@nanonets/graft 0.23.1 → 0.24.1

package/dist/trace/gate-file.js

@@ -0,0 +1,329 @@
+/**
+ * The small files the PreToolUse fast path reads while a skill's run block is
+ * live, kept beside phase 0's session state in `<trail home>/sessions/`:
+ *
+ *  - `<id>.gate.json`: the live run blocks' gated steps (a publish, a push to
+ *    prod, a deploy, ...), grouped so one ask of the person covers a run of
+ *    consecutive steps of one kind, and which asks were made and approved.
+ *    It exists only while something is live.
+ *  - `<id>.post.jsonl`: outcomes PostToolUse and PostToolUseFailure saw
+ *    before the transcript had them, one line each, taken by the next
+ *    catch-up. The transcript's result always wins when it arrives.
+ *
+ * An approval is the asked call's own PostToolUse: the person said yes and
+ * the command ran. A failed asked call (PostToolUseFailure) never approves,
+ * because a refused ask may arrive the same way.
+ *
+ * Every shell command passes through PreToolUse, so this file stays light:
+ * static imports are node:path, node:os and the shell lexer; node:fs and
+ * node:crypto come from `process.getBuiltinModule`, as pre-bash.ts does.
+ * Writes are tmp-and-rename (or one O_APPEND write) at 0600 in a 0700 folder.
+ */
+import { homedir } from 'node:os';
+import { dirname, join, resolve } from 'node:path';
+import { programOf } from './shell.js';
+/** A gate file bigger than this is not read: the fast path never parses much. */
+const MAX_GATE_BYTES = 16 * 1024;
+const MAX_TAIL = 200;
+const MAX_MARKS = 2000;
+const fs = () => process.getBuiltinModule('node:fs');
+const crypto = () => process.getBuiltinModule('node:crypto');
+/** The same answer as notes/home.ts trailHome(env); a test holds them equal. */
+export function trailHomeFast(env = process.env) {
+    return env.TRAIL_HOME ? resolve(env.TRAIL_HOME) : join(homedir(), '.trail');
+}
+/** A session id as a file name, as phase 0's state.ts does it (a test holds them equal). */
+function fileId(sessionId) {
+    if (/^[A-Za-z0-9_-][A-Za-z0-9._-]{0,127}$/.test(sessionId))
+        return sessionId;
+    return `h-${crypto().createHash('sha256').update(String(sessionId)).digest('hex').slice(0, 16)}`;
+}
+/** `<home>/sessions/<id><suffix>`: the session's files (`.json`, `.gate.json`, `.post.jsonl`). */
+export function sessionPath(sessionId, suffix, env = process.env) {
+    return join(trailHomeFast(env), 'sessions', `${fileId(String(sessionId))}${suffix}`);
+}
+export function gateFilePath(sessionId, env = process.env) {
+    return sessionPath(sessionId, '.gate.json', env);
+}
+function postPath(sessionId, env) {
+    return sessionPath(sessionId, '.post.jsonl', env);
+}
+/**
+ * A folder only its owner can open, made if missing and tightened if it was looser. A link is left alone: a chmod
+ * would follow it and tighten what it points to. The mode is set through a descriptor that refuses a link (as
+ * state.ts ensurePrivateDir, kept here so this file loads only node:path and node:os).
+ */
+function privateDir(dir) {
+    const f = fs();
+    try {
+        if (f.lstatSync(dir).isSymbolicLink())
+            return;
+    }
+    catch { /* missing: made below */ }
+    f.mkdirSync(dir, { recursive: true, mode: 0o700 });
+    const k = f.constants;
+    if (process.platform === 'win32' || k.O_NOFOLLOW === undefined)
+        return;
+    try {
+        const fd = f.openSync(dir, k.O_RDONLY | (k.O_DIRECTORY ?? 0) | k.O_NOFOLLOW);
+        try {
+            f.fchmodSync(fd, 0o700);
+        }
+        finally {
+            f.closeSync(fd);
+        }
+    }
+    catch (e) {
+        // A folder its owner can't read can't be opened, but can still be tightened.
+        if (e.code !== 'EACCES')
+            return;
+        try {
+            if (!f.lstatSync(dir).isSymbolicLink())
+                f.chmodSync(dir, 0o700);
+        }
+        catch { /* not ours to change */ }
+    }
+}
+/** tmp file + rename at 0600. */
+function writeWhole(path, data) {
+    const f = fs();
+    privateDir(dirname(path));
+    const tmp = `${path}.${process.pid}.${Math.random().toString(16).slice(2, 8)}.tmp`;
+    try {
+        const fd = f.openSync(tmp, 'wx', 0o600);
+        try {
+            f.fchmodSync(fd, 0o600);
+            f.writeSync(fd, data);
+        }
+        finally {
+            f.closeSync(fd);
+        }
+        f.renameSync(tmp, path);
+    }
+    catch (e) {
+        try {
+            f.rmSync(tmp, { force: true });
+        }
+        catch { /* nothing more to do */ }
+        throw e;
+    }
+}
+const isStr = (v) => typeof v === 'string';
+const strOrNull = (v) => v === null || typeof v === 'string';
+function validGroup(g) {
+    if (!g || typeof g !== 'object')
+        return false;
+    const x = g;
+    return isStr(x.kind) && Array.isArray(x.steps) && x.steps.every((s) => s && typeof s.n === 'number' && isStr(s.text))
+        && strOrNull(x.askedAt) && strOrNull(x.askedToolUseId) && strOrNull(x.approvedAt);
+}
+function validGate(v) {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return false;
+    const g = v;
+    if (g.v !== 1 || typeof g.epoch !== 'number' || !Array.isArray(g.live))
+        return false;
+    return g.live.every((l) => l && isStr(l.injId) && isStr(l.name) && Array.isArray(l.steps) && Array.isArray(l.groups) && l.groups.every(validGroup));
+}
+/** No lock; a file over 16 KB or bad JSON reads as null. */
+export function readGateFile(sessionId, env = process.env) {
+    try {
+        const f = fs();
+        const path = gateFilePath(sessionId, env);
+        const st = f.statSync(path);
+        if (!st.isFile() || st.size > MAX_GATE_BYTES)
+            return null;
+        const v = JSON.parse(f.readFileSync(path, 'utf8'));
+        return validGate(v) ? v : null;
+    }
+    catch {
+        return null;
+    }
+}
+/** Gated steps, consecutive ones of one kind together (one ask covers a group). */
+function groupsOf(steps, gated) {
+    const sorted = [...gated].filter((g) => g.step >= 1 && g.step <= steps.length).sort((a, b) => a.step - b.step);
+    const out = [];
+    for (const g of sorted) {
+        const text = steps[g.step - 1];
+        const step = { n: g.step, text, program: programOf(text) };
+        const last = out[out.length - 1];
+        const prev = last?.steps[last.steps.length - 1];
+        if (last && prev && last.kind === g.kind && prev.n === g.step - 1)
+            last.steps.push(step);
+        else
+            out.push({ kind: g.kind, steps: [step], askedAt: null, askedToolUseId: null, approvedAt: null });
+    }
+    return out;
+}
+const sameSteps = (a, b) => a.kind === b.kind && a.steps.length === b.steps.length && a.steps.every((s, i) => s.n === b.steps[i].n && s.text === b.steps[i].text);
+/** Rewrites `live` from st.injected (live ones), keeping asked/approved marks of injections that stay. Deletes the file when nothing is live. */
+export function writeGateFile(sessionId, st, env = process.env) {
+    const path = gateFilePath(sessionId, env);
+    const old = readGateFile(sessionId, env);
+    const live = st.injected.filter((i) => i.live).map((inj) => {
+        const before = old?.live.find((l) => l.injId === inj.injId);
+        const groups = groupsOf(inj.steps, inj.gated).map((g) => {
+            const kept = before?.groups.find((b) => sameSteps(b, g));
+            return kept ? { ...g, askedAt: kept.askedAt, askedToolUseId: kept.askedToolUseId, approvedAt: kept.approvedAt, askedStep: kept.askedStep ?? null } : g;
+        });
+        const handed = before?.steps.join('\n') === inj.steps.join('\n') ? validHanded(before?.handed) : [];
+        return { injId: inj.injId, name: inj.name, skillId: inj.skillId, params: inj.params, steps: inj.steps, check: inj.check, groups, ...(handed.length ? { handed } : {}) };
+    });
+    if (!live.length) {
+        try {
+            fs().rmSync(path, { force: true });
+        }
+        catch { /* gone already */ }
+        return;
+    }
+    // Over the cap the file would read as nothing: keep the newest blocks that fit.
+    let file = { v: 1, epoch: st.epoch, live };
+    let text = JSON.stringify(file);
+    while (Buffer.byteLength(text) > MAX_GATE_BYTES && file.live.length > 1) {
+        file = { ...file, live: file.live.slice(1) };
+        text = JSON.stringify(file);
+    }
+    writeWhole(path, text);
+}
+function rewrite(sessionId, env, change) {
+    const g = readGateFile(sessionId, env);
+    if (!g || !change(g))
+        return false;
+    writeWhole(gateFilePath(sessionId, env), JSON.stringify(g));
+    return true;
+}
+export function markAsked(sessionId, injId, group, toolUseId, now, env = process.env, step) {
+    rewrite(sessionId, env, (g) => {
+        const target = g.live.find((l) => l.injId === injId)?.groups[group];
+        if (!target)
+            return false;
+        target.askedAt = now.toISOString();
+        target.askedToolUseId = toolUseId;
+        target.approvedAt = null;
+        target.askedStep = typeof step === 'number' ? step : null;
+        return true;
+    });
+}
+const MAX_HANDED = 8;
+const validHanded = (v) => (Array.isArray(v) ? v : []).filter((h) => !!h && typeof h.n === 'number' && Number.isInteger(h.n) && h.n >= 1 && isStr(h.at)).slice(-MAX_HANDED);
+/** D137: the gated step `step` of block `injId` was denied and printed for the person to run (no ask possible here). */
+export function markHanded(sessionId, injId, step, now, env = process.env) {
+    rewrite(sessionId, env, (g) => {
+        const l = g.live.find((x) => x.injId === injId);
+        if (!l || !Number.isInteger(step) || step < 1 || step > l.steps.length)
+            return false;
+        l.handed = [...validHanded(l.handed).filter((h) => h.n !== step), { n: step, at: now.toISOString() }].slice(-MAX_HANDED);
+        return true;
+    });
+}
+/** D137: every handed step the gate file holds, by block. */
+export function readHanded(sessionId, env = process.env) {
+    const g = readGateFile(sessionId, env);
+    return g ? g.live.flatMap((l) => validHanded(l.handed).map((h) => ({ ...h, injId: l.injId }))) : [];
+}
+/** true when toolUseId was an asked call (sets approvedAt). PostToolUse only: a failed asked call (PostToolUseFailure) never
+ *  approves its group, because a refused ask may arrive the same way; the next step in the group asks again (3.3). */
+export function markApproved(sessionId, toolUseId, now, env = process.env) {
+    if (!toolUseId)
+        return false;
+    return rewrite(sessionId, env, (g) => {
+        let hit = false;
+        for (const l of g.live)
+            for (const grp of l.groups) {
+                if (grp.askedToolUseId === toolUseId) {
+                    grp.approvedAt = now.toISOString();
+                    hit = true;
+                }
+            }
+        return hit;
+    });
+}
+/**
+ * `<home>/sessions/<id>.post.jsonl`, one O_APPEND write at 0600. Opened without blocking and written only when it
+ * is a regular file: a FIFO planted at the path would otherwise hold PostToolUse until its timeout (D100 18). A FIFO
+ * or anything else that isn't a regular file is skipped, and the mark is lost (the fold reads the call anyway).
+ */
+export function appendPostMark(sessionId, mark, env = process.env) {
+    const f = fs();
+    const path = postPath(sessionId, env);
+    const clean = { id: String(mark.id), at: String(mark.at), failed: mark.failed === true };
+    if (typeof mark.tail === 'string')
+        clean.tail = mark.tail.slice(-MAX_TAIL);
+    privateDir(dirname(path));
+    // Never through a symlink: one planted at this path would have the hook append to, and chmod, its target.
+    const { O_WRONLY, O_APPEND, O_CREAT, O_NOFOLLOW, O_NONBLOCK } = f.constants;
+    let fd;
+    try {
+        fd = f.openSync(path, O_WRONLY | O_APPEND | O_CREAT | O_NOFOLLOW | (O_NONBLOCK ?? 0), 0o600);
+    }
+    catch (e) {
+        // A FIFO with no reader refuses a non-blocking open for writing.
+        if (e.code === 'ENXIO')
+            return;
+        throw e;
+    }
+    try {
+        if (!f.fstatSync(fd).isFile())
+            return;
+        f.fchmodSync(fd, 0o600);
+        f.writeSync(fd, `${JSON.stringify(clean)}\n`);
+    }
+    finally {
+        f.closeSync(fd);
+    }
+}
+function asMark(v) {
+    if (!v || typeof v !== 'object' || Array.isArray(v))
+        return null;
+    const m = v;
+    if (!isStr(m.id) || !m.id || !isStr(m.at) || typeof m.failed !== 'boolean')
+        return null;
+    return isStr(m.tail) ? { id: m.id, at: m.at, failed: m.failed, tail: m.tail.slice(-MAX_TAIL) } : { id: m.id, at: m.at, failed: m.failed };
+}
+/** Read and truncate: the file is moved aside first, so a mark appended meanwhile waits for the next take. */
+export function takePostMarks(sessionId, env = process.env) {
+    const f = fs();
+    const path = postPath(sessionId, env);
+    const aside = `${path}.${process.pid}.${Math.random().toString(16).slice(2, 8)}.take`;
+    try {
+        f.renameSync(path, aside);
+    }
+    catch {
+        return [];
+    }
+    try {
+        const out = [];
+        for (const line of f.readFileSync(aside, 'utf8').split('\n')) {
+            if (!line.trim())
+                continue;
+            try {
+                const m = asMark(JSON.parse(line));
+                if (m)
+                    out.push(m);
+            }
+            catch { /* a broken line is skipped */ }
+        }
+        return out.slice(-MAX_MARKS);
+    }
+    catch {
+        return [];
+    }
+    finally {
+        try {
+            f.rmSync(aside, { force: true });
+        }
+        catch { /* nothing more to do */ }
+    }
+}
+/** settings.json's `skills === 'on'`, read with fs only. */
+export function skillsOnFast(env = process.env) {
+    try {
+        const v = JSON.parse(fs().readFileSync(join(trailHomeFast(env), 'settings.json'), 'utf8'));
+        return !!v && typeof v === 'object' && !Array.isArray(v) && v.skills === 'on';
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=gate-file.js.map

package/dist/trace/gate-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate-file.js","sourceRoot":"","sources":["../../src/trace/gate-file.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGnD,OAAO,EAAE,SAAS,EAAE,MAAM,YAAY,CAAC;AAyBvC,iFAAiF;AACjF,MAAM,cAAc,GAAG,EAAE,GAAG,IAAI,CAAC;AACjC,MAAM,QAAQ,GAAG,GAAG,CAAC;AACrB,MAAM,SAAS,GAAG,IAAI,CAAC;AAEvB,MAAM,EAAE,GAAG,GAAc,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAc,CAAC;AAC7E,MAAM,MAAM,GAAG,GAAkB,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAkB,CAAC;AAE7F,gFAAgF;AAChF,MAAM,UAAU,aAAa,CAAC,MAAyB,OAAO,CAAC,GAAG;IAChE,OAAO,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,CAAC;AAC9E,CAAC;AAED,4FAA4F;AAC5F,SAAS,MAAM,CAAC,SAAiB;IAC/B,IAAI,sCAAsC,CAAC,IAAI,CAAC,SAAS,CAAC;QAAE,OAAO,SAAS,CAAC;IAC7E,OAAO,KAAK,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;AACnG,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,WAAW,CAAC,SAAiB,EAAE,MAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACjG,OAAO,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,UAAU,EAAE,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,GAAG,MAAM,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAClF,OAAO,WAAW,CAAC,SAAS,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,QAAQ,CAAC,SAAiB,EAAE,GAAsB;IACzD,OAAO,WAAW,CAAC,SAAS,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC;AACpD,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;IACf,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE;YAAE,OAAO;IAChD,CAAC;IAAC,MAAM,CAAC,CAAC,yBAAyB,CAAC,CAAC;IACrC,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnD,MAAM,CAAC,GAAG,CAAC,CAAC,SAAS,CAAC;IACtB,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,CAAC,UAAU,KAAK,SAAS;QAAE,OAAO;IACvE,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,WAAW,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC;QAC7E,IAAI,CAAC;YAAC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;gBAAS,CAAC;YAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAAC,CAAC;IAC/D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,6EAA6E;QAC7E,IAAK,CAA2B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO;QAC3D,IAAI,CAAC;YAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,cAAc,EAAE;gBAAE,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAC7G,CAAC;AACH,CAAC;AAED,iCAAiC;AACjC,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;IACf,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1B,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;QACxC,IAAI,CAAC;YACH,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxB,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;QACD,CAAC,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IAC1B,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,IAAI,CAAC;YAAC,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;QAC1E,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AAED,MAAM,KAAK,GAAG,CAAC,CAAU,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;AACjE,MAAM,SAAS,GAAG,CAAC,CAAU,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,OAAO,CAAC,KAAK,QAAQ,CAAC;AAEtE,SAAS,UAAU,CAAC,CAAU;IAC5B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC9C,MAAM,CAAC,GAAG,CAAc,CAAC;IACzB,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;WAChH,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC;AACtF,CAAC;AAED,SAAS,SAAS,CAAC,CAAU;IAC3B,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClE,MAAM,CAAC,GAAG,CAAa,CAAC;IACxB,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;QAAE,OAAO,KAAK,CAAC;IACrF,OAAO,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;AACtJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAClF,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;QAC1C,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;QAC5B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,cAAc;YAAE,OAAO,IAAI,CAAC;QAC1D,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5D,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IACjC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,mFAAmF;AACnF,SAAS,QAAQ,CAAC,KAAe,EAAE,KAA+C;IAChF,MAAM,MAAM,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,IAAI,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC;IAC/G,MAAM,GAAG,GAAgB,EAAE,CAAC;IAC5B,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAE,CAAC;QAChC,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,GAAG,GAAG,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;QAChD,IAAI,IAAI,IAAI,IAAI,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,GAAG,CAAC;YAAE,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACpF,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC;IACxG,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,CAAY,EAAE,CAAY,EAAE,EAAE,CAC/C,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,KAAK,CAAC,MAAM,IAAI,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,CAAE,CAAC,IAAI,CAAC,CAAC;AAE1I,iJAAiJ;AACjJ,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,EAAqB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAC1G,MAAM,IAAI,GAAG,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACzC,MAAM,IAAI,GAAqB,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC3E,MAAM,MAAM,GAAG,GAAG,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,KAAK,CAAC,CAAC;QAC5D,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;YACtD,MAAM,IAAI,GAAG,MAAM,EAAE,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzD,OAAO,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,IAAI,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QACzJ,CAAC,CAAC,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpG,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC1K,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,IAAI,CAAC;YAAC,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACxE,OAAO;IACT,CAAC;IACD,gFAAgF;IAChF,IAAI,IAAI,GAAa,EAAE,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC;IACrD,IAAI,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAChC,OAAO,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,cAAc,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxE,IAAI,GAAG,EAAE,GAAG,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7C,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9B,CAAC;IACD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,OAAO,CAAC,SAAiB,EAAE,GAAsB,EAAE,MAAgC;IAC1F,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACnC,UAAU,CAAC,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5D,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,SAAiB,EAAE,KAAa,EAAE,KAAa,EAAE,SAAiB,EAAE,GAAS,EAAE,MAAyB,OAAO,CAAC,GAAG,EAAE,IAAa;IAC1J,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,MAAM,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC;QACpE,IAAI,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC;QAClC,MAAM,CAAC,UAAU,GAAG,IAAI,CAAC;QACzB,MAAM,CAAC,SAAS,GAAG,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;QAC1D,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,MAAM,UAAU,GAAG,CAAC,CAAC;AACrB,MAAM,WAAW,GAAG,CAAC,CAAU,EAAY,EAAE,CAC3C,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;AAEhK,wHAAwH;AACxH,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,KAAa,EAAE,IAAY,EAAE,GAAS,EAAE,MAAyB,OAAO,CAAC,GAAG;IACxH,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QAChD,IAAI,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM;YAAE,OAAO,KAAK,CAAC;QACrF,CAAC,CAAC,MAAM,GAAG,CAAC,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,CAAC,CAAC;QACzH,OAAO,IAAI,CAAC;IACd,CAAC,CAAC,CAAC;AACL,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IAChF,MAAM,CAAC,GAAG,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACvC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACtG,CAAC;AAED;sHACsH;AACtH,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,SAAiB,EAAE,GAAS,EAAE,MAAyB,OAAO,CAAC,GAAG;IAChH,IAAI,CAAC,SAAS;QAAE,OAAO,KAAK,CAAC;IAC7B,OAAO,OAAO,CAAC,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE;QACnC,IAAI,GAAG,GAAG,KAAK,CAAC;QAChB,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,IAAI;YAAE,KAAK,MAAM,GAAG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACnD,IAAI,GAAG,CAAC,cAAc,KAAK,SAAS,EAAE,CAAC;oBAAC,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;oBAAC,GAAG,GAAG,IAAI,CAAC;gBAAC,CAAC;YAC3F,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,IAAc,EAAE,MAAyB,OAAO,CAAC,GAAG;IACpG,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAa,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;IACnG,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC;IAC3E,UAAU,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;IAC1B,0GAA0G;IAC1G,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;IAC5E,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,UAAU,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;IAC/F,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,iEAAiE;QACjE,IAAK,CAA2B,CAAC,IAAI,KAAK,OAAO;YAAE,OAAO;QAC1D,MAAM,CAAC,CAAC;IACV,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,MAAM,EAAE;YAAE,OAAO;QACtC,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QACxB,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChD,CAAC;YAAS,CAAC;QACT,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;IAClB,CAAC;AACH,CAAC;AAED,SAAS,MAAM,CAAC,CAAU;IACxB,IAAI,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACjE,MAAM,CAAC,GAAG,CAA4B,CAAC;IACvC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACxF,OAAO,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC;AAC5I,CAAC;AAED,8GAA8G;AAC9G,MAAM,UAAU,aAAa,CAAC,SAAiB,EAAE,MAAyB,OAAO,CAAC,GAAG;IACnF,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;IACf,MAAM,IAAI,GAAG,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC;IACtF,IAAI,CAAC;QACH,CAAC,CAAC,UAAU,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,IAAI,CAAC;QACH,MAAM,GAAG,GAAe,EAAE,CAAC;QAC3B,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7D,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;gBAAE,SAAS;YAC3B,IAAI,CAAC;gBACH,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;gBACnC,IAAI,CAAC;oBAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YACrB,CAAC;YAAC,MAAM,CAAC,CAAC,8BAA8B,CAAC,CAAC;QAC5C,CAAC;QACD,OAAO,GAAG,CAAC,KAAK,CAAC,CAAC,SAAS,CAAC,CAAC;IAC/B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,CAAC,CAAC,MAAM,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,wBAAwB,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,YAAY,CAAC,MAAyB,OAAO,CAAC,GAAG;IAC/D,IAAI,CAAC;QACH,MAAM,CAAC,GAAY,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,eAAe,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACpG,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAK,CAA0B,CAAC,MAAM,KAAK,IAAI,CAAC;IAC1G,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}

package/dist/trace/guard-fast.d.ts

@@ -0,0 +1,22 @@
+/** J16's words, then the way out (R29), as information about the denied command (D88). */
+export declare const SURE_FAIL_REASON: string;
+/**
+ * Where `timeout` lives when the hook's PATH is narrower than the shell's (4.11 step 3, R29). `$HOME` is env.HOME,
+ * `$USER` env.USER. Review: nix-darwin's per-user profile joins 4.11's list. /usr/bin and /bin stay out: a hook's
+ * PATH always holds them, and on Linux (where coreutils puts timeout there) they would hide the deny path from CI.
+ */
+export declare const FIXED_DIRS: readonly string[];
+/** The PATH's folders, split on the platform's delimiter (';' on Windows), absolute ones only. */
+export declare function pathDirs(env: NodeJS.ProcessEnv): string[];
+/** The file names a program can have: itself, and on Windows with each PATHEXT ending too (git.exe, npm.cmd). */
+export declare function programFiles(name: string, env: NodeJS.ProcessEnv): string[];
+/** PATH dirs from env, then the fixed folders of 4.11. */
+export declare function timeoutOnPath(env: NodeJS.ProcessEnv): boolean;
+/** Reads <trail home>/learnings/no-timeout.md (under 1 KB) when it exists. Deny only when sure (4.11). */
+export declare function sureFail(command: string, env: NodeJS.ProcessEnv): {
+    deny: string;
+    check: 'no-timeout';
+} | null;
+/** Appends {at, restSha} to sessions/<id>.denied.jsonl (O_APPEND, 0600, 4 KB cap) for the avoided credit. */
+export declare function markDenied(sessionId: string, command: string, env: NodeJS.ProcessEnv, now?: Date): void;
+//# sourceMappingURL=guard-fast.d.ts.map

package/dist/trace/guard-fast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-fast.d.ts","sourceRoot":"","sources":["../../src/trace/guard-fast.ts"],"names":[],"mappings":"AAuBA,0FAA0F;AAC1F,eAAO,MAAM,gBAAgB,QAG2E,CAAC;AAEzG;;;;GAIG;AACH,eAAO,MAAM,UAAU,EAAE,SAAS,MAAM,EAKtC,CAAC;AAmFH,kGAAkG;AAClG,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,CAEzD;AAED,iHAAiH;AACjH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,MAAM,EAAE,CAI3E;AAkBD,0DAA0D;AAC1D,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG,OAAO,CAW7D;AAED,0GAA0G;AAC1G,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,YAAY,CAAA;CAAE,GAAG,IAAI,CAU9G;AAED,6GAA6G;AAC7G,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,CAAC,UAAU,EAAE,GAAG,GAAE,IAAiB,GAAG,IAAI,CAsBnH"}

package/dist/trace/guard-fast.js

@@ -0,0 +1,213 @@
+/**
+ * The sure-fail guardrail on the PreToolUse fast path (design 4.11): when
+ * the person kept the no-timeout guardrail, a `timeout N ...` command is
+ * denied, but only when no `timeout` program exists on this machine, so the
+ * command would fail anyway. Nothing else is ever denied here, and anything
+ * odd (no file, a retired or edited one, a read that throws) allows.
+ *
+ * The caller decides whether skills are on (0 rule 1); this file only reads
+ * `<trail home>/learnings/no-timeout.md` (one small file, R56).
+ *
+ * Fast-path safe (0 rule 8): static imports are node:path, node:os and the
+ * shell lexer files already on the path; node:fs and node:crypto come from
+ * `process.getBuiltinModule`. TRAIL_HOME is resolved as gate-file.ts does.
+ */
+import { homedir, userInfo } from 'node:os';
+import { delimiter, dirname, isAbsolute, join } from 'node:path';
+import { sessionPath, trailHomeFast } from './gate-file.js';
+import { normalizeCommand, stripTimeout } from './shell.js';
+import { afterTimeout, simpleCommands } from './shell-words.js';
+import { ASSIGN, words } from './shell-scan.js';
+/** J16's words, then the way out (R29), as information about the denied command (D88). */
+export const SURE_FAIL_REASON = '[trail] Trail, the tool this person installed, stopped this command before it ran: '
+    + 'this Mac has no timeout program (a guardrail this person kept), so it would fail with "timeout: command not found". '
+    + "The usual fix is the same command without timeout, using the Bash tool's own timeout parameter or run_in_background. "
+    + 'If timeout is installed here now, the person can drop this guardrail with trail forget no-timeout.';
+/**
+ * Where `timeout` lives when the hook's PATH is narrower than the shell's (4.11 step 3, R29). `$HOME` is env.HOME,
+ * `$USER` env.USER. Review: nix-darwin's per-user profile joins 4.11's list. /usr/bin and /bin stay out: a hook's
+ * PATH always holds them, and on Linux (where coreutils puts timeout there) they would hide the deny path from CI.
+ */
+export const FIXED_DIRS = Object.freeze([
+    '/opt/homebrew/bin', '/usr/local/bin', '/opt/homebrew/opt/coreutils/libexec/gnubin', '/usr/local/opt/coreutils/libexec/gnubin',
+    '/opt/local/bin', '/opt/local/libexec/gnubin', '$HOME/.nix-profile/bin', '/run/current-system/sw/bin',
+    '/nix/var/nix/profiles/default/bin', '$HOME/bin', '$HOME/.local/bin',
+    '/etc/profiles/per-user/$USER/bin',
+]);
+const MAX_FILE = 4 * 1024;
+/** A longer command is allowed unread: the deny is only for when Trail is sure, and parsing 2 MB took 150 ms here. */
+const MAX_COMMAND = 64 * 1024;
+const MAX_DENIED = 4 * 1024;
+const fs = () => process.getBuiltinModule('node:fs');
+const crypto = () => process.getBuiltinModule('node:crypto');
+/** A front-matter value: quotes and padding gone, lower case. */
+const value = (raw) => raw.trim().replace(/^(['"])(.*)\1$/, '$2').trim().toLowerCase();
+/** The guardrail file says: active, check no-timeout, enforce sure-fail (2.5). Anything else, or a read error: false. */
+function guardrailKept(env) {
+    const f = fs();
+    let text;
+    try {
+        const path = join(trailHomeFast(env), 'learnings', 'no-timeout.md');
+        // O_NONBLOCK: a FIFO planted here would otherwise hold the hook until its 5 s run out.
+        const fd = f.openSync(path, f.constants.O_RDONLY | (f.constants.O_NOFOLLOW ?? 0) | (f.constants.O_NONBLOCK ?? 0));
+        try {
+            const st = f.fstatSync(fd);
+            if (!st.isFile() || st.size > MAX_FILE)
+                return false;
+            const buf = Buffer.alloc(st.size);
+            const n = f.readSync(fd, buf, 0, st.size, 0);
+            text = buf.toString('utf8', 0, n);
+        }
+        finally {
+            f.closeSync(fd);
+        }
+    }
+    catch {
+        return false;
+    }
+    const m = /^---\r?\n([\s\S]*?)\r?\n---(?:\r?\n|$)/.exec(text);
+    if (!m)
+        return false;
+    const fm = {};
+    for (const line of m[1].split(/\r?\n/)) {
+        const kv = /^([a-z]+):(.*)$/.exec(line);
+        if (kv)
+            fm[kv[1]] = value(kv[2]);
+    }
+    return (fm.status ?? 'active') === 'active' && fm.check === 'no-timeout' && fm.enforce === 'sure-fail';
+}
+/** The words of a simple command after env prefixes (`A=1`, `env [-i] [-u N] A=1`). */
+function afterEnv(simple) {
+    let w = words(simple);
+    while (w.length && ASSIGN.test(w[0]))
+        w = w.slice(1);
+    if (w[0] === 'env') {
+        let i = 1;
+        while (i < w.length && (w[i].startsWith('-') || ASSIGN.test(w[i])))
+            i += /^-[uCS]$/.test(w[i]) ? 2 : 1;
+        w = w.slice(i);
+    }
+    return w;
+}
+/** `timeout() {`, `function timeout`, `alias timeout=` anywhere in the command: its own timeout, so not sure (R29). */
+const OWN_TIMEOUT = /(?:^|[\s;&|({])(?:timeout\s*\(\s*\)|function\s+timeout\b|alias\s+(?:-\S+\s+)*['"]?timeout=)/;
+/**
+ * The command may find a `timeout` the hook can't see: it changes PATH, or loads the person's shell setup
+ * (`source`, `.`, `eval`, `hash`), whose PATH, alias or function Trail can't read. Not sure, so allow.
+ */
+const CHANGES_LOOKUP = /(?:^|[\s;&|({`])(?:(?:export|typeset|declare|local|readonly)\s+(?:-\S+\s+)*)?(?:PATH|path)\+?=|(?:^|[\s;&|({`])(?:source|eval|hash|rehash)(?:\s|$)|(?:^|[\s;&|({`])\.\s+\S/;
+/** How many simple commands run `timeout DURATION ...` (after env prefixes). `gtimeout` never. */
+function timeoutRuns(command) {
+    let n = 0;
+    for (const s of simpleCommands(command)) {
+        const w = afterEnv(s);
+        if (w[0] === 'timeout' && afterTimeout(w) !== null)
+            n++;
+    }
+    return n;
+}
+/**
+ * Sure only when every `timeout` in the command is one of those runs. Any other (`command -v timeout &&`,
+ * `which timeout`, `[[ -x …/timeout ]]`, `ln -s … ~/bin/timeout`, a function or alias) means the command looks for
+ * one, falls back, or puts one in place: it may well not fail, so it is allowed (R29).
+ */
+function onlyRunsTimeout(command) {
+    const runs = timeoutRuns(command);
+    return runs > 0 && (command.match(/\btimeout\b/g) ?? []).length === runs;
+}
+/** The PATH's folders, split on the platform's delimiter (';' on Windows), absolute ones only. */
+export function pathDirs(env) {
+    return String(env.PATH ?? '').split(delimiter).filter((d) => d !== '' && isAbsolute(d));
+}
+/** The file names a program can have: itself, and on Windows with each PATHEXT ending too (git.exe, npm.cmd). */
+export function programFiles(name, env) {
+    if (process.platform !== 'win32')
+        return [name];
+    const exts = String(env.PATHEXT || '.COM;.EXE;.BAT;.CMD').split(';').map((e) => e.trim().toLowerCase()).filter((e) => /^\.[a-z0-9]{1,8}$/.test(e));
+    return [name, ...exts.map((e) => name + e)];
+}
+/** An executable regular file at `dir/timeout` (on Windows, which has no exec bit, any timeout.exe and the like). */
+function executableIn(dir, env) {
+    if (!dir)
+        return false;
+    const f = fs();
+    return programFiles('timeout', env).some((name) => {
+        try {
+            const p = join(dir, name);
+            if (!f.statSync(p).isFile())
+                return false;
+            f.accessSync(p, f.constants.X_OK);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    });
+}
+/** PATH dirs from env, then the fixed folders of 4.11. */
+export function timeoutOnPath(env) {
+    const home = env.HOME || homedir();
+    let user = env.USER || env.LOGNAME || '';
+    if (!user)
+        try {
+            user = userInfo().username;
+        }
+        catch { /* none */ }
+    const dirs = pathDirs(env);
+    for (const d of FIXED_DIRS) {
+        if (d.startsWith('$HOME'))
+            dirs.push(join(home, d.slice('$HOME'.length)));
+        else if (d.includes('$USER')) {
+            if (/^[\w.-]{1,64}$/.test(user))
+                dirs.push(d.replace('$USER', user));
+        }
+        else
+            dirs.push(d);
+    }
+    return [...new Set(dirs)].some((d) => executableIn(d, env));
+}
+/** Reads <trail home>/learnings/no-timeout.md (under 1 KB) when it exists. Deny only when sure (4.11). */
+export function sureFail(command, env) {
+    try {
+        if (typeof command !== 'string' || command.length > MAX_COMMAND || !/\btimeout\b/.test(command))
+            return null;
+        if (!onlyRunsTimeout(command) || OWN_TIMEOUT.test(command) || CHANGES_LOOKUP.test(command))
+            return null;
+        if (!guardrailKept(env))
+            return null;
+        if (timeoutOnPath(env))
+            return null;
+        return { deny: SURE_FAIL_REASON, check: 'no-timeout' };
+    }
+    catch {
+        return null;
+    }
+}
+/** Appends {at, restSha} to sessions/<id>.denied.jsonl (O_APPEND, 0600, 4 KB cap) for the avoided credit. */
+export function markDenied(sessionId, command, env, now = new Date()) {
+    try {
+        const f = fs();
+        const path = sessionPath(String(sessionId), '.denied.jsonl', env);
+        const rest = normalizeCommand(stripTimeout(String(command ?? '')));
+        const line = `${JSON.stringify({ at: now.toISOString(), restSha: `sha256:${crypto().createHash('sha256').update(rest).digest('hex')}` })}\n`;
+        const dir = dirname(path);
+        f.mkdirSync(dir, { recursive: true, mode: 0o700 });
+        const { O_WRONLY, O_APPEND, O_CREAT, O_NOFOLLOW, O_NONBLOCK } = f.constants;
+        // O_NONBLOCK: a FIFO planted here would otherwise hold the hook until its 5 s run out (with no reader, ENXIO).
+        const fd = f.openSync(path, O_WRONLY | O_APPEND | O_CREAT | (O_NOFOLLOW ?? 0) | (O_NONBLOCK ?? 0), 0o600);
+        try {
+            const st = f.fstatSync(fd);
+            if (!st.isFile() || st.size + Buffer.byteLength(line) > MAX_DENIED)
+                return;
+            f.fchmodSync(fd, 0o600);
+            f.writeSync(fd, line);
+        }
+        finally {
+            f.closeSync(fd);
+        }
+    }
+    catch {
+        /* the avoided count is best effort */
+    }
+}
+//# sourceMappingURL=guard-fast.js.map

package/dist/trace/guard-fast.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"guard-fast.js","sourceRoot":"","sources":["../../src/trace/guard-fast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC5C,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAGjE,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAChE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,iBAAiB,CAAC;AAEhD,0FAA0F;AAC1F,MAAM,CAAC,MAAM,gBAAgB,GAAG,qFAAqF;MACjH,sHAAsH;MACtH,uHAAuH;MACvH,oGAAoG,CAAC;AAEzG;;;;GAIG;AACH,MAAM,CAAC,MAAM,UAAU,GAAsB,MAAM,CAAC,MAAM,CAAC;IACzD,mBAAmB,EAAE,gBAAgB,EAAE,4CAA4C,EAAE,yCAAyC;IAC9H,gBAAgB,EAAE,2BAA2B,EAAE,wBAAwB,EAAE,4BAA4B;IACrG,mCAAmC,EAAE,WAAW,EAAE,kBAAkB;IACpE,kCAAkC;CACnC,CAAC,CAAC;AAEH,MAAM,QAAQ,GAAG,CAAC,GAAG,IAAI,CAAC;AAC1B,sHAAsH;AACtH,MAAM,WAAW,GAAG,EAAE,GAAG,IAAI,CAAC;AAC9B,MAAM,UAAU,GAAG,CAAC,GAAG,IAAI,CAAC;AAC5B,MAAM,EAAE,GAAG,GAAc,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,SAAS,CAAc,CAAC;AAC7E,MAAM,MAAM,GAAG,GAAkB,EAAE,CAAC,OAAO,CAAC,gBAAgB,CAAC,aAAa,CAAkB,CAAC;AAE7F,iEAAiE;AACjE,MAAM,KAAK,GAAG,CAAC,GAAW,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,gBAAgB,EAAE,IAAI,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAE/F,yHAAyH;AACzH,SAAS,aAAa,CAAC,GAAsB;IAC3C,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;IACf,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,EAAE,WAAW,EAAE,eAAe,CAAC,CAAC;QACpE,uFAAuF;QACvF,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAClH,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,QAAQ;gBAAE,OAAO,KAAK,CAAC;YACrD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC;YAClC,MAAM,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,GAAG,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC7C,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC;QACpC,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,CAAC,GAAG,wCAAwC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC9D,IAAI,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IACrB,MAAM,EAAE,GAA2B,EAAE,CAAC;IACtC,KAAK,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,EAAE,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACxC,IAAI,EAAE;YAAE,EAAE,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAE,CAAC,CAAC;IACrC,CAAC;IACD,OAAO,CAAC,EAAE,CAAC,MAAM,IAAI,QAAQ,CAAC,KAAK,QAAQ,IAAI,EAAE,CAAC,KAAK,KAAK,YAAY,IAAI,EAAE,CAAC,OAAO,KAAK,WAAW,CAAC;AACzG,CAAC;AAED,uFAAuF;AACvF,SAAS,QAAQ,CAAC,MAAc;IAC9B,IAAI,CAAC,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IACtB,OAAO,CAAC,CAAC,MAAM,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;QAAE,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACtD,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,EAAE,CAAC;QACnB,IAAI,CAAC,GAAG,CAAC,CAAC;QACV,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC;YAAE,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC1G,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED,uHAAuH;AACvH,MAAM,WAAW,GAAG,6FAA6F,CAAC;AAElH;;;GAGG;AACH,MAAM,cAAc,GAAG,4KAA4K,CAAC;AAEpM,kGAAkG;AAClG,SAAS,WAAW,CAAC,OAAe;IAClC,IAAI,CAAC,GAAG,CAAC,CAAC;IACV,KAAK,MAAM,CAAC,IAAI,cAAc,CAAC,OAAO,CAAC,EAAE,CAAC;QACxC,MAAM,CAAC,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;QACtB,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,YAAY,CAAC,CAAC,CAAC,KAAK,IAAI;YAAE,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,OAAe;IACtC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,cAAc,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;AAC3E,CAAC;AAED,kGAAkG;AAClG,MAAM,UAAU,QAAQ,CAAC,GAAsB;IAC7C,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,EAAE,IAAI,UAAU,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,iHAAiH;AACjH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,GAAsB;IAC/D,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,qBAAqB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IACnJ,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,qHAAqH;AACrH,SAAS,YAAY,CAAC,GAAW,EAAE,GAAsB;IACvD,IAAI,CAAC,GAAG;QAAE,OAAO,KAAK,CAAC;IACvB,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;IACf,OAAO,YAAY,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE;QAChD,IAAI,CAAC;YACH,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE;gBAAE,OAAO,KAAK,CAAC;YAC1C,CAAC,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;YAClC,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,0DAA0D;AAC1D,MAAM,UAAU,aAAa,CAAC,GAAsB;IAClD,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;IACnC,IAAI,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IACzC,IAAI,CAAC,IAAI;QAAE,IAAI,CAAC;YAAC,IAAI,GAAG,QAAQ,EAAE,CAAC,QAAQ,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,UAAU,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,UAAU,EAAE,CAAC;QAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;aACrE,IAAI,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC;QAAC,CAAC;;YAClG,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,CAAC;IACD,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AAC9D,CAAC;AAED,0GAA0G;AAC1G,MAAM,UAAU,QAAQ,CAAC,OAAe,EAAE,GAAsB;IAC9D,IAAI,CAAC;QACH,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,CAAC,MAAM,GAAG,WAAW,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7G,IAAI,CAAC,eAAe,CAAC,OAAO,CAAC,IAAI,WAAW,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,OAAO,IAAI,CAAC;QACxG,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACrC,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,OAAO,IAAI,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,6GAA6G;AAC7G,MAAM,UAAU,UAAU,CAAC,SAAiB,EAAE,OAAe,EAAE,GAAsB,EAAE,MAAY,IAAI,IAAI,EAAE;IAC3G,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,EAAE,EAAE,CAAC;QACf,MAAM,IAAI,GAAG,WAAW,CAAC,MAAM,CAAC,SAAS,CAAC,EAAE,eAAe,EAAE,GAAG,CAAC,CAAC;QAClE,MAAM,IAAI,GAAG,gBAAgB,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACnE,MAAM,IAAI,GAAG,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,WAAW,EAAE,EAAE,OAAO,EAAE,UAAU,MAAM,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC;QAC7I,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1B,CAAC,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACnD,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC;QAC5E,+GAA+G;QAC/G,MAAM,EAAE,GAAG,CAAC,CAAC,QAAQ,CAAC,IAAI,EAAE,QAAQ,GAAG,QAAQ,GAAG,OAAO,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,GAAG,CAAC,UAAU,IAAI,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;QAC1G,IAAI,CAAC;YACH,MAAM,EAAE,GAAG,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YAC3B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,IAAI,GAAG,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,UAAU;gBAAE,OAAO;YAC3E,CAAC,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;YACxB,CAAC,CAAC,SAAS,CAAC,EAAE,EAAE,IAAI,CAAC,CAAC;QACxB,CAAC;gBAAS,CAAC;YACT,CAAC,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC"}

package/dist/trace/host.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Which agent sent a hook payload, and how much of what it did its transcript
+ * keeps. Worked out from the payload itself, before any transcript is parsed,
+ * never from the settings file that fired the hook: Cursor and Copilot CLI run
+ * the Claude Code hooks in `.claude/settings.json` too, so a payload on a
+ * Claude hook can carry a Cursor or Copilot transcript path. Parsed as Claude,
+ * such a file shows no typed words and no tool results, and every save would
+ * look like the agent's own.
+ *
+ * Tiers (how far Trail can trust the record):
+ *  - A: typed words told apart, tool calls, results with a failure signal,
+ *    compactions. Claude Code.
+ *  - B: a full record whose host checks aren't written up yet. Codex, until HC1 to HC12 are (P31): its rollouts
+ *    are read and folded (phase 2), but learning stays off.
+ *  - C: typed words, calls at best, no results Trail can read. Copilot CLI,
+ *    Gemini CLI (no hooks wired, no parser yet).
+ *  - D: nothing Trail can read, or a shape it doesn't know. Cursor (its
+ *    transcripts keep no results), anything unknown.
+ * Only tier A can make a live item; everything else is held for a yes.
+ *
+ * `subagent` is set when the payload comes from a subagent's tool call or
+ * stop (Claude Code adds `agent_id` there, never on the main thread). Its
+ * transcript path still names the parent session, so the caller stays out.
+ */
+export type Host = "claude" | "codex" | "cursor" | "copilot" | "gemini" | "unknown";
+export type Tier = "A" | "B" | "C" | "D";
+export interface HostInfo {
+    host: Host;
+    tier: Tier;
+    subagent?: true;
+}
+/**
+ * Codex's tier (design 4.18, P31): the one constant that flips to "A", in the commit that writes up HC1 to HC12 in
+ * host-checks.md and passes the Codex legs of J04, J10 and J13 in a real session. Until then a test home may set
+ * TRAIL_TIER_CODEX=A (host-facts.ts `hostTier`).
+ */
+export declare const CODEX_TIER: Tier;
+/** The host that sent `payload` and its tier. Never throws; anything unreadable is unknown. */
+export declare function detectHost(payload: unknown): HostInfo;
+//# sourceMappingURL=host.d.ts.map