failproofai 1.0.2-beta.0 → 1.0.2-beta.1

package/src/hooks/pack-manifest.ts

@@ -2,7 +2,7 @@
  * Reads the installed policy packs a machine has on disk.
  *
  * A pack is the delivery unit for policies that did not ship compiled into this
- * build: `failproofai pack add` writes the artifact and records it here, and the
+ * build: `failproofai policies add` writes the artifact and records it here, and the
  * loader imports it through the same path custom policies already use.
  *
  * ## Why this is not `cloud-managed-policies.ts`
@@ -24,11 +24,19 @@
  * ## Fail-open, and the condition that makes it sound
  *
  * An unreadable manifest, a bad digest or a corrupt artifact yields zero packs
- * and a recorded error — it does not deny. That is only defensible **while the
- * builtin policies still ship compiled into the package and keep enforcing
- * underneath**. The day builtins become a fetched pack, this exact behaviour
- * becomes "zero enforcement on a machine reporting healthy", and this comment is
- * the reason that must be revisited rather than inherited.
+ * and a recorded error — this READER does not deny.
+ *
+ * That used to be defensible because the builtin policies shipped compiled in
+ * and kept enforcing underneath. They no longer do: the builtins ARE a pack now,
+ * so a silent zero here would be zero enforcement at exit 0 on a machine that
+ * reports healthy — exactly what the comment that stood here warned about.
+ *
+ * What makes it sound now is that the denying moved rather than disappeared:
+ * `pack-failclosed.ts` reads these same `errors` and refuses the events the
+ * missing policies declared. So this stays a pure reader that reports what it
+ * found, and the layer above decides what a failure means. Do not add a throw
+ * here — per-pack isolation is the reason one bad third-party pack cannot
+ * switch off every other pack on the machine.
  */
 import { createHash } from "node:crypto";
 import { existsSync, readFileSync } from "node:fs";

package/src/hooks/pack-store.ts

@@ -18,7 +18,9 @@
  * Asset URLs are CONSTRUCTED from an owner, repo and concrete tag. When the
  * user omits a tag, one `releases/latest` redirect resolves it before any asset
  * is fetched or written. There is no API lookup or rate-limit dependency, and
- * the installed record always names the pinned result.
+ * the installed record always names the pinned result — which has to AGREE with
+ * the version that pack's manifest declares, or nothing is installed at all
+ * (`packTagMatchesVersion`).
  *
  * ## Never on the hook path
  *
@@ -157,6 +159,14 @@ function validated(owner: string, repo: string, tag: string | null): PackSpec {
  * unauthenticated rate limit, and stays pointed at whatever
  * `FAILPROOFAI_PACK_BASE_URL` names — which is how a mirror, and the tests,
  * work at all.
+ *
+ * The price of that, and it is a real one: the redirect is issued only for a
+ * PUBLISHED, non-prerelease release. A repository whose newest release is a
+ * prerelease or a draft therefore either redirects to an OLDER stable tag —
+ * pinning something the publisher has already superseded — or issues no
+ * redirect at all. Only the second is detectable from here, so the error names
+ * the prerelease case explicitly; the first is why naming a tag is the answer
+ * whenever a publisher's newest release is not their newest stable one.
  */
 export async function resolveLatestTag(spec: PackSpec): Promise<string> {
   const url = `${baseUrl()}/${spec.owner}/${spec.repo}/releases/latest`;
@@ -168,7 +178,9 @@ export async function resolveLatestTag(spec: PackSpec): Promise<string> {
   if (!location) {
     throw new Error(
       `could not resolve the newest release of ${spec.owner}/${spec.repo} ` +
-        `(GET ${url} returned ${response.status} with no redirect). Name a tag explicitly.`,
+        `(GET ${url} returned ${response.status} with no redirect). That redirect is issued only ` +
+        `for a published, non-prerelease release, so either the repository has no releases at all ` +
+        `or every release it has is a prerelease or a draft. Name a tag explicitly.`,
     );
   }
   const match = location.match(/\/releases\/tag\/(.+)$/);
@@ -193,6 +205,33 @@ export function packAssetUrl(spec: PinnedPackSpec, asset: string): string {
   return `${baseUrl()}/${spec.owner}/${spec.repo}/releases/download/${spec.tag}/${asset}`;
 }
 
+/**
+ * Does a release tag describe the version the pack's own manifest declares?
+ *
+ * These are two independently-typed strings that everything downstream treats as
+ * one fact: the TAG builds every asset URL and is what `installed.json` records
+ * as the source, while the VERSION is read out of the manifest and is what
+ * `pack list` prints and `pack:<id>@<version>:<name>` keys are built from. Left
+ * uncompared, a pack tagged `v2` whose manifest still said `1.0.0` installed
+ * cleanly and recorded a version no release of that repository answers to.
+ *
+ * A leading `v` is accepted because both spellings are in live use for the same
+ * release — `pack build` tells publishers to tag `<version>` while this repo's
+ * own releases are tagged `v<version>` — and refusing that would break packs
+ * that are perfectly coherent.
+ *
+ * Compared on the tag's LAST `/`-delimited segment, so the monorepo shape
+ * `parsePackSpec` deliberately supports (`release/2.1`) still installs:
+ * `PACK_VERSION_RE` forbids `/`, so such a tag could never equal a version and a
+ * whole-string comparison would make the shape uninstallable rather than merely
+ * unusual. Everything else is a genuine disagreement — the release was tagged
+ * without rebuilding the manifest, or the wrong tag was typed.
+ */
+export function packTagMatchesVersion(tag: string, version: string): boolean {
+  const tail = tag.slice(tag.lastIndexOf("/") + 1);
+  return tail === version || tail === `v${version}`;
+}
+
 async function fetchBytes(url: string): Promise<Buffer> {
   const response = await fetch(url, {
     signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
@@ -277,6 +316,16 @@ interface FetchedPack {
  * and has to resolve it the same way — `core` worked in the terminal and failed
  * in the browser for exactly as long as this list sat in `pack-cli.ts`.
  */
+/**
+ * Where our own policies actually live.
+ *
+ * They are a GitHub release like anybody else's, and the package carries no
+ * copy of them. That is the point: a pack that ships inside the binary is a
+ * policy set we chose for you and put on your disk before you asked, and it
+ * gives our own policies a delivery path nobody else's pack can use. One lane,
+ * the same for everyone — ours are just the pack whose short name we spell.
+ */
+export const CORE_SOURCE = "FailproofAI/policies";
 export const CORE_ALIASES = new Set(["core", "failproofai", "official"]);
 
 export interface PackAddOptions {
@@ -307,18 +356,12 @@ export async function addPackFromSource(
   source: string,
   opts: PackAddOptions = {},
 ): Promise<AddedPack> {
-  if (CORE_ALIASES.has(source.trim().toLowerCase())) {
-    const result = installBundledPack(opts);
-    if (!result.installed) throw new Error(result.reason ?? "could not install");
-    return {
-      id: result.id!,
-      version: result.version!,
-      enabled: result.enabled ?? result.available ?? [],
-      available: result.available ?? [],
-      bundled: true,
-    };
-  }
-  const result = await addPack(source, opts);
+  // `core` is a spelling of CORE_SOURCE, not a second delivery path. Resolved
+  // HERE rather than in the CLI so the dashboard and the CLI cannot disagree
+  // about what the short name means — they did once, and a name the CLI could
+  // resolve failed in the browser.
+  const resolved = CORE_ALIASES.has(source.trim().toLowerCase()) ? CORE_SOURCE : source;
+  const result = await addPack(resolved, opts);
   return {
     id: result.id,
     version: result.version,
@@ -607,6 +650,27 @@ export async function addPack(
     : { ...parsed, tag: await resolveLatestTag(parsed) };
   const resolvedFromLatest = parsed.tag === null;
   const fetched = await fetchPack(spec);
+  // Checked here, before a byte is written and before the artifact is imported,
+  // so a refusal leaves the machine exactly as it was — and on the RESOLVED tag
+  // as well as a typed one, because a tagless add pins whatever
+  // `releases/latest` pointed at and lands the same incoherent pair in
+  // `installed.json` with nobody having typed it. Deliberately NOT in
+  // `fetchPackPreview`: looking at a pack has to stay possible precisely so a
+  // publisher can SEE the two values disagree.
+  if (!packTagMatchesVersion(spec.tag, fetched.version)) {
+    const fromTag = spec.tag.slice(spec.tag.lastIndexOf("/") + 1).replace(/^v/, "");
+    const fix =
+      `re-tag the release ${fetched.version} (a leading v is fine), or rebuild the pack with ` +
+      `--version ${fromTag}`;
+    throw new Error(
+      `${fetched.id} was not installed: release tag ${spec.tag} does not match the version its ` +
+        `manifest declares (${fetched.version}). ` +
+        (resolvedFromLatest
+          ? `That is the newest release of ${spec.owner}/${spec.repo}, so the release and the pack ` +
+            `disagree at the source — ask the publisher to ${fix}.`
+          : `Name the tag whose manifest says ${fetched.version}, or fix the pack: ${fix}.`),
+    );
+  }
   const available = fetched.policies.map((p) => p.name);
 
   const prior = priorRecordFor(fetched.id, fetched.artifactDigest);
@@ -686,25 +750,21 @@ export async function addPack(
 }
 
 /**
- * Install the pack that ships inside the npm package, from disk.
+ * The vendored pack directory, when a working tree happens to have one.
  *
- * This is what makes removing the builtins from the bundle survivable. The
- * tarball carries `policy-pack/` — the builtins as a real, digest-verified pack —
- * so a machine that has just installed failproofai already HAS them and setup
- * can enable them with no network at all. Without this, a fresh install with no
- * connectivity would be a machine enforcing nothing.
+ * The published package does NOT carry `policy-pack/` and there is no install
+ * path through here. Our policies are fetched from their GitHub release like
+ * anybody else's — a pack that ships inside the binary is a policy set chosen
+ * for the user and written to their disk before they asked, and it gave our own
+ * policies a delivery route no third-party pack could use.
+ *
+ * The one remaining caller is `audit/replay.ts`, which prefers the pack's own
+ * functions when a dev tree has run `build:pack` and falls back to the compiled
+ * implementations when it returns null. Both produce identical text, so the two
+ * paths score the same; the fallback is the normal case now.
  *
  * Anchored at `FAILPROOFAI_PACKAGE_ROOT` for the reason `npmPlatformBinaryPath`
  * documents: `import.meta.url` does not survive the CJS bundle.
- *
- * The bytes are COPIED into `packsDir()` rather than loaded where they lie. A
- * `sudo npm i -g` package directory is root-owned, and the loader writes its
- * rewritten module tree BESIDE the source it loads — so loading in place gives a
- * non-root hook EACCES, the pack never loads, and the hook exits 0. Copying is
- * what avoids that, and it is the same trap CHANGELOG #694 fixed for the shim.
- *
- * Idempotent, and never throws: a package without the directory returns null,
- * which is a normal state for a dev checkout that has not run `build:pack`.
  */
 export function bundledPackDir(): string | null {
   const root = process.env.FAILPROOFAI_PACKAGE_ROOT;
@@ -713,105 +773,6 @@ export function bundledPackDir(): string | null {
   return existsSync(resolve(dir, PACK_MANIFEST_ASSET)) ? dir : null;
 }
 
-export interface BundledPackResult {
-  installed: boolean;
-  id?: string;
-  version?: string;
-  enabled?: string[];
-  available?: string[];
-  /** Ids this install absorbed — the same pack, previously under another name. */
-  replaced?: string[];
-  reason?: string;
-}
-
-export function installBundledPack(opts?: { only?: string[]; categories?: string[]; all?: boolean }): BundledPackResult {
-  const dir = bundledPackDir();
-  if (!dir) return { installed: false, reason: "this build ships no bundled pack" };
-
-  try {
-    const checksums = readFileSync(resolve(dir, PACK_CHECKSUMS_ASSET), "utf8");
-    const manifestBytes = readFileSync(resolve(dir, PACK_MANIFEST_ASSET));
-    const artifact = readFileSync(resolve(dir, PACK_ENTRY_ASSET));
-
-    // Verified even though it never crossed a network. The digest is what the
-    // hook path re-checks before every import, so it has to describe the bytes
-    // actually installed — and a tarball can be corrupted on disk like anything
-    // else.
-    const manifestDigest = digestFor(checksums, PACK_MANIFEST_ASSET);
-    const entryDigest = digestFor(checksums, PACK_ENTRY_ASSET);
-    const artifactDigest = sha256(artifact);
-    if (!manifestDigest || sha256(manifestBytes) !== manifestDigest) {
-      return { installed: false, reason: `${PACK_MANIFEST_ASSET} failed integrity verification` };
-    }
-    if (!entryDigest || artifactDigest !== entryDigest) {
-      return { installed: false, reason: `${PACK_ENTRY_ASSET} failed integrity verification` };
-    }
-
-    const parsed = JSON.parse(manifestBytes.toString("utf8")) as {
-      id?: unknown; version?: unknown; policies?: unknown; effect?: unknown;
-    };
-    if (!Array.isArray(parsed.policies)) {
-      return { installed: false, reason: "bundled pack manifest is malformed" };
-    }
-    const identity = parsePackIdentity(parsed);
-    // Same rules the loader applies, so a bundled pack that could never load
-    // fails the install rather than looking fine until the next tool call.
-    const policies = parsed.policies.map((pol, i) => parsePackPolicy(identity.id, pol, i));
-
-    const root = packsRoot();
-    const artifactRel = `artifacts/${artifactDigest}.mjs`;
-    const artifactAbs = resolve(root, artifactRel);
-    if (!existsSync(artifactAbs)) writeAtomic(artifactAbs, artifact);
-
-    const prior = priorRecordFor(identity.id, artifactDigest);
-    const available = policies.map((pol) => pol.name);
-    const { enabled } = resolveSelection(
-      policies,
-      opts,
-      prior?.enabled ? prior.enabled.filter((n) => available.includes(n)) : prior?.enabled,
-      Boolean(prior),
-    );
-
-    const absorbed = upsertInstalled({
-      id: identity.id,
-      version: identity.version,
-      // Recorded as `bundled:` rather than a github: source, because it did not
-      // come from one — and `pack add` on this id would otherwise look like a
-      // re-fetch of something that was never fetched.
-      source: `bundled:${identity.id}@${identity.version}`,
-      entry: artifactRel,
-      sha256: artifactDigest,
-      policies,
-      ...(parsed.effect !== undefined ? { effect: identity.effect } : {}),
-      ...(enabled ? { enabled } : {}),
-    });
-
-    return {
-      installed: true,
-      id: identity.id,
-      version: identity.version,
-      enabled: enabled ?? available,
-      available,
-      ...(absorbed.length > 0 ? { replaced: absorbed } : {}),
-    };
-  } catch (err) {
-    return { installed: false, reason: errText(err) };
-  }
-}
-
-/** Remove a pack from the activation pointer. Returns false if it was not installed. */
-/**
- * Turn ONE policy of an installed pack on or off.
- *
- * The selection in `installed.json` is the lever, not a `disabledCustomPolicies`
- * entry: those are keyed by `pack:<id>@<version>:<name>`, so an upgrade stops
- * matching them and silently switches back on everything the user had turned
- * off. The selection is version-stable and is carried forward by `pack add`.
- *
- * Enabling also clears any matching disabled key, or a policy switched off from
- * the dashboard could not be switched back on from the CLI — the two mechanisms
- * would disagree and the more obscure one would win.
- */
 export function setPackPolicyEnabled(
   packId: string,
   name: string,

package/src/hooks/tui.ts

@@ -14,8 +14,8 @@
  * repaint) and, on resolve, collapses that region to a one-line summary that
  * stays on screen — so the next prompt simply appends below, building the log.
  * No external dependencies. Honors NO_COLOR and non-TTY (returns the default
- * without drawing), and uses 24-bit color where COLORTERM advertises it,
- * falling back to the nearest basic ANSI hue otherwise.
+ * without drawing), and paints at the deepest tier the terminal admits to —
+ * 24-bit, the xterm-256 cube, or the 16 basic ANSI hues.
  */
 import * as readline from "node:readline";
 
@@ -116,13 +116,32 @@ const FLOWER = "❋";
 // re-deriving their own copies.
 interface Hue {
   rgb: [number, number, number];
+  /**
+   * xterm-256 index for the middle tier, verified as the nearest cube entry by
+   * Euclidean distance rather than eyeballed.
+   *
+   * Optional because `dim` has no honest answer: its `basic` is SGR 2, an
+   * ATTRIBUTE that steps down whatever foreground the user's theme is already
+   * using, and the cube's nearest grey (243, #767676) is a fixed colour that
+   * fights every theme that is not ours. So dim keeps the attribute at all
+   * three tiers and this stays undefined.
+   */
+  c256?: number;
   basic: string;
 }
+/**
+ * TWO accent hues and no third — the brand system states that as a rule, and
+ * this table used to break it: `pink` was #ff2e88, a hot pink that appears in
+ * no brand token, sitting beside `logoPink` #e4587d which was the real one. The
+ * mark and the prompts were therefore two different pinks, and neither surface
+ * could be recoloured without the other drifting. There is now one pink.
+ * Everything past the two accents is a state — amber for warn, an attribute for
+ * dim — never identity.
+ */
 const HUES = {
-  guide: { rgb: [102, 209, 181], basic: "36" }, // teal — the policy flower / step spine
-  pink: { rgb: [255, 46, 136], basic: "95" }, // hot pink — selection, enabled, the brand
-  logoPink: { rgb: [228, 88, 124], basic: "95" }, // the softer artwork pink of the logomark
-  warn: { rgb: [227, 179, 65], basic: "33" },
+  guide: { rgb: [102, 209, 181], c256: 79, basic: "36" }, // #66d1b5 mint — the policy flower / step spine
+  pink: { rgb: [228, 88, 125], c256: 168, basic: "95" }, // #e4587d — selection, enabled, the mark, the brand
+  warn: { rgb: [227, 179, 65], c256: 179, basic: "33" },
   dim: { rgb: [107, 118, 132], basic: "2" },
 } satisfies Record<string, Hue>;
 
@@ -137,32 +156,68 @@ export function colorsEnabled(out: TTYOut): boolean {
  * blue that appear nowhere in the brand — so `audit` looked like a different
  * product from `config`. Routing it here
  * keeps HUES the single source of truth: change a hue once and every surface
- * follows. Emits truecolor where the terminal advertises it, basic ANSI
- * otherwise; the caller still decides *whether* to colour at all.
+ * follows. Paints at the deepest tier the terminal admits to; the caller still
+ * decides *whether* to colour at all.
  */
 export function brandAnsi(role: keyof typeof HUES): string {
-  const h = HUES[role];
-  const code = truecolorEnabled() ? `38;2;${h.rgb.join(";")}` : h.basic;
-  return `${ESC}[${code}m`;
+  return `${ESC}[${fg(HUES[role], colorTier())}m`;
 }
 
 export const ANSI_RESET = `${ESC}[0m`;
 export const ANSI_BOLD = `${ESC}[1m`;
 export const ANSI_DIM = `${ESC}[2m`;
-function truecolorEnabled(): boolean {
-  return /truecolor|24bit/i.test(process.env.COLORTERM || "");
-}
 
-/** Brand painter: role-named color functions, truecolor where advertised,
- * basic-ANSI fallback otherwise, identity when `on` is false. */
+/** How much colour this terminal will actually render. */
+type ColorTier = "truecolor" | "ansi256" | "basic";
+
+/**
+ * Three tiers, because the two-way gate skipped the one most terminals are in.
+ *
+ * COLORTERM-or-nothing sent every terminal that renders 256 colours but does
+ * not advertise 24-bit — tmux and screen, ssh into a stock xterm, most CI
+ * runners — all the way down to the 16 basic hues, where the brand pink lands
+ * on generic bright magenta and the mint on generic cyan. TERM naming its own
+ * depth is the signal those terminals do set, and it costs one regex.
+ *
+ * Deliberately no `FORCE_COLOR` / `-256color`-less allowlist: over-claiming a
+ * depth prints raw escape bytes into the user's scrollback, which is worse than
+ * an approximate hue. Under-claiming only costs fidelity.
+ */
+function colorTier(): ColorTier {
+  if (/truecolor|24bit/i.test(process.env.COLORTERM || "")) return "truecolor";
+  if (/256color/i.test(process.env.TERM || "")) return "ansi256";
+  return "basic";
+}
+
+/** SGR foreground parameters for a hue at a tier. The ONE place a hue turns
+ *  into bytes, so a new tier is added here and nowhere else. */
+function fg(h: Hue, tier: ColorTier): string {
+  if (tier === "truecolor") return `38;2;${h.rgb[0]};${h.rgb[1]};${h.rgb[2]}`;
+  if (tier === "ansi256" && h.c256 !== undefined) return `38;5;${h.c256}`;
+  return h.basic;
+}
+
+/** The same as a background — only the logomark needs one, for a half-block
+ *  cell whose two pixels are different hues. The current grid has no such cell
+ *  (the flower and the cross never share a column), so this is here for the
+ *  next grid edit, which the rules above LOGO_GRID actively invite. Never
+ *  called at the basic tier: the mark draws monochrome there rather than
+ *  approximate two brand hues with ANSI 5 and 6. */
+function bg(h: Hue, tier: ColorTier): string {
+  return tier === "ansi256" && h.c256 !== undefined
+    ? `48;5;${h.c256}`
+    : `48;2;${h.rgb[0]};${h.rgb[1]};${h.rgb[2]}`;
+}
+
+/** Brand painter: role-named color functions at the terminal's best tier,
+ * identity when `on` is false. */
 export function paint(on: boolean) {
-  const tc = on && truecolorEnabled();
+  const tier: ColorTier = on ? colorTier() : "basic";
   const mk =
     (h: Hue, bold = false) =>
     (s: string): string => {
       if (!on) return s;
-      const code = tc ? `38;2;${h.rgb[0]};${h.rgb[1]};${h.rgb[2]}` : h.basic;
-      return `${ESC}[${bold ? "1;" : ""}${code}m${s}${ESC}[0m`;
+      return `${ESC}[${bold ? "1;" : ""}${fg(h, tier)}m${s}${ESC}[0m`;
     };
   return {
     bold: (s: string) => (on ? `${ESC}[1m${s}${ESC}[0m` : s),
@@ -170,7 +225,11 @@ export function paint(on: boolean) {
     guide: mk(HUES.guide),
     pink: mk(HUES.pink),
     pinkBold: mk(HUES.pink, true),
-    softPink: mk(HUES.logoPink),
+    // An ALIAS of `pink`, not a hue. The logomark's softer artwork tint
+    // collapsed into the one brand pink, so this name survives only for its
+    // single caller — install-prompt.ts's "beta" pill — and should be renamed
+    // to `pink` there, at which point it is deleted.
+    softPink: mk(HUES.pink),
     warn: mk(HUES.warn),
   };
 }
@@ -224,37 +283,40 @@ const LOGO_GRID = [
   "..ppppppppppp",
   "..ppppppppppp",
 ];
-// Derived from the shared HUES table so a palette tweak needs one edit.
-const LOGO_TEAL: [number, number, number] = HUES.guide.rgb;
-const LOGO_PINK: [number, number, number] = HUES.logoPink.rgb;
-
-/** Render the logomark as half-block art. When `colorize` is false (no truecolor
- * / NO_COLOR) the shape still prints, just monochrome. */
-function renderLogo(colorize: boolean): string[] {
+// Derived from the shared HUES table so a palette tweak needs one edit. The
+// mark is painted from the SAME two accents as the prompts — it used to carry
+// its own pink, which is how the two drifted apart.
+const LOGO_TEAL: Hue = HUES.guide;
+const LOGO_PINK: Hue = HUES.pink;
+
+/** Render the logomark as half-block art. At the `basic` tier (16 colours, or
+ * NO_COLOR) the shape still prints, just monochrome — approximating two brand
+ * hues with generic magenta and cyan reads as a different mark, and the shape
+ * alone already carries it. */
+function renderLogo(tier: ColorTier): string[] {
   const pad = ".".repeat(LOGO_GRID[0]?.length ?? 0);
-  const rgb = (ch: string): [number, number, number] | null =>
-    ch === "t" ? LOGO_TEAL : ch === "p" ? LOGO_PINK : null;
+  const hue = (ch: string): Hue | null => (ch === "t" ? LOGO_TEAL : ch === "p" ? LOGO_PINK : null);
   const lines: string[] = [];
   for (let r = 0; r < LOGO_GRID.length; r += 2) {
     const top = LOGO_GRID[r];
     const bot = LOGO_GRID[r + 1] ?? pad;
     let line = "";
     for (let x = 0; x < top.length; x++) {
-      const t = rgb(top[x]);
-      const b = rgb(bot[x]);
+      const t = hue(top[x]);
+      const b = hue(bot[x]);
       if (!t && !b) {
         line += " ";
-      } else if (!colorize) {
+      } else if (tier === "basic") {
         line += t && b ? "█" : t ? "▀" : "▄";
       } else if (t && b) {
         line +=
           t === b
-            ? `${ESC}[38;2;${t.join(";")}m█${ESC}[0m`
-            : `${ESC}[38;2;${t.join(";")};48;2;${b.join(";")}m▀${ESC}[0m`;
+            ? `${ESC}[${fg(t, tier)}m█${ESC}[0m`
+            : `${ESC}[${fg(t, tier)};${bg(b, tier)}m▀${ESC}[0m`;
       } else if (t) {
-        line += `${ESC}[38;2;${t.join(";")}m▀${ESC}[0m`;
+        line += `${ESC}[${fg(t, tier)}m▀${ESC}[0m`;
       } else {
-        line += `${ESC}[38;2;${b!.join(";")}m▄${ESC}[0m`;
+        line += `${ESC}[${fg(b!, tier)}m▄${ESC}[0m`;
       }
     }
     lines.push(line);
@@ -320,8 +382,10 @@ export function renderBrandLogo(stdout: TTYOut = process.stdout): string[] {
   if (cols < LOGO_MIN_COLS) {
     return [`${c.guide(FLOWER)} fa${c.pink("il")}proof ai  ${c.dim("· " + TAGLINE)}`];
   }
-  const tc = colorsEnabled(stdout) && truecolorEnabled();
-  const lines = renderLogo(tc).map((l) => `  ${l}`);
+  // NO_COLOR / non-TTY forces `basic`, which renderLogo draws monochrome — so
+  // the mark never emits an escape byte on a stream that asked for none.
+  const tier: ColorTier = colorsEnabled(stdout) ? colorTier() : "basic";
+  const lines = renderLogo(tier).map((l) => `  ${l}`);
   lines.push("");
   lines.push(`  fa${c.pink("il")}proof ai`);
   lines.push(`  ${c.dim(TAGLINE)}`);
@@ -445,6 +509,24 @@ function nameWidth(labels: string[]): number {
   return Math.min(24, Math.max(6, ...labels.map((l) => l.length)));
 }
 
+/**
+ * The hint budget for one row, after a label that outgrew its column.
+ *
+ * `nameWidth` caps the name column at 24 so that one long name cannot squeeze
+ * every description on screen — but `padEnd` pads, it does not TRUNCATE, so a
+ * longer name renders at its true width while the description was sized against
+ * the cap. The row then overruns the terminal by the difference and the
+ * description is cut by the terminal instead of by `ellipsize`, with no `…` to
+ * show it happened.
+ *
+ * Names are deliberately not truncated: a policy name is the thing you type
+ * next, and half of one is useless. The description gives up the space, because
+ * it is prose and shortening prose costs nothing.
+ */
+function hintBudget(label: string, nameCol: number, budget: number): number {
+  return Math.max(6, budget - Math.max(0, label.length - nameCol));
+}
+
 type DisplayRow = { kind: "header"; text: string } | { kind: "item"; index: number };
 
 /** Flatten choices into section-header + item display rows. */
@@ -651,7 +733,9 @@ export function selectOne<T>(opts: SelectOneOptions<T>): Promise<T | Back | null
       const dot = active ? c.pink(RADIO_ON) : c.dim(RADIO_OFF);
       const rawLabel = choice.label.padEnd(nameCol);
       const label = active ? c.pinkBold(rawLabel) : rawLabel;
-      const hint = choice.hint ? `  ${c.dim(ellipsize(choice.hint, budget))}` : "";
+      const hint = choice.hint
+        ? `  ${c.dim(ellipsize(choice.hint, hintBudget(choice.label, nameCol, budget)))}`
+        : "";
       return `${dot} ${label}${hint}`;
     },
     allowBack: opts.allowBack,
@@ -709,7 +793,9 @@ export function multiSelect<T>(opts: MultiSelectOptions<T>): Promise<T[] | null
           : c.dim(CHECK_OFF);
       const rawLabel = choice.label.padEnd(nameCol);
       const label = active ? c.pinkBold(rawLabel) : checked[index] ? rawLabel : c.dim(rawLabel);
-      const hint = choice.hint ? `  ${c.dim(ellipsize(choice.hint, budget))}` : "";
+      const hint = choice.hint
+        ? `  ${c.dim(ellipsize(choice.hint, hintBudget(choice.label, nameCol, budget)))}`
+        : "";
       return `${caret} ${box} ${label}${hint}`;
     },
     warnLine: () => (warn ? c.warn(`Select at least ${minSelected}.`) : null),

package/.next/standalone/.next/server/chunks/ssr/[root-of-the-server]__0zig5sv._.js

@@ -1,3 +0,0 @@
-module.exports=[18622,(a,b,c)=>{b.exports=a.x("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js",()=>require("next/dist/compiled/next-server/app-page-turbo.runtime.prod.js"))},20635,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/action-async-storage.external.js",()=>require("next/dist/server/app-render/action-async-storage.external.js"))},24725,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/after-task-async-storage.external.js",()=>require("next/dist/server/app-render/after-task-async-storage.external.js"))},43285,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/dynamic-access-async-storage.external.js",()=>require("next/dist/server/app-render/dynamic-access-async-storage.external.js"))},56704,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/work-async-storage.external.js",()=>require("next/dist/server/app-render/work-async-storage.external.js"))},32319,(a,b,c)=>{b.exports=a.x("next/dist/server/app-render/work-unit-async-storage.external.js",()=>require("next/dist/server/app-render/work-unit-async-storage.external.js"))},59043,(a,b,c)=>{b.exports=a.x("next/dist/server/runtime-reacts.external.js",()=>require("next/dist/server/runtime-reacts.external.js"))},77580,a=>{"use strict";var b=a.i(5050);let c=(0,b.createServerReference)("00b801c035726aaa9d297e34f35258369a37177149",b.callServer,void 0,b.findSourceMapURL,"getTelemetryConfig");a.s(["getTelemetryConfig",0,c])},3171,a=>{"use strict";var b=a.i(87924),c=a.i(72131),d=a.i(77580),e=a.i(66036);a.s(["default",0,function({error:a,reset:f}){return(0,c.useEffect)(()=>{(0,d.getTelemetryConfig)().then(b=>{(0,e.setClientTelemetryConfig)(b),(0,e.captureClientEvent)("client_error",{error_message:a.message,error_name:a.name,error_digest:a.digest,boundary:"global"})}).catch(()=>{})},[a]),(0,b.jsx)("html",{children:(0,b.jsx)("body",{children:(0,b.jsx)("main",{style:{minHeight:"100vh",display:"flex",alignItems:"center",justifyContent:"center",background:"#031035",color:"#f8fafc",fontFamily:"system-ui, sans-serif"},children:(0,b.jsxs)("div",{style:{textAlign:"center",padding:"2rem",border:"1px solid rgba(239,68,68,0.4)",borderRadius:"0.5rem",maxWidth:"500px"},children:[(0,b.jsx)("h2",{style:{color:"#ef4444",marginBottom:"0.5rem",fontSize:"1.25rem"},children:"Something went wrong"}),(0,b.jsx)("p",{style:{color:"#94a3b8",marginBottom:"1.5rem"},children:a.message||"An unexpected error occurred."}),(0,b.jsx)("button",{onClick:f,style:{padding:"0.5rem 1.25rem",background:"#3b82f6",color:"white",border:"none",borderRadius:"0.375rem",cursor:"pointer",fontSize:"0.875rem"},children:"Try again"})]})})})})}])},66036,a=>{"use strict";a.s(["captureClientEvent",0,function(a,b){},"setClientTelemetryConfig",0,function(a){}])},46058,(a,b,c)=>{"use strict";function d(a){if("function"!=typeof WeakMap)return null;var b=new WeakMap,c=new WeakMap;return(d=function(a){return a?c:b})(a)}c._=function(a,b){if(!b&&a&&a.__esModule)return a;if(null===a||"object"!=typeof a&&"function"!=typeof a)return{default:a};var c=d(b);if(c&&c.has(a))return c.get(a);var e={__proto__:null},f=Object.defineProperty&&Object.getOwnPropertyDescriptor;for(var g in a)if("default"!==g&&Object.prototype.hasOwnProperty.call(a,g)){var h=f?Object.getOwnPropertyDescriptor(a,g):null;h&&(h.get||h.set)?Object.defineProperty(e,g,h):e[g]=a[g]}return e.default=a,c&&c.set(a,e),e}},5050,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={callServer:function(){return f.callServer},createServerReference:function(){return h.createServerReference},findSourceMapURL:function(){return g.findSourceMapURL}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(20611),g=a.r(1722),h=a.r(38783)},20611,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"callServer",{enumerable:!0,get:function(){return g}});let d=a.r(72131),e=a.r(88347),f=a.r(90841);async function g(a,b){return new Promise((c,g)=>{(0,d.startTransition)(()=>{(0,f.dispatchAppRouterAction)({type:e.ACTION_SERVER_ACTION,actionId:a,actionArgs:b,resolve:c,reject:g})})})}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},1722,(a,b,c)=>{"use strict";let d;Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"findSourceMapURL",{enumerable:!0,get:function(){return d}});("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},88347,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d,e,f={ACTION_HMR_REFRESH:function(){return l},ACTION_NAVIGATE:function(){return i},ACTION_REFRESH:function(){return h},ACTION_RESTORE:function(){return j},ACTION_SERVER_ACTION:function(){return m},ACTION_SERVER_PATCH:function(){return k},PrefetchKind:function(){return n},ScrollBehavior:function(){return o}};for(var g in f)Object.defineProperty(c,g,{enumerable:!0,get:f[g]});let h="refresh",i="navigate",j="restore",k="server-patch",l="hmr-refresh",m="server-action";var n=((d={}).AUTO="auto",d.FULL="full",d),o=((e={})[e.Default=0]="Default",e[e.NoScroll=1]="NoScroll",e);("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},90841,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={dispatchAppRouterAction:function(){return i},dispatchGestureState:function(){return j},refreshOnInstantNavigationUnlock:function(){return h},useActionQueue:function(){return k}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(46058)._(a.r(72131)),g=a.r(67009);a.r(88347);function h(){}function i(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function j(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function k(a){let[b,c]=f.default.useState(a.state),[d,e]=(0,f.useOptimistic)(b),h=(0,f.useMemo)(()=>d,[d]);return(0,g.isThenable)(h)?(0,f.use)(h):h}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},42602,(a,b,c)=>{"use strict";b.exports=a.r(18622)},9270,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.AppRouterContext},36313,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.HooksClientContext},18341,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored.contexts.ServerInsertedHtml},35112,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactDOM},87924,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactJsxRuntime},38783,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].ReactServerDOMTurbopackClient},72131,(a,b,c)=>{"use strict";b.exports=a.r(42602).vendored["react-ssr"].React},67009,(a,b,c)=>{"use strict";function d(a){return null!==a&&"object"==typeof a&&"then"in a&&"function"==typeof a.then}Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"isThenable",{enumerable:!0,get:function(){return d}})}];
-
-//# sourceMappingURL=%5Broot-of-the-server%5D__0zig5sv._.js.map

package/.next/standalone/.next/server/chunks/ssr/_00e9tnf._.js

@@ -1,23 +0,0 @@
-module.exports=[77580,a=>{"use strict";var b=a.i(5050);let c=(0,b.createServerReference)("00b801c035726aaa9d297e34f35258369a37177149",b.callServer,void 0,b.findSourceMapURL,"getTelemetryConfig");a.s(["getTelemetryConfig",0,c])},18952,a=>{"use strict";var b=a.i(87924),c=a.i(72131);let d=[],e=0,f=new Set;function g(){for(let a of f)a()}function h(a){return f.add(a),()=>f.delete(a)}function i(){return d}function j({message:a}){let[d,e]=(0,c.useState)(!1);return(0,c.useEffect)(()=>{requestAnimationFrame(()=>e(!0));let a=setTimeout(()=>e(!1),2e3);return()=>clearTimeout(a)},[]),(0,b.jsx)("div",{className:`bg-card border border-border text-foreground text-sm px-4 py-2 rounded-lg shadow-lg transition-opacity duration-300 ${d?"opacity-100":"opacity-0"}`,children:a})}a.s(["Toaster",0,function(){let a=(0,c.useSyncExternalStore)(h,i,i);return(0,b.jsx)("div",{className:"fixed bottom-4 right-4 z-50 flex flex-col gap-2",children:a.map(a=>(0,b.jsx)(j,{message:a.message},a.id))})},"toast",0,function(a){let b=e++;d=[...d,{id:b,message:a}],g(),setTimeout(()=>{d=d.filter(a=>a.id!==b),g()},2500)}])},10765,a=>{"use strict";var b=a.i(87924),c=a.i(72131),d=a.i(50944),e=a.i(77580),f=a.i(66036);let g=(0,c.createContext)(void 0);a.s(["PostHogProvider",0,function({children:a}){let h=(0,d.usePathname)(),i=(0,c.useRef)(null),j=(0,c.useRef)(!1);(0,c.useEffect)(()=>{let a=!1;return(0,e.getTelemetryConfig)().then(b=>{a||((0,f.setClientTelemetryConfig)(b),j.current=!0,(0,f.captureClientEvent)("$pageview"),i.current=window.location.pathname)}),()=>{a=!0}},[]),(0,c.useEffect)(()=>{j.current&&i.current!==h&&(i.current=h,(0,f.captureClientEvent)("$pageview"))},[h]);let k=c.default.useCallback((a,b)=>{(0,f.captureClientEvent)(a,b)},[]);return(0,b.jsx)(g.Provider,{value:{capture:k},children:a})},"usePostHog",0,function(){let a=(0,c.useContext)(g);if(void 0===a)throw Error("usePostHog must be used within a PostHogProvider");return a}])},66036,a=>{"use strict";a.s(["captureClientEvent",0,function(a,b){},"setClientTelemetryConfig",0,function(a){}])},46058,(a,b,c)=>{"use strict";function d(a){if("function"!=typeof WeakMap)return null;var b=new WeakMap,c=new WeakMap;return(d=function(a){return a?c:b})(a)}c._=function(a,b){if(!b&&a&&a.__esModule)return a;if(null===a||"object"!=typeof a&&"function"!=typeof a)return{default:a};var c=d(b);if(c&&c.has(a))return c.get(a);var e={__proto__:null},f=Object.defineProperty&&Object.getOwnPropertyDescriptor;for(var g in a)if("default"!==g&&Object.prototype.hasOwnProperty.call(a,g)){var h=f?Object.getOwnPropertyDescriptor(a,g):null;h&&(h.get||h.set)?Object.defineProperty(e,g,h):e[g]=a[g]}return e.default=a,c&&c.set(a,e),e}},5050,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={callServer:function(){return f.callServer},createServerReference:function(){return h.createServerReference},findSourceMapURL:function(){return g.findSourceMapURL}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(20611),g=a.r(1722),h=a.r(38783)},20611,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"callServer",{enumerable:!0,get:function(){return g}});let d=a.r(72131),e=a.r(88347),f=a.r(90841);async function g(a,b){return new Promise((c,g)=>{(0,d.startTransition)(()=>{(0,f.dispatchAppRouterAction)({type:e.ACTION_SERVER_ACTION,actionId:a,actionArgs:b,resolve:c,reject:g})})})}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},1722,(a,b,c)=>{"use strict";let d;Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"findSourceMapURL",{enumerable:!0,get:function(){return d}});("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},88347,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d,e,f={ACTION_HMR_REFRESH:function(){return l},ACTION_NAVIGATE:function(){return i},ACTION_REFRESH:function(){return h},ACTION_RESTORE:function(){return j},ACTION_SERVER_ACTION:function(){return m},ACTION_SERVER_PATCH:function(){return k},PrefetchKind:function(){return n},ScrollBehavior:function(){return o}};for(var g in f)Object.defineProperty(c,g,{enumerable:!0,get:f[g]});let h="refresh",i="navigate",j="restore",k="server-patch",l="hmr-refresh",m="server-action";var n=((d={}).AUTO="auto",d.FULL="full",d),o=((e={})[e.Default=0]="Default",e[e.NoScroll=1]="NoScroll",e);("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},90841,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={dispatchAppRouterAction:function(){return i},dispatchGestureState:function(){return j},refreshOnInstantNavigationUnlock:function(){return h},useActionQueue:function(){return k}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f=a.r(46058)._(a.r(72131)),g=a.r(67009);a.r(88347);function h(){}function i(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function j(a){!0;throw Object.defineProperty(Error("Internal Next.js error: Router action dispatched before initialization."),"__NEXT_ERROR_CODE",{value:"E668",enumerable:!1,configurable:!0})}function k(a){let[b,c]=f.default.useState(a.state),[d,e]=(0,f.useOptimistic)(b),h=(0,f.useMemo)(()=>d,[d]);return(0,g.isThenable)(h)?(0,f.use)(h):h}("function"==typeof c.default||"object"==typeof c.default&&null!==c.default)&&void 0===c.default.__esModule&&(Object.defineProperty(c.default,"__esModule",{value:!0}),Object.assign(c.default,c),b.exports=c.default)},14827,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={createLinkPrefetchPartialError:function(){return g},createUnrenderedSegmentError:function(){return f}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});function f(a,b){let c=`Route "${a}": Could not validate that a segment in your UI has instant navigation.`;if(b.length>0){let a=1===b.length?"Dropped segment":"Dropped segments";c+=`
-
-This segment was dropped from rendering. Issues that would prevent instant navigation will go undetected.
-
-${a}:
-${b.map(a=>`  ${a}`).join("\n")}
-
-Ways to fix this:
-  - [render] Render the dropped segment
-  - [ignore] Set \`export const instant = false\` to opt the dropped segment out of instant-navigation validation
-
-Learn more: https://nextjs.org/docs/messages/instant-unrendered-segment`}return Object.defineProperty(Error(c),"__NEXT_ERROR_CODE",{value:"E1286",enumerable:!1,configurable:!0})}function g(a){return Object.defineProperty(Error(`Next.js encountered dynamic data during prefetching for "${a}".
-
-This will lead to slower, more expensive prefetches.
-
-Ways to fix this:
-  - [upgrade] Opt into Partial Prefetching by exporting \`const prefetch = 'partial'\` from the page or layout, or by setting \`partialPrefetching: true\` in next.config to opt the whole app in
-  - [disable] Remove \`prefetch={true}\` from the <Link> to use the default prefetch
-  - [ignore] Set \`export const instant = false\` to opt the route out of instant-navigation validation
-
-Learn more: https://nextjs.org/docs/messages/instant-link-prefetch-partial`),"__NEXT_ERROR_CODE",{value:"E1435",enumerable:!1,configurable:!0})}},88644,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"InvariantError",{enumerable:!0,get:function(){return d}});class d extends Error{constructor(a,b){super(`Invariant: ${a.endsWith(".")?a:a+"."} This is a bug in Next.js.`,b),Object.defineProperty(this,"__NEXT_ERROR_CODE",{value:"E1179",enumerable:!1,configurable:!0}),this.name="InvariantError"}}},67009,(a,b,c)=>{"use strict";function d(a){return null!==a&&"object"==typeof a&&"then"in a&&"function"==typeof a.then}Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"isThenable",{enumerable:!0,get:function(){return d}})},41997,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={BailoutToCSRError:function(){return g},isBailoutToCSRError:function(){return h}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});let f="BAILOUT_TO_CLIENT_SIDE_RENDERING";class g extends Error{constructor(a){super(`Bail out to client-side rendering: ${a}`),this.reason=a,this.digest=f}}function h(a){return"object"==typeof a&&null!==a&&"digest"in a&&a.digest===f}},54427,(a,b,c)=>{"use strict";function d(){let a,b,c=new Promise((c,d)=>{a=c,b=d});return{resolve:a,reject:b,promise:c}}Object.defineProperty(c,"__esModule",{value:!0}),Object.defineProperty(c,"createPromiseWithResolvers",{enumerable:!0,get:function(){return d}})},39118,(a,b,c)=>{"use strict";Object.defineProperty(c,"__esModule",{value:!0});var d={DEFAULT_SEGMENT_KEY:function(){return l},NOT_FOUND_SEGMENT_KEY:function(){return m},PAGE_SEGMENT_KEY:function(){return k},addSearchParamsIfPageSegment:function(){return i},computeSelectedLayoutSegment:function(){return j},getSegmentValue:function(){return f},getSelectedLayoutSegmentPath:function(){return function a(b,c,d=!0,e=[]){let g;if(d)g=b[1][c];else{let a=b[1];g=a.children??Object.values(a)[0]}if(!g)return e;let h=f(g[0]);return!h||h.startsWith(k)?e:(e.push(h),a(g,c,!1,e))}},isGroupSegment:function(){return g},isParallelRouteSegment:function(){return h}};for(var e in d)Object.defineProperty(c,e,{enumerable:!0,get:d[e]});function f(a){return Array.isArray(a)?a[1]:a}function g(a){return"("===a[0]&&a.endsWith(")")}function h(a){return a.startsWith("@")&&"@children"!==a}function i(a,b){if(a.includes(k)){let a=JSON.stringify(b);return"{}"!==a?k+"?"+a:k}return a}function j(a,b){if(!a||0===a.length)return null;let c="children"===b?a[0]:a[a.length-1];return c===l?null:c}let k="__PAGE__",l="__DEFAULT__",m="/_not-found"}];
-
-//# sourceMappingURL=_00e9tnf._.js.map