@atbash/cli 0.6.0-dev.1 → 0.6.1-dev.2

package/dist/shared/openclaw-runtime.js

@@ -0,0 +1,476 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.detectChannel = detectChannel;
+exports.updateCommand = updateCommand;
+exports.detectOpenclaw = detectOpenclaw;
+exports.writeStrategy = writeStrategy;
+exports.supportStatus = supportStatus;
+exports.verifyOpenclawPlugin = verifyOpenclawPlugin;
+exports.pluginEntryAcceptsHooks = pluginEntryAcceptsHooks;
+exports.validateConfig = validateConfig;
+/**
+ * What the OpenClaw on THIS machine actually is, and what it can actually do.
+ *
+ * WHY THIS MODULE EXISTS — it is the fix for a whole class of bug, not one bug.
+ *
+ * `atbash setup` used to assert OpenClaw's shape from a single machine we happened
+ * to have installed. It hardcoded `~/.openclaw/extensions/<id>` as the plugin
+ * store and wrote that path into `plugins.load.paths`. On the box it was written
+ * against — 2026.2.1, brew formula — that was correct. On a fresh 2026.6.6 it is
+ * a path OpenClaw never creates, and a `load.paths` entry naming a missing
+ * directory fails the ENTIRE config, which then takes down the
+ * `openclaw plugins install` in the same run. The command broke its own install
+ * step and left behind a dangling entry that `openclaw doctor --fix` offers to
+ * delete — silently un-governing the agent.
+ *
+ * The lesson is not "update the hardcoded path". It is that we cannot know what
+ * OpenClaw a user has:
+ *
+ *   - It ships on at least three channels, each on its own version number. When
+ *     this was written: brew formula `openclaw-cli` 2026.7.1, brew cask
+ *     `openclaw` 2026.8.1, npm-global 2026.8.2, plus an npm `extended-stable`
+ *     tag on a fourth number. "The latest OpenClaw" does not identify a build.
+ *   - It moved its plugin store twice in six months, and the migration is
+ *     destructive (`plugins/installs.json` → `installs.json.migrated`).
+ *   - Keys change meaning: `plugins.allow` was repurposed to gate bundled
+ *     provider discovery; `plugins.entries.<id>.hooks` went from a FATAL unknown
+ *     key on 2026.2.1 to a valid one on 2026.6.6.
+ *
+ * So: ASK, never assume. Everything here is probed from the binary on the box,
+ * and version numbers are used for REPORTING, not for deciding. Capability
+ * detection is what makes a range of versions supportable instead of one —
+ * comparing version strings is how you end up shipping a table that goes stale
+ * the next time OpenClaw releases.
+ */
+const child_process_1 = require("child_process");
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const win_exec_1 = require("./win-exec");
+const NO_CAPS = { patch: false, validate: false, schema: false, configFile: false };
+/** Bounded probe of a command. Never throws; a missing binary is a normal answer. */
+function probe(command, args) {
+    const r = (0, win_exec_1.spawnPortable)(command, args, { encoding: "utf8", timeout: 20000 });
+    const out = `${r.stdout ?? ""}${r.stderr ?? ""}`;
+    return { ok: !r.error && r.status === 0, out };
+}
+/**
+ * Where the `openclaw` on PATH came from.
+ *
+ * Path-based rather than asked of a package manager, because shelling out to
+ * brew and npm to answer a question we can read off a path is slow and can hang
+ * on a bad network — and this runs before we have written anything, where a
+ * hang looks like the command being broken.
+ *
+ * ⚠️ The npm case is not hypothetical or unusual: the machine that reported the
+ * original failure ran `/Users/m4/.nvm/versions/node/v24.13.0/bin/openclaw`,
+ * so `brew info openclaw-cli` there said "Not installed" while OpenClaw was
+ * plainly running. Telling that user `brew upgrade openclaw-cli` would have been
+ * useless, which is the whole reason this returns a channel at all.
+ */
+function detectChannel(binPath) {
+    if (!binPath)
+        return "unknown";
+    const p = binPath.replace(/\\/g, "/");
+    // Follows the formula's Cellar layout, and the /opt/homebrew symlink to it.
+    if (/\/Cellar\/openclaw-cli\//.test(p) || /\/(opt\/homebrew|usr\/local)\/(bin|Cellar)\//.test(p))
+        return "brew-formula";
+    if (/\/Applications\/OpenClaw\.app\//.test(p))
+        return "brew-cask";
+    // nvm, fnm, volta, asdf and a plain global prefix all land under a node dir or
+    // an npm/lib/node_modules path.
+    if (/\/(\.nvm|\.fnm|\.volta|\.asdf)\//.test(p) || /\/lib\/node_modules\//.test(p) || /\/node\/v?\d/.test(p))
+        return "npm";
+    return "unknown";
+}
+/**
+ * The command that updates THIS install, or undefined when we cannot tell.
+ *
+ * Returning undefined is deliberate and better than a plausible guess: a user
+ * told to run `brew upgrade openclaw-cli` on an npm install gets "No available
+ * formula", concludes our instructions are wrong, and is no closer to an
+ * upgrade. `openclaw update` is the honest fallback where the channel is
+ * unknown — it is OpenClaw's own self-updater, and 2026.6.6's `doctor` already
+ * recommends exactly that ("Run `openclaw update` to update via your package
+ * manager (npm/pnpm)").
+ */
+function updateCommand(channel) {
+    switch (channel) {
+        case "brew-formula":
+            return "brew upgrade openclaw-cli";
+        case "brew-cask":
+            return "brew upgrade --cask openclaw";
+        case "npm":
+            return "openclaw update";
+        default:
+            return "openclaw update";
+    }
+}
+/**
+ * Parse the subcommand list out of `openclaw config --help`.
+ *
+ * Reads the two-space-indented `  <name>  <description>` rows commander prints
+ * under `Commands:`. A capability we cannot see is reported as absent, which is
+ * the safe direction: we fall back to the path that works everywhere rather than
+ * invoking a subcommand that exits "unknown command" mid-run.
+ */
+function parseConfigCaps(help) {
+    const lines = help.split(/\r?\n/);
+    // Only the `Commands:` section. `Options:` lists flags, and the trailing
+    // `Docs:` line is prose — neither describes a subcommand.
+    const start = lines.findIndex((l) => /^\s*Commands:\s*$/.test(l));
+    const section = start === -1 ? lines : lines.slice(start + 1);
+    const names = new Set(section
+        // EXACTLY two spaces of indent. Commander puts subcommand names at 2 and
+        // wraps long descriptions much deeper, and 2026.7.1's `config --help` is
+        // full of those continuations — `patch` and `set` each carry several lines
+        // of examples like "openclaw config patch --stdin". A looser `^ {2,}`
+        // could read a wrapped line as a subcommand and invent a capability that
+        // does not exist, which then gets invoked mid-run and exits "unknown
+        // command" after earlier steps have already written.
+        .map((line) => /^ {2}(?! )([a-z][a-z-]*)\s{2,}\S/.exec(line)?.[1])
+        .filter((n) => Boolean(n)));
+    return {
+        patch: names.has("patch"),
+        validate: names.has("validate"),
+        schema: names.has("schema"),
+        configFile: names.has("file"),
+    };
+}
+/**
+ * The version out of `openclaw --version`, in either format OpenClaw has used.
+ *
+ * ⚠️ THE OUTPUT FORMAT CHANGED TOO, and this function's first version only
+ * handled the newer one — the exact mistake this module exists to prevent,
+ * committed inside the module itself. Caught only by running a real old binary:
+ *
+ *   2026.2.1  →  "2026.2.1\n"                  (bare, verified with od -c)
+ *   2026.7.1  →  "OpenClaw 2026.7.1 (2d2ddc4)"
+ *
+ * A regex anchored on the word "OpenClaw" returned undefined for every 2026.2.x
+ * machine. Behavior did not break — capabilities drive every decision here, which
+ * is the point of the design — but the operator lost the version from the message
+ * that tells them what was detected, and any future version-dependent reporting
+ * would have silently had nothing to work with.
+ *
+ * Neither format can be assumed, so try the labelled form first and fall back to
+ * a line that is nothing but a version. Both are matched by PATTERN rather than
+ * by line position: a loaded Atbash plugin prints `[atbash] plugin loaded` and
+ * `guard manager ready …` ahead of anything else on stdout.
+ */
+function parseVersion(out) {
+    const labelled = /OpenClaw\s+v?(\d[\w.-]*)(?:\s+\(([0-9a-f]{4,})\))?/i.exec(out);
+    if (labelled)
+        return { version: labelled[1], ...(labelled[2] ? { build: labelled[2] } : {}) };
+    // A line holding only a version, e.g. 2026.2.1 — with an optional build hash,
+    // since a future build could print that form too.
+    const bare = /^[ \t]*v?(\d{4}\.\d+[\w.-]*)(?:[ \t]+\(([0-9a-f]{4,})\))?[ \t]*$/m.exec(out);
+    if (bare)
+        return { version: bare[1], ...(bare[2] ? { build: bare[2] } : {}) };
+    return {};
+}
+/**
+ * The openclaw to inspect: an explicit path as given, a bare name off PATH.
+ *
+ * ⚠️ An explicit path must NOT go through `where`/`which`. `--runtime` and the
+ * tests both pass a full path, and `where C:\dir\openclaw.cmd` does not answer
+ * "yes, that file" — `where` takes a NAME to search for, so a path came back as
+ * no match and a caller who had named the binary outright was told none existed.
+ */
+function resolveBinary(binary) {
+    if (path_1.default.isAbsolute(binary) || binary.includes("/") || binary.includes("\\")) {
+        return fs_1.default.existsSync(binary) ? binary : undefined;
+    }
+    const which = (0, child_process_1.spawnSync)(process.platform === "win32" ? "where" : "which", [binary], { encoding: "utf8" });
+    if (which.status !== 0)
+        return undefined;
+    // `where` reports EVERY match, and on Windows npm writes two: the extensionless
+    // Git Bash script first, then the `.cmd` Windows can actually run. Taking line
+    // one picked the unrunnable one — see pickExecutable.
+    return (0, win_exec_1.pickExecutable)((which.stdout ?? "").split(/\r?\n/));
+}
+/**
+ * Inspect the OpenClaw on this machine. Read-only: probes `--version` and
+ * `config --help`, writes nothing, and never throws.
+ */
+function detectOpenclaw(binary = "openclaw") {
+    const binPath = resolveBinary(binary);
+    if (!binPath)
+        return { present: false, channel: "unknown", caps: { ...NO_CAPS } };
+    const channel = detectChannel(binPath);
+    // Probe the RESOLVED path, not the name we were handed: on Windows those are
+    // different files, and only one of them runs.
+    const ver = probe(binPath, ["--version"]);
+    const parsedVersion = parseVersion(ver.out);
+    const help = probe(binPath, ["config", "--help"]);
+    return {
+        present: true,
+        binPath,
+        channel,
+        ...parsedVersion,
+        caps: help.out ? parseConfigCaps(help.out) : { ...NO_CAPS },
+    };
+}
+function writeStrategy(rt) {
+    return rt.caps.patch ? "openclaw-patch" : "hand-merge";
+}
+/**
+ * Whether this OpenClaw is one we can wire at all, and what to say if not.
+ *
+ * DELIBERATELY PERMISSIVE. The floor is "there is an OpenClaw here", not "it has
+ * the newest config commands", because 2026.2.x installs are real — the box every
+ * CLI attestation was verified on is one — and the minimal entry-only config we
+ * now write was confirmed to load there with the plugin reporting
+ * `[atbash] plugin loaded` and `guard manager ready`. Narrowing support to the
+ * versions we happen to run is the mistake that produced this whole module.
+ *
+ * So an older build is a DEGRADED path with an offer, never a refusal: it gets
+ * the hand-merge, and the reason to upgrade is stated once, with the command for
+ * its own channel. Refusal is reserved for "no OpenClaw at all", where there is
+ * genuinely nothing to configure.
+ */
+function supportStatus(rt) {
+    if (!rt.present) {
+        return {
+            supported: false,
+            degraded: false,
+            message: "No OpenClaw found on this machine. Nothing was changed. If this agent runs on a different computer, run this command there instead — the plugin has to be installed where the agent actually runs.",
+        };
+    }
+    const where = rt.version ? `OpenClaw ${rt.version}` : "This OpenClaw";
+    if (writeStrategy(rt) === "openclaw-patch") {
+        return { supported: true, degraded: false, message: `${where} — supported, and OpenClaw will validate the config change itself.` };
+    }
+    return {
+        supported: true,
+        degraded: true,
+        message: `${where} is supported, but it predates OpenClaw's validated config commands (\`config patch\` / \`config validate\`), so Atbash has to edit the config file directly and cannot ask OpenClaw to check it first. Upgrading is optional and makes this step safer.`,
+        upgrade: updateCommand(rt.channel),
+    };
+}
+/**
+ * Parse JSON out of a stream that also carries log lines.
+ *
+ * `openclaw plugins list --json` is clean on stdout, but a loaded plugin prints
+ * its own startup lines — this project's plugin logs `[atbash] plugin loaded` and
+ * `guard manager ready` — and those can interleave. So find the JSON rather than
+ * assuming the output begins with it.
+ */
+function parseLooseJson(text) {
+    for (let start = text.indexOf("{"); start !== -1; start = text.indexOf("{", start + 1)) {
+        // Walk to the matching brace instead of parsing "the rest of the output".
+        //
+        // ⚠️ Slicing to the end and parsing that is what the first version did, and
+        // it failed on real 2026.2.1: its plugin log lines land on the SAME stream
+        // AFTER the JSON object, so `JSON.parse` saw `{…}` followed by
+        // `[plugins] [atbash] plugin loaded` and threw on the trailing text. The
+        // whole verification then reported "unknown" for a plugin that was
+        // demonstrably loaded — a false negative on the one check that says whether
+        // an agent is governed.
+        //
+        // String-aware, because a description field legitimately contains braces:
+        // this project's own plugin describes itself as mapping OpenClaw's hook, and
+        // other plugins embed JSON snippets in their descriptions.
+        let depth = 0;
+        let inString = false;
+        let escaped = false;
+        for (let i = start; i < text.length; i++) {
+            const ch = text[i];
+            if (inString) {
+                if (escaped)
+                    escaped = false;
+                else if (ch === "\\")
+                    escaped = true;
+                else if (ch === '"')
+                    inString = false;
+                continue;
+            }
+            if (ch === '"')
+                inString = true;
+            else if (ch === "{")
+                depth++;
+            else if (ch === "}") {
+                depth--;
+                if (depth === 0) {
+                    try {
+                        return JSON.parse(text.slice(start, i + 1));
+                    }
+                    catch {
+                        break; // this `{` began something that is not JSON; try the next
+                    }
+                }
+            }
+        }
+    }
+    return undefined;
+}
+/**
+ * Ask OpenClaw whether the plugin actually loaded — the check setup never had.
+ *
+ * ⚠️ WHY THIS IS NOT OPTIONAL. Setup used to declare success on the strength of
+ * having written what it meant to write. That is not the same claim: on the
+ * machine that reported the original failure, the config entry existed and the
+ * plugin did not, and OpenClaw said so plainly —
+ *
+ *   plugins.entries.atbash-openclaw: plugin not found: atbash-openclaw
+ *   (stale config entry ignored; remove it from plugins config)
+ *
+ * — while setup reported the run as done. An owner reading that summary believes
+ * their agent is governed. Nothing is more expensive than a false green on a
+ * control boundary, so the last word belongs to OpenClaw, not to us.
+ *
+ * ⚠️ DO NOT check `hookCount` or `hookNames` here. They are 0 and empty for a
+ * perfectly healthy plugin: hooks register when the GATEWAY starts, not when
+ * `plugins list` runs. Verified against a plugin that was demonstrably loaded and
+ * enforcing — it reports `hookCount: 0`. Treating that as a fault would fail
+ * every correct install.
+ */
+function verifyOpenclawPlugin(rt, opts) {
+    const binary = opts.binary ?? "openclaw";
+    if (!rt.present)
+        return { state: "unknown", detail: "OpenClaw is not on this machine." };
+    const r = (0, win_exec_1.spawnPortable)(binary, ["plugins", "list", "--json"], {
+        encoding: "utf8",
+        timeout: 120000,
+        env: {
+            ...process.env,
+            ...(opts.configPath ? { OPENCLAW_CONFIG_PATH: path_1.default.resolve(opts.configPath) } : {}),
+            ...(opts.home ? { HOME: opts.home } : {}),
+        },
+    });
+    if (r.error)
+        return { state: "unknown", detail: `\`${binary} plugins list\` could not run: ${r.error.message}` };
+    const parsed = parseLooseJson(`${r.stdout ?? ""}${r.stderr ?? ""}`);
+    const plugins = parsed?.plugins;
+    // No parseable answer is UNKNOWN, never "missing" — reporting a governed agent
+    // as ungoverned on a parse failure is its own kind of wrong.
+    if (!Array.isArray(plugins)) {
+        return { state: "unknown", detail: `Could not read \`${binary} plugins list --json\` output.` };
+    }
+    const rows = plugins;
+    // Preference order, so a stood-down legacy entry cannot shadow the live one —
+    // the same rule the dashboard scan needs for the same reason.
+    const found = opts.entryIds
+        .map((id) => rows.find((p) => typeof p.id === "string" && p.id === id))
+        .filter((p) => Boolean(p));
+    const row = found.find((p) => p.enabled !== false) ?? found[0];
+    if (!row) {
+        return {
+            state: "missing",
+            detail: `OpenClaw does not list the Atbash plugin (looked for: ${opts.entryIds.join(", ")}). The config may name a plugin that is not installed — OpenClaw calls that a stale entry and \`openclaw doctor --fix\` will delete it.`,
+        };
+    }
+    const entry = typeof row.id === "string" ? row.id : undefined;
+    const version = typeof row.version === "string" ? row.version : undefined;
+    const missing = Array.isArray(row.dependencyStatus?.missing)
+        ? row.dependencyStatus.missing.filter((m) => typeof m === "string")
+        : [];
+    const base = { entry, ...(version ? { version } : {}), ...(missing.length ? { missingDeps: missing } : {}) };
+    if (row.enabled === false) {
+        return { ...base, state: "disabled", detail: "The plugin is installed but switched off in the config, so it governs nothing." };
+    }
+    if (typeof row.status === "string" && row.status !== "loaded") {
+        return { ...base, state: "load-error", detail: `OpenClaw reports its status as "${row.status}" rather than "loaded".` };
+    }
+    // A plugin whose required dependencies are absent loads and then fails at the
+    // moment it matters — the SDK it signs with is one of them.
+    if (row.dependencyStatus?.requiredInstalled === false || missing.length) {
+        return {
+            ...base,
+            state: "load-error",
+            detail: `OpenClaw reports required dependencies missing${missing.length ? `: ${missing.join(", ")}` : ""}. The plugin cannot reach the judge without them.`,
+        };
+    }
+    // Right plugin, wrong build. Loads cleanly, hooks fire, and every judge call
+    // fails because the agent does not exist on the chain that build targets.
+    if (opts.expectedSpec && version) {
+        const wantsDev = /@dev$/.test(opts.expectedSpec);
+        const isDev = /-dev\./.test(version);
+        if (wantsDev !== isDev) {
+            return {
+                ...base,
+                state: "load-error",
+                detail: `The installed build (${version}) does not match the deployment this agent was onboarded on (${opts.expectedSpec}). It will load and fire its hook, then fail every judge call because the agent does not exist on the chain that build targets.`,
+            };
+        }
+    }
+    return { ...base, state: "loaded" };
+}
+/**
+ * Ask OpenClaw whether a config is valid, when it can answer.
+ *
+ * This is the PREFLIGHT the command never had. Setup merged into
+ * `~/.openclaw/openclaw.json` without ever checking whether that file currently
+ * loads — so on a machine whose config was already broken it added its own entry
+ * to an unloadable file, and then its `openclaw plugins install` step died on the
+ * pre-existing breakage. Reported as an Atbash failure; it was not one.
+ *
+ * `undefined` means "cannot tell" (no `validate` on this build) and must be
+ * treated as such — not as a pass and not as a failure.
+ */
+/**
+ * Does THIS build accept `hooks` on a plugin entry?
+ *
+ * Asked of `openclaw config schema`, never inferred from a version number or
+ * correlated with other capabilities — the whole point of this module.
+ *
+ * ⚠️ WHY THIS QUESTION EXISTS. `hooks` was ADDED, not removed: it is unknown on
+ * 2026.2.1 and valid, optional and undeprecated on 2026.6.6 and 2026.7.1, where
+ * an entry accepts `enabled | hooks | subagent | llm | config`. Because the entry
+ * schema is `additionalProperties: false`, the same key is FATAL on the old build
+ * and legitimate on the new one.
+ *
+ * Setup never writes `hooks` — nothing under it is required, and it gates hook
+ * families this plugin does not use (it registers only `before_tool_call`). But
+ * it also used to DELETE an operator's `hooks` block unconditionally, and on a
+ * build that accepts the key that is destroying their configuration:
+ * `hooks.timeoutMs` bounds this plugin's hook latency "without changing plugin
+ * code", which is a deliberate operator choice, not damage to repair.
+ *
+ * `undefined` means "cannot tell" (no `config schema` on this build). The caller
+ * must treat that as NOT supported and strip: keeping an unrecognized key makes
+ * OpenClaw refuse the entire config, and losing a timeout knob is a far smaller
+ * harm than a machine whose config will not load at all.
+ */
+function pluginEntryAcceptsHooks(rt, binary = "openclaw") {
+    if (!rt.present || !rt.caps.schema)
+        return undefined;
+    const r = (0, win_exec_1.spawnPortable)(binary, ["config", "schema"], {
+        encoding: "utf8",
+        timeout: 120000,
+        maxBuffer: 64 * 1024 * 1024, // the schema is a few MB
+    });
+    if (r.error || r.status !== 0)
+        return undefined;
+    const parsed = parseLooseJson(`${r.stdout ?? ""}`);
+    const entry = parsed?.properties?.plugins?.properties?.entries?.additionalProperties?.properties;
+    if (!entry || typeof entry !== "object")
+        return undefined;
+    return Object.prototype.hasOwnProperty.call(entry, "hooks");
+}
+function validateConfig(rt, configPath, binary = "openclaw", 
+/** The home being configured, when not the process's own — see verifyOpenclawPlugin. */
+home) {
+    if (!rt.caps.validate)
+        return undefined;
+    const r = (0, win_exec_1.spawnPortable)(binary, ["config", "validate"], {
+        encoding: "utf8",
+        timeout: 60000,
+        env: { ...process.env, OPENCLAW_CONFIG_PATH: path_1.default.resolve(configPath), ...(home ? { HOME: home } : {}) },
+    });
+    if (r.error)
+        return undefined;
+    const out = `${r.stdout ?? ""}${r.stderr ?? ""}`;
+    // 2026.6.6/2026.7.1 print "Config valid: <path>" on success, and
+    // "OpenClaw config is invalid: <path>" followed by `× <key>: <reason>` lines.
+    const valid = r.status === 0 && /config valid/i.test(out);
+    const problems = out
+        .split(/\r?\n/)
+        .filter((l) => /^\s*[×x✘]\s/.test(l))
+        .map((l) => l.replace(/^\s*[×x✘]\s*/, "").trim())
+        .join("\n");
+    return { valid, problems: problems || (valid ? "" : out.trim()) };
+}
+//# sourceMappingURL=openclaw-runtime.js.map

package/dist/shared/openclaw-runtime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"openclaw-runtime.js","sourceRoot":"","sources":["../../src/shared/openclaw-runtime.ts"],"names":[],"mappings":";;;;;AA4GA,sCAUC;AAaD,sCAWC;AA2FD,wCAkBC;AASD,sCAEC;AAiBD,sCA0BC;AAqGD,oDA0GC;AAsCD,0DAgBC;AAED,wCAwBC;AAhlBD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,iDAA0C;AAC1C,4CAAoB;AACpB,gDAAwB;AACxB,yCAA2D;AAgD3D,MAAM,OAAO,GAAiB,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,CAAC;AAElG,qFAAqF;AACrF,SAAS,KAAK,CAAC,OAAe,EAAE,IAAc;IAC5C,MAAM,CAAC,GAAG,IAAA,wBAAa,EAAC,OAAO,EAAE,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,OAAO,EAAE,KAAM,EAAE,CAAC,CAAC;IAC9E,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACjD,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,GAAG,EAAE,CAAC;AACjD,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAgB,aAAa,CAAC,OAA2B;IACvD,IAAI,CAAC,OAAO;QAAE,OAAO,SAAS,CAAC;IAC/B,MAAM,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IACtC,4EAA4E;IAC5E,IAAI,0BAA0B,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,8CAA8C,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,cAAc,CAAC;IACxH,IAAI,iCAAiC,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,WAAW,CAAC;IAClE,+EAA+E;IAC/E,gCAAgC;IAChC,IAAI,kCAAkC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAC1H,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;GAUG;AACH,SAAgB,aAAa,CAAC,OAAwB;IACpD,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,cAAc;YACjB,OAAO,2BAA2B,CAAC;QACrC,KAAK,WAAW;YACd,OAAO,8BAA8B,CAAC;QACxC,KAAK,KAAK;YACR,OAAO,iBAAiB,CAAC;QAC3B;YACE,OAAO,iBAAiB,CAAC;IAC7B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,eAAe,CAAC,IAAY;IACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAClC,yEAAyE;IACzE,0DAA0D;IAC1D,MAAM,KAAK,GAAG,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,MAAM,OAAO,GAAG,KAAK,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;IAC9D,MAAM,KAAK,GAAG,IAAI,GAAG,CACnB,OAAO;QACL,yEAAyE;QACzE,yEAAyE;QACzE,2EAA2E;QAC3E,sEAAsE;QACtE,yEAAyE;QACzE,qEAAqE;QACrE,qDAAqD;SACpD,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,kCAAkC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SACjE,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAC1C,CAAC;IACF,OAAO;QACL,KAAK,EAAE,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;QACzB,QAAQ,EAAE,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC;QAC/B,MAAM,EAAE,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3B,UAAU,EAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;KAC9B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAS,YAAY,CAAC,GAAW;IAC/B,MAAM,QAAQ,GAAG,qDAAqD,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACjF,IAAI,QAAQ;QAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9F,8EAA8E;IAC9E,kDAAkD;IAClD,MAAM,IAAI,GAAG,mEAAmE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC3F,IAAI,IAAI;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAC9E,OAAO,EAAE,CAAC;AACZ,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,MAAc;IACnC,IAAI,cAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC;QAC7E,OAAO,YAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IACpD,CAAC;IACD,MAAM,KAAK,GAAG,IAAA,yBAAS,EAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;IAC1G,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IACzC,gFAAgF;IAChF,+EAA+E;IAC/E,sDAAsD;IACtD,OAAO,IAAA,yBAAc,EAAC,CAAC,KAAK,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED;;;GAGG;AACH,SAAgB,cAAc,CAAC,MAAM,GAAG,UAAU;IAChD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;IAElF,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,6EAA6E;IAC7E,8CAA8C;IAC9C,MAAM,GAAG,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,WAAW,CAAC,CAAC,CAAC;IAC1C,MAAM,aAAa,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC5C,MAAM,IAAI,GAAG,KAAK,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IAElD,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO;QACP,OAAO;QACP,GAAG,aAAa;QAChB,IAAI,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,OAAO,EAAE;KAC5D,CAAC;AACJ,CAAC;AASD,SAAgB,aAAa,CAAC,EAAmB;IAC/C,OAAO,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,YAAY,CAAC;AACzD,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,SAAgB,aAAa,CAAC,EAAmB;IAQ/C,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC;QAChB,OAAO;YACL,SAAS,EAAE,KAAK;YAChB,QAAQ,EAAE,KAAK;YACf,OAAO,EACL,oMAAoM;SACvM,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,YAAY,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,eAAe,CAAC;IACtE,IAAI,aAAa,CAAC,EAAE,CAAC,KAAK,gBAAgB,EAAE,CAAC;QAC3C,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,EAAE,GAAG,KAAK,oEAAoE,EAAE,CAAC;IACrI,CAAC;IACD,OAAO;QACL,SAAS,EAAE,IAAI;QACf,QAAQ,EAAE,IAAI;QACd,OAAO,EAAE,GAAG,KAAK,0PAA0P;QAC3Q,OAAO,EAAE,aAAa,CAAC,EAAE,CAAC,OAAO,CAAC;KACnC,CAAC;AACJ,CAAC;AA6BD;;;;;;;GAOG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,KAAK,IAAI,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,EAAE,KAAK,KAAK,CAAC,CAAC,EAAE,KAAK,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,KAAK,GAAG,CAAC,CAAC,EAAE,CAAC;QACvF,0EAA0E;QAC1E,EAAE;QACF,4EAA4E;QAC5E,2EAA2E;QAC3E,+DAA+D;QAC/D,yEAAyE;QACzE,mEAAmE;QACnE,4EAA4E;QAC5E,wBAAwB;QACxB,EAAE;QACF,0EAA0E;QAC1E,6EAA6E;QAC7E,2DAA2D;QAC3D,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,IAAI,QAAQ,GAAG,KAAK,CAAC;QACrB,IAAI,OAAO,GAAG,KAAK,CAAC;QACpB,KAAK,IAAI,CAAC,GAAG,KAAK,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;YACnB,IAAI,QAAQ,EAAE,CAAC;gBACb,IAAI,OAAO;oBAAE,OAAO,GAAG,KAAK,CAAC;qBACxB,IAAI,EAAE,KAAK,IAAI;oBAAE,OAAO,GAAG,IAAI,CAAC;qBAChC,IAAI,EAAE,KAAK,GAAG;oBAAE,QAAQ,GAAG,KAAK,CAAC;gBACtC,SAAS;YACX,CAAC;YACD,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,IAAI,CAAC;iBAC3B,IAAI,EAAE,KAAK,GAAG;gBAAE,KAAK,EAAE,CAAC;iBACxB,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;gBACpB,KAAK,EAAE,CAAC;gBACR,IAAI,KAAK,KAAK,CAAC,EAAE,CAAC;oBAChB,IAAI,CAAC;wBACH,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;oBAC9C,CAAC;oBAAC,MAAM,CAAC;wBACP,MAAM,CAAC,0DAA0D;oBACnE,CAAC;gBACH,CAAC;YACH,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,SAAgB,oBAAoB,CAClC,EAAmB,EACnB,IAyBC;IAED,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,UAAU,CAAC;IACzC,IAAI,CAAC,EAAE,CAAC,OAAO;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,kCAAkC,EAAE,CAAC;IACzF,MAAM,CAAC,GAAG,IAAA,wBAAa,EAAC,MAAM,EAAE,CAAC,SAAS,EAAE,MAAM,EAAE,QAAQ,CAAC,EAAE;QAC7D,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAO;QAChB,GAAG,EAAE;YACH,GAAG,OAAO,CAAC,GAAG;YACd,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,oBAAoB,EAAE,cAAI,CAAC,OAAO,CAAC,IAAI,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACnF,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC1C;KACF,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,MAAM,kCAAkC,CAAC,CAAC,KAAK,CAAC,OAAO,EAAE,EAAE,CAAC;IACjH,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IACpE,MAAM,OAAO,GAAI,MAAgC,EAAE,OAAO,CAAC;IAC3D,+EAA+E;IAC/E,6DAA6D;IAC7D,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC5B,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,oBAAoB,MAAM,gCAAgC,EAAE,CAAC;IAClG,CAAC;IASD,MAAM,IAAI,GAAG,OAAgB,CAAC;IAC9B,8EAA8E;IAC9E,8DAA8D;IAC9D,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ;SACxB,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,EAAE,KAAK,QAAQ,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC;SACtE,MAAM,CAAC,CAAC,CAAC,EAAY,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IACvC,MAAM,GAAG,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG,EAAE,CAAC;QACT,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,MAAM,EAAE,yDAAyD,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,yIAAyI;SACnO,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,GAAG,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;IAC9D,MAAM,OAAO,GAAG,OAAO,GAAG,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC;IAC1E,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,EAAE,OAAO,CAAC;QAC1D,CAAC,CAAE,GAAG,CAAC,gBAAiB,CAAC,OAAqB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC;QAChG,CAAC,CAAC,EAAE,CAAC;IACP,MAAM,IAAI,GAAG,EAAE,KAAK,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC;IAE7G,IAAI,GAAG,CAAC,OAAO,KAAK,KAAK,EAAE,CAAC;QAC1B,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,gFAAgF,EAAE,CAAC;IAClI,CAAC;IACD,IAAI,OAAO,GAAG,CAAC,MAAM,KAAK,QAAQ,IAAI,GAAG,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;QAC9D,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,YAAY,EAAE,MAAM,EAAE,mCAAmC,GAAG,CAAC,MAAM,yBAAyB,EAAE,CAAC;IAC1H,CAAC;IACD,8EAA8E;IAC9E,4DAA4D;IAC5D,IAAI,GAAG,CAAC,gBAAgB,EAAE,iBAAiB,KAAK,KAAK,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACxE,OAAO;YACL,GAAG,IAAI;YACP,KAAK,EAAE,YAAY;YACnB,MAAM,EAAE,iDAAiD,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,mDAAmD;SAC5J,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,IAAI,IAAI,CAAC,YAAY,IAAI,OAAO,EAAE,CAAC;QACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACrC,IAAI,QAAQ,KAAK,KAAK,EAAE,CAAC;YACvB,OAAO;gBACL,GAAG,IAAI;gBACP,KAAK,EAAE,YAAY;gBACnB,MAAM,EAAE,wBAAwB,OAAO,gEAAgE,IAAI,CAAC,YAAY,iIAAiI;aAC1P,CAAC;QACJ,CAAC;IACH,CAAC;IACD,OAAO,EAAE,GAAG,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;AACtC,CAAC;AAED;;;;;;;;;;;GAWG;AACH;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,SAAgB,uBAAuB,CAAC,EAAmB,EAAE,MAAM,GAAG,UAAU;IAC9E,IAAI,CAAC,EAAE,CAAC,OAAO,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IACrD,MAAM,CAAC,GAAG,IAAA,wBAAa,EAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE;QACpD,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,MAAO;QAChB,SAAS,EAAE,EAAE,GAAG,IAAI,GAAG,IAAI,EAAE,yBAAyB;KACvD,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK,IAAI,CAAC,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,SAAS,CAAC;IAChD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC,CAAC;IACnD,MAAM,KAAK,GACT,MAGD,EAAE,UAAU,EAAE,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,oBAAoB,EAAE,UAAU,CAAC;IAC9E,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,SAAS,CAAC;IAC1D,OAAO,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AAC9D,CAAC;AAED,SAAgB,cAAc,CAC5B,EAAmB,EACnB,UAAkB,EAClB,MAAM,GAAG,UAAU;AACnB,wFAAwF;AACxF,IAAa;IAEb,IAAI,CAAC,EAAE,CAAC,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAC;IACxC,MAAM,CAAC,GAAG,IAAA,wBAAa,EAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE;QACtD,QAAQ,EAAE,MAAM;QAChB,OAAO,EAAE,KAAM;QACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,oBAAoB,EAAE,cAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;KACzG,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,SAAS,CAAC;IAC9B,MAAM,GAAG,GAAG,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,CAAC;IACjD,iEAAiE;IACjE,8EAA8E;IAC9E,MAAM,KAAK,GAAG,CAAC,CAAC,MAAM,KAAK,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IAC1D,MAAM,QAAQ,GAAG,GAAG;SACjB,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;SACpC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;SAChD,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;AACpE,CAAC"}

package/dist/shared/win-exec.d.ts

@@ -0,0 +1,63 @@
+/**
+ * Launching an npm-installed CLI on Windows, without opening a shell seam.
+ *
+ * `openclaw`, `hermes`, `npm` and every other Node CLI arrive on Windows as a
+ * `.cmd` shim, and a `.cmd` is not an executable — CreateProcess cannot run one.
+ * Node used to paper over that; since 18.20.2 / 20.12.2 (the CVE-2024-27980 fix)
+ * it refuses outright, and `spawnSync("openclaw.cmd", …)` fails with EINVAL
+ * unless the call goes through a shell. That is why every `openclaw` probe
+ * answered "could not run" on Windows while working everywhere else: detection
+ * did not misread the machine, it never reached the binary at all.
+ *
+ * ⚠️ THE OBVIOUS REPAIR, `shell: true`, IS THE WRONG ONE HERE. It concatenates
+ * the command and its arguments into ONE string for `cmd.exe` to re-parse, so a
+ * `&`, `|` or `%VAR%` anywhere in an argument — or in the install path, which is
+ * read off `where` and was never written by us — stops being data and becomes
+ * another command. This tool governs whether an agent's actions are allowed to
+ * happen; it does not get to introduce shell injection into its own probe path.
+ *
+ * So a shim is routed through `cmd.exe /d /s /c` explicitly, with the command
+ * line built here: each token is quoted for the child's own CRT parser and then
+ * caret-escaped for the `cmd.exe` pass that happens first. `shell: true` skips
+ * that second step, which is exactly the part that matters.
+ *
+ * Everything off Windows, and every real `.exe`, is spawned directly as before.
+ */
+import { type SpawnSyncOptions, type SpawnSyncReturns } from "child_process";
+/** Does this command need `cmd.exe` to run at all? */
+export declare function isWindowsShim(command: string): boolean;
+/**
+ * Quote one token the way the child's C runtime will parse it back.
+ *
+ * The backslash rule is the unobvious half: a backslash is literal EXCEPT in the
+ * run immediately before a quote, where each one must be doubled. `C:\dir\` as
+ * the last token would otherwise end `"C:\dir\"` — an escaped quote, which
+ * swallows the rest of the line.
+ */
+export declare function quoteArg(arg: string): string;
+/**
+ * Caret-escape a token for the `cmd.exe` parse.
+ *
+ * The quotes added by {@link quoteArg} are escaped too, deliberately. An escaped
+ * quote is literal text to `cmd.exe`, so it does not open a quoted section
+ * there, and arrives at the child as the plain `"` its CRT is expecting.
+ */
+export declare function escapeForCmd(token: string): string;
+/** Build the full `cmd.exe` command line for a shim and its arguments. */
+export declare function cmdLineFor(command: string, args: readonly string[]): string;
+/**
+ * `spawnSync`, but a Windows `.cmd`/`.bat` shim actually runs.
+ *
+ * Identical to `spawnSync` in every other case — same arguments, same return —
+ * so it is a drop-in at the call sites that probe an external CLI.
+ */
+export declare function spawnPortable(command: string, args: readonly string[], options?: SpawnSyncOptions): SpawnSyncReturns<string>;
+/**
+ * Pick the runnable match out of `where` output.
+ *
+ * `where openclaw` lists BOTH the extensionless POSIX-style script npm writes for
+ * Git Bash and the `openclaw.cmd` Windows actually uses, in that order. Taking
+ * the first line — which is what this did — hands back the one file on the list
+ * that Windows cannot execute.
+ */
+export declare function pickExecutable(lines: string[]): string | undefined;