wyrm-mcp 7.3.2 → 7.3.3

package/dist/wyrm-guard.js

@@ -1,15 +1,476 @@
 #!/usr/bin/env node
-import S from"better-sqlite3";import{readFileSync as D,realpathSync as I}from"node:fs";import{homedir as L}from"node:os";import{basename as W,dirname as T,isAbsolute as k,join as O,relative as j,resolve as $,sep as U}from"node:path";import{fileURLToPath as G}from"node:url";import{FailurePatterns as A,normalizeIdentity as E}from"./failure-patterns.js";import{LEGACY_ENVELOPE as Y,runWithActor as B,sanitizeActorId as P}from"./handlers/boundary.js";const g={exitCode:0,stdout:"",stderr:""},V=new Set(["Edit","Write","MultiEdit","NotebookEdit"]),F=3,H=10;function p(t){return typeof t=="string"&&t.length>0?t:null}function a(t,e){return t?t.replace(/[\x00-\x1f\x7f]/g," ").replace(/\s+/g," ").trim().slice(0,e):""}function J(t){const e=t.hook_event_name;if(e!==void 0&&e!=="PreToolUse")return null;const i=t.tool_name,s=t.tool_input;if(typeof i!="string"||typeof s!="object"||s===null)return null;const o=s,r=p(t.cwd);if(i==="Bash"){const c=p(o.command)?.trim();if(!c)return null;const d=c.slice(0,1e3);return{scopes:["command"],probeTarget:d,identity:[c],display:a(d,80),startDir:r,absPath:null}}if(V.has(i)){const c=p(o.file_path)??p(o.notebook_path);if(!c)return null;const d=o.edits,m=p(o.new_string)??p(o.content)??p(o.new_source)??(Array.isArray(d)?d.map(h=>p(h?.new_string)??"").join(" "):""),f=k(c)?$(c):r&&k(r)?$(r,c):null;return{scopes:["file","edit"],probeTarget:W(c).slice(0,200),identity:C([c,...f?[f]:[]]),display:a(c,80),startDir:f?T(f):r,absPath:f,content:m}}return null}function C(t){const e=new Set,i=[];for(const s of t){const o=E(s);o.length===0||e.has(o)||(e.add(o),i.push(s))}return i}function K(t,e){if(!e)return{id:null,root:null};const i=t.prepare("SELECT id FROM projects WHERE path = ?");let s=$(e);for(let o=0;o<H;o++){const r=i.get(s);if(r)return{id:r.id,root:s};const c=T(s);if(c===s)break;s=c}return{id:null,root:null}}function q(t){if(t.recorded_by_agent==="legacy"&&t.run_id===null)return"";const e=t.run_id?` (run ${a(t.run_id,32)}${t.quarantine_scope==="run"?", run-quarantined":""})`:"";return`  recorded by: ${a(t.recorded_by_agent,64)}${e}
-`}function z(t,e,i){const s=t.description?`  description: ${a(t.description,200)}
-`:"",o=t.why_failed?`  failed because: ${a(t.why_failed,300)}
-`:"";return`wyrm-guard: BLOCKED \u2014 ${e==="exact"?"this exact action is a recorded unresolved failure":e==="content"?"this edit re-introduces the code of a recorded unresolved failure":"this exact target previously failed and the failure is unresolved"} (deterministic ${e} match).
-  failure #${t.id} [${t.severity}/${t.scope}] seen ${t.occurrences}x, last ${a(t.last_seen,32)}
-  target: ${a(t.target,120)}
-`+s+o+q(t)+`Do NOT retry the same action \u2014 pick a different approach. If the underlying
-issue is truly fixed, resolve the failure first (wyrm_failure_resolve id=${t.id})
-and then retry.
-`+(i>0?`(+${i} more recorded match${i===1?"":"es"} \u2014 wyrm_failure_list)
-`:"")}function Q(t,e){const i=t.slice(0,F),s=i.map(r=>{const c=r.why_failed??r.description;return`- #${r.id} [${r.severity}/${r.scope}] ${a(r.target,80)} (seen ${r.occurrences}x, confidence ${r.confidence}): ${a(c,160)}`}),o=t.length-i.length;return["<wyrm-memory>",`wyrm-guard: ${t.length} recorded unresolved failure(s) look similar to \`${e}\` \u2014 check before proceeding:`,...s,...o>0?[`(+${o} more \u2014 wyrm_failure_list)`]:[],"If one applies, do not repeat it \u2014 adjust the approach or resolve it first (wyrm_failure_resolve).","</wyrm-memory>"].join(`
-`)}function X(t,e){const i={hookSpecificOutput:{hookEventName:"PreToolUse",additionalContext:Q(t,e)}};return{exitCode:0,stdout:JSON.stringify(i)+`
-`,stderr:""}}function Z(t,e=process.env){let i=null;try{const s=(e.WYRM_GUARD_MODE??"block").toLowerCase();if(s==="off"||!t||!t.trim())return g;const o=JSON.parse(t);if(typeof o!="object"||o===null)return g;const r=J(o);if(!r)return g;const c=e.WYRM_DB_PATH??O(L(),".wyrm","wyrm.db");i=new S(c,{readonly:!0,fileMustExist:!0}),i.pragma("busy_timeout = 100");const{id:d,root:m}=K(i,r.startDir),f=[...r.identity];m&&r.absPath&&r.absPath.startsWith(m+U)&&f.push(j(m,r.absPath));const h=P(e.WYRM_RUN_ID)??null,w=new A(i),y=new Set,_=[],R=C(f);for(const n of r.scopes)try{const u=w.checkVerdict(n,r.probeTarget,"",d,{callerRunId:h});for(const l of u.matches)y.has(l.id)||(y.add(l.id),_.push(l))}catch{}for(const n of r.scopes)for(const u of R)try{for(const l of w.targetIdentityMatches(n,u,d,{callerRunId:h}))y.has(l.id)||(y.add(l.id),_.push(w.toVerdictMatch(l,"target")))}catch{}let b=null;if(r.content&&r.scopes.includes("edit")&&/^(1|true|yes|on)$/i.test(e.WYRM_GUARD_CONTENT??""))try{const n=w.contentMatch(r.content,"edit",d);n&&!y.has(n.id)&&(y.add(n.id),b=w.toVerdictMatch(n,"target"))}catch{}if(_.length===0&&!b)return g;const N=new Set(R.map(n=>E(n))),v={exact:0,target:1,content:2},M=[..._.map(n=>({m:n,reason:n.match==="exact"?"exact":n.match==="target"||N.has(E(n.target))?"target":null})).filter(n=>n.reason!==null),...b?[{m:b,reason:"content"}]:[]].sort((n,u)=>v[n.reason]-v[u.reason]);if(M.length>0&&s!=="warn"){const n=M[0];try{const u=new S(c,{fileMustExist:!0});try{u.pragma("busy_timeout = 50");const l=P(e.WYRM_AGENT_ID);B(l!==null||h!==null?{agent_id:l,run_id:h,source:"env"}:Y,()=>new A(u).recordBlock({blocked:!0,matches:[n.m],recorded_by_agent:n.m.recorded_by_agent,run_id:n.m.run_id,confidence:n.m.confidence},d))}finally{u.close()}}catch{}return{exitCode:2,stdout:"",stderr:z(n.m,n.reason,_.length-1)}}return X(_,r.display)}catch(s){if(e.WYRM_GUARD_DEBUG==="1"){const o=s instanceof Error?s.message:String(s);return{exitCode:0,stdout:"",stderr:`wyrm-guard: internal error (fail-open): ${a(o,200)}
-`}}return g}finally{try{i?.close()}catch{}}}const tt=G(import.meta.url);let x=!1;try{x=typeof process.argv[1]=="string"&&I(process.argv[1])===tt}catch{x=!1}if(x){let t="";try{t=D(0,"utf-8")}catch{t=""}const e=Z(t);e.stdout&&process.stdout.write(e.stdout),e.stderr&&process.stderr.write(e.stderr),process.exit(e.exitCode)}export{Z as runGuard};
+/**
+ * wyrm-guard — deterministic PreToolUse hook bin (v7 F2, T016; spec FR-2/G2).
+ *
+ * Harness-side negative learning: Claude Code pipes the PreToolUse payload for
+ * Bash/Edit/Write(/MultiEdit/NotebookEdit) to this bin; the bin runs the SAME
+ * deterministic failure_check the MCP tool runs (FailurePatterns.checkVerdict —
+ * Article III: bm25/match-tier arithmetic, zero LLM calls, zero network)
+ * against the LOCAL SQLite DB opened READ-ONLY, and answers on the Claude Code
+ * hook contract:
+ *
+ *   BLOCK  — exit 2, the failure pattern on stderr (Claude Code feeds stderr
+ *            back to the model and does not execute the tool call).
+ *            The deterministic block rule — identity blocks, similarity warns:
+ *              · an EXACT signature match (checkVerdict tier 'exact'), or
+ *              · a TARGET-IDENTITY match: a stored failure whose scope+target
+ *                normalize identical to the probed command / file path under
+ *                normalizeIdentity — the FULL, UNCAPPED form of the signature
+ *                normalization. Identity spans the whole command/path: the
+ *                200-char signature cap is range-scan recall only, so two
+ *                long actions differing only past it never alias into one
+ *                block, and the lookup filters identity BEFORE its result
+ *                cap, so same-prefix cousins can never crowd an
+ *                identical-target row out. v7 F2 review fix: this tier runs
+ *                as a DEDICATED signature-prefix lookup
+ *                (FailurePatterns.targetIdentityMatches) — production rows
+ *                always carry a non-empty description, so full-signature
+ *                equality against this bin's empty-description probe could
+ *                never fire, and a block never depends on FTS recall.
+ *   WARN   — exit 0, hookSpecificOutput.additionalContext JSON on stdout
+ *            (non-blocking context injection — the wyrm-push.py shape) for any
+ *            other match.
+ *   SILENT — exit 0, no output, when clean.
+ *
+ * Run/scope semantics (T014/T015): the caller's run identity comes from
+ * WYRM_RUN_ID (the F2 fleet convention — the orchestrator exports it once for
+ * the whole fleet) and is passed EXPLICITLY to checkVerdict, so same-run
+ * quarantined failures bite instantly while runless callers only ever see the
+ * project/global tiers. Project scoping: the payload `cwd` (or the edited
+ * file's directory) is walked up against projects.path — unenrolled paths
+ * still check the global (project-NULL) failures.
+ *
+ * Probe construction (recall under FTS5 implicit-AND, see query() in
+ * failure-patterns.ts):
+ *   · Bash  → scope 'command', probe target = the command string.
+ *   · Files → scopes 'file' + 'edit', probe target = the BASENAME (a full path
+ *     would AND-in every directory token and miss relpath-keyed rows); the
+ *     identity rule then compares the stored target against the absolute,
+ *     project-relative, and as-given path forms — equality on any blocks.
+ *     The edit content signal is extracted/validated but NOT fed to the FTS
+ *     probe: under implicit-AND it strictly narrows recall, and it can never
+ *     produce an exact signature against recorder-authored descriptions.
+ *
+ * Budget (the wyrm-push.py ~200ms discipline): readonly open + fileMustExist,
+ * busy_timeout=100ms (a locked DB fails open instead of hanging the harness),
+ * a small fixed number of prepared statements per scope (the two checkVerdict
+ * stages + one identity range-probe per identity candidate), no migrations,
+ * no index work. Measured by bench/guard-budget.mjs (Article VIII).
+ *
+ * Analytics (v7 F2 review fix): a BLOCK files one failure_blocks row — the
+ * prevented-repeat ROI counter behind `wyrm_stats view=failures` — via a
+ * separate short-lived RW connection (busy_timeout=50ms). Strictly
+ * best-effort and fail-open: the CHECK connection stays readonly, and any
+ * ledger failure is swallowed without affecting the verdict. Blocks are rare
+ * (they abort the tool call), so the extra write never touches the hot path.
+ *
+ * A broken guard must NEVER block the operator's harness: ANY internal error →
+ * silent exit 0 (fail-open). Set WYRM_GUARD_DEBUG=1 to surface the swallowed
+ * reason on stderr (still exit 0 — debug output never blocks).
+ *
+ * Operator escape hatch: WYRM_GUARD_MODE=warn (downgrade blocks to warns) |
+ * off (disable entirely). Article I: fully offline, local DB only. Article
+ * VII: read-only handle, every value a bound parameter (inside
+ * FailurePatterns), stored text control-char-stripped + length-capped before
+ * it is rendered into hook output.
+ *
+ * Install: scripts/hooks/install.sh wires the PreToolUse matchers
+ * (`Bash` and `Edit|Write|MultiEdit|NotebookEdit`) into ~/.claude/settings.json.
+ *
+ * @copyright 2026 Ghost Protocol (Pvt) Ltd.
+ * @license Proprietary — (c) 2026 Ghost Protocol (Pvt) Ltd. All rights reserved. See LICENSE.
+ */
+import Database from 'better-sqlite3';
+import { readFileSync, realpathSync } from 'node:fs';
+import { homedir } from 'node:os';
+import { basename, dirname, isAbsolute, join, relative, resolve, sep } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { FailurePatterns, normalizeIdentity, STALE_ANCHOR_FLAG, } from './failure-patterns.js';
+import { LEGACY_ENVELOPE, runWithActor, sanitizeActorId } from './handlers/boundary.js';
+const SILENT = { exitCode: 0, stdout: '', stderr: '' };
+/** Tools whose signal is a file path (+ content). Mirrors wyrm-push.py. */
+const FILE_TOOLS = new Set(['Edit', 'Write', 'MultiEdit', 'NotebookEdit']);
+/** How many warn-context matches to render at most. */
+const WARN_MATCH_CAP = 3;
+/** Max levels walked up when resolving cwd → projects.path. */
+const PROJECT_WALK_LEVELS = 10;
+// ── small helpers (all pure) ────────────────────────────────────────────────
+function asString(v) {
+    return typeof v === 'string' && v.length > 0 ? v : null;
+}
+/** Strip control chars + cap length before stored text reaches hook output. */
+function clean(s, max) {
+    if (!s)
+        return '';
+    // eslint-disable-next-line no-control-regex
+    return s.replace(/[\x00-\x1f\x7f]/g, ' ').replace(/\s+/g, ' ').trim().slice(0, max);
+}
+/** Extract the deterministic check signal from a PreToolUse payload, or null
+ * when the payload is not ours to judge (wrong event/tool/shape → SILENT). */
+function extractSignal(payload) {
+    const event = payload['hook_event_name'];
+    if (event !== undefined && event !== 'PreToolUse')
+        return null;
+    const toolName = payload['tool_name'];
+    const input = payload['tool_input'];
+    if (typeof toolName !== 'string' || typeof input !== 'object' || input === null)
+        return null;
+    const toolInput = input;
+    const cwd = asString(payload['cwd']);
+    if (toolName === 'Bash') {
+        const command = asString(toolInput['command'])?.trim();
+        if (!command)
+            return null;
+        const capped = command.slice(0, 1000); // FTS probe + display stay bounded
+        return {
+            scopes: ['command'],
+            probeTarget: capped,
+            // Identity is the FULL command, uncapped: commands differing only past
+            // any cap are DIFFERENT actions, and the comparison cost is one linear
+            // normalize pass — the cap above bounds only the recall/display paths.
+            identity: [command],
+            display: clean(capped, 80),
+            startDir: cwd,
+            absPath: null,
+        };
+    }
+    if (FILE_TOOLS.has(toolName)) {
+        const filePath = asString(toolInput['file_path']) ?? asString(toolInput['notebook_path']);
+        if (!filePath)
+            return null;
+        // Content signal — extracted/shape-checked (see header for why it is not
+        // fed to the FTS probe).
+        const edits = toolInput['edits'];
+        const content = asString(toolInput['new_string'])
+            ?? asString(toolInput['content'])
+            ?? asString(toolInput['new_source'])
+            ?? (Array.isArray(edits)
+                ? edits.map((e) => asString(e?.['new_string']) ?? '').join(' ')
+                : '');
+        const abs = isAbsolute(filePath)
+            ? resolve(filePath)
+            : cwd && isAbsolute(cwd) ? resolve(cwd, filePath) : null;
+        return {
+            scopes: ['file', 'edit'],
+            probeTarget: basename(filePath).slice(0, 200),
+            // identity candidates: as-given + absolute, RAW and uncapped (same
+            // full-identity rule as the Bash candidate — deep paths must not alias
+            // at a truncation boundary); the project-relative form is appended in
+            // runGuard once the project root is known.
+            identity: dedupe([filePath, ...(abs ? [abs] : [])]),
+            display: clean(filePath, 80),
+            startDir: abs ? dirname(abs) : cwd,
+            absPath: abs,
+            content,
+        };
+    }
+    return null;
+}
+/** Dedupe identity candidates by their normalizeIdentity image (the form
+ * every identity comparison uses), keeping the first raw spelling. */
+function dedupe(xs) {
+    const seen = new Set();
+    const out = [];
+    for (const x of xs) {
+        const key = normalizeIdentity(x);
+        if (key.length === 0 || seen.has(key))
+            continue;
+        seen.add(key);
+        out.push(x);
+    }
+    return out;
+}
+/** Walk up from startDir matching projects.path (indexed UNIQUE lookup per
+ * level, ≤PROJECT_WALK_LEVELS). Unenrolled → null (global failures still apply). */
+function resolveProject(db, startDir) {
+    if (!startDir)
+        return { id: null, root: null };
+    const stmt = db.prepare('SELECT id FROM projects WHERE path = ?');
+    let p = resolve(startDir);
+    for (let i = 0; i < PROJECT_WALK_LEVELS; i++) {
+        const row = stmt.get(p);
+        if (row)
+            return { id: row.id, root: p };
+        const parent = dirname(p);
+        if (parent === p)
+            break;
+        p = parent;
+    }
+    return { id: null, root: null };
+}
+// ── rendering (plain ASCII — spec FR-3 renderer discipline) ─────────────────
+function attributionLine(m) {
+    if (m.recorded_by_agent === 'legacy' && m.run_id === null)
+        return '';
+    const run = m.run_id
+        ? ` (run ${clean(m.run_id, 32)}${m.quarantine_scope === 'run' ? ', run-quarantined' : ''})`
+        : '';
+    return `  recorded by: ${clean(m.recorded_by_agent, 64)}${run}\n`;
+}
+function renderBlock(m, reason, extra) {
+    const desc = m.description ? `  description: ${clean(m.description, 200)}\n` : '';
+    const why = m.why_failed ? `  failed because: ${clean(m.why_failed, 300)}\n` : '';
+    const reasonText = reason === 'exact'
+        ? 'this exact action is a recorded unresolved failure'
+        : reason === 'content'
+            ? 'this edit re-introduces the code of a recorded unresolved failure'
+            : 'this exact target previously failed and the failure is unresolved';
+    return (`wyrm-guard: BLOCKED — ${reasonText} (deterministic ${reason} match).\n` +
+        `  failure #${m.id} [${m.severity}/${m.scope}] seen ${m.occurrences}x, last ${clean(m.last_seen, 32)}\n` +
+        `  target: ${clean(m.target, 120)}\n` +
+        desc +
+        why +
+        attributionLine(m) +
+        'Do NOT retry the same action — pick a different approach. If the underlying\n' +
+        `issue is truly fixed, resolve the failure first (wyrm_failure_resolve id=${m.id})\n` +
+        'and then retry.\n' +
+        (extra > 0 ? `(+${extra} more recorded match${extra === 1 ? '' : 'es'} — wyrm_failure_list)\n` : ''));
+}
+function renderWarn(matches, display) {
+    const shown = matches.slice(0, WARN_MATCH_CAP);
+    const lines = shown.map((m) => {
+        const why = m.why_failed ?? m.description;
+        return `- #${m.id} [${m.severity}/${m.scope}] ${clean(m.target, 80)} ` +
+            `(seen ${m.occurrences}x, confidence ${m.confidence}): ${clean(why, 160)}` +
+            // Staleness oracle: a downgraded block surfaces here as a WARN carrying
+            // the SAME flag text the MCP verdict emits (stale_anchor).
+            (m.stale_anchor ? `\n  stale_anchor: ${m.stale_anchor}` : '');
+    });
+    const extra = matches.length - shown.length;
+    return [
+        '<wyrm-memory>',
+        `wyrm-guard: ${matches.length} recorded unresolved failure(s) look similar to \`${display}\` — check before proceeding:`,
+        ...lines,
+        ...(extra > 0 ? [`(+${extra} more — wyrm_failure_list)`] : []),
+        'If one applies, do not repeat it — adjust the approach or resolve it first (wyrm_failure_resolve).',
+        '</wyrm-memory>',
+    ].join('\n');
+}
+function warnResult(matches, display) {
+    const body = {
+        hookSpecificOutput: {
+            hookEventName: 'PreToolUse',
+            additionalContext: renderWarn(matches, display),
+        },
+    };
+    return { exitCode: 0, stdout: JSON.stringify(body) + '\n', stderr: '' };
+}
+// ── the guard ───────────────────────────────────────────────────────────────
+/**
+ * The whole guard as a pure-ish function of (stdin, env) — exported so tests
+ * exercise every path in-process. NEVER throws: any internal error returns
+ * SILENT (fail-open — a broken guard must never block the operator's harness).
+ */
+export function runGuard(stdinText, env = process.env) {
+    let db = null;
+    try {
+        const mode = (env.WYRM_GUARD_MODE ?? 'block').toLowerCase();
+        if (mode === 'off')
+            return SILENT;
+        if (!stdinText || !stdinText.trim())
+            return SILENT;
+        const parsed = JSON.parse(stdinText);
+        if (typeof parsed !== 'object' || parsed === null)
+            return SILENT;
+        const signal = extractSignal(parsed);
+        if (!signal)
+            return SILENT;
+        const dbPath = env.WYRM_DB_PATH ?? join(homedir(), '.wyrm', 'wyrm.db');
+        db = new Database(dbPath, { readonly: true, fileMustExist: true });
+        db.pragma('busy_timeout = 100'); // a locked DB fails open, never hangs the harness
+        const { id: projectId, root } = resolveProject(db, signal.startDir);
+        // Project-relative identity candidate for file probes (recorders commonly
+        // key file failures by relpath). RAW like every identity candidate.
+        const identity = [...signal.identity];
+        if (root && signal.absPath && signal.absPath.startsWith(root + sep)) {
+            identity.push(relative(root, signal.absPath));
+        }
+        // The caller's run identity — explicit (deterministic in (stdin, env)),
+        // honoring the same WYRM_RUN_ID convention the ambient envelope uses.
+        const callerRunId = sanitizeActorId(env.WYRM_RUN_ID) ?? null;
+        const failures = new FailurePatterns(db);
+        const seen = new Set();
+        const matches = [];
+        const identityCandidates = dedupe(identity);
+        // (a) The checkVerdict stages: the exact-signature tier + FTS fuzzy
+        // recall for the WARN context. Runs first so a genuine full-signature
+        // match keeps its 'exact' classification.
+        for (const scope of signal.scopes) {
+            try {
+                const verdict = failures.checkVerdict(scope, signal.probeTarget, '', projectId, { callerRunId });
+                for (const m of verdict.matches) {
+                    if (!seen.has(m.id)) {
+                        seen.add(m.id);
+                        matches.push(m);
+                    }
+                }
+            }
+            catch {
+                // e.g. a probe that sanitizes to an empty FTS query — skip this scope
+            }
+        }
+        // (b) The deterministic TARGET-IDENTITY tier (v7 F2 review fix): a
+        // dedicated description-independent signature-prefix lookup per identity
+        // candidate — production rows (whose descriptions are never empty) block
+        // on it. Candidates go in RAW: identity equality runs over the FULL
+        // normalizeIdentity forms, and the lookup filters identity before its
+        // result cap — so neither the 200-char signature cap nor higher-ranked
+        // same-prefix cousins (colon-extended npm scripts, URLs, host:port) can
+        // alias or crowd out an identical-target row. Stage (a)'s FTS LIMIT 5
+        // can still be crowded, but it only feeds WARN context — a block never
+        // depends on FTS recall.
+        for (const scope of signal.scopes) {
+            for (const cand of identityCandidates) {
+                try {
+                    for (const row of failures.targetIdentityMatches(scope, cand, projectId, { callerRunId })) {
+                        if (!seen.has(row.id)) {
+                            seen.add(row.id);
+                            matches.push(failures.toVerdictMatch(row, 'target'));
+                        }
+                    }
+                }
+                catch {
+                    // identity probe failure is never fatal — the other stages still ran
+                }
+            }
+        }
+        // (c) v7 Failure Firewall v2 — CONTENT tier (opt-in WYRM_GUARD_CONTENT): an
+        // Edit/Write whose code re-introduces a recorded failed pattern blocks even
+        // when the target path differs. Precision-gated in contentMatch; readonly;
+        // any error degrades to the path tiers above.
+        let contentHit = null;
+        if (signal.content && signal.scopes.includes('edit') &&
+            /^(1|true|yes|on)$/i.test(env.WYRM_GUARD_CONTENT ?? '')) {
+            try {
+                const row = failures.contentMatch(signal.content, 'edit', projectId);
+                if (row && !seen.has(row.id)) {
+                    seen.add(row.id);
+                    contentHit = failures.toVerdictMatch(row, 'target');
+                }
+            }
+            catch { /* content probe failure is never fatal */ }
+        }
+        if (matches.length === 0 && !contentHit)
+            return SILENT;
+        // Fuzzy→target upgrade set: FULL normalized identity forms — same truth
+        // predicate as targetIdentityMatches, so a fuzzy-recalled row upgrades to
+        // a block only on whole-string identity, never on a shared capped prefix.
+        const identitySet = new Set(identityCandidates.map((c) => normalizeIdentity(c)));
+        const RANK = { exact: 0, target: 1, content: 2 };
+        const blockers = [
+            ...matches
+                .map((m) => ({
+                m,
+                reason: m.match === 'exact'
+                    ? 'exact'
+                    : m.match === 'target' || identitySet.has(normalizeIdentity(m.target))
+                        ? 'target' : null,
+            }))
+                .filter((x) => x.reason !== null),
+            ...(contentHit ? [{ m: contentHit, reason: 'content' }] : []),
+        ]
+            // exact identity outranks target, target outranks content
+            .sort((a, b) => RANK[a.reason] - RANK[b.reason]);
+        // STALENESS ORACLE (migration 30, PROTOCOL.md §10.2.5) — the SAME shared
+        // helper the MCP failure_check handler calls (FailurePatterns.
+        // staleAnchorIds), so the two surfaces cannot drift: a file/symbol-scoped
+        // blocker whose anchored source has POSITIVELY drifted since its failure
+        // was recorded downgrades from BLOCK to WARN, carrying the stale_anchor
+        // flag. An exact-signature match keeps its block, and so does every
+        // command/edit-attempt match (code moving on does not unprove a command
+        // failure) — both enforced inside the helper. Latency: evaluated ONLY
+        // when blockers exist (blocks are rare and abort the tool call anyway),
+        // stat-only fast path per anchor, readonly handle — the clean/hot path
+        // does not change. Fail-open: no root / missing files / any error ⇒
+        // empty set ⇒ verdict unchanged.
+        let firmBlockers = blockers;
+        let warnMatches = matches;
+        if (blockers.length > 0 && root) {
+            try {
+                const stale = failures.staleAnchorIds(blockers.map((b) => b.m), root);
+                if (stale.size > 0) {
+                    firmBlockers = blockers.filter((b) => !stale.has(b.m.id));
+                    warnMatches = matches.map((m) => stale.has(m.id) ? { ...m, stale_anchor: STALE_ANCHOR_FLAG } : m);
+                }
+            }
+            catch {
+                // staleness is advisory — an oracle error never changes the verdict
+            }
+        }
+        if (firmBlockers.length > 0 && mode !== 'warn') {
+            const top = firmBlockers[0];
+            // v7 F2 review fix: count the prevented repeat (the FR-2 ROI number).
+            // The check connection stays READONLY; the block row rides a separate
+            // short-lived RW connection — strictly best-effort and fail-open.
+            try {
+                const rw = new Database(dbPath, { fileMustExist: true });
+                try {
+                    rw.pragma('busy_timeout = 50'); // a contended ledger is dropped, never waited on
+                    const agentId = sanitizeActorId(env.WYRM_AGENT_ID);
+                    const envelope = agentId !== null || callerRunId !== null
+                        ? { agent_id: agentId, run_id: callerRunId, source: 'env' }
+                        : LEGACY_ENVELOPE;
+                    runWithActor(envelope, () => new FailurePatterns(rw).recordBlock({
+                        blocked: true,
+                        matches: [top.m],
+                        recorded_by_agent: top.m.recorded_by_agent,
+                        run_id: top.m.run_id,
+                        confidence: top.m.confidence,
+                    }, projectId));
+                }
+                finally {
+                    rw.close();
+                }
+            }
+            catch {
+                // fail-open: analytics must never affect the block verdict
+            }
+            return {
+                exitCode: 2,
+                stdout: '',
+                stderr: renderBlock(top.m, top.reason, matches.length - 1),
+            };
+        }
+        return warnResult(warnMatches, signal.display);
+    }
+    catch (err) {
+        if (env.WYRM_GUARD_DEBUG === '1') {
+            const msg = err instanceof Error ? err.message : String(err);
+            return { exitCode: 0, stdout: '', stderr: `wyrm-guard: internal error (fail-open): ${clean(msg, 200)}\n` };
+        }
+        return SILENT;
+    }
+    finally {
+        try {
+            db?.close();
+        }
+        catch { /* readonly close failure is irrelevant */ }
+    }
+}
+// ── bin entry ───────────────────────────────────────────────────────────────
+// realpathSync so the npm bin symlink (wyrm-guard → dist/wyrm-guard.js) still
+// counts as "run directly"; importing this module (tests) never reads stdin.
+const __filename = fileURLToPath(import.meta.url);
+let isMain = false;
+try {
+    isMain = typeof process.argv[1] === 'string' && realpathSync(process.argv[1]) === __filename;
+}
+catch {
+    isMain = false;
+}
+if (isMain) {
+    let stdinText = '';
+    try {
+        stdinText = readFileSync(0, 'utf-8'); // fd 0 — blocks to EOF, like wyrm-push.py
+    }
+    catch {
+        stdinText = '';
+    }
+    const result = runGuard(stdinText);
+    if (result.stdout)
+        process.stdout.write(result.stdout);
+    if (result.stderr)
+        process.stderr.write(result.stderr);
+    process.exit(result.exitCode);
+}
+//# sourceMappingURL=wyrm-guard.js.map

package/dist/wyrm-guard.js.map

@@ -1 +1 @@
-{"version":3,"file":"wyrm-guard.js","sourceRoot":"","sources":["../src/wyrm-guard.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,eAAe,EACf,iBAAiB,GAGlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAaxF,MAAM,MAAM,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEpE,2EAA2E;AAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAE3E,uDAAuD;AACvD,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAuB/B,+EAA+E;AAE/E,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,+EAA+E;AAC/E,SAAS,KAAK,CAAC,CAA4B,EAAE,GAAW;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,4CAA4C;IAC5C,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;8EAC8E;AAC9E,SAAS,aAAa,CAAC,OAAgC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7F,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAErC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,mCAAmC;QAC1E,OAAO;YACL,MAAM,EAAE,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,MAAM;YACnB,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,yEAAyE;QACzE,yBAAyB;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,OAAO,GACX,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;eAC9B,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;eAC9B,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;eACjC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAE,CAAoC,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACnG,CAAC,CAAC,EAAE,CAAC,CAAC;QACV,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;YAC9B,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACnB,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,OAAO;YACL,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;YACxB,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC7C,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,2CAA2C;YAC3C,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC5B,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;YAClC,OAAO,EAAE,GAAG;YACZ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;sEACsE;AACtE,SAAS,MAAM,CAAC,EAAY;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;oFACoF;AACpF,SAAS,cAAc,CACrB,EAAqB,EACrB,QAAuB;IAEvB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAA+B,CAAC;QACtD,IAAI,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,CAAC;YAAE,MAAM;QACxB,CAAC,GAAG,MAAM,CAAC;IACb,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,+EAA+E;AAE/E,SAAS,eAAe,CAAC,CAAsB;IAC7C,IAAI,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM;QAClB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,GAAG;QAC3F,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,kBAAkB,KAAK,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,CAAsB,EAAE,MAAsC,EAAE,KAAa;IAChG,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,UAAU,GAAG,MAAM,KAAK,OAAO;QACnC,CAAC,CAAC,oDAAoD;QACtD,CAAC,CAAC,MAAM,KAAK,SAAS;YACpB,CAAC,CAAC,mEAAmE;YACrE,CAAC,CAAC,mEAAmE,CAAC;IAC1E,OAAO,CACL,yBAAyB,UAAU,mBAAmB,MAAM,YAAY;QACxE,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,WAAW,WAAW,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI;QACxG,aAAa,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;QACrC,IAAI;QACJ,GAAG;QACH,eAAe,CAAC,CAAC,CAAC;QAClB,+EAA+E;QAC/E,4EAA4E,CAAC,CAAC,EAAE,KAAK;QACrF,mBAAmB;QACnB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAA8B,EAAE,OAAe;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC;QAC1C,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG;YACpE,SAAS,CAAC,CAAC,WAAW,iBAAiB,CAAC,CAAC,UAAU,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,CAAC;IAC/E,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,OAAO;QACL,eAAe;QACf,eAAe,OAAO,CAAC,MAAM,qDAAqD,OAAO,+BAA+B;QACxH,GAAG,KAAK;QACR,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,oGAAoG;QACpG,gBAAgB;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,OAA8B,EAAE,OAAe;IACjE,MAAM,IAAI,GAAG;QACX,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;SAChD;KACF,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CACtB,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,EAAE,GAA6B,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5D,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QAClC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC;QAEnD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACjE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAiC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAE3B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACvE,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,kDAAkD;QAEnF,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE7D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5C,oEAAoE;QACpE,sEAAsE;QACtE,0CAA0C;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;gBACjG,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;wBAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;wBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,yBAAyB;QACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;wBAC1F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;4BAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;4BAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;wBAAC,CAAC;oBACpG,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,UAAU,GAA+B,IAAI,CAAC;QAClD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChD,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;gBACrE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAAC,UAAU,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAAC,CAAC;YAC1G,CAAC;YAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,MAAM,CAAC;QAEvD,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAW,CAAC;QAC1D,MAAM,QAAQ,GAAG;YACf,GAAG,OAAO;iBACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,CAAC;gBACD,MAAM,EAAE,CAAC,CAAC,KAAK,KAAK,OAAO;oBACzB,CAAC,CAAE,OAAiB;oBACpB,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;wBACpE,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAC,IAAI;aACjC,CAAC,CAAC;iBACF,MAAM,CAAC,CAAC,CAAC,EAA+D,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;YAChG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE;YACC,0DAA0D;aACzD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAEnD,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC3C,MAAM,GAAG,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxB,sEAAsE;YACtE,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzD,IAAI,CAAC;oBACH,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,iDAAiD;oBACjF,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBACnD,MAAM,QAAQ,GAAG,OAAO,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI;wBACvD,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAc,EAAE;wBACpE,CAAC,CAAC,eAAe,CAAC;oBACpB,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC,WAAW,CAC9D;wBACE,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChB,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,iBAAiB;wBAC1C,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM;wBACpB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU;qBAC7B,EACD,SAAS,CACV,CAAC,CAAC;gBACL,CAAC;wBAAS,CAAC;oBACT,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;aAC3D,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,gBAAgB,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,2CAA2C,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7G,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAE7E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI,MAAM,GAAG,KAAK,CAAC;AACnB,IAAI,CAAC;IACH,MAAM,GAAG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;AAC/F,CAAC;AAAC,MAAM,CAAC;IACP,MAAM,GAAG,KAAK,CAAC;AACjB,CAAC;AAED,IAAI,MAAM,EAAE,CAAC;IACX,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,0CAA0C;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC"}
+{"version":3,"file":"wyrm-guard.js","sourceRoot":"","sources":["../src/wyrm-guard.ts"],"names":[],"mappings":";AACA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgFG;AAEH,OAAO,QAAQ,MAAM,gBAAgB,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACrD,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AACxF,OAAO,EAAE,aAAa,EAAE,MAAM,UAAU,CAAC;AACzC,OAAO,EACL,eAAe,EACf,iBAAiB,EACjB,iBAAiB,GAGlB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,eAAe,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AAaxF,MAAM,MAAM,GAAgB,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAEpE,2EAA2E;AAC3E,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,WAAW,EAAE,cAAc,CAAC,CAAC,CAAC;AAE3E,uDAAuD;AACvD,MAAM,cAAc,GAAG,CAAC,CAAC;AACzB,+DAA+D;AAC/D,MAAM,mBAAmB,GAAG,EAAE,CAAC;AAuB/B,+EAA+E;AAE/E,SAAS,QAAQ,CAAC,CAAU;IAC1B,OAAO,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AAC1D,CAAC;AAED,+EAA+E;AAC/E,SAAS,KAAK,CAAC,CAA4B,EAAE,GAAW;IACtD,IAAI,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IAClB,4CAA4C;IAC5C,OAAO,CAAC,CAAC,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACtF,CAAC;AAED;8EAC8E;AAC9E,SAAS,aAAa,CAAC,OAAgC;IACrD,MAAM,KAAK,GAAG,OAAO,CAAC,iBAAiB,CAAC,CAAC;IACzC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,YAAY;QAAE,OAAO,IAAI,CAAC;IAC/D,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IACpC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7F,MAAM,SAAS,GAAG,KAAgC,CAAC;IACnD,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC;IAErC,IAAI,QAAQ,KAAK,MAAM,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvD,IAAI,CAAC,OAAO;YAAE,OAAO,IAAI,CAAC;QAC1B,MAAM,MAAM,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,mCAAmC;QAC1E,OAAO;YACL,MAAM,EAAE,CAAC,SAAS,CAAC;YACnB,WAAW,EAAE,MAAM;YACnB,uEAAuE;YACvE,uEAAuE;YACvE,uEAAuE;YACvE,QAAQ,EAAE,CAAC,OAAO,CAAC;YACnB,OAAO,EAAE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC;YAC1B,QAAQ,EAAE,GAAG;YACb,OAAO,EAAE,IAAI;SACd,CAAC;IACJ,CAAC;IAED,IAAI,UAAU,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,QAAQ,GAAG,QAAQ,CAAC,SAAS,CAAC,WAAW,CAAC,CAAC,IAAI,QAAQ,CAAC,SAAS,CAAC,eAAe,CAAC,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC;QAC3B,yEAAyE;QACzE,yBAAyB;QACzB,MAAM,KAAK,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;QACjC,MAAM,OAAO,GACX,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;eAC9B,QAAQ,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC;eAC9B,QAAQ,CAAC,SAAS,CAAC,YAAY,CAAC,CAAC;eACjC,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;gBACtB,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAE,CAAoC,EAAE,CAAC,YAAY,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;gBACnG,CAAC,CAAC,EAAE,CAAC,CAAC;QACV,MAAM,GAAG,GAAG,UAAU,CAAC,QAAQ,CAAC;YAC9B,CAAC,CAAC,OAAO,CAAC,QAAQ,CAAC;YACnB,CAAC,CAAC,GAAG,IAAI,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;QAC3D,OAAO;YACL,MAAM,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;YACxB,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC;YAC7C,mEAAmE;YACnE,uEAAuE;YACvE,sEAAsE;YACtE,2CAA2C;YAC3C,QAAQ,EAAE,MAAM,CAAC,CAAC,QAAQ,EAAE,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACnD,OAAO,EAAE,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC;YAC5B,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG;YAClC,OAAO,EAAE,GAAG;YACZ,OAAO;SACR,CAAC;IACJ,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;sEACsE;AACtE,SAAS,MAAM,CAAC,EAAY;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,KAAK,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC;QACnB,MAAM,GAAG,GAAG,iBAAiB,CAAC,CAAC,CAAC,CAAC;QACjC,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAS;QAChD,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACd,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;oFACoF;AACpF,SAAS,cAAc,CACrB,EAAqB,EACrB,QAAuB;IAEvB,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,IAAI,GAAG,EAAE,CAAC,OAAO,CAAC,wCAAwC,CAAC,CAAC;IAClE,IAAI,CAAC,GAAG,OAAO,CAAC,QAAQ,CAAC,CAAC;IAC1B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,mBAAmB,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAA+B,CAAC;QACtD,IAAI,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACxC,MAAM,MAAM,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,MAAM,KAAK,CAAC;YAAE,MAAM;QACxB,CAAC,GAAG,MAAM,CAAC;IACb,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;AAClC,CAAC;AAED,+EAA+E;AAE/E,SAAS,eAAe,CAAC,CAAsB;IAC7C,IAAI,CAAC,CAAC,iBAAiB,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrE,MAAM,GAAG,GAAG,CAAC,CAAC,MAAM;QAClB,CAAC,CAAC,SAAS,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,gBAAgB,KAAK,KAAK,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,EAAE,GAAG;QAC3F,CAAC,CAAC,EAAE,CAAC;IACP,OAAO,kBAAkB,KAAK,CAAC,CAAC,CAAC,iBAAiB,EAAE,EAAE,CAAC,GAAG,GAAG,IAAI,CAAC;AACpE,CAAC;AAED,SAAS,WAAW,CAAC,CAAsB,EAAE,MAAsC,EAAE,KAAa;IAChG,MAAM,IAAI,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,kBAAkB,KAAK,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,qBAAqB,KAAK,CAAC,CAAC,CAAC,UAAU,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAClF,MAAM,UAAU,GAAG,MAAM,KAAK,OAAO;QACnC,CAAC,CAAC,oDAAoD;QACtD,CAAC,CAAC,MAAM,KAAK,SAAS;YACpB,CAAC,CAAC,mEAAmE;YACrE,CAAC,CAAC,mEAAmE,CAAC;IAC1E,OAAO,CACL,yBAAyB,UAAU,mBAAmB,MAAM,YAAY;QACxE,cAAc,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,UAAU,CAAC,CAAC,WAAW,WAAW,KAAK,CAAC,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,IAAI;QACxG,aAAa,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI;QACrC,IAAI;QACJ,GAAG;QACH,eAAe,CAAC,CAAC,CAAC;QAClB,+EAA+E;QAC/E,4EAA4E,CAAC,CAAC,EAAE,KAAK;QACrF,mBAAmB;QACnB,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,uBAAuB,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,yBAAyB,CAAC,CAAC,CAAC,EAAE,CAAC,CACrG,CAAC;AACJ,CAAC;AAED,SAAS,UAAU,CAAC,OAA8B,EAAE,OAAe;IACjE,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,cAAc,CAAC,CAAC;IAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE;QAC5B,MAAM,GAAG,GAAG,CAAC,CAAC,UAAU,IAAI,CAAC,CAAC,WAAW,CAAC;QAC1C,OAAO,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG;YACpE,SAAS,CAAC,CAAC,WAAW,iBAAiB,CAAC,CAAC,UAAU,MAAM,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE;YAC1E,wEAAwE;YACxE,2DAA2D;YAC3D,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAClE,CAAC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;IAC5C,OAAO;QACL,eAAe;QACf,eAAe,OAAO,CAAC,MAAM,qDAAqD,OAAO,+BAA+B;QACxH,GAAG,KAAK;QACR,GAAG,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,4BAA4B,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC9D,oGAAoG;QACpG,gBAAgB;KACjB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,SAAS,UAAU,CAAC,OAA8B,EAAE,OAAe;IACjE,MAAM,IAAI,GAAG;QACX,kBAAkB,EAAE;YAClB,aAAa,EAAE,YAAY;YAC3B,iBAAiB,EAAE,UAAU,CAAC,OAAO,EAAE,OAAO,CAAC;SAChD;KACF,CAAC;IACF,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC1E,CAAC;AAED,+EAA+E;AAE/E;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CACtB,SAAiB,EACjB,MAAyB,OAAO,CAAC,GAAG;IAEpC,IAAI,EAAE,GAA6B,IAAI,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,CAAC,GAAG,CAAC,eAAe,IAAI,OAAO,CAAC,CAAC,WAAW,EAAE,CAAC;QAC5D,IAAI,IAAI,KAAK,KAAK;YAAE,OAAO,MAAM,CAAC;QAClC,IAAI,CAAC,SAAS,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE;YAAE,OAAO,MAAM,CAAC;QAEnD,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;QAC9C,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,MAAM,CAAC;QACjE,MAAM,MAAM,GAAG,aAAa,CAAC,MAAiC,CAAC,CAAC;QAChE,IAAI,CAAC,MAAM;YAAE,OAAO,MAAM,CAAC;QAE3B,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,OAAO,EAAE,SAAS,CAAC,CAAC;QACvE,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QACnE,EAAE,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,kDAAkD;QAEnF,MAAM,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,GAAG,cAAc,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;QACpE,0EAA0E;QAC1E,oEAAoE;QACpE,MAAM,QAAQ,GAAG,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,IAAI,IAAI,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,OAAO,CAAC,UAAU,CAAC,IAAI,GAAG,GAAG,CAAC,EAAE,CAAC;YACpE,QAAQ,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC;QAChD,CAAC;QAED,wEAAwE;QACxE,sEAAsE;QACtE,MAAM,WAAW,GAAG,eAAe,CAAC,GAAG,CAAC,WAAW,CAAC,IAAI,IAAI,CAAC;QAE7D,MAAM,QAAQ,GAAG,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC;QACzC,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,OAAO,GAA0B,EAAE,CAAC;QAC1C,MAAM,kBAAkB,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC;QAE5C,oEAAoE;QACpE,sEAAsE;QACtE,0CAA0C;QAC1C,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,IAAI,CAAC;gBACH,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,WAAW,EAAE,EAAE,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,CAAC;gBACjG,KAAK,MAAM,CAAC,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;oBAChC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;wBAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;wBAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;oBAAC,CAAC;gBAC3D,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,sEAAsE;YACxE,CAAC;QACH,CAAC;QAED,mEAAmE;QACnE,yEAAyE;QACzE,yEAAyE;QACzE,oEAAoE;QACpE,sEAAsE;QACtE,uEAAuE;QACvE,wEAAwE;QACxE,sEAAsE;QACtE,uEAAuE;QACvE,yBAAyB;QACzB,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;YAClC,KAAK,MAAM,IAAI,IAAI,kBAAkB,EAAE,CAAC;gBACtC,IAAI,CAAC;oBACH,KAAK,MAAM,GAAG,IAAI,QAAQ,CAAC,qBAAqB,CAAC,KAAK,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC;wBAC1F,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;4BAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;4BAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;wBAAC,CAAC;oBACpG,CAAC;gBACH,CAAC;gBAAC,MAAM,CAAC;oBACP,qEAAqE;gBACvE,CAAC;YACH,CAAC;QACH,CAAC;QACD,4EAA4E;QAC5E,4EAA4E;QAC5E,2EAA2E;QAC3E,8CAA8C;QAC9C,IAAI,UAAU,GAA+B,IAAI,CAAC;QAClD,IAAI,MAAM,CAAC,OAAO,IAAI,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;YAChD,oBAAoB,CAAC,IAAI,CAAC,GAAG,CAAC,kBAAkB,IAAI,EAAE,CAAC,EAAE,CAAC;YAC5D,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,QAAQ,CAAC,YAAY,CAAC,MAAM,CAAC,OAAO,EAAE,MAAM,EAAE,SAAS,CAAC,CAAC;gBACrE,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;oBAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;oBAAC,UAAU,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;gBAAC,CAAC;YAC1G,CAAC;YAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;QACxD,CAAC;QAED,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,UAAU;YAAE,OAAO,MAAM,CAAC;QAEvD,wEAAwE;QACxE,0EAA0E;QAC1E,0EAA0E;QAC1E,MAAM,WAAW,GAAG,IAAI,GAAG,CAAC,kBAAkB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC,EAAW,CAAC;QAC1D,MAAM,QAAQ,GAAG;YACf,GAAG,OAAO;iBACP,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBACX,CAAC;gBACD,MAAM,EAAE,CAAC,CAAC,KAAK,KAAK,OAAO;oBACzB,CAAC,CAAE,OAAiB;oBACpB,CAAC,CAAC,CAAC,CAAC,KAAK,KAAK,QAAQ,IAAI,WAAW,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;wBACpE,CAAC,CAAE,QAAkB,CAAC,CAAC,CAAC,IAAI;aACjC,CAAC,CAAC;iBACF,MAAM,CAAC,CAAC,CAAC,EAA+D,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,CAAC;YAChG,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,UAAU,EAAE,MAAM,EAAE,SAAkB,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;SACvE;YACC,0DAA0D;aACzD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;QAEnD,yEAAyE;QACzE,+DAA+D;QAC/D,0EAA0E;QAC1E,yEAAyE;QACzE,wEAAwE;QACxE,oEAAoE;QACpE,wEAAwE;QACxE,sEAAsE;QACtE,wEAAwE;QACxE,uEAAuE;QACvE,oEAAoE;QACpE,iCAAiC;QACjC,IAAI,YAAY,GAAG,QAAQ,CAAC;QAC5B,IAAI,WAAW,GAAG,OAAO,CAAC;QAC1B,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,EAAE,CAAC;YAChC,IAAI,CAAC;gBACH,MAAM,KAAK,GAAG,QAAQ,CAAC,cAAc,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;gBACtE,IAAI,KAAK,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;oBACnB,YAAY,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;oBAC1D,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAC9B,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,YAAY,EAAE,iBAAiB,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;gBACrE,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,oEAAoE;YACtE,CAAC;QACH,CAAC;QAED,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;YAC/C,MAAM,GAAG,GAAG,YAAY,CAAC,CAAC,CAAC,CAAC;YAC5B,sEAAsE;YACtE,sEAAsE;YACtE,kEAAkE;YAClE,IAAI,CAAC;gBACH,MAAM,EAAE,GAAG,IAAI,QAAQ,CAAC,MAAM,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;gBACzD,IAAI,CAAC;oBACH,EAAE,CAAC,MAAM,CAAC,mBAAmB,CAAC,CAAC,CAAC,iDAAiD;oBACjF,MAAM,OAAO,GAAG,eAAe,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;oBACnD,MAAM,QAAQ,GAAG,OAAO,KAAK,IAAI,IAAI,WAAW,KAAK,IAAI;wBACvD,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,EAAE,KAAc,EAAE;wBACpE,CAAC,CAAC,eAAe,CAAC;oBACpB,YAAY,CAAC,QAAQ,EAAE,GAAG,EAAE,CAAC,IAAI,eAAe,CAAC,EAAE,CAAC,CAAC,WAAW,CAC9D;wBACE,OAAO,EAAE,IAAI;wBACb,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;wBAChB,iBAAiB,EAAE,GAAG,CAAC,CAAC,CAAC,iBAAiB;wBAC1C,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,MAAM;wBACpB,UAAU,EAAE,GAAG,CAAC,CAAC,CAAC,UAAU;qBAC7B,EACD,SAAS,CACV,CAAC,CAAC;gBACL,CAAC;wBAAS,CAAC;oBACT,EAAE,CAAC,KAAK,EAAE,CAAC;gBACb,CAAC;YACH,CAAC;YAAC,MAAM,CAAC;gBACP,2DAA2D;YAC7D,CAAC;YACD,OAAO;gBACL,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,EAAE;gBACV,MAAM,EAAE,WAAW,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;aAC3D,CAAC;QACJ,CAAC;QACD,OAAO,UAAU,CAAC,WAAW,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;IACjD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,CAAC,gBAAgB,KAAK,GAAG,EAAE,CAAC;YACjC,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAC7D,OAAO,EAAE,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,2CAA2C,KAAK,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,EAAE,CAAC;QAC7G,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC;YAAS,CAAC;QACT,IAAI,CAAC;YAAC,EAAE,EAAE,KAAK,EAAE,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,0CAA0C,CAAC,CAAC;IAC3E,CAAC;AACH,CAAC;AAED,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAE7E,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,IAAI,MAAM,GAAG,KAAK,CAAC;AACnB,IAAI,CAAC;IACH,MAAM,GAAG,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,QAAQ,IAAI,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;AAC/F,CAAC;AAAC,MAAM,CAAC;IACP,MAAM,GAAG,KAAK,CAAC;AACjB,CAAC;AAED,IAAI,MAAM,EAAE,CAAC;IACX,IAAI,SAAS,GAAG,EAAE,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,0CAA0C;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,SAAS,GAAG,EAAE,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,QAAQ,CAAC,SAAS,CAAC,CAAC;IACnC,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,MAAM;QAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;AAChC,CAAC"}