@aperant/framework 0.6.2

package/dist/cli/install/cli-to-install-root.d.mts

@@ -0,0 +1,18 @@
+/**
+ * Look up the install-root (e.g. `.claude`, `.codex`, `.github/copilot`) for
+ * the runtime whose CLI is currently at the prompt.
+ *
+ * @param {string} cli  the `cli` string `detectHost()` returned
+ * @returns {string|null}  project-relative install root, or null when the
+ *   CLI has no mapped install target.
+ */
+export function cliToInstallRoot(cli: string): string | null;
+/**
+ * Inverse lookup: for a host cli, return the full runtime descriptor. Useful
+ * for callers that need more than just the install root (e.g. markers).
+ *
+ * @param {string} cli
+ * @returns {import('./runtime-detect.mjs').RuntimeDescriptor|null}
+ */
+export function runtimeForCli(cli: string): import("./runtime-detect.mjs").RuntimeDescriptor | null;
+//# sourceMappingURL=cli-to-install-root.d.mts.map

package/dist/cli/install/cli-to-install-root.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-to-install-root.d.mts","sourceRoot":"","sources":["../../../src/cli/install/cli-to-install-root.mjs"],"names":[],"mappings":"AAsBA;;;;;;;GAOG;AACH,sCAJW,MAAM,GACJ,MAAM,GAAC,IAAI,CAOvB;AAED;;;;;;GAMG;AACH,mCAHW,MAAM,GACJ,OAAO,sBAAsB,EAAE,iBAAiB,GAAC,IAAI,CAKjE"}

package/dist/cli/install/cli-to-install-root.mjs

@@ -0,0 +1,47 @@
+/**
+ * install/cli-to-install-root.mjs — shared host-cli → install-root mapping.
+ *
+ * Extracted so both the install pipeline (which targets runtimes by their
+ * `id`) and the router (which discovers skills under the install root of
+ * whichever host CLI is detected) share a single source of truth. Keeps the
+ * scan surface and the install surface from drifting.
+ *
+ * The mapping is driven entirely by RUNTIMES[i].cliId — do not add ad-hoc
+ * aliases here. When a new runtime lands, give its descriptor a cliId and
+ * the lookups below work automatically.
+ *
+ * `null` is returned for:
+ *   - CLIs with no install target (e.g. `pi` — host detected, but no apt
+ *     install root exists for the Pi runtime).
+ *   - `'unknown'` — deterministic branches (init/status/help) don't need a
+ *     mapping; the router falls back to the framework-scoped dev default
+ *     defined in getTrustedSkillSources().
+ */
+import { RUNTIMES } from './runtime-detect.mjs';
+/**
+ * Look up the install-root (e.g. `.claude`, `.codex`, `.github/copilot`) for
+ * the runtime whose CLI is currently at the prompt.
+ *
+ * @param {string} cli  the `cli` string `detectHost()` returned
+ * @returns {string|null}  project-relative install root, or null when the
+ *   CLI has no mapped install target.
+ */
+export function cliToInstallRoot(cli) {
+    if (typeof cli !== 'string' || cli === '' || cli === 'unknown')
+        return null;
+    const runtime = RUNTIMES.find((r) => r.cliId === cli);
+    return runtime?.installRoot ?? null;
+}
+/**
+ * Inverse lookup: for a host cli, return the full runtime descriptor. Useful
+ * for callers that need more than just the install root (e.g. markers).
+ *
+ * @param {string} cli
+ * @returns {import('./runtime-detect.mjs').RuntimeDescriptor|null}
+ */
+export function runtimeForCli(cli) {
+    if (typeof cli !== 'string' || cli === '' || cli === 'unknown')
+        return null;
+    return RUNTIMES.find((r) => r.cliId === cli) ?? null;
+}
+//# sourceMappingURL=cli-to-install-root.mjs.map

package/dist/cli/install/cli-to-install-root.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli-to-install-root.mjs","sourceRoot":"","sources":["../../../src/cli/install/cli-to-install-root.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,sBAAsB,CAAA;AAE/C;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,GAAG;IACnC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3E,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,CAAA;IACrD,OAAO,OAAO,EAAE,WAAW,IAAI,IAAI,CAAA;AACpC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,aAAa,CAAC,GAAG;IAChC,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,IAAI,CAAA;IAC3E,OAAO,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,GAAG,CAAC,IAAI,IAAI,CAAA;AACrD,CAAC"}

package/dist/cli/install/detached-spawn.d.mts

@@ -0,0 +1,128 @@
+/**
+ * Build the child env from allowlist + ecosystem opt-outs + HOME override.
+ *
+ * @param {{ ecosystem: string, homeDir: string, parentEnv?: NodeJS.ProcessEnv }} opts
+ * @returns {NodeJS.ProcessEnv}
+ */
+export function buildChildEnv({ ecosystem, homeDir, parentEnv }: {
+    ecosystem: string;
+    homeDir: string;
+    parentEnv?: NodeJS.ProcessEnv;
+}): NodeJS.ProcessEnv;
+/**
+ * Write the finalize wrapper shell script. The script runs the install
+ * command, captures its exit code, and invokes
+ * `apt-tools worktree-install --finalize` so the final status lands on
+ * state.json whether the install succeeds or fails.
+ *
+ * Shell choice:
+ *   - POSIX (macOS/Linux): /bin/sh — minimal dependencies
+ *   - Windows: .cmd file, invoked via cmd.exe — pure detached-spawn on
+ *     Windows is more fragile; we degrade gracefully by still capturing
+ *     the exit code + calling --finalize.
+ *
+ * @param {{
+ *   scriptPath: string,
+ *   cwd: string,
+ *   cmd: string[],
+ *   aptToolsPath: string,
+ *   taskId: string,
+ *   ecosystem: string,
+ *   projectDir: string,
+ *   shellWrapper?: string[] | null,
+ * }} opts
+ * @returns {string} path of the written script
+ */
+export function writeWrapperScript({ scriptPath, cwd, cmd, aptToolsPath, taskId, ecosystem, projectDir, shellWrapper, }: {
+    scriptPath: string;
+    cwd: string;
+    cmd: string[];
+    aptToolsPath: string;
+    taskId: string;
+    ecosystem: string;
+    projectDir: string;
+    shellWrapper?: string[] | null;
+}): string;
+/**
+ * Spawn the detached install child. Returns synchronously with the child's
+ * pid + start timestamp. The caller MUST have already:
+ *   1. Validated homeDir is a per-task tempdir (not the user's real HOME).
+ *   2. Run the manifest-scanner and confirmed ok === true.
+ *   3. Acquired a semaphore slot (or marked the install queued).
+ *   4. Written install_status: "running", install_pid: null,
+ *      install_started_at, install_log_path to state.json.
+ * This function then spawns and the caller updates state with the real pid.
+ *
+ * @param {{
+ *   argv: string[],               // ignored when wrapperPath is set
+ *   cwd: string,
+ *   logPath: string,
+ *   homeDir: string,
+ *   ecosystem: string,
+ *   wrapperPath: string,          // path to the finalize wrapper script
+ *   parentEnv?: NodeJS.ProcessEnv,
+ * }} opts
+ * @returns {{ pid: number, started_at: string, log_path: string }}
+ */
+export function spawnDetachedInstall({ argv: _argv, cwd, logPath, homeDir, ecosystem, wrapperPath, parentEnv, }: {
+    argv: string[];
+    cwd: string;
+    logPath: string;
+    homeDir: string;
+    ecosystem: string;
+    wrapperPath: string;
+    parentEnv?: NodeJS.ProcessEnv;
+}): {
+    pid: number;
+    started_at: string;
+    log_path: string;
+};
+/**
+ * Ecosystem-specific env opt-outs. Merged into the allowed env per call.
+ * Values intentionally use `CI=1` (not `true`) to sidestep Codex envvar
+ * transforms that flatten boolean string values inconsistently.
+ */
+export const ECOSYSTEM_ENV_OPTOUTS: {
+    pnpm: {
+        CI: string;
+        npm_config_progress: string;
+    };
+    npm: {
+        CI: string;
+        npm_config_progress: string;
+    };
+    yarn: {
+        CI: string;
+    };
+    'yarn-berry': {
+        CI: string;
+    };
+    bun: {
+        CI: string;
+    };
+    uv: {
+        UV_NO_PROGRESS: string;
+    };
+    poetry: {
+        POETRY_NO_INTERACTION: string;
+    };
+    'pip-venv': {
+        PIP_DISABLE_PIP_VERSION_CHECK: string;
+    };
+    cargo: {
+        CARGO_TERM_PROGRESS_WHEN: string;
+    };
+    go: {
+        GOFLAGS: string;
+    };
+    bundler: {
+        BUNDLE_SILENCE_ROOT_WARNING: string;
+    };
+    composer: {
+        COMPOSER_NO_INTERACTION: string;
+    };
+    gradle: {
+        GRADLE_OPTS: string;
+    };
+};
+//# sourceMappingURL=detached-spawn.d.mts.map

package/dist/cli/install/detached-spawn.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detached-spawn.d.mts","sourceRoot":"","sources":["../../../src/cli/install/detached-spawn.mjs"],"names":[],"mappings":"AAyEA;;;;;GAKG;AACH,iEAHW;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GACnE,MAAM,CAAC,UAAU,CAsB7B;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,yHAZW;IACN,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,MAAM,EAAE,CAAC;IACd,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;CAChC,GACS,MAAM,CAuElB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,iHAXW;IACN,IAAI,EAAE,MAAM,EAAE,CAAC;IACf,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CAC/B,GACS;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,CA2DjE;AA9ND;;;;GAIG;AACH;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAcC"}

package/dist/cli/install/detached-spawn.mjs

@@ -0,0 +1,245 @@
+/**
+ * install/detached-spawn.mjs — detached child + env isolation (C54 R3).
+ *
+ * Spawns an install child as a DETACHED process so the parent (apt-tools
+ * worktree-install) returns immediately with install_status: "running".
+ * The child survives parent exit because:
+ *   - `detached: true`
+ *   - `stdio: ['ignore', logFd, logFd]` — child inherits the log-file fd
+ *   - `child.unref()` — parent's event loop isn't tied to the child
+ *
+ * **Why not `run_in_background: true` (Claude Code Task tool)?**
+ * Claude-Code-only API. Does not translate through Gemini / Codex /
+ * OpenCode install transforms. C54 is runtime-agnostic — every runtime's
+ * worktree-install invocation goes through this same Node-level detached
+ * spawn primitive.
+ *
+ * Env allowlist (everything else dropped): PATH, LANG, LC_ALL, TMPDIR,
+ * SYSTEMROOT (Windows), plus ecosystem-specific opt-outs. `HOME` is
+ * overridden to a per-task tempdir containing ONLY stubbed configs that
+ * redirect to allowlisted registries. Without this, `~/.npmrc` auth
+ * tokens and `~/.cargo/credentials.toml` leak into postinstall scripts.
+ *
+ * PID heartbeat: caller (worktree-install) writes `install_status: running`,
+ * `install_pid`, `install_started_at` SYNCHRONOUSLY BEFORE calling spawn.
+ * If the child crashes before the parent updates state, the record still
+ * reflects reality and the R6 dead-PID liveness check in `task get`
+ * catches the dangling "running" state.
+ *
+ * Finalize wrapper: we do NOT call the install binary directly. Instead
+ * we write a short shell wrapper that:
+ *   1. runs the install command
+ *   2. captures its exit code
+ *   3. calls `apt-tools worktree-install --finalize ...` with the exit
+ *      code so the parent's final-status write happens regardless of
+ *      success/failure.
+ */
+import { spawn } from 'node:child_process';
+import { chmodSync, closeSync, mkdirSync, openSync, writeFileSync } from 'node:fs';
+import { platform } from 'node:os';
+import { dirname, resolve } from 'node:path';
+/**
+ * Env vars we always carry through (plus ecosystem opt-outs merged in per-call).
+ * Everything NOT in this list is dropped from the child's env.
+ */
+const BASE_ENV_ALLOWLIST = ['PATH', 'LANG', 'LC_ALL', 'LC_CTYPE', 'TMPDIR', 'TMP', 'TEMP'];
+// Windows ships a mix of SYSTEMROOT / SystemRoot / WINDIR that child
+// processes need to boot. Preserve those on Windows only.
+const WINDOWS_ENV_ALLOWLIST = ['SYSTEMROOT', 'SystemRoot', 'WINDIR', 'COMSPEC', 'APPDATA'];
+/**
+ * Ecosystem-specific env opt-outs. Merged into the allowed env per call.
+ * Values intentionally use `CI=1` (not `true`) to sidestep Codex envvar
+ * transforms that flatten boolean string values inconsistently.
+ */
+export const ECOSYSTEM_ENV_OPTOUTS = {
+    pnpm: { CI: '1', npm_config_progress: 'false' },
+    npm: { CI: '1', npm_config_progress: 'false' },
+    yarn: { CI: '1' },
+    'yarn-berry': { CI: '1' },
+    bun: { CI: '1' },
+    uv: { UV_NO_PROGRESS: '1' },
+    poetry: { POETRY_NO_INTERACTION: '1' },
+    'pip-venv': { PIP_DISABLE_PIP_VERSION_CHECK: '1' },
+    cargo: { CARGO_TERM_PROGRESS_WHEN: 'never' },
+    go: { GOFLAGS: '-mod=readonly' },
+    bundler: { BUNDLE_SILENCE_ROOT_WARNING: '1' },
+    composer: { COMPOSER_NO_INTERACTION: '1' },
+    gradle: { GRADLE_OPTS: '-Dorg.gradle.daemon=false' },
+};
+/**
+ * Build the child env from allowlist + ecosystem opt-outs + HOME override.
+ *
+ * @param {{ ecosystem: string, homeDir: string, parentEnv?: NodeJS.ProcessEnv }} opts
+ * @returns {NodeJS.ProcessEnv}
+ */
+export function buildChildEnv({ ecosystem, homeDir, parentEnv = process.env }) {
+    const env = {};
+    const allowlist = [...BASE_ENV_ALLOWLIST];
+    if (platform() === 'win32')
+        allowlist.push(...WINDOWS_ENV_ALLOWLIST);
+    for (const key of allowlist) {
+        if (parentEnv[key] !== undefined)
+            env[key] = parentEnv[key];
+    }
+    // HOME is mandatory — install scripts need to write to ~/.cache etc.
+    // Point at the per-task stubbed home so user credentials don't leak.
+    env.HOME = homeDir;
+    // Ecosystem-specific opt-outs.
+    const optouts = ECOSYSTEM_ENV_OPTOUTS[ecosystem] || {};
+    for (const [k, v] of Object.entries(optouts)) {
+        env[k] = v;
+    }
+    return env;
+}
+/**
+ * Write the finalize wrapper shell script. The script runs the install
+ * command, captures its exit code, and invokes
+ * `apt-tools worktree-install --finalize` so the final status lands on
+ * state.json whether the install succeeds or fails.
+ *
+ * Shell choice:
+ *   - POSIX (macOS/Linux): /bin/sh — minimal dependencies
+ *   - Windows: .cmd file, invoked via cmd.exe — pure detached-spawn on
+ *     Windows is more fragile; we degrade gracefully by still capturing
+ *     the exit code + calling --finalize.
+ *
+ * @param {{
+ *   scriptPath: string,
+ *   cwd: string,
+ *   cmd: string[],
+ *   aptToolsPath: string,
+ *   taskId: string,
+ *   ecosystem: string,
+ *   projectDir: string,
+ *   shellWrapper?: string[] | null,
+ * }} opts
+ * @returns {string} path of the written script
+ */
+export function writeWrapperScript({ scriptPath, cwd, cmd, aptToolsPath, taskId, ecosystem, projectDir, shellWrapper, }) {
+    const isWin = platform() === 'win32';
+    // Escape single quotes for POSIX shell: ' → '\''
+    const esc = (s) => String(s).replace(/'/g, `'\\''`);
+    // For the wrapper we need the cmd as a single space-joined string.
+    // Either use the ecosystem's shell_wrapper (pip-venv) or join argv.
+    const install = shellWrapper && Array.isArray(shellWrapper) && shellWrapper.length > 0
+        ? shellWrapper.join(' && ')
+        : cmd.map((c) => `'${esc(c)}'`).join(' ');
+    if (isWin) {
+        // Minimal cmd.exe wrapper — quoted with double quotes.
+        // Guard `cd /d "…"` so a missing-cwd failure doesn't run the install
+        // command in the caller's CWD (which on Windows is typically
+        // `C:\Windows\System32` for detached children — a confused-deputy
+        // hazard). We still fall through to `--finalize` so state.json is
+        // updated with exit=1 rather than the task wedging in "running".
+        const winLines = [
+            '@echo off',
+            'setlocal',
+            'set INSTALL_EXIT=0',
+            `cd /d "${cwd}" || (set INSTALL_EXIT=1 && goto FINALIZE)`,
+            install,
+            'set INSTALL_EXIT=%ERRORLEVEL%',
+            ':FINALIZE',
+            `"${process.execPath}" "${aptToolsPath}" worktree-install "${projectDir}" --finalize --task "${taskId}" --ecosystem "${ecosystem}" --exit-code %INSTALL_EXIT%`,
+            'exit /b %INSTALL_EXIT%',
+        ];
+        writeFileSync(scriptPath, winLines.join('\r\n'), { mode: 0o755 });
+    }
+    else {
+        // `cd '…'` failure check — do NOT run the install command in the
+        // parent's cwd if the worktree dir was removed between `worktree create`
+        // and the detached child starting up. Without this guard, `pnpm install`
+        // would install into whatever happened to be inherited as the cwd
+        // (typically `/` or the parent's launch dir — a confused-deputy hazard).
+        // We still fall through to the --finalize call so state.json is updated
+        // with exit=1 rather than the task wedging in "running".
+        const posixLines = [
+            '#!/bin/sh',
+            'set +e',
+            'INSTALL_EXIT=0',
+            `if cd '${esc(cwd)}'; then`,
+            `  ${install}`,
+            '  INSTALL_EXIT=$?',
+            'else',
+            '  INSTALL_EXIT=1',
+            'fi',
+            `'${esc(process.execPath)}' '${esc(aptToolsPath)}' worktree-install '${esc(projectDir)}' --finalize --task '${esc(taskId)}' --ecosystem '${esc(ecosystem)}' --exit-code "$INSTALL_EXIT"`,
+            'exit $INSTALL_EXIT',
+        ];
+        writeFileSync(scriptPath, posixLines.join('\n'), { mode: 0o755 });
+    }
+    // Ensure +x on POSIX even if mkdir-based umask ate the mode bit.
+    try {
+        chmodSync(scriptPath, 0o755);
+    }
+    catch {
+        /* best-effort on Windows */
+    }
+    return scriptPath;
+}
+/**
+ * Spawn the detached install child. Returns synchronously with the child's
+ * pid + start timestamp. The caller MUST have already:
+ *   1. Validated homeDir is a per-task tempdir (not the user's real HOME).
+ *   2. Run the manifest-scanner and confirmed ok === true.
+ *   3. Acquired a semaphore slot (or marked the install queued).
+ *   4. Written install_status: "running", install_pid: null,
+ *      install_started_at, install_log_path to state.json.
+ * This function then spawns and the caller updates state with the real pid.
+ *
+ * @param {{
+ *   argv: string[],               // ignored when wrapperPath is set
+ *   cwd: string,
+ *   logPath: string,
+ *   homeDir: string,
+ *   ecosystem: string,
+ *   wrapperPath: string,          // path to the finalize wrapper script
+ *   parentEnv?: NodeJS.ProcessEnv,
+ * }} opts
+ * @returns {{ pid: number, started_at: string, log_path: string }}
+ */
+export function spawnDetachedInstall({ argv: _argv, cwd, logPath, homeDir, ecosystem, wrapperPath, parentEnv = process.env, }) {
+    // Defense in depth: homeDir MUST be inside .aperant/tasks/... to prevent
+    // accidental use of the caller's real HOME.
+    const absHome = resolve(homeDir);
+    if (!/\.aperant[\\/]tasks[\\/]/.test(absHome)) {
+        throw new Error(`detached-spawn: homeDir must live inside .aperant/tasks/<id>/install/home; got ${absHome}`);
+    }
+    if (!wrapperPath) {
+        throw new Error('detached-spawn: wrapperPath is required (writeWrapperScript first)');
+    }
+    // Ensure the log's parent directory exists; openSync fails otherwise.
+    try {
+        mkdirSync(dirname(logPath), { recursive: true });
+    }
+    catch {
+        // Fall through — let openSync surface the real error if it persists.
+    }
+    const logFd = openSync(logPath, 'a');
+    const env = buildChildEnv({ ecosystem, homeDir: absHome, parentEnv });
+    // On Windows detached processes need `shell: true` when the exec is
+    // a .cmd file. POSIX can exec the #!/bin/sh shebang directly.
+    const isWin = platform() === 'win32';
+    const spawnOpts = {
+        cwd,
+        detached: true,
+        stdio: ['ignore', logFd, logFd],
+        env,
+        shell: isWin,
+    };
+    const child = spawn(wrapperPath, [], spawnOpts);
+    const pid = child.pid;
+    child.unref();
+    // Close the parent's fd — the child has its own copy.
+    try {
+        closeSync(logFd);
+    }
+    catch {
+        /* already closed */
+    }
+    return {
+        pid: typeof pid === 'number' ? pid : -1,
+        started_at: new Date().toISOString(),
+        log_path: logPath,
+    };
+}
+//# sourceMappingURL=detached-spawn.mjs.map

package/dist/cli/install/detached-spawn.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"detached-spawn.mjs","sourceRoot":"","sources":["../../../src/cli/install/detached-spawn.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AAEH,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,SAAS,CAAA;AAClF,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAA;AAClC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAA;AAE5C;;;GAGG;AACH,MAAM,kBAAkB,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,UAAU,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,CAAA;AAE1F,qEAAqE;AACrE,0DAA0D;AAC1D,MAAM,qBAAqB,GAAG,CAAC,YAAY,EAAE,YAAY,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,CAAC,CAAA;AAE1F;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG;IACpC,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE;IAC/C,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE,mBAAmB,EAAE,OAAO,EAAE;IAC9C,IAAI,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;IACjB,YAAY,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;IACzB,GAAG,EAAE,EAAE,EAAE,EAAE,GAAG,EAAE;IAChB,EAAE,EAAE,EAAE,cAAc,EAAE,GAAG,EAAE;IAC3B,MAAM,EAAE,EAAE,qBAAqB,EAAE,GAAG,EAAE;IACtC,UAAU,EAAE,EAAE,6BAA6B,EAAE,GAAG,EAAE;IAClD,KAAK,EAAE,EAAE,wBAAwB,EAAE,OAAO,EAAE;IAC5C,EAAE,EAAE,EAAE,OAAO,EAAE,eAAe,EAAE;IAChC,OAAO,EAAE,EAAE,2BAA2B,EAAE,GAAG,EAAE;IAC7C,QAAQ,EAAE,EAAE,uBAAuB,EAAE,GAAG,EAAE;IAC1C,MAAM,EAAE,EAAE,WAAW,EAAE,2BAA2B,EAAE;CACpD,CAAA;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,SAAS,GAAG,OAAO,CAAC,GAAG,EAAE;IAC5E,MAAM,GAAG,GAAG,EAAE,CAAA;IACd,MAAM,SAAS,GAAG,CAAC,GAAG,kBAAkB,CAAC,CAAA;IACzC,IAAI,QAAQ,EAAE,KAAK,OAAO;QAAE,SAAS,CAAC,IAAI,CAAC,GAAG,qBAAqB,CAAC,CAAA;IAEpE,KAAK,MAAM,GAAG,IAAI,SAAS,EAAE,CAAC;QAC7B,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,SAAS;YAAE,GAAG,CAAC,GAAG,CAAC,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5D,CAAC;IAED,qEAAqE;IACrE,qEAAqE;IACrE,GAAG,CAAC,IAAI,GAAG,OAAO,CAAA;IAElB,+BAA+B;IAC/B,MAAM,OAAO,GAAG,qBAAqB,CAAC,SAAS,CAAC,IAAI,EAAE,CAAA;IACtD,KAAK,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9C,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAA;IACX,CAAC;IAED,OAAO,GAAG,CAAA;AACX,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,MAAM,UAAU,kBAAkB,CAAC,EAClC,UAAU,EACV,GAAG,EACH,GAAG,EACH,YAAY,EACZ,MAAM,EACN,SAAS,EACT,UAAU,EACV,YAAY,GACZ;IACA,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,OAAO,CAAA;IACpC,iDAAiD;IACjD,MAAM,GAAG,GAAG,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IACnD,mEAAmE;IACnE,oEAAoE;IACpE,MAAM,OAAO,GACZ,YAAY,IAAI,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,IAAI,YAAY,CAAC,MAAM,GAAG,CAAC;QACrE,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,MAAM,CAAC;QAC3B,CAAC,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAE3C,IAAI,KAAK,EAAE,CAAC;QACX,uDAAuD;QACvD,qEAAqE;QACrE,6DAA6D;QAC7D,kEAAkE;QAClE,kEAAkE;QAClE,iEAAiE;QACjE,MAAM,QAAQ,GAAG;YAChB,WAAW;YACX,UAAU;YACV,oBAAoB;YACpB,UAAU,GAAG,4CAA4C;YACzD,OAAO;YACP,+BAA+B;YAC/B,WAAW;YACX,IAAI,OAAO,CAAC,QAAQ,MAAM,YAAY,uBAAuB,UAAU,wBAAwB,MAAM,kBAAkB,SAAS,8BAA8B;YAC9J,wBAAwB;SACxB,CAAA;QACD,aAAa,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAClE,CAAC;SAAM,CAAC;QACP,iEAAiE;QACjE,yEAAyE;QACzE,yEAAyE;QACzE,kEAAkE;QAClE,yEAAyE;QACzE,wEAAwE;QACxE,yDAAyD;QACzD,MAAM,UAAU,GAAG;YAClB,WAAW;YACX,QAAQ;YACR,gBAAgB;YAChB,UAAU,GAAG,CAAC,GAAG,CAAC,SAAS;YAC3B,KAAK,OAAO,EAAE;YACd,mBAAmB;YACnB,MAAM;YACN,kBAAkB;YAClB,IAAI;YACJ,IAAI,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,YAAY,CAAC,uBAAuB,GAAG,CAAC,UAAU,CAAC,wBAAwB,GAAG,CAAC,MAAM,CAAC,kBAAkB,GAAG,CAAC,SAAS,CAAC,+BAA+B;YACxL,oBAAoB;SACpB,CAAA;QACD,aAAa,CAAC,UAAU,EAAE,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;IAClE,CAAC;IACD,iEAAiE;IACjE,IAAI,CAAC;QACJ,SAAS,CAAC,UAAU,EAAE,KAAK,CAAC,CAAA;IAC7B,CAAC;IAAC,MAAM,CAAC;QACR,4BAA4B;IAC7B,CAAC;IACD,OAAO,UAAU,CAAA;AAClB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,oBAAoB,CAAC,EACpC,IAAI,EAAE,KAAK,EACX,GAAG,EACH,OAAO,EACP,OAAO,EACP,SAAS,EACT,WAAW,EACX,SAAS,GAAG,OAAO,CAAC,GAAG,GACvB;IACA,yEAAyE;IACzE,4CAA4C;IAC5C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAChC,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,KAAK,CACd,kFAAkF,OAAO,EAAE,CAC3F,CAAA;IACF,CAAC;IACD,IAAI,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;IACtF,CAAC;IACD,sEAAsE;IACtE,IAAI,CAAC;QACJ,SAAS,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAA;IACjD,CAAC;IAAC,MAAM,CAAC;QACR,qEAAqE;IACtE,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAA;IACpC,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,SAAS,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,CAAA;IAErE,oEAAoE;IACpE,8DAA8D;IAC9D,MAAM,KAAK,GAAG,QAAQ,EAAE,KAAK,OAAO,CAAA;IACpC,MAAM,SAAS,GAAG;QACjB,GAAG;QACH,QAAQ,EAAE,IAAI;QACd,KAAK,EAAE,CAAC,QAAQ,EAAE,KAAK,EAAE,KAAK,CAAC;QAC/B,GAAG;QACH,KAAK,EAAE,KAAK;KACZ,CAAA;IAED,MAAM,KAAK,GAAG,KAAK,CAAC,WAAW,EAAE,EAAE,EAAE,SAAS,CAAC,CAAA;IAC/C,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAA;IACrB,KAAK,CAAC,KAAK,EAAE,CAAA;IAEb,sDAAsD;IACtD,IAAI,CAAC;QACJ,SAAS,CAAC,KAAK,CAAC,CAAA;IACjB,CAAC;IAAC,MAAM,CAAC;QACR,oBAAoB;IACrB,CAAC;IAED,OAAO;QACN,GAAG,EAAE,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;QACvC,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACpC,QAAQ,EAAE,OAAO;KACjB,CAAA;AACF,CAAC"}

package/dist/cli/install/ecosystem-commands.d.mts

@@ -0,0 +1,42 @@
+/**
+ * Look up the canonical install command for an ecosystem. Returns null for
+ * unknown ecosystems — callers decide whether to skip or fail.
+ *
+ * @param {string} ecosystem
+ * @returns {EcosystemCommand | null}
+ */
+export function getInstallCommand(ecosystem: string): EcosystemCommand | null;
+/**
+ * List every supported ecosystem name.
+ *
+ * @returns {string[]}
+ */
+export function listSupportedEcosystems(): string[];
+/**
+ * @type {Record<string, EcosystemCommand>}
+ */
+export const ECOSYSTEM_COMMANDS: Record<string, EcosystemCommand>;
+export type EcosystemCommand = {
+    /**
+     * argv (cmd[0] is exec)
+     */
+    cmd: string[];
+    /**
+     * per-install timeout (5min default)
+     */
+    timeout_ms: number;
+    /**
+     * true ⇒ fail if lockfile missing
+     */
+    needs_lockfile: boolean;
+    /**
+     * true ⇒ needs registry access
+     */
+    requires_network: boolean;
+    /**
+     * optional: compose in a wrapper
+     *    script (pip-venv is the only user)
+     */
+    shell_wrapper?: string[] | undefined;
+};
+//# sourceMappingURL=ecosystem-commands.d.mts.map

package/dist/cli/install/ecosystem-commands.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecosystem-commands.d.mts","sourceRoot":"","sources":["../../../src/cli/install/ecosystem-commands.mjs"],"names":[],"mappings":"AAiIA;;;;;;GAMG;AACH,6CAHW,MAAM,GACJ,gBAAgB,GAAG,IAAI,CAenC;AAED;;;;GAIG;AACH,2CAFa,MAAM,EAAE,CAIpB;AAvHD;;GAEG;AACH,iCAFU,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAuFzC;;;;;SAlGa,MAAM,EAAE;;;;gBACR,MAAM;;;;oBACN,OAAO;;;;sBACP,OAAO"}

package/dist/cli/install/ecosystem-commands.mjs

@@ -0,0 +1,157 @@
+/**
+ * install/ecosystem-commands.mjs — canonical install command per ecosystem (C54 R4).
+ *
+ * Every entry is a declarative {cmd, timeout_ms, needs_lockfile, requires_network}
+ * record. `cmd` is an argv array (exec + args) — the detached-spawn helper
+ * passes `cmd[0]` to `child_process.spawn` as the executable and
+ * `cmd.slice(1)` as the argv.
+ *
+ * Design rules baked into the table:
+ *   - Use the ECOSYSTEM'S native frozen-install flag. We do NOT try to
+ *     invent a cross-ecosystem "safe install" flag matrix — security in C54
+ *     comes from env isolation + URL allowlist, not from flag stripping.
+ *   - `cargo fetch --locked` only, NEVER `cargo build`. build.rs is
+ *     arbitrary exec; that's deferred to the verify stage.
+ *   - `gradle --no-daemon` is mandatory for our invocation. Parallel
+ *     worktrees would otherwise deadlock on the daemon lock file. Users
+ *     can keep their daemon for interactive work; we don't kill it.
+ *   - `pip-venv` is a two-step wrapper (create venv, then pip install).
+ *     The detached-spawn wrapper script composes the two shell calls.
+ *
+ * Consumer pattern:
+ *
+ *     import { getInstallCommand } from '.../ecosystem-commands.mjs'
+ *     const entry = getInstallCommand('pnpm')
+ *     // entry.cmd === ['pnpm', 'install', '--frozen-lockfile']
+ */
+/**
+ * @typedef {Object} EcosystemCommand
+ * @property {string[]} cmd               argv (cmd[0] is exec)
+ * @property {number} timeout_ms          per-install timeout (5min default)
+ * @property {boolean} needs_lockfile     true ⇒ fail if lockfile missing
+ * @property {boolean} requires_network   true ⇒ needs registry access
+ * @property {string[]} [shell_wrapper]   optional: compose in a wrapper
+ *                                        script (pip-venv is the only user)
+ */
+const DEFAULT_TIMEOUT_MS = 300_000; // 5 minutes per ecosystem (per spec R1.5)
+/**
+ * @type {Record<string, EcosystemCommand>}
+ */
+export const ECOSYSTEM_COMMANDS = {
+    pnpm: {
+        cmd: ['pnpm', 'install', '--frozen-lockfile'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: true,
+        requires_network: true,
+    },
+    npm: {
+        cmd: ['npm', 'ci'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: true,
+        requires_network: true,
+    },
+    yarn: {
+        cmd: ['yarn', 'install', '--frozen-lockfile'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: true,
+        requires_network: true,
+    },
+    'yarn-berry': {
+        cmd: ['yarn', 'install', '--immutable'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: true,
+        requires_network: true,
+    },
+    bun: {
+        cmd: ['bun', 'install', '--frozen-lockfile'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: true,
+        requires_network: true,
+    },
+    uv: {
+        cmd: ['uv', 'sync', '--frozen'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: false, // uv can resolve from pyproject.toml without uv.lock
+        requires_network: true,
+    },
+    poetry: {
+        cmd: ['poetry', 'install', '--no-root', '--sync'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: false,
+        requires_network: true,
+    },
+    'pip-venv': {
+        // Two-step wrapper: (a) python -m venv .venv (b) .venv/bin/pip install -r requirements.txt
+        // detached-spawn composes these as `<venv-cmd> && <pip-cmd>` inside its wrapper
+        // script. The `cmd` here is the literal shell commands that the wrapper evaluates.
+        cmd: ['python', '-m', 'venv', '.venv'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: false,
+        requires_network: true,
+        shell_wrapper: ['python -m venv .venv', '.venv/bin/pip install -r requirements.txt'],
+    },
+    cargo: {
+        // NEVER `cargo build` — build.rs is arbitrary exec, deferred to verify stage.
+        cmd: ['cargo', 'fetch', '--locked'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: true,
+        requires_network: true,
+    },
+    go: {
+        cmd: ['go', 'mod', 'download'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: false, // go.sum is a checksum file, not the source of truth
+        requires_network: true,
+    },
+    bundler: {
+        cmd: ['bundle', 'install', '--jobs', '4', '--retry', '3'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: false, // bundler can resolve without Gemfile.lock
+        requires_network: true,
+    },
+    composer: {
+        cmd: ['composer', 'install', '--no-interaction', '--prefer-dist'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: false,
+        requires_network: true,
+    },
+    gradle: {
+        // --no-daemon mandatory: parallel worktrees deadlock on the daemon lock.
+        cmd: ['./gradlew', '--no-daemon', 'dependencies'],
+        timeout_ms: DEFAULT_TIMEOUT_MS,
+        needs_lockfile: false,
+        requires_network: true,
+    },
+};
+/**
+ * Look up the canonical install command for an ecosystem. Returns null for
+ * unknown ecosystems — callers decide whether to skip or fail.
+ *
+ * @param {string} ecosystem
+ * @returns {EcosystemCommand | null}
+ */
+export function getInstallCommand(ecosystem) {
+    if (!ecosystem || typeof ecosystem !== 'string')
+        return null;
+    const entry = ECOSYSTEM_COMMANDS[ecosystem];
+    if (!entry)
+        return null;
+    // Return a shallow copy so callers can mutate (e.g. timeout override)
+    // without leaking back into the registry.
+    return {
+        cmd: [...entry.cmd],
+        timeout_ms: entry.timeout_ms,
+        needs_lockfile: entry.needs_lockfile,
+        requires_network: entry.requires_network,
+        ...(entry.shell_wrapper ? { shell_wrapper: [...entry.shell_wrapper] } : {}),
+    };
+}
+/**
+ * List every supported ecosystem name.
+ *
+ * @returns {string[]}
+ */
+export function listSupportedEcosystems() {
+    return Object.keys(ECOSYSTEM_COMMANDS);
+}
+//# sourceMappingURL=ecosystem-commands.mjs.map

package/dist/cli/install/ecosystem-commands.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"ecosystem-commands.mjs","sourceRoot":"","sources":["../../../src/cli/install/ecosystem-commands.mjs"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH;;;;;;;;GAQG;AAEH,MAAM,kBAAkB,GAAG,OAAO,CAAA,CAAC,0CAA0C;AAE7E;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG;IACjC,IAAI,EAAE;QACL,GAAG,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC;QAC7C,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,IAAI;QACpB,gBAAgB,EAAE,IAAI;KACtB;IACD,GAAG,EAAE;QACJ,GAAG,EAAE,CAAC,KAAK,EAAE,IAAI,CAAC;QAClB,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,IAAI;QACpB,gBAAgB,EAAE,IAAI;KACtB;IACD,IAAI,EAAE;QACL,GAAG,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,mBAAmB,CAAC;QAC7C,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,IAAI;QACpB,gBAAgB,EAAE,IAAI;KACtB;IACD,YAAY,EAAE;QACb,GAAG,EAAE,CAAC,MAAM,EAAE,SAAS,EAAE,aAAa,CAAC;QACvC,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,IAAI;QACpB,gBAAgB,EAAE,IAAI;KACtB;IACD,GAAG,EAAE;QACJ,GAAG,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,mBAAmB,CAAC;QAC5C,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,IAAI;QACpB,gBAAgB,EAAE,IAAI;KACtB;IACD,EAAE,EAAE;QACH,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,UAAU,CAAC;QAC/B,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,KAAK,EAAE,qDAAqD;QAC5E,gBAAgB,EAAE,IAAI;KACtB;IACD,MAAM,EAAE;QACP,GAAG,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,CAAC;QACjD,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,IAAI;KACtB;IACD,UAAU,EAAE;QACX,2FAA2F;QAC3F,gFAAgF;QAChF,mFAAmF;QACnF,GAAG,EAAE,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,CAAC;QACtC,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,IAAI;QACtB,aAAa,EAAE,CAAC,sBAAsB,EAAE,2CAA2C,CAAC;KACpF;IACD,KAAK,EAAE;QACN,8EAA8E;QAC9E,GAAG,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,UAAU,CAAC;QACnC,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,IAAI;QACpB,gBAAgB,EAAE,IAAI;KACtB;IACD,EAAE,EAAE;QACH,GAAG,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,UAAU,CAAC;QAC9B,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,KAAK,EAAE,qDAAqD;QAC5E,gBAAgB,EAAE,IAAI;KACtB;IACD,OAAO,EAAE;QACR,GAAG,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,GAAG,EAAE,SAAS,EAAE,GAAG,CAAC;QACzD,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,KAAK,EAAE,2CAA2C;QAClE,gBAAgB,EAAE,IAAI;KACtB;IACD,QAAQ,EAAE;QACT,GAAG,EAAE,CAAC,UAAU,EAAE,SAAS,EAAE,kBAAkB,EAAE,eAAe,CAAC;QACjE,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,IAAI;KACtB;IACD,MAAM,EAAE;QACP,yEAAyE;QACzE,GAAG,EAAE,CAAC,WAAW,EAAE,aAAa,EAAE,cAAc,CAAC;QACjD,UAAU,EAAE,kBAAkB;QAC9B,cAAc,EAAE,KAAK;QACrB,gBAAgB,EAAE,IAAI;KACtB;CACD,CAAA;AAED;;;;;;GAMG;AACH,MAAM,UAAU,iBAAiB,CAAC,SAAS;IAC1C,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAA;IAC5D,MAAM,KAAK,GAAG,kBAAkB,CAAC,SAAS,CAAC,CAAA;IAC3C,IAAI,CAAC,KAAK;QAAE,OAAO,IAAI,CAAA;IACvB,sEAAsE;IACtE,0CAA0C;IAC1C,OAAO;QACN,GAAG,EAAE,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC;QACnB,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,cAAc,EAAE,KAAK,CAAC,cAAc;QACpC,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;QACxC,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,aAAa,EAAE,CAAC,GAAG,KAAK,CAAC,aAAa,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KAC3E,CAAA;AACF,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,uBAAuB;IACtC,OAAO,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAA;AACvC,CAAC"}