@aligndottech/cli 0.49.0 → 0.50.0

package/dist/lib/share/run.js

@@ -0,0 +1,261 @@
+/**
+ * L9: the share flow with no I/O of its own beyond the injected client: select, build, scan, price
+ * the preview, send, read the answer, record the ledger. `align share`, `align share --confirm` and
+ * `align_share` all call it, so the three cannot disagree about what a share is.
+ *
+ * Order, and why: the secret scan runs on the payload that will be SENT (a refusal names the decision,
+ * the field and the placeholder, never the match); an item already shared with an unchanged payload
+ * is "already shared" and makes no call; only then is anything previewed. Nothing here sends without
+ * the caller having passed `send`, and `prepare` never calls the network except `whoami` (a read).
+ */
+import { existingTitles, listJudgements } from '../curation/judgements-db.js';
+import { createLocalDb } from '../local-db.js';
+import { getLegacyPromotion, getPromotion, ledgerReady, listPromotions, markRetracted, recordPromotion, recordPromotions } from './ledger.js';
+import { visible } from './visible.js';
+import { buildSharePayload, clientKeyFor } from './payload.js';
+import { renderPreview } from './preview.js';
+import { scanForSecrets, scanHiddenText, scanSourceUrl } from './secret-scan.js';
+import { failedJudgements, readOutcomes } from './wire.js';
+export class ShareError extends Error {
+    exitCode;
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.exitCode = exitCode;
+        this.name = 'ShareError';
+    }
+}
+/** Batches of at most this many items: 10 x the gateway's 50 judgements per item stays under its 500 per request. */
+export const SHARE_BATCH_ITEMS = 10;
+export function ratifiedRows(dbPath, opts = {}) {
+    const db = createLocalDb(dbPath);
+    try {
+        return db.listDecisions().filter((r) => r.ratifiedAt !== null
+            && (opts.owner === undefined || r.ratifiedBy === opts.owner)
+            && (opts.sinceIso === undefined || r.ratifiedAt >= opts.sinceIso));
+    }
+    finally {
+        db.close();
+    }
+}
+export async function prepare(ctx, ids) {
+    const who = await ctx.client.whoami();
+    const tenantId = who.tenant.id;
+    const dest = {
+        workspace: who.tenant.name, env: ctx.envName, email: who.user.email,
+        ...(ctx.gatewayUrl !== ctx.defaultGatewayUrl ? { gateway: ctx.gatewayUrl } : {}),
+    };
+    const rows = [];
+    const db = createLocalDb(ctx.dbPath);
+    try {
+        for (const id of ids) {
+            const row = db.getDecisionById(id);
+            if (!row)
+                throw new ShareError(`No decision ${visible(id)} in your local graph. \`align decisions list\` shows what is there.`);
+            if (!row.ratifiedAt)
+                throw new ShareError(`${visible(id)} has not been ratified, so it stays a claim on this machine.\n  A human stands behind it first: align ratify ${visible(id)}`);
+            rows.push(row);
+        }
+    }
+    finally {
+        db.close();
+    }
+    // The graph was just opened (which repairs an older v10); refuse BEFORE any request if the ledger is still not usable.
+    if (!ledgerReady(ctx.dbPath))
+        throw new ShareError('Your local graph\'s record of shares is not in the expected shape, so nothing was sent. Run `align local status` once, or update the CLI.');
+    const shared = listPromotions(ctx.dbPath, ctx.envName, tenantId);
+    const remoteIdOf = (id) => shared.get(id)?.remoteId;
+    const payloads = [];
+    const priors = new Map();
+    const already = [];
+    const secrets = [];
+    const updates = new Set();
+    const legacy = new Set();
+    for (const row of rows) {
+        const mine = listJudgements(ctx.dbPath, ctx.judge.judgeId, row.id);
+        const others = [...new Set(mine.flatMap((j) => [j.decision_id, j.counterpart_id]).filter((x) => x !== null && x !== row.id))];
+        const titles = existingTitles(ctx.dbPath, others);
+        const prior = getPromotion(ctx.dbPath, row.id, ctx.envName, tenantId);
+        priors.set(row.id, prior);
+        const live = prior !== null && prior.retractedAt === null;
+        // A live row with no stored key came from an earlier test build of this branch, whose key was derived another
+        // way. Re-deriving it now could mint a SECOND team decision, so the share stops and names the way out.
+        if (live && prior.clientKey === '') {
+            throw new ShareError(`${visible(row.id)} was shared by an earlier build that did not record its key, so sharing it again could create a second copy.\n  Retract the old one, then share again: align share --retract ${visible(row.id)}`);
+        }
+        const p = buildSharePayload({
+            row, judgements: mine, remoteIdOf, titleOf: (id) => titles.get(id) ?? null,
+            // The key is minted ONCE and reused, so a twin fold (a new local id) cannot create a second team decision.
+            clientKey: prior && prior.clientKey !== '' ? prior.clientKey : clientKeyFor(ctx.salt, row.id),
+            salt: ctx.salt,
+            alreadySent: new Set(live ? prior.sent : []),
+        });
+        let note = 0;
+        const fields = [
+            { field: 'title', text: p.item.title }, { field: 'summary', text: p.item.summary }, { field: 'platform', text: p.item.platform },
+            ...p.item.judgements.map((j) => ({ field: j.kind === 'note' ? `note ${++note}` : j.kind, text: j.note })),
+        ];
+        for (const f of [...scanForSecrets(fields), ...scanHiddenText([...fields, { field: 'raw_text', text: p.item.raw_text }, { field: 'source_url', text: p.item.source_url }])])
+            secrets.push({ ...f, localId: row.id });
+        for (const f of scanSourceUrl(p.item.source_url))
+            secrets.push({ ...f, localId: row.id });
+        if (live) {
+            if (prior.contentHash === p.fullHash && p.item.judgements.length === 0 && !prior.confirmPending) {
+                already.push({ localId: row.id, title: row.title, remoteId: prior.remoteId });
+                continue;
+            }
+            updates.add(row.id);
+        }
+        else if (!prior && getLegacyPromotion(ctx.dbPath, row.id, ctx.envName))
+            legacy.add(row.id);
+        payloads.push(p);
+    }
+    return { payloads, dest, tenantId, gatewayUrl: ctx.gatewayUrl, priors, already, secrets, preview: renderPreview(payloads, dest, { updates, legacy }) };
+}
+/** The refusal text: where, which kind, never the value. */
+export function secretRefusal(secrets) {
+    const lines = secrets.map((s) => `  ${visible(s.localId)}: ${visible(s.field)} ${s.placeholder === '<HIDDEN_TEXT>' ? 'contains hidden tag characters (invisible text)' : `looks like ${s.placeholder}`}`);
+    return `Nothing was sent: part of what would be shared looks like a credential or holds hidden text.\n${lines.join('\n')}\n  Edit it out of the decision, then share again.`;
+}
+async function postBatch(ctx, batch) {
+    const res = await ctx.client.shareBatch(batch.map((p) => ({ ...p.item })));
+    return readOutcomes(batch.length, res);
+}
+/** The judgements the gateway reported as stored, by hash. A null report stores nothing we can name. */
+function storedHashes(p, results) {
+    if (results === null)
+        return [];
+    return p.shown.flatMap((s, i) => (results[i]?.ok === true ? [s.hash] : []));
+}
+/**
+ * The ledger row an outcome implies, from the FIRST response alone, or null when nothing was written
+ * (refused, unknown). Matched and skipped rows are `matched` (not ours to archive); an update of something
+ * this machine never shared is treated the same way, with a warning.
+ */
+function initialRow(ctx, prep, it) {
+    const { p, outcome } = it;
+    const base = { localId: p.localId, env: ctx.envName, tenantId: prep.tenantId, contentHash: p.fullHash, clientKey: p.item.client_key, sent: [...it.stored], confirmPending: it.confirmPending };
+    switch (outcome.kind) {
+        case 'created': return { ...base, remoteId: outcome.remoteId, matched: outcome.uncertain };
+        case 'updated': return { ...base, remoteId: outcome.remoteId, matched: it.live ? it.prior.matched : true };
+        case 'matched': return { ...base, remoteId: outcome.remoteId, matched: true };
+        case 'skipped': return { ...base, remoteId: outcome.remoteId, matched: true };
+        default: return null;
+    }
+}
+export async function send(ctx, prep, hooks = {}) {
+    const results = [];
+    for (let at = 0; at < prep.payloads.length; at += SHARE_BATCH_ITEMS) {
+        const batch = prep.payloads.slice(at, at + SHARE_BATCH_ITEMS);
+        const outcomes = await postBatch(ctx, batch);
+        const items = batch.map((p, k) => {
+            const outcome = outcomes[k];
+            const prior = prep.priors.get(p.localId) ?? null;
+            const live = prior !== null && prior.retractedAt === null;
+            const it = { p, outcome, live, prior, stored: new Set(live ? prior.sent : []), warnings: [], confirmPending: false, failures: 'judgements' in outcome ? failedJudgements(outcome.judgements) : [] };
+            if ('judgements' in outcome)
+                for (const h of storedHashes(p, outcome.judgements))
+                    it.stored.add(h);
+            if ('judgements' in outcome && outcome.judgements === null && p.item.judgements.length > 0) {
+                it.warnings.push(`this gateway did not report what happened to your ${p.item.judgements.map((j) => j.kind).join(', ')}: they were not stored as far as can be told, so they stay unsent here and your ratify was not stored by this gateway. Check your team graph.`);
+            }
+            if (outcome.kind === 'created' && outcome.uncertain)
+                it.warnings.push('this gateway cannot tell new from existing (it is older than share matching), so this is recorded as not yours to retract.');
+            if (outcome.kind === 'updated' && !live)
+                it.warnings.push('the gateway answered this as an existing team decision, so it is recorded as not yours to retract.');
+            if (outcome.kind === 'matched')
+                it.confirmPending = outcome.needsConfirmation.length > 0;
+            return it;
+        });
+        // Record EVERY item the first response named, in ONE write, before anything that can throw (the team-text
+        // fetch, the confirmation re-post, a later batch): a 502 or a kill after this point cannot orphan a
+        // decision that now exists on the team graph and is retractable only through this row.
+        recordPromotions(ctx.dbPath, items.flatMap((it) => { const r = initialRow(ctx, prep, it); return r ? [r] : []; }));
+        for (const it of items) {
+            const { p, outcome } = it;
+            if (outcome.kind === 'matched' && outcome.needsConfirmation.length > 0) {
+                let team = null;
+                if (outcome.teamTextHash && hooks.confirmTeamText)
+                    team = await ctx.client.getDecision(outcome.remoteId).catch(() => null);
+                if (team !== null && !('decision_json' in team)) {
+                    it.warnings.push('the team\'s full text could not be read from this gateway, so your ratify was not confirmed.');
+                    team = null;
+                }
+                const agreed = team !== null && await hooks.confirmTeamText({ localId: p.localId, title: p.item.title, team });
+                if (agreed) {
+                    // Re-post ONLY what waited: a note or check verdict already stored must not be posted a second time.
+                    const need = new Set(outcome.needsConfirmation.map((n) => n.judgement_index));
+                    const waiting = p.shown.filter((_, i) => need.has(i));
+                    const again = { ...p, shown: waiting, item: { ...p.item, judgements: waiting.map((s) => ({ ...s.wire, confirm_team_text_hash: outcome.teamTextHash })) } };
+                    const second = (await postBatch(ctx, [again]))[0];
+                    if (second.kind === 'matched') {
+                        for (const h of storedHashes(again, second.judgements))
+                            it.stored.add(h);
+                        it.failures = failedJudgements(second.judgements);
+                        it.confirmPending = it.failures.length > 0;
+                        const row = initialRow(ctx, prep, it);
+                        if (row)
+                            recordPromotion(ctx.dbPath, row);
+                    }
+                }
+            }
+            if (outcome.kind === 'matched')
+                it.failures = it.failures.filter((f) => f.error !== 'needs_confirmation' || it.confirmPending);
+            results.push({ localId: p.localId, title: p.item.title, outcome, judgementFailures: it.failures, warnings: it.warnings });
+        }
+    }
+    return results;
+}
+/** Every field the server's team-text hash covers, so what the person confirms is what the hash pins. */
+export function renderTeamText(team) {
+    const ai = team.decision_json?.ai ?? {};
+    const show = (v) => (v === undefined || v === null ? '(none)' : typeof v === 'string' ? v : Array.isArray(v) ? v.map((x) => `- ${typeof x === 'string' ? x : JSON.stringify(x)}`).join('\n') : JSON.stringify(v));
+    const block = (label, v) => `  ${label}:\n${visible(show(v), { keepNewline: true }).split('\n').map((l) => `    ${l}`).join('\n')}`;
+    return [
+        block('Title', team.title ?? ''), block('Summary', team.summary ?? ''), block('Decisions', ai.decisions),
+        block('Gherkin', ai.gherkin), block('Acceptance criteria', ai.acceptance_criteria),
+    ].join('\n');
+}
+const FAIL_TEXT = {
+    needs_confirmation: 'waits for you to confirm the team\'s text (run the share again and answer yes)',
+    team_text_changed: 'the team\'s text changed while you were looking; share again',
+    ratification_not_permitted: 'your role may not ratify here',
+    decision_not_found: 'the other decision is not visible to you',
+};
+export function renderResults(rows) {
+    const lines = [];
+    for (const r of rows) {
+        const o = r.outcome;
+        const head = (() => {
+            switch (o.kind) {
+                case 'created': return o.ambiguous ? `shared as new (several team decisions share this source, so it was not matched): ${visible(o.remoteId)}` : `created: ${visible(o.remoteId)}`;
+                case 'updated': return `updated: ${visible(o.remoteId)}`;
+                case 'matched': return `matched an existing team decision (${visible(o.remoteId)}); your judgements were added, its text is untouched`;
+                case 'skipped': return `left alone (${visible(o.reason)}): ${visible(o.remoteId)}`;
+                case 'refused': return `refused by the server (${visible(o.reason)})`;
+                case 'unknown': return 'the server did not say what happened to it; check your team graph before sharing again';
+            }
+        })();
+        lines.push(`  ${visible(r.title)}\n    ${head}`);
+        for (const w of r.warnings)
+            lines.push(`    note: ${visible(w)}`);
+        for (const f of r.judgementFailures)
+            lines.push(`    judgement ${f.index + 1} not stored: ${FAIL_TEXT[f.error] ?? visible(f.error)}`);
+    }
+    return lines.join('\n');
+}
+export async function retract(ctx, localId) {
+    const who = await ctx.client.whoami();
+    const row = getPromotion(ctx.dbPath, localId, ctx.envName, who.tenant.id);
+    if (!row || row.retractedAt !== null) {
+        if (getLegacyPromotion(ctx.dbPath, localId, ctx.envName))
+            return { ok: false, message: `${localId} was pushed before Align tracked workspaces, so it cannot be retracted from here. Archive it on your team graph.` };
+        return { ok: false, message: `Nothing to retract: ${localId} was not shared to ${who.tenant.name} (${ctx.envName}) from this machine.` };
+    }
+    if (row.matched) {
+        return { ok: false, message: `${localId} attached to a decision your team already held (${row.remoteId}). Retracting would archive THEIR decision, so nothing was done.` };
+    }
+    await ctx.client.archiveDecision(row.remoteId);
+    markRetracted(ctx.dbPath, localId, ctx.envName, who.tenant.id);
+    return { ok: true, message: `Retracted: ${row.remoteId} is archived on your team graph.` };
+}
+//# sourceMappingURL=run.js.map

package/dist/lib/share/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/lib/share/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAc,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAoB,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAuC,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnL,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAqB,MAAM,cAAc,CAAC;AAClF,OAAO,EAAoB,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAsB,gBAAgB,EAA0C,YAAY,EAAE,MAAM,WAAW,CAAC;AA6BvH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACG;IAAtC,YAAY,OAAe,EAAW,WAAW,CAAC;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAA/B,aAAQ,GAAR,QAAQ,CAAI;QAAoB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAAC,CAAC;CAClG;AAeD,qHAAqH;AACrH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAA8C,EAAE;IAC3F,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI;eACxD,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC;eACzD,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAiB,EAAE,GAAa;IAC5D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAgB;QACxB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK;QACnE,GAAG,CAAC,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjF,CAAC;IACF,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,UAAU,CAAC,eAAe,OAAO,CAAC,EAAE,CAAC,qEAAqE,CAAC,CAAC;YAChI,IAAI,CAAC,GAAG,CAAC,UAAU;gBAAE,MAAM,IAAI,UAAU,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,gHAAgH,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvL,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACzB,uHAAuH;IACvH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,2IAA2I,CAAC,CAAC;IAEhM,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3I,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;QAC1D,8GAA8G;QAC9G,uGAAuG;QACvG,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,gLAAgL,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5O,CAAC;QACD,MAAM,CAAC,GAAG,iBAAiB,CAAC;YAC1B,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI;YAC1E,2GAA2G;YAC3G,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7F,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG;YACb,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE;YAChI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC1G,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrN,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAChG,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC9E,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACzJ,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,OAA4B;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,eAAe,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1M,OAAO,iGAAiG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD,CAAC;AAC/K,CAAC;AAcD,KAAK,UAAU,SAAS,CAAC,GAAiB,EAAE,KAAqB;IAC/D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC3E,OAAO,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AACzC,CAAC;AAED,wGAAwG;AACxG,SAAS,YAAY,CAAC,CAAe,EAAE,OAAiC;IACtE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC;AAaD;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAiB,EAAE,IAAc,EAAE,EAAQ;IAC7D,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,cAAc,EAAE,CAAC;IAC/L,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3F,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5G,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,GAAiB,EAAE,IAAc,EAAE,QAAmB,EAAE;IACjF,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,iBAAiB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QAC7C,MAAM,KAAK,GAAW,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;YACjD,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;YAC1D,MAAM,EAAE,GAAS,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1M,IAAI,YAAY,IAAI,OAAO;gBAAE,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC;oBAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3F,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+IAA+I,CAAC,CAAC;YACxQ,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS;gBAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,4HAA4H,CAAC,CAAC;YACpM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI;gBAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;YAChK,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,EAAE,CAAC,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;YACzF,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,0GAA0G;QAC1G,oGAAoG;QACpG,uFAAuF;QACvF,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnH,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvE,IAAI,IAAI,GAAwB,IAAI,CAAC;gBACrC,IAAI,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe;oBAAE,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC3H,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,eAAe,IAAI,IAAI,CAAC,EAAE,CAAC;oBAChD,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;oBACjH,IAAI,GAAG,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,MAAM,GAAG,IAAI,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC,eAAgB,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChH,IAAI,MAAM,EAAE,CAAC;oBACX,qGAAqG;oBACrG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;oBAC9E,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBACtD,MAAM,KAAK,GAAiB,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,sBAAsB,EAAE,OAAO,CAAC,YAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC1K,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAE,CAAC;oBACnD,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBAC9B,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC;4BAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBACzE,EAAE,CAAC,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;wBAClD,EAAE,CAAC,cAAc,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;wBAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;wBACtC,IAAI,GAAG;4BAAE,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,EAAE,CAAC,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC;YAC/H,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAAC,IAAkB;IAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnO,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,CAAU,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrJ,OAAO;QACL,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,SAAS,CAAC;QACxG,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,mBAAmB,CAAC;KACnF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,SAAS,GAA2B;IACxC,kBAAkB,EAAE,gFAAgF;IACpG,iBAAiB,EAAE,8DAA8D;IACjF,0BAA0B,EAAE,+BAA+B;IAC3D,kBAAkB,EAAE,0CAA0C;CAC/D,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE;YACzB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oFAAoF,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnL,KAAK,SAAS,CAAC,CAAC,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,KAAK,SAAS,CAAC,CAAC,OAAO,sCAAsC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;gBACvI,KAAK,SAAS,CAAC,CAAC,OAAO,eAAe,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnF,KAAK,SAAS,CAAC,CAAC,OAAO,0BAA0B,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACtE,KAAK,SAAS,CAAC,CAAC,OAAO,wFAAwF,CAAC;YAClH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB;YAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,GAAG,CAAC,gBAAgB,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAiB,EAAE,OAAe;IAC9D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACrC,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,kHAAkH,EAAE,CAAC;QACtN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,OAAO,sBAAsB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,sBAAsB,EAAE,CAAC;IAC3I,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,mDAAmD,GAAG,CAAC,QAAQ,kEAAkE,EAAE,CAAC;IAC7K,CAAC;IACD,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,CAAC,QAAQ,kCAAkC,EAAE,CAAC;AAC7F,CAAC"}

package/dist/lib/share/salt.d.ts

@@ -0,0 +1,2 @@
+export declare function shareSalt(): string;
+//# sourceMappingURL=salt.d.ts.map

package/dist/lib/share/salt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"salt.d.ts","sourceRoot":"","sources":["../../../src/lib/share/salt.ts"],"names":[],"mappings":"AAcA,wBAAgB,SAAS,IAAI,MAAM,CAoBlC"}

package/dist/lib/share/salt.js

@@ -0,0 +1,44 @@
+/**
+ * L9: the install's PRIVATE share salt, for the opaque `client_key` and local-only source URLs.
+ *
+ * A separate random value, kept in the CLI's own state directory (mode 0600, the same lstat-checked directory
+ * as the pending shares), never sent anywhere and NOT the telemetry install id: that id is a stable identifier
+ * the usage ping carries, and a salt equal to it would let anyone who sees both link a team-graph key to an
+ * install. Created on first use. If it is ever lost, decisions already shared keep working: their key is stored
+ * in the ledger at the first share, and only a decision never shared would get a new one.
+ */
+import { randomBytes } from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { alignStateDir } from '../backfill-state.js';
+export function shareSalt() {
+    const base = alignStateDir();
+    if (base === null)
+        throw new Error('Cannot create a private state directory for the share salt, so nothing was prepared.');
+    const file = path.join(base, 'share-salt');
+    let present = false;
+    try {
+        const have = fs.readFileSync(file, 'utf8').trim();
+        present = true;
+        if (/^[0-9a-f]{64}$/.test(have))
+            return have;
+    }
+    catch { /* not created yet */ }
+    const salt = randomBytes(32).toString('hex');
+    if (present) {
+        // A damaged file is replaced, atomically, rather than trusted: a salt that is not 64 hex characters is not ours.
+        const tmp = `${file}.${process.pid}.tmp`;
+        fs.writeFileSync(tmp, salt, { mode: 0o600 });
+        fs.renameSync(tmp, file);
+        return salt;
+    }
+    // wx: two first runs cannot overwrite each other; the loser reads the winner's value.
+    try {
+        fs.writeFileSync(file, salt, { mode: 0o600, flag: 'wx' });
+        return salt;
+    }
+    catch {
+        return fs.readFileSync(file, 'utf8').trim();
+    }
+}
+//# sourceMappingURL=salt.js.map

package/dist/lib/share/salt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"salt.js","sourceRoot":"","sources":["../../../src/lib/share/salt.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD,MAAM,UAAU,SAAS;IACvB,MAAM,IAAI,GAAG,aAAa,EAAE,CAAC;IAC7B,IAAI,IAAI,KAAK,IAAI;QAAE,MAAM,IAAI,KAAK,CAAC,sFAAsF,CAAC,CAAC;IAC3H,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,YAAY,CAAC,CAAC;IAC3C,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAClD,OAAO,GAAG,IAAI,CAAC;QACf,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC,CAAC,qBAAqB,CAAC,CAAC;IACjC,MAAM,IAAI,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC7C,IAAI,OAAO,EAAE,CAAC;QACZ,iHAAiH;QACjH,MAAM,GAAG,GAAG,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;QACzC,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7C,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IACD,sFAAsF;IACtF,IAAI,CAAC;QAAC,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QAAC,OAAO,IAAI,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IAAC,CAAC;AACxI,CAAC"}

package/dist/lib/share/secret-patterns.json

@@ -0,0 +1,100 @@
+{
+    "case_insensitive": [
+        [
+            "([a-zA-Z][a-zA-Z0-9+.\\-]{0,31}://)[^/\\s:@]+:[^/\\s:@]+@",
+            "\\1<URL_CREDENTIALS>@"
+        ],
+        [
+            "(?<![\\w@.:/])[A-Za-z][\\w.\\-]{1,30}:(?![/\\s])(?!v?\\d[\\d.]*(?:-[a-z0-9][a-z0-9.\\-]*)?(?![^\\s:@/]))(?=[^\\s:@/]*[A-Za-z])(?=[^\\s:@/]*\\d)[^\\s:@/]{8,}",
+            "<CREDENTIALS>"
+        ],
+        [
+            "AKIA[0-9A-Z]{16}",
+            "<AWS_ACCESS_KEY>"
+        ],
+        [
+            "ghp_[a-zA-Z0-9]{36}",
+            "<GITHUB_TOKEN>"
+        ],
+        [
+            "github_pat_[a-zA-Z0-9]{22}_[a-zA-Z0-9]{59}",
+            "<GITHUB_TOKEN>"
+        ],
+        [
+            "sk-[a-zA-Z0-9]{48}",
+            "<OPENAI_KEY>"
+        ],
+        [
+            "sk-ant-[a-zA-Z0-9\\-]{95,}",
+            "<ANTHROPIC_KEY>"
+        ],
+        [
+            "(?<![A-Za-z0-9])eyJ(?:[A-Za-z0-9_\\-]|\\r?\\n){10,}(?:\\s*(?:\\.|%2E)\\s*(?:[A-Za-z0-9_\\-]|\\r?\\n){10,}){2}",
+            "<JWT>"
+        ],
+        [
+            "(?<![A-Za-z0-9])sk-(?=[A-Za-z0-9_\\-]*\\d)[A-Za-z0-9_\\-]{20,}",
+            "<OPENAI_KEY>"
+        ],
+        [
+            "(?<![A-Za-z0-9])[sr]k_(?:live|test)_[A-Za-z0-9]{16,}",
+            "<STRIPE_KEY>"
+        ],
+        [
+            "(?<![A-Za-z0-9])AIza[0-9A-Za-z_\\-]{35}",
+            "<GOOGLE_API_KEY>"
+        ],
+        [
+            "((?:aws[_\\-\\s]*secret(?:[_\\-\\s]*access)?(?:[_\\-\\s]*key)?|secret[_\\-\\s]*access[_\\-\\s]*key)[\\\"'\\s:=]+)[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+])",
+            "\\1<AWS_SECRET_KEY>"
+        ],
+        [
+            "xox[baprs]-[0-9]{10,13}-[0-9]{10,13}-[a-zA-Z0-9]{24,}",
+            "<SLACK_TOKEN>"
+        ],
+        [
+            "(?<![A-Za-z0-9])xox[a-z](?:\\.xox[a-z])?-[A-Za-z0-9\\-]{20,}",
+            "<SLACK_TOKEN>"
+        ],
+        [
+            "(?<![A-Za-z0-9])lin_api_[A-Za-z0-9]{32,}",
+            "<LINEAR_KEY>"
+        ],
+        [
+            "(?<![A-Za-z0-9])gh[ousr]_[A-Za-z0-9]{36}",
+            "<GITHUB_TOKEN>"
+        ],
+        [
+            "(?<![A-Za-z0-9])glpat-[A-Za-z0-9_\\-]{20,}",
+            "<GITLAB_TOKEN>"
+        ],
+        [
+            "api[_-]?key[\"\\s:=]+[\"\\']?([a-zA-Z0-9_\\-]{20,})[\"\\']?",
+            "<API_KEY>"
+        ],
+        [
+            "bearer\\s+[a-zA-Z0-9\\-._~+/]{20,}=*",
+            "<BEARER_TOKEN>"
+        ],
+        [
+            "-----BEGIN ((?:[A-Z0-9]{1,20} ){0,4})PRIVATE KEY(?: BLOCK)?-----(?:[A-Za-z0-9+/=\\s:,.]{0,16384}-----END \\1PRIVATE KEY(?: BLOCK)?-----)?",
+            "<PRIVATE_KEY>"
+        ],
+        [
+            "([?&](?:token|access_token|id_token|refresh_token|api_key|apikey|secret|client_secret|password|passwd|pwd|passcode|sig|signature|x-amz-signature|x-amz-credential)=)(?=[^&\\s\\\"'<>#]{0,100}\\d)[^&\\s\\\"'<>#]{8,}",
+            "\\1<URL_SECRET_PARAM>"
+        ],
+        [
+            "((?<![A-Za-z0-9])(?<!page_)(?<!page-)(?:password|passwd|secret|token)[\\\"']?[ \\t]*[:=][ \\t]*[\\\"']?)(?!\\$|\\{\\{|%\\(|v?\\d+\\.\\d|[a-z_]+=\\d|[A-Za-z_][\\w.]*\\()(?![^\\s\\\"'<>,;&]{0,64}\\d{4}-\\d\\d-\\d\\d)(?=[^\\s\\\"'<>,;&]{0,100}[A-Za-z])(?=[^\\s\\\"'<>,;&]{0,100}(?:[!@#$%^*]|\\d[^\\s\\\"'<>,;&]{0,100}\\d))[^\\s\\\"'<>,;&]{8,}",
+            "\\1<SECRET_VALUE>"
+        ]
+    ],
+    "case_sensitive": [
+        [
+            "(\\b[A-Z0-9_]*(?:PASSWORD|PASSWD|SECRET|TOKEN)[A-Z0-9_]*\\s*=\\s*[\\\"']?)(?!(?<!')(?:\\$\\([^)\\\"'<>\\n]*\\)|\\$\\{[A-Z_][A-Z0-9_]*\\}|\\$[A-Z_][A-Z0-9_]*)(?![^\\s\\\"'<>]))(?=[^\\s\\\"']*[A-Za-z])[^\\s\\\"'<>]{6,}",
+            "\\1<SECRET_VALUE>"
+        ]
+    ],
+    "aws_bare_secret": "(?<![A-Za-z0-9/+])(?=[A-Za-z0-9/+]*[A-Z])(?=[A-Za-z0-9/+]*[a-z])(?=[A-Za-z0-9/+]*\\d)[A-Za-z0-9/+]{40}(?![A-Za-z0-9/+])",
+    "aws_context_chars": 100
+}

package/dist/lib/share/secret-scan.d.ts

@@ -0,0 +1,19 @@
+export interface SecretFinding {
+    /** Which field of the share held it: `title`, `summary`, `source_url`, `note`. */
+    field: string;
+    /** The placeholder the redactor would write, for example `<GITHUB_TOKEN>`. Never the match. */
+    placeholder: string;
+}
+/** Placeholder names found in `text`, each once, in pattern order. */
+export declare function secretsIn(text: string): string[];
+/** Scan every named field; one finding per (field, placeholder). */
+export declare function scanForSecrets(fields: Array<{
+    field: string;
+    text: string | null | undefined;
+}>): SecretFinding[];
+export declare function scanSourceUrl(url: string): SecretFinding[];
+export declare function scanHiddenText(fields: Array<{
+    field: string;
+    text: string | null | undefined;
+}>): SecretFinding[];
+//# sourceMappingURL=secret-scan.d.ts.map

package/dist/lib/share/secret-scan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.d.ts","sourceRoot":"","sources":["../../../src/lib/share/secret-scan.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,aAAa;IAC5B,kFAAkF;IAClF,KAAK,EAAE,MAAM,CAAC;IACd,+FAA+F;IAC/F,WAAW,EAAE,MAAM,CAAC;CACrB;AAYD,sEAAsE;AACtE,wBAAgB,SAAS,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAUhD;AAED,oEAAoE;AACpE,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,CAAC,GAAG,aAAa,EAAE,CAOjH;AASD,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,aAAa,EAAE,CAM1D;AASD,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,CAAC;IAAE,KAAK,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAA;CAAE,CAAC,GAAG,aAAa,EAAE,CAEjH"}

package/dist/lib/share/secret-scan.js

@@ -0,0 +1,75 @@
+/**
+ * L9: the client-side secret scan for `align share`. Refuse and SHOW which kind of secret was found,
+ * never the secret itself: the match is not printed, logged or returned, only its placeholder name.
+ *
+ * `secret-patterns.json` is vendored byte for byte from align-stack `config/secret-patterns.json`
+ * (last changed in align-stack commit 292e07017). It is the same list brain redacts with and the
+ * gateway refuses on at POST /ingest/batch, so a share that passes here is not refused there for a
+ * credential shape. `share-secret-patterns.test.ts` pins the file's sha256 and one positive and one
+ * near-miss per newer shape; a pattern added server-side but not copied here only means the SERVER
+ * refuses a share this scan let through, so re-vendor the file and update that pin together.
+ */
+import patterns from './secret-patterns.json' with { type: 'json' };
+const placeholderOf = (replacement) => /<[A-Z0-9_]+>/.exec(replacement)?.[0] ?? '<SECRET>';
+const COMPILED = [
+    ...patterns.case_insensitive.map(([p, r]) => ({ re: new RegExp(p, 'i'), placeholder: placeholderOf(r) })),
+    ...patterns.case_sensitive.map(([p, r]) => ({ re: new RegExp(p), placeholder: placeholderOf(r) })),
+];
+const AWS_BARE = new RegExp(patterns.aws_bare_secret, 'g');
+const AWS_CONTEXT = patterns.aws_context_chars;
+/** Placeholder names found in `text`, each once, in pattern order. */
+export function secretsIn(text) {
+    const found = [];
+    for (const c of COMPILED)
+        if (c.re.test(text) && !found.includes(c.placeholder))
+            found.push(c.placeholder);
+    // The bare AWS secret shape is only a secret near the word "aws", exactly as the server decides.
+    AWS_BARE.lastIndex = 0;
+    for (let m = AWS_BARE.exec(text); m; m = AWS_BARE.exec(text)) {
+        const near = text.slice(Math.max(0, m.index - AWS_CONTEXT), m.index + m[0].length + AWS_CONTEXT).toLowerCase();
+        if (near.includes('aws') && !found.includes('<AWS_SECRET_KEY>'))
+            found.push('<AWS_SECRET_KEY>');
+    }
+    return found;
+}
+/** Scan every named field; one finding per (field, placeholder). */
+export function scanForSecrets(fields) {
+    const out = [];
+    for (const f of fields) {
+        if (!f.text)
+            continue;
+        for (const placeholder of secretsIn(f.text))
+            out.push({ field: f.field, placeholder });
+    }
+    return out;
+}
+/**
+ * Query parameters that carry a secret in the URL itself (a Zoom `pwd`, a signed link's signature, a token).
+ * The decision's URL is sent and shown, so one of these is refused like a token in the text, never stripped:
+ * stripping would change which item the URL names. The VALUE is never reported, only the parameter name.
+ */
+const SECRET_PARAMS = /^(?:token|access[_-]?token|id[_-]?token|refresh[_-]?token|api[_-]?key|apikey|secret|client[_-]?secret|password|passwd|pwd|passcode|sig|signature|x-amz-signature|x-amz-credential|auth|authorization)$/i;
+export function scanSourceUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        return [];
+    }
+    const names = new Set();
+    for (const [k, v] of parsed.searchParams)
+        if (v !== '' && SECRET_PARAMS.test(k))
+            names.add(k.toLowerCase());
+    return [...names].map((n) => ({ field: `source_url (parameter ${n})`, placeholder: '<URL_SECRET_PARAM>' }));
+}
+/**
+ * Tag characters (U+E0000-E007F) render as nothing but a model reads them as text, so they can hide an
+ * instruction inside a title or note. The secret scan cannot see them and a person cannot either, so a share
+ * containing one is refused (naming the field) rather than sent.
+ */
+const HIDDEN = /[\u{E0000}-\u{E007F}]/u;
+export function scanHiddenText(fields) {
+    return fields.filter((f) => f.text && HIDDEN.test(f.text)).map((f) => ({ field: f.field, placeholder: '<HIDDEN_TEXT>' }));
+}
+//# sourceMappingURL=secret-scan.js.map

package/dist/lib/share/secret-scan.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-scan.js","sourceRoot":"","sources":["../../../src/lib/share/secret-scan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,QAAQ,MAAM,wBAAwB,CAAC,OAAO,IAAI,EAAE,MAAM,EAAE,CAAC;AASpE,MAAM,aAAa,GAAG,CAAC,WAAmB,EAAU,EAAE,CAAC,cAAc,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,UAAU,CAAC;AAG3G,MAAM,QAAQ,GAAe;IAC3B,GAAG,QAAQ,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,CAAW,EAAE,GAAG,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAW,CAAC,EAAE,CAAC,CAAC;IAC7H,GAAG,QAAQ,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,MAAM,CAAC,CAAW,CAAC,EAAE,WAAW,EAAE,aAAa,CAAC,CAAW,CAAC,EAAE,CAAC,CAAC;CACvH,CAAC;AACF,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,QAAQ,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC;AAC3D,MAAM,WAAW,GAAG,QAAQ,CAAC,iBAAiB,CAAC;AAE/C,sEAAsE;AACtE,MAAM,UAAU,SAAS,CAAC,IAAY;IACpC,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,QAAQ;QAAE,IAAI,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;IAC3G,iGAAiG;IACjG,QAAQ,CAAC,SAAS,GAAG,CAAC,CAAC;IACvB,KAAK,IAAI,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,WAAW,CAAC,CAAC,WAAW,EAAE,CAAC;QAC/G,IAAI,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,kBAAkB,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC;IAClG,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,cAAc,CAAC,MAAiE;IAC9F,MAAM,GAAG,GAAoB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,IAAI,CAAC,CAAC,CAAC,IAAI;YAAE,SAAS;QACtB,KAAK,MAAM,WAAW,IAAI,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC;YAAE,GAAG,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC;IACzF,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,aAAa,GAAG,yMAAyM,CAAC;AAEhO,MAAM,UAAU,aAAa,CAAC,GAAW;IACvC,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QAAC,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IAAC,CAAC;IAAC,MAAM,CAAC;QAAC,OAAO,EAAE,CAAC;IAAC,CAAC;IACnD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,YAAY;QAAE,IAAI,CAAC,KAAK,EAAE,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC;YAAE,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IAC5G,OAAO,CAAC,GAAG,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,yBAAyB,CAAC,GAAG,EAAE,WAAW,EAAE,oBAAoB,EAAE,CAAC,CAAC,CAAC;AAC9G,CAAC;AAED;;;;GAIG;AACH,MAAM,MAAM,GAAG,wBAAwB,CAAC;AAExC,MAAM,UAAU,cAAc,CAAC,MAAiE;IAC9F,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,WAAW,EAAE,eAAe,EAAE,CAAC,CAAC,CAAC;AAC5H,CAAC"}

package/dist/lib/share/tty.d.ts

@@ -0,0 +1,4 @@
+export type TtyPaths = readonly [input: string, output: string];
+export declare const TTY_PATHS: TtyPaths;
+export declare function ttyConfirm(shown: string, question: string, paths?: TtyPaths): Promise<boolean | null>;
+//# sourceMappingURL=tty.d.ts.map

package/dist/lib/share/tty.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty.d.ts","sourceRoot":"","sources":["../../../src/lib/share/tty.ts"],"names":[],"mappings":"AAkBA,MAAM,MAAM,QAAQ,GAAG,SAAS,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAChE,eAAO,MAAM,SAAS,EAAE,QAA0F,CAAC;AAEnH,wBAAsB,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,KAAK,GAAE,QAAoB,GAAG,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CA4BtH"}

package/dist/lib/share/tty.js

@@ -0,0 +1,57 @@
+/**
+ * L9: ask a person a yes/no question on their CONTROLLING terminal, and prove it is one.
+ *
+ * Why not stdin: an agent's shell tool, a hook and a pipe all own stdin, so a "yes" read there proves
+ * nothing. `/dev/tty` (`CONIN$`/`CONOUT$` on Windows) is the terminal the process was started from; a
+ * process with no controlling terminal (a daemon, a `setsid` child, most agent shells) cannot open it.
+ * The handle must also pass `tty.isatty`: on Windows an open of CONIN$ can succeed against something
+ * that is not an interactive console, and "cannot prove it" means refuse, never block.
+ *
+ * The text a person must read is written to the SAME terminal just before the question, so it is the
+ * thing they see even when stdout is a pipe or a file. Returns true/false for y/n (default No, and end
+ * of input is No), or null when there is no interactive terminal. Honest limit, stated in SECURITY.md:
+ * a caller that allocates its own pseudo-terminal can type the answer; no local CLI can stop that.
+ */
+import fs from 'node:fs';
+import readline from 'node:readline';
+import tty from 'node:tty';
+export const TTY_PATHS = process.platform === 'win32' ? ['CONIN$', 'CONOUT$'] : ['/dev/tty', '/dev/tty'];
+export async function ttyConfirm(shown, question, paths = TTY_PATHS) {
+    let inFd = -1;
+    let outFd = -1;
+    try {
+        inFd = fs.openSync(paths[0], 'r');
+        outFd = fs.openSync(paths[1], 'w');
+        if (!tty.isatty(inFd) || !tty.isatty(outFd))
+            throw new Error('not an interactive terminal');
+    }
+    catch {
+        for (const fd of [inFd, outFd])
+            if (fd >= 0) {
+                try {
+                    fs.closeSync(fd);
+                }
+                catch { /* already closed */ }
+            }
+        return null;
+    }
+    // The tty streams own their descriptors from here: destroying them closes the fds, so no
+    // fs.closeSync of ours can race a readline that is still reading (the EBADF the review found).
+    const input = new tty.ReadStream(inFd);
+    const output = new tty.WriteStream(outFd);
+    const rl = readline.createInterface({ input, output, terminal: true });
+    try {
+        output.write(`${shown}\n\n`);
+        const answer = await new Promise((resolve) => {
+            rl.once('close', () => resolve(''));
+            rl.question(`${question} [y/N] `, resolve);
+        });
+        return /^y(es)?$/i.test(answer.trim());
+    }
+    finally {
+        rl.close();
+        input.destroy();
+        output.destroy();
+    }
+}
+//# sourceMappingURL=tty.js.map

package/dist/lib/share/tty.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"tty.js","sourceRoot":"","sources":["../../../src/lib/share/tty.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,QAAQ,MAAM,eAAe,CAAC;AACrC,OAAO,GAAG,MAAM,UAAU,CAAC;AAG3B,MAAM,CAAC,MAAM,SAAS,GAAa,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,UAAU,CAAC,CAAC;AAEnH,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,KAAa,EAAE,QAAgB,EAAE,QAAkB,SAAS;IAC3F,IAAI,IAAI,GAAG,CAAC,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAClC,KAAK,GAAG,EAAE,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC;YAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9F,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,MAAM,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC;YAAE,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBAAC,IAAI,CAAC;oBAAC,EAAE,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;gBAAC,CAAC;gBAAC,MAAM,CAAC,CAAC,oBAAoB,CAAC,CAAC;YAAC,CAAC;QACzG,OAAO,IAAI,CAAC;IACd,CAAC;IACD,yFAAyF;IACzF,+FAA+F;IAC/F,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;IACvC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,KAAK,CAAC,CAAC;IAC1C,MAAM,EAAE,GAAG,QAAQ,CAAC,eAAe,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IACvE,IAAI,CAAC;QACH,MAAM,CAAC,KAAK,CAAC,GAAG,KAAK,MAAM,CAAC,CAAC;QAC7B,MAAM,MAAM,GAAG,MAAM,IAAI,OAAO,CAAS,CAAC,OAAO,EAAE,EAAE;YACnD,EAAE,CAAC,IAAI,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC;YACpC,EAAE,CAAC,QAAQ,CAAC,GAAG,QAAQ,SAAS,EAAE,OAAO,CAAC,CAAC;QAC7C,CAAC,CAAC,CAAC;QACH,OAAO,WAAW,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,KAAK,EAAE,CAAC;QACX,KAAK,CAAC,OAAO,EAAE,CAAC;QAChB,MAAM,CAAC,OAAO,EAAE,CAAC;IACnB,CAAC;AACH,CAAC"}

package/dist/lib/share/visible.d.ts

@@ -0,0 +1,4 @@
+export declare function visible(text: string, opts?: {
+    keepNewline?: boolean;
+}): string;
+//# sourceMappingURL=visible.d.ts.map