@getrift/rift 0.1.0-beta.2 → 0.1.0-beta.20

package/dist/src/cli/commands/update.js

@@ -0,0 +1,378 @@
+/**
+ * `rift update` — friend-readable in-place upgrade for the npm-installed CLI.
+ *
+ * Steps (in order, each one printed):
+ *   1. Resolve the target version with FRESH registry metadata
+ *      (`npm view --prefer-online @getrift/rift@beta version`), then
+ *      `npm install -g --prefer-online @getrift/rift@<that exact version>`.
+ *      Pinning the exact version (not the `@beta` tag) plus `--prefer-online`
+ *      removes the two ways an install can be a silent no-op: a stale local
+ *      cache resolving the tag to the already-installed version, and the
+ *      verify step later reading that same stale cache so a no-op "matches"
+ *      itself. Falls back to `sudo npm install -g …` exactly like
+ *      scripts/install.sh, so friends who installed via the one-liner without
+ *      nvm don't hit a permission wall. When we can resolve where the `rift`
+ *      on the friend's PATH lives, we install into THAT prefix (`--prefix`)
+ *      so the copy their terminal runs is the copy that gets upgraded.
+ *   2. VERIFY: run the `rift` on PATH and confirm its version now equals the
+ *      freshly-resolved expected version. An exit-0 npm install is NOT proof
+ *      of an upgrade — npm can install into a different prefix than the binary
+ *      on PATH. And if we could not reach the registry to learn the expected
+ *      version at all, we FAIL as "could not verify" rather than passing on
+ *      "installed something". We refuse to report success until the active
+ *      version provably equals a freshly-resolved expected version. This is
+ *      the load-bearing fix for the beta.18→beta.19 silent no-op that shipped
+ *      a CLI too old to read its own (valid) config.
+ *   3. `launchctl kickstart -k gui/$UID/com.getrift.daemon` — restarts the
+ *      daemon so it picks up the new code on disk.
+ *   4. Poll `/health` until 200 (or timeout) — proves the new build can
+ *      actually start.
+ *   5. Refresh the SwiftBar menu plugin — keeps the 10-second menu surface
+ *      on the same packaged scripts as the just-installed CLI.
+ *
+ * Failure contract:
+ *   - npm install failure (step 1): the previous install is left in place.
+ *     `npm install -g` with the same dist-tag is atomic enough here — npm
+ *     replaces `bin/rift` only after a successful tarball install.
+ *   - Verification failure (step 2): npm reported success but the `rift` on
+ *     PATH is still the old version. The transcript names both versions and
+ *     all the paths, leads with a plain-English headline ("Rift updated one
+ *     copy, but your terminal still points at another copy."), and prints the
+ *     exact command to install into the right prefix.
+ *   - Kickstart or /health failure (steps 3–4): the new package is already
+ *     installed on disk; only daemon recovery is needed. The transcript
+ *     says so explicitly and points at the manual recovery action.
+ * In every branch the output is a friend-readable error pointing at the
+ * next recovery step; we never drop into "your install is broken" territory.
+ *
+ * Deliberately not in scope here:
+ *   - No publishing.
+ *   - No clean-Mac validation.
+ *   - No Sparkle / background self-update.
+ *   - No telemetry. The npm-registry probe lives in the daemon's daily
+ *     loop (see src/observability/version-check.ts); this command does
+ *     not write to that snapshot.
+ */
+import { spawn, execFile } from "node:child_process";
+import path from "node:path";
+import { Command } from "commander";
+import { kickstartDaemon, waitForHealth, } from "../../onboarding/daemon-control.js";
+import { installMenuBar } from "./menubar.js";
+import { printJson, printText } from "../output.js";
+const RIFT_PACKAGE_NAME = "@getrift/rift";
+const RIFT_PACKAGE_SPEC = "@getrift/rift@beta";
+const RIFT_BETA_TAG = "@getrift/rift@beta";
+const DAEMON_BASE_URL = "http://127.0.0.1:3577";
+const HEALTH_TIMEOUT_MS = 30_000;
+const defaultRunner = {
+    runNpmInstall: defaultNpmInstall,
+    resolveActiveCli: defaultResolveActiveCli,
+    getActiveCliVersion: defaultGetActiveCliVersion,
+    getExpectedVersion: defaultGetExpectedVersion,
+    getNpmGlobalPrefix: defaultGetNpmGlobalPrefix,
+    kickstart: kickstartDaemon,
+    waitForHealth,
+    installMenuBar,
+};
+export function makeUpdateCommand() {
+    return new Command("update")
+        .description("Reinstall the latest @getrift/rift@beta and restart the daemon")
+        .action(async (_opts, cmd) => {
+        const globalOpts = cmd.optsWithGlobals();
+        const result = await runUpdate(defaultRunner);
+        if (globalOpts.json) {
+            printJson(result);
+        }
+        else {
+            for (const line of result.transcript)
+                printText(line);
+        }
+        if (!result.ok)
+            process.exitCode = 1;
+    });
+}
+/**
+ * Pure orchestration so tests can inject a mock runner. The function
+ * always returns — exit-code mapping is the caller's job.
+ */
+export async function runUpdate(runner) {
+    const transcript = [];
+    const say = (line) => {
+        transcript.push(line);
+    };
+    // --- Step 1a: resolve the target version with FRESH registry metadata ---
+    // Resolve the expected version BEFORE installing, and force a registry
+    // round-trip (`npm view --prefer-online`). This is load-bearing: if both
+    // `npm install @beta` and the verification's `npm view @beta` read the same
+    // stale local cache, the tag can resolve to the version already installed —
+    // a no-op that then "verifies" against itself (beta.18 == beta.18) and the
+    // command lies. Pinning to the freshly-resolved EXACT version below removes
+    // the tag indirection from the install entirely.
+    const active = await runner.resolveActiveCli();
+    const installPrefix = active.prefix;
+    const expected = await runner.getExpectedVersion();
+    // --- Step 1b: npm install ---
+    // Install the exact pinned version when we know it (so a stale-cached tag
+    // can't redirect us), falling back to the @beta tag only when the registry
+    // probe failed. Install into the prefix that owns the `rift` on PATH so the
+    // copy the friend's shell runs is the copy that gets upgraded; when we can't
+    // resolve it, fall back to npm's choice and let verify (Step 2) catch a split.
+    const installSpec = expected ? `${RIFT_PACKAGE_NAME}@${expected}` : RIFT_PACKAGE_SPEC;
+    say(`==> Installing ${installSpec} via npm` +
+        (installPrefix ? ` (into ${installPrefix})` : ""));
+    let npmCode = await runner.runNpmInstall(installSpec, false, installPrefix);
+    if (npmCode !== 0) {
+        // npm exits non-zero on a permission denied error; mirror install.sh
+        // and retry under sudo so a non-nvm user on a system Node doesn't get
+        // stuck. The sudo prompt itself surfaces inline in the friend's
+        // terminal — we don't try to suppress it.
+        say("    npm install failed without sudo — retrying with sudo");
+        npmCode = await runner.runNpmInstall(installSpec, true, installPrefix);
+    }
+    if (npmCode !== 0) {
+        say("");
+        say("Update failed at step 1 (npm install).");
+        say("Your existing Rift install is unchanged.");
+        say(`Try manually: npm install -g --prefer-online ${RIFT_PACKAGE_SPEC}`);
+        return { ok: false, step: "npm", transcript };
+    }
+    say("    npm install completed.");
+    // --- Step 2: verify the active CLI actually upgraded ---
+    // An exit-0 npm install is NOT proof. npm can install into a different
+    // prefix than the binary on PATH, or (when we fell back to the tag) resolve
+    // `@beta` to the version already installed. In both cases the friend's shell
+    // still runs the old build. Refuse to claim success until the `rift` on PATH
+    // reports the expected version — and if we never resolved the expected
+    // version, say so honestly rather than passing on "installed something".
+    say("==> Verifying the rift on your PATH is up to date");
+    const activeVersion = await runner.getActiveCliVersion();
+    const verdict = evaluateUpgrade(expected, activeVersion);
+    if (!verdict.ok) {
+        const npmPrefix = await runner.getNpmGlobalPrefix();
+        appendVerifyDiagnosis(say, {
+            expected,
+            activeVersion,
+            active,
+            installPrefix,
+            npmPrefix,
+            reason: verdict.reason,
+        });
+        return { ok: false, step: "verify", transcript };
+    }
+    say(`    Active rift is ${activeVersion} (matches the published @beta).`);
+    // --- Step 3: kickstart daemon ---
+    say("==> Restarting the Rift daemon");
+    const kick = await runner.kickstart();
+    if (kick.status !== "ok") {
+        say("");
+        say("Update installed, but the daemon did not restart cleanly.");
+        if (kick.hint)
+            say(`    ${kick.hint}`);
+        say("Try: launchctl kickstart -k gui/$UID/com.getrift.daemon");
+        return { ok: false, step: "kickstart", transcript };
+    }
+    say("    Daemon kickstarted.");
+    // --- Step 4: wait for /health ---
+    say("==> Waiting for the daemon to answer /health");
+    const health = await runner.waitForHealth({
+        baseUrl: DAEMON_BASE_URL,
+        timeoutMs: HEALTH_TIMEOUT_MS,
+    });
+    if (!health.ok) {
+        say("");
+        say("Update installed and daemon kickstarted, but /health did not return 200.");
+        say(`    ${health.reason}`);
+        say("Inspect with: rift status");
+        return { ok: false, step: "health", transcript };
+    }
+    say(`    Daemon healthy (uptime ${health.uptimeSeconds}s).`);
+    // --- Step 5: refresh menu bar plugin ---
+    say("==> Refreshing the Rift menu bar");
+    try {
+        const menu = runner.installMenuBar();
+        if (menu.skipped) {
+            say(`    Menu bar skipped: ${menu.reason ?? "not available"}`);
+        }
+        else {
+            say("    Menu bar refreshed.");
+        }
+    }
+    catch (err) {
+        say("    Menu bar refresh skipped.");
+        say(`    ${err instanceof Error ? err.message : String(err)}`);
+    }
+    say("");
+    say("Rift updated. Run `rift status` to confirm the new version.");
+    return { ok: true, transcript };
+}
+/**
+ * Decide whether the active CLI actually upgraded. The contract is strict and
+ * biased toward honesty — "could not confirm" is a FAILURE, never a pass:
+ *   - no active version at all → the binary is broken (`no_binary`).
+ *   - no expected version → we couldn't reach the registry to learn the latest
+ *     beta, so we cannot claim the update landed (`unverified`). This is the
+ *     deliberate fix for "couldn't verify" silently becoming "updated".
+ *   - active != expected → still the old (or wrong) build (`mismatch`).
+ * Only an active version that equals a freshly-resolved expected version is OK.
+ */
+export function evaluateUpgrade(expected, activeVersion) {
+    if (!activeVersion)
+        return { ok: false, reason: "no_binary" };
+    if (!expected)
+        return { ok: false, reason: "unverified" };
+    if (activeVersion !== expected)
+        return { ok: false, reason: "mismatch" };
+    return { ok: true };
+}
+/**
+ * Friend-readable verification failure. Leads with a plain-English headline,
+ * then prints versions and paths so the detail is actionable. The branch is
+ * chosen from the classified `reason`, and — crucially — only calls it a
+ * prefix split when the install was NOT targeted at the active CLI's prefix.
+ * Since we install with `--prefix <active.prefix>` whenever we can resolve it,
+ * a failure there is a stale-cache / no-op, NOT a split; telling the friend to
+ * re-run the same targeted command would be misleading.
+ */
+function appendVerifyDiagnosis(say, ctx) {
+    const { expected, activeVersion, active, installPrefix, npmPrefix, reason } = ctx;
+    // The prefix npm actually wrote to: the one we targeted, else npm's default.
+    const actualInstallPrefix = installPrefix ?? npmPrefix;
+    // A genuine split is only possible when we did NOT target the active prefix
+    // (installPrefix === null) AND the binary on PATH lives outside where npm
+    // installed. When we targeted active.prefix, npm wrote exactly there.
+    const prefixSplit = reason === "mismatch" &&
+        installPrefix === null &&
+        active.binPath !== null &&
+        npmPrefix !== null &&
+        !binaryLivesUnderPrefix(active.binPath, npmPrefix);
+    say("");
+    if (reason === "no_binary") {
+        say("Rift installed, but `rift --version` would not run afterward.");
+    }
+    else if (reason === "unverified") {
+        say("Rift installed something, but I could not confirm it is the latest.");
+    }
+    else if (prefixSplit) {
+        say("Rift updated one copy, but your terminal still points at another copy.");
+    }
+    else {
+        say("Rift installed, but the rift in your PATH is still the old version.");
+    }
+    // Detail block — keep the headline understandable, put specifics below it.
+    say("");
+    if (expected)
+        say(`    Expected (published @beta): ${expected}`);
+    else
+        say("    Expected (published @beta): unknown — npm registry probe failed");
+    say(`    Active (your shell's rift): ${activeVersion ?? "unknown"}`);
+    if (active.binPath)
+        say(`    Active rift path:           ${active.binPath}`);
+    if (actualInstallPrefix) {
+        say(`    Installed into prefix:      ${actualInstallPrefix}`);
+    }
+    if (prefixSplit && npmPrefix) {
+        say(`    npm global prefix:          ${npmPrefix}`);
+    }
+    // Recovery.
+    say("");
+    if (reason === "unverified") {
+        say("This usually means npm couldn't reach the registry. Check your");
+        say("connection and re-run `rift update`. To verify by hand:");
+        say(`    npm view ${RIFT_BETA_TAG} version   # the target`);
+        say("    rift --version                    # what your shell runs");
+    }
+    else if (prefixSplit) {
+        const targetPrefix = active.prefix ?? deriveBinPrefix(active.binPath);
+        say("Fix: install into the copy your terminal actually runs:");
+        if (targetPrefix) {
+            say(`    npm install -g --prefix ${targetPrefix} --prefer-online ${RIFT_BETA_TAG}`);
+        }
+        else {
+            say(`    npm install -g --prefer-online ${RIFT_BETA_TAG}`);
+        }
+    }
+    else {
+        // no_binary or same-prefix no-op: most often a stale npm metadata cache.
+        say("Your npm metadata cache may be stale (the install was a no-op).");
+        say(`Fix: npm install -g --prefer-online ${RIFT_BETA_TAG}`);
+        say("     (if it repeats: npm cache clean --force, then re-run rift update)");
+    }
+}
+/** True when `binPath` sits inside `<prefix>/bin` (i.e. npm's `-g` bin dir). */
+function binaryLivesUnderPrefix(binPath, prefix) {
+    const binDir = path.join(prefix, "bin") + path.sep;
+    return (binPath + path.sep).startsWith(binDir);
+}
+/** prefix that owns a `<prefix>/bin/rift` binary, or null if not that shape. */
+function deriveBinPrefix(binPath) {
+    if (!binPath)
+        return null;
+    const binDir = path.dirname(binPath);
+    return path.basename(binDir) === "bin" ? path.dirname(binDir) : null;
+}
+function defaultNpmInstall(spec, useSudo, prefix) {
+    return new Promise((resolve) => {
+        const prefixArgs = prefix ? ["--prefix", prefix] : [];
+        // `--prefer-online` forces npm to revalidate registry metadata instead of
+        // trusting a possibly-stale local cache — defense in depth on top of the
+        // pinned exact version, so even the tag-fallback path installs fresh.
+        const baseArgs = ["install", "-g", "--prefer-online", ...prefixArgs, spec];
+        const cmd = useSudo ? "sudo" : "npm";
+        const args = useSudo ? ["npm", ...baseArgs] : baseArgs;
+        const child = spawn(cmd, args, { stdio: "inherit" });
+        child.on("error", () => resolve(1));
+        child.on("close", (code) => resolve(code ?? 1));
+    });
+}
+/** Run a command, capture trimmed stdout, return null on any failure. */
+function capture(cmd, args) {
+    return new Promise((resolve) => {
+        execFile(cmd, args, { timeout: 20_000, encoding: "utf8" }, (err, stdout) => {
+            if (err) {
+                resolve(null);
+                return;
+            }
+            const out = stdout.trim();
+            resolve(out.length > 0 ? out : null);
+        });
+    });
+}
+/**
+ * Resolve the `rift` the friend's shell runs and the prefix that owns it.
+ * Uses `command -v rift` (PATH lookup) rather than this process's own path —
+ * the running update is the OLD build, and we want the binary a fresh shell
+ * would launch. Prefix is the parent of the binary's `bin/` dir, which is
+ * exactly what `npm install -g --prefix` expects.
+ */
+async function defaultResolveActiveCli() {
+    const binPath = await capture("/bin/sh", ["-c", "command -v rift"]);
+    if (!binPath)
+        return { binPath: null, prefix: null };
+    // /opt/homebrew/bin/rift → bin dir /opt/homebrew/bin → prefix /opt/homebrew
+    const binDir = path.dirname(binPath);
+    const prefix = path.basename(binDir) === "bin" ? path.dirname(binDir) : null;
+    return { binPath, prefix };
+}
+/** Version reported by the `rift` on PATH (`rift --version`). */
+async function defaultGetActiveCliVersion() {
+    const out = await capture("/bin/sh", ["-c", "rift --version"]);
+    if (!out)
+        return null;
+    // commander prints a bare version line; tolerate any extra decoration.
+    const match = out.match(/\d+\.\d+\.\d+[^\s]*/);
+    return match ? match[0] : out;
+}
+/**
+ * Expected version from the published `@beta` dist-tag, with FRESH metadata.
+ * `--prefer-online` is load-bearing: without it this probe can read the same
+ * stale cache the install did, so a no-op install would "verify" against an
+ * equally-stale expected version and the command would lie.
+ */
+function defaultGetExpectedVersion() {
+    return capture("npm", ["view", "--prefer-online", RIFT_BETA_TAG, "version"]);
+}
+/** npm's own global prefix (`npm prefix -g`). */
+function defaultGetNpmGlobalPrefix() {
+    return capture("npm", ["prefix", "-g"]);
+}
+//# sourceMappingURL=update.js.map

package/dist/src/cli/commands/update.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"update.js","sourceRoot":"","sources":["../../../../src/cli/commands/update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EACL,eAAe,EACf,aAAa,GACd,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,cAAc,EAAE,MAAM,cAAc,CAAC;AAC9C,OAAO,EAAc,SAAS,EAAE,SAAS,EAAE,MAAM,cAAc,CAAC;AAEhE,MAAM,iBAAiB,GAAG,eAAe,CAAC;AAC1C,MAAM,iBAAiB,GAAG,oBAAoB,CAAC;AAC/C,MAAM,aAAa,GAAG,oBAAoB,CAAC;AAC3C,MAAM,eAAe,GAAG,uBAAuB,CAAC;AAChD,MAAM,iBAAiB,GAAG,MAAM,CAAC;AAuDjC,MAAM,aAAa,GAAiB;IAClC,aAAa,EAAE,iBAAiB;IAChC,gBAAgB,EAAE,uBAAuB;IACzC,mBAAmB,EAAE,0BAA0B;IAC/C,kBAAkB,EAAE,yBAAyB;IAC7C,kBAAkB,EAAE,yBAAyB;IAC7C,SAAS,EAAE,eAAe;IAC1B,aAAa;IACb,cAAc;CACf,CAAC;AAEF,MAAM,UAAU,iBAAiB;IAC/B,OAAO,IAAI,OAAO,CAAC,QAAQ,CAAC;SACzB,WAAW,CAAC,gEAAgE,CAAC;SAC7E,MAAM,CAAC,KAAK,EAAE,KAAK,EAAE,GAAG,EAAE,EAAE;QAC3B,MAAM,UAAU,GAAG,GAAG,CAAC,eAAe,EAAuB,CAAC;QAC9D,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,aAAa,CAAC,CAAC;QAC9C,IAAI,UAAU,CAAC,IAAI,EAAE,CAAC;YACpB,SAAS,CAAC,MAAM,CAAC,CAAC;QACpB,CAAC;aAAM,CAAC;YACN,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,UAAU;gBAAE,SAAS,CAAC,IAAI,CAAC,CAAC;QACxD,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvC,CAAC,CAAC,CAAC;AACP,CAAC;AAQD;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,MAAoB;IAClD,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,MAAM,GAAG,GAAG,CAAC,IAAY,EAAQ,EAAE;QACjC,UAAU,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxB,CAAC,CAAC;IAEF,2EAA2E;IAC3E,uEAAuE;IACvE,yEAAyE;IACzE,4EAA4E;IAC5E,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,iDAAiD;IACjD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,gBAAgB,EAAE,CAAC;IAC/C,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;IACpC,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC;IAEnD,+BAA+B;IAC/B,0EAA0E;IAC1E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,WAAW,GAAG,QAAQ,CAAC,CAAC,CAAC,GAAG,iBAAiB,IAAI,QAAQ,EAAE,CAAC,CAAC,CAAC,iBAAiB,CAAC;IACtF,GAAG,CACD,kBAAkB,WAAW,UAAU;QACrC,CAAC,aAAa,CAAC,CAAC,CAAC,UAAU,aAAa,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CACpD,CAAC;IACF,IAAI,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,KAAK,EAAE,aAAa,CAAC,CAAC;IAC5E,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,qEAAqE;QACrE,sEAAsE;QACtE,gEAAgE;QAChE,0CAA0C;QAC1C,GAAG,CAAC,0DAA0D,CAAC,CAAC;QAChE,OAAO,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,EAAE,IAAI,EAAE,aAAa,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,OAAO,KAAK,CAAC,EAAE,CAAC;QAClB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,wCAAwC,CAAC,CAAC;QAC9C,GAAG,CAAC,0CAA0C,CAAC,CAAC;QAChD,GAAG,CAAC,gDAAgD,iBAAiB,EAAE,CAAC,CAAC;QACzE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,CAAC;IAChD,CAAC;IACD,GAAG,CAAC,4BAA4B,CAAC,CAAC;IAElC,0DAA0D;IAC1D,uEAAuE;IACvE,4EAA4E;IAC5E,6EAA6E;IAC7E,6EAA6E;IAC7E,uEAAuE;IACvE,yEAAyE;IACzE,GAAG,CAAC,mDAAmD,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,MAAM,MAAM,CAAC,mBAAmB,EAAE,CAAC;IACzD,MAAM,OAAO,GAAG,eAAe,CAAC,QAAQ,EAAE,aAAa,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,kBAAkB,EAAE,CAAC;QACpD,qBAAqB,CAAC,GAAG,EAAE;YACzB,QAAQ;YACR,aAAa;YACb,MAAM;YACN,aAAa;YACb,SAAS;YACT,MAAM,EAAE,OAAO,CAAC,MAAM;SACvB,CAAC,CAAC;QACH,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IACD,GAAG,CAAC,sBAAsB,aAAa,iCAAiC,CAAC,CAAC;IAE1E,mCAAmC;IACnC,GAAG,CAAC,gCAAgC,CAAC,CAAC;IACtC,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,EAAE,CAAC;IACtC,IAAI,IAAI,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QACzB,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,2DAA2D,CAAC,CAAC;QACjE,IAAI,IAAI,CAAC,IAAI;YAAE,GAAG,CAAC,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QACvC,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAC/D,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,CAAC;IACtD,CAAC;IACD,GAAG,CAAC,yBAAyB,CAAC,CAAC;IAE/B,mCAAmC;IACnC,GAAG,CAAC,8CAA8C,CAAC,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,aAAa,CAAC;QACxC,OAAO,EAAE,eAAe;QACxB,SAAS,EAAE,iBAAiB;KAC7B,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,GAAG,CAAC,EAAE,CAAC,CAAC;QACR,GAAG,CAAC,0EAA0E,CAAC,CAAC;QAChF,GAAG,CAAC,OAAO,MAAM,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5B,GAAG,CAAC,2BAA2B,CAAC,CAAC;QACjC,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,EAAE,UAAU,EAAE,CAAC;IACnD,CAAC;IACD,GAAG,CAAC,8BAA8B,MAAM,CAAC,aAAa,KAAK,CAAC,CAAC;IAE7D,0CAA0C;IAC1C,GAAG,CAAC,kCAAkC,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,cAAc,EAAE,CAAC;QACrC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YACjB,GAAG,CAAC,yBAAyB,IAAI,CAAC,MAAM,IAAI,eAAe,EAAE,CAAC,CAAC;QACjE,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,yBAAyB,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,GAAG,CAAC,+BAA+B,CAAC,CAAC;QACrC,GAAG,CAAC,OAAO,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACjE,CAAC;IAED,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,GAAG,CAAC,6DAA6D,CAAC,CAAC;IACnE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC;AAClC,CAAC;AAID;;;;;;;;;GASG;AACH,MAAM,UAAU,eAAe,CAC7B,QAAuB,EACvB,aAA4B;IAE5B,IAAI,CAAC,aAAa;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC9D,IAAI,CAAC,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC;IAC1D,IAAI,aAAa,KAAK,QAAQ;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACzE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,qBAAqB,CAC5B,GAA2B,EAC3B,GAOC;IAED,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,MAAM,EAAE,aAAa,EAAE,SAAS,EAAE,MAAM,EAAE,GACzE,GAAG,CAAC;IAEN,6EAA6E;IAC7E,MAAM,mBAAmB,GAAG,aAAa,IAAI,SAAS,CAAC;IACvD,4EAA4E;IAC5E,0EAA0E;IAC1E,sEAAsE;IACtE,MAAM,WAAW,GACf,MAAM,KAAK,UAAU;QACrB,aAAa,KAAK,IAAI;QACtB,MAAM,CAAC,OAAO,KAAK,IAAI;QACvB,SAAS,KAAK,IAAI;QAClB,CAAC,sBAAsB,CAAC,MAAM,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAErD,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,MAAM,KAAK,WAAW,EAAE,CAAC;QAC3B,GAAG,CAAC,+DAA+D,CAAC,CAAC;IACvE,CAAC;SAAM,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QACnC,GAAG,CAAC,qEAAqE,CAAC,CAAC;IAC7E,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,GAAG,CAAC,wEAAwE,CAAC,CAAC;IAChF,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,qEAAqE,CAAC,CAAC;IAC7E,CAAC;IAED,2EAA2E;IAC3E,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,QAAQ;QAAE,GAAG,CAAC,mCAAmC,QAAQ,EAAE,CAAC,CAAC;;QAC5D,GAAG,CAAC,qEAAqE,CAAC,CAAC;IAChF,GAAG,CAAC,mCAAmC,aAAa,IAAI,SAAS,EAAE,CAAC,CAAC;IACrE,IAAI,MAAM,CAAC,OAAO;QAAE,GAAG,CAAC,mCAAmC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC;IAC7E,IAAI,mBAAmB,EAAE,CAAC;QACxB,GAAG,CAAC,mCAAmC,mBAAmB,EAAE,CAAC,CAAC;IAChE,CAAC;IACD,IAAI,WAAW,IAAI,SAAS,EAAE,CAAC;QAC7B,GAAG,CAAC,mCAAmC,SAAS,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,YAAY;IACZ,GAAG,CAAC,EAAE,CAAC,CAAC;IACR,IAAI,MAAM,KAAK,YAAY,EAAE,CAAC;QAC5B,GAAG,CAAC,gEAAgE,CAAC,CAAC;QACtE,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAC/D,GAAG,CAAC,gBAAgB,aAAa,yBAAyB,CAAC,CAAC;QAC5D,GAAG,CAAC,8DAA8D,CAAC,CAAC;IACtE,CAAC;SAAM,IAAI,WAAW,EAAE,CAAC;QACvB,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,IAAI,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACtE,GAAG,CAAC,yDAAyD,CAAC,CAAC;QAC/D,IAAI,YAAY,EAAE,CAAC;YACjB,GAAG,CAAC,+BAA+B,YAAY,oBAAoB,aAAa,EAAE,CAAC,CAAC;QACtF,CAAC;aAAM,CAAC;YACN,GAAG,CAAC,sCAAsC,aAAa,EAAE,CAAC,CAAC;QAC7D,CAAC;IACH,CAAC;SAAM,CAAC;QACN,yEAAyE;QACzE,GAAG,CAAC,iEAAiE,CAAC,CAAC;QACvE,GAAG,CAAC,uCAAuC,aAAa,EAAE,CAAC,CAAC;QAC5D,GAAG,CAAC,wEAAwE,CAAC,CAAC;IAChF,CAAC;AACH,CAAC;AAED,gFAAgF;AAChF,SAAS,sBAAsB,CAAC,OAAe,EAAE,MAAc;IAC7D,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC;IACnD,OAAO,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,MAAM,CAAC,CAAC;AACjD,CAAC;AAED,gFAAgF;AAChF,SAAS,eAAe,CAAC,OAAsB;IAC7C,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,OAAO,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED,SAAS,iBAAiB,CACxB,IAAY,EACZ,OAAgB,EAChB,MAAsB;IAEtB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,MAAM,UAAU,GAAG,MAAM,CAAC,CAAC,CAAC,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QACtD,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,MAAM,QAAQ,GAAG,CAAC,SAAS,EAAE,IAAI,EAAE,iBAAiB,EAAE,GAAG,UAAU,EAAE,IAAI,CAAC,CAAC;QAC3E,MAAM,GAAG,GAAG,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC;QACrC,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvD,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;QACrD,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC;IAClD,CAAC,CAAC,CAAC;AACL,CAAC;AAED,yEAAyE;AACzE,SAAS,OAAO,CAAC,GAAW,EAAE,IAAc;IAC1C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CACN,GAAG,EACH,IAAI,EACJ,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,EACrC,CAAC,GAAG,EAAE,MAAM,EAAE,EAAE;YACd,IAAI,GAAG,EAAE,CAAC;gBACR,OAAO,CAAC,IAAI,CAAC,CAAC;gBACd,OAAO;YACT,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;YAC1B,OAAO,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;QACvC,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,uBAAuB;IACpC,MAAM,OAAO,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,CAAC;IACpE,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC;IACrD,4EAA4E;IAC5E,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,CAAC;AAC7B,CAAC;AAED,iEAAiE;AACjE,KAAK,UAAU,0BAA0B;IACvC,MAAM,GAAG,GAAG,MAAM,OAAO,CAAC,SAAS,EAAE,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC,CAAC;IAC/D,IAAI,CAAC,GAAG;QAAE,OAAO,IAAI,CAAC;IACtB,uEAAuE;IACvE,MAAM,KAAK,GAAG,GAAG,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,OAAO,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;AAChC,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB;IAChC,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,iBAAiB,EAAE,aAAa,EAAE,SAAS,CAAC,CAAC,CAAC;AAC/E,CAAC;AAED,iDAAiD;AACjD,SAAS,yBAAyB;IAChC,OAAO,OAAO,CAAC,KAAK,EAAE,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC,CAAC;AAC1C,CAAC"}

package/dist/src/cli/default-config-path.d.ts

@@ -0,0 +1,15 @@
+/**
+ * Canonical config path used when `--config` is not provided.
+ *
+ * Mirrors the path written by `scripts/install.sh`:
+ *   $HOME/Library/Application Support/Rift/data/config.json
+ *
+ * Without this, the CLI default was `config.json` (relative to cwd),
+ * which broke every invocation made outside the data dir on a fresh
+ * friend install — `rift status` from the home folder would `ENOENT`.
+ *
+ * Override with the `RIFT_CONFIG` env var (absolute path) for tests
+ * or operators running multiple instances side-by-side.
+ */
+export declare function defaultConfigPath(): string;
+//# sourceMappingURL=default-config-path.d.ts.map

package/dist/src/cli/default-config-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-config-path.d.ts","sourceRoot":"","sources":["../../../src/cli/default-config-path.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;GAYG;AACH,wBAAgB,iBAAiB,IAAI,MAAM,CAiB1C"}

package/dist/src/cli/default-config-path.js

@@ -0,0 +1,27 @@
+import os from "node:os";
+import path from "node:path";
+/**
+ * Canonical config path used when `--config` is not provided.
+ *
+ * Mirrors the path written by `scripts/install.sh`:
+ *   $HOME/Library/Application Support/Rift/data/config.json
+ *
+ * Without this, the CLI default was `config.json` (relative to cwd),
+ * which broke every invocation made outside the data dir on a fresh
+ * friend install — `rift status` from the home folder would `ENOENT`.
+ *
+ * Override with the `RIFT_CONFIG` env var (absolute path) for tests
+ * or operators running multiple instances side-by-side.
+ */
+export function defaultConfigPath() {
+    // Per A-2.1: empty or whitespace-only RIFT_CONFIG falls through to the
+    // default. Treating "   " as set would give the user a confusing
+    // `Config not found at /<cwd>` message later, when they think they
+    // didn't set the env var at all.
+    const override = process.env.RIFT_CONFIG;
+    if (typeof override === "string" && override.trim().length > 0) {
+        return path.resolve(override);
+    }
+    return path.join(os.homedir(), "Library", "Application Support", "Rift", "data", "config.json");
+}
+//# sourceMappingURL=default-config-path.js.map

package/dist/src/cli/default-config-path.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"default-config-path.js","sourceRoot":"","sources":["../../../src/cli/default-config-path.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,iBAAiB;IAC/B,uEAAuE;IACvE,iEAAiE;IACjE,mEAAmE;IACnE,iCAAiC;IACjC,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IACzC,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,QAAQ,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/D,OAAO,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChC,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CACd,EAAE,CAAC,OAAO,EAAE,EACZ,SAAS,EACT,qBAAqB,EACrB,MAAM,EACN,MAAM,EACN,aAAa,CACd,CAAC;AACJ,CAAC"}

package/dist/src/cli/feedback/feedback-config.d.ts

@@ -1,21 +1,67 @@
 import { z } from "zod";
+import type { RelaySecretStore } from "./relay-secret-store.js";
 export declare const FeedbackConfigSchema: z.ZodObject<{
     enabled: z.ZodBoolean;
     url: z.ZodOptional<z.ZodString>;
     installation_id: z.ZodOptional<z.ZodString>;
     hmac_secret: z.ZodOptional<z.ZodString>;
+    unsigned: z.ZodOptional<z.ZodBoolean>;
+    email: z.ZodOptional<z.ZodString>;
 }, "strict", z.ZodTypeAny, {
     enabled: boolean;
     url?: string | undefined;
+    email?: string | undefined;
     installation_id?: string | undefined;
     hmac_secret?: string | undefined;
+    unsigned?: boolean | undefined;
 }, {
     enabled: boolean;
     url?: string | undefined;
+    email?: string | undefined;
     installation_id?: string | undefined;
     hmac_secret?: string | undefined;
+    unsigned?: boolean | undefined;
 }>;
 export type FeedbackConfig = z.infer<typeof FeedbackConfigSchema>;
 export declare function feedbackConfigPath(dataDir: string): string;
 export declare function loadFeedbackConfig(dataDir: string): FeedbackConfig;
+/**
+ * Persist the feedback config, ALWAYS stripping the deprecated `hmac_secret`
+ * — the secret belongs in the Keychain, never the sidecar. Writes mode 0600.
+ */
+export declare function writeFeedbackConfig(dataDir: string, cfg: FeedbackConfig): void;
+/**
+ * Resolve the relay HMAC secret, migrating a legacy plaintext sidecar secret
+ * into the Keychain on first use. Order:
+ *   1. Keychain (the canonical home) — return it if present.
+ *   2. Legacy `hmac_secret` in the sidecar — write it to the Keychain, strip
+ *      it from the file, then return it.
+ *   3. None / not securely resolvable — return null.
+ *
+ * NEVER returns a secret that isn't (or didn't just become) securely stored:
+ *   - If the Keychain READ fails (e.g. locked), returns null — the caller must
+ *     not downgrade to an unsigned production POST.
+ *   - A legacy plaintext secret is returned ONLY after it is successfully
+ *     written to the Keychain. If that write fails, returns null (no silent
+ *     plaintext fallback); migration retries next time once the Keychain is
+ *     reachable.
+ *
+ * NEVER throws — it runs in the best-effort `rift feedback` relay path. The
+ * plaintext strip is best-effort and RETRYABLE: a strip that fails (e.g. a
+ * read-only sidecar) leaves the plaintext for a later call to remove, and a
+ * later call strips a lingering plaintext copy even when the Keychain already
+ * holds the secret (the partial-migration case).
+ */
+export declare function resolveRelaySecret(deps: {
+    dataDir: string;
+    store: RelaySecretStore;
+}): Promise<string | null>;
+/**
+ * Turn the relay on for this install (from an accepted invite or operator
+ * flags): set `enabled` + `url`, mint an `installation_id` when absent, and
+ * preserve any existing email. `writeFeedbackConfig` guarantees no secret
+ * lands in the sidecar — the caller writes the secret to the Keychain. Returns
+ * the persisted config.
+ */
+export declare function applyRelayUrl(dataDir: string, url: string): FeedbackConfig;
 //# sourceMappingURL=feedback-config.d.ts.map

package/dist/src/cli/feedback/feedback-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"feedback-config.d.ts","sourceRoot":"","sources":["../../../../src/cli/feedback/feedback-config.ts"],"names":[],"mappings":"AAaA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;EAOtB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAclE"}
+{"version":3,"file":"feedback-config.d.ts","sourceRoot":"","sources":["../../../../src/cli/feedback/feedback-config.ts"],"names":[],"mappings":"AAmBA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;EAmBtB,CAAC;AAEZ,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE1D;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,cAAc,CAclE;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,GAAG,IAAI,CAc9E;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,wBAAsB,kBAAkB,CAAC,IAAI,EAAE;IAC7C,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,gBAAgB,CAAC;CACzB,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CA6BzB;AAkBD;;;;;;GAMG;AACH,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,cAAc,CAU1E"}