@formigio/fazemos-cli 0.10.54 → 0.10.58

package/dist/commands/profiles.js

@@ -0,0 +1,370 @@
+/**
+ * F48-B — Execution Profiles CLI commands.
+ *
+ * Exports `registerProfilesCommands(program)` which wires the following
+ * subcommands under `fazemos profiles`:
+ *
+ *   fazemos profiles create <name>
+ *     → POST /api/projects/:projectId/profiles  {name, model, description, baseVersion, cpu, memory, networkPlacement}
+ *     Owner/admin only. Returns { profile }.
+ *
+ *   fazemos profiles list
+ *     → GET /api/projects/:projectId/profiles
+ *     All project members. Returns metadata list.
+ *
+ *   fazemos profiles show <name>
+ *     → GET /api/projects/:projectId/profiles/:name
+ *     All project members. Full profile detail including build source + latest build.
+ *
+ *   fazemos profiles delete <name> [-y]
+ *     → DELETE /api/projects/:projectId/profiles/:name (owner/admin)
+ *     Soft-deletes profile row. Prompts for confirmation unless --yes / -y is passed.
+ *
+ *   fazemos profiles register-source <name>
+ *     → POST /api/projects/:projectId/profiles/:name/source
+ *     Owner/admin. Registers/replaces Model B build source. credentialSecretName
+ *     is a POINTER (name of a project_secrets row); value is NEVER stored or logged.
+ *
+ *   fazemos profiles register-image <name>  [B2 DEFERRED — stub]
+ *   fazemos profiles admit <name>           [B2 DEFERRED — stub]
+ *
+ * Auth: all commands require a valid Cognito session + active project context.
+ * Project ID is threaded in the URL path so noProjectHeader: true on every call.
+ *
+ * Spec: F48-phaseB-partner-custom-images-manifest.yaml §cli / §api
+ */
+import chalk from 'chalk';
+import { createInterface } from 'readline';
+import { api, ApiError, resolveProjectIdBySlug } from '../api.js';
+// ── Project resolution ────────────────────────────────────────────────────────
+/**
+ * Resolve the active project ID for a profiles command.
+ * Mirrors the pattern from commands/secrets.ts.
+ */
+async function requireProjectForProfiles(slugOverride) {
+    let projectId;
+    try {
+        projectId = await resolveProjectIdBySlug(slugOverride);
+    }
+    catch (err) {
+        console.error(chalk.red(err?.message ?? String(err)));
+        process.exit(1);
+    }
+    if (!projectId) {
+        console.error(chalk.red('Error: requirement missing: project'));
+        console.error('');
+        console.error(chalk.gray('Set one with:  fazemos projects switch <slug>'));
+        console.error(chalk.gray('Or pass:       --project <slug>'));
+        process.exit(1);
+    }
+    return projectId;
+}
+// ── Confirmation prompt ───────────────────────────────────────────────────────
+function confirmPrompt(message) {
+    return new Promise((resolve) => {
+        const rl = createInterface({
+            input: process.stdin,
+            output: process.stdout,
+        });
+        rl.question(`${message} [y/N] `, (answer) => {
+            rl.close();
+            resolve(answer.trim().toLowerCase() === 'y');
+        });
+    });
+}
+// ── Profile formatting helpers ────────────────────────────────────────────────
+function statusColor(status) {
+    switch (status) {
+        case 'ready': return chalk.green(status);
+        case 'building': return chalk.yellow(status);
+        case 'failed': return chalk.red(status);
+        case 'disabled': return chalk.gray(status);
+        default: return chalk.gray(status); // draft / unknown
+    }
+}
+function admissionColor(status) {
+    switch (status) {
+        case 'admitted': return chalk.green(status);
+        case 'rejected': return chalk.red(status);
+        case 'pending': return chalk.yellow(status);
+        case 'not_required': return chalk.gray(status);
+        default: return chalk.gray(status);
+    }
+}
+function printProfile(p) {
+    console.log('');
+    console.log(`${chalk.cyan(p.name)}  ${statusColor(p.status)}  ${chalk.gray('[' + p.model + ']')}`);
+    if (p.description)
+        console.log(`  ${p.description}`);
+    console.log(`  ID:               ${p.id}`);
+    console.log(`  Status:           ${statusColor(p.status)}`);
+    console.log(`  Model:            ${p.model}`);
+    console.log(`  Base version:     ${p.baseVersion ?? '(none)'}`);
+    console.log(`  CPU / Memory:     ${p.cpu ?? '(default)'} / ${p.memory ?? '(default)'}`);
+    console.log(`  Network:          ${p.networkPlacement}`);
+    console.log(`  IAM tier:         ${p.iamTier}`);
+    console.log(`  Admission status: ${admissionColor(p.admissionStatus)}`);
+    console.log(`  Task-def family:  ${p.taskDefFamily ?? '(none)'}`);
+    console.log(`  Image URI:        ${p.imageUri ?? '(none)'}`);
+    console.log(`  Created:          ${p.createdAt ? new Date(p.createdAt).toLocaleString() : ''}`);
+    console.log(`  Updated:          ${p.updatedAt ? new Date(p.updatedAt).toLocaleString() : ''}`);
+    if (p.source) {
+        console.log('  Source:');
+        console.log(`    Repo:           ${p.source.repoUrl}`);
+        console.log(`    Ref:            ${p.source.ref}`);
+        console.log(`    Manifest path:  ${p.source.manifestPath ?? 'fazemos-image.yaml'}`);
+        console.log(`    Credential:     ${p.source.credentialSecretName}  ${chalk.gray('(secret pointer — value never shown)')}`);
+    }
+    else {
+        console.log('  Source:           (none registered)');
+    }
+    if (p.latestBuild) {
+        const b = p.latestBuild;
+        console.log('  Latest build:');
+        console.log(`    Build ID:       ${b.buildId}`);
+        console.log(`    Status:         ${statusColor(b.status)}`);
+        console.log(`    Resolved SHA:   ${b.resolvedSha ?? '(pending)'}`);
+        console.log(`    Image digest:   ${b.imageDigest ?? '(pending)'}`);
+        console.log(`    Created:        ${b.createdAt ? new Date(b.createdAt).toLocaleString() : ''}`);
+    }
+    else {
+        console.log('  Latest build:     (none)');
+    }
+}
+function handleProfileError(err) {
+    if (err instanceof ApiError) {
+        if (err.code === 'INSUFFICIENT_ROLE') {
+            console.error(chalk.red('Error: Only project owners and admins can perform this action'));
+        }
+        else if (err.code === 'PROFILE_NOT_FOUND') {
+            console.error(chalk.red('Error: Profile not found'));
+        }
+        else if (err.code === 'INVALID_NAME') {
+            console.error(chalk.red('Error: Profile name format invalid (slug, max 64 chars)'));
+        }
+        else if (err.code === 'INVALID_MODEL') {
+            console.error(chalk.red("Error: --model must be 'fazemos-build' or 'byo-image'"));
+        }
+        else if (err.code === 'INVALID_NETWORK_PLACEMENT') {
+            console.error(chalk.red("Error: --network must be 'default' or 'fazemos-static-egress'"));
+        }
+        else if (err.code === 'CREDENTIAL_SECRET_NOT_FOUND') {
+            console.error(chalk.red('Error: Credential secret not found — run `fazemos secrets set <NAME>` first'));
+        }
+        else {
+            console.error(chalk.red(err.message));
+        }
+    }
+    else {
+        console.error(chalk.red(err?.message ?? String(err)));
+    }
+    process.exit(1);
+}
+// ── Command registration ──────────────────────────────────────────────────────
+export function registerProfilesCommands(program) {
+    const profiles = program
+        .command('profiles')
+        .description('Execution profile management (F48-B — partner custom images)');
+    // ── profiles create ────────────────────────────────────────────────────────
+    profiles
+        .command('create')
+        .description('Create a new execution profile (owner/admin only). ' +
+        'Model B (fazemos-build) is the default: Fazemos builds the image from your repo. ' +
+        'Model A (byo-image) brings your own image — requires admission gate (Phase B.2).')
+        .argument('<name>', 'Profile name — slug format, unique per project (max 64 chars)')
+        .option('--model <model>', "Execution model: 'fazemos-build' (default) or 'byo-image'", 'fazemos-build')
+        .option('--base <version>', 'Base contract version (e.g. fazemos-agent-base:v1)')
+        .option('--cpu <n>', 'CPU units override (e.g. 1024 = 1 vCPU)', parseInt)
+        .option('--memory <n>', 'Memory MiB override (e.g. 2048)', parseInt)
+        .option('--network <placement>', "Network placement: 'default' or 'fazemos-static-egress'")
+        .option('--description <text>', 'Human-readable description of this profile')
+        .option('--project <slug>', 'Override active project for this call')
+        .action(async (name, opts) => {
+        try {
+            const projectId = await requireProjectForProfiles(opts.project);
+            // Map CLI flag values to API values
+            const modelMap = {
+                'fazemos-build': 'fazemos_build',
+                'byo-image': 'byo_image',
+            };
+            const apiModel = modelMap[opts.model];
+            if (!apiModel) {
+                console.error(chalk.red("Error: --model must be 'fazemos-build' or 'byo-image'"));
+                process.exit(1);
+            }
+            const body = { name, model: apiModel };
+            if (opts.description)
+                body.description = opts.description;
+            if (opts.base)
+                body.baseVersion = opts.base;
+            if (opts.cpu != null)
+                body.cpu = opts.cpu;
+            if (opts.memory != null)
+                body.memory = opts.memory;
+            if (opts.network)
+                body.networkPlacement = opts.network;
+            const data = await api('POST', `/api/projects/${projectId}/profiles`, body, { noProjectHeader: true });
+            const p = data.profile;
+            console.log(chalk.green(`Profile '${p.name}' created.`));
+            printProfile(p);
+        }
+        catch (err) {
+            handleProfileError(err);
+        }
+    });
+    // ── profiles list ──────────────────────────────────────────────────────────
+    profiles
+        .command('list')
+        .description('List execution profiles in the active project')
+        .option('--project <slug>', 'Override active project for this call')
+        .option('--json', 'Output raw JSON')
+        .action(async (opts) => {
+        try {
+            const projectId = await requireProjectForProfiles(opts.project);
+            const data = await api('GET', `/api/projects/${projectId}/profiles`, undefined, { noProjectHeader: true });
+            const items = data.profiles ?? [];
+            if (opts.json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            if (items.length === 0) {
+                console.log(chalk.yellow('No profiles'));
+                return;
+            }
+            const nameW = Math.max(4, ...items.map((p) => String(p.name ?? '').length));
+            const modelW = Math.max(5, ...items.map((p) => String(p.model ?? '').length));
+            const statusW = Math.max(6, ...items.map((p) => String(p.status ?? '').length));
+            const header = [
+                'NAME'.padEnd(nameW),
+                'MODEL'.padEnd(modelW),
+                'STATUS'.padEnd(statusW),
+                'IMAGE URI',
+            ].join('  ');
+            console.log(chalk.gray(header));
+            console.log(chalk.gray('─'.repeat(header.length + 20)));
+            for (const p of items) {
+                const imageUri = p.imageUri ? p.imageUri.slice(0, 48) + (p.imageUri.length > 48 ? '…' : '') : '(none)';
+                console.log([
+                    String(p.name ?? '').padEnd(nameW),
+                    String(p.model ?? '').padEnd(modelW),
+                    String(p.status ?? '').padEnd(statusW),
+                    imageUri,
+                ].join('  '));
+            }
+        }
+        catch (err) {
+            handleProfileError(err);
+        }
+    });
+    // ── profiles show ──────────────────────────────────────────────────────────
+    profiles
+        .command('show')
+        .description('Show execution profile detail (build source, latest build, admission status)')
+        .argument('<name>', 'Profile name')
+        .option('--project <slug>', 'Override active project for this call')
+        .option('--json', 'Output raw JSON')
+        .action(async (name, opts) => {
+        try {
+            const projectId = await requireProjectForProfiles(opts.project);
+            const data = await api('GET', `/api/projects/${projectId}/profiles/${encodeURIComponent(name)}`, undefined, { noProjectHeader: true });
+            if (opts.json) {
+                console.log(JSON.stringify(data, null, 2));
+                return;
+            }
+            printProfile(data.profile);
+        }
+        catch (err) {
+            handleProfileError(err);
+        }
+    });
+    // ── profiles delete ────────────────────────────────────────────────────────
+    profiles
+        .command('delete')
+        .description('Delete (soft-delete) an execution profile (owner/admin only)')
+        .argument('<name>', 'Profile name')
+        .option('--project <slug>', 'Override active project for this call')
+        .option('-y, --yes', 'Skip confirmation prompt')
+        .action(async (name, opts) => {
+        try {
+            const projectId = await requireProjectForProfiles(opts.project);
+            if (!opts.yes) {
+                const confirmed = await confirmPrompt(`Delete profile ${chalk.cyan(name)}? This soft-deletes the profile and any associated builds.`);
+                if (!confirmed) {
+                    console.log('Aborted.');
+                    return;
+                }
+            }
+            await api('DELETE', `/api/projects/${projectId}/profiles/${encodeURIComponent(name)}`, undefined, { noProjectHeader: true });
+            console.log(chalk.green(`Profile '${name}' deleted.`));
+        }
+        catch (err) {
+            handleProfileError(err);
+        }
+    });
+    // ── profiles register-source ───────────────────────────────────────────────
+    profiles
+        .command('register-source')
+        .description('Register (or replace) the Model B build source for a profile (owner/admin only). ' +
+        '--credential is the NAME of a project secret (set via `fazemos secrets set`). ' +
+        'The secret value is read directly by the build service — it is NEVER returned by this command.')
+        .argument('<name>', 'Profile name')
+        .requiredOption('--repo <url>', 'Partner repository URL (e.g. git@github.com:org/repo.git)')
+        .requiredOption('--ref <ref>', 'Branch, tag, or commit SHA to build from')
+        .requiredOption('--credential <secret-name>', 'Name of a project secret holding the deploy key / PAT')
+        .option('--manifest <path>', 'Path to fazemos-image.yaml in the repo (default: fazemos-image.yaml)', 'fazemos-image.yaml')
+        .option('--project <slug>', 'Override active project for this call')
+        .action(async (name, opts) => {
+        try {
+            const projectId = await requireProjectForProfiles(opts.project);
+            const body = {
+                repoUrl: opts.repo,
+                ref: opts.ref,
+                credentialSecretName: opts.credential,
+                manifestPath: opts.manifest,
+            };
+            const data = await api('POST', `/api/projects/${projectId}/profiles/${encodeURIComponent(name)}/source`, body, { noProjectHeader: true });
+            console.log(chalk.green(`Build source registered for profile '${name}'.`));
+            console.log(`  Repo:        ${opts.repo}`);
+            console.log(`  Ref:         ${opts.ref}`);
+            console.log(`  Manifest:    ${opts.manifest}`);
+            console.log(`  Credential:  ${opts.credential}  ${chalk.gray('(secret pointer — value never shown)')}`);
+            console.log('');
+            console.log(chalk.gray('Next step: run `fazemos image build ' + name + '` to trigger a build.'));
+            const p = data.profile;
+            if (p)
+                printProfile(p);
+        }
+        catch (err) {
+            handleProfileError(err);
+        }
+    });
+    // ── profiles register-image [B2 DEFERRED] ─────────────────────────────────
+    profiles
+        .command('register-image')
+        .description('[B2 DEFERRED] Register a BYO (Model A) image URI for a profile. ' +
+        'Not available in Phase B.1 — open a GitHub issue to track B.2 delivery.')
+        .argument('<name>', 'Profile name')
+        .option('--image-uri <uri>', 'Partner ECR image URI (digest-addressable)')
+        .option('--signing-key <path|inline>', 'Partner signing public key (file path or inline PEM)')
+        .option('--project <slug>', 'Override active project for this call')
+        .action(async (_name, _opts) => {
+        console.error(chalk.red('Error: `profiles register-image` is not available in Phase B.1.'));
+        console.error(chalk.gray('Model A (BYO image + admission gate) is deferred to Phase B.2.'));
+        console.error(chalk.gray('Use `fazemos profiles register-source` + `fazemos image build` for Model B (Fazemos-builds).'));
+        process.exit(1);
+    });
+    // ── profiles admit [B2 DEFERRED] ──────────────────────────────────────────
+    profiles
+        .command('admit')
+        .description('[B2 DEFERRED] Run the Model A admission gate (scan + signature verify + digest-pin) for a profile. ' +
+        'Not available in Phase B.1.')
+        .argument('<name>', 'Profile name')
+        .option('--scan-only', 'Run vulnerability scan only, do not fully admit')
+        .option('--project <slug>', 'Override active project for this call')
+        .action(async (_name, _opts) => {
+        console.error(chalk.red('Error: `profiles admit` is not available in Phase B.1.'));
+        console.error(chalk.gray('Model A admission gate (scan + signature verification) is deferred to Phase B.2.'));
+        process.exit(1);
+    });
+}
+//# sourceMappingURL=profiles.js.map

package/dist/commands/profiles.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"profiles.js","sourceRoot":"","sources":["../../src/commands/profiles.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAGH,OAAO,KAAK,MAAM,OAAO,CAAC;AAC1B,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAC3C,OAAO,EAAE,GAAG,EAAE,QAAQ,EAAE,sBAAsB,EAAE,MAAM,WAAW,CAAC;AAElE,iFAAiF;AAEjF;;;GAGG;AACH,KAAK,UAAU,yBAAyB,CAAC,YAAqB;IAC5D,IAAI,SAAwB,CAAC;IAC7B,IAAI,CAAC;QACH,SAAS,GAAG,MAAM,sBAAsB,CAAC,YAAY,CAAC,CAAC;IACzD,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;QACtD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,qCAAqC,CAAC,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,+CAA+C,CAAC,CAAC,CAAC;QAC3E,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,iCAAiC,CAAC,CAAC,CAAC;QAC7D,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iFAAiF;AAEjF,SAAS,aAAa,CAAC,OAAe;IACpC,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,EAAE,GAAG,eAAe,CAAC;YACzB,KAAK,EAAE,OAAO,CAAC,KAAK;YACpB,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,EAAE,CAAC,QAAQ,CAAC,GAAG,OAAO,SAAS,EAAE,CAAC,MAAM,EAAE,EAAE;YAC1C,EAAE,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,GAAG,CAAC,CAAC;QAC/C,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC;AAED,iFAAiF;AAEjF,SAAS,WAAW,CAAC,MAAc;IACjC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,OAAO,CAAC,CAAI,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAC5C,KAAK,UAAU,CAAC,CAAC,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAC7C,KAAK,QAAQ,CAAC,CAAG,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC1C,KAAK,UAAU,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC3C,OAAO,CAAC,CAAS,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAE,kBAAkB;IACjE,CAAC;AACH,CAAC;AAED,SAAS,cAAc,CAAC,MAAc;IACpC,QAAQ,MAAM,EAAE,CAAC;QACf,KAAK,UAAU,CAAC,CAAK,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QAChD,KAAK,UAAU,CAAC,CAAK,OAAO,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC9C,KAAK,SAAS,CAAC,CAAM,OAAO,KAAK,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACjD,KAAK,cAAc,CAAC,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,CAAC,CAAa,OAAO,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACjD,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,CAAM;IAC1B,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IAChB,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,CAAC,KAAK,GAAG,GAAG,CAAC,EAAE,CAAC,CAAC;IACnG,IAAI,CAAC,CAAC,WAAW;QAAE,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC;IACrD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,uBAAuB,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IAC5D,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC;IAC9C,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,WAAW,IAAI,QAAQ,EAAE,CAAC,CAAC;IAChE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,GAAG,IAAI,WAAW,MAAM,CAAC,CAAC,MAAM,IAAI,WAAW,EAAE,CAAC,CAAC;IACxF,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,gBAAgB,EAAE,CAAC,CAAC;IACzD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CAAC,uBAAuB,cAAc,CAAC,CAAC,CAAC,eAAe,CAAC,EAAE,CAAC,CAAC;IACxE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,aAAa,IAAI,QAAQ,EAAE,CAAC,CAAC;IAClE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,QAAQ,IAAI,QAAQ,EAAE,CAAC,CAAC;IAC7D,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChG,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAChG,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;QACb,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;QACzB,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC;QACnD,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,YAAY,IAAI,oBAAoB,EAAE,CAAC,CAAC;QACpF,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,MAAM,CAAC,oBAAoB,KAAK,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;IAC7H,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,uCAAuC,CAAC,CAAC;IACvD,CAAC;IACD,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;QAClB,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;QAC/B,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC;QAChD,OAAO,CAAC,GAAG,CAAC,uBAAuB,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;QAC5D,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,WAAW,IAAI,WAAW,EAAE,CAAC,CAAC;QACnE,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;IAClG,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAC5C,CAAC;AACH,CAAC;AAED,SAAS,kBAAkB,CAAC,GAAQ;IAClC,IAAI,GAAG,YAAY,QAAQ,EAAE,CAAC;QAC5B,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAC;QAC5F,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,mBAAmB,EAAE,CAAC;YAC5C,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,0BAA0B,CAAC,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,cAAc,EAAE,CAAC;YACvC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,yDAAyD,CAAC,CAAC,CAAC;QACtF,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,eAAe,EAAE,CAAC;YACxC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC;QACpF,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,2BAA2B,EAAE,CAAC;YACpD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,+DAA+D,CAAC,CAAC,CAAC;QAC5F,CAAC;aAAM,IAAI,GAAG,CAAC,IAAI,KAAK,6BAA6B,EAAE,CAAC;YACtD,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,6EAA6E,CAAC,CAAC,CAAC;QAC1G,CAAC;aAAM,CAAC;YACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;QACxC,CAAC;IACH,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC;IACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC;AAED,iFAAiF;AAEjF,MAAM,UAAU,wBAAwB,CAAC,OAAgB;IACvD,MAAM,QAAQ,GAAG,OAAO;SACrB,OAAO,CAAC,UAAU,CAAC;SACnB,WAAW,CAAC,8DAA8D,CAAC,CAAC;IAE/E,8EAA8E;IAE9E,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CACV,qDAAqD;QACrD,mFAAmF;QACnF,kFAAkF,CACnF;SACA,QAAQ,CAAC,QAAQ,EAAE,+DAA+D,CAAC;SACnF,MAAM,CAAC,iBAAiB,EAAE,2DAA2D,EAAE,eAAe,CAAC;SACvG,MAAM,CAAC,kBAAkB,EAAE,oDAAoD,CAAC;SAChF,MAAM,CAAC,WAAW,EAAE,yCAAyC,EAAE,QAAQ,CAAC;SACxE,MAAM,CAAC,cAAc,EAAE,iCAAiC,EAAE,QAAQ,CAAC;SACnE,MAAM,CAAC,uBAAuB,EAAE,yDAAyD,CAAC;SAC1F,MAAM,CAAC,sBAAsB,EAAE,4CAA4C,CAAC;SAC5E,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEhE,oCAAoC;YACpC,MAAM,QAAQ,GAA2B;gBACvC,eAAe,EAAE,eAAe;gBAChC,WAAW,EAAM,WAAW;aAC7B,CAAC;YACF,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YACtC,IAAI,CAAC,QAAQ,EAAE,CAAC;gBACd,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,uDAAuD,CAAC,CAAC,CAAC;gBAClF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YAED,MAAM,IAAI,GAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;YAC5C,IAAI,IAAI,CAAC,WAAW;gBAAG,IAAI,CAAC,WAAW,GAAO,IAAI,CAAC,WAAW,CAAC;YAC/D,IAAI,IAAI,CAAC,IAAI;gBAAU,IAAI,CAAC,WAAW,GAAQ,IAAI,CAAC,IAAI,CAAC;YACzD,IAAI,IAAI,CAAC,GAAG,IAAI,IAAI;gBAAG,IAAI,CAAC,GAAG,GAAgB,IAAI,CAAC,GAAG,CAAC;YACxD,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI;gBAAE,IAAI,CAAC,MAAM,GAAW,IAAI,CAAC,MAAM,CAAC;YAC3D,IAAI,IAAI,CAAC,OAAO;gBAAO,IAAI,CAAC,gBAAgB,GAAG,IAAI,CAAC,OAAO,CAAC;YAE5D,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,MAAM,EACN,iBAAiB,SAAS,WAAW,EACrC,IAAI,EACJ,EAAE,eAAe,EAAE,IAAI,EAAE,CACnB,CAAC;YAET,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,IAAI,YAAY,CAAC,CAAC,CAAC;YACzD,YAAY,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,+CAA+C,CAAC;SAC5D,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;SACnC,MAAM,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE;QACrB,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,KAAK,EACL,iBAAiB,SAAS,WAAW,EACrC,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CACnB,CAAC;YAET,MAAM,KAAK,GAAU,IAAI,CAAC,QAAQ,IAAI,EAAE,CAAC;YAEzC,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;gBACvB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,MAAM,KAAK,GAAK,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,IAAM,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,MAAM,MAAM,GAAI,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAK,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAChF,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC;YAEhF,MAAM,MAAM,GAAG;gBACb,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC;gBACpB,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC;gBACtB,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC;gBACxB,WAAW;aACZ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACb,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;YAChC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC;YAExD,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;gBACtB,MAAM,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;gBACvG,OAAO,CAAC,GAAG,CAAC;oBACV,MAAM,CAAC,CAAC,CAAC,IAAI,IAAM,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC;oBACpC,MAAM,CAAC,CAAC,CAAC,KAAK,IAAK,EAAE,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;oBACrC,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC;oBACtC,QAAQ;iBACT,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;YAChB,CAAC;QACH,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,QAAQ;SACL,OAAO,CAAC,MAAM,CAAC;SACf,WAAW,CAAC,8EAA8E,CAAC;SAC3F,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;SAClC,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,QAAQ,EAAE,iBAAiB,CAAC;SACnC,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChE,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,KAAK,EACL,iBAAiB,SAAS,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,EACjE,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CACnB,CAAC;YAET,IAAI,IAAI,CAAC,IAAI,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;gBAC3C,OAAO;YACT,CAAC;YAED,YAAY,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC7B,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,QAAQ;SACL,OAAO,CAAC,QAAQ,CAAC;SACjB,WAAW,CAAC,8DAA8D,CAAC;SAC3E,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;SAClC,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,WAAW,EAAE,0BAA0B,CAAC;SAC/C,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEhE,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC;gBACd,MAAM,SAAS,GAAG,MAAM,aAAa,CACnC,kBAAkB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,4DAA4D,CAC/F,CAAC;gBACF,IAAI,CAAC,SAAS,EAAE,CAAC;oBACf,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;oBACxB,OAAO;gBACT,CAAC;YACH,CAAC;YAED,MAAM,GAAG,CACP,QAAQ,EACR,iBAAiB,SAAS,aAAa,kBAAkB,CAAC,IAAI,CAAC,EAAE,EACjE,SAAS,EACT,EAAE,eAAe,EAAE,IAAI,EAAE,CAC1B,CAAC;YACF,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,YAAY,IAAI,YAAY,CAAC,CAAC,CAAC;QACzD,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,8EAA8E;IAE9E,QAAQ;SACL,OAAO,CAAC,iBAAiB,CAAC;SAC1B,WAAW,CACV,mFAAmF;QACnF,gFAAgF;QAChF,gGAAgG,CACjG;SACA,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;SAClC,cAAc,CAAC,cAAc,EAAE,2DAA2D,CAAC;SAC3F,cAAc,CAAC,aAAa,EAAE,0CAA0C,CAAC;SACzE,cAAc,CAAC,4BAA4B,EAAE,uDAAuD,CAAC;SACrG,MAAM,CAAC,mBAAmB,EAAE,sEAAsE,EAAE,oBAAoB,CAAC;SACzH,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,IAAY,EAAE,IAAI,EAAE,EAAE;QACnC,IAAI,CAAC;YACH,MAAM,SAAS,GAAG,MAAM,yBAAyB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAEhE,MAAM,IAAI,GAAQ;gBAChB,OAAO,EAAe,IAAI,CAAC,IAAI;gBAC/B,GAAG,EAAmB,IAAI,CAAC,GAAG;gBAC9B,oBAAoB,EAAE,IAAI,CAAC,UAAU;gBACrC,YAAY,EAAU,IAAI,CAAC,QAAQ;aACpC,CAAC;YAEF,MAAM,IAAI,GAAG,MAAM,GAAG,CACpB,MAAM,EACN,iBAAiB,SAAS,aAAa,kBAAkB,CAAC,IAAI,CAAC,SAAS,EACxE,IAAI,EACJ,EAAE,eAAe,EAAE,IAAI,EAAE,CACnB,CAAC;YAET,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,CAAC,wCAAwC,IAAI,IAAI,CAAC,CAAC,CAAC;YAC3E,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;YAC3C,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;YAC1C,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;YAC/C,OAAO,CAAC,GAAG,CAAC,kBAAkB,IAAI,CAAC,UAAU,KAAK,KAAK,CAAC,IAAI,CAAC,sCAAsC,CAAC,EAAE,CAAC,CAAC;YACxG,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;YAChB,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,sCAAsC,GAAG,IAAI,GAAG,uBAAuB,CAAC,CAAC,CAAC;YAEjG,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,CAAC;YACvB,IAAI,CAAC;gBAAE,YAAY,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAQ,EAAE,CAAC;YAClB,kBAAkB,CAAC,GAAG,CAAC,CAAC;QAC1B,CAAC;IACH,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAE7E,QAAQ;SACL,OAAO,CAAC,gBAAgB,CAAC;SACzB,WAAW,CACV,kEAAkE;QAClE,yEAAyE,CAC1E;SACA,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;SAClC,MAAM,CAAC,mBAAmB,EAAE,4CAA4C,CAAC;SACzE,MAAM,CAAC,6BAA6B,EAAE,sDAAsD,CAAC;SAC7F,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,KAAK,EAAE,EAAE;QACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,iEAAiE,CAAC,CAAC,CAAC;QAC5F,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,gEAAgE,CAAC,CAAC,CAAC;QAC5F,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,8FAA8F,CAAC,CAAC,CAAC;QAC1H,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;IAEL,6EAA6E;IAE7E,QAAQ;SACL,OAAO,CAAC,OAAO,CAAC;SAChB,WAAW,CACV,qGAAqG;QACrG,6BAA6B,CAC9B;SACA,QAAQ,CAAC,QAAQ,EAAE,cAAc,CAAC;SAClC,MAAM,CAAC,aAAa,EAAE,iDAAiD,CAAC;SACxE,MAAM,CAAC,kBAAkB,EAAE,uCAAuC,CAAC;SACnE,MAAM,CAAC,KAAK,EAAE,KAAa,EAAE,KAAK,EAAE,EAAE;QACrC,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,wDAAwD,CAAC,CAAC,CAAC;QACnF,OAAO,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,kFAAkF,CAAC,CAAC,CAAC;QAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC,CAAC,CAAC;AACP,CAAC"}

package/dist/index.js

@@ -26,6 +26,8 @@ import { registerFtrCommand } from './ftr.js';
 import { registerScheduleCommands } from './schedule.js';
 import { registerApprovalsCommands } from './approvals.js';
 import { registerSecretsCommands } from './commands/secrets.js';
+import { registerProfilesCommands } from './commands/profiles.js';
+import { registerImageCommands } from './commands/image.js';
 import { parseExecutionsJson, resolveWaitOptions, waitForPipelines, buildAwsCommand, validateExecutionEntry, } from './wait-for-pipeline.js';
 import { readFileSync, readdirSync, writeFileSync, mkdirSync, existsSync, statSync } from 'fs';
 import { fileURLToPath } from 'url';
@@ -5640,6 +5642,94 @@ pipelines
         process.exit(1);
     }
 });
+// ── OPERATOR-RECOVERY-BUNDLE — `pl reconcile <instanceId>` ──
+// Idempotent operator-safe healing command (spec §2).
+// Re-runs the DAG resolver, detects stranded steps (queued/in_progress with
+// no live execution), gates through canLaunch, re-launches eligible ones,
+// and returns a structured JSON report (launched, skipped, stalled).
+//
+//   POST /api/pipeline-instances/:id/reconcile
+//   Auth: owner or admin only
+//
+// Distinct from pl rematerialize (P-TOOL-1): rematerialize rebases onto the
+// TEMPLATE (schema/content-side); reconcile re-launches missing EXECUTIONS on
+// the instance as-is (runtime-side only). Different jobs kept separate.
+pipelines
+    .command('reconcile')
+    .description('Idempotent operator recovery: re-runs the DAG resolver, detects stranded steps ' +
+    '(queued/in_progress with no live execution), and re-launches eligible ones. ' +
+    'Safe to run multiple times — the second call fires nothing if the first succeeded. ' +
+    'Owner/admin only. Distinct from rematerialize: this heals EXECUTIONS, not the template schema.')
+    .argument('<instanceId>', 'Pipeline instance ID')
+    .option('--json', 'Print the raw API response as JSON (machine-readable)')
+    .action(async (instanceId, opts) => {
+    try {
+        const path = `/api/pipeline-instances/${instanceId}/reconcile`;
+        const data = (await api('POST', path, {}));
+        if (opts.json) {
+            console.log(JSON.stringify(data, null, 2));
+            return;
+        }
+        // Human-readable reconcile report
+        const reconciledAt = data?.reconciled_at ? new Date(data.reconciled_at).toLocaleString() : 'unknown';
+        console.log(chalk.bold(`Reconcile — instance ${instanceId}`));
+        console.log(chalk.gray(`  Reconciled at : ${reconciledAt}`));
+        console.log(chalk.gray(`  DAG resolver  : ${data?.dag_resolver_ran ? 'ran' : 'skipped'}`));
+        console.log(chalk.gray(`  Steps verified: ${data?.steps_verified ?? 0}`));
+        console.log();
+        // Launched
+        const launched = Array.isArray(data?.launched) ? data.launched : [];
+        if (launched.length > 0) {
+            console.log(chalk.green(`  Launched (${launched.length}):`));
+            for (const s of launched) {
+                console.log(chalk.green(`    ✓ ${s.step_name} (${s.step_id}) → execution ${s.execution_id}` +
+                    (s.assigned_to ? ` [agent: ${s.assigned_to}]` : '')));
+            }
+        }
+        else {
+            console.log(chalk.gray('  Launched: (none)'));
+        }
+        // Skipped (canLaunch=false due to pause/budget/fan-out)
+        const skipped = Array.isArray(data?.skipped) ? data.skipped : [];
+        if (skipped.length > 0) {
+            console.log(chalk.yellow(`\n  Skipped — canLaunch blocked (${skipped.length}):`));
+            for (const s of skipped) {
+                console.log(chalk.yellow(`    ⚠ ${s.step_name} (${s.step_id}) [${s.reason}]: ${s.detail}`));
+            }
+        }
+        // Stalled (governance signal — queued, no execution, canLaunch=false for other reason)
+        const stalled = Array.isArray(data?.stalled) ? data.stalled : [];
+        if (stalled.length > 0) {
+            console.log(chalk.red(`\n  Stalled — governance signal (${stalled.length}):`));
+            for (const s of stalled) {
+                console.log(chalk.red(`    ✗ ${s.step_name} (${s.step_id}) [status: ${s.status}]: ${s.detail}`));
+            }
+        }
+        console.log();
+        if (launched.length === 0 && skipped.length === 0 && stalled.length === 0) {
+            console.log(chalk.green('No stranded steps found — instance is healthy.'));
+        }
+        else {
+            const summary = [];
+            if (launched.length > 0)
+                summary.push(chalk.green(`${launched.length} launched`));
+            if (skipped.length > 0)
+                summary.push(chalk.yellow(`${skipped.length} skipped`));
+            if (stalled.length > 0)
+                summary.push(chalk.red(`${stalled.length} stalled`));
+            console.log(`Summary: ${summary.join(', ')}`);
+        }
+    }
+    catch (err) {
+        // 403 owner/admin gate
+        if (err instanceof ApiError && err.status === 403) {
+            console.error(chalk.red(`Permission denied: ${err.message}`));
+            process.exit(1);
+        }
+        console.error(chalk.red(err.message));
+        process.exit(1);
+    }
+});
 pipelines
     .command('set-params')
     .description('Set instance parameters (atomic update)')
@@ -6260,6 +6350,7 @@ program
     .option('--repos <repos>', 'Comma-separated repo names to clone (overrides agent config)', (v) => v.split(','))
     .option('--model <model>', 'Model override (e.g., opus, sonnet)')
     .option('--budget <usd>', 'Max budget override in USD', parseNumber)
+    .option('--profile <name>', 'Named execution profile (F48-B). Threaded into POST /api/executions context as context.profile. Tracking-only in B.1 — does not change runtime resolution.')
     .action(async (sourceId, opts) => {
     try {
         const validTypes = ['action', 'commitment', 'pipeline_step'];
@@ -6392,6 +6483,13 @@ program
         }
         if (opts.prompt)
             context.prompt = opts.prompt;
+        // [F48-B LD-14] --profile threads the named profile into context.profile
+        // for tracking/dispatch. In Phase B.1 this field is recorded on the
+        // executions row but does NOT drive runtime resolution — the nb-scanning
+        // path continues through the unchanged Phase-A tools path. B.2 will wire
+        // the DB-backed resolver at executionService.ts.
+        if (opts.profile)
+            context.profile = opts.profile;
         // [F24 §3.3 / D2] Forward --no-auto-complete intent. The CLI guard
         // above suppresses this for pipeline_step (forwardSuppress is false
         // in that case). Agent's buildSelfReportingInstructions reads
@@ -10227,6 +10325,22 @@ registerApprovalsCommands(program);
 // set supports interactive masked input, --value-from <file>, positional arg,
 // and piped stdin. delete prompts for confirmation unless --yes / -y is passed.
 registerSecretsCommands(program);
+// ── F48-B — Execution Profiles: profiles create / list / show / delete / register-source ────
+// Registers `profiles` top-level command and sub-commands.
+// All calls use project ID in the URL path (/api/projects/:projectId/profiles/...);
+// noProjectHeader: true on every call (path-scoped, not header-scoped).
+// create/delete/register-source: owner/admin only (server-side gate).
+// list/show: all project members.
+// register-image / admit: B2 DEFERRED stubs (print friendly error + exit 1).
+registerProfilesCommands(program);
+// ── F48-B — Image Builds: image build / status / list ───────────────────────
+// Registers `image` top-level command with build, status, and list sub-commands.
+// All calls use project ID in the URL path (/api/projects/:projectId/profiles/:name/builds[/:id]);
+// noProjectHeader: true on every call.
+// build: owner/admin only. status/list: all project members.
+// When codebuildEnabled=false on a build response, the note field is surfaced
+// to the user (infrastructure not yet deployed).
+registerImageCommands(program);
 // Skip auto-parse only when running under Vitest (which sets process.env.VITEST).
 // Tests import `program` and drive it via `program.parseAsync(...)` after mocking
 // `./api.js`. In every other context — direct invocation, npx tsx, OR the bin