@shield-agent/kya 0.24.2 → 0.26.0

package/dist/commands/hosted-hook.js

@@ -0,0 +1,610 @@
+/**
+ * Hosted-plane mode for `kya hook` (beta): `--plane-config <absolute path>`.
+ *
+ * The API key, base URL and agent id come ONLY from that one user-owned file.
+ * Env (KYA_OFFLINE, KYA_BASE_URL, KYA_API_KEY, SHIELD_API_KEY, KYA_AGENT_ID,
+ * KYA_HOME) and the repo's .kya/config.json are never read on this path, so
+ * neither can downgrade it. Every plane failure is a reason code, never an
+ * exception message (which could echo config bytes or the key).
+ */
+import { createHash } from "node:crypto";
+import { closeSync, constants, fstatSync, lstatSync, openSync, readSync, realpathSync, writeSync } from "node:fs";
+import { request as httpRequest } from "node:http";
+import { Agent as HttpsAgent, request as httpsRequest } from "node:https";
+import { isIP } from "node:net";
+import { dirname, isAbsolute, join, sep } from "node:path";
+import { applyPlaneAuth } from "../client.js";
+import { computeArgsHash } from "../hash.js";
+import { deriveWireChangeFields } from "../diff-preview.js";
+import { findSampleTool } from "../sample-tools.js";
+import { CLI_VERSION } from "../version.js";
+/** A plane failure. `message` is fixed text chosen here: never upstream or parser output. */
+export class PlaneError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+        this.name = "PlaneError";
+    }
+}
+/** Keys loaded in this process; the hosted output guard redacts them from stdout and stderr. */
+export const loadedSecrets = new Set();
+/** Every form of a loaded key the guard redacts: exact, URL-encoded and base64. */
+function secretForms() {
+    const out = new Set();
+    for (const k of loadedSecrets) {
+        out.add(k);
+        out.add(encodeURIComponent(k));
+        out.add(Buffer.from(k, "utf8").toString("base64"));
+    }
+    return [...out].filter((f) => f.length >= 8);
+}
+/**
+ * Best-effort output guard for hosted mode: the exact key (and its URL-encoded
+ * and base64 forms) is replaced by [redacted] in anything written to the
+ * stream, including a key split across two writes (a trailing partial match
+ * is held back until the next write or process exit). kya itself never
+ * prints the key; this covers anything else that might.
+ */
+export function guardStream(stream) {
+    const orig = stream.write.bind(stream);
+    let pending = "";
+    stream.write = (chunk, ...rest) => {
+        const forms = secretForms();
+        if (forms.length === 0 || (typeof chunk !== "string" && !Buffer.isBuffer(chunk))) {
+            return orig(chunk, ...rest);
+        }
+        let text = pending + (typeof chunk === "string" ? chunk : chunk.toString("utf8"));
+        for (const f of forms)
+            text = text.split(f).join("[redacted]");
+        // Hold back a tail that could be the start of a key completed by the next write.
+        let hold = 0;
+        for (const f of forms) {
+            for (let n = Math.min(f.length - 1, text.length); n > hold; n--) {
+                if (text.endsWith(f.slice(0, n))) {
+                    hold = n;
+                    break;
+                }
+            }
+        }
+        pending = hold ? text.slice(-hold) : "";
+        return orig(hold ? text.slice(0, -hold) : text, ...rest);
+    };
+    process.once("exit", () => {
+        // A held tail that never became a key is ordinary output: release it.
+        if (pending) {
+            try {
+                writeSync(stream.fd, pending);
+            }
+            catch { /* exiting */ }
+        }
+    });
+}
+/** What the hook knows before any plane code runs; the crash path never lowers it. */
+export const hostedDecision = { neverList: "unknown" };
+/**
+ * Crash decision. The local never-list (evaluated before any plane code) wins
+ * everywhere, shadow included; an unparsed payload is not provably harmless,
+ * so it also denies in shadow. Only a payload known to be off the never-list
+ * may exit 0, and only in shadow.
+ */
+export function crashDecision(shadow) {
+    if (hostedDecision.neverList === "deny") {
+        return { code: 2, reason: "KYA denied: NEVER_EVENT (internal error after the local never-list matched)" };
+    }
+    if (shadow && hostedDecision.neverList === "clear") {
+        return { code: 0, reason: "KYA shadow: internal error; allowed because --plane-shadow is set" };
+    }
+    return { code: 2, reason: "KYA hosted: internal error (FAIL_CLOSED); tool call denied (fails closed)" };
+}
+/**
+ * Hosted mode crash path: an uncaught exception or rejection must not become
+ * exit 1 (which a host without onFailure "block" treats as allow). Uses
+ * crashDecision (never the error text): stderr first, then the deny JSON.
+ */
+export function hostedCrashHandler(opts) {
+    return () => {
+        const d = crashDecision(opts.shadow);
+        try {
+            opts.err(`${d.reason}\n`);
+            if (d.code === 2) {
+                opts.out(`${JSON.stringify({ hookSpecificOutput: { hookEventName: "PreToolUse", permissionDecision: "deny", permissionDecisionReason: d.reason } })}\n`);
+            }
+        }
+        catch { /* still exit below */ }
+        finally {
+            opts.exit(d.code);
+        }
+    };
+}
+export const DEFAULT_PLANE_BUDGET_MS = 3000;
+/** Node start (~0.2 s) plus trail work must stay under the host's 5 s hook timeout. */
+export const MAX_PLANE_BUDGET_MS = 4000;
+const MIN_PLANE_BUDGET_MS = 100;
+const MAX_CONFIG_BYTES = 64 * 1024;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+/** Flag-only test mode admits exactly these literal hosts. */
+const LOOPBACK = new Set(["127.0.0.1", "[::1]"]);
+/** Clamp a --plane-budget-ms value; anything unparseable is the default. */
+export function planeBudgetMs(raw) {
+    const n = typeof raw === "string" ? Number.parseInt(raw, 10) : Number.NaN;
+    if (!Number.isFinite(n))
+        return DEFAULT_PLANE_BUDGET_MS;
+    return Math.min(MAX_PLANE_BUDGET_MS, Math.max(MIN_PLANE_BUDGET_MS, n));
+}
+/**
+ * NODE_OPTIONS tokens hosted mode accepts; anything else is refused (allowlist).
+ * Matched after unquoting and with underscores in the flag name read as dashes,
+ * the way node does.
+ */
+const SAFE_NODE_OPTION = /^--(max-old-space-size|max-semi-space-size|stack-trace-limit)=\d+$|^--(no-warnings|no-deprecation|enable-source-maps)$|^--disable-warning=[A-Za-z0-9-]+$/;
+/**
+ * Split NODE_OPTIONS for the allowlist check. Close to node's own rules
+ * (whitespace separates tokens, double quotes group, a backslash escapes the
+ * next character inside quotes) but stricter: undefined for anything it does
+ * not understand (an unterminated quote or a trailing escape), which refuses.
+ */
+export function parseNodeOptions(raw) {
+    const out = [];
+    let cur = "";
+    let has = false;
+    let quoted = false;
+    for (let i = 0; i < raw.length; i++) {
+        const c = raw[i];
+        if (quoted && c === "\\") {
+            if (i + 1 >= raw.length)
+                return undefined;
+            cur += raw[++i];
+        }
+        else if (c === '"') {
+            quoted = !quoted;
+            has = true;
+        }
+        else if (!quoted && /\s/.test(c)) {
+            if (has || cur)
+                out.push(cur);
+            cur = "";
+            has = false;
+        }
+        else {
+            cur += c;
+        }
+    }
+    if (quoted)
+        return undefined;
+    if (has || cur)
+        out.push(cur);
+    return out;
+}
+function safeNodeOption(token) {
+    const eq = token.indexOf("=");
+    const name = (eq === -1 ? token : token.slice(0, eq)).replace(/_/g, "-");
+    return SAFE_NODE_OPTION.test(eq === -1 ? name : name + token.slice(eq));
+}
+/** Read by node or OpenSSL at process start, so they cannot be undone at runtime: refuse. */
+const REFUSED_TLS_ENV = ["NODE_EXTRA_CA_CERTS", "SSL_CERT_FILE", "SSL_CERT_DIR", "NODE_TLS_REJECT_UNAUTHORIZED", "NODE_USE_ENV_PROXY", "NODE_PATH", "OPENSSL_CONF"];
+/** Proxy and TLS-override variables: deleted in hosted mode (the transport never uses a proxy anyway). */
+export const PROXY_ENV = ["HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "NO_PROXY", "http_proxy", "https_proxy", "all_proxy", "no_proxy", "NODE_USE_ENV_PROXY", "NODE_TLS_REJECT_UNAUTHORIZED"];
+/** Namespaces that steer node, libuv or OpenSSL; only the names below are allowed in hosted mode. */
+const CONTROLLED_ENV = /^(NODE_|SSL_|OPENSSL_|UV_|DYLD_|LD_)/i;
+const ALLOWED_CONTROLLED_ENV = new Set(["NODE_ENV", "NODE_OPTIONS", "NODE_NO_WARNINGS", "NODE_DISABLE_COLORS", "NODE_VERSION"]);
+/**
+ * Env that can load code into node, weaken TLS, add trust anchors, print
+ * request headers (NODE_DEBUG) or route the plane call through a proxy (N15
+ * lessons, reviews of #388). Positive allowlist: any NODE_*, SSL_*, OPENSSL_*
+ * or UV_* variable outside ALLOWED_CONTROLLED_ENV is refused, and NODE_OPTIONS
+ * must pass the token allowlist above. Returns the variable NAME only, never
+ * its value.
+ */
+export function hostedEnvProblem(env) {
+    for (const k of REFUSED_TLS_ENV) {
+        if (env[k] !== undefined && env[k] !== "")
+            return `${k} is set`;
+    }
+    for (const k of Object.keys(env).sort()) {
+        if (CONTROLLED_ENV.test(k) && !ALLOWED_CONTROLLED_ENV.has(k) && env[k] !== undefined && env[k] !== "") {
+            return `${k} is set`;
+        }
+    }
+    const tokens = parseNodeOptions(env.NODE_OPTIONS ?? "");
+    if (!tokens || !tokens.every(safeNodeOption)) {
+        return "NODE_OPTIONS has a flag outside the hosted-mode allowlist";
+    }
+    return undefined;
+}
+/** Hosted mode start: strip proxy and TLS-override variables before any network code. */
+export function scrubNetworkEnv(...envs) {
+    for (const e of envs)
+        for (const k of PROXY_ENV)
+            delete e[k];
+}
+function insideDir(child, dir) {
+    return child === dir || child.startsWith(dir.endsWith(sep) ? dir : dir + sep);
+}
+/** Nearest ancestor holding a .git entry (dir or worktree file); no git process spawned. */
+export function gitRoot(dir) {
+    for (let d = dir;; d = dirname(d)) {
+        try {
+            lstatSync(join(d, ".git"));
+            return d;
+        }
+        catch { /* keep walking */ }
+        if (dirname(d) === d)
+            return undefined;
+    }
+}
+function real(p) {
+    try {
+        return realpathSync(p);
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * Load and validate the plane config file. Refuses: relative paths, symlinks
+ * (O_NOFOLLOW + fstat on the opened fd, no check-then-read race), non-regular
+ * files, another owner, group/world bits, files inside the agent's working
+ * directory (unless that directory is the home dir itself), bad JSON, a
+ * non-https base URL (loopback http only with the explicit argv flag), URL
+ * credentials, and a non-UUID agent id. Throws PlaneError("PLANE_CONFIG").
+ */
+export function loadPlaneConfig(path, opts) {
+    const bad = (why) => {
+        throw new PlaneError("PLANE_CONFIG", `plane config ${why}`);
+    };
+    if (process.platform === "win32")
+        bad("is not supported on Windows in this beta (no POSIX owner and mode check)");
+    if (!path || !isAbsolute(path))
+        bad("path must be absolute");
+    // lstat first: a FIFO or device would block or misbehave on open.
+    let pre;
+    try {
+        pre = lstatSync(path);
+    }
+    catch {
+        return bad("cannot be opened");
+    }
+    if (pre.isSymbolicLink())
+        bad("must not be a symlink");
+    if (!pre.isFile())
+        bad("must be a regular file");
+    if (pre.size > MAX_CONFIG_BYTES)
+        bad("is too large");
+    let fd;
+    let text = "";
+    try {
+        try {
+            fd = openSync(path, constants.O_RDONLY | constants.O_NOFOLLOW | (constants.O_NONBLOCK ?? 0));
+        }
+        catch (e) {
+            const code = e.code;
+            bad(code === "ELOOP" ? "must not be a symlink" : "cannot be opened");
+        }
+        const st = fstatSync(fd);
+        if (!st.isFile() || st.ino !== pre.ino || st.dev !== pre.dev)
+            bad("must be a regular file");
+        // A hard link elsewhere (for example inside a repo) would dodge the location check.
+        if (st.nlink > 1)
+            bad("must not have other hard links");
+        if (process.getuid && st.uid !== process.getuid())
+            bad("must be owned by the current user");
+        if ((st.mode & 0o077) !== 0)
+            bad("must not be group or world accessible (chmod 600)");
+        if (st.size > MAX_CONFIG_BYTES)
+            bad("is too large");
+        const buf = Buffer.alloc(Math.min(st.size, MAX_CONFIG_BYTES));
+        const n = readSync(fd, buf, 0, buf.length, 0);
+        text = buf.subarray(0, n).toString("utf8");
+    }
+    finally {
+        if (fd !== undefined)
+            closeSync(fd);
+    }
+    const file = real(path) ?? path;
+    const home = real(opts.home) ?? opts.home;
+    for (const cwd of opts.cwds) {
+        const dir = cwd && real(cwd);
+        if (!dir)
+            continue;
+        for (const d of [dir, gitRoot(dir)]) {
+            if (d && d !== home && insideDir(file, d))
+                bad("must not live inside the project directory or its git work tree");
+        }
+    }
+    let raw;
+    try {
+        raw = JSON.parse(text);
+    }
+    catch {
+        // Never echo the parser message: newer V8 quotes the input, which holds the key.
+        bad("is not valid JSON");
+    }
+    if (!raw || typeof raw !== "object" || Array.isArray(raw))
+        bad("must be a JSON object");
+    const o = raw;
+    const apiKey = typeof o.apiKey === "string" ? o.apiKey.trim() : "";
+    // Printable ASCII only: anything else cannot be a header value (node throws) and is not a real key.
+    if (!/^[\x21-\x7e]{8,512}$/.test(apiKey))
+        bad("needs an apiKey of 8 to 512 printable ASCII characters");
+    const agentId = typeof o.agentId === "string" ? o.agentId.trim() : "";
+    if (!UUID_RE.test(agentId))
+        bad("needs agentId (the registered agent's UUID)");
+    const url = validatePlaneUrl(typeof o.baseUrl === "string" ? o.baseUrl.trim() : "", opts.allowHttpLoopback === true);
+    loadedSecrets.add(apiKey);
+    return { baseUrl: url.origin + url.pathname.replace(/\/+$/, ""), url, apiKey, agentId };
+}
+/**
+ * Strict base-URL check, one parse. https only; no userinfo, query or
+ * fragment; ASCII only (no punycode); the host as written must equal the
+ * parsed host (refuses 0x7f.1, 2130706433 and other non-canonical forms); no
+ * IP literal and no `localhost`. The argv-only loopback test mode admits
+ * exactly 127.0.0.1 and [::1], over http or https.
+ */
+export function validatePlaneUrl(raw, allowLoopback) {
+    const bad = (why) => {
+        throw new PlaneError("PLANE_CONFIG", `plane config baseUrl ${why}`);
+    };
+    if (!raw || /[^\x21-\x7e]/.test(raw))
+        bad("must be a non-empty ASCII URL");
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        return bad("is not a valid URL");
+    }
+    if (url.username || url.password || /^[a-z]+:\/\/[^/?#]*@/i.test(raw))
+        bad("must not carry credentials");
+    if (url.search || url.hash || /[?#]/.test(raw))
+        bad("must not carry a query or fragment");
+    if (/^[a-z]+:\/\/(\[[^\]]*\]|[^/:]+):0*(\/|$)/i.test(raw))
+        bad("must not use port 0");
+    const rawHost = /^[a-z]+:\/\/(\[[^\]]*\]|[^/:]+)/i.exec(raw)?.[1]?.toLowerCase().replace(/\.+$/, "");
+    if (url.hostname.endsWith("."))
+        url.hostname = url.hostname.replace(/\.+$/, "");
+    if (!rawHost || rawHost !== url.hostname)
+        bad("host must be written in canonical form");
+    if (url.hostname.split(".").some((l) => l.startsWith("xn--")))
+        bad("host must not be punycode");
+    const loopback = allowLoopback && LOOPBACK.has(url.hostname);
+    if (!loopback) {
+        if (url.protocol !== "https:")
+            bad("must be https");
+        if (/(^|\.)localhost$|^localhost\./.test(url.hostname))
+            bad("must not be localhost");
+        if (isIP(url.hostname.replace(/^\[|\]$/g, "")))
+            bad("must not be an IP address");
+    }
+    else if (url.protocol !== "https:" && url.protocol !== "http:") {
+        bad("must be https or loopback http");
+    }
+    return url;
+}
+/** Cap on the plane's answer: a verdict is a few hundred bytes. */
+export const MAX_RESPONSE_BYTES = 64 * 1024;
+/** Printable ASCII, at most 128 chars: plane text reaches the model and the trail. */
+export function cleanPlaneText(v) {
+    return typeof v === "string" ? v.replace(/[^\x20-\x7e]/g, "").slice(0, 128) : "";
+}
+/** Reason codes are short upper-case identifiers; anything else becomes PLANE_BAD_RESPONSE. */
+export function planeReasonCode(v) {
+    if (v === undefined || v === null || v === "")
+        return "";
+    return typeof v === "string" && /^[A-Z0-9_]{1,64}$/.test(v) ? v : "PLANE_BAD_RESPONSE";
+}
+/**
+ * The hosted-mode transport: node:https with its own agent (verify certs, no
+ * keep-alive, no proxy), SNI from the validated host, no redirect following.
+ * The global fetch is never used, so env proxy switches and undici defaults
+ * cannot reach this call. Plain http only for the argv-only loopback mode.
+ */
+export const httpsTransport = (url, init) => new Promise((resolve, reject) => {
+    const host = url.hostname.replace(/^\[|\]$/g, "");
+    const common = {
+        method: "POST",
+        host,
+        port: url.port ? Number(url.port) : undefined,
+        path: url.pathname,
+        headers: { ...init.headers, "Content-Length": String(Buffer.byteLength(init.body)) },
+        signal: init.signal,
+    };
+    const agent = new HttpsAgent({ rejectUnauthorized: true, keepAlive: false });
+    const done = () => agent.destroy();
+    let req;
+    try {
+        req = url.protocol === "https:"
+            ? httpsRequest({
+                ...common,
+                agent,
+                rejectUnauthorized: true,
+                ...(isIP(host) ? {} : { servername: host }),
+            })
+            : httpRequest({ ...common, agent: false });
+    }
+    catch (e) {
+        // A request that cannot even be built (bad header value, ...) is a plane failure, not a crash.
+        done();
+        reject(e);
+        return;
+    }
+    // Registered only once req exists: no temporal-dead-zone window.
+    init.signal.addEventListener("abort", () => { req.destroy(); done(); reject(init.signal.reason); }, { once: true });
+    req.on("response", (res) => {
+        const chunks = [];
+        let size = 0;
+        res.on("data", (c) => {
+            size += c.length;
+            if (size > MAX_RESPONSE_BYTES) {
+                // Stop reading at once; an endless or huge body is a plane failure, not a crash.
+                req.destroy();
+                done();
+                reject(new PlaneError("PLANE_UNREACHABLE", "hosted plane response is too large"));
+                return;
+            }
+            chunks.push(c);
+        });
+        res.on("error", (e) => { done(); reject(e); });
+        res.on("end", () => {
+            done();
+            const text = Buffer.concat(chunks).toString("utf8");
+            resolve({
+                status: res.statusCode ?? 0,
+                headers: { get: (n) => { const v = res.headers[n.toLowerCase()]; return Array.isArray(v) ? v[0] ?? null : v ?? null; } },
+                text: async () => text,
+            });
+        });
+    });
+    req.on("error", (e) => { done(); reject(e); });
+    req.end(init.body);
+});
+export const BACKOFF_BASE_MS = 200;
+export const BACKOFF_CAP_MS = 1600;
+/** Exponential backoff with equal jitter: attempt n waits in [d/2, d], d = min(cap, base * 2^n). */
+export function backoffMs(attempt, random) {
+    const d = Math.min(BACKOFF_CAP_MS, BACKOFF_BASE_MS * 2 ** attempt);
+    return Math.round(d / 2 + random() * (d / 2));
+}
+/** Retry-After as delta seconds or an HTTP date; undefined when absent or garbage. */
+export function retryAfterMs(header, now) {
+    if (!header)
+        return undefined;
+    const v = header.trim();
+    if (/^\d+$/.test(v))
+        return Number(v) * 1000;
+    const at = Date.parse(v);
+    return Number.isFinite(at) ? Math.max(0, at - now) : undefined;
+}
+/** sha256 over the same key shape as the hook's tool_use_id marker. */
+export function correlationId(sessionId, toolUseId) {
+    if (!toolUseId)
+        return undefined;
+    const key = sessionId ? JSON.stringify([sessionId, toolUseId]) : toolUseId;
+    return createHash("sha256").update(key).digest("hex");
+}
+const VERDICTS = new Set(["ALLOW", "DENY", "REQUIRE_APPROVE"]);
+/**
+ * The evaluate body: what connected mode sends (toolId, argsHash, sample risk
+ * fields, redacted change fields unless KYA_SEND_PREVIEWS=0), plus the hook
+ * fields the design adds: env.correlationId, mode, product, and
+ * requireRegisteredAgent so the hosted kill switch applies. Raw args never leave.
+ */
+export function hostedEvaluateBody(input) {
+    const sample = findSampleTool(input.toolName);
+    const change = deriveWireChangeFields(input.toolName, input.args, input.env);
+    return {
+        toolId: input.toolName,
+        action: input.toolName,
+        argsHash: computeArgsHash(input.args),
+        irreversible: sample?.irreversible ?? false,
+        actionClass: sample?.actionClass,
+        dataClass: sample?.dataClass,
+        sessionRisk: "LOW",
+        approvalStatus: "NONE",
+        packId: "generic",
+        ...(change ?? {}),
+        env: {
+            host: "ide",
+            agentId: input.config.agentId,
+            // No env.sessionId: kya_tool_event.session_id references kya_session, so an
+            // un-ingested host session id makes the plane drop the trail row (fail soft).
+            correlationId: correlationId(input.sessionId, input.toolUseId),
+        },
+        mode: input.strict ? "hold" : "observe",
+        product: input.product,
+        requireRegisteredAgent: true,
+    };
+}
+/**
+ * One deadline for the whole call. Retries 429, 5xx and network errors with
+ * exponential backoff plus jitter, honours Retry-After, and never sleeps past
+ * the deadline: if the next wait does not fit, it fails now with the code of
+ * the last failure. 401/403 and other 4xx are not retried. Each attempt is
+ * capped at half the budget, so a single stalled attempt is retried once.
+ */
+export async function evaluateHosted(input) {
+    const now = input.now ?? Date.now;
+    const sleep = input.sleep ?? ((ms) => new Promise((r) => setTimeout(r, ms)));
+    const random = input.random ?? Math.random;
+    const fetchImpl = input.fetch ?? httpsTransport;
+    const deadline = now() + input.budgetMs;
+    const body = JSON.stringify(hostedEvaluateBody(input));
+    const headers = {
+        Accept: "application/json",
+        "Content-Type": "application/json; charset=utf-8",
+        "User-Agent": `shield-agent-kya-cli/${CLI_VERSION}`,
+    };
+    applyPlaneAuth(headers, input.config.apiKey);
+    // Built from the same validated URL object, never from a second string.
+    const url = new URL(input.config.url);
+    url.pathname = `${input.config.url.pathname.replace(/\/+$/, "")}/api/v1/kya/policy/evaluate`;
+    let last = new PlaneError("PLANE_TIMEOUT", "hosted plane did not answer within the budget");
+    for (let attempt = 0;; attempt++) {
+        const remaining = deadline - now();
+        if (remaining <= 0)
+            return Promise.reject(last);
+        let wait;
+        try {
+            const res = await fetchImpl(url, {
+                headers,
+                body,
+                // Per-attempt cap: one stalled attempt must leave room for a retry (timeouts are transient too).
+                signal: AbortSignal.timeout(Math.min(remaining, Math.ceil(input.budgetMs / 2))),
+            });
+            if (res.status === 401 || res.status === 403) {
+                throw new PlaneError("PLANE_AUTH_REJECTED", `hosted plane rejected the API key (HTTP ${res.status})`);
+            }
+            if (res.status >= 300 && res.status < 400) {
+                // Never follow: the key header must not reach a second URL.
+                throw new PlaneError("PLANE_UNREACHABLE", `hosted plane answered with a redirect (HTTP ${res.status}); not followed`);
+            }
+            if (res.status >= 200 && res.status < 300) {
+                let parsed;
+                try {
+                    parsed = JSON.parse(await res.text());
+                }
+                catch { /* no verdict below */ }
+                const verdict = typeof parsed?.verdict === "string" ? parsed.verdict.toUpperCase() : "";
+                if (!parsed || !VERDICTS.has(verdict)) {
+                    throw new PlaneError("PLANE_UNREACHABLE", "hosted plane returned no verdict");
+                }
+                return {
+                    verdict,
+                    reasonCode: planeReasonCode(parsed.reasonCode),
+                    ...(typeof parsed.toolId === "string" ? { toolId: cleanPlaneText(parsed.toolId) } : {}),
+                    ...(typeof parsed.argsHash === "string" && /^[0-9a-f]{64}$/.test(parsed.argsHash) ? { argsHash: parsed.argsHash } : {}),
+                };
+            }
+            // Do not await: a stuck body must not eat the budget.
+            if (res.status === 429) {
+                last = new PlaneError("PLANE_RATE_LIMITED", "hosted plane rate limit reached (HTTP 429)");
+                const ra = retryAfterMs(res.headers.get("retry-after"), now());
+                // Floor: Retry-After 0 or a past date must not turn into a zero-wait retry loop.
+                wait = Math.max(ra ?? 0, backoffMs(attempt, random));
+                // Retry-After that does not fit the budget: fail now instead of sleeping.
+                if (ra !== undefined && ra >= deadline - now())
+                    return Promise.reject(last);
+            }
+            else if (res.status >= 500) {
+                last = new PlaneError("PLANE_UNREACHABLE", `hosted plane error (HTTP ${res.status})`);
+                wait = backoffMs(attempt, random);
+            }
+            else {
+                throw new PlaneError("PLANE_UNREACHABLE", `hosted plane refused the request (HTTP ${res.status})`);
+            }
+        }
+        catch (e) {
+            if (e instanceof PlaneError)
+                throw e;
+            last = e?.name === "TimeoutError" || e?.name === "AbortError" || deadline - now() <= 0
+                ? new PlaneError("PLANE_TIMEOUT", "hosted plane did not answer within the budget")
+                : new PlaneError("PLANE_UNREACHABLE", "hosted plane unreachable");
+            wait = backoffMs(attempt, random);
+        }
+        const left = deadline - now();
+        if (wait >= left)
+            return Promise.reject(last);
+        await sleep(wait);
+    }
+}
+//# sourceMappingURL=hosted-hook.js.map

package/dist/commands/hosted-hook.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"hosted-hook.js","sourceRoot":"","sources":["../../src/commands/hosted-hook.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE,SAAS,EAAE,MAAM,SAAS,CAAC;AAClH,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,KAAK,IAAI,UAAU,EAAE,OAAO,IAAI,YAAY,EAAE,MAAM,YAAY,CAAC;AAC1E,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC3D,OAAO,EAAE,cAAc,EAA+B,MAAM,cAAc,CAAC;AAC3E,OAAO,EAAE,eAAe,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAU5C,6FAA6F;AAC7F,MAAM,OAAO,UAAW,SAAQ,KAAK;IACd;IAArB,YAAqB,IAAe,EAAE,OAAe;QACnD,KAAK,CAAC,OAAO,CAAC,CAAC;QADI,SAAI,GAAJ,IAAI,CAAW;QAElC,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAC3B,CAAC;CACF;AAED,gGAAgG;AAChG,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AAE/C,mFAAmF;AACnF,SAAS,WAAW;IAClB,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;QAC9B,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACX,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/B,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IACrD,CAAC;IACD,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,MAA0B;IACpD,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAiC,CAAC;IACvE,IAAI,OAAO,GAAG,EAAE,CAAC;IAChB,MAA6D,CAAC,KAAK,GAAG,CAAC,KAAc,EAAE,GAAG,IAAe,EAAE,EAAE;QAC5G,MAAM,KAAK,GAAG,WAAW,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;YACjF,OAAO,IAAI,CAAC,KAAK,EAAE,GAAG,IAAI,CAAC,CAAC;QAC9B,CAAC;QACD,IAAI,IAAI,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC;QAClF,KAAK,MAAM,CAAC,IAAI,KAAK;YAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QAC/D,iFAAiF;QACjF,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;YACtB,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,GAAG,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC;gBAChE,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAAC,IAAI,GAAG,CAAC,CAAC;oBAAC,MAAM;gBAAC,CAAC;YACxD,CAAC;QACH,CAAC;QACD,OAAO,GAAG,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACxC,OAAO,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,CAAC;IAC3D,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,MAAM,EAAE,GAAG,EAAE;QACxB,sEAAsE;QACtE,IAAI,OAAO,EAAE,CAAC;YAAC,IAAI,CAAC;gBAAC,SAAS,CAAE,MAAoC,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;YAAC,CAAC;YAAC,MAAM,CAAC,CAAC,aAAa,CAAC,CAAC;QAAC,CAAC;IAChH,CAAC,CAAC,CAAC;AACL,CAAC;AAED,sFAAsF;AACtF,MAAM,CAAC,MAAM,cAAc,GAAgD,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC;AAEpG;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,MAAe;IAC3C,IAAI,cAAc,CAAC,SAAS,KAAK,MAAM,EAAE,CAAC;QACxC,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,6EAA6E,EAAE,CAAC;IAC5G,CAAC;IACD,IAAI,MAAM,IAAI,cAAc,CAAC,SAAS,KAAK,OAAO,EAAE,CAAC;QACnD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,mEAAmE,EAAE,CAAC;IAClG,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,2EAA2E,EAAE,CAAC;AAC1G,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,IAKlC;IACC,OAAO,GAAG,EAAE;QACV,MAAM,CAAC,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC;YACH,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC;YAC1B,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;gBACjB,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,EAAE,aAAa,EAAE,YAAY,EAAE,kBAAkB,EAAE,MAAM,EAAE,wBAAwB,EAAE,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3J,CAAC;QACH,CAAC;QAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;gBAAS,CAAC;YAC1C,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACpB,CAAC;IACH,CAAC,CAAC;AACJ,CAAC;AAWD,MAAM,CAAC,MAAM,uBAAuB,GAAG,IAAI,CAAC;AAC5C,uFAAuF;AACvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,IAAI,CAAC;AACxC,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAChC,MAAM,gBAAgB,GAAG,EAAE,GAAG,IAAI,CAAC;AACnC,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAClF,8DAA8D;AAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC,CAAC;AAEjD,4EAA4E;AAC5E,MAAM,UAAU,aAAa,CAAC,GAAiC;IAC7D,MAAM,CAAC,GAAG,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;IAC1E,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;QAAE,OAAO,uBAAuB,CAAC;IACxD,OAAO,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,IAAI,CAAC,GAAG,CAAC,mBAAmB,EAAE,CAAC,CAAC,CAAC,CAAC;AACzE,CAAC;AAED;;;;GAIG;AACH,MAAM,gBAAgB,GAAG,0JAA0J,CAAC;AAEpL;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW;IAC1C,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,CAAC,GAAG,GAAG,CAAC,CAAC,CAAE,CAAC;QAClB,IAAI,MAAM,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;YACzB,IAAI,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,MAAM;gBAAE,OAAO,SAAS,CAAC;YAC1C,GAAG,IAAI,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAClB,CAAC;aAAM,IAAI,CAAC,KAAK,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,CAAC,MAAM,CAAC;YACjB,GAAG,GAAG,IAAI,CAAC;QACb,CAAC;aAAM,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;YACnC,IAAI,GAAG,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAC9B,GAAG,GAAG,EAAE,CAAC;YACT,GAAG,GAAG,KAAK,CAAC;QACd,CAAC;aAAM,CAAC;YACN,GAAG,IAAI,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,IAAI,MAAM;QAAE,OAAO,SAAS,CAAC;IAC7B,IAAI,GAAG,IAAI,GAAG;QAAE,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,cAAc,CAAC,KAAa;IACnC,MAAM,EAAE,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC9B,MAAM,IAAI,GAAG,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACzE,OAAO,gBAAgB,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,6FAA6F;AAC7F,MAAM,eAAe,GAAG,CAAC,qBAAqB,EAAE,eAAe,EAAE,cAAc,EAAE,8BAA8B,EAAE,oBAAoB,EAAE,WAAW,EAAE,cAAc,CAAU,CAAC;AAE7K,0GAA0G;AAC1G,MAAM,CAAC,MAAM,SAAS,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,UAAU,EAAE,oBAAoB,EAAE,8BAA8B,CAAU,CAAC;AAErM,qGAAqG;AACrG,MAAM,cAAc,GAAG,uCAAuC,CAAC;AAC/D,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC,CAAC,UAAU,EAAE,cAAc,EAAE,kBAAkB,EAAE,qBAAqB,EAAE,cAAc,CAAC,CAAC,CAAC;AAEhI;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAsB;IACrD,KAAK,MAAM,CAAC,IAAI,eAAe,EAAE,CAAC;QAChC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE;YAAE,OAAO,GAAG,CAAC,SAAS,CAAC;IAClE,CAAC;IACD,KAAK,MAAM,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC;QACxC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,sBAAsB,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC;YACtG,OAAO,GAAG,CAAC,SAAS,CAAC;QACvB,CAAC;IACH,CAAC;IACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,GAAG,CAAC,YAAY,IAAI,EAAE,CAAC,CAAC;IACxD,IAAI,CAAC,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,cAAc,CAAC,EAAE,CAAC;QAC7C,OAAO,2DAA2D,CAAC;IACrE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,GAAG,IAAyB;IAC1D,KAAK,MAAM,CAAC,IAAI,IAAI;QAAE,KAAK,MAAM,CAAC,IAAI,SAAS;YAAE,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,SAAS,CAAC,KAAa,EAAE,GAAW;IAC3C,OAAO,KAAK,KAAK,GAAG,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;AAChF,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,OAAO,CAAC,GAAW;IACjC,KAAK,IAAI,CAAC,GAAG,GAAG,GAAI,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,SAAS,CAAC,IAAI,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;YAC3B,OAAO,CAAC,CAAC;QACX,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QAC9B,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;YAAE,OAAO,SAAS,CAAC;IACzC,CAAC;AACH,CAAC;AAED,SAAS,IAAI,CAAC,CAAS;IACrB,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAC7B,IAAY,EACZ,IAAuG;IAEvG,MAAM,GAAG,GAAG,CAAC,GAAW,EAAS,EAAE;QACjC,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,gBAAgB,GAAG,EAAE,CAAC,CAAC;IAC9D,CAAC,CAAC;IACF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO;QAAE,GAAG,CAAC,0EAA0E,CAAC,CAAC;IAClH,IAAI,CAAC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,GAAG,CAAC,uBAAuB,CAAC,CAAC;IAC7D,kEAAkE;IAClE,IAAI,GAAG,CAAC;IACR,IAAI,CAAC;QACH,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,kBAAkB,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,GAAG,CAAC,cAAc,EAAE;QAAE,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACvD,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE;QAAE,GAAG,CAAC,wBAAwB,CAAC,CAAC;IACjD,IAAI,GAAG,CAAC,IAAI,GAAG,gBAAgB;QAAE,GAAG,CAAC,cAAc,CAAC,CAAC;IACrD,IAAI,EAAsB,CAAC;IAC3B,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,IAAI,CAAC;YACH,EAAE,GAAG,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,QAAQ,GAAG,SAAS,CAAC,UAAU,GAAG,CAAC,SAAS,CAAC,UAAU,IAAI,CAAC,CAAC,CAAC,CAAC;QAC/F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;YAC/C,GAAG,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACvE,CAAC;QACD,MAAM,EAAE,GAAG,SAAS,CAAC,EAAG,CAAC,CAAC;QAC1B,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,KAAK,GAAG,CAAC,GAAG;YAAE,GAAG,CAAC,wBAAwB,CAAC,CAAC;QAC5F,oFAAoF;QACpF,IAAI,EAAE,CAAC,KAAK,GAAG,CAAC;YAAE,GAAG,CAAC,gCAAgC,CAAC,CAAC;QACxD,IAAI,OAAO,CAAC,MAAM,IAAI,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,EAAE;YAAE,GAAG,CAAC,mCAAmC,CAAC,CAAC;QAC5F,IAAI,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,KAAK,CAAC;YAAE,GAAG,CAAC,mDAAmD,CAAC,CAAC;QACtF,IAAI,EAAE,CAAC,IAAI,GAAG,gBAAgB;YAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QACpD,MAAM,GAAG,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;QAC9D,MAAM,CAAC,GAAG,QAAQ,CAAC,EAAG,EAAE,GAAG,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC;QAC/C,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,IAAI,EAAE,KAAK,SAAS;YAAE,SAAS,CAAC,EAAE,CAAC,CAAC;IACtC,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC;IAChC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC;IAC1C,KAAK,MAAM,GAAG,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7B,IAAI,CAAC,GAAG;YAAE,SAAS;QACnB,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;YACpC,IAAI,CAAC,IAAI,CAAC,KAAK,IAAI,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,CAAC;gBAAE,GAAG,CAAC,iEAAiE,CAAC,CAAC;QACpH,CAAC;IACH,CAAC;IACD,IAAI,GAAY,CAAC;IACjB,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,iFAAiF;QACjF,GAAG,CAAC,mBAAmB,CAAC,CAAC;IAC3B,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,uBAAuB,CAAC,CAAC;IACxF,MAAM,CAAC,GAAG,GAA8B,CAAC;IACzC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACnE,oGAAoG;IACpG,IAAI,CAAC,sBAAsB,CAAC,IAAI,CAAC,MAAM,CAAC;QAAE,GAAG,CAAC,wDAAwD,CAAC,CAAC;IACxG,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtE,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC;QAAE,GAAG,CAAC,6CAA6C,CAAC,CAAC;IAC/E,MAAM,GAAG,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,CAAC,iBAAiB,KAAK,IAAI,CAAC,CAAC;IACrH,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1B,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,aAAsB;IAClE,MAAM,GAAG,GAAG,CAAC,GAAW,EAAS,EAAE;QACjC,MAAM,IAAI,UAAU,CAAC,cAAc,EAAE,wBAAwB,GAAG,EAAE,CAAC,CAAC;IACtE,CAAC,CAAC;IACF,IAAI,CAAC,GAAG,IAAI,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,+BAA+B,CAAC,CAAC;IAC3E,IAAI,GAAQ,CAAC;IACb,IAAI,CAAC;QACH,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACrB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,oBAAoB,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,QAAQ,IAAI,uBAAuB,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,4BAA4B,CAAC,CAAC;IACzG,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,oCAAoC,CAAC,CAAC;IAC1F,IAAI,2CAA2C,CAAC,IAAI,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,qBAAqB,CAAC,CAAC;IACtF,MAAM,OAAO,GAAG,kCAAkC,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACrG,IAAI,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,GAAG,CAAC,QAAQ,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,GAAG,CAAC,QAAQ;QAAE,GAAG,CAAC,wCAAwC,CAAC,CAAC;IACxF,IAAI,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAE,GAAG,CAAC,2BAA2B,CAAC,CAAC;IAChG,MAAM,QAAQ,GAAG,aAAa,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAAE,GAAG,CAAC,eAAe,CAAC,CAAC;QACpD,IAAI,+BAA+B,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC;YAAE,GAAG,CAAC,uBAAuB,CAAC,CAAC;QACrF,IAAI,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;YAAE,GAAG,CAAC,2BAA2B,CAAC,CAAC;IACnF,CAAC;SAAM,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,IAAI,GAAG,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjE,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACxC,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,mEAAmE;AACnE,MAAM,CAAC,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AAE5C,sFAAsF;AACtF,MAAM,UAAU,cAAc,CAAC,CAAU;IACvC,OAAO,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,eAAe,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;AACnF,CAAC;AAED,+FAA+F;AAC/F,MAAM,UAAU,eAAe,CAAC,CAAU;IACxC,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,EAAE;QAAE,OAAO,EAAE,CAAC;IACzD,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC;AACzF,CAAC;AAcD;;;;;GAKG;AACH,MAAM,CAAC,MAAM,cAAc,GAAmB,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAC1D,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;IAC9B,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAClD,MAAM,MAAM,GAAG;QACb,MAAM,EAAE,MAAM;QACd,IAAI;QACJ,IAAI,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7C,IAAI,EAAE,GAAG,CAAC,QAAQ;QAClB,OAAO,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,EAAE,gBAAgB,EAAE,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE;QACpF,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;IACF,MAAM,KAAK,GAAG,IAAI,UAAU,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;IAC7E,MAAM,IAAI,GAAG,GAAG,EAAE,CAAC,KAAK,CAAC,OAAO,EAAE,CAAC;IACnC,IAAI,GAAoC,CAAC;IACzC,IAAI,CAAC;QACH,GAAG,GAAG,GAAG,CAAC,QAAQ,KAAK,QAAQ;YAC7B,CAAC,CAAC,YAAY,CAAC;gBACX,GAAG,MAAM;gBACT,KAAK;gBACL,kBAAkB,EAAE,IAAI;gBACxB,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;aAC5C,CAAC;YACJ,CAAC,CAAC,WAAW,CAAC,EAAE,GAAG,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IAC/C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,+FAA+F;QAC/F,IAAI,EAAE,CAAC;QACP,MAAM,CAAC,CAAC,CAAC,CAAC;QACV,OAAO;IACT,CAAC;IACD,iEAAiE;IACjE,IAAI,CAAC,MAAM,CAAC,gBAAgB,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IACpH,GAAG,CAAC,EAAE,CAAC,UAAU,EAAE,CAAC,GAAG,EAAE,EAAE;QACzB,MAAM,MAAM,GAAa,EAAE,CAAC;QAC5B,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,GAAG,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAS,EAAE,EAAE;YAC3B,IAAI,IAAI,CAAC,CAAC,MAAM,CAAC;YACjB,IAAI,IAAI,GAAG,kBAAkB,EAAE,CAAC;gBAC9B,iFAAiF;gBACjF,GAAG,CAAC,OAAO,EAAE,CAAC;gBACd,IAAI,EAAE,CAAC;gBACP,MAAM,CAAC,IAAI,UAAU,CAAC,mBAAmB,EAAE,oCAAoC,CAAC,CAAC,CAAC;gBAClF,OAAO;YACT,CAAC;YACD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACjB,CAAC,CAAC,CAAC;QACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC/C,GAAG,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE;YACjB,IAAI,EAAE,CAAC;YACP,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YACpD,OAAO,CAAC;gBACN,MAAM,EAAE,GAAG,CAAC,UAAU,IAAI,CAAC;gBAC3B,OAAO,EAAE,EAAE,GAAG,EAAE,CAAC,CAAS,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE;gBAChI,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC,IAAI;aACvB,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IACH,GAAG,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACrB,CAAC,CAAC,CAAC;AAmBL,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,CAAC,MAAM,cAAc,GAAG,IAAI,CAAC;AAEnC,oGAAoG;AACpG,MAAM,UAAU,SAAS,CAAC,OAAe,EAAE,MAAoB;IAC7D,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,cAAc,EAAE,eAAe,GAAG,CAAC,IAAI,OAAO,CAAC,CAAC;IACnE,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,GAAG,MAAM,EAAE,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,YAAY,CAAC,MAAqB,EAAE,GAAW;IAC7D,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC;IAC7C,MAAM,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;AACjE,CAAC;AAED,uEAAuE;AACvE,MAAM,UAAU,aAAa,CAAC,SAA6B,EAAE,SAA6B;IACxF,IAAI,CAAC,SAAS;QAAE,OAAO,SAAS,CAAC;IACjC,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IAC3E,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AACxD,CAAC;AAED,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,iBAAiB,CAAC,CAAC,CAAC;AAE/D;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAA0B;IAC3D,MAAM,MAAM,GAAG,cAAc,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IAC9C,MAAM,MAAM,GAAG,sBAAsB,CAAC,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC,CAAC;IAC7E,OAAO;QACL,MAAM,EAAE,KAAK,CAAC,QAAQ;QACtB,MAAM,EAAE,KAAK,CAAC,QAAQ;QACtB,QAAQ,EAAE,eAAe,CAAC,KAAK,CAAC,IAAI,CAAC;QACrC,YAAY,EAAE,MAAM,EAAE,YAAY,IAAI,KAAK;QAC3C,WAAW,EAAE,MAAM,EAAE,WAAW;QAChC,SAAS,EAAE,MAAM,EAAE,SAAS;QAC5B,WAAW,EAAE,KAAK;QAClB,cAAc,EAAE,MAAM;QACtB,MAAM,EAAE,SAAS;QACjB,GAAG,CAAC,MAAM,IAAI,EAAE,CAAC;QACjB,GAAG,EAAE;YACH,IAAI,EAAE,KAAK;YACX,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO;YAC7B,4EAA4E;YAC5E,8EAA8E;YAC9E,aAAa,EAAE,aAAa,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;SAC/D;QACD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS;QACvC,OAAO,EAAE,KAAK,CAAC,OAAO;QACtB,sBAAsB,EAAE,IAAI;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,KAA0B;IAC7D,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;IAClC,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,CAAC,CAAC,EAAU,EAAE,EAAE,CAAC,IAAI,OAAO,CAAO,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3F,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,IAAI,IAAI,CAAC,MAAM,CAAC;IAC3C,MAAM,SAAS,GAAG,KAAK,CAAC,KAAK,IAAI,cAAc,CAAC;IAChD,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;IACxC,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,KAAK,CAAC,CAAC,CAAC;IACvD,MAAM,OAAO,GAA2B;QACtC,MAAM,EAAE,kBAAkB;QAC1B,cAAc,EAAE,iCAAiC;QACjD,YAAY,EAAE,wBAAwB,WAAW,EAAE;KACpD,CAAC;IACF,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,wEAAwE;IACxE,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IACtC,GAAG,CAAC,QAAQ,GAAG,GAAG,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,6BAA6B,CAAC;IAE7F,IAAI,IAAI,GAAe,IAAI,UAAU,CAAC,eAAe,EAAE,+CAA+C,CAAC,CAAC;IACxG,KAAK,IAAI,OAAO,GAAG,CAAC,GAAI,OAAO,EAAE,EAAE,CAAC;QAClC,MAAM,SAAS,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;QACnC,IAAI,SAAS,IAAI,CAAC;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAChD,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE;gBAC/B,OAAO;gBACP,IAAI;gBACJ,iGAAiG;gBACjG,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,CAAC;aAChF,CAAC,CAAC;YACH,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,MAAM,IAAI,UAAU,CAAC,qBAAqB,EAAE,2CAA2C,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YACxG,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1C,4DAA4D;gBAC5D,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,+CAA+C,GAAG,CAAC,MAAM,iBAAiB,CAAC,CAAC;YACxH,CAAC;YACD,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;gBAC1C,IAAI,MAA0C,CAAC;gBAC/C,IAAI,CAAC;oBACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAA2B,CAAC;gBAClE,CAAC;gBAAC,MAAM,CAAC,CAAC,sBAAsB,CAAC,CAAC;gBAClC,MAAM,OAAO,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACxF,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACtC,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,kCAAkC,CAAC,CAAC;gBAChF,CAAC;gBACD,OAAO;oBACL,OAAO;oBACP,UAAU,EAAE,eAAe,CAAC,MAAM,CAAC,UAAU,CAAC;oBAC9C,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,cAAc,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACvF,GAAG,CAAC,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACxH,CAAC;YACJ,CAAC;YACD,sDAAsD;YACtD,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBACvB,IAAI,GAAG,IAAI,UAAU,CAAC,oBAAoB,EAAE,4CAA4C,CAAC,CAAC;gBAC1F,MAAM,EAAE,GAAG,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;gBAC/D,iFAAiF;gBACjF,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC;gBACrD,0EAA0E;gBAC1E,IAAI,EAAE,KAAK,SAAS,IAAI,EAAE,IAAI,QAAQ,GAAG,GAAG,EAAE;oBAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;YAC9E,CAAC;iBAAM,IAAI,GAAG,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;gBAC7B,IAAI,GAAG,IAAI,UAAU,CAAC,mBAAmB,EAAE,4BAA4B,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;gBACtF,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,IAAI,UAAU,CAAC,mBAAmB,EAAE,0CAA0C,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC;YACrG,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,UAAU;gBAAE,MAAM,CAAC,CAAC;YACrC,IAAI,GAAI,CAAW,EAAE,IAAI,KAAK,cAAc,IAAK,CAAW,EAAE,IAAI,KAAK,YAAY,IAAI,QAAQ,GAAG,GAAG,EAAE,IAAI,CAAC;gBAC1G,CAAC,CAAC,IAAI,UAAU,CAAC,eAAe,EAAE,+CAA+C,CAAC;gBAClF,CAAC,CAAC,IAAI,UAAU,CAAC,mBAAmB,EAAE,0BAA0B,CAAC,CAAC;YACpE,IAAI,GAAG,SAAS,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QACpC,CAAC;QACD,MAAM,IAAI,GAAG,QAAQ,GAAG,GAAG,EAAE,CAAC;QAC9B,IAAI,IAAI,IAAI,IAAI;YAAE,OAAO,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QAC9C,MAAM,KAAK,CAAC,IAAI,CAAC,CAAC;IACpB,CAAC;AACH,CAAC"}

package/dist/commands/import-traces.js

@@ -1,6 +1,6 @@
 import { flagString } from "../parse-args.js";
 import { defaultAgtAuditPath, importTraces, renderImportSummary, } from "../importers/index.js";
-const SOURCES = ["langsmith", "langfuse", "phoenix", "otel", "agt"];
+const SOURCES = ["langsmith", "langfuse", "phoenix", "otel", "agt", "adr-sensor"];
 export function importOptionsFromArgs(parsed) {
     const rawFrom = flagString(parsed.flags, "from")?.toLowerCase();
     const from = SOURCES.find((s) => s === rawFrom);
@@ -10,7 +10,7 @@ export async function runImport(opts, io, cwd, env) {
     // agt reads AGT's own audit log, so --file is optional there.
     const file = opts.file ?? (opts.from === "agt" ? defaultAgtAuditPath(env) : undefined);
     if (!opts.from || !file) {
-        io.error("Usage: kya import --from <langsmith|langfuse|phoenix|otel|agt> <file> | --file <path>");
+        io.error("Usage: kya import --from <langsmith|langfuse|phoenix|otel|agt|adr-sensor> <file> | --file <path>");
         return 2;
     }
     const result = await importTraces({ from: opts.from, file, cwd, env });