@aligndottech/cli 0.49.0 → 0.51.0

package/dist/lib/share/approval.js

@@ -0,0 +1,139 @@
+/**
+ * ALI-1540: the client side of an approval, as functions over an injected client, a clock and a sleep.
+ *
+ * stage   - make the request id, seal, send the ciphertext, check the answer is about THIS request.
+ * poll    - ask the gateway what the person did, backing off, stopping at the expiry, stopping on Ctrl-C.
+ * link    - build the approve URL. The key goes in the fragment ONLY, which a browser never sends.
+ * complete - after (and only after) the gateway says approved, send the exact approved bytes.
+ *
+ * Nothing here can approve: the approve route refuses the CLI's token. A person does that in a browser.
+ */
+import { randomUUID } from 'node:crypto';
+import { seal } from './envelope.js';
+import { visible } from './visible.js';
+import { ShareError } from './run.js';
+/** Sleep that ends early when `signal` aborts (Ctrl-C), so a cancel is not delayed by a poll interval. */
+export function abortableSleep(ms, signal) {
+    return new Promise((resolve) => {
+        if (signal?.aborted) {
+            resolve();
+            return;
+        }
+        const done = () => { clearTimeout(timer); signal?.removeEventListener('abort', done); resolve(); };
+        const timer = setTimeout(done, ms);
+        signal?.addEventListener('abort', done, { once: true });
+    });
+}
+/** A machine label the person will read on the page as "a machine calling itself ...": printable, one line, at most 120 characters. */
+export function cleanLabel(raw) {
+    return visible(raw).replace(/\s+/g, ' ').trim().slice(0, 120);
+}
+export async function stageRequest(client, input, makeId = randomUUID, signal) {
+    const envelopeId = makeId();
+    const sealed = seal(input.plaintext, { envelopeId, tenantId: input.tenantId, userId: input.userId, kind: input.kind });
+    const label = cleanLabel(input.label);
+    const res = await client.stageShareRequest({
+        envelope_id: envelopeId, kind: input.kind, envelope: sealed.envelopeB64, payload_sha256: sealed.sha256,
+        item_count: input.itemCount, judgement_count: input.judgementCount,
+        ...(label ? { requester_label: label } : {}), ...(input.agent ? { agent: input.agent } : {}),
+    }, signal);
+    return { ...res, envelopeId, keyB64Url: sealed.keyB64Url, sha256: sealed.sha256, bytesB64: input.plaintext.toString('base64') };
+}
+/** The link the person opens. The key is in the fragment, never the path or query. */
+export function approveUrl(appUrl, requestId, keyB64Url) {
+    return `${appUrl.replace(/\/+$/, '')}/share/approve/${requestId}#k=${keyB64Url}`;
+}
+export const POLL_START_MS = 2000;
+export const POLL_MAX_MS = 5000;
+export const POLL_GROWTH = 1.3;
+/** Consecutive failed status reads before giving up. One blip is not a decision. */
+export const POLL_MAX_FAILURES = 3;
+/** Used when the gateway's config gives no lifetimes: pending (15 min) plus the window to complete after approval (10 min). */
+export const DEFAULT_MAX_WAIT_MS = (900 + 600) * 1000;
+/**
+ * Poll until the person decides. The expiry is the gateway's own `expires_at`; at that moment the answer is read
+ * ONE more time before calling it expired, because this machine's clock may run ahead of the gateway's and an
+ * approval can land in the last second. The deadline is clamped to `maxWaitMs` from now, so a far-future `expires_at`
+ * (a broken or hostile gateway) cannot keep this polling forever. `signal` reaches every status read, so Ctrl-C ends a
+ * read that is hanging, not only the sleep between reads.
+ */
+export async function pollUntilDecided(id, expiresAt, deps) {
+    const stated = Date.parse(expiresAt);
+    if (Number.isNaN(stated))
+        throw new ShareError('The gateway gave this request no usable expiry, so it was not waited on.');
+    const deadline = Math.min(stated, deps.now() + (deps.maxWaitMs ?? DEFAULT_MAX_WAIT_MS));
+    let delay = POLL_START_MS;
+    let failures = 0;
+    for (;;) {
+        if (deps.signal?.aborted)
+            return 'aborted';
+        const last = deps.now() >= deadline;
+        try {
+            const { state } = await deps.client.getShareRequest(id, deps.signal);
+            failures = 0;
+            switch (state) {
+                case 'approved': return 'approved';
+                case 'declined':
+                case 'expired':
+                case 'cancelled':
+                case 'failed': return state;
+                case 'pending': break;
+                // completing and completed mean something other than this process acted on the request: not ours to wait on.
+                default: throw new ShareError(`The request is already ${visible(state)} on the gateway, and this run did not cause that. This run stopped waiting on it.`);
+            }
+        }
+        catch (e) {
+            if (e instanceof ShareError)
+                throw e;
+            if (deps.signal?.aborted)
+                return 'aborted';
+            failures += 1;
+            if (failures >= POLL_MAX_FAILURES)
+                throw new ShareError(`Could not read the request's status ${POLL_MAX_FAILURES} times in a row (${visible(e.message)}). The request stays open on the gateway until it expires.`);
+        }
+        if (last)
+            return 'expired';
+        await deps.sleep(delay, deps.signal);
+        delay = Math.min(Math.round(delay * POLL_GROWTH), POLL_MAX_MS);
+    }
+}
+/**
+ * A completion that failed. `retryable` is true when no verdict came back (5xx, a dropped connection) or the gateway says it
+ * is already completing: the same bytes may be sent again. `sent` says what may be claimed: 'no' (the gateway refused, nothing
+ * was written) or 'maybe' (it may have finished; only the team graph knows).
+ */
+export class CompletionError extends ShareError {
+    retryable;
+    sent;
+    constructor(message, retryable, sent = retryable ? 'maybe' : 'no') {
+        super(message);
+        this.retryable = retryable;
+        this.sent = sent;
+        this.name = 'CompletionError';
+    }
+}
+const MAYBE_SENT = 'It may have been sent, so check your team graph. This machine has no record of the result yet, so `align share --retract` will not find it until you share the same decision again. That is safe: it will not make a second copy.';
+/**
+ * Send the approved bytes. The gateway re-hashes them against what the person approved, so a payload that
+ * differs by one character is refused there. An error here is explained by status; a 5xx or a dropped
+ * connection is an UNKNOWN outcome, not a failure, because the gateway may have finished before the answer got lost.
+ */
+export async function completeRequest(client, id, bytesB64) {
+    try {
+        return await client.completeShareRequest(id, bytesB64);
+    }
+    catch (e) {
+        const status = e.statusCode ?? 0;
+        const msg = visible(e.message);
+        if (status === 409 && /already_(completing|completed)/.test(msg))
+            throw new CompletionError(`The gateway says this request is already being completed, or was (${msg}). ${MAYBE_SENT}`, true);
+        if (status === 410)
+            throw new CompletionError('The approval was too old to use (it lasts 10 minutes). Nothing was sent. Run the share again.', false);
+        if (status === 422)
+            throw new CompletionError(`The gateway refused what was approved: ${msg}. Nothing was sent.`, false);
+        if (status >= 400 && status < 500)
+            throw new CompletionError(`The gateway would not complete it: ${msg}. Nothing was sent.`, false);
+        throw new CompletionError(`The gateway did not say whether the share finished (${msg}). ${MAYBE_SENT}`, true);
+    }
+}
+//# sourceMappingURL=approval.js.map

package/dist/lib/share/approval.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approval.js","sourceRoot":"","sources":["../../../src/lib/share/approval.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,IAAI,EAAE,MAAM,eAAe,CAAC;AAGrC,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,MAAM,UAAU,CAAC;AAGtC,0GAA0G;AAC1G,MAAM,UAAU,cAAc,CAAC,EAAU,EAAE,MAAoB;IAC7D,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,MAAM,EAAE,OAAO,EAAE,CAAC;YAAC,OAAO,EAAE,CAAC;YAAC,OAAO;QAAC,CAAC;QAC3C,MAAM,IAAI,GAAG,GAAS,EAAE,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,EAAE,mBAAmB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC;QACzG,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;QACnC,MAAM,EAAE,gBAAgB,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1D,CAAC,CAAC,CAAC;AACL,CAAC;AAsBD,uIAAuI;AACvI,MAAM,UAAU,UAAU,CAAC,GAAW;IACpC,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AAChE,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,MAAmD,EAAE,KAAiB,EAAE,SAAuB,UAAU,EAAE,MAAoB;IAChK,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;IAC5B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACvH,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,MAAM,MAAM,CAAC,iBAAiB,CAAC;QACzC,WAAW,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,QAAQ,EAAE,MAAM,CAAC,WAAW,EAAE,cAAc,EAAE,MAAM,CAAC,MAAM;QACtG,UAAU,EAAE,KAAK,CAAC,SAAS,EAAE,eAAe,EAAE,KAAK,CAAC,cAAc;QAClE,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,eAAe,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC7F,EAAE,MAAM,CAAC,CAAC;IACX,OAAO,EAAE,GAAG,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,EAAE,KAAK,CAAC,SAAS,CAAC,QAAQ,CAAC,QAAQ,CAAC,EAAE,CAAC;AAClI,CAAC;AAED,sFAAsF;AACtF,MAAM,UAAU,UAAU,CAAC,MAAc,EAAE,SAAiB,EAAE,SAAiB;IAC7E,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,kBAAkB,SAAS,MAAM,SAAS,EAAE,CAAC;AACnF,CAAC;AAcD,MAAM,CAAC,MAAM,aAAa,GAAG,IAAI,CAAC;AAClC,MAAM,CAAC,MAAM,WAAW,GAAG,IAAI,CAAC;AAChC,MAAM,CAAC,MAAM,WAAW,GAAG,GAAG,CAAC;AAC/B,oFAAoF;AACpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,CAAC;AACnC,+HAA+H;AAC/H,MAAM,CAAC,MAAM,mBAAmB,GAAG,CAAC,GAAG,GAAG,GAAG,CAAC,GAAG,IAAI,CAAC;AAEtD;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,EAAU,EAAE,SAAiB,EAAE,IAAc;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IACrC,IAAI,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,0EAA0E,CAAC,CAAC;IAC3H,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,CAAC,MAAM,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,IAAI,mBAAmB,CAAC,CAAC,CAAC;IACxF,IAAI,KAAK,GAAG,aAAa,CAAC;IAC1B,IAAI,QAAQ,GAAG,CAAC,CAAC;IACjB,SAAS,CAAC;QACR,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;YAAE,OAAO,SAAS,CAAC;QAC3C,MAAM,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,QAAQ,CAAC;QACpC,IAAI,CAAC;YACH,MAAM,EAAE,KAAK,EAAE,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,eAAe,CAAC,EAAE,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACrE,QAAQ,GAAG,CAAC,CAAC;YACb,QAAQ,KAAK,EAAE,CAAC;gBACd,KAAK,UAAU,CAAC,CAAC,OAAO,UAAU,CAAC;gBACnC,KAAK,UAAU,CAAC;gBAAC,KAAK,SAAS,CAAC;gBAAC,KAAK,WAAW,CAAC;gBAAC,KAAK,QAAQ,CAAC,CAAC,OAAO,KAAK,CAAC;gBAC/E,KAAK,SAAS,CAAC,CAAC,MAAM;gBACtB,6GAA6G;gBAC7G,OAAO,CAAC,CAAC,MAAM,IAAI,UAAU,CAAC,0BAA0B,OAAO,CAAC,KAAK,CAAC,mFAAmF,CAAC,CAAC;YAC7J,CAAC;QACH,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,CAAC,YAAY,UAAU;gBAAE,MAAM,CAAC,CAAC;YACrC,IAAI,IAAI,CAAC,MAAM,EAAE,OAAO;gBAAE,OAAO,SAAS,CAAC;YAC3C,QAAQ,IAAI,CAAC,CAAC;YACd,IAAI,QAAQ,IAAI,iBAAiB;gBAAE,MAAM,IAAI,UAAU,CAAC,uCAAuC,iBAAiB,oBAAoB,OAAO,CAAE,CAAW,CAAC,OAAO,CAAC,4DAA4D,CAAC,CAAC;QACjO,CAAC;QACD,IAAI,IAAI;YAAE,OAAO,SAAS,CAAC;QAC3B,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;QACrC,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,GAAG,WAAW,CAAC,EAAE,WAAW,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,OAAO,eAAgB,SAAQ,UAAU;IACP;IAA6B;IAAnE,YAAY,OAAe,EAAW,SAAkB,EAAW,OAAuB,SAAS,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAAjG,cAAS,GAAT,SAAS,CAAS;QAAW,SAAI,GAAJ,IAAI,CAA6C;QAAoB,IAAI,CAAC,IAAI,GAAG,iBAAiB,CAAC;IAAC,CAAC;CACzK;AAED,MAAM,UAAU,GAAG,mOAAmO,CAAC;AAEvP;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,MAAsD,EAAE,EAAU,EAAE,QAAgB;IACxH,IAAI,CAAC;QACH,OAAO,MAAM,MAAM,CAAC,oBAAoB,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,MAAM,GAAI,CAA6B,CAAC,UAAU,IAAI,CAAC,CAAC;QAC9D,MAAM,GAAG,GAAG,OAAO,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;QAC1C,IAAI,MAAM,KAAK,GAAG,IAAI,gCAAgC,CAAC,IAAI,CAAC,GAAG,CAAC;YAAE,MAAM,IAAI,eAAe,CAAC,qEAAqE,GAAG,MAAM,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;QAC9L,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,+FAA+F,EAAE,KAAK,CAAC,CAAC;QACtJ,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,0CAA0C,GAAG,qBAAqB,EAAE,KAAK,CAAC,CAAC;QACzH,IAAI,MAAM,IAAI,GAAG,IAAI,MAAM,GAAG,GAAG;YAAE,MAAM,IAAI,eAAe,CAAC,sCAAsC,GAAG,qBAAqB,EAAE,KAAK,CAAC,CAAC;QACpI,MAAM,IAAI,eAAe,CAAC,uDAAuD,GAAG,MAAM,UAAU,EAAE,EAAE,IAAI,CAAC,CAAC;IAChH,CAAC;AACH,CAAC"}

package/dist/lib/share/approve-link.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The gate between an approval link and anything that acts on it: a browser launch, a QR code, a clipboard write.
+ *
+ * The link is built from three parts the CLI does not fully control: the app URL (from config or an env var),
+ * the request id (the gateway's answer) and the key (random, ours). Before any of it reaches a child process or the
+ * terminal as anything but text, the WHOLE string must match one exact shape:
+ *
+ *   <scheme>://<host[:port]>/share/approve/<uuid>#k=<43 base64url characters>
+ *
+ * with the origin equal to the configured app's origin, https (http only for a localhost dev app), no userinfo, no
+ * query, no extra path, no whitespace or control characters, and a length cap. A string that passes contains none of
+ * the characters a shell, a PowerShell string or an argv parser treats specially. Callers must still pass it as an
+ * argument vector and never build a shell string from it; this is the second belt, not the first.
+ *
+ * WHAT THIS IS NOT. It is a SHAPE check, not a destination control. The link is built from the configured app URL and
+ * then compared with that same app URL, so the host check only catches a link that was altered after it was built. Where
+ * the link points is whatever the configuration (gateway URL, ALIGN_GATEWAY_URL) says. Only the host is
+ * case-insensitive; the scheme, the path and `#k=` must be exactly as written.
+ */
+export type LinkCheck = {
+    ok: true;
+    url: string;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare const MAX_LINK_LENGTH = 220;
+export declare function checkApproveLink(url: string, appUrl: string): LinkCheck;
+/** The same gate as checkApproveLink, for the one settings link: exact shape, the configured app's origin, https or a localhost http app. */
+export declare function checkSettingsLink(url: string, appUrl: string): LinkCheck;
+//# sourceMappingURL=approve-link.d.ts.map

package/dist/lib/share/approve-link.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve-link.d.ts","sourceRoot":"","sources":["../../../src/lib/share/approve-link.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,MAAM,MAAM,SAAS,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAElF,eAAO,MAAM,eAAe,MAAM,CAAC;AAUnC,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAWvE;AAKD,6IAA6I;AAC7I,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,SAAS,CAUxE"}

package/dist/lib/share/approve-link.js

@@ -0,0 +1,46 @@
+export const MAX_LINK_LENGTH = 220;
+const UUID = '[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{4}-[0-9a-fA-F]{12}';
+const HOST = '(?:[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?)(?:\\.[a-zA-Z0-9](?:[a-zA-Z0-9-]*[a-zA-Z0-9])?)*';
+const AUTHORITY = `(?:${HOST}|\\[::1\\])(?::[0-9]{1,5})?`;
+const LINK_RE = new RegExp(`^(https?)://(${AUTHORITY})/share/approve/(${UUID})#k=([A-Za-z0-9_-]{43})$`);
+const APP_RE = new RegExp(`^(https?)://(${AUTHORITY})/*$`);
+const isLocalHost = (authority) => /^(localhost|127\.0\.0\.1|\[::1\])(:[0-9]{1,5})?$/i.test(authority);
+const refuse = (reason) => ({ ok: false, reason });
+export function checkApproveLink(url, appUrl) {
+    if (typeof url !== 'string' || typeof appUrl !== 'string')
+        return refuse('not a string');
+    if (url.length > MAX_LINK_LENGTH)
+        return refuse('too long');
+    const app = APP_RE.exec(appUrl);
+    if (!app)
+        return refuse('the configured app URL is not a plain origin');
+    const m = LINK_RE.exec(url);
+    if (!m)
+        return refuse('not the shape of an approval link');
+    const [, scheme, authority] = m;
+    if (scheme === 'http' && !isLocalHost(authority))
+        return refuse('http is only for a localhost app');
+    if (`${scheme}://${authority}`.toLowerCase() !== `${app[1]}://${app[2]}`.toLowerCase())
+        return refuse('not the configured app');
+    return { ok: true, url };
+}
+/** The Team invites page `align invite` opens. Fixed path and query, so nothing from config but the origin varies. */
+const SETTINGS_RE = new RegExp(`^(https?)://(${AUTHORITY})/settings\\?tab=invites$`);
+/** The same gate as checkApproveLink, for the one settings link: exact shape, the configured app's origin, https or a localhost http app. */
+export function checkSettingsLink(url, appUrl) {
+    if (typeof url !== 'string' || typeof appUrl !== 'string')
+        return refuse('not a string');
+    const app = APP_RE.exec(appUrl);
+    if (!app)
+        return refuse('the configured app URL is not a plain origin');
+    const m = SETTINGS_RE.exec(url);
+    if (!m)
+        return refuse('not the shape of the settings link');
+    const [, scheme, authority] = m;
+    if (scheme === 'http' && !isLocalHost(authority))
+        return refuse('http is only for a localhost app');
+    if (`${scheme}://${authority}`.toLowerCase() !== `${app[1]}://${app[2]}`.toLowerCase())
+        return refuse('not the configured app');
+    return { ok: true, url };
+}
+//# sourceMappingURL=approve-link.js.map

package/dist/lib/share/approve-link.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"approve-link.js","sourceRoot":"","sources":["../../../src/lib/share/approve-link.ts"],"names":[],"mappings":"AAqBA,MAAM,CAAC,MAAM,eAAe,GAAG,GAAG,CAAC;AACnC,MAAM,IAAI,GAAG,6EAA6E,CAAC;AAC3F,MAAM,IAAI,GAAG,8FAA8F,CAAC;AAC5G,MAAM,SAAS,GAAG,MAAM,IAAI,6BAA6B,CAAC;AAC1D,MAAM,OAAO,GAAG,IAAI,MAAM,CAAC,gBAAgB,SAAS,oBAAoB,IAAI,0BAA0B,CAAC,CAAC;AACxG,MAAM,MAAM,GAAG,IAAI,MAAM,CAAC,gBAAgB,SAAS,MAAM,CAAC,CAAC;AAE3D,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAW,EAAE,CAAC,mDAAmD,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;AACxH,MAAM,MAAM,GAAG,CAAC,MAAc,EAAa,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;AAEtE,MAAM,UAAU,gBAAgB,CAAC,GAAW,EAAE,MAAc;IAC1D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IACzF,IAAI,GAAG,CAAC,MAAM,GAAG,eAAe;QAAE,OAAO,MAAM,CAAC,UAAU,CAAC,CAAC;IAC5D,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,8CAA8C,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC5B,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,mCAAmC,CAAC,CAAC;IAC3D,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAwC,CAAC;IACvE,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACpG,IAAI,GAAG,MAAM,MAAM,SAAS,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAChI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC;AAED,sHAAsH;AACtH,MAAM,WAAW,GAAG,IAAI,MAAM,CAAC,gBAAgB,SAAS,2BAA2B,CAAC,CAAC;AAErF,6IAA6I;AAC7I,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,MAAc;IAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,OAAO,MAAM,KAAK,QAAQ;QAAE,OAAO,MAAM,CAAC,cAAc,CAAC,CAAC;IACzF,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChC,IAAI,CAAC,GAAG;QAAE,OAAO,MAAM,CAAC,8CAA8C,CAAC,CAAC;IACxE,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC;QAAE,OAAO,MAAM,CAAC,oCAAoC,CAAC,CAAC;IAC5D,MAAM,CAAC,EAAE,MAAM,EAAE,SAAS,CAAC,GAAG,CAAwC,CAAC;IACvE,IAAI,MAAM,KAAK,MAAM,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;QAAE,OAAO,MAAM,CAAC,kCAAkC,CAAC,CAAC;IACpG,IAAI,GAAG,MAAM,MAAM,SAAS,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,GAAG,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,WAAW,EAAE;QAAE,OAAO,MAAM,CAAC,wBAAwB,CAAC,CAAC;IAChI,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC3B,CAAC"}

package/dist/lib/share/browser-flow.d.ts

@@ -0,0 +1,85 @@
+/**
+ * ALI-1540: `align share` when the person approves in a browser instead of typing y.
+ *
+ * For each request (at most SHARE_BATCH_ITEMS decisions, and small enough to seal): stage it, print the link and the
+ * code, wait, and when the gateway says the person approved, send the approved bytes. The link carries the key in
+ * its `#k=` fragment; this module prints it to the terminal the person is at and keeps it nowhere else (the MCP
+ * path stores it 0600 in the pending directory; this one holds it in memory).
+ *
+ * What a run from inside an agent can do here: stage and wait. Its own CLI token cannot approve: the gateway
+ * refuses it on the approve route. That is why this path, unlike the typed one, is allowed when ALIGN_WRAPPED is set. It is
+ * not a lock: SECURITY.md lists how an agent can still obtain a session.
+ */
+import { type PollDeps } from './approval.js';
+import { type RequestKind } from './envelope.js';
+import type { SharePayload } from './payload.js';
+import { type Prepared, type SendHooks, type ShareContext } from './run.js';
+import type { ShareRequestsApi } from './requests-client.js';
+import type { BatchResponse } from './wire.js';
+import { type DeliveryPlan, type PresentDeps } from './delivery.js';
+export interface BrowserFlowDeps extends Omit<PollDeps, 'client'> {
+    client: ShareRequestsApi;
+    appUrl: string;
+    /** This machine's label, shown on the page as client-claimed. */
+    label: string;
+    agent?: string;
+    /** Try to open the link here. The link is printed either way. */
+    openUrl?: (url: string, appUrl: string) => Promise<boolean>;
+    /** What to do with the link (open, QR). Absent: open when `openUrl` is given, never a QR. */
+    plan?: DeliveryPlan;
+    /** Build the QR lines for a link. */
+    qr?: PresentDeps['qr'];
+    /** Terminal width, when known. */
+    columns?: number;
+    /** --copy */
+    copy?: (url: string) => void;
+    /** Unfiltered output for the QR lines (they carry colour escapes that `out` would neutralise). */
+    raw?: (line: string) => void;
+    out: (line: string) => void;
+    err: (line: string) => void;
+}
+/** Split into requests of at most SHARE_BATCH_ITEMS decisions that each seal under the size cap. */
+export declare function groupForApproval(payloads: readonly SharePayload[], to: {
+    tenantId: string;
+    userId: string;
+    gatewayUrl: string;
+}): SharePayload[][];
+export type StepResult = {
+    ok: true;
+    response: BatchResponse;
+} | {
+    ok: false;
+    exit: number;
+};
+/** One request, end to end: stage, show the link, wait, and send the approved bytes. Prints what happened. */
+export declare function approveOne(d: BrowserFlowDeps, to: {
+    tenantId: string;
+    userId: string;
+    gatewayUrl: string;
+}, spec: {
+    kind: RequestKind;
+    payloads: readonly SharePayload[];
+    confirm?: {
+        remoteId: string;
+        teamTextHash: string;
+    };
+    heading?: string;
+    tail?: string;
+}): Promise<StepResult>;
+/**
+ * The hooks that make `send` use the approvals: the first post of a group is the completion already in hand, and a
+ * matched share that waits on the team's text asks for a SECOND approval (kind confirm_team_text), whose page shows
+ * the team's text and refuses when its hash is not the one carried here.
+ */
+export declare function approvalHooks(d: BrowserFlowDeps, to: {
+    tenantId: string;
+    userId: string;
+    gatewayUrl: string;
+}, firstResponse: BatchResponse): SendHooks;
+/**
+ * Run every group through approval and `send`, printing each group's results as soon as they are known (a later
+ * group that fails must not hide an earlier one that landed). Stops at the first group that is not approved.
+ * Returns the exit code.
+ */
+export declare function runBrowserShare(ctx: ShareContext, prep: Prepared, d: BrowserFlowDeps): Promise<number>;
+//# sourceMappingURL=browser-flow.d.ts.map

package/dist/lib/share/browser-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-flow.d.ts","sourceRoot":"","sources":["../../../src/lib/share/browser-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAgD,KAAK,QAAQ,EAAkC,MAAM,eAAe,CAAC;AAC5H,OAAO,EAAuC,KAAK,WAAW,EAAE,MAAM,eAAe,CAAC;AACtF,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AACjD,OAAO,EAAE,KAAK,QAAQ,EAAuB,KAAK,SAAS,EAAqB,KAAK,YAAY,EAAc,MAAM,UAAU,CAAC;AAChI,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC/C,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAe,MAAM,eAAe,CAAC;AAGjF,MAAM,WAAW,eAAgB,SAAQ,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC;IAC/D,MAAM,EAAE,gBAAgB,CAAC;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,6FAA6F;IAC7F,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,qCAAqC;IACrC,EAAE,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACvB,kCAAkC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa;IACb,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,kGAAkG;IAClG,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC7B;AAED,oGAAoG;AACpG,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,EAAE,EAAE,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,GAAG,YAAY,EAAE,EAAE,CAiBlJ;AAED,MAAM,MAAM,UAAU,GAAG;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,aAAa,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAI7F,8GAA8G;AAC9G,wBAAsB,UAAU,CAC9B,CAAC,EAAE,eAAe,EAClB,EAAE,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAC5D,IAAI,EAAE;IAAE,IAAI,EAAE,WAAW,CAAC;IAAC,QAAQ,EAAE,SAAS,YAAY,EAAE,CAAC;IAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;IAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAA;CAAE,GACpJ,OAAO,CAAC,UAAU,CAAC,CAuCrB;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,CAAC,EAAE,eAAe,EAAE,EAAE,EAAE;IAAE,QAAQ,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAE,aAAa,EAAE,aAAa,GAAG,SAAS,CAwBvJ;AAED;;;;GAIG;AACH,wBAAsB,eAAe,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA6B5G"}

package/dist/lib/share/browser-flow.js

@@ -0,0 +1,168 @@
+/**
+ * ALI-1540: `align share` when the person approves in a browser instead of typing y.
+ *
+ * For each request (at most SHARE_BATCH_ITEMS decisions, and small enough to seal): stage it, print the link and the
+ * code, wait, and when the gateway says the person approved, send the approved bytes. The link carries the key in
+ * its `#k=` fragment; this module prints it to the terminal the person is at and keeps it nowhere else (the MCP
+ * path stores it 0600 in the pending directory; this one holds it in memory).
+ *
+ * What a run from inside an agent can do here: stage and wait. Its own CLI token cannot approve: the gateway
+ * refuses it on the approve route. That is why this path, unlike the typed one, is allowed when ALIGN_WRAPPED is set. It is
+ * not a lock: SECURITY.md lists how an agent can still obtain a session.
+ */
+import { approveUrl, completeRequest, CompletionError, pollUntilDecided, stageRequest } from './approval.js';
+import { buildPlaintext, MAX_PLAINTEXT_BYTES } from './envelope.js';
+import { renderResults, send, SHARE_BATCH_ITEMS, ShareError } from './run.js';
+import { presentLink } from './delivery.js';
+import { visible } from './visible.js';
+/** Split into requests of at most SHARE_BATCH_ITEMS decisions that each seal under the size cap. */
+export function groupForApproval(payloads, to) {
+    const size = (g) => buildPlaintext({ kind: 'share', ...to, payloads: g }).length;
+    // A matched share is followed by a SECOND request (confirm_team_text) for the same item, which carries the `confirm` block and a
+    // 64-character hash on every judgement. Size an item by the larger of the two, so the second request cannot be too big after the first landed.
+    const confirmSize = (p) => {
+        const withHash = { ...p, item: { ...p.item, judgements: p.item.judgements.map((j) => ({ ...j, confirm_team_text_hash: 'f'.repeat(64) })) } };
+        return buildPlaintext({ kind: 'confirm_team_text', ...to, payloads: [withHash], confirm: { remoteId: 'f'.repeat(64), teamTextHash: 'f'.repeat(64) } }).length;
+    };
+    const groups = [];
+    let cur = [];
+    for (const p of payloads) {
+        if (Math.max(size([p]), confirmSize(p)) > MAX_PLAINTEXT_BYTES)
+            throw new ShareError(`"${visible(p.item.title)}" is too large to approve in one request (${Math.max(size([p]), confirmSize(p))} bytes sealed, the limit is ${MAX_PLAINTEXT_BYTES}). Nothing was sent. Shorten its text or its notes, then share again.`);
+        if (cur.length > 0 && (cur.length >= SHARE_BATCH_ITEMS || size([...cur, p]) > MAX_PLAINTEXT_BYTES)) {
+            groups.push(cur);
+            cur = [];
+        }
+        cur.push(p);
+    }
+    if (cur.length)
+        groups.push(cur);
+    return groups;
+}
+const minutesLeft = (expiresAt, now) => Math.max(1, Math.round((Date.parse(expiresAt) - now) / 60000));
+/** One request, end to end: stage, show the link, wait, and send the approved bytes. Prints what happened. */
+export async function approveOne(d, to, spec) {
+    // What may be said about this step: for the first request nothing has been sent; for a confirmation or a later request, something already was.
+    const tail = spec.tail ?? 'Nothing was sent.';
+    if (d.signal?.aborted) {
+        d.err(`Cancelled before it was staged. ${tail}`);
+        return { ok: false, exit: 130 };
+    }
+    const plaintext = buildPlaintext({ kind: spec.kind, ...to, payloads: spec.payloads, ...(spec.confirm ? { confirm: spec.confirm } : {}) });
+    const staged = await stageRequest(d.client, {
+        kind: spec.kind, plaintext, tenantId: to.tenantId, userId: to.userId,
+        itemCount: spec.payloads.length, judgementCount: spec.payloads.reduce((n, p) => n + p.item.judgements.length, 0),
+        label: d.label, ...(d.agent ? { agent: d.agent } : {}),
+    }, undefined, d.signal);
+    const url = approveUrl(d.appUrl, staged.id, staged.keyB64Url);
+    if (spec.heading)
+        d.out(spec.heading);
+    d.out(`Approve in your browser: ${url}`);
+    d.out(`Code: ${staged.userCode}  (the page shows the same code. Check they match before you approve.)`);
+    d.out(`The link opens on any device where you are signed in to Align. It expires in ${minutesLeft(staged.expiresAt, d.now())} minutes. Nothing is sent until you approve.`);
+    await presentLink(url, {
+        appUrl: d.appUrl, plan: d.plan ?? { open: d.openUrl !== undefined, qr: false, qrIfOpenFails: false, why: 'default' },
+        ...(d.openUrl ? { openUrl: d.openUrl } : {}), ...(d.qr ? { qr: d.qr } : {}), ...(d.columns !== undefined ? { columns: d.columns } : {}),
+        ...(d.copy ? { copy: d.copy } : {}), out: d.out, raw: d.raw ?? d.out,
+    });
+    d.out('Waiting for your approval. Ctrl-C cancels the request.');
+    const decision = await pollUntilDecided(staged.id, staged.expiresAt, d);
+    switch (decision) {
+        case 'approved': break;
+        case 'declined':
+            d.out(`Declined in your browser. ${tail}`);
+            return { ok: false, exit: 0 };
+        case 'expired':
+            d.err(`The request expired before it was approved. ${tail} Run the share again to start a new one.`);
+            return { ok: false, exit: 1 };
+        case 'cancelled':
+            d.err(`The request was cancelled. ${tail}`);
+            return { ok: false, exit: 1 };
+        case 'failed':
+            d.err(`The gateway marked the request as failed. ${tail} Run the share again.`);
+            return { ok: false, exit: 1 };
+        case 'aborted': {
+            const cancelled = await d.client.cancelShareRequest(staged.id).then(() => true, () => false);
+            d.err(cancelled
+                ? `Cancelled the request. ${tail}`
+                : 'Could not reach the gateway to cancel. The request expires on its own. Nothing can be sent from it, because only this run could finish it and this run has stopped.');
+            return { ok: false, exit: 130 };
+        }
+    }
+    d.out('Approved in your browser. Sending...');
+    return { ok: true, response: await completeRequest(d.client, staged.id, staged.bytesB64) };
+}
+/**
+ * The hooks that make `send` use the approvals: the first post of a group is the completion already in hand, and a
+ * matched share that waits on the team's text asks for a SECOND approval (kind confirm_team_text), whose page shows
+ * the team's text and refuses when its hash is not the one carried here.
+ */
+export function approvalHooks(d, to, firstResponse) {
+    let first = true;
+    return {
+        confirmByApproval: true,
+        post: async (batch, phase, confirm) => {
+            if (phase === 'share') {
+                if (!first)
+                    throw new ShareError('Internal error: a group was posted twice.');
+                first = false;
+                return firstResponse;
+            }
+            d.out('\nYour ratification would sit on the team\'s existing text, so that needs its own approval.');
+            const tail = 'The share itself already went through; your ratify is not confirmed. Run the share again to retry.';
+            try {
+                const step = await approveOne(d, to, { kind: 'confirm_team_text', payloads: batch, tail, ...(confirm ? { confirm } : {}) });
+                return step.ok ? step.response : null;
+            }
+            catch (e) {
+                // The first request already landed and is recorded: a failure here (the server's live-request cap, three failed reads, a
+                // completion with no verdict) must not turn the run into a report that nothing happened.
+                const why = e instanceof CompletionError ? (e.sent === 'maybe' ? 'the gateway did not say whether it finished; check your team graph' : 'the gateway refused it') : visible(e.message);
+                d.err(`The confirmation of the team's text did not finish (${why}). ${tail}`);
+                return null;
+            }
+        },
+    };
+}
+/**
+ * Run every group through approval and `send`, printing each group's results as soon as they are known (a later
+ * group that fails must not hide an earlier one that landed). Stops at the first group that is not approved.
+ * Returns the exit code.
+ */
+export async function runBrowserShare(ctx, prep, d) {
+    if (prep.userId === null)
+        throw new ShareError('The gateway did not say who you are signed in as, so a request cannot be sealed to you. Nothing was staged. Run: align login');
+    const to = { tenantId: prep.tenantId, userId: prep.userId, gatewayUrl: prep.gatewayUrl };
+    const groups = groupForApproval(prep.payloads, to);
+    let failed = false;
+    let landed = 0;
+    for (const [i, group] of groups.entries()) {
+        const heading = groups.length > 1 ? `\nRequest ${i + 1} of ${groups.length} (${group.length} decision${group.length === 1 ? '' : 's'}):` : undefined;
+        let step;
+        try {
+            step = await approveOne(d, to, { kind: 'share', payloads: group, ...(heading ? { heading } : {}), ...(landed ? { tail: 'Nothing more was sent (the earlier requests in this run were).' } : {}) });
+        }
+        catch (e) {
+            if (landed === 0)
+                throw e;
+            // Earlier requests are on the team graph and printed above: say this one failed, not that the run sent nothing.
+            throw new ShareError(`${e.message} (That is about this request only: ${landed} earlier request${landed === 1 ? ' was' : 's were'} sent, see above.)`);
+        }
+        if (!step.ok)
+            return failed ? 1 : step.exit;
+        landed += 1;
+        let rows;
+        try {
+            rows = await send(ctx, { ...prep, payloads: group }, approvalHooks(d, to, step.response));
+        }
+        catch (e) {
+            d.err(`The gateway completed this request, so it is on your team graph, but this run could not finish recording it (${visible(e.message)}). \`align share --retract\` may not find it until you share the same decision again. That is safe: it will not make a second copy.`);
+            return 1;
+        }
+        d.out(`\n${renderResults(rows)}`);
+        if (rows.some((r) => r.outcome.kind === 'refused' || r.outcome.kind === 'unknown'))
+            failed = true;
+    }
+    return failed ? 1 : 0;
+}
+//# sourceMappingURL=browser-flow.js.map

package/dist/lib/share/browser-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"browser-flow.js","sourceRoot":"","sources":["../../../src/lib/share/browser-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,UAAU,EAAE,eAAe,EAAE,eAAe,EAAiB,gBAAgB,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAC5H,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAoB,MAAM,eAAe,CAAC;AAEtF,OAAO,EAAiB,aAAa,EAAE,IAAI,EAAkB,iBAAiB,EAAqB,UAAU,EAAE,MAAM,UAAU,CAAC;AAGhI,OAAO,EAAuC,WAAW,EAAE,MAAM,eAAe,CAAC;AACjF,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AAwBvC,oGAAoG;AACpG,MAAM,UAAU,gBAAgB,CAAC,QAAiC,EAAE,EAA4D;IAC9H,MAAM,IAAI,GAAG,CAAC,CAA0B,EAAU,EAAE,CAAC,cAAc,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC,MAAM,CAAC;IAClH,iIAAiI;IACjI,+IAA+I;IAC/I,MAAM,WAAW,GAAG,CAAC,CAAe,EAAU,EAAE;QAC9C,MAAM,QAAQ,GAAiB,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,sBAAsB,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;QAC3J,OAAO,cAAc,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC;IAChK,CAAC,CAAC;IACF,MAAM,MAAM,GAAqB,EAAE,CAAC;IACpC,IAAI,GAAG,GAAmB,EAAE,CAAC;IAC7B,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,IAAI,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,GAAG,mBAAmB;YAAE,MAAM,IAAI,UAAU,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,6CAA6C,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,+BAA+B,mBAAmB,uEAAuE,CAAC,CAAC;QACxT,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,IAAI,iBAAiB,IAAI,IAAI,CAAC,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,mBAAmB,CAAC,EAAE,CAAC;YAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAAC,GAAG,GAAG,EAAE,CAAC;QAAC,CAAC;QACnI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACd,CAAC;IACD,IAAI,GAAG,CAAC,MAAM;QAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjC,OAAO,MAAM,CAAC;AAChB,CAAC;AAID,MAAM,WAAW,GAAG,CAAC,SAAiB,EAAE,GAAW,EAAU,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,GAAG,GAAG,CAAC,GAAG,KAAK,CAAC,CAAC,CAAC;AAE/H,8GAA8G;AAC9G,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,CAAkB,EAClB,EAA4D,EAC5D,IAAqJ;IAErJ,+IAA+I;IAC/I,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,mBAAmB,CAAC;IAC9C,IAAI,CAAC,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;QAAC,CAAC,CAAC,GAAG,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;IAAC,CAAC;IAC7G,MAAM,SAAS,GAAG,cAAc,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IAC1I,MAAM,MAAM,GAAG,MAAM,YAAY,CAAC,CAAC,CAAC,MAAM,EAAE;QAC1C,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,SAAS,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,CAAC,MAAM;QACpE,SAAS,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,cAAc,EAAE,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;QAChH,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACvD,EAAE,SAAS,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC;IACxB,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAC9D,IAAI,IAAI,CAAC,OAAO;QAAE,CAAC,CAAC,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACtC,CAAC,CAAC,GAAG,CAAC,4BAA4B,GAAG,EAAE,CAAC,CAAC;IACzC,CAAC,CAAC,GAAG,CAAC,SAAS,MAAM,CAAC,QAAQ,wEAAwE,CAAC,CAAC;IACxG,CAAC,CAAC,GAAG,CAAC,gFAAgF,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC,8CAA8C,CAAC,CAAC;IAC5K,MAAM,WAAW,CAAC,GAAG,EAAE;QACrB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,OAAO,KAAK,SAAS,EAAE,EAAE,EAAE,KAAK,EAAE,aAAa,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE;QACpH,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvI,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,GAAG;KACrE,CAAC,CAAC;IACH,CAAC,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC;IAEhE,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC;IACxE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,UAAU,CAAC,CAAC,MAAM;QACvB,KAAK,UAAU;YAAE,CAAC,CAAC,GAAG,CAAC,6BAA6B,IAAI,EAAE,CAAC,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC3F,KAAK,SAAS;YAAE,CAAC,CAAC,GAAG,CAAC,+CAA+C,IAAI,0CAA0C,CAAC,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QACpJ,KAAK,WAAW;YAAE,CAAC,CAAC,GAAG,CAAC,8BAA8B,IAAI,EAAE,CAAC,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC7F,KAAK,QAAQ;YAAE,CAAC,CAAC,GAAG,CAAC,6CAA6C,IAAI,uBAAuB,CAAC,CAAC;YAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC;QAC9H,KAAK,SAAS,CAAC,CAAC,CAAC;YACf,MAAM,SAAS,GAAG,MAAM,CAAC,CAAC,MAAM,CAAC,kBAAkB,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC;YAC7F,CAAC,CAAC,GAAG,CAAC,SAAS;gBACb,CAAC,CAAC,0BAA0B,IAAI,EAAE;gBAClC,CAAC,CAAC,qKAAqK,CAAC,CAAC;YAC3K,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;QAClC,CAAC;IACH,CAAC;IACD,CAAC,CAAC,GAAG,CAAC,sCAAsC,CAAC,CAAC;IAC9C,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC,CAAC,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,CAAC;AAC7F,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,CAAkB,EAAE,EAA4D,EAAE,aAA4B;IAC1I,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,OAAO;QACL,iBAAiB,EAAE,IAAI;QACvB,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,EAAE;YACpC,IAAI,KAAK,KAAK,OAAO,EAAE,CAAC;gBACtB,IAAI,CAAC,KAAK;oBAAE,MAAM,IAAI,UAAU,CAAC,2CAA2C,CAAC,CAAC;gBAC9E,KAAK,GAAG,KAAK,CAAC;gBACd,OAAO,aAAa,CAAC;YACvB,CAAC;YACD,CAAC,CAAC,GAAG,CAAC,6FAA6F,CAAC,CAAC;YACrG,MAAM,IAAI,GAAG,oGAAoG,CAAC;YAClH,IAAI,CAAC;gBACH,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,mBAAmB,EAAE,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;gBAC5H,OAAO,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC;YACxC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACX,yHAAyH;gBACzH,yFAAyF;gBACzF,MAAM,GAAG,GAAG,CAAC,YAAY,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,KAAK,OAAO,CAAC,CAAC,CAAC,oEAAoE,CAAC,CAAC,CAAC,wBAAwB,CAAC,CAAC,CAAC,CAAC,OAAO,CAAE,CAAW,CAAC,OAAO,CAAC,CAAC;gBAClM,CAAC,CAAC,GAAG,CAAC,uDAAuD,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC;gBAC9E,OAAO,IAAI,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,GAAiB,EAAE,IAAc,EAAE,CAAkB;IACzF,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI;QAAE,MAAM,IAAI,UAAU,CAAC,8HAA8H,CAAC,CAAC;IAC/K,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,UAAU,EAAE,IAAI,CAAC,UAAU,EAAE,CAAC;IACzF,MAAM,MAAM,GAAG,gBAAgB,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IACnD,IAAI,MAAM,GAAG,KAAK,CAAC;IACnB,IAAI,MAAM,GAAG,CAAC,CAAC;IACf,KAAK,MAAM,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QAC1C,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QACrJ,IAAI,IAAgB,CAAC;QACrB,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,UAAU,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,gEAAgE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QACrM,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,IAAI,MAAM,KAAK,CAAC;gBAAE,MAAM,CAAC,CAAC;YAC1B,gHAAgH;YAChH,MAAM,IAAI,UAAU,CAAC,GAAI,CAAW,CAAC,OAAO,sCAAsC,MAAM,mBAAmB,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,QAAQ,oBAAoB,CAAC,CAAC;QACnK,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAC5C,MAAM,IAAI,CAAC,CAAC;QACZ,IAAI,IAAI,CAAC;QACT,IAAI,CAAC;YACH,IAAI,GAAG,MAAM,IAAI,CAAC,GAAG,EAAE,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,EAAE,aAAa,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5F,CAAC;QAAC,OAAO,CAAC,EAAE,CAAC;YACX,CAAC,CAAC,GAAG,CAAC,gHAAgH,OAAO,CAAE,CAAW,CAAC,OAAO,CAAC,qIAAqI,CAAC,CAAC;YAC1R,OAAO,CAAC,CAAC;QACX,CAAC;QACD,CAAC,CAAC,GAAG,CAAC,KAAK,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;QAClC,IAAI,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,CAAC,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC;YAAE,MAAM,GAAG,IAAI,CAAC;IACpG,CAAC;IACD,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxB,CAAC"}

package/dist/lib/share/command.d.ts

@@ -0,0 +1,65 @@
+import { type EnvironmentConfig } from '../config.js';
+import { type DeliveryPlan, type PresentDeps } from './delivery.js';
+import { type ShareClient } from './run.js';
+import type { Judge } from '../curation/judgements-db.js';
+export interface ShareOptions {
+    ids: string[];
+    allRatified?: boolean;
+    /** An already-parsed lower bound (ISO), for --since. */
+    sinceIso?: string;
+    confirm?: string;
+    retract?: string;
+    /** Use the typed-yes flow although the gateway offers browser approval (refused when it requires it). */
+    typed?: boolean;
+    /** --open <request id>: re-open or re-print the link of a request an agent staged on this machine. */
+    openRequest?: string;
+    envName: string;
+}
+/** Everything the browser flow needs from the outside world, so tests drive it with a fake clock and no browser. */
+export interface ApprovalDeps {
+    /** The web app's base URL (the link's origin), from the environment. */
+    appUrl: string;
+    /** This machine's label, shown on the page as client-claimed. */
+    label: string;
+    openUrl?: (url: string, appUrl: string) => Promise<boolean>;
+    /** Open and/or QR for the link: see decideDelivery. */
+    plan?: DeliveryPlan;
+    qr?: PresentDeps['qr'];
+    columns?: number;
+    copy?: (url: string) => void;
+    sleep: (ms: number, signal?: AbortSignal) => Promise<void>;
+    now: () => number;
+    /**
+     * Runs the waiting part with a signal that aborts on Ctrl-C (the request is then cancelled and nothing is sent),
+     * and takes the handler away afterwards. Absent, nothing can interrupt the wait but the expiry.
+     */
+    guard?: <T>(run: (signal: AbortSignal | undefined) => Promise<T>) => Promise<T>;
+}
+export interface ShareDeps {
+    cloudEnv: EnvironmentConfig;
+    /** Set for a team destination: the web app saved when it was joined. Approval links use it, and a gateway that disagrees stops the share. */
+    teamAppUrl?: string;
+    /** This install's salt for the opaque client_key. */
+    salt: string;
+    /** The environment's default gateway URL: anything else is shown in the preview. */
+    defaultGatewayUrl: string;
+    localDbPath: string | null;
+    client: () => ShareClient;
+    judge: () => Promise<Judge>;
+    /** The person's own git identity: `--all-ratified` shares only what they ratified. */
+    owner: () => Promise<string>;
+    /** True inside an agent that `align` launched (ALIGN_WRAPPED): the TYPED flow is then refused, as a speed bump. Asking for browser approval is not. */
+    wrapped: boolean;
+    approval: ApprovalDeps;
+    /** Show `shown` and ask on the controlling terminal; null when there is no interactive terminal. */
+    ttyConfirm: (shown: string, question: string) => Promise<boolean | null>;
+    out: (line: string) => void;
+    err: (line: string) => void;
+    /**
+     * The optional work-email prompt (lib/lead-prompt.ts). Called ONLY on the no-team-login path of this human command,
+     * after the upgrade line. Absent in the MCP tools, which never ask a person for an email.
+     */
+    leadPrompt?: () => Promise<unknown>;
+}
+export declare function runShare(opts: ShareOptions, deps: ShareDeps): Promise<number>;
+//# sourceMappingURL=command.d.ts.map

package/dist/lib/share/command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"command.d.ts","sourceRoot":"","sources":["../../../src/lib/share/command.ts"],"names":[],"mappings":"AAiBA,OAAO,EAAE,KAAK,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAGtD,OAAO,EAAE,KAAK,YAAY,EAAE,KAAK,WAAW,EAAe,MAAM,eAAe,CAAC;AAKjF,OAAO,EAAqG,KAAK,WAAW,EAAc,MAAM,UAAU,CAAC;AAC3J,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,8BAA8B,CAAC;AAE1D,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,WAAW,CAAC,EAAE,OAAO,CAAC;IACtB,wDAAwD;IACxD,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,yGAAyG;IACzG,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,sGAAsG;IACtG,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,oHAAoH;AACpH,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,MAAM,EAAE,MAAM,CAAC;IACf,iEAAiE;IACjE,KAAK,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IAC5D,uDAAuD;IACvD,IAAI,CAAC,EAAE,YAAY,CAAC;IACpB,EAAE,CAAC,EAAE,WAAW,CAAC,IAAI,CAAC,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,KAAK,EAAE,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAC3D,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB;;;OAGG;IACH,KAAK,CAAC,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC,MAAM,EAAE,WAAW,GAAG,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;CACjF;AAED,MAAM,WAAW,SAAS;IACxB,QAAQ,EAAE,iBAAiB,CAAC;IAC5B,6IAA6I;IAC7I,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,qDAAqD;IACrD,IAAI,EAAE,MAAM,CAAC;IACb,oFAAoF;IACpF,iBAAiB,EAAE,MAAM,CAAC;IAC1B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,MAAM,WAAW,CAAC;IAC1B,KAAK,EAAE,MAAM,OAAO,CAAC,KAAK,CAAC,CAAC;IAC5B,sFAAsF;IACtF,KAAK,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAC7B,uJAAuJ;IACvJ,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,YAAY,CAAC;IACvB,oGAAoG;IACpG,UAAU,EAAE,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,CAAC;IACzE,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC5B;;;OAGG;IACH,UAAU,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAC;CACrC;AAOD,wBAAsB,QAAQ,CAAC,IAAI,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,MAAM,CAAC,CAiInF"}