU,MAAM,SAAS;AAMzD,QAAM,uBAAuB,SAAS,aAAa,SAAS,CAAC;AAG7D,QAAM,uBAAuB,qBAAqB,OAAO;AAKzD,QAAM,6BAA6B,SAAS,yBAAyB,CAAC;AAGtE,QAAM,iBAAiB,OAAO;AAAA,IAC5B,YAAY,IAAI,CAAC,UAAU,CAAC,OAAO,SAAS,MAAM,KAAK,EAAE,MAAM,CAAC;AAAA,EAClE;AACA,MAAI,SAAS;AACX,QAAI,WAAyB;AAC7B,QAAI,qBAAqB,SAAS,GAAG;AACnC,iBAAW,EAAE,GAAG,UAAU,aAAa,EAAE,GAAG,SAAS,aAAa,OAAO,CAAC,EAAE,EAAE;AAAA,IAChF;AACA,QAAI,2BAA2B,SAAS,GAAG;AACzC,iBAAW,EAAE,GAAG,UAAU,uBAAuB,CAAC,EAAE;AAAA,IACtD;AACA,QAAI,qBAAqB,SAAS,GAAG;AACnC,iBAAW,EAAE,GAAG,UAAU,OAAO,gBAAgB,iBAAiB,KAAK,EAAE;AAAA,IAC3E;AACA,eAAW,WAAW,UAAU,cAAc,QAAQ,GAAG,YAAY;AAAA,EACvE;AAGA,MAAI,MAAO,YAAW,WAAW,UAAU,cAAc,KAAK,GAAG,OAAO;AAGxE,MAAI,SAAU,YAAW,WAAW,UAAU,UAAU,SAAS;AAMjE,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,MAAM,kBAAkB,sBAAsB,MAAM,IAAI;AAAA,EAC1D;AACA,WAAS,YAAY,oBAAoB;AAAA,IACvC,GAAG,SAAS,YAAY;AAAA,IACxB,GAAG,MAAM;AAAA,EACX;AACA,WAAS,IAAI,iBAAiB,EAAE,GAAG,SAAS,IAAI,gBAAgB,GAAG,MAAM,WAAW;AACpF,WAAS,MAAM,iBAAiB,EAAE,GAAG,SAAS,MAAM,gBAAgB,GAAG,MAAM,YAAY;AACzF,WAAS,SAAS,kBAAkB;AAAA,IAClC,GAAG,SAAS,SAAS;AAAA,IACrB,GAAG,MAAM;AAAA,EACX;AACA,WAAS,qBAAqB;AAAA,IAC5B,GAAG,SAAS;AAAA,IACZ,GAAG,MAAM;AAAA,EACX;AACA,WAAS,qBAAqB;AAAA,IAC5B,GAAG,SAAS;AAAA,IACZ,GAAG,MAAM;AAAA,EACX;AAIA,QAAM,oBAAoB;AAAA,IACxB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,EACX;AACA,aAAW,EAAE,IAAI,YAAY,KAAK,kBAAkB,UAAU;AAC5D,aAAS,SAAS,EAAE,IAAI;AAAA,EAC1B;AACA,QAAM,oBAAoB,IAAI,IAAI,oBAAoB,iBAAiB,CAAC;AAGxE,QAAM,kBAAyC;AAAA,IAC7C,EAAE,MAAM,UAAU,SAAS,MAAM,YAAY,kBAAkB,QAAQ,CAAC,CAAC,EAAE;AAAA,IAC3E,EAAE,MAAM,aAAa,SAAS,OAAO,YAAY,kBAAkB,WAAW,CAAC,CAAC,EAAE;AAAA,IAClF,EAAE,MAAM,WAAW,SAAS,OAAO,YAAY,kBAAkB,SAAS,CAAC,CAAC,EAAE;AAAA,IAC9E,EAAE,MAAM,gBAAgB,IAAI,SAAS,MAAM,YAAY,kBAAkB,YAAY,CAAC,CAAC,EAAE;AAAA,EAC3F;AACA,QAAM,qBAAqB,wBAAwB,iBAAiB,iBAAiB;AACrF,aAAW,EAAE,KAAK,SAAS,KAAK,oBAAoB;AAClD,UAAM,UAAU,kBAAkB,GAAG;AACrC,QAAI,YAAY,QAAW;AACzB,YAAM,WAAW;AACjB,UAAI,aAAa,OAAW,QAAO,SAAS,QAAQ;AAAA,UAC/C,UAAS,QAAQ,IAAI;AAC1B;AAAA,IACF;AACA,UAAM,QAAQ,SAAS,OAAO,SAAS,OAAO;AAC9C,QAAI,CAAC,MAAO;AACZ,QAAI,aAAa,OAAW,QAAO,MAAM;AAAA,QACpC,OAAM,QAAQ;AACnB,QAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO,SAAS,OAAO,SAAS,OAAO;AAAA,EAC9E;AAIA,MAAI,qBAAqB,SAAS,GAAG;AACnC,UAAM,EAAE,SAAS,IAAI;AAAA,MACnB;AAAA,MACA,SAAS,aAAa;AAAA,IACxB;AACA,QAAI,SAAS,SAAS,GAAG;AACvB,eAAS,YAAY,QAAQ,CAAC,GAAI,SAAS,YAAY,SAAS,CAAC,GAAI,GAAG,QAAQ;AAAA,IAClF;AAAA,EACF;AAEA,MAAI,2BAA2B,SAAS,GAAG;AAIzC,UAAM,EAAE,SAAS,IAAI;AAAA,MACnB,2BAA2B,WAAW,0BAA0B;AAAA,MAChE,SAAS;AAAA,IACX;AACA,QAAI,SAAS,SAAS,GAAG;AAMvB,eAAS,wBAAwB;AAAA,QAC/B,GAAI,SAAS,yBAAyB,CAAC;AAAA,QACvC,GAAG,SAAS,IAAI,CAAC,cAAc,UAAU,QAAQ;AAAA,MACnD;AAAA,IACF;AAAA,EACF;AAEA,MAAI,qBAAqB,SAAS,GAAG;AACnC,UAAM,EAAE,SAAS,IAAI;AAAA,MACnB;AAAA,MACA,SAAS,OAAO;AAAA,IAClB;AACA,UAAM,kBAAkB,oBAAI,IAA4B;AACxD,eAAW,EAAE,OAAO,MAAM,KAAK,UAAU;AACvC,YAAM,UAAU,gBAAgB,IAAI,KAAK,KAAK,CAAC;AAC/C,cAAQ,KAAK,KAAK;AAClB,sBAAgB,IAAI,OAAO,OAAO;AAAA,IACpC;AACA,eAAW,CAAC,OAAO,OAAO,KAAK,iBAAiB;AAC9C,eAAS,MAAM,KAAK,EAAE,OAAO,eAAe,KAAK,GAAG,GAAG,GAAG,OAAO;AAAA,IACnE;AAAA,EACF;AAEA,QAAM,WAAW,mBAAmB,MAAM,QAAQ;AAClD,QAAM,eAAe,4BAA4B;AAAA,IAC/C,WAAW;AAAA,IACX,kBAAkB,yBAAyB,yBAAyB,kBAAkB;AAAA,IACtF;AAAA,IACA,sBAAsB,0BAA0B,iBAAiB,iBAAiB;AAAA,EACpF,CAAC;AACD,SAAO,EAAE,UAAU,aAAa;AAClC;AAiBO,SAAS,0BACd,UACA,MAAyB,QAAQ,KACf;AAClB,QAAM,mBAAmB,gBAAgB,IAAI,sBAAsB;AACnE,MAAI,qBAAqB,OAAW,QAAO;AAC3C,SAAO,EAAE,GAAG,UAAU,IAAI,EAAE,GAAG,SAAS,IAAI,iBAAiB,EAAE;AACjE;AAOO,SAAS,wBAAwB,MAAyB,QAAQ,KAAyB;AAChG,QAAM,MAAM,IAAI;AAChB,MAAI,gBAAgB,GAAG,MAAM,OAAW,QAAO;AAC/C,SACE,qCAAqC,GAAG;AAG5C;AAaO,SAAS,yBACd,WACA,MACA,mBACS;AAIT,MAAI,CAAC,mBAAmB;AACtB,oBAAgB,WAAW,QAAW,OAAO,EAAE,KAAK,IAAI,MAAS;AAAA,EACnE;AAEA,QAAM,aAAa,KAAK,OAAO,KAAK,MAAM,OAAO,IAAI,gBAAgB,GAAG,kBAAkB;AAC1F,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,QAAM,aAAa,KAAK,WAAW,SAAS,iBAAiB;AAC7D,QAAM,YAAY,KAAK,WAAW,SAAS,qBAAqB;AAEhE,aAAW,QAAQ,CAAC,YAAY,SAAS,GAAG;AAC1C,UAAM,UAAU,wBAAwB,IAAI;AAC5C,QAAI,SAAS;AACX,cAAQ,KAAK,0CAAqC,IAAI,KAAK,OAAO,GAAG;AACrE,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AAG3D,SAAK,OAAO,qBAAqB,MAAM,qCAAsC,QAAO;AAAA,EACtF,QAAQ;AAAA,EAER;AAEA,MAAI,cAA6E,CAAC;AAClF,MAAI;AACF,UAAM,MAAM,aAAa,YAAY,OAAO;AAC5C,UAAM,SAAS,KAAK,MAAM,GAAG;AAG7B,kBAAc,OAAO,SAAS,CAAC;AAAA,EACjC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,MAAI,YAAY,WAAW,EAAG,QAAO;AAErC,QAAM,SAAS,IAAI,mBAAmB,SAAS,EAAE,OAAO,CAAC,aAAa;AACpE,UAAM,cAAe,SAAS,eAAe,CAAC;AAK9C,eAAW,OAAO,CAAC,SAAS,OAAO,MAAM,GAAY;AACnD,UAAI,CAAC,MAAM,QAAQ,YAAY,GAAG,CAAC,EAAG,aAAY,GAAG,IAAI,CAAC;AAAA,IAC5D;AAEA,eAAW,QAAQ,aAAa;AAC9B,YAAM,YAAY,KAAK,UAAU,GAAG,KAAK,QAAQ,IAAI,KAAK,OAAO,MAAM,KAAK;AAC5E,YAAM,SAAS,KAAK;AACpB,UAAI,CAAC,YAAY,MAAM,EAAG,SAAS,SAAS,EAAG,aAAY,MAAM,EAAG,KAAK,SAAS;AAAA,IACpF;AACA,aAAS,cAAc;AAAA,EACzB,CAAC;AACD,MAAI,CAAC,OAAO,GAAI,QAAO;AAEvB;AAAA,IACE;AAAA,IACA,GAAG,KAAK,UAAU,EAAE,mBAAmB,qCAAqC,GAAG,MAAM,CAAC,CAAC;AAAA;AAAA,EACzF;AACA,MAAI,CAAC,OAAO,QAAS,QAAO;AAE5B,UAAQ;AAAA,IACN,oBAAe,YAAY,MAAM,wDAAwD,SAAS;AAAA,EAEpG;AACA,SAAO;AACT;","names":[]}