plumbbob 0.9.3 → 0.10.0

package/node_modules/checkride/dist/gate.js

@@ -0,0 +1,617 @@
+/**
+ * `checkride gate` — the stop-gate verdict, harness-neutral.
+ *
+ * Every agent harness offers some "the turn is ending" hook, and checkride's
+ * gate hangs off it: run the repo's `check` script, and while it is red, refuse
+ * to let the turn finish. What differs between harnesses is only the *wire
+ * format* of that refusal — Claude Code reads stderr and blocks on exit 2,
+ * Cursor reads a `followup_message` on stdout and submits it as the next turn.
+ * The decision itself (is it dirty, is it green, which artifact should the agent
+ * read) is identical, so it lives here once and the generated hook scripts
+ * become two-line adapters that name their harness.
+ *
+ * That split is the point. Before this command, the whole body was duplicated
+ * shell inside `.claude/hooks/checkride-gate.sh`, untestable outside an e2e run
+ * and impossible to share with a second harness.
+ *
+ * The gate answers three verdicts, not two. Green and red are the pipeline's;
+ * the third is **could not run**, for a package manager that refused to start
+ * the check script at all — an `engines.node` pin the hook's Node does not
+ * satisfy is the common cause, and it exits non-zero exactly like a failing
+ * test. Reading that as red produced a permanent red no code change could clear,
+ * pointing at a `.check/summary.json` no run had written. So it names the cause
+ * instead of naming an artifact. See `./pm/launch.ts` for the classification and
+ * `./node-pin.ts` for the alignment that avoids it.
+ *
+ * Whether that third verdict *blocks* turns on one question: can the turn clear
+ * it? A missing `check` script can be fixed by the agent holding the edit tools,
+ * so the gate blocks and the agent fixes it. A Node the harness never put on
+ * `PATH` cannot, so the gate says so and stands down (see
+ * {@link reportStandDown}). Blocking on the second only re-asks an agent that
+ * has no lever to pull, which is not gating — it is a loop, and the way out of
+ * a loop is turning the gate off.
+ *
+ * Not to be confused with `../triage/gate.ts`, which also runs the `check`
+ * script: that one runs it *verbatim* as a reader's preflight and classifies the
+ * result for a report. This one appends `--strict --digest` because it IS the
+ * gate, and its output is a verdict for the harness, not prose for a human.
+ */
+import { spawn } from 'node:child_process';
+import { existsSync, readFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { formatDuration, readSummary } from './artifacts/index.js';
+import { loadConfig } from './config.js';
+import { DIGEST_FILE } from './digest/index.js';
+import { alignNode, NODE_BIN_VAR, realPinEnv, withNodeBin } from './node-pin.js';
+import { detectPackageManager, launchRefusal, runScript, SPAWN_FAILED_MARKER, } from './pm/index.js';
+/**
+ * The edit marker: touched by the harness's "a file changed" hook, checked here
+ * under `--if-dirty`, and cleared by a green gate. Dot-named so it can never
+ * collide with a slot's `<slot>.json`/`<slot>.stdout.txt` artifacts, which the
+ * orchestrator deletes per slot before a re-run — the marker must survive every
+ * run.
+ *
+ * It lives here, not in `agent-setup`, because the gate is what reads and clears
+ * it; the hook writers import it from this module to build the touch command.
+ */
+export const DIRTY_MARKER = '.check/.dirty';
+/**
+ * Whether a follow-up has already been auto-submitted this conversation: `1` if
+ * so, `0` if not. The generated stop-hook script reads the harness's stop payload
+ * and exports it; the hook writers import the name from here to spell the export.
+ *
+ * It exists for exactly one decision. Under Cursor the only channel that reaches
+ * a *user* is `followup_message`, and that field **submits a new turn** — so a
+ * stand-down spending it on every turn is the unbounded loop a stand-down exists
+ * to avoid. `0` means the budget of one has not been spent yet. checkride cannot
+ * work this out alone: the stop payload goes to the hook script, never to this
+ * process. See {@link reportStandDown}.
+ *
+ * **Absence is not `0`.** A script generated before this variable existed exports
+ * neither value, and reading absence as "go ahead" would loop under precisely the
+ * pairing checkride cannot detect — a new binary, an old script, and the
+ * `loop_limit: null` the gate's own hook entry asks for. So absence keeps the
+ * older and quieter behavior, and only an explicit `0` unlocks the message.
+ */
+export const GATE_RETRY_ENV = 'CHECKRIDE_GATE_RETRY';
+/** Where the gate points a red agent when `--digest` wrote nothing. */
+const SUMMARY_PATH = '.check/summary.json';
+/**
+ * Cursor's own hook config. It lives here rather than in `agent-setup/cursor.ts`
+ * for the same reason {@link DIRTY_MARKER} does: the gate *reads* it (see
+ * {@link deferredToCursor}), and the writer importing from the gate is the
+ * direction that has no cycle. `agent-setup/cursor.ts` re-exports it.
+ */
+export const CURSOR_HOOKS_FILE = '.cursor/hooks.json';
+/**
+ * What a registered checkride gate looks like inside a harness's hook config.
+ * Both harnesses name the script the same, so finding it in Cursor's config is
+ * enough to know Cursor has a native gate of its own.
+ */
+const GATE_SCRIPT_SENTINEL = 'checkride-gate.sh';
+/** Every harness whose stop-hook protocol the gate can speak. */
+export const HARNESS_NAMES = ['claude', 'cursor'];
+/** Script name every checkride repo exposes; `checkride init` writes it. */
+const CHECK_SCRIPT = 'check';
+const spawnForward = (command, args, opts) => new Promise((resolve) => {
+    const proc = spawn(command, [...args], {
+        cwd: opts.cwd,
+        stdio: ['ignore', 'pipe', 'pipe'],
+        env: { ...opts.env, FORCE_COLOR: '0', NO_COLOR: '1' },
+    });
+    proc.stdout.setEncoding('utf8');
+    proc.stderr.setEncoding('utf8');
+    proc.stdout.on('data', (chunk) => opts.stderr.write(chunk));
+    proc.stderr.on('data', (chunk) => opts.stderr.write(chunk));
+    // A gate that cannot spawn its package manager is not a crash: the harness
+    // gets a verdict it can act on rather than a stack trace. The message goes
+    // to the stream so it is both visible and classifiable — a spawn failure
+    // that printed nothing at all was reported as a red with no explanation.
+    proc.on('error', (err) => {
+        opts.stderr.write(`${SPAWN_FAILED_MARKER} \`${command}\`: ${err.message}\n`);
+        resolve(null);
+    });
+    proc.on('close', (code) => resolve(code));
+});
+/**
+ * How much of the child's output to keep for {@link launchRefusal}.
+ *
+ * The **head**, not the tail: a package manager that refuses to launch says so
+ * before anything else runs, so the evidence is always in the first bytes. A
+ * check that fails after this much output is a pipeline red, which needs no
+ * classification.
+ */
+const CAPTURE_LIMIT = 8 * 1024;
+/** An `Out` that forwards everything and remembers the beginning. */
+function recording(out) {
+    let kept = '';
+    return {
+        write: (chunk) => {
+            if (kept.length < CAPTURE_LIMIT)
+                kept += chunk;
+            return out.write(chunk);
+        },
+        text: () => kept,
+    };
+}
+/**
+ * True when this `--harness claude` invocation is really Cursor running the
+ * repo's `.claude/settings.json` hooks, *and* Cursor has a native checkride gate
+ * of its own that will run for the same turn.
+ *
+ * Cursor loads third-party (Claude Code) hook configs when "Include third-party
+ * Plugins, Skills, and other configs" is on, maps `Stop` onto `stop`, and — the
+ * load-bearing sentence — runs **all** matching hooks from **every** source. A
+ * repo wired for both harnesses therefore fires two full pipelines into one
+ * `.check/` directory, concurrently and with nothing to serialize them, where
+ * the orchestrator clears each slot's artifacts before re-running it.
+ *
+ * So one of the two has to stand down, and it is this one: under Cursor the
+ * native `.cursor/hooks.json` gate is the only one that can answer in Cursor's
+ * protocol, which makes it authoritative there.
+ *
+ * Deliberately narrow — it defers only when a Cursor gate is *registered*, not
+ * merely when Cursor is running, so the failure mode of a stale environment
+ * variable is a duplicate run (today's behavior) rather than no gate at all.
+ */
+function deferredToCursor(cwd, env) {
+    if (!env['CURSOR_PROJECT_DIR'])
+        return false;
+    try {
+        return readFileSync(join(cwd, CURSOR_HOOKS_FILE), 'utf8').includes(GATE_SCRIPT_SENTINEL);
+    }
+    catch {
+        return false;
+    }
+}
+/**
+ * The gate's `check`-script invocation for `pm` (the alias `agent-setup`
+ * ensures exists). The hook IS a gate, so it runs `--strict` (zero checks
+ * running is exit 2, not a pass — docs/contract.md) and `--digest` (the
+ * token-bounded failure excerpt is a far better landing spot for an agent than
+ * raw summary.json). npm alone needs `--` to reach the script with flags;
+ * pnpm/yarn/bun forward them directly.
+ */
+export function checkArgs(pm, profile = null) {
+    return [
+        'run',
+        CHECK_SCRIPT,
+        ...(pm === 'npm' ? ['--'] : []),
+        '--strict',
+        '--digest',
+        ...profileArgs(profile),
+    ];
+}
+/**
+ * The profile's flags, appended **after** the check script's own.
+ *
+ * Last wins in `parseArgs`, so a repo whose `check` script already carries
+ * `--only` has the profile override it rather than fight it — the profile is the
+ * more specific statement, made about this hook in particular.
+ */
+function profileArgs(profile) {
+    if (profile === null)
+        return [];
+    return [
+        ...(profile.only && profile.only.length > 0 ? ['--only', profile.only.join(',')] : []),
+        ...(profile.skip && profile.skip.length > 0 ? ['--skip', profile.skip.join(',')] : []),
+        ...(profile.changed === true ? ['--changed'] : []),
+    ];
+}
+/**
+ * The repo's gate profile, or `null` when it configures none and the gate should
+ * run the whole check.
+ *
+ * A profile with nothing in it is `null` too: `"gate": {}` narrows nothing, and
+ * carrying it forward would put "not the full check" on a verdict that *was* the
+ * full check.
+ */
+export function gateProfile(cwd, config = loadConfig(cwd)) {
+    const profile = config?.gate;
+    if (!profile)
+        return null;
+    return profileArgs(profile).length > 0 ? profile : null;
+}
+/**
+ * The repo's gate preflight, or `null` when it declares none.
+ *
+ * Read at *write* time rather than at run time, by the hook writers in
+ * `./agent-setup/`, and baked into the generated script as a literal path. Two
+ * reasons, and both are the point of the seam:
+ *
+ * 1. A preflight that only ran once checkride had started could not answer for
+ *    the case it exists to cover — a repo whose dependencies were never
+ *    installed, where `checkride gate` is the thing that cannot run.
+ * 2. Every `hooks add`/`agent-setup` re-reads this file, so the wiring is
+ *    restored on every refresh instead of being clobbered by it. That is exactly
+ *    the failure a `--preflight` flag would have kept: a teammate running the
+ *    bare command would silently drop the guard.
+ *
+ * Kept separate from {@link gateProfile} because a preflight narrows nothing —
+ * it must never put a "NOT the full check" clause on a verdict.
+ */
+export function gatePreflight(cwd, config = loadConfig(cwd)) {
+    const path = config?.gate?.preflight;
+    return path !== undefined && path.length > 0 ? path : null;
+}
+/**
+ * How a narrowed run must describe itself — appended to every verdict the gate
+ * produces while a profile is active.
+ *
+ * This is the price of the profile and it is not optional. A gate that runs two
+ * of eighteen slots and reports a bare `✔ green` has told the reader the work is
+ * done, which is exactly what it does not know. Naming the profile turns a
+ * silent partial pass into a stated one.
+ */
+function profileClause(profile) {
+    if (profile === null)
+        return null;
+    const parts = [
+        profile.only && profile.only.length > 0 ? `only ${profile.only.join(', ')}` : null,
+        profile.skip && profile.skip.length > 0 ? `without ${profile.skip.join(', ')}` : null,
+        profile.changed === true ? 'affected-only' : null,
+    ].filter((p) => p !== null);
+    return `gate profile: ${parts.join(', ')} — NOT the full check`;
+}
+/**
+ * Below this, naming the slowest check is noise rather than insight — every
+ * check in a fast repo is "the slowest" by some millisecond.
+ */
+const SLOWEST_FLOOR_MS = 1000;
+/** The checks that actually ran, in report order. */
+function ranChecks(checks) {
+    return checks.filter((c) => c.skipped !== true);
+}
+/** `15 checks, slowest test 21.4s` — what a green run is worth saying about itself. */
+function greenDetail(ran) {
+    const count = `${ran.length} check${ran.length === 1 ? '' : 's'}`;
+    const slowest = ran.reduce((worst, c) => (worst === null || c.duration_ms > worst.duration_ms ? c : worst), null);
+    if (slowest === null || slowest.duration_ms < SLOWEST_FLOOR_MS)
+        return count;
+    return `${count}, slowest ${slowest.name} ${formatDuration(slowest.duration_ms)}`;
+}
+/**
+ * Tolerance for a summary written moments before the gate's own clock reading —
+ * mirrors `MTIME_TOLERANCE_MS` in `./triage/triage.ts`, where the same
+ * comparison decides whether the summary belongs to this run.
+ *
+ * Without it this comparison is unsound on Linux: file mtimes come from the
+ * kernel's coarse (timer-tick) clock while `Date.now()` does not, so a summary
+ * written *after* `startedAt` routinely lands a few milliseconds behind it —
+ * measured at ~47% of writes on overlayfs, and never once on APFS. That is why
+ * the gate went red only on the Linux CI legs.
+ */
+const MTIME_TOLERANCE_MS = 1000;
+/**
+ * Is the summary on disk the one *this* run wrote?
+ *
+ * A gate that could not run wrote none, and a report that invents "0 checks
+ * failed" from a missing file is exactly the vacuous green the artifact exists
+ * to disprove. A summary older than `startedAt` belongs to a *previous* run and
+ * is dropped for the same reason — not hypothetical: a check script of the shape
+ * `tsc --build && checkride` leaves the summary untouched when the build fails,
+ * so trusting whatever is on disk would report the last run's failing slots as
+ * this one's, confidently and wrongly. The tolerance is far smaller than any
+ * real gate run, so it cannot launder a genuinely stale summary into a fresh one.
+ */
+function isFresh(read, startedAt) {
+    return read.state === 'ok' && read.mtimeMs >= startedAt - MTIME_TOLERANCE_MS;
+}
+/**
+ * What the run itself says, read back out of a summary already known to be this
+ * run's, or `null` when there is none. The caller still has the elapsed time,
+ * which is true regardless.
+ */
+function runDetail(read, green) {
+    if (read.state !== 'ok')
+        return null;
+    const ran = ranChecks(read.summary.checks);
+    if (green)
+        return greenDetail(ran);
+    const failed = ran.filter((c) => !c.ok).map((c) => c.name);
+    // Red with nothing failing means the check script itself died (or --strict
+    // caught a vacuous run); say the honest thing rather than name no slots.
+    if (failed.length === 0)
+        return `${ran.length} checks ran, none failed — the check script itself failed`;
+    return `${failed.length} of ${ran.length} failed: ${failed.join(', ')}`;
+}
+/**
+ * The one line a human reads to know the gate ran, what it decided, and how long
+ * they waited on it.
+ *
+ * The elapsed time is the gate's own wall clock — package-manager startup,
+ * incremental build and all — not the pipeline's `total_duration_ms`, because
+ * the honest answer to "why did that pause" is the whole pause, not the part
+ * checkride chooses to measure.
+ */
+function headline(verdict, elapsedMs, detail) {
+    return `checkride ${verdict} in ${formatDuration(elapsedMs)}${detail === null ? '' : ` — ${detail}`}`;
+}
+/** Join the run's own detail with the narrowing note, dropping whichever is absent. */
+function detailWith(detail, profile) {
+    const parts = [detail, profileClause(profile)].filter((p) => p !== null);
+    return parts.length === 0 ? null : parts.join(' — ');
+}
+/** The sentence a red gate hands the agent, naming what to open first. */
+function redMessage(cwd, pm, profile) {
+    const where = existsSync(join(cwd, '.check', DIGEST_FILE)) ? `.check/${DIGEST_FILE}` : SUMMARY_PATH;
+    // A narrowed red is still a red, but it is not the whole story: the slots the
+    // profile skipped were never asked, so fixing what it names may not be enough.
+    const narrowed = profile === null
+        ? ''
+        : ` This gate ran a profile, not the full check — run \`${runScript(pm, CHECK_SCRIPT)}\` for the rest.`;
+    return (`checkride: the gate is red — read ${where}, fix the failing slot, then finish ` +
+        `(do not stop while checkride is red). Run \`${pm} exec checkride triage\` for full triage.${narrowed}`);
+}
+/**
+ * The Node half of a refusal message: what this process is running, what the
+ * repo asked for, and the one lever that closes the gap.
+ *
+ * This clause is why the whole classification exists. The default cause of a
+ * refused launch is that the harness ran its hook in a non-login shell, so the
+ * hook got the machine's default interpreter rather than the contributor's —
+ * a fact no amount of reading `.check/` would ever reveal.
+ */
+function nodeClause(alignment, running) {
+    const context = 'Agent harnesses run hooks in a non-login shell, so a hook gets the machine’s default ' +
+        'Node rather than the one your terminal has.';
+    const pin = alignment?.pin ?? null;
+    if (pin === null) {
+        return (`${context} This process is on Node ${running} and the repo pins no ` +
+            `\`.nvmrc\`/\`.node-version\` for checkride to align to; add one, or set ${NODE_BIN_VAR} to the ` +
+            'bin directory of a Node the repo accepts.');
+    }
+    return (`${context} This one is on Node ${running}, the repo pins ${pin.version} ` +
+        `(${pin.file}), and no matching install was found in a known version-manager layout — ` +
+        `so checkride could not align to it. Install that Node, or set ${NODE_BIN_VAR} to its bin directory.`);
+}
+/**
+ * Said on the refusals nobody in the turn can clear, and only those: the gate is
+ * declining to block.
+ *
+ * Stating it is the whole point. A turn that ended unverified must not look like
+ * a turn that passed, and the reader — who *can* fix their environment, unlike
+ * the agent — is the one who needs to know a check was owed and never ran.
+ */
+const STOOD_DOWN = 'This gate is not blocking the turn: nothing here is fixable by editing the repo, so blocking ' +
+    'would only re-ask an agent that has no lever to pull. Nothing was verified — fix the ' +
+    'environment and run the check yourself before trusting this turn.';
+/**
+ * The verdict for a package manager that refused to start the check script.
+ *
+ * It says the three things a red verdict would get wrong here: nothing ran, so
+ * `.check/` describes some earlier turn and not this one; the code is not what
+ * failed, so no edit will clear it; and here is the actual cause. A gate that
+ * sent a reader to `summary.json` for a run that never happened is the confusion
+ * this replaces.
+ *
+ * {@link nodeClause} rides only on an `environment` refusal. It is a paragraph
+ * about which interpreter this process got, and appending it to "this repo has
+ * no `check` script" pointed a reader at their Node version to explain a missing
+ * line of package.json.
+ */
+function refusalMessage(refusal, context) {
+    const environment = refusal.fixable === 'environment';
+    return [
+        `checkride: the gate could not run — ${refusal.cause}.`,
+        'Nothing ran: no check executed and no artifact was written, so `.check/` holds nothing from ' +
+            'this turn and the code is not what to look at.',
+        ...(environment ? [nodeClause(context.alignment, context.running), STOOD_DOWN] : []),
+        `Run \`${runScript(context.pm, CHECK_SCRIPT)}\` in a terminal to see the same failure directly.`,
+    ].join(' ');
+}
+/**
+ * Put the pinned Node in front of the child's `PATH`, and say so on stderr.
+ *
+ * Never silent, by rule: which interpreter the whole pipeline runs on is not
+ * something to change behind the reader's back, and the line is what turns a
+ * mysteriously different result into an explained one. It goes to stderr with
+ * the rest of the run's progress rather than into the one-line verdict, so it is
+ * present on a red run too — which is exactly when it is worth knowing.
+ *
+ * Returns `env` unchanged when there is nothing to align, which is every repo
+ * that pins nothing and every hook that already arrived on the right Node.
+ */
+function announceAlignment(alignment, env, stderr) {
+    if (alignment === null)
+        return env;
+    const { bin } = alignment;
+    if (bin === null)
+        return env;
+    const target = alignment.version ?? alignment.pin?.version ?? 'the pinned version';
+    const why = alignment.pin === null ? NODE_BIN_VAR : `${alignment.pin.file} pins ${alignment.pin.version}`;
+    stderr.write(`checkride: running the check on Node ${target} from ${bin} (${why}; this hook started on ${alignment.running}).\n`);
+    return withNodeBin(env, bin);
+}
+/**
+ * Classify a non-green run and phrase it.
+ *
+ * The one judgement here is whether the pipeline ran. A summary from this run
+ * proves it did, so on that branch nothing in the output can mean otherwise —
+ * the guard that keeps a check which merely *printed* a package-manager error
+ * code from being read as a launch refusal.
+ */
+function failedVerdict(f) {
+    const refusal = f.fresh ? null : launchRefusal(f.output);
+    if (refusal === null) {
+        return {
+            status: headline('✘ red', f.elapsedMs, detailWith(f.fresh ? runDetail(f.summary, false) : null, f.profile)),
+            instruction: redMessage(f.cwd, f.pm, f.profile),
+            refusal: null,
+            standDown: false,
+        };
+    }
+    // A launch refusal names no profile: nothing ran, so how much would have run
+    // is beside the point.
+    return {
+        status: headline('⚠ could not run', f.elapsedMs, refusal.cause),
+        instruction: refusalMessage(refusal, { alignment: f.alignment, running: f.running, pm: f.pm }),
+        refusal: refusal.cause,
+        standDown: refusal.fixable === 'environment',
+    };
+}
+/**
+ * Answer a green run in `harness`'s protocol.
+ *
+ * Claude Code gets `{"systemMessage": …}`, which it shows the user. Without it a
+ * green gate is completely silent: the turn simply takes a minute longer than it
+ * should have, with nothing on screen to say a full pipeline just ran, which is
+ * indistinguishable from a hung model.
+ *
+ * Cursor gets nothing, and cannot. Its stop hook accepts one field —
+ * `followup_message` — and that field *submits a new turn*, so using it to
+ * announce a pass would put the agent back to work every time it succeeded. No
+ * other channel is documented for the event; see docs/cursor.md.
+ */
+function reportGreen(harness, stdout, status) {
+    if (harness === 'cursor')
+        return;
+    stdout.write(`${JSON.stringify({ systemMessage: status })}\n`);
+}
+/**
+ * Answer a refusal the turn cannot possibly clear: say so, loudly, and do not
+ * block.
+ *
+ * This is the one place checkride chooses *not* to gate, and it is not a
+ * softening of the vacuous-green rule — it is that rule reaching its limit.
+ * Blocking exists to make an agent fix what it broke. When the cause is a Node
+ * the harness did not put on `PATH`, or a package manager corepack will not
+ * verify, there is nothing to fix from inside the turn; the block just re-asks
+ * the same agent forever, and the observed end of that road is a contributor
+ * turning the gate off. A standing gate that says "I could not run" beats a
+ * removed one.
+ *
+ * The message goes to whoever can act on it. Under Claude Code that is
+ * `systemMessage`, which the *user* sees — and the full text rides there rather
+ * than the one-line status, because without a `decision: "block"` there is no
+ * `reason` channel to carry the rest.
+ *
+ * Cursor has no equivalent. Its stop hook takes one output field,
+ * `followup_message`, and that *submits a new turn* — the loop being stood down
+ * from. This used to settle for stderr, on the reading that a stand-down nobody
+ * sees still beats a loop. That reading was wrong in its premise: Cursor does not
+ * document hook stderr as reaching the user at all, surfacing it only in a Hooks
+ * output panel under Customize, so "not silent" held on one harness and the
+ * party who can actually run an install saw nothing.
+ *
+ * So the message does go to `followup_message` — **once**. {@link GATE_RETRY_ENV}
+ * carries the one fact that makes that safe, since the `loop_count` deciding it
+ * reaches the hook script rather than this process. One nudge names the fix in
+ * the chat; the next turn is silent, and the loop is bounded at a single extra
+ * turn rather than at nothing.
+ */
+function reportStandDown(harness, out, full, env) {
+    if (harness === 'cursor') {
+        if (env[GATE_RETRY_ENV] === '0')
+            out.stdout.write(`${JSON.stringify({ followup_message: full })}\n`);
+    }
+    else {
+        out.stdout.write(`${JSON.stringify({ systemMessage: full })}\n`);
+    }
+    out.stderr.write(`${full}\n`);
+    return 0;
+}
+/**
+ * Answer a run that was not green in `harness`'s protocol — a pipeline red, or a
+ * launch refusal the repo can fix; the wire format is the same for both, because
+ * both block. A refusal nothing in the turn can fix takes
+ * {@link reportStandDown} instead, before any of this.
+ *
+ * Claude Code gets both spellings of the same verdict, because which one lands
+ * depends on the hook script the repo happens to have. The JSON body
+ * (`decision: "block"`) is what a current script forwards on its own exit 0 —
+ * Claude Code parses hook JSON *only* on exit 0, and that body is the one form
+ * that can carry a user-visible `systemMessage` alongside the block. The stderr
+ * line is what a script generated before that change relies on, where the block
+ * rides on exit 2 and stdout is ignored. Emitting both is what lets an
+ * already-installed hook script keep gating across the upgrade.
+ *
+ * Cursor gets `{"followup_message": …}` on stdout and **exit 0**: it reads a
+ * non-zero stop hook as a *failed hook* and lets the turn end anyway, so the
+ * verdict cannot ride on the exit code. Cursor caps those auto-followups at five
+ * per script by default; the hook entry `agent-setup` writes opts out
+ * (`loop_limit: null`), because a gate that stops replying after five turns is
+ * not a gate.
+ */
+function reportRed(harness, out, verdict, env) {
+    // The agent is told what to open and what not to do; the user is told what
+    // happened and how long it took. Handing the user the agent's marching orders
+    // would bury the one line they are actually reading.
+    const full = `${verdict.status}\n${verdict.instruction}`;
+    if (verdict.standDown)
+        return reportStandDown(harness, out, full, env);
+    if (harness === 'cursor') {
+        out.stdout.write(`${JSON.stringify({ followup_message: full })}\n`);
+        return 0;
+    }
+    out.stdout.write(`${JSON.stringify({ decision: 'block', reason: full, systemMessage: verdict.status })}\n`);
+    out.stderr.write(`${full}\n`);
+    return 2;
+}
+function gateContext(options) {
+    return {
+        cwd: options.cwd ?? process.cwd(),
+        harness: options.harness ?? 'claude',
+        stdout: options.stdout ?? process.stdout,
+        stderr: options.stderr ?? process.stderr,
+        run: options.spawn ?? spawnForward,
+        env: options.env ?? process.env,
+        pinEnv: options.pinEnv ?? realPinEnv,
+        now: options.now ?? Date.now,
+    };
+}
+/**
+ * Run the gate and answer in `harness`'s protocol.
+ *
+ * The exit code is unchanged and stays as `docs/contract.md` promises it: 2 while
+ * blocked under `--harness claude`, always 0 under `--harness cursor`. What each
+ * harness *displays* is carried by the JSON body on stdout — see
+ * {@link reportGreen} and {@link reportRed} — because that is the only channel
+ * either harness renders for a human.
+ */
+export async function runGate(options = {}) {
+    const { cwd, harness, stdout, stderr, run, env, pinEnv, now } = gateContext(options);
+    const marker = join(cwd, DIRTY_MARKER);
+    // Cursor running this repo's Claude hooks alongside its own. Stand down before
+    // touching the marker: the native Cursor gate owns both the verdict and the
+    // marker for this turn.
+    if (harness === 'claude' && deferredToCursor(cwd, env)) {
+        return { exitCode: 0, ran: false, green: true, refusal: null };
+    }
+    // No edit marker → this turn touched no files → nothing to gate. Stop hooks
+    // fire on every turn, including pure-conversation ones; without this the gate
+    // taxes every reply with a full pipeline run.
+    if (options.ifDirty === true && !existsSync(marker)) {
+        return { exitCode: 0, ran: false, green: true, refusal: null };
+    }
+    const pm = options.pm ?? detectPackageManager({ cwd });
+    const profile = options.profile !== undefined ? options.profile : gateProfile(cwd);
+    const alignment = alignNode(cwd, pinEnv);
+    const childEnv = announceAlignment(alignment, env, stderr);
+    const startedAt = now();
+    const output = recording(stderr);
+    const code = await run(pm, checkArgs(pm, profile), { cwd, stderr: output, env: childEnv });
+    const green = code === 0;
+    const summary = await readSummary(cwd);
+    const fresh = isFresh(summary, startedAt);
+    if (green) {
+        rmSync(marker, { force: true });
+        const detail = detailWith(fresh ? runDetail(summary, true) : null, profile);
+        reportGreen(harness, stdout, headline('✔ green', now() - startedAt, detail));
+        return { exitCode: 0, ran: true, green: true, refusal: null };
+    }
+    const verdict = failedVerdict({
+        cwd,
+        pm,
+        elapsedMs: now() - startedAt,
+        summary,
+        fresh,
+        output: output.text(),
+        alignment,
+        running: pinEnv.running(),
+        profile,
+    });
+    const exitCode = reportRed(harness, { stdout, stderr }, verdict, env);
+    return { exitCode, ran: true, green: false, refusal: verdict.refusal };
+}
+//# sourceMappingURL=gate.js.map

package/node_modules/checkride/dist/gate.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"gate.js","sourceRoot":"","sources":["../src/gate.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,EAAE,MAAM,SAAS,CAAC;AAC3D,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,WAAW,EAAoB,MAAM,sBAAsB,CAAC;AAErF,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAEjF,OAAO,EACL,oBAAoB,EAEpB,aAAa,EAEb,SAAS,EACT,mBAAmB,GACpB,MAAM,eAAe,CAAC;AAEvB;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAE5C;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,CAAC,MAAM,cAAc,GAAG,sBAAsB,CAAC;AAErD,uEAAuE;AACvE,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAE3C;;;;;GAKG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAEtD;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,mBAAmB,CAAC;AAEjD,iEAAiE;AACjE,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,QAAQ,EAAE,QAAQ,CAAU,CAAC;AAG3D,4EAA4E;AAC5E,MAAM,YAAY,GAAG,OAAO,CAAC;AAmB7B,MAAM,YAAY,GAAc,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,CACtD,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;IACtB,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;QACrC,GAAG,EAAE,IAAI,CAAC,GAAG;QACb,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;QACjC,GAAG,EAAE,EAAE,GAAG,IAAI,CAAC,GAAG,EAAE,WAAW,EAAE,GAAG,EAAE,QAAQ,EAAE,GAAG,EAAE;KACtD,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,KAAa,EAAE,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IACpE,2EAA2E;IAC3E,2EAA2E;IAC3E,yEAAyE;IACzE,yEAAyE;IACzE,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;QACvB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,mBAAmB,MAAM,OAAO,OAAO,GAAG,CAAC,OAAO,IAAI,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC;AAC5C,CAAC,CAAC,CAAC;AAEL;;;;;;;GAOG;AACH,MAAM,aAAa,GAAG,CAAC,GAAG,IAAI,CAAC;AAE/B,qEAAqE;AACrE,SAAS,SAAS,CAAC,GAAQ;IACzB,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,OAAO;QACL,KAAK,EAAE,CAAC,KAAa,EAAE,EAAE;YACvB,IAAI,IAAI,CAAC,MAAM,GAAG,aAAa;gBAAE,IAAI,IAAI,KAAK,CAAC;YAC/C,OAAO,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QAC1B,CAAC;QACD,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI;KACjB,CAAC;AACJ,CAAC;AAsCD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,SAAS,gBAAgB,CAAC,GAAW,EAAE,GAAuC;IAC5E,IAAI,CAAC,GAAG,CAAC,oBAAoB,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,CAAC;QACH,OAAO,YAAY,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,oBAAoB,CAAC,CAAC;IAC3F,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,SAAS,CAAC,EAAkB,EAAE,UAA8B,IAAI;IAC9E,OAAO;QACL,KAAK;QACL,YAAY;QACZ,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/B,UAAU;QACV,UAAU;QACV,GAAG,WAAW,CAAC,OAAO,CAAC;KACxB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,SAAS,WAAW,CAAC,OAA2B;IAC9C,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO;QACL,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,GAAG,CAAC,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;KACnD,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,GAAW,EAAE,SAAiC,UAAU,CAAC,GAAG,CAAC;IACvF,MAAM,OAAO,GAAG,MAAM,EAAE,IAAI,CAAC;IAC7B,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,OAAO,WAAW,CAAC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa,CAAC,GAAW,EAAE,SAAiC,UAAU,CAAC,GAAG,CAAC;IACzF,MAAM,IAAI,GAAG,MAAM,EAAE,IAAI,EAAE,SAAS,CAAC;IACrC,OAAO,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;AAC7D,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,aAAa,CAAC,OAA2B;IAChD,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAClC,MAAM,KAAK,GAAG;QACZ,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,QAAQ,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QAClF,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI;QACrF,OAAO,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,IAAI;KAClD,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACzC,OAAO,iBAAiB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,CAAC;AAClE,CAAC;AAED;;;GAGG;AACH,MAAM,gBAAgB,GAAG,IAAI,CAAC;AAE9B,qDAAqD;AACrD,SAAS,SAAS,CAAC,MAA+B;IAChD,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,IAAI,CAAC,CAAC;AAClD,CAAC;AAED,uFAAuF;AACvF,SAAS,WAAW,CAAC,GAA4B;IAC/C,MAAM,KAAK,GAAG,GAAG,GAAG,CAAC,MAAM,SAAS,GAAG,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IAClE,MAAM,OAAO,GAAG,GAAG,CAAC,MAAM,CACxB,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,IAAI,CAAC,CAAC,WAAW,GAAG,KAAK,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,EAC/E,IAAI,CACL,CAAC;IACF,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,CAAC,WAAW,GAAG,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAC7E,OAAO,GAAG,KAAK,aAAa,OAAO,CAAC,IAAI,IAAI,cAAc,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;AACpF,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC;AAEhC;;;;;;;;;;;GAWG;AACH,SAAS,OAAO,CAAC,IAAiB,EAAE,SAAiB;IACnD,OAAO,IAAI,CAAC,KAAK,KAAK,IAAI,IAAI,IAAI,CAAC,OAAO,IAAI,SAAS,GAAG,kBAAkB,CAAC;AAC/E,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAiB,EAAE,KAAc;IAClD,IAAI,IAAI,CAAC,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IAC3C,IAAI,KAAK;QAAE,OAAO,WAAW,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAC3D,2EAA2E;IAC3E,yEAAyE;IACzE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,GAAG,CAAC,MAAM,2DAA2D,CAAC;IACzG,OAAO,GAAG,MAAM,CAAC,MAAM,OAAO,GAAG,CAAC,MAAM,YAAY,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AAC1E,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,QAAQ,CAAC,OAAe,EAAE,SAAiB,EAAE,MAAqB;IACzE,OAAO,aAAa,OAAO,OAAO,cAAc,CAAC,SAAS,CAAC,GAAG,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,EAAE,CAAC;AACxG,CAAC;AAED,uFAAuF;AACvF,SAAS,UAAU,CAAC,MAAqB,EAAE,OAA2B;IACpE,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC;IACtF,OAAO,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACvD,CAAC;AAED,0EAA0E;AAC1E,SAAS,UAAU,CAAC,GAAW,EAAE,EAAkB,EAAE,OAA2B;IAC9E,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,QAAQ,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,WAAW,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC;IACpG,8EAA8E;IAC9E,+EAA+E;IAC/E,MAAM,QAAQ,GACZ,OAAO,KAAK,IAAI;QACd,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,wDAAwD,SAAS,CAAC,EAAE,EAAE,YAAY,CAAC,kBAAkB,CAAC;IAC5G,OAAO,CACL,qCAAqC,KAAK,sCAAsC;QAChF,+CAA+C,EAAE,4CAA4C,QAAQ,EAAE,CACxG,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,UAAU,CAAC,SAA+B,EAAE,OAAe;IAClE,MAAM,OAAO,GACX,uFAAuF;QACvF,6CAA6C,CAAC;IAChD,MAAM,GAAG,GAAG,SAAS,EAAE,GAAG,IAAI,IAAI,CAAC;IACnC,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,OAAO,CACL,GAAG,OAAO,4BAA4B,OAAO,wBAAwB;YACrE,2EAA2E,YAAY,UAAU;YACjG,2CAA2C,CAC5C,CAAC;IACJ,CAAC;IACD,OAAO,CACL,GAAG,OAAO,wBAAwB,OAAO,mBAAmB,GAAG,CAAC,OAAO,GAAG;QAC1E,IAAI,GAAG,CAAC,IAAI,2EAA2E;QACvF,iEAAiE,YAAY,wBAAwB,CACtG,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,GACd,+FAA+F;IAC/F,uFAAuF;IACvF,mEAAmE,CAAC;AAEtE;;;;;;;;;;;;;GAaG;AACH,SAAS,cAAc,CACrB,OAAsB,EACtB,OAAiF;IAEjF,MAAM,WAAW,GAAG,OAAO,CAAC,OAAO,KAAK,aAAa,CAAC;IACtD,OAAO;QACL,uCAAuC,OAAO,CAAC,KAAK,GAAG;QACvD,8FAA8F;YAC5F,gDAAgD;QAClD,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACpF,SAAS,SAAS,CAAC,OAAO,CAAC,EAAE,EAAE,YAAY,CAAC,oDAAoD;KACjG,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,iBAAiB,CACxB,SAA+B,EAC/B,GAAuC,EACvC,MAAW;IAEX,IAAI,SAAS,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IACnC,MAAM,EAAE,GAAG,EAAE,GAAG,SAAS,CAAC;IAC1B,IAAI,GAAG,KAAK,IAAI;QAAE,OAAO,GAAG,CAAC;IAC7B,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,IAAI,SAAS,CAAC,GAAG,EAAE,OAAO,IAAI,oBAAoB,CAAC;IACnF,MAAM,GAAG,GAAG,SAAS,CAAC,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,IAAI,SAAS,SAAS,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC;IAC1G,MAAM,CAAC,KAAK,CAAC,wCAAwC,MAAM,SAAS,GAAG,KAAK,GAAG,0BAA0B,SAAS,CAAC,OAAO,MAAM,CAAC,CAAC;IAClI,OAAO,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC/B,CAAC;AAgBD;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,CAAU;IAC/B,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;IACzD,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,OAAO;YACL,MAAM,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;YAC3G,WAAW,EAAE,UAAU,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC;YAC/C,OAAO,EAAE,IAAI;YACb,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,uBAAuB;IACvB,OAAO;QACL,MAAM,EAAE,QAAQ,CAAC,iBAAiB,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC;QAC/D,WAAW,EAAE,cAAc,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,CAAC,CAAC,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QAC9F,OAAO,EAAE,OAAO,CAAC,KAAK;QACtB,SAAS,EAAE,OAAO,CAAC,OAAO,KAAK,aAAa;KAC7C,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,WAAW,CAAC,OAAoB,EAAE,MAAW,EAAE,MAAc;IACpE,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO;IACjC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC,IAAI,CAAC,CAAC;AACjE,CAAC;AAWD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,SAAS,eAAe,CACtB,OAAoB,EACpB,GAAiC,EACjC,IAAY,EACZ,GAAuC;IAEvC,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,IAAI,GAAG,CAAC,cAAc,CAAC,KAAK,GAAG;YAAE,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IACvG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;IACnE,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,SAAS,CAChB,OAAoB,EACpB,GAAiC,EACjC,OAAgB,EAChB,GAAuC;IAEvC,2EAA2E;IAC3E,8EAA8E;IAC9E,qDAAqD;IACrD,MAAM,IAAI,GAAG,GAAG,OAAO,CAAC,MAAM,KAAK,OAAO,CAAC,WAAW,EAAE,CAAC;IACzD,IAAI,OAAO,CAAC,SAAS;QAAE,OAAO,eAAe,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;QACzB,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,IAAI,CAAC,CAAC;QACpE,OAAO,CAAC,CAAC;IACX,CAAC;IACD,GAAG,CAAC,MAAM,CAAC,KAAK,CACd,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,IAAI,CAC1F,CAAC;IACF,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IAC9B,OAAO,CAAC,CAAC;AACX,CAAC;AAkBD,SAAS,WAAW,CAAC,OAAoB;IACvC,OAAO;QACL,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;QACjC,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,QAAQ;QACpC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;QACxC,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,MAAM;QACxC,GAAG,EAAE,OAAO,CAAC,KAAK,IAAI,YAAY;QAClC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG;QAC/B,MAAM,EAAE,OAAO,CAAC,MAAM,IAAI,UAAU;QACpC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG;KAC7B,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,UAAuB,EAAE;IACrD,MAAM,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IACrF,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE,YAAY,CAAC,CAAC;IAEvC,+EAA+E;IAC/E,4EAA4E;IAC5E,wBAAwB;IACxB,IAAI,OAAO,KAAK,QAAQ,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,8CAA8C;IAC9C,IAAI,OAAO,CAAC,OAAO,KAAK,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;QACpD,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACjE,CAAC;IAED,MAAM,EAAE,GAAG,OAAO,CAAC,EAAE,IAAI,oBAAoB,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC;IACvD,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IACnF,MAAM,SAAS,GAAG,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACzC,MAAM,QAAQ,GAAG,iBAAiB,CAAC,SAAS,EAAE,GAAG,EAAE,MAAM,CAAC,CAAC;IAC3D,MAAM,SAAS,GAAG,GAAG,EAAE,CAAC;IACxB,MAAM,MAAM,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,EAAE,EAAE,SAAS,CAAC,EAAE,EAAE,OAAO,CAAC,EAAE,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC3F,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,CAAC;IACzB,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAE1C,IAAI,KAAK,EAAE,CAAC;QACV,MAAM,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;QAC5E,WAAW,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,CAAC,SAAS,EAAE,GAAG,EAAE,GAAG,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC;QAC7E,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAChE,CAAC;IAED,MAAM,OAAO,GAAG,aAAa,CAAC;QAC5B,GAAG;QACH,EAAE;QACF,SAAS,EAAE,GAAG,EAAE,GAAG,SAAS;QAC5B,OAAO;QACP,KAAK;QACL,MAAM,EAAE,MAAM,CAAC,IAAI,EAAE;QACrB,SAAS;QACT,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE;QACzB,OAAO;KACR,CAAC,CAAC;IACH,MAAM,QAAQ,GAAG,SAAS,CAAC,OAAO,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,GAAG,CAAC,CAAC;IACtE,OAAO,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC"}