@aligndottech/cli 0.48.0 → 0.50.0

package/dist/lib/share/preview.js

@@ -0,0 +1,72 @@
+/**
+ * L9: the text a person reads before anything leaves the machine. Plain text with no colour, so the
+ * CLI prints it, the confirmation prompt re-renders it from the stored payload, and `align_share`
+ * returns the SAME string to the agent. It is rendered from the payload objects `buildSharePayload`
+ * made, which are the objects that are sent: it cannot show one thing and send another.
+ *
+ * Judgements an agent relayed are listed under their own heading, so the person sees them before
+ * they leave. What stays local is named, so a missing verdict is a visible choice and not a surprise.
+ */
+import { visible } from './visible.js';
+const day = (iso) => iso.slice(0, 10);
+const quoted = (t) => (t ? `"${visible(t)}"` : 'another decision');
+function describe(s) {
+    const w = s.wire;
+    const when = day(w.judged_at);
+    switch (w.kind) {
+        case 'ratify': return `ratified by you (${when})`;
+        case 'conflict_verdict':
+            return `${w.value === 'false_positive' ? 'not a real conflict' : 'a real conflict'} with ${quoted(s.counterpartTitle)} (${when})`;
+        case 'check_verdict': return `check hit judged ${w.value === 'false_positive' ? 'a false alarm' : 'real'} (${when})`;
+        case 'supersede': return `replaces ${quoted(s.counterpartTitle)} (${when})`;
+        case 'not_a_decision': return `marked as not a decision (${when})`;
+        case 'note': return `note: "${visible(w.note ?? '')}" (${when})`;
+    }
+}
+function leftLocalLine(l) {
+    const noun = l.kind === 'conflict_verdict' ? 'conflict verdict' : l.kind === 'supersede' ? 'replaced mark' : l.kind.replace(/_/g, ' ');
+    return l.why === 'counterpart_not_shared'
+        ? `a ${noun} about ${quoted(l.counterpartTitle)}: that decision is not on your team graph`
+        : `an older ${noun}: a decision carries at most 50 judgements`;
+}
+const indent = (text, pad) => visible(text, { keepNewline: true }).split('\n').map((l) => `${pad}${l}`).join('\n');
+export function renderPreview(payloads, dest, opts = {}) {
+    const lines = [
+        `You are about to share ${payloads.length} decision${payloads.length === 1 ? '' : 's'} with your team.`,
+        '',
+    ];
+    payloads.forEach((p, i) => {
+        const ownJudgements = p.shown.filter((s) => s.via === 'cli');
+        const viaAgent = p.shown.filter((s) => s.via === 'mcp');
+        lines.push(`${i + 1}. ${visible(p.item.title)}${opts.updates?.has(p.localId) ? '  (update: you shared this before)' : ''}`);
+        lines.push(indent(p.item.raw_text, '   '));
+        lines.push(`   Source: ${visible(p.item.source_url)} (${visible(p.item.platform)})`);
+        if (!/^https?:\/\//i.test(p.item.source_url))
+            lines.push('   That source is a path or id on your machine, not a link your team can open.');
+        if (p.item.created_at)
+            lines.push(`   Decided: ${visible(p.item.created_at)}`);
+        if (opts.legacy?.has(p.localId)) {
+            lines.push(`   This was pushed before Align tracked shares, so sharing again may create a second copy. Retract the old one: align share --retract ${p.localId}`);
+        }
+        if (ownJudgements.length) {
+            lines.push('   Goes with it:');
+            for (const s of ownJudgements)
+                lines.push(`     - ${describe(s)}`);
+        }
+        for (const agent of [...new Set(viaAgent.map((s) => s.agentId ?? 'unknown'))]) {
+            lines.push(`   Recorded by your agent (${visible(agent)}):`);
+            for (const s of viaAgent.filter((x) => (x.agentId ?? 'unknown') === agent))
+                lines.push(`     - ${describe(s)}`);
+        }
+        if (p.leftLocal.length) {
+            lines.push('   Stays on this machine:');
+            for (const l of p.leftLocal)
+                lines.push(`     - ${leftLocalLine(l)}`);
+        }
+        lines.push('');
+    });
+    // The destination is the LAST thing printed, directly above the question, so it is what is read last.
+    lines.push('Nothing is sent until you say yes.', `To: ${visible(dest.workspace)} (${visible(dest.env)}) as ${visible(dest.email)}${dest.gateway ? `, via ${visible(dest.gateway)} (not the default for ${visible(dest.env)})` : ''}`);
+    return lines.join('\n');
+}
+//# sourceMappingURL=preview.js.map

package/dist/lib/share/preview.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preview.js","sourceRoot":"","sources":["../../../src/lib/share/preview.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAoBvC,MAAM,GAAG,GAAG,CAAC,GAAW,EAAU,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;AACtD,MAAM,MAAM,GAAG,CAAC,CAAgB,EAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC;AAE1F,SAAS,QAAQ,CAAC,CAAiB;IACjC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;IACjB,MAAM,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IAC9B,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;QACf,KAAK,QAAQ,CAAC,CAAC,OAAO,oBAAoB,IAAI,GAAG,CAAC;QAClD,KAAK,kBAAkB;YACrB,OAAO,GAAG,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iBAAiB,SAAS,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,IAAI,GAAG,CAAC;QACpI,KAAK,eAAe,CAAC,CAAC,OAAO,oBAAoB,CAAC,CAAC,KAAK,KAAK,gBAAgB,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,MAAM,KAAK,IAAI,GAAG,CAAC;QACrH,KAAK,WAAW,CAAC,CAAC,OAAO,YAAY,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,KAAK,IAAI,GAAG,CAAC;QAC5E,KAAK,gBAAgB,CAAC,CAAC,OAAO,6BAA6B,IAAI,GAAG,CAAC;QACnE,KAAK,MAAM,CAAC,CAAC,OAAO,UAAU,OAAO,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,MAAM,IAAI,GAAG,CAAC;IACnE,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,CAAY;IACjC,MAAM,IAAI,GAAG,CAAC,CAAC,IAAI,KAAK,kBAAkB,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;IACvI,OAAO,CAAC,CAAC,GAAG,KAAK,wBAAwB;QACvC,CAAC,CAAC,KAAK,IAAI,UAAU,MAAM,CAAC,CAAC,CAAC,gBAAgB,CAAC,2CAA2C;QAC1F,CAAC,CAAC,YAAY,IAAI,4CAA4C,CAAC;AACnE,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,IAAY,EAAE,GAAW,EAAU,EAAE,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAE3I,MAAM,UAAU,aAAa,CAAC,QAAiC,EAAE,IAAiB,EAAE,OAAuB,EAAE;IAC3G,MAAM,KAAK,GAAa;QACtB,0BAA0B,QAAQ,CAAC,MAAM,YAAY,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,kBAAkB;QACvG,EAAE;KACH,CAAC;IACF,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;QACxB,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QAC7D,MAAM,QAAQ,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,KAAK,KAAK,CAAC,CAAC;QACxD,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,oCAAoC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC5H,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;QAC3C,KAAK,CAAC,IAAI,CAAC,cAAc,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QACrF,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,gFAAgF,CAAC,CAAC;QAC3I,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU;YAAE,KAAK,CAAC,IAAI,CAAC,eAAe,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;QAC/E,IAAI,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC;YAChC,KAAK,CAAC,IAAI,CAAC,yIAA2I,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QACrK,CAAC;QACD,IAAI,aAAa,CAAC,MAAM,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;YAC/B,KAAK,MAAM,CAAC,IAAI,aAAa;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACrE,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;YAC9E,KAAK,CAAC,IAAI,CAAC,8BAA8B,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAC7D,KAAK,MAAM,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,SAAS,CAAC,KAAK,KAAK,CAAC;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClH,CAAC;QACD,IAAI,CAAC,CAAC,SAAS,CAAC,MAAM,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,2BAA2B,CAAC,CAAC;YACxC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,SAAS;gBAAE,KAAK,CAAC,IAAI,CAAC,UAAU,aAAa,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC,CAAC,CAAC;IACH,sGAAsG;IACtG,KAAK,CAAC,IAAI,CAAC,oCAAoC,EAAE,OAAO,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,yBAAyB,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IACtO,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/lib/share/run.d.ts

@@ -0,0 +1,115 @@
+/**
+ * L9: the share flow with no I/O of its own beyond the injected client: select, build, scan, price
+ * the preview, send, read the answer, record the ledger. `align share`, `align share --confirm` and
+ * `align_share` all call it, so the three cannot disagree about what a share is.
+ *
+ * Order, and why: the secret scan runs on the payload that will be SENT (a refusal names the decision,
+ * the field and the placeholder, never the match); an item already shared with an unchanged payload
+ * is "already shared" and makes no call; only then is anything previewed. Nothing here sends without
+ * the caller having passed `send`, and `prepare` never calls the network except `whoami` (a read).
+ */
+import { type Judge } from '../curation/judgements-db.js';
+import { type DecisionRow } from '../local-db.js';
+import { type Promotion } from './ledger.js';
+import { type SharePayload } from './payload.js';
+import { type Destination } from './preview.js';
+import { type SecretFinding } from './secret-scan.js';
+import { type BatchResponse, type ItemOutcome } from './wire.js';
+export interface TeamDecision {
+    title?: string;
+    summary?: string;
+    /** The decision's AI payload: the server's team-text hash also covers its statements, Gherkin and acceptance criteria. */
+    decision_json?: {
+        ai?: {
+            decisions?: unknown;
+            gherkin?: unknown;
+            acceptance_criteria?: unknown;
+        };
+    } | null;
+}
+export interface ShareClient {
+    whoami(): Promise<{
+        user: {
+            email: string;
+        };
+        tenant: {
+            id: string;
+            name: string;
+        };
+    }>;
+    shareBatch(items: Array<Record<string, unknown>>): Promise<BatchResponse>;
+    getDecision(id: string): Promise<TeamDecision>;
+    archiveDecision(id: string): Promise<void>;
+}
+export interface ShareContext {
+    dbPath: string;
+    envName: string;
+    client: ShareClient;
+    judge: Judge;
+    /** This install's private share salt (see salt.ts): never sent anywhere, not the telemetry install id. */
+    salt: string;
+    /** Where the share goes. Shown whenever it is not the environment's default, and bound into a confirmation code. */
+    gatewayUrl: string;
+    /** The default gateway URL for this environment, to tell an override from the norm. */
+    defaultGatewayUrl: string;
+}
+export declare class ShareError extends Error {
+    readonly exitCode: number;
+    constructor(message: string, exitCode?: number);
+}
+export interface Prepared {
+    payloads: SharePayload[];
+    dest: Destination;
+    tenantId: string;
+    gatewayUrl: string;
+    /** What this machine knew of each payload before: its ledger row, if any (live or retracted). */
+    priors: Map<string, Promotion | null>;
+    /** Decisions whose payload is unchanged since the last share: nothing to send. */
+    already: Array<{
+        localId: string;
+        title: string;
+        remoteId: string;
+    }>;
+    secrets: Array<SecretFinding & {
+        localId: string;
+    }>;
+    preview: string;
+}
+/** Batches of at most this many items: 10 x the gateway's 50 judgements per item stays under its 500 per request. */
+export declare const SHARE_BATCH_ITEMS = 10;
+export declare function ratifiedRows(dbPath: string, opts?: {
+    owner?: string;
+    sinceIso?: string;
+}): DecisionRow[];
+export declare function prepare(ctx: ShareContext, ids: string[]): Promise<Prepared>;
+/** The refusal text: where, which kind, never the value. */
+export declare function secretRefusal(secrets: Prepared['secrets']): string;
+export type RowResult = {
+    localId: string;
+    title: string;
+    outcome: ItemOutcome;
+    judgementFailures: Array<{
+        index: number;
+        error: string;
+    }>;
+    /** Things the person must know that are not failures (an older gateway, a share treated as not yours to retract). */
+    warnings: string[];
+};
+export interface SendHooks {
+    /** A matched share whose ratify/supersede wait on the team's text: show it, return whether the person agrees. */
+    confirmTeamText?: (info: {
+        localId: string;
+        title: string;
+        team: TeamDecision;
+    }) => Promise<boolean>;
+}
+export declare function send(ctx: ShareContext, prep: Prepared, hooks?: SendHooks): Promise<RowResult[]>;
+/** Every field the server's team-text hash covers, so what the person confirms is what the hash pins. */
+export declare function renderTeamText(team: TeamDecision): string;
+export declare function renderResults(rows: readonly RowResult[]): string;
+export interface RetractResult {
+    ok: boolean;
+    message: string;
+}
+export declare function retract(ctx: ShareContext, localId: string): Promise<RetractResult>;
+//# sourceMappingURL=run.d.ts.map

package/dist/lib/share/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/lib/share/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAkB,KAAK,KAAK,EAAkB,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAgF,KAAK,SAAS,EAA0D,MAAM,aAAa,CAAC;AAEnL,OAAO,EAAmC,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAiD,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,KAAK,aAAa,EAAoB,KAAK,WAAW,EAAsC,MAAM,WAAW,CAAC;AAEvH,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0HAA0H;IAC1H,aAAa,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC3G;AAED,MAAM,WAAW,WAAW;IAC1B,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IACrF,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,0GAA0G;IAC1G,IAAI,EAAE,MAAM,CAAC;IACb,oHAAoH;IACpH,UAAU,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,UAAW,SAAQ,KAAK;IACN,QAAQ,CAAC,QAAQ;gBAAlC,OAAO,EAAE,MAAM,EAAW,QAAQ,SAAI;CACnD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;IACtC,kFAAkF;IAClF,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,OAAO,EAAE,KAAK,CAAC,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qHAAqH;AACrH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,EAAE,CAO5G;AAED,wBAAsB,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAgEjF;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,MAAM,CAGlE;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IACrD,iBAAiB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,qHAAqH;IACrH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,iHAAiH;IACjH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;CACtG;AAyCD,wBAAsB,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAE,SAAc,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CAsDzG;AAED,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAQzD;AASD,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAmBhE;AAED,MAAM,WAAW,aAAa;IAAG,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAE/D,wBAAsB,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAaxF"}

package/dist/lib/share/run.js

@@ -0,0 +1,261 @@
+/**
+ * L9: the share flow with no I/O of its own beyond the injected client: select, build, scan, price
+ * the preview, send, read the answer, record the ledger. `align share`, `align share --confirm` and
+ * `align_share` all call it, so the three cannot disagree about what a share is.
+ *
+ * Order, and why: the secret scan runs on the payload that will be SENT (a refusal names the decision,
+ * the field and the placeholder, never the match); an item already shared with an unchanged payload
+ * is "already shared" and makes no call; only then is anything previewed. Nothing here sends without
+ * the caller having passed `send`, and `prepare` never calls the network except `whoami` (a read).
+ */
+import { existingTitles, listJudgements } from '../curation/judgements-db.js';
+import { createLocalDb } from '../local-db.js';
+import { getLegacyPromotion, getPromotion, ledgerReady, listPromotions, markRetracted, recordPromotion, recordPromotions } from './ledger.js';
+import { visible } from './visible.js';
+import { buildSharePayload, clientKeyFor } from './payload.js';
+import { renderPreview } from './preview.js';
+import { scanForSecrets, scanHiddenText, scanSourceUrl } from './secret-scan.js';
+import { failedJudgements, readOutcomes } from './wire.js';
+export class ShareError extends Error {
+    exitCode;
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.exitCode = exitCode;
+        this.name = 'ShareError';
+    }
+}
+/** Batches of at most this many items: 10 x the gateway's 50 judgements per item stays under its 500 per request. */
+export const SHARE_BATCH_ITEMS = 10;
+export function ratifiedRows(dbPath, opts = {}) {
+    const db = createLocalDb(dbPath);
+    try {
+        return db.listDecisions().filter((r) => r.ratifiedAt !== null
+            && (opts.owner === undefined || r.ratifiedBy === opts.owner)
+            && (opts.sinceIso === undefined || r.ratifiedAt >= opts.sinceIso));
+    }
+    finally {
+        db.close();
+    }
+}
+export async function prepare(ctx, ids) {
+    const who = await ctx.client.whoami();
+    const tenantId = who.tenant.id;
+    const dest = {
+        workspace: who.tenant.name, env: ctx.envName, email: who.user.email,
+        ...(ctx.gatewayUrl !== ctx.defaultGatewayUrl ? { gateway: ctx.gatewayUrl } : {}),
+    };
+    const rows = [];
+    const db = createLocalDb(ctx.dbPath);
+    try {
+        for (const id of ids) {
+            const row = db.getDecisionById(id);
+            if (!row)
+                throw new ShareError(`No decision ${visible(id)} in your local graph. \`align decisions list\` shows what is there.`);
+            if (!row.ratifiedAt)
+                throw new ShareError(`${visible(id)} has not been ratified, so it stays a claim on this machine.\n  A human stands behind it first: align ratify ${visible(id)}`);
+            rows.push(row);
+        }
+    }
+    finally {
+        db.close();
+    }
+    // The graph was just opened (which repairs an older v10); refuse BEFORE any request if the ledger is still not usable.
+    if (!ledgerReady(ctx.dbPath))
+        throw new ShareError('Your local graph\'s record of shares is not in the expected shape, so nothing was sent. Run `align local status` once, or update the CLI.');
+    const shared = listPromotions(ctx.dbPath, ctx.envName, tenantId);
+    const remoteIdOf = (id) => shared.get(id)?.remoteId;
+    const payloads = [];
+    const priors = new Map();
+    const already = [];
+    const secrets = [];
+    const updates = new Set();
+    const legacy = new Set();
+    for (const row of rows) {
+        const mine = listJudgements(ctx.dbPath, ctx.judge.judgeId, row.id);
+        const others = [...new Set(mine.flatMap((j) => [j.decision_id, j.counterpart_id]).filter((x) => x !== null && x !== row.id))];
+        const titles = existingTitles(ctx.dbPath, others);
+        const prior = getPromotion(ctx.dbPath, row.id, ctx.envName, tenantId);
+        priors.set(row.id, prior);
+        const live = prior !== null && prior.retractedAt === null;
+        // A live row with no stored key came from an earlier test build of this branch, whose key was derived another
+        // way. Re-deriving it now could mint a SECOND team decision, so the share stops and names the way out.
+        if (live && prior.clientKey === '') {
+            throw new ShareError(`${visible(row.id)} was shared by an earlier build that did not record its key, so sharing it again could create a second copy.\n  Retract the old one, then share again: align share --retract ${visible(row.id)}`);
+        }
+        const p = buildSharePayload({
+            row, judgements: mine, remoteIdOf, titleOf: (id) => titles.get(id) ?? null,
+            // The key is minted ONCE and reused, so a twin fold (a new local id) cannot create a second team decision.
+            clientKey: prior && prior.clientKey !== '' ? prior.clientKey : clientKeyFor(ctx.salt, row.id),
+            salt: ctx.salt,
+            alreadySent: new Set(live ? prior.sent : []),
+        });
+        let note = 0;
+        const fields = [
+            { field: 'title', text: p.item.title }, { field: 'summary', text: p.item.summary }, { field: 'platform', text: p.item.platform },
+            ...p.item.judgements.map((j) => ({ field: j.kind === 'note' ? `note ${++note}` : j.kind, text: j.note })),
+        ];
+        for (const f of [...scanForSecrets(fields), ...scanHiddenText([...fields, { field: 'raw_text', text: p.item.raw_text }, { field: 'source_url', text: p.item.source_url }])])
+            secrets.push({ ...f, localId: row.id });
+        for (const f of scanSourceUrl(p.item.source_url))
+            secrets.push({ ...f, localId: row.id });
+        if (live) {
+            if (prior.contentHash === p.fullHash && p.item.judgements.length === 0 && !prior.confirmPending) {
+                already.push({ localId: row.id, title: row.title, remoteId: prior.remoteId });
+                continue;
+            }
+            updates.add(row.id);
+        }
+        else if (!prior && getLegacyPromotion(ctx.dbPath, row.id, ctx.envName))
+            legacy.add(row.id);
+        payloads.push(p);
+    }
+    return { payloads, dest, tenantId, gatewayUrl: ctx.gatewayUrl, priors, already, secrets, preview: renderPreview(payloads, dest, { updates, legacy }) };
+}
+/** The refusal text: where, which kind, never the value. */
+export function secretRefusal(secrets) {
+    const lines = secrets.map((s) => `  ${visible(s.localId)}: ${visible(s.field)} ${s.placeholder === '<HIDDEN_TEXT>' ? 'contains hidden tag characters (invisible text)' : `looks like ${s.placeholder}`}`);
+    return `Nothing was sent: part of what would be shared looks like a credential or holds hidden text.\n${lines.join('\n')}\n  Edit it out of the decision, then share again.`;
+}
+async function postBatch(ctx, batch) {
+    const res = await ctx.client.shareBatch(batch.map((p) => ({ ...p.item })));
+    return readOutcomes(batch.length, res);
+}
+/** The judgements the gateway reported as stored, by hash. A null report stores nothing we can name. */
+function storedHashes(p, results) {
+    if (results === null)
+        return [];
+    return p.shown.flatMap((s, i) => (results[i]?.ok === true ? [s.hash] : []));
+}
+/**
+ * The ledger row an outcome implies, from the FIRST response alone, or null when nothing was written
+ * (refused, unknown). Matched and skipped rows are `matched` (not ours to archive); an update of something
+ * this machine never shared is treated the same way, with a warning.
+ */
+function initialRow(ctx, prep, it) {
+    const { p, outcome } = it;
+    const base = { localId: p.localId, env: ctx.envName, tenantId: prep.tenantId, contentHash: p.fullHash, clientKey: p.item.client_key, sent: [...it.stored], confirmPending: it.confirmPending };
+    switch (outcome.kind) {
+        case 'created': return { ...base, remoteId: outcome.remoteId, matched: outcome.uncertain };
+        case 'updated': return { ...base, remoteId: outcome.remoteId, matched: it.live ? it.prior.matched : true };
+        case 'matched': return { ...base, remoteId: outcome.remoteId, matched: true };
+        case 'skipped': return { ...base, remoteId: outcome.remoteId, matched: true };
+        default: return null;
+    }
+}
+export async function send(ctx, prep, hooks = {}) {
+    const results = [];
+    for (let at = 0; at < prep.payloads.length; at += SHARE_BATCH_ITEMS) {
+        const batch = prep.payloads.slice(at, at + SHARE_BATCH_ITEMS);
+        const outcomes = await postBatch(ctx, batch);
+        const items = batch.map((p, k) => {
+            const outcome = outcomes[k];
+            const prior = prep.priors.get(p.localId) ?? null;
+            const live = prior !== null && prior.retractedAt === null;
+            const it = { p, outcome, live, prior, stored: new Set(live ? prior.sent : []), warnings: [], confirmPending: false, failures: 'judgements' in outcome ? failedJudgements(outcome.judgements) : [] };
+            if ('judgements' in outcome)
+                for (const h of storedHashes(p, outcome.judgements))
+                    it.stored.add(h);
+            if ('judgements' in outcome && outcome.judgements === null && p.item.judgements.length > 0) {
+                it.warnings.push(`this gateway did not report what happened to your ${p.item.judgements.map((j) => j.kind).join(', ')}: they were not stored as far as can be told, so they stay unsent here and your ratify was not stored by this gateway. Check your team graph.`);
+            }
+            if (outcome.kind === 'created' && outcome.uncertain)
+                it.warnings.push('this gateway cannot tell new from existing (it is older than share matching), so this is recorded as not yours to retract.');
+            if (outcome.kind === 'updated' && !live)
+                it.warnings.push('the gateway answered this as an existing team decision, so it is recorded as not yours to retract.');
+            if (outcome.kind === 'matched')
+                it.confirmPending = outcome.needsConfirmation.length > 0;
+            return it;
+        });
+        // Record EVERY item the first response named, in ONE write, before anything that can throw (the team-text
+        // fetch, the confirmation re-post, a later batch): a 502 or a kill after this point cannot orphan a
+        // decision that now exists on the team graph and is retractable only through this row.
+        recordPromotions(ctx.dbPath, items.flatMap((it) => { const r = initialRow(ctx, prep, it); return r ? [r] : []; }));
+        for (const it of items) {
+            const { p, outcome } = it;
+            if (outcome.kind === 'matched' && outcome.needsConfirmation.length > 0) {
+                let team = null;
+                if (outcome.teamTextHash && hooks.confirmTeamText)
+                    team = await ctx.client.getDecision(outcome.remoteId).catch(() => null);
+                if (team !== null && !('decision_json' in team)) {
+                    it.warnings.push('the team\'s full text could not be read from this gateway, so your ratify was not confirmed.');
+                    team = null;
+                }
+                const agreed = team !== null && await hooks.confirmTeamText({ localId: p.localId, title: p.item.title, team });
+                if (agreed) {
+                    // Re-post ONLY what waited: a note or check verdict already stored must not be posted a second time.
+                    const need = new Set(outcome.needsConfirmation.map((n) => n.judgement_index));
+                    const waiting = p.shown.filter((_, i) => need.has(i));
+                    const again = { ...p, shown: waiting, item: { ...p.item, judgements: waiting.map((s) => ({ ...s.wire, confirm_team_text_hash: outcome.teamTextHash })) } };
+                    const second = (await postBatch(ctx, [again]))[0];
+                    if (second.kind === 'matched') {
+                        for (const h of storedHashes(again, second.judgements))
+                            it.stored.add(h);
+                        it.failures = failedJudgements(second.judgements);
+                        it.confirmPending = it.failures.length > 0;
+                        const row = initialRow(ctx, prep, it);
+                        if (row)
+                            recordPromotion(ctx.dbPath, row);
+                    }
+                }
+            }
+            if (outcome.kind === 'matched')
+                it.failures = it.failures.filter((f) => f.error !== 'needs_confirmation' || it.confirmPending);
+            results.push({ localId: p.localId, title: p.item.title, outcome, judgementFailures: it.failures, warnings: it.warnings });
+        }
+    }
+    return results;
+}
+/** Every field the server's team-text hash covers, so what the person confirms is what the hash pins. */
+export function renderTeamText(team) {
+    const ai = team.decision_json?.ai ?? {};
+    const show = (v) => (v === undefined || v === null ? '(none)' : typeof v === 'string' ? v : Array.isArray(v) ? v.map((x) => `- ${typeof x === 'string' ? x : JSON.stringify(x)}`).join('\n') : JSON.stringify(v));
+    const block = (label, v) => `  ${label}:\n${visible(show(v), { keepNewline: true }).split('\n').map((l) => `    ${l}`).join('\n')}`;
+    return [
+        block('Title', team.title ?? ''), block('Summary', team.summary ?? ''), block('Decisions', ai.decisions),
+        block('Gherkin', ai.gherkin), block('Acceptance criteria', ai.acceptance_criteria),
+    ].join('\n');
+}
+const FAIL_TEXT = {
+    needs_confirmation: 'waits for you to confirm the team\'s text (run the share again and answer yes)',
+    team_text_changed: 'the team\'s text changed while you were looking; share again',
+    ratification_not_permitted: 'your role may not ratify here',
+    decision_not_found: 'the other decision is not visible to you',
+};
+export function renderResults(rows) {
+    const lines = [];
+    for (const r of rows) {
+        const o = r.outcome;
+        const head = (() => {
+            switch (o.kind) {
+                case 'created': return o.ambiguous ? `shared as new (several team decisions share this source, so it was not matched): ${visible(o.remoteId)}` : `created: ${visible(o.remoteId)}`;
+                case 'updated': return `updated: ${visible(o.remoteId)}`;
+                case 'matched': return `matched an existing team decision (${visible(o.remoteId)}); your judgements were added, its text is untouched`;
+                case 'skipped': return `left alone (${visible(o.reason)}): ${visible(o.remoteId)}`;
+                case 'refused': return `refused by the server (${visible(o.reason)})`;
+                case 'unknown': return 'the server did not say what happened to it; check your team graph before sharing again';
+            }
+        })();
+        lines.push(`  ${visible(r.title)}\n    ${head}`);
+        for (const w of r.warnings)
+            lines.push(`    note: ${visible(w)}`);
+        for (const f of r.judgementFailures)
+            lines.push(`    judgement ${f.index + 1} not stored: ${FAIL_TEXT[f.error] ?? visible(f.error)}`);
+    }
+    return lines.join('\n');
+}
+export async function retract(ctx, localId) {
+    const who = await ctx.client.whoami();
+    const row = getPromotion(ctx.dbPath, localId, ctx.envName, who.tenant.id);
+    if (!row || row.retractedAt !== null) {
+        if (getLegacyPromotion(ctx.dbPath, localId, ctx.envName))
+            return { ok: false, message: `${localId} was pushed before Align tracked workspaces, so it cannot be retracted from here. Archive it on your team graph.` };
+        return { ok: false, message: `Nothing to retract: ${localId} was not shared to ${who.tenant.name} (${ctx.envName}) from this machine.` };
+    }
+    if (row.matched) {
+        return { ok: false, message: `${localId} attached to a decision your team already held (${row.remoteId}). Retracting would archive THEIR decision, so nothing was done.` };
+    }
+    await ctx.client.archiveDecision(row.remoteId);
+    markRetracted(ctx.dbPath, localId, ctx.envName, who.tenant.id);
+    return { ok: true, message: `Retracted: ${row.remoteId} is archived on your team graph.` };
+}
+//# sourceMappingURL=run.js.map

package/dist/lib/share/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/lib/share/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAc,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAoB,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAuC,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnL,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAqB,MAAM,cAAc,CAAC;AAClF,OAAO,EAAoB,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAsB,gBAAgB,EAA0C,YAAY,EAAE,MAAM,WAAW,CAAC;AA6BvH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACG;IAAtC,YAAY,OAAe,EAAW,WAAW,CAAC;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAA/B,aAAQ,GAAR,QAAQ,CAAI;QAAoB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAAC,CAAC;CAClG;AAeD,qHAAqH;AACrH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAA8C,EAAE;IAC3F,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI;eACxD,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC;eACzD,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAiB,EAAE,GAAa;IAC5D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAgB;QACxB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK;QACnE,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC;IACF,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,UAAU,CAAC,eAAe,OAAO,CAAC,EAAE,CAAC,qEAAqE,CAAC,CAAC;YAChI,IAAI,CAAC,GAAG,CAAC,UAAU;gBAAE,MAAM,IAAI,UAAU,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,gHAAgH,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvL,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACzB,uHAAuH;IACvH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,2IAA2I,CAAC,CAAC;IAEhM,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3I,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;QAC1D,8GAA8G;QAC9G,uGAAuG;QACvG,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,gLAAgL,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5O,CAAC;QACD,MAAM,CAAC,GAAG,iBAAiB,CAAC;YAC1B,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI;YAC1E,2GAA2G;YAC3G,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7F,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG;YACb,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE;YAChI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC1G,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrN,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAChG,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC9E,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACzJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,OAA4B;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,eAAe,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1M,OAAO,iGAAiG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD,CAAC;AAC/K,CAAC;AAcD,KAAK,UAAU,SAAS,CAAC,GAAiB,EAAE,KAAqB;IAC/D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,wGAAwG;AACxG,SAAS,YAAY,CAAC,CAAe,EAAE,OAAiC;IACtE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC;AAaD;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAiB,EAAE,IAAc,EAAE,EAAQ;IAC7D,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,cAAc,EAAE,CAAC;IAC/L,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3F,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5G,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,GAAiB,EAAE,IAAc,EAAE,QAAmB,EAAE;IACjF,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,iBAAiB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAW,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;YACjD,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;YAC1D,MAAM,EAAE,GAAS,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1M,IAAI,YAAY,IAAI,OAAO;gBAAE,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC;oBAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3F,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+IAA+I,CAAC,CAAC;YACxQ,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS;gBAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,4HAA4H,CAAC,CAAC;YACpM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI;gBAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;YAChK,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,EAAE,CAAC,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;YACzF,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,0GAA0G;QAC1G,oGAAoG;QACpG,uFAAuF;QACvF,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnH,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvE,IAAI,IAAI,GAAwB,IAAI,CAAC;gBACrC,IAAI,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe;oBAAE,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3H,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,eAAe,IAAI,IAAI,CAAC,EAAE,CAAC;oBAChD,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;oBACjH,IAAI,GAAG,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,eAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChH,IAAI,MAAM,EAAE,CAAC;oBACX,qGAAqG;oBACrG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;oBAC9E,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBACtD,MAAM,KAAK,GAAiB,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,sBAAsB,EAAE,OAAO,CAAC,YAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC1K,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;oBACnD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBAC9B,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC;4BAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBACzE,EAAE,CAAC,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;wBAClD,EAAE,CAAC,cAAc,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;wBAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;wBACtC,IAAI,GAAG;4BAAE,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,EAAE,CAAC,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC;YAC/H,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAAC,IAAkB;IAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnO,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,CAAU,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrJ,OAAO;QACL,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,SAAS,CAAC;QACxG,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,mBAAmB,CAAC;KACnF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,SAAS,GAA2B;IACxC,kBAAkB,EAAE,gFAAgF;IACpG,iBAAiB,EAAE,8DAA8D;IACjF,0BAA0B,EAAE,+BAA+B;IAC3D,kBAAkB,EAAE,0CAA0C;CAC/D,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE;YACzB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oFAAoF,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnL,KAAK,SAAS,CAAC,CAAC,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,KAAK,SAAS,CAAC,CAAC,OAAO,sCAAsC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;gBACvI,KAAK,SAAS,CAAC,CAAC,OAAO,eAAe,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnF,KAAK,SAAS,CAAC,CAAC,OAAO,0BAA0B,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACtE,KAAK,SAAS,CAAC,CAAC,OAAO,wFAAwF,CAAC;YAClH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB;YAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,GAAG,CAAC,gBAAgB,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAiB,EAAE,OAAe;IAC9D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACrC,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,kHAAkH,EAAE,CAAC;QACtN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,OAAO,sBAAsB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,sBAAsB,EAAE,CAAC;IAC3I,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,mDAAmD,GAAG,CAAC,QAAQ,kEAAkE,EAAE,CAAC;IAC7K,CAAC;IACD,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,CAAC,QAAQ,kCAAkC,EAAE,CAAC;AAC7F,CAAC"}

package/dist/lib/share/salt.d.ts

@@ -0,0 +1,2 @@
+export declare function shareSalt(): string;
+//# sourceMappingURL=salt.d.ts.map

package/dist/lib/share/salt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"salt.d.ts","sourceRoot":"","sources":["../../../src/lib/share/salt.ts"],"names":[],"mappings":"AAcA,wBAAgB,SAAS,IAAI,MAAM,CAoBlC"}

package/dist/lib/share/salt.js

@@ -0,0 +1,44 @@
+/**
+ * L9: the install's PRIVATE share salt, for the opaque `client_key` and local-only source URLs.
+ *
+ * A separate random value, kept in the CLI's own state directory (mode 0600, the same lstat-checked directory
+ * as the pending shares), never sent anywhere and NOT the telemetry install id: that id is a stable identifier
+ * the usage ping carries, and a salt equal to it would let anyone who sees both link a team-graph key to an
+ * install. Created on first use. If it is ever lost, decisions already shared keep working: their key is stored
+ * in the ledger at the first share, and only a decision never shared would get a new one.
+ */
+import { randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { alignStateDir } from '../backfill-state.js';
+export function shareSalt() {
+    const base = alignStateDir();
+    if (base === null)
+        throw new Error('Cannot create a private state directory for the share salt, so nothing was prepared.');
+    const file = path.join(base, 'share-salt');
+    let present = false;
+    try {
+        const have = fs.readFileSync(file, 'utf8').trim();
+        present = true;
+        if (/^[0-9a-f]{64}$/.test(have))
+            return have;
+    }
+    catch { /* not created yet */ }
+    const salt = randomBytes(32).toString('hex');
+    if (present) {
+        // A damaged file is replaced, atomically, rather than trusted: a salt that is not 64 hex characters is not ours.
+        const tmp = `${file}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, salt, { mode: 0o600 });
+        fs.renameSync(tmp, file);
+        return salt;
+    }
+    // wx: two first runs cannot overwrite each other; the loser reads the winner's value.
+    try {
+        fs.writeFileSync(file, salt, { mode: 0o600, flag: 'wx' });
+        return salt;
+    }
+    catch {
+        return fs.readFileSync(file, 'utf8').trim();
+    }
+}
+//# sourceMappingURL=salt.js.map

package/dist/lib/share/salt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"salt.js","sourceRoot":"","sources":["../../../src/lib/share/salt.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,UAAU,SAAS;IACvB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC3H,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,EAAE,CAAC;QACZ,iHAAiH;QACjH,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7C,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,sFAAsF;IACtF,IAAI,CAAC;QAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;AACxI,CAAC"}