@antasphere/chassis-cli 0.0.0-stage → 1.0.0

package/dist/context.d.ts

@@ -0,0 +1,152 @@
+import { type ChassisClient, type ClientOptions } from '@antasphere/chassis-sdk';
+import type { Command } from 'commander';
+import { CliUsageError, type CliIo as CoreCliIo, type ConnectOnDemandOptions, type ProfileSource } from '@antasphere/cli-core';
+import type { CliConfig, CliConfigStore, CliProfile } from './config.js';
+import type { CliIdentity } from './identity.js';
+import { type CliWorkspace, type WorkspaceSelection, type WorkspaceSource } from './workspace.js';
+export { CliUsageError } from '@antasphere/cli-core';
+/**
+ * A refusal of the API that a command turned into a sentence (the project
+ * verbs do), thrown as the usage error it reads as, with the wire status
+ * kept: the runner adds what only it knows, the workspace a 404 was asked of.
+ */
+export declare class CliApiRefusal extends CliUsageError {
+    readonly status: number;
+    constructor(message: string, status: number);
+}
+/**
+ * The tool's I/O seam: cli-core's, plus an injectable stdin reader so the
+ * `--*-stdin` secret flags (stdin.ts) stay testable in-process. The bin
+ * leaves it unset and the default reads `process.stdin`.
+ */
+export interface CliIo extends CoreCliIo {
+    readStdin?: () => Promise<string>;
+    /**
+     * `process.stdout` carries `isTTY`; a pipe does not. The only signal the
+     * CLI reads before opening a browser unasked (open.ts): a piped run is a
+     * script or an agent, and a browser popping up on a build agent is a bug.
+     */
+    out: CoreCliIo['out'] & {
+        isTTY?: boolean;
+    };
+    /**
+     * The browser opener seam. The bin leaves it unset and the default spawns
+     * the platform command (open.ts); tests inject a recorder.
+     */
+    openUrl?: (url: string) => void;
+    /**
+     * The wait seam. The bin leaves it unset and the default is a timer; tests
+     * inject a recorder, so a command that waits out a rate wall is tested
+     * without the wait.
+     */
+    sleep?: (ms: number) => Promise<void>;
+}
+/**
+ * Strip terminal control sequences from human output.
+ *
+ * Almost everything the CLI prints in its human mode is content someone
+ * ELSE wrote: annotation bodies and author names from a share-link
+ * recipient, the titles of the tool's resources, form-response payloads, stored
+ * filenames, and server error messages. A terminal renders ANSI escapes in
+ * all of it — colours and cursor moves are the mild end; OSC 8 hyperlinks
+ * hide a URL behind friendly text, OSC 52 writes the user's clipboard, and
+ * a CSI sequence can scrub the line above so the owner never sees what the
+ * command really did.
+ *
+ * So the human sinks are wrapped (`ttySafeIo`) and everything they print
+ * loses C0 (except tab / LF / CR, which the tables and the CSV need), the
+ * 8-bit C1 introducers, and complete CSI/OSC/two-character escapes. `--json`
+ * output deliberately bypasses this: it is data, not display, and
+ * `JSON.stringify` already escapes every C0 byte.
+ */
+export declare function sanitizeForTty(s: string): string;
+/** Wrap an io so every human write is sanitized (see sanitizeForTty). */
+export declare function ttySafeIo(io: CliIo): CliIo;
+export declare function setStdinApiKey(io: CliIo, key: string): void;
+/** The key `--api-key-stdin` already read, if any. */
+export declare function stdinApiKey(io: CliIo): string | undefined;
+/**
+ * `--json` output goes to the RAW sink: machine output must stay
+ * byte-exact, and JSON.stringify already escapes the C0 range.
+ */
+export declare function printJson(io: CliIo, value: unknown): void;
+/**
+ * Where this invocation's credential came from, in the order it resolves:
+ * the flag (or `--api-key-stdin`), the tool's key variable, the profile's own
+ * key (the tool's login), the key the hub exchange cached on the profile, a
+ * fresh hub exchange run by this very command, or nothing yet.
+ */
+export type CredentialSource = 'flag' | 'env' | 'profile' | 'hub-cache' | 'hub-exchange' | 'none';
+export interface CliContext<TClient extends ChassisClient<string> = ChassisClient<string>> {
+    client: TClient;
+    baseUrl: string;
+    apiKey: string | undefined;
+    /** Where `apiKey` came from (`whoami` says it; the recovery reads it). */
+    credentialSource: CredentialSource;
+    json: boolean;
+    io: CliIo;
+    /**
+     * The profile this run selected (cli-core `selectProfile`: --profile, the
+     * instance URL, the active profile, the implicit `cloud` profile). Always
+     * named on a tool with a cloud URL; `profileCreated` says it is not on
+     * disk yet.
+     */
+    profileName: string | undefined;
+    profileSource: ProfileSource | undefined;
+    profileCreated: boolean;
+    config: CliConfig;
+    /**
+     * What selects the workspace (workspace.ts), undefined = the server's
+     * default. Resolved here, APPLIED by `requireApiKey`: a name needs `/me`,
+     * and `resolveContext` is synchronous.
+     */
+    workspaceSelection: WorkspaceSelection | undefined;
+    /** The id `requireApiKey` put on the client; undefined until then, or with no selection. */
+    workspaceId: string | undefined;
+}
+/** What `createContext` hands back: the context functions of ONE tool. */
+export interface CliContextKit<TClient extends ChassisClient<string>> {
+    resolveProfile(config: CliConfig, requested: string | undefined): {
+        name: string | undefined;
+        profile: CliProfile | undefined;
+    };
+    resolveContext(cmd: Command, io: CliIo): CliContext<TClient>;
+    requireApiKey(ctx: CliContext<TClient>, opts?: {
+        workspace?: boolean;
+    }): Promise<string>;
+    workspaceSource(ctx: CliContext<TClient>): WorkspaceSource;
+    explainWorkspaceRefusal(io: CliIo, e: unknown): Promise<string | null>;
+    workspaceNotFoundHint(io: CliIo): string;
+    /** The instance a profile names: its `baseUrl`, else the tool's cloud URL. */
+    profileUrl(profile: CliProfile | undefined): string;
+    /** The `connectOnDemand` options of one context (the tool, the instance, the profile, the wire). */
+    connectOptions(ctx: CliContext<TClient>): ConnectOnDemandOptions;
+}
+/**
+ * The context functions, bound to one tool: its identity (identity.ts), the
+ * client it talks through, and the config and workspace functions already
+ * bound to the same identity.
+ */
+export declare function createContext<TClient extends ChassisClient<string>>(input: {
+    identity: CliIdentity;
+    createClient: (options: ClientOptions) => TClient;
+    config: Pick<CliConfigStore, 'loadConfig' | 'removeConnectKey'>;
+    workspace: CliWorkspace;
+}): CliContextKit<TClient>;
+/**
+ * `--all` for a cursor-paginated list: the first page, then every next page
+ * while the server hands a cursor, the rows in order. The one loop behind
+ * every `--all`; a server that repeats a cursor is stopped here, once.
+ */
+export declare function drainPages<T>(first: {
+    rows: T[];
+    nextCursor: string | null;
+}, fetchPage: (cursor: string) => Promise<{
+    rows: T[];
+    nextCursor: string | null;
+}>): Promise<T[]>;
+/** Human-readable size (B / KB / MB) for the listing commands. */
+export declare function fmtBytes(n: number): string;
+/** Minimal aligned two-space table for human output. */
+export declare function table(rows: string[][]): string;
+//# sourceMappingURL=context.d.ts.map

package/dist/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,KAAK,aAAa,EAAE,KAAK,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACnG,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACzC,OAAO,EAIL,aAAa,EASb,KAAK,KAAK,IAAI,SAAS,EACvB,KAAK,sBAAsB,EAC3B,KAAK,aAAa,EACnB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,KAAK,EAAE,SAAS,EAAE,cAAc,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AACjD,OAAO,EAGL,KAAK,YAAY,EACjB,KAAK,kBAAkB,EACvB,KAAK,eAAe,EACrB,MAAM,gBAAgB,CAAC;AAKxB,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;GAIG;AACH,qBAAa,aAAc,SAAQ,aAAa;aAG5B,MAAM,EAAE,MAAM;gBAD9B,OAAO,EAAE,MAAM,EACC,MAAM,EAAE,MAAM;CAKjC;AAED;;;;GAIG;AACH,MAAM,WAAW,KAAM,SAAQ,SAAS;IACtC,SAAS,CAAC,EAAE,MAAM,OAAO,CAAC,MAAM,CAAC,CAAC;IAClC;;;;OAIG;IACH,GAAG,EAAE,SAAS,CAAC,KAAK,CAAC,GAAG;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;IAC5C;;;OAGG;IACH,OAAO,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IAChC;;;;OAIG;IACH,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CACvC;AAID;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,cAAc,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAgBhD;AAKD,yEAAyE;AACzE,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,GAAG,KAAK,CAY1C;AAQD,wBAAgB,cAAc,CAAC,EAAE,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,GAAG,IAAI,CAE3D;AAED,sDAAsD;AACtD,wBAAgB,WAAW,CAAC,EAAE,EAAE,KAAK,GAAG,MAAM,GAAG,SAAS,CAEzD;AAED;;;GAGG;AACH,wBAAgB,SAAS,CAAC,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,GAAG,IAAI,CAEzD;AAED;;;;;GAKG;AACH,MAAM,MAAM,gBAAgB,GAAG,MAAM,GAAG,KAAK,GAAG,SAAS,GAAG,WAAW,GAAG,cAAc,GAAG,MAAM,CAAC;AAElG,MAAM,WAAW,UAAU,CAAC,OAAO,SAAS,aAAa,CAAC,MAAM,CAAC,GAAG,aAAa,CAAC,MAAM,CAAC;IACvF,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,0EAA0E;IAC1E,gBAAgB,EAAE,gBAAgB,CAAC;IACnC,IAAI,EAAE,OAAO,CAAC;IACd,EAAE,EAAE,KAAK,CAAC;IACV;;;;;OAKG;IACH,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,aAAa,EAAE,aAAa,GAAG,SAAS,CAAC;IACzC,cAAc,EAAE,OAAO,CAAC;IACxB,MAAM,EAAE,SAAS,CAAC;IAClB;;;;OAIG;IACH,kBAAkB,EAAE,kBAAkB,GAAG,SAAS,CAAC;IACnD,4FAA4F;IAC5F,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;CACjC;AAeD,0EAA0E;AAC1E,MAAM,WAAW,aAAa,CAAC,OAAO,SAAS,aAAa,CAAC,MAAM,CAAC;IAClE,cAAc,CACZ,MAAM,EAAE,SAAS,EACjB,SAAS,EAAE,MAAM,GAAG,SAAS,GAC5B;QAAE,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;QAAC,OAAO,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE,CAAC;IACjE,cAAc,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE,KAAK,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC;IAC7D,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,OAAO,CAAA;KAAE,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IACzF,eAAe,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,eAAe,CAAC;IAC3D,uBAAuB,CAAC,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAAC;IACvE,qBAAqB,CAAC,EAAE,EAAE,KAAK,GAAG,MAAM,CAAC;IACzC,8EAA8E;IAC9E,UAAU,CAAC,OAAO,EAAE,UAAU,GAAG,SAAS,GAAG,MAAM,CAAC;IACpD,oGAAoG;IACpG,cAAc,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,CAAC,GAAG,sBAAsB,CAAC;CAClE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,OAAO,SAAS,aAAa,CAAC,MAAM,CAAC,EAAE,KAAK,EAAE;IAC1E,QAAQ,EAAE,WAAW,CAAC;IACtB,YAAY,EAAE,CAAC,OAAO,EAAE,aAAa,KAAK,OAAO,CAAC;IAClD,MAAM,EAAE,IAAI,CAAC,cAAc,EAAE,YAAY,GAAG,kBAAkB,CAAC,CAAC;IAChE,SAAS,EAAE,YAAY,CAAC;CACzB,GAAG,aAAa,CAAC,OAAO,CAAC,CAoVzB;AAED;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,CAAC,EAChC,KAAK,EAAE;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,EAC/C,SAAS,EAAE,CAAC,MAAM,EAAE,MAAM,KAAK,OAAO,CAAC;IAAE,IAAI,EAAE,CAAC,EAAE,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,CAAC,GAC/E,OAAO,CAAC,CAAC,EAAE,CAAC,CAWd;AAED,kEAAkE;AAClE,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAI1C;AAED,wDAAwD;AACxD,wBAAgB,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,GAAG,MAAM,CAc9C"}

package/dist/context.js

@@ -0,0 +1,456 @@
+import { PlatformApiError } from '@antasphere/chassis-sdk';
+import { activeHubProfile, CLOUD_PROFILE, CliAuthClient, CliUsageError, connectOnDemand, lookupConnectKey, printJson as corePrintJson, refreshConnectKey, resolveApiKey, resolveBaseUrl, sameInstance, selectProfile } from '@antasphere/cli-core';
+import { isWorkspaceId, matchWorkspace } from './workspace.js';
+// The injectable I/O seam, the usage-error class, and the resolution
+// helpers live in @antasphere/cli-core (extracted from this CLI); re-exported
+// so the command modules' imports stay unchanged.
+export { CliUsageError } from '@antasphere/cli-core';
+/**
+ * A refusal of the API that a command turned into a sentence (the project
+ * verbs do), thrown as the usage error it reads as, with the wire status
+ * kept: the runner adds what only it knows, the workspace a 404 was asked of.
+ */
+export class CliApiRefusal extends CliUsageError {
+    status;
+    constructor(message, status) {
+        super(message);
+        this.status = status;
+        this.name = 'CliApiRefusal';
+    }
+}
+// ── Terminal-control sanitation ──────────────────────────────────────────────
+/**
+ * Strip terminal control sequences from human output.
+ *
+ * Almost everything the CLI prints in its human mode is content someone
+ * ELSE wrote: annotation bodies and author names from a share-link
+ * recipient, the titles of the tool's resources, form-response payloads, stored
+ * filenames, and server error messages. A terminal renders ANSI escapes in
+ * all of it — colours and cursor moves are the mild end; OSC 8 hyperlinks
+ * hide a URL behind friendly text, OSC 52 writes the user's clipboard, and
+ * a CSI sequence can scrub the line above so the owner never sees what the
+ * command really did.
+ *
+ * So the human sinks are wrapped (`ttySafeIo`) and everything they print
+ * loses C0 (except tab / LF / CR, which the tables and the CSV need), the
+ * 8-bit C1 introducers, and complete CSI/OSC/two-character escapes. `--json`
+ * output deliberately bypasses this: it is data, not display, and
+ * `JSON.stringify` already escapes every C0 byte.
+ */
+export function sanitizeForTty(s) {
+    /* eslint-disable no-control-regex -- matching control characters IS the job here. */
+    return (s
+        // OSC: ESC ] … terminated by BEL, ST (ESC \\) or the end of the string.
+        .replace(/\u001b\][\s\S]*?(?:\u0007|\u001b\\|$)/g, '')
+        // CSI: ESC [ params intermediates final.
+        .replace(/\u001b\[[0-?]*[ -/]*[@-~]/g, '')
+        // Any other two-character escape (charset switches, RIS, …).
+        .replace(/\u001b[@-Z\\-_]/g, '')
+        // Whatever is left: stray C0 (ESC included), DEL, and the 8-bit C1
+        // block whose 0x9b / 0x9d are CSI / OSC on their own. Tab (0x09),
+        // LF (0x0a) and CR (0x0d) survive — tables and CSV are built of them.
+        .replace(/[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f]/g, ''));
+    /* eslint-enable no-control-regex */
+}
+/** Raw sink behind a sanitizing one, so `--json` can still print verbatim. */
+const rawSinks = new WeakMap();
+/** Wrap an io so every human write is sanitized (see sanitizeForTty). */
+export function ttySafeIo(io) {
+    const safe = {
+        ...io,
+        // `isTTY` rides along: the open decision reads it through the wrapper.
+        out: {
+            write: (s) => io.out.write(sanitizeForTty(s)),
+            ...(io.out.isTTY !== undefined ? { isTTY: io.out.isTTY } : {})
+        },
+        err: { write: (s) => io.err.write(sanitizeForTty(s)) }
+    };
+    rawSinks.set(safe, io);
+    return safe;
+}
+/**
+ * The `--api-key-stdin` value, parked against this invocation's io because
+ * `resolveContext` is synchronous and cannot read stdin itself.
+ */
+const stdinApiKeys = new WeakMap();
+export function setStdinApiKey(io, key) {
+    stdinApiKeys.set(io, key);
+}
+/** The key `--api-key-stdin` already read, if any. */
+export function stdinApiKey(io) {
+    return stdinApiKeys.get(io);
+}
+/**
+ * `--json` output goes to the RAW sink: machine output must stay
+ * byte-exact, and JSON.stringify already escapes the C0 range.
+ */
+export function printJson(io, value) {
+    corePrintJson(rawSinks.get(io) ?? io, value);
+}
+/** The context whose selection reached the wire, for the runner's error path. */
+const appliedContexts = new WeakMap();
+/**
+ * The context functions, bound to one tool: its identity (identity.ts), the
+ * client it talks through, and the config and workspace functions already
+ * bound to the same identity.
+ */
+export function createContext(input) {
+    const { identity, createClient } = input;
+    const { loadConfig, removeConnectKey } = input.config;
+    const { describeSelection, explainRefusal, pickWorkspaceSelection } = input.workspace;
+    const unknownHint = `run \`${identity.bin} profiles\` to list them.`;
+    /** The named (or active) profile, erroring on an explicitly named missing one. */
+    function resolveProfile(config, requested) {
+        const { name, profile } = selectProfile({ config, requested, cloudUrl: identity.cloudUrl, unknownHint });
+        return { name, profile };
+    }
+    function profileUrl(profile) {
+        return profile?.baseUrl ?? identity.cloudUrl;
+    }
+    /**
+     * Backend + credential resolution, in its documented order:
+     *
+     *   profile:   --profile → the profile of --api-url / <PREFIX>_URL (made in
+     *              memory, named for the host, when none is saved) → the active
+     *              profile (`<bin> use`) → the implicit `cloud` profile
+     *   base URL:  --api-url (or --url) → <PREFIX>_URL → profile baseUrl → the
+     *              tool's cloud URL
+     *   API key:   --api-key → <PREFIX>_API_KEY → profile apiKey
+     *              → the hub-connect key cached on the profile (cloud instances)
+     *   workspace: --org / --workspace → <PREFIX>_ORG / <PREFIX>_WORKSPACE
+     *              → none (the server's default; workspace.ts)
+     *
+     * A profile is an instance (cli-core 0.5.0): a cached hub key is read only
+     * when the profile names the instance this request goes to, so a key
+     * minted for the cloud can never be sent to some other instance named by
+     * --api-url / <PREFIX>_URL. A self-hosted CLI names its instance once, as a
+     * profile; the cloud needs no flag at all.
+     */
+    function resolveContext(cmd, io) {
+        const opts = cmd.optsWithGlobals();
+        const config = loadConfig(io.env);
+        const apiUrl = opts.apiUrl ?? opts.url ?? io.env[`${identity.envPrefix}_URL`];
+        const selected = selectProfile({
+            config,
+            requested: opts.profile,
+            apiUrl,
+            cloudUrl: identity.cloudUrl,
+            unknownHint
+        });
+        const { name: profileName, profile } = selected;
+        const baseUrl = resolveBaseUrl({
+            flag: apiUrl,
+            env: io.env,
+            envVar: `${identity.envPrefix}_URL`,
+            profile,
+            cloudUrl: identity.cloudUrl
+        });
+        // A profile's own key is sent only to the instance the profile names
+        // (verifier round 1, F5): `--profile a --api-url <b>` must never hand
+        // a's key to b, exactly as the connect cache below never does.
+        const sameProfileInstance = sameInstance(profileUrl(profile), baseUrl);
+        let apiKey = resolveApiKey({
+            flag: opts.apiKey ?? stdinApiKeys.get(io),
+            env: io.env,
+            envVar: `${identity.envPrefix}_API_KEY`,
+            profile: sameProfileInstance ? profile : undefined
+        });
+        let credentialSource = opts.apiKey !== undefined || stdinApiKeys.get(io) !== undefined
+            ? 'flag'
+            : io.env[`${identity.envPrefix}_API_KEY`]
+                ? 'env'
+                : apiKey
+                    ? 'profile'
+                    : 'none';
+        if (!apiKey && sameProfileInstance) {
+            // No direct key: the connect cache's slot is the ACTIVE hub profile
+            // (what `antasphere login` stored) — org-independent by design. A key
+            // cached for ANOTHER account than the login now stored on that slot
+            // (`antasphere login --email other` since) is never served: it is the
+            // other person's credential (PRDCT-3032); connectForKey retires it.
+            const hub = activeHubProfile(io.env);
+            if (hub.name && !cachedForAnotherAccount(profile, hub.name, hub.profile?.email)) {
+                apiKey = lookupConnectKey(profile, hub.name);
+            }
+            if (apiKey)
+                credentialSource = 'hub-cache';
+        }
+        const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
+        const ctx = {
+            client: createClient({ baseUrl, ...(apiKey ? { apiKey } : {}), fetch: fetchImpl }),
+            baseUrl,
+            apiKey,
+            credentialSource,
+            json: Boolean(opts.json),
+            io,
+            profileName,
+            profileSource: selected.source,
+            profileCreated: selected.created,
+            config,
+            workspaceSelection: pickWorkspaceSelection({
+                workspaceFlag: opts.workspace,
+                orgFlag: opts.org,
+                env: io.env
+            }),
+            workspaceId: undefined
+        };
+        if (credentialSource === 'hub-cache' && apiKey) {
+            // A cached key may have been revoked at the hub since it was minted
+            // (a swept membership, a logout elsewhere): the client's fetch recovers
+            // once, below, instead of stranding the person on a 401.
+            ctx.client = createClient({ baseUrl, apiKey, fetch: recoveringFetch(ctx, fetchImpl) });
+        }
+        return ctx;
+    }
+    /**
+     * The cached connect key on `slot` was minted for another Antasphere
+     * account than the one whose login the slot now holds. Both addresses must
+     * be known: a cache entry or a hub profile without one is trusted as before.
+     */
+    function cachedForAnotherAccount(profile, slot, hubEmail) {
+        const cached = profile?.connectKeys?.[slot]?.email;
+        if (!cached || !hubEmail)
+            return false;
+        return cached.toLowerCase() !== hubEmail.toLowerCase();
+    }
+    const NO_KEY_MESSAGE = `An API key is required. Sign in (\`${identity.bin} login\`), pass --api-key, or set ` +
+        `${identity.envPrefix}_API_KEY.`;
+    /** The tool's own copy for the cli-core seam: the one-command login is the remedy. */
+    const MISSING_HUB_LOGIN_MESSAGE = `This ${identity.displayName} instance signs in through Antasphere. Run \`${identity.bin} login\` once ` +
+        `(or \`antasphere login\`), then retry — or pass --api-key <${identity.keyPrefix}_…> / set ` +
+        `${identity.envPrefix}_API_KEY.`;
+    function connectOptions(ctx) {
+        const { io } = ctx;
+        return {
+            tool: identity.tool,
+            toolBaseUrl: ctx.baseUrl,
+            // A profile with no baseUrl of its own is at the cloud URL (cli-core 0.5.0).
+            cloudUrl: identity.cloudUrl,
+            profileName: ctx.profileName ?? CLOUD_PROFILE,
+            env: io.env,
+            // Thread the injected fetch so the probe + exchange stay on the test
+            // harness wire (and any proxying the runner set up).
+            ...(io.fetch ? { fetch: io.fetch } : {}),
+            notify: (line) => io.err.write(line),
+            messages: { missingHubLogin: MISSING_HUB_LOGIN_MESSAGE }
+        };
+    }
+    /**
+     * The stranded-key recovery (PRDCT-2947): a fetch that, on the FIRST 401
+     * answered to a key served from the connect cache, evicts that key, runs
+     * the hub exchange again (cli-core `refreshConnectKey`) and replays the
+     * request once with the new key. A second 401 stands. A hub refusal on the
+     * way (a restricted tool, a swept account) is the hub's own sentence, exit
+     * 3, through the runner. An instance that is no longer cloud recovers
+     * nothing and the 401 stands as it is.
+     */
+    function recoveringFetch(ctx, base) {
+        let recovered = false;
+        return async (input, init) => {
+            const res = await base(input, init);
+            if (res.status !== 401 || recovered || ctx.credentialSource !== 'hub-cache')
+                return res;
+            recovered = true;
+            // A 401 under a workspace selection may be the SELECTION's refusal:
+            // the server answers a workspace the person does not belong to exactly
+            // like an unknown key (no oracle). Ask `/me` once without it; when the
+            // key answers there, it is alive and nothing is evicted, exchanged or
+            // replayed (verifier round 1, F2: a refused --org leaked a live key per
+            // command). The runner then explains the refusal.
+            if (ctx.workspaceId !== undefined && ctx.apiKey) {
+                const probe = await base(`${ctx.baseUrl}/api/v1/me`, {
+                    headers: { authorization: `Bearer ${ctx.apiKey}` }
+                }).catch(() => null);
+                // Only a probe that ANSWERS 401 proves the key dead (verifier round 2,
+                // F10): a probe with no answer, or any other status, keeps the key and
+                // lets the 401 stand.
+                if (!probe || probe.status !== 401)
+                    return res;
+            }
+            const outcome = await refreshConnectKey(connectOptions(ctx));
+            if (outcome.outcome === 'not_cloud')
+                return res;
+            ctx.apiKey = outcome.key;
+            ctx.credentialSource = 'hub-exchange';
+            ctx.io.err.write('The cached key was refused; signed in again through Antasphere.\n');
+            const headers = new Headers(init?.headers);
+            headers.set('authorization', `Bearer ${outcome.key}`);
+            return base(input, { ...init, headers });
+        };
+    }
+    /**
+     * Requires an API key; throws a friendly message the runner turns into exit 1.
+     *
+     * When nothing resolved, this is the connect-on-demand seam (binding
+     * patterns §7, gcloud model), owned by @antasphere/cli-core since 0.3.0:
+     * if — and only if — discovery says the instance is an Antasphere-cloud
+     * one, the stored `antasphere login` credential is exchanged (hub → tool)
+     * for a USER-scoped tool-local API key, which is cached on the selected
+     * profile under the hub profile's name and used for this invocation — and
+     * served from that cache on every subsequent run (no re-exchange, no fresh
+     * mint). Self-hosted instances never take this branch: they get the
+     * classic error unchanged.
+     */
+    async function requireApiKey(ctx, opts = {}) {
+        const key = ctx.apiKey ?? (await connectForKey(ctx));
+        if (opts.workspace !== false)
+            await applyWorkspace(ctx);
+        return key;
+    }
+    /**
+     * Put the selected workspace on the client (PRDCT-2419). Every signed-in
+     * command calls `requireApiKey`, so this is the one place the selection is
+     * applied and no command names it. An id is sent as it is (a workspace id
+     * or a hub organization id: the server maps the latter and fails closed on
+     * one that is not the person's, and `explainWorkspaceRefusal` says so); a
+     * name costs one `/me` to find its id. `workspaces` and `workspace default`
+     * pass `workspace: false`: they are how a person repairs a selection that
+     * no longer works, so they must answer when it does not.
+     */
+    async function applyWorkspace(ctx) {
+        const selection = ctx.workspaceSelection;
+        if (!selection || ctx.workspaceId !== undefined)
+            return;
+        const id = isWorkspaceId(selection.value)
+            ? selection.value
+            : matchWorkspace((await ctx.client.me()).workspaces, selection.value).id;
+        ctx.client.setWorkspace(id);
+        ctx.workspaceId = id;
+        appliedContexts.set(ctx.io, ctx);
+    }
+    /** How the workspace of this invocation was chosen (`whoami`). */
+    function workspaceSource(ctx) {
+        return ctx.workspaceSelection?.source ?? 'default';
+    }
+    /**
+     * The sentence for a refusal the SELECTION caused, or null (workspace.ts
+     * `explainRefusal`). Asks `/me` once WITHOUT the selection: when that
+     * answers, the key is good and the workspace is what was refused. Any
+     * failure of the probe means the plain error is the honest one.
+     */
+    async function explainWorkspaceRefusal(io, e) {
+        const ctx = appliedContexts.get(io);
+        if (!ctx?.workspaceSelection || ctx.workspaceId === undefined || !ctx.apiKey)
+            return null;
+        if (!(e instanceof PlatformApiError))
+            return null;
+        if (e.code !== 'workspace_mismatch' && e.code !== 'invalid_api_key')
+            return null;
+        try {
+            const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
+            const me = await createClient({ baseUrl: ctx.baseUrl, apiKey: ctx.apiKey, fetch: fetchImpl }).me();
+            return explainRefusal({
+                code: e.code,
+                status: e.status,
+                selection: ctx.workspaceSelection,
+                workspaceId: ctx.workspaceId,
+                me,
+                baseUrl: ctx.baseUrl
+            });
+        }
+        catch {
+            return null;
+        }
+    }
+    /**
+     * The hint for a 404 under a selection: a resource id (a linked folder's, a
+     * pasted one) lives in ONE workspace, and the same id asked of another is
+     * "not found" — true, and useless without the workspace that was asked.
+     */
+    function workspaceNotFoundHint(io) {
+        const ctx = appliedContexts.get(io);
+        if (!ctx?.workspaceSelection || ctx.workspaceId === undefined)
+            return '';
+        const { workspaceSelection: selection } = ctx;
+        const noun = selection.kind === 'org' ? 'organization' : 'workspace';
+        return ` (looked in the ${noun} "${selection.value}", selected by ${describeSelection(selection)})`;
+    }
+    async function connectForKey(ctx) {
+        const { io } = ctx;
+        // The cached key of another account (the hub login on the slot changed)
+        // is revoked on its instance and forgotten before the exchange runs for
+        // the account now signed in (PRDCT-3032). Best effort: a dead key
+        // answers 401 and is forgotten all the same.
+        const hub = activeHubProfile(io.env);
+        if (ctx.profileName && hub.name) {
+            const profile = loadConfig(io.env).profiles[ctx.profileName];
+            if (cachedForAnotherAccount(profile, hub.name, hub.profile?.email)) {
+                const stale = profile?.connectKeys?.[hub.name];
+                if (stale) {
+                    io.err.write(`The ${identity.displayName} key cached for ${stale.email ?? 'another Antasphere login'} is retired: ` +
+                        `the Antasphere login is now ${hub.profile?.email ?? 'another account'}.\n`);
+                    const auth = new CliAuthClient({
+                        baseUrl: profileUrl(profile),
+                        ...(io.fetch ? { fetch: io.fetch } : {})
+                    });
+                    await auth.revoke(stale.apiKey).catch(() => undefined);
+                    removeConnectKey(io.env, ctx.profileName, hub.name);
+                }
+            }
+        }
+        const outcome = await connectOnDemand(connectOptions(ctx));
+        if (outcome.outcome === 'not_cloud') {
+            // Self-hosted / unreachable: the classic error, byte-identical.
+            throw new CliUsageError(NO_KEY_MESSAGE);
+        }
+        // The minted key becomes this invocation's credential.
+        ctx.apiKey = outcome.key;
+        ctx.credentialSource = outcome.cached ? 'hub-cache' : 'hub-exchange';
+        const fetchImpl = io.fetch ?? globalThis.fetch.bind(globalThis);
+        ctx.client = createClient({
+            baseUrl: ctx.baseUrl,
+            apiKey: outcome.key,
+            fetch: outcome.cached ? recoveringFetch(ctx, fetchImpl) : fetchImpl
+        });
+        return outcome.key;
+    }
+    return {
+        resolveProfile,
+        resolveContext,
+        requireApiKey,
+        workspaceSource,
+        explainWorkspaceRefusal,
+        workspaceNotFoundHint,
+        profileUrl,
+        connectOptions
+    };
+}
+/**
+ * `--all` for a cursor-paginated list: the first page, then every next page
+ * while the server hands a cursor, the rows in order. The one loop behind
+ * every `--all`; a server that repeats a cursor is stopped here, once.
+ */
+export async function drainPages(first, fetchPage) {
+    const rows = [...first.rows];
+    const seen = new Set();
+    let cursor = first.nextCursor;
+    while (cursor && !seen.has(cursor)) {
+        seen.add(cursor);
+        const page = await fetchPage(cursor);
+        rows.push(...page.rows);
+        cursor = page.nextCursor;
+    }
+    return rows;
+}
+/** Human-readable size (B / KB / MB) for the listing commands. */
+export function fmtBytes(n) {
+    if (n < 1024)
+        return `${n} B`;
+    if (n < 1024 * 1024)
+        return `${(n / 1024).toFixed(1)} KB`;
+    return `${(n / (1024 * 1024)).toFixed(1)} MB`;
+}
+/** Minimal aligned two-space table for human output. */
+export function table(rows) {
+    if (rows.length === 0)
+        return '';
+    const first = rows[0];
+    const widths = first.map((_, i) => Math.max(...rows.map((r) => (r[i] ?? '').length)));
+    return (rows
+        .map((r) => r
+        .map((cell, i) => (i === r.length - 1 ? cell : (cell ?? '').padEnd(widths[i] ?? 0)))
+        .join('  ')
+        .trimEnd())
+        .join('\n') + '\n');
+}
+//# sourceMappingURL=context.js.map

package/dist/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../src/context.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAA0C,MAAM,yBAAyB,CAAC;AAEnG,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,aAAa,EACb,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,SAAS,IAAI,aAAa,EAC1B,iBAAiB,EACjB,aAAa,EACb,cAAc,EACd,YAAY,EACZ,aAAa,EAId,MAAM,sBAAsB,CAAC;AAG9B,OAAO,EACL,aAAa,EACb,cAAc,EAIf,MAAM,gBAAgB,CAAC;AAExB,qEAAqE;AACrE,8EAA8E;AAC9E,kDAAkD;AAClD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AAErD;;;;GAIG;AACH,MAAM,OAAO,aAAc,SAAQ,aAAa;IAG5B;IAFlB,YACE,OAAe,EACC,MAAc;QAE9B,KAAK,CAAC,OAAO,CAAC,CAAC;QAFC,WAAM,GAAN,MAAM,CAAQ;QAG9B,IAAI,CAAC,IAAI,GAAG,eAAe,CAAC;IAC9B,CAAC;CACF;AA4BD,gFAAgF;AAEhF;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,cAAc,CAAC,CAAS;IACtC,qFAAqF;IACrF,OAAO,CACL,CAAC;QACC,wEAAwE;SACvE,OAAO,CAAC,wCAAwC,EAAE,EAAE,CAAC;QACtD,yCAAyC;SACxC,OAAO,CAAC,4BAA4B,EAAE,EAAE,CAAC;QAC1C,6DAA6D;SAC5D,OAAO,CAAC,kBAAkB,EAAE,EAAE,CAAC;QAChC,mEAAmE;QACnE,kEAAkE;QAClE,sEAAsE;SACrE,OAAO,CAAC,wDAAwD,EAAE,EAAE,CAAC,CACzE,CAAC;IACF,oCAAoC;AACtC,CAAC;AAED,8EAA8E;AAC9E,MAAM,QAAQ,GAAG,IAAI,OAAO,EAAgB,CAAC;AAE7C,yEAAyE;AACzE,MAAM,UAAU,SAAS,CAAC,EAAS;IACjC,MAAM,IAAI,GAAU;QAClB,GAAG,EAAE;QACL,uEAAuE;QACvE,GAAG,EAAE;YACH,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;YACrD,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC/D;QACD,GAAG,EAAE,EAAE,KAAK,EAAE,CAAC,CAAS,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC,EAAE;KAC/D,CAAC;IACF,QAAQ,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IACvB,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;GAGG;AACH,MAAM,YAAY,GAAG,IAAI,OAAO,EAAiB,CAAC;AAElD,MAAM,UAAU,cAAc,CAAC,EAAS,EAAE,GAAW;IACnD,YAAY,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED,sDAAsD;AACtD,MAAM,UAAU,WAAW,CAAC,EAAS;IACnC,OAAO,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;AAC9B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,SAAS,CAAC,EAAS,EAAE,KAAc;IACjD,aAAa,CAAC,QAAQ,CAAC,GAAG,CAAC,EAAE,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC;AAC/C,CAAC;AAgDD,iFAAiF;AACjF,MAAM,eAAe,GAAG,IAAI,OAAO,EAAqB,CAAC;AAmBzD;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAwC,KAKpE;IACC,MAAM,EAAE,QAAQ,EAAE,YAAY,EAAE,GAAG,KAAK,CAAC;IACzC,MAAM,EAAE,UAAU,EAAE,gBAAgB,EAAE,GAAG,KAAK,CAAC,MAAM,CAAC;IACtD,MAAM,EAAE,iBAAiB,EAAE,cAAc,EAAE,sBAAsB,EAAE,GAAG,KAAK,CAAC,SAAS,CAAC;IACtF,MAAM,WAAW,GAAG,SAAS,QAAQ,CAAC,GAAG,2BAA2B,CAAC;IAErE,kFAAkF;IAClF,SAAS,cAAc,CACrB,MAAiB,EACjB,SAA6B;QAE7B,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,aAAa,CAAC,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,CAAC,QAAQ,EAAE,WAAW,EAAE,CAAC,CAAC;QACzG,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IAC3B,CAAC;IAED,SAAS,UAAU,CAAC,OAA+B;QACjD,OAAO,OAAO,EAAE,OAAO,IAAI,QAAQ,CAAC,QAAQ,CAAC;IAC/C,CAAC;IAED;;;;;;;;;;;;;;;;;;OAkBG;IACH,SAAS,cAAc,CAAC,GAAY,EAAE,EAAS;QAC7C,MAAM,IAAI,GAAG,GAAG,CAAC,eAAe,EAAgB,CAAC;QACjD,MAAM,MAAM,GAAG,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QAClC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,SAAS,MAAM,CAAC,CAAC;QAC9E,MAAM,QAAQ,GAAG,aAAa,CAAC;YAC7B,MAAM;YACN,SAAS,EAAE,IAAI,CAAC,OAAO;YACvB,MAAM;YACN,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,WAAW;SACZ,CAAC,CAAC;QACH,MAAM,EAAE,IAAI,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,QAAQ,CAAC;QAEhD,MAAM,OAAO,GAAG,cAAc,CAAC;YAC7B,IAAI,EAAE,MAAM;YACZ,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,MAAM;YACnC,OAAO;YACP,QAAQ,EAAE,QAAQ,CAAC,QAAQ;SAC5B,CAAC,CAAC;QACH,qEAAqE;QACrE,sEAAsE;QACtE,+DAA+D;QAC/D,MAAM,mBAAmB,GAAG,YAAY,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC;QACvE,IAAI,MAAM,GAAG,aAAa,CAAC;YACzB,IAAI,EAAE,IAAI,CAAC,MAAM,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC;YACzC,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,MAAM,EAAE,GAAG,QAAQ,CAAC,SAAS,UAAU;YACvC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS;SACnD,CAAC,CAAC;QACH,IAAI,gBAAgB,GAClB,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,YAAY,CAAC,GAAG,CAAC,EAAE,CAAC,KAAK,SAAS;YAC7D,CAAC,CAAC,MAAM;YACR,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,GAAG,QAAQ,CAAC,SAAS,UAAU,CAAC;gBACvC,CAAC,CAAC,KAAK;gBACP,CAAC,CAAC,MAAM;oBACN,CAAC,CAAC,SAAS;oBACX,CAAC,CAAC,MAAM,CAAC;QACjB,IAAI,CAAC,MAAM,IAAI,mBAAmB,EAAE,CAAC;YACnC,oEAAoE;YACpE,sEAAsE;YACtE,oEAAoE;YACpE,sEAAsE;YACtE,oEAAoE;YACpE,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;YACrC,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;gBAChF,MAAM,GAAG,gBAAgB,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;YAC/C,CAAC;YACD,IAAI,MAAM;gBAAE,gBAAgB,GAAG,WAAW,CAAC;QAC7C,CAAC;QACD,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,MAAM,GAAG,GAAwB;YAC/B,MAAM,EAAE,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;YAClF,OAAO;YACP,MAAM;YACN,gBAAgB;YAChB,IAAI,EAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;YACxB,EAAE;YACF,WAAW;YACX,aAAa,EAAE,QAAQ,CAAC,MAAM;YAC9B,cAAc,EAAE,QAAQ,CAAC,OAAO;YAChC,MAAM;YACN,kBAAkB,EAAE,sBAAsB,CAAC;gBACzC,aAAa,EAAE,IAAI,CAAC,SAAS;gBAC7B,OAAO,EAAE,IAAI,CAAC,GAAG;gBACjB,GAAG,EAAE,EAAE,CAAC,GAAG;aACZ,CAAC;YACF,WAAW,EAAE,SAAS;SACvB,CAAC;QACF,IAAI,gBAAgB,KAAK,WAAW,IAAI,MAAM,EAAE,CAAC;YAC/C,oEAAoE;YACpE,wEAAwE;YACxE,yDAAyD;YACzD,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,EAAE,CAAC,CAAC;QACzF,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;OAIG;IACH,SAAS,uBAAuB,CAC9B,OAA+B,EAC/B,IAAY,EACZ,QAA4B;QAE5B,MAAM,MAAM,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;QACnD,IAAI,CAAC,MAAM,IAAI,CAAC,QAAQ;YAAE,OAAO,KAAK,CAAC;QACvC,OAAO,MAAM,CAAC,WAAW,EAAE,KAAK,QAAQ,CAAC,WAAW,EAAE,CAAC;IACzD,CAAC;IAED,MAAM,cAAc,GAClB,sCAAsC,QAAQ,CAAC,GAAG,oCAAoC;QACtF,GAAG,QAAQ,CAAC,SAAS,WAAW,CAAC;IAEnC,sFAAsF;IACtF,MAAM,yBAAyB,GAC7B,QAAQ,QAAQ,CAAC,WAAW,gDAAgD,QAAQ,CAAC,GAAG,gBAAgB;QACxG,8DAA8D,QAAQ,CAAC,SAAS,YAAY;QAC5F,GAAG,QAAQ,CAAC,SAAS,WAAW,CAAC;IAEnC,SAAS,cAAc,CAAC,GAAwB;QAC9C,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC;QACnB,OAAO;YACL,IAAI,EAAE,QAAQ,CAAC,IAAI;YACnB,WAAW,EAAE,GAAG,CAAC,OAAO;YACxB,6EAA6E;YAC7E,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,WAAW,EAAE,GAAG,CAAC,WAAW,IAAI,aAAa;YAC7C,GAAG,EAAE,EAAE,CAAC,GAAG;YACX,qEAAqE;YACrE,qDAAqD;YACrD,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACxC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC;YACpC,QAAQ,EAAE,EAAE,eAAe,EAAE,yBAAyB,EAAE;SACzD,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,SAAS,eAAe,CAAC,GAAwB,EAAE,IAA6B;QAC9E,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE;YAC3B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;YACpC,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,SAAS,IAAI,GAAG,CAAC,gBAAgB,KAAK,WAAW;gBAAE,OAAO,GAAG,CAAC;YACxF,SAAS,GAAG,IAAI,CAAC;YACjB,oEAAoE;YACpE,uEAAuE;YACvE,uEAAuE;YACvE,sEAAsE;YACtE,wEAAwE;YACxE,kDAAkD;YAClD,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,EAAE,CAAC;gBAChD,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,GAAG,GAAG,CAAC,OAAO,YAAY,EAAE;oBACnD,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,GAAG,CAAC,MAAM,EAAE,EAAE;iBACnD,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;gBACrB,uEAAuE;gBACvE,uEAAuE;gBACvE,sBAAsB;gBACtB,IAAI,CAAC,KAAK,IAAI,KAAK,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,GAAG,CAAC;YACjD,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,iBAAiB,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;YAC7D,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW;gBAAE,OAAO,GAAG,CAAC;YAChD,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;YACzB,GAAG,CAAC,gBAAgB,GAAG,cAAc,CAAC;YACtC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,mEAAmE,CAAC,CAAC;YACtF,MAAM,OAAO,GAAG,IAAI,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,eAAe,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YACtD,OAAO,IAAI,CAAC,KAAK,EAAE,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;QAC3C,CAAC,CAAC;IACJ,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,UAAU,aAAa,CAC1B,GAAwB,EACxB,OAAgC,EAAE;QAElC,MAAM,GAAG,GAAG,GAAG,CAAC,MAAM,IAAI,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC;QACrD,IAAI,IAAI,CAAC,SAAS,KAAK,KAAK;YAAE,MAAM,cAAc,CAAC,GAAG,CAAC,CAAC;QACxD,OAAO,GAAG,CAAC;IACb,CAAC;IAED;;;;;;;;;OASG;IACH,KAAK,UAAU,cAAc,CAAC,GAAwB;QACpD,MAAM,SAAS,GAAG,GAAG,CAAC,kBAAkB,CAAC;QACzC,IAAI,CAAC,SAAS,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO;QACxD,MAAM,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,KAAK,CAAC;YACvC,CAAC,CAAC,SAAS,CAAC,KAAK;YACjB,CAAC,CAAC,cAAc,CAAC,CAAC,MAAM,GAAG,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,UAAU,EAAE,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;QAC3E,GAAG,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC,CAAC;QAC5B,GAAG,CAAC,WAAW,GAAG,EAAE,CAAC;QACrB,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,EAAE,GAAG,CAAC,CAAC;IACnC,CAAC;IAED,kEAAkE;IAClE,SAAS,eAAe,CAAC,GAAwB;QAC/C,OAAO,GAAG,CAAC,kBAAkB,EAAE,MAAM,IAAI,SAAS,CAAC;IACrD,CAAC;IAED;;;;;OAKG;IACH,KAAK,UAAU,uBAAuB,CAAC,EAAS,EAAE,CAAU;QAC1D,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,kBAAkB,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS,IAAI,CAAC,GAAG,CAAC,MAAM;YAAE,OAAO,IAAI,CAAC;QAC1F,IAAI,CAAC,CAAC,CAAC,YAAY,gBAAgB,CAAC;YAAE,OAAO,IAAI,CAAC;QAClD,IAAI,CAAC,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,CAAC,IAAI,KAAK,iBAAiB;YAAE,OAAO,IAAI,CAAC;QACjF,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YAChE,MAAM,EAAE,GAAG,MAAM,YAAY,CAAC,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC;YACnG,OAAO,cAAc,CAAC;gBACpB,IAAI,EAAE,CAAC,CAAC,IAAI;gBACZ,MAAM,EAAE,CAAC,CAAC,MAAM;gBAChB,SAAS,EAAE,GAAG,CAAC,kBAAkB;gBACjC,WAAW,EAAE,GAAG,CAAC,WAAW;gBAC5B,EAAE;gBACF,OAAO,EAAE,GAAG,CAAC,OAAO;aACrB,CAAC,CAAC;QACL,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IAED;;;;OAIG;IACH,SAAS,qBAAqB,CAAC,EAAS;QACtC,MAAM,GAAG,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACpC,IAAI,CAAC,GAAG,EAAE,kBAAkB,IAAI,GAAG,CAAC,WAAW,KAAK,SAAS;YAAE,OAAO,EAAE,CAAC;QACzE,MAAM,EAAE,kBAAkB,EAAE,SAAS,EAAE,GAAG,GAAG,CAAC;QAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,WAAW,CAAC;QACrE,OAAO,mBAAmB,IAAI,KAAK,SAAS,CAAC,KAAK,kBAAkB,iBAAiB,CAAC,SAAS,CAAC,GAAG,CAAC;IACtG,CAAC;IAED,KAAK,UAAU,aAAa,CAAC,GAAwB;QACnD,MAAM,EAAE,EAAE,EAAE,GAAG,GAAG,CAAC;QACnB,wEAAwE;QACxE,wEAAwE;QACxE,kEAAkE;QAClE,6CAA6C;QAC7C,MAAM,GAAG,GAAG,gBAAgB,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,WAAW,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC;YAChC,MAAM,OAAO,GAAG,UAAU,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YAC7D,IAAI,uBAAuB,CAAC,OAAO,EAAE,GAAG,CAAC,IAAI,EAAE,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,EAAE,CAAC;gBACnE,MAAM,KAAK,GAAG,OAAO,EAAE,WAAW,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;gBAC/C,IAAI,KAAK,EAAE,CAAC;oBACV,EAAE,CAAC,GAAG,CAAC,KAAK,CACV,OAAO,QAAQ,CAAC,WAAW,mBAAmB,KAAK,CAAC,KAAK,IAAI,0BAA0B,eAAe;wBACpG,+BAA+B,GAAG,CAAC,OAAO,EAAE,KAAK,IAAI,iBAAiB,KAAK,CAC9E,CAAC;oBACF,MAAM,IAAI,GAAG,IAAI,aAAa,CAAC;wBAC7B,OAAO,EAAE,UAAU,CAAC,OAAO,CAAC;wBAC5B,GAAG,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;qBACzC,CAAC,CAAC;oBACH,MAAM,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACvD,gBAAgB,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,WAAW,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC;gBACtD,CAAC;YACH,CAAC;QACH,CAAC;QACD,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC;QAC3D,IAAI,OAAO,CAAC,OAAO,KAAK,WAAW,EAAE,CAAC;YACpC,gEAAgE;YAChE,MAAM,IAAI,aAAa,CAAC,cAAc,CAAC,CAAC;QAC1C,CAAC;QAED,uDAAuD;QACvD,GAAG,CAAC,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC;QACzB,GAAG,CAAC,gBAAgB,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;QACrE,MAAM,SAAS,GAAG,EAAE,CAAC,KAAK,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QAChE,GAAG,CAAC,MAAM,GAAG,YAAY,CAAC;YACxB,OAAO,EAAE,GAAG,CAAC,OAAO;YACpB,MAAM,EAAE,OAAO,CAAC,GAAG;YACnB,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,eAAe,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS;SACpE,CAAC,CAAC;QACH,OAAO,OAAO,CAAC,GAAG,CAAC;IACrB,CAAC;IAED,OAAO;QACL,cAAc;QACd,cAAc;QACd,aAAa;QACb,eAAe;QACf,uBAAuB;QACvB,qBAAqB;QACrB,UAAU;QACV,cAAc;KACf,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,KAA+C,EAC/C,SAAgF;IAEhF,MAAM,IAAI,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC;IAC7B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,IAAI,MAAM,GAAG,KAAK,CAAC,UAAU,CAAC;IAC9B,OAAO,MAAM,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;QACnC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,SAAS,CAAC,MAAM,CAAC,CAAC;QACrC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QACxB,MAAM,GAAG,IAAI,CAAC,UAAU,CAAC;IAC3B,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,kEAAkE;AAClE,MAAM,UAAU,QAAQ,CAAC,CAAS;IAChC,IAAI,CAAC,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,IAAI,CAAC;IAC9B,IAAI,CAAC,GAAG,IAAI,GAAG,IAAI;QAAE,OAAO,GAAG,CAAC,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;IAC1D,OAAO,GAAG,CAAC,CAAC,GAAG,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,CAAC;AAChD,CAAC;AAED,wDAAwD;AACxD,MAAM,UAAU,KAAK,CAAC,IAAgB;IACpC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,CAAC,CAAE,CAAC;IACvB,MAAM,MAAM,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IACtF,OAAO,CACL,IAAI;SACD,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CACT,CAAC;SACE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACnF,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,EAAE,CACb;SACA,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CACrB,CAAC;AACJ,CAAC"}