@aligndottech/cli 0.49.0 → 0.51.0

package/dist/lib/share/requests-client.d.ts

@@ -0,0 +1,63 @@
+/**
+ * ALI-1540: the gateway's share-request routes, parsed without trusting them.
+ *
+ * Built from `request` (the gateway client's own fetch wrapper: bearer, identity headers, error text) so there
+ * is one HTTP path. Every call refuses a redirect: a 30x to another host would carry the bearer token and the
+ * sealed request. Every answer is validated, and an answer that does not look right is an error, never a
+ * default: a gateway that says something this CLI does not know is not asked to approve anything.
+ *
+ * Routes (the plan's Routes table; the gateway side is built separately, so these shapes are the contract):
+ *   GET  /share-requests/config            -> { mode, pending_ttl_s, complete_ttl_s, app_url? }   (404: an older gateway; app_url: gateway PR #3094)
+ *   POST /share-requests                   -> 201 { id (the SERVER's row id), user_code, expires_at }; 409 on a repeated envelope_id for this tenant and user
+ *   GET  /share-requests/:id               -> { state, expires_at? }
+ *   POST /share-requests/:id/cancel        -> any 2xx
+ *   POST /share-requests/:id/complete      -> the /ingest/batch response shape
+ */
+import type { BatchResponse } from './wire.js';
+export type ShareMode = 'off' | 'available' | 'required';
+export interface ShareRequestsConfig {
+    mode: ShareMode;
+    pendingTtlS: number | null;
+    completeTtlS: number | null; /** The gateway's own web app address (its FRONTEND_URL origin), when it says one. Not yet validated: see resolveApprovalAppUrl. */
+    appUrl: string | null;
+}
+export type RequestState = 'pending' | 'approved' | 'completing' | 'completed' | 'declined' | 'expired' | 'cancelled' | 'failed';
+export interface StageBody {
+    /** The CLI's own id for the sealed envelope (in its AAD). Unique per tenant and user; NOT the row's id. */
+    envelope_id: string;
+    kind: 'share' | 'confirm_team_text';
+    /** iv || ciphertext || tag, base64. */
+    envelope: string;
+    payload_sha256: string;
+    item_count: number;
+    judgement_count: number;
+    requester_label?: string;
+    agent?: string;
+}
+export interface StagedRequest {
+    id: string;
+    userCode: string;
+    expiresAt: string;
+}
+export interface ShareRequestStatus {
+    state: RequestState;
+    expiresAt: string | null;
+}
+export interface ShareRequestsApi {
+    /** Null when the gateway has no such route (404): an older gateway, so the typed path applies. `signal` aborts the call (Ctrl-C). */
+    shareRequestsConfig(signal?: AbortSignal): Promise<ShareRequestsConfig | null>;
+    stageShareRequest(body: StageBody, signal?: AbortSignal): Promise<StagedRequest>;
+    getShareRequest(id: string, signal?: AbortSignal): Promise<ShareRequestStatus>;
+    cancelShareRequest(id: string): Promise<void>;
+    completeShareRequest(id: string, payloadB64: string): Promise<BatchResponse>;
+}
+export declare const REQUEST_ID_RE: RegExp;
+type Requester = <T>(path: string, options?: Parameters<typeof fetch>[1] & {
+    maxBytes?: number;
+}) => Promise<T>;
+/** Every call has a deadline and a size cap: a gateway that hangs or answers without end cannot hold this process. */
+export declare const REQUEST_TIMEOUT_MS = 15000;
+export declare const COMPLETE_TIMEOUT_MS = 30000;
+export declare function shareRequestMethods(request: Requester): ShareRequestsApi;
+export {};
+//# sourceMappingURL=requests-client.d.ts.map

package/dist/lib/share/requests-client.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"requests-client.d.ts","sourceRoot":"","sources":["../../../src/lib/share/requests-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAE/C,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,WAAW,GAAG,UAAU,CAAC;AAGzD,MAAM,WAAW,mBAAmB;IAAG,IAAI,EAAE,SAAS,CAAC;IAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,mIAAmI;IAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAE5Q,MAAM,MAAM,YAAY,GAAG,SAAS,GAAG,UAAU,GAAG,YAAY,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAC;AAGjI,MAAM,WAAW,SAAS;IACxB,2GAA2G;IAC3G,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,OAAO,GAAG,mBAAmB,CAAC;IACpC,uCAAuC;IACvC,QAAQ,EAAE,MAAM,CAAC;IACjB,cAAc,EAAE,MAAM,CAAC;IACvB,UAAU,EAAE,MAAM,CAAC;IACnB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED,MAAM,WAAW,aAAa;IAAG,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAC;IAAC,SAAS,EAAE,MAAM,CAAA;CAAE;AAClF,MAAM,WAAW,kBAAkB;IAAG,KAAK,EAAE,YAAY,CAAC;IAAC,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE;AAErF,MAAM,WAAW,gBAAgB;IAC/B,qIAAqI;IACrI,mBAAmB,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,mBAAmB,GAAG,IAAI,CAAC,CAAC;IAC/E,iBAAiB,CAAC,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IACjF,eAAe,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAAC;IAC/E,kBAAkB,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IAC9C,oBAAoB,CAAC,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;CAC9E;AAED,eAAO,MAAM,aAAa,QAAmE,CAAC;AAG9F,KAAK,SAAS,GAAG,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,KAAK,OAAO,CAAC,CAAC,CAAC,CAAC;AAEhH,sHAAsH;AACtH,eAAO,MAAM,kBAAkB,QAAS,CAAC;AACzC,eAAO,MAAM,mBAAmB,QAAS,CAAC;AAY1C,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,GAAG,gBAAgB,CAwCxE"}

package/dist/lib/share/requests-client.js

@@ -0,0 +1,69 @@
+const MODES = ['off', 'available', 'required'];
+const STATES = ['pending', 'approved', 'completing', 'completed', 'declined', 'expired', 'cancelled', 'failed'];
+export const REQUEST_ID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/;
+const USER_CODE_RE = /^[A-HJ-NP-Z2-9]{4}-[A-HJ-NP-Z2-9]{4}$/;
+/** Every call has a deadline and a size cap: a gateway that hangs or answers without end cannot hold this process. */
+export const REQUEST_TIMEOUT_MS = 15_000;
+export const COMPLETE_TIMEOUT_MS = 30_000;
+const SMALL_ANSWER_BYTES = 64 * 1024;
+const BATCH_ANSWER_BYTES = 2 * 1024 * 1024;
+const bad = (what) => new Error(`The gateway answered the share request with something this CLI does not recognise (${what}), so nothing was done.`);
+const isObj = (v) => typeof v === 'object' && v !== null && !Array.isArray(v);
+function idOf(id) {
+    if (!REQUEST_ID_RE.test(id))
+        throw new Error('That is not a share request id.');
+    return id;
+}
+export function shareRequestMethods(request) {
+    const call = (path, init = {}, o = {}) => {
+        const deadline = AbortSignal.timeout(o.timeoutMs ?? REQUEST_TIMEOUT_MS);
+        return request(path, { redirect: 'error', maxBytes: o.maxBytes ?? SMALL_ANSWER_BYTES, signal: o.signal ? AbortSignal.any([o.signal, deadline]) : deadline, ...init });
+    };
+    return {
+        async shareRequestsConfig(signal) {
+            let raw;
+            try {
+                raw = await call('/share-requests/config', {}, { signal });
+            }
+            catch (e) {
+                if (e.statusCode === 404)
+                    return null;
+                throw e;
+            }
+            if (!isObj(raw) || typeof raw['mode'] !== 'string' || !MODES.includes(raw['mode']))
+                throw bad('the approval mode');
+            const num = (v) => (typeof v === 'number' && Number.isFinite(v) && v > 0 ? v : null);
+            return { mode: raw['mode'], pendingTtlS: num(raw['pending_ttl_s']), completeTtlS: num(raw['complete_ttl_s']), appUrl: typeof raw['app_url'] === 'string' && raw['app_url'] !== '' ? raw['app_url'] : null };
+        },
+        async stageShareRequest(body, signal) {
+            const raw = await call('/share-requests', { method: 'POST', body: JSON.stringify(body) }, { signal });
+            if (!isObj(raw) || typeof raw['id'] !== 'string' || typeof raw['user_code'] !== 'string' || typeof raw['expires_at'] !== 'string')
+                throw bad('the staged request');
+            // The row id is the server's. Every later route uses it, so it must be a well-formed UUID before it becomes a path.
+            if (!REQUEST_ID_RE.test(raw['id']))
+                throw bad('the request id');
+            if (!USER_CODE_RE.test(raw['user_code']))
+                throw bad('the code');
+            if (Number.isNaN(Date.parse(raw['expires_at'])))
+                throw bad('the expiry');
+            return { id: raw['id'], userCode: raw['user_code'], expiresAt: raw['expires_at'] };
+        },
+        async getShareRequest(id, signal) {
+            const raw = await call(`/share-requests/${idOf(id)}`, {}, { signal });
+            if (!isObj(raw) || typeof raw['state'] !== 'string' || !STATES.includes(raw['state']))
+                throw bad('the request state');
+            const expires = typeof raw['expires_at'] === 'string' && !Number.isNaN(Date.parse(raw['expires_at'])) ? raw['expires_at'] : null;
+            return { state: raw['state'], expiresAt: expires };
+        },
+        async cancelShareRequest(id) {
+            await call(`/share-requests/${idOf(id)}/cancel`, { method: 'POST', body: '{}' });
+        },
+        async completeShareRequest(id, payloadB64) {
+            const raw = await call(`/share-requests/${idOf(id)}/complete`, { method: 'POST', body: JSON.stringify({ payload_b64: payloadB64 }) }, { timeoutMs: COMPLETE_TIMEOUT_MS, maxBytes: BATCH_ANSWER_BYTES });
+            if (!isObj(raw))
+                throw bad('the completion');
+            return raw;
+        },
+    };
+}
+//# sourceMappingURL=requests-client.js.map

package/dist/lib/share/requests-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"requests-client.js","sourceRoot":"","sources":["../../../src/lib/share/requests-client.ts"],"names":[],"mappings":"AAkBA,MAAM,KAAK,GAAsB,CAAC,KAAK,EAAE,WAAW,EAAE,UAAU,CAAC,CAAC;AAKlE,MAAM,MAAM,GAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,YAAY,EAAE,WAAW,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC,CAAC;AA2BnI,MAAM,CAAC,MAAM,aAAa,GAAG,gEAAgE,CAAC;AAC9F,MAAM,YAAY,GAAG,uCAAuC,CAAC;AAI7D,sHAAsH;AACtH,MAAM,CAAC,MAAM,kBAAkB,GAAG,MAAM,CAAC;AACzC,MAAM,CAAC,MAAM,mBAAmB,GAAG,MAAM,CAAC;AAC1C,MAAM,kBAAkB,GAAG,EAAE,GAAG,IAAI,CAAC;AACrC,MAAM,kBAAkB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AAE3C,MAAM,GAAG,GAAG,CAAC,IAAY,EAAS,EAAE,CAAC,IAAI,KAAK,CAAC,sFAAsF,IAAI,yBAAyB,CAAC,CAAC;AACpK,MAAM,KAAK,GAAG,CAAC,CAAU,EAAgC,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAErH,SAAS,IAAI,CAAC,EAAU;IACtB,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IAChF,OAAO,EAAE,CAAC;AACZ,CAAC;AAED,MAAM,UAAU,mBAAmB,CAAC,OAAkB;IACpD,MAAM,IAAI,GAAG,CAAI,IAAY,EAAE,OAA2C,EAAE,EAAE,IAAqE,EAAE,EAAc,EAAE;QACnK,MAAM,QAAQ,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,IAAI,kBAAkB,CAAC,CAAC;QACxE,OAAO,OAAO,CAAI,IAAI,EAAE,EAAE,QAAQ,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,kBAAkB,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,GAAG,IAAI,EAAE,CAAC,CAAC;IAC3K,CAAC,CAAC;IACF,OAAO;QACL,KAAK,CAAC,mBAAmB,CAAC,MAAM;YAC9B,IAAI,GAAY,CAAC;YACjB,IAAI,CAAC;gBAAC,GAAG,GAAG,MAAM,IAAI,CAAU,wBAAwB,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAAC,CAAC;YAAC,OAAO,CAAC,EAAE,CAAC;gBACtF,IAAK,CAA6B,CAAC,UAAU,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBACnE,MAAM,CAAC,CAAC;YACV,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,MAAM,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACnH,MAAM,GAAG,GAAG,CAAC,CAAU,EAAiB,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;YAC7G,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAc,EAAE,WAAW,EAAE,GAAG,CAAC,GAAG,CAAC,eAAe,CAAC,CAAC,EAAE,YAAY,EAAE,GAAG,CAAC,GAAG,CAAC,gBAAgB,CAAC,CAAC,EAAE,MAAM,EAAE,OAAO,GAAG,CAAC,SAAS,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3N,CAAC;QACD,KAAK,CAAC,iBAAiB,CAAC,IAAI,EAAE,MAAM;YAClC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAU,iBAAiB,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/G,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,IAAI,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,WAAW,CAAC,KAAK,QAAQ,IAAI,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC,oBAAoB,CAAC,CAAC;YACnK,oHAAoH;YACpH,IAAI,CAAC,aAAa,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAChE,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC,UAAU,CAAC,CAAC;YAChE,IAAI,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC,YAAY,CAAC,CAAC;YACzE,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,GAAG,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,YAAY,CAAC,EAAE,CAAC;QACrF,CAAC;QACD,KAAK,CAAC,eAAe,CAAC,EAAE,EAAE,MAAM;YAC9B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAU,mBAAmB,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC;YAC/E,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAAE,MAAM,GAAG,CAAC,mBAAmB,CAAC,CAAC;YACtH,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YACjI,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAiB,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;QACrE,CAAC;QACD,KAAK,CAAC,kBAAkB,CAAC,EAAE;YACzB,MAAM,IAAI,CAAC,mBAAmB,IAAI,CAAC,EAAE,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,KAAK,CAAC,oBAAoB,CAAC,EAAE,EAAE,UAAU;YACvC,MAAM,GAAG,GAAG,MAAM,IAAI,CAAU,mBAAmB,IAAI,CAAC,EAAE,CAAC,WAAW,EAAE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,SAAS,EAAE,mBAAmB,EAAE,QAAQ,EAAE,kBAAkB,EAAE,CAAC,CAAC;YACjN,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;gBAAE,MAAM,GAAG,CAAC,gBAAgB,CAAC,CAAC;YAC7C,OAAO,GAAoB,CAAC;QAC9B,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/lib/share/run.d.ts

@@ -0,0 +1,134 @@
+/**
+ * L9: the share flow with no I/O of its own beyond the injected client: select, build, scan, price
+ * the preview, send, read the answer, record the ledger. `align share`, `align share --confirm` and
+ * `align_share` all call it, so the three cannot disagree about what a share is.
+ *
+ * Order, and why: the secret scan runs on the payload that will be SENT (a refusal names the decision,
+ * the field and the placeholder, never the match); an item already shared with an unchanged payload
+ * is "already shared" and makes no call; only then is anything previewed. Nothing here sends without
+ * the caller having passed `send`, and `prepare` never calls the network except `whoami` (a read).
+ */
+import { type Judge } from '../curation/judgements-db.js';
+import { type DecisionRow } from '../local-db.js';
+import { type Promotion } from './ledger.js';
+import type { ShareRequestsApi } from './requests-client.js';
+import { type SharePayload } from './payload.js';
+import { type Destination } from './preview.js';
+import { type SecretFinding } from './secret-scan.js';
+import { type BatchResponse, type ItemOutcome } from './wire.js';
+export interface TeamDecision {
+    title?: string;
+    summary?: string;
+    /** The decision's AI payload: the server's team-text hash also covers its statements, Gherkin and acceptance criteria. */
+    decision_json?: {
+        ai?: {
+            decisions?: unknown;
+            gherkin?: unknown;
+            acceptance_criteria?: unknown;
+        };
+    } | null;
+}
+export interface ShareClient extends ShareRequestsApi {
+    whoami(): Promise<{
+        user: {
+            email: string;
+            id?: string;
+        };
+        tenant: {
+            id: string;
+            name: string;
+        };
+    }>;
+    shareBatch(items: Array<Record<string, unknown>>): Promise<BatchResponse>;
+    getDecision(id: string): Promise<TeamDecision>;
+    archiveDecision(id: string): Promise<void>;
+}
+export interface ShareContext {
+    dbPath: string;
+    envName: string;
+    client: ShareClient;
+    judge: Judge;
+    /** This install's private share salt (see salt.ts): never sent anywhere, not the telemetry install id. */
+    salt: string;
+    /** Where the share goes. Shown whenever it is not the environment's default, and bound into a confirmation code. */
+    gatewayUrl: string;
+    /** The default gateway URL for this environment, to tell an override from the norm. */
+    defaultGatewayUrl: string;
+}
+export declare class ShareError extends Error {
+    readonly exitCode: number;
+    constructor(message: string, exitCode?: number);
+}
+export interface Prepared {
+    payloads: SharePayload[];
+    dest: Destination;
+    tenantId: string;
+    /** The signed-in user's id (from whoami), bound into a sealed request's AAD. Null when the gateway did not say. */
+    userId: string | null;
+    gatewayUrl: string;
+    /** What this machine knew of each payload before: its ledger row, if any (live or retracted). */
+    priors: Map<string, Promotion | null>;
+    /** Decisions whose payload is unchanged since the last share: nothing to send. */
+    already: Array<{
+        localId: string;
+        title: string;
+        remoteId: string;
+    }>;
+    secrets: Array<SecretFinding & {
+        localId: string;
+    }>;
+    preview: string;
+}
+/** Batches of at most this many items: 10 x the gateway's 50 judgements per item stays under its 500 per request. */
+export declare const SHARE_BATCH_ITEMS = 10;
+export declare function ratifiedRows(dbPath: string, opts?: {
+    owner?: string;
+    sinceIso?: string;
+}): DecisionRow[];
+export declare function prepare(ctx: ShareContext, ids: string[]): Promise<Prepared>;
+/** The refusal text: where, which kind, never the value. */
+export declare function secretRefusal(secrets: Prepared['secrets']): string;
+export type RowResult = {
+    localId: string;
+    title: string;
+    outcome: ItemOutcome;
+    judgementFailures: Array<{
+        index: number;
+        error: string;
+    }>;
+    /** Things the person must know that are not failures (an older gateway, a share treated as not yours to retract). */
+    warnings: string[];
+};
+export interface SendHooks {
+    /** A matched share whose ratify/supersede wait on the team's text: show it, return whether the person agrees. */
+    confirmTeamText?: (info: {
+        localId: string;
+        title: string;
+        team: TeamDecision;
+    }) => Promise<boolean>;
+    /**
+     * Browser approval (ALI-1540): the batch goes out through the gateway's completion of a request the person
+     * approved, NOT through shareBatch. Called once per batch with phase 'share' (the caller already holds the
+     * answer) and once more with phase 'confirm' for a re-post that waits on the team's text. Null means that
+     * step was not approved (declined, expired, cancelled): nothing was posted for it.
+     */
+    post?: (batch: SharePayload[], phase: 'share' | 'confirm', confirm?: {
+        remoteId: string;
+        teamTextHash: string;
+    }) => Promise<BatchResponse | null>;
+    /**
+     * With `post`: whether the person can approve the team-text confirmation in this run. Absent, the judgements
+     * that wait on it stay unconfirmed and the result says so (a person re-runs the share to finish that step).
+     */
+    confirmByApproval?: boolean;
+}
+export declare function send(ctx: ShareContext, prep: Prepared, hooks?: SendHooks): Promise<RowResult[]>;
+/** Every field the server's team-text hash covers, so what the person confirms is what the hash pins. */
+export declare function renderTeamText(team: TeamDecision): string;
+export declare function renderResults(rows: readonly RowResult[]): string;
+export interface RetractResult {
+    ok: boolean;
+    message: string;
+}
+export declare function retract(ctx: ShareContext, localId: string): Promise<RetractResult>;
+//# sourceMappingURL=run.d.ts.map

package/dist/lib/share/run.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.d.ts","sourceRoot":"","sources":["../../../src/lib/share/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAkB,KAAK,KAAK,EAAkB,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAiB,KAAK,WAAW,EAAE,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAgF,KAAK,SAAS,EAA0D,MAAM,aAAa,CAAC;AAGnL,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAC7D,OAAO,EAAmC,KAAK,YAAY,EAAE,MAAM,cAAc,CAAC;AAClF,OAAO,EAAE,KAAK,WAAW,EAAiB,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAiD,KAAK,aAAa,EAAE,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAE,KAAK,aAAa,EAAoB,KAAK,WAAW,EAAsC,MAAM,WAAW,CAAC;AAEvH,MAAM,WAAW,YAAY;IAC3B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0HAA0H;IAC1H,aAAa,CAAC,EAAE;QAAE,EAAE,CAAC,EAAE;YAAE,SAAS,CAAC,EAAE,OAAO,CAAC;YAAC,OAAO,CAAC,EAAE,OAAO,CAAC;YAAC,mBAAmB,CAAC,EAAE,OAAO,CAAA;SAAE,CAAA;KAAE,GAAG,IAAI,CAAC;CAC3G;AAED,MAAM,WAAW,WAAY,SAAQ,gBAAgB;IACnD,MAAM,IAAI,OAAO,CAAC;QAAE,IAAI,EAAE;YAAE,KAAK,EAAE,MAAM,CAAC;YAAC,EAAE,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAAC,MAAM,EAAE;YAAE,EAAE,EAAE,MAAM,CAAC;YAAC,IAAI,EAAE,MAAM,CAAA;SAAE,CAAA;KAAE,CAAC,CAAC;IAClG,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,GAAG,OAAO,CAAC,aAAa,CAAC,CAAC;IAC1E,WAAW,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,YAAY,CAAC,CAAC;IAC/C,eAAe,CAAC,EAAE,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,WAAW,CAAC;IACpB,KAAK,EAAE,KAAK,CAAC;IACb,0GAA0G;IAC1G,IAAI,EAAE,MAAM,CAAC;IACb,oHAAoH;IACpH,UAAU,EAAE,MAAM,CAAC;IACnB,uFAAuF;IACvF,iBAAiB,EAAE,MAAM,CAAC;CAC3B;AAED,qBAAa,UAAW,SAAQ,KAAK;IACN,QAAQ,CAAC,QAAQ;gBAAlC,OAAO,EAAE,MAAM,EAAW,QAAQ,SAAI;CACnD;AAED,MAAM,WAAW,QAAQ;IACvB,QAAQ,EAAE,YAAY,EAAE,CAAC;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,mHAAmH;IACnH,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,iGAAiG;IACjG,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,SAAS,GAAG,IAAI,CAAC,CAAC;IACtC,kFAAkF;IAClF,OAAO,EAAE,KAAK,CAAC;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrE,OAAO,EAAE,KAAK,CAAC,aAAa,GAAG;QAAE,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACpD,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,qHAAqH;AACrH,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,wBAAgB,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAO,GAAG,WAAW,EAAE,CAO5G;AAID,wBAAsB,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,QAAQ,CAAC,CAkEjF;AAED,4DAA4D;AAC5D,wBAAgB,aAAa,CAAC,OAAO,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,MAAM,CAGlE;AAED,MAAM,MAAM,SAAS,GAAG;IACtB,OAAO,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,WAAW,CAAC;IACrD,iBAAiB,EAAE,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC3D,qHAAqH;IACrH,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB,CAAC;AAEF,MAAM,WAAW,SAAS;IACxB,iHAAiH;IACjH,eAAe,CAAC,EAAE,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,YAAY,CAAA;KAAE,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACrG;;;;;OAKG;IACH,IAAI,CAAC,EAAE,CAAC,KAAK,EAAE,YAAY,EAAE,EAAE,KAAK,EAAE,OAAO,GAAG,SAAS,EAAE,OAAO,CAAC,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,aAAa,GAAG,IAAI,CAAC,CAAC;IAClJ;;;OAGG;IACH,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAyCD,wBAAsB,IAAI,CAAC,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,GAAE,SAAc,GAAG,OAAO,CAAC,SAAS,EAAE,CAAC,CA2DzG;AAED,yGAAyG;AACzG,wBAAgB,cAAc,CAAC,IAAI,EAAE,YAAY,GAAG,MAAM,CAQzD;AASD,wBAAgB,aAAa,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,GAAG,MAAM,CAmBhE;AAED,MAAM,WAAW,aAAa;IAAG,EAAE,EAAE,OAAO,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE;AAE/D,wBAAsB,OAAO,CAAC,GAAG,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,aAAa,CAAC,CAaxF"}

package/dist/lib/share/run.js

@@ -0,0 +1,278 @@
+/**
+ * L9: the share flow with no I/O of its own beyond the injected client: select, build, scan, price
+ * the preview, send, read the answer, record the ledger. `align share`, `align share --confirm` and
+ * `align_share` all call it, so the three cannot disagree about what a share is.
+ *
+ * Order, and why: the secret scan runs on the payload that will be SENT (a refusal names the decision,
+ * the field and the placeholder, never the match); an item already shared with an unchanged payload
+ * is "already shared" and makes no call; only then is anything previewed. Nothing here sends without
+ * the caller having passed `send`, and `prepare` never calls the network except `whoami` (a read).
+ */
+import { existingTitles, listJudgements } from '../curation/judgements-db.js';
+import { createLocalDb } from '../local-db.js';
+import { getLegacyPromotion, getPromotion, ledgerReady, listPromotions, markRetracted, recordPromotion, recordPromotions } from './ledger.js';
+import { visible } from './visible.js';
+import { TEAM_TEXT_HASH_RE } from './envelope.js';
+import { buildSharePayload, clientKeyFor } from './payload.js';
+import { renderPreview } from './preview.js';
+import { scanForSecrets, scanHiddenText, scanSourceUrl } from './secret-scan.js';
+import { failedJudgements, readOutcomes } from './wire.js';
+export class ShareError extends Error {
+    exitCode;
+    constructor(message, exitCode = 1) {
+        super(message);
+        this.exitCode = exitCode;
+        this.name = 'ShareError';
+    }
+}
+/** Batches of at most this many items: 10 x the gateway's 50 judgements per item stays under its 500 per request. */
+export const SHARE_BATCH_ITEMS = 10;
+export function ratifiedRows(dbPath, opts = {}) {
+    const db = createLocalDb(dbPath);
+    try {
+        return db.listDecisions().filter((r) => r.ratifiedAt !== null
+            && (opts.owner === undefined || r.ratifiedBy === opts.owner)
+            && (opts.sinceIso === undefined || r.ratifiedAt >= opts.sinceIso));
+    }
+    finally {
+        db.close();
+    }
+}
+const hostOf = (url) => { try {
+    return new URL(url).host;
+}
+catch {
+    return url;
+} };
+export async function prepare(ctx, ids) {
+    const who = await ctx.client.whoami();
+    const tenantId = who.tenant.id;
+    const dest = {
+        workspace: who.tenant.name, env: ctx.envName, email: who.user.email,
+        gatewayHost: hostOf(ctx.gatewayUrl),
+        // A team destination has no default gateway (defaultGatewayUrl is ''), so only a builtin can be "pointed elsewhere".
+        ...(ctx.defaultGatewayUrl !== '' && ctx.gatewayUrl !== ctx.defaultGatewayUrl ? { gateway: ctx.gatewayUrl } : {}),
+    };
+    const rows = [];
+    const db = createLocalDb(ctx.dbPath);
+    try {
+        for (const id of ids) {
+            const row = db.getDecisionById(id);
+            if (!row)
+                throw new ShareError(`No decision ${visible(id)} in your local graph. \`align decisions list\` shows what is there.`);
+            if (!row.ratifiedAt)
+                throw new ShareError(`${visible(id)} has not been ratified, so it stays a claim on this machine.\n  A human stands behind it first: align ratify ${visible(id)}`);
+            rows.push(row);
+        }
+    }
+    finally {
+        db.close();
+    }
+    // The graph was just opened (which repairs an older v10); refuse BEFORE any request if the ledger is still not usable.
+    if (!ledgerReady(ctx.dbPath))
+        throw new ShareError('Your local graph\'s record of shares is not in the expected shape, so nothing was sent. Run `align local status` once, or update the CLI.');
+    const shared = listPromotions(ctx.dbPath, ctx.envName, tenantId);
+    const remoteIdOf = (id) => shared.get(id)?.remoteId;
+    const payloads = [];
+    const priors = new Map();
+    const already = [];
+    const secrets = [];
+    const updates = new Set();
+    const legacy = new Set();
+    for (const row of rows) {
+        const mine = listJudgements(ctx.dbPath, ctx.judge.judgeId, row.id);
+        const others = [...new Set(mine.flatMap((j) => [j.decision_id, j.counterpart_id]).filter((x) => x !== null && x !== row.id))];
+        const titles = existingTitles(ctx.dbPath, others);
+        const prior = getPromotion(ctx.dbPath, row.id, ctx.envName, tenantId);
+        priors.set(row.id, prior);
+        const live = prior !== null && prior.retractedAt === null;
+        // A live row with no stored key came from an earlier test build of this branch, whose key was derived another
+        // way. Re-deriving it now could mint a SECOND team decision, so the share stops and names the way out.
+        if (live && prior.clientKey === '') {
+            throw new ShareError(`${visible(row.id)} was shared by an earlier build that did not record its key, so sharing it again could create a second copy.\n  Retract the old one, then share again: align share --retract ${visible(row.id)}`);
+        }
+        const p = buildSharePayload({
+            row, judgements: mine, remoteIdOf, titleOf: (id) => titles.get(id) ?? null,
+            // The key is minted ONCE and reused, so a twin fold (a new local id) cannot create a second team decision.
+            clientKey: prior && prior.clientKey !== '' ? prior.clientKey : clientKeyFor(ctx.salt, row.id),
+            salt: ctx.salt,
+            alreadySent: new Set(live ? prior.sent : []),
+        });
+        let note = 0;
+        const fields = [
+            { field: 'title', text: p.item.title }, { field: 'summary', text: p.item.summary }, { field: 'platform', text: p.item.platform },
+            ...p.item.judgements.map((j) => ({ field: j.kind === 'note' ? `note ${++note}` : j.kind, text: j.note })),
+        ];
+        for (const f of [...scanForSecrets(fields), ...scanHiddenText([...fields, { field: 'raw_text', text: p.item.raw_text }, { field: 'source_url', text: p.item.source_url }])])
+            secrets.push({ ...f, localId: row.id });
+        for (const f of scanSourceUrl(p.item.source_url))
+            secrets.push({ ...f, localId: row.id });
+        if (live) {
+            if (prior.contentHash === p.fullHash && p.item.judgements.length === 0 && !prior.confirmPending) {
+                already.push({ localId: row.id, title: row.title, remoteId: prior.remoteId });
+                continue;
+            }
+            updates.add(row.id);
+        }
+        else if (!prior && getLegacyPromotion(ctx.dbPath, row.id, ctx.envName))
+            legacy.add(row.id);
+        payloads.push(p);
+    }
+    return { payloads, dest, tenantId, userId: who.user.id ?? null, gatewayUrl: ctx.gatewayUrl, priors, already, secrets, preview: renderPreview(payloads, dest, { updates, legacy }) };
+}
+/** The refusal text: where, which kind, never the value. */
+export function secretRefusal(secrets) {
+    const lines = secrets.map((s) => `  ${visible(s.localId)}: ${visible(s.field)} ${s.placeholder === '<HIDDEN_TEXT>' ? 'contains hidden tag characters (invisible text)' : `looks like ${s.placeholder}`}`);
+    return `Nothing was sent: part of what would be shared looks like a credential or holds hidden text.\n${lines.join('\n')}\n  Edit it out of the decision, then share again.`;
+}
+async function postBatch(ctx, batch, hooks, phase = 'share', confirm) {
+    const res = hooks.post ? await hooks.post(batch, phase, confirm) : await ctx.client.shareBatch(batch.map((p) => ({ ...p.item })));
+    return res === null ? null : readOutcomes(batch.length, res);
+}
+/** The judgements the gateway reported as stored, by hash. A null report stores nothing we can name. */
+function storedHashes(p, results) {
+    if (results === null)
+        return [];
+    return p.shown.flatMap((s, i) => (results[i]?.ok === true ? [s.hash] : []));
+}
+/**
+ * The ledger row an outcome implies, from the FIRST response alone, or null when nothing was written
+ * (refused, unknown). Matched and skipped rows are `matched` (not ours to archive); an update of something
+ * this machine never shared is treated the same way, with a warning.
+ */
+function initialRow(ctx, prep, it) {
+    const { p, outcome } = it;
+    const base = { localId: p.localId, env: ctx.envName, tenantId: prep.tenantId, contentHash: p.fullHash, clientKey: p.item.client_key, sent: [...it.stored], confirmPending: it.confirmPending };
+    switch (outcome.kind) {
+        case 'created': return { ...base, remoteId: outcome.remoteId, matched: outcome.uncertain };
+        case 'updated': return { ...base, remoteId: outcome.remoteId, matched: it.live ? it.prior.matched : true };
+        case 'matched': return { ...base, remoteId: outcome.remoteId, matched: true };
+        case 'skipped': return { ...base, remoteId: outcome.remoteId, matched: true };
+        default: return null;
+    }
+}
+export async function send(ctx, prep, hooks = {}) {
+    const results = [];
+    for (let at = 0; at < prep.payloads.length; at += SHARE_BATCH_ITEMS) {
+        const batch = prep.payloads.slice(at, at + SHARE_BATCH_ITEMS);
+        const outcomes = await postBatch(ctx, batch, hooks);
+        if (outcomes === null)
+            throw new ShareError('The share was not approved, so nothing was posted.');
+        const items = batch.map((p, k) => {
+            const outcome = outcomes[k];
+            const prior = prep.priors.get(p.localId) ?? null;
+            const live = prior !== null && prior.retractedAt === null;
+            const it = { p, outcome, live, prior, stored: new Set(live ? prior.sent : []), warnings: [], confirmPending: false, failures: 'judgements' in outcome ? failedJudgements(outcome.judgements) : [] };
+            if ('judgements' in outcome)
+                for (const h of storedHashes(p, outcome.judgements))
+                    it.stored.add(h);
+            if ('judgements' in outcome && outcome.judgements === null && p.item.judgements.length > 0) {
+                it.warnings.push(`this gateway did not report what happened to your ${p.item.judgements.map((j) => j.kind).join(', ')}: they were not stored as far as can be told, so they stay unsent here and your ratify was not stored by this gateway. Check your team graph.`);
+            }
+            if (outcome.kind === 'created' && outcome.uncertain)
+                it.warnings.push('this gateway cannot tell new from existing (it is older than share matching), so this is recorded as not yours to retract.');
+            if (outcome.kind === 'updated' && !live)
+                it.warnings.push('the gateway answered this as an existing team decision, so it is recorded as not yours to retract.');
+            if (outcome.kind === 'matched')
+                it.confirmPending = outcome.needsConfirmation.length > 0;
+            return it;
+        });
+        // Record EVERY item the first response named, in ONE write, before anything that can throw (the team-text
+        // fetch, the confirmation re-post, a later batch): a 502 or a kill after this point cannot orphan a
+        // decision that now exists on the team graph and is retractable only through this row.
+        recordPromotions(ctx.dbPath, items.flatMap((it) => { const r = initialRow(ctx, prep, it); return r ? [r] : []; }));
+        for (const it of items) {
+            const { p, outcome } = it;
+            if (outcome.kind === 'matched' && outcome.needsConfirmation.length > 0) {
+                let team = null;
+                const hashOk = outcome.teamTextHash !== null && TEAM_TEXT_HASH_RE.test(outcome.teamTextHash);
+                if (hooks.post && hooks.confirmByApproval && outcome.teamTextHash !== null && !hashOk)
+                    it.warnings.push('the gateway sent a team text hash this CLI does not recognise, so your ratify was not confirmed.');
+                const byApproval = hooks.post !== undefined && hooks.confirmByApproval === true && hashOk;
+                if (!byApproval && outcome.teamTextHash && hooks.confirmTeamText)
+                    team = await ctx.client.getDecision(outcome.remoteId).catch(() => null);
+                if (team !== null && !('decision_json' in team)) {
+                    it.warnings.push('the team\'s full text could not be read from this gateway, so your ratify was not confirmed.');
+                    team = null;
+                }
+                const agreed = byApproval || (team !== null && hooks.confirmTeamText !== undefined && await hooks.confirmTeamText({ localId: p.localId, title: p.item.title, team }));
+                if (agreed) {
+                    // Re-post ONLY what waited: a note or check verdict already stored must not be posted a second time.
+                    const need = new Set(outcome.needsConfirmation.map((n) => n.judgement_index));
+                    const waiting = p.shown.filter((_, i) => need.has(i));
+                    const again = { ...p, shown: waiting, item: { ...p.item, judgements: waiting.map((s) => ({ ...s.wire, confirm_team_text_hash: outcome.teamTextHash })) } };
+                    const second = (await postBatch(ctx, [again], hooks, 'confirm', byApproval ? { remoteId: outcome.remoteId, teamTextHash: outcome.teamTextHash } : undefined))?.[0];
+                    if (second === undefined)
+                        it.warnings.push('the confirmation of the team\'s text was not approved, so your ratify was not confirmed. Run the share again to try once more.');
+                    else if (second.kind === 'matched') {
+                        for (const h of storedHashes(again, second.judgements))
+                            it.stored.add(h);
+                        it.failures = failedJudgements(second.judgements);
+                        it.confirmPending = it.failures.length > 0;
+                        const row = initialRow(ctx, prep, it);
+                        if (row)
+                            recordPromotion(ctx.dbPath, row);
+                    }
+                }
+            }
+            if (outcome.kind === 'matched')
+                it.failures = it.failures.filter((f) => f.error !== 'needs_confirmation' || it.confirmPending);
+            results.push({ localId: p.localId, title: p.item.title, outcome, judgementFailures: it.failures, warnings: it.warnings });
+        }
+    }
+    return results;
+}
+/** Every field the server's team-text hash covers, so what the person confirms is what the hash pins. */
+export function renderTeamText(team) {
+    const ai = team.decision_json?.ai ?? {};
+    const show = (v) => (v === undefined || v === null ? '(none)' : typeof v === 'string' ? v : Array.isArray(v) ? v.map((x) => `- ${typeof x === 'string' ? x : JSON.stringify(x)}`).join('\n') : JSON.stringify(v));
+    const block = (label, v) => `  ${label}:\n${visible(show(v), { keepNewline: true }).split('\n').map((l) => `    ${l}`).join('\n')}`;
+    return [
+        block('Title', team.title ?? ''), block('Summary', team.summary ?? ''), block('Decisions', ai.decisions),
+        block('Gherkin', ai.gherkin), block('Acceptance criteria', ai.acceptance_criteria),
+    ].join('\n');
+}
+const FAIL_TEXT = {
+    needs_confirmation: 'waits for you to confirm the team\'s text (run the share again and answer yes)',
+    team_text_changed: 'the team\'s text changed while you were looking; share again',
+    ratification_not_permitted: 'your role may not ratify here',
+    decision_not_found: 'the other decision is not visible to you',
+};
+export function renderResults(rows) {
+    const lines = [];
+    for (const r of rows) {
+        const o = r.outcome;
+        const head = (() => {
+            switch (o.kind) {
+                case 'created': return o.ambiguous ? `shared as new (several team decisions share this source, so it was not matched): ${visible(o.remoteId)}` : `created: ${visible(o.remoteId)}`;
+                case 'updated': return `updated: ${visible(o.remoteId)}`;
+                case 'matched': return `matched an existing team decision (${visible(o.remoteId)}); your judgements were added, its text is untouched`;
+                case 'skipped': return `left alone (${visible(o.reason)}): ${visible(o.remoteId)}`;
+                case 'refused': return `refused by the server (${visible(o.reason)})`;
+                case 'unknown': return 'the server did not say what happened to it; check your team graph before sharing again';
+            }
+        })();
+        lines.push(`  ${visible(r.title)}\n    ${head}`);
+        for (const w of r.warnings)
+            lines.push(`    note: ${visible(w)}`);
+        for (const f of r.judgementFailures)
+            lines.push(`    judgement ${f.index + 1} not stored: ${FAIL_TEXT[f.error] ?? visible(f.error)}`);
+    }
+    return lines.join('\n');
+}
+export async function retract(ctx, localId) {
+    const who = await ctx.client.whoami();
+    const row = getPromotion(ctx.dbPath, localId, ctx.envName, who.tenant.id);
+    if (!row || row.retractedAt !== null) {
+        if (getLegacyPromotion(ctx.dbPath, localId, ctx.envName))
+            return { ok: false, message: `${localId} was pushed before Align tracked workspaces, so it cannot be retracted from here. Archive it on your team graph.` };
+        return { ok: false, message: `Nothing to retract: ${localId} was not shared to ${who.tenant.name} (${ctx.envName}) from this machine.` };
+    }
+    if (row.matched) {
+        return { ok: false, message: `${localId} attached to a decision your team already held (${row.remoteId}). Retracting would archive THEIR decision, so nothing was done.` };
+    }
+    await ctx.client.archiveDecision(row.remoteId);
+    markRetracted(ctx.dbPath, localId, ctx.envName, who.tenant.id);
+    return { ok: true, message: `Retracted: ${row.remoteId} is archived on your team graph.` };
+}
+//# sourceMappingURL=run.js.map

package/dist/lib/share/run.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"run.js","sourceRoot":"","sources":["../../../src/lib/share/run.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,cAAc,EAAc,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAC1F,OAAO,EAAE,aAAa,EAAoB,MAAM,gBAAgB,CAAC;AACjE,OAAO,EAAE,kBAAkB,EAAE,YAAY,EAAE,WAAW,EAAE,cAAc,EAAE,aAAa,EAAuC,eAAe,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACnL,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,YAAY,EAAqB,MAAM,cAAc,CAAC;AAClF,OAAO,EAAoB,aAAa,EAAE,MAAM,cAAc,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAsB,MAAM,kBAAkB,CAAC;AACrG,OAAO,EAAsB,gBAAgB,EAA0C,YAAY,EAAE,MAAM,WAAW,CAAC;AA6BvH,MAAM,OAAO,UAAW,SAAQ,KAAK;IACG;IAAtC,YAAY,OAAe,EAAW,WAAW,CAAC;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAA/B,aAAQ,GAAR,QAAQ,CAAI;QAAoB,IAAI,CAAC,IAAI,GAAG,YAAY,CAAC;IAAC,CAAC;CAClG;AAiBD,qHAAqH;AACrH,MAAM,CAAC,MAAM,iBAAiB,GAAG,EAAE,CAAC;AAEpC,MAAM,UAAU,YAAY,CAAC,MAAc,EAAE,OAA8C,EAAE;IAC3F,MAAM,EAAE,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACjC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,aAAa,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,KAAK,IAAI;eACxD,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,KAAK,IAAI,CAAC,KAAK,CAAC;eACzD,CAAC,IAAI,CAAC,QAAQ,KAAK,SAAS,IAAI,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvE,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;AAC3B,CAAC;AAED,MAAM,MAAM,GAAG,CAAC,GAAW,EAAU,EAAE,GAAG,IAAI,CAAC;IAAC,OAAO,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC;AAAC,CAAC;AAAC,MAAM,CAAC;IAAC,OAAO,GAAG,CAAC;AAAC,CAAC,CAAC,CAAC,CAAC;AAEpG,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAiB,EAAE,GAAa;IAC5D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,QAAQ,GAAG,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;IAC/B,MAAM,IAAI,GAAgB;QACxB,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK;QACnE,WAAW,EAAE,MAAM,CAAC,GAAG,CAAC,UAAU,CAAC;QACnC,qHAAqH;QACrH,GAAG,CAAC,GAAG,CAAC,iBAAiB,KAAK,EAAE,IAAI,GAAG,CAAC,UAAU,KAAK,GAAG,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACjH,CAAC;IACF,MAAM,IAAI,GAAkB,EAAE,CAAC;IAC/B,MAAM,EAAE,GAAG,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACrC,IAAI,CAAC;QACH,KAAK,MAAM,EAAE,IAAI,GAAG,EAAE,CAAC;YACrB,MAAM,GAAG,GAAG,EAAE,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;YACnC,IAAI,CAAC,GAAG;gBAAE,MAAM,IAAI,UAAU,CAAC,eAAe,OAAO,CAAC,EAAE,CAAC,qEAAqE,CAAC,CAAC;YAChI,IAAI,CAAC,GAAG,CAAC,UAAU;gBAAE,MAAM,IAAI,UAAU,CAAC,GAAG,OAAO,CAAC,EAAE,CAAC,gHAAgH,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;YACvL,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjB,CAAC;IACH,CAAC;YAAS,CAAC;QAAC,EAAE,CAAC,KAAK,EAAE,CAAC;IAAC,CAAC;IACzB,uHAAuH;IACvH,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,MAAM,CAAC;QAAE,MAAM,IAAI,UAAU,CAAC,2IAA2I,CAAC,CAAC;IAEhM,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACjE,MAAM,UAAU,GAAG,CAAC,EAAU,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC;IAC5D,MAAM,QAAQ,GAAmB,EAAE,CAAC;IACpC,MAAM,MAAM,GAAG,IAAI,GAAG,EAA4B,CAAC;IACnD,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;QACnE,MAAM,MAAM,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;QAC3I,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;QAClD,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QACtE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC;QAC1B,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;QAC1D,8GAA8G;QAC9G,uGAAuG;QACvG,IAAI,IAAI,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,EAAE,CAAC;YACnC,MAAM,IAAI,UAAU,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,gLAAgL,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;QAC5O,CAAC;QACD,MAAM,CAAC,GAAG,iBAAiB,CAAC;YAC1B,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,IAAI;YAC1E,2GAA2G;YAC3G,SAAS,EAAE,KAAK,IAAI,KAAK,CAAC,SAAS,KAAK,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,EAAE,CAAC;YAC7F,IAAI,EAAE,GAAG,CAAC,IAAI;YACd,WAAW,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;SAC7C,CAAC,CAAC;QACH,IAAI,IAAI,GAAG,CAAC,CAAC;QACb,MAAM,MAAM,GAAG;YACb,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE;YAChI,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;SAC1G,CAAC;QACF,KAAK,MAAM,CAAC,IAAI,CAAC,GAAG,cAAc,CAAC,MAAM,CAAC,EAAE,GAAG,cAAc,CAAC,CAAC,GAAG,MAAM,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,QAAQ,EAAE,EAAE,EAAE,KAAK,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QACrN,KAAK,MAAM,CAAC,IAAI,aAAa,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,EAAE,GAAG,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1F,IAAI,IAAI,EAAE,CAAC;YACT,IAAI,KAAK,CAAC,WAAW,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC;gBAChG,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,QAAQ,EAAE,KAAK,CAAC,QAAQ,EAAE,CAAC,CAAC;gBAC9E,SAAS;YACX,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtB,CAAC;aAAM,IAAI,CAAC,KAAK,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAC7F,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IACnB,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,EAAE,IAAI,IAAI,EAAE,UAAU,EAAE,GAAG,CAAC,UAAU,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AACtL,CAAC;AAED,4DAA4D;AAC5D,MAAM,UAAU,aAAa,CAAC,OAA4B;IACxD,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,WAAW,KAAK,eAAe,CAAC,CAAC,CAAC,iDAAiD,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC1M,OAAO,iGAAiG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,oDAAoD,CAAC;AAC/K,CAAC;AA0BD,KAAK,UAAU,SAAS,CAAC,GAAiB,EAAE,KAAqB,EAAE,KAAgB,EAAE,QAA6B,OAAO,EAAE,OAAoD;IAC7K,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,UAAU,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAClI,OAAO,GAAG,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,KAAK,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAC/D,CAAC;AAED,wGAAwG;AACxG,SAAS,YAAY,CAAC,CAAe,EAAE,OAAiC;IACtE,IAAI,OAAO,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IAChC,OAAO,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;AAC9E,CAAC;AAaD;;;;GAIG;AACH,SAAS,UAAU,CAAC,GAAiB,EAAE,IAAc,EAAE,EAAQ;IAC7D,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,GAAG,EAAE,GAAG,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC,QAAQ,EAAE,SAAS,EAAE,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,EAAE,cAAc,EAAE,EAAE,CAAC,cAAc,EAAE,CAAC;IAC/L,QAAQ,OAAO,CAAC,IAAI,EAAE,CAAC;QACrB,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC;QAC3F,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAM,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5G,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,KAAK,SAAS,CAAC,CAAC,OAAO,EAAE,GAAG,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;QAC9E,OAAO,CAAC,CAAC,OAAO,IAAI,CAAC;IACvB,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,IAAI,CAAC,GAAiB,EAAE,IAAc,EAAE,QAAmB,EAAE;IACjF,MAAM,OAAO,GAAgB,EAAE,CAAC;IAChC,KAAK,IAAI,EAAE,GAAG,CAAC,EAAE,EAAE,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACpE,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,EAAE,EAAE,GAAG,iBAAiB,CAAC,CAAC;QAC9D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC;QACpD,IAAI,QAAQ,KAAK,IAAI;YAAE,MAAM,IAAI,UAAU,CAAC,oDAAoD,CAAC,CAAC;QAClG,MAAM,KAAK,GAAW,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE;YACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;YAC7B,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;YACjD,MAAM,IAAI,GAAG,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,WAAW,KAAK,IAAI,CAAC;YAC1D,MAAM,EAAE,GAAS,EAAE,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,QAAQ,EAAE,YAAY,IAAI,OAAO,CAAC,CAAC,CAAC,gBAAgB,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC;YAC1M,IAAI,YAAY,IAAI,OAAO;gBAAE,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,UAAU,CAAC;oBAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;YACnG,IAAI,YAAY,IAAI,OAAO,IAAI,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3F,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,qDAAqD,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,+IAA+I,CAAC,CAAC;YACxQ,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,SAAS;gBAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,4HAA4H,CAAC,CAAC;YACpM,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,CAAC,IAAI;gBAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,oGAAoG,CAAC,CAAC;YAChK,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,EAAE,CAAC,cAAc,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,CAAC;YACzF,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC,CAAC;QACH,0GAA0G;QAC1G,oGAAoG;QACpG,uFAAuF;QACvF,gBAAgB,CAAC,GAAG,CAAC,MAAM,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,MAAM,CAAC,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAEnH,KAAK,MAAM,EAAE,IAAI,KAAK,EAAE,CAAC;YACvB,MAAM,EAAE,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;YAC1B,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,iBAAiB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACvE,IAAI,IAAI,GAAwB,IAAI,CAAC;gBACrC,MAAM,MAAM,GAAG,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;gBAC7F,IAAI,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,iBAAiB,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,IAAI,CAAC,MAAM;oBAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,kGAAkG,CAAC,CAAC;gBAC5M,MAAM,UAAU,GAAG,KAAK,CAAC,IAAI,KAAK,SAAS,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI,IAAI,MAAM,CAAC;gBAC1F,IAAI,CAAC,UAAU,IAAI,OAAO,CAAC,YAAY,IAAI,KAAK,CAAC,eAAe;oBAAE,IAAI,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,WAAW,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBAC1I,IAAI,IAAI,KAAK,IAAI,IAAI,CAAC,CAAC,eAAe,IAAI,IAAI,CAAC,EAAE,CAAC;oBAChD,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC;oBACjH,IAAI,GAAG,IAAI,CAAC;gBACd,CAAC;gBACD,MAAM,MAAM,GAAG,UAAU,IAAI,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,CAAC,eAAe,KAAK,SAAS,IAAI,MAAM,KAAK,CAAC,eAAe,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC;gBACtK,IAAI,MAAM,EAAE,CAAC;oBACX,qGAAqG;oBACrG,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,iBAAiB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC;oBAC9E,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;oBACtD,MAAM,KAAK,GAAiB,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,UAAU,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,sBAAsB,EAAE,OAAO,CAAC,YAAa,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;oBAC1K,MAAM,MAAM,GAAG,CAAC,MAAM,SAAS,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,YAAY,EAAE,OAAO,CAAC,YAAa,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;oBACpK,IAAI,MAAM,KAAK,SAAS;wBAAE,EAAE,CAAC,QAAQ,CAAC,IAAI,CAAC,gIAAgI,CAAC,CAAC;yBACxK,IAAI,MAAM,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;wBACnC,KAAK,MAAM,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,UAAU,CAAC;4BAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;wBACzE,EAAE,CAAC,QAAQ,GAAG,gBAAgB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;wBAClD,EAAE,CAAC,cAAc,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAC;wBAC3C,MAAM,GAAG,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;wBACtC,IAAI,GAAG;4BAAE,eAAe,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;oBAC5C,CAAC;gBACH,CAAC;YACH,CAAC;YACD,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;gBAAE,EAAE,CAAC,QAAQ,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,oBAAoB,IAAI,EAAE,CAAC,cAAc,CAAC,CAAC;YAC/H,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,iBAAiB,EAAE,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,EAAE,CAAC,QAAQ,EAAE,CAAC,CAAC;QAC5H,CAAC;IACH,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,cAAc,CAAC,IAAkB;IAC/C,MAAM,EAAE,GAAG,IAAI,CAAC,aAAa,EAAE,EAAE,IAAI,EAAE,CAAC;IACxC,MAAM,IAAI,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAC;IACnO,MAAM,KAAK,GAAG,CAAC,KAAa,EAAE,CAAU,EAAE,EAAE,CAAC,KAAK,KAAK,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACrJ,OAAO;QACL,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,SAAS,EAAE,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,KAAK,CAAC,WAAW,EAAE,EAAE,CAAC,SAAS,CAAC;QACxG,KAAK,CAAC,SAAS,EAAE,EAAE,CAAC,OAAO,CAAC,EAAE,KAAK,CAAC,qBAAqB,EAAE,EAAE,CAAC,mBAAmB,CAAC;KACnF,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED,MAAM,SAAS,GAA2B;IACxC,kBAAkB,EAAE,gFAAgF;IACpG,iBAAiB,EAAE,8DAA8D;IACjF,0BAA0B,EAAE,+BAA+B;IAC3D,kBAAkB,EAAE,0CAA0C;CAC/D,CAAC;AAEF,MAAM,UAAU,aAAa,CAAC,IAA0B;IACtD,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,KAAK,MAAM,CAAC,IAAI,IAAI,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,CAAC,CAAC,OAAO,CAAC;QACpB,MAAM,IAAI,GAAG,CAAC,GAAW,EAAE;YACzB,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC;gBACf,KAAK,SAAS,CAAC,CAAC,OAAO,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,oFAAoF,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnL,KAAK,SAAS,CAAC,CAAC,OAAO,YAAY,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACzD,KAAK,SAAS,CAAC,CAAC,OAAO,sCAAsC,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,sDAAsD,CAAC;gBACvI,KAAK,SAAS,CAAC,CAAC,OAAO,eAAe,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,OAAO,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACnF,KAAK,SAAS,CAAC,CAAC,OAAO,0BAA0B,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;gBACtE,KAAK,SAAS,CAAC,CAAC,OAAO,wFAAwF,CAAC;YAClH,CAAC;QACH,CAAC,CAAC,EAAE,CAAC;QACL,KAAK,CAAC,IAAI,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,SAAS,IAAI,EAAE,CAAC,CAAC;QACjD,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,QAAQ;YAAE,KAAK,CAAC,IAAI,CAAC,aAAa,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QAClE,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC,iBAAiB;YAAE,KAAK,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAC,KAAK,GAAG,CAAC,gBAAgB,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;IACxI,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAID,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAiB,EAAE,OAAe;IAC9D,MAAM,GAAG,GAAG,MAAM,GAAG,CAAC,MAAM,CAAC,MAAM,EAAE,CAAC;IACtC,MAAM,GAAG,GAAG,YAAY,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC1E,IAAI,CAAC,GAAG,IAAI,GAAG,CAAC,WAAW,KAAK,IAAI,EAAE,CAAC;QACrC,IAAI,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,kHAAkH,EAAE,CAAC;QACtN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,uBAAuB,OAAO,sBAAsB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,GAAG,CAAC,OAAO,sBAAsB,EAAE,CAAC;IAC3I,CAAC;IACD,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,OAAO,mDAAmD,GAAG,CAAC,QAAQ,kEAAkE,EAAE,CAAC;IAC7K,CAAC;IACD,MAAM,GAAG,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/C,aAAa,CAAC,GAAG,CAAC,MAAM,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC/D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,cAAc,GAAG,CAAC,QAAQ,kCAAkC,EAAE,CAAC;AAC7F,CAAC"}

package/dist/lib/share/salt.d.ts

@@ -0,0 +1,2 @@
+export declare function shareSalt(): string;
+//# sourceMappingURL=salt.d.ts.map

package/dist/lib/share/salt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"salt.d.ts","sourceRoot":"","sources":["../../../src/lib/share/salt.ts"],"names":[],"mappings":"AAcA,wBAAgB,SAAS,IAAI,MAAM,CAoBlC"}