harness-dispatch 0.9.0 → 0.10.0

package/dist/observability/spans.js.map

@@ -1 +1 @@
-{"version":3,"file":"spans.js","sourceRoot":"","sources":["../../src/observability/spans.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,cAAc,EAAE,KAAK,EAA8B,MAAM,oBAAoB,CAAC;AAEvF,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,6EAA6E;AAC7E,qDAAqD;AACrD,MAAM,cAAc,GAAG,OAAO,CAAC;AAM/B,SAAS,MAAM;IACb,OAAO,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,IAAU,EAAE,KAAgB;IAC/C,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,KAAgB,EAChB,EAA8B;IAE9B,OAAO,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAU,EAAE,EAAE;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,IAAI,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACxB,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;YACnE,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAyB,EACzB,KAA0B,EAC1B,EAA8B;IAE9B,OAAO,QAAQ,CAAC,+BAA+B,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAsB,EACtB,EAA8B;IAE9B,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAC3C,OAAO,QAAQ,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAuB,EACvB,EAA8B;IAE9B,OAAO,QAAQ,CAAC,2BAA2B,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC"}
+{"version":3,"file":"spans.js","sourceRoot":"","sources":["../../src/observability/spans.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAAE,cAAc,EAAE,KAAK,EAA8B,MAAM,oBAAoB,CAAC;AACvF,OAAO,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAEzC,OAAO,EAAE,OAAO,EAAE,MAAM,eAAe,CAAC;AAExC,MAAM,WAAW,GAAG,kBAAkB,CAAC;AACvC,6EAA6E;AAC7E,qDAAqD;AACrD,MAAM,cAAc,GAAG,OAAO,CAAC;AAM/B,SAAS,MAAM;IACb,OAAO,KAAK,CAAC,SAAS,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,WAAW,CAAC,IAAU,EAAE,KAAgB;IAC/C,MAAM,GAAG,GAAe,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACjD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,GAAG,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACnB,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;QAAE,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC;AAC3D,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,QAAQ,CACrB,IAAY,EACZ,KAAgB,EAChB,EAA8B;IAE9B,OAAO,MAAM,EAAE,CAAC,eAAe,CAAC,IAAI,EAAE,KAAK,EAAE,IAAU,EAAE,EAAE;QACzD,MAAM,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACtB,IAAI,CAAC;YACH,WAAW,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;YACzB,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;YAC3B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC7C,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,CAAC;YAC5C,OAAO,GAAG,CAAC;QACb,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC;YACnC,IAAI,CAAC,YAAY,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;YAC7C,MAAM,CAAC,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC;YAC9D,wEAAwE;YACxE,uEAAuE;YACvE,wEAAwE;YACxE,sEAAsE;YACtE,wCAAwC;YACxC,MAAM,IAAI,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC;YAC1C,IAAI,CAAC,IAAI,GAAG,CAAC,CAAC,IAAI,CAAC;YACnB,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC;YAC3B,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,cAAc,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;gBAAS,CAAC;YACT,IAAI,CAAC,GAAG,EAAE,CAAC;QACb,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAiBD,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAyB,EACzB,KAA0B,EAC1B,EAA8B;IAE9B,OAAO,QAAQ,CAAC,+BAA+B,EAAE,EAAE,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAClE,CAAC;AAcD,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,KAAsB,EACtB,EAA8B;IAE9B,MAAM,EAAE,WAAW,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,KAAK,CAAC;IAC3C,OAAO,QAAQ,CAAC,2BAA2B,EAAE,EAAE,EAAE,EAAE,GAAG,IAAI,EAAE,WAAW,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,CAAC;AACrF,CAAC;AAYD,MAAM,CAAC,KAAK,UAAU,eAAe,CACnC,KAAuB,EACvB,EAA8B;IAE9B,OAAO,QAAQ,CAAC,2BAA2B,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC;AAC1D,CAAC"}

package/dist/redaction.d.ts

@@ -0,0 +1,90 @@
+/**
+ * One place that knows every secret this process holds, and one function that
+ * removes them from anything on its way out.
+ *
+ * WHY THIS EXISTS, because the alternative was tried six times and failed six
+ * times. The same defect — a configured credential reaching a caller, a log
+ * file or an agent's context — was found and "fixed" in six consecutive
+ * rounds. Every fix was correct. Every fix was also incomplete, because each
+ * one scrubbed at a SITE: a specific error path in a specific file. Four of
+ * the six were found as "the fix landed in one branch and the sibling beside
+ * it kept leaking", twice inside a single file. One round shipped a comment
+ * asserting that every branch was covered while a branch was not.
+ *
+ * Sites are the wrong unit. There is no bounded list of places a string can be
+ * built, and a new one is added by ordinary feature work with no reason for
+ * its author to think about credentials. What IS bounded is the set of ways a
+ * string leaves this process: it is serialized to JSON for a tool result or an
+ * HTTP response, appended to the dispatch log, written into a job file, or
+ * printed to the terminal. Those are sinks, there are few of them, and they
+ * change rarely.
+ *
+ * So: scrub at the sinks, and derive the secrets from the loaded config rather
+ * than naming them per call site. A leak then requires someone to add a whole
+ * new egress mechanism, not merely to write a new error message.
+ *
+ * This is deliberately more machinery than the individual fixes it replaces.
+ * It has earned that: it is not guarding against a hypothetical, it is
+ * guarding against six measured, reproduced disclosures, one of which put a
+ * key into a file on disk and another into an orchestrating agent's context.
+ */
+import type { RouterConfig } from "./types.js";
+/** What a removed secret is replaced with. Matches `scrubEndpointSecrets`. */
+export declare const REDACTED = "<redacted>";
+/**
+ * Every secret value reachable from a loaded config.
+ *
+ * Collected from fields that HOLD credentials, and deliberately not from
+ * `envRefs`. Keying off `envRefs` was the obvious shortcut — it records every
+ * `${VAR}` in the file by resolved value — and it was wrong in a way that
+ * mattered: `${VAR}` is documented as legal in any string value, so a config
+ * writing `model: ${MY_MODEL}` or `command: ${CODEX_BIN}` turned a model name
+ * and a file path into process-wide redaction targets. An acceptance pass
+ * measured `model=<redacted>` in `status` output, and a harness answer
+ * mentioning that model would have been mangled the same way, silently.
+ *
+ * That failure is worse than the leak this guards against: a corrupted answer
+ * is wrong work product delivered as if it were right. A `${VAR}` in a
+ * credential field still resolves into `apiKey` before this runs, so nothing
+ * real is lost by dropping the shortcut.
+ */
+export declare function collectSecrets(config: RouterConfig | undefined): string[];
+/** Remove every one of `secrets` from `text`, by value. */
+export declare function scrubSecrets(text: string, secrets: readonly string[]): string;
+/** Record a secret found while parsing, for redaction to pick up. */
+export declare function registerSecretValue(value: string | undefined): void;
+/** Install the secrets for a loaded config. Safe to call on every reload. */
+export declare function setActiveSecrets(config: RouterConfig | undefined): void;
+/** For tests that need to restore a clean slate. */
+export declare function clearActiveSecrets(): void;
+/** How many secrets are currently registered. For diagnostics and tests. */
+export declare function activeSecretCount(): number;
+/**
+ * Remove every registered secret from text that is about to leave the process.
+ *
+ * Call this at SINKS — serialization, disk writes, terminal output — not at
+ * the places strings are built. That distinction is the whole design.
+ */
+export declare function redact(text: string): string;
+/**
+ * Redact everything written to stdout and stderr, for the life of the process.
+ *
+ * The terminal is a sink like any other, and it was the one left unwired when
+ * the JSON and disk sinks were done — measured immediately afterwards, with a
+ * path-embedded credential surviving into `status --json`, `usage` and
+ * `configure --print` while the same value was correctly removed from the MCP
+ * and HTTP payloads. That is the per-site failure this whole design exists to
+ * end, reproduced one more time by doing four sinks out of five.
+ *
+ * Installed once at the entrypoint rather than applied at each print, because
+ * `bin.ts` alone writes to stdout from dozens of places and every future
+ * command adds more. `redact` reads the registry at call time, so installing
+ * before config load is correct: writes made before any secret is known are
+ * unchanged, and everything after is covered with no ordering requirement.
+ *
+ * Non-string chunks pass through untouched — a Buffer write is not text this
+ * process composed, and decoding one to scan it would risk corrupting binary
+ * output for no benefit.
+ */
+export declare function installOutputRedaction(): void;
+//# sourceMappingURL=redaction.d.ts.map

package/dist/redaction.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.d.ts","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,YAAY,CAAC;AAE/C,8EAA8E;AAC9E,eAAO,MAAM,QAAQ,eAAe,CAAC;AA4BrC;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,MAAM,EAAE,CAiCzE;AAED,2DAA2D;AAC3D,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,MAAM,EAAE,GAAG,MAAM,CAc7E;AA+BD,qEAAqE;AACrE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAInE;AAED,6EAA6E;AAC7E,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,SAAS,GAAG,IAAI,CAGvE;AAED,oDAAoD;AACpD,wBAAgB,kBAAkB,IAAI,IAAI,CAGzC;AAED,4EAA4E;AAC5E,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;GAKG;AACH,wBAAgB,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAG3C;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAY7C"}

package/dist/redaction.js

@@ -0,0 +1,221 @@
+/**
+ * One place that knows every secret this process holds, and one function that
+ * removes them from anything on its way out.
+ *
+ * WHY THIS EXISTS, because the alternative was tried six times and failed six
+ * times. The same defect — a configured credential reaching a caller, a log
+ * file or an agent's context — was found and "fixed" in six consecutive
+ * rounds. Every fix was correct. Every fix was also incomplete, because each
+ * one scrubbed at a SITE: a specific error path in a specific file. Four of
+ * the six were found as "the fix landed in one branch and the sibling beside
+ * it kept leaking", twice inside a single file. One round shipped a comment
+ * asserting that every branch was covered while a branch was not.
+ *
+ * Sites are the wrong unit. There is no bounded list of places a string can be
+ * built, and a new one is added by ordinary feature work with no reason for
+ * its author to think about credentials. What IS bounded is the set of ways a
+ * string leaves this process: it is serialized to JSON for a tool result or an
+ * HTTP response, appended to the dispatch log, written into a job file, or
+ * printed to the terminal. Those are sinks, there are few of them, and they
+ * change rarely.
+ *
+ * So: scrub at the sinks, and derive the secrets from the loaded config rather
+ * than naming them per call site. A leak then requires someone to add a whole
+ * new egress mechanism, not merely to write a new error message.
+ *
+ * This is deliberately more machinery than the individual fixes it replaces.
+ * It has earned that: it is not guarding against a hypothetical, it is
+ * guarding against six measured, reproduced disclosures, one of which put a
+ * key into a file on disk and another into an orchestrating agent's context.
+ */
+/** What a removed secret is replaced with. Matches `scrubEndpointSecrets`. */
+export const REDACTED = "<redacted>";
+/**
+ * Below this length a "secret" is more likely to be a coincidence than a
+ * credential, and redacting it would corrupt ordinary output.
+ *
+ * A real key is far longer. The risk being traded here is asymmetric and worth
+ * stating: too low a bound mangles legitimate text (a route named `a` would
+ * turn every `a` in an answer into a placeholder), while too high a bound
+ * misses a short key. Eight is below every provider key format in this
+ * project's own config and far above the length at which a value collides with
+ * prose by accident.
+ */
+const MIN_SECRET_LENGTH = 8;
+/**
+ * Query keys whose VALUE is a credential.
+ *
+ * A name test, not a length test. The length heuristic this replaces treated
+ * any URL path segment of 16+ characters as a secret, which made an Azure
+ * deployment name (`.../deployments/gpt-4-turbo-preview`) a redaction target —
+ * measured by an acceptance pass. A credential in the path is a real shape,
+ * but it cannot be told from a deployment name by inspection, and guessing
+ * wrong corrupts output. `warnCredentialInUrlPath` in config.ts says so out
+ * loud instead, which is actionable where a silent guess is not.
+ */
+const CREDENTIAL_QUERY_KEY = /^(api[_-]?key|key|token|access[_-]?token|auth|password|secret|sig|signature)$/i;
+/**
+ * Every secret value reachable from a loaded config.
+ *
+ * Collected from fields that HOLD credentials, and deliberately not from
+ * `envRefs`. Keying off `envRefs` was the obvious shortcut — it records every
+ * `${VAR}` in the file by resolved value — and it was wrong in a way that
+ * mattered: `${VAR}` is documented as legal in any string value, so a config
+ * writing `model: ${MY_MODEL}` or `command: ${CODEX_BIN}` turned a model name
+ * and a file path into process-wide redaction targets. An acceptance pass
+ * measured `model=<redacted>` in `status` output, and a harness answer
+ * mentioning that model would have been mangled the same way, silently.
+ *
+ * That failure is worse than the leak this guards against: a corrupted answer
+ * is wrong work product delivered as if it were right. A `${VAR}` in a
+ * credential field still resolves into `apiKey` before this runs, so nothing
+ * real is lost by dropping the shortcut.
+ */
+export function collectSecrets(config) {
+    const out = new Set();
+    if (!config)
+        return [];
+    const add = (value) => {
+        if (value === undefined)
+            return;
+        const trimmed = value.trim();
+        if (trimmed.length >= MIN_SECRET_LENGTH)
+            out.add(trimmed);
+    };
+    for (const svc of Object.values(config.services ?? {})) {
+        add(svc.apiKey);
+        if (svc.baseUrl === undefined)
+            continue;
+        try {
+            const url = new URL(svc.baseUrl);
+            add(url.password);
+            add(url.username);
+            // Only query values under a credential-looking KEY. Taking every value
+            // meant `?model=gemini-2.5-flash` made that model name a redaction
+            // target — measured. A query string carries ordinary parameters too.
+            for (const [key, value] of url.searchParams.entries()) {
+                if (CREDENTIAL_QUERY_KEY.test(key))
+                    add(value);
+            }
+        }
+        catch {
+            // An unparseable base_url has no parts to take apart. A credential
+            // written into one is still caught if it also appears as an api_key,
+            // which is how it is normally configured.
+        }
+    }
+    // Longest first, so a secret that contains another is removed whole rather
+    // than being left as a recognisable fragment around a placeholder.
+    return [...out].sort((a, b) => b.length - a.length);
+}
+/** Remove every one of `secrets` from `text`, by value. */
+export function scrubSecrets(text, secrets) {
+    let out = text;
+    for (const secret of secrets) {
+        if (out.includes(secret))
+            out = out.split(secret).join(REDACTED);
+        // Redaction runs AFTER JSON.stringify at most sinks, so a secret holding a
+        // character JSON escapes — a quote, or the backslashes in a Windows path —
+        // is no longer present in its raw form and survived. Measured with a key
+        // containing a double quote.
+        const escaped = JSON.stringify(secret).slice(1, -1);
+        if (escaped !== secret && out.includes(escaped)) {
+            out = out.split(escaped).join(REDACTED);
+        }
+    }
+    return out;
+}
+/**
+ * The secrets of the config this process is currently running.
+ *
+ * Process-wide mutable state, which is normally a smell and is the right shape
+ * here: whether a given string is a credential is a property of the process,
+ * not of the call. Threading config into the dispatch log, the JSON
+ * serializers and the job-file writers is exactly the per-site plumbing whose
+ * absence caused six rounds of this bug — every one of those sinks would have
+ * needed a caller to remember to pass it.
+ */
+let activeSecrets = [];
+/**
+ * Secrets seen while PARSING a config, which never become a route field.
+ *
+ * The top-level `api_keys:` block is the case that forced this. Its entries
+ * are applied to routes by name, so an entry whose route also declares an
+ * inline `api_key:` — or that names no route at all — is a live credential
+ * sitting in the config file that `collectSecrets` cannot see from the
+ * finished RouterConfig. A pass measured every entry after the first in that
+ * block leaking, and this is the machine setup this project documents.
+ *
+ * Accumulated rather than replaced on reload, deliberately: continuing to
+ * scrub a credential that has been removed from the config costs one
+ * unnecessary replacement in output that would not have contained it anyway,
+ * whereas forgetting one costs a disclosure.
+ */
+const parsedSecrets = new Set();
+/** Record a secret found while parsing, for redaction to pick up. */
+export function registerSecretValue(value) {
+    if (value === undefined)
+        return;
+    const trimmed = value.trim();
+    if (trimmed.length >= MIN_SECRET_LENGTH)
+        parsedSecrets.add(trimmed);
+}
+/** Install the secrets for a loaded config. Safe to call on every reload. */
+export function setActiveSecrets(config) {
+    const merged = new Set([...collectSecrets(config), ...parsedSecrets]);
+    activeSecrets = [...merged].sort((a, b) => b.length - a.length);
+}
+/** For tests that need to restore a clean slate. */
+export function clearActiveSecrets() {
+    activeSecrets = [];
+    parsedSecrets.clear();
+}
+/** How many secrets are currently registered. For diagnostics and tests. */
+export function activeSecretCount() {
+    return activeSecrets.length;
+}
+/**
+ * Remove every registered secret from text that is about to leave the process.
+ *
+ * Call this at SINKS — serialization, disk writes, terminal output — not at
+ * the places strings are built. That distinction is the whole design.
+ */
+export function redact(text) {
+    if (activeSecrets.length === 0)
+        return text;
+    return scrubSecrets(text, activeSecrets);
+}
+/**
+ * Redact everything written to stdout and stderr, for the life of the process.
+ *
+ * The terminal is a sink like any other, and it was the one left unwired when
+ * the JSON and disk sinks were done — measured immediately afterwards, with a
+ * path-embedded credential surviving into `status --json`, `usage` and
+ * `configure --print` while the same value was correctly removed from the MCP
+ * and HTTP payloads. That is the per-site failure this whole design exists to
+ * end, reproduced one more time by doing four sinks out of five.
+ *
+ * Installed once at the entrypoint rather than applied at each print, because
+ * `bin.ts` alone writes to stdout from dozens of places and every future
+ * command adds more. `redact` reads the registry at call time, so installing
+ * before config load is correct: writes made before any secret is known are
+ * unchanged, and everything after is covered with no ordering requirement.
+ *
+ * Non-string chunks pass through untouched — a Buffer write is not text this
+ * process composed, and decoding one to scan it would risk corrupting binary
+ * output for no benefit.
+ */
+export function installOutputRedaction() {
+    for (const stream of [process.stdout, process.stderr]) {
+        const original = stream.write.bind(stream);
+        // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        stream.write = ((chunk, ...rest) => {
+            if (typeof chunk === "string" && activeSecrets.length > 0) {
+                return original(redact(chunk), ...rest);
+            }
+            return original(chunk, ...rest);
+            // eslint-disable-next-line @typescript-eslint/no-explicit-any
+        });
+    }
+}
+//# sourceMappingURL=redaction.js.map

package/dist/redaction.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redaction.js","sourceRoot":"","sources":["../src/redaction.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,8EAA8E;AAC9E,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAY,CAAC;AAErC;;;;;;;;;;GAUG;AACH,MAAM,iBAAiB,GAAG,CAAC,CAAC;AAE5B;;;;;;;;;;GAUG;AACH,MAAM,oBAAoB,GAAG,gFAAgF,CAAC;AAE9G;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,cAAc,CAAC,MAAgC;IAC7D,MAAM,GAAG,GAAG,IAAI,GAAG,EAAU,CAAC;IAC9B,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,MAAM,GAAG,GAAG,CAAC,KAAyB,EAAQ,EAAE;QAC9C,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,iBAAiB;YAAE,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC5D,CAAC,CAAC;IAEF,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;QACvD,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAChB,IAAI,GAAG,CAAC,OAAO,KAAK,SAAS;YAAE,SAAS;QACxC,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;YACjC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClB,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;YAClB,uEAAuE;YACvE,mEAAmE;YACnE,qEAAqE;YACrE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,EAAE,EAAE,CAAC;gBACtD,IAAI,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC;oBAAE,GAAG,CAAC,KAAK,CAAC,CAAC;YACjD,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,mEAAmE;YACnE,qEAAqE;YACrE,0CAA0C;QAC5C,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,mEAAmE;IACnE,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AACtD,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAA0B;IACnE,IAAI,GAAG,GAAG,IAAI,CAAC;IACf,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE,CAAC;QAC7B,IAAI,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QACjE,2EAA2E;QAC3E,2EAA2E;QAC3E,yEAAyE;QACzE,6BAA6B;QAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QACpD,IAAI,OAAO,KAAK,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;IACH,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;;;;;GASG;AACH,IAAI,aAAa,GAAsB,EAAE,CAAC;AAE1C;;;;;;;;;;;;;;GAcG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,EAAU,CAAC;AAExC,qEAAqE;AACrE,MAAM,UAAU,mBAAmB,CAAC,KAAyB;IAC3D,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO;IAChC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,IAAI,iBAAiB;QAAE,aAAa,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACtE,CAAC;AAED,6EAA6E;AAC7E,MAAM,UAAU,gBAAgB,CAAC,MAAgC;IAC/D,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,GAAG,aAAa,CAAC,CAAC,CAAC;IACtE,aAAa,GAAG,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;AAClE,CAAC;AAED,oDAAoD;AACpD,MAAM,UAAU,kBAAkB;IAChC,aAAa,GAAG,EAAE,CAAC;IACnB,aAAa,CAAC,KAAK,EAAE,CAAC;AACxB,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,iBAAiB;IAC/B,OAAO,aAAa,CAAC,MAAM,CAAC;AAC9B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,MAAM,CAAC,IAAY;IACjC,IAAI,aAAa,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC5C,OAAO,YAAY,CAAC,IAAI,EAAE,aAAa,CAAC,CAAC;AAC3C,CAAC;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,UAAU,sBAAsB;IACpC,KAAK,MAAM,MAAM,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACtD,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,8DAA8D;QAC9D,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAU,EAAE,GAAG,IAAW,EAAW,EAAE;YACtD,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC1D,OAAO,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,GAAI,IAAW,CAAC,CAAC;YAClD,CAAC;YACD,OAAO,QAAQ,CAAC,KAAK,EAAE,GAAI,IAAW,CAAC,CAAC;YACxC,8DAA8D;QAChE,CAAC,CAAQ,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/router.d.ts

@@ -55,8 +55,18 @@
  * Explicit `tier` in config is the fallback when ELO is unavailable.
  *
  * R3: adds `stream()` / `streamTo()` that emit `DispatcherEvent`s with an
- * attached `RoutingDecision`. The buffered `route` / `routeTo` methods are
- * reimplemented on top of the streaming primitives.
+ * attached `RoutingDecision`.
+ *
+ * There is ONE selection-and-fallback loop per shape — `#runStream` for the
+ * routed path, `#runStreamTo` for an explicit route — and the buffered
+ * `route()` / `routeTo()` drain them. This paragraph used to claim exactly
+ * that while it was false: the buffered methods were separate 120-line
+ * implementations, and the copies drifted. The timeout rule ended up written
+ * four times, and an audit mutation showed a test pinned only the `route()`
+ * copy, leaving the pair that jobs and the HTTP server actually use unguarded.
+ *
+ * What still differs between buffered and streaming is the dispatcher call
+ * itself, and only that: see `DispatcherInvoke`.
  */
 import type { DispatchResult, DispatcherEvent, RouterConfig, RoutingDecision, RouteHints, RouteSkip, SafetyProfile, ServiceConfig, TaskType } from "./types.js";
 import { CircuitBreaker } from "./circuit-breaker.js";
@@ -120,27 +130,6 @@ export interface ExplicitDispatchOpts {
      */
     defaultTimeoutMs?: number;
 }
-/**
- * Every hint that means something to an explicitly-chosen route, in one place.
- *
- * The HTTP fanout path built these options by naming three fields inline and
- * missed two: `routePolicy` never reached `routeTo`, so
- * `{"mode":"fanout","hints":{"routePolicy":"blocked"}}` — documented as
- * "dry-run: block everything" — returned 200 having run a live agent in the
- * caller's working tree, and `local_only` let a metered route run. `timeoutMs`
- * was dropped the same way, so the bound the release notes describe never
- * reached the child in fanout mode. Single mode enforced both correctly, so
- * one surface disagreed with itself.
- *
- * Picking fields by name is what allowed that: nothing fails when a new hint
- * is added and a call site is not updated. Adding one here reaches every
- * caller, and `ExplicitDispatchOpts` is the compiler's list of what belongs.
- *
- * `model` is deliberately absent — fanout selects routes with `models`, and
- * each arm runs its own. `preferLargeContext` and `service` only steer which
- * route is PICKED, which an explicit route has already decided.
- */
-export declare function explicitOptsFromHints(hints: RouteHints): ExplicitDispatchOpts;
 /**
  * Does this route actually DECLARE this model? The route's own name does not
  * count.

package/dist/router.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2DG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,YAAY,EACZ,eAAe,EACf,UAAU,EACV,SAAS,EACT,aAAa,EACb,aAAa,EACb,QAAQ,EACT,MAAM,YAAY,CAAC;AAEpB,OAAO,EAAE,cAAc,EAA+B,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAsB9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,OAAO;IAClB,kEAAkE;;IAElE,uEAAuE;;IAEvE,uEAAuE;;;;IAIvE,6DAA6D;;CAErD,CAAC;AAYX;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,eAAe,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACnD,WAAW,CAAC,EAAE,OAAO,YAAY,EAAE,WAAW,CAAC;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;;;;;;;;;;;;;;GAmBG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,UAAU,GAAG,oBAAoB,CAQ7E;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAOpF;AAyLD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;CAClC;AAYD,qBAAa,MAAM;;IAMf,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAR9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IACnE,OAAO,CAAC,iBAAiB,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAGzB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,WAAW,EAAE,gBAAgB,EAC9C,YAAY,CAAC,EAAE,YAAY;IAe7B,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIvD,aAAa,IAAI,SAAS,EAAE;IAI5B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IAuBtB,WAAW,CAAC,IAAI,GAAE;QACtB,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAClB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA+SxC;;;;;;;;OAQG;IACH,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACxG,aAAa,CAAC,iBAAiB,CAAC;IAkHnC;;;OAGG;IACH,QAAQ,CACN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,oBAAyB,GAC9B,aAAa,CAAC,iBAAiB,CAAC;IAwInC;;;;;;;;;;;OAWG;IACG,KAAK,CACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAC7E,OAAO,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;KAAE,CAAC;IAyIxE;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;KAAE,CAAC;IA2GxE,OAAO,CAAC,YAAY;IAsDpB;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAO5E;;;;;OAKG;IACH,sBAAsB,IAAI,MAAM,EAAE;IAIlC;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,wBAAwB;CAYjC;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC"}
+{"version":3,"file":"router.d.ts","sourceRoot":"","sources":["../src/router.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqEG;AAEH,OAAO,KAAK,EACV,cAAc,EACd,eAAe,EACf,YAAY,EACZ,eAAe,EACf,UAAU,EACV,SAAS,EACT,aAAa,EACb,aAAa,EACb,QAAQ,EACT,MAAM,YAAY,CAAC;AACpB,OAAO,EAAE,cAAc,EAA+B,MAAM,sBAAsB,CAAC;AACnF,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACxC,OAAO,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACpD,OAAO,KAAK,EAAgB,UAAU,EAAE,MAAM,uBAAuB,CAAC;AACtE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAsB9D;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,OAAO;IAClB,kEAAkE;;IAElE,uEAAuE;;IAEvE,uEAAuE;;;;IAIvE,6DAA6D;;CAErD,CAAC;AAYX;;;;;;;;GAQG;AACH,MAAM,WAAW,oBAAoB;IACnC,+EAA+E;IAC/E,MAAM,CAAC,EAAE,WAAW,CAAC;IACrB,aAAa,CAAC,EAAE,aAAa,CAAC;IAC9B,eAAe,CAAC,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACnD,WAAW,CAAC,EAAE,OAAO,YAAY,EAAE,WAAW,CAAC;IAC/C,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;;;OAOG;IACH,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAwBD;;;;;;;;;;;;GAYG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,aAAa,EAAE,KAAK,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAOpF;AA4MD;;;;;;GAMG;AACH,MAAM,WAAW,iBAAiB;IAChC,KAAK,EAAE,eAAe,CAAC;IACvB,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAC;CAClC;AAYD,qBAAa,MAAM;;IAMf,OAAO,CAAC,QAAQ,CAAC,MAAM;IACvB,OAAO,CAAC,QAAQ,CAAC,KAAK;IACtB,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAR9B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;IACnE,OAAO,CAAC,iBAAiB,CAAmB;IAC5C,OAAO,CAAC,QAAQ,CAAC,YAAY,CAAe;gBAGzB,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,UAAU,EACjB,WAAW,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,EACvC,WAAW,EAAE,gBAAgB,EAC9C,YAAY,CAAC,EAAE,YAAY;IAe7B,UAAU,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAIvD,aAAa,IAAI,SAAS,EAAE;IAI5B;;;;;;;;;;;;;;OAcG;IACH,OAAO,CAAC,oBAAoB;IAuBtB,WAAW,CAAC,IAAI,GAAE;QACtB,KAAK,CAAC,EAAE,UAAU,CAAC;QACnB,MAAM,CAAC,EAAE,MAAM,CAAC;QAChB,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;KAClB,GAAG,OAAO,CAAC,eAAe,GAAG,IAAI,CAAC;IA+SxC;;;;;;;;OAQG;IACH,MAAM,CACJ,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,gBAAgB,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GACxG,aAAa,CAAC,iBAAiB,CAAC;IAyHnC;;;OAGG;IACH,QAAQ,CACN,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,oBAAyB,GAC9B,aAAa,CAAC,iBAAiB,CAAC;IAyInC;;;;;;;;;;;OAWG;IACG,KAAK,CACT,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE;QAAE,KAAK,CAAC,EAAE,UAAU,CAAC;QAAC,YAAY,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,WAAW,CAAA;KAAO,GAC7E,OAAO,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;KAAE,CAAC;IA0DxE;;OAEG;IACG,OAAO,CACX,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,KAAK,EAAE,MAAM,EAAE,EACf,UAAU,EAAE,MAAM,EAClB,IAAI,GAAE,oBAAyB,GAC9B,OAAO,CAAC;QAAE,MAAM,EAAE,cAAc,CAAC;QAAC,QAAQ,EAAE,eAAe,GAAG,IAAI,CAAA;KAAE,CAAC;IA0BxE,OAAO,CAAC,YAAY;IAsDpB;;;;;;;;;;;;;;;OAeG;IACH,oBAAoB,IAAI,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,cAAc,CAAC,QAAQ,CAAC,CAAC,CAAC;IAO5E;;;;;OAKG;IACH,sBAAsB,IAAI,MAAM,EAAE;IAIlC;;;;;;OAMG;IACH,OAAO,CAAC,iBAAiB;IAYzB,OAAO,CAAC,wBAAwB;CAYjC;AAED,OAAO,EAAE,qBAAqB,EAAE,CAAC"}