safeword 0.78.2 → 0.78.4

package/dist/{chunk-SME5SU3O.js → chunk-DBXX5K74.js}

@@ -1,13 +1,15 @@
 import {
-  SAFEWORD_SCHEMA,
+  writeDurableFile
+} from "./chunk-QOLHGAD5.js";
+import {
+  SAFEWORD_SCHEMA
+} from "./chunk-IPTM5VE7.js";
+import {
   parse
-} from "./chunk-BSOUMHMQ.js";
+} from "./chunk-JSR3HXFT.js";
 import {
   CODEX_MIGRATION_SCHEMA
 } from "./chunk-AVAUUIDB.js";
-import {
-  writeDurableFile
-} from "./chunk-QOLHGAD5.js";
 
 // src/codex-plugin/legacy-authority.ts
 import { accessSync, constants, lstatSync, readFileSync } from "fs";
@@ -120,10 +122,13 @@ import {
   constants as fsConstants,
   existsSync,
   fstatSync,
+  lstatSync as lstatSync2,
   openSync,
+  readdirSync,
   readFileSync as readFileSync2,
   readSync,
   realpathSync,
+  rmdirSync,
   rmSync
 } from "fs";
 import { homedir } from "os";
@@ -210,15 +215,17 @@ function observeCodexHostProcesses() {
   if (result.status !== 0) return { available: false, running: [], current: null };
   return codexHostsFromProcessTable(result.stdout, process.ppid);
 }
-function observeRunningCodexHosts() {
-  const observation = observeCodexHostProcesses();
-  return observation.available ? observation.running : null;
-}
 function sameCodexHost(left, right) {
   return left.pid === right.pid && left.started_at === right.started_at;
 }
 
 // src/codex-plugin/profile-proof.ts
+var SHA256_PATTERN = /^[a-f\d]{64}$/u;
+var NUMERIC_VERSION_PART_PATTERN = /^\d+$/u;
+var VERSION_IDENTIFIER_PATTERN = /^[\dA-Za-z-]+$/u;
+var MAX_PLUGIN_VERSION_LENGTH = 128;
+var MAX_RETAINED_SESSION_PROOFS_PER_PROJECT = 256;
+var MAX_RETAINED_SESSION_PROOF_PROJECTS = 64;
 var CODEX_PLUGIN_HOOK_EVENTS = [
   "session-start",
   "pre-tool-use",
@@ -227,7 +234,8 @@ var CODEX_PLUGIN_HOOK_EVENTS = [
   "stop"
 ];
 function codexProfileDirectory(environment = process.env) {
-  return environment.CODEX_HOME ?? nodePath2.join(homedir(), ".codex");
+  const configuredHome = environment.CODEX_HOME?.trim();
+  return configuredHome || nodePath2.join(homedir(), ".codex");
 }
 function codexProofPath(environment = process.env, event = "session-start") {
   return nodePath2.join(
@@ -267,7 +275,13 @@ function legacyCodexRestartMarkerPath(environment = process.env) {
   return nodePath2.join(codexProfileDirectory(environment), "safeword/restart-pending-v1.json");
 }
 function codexActivationIsPending(environment = process.env) {
-  const identity = currentCodexPluginIdentity();
+  try {
+    return activationIsPendingForIdentity(environment, currentCodexPluginIdentity());
+  } catch {
+    return true;
+  }
+}
+function activationIsPendingForIdentity(environment, identity) {
   return (
     // The canonical marker is written atomically. If it exists but cannot be
     // parsed or matched, fail closed instead of accepting unbound hook proof.
@@ -276,6 +290,23 @@ function codexActivationIsPending(environment = process.env) {
     )
   );
 }
+function codexActivationMarkerIssue(environment = process.env) {
+  const markerPath = codexActivationMarkerPath(environment);
+  if (!existsSync(markerPath)) return void 0;
+  let identity;
+  try {
+    identity = currentCodexPluginIdentity();
+  } catch {
+    return "package-unavailable";
+  }
+  try {
+    const marker = readTrustedHookProofJson(markerPath);
+    if (!isActivationMarkerV2(marker)) return "malformed";
+    return matchesCodexPluginIdentity(marker, identity) ? void 0 : "identity-mismatch";
+  } catch {
+    return "malformed";
+  }
+}
 function packagedHookManifestPath() {
   const candidates = [
     nodePath2.resolve(import.meta.dirname, "../codex-plugin/hooks.json"),
@@ -287,19 +318,25 @@ function packagedHookManifestPath() {
   }
   return manifest;
 }
-function currentCodexPluginIdentity() {
-  const manifest = readFileSync2(packagedHookManifestPath());
-  return {
-    plugin_version: SAFEWORD_SCHEMA.version,
-    manifest_sha256: createHash("sha256").update(manifest).digest("hex")
+var currentCodexPluginIdentity = /* @__PURE__ */ (() => {
+  let cachedIdentity;
+  return () => {
+    cachedIdentity ??= (() => {
+      const manifest = readFileSync2(packagedHookManifestPath());
+      return {
+        plugin_version: SAFEWORD_SCHEMA.version,
+        manifest_sha256: createHash("sha256").update(manifest).digest("hex")
+      };
+    })();
+    return cachedIdentity;
   };
-}
+})();
 function matchesCodexPluginIdentity(value, identity) {
   return value.plugin_version === identity.plugin_version && value.manifest_sha256 === identity.manifest_sha256;
 }
 function writeCodexActivationMarker(environment = process.env, now = /* @__PURE__ */ new Date(), options = {}) {
   const path = codexActivationMarkerPath(environment);
-  const activeHosts = options.activeHosts === void 0 ? observeRunningCodexHosts() : options.activeHosts;
+  const activeHosts = activeHostsForMarker(options);
   const marker = {
     schema_version: 2,
     ...currentCodexPluginIdentity(),
@@ -315,15 +352,24 @@ function writeCodexActivationMarker(environment = process.env, now = /* @__PURE_
     recursive: true,
     force: true
   });
-  rmSync(nodePath2.join(codexProfileDirectory(environment), "safeword/session-proof-v1"), {
-    recursive: true,
-    force: true
-  });
   rmSync(codexActivationReceiptPath(environment), { force: true });
   rmSync(legacyCodexActivationMarkerPath(environment), { force: true });
   rmSync(legacyCodexRestartMarkerPath(environment), { force: true });
   return marker;
 }
+function activeHostsForMarker(options) {
+  if (options.activeHosts !== void 0) {
+    return options.activeHosts === null || options.activeHosts.length === 0 ? null : options.activeHosts;
+  }
+  const observation = options.hostObservation ?? observeCodexHostProcesses();
+  if (!observation.available) return null;
+  const activeHosts = [...observation.running];
+  const currentHost = observation.current;
+  if (currentHost !== null && activeHosts.every((host) => !sameCodexHost(host, currentHost))) {
+    activeHosts.push(currentHost);
+  }
+  return activeHosts.length === 0 ? null : activeHosts;
+}
 function hostObservationForOverride(current = null) {
   return {
     available: true,
@@ -333,7 +379,7 @@ function hostObservationForOverride(current = null) {
 }
 function activationReceiptForRestart(marker, hostObservation, identity, now) {
   const currentHost = hostObservation.current;
-  if (!hostObservation.available || currentHost === null || marker.host_observation !== "observed" || now.getTime() < Date.parse(marker.installed_at) || marker.active_hosts.some(
+  if (!hostObservation.available || currentHost === null || marker.host_observation !== "observed" || marker.active_hosts.length === 0 || now.getTime() < Date.parse(marker.installed_at) || marker.active_hosts.some((installedHost) => sameCodexHost(installedHost, currentHost)) || marker.active_hosts.some(
     (installedHost) => hostObservation.running.some((runningHost) => sameCodexHost(installedHost, runningHost))
   )) {
     return null;
@@ -361,36 +407,174 @@ function recordCodexHookProof(event, environment = process.env, now = /* @__PURE
   }
   const projectDirectory = writeOptions.projectDirectory === void 0 ? void 0 : canonicalProjectDirectory(writeOptions.projectDirectory);
   const sessionId = writeOptions.sessionId?.trim();
-  const proof = {
-    schema_version: projectDirectory !== void 0 && sessionId ? 3 : 2,
+  const activationId = activeCodexActivationId(marker, receipt);
+  const recordedAt = now.toISOString();
+  const proof = projectDirectory !== void 0 && sessionId ? {
+    schema_version: 3,
     event,
     ...identity,
-    activation_id: receipt?.activation_id ?? marker?.activation_id ?? null,
-    ...projectDirectory !== void 0 && sessionId && { project_directory: projectDirectory, session_id: sessionId },
-    recorded_at: now.toISOString()
+    activation_id: activationId,
+    project_directory: projectDirectory,
+    session_id: sessionId,
+    recorded_at: recordedAt
+  } : {
+    schema_version: 2,
+    event,
+    ...identity,
+    activation_id: activationId,
+    recorded_at: recordedAt
   };
   writeAtomicJson(codexProofPath(environment, event), proof, writeOptions);
   if (event === "session-start" && projectDirectory !== void 0 && sessionId) {
     const sessionProof = {
-      schema_version: 1,
+      schema_version: 2,
       ...identity,
+      activation_id: activationId,
       project_directory: projectDirectory,
       session_id: sessionId,
-      recorded_at: now.toISOString()
+      recorded_at: recordedAt
     };
-    writeAtomicJson(codexSessionProofPath(projectDirectory, sessionId, environment), sessionProof);
+    const path = codexSessionProofPath(projectDirectory, sessionId, environment);
+    writeAtomicJson(path, sessionProof);
+    pruneCodexSessionProofs(path);
   }
   return proof;
 }
-function codexSessionProofIsCurrent(projectDirectory, sessionId, environment = process.env) {
+function validSessionProof(value, canonicalProject, sessionId) {
+  if (typeof value !== "object" || value === null) return false;
+  const proof = value;
+  return sessionProofBindingMatches(proof, canonicalProject, sessionId) && sessionProofIdentityIsWellFormed(proof) && sessionProofTimeIsWellFormed(proof);
+}
+function sessionProofBindingMatches(proof, canonicalProject, sessionId) {
+  return (proof.schema_version === 1 || proof.schema_version === 2) && proof.project_directory === canonicalProject && proof.session_id === sessionId && (proof.schema_version === 1 || typeof proof.activation_id === "string" || proof.activation_id === null);
+}
+function sessionProofIdentityIsWellFormed(proof) {
+  return pluginVersionIsWellFormed(proof.plugin_version) && typeof proof.manifest_sha256 === "string" && SHA256_PATTERN.test(proof.manifest_sha256);
+}
+function numericVersionPartIsWellFormed(part) {
+  return part.length > 0 && NUMERIC_VERSION_PART_PATTERN.test(part) && (part === "0" || !part.startsWith("0"));
+}
+function versionIdentifiersAreWellFormed(value) {
+  return value === void 0 || value.split(".").every(
+    (identifier) => identifier.length > 0 ? VERSION_IDENTIFIER_PATTERN.test(identifier) : false
+  );
+}
+function pluginVersionIsWellFormed(value) {
+  if (typeof value !== "string" || value.length > MAX_PLUGIN_VERSION_LENGTH) return false;
+  const buildSplit = value.split("+");
+  if (buildSplit.length > 2) return false;
+  const coreAndPrerelease = buildSplit[0] ?? "";
+  const prereleaseSeparator = coreAndPrerelease.indexOf("-");
+  const coreText = prereleaseSeparator === -1 ? coreAndPrerelease : coreAndPrerelease.slice(0, prereleaseSeparator);
+  const prerelease = prereleaseSeparator === -1 ? void 0 : coreAndPrerelease.slice(prereleaseSeparator + 1);
+  const core = coreText.split(".");
+  return core.length === 3 && core.every((part) => numericVersionPartIsWellFormed(part)) && versionIdentifiersAreWellFormed(prerelease) && versionIdentifiersAreWellFormed(buildSplit[1]);
+}
+function sessionProofTimeIsWellFormed(proof) {
+  return typeof proof.recorded_at === "string" && !Number.isNaN(Date.parse(proof.recorded_at));
+}
+function classifySessionProof(proof, identity, marker, receipt, activationPending) {
+  if (proof.schema_version === 1) return "prior-observed";
+  if (!matchesCodexPluginIdentity(proof, identity)) return "prior-observed";
+  if (marker !== null && Date.parse(proof.recorded_at) < Date.parse(marker.installed_at)) {
+    return "prior-observed";
+  }
+  if (activationPending) return "activation-pending";
+  if (receipt === null) return proof.activation_id === null ? "current" : "prior-observed";
+  return proof.activation_id === receipt.activation_id && Date.parse(proof.recorded_at) >= Date.parse(receipt.activated_at) ? "current" : "prior-observed";
+}
+function observeCodexSessionProof(projectDirectory, sessionId, environment = process.env) {
   const canonicalProject = canonicalProjectDirectory(projectDirectory);
+  const path = codexSessionProofPath(canonicalProject, sessionId, environment);
+  if (!existsSync(path)) {
+    return {
+      status: "missing",
+      plugin_version: null,
+      manifest_sha256: null,
+      recorded_at: null
+    };
+  }
   try {
-    const value = JSON.parse(
-      readFileSync2(codexSessionProofPath(canonicalProject, sessionId, environment), "utf8")
+    const value = readTrustedHookProofJson(path);
+    if (!validSessionProof(value, canonicalProject, sessionId)) throw new Error("Invalid proof.");
+    const identity = currentCodexPluginIdentity();
+    const marker = readActivationMarkerV2(environment, identity);
+    const receipt = readActivationReceipt(environment, identity);
+    const status = classifySessionProof(
+      value,
+      identity,
+      marker,
+      receipt,
+      activationIsPendingForIdentity(environment, identity)
     );
-    return value.schema_version === 1 && value.project_directory === canonicalProject && value.session_id === sessionId && typeof value.recorded_at === "string" && !Number.isNaN(Date.parse(value.recorded_at)) && matchesCodexPluginIdentity(value, currentCodexPluginIdentity());
+    return {
+      status,
+      plugin_version: value.plugin_version,
+      manifest_sha256: value.manifest_sha256,
+      recorded_at: value.recorded_at
+    };
   } catch {
-    return false;
+    return {
+      status: "untrusted",
+      plugin_version: null,
+      manifest_sha256: null,
+      recorded_at: null
+    };
+  }
+}
+function sessionProofProjectDirectories(root) {
+  try {
+    return readdirSync(root, { withFileTypes: true }).filter((entry) => entry.isDirectory() && !entry.isSymbolicLink()).flatMap((projectEntry) => {
+      const path = nodePath2.join(root, projectEntry.name);
+      try {
+        if (sessionProofProjectFiles(path).length === 0) return [];
+        return [{ modifiedAt: lstatSync2(path).mtimeMs, path }];
+      } catch {
+        return [];
+      }
+    });
+  } catch {
+    return [];
+  }
+}
+function sessionProofProjectFiles(projectPath) {
+  try {
+    return readdirSync(projectPath, { withFileTypes: true }).flatMap((entry) => {
+      if (!entry.isFile() || entry.isSymbolicLink() || entry.name.startsWith(".") || !entry.name.endsWith(".json"))
+        return [];
+      const path = nodePath2.join(projectPath, entry.name);
+      try {
+        return [{ modifiedAt: lstatSync2(path).mtimeMs, path }];
+      } catch {
+        return [];
+      }
+    });
+  } catch {
+    return [];
+  }
+}
+function pruneCodexSessionProofs(retainedPath) {
+  const retainedProjectPath = nodePath2.dirname(retainedPath);
+  const files = sessionProofProjectFiles(retainedProjectPath).toSorted((left, right) => {
+    if (left.path === retainedPath) return -1;
+    if (right.path === retainedPath) return 1;
+    return right.modifiedAt - left.modifiedAt || left.path.localeCompare(right.path);
+  });
+  for (const stale of files.slice(MAX_RETAINED_SESSION_PROOFS_PER_PROJECT)) {
+    rmSync(stale.path, { force: true });
+  }
+  const root = nodePath2.dirname(retainedProjectPath);
+  const projects = sessionProofProjectDirectories(root).toSorted((left, right) => {
+    if (left.path === retainedProjectPath) return -1;
+    if (right.path === retainedProjectPath) return 1;
+    return right.modifiedAt - left.modifiedAt || left.path.localeCompare(right.path);
+  });
+  for (const stale of projects.slice(MAX_RETAINED_SESSION_PROOF_PROJECTS)) {
+    for (const proof of sessionProofProjectFiles(stale.path)) rmSync(proof.path, { force: true });
+    try {
+      rmdirSync(stale.path);
+    } catch {
+    }
   }
 }
 function writeAtomicJson(path, value, options = {}) {
@@ -423,10 +607,13 @@ function readActivationReceipt(environment, identity) {
     isActivationReceiptV1
   );
 }
+function activeCodexActivationId(marker, receipt) {
+  return receipt?.activation_id ?? marker?.activation_id ?? null;
+}
 function readIdentityBoundJson(path, identity, validator) {
   if (!existsSync(path)) return null;
   try {
-    const value = JSON.parse(readFileSync2(path, "utf8"));
+    const value = readTrustedHookProofJson(path);
     return validator(value) && matchesCodexPluginIdentity(value, identity) ? value : null;
   } catch {
     return null;
@@ -442,8 +629,8 @@ function readEventProof(path, expectedEvent) {
 }
 var MAX_CODEX_HOOK_PROOF_BYTES = 64 * 1024;
 function assertTrustedHookProofMetadata(metadata) {
-  const ownerMatches = process.getuid === void 0 || metadata.uid === process.getuid();
-  if (!metadata.isFile() || metadata.nlink !== 1 || !ownerMatches || (metadata.mode & 63) !== 0 || metadata.size > MAX_CODEX_HOOK_PROOF_BYTES) {
+  const posixPermissionsAreTrusted = process.getuid === void 0 || metadata.uid === process.getuid() && (metadata.mode & 63) === 0;
+  if (!metadata.isFile() || metadata.nlink !== 1 || !posixPermissionsAreTrusted || metadata.size > MAX_CODEX_HOOK_PROOF_BYTES) {
     throw new Error("Untrusted Codex hook proof file.");
   }
 }
@@ -496,15 +683,25 @@ function observeCodexHookProof(environment = process.env, binding) {
   const parsed = existing.map((item) => readEventProof(item.path, item.event));
   if (parsed.includes(null)) return malformedObservation();
   const validProofs = parsed.filter((proof) => proof !== null);
-  const identity = currentCodexPluginIdentity();
-  const activationId = readActivationMarkerV2(environment, identity)?.activation_id ?? readActivationReceipt(environment, identity)?.activation_id ?? null;
+  let identity;
+  try {
+    identity = currentCodexPluginIdentity();
+  } catch {
+    return malformedObservation();
+  }
+  const marker = readActivationMarkerV2(environment, identity);
+  const receipt = readActivationReceipt(environment, identity);
+  const activationId = activeCodexActivationId(marker, receipt);
+  if (activationIsPendingForIdentity(environment, identity)) {
+    return staleHookObservation(validProofs, activationId);
+  }
   const canonicalProject = binding === void 0 ? void 0 : canonicalProjectDirectory(binding.projectDirectory);
   const current = validProofs.filter(
-    (proof) => matchesCodexPluginIdentity(proof, identity) && (activationId === null || proof.schema_version !== 1 && proof.activation_id === activationId) && (binding === void 0 || proof.schema_version === 3 && proof.project_directory === canonicalProject && proof.session_id === binding.sessionId)
+    (proof) => matchesCodexPluginIdentity(proof, identity) && (activationId === null ? proof.activation_id === null : proof.activation_id === activationId) && (receipt === null || Date.parse(proof.recorded_at) >= Date.parse(receipt.activated_at)) && (binding === void 0 || proof.schema_version === 3 && proof.project_directory === canonicalProject && proof.session_id === binding.sessionId)
   );
   const events = current.map((proof) => proof.event);
   const missingEvents = CODEX_PLUGIN_HOOK_EVENTS.filter((event) => !events.includes(event));
-  const latest = current.toSorted((left, right) => right.recorded_at.localeCompare(left.recorded_at)).at(0);
+  const latest = current.toSorted((left, right) => Date.parse(right.recorded_at) - Date.parse(left.recorded_at)).at(0);
   let status = "stale";
   if (current.length === CODEX_PLUGIN_HOOK_EVENTS.length) status = "current";
   else if (current.length > 0) status = "partial";
@@ -518,6 +715,17 @@ function observeCodexHookProof(environment = process.env, binding) {
     missing_events: missingEvents
   };
 }
+function staleHookObservation(proofs, activationId) {
+  return {
+    status: "stale",
+    plugin_version: proofs[0]?.plugin_version ?? null,
+    manifest_sha256: proofs[0]?.manifest_sha256 ?? null,
+    recorded_at: null,
+    activation_id: activationId,
+    events: [],
+    missing_events: CODEX_PLUGIN_HOOK_EVENTS
+  };
+}
 function malformedObservation() {
   return {
     status: "malformed",
@@ -532,17 +740,17 @@ function malformedObservation() {
 function isCodexHookProof(value) {
   if (typeof value !== "object" || value === null) return false;
   const proof = value;
-  return [1, 2, 3].includes(proof.schema_version) && isCodexPluginHookEvent(proof.event) && typeof proof.plugin_version === "string" && typeof proof.manifest_sha256 === "string" && /^[\da-f]{64}$/u.test(proof.manifest_sha256) && (proof.schema_version === 1 || "activation_id" in proof && (typeof proof.activation_id === "string" || proof.activation_id === null)) && (proof.schema_version !== 3 || typeof proof.project_directory === "string" && typeof proof.session_id === "string" && proof.session_id.trim() !== "") && typeof proof.recorded_at === "string" && !Number.isNaN(Date.parse(proof.recorded_at));
+  return (proof.schema_version === 2 || proof.schema_version === 3) && isCodexPluginHookEvent(proof.event) && pluginVersionIsWellFormed(proof.plugin_version) && typeof proof.manifest_sha256 === "string" && SHA256_PATTERN.test(proof.manifest_sha256) && "activation_id" in proof && (typeof proof.activation_id === "string" || proof.activation_id === null) && (proof.schema_version !== 3 || typeof proof.project_directory === "string" && typeof proof.session_id === "string" && proof.session_id.trim() !== "") && typeof proof.recorded_at === "string" && !Number.isNaN(Date.parse(proof.recorded_at));
 }
 function isActivationMarkerV2(value) {
   if (typeof value !== "object" || value === null) return false;
   const marker = value;
-  return marker.schema_version === 2 && typeof marker.plugin_version === "string" && typeof marker.manifest_sha256 === "string" && /^[\da-f]{64}$/u.test(marker.manifest_sha256) && typeof marker.activation_id === "string" && typeof marker.installed_at === "string" && !Number.isNaN(Date.parse(marker.installed_at)) && (marker.host_observation === "observed" || marker.host_observation === "unavailable") && Array.isArray(marker.active_hosts) && marker.active_hosts.every(isCodexHostProcessIdentity);
+  return marker.schema_version === 2 && pluginVersionIsWellFormed(marker.plugin_version) && typeof marker.manifest_sha256 === "string" && SHA256_PATTERN.test(marker.manifest_sha256) && typeof marker.activation_id === "string" && typeof marker.installed_at === "string" && !Number.isNaN(Date.parse(marker.installed_at)) && (marker.host_observation === "observed" || marker.host_observation === "unavailable") && Array.isArray(marker.active_hosts) && marker.active_hosts.every(isCodexHostProcessIdentity) && (marker.host_observation === "observed" ? marker.active_hosts.length > 0 : marker.active_hosts.length === 0);
 }
 function isActivationReceiptV1(value) {
   if (typeof value !== "object" || value === null) return false;
   const receipt = value;
-  return receipt.schema_version === 1 && typeof receipt.plugin_version === "string" && typeof receipt.manifest_sha256 === "string" && /^[\da-f]{64}$/u.test(receipt.manifest_sha256) && typeof receipt.activation_id === "string" && typeof receipt.activated_at === "string" && !Number.isNaN(Date.parse(receipt.activated_at)) && isCodexHostProcessIdentity(receipt.host);
+  return receipt.schema_version === 1 && pluginVersionIsWellFormed(receipt.plugin_version) && typeof receipt.manifest_sha256 === "string" && SHA256_PATTERN.test(receipt.manifest_sha256) && typeof receipt.activation_id === "string" && typeof receipt.activated_at === "string" && !Number.isNaN(Date.parse(receipt.activated_at)) && isCodexHostProcessIdentity(receipt.host);
 }
 function isCodexHostProcessIdentity(value) {
   if (typeof value !== "object" || value === null) return false;
@@ -556,10 +764,12 @@ function isCodexPluginHookEvent(value) {
 export {
   legacyCommandIdentity,
   legacyCodexEventIsViable,
+  CODEX_PLUGIN_HOOK_EVENTS,
   codexActivationIsPending,
+  codexActivationMarkerIssue,
   writeCodexActivationMarker,
   recordCodexHookProof,
-  codexSessionProofIsCurrent,
+  observeCodexSessionProof,
   observeCodexHookProof
 };
-//# sourceMappingURL=chunk-SME5SU3O.js.map
+//# sourceMappingURL=chunk-DBXX5K74.js.map

package/dist/chunk-DBXX5K74.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/codex-plugin/legacy-authority.ts","../src/codex-plugin/legacy-command.ts","../src/codex-plugin/profile-proof.ts","../src/codex-plugin/host-process.ts"],"sourcesContent":["import { accessSync, constants, lstatSync, readFileSync } from 'node:fs';\nimport nodePath from 'node:path';\n\nimport { parse } from 'smol-toml';\n\nimport { SAFEWORD_SCHEMA } from '../schema.js';\nimport { CODEX_MIGRATION_SCHEMA } from './inventory.js';\nimport { legacyCommandIdentity } from './legacy-command.js';\n\ntype LegacyHook = { command?: unknown; type?: unknown };\ntype LegacyHookGroup = { hooks?: unknown };\ntype LegacyConfig = { hooks?: unknown };\n\nfunction regularFile(path: string): boolean {\n  try {\n    return lstatSync(path).isFile();\n  } catch {\n    return false;\n  }\n}\n\nfunction eventCommands(config: LegacyConfig, eventName: string): string[] {\n  if (typeof config.hooks !== 'object' || config.hooks === null) return [];\n  const groups = (config.hooks as Record<string, unknown>)[eventName];\n  if (!Array.isArray(groups)) return [];\n\n  return groups.flatMap(group => {\n    const hooks = (group as LegacyHookGroup).hooks;\n    if (!Array.isArray(hooks)) return [];\n    return hooks.flatMap(hook => {\n      const candidate = hook as LegacyHook;\n      return candidate.type === 'command' && typeof candidate.command === 'string'\n        ? [candidate.command]\n        : [];\n    });\n  });\n}\n\nfunction packageRunnerIsAvailable(cwd: string, environment: NodeJS.ProcessEnv): boolean {\n  const runner = SAFEWORD_SCHEMA.codexMigration.packageRunner;\n  const pathEntries = (environment.PATH ?? '').split(nodePath.delimiter).filter(Boolean);\n  const extensions =\n    process.platform === 'win32' ? (environment.PATHEXT ?? '.COM;.EXE;.BAT;.CMD').split(';') : [''];\n  return pathEntries.some(entry =>\n    extensions.some(extension => {\n      const candidate = nodePath.resolve(cwd, entry, `${runner}${extension.toLowerCase()}`);\n      try {\n        accessSync(candidate, process.platform === 'win32' ? constants.F_OK : constants.X_OK);\n        return regularFile(candidate);\n      } catch {\n        return false;\n      }\n    }),\n  );\n}\n\nfunction commandIsViable(\n  command: string,\n  event: string,\n  cwd: string,\n  environment: NodeJS.ProcessEnv,\n): boolean {\n  const identity = legacyCommandIdentity(command);\n  if (identity?.event !== event) return false;\n  if (identity.kind === 'package') {\n    return (\n      regularFile(nodePath.join(cwd, SAFEWORD_SCHEMA.codexMigration.projectMarker)) &&\n      packageRunnerIsAvailable(cwd, environment)\n    );\n  }\n  return (\n    identity.kind === 'script' &&\n    regularFile(nodePath.join(cwd, CODEX_MIGRATION_SCHEMA.paths.hookRuntimeRoot, identity.script))\n  );\n}\n\nexport function legacyCodexEventIsViable(\n  cwd: string,\n  event: string,\n  environment: NodeJS.ProcessEnv = process.env,\n): boolean {\n  const eventName = SAFEWORD_SCHEMA.codexMigration.hookEventNames[event];\n  if (eventName === undefined) return false;\n\n  const configPath = nodePath.join(cwd, CODEX_MIGRATION_SCHEMA.paths.config);\n  if (!regularFile(configPath)) return false;\n\n  let config: LegacyConfig;\n  try {\n    config = parse(readFileSync(configPath, 'utf8'));\n  } catch {\n    return false;\n  }\n\n  return eventCommands(config, eventName).some(command =>\n    commandIsViable(command, event, cwd, environment),\n  );\n}\n","import { CODEX_MIGRATION_SCHEMA } from './inventory.js';\n\nexport type LegacyCommandIdentity =\n  | {\n      readonly kind: 'package';\n      readonly event: string;\n    }\n  | {\n      readonly kind: 'script';\n      readonly event: string;\n      readonly script: string;\n    };\n\nfunction commandParts(command: string): string[] {\n  return command\n    .trim()\n    .split(' ')\n    .filter(part => part !== '');\n}\n\nfunction isHistoricalPackagePrefix(parts: readonly string[]): boolean {\n  return (\n    parts[0] === CODEX_MIGRATION_SCHEMA.packageRunner &&\n    parts[1] === '--yes' &&\n    parts[2] === 'safeword'\n  );\n}\n\nfunction packagedHookEvent(hook: readonly string[]): string | undefined {\n  if (\n    hook.length === 3 &&\n    hook[0] === 'hook' &&\n    hook[1] === 'codex' &&\n    CODEX_MIGRATION_SCHEMA.hookEvents.includes(hook[2] ?? '')\n  ) {\n    return hook[2];\n  }\n  if (\n    hook.length === 2 &&\n    hook[0] === 'codex-hook' &&\n    CODEX_MIGRATION_SCHEMA.hookEvents.includes(hook[1] ?? '')\n  ) {\n    return hook[1];\n  }\n  return undefined;\n}\n\nfunction packageIdentity(command: string): LegacyCommandIdentity | undefined {\n  const parts = commandParts(command);\n  if (!isHistoricalPackagePrefix(parts)) return undefined;\n  const event = packagedHookEvent(parts.slice(3));\n  return event === undefined ? undefined : { kind: 'package', event };\n}\n\nfunction scriptIdentity(command: string): LegacyCommandIdentity | undefined {\n  const prefix = CODEX_MIGRATION_SCHEMA.hookScriptPrefix;\n  if (!command.startsWith(prefix)) return undefined;\n  const remainder = command.slice(prefix.length);\n  const quote = remainder.indexOf('\"');\n  if (quote === -1) return undefined;\n  const script = remainder.slice(0, quote);\n  const event = CODEX_MIGRATION_SCHEMA.hookScriptEvents[script];\n  if (event === undefined) return undefined;\n  const arguments_ = remainder.slice(quote + 1);\n  const supportedArguments =\n    arguments_ === '' ||\n    (script === 'session-safeword-context.ts' && arguments_ === ' --agent=codex');\n  return supportedArguments ? { kind: 'script', event, script } : undefined;\n}\n\nexport function legacyCommandIdentity(command: string): LegacyCommandIdentity | undefined {\n  return packageIdentity(command) ?? scriptIdentity(command);\n}\n","/* eslint-disable unicorn/no-null -- versioned JSON uses explicit null for unavailable values */\n\nimport { createHash, randomUUID } from 'node:crypto';\nimport {\n  closeSync,\n  constants as fsConstants,\n  existsSync,\n  fstatSync,\n  lstatSync,\n  openSync,\n  readdirSync,\n  readFileSync,\n  readSync,\n  realpathSync,\n  rmdirSync,\n  rmSync,\n  type Stats,\n} from 'node:fs';\nimport { homedir } from 'node:os';\nimport nodePath from 'node:path';\n\nimport { SAFEWORD_SCHEMA } from '../schema.js';\nimport { writeDurableFile } from './durable-write.js';\nimport {\n  type CodexHostProcessIdentity,\n  type CodexHostProcessObservation,\n  observeCodexHostProcesses,\n  sameCodexHost,\n} from './host-process.js';\n\nexport type { CodexHostProcessIdentity } from './host-process.js';\n\nexport interface CodexPluginIdentity {\n  plugin_version: string;\n  manifest_sha256: string;\n}\n\nexport interface CodexHookProofV2 {\n  schema_version: 2;\n  event: CodexPluginHookEvent;\n  plugin_version: string;\n  manifest_sha256: string;\n  activation_id: string | null;\n  recorded_at: string;\n}\n\nexport interface CodexHookProofV3 extends CodexPluginIdentity {\n  schema_version: 3;\n  event: CodexPluginHookEvent;\n  activation_id: string | null;\n  project_directory: string;\n  session_id: string;\n  recorded_at: string;\n}\n\ninterface CodexSessionProofV1 extends CodexPluginIdentity {\n  schema_version: 1;\n  project_directory: string;\n  session_id: string;\n  recorded_at: string;\n}\n\ninterface CodexSessionProofV2 extends CodexPluginIdentity {\n  schema_version: 2;\n  activation_id: string | null;\n  project_directory: string;\n  session_id: string;\n  recorded_at: string;\n}\n\ntype CodexSessionProof = CodexSessionProofV1 | CodexSessionProofV2;\n\nexport type CodexSessionProofStatus =\n  'activation-pending' | 'current' | 'prior-observed' | 'missing' | 'untrusted';\n\nexport interface CodexSessionProofObservation {\n  status: CodexSessionProofStatus;\n  plugin_version: string | null;\n  manifest_sha256: string | null;\n  recorded_at: string | null;\n}\n\nconst SHA256_PATTERN = /^[a-f\\d]{64}$/u;\nconst NUMERIC_VERSION_PART_PATTERN = /^\\d+$/u;\nconst VERSION_IDENTIFIER_PATTERN = /^[\\dA-Za-z-]+$/u;\nconst MAX_PLUGIN_VERSION_LENGTH = 128;\nconst MAX_RETAINED_SESSION_PROOFS_PER_PROJECT = 256;\nconst MAX_RETAINED_SESSION_PROOF_PROJECTS = 64;\n\ninterface CodexActivationMarkerV1 {\n  schema_version: 1;\n  plugin_version: string;\n  manifest_sha256: string;\n}\n\nexport interface CodexActivationMarkerV2 {\n  schema_version: 2;\n  plugin_version: string;\n  manifest_sha256: string;\n  activation_id: string;\n  installed_at: string;\n  host_observation: 'observed' | 'unavailable';\n  active_hosts: CodexHostProcessIdentity[];\n}\n\ninterface CodexActivationReceiptV1 {\n  schema_version: 1;\n  plugin_version: string;\n  manifest_sha256: string;\n  activation_id: string;\n  activated_at: string;\n  host: CodexHostProcessIdentity;\n}\n\nexport const CODEX_PLUGIN_HOOK_EVENTS = [\n  'session-start',\n  'pre-tool-use',\n  'post-tool-use',\n  'user-prompt-submit',\n  'stop',\n] as const;\nexport type CodexPluginHookEvent = (typeof CODEX_PLUGIN_HOOK_EVENTS)[number];\n\ntype CodexHookProofStatus = 'current' | 'partial' | 'missing' | 'stale' | 'malformed';\n\nexport interface CodexHookProofObservation {\n  status: CodexHookProofStatus;\n  plugin_version: string | null;\n  manifest_sha256: string | null;\n  recorded_at: string | null;\n  activation_id: string | null;\n  events: readonly CodexPluginHookEvent[];\n  missing_events: readonly CodexPluginHookEvent[];\n}\n\nfunction codexProfileDirectory(environment: NodeJS.ProcessEnv = process.env): string {\n  const configuredHome = environment.CODEX_HOME?.trim();\n  return configuredHome || nodePath.join(homedir(), '.codex');\n}\n\nexport function codexProofPath(\n  environment: NodeJS.ProcessEnv = process.env,\n  event: CodexPluginHookEvent = 'session-start',\n): string {\n  return nodePath.join(\n    codexProfileDirectory(environment),\n    'safeword/hook-proof-v2',\n    `${event}.json`,\n  );\n}\n\nfunction canonicalProjectDirectory(projectDirectory: string): string {\n  try {\n    return realpathSync(projectDirectory);\n  } catch {\n    return nodePath.resolve(projectDirectory);\n  }\n}\n\nfunction codexSessionProofPath(\n  projectDirectory: string,\n  sessionId: string,\n  environment: NodeJS.ProcessEnv,\n): string {\n  // The directory suffix versions the storage layout, independently from the\n  // schema_version inside each retained proof record.\n  const project = canonicalProjectDirectory(projectDirectory);\n  const projectDigest = createHash('sha256').update(project).digest('hex');\n  const sessionDigest = createHash('sha256').update(sessionId).digest('hex');\n  return nodePath.join(\n    codexProfileDirectory(environment),\n    'safeword/session-proof-v1',\n    projectDigest,\n    `${sessionDigest}.json`,\n  );\n}\n\nfunction legacyCodexActivationMarkerPath(environment: NodeJS.ProcessEnv = process.env): string {\n  return nodePath.join(codexProfileDirectory(environment), 'safeword/activation-pending-v1.json');\n}\n\nfunction codexActivationMarkerPath(environment: NodeJS.ProcessEnv = process.env): string {\n  return nodePath.join(codexProfileDirectory(environment), 'safeword/activation-pending-v2.json');\n}\n\nfunction codexActivationReceiptPath(environment: NodeJS.ProcessEnv = process.env): string {\n  return nodePath.join(codexProfileDirectory(environment), 'safeword/activation-current-v1.json');\n}\n\nfunction legacyCodexRestartMarkerPath(environment: NodeJS.ProcessEnv = process.env): string {\n  return nodePath.join(codexProfileDirectory(environment), 'safeword/restart-pending-v1.json');\n}\n\nexport function codexActivationIsPending(environment: NodeJS.ProcessEnv = process.env): boolean {\n  try {\n    return activationIsPendingForIdentity(environment, currentCodexPluginIdentity());\n  } catch {\n    return true;\n  }\n}\n\nfunction activationIsPendingForIdentity(\n  environment: NodeJS.ProcessEnv,\n  identity: CodexPluginIdentity,\n): boolean {\n  return (\n    // The canonical marker is written atomically. If it exists but cannot be\n    // parsed or matched, fail closed instead of accepting unbound hook proof.\n    existsSync(codexActivationMarkerPath(environment)) ||\n    [legacyCodexActivationMarkerPath(environment), legacyCodexRestartMarkerPath(environment)].some(\n      path => legacyActivationMarkerMatches(path, identity),\n    )\n  );\n}\n\nexport type CodexActivationMarkerIssue = 'identity-mismatch' | 'malformed' | 'package-unavailable';\n\nexport function codexActivationMarkerIssue(\n  environment: NodeJS.ProcessEnv = process.env,\n): CodexActivationMarkerIssue | undefined {\n  const markerPath = codexActivationMarkerPath(environment);\n  if (!existsSync(markerPath)) return undefined;\n  let identity: CodexPluginIdentity;\n  try {\n    identity = currentCodexPluginIdentity();\n  } catch {\n    return 'package-unavailable';\n  }\n  try {\n    const marker = readTrustedHookProofJson(markerPath);\n    if (!isActivationMarkerV2(marker)) return 'malformed';\n    return matchesCodexPluginIdentity(marker, identity) ? undefined : 'identity-mismatch';\n  } catch {\n    return 'malformed';\n  }\n}\n\nfunction packagedHookManifestPath(): string {\n  const candidates = [\n    nodePath.resolve(import.meta.dirname, '../codex-plugin/hooks.json'),\n    nodePath.resolve(import.meta.dirname, '../../codex-plugin/hooks.json'),\n  ];\n  const manifest = candidates.find(candidate => existsSync(candidate));\n  if (manifest === undefined) {\n    throw new Error('Could not locate the packaged Codex hook manifest.');\n  }\n  return manifest;\n}\n\nexport const currentCodexPluginIdentity = (() => {\n  let cachedIdentity: CodexPluginIdentity | undefined;\n  return (): CodexPluginIdentity => {\n    cachedIdentity ??= (() => {\n      const manifest = readFileSync(packagedHookManifestPath());\n      return {\n        plugin_version: SAFEWORD_SCHEMA.version,\n        manifest_sha256: createHash('sha256').update(manifest).digest('hex'),\n      };\n    })();\n    return cachedIdentity;\n  };\n})();\n\nfunction matchesCodexPluginIdentity(\n  value: { plugin_version?: unknown; manifest_sha256?: unknown },\n  identity: CodexPluginIdentity,\n): boolean {\n  return (\n    value.plugin_version === identity.plugin_version &&\n    value.manifest_sha256 === identity.manifest_sha256\n  );\n}\n\nexport function writeCodexActivationMarker(\n  environment: NodeJS.ProcessEnv = process.env,\n  now = new Date(),\n  options: {\n    activationId?: string;\n    activeHosts?: CodexHostProcessIdentity[] | null;\n    hostObservation?: CodexHostProcessObservation;\n  } = {},\n): CodexActivationMarkerV2 {\n  const path = codexActivationMarkerPath(environment);\n  const activeHosts = activeHostsForMarker(options);\n  const marker: CodexActivationMarkerV2 = {\n    schema_version: 2,\n    ...currentCodexPluginIdentity(),\n    activation_id: options.activationId ?? randomUUID(),\n    installed_at: now.toISOString(),\n    host_observation: activeHosts === null ? 'unavailable' : 'observed',\n    active_hosts: activeHosts ?? [],\n  };\n  writeAtomicJson(path, marker);\n  // A new installation invalidates every earlier execution proof. The v2\n  // marker is the only authority until SessionStart proves a different Codex\n  // app-server loaded the installed plugin catalogue.\n  for (const event of CODEX_PLUGIN_HOOK_EVENTS)\n    rmSync(codexProofPath(environment, event), { force: true });\n  rmSync(nodePath.join(codexProfileDirectory(environment), 'safeword/hook-proof-v1'), {\n    recursive: true,\n    force: true,\n  });\n  // Task-bound SessionStart history is intentionally retained. Exact-current\n  // checks still reject it after this marker is written, while bootstrap can\n  // distinguish a previously observed runtime from wholly unobserved\n  // protection in the already-open task.\n  rmSync(codexActivationReceiptPath(environment), { force: true });\n  rmSync(legacyCodexActivationMarkerPath(environment), { force: true });\n  rmSync(legacyCodexRestartMarkerPath(environment), { force: true });\n  return marker;\n}\n\nfunction activeHostsForMarker(options: {\n  activeHosts?: CodexHostProcessIdentity[] | null;\n  hostObservation?: CodexHostProcessObservation;\n}): CodexHostProcessIdentity[] | null {\n  if (options.activeHosts !== undefined) {\n    return options.activeHosts === null || options.activeHosts.length === 0\n      ? null\n      : options.activeHosts;\n  }\n  const observation = options.hostObservation ?? observeCodexHostProcesses();\n  if (!observation.available) return null;\n  const activeHosts = [...observation.running];\n  const currentHost = observation.current;\n  if (currentHost !== null && activeHosts.every(host => !sameCodexHost(host, currentHost))) {\n    activeHosts.push(currentHost);\n  }\n  return activeHosts.length === 0 ? null : activeHosts;\n}\n\nfunction hostObservationForOverride(\n  current: CodexHostProcessIdentity | null = null,\n): CodexHostProcessObservation {\n  return {\n    available: true,\n    current,\n    running: current === null ? [] : [current],\n  };\n}\n\nfunction activationReceiptForRestart(\n  marker: CodexActivationMarkerV2,\n  hostObservation: CodexHostProcessObservation,\n  identity: CodexPluginIdentity,\n  now: Date,\n): CodexActivationReceiptV1 | null {\n  const currentHost = hostObservation.current;\n  if (\n    !hostObservation.available ||\n    currentHost === null ||\n    marker.host_observation !== 'observed' ||\n    marker.active_hosts.length === 0 ||\n    now.getTime() < Date.parse(marker.installed_at) ||\n    marker.active_hosts.some(installedHost => sameCodexHost(installedHost, currentHost)) ||\n    marker.active_hosts.some(installedHost =>\n      hostObservation.running.some(runningHost => sameCodexHost(installedHost, runningHost)),\n    )\n  ) {\n    return null;\n  }\n  return {\n    schema_version: 1,\n    ...identity,\n    activation_id: marker.activation_id,\n    activated_at: now.toISOString(),\n    host: currentHost,\n  };\n}\n\n// eslint-disable-next-line complexity -- coordinates optional host overrides with durable proof writes\nexport function recordCodexHookProof(\n  event: CodexPluginHookEvent,\n  environment: NodeJS.ProcessEnv = process.env,\n  now = new Date(),\n  writeOptions: {\n    beforeRename?: () => void;\n    currentHost?: CodexHostProcessIdentity | null;\n    hostObservation?: CodexHostProcessObservation;\n    projectDirectory?: string;\n    sessionId?: string;\n  } = {},\n): CodexHookProofV2 | CodexHookProofV3 {\n  const identity = currentCodexPluginIdentity();\n  const marker = readActivationMarkerV2(environment, identity);\n  let receipt = readActivationReceipt(environment, identity);\n  if (event === 'session-start' && marker !== null) {\n    const hostObservation =\n      writeOptions.hostObservation ??\n      ('currentHost' in writeOptions\n        ? hostObservationForOverride(writeOptions.currentHost)\n        : observeCodexHostProcesses());\n    const restartedReceipt = activationReceiptForRestart(marker, hostObservation, identity, now);\n    if (restartedReceipt !== null) {\n      receipt = restartedReceipt;\n      writeAtomicJson(codexActivationReceiptPath(environment), receipt);\n      rmSync(codexActivationMarkerPath(environment), { force: true });\n    }\n  }\n  const projectDirectory =\n    writeOptions.projectDirectory === undefined\n      ? undefined\n      : canonicalProjectDirectory(writeOptions.projectDirectory);\n  const sessionId = writeOptions.sessionId?.trim();\n  const activationId = activeCodexActivationId(marker, receipt);\n  const recordedAt = now.toISOString();\n  const proof: CodexHookProofV2 | CodexHookProofV3 =\n    projectDirectory !== undefined && sessionId\n      ? {\n          schema_version: 3,\n          event,\n          ...identity,\n          activation_id: activationId,\n          project_directory: projectDirectory,\n          session_id: sessionId,\n          recorded_at: recordedAt,\n        }\n      : {\n          schema_version: 2,\n          event,\n          ...identity,\n          activation_id: activationId,\n          recorded_at: recordedAt,\n        };\n  writeAtomicJson(codexProofPath(environment, event), proof, writeOptions);\n  if (event === 'session-start' && projectDirectory !== undefined && sessionId) {\n    const sessionProof: CodexSessionProofV2 = {\n      schema_version: 2,\n      ...identity,\n      activation_id: activationId,\n      project_directory: projectDirectory,\n      session_id: sessionId,\n      recorded_at: recordedAt,\n    };\n    const path = codexSessionProofPath(projectDirectory, sessionId, environment);\n    writeAtomicJson(path, sessionProof);\n    pruneCodexSessionProofs(path);\n  }\n  return proof;\n}\n\nexport function codexSessionProofIsCurrent(\n  projectDirectory: string,\n  sessionId: string,\n  environment: NodeJS.ProcessEnv = process.env,\n): boolean {\n  return observeCodexSessionProof(projectDirectory, sessionId, environment).status === 'current';\n}\n\nfunction validSessionProof(\n  value: unknown,\n  canonicalProject: string,\n  sessionId: string,\n): value is CodexSessionProof {\n  if (typeof value !== 'object' || value === null) return false;\n  const proof = value as Record<string, unknown>;\n  return (\n    sessionProofBindingMatches(proof, canonicalProject, sessionId) &&\n    sessionProofIdentityIsWellFormed(proof) &&\n    sessionProofTimeIsWellFormed(proof)\n  );\n}\n\nfunction sessionProofBindingMatches(\n  proof: Record<string, unknown>,\n  canonicalProject: string,\n  sessionId: string,\n): boolean {\n  return (\n    (proof.schema_version === 1 || proof.schema_version === 2) &&\n    proof.project_directory === canonicalProject &&\n    proof.session_id === sessionId &&\n    (proof.schema_version === 1 ||\n      typeof proof.activation_id === 'string' ||\n      proof.activation_id === null)\n  );\n}\n\nfunction sessionProofIdentityIsWellFormed(proof: Record<string, unknown>): boolean {\n  return (\n    pluginVersionIsWellFormed(proof.plugin_version) &&\n    typeof proof.manifest_sha256 === 'string' &&\n    SHA256_PATTERN.test(proof.manifest_sha256)\n  );\n}\n\nfunction numericVersionPartIsWellFormed(part: string): boolean {\n  return (\n    part.length > 0 &&\n    NUMERIC_VERSION_PART_PATTERN.test(part) &&\n    (part === '0' || !part.startsWith('0'))\n  );\n}\n\nfunction versionIdentifiersAreWellFormed(value: string | undefined): boolean {\n  return (\n    value === undefined ||\n    value\n      .split('.')\n      .every(identifier =>\n        identifier.length > 0 ? VERSION_IDENTIFIER_PATTERN.test(identifier) : false,\n      )\n  );\n}\n\nfunction pluginVersionIsWellFormed(value: unknown): value is string {\n  if (typeof value !== 'string' || value.length > MAX_PLUGIN_VERSION_LENGTH) return false;\n  const buildSplit = value.split('+');\n  if (buildSplit.length > 2) return false;\n  const coreAndPrerelease = buildSplit[0] ?? '';\n  const prereleaseSeparator = coreAndPrerelease.indexOf('-');\n  const coreText =\n    prereleaseSeparator === -1\n      ? coreAndPrerelease\n      : coreAndPrerelease.slice(0, prereleaseSeparator);\n  const prerelease =\n    prereleaseSeparator === -1 ? undefined : coreAndPrerelease.slice(prereleaseSeparator + 1);\n  const core = coreText.split('.');\n  return (\n    core.length === 3 &&\n    core.every(part => numericVersionPartIsWellFormed(part)) &&\n    versionIdentifiersAreWellFormed(prerelease) &&\n    versionIdentifiersAreWellFormed(buildSplit[1])\n  );\n}\n\nfunction sessionProofTimeIsWellFormed(proof: Record<string, unknown>): boolean {\n  return typeof proof.recorded_at === 'string' && !Number.isNaN(Date.parse(proof.recorded_at));\n}\n\nfunction classifySessionProof(\n  proof: CodexSessionProof,\n  identity: CodexPluginIdentity,\n  marker: CodexActivationMarkerV2 | null,\n  receipt: CodexActivationReceiptV1 | null,\n  activationPending: boolean,\n): CodexSessionProofStatus {\n  if (proof.schema_version === 1) return 'prior-observed';\n  if (!matchesCodexPluginIdentity(proof, identity)) return 'prior-observed';\n  if (marker !== null && Date.parse(proof.recorded_at) < Date.parse(marker.installed_at)) {\n    return 'prior-observed';\n  }\n  if (activationPending) return 'activation-pending';\n  if (receipt === null) return proof.activation_id === null ? 'current' : 'prior-observed';\n  return proof.activation_id === receipt.activation_id &&\n    Date.parse(proof.recorded_at) >= Date.parse(receipt.activated_at)\n    ? 'current'\n    : 'prior-observed';\n}\n\nexport function observeCodexSessionProof(\n  projectDirectory: string,\n  sessionId: string,\n  environment: NodeJS.ProcessEnv = process.env,\n): CodexSessionProofObservation {\n  const canonicalProject = canonicalProjectDirectory(projectDirectory);\n  const path = codexSessionProofPath(canonicalProject, sessionId, environment);\n  if (!existsSync(path)) {\n    return {\n      status: 'missing',\n      plugin_version: null,\n      manifest_sha256: null,\n      recorded_at: null,\n    };\n  }\n  try {\n    const value = readTrustedHookProofJson(path);\n    if (!validSessionProof(value, canonicalProject, sessionId)) throw new Error('Invalid proof.');\n    const identity = currentCodexPluginIdentity();\n    const marker = readActivationMarkerV2(environment, identity);\n    const receipt = readActivationReceipt(environment, identity);\n    const status = classifySessionProof(\n      value,\n      identity,\n      marker,\n      receipt,\n      activationIsPendingForIdentity(environment, identity),\n    );\n    return {\n      status,\n      plugin_version: value.plugin_version,\n      manifest_sha256: value.manifest_sha256,\n      recorded_at: value.recorded_at,\n    };\n  } catch {\n    return {\n      status: 'untrusted',\n      plugin_version: null,\n      manifest_sha256: null,\n      recorded_at: null,\n    };\n  }\n}\n\nfunction sessionProofProjectDirectories(root: string): {\n  modifiedAt: number;\n  path: string;\n}[] {\n  try {\n    return readdirSync(root, { withFileTypes: true })\n      .filter(entry => entry.isDirectory() && !entry.isSymbolicLink())\n      .flatMap(projectEntry => {\n        const path = nodePath.join(root, projectEntry.name);\n        try {\n          // A crash may leave only a durable-write temporary file. Such a\n          // directory is not retained proof and must not consume a project\n          // retention slot or evict a live sibling project.\n          if (sessionProofProjectFiles(path).length === 0) return [];\n          return [{ modifiedAt: lstatSync(path).mtimeMs, path }];\n        } catch {\n          // An unreadable directory is not evidence that its retained history\n          // is empty. Leave it untouched and retry on a later SessionStart.\n          return [];\n        }\n      });\n  } catch {\n    return [];\n  }\n}\n\nfunction sessionProofProjectFiles(projectPath: string): { modifiedAt: number; path: string }[] {\n  try {\n    return readdirSync(projectPath, { withFileTypes: true }).flatMap(entry => {\n      if (\n        !entry.isFile() ||\n        entry.isSymbolicLink() ||\n        entry.name.startsWith('.') ||\n        !entry.name.endsWith('.json')\n      )\n        return [];\n      const path = nodePath.join(projectPath, entry.name);\n      try {\n        return [{ modifiedAt: lstatSync(path).mtimeMs, path }];\n      } catch {\n        // Another task may prune the same proof between listing and metadata\n        // lookup. Keep the remaining bounded history instead of abandoning it.\n        return [];\n      }\n    });\n  } catch {\n    return [];\n  }\n}\n\nfunction pruneCodexSessionProofs(retainedPath: string): void {\n  const retainedProjectPath = nodePath.dirname(retainedPath);\n  const files = sessionProofProjectFiles(retainedProjectPath).toSorted((left, right) => {\n    if (left.path === retainedPath) return -1;\n    if (right.path === retainedPath) return 1;\n    return right.modifiedAt - left.modifiedAt || left.path.localeCompare(right.path);\n  });\n  for (const stale of files.slice(MAX_RETAINED_SESSION_PROOFS_PER_PROJECT)) {\n    rmSync(stale.path, { force: true });\n  }\n  const root = nodePath.dirname(retainedProjectPath);\n  const projects = sessionProofProjectDirectories(root).toSorted((left, right) => {\n    if (left.path === retainedProjectPath) return -1;\n    if (right.path === retainedProjectPath) return 1;\n    return right.modifiedAt - left.modifiedAt || left.path.localeCompare(right.path);\n  });\n  for (const stale of projects.slice(MAX_RETAINED_SESSION_PROOF_PROJECTS)) {\n    for (const proof of sessionProofProjectFiles(stale.path)) rmSync(proof.path, { force: true });\n    try {\n      // Non-recursive removal cannot erase a concurrent writer's temporary or\n      // newly published proof. A non-empty directory is retried later.\n      rmdirSync(stale.path);\n    } catch {\n      // Advisory history remains bounded per project even when a concurrent\n      // writer keeps this project directory alive.\n    }\n  }\n}\n\nfunction writeAtomicJson(\n  path: string,\n  value: unknown,\n  options: { beforeRename?: () => void } = {},\n): void {\n  writeDurableFile(path, `${JSON.stringify(value)}\\n`, {\n    mode: 0o600,\n    beforeRename: options.beforeRename,\n  });\n}\n\nfunction legacyActivationMarkerMatches(path: string, identity: CodexPluginIdentity): boolean {\n  if (!existsSync(path)) return false;\n  try {\n    const marker = JSON.parse(readFileSync(path, 'utf8')) as Partial<CodexActivationMarkerV1>;\n    return marker.schema_version === 1 && matchesCodexPluginIdentity(marker, identity);\n  } catch {\n    return false;\n  }\n}\n\nfunction readActivationMarkerV2(\n  environment: NodeJS.ProcessEnv,\n  identity: CodexPluginIdentity,\n): CodexActivationMarkerV2 | null {\n  return readIdentityBoundJson(\n    codexActivationMarkerPath(environment),\n    identity,\n    isActivationMarkerV2,\n  );\n}\n\nfunction readActivationReceipt(\n  environment: NodeJS.ProcessEnv,\n  identity: CodexPluginIdentity,\n): CodexActivationReceiptV1 | null {\n  return readIdentityBoundJson(\n    codexActivationReceiptPath(environment),\n    identity,\n    isActivationReceiptV1,\n  );\n}\n\nfunction activeCodexActivationId(\n  marker: CodexActivationMarkerV2 | null,\n  receipt: CodexActivationReceiptV1 | null,\n): string | null {\n  // A completed restart receipt supersedes a leftover pending marker. Sharing\n  // this precedence keeps the proof writer and observer on the same identity.\n  return receipt?.activation_id ?? marker?.activation_id ?? null;\n}\n\nfunction readIdentityBoundJson<T extends CodexPluginIdentity>(\n  path: string,\n  identity: CodexPluginIdentity,\n  validator: (value: unknown) => value is T,\n): T | null {\n  if (!existsSync(path)) return null;\n  try {\n    const value = readTrustedHookProofJson(path);\n    return validator(value) && matchesCodexPluginIdentity(value, identity) ? value : null;\n  } catch {\n    return null;\n  }\n}\n\nfunction readEventProof(\n  path: string,\n  expectedEvent: CodexPluginHookEvent,\n): CodexHookProofV2 | CodexHookProofV3 | null {\n  try {\n    const proof = readTrustedHookProofJson(path);\n    return isCodexHookProof(proof) && proof.event === expectedEvent ? proof : null;\n  } catch {\n    return null;\n  }\n}\n\nconst MAX_CODEX_HOOK_PROOF_BYTES = 64 * 1024;\n\nfunction assertTrustedHookProofMetadata(metadata: Stats): void {\n  const posixPermissionsAreTrusted =\n    process.getuid === undefined ||\n    (metadata.uid === process.getuid() && (metadata.mode & 0o077) === 0);\n  if (\n    !metadata.isFile() ||\n    metadata.nlink !== 1 ||\n    !posixPermissionsAreTrusted ||\n    metadata.size > MAX_CODEX_HOOK_PROOF_BYTES\n  ) {\n    throw new Error('Untrusted Codex hook proof file.');\n  }\n}\n\nfunction readDescriptorFully(descriptor: number, size: number): Buffer {\n  const buffer = Buffer.alloc(size);\n  let offset = 0;\n  while (offset < buffer.length) {\n    const count = readSync(descriptor, buffer, offset, buffer.length - offset, offset);\n    if (count === 0) break;\n    offset += count;\n  }\n  if (offset !== buffer.length)\n    throw new Error('Codex hook proof changed while it was being read.');\n  return buffer;\n}\n\nfunction assertHookProofUnchanged(before: Stats, after: Stats): void {\n  if (\n    after.size !== before.size ||\n    after.mtimeMs !== before.mtimeMs ||\n    after.ctimeMs !== before.ctimeMs\n  ) {\n    throw new Error('Codex hook proof changed while it was being read.');\n  }\n}\n\nfunction readTrustedHookProofJson(path: string): unknown {\n  const descriptor = openSync(path, fsConstants.O_RDONLY | (fsConstants.O_NOFOLLOW ?? 0));\n  try {\n    const metadata = fstatSync(descriptor);\n    assertTrustedHookProofMetadata(metadata);\n    const buffer = readDescriptorFully(descriptor, metadata.size);\n    assertHookProofUnchanged(metadata, fstatSync(descriptor));\n    return JSON.parse(buffer.toString('utf8')) as unknown;\n  } finally {\n    closeSync(descriptor);\n  }\n}\n\n// eslint-disable-next-line complexity -- aggregates independently written event proofs and preserves malformed/stale distinctions\nexport function observeCodexHookProof(\n  environment: NodeJS.ProcessEnv = process.env,\n  binding?: { projectDirectory: string; sessionId: string },\n): CodexHookProofObservation {\n  const candidates = CODEX_PLUGIN_HOOK_EVENTS.map(event => ({\n    event,\n    path: codexProofPath(environment, event),\n  }));\n  const existing = candidates.filter(candidate => existsSync(candidate.path));\n  if (existing.length === 0) {\n    return {\n      status: 'missing',\n      plugin_version: null,\n      manifest_sha256: null,\n      recorded_at: null,\n      activation_id: null,\n      events: [],\n      missing_events: CODEX_PLUGIN_HOOK_EVENTS,\n    };\n  }\n\n  const parsed = existing.map(item => readEventProof(item.path, item.event));\n  if (parsed.includes(null)) return malformedObservation();\n  const validProofs = parsed.filter(proof => proof !== null);\n\n  let identity: CodexPluginIdentity;\n  try {\n    identity = currentCodexPluginIdentity();\n  } catch {\n    return malformedObservation();\n  }\n  const marker = readActivationMarkerV2(environment, identity);\n  const receipt = readActivationReceipt(environment, identity);\n  const activationId = activeCodexActivationId(marker, receipt);\n  if (activationIsPendingForIdentity(environment, identity)) {\n    return staleHookObservation(validProofs, activationId);\n  }\n  const canonicalProject =\n    binding === undefined ? undefined : canonicalProjectDirectory(binding.projectDirectory);\n  const current = validProofs.filter(\n    proof =>\n      matchesCodexPluginIdentity(proof, identity) &&\n      (activationId === null\n        ? proof.activation_id === null\n        : proof.activation_id === activationId) &&\n      (receipt === null || Date.parse(proof.recorded_at) >= Date.parse(receipt.activated_at)) &&\n      (binding === undefined ||\n        (proof.schema_version === 3 &&\n          proof.project_directory === canonicalProject &&\n          proof.session_id === binding.sessionId)),\n  );\n  const events = current.map(proof => proof.event);\n  const missingEvents = CODEX_PLUGIN_HOOK_EVENTS.filter(event => !events.includes(event));\n  const latest = current\n    .toSorted((left, right) => Date.parse(right.recorded_at) - Date.parse(left.recorded_at))\n    .at(0);\n  let status: CodexHookProofStatus = 'stale';\n  if (current.length === CODEX_PLUGIN_HOOK_EVENTS.length) status = 'current';\n  else if (current.length > 0) status = 'partial';\n  return {\n    status,\n    plugin_version: latest?.plugin_version ?? validProofs[0]?.plugin_version ?? null,\n    manifest_sha256: latest?.manifest_sha256 ?? validProofs[0]?.manifest_sha256 ?? null,\n    recorded_at: latest?.recorded_at ?? null,\n    activation_id: activationId,\n    events,\n    missing_events: missingEvents,\n  };\n}\n\nfunction staleHookObservation(\n  proofs: (CodexHookProofV2 | CodexHookProofV3)[],\n  activationId: string | null,\n): CodexHookProofObservation {\n  return {\n    status: 'stale',\n    plugin_version: proofs[0]?.plugin_version ?? null,\n    manifest_sha256: proofs[0]?.manifest_sha256 ?? null,\n    recorded_at: null,\n    activation_id: activationId,\n    events: [],\n    missing_events: CODEX_PLUGIN_HOOK_EVENTS,\n  };\n}\n\nfunction malformedObservation(): CodexHookProofObservation {\n  return {\n    status: 'malformed',\n    plugin_version: null,\n    manifest_sha256: null,\n    recorded_at: null,\n    activation_id: null,\n    events: [],\n    missing_events: CODEX_PLUGIN_HOOK_EVENTS,\n  };\n}\n\n/*\n  Each manifest entry is trusted independently by Codex, so finalization proof\n  is intentionally one file per event. Separate files also avoid concurrent\n  hook processes racing on a shared read-modify-write document.\n*/\n\n// eslint-disable-next-line complexity -- validates every field of two persisted proof schema versions\nfunction isCodexHookProof(value: unknown): value is CodexHookProofV2 | CodexHookProofV3 {\n  if (typeof value !== 'object' || value === null) return false;\n  const proof = value as Record<string, unknown>;\n  return (\n    (proof.schema_version === 2 || proof.schema_version === 3) &&\n    isCodexPluginHookEvent(proof.event) &&\n    pluginVersionIsWellFormed(proof.plugin_version) &&\n    typeof proof.manifest_sha256 === 'string' &&\n    SHA256_PATTERN.test(proof.manifest_sha256) &&\n    'activation_id' in proof &&\n    (typeof proof.activation_id === 'string' || proof.activation_id === null) &&\n    (proof.schema_version !== 3 ||\n      (typeof proof.project_directory === 'string' &&\n        typeof proof.session_id === 'string' &&\n        proof.session_id.trim() !== '')) &&\n    typeof proof.recorded_at === 'string' &&\n    !Number.isNaN(Date.parse(proof.recorded_at))\n  );\n}\n\n// eslint-disable-next-line complexity -- validates each untrusted persisted marker field\nfunction isActivationMarkerV2(value: unknown): value is CodexActivationMarkerV2 {\n  if (typeof value !== 'object' || value === null) return false;\n  const marker = value as Partial<CodexActivationMarkerV2>;\n  return (\n    marker.schema_version === 2 &&\n    pluginVersionIsWellFormed(marker.plugin_version) &&\n    typeof marker.manifest_sha256 === 'string' &&\n    SHA256_PATTERN.test(marker.manifest_sha256) &&\n    typeof marker.activation_id === 'string' &&\n    typeof marker.installed_at === 'string' &&\n    !Number.isNaN(Date.parse(marker.installed_at)) &&\n    (marker.host_observation === 'observed' || marker.host_observation === 'unavailable') &&\n    Array.isArray(marker.active_hosts) &&\n    marker.active_hosts.every(isCodexHostProcessIdentity) &&\n    (marker.host_observation === 'observed'\n      ? marker.active_hosts.length > 0\n      : marker.active_hosts.length === 0)\n  );\n}\n\nfunction isActivationReceiptV1(value: unknown): value is CodexActivationReceiptV1 {\n  if (typeof value !== 'object' || value === null) return false;\n  const receipt = value as Partial<CodexActivationReceiptV1>;\n  return (\n    receipt.schema_version === 1 &&\n    pluginVersionIsWellFormed(receipt.plugin_version) &&\n    typeof receipt.manifest_sha256 === 'string' &&\n    SHA256_PATTERN.test(receipt.manifest_sha256) &&\n    typeof receipt.activation_id === 'string' &&\n    typeof receipt.activated_at === 'string' &&\n    !Number.isNaN(Date.parse(receipt.activated_at)) &&\n    isCodexHostProcessIdentity(receipt.host)\n  );\n}\n\nfunction isCodexHostProcessIdentity(value: unknown): value is CodexHostProcessIdentity {\n  if (typeof value !== 'object' || value === null) return false;\n  const host = value as Partial<CodexHostProcessIdentity>;\n  return (\n    Number.isSafeInteger(host.pid) &&\n    (host.pid ?? 0) > 0 &&\n    typeof host.started_at === 'string' &&\n    !Number.isNaN(Date.parse(host.started_at))\n  );\n}\n\nfunction isCodexPluginHookEvent(value: unknown): value is CodexPluginHookEvent {\n  return (\n    typeof value === 'string' && CODEX_PLUGIN_HOOK_EVENTS.includes(value as CodexPluginHookEvent)\n  );\n}\n","/* eslint-disable unicorn/no-null -- host observations use explicit null when ancestry is unavailable */\n\nimport { spawnSync } from 'node:child_process';\n\nexport interface CodexHostProcessIdentity {\n  pid: number;\n  started_at: string;\n}\n\ninterface ProcessRow extends CodexHostProcessIdentity {\n  parentPid: number;\n  command: string;\n}\n\nexport interface CodexHostProcessObservation {\n  available: boolean;\n  running: CodexHostProcessIdentity[];\n  current: CodexHostProcessIdentity | null;\n}\n\nconst WINDOWS_PROCESS_COMMAND =\n  'Get-CimInstance Win32_Process | ForEach-Object { $started = [DateTimeOffset]$_.CreationDate; Write-Output (\"{0}`t{1}`t{2}`t{3}\" -f $_.ProcessId, $_.ParentProcessId, $started.ToUnixTimeMilliseconds(), $_.CommandLine) }';\n\nfunction parseProcessRows(output: string): ProcessRow[] {\n  return output.split('\\n').flatMap(line => {\n    const columns = line.trim().split(/\\s+/u);\n    if (columns.length < 8) return [];\n    const pid = Number(columns[0]);\n    const parentPid = Number(columns[1]);\n    if (!Number.isSafeInteger(pid) || !Number.isSafeInteger(parentPid)) return [];\n    const startedAt = new Date(columns.slice(2, 7).join(' '));\n    if (Number.isNaN(startedAt.getTime())) return [];\n    return [\n      {\n        pid,\n        parentPid,\n        started_at: startedAt.toISOString(),\n        command: columns.slice(7).join(' '),\n      },\n    ];\n  });\n}\n\nfunction parseWindowsProcessRows(output: string): ProcessRow[] {\n  return output.split('\\n').flatMap(line => {\n    const [pidText, parentPidText, startedAtText, ...command] = line.trimEnd().split('\\t');\n    const pid = Number(pidText);\n    const parentPid = Number(parentPidText);\n    const startedAt = new Date(Number(startedAtText));\n    if (!Number.isSafeInteger(pid) || !Number.isSafeInteger(parentPid) || command.length === 0)\n      return [];\n    if (Number.isNaN(startedAt.getTime())) return [];\n    return [\n      {\n        pid,\n        parentPid,\n        started_at: startedAt.toISOString(),\n        command: command.join('\\t'),\n      },\n    ];\n  });\n}\n\nfunction isCodexAppServer(row: ProcessRow): boolean {\n  const command = row.command.replaceAll('\\\\', '/');\n  return (\n    /(?:^|\\/)codex(?:\\.exe)?[\"']?\\s/iu.test(command) && /(?:^|\\s)app-server(?:\\s|$)/u.test(command)\n  );\n}\n\nexport function codexHostsFromProcessTable(\n  output: string,\n  parentPid: number,\n  format: 'posix' | 'windows' = 'posix',\n): CodexHostProcessObservation {\n  const rows = format === 'windows' ? parseWindowsProcessRows(output) : parseProcessRows(output);\n  const running = rows\n    .filter(row => isCodexAppServer(row))\n    .map(({ pid, started_at }) => ({ pid, started_at }));\n  const byPid = new Map(rows.map(row => [row.pid, row]));\n  let candidate = byPid.get(parentPid);\n  const visited = new Set<number>();\n  while (candidate !== undefined && !visited.has(candidate.pid)) {\n    if (isCodexAppServer(candidate)) {\n      return {\n        available: true,\n        running,\n        current: { pid: candidate.pid, started_at: candidate.started_at },\n      };\n    }\n    visited.add(candidate.pid);\n    candidate = byPid.get(candidate.parentPid);\n  }\n  return { available: true, running, current: null };\n}\n\nexport function observeCodexHostProcesses(): CodexHostProcessObservation {\n  if (process.platform === 'win32') {\n    const result = spawnSync(\n      'powershell.exe',\n      ['-NoProfile', '-NonInteractive', '-Command', WINDOWS_PROCESS_COMMAND],\n      { encoding: 'utf8', timeout: 2000 },\n    );\n    if (result.status !== 0) return { available: false, running: [], current: null };\n    return codexHostsFromProcessTable(result.stdout, process.ppid, 'windows');\n  }\n  const result = spawnSync('ps', ['-axo', 'pid=,ppid=,lstart=,command='], {\n    encoding: 'utf8',\n    timeout: 2000,\n  });\n  if (result.status !== 0) return { available: false, running: [], current: null };\n  return codexHostsFromProcessTable(result.stdout, process.ppid);\n}\n\nexport function observeRunningCodexHosts(): CodexHostProcessIdentity[] | null {\n  const observation = observeCodexHostProcesses();\n  return observation.available ? observation.running : null;\n}\n\nexport function sameCodexHost(\n  left: CodexHostProcessIdentity,\n  right: CodexHostProcessIdentity,\n): boolean {\n  return left.pid === right.pid && left.started_at === right.started_at;\n}\n"],"mappings":";;;;;;;;;;;;;;AAAA,SAAS,YAAY,WAAW,WAAW,oBAAoB;AAC/D,OAAO,cAAc;;;ACYrB,SAAS,aAAa,SAA2B;AAC/C,SAAO,QACJ,KAAK,EACL,MAAM,GAAG,EACT,OAAO,UAAQ,SAAS,EAAE;AAC/B;AAEA,SAAS,0BAA0B,OAAmC;AACpE,SACE,MAAM,CAAC,MAAM,uBAAuB,iBACpC,MAAM,CAAC,MAAM,WACb,MAAM,CAAC,MAAM;AAEjB;AAEA,SAAS,kBAAkB,MAA6C;AACtE,MACE,KAAK,WAAW,KAChB,KAAK,CAAC,MAAM,UACZ,KAAK,CAAC,MAAM,WACZ,uBAAuB,WAAW,SAAS,KAAK,CAAC,KAAK,EAAE,GACxD;AACA,WAAO,KAAK,CAAC;AAAA,EACf;AACA,MACE,KAAK,WAAW,KAChB,KAAK,CAAC,MAAM,gBACZ,uBAAuB,WAAW,SAAS,KAAK,CAAC,KAAK,EAAE,GACxD;AACA,WAAO,KAAK,CAAC;AAAA,EACf;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAoD;AAC3E,QAAM,QAAQ,aAAa,OAAO;AAClC,MAAI,CAAC,0BAA0B,KAAK,EAAG,QAAO;AAC9C,QAAM,QAAQ,kBAAkB,MAAM,MAAM,CAAC,CAAC;AAC9C,SAAO,UAAU,SAAY,SAAY,EAAE,MAAM,WAAW,MAAM;AACpE;AAEA,SAAS,eAAe,SAAoD;AAC1E,QAAM,SAAS,uBAAuB;AACtC,MAAI,CAAC,QAAQ,WAAW,MAAM,EAAG,QAAO;AACxC,QAAM,YAAY,QAAQ,MAAM,OAAO,MAAM;AAC7C,QAAM,QAAQ,UAAU,QAAQ,GAAG;AACnC,MAAI,UAAU,GAAI,QAAO;AACzB,QAAM,SAAS,UAAU,MAAM,GAAG,KAAK;AACvC,QAAM,QAAQ,uBAAuB,iBAAiB,MAAM;AAC5D,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,aAAa,UAAU,MAAM,QAAQ,CAAC;AAC5C,QAAM,qBACJ,eAAe,MACd,WAAW,iCAAiC,eAAe;AAC9D,SAAO,qBAAqB,EAAE,MAAM,UAAU,OAAO,OAAO,IAAI;AAClE;AAEO,SAAS,sBAAsB,SAAoD;AACxF,SAAO,gBAAgB,OAAO,KAAK,eAAe,OAAO;AAC3D;;;AD3DA,SAAS,YAAY,MAAuB;AAC1C,MAAI;AACF,WAAO,UAAU,IAAI,EAAE,OAAO;AAAA,EAChC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,cAAc,QAAsB,WAA6B;AACxE,MAAI,OAAO,OAAO,UAAU,YAAY,OAAO,UAAU,KAAM,QAAO,CAAC;AACvE,QAAM,SAAU,OAAO,MAAkC,SAAS;AAClE,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AAEpC,SAAO,OAAO,QAAQ,WAAS;AAC7B,UAAM,QAAS,MAA0B;AACzC,QAAI,CAAC,MAAM,QAAQ,KAAK,EAAG,QAAO,CAAC;AACnC,WAAO,MAAM,QAAQ,UAAQ;AAC3B,YAAM,YAAY;AAClB,aAAO,UAAU,SAAS,aAAa,OAAO,UAAU,YAAY,WAChE,CAAC,UAAU,OAAO,IAClB,CAAC;AAAA,IACP,CAAC;AAAA,EACH,CAAC;AACH;AAEA,SAAS,yBAAyB,KAAa,aAAyC;AACtF,QAAM,SAAS,gBAAgB,eAAe;AAC9C,QAAM,eAAe,YAAY,QAAQ,IAAI,MAAM,SAAS,SAAS,EAAE,OAAO,OAAO;AACrF,QAAM,aACJ,QAAQ,aAAa,WAAW,YAAY,WAAW,uBAAuB,MAAM,GAAG,IAAI,CAAC,EAAE;AAChG,SAAO,YAAY;AAAA,IAAK,WACtB,WAAW,KAAK,eAAa;AAC3B,YAAM,YAAY,SAAS,QAAQ,KAAK,OAAO,GAAG,MAAM,GAAG,UAAU,YAAY,CAAC,EAAE;AACpF,UAAI;AACF,mBAAW,WAAW,QAAQ,aAAa,UAAU,UAAU,OAAO,UAAU,IAAI;AACpF,eAAO,YAAY,SAAS;AAAA,MAC9B,QAAQ;AACN,eAAO;AAAA,MACT;AAAA,IACF,CAAC;AAAA,EACH;AACF;AAEA,SAAS,gBACP,SACA,OACA,KACA,aACS;AACT,QAAM,WAAW,sBAAsB,OAAO;AAC9C,MAAI,UAAU,UAAU,MAAO,QAAO;AACtC,MAAI,SAAS,SAAS,WAAW;AAC/B,WACE,YAAY,SAAS,KAAK,KAAK,gBAAgB,eAAe,aAAa,CAAC,KAC5E,yBAAyB,KAAK,WAAW;AAAA,EAE7C;AACA,SACE,SAAS,SAAS,YAClB,YAAY,SAAS,KAAK,KAAK,uBAAuB,MAAM,iBAAiB,SAAS,MAAM,CAAC;AAEjG;AAEO,SAAS,yBACd,KACA,OACA,cAAiC,QAAQ,KAChC;AACT,QAAM,YAAY,gBAAgB,eAAe,eAAe,KAAK;AACrE,MAAI,cAAc,OAAW,QAAO;AAEpC,QAAM,aAAa,SAAS,KAAK,KAAK,uBAAuB,MAAM,MAAM;AACzE,MAAI,CAAC,YAAY,UAAU,EAAG,QAAO;AAErC,MAAI;AACJ,MAAI;AACF,aAAS,MAAM,aAAa,YAAY,MAAM,CAAC;AAAA,EACjD,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,SAAO,cAAc,QAAQ,SAAS,EAAE;AAAA,IAAK,aAC3C,gBAAgB,SAAS,OAAO,KAAK,WAAW;AAAA,EAClD;AACF;;;AE/FA,SAAS,YAAY,kBAAkB;AACvC;AAAA,EACE;AAAA,EACA,aAAa;AAAA,EACb;AAAA,EACA;AAAA,EACA,aAAAA;AAAA,EACA;AAAA,EACA;AAAA,EACA,gBAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,eAAe;AACxB,OAAOC,eAAc;;;ACjBrB,SAAS,iBAAiB;AAkB1B,IAAM,0BACJ;AAEF,SAAS,iBAAiB,QAA8B;AACtD,SAAO,OAAO,MAAM,IAAI,EAAE,QAAQ,UAAQ;AACxC,UAAM,UAAU,KAAK,KAAK,EAAE,MAAM,MAAM;AACxC,QAAI,QAAQ,SAAS,EAAG,QAAO,CAAC;AAChC,UAAM,MAAM,OAAO,QAAQ,CAAC,CAAC;AAC7B,UAAM,YAAY,OAAO,QAAQ,CAAC,CAAC;AACnC,QAAI,CAAC,OAAO,cAAc,GAAG,KAAK,CAAC,OAAO,cAAc,SAAS,EAAG,QAAO,CAAC;AAC5E,UAAM,YAAY,IAAI,KAAK,QAAQ,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG,CAAC;AACxD,QAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,EAAG,QAAO,CAAC;AAC/C,WAAO;AAAA,MACL;AAAA,QACE;AAAA,QACA;AAAA,QACA,YAAY,UAAU,YAAY;AAAA,QAClC,SAAS,QAAQ,MAAM,CAAC,EAAE,KAAK,GAAG;AAAA,MACpC;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,wBAAwB,QAA8B;AAC7D,SAAO,OAAO,MAAM,IAAI,EAAE,QAAQ,UAAQ;AACxC,UAAM,CAAC,SAAS,eAAe,eAAe,GAAG,OAAO,IAAI,KAAK,QAAQ,EAAE,MAAM,GAAI;AACrF,UAAM,MAAM,OAAO,OAAO;AAC1B,UAAM,YAAY,OAAO,aAAa;AACtC,UAAM,YAAY,IAAI,KAAK,OAAO,aAAa,CAAC;AAChD,QAAI,CAAC,OAAO,cAAc,GAAG,KAAK,CAAC,OAAO,cAAc,SAAS,KAAK,QAAQ,WAAW;AACvF,aAAO,CAAC;AACV,QAAI,OAAO,MAAM,UAAU,QAAQ,CAAC,EAAG,QAAO,CAAC;AAC/C,WAAO;AAAA,MACL;AAAA,QACE;AAAA,QACA;AAAA,QACA,YAAY,UAAU,YAAY;AAAA,QAClC,SAAS,QAAQ,KAAK,GAAI;AAAA,MAC5B;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,SAAS,iBAAiB,KAA0B;AAClD,QAAM,UAAU,IAAI,QAAQ,WAAW,MAAM,GAAG;AAChD,SACE,mCAAmC,KAAK,OAAO,KAAK,8BAA8B,KAAK,OAAO;AAElG;AAEO,SAAS,2BACd,QACA,WACA,SAA8B,SACD;AAC7B,QAAM,OAAO,WAAW,YAAY,wBAAwB,MAAM,IAAI,iBAAiB,MAAM;AAC7F,QAAM,UAAU,KACb,OAAO,SAAO,iBAAiB,GAAG,CAAC,EACnC,IAAI,CAAC,EAAE,KAAK,WAAW,OAAO,EAAE,KAAK,WAAW,EAAE;AACrD,QAAM,QAAQ,IAAI,IAAI,KAAK,IAAI,SAAO,CAAC,IAAI,KAAK,GAAG,CAAC,CAAC;AACrD,MAAI,YAAY,MAAM,IAAI,SAAS;AACnC,QAAM,UAAU,oBAAI,IAAY;AAChC,SAAO,cAAc,UAAa,CAAC,QAAQ,IAAI,UAAU,GAAG,GAAG;AAC7D,QAAI,iBAAiB,SAAS,GAAG;AAC/B,aAAO;AAAA,QACL,WAAW;AAAA,QACX;AAAA,QACA,SAAS,EAAE,KAAK,UAAU,KAAK,YAAY,UAAU,WAAW;AAAA,MAClE;AAAA,IACF;AACA,YAAQ,IAAI,UAAU,GAAG;AACzB,gBAAY,MAAM,IAAI,UAAU,SAAS;AAAA,EAC3C;AACA,SAAO,EAAE,WAAW,MAAM,SAAS,SAAS,KAAK;AACnD;AAEO,SAAS,4BAAyD;AACvE,MAAI,QAAQ,aAAa,SAAS;AAChC,UAAMC,UAAS;AAAA,MACb;AAAA,MACA,CAAC,cAAc,mBAAmB,YAAY,uBAAuB;AAAA,MACrE,EAAE,UAAU,QAAQ,SAAS,IAAK;AAAA,IACpC;AACA,QAAIA,QAAO,WAAW,EAAG,QAAO,EAAE,WAAW,OAAO,SAAS,CAAC,GAAG,SAAS,KAAK;AAC/E,WAAO,2BAA2BA,QAAO,QAAQ,QAAQ,MAAM,SAAS;AAAA,EAC1E;AACA,QAAM,SAAS,UAAU,MAAM,CAAC,QAAQ,6BAA6B,GAAG;AAAA,IACtE,UAAU;AAAA,IACV,SAAS;AAAA,EACX,CAAC;AACD,MAAI,OAAO,WAAW,EAAG,QAAO,EAAE,WAAW,OAAO,SAAS,CAAC,GAAG,SAAS,KAAK;AAC/E,SAAO,2BAA2B,OAAO,QAAQ,QAAQ,IAAI;AAC/D;AAOO,SAAS,cACd,MACA,OACS;AACT,SAAO,KAAK,QAAQ,MAAM,OAAO,KAAK,eAAe,MAAM;AAC7D;;;AD1CA,IAAM,iBAAiB;AACvB,IAAM,+BAA+B;AACrC,IAAM,6BAA6B;AACnC,IAAM,4BAA4B;AAClC,IAAM,0CAA0C;AAChD,IAAM,sCAAsC;AA2BrC,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAeA,SAAS,sBAAsB,cAAiC,QAAQ,KAAa;AACnF,QAAM,iBAAiB,YAAY,YAAY,KAAK;AACpD,SAAO,kBAAkBC,UAAS,KAAK,QAAQ,GAAG,QAAQ;AAC5D;AAEO,SAAS,eACd,cAAiC,QAAQ,KACzC,QAA8B,iBACtB;AACR,SAAOA,UAAS;AAAA,IACd,sBAAsB,WAAW;AAAA,IACjC;AAAA,IACA,GAAG,KAAK;AAAA,EACV;AACF;AAEA,SAAS,0BAA0B,kBAAkC;AACnE,MAAI;AACF,WAAO,aAAa,gBAAgB;AAAA,EACtC,QAAQ;AACN,WAAOA,UAAS,QAAQ,gBAAgB;AAAA,EAC1C;AACF;AAEA,SAAS,sBACP,kBACA,WACA,aACQ;AAGR,QAAM,UAAU,0BAA0B,gBAAgB;AAC1D,QAAM,gBAAgB,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK;AACvE,QAAM,gBAAgB,WAAW,QAAQ,EAAE,OAAO,SAAS,EAAE,OAAO,KAAK;AACzE,SAAOA,UAAS;AAAA,IACd,sBAAsB,WAAW;AAAA,IACjC;AAAA,IACA;AAAA,IACA,GAAG,aAAa;AAAA,EAClB;AACF;AAEA,SAAS,gCAAgC,cAAiC,QAAQ,KAAa;AAC7F,SAAOA,UAAS,KAAK,sBAAsB,WAAW,GAAG,qCAAqC;AAChG;AAEA,SAAS,0BAA0B,cAAiC,QAAQ,KAAa;AACvF,SAAOA,UAAS,KAAK,sBAAsB,WAAW,GAAG,qCAAqC;AAChG;AAEA,SAAS,2BAA2B,cAAiC,QAAQ,KAAa;AACxF,SAAOA,UAAS,KAAK,sBAAsB,WAAW,GAAG,qCAAqC;AAChG;AAEA,SAAS,6BAA6B,cAAiC,QAAQ,KAAa;AAC1F,SAAOA,UAAS,KAAK,sBAAsB,WAAW,GAAG,kCAAkC;AAC7F;AAEO,SAAS,yBAAyB,cAAiC,QAAQ,KAAc;AAC9F,MAAI;AACF,WAAO,+BAA+B,aAAa,2BAA2B,CAAC;AAAA,EACjF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,+BACP,aACA,UACS;AACT;AAAA;AAAA;AAAA,IAGE,WAAW,0BAA0B,WAAW,CAAC,KACjD,CAAC,gCAAgC,WAAW,GAAG,6BAA6B,WAAW,CAAC,EAAE;AAAA,MACxF,UAAQ,8BAA8B,MAAM,QAAQ;AAAA,IACtD;AAAA;AAEJ;AAIO,SAAS,2BACd,cAAiC,QAAQ,KACD;AACxC,QAAM,aAAa,0BAA0B,WAAW;AACxD,MAAI,CAAC,WAAW,UAAU,EAAG,QAAO;AACpC,MAAI;AACJ,MAAI;AACF,eAAW,2BAA2B;AAAA,EACxC,QAAQ;AACN,WAAO;AAAA,EACT;AACA,MAAI;AACF,UAAM,SAAS,yBAAyB,UAAU;AAClD,QAAI,CAAC,qBAAqB,MAAM,EAAG,QAAO;AAC1C,WAAO,2BAA2B,QAAQ,QAAQ,IAAI,SAAY;AAAA,EACpE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,2BAAmC;AAC1C,QAAM,aAAa;AAAA,IACjBA,UAAS,QAAQ,YAAY,SAAS,4BAA4B;AAAA,IAClEA,UAAS,QAAQ,YAAY,SAAS,+BAA+B;AAAA,EACvE;AACA,QAAM,WAAW,WAAW,KAAK,eAAa,WAAW,SAAS,CAAC;AACnE,MAAI,aAAa,QAAW;AAC1B,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,SAAO;AACT;AAEO,IAAM,6BAA8B,uBAAM;AAC/C,MAAI;AACJ,SAAO,MAA2B;AAChC,wBAAoB,MAAM;AACxB,YAAM,WAAWC,cAAa,yBAAyB,CAAC;AACxD,aAAO;AAAA,QACL,gBAAgB,gBAAgB;AAAA,QAChC,iBAAiB,WAAW,QAAQ,EAAE,OAAO,QAAQ,EAAE,OAAO,KAAK;AAAA,MACrE;AAAA,IACF,GAAG;AACH,WAAO;AAAA,EACT;AACF,GAAG;AAEH,SAAS,2BACP,OACA,UACS;AACT,SACE,MAAM,mBAAmB,SAAS,kBAClC,MAAM,oBAAoB,SAAS;AAEvC;AAEO,SAAS,2BACd,cAAiC,QAAQ,KACzC,MAAM,oBAAI,KAAK,GACf,UAII,CAAC,GACoB;AACzB,QAAM,OAAO,0BAA0B,WAAW;AAClD,QAAM,cAAc,qBAAqB,OAAO;AAChD,QAAM,SAAkC;AAAA,IACtC,gBAAgB;AAAA,IAChB,GAAG,2BAA2B;AAAA,IAC9B,eAAe,QAAQ,gBAAgB,WAAW;AAAA,IAClD,cAAc,IAAI,YAAY;AAAA,IAC9B,kBAAkB,gBAAgB,OAAO,gBAAgB;AAAA,IACzD,cAAc,eAAe,CAAC;AAAA,EAChC;AACA,kBAAgB,MAAM,MAAM;AAI5B,aAAW,SAAS;AAClB,WAAO,eAAe,aAAa,KAAK,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5D,SAAOD,UAAS,KAAK,sBAAsB,WAAW,GAAG,wBAAwB,GAAG;AAAA,IAClF,WAAW;AAAA,IACX,OAAO;AAAA,EACT,CAAC;AAKD,SAAO,2BAA2B,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;AAC/D,SAAO,gCAAgC,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;AACpE,SAAO,6BAA6B,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;AACjE,SAAO;AACT;AAEA,SAAS,qBAAqB,SAGQ;AACpC,MAAI,QAAQ,gBAAgB,QAAW;AACrC,WAAO,QAAQ,gBAAgB,QAAQ,QAAQ,YAAY,WAAW,IAClE,OACA,QAAQ;AAAA,EACd;AACA,QAAM,cAAc,QAAQ,mBAAmB,0BAA0B;AACzE,MAAI,CAAC,YAAY,UAAW,QAAO;AACnC,QAAM,cAAc,CAAC,GAAG,YAAY,OAAO;AAC3C,QAAM,cAAc,YAAY;AAChC,MAAI,gBAAgB,QAAQ,YAAY,MAAM,UAAQ,CAAC,cAAc,MAAM,WAAW,CAAC,GAAG;AACxF,gBAAY,KAAK,WAAW;AAAA,EAC9B;AACA,SAAO,YAAY,WAAW,IAAI,OAAO;AAC3C;AAEA,SAAS,2BACP,UAA2C,MACd;AAC7B,SAAO;AAAA,IACL,WAAW;AAAA,IACX;AAAA,IACA,SAAS,YAAY,OAAO,CAAC,IAAI,CAAC,OAAO;AAAA,EAC3C;AACF;AAEA,SAAS,4BACP,QACA,iBACA,UACA,KACiC;AACjC,QAAM,cAAc,gBAAgB;AACpC,MACE,CAAC,gBAAgB,aACjB,gBAAgB,QAChB,OAAO,qBAAqB,cAC5B,OAAO,aAAa,WAAW,KAC/B,IAAI,QAAQ,IAAI,KAAK,MAAM,OAAO,YAAY,KAC9C,OAAO,aAAa,KAAK,mBAAiB,cAAc,eAAe,WAAW,CAAC,KACnF,OAAO,aAAa;AAAA,IAAK,mBACvB,gBAAgB,QAAQ,KAAK,iBAAe,cAAc,eAAe,WAAW,CAAC;AAAA,EACvF,GACA;AACA,WAAO;AAAA,EACT;AACA,SAAO;AAAA,IACL,gBAAgB;AAAA,IAChB,GAAG;AAAA,IACH,eAAe,OAAO;AAAA,IACtB,cAAc,IAAI,YAAY;AAAA,IAC9B,MAAM;AAAA,EACR;AACF;AAGO,SAAS,qBACd,OACA,cAAiC,QAAQ,KACzC,MAAM,oBAAI,KAAK,GACf,eAMI,CAAC,GACgC;AACrC,QAAM,WAAW,2BAA2B;AAC5C,QAAM,SAAS,uBAAuB,aAAa,QAAQ;AAC3D,MAAI,UAAU,sBAAsB,aAAa,QAAQ;AACzD,MAAI,UAAU,mBAAmB,WAAW,MAAM;AAChD,UAAM,kBACJ,aAAa,oBACZ,iBAAiB,eACd,2BAA2B,aAAa,WAAW,IACnD,0BAA0B;AAChC,UAAM,mBAAmB,4BAA4B,QAAQ,iBAAiB,UAAU,GAAG;AAC3F,QAAI,qBAAqB,MAAM;AAC7B,gBAAU;AACV,sBAAgB,2BAA2B,WAAW,GAAG,OAAO;AAChE,aAAO,0BAA0B,WAAW,GAAG,EAAE,OAAO,KAAK,CAAC;AAAA,IAChE;AAAA,EACF;AACA,QAAM,mBACJ,aAAa,qBAAqB,SAC9B,SACA,0BAA0B,aAAa,gBAAgB;AAC7D,QAAM,YAAY,aAAa,WAAW,KAAK;AAC/C,QAAM,eAAe,wBAAwB,QAAQ,OAAO;AAC5D,QAAM,aAAa,IAAI,YAAY;AACnC,QAAM,QACJ,qBAAqB,UAAa,YAC9B;AAAA,IACE,gBAAgB;AAAA,IAChB;AAAA,IACA,GAAG;AAAA,IACH,eAAe;AAAA,IACf,mBAAmB;AAAA,IACnB,YAAY;AAAA,IACZ,aAAa;AAAA,EACf,IACA;AAAA,IACE,gBAAgB;AAAA,IAChB;AAAA,IACA,GAAG;AAAA,IACH,eAAe;AAAA,IACf,aAAa;AAAA,EACf;AACN,kBAAgB,eAAe,aAAa,KAAK,GAAG,OAAO,YAAY;AACvE,MAAI,UAAU,mBAAmB,qBAAqB,UAAa,WAAW;AAC5E,UAAM,eAAoC;AAAA,MACxC,gBAAgB;AAAA,MAChB,GAAG;AAAA,MACH,eAAe;AAAA,MACf,mBAAmB;AAAA,MACnB,YAAY;AAAA,MACZ,aAAa;AAAA,IACf;AACA,UAAM,OAAO,sBAAsB,kBAAkB,WAAW,WAAW;AAC3E,oBAAgB,MAAM,YAAY;AAClC,4BAAwB,IAAI;AAAA,EAC9B;AACA,SAAO;AACT;AAUA,SAAS,kBACP,OACA,kBACA,WAC4B;AAC5B,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,QAAQ;AACd,SACE,2BAA2B,OAAO,kBAAkB,SAAS,KAC7D,iCAAiC,KAAK,KACtC,6BAA6B,KAAK;AAEtC;AAEA,SAAS,2BACP,OACA,kBACA,WACS;AACT,UACG,MAAM,mBAAmB,KAAK,MAAM,mBAAmB,MACxD,MAAM,sBAAsB,oBAC5B,MAAM,eAAe,cACpB,MAAM,mBAAmB,KACxB,OAAO,MAAM,kBAAkB,YAC/B,MAAM,kBAAkB;AAE9B;AAEA,SAAS,iCAAiC,OAAyC;AACjF,SACE,0BAA0B,MAAM,cAAc,KAC9C,OAAO,MAAM,oBAAoB,YACjC,eAAe,KAAK,MAAM,eAAe;AAE7C;AAEA,SAAS,+BAA+B,MAAuB;AAC7D,SACE,KAAK,SAAS,KACd,6BAA6B,KAAK,IAAI,MACrC,SAAS,OAAO,CAAC,KAAK,WAAW,GAAG;AAEzC;AAEA,SAAS,gCAAgC,OAAoC;AAC3E,SACE,UAAU,UACV,MACG,MAAM,GAAG,EACT;AAAA,IAAM,gBACL,WAAW,SAAS,IAAI,2BAA2B,KAAK,UAAU,IAAI;AAAA,EACxE;AAEN;AAEA,SAAS,0BAA0B,OAAiC;AAClE,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,0BAA2B,QAAO;AAClF,QAAM,aAAa,MAAM,MAAM,GAAG;AAClC,MAAI,WAAW,SAAS,EAAG,QAAO;AAClC,QAAM,oBAAoB,WAAW,CAAC,KAAK;AAC3C,QAAM,sBAAsB,kBAAkB,QAAQ,GAAG;AACzD,QAAM,WACJ,wBAAwB,KACpB,oBACA,kBAAkB,MAAM,GAAG,mBAAmB;AACpD,QAAM,aACJ,wBAAwB,KAAK,SAAY,kBAAkB,MAAM,sBAAsB,CAAC;AAC1F,QAAM,OAAO,SAAS,MAAM,GAAG;AAC/B,SACE,KAAK,WAAW,KAChB,KAAK,MAAM,UAAQ,+BAA+B,IAAI,CAAC,KACvD,gCAAgC,UAAU,KAC1C,gCAAgC,WAAW,CAAC,CAAC;AAEjD;AAEA,SAAS,6BAA6B,OAAyC;AAC7E,SAAO,OAAO,MAAM,gBAAgB,YAAY,CAAC,OAAO,MAAM,KAAK,MAAM,MAAM,WAAW,CAAC;AAC7F;AAEA,SAAS,qBACP,OACA,UACA,QACA,SACA,mBACyB;AACzB,MAAI,MAAM,mBAAmB,EAAG,QAAO;AACvC,MAAI,CAAC,2BAA2B,OAAO,QAAQ,EAAG,QAAO;AACzD,MAAI,WAAW,QAAQ,KAAK,MAAM,MAAM,WAAW,IAAI,KAAK,MAAM,OAAO,YAAY,GAAG;AACtF,WAAO;AAAA,EACT;AACA,MAAI,kBAAmB,QAAO;AAC9B,MAAI,YAAY,KAAM,QAAO,MAAM,kBAAkB,OAAO,YAAY;AACxE,SAAO,MAAM,kBAAkB,QAAQ,iBACrC,KAAK,MAAM,MAAM,WAAW,KAAK,KAAK,MAAM,QAAQ,YAAY,IAC9D,YACA;AACN;AAEO,SAAS,yBACd,kBACA,WACA,cAAiC,QAAQ,KACX;AAC9B,QAAM,mBAAmB,0BAA0B,gBAAgB;AACnE,QAAM,OAAO,sBAAsB,kBAAkB,WAAW,WAAW;AAC3E,MAAI,CAAC,WAAW,IAAI,GAAG;AACrB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,aAAa;AAAA,IACf;AAAA,EACF;AACA,MAAI;AACF,UAAM,QAAQ,yBAAyB,IAAI;AAC3C,QAAI,CAAC,kBAAkB,OAAO,kBAAkB,SAAS,EAAG,OAAM,IAAI,MAAM,gBAAgB;AAC5F,UAAM,WAAW,2BAA2B;AAC5C,UAAM,SAAS,uBAAuB,aAAa,QAAQ;AAC3D,UAAM,UAAU,sBAAsB,aAAa,QAAQ;AAC3D,UAAM,SAAS;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,+BAA+B,aAAa,QAAQ;AAAA,IACtD;AACA,WAAO;AAAA,MACL;AAAA,MACA,gBAAgB,MAAM;AAAA,MACtB,iBAAiB,MAAM;AAAA,MACvB,aAAa,MAAM;AAAA,IACrB;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,aAAa;AAAA,IACf;AAAA,EACF;AACF;AAEA,SAAS,+BAA+B,MAGpC;AACF,MAAI;AACF,WAAO,YAAY,MAAM,EAAE,eAAe,KAAK,CAAC,EAC7C,OAAO,WAAS,MAAM,YAAY,KAAK,CAAC,MAAM,eAAe,CAAC,EAC9D,QAAQ,kBAAgB;AACvB,YAAM,OAAOE,UAAS,KAAK,MAAM,aAAa,IAAI;AAClD,UAAI;AAIF,YAAI,yBAAyB,IAAI,EAAE,WAAW,EAAG,QAAO,CAAC;AACzD,eAAO,CAAC,EAAE,YAAYC,WAAU,IAAI,EAAE,SAAS,KAAK,CAAC;AAAA,MACvD,QAAQ;AAGN,eAAO,CAAC;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACL,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,yBAAyB,aAA6D;AAC7F,MAAI;AACF,WAAO,YAAY,aAAa,EAAE,eAAe,KAAK,CAAC,EAAE,QAAQ,WAAS;AACxE,UACE,CAAC,MAAM,OAAO,KACd,MAAM,eAAe,KACrB,MAAM,KAAK,WAAW,GAAG,KACzB,CAAC,MAAM,KAAK,SAAS,OAAO;AAE5B,eAAO,CAAC;AACV,YAAM,OAAOD,UAAS,KAAK,aAAa,MAAM,IAAI;AAClD,UAAI;AACF,eAAO,CAAC,EAAE,YAAYC,WAAU,IAAI,EAAE,SAAS,KAAK,CAAC;AAAA,MACvD,QAAQ;AAGN,eAAO,CAAC;AAAA,MACV;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,wBAAwB,cAA4B;AAC3D,QAAM,sBAAsBD,UAAS,QAAQ,YAAY;AACzD,QAAM,QAAQ,yBAAyB,mBAAmB,EAAE,SAAS,CAAC,MAAM,UAAU;AACpF,QAAI,KAAK,SAAS,aAAc,QAAO;AACvC,QAAI,MAAM,SAAS,aAAc,QAAO;AACxC,WAAO,MAAM,aAAa,KAAK,cAAc,KAAK,KAAK,cAAc,MAAM,IAAI;AAAA,EACjF,CAAC;AACD,aAAW,SAAS,MAAM,MAAM,uCAAuC,GAAG;AACxE,WAAO,MAAM,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,EACpC;AACA,QAAM,OAAOA,UAAS,QAAQ,mBAAmB;AACjD,QAAM,WAAW,+BAA+B,IAAI,EAAE,SAAS,CAAC,MAAM,UAAU;AAC9E,QAAI,KAAK,SAAS,oBAAqB,QAAO;AAC9C,QAAI,MAAM,SAAS,oBAAqB,QAAO;AAC/C,WAAO,MAAM,aAAa,KAAK,cAAc,KAAK,KAAK,cAAc,MAAM,IAAI;AAAA,EACjF,CAAC;AACD,aAAW,SAAS,SAAS,MAAM,mCAAmC,GAAG;AACvE,eAAW,SAAS,yBAAyB,MAAM,IAAI,EAAG,QAAO,MAAM,MAAM,EAAE,OAAO,KAAK,CAAC;AAC5F,QAAI;AAGF,gBAAU,MAAM,IAAI;AAAA,IACtB,QAAQ;AAAA,IAGR;AAAA,EACF;AACF;AAEA,SAAS,gBACP,MACA,OACA,UAAyC,CAAC,GACpC;AACN,mBAAiB,MAAM,GAAG,KAAK,UAAU,KAAK,CAAC;AAAA,GAAM;AAAA,IACnD,MAAM;AAAA,IACN,cAAc,QAAQ;AAAA,EACxB,CAAC;AACH;AAEA,SAAS,8BAA8B,MAAc,UAAwC;AAC3F,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,SAAS,KAAK,MAAME,cAAa,MAAM,MAAM,CAAC;AACpD,WAAO,OAAO,mBAAmB,KAAK,2BAA2B,QAAQ,QAAQ;AAAA,EACnF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,uBACP,aACA,UACgC;AAChC,SAAO;AAAA,IACL,0BAA0B,WAAW;AAAA,IACrC;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,sBACP,aACA,UACiC;AACjC,SAAO;AAAA,IACL,2BAA2B,WAAW;AAAA,IACtC;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,wBACP,QACA,SACe;AAGf,SAAO,SAAS,iBAAiB,QAAQ,iBAAiB;AAC5D;AAEA,SAAS,sBACP,MACA,UACA,WACU;AACV,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACF,UAAM,QAAQ,yBAAyB,IAAI;AAC3C,WAAO,UAAU,KAAK,KAAK,2BAA2B,OAAO,QAAQ,IAAI,QAAQ;AAAA,EACnF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,eACP,MACA,eAC4C;AAC5C,MAAI;AACF,UAAM,QAAQ,yBAAyB,IAAI;AAC3C,WAAO,iBAAiB,KAAK,KAAK,MAAM,UAAU,gBAAgB,QAAQ;AAAA,EAC5E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,IAAM,6BAA6B,KAAK;AAExC,SAAS,+BAA+B,UAAuB;AAC7D,QAAM,6BACJ,QAAQ,WAAW,UAClB,SAAS,QAAQ,QAAQ,OAAO,MAAM,SAAS,OAAO,QAAW;AACpE,MACE,CAAC,SAAS,OAAO,KACjB,SAAS,UAAU,KACnB,CAAC,8BACD,SAAS,OAAO,4BAChB;AACA,UAAM,IAAI,MAAM,kCAAkC;AAAA,EACpD;AACF;AAEA,SAAS,oBAAoB,YAAoB,MAAsB;AACrE,QAAM,SAAS,OAAO,MAAM,IAAI;AAChC,MAAI,SAAS;AACb,SAAO,SAAS,OAAO,QAAQ;AAC7B,UAAM,QAAQ,SAAS,YAAY,QAAQ,QAAQ,OAAO,SAAS,QAAQ,MAAM;AACjF,QAAI,UAAU,EAAG;AACjB,cAAU;AAAA,EACZ;AACA,MAAI,WAAW,OAAO;AACpB,UAAM,IAAI,MAAM,mDAAmD;AACrE,SAAO;AACT;AAEA,SAAS,yBAAyB,QAAe,OAAoB;AACnE,MACE,MAAM,SAAS,OAAO,QACtB,MAAM,YAAY,OAAO,WACzB,MAAM,YAAY,OAAO,SACzB;AACA,UAAM,IAAI,MAAM,mDAAmD;AAAA,EACrE;AACF;AAEA,SAAS,yBAAyB,MAAuB;AACvD,QAAM,aAAa,SAAS,MAAM,YAAY,YAAY,YAAY,cAAc,EAAE;AACtF,MAAI;AACF,UAAM,WAAW,UAAU,UAAU;AACrC,mCAA+B,QAAQ;AACvC,UAAM,SAAS,oBAAoB,YAAY,SAAS,IAAI;AAC5D,6BAAyB,UAAU,UAAU,UAAU,CAAC;AACxD,WAAO,KAAK,MAAM,OAAO,SAAS,MAAM,CAAC;AAAA,EAC3C,UAAE;AACA,cAAU,UAAU;AAAA,EACtB;AACF;AAGO,SAAS,sBACd,cAAiC,QAAQ,KACzC,SAC2B;AAC3B,QAAM,aAAa,yBAAyB,IAAI,YAAU;AAAA,IACxD;AAAA,IACA,MAAM,eAAe,aAAa,KAAK;AAAA,EACzC,EAAE;AACF,QAAM,WAAW,WAAW,OAAO,eAAa,WAAW,UAAU,IAAI,CAAC;AAC1E,MAAI,SAAS,WAAW,GAAG;AACzB,WAAO;AAAA,MACL,QAAQ;AAAA,MACR,gBAAgB;AAAA,MAChB,iBAAiB;AAAA,MACjB,aAAa;AAAA,MACb,eAAe;AAAA,MACf,QAAQ,CAAC;AAAA,MACT,gBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,QAAM,SAAS,SAAS,IAAI,UAAQ,eAAe,KAAK,MAAM,KAAK,KAAK,CAAC;AACzE,MAAI,OAAO,SAAS,IAAI,EAAG,QAAO,qBAAqB;AACvD,QAAM,cAAc,OAAO,OAAO,WAAS,UAAU,IAAI;AAEzD,MAAI;AACJ,MAAI;AACF,eAAW,2BAA2B;AAAA,EACxC,QAAQ;AACN,WAAO,qBAAqB;AAAA,EAC9B;AACA,QAAM,SAAS,uBAAuB,aAAa,QAAQ;AAC3D,QAAM,UAAU,sBAAsB,aAAa,QAAQ;AAC3D,QAAM,eAAe,wBAAwB,QAAQ,OAAO;AAC5D,MAAI,+BAA+B,aAAa,QAAQ,GAAG;AACzD,WAAO,qBAAqB,aAAa,YAAY;AAAA,EACvD;AACA,QAAM,mBACJ,YAAY,SAAY,SAAY,0BAA0B,QAAQ,gBAAgB;AACxF,QAAM,UAAU,YAAY;AAAA,IAC1B,WACE,2BAA2B,OAAO,QAAQ,MACzC,iBAAiB,OACd,MAAM,kBAAkB,OACxB,MAAM,kBAAkB,kBAC3B,YAAY,QAAQ,KAAK,MAAM,MAAM,WAAW,KAAK,KAAK,MAAM,QAAQ,YAAY,OACpF,YAAY,UACV,MAAM,mBAAmB,KACxB,MAAM,sBAAsB,oBAC5B,MAAM,eAAe,QAAQ;AAAA,EACrC;AACA,QAAM,SAAS,QAAQ,IAAI,WAAS,MAAM,KAAK;AAC/C,QAAM,gBAAgB,yBAAyB,OAAO,WAAS,CAAC,OAAO,SAAS,KAAK,CAAC;AACtF,QAAM,SAAS,QACZ,SAAS,CAAC,MAAM,UAAU,KAAK,MAAM,MAAM,WAAW,IAAI,KAAK,MAAM,KAAK,WAAW,CAAC,EACtF,GAAG,CAAC;AACP,MAAI,SAA+B;AACnC,MAAI,QAAQ,WAAW,yBAAyB,OAAQ,UAAS;AAAA,WACxD,QAAQ,SAAS,EAAG,UAAS;AACtC,SAAO;AAAA,IACL;AAAA,IACA,gBAAgB,QAAQ,kBAAkB,YAAY,CAAC,GAAG,kBAAkB;AAAA,IAC5E,iBAAiB,QAAQ,mBAAmB,YAAY,CAAC,GAAG,mBAAmB;AAAA,IAC/E,aAAa,QAAQ,eAAe;AAAA,IACpC,eAAe;AAAA,IACf;AAAA,IACA,gBAAgB;AAAA,EAClB;AACF;AAEA,SAAS,qBACP,QACA,cAC2B;AAC3B,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,gBAAgB,OAAO,CAAC,GAAG,kBAAkB;AAAA,IAC7C,iBAAiB,OAAO,CAAC,GAAG,mBAAmB;AAAA,IAC/C,aAAa;AAAA,IACb,eAAe;AAAA,IACf,QAAQ,CAAC;AAAA,IACT,gBAAgB;AAAA,EAClB;AACF;AAEA,SAAS,uBAAkD;AACzD,SAAO;AAAA,IACL,QAAQ;AAAA,IACR,gBAAgB;AAAA,IAChB,iBAAiB;AAAA,IACjB,aAAa;AAAA,IACb,eAAe;AAAA,IACf,QAAQ,CAAC;AAAA,IACT,gBAAgB;AAAA,EAClB;AACF;AASA,SAAS,iBAAiB,OAA8D;AACtF,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,QAAQ;AACd,UACG,MAAM,mBAAmB,KAAK,MAAM,mBAAmB,MACxD,uBAAuB,MAAM,KAAK,KAClC,0BAA0B,MAAM,cAAc,KAC9C,OAAO,MAAM,oBAAoB,YACjC,eAAe,KAAK,MAAM,eAAe,KACzC,mBAAmB,UAClB,OAAO,MAAM,kBAAkB,YAAY,MAAM,kBAAkB,UACnE,MAAM,mBAAmB,KACvB,OAAO,MAAM,sBAAsB,YAClC,OAAO,MAAM,eAAe,YAC5B,MAAM,WAAW,KAAK,MAAM,OAChC,OAAO,MAAM,gBAAgB,YAC7B,CAAC,OAAO,MAAM,KAAK,MAAM,MAAM,WAAW,CAAC;AAE/C;AAGA,SAAS,qBAAqB,OAAkD;AAC9E,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,SACE,OAAO,mBAAmB,KAC1B,0BAA0B,OAAO,cAAc,KAC/C,OAAO,OAAO,oBAAoB,YAClC,eAAe,KAAK,OAAO,eAAe,KAC1C,OAAO,OAAO,kBAAkB,YAChC,OAAO,OAAO,iBAAiB,YAC/B,CAAC,OAAO,MAAM,KAAK,MAAM,OAAO,YAAY,CAAC,MAC5C,OAAO,qBAAqB,cAAc,OAAO,qBAAqB,kBACvE,MAAM,QAAQ,OAAO,YAAY,KACjC,OAAO,aAAa,MAAM,0BAA0B,MACnD,OAAO,qBAAqB,aACzB,OAAO,aAAa,SAAS,IAC7B,OAAO,aAAa,WAAW;AAEvC;AAEA,SAAS,sBAAsB,OAAmD;AAChF,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,UAAU;AAChB,SACE,QAAQ,mBAAmB,KAC3B,0BAA0B,QAAQ,cAAc,KAChD,OAAO,QAAQ,oBAAoB,YACnC,eAAe,KAAK,QAAQ,eAAe,KAC3C,OAAO,QAAQ,kBAAkB,YACjC,OAAO,QAAQ,iBAAiB,YAChC,CAAC,OAAO,MAAM,KAAK,MAAM,QAAQ,YAAY,CAAC,KAC9C,2BAA2B,QAAQ,IAAI;AAE3C;AAEA,SAAS,2BAA2B,OAAmD;AACrF,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,OAAO;AACb,SACE,OAAO,cAAc,KAAK,GAAG,MAC5B,KAAK,OAAO,KAAK,KAClB,OAAO,KAAK,eAAe,YAC3B,CAAC,OAAO,MAAM,KAAK,MAAM,KAAK,UAAU,CAAC;AAE7C;AAEA,SAAS,uBAAuB,OAA+C;AAC7E,SACE,OAAO,UAAU,YAAY,yBAAyB,SAAS,KAA6B;AAEhG;","names":["lstatSync","readFileSync","nodePath","result","nodePath","readFileSync","nodePath","lstatSync","readFileSync"]}