approval-md 0.2.0 → 0.3.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (235) hide show
  1. package/README.md +63 -24
  2. package/SPEC.md +57 -11
  3. package/dist/src/channels/contract.d.ts +34 -1
  4. package/dist/src/channels/contract.js +200 -7
  5. package/dist/src/channels/contract.js.map +1 -1
  6. package/dist/src/channels/telegram.d.ts +123 -11
  7. package/dist/src/channels/telegram.js +218 -23
  8. package/dist/src/channels/telegram.js.map +1 -1
  9. package/dist/src/channels/web.d.ts +9 -0
  10. package/dist/src/channels/web.js +17 -0
  11. package/dist/src/channels/web.js.map +1 -1
  12. package/dist/src/cli/amend.js +214 -30
  13. package/dist/src/cli/amend.js.map +1 -1
  14. package/dist/src/cli/attest.d.ts +9 -0
  15. package/dist/src/cli/attest.js +134 -7
  16. package/dist/src/cli/attest.js.map +1 -1
  17. package/dist/src/cli/channel-telegram.d.ts +99 -26
  18. package/dist/src/cli/channel-telegram.js +311 -13
  19. package/dist/src/cli/channel-telegram.js.map +1 -1
  20. package/dist/src/cli/channel.d.ts +9 -0
  21. package/dist/src/cli/channel.js +9 -0
  22. package/dist/src/cli/channel.js.map +1 -1
  23. package/dist/src/cli/codex-bridge.d.ts +819 -0
  24. package/dist/src/cli/codex-bridge.js +1607 -0
  25. package/dist/src/cli/codex-bridge.js.map +1 -0
  26. package/dist/src/cli/codex.d.ts +1 -1
  27. package/dist/src/cli/codex.js +304 -7
  28. package/dist/src/cli/codex.js.map +1 -1
  29. package/dist/src/cli/daemon.js +4 -1
  30. package/dist/src/cli/daemon.js.map +1 -1
  31. package/dist/src/cli/doctor.js +467 -12
  32. package/dist/src/cli/doctor.js.map +1 -1
  33. package/dist/src/cli/execute.js +25 -2
  34. package/dist/src/cli/execute.js.map +1 -1
  35. package/dist/src/cli/help.d.ts +6 -2
  36. package/dist/src/cli/help.js +165 -60
  37. package/dist/src/cli/help.js.map +1 -1
  38. package/dist/src/cli/hook-codex.d.ts +49 -1
  39. package/dist/src/cli/hook-codex.js +60 -1
  40. package/dist/src/cli/hook-codex.js.map +1 -1
  41. package/dist/src/cli/hook.d.ts +459 -3
  42. package/dist/src/cli/hook.js +1062 -114
  43. package/dist/src/cli/hook.js.map +1 -1
  44. package/dist/src/cli/import.js +1 -1
  45. package/dist/src/cli/import.js.map +1 -1
  46. package/dist/src/cli/main.js +5 -3
  47. package/dist/src/cli/main.js.map +1 -1
  48. package/dist/src/cli/policy-apply.d.ts +195 -0
  49. package/dist/src/cli/policy-apply.js +573 -0
  50. package/dist/src/cli/policy-apply.js.map +1 -0
  51. package/dist/src/cli/policy.js +14 -1
  52. package/dist/src/cli/policy.js.map +1 -1
  53. package/dist/src/cli/preflight.d.ts +151 -13
  54. package/dist/src/cli/preflight.js +398 -41
  55. package/dist/src/cli/preflight.js.map +1 -1
  56. package/dist/src/cli/sandbox.js +17 -1
  57. package/dist/src/cli/sandbox.js.map +1 -1
  58. package/dist/src/cli/scaffold.d.ts +1 -1
  59. package/dist/src/cli/scaffold.js +1 -1
  60. package/dist/src/cli/setup-channel.d.ts +9 -0
  61. package/dist/src/cli/setup-channel.js +28 -1
  62. package/dist/src/cli/setup-channel.js.map +1 -1
  63. package/dist/src/cli/setup-common.d.ts +3 -1
  64. package/dist/src/cli/setup-common.js +3 -2
  65. package/dist/src/cli/setup-common.js.map +1 -1
  66. package/dist/src/cli/setup.d.ts +2 -0
  67. package/dist/src/cli/setup.js +94 -2
  68. package/dist/src/cli/setup.js.map +1 -1
  69. package/dist/src/cli/up.js +115 -51
  70. package/dist/src/cli/up.js.map +1 -1
  71. package/dist/src/cli/values.js +3 -4
  72. package/dist/src/cli/values.js.map +1 -1
  73. package/dist/src/cli/verb-registry.js +174 -9
  74. package/dist/src/cli/verb-registry.js.map +1 -1
  75. package/dist/src/cli/wordmark.d.ts +2 -2
  76. package/dist/src/cli/wordmark.js +2 -2
  77. package/dist/src/codex/broker.d.ts +229 -0
  78. package/dist/src/codex/broker.js +548 -0
  79. package/dist/src/codex/broker.js.map +1 -0
  80. package/dist/src/codex/runner.d.ts +178 -0
  81. package/dist/src/codex/runner.js +231 -0
  82. package/dist/src/codex/runner.js.map +1 -0
  83. package/dist/src/codex/serve.d.ts +56 -0
  84. package/dist/src/codex/serve.js +98 -0
  85. package/dist/src/codex/serve.js.map +1 -0
  86. package/dist/src/codex/workspace-commit.d.ts +219 -0
  87. package/dist/src/codex/workspace-commit.js +549 -0
  88. package/dist/src/codex/workspace-commit.js.map +1 -0
  89. package/dist/src/core/advance-cycle.d.ts +51 -0
  90. package/dist/src/core/advance-cycle.js +66 -2
  91. package/dist/src/core/advance-cycle.js.map +1 -1
  92. package/dist/src/core/agents-md.d.ts +20 -18
  93. package/dist/src/core/agents-md.js +33 -31
  94. package/dist/src/core/agents-md.js.map +1 -1
  95. package/dist/src/core/attest.d.ts +215 -0
  96. package/dist/src/core/attest.js +317 -7
  97. package/dist/src/core/attest.js.map +1 -1
  98. package/dist/src/core/audit.d.ts +18 -0
  99. package/dist/src/core/audit.js +13 -0
  100. package/dist/src/core/audit.js.map +1 -1
  101. package/dist/src/core/channel-owner.d.ts +213 -0
  102. package/dist/src/core/channel-owner.js +358 -0
  103. package/dist/src/core/channel-owner.js.map +1 -0
  104. package/dist/src/core/command-class.d.ts +154 -0
  105. package/dist/src/core/command-class.js +673 -20
  106. package/dist/src/core/command-class.js.map +1 -1
  107. package/dist/src/core/commit-guard.d.ts +272 -0
  108. package/dist/src/core/commit-guard.js +424 -0
  109. package/dist/src/core/commit-guard.js.map +1 -0
  110. package/dist/src/core/daemon-actor.d.ts +45 -0
  111. package/dist/src/core/daemon-actor.js +54 -0
  112. package/dist/src/core/daemon-actor.js.map +1 -0
  113. package/dist/src/core/dark-session.d.ts +109 -8
  114. package/dist/src/core/dark-session.js +266 -82
  115. package/dist/src/core/dark-session.js.map +1 -1
  116. package/dist/src/core/decision-refusal.d.ts +23 -2
  117. package/dist/src/core/decision-refusal.js +24 -2
  118. package/dist/src/core/decision-refusal.js.map +1 -1
  119. package/dist/src/core/env-file.d.ts +5 -0
  120. package/dist/src/core/env-file.js +60 -1
  121. package/dist/src/core/env-file.js.map +1 -1
  122. package/dist/src/core/execute.d.ts +15 -2
  123. package/dist/src/core/execute.js +15 -2
  124. package/dist/src/core/execute.js.map +1 -1
  125. package/dist/src/core/gate.d.ts +86 -1
  126. package/dist/src/core/gate.js +81 -1
  127. package/dist/src/core/gate.js.map +1 -1
  128. package/dist/src/core/gesture-refusal.d.ts +166 -0
  129. package/dist/src/core/gesture-refusal.js +188 -0
  130. package/dist/src/core/gesture-refusal.js.map +1 -0
  131. package/dist/src/core/harness-version.d.ts +1 -1
  132. package/dist/src/core/harness-version.js +3 -1
  133. package/dist/src/core/harness-version.js.map +1 -1
  134. package/dist/src/core/instance.d.ts +59 -2
  135. package/dist/src/core/instance.js +113 -0
  136. package/dist/src/core/instance.js.map +1 -1
  137. package/dist/src/core/log.d.ts +39 -1
  138. package/dist/src/core/log.js.map +1 -1
  139. package/dist/src/core/policy-explain.d.ts +10 -0
  140. package/dist/src/core/policy-explain.js +32 -0
  141. package/dist/src/core/policy-explain.js.map +1 -1
  142. package/dist/src/core/policy-load.d.ts +41 -1
  143. package/dist/src/core/policy-load.js +21 -3
  144. package/dist/src/core/policy-load.js.map +1 -1
  145. package/dist/src/core/policy-match.d.ts +43 -0
  146. package/dist/src/core/policy-match.js +52 -0
  147. package/dist/src/core/policy-match.js.map +1 -1
  148. package/dist/src/core/policy-proposal.d.ts +52 -0
  149. package/dist/src/core/policy-proposal.js +102 -2
  150. package/dist/src/core/policy-proposal.js.map +1 -1
  151. package/dist/src/core/protected-path-guard.d.ts +117 -4
  152. package/dist/src/core/protected-path-guard.js +362 -48
  153. package/dist/src/core/protected-path-guard.js.map +1 -1
  154. package/dist/src/core/question-preempted.d.ts +141 -0
  155. package/dist/src/core/question-preempted.js +152 -0
  156. package/dist/src/core/question-preempted.js.map +1 -0
  157. package/dist/src/core/read-scope.d.ts +172 -0
  158. package/dist/src/core/read-scope.js +252 -0
  159. package/dist/src/core/read-scope.js.map +1 -0
  160. package/dist/src/core/sandbox.d.ts +81 -0
  161. package/dist/src/core/sandbox.js +190 -1
  162. package/dist/src/core/sandbox.js.map +1 -1
  163. package/dist/src/core/sender-identity.d.ts +476 -0
  164. package/dist/src/core/sender-identity.js +572 -0
  165. package/dist/src/core/sender-identity.js.map +1 -0
  166. package/dist/src/core/shlex.d.ts +102 -0
  167. package/dist/src/core/shlex.js +159 -0
  168. package/dist/src/core/shlex.js.map +1 -0
  169. package/dist/src/core/values.d.ts +18 -8
  170. package/dist/src/core/values.js +36 -1
  171. package/dist/src/core/values.js.map +1 -1
  172. package/dist/src/daemon/advance.d.ts +10 -0
  173. package/dist/src/daemon/advance.js +25 -4
  174. package/dist/src/daemon/advance.js.map +1 -1
  175. package/dist/src/daemon/daemon.js +9 -0
  176. package/dist/src/daemon/daemon.js.map +1 -1
  177. package/dist/src/daemon/git-evidence.d.ts +2 -2
  178. package/dist/src/daemon/git-evidence.js +1 -1
  179. package/dist/src/mcp/server.js +8 -0
  180. package/dist/src/mcp/server.js.map +1 -1
  181. package/docs/cli-reference.md +932 -32
  182. package/docs/codex-enforced-session.md +75 -2
  183. package/docs/codex-workspace-broker.md +118 -0
  184. package/package.json +3 -1
  185. package/schema/event.schema.json +538 -9
  186. package/schema/fixtures/event/invalid/approval-granted-sender-hashed-false.json +20 -0
  187. package/schema/fixtures/event/invalid/approval-granted-sender-hashed-raw-id.json +20 -0
  188. package/schema/fixtures/event/invalid/audit-gesture-refused-human-actor.json +16 -0
  189. package/schema/fixtures/event/invalid/audit-gesture-refused-no-actor-no-sender.json +15 -0
  190. package/schema/fixtures/event/invalid/audit-gesture-refused-unknown-gesture.json +16 -0
  191. package/schema/fixtures/event/invalid/audit-question-preempted-agent-actor.json +16 -0
  192. package/schema/fixtures/event/invalid/audit-question-preempted-no-question-id.json +16 -0
  193. package/schema/fixtures/event/invalid/audit-question-preempted-unknown-source.json +15 -0
  194. package/schema/fixtures/event/invalid/gate-path-signed-off-absolute-path.json +14 -0
  195. package/schema/fixtures/event/invalid/gate-path-signed-off-agent-actor.json +14 -0
  196. package/schema/fixtures/event/invalid/gate-path-signed-off-missing-path.json +13 -0
  197. package/schema/fixtures/event/valid/approval-granted-sender-hashed.json +20 -0
  198. package/schema/fixtures/event/valid/audit-gesture-refused-review-note.json +21 -0
  199. package/schema/fixtures/event/valid/audit-gesture-refused-sender-key-unavailable.json +19 -0
  200. package/schema/fixtures/event/valid/audit-gesture-refused.json +19 -0
  201. package/schema/fixtures/event/valid/audit-question-preempted-no-verdict.json +16 -0
  202. package/schema/fixtures/event/valid/audit-question-preempted.json +20 -0
  203. package/schema/fixtures/event/valid/gate-path-signed-off.json +14 -0
  204. package/schema/fixtures/event/valid/harness-kind-claude-code.json +23 -0
  205. package/schema/fixtures/event/valid/harness-kind-codex.json +23 -0
  206. package/schema/fixtures/event/valid/harness-kind-cursor.json +23 -0
  207. package/schema/fixtures/event/valid/harness-kind-grok.json +23 -0
  208. package/schema/fixtures/event/valid/harness-kind-muse.json +23 -0
  209. package/schema/fixtures/policy/invalid/senders-half-keyed.json +20 -0
  210. package/schema/fixtures/policy/valid/canonical.json +1 -1
  211. package/schema/fixtures/policy/valid/senders-keyed.json +24 -0
  212. package/schema/fixtures/policy-md/valid/canonical.md +1 -1
  213. package/schema/fixtures/policy-md/valid/with-values.md +5 -7
  214. package/schema/fixtures/values/invalid/class-shaped.json +1 -1
  215. package/schema/fixtures/values/invalid/duplicate-entry.json +1 -1
  216. package/schema/fixtures/values/invalid/non-string-item.json +1 -1
  217. package/schema/fixtures/values/invalid/over-cap.json +1 -1
  218. package/schema/fixtures/values/invalid/unknown-key.json +1 -1
  219. package/schema/fixtures/values/invalid/version-float.json +1 -0
  220. package/schema/fixtures/values/invalid/version-integer.json +1 -0
  221. package/schema/fixtures/values/invalid/version-wrong-string.json +1 -0
  222. package/schema/fixtures/values/valid/empty-lists.json +2 -3
  223. package/schema/fixtures/values/valid/full.json +5 -7
  224. package/schema/fixtures/values/valid/minimal.json +1 -1
  225. package/schema/fixtures/values-md/invalid/schema-invalid.md +5 -3
  226. package/schema/fixtures/values-md/invalid/two-blocks.md +3 -3
  227. package/schema/fixtures/values-md/invalid/unterminated.md +2 -2
  228. package/schema/fixtures/values-md/invalid/version-1.md +69 -0
  229. package/schema/fixtures/values-md/invalid/version-unquoted.md +64 -0
  230. package/schema/fixtures/values-md/invalid/yaml-error.md +2 -2
  231. package/schema/fixtures/values-md/valid/absent.md +1 -1
  232. package/schema/fixtures/values-md/valid/with-values.md +5 -7
  233. package/schema/policy.schema.json +54 -2
  234. package/schema/values.schema.json +7 -11
  235. package/schema/fixtures/values/invalid/version-string.json +0 -1
@@ -54,7 +54,7 @@ Usage:
54
54
  [--as <id>] [--json] (internal)
55
55
  approval run <action-key> [--token <t>] [--payload-hash <64hex>]
56
56
  [--as <id>] [--no-sandbox] [--json] -- <cmd…>
57
- approval sandbox [--allow-loopback] [--log <path>] -- <cmd…>
57
+ approval sandbox [--allow-loopback] [--read-jail] [--log <path>] -- <cmd…>
58
58
  approval adapter email <action-key> [--token <t>] --payload <file|->
59
59
  [--as <id>] [--vault <path>] [--timeout <ms>] [--json]
60
60
  approval adapter agentmail <action-key> [--token <t>] --payload <file|->
@@ -607,24 +607,49 @@ const POLICY_MANUAL_BECAUSE = `manualBecause is "matched-rule", "irreversibility
607
607
  export const POLICY_HELP = `approval policy — explain what policy does with an action class
608
608
 
609
609
  Usage:
610
- approval policy check|test <class> [--reversible true|false] [--policy <p>]
611
- [--dir <p>] [--json]
612
- approval policy attest [--policy <p>] [--dir <p>] [--as human:<id>] [--json]
613
- approval policy amend [--policy <p>] [--dir <p>] [--log <p>] [--as human:<id>]
614
- [--require-load] [--dry-run] [--commit] [--yes] [--json]
610
+ approval policy check|test <class> [--reversible true|false] [--policy|--dir <p>] [--json]
611
+ approval policy attest [--policy|--dir <p>] [--as human:<id>] [--json]
612
+ approval policy amend [--policy|--dir|--log <p>] [--as human:<id>] [--require-load]
613
+ [--dry-run] [--commit|--pr] [--yes] [--json]
614
+ approval policy apply <proposal.md> [--dry-run] [--no-amend] [--pr] [--yes]
615
615
 
616
616
  Subcommands:
617
617
  check explain the autonomy resolution for <class>
618
618
  test exact alias of check (SPEC.md §10.1 names both)
619
619
  attest record a human's sign-off on the policy file's bytes (human-only)
620
620
  amend the whole amendment ceremony: diff, advisory, attestation, commit
621
+ apply apply a proposal document's quoted replacements, then amend (human-only)
621
622
 
622
- Nothing is executed, requested, or logged: this reads APPROVAL.md and answers a
623
- hypothetical. Discovery is APPROVAL.md then APPROVALS.md in --dir.
624
- ${POLICY_MANUAL_BECAUSE}
623
+ check and test read APPROVAL.md and answer a hypothetical, executing and logging nothing.
624
+ Discovery is APPROVAL.md then APPROVALS.md in --dir. ${POLICY_MANUAL_BECAUSE}
625
625
 
626
626
  ${POLICY_EXIT_CODES}
627
627
  ${why("policy")}`;
628
+ export const POLICY_APPLY_HELP = `approval policy apply — apply a proposal document to APPROVAL.md, then amend
629
+
630
+ Usage:
631
+ approval policy apply <proposal.md> [--policy <p>] [--dir <p>] [--log <p>]
632
+ [--as human:<id>] [--dry-run] [--no-amend] [--no-publish] [--yes] [--json]
633
+
634
+ Flags:
635
+ <proposal.md> the document whose Current/Replace-with pairs to apply
636
+ --policy <p> / --dir <p> the policy file, or the directory to discover it in
637
+ --dry-run / --no-amend show the replacements only / write them and stop
638
+ --no-publish / --yes / --json stop at the commit / skip both prompts / machine
639
+
640
+ HUMAN-ONLY: an agent identity refuses apply-agent-actor, and the verb classifies
641
+ policy.core, human-only in this project's policy. Every pair resolves against an
642
+ in-memory copy FIRST, so a stale proposal writes nothing at all. A pair is two
643
+ fenced blocks WITH a declared language (APRV-273), labelled \`Current:\` and
644
+ \`Replace with:\` above; \`Supersedes:\` names an earlier section's result to match
645
+ instead. Whole-file replacement is NOT accepted: every byte written is anchored
646
+ to a byte proved present. The values block is treated as the policy block is.
647
+ Refusals: usage, io, apply-agent-actor, proposal-empty, proposal-malformed,
648
+ proposal-stale, proposal-ambiguous. Then it runs \`policy amend --pr\`, which
649
+ PUBLISHES: refspec push, pull request, merge armed, checkout never moved.
650
+
651
+ ${EXIT_CODES_POINTER}
652
+ ${why("policy-apply")}`;
628
653
  function policyVerbHelp(verb, alias) {
629
654
  return `approval policy ${verb} — explain what policy does with an action class
630
655
 
@@ -653,21 +678,21 @@ export const POLICY_ATTEST_HELP = `approval policy attest — record a human's s
653
678
 
654
679
  Usage:
655
680
  approval policy attest [--policy <path>] [--dir <path>] [--organ <path>]
656
- [--as human:<id>] [--log <path>] [--json]
681
+ [--path <path>] [--as human:<id>] [--log <path>] [--json]
657
682
 
658
683
  Flags:
659
684
  --policy <path> / --dir <path> the policy file, or where to discover it
660
685
  --organ <path> attest a GATE ORGAN instead; one path per call, under --dir
686
+ --path <path> sign off a PROTECTED path's current bytes; one path per call
661
687
  --as human:<id> the human attesting; overrides APPROVAL_HUMAN
662
688
  --log <path> log file to append to (default .approval/log/events.jsonl)
663
- --json machine-readable output
664
- -h, --help this text
689
+ --json / -h, --help machine-readable output / this text
665
690
 
666
- Appends one policy.updated event carrying the SHA-256 of the policy file's exact
667
- bytes; gate operations refuse while it differs ("policy-not-attested").
668
- Human-only, identity CONFIG-DECLARED: the trust boundary is the local machine,
669
- so it proves someone with local control signed off, not who. Bytes, not parse.
670
- --organ appends gate.organ.attested for a policy.core harness file instead.
691
+ Appends one policy.updated event with the policy file's exact SHA-256; gate
692
+ operations refuse while it differs ("policy-not-attested"). Bytes, not parse.
693
+ Human-only, identity CONFIG-DECLARED. What attestation proves is bounded: the
694
+ trust boundary is the local machine, so someone with local control, not who.
695
+ --organ appends gate.organ.attested (policy.core); --path gate.path.signed_off.
671
696
 
672
697
  JSON shape: docs/cli-reference.md#policy-attest
673
698
  ${EXIT_CODES_POINTER}
@@ -677,22 +702,22 @@ export const POLICY_AMEND_HELP = `approval policy amend — the whole amendment
677
702
 
678
703
  Usage:
679
704
  approval policy amend [--policy|--dir|--log <p>] [--as human:<id>|agent:<id>] [--require-load]
680
- [--dry-run] [--commit] [--no-publish] [--yes] [--json] [--branch <n>|--direct] [--wait <d>]
705
+ [--dry-run] [--commit|--pr] [--no-publish] [--yes] [--json] [--branch <n>|--direct] [--wait <d>]
681
706
 
682
707
  Flags:
683
708
  --policy <p> / --dir <p> / --log <p> policy, its discovery dir, and the log
684
709
  --as human:<id> / agent:<id> attest HERE, or ask for a TAP (--wait/--interval/--note)
685
710
  --require-load refuse to attest a policy that does not load
686
711
  --dry-run / --commit / --no-publish write nothing / the ceremony / stop at commit
687
- --branch <name> / --direct force the BRANCH or the DIRECT flow
712
+ --pr / --branch <name> / --direct FINISH it (branch, push, PR, arm) / force either flow
688
713
  --yes / --json / -h, --help skip the prompt / machine-readable / this text
689
714
 
690
- Hashes the policy, diffs it against the BASELINE (classes AND every policy key), attests, then
691
- commits EXACTLY the policy, the log and the pins when they moved. commit-preconditions, the pins
692
- and the DOGFOOD SUITE refuse BEFORE the append; git-failed, push-rejected, pr-failed break after it.
693
- Attested TEXT is NOT recoverable from the log: HASH-ONLY MODE. Flows, in PRECEDENCE, highest first:
694
- --branch <name>, --direct; a refused push PUBLISHES ITSELF, dropping to a RUNBOOK. MERGE COMMIT it.
695
- --as agent: appends policy.proposed; the TAP attests. Fail closed: no-channel, declined, timeout.
715
+ Hashes the policy, diffs it against the BASELINE (classes AND every policy key), attests, then commits
716
+ EXACTLY the policy, the log and the pins when they moved. commit-preconditions, staged-unrelated,
717
+ dirty-tree, the pins and the DOGFOOD SUITE refuse BEFORE the append; git-failed, push-rejected and
718
+ pr-failed break after it, into a RUNBOOK. Attested TEXT is NOT recoverable from the log:
719
+ HASH-ONLY MODE. Flows, in PRECEDENCE, highest first: --branch <name>, --pr (opens or UPDATES the open
720
+ pull request, arms --auto), --direct. MERGE COMMIT it. --as agent: appends policy.proposed, TAP attests.
696
721
 
697
722
  ${EXIT_CODES_POINTER}
698
723
  ${JSON_ERRORS}
@@ -958,19 +983,21 @@ ${why("run")}`;
958
983
  export const SANDBOX_HELP = `approval sandbox — run a command with no way out (APRV-193)
959
984
 
960
985
  Usage:
961
- approval sandbox [--allow-loopback] [--log <path>] -- <cmd> [args…]
986
+ approval sandbox [--allow-loopback] [--read-jail] [--log <path>] -- <cmd…>
962
987
 
963
988
  Flags:
964
989
  --allow-loopback also allow connections to localhost. For a suite that
965
990
  starts its own server. A real widening: a port is a port
991
+ --read-jail also deny file reads outside the gate root and the scratch
992
+ roots. Already on when the policy declares read_scope, and
993
+ nothing turns it off where it did (APRV-347)
966
994
  --log <path> the log, so the credential material beside it can be made
967
995
  unreadable to the child (vault, env map, sealing keys)
968
996
  -h, --help this text ("--help --long" adds the reference section)
969
997
 
970
- Denies the child outbound network (macOS sandbox-exec), scrubs the
971
- credential-bearing variables out of its environment, and exits with the child's
972
- own exit code. It appends NOTHING: it removes a capability rather than
973
- authorizing anything, and the gate stays reachable because its IPC is a file.
998
+ Denies outbound network (macOS sandbox-exec), scrubs the credential variables
999
+ from the child's environment, exits with its code, and appends NOTHING: it
1000
+ removes a capability rather than authorizing anything.
974
1001
 
975
1002
  The point is laundered exec: "npm test" runs whatever was written a minute ago,
976
1003
  so the command's NAME stopped describing its effect. An agent HARNESS cannot run
@@ -1408,27 +1435,78 @@ ${why("quickstart")}`;
1408
1435
  export const HOOK_HELP = `approval hook — put the gate in front of an agent harness
1409
1436
 
1410
1437
  Usage:
1411
- approval hook claude-code|cursor|codex [--as agent:<id>] [--timeout <d>] [--interval <d>] [--retry-grace <d>] [--policy <p>] [--dir <p>] [--log <p>]
1438
+ approval hook claude-code|cursor|codex|grok|muse [--as agent:<id>] [--timeout <d>] [--interval <d>] [--retry-grace <d>] [--policy <p>] [--dir <p>] [--log <p>]
1412
1439
  approval hook classify [--json] [--policy <p>] [--dir <p>] -- <command…>
1413
1440
 
1414
1441
  Commands:
1415
1442
  claude-code Claude Pre/PostToolUse JSON in; decision JSON out. REGISTER BOTH
1416
1443
  cursor Cursor preToolUse JSON in; native {permission} JSON out
1417
1444
  codex Codex synchronous Pre/Post JSON; Bash denied, direct apply_patch experimentally gated
1445
+ grok Grok Build camelCase Pre/PostToolUse JSON in; {decision,reason} out, DENY IS EXIT 2. \`approval hook grok --help\` prints the config
1446
+ muse Muse Code snake_case Pre/PostToolUse; ONE dialect out or it fails open. \`approval hook muse --help\` prints the config
1418
1447
  classify print what the classifier makes of a command line and exit
1419
-
1420
- --as <id> proposing identity (default agent:claude-code / agent:cursor / agent:codex)
1448
+ --as <id> proposing identity (default agent:<harness>)
1421
1449
  --timeout/--interval/--retry-grace <d> wait / poll / hold for a retry (9m/1s/5m)
1422
1450
  --dir/--policy/--log <p> policy+log root; --dir sets BOTH, default primary
1423
1451
  -h, --help this text
1424
1452
 
1425
1453
  Codex opt-in: register exact Bash|apply_patch synchronously with timeout 600s (default wait 9m). Bash is denied because native events hide per-call workdir; direct apply_patch is experimental. PostToolUse is diagnostic.
1426
1454
 
1427
- Deny: hook-unclassified, hook-class-human-only, hook-opaque, hook-unparseable, hook-rejected, hook-revoked, hook-expired, hook-withdrawn, hook-timeout,
1428
- hook-gate-refused:<c>, hook-grant-unverified, hook-sandbox-required, hook-policy-unavailable, hook-log-unreachable, hook-io.
1455
+ Deny: hook-unclassified, hook-class-human-only, hook-harness-launch-unruled, hook-opaque, hook-unparseable, hook-rejected, hook-revoked, hook-expired, hook-withdrawn, hook-timeout,
1456
+ hook-gate-refused:<c>, hook-grant-unverified, hook-sandbox-required, hook-policy-unavailable, hook-log-unreachable, hook-unsupported-execution-context, hook-muse-contributor-model, hook-io.
1429
1457
 
1430
1458
  ${EXIT_CODES_POINTER} (harness verbs use 0 and 2 only; 0 is a verdict, never "ask")
1431
1459
  ${why("hook")}`;
1460
+ export const HOOK_GROK_HELP = `approval hook grok — the gate in front of Grok Build (APRV-243)
1461
+
1462
+ Usage:
1463
+ approval hook grok [--as agent:<id>] [--timeout <d>] [--interval <d>]
1464
+ [--retry-grace <d>] [--policy <p>] [--dir <p>] [--log <p>]
1465
+
1466
+ camelCase in (hookEventName, sessionId, cwd, workspaceRoot, toolName, toolInput);
1467
+ {"decision":"allow"|"deny","reason":"…"} out, never "ask". DENY IS EXIT 2,
1468
+ allow is 0, post-execution always 0.
1469
+
1470
+ READ docs/grok-hook.md BEFORE COMMITTING THIS: Grok Build fails OPEN on hook
1471
+ timeout, crash and malformed output, with no setting to change that. It
1472
+ contradicts the fail-closed invariant and the adapter cannot fix it.
1473
+
1474
+ The file the human commits, .grok/hooks/pre-tool-use.json:
1475
+ {"hooks":{"PreToolUse":[{"matcher":"*","hooks":[
1476
+ {"type":"command","command":"approval hook grok --dir <repo>",
1477
+ "timeout": 600}]}]}}
1478
+
1479
+ That "timeout" MUST EXCEED --timeout (default 9m), or Grok abandons the call
1480
+ mid-wait and, failing open, runs the command while a human is still deciding.
1481
+ .grok/hooks/ classifies policy.core, like .cursor/hooks.json.
1482
+
1483
+ ${EXIT_CODES_POINTER} (0 allow, 2 deny; never "ask")
1484
+ ${why("hook")}`;
1485
+ export const HOOK_MUSE_HELP = `approval hook muse — the gate in front of Meta Muse Code (APRV-350)
1486
+
1487
+ Usage:
1488
+ approval hook muse [--as agent:<id>] [--timeout <d>] [--interval <d>]
1489
+ [--retry-grace <d>] [--policy <p>] [--dir <p>] [--log <p>]
1490
+ snake_case in (hook_event_name, tool_name, tool_input, cwd, model); ONE dialect
1491
+ out, nested {"hookSpecificOutput":{"permissionDecision":…}} at exit 0, never
1492
+ "ask". Tools: bash (per-call workdir), write_file, read_file, search.
1493
+
1494
+ READ docs/muse-hook.md FIRST. Muse fails OPEN on hook crash, timeout and
1495
+ malformed output — and output MIXING dialects is itself malformed, so a payload
1496
+ satisfying every harness at once satisfies this one not at all.
1497
+ CONTRIBUTOR MODELS ARE REFUSED (hook-muse-contributor-model) on every tool call
1498
+ regardless of policy: Meta trains on that tier. The guard stops tool calls; it
1499
+ cannot recall a prompt already sent.
1500
+ The file the human commits, .muse/hooks.json (no "matcher"; policy.core):
1501
+ {"hooks":{"PreToolUse":[{"hooks":[
1502
+ {"type":"command","command":"approval hook muse --dir <repo>",
1503
+ "timeout": 600}]}],"PostToolUse":[{"hooks":[
1504
+ {"type":"command","command":"approval hook muse --dir <repo>",
1505
+ "timeout": 600}]}]}}
1506
+ That "timeout" MUST EXCEED --timeout (9m), or Muse abandons the call mid-wait
1507
+ and, failing open, runs it while a human is still deciding.
1508
+ ${EXIT_CODES_POINTER} (0 for every verdict; deny is the body, not the code)
1509
+ ${why("hook")}`;
1432
1510
  export const IMPORT_HELP = `approval import — turn existing permissions prose into a draft policy
1433
1511
 
1434
1512
  Usage:
@@ -1455,7 +1533,7 @@ Reads one markdown file, finds its permissions section, and prints a DRAFT
1455
1533
  \`\`\`yaml approval-policy block from a fixed, ordered keyword table.
1456
1534
  THE DRAFT AUTHORIZES NOTHING: this verb never writes APPROVAL.md, never logs and
1457
1535
  never attests. Fail closed: a bullet the table cannot place is kept verbatim.
1458
- "What I value"-style headings become a DRAFT values fence, all under \`wants\`.
1536
+ "What I value"-style headings become a DRAFT values fence, all under \`like\`.
1459
1537
 
1460
1538
  JSON shape (stdout, one object):
1461
1539
  {"ok":true,"source":"<path>","out":"<path>"|null,
@@ -1611,8 +1689,8 @@ Flags:
1611
1689
  --json / -h, --help machine-readable output / this text
1612
1690
 
1613
1691
  Prints the optional \`\`\`yaml approval-values block of APPROVAL.md: what the
1614
- operator loves, likes and dislikes, what they want from you as behaviour, and
1615
- how they read and answer. EVERY FORM CARRIES THE LABEL: this is GUIDANCE and
1692
+ operator loves, likes (including what they ask of you as behaviour) and
1693
+ dislikes, and how they read and answer. EVERY FORM CARRIES THE LABEL: this is GUIDANCE and
1616
1694
  never policy. It grants nothing, forbids nothing and changes no verdict; what
1617
1695
  you MAY do is the policy block, answered by \`approval policy check\`.
1618
1696
 
@@ -1680,15 +1758,18 @@ Usage:
1680
1758
  [--policy <path>] [--dir <path>]
1681
1759
  [--log <path>] [--api-base <url>]
1682
1760
  [--poll-timeout <seconds>] [--json]
1683
- approval channel telegram health [--json]
1761
+ approval channel telegram health [--dir <path>] [--log <path>] [--json]
1684
1762
 
1685
1763
  Configuration is ENVIRONMENT-ONLY: APPROVAL_TG_TOKEN holds the bot token and
1686
- APPROVAL_TG_CHAT the approver chat id. APPROVAL.md carries only those variable
1687
- NAMES, and there is no flag that would put a bot token into a shell history.
1764
+ APPROVAL_TG_CHAT the approver chat id by default. APPROVAL.md carries only those
1765
+ variable NAMES — a second gate on one machine declares a pair of its own — and
1766
+ there is no flag that would put a bot token into a shell history.
1688
1767
 
1689
1768
  Anyone in the configured chat can approve as the actor this process was started
1690
1769
  with, so the chat's membership is part of your trust boundary. Use a private
1691
- chat with the bot.
1770
+ chat with the bot — or map senders: approvers.<id>.senders.telegram: "<id>"
1771
+ records each decision against the person that Telegram account is attested to
1772
+ and refuses a tap from an account the policy does not name.
1692
1773
 
1693
1774
  ${EXIT_CODES_POINTER}
1694
1775
  ${JSON_ERRORS}
@@ -1707,7 +1788,7 @@ Flags:
1707
1788
  --as human:<id> the approver every decision is recorded against. REQUIRED
1708
1789
  --payloads <f> OPTIONAL OVERRIDE: JSON file of action key -> payload
1709
1790
  --policy <p> / --dir <p> / --log <p> the policy, its dir, the log written to
1710
- --api-base <url> / --poll-timeout <s> Bot API base / long-poll seconds (25)
1791
+ --api-base <url> / --poll-timeout <s> / --allow-cross-instance Bot API base / long-poll seconds (25) / start on another instance's bot
1711
1792
  -h, --help this text
1712
1793
  Config is ENVIRONMENT-ONLY and the policy names the variables. Delivery is per cycle;
1713
1794
  a new request reaches the phone without restart. THE TOKEN IS PRINTED HERE, NEVER SENT TO TELEGRAM.
@@ -1796,7 +1877,7 @@ Flags (every "daemon run" flag, unchanged, plus):
1796
1877
  --payloads <f> / --payload-dir <d> payload overrides: telegram / web
1797
1878
  --api-base <url> / --poll-timeout <s> Bot API base / long-poll seconds
1798
1879
  --port <n> queue-page port. Precedence: --port, channels.web.port
1799
- --no-telegram / --no-web leave that channel out of this process
1880
+ --no-telegram / --no-web / --allow-cross-instance leave that channel out / start on another instance's bot
1800
1881
  --no-gloss / --restart-backoff <d> drop gloss / first retry wait
1801
1882
  --gloss-provider <p> / --gloss-model <id> choose claude|codex (default claude); Codex requires model; no fallback
1802
1883
  -h, --help this text
@@ -2030,14 +2111,14 @@ ${why("env")}`;
2030
2111
  export const SETUP_HELP = `approval setup — interactive configuration (SPEC.md §5.2, §10.1)
2031
2112
 
2032
2113
  Usage:
2033
- approval setup identity|vault|sampling|checkpoint [--as human:<id>] …
2114
+ approval setup identity|vault|sampling|sender-key|checkpoint [--as human:<id>] …
2034
2115
  approval setup channel|adapter <name> [--api-base <url>] [--as human:<id>] …
2035
2116
  approval setup service [--platform launchd|systemd] [--uninstall] …
2036
-
2037
2117
  Subcommands:
2038
2118
  identity declare who the human is (APPROVAL_HUMAN); not human-only
2039
2119
  vault mint a vault passphrase, store it, and record where it lives
2040
2120
  sampling mint the audit sampling secret and print the policy line for it
2121
+ sender-key mint the key that hashes sender ids; --id prints one mapping line
2041
2122
  checkpoint mint the Ed25519 key you sign the log's head with (--rotate/--retire)
2042
2123
  channel configure one CHANNEL's transport credential (OS keystore)
2043
2124
  adapter fill the VAULT with one ADAPTER's credentials, from its manifest
@@ -2110,6 +2191,28 @@ does not edit an attested policy file: it prints the block to add and the
2110
2191
  ${EXIT_CODES_POINTER}
2111
2192
  ${JSON_ERRORS}
2112
2193
  ${why("setup-sampling")}`;
2194
+ export const SETUP_SENDER_KEY_HELP = `approval setup sender-key — mint the key that hashes sender ids (HUMAN-ONLY)
2195
+
2196
+ Usage:
2197
+ approval setup sender-key [--as human:<id>] [--log <path>] [--dir <path>]
2198
+ approval setup sender-key --id <account-id> [--log <path>] [--json]
2199
+
2200
+ Bare, it mints the operator-held key that turns a channel account id into the
2201
+ value an approvers[id].senders block carries, stores it as approval-sender-key,
2202
+ and writes its source line. It edits no policy file (APRV-370).
2203
+
2204
+ WITH --id it mints and stores nothing: it reads the key from the environment,
2205
+ prints the hmac-sha256:<hex> for that account, and prints the senders line and
2206
+ the paste-ready proposal pair around it. Run \`eval "$(approval env)"\` first.
2207
+ That is the one setup path that needs no terminal.
2208
+
2209
+ A LISTENER THAT HOLDS NO KEY UNDER A KEYED MAPPING REFUSES EVERY DECISION on
2210
+ that channel (sender-key-unavailable), never falling back to a raw comparison.
2211
+ The key authenticates nothing; losing it costs the ability to resolve accounts.
2212
+
2213
+ ${EXIT_CODES_POINTER}
2214
+ ${JSON_ERRORS}
2215
+ ${why("setup-sender-key")}`;
2113
2216
  export const SETUP_CHECKPOINT_HELP = `approval setup checkpoint — mint the log-checkpoint key (HUMAN-ONLY)
2114
2217
 
2115
2218
  Usage:
@@ -2290,26 +2393,28 @@ ${why("setup-service")}`;
2290
2393
  // ---------------------------------------------------------------------------
2291
2394
  // The MCP wrapper (APRV-87)
2292
2395
  // ---------------------------------------------------------------------------
2293
- export const CODEX_HELP = `approval codex — prepare and inspect a constrained Codex host bundle (INERT)
2396
+ export const CODEX_HELP = `approval codex — prepare a constrained Codex host and broker its workspace writes
2294
2397
 
2295
2398
  Usage:
2296
2399
  approval codex prepare --instance <id> --workspace <abs> --primary <abs>
2297
2400
  --install-root <abs> --output <new-dir> --codex <abs> --node <abs> [--json]
2298
2401
  approval codex setup --check <bundle-dir> [--json]
2299
2402
  approval codex doctor --strict --manifest <abs> [--json]
2300
- approval codex start|serve --manifest <abs> [--json]
2301
-
2302
- prepare writes a fresh review bundle only. setup --check verifies its closed file
2303
- set, hashes, manifest and generated templates. Neither installs a package, edits
2304
- Codex configuration, creates principals, loads services, reads credentials, or
2305
- changes policy. doctor fails closed on unknown custody, executes no manifest
2306
- binary in this slice, and reports runtime versions as unchecked.
2307
-
2308
- start and serve currently refuse with codex-not-ready. The policy-bound broker
2309
- and confined runner arrive in APRV-325.2 and APRV-325.3. An npm or project
2310
- installation alone is never reported as enforcement.
2311
-
2312
- ${EXIT_CODES_POINTER} (1 means the strict boundary is absent or invalid)
2403
+ approval codex apply --manifest <abs> --proposal <file> [--json]
2404
+ [--token <class>=<token>]... [--require-exclusive-custody]
2405
+ approval codex serve|recover --manifest <abs> [--json]
2406
+ approval codex start --manifest <abs> [--timeout <dur>] [--json] [-- <cmd>...]
2407
+
2408
+ prepare, setup --check and doctor are the inert half: a review bundle, its exact
2409
+ file set and hashes, and host custody, executing no manifest binary. apply is the
2410
+ BROKER: a bounded create/replace/delete/move proposal, ONE ACTION PER PATH CLASS,
2411
+ gate-authorized, every leg started before any byte moves, then staged, journaled
2412
+ and applied under a workspace lock; the MANIFEST supplies actor, root, policy and
2413
+ log. recover READS a retained journal, repairing nothing. serve is EXACTLY ONE MCP
2414
+ tool, separate from \`approval mcp serve\`. start CONFINES a shell: one disposable
2415
+ writable path, read-only gate and workspace, no credentials, no egress, NO OPT-OUT.
2416
+
2417
+ ${EXIT_CODES_POINTER} (1: the boundary is absent, invalid, or the workspace mixed)
2313
2418
  ${JSON_ERRORS}
2314
2419
  why: docs/cli-reference.md#constrained-codex-preparation`;
2315
2420
  export const MCP_HELP = `approval mcp serve — the MCP wrapper of SPEC.md §10.5 (FOREGROUND)
@@ -1 +1 @@
1
- {"version":3,"file":"help.js","sourceRoot":"","sources":["../../../src/cli/help.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAExE,0EAA0E;AAC1E,MAAM,UAAU,GAAG;;;;;0EAKuD,CAAC;AAE3E,iEAAiE;AACjE,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD,MAAM,WAAW,GAAG;8BACU,CAAC;AAE/B,uDAAuD;AACvD,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO,8BAA8B,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+SvB,UAAU;;;;;;;;;;;EAWV,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmC8D,CAAC;AAE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;EAiB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;sCAqBc,kBAAkB;EACtD,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;EAoBzB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBvB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,GAAG,kBAAkB;;;;yDAIU,CAAC;AAE1D,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,6EAA6E,CAAC;AAE5G,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;EAiBzB,qBAAqB;;EAErB,iBAAiB;EACjB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,SAAS,cAAc,CAAC,IAAsB,EAAE,KAAuB;IACrE,OAAO,mBAAmB,IAAI;;;oBAGZ,IAAI;;;;;;;;6BAQK,KAAK;;EAEhC,qBAAqB;;;;EAIrB,iBAAiB;EACjB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG;EACzB,kBAAkB;qEACiD,CAAC;AAEtE,wEAAwE;AACxE,MAAM,mBAAmB,GAAG;EAC1B,kBAAkB;qEACiD,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,SAAS,YAAY,CAAC,IAAmC;IACvD,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1F,MAAM,IAAI,GACR,IAAI,KAAK,OAAO;QACd,CAAC,CAAC;;iFAEyE;QAC3E,CAAC,CAAC,IAAI,KAAK,QAAQ;YACjB,CAAC,CAAC;;oEAE0D;YAC5D,CAAC,CAAC;;gDAEsC,CAAC;IAE/C,OAAO,YAAY,IAAI,qBAAqB,IAAI;;;aAGrC,IAAI,gCACb,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAC3C;;;;iEAKE,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,+EAA+E;QACjF,CAAC,CAAC,EACN;;;;;;EAMA,IAAI;;oCAE8B,IAAI;EACtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;EAkBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;2DAY2B,gBAAgB;;;;;;;;;;;EAWzE,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;EAmBxB,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;EAmBvB,kBAAkB;;;EAGlB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuBxB,kBAAkB;EAClB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;EAmB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;EAkBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;AAE3B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB5B,kBAAkB;EAClB,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB9B,kBAAkB;EAClB,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;6DAYoC,gBAAgB;IACzE,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;;;;;;;;EAQ/C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB7B,kBAAkB;EAClB,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsBvB,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;EAUzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;EAc1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;EAoB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;EAmB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;EAiB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;EAWzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAEd,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,YAAY,GAAG;iEAC4C,CAAC;AAElE,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,YAAY;;EAEZ,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;EAoB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;EAoB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAE;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;EAejC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;EAkB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;EAiBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;EAcpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;EAmBhC,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;EAezC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;EAmBxB,kBAAkB;EAClB,WAAW;yDAC4C,CAAC;AAE1D,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC"}
1
+ {"version":3,"file":"help.js","sourceRoot":"","sources":["../../../src/cli/help.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAExE,0EAA0E;AAC1E,MAAM,UAAU,GAAG;;;;;0EAKuD,CAAC;AAE3E,iEAAiE;AACjE,MAAM,kBAAkB,GAAG,6BAA6B,CAAC;AAEzD,MAAM,WAAW,GAAG;8BACU,CAAC;AAE/B,uDAAuD;AACvD,SAAS,GAAG,CAAC,MAAc;IACzB,OAAO,8BAA8B,MAAM,EAAE,CAAC;AAChD,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+SvB,UAAU;;;;;;;;;;;EAWV,WAAW;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;2EAmC8D,CAAC;AAE5E,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;EAiB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;sCAqBc,kBAAkB;EACtD,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;EAoBzB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBvB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB;;;;;;GAMG;AACH,MAAM,iBAAiB,GAAG,GAAG,kBAAkB;;;;yDAIU,CAAC;AAE1D,+EAA+E;AAC/E,MAAM,qBAAqB,GAAG,6EAA6E,CAAC;AAE5G,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;uDAiB4B,qBAAqB;;EAE1E,iBAAiB;EACjB,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB/B,kBAAkB;EAClB,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,SAAS,cAAc,CAAC,IAAsB,EAAE,KAAuB;IACrE,OAAO,mBAAmB,IAAI;;;oBAGZ,IAAI;;;;;;;;6BAQK,KAAK;;EAEhC,qBAAqB;;;;EAIrB,iBAAiB;EACjB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,cAAc,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;AACjE,MAAM,CAAC,MAAM,gBAAgB,GAAG,cAAc,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAEhE,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB;;;;;GAKG;AACH,MAAM,kBAAkB,GAAG;EACzB,kBAAkB;qEACiD,CAAC;AAEtE,wEAAwE;AACxE,MAAM,mBAAmB,GAAG;EAC1B,kBAAkB;qEACiD,CAAC;AAEtE,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,SAAS,YAAY,CAAC,IAAmC;IACvD,MAAM,IAAI,GAAG,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC;IAC1F,MAAM,IAAI,GACR,IAAI,KAAK,OAAO;QACd,CAAC,CAAC;;iFAEyE;QAC3E,CAAC,CAAC,IAAI,KAAK,QAAQ;YACjB,CAAC,CAAC;;oEAE0D;YAC5D,CAAC,CAAC;;gDAEsC,CAAC;IAE/C,OAAO,YAAY,IAAI,qBAAqB,IAAI;;;aAGrC,IAAI,gCACb,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAC3C;;;;iEAKE,IAAI,KAAK,OAAO;QACd,CAAC,CAAC,+EAA+E;QACjF,CAAC,CAAC,EACN;;;;;;EAMA,IAAI;;oCAE8B,IAAI;EACtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AACd,CAAC;AAED,MAAM,CAAC,MAAM,UAAU,GAAG,YAAY,CAAC,OAAO,CAAC,CAAC;AAChD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAClD,MAAM,CAAC,MAAM,WAAW,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;AAElD,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;EAmB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;EAkBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;2DAY2B,gBAAgB;;;;;;;;;;;EAWzE,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;EAmBxB,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;EAmB1B,mBAAmB;EACnB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,8EAA8E;AAC9E,0DAA0D;AAC1D,8EAA8E;AAE9E,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtB,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;EAmBvB,kBAAkB;;;EAGlB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuBxB,kBAAkB;EAClB,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;EAmB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;EAkBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,iBAAiB,CAAC,EAAE,CAAC;AAE3B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB5B,kBAAkB;EAClB,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB1B,kBAAkB;EAClB,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB9B,kBAAkB;EAClB,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;6DAYoC,gBAAgB;IACzE,qBAAqB,CAAC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;;;;;;;;EAQ/C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;;EAsB7B,kBAAkB;EAClB,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,SAAS,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuBvB,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB5B,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;;;EAuB5B,kBAAkB;EAClB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;AAEhB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;EAUzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;EAc1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;EAoB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;EAmB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClB,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;AAEpB,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;;;;;;;;;EAmBzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;AAElB,8EAA8E;AAC9E,qBAAqB;AACrB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,aAAa,GAAG;;;;;;;;;;;;;;;;;;;;EAoB3B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,oBAAoB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBlC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,CAAC,MAAM,WAAW,GAAG;;;;;;;;;;;EAWzB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,8EAA8E;AAC9E,iCAAiC;AACjC,8EAA8E;AAE9E,MAAM,CAAC,MAAM,OAAO,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;AAEd,8EAA8E;AAC9E,sBAAsB;AACtB,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,YAAY,GAAG;iEAC4C,CAAC;AAElE,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;EAkBxB,YAAY;;EAEZ,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,cAAc,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB5B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;AAErB,MAAM,CAAC,MAAM,eAAe,GAAG;;;;;;;;;;;;;;;;;;;;EAoB7B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;AAEtB,MAAM,CAAC,MAAM,iBAAiB,GAAG;;;;;;;;;;;;;;;;;;;;EAoB/B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,cAAc,CAAC,EAAE,CAAC;AAExB,MAAM,CAAC,MAAM,YAAY,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;AAEnB,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,QAAQ,GAAE;;;;;;;;;;;;;;;;;;;;;EAqBrB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;AAEf,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBxB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;AAEjB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;EAejC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,gBAAgB,GAAG;;;;;;;;;;;;;;;;;;EAkB9B,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;AAEvB,MAAM,CAAC,MAAM,mBAAmB,GAAG;;;;;;;;;;;;;;;;;EAiBjC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,gBAAgB,CAAC,EAAE,CAAC;AAE1B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;EAmBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,qBAAqB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBnC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,kBAAkB,CAAC,EAAE,CAAC;AAE5B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,wBAAwB,GAAG;;;;;;;;;;;;;;;;;;;;EAoBtC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,qBAAqB,CAAC,EAAE,CAAC;AAE/B,MAAM,CAAC,MAAM,4BAA4B,GAAG;;;;;;;;;;;;;;;;;;;;;EAqB1C,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,yBAAyB,CAAC,EAAE,CAAC;AAEnC,MAAM,CAAC,MAAM,sBAAsB,GAAG;;;;;;;;;;;;;;EAcpC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,mBAAmB,CAAC,EAAE,CAAC;AAE7B,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;EAmBhC,kBAAkB;;EAElB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,MAAM,CAAC,MAAM,2BAA2B,GAAG;;;;;;;;;;;;;;;EAezC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;AAElC,MAAM,CAAC,MAAM,kBAAkB,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBhC,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,eAAe,CAAC,EAAE,CAAC;AAEzB,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E,MAAM,CAAC,MAAM,UAAU,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBxB,kBAAkB;EAClB,WAAW;yDAC4C,CAAC;AAE1D,MAAM,CAAC,MAAM,QAAQ,GAAG;;;;;;;;;;;;;;;;;;;;;EAqBtB,kBAAkB;EAClB,WAAW;EACX,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC"}
@@ -52,20 +52,68 @@ export type CodexOutcomeReading = {
52
52
  * arbitrary JSON with no stable status key. Its raw value is intentionally
53
53
  * accepted and ignored. Until a native probe records a discriminating
54
54
  * contract, appending either outcome would fabricate it.
55
+ *
56
+ * The negative half of that contract matters as much and is recorded here
57
+ * rather than in a note somebody has to find (APRV-310 v5/v6, APRV-311): Codex
58
+ * has NO counterpart to Claude Code's `PostToolUseFailure`. An exit 0 and an
59
+ * exit 7 shell call both raised the same `PostToolUse` event, and the top-level
60
+ * fields of that event carried no status, no exit code, and nothing else that
61
+ * separates them. So there is no reading to take from the event NAME either,
62
+ * which is the reading Claude Code's adapter relies on. This function is
63
+ * therefore total: it refuses every event, and the caller's unreadable arm
64
+ * (which appends nothing and names the open execution) is the only arm Codex
65
+ * reaches today.
55
66
  */
56
67
  export declare function readCodexReportedOutcome(_input: CodexHookInput): CodexOutcomeReading;
57
68
  export interface CodexBinding {
58
- /** Exact bytes the gate and a future counterpart both bind. */
69
+ /**
70
+ * Exact bytes the gate and a future counterpart both bind.
71
+ *
72
+ * `argv` is present only where the caller supplied one and it AGREES with
73
+ * `command` (APRV-362): the app-server bridge knows the words the kernel will
74
+ * receive, and a payload that named only their rendering would put the
75
+ * approver one parse away from the action. See {@link codexArgv} for why
76
+ * agreement is checked here rather than trusted.
77
+ */
59
78
  payload: {
60
79
  tool: "Bash" | "apply_patch";
61
80
  command: string;
62
81
  cwd: string;
82
+ argv?: string[];
63
83
  };
64
84
  /** Passed to the legacy finish helper; reconstructs the four-segment task. */
65
85
  finishSessionId: string;
66
86
  finishToolUseId: string;
67
87
  task: string;
68
88
  }
89
+ /**
90
+ * The argv a call carries, when it carries one that says nothing new (APRV-362).
91
+ *
92
+ * `tool_input.argv` reaches this runtime from the app-server bridge, which
93
+ * un-joins the command string the server sent so the payload can name the words
94
+ * rather than their rendering. It is READ back out of `tool_input` rather than
95
+ * threaded down a private channel, which is the shape APRV-363 established for
96
+ * the change map beside it, and that raises the obvious question: `tool_input`
97
+ * on a NATIVE Codex event is the model's own tool-call arguments, so a model
98
+ * could put an `argv` there too.
99
+ *
100
+ * It cannot buy anything by doing so, because this function does not believe
101
+ * it. An argv is accepted only when `command` splits to exactly it, which makes
102
+ * the field a DERIVATION of bytes already bound rather than a second claim
103
+ * beside them. A disagreeing argv is `null`, and the caller refuses the call
104
+ * outright rather than quietly binding the command alone: a call whose two
105
+ * accounts of itself differ is one this runtime cannot describe, and SPEC §11.1
106
+ * invariant 4 is kept by construction rather than by care.
107
+ */
108
+ export declare function codexArgv(toolInput: Record<string, unknown>, command: string): string[] | null;
109
+ /**
110
+ * Does this call carry an `argv` that {@link codexArgv} will not accept?
111
+ *
112
+ * The caller's cue to refuse rather than fall back. Absence is not
113
+ * disagreement: a call with no `argv` is every call this runtime made before
114
+ * APRV-362 and is bound exactly as it was.
115
+ */
116
+ export declare function codexArgvDisagrees(toolInput: Record<string, unknown>, command: string): boolean;
69
117
  /**
70
118
  * Build the one Codex tool-call identity used by both pre and post phases.
71
119
  *
@@ -9,6 +9,7 @@
9
9
  import { realpathSync } from "node:fs";
10
10
  import { resolve } from "node:path";
11
11
  import { payloadHash } from "../core/payload.js";
12
+ import { shlexSplit } from "../core/shlex.js";
12
13
  /** The only Codex events this adapter understands. */
13
14
  export const CODEX_PRE_TOOL_EVENT = "PreToolUse";
14
15
  export const CODEX_POST_TOOL_EVENT = "PostToolUse";
@@ -119,6 +120,17 @@ export function checkCodexHookInput(input, processCwd) {
119
120
  * arbitrary JSON with no stable status key. Its raw value is intentionally
120
121
  * accepted and ignored. Until a native probe records a discriminating
121
122
  * contract, appending either outcome would fabricate it.
123
+ *
124
+ * The negative half of that contract matters as much and is recorded here
125
+ * rather than in a note somebody has to find (APRV-310 v5/v6, APRV-311): Codex
126
+ * has NO counterpart to Claude Code's `PostToolUseFailure`. An exit 0 and an
127
+ * exit 7 shell call both raised the same `PostToolUse` event, and the top-level
128
+ * fields of that event carried no status, no exit code, and nothing else that
129
+ * separates them. So there is no reading to take from the event NAME either,
130
+ * which is the reading Claude Code's adapter relies on. This function is
131
+ * therefore total: it refuses every event, and the caller's unreadable arm
132
+ * (which appends nothing and names the open execution) is the only arm Codex
133
+ * reaches today.
122
134
  */
123
135
  export function readCodexReportedOutcome(_input) {
124
136
  return {
@@ -126,6 +138,47 @@ export function readCodexReportedOutcome(_input) {
126
138
  detail: "Codex PostToolUse does not yet expose a native-verified success or failure reading; tool_response is arbitrary JSON, so the execution remains open",
127
139
  };
128
140
  }
141
+ /**
142
+ * The argv a call carries, when it carries one that says nothing new (APRV-362).
143
+ *
144
+ * `tool_input.argv` reaches this runtime from the app-server bridge, which
145
+ * un-joins the command string the server sent so the payload can name the words
146
+ * rather than their rendering. It is READ back out of `tool_input` rather than
147
+ * threaded down a private channel, which is the shape APRV-363 established for
148
+ * the change map beside it, and that raises the obvious question: `tool_input`
149
+ * on a NATIVE Codex event is the model's own tool-call arguments, so a model
150
+ * could put an `argv` there too.
151
+ *
152
+ * It cannot buy anything by doing so, because this function does not believe
153
+ * it. An argv is accepted only when `command` splits to exactly it, which makes
154
+ * the field a DERIVATION of bytes already bound rather than a second claim
155
+ * beside them. A disagreeing argv is `null`, and the caller refuses the call
156
+ * outright rather than quietly binding the command alone: a call whose two
157
+ * accounts of itself differ is one this runtime cannot describe, and SPEC §11.1
158
+ * invariant 4 is kept by construction rather than by care.
159
+ */
160
+ export function codexArgv(toolInput, command) {
161
+ const value = toolInput["argv"];
162
+ if (!Array.isArray(value))
163
+ return null;
164
+ const argv = value.filter((entry) => typeof entry === "string");
165
+ if (argv.length !== value.length)
166
+ return null;
167
+ const split = shlexSplit(command);
168
+ if (!split.ok || split.argv.length !== argv.length)
169
+ return null;
170
+ return split.argv.every((word, at) => word === argv[at]) ? argv : null;
171
+ }
172
+ /**
173
+ * Does this call carry an `argv` that {@link codexArgv} will not accept?
174
+ *
175
+ * The caller's cue to refuse rather than fall back. Absence is not
176
+ * disagreement: a call with no `argv` is every call this runtime made before
177
+ * APRV-362 and is bound exactly as it was.
178
+ */
179
+ export function codexArgvDisagrees(toolInput, command) {
180
+ return toolInput["argv"] !== undefined && codexArgv(toolInput, command) === null;
181
+ }
129
182
  /**
130
183
  * Build the one Codex tool-call identity used by both pre and post phases.
131
184
  *
@@ -143,7 +196,13 @@ export function codexBinding(input, processCwd) {
143
196
  if (input.toolUseId === null)
144
197
  throw new Error("codexBinding requires a validated tool_use_id");
145
198
  const tool = input.toolName;
146
- const payload = { tool, command, cwd: realpathSync(processCwd) };
199
+ const argv = codexArgv(input.toolInput, command);
200
+ const payload = {
201
+ tool,
202
+ command,
203
+ cwd: realpathSync(processCwd),
204
+ ...(argv === null ? {} : { argv }),
205
+ };
147
206
  const sessionDigest = payloadHash({
148
207
  domain: "approval.md/codex-hook-session/v1",
149
208
  harness: "codex",
@@ -1 +1 @@
1
- {"version":3,"file":"hook-codex.js","sourceRoot":"","sources":["../../../src/cli/hook-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAEjD,sDAAsD;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,SAAS,GAAG,sCAAsC,CAAC;AAkBzD,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAoB;IAClD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,GAAG,IAAI,+DAA+D,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAqB,EAAE,UAAkB;IAC3E,MAAM,KAAK,GACT,KAAK,CAAC,aAAa,KAAK,oBAAoB;QAC1C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,CAAC,aAAa,KAAK,qBAAqB;YAC7C,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC;IACb,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2BAA2B,oBAAoB,OAAO,qBAAqB,EAAE;SACtF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE5D,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QAClE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,oEAAoE;SAC9G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,gDAAgD,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,8DAA8D,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;SACpH,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,SAAS;QAC5C,OAAO,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,QAAQ,EAClD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;IAC5F,CAAC;IAED,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClF,IAAI,QAAgB,CAAC;IACrB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mEAAmE;SAC5E,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,+CAA+C;SAC7F,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAU,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,GAAG,gCAAgC,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,GAAG,wBAAwB,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB,GAAG,+CAA+C;aAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAMD;;;;;;;;GAQG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EACJ,oJAAoJ;KACvJ,CAAC;AACJ,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAqB,EAAE,UAAkB;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,aAAa,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/F,MAAM,IAAI,GAA2B,KAAK,CAAC,QAAQ,CAAC;IACpD,MAAM,OAAO,GAAG,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,YAAY,CAAC,UAAU,CAAC,EAAE,CAAC;IACjE,MAAM,aAAa,GAAG,WAAW,CAAC;QAChC,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,KAAK,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC;QAC7B,MAAM,EAAE,gCAAgC;QACxC,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,WAAW,EAAE,KAAK,CAAC,SAAS;QAC5B,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,SAAS,aAAa,EAAE,CAAC;IACjD,OAAO;QACL,OAAO;QACP,eAAe;QACf,eAAe,EAAE,UAAU;QAC3B,IAAI,EAAE,QAAQ,eAAe,IAAI,UAAU,EAAE;KAC9C,CAAC;AACJ,CAAC"}
1
+ {"version":3,"file":"hook-codex.js","sourceRoot":"","sources":["../../../src/cli/hook-codex.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAE9C,sDAAsD;AACtD,MAAM,CAAC,MAAM,oBAAoB,GAAG,YAAY,CAAC;AACjD,MAAM,CAAC,MAAM,qBAAqB,GAAG,aAAa,CAAC;AAEnD,8EAA8E;AAC9E,MAAM,SAAS,GAAG,sCAAsC,CAAC;AAkBzD,SAAS,QAAQ,CAAC,IAAY,EAAE,KAAoB;IAClD,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,GAAG,IAAI,+DAA+D,CAAC;IAChF,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,mBAAmB,CAAC,KAAqB,EAAE,UAAkB;IAC3E,MAAM,KAAK,GACT,KAAK,CAAC,aAAa,KAAK,oBAAoB;QAC1C,CAAC,CAAC,KAAK;QACP,CAAC,CAAC,KAAK,CAAC,aAAa,KAAK,qBAAqB;YAC7C,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,IAAI,CAAC;IACb,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2BAA2B,oBAAoB,OAAO,qBAAqB,EAAE;SACtF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,EAAE,KAAK,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IACxF,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAC5D,MAAM,OAAO,GAAG,QAAQ,CAAC,aAAa,EAAE,KAAK,CAAC,SAAS,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IAE5D,IAAI,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,aAAa,EAAE,CAAC;QAClE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,QAAQ,CAAC,oEAAoE;SAC9G,CAAC;IACJ,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9F,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,gDAAgD,EAAE,CAAC;IAClG,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,SAAS,EAAE,aAAa,EAAE,KAAK,EAAE,SAAS,CAAC,CAAC,CAAC;IACzE,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;IACpF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,KAAK,CAAC,QAAQ,8DAA8D,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE;SACpH,CAAC;IACJ,CAAC;IACD,IACE,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,SAAS;QAC5C,OAAO,KAAK,CAAC,SAAS,CAAC,aAAa,CAAC,KAAK,QAAQ,EAClD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2DAA2D,EAAE,CAAC;IAC5F,CAAC;IAED,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uBAAuB,EAAE,CAAC;IAClF,IAAI,QAAgB,CAAC;IACrB,IAAI,SAAiB,CAAC;IACtB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACnC,SAAS,GAAG,YAAY,CAAC,UAAU,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,mEAAmE;SAC5E,CAAC;IACJ,CAAC;IACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,YAAY,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,+CAA+C;SAC7F,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,GAAG,IAAI,CAAC,KAAK,EAAE,SAAS,CAAU,EAAE,CAAC;QAC9C,MAAM,MAAM,GAAG,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,MAAM,KAAK,SAAS;YAAE,SAAS;QACnC,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,GAAG,gCAAgC,EAAE,CAAC;QACvF,CAAC;QACD,IAAI,QAAgB,CAAC;QACrB,IAAI,CAAC;YACH,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC;QACvD,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mBAAmB,GAAG,wBAAwB,EAAE,CAAC;QAC/E,CAAC;QACD,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EAAE,mBAAmB,GAAG,+CAA+C;aAC9E,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AAC7B,CAAC;AAMD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,wBAAwB,CAAC,MAAsB;IAC7D,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EACJ,oJAAoJ;KACvJ,CAAC;AACJ,CAAC;AAmBD;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,UAAU,SAAS,CAAC,SAAkC,EAAE,OAAe;IAC3E,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACjF,IAAI,IAAI,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,KAAK,CAAC,EAAE,IAAI,KAAK,CAAC,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC,MAAM;QAAE,OAAO,IAAI,CAAC;IAChE,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,EAAE,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AACzE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAkC,EAAE,OAAe;IACpF,OAAO,SAAS,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,SAAS,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,IAAI,CAAC;AACnF,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,YAAY,CAAC,KAAqB,EAAE,UAAkB;IACpE,MAAM,OAAO,GAAG,KAAK,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,aAAa,CAAC,IAAI,OAAO,OAAO,KAAK,QAAQ,EAAE,CAAC;QACnG,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IACD,IAAI,KAAK,CAAC,SAAS,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAC;IAC/F,MAAM,IAAI,GAA2B,KAAK,CAAC,QAAQ,CAAC;IACpD,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IACjD,MAAM,OAAO,GAAG;QACd,IAAI;QACJ,OAAO;QACP,GAAG,EAAE,YAAY,CAAC,UAAU,CAAC;QAC7B,GAAG,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;KACnC,CAAC;IACF,MAAM,aAAa,GAAG,WAAW,CAAC;QAChC,MAAM,EAAE,mCAAmC;QAC3C,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,KAAK,CAAC,SAAS;KAC5B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,WAAW,CAAC;QAC7B,MAAM,EAAE,gCAAgC;QACxC,OAAO,EAAE,OAAO;QAChB,UAAU,EAAE,KAAK,CAAC,SAAS;QAC3B,WAAW,EAAE,KAAK,CAAC,SAAS;QAC5B,YAAY,EAAE,WAAW,CAAC,OAAO,CAAC;KACnC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,SAAS,aAAa,EAAE,CAAC;IACjD,OAAO;QACL,OAAO;QACP,eAAe;QACf,eAAe,EAAE,UAAU;QAC3B,IAAI,EAAE,QAAQ,eAAe,IAAI,UAAU,EAAE;KAC9C,CAAC;AACJ,CAAC"}