pushary 1.8.0

package/dist/chunk-JZTHGAPA.js

@@ -0,0 +1,503 @@
+import {
+  changedRecipientsMessage,
+  loadPin,
+  savePin,
+  verifyRecipients
+} from "./chunk-SGZJ5LYH.js";
+import {
+  hookOwnerOf
+} from "./chunk-EYK3GSRH.js";
+import {
+  ensureDaemonRunning
+} from "./chunk-WE2J62NC.js";
+import {
+  buildTranscriptRecords,
+  decodePublicKey,
+  generateSessionKey,
+  wrapSessionKey
+} from "./chunk-MPWXGONV.js";
+import {
+  fetchTranscriptRecipients,
+  uploadTranscriptRecords
+} from "./chunk-SAXBC4AZ.js";
+import {
+  transcriptEnvironmentPreference,
+  transcriptsEnabled
+} from "./chunk-OLQRRFBX.js";
+import {
+  readTranscriptPreference
+} from "./chunk-P7WQEVWA.js";
+import {
+  codexHome,
+  pusharyDir
+} from "./chunk-A2A2YTMG.js";
+import {
+  writeJsonAtomic
+} from "./chunk-T7E75EKA.js";
+import {
+  getApiKey,
+  getBaseUrl
+} from "./chunk-GPEGOGRJ.js";
+
+// src/transcript-registration.ts
+import { createHash } from "crypto";
+import { readFileSync as readFileSync3, readdirSync as readdirSync2, statSync as statSync3, unlinkSync } from "fs";
+import { isAbsolute, join as join3, resolve as resolve2, sep } from "path";
+
+// src/transcript-source.ts
+var normalizeTranscriptLines = (lines, source) => {
+  if (source === "claude") return [...lines];
+  return lines.flatMap((line) => {
+    try {
+      const record = JSON.parse(line);
+      const item = record.payload;
+      if (record.type !== "response_item" || item?.type !== "message" || !["user", "assistant"].includes(item.role)) return [];
+      const content = (Array.isArray(item.content) ? item.content : []).flatMap((block) => ["input_text", "output_text"].includes(block.type ?? "") && typeof block.text === "string" ? [{ type: "text", text: block.text }] : []);
+      return content.length ? [JSON.stringify({ timestamp: record.timestamp, message: { role: item.role, content } })] : [];
+    } catch {
+      return [];
+    }
+  });
+};
+
+// src/transcript-sync.ts
+import { homedir as homedir2 } from "os";
+import { join as join2, resolve } from "path";
+import { existsSync as existsSync2, readFileSync as readFileSync2, statSync as statSync2 } from "fs";
+
+// src/transcript-session-key.ts
+import { existsSync, mkdirSync, readFileSync, readdirSync, rmSync, statSync, writeFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var sessionDir = () => process.env.PUSHARY_SESSION_KEY_DIR?.trim() || join(homedir(), ".pushary", "sessions");
+var SESSION_KEY_TTL_MS = 48 * 60 * 60 * 1e3;
+var SAFE_SESSION_ID = /^[A-Za-z0-9._-]{1,128}$/;
+var fileFor = (sessionId) => SAFE_SESSION_ID.test(sessionId) ? join(sessionDir(), `${sessionId}.json`) : null;
+var loadSessionKey = (sessionId) => {
+  const path = fileFor(sessionId);
+  if (!path || !existsSync(path)) return null;
+  try {
+    if (Date.now() - statSync(path).mtimeMs > SESSION_KEY_TTL_MS) return null;
+    const raw = JSON.parse(readFileSync(path, "utf-8"));
+    const key = typeof raw.sessionKey === "string" ? Buffer.from(raw.sessionKey, "base64") : null;
+    if (!key || key.length !== 32) return null;
+    return {
+      sessionKey: new Uint8Array(key),
+      wrappedKey: typeof raw.wrappedKey === "string" ? raw.wrappedKey : null,
+      providerWrappedKey: typeof raw.providerWrappedKey === "string" ? raw.providerWrappedKey : null,
+      providerKeyId: typeof raw.providerKeyId === "string" ? raw.providerKeyId : null,
+      keyUploaded: raw.keyUploaded === true
+    };
+  } catch {
+    return null;
+  }
+};
+var saveSessionKey = (sessionId, value) => {
+  const path = fileFor(sessionId);
+  if (!path) return;
+  try {
+    mkdirSync(sessionDir(), { recursive: true, mode: 448 });
+    writeFileSync(
+      path,
+      JSON.stringify({
+        sessionKey: Buffer.from(value.sessionKey).toString("base64"),
+        wrappedKey: value.wrappedKey,
+        providerWrappedKey: value.providerWrappedKey,
+        providerKeyId: value.providerKeyId,
+        keyUploaded: value.keyUploaded
+      }),
+      { mode: 384 }
+    );
+  } catch {
+  }
+};
+var sweepStaleSessionKeys = (now = Date.now()) => {
+  const dir = sessionDir();
+  if (!existsSync(dir)) return 0;
+  let removed = 0;
+  try {
+    for (const name of readdirSync(dir)) {
+      if (!name.endsWith(".json")) continue;
+      const path = join(dir, name);
+      try {
+        if (now - statSync(path).mtimeMs <= SESSION_KEY_TTL_MS) continue;
+        rmSync(path, { force: true });
+        removed += 1;
+      } catch {
+      }
+    }
+  } catch {
+    return removed;
+  }
+  return removed;
+};
+
+// src/transcript-sync.ts
+var claudeTranscriptPath = (cwd, sessionId) => {
+  const projectId = resolve(cwd).replace(/[^a-zA-Z0-9-]/g, "-");
+  const configDir = process.env.CLAUDE_CONFIG_DIR || join2(homedir2(), ".claude");
+  return join2(configDir, "projects", projectId, `${sessionId}.jsonl`);
+};
+var createSyncState = () => ({
+  sessionKey: null,
+  wrappedKey: null,
+  providerWrappedKey: null,
+  providerKeyId: null,
+  seen: /* @__PURE__ */ new Set(),
+  keyUploaded: false,
+  keyRejected: false,
+  keyUnavailable: false
+});
+var syncTick = async (lines, state, uploader, sessionId, machineId) => {
+  if (state.keyRejected) return state;
+  let sessionKey = state.sessionKey;
+  let wrappedKey = state.wrappedKey;
+  let providerWrappedKey = state.providerWrappedKey;
+  let providerKeyId = state.providerKeyId;
+  if (!sessionKey) {
+    const recipients = await uploader.fetchTranscriptRecipients();
+    if (!recipients) return state;
+    sessionKey = generateSessionKey();
+    wrappedKey = wrapSessionKey(sessionKey, decodePublicKey(recipients.phonePublicKey));
+    if (recipients.provider) {
+      providerWrappedKey = wrapSessionKey(sessionKey, decodePublicKey(recipients.provider.publicKey));
+      providerKeyId = recipients.provider.keyId;
+    }
+  }
+  const built = buildTranscriptRecords(lines, sessionKey, state.seen);
+  if (built.records.length === 0) {
+    return { ...state, sessionKey, wrappedKey, providerWrappedKey, providerKeyId, seen: built.seen };
+  }
+  const seen = new Set(state.seen);
+  let keyUploaded = state.keyUploaded;
+  let keyRejected = false;
+  let keyUnavailable = false;
+  let rejected = 0;
+  for (const chunk of chunkRecords(built.records)) {
+    const result = await uploader.uploadRecords({
+      sessionId,
+      machineId,
+      dataEncryptionKey: keyUploaded ? void 0 : wrappedKey ?? void 0,
+      providerWrappedSessionKey: keyUploaded ? void 0 : providerWrappedKey ?? void 0,
+      providerKeyId: keyUploaded ? void 0 : providerKeyId ?? void 0,
+      records: chunk
+    });
+    keyUploaded = keyUploaded || result.keyRegistered;
+    if (result.keyConflict) {
+      keyRejected = true;
+      break;
+    }
+    if (result.keyUnavailable) {
+      keyUnavailable = true;
+      break;
+    }
+    if (!result.ok) break;
+    for (const id of result.settledIds ?? chunk.map((r) => r.localId)) seen.add(id);
+    rejected += result.rejectedIds.length;
+  }
+  if (rejected > 0) {
+    process.stderr.write(`[pushary] transcript: ${rejected} record${rejected === 1 ? "" : "s"} could not be stored and will not be retried.
+`);
+  }
+  return {
+    sessionKey,
+    wrappedKey,
+    providerWrappedKey,
+    providerKeyId,
+    seen,
+    keyUploaded,
+    keyRejected,
+    keyUnavailable
+  };
+};
+var MAX_RECORDS_PER_BATCH = 200;
+var MAX_BATCH_BYTES = 3e6;
+var chunkRecords = (records) => {
+  const chunks = [];
+  let current = [];
+  let bytes = 0;
+  for (const record of records) {
+    const size = record.content.length;
+    if (current.length > 0 && (current.length >= MAX_RECORDS_PER_BATCH || bytes + size > MAX_BATCH_BYTES)) {
+      chunks.push(current);
+      current = [];
+      bytes = 0;
+    }
+    current.push(record);
+    bytes += size;
+  }
+  if (current.length > 0) chunks.push(current);
+  return chunks;
+};
+var readLines = (path) => {
+  try {
+    return existsSync2(path) ? readFileSync2(path, "utf-8").split("\n") : [];
+  } catch {
+    return [];
+  }
+};
+var IDLE_CEILING_MS = 6e4;
+var nextInterval = (previousMs, idle, baseMs, maxMs) => idle ? Math.min(previousMs * 2, maxMs) : baseMs;
+var startTranscriptSync = (opts) => {
+  let warnedAboutRecipients = false;
+  const fetchPinnedRecipients = async () => {
+    const offer = await fetchTranscriptRecipients(opts.apiKey);
+    if (!offer) return null;
+    const verdict = verifyRecipients(offer, loadPin());
+    if (verdict.kind === "first-use" && !savePin(verdict.pin)) return null;
+    if (verdict.kind === "changed") {
+      if (!warnedAboutRecipients) {
+        warnedAboutRecipients = true;
+        process.stderr.write(`${changedRecipientsMessage(verdict, offer)}
+`);
+      }
+      return null;
+    }
+    return offer;
+  };
+  const uploader = {
+    fetchTranscriptRecipients: fetchPinnedRecipients,
+    uploadRecords: (params) => (opts.enabled ? opts.enabled() : transcriptsEnabled()) ? uploadTranscriptRecords(opts.apiKey, params) : Promise.resolve({ ok: false, keyRegistered: false, keyConflict: false, keyUnavailable: false, settledIds: null, rejectedIds: [] })
+  };
+  const path = opts.path ?? claudeTranscriptPath(opts.cwd, opts.sessionId);
+  const persisted = loadSessionKey(opts.sessionId);
+  let state = persisted ? { ...createSyncState(), ...persisted } : createSyncState();
+  sweepStaleSessionKeys();
+  let persistedUploaded = persisted?.keyUploaded ?? false;
+  let running = true;
+  let inFlight = false;
+  const tick = async () => {
+    if (!running || inFlight || !(opts.enabled ? opts.enabled() : transcriptsEnabled())) return;
+    inFlight = true;
+    try {
+      const before = state.sessionKey;
+      const ending = opts.ending?.() === true;
+      const modified = existsSync2(path) ? statSync2(path).mtimeMs : null;
+      const lines = normalizeTranscriptLines(readLines(path), opts.source ?? "claude");
+      state = await syncTick(lines, state, uploader, opts.sessionId, opts.machineId);
+      if (state.sessionKey && (before !== state.sessionKey || state.keyUploaded !== persistedUploaded)) {
+        persistedUploaded = state.keyUploaded;
+        saveSessionKey(opts.sessionId, {
+          sessionKey: state.sessionKey,
+          wrappedKey: state.wrappedKey,
+          providerWrappedKey: state.providerWrappedKey,
+          providerKeyId: state.providerKeyId,
+          keyUploaded: state.keyUploaded
+        });
+      }
+      if (ending && opts.ending?.() && existsSync2(path) && statSync2(path).mtimeMs === modified && state.keyUploaded && !state.keyRejected && buildTranscriptRecords(lines, state.sessionKey, state.seen).records.length === 0) opts.onDrained?.();
+    } catch {
+    } finally {
+      inFlight = false;
+    }
+  };
+  const baseIntervalMs = opts.intervalMs ?? 3e3;
+  const maxIntervalMs = Math.max(baseIntervalMs, IDLE_CEILING_MS);
+  let timer;
+  const schedule = (delayMs) => {
+    if (!running) return;
+    timer = setTimeout(() => {
+      void (async () => {
+        const before = state.sessionKey;
+        await tick();
+        const idle = state.sessionKey === null && before === null || state.keyUnavailable;
+        schedule(nextInterval(delayMs, idle, baseIntervalMs, maxIntervalMs));
+      })();
+    }, delayMs);
+    if (typeof timer.unref === "function") timer.unref();
+  };
+  void tick();
+  schedule(baseIntervalMs);
+  return () => {
+    running = false;
+    if (timer) clearTimeout(timer);
+  };
+};
+
+// src/transcript-registration.ts
+import { homedir as homedir3 } from "os";
+var directory = () => process.env.PUSHARY_TRANSCRIPT_REGISTRY_DIR || join3(pusharyDir(), "transcript-capture");
+var accountFor = (apiKey) => createHash("sha256").update(`${getBaseUrl()}\0${apiKey}`).digest("hex");
+var TTL = 48 * 60 * 60 * 1e3;
+var read = (path) => JSON.parse(readFileSync3(path, "utf8"));
+var consent = (record) => record.consentOverride ?? readTranscriptPreference() ?? false;
+var sameServer = (url) => url.replace(/\/+$/, "") === getBaseUrl().replace(/\/+$/, "");
+var fileFor2 = (apiKey, sessionId) => join3(directory(), `${createHash("sha256").update(accountFor(apiKey) + sessionId).digest("hex")}.json`);
+var permitted = (apiKey, raw) => raw.account === accountFor(apiKey) && consent(raw) && !raw.drained && (raw.source !== "claude" || !!raw.expectedSiteId || !macOwnsClaudeHooks(raw.cwd)) && (!raw.expectedSiteId || raw.expectedSiteId === raw.verifiedSiteId && !!raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl));
+var registeredTranscriptEnabled = (apiKey, sessionId) => {
+  try {
+    return permitted(apiKey, read(fileFor2(apiKey, sessionId)));
+  } catch {
+    return false;
+  }
+};
+var macOwnsClaudeHooks = (cwd) => [
+  join3(process.env.CLAUDE_CONFIG_DIR || join3(homedir3(), ".claude"), "settings.json"),
+  join3(cwd, ".claude", "settings.json"),
+  join3(cwd, ".claude", "settings.local.json")
+].some((path) => {
+  try {
+    return hookOwnerOf(JSON.parse(readFileSync3(path, "utf8"))) === "app";
+  } catch {
+    return false;
+  }
+});
+var transcriptRoots = (source) => {
+  const home = homedir3();
+  if (source === "codex") return [join3(codexHome(), "sessions")];
+  const configured = process.env.CLAUDE_CONFIG_DIR;
+  return [join3(configured || join3(home, ".claude"), "projects"), join3(home, ".claude", "projects")];
+};
+var withinTranscriptRoot = (candidate, source) => {
+  const target = resolve2(candidate);
+  return transcriptRoots(source).some((root) => target.startsWith(resolve2(root) + sep));
+};
+var captureRegistration = (source, value) => {
+  const input = value;
+  if (source !== "claude" && source !== "codex") return null;
+  if (input.agent_id || typeof input.session_id !== "string" || !/^[\w-]{1,128}$/.test(input.session_id)) return null;
+  if (typeof input.cwd !== "string" || !isAbsolute(input.cwd)) return null;
+  const path = input.transcript_path ?? input.agent_transcript_path ?? (source === "claude" ? claudeTranscriptPath(input.cwd, input.session_id) : null);
+  if (typeof path !== "string" || !isAbsolute(path) || !path.endsWith(".jsonl")) return null;
+  if (!withinTranscriptRoot(path, source)) return null;
+  return { sessionId: input.session_id, cwd: input.cwd, path, source };
+};
+var registerTranscript = (source, input, startDaemon = () => {
+  void ensureDaemonRunning({ waitTimeoutMs: 0 }).catch(() => {
+  });
+}, options = {}) => {
+  const registration = captureRegistration(source, input);
+  if (!registration) return;
+  try {
+    const account = accountFor(getApiKey());
+    const path = fileFor2(getApiKey(), registration.sessionId);
+    let previous;
+    try {
+      previous = read(path);
+    } catch {
+    }
+    if (source === "claude" && !options.siteId && !previous?.expectedSiteId && macOwnsClaudeHooks(registration.cwd)) return;
+    const ending = options.ended || input.hook_event_name === "SessionEnd" && process.env.PUSHARY_WRAPPER_ACTIVE !== "1";
+    const stored = {
+      ...registration,
+      account,
+      consentOverride: transcriptEnvironmentPreference(),
+      // A wrapper refresh must not erase the Mac's account binding.
+      expectedSiteId: options.siteId ?? previous?.expectedSiteId,
+      expectedBaseUrl: options.baseUrl ?? previous?.expectedBaseUrl,
+      verifiedSiteId: (!options.siteId || options.siteId === previous?.expectedSiteId) && (!options.baseUrl || options.baseUrl === previous?.expectedBaseUrl) ? previous?.verifiedSiteId : void 0,
+      ...ending ? { endedAt: Date.now() } : {}
+    };
+    if (previous && Date.now() - statSync3(path).mtimeMs < 6e4 && JSON.stringify(previous) === JSON.stringify(stored)) return;
+    writeJsonAtomic(path, stored, 384);
+    if (consent(stored)) startDaemon();
+  } catch {
+  }
+};
+var startRegisteredTranscripts = (apiKey, machineId, intervalMs = 3e3) => {
+  const active = /* @__PURE__ */ new Map();
+  let stopped = false;
+  let scanning = false;
+  let verifiedSiteId;
+  let nextVerification = 0;
+  const tick = async () => {
+    if (stopped || scanning) return;
+    scanning = true;
+    const wanted = /* @__PURE__ */ new Map();
+    try {
+      const files = readdirSync2(directory()).filter((name) => name.endsWith(".json")).flatMap((name) => {
+        const path = join3(directory(), name);
+        try {
+          const time = statSync3(path).mtimeMs;
+          if (Date.now() - time > TTL) {
+            unlinkSync(path);
+            return [];
+          }
+          return [{ path, time, raw: read(path) }];
+        } catch {
+          return [];
+        }
+      }).sort((a, b) => Number(!!a.raw.endedAt) - Number(!!b.raw.endedAt) || b.time - a.time);
+      for (const file of files) {
+        const raw = file.raw;
+        if (raw.account !== accountFor(apiKey) || !consent(raw) || raw.drained) continue;
+        if (raw.expectedSiteId && !verifiedSiteId && Date.now() >= nextVerification && raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl)) {
+          nextVerification = Date.now() + 3e4;
+          try {
+            const response = await fetch(`${getBaseUrl()}/api/agent/encryption-account`, {
+              headers: { Authorization: `Bearer ${apiKey}` },
+              signal: AbortSignal.timeout(5e3)
+            });
+            const proof = response.ok ? await response.json() : null;
+            if (typeof proof?.siteId === "string") verifiedSiteId = proof.siteId;
+          } catch {
+          }
+        }
+        if (raw.expectedSiteId && raw.expectedSiteId === verifiedSiteId && raw.expectedBaseUrl && sameServer(raw.expectedBaseUrl) && raw.verifiedSiteId !== verifiedSiteId) {
+          const latest = read(file.path);
+          if (JSON.stringify(latest) !== JSON.stringify(raw)) continue;
+          raw.verifiedSiteId = verifiedSiteId;
+          writeJsonAtomic(file.path, raw, 384);
+        }
+        if (!permitted(apiKey, raw)) continue;
+        if (wanted.size >= (raw.endedAt ? 33 : 32)) continue;
+        const registration = captureRegistration(raw.source, { session_id: raw.sessionId, cwd: raw.cwd, transcript_path: raw.path });
+        if (registration) wanted.set(registration.sessionId, { ...registration, registrationPath: file.path });
+      }
+      if (stopped) return;
+      for (const [id, reader] of active) {
+        if (wanted.get(id)?.path === reader.path) continue;
+        reader.stop();
+        active.delete(id);
+      }
+      for (const [id, registration] of wanted) {
+        if (active.has(id)) continue;
+        const current = () => read(registration.registrationPath);
+        active.set(id, { path: registration.path, stop: startTranscriptSync({
+          apiKey,
+          machineId,
+          ...registration,
+          intervalMs,
+          enabled: () => {
+            try {
+              return permitted(apiKey, current());
+            } catch {
+              return false;
+            }
+          },
+          ending: () => {
+            try {
+              return !!current().endedAt;
+            } catch {
+              return false;
+            }
+          },
+          onDrained: () => {
+            const raw = current();
+            if (raw.endedAt) writeJsonAtomic(registration.registrationPath, { ...raw, drained: true }, 384);
+          }
+        }) });
+      }
+    } catch {
+    } finally {
+      scanning = false;
+    }
+  };
+  void tick();
+  const timer = setInterval(() => void tick(), intervalMs);
+  timer.unref();
+  return () => {
+    stopped = true;
+    clearInterval(timer);
+    for (const reader of active.values()) reader.stop();
+    active.clear();
+  };
+};
+
+export {
+  loadSessionKey,
+  claudeTranscriptPath,
+  registeredTranscriptEnabled,
+  registerTranscript,
+  startRegisteredTranscripts
+};

package/dist/chunk-KGDWDSNL.js

@@ -0,0 +1,102 @@
+import {
+  registerTranscript
+} from "./chunk-JZTHGAPA.js";
+import {
+  writeDegraded
+} from "./chunk-CVQYGMSR.js";
+
+// src/tool-hook-input.ts
+var OPTIONAL_TEXT_FIELDS = ["hook_event_name", "session_id", "cwd", "transcript_path", "tool_use_id", "permission_mode"];
+function isInputRecord(value) {
+  return value !== null && typeof value === "object" && !Array.isArray(value);
+}
+function isToolHookInput(value) {
+  if (!isInputRecord(value)) return false;
+  if (typeof value.tool_name !== "string" || value.tool_name.length === 0) return false;
+  if (!isInputRecord(value.tool_input)) return false;
+  for (const field of OPTIONAL_TEXT_FIELDS) {
+    if (value[field] !== void 0 && typeof value[field] !== "string") return false;
+  }
+  return true;
+}
+function parseToolHookInput(value) {
+  if (!isInputRecord(value)) return null;
+  const input = { ...value, tool_input: value.tool_input === void 0 ? {} : value.tool_input };
+  return isToolHookInput(input) ? input : null;
+}
+
+// src/admission.ts
+import { readFileSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var NO_RULES = { version: 1, disabled: [] };
+var SUPPORTED_VERSION = 1;
+var parseAdmissionRules = (raw) => {
+  if (!raw) return NO_RULES;
+  try {
+    const parsed = JSON.parse(raw);
+    if (parsed.version !== SUPPORTED_VERSION) return NO_RULES;
+    if (!Array.isArray(parsed.disabled)) return NO_RULES;
+    return {
+      version: SUPPORTED_VERSION,
+      disabled: parsed.disabled.filter((rule) => typeof rule === "string")
+    };
+  } catch {
+    return NO_RULES;
+  }
+};
+var admissionRulesFile = () => process.env.PUSHARY_ADMISSION_FILE?.trim() || join(homedir(), ".pushary", "admission-rules.json");
+var readAdmissionRules = () => {
+  try {
+    return parseAdmissionRules(readFileSync(admissionRulesFile(), "utf-8"));
+  } catch {
+    return NO_RULES;
+  }
+};
+var matches = (rule, source, event) => {
+  const colon = rule.indexOf(":");
+  if (colon <= 0 || colon === rule.length - 1) return false;
+  const ruleSource = rule.slice(0, colon);
+  const ruleEvent = rule.slice(colon + 1);
+  return (ruleSource === "*" || ruleSource === source) && (ruleEvent === "*" || ruleEvent === event);
+};
+var isAdmitted = (rules, source, event) => !rules.disabled.some((rule) => matches(rule, source, event));
+var readHookInput = async (source, fallbackEvent = "", stdin = process.stdin, parseInput) => {
+  if (source === null) {
+    writeDegraded("hook", {
+      reason: "unknown_agent",
+      fallback: "stood aside, so nothing is gated or reported for this call",
+      event: fallbackEvent
+    });
+    return null;
+  }
+  let raw = "";
+  for await (const chunk of stdin) raw += chunk;
+  if (!raw.trim()) return null;
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (!parsed || typeof parsed !== "object" || Array.isArray(parsed)) return null;
+  const input = parseInput ? parseInput(parsed) : parsed;
+  if (input === null) return null;
+  const event = eventNameOf(input) ?? fallbackEvent;
+  if (!isAdmitted(readAdmissionRules(), source, event)) return null;
+  if (stdin === process.stdin) registerTranscript(source, input);
+  return input;
+};
+var eventNameOf = (input) => {
+  if (!("hook_event_name" in input)) return void 0;
+  const name = input.hook_event_name;
+  return typeof name === "string" && name.length > 0 ? name : void 0;
+};
+function readToolHookInput(source, event, stdin = process.stdin) {
+  return readHookInput(source, event, stdin, parseToolHookInput);
+}
+
+export {
+  readHookInput,
+  readToolHookInput
+};