@bragi-gmbh/codebus 1.2.0

package/bin/codebus.js

@@ -0,0 +1,2 @@
+#!/usr/bin/env node
+import("../dist/index.js");

package/dist/binding-guard.js

@@ -0,0 +1,97 @@
+// Shared directory-binding safety guard (FM-7, docs/plans/
+// codebus-v2-reliability.md §2.3 + §6.1). Used by BOTH commands that can
+// create a directory binding today — `codebus as --bind` (the only one, per
+// the owner's locked decision: checkin stops auto-binding directories) — and
+// kept in its own module so a future second writer never has to reimplement
+// or diverge from it. Two independent hazards, one guard:
+//
+// 1. GENERIC_DIRS: a fixed list of directory names too common to trust as a
+//    machine-wide identity anchor (field incident: a checkin from /tmp bound
+//    the literal pattern 'tmp', which then matched EVERY tmp dir on the
+//    machine — unrelated sessions silently resolved as that agent).
+// 2. Uniqueness-by-recorded-path: a fixed list can never catch a
+//    real-but-shared name — 'CodeBus' slipped it (a genuine, specific name
+//    that still recurs across clones/checkouts) and ended up bound
+//    machine-wide. Instead of guessing more names onto the list, track the
+//    actual directory each bare-basename binding was recorded from
+//    (Binding.boundFrom, rolestore.ts); a second bind of the same basename
+//    from a DIFFERENT recorded path means the pattern is genuinely ambiguous
+//    — refuse and point at a full-path pattern instead (which globToRegExp
+//    matches against the whole absolute path, not just the basename).
+//
+//    That comparison only fires when the EXISTING binding has a boundFrom to
+//    compare against. A legacy binding (written before this field existed, so
+//    `boundFrom` is simply absent — every pre-existing roles.json entry keeps
+//    loading unchanged, by design) has no recorded path at all, and the old
+//    check's `!!b.boundFrom` term silently treated "no provenance" as "no
+//    conflict" — a second `as --bind` of the same bare basename from a
+//    DIFFERENT clone would sail through and silently replace the legacy
+//    mapping, which is exactly the takeover this guard exists to stop. There
+//    is no way to tell "same directory, re-bound" from "different directory,
+//    ambiguous" without a recorded path to compare against, so a matching
+//    legacy binding fails closed unconditionally: bind it again only via an
+//    explicit `as --unbind` first, or sidestep the ambiguity with a full-path
+//    pattern.
+//
+//    Round-2 review: the legacy check used `.find()`, which only inspects the
+//    FIRST binding matching `pattern` — a store can (and, once one write path
+//    has a bug, does) hold more than one binding for the same pattern, e.g.
+//    [{pattern:'lane', role:'new', boundFrom:'/same/lane'},
+//     {pattern:'lane', role:'legacy'}]. `.find()` stops at the first (safe,
+//    provenanced) entry and never looks at the second (legacy, unprovenanced)
+//    one, so `bindRole` sails through and silently overwrites/duplicates the
+//    legacy mapping — the exact takeover the legacy check above exists to
+//    stop. Every binding matching `pattern` is now collected and checked: if
+//    ANY of them lacks boundFrom, the whole bind is refused, regardless of
+//    where it sits in the list.
+export const GENERIC_DIRS = new Set([
+    "tmp", "temp", "src", "lib", "bin", "cli", "app", "web", "api", "test",
+    "tests", "build", "dist", "out", "home", "work", "code", "repo", "repos",
+    "dev", "docs", "scripts", "packages", "desktop", "documents", "downloads",
+]);
+/**
+ * Guard a candidate (pattern, cwd) pair BEFORE it's written as a binding.
+ * Only bare-basename patterns (no `/`) are checked — a full-path pattern is
+ * already unambiguous by construction.
+ */
+export function checkBindingSafety(store, pattern, cwd) {
+    if (pattern.includes("/"))
+        return { ok: true };
+    const lower = pattern.toLowerCase();
+    if (GENERIC_DIRS.has(lower)) {
+        return {
+            ok: false,
+            reason: `'${pattern}' is too generic a name to bind — it would match every '${pattern}' directory on ` +
+                `the machine. Use a full-path pattern instead: --pattern '${cwd}'`,
+        };
+    }
+    // ALL bindings matching this pattern, not just the first — a store can
+    // hold more than one entry for the same pattern (a prior bug, a hand-edited
+    // file, a partially-applied migration), and a legacy one hiding behind a
+    // provenanced one must still be caught.
+    const matches = (store.bindings ?? []).filter((b) => b.pattern === pattern);
+    const legacy = matches.find((b) => !b.boundFrom);
+    if (legacy) {
+        // Legacy binding, no recorded source directory — cannot prove this is a
+        // same-directory re-bind rather than a different clone silently stealing
+        // the mapping, so refuse unconditionally rather than guess. Fail closed.
+        return {
+            ok: false,
+            reason: `'${pattern}' is already bound to '${legacy.role}' from a legacy entry with no recorded source ` +
+                `directory — binding it again from ${cwd} could silently replace a DIFFERENT directory's mapping (there's ` +
+                `no provenance to check it against). Either remove the legacy binding first (codebus as --unbind ` +
+                `'${pattern}') or use a full-path pattern instead: --pattern '${cwd}'`,
+        };
+    }
+    const conflict = matches.find((b) => b.boundFrom !== cwd);
+    if (conflict) {
+        return {
+            ok: false,
+            reason: `'${pattern}' is already bound from a different directory (${conflict.boundFrom}) — binding it ` +
+                `again from ${cwd} would make the pattern ambiguous between the two. Use a full-path pattern instead: ` +
+                `--pattern '${cwd}'`,
+        };
+    }
+    return { ok: true };
+}
+//# sourceMappingURL=binding-guard.js.map

package/dist/binding-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"binding-guard.js","sourceRoot":"","sources":["../src/binding-guard.ts"],"names":[],"mappings":"AAEA,2DAA2D;AAC3D,yEAAyE;AACzE,4EAA4E;AAC5E,6EAA6E;AAC7E,4EAA4E;AAC5E,0DAA0D;AAC1D,EAAE;AACF,4EAA4E;AAC5E,6EAA6E;AAC7E,wEAAwE;AACxE,oEAAoE;AACpE,iEAAiE;AACjE,2EAA2E;AAC3E,mEAAmE;AACnE,2EAA2E;AAC3E,mEAAmE;AACnE,2EAA2E;AAC3E,6EAA6E;AAC7E,2EAA2E;AAC3E,sEAAsE;AACtE,EAAE;AACF,6EAA6E;AAC7E,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,6EAA6E;AAC7E,6EAA6E;AAC7E,0EAA0E;AAC1E,4EAA4E;AAC5E,8EAA8E;AAC9E,cAAc;AACd,EAAE;AACF,8EAA8E;AAC9E,8EAA8E;AAC9E,4EAA4E;AAC5E,4DAA4D;AAC5D,4EAA4E;AAC5E,8EAA8E;AAC9E,6EAA6E;AAC7E,0EAA0E;AAC1E,6EAA6E;AAC7E,2EAA2E;AAC3E,gCAAgC;AAEhC,MAAM,CAAC,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC;IAClC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IACtE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,OAAO;IACxE,KAAK,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,WAAW,EAAE,WAAW;CAC1E,CAAC,CAAC;AAIH;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAgB,EAAE,OAAe,EAAE,GAAW;IAC/E,IAAI,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;IAC/C,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,EAAE,CAAC;IACpC,IAAI,YAAY,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;QAC5B,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI,OAAO,2DAA2D,OAAO,iBAAiB;gBACpG,4DAA4D,GAAG,GAAG;SACrE,CAAC;IACJ,CAAC;IACD,uEAAuE;IACvE,4EAA4E;IAC5E,yEAAyE;IACzE,wCAAwC;IACxC,MAAM,OAAO,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC5E,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;IACjD,IAAI,MAAM,EAAE,CAAC;QACX,wEAAwE;QACxE,yEAAyE;QACzE,yEAAyE;QACzE,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI,OAAO,0BAA0B,MAAM,CAAC,IAAI,gDAAgD;gBACtG,qCAAqC,GAAG,mEAAmE;gBAC3G,kGAAkG;gBAClG,IAAI,OAAO,qDAAqD,GAAG,GAAG;SACzE,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,GAAG,CAAC,CAAC;IAC1D,IAAI,QAAQ,EAAE,CAAC;QACb,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,IAAI,OAAO,kDAAkD,QAAQ,CAAC,SAAS,iBAAiB;gBACtG,cAAc,GAAG,sFAAsF;gBACvG,cAAc,GAAG,GAAG;SACvB,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC"}

package/dist/client.js

@@ -0,0 +1,94 @@
+import { createClient } from "@supabase/supabase-js";
+import { getSession } from "./session.js";
+import { CodebusError } from "./errors.js";
+export async function makeCtx(cfg) {
+    // supabase-js needs an apikey; resolved by config (flags > env > config file).
+    const ANON = cfg.anonKey ?? "";
+    // cfg.assume: the token is the AUTHOR's credential and the session is minted
+    // server-side AS the named role (auth edge function ownership check).
+    const session = await getSession(cfg.url, cfg.token, fetch, ANON, cfg.assume);
+    if (cfg.agent && cfg.agent !== session.agent.slug)
+        throw new CodebusError(`--agent/CODEBUS_AGENT='${cfg.agent}' does not match the authenticated agent '${session.agent.slug}' (check CODEBUS_TOKEN)`);
+    const supabase = createClient(cfg.url, ANON, {
+        global: { headers: { Authorization: `Bearer ${session.jwt}`, apikey: ANON } },
+        auth: { persistSession: false, autoRefreshToken: false },
+    });
+    // Realtime authenticates separately from the HTTP headers above; without this,
+    // `watch` subscriptions connect as anon and RLS hides the agent's changes.
+    supabase.realtime.setAuth(session.jwt);
+    return { supabase, agentSlug: session.agent.slug, workspaceSlug: cfg.workspace, identitySource: cfg.identitySource };
+}
+/** True when `ctx`'s identity came from this directory's default binding
+ * rather than something the caller actually asserted (a flag, env token, or
+ * THIS session's own checkin). Safe in a directory one agent alone owns;
+ * unsafe the moment that directory is shared, since a fresh session's very
+ * first command — before it has checked in — silently inherits whichever
+ * agent the directory happens to default to. Callers that render one
+ * identity's private data (inbox, read, next) should warn on this. */
+export function identityIsGuessed(ctx) {
+    return ctx.identitySource === "cwd-binding";
+}
+export const guessedIdentityWarning = (ctx, what = "results") => `⚠ codebus: these ${what} belong to '${ctx.agentSlug}', via this directory's DEFAULT binding — not an identity you asserted. ` +
+    `If you are not '${ctx.agentSlug}', STOP and run: codebus checkin <your-name>\n`;
+// Resolves a workspace slug to its id (member-visible under RLS).
+export async function workspaceId(ctx) {
+    const { data, error } = await ctx.supabase.from("workspaces").select("id").eq("slug", ctx.workspaceSlug).single();
+    if (error || !data)
+        throw new CodebusError(`workspace not found or not a member: ${ctx.workspaceSlug}`);
+    return data.id;
+}
+// Resolves an optional project slug to its id within a workspace.
+export async function projectId(ctx, ws, slug) {
+    if (!slug)
+        return null;
+    const { data, error } = await ctx.supabase.from("projects").select("id").eq("workspace_id", ws).eq("slug", slug).single();
+    if (error || !data)
+        throw new CodebusError(`project not found in workspace: ${slug}`);
+    return data.id;
+}
+// Resolves an optional repo slug to its id within a workspace.
+//
+// Round-20 review finding (CONFIRMED, PR #55 comment 3827670905): this used
+// to be a bare `.eq("slug", slug)` lookup — it neither rejected a retired
+// row nor followed `retired_into`, so any of this function's callers
+// (repo.ts's statusAction via the `resolveRepoIdBySlug` alias, pr.ts,
+// jira.ts, question.ts, plan.ts) resolved a retired `-dup-<n>` loser slug
+// (collapse_duplicate_repo_group renames a loser, never deletes it) to
+// that dead repo_id instead of transparently following the chain to its
+// canonical repo — the exact class of bug the round-17 `graph_resolve_
+// repo_id` fix (0070_repo_connect.sql) already closed for every graph
+// query RPC. Fixed here, in this ONE shared helper, by delegating to that
+// same RPC (`security invoker`, granted to `authenticated`, already called
+// this way from graph-remote.ts) rather than re-implementing its bounded
+// retired_into-chain walk client-side — every caller above gets the fix
+// for free, with no change to their own code. `ws` is kept in the
+// signature for interface stability (every caller already derives it from
+// this same `ctx` via `workspaceId()` above, so `ctx.workspaceSlug` names
+// the identical workspace) even though the RPC call below no longer reads
+// it directly. The not-found error message is deliberately preserved
+// verbatim rather than passed through from the RPC's own exception text,
+// so this remains a pure internal-resolution swap with no user-visible
+// wording change for the (unaffected, already-correct) "truly unknown
+// slug" case.
+//
+// Deliberately does NOT surface a "resolved to canonical slug" redirect
+// note the way ingest.ts's resolveConnectedRepo/`repo connect` do — this
+// function returns a bare id, not a row a caller could compare requested-
+// vs-resolved against, and giving it that would mean widening this shared
+// helper's return shape plus touching every one of the 5 call sites' own
+// human-mode output — materially larger than closing the correctness gap
+// itself. The resolution is correct either way; only the redirect UX is
+// narrower here than on the ingest/connect paths.
+export async function repoId(ctx, ws, slug) {
+    if (!slug)
+        return null;
+    const { data, error } = await ctx.supabase.rpc("graph_resolve_repo_id", {
+        p_caller: "codebus-cli",
+        p_repo_slug: slug,
+        p_workspace_slug: ctx.workspaceSlug,
+    });
+    if (error || !data)
+        throw new CodebusError(`repo not found in workspace: ${slug}`);
+    return data;
+}
+//# sourceMappingURL=client.js.map

package/dist/client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../src/client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAkB,MAAM,uBAAuB,CAAC;AACrE,OAAO,EAAE,UAAU,EAAE,MAAM,cAAc,CAAC;AAE1C,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAS3C,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,GAAW;IACvC,+EAA+E;IAC/E,MAAM,IAAI,GAAG,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC;IAC/B,6EAA6E;IAC7E,sEAAsE;IACtE,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9E,IAAI,GAAG,CAAC,KAAK,IAAI,GAAG,CAAC,KAAK,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI;QAC/C,MAAM,IAAI,YAAY,CAAC,0BAA0B,GAAG,CAAC,KAAK,6CAA6C,OAAO,CAAC,KAAK,CAAC,IAAI,yBAAyB,CAAC,CAAC;IACtJ,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,EAAE;QAC3C,MAAM,EAAE,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,EAAE;QAC7E,IAAI,EAAE,EAAE,cAAc,EAAE,KAAK,EAAE,gBAAgB,EAAE,KAAK,EAAE;KACzD,CAAC,CAAC;IACH,+EAA+E;IAC/E,2EAA2E;IAC3E,QAAQ,CAAC,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACvC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,CAAC,SAAS,EAAE,cAAc,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC;AACvH,CAAC;AAED;;;;;;sEAMsE;AACtE,MAAM,UAAU,iBAAiB,CAAC,GAAQ;IACxC,OAAO,GAAG,CAAC,cAAc,KAAK,aAAa,CAAC;AAC9C,CAAC;AAED,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,GAAQ,EAAE,IAAI,GAAG,SAAS,EAAE,EAAE,CACnE,oBAAoB,IAAI,eAAe,GAAG,CAAC,SAAS,0EAA0E;IAC9H,mBAAmB,GAAG,CAAC,SAAS,gDAAgD,CAAC;AAEnF,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAQ;IACxC,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,GAAG,CAAC,aAAa,CAAC,CAAC,MAAM,EAAE,CAAC;IAClH,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,YAAY,CAAC,wCAAwC,GAAG,CAAC,aAAa,EAAE,CAAC,CAAC;IACxG,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,kEAAkE;AAClE,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,GAAQ,EAAE,EAAU,EAAE,IAAa;IACjE,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;IAC1H,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,YAAY,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;IACtF,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,+DAA+D;AAC/D,EAAE;AACF,4EAA4E;AAC5E,0EAA0E;AAC1E,qEAAqE;AACrE,sEAAsE;AACtE,0EAA0E;AAC1E,uEAAuE;AACvE,wEAAwE;AACxE,uEAAuE;AACvE,sEAAsE;AACtE,0EAA0E;AAC1E,2EAA2E;AAC3E,yEAAyE;AACzE,wEAAwE;AACxE,kEAAkE;AAClE,0EAA0E;AAC1E,0EAA0E;AAC1E,0EAA0E;AAC1E,qEAAqE;AACrE,yEAAyE;AACzE,uEAAuE;AACvE,sEAAsE;AACtE,cAAc;AACd,EAAE;AACF,wEAAwE;AACxE,yEAAyE;AACzE,0EAA0E;AAC1E,0EAA0E;AAC1E,yEAAyE;AACzE,yEAAyE;AACzE,wEAAwE;AACxE,kDAAkD;AAClD,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,GAAQ,EAAE,EAAU,EAAE,IAAa;IAC9D,IAAI,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IACvB,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,uBAAuB,EAAE;QACtE,QAAQ,EAAE,aAAa;QACvB,WAAW,EAAE,IAAI;QACjB,gBAAgB,EAAE,GAAG,CAAC,aAAa;KACpC,CAAC,CAAC;IACH,IAAI,KAAK,IAAI,CAAC,IAAI;QAAE,MAAM,IAAI,YAAY,CAAC,gCAAgC,IAAI,EAAE,CAAC,CAAC;IACnF,OAAO,IAAc,CAAC;AACxB,CAAC"}

package/dist/commands/ack.js

@@ -0,0 +1,47 @@
+import { resolveConfig } from "../config.js";
+import { makeCtx, workspaceId } from "../client.js";
+import { CodebusError } from "../errors.js";
+// `codebus ack <id>` — explicit handled-marker (delivery gap #5). Replying
+// already marks the original handled for the replier (0048 trigger); `ack` is
+// the other lawful way to clear a message from every unread surface — for
+// mail that needed no reply (an FYI, a broadcast note) but was actually acted
+// on / read and dealt with. Mirrors archive.ts's shape (resolve, update own
+// recipient row, done); the mr_update RLS policy (0007) already scopes the
+// update to the caller's own row.
+export async function ackCmd(idOrDisplay, o) {
+    const ctx = await makeCtx(resolveConfig(o));
+    const isDisplay = /^CB-MSG-/i.test(idOrDisplay);
+    const sel = isDisplay ? "display_id" : "id";
+    const val = isDisplay ? idOrDisplay.toUpperCase() : idOrDisplay;
+    // display ids are only unique per workspace (bus_counters, 0004) — scope
+    // the display_id lookup, or a multi-workspace agent could ack the WRONG
+    // workspace's message when two workspaces happen to share a display_id.
+    let q = ctx.supabase.from("messages").select("id").eq(sel, val);
+    if (isDisplay)
+        q = q.eq("workspace_id", await workspaceId(ctx));
+    const { data: msg, error } = await q.single();
+    if (error || !msg)
+        throw new CodebusError(`message not found: ${idOrDisplay}`);
+    // Review MAJOR finding #6: the update's error/rowcount used to be ignored
+    // entirely — a caller who is NOT a recipient of this message (mr_update
+    // RLS, 0007, scopes updates to `agent_id = current_agent_id()`) matched zero
+    // rows, got no error back from PostgREST, and still printed a success
+    // message claiming the message was acked/handled. Select the row back
+    // (`.select()`) so the actual affected-row count is visible, and fail
+    // loudly on either an error or an empty result.
+    const { data: updated, error: uerr } = await ctx.supabase
+        .from("message_recipients")
+        .update({ handled_at: new Date().toISOString() })
+        .eq("message_id", msg.id)
+        .select("message_id");
+    if (uerr)
+        throw new CodebusError(`ack failed: ${uerr.message}`);
+    if (!updated || updated.length === 0) {
+        throw new CodebusError(`ack failed: you are not a recipient of ${idOrDisplay} (nothing to ack)`);
+    }
+    if (o.json)
+        console.log(JSON.stringify({ acked: idOrDisplay }));
+    else
+        console.log(`acked ${idOrDisplay} (handled)`);
+}
+//# sourceMappingURL=ack.js.map

package/dist/commands/ack.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"ack.js","sourceRoot":"","sources":["../../src/commands/ack.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAa,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,2EAA2E;AAC3E,8EAA8E;AAC9E,0EAA0E;AAC1E,8EAA8E;AAC9E,4EAA4E;AAC5E,2EAA2E;AAC3E,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,MAAM,CAAC,WAAmB,EAAE,CAAiC;IACjF,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAChE,yEAAyE;IACzE,wEAAwE;IACxE,wEAAwE;IACxE,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,SAAS;QAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9C,IAAI,KAAK,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;IAC/E,0EAA0E;IAC1E,wEAAwE;IACxE,6EAA6E;IAC7E,sEAAsE;IACtE,sEAAsE;IACtE,sEAAsE;IACtE,gDAAgD;IAChD,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,QAAQ;SACtD,IAAI,CAAC,oBAAoB,CAAC;SAC1B,MAAM,CAAC,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;SAChD,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC;SACxB,MAAM,CAAC,YAAY,CAAC,CAAC;IACxB,IAAI,IAAI;QAAE,MAAM,IAAI,YAAY,CAAC,eAAe,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CAAC,0CAA0C,WAAW,mBAAmB,CAAC,CAAC;IACnG,CAAC;IACD,IAAI,CAAC,CAAC,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,CAAC;;QAC3D,OAAO,CAAC,GAAG,CAAC,SAAS,WAAW,YAAY,CAAC,CAAC;AACrD,CAAC"}

package/dist/commands/archive.js

@@ -0,0 +1,21 @@
+import { resolveConfig } from "../config.js";
+import { makeCtx, workspaceId } from "../client.js";
+import { CodebusError } from "../errors.js";
+export async function archiveCmd(idOrDisplay, o) {
+    const ctx = await makeCtx(resolveConfig(o));
+    const isDisplay = /^CB-MSG-/i.test(idOrDisplay);
+    const sel = isDisplay ? "display_id" : "id";
+    const val = isDisplay ? idOrDisplay.toUpperCase() : idOrDisplay;
+    // display ids are only unique per workspace (bus_counters, 0004) — scope
+    // the display_id lookup, or a multi-workspace agent can archive the WRONG
+    // workspace's message when two workspaces happen to share a display_id.
+    let q = ctx.supabase.from("messages").select("id").eq(sel, val);
+    if (isDisplay)
+        q = q.eq("workspace_id", await workspaceId(ctx));
+    const { data: msg, error } = await q.single();
+    if (error || !msg)
+        throw new CodebusError(`message not found: ${idOrDisplay}`);
+    await ctx.supabase.from("message_recipients").update({ archived_at: new Date().toISOString() }).eq("message_id", msg.id);
+    console.log(`archived ${idOrDisplay}`);
+}
+//# sourceMappingURL=archive.js.map

package/dist/commands/archive.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive.js","sourceRoot":"","sources":["../../src/commands/archive.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAa,MAAM,cAAc,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AACpD,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,MAAM,CAAC,KAAK,UAAU,UAAU,CAAC,WAAmB,EAAE,CAAY;IAChE,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,WAAW,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;IAChD,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC;IAC5C,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,WAAW,CAAC;IAChE,yEAAyE;IACzE,0EAA0E;IAC1E,wEAAwE;IACxE,IAAI,CAAC,GAAG,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IAChE,IAAI,SAAS;QAAE,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,GAAG,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC;IAC9C,IAAI,KAAK,IAAI,CAAC,GAAG;QAAE,MAAM,IAAI,YAAY,CAAC,sBAAsB,WAAW,EAAE,CAAC,CAAC;IAC/E,MAAM,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC,YAAY,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACzH,OAAO,CAAC,GAAG,CAAC,YAAY,WAAW,EAAE,CAAC,CAAC;AACzC,CAAC"}

package/dist/commands/as.js

@@ -0,0 +1,299 @@
+import { spawn } from "node:child_process";
+import { resolveConfig } from "../config.js";
+import { makeCtx } from "../client.js";
+import { render } from "../output.js";
+import { CodebusError } from "../errors.js";
+// `codebus as <role> -- <cmd>` — run a command as a specific bus role.
+//
+// Why this exists: a session must never own its identity. provision_my_agent()
+// mints a NEW principal per call, which is how nihviid-claude / nihviid-web /
+// nihviid-default got created — the "address-book graveyard" the founding brief
+// bans. Roles are durable and few; sessions are ephemeral and many. This command
+// binds an ephemeral session to a durable role for the life of one process, via
+// CODEBUS_TOKEN in the child env (config.ts precedence: flags > env > file).
+//
+// Tokens are stored ONCE, verified at write time, and never printed again.
+// This is deliberately a local token store, not real credential delegation: N
+// long-lived role tokens on disk is acceptable for one machine and one human,
+// and becomes a liability the moment other people are involved. The proper fix
+// is a server-side assume_role() issuing short-lived JWTs — no such primitive
+// exists yet, so this is honest scaffolding, not the finished thing.
+export { rolesFile, loadRoles, saveRoles } from "../rolestore.js";
+import { rolesFile, loadRoles, saveRoles, inferRole } from "../rolestore.js";
+import { checkBindingSafety } from "../binding-guard.js";
+/**
+ * The child env for a role entry — exported for the regression suite (FM-5).
+ * A nested `codebus as roleA -- codebus as roleB -- cmd` (or simply running
+ * `as` from inside a session that already has CODEBUS_AGENT/CODEBUS_ASSUME
+ * set) must not leak the OUTER identity pin into the child: spreading the
+ * base env and overlaying only ONE of {CODEBUS_TOKEN, CODEBUS_ASSUME} left
+ * CODEBUS_AGENT and/or the other of {CODEBUS_TOKEN, CODEBUS_ASSUME} in place
+ * whenever the parent process happened to have them set — a raw-token role
+ * would then fail the identity check against a stale CODEBUS_AGENT, and an
+ * {assume} role's token-backed child would authenticate under the WRONG
+ * assumed role via a stale CODEBUS_ASSUME. Delete every conflicting inherited
+ * var first, then set exactly the one shape this entry actually has.
+ */
+export function childEnvFor(entry, base = process.env) {
+    const env = { ...base };
+    delete env.CODEBUS_TOKEN;
+    delete env.CODEBUS_AGENT;
+    delete env.CODEBUS_ASSUME;
+    if (entry.token)
+        env.CODEBUS_TOKEN = entry.token;
+    else
+        env.CODEBUS_ASSUME = entry.assume;
+    return env;
+}
+/**
+ * Read a secret without echoing it. Tokens must never reach argv — argv leaks
+ * into shell history and `ps` output — so --set always prompts or reads a pipe.
+ */
+async function readSecret(prompt) {
+    const stdin = process.stdin;
+    if (!stdin.isTTY) {
+        // piped / CI: consume stdin as the token
+        return new Promise((resolve, reject) => {
+            let data = "";
+            stdin.setEncoding("utf8");
+            stdin.on("data", (c) => (data += c));
+            stdin.on("end", () => resolve(data.trim()));
+            stdin.on("error", reject);
+        });
+    }
+    // Prompt on stderr so stdout stays clean for piping.
+    process.stderr.write(prompt);
+    return new Promise((resolve) => {
+        let buf = "";
+        stdin.setRawMode(true);
+        stdin.resume();
+        stdin.setEncoding("utf8");
+        const onData = (ch) => {
+            if (ch === "\r" || ch === "\n" || ch === "\u0004") {
+                stdin.setRawMode(false);
+                stdin.pause();
+                stdin.removeListener("data", onData);
+                process.stderr.write("\n");
+                resolve(buf);
+            }
+            else if (ch === "\u0003") {
+                stdin.setRawMode(false);
+                process.stderr.write("\n");
+                process.exit(130); // ctrl-c
+            }
+            else if (ch === "\u007f" || ch === "\b") {
+                buf = buf.slice(0, -1);
+            }
+            else {
+                buf += ch;
+            }
+        };
+        stdin.on("data", onData);
+    });
+}
+/**
+ * Store a role's token. Verifies the token authenticates AS the named role
+ * before writing — a token stored under the wrong name would silently make
+ * every future session act as the wrong identity, which is far worse than
+ * failing here.
+ */
+async function setRole(role, o) {
+    const token = await readSecret(`token for ${role} (not echoed): `);
+    if (!token)
+        throw new CodebusError("no token provided");
+    const cfg = resolveConfig({ url: o.url, anonKey: o.anonKey, token });
+    let authed;
+    try {
+        const ctx = await makeCtx(cfg);
+        authed = ctx.agentSlug;
+    }
+    catch (e) {
+        throw new CodebusError(`token rejected: ${e.message}`);
+    }
+    if (authed !== role) {
+        throw new CodebusError(`token authenticates as '${authed}', not '${role}'. ` +
+            `Store it under its real name (codebus as --set ${authed}) or use the right token.`);
+    }
+    const store = loadRoles();
+    const existed = !!store.roles[role];
+    store.roles[role] = { token, agent: authed, added_at: new Date().toISOString() };
+    saveRoles(store);
+    console.log(`${existed ? "updated" : "stored"} ${role} (verified as ${authed}) → ${rolesFile()}`);
+}
+function listRoles(o) {
+    const store = loadRoles();
+    const rows = Object.entries(store.roles).map(([role, e]) => ({
+        role, agent: e.agent, added_at: e.added_at,
+    }));
+    if (!rows.length) {
+        console.log(`no roles bound yet — add one with: codebus as --set <role>`);
+        return;
+    }
+    console.log(render(rows, { json: !!o.json })); // never renders tokens
+}
+function forgetRole(role) {
+    const store = loadRoles();
+    if (!store.roles[role])
+        throw new CodebusError(`no such bound role: ${role}`);
+    delete store.roles[role];
+    saveRoles(store);
+    console.log(`forgot ${role}`);
+}
+/**
+ * Bind a directory pattern to a role, so `codebus as -- <cmd>` needs no role.
+ * The ONLY command that creates directory bindings (owner decision §6.1,
+ * docs/plans/codebus-v2-reliability.md — checkin stops auto-binding). Guarded
+ * against generic basenames and cross-directory name collisions
+ * (binding-guard.ts, FM-7) — both catch the same underlying hazard: a bare
+ * basename pattern matching more than the one directory the human meant.
+ */
+function bindRole(role, pattern) {
+    const store = loadRoles();
+    if (!store.roles[role]) {
+        throw new CodebusError(`role '${role}' has no stored token yet — run: codebus as --set ${role}`);
+    }
+    // Default to the current directory's basename as a pattern rather than its
+    // full path: the enclosing dir is usually the lane, and a basename pattern
+    // survives the worktree being recreated elsewhere.
+    const cwd = process.cwd();
+    const pat = pattern ?? (cwd.split("/").filter(Boolean).pop() ?? cwd);
+    const guard = checkBindingSafety(store, pat, cwd);
+    if (!guard.ok)
+        throw new CodebusError(guard.reason);
+    store.bindings = (store.bindings ?? []).filter((b) => b.pattern !== pat);
+    store.bindings.push({ pattern: pat, role, boundFrom: cwd });
+    saveRoles(store);
+    console.log(`bound ${pat} → ${role}`);
+}
+function unbindPattern(pattern) {
+    const store = loadRoles();
+    const before = (store.bindings ?? []).length;
+    store.bindings = (store.bindings ?? []).filter((b) => b.pattern !== pattern);
+    if (store.bindings.length === before) {
+        throw new CodebusError(`no binding for pattern: ${pattern}`);
+    }
+    saveRoles(store);
+    console.log(`unbound ${pattern}`);
+}
+function listBindings(o) {
+    const store = loadRoles();
+    const rows = (store.bindings ?? []).map((b) => ({ pattern: b.pattern, role: b.role }));
+    if (!rows.length) {
+        console.log(`no path bindings — add one with: codebus as --bind <role> [--pattern '<glob>']`);
+        return;
+    }
+    const hit = inferRole(store, process.cwd());
+    console.log(render(rows, { json: !!o.json }));
+    console.log(hit ? `\ncwd matches: ${hit.pattern} → ${hit.role}` : `\ncwd matches: (none)`);
+}
+/**
+ * Exec a child process bound to a role. Inherits stdio so interactive tools
+ * (claude, codex) behave normally, and propagates the child's exit code so
+ * this is transparent in scripts and wrappers.
+ *
+ * Returns a Promise that never itself resolves — index.ts's top-level
+ * `program.parseAsync().then(() => process.exit(0))` would otherwise race
+ * ahead of the child (commander's action returns as soon as spawn() is
+ * called, long before the child finishes) and always exit 0 regardless of
+ * the child's real outcome. The event handlers below call process.exit(...)
+ * directly with the real code/signal once the child is actually done, which
+ * terminates the process before that outer `.then` ever runs.
+ */
+function runAs(role, argv) {
+    const store = loadRoles();
+    const entry = store.roles[role];
+    if (!entry) {
+        const known = Object.keys(store.roles);
+        throw new CodebusError(`role '${role}' is not bound. ${known.length ? `Bound: ${known.join(", ")}. ` : ""}` +
+            `Add it with: codebus as --set ${role}`);
+    }
+    if (!argv.length)
+        throw new CodebusError(`nothing to run — usage: codebus as ${role} -- <command> [args…]`);
+    if (!entry.token && !entry.assume) {
+        throw new CodebusError(`role '${role}' has neither a token nor an assume target — re-add it with: codebus as --set ${role}`);
+    }
+    const childEnv = childEnvFor(entry); // FM-5: never leaks a stale outer identity pin, see childEnvFor
+    const [cmd, ...rest] = argv;
+    const child = spawn(cmd, rest, {
+        stdio: "inherit",
+        // CODEBUS_TOKEN overrides the config file's identity for this process tree.
+        // CODEBUS_AGENT is deliberately NOT set: config.ts treats a mismatch between
+        // it and the authenticated agent as a hard error, and the token is already
+        // authoritative. Setting both invites a confusing failure for no benefit.
+        // An {assume} entry has no token to export — CODEBUS_ASSUME names the role
+        // instead, and each child mints its session from the author's config.json
+        // credential (config.ts threads it; spreading an undefined CODEBUS_TOKEN
+        // here would silently run the child as the AUTHOR, the exact misfire `as`
+        // exists to prevent).
+        env: childEnv,
+    });
+    child.on("error", (e) => {
+        console.error(`error: cannot run '${cmd}': ${e.message}`);
+        process.exit(127);
+    });
+    child.on("exit", (code, signal) => {
+        if (signal)
+            process.kill(process.pid, signal);
+        else
+            process.exit(code ?? 0);
+    });
+    return new Promise(() => { });
+}
+export function registerAs(program, g) {
+    g(program.command("as"))
+        .description("run a command as a bus role (codebus as <role> -- <cmd>)")
+        .argument("[role]", "bound role slug")
+        .option("--set <role>", "store a token for a role (prompts; never echoed)")
+        .option("--list", "list bound roles (never prints tokens)")
+        .option("--forget <role>", "remove a bound role")
+        .option("--bind <role>", "bind a directory pattern to a role (default: this dir's name)")
+        .option("--pattern <glob>", "pattern for --bind (e.g. 'wt-playkit-*')")
+        .option("--unbind <pattern>", "remove a path→role binding")
+        .option("--bindings", "list path→role bindings and what cwd resolves to")
+        .allowUnknownOption() // everything after `--` belongs to the child
+        .action(async (role, o) => {
+        if (o.set)
+            return setRole(o.set, o);
+        if (o.list)
+            return listRoles(o);
+        if (o.forget)
+            return forgetRole(o.forget);
+        if (o.bind)
+            return bindRole(o.bind, o.pattern);
+        if (o.unbind)
+            return unbindPattern(o.unbind);
+        if (o.bindings)
+            return listBindings(o);
+        // Read the child argv straight from process.argv: commander's own
+        // parsing of `--` passthrough varies with option placement, and getting
+        // this wrong would silently run the wrong command.
+        const dd = process.argv.indexOf("--");
+        const childArgv = dd >= 0 ? process.argv.slice(dd + 1) : [];
+        // Commander fills the [role] positional from the FIRST token after `--`
+        // (so `as -- echo hi` arrives as role='echo'), which would silently treat
+        // the child command as a role name. Only trust `role` if it actually
+        // appears before `--` in argv.
+        const beforeDD = dd >= 0 ? process.argv.slice(0, dd) : process.argv;
+        let resolved = role !== undefined && beforeDD.includes(role) ? role : undefined;
+        // No explicit role → infer from cwd. This is the zero-touch path: a
+        // session in a bound worktree needs no role argument at all.
+        if (!resolved) {
+            const store = loadRoles();
+            const hit = inferRole(store, process.cwd());
+            if (!hit) {
+                const bound = Object.keys(store.roles);
+                throw new CodebusError(`no role bound for ${process.cwd()}.\n` +
+                    (bound.length
+                        ? `  bind it:  codebus as --bind <role> [--pattern '<glob>']   (stored roles: ${bound.join(", ")})\n`
+                        : `  add one:  codebus as --set <role>\n`) +
+                    `  or name it: codebus as <role> -- <command>`);
+            }
+            resolved = hit.role;
+            // Say which rule fired — silent inference of identity is how you end
+            // up acting as the wrong agent without noticing.
+            console.error(`codebus: ${hit.pattern} → ${resolved}`);
+        }
+        await runAs(resolved, childArgv);
+    });
+}
+//# sourceMappingURL=as.js.map

package/dist/commands/as.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"as.js","sourceRoot":"","sources":["../../src/commands/as.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,cAAc,CAAC;AAC7C,OAAO,EAAE,OAAO,EAAE,MAAM,cAAc,CAAC;AACvC,OAAO,EAAE,MAAM,EAAE,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAE5C,uEAAuE;AACvE,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,gFAAgF;AAChF,iFAAiF;AACjF,gFAAgF;AAChF,6EAA6E;AAC7E,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,8EAA8E;AAC9E,+EAA+E;AAC/E,8EAA8E;AAC9E,qEAAqE;AAErE,OAAO,EAAiC,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACjG,OAAO,EAAwB,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AACnG,OAAO,EAAE,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAEzD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,WAAW,CAAC,KAAgB,EAAE,OAA0B,OAAO,CAAC,GAAG;IACjF,MAAM,GAAG,GAAsB,EAAE,GAAG,IAAI,EAAE,CAAC;IAC3C,OAAO,GAAG,CAAC,aAAa,CAAC;IACzB,OAAO,GAAG,CAAC,aAAa,CAAC;IACzB,OAAO,GAAG,CAAC,cAAc,CAAC;IAC1B,IAAI,KAAK,CAAC,KAAK;QAAE,GAAG,CAAC,aAAa,GAAG,KAAK,CAAC,KAAK,CAAC;;QAC5C,GAAG,CAAC,cAAc,GAAG,KAAK,CAAC,MAAM,CAAC;IACvC,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,UAAU,CAAC,MAAc;IACtC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;IAC5B,IAAI,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QACjB,yCAAyC;QACzC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;YACrC,IAAI,IAAI,GAAG,EAAE,CAAC;YACd,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;YAC1B,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;YACrC,KAAK,CAAC,EAAE,CAAC,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;YAC5C,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;QAC5B,CAAC,CAAC,CAAC;IACL,CAAC;IACD,qDAAqD;IACrD,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IAC7B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,IAAI,GAAG,GAAG,EAAE,CAAC;QACb,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QACvB,KAAK,CAAC,MAAM,EAAE,CAAC;QACf,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC;QAC1B,MAAM,MAAM,GAAG,CAAC,EAAU,EAAE,EAAE;YAC5B,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAClD,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACxB,KAAK,CAAC,KAAK,EAAE,CAAC;gBACd,KAAK,CAAC,cAAc,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;gBACrC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,CAAC,GAAG,CAAC,CAAC;YACf,CAAC;iBAAM,IAAI,EAAE,KAAK,QAAQ,EAAE,CAAC;gBAC3B,KAAK,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;gBACxB,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;gBAC3B,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS;YAC9B,CAAC;iBAAM,IAAI,EAAE,KAAK,QAAQ,IAAI,EAAE,KAAK,IAAI,EAAE,CAAC;gBAC1C,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YACzB,CAAC;iBAAM,CAAC;gBACN,GAAG,IAAI,EAAE,CAAC;YACZ,CAAC;QACH,CAAC,CAAC;QACF,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC3B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,OAAO,CAAC,IAAY,EAAE,CAAqC;IACxE,MAAM,KAAK,GAAG,MAAM,UAAU,CAAC,aAAa,IAAI,iBAAiB,CAAC,CAAC;IACnE,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAExD,MAAM,GAAG,GAAG,aAAa,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,GAAG,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,IAAI,MAAc,CAAC;IACnB,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC;QAC/B,MAAM,GAAG,GAAG,CAAC,SAAS,CAAC;IACzB,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,YAAY,CAAC,mBAAoB,CAAW,CAAC,OAAO,EAAE,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,MAAM,IAAI,YAAY,CACpB,2BAA2B,MAAM,WAAW,IAAI,KAAK;YACrD,kDAAkD,MAAM,2BAA2B,CACpF,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,OAAO,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACpC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAE,CAAC;IACjF,SAAS,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,IAAI,IAAI,iBAAiB,MAAM,OAAO,SAAS,EAAE,EAAE,CAAC,CAAC;AACpG,CAAC;AAED,SAAS,SAAS,CAAC,CAAqB;IACtC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC3D,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ;KAC3C,CAAC,CAAC,CAAC;IACJ,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAC;QAC1E,OAAO;IACT,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,uBAAuB;AACxE,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC;QAAE,MAAM,IAAI,YAAY,CAAC,uBAAuB,IAAI,EAAE,CAAC,CAAC;IAC9E,OAAO,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IACzB,SAAS,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,EAAE,CAAC,CAAC;AAChC,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,OAA2B;IACzD,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,YAAY,CAAC,SAAS,IAAI,qDAAqD,IAAI,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,2EAA2E;IAC3E,2EAA2E;IAC3E,mDAAmD;IACnD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC1B,MAAM,GAAG,GAAG,OAAO,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,CAAC;IACrE,MAAM,KAAK,GAAG,kBAAkB,CAAC,KAAK,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC;IAClD,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpD,KAAK,CAAC,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,GAAG,CAAC,CAAC;IACzE,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,EAAE,CAAC,CAAC;IAC5D,SAAS,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,SAAS,GAAG,MAAM,IAAI,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,OAAe;IACpC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC7C,KAAK,CAAC,QAAQ,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC,CAAC;IAC7E,IAAI,KAAK,CAAC,QAAQ,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;QACrC,MAAM,IAAI,YAAY,CAAC,2BAA2B,OAAO,EAAE,CAAC,CAAC;IAC/D,CAAC;IACD,SAAS,CAAC,KAAK,CAAC,CAAC;IACjB,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;AACpC,CAAC;AAED,SAAS,YAAY,CAAC,CAAqB;IACzC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,CAAC,KAAK,CAAC,QAAQ,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IACvF,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;QACjB,OAAO,CAAC,GAAG,CAAC,gFAAgF,CAAC,CAAC;QAC9F,OAAO;IACT,CAAC;IACD,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,kBAAkB,GAAG,CAAC,OAAO,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,uBAAuB,CAAC,CAAC;AAC7F,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,KAAK,CAAC,IAAY,EAAE,IAAc;IACzC,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;IAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACvC,MAAM,IAAI,YAAY,CACpB,SAAS,IAAI,mBAAmB,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,UAAU,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACpF,iCAAiC,IAAI,EAAE,CACxC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,YAAY,CAAC,sCAAsC,IAAI,uBAAuB,CAAC,CAAC;IAC5G,IAAI,CAAC,KAAK,CAAC,KAAK,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,YAAY,CAAC,SAAS,IAAI,iFAAiF,IAAI,EAAE,CAAC,CAAC;IAC/H,CAAC;IAED,MAAM,QAAQ,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC,CAAC,gEAAgE;IAErG,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,KAAK,EAAE,SAAS;QAChB,4EAA4E;QAC5E,6EAA6E;QAC7E,2EAA2E;QAC3E,0EAA0E;QAC1E,2EAA2E;QAC3E,0EAA0E;QAC1E,yEAAyE;QACzE,0EAA0E;QAC1E,sBAAsB;QACtB,GAAG,EAAE,QAAQ;KACd,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,CAAC,EAAE,EAAE;QACtB,OAAO,CAAC,KAAK,CAAC,sBAAsB,GAAG,MAAM,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAC1D,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpB,CAAC,CAAC,CAAC;IACH,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE;QAChC,IAAI,MAAM;YAAE,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;;YACzC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC;IAC/B,CAAC,CAAC,CAAC;IACH,OAAO,IAAI,OAAO,CAAQ,GAAG,EAAE,GAAsD,CAAC,CAAC,CAAC;AAC1F,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,OAAgB,EAAE,CAA0B;IACrE,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;SACrB,WAAW,CAAC,0DAA0D,CAAC;SACvE,QAAQ,CAAC,QAAQ,EAAE,iBAAiB,CAAC;SACrC,MAAM,CAAC,cAAc,EAAE,kDAAkD,CAAC;SAC1E,MAAM,CAAC,QAAQ,EAAE,wCAAwC,CAAC;SAC1D,MAAM,CAAC,iBAAiB,EAAE,qBAAqB,CAAC;SAChD,MAAM,CAAC,eAAe,EAAE,+DAA+D,CAAC;SACxF,MAAM,CAAC,kBAAkB,EAAE,0CAA0C,CAAC;SACtE,MAAM,CAAC,oBAAoB,EAAE,4BAA4B,CAAC;SAC1D,MAAM,CAAC,YAAY,EAAE,kDAAkD,CAAC;SACxE,kBAAkB,EAAE,CAAG,6CAA6C;SACpE,MAAM,CAAC,KAAK,EAAE,IAAwB,EAAE,CAAM,EAAE,EAAE;QACjD,IAAI,CAAC,CAAC,GAAG;YAAE,OAAO,OAAO,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,SAAS,CAAC,CAAC,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,UAAU,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC1C,IAAI,CAAC,CAAC,IAAI;YAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC;QAC/C,IAAI,CAAC,CAAC,MAAM;YAAE,OAAO,aAAa,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC;QAC7C,IAAI,CAAC,CAAC,QAAQ;YAAE,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;QAEvC,kEAAkE;QAClE,wEAAwE;QACxE,mDAAmD;QACnD,MAAM,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,SAAS,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAE5D,wEAAwE;QACxE,0EAA0E;QAC1E,qEAAqE;QACrE,+BAA+B;QAC/B,MAAM,QAAQ,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC;QACpE,IAAI,QAAQ,GAAG,IAAI,KAAK,SAAS,IAAI,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC;QAEhF,oEAAoE;QACpE,6DAA6D;QAC7D,IAAI,CAAC,QAAQ,EAAE,CAAC;YACd,MAAM,KAAK,GAAG,SAAS,EAAE,CAAC;YAC1B,MAAM,GAAG,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;YAC5C,IAAI,CAAC,GAAG,EAAE,CAAC;gBACT,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBACvC,MAAM,IAAI,YAAY,CACpB,qBAAqB,OAAO,CAAC,GAAG,EAAE,KAAK;oBACvC,CAAC,KAAK,CAAC,MAAM;wBACX,CAAC,CAAC,8EAA8E,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK;wBACrG,CAAC,CAAC,uCAAuC,CAAC;oBAC5C,8CAA8C,CAC/C,CAAC;YACJ,CAAC;YACD,QAAQ,GAAG,GAAG,CAAC,IAAI,CAAC;YACpB,qEAAqE;YACrE,iDAAiD;YACjD,OAAO,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,OAAO,MAAM,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QACD,MAAM,KAAK,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;IACnC,CAAC,CAAC,CAAC;AACP,CAAC"}