@calltelemetry/ct-lab-mcp 0.8.96 → 0.8.98

package/README.md

@@ -1,13 +1,13 @@
 # @calltelemetry/ct-lab-mcp
 
-> **Model Context Protocol (MCP) Server for Unified Call Telemetry Lab, Fleet, and Appliance Management across Proxmox VE and VMware ESXi**
+> **Model Context Protocol (MCP) Server for Unified Call Telemetry Lab, Fleet, and Appliance Management across Proxmox VE (ESXi is retired)**
 
 [![NPM Version](https://img.shields.io/npm/v/@calltelemetry/ct-lab-mcp.svg)](https://www.npmjs.com/package/@calltelemetry/ct-lab-mcp)
 [![License: MIT](https://img.shields.io/badge/License-MIT-blue.svg)](LICENSE)
 [![TypeScript](https://img.shields.io/badge/TypeScript-5.7+-blue.svg)](https://www.typescriptlang.org/)
 [![Node Version](https://img.shields.io/badge/node-%3E%3D20.0.0-brightgreen.svg)](https://nodejs.org/)
 
-`@calltelemetry/ct-lab-mcp` is the single public MCP façade for Call Telemetry lab operations. It exposes high-level multi-hypervisor management (Proxmox VE & VMware ESXi), disposable VM workflows, and secure appliance diagnostics while delegating canonical asset identity, lease ownership, and release-line policy to the private `lab-inventory` CLI supplied by `ct-meta`.
+`@calltelemetry/ct-lab-mcp` is the single public MCP façade for Call Telemetry lab operations. It exposes high-level hypervisor management (Proxmox VE only; ESXi was retired 2026-10-15), disposable VM workflows, and secure appliance diagnostics while delegating canonical asset identity, lease ownership, and release-line policy to the private `lab-inventory` CLI supplied by `ct-meta`.
 
 ---
 
@@ -29,7 +29,7 @@ AI Clients (Claude Desktop / Cursor / Web / AI Agents)
   ├── release_slot        (DEPRECATED alias -> delete_appliance_claim)
   ├── find_slot / list_slots (DEPRECATED aliases -> list_hosts / list_appliance_claims)
   ├── purge_slots         (RETIRED: explicit SLOT_VERB_RETIRED error; use list_expired_vms / cleanup_expired_vms)
-  ├── provision_vm        (Disposable VM provisioning on Proxmox/ESXi)
+  ├── provision_vm        (Disposable VM provisioning on Proxmox)
   ├── proxmox_quick_provision (Size-driven Proxmox fleet plan/apply; host=auto ranks by free RAM then disk)
   ├── pin_pool_slots      (RETIRED: explicit SLOT_VERB_RETIRED error; pass webImage to proxmox_quick_provision)
   ├── vm_action           (Power lifecycle with non-bypassable safety guardrails)
@@ -50,15 +50,15 @@ AI Clients (Claude Desktop / Cursor / Web / AI Agents)
   ┌───────────────┼───────────────┬───────────────────┐
   ▼               ▼               ▼                   ▼
 [MultiHypervisor] [Slot Engine]   [Safety Guardrails] [Appliance SSH]
-  ├── Proxmox VE   ├── ProxmoxLab  ├── Proxmox fixtures ├── ssh2 port 2222
-  │   (2x8GB)      │   (2x8GB max) │   (100-104, 9000s) ├── cli.sh / db vacuum
-  └── VMware ESXi  ├── ProxmoxMini └── ESXi fixtures    ├── migrate / logs
-      (8x8GB)      │   (4x8GB max)     (CUCM, CUBE,     └── Redaction Engine
-                   └── ESXi (8x8GB)     Runners, K8s)
+  └── Proxmox VE   ├── ProxmoxLab  ├── Proxmox fixtures ├── ssh2 port 2222
+      (lab, mini,  │   (2x8GB max) │   (100-104, 9000s) ├── cli.sh / db vacuum
+       ibm64)      ├── ProxmoxMini └── CUCM, CUBE,      ├── migrate / logs
+                   │   (4x8GB max)     Runners, K8s     └── Redaction Engine
+                   └── ProxmoxIbm64
                           │
                           ▼
             [Lab Credential Resolver]
-            ├── Tier 1: Process Environment (LAB_PROXMOX_*, GOVC_*, LAB_VM_*)
+            ├── Tier 1: Process Environment (LAB_PROXMOX_*, LAB_VM_*)
             ├── Tier 2: Doppler REST API v3 (DOPPLER_TOKEN)
             └── Tier 3: In-Memory Mock Fallback / Offline Dev
 ```
@@ -73,13 +73,13 @@ than use the legacy Node VMID/name slot state when the bridge is unavailable.
 
 ## Key Features
 
-- **Multi-Hypervisor Fleet Management**: Polymorphic abstraction unifying Proxmox VE clusters (`proxmox-lab`, `proxmox-mini`) and VMware ESXi hosts (`esxi-intel-192-168-123-176`).
+- **Multi-Hypervisor Fleet Management**: Polymorphic abstraction over the Proxmox VE hosts (`proxmox-lab`, `proxmox-mini`, `proxmox-ibm64`). **ESXi is retired (operator decision 2026-10-15)**: no ESXi host is catalogued, registered, probed or polled; `GOVC_*`, `ALLOW_ESXI_SLOTS` and `ESXI_SCAN` are ignored; the `esxi-intel-192-168-123-176` id and `esxi` provider/hypervisor selectors are refused (canonical bridge, `list_hosts`, `list_inventory`) without contacting anything; the image ships no `govc`.
 - **Disposable VM Provisioning**: Give `proxmox_quick_provision` one resource size (`memoryMb`, `vcpus`, `diskGb`). Live capacity filters the homogeneous Proxmox pool, then the eligible host with the most free RAM (then the most free disk headroom, then host id) is selected; a plan with `hostAssetId: auto` resolves it from `host capacity` and pins it in the reviewed plan (`placement` in the result). If capacity cannot be read the canonical CLI keeps resolving `auto`. Apply repeats the reviewed explicit host, VMID, and operation ID.
 - **Thin-only guest disks (REL-1588, "never thick disks")**: Every disk `provision_vm`, `auto_provision_vm`, `proxmox_quick_provision`, `proxmox_import_qcow`, `claimed_import_qcow`, `host_migrate_vm` and `sandbox_clone` creates, clones, migrates or imports on Proxmox must be on thin storage: `lvmthin` (the `local-lvm` pool on both lab hosts), or a `zfspool` proven `sparse`. Anything else (`lvm`, `dir`, `nfs`, `iscsi`, unknown) is refused with the stable error code `THICK_STORAGE_REFUSED` before any claim, journal, clone, import or other Proxmox change. The storage type is read through the same `host capacity` path as `list_storage`; if it cannot be determined the request fails closed. An omitted `storage` is checked against the default pool (`local-lvm`). `importStorage` (the `dir` pool that only stages a downloaded image) is not a guest-disk target and is not restricted. This server never builds Proxmox disk options itself, so `discard=on` is owned by the canonical transports and templates.
 - **Resource-based Lease Admission**: There are no fixed per-host or global VM-count quotas. Fresh host health, physical free RAM, VM-image storage, and the requested guest size determine placement. Outstanding unprovisioned claims reserve their size under the claim mutex; backed running VMs are already reflected in physical usage. Unknown, offline, or insufficient resources fail closed.
   - Slots are retired (slot retirement ADR (REL-1746)); lab capacity is pure cluster capacity. `find_slot`, `claim_slot`, `release_slot` and `list_slots` remain only as deprecated aliases: they return their real result plus `deprecated: true` and the replacement (`list_hosts`, `create_appliance_claim`, `delete_appliance_claim`, `list_appliance_claims`). `purge_slots` and `pin_pool_slots` have no capacity equivalent and return an explicit `SLOT_VERB_RETIRED` error (not an internal failure) naming the replacement. `maxSlots`, `slot_limit` and `availableSlots` stay as deprecated numeric estimates and never gate admission.
-  - Host selection for provisioning ranks eligible Proxmox hosts by live free RAM, then free disk headroom (no random spread and no "Mini first" tier); ESXi remains a last-place opt-in fallback. A test-only `placementSeed` keeps its reproducible selection. `ferrum_fleet_metrics` reports free RAM/CPU/disk as the authoritative capacity and keeps `slotFloor`/`slotHardMax` as deprecated numbers.
-  - ESXi leasing remains explicitly opt-in; platform authorization and protected assets remain separate from resource availability.
+  - Host selection for provisioning ranks eligible Proxmox hosts by live free RAM, then free disk headroom (no random spread and no "Mini first" tier). A test-only `placementSeed` keeps its reproducible selection. `ferrum_fleet_metrics` reports free RAM/CPU/disk as the authoritative capacity and keeps `slotFloor`/`slotHardMax` as deprecated numbers.
+  - Platform authorization and protected assets remain separate from resource availability.
 - **Non-Bypassable Safety Guardrails**: Hard protection preventing destructive actions (`destroy`, `stop`, `reboot`) against core infrastructure:
   - Cisco Unified Communications Manager (CUCM 14 / 15 publishers and subscribers)
   - Cisco CUBE Voice Gateways / Cat8000v
@@ -88,11 +88,11 @@ than use the legacy Node VMID/name slot state when the bridge is unavailable.
   - VM Templates (VMIDs `9000`–`9999` or template flags)
   - SPA-1103 on minis VMID `182`, including cleanup of expired or untracked rows
 - **Physical Maintenance Shutdown**: `host_maintenance_shutdown` accepts one
-  exact canonical Proxmox or ESXi host. It plans by default; apply requires the
+  exact canonical Proxmox host. It plans by default; apply requires the
   reviewed plan digest and exact host confirmation, preflights credentials,
   gracefully drains catalog-matched unclaimed guests, shuts CUCM subscribers
   before publishers, and refuses active claims, partial discovery, identity
-  drift, clustered Proxmox, or an ESXi maintenance-mode failure. Force host
+  drift, or clustered Proxmox. Force host
   power-off is not implemented.
 - **Remote Appliance CLI Control**: Mediated execution of `cli.sh` commands over SSH (port 2222) for status inspection, health diagnostics, Ecto migrations, table vacuums, and container logs.
 - **Leased Remote Development**: `lab_dev` is a canonical-only façade for the `ct-local-dev-v1` profile. It supports strict `doctor`, `plan`, `prepare`, `start`, `status`, `sync`, `stop`, and `cleanup` actions bound to one asset, lease, Linear issue, operation ID, and reviewed receipt chain. It accepts no guest commands, remote paths, or mock fallback.
@@ -108,7 +108,7 @@ than use the legacy Node VMID/name slot state when the bridge is unavailable.
 - **Dynamic Secret Redaction**: Real-time masking prevents passwords, Doppler API tokens, and private keys from leaking into MCP responses or stderr logs.
 - **Dual Transports**: Clean standard I/O transport (`stdio`) and Express HTTP/SSE transport (`sse`) with `/health`, `/sse`, and `/messages` endpoints.
 - **3-Tier Credential Resolution**:
-  1. *Tier 1*: Direct Environment Variables (`LAB_PROXMOX_*`, `LAB_VM_CREDENTIALS_*`; ESXi `GOVC_*` is optional and retired)
+  1. *Tier 1*: Direct Environment Variables (`LAB_PROXMOX_*`, `LAB_VM_CREDENTIALS_*`; ESXi `GOVC_*` is ignored)
   2. *Tier 2*: Doppler Secrets REST API v3 (`DOPPLER_TOKEN`)
   3. *Tier 3*: In-Memory Mock Hypervisor & Appliance Fallback (for offline test suites)
 
@@ -218,8 +218,8 @@ its rows by exact host or hypervisor without creating another inventory. Exact
 host reads invoke `vm inventory --host-asset-id`, hypervisor reads invoke
 `vm inventory --hypervisor`, and only all-scope reads invoke
 `vm inventory --all`.
-Warnings are preserved, with the current singleton ESXi warning bound to its
-canonical host identity. Status, template, text, and tag projection remains
+Warnings are preserved. An unqualified read is scoped to Proxmox
+(`--hypervisor proxmox`); ESXi is retired and is never queried. Status, template, text, and tag projection remains
 unsupported until those fields have an authoritative canonical CLI contract.
 
 `list_storage` delegates to `lab-inventory host capacity --asset-id` once per
@@ -230,8 +230,6 @@ warnings; an exact-host failure or all-host failure remains fail-closed. The
 canonical CLI does not currently prove individual ISO, VM-disk, or backup
 volume contents, so `includeContent: true` returns
 `CANONICAL_DETAIL_UNSUPPORTED` without consulting legacy Node credentials.
-ESXi datastore `enabled`, `shared`, and content-capability fields are returned
-as `null` because the current canonical capacity contract does not expose them.
 
 `lab_mission` is the bounded façade for `lab-inventory mission run`. It accepts
 an immutable manifest path and canonical SHA-256, plans by default, and requires
@@ -504,22 +502,22 @@ at `http://<guest-ip>:80/api/xcc/<cube_id>`.
 The server registers 7 comprehensive tools conforming to the MCP JSON Schema specification:
 
 ### 1. `list_hosts`
-Query live free RAM/CPU/disk capacity, health, and deprecated resource-derived 8GB unit estimates across Proxmox VE (`proxmox-lab`, `proxmox-mini`) and VMware ESXi (`esxi-intel-192-168-123-176`).
+Query live free RAM/CPU/disk capacity, health, and deprecated resource-derived 8GB unit estimates across Proxmox VE (`proxmox-lab`, `proxmox-mini`, `proxmox-ibm64`). ESXi is retired and is refused.
 
 ```json
 {
-  "host": "all",              // "proxmox-lab" | "proxmox-mini" | "esxi-intel-192-168-123-176" | "all"
-  "hypervisorType": "all",    // "proxmox" | "esxi" | "all"
+  "host": "all",              // "proxmox-lab" | "proxmox-mini" | "proxmox-ibm64" | "all"
+  "hypervisorType": "all",    // "proxmox" | "all"
   "refresh": false            // boolean: force live hypervisor API poll
 }
 ```
 
 ### 2. `list_inventory`
-Query unified fleet inventory across Proxmox VE and VMware ESXi VMs with power status, IP addresses, VLAN, protected flags, release version, and Linear lease tags.
+Query unified fleet inventory across Proxmox VE VMs with power status, IP addresses, VLAN, protected flags, release version, and Linear lease tags.
 
 ```json
 {
-  "hypervisor": "all",        // "proxmox" | "esxi" | "all"
+  "hypervisor": "all",        // "proxmox" | "all"
   "host": "proxmox-mini",     // optional host filter
   "status": "all",            // "all" | "running" | "stopped" | "claimed" | "disposable"
   "includeTemplates": false,  // boolean (default: false)
@@ -535,8 +533,8 @@ Claim capacity on a specified host or the capacity-ranked eligible Proxmox host
 {
   "tag": "CTUAT-693",         // required string: issue tag or session identifier
   "linearIssue": "CTUAT-693", // Linear issue key
-  "host": "auto",             // "proxmox-lab" | "proxmox-mini" | "esxi-intel-192-168-123-176" | "auto"
-  "hypervisorType": "any",    // "proxmox" | "esxi" | "any"
+  "host": "auto",             // "proxmox-lab" | "proxmox-mini" | "proxmox-ibm64" | "auto"
+  "hypervisorType": "any",    // "proxmox" | "any"
   "durationMinutes": 60,      // integer (1 - 1440 minutes / 24 hours, default: 60)
   "purpose": "UAT Testing"    // optional description
 }
@@ -568,7 +566,7 @@ an exact `confirmAssetId` to execute the guarded release-and-destroy operation.
 ```
 
 ### 5. `provision_vm`
-Provision a new disposable Call Telemetry appliance VM on Proxmox VE or VMware ESXi from a base template with IP/VLAN networking and auto-attached 8GB slot lease.
+Provision a new disposable Call Telemetry appliance VM on Proxmox VE from a base template with IP/VLAN networking and auto-attached 8GB slot lease.
 
 ```json
 {
@@ -606,7 +604,7 @@ set, `target.vmid`, and `operation_id`. Copy those exact identities into apply;
 do not leave `hostAssetId` as `auto` for a mutating call.
 
 ### 6. `vm_action`
-Execute power lifecycle operations across Proxmox and ESXi with non-bypassable guardrails protecting core infrastructure.
+Execute power lifecycle operations across Proxmox with non-bypassable guardrails protecting core infrastructure.
 
 ```json
 {
@@ -646,10 +644,7 @@ After reviewing an eligible plan, apply the same immutable request:
 ```
 
 Proxmox apply verifies a standalone, fully drained node before requesting the
-supported node shutdown. ESXi apply verifies a fully drained host, enters
-maintenance mode without evacuation, then requests shutdown with `force=false`.
-Both require physical power-on for recovery; ESXi remains in maintenance mode
-until an operator verifies the host and exits it. Start CUCM publishers first,
+supported node shutdown. It requires physical power-on for recovery. Start CUCM publishers first,
 verify replication, then start subscribers.
 
 ### 7. `appliance_exec`
@@ -674,7 +669,7 @@ Execute mediated Call Telemetry appliance CLI operations over secure SSH on Port
 ## Client Configuration
 
 Credentials are inherited from the process environment. Do not put a Doppler
-token, Proxmox credential, ESXi password, or appliance password in checked-in
+token, Proxmox credential, or appliance password in checked-in
 MCP JSON. A GitHub token authorizes repository fetches only; it is not a
 Doppler token and cannot authenticate a hypervisor.
 
@@ -697,6 +692,28 @@ invents a mock transport. Repair the direct provider credentials or the
 config-scoped `DOPPLER_TOKEN`, then restart the client. SSE startup remains
 fail-closed.
 
+#### Troubleshooting `CREDENTIALS_UNAVAILABLE`
+
+A local stdio server only sees the environment its parent harness gave it.
+`DOPPLER_PROJECT` / `DOPPLER_CONFIG` are not credentials, and under the governed
+runtime wrapper (`tools/mcp-runtime-exec.mjs`) an exported `DOPPLER_TOKEN` is
+stripped before this process starts, so the Doppler API tier cannot resolve
+there. Call `credential_status`: when credentials are unavailable it prints the
+failure reason, which variable groups (`proxmox-lab`, `proxmox-mini`,
+`appliance-ssh`) reached the process (names only, never values), and the exact
+next steps. The usual fixes are:
+
+- add `doppler://<project>/<config>/<NAME>` references as the ct-lab entry's
+  `env` values in the harness MCP config (the wrapper resolves them through the
+  Doppler CLI with no login prompt; the reference is not a secret), or
+- start the harness itself under `doppler run --project ai-workspace --config dev --`.
+
+The aggregate resolver needs a shared appliance login (`LAB_VM_CREDENTIALS`, or
+`LAB_VM_CREDENTIALS_USERNAME` + `LAB_VM_CREDENTIALS_PASSWORD`). Per-VM
+`LAB_VM_CREDENTIALS_<UUID>` secrets belong to the canonical CLI and do not
+satisfy it. `list_hosts`, `list_inventory` and the ApplianceClaim tools do not
+need the aggregate bundle; legacy tools such as `list_slots` do.
+
 ### Governed Call Telemetry workspace
 
 Use the `ct-lab` plugin and its `launch-ct-lab-mcp.sh` entrypoint. Cursor

package/dist/bin/ct-lab-mcp.js

@@ -4,7 +4,7 @@
  *
  * Command-line runner supporting Stdio and HTTP/SSE transports,
  * Doppler credential resolution cascade, multi-hypervisor management
- * across Proxmox VE and VMware ESXi, remote appliance CLI control,
+ * across Proxmox VE, remote appliance CLI control,
  * and graceful lifecycle management.
  */
 import process from "node:process";
@@ -79,7 +79,7 @@ export function buildFleetCommand() {
         .requiredOption("--vcpus <n>", "Minimum vCPU count")
         .requiredOption("--disk-gb <gb>", "Minimum guest disk in GiB")
         .option("--host-asset-id <id>", "Restrict to a specific host asset ID")
-        .option("--hypervisor <type>", "Restrict to proxmox or esxi")
+        .option("--hypervisor <type>", "Restrict to proxmox (ESXi is retired)")
         .option("--format <fmt>", "Output format: json or table", "json")
         .action(async (opts) => {
         const bridge = new CanonicalLabBridge({ required: true });
@@ -143,11 +143,9 @@ export async function runPurgeDaemonCli(argv = process.argv) {
     const hypervisorManager = new MultiHypervisorManager({
         credentials: credentialsResult,
         proxmoxConfigs: credentialsResult?.proxmoxHosts,
-        esxiConfigs: credentialsResult?.esxiHosts,
     });
     const slotManager = new SlotManager({
         hypervisorManager,
-        includeEsxi: true,
     });
     slotManager.setHypervisorManager(hypervisorManager);
     const controller = new PurgeController({
@@ -321,7 +319,7 @@ export function buildCli(exitOverride = false) {
     const program = new Command();
     program
         .name("ct-lab-mcp")
-        .description("Expanded Model Context Protocol (MCP) server for Call Telemetry lab, fleet, and appliance management across Proxmox VE and VMware ESXi.")
+        .description("Expanded Model Context Protocol (MCP) server for Call Telemetry lab, fleet, and appliance management across Proxmox VE.")
         .version(VERSION, "-v, --version", "Output the current version")
         .helpOption("-h, --help", "Display help for command")
         .option("-t, --transport <type>", "Transport mode: 'stdio' or 'sse'", process.env.CT_LAB_MCP_TRANSPORT || process.env.PROXMOX_MCP_TRANSPORT || "stdio")
@@ -480,7 +478,6 @@ export async function runCli(argv = process.argv, runOptions = {}) {
         credentials: credentialsResult,
         credentialError,
         proxmoxConfigs: hostConfigs,
-        esxiConfigs: credentialsResult?.esxiHosts,
         forceMock: effectiveForceMock,
         canonicalBridge,
         plane: effectiveTransport === "sse" ? "local-sse" : "local-stdio",

package/dist/src/canonical/bridge.d.ts

@@ -11,6 +11,11 @@ export interface CanonicalLabBridgeOptions {
     credentials?: Pick<CredentialResolutionResult, "proxmoxHosts" | "esxiHosts">;
     runner?: (args: string[], options: CanonicalRunOptions) => Promise<CanonicalRunnerResult>;
 }
+/**
+ * ESXi is retired (operator decision 2026-10-15). A canonical command that names the esxi
+ * provider or the legacy ESXi host is refused before any process or runner is started.
+ */
+export declare function namesRetiredEsxi(args: string[]): boolean;
 export declare class CanonicalBridgeError extends Error {
     readonly code = "CANONICAL_INVENTORY_UNAVAILABLE";
     constructor(message: string);

package/dist/src/canonical/bridge.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../src/canonical/bridge.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,0BAA0B,EAG3B,MAAM,yBAAyB,CAAC;AAUjC,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,IAAI,CAAC,0BAA0B,EAAE,cAAc,GAAG,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC3F;AAmJD,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,qCAAqC;gBAEtC,OAAO,EAAE,MAAM;CAI5B;AAyFD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAW;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiE;IAC9F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsC;gBAElD,OAAO,GAAE,yBAA8B;IAcnD,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED,qEAAqE;IACrE,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,gBAAgB;IAUlB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAoJhF,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA2HvE"}
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../src/canonical/bridge.ts"],"names":[],"mappings":"AAEA,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,mBAAmB,EACnB,iBAAiB,EACjB,kBAAkB,EACnB,MAAM,YAAY,CAAC;AACpB,OAAO,KAAK,EAEV,0BAA0B,EAG3B,MAAM,yBAAyB,CAAC;AAUjC,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,8EAA8E;IAC9E,WAAW,CAAC,EAAE,IAAI,CAAC,0BAA0B,EAAE,cAAc,GAAG,WAAW,CAAC,CAAC;IAC7E,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,qBAAqB,CAAC,CAAC;CAC3F;AA4CD;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAKxD;AA+FD,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,qCAAqC;gBAEtC,OAAO,EAAE,MAAM;CAI5B;AAyFD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAW;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,kBAAkB,CAAS;IAC5C,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAiE;IAC9F,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsC;gBAElD,OAAO,GAAE,yBAA8B;IAcnD,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED,qEAAqE;IACrE,IAAI,UAAU,IAAI,OAAO,CAExB;IAED,OAAO,CAAC,2BAA2B;IAYnC,OAAO,CAAC,gBAAgB;IAUlB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,iBAAiB,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,sBAAsB,CAAC;IAuJhF,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA2HvE"}

package/dist/src/canonical/bridge.js

@@ -26,8 +26,17 @@ function delay(ms) {
     return new Promise((resolve) => setTimeout(resolve, ms));
 }
 const CANONICAL_PROXMOX_HOST_IDS = new Set(["proxmox-lab", "proxmox-mini", "proxmox-minis-lab"]);
-// ESXi is retired (REL-1722); its identity is only resolved for an explicit legacy ESXi selection.
-const CANONICAL_ESXI_HOST_IDS = new Set([LEGACY_ESXI_HOST_ID]);
+/**
+ * ESXi is retired (operator decision 2026-10-15). A canonical command that names the esxi
+ * provider or the legacy ESXi host is refused before any process or runner is started.
+ */
+export function namesRetiredEsxi(args) {
+    if (args[0] === "esxi")
+        return true;
+    const selector = commandValue(args, "--host-asset-id");
+    return selector.present && typeof selector.value === "string"
+        && (selector.value === LEGACY_ESXI_HOST_ID || selector.value.toLowerCase().startsWith("esxi"));
+}
 function canonicalHostAlias(hostId) {
     return hostId === "proxmox-mini" ? "proxmox-minis-lab" : hostId;
 }
@@ -58,26 +67,17 @@ function canonicalCommandScope(args) {
         if (hostSelector.duplicate || !hostSelector.value)
             return scope;
         const selectedHost = hostSelector.value;
-        const selectedProvider = CANONICAL_PROXMOX_HOST_IDS.has(selectedHost)
-            ? "proxmox"
-            : CANONICAL_ESXI_HOST_IDS.has(selectedHost)
-                ? "esxi"
-                : undefined;
+        const selectedProvider = CANONICAL_PROXMOX_HOST_IDS.has(selectedHost) ? "proxmox" : undefined;
         if (!selectedProvider)
             return scope;
         // Provider-specific commands must agree with the explicit host. Generic
         // commands (vm/fleet/etc.) may target either canonical provider.
-        if ((args[0] === "proxmox" || args[0] === "esxi") && args[0] !== selectedProvider) {
+        if (args[0] === "proxmox" && args[0] !== selectedProvider) {
             return scope;
         }
         scope.add(canonicalHostAlias(selectedHost));
         return scope;
     }
-    // ESXi has one canonical host in this bridge. It is safe to select only
-    // for its explicit provider command; every ambiguous/all-provider command
-    // remains direct-environment-only rather than widening credential scope.
-    if (args[0] === "esxi")
-        scope.add(LEGACY_ESXI_HOST_ID);
     return scope;
 }
 function ownedProcessGroupExists(child) {
@@ -251,7 +251,7 @@ export class CanonicalLabBridge {
         if (scope.size === 0)
             return {};
         const selectedId = scope.values().next().value;
-        const host = this.credentials.proxmoxHosts.find((candidate) => canonicalHostAlias(candidate.id) === selectedId) || this.credentials.esxiHosts.find((candidate) => candidate.id === selectedId);
+        const host = this.credentials.proxmoxHosts.find((candidate) => canonicalHostAlias(candidate.id) === selectedId);
         return host ? canonicalEnvironmentForHost(host) : {};
     }
     childEnvironment(args) {
@@ -268,6 +268,9 @@ export class CanonicalLabBridge {
         if (!this.isConfigured) {
             throw new CanonicalBridgeError("canonical lab CLI is not configured");
         }
+        if (namesRetiredEsxi(args)) {
+            throw new CanonicalBridgeError("ESXi is retired (the lab is Proxmox only); the canonical command was not run");
+        }
         const command = [
             ...(this.inventoryFile ? ["--file", this.inventoryFile] : []),
             ...args,

package/dist/src/canonical/bridge.js.map

@@ -1 +1 @@
-{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../../src/canonical/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAe3C,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAC3C,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AA0BzC,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB;IAClE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9E,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAyB;IACxD,OAAO,IAAI,CAAC,GAAG,CACb,eAAe,CAAC,KAAK,EAAE,4BAA4B,CAAC,EACpD,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAmC,EACnC,UAAkC,EAClC,QAAQ,GAAG,KAAK;IAEhB,0EAA0E;IAC1E,wEAAwE;IACxE,4CAA4C;IAC5C,IAAI,QAAQ;QAAE,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,UAAU;QAAE,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;AACjG,mGAAmG;AACnG,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC;AAE/D,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,IAAc,EAAE,IAAY;IAKhD,MAAM,OAAO,GAAG,IAAI;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACpD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,IAAc;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC3D,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,YAAY,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEhE,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC;QACxC,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,GAAG,CAAC,YAAY,CAAC;YACnE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,uBAAuB,CAAC,GAAG,CAAC,YAAY,CAAC;gBACzC,CAAC,CAAC,MAAM;gBACR,CAAC,CAAC,SAAS,CAAC;QAChB,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAEpC,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAClF,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,KAAK,CAAC,GAAG,CAAC,mBAAmB,CAAC,CAAC;IACvD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAmB;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,IAAI,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAmB,EAAE,MAAsB;IAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAAmB,EAAE,SAAiB;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAAmB,EAAE,OAAe;IAC5E,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1C,IAAI,MAAM,4BAA4B,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,OAAO;IAC/D,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,4BAA4B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,iCAAiC,CAAC;IAElD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,UAAU,GAAG,oFAAoF,CAAC;AACxG,MAAM,YAAY,GAAG,+HAA+H,CAAC;AACrJ,4DAA4D;AAC5D,+EAA+E;AAC/E,4EAA4E;AAC5E,kDAAkD;AAClD,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AAC9D,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,0BAA0B;IAC1B,iDAAiD;IACjD,uCAAuC;IACvC,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,sDAAsD;IACtD,0CAA0C;IAC1C,6CAA6C;IAC7C,kDAAkD;IAClD,qDAAqD;IACrD,wCAAwC;IACxC,2CAA2C;IAC3C,6CAA6C;IAC7C,iDAAiD;IACjD,iCAAiC;IACjC,mCAAmC;IACnC,oCAAoC;CACrC,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,mBAAmB;IACnB,mBAAmB;CACpB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,CAAC,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,GAAY;IACzD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC;SACvC,OAAO,CAAC,uKAAuK,EAAE,gBAAgB,CAAC;SAClM,OAAO,CAAC,qDAAqD,EAAE,cAAc,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,GAAY;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,yDAAyD;QACzD,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnE,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,SAAS,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ;gBAC3E,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,sEAAsE;IACtE,qEAAqE;IACrE,2EAA2E;IAC3E,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,OAAO,kBAAkB;IACZ,OAAO,CAAU;IACjB,aAAa,CAAU;IACvB,UAAU,CAAW;IACrB,SAAS,CAAS;IAClB,kBAAkB,CAAS;IAC3B,QAAQ,CAAU;IAClB,WAAW,CAAkE;IAC7E,MAAM,CAAuC;IAE9D,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC7E,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,eAAe,CAC9B,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EACpE,kBAAkB,CACnB,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,uBAAuB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,CAAC;QAClF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,qEAAqE;IACrE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,2BAA2B,CAAC,IAAc;QAChD,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAC7C,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,UAAU,CAC/D,IAAI,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,CAAC,EAAE,KAAK,UAAU,CAAC,CAAC;QACjF,OAAO,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IAEO,gBAAgB,CAAC,IAAc;QACrC,MAAM,WAAW,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,qEAAqE;QACrE,wEAAwE;QACxE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,iBAA0B;QAClD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,kBAAkB,GAAG,eAAe,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9E,MAAM,cAAc,GAAG,yCAAyC,kBAAkB,IAAI,CAAC;QAEvF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAwB;gBACnC,SAAS,EAAE,kBAAkB;gBAC7B,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;gBAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;YACF,MAAM,aAAa,GAA2B,OAAO,CAAC,OAAO,EAAE;iBAC5D,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;iBAC1C,IAAI,CACH,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EACxC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CACtC,CAAC;YACJ,IAAI,aAAyC,CAAC;YAC9C,MAAM,cAAc,GAAG,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,EAAE;gBAClE,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;oBAC5C,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/B,CAAC,EAAE,kBAAkB,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;YACpE,IAAI,aAAa;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,OAAO,CAAC,KAAK,CAAC;YAClD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO;oBACL,OAAO;oBACP,QAAQ,EAAE,kBAAkB,CAC1B,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,OAAO,CAAC,MAAM,CAAC,UAAU,EACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CACjC;oBACD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/E,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBACrC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM;wBACvD,CAAC,CAAC,cAAc;wBAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBACxC,aAAa;gBACb,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACrD,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,cAAc,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,OAAO;gBACL,OAAO;gBACP,QAAQ,EAAE,kBAAkB,CAC1B,cAAc,EAAE,QAAQ,EACxB,cAAc,EAAE,UAAU,EAC1B,IAAI,CACL;gBACD,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,IAAI,EAAE,CAAC;gBAC5C,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QAED,IAAI,KAA+B,CAAC;QACpC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;YAC7D,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,YAAiB,CAAC;YACtB,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,EAAE;gBAC7D,oEAAoE;gBACpE,qEAAqE;gBACrE,qDAAqD;gBACrD,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,CAAC,MAA2B,EAAE,KAAsB,EAAE,EAAE;gBAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC9B,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,WAAW,GAAG,gBAAgB,EAAE,CAAC;oBACnC,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,cAAc,GAAG,IAAI,CAAC;wBACtB,YAAY,GAAG,IAAI,KAAK,CAAC,kCAAkC,gBAAgB,eAAe,CAAC,CAAC;wBAC5F,uBAAuB,CAAC,KAAM,EAAE,SAAS,CAAC,CAAC;oBAC7C,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,IAAI,MAAM,KAAK,QAAQ;oBAAE,MAAM,IAAI,IAAI,CAAC;;oBACnC,MAAM,IAAI,IAAI,CAAC;YACtB,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACnE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,YAAY,GAAG,KAAK,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE;gBAC3C,OAAO,CAAC;oBACN,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC;oBAClD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,MAAM;oBACN,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,aAAyC,CAAC;QAC9C,MAAM,cAAc,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;YACjE,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACrE,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAE/C,IAAI,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC9B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,0BAA0B,CAAC,KAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACnC,cAAc;YACd,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACrD,CAAC,CAAC;QACH,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxE,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,CAAC;YACvC,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAwB;QACtC,MAAM,IAAI,GAAqE;YAC7E,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO;oBACL,GAAG,IAAI;oBACP,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,eAAe;oBAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;oBACnG,OAAO,EAAE,qCAAqC;iBAC/C,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QACpC,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,WAAW;gBACtB,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;gBACnG,OAAO,EAAE,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,IAAI,uCAAuC;gBACxF,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAClC,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;gBAClG,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,yCAAyC;gBACxF,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YAC/B,QAAQ;YACR,MAAM;YACN,YAAY;YACZ,KAAK,CAAC,OAAO;YACb,yBAAyB;YACzB,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QACpC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAS1C,CAAC;YACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC7E,SAAS,GAAG,OAAO,CACjB,KAAK;mBACF,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO;mBAChC,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;mBACrE,KAAK,CAAC,QAAQ;mBACd,KAAK,CAAC,aAAa,KAAK,QAAQ;mBAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;mBACvB,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;mBACnB,KAAK,CAAC,aAAa,KAAK,MAAM;mBAC9B,SAAS,CAAC,QAAQ,KAAK,CAAC,CAC5B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,WAAW;gBACtB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;gBACjG,OAAO,EAAE,SAAS,CAAC,MAAM,IAAI,oEAAoE;gBACjG,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YACjC,OAAO;YACP,UAAU;YACV,YAAY;YACZ,KAAK,CAAC,OAAO;YACb,UAAU;YACV,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;QACxC,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,aAAa;gBACxB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE;gBAChG,OAAO,EAAE,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,IAAI,mCAAmC;gBACxF,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE;SAChG,CAAC;IACJ,CAAC;CACF"}
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../../src/canonical/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAe3C,OAAO,EAAE,2BAA2B,EAAE,MAAM,4BAA4B,CAAC;AACzE,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AACvD,OAAO,EAAE,mBAAmB,EAAE,MAAM,gCAAgC,CAAC;AAErE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,4BAA4B,GAAG,KAAK,CAAC;AAC3C,MAAM,wBAAwB,GAAG,MAAM,CAAC;AACxC,MAAM,gBAAgB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,CAAC;AA0BzC,SAAS,eAAe,CAAC,KAAyB,EAAE,QAAgB;IAClE,OAAO,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAM,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;AAC9E,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAyB;IACxD,OAAO,IAAI,CAAC,GAAG,CACb,eAAe,CAAC,KAAK,EAAE,4BAA4B,CAAC,EACpD,wBAAwB,CACzB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CACzB,QAAmC,EACnC,UAAkC,EAClC,QAAQ,GAAG,KAAK;IAEhB,0EAA0E;IAC1E,wEAAwE;IACxE,4CAA4C;IAC5C,IAAI,QAAQ;QAAE,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACnF,IAAI,UAAU;QAAE,OAAO,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;IACrF,OAAO,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AACrD,CAAC;AAED,SAAS,KAAK,CAAC,EAAU;IACvB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAC3D,CAAC;AAED,MAAM,0BAA0B,GAAG,IAAI,GAAG,CAAC,CAAC,aAAa,EAAE,cAAc,EAAE,mBAAmB,CAAC,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAc;IAC7C,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC;IACpC,MAAM,QAAQ,GAAG,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IACvD,OAAO,QAAQ,CAAC,OAAO,IAAI,OAAO,QAAQ,CAAC,KAAK,KAAK,QAAQ;WACxD,CAAC,QAAQ,CAAC,KAAK,KAAK,mBAAmB,IAAI,QAAQ,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;AACnG,CAAC;AAED,SAAS,kBAAkB,CAAC,MAAc;IACxC,OAAO,MAAM,KAAK,cAAc,CAAC,CAAC,CAAC,mBAAmB,CAAC,CAAC,CAAC,MAAM,CAAC;AAClE,CAAC;AAED,SAAS,YAAY,CAAC,IAAc,EAAE,IAAY;IAKhD,MAAM,OAAO,GAAG,IAAI;SACjB,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;SACpD,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC;IACjC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACtE,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC;IACzB,OAAO;QACL,OAAO,EAAE,IAAI;QACb,SAAS,EAAE,OAAO,CAAC,MAAM,GAAG,CAAC;QAC7B,KAAK,EAAE,IAAI,CAAC,KAAK,GAAG,CAAC,CAAC;KACvB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,qBAAqB,CAAC,IAAc;IAC3C,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,YAAY,GAAG,YAAY,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC;IAC3D,IAAI,YAAY,CAAC,OAAO,EAAE,CAAC;QACzB,mEAAmE;QACnE,uEAAuE;QACvE,IAAI,YAAY,CAAC,SAAS,IAAI,CAAC,YAAY,CAAC,KAAK;YAAE,OAAO,KAAK,CAAC;QAEhE,MAAM,YAAY,GAAG,YAAY,CAAC,KAAK,CAAC;QACxC,MAAM,gBAAgB,GAAG,0BAA0B,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC;QAC9F,IAAI,CAAC,gBAAgB;YAAE,OAAO,KAAK,CAAC;QAEpC,wEAAwE;QACxE,iEAAiE;QACjE,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,SAAS,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,gBAAgB,EAAE,CAAC;YAC1D,OAAO,KAAK,CAAC;QACf,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,kBAAkB,CAAC,YAAY,CAAC,CAAC,CAAC;QAC5C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAmB;IAClD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;YAC5B,OAAO,IAAI,CAAC;QACd,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,IAAI,KAAK,OAAO;gBAAE,OAAO,KAAK,CAAC;YAC1C,OAAO,IAAI,CAAC;QACd,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,KAAK,CAAC,UAAU,KAAK,IAAI,CAAC;AAC9D,CAAC;AAED,SAAS,uBAAuB,CAAC,KAAmB,EAAE,MAAsB;IAC1E,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,CAAC;QAC9C,IAAI,CAAC;YACH,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjC,OAAO;QACT,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,IAAI,KAAK,EAAE,IAAI,KAAK,OAAO,EAAE,CAAC;gBAC5B,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;YACrB,CAAC;YACD,OAAO;QACT,CAAC;IACH,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACrB,CAAC;AAED,KAAK,UAAU,4BAA4B,CAAC,KAAmB,EAAE,SAAiB;IAChF,MAAM,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC;IACxC,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QAC7B,IAAI,CAAC,uBAAuB,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,QAAQ,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;IAChE,CAAC;IACD,OAAO,CAAC,uBAAuB,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED,KAAK,UAAU,0BAA0B,CAAC,KAAmB,EAAE,OAAe;IAC5E,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1C,IAAI,MAAM,4BAA4B,CAAC,KAAK,EAAE,OAAO,CAAC;QAAE,OAAO;IAC/D,uBAAuB,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;IAC1C,MAAM,4BAA4B,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;AACrD,CAAC;AAED,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,iCAAiC,CAAC;IAElD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,MAAM,UAAU,GAAG,oFAAoF,CAAC;AACxG,MAAM,YAAY,GAAG,+HAA+H,CAAC;AACrJ,4DAA4D;AAC5D,+EAA+E;AAC/E,4EAA4E;AAC5E,kDAAkD;AAClD,MAAM,iBAAiB,GAAG,mCAAmC,CAAC;AAC9D,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACvC,0BAA0B;IAC1B,iDAAiD;IACjD,uCAAuC;IACvC,4CAA4C;IAC5C,+CAA+C;IAC/C,+CAA+C;IAC/C,sDAAsD;IACtD,0CAA0C;IAC1C,6CAA6C;IAC7C,kDAAkD;IAClD,qDAAqD;IACrD,wCAAwC;IACxC,2CAA2C;IAC3C,6CAA6C;IAC7C,iDAAiD;IACjD,iCAAiC;IACjC,mCAAmC;IACnC,oCAAoC;CACrC,CAAC,CAAC;AACH,MAAM,uBAAuB,GAAG,IAAI,GAAG,CAAC;IACtC,mBAAmB;IACnB,mBAAmB;CACpB,CAAC,CAAC;AAEH,SAAS,WAAW,CAAC,GAAW;IAC9B,OAAO,CAAC,oCAAoC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACjF,CAAC;AAED,SAAS,sBAAsB,CAAC,KAAa,EAAE,GAAY;IACzD,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,wBAAwB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IACjE,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,uBAAuB,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC/D,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,qBAAqB,CAAC,KAAa;IAC1C,OAAO,eAAe,CAAC,YAAY,CAAC,KAAK,CAAC;SACvC,OAAO,CAAC,uKAAuK,EAAE,gBAAgB,CAAC;SAClM,OAAO,CAAC,qDAAqD,EAAE,cAAc,CAAC,CAAC;AACpF,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc,EAAE,GAAY;IACxD,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,wEAAwE;QACxE,yEAAyE;QACzE,qEAAqE;QACrE,IAAI,sBAAsB,CAAC,KAAK,EAAE,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACrD,sEAAsE;QACtE,0EAA0E;QAC1E,wEAAwE;QACxE,yDAAyD;QACzD,OAAO,GAAG,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YACnE,CAAC,CAAC,KAAK;YACP,CAAC,CAAC,qBAAqB,CAAC,KAAK,CAAC,CAAC;IACnC,CAAC;IACD,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjF,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACvC,MAAM,SAAS,GAA4B,EAAE,CAAC;QAC9C,KAAK,MAAM,CAAC,QAAQ,EAAE,UAAU,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAC3D,SAAS,CAAC,QAAQ,CAAC,GAAG,WAAW,CAAC,QAAQ,CAAC,IAAI,OAAO,UAAU,KAAK,QAAQ;gBAC3E,CAAC,CAAC,YAAY;gBACd,CAAC,CAAC,oBAAoB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;QACjD,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,sEAAsE;IACtE,qEAAqE;IACrE,2EAA2E;IAC3E,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,SAAS,CAAC,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC,CAAC,CAAC;IAC3E,CAAC;IAAC,MAAM,CAAC;QACP,+DAA+D;QAC/D,OAAO,qBAAqB,CAAC,IAAI,CAAC,CAAC;IACrC,CAAC;AACH,CAAC;AAED,MAAM,OAAO,kBAAkB;IACZ,OAAO,CAAU;IACjB,aAAa,CAAU;IACvB,UAAU,CAAW;IACrB,SAAS,CAAS;IAClB,kBAAkB,CAAS;IAC3B,QAAQ,CAAU;IAClB,WAAW,CAAkE;IAC7E,MAAM,CAAuC;IAE9D,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC7E,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,eAAe,CAC9B,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,EACpE,kBAAkB,CACnB,CAAC;QACF,IAAI,CAAC,kBAAkB,GAAG,uBAAuB,CAAC,OAAO,CAAC,kBAAkB,CAAC,CAAC;QAC9E,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,CAAC;QAClF,IAAI,CAAC,WAAW,GAAG,OAAO,CAAC,WAAW,CAAC;QACvC,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,qEAAqE;IACrE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAEO,2BAA2B,CAAC,IAAc;QAChD,IAAI,CAAC,IAAI,CAAC,WAAW;YAAE,OAAO,EAAE,CAAC;QACjC,MAAM,KAAK,GAAG,qBAAqB,CAAC,IAAI,CAAC,CAAC;QAC1C,IAAI,KAAK,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,CAAC;QAEhC,MAAM,UAAU,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,KAAe,CAAC;QACzD,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,IAAI,CAC7C,CAAC,SAAS,EAAE,EAAE,CAAC,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC,KAAK,UAAU,CAC/D,CAAC;QACF,OAAO,IAAI,CAAC,CAAC,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC;IAEO,gBAAgB,CAAC,IAAc;QACrC,MAAM,WAAW,GAAsB,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;QAC1D,qEAAqE;QACrE,wEAAwE;QACxE,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,2BAA2B,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;YAClF,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC;gBAAE,WAAW,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;QAClD,CAAC;QACD,OAAO,WAAW,CAAC;IACrB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAc,EAAE,iBAA0B;QAClD,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,gBAAgB,CAAC,IAAI,CAAC,EAAE,CAAC;YAC3B,MAAM,IAAI,oBAAoB,CAAC,8EAA8E,CAAC,CAAC;QACjH,CAAC;QAED,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,IAAI;SACR,CAAC;QAEF,MAAM,kBAAkB,GAAG,eAAe,CAAC,iBAAiB,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QAC9E,MAAM,cAAc,GAAG,yCAAyC,kBAAkB,IAAI,CAAC;QAEvF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;YACzC,MAAM,OAAO,GAAwB;gBACnC,SAAS,EAAE,kBAAkB;gBAC7B,YAAY,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,kBAAkB;gBAC7C,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC;YACF,MAAM,aAAa,GAA2B,OAAO,CAAC,OAAO,EAAE;iBAC5D,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,MAAO,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;iBAC1C,IAAI,CACH,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EACxC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CACtC,CAAC;YACJ,IAAI,aAAyC,CAAC;YAC9C,MAAM,cAAc,GAAG,IAAI,OAAO,CAAsB,CAAC,OAAO,EAAE,EAAE;gBAClE,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE;oBAC9B,UAAU,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,cAAc,CAAC,CAAC,CAAC;oBAC5C,OAAO,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;gBAC/B,CAAC,EAAE,kBAAkB,CAAC,CAAC;YACzB,CAAC,CAAC,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,aAAa,EAAE,cAAc,CAAC,CAAC,CAAC;YACpE,IAAI,aAAa;gBAAE,YAAY,CAAC,aAAa,CAAC,CAAC;YAC/C,IAAI,OAAO,CAAC,IAAI,KAAK,OAAO;gBAAE,MAAM,OAAO,CAAC,KAAK,CAAC;YAClD,IAAI,OAAO,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;gBAC9B,OAAO;oBACL,OAAO;oBACP,QAAQ,EAAE,kBAAkB,CAC1B,OAAO,CAAC,MAAM,CAAC,QAAQ,EACvB,OAAO,CAAC,MAAM,CAAC,UAAU,EACzB,OAAO,CAAC,MAAM,CAAC,QAAQ,KAAK,IAAI,CACjC;oBACD,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAC/E,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBACrC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM;wBACvD,CAAC,CAAC,cAAc;wBAChB,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;oBACjC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;iBACvD,CAAC;YACJ,CAAC;YAED,MAAM,cAAc,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;gBACxC,aAAa;gBACb,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;aACrD,CAAC,CAAC;YACH,MAAM,cAAc,GAAG,cAAc,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;YAC7F,OAAO;gBACL,OAAO;gBACP,QAAQ,EAAE,kBAAkB,CAC1B,cAAc,EAAE,QAAQ,EACxB,cAAc,EAAE,UAAU,EAC1B,IAAI,CACL;gBACD,GAAG,CAAC,cAAc,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,cAAc,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAChF,MAAM,EAAE,MAAM,CAAC,cAAc,EAAE,MAAM,IAAI,EAAE,CAAC;gBAC5C,MAAM,EAAE,cAAc;gBACtB,QAAQ,EAAE,IAAI;aACf,CAAC;QACJ,CAAC;QAED,IAAI,KAA+B,CAAC;QACpC,MAAM,cAAc,GAAG,IAAI,OAAO,CAAiB,CAAC,OAAO,EAAE,EAAE;YAC7D,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,MAAM,GAAG,EAAE,CAAC;YAChB,IAAI,WAAW,GAAG,CAAC,CAAC;YACpB,IAAI,YAAiB,CAAC;YACtB,IAAI,cAAc,GAAG,KAAK,CAAC;YAC3B,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,OAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,EAAE;gBAC7D,oEAAoE;gBACpE,qEAAqE;gBACrE,qDAAqD;gBACrD,GAAG,EAAE,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC;gBAChC,QAAQ,EAAE,OAAO,CAAC,QAAQ,KAAK,OAAO;gBACtC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YACH,MAAM,YAAY,GAAG,CAAC,MAA2B,EAAE,KAAsB,EAAE,EAAE;gBAC3E,MAAM,IAAI,GAAG,KAAK,CAAC,QAAQ,EAAE,CAAC;gBAC9B,WAAW,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;gBACvC,IAAI,WAAW,GAAG,gBAAgB,EAAE,CAAC;oBACnC,IAAI,CAAC,cAAc,EAAE,CAAC;wBACpB,cAAc,GAAG,IAAI,CAAC;wBACtB,YAAY,GAAG,IAAI,KAAK,CAAC,kCAAkC,gBAAgB,eAAe,CAAC,CAAC;wBAC5F,uBAAuB,CAAC,KAAM,EAAE,SAAS,CAAC,CAAC;oBAC7C,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,IAAI,MAAM,KAAK,QAAQ;oBAAE,MAAM,IAAI,IAAI,CAAC;;oBACnC,MAAM,IAAI,IAAI,CAAC;YACtB,CAAC,CAAC;YACF,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACnE,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,CAAC;YACnE,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;gBAC5B,YAAY,GAAG,KAAK,CAAC;YACvB,CAAC,CAAC,CAAC;YACH,KAAK,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,UAAU,EAAE,EAAE;gBAC3C,OAAO,CAAC;oBACN,GAAG,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBAChD,QAAQ,EAAE,kBAAkB,CAAC,QAAQ,EAAE,UAAU,CAAC;oBAClD,GAAG,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;oBACrC,MAAM;oBACN,MAAM;iBACP,CAAC,CAAC;YACL,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;QACH,IAAI,aAAyC,CAAC;QAC9C,MAAM,cAAc,GAAG,IAAI,OAAO,CAAqB,CAAC,OAAO,EAAE,EAAE;YACjE,aAAa,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,EAAE,kBAAkB,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,cAAc,CAAC,CAAC,CAAC;QACrE,IAAI,aAAa;YAAE,YAAY,CAAC,aAAa,CAAC,CAAC;QAE/C,IAAI,CAAC,CAAC,UAAU,IAAI,OAAO,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,OAAO;gBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACjE,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC;gBAC9B,MAAM,EAAE,MAAM,CAAC,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC;aAC/D,CAAC;QACJ,CAAC;QAED,MAAM,0BAA0B,CAAC,KAAM,EAAE,IAAI,CAAC,kBAAkB,CAAC,CAAC;QAClE,MAAM,SAAS,GAAG,MAAM,OAAO,CAAC,IAAI,CAAC;YACnC,cAAc;YACd,KAAK,CAAC,IAAI,CAAC,kBAAkB,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC;SACrD,CAAC,CAAC;QACH,OAAO;YACL,OAAO;YACP,QAAQ,EAAE,SAAS,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;YACxE,GAAG,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC,CAAC,EAAE,UAAU,EAAE,SAAS,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,MAAM,EAAE,MAAM,CAAC,SAAS,EAAE,MAAM,IAAI,EAAE,CAAC;YACvC,MAAM,EAAE,cAAc;YACtB,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAwB;QACtC,MAAM,IAAI,GAAqE;YAC7E,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO;oBACL,GAAG,IAAI;oBACP,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,eAAe;oBAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;oBACnG,OAAO,EAAE,qCAAqC;iBAC/C,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QACpC,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,WAAW;gBACtB,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;gBACnG,OAAO,EAAE,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,IAAI,uCAAuC;gBACxF,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAClC,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;gBAClG,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,yCAAyC;gBACxF,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC;QACJ,CAAC;QAED,qEAAqE;QACrE,sEAAsE;QACtE,iEAAiE;QACjE,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YAC/B,QAAQ;YACR,MAAM;YACN,YAAY;YACZ,KAAK,CAAC,OAAO;YACb,yBAAyB;YACzB,UAAU;SACX,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QACpC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAS1C,CAAC;YACF,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC;YAC5B,MAAM,MAAM,GAAG,KAAK,EAAE,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC;YAC7E,SAAS,GAAG,OAAO,CACjB,KAAK;mBACF,KAAK,CAAC,QAAQ,KAAK,KAAK,CAAC,OAAO;mBAChC,KAAK,CAAC,YAAY,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE;mBACrE,KAAK,CAAC,QAAQ;mBACd,KAAK,CAAC,aAAa,KAAK,QAAQ;mBAChC,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC;mBACvB,MAAM,GAAG,IAAI,CAAC,GAAG,EAAE;mBACnB,KAAK,CAAC,aAAa,KAAK,MAAM;mBAC9B,SAAS,CAAC,QAAQ,KAAK,CAAC,CAC5B,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,WAAW;gBACtB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;gBACjG,OAAO,EAAE,SAAS,CAAC,MAAM,IAAI,oEAAoE;gBACjG,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YACjC,OAAO;YACP,UAAU;YACV,YAAY;YACZ,KAAK,CAAC,OAAO;YACb,UAAU;YACV,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;QACxC,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,aAAa;gBACxB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE;gBAChG,OAAO,EAAE,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,IAAI,mCAAmC;gBACxF,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE;SAChG,CAAC;IACJ,CAAC;CACF"}

package/dist/src/credentials/index.d.ts

@@ -1,4 +1,5 @@
 export * from "./types.js";
 export * from "./doppler.js";
 export * from "./resolver.js";
+export * from "./remediation.js";
 //# sourceMappingURL=index.d.ts.map

package/dist/src/credentials/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC"}

package/dist/src/credentials/index.js

@@ -1,4 +1,5 @@
 export * from "./types.js";
 export * from "./doppler.js";
 export * from "./resolver.js";
+export * from "./remediation.js";
 //# sourceMappingURL=index.js.map

package/dist/src/credentials/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/credentials/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,cAAc,CAAC;AAC7B,cAAc,eAAe,CAAC;AAC9B,cAAc,kBAAkB,CAAC"}

package/dist/src/credentials/remediation.d.ts

@@ -0,0 +1,33 @@
+/**
+ * Actionable credential remediation for credential_status and the
+ * CREDENTIALS_UNAVAILABLE gate.
+ *
+ * The resolver's own `remediation` string is generic (and leads with mock
+ * mode). In a governed local-stdio install the failure is almost always the
+ * same: the harness that spawned this process never injected the lab
+ * variables, and the governed runtime wrapper strips DOPPLER_TOKEN so the
+ * Tier-2 Doppler path is unreachable. This module inspects which variable
+ * groups the process actually received (names only, never values) and says
+ * exactly what to change.
+ */
+import type { CredentialResolutionError } from "./errors.js";
+export interface CredentialGroupStatus {
+    group: "proxmox-lab" | "proxmox-mini" | "appliance-ssh";
+    present: boolean;
+    /** Variable names that satisfy this group (name-only; never values). */
+    needs: string;
+}
+export interface CredentialRemediation {
+    /** One sentence naming the concrete gap; safe to embed in an error. */
+    headline: string;
+    /** Ordered, copy-pasteable steps. Never contains a secret value. */
+    steps: string[];
+    /** Which variable groups the aggregate resolver found in this process. */
+    inspected: CredentialGroupStatus[];
+    dopplerTokenInProcess: boolean;
+}
+type Env = Record<string, string | undefined>;
+export declare function inspectCredentialEnvironment(env?: Env): CredentialGroupStatus[];
+export declare function buildCredentialRemediation(error: Pick<CredentialResolutionError, "reason" | "missing" | "message"> | undefined, env?: Env): CredentialRemediation;
+export {};
+//# sourceMappingURL=remediation.d.ts.map

package/dist/src/credentials/remediation.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.d.ts","sourceRoot":"","sources":["../../../src/credentials/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,KAAK,EAAE,yBAAyB,EAAE,MAAM,aAAa,CAAC;AAE7D,MAAM,WAAW,qBAAqB;IACpC,KAAK,EAAE,aAAa,GAAG,cAAc,GAAG,eAAe,CAAC;IACxD,OAAO,EAAE,OAAO,CAAC;IACjB,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,qBAAqB;IACpC,uEAAuE;IACvE,QAAQ,EAAE,MAAM,CAAC;IACjB,oEAAoE;IACpE,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,0EAA0E;IAC1E,SAAS,EAAE,qBAAqB,EAAE,CAAC;IACnC,qBAAqB,EAAE,OAAO,CAAC;CAChC;AAED,KAAK,GAAG,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC;AAe9C,wBAAgB,4BAA4B,CAAC,GAAG,GAAE,GAAiB,GAAG,qBAAqB,EAAE,CAqB5F;AAcD,wBAAgB,0BAA0B,CACxC,KAAK,EAAE,IAAI,CAAC,yBAAyB,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC,GAAG,SAAS,EACpF,GAAG,GAAE,GAAiB,GACrB,qBAAqB,CAqEvB"}

package/dist/src/credentials/remediation.js

@@ -0,0 +1,105 @@
+/**
+ * Actionable credential remediation for credential_status and the
+ * CREDENTIALS_UNAVAILABLE gate.
+ *
+ * The resolver's own `remediation` string is generic (and leads with mock
+ * mode). In a governed local-stdio install the failure is almost always the
+ * same: the harness that spawned this process never injected the lab
+ * variables, and the governed runtime wrapper strips DOPPLER_TOKEN so the
+ * Tier-2 Doppler path is unreachable. This module inspects which variable
+ * groups the process actually received (names only, never values) and says
+ * exactly what to change.
+ */
+const set = (env, key) => typeof env[key] === "string" && env[key].length > 0;
+const anySet = (env, keys) => keys.some((key) => set(env, key));
+function proxmoxGroupPresent(env, prefix) {
+    const endpoint = anySet(env, [`${prefix}URL`, `${prefix}BASE_URL`, `${prefix}HOST`, `${prefix}IP`]);
+    const auth = set(env, `${prefix}API_TOKEN`) ||
+        (anySet(env, [`${prefix}TOKEN_ID`, `${prefix}API_TOKEN_ID`]) &&
+            anySet(env, [`${prefix}TOKEN_SECRET`, `${prefix}API_TOKEN_SECRET`])) ||
+        (anySet(env, [`${prefix}USERNAME`, `${prefix}USER`]) && anySet(env, [`${prefix}PASSWORD`, `${prefix}PASS`]));
+    return endpoint && auth;
+}
+export function inspectCredentialEnvironment(env = process.env) {
+    return [
+        {
+            group: "proxmox-lab",
+            present: proxmoxGroupPresent(env, "LAB_PROXMOX_"),
+            needs: "LAB_PROXMOX_URL (or _HOST) + LAB_PROXMOX_API_TOKEN (or _USERNAME/_PASSWORD)",
+        },
+        {
+            group: "proxmox-mini",
+            present: proxmoxGroupPresent(env, "LAB_PROXMOX_MINIS_") || proxmoxGroupPresent(env, "LAB_PROXMOX_MINI_"),
+            needs: "LAB_PROXMOX_MINIS_URL (or _HOST) + LAB_PROXMOX_MINIS_API_TOKEN (or _USERNAME/_PASSWORD)",
+        },
+        {
+            group: "appliance-ssh",
+            present: anySet(env, ["LAB_VM_CREDENTIALS", "VM_CREDENTIALS"]) ||
+                (anySet(env, ["LAB_VM_CREDENTIALS_USERNAME", "LAB_VM_CREDENTIALS_USER", "LAB_VM_USER", "VM_USER"]) &&
+                    anySet(env, ["LAB_VM_CREDENTIALS_PASSWORD", "LAB_VM_CREDENTIALS_PASS", "LAB_VM_PASS", "VM_PASS"])),
+            needs: "LAB_VM_CREDENTIALS (JSON or user:pass) or LAB_VM_CREDENTIALS_USERNAME + LAB_VM_CREDENTIALS_PASSWORD",
+        },
+    ];
+}
+const CANONICAL_ALTERNATIVE = "Reads that do not need this aggregate bundle: list_hosts and list_inventory (target-scoped credentials via the " +
+    "canonical lab-inventory CLI), the ApplianceClaim tools, and `lab-inventory` itself. Legacy tools such as " +
+    "list_slots stay blocked with CREDENTIALS_UNAVAILABLE until the bundle resolves; do not inject unrelated hosts' " +
+    "credentials just to unblock one VM.";
+const VERIFY_STEP = "Reload the server (manage_mcp_server reload, or restart the harness) and call credential_status again: the " +
+    "tier should read direct_env or doppler_api and the legacy aggregate source resolved. A host listed here as " +
+    "reachable is the only evidence the credentials work; mock mode (CT_LAB_MCP_ALLOW_MOCK=1) is for offline tests " +
+    "and its results are not evidence.";
+export function buildCredentialRemediation(error, env = process.env) {
+    const inspected = inspectCredentialEnvironment(env);
+    const missingGroups = inspected.filter((g) => !g.present);
+    const dopplerTokenInProcess = set(env, "DOPPLER_TOKEN");
+    const reason = error?.reason ?? "no_credentials_found";
+    const steps = [];
+    const injectSteps = () => [
+        "Confirm the source has the values (names only; never print values): " +
+            "`doppler secrets --only-names --project ai-workspace --config dev | grep -E 'LAB_PROXMOX|LAB_VM_CREDENTIALS'`.",
+        "Inject them into this process from the parent, because it only sees the environment its harness gave it " +
+            "(DOPPLER_PROJECT/DOPPLER_CONFIG are not credentials). Either add `env` refs to the ct-lab entry of the " +
+            "harness MCP config, e.g. `\"LAB_PROXMOX_URL\": \"doppler://ai-workspace/dev/LAB_PROXMOX_URL\"` for each " +
+            "variable below, which the governed runtime wrapper (tools/mcp-runtime-exec.mjs) resolves through the " +
+            "Doppler CLI without a login prompt, or start the harness itself under " +
+            "`doppler run --project ai-workspace --config dev --`.",
+        dopplerTokenInProcess
+            ? "DOPPLER_TOKEN is present in this process, so the Tier-2 Doppler API path was attempted; check the " +
+                "`doppler_unreachable` / `partial_credentials` detail above instead of the injection steps."
+            : "A DOPPLER_TOKEN exported in the harness is not enough: the governed runtime wrapper strips it before " +
+                "spawning this server (by design), so the Doppler API tier is unreachable here. Use the env refs above.",
+    ];
+    if (reason === "doppler_unreachable") {
+        steps.push("The Doppler API tier was attempted and failed. Check that DOPPLER_TOKEN is a valid config-scoped token for " +
+            "DOPPLER_PROJECT/DOPPLER_CONFIG (not expired or revoked) and that api.doppler.com is reachable.", "The fetch is bounded by CT_LAB_MCP_RESOLVE_TIMEOUT_MS (default 8000, 250-30000); raise it only for a slow link.", "Or bypass Doppler by injecting the variables directly (see the groups below).");
+    }
+    else if (reason === "partial_credentials") {
+        steps.push(`The aggregate resolver found some but not all required groups; still missing: ${(error?.missing.length ? error.missing : missingGroups.map((g) => g.group)).join(", ") || "unknown"}.`, ...injectSteps().slice(1));
+    }
+    else {
+        steps.push(...injectSteps());
+    }
+    if (missingGroups.length > 0) {
+        steps.push("Variable groups still missing from this process: " +
+            missingGroups.map((g) => `${g.group} (${g.needs})`).join("; ") +
+            ".");
+    }
+    if (missingGroups.some((g) => g.group === "appliance-ssh")) {
+        steps.push("Note: the aggregate resolver reads one shared appliance login (LAB_VM_CREDENTIALS or the _USERNAME/_PASSWORD " +
+            "pair). Per-VM `LAB_VM_CREDENTIALS_<UUID>` secrets are consumed only by the canonical CLI and do not satisfy " +
+            "it; if the secret store has no shared entry the aggregate bundle cannot resolve from it.");
+    }
+    steps.push(CANONICAL_ALTERNATIVE, VERIFY_STEP);
+    const groupSummary = missingGroups.length
+        ? `no ${missingGroups.map((g) => g.group).join(", ")} variables reached this process`
+        : "the expected variables are present but did not resolve";
+    const headline = reason === "doppler_unreachable"
+        ? "The Doppler API tier failed; fix the token/connectivity or inject LAB_* variables directly."
+        : `Aggregate lab credentials unavailable: ${groupSummary}. Inject LAB_PROXMOX_*, LAB_PROXMOX_MINIS_* and ` +
+            "LAB_VM_CREDENTIALS from the parent (doppler:// env refs in the MCP config, or run the harness under " +
+            "`doppler run`); credential_status lists the exact steps. list_hosts/list_inventory and claim tools do " +
+            "not need this bundle.";
+    return { headline, steps, inspected, dopplerTokenInProcess };
+}
+//# sourceMappingURL=remediation.js.map

package/dist/src/credentials/remediation.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remediation.js","sourceRoot":"","sources":["../../../src/credentials/remediation.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAuBH,MAAM,GAAG,GAAG,CAAC,GAAQ,EAAE,GAAW,EAAW,EAAE,CAAC,OAAO,GAAG,CAAC,GAAG,CAAC,KAAK,QAAQ,IAAI,GAAG,CAAC,GAAG,CAAE,CAAC,MAAM,GAAG,CAAC,CAAC;AACrG,MAAM,MAAM,GAAG,CAAC,GAAQ,EAAE,IAAc,EAAW,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC;AAExF,SAAS,mBAAmB,CAAC,GAAQ,EAAE,MAAc;IACnD,MAAM,QAAQ,GAAG,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,KAAK,EAAE,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,EAAE,GAAG,MAAM,IAAI,CAAC,CAAC,CAAC;IACpG,MAAM,IAAI,GACR,GAAG,CAAC,GAAG,EAAE,GAAG,MAAM,WAAW,CAAC;QAC9B,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,cAAc,CAAC,CAAC;YAC1D,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,cAAc,EAAE,GAAG,MAAM,kBAAkB,CAAC,CAAC,CAAC;QACtE,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,GAAG,EAAE,CAAC,GAAG,MAAM,UAAU,EAAE,GAAG,MAAM,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/G,OAAO,QAAQ,IAAI,IAAI,CAAC;AAC1B,CAAC;AAED,MAAM,UAAU,4BAA4B,CAAC,MAAW,OAAO,CAAC,GAAG;IACjE,OAAO;QACL;YACE,KAAK,EAAE,aAAa;YACpB,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,cAAc,CAAC;YACjD,KAAK,EAAE,6EAA6E;SACrF;QACD;YACE,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,mBAAmB,CAAC,GAAG,EAAE,oBAAoB,CAAC,IAAI,mBAAmB,CAAC,GAAG,EAAE,mBAAmB,CAAC;YACxG,KAAK,EAAE,yFAAyF;SACjG;QACD;YACE,KAAK,EAAE,eAAe;YACtB,OAAO,EACL,MAAM,CAAC,GAAG,EAAE,CAAC,oBAAoB,EAAE,gBAAgB,CAAC,CAAC;gBACrD,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC;oBAChG,MAAM,CAAC,GAAG,EAAE,CAAC,6BAA6B,EAAE,yBAAyB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;YACtG,KAAK,EAAE,qGAAqG;SAC7G;KACF,CAAC;AACJ,CAAC;AAED,MAAM,qBAAqB,GACzB,iHAAiH;IACjH,2GAA2G;IAC3G,iHAAiH;IACjH,qCAAqC,CAAC;AAExC,MAAM,WAAW,GACf,6GAA6G;IAC7G,6GAA6G;IAC7G,gHAAgH;IAChH,mCAAmC,CAAC;AAEtC,MAAM,UAAU,0BAA0B,CACxC,KAAoF,EACpF,MAAW,OAAO,CAAC,GAAG;IAEtB,MAAM,SAAS,GAAG,4BAA4B,CAAC,GAAG,CAAC,CAAC;IACpD,MAAM,aAAa,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;IAC1D,MAAM,qBAAqB,GAAG,GAAG,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC;IACxD,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,IAAI,sBAAsB,CAAC;IACvD,MAAM,KAAK,GAAa,EAAE,CAAC;IAE3B,MAAM,WAAW,GAAG,GAAa,EAAE,CAAC;QAClC,sEAAsE;YACpE,gHAAgH;QAClH,0GAA0G;YACxG,yGAAyG;YACzG,0GAA0G;YAC1G,uGAAuG;YACvG,wEAAwE;YACxE,uDAAuD;QACzD,qBAAqB;YACnB,CAAC,CAAC,oGAAoG;gBACpG,4FAA4F;YAC9F,CAAC,CAAC,uGAAuG;gBACvG,wGAAwG;KAC7G,CAAC;IAEF,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QACrC,KAAK,CAAC,IAAI,CACR,6GAA6G;YAC3G,gGAAgG,EAClG,iHAAiH,EACjH,+EAA+E,CAChF,CAAC;IACJ,CAAC;SAAM,IAAI,MAAM,KAAK,qBAAqB,EAAE,CAAC;QAC5C,KAAK,CAAC,IAAI,CACR,iFACE,CAAC,KAAK,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,SAC5F,GAAG,EACH,GAAG,WAAW,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAC1B,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,CAAC;IAC/B,CAAC;IAED,IAAI,aAAa,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CACR,mDAAmD;YACjD,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,KAAK,KAAK,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;YAC9D,GAAG,CACN,CAAC;IACJ,CAAC;IACD,IAAI,aAAa,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,eAAe,CAAC,EAAE,CAAC;QAC3D,KAAK,CAAC,IAAI,CACR,+GAA+G;YAC7G,8GAA8G;YAC9G,0FAA0F,CAC7F,CAAC;IACJ,CAAC;IACD,KAAK,CAAC,IAAI,CAAC,qBAAqB,EAAE,WAAW,CAAC,CAAC;IAE/C,MAAM,YAAY,GAAG,aAAa,CAAC,MAAM;QACvC,CAAC,CAAC,MAAM,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,iCAAiC;QACrF,CAAC,CAAC,wDAAwD,CAAC;IAC7D,MAAM,QAAQ,GACZ,MAAM,KAAK,qBAAqB;QAC9B,CAAC,CAAC,6FAA6F;QAC/F,CAAC,CAAC,0CAA0C,YAAY,kDAAkD;YACxG,sGAAsG;YACtG,wGAAwG;YACxG,uBAAuB,CAAC;IAE9B,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,SAAS,EAAE,qBAAqB,EAAE,CAAC;AAC/D,CAAC"}