@cleocode/core 2026.4.9 → 2026.4.12

package/dist/store/git-checkpoint.js

@@ -0,0 +1,365 @@
+/**
+ * Git checkpoint system for CLEO state files.
+ * Ported from lib/data/git-checkpoint.sh
+ *
+ * Opt-in automatic git commits of .cleo/ state files at semantic
+ * boundaries (save_json, session end) with debounce to prevent commit noise.
+ * All git errors are suppressed - checkpointing is never fatal.
+ *
+ * @task T4552
+ * @task T4872
+ * @epic T4545
+ */
+import { execFile } from 'node:child_process';
+import { existsSync } from 'node:fs';
+import { readFile, writeFile } from 'node:fs/promises';
+import { join, resolve } from 'node:path';
+import { promisify } from 'node:util';
+import { getCleoDir, getConfigPath } from '../paths.js';
+import { readJson } from './json.js';
+const execFileAsync = promisify(execFile);
+/**
+ * Build environment variables that point git at the isolated .cleo/.git repo.
+ * @task T4872
+ */
+export function makeCleoGitEnv(cleoDir) {
+    // resolve() ensures GIT_DIR and GIT_WORK_TREE are absolute even when cleoDir
+    // is a relative path (e.g. '.cleo' returned by getCleoDir() with no cwd arg)
+    const abs = resolve(cleoDir);
+    return {
+        ...process.env,
+        GIT_DIR: join(abs, '.git'),
+        GIT_WORK_TREE: abs,
+    };
+}
+/**
+ * Run a git command against the isolated .cleo/.git repo, suppressing errors.
+ * @task T4872
+ */
+export async function cleoGitCommand(args, cleoDir) {
+    try {
+        const result = await execFileAsync('git', args, {
+            cwd: resolve(cleoDir), // absolute cwd so relative paths in args resolve correctly
+            env: makeCleoGitEnv(cleoDir),
+            timeout: 10_000,
+        });
+        return { stdout: result.stdout.trim(), success: true };
+    }
+    catch {
+        return { stdout: '', success: false };
+    }
+}
+/**
+ * Check whether the isolated .cleo/.git repo has been initialized.
+ * @task T4872
+ */
+export function isCleoGitInitialized(cleoDir) {
+    return existsSync(join(cleoDir, '.git', 'HEAD'));
+}
+/**
+ * Core state files and directories eligible for checkpointing (relative to .cleo/).
+ *
+ * Only human-editable JSON config files (per ADR-006) and documentation
+ * output directories. All operational data lives in tasks.db (SQLite).
+ * tasks.db is excluded from git — backed up via VACUUM INTO rotation instead.
+ *
+ * Directory entries (trailing slash) are passed directly to git; git handles
+ * them recursively for add/diff/ls-files operations.
+ *
+ * Users can add custom entries via config.json `checkpoint.stateFileAllowlist`.
+ */
+const STATE_FILES = [
+    // Human-editable config files (ADR-006: JSON retained for human-editable config only)
+    'config.json',
+    'project-info.json',
+    'project-context.json',
+    // Architecture decisions and research outputs (docs, never in SQLite)
+    'adrs/',
+    'agent-outputs/',
+];
+/**
+ * Load additional state file paths from config.json `checkpoint.stateFileAllowlist`.
+ * Returns an empty array if config is missing, malformed, or the key is absent.
+ */
+export async function loadStateFileAllowlist(cwd) {
+    try {
+        const configPath = getConfigPath(cwd);
+        const config = await readJson(configPath);
+        const checkpoint = config?.checkpoint;
+        const allowlist = checkpoint?.stateFileAllowlist;
+        if (!Array.isArray(allowlist))
+            return [];
+        // Filter to strings only, ignore non-string entries
+        return allowlist.filter((entry) => typeof entry === 'string');
+    }
+    catch {
+        return [];
+    }
+}
+/**
+ * Get the full list of state files: core defaults merged with config allowlist.
+ */
+async function getAllStateFiles(cwd) {
+    const custom = await loadStateFileAllowlist(cwd);
+    const all = [...STATE_FILES, ...custom];
+    // Deduplicate
+    return [...new Set(all)];
+}
+/** Debounce state file name (relative to .cleo/). */
+const CHECKPOINT_STATE_FILE = '.git-checkpoint-state';
+/**
+ * Load checkpoint configuration from config.json.
+ * @task T4552
+ */
+export async function loadCheckpointConfig(cwd) {
+    try {
+        const configPath = getConfigPath(cwd);
+        const config = await readJson(configPath);
+        const gc = config?.gitCheckpoint;
+        return {
+            enabled: gc?.enabled !== false,
+            debounceMinutes: typeof gc?.debounceMinutes === 'number' ? gc.debounceMinutes : 5,
+            messagePrefix: typeof gc?.messagePrefix === 'string' ? gc.messagePrefix : 'chore(cleo):',
+            noVerify: gc?.noVerify !== false,
+        };
+    }
+    catch {
+        return {
+            enabled: true,
+            debounceMinutes: 5,
+            messagePrefix: 'chore(cleo):',
+            noVerify: true,
+        };
+    }
+}
+/**
+ * Check if the isolated .cleo/.git repo is a valid git work tree.
+ * @task T4552
+ * @task T4872
+ */
+async function isCleoGitRepo(cleoDir) {
+    const result = await cleoGitCommand(['rev-parse', '--is-inside-work-tree'], cleoDir);
+    // On a freshly initialized empty repo, git returns "false" (no commits yet) but
+    // the repo is still valid for staging + committing. Fall back to existsSync check.
+    return result.success && (result.stdout === 'true' || isCleoGitInitialized(cleoDir));
+}
+/**
+ * Check if a merge is in progress in the .cleo/.git repo.
+ * @task T4552
+ * @task T4872
+ */
+function isMergeInProgress(cleoDir) {
+    return existsSync(join(cleoDir, '.git', 'MERGE_HEAD'));
+}
+/**
+ * Check if HEAD is detached in the .cleo/.git repo.
+ * @task T4552
+ * @task T4872
+ */
+async function isDetachedHead(cleoDir) {
+    const result = await cleoGitCommand(['symbolic-ref', 'HEAD'], cleoDir);
+    return !result.success;
+}
+/**
+ * Check if a rebase is in progress in the .cleo/.git repo.
+ * @task T4552
+ * @task T4872
+ */
+function isRebaseInProgress(cleoDir) {
+    return (existsSync(join(cleoDir, '.git', 'rebase-merge')) ||
+        existsSync(join(cleoDir, '.git', 'rebase-apply')));
+}
+/**
+ * Record the current time as the last checkpoint time.
+ * @task T4552
+ */
+async function recordCheckpointTime(cleoDir) {
+    try {
+        const stateFile = join(cleoDir, CHECKPOINT_STATE_FILE);
+        await writeFile(stateFile, String(Math.floor(Date.now() / 1000)));
+    }
+    catch {
+        // Non-fatal
+    }
+}
+/**
+ * Get the epoch time of the last checkpoint.
+ * @task T4552
+ */
+async function getLastCheckpointTime(cleoDir) {
+    try {
+        const stateFile = join(cleoDir, CHECKPOINT_STATE_FILE);
+        const content = await readFile(stateFile, 'utf-8');
+        const epoch = parseInt(content.trim(), 10);
+        return Number.isNaN(epoch) ? 0 : epoch;
+    }
+    catch {
+        return 0;
+    }
+}
+/**
+ * Get list of state files with pending changes in the .cleo/.git repo.
+ * Paths are relative to cleoDir (the git work tree).
+ * @task T4552
+ * @task T4872
+ */
+async function getChangedStateFiles(cleoDir, cwd) {
+    const changed = [];
+    const allStateFiles = await getAllStateFiles(cwd);
+    for (const stateFile of allStateFiles) {
+        const fullPath = join(cleoDir, stateFile);
+        if (!existsSync(fullPath))
+            continue;
+        // Check for staged or unstaged changes (paths relative to cleoDir work tree)
+        const diffResult = await cleoGitCommand(['diff', '--quiet', '--', stateFile], cleoDir);
+        const cachedResult = await cleoGitCommand(['diff', '--cached', '--quiet', '--', stateFile], cleoDir);
+        const untrackedResult = await cleoGitCommand(['ls-files', '--others', '--exclude-standard', '--', stateFile], cleoDir);
+        if (!diffResult.success || !cachedResult.success) {
+            changed.push({ path: stateFile, status: 'modified' });
+        }
+        else if (untrackedResult.stdout.length > 0) {
+            changed.push({ path: stateFile, status: 'untracked' });
+        }
+    }
+    return changed;
+}
+/**
+ * Check whether a checkpoint should be performed.
+ * Evaluates: enabled, .cleo/.git initialized, debounce elapsed, files changed.
+ * @task T4552
+ * @task T4872
+ */
+export async function shouldCheckpoint(options) {
+    const force = options?.force ?? false;
+    const cwd = options?.cwd;
+    // Suppression check (even force doesn't override explicit suppression)
+    if (process.env['GIT_CHECKPOINT_SUPPRESS'] === 'true') {
+        return false;
+    }
+    const config = await loadCheckpointConfig(cwd);
+    if (!config.enabled)
+        return false;
+    const cleoDir = getCleoDir(cwd);
+    if (!existsSync(cleoDir))
+        return false;
+    // Guard: .cleo/.git must be initialized (run `cleo init` to enable checkpointing)
+    if (!isCleoGitInitialized(cleoDir))
+        return false;
+    if (!(await isCleoGitRepo(cleoDir)))
+        return false;
+    if (isMergeInProgress(cleoDir))
+        return false;
+    if (await isDetachedHead(cleoDir))
+        return false;
+    if (isRebaseInProgress(cleoDir))
+        return false;
+    // Check debounce (unless forced)
+    if (!force) {
+        const lastCheckpoint = await getLastCheckpointTime(cleoDir);
+        const now = Math.floor(Date.now() / 1000);
+        const elapsed = now - lastCheckpoint;
+        const debounceSeconds = config.debounceMinutes * 60;
+        if (elapsed < debounceSeconds)
+            return false;
+    }
+    // Check if any state files have changes
+    const changed = await getChangedStateFiles(cleoDir, cwd);
+    return changed.length > 0;
+}
+/**
+ * Stage .cleo/ state files and commit to the isolated .cleo/.git repo.
+ * Never fatal - all git errors are suppressed.
+ * @task T4552
+ * @task T4872
+ */
+export async function gitCheckpoint(trigger = 'auto', context, cwd) {
+    // Suppression check
+    if (process.env['GIT_CHECKPOINT_SUPPRESS'] === 'true') {
+        return;
+    }
+    const force = trigger === 'manual';
+    if (!(await shouldCheckpoint({ force, cwd }))) {
+        return;
+    }
+    const config = await loadCheckpointConfig(cwd);
+    const cleoDir = getCleoDir(cwd);
+    const changed = await getChangedStateFiles(cleoDir, cwd);
+    if (changed.length === 0)
+        return;
+    // Stage changed files (paths are relative to cleoDir work tree)
+    let stagedCount = 0;
+    for (const file of changed) {
+        const result = await cleoGitCommand(['add', file.path], cleoDir);
+        if (result.success)
+            stagedCount++;
+    }
+    if (stagedCount === 0)
+        return;
+    // Build commit message
+    let commitMsg = `${config.messagePrefix} ${trigger} checkpoint`;
+    if (context) {
+        commitMsg = `${config.messagePrefix} ${trigger} checkpoint (${context})`;
+    }
+    // Build commit args
+    const commitArgs = ['commit', '-m', commitMsg];
+    if (config.noVerify) {
+        commitArgs.push('--no-verify');
+    }
+    // Restrict commit to only the staged state files (prevents sweeping pre-staged project files)
+    commitArgs.push('--', ...changed.map((f) => f.path));
+    // Commit to .cleo/.git
+    const commitResult = await cleoGitCommand(commitArgs, cleoDir);
+    if (!commitResult.success) {
+        // If commit failed, unstage our changes
+        for (const file of changed) {
+            await cleoGitCommand(['reset', 'HEAD', '--', file.path], cleoDir);
+        }
+        return;
+    }
+    // Record checkpoint time
+    await recordCheckpointTime(cleoDir);
+}
+/**
+ * Show checkpoint configuration and status.
+ * @task T4552
+ * @task T4872
+ */
+export async function gitCheckpointStatus(cwd) {
+    const config = await loadCheckpointConfig(cwd);
+    const cleoDir = getCleoDir(cwd);
+    const lastCheckpoint = await getLastCheckpointTime(cleoDir);
+    let lastCheckpointIso = 'never';
+    if (lastCheckpoint !== 0) {
+        lastCheckpointIso = new Date(lastCheckpoint * 1000).toISOString();
+    }
+    const isRepo = isCleoGitInitialized(cleoDir) && (await isCleoGitRepo(cleoDir));
+    let pendingChanges = 0;
+    if (isRepo) {
+        const changed = await getChangedStateFiles(cleoDir, cwd);
+        pendingChanges = changed.length;
+    }
+    const suppressed = process.env['GIT_CHECKPOINT_SUPPRESS'] === 'true';
+    return {
+        config,
+        status: {
+            isGitRepo: isRepo,
+            lastCheckpoint: lastCheckpointIso,
+            lastCheckpointEpoch: lastCheckpoint,
+            pendingChanges,
+            suppressed,
+        },
+    };
+}
+/**
+ * Show what files would be committed (dry-run).
+ * @task T4552
+ * @task T4872
+ */
+export async function gitCheckpointDryRun(cwd) {
+    const cleoDir = getCleoDir(cwd);
+    const isRepo = isCleoGitInitialized(cleoDir) && (await isCleoGitRepo(cleoDir));
+    if (!isRepo)
+        return [];
+    return getChangedStateFiles(cleoDir, cwd);
+}
+//# sourceMappingURL=git-checkpoint.js.map

package/dist/store/git-checkpoint.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-checkpoint.js","sourceRoot":"","sources":["../../src/store/git-checkpoint.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACrC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AACtC,OAAO,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAC;AAErC,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAE1C;;;GAGG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,6EAA6E;IAC7E,6EAA6E;IAC7E,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO;QACL,GAAG,OAAO,CAAC,GAAG;QACd,OAAO,EAAE,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC;QAC1B,aAAa,EAAE,GAAG;KACnB,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,IAAc,EACd,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE;YAC9C,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,EAAE,2DAA2D;YAClF,GAAG,EAAE,cAAc,CAAC,OAAO,CAAC;YAC5B,OAAO,EAAE,MAAM;SAChB,CAAC,CAAC;QACH,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IACzD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IACxC,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AACnD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,WAAW,GAAG;IAClB,sFAAsF;IACtF,aAAa;IACb,mBAAmB;IACnB,sBAAsB;IACtB,sEAAsE;IACtE,OAAO;IACP,gBAAgB;CACR,CAAC;AAEX;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,GAAY;IACvD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAA0B,UAAU,CAAC,CAAC;QACnE,MAAM,UAAU,GAAI,MAAyD,EAAE,UAAU,CAAC;QAC1F,MAAM,SAAS,GAAG,UAAU,EAAE,kBAAkB,CAAC;QACjD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC;YAAE,OAAO,EAAE,CAAC;QACzC,oDAAoD;QACpD,OAAO,SAAS,CAAC,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;GAEG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAY;IAC1C,MAAM,MAAM,GAAG,MAAM,sBAAsB,CAAC,GAAG,CAAC,CAAC;IACjD,MAAM,GAAG,GAAG,CAAC,GAAG,WAAW,EAAE,GAAG,MAAM,CAAC,CAAC;IACxC,cAAc;IACd,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC;AAC3B,CAAC;AAED,qDAAqD;AACrD,MAAM,qBAAqB,GAAG,uBAAuB,CAAC;AA4BtD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,GAAY;IACrD,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC;QACtC,MAAM,MAAM,GAAG,MAAM,QAAQ,CAA0B,UAAU,CAAC,CAAC;QACnE,MAAM,EAAE,GAAI,MAAyD,EAAE,aAAa,CAAC;QAErF,OAAO;YACL,OAAO,EAAE,EAAE,EAAE,OAAO,KAAK,KAAK;YAC9B,eAAe,EAAE,OAAO,EAAE,EAAE,eAAe,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC;YACjF,aAAa,EAAE,OAAO,EAAE,EAAE,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,aAAa,CAAC,CAAC,CAAC,cAAc;YACxF,QAAQ,EAAE,EAAE,EAAE,QAAQ,KAAK,KAAK;SACjC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,OAAO,EAAE,IAAI;YACb,eAAe,EAAE,CAAC;YAClB,aAAa,EAAE,cAAc;YAC7B,QAAQ,EAAE,IAAI;SACf,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,aAAa,CAAC,OAAe;IAC1C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,CAAC,WAAW,EAAE,uBAAuB,CAAC,EAAE,OAAO,CAAC,CAAC;IACrF,gFAAgF;IAChF,mFAAmF;IACnF,OAAO,MAAM,CAAC,OAAO,IAAI,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM,IAAI,oBAAoB,CAAC,OAAO,CAAC,CAAC,CAAC;AACvF,CAAC;AAED;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,cAAc,CAAC,OAAe;IAC3C,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,CAAC,cAAc,EAAE,MAAM,CAAC,EAAE,OAAO,CAAC,CAAC;IACvE,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;AACzB,CAAC;AAED;;;;GAIG;AACH,SAAS,kBAAkB,CAAC,OAAe;IACzC,OAAO,CACL,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;QACjD,UAAU,CAAC,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAClD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,oBAAoB,CAAC,OAAe;IACjD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACvD,MAAM,SAAS,CAAC,SAAS,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpE,CAAC;IAAC,MAAM,CAAC;QACP,YAAY;IACd,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,qBAAqB,CAAC,OAAe;IAClD,IAAI,CAAC;QACH,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;QACvD,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;QACnD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC,CAAC;QAC3C,OAAO,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,oBAAoB,CAAC,OAAe,EAAE,GAAY;IAC/D,MAAM,OAAO,GAAkB,EAAE,CAAC;IAClC,MAAM,aAAa,GAAG,MAAM,gBAAgB,CAAC,GAAG,CAAC,CAAC;IAElD,KAAK,MAAM,SAAS,IAAI,aAAa,EAAE,CAAC;QACtC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;QAC1C,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;YAAE,SAAS;QAEpC,6EAA6E;QAC7E,MAAM,UAAU,GAAG,MAAM,cAAc,CAAC,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,CAAC;QACvF,MAAM,YAAY,GAAG,MAAM,cAAc,CACvC,CAAC,MAAM,EAAE,UAAU,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,CAAC,EAChD,OAAO,CACR,CAAC;QACF,MAAM,eAAe,GAAG,MAAM,cAAc,CAC1C,CAAC,UAAU,EAAE,UAAU,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,CAAC,EAC/D,OAAO,CACR,CAAC;QAEF,IAAI,CAAC,UAAU,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;YACjD,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC,CAAC;QACxD,CAAC;aAAM,IAAI,eAAe,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC7C,OAAO,CAAC,IAAI,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACzD,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,OAGtC;IACC,MAAM,KAAK,GAAG,OAAO,EAAE,KAAK,IAAI,KAAK,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,EAAE,GAAG,CAAC;IAEzB,uEAAuE;IACvE,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,MAAM,EAAE,CAAC;QACtD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAE/C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAElC,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAEvC,kFAAkF;IAClF,IAAI,CAAC,oBAAoB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAEjD,IAAI,CAAC,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC;QAAE,OAAO,KAAK,CAAC;IAClD,IAAI,iBAAiB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAC7C,IAAI,MAAM,cAAc,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAChD,IAAI,kBAAkB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE9C,iCAAiC;IACjC,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;QAC5D,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC;QAC1C,MAAM,OAAO,GAAG,GAAG,GAAG,cAAc,CAAC;QACrC,MAAM,eAAe,GAAG,MAAM,CAAC,eAAe,GAAG,EAAE,CAAC;QAEpD,IAAI,OAAO,GAAG,eAAe;YAAE,OAAO,KAAK,CAAC;IAC9C,CAAC;IAED,wCAAwC;IACxC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IACzD,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;AAC5B,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,UAA6C,MAAM,EACnD,OAAgB,EAChB,GAAY;IAEZ,oBAAoB;IACpB,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,MAAM,EAAE,CAAC;QACtD,OAAO;IACT,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,KAAK,QAAQ,CAAC;IAEnC,IAAI,CAAC,CAAC,MAAM,gBAAgB,CAAC,EAAE,KAAK,EAAE,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC;QAC9C,OAAO;IACT,CAAC;IAED,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAEzD,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IAEjC,gEAAgE;IAChE,IAAI,WAAW,GAAG,CAAC,CAAC;IACpB,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,CAAC,KAAK,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACjE,IAAI,MAAM,CAAC,OAAO;YAAE,WAAW,EAAE,CAAC;IACpC,CAAC;IAED,IAAI,WAAW,KAAK,CAAC;QAAE,OAAO;IAE9B,uBAAuB;IACvB,IAAI,SAAS,GAAG,GAAG,MAAM,CAAC,aAAa,IAAI,OAAO,aAAa,CAAC;IAChE,IAAI,OAAO,EAAE,CAAC;QACZ,SAAS,GAAG,GAAG,MAAM,CAAC,aAAa,IAAI,OAAO,gBAAgB,OAAO,GAAG,CAAC;IAC3E,CAAC;IAED,oBAAoB;IACpB,MAAM,UAAU,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,SAAS,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACpB,UAAU,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;IACjC,CAAC;IAED,8FAA8F;IAC9F,UAAU,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IAErD,uBAAuB;IACvB,MAAM,YAAY,GAAG,MAAM,cAAc,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IAE/D,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,CAAC;QAC1B,wCAAwC;QACxC,KAAK,MAAM,IAAI,IAAI,OAAO,EAAE,CAAC;YAC3B,MAAM,cAAc,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC,CAAC;QACpE,CAAC;QACD,OAAO;IACT,CAAC;IAED,yBAAyB;IACzB,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;AACtC,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAY;IACpD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,GAAG,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,cAAc,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,CAAC;IAE5D,IAAI,iBAAiB,GAAG,OAAO,CAAC;IAChC,IAAI,cAAc,KAAK,CAAC,EAAE,CAAC;QACzB,iBAAiB,GAAG,IAAI,IAAI,CAAC,cAAc,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;IACpE,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/E,IAAI,cAAc,GAAG,CAAC,CAAC;IACvB,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACzD,cAAc,GAAG,OAAO,CAAC,MAAM,CAAC;IAClC,CAAC;IAED,MAAM,UAAU,GAAG,OAAO,CAAC,GAAG,CAAC,yBAAyB,CAAC,KAAK,MAAM,CAAC;IAErE,OAAO;QACL,MAAM;QACN,MAAM,EAAE;YACN,SAAS,EAAE,MAAM;YACjB,cAAc,EAAE,iBAAiB;YACjC,mBAAmB,EAAE,cAAc;YACnC,cAAc;YACd,UAAU;SACX;KACF,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,GAAY;IACpD,MAAM,OAAO,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAE/E,IAAI,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAEvB,OAAO,oBAAoB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;AAC5C,CAAC"}

package/dist/store/global-salt.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Global-salt subsystem for the CLEO API key KDF.
+ *
+ * @task T348
+ * @epic T310
+ * @why ADR-037 §5 — API key KDF uses machine-key + global-salt + agentId.
+ *      global-salt must persist across process restarts but is machine-local.
+ * @what Atomic first-run generation, memoized read, permission/size validation.
+ */
+/** Filename for the global salt file under CLEO home. */
+export declare const GLOBAL_SALT_FILENAME = "global-salt";
+/** Required size of the global salt in bytes. */
+export declare const GLOBAL_SALT_SIZE = 32;
+/**
+ * Returns the absolute path to the global-salt file.
+ *
+ * @returns Absolute path: `{cleoHome}/global-salt`
+ *
+ * @task T348
+ * @epic T310
+ *
+ * @example
+ * ```typescript
+ * const saltPath = getGlobalSaltPath();
+ * // Linux: "/home/user/.local/share/cleo/global-salt"
+ * ```
+ */
+export declare function getGlobalSaltPath(): string;
+/**
+ * Returns the 32-byte global salt. Generates and persists atomically on first
+ * call when the file does not exist. Subsequent calls return the memoized value.
+ *
+ * Never overwrites an existing salt — doing so would invalidate every stored
+ * API key derived from it.
+ *
+ * @returns A 32-byte Buffer containing the global salt
+ * @throws {Error} If the salt file exists with wrong size or wrong permissions
+ *
+ * @task T348
+ * @epic T310
+ *
+ * @example
+ * ```typescript
+ * const salt = getGlobalSalt(); // Buffer(32) [...]
+ * ```
+ */
+export declare function getGlobalSalt(): Buffer;
+/**
+ * Runtime validation helper for startup integrity checks.
+ *
+ * Throws if the salt file exists but is malformed (wrong size or permissions).
+ * Safe to call when the file does not yet exist — returns silently in that case
+ * because first-run generation is handled lazily by `getGlobalSalt()`.
+ *
+ * @throws {Error} If the salt file exists with wrong size or wrong permissions
+ *
+ * @task T348
+ * @epic T310
+ *
+ * @example
+ * ```typescript
+ * // Called at process startup to catch accidental salt corruption early
+ * validateGlobalSalt();
+ * ```
+ */
+export declare function validateGlobalSalt(): void;
+/**
+ * Clears the in-process memoization cache so tests can exercise the
+ * first-call generation path independently.
+ *
+ * @internal TEST ONLY — do NOT export through internal.ts or re-export
+ * from any public barrel. This symbol must never appear in production call paths.
+ *
+ * @task T348
+ * @epic T310
+ */
+export declare function __clearGlobalSaltCache(): void;
+//# sourceMappingURL=global-salt.d.ts.map

package/dist/store/global-salt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-salt.d.ts","sourceRoot":"","sources":["../../src/store/global-salt.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAOH,yDAAyD;AACzD,eAAO,MAAM,oBAAoB,gBAAgB,CAAC;AAElD,iDAAiD;AACjD,eAAO,MAAM,gBAAgB,KAAK,CAAC;AAWnC;;;;;;;;;;;;;GAaG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAE1C;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAkDtC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAwBzC;AAED;;;;;;;;;GASG;AACH,wBAAgB,sBAAsB,IAAI,IAAI,CAE7C"}

package/dist/store/global-salt.js

@@ -0,0 +1,147 @@
+/**
+ * Global-salt subsystem for the CLEO API key KDF.
+ *
+ * @task T348
+ * @epic T310
+ * @why ADR-037 §5 — API key KDF uses machine-key + global-salt + agentId.
+ *      global-salt must persist across process restarts but is machine-local.
+ * @what Atomic first-run generation, memoized read, permission/size validation.
+ */
+import crypto from 'node:crypto';
+import fs from 'node:fs';
+import path from 'node:path';
+import { getCleoHome } from '../paths.js';
+/** Filename for the global salt file under CLEO home. */
+export const GLOBAL_SALT_FILENAME = 'global-salt';
+/** Required size of the global salt in bytes. */
+export const GLOBAL_SALT_SIZE = 32;
+/** Required file permission mode for the global salt file (POSIX). */
+const SALT_FILE_MODE = 0o600;
+/**
+ * In-process memoization. Invalidated only by process restart.
+ * Cleared in tests via `__clearGlobalSaltCache()` (test-only export).
+ */
+let cached = null;
+/**
+ * Returns the absolute path to the global-salt file.
+ *
+ * @returns Absolute path: `{cleoHome}/global-salt`
+ *
+ * @task T348
+ * @epic T310
+ *
+ * @example
+ * ```typescript
+ * const saltPath = getGlobalSaltPath();
+ * // Linux: "/home/user/.local/share/cleo/global-salt"
+ * ```
+ */
+export function getGlobalSaltPath() {
+    return path.join(getCleoHome(), GLOBAL_SALT_FILENAME);
+}
+/**
+ * Returns the 32-byte global salt. Generates and persists atomically on first
+ * call when the file does not exist. Subsequent calls return the memoized value.
+ *
+ * Never overwrites an existing salt — doing so would invalidate every stored
+ * API key derived from it.
+ *
+ * @returns A 32-byte Buffer containing the global salt
+ * @throws {Error} If the salt file exists with wrong size or wrong permissions
+ *
+ * @task T348
+ * @epic T310
+ *
+ * @example
+ * ```typescript
+ * const salt = getGlobalSalt(); // Buffer(32) [...]
+ * ```
+ */
+export function getGlobalSalt() {
+    if (cached !== null)
+        return cached;
+    const saltPath = getGlobalSaltPath();
+    const cleoHome = getCleoHome();
+    if (!fs.existsSync(saltPath)) {
+        // First-run generation: ensure the directory exists
+        if (!fs.existsSync(cleoHome)) {
+            fs.mkdirSync(cleoHome, { recursive: true });
+        }
+        const salt = crypto.randomBytes(GLOBAL_SALT_SIZE);
+        // Atomic write: write to tmp file, chmod, then rename into place
+        const tmpPath = `${saltPath}.tmp-${process.pid}-${Date.now()}`;
+        fs.writeFileSync(tmpPath, salt, { mode: SALT_FILE_MODE });
+        // Explicit chmod in case writeFileSync's mode arg is ignored on some FS
+        fs.chmodSync(tmpPath, SALT_FILE_MODE);
+        fs.renameSync(tmpPath, saltPath);
+        cached = salt;
+        return cached;
+    }
+    // Existing file — validate before trusting
+    const stat = fs.statSync(saltPath);
+    if (stat.size !== GLOBAL_SALT_SIZE) {
+        throw new Error(`global-salt at ${saltPath} has wrong size: expected ${GLOBAL_SALT_SIZE} bytes, got ${stat.size}. ` +
+            `Refusing to use a corrupted salt file. Delete the file manually if you intend to regenerate it ` +
+            `(this will invalidate all stored API keys).`);
+    }
+    // Permission check: only meaningful on POSIX; Windows does not support mode bits
+    if (process.platform !== 'win32') {
+        const mode = stat.mode & 0o777;
+        if (mode !== SALT_FILE_MODE) {
+            throw new Error(`global-salt at ${saltPath} has wrong permissions: expected 0o600, got 0o${mode.toString(8)}. ` +
+                `Fix with: chmod 600 ${saltPath}`);
+        }
+    }
+    const salt = fs.readFileSync(saltPath);
+    cached = salt;
+    return cached;
+}
+/**
+ * Runtime validation helper for startup integrity checks.
+ *
+ * Throws if the salt file exists but is malformed (wrong size or permissions).
+ * Safe to call when the file does not yet exist — returns silently in that case
+ * because first-run generation is handled lazily by `getGlobalSalt()`.
+ *
+ * @throws {Error} If the salt file exists with wrong size or wrong permissions
+ *
+ * @task T348
+ * @epic T310
+ *
+ * @example
+ * ```typescript
+ * // Called at process startup to catch accidental salt corruption early
+ * validateGlobalSalt();
+ * ```
+ */
+export function validateGlobalSalt() {
+    const saltPath = getGlobalSaltPath();
+    if (!fs.existsSync(saltPath)) {
+        // Not yet generated — first-run case; no error
+        return;
+    }
+    const stat = fs.statSync(saltPath);
+    if (stat.size !== GLOBAL_SALT_SIZE) {
+        throw new Error(`global-salt validation failed: size ${stat.size}, expected ${GLOBAL_SALT_SIZE}`);
+    }
+    if (process.platform !== 'win32') {
+        const mode = stat.mode & 0o777;
+        if (mode !== SALT_FILE_MODE) {
+            throw new Error(`global-salt validation failed: permissions 0o${mode.toString(8)}, expected 0o600`);
+        }
+    }
+}
+/**
+ * Clears the in-process memoization cache so tests can exercise the
+ * first-call generation path independently.
+ *
+ * @internal TEST ONLY — do NOT export through internal.ts or re-export
+ * from any public barrel. This symbol must never appear in production call paths.
+ *
+ * @task T348
+ * @epic T310
+ */
+export function __clearGlobalSaltCache() {
+    cached = null;
+}
+//# sourceMappingURL=global-salt.js.map

package/dist/store/global-salt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"global-salt.js","sourceRoot":"","sources":["../../src/store/global-salt.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,MAAM,MAAM,aAAa,CAAC;AACjC,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,yDAAyD;AACzD,MAAM,CAAC,MAAM,oBAAoB,GAAG,aAAa,CAAC;AAElD,iDAAiD;AACjD,MAAM,CAAC,MAAM,gBAAgB,GAAG,EAAE,CAAC;AAEnC,sEAAsE;AACtE,MAAM,cAAc,GAAG,KAAK,CAAC;AAE7B;;;GAGG;AACH,IAAI,MAAM,GAAkB,IAAI,CAAC;AAEjC;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC,CAAC;AACxD,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,aAAa;IAC3B,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAEnC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IACrC,MAAM,QAAQ,GAAG,WAAW,EAAE,CAAC;IAE/B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,oDAAoD;QACpD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC7B,EAAE,CAAC,SAAS,CAAC,QAAQ,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,CAAC;QAED,MAAM,IAAI,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,CAAC;QAElD,iEAAiE;QACjE,MAAM,OAAO,GAAG,GAAG,QAAQ,QAAQ,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC;QAC/D,EAAE,CAAC,aAAa,CAAC,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;QAC1D,wEAAwE;QACxE,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC;QACtC,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;QAEjC,MAAM,GAAG,IAAI,CAAC;QACd,OAAO,MAAM,CAAC;IAChB,CAAC;IAED,2CAA2C;IAC3C,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,6BAA6B,gBAAgB,eAAe,IAAI,CAAC,IAAI,IAAI;YACjG,iGAAiG;YACjG,6CAA6C,CAChD,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,kBAAkB,QAAQ,iDAAiD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI;gBAC7F,uBAAuB,QAAQ,EAAE,CACpC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;IACvC,MAAM,GAAG,IAAI,CAAC;IACd,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,kBAAkB;IAChC,MAAM,QAAQ,GAAG,iBAAiB,EAAE,CAAC;IAErC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,+CAA+C;QAC/C,OAAO;IACT,CAAC;IAED,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAEnC,IAAI,IAAI,CAAC,IAAI,KAAK,gBAAgB,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CACb,uCAAuC,IAAI,CAAC,IAAI,cAAc,gBAAgB,EAAE,CACjF,CAAC;IACJ,CAAC;IAED,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;QACjC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;QAC/B,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,MAAM,IAAI,KAAK,CACb,gDAAgD,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,kBAAkB,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,sBAAsB;IACpC,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC"}