@rulemetric/cli 0.3.0 → 0.4.0

package/dist/commands/hooks/install.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/commands/hooks/install.ts"],
-  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { execFileSync, execSync, spawnSync } from 'node:child_process';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport { isGatewayRunning, spawnGateway, GATEWAY_PORT } from '../../lib/gateway-lifecycle.js';\n\n// True iff `rulemetric service install` has wired the gateway up as a launchd\n// agent. When this returns true, hooks install must NOT spawn its own\n// detached gateway \u2014 two processes fighting for :8787 means one crash-loops\n// and Claude Code's HTTPS_PROXY breaks.\nfunction isGatewayLaunchdManaged(): boolean {\n  try {\n    execFileSync('launchctl', ['list', 'com.rulemetric.gateway'], {\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    return true;\n  } catch {\n    // Non-zero exit = label not loaded\n    return false;\n  }\n}\nimport {\n  writeStatuslineShim,\n  readCurrentStatusLine,\n  isStatuslineShimInstalled,\n  STATUSLINE_SETTINGS_VALUE,\n} from '../../lib/statusline-shim.js';\nimport {\n  writeCursorProxyConfig,\n  writeCursorUserProxyConfig,\n  writeVSCodeProxyConfig,\n  installMacOSProxyEnv,\n  writeVSCodeUserProxyConfig,\n  writeCursorHooks,\n  writeCursorUserHooks,\n  writeCopilotHooks,\n  writeAntigravityHooks,\n  writeAntigravityUserHooks,\n} from '../../lib/hooks-config.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { detectTmux } from '../../lib/detect-tmux.js';\n\nconst CERT_PATH = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n\nexport default class HooksInstall extends BaseCommand {\n  static override description = 'Install session tracking hooks and context capture proxy for Claude Code';\n\n  static override examples = [\n    '<%= config.bin %> hooks install',\n    '<%= config.bin %> hooks install --global',\n    '<%= config.bin %> hooks install --no-proxy',\n  ];\n\n  static override flags = {\n    'no-proxy': Flags.boolean({\n      default: false,\n      description: 'Skip proxy/gateway configuration (hooks only)',\n    }),\n    'project-dir': Flags.string({\n      description: 'Project directory to install hooks in (defaults to cwd)',\n    }),\n    global: Flags.boolean({\n      char: 'g',\n      default: false,\n      description: 'Install hooks globally (~/.claude/settings.json) so all projects are tracked',\n    }),\n    'statusline-usage': Flags.boolean({\n      default: false,\n      description: 'Install the statusline shim so Claude Code pushes live rate_limits on every refresh (makes /usage rings update in real time without needing the proxy)',\n    }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(HooksInstall);\n    const isGlobal = flags.global;\n    const projectPath = isGlobal ? homedir() : (flags['project-dir'] ?? process.cwd());\n    const configDir = join(projectPath, '.claude');\n    const configPath = join(configDir, 'settings.json');\n    const noProxy = flags['no-proxy'];\n\n    if (isGlobal) {\n      this.log(`Installing hooks globally \u2192 ${configPath}`);\n    }\n\n    // Read or create .claude/settings.json\n    let settings: Record<string, unknown> = {};\n    if (existsSync(configPath)) {\n      settings = JSON.parse(readFileSync(configPath, 'utf-8'));\n    }\n\n    // \u2500\u2500 1. Remove legacy rulemetric hooks (session data now comes from the\n    // proxy + local file providers). Only strip entries whose command invokes\n    // rulemetric \u2014 the user's own hooks must survive an install run.\n    if (settings.hooks && typeof settings.hooks === 'object') {\n      const hooks = settings.hooks as Record<string, Array<{ matcher?: string; hooks?: Array<{ command?: string }> }>>;\n      let removed = 0;\n      for (const event of Object.keys(hooks)) {\n        const entries = hooks[event];\n        if (!Array.isArray(entries)) continue;\n        const kept = entries.filter((entry) => {\n          const isRulemetric = entry?.hooks?.some((h) => typeof h?.command === 'string' && h.command.includes('rulemetric'));\n          if (isRulemetric) removed += 1;\n          return !isRulemetric;\n        });\n        if (kept.length === 0) delete hooks[event];\n        else hooks[event] = kept;\n      }\n      if (Object.keys(hooks).length === 0) delete settings.hooks;\n      if (removed > 0) this.log(`[OK] Removed ${removed} legacy rulemetric session hook(s) (no longer needed)`);\n    }\n\n    // \u2500\u2500 2. Configure gateway + proxy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    if (!noProxy) {\n      // Ensure mitmproxy is available\n      const hasMitmproxy = this.findBinary('mitmdump');\n      if (!hasMitmproxy) {\n        this.log('');\n        this.log('[!!] mitmproxy not found \u2014 installing...');\n        const installed = this.installMitmproxy();\n        if (!installed) {\n          this.log('[!!] Could not install mitmproxy. Skipping proxy config.');\n          this.log('     Install manually: pipx install mitmproxy');\n          this.log('     Then re-run: rulemetric hooks install');\n        }\n      }\n\n      // Generate CA cert if missing\n      if (!existsSync(CERT_PATH)) {\n        this.log('[..] Generating CA certificate...');\n        const mitmdump = this.findBinary('mitmdump');\n        if (mitmdump) {\n          spawnSync(mitmdump, ['--set', 'listen_port=0', '-q'], {\n            timeout: 5000,\n            stdio: 'ignore',\n          });\n          if (existsSync(CERT_PATH)) {\n            this.log(`[OK] CA certificate generated at ${CERT_PATH}`);\n          } else {\n            this.log('[!!] Could not generate CA cert');\n          }\n        }\n      } else {\n        this.log('[OK] CA certificate found');\n      }\n\n      // Trust CA cert in system store (if not already trusted)\n      if (existsSync(CERT_PATH) && !this.isCACertTrusted()) {\n        this.log('[..] Installing CA certificate into system trust store (requires admin)...');\n        const trusted = this.trustCACert();\n        if (trusted) {\n          this.log('[OK] CA certificate trusted by system');\n        } else {\n          this.log('[!!] Could not install CA cert automatically.');\n          if (process.platform === 'darwin') {\n            this.log(`     Run manually: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${CERT_PATH}`);\n          } else if (process.platform === 'linux') {\n            this.log(`     Run manually: sudo cp ${CERT_PATH} /usr/local/share/ca-certificates/mitmproxy-ca.crt && sudo update-ca-certificates`);\n          }\n        }\n      } else if (existsSync(CERT_PATH)) {\n        this.log('[OK] CA certificate already trusted');\n      }\n\n      // Set permanent HTTPS_PROXY and NODE_EXTRA_CA_CERTS in settings.json\n      // These point to the gateway (always running), not mitmproxy directly\n      const env = (settings.env ?? {}) as Record<string, string>;\n      env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;\n      // Bypass proxy for non-Anthropic traffic (Supabase auth, npm, etc.)\n      env.NO_PROXY = 'localhost,127.0.0.1,*.supabase.co,*.supabase.in';\n      if (existsSync(CERT_PATH)) {\n        env.NODE_EXTRA_CA_CERTS = CERT_PATH;\n      }\n      settings.env = env;\n      this.log(`[OK] HTTPS_PROXY set to gateway on :${GATEWAY_PORT} (permanent)`);\n\n      // Configure Cursor proxy (if .cursor/ exists)\n      const cursorProxy = writeCursorProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n      if (cursorProxy) {\n        this.log('[OK] Cursor proxy configured \u2192 .cursor/settings.json');\n      }\n\n      // Configure VS Code proxy for Copilot capture (workspace settings)\n      const vscodeProxy = writeVSCodeProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n      if (vscodeProxy) {\n        this.log('[OK] VS Code workspace proxy configured \u2192 .vscode/settings.json');\n      }\n\n      // Set http.proxy in VS Code user settings (workspace-level is silently ignored\n      // for http.proxy due to APPLICATION scope \u2014 microsoft/vscode#236932)\n      const vscodeUserProxy = writeVSCodeUserProxyConfig(GATEWAY_PORT);\n      if (vscodeUserProxy) {\n        this.log('[OK] VS Code user proxy configured \u2192 ~/Library/Application Support/Code/User/settings.json');\n      }\n\n      // Same for Cursor (VS Code fork inherits the APPLICATION-scope restriction).\n      const cursorUserProxy = writeCursorUserProxyConfig(GATEWAY_PORT);\n      if (cursorUserProxy) {\n        this.log('[OK] Cursor user proxy configured \u2192 ~/Library/Application Support/Cursor/User/settings.json');\n      }\n\n      // Set HTTPS_PROXY for all GUI apps via launchctl + LaunchAgent (macOS)\n      // Copilot reads process.env.HTTPS_PROXY directly \u2014 VS Code settings alone\n      // are insufficient because workspace http.proxy is ignored and extensions\n      // may bypass vscode-proxy-agent (microsoft/vscode#12588)\n      const macProxy = installMacOSProxyEnv(GATEWAY_PORT, CERT_PATH);\n      if (macProxy) {\n        this.log('[OK] HTTPS_PROXY set for GUI apps (launchctl + LaunchAgent)');\n      }\n\n      // Start gateway if not already running. Three possible owners (in order\n      // of precedence):\n      //   1. launchd (`rulemetric service install` plist) \u2014 authoritative;\n      //      hooks must NOT spawn a competing copy that would fight for :8787\n      //   2. legacy PID-file (this same code path from a previous run)\n      //   3. nothing \u2014 spawn a fresh detached process\n      if (isGatewayLaunchdManaged()) {\n        this.log('[OK] Gateway managed by launchd (com.rulemetric.gateway)');\n      } else if (isGatewayRunning()) {\n        this.log('[OK] Gateway already running');\n      } else {\n        try {\n          const pid = spawnGateway(this.config.version);\n          this.log(`[OK] Gateway started (PID ${pid})`);\n        } catch (err) {\n          this.log(`[!!] Could not start gateway: ${(err as Error).message}`);\n          this.log('     The session-start hook will auto-start it on next Claude Code session.');\n        }\n      }\n    }\n\n    // \u2500\u2500 3. Write Cursor + Copilot hook configs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // These are independent of the proxy (they capture editor lifecycle\n    // events, not LLM traffic), so they run regardless of --no-proxy. Both\n    // helpers no-op when the target directory (.cursor/ or .github/)\n    // doesn't exist.\n    if (!isGlobal) {\n      const cursorHooks = writeCursorHooks(projectPath);\n      if (cursorHooks) {\n        this.log(`[OK] Cursor hooks configured \u2192 ${cursorHooks}`);\n      }\n\n      const copilotHooks = writeCopilotHooks(projectPath);\n      if (copilotHooks) {\n        this.log(`[OK] Copilot Agent hooks configured \u2192 ${copilotHooks}`);\n      }\n\n      const antigravityHooks = writeAntigravityHooks(projectPath);\n      if (antigravityHooks) {\n        this.log(`[OK] Antigravity workspace hooks configured \u2192 ${antigravityHooks}`);\n      }\n    }\n\n    // User-level Antigravity hooks at ~/.gemini/config/hooks.json. Required\n    // because the GUI Antigravity process is launched once per machine and\n    // covers any workspace the user opens, not just the install-time cwd.\n    const antigravityUserHooks = writeAntigravityUserHooks();\n    if (antigravityUserHooks) {\n      this.log(`[OK] Antigravity user hooks configured \u2192 ${antigravityUserHooks}`);\n    }\n\n    // User-level Cursor hooks (~/.cursor/hooks.json) are required for global\n    // capture because Cursor's chat traffic bypasses HTTP proxies (HTTP/2\n    // multiplexed persistent connection \u2014 see cursor.com/docs/hooks). Without\n    // hooks, we get zero Cursor visibility for sessions outside this project.\n    // Runs in both --global and per-project modes since the user file is\n    // machine-wide either way.\n    const cursorUserHooks = writeCursorUserHooks();\n    if (cursorUserHooks) {\n      this.log(`[OK] Cursor user hooks configured \u2192 ${cursorUserHooks}`);\n    }\n\n    // \u2500\u2500 4. Statusline shim (rate_limits freshness) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // When --statusline-usage is set, write ~/.claude/statusline-rulemetric.sh\n    // and point settings.statusLine at it. If the user already has a statusLine\n    // command configured, chain it so their prompt text is preserved.\n    if (flags['statusline-usage']) {\n      if (isStatuslineShimInstalled(settings)) {\n        this.log('[OK] Statusline shim already installed');\n      } else {\n        const prevCmd = readCurrentStatusLine(settings);\n        writeStatuslineShim(prevCmd);\n        settings.statusLine = STATUSLINE_SETTINGS_VALUE;\n        if (prevCmd) {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command} (chains to: ${prevCmd})`);\n        } else {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command}`);\n        }\n        this.log('     Rate-limit rings will now update on Claude Code\\'s statusline refresh cadence');\n      }\n    }\n\n    // \u2500\u2500 5. Write Claude Code settings \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    mkdirSync(configDir, { recursive: true });\n    writeFileSync(configPath, JSON.stringify(settings, null, 2) + '\\n');\n\n    this.log('');\n    this.log('Setup complete! Next steps:');\n    if (isGlobal) {\n      this.log('  1. Install always-on API:    rulemetric service install');\n      this.log('  2. Start Claude Code in any project \u2014 all sessions tracked automatically');\n      this.log('');\n      this.log('The API service starts on login and restarts on crash.');\n    } else if (!noProxy) {\n      this.log('  1. Start the capture proxy:  rulemetric proxy start');\n      this.log('  2. Start Claude Code \u2014 context will be captured automatically');\n      this.log('');\n      this.log('The gateway routes traffic direct when the proxy is off \u2014 Claude Code always works.');\n      this.log('');\n      this.log('To capture traffic from other clients (Python, curl, etc.):');\n      this.log('  eval \"$(rulemetric proxy env --all)\"');\n    } else {\n      this.log('  1. Start Claude Code \u2014 session events will be tracked');\n      this.log('     (Run without --no-proxy to also capture system prompts)');\n    }\n\n    // Ensure the active-org cache is populated before the user starts a\n    // Claude Code session. BaseCommand fired the guarded refresh earlier\n    // but may have raced with auth init or hit a transient error; this\n    // explicit retry guarantees the cache reflects the user's current\n    // active_org_id at the end of `hooks install`.\n    await bootstrapActiveOrg();\n\n    // Soft tmux capability check \u2014 live message send needs tmux on the\n    // user's machine. We do not auto-install; just surface one line.\n    const tmux = await detectTmux();\n    this.log('');\n    if (tmux.available) {\n      this.log(`[OK] tmux found${tmux.version ? ` (v${tmux.version})` : ''} \u2014 live send enabled`);\n    } else {\n      this.log('[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux');\n    }\n  }\n\n  private findBinary(name: string): string | null {\n    try {\n      return execSync(`which ${name} 2>/dev/null`, { encoding: 'utf-8' }).trim() || null;\n    } catch {\n      return null;\n    }\n  }\n\n  private installMitmproxy(): boolean {\n    for (const [cmd, args] of [\n      ['pipx', ['install', 'mitmproxy']],\n      ['uv', ['tool', 'install', 'mitmproxy']],\n      ['brew', ['install', 'mitmproxy']],\n    ] as const) {\n      if (this.findBinary(cmd)) {\n        this.log(`     Installing via ${cmd}...`);\n        const result = spawnSync(cmd, [...args], { stdio: 'inherit' });\n        if (result.status === 0) return true;\n      }\n    }\n    return false;\n  }\n\n  private isCACertTrusted(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('security', ['verify-cert', '-c', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      return existsSync('/usr/local/share/ca-certificates/mitmproxy-ca.crt');\n    }\n\n    if (process.platform === 'win32') {\n      // On Windows, check if cert is in the Root store\n      const result = spawnSync('certutil', ['-verify', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n\n  private trustCACert(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('sudo', [\n        'security', 'add-trusted-cert', '-d', '-r', 'trustRoot',\n        '-k', '/Library/Keychains/System.keychain', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      const cp = spawnSync('sudo', [\n        'cp', CERT_PATH, '/usr/local/share/ca-certificates/mitmproxy-ca.crt',\n      ], { stdio: 'inherit' });\n      if (cp.status !== 0) return false;\n      const update = spawnSync('sudo', ['update-ca-certificates'], { stdio: 'inherit' });\n      return update.status === 0;\n    }\n\n    if (process.platform === 'win32') {\n      const result = spawnSync('certutil', [\n        '-addstore', '-f', 'Root', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,cAAc,UAAU,iBAAiB;AAClD,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AACxB,SAAS,YAAY;AAQrB,SAAS,0BAAmC;AAC1C,MAAI;AACF,iBAAa,aAAa,CAAC,QAAQ,wBAAwB,GAAG;AAAA,MAC5D,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAsBA,IAAM,YAAY,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AAEvE,IAAqB,eAArB,MAAqB,sBAAqB,YAAY;AAAA,EACpD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,YAAY,MAAM,QAAQ;AAAA,MACxB,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,eAAe,MAAM,OAAO;AAAA,MAC1B,aAAa;AAAA,IACf,CAAC;AAAA,IACD,QAAQ,MAAM,QAAQ;AAAA,MACpB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,oBAAoB,MAAM,QAAQ;AAAA,MAChC,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,aAAY;AAC/C,UAAM,WAAW,MAAM;AACvB,UAAM,cAAc,WAAW,QAAQ,IAAK,MAAM,aAAa,KAAK,QAAQ,IAAI;AAChF,UAAM,YAAY,KAAK,aAAa,SAAS;AAC7C,UAAM,aAAa,KAAK,WAAW,eAAe;AAClD,UAAM,UAAU,MAAM,UAAU;AAEhC,QAAI,UAAU;AACZ,WAAK,IAAI,oCAA+B,UAAU,EAAE;AAAA,IACtD;AAGA,QAAI,WAAoC,CAAC;AACzC,QAAI,WAAW,UAAU,GAAG;AAC1B,iBAAW,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AAAA,IACzD;AAKA,QAAI,SAAS,SAAS,OAAO,SAAS,UAAU,UAAU;AACxD,YAAM,QAAQ,SAAS;AACvB,UAAI,UAAU;AACd,iBAAW,SAAS,OAAO,KAAK,KAAK,GAAG;AACtC,cAAM,UAAU,MAAM,KAAK;AAC3B,YAAI,CAAC,MAAM,QAAQ,OAAO,EAAG;AAC7B,cAAM,OAAO,QAAQ,OAAO,CAAC,UAAU;AACrC,gBAAM,eAAe,OAAO,OAAO,KAAK,CAAC,MAAM,OAAO,GAAG,YAAY,YAAY,EAAE,QAAQ,SAAS,YAAY,CAAC;AACjH,cAAI,aAAc,YAAW;AAC7B,iBAAO,CAAC;AAAA,QACV,CAAC;AACD,YAAI,KAAK,WAAW,EAAG,QAAO,MAAM,KAAK;AAAA,YACpC,OAAM,KAAK,IAAI;AAAA,MACtB;AACA,UAAI,OAAO,KAAK,KAAK,EAAE,WAAW,EAAG,QAAO,SAAS;AACrD,UAAI,UAAU,EAAG,MAAK,IAAI,gBAAgB,OAAO,uDAAuD;AAAA,IAC1G;AAGA,QAAI,CAAC,SAAS;AAEZ,YAAM,eAAe,KAAK,WAAW,UAAU;AAC/C,UAAI,CAAC,cAAc;AACjB,aAAK,IAAI,EAAE;AACX,aAAK,IAAI,+CAA0C;AACnD,cAAM,YAAY,KAAK,iBAAiB;AACxC,YAAI,CAAC,WAAW;AACd,eAAK,IAAI,0DAA0D;AACnE,eAAK,IAAI,+CAA+C;AACxD,eAAK,IAAI,4CAA4C;AAAA,QACvD;AAAA,MACF;AAGA,UAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,aAAK,IAAI,mCAAmC;AAC5C,cAAM,WAAW,KAAK,WAAW,UAAU;AAC3C,YAAI,UAAU;AACZ,oBAAU,UAAU,CAAC,SAAS,iBAAiB,IAAI,GAAG;AAAA,YACpD,SAAS;AAAA,YACT,OAAO;AAAA,UACT,CAAC;AACD,cAAI,WAAW,SAAS,GAAG;AACzB,iBAAK,IAAI,oCAAoC,SAAS,EAAE;AAAA,UAC1D,OAAO;AACL,iBAAK,IAAI,iCAAiC;AAAA,UAC5C;AAAA,QACF;AAAA,MACF,OAAO;AACL,aAAK,IAAI,2BAA2B;AAAA,MACtC;AAGA,UAAI,WAAW,SAAS,KAAK,CAAC,KAAK,gBAAgB,GAAG;AACpD,aAAK,IAAI,4EAA4E;AACrF,cAAM,UAAU,KAAK,YAAY;AACjC,YAAI,SAAS;AACX,eAAK,IAAI,uCAAuC;AAAA,QAClD,OAAO;AACL,eAAK,IAAI,+CAA+C;AACxD,cAAI,QAAQ,aAAa,UAAU;AACjC,iBAAK,IAAI,2GAA2G,SAAS,EAAE;AAAA,UACjI,WAAW,QAAQ,aAAa,SAAS;AACvC,iBAAK,IAAI,8BAA8B,SAAS,mFAAmF;AAAA,UACrI;AAAA,QACF;AAAA,MACF,WAAW,WAAW,SAAS,GAAG;AAChC,aAAK,IAAI,qCAAqC;AAAA,MAChD;AAIA,YAAM,MAAO,SAAS,OAAO,CAAC;AAC9B,UAAI,cAAc,oBAAoB,YAAY;AAElD,UAAI,WAAW;AACf,UAAI,WAAW,SAAS,GAAG;AACzB,YAAI,sBAAsB;AAAA,MAC5B;AACA,eAAS,MAAM;AACf,WAAK,IAAI,uCAAuC,YAAY,cAAc;AAG1E,YAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,UAAI,aAAa;AACf,aAAK,IAAI,2DAAsD;AAAA,MACjE;AAGA,YAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,UAAI,aAAa;AACf,aAAK,IAAI,sEAAiE;AAAA,MAC5E;AAIA,YAAM,kBAAkB,2BAA2B,YAAY;AAC/D,UAAI,iBAAiB;AACnB,aAAK,IAAI,iGAA4F;AAAA,MACvG;AAGA,YAAM,kBAAkB,2BAA2B,YAAY;AAC/D,UAAI,iBAAiB;AACnB,aAAK,IAAI,kGAA6F;AAAA,MACxG;AAMA,YAAM,WAAW,qBAAqB,cAAc,SAAS;AAC7D,UAAI,UAAU;AACZ,aAAK,IAAI,6DAA6D;AAAA,MACxE;AAQA,UAAI,wBAAwB,GAAG;AAC7B,aAAK,IAAI,0DAA0D;AAAA,MACrE,WAAW,iBAAiB,GAAG;AAC7B,aAAK,IAAI,8BAA8B;AAAA,MACzC,OAAO;AACL,YAAI;AACF,gBAAM,MAAM,aAAa,KAAK,OAAO,OAAO;AAC5C,eAAK,IAAI,6BAA6B,GAAG,GAAG;AAAA,QAC9C,SAAS,KAAK;AACZ,eAAK,IAAI,iCAAkC,IAAc,OAAO,EAAE;AAClE,eAAK,IAAI,6EAA6E;AAAA,QACxF;AAAA,MACF;AAAA,IACF;AAOA,QAAI,CAAC,UAAU;AACb,YAAM,cAAc,iBAAiB,WAAW;AAChD,UAAI,aAAa;AACf,aAAK,IAAI,uCAAkC,WAAW,EAAE;AAAA,MAC1D;AAEA,YAAM,eAAe,kBAAkB,WAAW;AAClD,UAAI,cAAc;AAChB,aAAK,IAAI,8CAAyC,YAAY,EAAE;AAAA,MAClE;AAEA,YAAM,mBAAmB,sBAAsB,WAAW;AAC1D,UAAI,kBAAkB;AACpB,aAAK,IAAI,sDAAiD,gBAAgB,EAAE;AAAA,MAC9E;AAAA,IACF;AAKA,UAAM,uBAAuB,0BAA0B;AACvD,QAAI,sBAAsB;AACxB,WAAK,IAAI,iDAA4C,oBAAoB,EAAE;AAAA,IAC7E;AAQA,UAAM,kBAAkB,qBAAqB;AAC7C,QAAI,iBAAiB;AACnB,WAAK,IAAI,4CAAuC,eAAe,EAAE;AAAA,IACnE;AAMA,QAAI,MAAM,kBAAkB,GAAG;AAC7B,UAAI,0BAA0B,QAAQ,GAAG;AACvC,aAAK,IAAI,wCAAwC;AAAA,MACnD,OAAO;AACL,cAAM,UAAU,sBAAsB,QAAQ;AAC9C,4BAAoB,OAAO;AAC3B,iBAAS,aAAa;AACtB,YAAI,SAAS;AACX,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,gBAAgB,OAAO,GAAG;AAAA,QAC1G,OAAO;AACL,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,EAAE;AAAA,QAClF;AACA,aAAK,IAAI,mFAAoF;AAAA,MAC/F;AAAA,IACF;AAGA,cAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AACxC,kBAAc,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAElE,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,6BAA6B;AACtC,QAAI,UAAU;AACZ,WAAK,IAAI,2DAA2D;AACpE,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,wDAAwD;AAAA,IACnE,WAAW,CAAC,SAAS;AACnB,WAAK,IAAI,uDAAuD;AAChE,WAAK,IAAI,sEAAiE;AAC1E,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,0FAAqF;AAC9F,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,6DAA6D;AACtE,WAAK,IAAI,wCAAwC;AAAA,IACnD,OAAO;AACL,WAAK,IAAI,8DAAyD;AAClE,WAAK,IAAI,8DAA8D;AAAA,IACzE;AAOA,UAAM,mBAAmB;AAIzB,UAAM,OAAO,MAAM,WAAW;AAC9B,SAAK,IAAI,EAAE;AACX,QAAI,KAAK,WAAW;AAClB,WAAK,IAAI,kBAAkB,KAAK,UAAU,MAAM,KAAK,OAAO,MAAM,EAAE,2BAAsB;AAAA,IAC5F,OAAO;AACL,WAAK,IAAI,0GAAqG;AAAA,IAChH;AAAA,EACF;AAAA,EAEQ,WAAW,MAA6B;AAC9C,QAAI;AACF,aAAO,SAAS,SAAS,IAAI,gBAAgB,EAAE,UAAU,QAAQ,CAAC,EAAE,KAAK,KAAK;AAAA,IAChF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,mBAA4B;AAClC,eAAW,CAAC,KAAK,IAAI,KAAK;AAAA,MACxB,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,MACjC,CAAC,MAAM,CAAC,QAAQ,WAAW,WAAW,CAAC;AAAA,MACvC,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,IACnC,GAAY;AACV,UAAI,KAAK,WAAW,GAAG,GAAG;AACxB,aAAK,IAAI,uBAAuB,GAAG,KAAK;AACxC,cAAM,SAAS,UAAU,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,UAAU,CAAC;AAC7D,YAAI,OAAO,WAAW,EAAG,QAAO;AAAA,MAClC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,kBAA2B;AACjC,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,YAAY,CAAC,eAAe,MAAM,SAAS,GAAG;AAAA,QACrE,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,aAAO,WAAW,mDAAmD;AAAA,IACvE;AAEA,QAAI,QAAQ,aAAa,SAAS;AAEhC,YAAM,SAAS,UAAU,YAAY,CAAC,WAAW,SAAS,GAAG;AAAA,QAC3D,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAuB;AAC7B,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,QAAQ;AAAA,QAC/B;AAAA,QAAY;AAAA,QAAoB;AAAA,QAAM;AAAA,QAAM;AAAA,QAC5C;AAAA,QAAM;AAAA,QAAsC;AAAA,MAC9C,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,KAAK,UAAU,QAAQ;AAAA,QAC3B;AAAA,QAAM;AAAA,QAAW;AAAA,MACnB,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,UAAI,GAAG,WAAW,EAAG,QAAO;AAC5B,YAAM,SAAS,UAAU,QAAQ,CAAC,wBAAwB,GAAG,EAAE,OAAO,UAAU,CAAC;AACjF,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,SAAS,UAAU,YAAY;AAAA,QACnC;AAAA,QAAa;AAAA,QAAM;AAAA,QAAQ;AAAA,MAC7B,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { execFileSync, execSync, spawnSync } from 'node:child_process';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport { isGatewayRunning, spawnGateway, GATEWAY_PORT } from '../../lib/gateway-lifecycle.js';\n\n// True iff `rulemetric service install` has wired the gateway up as a launchd\n// agent. When this returns true, hooks install must NOT spawn its own\n// detached gateway \u2014 two processes fighting for :8787 means one crash-loops\n// and Claude Code's HTTPS_PROXY breaks.\nfunction isGatewayLaunchdManaged(): boolean {\n  try {\n    execFileSync('launchctl', ['list', 'com.rulemetric.gateway'], {\n      stdio: ['ignore', 'pipe', 'pipe'],\n    });\n    return true;\n  } catch {\n    // Non-zero exit = label not loaded\n    return false;\n  }\n}\nimport {\n  writeStatuslineShim,\n  readCurrentStatusLine,\n  isStatuslineShimInstalled,\n  STATUSLINE_SETTINGS_VALUE,\n} from '../../lib/statusline-shim.js';\nimport {\n  mergeClaudeCodeHooks,\n  removeClaudeCodeHooks,\n  writeCursorProxyConfig,\n  writeCursorUserProxyConfig,\n  writeVSCodeProxyConfig,\n  installMacOSProxyEnv,\n  writeVSCodeUserProxyConfig,\n  writeCursorHooks,\n  writeCursorUserHooks,\n  writeCopilotHooks,\n  writeAntigravityHooks,\n  writeAntigravityUserHooks,\n} from '../../lib/hooks-config.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { detectTmux } from '../../lib/detect-tmux.js';\n\nconst CERT_PATH = join(homedir(), '.mitmproxy', 'mitmproxy-ca-cert.pem');\n\nexport default class HooksInstall extends BaseCommand {\n  static override description = 'Install session tracking hooks and context capture proxy for Claude Code';\n\n  static override examples = [\n    '<%= config.bin %> hooks install',\n    '<%= config.bin %> hooks install --global',\n    '<%= config.bin %> hooks install --no-proxy',\n  ];\n\n  static override flags = {\n    'no-proxy': Flags.boolean({\n      default: false,\n      description: 'Skip proxy/gateway configuration (hooks only)',\n    }),\n    'project-dir': Flags.string({\n      description: 'Project directory to install hooks in (defaults to cwd)',\n    }),\n    global: Flags.boolean({\n      char: 'g',\n      default: false,\n      description: 'Install hooks globally (~/.claude/settings.json) so all projects are tracked',\n    }),\n    'statusline-usage': Flags.boolean({\n      default: false,\n      description: 'Install the statusline shim so Claude Code pushes live rate_limits on every refresh (makes /usage rings update in real time without needing the proxy)',\n    }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(HooksInstall);\n    const isGlobal = flags.global;\n    const projectPath = isGlobal ? homedir() : (flags['project-dir'] ?? process.cwd());\n    const configDir = join(projectPath, '.claude');\n    const configPath = join(configDir, 'settings.json');\n    const noProxy = flags['no-proxy'];\n\n    if (isGlobal) {\n      this.log(`Installing hooks globally \u2192 ${configPath}`);\n    }\n\n    // Read or create .claude/settings.json\n    let settings: Record<string, unknown> = {};\n    if (existsSync(configPath)) {\n      settings = JSON.parse(readFileSync(configPath, 'utf-8'));\n    }\n\n    // \u2500\u2500 1. Install Claude Code session-tracking hooks (hooks-first, zero-proxy\n    // capture). Strip any stale rulemetric entries first \u2014 handles old command\n    // formats, preserves the user's own hooks \u2014 then merge the current canonical\n    // set. Runs regardless of --no-proxy: this is the whole point of the hooks\n    // path, which captures full sessions (lifecycle + SessionEnd transcript\n    // reimport) without mitmproxy / CA trust / gateway. The proxy adds the\n    // rendered system prompt (instruction-linking) + cross-tool capture on top.\n    const refreshedHooks = removeClaudeCodeHooks(settings);\n    mergeClaudeCodeHooks(settings);\n    this.log(\n      refreshedHooks\n        ? '[OK] Refreshed RuleMetric Claude Code session hooks \u2192 .claude/settings.json'\n        : '[OK] Installed RuleMetric Claude Code session hooks \u2192 .claude/settings.json',\n    );\n\n    // \u2500\u2500 2. Configure gateway + proxy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    if (!noProxy) {\n      // Ensure mitmproxy is available\n      const hasMitmproxy = this.findBinary('mitmdump');\n      if (!hasMitmproxy) {\n        this.log('');\n        this.log('[!!] mitmproxy not found \u2014 installing...');\n        const installed = this.installMitmproxy();\n        if (!installed) {\n          this.log('[!!] Could not install mitmproxy. Skipping proxy config.');\n          this.log('     Install manually: pipx install mitmproxy');\n          this.log('     Then re-run: rulemetric hooks install');\n        }\n      }\n\n      // Generate CA cert if missing\n      if (!existsSync(CERT_PATH)) {\n        this.log('[..] Generating CA certificate...');\n        const mitmdump = this.findBinary('mitmdump');\n        if (mitmdump) {\n          spawnSync(mitmdump, ['--set', 'listen_port=0', '-q'], {\n            timeout: 5000,\n            stdio: 'ignore',\n          });\n          if (existsSync(CERT_PATH)) {\n            this.log(`[OK] CA certificate generated at ${CERT_PATH}`);\n          } else {\n            this.log('[!!] Could not generate CA cert');\n          }\n        }\n      } else {\n        this.log('[OK] CA certificate found');\n      }\n\n      // Trust CA cert in system store (if not already trusted)\n      if (existsSync(CERT_PATH) && !this.isCACertTrusted()) {\n        this.log('[..] Installing CA certificate into system trust store (requires admin)...');\n        const trusted = this.trustCACert();\n        if (trusted) {\n          this.log('[OK] CA certificate trusted by system');\n        } else {\n          this.log('[!!] Could not install CA cert automatically.');\n          if (process.platform === 'darwin') {\n            this.log(`     Run manually: sudo security add-trusted-cert -d -r trustRoot -k /Library/Keychains/System.keychain ${CERT_PATH}`);\n          } else if (process.platform === 'linux') {\n            this.log(`     Run manually: sudo cp ${CERT_PATH} /usr/local/share/ca-certificates/mitmproxy-ca.crt && sudo update-ca-certificates`);\n          }\n        }\n      } else if (existsSync(CERT_PATH)) {\n        this.log('[OK] CA certificate already trusted');\n      }\n\n      // Set permanent HTTPS_PROXY and NODE_EXTRA_CA_CERTS in settings.json\n      // These point to the gateway (always running), not mitmproxy directly\n      const env = (settings.env ?? {}) as Record<string, string>;\n      env.HTTPS_PROXY = `http://localhost:${GATEWAY_PORT}`;\n      // Bypass proxy for non-Anthropic traffic (Supabase auth, npm, etc.)\n      env.NO_PROXY = 'localhost,127.0.0.1,*.supabase.co,*.supabase.in';\n      if (existsSync(CERT_PATH)) {\n        env.NODE_EXTRA_CA_CERTS = CERT_PATH;\n      }\n      settings.env = env;\n      this.log(`[OK] HTTPS_PROXY set to gateway on :${GATEWAY_PORT} (permanent)`);\n\n      // Configure Cursor proxy (if .cursor/ exists)\n      const cursorProxy = writeCursorProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n      if (cursorProxy) {\n        this.log('[OK] Cursor proxy configured \u2192 .cursor/settings.json');\n      }\n\n      // Configure VS Code proxy for Copilot capture (workspace settings)\n      const vscodeProxy = writeVSCodeProxyConfig(projectPath, GATEWAY_PORT, CERT_PATH);\n      if (vscodeProxy) {\n        this.log('[OK] VS Code workspace proxy configured \u2192 .vscode/settings.json');\n      }\n\n      // Set http.proxy in VS Code user settings (workspace-level is silently ignored\n      // for http.proxy due to APPLICATION scope \u2014 microsoft/vscode#236932)\n      const vscodeUserProxy = writeVSCodeUserProxyConfig(GATEWAY_PORT);\n      if (vscodeUserProxy) {\n        this.log('[OK] VS Code user proxy configured \u2192 ~/Library/Application Support/Code/User/settings.json');\n      }\n\n      // Same for Cursor (VS Code fork inherits the APPLICATION-scope restriction).\n      const cursorUserProxy = writeCursorUserProxyConfig(GATEWAY_PORT);\n      if (cursorUserProxy) {\n        this.log('[OK] Cursor user proxy configured \u2192 ~/Library/Application Support/Cursor/User/settings.json');\n      }\n\n      // Set HTTPS_PROXY for all GUI apps via launchctl + LaunchAgent (macOS)\n      // Copilot reads process.env.HTTPS_PROXY directly \u2014 VS Code settings alone\n      // are insufficient because workspace http.proxy is ignored and extensions\n      // may bypass vscode-proxy-agent (microsoft/vscode#12588)\n      const macProxy = installMacOSProxyEnv(GATEWAY_PORT, CERT_PATH);\n      if (macProxy) {\n        this.log('[OK] HTTPS_PROXY set for GUI apps (launchctl + LaunchAgent)');\n      }\n\n      // Start gateway if not already running. Three possible owners (in order\n      // of precedence):\n      //   1. launchd (`rulemetric service install` plist) \u2014 authoritative;\n      //      hooks must NOT spawn a competing copy that would fight for :8787\n      //   2. legacy PID-file (this same code path from a previous run)\n      //   3. nothing \u2014 spawn a fresh detached process\n      if (isGatewayLaunchdManaged()) {\n        this.log('[OK] Gateway managed by launchd (com.rulemetric.gateway)');\n      } else if (isGatewayRunning()) {\n        this.log('[OK] Gateway already running');\n      } else {\n        try {\n          const pid = spawnGateway(this.config.version);\n          this.log(`[OK] Gateway started (PID ${pid})`);\n        } catch (err) {\n          this.log(`[!!] Could not start gateway: ${(err as Error).message}`);\n          this.log('     The session-start hook will auto-start it on next Claude Code session.');\n        }\n      }\n    }\n\n    // \u2500\u2500 3. Write Cursor + Copilot hook configs \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // These are independent of the proxy (they capture editor lifecycle\n    // events, not LLM traffic), so they run regardless of --no-proxy. Both\n    // helpers no-op when the target directory (.cursor/ or .github/)\n    // doesn't exist.\n    if (!isGlobal) {\n      const cursorHooks = writeCursorHooks(projectPath);\n      if (cursorHooks) {\n        this.log(`[OK] Cursor hooks configured \u2192 ${cursorHooks}`);\n      }\n\n      const copilotHooks = writeCopilotHooks(projectPath);\n      if (copilotHooks) {\n        this.log(`[OK] Copilot Agent hooks configured \u2192 ${copilotHooks}`);\n      }\n\n      const antigravityHooks = writeAntigravityHooks(projectPath);\n      if (antigravityHooks) {\n        this.log(`[OK] Antigravity workspace hooks configured \u2192 ${antigravityHooks}`);\n      }\n    }\n\n    // User-level Antigravity hooks at ~/.gemini/config/hooks.json. Required\n    // because the GUI Antigravity process is launched once per machine and\n    // covers any workspace the user opens, not just the install-time cwd.\n    const antigravityUserHooks = writeAntigravityUserHooks();\n    if (antigravityUserHooks) {\n      this.log(`[OK] Antigravity user hooks configured \u2192 ${antigravityUserHooks}`);\n    }\n\n    // User-level Cursor hooks (~/.cursor/hooks.json) are required for global\n    // capture because Cursor's chat traffic bypasses HTTP proxies (HTTP/2\n    // multiplexed persistent connection \u2014 see cursor.com/docs/hooks). Without\n    // hooks, we get zero Cursor visibility for sessions outside this project.\n    // Runs in both --global and per-project modes since the user file is\n    // machine-wide either way.\n    const cursorUserHooks = writeCursorUserHooks();\n    if (cursorUserHooks) {\n      this.log(`[OK] Cursor user hooks configured \u2192 ${cursorUserHooks}`);\n    }\n\n    // \u2500\u2500 4. Statusline shim (rate_limits freshness) \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // When --statusline-usage is set, write ~/.claude/statusline-rulemetric.sh\n    // and point settings.statusLine at it. If the user already has a statusLine\n    // command configured, chain it so their prompt text is preserved.\n    if (flags['statusline-usage']) {\n      if (isStatuslineShimInstalled(settings)) {\n        this.log('[OK] Statusline shim already installed');\n      } else {\n        const prevCmd = readCurrentStatusLine(settings);\n        writeStatuslineShim(prevCmd);\n        settings.statusLine = STATUSLINE_SETTINGS_VALUE;\n        if (prevCmd) {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command} (chains to: ${prevCmd})`);\n        } else {\n          this.log(`[OK] Statusline shim installed \u2192 ${STATUSLINE_SETTINGS_VALUE.command}`);\n        }\n        this.log('     Rate-limit rings will now update on Claude Code\\'s statusline refresh cadence');\n      }\n    }\n\n    // \u2500\u2500 5. Write Claude Code settings \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    mkdirSync(configDir, { recursive: true });\n    writeFileSync(configPath, JSON.stringify(settings, null, 2) + '\\n');\n\n    this.log('');\n    this.log('Setup complete! Next steps:');\n    if (isGlobal) {\n      this.log('  1. Install always-on API:    rulemetric service install');\n      this.log('  2. Start Claude Code in any project \u2014 all sessions tracked automatically');\n      this.log('');\n      this.log('The API service starts on login and restarts on crash.');\n    } else if (!noProxy) {\n      this.log('  1. Start Claude Code \u2014 sessions are captured by hooks immediately');\n      this.log('  2. Start the capture proxy for full depth:  rulemetric proxy start');\n      this.log('');\n      this.log('Hooks capture every session (lifecycle + transcript). The proxy adds the');\n      this.log('rendered system prompt (instruction-effectiveness linking) + cross-tool capture.');\n      this.log('');\n      this.log('To capture traffic from other clients (Python, curl, etc.):');\n      this.log('  eval \"$(rulemetric proxy env --all)\"');\n    } else {\n      // --no-proxy still installs the Claude Code session hooks above, so full\n      // sessions ARE captured (lifecycle + SessionEnd transcript reimport) with\n      // no mitmproxy / CA trust / gateway. Only the proxy-exclusive layer\n      // (rendered system prompt \u2192 instruction-linking, cross-tool) is skipped.\n      this.log('  1. Start Claude Code \u2014 sessions are captured by the hooks just installed');\n      this.log('');\n      this.log('No proxy means no mitmproxy / CA cert needed. The hooks capture full');\n      this.log('sessions on their own; re-run without --no-proxy to also capture system');\n      this.log('prompts for instruction-effectiveness linking.');\n    }\n\n    // Ensure the active-org cache is populated before the user starts a\n    // Claude Code session. BaseCommand fired the guarded refresh earlier\n    // but may have raced with auth init or hit a transient error; this\n    // explicit retry guarantees the cache reflects the user's current\n    // active_org_id at the end of `hooks install`.\n    await bootstrapActiveOrg();\n\n    // Soft tmux capability check \u2014 live message send needs tmux on the\n    // user's machine. We do not auto-install; just surface one line.\n    const tmux = await detectTmux();\n    this.log('');\n    if (tmux.available) {\n      this.log(`[OK] tmux found${tmux.version ? ` (v${tmux.version})` : ''} \u2014 live send enabled`);\n    } else {\n      this.log('[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux');\n    }\n  }\n\n  private findBinary(name: string): string | null {\n    try {\n      return execSync(`which ${name} 2>/dev/null`, { encoding: 'utf-8' }).trim() || null;\n    } catch {\n      return null;\n    }\n  }\n\n  private installMitmproxy(): boolean {\n    for (const [cmd, args] of [\n      ['pipx', ['install', 'mitmproxy']],\n      ['uv', ['tool', 'install', 'mitmproxy']],\n      ['brew', ['install', 'mitmproxy']],\n    ] as const) {\n      if (this.findBinary(cmd)) {\n        this.log(`     Installing via ${cmd}...`);\n        const result = spawnSync(cmd, [...args], { stdio: 'inherit' });\n        if (result.status === 0) return true;\n      }\n    }\n    return false;\n  }\n\n  private isCACertTrusted(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('security', ['verify-cert', '-c', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      return existsSync('/usr/local/share/ca-certificates/mitmproxy-ca.crt');\n    }\n\n    if (process.platform === 'win32') {\n      // On Windows, check if cert is in the Root store\n      const result = spawnSync('certutil', ['-verify', CERT_PATH], {\n        stdio: 'pipe',\n      });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n\n  private trustCACert(): boolean {\n    if (process.platform === 'darwin') {\n      const result = spawnSync('sudo', [\n        'security', 'add-trusted-cert', '-d', '-r', 'trustRoot',\n        '-k', '/Library/Keychains/System.keychain', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    if (process.platform === 'linux') {\n      const cp = spawnSync('sudo', [\n        'cp', CERT_PATH, '/usr/local/share/ca-certificates/mitmproxy-ca.crt',\n      ], { stdio: 'inherit' });\n      if (cp.status !== 0) return false;\n      const update = spawnSync('sudo', ['update-ca-certificates'], { stdio: 'inherit' });\n      return update.status === 0;\n    }\n\n    if (process.platform === 'win32') {\n      const result = spawnSync('certutil', [\n        '-addstore', '-f', 'Root', CERT_PATH,\n      ], { stdio: 'inherit' });\n      return result.status === 0;\n    }\n\n    return false;\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,cAAc,UAAU,iBAAiB;AAClD,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AACxB,SAAS,YAAY;AAQrB,SAAS,0BAAmC;AAC1C,MAAI;AACF,iBAAa,aAAa,CAAC,QAAQ,wBAAwB,GAAG;AAAA,MAC5D,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,IAClC,CAAC;AACD,WAAO;AAAA,EACT,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAwBA,IAAM,YAAY,KAAK,QAAQ,GAAG,cAAc,uBAAuB;AAEvE,IAAqB,eAArB,MAAqB,sBAAqB,YAAY;AAAA,EACpD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,YAAY,MAAM,QAAQ;AAAA,MACxB,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,eAAe,MAAM,OAAO;AAAA,MAC1B,aAAa;AAAA,IACf,CAAC;AAAA,IACD,QAAQ,MAAM,QAAQ;AAAA,MACpB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,oBAAoB,MAAM,QAAQ;AAAA,MAChC,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,aAAY;AAC/C,UAAM,WAAW,MAAM;AACvB,UAAM,cAAc,WAAW,QAAQ,IAAK,MAAM,aAAa,KAAK,QAAQ,IAAI;AAChF,UAAM,YAAY,KAAK,aAAa,SAAS;AAC7C,UAAM,aAAa,KAAK,WAAW,eAAe;AAClD,UAAM,UAAU,MAAM,UAAU;AAEhC,QAAI,UAAU;AACZ,WAAK,IAAI,oCAA+B,UAAU,EAAE;AAAA,IACtD;AAGA,QAAI,WAAoC,CAAC;AACzC,QAAI,WAAW,UAAU,GAAG;AAC1B,iBAAW,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AAAA,IACzD;AASA,UAAM,iBAAiB,sBAAsB,QAAQ;AACrD,yBAAqB,QAAQ;AAC7B,SAAK;AAAA,MACH,iBACI,qFACA;AAAA,IACN;AAGA,QAAI,CAAC,SAAS;AAEZ,YAAM,eAAe,KAAK,WAAW,UAAU;AAC/C,UAAI,CAAC,cAAc;AACjB,aAAK,IAAI,EAAE;AACX,aAAK,IAAI,+CAA0C;AACnD,cAAM,YAAY,KAAK,iBAAiB;AACxC,YAAI,CAAC,WAAW;AACd,eAAK,IAAI,0DAA0D;AACnE,eAAK,IAAI,+CAA+C;AACxD,eAAK,IAAI,4CAA4C;AAAA,QACvD;AAAA,MACF;AAGA,UAAI,CAAC,WAAW,SAAS,GAAG;AAC1B,aAAK,IAAI,mCAAmC;AAC5C,cAAM,WAAW,KAAK,WAAW,UAAU;AAC3C,YAAI,UAAU;AACZ,oBAAU,UAAU,CAAC,SAAS,iBAAiB,IAAI,GAAG;AAAA,YACpD,SAAS;AAAA,YACT,OAAO;AAAA,UACT,CAAC;AACD,cAAI,WAAW,SAAS,GAAG;AACzB,iBAAK,IAAI,oCAAoC,SAAS,EAAE;AAAA,UAC1D,OAAO;AACL,iBAAK,IAAI,iCAAiC;AAAA,UAC5C;AAAA,QACF;AAAA,MACF,OAAO;AACL,aAAK,IAAI,2BAA2B;AAAA,MACtC;AAGA,UAAI,WAAW,SAAS,KAAK,CAAC,KAAK,gBAAgB,GAAG;AACpD,aAAK,IAAI,4EAA4E;AACrF,cAAM,UAAU,KAAK,YAAY;AACjC,YAAI,SAAS;AACX,eAAK,IAAI,uCAAuC;AAAA,QAClD,OAAO;AACL,eAAK,IAAI,+CAA+C;AACxD,cAAI,QAAQ,aAAa,UAAU;AACjC,iBAAK,IAAI,2GAA2G,SAAS,EAAE;AAAA,UACjI,WAAW,QAAQ,aAAa,SAAS;AACvC,iBAAK,IAAI,8BAA8B,SAAS,mFAAmF;AAAA,UACrI;AAAA,QACF;AAAA,MACF,WAAW,WAAW,SAAS,GAAG;AAChC,aAAK,IAAI,qCAAqC;AAAA,MAChD;AAIA,YAAM,MAAO,SAAS,OAAO,CAAC;AAC9B,UAAI,cAAc,oBAAoB,YAAY;AAElD,UAAI,WAAW;AACf,UAAI,WAAW,SAAS,GAAG;AACzB,YAAI,sBAAsB;AAAA,MAC5B;AACA,eAAS,MAAM;AACf,WAAK,IAAI,uCAAuC,YAAY,cAAc;AAG1E,YAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,UAAI,aAAa;AACf,aAAK,IAAI,2DAAsD;AAAA,MACjE;AAGA,YAAM,cAAc,uBAAuB,aAAa,cAAc,SAAS;AAC/E,UAAI,aAAa;AACf,aAAK,IAAI,sEAAiE;AAAA,MAC5E;AAIA,YAAM,kBAAkB,2BAA2B,YAAY;AAC/D,UAAI,iBAAiB;AACnB,aAAK,IAAI,iGAA4F;AAAA,MACvG;AAGA,YAAM,kBAAkB,2BAA2B,YAAY;AAC/D,UAAI,iBAAiB;AACnB,aAAK,IAAI,kGAA6F;AAAA,MACxG;AAMA,YAAM,WAAW,qBAAqB,cAAc,SAAS;AAC7D,UAAI,UAAU;AACZ,aAAK,IAAI,6DAA6D;AAAA,MACxE;AAQA,UAAI,wBAAwB,GAAG;AAC7B,aAAK,IAAI,0DAA0D;AAAA,MACrE,WAAW,iBAAiB,GAAG;AAC7B,aAAK,IAAI,8BAA8B;AAAA,MACzC,OAAO;AACL,YAAI;AACF,gBAAM,MAAM,aAAa,KAAK,OAAO,OAAO;AAC5C,eAAK,IAAI,6BAA6B,GAAG,GAAG;AAAA,QAC9C,SAAS,KAAK;AACZ,eAAK,IAAI,iCAAkC,IAAc,OAAO,EAAE;AAClE,eAAK,IAAI,6EAA6E;AAAA,QACxF;AAAA,MACF;AAAA,IACF;AAOA,QAAI,CAAC,UAAU;AACb,YAAM,cAAc,iBAAiB,WAAW;AAChD,UAAI,aAAa;AACf,aAAK,IAAI,uCAAkC,WAAW,EAAE;AAAA,MAC1D;AAEA,YAAM,eAAe,kBAAkB,WAAW;AAClD,UAAI,cAAc;AAChB,aAAK,IAAI,8CAAyC,YAAY,EAAE;AAAA,MAClE;AAEA,YAAM,mBAAmB,sBAAsB,WAAW;AAC1D,UAAI,kBAAkB;AACpB,aAAK,IAAI,sDAAiD,gBAAgB,EAAE;AAAA,MAC9E;AAAA,IACF;AAKA,UAAM,uBAAuB,0BAA0B;AACvD,QAAI,sBAAsB;AACxB,WAAK,IAAI,iDAA4C,oBAAoB,EAAE;AAAA,IAC7E;AAQA,UAAM,kBAAkB,qBAAqB;AAC7C,QAAI,iBAAiB;AACnB,WAAK,IAAI,4CAAuC,eAAe,EAAE;AAAA,IACnE;AAMA,QAAI,MAAM,kBAAkB,GAAG;AAC7B,UAAI,0BAA0B,QAAQ,GAAG;AACvC,aAAK,IAAI,wCAAwC;AAAA,MACnD,OAAO;AACL,cAAM,UAAU,sBAAsB,QAAQ;AAC9C,4BAAoB,OAAO;AAC3B,iBAAS,aAAa;AACtB,YAAI,SAAS;AACX,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,gBAAgB,OAAO,GAAG;AAAA,QAC1G,OAAO;AACL,eAAK,IAAI,yCAAoC,0BAA0B,OAAO,EAAE;AAAA,QAClF;AACA,aAAK,IAAI,mFAAoF;AAAA,MAC/F;AAAA,IACF;AAGA,cAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AACxC,kBAAc,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAElE,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,6BAA6B;AACtC,QAAI,UAAU;AACZ,WAAK,IAAI,2DAA2D;AACpE,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,wDAAwD;AAAA,IACnE,WAAW,CAAC,SAAS;AACnB,WAAK,IAAI,0EAAqE;AAC9E,WAAK,IAAI,sEAAsE;AAC/E,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,0EAA0E;AACnF,WAAK,IAAI,kFAAkF;AAC3F,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,6DAA6D;AACtE,WAAK,IAAI,wCAAwC;AAAA,IACnD,OAAO;AAKL,WAAK,IAAI,iFAA4E;AACrF,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,sEAAsE;AAC/E,WAAK,IAAI,yEAAyE;AAClF,WAAK,IAAI,gDAAgD;AAAA,IAC3D;AAOA,UAAM,mBAAmB;AAIzB,UAAM,OAAO,MAAM,WAAW;AAC9B,SAAK,IAAI,EAAE;AACX,QAAI,KAAK,WAAW;AAClB,WAAK,IAAI,kBAAkB,KAAK,UAAU,MAAM,KAAK,OAAO,MAAM,EAAE,2BAAsB;AAAA,IAC5F,OAAO;AACL,WAAK,IAAI,0GAAqG;AAAA,IAChH;AAAA,EACF;AAAA,EAEQ,WAAW,MAA6B;AAC9C,QAAI;AACF,aAAO,SAAS,SAAS,IAAI,gBAAgB,EAAE,UAAU,QAAQ,CAAC,EAAE,KAAK,KAAK;AAAA,IAChF,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,mBAA4B;AAClC,eAAW,CAAC,KAAK,IAAI,KAAK;AAAA,MACxB,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,MACjC,CAAC,MAAM,CAAC,QAAQ,WAAW,WAAW,CAAC;AAAA,MACvC,CAAC,QAAQ,CAAC,WAAW,WAAW,CAAC;AAAA,IACnC,GAAY;AACV,UAAI,KAAK,WAAW,GAAG,GAAG;AACxB,aAAK,IAAI,uBAAuB,GAAG,KAAK;AACxC,cAAM,SAAS,UAAU,KAAK,CAAC,GAAG,IAAI,GAAG,EAAE,OAAO,UAAU,CAAC;AAC7D,YAAI,OAAO,WAAW,EAAG,QAAO;AAAA,MAClC;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,kBAA2B;AACjC,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,YAAY,CAAC,eAAe,MAAM,SAAS,GAAG;AAAA,QACrE,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,aAAO,WAAW,mDAAmD;AAAA,IACvE;AAEA,QAAI,QAAQ,aAAa,SAAS;AAEhC,YAAM,SAAS,UAAU,YAAY,CAAC,WAAW,SAAS,GAAG;AAAA,QAC3D,OAAO;AAAA,MACT,CAAC;AACD,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AAAA,EAEQ,cAAuB;AAC7B,QAAI,QAAQ,aAAa,UAAU;AACjC,YAAM,SAAS,UAAU,QAAQ;AAAA,QAC/B;AAAA,QAAY;AAAA,QAAoB;AAAA,QAAM;AAAA,QAAM;AAAA,QAC5C;AAAA,QAAM;AAAA,QAAsC;AAAA,MAC9C,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,KAAK,UAAU,QAAQ;AAAA,QAC3B;AAAA,QAAM;AAAA,QAAW;AAAA,MACnB,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,UAAI,GAAG,WAAW,EAAG,QAAO;AAC5B,YAAM,SAAS,UAAU,QAAQ,CAAC,wBAAwB,GAAG,EAAE,OAAO,UAAU,CAAC;AACjF,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,QAAI,QAAQ,aAAa,SAAS;AAChC,YAAM,SAAS,UAAU,YAAY;AAAA,QACnC;AAAA,QAAa;AAAA,QAAM;AAAA,QAAQ;AAAA,MAC7B,GAAG,EAAE,OAAO,UAAU,CAAC;AACvB,aAAO,OAAO,WAAW;AAAA,IAC3B;AAEA,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/commands/hooks/uninstall.js

@@ -1,6 +1,7 @@
 import {
   removeAntigravityHooks,
   removeAntigravityUserHooks,
+  removeClaudeCodeHooks,
   removeCopilotHooks,
   removeCursorHooks,
   removeCursorUserHooks,
@@ -8,7 +9,7 @@ import {
   removeVSCodeProxyConfig,
   removeVSCodeUserProxyConfig,
   uninstallMacOSProxyEnv
-} from "../../chunk-L674RNKQ.js";
+} from "../../chunk-ANOWI23I.js";
 import {
   stopGateway
 } from "../../chunk-FTJRMUID.js";
@@ -38,9 +39,8 @@ var HooksUninstall = class extends BaseCommand {
     }
     const settings = JSON.parse(readFileSync(configPath, "utf-8"));
     let changed = false;
-    if (settings.hooks) {
-      delete settings.hooks;
-      this.log("Removed hooks from .claude/settings.json");
+    if (removeClaudeCodeHooks(settings)) {
+      this.log("Removed RuleMetric hooks from .claude/settings.json");
       changed = true;
     }
     const env = settings.env;

package/dist/commands/hooks/uninstall.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/commands/hooks/uninstall.ts"],
-  "sourcesContent": ["import { existsSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport { stopGateway } from '../../lib/gateway-lifecycle.js';\nimport { removeCursorHooks, removeCursorUserHooks, removeCopilotHooks, removeAntigravityHooks, removeAntigravityUserHooks, removeVSCodeProxyConfig, uninstallMacOSProxyEnv, removeVSCodeUserProxyConfig, removeCursorUserProxyConfig } from '../../lib/hooks-config.js';\n\nexport default class HooksUninstall extends BaseCommand {\n  static override description = 'Remove session tracking hooks from the current project';\n\n  static override examples = [\n    '<%= config.bin %> hooks uninstall',\n  ];\n\n  async run(): Promise<void> {\n    const configPath = join(process.cwd(), '.claude', 'settings.json');\n\n    if (!existsSync(configPath)) {\n      this.log('No .claude/settings.json found \u2014 nothing to uninstall.');\n      return;\n    }\n\n    const settings: Record<string, unknown> = JSON.parse(readFileSync(configPath, 'utf-8'));\n\n    let changed = false;\n\n    // Remove hooks\n    if (settings.hooks) {\n      delete settings.hooks;\n      this.log('Removed hooks from .claude/settings.json');\n      changed = true;\n    }\n\n    // Remove gateway proxy env\n    const env = settings.env as Record<string, string> | undefined;\n    if (env?.HTTPS_PROXY || env?.NODE_EXTRA_CA_CERTS) {\n      delete env.HTTPS_PROXY;\n      delete env.NODE_EXTRA_CA_CERTS;\n      if (Object.keys(env).length === 0) {\n        delete settings.env;\n      }\n      this.log('Removed HTTPS_PROXY and NODE_EXTRA_CA_CERTS from .claude/settings.json');\n      changed = true;\n    }\n\n    if (changed) {\n      writeFileSync(configPath, JSON.stringify(settings, null, 2) + '\\n');\n    } else {\n      this.log('No hooks or proxy config found \u2014 nothing to uninstall.');\n    }\n\n    // Remove Cursor hooks\n    // Remove Cursor and Copilot hooks\n    if (removeCursorHooks(process.cwd())) {\n      this.log('Removed RuleMetric hooks from .cursor/hooks.json');\n      changed = true;\n    }\n    if (removeCursorUserHooks()) {\n      this.log('Removed RuleMetric hooks from ~/.cursor/hooks.json');\n      changed = true;\n    }\n\n    // Remove Cursor proxy config\n    const cursorSettingsPath = join(process.cwd(), '.cursor', 'settings.json');\n    if (existsSync(cursorSettingsPath)) {\n      try {\n        const cursorSettings = JSON.parse(readFileSync(cursorSettingsPath, 'utf-8'));\n        if (cursorSettings['http.proxy']?.includes('localhost')) {\n          delete cursorSettings['http.proxy'];\n          delete cursorSettings['http.proxyStrictSSL'];\n          writeFileSync(cursorSettingsPath, JSON.stringify(cursorSettings, null, 2) + '\\n');\n          this.log('Removed proxy config from .cursor/settings.json');\n          changed = true;\n        }\n      } catch { /* not valid JSON, skip */ }\n    }\n\n    // Remove Copilot hooks\n    if (removeCopilotHooks(process.cwd())) {\n      this.log('Removed RuleMetric hooks from .github/hooks/');\n      changed = true;\n    }\n\n    // Remove Antigravity hooks (workspace + user)\n    if (removeAntigravityHooks(process.cwd())) {\n      this.log('Removed RuleMetric block from .agents/hooks.json');\n      changed = true;\n    }\n    if (removeAntigravityUserHooks()) {\n      this.log('Removed RuleMetric block from ~/.gemini/config/hooks.json');\n      changed = true;\n    }\n\n    // Remove VS Code proxy config (workspace + user settings)\n    if (removeVSCodeProxyConfig(process.cwd())) {\n      this.log('Removed proxy config from .vscode/settings.json');\n      changed = true;\n    }\n    if (removeVSCodeUserProxyConfig()) {\n      this.log('Removed proxy config from VS Code user settings');\n      changed = true;\n    }\n    if (removeCursorUserProxyConfig()) {\n      this.log('Removed proxy config from Cursor user settings');\n      changed = true;\n    }\n\n    // Remove macOS LaunchAgent + launchctl env vars\n    if (uninstallMacOSProxyEnv()) {\n      this.log('Removed HTTPS_PROXY LaunchAgent');\n      changed = true;\n    }\n\n    // Stop gateway\n    if (stopGateway()) {\n      this.log('Gateway stopped.');\n    }\n  }\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,YAAY,cAAc,qBAAqB;AACxD,SAAS,YAAY;AAKrB,IAAqB,iBAArB,cAA4C,YAAY;AAAA,EACtD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,aAAa,KAAK,QAAQ,IAAI,GAAG,WAAW,eAAe;AAEjE,QAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAK,IAAI,6DAAwD;AACjE;AAAA,IACF;AAEA,UAAM,WAAoC,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AAEtF,QAAI,UAAU;AAGd,QAAI,SAAS,OAAO;AAClB,aAAO,SAAS;AAChB,WAAK,IAAI,0CAA0C;AACnD,gBAAU;AAAA,IACZ;AAGA,UAAM,MAAM,SAAS;AACrB,QAAI,KAAK,eAAe,KAAK,qBAAqB;AAChD,aAAO,IAAI;AACX,aAAO,IAAI;AACX,UAAI,OAAO,KAAK,GAAG,EAAE,WAAW,GAAG;AACjC,eAAO,SAAS;AAAA,MAClB;AACA,WAAK,IAAI,wEAAwE;AACjF,gBAAU;AAAA,IACZ;AAEA,QAAI,SAAS;AACX,oBAAc,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAAA,IACpE,OAAO;AACL,WAAK,IAAI,6DAAwD;AAAA,IACnE;AAIA,QAAI,kBAAkB,QAAQ,IAAI,CAAC,GAAG;AACpC,WAAK,IAAI,kDAAkD;AAC3D,gBAAU;AAAA,IACZ;AACA,QAAI,sBAAsB,GAAG;AAC3B,WAAK,IAAI,oDAAoD;AAC7D,gBAAU;AAAA,IACZ;AAGA,UAAM,qBAAqB,KAAK,QAAQ,IAAI,GAAG,WAAW,eAAe;AACzE,QAAI,WAAW,kBAAkB,GAAG;AAClC,UAAI;AACF,cAAM,iBAAiB,KAAK,MAAM,aAAa,oBAAoB,OAAO,CAAC;AAC3E,YAAI,eAAe,YAAY,GAAG,SAAS,WAAW,GAAG;AACvD,iBAAO,eAAe,YAAY;AAClC,iBAAO,eAAe,qBAAqB;AAC3C,wBAAc,oBAAoB,KAAK,UAAU,gBAAgB,MAAM,CAAC,IAAI,IAAI;AAChF,eAAK,IAAI,iDAAiD;AAC1D,oBAAU;AAAA,QACZ;AAAA,MACF,QAAQ;AAAA,MAA6B;AAAA,IACvC;AAGA,QAAI,mBAAmB,QAAQ,IAAI,CAAC,GAAG;AACrC,WAAK,IAAI,8CAA8C;AACvD,gBAAU;AAAA,IACZ;AAGA,QAAI,uBAAuB,QAAQ,IAAI,CAAC,GAAG;AACzC,WAAK,IAAI,kDAAkD;AAC3D,gBAAU;AAAA,IACZ;AACA,QAAI,2BAA2B,GAAG;AAChC,WAAK,IAAI,2DAA2D;AACpE,gBAAU;AAAA,IACZ;AAGA,QAAI,wBAAwB,QAAQ,IAAI,CAAC,GAAG;AAC1C,WAAK,IAAI,iDAAiD;AAC1D,gBAAU;AAAA,IACZ;AACA,QAAI,4BAA4B,GAAG;AACjC,WAAK,IAAI,iDAAiD;AAC1D,gBAAU;AAAA,IACZ;AACA,QAAI,4BAA4B,GAAG;AACjC,WAAK,IAAI,gDAAgD;AACzD,gBAAU;AAAA,IACZ;AAGA,QAAI,uBAAuB,GAAG;AAC5B,WAAK,IAAI,iCAAiC;AAC1C,gBAAU;AAAA,IACZ;AAGA,QAAI,YAAY,GAAG;AACjB,WAAK,IAAI,kBAAkB;AAAA,IAC7B;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { existsSync, readFileSync, writeFileSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport { stopGateway } from '../../lib/gateway-lifecycle.js';\nimport { removeClaudeCodeHooks, removeCursorHooks, removeCursorUserHooks, removeCopilotHooks, removeAntigravityHooks, removeAntigravityUserHooks, removeVSCodeProxyConfig, uninstallMacOSProxyEnv, removeVSCodeUserProxyConfig, removeCursorUserProxyConfig } from '../../lib/hooks-config.js';\n\nexport default class HooksUninstall extends BaseCommand {\n  static override description = 'Remove session tracking hooks from the current project';\n\n  static override examples = [\n    '<%= config.bin %> hooks uninstall',\n  ];\n\n  async run(): Promise<void> {\n    const configPath = join(process.cwd(), '.claude', 'settings.json');\n\n    if (!existsSync(configPath)) {\n      this.log('No .claude/settings.json found \u2014 nothing to uninstall.');\n      return;\n    }\n\n    const settings: Record<string, unknown> = JSON.parse(readFileSync(configPath, 'utf-8'));\n\n    let changed = false;\n\n    // Remove only RuleMetric's hooks \u2014 preserve the user's own. The old wholesale\n    // `delete settings.hooks` also nuked unrelated project hooks.\n    if (removeClaudeCodeHooks(settings)) {\n      this.log('Removed RuleMetric hooks from .claude/settings.json');\n      changed = true;\n    }\n\n    // Remove gateway proxy env\n    const env = settings.env as Record<string, string> | undefined;\n    if (env?.HTTPS_PROXY || env?.NODE_EXTRA_CA_CERTS) {\n      delete env.HTTPS_PROXY;\n      delete env.NODE_EXTRA_CA_CERTS;\n      if (Object.keys(env).length === 0) {\n        delete settings.env;\n      }\n      this.log('Removed HTTPS_PROXY and NODE_EXTRA_CA_CERTS from .claude/settings.json');\n      changed = true;\n    }\n\n    if (changed) {\n      writeFileSync(configPath, JSON.stringify(settings, null, 2) + '\\n');\n    } else {\n      this.log('No hooks or proxy config found \u2014 nothing to uninstall.');\n    }\n\n    // Remove Cursor hooks\n    // Remove Cursor and Copilot hooks\n    if (removeCursorHooks(process.cwd())) {\n      this.log('Removed RuleMetric hooks from .cursor/hooks.json');\n      changed = true;\n    }\n    if (removeCursorUserHooks()) {\n      this.log('Removed RuleMetric hooks from ~/.cursor/hooks.json');\n      changed = true;\n    }\n\n    // Remove Cursor proxy config\n    const cursorSettingsPath = join(process.cwd(), '.cursor', 'settings.json');\n    if (existsSync(cursorSettingsPath)) {\n      try {\n        const cursorSettings = JSON.parse(readFileSync(cursorSettingsPath, 'utf-8'));\n        if (cursorSettings['http.proxy']?.includes('localhost')) {\n          delete cursorSettings['http.proxy'];\n          delete cursorSettings['http.proxyStrictSSL'];\n          writeFileSync(cursorSettingsPath, JSON.stringify(cursorSettings, null, 2) + '\\n');\n          this.log('Removed proxy config from .cursor/settings.json');\n          changed = true;\n        }\n      } catch { /* not valid JSON, skip */ }\n    }\n\n    // Remove Copilot hooks\n    if (removeCopilotHooks(process.cwd())) {\n      this.log('Removed RuleMetric hooks from .github/hooks/');\n      changed = true;\n    }\n\n    // Remove Antigravity hooks (workspace + user)\n    if (removeAntigravityHooks(process.cwd())) {\n      this.log('Removed RuleMetric block from .agents/hooks.json');\n      changed = true;\n    }\n    if (removeAntigravityUserHooks()) {\n      this.log('Removed RuleMetric block from ~/.gemini/config/hooks.json');\n      changed = true;\n    }\n\n    // Remove VS Code proxy config (workspace + user settings)\n    if (removeVSCodeProxyConfig(process.cwd())) {\n      this.log('Removed proxy config from .vscode/settings.json');\n      changed = true;\n    }\n    if (removeVSCodeUserProxyConfig()) {\n      this.log('Removed proxy config from VS Code user settings');\n      changed = true;\n    }\n    if (removeCursorUserProxyConfig()) {\n      this.log('Removed proxy config from Cursor user settings');\n      changed = true;\n    }\n\n    // Remove macOS LaunchAgent + launchctl env vars\n    if (uninstallMacOSProxyEnv()) {\n      this.log('Removed HTTPS_PROXY LaunchAgent');\n      changed = true;\n    }\n\n    // Stop gateway\n    if (stopGateway()) {\n      this.log('Gateway stopped.');\n    }\n  }\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,YAAY,cAAc,qBAAqB;AACxD,SAAS,YAAY;AAKrB,IAAqB,iBAArB,cAA4C,YAAY;AAAA,EACtD,OAAgB,cAAc;AAAA,EAE9B,OAAgB,WAAW;AAAA,IACzB;AAAA,EACF;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,aAAa,KAAK,QAAQ,IAAI,GAAG,WAAW,eAAe;AAEjE,QAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,WAAK,IAAI,6DAAwD;AACjE;AAAA,IACF;AAEA,UAAM,WAAoC,KAAK,MAAM,aAAa,YAAY,OAAO,CAAC;AAEtF,QAAI,UAAU;AAId,QAAI,sBAAsB,QAAQ,GAAG;AACnC,WAAK,IAAI,qDAAqD;AAC9D,gBAAU;AAAA,IACZ;AAGA,UAAM,MAAM,SAAS;AACrB,QAAI,KAAK,eAAe,KAAK,qBAAqB;AAChD,aAAO,IAAI;AACX,aAAO,IAAI;AACX,UAAI,OAAO,KAAK,GAAG,EAAE,WAAW,GAAG;AACjC,eAAO,SAAS;AAAA,MAClB;AACA,WAAK,IAAI,wEAAwE;AACjF,gBAAU;AAAA,IACZ;AAEA,QAAI,SAAS;AACX,oBAAc,YAAY,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI,IAAI;AAAA,IACpE,OAAO;AACL,WAAK,IAAI,6DAAwD;AAAA,IACnE;AAIA,QAAI,kBAAkB,QAAQ,IAAI,CAAC,GAAG;AACpC,WAAK,IAAI,kDAAkD;AAC3D,gBAAU;AAAA,IACZ;AACA,QAAI,sBAAsB,GAAG;AAC3B,WAAK,IAAI,oDAAoD;AAC7D,gBAAU;AAAA,IACZ;AAGA,UAAM,qBAAqB,KAAK,QAAQ,IAAI,GAAG,WAAW,eAAe;AACzE,QAAI,WAAW,kBAAkB,GAAG;AAClC,UAAI;AACF,cAAM,iBAAiB,KAAK,MAAM,aAAa,oBAAoB,OAAO,CAAC;AAC3E,YAAI,eAAe,YAAY,GAAG,SAAS,WAAW,GAAG;AACvD,iBAAO,eAAe,YAAY;AAClC,iBAAO,eAAe,qBAAqB;AAC3C,wBAAc,oBAAoB,KAAK,UAAU,gBAAgB,MAAM,CAAC,IAAI,IAAI;AAChF,eAAK,IAAI,iDAAiD;AAC1D,oBAAU;AAAA,QACZ;AAAA,MACF,QAAQ;AAAA,MAA6B;AAAA,IACvC;AAGA,QAAI,mBAAmB,QAAQ,IAAI,CAAC,GAAG;AACrC,WAAK,IAAI,8CAA8C;AACvD,gBAAU;AAAA,IACZ;AAGA,QAAI,uBAAuB,QAAQ,IAAI,CAAC,GAAG;AACzC,WAAK,IAAI,kDAAkD;AAC3D,gBAAU;AAAA,IACZ;AACA,QAAI,2BAA2B,GAAG;AAChC,WAAK,IAAI,2DAA2D;AACpE,gBAAU;AAAA,IACZ;AAGA,QAAI,wBAAwB,QAAQ,IAAI,CAAC,GAAG;AAC1C,WAAK,IAAI,iDAAiD;AAC1D,gBAAU;AAAA,IACZ;AACA,QAAI,4BAA4B,GAAG;AACjC,WAAK,IAAI,iDAAiD;AAC1D,gBAAU;AAAA,IACZ;AACA,QAAI,4BAA4B,GAAG;AACjC,WAAK,IAAI,gDAAgD;AACzD,gBAAU;AAAA,IACZ;AAGA,QAAI,uBAAuB,GAAG;AAC5B,WAAK,IAAI,iCAAiC;AAC1C,gBAAU;AAAA,IACZ;AAGA,QAAI,YAAY,GAAG;AACjB,WAAK,IAAI,kBAAkB;AAAA,IAC7B;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/commands/research/backfill.js

@@ -1,9 +1,9 @@
-import {
-  scanAllTranscripts
-} from "../../chunk-WA4MWYRW.js";
 import {
   postObservations
 } from "../../chunk-UF73WX2J.js";
+import {
+  scanAllTranscripts
+} from "../../chunk-WA4MWYRW.js";
 import {
   BaseCommand
 } from "../../chunk-S56LOTGQ.js";

package/dist/commands/research/tail-transcript.js

@@ -1,11 +1,11 @@
+import {
+  postObservations
+} from "../../chunk-UF73WX2J.js";
 import {
   loadOffsets,
   saveOffsets,
   tailJsonl
 } from "../../chunk-WA4MWYRW.js";
-import {
-  postObservations
-} from "../../chunk-UF73WX2J.js";
 import {
   BaseCommand
 } from "../../chunk-S56LOTGQ.js";

package/dist/commands/service/install.js

@@ -58,7 +58,13 @@ var ALLOWED_ENV_VARS = /* @__PURE__ */ new Set([
   // sender (noreply@rulemetric.com) — otherwise the provider defaults to
   // Resend's shared sandbox `onboarding@resend.dev`, which Gmail spam-filters.
   "RESEND_API_KEY",
-  "RESEND_FROM_EMAIL"
+  "RESEND_FROM_EMAIL",
+  // Sentry error capture for the worker process. The worker (`evals agent`)
+  // calls initSentry(), which now keys off DSN presence alone. Without this in
+  // the allow-list the installer stripped SENTRY_DSN from the worker plist, so
+  // worker crashes went unreported even when the DSN was set in .env.local /
+  // ~/.config/rulemetric/env. The DSN is ingest-only (not a secret).
+  "SENTRY_DSN"
 ]);
 var PLIST_LABEL = "com.rulemetric.api";
 var PLIST_PATH = join(homedir(), "Library", "LaunchAgents", `${PLIST_LABEL}.plist`);

package/dist/commands/service/install.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/commands/service/install.ts"],
-  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { execSync, execFileSync, spawnSync } from 'node:child_process';\nimport { homedir } from 'node:os';\nimport { dirname, join } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { detectTmux } from '../../lib/detect-tmux.js';\n\n// Only these env vars are written to the plist \u2014 never leak unrelated secrets\nconst ALLOWED_ENV_VARS = new Set([\n  'SUPABASE_URL',\n  'SUPABASE_ANON_KEY',\n  'SUPABASE_SERVICE_ROLE_KEY',\n  // Enables local HS256 JWT verification in the API's authMiddleware \u2014\n  // without it every authed request pays a /auth/v1/user network round-trip\n  // (measured p50 ~244ms) to Supabase.\n  'SUPABASE_JWT_SECRET',\n  'DATABASE_URL',\n  'RULEMETRIC_API_URL',\n  'RULEMETRIC_API_KEY',\n  'RULEMETRIC_ACCESS_TOKEN',\n  // Recipient for the weekly cron_data_integrity_audit notification.\n  // Without one of these, the audit cron runs but nobody is notified \u2014\n  // see cron-data-integrity-audit.ts (defaults: NOTIFY_USER_ID then USER_ID).\n  'RULEMETRIC_AUDIT_NOTIFY_USER_ID',\n  'RULEMETRIC_USER_ID',\n  // cron_refresh_skills needs an authenticated GitHub API budget (5000\n  // req/hr) \u2014 without it the handler skips and the skills registry goes\n  // stale, which makes cron_suggest_instructions mark every suggestion\n  // stale on each nightly run.\n  'GITHUB_TOKEN',\n  // Pool-tuning overrides so the plist generators (buildPlist / buildWorkerPlist)\n  // actually honor a user-set value instead of always falling back to the pinned\n  // default \u2014 without these in the allow-list the `envVars.PG_* ?? '<default>'`\n  // escape hatch was silently dead. Pool-exhaustion RCA 2026-06-21.\n  'PG_POOL_MAX',\n  'PG_IDLE_TIMEOUT',\n  'PG_STATEMENT_TIMEOUT_MS',\n  // Resend transactional email. The worker (`evals agent`) sends changelog\n  // announcements via `@rulemetric/email` \u2192 `sendEmail()`, which picks the\n  // provider from `process.env.RESEND_API_KEY`. Without these in the allow-list\n  // the installer stripped them out of the worker plist, the CLI never loads\n  // `.env.local`, so the worker fell back to the `noop` provider and SILENTLY\n  // dropped every announcement email. RESEND_FROM_EMAIL must be the verified\n  // sender (noreply@rulemetric.com) \u2014 otherwise the provider defaults to\n  // Resend's shared sandbox `onboarding@resend.dev`, which Gmail spam-filters.\n  'RESEND_API_KEY',\n  'RESEND_FROM_EMAIL',\n]);\n\nconst PLIST_LABEL = 'com.rulemetric.api';\nconst PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.plist`);\nconst WORKER_PLIST_LABEL = 'com.rulemetric.worker';\nconst WORKER_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${WORKER_PLIST_LABEL}.plist`);\nconst GATEWAY_PLIST_LABEL = 'com.rulemetric.gateway';\nconst GATEWAY_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${GATEWAY_PLIST_LABEL}.plist`);\nconst PROXY_PLIST_LABEL = 'com.rulemetric.proxy';\nconst PROXY_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${PROXY_PLIST_LABEL}.plist`);\n// Daily kickstart agent \u2014 see Phase 4c cleanup block below. Kept as a constant\n// so we can tear it down on every install if a stale copy is lying around.\nconst WORKER_RESTART_PLIST_LABEL = 'com.rulemetric.worker.restart';\nconst WORKER_RESTART_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${WORKER_RESTART_PLIST_LABEL}.plist`);\nconst CONFIG_DIR = join(homedir(), '.config', 'rulemetric');\nconst LOG_DIR = join(CONFIG_DIR, 'logs');\nconst GATEWAY_PORT = 8787;\nconst PROXY_PORT = 8788;\n// Linux systemd --user unit for the worker-only install path.\nconst WORKER_SYSTEMD_DIR = join(homedir(), '.config', 'systemd', 'user');\nconst WORKER_SYSTEMD_UNIT = 'rulemetric-worker.service';\nconst WORKER_SYSTEMD_PATH = join(WORKER_SYSTEMD_DIR, WORKER_SYSTEMD_UNIT);\n\nexport default class ServiceInstall extends BaseCommand {\n  static override description =\n    'Install RuleMetric services. Default (in a repo checkout): API + worker + gateway + capture proxy as launchd agents. With --worker-only: just the job worker, targeting the globally-installed CLI \u2014 no repo, no build (works from `npm i -g @rulemetric/cli`, macOS launchd or Linux systemd).';\n\n  static override examples = [\n    '<%= config.bin %> service install',\n    '<%= config.bin %> service install --port 3000',\n    '<%= config.bin %> service install --skip-build',\n    '<%= config.bin %> service install --no-proxy',\n    '<%= config.bin %> service install --worker-only',\n  ];\n\n  static override flags = {\n    port: Flags.integer({\n      char: 'p',\n      default: 3000,\n      description: 'API server port',\n    }),\n    force: Flags.boolean({\n      char: 'f',\n      default: false,\n      description: 'Overwrite existing service configuration and reclaim conflicting ports',\n    }),\n    'skip-build': Flags.boolean({\n      default: false,\n      description: 'Skip the pre-install workspace build (API/web/cli dist must already exist)',\n    }),\n    'no-proxy': Flags.boolean({\n      default: false,\n      description: 'Skip gateway + mitmproxy plists (just install API + worker)',\n    }),\n    'worker-only': Flags.boolean({\n      default: false,\n      description:\n        'Install ONLY the job worker as a persistent service, targeting the globally-installed CLI (no repo checkout, no build, no API/gateway/proxy). Sources auth from ~/.config/rulemetric/env. macOS (launchd) + Linux (systemd --user).',\n    }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(ServiceInstall);\n    const port = flags.port;\n    const skipBuild = flags['skip-build'];\n    const noProxy = flags['no-proxy'];\n\n    // Worker-only path: a no-repo, no-build installer for end users on the\n    // globally-installed CLI. Diverges so completely from the full monorepo\n    // install (no findProjectRoot, no .env.local, no turbo build, no\n    // API/gateway/proxy) that it gets its own method rather than threading\n    // `if (!workerOnly)` through 200 lines below. Supports macOS + Linux.\n    if (flags['worker-only']) {\n      await this.runWorkerOnly(flags.force);\n      return;\n    }\n\n    // The full install (API + web + gateway + proxy) is macOS-only.\n    if (process.platform !== 'darwin') {\n      this.error(\n        'The full service install is macOS-only (launchd). For just the job worker on Linux (or a clean npm install), use: rulemetric service install --worker-only',\n      );\n    }\n\n    // Existing-service guard. Presence of the API plist implies a prior\n    // install \u2014 we only proceed automatically when --force is set so a\n    // user doesn't accidentally overwrite a working config.\n    if (existsSync(PLIST_PATH) && !flags.force) {\n      this.log(`Service already installed at ${PLIST_PATH}`);\n      this.log('Use --force to overwrite, or run: rulemetric service status');\n      return;\n    }\n\n    // API port conflict. Without --force we bail; with --force we'll reclaim\n    // the port later in killStaleProcess so launchd can actually bind it.\n    try {\n      const res = await fetch(`http://localhost:${port}/health`);\n      if (res.ok && !flags.force) {\n        this.warn(`Port ${port} is already in use (API may be running via start.sh or in another terminal).`);\n        this.warn('Stop it first with scripts/stop.sh, or use --force to take over the port.');\n        return;\n      }\n    } catch {\n      // Port free \u2014 good\n    }\n\n    // Find project root\n    const projectRoot = this.findProjectRoot();\n    if (!projectRoot) {\n      this.error(\n        'Could not find RuleMetric project root. Run this command from within the momento-mori repo, or set RULEMETRIC_PROJECT_ROOT.',\n      );\n    }\n\n    // Verify .env.local\n    const envLocal = join(projectRoot, '.env.local');\n    if (!existsSync(envLocal)) {\n      this.error(`.env.local not found at ${envLocal}. The API needs Supabase credentials to start.`);\n    }\n\n    // Load env vars (filtered by ALLOWED_ENV_VARS)\n    const envVars = this.guardAlwaysOnDatabaseUrl(this.loadEnvVars(projectRoot));\n\n    // Resolve binaries\n    const nodePath = this.findBinary('node');\n    const pnpmPath = this.findBinary('pnpm');\n    if (!nodePath || !pnpmPath) {\n      this.error('Could not find node or pnpm. Ensure they are in your PATH.');\n    }\n\n    // Resolve mitmdump (required unless --no-proxy). We resolve via `which`\n    // so the plist gets an absolute path \u2014 launchd's PATH at GUI session\n    // start can be narrow, and pyenv shims often don't appear in it.\n    let mitmdumpPath: string | null = null;\n    if (!noProxy) {\n      mitmdumpPath = this.findBinary('mitmdump');\n      if (!mitmdumpPath) {\n        this.error(\n          'mitmdump not found in PATH. Install with: pipx install mitmproxy (or brew install mitmproxy), then re-run.\\n' +\n          'Or skip the capture proxy with --no-proxy.',\n        );\n      }\n    }\n\n    // \u2500\u2500 Pre-install build \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // Mirrors the Dockerfile prod stage: API + web + CLI all need their\n    // dist/ directories to exist before launchd starts the processes. We\n    // run the whole set via turbo so the cache eats the cost on re-installs.\n    if (!skipBuild) {\n      this.log('[..] Building workspace artifacts (api, web, cli) via turbo...');\n      const buildFilters = [\n        '--filter', '@rulemetric/api...',\n        '--filter', '@rulemetric/web...',\n        '--filter', '@rulemetric/cli',\n      ];\n      const build = spawnSync(pnpmPath!, ['exec', 'turbo', 'run', 'build', ...buildFilters], {\n        cwd: projectRoot,\n        stdio: 'inherit',\n      });\n      if (build.status !== 0) {\n        this.error(\n          `Workspace build failed (exit ${build.status}). Fix the build first, or use --skip-build if dist/ already exists.`,\n        );\n      }\n      this.log('[OK] Build complete');\n    } else {\n      this.log('[..] Skipping pre-install build (--skip-build)');\n    }\n\n    // Verify the build artifacts launchd is about to invoke. A missing\n    // entry would crash-loop the plist; surfacing it here is friendlier.\n    const apiEntry = join(projectRoot, 'apps', 'api', 'dist', 'index.js');\n    if (!existsSync(apiEntry)) {\n      this.error(`API entry not found at ${apiEntry}. Re-run without --skip-build, or: pnpm --filter @rulemetric/api... build`);\n    }\n    const webIndex = join(projectRoot, 'apps', 'web', 'dist', 'index.html');\n    if (!existsSync(webIndex)) {\n      this.warn(`Web bundle not found at ${webIndex}. Dashboard at :${port} will 404 until you build apps/web.`);\n    }\n    if (!noProxy) {\n      const gatewayEntry = join(projectRoot, 'apps', 'cli', 'dist', 'lib', 'gateway-entry.js');\n      if (!existsSync(gatewayEntry)) {\n        this.error(`Gateway entry not found at ${gatewayEntry}. Re-run without --skip-build, or: pnpm --filter @rulemetric/cli build`);\n      }\n    }\n\n    // \u2500\u2500 Clean up conflicting PID-file-managed or orphan processes \u2500\n    // hooks install + proxy start use PID files; we replace those with\n    // launchd-managed lifecycles so both ports need to be free before\n    // bootstrap. With --force we also clear whatever is squatting on\n    // the API port.\n    if (flags.force) {\n      this.killStaleProcess(port, null, 'API on :' + port);\n    }\n    if (!noProxy) {\n      this.killStaleProcess(GATEWAY_PORT, join(CONFIG_DIR, 'gateway.pid'), 'gateway');\n      this.killStaleProcess(PROXY_PORT, join(CONFIG_DIR, 'proxy.pid'), 'mitmproxy');\n    }\n\n    // Create dirs\n    mkdirSync(join(homedir(), 'Library', 'LaunchAgents'), { recursive: true });\n    mkdirSync(LOG_DIR, { recursive: true });\n\n    const uid = execSync('id -u', { encoding: 'utf-8' }).trim();\n\n    // \u2500\u2500 Install API service \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    const apiPlist = this.buildPlist({ port, projectRoot, nodePath: nodePath!, pnpmPath: pnpmPath!, envVars });\n    this.bootoutAndWrite(uid, PLIST_PATH, apiPlist, 'API');\n    this.bootstrapPlist(uid, PLIST_PATH, 'API');\n\n    // Wait for API to come up\n    this.log(`[..] Waiting for API on :${port}...`);\n    const apiStarted = await this.waitForApi(port, 15);\n    if (apiStarted) {\n      this.log(`[OK] RuleMetric API running on :${port}`);\n      if (existsSync(webIndex)) {\n        this.log(`[OK] Dashboard available at http://localhost:${port}`);\n      }\n    } else {\n      this.warn('API did not respond within 15s. Check logs:');\n      this.log(`  tail -f ${LOG_DIR}/api-stdout.log`);\n      this.log(`  tail -f ${LOG_DIR}/api-stderr.log`);\n    }\n\n    // \u2500\u2500 Install worker service \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    this.log('');\n    this.log('Installing worker service...');\n    // Reap detached, unsupervised evals-agent orphans before bootstrapping the\n    // worker \u2014 they hold no listening port, so killStaleProcess can't find them\n    // (a fleet of 4 ran 3+ days and helped saturate the pool). RCA 2026-06-21.\n    this.killStaleAgents();\n    const workerPlist = this.buildWorkerPlist({\n      cliBin: join(projectRoot, 'apps', 'cli', 'bin', 'run.js'),\n      cliDist: join(projectRoot, 'apps', 'cli', 'dist'),\n      workingDir: projectRoot,\n      nodePath: nodePath!,\n      pnpmPath: pnpmPath!,\n      envVars,\n    });\n    this.bootoutAndWrite(uid, WORKER_PLIST_PATH, workerPlist, 'Worker');\n    this.bootstrapPlist(uid, WORKER_PLIST_PATH, 'Worker');\n\n    // \u2500\u2500 Install gateway + capture-proxy services \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    if (!noProxy) {\n      this.log('');\n      this.log('Installing gateway + capture proxy services...');\n\n      const gatewayPlist = this.buildGatewayPlist({ projectRoot, nodePath: nodePath! });\n      this.bootoutAndWrite(uid, GATEWAY_PLIST_PATH, gatewayPlist, 'Gateway');\n      this.bootstrapPlist(uid, GATEWAY_PLIST_PATH, 'Gateway');\n\n      const proxyPlist = this.buildProxyPlist({\n        projectRoot,\n        mitmdumpPath: mitmdumpPath!,\n        envVars,\n      });\n      this.bootoutAndWrite(uid, PROXY_PLIST_PATH, proxyPlist, 'Proxy');\n      this.bootstrapPlist(uid, PROXY_PLIST_PATH, 'Proxy');\n    }\n\n    // Phase 4c cleanup: the daily worker-restart agent (04:00 kickstart)\n    // existed to dodge the graphile-LISTEN-wedge class observed at ~25h\n    // worker uptime. The agent path has no LISTEN socket, so the wedge\n    // class is structurally gone \u2014 the daily kickstart is dead weight.\n    // Bootout any leftover plist from prior installs so reinstall is a\n    // truly clean state.\n    if (existsSync(WORKER_RESTART_PLIST_PATH)) {\n      try {\n        execFileSync('launchctl', ['bootout', `gui/${uid}`, WORKER_RESTART_PLIST_PATH], { encoding: 'utf-8' });\n      } catch {\n        // Expected if not loaded\n      }\n      try {\n        execFileSync('rm', ['-f', WORKER_RESTART_PLIST_PATH]);\n        this.log('[OK] Removed stale daily worker-restart agent (no longer needed on agent path)');\n      } catch {\n        // Best-effort\n      }\n    }\n\n    this.log('');\n    if (noProxy) {\n      this.log('Installed: API + worker. Gateway/proxy skipped (--no-proxy).');\n    } else {\n      this.log('Installed: API + worker + gateway + capture proxy.');\n    }\n    this.log('All services start at login, restart on crash, and pick up rebuilds via WatchPaths.');\n    this.log('');\n    this.log('NOTE: Env vars are baked in at install time. If you change');\n    this.log('.env.local or credentials, re-run: rulemetric service install --force');\n    this.log('');\n    this.log('Manage with:');\n    this.log('  rulemetric service status    \u2014 check if running');\n    this.log('  rulemetric service uninstall \u2014 remove all services');\n\n    // Ensure the active-org cache reflects the user's current active_org_id\n    // before the worker spawns its first capture. Belt-and-suspenders with\n    // BaseCommand's guarded refresh.\n    await bootstrapActiveOrg();\n\n    // Soft tmux capability check \u2014 see hooks/install.ts for the same line.\n    const tmux = await detectTmux();\n    this.log('');\n    if (tmux.available) {\n      this.log(`[OK] tmux found${tmux.version ? ` (v${tmux.version})` : ''} \u2014 live send enabled`);\n    } else {\n      this.log('[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux');\n    }\n  }\n\n  /**\n   * Worker-only install: a persistent job worker for end users on the\n   * globally-installed CLI, with NO repo checkout, NO build, and NO\n   * API/gateway/proxy. macOS \u2192 launchd; Linux \u2192 systemd --user. Auth is\n   * sourced from ~/.config/rulemetric/env (written by `rulemetric auth\n   * login`); the thin-agent worker is HTTP-only (long-polls /api/work/next),\n   * so it needs only the API URL + a key/token, never DB credentials.\n   */\n  private async runWorkerOnly(force: boolean): Promise<void> {\n    const platform = process.platform;\n    if (platform !== 'darwin' && platform !== 'linux') {\n      this.error(`--worker-only supports macOS (launchd) and Linux (systemd) only; detected '${platform}'.`);\n    }\n\n    // Resolve node + the GLOBAL CLI entry (the installed package root, NOT a\n    // repo). oclif's this.config.root is the package directory; bin/run.js is\n    // shipped in the published tarball (\"files\": [\"bin\", ...]).\n    const nodePath = this.findBinary('node');\n    if (!nodePath) {\n      this.error('Could not find `node` in PATH.');\n    }\n    const cliBin = join(this.config.root, 'bin', 'run.js');\n    if (!existsSync(cliBin)) {\n      this.error(\n        `Could not locate the installed CLI entry at ${cliBin}. Reinstall the CLI (e.g. npm i -g @rulemetric/cli) and re-run.`,\n      );\n    }\n    const cliDist = join(this.config.root, 'dist');\n\n    const envVars = this.loadGlobalWorkerEnv();\n    if (!envVars.RULEMETRIC_API_KEY && !envVars.RULEMETRIC_ACCESS_TOKEN) {\n      this.error(\n        'Not authenticated \u2014 no RULEMETRIC_API_KEY/RULEMETRIC_ACCESS_TOKEN in ~/.config/rulemetric/env.\\nRun `rulemetric auth login` first, then re-run `rulemetric service install --worker-only`.',\n      );\n    }\n    // Default to prod so a user who never set RULEMETRIC_API_URL still works.\n    if (!envVars.RULEMETRIC_API_URL) {\n      envVars.RULEMETRIC_API_URL = 'https://rulemetric.com';\n    }\n\n    mkdirSync(LOG_DIR, { recursive: true });\n    // Reap any orphaned foreground `evals agent` the user may have started by\n    // hand \u2014 otherwise two workers double-claim jobs.\n    this.killStaleAgents();\n\n    if (platform === 'darwin') {\n      if (existsSync(WORKER_PLIST_PATH) && !force) {\n        this.log(`Worker already installed at ${WORKER_PLIST_PATH}.`);\n        this.log('Use --force to overwrite, or run: rulemetric service status');\n        return;\n      }\n      mkdirSync(join(homedir(), 'Library', 'LaunchAgents'), { recursive: true });\n      const uid = execSync('id -u', { encoding: 'utf-8' }).trim();\n      const plist = this.buildWorkerPlist({\n        cliBin,\n        cliDist,\n        workingDir: homedir(),\n        nodePath: nodePath!,\n        nodeEnv: 'production',\n        envVars,\n      });\n      this.bootoutAndWrite(uid, WORKER_PLIST_PATH, plist, 'Worker');\n      this.bootstrapPlist(uid, WORKER_PLIST_PATH, 'Worker');\n      this.log('');\n      this.log('[OK] Worker installed (launchd). Starts at login, restarts on crash.');\n      this.log(`     Logs: tail -f ${join(LOG_DIR, 'worker-stdout.log')}`);\n    } else {\n      // Linux: systemd --user unit.\n      if (existsSync(WORKER_SYSTEMD_PATH) && !force) {\n        this.log(`Worker already installed at ${WORKER_SYSTEMD_PATH}.`);\n        this.log(`Use --force to overwrite, or: systemctl --user status ${WORKER_SYSTEMD_UNIT}`);\n        return;\n      }\n      mkdirSync(WORKER_SYSTEMD_DIR, { recursive: true });\n      const unit = this.buildWorkerSystemdUnit({ cliBin, nodePath: nodePath!, envVars });\n      writeFileSync(WORKER_SYSTEMD_PATH, unit, { mode: 0o600 });\n      this.log(`[OK] Wrote ${WORKER_SYSTEMD_PATH}`);\n      try {\n        execFileSync('systemctl', ['--user', 'daemon-reload']);\n        execFileSync('systemctl', ['--user', 'enable', '--now', WORKER_SYSTEMD_UNIT]);\n        this.log('[OK] Worker enabled + started (systemctl --user).');\n        this.log('     Survive logout/reboot: sudo loginctl enable-linger \"$USER\"');\n        this.log(`     Logs: journalctl --user -u ${WORKER_SYSTEMD_UNIT} -f`);\n      } catch (err) {\n        this.warn(\n          `Wrote the unit but \\`systemctl --user\\` failed: ${err instanceof Error ? err.message : String(err)}`,\n        );\n        this.log(\n          `Enable it manually: systemctl --user daemon-reload && systemctl --user enable --now ${WORKER_SYSTEMD_UNIT}`,\n        );\n      }\n    }\n\n    this.log('');\n    this.log('Manage with:');\n    this.log('  rulemetric service status    \u2014 check if running');\n    this.log('  rulemetric service uninstall \u2014 remove the worker');\n\n    // Keep the active-org cache warm for the worker's first capture.\n    await bootstrapActiveOrg();\n  }\n\n  /**\n   * Load worker env from ~/.config/rulemetric/env only (no repo .env.local).\n   * Filtered by ALLOWED_ENV_VARS, same as the full install's loader.\n   */\n  private loadGlobalWorkerEnv(): Record<string, string> {\n    const vars: Record<string, string> = {};\n    const globalEnv = join(CONFIG_DIR, 'env');\n    if (existsSync(globalEnv)) {\n      for (const line of readFileSync(globalEnv, 'utf-8').split('\\n')) {\n        const trimmed = line.trim();\n        if (!trimmed || trimmed.startsWith('#')) continue;\n        const eqIdx = trimmed.indexOf('=');\n        if (eqIdx > 0) {\n          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);\n        }\n      }\n    }\n    return Object.fromEntries(Object.entries(vars).filter(([k]) => ALLOWED_ENV_VARS.has(k)));\n  }\n\n  /** systemd --user unit for the Linux worker-only path. */\n  private buildWorkerSystemdUnit(opts: {\n    cliBin: string;\n    nodePath: string;\n    envVars: Record<string, string>;\n  }): string {\n    const { cliBin, nodePath, envVars } = opts;\n    const env: Record<string, string> = {\n      ...envVars,\n      NODE_ENV: 'production',\n      // Mirror the launchd worker's pooler bound (RCA 2026-06-21).\n      PG_POOL_MAX: envVars.PG_POOL_MAX ?? '3',\n      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? '10',\n    };\n    // systemd Environment= values: wrap in double quotes and escape embedded\n    // quotes/backslashes. Tokens/URLs carry neither, but be defensive.\n    const envLines = Object.entries(env)\n      .map(([k, v]) => `Environment=\"${k}=${v.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"')}\"`)\n      .join('\\n');\n    return `[Unit]\nDescription=RuleMetric job worker (evals agent)\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nExecStart=${nodePath} ${cliBin} evals agent\nRestart=on-failure\nRestartSec=15\n${envLines}\n\n[Install]\nWantedBy=default.target\n`;\n  }\n\n  private findProjectRoot(): string | null {\n    // Check env var override\n    if (process.env.RULEMETRIC_PROJECT_ROOT) {\n      return process.env.RULEMETRIC_PROJECT_ROOT;\n    }\n    // Walk up from cwd looking for the monorepo marker\n    let dir = process.cwd();\n    for (let i = 0; i < 10; i++) {\n      if (existsSync(join(dir, 'apps', 'api', 'package.json'))) {\n        return dir;\n      }\n      const parent = join(dir, '..');\n      if (parent === dir) break;\n      dir = parent;\n    }\n    return null;\n  }\n\n  private findBinary(name: string): string | null {\n    try {\n      return execFileSync('which', [name], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }).trim() || null;\n    } catch {\n      return null;\n    }\n  }\n\n  private loadEnvVars(projectRoot: string): Record<string, string> {\n    const vars: Record<string, string> = {};\n\n    // Load from .env.local (Supabase credentials)\n    const envLocal = join(projectRoot, '.env.local');\n    if (existsSync(envLocal)) {\n      for (const line of readFileSync(envLocal, 'utf-8').split('\\n')) {\n        const trimmed = line.trim();\n        if (!trimmed || trimmed.startsWith('#')) continue;\n        const eqIdx = trimmed.indexOf('=');\n        if (eqIdx > 0) {\n          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);\n        }\n      }\n    }\n\n    // Load from ~/.config/rulemetric/env (API key)\n    const globalEnv = join(CONFIG_DIR, 'env');\n    if (existsSync(globalEnv)) {\n      for (const line of readFileSync(globalEnv, 'utf-8').split('\\n')) {\n        const trimmed = line.trim();\n        if (!trimmed || trimmed.startsWith('#')) continue;\n        const eqIdx = trimmed.indexOf('=');\n        if (eqIdx > 0) {\n          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);\n        }\n      }\n    }\n\n    // Only keep allowed env vars \u2014 never leak unrelated secrets\n    return Object.fromEntries(\n      Object.entries(vars).filter(([k]) => ALLOWED_ENV_VARS.has(k)),\n    );\n  }\n\n  // Guard: the always-on API + worker MUST use the TRANSACTION-mode pooler\n  // (port 6543). A SESSION-mode URL (:5432, 15-slot cap) baked into these\n  // services was the trigger of the recurring pool saturation \u2014 a pool-cascade\n  // debugging override leaked into the plists through this very installer. Auto-\n  // correct the obvious session\u2192transaction port and warn loudly; warn (but do\n  // not block) on a direct, non-pooler URL. Pool-exhaustion RCA 2026-06-21.\n  private guardAlwaysOnDatabaseUrl(envVars: Record<string, string>): Record<string, string> {\n    const url = envVars.DATABASE_URL;\n    if (!url) return envVars;\n    if (url.includes('pooler.supabase.com:5432')) {\n      this.warn(\n        'DATABASE_URL points at the SESSION-mode pooler (:5432, 15-slot cap). The ' +\n          'always-on API/worker must use TRANSACTION mode (:6543) \u2014 auto-correcting ' +\n          'for the installed services. Fix .env.local to silence this warning.',\n      );\n      return { ...envVars, DATABASE_URL: url.replace('pooler.supabase.com:5432', 'pooler.supabase.com:6543') };\n    }\n    if (/@db\\.[a-z0-9]+\\.supabase\\.co[:/]/.test(url)) {\n      this.warn(\n        'DATABASE_URL is a DIRECT database connection (db.<ref>.supabase.co), not the ' +\n          'pooler. Always-on services should use the transaction pooler ' +\n          '(aws-*.pooler.supabase.com:6543) to avoid exhausting Postgres connections.',\n      );\n    }\n    return envVars;\n  }\n\n  // Reap orphaned, unsupervised `evals agent` worker processes before\n  // (re)bootstrapping the launchd worker. The worker holds no listening port,\n  // so killStaleProcess (port/pidfile based) cannot find detached agents \u2014 a\n  // fleet of 4 ran 3+ days and helped saturate the pool (RCA 2026-06-21). pgrep\n  // the command line and SIGTERM every match except ourselves; the agent's own\n  // single-instance lock then keeps a fresh fleet from forming.\n  private killStaleAgents(): void {\n    try {\n      const out = execFileSync('pgrep', ['-f', 'bin/run.js evals agent'], {\n        encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'],\n      });\n      const pids = out.trim().split('\\n').filter(Boolean)\n        .map((s) => parseInt(s, 10))\n        .filter((p) => !isNaN(p) && p !== process.pid);\n      for (const pid of pids) {\n        try {\n          process.kill(pid, 'SIGTERM');\n          this.log(`[OK] Reaped orphan evals agent (PID ${pid})`);\n        } catch {\n          // already gone\n        }\n      }\n      if (pids.length) spawnSync('sleep', ['1'], { stdio: 'ignore' });\n    } catch {\n      // pgrep exits non-zero when nothing matches \u2014 fine\n    }\n  }\n\n  // Best-effort cleanup of a process that would conflict with an\n  // about-to-bootstrap launchd plist. Tries two routes:\n  //   (a) the PID file written by the legacy spawn path\n  //       (gateway-lifecycle / proxy start), if pidFile is non-null\n  //   (b) anything actively listening on the expected port\n  // Either way: SIGTERM + small grace + SIGKILL fallback. Stale PID file\n  // gets unlinked.\n  private killStaleProcess(port: number, pidFile: string | null, name: string): void {\n    let killedAny = false;\n\n    if (pidFile && existsSync(pidFile)) {\n      try {\n        const pidStr = readFileSync(pidFile, 'utf-8').trim();\n        const pid = parseInt(pidStr, 10);\n        if (!isNaN(pid)) {\n          try {\n            process.kill(pid, 'SIGTERM');\n            killedAny = true;\n            this.log(`[OK] Stopped existing ${name} (PID ${pid} from ${pidFile})`);\n          } catch {\n            // Already dead \u2014 fine\n          }\n        }\n      } catch {\n        // Unreadable PID file\n      }\n      try { execFileSync('rm', ['-f', pidFile]); } catch { /* best-effort */ }\n    }\n\n    // Port listener (catches orphans not in the PID file, and the foreground\n    // dev API when --force is set on the API port)\n    try {\n      const result = execFileSync('lsof', ['-ti', `:${port}`, '-sTCP:LISTEN'], {\n        encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'],\n      });\n      const pids = result.trim().split('\\n').filter(Boolean);\n      for (const pidStr of pids) {\n        const pid = parseInt(pidStr, 10);\n        if (!isNaN(pid)) {\n          try {\n            process.kill(pid, 'SIGTERM');\n            killedAny = true;\n            this.log(`[OK] Stopped orphan on :${port} (PID ${pid})`);\n          } catch { /* already gone */ }\n        }\n      }\n    } catch {\n      // lsof exits non-zero when nothing matches \u2014 that's fine\n    }\n\n    if (killedAny) {\n      // Brief grace so the port releases before launchd binds it\n      spawnSync('sleep', ['1'], { stdio: 'ignore' });\n    }\n  }\n\n  private bootoutAndWrite(uid: string, plistPath: string, content: string, name: string): void {\n    // First install of a service has no prior load \u2192 launchctl bootout exits\n    // non-zero. The messaging is inconsistent across macOS versions (\"Could\n    // not find specified service\" on some, \"Boot-out failed: 5: Input/output\n    // error\" on others). We treat all of these as \"nothing to unload\" and\n    // only warn on errors that don't look like that family.\n    const benignBootoutPatterns = [\n      'Could not find specified service',\n      'No such process',\n      '3: No such process',\n      '5: Input/output error',\n    ];\n    try {\n      execFileSync('launchctl', ['bootout', `gui/${uid}`, plistPath], {\n        encoding: 'utf-8',\n        // Capture stderr instead of letting it print to the user's terminal.\n        // The plist was either already-loaded (we unload it cleanly) or not\n        // loaded (we want to swallow the error) \u2014 the user shouldn't see\n        // launchctl's raw output either way.\n        stdio: ['ignore', 'pipe', 'pipe'],\n      });\n      this.log(`[OK] Unloaded existing ${name} service`);\n    } catch (err) {\n      const msg = (err as Error).message || '';\n      const stderr = ((err as { stderr?: Buffer | string }).stderr ?? '').toString();\n      const combined = `${msg}\\n${stderr}`;\n      if (!benignBootoutPatterns.some((p) => combined.includes(p))) {\n        this.warn(`Could not unload existing ${name} service: ${msg.trim()}`);\n      }\n    }\n    writeFileSync(plistPath, content, { mode: 0o600 });\n    this.log(`[OK] ${name} plist written to ${plistPath}`);\n  }\n\n  private bootstrapPlist(uid: string, plistPath: string, name: string): void {\n    try {\n      execFileSync('launchctl', ['bootstrap', `gui/${uid}`, plistPath]);\n      this.log(`[OK] ${name} service loaded into launchd`);\n    } catch (bootstrapErr) {\n      try {\n        execFileSync('launchctl', ['load', plistPath]);\n        this.log(`[OK] ${name} service loaded into launchd (legacy)`);\n      } catch (loadErr) {\n        this.warn(\n          `Could not load ${name} service.\\n` +\n          `  bootstrap: ${(bootstrapErr as Error).message.trim()}\\n` +\n          `  load: ${(loadErr as Error).message.trim()}`,\n        );\n      }\n    }\n  }\n\n  private buildPlist(opts: {\n    port: number;\n    projectRoot: string;\n    nodePath: string;\n    pnpmPath: string;\n    envVars: Record<string, string>;\n  }): string {\n    const { port, projectRoot, nodePath, pnpmPath, envVars } = opts;\n\n    // Derive PATH from resolved binary locations (works with nvm, volta, fnm, homebrew)\n    const pathDirs = [...new Set([dirname(nodePath), dirname(pnpmPath), '/usr/local/bin', '/usr/bin', '/bin'])];\n\n    // Build environment dict entries. NODE_ENV=production mirrors fly.toml\n    // so the bundled web build is served exactly as it is on rulemetric.com,\n    // and middleware paths that branch on NODE_ENV match prod behavior\n    // locally (rate-limits, error verbosity, etc.).\n    const envEntries = Object.entries({\n      ...envVars,\n      PORT: String(port),\n      NODE_ENV: 'production',\n      PATH: pathDirs.join(':'),\n      // Pool resilience for the always-on API (NOT the worker, which runs\n      // legitimately long analytics queries). A wedged Supavisor socket with\n      // the default max=3 pool and no query timeout hangs every authenticated\n      // request \u2014 the 2026-06-09 login-hang. statement_timeout lets Postgres\n      // cancel a stuck query so the connection returns to the pool (verified\n      // honored through the transaction pooler); the larger pool adds headroom.\n      // Both env-overridable. See packages/db/src/client.ts.\n      PG_POOL_MAX: envVars.PG_POOL_MAX ?? '10',\n      PG_STATEMENT_TIMEOUT_MS: envVars.PG_STATEMENT_TIMEOUT_MS ?? '10000',\n      // Keep the pool warm so the API stops reconnecting (and re-resolving the\n      // rotating pooler ELB) on nearly every request \u2014 the churn that exposed\n      // it to intermittent CONNECT_TIMEOUT/ENOTFOUND. Worker/tests keep the\n      // conservative 5s default. See packages/db/src/client.ts (2026-06-09).\n      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? '30',\n      // Silence per-span stdout dumps on the local API \u2014 it has no OTLP\n      // endpoint and a fixed (now rotated) log file; the ConsoleSpanExporter\n      // grew api-stdout to 370MB / ~400k spans. Fly leaves this unset so its\n      // console spans stay grep-able in the managed log stream.\n      OTEL_SPAN_EXPORT: envVars.OTEL_SPAN_EXPORT ?? 'none',\n    })\n      .map(([k, v]) => `      <key>${escapeXml(k)}</key>\\n      <string>${escapeXml(v)}</string>`)\n      .join('\\n');\n\n    // Run the compiled API directly \u2014 same shape as the prod Dockerfile\n    // CMD. Avoids tsx startup cost on every launchd restart, and serves\n    // apps/web/dist from the same process so :3000 is \"API + dashboard\",\n    // matching rulemetric.com. WatchPaths on apps/api/dist auto-bounces\n    // the service on rebuild, so the dev cycle is: edit src \u2192 pnpm build\n    // \u2192 launchd kicks the new code automatically (no manual kickstart).\n    const apiEntry = join(projectRoot, 'apps', 'api', 'dist', 'index.js');\n    const apiDist = join(projectRoot, 'apps', 'api', 'dist');\n\n    return `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${PLIST_LABEL}</string>\n\n  <key>ProgramArguments</key>\n  <array>\n    <string>${escapeXml(nodePath)}</string>\n    <string>${escapeXml(apiEntry)}</string>\n  </array>\n\n  <key>WorkingDirectory</key>\n  <string>${escapeXml(projectRoot)}</string>\n\n  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries}\n  </dict>\n\n  <key>RunAtLoad</key>\n  <true/>\n\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key>\n    <false/>\n  </dict>\n\n  <key>ThrottleInterval</key>\n  <integer>10</integer>\n\n  <key>WatchPaths</key>\n  <array>\n    <string>${escapeXml(apiDist)}</string>\n  </array>\n\n  <key>StandardOutPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'api-stdout.log'))}</string>\n\n  <key>StandardErrorPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'api-stderr.log'))}</string>\n\n  <key>ProcessType</key>\n  <string>Background</string>\n</dict>\n</plist>\n`;\n  }\n\n  private buildWorkerPlist(opts: {\n    cliBin: string;\n    cliDist: string;\n    workingDir: string;\n    nodePath: string;\n    pnpmPath?: string;\n    nodeEnv?: string;\n    envVars: Record<string, string>;\n  }): string {\n    const { cliBin, cliDist, workingDir, nodePath, pnpmPath, envVars } = opts;\n    // Repo install runs as the dev host \u2192 'development'. --worker-only is an\n    // end-user worker against prod \u2192 'production'.\n    const nodeEnv = opts.nodeEnv ?? 'development';\n\n    const pathDirs = [\n      ...new Set(\n        [dirname(nodePath), pnpmPath ? dirname(pnpmPath) : null, '/usr/local/bin', '/usr/bin', '/bin'].filter(\n          (d): d is string => Boolean(d),\n        ),\n      ),\n    ];\n\n    const envEntries = Object.entries({\n      ...envVars,\n      NODE_ENV: nodeEnv,\n      PATH: pathDirs.join(':'),\n      // Bound the worker's pooler footprint. The worker is mostly idle (HTTP\n      // long-poll); an UNPINNED pool plus the previously-missing single-instance\n      // guard let an orphaned fleet of agents each hold a pool and saturate\n      // Supavisor's 200-client cap. A small pool + short idle timeout releases\n      // sessions promptly. Pool-exhaustion RCA 2026-06-21.\n      PG_POOL_MAX: envVars.PG_POOL_MAX ?? '3',\n      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? '10',\n    })\n      .map(([k, v]) => `      <key>${escapeXml(k)}</key>\\n      <string>${escapeXml(v)}</string>`)\n      .join('\\n');\n\n    // Run the CLI bin directly via node. Earlier this used\n    // `pnpm --filter @rulemetric/cli exec rulemetric` but pnpm-exec couldn't\n    // resolve the workspace bin symlink reliably under launchd, crash-looping\n    // with `Command \"rulemetric\" not found`. Direct node invocation is both\n    // simpler (one process less) and avoids the bin-symlink lookup entirely.\n    // cliBin/cliDist are passed in: the repo install points them at\n    // <repo>/apps/cli/{bin/run.js,dist}; --worker-only points them at the\n    // globally-installed package (<config.root>/{bin/run.js,dist}). WatchPaths\n    // on cliDist bounces the worker when the code changes \u2014 a local `pnpm\n    // build` for the repo path, an `npm update -g` for the global path.\n    return `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${WORKER_PLIST_LABEL}</string>\n\n  <key>ProgramArguments</key>\n  <array>\n    <string>${escapeXml(nodePath)}</string>\n    <string>${escapeXml(cliBin)}</string>\n    <string>evals</string>\n    <string>agent</string>\n  </array>\n\n  <key>WorkingDirectory</key>\n  <string>${escapeXml(workingDir)}</string>\n\n  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries}\n  </dict>\n\n  <key>RunAtLoad</key>\n  <true/>\n\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key>\n    <false/>\n  </dict>\n\n  <key>ThrottleInterval</key>\n  <integer>15</integer>\n\n  <key>WatchPaths</key>\n  <array>\n    <string>${escapeXml(cliDist)}</string>\n  </array>\n\n  <key>StandardOutPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'worker-stdout.log'))}</string>\n\n  <key>StandardErrorPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'worker-stderr.log'))}</string>\n\n  <key>ProcessType</key>\n  <string>Background</string>\n</dict>\n</plist>\n`;\n  }\n\n  // CONNECT-proxy router that fronts mitmproxy on :8787. Always-on so\n  // .claude/settings.json's HTTPS_PROXY pointer never resolves to a dead\n  // socket (which would break Claude Code entirely \u2014 see CLAUDE.md).\n  // NOT watched on rebuild: bouncing the gateway mid-request would drop\n  // in-flight streaming responses. Gateway code changes rarely; on\n  // upgrade, the user can `launchctl kickstart gui/<uid>/com.rulemetric.gateway`.\n  private buildGatewayPlist(opts: {\n    projectRoot: string;\n    nodePath: string;\n  }): string {\n    const { projectRoot, nodePath } = opts;\n    const gatewayEntry = join(projectRoot, 'apps', 'cli', 'dist', 'lib', 'gateway-entry.js');\n    const cliBin = join(projectRoot, 'apps', 'cli', 'bin', 'run.js');\n\n    const pathDirs = [...new Set([dirname(nodePath), '/usr/local/bin', '/usr/bin', '/bin'])];\n\n    // Gateway only needs PATH + the CLI metadata used for drift detection\n    // (gateway.ts:43 \u2014 when the addon's on-disk version file diverges from\n    // the gateway's runtime version, it re-invokes the CLI to restart\n    // mitmproxy). It does NOT need Supabase/auth env vars.\n    const env = {\n      RULEMETRIC_CLI_VERSION: this.config.version,\n      RULEMETRIC_CLI_ENTRY: cliBin,\n      PATH: pathDirs.join(':'),\n    };\n\n    const envEntries = Object.entries(env)\n      .map(([k, v]) => `      <key>${escapeXml(k)}</key>\\n      <string>${escapeXml(v)}</string>`)\n      .join('\\n');\n\n    return `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${GATEWAY_PLIST_LABEL}</string>\n\n  <key>ProgramArguments</key>\n  <array>\n    <string>${escapeXml(nodePath)}</string>\n    <string>${escapeXml(gatewayEntry)}</string>\n  </array>\n\n  <key>WorkingDirectory</key>\n  <string>${escapeXml(projectRoot)}</string>\n\n  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries}\n  </dict>\n\n  <key>RunAtLoad</key>\n  <true/>\n\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key>\n    <false/>\n  </dict>\n\n  <key>ThrottleInterval</key>\n  <integer>10</integer>\n\n  <key>StandardOutPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'gateway-stdout.log'))}</string>\n\n  <key>StandardErrorPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'gateway-stderr.log'))}</string>\n\n  <key>ProcessType</key>\n  <string>Background</string>\n</dict>\n</plist>\n`;\n  }\n\n  // mitmproxy with the RuleMetric capture addon. Same invocation as\n  // `rulemetric proxy start` (see commands/proxy/start.ts:308) so the\n  // launchd path and the CLI path are interchangeable. We don't WatchPath\n  // the Python addon \u2014 mitmdump has its own addon reload that handles\n  // edits without a full process restart.\n  private buildProxyPlist(opts: {\n    projectRoot: string;\n    mitmdumpPath: string;\n    envVars: Record<string, string>;\n  }): string {\n    const { projectRoot, mitmdumpPath, envVars } = opts;\n    const addonPath = join(projectRoot, 'packages', 'proxy', 'addon', 'rulemetric_addon.py');\n\n    const pathDirs = [...new Set([dirname(mitmdumpPath), '/usr/local/bin', '/usr/bin', '/bin'])];\n\n    // Proxy needs:\n    //  - auth env vars (so its reporter can POST events to the API)\n    //  - RULEMETRIC_PROJECT_PATH (writes session-meta + addon-version files)\n    //  - RULEMETRIC_CLI_VERSION (gateway uses this to detect drift)\n    const env = {\n      ...envVars,\n      RULEMETRIC_PROJECT_PATH: projectRoot,\n      RULEMETRIC_CLI_VERSION: this.config.version,\n      PATH: pathDirs.join(':'),\n    };\n\n    const envEntries = Object.entries(env)\n      .map(([k, v]) => `      <key>${escapeXml(k)}</key>\\n      <string>${escapeXml(v)}</string>`)\n      .join('\\n');\n\n    return `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${PROXY_PLIST_LABEL}</string>\n\n  <key>ProgramArguments</key>\n  <array>\n    <string>${escapeXml(mitmdumpPath)}</string>\n    <string>--listen-port</string>\n    <string>${PROXY_PORT}</string>\n    <string>-s</string>\n    <string>${escapeXml(addonPath)}</string>\n    <string>--set</string>\n    <string>console_eventlog_verbosity=info</string>\n  </array>\n\n  <key>WorkingDirectory</key>\n  <string>${escapeXml(projectRoot)}</string>\n\n  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries}\n  </dict>\n\n  <key>RunAtLoad</key>\n  <true/>\n\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key>\n    <false/>\n  </dict>\n\n  <key>ThrottleInterval</key>\n  <integer>15</integer>\n\n  <key>StandardOutPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'proxy-stdout.log'))}</string>\n\n  <key>StandardErrorPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'proxy-stderr.log'))}</string>\n\n  <key>ProcessType</key>\n  <string>Background</string>\n</dict>\n</plist>\n`;\n  }\n\n  private async waitForApi(port: number, timeoutSecs: number): Promise<boolean> {\n    let lastError: string | null = null;\n    for (let i = 0; i < timeoutSecs; i++) {\n      try {\n        const res = await fetch(`http://localhost:${port}/health`);\n        if (res.ok) return true;\n        lastError = `health check returned ${res.status}`;\n      } catch (err) {\n        lastError = (err as Error).message;\n      }\n      await new Promise(r => setTimeout(r, 1000));\n    }\n    if (lastError) {\n      this.warn(`Last health check error: ${lastError}`);\n    }\n    return false;\n  }\n}\n\nfunction escapeXml(s: string): string {\n  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\"/g, '&quot;');\n}\n"],
-  "mappings": ";;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,UAAU,cAAc,iBAAiB;AAClD,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AAM9B,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA,EACA;AACF,CAAC;AAED,IAAM,cAAc;AACpB,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,WAAW,QAAQ;AACpF,IAAM,qBAAqB;AAC3B,IAAM,oBAAoB,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,kBAAkB,QAAQ;AAClG,IAAM,sBAAsB;AAC5B,IAAM,qBAAqB,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,mBAAmB,QAAQ;AACpG,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,iBAAiB,QAAQ;AAGhG,IAAM,6BAA6B;AACnC,IAAM,4BAA4B,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,0BAA0B,QAAQ;AAClH,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,YAAY;AAC1D,IAAM,UAAU,KAAK,YAAY,MAAM;AACvC,IAAM,eAAe;AACrB,IAAM,aAAa;AAEnB,IAAM,qBAAqB,KAAK,QAAQ,GAAG,WAAW,WAAW,MAAM;AACvE,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB,KAAK,oBAAoB,mBAAmB;AAExE,IAAqB,iBAArB,MAAqB,wBAAuB,YAAY;AAAA,EACtD,OAAgB,cACd;AAAA,EAEF,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,MAAM,MAAM,QAAQ;AAAA,MAClB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,OAAO,MAAM,QAAQ;AAAA,MACnB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,cAAc,MAAM,QAAQ;AAAA,MAC1B,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,YAAY,MAAM,QAAQ;AAAA,MACxB,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,eAAe,MAAM,QAAQ;AAAA,MAC3B,SAAS;AAAA,MACT,aACE;AAAA,IACJ,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,eAAc;AACjD,UAAM,OAAO,MAAM;AACnB,UAAM,YAAY,MAAM,YAAY;AACpC,UAAM,UAAU,MAAM,UAAU;AAOhC,QAAI,MAAM,aAAa,GAAG;AACxB,YAAM,KAAK,cAAc,MAAM,KAAK;AACpC;AAAA,IACF;AAGA,QAAI,QAAQ,aAAa,UAAU;AACjC,WAAK;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAKA,QAAI,WAAW,UAAU,KAAK,CAAC,MAAM,OAAO;AAC1C,WAAK,IAAI,gCAAgC,UAAU,EAAE;AACrD,WAAK,IAAI,6DAA6D;AACtE;AAAA,IACF;AAIA,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,oBAAoB,IAAI,SAAS;AACzD,UAAI,IAAI,MAAM,CAAC,MAAM,OAAO;AAC1B,aAAK,KAAK,QAAQ,IAAI,8EAA8E;AACpG,aAAK,KAAK,2EAA2E;AACrF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAGA,UAAM,cAAc,KAAK,gBAAgB;AACzC,QAAI,CAAC,aAAa;AAChB,WAAK;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,UAAM,WAAW,KAAK,aAAa,YAAY;AAC/C,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,WAAK,MAAM,2BAA2B,QAAQ,gDAAgD;AAAA,IAChG;AAGA,UAAM,UAAU,KAAK,yBAAyB,KAAK,YAAY,WAAW,CAAC;AAG3E,UAAM,WAAW,KAAK,WAAW,MAAM;AACvC,UAAM,WAAW,KAAK,WAAW,MAAM;AACvC,QAAI,CAAC,YAAY,CAAC,UAAU;AAC1B,WAAK,MAAM,4DAA4D;AAAA,IACzE;AAKA,QAAI,eAA8B;AAClC,QAAI,CAAC,SAAS;AACZ,qBAAe,KAAK,WAAW,UAAU;AACzC,UAAI,CAAC,cAAc;AACjB,aAAK;AAAA,UACH;AAAA,QAEF;AAAA,MACF;AAAA,IACF;AAMA,QAAI,CAAC,WAAW;AACd,WAAK,IAAI,gEAAgE;AACzE,YAAM,eAAe;AAAA,QACnB;AAAA,QAAY;AAAA,QACZ;AAAA,QAAY;AAAA,QACZ;AAAA,QAAY;AAAA,MACd;AACA,YAAM,QAAQ,UAAU,UAAW,CAAC,QAAQ,SAAS,OAAO,SAAS,GAAG,YAAY,GAAG;AAAA,QACrF,KAAK;AAAA,QACL,OAAO;AAAA,MACT,CAAC;AACD,UAAI,MAAM,WAAW,GAAG;AACtB,aAAK;AAAA,UACH,gCAAgC,MAAM,MAAM;AAAA,QAC9C;AAAA,MACF;AACA,WAAK,IAAI,qBAAqB;AAAA,IAChC,OAAO;AACL,WAAK,IAAI,gDAAgD;AAAA,IAC3D;AAIA,UAAM,WAAW,KAAK,aAAa,QAAQ,OAAO,QAAQ,UAAU;AACpE,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,WAAK,MAAM,0BAA0B,QAAQ,2EAA2E;AAAA,IAC1H;AACA,UAAM,WAAW,KAAK,aAAa,QAAQ,OAAO,QAAQ,YAAY;AACtE,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,WAAK,KAAK,2BAA2B,QAAQ,mBAAmB,IAAI,qCAAqC;AAAA,IAC3G;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,eAAe,KAAK,aAAa,QAAQ,OAAO,QAAQ,OAAO,kBAAkB;AACvF,UAAI,CAAC,WAAW,YAAY,GAAG;AAC7B,aAAK,MAAM,8BAA8B,YAAY,wEAAwE;AAAA,MAC/H;AAAA,IACF;AAOA,QAAI,MAAM,OAAO;AACf,WAAK,iBAAiB,MAAM,MAAM,aAAa,IAAI;AAAA,IACrD;AACA,QAAI,CAAC,SAAS;AACZ,WAAK,iBAAiB,cAAc,KAAK,YAAY,aAAa,GAAG,SAAS;AAC9E,WAAK,iBAAiB,YAAY,KAAK,YAAY,WAAW,GAAG,WAAW;AAAA,IAC9E;AAGA,cAAU,KAAK,QAAQ,GAAG,WAAW,cAAc,GAAG,EAAE,WAAW,KAAK,CAAC;AACzE,cAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AAEtC,UAAM,MAAM,SAAS,SAAS,EAAE,UAAU,QAAQ,CAAC,EAAE,KAAK;AAG1D,UAAM,WAAW,KAAK,WAAW,EAAE,MAAM,aAAa,UAAqB,UAAqB,QAAQ,CAAC;AACzG,SAAK,gBAAgB,KAAK,YAAY,UAAU,KAAK;AACrD,SAAK,eAAe,KAAK,YAAY,KAAK;AAG1C,SAAK,IAAI,4BAA4B,IAAI,KAAK;AAC9C,UAAM,aAAa,MAAM,KAAK,WAAW,MAAM,EAAE;AACjD,QAAI,YAAY;AACd,WAAK,IAAI,mCAAmC,IAAI,EAAE;AAClD,UAAI,WAAW,QAAQ,GAAG;AACxB,aAAK,IAAI,gDAAgD,IAAI,EAAE;AAAA,MACjE;AAAA,IACF,OAAO;AACL,WAAK,KAAK,6CAA6C;AACvD,WAAK,IAAI,aAAa,OAAO,iBAAiB;AAC9C,WAAK,IAAI,aAAa,OAAO,iBAAiB;AAAA,IAChD;AAGA,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,8BAA8B;AAIvC,SAAK,gBAAgB;AACrB,UAAM,cAAc,KAAK,iBAAiB;AAAA,MACxC,QAAQ,KAAK,aAAa,QAAQ,OAAO,OAAO,QAAQ;AAAA,MACxD,SAAS,KAAK,aAAa,QAAQ,OAAO,MAAM;AAAA,MAChD,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,gBAAgB,KAAK,mBAAmB,aAAa,QAAQ;AAClE,SAAK,eAAe,KAAK,mBAAmB,QAAQ;AAGpD,QAAI,CAAC,SAAS;AACZ,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,gDAAgD;AAEzD,YAAM,eAAe,KAAK,kBAAkB,EAAE,aAAa,SAAoB,CAAC;AAChF,WAAK,gBAAgB,KAAK,oBAAoB,cAAc,SAAS;AACrE,WAAK,eAAe,KAAK,oBAAoB,SAAS;AAEtD,YAAM,aAAa,KAAK,gBAAgB;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,WAAK,gBAAgB,KAAK,kBAAkB,YAAY,OAAO;AAC/D,WAAK,eAAe,KAAK,kBAAkB,OAAO;AAAA,IACpD;AAQA,QAAI,WAAW,yBAAyB,GAAG;AACzC,UAAI;AACF,qBAAa,aAAa,CAAC,WAAW,OAAO,GAAG,IAAI,yBAAyB,GAAG,EAAE,UAAU,QAAQ,CAAC;AAAA,MACvG,QAAQ;AAAA,MAER;AACA,UAAI;AACF,qBAAa,MAAM,CAAC,MAAM,yBAAyB,CAAC;AACpD,aAAK,IAAI,gFAAgF;AAAA,MAC3F,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,SAAK,IAAI,EAAE;AACX,QAAI,SAAS;AACX,WAAK,IAAI,8DAA8D;AAAA,IACzE,OAAO;AACL,WAAK,IAAI,oDAAoD;AAAA,IAC/D;AACA,SAAK,IAAI,qFAAqF;AAC9F,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,4DAA4D;AACrE,SAAK,IAAI,uEAAuE;AAChF,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,cAAc;AACvB,SAAK,IAAI,wDAAmD;AAC5D,SAAK,IAAI,2DAAsD;AAK/D,UAAM,mBAAmB;AAGzB,UAAM,OAAO,MAAM,WAAW;AAC9B,SAAK,IAAI,EAAE;AACX,QAAI,KAAK,WAAW;AAClB,WAAK,IAAI,kBAAkB,KAAK,UAAU,MAAM,KAAK,OAAO,MAAM,EAAE,2BAAsB;AAAA,IAC5F,OAAO;AACL,WAAK,IAAI,0GAAqG;AAAA,IAChH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,cAAc,OAA+B;AACzD,UAAM,WAAW,QAAQ;AACzB,QAAI,aAAa,YAAY,aAAa,SAAS;AACjD,WAAK,MAAM,8EAA8E,QAAQ,IAAI;AAAA,IACvG;AAKA,UAAM,WAAW,KAAK,WAAW,MAAM;AACvC,QAAI,CAAC,UAAU;AACb,WAAK,MAAM,gCAAgC;AAAA,IAC7C;AACA,UAAM,SAAS,KAAK,KAAK,OAAO,MAAM,OAAO,QAAQ;AACrD,QAAI,CAAC,WAAW,MAAM,GAAG;AACvB,WAAK;AAAA,QACH,+CAA+C,MAAM;AAAA,MACvD;AAAA,IACF;AACA,UAAM,UAAU,KAAK,KAAK,OAAO,MAAM,MAAM;AAE7C,UAAM,UAAU,KAAK,oBAAoB;AACzC,QAAI,CAAC,QAAQ,sBAAsB,CAAC,QAAQ,yBAAyB;AACnE,WAAK;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,oBAAoB;AAC/B,cAAQ,qBAAqB;AAAA,IAC/B;AAEA,cAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AAGtC,SAAK,gBAAgB;AAErB,QAAI,aAAa,UAAU;AACzB,UAAI,WAAW,iBAAiB,KAAK,CAAC,OAAO;AAC3C,aAAK,IAAI,+BAA+B,iBAAiB,GAAG;AAC5D,aAAK,IAAI,6DAA6D;AACtE;AAAA,MACF;AACA,gBAAU,KAAK,QAAQ,GAAG,WAAW,cAAc,GAAG,EAAE,WAAW,KAAK,CAAC;AACzE,YAAM,MAAM,SAAS,SAAS,EAAE,UAAU,QAAQ,CAAC,EAAE,KAAK;AAC1D,YAAM,QAAQ,KAAK,iBAAiB;AAAA,QAClC;AAAA,QACA;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB;AAAA,QACA,SAAS;AAAA,QACT;AAAA,MACF,CAAC;AACD,WAAK,gBAAgB,KAAK,mBAAmB,OAAO,QAAQ;AAC5D,WAAK,eAAe,KAAK,mBAAmB,QAAQ;AACpD,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,sEAAsE;AAC/E,WAAK,IAAI,sBAAsB,KAAK,SAAS,mBAAmB,CAAC,EAAE;AAAA,IACrE,OAAO;AAEL,UAAI,WAAW,mBAAmB,KAAK,CAAC,OAAO;AAC7C,aAAK,IAAI,+BAA+B,mBAAmB,GAAG;AAC9D,aAAK,IAAI,yDAAyD,mBAAmB,EAAE;AACvF;AAAA,MACF;AACA,gBAAU,oBAAoB,EAAE,WAAW,KAAK,CAAC;AACjD,YAAM,OAAO,KAAK,uBAAuB,EAAE,QAAQ,UAAqB,QAAQ,CAAC;AACjF,oBAAc,qBAAqB,MAAM,EAAE,MAAM,IAAM,CAAC;AACxD,WAAK,IAAI,cAAc,mBAAmB,EAAE;AAC5C,UAAI;AACF,qBAAa,aAAa,CAAC,UAAU,eAAe,CAAC;AACrD,qBAAa,aAAa,CAAC,UAAU,UAAU,SAAS,mBAAmB,CAAC;AAC5E,aAAK,IAAI,mDAAmD;AAC5D,aAAK,IAAI,iEAAiE;AAC1E,aAAK,IAAI,mCAAmC,mBAAmB,KAAK;AAAA,MACtE,SAAS,KAAK;AACZ,aAAK;AAAA,UACH,mDAAmD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACrG;AACA,aAAK;AAAA,UACH,uFAAuF,mBAAmB;AAAA,QAC5G;AAAA,MACF;AAAA,IACF;AAEA,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,cAAc;AACvB,SAAK,IAAI,wDAAmD;AAC5D,SAAK,IAAI,yDAAoD;AAG7D,UAAM,mBAAmB;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,sBAA8C;AACpD,UAAM,OAA+B,CAAC;AACtC,UAAM,YAAY,KAAK,YAAY,KAAK;AACxC,QAAI,WAAW,SAAS,GAAG;AACzB,iBAAW,QAAQ,aAAa,WAAW,OAAO,EAAE,MAAM,IAAI,GAAG;AAC/D,cAAM,UAAU,KAAK,KAAK;AAC1B,YAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG;AACzC,cAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,YAAI,QAAQ,GAAG;AACb,eAAK,QAAQ,MAAM,GAAG,KAAK,CAAC,IAAI,QAAQ,MAAM,QAAQ,CAAC;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,iBAAiB,IAAI,CAAC,CAAC,CAAC;AAAA,EACzF;AAAA;AAAA,EAGQ,uBAAuB,MAIpB;AACT,UAAM,EAAE,QAAQ,UAAU,QAAQ,IAAI;AACtC,UAAM,MAA8B;AAAA,MAClC,GAAG;AAAA,MACH,UAAU;AAAA;AAAA,MAEV,aAAa,QAAQ,eAAe;AAAA,MACpC,iBAAiB,QAAQ,mBAAmB;AAAA,IAC9C;AAGA,UAAM,WAAW,OAAO,QAAQ,GAAG,EAChC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK,CAAC,GAAG,EACrF,KAAK,IAAI;AACZ,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAOC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAAA,EAG5B,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKR;AAAA,EAEQ,kBAAiC;AAEvC,QAAI,QAAQ,IAAI,yBAAyB;AACvC,aAAO,QAAQ,IAAI;AAAA,IACrB;AAEA,QAAI,MAAM,QAAQ,IAAI;AACtB,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAI,WAAW,KAAK,KAAK,QAAQ,OAAO,cAAc,CAAC,GAAG;AACxD,eAAO;AAAA,MACT;AACA,YAAM,SAAS,KAAK,KAAK,IAAI;AAC7B,UAAI,WAAW,IAAK;AACpB,YAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,MAA6B;AAC9C,QAAI;AACF,aAAO,aAAa,SAAS,CAAC,IAAI,GAAG,EAAE,UAAU,SAAS,OAAO,CAAC,QAAQ,QAAQ,QAAQ,EAAE,CAAC,EAAE,KAAK,KAAK;AAAA,IAC3G,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,YAAY,aAA6C;AAC/D,UAAM,OAA+B,CAAC;AAGtC,UAAM,WAAW,KAAK,aAAa,YAAY;AAC/C,QAAI,WAAW,QAAQ,GAAG;AACxB,iBAAW,QAAQ,aAAa,UAAU,OAAO,EAAE,MAAM,IAAI,GAAG;AAC9D,cAAM,UAAU,KAAK,KAAK;AAC1B,YAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG;AACzC,cAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,YAAI,QAAQ,GAAG;AACb,eAAK,QAAQ,MAAM,GAAG,KAAK,CAAC,IAAI,QAAQ,MAAM,QAAQ,CAAC;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,KAAK,YAAY,KAAK;AACxC,QAAI,WAAW,SAAS,GAAG;AACzB,iBAAW,QAAQ,aAAa,WAAW,OAAO,EAAE,MAAM,IAAI,GAAG;AAC/D,cAAM,UAAU,KAAK,KAAK;AAC1B,YAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG;AACzC,cAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,YAAI,QAAQ,GAAG;AACb,eAAK,QAAQ,MAAM,GAAG,KAAK,CAAC,IAAI,QAAQ,MAAM,QAAQ,CAAC;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAGA,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,iBAAiB,IAAI,CAAC,CAAC;AAAA,IAC9D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,yBAAyB,SAAyD;AACxF,UAAM,MAAM,QAAQ;AACpB,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,IAAI,SAAS,0BAA0B,GAAG;AAC5C,WAAK;AAAA,QACH;AAAA,MAGF;AACA,aAAO,EAAE,GAAG,SAAS,cAAc,IAAI,QAAQ,4BAA4B,0BAA0B,EAAE;AAAA,IACzG;AACA,QAAI,mCAAmC,KAAK,GAAG,GAAG;AAChD,WAAK;AAAA,QACH;AAAA,MAGF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBAAwB;AAC9B,QAAI;AACF,YAAM,MAAM,aAAa,SAAS,CAAC,MAAM,wBAAwB,GAAG;AAAA,QAClE,UAAU;AAAA,QAAS,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,MACvD,CAAC;AACD,YAAM,OAAO,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO,EAC/C,IAAI,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,EAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,QAAQ,GAAG;AAC/C,iBAAW,OAAO,MAAM;AACtB,YAAI;AACF,kBAAQ,KAAK,KAAK,SAAS;AAC3B,eAAK,IAAI,uCAAuC,GAAG,GAAG;AAAA,QACxD,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI,KAAK,OAAQ,WAAU,SAAS,CAAC,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;AAAA,IAChE,QAAQ;AAAA,IAER;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,iBAAiB,MAAc,SAAwB,MAAoB;AACjF,QAAI,YAAY;AAEhB,QAAI,WAAW,WAAW,OAAO,GAAG;AAClC,UAAI;AACF,cAAM,SAAS,aAAa,SAAS,OAAO,EAAE,KAAK;AACnD,cAAM,MAAM,SAAS,QAAQ,EAAE;AAC/B,YAAI,CAAC,MAAM,GAAG,GAAG;AACf,cAAI;AACF,oBAAQ,KAAK,KAAK,SAAS;AAC3B,wBAAY;AACZ,iBAAK,IAAI,yBAAyB,IAAI,SAAS,GAAG,SAAS,OAAO,GAAG;AAAA,UACvE,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI;AAAE,qBAAa,MAAM,CAAC,MAAM,OAAO,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAoB;AAAA,IACzE;AAIA,QAAI;AACF,YAAM,SAAS,aAAa,QAAQ,CAAC,OAAO,IAAI,IAAI,IAAI,cAAc,GAAG;AAAA,QACvE,UAAU;AAAA,QAAS,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,MACvD,CAAC;AACD,YAAM,OAAO,OAAO,KAAK,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO;AACrD,iBAAW,UAAU,MAAM;AACzB,cAAM,MAAM,SAAS,QAAQ,EAAE;AAC/B,YAAI,CAAC,MAAM,GAAG,GAAG;AACf,cAAI;AACF,oBAAQ,KAAK,KAAK,SAAS;AAC3B,wBAAY;AACZ,iBAAK,IAAI,2BAA2B,IAAI,SAAS,GAAG,GAAG;AAAA,UACzD,QAAQ;AAAA,UAAqB;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,QAAI,WAAW;AAEb,gBAAU,SAAS,CAAC,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,gBAAgB,KAAa,WAAmB,SAAiB,MAAoB;AAM3F,UAAM,wBAAwB;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI;AACF,mBAAa,aAAa,CAAC,WAAW,OAAO,GAAG,IAAI,SAAS,GAAG;AAAA,QAC9D,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,QAKV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,MAClC,CAAC;AACD,WAAK,IAAI,0BAA0B,IAAI,UAAU;AAAA,IACnD,SAAS,KAAK;AACZ,YAAM,MAAO,IAAc,WAAW;AACtC,YAAM,UAAW,IAAqC,UAAU,IAAI,SAAS;AAC7E,YAAM,WAAW,GAAG,GAAG;AAAA,EAAK,MAAM;AAClC,UAAI,CAAC,sBAAsB,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,CAAC,GAAG;AAC5D,aAAK,KAAK,6BAA6B,IAAI,aAAa,IAAI,KAAK,CAAC,EAAE;AAAA,MACtE;AAAA,IACF;AACA,kBAAc,WAAW,SAAS,EAAE,MAAM,IAAM,CAAC;AACjD,SAAK,IAAI,QAAQ,IAAI,qBAAqB,SAAS,EAAE;AAAA,EACvD;AAAA,EAEQ,eAAe,KAAa,WAAmB,MAAoB;AACzE,QAAI;AACF,mBAAa,aAAa,CAAC,aAAa,OAAO,GAAG,IAAI,SAAS,CAAC;AAChE,WAAK,IAAI,QAAQ,IAAI,8BAA8B;AAAA,IACrD,SAAS,cAAc;AACrB,UAAI;AACF,qBAAa,aAAa,CAAC,QAAQ,SAAS,CAAC;AAC7C,aAAK,IAAI,QAAQ,IAAI,uCAAuC;AAAA,MAC9D,SAAS,SAAS;AAChB,aAAK;AAAA,UACH,kBAAkB,IAAI;AAAA,eACL,aAAuB,QAAQ,KAAK,CAAC;AAAA,UAC1C,QAAkB,QAAQ,KAAK,CAAC;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,WAAW,MAMR;AACT,UAAM,EAAE,MAAM,aAAa,UAAU,UAAU,QAAQ,IAAI;AAG3D,UAAM,WAAW,CAAC,GAAG,oBAAI,IAAI,CAAC,QAAQ,QAAQ,GAAG,QAAQ,QAAQ,GAAG,kBAAkB,YAAY,MAAM,CAAC,CAAC;AAM1G,UAAM,aAAa,OAAO,QAAQ;AAAA,MAChC,GAAG;AAAA,MACH,MAAM,OAAO,IAAI;AAAA,MACjB,UAAU;AAAA,MACV,MAAM,SAAS,KAAK,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQvB,aAAa,QAAQ,eAAe;AAAA,MACpC,yBAAyB,QAAQ,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA,MAK5D,iBAAiB,QAAQ,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,MAK5C,kBAAkB,QAAQ,oBAAoB;AAAA,IAChD,CAAC,EACE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,cAAc,UAAU,CAAC,CAAC;AAAA,gBAAyB,UAAU,CAAC,CAAC,WAAW,EAC1F,KAAK,IAAI;AAQZ,UAAM,WAAW,KAAK,aAAa,QAAQ,OAAO,QAAQ,UAAU;AACpE,UAAM,UAAU,KAAK,aAAa,QAAQ,OAAO,MAAM;AAEvD,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA,YAKC,WAAW;AAAA;AAAA;AAAA;AAAA,cAIT,UAAU,QAAQ,CAAC;AAAA,cACnB,UAAU,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,YAIrB,UAAU,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA,EAIhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAiBE,UAAU,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA,YAIpB,UAAU,KAAK,SAAS,gBAAgB,CAAC,CAAC;AAAA;AAAA;AAAA,YAG1C,UAAU,KAAK,SAAS,gBAAgB,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpD;AAAA,EAEQ,iBAAiB,MAQd;AACT,UAAM,EAAE,QAAQ,SAAS,YAAY,UAAU,UAAU,QAAQ,IAAI;AAGrE,UAAM,UAAU,KAAK,WAAW;AAEhC,UAAM,WAAW;AAAA,MACf,GAAG,IAAI;AAAA,QACL,CAAC,QAAQ,QAAQ,GAAG,WAAW,QAAQ,QAAQ,IAAI,MAAM,kBAAkB,YAAY,MAAM,EAAE;AAAA,UAC7F,CAAC,MAAmB,QAAQ,CAAC;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,OAAO,QAAQ;AAAA,MAChC,GAAG;AAAA,MACH,UAAU;AAAA,MACV,MAAM,SAAS,KAAK,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMvB,aAAa,QAAQ,eAAe;AAAA,MACpC,iBAAiB,QAAQ,mBAAmB;AAAA,IAC9C,CAAC,EACE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,cAAc,UAAU,CAAC,CAAC;AAAA,gBAAyB,UAAU,CAAC,CAAC,WAAW,EAC1F,KAAK,IAAI;AAYZ,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA,YAKC,kBAAkB;AAAA;AAAA;AAAA;AAAA,cAIhB,UAAU,QAAQ,CAAC;AAAA,cACnB,UAAU,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAMnB,UAAU,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA,EAI/B,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAiBE,UAAU,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA,YAIpB,UAAU,KAAK,SAAS,mBAAmB,CAAC,CAAC;AAAA;AAAA;AAAA,YAG7C,UAAU,KAAK,SAAS,mBAAmB,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBAAkB,MAGf;AACT,UAAM,EAAE,aAAa,SAAS,IAAI;AAClC,UAAM,eAAe,KAAK,aAAa,QAAQ,OAAO,QAAQ,OAAO,kBAAkB;AACvF,UAAM,SAAS,KAAK,aAAa,QAAQ,OAAO,OAAO,QAAQ;AAE/D,UAAM,WAAW,CAAC,GAAG,oBAAI,IAAI,CAAC,QAAQ,QAAQ,GAAG,kBAAkB,YAAY,MAAM,CAAC,CAAC;AAMvF,UAAM,MAAM;AAAA,MACV,wBAAwB,KAAK,OAAO;AAAA,MACpC,sBAAsB;AAAA,MACtB,MAAM,SAAS,KAAK,GAAG;AAAA,IACzB;AAEA,UAAM,aAAa,OAAO,QAAQ,GAAG,EAClC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,cAAc,UAAU,CAAC,CAAC;AAAA,gBAAyB,UAAU,CAAC,CAAC,WAAW,EAC1F,KAAK,IAAI;AAEZ,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA,YAKC,mBAAmB;AAAA;AAAA;AAAA;AAAA,cAIjB,UAAU,QAAQ,CAAC;AAAA,cACnB,UAAU,YAAY,CAAC;AAAA;AAAA;AAAA;AAAA,YAIzB,UAAU,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA,EAIhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAgBA,UAAU,KAAK,SAAS,oBAAoB,CAAC,CAAC;AAAA;AAAA;AAAA,YAG9C,UAAU,KAAK,SAAS,oBAAoB,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,gBAAgB,MAIb;AACT,UAAM,EAAE,aAAa,cAAc,QAAQ,IAAI;AAC/C,UAAM,YAAY,KAAK,aAAa,YAAY,SAAS,SAAS,qBAAqB;AAEvF,UAAM,WAAW,CAAC,GAAG,oBAAI,IAAI,CAAC,QAAQ,YAAY,GAAG,kBAAkB,YAAY,MAAM,CAAC,CAAC;AAM3F,UAAM,MAAM;AAAA,MACV,GAAG;AAAA,MACH,yBAAyB;AAAA,MACzB,wBAAwB,KAAK,OAAO;AAAA,MACpC,MAAM,SAAS,KAAK,GAAG;AAAA,IACzB;AAEA,UAAM,aAAa,OAAO,QAAQ,GAAG,EAClC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,cAAc,UAAU,CAAC,CAAC;AAAA,gBAAyB,UAAU,CAAC,CAAC,WAAW,EAC1F,KAAK,IAAI;AAEZ,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA,YAKC,iBAAiB;AAAA;AAAA;AAAA;AAAA,cAIf,UAAU,YAAY,CAAC;AAAA;AAAA,cAEvB,UAAU;AAAA;AAAA,cAEV,UAAU,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAMtB,UAAU,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA,EAIhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAgBA,UAAU,KAAK,SAAS,kBAAkB,CAAC,CAAC;AAAA;AAAA;AAAA,YAG5C,UAAU,KAAK,SAAS,kBAAkB,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtD;AAAA,EAEA,MAAc,WAAW,MAAc,aAAuC;AAC5E,QAAI,YAA2B;AAC/B,aAAS,IAAI,GAAG,IAAI,aAAa,KAAK;AACpC,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,oBAAoB,IAAI,SAAS;AACzD,YAAI,IAAI,GAAI,QAAO;AACnB,oBAAY,yBAAyB,IAAI,MAAM;AAAA,MACjD,SAAS,KAAK;AACZ,oBAAa,IAAc;AAAA,MAC7B;AACA,YAAM,IAAI,QAAQ,OAAK,WAAW,GAAG,GAAI,CAAC;AAAA,IAC5C;AACA,QAAI,WAAW;AACb,WAAK,KAAK,4BAA4B,SAAS,EAAE;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,UAAU,GAAmB;AACpC,SAAO,EAAE,QAAQ,MAAM,OAAO,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,QAAQ;AACpG;",
+  "sourcesContent": ["import { Flags } from '@oclif/core';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { execSync, execFileSync, spawnSync } from 'node:child_process';\nimport { homedir } from 'node:os';\nimport { dirname, join } from 'node:path';\nimport { BaseCommand } from '../../base-command.js';\nimport { bootstrapActiveOrg } from '../../lib/active-org-refresh.js';\nimport { detectTmux } from '../../lib/detect-tmux.js';\n\n// Only these env vars are written to the plist \u2014 never leak unrelated secrets\nconst ALLOWED_ENV_VARS = new Set([\n  'SUPABASE_URL',\n  'SUPABASE_ANON_KEY',\n  'SUPABASE_SERVICE_ROLE_KEY',\n  // Enables local HS256 JWT verification in the API's authMiddleware \u2014\n  // without it every authed request pays a /auth/v1/user network round-trip\n  // (measured p50 ~244ms) to Supabase.\n  'SUPABASE_JWT_SECRET',\n  'DATABASE_URL',\n  'RULEMETRIC_API_URL',\n  'RULEMETRIC_API_KEY',\n  'RULEMETRIC_ACCESS_TOKEN',\n  // Recipient for the weekly cron_data_integrity_audit notification.\n  // Without one of these, the audit cron runs but nobody is notified \u2014\n  // see cron-data-integrity-audit.ts (defaults: NOTIFY_USER_ID then USER_ID).\n  'RULEMETRIC_AUDIT_NOTIFY_USER_ID',\n  'RULEMETRIC_USER_ID',\n  // cron_refresh_skills needs an authenticated GitHub API budget (5000\n  // req/hr) \u2014 without it the handler skips and the skills registry goes\n  // stale, which makes cron_suggest_instructions mark every suggestion\n  // stale on each nightly run.\n  'GITHUB_TOKEN',\n  // Pool-tuning overrides so the plist generators (buildPlist / buildWorkerPlist)\n  // actually honor a user-set value instead of always falling back to the pinned\n  // default \u2014 without these in the allow-list the `envVars.PG_* ?? '<default>'`\n  // escape hatch was silently dead. Pool-exhaustion RCA 2026-06-21.\n  'PG_POOL_MAX',\n  'PG_IDLE_TIMEOUT',\n  'PG_STATEMENT_TIMEOUT_MS',\n  // Resend transactional email. The worker (`evals agent`) sends changelog\n  // announcements via `@rulemetric/email` \u2192 `sendEmail()`, which picks the\n  // provider from `process.env.RESEND_API_KEY`. Without these in the allow-list\n  // the installer stripped them out of the worker plist, the CLI never loads\n  // `.env.local`, so the worker fell back to the `noop` provider and SILENTLY\n  // dropped every announcement email. RESEND_FROM_EMAIL must be the verified\n  // sender (noreply@rulemetric.com) \u2014 otherwise the provider defaults to\n  // Resend's shared sandbox `onboarding@resend.dev`, which Gmail spam-filters.\n  'RESEND_API_KEY',\n  'RESEND_FROM_EMAIL',\n  // Sentry error capture for the worker process. The worker (`evals agent`)\n  // calls initSentry(), which now keys off DSN presence alone. Without this in\n  // the allow-list the installer stripped SENTRY_DSN from the worker plist, so\n  // worker crashes went unreported even when the DSN was set in .env.local /\n  // ~/.config/rulemetric/env. The DSN is ingest-only (not a secret).\n  'SENTRY_DSN',\n]);\n\nconst PLIST_LABEL = 'com.rulemetric.api';\nconst PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${PLIST_LABEL}.plist`);\nconst WORKER_PLIST_LABEL = 'com.rulemetric.worker';\nconst WORKER_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${WORKER_PLIST_LABEL}.plist`);\nconst GATEWAY_PLIST_LABEL = 'com.rulemetric.gateway';\nconst GATEWAY_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${GATEWAY_PLIST_LABEL}.plist`);\nconst PROXY_PLIST_LABEL = 'com.rulemetric.proxy';\nconst PROXY_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${PROXY_PLIST_LABEL}.plist`);\n// Daily kickstart agent \u2014 see Phase 4c cleanup block below. Kept as a constant\n// so we can tear it down on every install if a stale copy is lying around.\nconst WORKER_RESTART_PLIST_LABEL = 'com.rulemetric.worker.restart';\nconst WORKER_RESTART_PLIST_PATH = join(homedir(), 'Library', 'LaunchAgents', `${WORKER_RESTART_PLIST_LABEL}.plist`);\nconst CONFIG_DIR = join(homedir(), '.config', 'rulemetric');\nconst LOG_DIR = join(CONFIG_DIR, 'logs');\nconst GATEWAY_PORT = 8787;\nconst PROXY_PORT = 8788;\n// Linux systemd --user unit for the worker-only install path.\nconst WORKER_SYSTEMD_DIR = join(homedir(), '.config', 'systemd', 'user');\nconst WORKER_SYSTEMD_UNIT = 'rulemetric-worker.service';\nconst WORKER_SYSTEMD_PATH = join(WORKER_SYSTEMD_DIR, WORKER_SYSTEMD_UNIT);\n\nexport default class ServiceInstall extends BaseCommand {\n  static override description =\n    'Install RuleMetric services. Default (in a repo checkout): API + worker + gateway + capture proxy as launchd agents. With --worker-only: just the job worker, targeting the globally-installed CLI \u2014 no repo, no build (works from `npm i -g @rulemetric/cli`, macOS launchd or Linux systemd).';\n\n  static override examples = [\n    '<%= config.bin %> service install',\n    '<%= config.bin %> service install --port 3000',\n    '<%= config.bin %> service install --skip-build',\n    '<%= config.bin %> service install --no-proxy',\n    '<%= config.bin %> service install --worker-only',\n  ];\n\n  static override flags = {\n    port: Flags.integer({\n      char: 'p',\n      default: 3000,\n      description: 'API server port',\n    }),\n    force: Flags.boolean({\n      char: 'f',\n      default: false,\n      description: 'Overwrite existing service configuration and reclaim conflicting ports',\n    }),\n    'skip-build': Flags.boolean({\n      default: false,\n      description: 'Skip the pre-install workspace build (API/web/cli dist must already exist)',\n    }),\n    'no-proxy': Flags.boolean({\n      default: false,\n      description: 'Skip gateway + mitmproxy plists (just install API + worker)',\n    }),\n    'worker-only': Flags.boolean({\n      default: false,\n      description:\n        'Install ONLY the job worker as a persistent service, targeting the globally-installed CLI (no repo checkout, no build, no API/gateway/proxy). Sources auth from ~/.config/rulemetric/env. macOS (launchd) + Linux (systemd --user).',\n    }),\n  };\n\n  async run(): Promise<void> {\n    const { flags } = await this.parse(ServiceInstall);\n    const port = flags.port;\n    const skipBuild = flags['skip-build'];\n    const noProxy = flags['no-proxy'];\n\n    // Worker-only path: a no-repo, no-build installer for end users on the\n    // globally-installed CLI. Diverges so completely from the full monorepo\n    // install (no findProjectRoot, no .env.local, no turbo build, no\n    // API/gateway/proxy) that it gets its own method rather than threading\n    // `if (!workerOnly)` through 200 lines below. Supports macOS + Linux.\n    if (flags['worker-only']) {\n      await this.runWorkerOnly(flags.force);\n      return;\n    }\n\n    // The full install (API + web + gateway + proxy) is macOS-only.\n    if (process.platform !== 'darwin') {\n      this.error(\n        'The full service install is macOS-only (launchd). For just the job worker on Linux (or a clean npm install), use: rulemetric service install --worker-only',\n      );\n    }\n\n    // Existing-service guard. Presence of the API plist implies a prior\n    // install \u2014 we only proceed automatically when --force is set so a\n    // user doesn't accidentally overwrite a working config.\n    if (existsSync(PLIST_PATH) && !flags.force) {\n      this.log(`Service already installed at ${PLIST_PATH}`);\n      this.log('Use --force to overwrite, or run: rulemetric service status');\n      return;\n    }\n\n    // API port conflict. Without --force we bail; with --force we'll reclaim\n    // the port later in killStaleProcess so launchd can actually bind it.\n    try {\n      const res = await fetch(`http://localhost:${port}/health`);\n      if (res.ok && !flags.force) {\n        this.warn(`Port ${port} is already in use (API may be running via start.sh or in another terminal).`);\n        this.warn('Stop it first with scripts/stop.sh, or use --force to take over the port.');\n        return;\n      }\n    } catch {\n      // Port free \u2014 good\n    }\n\n    // Find project root\n    const projectRoot = this.findProjectRoot();\n    if (!projectRoot) {\n      this.error(\n        'Could not find RuleMetric project root. Run this command from within the momento-mori repo, or set RULEMETRIC_PROJECT_ROOT.',\n      );\n    }\n\n    // Verify .env.local\n    const envLocal = join(projectRoot, '.env.local');\n    if (!existsSync(envLocal)) {\n      this.error(`.env.local not found at ${envLocal}. The API needs Supabase credentials to start.`);\n    }\n\n    // Load env vars (filtered by ALLOWED_ENV_VARS)\n    const envVars = this.guardAlwaysOnDatabaseUrl(this.loadEnvVars(projectRoot));\n\n    // Resolve binaries\n    const nodePath = this.findBinary('node');\n    const pnpmPath = this.findBinary('pnpm');\n    if (!nodePath || !pnpmPath) {\n      this.error('Could not find node or pnpm. Ensure they are in your PATH.');\n    }\n\n    // Resolve mitmdump (required unless --no-proxy). We resolve via `which`\n    // so the plist gets an absolute path \u2014 launchd's PATH at GUI session\n    // start can be narrow, and pyenv shims often don't appear in it.\n    let mitmdumpPath: string | null = null;\n    if (!noProxy) {\n      mitmdumpPath = this.findBinary('mitmdump');\n      if (!mitmdumpPath) {\n        this.error(\n          'mitmdump not found in PATH. Install with: pipx install mitmproxy (or brew install mitmproxy), then re-run.\\n' +\n          'Or skip the capture proxy with --no-proxy.',\n        );\n      }\n    }\n\n    // \u2500\u2500 Pre-install build \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // Mirrors the Dockerfile prod stage: API + web + CLI all need their\n    // dist/ directories to exist before launchd starts the processes. We\n    // run the whole set via turbo so the cache eats the cost on re-installs.\n    if (!skipBuild) {\n      this.log('[..] Building workspace artifacts (api, web, cli) via turbo...');\n      const buildFilters = [\n        '--filter', '@rulemetric/api...',\n        '--filter', '@rulemetric/web...',\n        '--filter', '@rulemetric/cli',\n      ];\n      const build = spawnSync(pnpmPath!, ['exec', 'turbo', 'run', 'build', ...buildFilters], {\n        cwd: projectRoot,\n        stdio: 'inherit',\n      });\n      if (build.status !== 0) {\n        this.error(\n          `Workspace build failed (exit ${build.status}). Fix the build first, or use --skip-build if dist/ already exists.`,\n        );\n      }\n      this.log('[OK] Build complete');\n    } else {\n      this.log('[..] Skipping pre-install build (--skip-build)');\n    }\n\n    // Verify the build artifacts launchd is about to invoke. A missing\n    // entry would crash-loop the plist; surfacing it here is friendlier.\n    const apiEntry = join(projectRoot, 'apps', 'api', 'dist', 'index.js');\n    if (!existsSync(apiEntry)) {\n      this.error(`API entry not found at ${apiEntry}. Re-run without --skip-build, or: pnpm --filter @rulemetric/api... build`);\n    }\n    const webIndex = join(projectRoot, 'apps', 'web', 'dist', 'index.html');\n    if (!existsSync(webIndex)) {\n      this.warn(`Web bundle not found at ${webIndex}. Dashboard at :${port} will 404 until you build apps/web.`);\n    }\n    if (!noProxy) {\n      const gatewayEntry = join(projectRoot, 'apps', 'cli', 'dist', 'lib', 'gateway-entry.js');\n      if (!existsSync(gatewayEntry)) {\n        this.error(`Gateway entry not found at ${gatewayEntry}. Re-run without --skip-build, or: pnpm --filter @rulemetric/cli build`);\n      }\n    }\n\n    // \u2500\u2500 Clean up conflicting PID-file-managed or orphan processes \u2500\n    // hooks install + proxy start use PID files; we replace those with\n    // launchd-managed lifecycles so both ports need to be free before\n    // bootstrap. With --force we also clear whatever is squatting on\n    // the API port.\n    if (flags.force) {\n      this.killStaleProcess(port, null, 'API on :' + port);\n    }\n    if (!noProxy) {\n      this.killStaleProcess(GATEWAY_PORT, join(CONFIG_DIR, 'gateway.pid'), 'gateway');\n      this.killStaleProcess(PROXY_PORT, join(CONFIG_DIR, 'proxy.pid'), 'mitmproxy');\n    }\n\n    // Create dirs\n    mkdirSync(join(homedir(), 'Library', 'LaunchAgents'), { recursive: true });\n    mkdirSync(LOG_DIR, { recursive: true });\n\n    const uid = execSync('id -u', { encoding: 'utf-8' }).trim();\n\n    // \u2500\u2500 Install API service \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    const apiPlist = this.buildPlist({ port, projectRoot, nodePath: nodePath!, pnpmPath: pnpmPath!, envVars });\n    this.bootoutAndWrite(uid, PLIST_PATH, apiPlist, 'API');\n    this.bootstrapPlist(uid, PLIST_PATH, 'API');\n\n    // Wait for API to come up\n    this.log(`[..] Waiting for API on :${port}...`);\n    const apiStarted = await this.waitForApi(port, 15);\n    if (apiStarted) {\n      this.log(`[OK] RuleMetric API running on :${port}`);\n      if (existsSync(webIndex)) {\n        this.log(`[OK] Dashboard available at http://localhost:${port}`);\n      }\n    } else {\n      this.warn('API did not respond within 15s. Check logs:');\n      this.log(`  tail -f ${LOG_DIR}/api-stdout.log`);\n      this.log(`  tail -f ${LOG_DIR}/api-stderr.log`);\n    }\n\n    // \u2500\u2500 Install worker service \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    this.log('');\n    this.log('Installing worker service...');\n    // Reap detached, unsupervised evals-agent orphans before bootstrapping the\n    // worker \u2014 they hold no listening port, so killStaleProcess can't find them\n    // (a fleet of 4 ran 3+ days and helped saturate the pool). RCA 2026-06-21.\n    this.killStaleAgents();\n    const workerPlist = this.buildWorkerPlist({\n      cliBin: join(projectRoot, 'apps', 'cli', 'bin', 'run.js'),\n      cliDist: join(projectRoot, 'apps', 'cli', 'dist'),\n      workingDir: projectRoot,\n      nodePath: nodePath!,\n      pnpmPath: pnpmPath!,\n      envVars,\n    });\n    this.bootoutAndWrite(uid, WORKER_PLIST_PATH, workerPlist, 'Worker');\n    this.bootstrapPlist(uid, WORKER_PLIST_PATH, 'Worker');\n\n    // \u2500\u2500 Install gateway + capture-proxy services \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    if (!noProxy) {\n      this.log('');\n      this.log('Installing gateway + capture proxy services...');\n\n      const gatewayPlist = this.buildGatewayPlist({ projectRoot, nodePath: nodePath! });\n      this.bootoutAndWrite(uid, GATEWAY_PLIST_PATH, gatewayPlist, 'Gateway');\n      this.bootstrapPlist(uid, GATEWAY_PLIST_PATH, 'Gateway');\n\n      const proxyPlist = this.buildProxyPlist({\n        projectRoot,\n        mitmdumpPath: mitmdumpPath!,\n        envVars,\n      });\n      this.bootoutAndWrite(uid, PROXY_PLIST_PATH, proxyPlist, 'Proxy');\n      this.bootstrapPlist(uid, PROXY_PLIST_PATH, 'Proxy');\n    }\n\n    // Phase 4c cleanup: the daily worker-restart agent (04:00 kickstart)\n    // existed to dodge the graphile-LISTEN-wedge class observed at ~25h\n    // worker uptime. The agent path has no LISTEN socket, so the wedge\n    // class is structurally gone \u2014 the daily kickstart is dead weight.\n    // Bootout any leftover plist from prior installs so reinstall is a\n    // truly clean state.\n    if (existsSync(WORKER_RESTART_PLIST_PATH)) {\n      try {\n        execFileSync('launchctl', ['bootout', `gui/${uid}`, WORKER_RESTART_PLIST_PATH], { encoding: 'utf-8' });\n      } catch {\n        // Expected if not loaded\n      }\n      try {\n        execFileSync('rm', ['-f', WORKER_RESTART_PLIST_PATH]);\n        this.log('[OK] Removed stale daily worker-restart agent (no longer needed on agent path)');\n      } catch {\n        // Best-effort\n      }\n    }\n\n    this.log('');\n    if (noProxy) {\n      this.log('Installed: API + worker. Gateway/proxy skipped (--no-proxy).');\n    } else {\n      this.log('Installed: API + worker + gateway + capture proxy.');\n    }\n    this.log('All services start at login, restart on crash, and pick up rebuilds via WatchPaths.');\n    this.log('');\n    this.log('NOTE: Env vars are baked in at install time. If you change');\n    this.log('.env.local or credentials, re-run: rulemetric service install --force');\n    this.log('');\n    this.log('Manage with:');\n    this.log('  rulemetric service status    \u2014 check if running');\n    this.log('  rulemetric service uninstall \u2014 remove all services');\n\n    // Ensure the active-org cache reflects the user's current active_org_id\n    // before the worker spawns its first capture. Belt-and-suspenders with\n    // BaseCommand's guarded refresh.\n    await bootstrapActiveOrg();\n\n    // Soft tmux capability check \u2014 see hooks/install.ts for the same line.\n    const tmux = await detectTmux();\n    this.log('');\n    if (tmux.available) {\n      this.log(`[OK] tmux found${tmux.version ? ` (v${tmux.version})` : ''} \u2014 live send enabled`);\n    } else {\n      this.log('[!!] tmux not found \u2014 live send will fall back to opening Terminal. Install with: brew install tmux');\n    }\n  }\n\n  /**\n   * Worker-only install: a persistent job worker for end users on the\n   * globally-installed CLI, with NO repo checkout, NO build, and NO\n   * API/gateway/proxy. macOS \u2192 launchd; Linux \u2192 systemd --user. Auth is\n   * sourced from ~/.config/rulemetric/env (written by `rulemetric auth\n   * login`); the thin-agent worker is HTTP-only (long-polls /api/work/next),\n   * so it needs only the API URL + a key/token, never DB credentials.\n   */\n  private async runWorkerOnly(force: boolean): Promise<void> {\n    const platform = process.platform;\n    if (platform !== 'darwin' && platform !== 'linux') {\n      this.error(`--worker-only supports macOS (launchd) and Linux (systemd) only; detected '${platform}'.`);\n    }\n\n    // Resolve node + the GLOBAL CLI entry (the installed package root, NOT a\n    // repo). oclif's this.config.root is the package directory; bin/run.js is\n    // shipped in the published tarball (\"files\": [\"bin\", ...]).\n    const nodePath = this.findBinary('node');\n    if (!nodePath) {\n      this.error('Could not find `node` in PATH.');\n    }\n    const cliBin = join(this.config.root, 'bin', 'run.js');\n    if (!existsSync(cliBin)) {\n      this.error(\n        `Could not locate the installed CLI entry at ${cliBin}. Reinstall the CLI (e.g. npm i -g @rulemetric/cli) and re-run.`,\n      );\n    }\n    const cliDist = join(this.config.root, 'dist');\n\n    const envVars = this.loadGlobalWorkerEnv();\n    if (!envVars.RULEMETRIC_API_KEY && !envVars.RULEMETRIC_ACCESS_TOKEN) {\n      this.error(\n        'Not authenticated \u2014 no RULEMETRIC_API_KEY/RULEMETRIC_ACCESS_TOKEN in ~/.config/rulemetric/env.\\nRun `rulemetric auth login` first, then re-run `rulemetric service install --worker-only`.',\n      );\n    }\n    // Default to prod so a user who never set RULEMETRIC_API_URL still works.\n    if (!envVars.RULEMETRIC_API_URL) {\n      envVars.RULEMETRIC_API_URL = 'https://rulemetric.com';\n    }\n\n    mkdirSync(LOG_DIR, { recursive: true });\n    // Reap any orphaned foreground `evals agent` the user may have started by\n    // hand \u2014 otherwise two workers double-claim jobs.\n    this.killStaleAgents();\n\n    if (platform === 'darwin') {\n      if (existsSync(WORKER_PLIST_PATH) && !force) {\n        this.log(`Worker already installed at ${WORKER_PLIST_PATH}.`);\n        this.log('Use --force to overwrite, or run: rulemetric service status');\n        return;\n      }\n      mkdirSync(join(homedir(), 'Library', 'LaunchAgents'), { recursive: true });\n      const uid = execSync('id -u', { encoding: 'utf-8' }).trim();\n      const plist = this.buildWorkerPlist({\n        cliBin,\n        cliDist,\n        workingDir: homedir(),\n        nodePath: nodePath!,\n        nodeEnv: 'production',\n        envVars,\n      });\n      this.bootoutAndWrite(uid, WORKER_PLIST_PATH, plist, 'Worker');\n      this.bootstrapPlist(uid, WORKER_PLIST_PATH, 'Worker');\n      this.log('');\n      this.log('[OK] Worker installed (launchd). Starts at login, restarts on crash.');\n      this.log(`     Logs: tail -f ${join(LOG_DIR, 'worker-stdout.log')}`);\n    } else {\n      // Linux: systemd --user unit.\n      if (existsSync(WORKER_SYSTEMD_PATH) && !force) {\n        this.log(`Worker already installed at ${WORKER_SYSTEMD_PATH}.`);\n        this.log(`Use --force to overwrite, or: systemctl --user status ${WORKER_SYSTEMD_UNIT}`);\n        return;\n      }\n      mkdirSync(WORKER_SYSTEMD_DIR, { recursive: true });\n      const unit = this.buildWorkerSystemdUnit({ cliBin, nodePath: nodePath!, envVars });\n      writeFileSync(WORKER_SYSTEMD_PATH, unit, { mode: 0o600 });\n      this.log(`[OK] Wrote ${WORKER_SYSTEMD_PATH}`);\n      try {\n        execFileSync('systemctl', ['--user', 'daemon-reload']);\n        execFileSync('systemctl', ['--user', 'enable', '--now', WORKER_SYSTEMD_UNIT]);\n        this.log('[OK] Worker enabled + started (systemctl --user).');\n        this.log('     Survive logout/reboot: sudo loginctl enable-linger \"$USER\"');\n        this.log(`     Logs: journalctl --user -u ${WORKER_SYSTEMD_UNIT} -f`);\n      } catch (err) {\n        this.warn(\n          `Wrote the unit but \\`systemctl --user\\` failed: ${err instanceof Error ? err.message : String(err)}`,\n        );\n        this.log(\n          `Enable it manually: systemctl --user daemon-reload && systemctl --user enable --now ${WORKER_SYSTEMD_UNIT}`,\n        );\n      }\n    }\n\n    this.log('');\n    this.log('Manage with:');\n    this.log('  rulemetric service status    \u2014 check if running');\n    this.log('  rulemetric service uninstall \u2014 remove the worker');\n\n    // Keep the active-org cache warm for the worker's first capture.\n    await bootstrapActiveOrg();\n  }\n\n  /**\n   * Load worker env from ~/.config/rulemetric/env only (no repo .env.local).\n   * Filtered by ALLOWED_ENV_VARS, same as the full install's loader.\n   */\n  private loadGlobalWorkerEnv(): Record<string, string> {\n    const vars: Record<string, string> = {};\n    const globalEnv = join(CONFIG_DIR, 'env');\n    if (existsSync(globalEnv)) {\n      for (const line of readFileSync(globalEnv, 'utf-8').split('\\n')) {\n        const trimmed = line.trim();\n        if (!trimmed || trimmed.startsWith('#')) continue;\n        const eqIdx = trimmed.indexOf('=');\n        if (eqIdx > 0) {\n          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);\n        }\n      }\n    }\n    return Object.fromEntries(Object.entries(vars).filter(([k]) => ALLOWED_ENV_VARS.has(k)));\n  }\n\n  /** systemd --user unit for the Linux worker-only path. */\n  private buildWorkerSystemdUnit(opts: {\n    cliBin: string;\n    nodePath: string;\n    envVars: Record<string, string>;\n  }): string {\n    const { cliBin, nodePath, envVars } = opts;\n    const env: Record<string, string> = {\n      ...envVars,\n      NODE_ENV: 'production',\n      // Mirror the launchd worker's pooler bound (RCA 2026-06-21).\n      PG_POOL_MAX: envVars.PG_POOL_MAX ?? '3',\n      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? '10',\n    };\n    // systemd Environment= values: wrap in double quotes and escape embedded\n    // quotes/backslashes. Tokens/URLs carry neither, but be defensive.\n    const envLines = Object.entries(env)\n      .map(([k, v]) => `Environment=\"${k}=${v.replace(/\\\\/g, '\\\\\\\\').replace(/\"/g, '\\\\\"')}\"`)\n      .join('\\n');\n    return `[Unit]\nDescription=RuleMetric job worker (evals agent)\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=simple\nExecStart=${nodePath} ${cliBin} evals agent\nRestart=on-failure\nRestartSec=15\n${envLines}\n\n[Install]\nWantedBy=default.target\n`;\n  }\n\n  private findProjectRoot(): string | null {\n    // Check env var override\n    if (process.env.RULEMETRIC_PROJECT_ROOT) {\n      return process.env.RULEMETRIC_PROJECT_ROOT;\n    }\n    // Walk up from cwd looking for the monorepo marker\n    let dir = process.cwd();\n    for (let i = 0; i < 10; i++) {\n      if (existsSync(join(dir, 'apps', 'api', 'package.json'))) {\n        return dir;\n      }\n      const parent = join(dir, '..');\n      if (parent === dir) break;\n      dir = parent;\n    }\n    return null;\n  }\n\n  private findBinary(name: string): string | null {\n    try {\n      return execFileSync('which', [name], { encoding: 'utf-8', stdio: ['pipe', 'pipe', 'ignore'] }).trim() || null;\n    } catch {\n      return null;\n    }\n  }\n\n  private loadEnvVars(projectRoot: string): Record<string, string> {\n    const vars: Record<string, string> = {};\n\n    // Load from .env.local (Supabase credentials)\n    const envLocal = join(projectRoot, '.env.local');\n    if (existsSync(envLocal)) {\n      for (const line of readFileSync(envLocal, 'utf-8').split('\\n')) {\n        const trimmed = line.trim();\n        if (!trimmed || trimmed.startsWith('#')) continue;\n        const eqIdx = trimmed.indexOf('=');\n        if (eqIdx > 0) {\n          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);\n        }\n      }\n    }\n\n    // Load from ~/.config/rulemetric/env (API key)\n    const globalEnv = join(CONFIG_DIR, 'env');\n    if (existsSync(globalEnv)) {\n      for (const line of readFileSync(globalEnv, 'utf-8').split('\\n')) {\n        const trimmed = line.trim();\n        if (!trimmed || trimmed.startsWith('#')) continue;\n        const eqIdx = trimmed.indexOf('=');\n        if (eqIdx > 0) {\n          vars[trimmed.slice(0, eqIdx)] = trimmed.slice(eqIdx + 1);\n        }\n      }\n    }\n\n    // Only keep allowed env vars \u2014 never leak unrelated secrets\n    return Object.fromEntries(\n      Object.entries(vars).filter(([k]) => ALLOWED_ENV_VARS.has(k)),\n    );\n  }\n\n  // Guard: the always-on API + worker MUST use the TRANSACTION-mode pooler\n  // (port 6543). A SESSION-mode URL (:5432, 15-slot cap) baked into these\n  // services was the trigger of the recurring pool saturation \u2014 a pool-cascade\n  // debugging override leaked into the plists through this very installer. Auto-\n  // correct the obvious session\u2192transaction port and warn loudly; warn (but do\n  // not block) on a direct, non-pooler URL. Pool-exhaustion RCA 2026-06-21.\n  private guardAlwaysOnDatabaseUrl(envVars: Record<string, string>): Record<string, string> {\n    const url = envVars.DATABASE_URL;\n    if (!url) return envVars;\n    if (url.includes('pooler.supabase.com:5432')) {\n      this.warn(\n        'DATABASE_URL points at the SESSION-mode pooler (:5432, 15-slot cap). The ' +\n          'always-on API/worker must use TRANSACTION mode (:6543) \u2014 auto-correcting ' +\n          'for the installed services. Fix .env.local to silence this warning.',\n      );\n      return { ...envVars, DATABASE_URL: url.replace('pooler.supabase.com:5432', 'pooler.supabase.com:6543') };\n    }\n    if (/@db\\.[a-z0-9]+\\.supabase\\.co[:/]/.test(url)) {\n      this.warn(\n        'DATABASE_URL is a DIRECT database connection (db.<ref>.supabase.co), not the ' +\n          'pooler. Always-on services should use the transaction pooler ' +\n          '(aws-*.pooler.supabase.com:6543) to avoid exhausting Postgres connections.',\n      );\n    }\n    return envVars;\n  }\n\n  // Reap orphaned, unsupervised `evals agent` worker processes before\n  // (re)bootstrapping the launchd worker. The worker holds no listening port,\n  // so killStaleProcess (port/pidfile based) cannot find detached agents \u2014 a\n  // fleet of 4 ran 3+ days and helped saturate the pool (RCA 2026-06-21). pgrep\n  // the command line and SIGTERM every match except ourselves; the agent's own\n  // single-instance lock then keeps a fresh fleet from forming.\n  private killStaleAgents(): void {\n    try {\n      const out = execFileSync('pgrep', ['-f', 'bin/run.js evals agent'], {\n        encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'],\n      });\n      const pids = out.trim().split('\\n').filter(Boolean)\n        .map((s) => parseInt(s, 10))\n        .filter((p) => !isNaN(p) && p !== process.pid);\n      for (const pid of pids) {\n        try {\n          process.kill(pid, 'SIGTERM');\n          this.log(`[OK] Reaped orphan evals agent (PID ${pid})`);\n        } catch {\n          // already gone\n        }\n      }\n      if (pids.length) spawnSync('sleep', ['1'], { stdio: 'ignore' });\n    } catch {\n      // pgrep exits non-zero when nothing matches \u2014 fine\n    }\n  }\n\n  // Best-effort cleanup of a process that would conflict with an\n  // about-to-bootstrap launchd plist. Tries two routes:\n  //   (a) the PID file written by the legacy spawn path\n  //       (gateway-lifecycle / proxy start), if pidFile is non-null\n  //   (b) anything actively listening on the expected port\n  // Either way: SIGTERM + small grace + SIGKILL fallback. Stale PID file\n  // gets unlinked.\n  private killStaleProcess(port: number, pidFile: string | null, name: string): void {\n    let killedAny = false;\n\n    if (pidFile && existsSync(pidFile)) {\n      try {\n        const pidStr = readFileSync(pidFile, 'utf-8').trim();\n        const pid = parseInt(pidStr, 10);\n        if (!isNaN(pid)) {\n          try {\n            process.kill(pid, 'SIGTERM');\n            killedAny = true;\n            this.log(`[OK] Stopped existing ${name} (PID ${pid} from ${pidFile})`);\n          } catch {\n            // Already dead \u2014 fine\n          }\n        }\n      } catch {\n        // Unreadable PID file\n      }\n      try { execFileSync('rm', ['-f', pidFile]); } catch { /* best-effort */ }\n    }\n\n    // Port listener (catches orphans not in the PID file, and the foreground\n    // dev API when --force is set on the API port)\n    try {\n      const result = execFileSync('lsof', ['-ti', `:${port}`, '-sTCP:LISTEN'], {\n        encoding: 'utf-8', stdio: ['ignore', 'pipe', 'ignore'],\n      });\n      const pids = result.trim().split('\\n').filter(Boolean);\n      for (const pidStr of pids) {\n        const pid = parseInt(pidStr, 10);\n        if (!isNaN(pid)) {\n          try {\n            process.kill(pid, 'SIGTERM');\n            killedAny = true;\n            this.log(`[OK] Stopped orphan on :${port} (PID ${pid})`);\n          } catch { /* already gone */ }\n        }\n      }\n    } catch {\n      // lsof exits non-zero when nothing matches \u2014 that's fine\n    }\n\n    if (killedAny) {\n      // Brief grace so the port releases before launchd binds it\n      spawnSync('sleep', ['1'], { stdio: 'ignore' });\n    }\n  }\n\n  private bootoutAndWrite(uid: string, plistPath: string, content: string, name: string): void {\n    // First install of a service has no prior load \u2192 launchctl bootout exits\n    // non-zero. The messaging is inconsistent across macOS versions (\"Could\n    // not find specified service\" on some, \"Boot-out failed: 5: Input/output\n    // error\" on others). We treat all of these as \"nothing to unload\" and\n    // only warn on errors that don't look like that family.\n    const benignBootoutPatterns = [\n      'Could not find specified service',\n      'No such process',\n      '3: No such process',\n      '5: Input/output error',\n    ];\n    try {\n      execFileSync('launchctl', ['bootout', `gui/${uid}`, plistPath], {\n        encoding: 'utf-8',\n        // Capture stderr instead of letting it print to the user's terminal.\n        // The plist was either already-loaded (we unload it cleanly) or not\n        // loaded (we want to swallow the error) \u2014 the user shouldn't see\n        // launchctl's raw output either way.\n        stdio: ['ignore', 'pipe', 'pipe'],\n      });\n      this.log(`[OK] Unloaded existing ${name} service`);\n    } catch (err) {\n      const msg = (err as Error).message || '';\n      const stderr = ((err as { stderr?: Buffer | string }).stderr ?? '').toString();\n      const combined = `${msg}\\n${stderr}`;\n      if (!benignBootoutPatterns.some((p) => combined.includes(p))) {\n        this.warn(`Could not unload existing ${name} service: ${msg.trim()}`);\n      }\n    }\n    writeFileSync(plistPath, content, { mode: 0o600 });\n    this.log(`[OK] ${name} plist written to ${plistPath}`);\n  }\n\n  private bootstrapPlist(uid: string, plistPath: string, name: string): void {\n    try {\n      execFileSync('launchctl', ['bootstrap', `gui/${uid}`, plistPath]);\n      this.log(`[OK] ${name} service loaded into launchd`);\n    } catch (bootstrapErr) {\n      try {\n        execFileSync('launchctl', ['load', plistPath]);\n        this.log(`[OK] ${name} service loaded into launchd (legacy)`);\n      } catch (loadErr) {\n        this.warn(\n          `Could not load ${name} service.\\n` +\n          `  bootstrap: ${(bootstrapErr as Error).message.trim()}\\n` +\n          `  load: ${(loadErr as Error).message.trim()}`,\n        );\n      }\n    }\n  }\n\n  private buildPlist(opts: {\n    port: number;\n    projectRoot: string;\n    nodePath: string;\n    pnpmPath: string;\n    envVars: Record<string, string>;\n  }): string {\n    const { port, projectRoot, nodePath, pnpmPath, envVars } = opts;\n\n    // Derive PATH from resolved binary locations (works with nvm, volta, fnm, homebrew)\n    const pathDirs = [...new Set([dirname(nodePath), dirname(pnpmPath), '/usr/local/bin', '/usr/bin', '/bin'])];\n\n    // Build environment dict entries. NODE_ENV=production mirrors fly.toml\n    // so the bundled web build is served exactly as it is on rulemetric.com,\n    // and middleware paths that branch on NODE_ENV match prod behavior\n    // locally (rate-limits, error verbosity, etc.).\n    const envEntries = Object.entries({\n      ...envVars,\n      PORT: String(port),\n      NODE_ENV: 'production',\n      PATH: pathDirs.join(':'),\n      // Pool resilience for the always-on API (NOT the worker, which runs\n      // legitimately long analytics queries). A wedged Supavisor socket with\n      // the default max=3 pool and no query timeout hangs every authenticated\n      // request \u2014 the 2026-06-09 login-hang. statement_timeout lets Postgres\n      // cancel a stuck query so the connection returns to the pool (verified\n      // honored through the transaction pooler); the larger pool adds headroom.\n      // Both env-overridable. See packages/db/src/client.ts.\n      PG_POOL_MAX: envVars.PG_POOL_MAX ?? '10',\n      PG_STATEMENT_TIMEOUT_MS: envVars.PG_STATEMENT_TIMEOUT_MS ?? '10000',\n      // Keep the pool warm so the API stops reconnecting (and re-resolving the\n      // rotating pooler ELB) on nearly every request \u2014 the churn that exposed\n      // it to intermittent CONNECT_TIMEOUT/ENOTFOUND. Worker/tests keep the\n      // conservative 5s default. See packages/db/src/client.ts (2026-06-09).\n      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? '30',\n      // Silence per-span stdout dumps on the local API \u2014 it has no OTLP\n      // endpoint and a fixed (now rotated) log file; the ConsoleSpanExporter\n      // grew api-stdout to 370MB / ~400k spans. Fly leaves this unset so its\n      // console spans stay grep-able in the managed log stream.\n      OTEL_SPAN_EXPORT: envVars.OTEL_SPAN_EXPORT ?? 'none',\n    })\n      .map(([k, v]) => `      <key>${escapeXml(k)}</key>\\n      <string>${escapeXml(v)}</string>`)\n      .join('\\n');\n\n    // Run the compiled API directly \u2014 same shape as the prod Dockerfile\n    // CMD. Avoids tsx startup cost on every launchd restart, and serves\n    // apps/web/dist from the same process so :3000 is \"API + dashboard\",\n    // matching rulemetric.com. WatchPaths on apps/api/dist auto-bounces\n    // the service on rebuild, so the dev cycle is: edit src \u2192 pnpm build\n    // \u2192 launchd kicks the new code automatically (no manual kickstart).\n    const apiEntry = join(projectRoot, 'apps', 'api', 'dist', 'index.js');\n    const apiDist = join(projectRoot, 'apps', 'api', 'dist');\n\n    return `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${PLIST_LABEL}</string>\n\n  <key>ProgramArguments</key>\n  <array>\n    <string>${escapeXml(nodePath)}</string>\n    <string>${escapeXml(apiEntry)}</string>\n  </array>\n\n  <key>WorkingDirectory</key>\n  <string>${escapeXml(projectRoot)}</string>\n\n  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries}\n  </dict>\n\n  <key>RunAtLoad</key>\n  <true/>\n\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key>\n    <false/>\n  </dict>\n\n  <key>ThrottleInterval</key>\n  <integer>10</integer>\n\n  <key>WatchPaths</key>\n  <array>\n    <string>${escapeXml(apiDist)}</string>\n  </array>\n\n  <key>StandardOutPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'api-stdout.log'))}</string>\n\n  <key>StandardErrorPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'api-stderr.log'))}</string>\n\n  <key>ProcessType</key>\n  <string>Background</string>\n</dict>\n</plist>\n`;\n  }\n\n  private buildWorkerPlist(opts: {\n    cliBin: string;\n    cliDist: string;\n    workingDir: string;\n    nodePath: string;\n    pnpmPath?: string;\n    nodeEnv?: string;\n    envVars: Record<string, string>;\n  }): string {\n    const { cliBin, cliDist, workingDir, nodePath, pnpmPath, envVars } = opts;\n    // Repo install runs as the dev host \u2192 'development'. --worker-only is an\n    // end-user worker against prod \u2192 'production'.\n    const nodeEnv = opts.nodeEnv ?? 'development';\n\n    const pathDirs = [\n      ...new Set(\n        [dirname(nodePath), pnpmPath ? dirname(pnpmPath) : null, '/usr/local/bin', '/usr/bin', '/bin'].filter(\n          (d): d is string => Boolean(d),\n        ),\n      ),\n    ];\n\n    const envEntries = Object.entries({\n      ...envVars,\n      NODE_ENV: nodeEnv,\n      PATH: pathDirs.join(':'),\n      // Bound the worker's pooler footprint. The worker is mostly idle (HTTP\n      // long-poll); an UNPINNED pool plus the previously-missing single-instance\n      // guard let an orphaned fleet of agents each hold a pool and saturate\n      // Supavisor's 200-client cap. A small pool + short idle timeout releases\n      // sessions promptly. Pool-exhaustion RCA 2026-06-21.\n      PG_POOL_MAX: envVars.PG_POOL_MAX ?? '3',\n      PG_IDLE_TIMEOUT: envVars.PG_IDLE_TIMEOUT ?? '10',\n    })\n      .map(([k, v]) => `      <key>${escapeXml(k)}</key>\\n      <string>${escapeXml(v)}</string>`)\n      .join('\\n');\n\n    // Run the CLI bin directly via node. Earlier this used\n    // `pnpm --filter @rulemetric/cli exec rulemetric` but pnpm-exec couldn't\n    // resolve the workspace bin symlink reliably under launchd, crash-looping\n    // with `Command \"rulemetric\" not found`. Direct node invocation is both\n    // simpler (one process less) and avoids the bin-symlink lookup entirely.\n    // cliBin/cliDist are passed in: the repo install points them at\n    // <repo>/apps/cli/{bin/run.js,dist}; --worker-only points them at the\n    // globally-installed package (<config.root>/{bin/run.js,dist}). WatchPaths\n    // on cliDist bounces the worker when the code changes \u2014 a local `pnpm\n    // build` for the repo path, an `npm update -g` for the global path.\n    return `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${WORKER_PLIST_LABEL}</string>\n\n  <key>ProgramArguments</key>\n  <array>\n    <string>${escapeXml(nodePath)}</string>\n    <string>${escapeXml(cliBin)}</string>\n    <string>evals</string>\n    <string>agent</string>\n  </array>\n\n  <key>WorkingDirectory</key>\n  <string>${escapeXml(workingDir)}</string>\n\n  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries}\n  </dict>\n\n  <key>RunAtLoad</key>\n  <true/>\n\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key>\n    <false/>\n  </dict>\n\n  <key>ThrottleInterval</key>\n  <integer>15</integer>\n\n  <key>WatchPaths</key>\n  <array>\n    <string>${escapeXml(cliDist)}</string>\n  </array>\n\n  <key>StandardOutPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'worker-stdout.log'))}</string>\n\n  <key>StandardErrorPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'worker-stderr.log'))}</string>\n\n  <key>ProcessType</key>\n  <string>Background</string>\n</dict>\n</plist>\n`;\n  }\n\n  // CONNECT-proxy router that fronts mitmproxy on :8787. Always-on so\n  // .claude/settings.json's HTTPS_PROXY pointer never resolves to a dead\n  // socket (which would break Claude Code entirely \u2014 see CLAUDE.md).\n  // NOT watched on rebuild: bouncing the gateway mid-request would drop\n  // in-flight streaming responses. Gateway code changes rarely; on\n  // upgrade, the user can `launchctl kickstart gui/<uid>/com.rulemetric.gateway`.\n  private buildGatewayPlist(opts: {\n    projectRoot: string;\n    nodePath: string;\n  }): string {\n    const { projectRoot, nodePath } = opts;\n    const gatewayEntry = join(projectRoot, 'apps', 'cli', 'dist', 'lib', 'gateway-entry.js');\n    const cliBin = join(projectRoot, 'apps', 'cli', 'bin', 'run.js');\n\n    const pathDirs = [...new Set([dirname(nodePath), '/usr/local/bin', '/usr/bin', '/bin'])];\n\n    // Gateway only needs PATH + the CLI metadata used for drift detection\n    // (gateway.ts:43 \u2014 when the addon's on-disk version file diverges from\n    // the gateway's runtime version, it re-invokes the CLI to restart\n    // mitmproxy). It does NOT need Supabase/auth env vars.\n    const env = {\n      RULEMETRIC_CLI_VERSION: this.config.version,\n      RULEMETRIC_CLI_ENTRY: cliBin,\n      PATH: pathDirs.join(':'),\n    };\n\n    const envEntries = Object.entries(env)\n      .map(([k, v]) => `      <key>${escapeXml(k)}</key>\\n      <string>${escapeXml(v)}</string>`)\n      .join('\\n');\n\n    return `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${GATEWAY_PLIST_LABEL}</string>\n\n  <key>ProgramArguments</key>\n  <array>\n    <string>${escapeXml(nodePath)}</string>\n    <string>${escapeXml(gatewayEntry)}</string>\n  </array>\n\n  <key>WorkingDirectory</key>\n  <string>${escapeXml(projectRoot)}</string>\n\n  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries}\n  </dict>\n\n  <key>RunAtLoad</key>\n  <true/>\n\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key>\n    <false/>\n  </dict>\n\n  <key>ThrottleInterval</key>\n  <integer>10</integer>\n\n  <key>StandardOutPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'gateway-stdout.log'))}</string>\n\n  <key>StandardErrorPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'gateway-stderr.log'))}</string>\n\n  <key>ProcessType</key>\n  <string>Background</string>\n</dict>\n</plist>\n`;\n  }\n\n  // mitmproxy with the RuleMetric capture addon. Same invocation as\n  // `rulemetric proxy start` (see commands/proxy/start.ts:308) so the\n  // launchd path and the CLI path are interchangeable. We don't WatchPath\n  // the Python addon \u2014 mitmdump has its own addon reload that handles\n  // edits without a full process restart.\n  private buildProxyPlist(opts: {\n    projectRoot: string;\n    mitmdumpPath: string;\n    envVars: Record<string, string>;\n  }): string {\n    const { projectRoot, mitmdumpPath, envVars } = opts;\n    const addonPath = join(projectRoot, 'packages', 'proxy', 'addon', 'rulemetric_addon.py');\n\n    const pathDirs = [...new Set([dirname(mitmdumpPath), '/usr/local/bin', '/usr/bin', '/bin'])];\n\n    // Proxy needs:\n    //  - auth env vars (so its reporter can POST events to the API)\n    //  - RULEMETRIC_PROJECT_PATH (writes session-meta + addon-version files)\n    //  - RULEMETRIC_CLI_VERSION (gateway uses this to detect drift)\n    const env = {\n      ...envVars,\n      RULEMETRIC_PROJECT_PATH: projectRoot,\n      RULEMETRIC_CLI_VERSION: this.config.version,\n      PATH: pathDirs.join(':'),\n    };\n\n    const envEntries = Object.entries(env)\n      .map(([k, v]) => `      <key>${escapeXml(k)}</key>\\n      <string>${escapeXml(v)}</string>`)\n      .join('\\n');\n\n    return `<?xml version=\"1.0\" encoding=\"UTF-8\"?>\n<!DOCTYPE plist PUBLIC \"-//Apple//DTD PLIST 1.0//EN\" \"http://www.apple.com/DTDs/PropertyList-1.0.dtd\">\n<plist version=\"1.0\">\n<dict>\n  <key>Label</key>\n  <string>${PROXY_PLIST_LABEL}</string>\n\n  <key>ProgramArguments</key>\n  <array>\n    <string>${escapeXml(mitmdumpPath)}</string>\n    <string>--listen-port</string>\n    <string>${PROXY_PORT}</string>\n    <string>-s</string>\n    <string>${escapeXml(addonPath)}</string>\n    <string>--set</string>\n    <string>console_eventlog_verbosity=info</string>\n  </array>\n\n  <key>WorkingDirectory</key>\n  <string>${escapeXml(projectRoot)}</string>\n\n  <key>EnvironmentVariables</key>\n  <dict>\n${envEntries}\n  </dict>\n\n  <key>RunAtLoad</key>\n  <true/>\n\n  <key>KeepAlive</key>\n  <dict>\n    <key>SuccessfulExit</key>\n    <false/>\n  </dict>\n\n  <key>ThrottleInterval</key>\n  <integer>15</integer>\n\n  <key>StandardOutPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'proxy-stdout.log'))}</string>\n\n  <key>StandardErrorPath</key>\n  <string>${escapeXml(join(LOG_DIR, 'proxy-stderr.log'))}</string>\n\n  <key>ProcessType</key>\n  <string>Background</string>\n</dict>\n</plist>\n`;\n  }\n\n  private async waitForApi(port: number, timeoutSecs: number): Promise<boolean> {\n    let lastError: string | null = null;\n    for (let i = 0; i < timeoutSecs; i++) {\n      try {\n        const res = await fetch(`http://localhost:${port}/health`);\n        if (res.ok) return true;\n        lastError = `health check returned ${res.status}`;\n      } catch (err) {\n        lastError = (err as Error).message;\n      }\n      await new Promise(r => setTimeout(r, 1000));\n    }\n    if (lastError) {\n      this.warn(`Last health check error: ${lastError}`);\n    }\n    return false;\n  }\n}\n\nfunction escapeXml(s: string): string {\n  return s.replace(/&/g, '&amp;').replace(/</g, '&lt;').replace(/>/g, '&gt;').replace(/\"/g, '&quot;');\n}\n"],
+  "mappings": ";;;;;;;;;;;;;;;;;AAAA,SAAS,aAAa;AACtB,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,UAAU,cAAc,iBAAiB;AAClD,SAAS,eAAe;AACxB,SAAS,SAAS,YAAY;AAM9B,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA,EAIA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA;AAAA;AAAA;AAAA;AAAA,EAKA;AAAA,EACA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA;AAAA,EACA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA;AACF,CAAC;AAED,IAAM,cAAc;AACpB,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,WAAW,QAAQ;AACpF,IAAM,qBAAqB;AAC3B,IAAM,oBAAoB,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,kBAAkB,QAAQ;AAClG,IAAM,sBAAsB;AAC5B,IAAM,qBAAqB,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,mBAAmB,QAAQ;AACpG,IAAM,oBAAoB;AAC1B,IAAM,mBAAmB,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,iBAAiB,QAAQ;AAGhG,IAAM,6BAA6B;AACnC,IAAM,4BAA4B,KAAK,QAAQ,GAAG,WAAW,gBAAgB,GAAG,0BAA0B,QAAQ;AAClH,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,YAAY;AAC1D,IAAM,UAAU,KAAK,YAAY,MAAM;AACvC,IAAM,eAAe;AACrB,IAAM,aAAa;AAEnB,IAAM,qBAAqB,KAAK,QAAQ,GAAG,WAAW,WAAW,MAAM;AACvE,IAAM,sBAAsB;AAC5B,IAAM,sBAAsB,KAAK,oBAAoB,mBAAmB;AAExE,IAAqB,iBAArB,MAAqB,wBAAuB,YAAY;AAAA,EACtD,OAAgB,cACd;AAAA,EAEF,OAAgB,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EAEA,OAAgB,QAAQ;AAAA,IACtB,MAAM,MAAM,QAAQ;AAAA,MAClB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,OAAO,MAAM,QAAQ;AAAA,MACnB,MAAM;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,cAAc,MAAM,QAAQ;AAAA,MAC1B,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,YAAY,MAAM,QAAQ;AAAA,MACxB,SAAS;AAAA,MACT,aAAa;AAAA,IACf,CAAC;AAAA,IACD,eAAe,MAAM,QAAQ;AAAA,MAC3B,SAAS;AAAA,MACT,aACE;AAAA,IACJ,CAAC;AAAA,EACH;AAAA,EAEA,MAAM,MAAqB;AACzB,UAAM,EAAE,MAAM,IAAI,MAAM,KAAK,MAAM,eAAc;AACjD,UAAM,OAAO,MAAM;AACnB,UAAM,YAAY,MAAM,YAAY;AACpC,UAAM,UAAU,MAAM,UAAU;AAOhC,QAAI,MAAM,aAAa,GAAG;AACxB,YAAM,KAAK,cAAc,MAAM,KAAK;AACpC;AAAA,IACF;AAGA,QAAI,QAAQ,aAAa,UAAU;AACjC,WAAK;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAKA,QAAI,WAAW,UAAU,KAAK,CAAC,MAAM,OAAO;AAC1C,WAAK,IAAI,gCAAgC,UAAU,EAAE;AACrD,WAAK,IAAI,6DAA6D;AACtE;AAAA,IACF;AAIA,QAAI;AACF,YAAM,MAAM,MAAM,MAAM,oBAAoB,IAAI,SAAS;AACzD,UAAI,IAAI,MAAM,CAAC,MAAM,OAAO;AAC1B,aAAK,KAAK,QAAQ,IAAI,8EAA8E;AACpG,aAAK,KAAK,2EAA2E;AACrF;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAGA,UAAM,cAAc,KAAK,gBAAgB;AACzC,QAAI,CAAC,aAAa;AAChB,WAAK;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAGA,UAAM,WAAW,KAAK,aAAa,YAAY;AAC/C,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,WAAK,MAAM,2BAA2B,QAAQ,gDAAgD;AAAA,IAChG;AAGA,UAAM,UAAU,KAAK,yBAAyB,KAAK,YAAY,WAAW,CAAC;AAG3E,UAAM,WAAW,KAAK,WAAW,MAAM;AACvC,UAAM,WAAW,KAAK,WAAW,MAAM;AACvC,QAAI,CAAC,YAAY,CAAC,UAAU;AAC1B,WAAK,MAAM,4DAA4D;AAAA,IACzE;AAKA,QAAI,eAA8B;AAClC,QAAI,CAAC,SAAS;AACZ,qBAAe,KAAK,WAAW,UAAU;AACzC,UAAI,CAAC,cAAc;AACjB,aAAK;AAAA,UACH;AAAA,QAEF;AAAA,MACF;AAAA,IACF;AAMA,QAAI,CAAC,WAAW;AACd,WAAK,IAAI,gEAAgE;AACzE,YAAM,eAAe;AAAA,QACnB;AAAA,QAAY;AAAA,QACZ;AAAA,QAAY;AAAA,QACZ;AAAA,QAAY;AAAA,MACd;AACA,YAAM,QAAQ,UAAU,UAAW,CAAC,QAAQ,SAAS,OAAO,SAAS,GAAG,YAAY,GAAG;AAAA,QACrF,KAAK;AAAA,QACL,OAAO;AAAA,MACT,CAAC;AACD,UAAI,MAAM,WAAW,GAAG;AACtB,aAAK;AAAA,UACH,gCAAgC,MAAM,MAAM;AAAA,QAC9C;AAAA,MACF;AACA,WAAK,IAAI,qBAAqB;AAAA,IAChC,OAAO;AACL,WAAK,IAAI,gDAAgD;AAAA,IAC3D;AAIA,UAAM,WAAW,KAAK,aAAa,QAAQ,OAAO,QAAQ,UAAU;AACpE,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,WAAK,MAAM,0BAA0B,QAAQ,2EAA2E;AAAA,IAC1H;AACA,UAAM,WAAW,KAAK,aAAa,QAAQ,OAAO,QAAQ,YAAY;AACtE,QAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,WAAK,KAAK,2BAA2B,QAAQ,mBAAmB,IAAI,qCAAqC;AAAA,IAC3G;AACA,QAAI,CAAC,SAAS;AACZ,YAAM,eAAe,KAAK,aAAa,QAAQ,OAAO,QAAQ,OAAO,kBAAkB;AACvF,UAAI,CAAC,WAAW,YAAY,GAAG;AAC7B,aAAK,MAAM,8BAA8B,YAAY,wEAAwE;AAAA,MAC/H;AAAA,IACF;AAOA,QAAI,MAAM,OAAO;AACf,WAAK,iBAAiB,MAAM,MAAM,aAAa,IAAI;AAAA,IACrD;AACA,QAAI,CAAC,SAAS;AACZ,WAAK,iBAAiB,cAAc,KAAK,YAAY,aAAa,GAAG,SAAS;AAC9E,WAAK,iBAAiB,YAAY,KAAK,YAAY,WAAW,GAAG,WAAW;AAAA,IAC9E;AAGA,cAAU,KAAK,QAAQ,GAAG,WAAW,cAAc,GAAG,EAAE,WAAW,KAAK,CAAC;AACzE,cAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AAEtC,UAAM,MAAM,SAAS,SAAS,EAAE,UAAU,QAAQ,CAAC,EAAE,KAAK;AAG1D,UAAM,WAAW,KAAK,WAAW,EAAE,MAAM,aAAa,UAAqB,UAAqB,QAAQ,CAAC;AACzG,SAAK,gBAAgB,KAAK,YAAY,UAAU,KAAK;AACrD,SAAK,eAAe,KAAK,YAAY,KAAK;AAG1C,SAAK,IAAI,4BAA4B,IAAI,KAAK;AAC9C,UAAM,aAAa,MAAM,KAAK,WAAW,MAAM,EAAE;AACjD,QAAI,YAAY;AACd,WAAK,IAAI,mCAAmC,IAAI,EAAE;AAClD,UAAI,WAAW,QAAQ,GAAG;AACxB,aAAK,IAAI,gDAAgD,IAAI,EAAE;AAAA,MACjE;AAAA,IACF,OAAO;AACL,WAAK,KAAK,6CAA6C;AACvD,WAAK,IAAI,aAAa,OAAO,iBAAiB;AAC9C,WAAK,IAAI,aAAa,OAAO,iBAAiB;AAAA,IAChD;AAGA,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,8BAA8B;AAIvC,SAAK,gBAAgB;AACrB,UAAM,cAAc,KAAK,iBAAiB;AAAA,MACxC,QAAQ,KAAK,aAAa,QAAQ,OAAO,OAAO,QAAQ;AAAA,MACxD,SAAS,KAAK,aAAa,QAAQ,OAAO,MAAM;AAAA,MAChD,YAAY;AAAA,MACZ;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,SAAK,gBAAgB,KAAK,mBAAmB,aAAa,QAAQ;AAClE,SAAK,eAAe,KAAK,mBAAmB,QAAQ;AAGpD,QAAI,CAAC,SAAS;AACZ,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,gDAAgD;AAEzD,YAAM,eAAe,KAAK,kBAAkB,EAAE,aAAa,SAAoB,CAAC;AAChF,WAAK,gBAAgB,KAAK,oBAAoB,cAAc,SAAS;AACrE,WAAK,eAAe,KAAK,oBAAoB,SAAS;AAEtD,YAAM,aAAa,KAAK,gBAAgB;AAAA,QACtC;AAAA,QACA;AAAA,QACA;AAAA,MACF,CAAC;AACD,WAAK,gBAAgB,KAAK,kBAAkB,YAAY,OAAO;AAC/D,WAAK,eAAe,KAAK,kBAAkB,OAAO;AAAA,IACpD;AAQA,QAAI,WAAW,yBAAyB,GAAG;AACzC,UAAI;AACF,qBAAa,aAAa,CAAC,WAAW,OAAO,GAAG,IAAI,yBAAyB,GAAG,EAAE,UAAU,QAAQ,CAAC;AAAA,MACvG,QAAQ;AAAA,MAER;AACA,UAAI;AACF,qBAAa,MAAM,CAAC,MAAM,yBAAyB,CAAC;AACpD,aAAK,IAAI,gFAAgF;AAAA,MAC3F,QAAQ;AAAA,MAER;AAAA,IACF;AAEA,SAAK,IAAI,EAAE;AACX,QAAI,SAAS;AACX,WAAK,IAAI,8DAA8D;AAAA,IACzE,OAAO;AACL,WAAK,IAAI,oDAAoD;AAAA,IAC/D;AACA,SAAK,IAAI,qFAAqF;AAC9F,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,4DAA4D;AACrE,SAAK,IAAI,uEAAuE;AAChF,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,cAAc;AACvB,SAAK,IAAI,wDAAmD;AAC5D,SAAK,IAAI,2DAAsD;AAK/D,UAAM,mBAAmB;AAGzB,UAAM,OAAO,MAAM,WAAW;AAC9B,SAAK,IAAI,EAAE;AACX,QAAI,KAAK,WAAW;AAClB,WAAK,IAAI,kBAAkB,KAAK,UAAU,MAAM,KAAK,OAAO,MAAM,EAAE,2BAAsB;AAAA,IAC5F,OAAO;AACL,WAAK,IAAI,0GAAqG;AAAA,IAChH;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAUA,MAAc,cAAc,OAA+B;AACzD,UAAM,WAAW,QAAQ;AACzB,QAAI,aAAa,YAAY,aAAa,SAAS;AACjD,WAAK,MAAM,8EAA8E,QAAQ,IAAI;AAAA,IACvG;AAKA,UAAM,WAAW,KAAK,WAAW,MAAM;AACvC,QAAI,CAAC,UAAU;AACb,WAAK,MAAM,gCAAgC;AAAA,IAC7C;AACA,UAAM,SAAS,KAAK,KAAK,OAAO,MAAM,OAAO,QAAQ;AACrD,QAAI,CAAC,WAAW,MAAM,GAAG;AACvB,WAAK;AAAA,QACH,+CAA+C,MAAM;AAAA,MACvD;AAAA,IACF;AACA,UAAM,UAAU,KAAK,KAAK,OAAO,MAAM,MAAM;AAE7C,UAAM,UAAU,KAAK,oBAAoB;AACzC,QAAI,CAAC,QAAQ,sBAAsB,CAAC,QAAQ,yBAAyB;AACnE,WAAK;AAAA,QACH;AAAA,MACF;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,oBAAoB;AAC/B,cAAQ,qBAAqB;AAAA,IAC/B;AAEA,cAAU,SAAS,EAAE,WAAW,KAAK,CAAC;AAGtC,SAAK,gBAAgB;AAErB,QAAI,aAAa,UAAU;AACzB,UAAI,WAAW,iBAAiB,KAAK,CAAC,OAAO;AAC3C,aAAK,IAAI,+BAA+B,iBAAiB,GAAG;AAC5D,aAAK,IAAI,6DAA6D;AACtE;AAAA,MACF;AACA,gBAAU,KAAK,QAAQ,GAAG,WAAW,cAAc,GAAG,EAAE,WAAW,KAAK,CAAC;AACzE,YAAM,MAAM,SAAS,SAAS,EAAE,UAAU,QAAQ,CAAC,EAAE,KAAK;AAC1D,YAAM,QAAQ,KAAK,iBAAiB;AAAA,QAClC;AAAA,QACA;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB;AAAA,QACA,SAAS;AAAA,QACT;AAAA,MACF,CAAC;AACD,WAAK,gBAAgB,KAAK,mBAAmB,OAAO,QAAQ;AAC5D,WAAK,eAAe,KAAK,mBAAmB,QAAQ;AACpD,WAAK,IAAI,EAAE;AACX,WAAK,IAAI,sEAAsE;AAC/E,WAAK,IAAI,sBAAsB,KAAK,SAAS,mBAAmB,CAAC,EAAE;AAAA,IACrE,OAAO;AAEL,UAAI,WAAW,mBAAmB,KAAK,CAAC,OAAO;AAC7C,aAAK,IAAI,+BAA+B,mBAAmB,GAAG;AAC9D,aAAK,IAAI,yDAAyD,mBAAmB,EAAE;AACvF;AAAA,MACF;AACA,gBAAU,oBAAoB,EAAE,WAAW,KAAK,CAAC;AACjD,YAAM,OAAO,KAAK,uBAAuB,EAAE,QAAQ,UAAqB,QAAQ,CAAC;AACjF,oBAAc,qBAAqB,MAAM,EAAE,MAAM,IAAM,CAAC;AACxD,WAAK,IAAI,cAAc,mBAAmB,EAAE;AAC5C,UAAI;AACF,qBAAa,aAAa,CAAC,UAAU,eAAe,CAAC;AACrD,qBAAa,aAAa,CAAC,UAAU,UAAU,SAAS,mBAAmB,CAAC;AAC5E,aAAK,IAAI,mDAAmD;AAC5D,aAAK,IAAI,iEAAiE;AAC1E,aAAK,IAAI,mCAAmC,mBAAmB,KAAK;AAAA,MACtE,SAAS,KAAK;AACZ,aAAK;AAAA,UACH,mDAAmD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACrG;AACA,aAAK;AAAA,UACH,uFAAuF,mBAAmB;AAAA,QAC5G;AAAA,MACF;AAAA,IACF;AAEA,SAAK,IAAI,EAAE;AACX,SAAK,IAAI,cAAc;AACvB,SAAK,IAAI,wDAAmD;AAC5D,SAAK,IAAI,yDAAoD;AAG7D,UAAM,mBAAmB;AAAA,EAC3B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMQ,sBAA8C;AACpD,UAAM,OAA+B,CAAC;AACtC,UAAM,YAAY,KAAK,YAAY,KAAK;AACxC,QAAI,WAAW,SAAS,GAAG;AACzB,iBAAW,QAAQ,aAAa,WAAW,OAAO,EAAE,MAAM,IAAI,GAAG;AAC/D,cAAM,UAAU,KAAK,KAAK;AAC1B,YAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG;AACzC,cAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,YAAI,QAAQ,GAAG;AACb,eAAK,QAAQ,MAAM,GAAG,KAAK,CAAC,IAAI,QAAQ,MAAM,QAAQ,CAAC;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AACA,WAAO,OAAO,YAAY,OAAO,QAAQ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,iBAAiB,IAAI,CAAC,CAAC,CAAC;AAAA,EACzF;AAAA;AAAA,EAGQ,uBAAuB,MAIpB;AACT,UAAM,EAAE,QAAQ,UAAU,QAAQ,IAAI;AACtC,UAAM,MAA8B;AAAA,MAClC,GAAG;AAAA,MACH,UAAU;AAAA;AAAA,MAEV,aAAa,QAAQ,eAAe;AAAA,MACpC,iBAAiB,QAAQ,mBAAmB;AAAA,IAC9C;AAGA,UAAM,WAAW,OAAO,QAAQ,GAAG,EAChC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,gBAAgB,CAAC,IAAI,EAAE,QAAQ,OAAO,MAAM,EAAE,QAAQ,MAAM,KAAK,CAAC,GAAG,EACrF,KAAK,IAAI;AACZ,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAOC,QAAQ,IAAI,MAAM;AAAA;AAAA;AAAA,EAG5B,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,EAKR;AAAA,EAEQ,kBAAiC;AAEvC,QAAI,QAAQ,IAAI,yBAAyB;AACvC,aAAO,QAAQ,IAAI;AAAA,IACrB;AAEA,QAAI,MAAM,QAAQ,IAAI;AACtB,aAAS,IAAI,GAAG,IAAI,IAAI,KAAK;AAC3B,UAAI,WAAW,KAAK,KAAK,QAAQ,OAAO,cAAc,CAAC,GAAG;AACxD,eAAO;AAAA,MACT;AACA,YAAM,SAAS,KAAK,KAAK,IAAI;AAC7B,UAAI,WAAW,IAAK;AACpB,YAAM;AAAA,IACR;AACA,WAAO;AAAA,EACT;AAAA,EAEQ,WAAW,MAA6B;AAC9C,QAAI;AACF,aAAO,aAAa,SAAS,CAAC,IAAI,GAAG,EAAE,UAAU,SAAS,OAAO,CAAC,QAAQ,QAAQ,QAAQ,EAAE,CAAC,EAAE,KAAK,KAAK;AAAA,IAC3G,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAAA,EAEQ,YAAY,aAA6C;AAC/D,UAAM,OAA+B,CAAC;AAGtC,UAAM,WAAW,KAAK,aAAa,YAAY;AAC/C,QAAI,WAAW,QAAQ,GAAG;AACxB,iBAAW,QAAQ,aAAa,UAAU,OAAO,EAAE,MAAM,IAAI,GAAG;AAC9D,cAAM,UAAU,KAAK,KAAK;AAC1B,YAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG;AACzC,cAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,YAAI,QAAQ,GAAG;AACb,eAAK,QAAQ,MAAM,GAAG,KAAK,CAAC,IAAI,QAAQ,MAAM,QAAQ,CAAC;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAGA,UAAM,YAAY,KAAK,YAAY,KAAK;AACxC,QAAI,WAAW,SAAS,GAAG;AACzB,iBAAW,QAAQ,aAAa,WAAW,OAAO,EAAE,MAAM,IAAI,GAAG;AAC/D,cAAM,UAAU,KAAK,KAAK;AAC1B,YAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,EAAG;AACzC,cAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,YAAI,QAAQ,GAAG;AACb,eAAK,QAAQ,MAAM,GAAG,KAAK,CAAC,IAAI,QAAQ,MAAM,QAAQ,CAAC;AAAA,QACzD;AAAA,MACF;AAAA,IACF;AAGA,WAAO,OAAO;AAAA,MACZ,OAAO,QAAQ,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,MAAM,iBAAiB,IAAI,CAAC,CAAC;AAAA,IAC9D;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,yBAAyB,SAAyD;AACxF,UAAM,MAAM,QAAQ;AACpB,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,IAAI,SAAS,0BAA0B,GAAG;AAC5C,WAAK;AAAA,QACH;AAAA,MAGF;AACA,aAAO,EAAE,GAAG,SAAS,cAAc,IAAI,QAAQ,4BAA4B,0BAA0B,EAAE;AAAA,IACzG;AACA,QAAI,mCAAmC,KAAK,GAAG,GAAG;AAChD,WAAK;AAAA,QACH;AAAA,MAGF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBAAwB;AAC9B,QAAI;AACF,YAAM,MAAM,aAAa,SAAS,CAAC,MAAM,wBAAwB,GAAG;AAAA,QAClE,UAAU;AAAA,QAAS,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,MACvD,CAAC;AACD,YAAM,OAAO,IAAI,KAAK,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO,EAC/C,IAAI,CAAC,MAAM,SAAS,GAAG,EAAE,CAAC,EAC1B,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,MAAM,QAAQ,GAAG;AAC/C,iBAAW,OAAO,MAAM;AACtB,YAAI;AACF,kBAAQ,KAAK,KAAK,SAAS;AAC3B,eAAK,IAAI,uCAAuC,GAAG,GAAG;AAAA,QACxD,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI,KAAK,OAAQ,WAAU,SAAS,CAAC,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;AAAA,IAChE,QAAQ;AAAA,IAER;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASQ,iBAAiB,MAAc,SAAwB,MAAoB;AACjF,QAAI,YAAY;AAEhB,QAAI,WAAW,WAAW,OAAO,GAAG;AAClC,UAAI;AACF,cAAM,SAAS,aAAa,SAAS,OAAO,EAAE,KAAK;AACnD,cAAM,MAAM,SAAS,QAAQ,EAAE;AAC/B,YAAI,CAAC,MAAM,GAAG,GAAG;AACf,cAAI;AACF,oBAAQ,KAAK,KAAK,SAAS;AAC3B,wBAAY;AACZ,iBAAK,IAAI,yBAAyB,IAAI,SAAS,GAAG,SAAS,OAAO,GAAG;AAAA,UACvE,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AACA,UAAI;AAAE,qBAAa,MAAM,CAAC,MAAM,OAAO,CAAC;AAAA,MAAG,QAAQ;AAAA,MAAoB;AAAA,IACzE;AAIA,QAAI;AACF,YAAM,SAAS,aAAa,QAAQ,CAAC,OAAO,IAAI,IAAI,IAAI,cAAc,GAAG;AAAA,QACvE,UAAU;AAAA,QAAS,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,MACvD,CAAC;AACD,YAAM,OAAO,OAAO,KAAK,EAAE,MAAM,IAAI,EAAE,OAAO,OAAO;AACrD,iBAAW,UAAU,MAAM;AACzB,cAAM,MAAM,SAAS,QAAQ,EAAE;AAC/B,YAAI,CAAC,MAAM,GAAG,GAAG;AACf,cAAI;AACF,oBAAQ,KAAK,KAAK,SAAS;AAC3B,wBAAY;AACZ,iBAAK,IAAI,2BAA2B,IAAI,SAAS,GAAG,GAAG;AAAA,UACzD,QAAQ;AAAA,UAAqB;AAAA,QAC/B;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,QAAI,WAAW;AAEb,gBAAU,SAAS,CAAC,GAAG,GAAG,EAAE,OAAO,SAAS,CAAC;AAAA,IAC/C;AAAA,EACF;AAAA,EAEQ,gBAAgB,KAAa,WAAmB,SAAiB,MAAoB;AAM3F,UAAM,wBAAwB;AAAA,MAC5B;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AACA,QAAI;AACF,mBAAa,aAAa,CAAC,WAAW,OAAO,GAAG,IAAI,SAAS,GAAG;AAAA,QAC9D,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA,QAKV,OAAO,CAAC,UAAU,QAAQ,MAAM;AAAA,MAClC,CAAC;AACD,WAAK,IAAI,0BAA0B,IAAI,UAAU;AAAA,IACnD,SAAS,KAAK;AACZ,YAAM,MAAO,IAAc,WAAW;AACtC,YAAM,UAAW,IAAqC,UAAU,IAAI,SAAS;AAC7E,YAAM,WAAW,GAAG,GAAG;AAAA,EAAK,MAAM;AAClC,UAAI,CAAC,sBAAsB,KAAK,CAAC,MAAM,SAAS,SAAS,CAAC,CAAC,GAAG;AAC5D,aAAK,KAAK,6BAA6B,IAAI,aAAa,IAAI,KAAK,CAAC,EAAE;AAAA,MACtE;AAAA,IACF;AACA,kBAAc,WAAW,SAAS,EAAE,MAAM,IAAM,CAAC;AACjD,SAAK,IAAI,QAAQ,IAAI,qBAAqB,SAAS,EAAE;AAAA,EACvD;AAAA,EAEQ,eAAe,KAAa,WAAmB,MAAoB;AACzE,QAAI;AACF,mBAAa,aAAa,CAAC,aAAa,OAAO,GAAG,IAAI,SAAS,CAAC;AAChE,WAAK,IAAI,QAAQ,IAAI,8BAA8B;AAAA,IACrD,SAAS,cAAc;AACrB,UAAI;AACF,qBAAa,aAAa,CAAC,QAAQ,SAAS,CAAC;AAC7C,aAAK,IAAI,QAAQ,IAAI,uCAAuC;AAAA,MAC9D,SAAS,SAAS;AAChB,aAAK;AAAA,UACH,kBAAkB,IAAI;AAAA,eACL,aAAuB,QAAQ,KAAK,CAAC;AAAA,UAC1C,QAAkB,QAAQ,KAAK,CAAC;AAAA,QAC9C;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,WAAW,MAMR;AACT,UAAM,EAAE,MAAM,aAAa,UAAU,UAAU,QAAQ,IAAI;AAG3D,UAAM,WAAW,CAAC,GAAG,oBAAI,IAAI,CAAC,QAAQ,QAAQ,GAAG,QAAQ,QAAQ,GAAG,kBAAkB,YAAY,MAAM,CAAC,CAAC;AAM1G,UAAM,aAAa,OAAO,QAAQ;AAAA,MAChC,GAAG;AAAA,MACH,MAAM,OAAO,IAAI;AAAA,MACjB,UAAU;AAAA,MACV,MAAM,SAAS,KAAK,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAQvB,aAAa,QAAQ,eAAe;AAAA,MACpC,yBAAyB,QAAQ,2BAA2B;AAAA;AAAA;AAAA;AAAA;AAAA,MAK5D,iBAAiB,QAAQ,mBAAmB;AAAA;AAAA;AAAA;AAAA;AAAA,MAK5C,kBAAkB,QAAQ,oBAAoB;AAAA,IAChD,CAAC,EACE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,cAAc,UAAU,CAAC,CAAC;AAAA,gBAAyB,UAAU,CAAC,CAAC,WAAW,EAC1F,KAAK,IAAI;AAQZ,UAAM,WAAW,KAAK,aAAa,QAAQ,OAAO,QAAQ,UAAU;AACpE,UAAM,UAAU,KAAK,aAAa,QAAQ,OAAO,MAAM;AAEvD,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA,YAKC,WAAW;AAAA;AAAA;AAAA;AAAA,cAIT,UAAU,QAAQ,CAAC;AAAA,cACnB,UAAU,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA,YAIrB,UAAU,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA,EAIhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAiBE,UAAU,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA,YAIpB,UAAU,KAAK,SAAS,gBAAgB,CAAC,CAAC;AAAA;AAAA;AAAA,YAG1C,UAAU,KAAK,SAAS,gBAAgB,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOpD;AAAA,EAEQ,iBAAiB,MAQd;AACT,UAAM,EAAE,QAAQ,SAAS,YAAY,UAAU,UAAU,QAAQ,IAAI;AAGrE,UAAM,UAAU,KAAK,WAAW;AAEhC,UAAM,WAAW;AAAA,MACf,GAAG,IAAI;AAAA,QACL,CAAC,QAAQ,QAAQ,GAAG,WAAW,QAAQ,QAAQ,IAAI,MAAM,kBAAkB,YAAY,MAAM,EAAE;AAAA,UAC7F,CAAC,MAAmB,QAAQ,CAAC;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,UAAM,aAAa,OAAO,QAAQ;AAAA,MAChC,GAAG;AAAA,MACH,UAAU;AAAA,MACV,MAAM,SAAS,KAAK,GAAG;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAMvB,aAAa,QAAQ,eAAe;AAAA,MACpC,iBAAiB,QAAQ,mBAAmB;AAAA,IAC9C,CAAC,EACE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,cAAc,UAAU,CAAC,CAAC;AAAA,gBAAyB,UAAU,CAAC,CAAC,WAAW,EAC1F,KAAK,IAAI;AAYZ,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA,YAKC,kBAAkB;AAAA;AAAA;AAAA;AAAA,cAIhB,UAAU,QAAQ,CAAC;AAAA,cACnB,UAAU,MAAM,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAMnB,UAAU,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA,EAI/B,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,cAiBE,UAAU,OAAO,CAAC;AAAA;AAAA;AAAA;AAAA,YAIpB,UAAU,KAAK,SAAS,mBAAmB,CAAC,CAAC;AAAA;AAAA;AAAA,YAG7C,UAAU,KAAK,SAAS,mBAAmB,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOvD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQQ,kBAAkB,MAGf;AACT,UAAM,EAAE,aAAa,SAAS,IAAI;AAClC,UAAM,eAAe,KAAK,aAAa,QAAQ,OAAO,QAAQ,OAAO,kBAAkB;AACvF,UAAM,SAAS,KAAK,aAAa,QAAQ,OAAO,OAAO,QAAQ;AAE/D,UAAM,WAAW,CAAC,GAAG,oBAAI,IAAI,CAAC,QAAQ,QAAQ,GAAG,kBAAkB,YAAY,MAAM,CAAC,CAAC;AAMvF,UAAM,MAAM;AAAA,MACV,wBAAwB,KAAK,OAAO;AAAA,MACpC,sBAAsB;AAAA,MACtB,MAAM,SAAS,KAAK,GAAG;AAAA,IACzB;AAEA,UAAM,aAAa,OAAO,QAAQ,GAAG,EAClC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,cAAc,UAAU,CAAC,CAAC;AAAA,gBAAyB,UAAU,CAAC,CAAC,WAAW,EAC1F,KAAK,IAAI;AAEZ,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA,YAKC,mBAAmB;AAAA;AAAA;AAAA;AAAA,cAIjB,UAAU,QAAQ,CAAC;AAAA,cACnB,UAAU,YAAY,CAAC;AAAA;AAAA;AAAA;AAAA,YAIzB,UAAU,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA,EAIhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAgBA,UAAU,KAAK,SAAS,oBAAoB,CAAC,CAAC;AAAA;AAAA;AAAA,YAG9C,UAAU,KAAK,SAAS,oBAAoB,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOxD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,gBAAgB,MAIb;AACT,UAAM,EAAE,aAAa,cAAc,QAAQ,IAAI;AAC/C,UAAM,YAAY,KAAK,aAAa,YAAY,SAAS,SAAS,qBAAqB;AAEvF,UAAM,WAAW,CAAC,GAAG,oBAAI,IAAI,CAAC,QAAQ,YAAY,GAAG,kBAAkB,YAAY,MAAM,CAAC,CAAC;AAM3F,UAAM,MAAM;AAAA,MACV,GAAG;AAAA,MACH,yBAAyB;AAAA,MACzB,wBAAwB,KAAK,OAAO;AAAA,MACpC,MAAM,SAAS,KAAK,GAAG;AAAA,IACzB;AAEA,UAAM,aAAa,OAAO,QAAQ,GAAG,EAClC,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,cAAc,UAAU,CAAC,CAAC;AAAA,gBAAyB,UAAU,CAAC,CAAC,WAAW,EAC1F,KAAK,IAAI;AAEZ,WAAO;AAAA;AAAA;AAAA;AAAA;AAAA,YAKC,iBAAiB;AAAA;AAAA;AAAA;AAAA,cAIf,UAAU,YAAY,CAAC;AAAA;AAAA,cAEvB,UAAU;AAAA;AAAA,cAEV,UAAU,SAAS,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAMtB,UAAU,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA,EAIhC,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,YAgBA,UAAU,KAAK,SAAS,kBAAkB,CAAC,CAAC;AAAA;AAAA;AAAA,YAG5C,UAAU,KAAK,SAAS,kBAAkB,CAAC,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOtD;AAAA,EAEA,MAAc,WAAW,MAAc,aAAuC;AAC5E,QAAI,YAA2B;AAC/B,aAAS,IAAI,GAAG,IAAI,aAAa,KAAK;AACpC,UAAI;AACF,cAAM,MAAM,MAAM,MAAM,oBAAoB,IAAI,SAAS;AACzD,YAAI,IAAI,GAAI,QAAO;AACnB,oBAAY,yBAAyB,IAAI,MAAM;AAAA,MACjD,SAAS,KAAK;AACZ,oBAAa,IAAc;AAAA,MAC7B;AACA,YAAM,IAAI,QAAQ,OAAK,WAAW,GAAG,GAAI,CAAC;AAAA,IAC5C;AACA,QAAI,WAAW;AACb,WAAK,KAAK,4BAA4B,SAAS,EAAE;AAAA,IACnD;AACA,WAAO;AAAA,EACT;AACF;AAEA,SAAS,UAAU,GAAmB;AACpC,SAAO,EAAE,QAAQ,MAAM,OAAO,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,MAAM,EAAE,QAAQ,MAAM,QAAQ;AACpG;",
   "names": []
 }