@vibgrate/cli 2026.819.3 → 2026.824.3

package/dist/chunk-III7S75O.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/engine/snapshot.ts","../src/engine/report.ts","../src/engine/html.ts","../src/engine/relevance-provider.ts","../src/engine/artifacts.ts","../src/engine/relevance-enrich.ts"],"names":["crc32","fs","path","fs2","legacy","MAGIC","zlib2","newPackr","Packr","fs4","path3","cached","tags"],"mappings":";;;;;;;;;;;AAsCA,IAAM,KAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,QAAQ,CAAA;AAG/C,IAAMA,SAA2C,IAAA,CAAA,KAAA,IAAS,OAAA;AAE1D,IAAI,QAAA,GAA+B,IAAA;AAEnC,SAAS,QAAQ,IAAA,EAA0B;AACzC,EAAA,IAAI,CAAC,QAAA,EAAU;AACb,IAAA,QAAA,GAAW,IAAI,YAAY,GAAG,CAAA;AAC9B,IAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,GAAA,EAAK,CAAA,EAAA,EAAK;AAC5B,MAAA,IAAI,CAAA,GAAI,CAAA;AACR,MAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,CAAA,EAAG,CAAA,EAAA,EAAK,CAAA,GAAI,CAAA,GAAI,CAAA,GAAI,UAAA,GAAc,CAAA,KAAM,CAAA,GAAK,CAAA,KAAM,CAAA;AACvE,MAAA,QAAA,CAAS,CAAC,IAAI,CAAA,KAAM,CAAA;AAAA,IACtB;AAAA,EACF;AACA,EAAA,IAAI,GAAA,GAAM,UAAA;AACV,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK,GAAA,GAAM,QAAA,CAAA,CAAU,GAAA,GAAM,IAAA,CAAK,CAAC,CAAA,IAAK,GAAI,IAAK,GAAA,KAAQ,CAAA;AACxF,EAAA,OAAA,CAAQ,MAAM,UAAA,MAAgB,CAAA;AAChC;AAgBO,SAAS,gBAAgB,SAAA,EAA2B;AACzD,EAAA,OAAO,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA,GAAI,CAAA,EAAG,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,KAAA,CAAA,GAAU,CAAA,EAAG,SAAS,CAAA,KAAA,CAAA;AACtF;AAEA,SAAS,QAAA,GAAkB;AACzB,EAAA,OAAO,IAAI,KAAA,CAAM,EAAE,UAAA,EAAY,MAAM,CAAA;AACvC;AAGO,SAAS,mBAAmB,KAAA,EAAwB;AACzD,EAAA,OAAO,OAAO,IAAA,CAAK,QAAA,EAAS,CAAE,IAAA,CAAK,KAAK,CAAC,CAAA;AAC3C;AAWO,SAAS,kBAAA,CACd,SAAA,EACA,KAAA,EACA,IAAA,GAAiC,EAAC,EACzB;AACT,EAAA,IAAI;AACF,IAAA,MAAM,OAAA,GAAU,mBAAmB,KAAK,CAAA;AACxC,IAAA,IAAI,MAAA;AACJ,IAAA,IAAI,KAAK,UAAA,EAAY;AACnB,MAAA,MAAA,GAAS,QAAA,GAAW,IAAA,CAAK;AAAA,QACvB,MAAA,EAAQ,OAAA;AAAA,QACR,KAAA,EAAOA,OAAM,OAAO,CAAA;AAAA,QACpB,UAAA,EAAY;AAAA,OACY,CAAA;AAAA,IAC5B,CAAA,MAAO;AACL,MAAA,MAAM,IAAA,GAAUC,aAAS,SAAS,CAAA;AAClC,MAAA,MAAA,GAAS,QAAA,GAAW,IAAA,CAAK;AAAA,QACvB,MAAA,EAAQ,OAAA;AAAA,QACR,YAAY,IAAA,CAAK,IAAA;AAAA,QACjB,eAAe,IAAA,CAAK,OAAA;AAAA,QACpB,KAAA,EAAOD,OAAM,OAAO;AAAA,OACI,CAAA;AAAA,IAC5B;AACA,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC7B,IAAA,MAAA,CAAO,aAAA,CAAc,MAAA,CAAO,MAAA,EAAQ,CAAC,CAAA;AACrC,IAAA,MAAM,IAAA,GAAO,gBAAgB,SAAS,CAAA;AACtC,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,QAAQ,GAAG,CAAA,IAAA,CAAA;AAClC,IAAA,IAAI;AACF,MAAGC,GAAA,CAAA,aAAA,CAAc,GAAA,EAAK,MAAA,CAAO,MAAA,CAAO,CAAC,OAAO,MAAA,EAAQ,MAAA,EAAQ,OAAO,CAAC,CAAC,CAAA;AACrE,MAAGA,GAAA,CAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,IACzB,SAAS,GAAA,EAAK;AACZ,MAAGA,GAAA,CAAA,MAAA,CAAO,GAAA,EAAK,EAAE,KAAA,EAAO,MAAM,CAAA;AAC9B,MAAA,MAAM,GAAA;AAAA,IACR;AACA,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAaO,SAAS,kBAAkB,SAAA,EAAmC;AACnE,EAAA,IAAI;AACF,IAAA,MAAM,IAAA,GAAO,gBAAgB,SAAS,CAAA;AACtC,IAAA,IAAI,CAAIA,GAAA,CAAA,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,IAAA;AACjC,IAAA,MAAM,GAAA,GAASA,iBAAa,IAAI,CAAA;AAChC,IAAA,IAAI,GAAA,CAAI,MAAA,GAAS,KAAA,CAAM,MAAA,GAAS,KAAK,CAAC,GAAA,CAAI,QAAA,CAAS,CAAA,EAAG,MAAM,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,GAAG,OAAO,IAAA;AAC1F,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,YAAA,CAAa,KAAA,CAAM,MAAM,CAAA;AAC/C,IAAA,MAAM,YAAA,GAAe,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,SAAA;AACxC,IAAA,IAAI,YAAA,GAAe,GAAA,CAAI,MAAA,EAAQ,OAAO,IAAA;AACtC,IAAA,MAAM,MAAA,GAAS,QAAA,EAAS,CAAE,MAAA,CAAO,GAAA,CAAI,SAAS,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,YAAY,CAAC,CAAA;AAC7E,IAAA,IAAI,CAAC,OAAO,UAAA,EAAY;AACtB,MAAA,IAAI,MAAA,CAAO,MAAA,KAAW,OAAA,EAAS,OAAO,IAAA;AACtC,MAAA,MAAM,UAAA,GAAgBA,aAAS,SAAS,CAAA;AACxC,MAAA,IAAI,MAAA,CAAO,eAAe,UAAA,CAAW,IAAA,IAAQ,OAAO,aAAA,KAAkB,UAAA,CAAW,SAAS,OAAO,IAAA;AAAA,IACnG;AACA,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,QAAA,CAAS,YAAY,CAAA;AACzC,IAAA,IAAID,MAAAA,CAAM,OAAO,CAAA,KAAM,MAAA,CAAO,OAAO,OAAO,IAAA;AAC5C,IAAA,MAAM,KAAA,GAAQ,QAAA,EAAS,CAAE,MAAA,CAAO,OAAO,CAAA;AACvC,IAAA,IAAI,CAAC,KAAA,IAAS,CAAC,KAAA,CAAM,QAAQ,KAAA,CAAM,KAAK,CAAA,IAAK,CAAC,KAAA,CAAM,OAAA,CAAQ,KAAA,CAAM,KAAK,GAAG,OAAO,IAAA;AACjF,IAAA,OAAO,KAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAOO,SAAS,cAAc,SAAA,EAA4B;AACxD,EAAA,IAAOC,GAAA,CAAA,UAAA,CAAW,SAAS,CAAA,EAAG,OAAO,IAAA;AACrC,EAAA,OAAO,kBAAA,CAAmB,eAAA,CAAgB,SAAS,CAAC,GAAG,UAAA,KAAe,IAAA;AACxE;AAOO,SAAS,YAAY,SAAA,EAA6B;AACvD,EAAA,IAAI;AACF,IAAA,OAAUA,aAAS,SAAS,CAAA;AAAA,EAC9B,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,IAAA,GAAO,gBAAgB,SAAS,CAAA;AACtC,IAAA,IAAOA,GAAA,CAAA,UAAA,CAAW,IAAI,CAAA,EAAG,OAAUA,aAAS,IAAI,CAAA;AAChD,IAAA,MAAM,GAAA;AAAA,EACR;AACF;AAGA,SAAS,mBAAmB,IAAA,EAAqC;AAC/D,EAAA,IAAI,EAAA,GAAoB,IAAA;AACxB,EAAA,IAAI;AACF,IAAA,EAAA,GAAQA,GAAA,CAAA,QAAA,CAAS,MAAM,GAAG,CAAA;AAC1B,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,IAAI,CAAA;AAChC,IAAA,MAAM,OAAUA,GAAA,CAAA,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA,EAAG,MAAA,CAAO,QAAQ,CAAC,CAAA;AACxD,IAAA,IAAI,IAAA,GAAO,KAAA,CAAM,MAAA,GAAS,CAAA,IAAK,CAAC,MAAA,CAAO,QAAA,CAAS,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,GAAG,OAAO,IAAA;AACvF,IAAA,MAAM,SAAA,GAAY,MAAA,CAAO,YAAA,CAAa,KAAA,CAAM,MAAM,CAAA;AAClD,IAAA,IAAI,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,SAAA,GAAY,MAAM,OAAO,IAAA;AAChD,IAAA,OAAO,QAAA,EAAS,CAAE,MAAA,CAAO,MAAA,CAAO,QAAA,CAAS,KAAA,CAAM,MAAA,GAAS,CAAA,EAAG,KAAA,CAAM,MAAA,GAAS,CAAA,GAAI,SAAS,CAAC,CAAA;AAAA,EAC1F,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,SAAE;AACA,IAAA,IAAI,EAAA,KAAO,IAAA,EAASA,GAAA,CAAA,SAAA,CAAU,EAAE,CAAA;AAAA,EAClC;AACF;AASO,SAAS,0BAA0B,SAAA,EAAmC;AAC3E,EAAA,MAAM,IAAA,GAAO,kBAAkB,SAAS,CAAA;AACxC,EAAA,IAAI,MAAM,OAAO,IAAA;AACjB,EAAA,IAAI,IAAA;AACJ,EAAA,IAAI;AACF,IAAA,IAAA,GAAUA,GAAA,CAAA,YAAA,CAAa,WAAW,MAAM,CAAA;AAAA,EAC1C,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,IAAI,KAAA;AACJ,EAAA,IAAI;AACF,IAAA,KAAA,GAAQ,WAAW,IAAI,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,kBAAA,CAAmB,WAAW,KAAK,CAAA;AACnC,EAAA,OAAO,KAAA;AACT;;;ACvOO,SAAS,aAAa,KAAA,EAAwB;AACnD,EAAA,MAAM,EAAE,IAAA,EAAM,UAAA,EAAY,KAAA,EAAO,OAAM,GAAI,KAAA;AAC3C,EAAA,MAAM,QAAkB,EAAC;AAEzB,EAAA,KAAA,CAAM,KAAK,qBAAqB,CAAA;AAChC,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,EAAA,KAAA,CAAM,KAAK,CAAA,oBAAA,EAAuB,UAAA,CAAW,OAAO,CAAA,eAAA,EAAe,KAAA,CAAM,aAAa,CAAA,EAAA,CAAI,CAAA;AAC1F,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,EAAA,KAAA,CAAM,KAAK,YAAY,CAAA;AACvB,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,EAAA,KAAA,CAAM,IAAA,CAAK,gBAAgB,IAAA,CAAK,MAAA,CAAO,MAAM,cAAA,CAAe,OAAO,CAAC,CAAA,CAAE,CAAA;AACtE,EAAA,KAAA,CAAM,IAAA,CAAK,gBAAgB,IAAA,CAAK,MAAA,CAAO,MAAM,cAAA,CAAe,OAAO,CAAC,CAAA,CAAE,CAAA;AACtE,EAAA,KAAA,CAAM,IAAA,CAAK,gBAAgB,IAAA,CAAK,MAAA,CAAO,MAAM,cAAA,CAAe,OAAO,CAAC,CAAA,CAAE,CAAA;AACtE,EAAA,KAAA,CAAM,IAAA,CAAK,oBAAoB,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,CAAA,IAAK,QAAG,CAAA,CAAE,CAAA;AACjE,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,kBAAA,EAAqB,IAAA,CAAK,OAAO,CAAA,CAAE,CAAA;AAC9C,EAAA,KAAA,CAAM,KAAK,CAAA,iBAAA,EAAoB,UAAA,CAAW,SAAS,IAAA,CAAK,IAAI,CAAC,CAAA,CAAE,CAAA;AAC/D,EAAA,KAAA,CAAM,IAAA,CAAK,qBAAqB,IAAA,CAAK,SAAA,CAAU,KAAK,IAAI,CAAA,IAAK,QAAG,CAAA,CAAE,CAAA;AAClE,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAGb,EAAA,MAAM,YAAY,KAAA,CAAM,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,SAAS,MAAM,CAAA;AACvD,EAAA,MAAM,UAAA,uBAAiB,GAAA,EAAoB;AAC3C,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,SAAS,UAAA,EAAY;AAChD,IAAA,UAAA,CAAW,GAAA,CAAI,EAAE,IAAA,EAAA,CAAO,UAAA,CAAW,IAAI,CAAA,CAAE,IAAI,CAAA,IAAK,CAAA,IAAK,CAAC,CAAA;AAAA,EAC1D;AACA,EAAA,MAAM,QAAA,GAAW,CAAC,GAAG,UAAA,CAAW,OAAA,EAAS,CAAA,CACtC,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,CAAC,CAAA,GAAI,CAAA,CAAE,CAAC,CAAA,IAAK,CAAA,CAAE,CAAC,CAAA,CAAE,aAAA,CAAc,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA,CACtD,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AACd,EAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,IAAA,KAAA,CAAM,KAAK,mCAAmC,CAAA;AAC9C,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,IAAA,KAAA,CAAM,KAAK,wBAAwB,CAAA;AACnC,IAAA,KAAA,CAAM,KAAK,gBAAgB,CAAA;AAC3B,IAAA,KAAA,MAAW,CAAC,IAAA,EAAM,KAAK,CAAA,IAAK,QAAA,EAAU,KAAA,CAAM,IAAA,CAAK,CAAA,IAAA,EAAO,IAAI,CAAA,KAAA,EAAQ,KAAK,CAAA,EAAA,CAAI,CAAA;AAC7E,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAAA,EACf;AAGA,EAAA,MAAM,QAAA,GAAW,KAAA,CACd,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,UAAU,CAAA,CACxD,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,UAAA,GAAa,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,aAAA,CAAc,aAAA,CAAc,CAAA,CAAE,aAAa,CAAC,CAAA,CAC5F,KAAA,CAAM,GAAG,EAAE,CAAA;AACd,EAAA,IAAI,SAAS,MAAA,EAAQ;AACnB,IAAA,KAAA,CAAM,KAAK,+BAA+B,CAAA;AAC1C,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,IAAA,KAAA,CAAM,KAAK,uCAAuC,CAAA;AAClD,IAAA,KAAA,CAAM,KAAK,4BAA4B,CAAA;AACvC,IAAA,KAAA,MAAW,KAAK,QAAA,EAAU;AACxB,MAAA,KAAA,CAAM,IAAA;AAAA,QACJ,OAAO,CAAA,CAAE,aAAa,QAAQ,CAAA,CAAE,IAAI,QAAQ,CAAA,CAAE,IAAI,CAAA,GAAA,EAAM,CAAA,CAAE,KAAK,KAAK,CAAA,GAAA,EAAM,EAAE,UAAA,CAAW,OAAA,CAAQ,CAAC,CAAC,CAAA,EAAA;AAAA,OACnG;AAAA,IACF;AACA,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAAA,EACf;AAGA,EAAA,MAAM,MAAA,uBAAa,GAAA,EAAoB;AACvC,EAAA,KAAA,MAAW,CAAA,IAAK,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,CAAA,CAAE,IAAA,EAAA,CAAO,MAAA,CAAO,GAAA,CAAI,CAAA,CAAE,IAAI,CAAA,IAAK,CAAA,IAAK,CAAC,CAAA;AACvE,EAAA,IAAI,OAAO,IAAA,EAAM;AACf,IAAA,KAAA,CAAM,KAAK,kBAAkB,CAAA;AAC7B,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,IAAA,KAAA,CAAM,KAAK,kBAAkB,CAAA;AAC7B,IAAA,KAAA,CAAM,KAAK,gBAAgB,CAAA;AAC3B,IAAA,KAAA,MAAW,CAAC,MAAM,KAAK,CAAA,IAAK,CAAC,GAAG,MAAA,CAAO,OAAA,EAAS,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,CAAC,CAAA,CAAE,cAAc,CAAA,CAAE,CAAC,CAAC,CAAC,CAAA,EAAG;AAC1F,MAAA,KAAA,CAAM,IAAA,CAAK,CAAA,EAAA,EAAK,IAAI,CAAA,GAAA,EAAM,KAAK,CAAA,EAAA,CAAI,CAAA;AAAA,IACrC;AACA,IAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAAA,EACf;AAEA,EAAA,KAAA,CAAM,KAAK,KAAK,CAAA;AAChB,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,EAAA,KAAA,CAAM,IAAA,CAAK,CAAA,QAAA,EAAW,SAAA,CAAU,MAAM,CAAA,gBAAA,EAAgB,UAAA,CAAW,UAAA,CAAW,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,SAAA,CAAM,CAAA;AAC9F,EAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AAEb,EAAA,OAAO,KAAA,CAAM,KAAK,IAAI,CAAA;AACxB;;;ACvEA,IAAM,gBAAA,GAAmB,GAAA;AAElB,SAAS,WAAW,KAAA,EAAwB;AACjD,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,KAAA,CACf,MAAA,CAAO,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,UAAU,EACxD,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,CAAA,CAAE,UAAA,GAAa,CAAA,CAAE,UAAA,IAAc,CAAA,CAAE,aAAA,CAAc,aAAA,CAAc,CAAA,CAAE,aAAa,CAAC,CAAA,CAC5F,KAAA,CAAM,GAAG,EAAE,CAAA;AAEd,EAAA,MAAM,KAAA,GAAQ,CAAC,GAAG,KAAA,CAAM,KAAK,CAAA,CAC1B,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,EAAE,IAAA,GAAO,CAAA,CAAE,QAAQ,CAAA,CAAE,EAAA,GAAK,EAAE,EAAE,CAAA,CAC7C,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAEd,EAAA,MAAM,OAAO,GAAA,CACV,GAAA;AAAA,IACC,CAAC,CAAA,KACC,CAAA,cAAA,EAAiB,GAAA,CAAI,CAAA,CAAE,aAAa,CAAC,CAAA,gBAAA,EAAmB,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA,eAAA,EACtD,IAAI,CAAA,CAAE,IAAI,CAAC,CAAA,QAAA,EAAW,CAAA,CAAE,IAAA,CAAK,KAAK,CAAA,SAAA,EAAY,CAAA,CAAE,UAAA,CAAW,OAAA,CAAQ,CAAC,CAAC,CAAA,UAAA;AAAA,GACtF,CACC,KAAK,IAAI,CAAA;AAEZ,EAAA,MAAM,WAAW,KAAA,CACd,GAAA;AAAA,IACC,CAAC,MACC,CAAA,QAAA,EAAW,CAAA,CAAE,EAAE,CAAA,eAAA,EAAkB,GAAA,CAAI,EAAE,KAAK,CAAC,mBACtC,CAAA,CAAE,IAAI,YAAY,CAAA,CAAE,QAAA,CAAS,QAAQ,CAAC,CAAC,CAAA,SAAA,EAAY,CAAA,CAAE,aAAa,CAAA,UAAA;AAAA,GAC7E,CACC,KAAK,IAAI,CAAA;AAEZ,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,KAAA,GAAQ,gBAAA;AACxC,EAAA,MAAM,eAAe,KAAA,GACjB;AAAA,IACE,eAAe,KAAA,CAAM,aAAA;AAAA,IACrB,aAAa,KAAA,CAAM,WAAA;AAAA,IACnB,YAAY,KAAA,CAAM,UAAA;AAAA,IAClB,MAAM,KAAA,CAAM,IAAA;AAAA,IACZ,IAAA,EAAM,GAAA,CAAI,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MACpB,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,MAAM,CAAA,CAAE,aAAA;AAAA,MACR,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,IAAA,EAAM,EAAE,IAAA,CAAK,KAAA;AAAA,MACb,YAAY,CAAA,CAAE,UAAA;AAAA,MACd,MAAM,CAAA,CAAE;AAAA,KACV,CAAE,CAAA;AAAA,IACF,KAAA,EAAO,KAAA,CAAM,GAAA,CAAI,CAAC,CAAA,MAAO;AAAA,MACvB,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,OAAO,CAAA,CAAE,KAAA;AAAA,MACT,MAAM,CAAA,CAAE,IAAA;AAAA,MACR,UAAU,CAAA,CAAE,QAAA;AAAA,MACZ,eAAe,CAAA,CAAE;AAAA,KACnB,CAAE,CAAA;AAAA,IACF,MAAM,CAAA,oBAAA,EAAuB,KAAA,CAAM,KAAK,MAAA,CAAO,KAAK,YAAY,gBAAgB,CAAA,8CAAA;AAAA,GAClF,GACA,KAAA;AAEJ,EAAA,MAAM,QAAA,GAAW,eAAA,CAAgB,YAAA,EAAc,CAAC,CAAA;AAChD,EAAA,MAAM,IAAA,GAAO,KAAA,CAAM,IAAA,CAAK,YAAA,IAAgB,MAAA;AAExC,EAAA,OAAO,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gBAAA,EAmBS,KAAA,CAAM,KAAK,MAAA,CAAO,KAAK,eAAY,KAAA,CAAM,IAAA,CAAK,OAAO,KAAK,CAAA;AAAA,EAC1E,KAAA,CAAM,IAAA,CAAK,MAAA,CAAO,KAAK,CAAA,YAAA,EAAY,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,SAAA,CAAU,IAAA,CAAK,IAAI,CAAA,IAAK,QAAG,CAAC,CAAA;AAAA,YAAA,EAClE,GAAA,CAAI,KAAA,CAAM,IAAA,CAAK,OAAO,CAAC,CAAA,YAAA,EAAY,GAAA,CAAI,IAAI,CAAC,CAAA,SAAA,EAAS,GAAA,CAAI,KAAA,CAAM,UAAA,CAAW,OAAO,CAAC,CAAA;AAAA,EAE9F,KAAA,GACI,CAAA,6BAAA,EAAgC,KAAA,CAAM,IAAA,CAAK,OAAO,KAAK,CAAA;AAAA,4HAAA,CAAA,GAEvD,EACN;AAAA;AAAA;AAAA;AAAA;AAAA,EAKE,YAAY,qDAAqD;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOjE,IAAI;AAAA;AAAA;AAAA,gBAAA,EAGY,KAAA,GAAQ,oBAAoB,YAAY,CAAA;AAAA;AAAA,EAExD,QAAQ;AAAA;AAAA;AAAA;AAAA,CAAA;AAKV;AAEA,SAAS,IAAI,CAAA,EAAmB;AAC9B,EAAA,OAAO,CAAA,CACJ,OAAA,CAAQ,IAAA,EAAM,OAAO,EACrB,OAAA,CAAQ,IAAA,EAAM,MAAM,CAAA,CACpB,QAAQ,IAAA,EAAM,MAAM,CAAA,CACpB,OAAA,CAAQ,MAAM,QAAQ,CAAA;AAC3B;AC2CA,SAAS,QAAA,GAAoB;AAC3B,EAAA,MAAM,CAAA,GAAI,QAAQ,GAAA,CAAI,kBAAA;AACtB,EAAA,OAAO,CAAA,KAAM,OAAO,CAAA,KAAM,MAAA;AAC5B;AAIO,SAAS,kBAAA,GAA6B;AAC3C,EAAA,MAAM,OAAO,OAAA,CAAQ,GAAA,CAAI,kBAAuBC,KAAA,CAAA,IAAA,CAAQ,EAAA,CAAA,OAAA,IAAW,QAAQ,CAAA;AAC3E,EAAA,OAAYA,KAAA,CAAA,IAAA,CAAK,IAAA,EAAM,UAAA,EAAY,SAAA,EAAW,WAAW,CAAA;AAC3D;AAEA,SAAS,iBAAA,GAA4B;AACnC,EAAA,OAAYA,KAAA,CAAA,IAAA,CAAK,kBAAA,EAAmB,EAAG,UAAU,CAAA;AACnD;AAEA,SAAS,cAAA,GAA2B;AAClC,EAAA,MAAM,MAAA,GAAS,QAAQ,GAAA,CAAI,uBAAA;AAC3B,EAAA,IAAI,MAAA,EAAQ;AACV,IAAA,MAAM,CAAA,GAASA,cAAQ,MAAM,CAAA;AAC7B,IAAA,IAAI;AACF,MAAA,IAAOC,GAAA,CAAA,QAAA,CAAS,CAAC,CAAA,CAAE,WAAA,EAAY,SAAU,CAAMD,KAAA,CAAA,IAAA,CAAK,CAAA,EAAG,UAAU,CAAC,CAAA;AAAA,IACpE,CAAA,CAAA,MAAQ;AAAA,IAER;AACA,IAAA,OAAO,CAAC,CAAC,CAAA;AAAA,EACX;AACA,EAAA,OAAO,CAAC,mBAAmB,CAAA;AAC7B;AAEA,IAAI,MAAA;AAGG,SAAS,2BAAA,GAAoC;AAClD,EAAA,MAAA,GAAS,MAAA;AACX;AAOA,eAAsB,qBAAA,GAA2D;AAC/E,EAAA,IAAI,MAAA,KAAW,QAAW,OAAO,MAAA;AACjC,EAAA,MAAA,GAAS,IAAA;AACT,EAAA,IAAI,QAAA,IAAY,OAAO,MAAA;AACvB,EAAA,KAAA,MAAW,CAAA,IAAK,gBAAe,EAAG;AAChC,IAAA,IAAI,CAAIC,GAAA,CAAA,UAAA,CAAW,CAAC,CAAA,EAAG;AACvB,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAO,MAAM,OAAO,aAAA,CAAc,CAAC,CAAA,CAAE,IAAA,CAAA;AAG3C,MAAA,MAAM,QAAA,GAAW,IAAI,uBAAA,IAA0B;AAC/C,MAAA,IAAI,QAAA,IAAY,OAAO,QAAA,CAAS,OAAA,KAAY,cAAc,OAAO,QAAA,CAAS,iBAAiB,UAAA,EAAY;AACrG,QAAA,MAAA,GAAS,QAAA;AACT,QAAA,OAAO,MAAA;AAAA,MACT;AAAA,IACF,CAAA,CAAA,MAAQ;AAAA,IAER;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAUA,IAAM,cAAA,GAAiB,EAAA;AACvB,IAAM,iBAAA,GAAoB,EAAA;AAC1B,IAAM,WAAA,GAAc,GAAA;AACpB,IAAM,YAAA,GAAe,GAAA;AAGrB,SAAS,SAAA,CAAU,KAAc,GAAA,EAAqB;AACpD,EAAA,OAAO,OAAO,GAAA,IAAO,EAAE,CAAA,CACpB,OAAA,CAAQ,2BAA2B,GAAG,CAAA,CACtC,OAAA,CAAQ,MAAA,EAAQ,GAAG,CAAA,CACnB,IAAA,EAAK,CACL,KAAA,CAAM,GAAG,GAAG,CAAA;AACjB;AASO,SAAS,YAAA,CAAa,KAAiB,QAAA,EAAqD;AACjG,EAAA,IAAI,CAAC,GAAA,IAAO,OAAO,GAAA,CAAI,OAAA,KAAY,YAAY,OAAO,GAAA,CAAI,UAAA,KAAe,SAAA,EAAW,OAAO,IAAA;AAC3F,EAAA,IAAI,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,KAAK,CAAA,IAAK,CAAC,KAAA,CAAM,OAAA,CAAQ,GAAA,CAAI,UAAU,CAAA,EAAG,OAAO,IAAA;AACxE,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,QAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,CAAA,IAAK,IAAI,KAAA,EAAO;AACzB,IAAA,MAAM,KAAK,OAAO,CAAA,EAAG,EAAA,KAAO,QAAA,GAAW,EAAE,EAAA,GAAK,EAAA;AAC9C,IAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,CAAA,EAAG,KAAK,CAAA;AAC7B,IAAA,IAAI,CAAC,EAAA,IAAM,CAAC,QAAA,CAAS,GAAA,CAAI,EAAE,CAAA,IAAK,IAAA,CAAK,GAAA,CAAI,EAAE,CAAA,EAAG;AAC9C,IAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,KAAK,CAAA,IAAK,SAAS,CAAA,EAAG;AAC3C,IAAA,IAAA,CAAK,IAAI,EAAE,CAAA;AACX,IAAA,KAAA,CAAM,IAAA,CAAK,EAAE,EAAA,EAAI,KAAA,EAAO,GAAA,EAAK,UAAU,CAAA,CAAE,GAAA,EAAK,WAAW,CAAA,EAAG,CAAA;AAC5D,IAAA,IAAI,KAAA,CAAM,UAAU,cAAA,EAAgB;AAAA,EACtC;AACA,EAAA,MAAM,UAAA,GAAa,IAAI,UAAA,CACpB,GAAA,CAAI,CAAC,CAAA,KAAM,SAAA,CAAU,GAAG,YAAY,CAAC,EACrC,MAAA,CAAO,CAAC,MAAM,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,CAC1B,KAAA,CAAM,GAAG,iBAAiB,CAAA;AAC7B,EAAA,OAAO,EAAE,OAAA,EAAS,GAAA,CAAI,OAAA,CAAQ,KAAA,CAAM,CAAA,EAAG,GAAG,CAAA,EAAG,UAAA,EAAY,GAAA,CAAI,UAAA,EAAY,KAAA,EAAO,UAAA,EAAW;AAC7F;AAGA,IAAM,eAAA,uBAAsB,OAAA,EAAiE;AAE7F,SAAS,aAAa,KAAA,EAE8B;AAClD,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,GAAA,CAAI,KAAK,CAAA;AACrC,EAAA,IAAI,KAAK,OAAO,GAAA;AAChB,EAAA,MAAM,UAA4B,EAAC;AACnC,EAAA,MAAM,GAAA,uBAAU,GAAA,EAAY;AAC5B,EAAA,KAAA,MAAW,CAAA,IAAK,MAAM,KAAA,EAAO;AAC3B,IAAA,IAAI,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,SAAS,UAAA,EAAY;AAChD,IAAA,OAAA,CAAQ,KAAK,EAAE,EAAA,EAAI,CAAA,CAAE,EAAA,EAAI,MAAM,CAAA,CAAE,IAAA,EAAM,aAAA,EAAe,CAAA,CAAE,eAAe,IAAA,EAAM,CAAA,CAAE,MAAM,UAAA,EAAY,CAAA,CAAE,YAAY,CAAA;AAC/G,IAAA,GAAA,CAAI,GAAA,CAAI,EAAE,EAAE,CAAA;AAAA,EACd;AACA,EAAA,MAAM,IAAA,GAAO,EAAE,OAAA,EAAS,GAAA,EAAI;AAC5B,EAAA,eAAA,CAAgB,GAAA,CAAI,OAAO,IAAI,CAAA;AAC/B,EAAA,OAAO,IAAA;AACT;AASA,eAAsB,YAAA,CACpB,KAAA,EACA,QAAA,EACA,IAAA,GAA6G,EAAC,EAC/E;AAC/B,EAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,EAAsB;AAC7C,EAAA,IAAI,CAAC,QAAA,IAAY,OAAO,QAAA,CAAS,WAAA,KAAgB,YAAY,OAAO,IAAA;AACpE,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,OAAA,EAAS,GAAA,EAAI,GAAI,aAAa,KAAK,CAAA;AAC3C,IAAA,MAAM,YAAY,IAAA,CAAK,SAAA,GAAY,OAAO,WAAA,CAAY,IAAA,CAAK,SAAS,CAAA,GAAI,IAAA;AACxE,IAAA,MAAM,GAAA,GAAM,QAAA,CAAS,WAAA,CAAY,QAAA,EAAU,OAAA,EAAS;AAAA,MAClD,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,aAAA,EAAe,KAAK,aAAA,IAAiB,IAAA;AAAA,MACrC;AAAA,KACD,CAAA;AACD,IAAA,OAAO,YAAA,CAAa,KAAK,GAAG,CAAA;AAAA,EAC9B,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;ACjSO,SAAS,YAAY,IAAA,EAAsB;AAChD,EAAA,OAAY,KAAA,CAAA,IAAA,CAAK,MAAM,WAAW,CAAA;AACpC;AAGO,SAAS,gBAAgB,IAAA,EAAsB;AACpD,EAAA,OAAY,KAAA,CAAA,IAAA,CAAK,WAAA,CAAY,IAAI,CAAA,EAAG,YAAY,CAAA;AAClD;AAMO,SAAS,iBAAA,CAAkB,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAc;AAC/E,EAAA,MAAM,CAAA,GAAI,GAAA,CAAI,sBAAA,EAAwB,IAAA,GAAO,WAAA,EAAY;AACzD,EAAA,OAAO,CAAA,KAAM,GAAA,IAAO,CAAA,KAAM,MAAA,IAAU,CAAA,KAAM,KAAA;AAC5C;AAQO,SAAS,gBAAA,CAAiB,IAAA,EAAc,GAAA,GAAyB,OAAA,CAAQ,GAAA,EAAa;AAC3F,EAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG,OAAO,gBAAgB,IAAI,CAAA;AACvD,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAK,GAAI,aAAa,IAAI,CAAA;AACvC,EAAA,IAAI,SAAS,MAAA,IAAU,GAAA,SAAY,qBAAA,CAAsB,IAAA,EAAM,KAAK,GAAG,CAAA;AACvE,EAAA,OAAO,eAAA,CAAgB,IAAA,EAAM,SAAA,EAAW,GAAG,CAAA;AAC7C;AAYO,SAAS,gBAAA,CAAiB,IAAA,EAAc,QAAA,EAAmB,GAAA,GAAyB,QAAQ,GAAA,EAAa;AAC9G,EAAA,IAAI,UAAU,IAAA,EAAK,SAAe,KAAA,CAAA,OAAA,CAAQ,QAAA,CAAS,MAAM,CAAA;AACzD,EAAA,IAAI,iBAAA,CAAkB,GAAG,CAAA,EAAG;AAC1B,IAAA,MAAMC,OAAAA,GAAS,gBAAgB,IAAI,CAAA;AACnC,IAAA,IAAO,GAAA,CAAA,UAAA,CAAWA,OAAM,CAAA,EAAG,OAAOA,OAAAA;AAClC,IAAA,OAAOA,OAAAA;AAAA,EACT;AACA,EAAA,MAAM,EAAE,GAAA,EAAK,IAAA,EAAK,GAAI,aAAa,IAAI,CAAA;AACvC,EAAA,IAAI,IAAA,KAAS,UAAU,GAAA,EAAK;AAC1B,IAAA,MAAM,UAAA,GAAa,qBAAA,CAAsB,IAAA,EAAM,GAAA,EAAK,GAAG,CAAA;AACvD,IAAA,IAAI,aAAA,CAAc,UAAU,CAAA,EAAG,OAAO,UAAA;AAAA,EACxC;AACA,EAAA,MAAM,UAAA,GAAa,eAAA,CAAgB,IAAA,EAAM,SAAA,EAAW,GAAG,CAAA;AACvD,EAAA,IAAI,aAAA,CAAc,UAAU,CAAA,EAAG,OAAO,UAAA;AACtC,EAAA,MAAM,MAAA,GAAS,gBAAgB,IAAI,CAAA;AACnC,EAAA,IAAO,GAAA,CAAA,UAAA,CAAW,MAAM,CAAA,EAAG,OAAO,MAAA;AAClC,EAAA,OAAO,gBAAA,CAAiB,MAAM,GAAG,CAAA;AACnC;AAmBA,IAAM,iBAAA,GAAoB;AAAA,EACxB,0EAAA;AAAA,EACA,2EAAA;AAAA,EACA,uEAAA;AAAA,EACA,0EAAA;AAAA,EACA,sDAAA;AAAA,EACA,YAAA;AAAA,EACA,QAAA;AAAA,EACA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,iBAAA;AAAA;AAAA,EAEA,YAAA;AAAA,EACA,YAAA;AAAA,EACA,iBAAA;AAAA,EACA,aAAA;AAAA,EACA,qBAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,qBAAA;AAAA;AAAA;AAAA;AAAA,EAIA,uBAAA;AAAA,EACA,oBAAA;AAAA;AAAA;AAAA;AAAA,EAIA,qBAAA;AAAA;AAAA;AAAA;AAAA,EAIA;AACF,CAAA;AAGA,IAAM,gBAAA,GAAmB,4BAAA;AAElB,SAAS,wBAAwB,IAAA,EAAoB;AAC1D,EAAA,MAAM,IAAA,GAAY,KAAA,CAAA,IAAA,CAAK,WAAA,CAAY,IAAI,GAAG,YAAY,CAAA;AACtD,EAAG,cAAU,WAAA,CAAY,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACnD,EAAA,IAAI,CAAI,GAAA,CAAA,UAAA,CAAW,IAAI,CAAA,EAAG;AACxB,IAAG,kBAAc,IAAA,EAAM,CAAA,EAAG,iBAAA,CAAkB,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA;AAC1D,IAAA;AAAA,EACF;AAOA,EAAA,MAAM,QAAA,GAAc,GAAA,CAAA,YAAA,CAAa,IAAA,EAAM,MAAM,CAAA;AAC7C,EAAA,IAAI,CAAC,gBAAA,CAAiB,IAAA,CAAK,QAAA,CAAS,KAAA,CAAM,OAAA,EAAS,CAAC,CAAA,CAAE,CAAC,CAAA,IAAK,EAAE,CAAA,EAAG;AACjE,EAAA,MAAM,IAAA,GAAO,IAAI,GAAA,CAAI,QAAA,CAAS,KAAA,CAAM,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,EAAM,CAAC,CAAA;AACjE,EAAA,MAAM,OAAA,GAAU,iBAAA,CAAkB,MAAA,CAAO,CAAC,UAAU,CAAC,KAAA,CAAM,UAAA,CAAW,GAAG,CAAA,IAAK,CAAC,IAAA,CAAK,GAAA,CAAI,KAAK,CAAC,CAAA;AAC9F,EAAA,IAAI,QAAQ,MAAA,EAAQ;AAClB,IAAG,GAAA,CAAA,aAAA,CAAc,IAAA,EAAM,CAAA,EAAG,QAAA,CAAS,OAAA,CAAQ,MAAA,EAAQ,IAAI,CAAC,CAAA,EAAG,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA;AAAA,EACnF;AACF;AAMO,SAAS,oBAAA,CAAqB,IAAA,EAAc,SAAA,EAAmB,GAAA,GAAyB,QAAQ,GAAA,EAAa;AAClH,EAAA,MAAM,QAAA,GAAgB,cAAQ,SAAS,CAAA;AACvC,EAAA,MAAM,MAAA,GAAc,KAAA,CAAA,OAAA,CAAQ,eAAA,CAAgB,IAAI,CAAC,CAAA;AACjD,EAAA,IAAI,QAAA,KAAa,MAAA,EAAQ,OAAO,WAAA,CAAY,IAAI,CAAA;AAChD,EAAA,MAAM,gBAAqB,KAAA,CAAA,OAAA,CAAQ,eAAA,CAAgB,IAAA,EAAM,SAAA,EAAW,GAAG,CAAC,CAAA;AACxE,EAAA,IAAI,QAAA,KAAa,aAAA,EAAe,OAAO,kBAAA,CAAmB,MAAM,GAAG,CAAA;AAEnE,EAAA,OAAY,cAAQ,QAAQ,CAAA;AAC9B;AAEO,SAAS,cAAA,CAAe,OAAgB,OAAA,EAAyC;AACtF,EAAA,MAAM,SAAA,GAAY,OAAA,CAAQ,SAAA,IAAa,gBAAA,CAAiB,QAAQ,IAAI,CAAA;AACpE,EAAA,MAAM,UAAA,GAAa,oBAAA,CAAqB,OAAA,CAAQ,IAAA,EAAM,SAAS,CAAA;AAC/D,EAAA,MAAM,MAAA,GAAS,aAAa,UAAA,EAAY,OAAA,CAAQ,IAAI,CAAA,IAAK,YAAA,CAAa,SAAA,EAAW,OAAA,CAAQ,IAAI,CAAA;AAE7F,EAAG,cAAe,KAAA,CAAA,OAAA,CAAQ,SAAS,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACzD,EAAG,GAAA,CAAA,SAAA,CAAU,UAAA,EAAY,EAAE,SAAA,EAAW,MAAM,CAAA;AAG5C,EAAA,IAAI,UAAU,YAAA,CAAa,UAAA,EAAY,YAAY,OAAA,CAAQ,IAAI,CAAC,CAAA,EAAG;AACjE,IAAA,uBAAA,CAAwB,QAAQ,IAAI,CAAA;AAAA,EACtC,CAAA,MAAA,IAAgB,cAAQ,SAAS,CAAA,KAAW,cAAQ,eAAA,CAAgB,OAAA,CAAQ,IAAI,CAAC,CAAA,EAAG;AAClF,IAAA,uBAAA,CAAwB,QAAQ,IAAI,CAAA;AAAA,EACtC;AAQA,EAAA,MAAM,YAAY,YAAA,CAAa,SAAA,EAAW,kBAAA,CAAmB,OAAA,CAAQ,IAAI,CAAC,CAAA;AAM1E,EAAA,oBAAA,CAAqB,SAAS,CAAA;AAE9B,EAAA,IAAI,SAAA,EAAW;AACb,IAAA,IAAI,CAAC,mBAAmB,SAAA,EAAW,KAAA,EAAO,EAAE,UAAA,EAAY,IAAA,EAAM,CAAA,EAAG,CAGjE,MAAO;AAGL,MAAG,GAAA,CAAA,MAAA,CAAO,SAAA,EAAW,EAAE,KAAA,EAAO,MAAM,CAAA;AAAA,IACtC;AAAA,EACF;AAEA,EAAA,IAAI,CAAC,SAAA,IAAa,CAAI,eAAW,eAAA,CAAgB,SAAS,CAAC,CAAA,EAAG;AAI5D,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,SAAS,CAAA,CAAA,EAAI,QAAQ,GAAG,CAAA,IAAA,CAAA;AACvC,IAAA,IAAI;AACF,MAAG,GAAA,CAAA,aAAA,CAAc,GAAA,EAAK,cAAA,CAAe,KAAK,CAAC,CAAA;AAC3C,MAAG,GAAA,CAAA,UAAA,CAAW,KAAK,SAAS,CAAA;AAAA,IAC9B,SAAS,GAAA,EAAK;AACZ,MAAG,GAAA,CAAA,MAAA,CAAO,GAAA,EAAK,EAAE,KAAA,EAAO,MAAM,CAAA;AAC9B,MAAA,MAAM,GAAA;AAAA,IACR;AAEA,IAAA,kBAAA,CAAmB,WAAW,KAAK,CAAA;AAAA,EACrC;AAEA,EAAA,MAAM,OAAA,GAA4B;AAAA,IAChC,SAAA,EAAW,aAAa,CAAI,GAAA,CAAA,UAAA,CAAW,SAAS,CAAA,GAAI,eAAA,CAAgB,SAAS,CAAA,GAAI;AAAA,GACnF;AAEA,EAAA,IAAI,OAAA,CAAQ,WAAW,KAAA,EAAO;AAC5B,IAAA,MAAM,UAAA,GAAkB,KAAA,CAAA,IAAA,CAAK,UAAA,EAAY,iBAAiB,CAAA;AAC1D,IAAG,GAAA,CAAA,aAAA,CAAc,UAAA,EAAY,YAAA,CAAa,KAAK,CAAC,CAAA;AAChD,IAAA,OAAA,CAAQ,UAAA,GAAa,UAAA;AAAA,EACvB;AAEA,EAAA,IAAI,OAAA,CAAQ,SAAS,KAAA,EAAO;AAC1B,IAAA,MAAM,QAAA,GAAgB,KAAA,CAAA,IAAA,CAAK,UAAA,EAAY,YAAY,CAAA;AACnD,IAAG,GAAA,CAAA,aAAA,CAAc,QAAA,EAAU,UAAA,CAAW,KAAK,CAAC,CAAA;AAC5C,IAAA,OAAA,CAAQ,QAAA,GAAW,QAAA;AAAA,EACrB;AAGA,EAAA,IAAI,KAAA,CAAM,KAAA,IAAS,KAAA,CAAM,KAAA,CAAM,MAAA,EAAQ;AACrC,IAAA,MAAM,SAAA,GAAiB,KAAA,CAAA,IAAA,CAAK,UAAA,EAAY,aAAa,CAAA;AACrD,IAAG,GAAA,CAAA,aAAA,CAAc,SAAA,EAAW,KAAA,CAAM,KAAA,CAAM,IAAI,CAAC,CAAA,KAAM,IAAA,CAAK,SAAA,CAAU,CAAC,CAAC,CAAA,CAAE,IAAA,CAAK,IAAI,IAAI,IAAI,CAAA;AACvF,IAAA,OAAA,CAAQ,SAAA,GAAY,SAAA;AAAA,EACtB;AAEA,EAAA,OAAO,OAAA;AACT;AAEA,SAAS,YAAA,CAAa,OAAe,MAAA,EAAyB;AAC5D,EAAA,MAAM,MAAW,KAAA,CAAA,QAAA,CAAc,KAAA,CAAA,OAAA,CAAQ,MAAM,CAAA,EAAQ,KAAA,CAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AACnE,EAAA,OAAO,GAAA,KAAQ,MAAO,CAAC,GAAA,CAAI,WAAW,IAAI,CAAA,IAAK,CAAM,KAAA,CAAA,UAAA,CAAW,GAAG,CAAA;AACrE;;;ACvOA,IAAMC,MAAAA,GAAQ,MAAA,CAAO,IAAA,CAAK,WAAA,EAAa,QAAQ,CAAA;AAI/C,IAAML,MAAAA,GAA2CM,eAAU,MAAM,CAAA,CAAA;AASjE,SAASC,SAAAA,GAAkB;AACzB,EAAA,OAAO,IAAIC,KAAAA,CAAM,EAAE,UAAA,EAAY,MAAM,CAAA;AACvC;AAGO,SAAS,mBAAmB,SAAA,EAA2B;AAC5D,EAAA,OAAO,SAAA,CAAU,QAAA,CAAS,OAAO,CAAA,GAAI,CAAA,EAAG,SAAA,CAAU,KAAA,CAAM,CAAA,EAAG,EAAE,CAAC,CAAA,UAAA,CAAA,GAAe,CAAA,EAAG,SAAS,CAAA,UAAA,CAAA;AAC3F;AAGO,SAAS,qBAAqB,SAAA,EAAyB;AAC5D,EAAA,IAAI;AACF,IAAGC,WAAO,kBAAA,CAAmB,SAAS,GAAG,EAAE,KAAA,EAAO,MAAM,CAAA;AAAA,EAC1D,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAEA,SAAS,WAAA,CAAY,MAAc,MAAA,EAAmF;AACpH,EAAA,IAAI;AACF,IAAA,IAAI,CAAIA,GAAA,CAAA,UAAA,CAAW,IAAI,CAAA,EAAG,OAAO,IAAA;AACjC,IAAA,MAAM,GAAA,GAASA,iBAAa,IAAI,CAAA;AAChC,IAAA,IAAI,GAAA,CAAI,MAAA,GAASJ,MAAAA,CAAM,MAAA,GAAS,KAAK,CAAC,GAAA,CAAI,QAAA,CAAS,CAAA,EAAGA,OAAM,MAAM,CAAA,CAAE,MAAA,CAAOA,MAAK,GAAG,OAAO,IAAA;AAC1F,IAAA,MAAM,SAAA,GAAY,GAAA,CAAI,YAAA,CAAaA,MAAAA,CAAM,MAAM,CAAA;AAC/C,IAAA,MAAM,WAAA,GAAcA,OAAM,MAAA,GAAS,CAAA;AACnC,IAAA,IAAI,GAAA,CAAI,MAAA,GAAS,WAAA,GAAc,SAAA,EAAW,OAAO,IAAA;AACjD,IAAA,MAAM,MAAA,GAASE,WAAS,CAAE,MAAA,CAAO,IAAI,QAAA,CAAS,WAAA,EAAa,WAAA,GAAc,SAAS,CAAC,CAAA;AACnF,IAAA,IAAI,MAAA,CAAO,MAAA,KAAW,OAAA,EAAS,OAAO,IAAA;AACtC,IAAA,IAAI,MAAA,CAAO,QAAA,KAAa,MAAA,CAAO,QAAA,EAAU,OAAO,IAAA;AAChD,IAAA,IAAI,MAAA,CAAO,UAAA,KAAe,MAAA,CAAO,UAAA,EAAY,OAAO,IAAA;AACpD,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,QAAA,CAAS,WAAA,GAAc,SAAS,CAAA;AACpD,IAAA,IAAKP,OAAM,OAAO,CAAA,KAAM,MAAQ,MAAA,CAAO,KAAA,KAAU,GAAI,OAAO,IAAA;AAC5D,IAAA,MAAM,IAAA,GAAOO,SAAAA,EAAS,CAAE,MAAA,CAAO,OAAO,CAAA;AACtC,IAAA,OAAO,IAAA,IAAQ,OAAO,IAAA,KAAS,QAAA,GAAW,IAAA,GAAO,IAAA;AAAA,EACnD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,SAAS,YAAA,CAAa,IAAA,EAAc,IAAA,EAAgD,IAAA,EAAsC;AACxH,EAAA,IAAI;AAEF,IAAA,MAAM,SAAS,MAAA,CAAO,WAAA,CAAY,OAAO,OAAA,CAAQ,IAAI,EAAE,IAAA,CAAK,CAAC,CAAC,CAAC,CAAA,EAAG,CAAC,CAAC,CAAA,KAAO,IAAI,CAAA,GAAI,CAAA,CAAA,GAAK,CAAE,CAAC,CAAA;AAC3F,IAAA,MAAM,OAAA,GAAUA,SAAAA,EAAS,CAAE,IAAA,CAAK,MAAM,CAAA;AACtC,IAAA,MAAM,MAAA,GAASA,SAAAA,EAAS,CAAE,IAAA,CAAK;AAAA,MAC7B,MAAA,EAAQ,OAAA;AAAA,MACR,UAAU,IAAA,CAAK,QAAA;AAAA,MACf,YAAY,IAAA,CAAK,UAAA;AAAA,MACjB,KAAA,EAAOP,MAAAA,CAAM,OAAO,CAAA,KAAM;AAAA,KACN,CAAA;AACtB,IAAA,MAAM,MAAA,GAAS,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA;AAC7B,IAAA,MAAA,CAAO,aAAA,CAAc,OAAO,MAAM,CAAA;AAClC,IAAGS,cAAeC,KAAA,CAAA,OAAA,CAAQ,IAAI,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACpD,IAAA,MAAM,GAAA,GAAM,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,QAAQ,GAAG,CAAA,IAAA,CAAA;AAClC,IAAGD,kBAAc,GAAA,EAAK,MAAA,CAAO,MAAA,CAAO,CAACJ,QAAO,MAAA,EAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,GAAG,MAAA,CAAO,IAAA,CAAK,OAAO,CAAC,CAAC,CAAC,CAAA;AAC/F,IAAGI,GAAA,CAAA,UAAA,CAAW,KAAK,IAAI,CAAA;AAAA,EACzB,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAaA,eAAsB,aAAA,CACpB,KAAA,EACA,IAAA,EACA,SAAA,EACgD;AAChD,EAAA,MAAM,QAAA,GAAW,MAAM,qBAAA,EAAsB;AAC7C,EAAA,IAAI,CAAC,QAAA,EAAU,OAAA,EAAS,OAAO,IAAA;AAC/B,EAAA,IAAI,eAAA;AACJ,EAAA,IAAI;AACF,IAAA,eAAA,GAAkB,SAAS,OAAA,EAAQ;AAAA,EACrC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,MAAM,UAAA,GAAa,MAAM,UAAA,EAAY,UAAA;AACrC,EAAA,IAAI,CAAC,YAAY,OAAO,IAAA;AAExB,EAAA,MAAM,IAAA,GAAO,kBAAA,CAAmB,SAAA,EAAW,IAAA,EAAK,GAASC,cAAQ,SAAS,CAAA,GAAI,gBAAA,CAAiB,IAAI,CAAC,CAAA;AACpG,EAAA,MAAMC,UAAS,WAAA,CAAY,IAAA,EAAM,EAAE,QAAA,EAAU,eAAA,EAAiB,YAAY,CAAA;AAC1E,EAAA,IAAIA,OAAAA,EAAQ;AACV,IAAA,MAAMC,KAAAA,uBAAW,GAAA,EAA+B;AAChD,IAAA,KAAA,MAAW,CAAC,EAAA,EAAI,CAAC,CAAA,IAAK,OAAO,OAAA,CAAQD,OAAM,CAAA,EAAG,IAAI,EAAE,MAAA,EAAQC,KAAAA,CAAK,GAAA,CAAI,IAAI,CAAC,CAAA;AAC1E,IAAA,OAAOA,KAAAA;AAAA,EACT;AAEA,EAAA,MAAM,SAAmC,EAAC;AAC1C,EAAA,MAAM,IAAA,uBAAW,GAAA,EAA+B;AAChD,EAAA,IAAI;AACF,IAAA,KAAA,MAAW,IAAA,IAAQ,MAAM,KAAA,EAAO;AAC9B,MAAA,IAAI,IAAA,CAAK,IAAA,KAAS,MAAA,IAAU,IAAA,CAAK,SAAS,UAAA,EAAY;AACtD,MAAA,MAAM,QAAA,GAAW,QAAA,CAAS,OAAA,CAAQ,EAAE,aAAA,EAAe,IAAA,CAAK,aAAA,EAAe,IAAA,EAAM,IAAA,CAAK,IAAA,EAAM,CAAA,IAAK,EAAC;AAE9F,MAAA,MAAM,KAAA,GAAQ,SACX,MAAA,CAAO,CAAC,MAAM,OAAO,CAAA,KAAM,YAAY,CAAA,CAAE,MAAA,GAAS,CAAC,CAAA,CACnD,GAAA,CAAI,CAAC,CAAA,KAAM,CAAA,CAAE,aAAa,CAAA,CAC1B,KAAA,CAAM,CAAA,EAAG,CAAC,CAAA;AACb,MAAA,MAAA,CAAO,IAAA,CAAK,EAAE,CAAA,GAAI,KAAA;AAClB,MAAA,IAAI,MAAM,MAAA,EAAQ,IAAA,CAAK,GAAA,CAAI,IAAA,CAAK,IAAI,KAAK,CAAA;AAAA,IAC3C;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACA,EAAA,YAAA,CAAa,MAAM,EAAE,QAAA,EAAU,eAAA,EAAiB,UAAA,IAAc,MAAM,CAAA;AACpE,EAAA,OAAO,IAAA;AACT","file":"chunk-III7S75O.js","sourcesContent":["import * as fs from 'node:fs';\nimport * as zlib from 'node:zlib';\nimport { Packr } from 'msgpackr';\nimport { parseGraph } from './serialize.js';\nimport { VERSION } from '../version.js';\nimport type { VgGraph } from '../schema.js';\n\n/**\n * Binary graph snapshot — a derived, local **cache** beside `graph.json`.\n *\n * `graph.json` stays the canonical, committed, human-diffable artifact and the\n * only interchange format (`vg export` / `share` / `bundle` are unchanged); the\n * determinism contract attaches to it, not to this file. The snapshot exists\n * purely so hot paths (`vg ask`/`serve`/`code`, vgd session attach) skip the\n * large-string `JSON.parse` on load and the pretty-print on write — measured\n * ~2.6× faster cold load and ~4× faster encode on XL maps, at ~40% of the size.\n *\n * Robustness rules (each one keeps JSON as the unquestioned fallback):\n *   - The loader trusts a snapshot only when its recorded (size, mtimeMs) of\n *     the source `graph.json` still match — any rebuild or hand-edit of the\n *     JSON silently invalidates it. Staleness never needs to parse the JSON.\n *   - A CRC-32 over the payload rejects torn/corrupted files; any decode error\n *     (unknown magic, short file, bad msgpack, version skew) returns null\n *     rather than throwing, and the caller re-reads JSON and rewrites the\n *     snapshot (\"self-healing\" — first load after upgrade migrates for free).\n *   - Writes are atomic (temp + rename) and best-effort: a full disk or\n *     read-only store must never fail a build or a query.\n *   - The engine VERSION is recorded and must match: the msgpack record layout\n *     tracks the in-memory graph shape, which may change between releases.\n *\n * Format: MAGIC (\"VGSNAP1\\0\") · u32LE header length · msgpack header\n * {engine, sourceSize, sourceMtimeMs, crc32} · msgpack graph payload.\n * Everything is explicit little-endian via DataView/Buffer — no platform\n * variance. msgpackr runs its pure-JS path (its native accelerator is an\n * optional dependency we do not rely on); a fresh Packr per encode/decode\n * keeps record-id assignment deterministic for identical input.\n */\n\nconst MAGIC = Buffer.from('VGSNAP1\\0', 'latin1');\n\n/** node:zlib gained crc32 in 22.2; fall back to a table crc for 22.0/22.1. */\nconst crc32: (data: Uint8Array) => number = zlib.crc32 ?? jsCrc32;\n\nlet crcTable: Uint32Array | null = null;\n\nfunction jsCrc32(data: Uint8Array): number {\n  if (!crcTable) {\n    crcTable = new Uint32Array(256);\n    for (let n = 0; n < 256; n++) {\n      let c = n;\n      for (let k = 0; k < 8; k++) c = c & 1 ? 0xedb88320 ^ (c >>> 1) : c >>> 1;\n      crcTable[n] = c >>> 0;\n    }\n  }\n  let crc = 0xffffffff;\n  for (let i = 0; i < data.length; i++) crc = crcTable[(crc ^ data[i]) & 0xff] ^ (crc >>> 8);\n  return (crc ^ 0xffffffff) >>> 0;\n}\n\ninterface SnapshotHeader {\n  engine: string;\n  crc32: number;\n  /**\n   * True when the snapshot IS the map (global-store mode, no graph.json\n   * beside it). False/absent = sidecar of a canonical graph.json, valid only\n   * while that JSON's recorded stat still matches.\n   */\n  standalone?: boolean;\n  sourceSize?: number;\n  sourceMtimeMs?: number;\n}\n\n/** Sidecar path for a map file: `…/graph.json` → `…/graph.snap`. */\nexport function snapshotPathFor(graphPath: string): string {\n  return graphPath.endsWith('.json') ? `${graphPath.slice(0, -5)}.snap` : `${graphPath}.snap`;\n}\n\nfunction newPackr(): Packr {\n  return new Packr({ useRecords: true });\n}\n\n/** Msgpack payload bytes for a graph (exported for the determinism test). */\nexport function encodeGraphPayload(graph: VgGraph): Buffer {\n  return Buffer.from(newPackr().pack(graph));\n}\n\n/**\n * Write the snapshot beside `graphPath`.\n *\n * Sidecar mode (default): call after `graph.json` is on disk — the header\n * records its stat so readers can cheaply detect staleness.\n * `standalone: true` (global-store mode): the snapshot IS the map; no\n * `graph.json` is required or consulted.\n * Best-effort: returns false (never throws) when the file can't be written.\n */\nexport function writeGraphSnapshot(\n  graphPath: string,\n  graph: VgGraph,\n  opts: { standalone?: boolean } = {},\n): boolean {\n  try {\n    const payload = encodeGraphPayload(graph);\n    let header: Buffer;\n    if (opts.standalone) {\n      header = newPackr().pack({\n        engine: VERSION,\n        crc32: crc32(payload),\n        standalone: true,\n      } satisfies SnapshotHeader);\n    } else {\n      const stat = fs.statSync(graphPath);\n      header = newPackr().pack({\n        engine: VERSION,\n        sourceSize: stat.size,\n        sourceMtimeMs: stat.mtimeMs,\n        crc32: crc32(payload),\n      } satisfies SnapshotHeader);\n    }\n    const lenBuf = Buffer.alloc(4);\n    lenBuf.writeUInt32LE(header.length, 0);\n    const file = snapshotPathFor(graphPath);\n    const tmp = `${file}.${process.pid}.tmp`;\n    try {\n      fs.writeFileSync(tmp, Buffer.concat([MAGIC, lenBuf, header, payload]));\n      fs.renameSync(tmp, file);\n    } catch (err) {\n      fs.rmSync(tmp, { force: true });\n      throw err;\n    }\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/**\n * Load the snapshot for `graphPath`, or null when it is absent, stale,\n * or corrupted.\n *\n * Sidecar snapshots additionally require their source `graph.json` to exist\n * with an unchanged stat AND an identical engine version — the JSON fallback\n * is free, so any doubt invalidates. Standalone snapshots are the map itself:\n * they are accepted on magic + CRC + a structural sanity check, including\n * across engine versions (msgpack embeds its record layout, so an older\n * snapshot decodes the same way an older committed graph.json would parse).\n */\nexport function readGraphSnapshot(graphPath: string): VgGraph | null {\n  try {\n    const file = snapshotPathFor(graphPath);\n    if (!fs.existsSync(file)) return null;\n    const raw = fs.readFileSync(file);\n    if (raw.length < MAGIC.length + 4 || !raw.subarray(0, MAGIC.length).equals(MAGIC)) return null;\n    const headerLen = raw.readUInt32LE(MAGIC.length);\n    const payloadStart = MAGIC.length + 4 + headerLen;\n    if (payloadStart > raw.length) return null;\n    const header = newPackr().unpack(raw.subarray(MAGIC.length + 4, payloadStart)) as SnapshotHeader;\n    if (!header.standalone) {\n      if (header.engine !== VERSION) return null;\n      const sourceStat = fs.statSync(graphPath); // no source JSON → nothing to be a cache of\n      if (header.sourceSize !== sourceStat.size || header.sourceMtimeMs !== sourceStat.mtimeMs) return null;\n    }\n    const payload = raw.subarray(payloadStart);\n    if (crc32(payload) !== header.crc32) return null;\n    const graph = newPackr().unpack(payload) as VgGraph;\n    if (!graph || !Array.isArray(graph.nodes) || !Array.isArray(graph.edges)) return null;\n    return graph;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Does a map exist at `graphPath` in either representation — the canonical\n * `graph.json`, or a standalone binary snapshot (global-store mode)?\n * Cheap: reads only the snapshot header, never the payload or the JSON.\n */\nexport function mapFileExists(graphPath: string): boolean {\n  if (fs.existsSync(graphPath)) return true;\n  return readSnapshotHeader(snapshotPathFor(graphPath))?.standalone === true;\n}\n\n/**\n * Stat for \"did the map change on disk\" mtime tracking: the JSON when\n * present, else the standalone snapshot file. Throws when neither exists —\n * same contract callers had with `fs.statSync(graphPath)`.\n */\nexport function mapFileStat(graphPath: string): fs.Stats {\n  try {\n    return fs.statSync(graphPath);\n  } catch (err) {\n    const snap = snapshotPathFor(graphPath);\n    if (fs.existsSync(snap)) return fs.statSync(snap);\n    throw err;\n  }\n}\n\n/** Parse just the envelope header of a snapshot file (null on any problem). */\nfunction readSnapshotHeader(file: string): SnapshotHeader | null {\n  let fd: number | null = null;\n  try {\n    fd = fs.openSync(file, 'r');\n    const prefix = Buffer.alloc(4096);\n    const read = fs.readSync(fd, prefix, 0, prefix.length, 0);\n    if (read < MAGIC.length + 4 || !prefix.subarray(0, MAGIC.length).equals(MAGIC)) return null;\n    const headerLen = prefix.readUInt32LE(MAGIC.length);\n    if (MAGIC.length + 4 + headerLen > read) return null;\n    return newPackr().unpack(prefix.subarray(MAGIC.length + 4, MAGIC.length + 4 + headerLen)) as SnapshotHeader;\n  } catch {\n    return null;\n  } finally {\n    if (fd !== null) fs.closeSync(fd);\n  }\n}\n\n/**\n * Load a map file, preferring the binary snapshot and self-healing it.\n * Fast path: valid snapshot (sidecar or standalone) → decode it. Fallback:\n * parse `graph.json`, then (best-effort) rewrite the sidecar so the next load\n * takes the fast path. Returns null only when neither representation yields a\n * graph — exactly the cases the pre-snapshot code treated as \"no graph\".\n */\nexport function loadGraphFileWithSnapshot(graphPath: string): VgGraph | null {\n  const snap = readGraphSnapshot(graphPath);\n  if (snap) return snap;\n  let json: string;\n  try {\n    json = fs.readFileSync(graphPath, 'utf8');\n  } catch {\n    return null;\n  }\n  let graph: VgGraph;\n  try {\n    graph = parseGraph(json);\n  } catch {\n    return null;\n  }\n  writeGraphSnapshot(graphPath, graph);\n  return graph;\n}\n","import type { VgGraph } from '../schema.js';\n\n/**\n * Deterministic Markdown summary (`GRAPH_REPORT.md`). Given a pinned\n * `generatedAt`, the report is byte-stable. Numbers are derived purely from the\n * graph, so the report can be regenerated from a committed `graph.json`.\n */\nexport function renderReport(graph: VgGraph): string {\n  const { meta, provenance, nodes, edges } = graph;\n  const lines: string[] = [];\n\n  lines.push('# Code Graph Report');\n  lines.push('');\n  lines.push(`Generated by \\`vg\\` ${provenance.version} · schema \\`${graph.schemaVersion}\\``);\n  lines.push('');\n  lines.push('## Summary');\n  lines.push('');\n  lines.push(`- **Nodes:** ${meta.counts.nodes.toLocaleString('en-US')}`);\n  lines.push(`- **Edges:** ${meta.counts.edges.toLocaleString('en-US')}`);\n  lines.push(`- **Areas:** ${meta.counts.areas.toLocaleString('en-US')}`);\n  lines.push(`- **Languages:** ${meta.languages.join(', ') || '—'}`);\n  lines.push(`- **Clustering:** ${meta.cluster}`);\n  lines.push(`- **Resolvers:** ${provenance.resolver.join(', ')}`);\n  lines.push(`- **Edge kinds:** ${meta.edgeKinds.join(', ') || '—'}`);\n  lines.push('');\n\n  // Files by definition count.\n  const fileNodes = nodes.filter((n) => n.kind === 'file');\n  const defsByFile = new Map<string, number>();\n  for (const n of nodes) {\n    if (n.kind === 'file' || n.kind === 'external') continue;\n    defsByFile.set(n.file, (defsByFile.get(n.file) ?? 0) + 1);\n  }\n  const topFiles = [...defsByFile.entries()]\n    .sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))\n    .slice(0, 15);\n  if (topFiles.length) {\n    lines.push('## Largest files (by definitions)');\n    lines.push('');\n    lines.push('| File | Definitions |');\n    lines.push('| --- | ---: |');\n    for (const [file, count] of topFiles) lines.push(`| \\`${file}\\` | ${count} |`);\n    lines.push('');\n  }\n\n  // Most-connected nodes (Phase 0 importance = normalised degree).\n  const topNodes = nodes\n    .filter((n) => n.kind !== 'file' && n.kind !== 'external')\n    .sort((a, b) => b.importance - a.importance || a.qualifiedName.localeCompare(b.qualifiedName))\n    .slice(0, 15);\n  if (topNodes.length) {\n    lines.push('## Most-connected definitions');\n    lines.push('');\n    lines.push('| Symbol | Kind | File | Importance |');\n    lines.push('| --- | --- | --- | ---: |');\n    for (const n of topNodes) {\n      lines.push(\n        `| \\`${n.qualifiedName}\\` | ${n.kind} | \\`${n.file}\\`:${n.span.start} | ${n.importance.toFixed(3)} |`,\n      );\n    }\n    lines.push('');\n  }\n\n  // Edge-kind breakdown.\n  const byKind = new Map<string, number>();\n  for (const e of edges) byKind.set(e.kind, (byKind.get(e.kind) ?? 0) + 1);\n  if (byKind.size) {\n    lines.push('## Edges by kind');\n    lines.push('');\n    lines.push('| Kind | Count |');\n    lines.push('| --- | ---: |');\n    for (const [kind, count] of [...byKind.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {\n      lines.push(`| ${kind} | ${count} |`);\n    }\n    lines.push('');\n  }\n\n  lines.push('---');\n  lines.push('');\n  lines.push(`_Files: ${fileNodes.length} · Corpus: \\`${provenance.corpusHash.slice(0, 16)}…\\`_`);\n  lines.push('');\n\n  return lines.join('\\n');\n}\n","import { stableStringify } from './serialize.js';\nimport type { VgGraph } from '../schema.js';\n\n/**\n * `graph.html`: self-contained, dependency-free, deterministic overview.\n *\n * For small/medium maps we embed the full graph JSON for tooling.\n * For large maps (default: >5k nodes) we embed only a\n * **hub + area summary** so the HTML stays openable; full data stays in\n * graph.json / graph.db. Interactive WebGL (sigma.js) remains a follow-up.\n */\n\nconst EMBED_NODE_LIMIT = 5_000;\n\nexport function renderHtml(graph: VgGraph): string {\n  const top = graph.nodes\n    .filter((n) => n.kind !== 'file' && n.kind !== 'external')\n    .sort((a, b) => b.importance - a.importance || a.qualifiedName.localeCompare(b.qualifiedName))\n    .slice(0, 50);\n\n  const areas = [...graph.areas]\n    .sort((a, b) => b.size - a.size || a.id - b.id)\n    .slice(0, 40);\n\n  const rows = top\n    .map(\n      (n) =>\n        `<tr><td><code>${esc(n.qualifiedName)}</code></td><td>${esc(n.kind)}</td>` +\n        `<td><code>${esc(n.file)}</code>:${n.span.start}</td><td>${n.importance.toFixed(3)}</td></tr>`,\n    )\n    .join('\\n');\n\n  const areaRows = areas\n    .map(\n      (a) =>\n        `<tr><td>${a.id}</td><td><code>${esc(a.label)}</code></td>` +\n        `<td>${a.size}</td><td>${a.cohesion.toFixed(3)}</td><td>${a.externalEdges}</td></tr>`,\n    )\n    .join('\\n');\n\n  const large = graph.meta.counts.nodes > EMBED_NODE_LIMIT;\n  const embedPayload = large\n    ? {\n        schemaVersion: graph.schemaVersion,\n        generatedAt: graph.generatedAt,\n        provenance: graph.provenance,\n        meta: graph.meta,\n        hubs: top.map((n) => ({\n          id: n.id,\n          name: n.qualifiedName,\n          kind: n.kind,\n          file: n.file,\n          line: n.span.start,\n          importance: n.importance,\n          area: n.area,\n        })),\n        areas: areas.map((a) => ({\n          id: a.id,\n          label: a.label,\n          size: a.size,\n          cohesion: a.cohesion,\n          externalEdges: a.externalEdges,\n        })),\n        note: `Full graph omitted (${graph.meta.counts.nodes} nodes > ${EMBED_NODE_LIMIT}). Use graph.json or .vibgrate/cache/graph.db.`,\n      }\n    : graph;\n\n  const embedded = stableStringify(embedPayload, 0);\n  const tier = graph.meta.analysisTier ?? 'full';\n\n  return `<!doctype html>\n<html lang=\"en\">\n<head>\n<meta charset=\"utf-8\">\n<meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n<title>vg · code graph</title>\n<style>\n  :root { color-scheme: light dark; }\n  body { font: 14px/1.5 system-ui, sans-serif; margin: 2rem auto; max-width: 60rem; padding: 0 1rem; }\n  h1 { font-size: 1.4rem; } h2 { font-size: 1.1rem; margin-top: 2rem; }\n  table { border-collapse: collapse; width: 100%; }\n  th, td { text-align: left; padding: 4px 8px; border-bottom: 1px solid #8884; }\n  td:last-child, th:last-child { text-align: right; }\n  .meta { color: #888; } code { font-size: 0.9em; }\n  .banner { background: #8882; padding: 0.6rem 0.8rem; border-radius: 6px; margin: 1rem 0; }\n</style>\n</head>\n<body>\n<h1>vg · code graph</h1>\n<p class=\"meta\">${graph.meta.counts.nodes} nodes · ${graph.meta.counts.edges} edges ·\n${graph.meta.counts.areas} areas · ${esc(graph.meta.languages.join(', ') || '—')} ·\nclustering: ${esc(graph.meta.cluster)} · tier: ${esc(tier)} · vg ${esc(graph.provenance.version)}</p>\n${\n  large\n    ? `<p class=\"banner\">Large map (${graph.meta.counts.nodes} nodes): HTML shows hubs + areas only.\nFull graph remains in <code>graph.json</code> / <code>.vibgrate/cache/graph.db</code> (query via <code>vg serve</code>).</p>`\n    : ''\n}\n<h2>Areas (subsystems)</h2>\n<table>\n<thead><tr><th>Id</th><th>Label</th><th>Size</th><th>Cohesion</th><th>External</th></tr></thead>\n<tbody>\n${areaRows || '<tr><td colspan=\"5\" class=\"meta\">no areas</td></tr>'}\n</tbody>\n</table>\n<h2>Most-connected definitions (hubs)</h2>\n<table>\n<thead><tr><th>Symbol</th><th>Kind</th><th>Location</th><th>Importance</th></tr></thead>\n<tbody>\n${rows}\n</tbody>\n</table>\n<p class=\"meta\">${large ? 'Summary payload' : 'Full graph'} embedded below for tooling.</p>\n<script type=\"application/json\" id=\"vg-graph\">\n${embedded}\n</script>\n</body>\n</html>\n`;\n}\n\nfunction esc(s: string): string {\n  return s\n    .replace(/&/g, '&amp;')\n    .replace(/</g, '&lt;')\n    .replace(/>/g, '&gt;')\n    .replace(/\"/g, '&quot;');\n}\n","/**\n * Relevance-provider seam for ask / Task Capsule seed ranking.\n *\n * Since the 2026-08 relevance relocation, the separately installed local\n * module (`@vibgrate/relevance`, auto-provisioned by the CLI) IS the ranking\n * engine: `rankQuestion` hands it the ask plus a name-only symbol view of\n * the loaded graph and receives an ordered, provenance-annotated seed list\n * and the plain-language concept map. When the module is unavailable —\n * offline install failure, explicit decline, `VIBGRATE_NO_KERNEL=1`, or a\n * pre-ranking module version — callers fall back to the host's mechanical\n * exact-name matcher (engine/query.ts) and proceed unchanged.\n *\n * Loading mirrors the optional-embedder pattern (engine/embeddings.ts):\n *  - `VIBGRATE_NO_KERNEL=1` disables the seam entirely.\n *  - `VIBGRATE_RELEVANCE_PATH` points at a provider module (a file, or a\n *    directory containing `index.js`).\n *  - Otherwise the default module location is probed:\n *    `$XDG_CACHE_HOME|~/.cache /vibgrate/modules/relevance/index.js`.\n * The module contract: it exports `createRelevanceProvider()` returning\n * `{ version(), analyzeQuery(q), tagNode?(input), rankSymbols?(q, symbols, opts) }`.\n *\n * Trust boundary: everything a module returns is sanitized here before it\n * can shape a capsule. A ranking may only ORDER symbols the loaded graph\n * actually has (`sanitizeRank`: unknown ids dropped, scores validated,\n * every printable string stripped of control characters and length-capped).\n * Every failure path degrades to `null` (→ mechanical fallback), never to an\n * error: the module is the brain, not a dependency.\n *\n * Determinism: given the same question, graph, and provider version, the\n * sanitized ranking is deterministic; the provider version is surfaced so\n * capsules can record it as ranking provenance.\n */\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport * as fs from 'node:fs';\nimport { pathToFileURL } from 'node:url';\n\nexport interface RelevanceExpansion {\n  /** Single lowercase word, ready for identifier-part matching. */\n  term: string;\n  /** The question token/phrase (or topic id) that produced it. */\n  from: string;\n  /** 0..1 relative confidence; scales the expansion's scoring contribution. */\n  weight: number;\n}\n\nexport interface RelevanceTopic {\n  id: string;\n  /** 0..1, normalized within one analysis. */\n  score: number;\n}\n\n/** One level of a matched taxonomy path, root-first. */\nexport interface RelevanceTaxonomyLevel {\n  id: string;\n  path: string;\n  /** 0..1 — never lower than the levels beneath it. */\n  score: number;\n  /** This level's own vocabulary. */\n  terms: string[];\n}\n\n/** A hierarchical match: the most specific node plus its ancestor chain. */\nexport interface RelevanceTaxonomyMatch {\n  /** \"infrastructure/networking/dns/cname\" */\n  path: string;\n  levels: RelevanceTaxonomyLevel[];\n  score: number;\n  /** Absolute evidence behind the match, not relative to other matches. */\n  evidence: number;\n  /** What matched — \"~\" prefixes a fuzzy repair. */\n  via: string[];\n  /** The matched node's OWN vocabulary, for explaining the domain. */\n  terms: string[];\n  /** Filenames and extensions this node's work lives in, nearest first. */\n  files: string[];\n  /** Standards governing this node, current revision first. */\n  standards: RelevanceStandard[];\n}\n\n/** A product the ask names, including through a misspelling. */\nexport interface RelevanceVendorMatch {\n  name: string;\n  from: string;\n  node?: string;\n  topic: string;\n  score: number;\n  /** Filenames and extensions this vendor's configuration lives in. */\n  files: string[];\n}\n\n/** A standard governing the matched area, at the revision the pack tracks. */\nexport interface RelevanceStandard {\n  name: string;\n  publisher: string;\n  node: string;\n  /** \"standard\" or \"regulation\". */\n  kind: string;\n  /** Lowercase category slugs from the website's own vocabulary. */\n  categories: string[];\n}\n\n/** A misspelling the provider resolved. */\nexport interface RelevanceCorrection {\n  from: string;\n  to: string;\n  distance: number;\n}\n\nexport interface RelevanceAnalysis {\n  version: string;\n  topics: RelevanceTopic[];\n  expansions: RelevanceExpansion[];\n  /** Hierarchical matches, most specific first. Absent from older providers. */\n  taxonomy?: RelevanceTaxonomyMatch[];\n  vendors?: RelevanceVendorMatch[];\n  corrections?: RelevanceCorrection[];\n  /** Every file hint the analysis implies, most specific first. */\n  files?: string[];\n  /** Standards governing what the ask is about, most specific node first. */\n  standards?: RelevanceStandard[];\n  /** Deduped lowercase category slugs across those standards. */\n  categories?: string[];\n}\n\n/** One graph symbol, as handed to the provider's ranker: identity and name\n *  material only — never source contents. */\nexport interface RankableSymbol {\n  id: string;\n  name: string;\n  qualifiedName: string;\n  file: string;\n  importance: number;\n}\n\nexport interface RankOptions {\n  limit?: number;\n  priorQuestion?: string | null;\n  topicTags?: Record<string, readonly string[]> | null;\n}\n\nexport interface RankedSeed {\n  id: string;\n  score: number;\n  why: string;\n}\n\n/** The provider's full ranking answer (schema 5), pre-sanitization. */\nexport interface RankResult {\n  version: string;\n  hasContent: boolean;\n  seeds: RankedSeed[];\n  conceptMap: string[];\n}\n\nexport interface RelevanceProvider {\n  version(): string;\n  analyzeQuery(question: string): RelevanceAnalysis;\n  /** Optional build-time enrichment: deterministic topic tags for one node\n   *  (path + identifier evidence). Providers without it still work. */\n  tagNode?(input: { qualifiedName: string; file: string }): string[];\n  /**\n   * Schema-5: rank the given symbols for one ask. When present, the module\n   * IS the relevance engine — the host delegates seed selection here and\n   * keeps only mechanical name matching as its module-less fallback. A\n   * provider without it is treated as no ranking engine at all.\n   */\n  rankSymbols?(question: string, symbols: RankableSymbol[], opts?: RankOptions): RankResult;\n}\n\nfunction disabled(): boolean {\n  const v = process.env.VIBGRATE_NO_KERNEL;\n  return v === '1' || v === 'true';\n}\n\n/** Default install location for the optional relevance module (shared with\n *  the install flow in install/relevance-module.ts). */\nexport function relevanceModuleDir(): string {\n  const base = process.env.XDG_CACHE_HOME || path.join(os.homedir(), '.cache');\n  return path.join(base, 'vibgrate', 'modules', 'relevance');\n}\n\nfunction defaultModulePath(): string {\n  return path.join(relevanceModuleDir(), 'index.js');\n}\n\nfunction candidatePaths(): string[] {\n  const custom = process.env.VIBGRATE_RELEVANCE_PATH;\n  if (custom) {\n    const p = path.resolve(custom);\n    try {\n      if (fs.statSync(p).isDirectory()) return [path.join(p, 'index.js')];\n    } catch {\n      /* fall through — treat as a file path */\n    }\n    return [p];\n  }\n  return [defaultModulePath()];\n}\n\nlet cached: RelevanceProvider | null | undefined;\n\n/** Reset the memoized provider (tests only). */\nexport function resetRelevanceProviderCache(): void {\n  cached = undefined;\n}\n\n/**\n * Load the optional relevance provider. Memoized per process; returns `null`\n * when disabled, not installed, or the module fails to load or violates the\n * contract — callers treat `null` as \"no analysis\" and proceed unchanged.\n */\nexport async function loadRelevanceProvider(): Promise<RelevanceProvider | null> {\n  if (cached !== undefined) return cached;\n  cached = null;\n  if (disabled()) return cached;\n  for (const p of candidatePaths()) {\n    if (!fs.existsSync(p)) continue;\n    try {\n      const mod = (await import(pathToFileURL(p).href)) as {\n        createRelevanceProvider?: () => RelevanceProvider;\n      };\n      const provider = mod.createRelevanceProvider?.();\n      if (provider && typeof provider.version === 'function' && typeof provider.analyzeQuery === 'function') {\n        cached = provider;\n        return cached;\n      }\n    } catch {\n      // A broken module must never break ask/capsule — fall through to null.\n    }\n  }\n  return cached;\n}\n\n/** Sanitized module ranking, ready for `queryGraph({ ranked })`. */\nexport interface SanitizedRank {\n  version: string;\n  hasContent: boolean;\n  seeds: RankedSeed[];\n  conceptMap: string[];\n}\n\nconst MAX_RANK_SEEDS = 64;\nconst MAX_CONCEPT_LINES = 24;\nconst MAX_WHY_LEN = 240;\nconst MAX_LINE_LEN = 400;\n\n/** Printable one-line string, control characters stripped, length-capped. */\nfunction cleanLine(raw: unknown, cap: number): string {\n  return String(raw ?? '')\n    .replace(/[\\u0000-\\u001F\\u007F]+/g, ' ')\n    .replace(/\\s+/g, ' ')\n    .trim()\n    .slice(0, cap);\n}\n\n/**\n * Enforce the trust boundary on a provider ranking (exported for tests).\n * Seed ids must name symbols the LOADED graph actually has — a module can\n * order the host's own symbols, never invent one — and every string the\n * capsule will print is stripped and capped. Malformed entries drop; a\n * malformed envelope drops the whole ranking (→ mechanical fallback).\n */\nexport function sanitizeRank(raw: RankResult, validIds: ReadonlySet<string>): SanitizedRank | null {\n  if (!raw || typeof raw.version !== 'string' || typeof raw.hasContent !== 'boolean') return null;\n  if (!Array.isArray(raw.seeds) || !Array.isArray(raw.conceptMap)) return null;\n  const seen = new Set<string>();\n  const seeds: RankedSeed[] = [];\n  for (const s of raw.seeds) {\n    const id = typeof s?.id === 'string' ? s.id : '';\n    const score = Number(s?.score);\n    if (!id || !validIds.has(id) || seen.has(id)) continue;\n    if (!Number.isFinite(score) || score <= 0) continue;\n    seen.add(id);\n    seeds.push({ id, score, why: cleanLine(s.why, MAX_WHY_LEN) });\n    if (seeds.length >= MAX_RANK_SEEDS) break;\n  }\n  const conceptMap = raw.conceptMap\n    .map((l) => cleanLine(l, MAX_LINE_LEN))\n    .filter((l) => l.length > 0)\n    .slice(0, MAX_CONCEPT_LINES);\n  return { version: raw.version.slice(0, 120), hasContent: raw.hasContent, seeds, conceptMap };\n}\n\n/** Per-graph symbol view for the ranker, cached on graph object identity. */\nconst symbolViewCache = new WeakMap<object, { symbols: RankableSymbol[]; ids: Set<string> }>();\n\nfunction symbolViewOf(graph: {\n  nodes: Array<{ id: string; name: string; qualifiedName: string; file: string; kind: string; importance: number }>;\n}): { symbols: RankableSymbol[]; ids: Set<string> } {\n  const hit = symbolViewCache.get(graph);\n  if (hit) return hit;\n  const symbols: RankableSymbol[] = [];\n  const ids = new Set<string>();\n  for (const n of graph.nodes) {\n    if (n.kind === 'file' || n.kind === 'external') continue;\n    symbols.push({ id: n.id, name: n.name, qualifiedName: n.qualifiedName, file: n.file, importance: n.importance });\n    ids.add(n.id);\n  }\n  const view = { symbols, ids };\n  symbolViewCache.set(graph, view);\n  return view;\n}\n\n/**\n * Rank a question over a graph's symbols via the installed module. Returns\n * `null` when no module is installed, the installed module predates the\n * ranking API, or its output fails sanitization — callers fall back to the\n * host's mechanical matcher and proceed unchanged. Every failure path is a\n * degrade, never an error.\n */\nexport async function rankQuestion(\n  graph: { nodes: Array<{ id: string; name: string; qualifiedName: string; file: string; kind: string; importance: number }> },\n  question: string,\n  opts: { limit?: number; priorQuestion?: string | null; topicTags?: Map<string, readonly string[]> | null } = {},\n): Promise<SanitizedRank | null> {\n  const provider = await loadRelevanceProvider();\n  if (!provider || typeof provider.rankSymbols !== 'function') return null;\n  try {\n    const { symbols, ids } = symbolViewOf(graph);\n    const topicTags = opts.topicTags ? Object.fromEntries(opts.topicTags) : null;\n    const raw = provider.rankSymbols(question, symbols, {\n      limit: opts.limit,\n      priorQuestion: opts.priorQuestion ?? null,\n      topicTags,\n    });\n    return sanitizeRank(raw, ids);\n  } catch {\n    return null;\n  }\n}\n\n","import * as fs from 'node:fs';\nimport * as path from 'node:path';\nimport { serializeGraph } from './serialize.js';\nimport { mapFileExists, snapshotPathFor, writeGraphSnapshot } from './snapshot.js';\nimport { renderReport } from './report.js';\nimport { renderHtml } from './html.js';\nimport { globalGraphPath, globalGraphPathForRef, repositoryStoreDir } from '../runtime/paths.js';\nimport { deleteTagsSidecarFor } from './relevance-enrich.js';\nimport { detectGitRef } from '../runtime/git-ref.js';\nimport type { VgGraph } from '../schema.js';\n\n/**\n * Graph artifact layout (Fusion Runtime Phase 1).\n *\n * By default the code map lives in the **global** application store\n * (XDG / Application Support), keyed by repository id — not inside the repo.\n * That keeps `vg` / `vg serve` / auto-refresh from dirtying the working tree.\n *\n * Legacy in-repo path `.vibgrate/graph.json` is still **read** when present\n * (migration), and is still the write target when:\n *   - `VIBGRATE_GRAPH_IN_REPO=1` (or true/yes), or\n *   - callers pass an explicit `graphPath` / `--graph`.\n *\n * `vg share` continues to opt into a committed in-repo map by writing under\n * `.vibgrate/` (and rewriting its gitignore).\n */\n\nexport interface WriteOptions {\n  root: string;\n  html?: boolean; // default true\n  report?: boolean; // default true\n  graphPath?: string; // override graph.json path\n}\n\nexport interface WrittenArtifacts {\n  graphPath: string;\n  reportPath?: string;\n  htmlPath?: string;\n  factsPath?: string;\n}\n\nexport function vibgrateDir(root: string): string {\n  return path.join(root, '.vibgrate');\n}\n\n/** Historical in-repo map path (still read as a fallback). */\nexport function legacyGraphPath(root: string): string {\n  return path.join(vibgrateDir(root), 'graph.json');\n}\n\n/**\n * When true, default writes go to `.vibgrate/graph.json` (pre–Phase-1 layout).\n * Useful for CI that asserts in-repo artifacts, and for `vg share` workflows.\n */\nexport function preferInRepoGraph(env: NodeJS.ProcessEnv = process.env): boolean {\n  const v = env.VIBGRATE_GRAPH_IN_REPO?.trim().toLowerCase();\n  return v === '1' || v === 'true' || v === 'yes';\n}\n\n/**\n * Default **write** path for the map. Global store unless the operator opts\n * into the legacy in-repo layout. When git is available, prefer a\n * branch-keyed snapshot (Fusion §4.1.1) so switching branches does not\n * overwrite another ref's on-disk map.\n */\nexport function defaultGraphPath(root: string, env: NodeJS.ProcessEnv = process.env): string {\n  if (preferInRepoGraph(env)) return legacyGraphPath(root);\n  const { ref, kind } = detectGitRef(root);\n  if (kind !== 'none' && ref) return globalGraphPathForRef(root, ref, env);\n  return globalGraphPath(root, 'current', env);\n}\n\n/**\n * Resolve where to **read** the map from.\n * Order: explicit override → legacy in-repo when `VIBGRATE_GRAPH_IN_REPO` is set\n * → branch-keyed global (if on a git ref) → `current` global snapshot →\n * legacy in-repo → default write path.\n *\n * The in-repo env short-circuit matters for CI and the release benchmark: they\n * force portable `.vibgrate/graph.json` artifacts and must not pay a synchronous\n * `git rev-parse` (or prefer a leftover global snapshot) on every resolve.\n */\nexport function resolveGraphPath(root: string, override?: string, env: NodeJS.ProcessEnv = process.env): string {\n  if (override?.trim()) return path.resolve(override.trim());\n  if (preferInRepoGraph(env)) {\n    const legacy = legacyGraphPath(root);\n    if (fs.existsSync(legacy)) return legacy;\n    return legacy;\n  }\n  const { ref, kind } = detectGitRef(root);\n  if (kind !== 'none' && ref) {\n    const branchPath = globalGraphPathForRef(root, ref, env);\n    if (mapFileExists(branchPath)) return branchPath;\n  }\n  const globalPath = globalGraphPath(root, 'current', env);\n  if (mapFileExists(globalPath)) return globalPath;\n  const legacy = legacyGraphPath(root);\n  if (fs.existsSync(legacy)) return legacy;\n  return defaultGraphPath(root, env);\n}\n\n/**\n * By default the graph artifacts are *local*: builds and auto-refreshes rewrite\n * them constantly, and without an ignore file every `vg ask`/`vg serve` leaves\n * the branch dirty (untracked or modified `.vibgrate/` files) — irritating for\n * humans and a source of junk commits from AI agents. So the first time vg\n * writes into `.vibgrate/` it also drops a `.gitignore` covering the graph\n * artifacts, the cache, and itself.\n *\n * Deliberately create-once: an existing `.vibgrate/.gitignore` is NEVER\n * touched, whatever its content — `vg share` owns it after opt-in (rewritten to\n * commit `graph.json`), and a user-managed file (even an empty one) is theirs.\n * Scanner artifacts meant for git (`baseline.json`, `standards.json`,\n * `attestation.intoto.jsonl`) are intentionally not listed.\n *\n * With the global store default, this gitignore is only created when something\n * is still written under `.vibgrate/` (in-repo mode or other in-repo writers).\n */\nconst DEFAULT_GITIGNORE = [\n  '# Created by vg — local graph artifacts stay out of git by default.',\n  '# Run `vg share` to commit the map for your team (it rewrites this file).',\n  '# vg appends newly-introduced local artifacts to this list while this',\n  '# header line stays; remove the header (or empty the file) to manage the',\n  '# ignores yourself and vg will never touch it again.',\n  '.gitignore',\n  'cache/',\n  'graph.json',\n  'graph.snap',\n  'graph.tags.snap',\n  // Binary semantic index next to the map (never model-named; never under cache/).\n  'embeddings',\n  'graph.html',\n  'GRAPH_REPORT.md',\n  'facts.jsonl',\n  'mcp-navigation.json',\n  // Machine-local telemetry the LSP/`vg code` accrue over time — never meant\n  // for git: score-history.jsonl is per-machine trend data (lsp/score-history.ts),\n  // run-outcomes.jsonl is per-machine agent-run telemetry (code/run-outcome.ts).\n  // Neither is a snapshot artifact like scan_result.json/baseline.json, which\n  // are intentionally left out of this list for a user to commit if they choose.\n  'score-history.jsonl',\n  // Per-machine drifted-dependency snapshot behind the inline \"new\" marker\n  // (lsp/inventory-history.ts). ignore.json is deliberately NOT here — an\n  // ignore with a reason is a team decision that belongs in review.\n  'inline-inventory.json',\n  'run-outcomes.jsonl',\n  // Standing approval rules are one developer's consent — sharing them via git\n  // would silently grant their \"Always allow\" decisions to every teammate's\n  // agent runs (code/approvals.ts).\n  'code-approvals.json',\n  // Isolated worktree checkouts for VG Code worktree sessions — full working\n  // copies that must never be committed into the repository that hosts them\n  // (code/worktree-session.ts).\n  'worktrees',\n];\n\n/** Marks a .vibgrate/.gitignore as vg-authored (safe to keep current). */\nconst GITIGNORE_MARKER = /^# Created (once )?by vg\\b/;\n\nexport function ensureVibgrateGitignore(root: string): void {\n  const file = path.join(vibgrateDir(root), '.gitignore');\n  fs.mkdirSync(vibgrateDir(root), { recursive: true });\n  if (!fs.existsSync(file)) {\n    fs.writeFileSync(file, `${DEFAULT_GITIGNORE.join('\\n')}\\n`);\n    return;\n  }\n  // A vg-authored .gitignore written before an entry joined DEFAULT_GITIGNORE\n  // would keep tracking the newer machine-local files (e.g.\n  // code-approvals.json — one developer's consent must not ride into the team\n  // repo), so vg keeps ITS OWN file current: entries are appended while the\n  // vg header is present. A file without the header — including an emptied\n  // one — is the user's, and is never touched (the documented opt-out).\n  const existing = fs.readFileSync(file, 'utf8');\n  if (!GITIGNORE_MARKER.test(existing.split(/\\r?\\n/, 1)[0] ?? '')) return;\n  const have = new Set(existing.split(/\\r?\\n/).map((l) => l.trim()));\n  const missing = DEFAULT_GITIGNORE.filter((entry) => !entry.startsWith('#') && !have.has(entry));\n  if (missing.length) {\n    fs.writeFileSync(file, `${existing.replace(/\\n*$/, '\\n')}${missing.join('\\n')}\\n`);\n  }\n}\n\n/**\n * Directory for companion artifacts (report, html, facts) next to the map.\n * Global maps → repository store root; in-repo maps → `.vibgrate/`.\n */\nexport function companionArtifactDir(root: string, graphPath: string, env: NodeJS.ProcessEnv = process.env): string {\n  const resolved = path.resolve(graphPath);\n  const legacy = path.resolve(legacyGraphPath(root));\n  if (resolved === legacy) return vibgrateDir(root);\n  const globalDefault = path.resolve(globalGraphPath(root, 'current', env));\n  if (resolved === globalDefault) return repositoryStoreDir(root, env);\n  // Custom --graph: keep companions next to the map file.\n  return path.dirname(resolved);\n}\n\nexport function writeArtifacts(graph: VgGraph, options: WriteOptions): WrittenArtifacts {\n  const graphPath = options.graphPath ?? defaultGraphPath(options.root);\n  const companions = companionArtifactDir(options.root, graphPath);\n  const inRepo = isPathInside(companions, options.root) || isPathInside(graphPath, options.root);\n\n  fs.mkdirSync(path.dirname(graphPath), { recursive: true });\n  fs.mkdirSync(companions, { recursive: true });\n\n  // Only drop `.vibgrate/.gitignore` when we still touch the in-repo layout.\n  if (inRepo && isPathInside(companions, vibgrateDir(options.root))) {\n    ensureVibgrateGitignore(options.root);\n  } else if (path.resolve(graphPath) === path.resolve(legacyGraphPath(options.root))) {\n    ensureVibgrateGitignore(options.root);\n  }\n\n  // Global-store maps are machine-consumed only, so the snapshot IS the map\n  // there — skipping the pretty-JSON serialize is the bulk of the write cost\n  // on large repos. Everywhere a human (or git) can see the file — legacy\n  // in-repo layout, VIBGRATE_GRAPH_IN_REPO, `vg share`, an explicit --graph\n  // path — the canonical graph.json is still written, with the snapshot as a\n  // sidecar cache.\n  const storeMode = isPathInside(graphPath, repositoryStoreDir(options.root));\n\n  // A (re)written graph at this path is a NEW graph: drop the relevance-tags\n  // sidecar bound to the previous content so nothing stale can outlive its\n  // graph (the sidecar would also self-invalidate via corpusHash, but a\n  // removed/replaced graph must take its derived artifacts with it).\n  deleteTagsSidecarFor(graphPath);\n\n  if (storeMode) {\n    if (!writeGraphSnapshot(graphPath, graph, { standalone: true })) {\n      // Store not writable for the binary — fall back to the JSON write below\n      // rather than losing the build.\n    } else {\n      // Drop any JSON left by an older CLI at this path so a downgrade can\n      // never silently serve a stale map from beside a newer snapshot.\n      fs.rmSync(graphPath, { force: true });\n    }\n  }\n\n  if (!storeMode || !fs.existsSync(snapshotPathFor(graphPath))) {\n    // Atomic write (temp + rename): `vg serve` hot-reloads the map on mtime\n    // change, so a rebuild — including its own in-process auto-refresh — must\n    // never expose a half-written file to a concurrent reader.\n    const tmp = `${graphPath}.${process.pid}.tmp`;\n    try {\n      fs.writeFileSync(tmp, serializeGraph(graph));\n      fs.renameSync(tmp, graphPath);\n    } catch (err) {\n      fs.rmSync(tmp, { force: true });\n      throw err;\n    }\n    // Binary sidecar cache for fast loads; best-effort, JSON stays canonical.\n    writeGraphSnapshot(graphPath, graph);\n  }\n\n  const written: WrittenArtifacts = {\n    graphPath: storeMode && !fs.existsSync(graphPath) ? snapshotPathFor(graphPath) : graphPath,\n  };\n\n  if (options.report !== false) {\n    const reportPath = path.join(companions, 'GRAPH_REPORT.md');\n    fs.writeFileSync(reportPath, renderReport(graph));\n    written.reportPath = reportPath;\n  }\n\n  if (options.html !== false) {\n    const htmlPath = path.join(companions, 'graph.html');\n    fs.writeFileSync(htmlPath, renderHtml(graph));\n    written.htmlPath = htmlPath;\n  }\n\n  // facts.jsonl (deterministic NDJSON) when facts were derived.\n  if (graph.facts && graph.facts.length) {\n    const factsPath = path.join(companions, 'facts.jsonl');\n    fs.writeFileSync(factsPath, graph.facts.map((f) => JSON.stringify(f)).join('\\n') + '\\n');\n    written.factsPath = factsPath;\n  }\n\n  return written;\n}\n\nfunction isPathInside(child: string, parent: string): boolean {\n  const rel = path.relative(path.resolve(parent), path.resolve(child));\n  return rel === '' || (!rel.startsWith('..') && !path.isAbsolute(rel));\n}\n","/**\n * Graph enrichment via the optional relevance provider: per-node TOPIC TAGS,\n * stored as a binary sidecar BOUND TO ONE EXACT GRAPH.\n *\n * When the installed provider exposes `tagNode`, every graph node gets a\n * deterministic topic tag set derived from path/identifier evidence\n * (\"src/payments/DirectDebitMandate.ts\" → [\"payments\"]). Query-time ranking\n * then adds a bounded affinity bonus when the question's inferred topics\n * intersect a node's tags.\n *\n * Storage contract (the part that keeps everything in step):\n *\n *  - Tags NEVER enter `graph.json` — byte-identical output for identical\n *    input is a hard invariant of `vg build`.\n *  - The sidecar lives BESIDE the resolved graph artifact\n *    (`<id>.graph.tags.snap` next to `<id>.graph.json` / `.graph.snap`).\n *    Graphs are branch-keyed in the global repository store (Fusion §4.1.1),\n *    so switching branches resolves a different graph file — and therefore a\n *    different sidecar — with zero extra bookkeeping. Legacy in-repo maps get\n *    `.vibgrate/graph.tags.snap` (gitignored alongside `graph.snap`).\n *  - The binding is CONTENT identity, not path or time: the header records\n *    the graph's `provenance.corpusHash` (blake3 over the included file set)\n *    and is trusted only when it matches the LOADED graph. A rebuild, a\n *    branch switch served through the same path, or a hand-swapped file all\n *    invalidate it exactly; anything published downstream (vgd scans) that\n *    carries the graph's corpusHash can verify the tags belong to it.\n *  - The provider version and engine VERSION are recorded and must match — a\n *    kernel/pack or CLI upgrade recomputes cleanly.\n *  - Any mismatch, torn file (CRC), decode error, or provider fault degrades\n *    to recompute-or-null; a sidecar problem must never break ranking.\n *  - Writes are atomic (temp + rename) and best-effort; the graph write path\n *    (engine/artifacts.ts) deletes the sidecar whenever the graph at that\n *    path is rewritten or removed, so an orphaned sidecar cannot outlive its\n *    graph.\n *\n * Format (mirrors engine/snapshot.ts conventions): MAGIC (\"VGTAGS1\\0\") ·\n * u32LE header length · msgpack header {engine, provider, corpusHash, crc32}\n * · msgpack payload (node id → tags, sorted by id). Explicit little-endian,\n * pure-JS msgpackr, fresh Packr per encode/decode — no platform variance.\n */\nimport * as fs from 'node:fs';\nimport * as path from 'node:path';\nimport * as zlib from 'node:zlib';\nimport { Packr } from 'msgpackr';\nimport { loadRelevanceProvider } from './relevance-provider.js';\nimport { resolveGraphPath } from './artifacts.js';\nimport { VERSION } from '../version.js';\nimport type { VgGraph } from '../schema.js';\n\nconst MAGIC = Buffer.from('VGTAGS1\\0', 'latin1');\n\n/** node:zlib gained crc32 in 22.2; engines pins Node >= 22 so it's present,\n *  but guard anyway (same posture as engine/snapshot.ts). */\nconst crc32: (data: Uint8Array) => number = zlib.crc32 ?? (() => 0);\n\ninterface TagsHeader {\n  engine: string;\n  provider: string;\n  corpusHash: string;\n  crc32: number;\n}\n\nfunction newPackr(): Packr {\n  return new Packr({ useRecords: true });\n}\n\n/** Sidecar path for a resolved graph artifact path. */\nexport function tagsSidecarPathFor(graphPath: string): string {\n  return graphPath.endsWith('.json') ? `${graphPath.slice(0, -5)}.tags.snap` : `${graphPath}.tags.snap`;\n}\n\n/** Remove the tags sidecar for a graph path (graph rewrite/removal hook). */\nexport function deleteTagsSidecarFor(graphPath: string): void {\n  try {\n    fs.rmSync(tagsSidecarPathFor(graphPath), { force: true });\n  } catch {\n    /* best-effort — a locked file self-invalidates via corpusHash anyway */\n  }\n}\n\nfunction readSidecar(file: string, expect: { provider: string; corpusHash: string }): Record<string, string[]> | null {\n  try {\n    if (!fs.existsSync(file)) return null;\n    const raw = fs.readFileSync(file);\n    if (raw.length < MAGIC.length + 4 || !raw.subarray(0, MAGIC.length).equals(MAGIC)) return null;\n    const headerLen = raw.readUInt32LE(MAGIC.length);\n    const headerStart = MAGIC.length + 4;\n    if (raw.length < headerStart + headerLen) return null;\n    const header = newPackr().unpack(raw.subarray(headerStart, headerStart + headerLen)) as TagsHeader;\n    if (header.engine !== VERSION) return null;\n    if (header.provider !== expect.provider) return null;\n    if (header.corpusHash !== expect.corpusHash) return null;\n    const payload = raw.subarray(headerStart + headerLen);\n    if ((crc32(payload) >>> 0) !== (header.crc32 >>> 0)) return null;\n    const tags = newPackr().unpack(payload) as Record<string, string[]>;\n    return tags && typeof tags === 'object' ? tags : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction writeSidecar(file: string, meta: { provider: string; corpusHash: string }, tags: Record<string, string[]>): void {\n  try {\n    // Deterministic payload: sorted node ids.\n    const sorted = Object.fromEntries(Object.entries(tags).sort(([a], [b]) => (a < b ? -1 : 1)));\n    const payload = newPackr().pack(sorted);\n    const header = newPackr().pack({\n      engine: VERSION,\n      provider: meta.provider,\n      corpusHash: meta.corpusHash,\n      crc32: crc32(payload) >>> 0,\n    } satisfies TagsHeader);\n    const lenBuf = Buffer.alloc(4);\n    lenBuf.writeUInt32LE(header.length);\n    fs.mkdirSync(path.dirname(file), { recursive: true });\n    const tmp = `${file}.${process.pid}.tmp`;\n    fs.writeFileSync(tmp, Buffer.concat([MAGIC, lenBuf, Buffer.from(header), Buffer.from(payload)]));\n    fs.renameSync(tmp, file);\n  } catch {\n    // Best-effort: a full disk or read-only store never fails a query.\n  }\n}\n\n/**\n * Topic tags for every scorable node of THIS graph, computed through the\n * provider and cached in the graph's own sidecar. Returns `null` when no\n * provider (or none with `tagNode`) is active — callers treat that as \"no\n * enrichment\" and proceed unchanged.\n *\n * `graphPath` should be the path the graph was actually loaded from (the MCP\n * server and `vg ask` pass it); when omitted it is re-resolved from the root\n * with the same branch-keyed rules `loadGraph` uses, so the sidecar always\n * sits beside the graph the current workspace state resolves to.\n */\nexport async function loadTopicTags(\n  graph: VgGraph,\n  root: string,\n  graphPath?: string,\n): Promise<Map<string, readonly string[]> | null> {\n  const provider = await loadRelevanceProvider();\n  if (!provider?.tagNode) return null;\n  let providerVersion: string;\n  try {\n    providerVersion = provider.version();\n  } catch {\n    return null;\n  }\n  const corpusHash = graph.provenance?.corpusHash;\n  if (!corpusHash) return null; // no content identity → no cacheable binding\n\n  const file = tagsSidecarPathFor(graphPath?.trim() ? path.resolve(graphPath) : resolveGraphPath(root));\n  const cached = readSidecar(file, { provider: providerVersion, corpusHash });\n  if (cached) {\n    const tags = new Map<string, readonly string[]>();\n    for (const [id, t] of Object.entries(cached)) if (t.length) tags.set(id, t);\n    return tags;\n  }\n\n  const record: Record<string, string[]> = {};\n  const tags = new Map<string, readonly string[]>();\n  try {\n    for (const node of graph.nodes) {\n      if (node.kind === 'file' || node.kind === 'external') continue;\n      const computed = provider.tagNode({ qualifiedName: node.qualifiedName, file: node.file }) ?? [];\n      // Sanitize at the trust boundary: strings only, lowercased, capped.\n      const clean = computed\n        .filter((t) => typeof t === 'string' && t.length > 0)\n        .map((t) => t.toLowerCase())\n        .slice(0, 3);\n      record[node.id] = clean;\n      if (clean.length) tags.set(node.id, clean);\n    }\n  } catch {\n    return null; // a faulting provider must never break ranking\n  }\n  writeSidecar(file, { provider: providerVersion, corpusHash }, record);\n  return tags;\n}\n"]}

package/dist/{chunk-3SOJZ3VV.js → chunk-IKB5U3AH.js}

@@ -1,4 +1,4 @@
-import { ensureVibgrateGitignore } from './chunk-C5AOLTQS.js';
+import { ensureVibgrateGitignore } from './chunk-III7S75O.js';
 import fs from 'fs';
 import path from 'path';
 
@@ -170,5 +170,5 @@ function findMatchingRule(action, rules) {
 }
 
 export { addApprovalRule, approvalsPath, findMatchingRule, globMatch, loadApprovalRules, normalizeCommandPrefix, removeApprovalRule, ruleForAction, ruleKey, ruleLabel, saveApprovalRules };
-//# sourceMappingURL=chunk-3SOJZ3VV.js.map
-//# sourceMappingURL=chunk-3SOJZ3VV.js.map
+//# sourceMappingURL=chunk-IKB5U3AH.js.map
+//# sourceMappingURL=chunk-IKB5U3AH.js.map

package/dist/{chunk-3SOJZ3VV.js.map → chunk-IKB5U3AH.js.map}

@@ -1 +1 @@
-{"version":3,"sources":["../src/code/approvals.ts"],"names":[],"mappings":";;;;AA+BO,SAAS,cAAc,IAAA,EAAsB;AAClD,EAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,WAAA,EAAa,qBAAqB,CAAA;AAC3D;AAMO,SAAS,QAAQ,IAAA,EAA4B;AAClD,EAAA,IAAI,KAAK,IAAA,KAAS,KAAA,EAAO,OAAO,CAAA,IAAA,EAAO,KAAK,MAAM,CAAA,CAAA;AAClD,EAAA,IAAI,KAAK,IAAA,KAAS,MAAA,EAAQ,OAAO,CAAA,KAAA,EAAQ,KAAK,IAAI,CAAA,CAAA;AAClD,EAAA,OAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAClC;AAGO,SAAS,UAAU,IAAA,EAA4B;AACpD,EAAA,IAAI,KAAK,IAAA,KAAS,KAAA,EAAO,OAAO,CAAA,MAAA,EAAS,KAAK,MAAM,CAAA,SAAA,CAAA;AACpD,EAAA,IAAI,KAAK,IAAA,KAAS,MAAA,EAAQ,OAAO,CAAA,KAAA,EAAQ,KAAK,IAAI,CAAA,CAAA;AAClD,EAAA,OAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAClC;AAOO,SAAS,kBAAkB,IAAA,EAA8B;AAC9D,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAA,CAAK,MAAM,EAAA,CAAG,YAAA,CAAa,cAAc,IAAI,CAAA,EAAG,MAAM,CAAC,CAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,GAC1B,MACA,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,MAAM,OAAA,CAAS,GAAA,CAA4B,KAAK,CAAA,GAC9E,GAAA,CAA6B,QAC/B,EAAC;AACP,EAAA,MAAM,MAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,QAAQ,IAAA,EAAM;AACvB,IAAA,MAAM,IAAA,GAAO,aAAa,IAAI,CAAA;AAC9B,IAAA,IAAI,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,EACzB;AACA,EAAA,OAAO,OAAO,GAAG,CAAA;AACnB;AAEA,SAAS,aAAa,IAAA,EAAoC;AACxD,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,UAAU,OAAO,IAAA;AAC9C,EAAA,MAAM,CAAA,GAAI,IAAA;AACV,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,KAAA,IAAS,OAAO,CAAA,CAAE,WAAW,QAAA,IAAY,CAAA,CAAE,MAAA,CAAO,IAAA,EAAK,EAAG;AACvE,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,QAAQ,sBAAA,CAAuB,CAAA,CAAE,MAAM,CAAA,EAAE;AAAA,EACjE;AACA,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,OAAO,CAAA,CAAE,SAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,IAAA,EAAK,EAAG;AACpE,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,MAAK,EAAE;AAAA,EAC7C;AACA,EAAA,IAAA,CAAK,EAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,YAAY,CAAA,CAAE,IAAA,KAAS,QAAA,KAAa,OAAO,EAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAK,EAAG;AACpH,IAAA,OAAO,EAAE,MAAM,CAAA,CAAE,IAAA,EAAM,MAAM,CAAA,CAAE,IAAA,CAAK,MAAK,EAAE;AAAA,EAC7C;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,OAAO,KAAA,EAAuC;AACrD,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,MAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,MAAM,GAAA,GAAM,QAAQ,CAAC,CAAA;AACrB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACZ;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,iBAAA,CAAkB,MAAc,KAAA,EAAgC;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,WAAW,CAAA;AACvC,IAAA,EAAA,CAAG,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AAGrC,IAAA,uBAAA,CAAwB,IAAI,CAAA;AAC5B,IAAA,MAAM,SAAS,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,GAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,QAAQ,CAAC,CAAA,CAAE,cAAc,OAAA,CAAQ,CAAC,CAAC,CAAC,CAAA;AACxF,IAAA,EAAA,CAAG,aAAA,CAAc,aAAA,CAAc,IAAI,CAAA,EAAG,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,MAAA,EAAO,EAAG,IAAA,EAAM,CAAC,CAAC;AAAA,CAAI,CAAA;AACvF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAGO,SAAS,eAAA,CAAgB,MAAc,IAAA,EAAyC;AACrF,EAAA,MAAM,KAAA,GAAQ,kBAAkB,IAAI,CAAA;AACpC,EAAA,IAAI,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,OAAA,CAAQ,CAAC,CAAA,KAAM,OAAA,CAAQ,IAAI,CAAC,CAAA,EAAG,OAAO,IAAA;AAC5D,EAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AACf,EAAA,OAAO,iBAAA,CAAkB,IAAA,EAAM,KAAK,CAAA,GAAI,IAAA,GAAO,IAAA;AACjD;AAGO,SAAS,kBAAA,CAAmB,MAAc,GAAA,EAAsB;AACrE,EAAA,MAAM,KAAA,GAAQ,kBAAkB,IAAI,CAAA;AACpC,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,CAAC,MAAM,OAAA,CAAQ,CAAC,MAAM,GAAG,CAAA;AACnD,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,KAAA,CAAM,MAAA,EAAQ,OAAO,KAAA;AACzC,EAAA,OAAO,iBAAA,CAAkB,MAAM,IAAI,CAAA;AACrC;AAYO,SAAS,uBAAuB,OAAA,EAAyB;AAC9D,EAAA,MAAM,MAAA,GAAS,QAAQ,IAAA,EAAK,CAAE,MAAM,KAAK,CAAA,CAAE,OAAO,OAAO,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,CAAC,CAAA,IAAK,EAAA;AAC1B,EAAA,MAAM,MAAA,GAAS,OAAO,CAAC,CAAA;AACvB,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,IAAI,OAAO,UAAA,CAAW,GAAG,GAAG,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAGlD,EAAA,IAAI,OAAO,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,UAAA,CAAW,GAAG,CAAC,CAAA,EAAG,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAC3E,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAC1B;AAGA,SAAS,iBAAiB,MAAA,EAAyB;AACjD,EAAA,OAAO,CAAC,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,GAAG,CAAC,CAAA;AACzD;AAUA,IAAM,eAAA,GAAkB,iBAAA;AAOjB,SAAS,cAAc,MAAA,EAA6C;AACzE,EAAA,QAAQ,OAAO,IAAA;AAAM,IACnB,KAAK,KAAA;AACH,MAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,QAAQ,sBAAA,CAAuB,MAAA,CAAO,OAAO,CAAA,EAAE;AAAA,IACvE,KAAK,MAAA;AACH,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,OAAO,IAAA,EAAK;AAAA,IAC3C,KAAK,MAAA;AAAA,IACL,KAAK,QAAA;AAAA,IACL,KAAK,QAAA;AACH,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,OAAO,IAAA,EAAK;AAAA,IAChD,KAAK,OAAA;AACH,MAAA,OAAO,IAAA;AAAA;AAEb;AAOO,SAAS,SAAA,CAAU,MAAc,IAAA,EAAuB;AAC7D,EAAA,IAAI,EAAA,GAAK,EAAA;AACT,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,MAAM,CAAA,GAAI,KAAK,CAAC,CAAA;AAChB,IAAA,IAAI,MAAM,GAAA,EAAK;AACb,MAAA,IAAI,IAAA,CAAK,CAAA,GAAI,CAAC,CAAA,KAAM,GAAA,EAAK;AAEvB,QAAA,EAAA,IAAM,IAAA;AACN,QAAA,CAAA,IAAK,IAAA,CAAK,CAAA,GAAI,CAAC,CAAA,KAAM,MAAM,CAAA,GAAI,CAAA;AAAA,MACjC,CAAA,MAAO;AACL,QAAA,EAAA,IAAM,OAAA;AAAA,MACR;AAAA,IACF,CAAA,MAAA,IAAW,MAAM,GAAA,EAAK;AACpB,MAAA,EAAA,IAAM,MAAA;AAAA,IACR,CAAA,MAAA,IAAW,eAAA,CAAgB,QAAA,CAAS,CAAC,CAAA,EAAG;AACtC,MAAA,EAAA,IAAM,KAAK,CAAC,CAAA,CAAA;AAAA,IACd,CAAA,MAAO;AACL,MAAA,EAAA,IAAM,CAAA;AAAA,IACR;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,CAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAA,CAAgB,KAAA,EAAuB,EAAA,EAAkC,IAAA,EAAmC;AACnH,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI,CAAA,CAAE,SAAS,EAAA,IAAM,SAAA,CAAU,EAAE,IAAA,EAAM,IAAI,GAAG,OAAO,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,gBAAA,CAAiB,QAAwB,KAAA,EAA4C;AACnG,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,EAAQ,OAAO,IAAA;AAC1B,EAAA,QAAQ,OAAO,IAAA;AAAM,IACnB,KAAK,KAAA,EAAO;AAKV,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,OAAA,CAAQ,IAAA,EAAK,CAAE,KAAA,CAAM,KAAK,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACxE,MAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,QAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACtB,QAAA,IAAI,IAAA,KAAS,CAAA,CAAE,MAAA,EAAQ,OAAO,CAAA;AAK9B,QAAA,IAAI,gBAAA,CAAiB,CAAA,CAAE,MAAM,CAAA,IAAK,IAAA,CAAK,WAAW,CAAA,EAAG,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA,EAAG;AACjE,UAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,MAAA,CAAO,SAAS,CAAC,CAAA;AAI3C,UAAA,IAAI,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA,EAAG;AAChC,UAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAChC,UAAA,IAAI,SAAA,CAAU,MAAM,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,GAAG,CAAC,CAAA,EAAG,OAAO,CAAA;AAAA,QACxD;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,IACA,KAAK,MAAA;AACH,MAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,MAAA,CAAO,IAAI,CAAA,IAAK,IAAA;AAAA,IAC3E,KAAK,MAAA;AAAA,IACL,KAAK,QAAA;AAAA,IACL,KAAK,QAAA;AACH,MAAA,OAAO,eAAA,CAAgB,KAAA,EAAO,MAAA,CAAO,IAAA,EAAM,OAAO,IAAI,CAAA;AAAA,IACxD,KAAK,OAAA,EAAS;AACZ,MAAA,MAAM,OAAA,GAAU,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,KAAuB,eAAA,CAAgB,KAAA,EAAO,CAAA,CAAE,EAAA,EAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AAC/F,MAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,MAAA,OAAO,eAAA,CAAgB,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,CAAG,EAAA,EAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,CAAG,IAAI,CAAA;AAAA,IAC1E;AAAA;AAEJ","file":"chunk-3SOJZ3VV.js","sourcesContent":["/**\n * Allow-always approval rules (P2 — permission parity).\n *\n * The approval gate exists to review state changes, but reviewing the *same*\n * change shape every time (`pnpm test`, edits to a scratch dir) is friction\n * without safety. A user can promote an approval to a standing rule\n * (\"Always allow\"); rules live in `.vibgrate/code-approvals.json` at the repo\n * root so the CLI and VS Code honour the same set, and are re-read on every\n * approval so a revocation (from the VG Code manage UI or by editing the\n * file) takes effect immediately — no session restart, no stale cache.\n *\n * Rules never widen safety: {@link dangerousCommand} still screens every rule\n * match, plan mode still denies everything engine-side before rules are\n * consulted, and a rule-approved action is still announced (notice event) and\n * checkpointed like any human-approved change.\n */\n\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ensureVibgrateGitignore } from '../engine/artifacts.js';\nimport type { MutatingAction, PatchFileAction } from './tools.js';\n\n/** One standing approval. Discriminated by `kind`, mirroring MutatingAction. */\nexport type ApprovalRule =\n  /** Matches `run` actions whose normalized command starts with these tokens. */\n  | { kind: 'run'; prefix: string }\n  /** Matches a single-file action of that op when the path matches the glob. */\n  | { kind: 'edit' | 'create' | 'delete'; glob: string }\n  /** Matches external `tool` calls by tool name. */\n  | { kind: 'tool'; tool: string };\n\nexport function approvalsPath(root: string): string {\n  return path.join(root, '.vibgrate', 'code-approvals.json');\n}\n\n/**\n * The stable identity of a rule — used for dedupe and for revocation from\n * hosts that only carry the display string.\n */\nexport function ruleKey(rule: ApprovalRule): string {\n  if (rule.kind === 'run') return `run:${rule.prefix}`;\n  if (rule.kind === 'tool') return `tool:${rule.tool}`;\n  return `${rule.kind}:${rule.glob}`;\n}\n\n/** Human-readable label for notices and manage UIs. */\nexport function ruleLabel(rule: ApprovalRule): string {\n  if (rule.kind === 'run') return `run \\`${rule.prefix} …\\``;\n  if (rule.kind === 'tool') return `call ${rule.tool}`;\n  return `${rule.kind} ${rule.glob}`;\n}\n\n/**\n * Load the rule set, tolerating absence and malformed JSON (an unreadable file\n * means \"no rules\", never a crash — same posture as `.vibgrate/code.json`).\n * Unknown shapes are dropped so an untrusted file cannot inject junk.\n */\nexport function loadApprovalRules(root: string): ApprovalRule[] {\n  let raw: unknown;\n  try {\n    raw = JSON.parse(fs.readFileSync(approvalsPath(root), 'utf8'));\n  } catch {\n    return [];\n  }\n  const list = Array.isArray(raw)\n    ? raw\n    : raw && typeof raw === 'object' && Array.isArray((raw as { rules?: unknown }).rules)\n      ? ((raw as { rules: unknown[] }).rules)\n      : [];\n  const out: ApprovalRule[] = [];\n  for (const item of list) {\n    const rule = sanitizeRule(item);\n    if (rule) out.push(rule);\n  }\n  return dedupe(out);\n}\n\nfunction sanitizeRule(item: unknown): ApprovalRule | null {\n  if (!item || typeof item !== 'object') return null;\n  const o = item as Record<string, unknown>;\n  if (o.kind === 'run' && typeof o.prefix === 'string' && o.prefix.trim()) {\n    return { kind: 'run', prefix: normalizeCommandPrefix(o.prefix) };\n  }\n  if (o.kind === 'tool' && typeof o.tool === 'string' && o.tool.trim()) {\n    return { kind: 'tool', tool: o.tool.trim() };\n  }\n  if ((o.kind === 'edit' || o.kind === 'create' || o.kind === 'delete') && typeof o.glob === 'string' && o.glob.trim()) {\n    return { kind: o.kind, glob: o.glob.trim() };\n  }\n  return null;\n}\n\nfunction dedupe(rules: ApprovalRule[]): ApprovalRule[] {\n  const seen = new Set<string>();\n  const out: ApprovalRule[] = [];\n  for (const r of rules) {\n    const key = ruleKey(r);\n    if (seen.has(key)) continue;\n    seen.add(key);\n    out.push(r);\n  }\n  return out;\n}\n\n/**\n * Persist the rule set, deterministically sorted so identical sets produce an\n * identical file. Best-effort like other `.vibgrate/` writers — a read-only\n * checkout means no standing rules, never a thrown error mid-approval.\n */\nexport function saveApprovalRules(root: string, rules: ApprovalRule[]): boolean {\n  try {\n    const dir = path.join(root, '.vibgrate');\n    fs.mkdirSync(dir, { recursive: true });\n    // First writer into .vibgrate/ creates its .gitignore (create-once): one\n    // developer's standing consents must not ride into the team's repo.\n    ensureVibgrateGitignore(root);\n    const sorted = dedupe(rules).slice().sort((a, b) => ruleKey(a).localeCompare(ruleKey(b)));\n    fs.writeFileSync(approvalsPath(root), `${JSON.stringify({ rules: sorted }, null, 2)}\\n`);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Add one rule (deduped). Returns the saved rule, or null when nothing was written. */\nexport function addApprovalRule(root: string, rule: ApprovalRule): ApprovalRule | null {\n  const rules = loadApprovalRules(root);\n  if (rules.some((r) => ruleKey(r) === ruleKey(rule))) return rule;\n  rules.push(rule);\n  return saveApprovalRules(root, rules) ? rule : null;\n}\n\n/** Remove the rule with this {@link ruleKey}. Returns true when one was removed and saved. */\nexport function removeApprovalRule(root: string, key: string): boolean {\n  const rules = loadApprovalRules(root);\n  const kept = rules.filter((r) => ruleKey(r) !== key);\n  if (kept.length === rules.length) return false;\n  return saveApprovalRules(root, kept);\n}\n\n/**\n * Normalize a shell command to its rule prefix: the first two tokens for the\n * `cmd subcommand [flags…]` shape (`git status`, `pnpm test --watch`), the\n * single token for a one-word command, and the *whole* command\n * (whitespace-normalized) in every other case. Collapsing `rm -f temp.log` to\n * bare `rm` — or `rm foo.log secrets.env` to `rm foo.log` — would turn one\n * blessed invocation into a standing grant covering paths the user never saw\n * (2026-08 audit, D2), so a command with a flag second-token or positional\n * arguments beyond the subcommand keeps its exact form.\n */\nexport function normalizeCommandPrefix(command: string): string {\n  const tokens = command.trim().split(/\\s+/).filter(Boolean);\n  const head = tokens[0] ?? '';\n  const second = tokens[1];\n  if (!second) return head;\n  if (second.startsWith('-')) return tokens.join(' ');\n  // Extra positionals after `cmd subcommand` make the rule exact; trailing\n  // flags still collapse to the extensible two-token prefix.\n  if (tokens.slice(2).some((t) => !t.startsWith('-'))) return tokens.join(' ');\n  return `${head} ${second}`;\n}\n\n/** True when a rule prefix is the extensible `cmd [subcommand]` shape (no flags). */\nfunction extensiblePrefix(prefix: string): boolean {\n  return !prefix.split(' ').some((t) => t.startsWith('-'));\n}\n\n/**\n * Shell constructs that can smuggle a second command into what looks like a\n * flag: command substitution, redirects, sequencing, backgrounding, subshells.\n * A `pnpm test` rule must not bless `pnpm test --reporter=$(curl … | sh)` —\n * the appended token is flag-shaped, but its *value* is another program the\n * user never saw. Same screen {@link readOnlyCommand} applies; kept local so\n * safety and approvals stay independent modules.\n */\nconst SHELL_METACHARS = /[><;&|`\\n(){}$]/;\n\n/**\n * Derive the standing rule an \"Always allow\" on this action should create.\n * Patch actions return null — an atomic multi-file transaction has no single\n * honest generalisation, so hosts do not offer Always on patch cards.\n */\nexport function ruleForAction(action: MutatingAction): ApprovalRule | null {\n  switch (action.kind) {\n    case 'run':\n      return { kind: 'run', prefix: normalizeCommandPrefix(action.command) };\n    case 'tool':\n      return { kind: 'tool', tool: action.name };\n    case 'edit':\n    case 'create':\n    case 'delete':\n      return { kind: action.kind, glob: action.file };\n    case 'patch':\n      return null;\n  }\n}\n\n/**\n * Minimal glob match for rule paths: `*` matches within a segment, `**`\n * across segments, `?` one character. Deterministic, no dependency, and\n * conservative — a malformed pattern simply never matches.\n */\nexport function globMatch(glob: string, file: string): boolean {\n  let re = '';\n  for (let i = 0; i < glob.length; i++) {\n    const c = glob[i];\n    if (c === '*') {\n      if (glob[i + 1] === '*') {\n        // `**/` or trailing `**` — match across segments.\n        re += '.*';\n        i += glob[i + 2] === '/' ? 2 : 1;\n      } else {\n        re += '[^/]*';\n      }\n    } else if (c === '?') {\n      re += '[^/]';\n    } else if ('\\\\^$.|+()[]{}'.includes(c)) {\n      re += `\\\\${c}`;\n    } else {\n      re += c;\n    }\n  }\n  try {\n    return new RegExp(`^${re}$`).test(file);\n  } catch {\n    return false;\n  }\n}\n\nfunction fileRuleMatches(rules: ApprovalRule[], op: 'edit' | 'create' | 'delete', file: string): ApprovalRule | null {\n  for (const r of rules) {\n    if (r.kind === op && globMatch(r.glob, file)) return r;\n  }\n  return null;\n}\n\n/**\n * The first rule matching this action, or null. A `patch` matches only when\n * *every* file in the transaction is covered by a matching file rule — an\n * atomic approval must never be half-earned.\n */\nexport function findMatchingRule(action: MutatingAction, rules: ApprovalRule[]): ApprovalRule | null {\n  if (!rules.length) return null;\n  switch (action.kind) {\n    case 'run': {\n      // Match the FULL whitespace-normalized command, never a truncated form:\n      // collapsing `rm foo.log secrets.env` to its first two tokens before\n      // comparing would silently discard the appended argument and let a rule\n      // saved for `rm foo.log` bless it (2026-08 audit, D2).\n      const full = action.command.trim().split(/\\s+/).filter(Boolean).join(' ');\n      for (const r of rules) {\n        if (r.kind !== 'run') continue;\n        if (full === r.prefix) return r;\n        // A `cmd [subcommand]` prefix extends to longer commands only when\n        // every appended token is a flag (`git status --short`). Appended\n        // positionals (extra paths, script arguments) are new state the user\n        // never blessed — they re-prompt, and can be Always-allowed exactly.\n        if (extensiblePrefix(r.prefix) && full.startsWith(`${r.prefix} `)) {\n          const tail = full.slice(r.prefix.length + 1);\n          // A flag whose value is a subshell is not an extension of the blessed\n          // command, it is a different one — screen the appended text before\n          // the flag-shape check, never after.\n          if (SHELL_METACHARS.test(tail)) continue;\n          const extension = tail.split(' ');\n          if (extension.every((t) => t.startsWith('-'))) return r;\n        }\n      }\n      return null;\n    }\n    case 'tool':\n      return rules.find((r) => r.kind === 'tool' && r.tool === action.name) ?? null;\n    case 'edit':\n    case 'create':\n    case 'delete':\n      return fileRuleMatches(rules, action.kind, action.file);\n    case 'patch': {\n      const covered = action.files.every((f: PatchFileAction) => fileRuleMatches(rules, f.op, f.file));\n      if (!covered) return null;\n      return fileRuleMatches(rules, action.files[0]!.op, action.files[0]!.file);\n    }\n  }\n}\n"]}
+{"version":3,"sources":["../src/code/approvals.ts"],"names":[],"mappings":";;;;AA+BO,SAAS,cAAc,IAAA,EAAsB;AAClD,EAAA,OAAO,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,WAAA,EAAa,qBAAqB,CAAA;AAC3D;AAMO,SAAS,QAAQ,IAAA,EAA4B;AAClD,EAAA,IAAI,KAAK,IAAA,KAAS,KAAA,EAAO,OAAO,CAAA,IAAA,EAAO,KAAK,MAAM,CAAA,CAAA;AAClD,EAAA,IAAI,KAAK,IAAA,KAAS,MAAA,EAAQ,OAAO,CAAA,KAAA,EAAQ,KAAK,IAAI,CAAA,CAAA;AAClD,EAAA,OAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAClC;AAGO,SAAS,UAAU,IAAA,EAA4B;AACpD,EAAA,IAAI,KAAK,IAAA,KAAS,KAAA,EAAO,OAAO,CAAA,MAAA,EAAS,KAAK,MAAM,CAAA,SAAA,CAAA;AACpD,EAAA,IAAI,KAAK,IAAA,KAAS,MAAA,EAAQ,OAAO,CAAA,KAAA,EAAQ,KAAK,IAAI,CAAA,CAAA;AAClD,EAAA,OAAO,CAAA,EAAG,IAAA,CAAK,IAAI,CAAA,CAAA,EAAI,KAAK,IAAI,CAAA,CAAA;AAClC;AAOO,SAAS,kBAAkB,IAAA,EAA8B;AAC9D,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,GAAA,GAAM,IAAA,CAAK,MAAM,EAAA,CAAG,YAAA,CAAa,cAAc,IAAI,CAAA,EAAG,MAAM,CAAC,CAAA;AAAA,EAC/D,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAC;AAAA,EACV;AACA,EAAA,MAAM,OAAO,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA,GAC1B,MACA,GAAA,IAAO,OAAO,GAAA,KAAQ,QAAA,IAAY,MAAM,OAAA,CAAS,GAAA,CAA4B,KAAK,CAAA,GAC9E,GAAA,CAA6B,QAC/B,EAAC;AACP,EAAA,MAAM,MAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,QAAQ,IAAA,EAAM;AACvB,IAAA,MAAM,IAAA,GAAO,aAAa,IAAI,CAAA;AAC9B,IAAA,IAAI,IAAA,EAAM,GAAA,CAAI,IAAA,CAAK,IAAI,CAAA;AAAA,EACzB;AACA,EAAA,OAAO,OAAO,GAAG,CAAA;AACnB;AAEA,SAAS,aAAa,IAAA,EAAoC;AACxD,EAAA,IAAI,CAAC,IAAA,IAAQ,OAAO,IAAA,KAAS,UAAU,OAAO,IAAA;AAC9C,EAAA,MAAM,CAAA,GAAI,IAAA;AACV,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,KAAA,IAAS,OAAO,CAAA,CAAE,WAAW,QAAA,IAAY,CAAA,CAAE,MAAA,CAAO,IAAA,EAAK,EAAG;AACvE,IAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,QAAQ,sBAAA,CAAuB,CAAA,CAAE,MAAM,CAAA,EAAE;AAAA,EACjE;AACA,EAAA,IAAI,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,OAAO,CAAA,CAAE,SAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,IAAA,EAAK,EAAG;AACpE,IAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,MAAM,CAAA,CAAE,IAAA,CAAK,MAAK,EAAE;AAAA,EAC7C;AACA,EAAA,IAAA,CAAK,EAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,YAAY,CAAA,CAAE,IAAA,KAAS,QAAA,KAAa,OAAO,EAAE,IAAA,KAAS,QAAA,IAAY,CAAA,CAAE,IAAA,CAAK,MAAK,EAAG;AACpH,IAAA,OAAO,EAAE,MAAM,CAAA,CAAE,IAAA,EAAM,MAAM,CAAA,CAAE,IAAA,CAAK,MAAK,EAAE;AAAA,EAC7C;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,OAAO,KAAA,EAAuC;AACrD,EAAA,MAAM,IAAA,uBAAW,GAAA,EAAY;AAC7B,EAAA,MAAM,MAAsB,EAAC;AAC7B,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,MAAM,GAAA,GAAM,QAAQ,CAAC,CAAA;AACrB,IAAA,IAAI,IAAA,CAAK,GAAA,CAAI,GAAG,CAAA,EAAG;AACnB,IAAA,IAAA,CAAK,IAAI,GAAG,CAAA;AACZ,IAAA,GAAA,CAAI,KAAK,CAAC,CAAA;AAAA,EACZ;AACA,EAAA,OAAO,GAAA;AACT;AAOO,SAAS,iBAAA,CAAkB,MAAc,KAAA,EAAgC;AAC9E,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAA,CAAK,IAAA,CAAK,IAAA,EAAM,WAAW,CAAA;AACvC,IAAA,EAAA,CAAG,SAAA,CAAU,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AAGrC,IAAA,uBAAA,CAAwB,IAAI,CAAA;AAC5B,IAAA,MAAM,SAAS,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,GAAQ,IAAA,CAAK,CAAC,CAAA,EAAG,CAAA,KAAM,QAAQ,CAAC,CAAA,CAAE,cAAc,OAAA,CAAQ,CAAC,CAAC,CAAC,CAAA;AACxF,IAAA,EAAA,CAAG,aAAA,CAAc,aAAA,CAAc,IAAI,CAAA,EAAG,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,MAAA,EAAO,EAAG,IAAA,EAAM,CAAC,CAAC;AAAA,CAAI,CAAA;AACvF,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAGO,SAAS,eAAA,CAAgB,MAAc,IAAA,EAAyC;AACrF,EAAA,MAAM,KAAA,GAAQ,kBAAkB,IAAI,CAAA;AACpC,EAAA,IAAI,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,OAAA,CAAQ,CAAC,CAAA,KAAM,OAAA,CAAQ,IAAI,CAAC,CAAA,EAAG,OAAO,IAAA;AAC5D,EAAA,KAAA,CAAM,KAAK,IAAI,CAAA;AACf,EAAA,OAAO,iBAAA,CAAkB,IAAA,EAAM,KAAK,CAAA,GAAI,IAAA,GAAO,IAAA;AACjD;AAGO,SAAS,kBAAA,CAAmB,MAAc,GAAA,EAAsB;AACrE,EAAA,MAAM,KAAA,GAAQ,kBAAkB,IAAI,CAAA;AACpC,EAAA,MAAM,IAAA,GAAO,MAAM,MAAA,CAAO,CAAC,MAAM,OAAA,CAAQ,CAAC,MAAM,GAAG,CAAA;AACnD,EAAA,IAAI,IAAA,CAAK,MAAA,KAAW,KAAA,CAAM,MAAA,EAAQ,OAAO,KAAA;AACzC,EAAA,OAAO,iBAAA,CAAkB,MAAM,IAAI,CAAA;AACrC;AAYO,SAAS,uBAAuB,OAAA,EAAyB;AAC9D,EAAA,MAAM,MAAA,GAAS,QAAQ,IAAA,EAAK,CAAE,MAAM,KAAK,CAAA,CAAE,OAAO,OAAO,CAAA;AACzD,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,CAAC,CAAA,IAAK,EAAA;AAC1B,EAAA,MAAM,MAAA,GAAS,OAAO,CAAC,CAAA;AACvB,EAAA,IAAI,CAAC,QAAQ,OAAO,IAAA;AACpB,EAAA,IAAI,OAAO,UAAA,CAAW,GAAG,GAAG,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAGlD,EAAA,IAAI,OAAO,KAAA,CAAM,CAAC,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAC,CAAA,CAAE,UAAA,CAAW,GAAG,CAAC,CAAA,EAAG,OAAO,MAAA,CAAO,KAAK,GAAG,CAAA;AAC3E,EAAA,OAAO,CAAA,EAAG,IAAI,CAAA,CAAA,EAAI,MAAM,CAAA,CAAA;AAC1B;AAGA,SAAS,iBAAiB,MAAA,EAAyB;AACjD,EAAA,OAAO,CAAC,MAAA,CAAO,KAAA,CAAM,GAAG,CAAA,CAAE,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,UAAA,CAAW,GAAG,CAAC,CAAA;AACzD;AAUA,IAAM,eAAA,GAAkB,iBAAA;AAOjB,SAAS,cAAc,MAAA,EAA6C;AACzE,EAAA,QAAQ,OAAO,IAAA;AAAM,IACnB,KAAK,KAAA;AACH,MAAA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,QAAQ,sBAAA,CAAuB,MAAA,CAAO,OAAO,CAAA,EAAE;AAAA,IACvE,KAAK,MAAA;AACH,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,OAAO,IAAA,EAAK;AAAA,IAC3C,KAAK,MAAA;AAAA,IACL,KAAK,QAAA;AAAA,IACL,KAAK,QAAA;AACH,MAAA,OAAO,EAAE,IAAA,EAAM,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,OAAO,IAAA,EAAK;AAAA,IAChD,KAAK,OAAA;AACH,MAAA,OAAO,IAAA;AAAA;AAEb;AAOO,SAAS,SAAA,CAAU,MAAc,IAAA,EAAuB;AAC7D,EAAA,IAAI,EAAA,GAAK,EAAA;AACT,EAAA,KAAA,IAAS,CAAA,GAAI,CAAA,EAAG,CAAA,GAAI,IAAA,CAAK,QAAQ,CAAA,EAAA,EAAK;AACpC,IAAA,MAAM,CAAA,GAAI,KAAK,CAAC,CAAA;AAChB,IAAA,IAAI,MAAM,GAAA,EAAK;AACb,MAAA,IAAI,IAAA,CAAK,CAAA,GAAI,CAAC,CAAA,KAAM,GAAA,EAAK;AAEvB,QAAA,EAAA,IAAM,IAAA;AACN,QAAA,CAAA,IAAK,IAAA,CAAK,CAAA,GAAI,CAAC,CAAA,KAAM,MAAM,CAAA,GAAI,CAAA;AAAA,MACjC,CAAA,MAAO;AACL,QAAA,EAAA,IAAM,OAAA;AAAA,MACR;AAAA,IACF,CAAA,MAAA,IAAW,MAAM,GAAA,EAAK;AACpB,MAAA,EAAA,IAAM,MAAA;AAAA,IACR,CAAA,MAAA,IAAW,eAAA,CAAgB,QAAA,CAAS,CAAC,CAAA,EAAG;AACtC,MAAA,EAAA,IAAM,KAAK,CAAC,CAAA,CAAA;AAAA,IACd,CAAA,MAAO;AACL,MAAA,EAAA,IAAM,CAAA;AAAA,IACR;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,OAAO,IAAI,MAAA,CAAO,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,CAAG,CAAA,CAAE,KAAK,IAAI,CAAA;AAAA,EACxC,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;AAEA,SAAS,eAAA,CAAgB,KAAA,EAAuB,EAAA,EAAkC,IAAA,EAAmC;AACnH,EAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,IAAA,IAAI,CAAA,CAAE,SAAS,EAAA,IAAM,SAAA,CAAU,EAAE,IAAA,EAAM,IAAI,GAAG,OAAO,CAAA;AAAA,EACvD;AACA,EAAA,OAAO,IAAA;AACT;AAOO,SAAS,gBAAA,CAAiB,QAAwB,KAAA,EAA4C;AACnG,EAAA,IAAI,CAAC,KAAA,CAAM,MAAA,EAAQ,OAAO,IAAA;AAC1B,EAAA,QAAQ,OAAO,IAAA;AAAM,IACnB,KAAK,KAAA,EAAO;AAKV,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,OAAA,CAAQ,IAAA,EAAK,CAAE,KAAA,CAAM,KAAK,CAAA,CAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AACxE,MAAA,KAAA,MAAW,KAAK,KAAA,EAAO;AACrB,QAAA,IAAI,CAAA,CAAE,SAAS,KAAA,EAAO;AACtB,QAAA,IAAI,IAAA,KAAS,CAAA,CAAE,MAAA,EAAQ,OAAO,CAAA;AAK9B,QAAA,IAAI,gBAAA,CAAiB,CAAA,CAAE,MAAM,CAAA,IAAK,IAAA,CAAK,WAAW,CAAA,EAAG,CAAA,CAAE,MAAM,CAAA,CAAA,CAAG,CAAA,EAAG;AACjE,UAAA,MAAM,OAAO,IAAA,CAAK,KAAA,CAAM,CAAA,CAAE,MAAA,CAAO,SAAS,CAAC,CAAA;AAI3C,UAAA,IAAI,eAAA,CAAgB,IAAA,CAAK,IAAI,CAAA,EAAG;AAChC,UAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,GAAG,CAAA;AAChC,UAAA,IAAI,SAAA,CAAU,MAAM,CAAC,CAAA,KAAM,EAAE,UAAA,CAAW,GAAG,CAAC,CAAA,EAAG,OAAO,CAAA;AAAA,QACxD;AAAA,MACF;AACA,MAAA,OAAO,IAAA;AAAA,IACT;AAAA,IACA,KAAK,MAAA;AACH,MAAA,OAAO,KAAA,CAAM,IAAA,CAAK,CAAC,CAAA,KAAM,CAAA,CAAE,IAAA,KAAS,MAAA,IAAU,CAAA,CAAE,IAAA,KAAS,MAAA,CAAO,IAAI,CAAA,IAAK,IAAA;AAAA,IAC3E,KAAK,MAAA;AAAA,IACL,KAAK,QAAA;AAAA,IACL,KAAK,QAAA;AACH,MAAA,OAAO,eAAA,CAAgB,KAAA,EAAO,MAAA,CAAO,IAAA,EAAM,OAAO,IAAI,CAAA;AAAA,IACxD,KAAK,OAAA,EAAS;AACZ,MAAA,MAAM,OAAA,GAAU,MAAA,CAAO,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA,KAAuB,eAAA,CAAgB,KAAA,EAAO,CAAA,CAAE,EAAA,EAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AAC/F,MAAA,IAAI,CAAC,SAAS,OAAO,IAAA;AACrB,MAAA,OAAO,eAAA,CAAgB,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,CAAG,EAAA,EAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,CAAG,IAAI,CAAA;AAAA,IAC1E;AAAA;AAEJ","file":"chunk-IKB5U3AH.js","sourcesContent":["/**\n * Allow-always approval rules (P2 — permission parity).\n *\n * The approval gate exists to review state changes, but reviewing the *same*\n * change shape every time (`pnpm test`, edits to a scratch dir) is friction\n * without safety. A user can promote an approval to a standing rule\n * (\"Always allow\"); rules live in `.vibgrate/code-approvals.json` at the repo\n * root so the CLI and VS Code honour the same set, and are re-read on every\n * approval so a revocation (from the VG Code manage UI or by editing the\n * file) takes effect immediately — no session restart, no stale cache.\n *\n * Rules never widen safety: {@link dangerousCommand} still screens every rule\n * match, plan mode still denies everything engine-side before rules are\n * consulted, and a rule-approved action is still announced (notice event) and\n * checkpointed like any human-approved change.\n */\n\nimport fs from 'node:fs';\nimport path from 'node:path';\nimport { ensureVibgrateGitignore } from '../engine/artifacts.js';\nimport type { MutatingAction, PatchFileAction } from './tools.js';\n\n/** One standing approval. Discriminated by `kind`, mirroring MutatingAction. */\nexport type ApprovalRule =\n  /** Matches `run` actions whose normalized command starts with these tokens. */\n  | { kind: 'run'; prefix: string }\n  /** Matches a single-file action of that op when the path matches the glob. */\n  | { kind: 'edit' | 'create' | 'delete'; glob: string }\n  /** Matches external `tool` calls by tool name. */\n  | { kind: 'tool'; tool: string };\n\nexport function approvalsPath(root: string): string {\n  return path.join(root, '.vibgrate', 'code-approvals.json');\n}\n\n/**\n * The stable identity of a rule — used for dedupe and for revocation from\n * hosts that only carry the display string.\n */\nexport function ruleKey(rule: ApprovalRule): string {\n  if (rule.kind === 'run') return `run:${rule.prefix}`;\n  if (rule.kind === 'tool') return `tool:${rule.tool}`;\n  return `${rule.kind}:${rule.glob}`;\n}\n\n/** Human-readable label for notices and manage UIs. */\nexport function ruleLabel(rule: ApprovalRule): string {\n  if (rule.kind === 'run') return `run \\`${rule.prefix} …\\``;\n  if (rule.kind === 'tool') return `call ${rule.tool}`;\n  return `${rule.kind} ${rule.glob}`;\n}\n\n/**\n * Load the rule set, tolerating absence and malformed JSON (an unreadable file\n * means \"no rules\", never a crash — same posture as `.vibgrate/code.json`).\n * Unknown shapes are dropped so an untrusted file cannot inject junk.\n */\nexport function loadApprovalRules(root: string): ApprovalRule[] {\n  let raw: unknown;\n  try {\n    raw = JSON.parse(fs.readFileSync(approvalsPath(root), 'utf8'));\n  } catch {\n    return [];\n  }\n  const list = Array.isArray(raw)\n    ? raw\n    : raw && typeof raw === 'object' && Array.isArray((raw as { rules?: unknown }).rules)\n      ? ((raw as { rules: unknown[] }).rules)\n      : [];\n  const out: ApprovalRule[] = [];\n  for (const item of list) {\n    const rule = sanitizeRule(item);\n    if (rule) out.push(rule);\n  }\n  return dedupe(out);\n}\n\nfunction sanitizeRule(item: unknown): ApprovalRule | null {\n  if (!item || typeof item !== 'object') return null;\n  const o = item as Record<string, unknown>;\n  if (o.kind === 'run' && typeof o.prefix === 'string' && o.prefix.trim()) {\n    return { kind: 'run', prefix: normalizeCommandPrefix(o.prefix) };\n  }\n  if (o.kind === 'tool' && typeof o.tool === 'string' && o.tool.trim()) {\n    return { kind: 'tool', tool: o.tool.trim() };\n  }\n  if ((o.kind === 'edit' || o.kind === 'create' || o.kind === 'delete') && typeof o.glob === 'string' && o.glob.trim()) {\n    return { kind: o.kind, glob: o.glob.trim() };\n  }\n  return null;\n}\n\nfunction dedupe(rules: ApprovalRule[]): ApprovalRule[] {\n  const seen = new Set<string>();\n  const out: ApprovalRule[] = [];\n  for (const r of rules) {\n    const key = ruleKey(r);\n    if (seen.has(key)) continue;\n    seen.add(key);\n    out.push(r);\n  }\n  return out;\n}\n\n/**\n * Persist the rule set, deterministically sorted so identical sets produce an\n * identical file. Best-effort like other `.vibgrate/` writers — a read-only\n * checkout means no standing rules, never a thrown error mid-approval.\n */\nexport function saveApprovalRules(root: string, rules: ApprovalRule[]): boolean {\n  try {\n    const dir = path.join(root, '.vibgrate');\n    fs.mkdirSync(dir, { recursive: true });\n    // First writer into .vibgrate/ creates its .gitignore (create-once): one\n    // developer's standing consents must not ride into the team's repo.\n    ensureVibgrateGitignore(root);\n    const sorted = dedupe(rules).slice().sort((a, b) => ruleKey(a).localeCompare(ruleKey(b)));\n    fs.writeFileSync(approvalsPath(root), `${JSON.stringify({ rules: sorted }, null, 2)}\\n`);\n    return true;\n  } catch {\n    return false;\n  }\n}\n\n/** Add one rule (deduped). Returns the saved rule, or null when nothing was written. */\nexport function addApprovalRule(root: string, rule: ApprovalRule): ApprovalRule | null {\n  const rules = loadApprovalRules(root);\n  if (rules.some((r) => ruleKey(r) === ruleKey(rule))) return rule;\n  rules.push(rule);\n  return saveApprovalRules(root, rules) ? rule : null;\n}\n\n/** Remove the rule with this {@link ruleKey}. Returns true when one was removed and saved. */\nexport function removeApprovalRule(root: string, key: string): boolean {\n  const rules = loadApprovalRules(root);\n  const kept = rules.filter((r) => ruleKey(r) !== key);\n  if (kept.length === rules.length) return false;\n  return saveApprovalRules(root, kept);\n}\n\n/**\n * Normalize a shell command to its rule prefix: the first two tokens for the\n * `cmd subcommand [flags…]` shape (`git status`, `pnpm test --watch`), the\n * single token for a one-word command, and the *whole* command\n * (whitespace-normalized) in every other case. Collapsing `rm -f temp.log` to\n * bare `rm` — or `rm foo.log secrets.env` to `rm foo.log` — would turn one\n * blessed invocation into a standing grant covering paths the user never saw\n * (2026-08 audit, D2), so a command with a flag second-token or positional\n * arguments beyond the subcommand keeps its exact form.\n */\nexport function normalizeCommandPrefix(command: string): string {\n  const tokens = command.trim().split(/\\s+/).filter(Boolean);\n  const head = tokens[0] ?? '';\n  const second = tokens[1];\n  if (!second) return head;\n  if (second.startsWith('-')) return tokens.join(' ');\n  // Extra positionals after `cmd subcommand` make the rule exact; trailing\n  // flags still collapse to the extensible two-token prefix.\n  if (tokens.slice(2).some((t) => !t.startsWith('-'))) return tokens.join(' ');\n  return `${head} ${second}`;\n}\n\n/** True when a rule prefix is the extensible `cmd [subcommand]` shape (no flags). */\nfunction extensiblePrefix(prefix: string): boolean {\n  return !prefix.split(' ').some((t) => t.startsWith('-'));\n}\n\n/**\n * Shell constructs that can smuggle a second command into what looks like a\n * flag: command substitution, redirects, sequencing, backgrounding, subshells.\n * A `pnpm test` rule must not bless `pnpm test --reporter=$(curl … | sh)` —\n * the appended token is flag-shaped, but its *value* is another program the\n * user never saw. Same screen {@link readOnlyCommand} applies; kept local so\n * safety and approvals stay independent modules.\n */\nconst SHELL_METACHARS = /[><;&|`\\n(){}$]/;\n\n/**\n * Derive the standing rule an \"Always allow\" on this action should create.\n * Patch actions return null — an atomic multi-file transaction has no single\n * honest generalisation, so hosts do not offer Always on patch cards.\n */\nexport function ruleForAction(action: MutatingAction): ApprovalRule | null {\n  switch (action.kind) {\n    case 'run':\n      return { kind: 'run', prefix: normalizeCommandPrefix(action.command) };\n    case 'tool':\n      return { kind: 'tool', tool: action.name };\n    case 'edit':\n    case 'create':\n    case 'delete':\n      return { kind: action.kind, glob: action.file };\n    case 'patch':\n      return null;\n  }\n}\n\n/**\n * Minimal glob match for rule paths: `*` matches within a segment, `**`\n * across segments, `?` one character. Deterministic, no dependency, and\n * conservative — a malformed pattern simply never matches.\n */\nexport function globMatch(glob: string, file: string): boolean {\n  let re = '';\n  for (let i = 0; i < glob.length; i++) {\n    const c = glob[i];\n    if (c === '*') {\n      if (glob[i + 1] === '*') {\n        // `**/` or trailing `**` — match across segments.\n        re += '.*';\n        i += glob[i + 2] === '/' ? 2 : 1;\n      } else {\n        re += '[^/]*';\n      }\n    } else if (c === '?') {\n      re += '[^/]';\n    } else if ('\\\\^$.|+()[]{}'.includes(c)) {\n      re += `\\\\${c}`;\n    } else {\n      re += c;\n    }\n  }\n  try {\n    return new RegExp(`^${re}$`).test(file);\n  } catch {\n    return false;\n  }\n}\n\nfunction fileRuleMatches(rules: ApprovalRule[], op: 'edit' | 'create' | 'delete', file: string): ApprovalRule | null {\n  for (const r of rules) {\n    if (r.kind === op && globMatch(r.glob, file)) return r;\n  }\n  return null;\n}\n\n/**\n * The first rule matching this action, or null. A `patch` matches only when\n * *every* file in the transaction is covered by a matching file rule — an\n * atomic approval must never be half-earned.\n */\nexport function findMatchingRule(action: MutatingAction, rules: ApprovalRule[]): ApprovalRule | null {\n  if (!rules.length) return null;\n  switch (action.kind) {\n    case 'run': {\n      // Match the FULL whitespace-normalized command, never a truncated form:\n      // collapsing `rm foo.log secrets.env` to its first two tokens before\n      // comparing would silently discard the appended argument and let a rule\n      // saved for `rm foo.log` bless it (2026-08 audit, D2).\n      const full = action.command.trim().split(/\\s+/).filter(Boolean).join(' ');\n      for (const r of rules) {\n        if (r.kind !== 'run') continue;\n        if (full === r.prefix) return r;\n        // A `cmd [subcommand]` prefix extends to longer commands only when\n        // every appended token is a flag (`git status --short`). Appended\n        // positionals (extra paths, script arguments) are new state the user\n        // never blessed — they re-prompt, and can be Always-allowed exactly.\n        if (extensiblePrefix(r.prefix) && full.startsWith(`${r.prefix} `)) {\n          const tail = full.slice(r.prefix.length + 1);\n          // A flag whose value is a subshell is not an extension of the blessed\n          // command, it is a different one — screen the appended text before\n          // the flag-shape check, never after.\n          if (SHELL_METACHARS.test(tail)) continue;\n          const extension = tail.split(' ');\n          if (extension.every((t) => t.startsWith('-'))) return r;\n        }\n      }\n      return null;\n    }\n    case 'tool':\n      return rules.find((r) => r.kind === 'tool' && r.tool === action.name) ?? null;\n    case 'edit':\n    case 'create':\n    case 'delete':\n      return fileRuleMatches(rules, action.kind, action.file);\n    case 'patch': {\n      const covered = action.files.every((f: PatchFileAction) => fileRuleMatches(rules, f.op, f.file));\n      if (!covered) return null;\n      return fileRuleMatches(rules, action.files[0]!.op, action.files[0]!.file);\n    }\n  }\n}\n"]}

package/dist/{chunk-QOU2Q5L4.js → chunk-JL66EPZ4.js}

@@ -1,20 +1,231 @@
-import { refreshIfStale } from './chunk-TD4JAEMH.js';
-import { listedToolNames, budgetSuffix, TOOLS, renderToolResult, warmEmbedderInBackground, countTokens } from './chunk-XAS45W3G.js';
-import { sanitizeClient, recordSaving, SAVINGS_TOOLS, PER_FILE_TOKENS } from './chunk-UAPA5AHX.js';
-import { attachVgd } from './chunk-UEXDSWKN.js';
+import { refreshIfStale } from './chunk-XHIWQGRE.js';
+import { listedToolNames, budgetSuffix, TOOLS, renderToolResult, warmEmbedderInBackground, countTokens } from './chunk-KRE7SXSA.js';
+import { sanitizeClient, recordSaving, SAVINGS_TOOLS, PER_FILE_TOKENS } from './chunk-TWWVTKA7.js';
+import { attachVgd } from './chunk-LMHKIQA5.js';
 import { formatSemanticProgress } from './chunk-5IQBIXHS.js';
 import { isRelevantChange } from './chunk-DBX3DL27.js';
-import { loadGraphPreferIndex } from './chunk-ARGYMFST.js';
+import { loadGraphPreferIndex } from './chunk-SGIFJIII.js';
 import { vgdRequest } from './chunk-VHRSG6CF.js';
-import { mapFileStat, renderHtml, renderReport } from './chunk-C5AOLTQS.js';
+import { relevanceModuleDir, resetRelevanceProviderCache, mapFileStat, renderHtml, renderReport } from './chunk-III7S75O.js';
 import { parseGraph, slimGraphForExport, serializeGraph } from './chunk-O3LABX6I.js';
-import { VERSION } from './chunk-MQJY4EQV.js';
+import { VERSION } from './chunk-AGOKTI77.js';
 import * as fs from 'fs';
 import * as path from 'path';
+import * as os from 'os';
+import * as zlib from 'zlib';
+import { createHash } from 'crypto';
 import { Server } from '@modelcontextprotocol/sdk/server/index.js';
 import { StdioServerTransport } from '@modelcontextprotocol/sdk/server/stdio.js';
 import { ListToolsRequestSchema, CallToolRequestSchema } from '@modelcontextprotocol/sdk/types.js';
 
+var DEFAULT_REGISTRY = "https://registry.npmjs.org";
+function registryBase(opts) {
+  return (process.env.VIBGRATE_MODULE_REGISTRY || opts.registry || DEFAULT_REGISTRY).replace(/\/+$/, "");
+}
+function modulesBaseDir() {
+  const base = process.env.XDG_CACHE_HOME || path.join(os.homedir(), ".cache");
+  return path.join(base, "vibgrate", "modules");
+}
+function stateFile() {
+  return path.join(modulesBaseDir(), "consent.json");
+}
+function readConsent() {
+  try {
+    return JSON.parse(fs.readFileSync(stateFile(), "utf8"));
+  } catch {
+    return {};
+  }
+}
+function writeConsent(state) {
+  try {
+    fs.mkdirSync(path.dirname(stateFile()), { recursive: true });
+    fs.writeFileSync(stateFile(), JSON.stringify(state));
+  } catch {
+  }
+}
+function kernelDisabled() {
+  const v = process.env.VIBGRATE_NO_KERNEL;
+  return v === "1" || v === "true";
+}
+function moduleInstalledAt(dir) {
+  try {
+    const meta = JSON.parse(fs.readFileSync(path.join(dir, ".module.json"), "utf8"));
+    if (fs.existsSync(path.join(dir, "index.js"))) {
+      return { installed: true, version: meta.version };
+    }
+  } catch {
+  }
+  return { installed: false };
+}
+function verifyIntegrity(buf, integrity, shasum) {
+  if (integrity) {
+    const [algo, expected] = integrity.split("-", 2);
+    if (!algo || !expected) throw new Error("malformed integrity metadata");
+    const actual = createHash(algo).update(buf).digest("base64");
+    if (actual !== expected) throw new Error(`integrity mismatch (${algo})`);
+    return;
+  }
+  if (shasum) {
+    const actual = createHash("sha1").update(buf).digest("hex");
+    if (actual !== shasum) throw new Error("integrity mismatch (shasum)");
+    return;
+  }
+  throw new Error("registry provided no integrity metadata");
+}
+function untar(data) {
+  const out = [];
+  let offset = 0;
+  let pendingName = null;
+  while (offset + 512 <= data.length) {
+    const block = data.subarray(offset, offset + 512);
+    offset += 512;
+    if (block.every((b) => b === 0)) continue;
+    const rawName = block.subarray(0, 100).toString("utf8").replace(/\0.*$/, "");
+    const size = parseInt(block.subarray(124, 136).toString("utf8").replace(/\0.*$/, "").trim() || "0", 8);
+    const type = String.fromCharCode(block[156]);
+    const prefix = block.subarray(345, 500).toString("utf8").replace(/\0.*$/, "");
+    const body = data.subarray(offset, offset + size);
+    offset += Math.ceil(size / 512) * 512;
+    if (type === "L") {
+      pendingName = body.toString("utf8").replace(/\0.*$/, "");
+      continue;
+    }
+    if (type === "x" || type === "g") {
+      const m = /(?:^|\n)\d+ path=([^\n]+)\n/.exec(body.toString("utf8"));
+      if (m) pendingName = m[1];
+      continue;
+    }
+    if (type !== "0" && type !== "\0") continue;
+    const name = pendingName ?? (prefix ? `${prefix}/${rawName}` : rawName);
+    pendingName = null;
+    if (name.split("/").includes("..") || path.isAbsolute(name)) {
+      throw new Error(`unsafe path in tarball: ${name}`);
+    }
+    out.push({ name, body: Buffer.from(body) });
+  }
+  return out;
+}
+async function installModule(mod, opts = {}) {
+  if (kernelDisabled()) return { status: "disabled", detail: "VIBGRATE_NO_KERNEL is set" };
+  const existing = moduleInstalledAt(mod.dir());
+  if (existing.installed && !opts.force) return { status: "already-installed", version: existing.version };
+  const doFetch = opts.fetchImpl ?? fetch;
+  const base = registryBase(opts);
+  try {
+    const metaRes = await doFetch(`${base}/${mod.npmName.replace("/", "%2f")}`);
+    if (!metaRes.ok) return { status: "unavailable", detail: `registry ${metaRes.status}` };
+    const meta = await metaRes.json();
+    const version = meta["dist-tags"]?.latest;
+    const dist = version ? meta.versions?.[version]?.dist : void 0;
+    if (!version || !dist?.tarball) return { status: "unavailable", detail: "no published version" };
+    const tarRes = await doFetch(dist.tarball);
+    if (!tarRes.ok) return { status: "unavailable", detail: `tarball ${tarRes.status}` };
+    const gz = Buffer.from(await tarRes.arrayBuffer());
+    verifyIntegrity(gz, dist.integrity, dist.shasum);
+    const entries = untar(zlib.gunzipSync(gz));
+    const dir = mod.dir();
+    fs.rmSync(dir, { recursive: true, force: true });
+    fs.mkdirSync(dir, { recursive: true });
+    let wrote = 0;
+    for (const e of entries) {
+      let rel = null;
+      if (e.name.startsWith("package/dist/")) rel = e.name.slice("package/dist/".length);
+      else if (e.name === "package/LICENSE" || e.name === "package/README.md") rel = e.name.slice("package/".length);
+      if (!rel) continue;
+      const target = path.join(dir, rel);
+      if (!target.startsWith(dir + path.sep) && target !== dir) throw new Error(`unsafe extract path: ${rel}`);
+      fs.mkdirSync(path.dirname(target), { recursive: true });
+      fs.writeFileSync(target, e.body);
+      wrote += 1;
+    }
+    if (!wrote || !fs.existsSync(path.join(dir, "index.js"))) {
+      fs.rmSync(dir, { recursive: true, force: true });
+      return { status: "unavailable", detail: "package layout not recognized (no dist/index.js)" };
+    }
+    fs.writeFileSync(path.join(dir, ".module.json"), JSON.stringify({ name: mod.npmName, version }));
+    mod.onChanged?.();
+    return { status: "installed", version };
+  } catch (e) {
+    return { status: "unavailable", detail: String(e.message ?? e).slice(0, 200) };
+  }
+}
+function removeModule(mod) {
+  fs.rmSync(mod.dir(), { recursive: true, force: true });
+  mod.onChanged?.();
+}
+
+// src/install/relevance-module.ts
+var RELEVANCE_MODULE_NAME = "@vibgrate/relevance";
+var RELEVANCE_MODULE = {
+  id: "relevance",
+  npmName: RELEVANCE_MODULE_NAME,
+  dir: relevanceModuleDir,
+  onChanged: resetRelevanceProviderCache
+};
+function moduleInstalled() {
+  return moduleInstalledAt(relevanceModuleDir());
+}
+var DISCLOSURE = "vg can install the optional Vibgrate relevance module (proprietary license, runs fully locally, improves how questions find the code they mean). Disable any time with VIBGRATE_NO_KERNEL=1.";
+async function installRelevanceModule(opts = {}) {
+  return installModule(RELEVANCE_MODULE, opts);
+}
+function removeRelevanceModule() {
+  removeModule(RELEVANCE_MODULE);
+}
+var RANKING_MIN_MODULE_VERSION = "2026.823.0";
+function versionAtLeast(version, min) {
+  if (!version) return false;
+  const a = version.split(".").map((n) => Number(n));
+  const b = min.split(".").map((n) => Number(n));
+  for (let i = 0; i < Math.max(a.length, b.length); i++) {
+    const x = a[i] ?? 0;
+    const y = b[i] ?? 0;
+    if (!Number.isFinite(x)) return false;
+    if (x !== y) return x > y;
+  }
+  return true;
+}
+async function ensureRelevanceModule(io = {}) {
+  try {
+    if (kernelDisabled()) return { status: "disabled" };
+    if (readConsent().relevance === "denied") return { status: "declined" };
+    const existing = moduleInstalled();
+    if (existing.installed) {
+      if (versionAtLeast(existing.version, RANKING_MIN_MODULE_VERSION)) {
+        return { status: "already-installed", version: existing.version };
+      }
+      return await installRelevanceModule({ fetchImpl: io.fetchImpl, force: true });
+    }
+    return await installRelevanceModule({ fetchImpl: io.fetchImpl });
+  } catch {
+    return { status: "unavailable", detail: "auto-install failed" };
+  }
+}
+var READINESS_THROTTLE_MS = 60 * 60 * 1e3;
+function kickRelevanceReadiness(io = {}) {
+  try {
+    if (kernelDisabled()) return;
+    if (readConsent().relevance === "denied") return;
+    const existing = moduleInstalled();
+    if (existing.installed && versionAtLeast(existing.version, RANKING_MIN_MODULE_VERSION)) return;
+    const modulesRoot = path.dirname(relevanceModuleDir());
+    const stamp = path.join(modulesRoot, "relevance.last-attempt");
+    try {
+      const at = Number(fs.readFileSync(stamp, "utf8"));
+      if (Number.isFinite(at) && Date.now() - at < READINESS_THROTTLE_MS) return;
+    } catch {
+    }
+    try {
+      fs.mkdirSync(modulesRoot, { recursive: true });
+      fs.writeFileSync(stamp, String(Date.now()));
+    } catch {
+    }
+    void ensureRelevanceModule(io).catch(() => {
+    });
+  } catch {
+  }
+}
+
 // src/engine/refresh-scheduler.ts
 var PROBE_INTERVAL_MS = 2e3;
 var MAX_PROBE_INTERVAL_MS = 3e4;
@@ -813,6 +1024,6 @@ function spdx(ctx) {
   return JSON.stringify(doc, null, 2) + "\n";
 }
 
-export { DaemonSemanticSession, GraphSource, RefreshScheduler, createServer, exportGraph, formatForExt, serveStdio };
-//# sourceMappingURL=chunk-QOU2Q5L4.js.map
-//# sourceMappingURL=chunk-QOU2Q5L4.js.map
+export { DISCLOSURE, DaemonSemanticSession, GraphSource, RELEVANCE_MODULE_NAME, RefreshScheduler, createServer, ensureRelevanceModule, exportGraph, formatForExt, installModule, installRelevanceModule, kernelDisabled, kickRelevanceReadiness, moduleInstalled, moduleInstalledAt, modulesBaseDir, readConsent, removeModule, removeRelevanceModule, serveStdio, writeConsent };
+//# sourceMappingURL=chunk-JL66EPZ4.js.map
+//# sourceMappingURL=chunk-JL66EPZ4.js.map