@glubean/cli 0.8.3 → 0.9.0

package/dist/commands/sync.js

@@ -0,0 +1,322 @@
+import { resolve } from "node:path";
+import { stat } from "node:fs/promises";
+import { loadProjectEnv } from "@glubean/runner";
+import { buildProjections } from "./dry-run.js";
+import { findProjectConfig } from "./run.js";
+import { resolveToken, resolveProjectId, resolveApiUrl } from "../lib/auth.js";
+import { resolveEnvFileName, SensitiveActiveEnvError } from "../lib/active_env.js";
+const colors = {
+    reset: "\x1b[0m",
+    bold: "\x1b[1m",
+    dim: "\x1b[2m",
+    green: "\x1b[32m",
+    yellow: "\x1b[33m",
+    blue: "\x1b[34m",
+    red: "\x1b[31m",
+};
+/** Strip credential-bearing URL parts (query / fragment / userinfo) before a URL
+ *  leaves the machine — mirrors the cloud's server-side sanitizer (defense in
+ *  depth: the dry-run projector already placeholders ctx.secrets to `<KEY>`). */
+function sanitizeUrl(url) {
+    try {
+        const u = new URL(url);
+        u.username = "";
+        u.password = "";
+        u.search = "";
+        u.hash = "";
+        return u.toString();
+    }
+    catch {
+        return url.split("#")[0].split("?")[0].replace(/(\/\/)[^/@]*@/, "$1");
+    }
+}
+/**
+ * `glubean sync` — sync the repo's test-definition projections (declared
+ * metadata + dry-run shape) to Glubean Cloud for team review. PROJECT-scoped:
+ * the projection is generated from SOURCE CODE, so it's one set per codebase
+ * regardless of how many targets it runs against. The upload is the COMPLETE
+ * source snapshot — the server replaces the project's projections with it
+ * (removed tests are deleted). Distinct from `glubean run --upload` (run
+ * evidence).
+ */
+export async function syncCommand(options = {}) {
+    const dir = options.dir ? resolve(options.dir) : process.cwd();
+    // Resolve auth/env from the PROJECT ROOT (so root .env.* / .glubean/active-env
+    // are honored even when --dir points at a nested scan dir) — parity with run.
+    const { rootDir } = await findProjectConfig(dir);
+    console.log(`\n${colors.bold}${colors.blue}🔄 Glubean Sync (test-definition projection)${colors.reset}\n`);
+    // Validate an EXPLICIT --env-file FIRST — before the (expensive, user-code-
+    // running) projection — so a typo fails fast. A missing explicit env file
+    // would otherwise load empty and let global/process credentials upload to the
+    // WRONG project (parity with run/load). Default: the active env (or .env).
+    // GLU-88: resolveEnvFileName throws SensitiveActiveEnvError instead of
+    // silently returning a prod-like active-env file — surface it as a clear,
+    // actionable error (mirrors run/load) rather than silently syncing
+    // projections against prod.
+    const userSpecifiedEnvFile = !!options.envFile;
+    let envFileName;
+    if (userSpecifiedEnvFile) {
+        envFileName = options.envFile;
+    }
+    else {
+        try {
+            envFileName = await resolveEnvFileName(rootDir);
+        }
+        catch (err) {
+            if (err instanceof SensitiveActiveEnvError) {
+                console.error(`${colors.red}Sync failed: ${err.message}${colors.reset}`);
+                process.exit(1);
+            }
+            throw err;
+        }
+    }
+    if (userSpecifiedEnvFile) {
+        try {
+            await stat(resolve(rootDir, envFileName));
+        }
+        catch {
+            console.error(`${colors.red}Sync failed: env file '${envFileName}' not found in ${rootDir}${colors.reset}`);
+            process.exit(1);
+        }
+    }
+    // ALWAYS project the WHOLE project (rootDir), never just --dir: the upload is a
+    // complete snapshot the server replaces, so scanning a subdirectory would make
+    // the server delete every test outside it. --dir only locates the project root.
+    const { projected, errors, warnings, emptyTestFiles, contracts, workflows, openapi, openapiFailed } = await buildProjections(rootDir);
+    // A file that failed to import / timed out has NO projection. Since sync is a
+    // full-snapshot replace, publishing now would DELETE the broken file's tests'
+    // projections (treating them as removed) — so abort and let the user fix +
+    // re-sync the complete set.
+    if (errors.length) {
+        console.error(`${colors.red}Sync aborted: ${errors.length} file(s) failed to project.${colors.reset}`);
+        for (const e of errors)
+            console.error(`  ${colors.red}✗ ${e.file}: ${e.message}${colors.reset}`);
+        console.error(`${colors.dim}Fix these files and re-run — syncing now would drop their tests' projections.${colors.reset}`);
+        process.exit(1);
+    }
+    // A file the SCANNER couldn't turn into a projection is dropped BEFORE upload
+    // (it never shows in `errors`), yet its tests/contracts/workflows would vanish
+    // from this full snapshot and be DELETED on replace. All fatal: test extraction
+    // THREW ("Failed to extract metadata from"), a test file yielded ZERO exports
+    // (emptyTestFiles), or a contract/workflow file failed to import ("Contract
+    // import failed" / "Flow import failed" — leaves contractsProjection/workflows
+    // missing that file, so a full-replace would wipe its prior Cloud projection).
+    const dropped = [
+        ...warnings.filter((w) => w.startsWith("Failed to extract metadata from") ||
+            w.startsWith("Contract import failed") ||
+            w.startsWith("Flow import failed")),
+        ...emptyTestFiles.map((f) => `${f} — a Glubean test file with no extractable tests (syntax error, or tests removed/unrecognized?)`),
+    ];
+    if (dropped.length) {
+        console.error(`${colors.red}Sync aborted: ${dropped.length} file(s) would be dropped from the snapshot.${colors.reset}`);
+        for (const w of dropped)
+            console.error(`  ${colors.red}✗ ${w}${colors.reset}`);
+        console.error(`${colors.dim}Fix these files and re-run — syncing now would delete their projections from Cloud.${colors.reset}`);
+        process.exit(1);
+    }
+    // Empty snapshot would CLEAR the project's projections — guard against an
+    // accidental run in the wrong/empty dir; require --allow-empty to actually wipe.
+    // "Empty" means NO specs of ANY kind (test + contract + workflow).
+    if (projected.length === 0 && contracts.length === 0 && workflows.length === 0 && !options.allowEmpty) {
+        console.log(`${colors.yellow}No tests, contracts, or workflows found.${colors.reset} ${colors.dim}Pass --allow-empty to clear the project's projections, or check the directory.${colors.reset}\n`);
+        return;
+    }
+    // Resolve cloud auth — PROJECT-scoped (no target: the projection is repo-level).
+    const { vars, secrets } = await loadProjectEnv(rootDir, envFileName);
+    const authOpts = { token: options.token, project: options.project, apiUrl: options.apiUrl };
+    const sources = { envFileVars: { ...vars, ...secrets } };
+    const token = await resolveToken(authOpts, sources, options.tokenEnv);
+    const projectId = await resolveProjectId(authOpts, sources);
+    const apiUrl = await resolveApiUrl(authOpts, sources);
+    if (!token) {
+        console.error(`${colors.red}Sync failed: no auth token.${colors.reset}\n` +
+            `${colors.dim}Create a project token (glb_…) in the dashboard (Project → Tokens), then run 'glubean login', set GLUBEAN_TOKEN / --token, or add it to .env.secrets.${colors.reset}`);
+        process.exit(1);
+    }
+    if (!projectId) {
+        console.error(`${colors.red}Sync failed: no project ID.${colors.reset}\n` +
+            `${colors.dim}Set --project / GLUBEAN_PROJECT_ID, or run 'glubean login'.${colors.reset}`);
+        process.exit(1);
+    }
+    if (!apiUrl) {
+        console.error(`${colors.red}Sync failed: no API URL (set --api-url / GLUBEAN_API_URL).${colors.reset}`);
+        process.exit(1);
+    }
+    const tests = projected.map((p) => ({
+        testId: p.testId,
+        description: p.description ?? null,
+        deprecated: p.deprecated ?? null,
+        requires: p.requires ?? null,
+        defaultRun: p.defaultRun ?? null,
+        tags: p.tags ?? [],
+        assertions: p.assertions,
+        endpoints: p.endpoints.map((e) => ({ ...e, url: sanitizeUrl(e.url) })),
+        assertionCount: p.assertionCount,
+        projectionComplete: p.projectionComplete,
+        incompleteReason: p.incompleteReason ?? null,
+        skipped: p.skipped ?? false,
+        // B3 T1.5 row provenance — a server that predates the field strips it
+        // (ingest zod is non-strict), so this is forward-compatible. NOT redacted
+        // below (like testId): idTemplate/rowKey are identity keys built from the
+        // same row values as the uploaded testId itself — masking them would break
+        // the rowKey === id join Cloud derive performs.
+        ...(p.each ? { each: p.each } : {}),
+    }));
+    // Redact outbound data before it leaves the machine (parity with run/load):
+    // a hardcoded credential in an assertion message / endpoint is masked (URL
+    // query/userinfo/fragment is already stripped above). Honor the PROJECT's
+    // redaction rules (glubean.yaml `defaults.redaction` — custom sensitiveKeys /
+    // customPatterns), not just the built-in defaults; FAIL CLOSED on invalid config.
+    const { redactValue, BUILTIN_SCOPES } = await import("@glubean/redaction");
+    const { loadProjectConfigV1, resolveRedactionConfig } = await import("../lib/config.js");
+    let redaction = resolveRedactionConfig(undefined); // built-in defaults
+    let hasConfig = false;
+    try {
+        await stat(resolve(rootDir, "glubean.yaml"));
+        hasConfig = true;
+    }
+    catch {
+        /* no glubean.yaml → built-in default redaction */
+    }
+    if (hasConfig) {
+        try {
+            const { config } = await loadProjectConfigV1(rootDir);
+            redaction = resolveRedactionConfig(config.defaults?.redaction);
+        }
+        catch (err) {
+            console.error(`${colors.red}Sync failed: invalid glubean.yaml redaction config — ${err?.message ?? String(err)}${colors.reset}`);
+            process.exit(1);
+        }
+    }
+    // The projection is a static blob with NO request/response scope to bind to, so
+    // fold the builtin SCOPE sensitive keys (cookie / set-cookie / authorization /
+    // token / …) into the global keys — otherwise header/query examples carried in a
+    // contract/workflow projection would upload in cleartext (run/load apply these
+    // per-scope; here there's no scope, so apply them everywhere).
+    const scopeKeys = [...new Set(BUILTIN_SCOPES.flatMap((s) => s.rules?.sensitiveKeys ?? []))];
+    const globalRules = {
+        ...redaction.globalRules,
+        sensitiveKeys: [...new Set([...(redaction.globalRules.sensitiveKeys ?? []), ...scopeKeys])],
+    };
+    const redactField = (v) => redactValue(v, {
+        globalRules,
+        replacementFormat: redaction.replacementFormat,
+        maxDepth: 64,
+    });
+    // The normalized contract/workflow `projection` is a TYPE/STRUCTURE blob (JSON
+    // schemas, node trees) — its object KEYS are field names (e.g. a schema property
+    // literally named `password`/`token`), NOT secrets. Key-based redaction would
+    // MASK those field names and destroy the schema projection — the most important
+    // part of a contract. So redact the projection with PATTERN rules ONLY (still
+    // catches secret-LOOKING literal values, e.g. a hardcoded `sk-…` default), never
+    // sensitiveKeys.
+    const structureRules = { ...redaction.globalRules, sensitiveKeys: [] };
+    const redactStructure = (v) => redactValue(v, {
+        globalRules: structureRules,
+        replacementFormat: redaction.replacementFormat,
+        maxDepth: 64,
+    });
+    // Redact ONLY the secret-bearing/free-text fields — NEVER `testId` (the stable
+    // join key with run evidence; redacting an id that matches a built-in pattern
+    // would break correlation and collapse distinct ids) or structural fields
+    // (requires/defaultRun/counts/flags).
+    const safeTests = tests.map((t) => ({
+        ...t,
+        description: t.description == null ? t.description : redactField(t.description),
+        deprecated: t.deprecated == null ? t.deprecated : redactField(t.deprecated),
+        incompleteReason: t.incompleteReason == null ? t.incompleteReason : redactField(t.incompleteReason),
+        assertions: redactField(t.assertions),
+        endpoints: redactField(t.endpoints),
+    }));
+    // Contracts/workflows: redact the free-text + the normalized `projection` body
+    // (schemas/descriptions/notes), preserve identity/structural fields.
+    const safeContracts = contracts.map((c) => ({
+        contractId: c.contractId,
+        protocol: c.protocol,
+        target: c.target ?? null,
+        description: c.description == null ? null : redactField(c.description),
+        deprecated: c.deprecated == null ? null : redactField(c.deprecated),
+        tags: c.tags ?? [],
+        caseCount: c.caseCount,
+        projection: redactStructure(c.projection),
+        projectionComplete: c.projectionComplete,
+        incompleteReason: c.incompleteReason ?? null,
+    }));
+    const safeWorkflows = workflows.map((w) => ({
+        workflowId: w.workflowId,
+        name: w.name ?? null,
+        description: w.description == null ? null : redactField(w.description),
+        tags: w.tags ?? [],
+        nodeCount: w.nodeCount,
+        projection: redactStructure(w.projection),
+        projectionComplete: w.projectionComplete,
+        incompleteReason: w.incompleteReason ?? null,
+    }));
+    // The OpenAPI doc is purely structural (paths + schemas). Redact it pattern-ONLY
+    // (same as the normalized projection): mask secret-LOOKING example/default values
+    // but PRESERVE schema field names — masking a `password`/`token` field name (a
+    // type, not a secret) would corrupt the schema. `null` when there are no HTTP
+    // contracts, so a full-replace clears any stale doc.
+    const safeOpenapi = openapi ? redactStructure(openapi) : null;
+    const base = `${apiUrl.replace(/\/+$/, "")}/v1/projects/${projectId}/projections`;
+    // Each kind is its OWN full-snapshot replace (an empty kind clears that kind's
+    // stale projections). POST all three; a failure on any aborts.
+    const post = async (kind, body, opts) => {
+        let res;
+        try {
+            res = await fetch(`${base}/${kind}`, {
+                method: "POST",
+                headers: { "content-type": "application/json", authorization: `Bearer ${token}` },
+                body: JSON.stringify(body),
+            });
+        }
+        catch (err) {
+            console.error(`${colors.red}Sync failed (${kind}): ${err?.message ?? String(err)}${colors.reset}`);
+            process.exit(1);
+        }
+        if (!res.ok) {
+            // A server that predates this projection kind answers 404 — tolerate it (skip
+            // this kind) instead of failing a sync that already replaced the OTHER kinds, so
+            // a newer CLI keeps working against a not-yet-upgraded / self-hosted server.
+            if (opts?.tolerateMissingRoute && res.status === 404)
+                return { skipped: true };
+            const text = await res.text().catch(() => "");
+            console.error(`${colors.red}Sync failed (${kind}): ${res.status} ${text}${colors.reset}`);
+            if (res.status === 401 || res.status === 403) {
+                console.error(`${colors.dim}The token is invalid/expired or lacks runs:write. Create a project token in the dashboard and 'glubean login' (or set GLUBEAN_TOKEN).${colors.reset}`);
+            }
+            process.exit(1);
+        }
+        return (await res.json().catch(() => ({})));
+    };
+    const testRes = await post("test", { tests: safeTests });
+    const contractRes = await post("contract", { contracts: safeContracts });
+    const workflowRes = await post("workflow", { workflows: safeWorkflows });
+    // The OpenAPI doc is a project-level single snapshot (not a per-id replace) — one
+    // doc rendered from all HTTP contracts. POST it last; `null` clears a stale doc. Two
+    // ways it skips (best-effort, never aborts the whole sync): render FAILED (don't wipe
+    // a prior doc on a transient error), or the server predates the route (404 tolerated,
+    // so a newer CLI doesn't break sync against a not-yet-upgraded server).
+    const openapiRes = openapiFailed
+        ? { skipped: true }
+        : await post("openapi", { openapi: safeOpenapi }, { tolerateMissingRoute: true });
+    const line = (label, r, n) => {
+        const removed = r.deleted ? `${colors.dim} (${r.deleted} removed)${colors.reset}` : "";
+        return `${colors.green}✓ ${r.upserted ?? n} ${label}${colors.reset}${removed}`;
+    };
+    const pathCount = safeOpenapi ? Object.keys(safeOpenapi.paths ?? {}).length : 0;
+    const openapiLine = openapiFailed
+        ? `${colors.yellow}⚠ openapi skipped (render failed; kept previous)${colors.reset}`
+        : openapiRes?.skipped
+            ? `${colors.dim}· openapi not supported by this server (skipped)${colors.reset}`
+            : `${colors.green}✓ openapi${colors.reset}${colors.dim} (${pathCount} path${pathCount === 1 ? "" : "s"})${colors.reset}`;
+    console.log(`${line("test", testRes, safeTests.length)}  ${line("contract", contractRes, safeContracts.length)}  ${line("workflow", workflowRes, safeWorkflows.length)}  ${openapiLine} ${colors.dim}→ project ${projectId}${colors.reset}`);
+    const partial = projected.filter((p) => !p.projectionComplete).length +
+        contracts.filter((c) => !c.projectionComplete).length +
+        workflows.filter((w) => !w.projectionComplete).length;
+    if (partial > 0) {
+        console.log(`${colors.yellow}  ◐ ${partial} partial — use ctx.when()/switch()/while() (tests) or resolve opaque nodes/unprojectable schemas (workflows/contracts) for full projection${colors.reset}`);
+    }
+    console.log();
+}
+//# sourceMappingURL=sync.js.map

package/dist/commands/sync.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sync.js","sourceRoot":"","sources":["../../src/commands/sync.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACxC,OAAO,EAAE,cAAc,EAAE,MAAM,iBAAiB,CAAC;AAEjD,OAAO,EAAE,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAChD,OAAO,EAAE,iBAAiB,EAAE,MAAM,UAAU,CAAC;AAC7C,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAC/E,OAAO,EAAE,kBAAkB,EAAE,uBAAuB,EAAE,MAAM,sBAAsB,CAAC;AAEnF,MAAM,MAAM,GAAG;IACb,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,SAAS;IACf,GAAG,EAAE,SAAS;IACd,KAAK,EAAE,UAAU;IACjB,MAAM,EAAE,UAAU;IAClB,IAAI,EAAE,UAAU;IAChB,GAAG,EAAE,UAAU;CAChB,CAAC;AAEF;;iFAEiF;AACjF,SAAS,WAAW,CAAC,GAAW;IAC9B,IAAI,CAAC;QACH,MAAM,CAAC,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;QACvB,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC,CAAC,MAAM,GAAG,EAAE,CAAC;QACd,CAAC,CAAC,IAAI,GAAG,EAAE,CAAC;QACZ,OAAO,CAAC,CAAC,QAAQ,EAAE,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAE,CAAC,OAAO,CAAC,eAAe,EAAE,IAAI,CAAC,CAAC;IAC1E,CAAC;AACH,CAAC;AAaD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,UAA8B,EAAE;IAChE,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/D,+EAA+E;IAC/E,8EAA8E;IAC9E,MAAM,EAAE,OAAO,EAAE,GAAG,MAAM,iBAAiB,CAAC,GAAG,CAAC,CAAC;IAEjD,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,IAAI,GAAG,MAAM,CAAC,IAAI,+CAA+C,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IAE3G,4EAA4E;IAC5E,0EAA0E;IAC1E,8EAA8E;IAC9E,2EAA2E;IAC3E,uEAAuE;IACvE,0EAA0E;IAC1E,mEAAmE;IACnE,4BAA4B;IAC5B,MAAM,oBAAoB,GAAG,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC;IAC/C,IAAI,WAAmB,CAAC;IACxB,IAAI,oBAAoB,EAAE,CAAC;QACzB,WAAW,GAAG,OAAO,CAAC,OAAQ,CAAC;IACjC,CAAC;SAAM,CAAC;QACN,IAAI,CAAC;YACH,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAClD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAI,GAAG,YAAY,uBAAuB,EAAE,CAAC;gBAC3C,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,gBAAgB,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;gBACzE,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;YAClB,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,oBAAoB,EAAE,CAAC;QACzB,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,0BAA0B,WAAW,kBAAkB,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC5G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IAED,gFAAgF;IAChF,+EAA+E;IAC/E,gFAAgF;IAChF,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,cAAc,EAAE,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,aAAa,EAAE,GACjG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAElC,8EAA8E;IAC9E,8EAA8E;IAC9E,2EAA2E;IAC3E,4BAA4B;IAC5B,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,iBAAiB,MAAM,CAAC,MAAM,8BAA8B,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACvG,KAAK,MAAM,CAAC,IAAI,MAAM;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,OAAO,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACjG,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,gFAAgF,MAAM,CAAC,KAAK,EAAE,CAC5G,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,8EAA8E;IAC9E,+EAA+E;IAC/E,gFAAgF;IAChF,8EAA8E;IAC9E,4EAA4E;IAC5E,+EAA+E;IAC/E,+EAA+E;IAC/E,MAAM,OAAO,GAAG;QACd,GAAG,QAAQ,CAAC,MAAM,CAChB,CAAC,CAAC,EAAE,EAAE,CACJ,CAAC,CAAC,UAAU,CAAC,iCAAiC,CAAC;YAC/C,CAAC,CAAC,UAAU,CAAC,wBAAwB,CAAC;YACtC,CAAC,CAAC,UAAU,CAAC,oBAAoB,CAAC,CACrC;QACD,GAAG,cAAc,CAAC,GAAG,CACnB,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,iGAAiG,CAC7G;KACF,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,iBAAiB,OAAO,CAAC,MAAM,+CAA+C,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACzH,KAAK,MAAM,CAAC,IAAI,OAAO;YAAE,OAAO,CAAC,KAAK,CAAC,KAAK,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QAC/E,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,sFAAsF,MAAM,CAAC,KAAK,EAAE,CAClH,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,0EAA0E;IAC1E,iFAAiF;IACjF,mEAAmE;IACnE,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,SAAS,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,EAAE,CAAC;QACtG,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,CAAC,MAAM,2CAA2C,MAAM,CAAC,KAAK,IAAI,MAAM,CAAC,GAAG,iFAAiF,MAAM,CAAC,KAAK,IAAI,CACvL,CAAC;QACF,OAAO;IACT,CAAC;IAED,iFAAiF;IACjF,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,MAAM,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACrE,MAAM,QAAQ,GAAG,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;IAC5F,MAAM,OAAO,GAAG,EAAE,WAAW,EAAE,EAAE,GAAG,IAAI,EAAE,GAAG,OAAO,EAAE,EAAE,CAAC;IACzD,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IACtE,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC5D,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAEtD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,8BAA8B,MAAM,CAAC,KAAK,IAAI;YACzD,GAAG,MAAM,CAAC,GAAG,wJAAwJ,MAAM,CAAC,KAAK,EAAE,CACtL,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,8BAA8B,MAAM,CAAC,KAAK,IAAI;YACzD,GAAG,MAAM,CAAC,GAAG,8DAA8D,MAAM,CAAC,KAAK,EAAE,CAC5F,CAAC;QACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IACD,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,6DAA6D,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;QACxG,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI;QAClC,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,QAAQ,EAAE,CAAC,CAAC,QAAQ,IAAI,IAAI;QAC5B,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI;QAChC,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,SAAS,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACtE,cAAc,EAAE,CAAC,CAAC,cAAc;QAChC,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;QAC5C,OAAO,EAAE,CAAC,CAAC,OAAO,IAAI,KAAK;QAC3B,sEAAsE;QACtE,0EAA0E;QAC1E,0EAA0E;QAC1E,2EAA2E;QAC3E,gDAAgD;QAChD,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpC,CAAC,CAAC,CAAC;IAEJ,4EAA4E;IAC5E,2EAA2E;IAC3E,0EAA0E;IAC1E,8EAA8E;IAC9E,kFAAkF;IAClF,MAAM,EAAE,WAAW,EAAE,cAAc,EAAE,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,CAAC;IAC3E,MAAM,EAAE,mBAAmB,EAAE,sBAAsB,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IACzF,IAAI,SAAS,GAAG,sBAAsB,CAAC,SAAS,CAAC,CAAC,CAAC,oBAAoB;IACvE,IAAI,SAAS,GAAG,KAAK,CAAC;IACtB,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,CAAC,CAAC;QAC7C,SAAS,GAAG,IAAI,CAAC;IACnB,CAAC;IAAC,MAAM,CAAC;QACP,kDAAkD;IACpD,CAAC;IACD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,CAAC;YACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,mBAAmB,CAAC,OAAO,CAAC,CAAC;YACtD,SAAS,GAAG,sBAAsB,CAAC,MAAM,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACjE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,wDAAyD,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAC7H,CAAC;YACF,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;IACH,CAAC;IACD,gFAAgF;IAChF,+EAA+E;IAC/E,iFAAiF;IACjF,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,SAAS,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,cAAc,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;IAC5F,MAAM,WAAW,GAAG;QAClB,GAAG,SAAS,CAAC,WAAW;QACxB,aAAa,EAAE,CAAC,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,SAAS,CAAC,WAAW,CAAC,aAAa,IAAI,EAAE,CAAC,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC;KAC5F,CAAC;IACF,MAAM,WAAW,GAAG,CAAC,CAAU,EAAW,EAAE,CAC1C,WAAW,CAAC,CAAC,EAAE;QACb,WAAW;QACX,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;IACL,+EAA+E;IAC/E,iFAAiF;IACjF,8EAA8E;IAC9E,gFAAgF;IAChF,8EAA8E;IAC9E,iFAAiF;IACjF,iBAAiB;IACjB,MAAM,cAAc,GAAG,EAAE,GAAG,SAAS,CAAC,WAAW,EAAE,aAAa,EAAE,EAAE,EAAE,CAAC;IACvE,MAAM,eAAe,GAAG,CAAC,CAAU,EAAW,EAAE,CAC9C,WAAW,CAAC,CAAC,EAAE;QACb,WAAW,EAAE,cAAc;QAC3B,iBAAiB,EAAE,SAAS,CAAC,iBAAiB;QAC9C,QAAQ,EAAE,EAAE;KACb,CAAC,CAAC;IACL,+EAA+E;IAC/E,8EAA8E;IAC9E,0EAA0E;IAC1E,sCAAsC;IACtC,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAClC,GAAG,CAAC;QACJ,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAY;QAC3F,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAY;QACvF,gBAAgB,EACd,CAAC,CAAC,gBAAgB,IAAI,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAE,WAAW,CAAC,CAAC,CAAC,gBAAgB,CAAY;QAC/F,UAAU,EAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAC;QACrC,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;KACpC,CAAC,CAAC,CAAC;IACJ,+EAA+E;IAC/E,qEAAqE;IACrE,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,QAAQ,EAAE,CAAC,CAAC,QAAQ;QACpB,MAAM,EAAE,CAAC,CAAC,MAAM,IAAI,IAAI;QACxB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAY;QAClF,UAAU,EAAE,CAAC,CAAC,UAAU,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,WAAW,CAAC,CAAC,CAAC,UAAU,CAAY;QAC/E,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QACzC,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;KAC7C,CAAC,CAAC,CAAC;IACJ,MAAM,aAAa,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAC1C,UAAU,EAAE,CAAC,CAAC,UAAU;QACxB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,IAAI;QACpB,WAAW,EAAE,CAAC,CAAC,WAAW,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAE,WAAW,CAAC,CAAC,CAAC,WAAW,CAAY;QAClF,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,EAAE;QAClB,SAAS,EAAE,CAAC,CAAC,SAAS;QACtB,UAAU,EAAE,eAAe,CAAC,CAAC,CAAC,UAAU,CAAC;QACzC,kBAAkB,EAAE,CAAC,CAAC,kBAAkB;QACxC,gBAAgB,EAAE,CAAC,CAAC,gBAAgB,IAAI,IAAI;KAC7C,CAAC,CAAC,CAAC;IACJ,iFAAiF;IACjF,kFAAkF;IAClF,+EAA+E;IAC/E,8EAA8E;IAC9E,qDAAqD;IACrD,MAAM,WAAW,GAAG,OAAO,CAAC,CAAC,CAAE,eAAe,CAAC,OAAO,CAA6B,CAAC,CAAC,CAAC,IAAI,CAAC;IAE3F,MAAM,IAAI,GAAG,GAAG,MAAM,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,SAAS,cAAc,CAAC;IAClF,+EAA+E;IAC/E,+DAA+D;IAC/D,MAAM,IAAI,GAAG,KAAK,EAChB,IAAY,EACZ,IAAa,EACb,IAAyC,EAC4B,EAAE;QACvE,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,IAAI,IAAI,EAAE,EAAE;gBACnC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,KAAK,EAAE,EAAE;gBACjF,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;aAC3B,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,gBAAgB,IAAI,MAAO,GAAa,EAAE,OAAO,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC9G,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,IAAI,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC;YACZ,8EAA8E;YAC9E,iFAAiF;YACjF,6EAA6E;YAC7E,IAAI,IAAI,EAAE,oBAAoB,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;gBAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;YAC/E,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;YAC9C,OAAO,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,GAAG,gBAAgB,IAAI,MAAM,GAAG,CAAC,MAAM,IAAI,IAAI,GAAG,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC;YAC1F,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,OAAO,CAAC,KAAK,CACX,GAAG,MAAM,CAAC,GAAG,wIAAwI,MAAM,CAAC,KAAK,EAAE,CACpK,CAAC;YACJ,CAAC;YACD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QAClB,CAAC;QACD,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAA+D,CAAC;IAC5G,CAAC,CAAC;IAEF,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACzD,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;IACzE,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,aAAa,EAAE,CAAC,CAAC;IACzE,kFAAkF;IAClF,qFAAqF;IACrF,sFAAsF;IACtF,sFAAsF;IACtF,wEAAwE;IACxE,MAAM,UAAU,GAAG,aAAa;QAC9B,CAAC,CAAC,EAAE,OAAO,EAAE,IAAa,EAAE;QAC5B,CAAC,CAAC,MAAM,IAAI,CAAC,SAAS,EAAE,EAAE,OAAO,EAAE,WAAW,EAAE,EAAE,EAAE,oBAAoB,EAAE,IAAI,EAAE,CAAC,CAAC;IAEpF,MAAM,IAAI,GAAG,CAAC,KAAa,EAAE,CAA0C,EAAE,CAAS,EAAE,EAAE;QACpF,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,KAAK,CAAC,CAAC,OAAO,YAAY,MAAM,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACvF,OAAO,GAAG,MAAM,CAAC,KAAK,KAAK,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,KAAK,GAAG,MAAM,CAAC,KAAK,GAAG,OAAO,EAAE,CAAC;IACjF,CAAC,CAAC;IACF,MAAM,SAAS,GAAG,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAE,WAAW,CAAC,KAAiC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC7G,MAAM,WAAW,GAAG,aAAa;QAC/B,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,mDAAmD,MAAM,CAAC,KAAK,EAAE;QACnF,CAAC,CAAC,UAAU,EAAE,OAAO;YACnB,CAAC,CAAC,GAAG,MAAM,CAAC,GAAG,mDAAmD,MAAM,CAAC,KAAK,EAAE;YAChF,CAAC,CAAC,GAAG,MAAM,CAAC,KAAK,YAAY,MAAM,CAAC,KAAK,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS,QAAQ,SAAS,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,IAAI,MAAM,CAAC,KAAK,EAAE,CAAC;IAC7H,OAAO,CAAC,GAAG,CACT,GAAG,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,UAAU,EAAE,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,KAAK,WAAW,IAAI,MAAM,CAAC,GAAG,aAAa,SAAS,GAAG,MAAM,CAAC,KAAK,EAAE,CAChO,CAAC;IACF,MAAM,OAAO,GACX,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,MAAM;QACrD,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,MAAM;QACrD,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,MAAM,CAAC;IACxD,IAAI,OAAO,GAAG,CAAC,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,GAAG,MAAM,CAAC,MAAM,OAAO,OAAO,6IAA6I,MAAM,CAAC,KAAK,EAAE,CAC1L,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,EAAE,CAAC;AAChB,CAAC"}

package/dist/lib/active_env.d.ts

@@ -5,6 +5,18 @@
  * Used by both the CLI `run` command and the MCP server to resolve
  * which `.env.<name>` file to load when no explicit `--env-file` is given.
  */
+/**
+ * Thrown by `resolveEnvFileName` when the active env resolves to a
+ * sensitive (prod-like) name. Callers MUST catch this and surface an
+ * actionable error — never fall through to silently loading the file
+ * anyway. Explicit `--env-file .env.prod` bypasses `resolveEnvFileName`
+ * entirely (call sites branch on `userSpecifiedEnvFile` first), so this
+ * only blocks the *implicit* path.
+ */
+export declare class SensitiveActiveEnvError extends Error {
+    readonly envName: string;
+    constructor(envName: string);
+}
 /**
  * Read the active environment name from `.glubean/active-env`.
  * Returns `undefined` if the file doesn't exist or is empty.
@@ -23,7 +35,10 @@ export declare function clearActiveEnv(projectRoot: string): Promise<void>;
  *
  * Priority:
  * 1. Explicit `--env-file` flag (pass-through, not handled here)
- * 2. `.glubean/active-env` → `.env.<name>`
+ * 2. `.glubean/active-env` → `.env.<name>` — UNLESS `<name>` is a sensitive
+ *    (prod-like) name, in which case this throws `SensitiveActiveEnvError`
+ *    instead of silently returning it (GLU-88). Every caller must handle
+ *    that error explicitly.
  * 3. Default `.env`
  */
 export declare function resolveEnvFileName(projectRoot: string): Promise<string>;

package/dist/lib/active_env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"active_env.d.ts","sourceRoot":"","sources":["../../src/lib/active_env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAYH;;;GAGG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvE;AAED;;;;;;;GAOG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CAMjB"}
+{"version":3,"file":"active_env.d.ts","sourceRoot":"","sources":["../../src/lib/active_env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AA4BH;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,KAAK;aACpB,OAAO,EAAE,MAAM;gBAAf,OAAO,EAAE,MAAM;CAW5C;AAMD;;;GAGG;AACH,wBAAsB,aAAa,CACjC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAQ7B;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,WAAW,EAAE,MAAM,EACnB,OAAO,EAAE,MAAM,GACd,OAAO,CAAC,IAAI,CAAC,CAIf;AAED;;GAEG;AACH,wBAAsB,cAAc,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAMvE;AAED;;;;;;;;;;GAUG;AACH,wBAAsB,kBAAkB,CACtC,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,MAAM,CAAC,CASjB"}

package/dist/lib/active_env.js

@@ -9,6 +9,45 @@ import { resolve } from "node:path";
 import { readFile, writeFile, mkdir, unlink } from "node:fs/promises";
 const ACTIVE_ENV_DIR = ".glubean";
 const ACTIVE_ENV_FILE = "active-env";
+/**
+ * GLU-88: env names that must NEVER be picked up silently through the
+ * `.glubean/active-env` fallback. `.glubean/active-env` is a persistent,
+ * un-TTL'd, un-warned sticky file — a `glubean env use prod` run once (e.g.
+ * to debug something) stays in effect for every future `glubean run` /
+ * `sync` / `load` in that directory until someone remembers to `glubean env
+ * reset`. For an ordinary named env (staging, dev, ci) that stickiness is
+ * the whole point of the feature. For a *production* env it's a footgun:
+ * a later, unrelated `--upload` silently ships data to prod with no
+ * confirmation and (today) no way to delete it server-side. Matched
+ * case-insensitively against the trimmed active-env name; deliberately an
+ * exact-match denylist (not a substring/regex sweep) to avoid false
+ * positives on names like "preprod-mirror".
+ */
+const SENSITIVE_ENV_NAMES = new Set(["prod", "production"]);
+function isSensitiveEnvName(name) {
+    return SENSITIVE_ENV_NAMES.has(name.trim().toLowerCase());
+}
+/**
+ * Thrown by `resolveEnvFileName` when the active env resolves to a
+ * sensitive (prod-like) name. Callers MUST catch this and surface an
+ * actionable error — never fall through to silently loading the file
+ * anyway. Explicit `--env-file .env.prod` bypasses `resolveEnvFileName`
+ * entirely (call sites branch on `userSpecifiedEnvFile` first), so this
+ * only blocks the *implicit* path.
+ */
+export class SensitiveActiveEnvError extends Error {
+    envName;
+    constructor(envName) {
+        super(`Active environment is "${envName}" (set via \`glubean env use ${envName}\`, ` +
+            `recorded in .glubean/active-env), which looks like a production ` +
+            `environment. Refusing to load it implicitly — GLU-88 hardens exactly ` +
+            `this case (a stale active-env silently routing an unrelated run to prod). ` +
+            `Pass \`--env-file .env.${envName}\` to use it explicitly, or run ` +
+            `\`glubean env reset\` to clear the active environment and fall back to .env.`);
+        this.envName = envName;
+        this.name = "SensitiveActiveEnvError";
+    }
+}
 function activeEnvPath(projectRoot) {
     return resolve(projectRoot, ACTIVE_ENV_DIR, ACTIVE_ENV_FILE);
 }
@@ -50,12 +89,18 @@ export async function clearActiveEnv(projectRoot) {
  *
  * Priority:
  * 1. Explicit `--env-file` flag (pass-through, not handled here)
- * 2. `.glubean/active-env` → `.env.<name>`
+ * 2. `.glubean/active-env` → `.env.<name>` — UNLESS `<name>` is a sensitive
+ *    (prod-like) name, in which case this throws `SensitiveActiveEnvError`
+ *    instead of silently returning it (GLU-88). Every caller must handle
+ *    that error explicitly.
  * 3. Default `.env`
  */
 export async function resolveEnvFileName(projectRoot) {
     const activeEnv = await readActiveEnv(projectRoot);
     if (activeEnv) {
+        if (isSensitiveEnvName(activeEnv)) {
+            throw new SensitiveActiveEnvError(activeEnv);
+        }
         return `.env.${activeEnv}`;
     }
     return ".env";

package/dist/lib/active_env.js.map

@@ -1 +1 @@
-{"version":3,"file":"active_env.js","sourceRoot":"","sources":["../../src/lib/active_env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEtE,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC,SAAS,aAAa,CAAC,WAAmB;IACxC,OAAO,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,GAAG,IAAI,SAAS,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,OAAe;IAEf,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACjD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,SAAS,EAAE,CAAC;QACd,OAAO,QAAQ,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"active_env.js","sourceRoot":"","sources":["../../src/lib/active_env.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAEtE,MAAM,cAAc,GAAG,UAAU,CAAC;AAClC,MAAM,eAAe,GAAG,YAAY,CAAC;AAErC;;;;;;;;;;;;;GAaG;AACH,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC,CAAC;AAE5D,SAAS,kBAAkB,CAAC,IAAY;IACtC,OAAO,mBAAmB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC;AAC5D,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACpB;IAA5B,YAA4B,OAAe;QACzC,KAAK,CACH,0BAA0B,OAAO,gCAAgC,OAAO,MAAM;YAC5E,kEAAkE;YAClE,uEAAuE;YACvE,4EAA4E;YAC5E,0BAA0B,OAAO,kCAAkC;YACnE,8EAA8E,CACjF,CAAC;QARwB,YAAO,GAAP,OAAO,CAAQ;QASzC,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACxC,CAAC;CACF;AAED,SAAS,aAAa,CAAC,WAAmB;IACxC,OAAO,OAAO,CAAC,WAAW,EAAE,cAAc,EAAE,eAAe,CAAC,CAAC;AAC/D,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB;IAEnB,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC,CAAC;QACpE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO,GAAG,IAAI,SAAS,CAAC;IAC1B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAClC,WAAmB,EACnB,OAAe;IAEf,MAAM,GAAG,GAAG,OAAO,CAAC,WAAW,EAAE,cAAc,CAAC,CAAC;IACjD,MAAM,KAAK,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtC,MAAM,SAAS,CAAC,aAAa,CAAC,WAAW,CAAC,EAAE,OAAO,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACvE,CAAC;AAED;;GAEG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,WAAmB;IACtD,IAAI,CAAC;QACH,MAAM,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,6BAA6B;IAC/B,CAAC;AACH,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,WAAmB;IAEnB,MAAM,SAAS,GAAG,MAAM,aAAa,CAAC,WAAW,CAAC,CAAC;IACnD,IAAI,SAAS,EAAE,CAAC;QACd,IAAI,kBAAkB,CAAC,SAAS,CAAC,EAAE,CAAC;YAClC,MAAM,IAAI,uBAAuB,CAAC,SAAS,CAAC,CAAC;QAC/C,CAAC;QACD,OAAO,QAAQ,SAAS,EAAE,CAAC;IAC7B,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/lib/only-selectors.d.ts

@@ -0,0 +1,61 @@
+/**
+ * only-selectors.ts — pure, unit-testable builders for the B2 M3 `{id, rowIndex}`
+ * "only" selector protocol at the CLI surface.
+ *
+ * Two entry points:
+ *  - `buildOnlySelectorsFromFlags` — the single validation gate for the
+ *    `--only-id` / `--row` / `--rerun-failed` flag combination. Returns the
+ *    selector set for the explicit (`--only-id`/`--row`) path, or a clear error.
+ *  - `deriveRerunSelectors` — turns a prior `last-run.result.json` into the
+ *    failed-subset selectors + the distinct files those failures live in.
+ *
+ * The protocol shape (`OnlySelector`) and matching/collection semantics
+ * (`collectFailedSelectors`) are reused from `@glubean/runner` so the CLI, the
+ * SDK runner, and the cloud harness all speak ONE protocol.
+ */
+import { type OnlySelector } from "@glubean/runner";
+export interface OnlyFlags {
+    onlyId?: string[];
+    row?: number;
+    rerunFailed?: boolean;
+}
+export type BuildSelectorsResult = {
+    ok: true;
+    selectors: OnlySelector[];
+} | {
+    ok: false;
+    error: string;
+};
+/**
+ * Validate the flag combination and build selectors for the explicit
+ * `--only-id` / `--row` path.
+ *
+ * Validation:
+ *  - `--rerun-failed` is mutually exclusive with `--only-id` / `--row`.
+ *  - `--row` requires EXACTLY one `--only-id` (it pins a single `.each` row).
+ *
+ * Returns `{ selectors: [] }` for the conflict-free `--rerun-failed` case — the
+ * caller sources the actual selectors from the last run via `deriveRerunSelectors`.
+ */
+export declare function buildOnlySelectorsFromFlags(opts: OnlyFlags): BuildSelectorsResult;
+/**
+ * Derive the `--rerun-failed` selector set + the distinct files those failures
+ * came from, off a prior run's `last-run.result.json` `tests` array.
+ *
+ * `selectors` reuses `collectFailedSelectors` (failed records with an id → bare
+ * `{id}` or row-pinned `{id, rowIndex}`). `files` is the de-duplicated list of
+ * `filePath`s of failed records (declaration order preserved) so the caller can
+ * narrow discovery to only the files that actually contained a failure.
+ */
+export declare function deriveRerunSelectors(lastRun: {
+    tests: Array<{
+        testId?: string;
+        rowIndex?: number;
+        filePath?: string;
+        success: boolean;
+    }>;
+}): {
+    selectors: OnlySelector[];
+    files: string[];
+};
+//# sourceMappingURL=only-selectors.d.ts.map

package/dist/lib/only-selectors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"only-selectors.d.ts","sourceRoot":"","sources":["../../src/lib/only-selectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAA0B,KAAK,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAE5E,MAAM,WAAW,SAAS;IACxB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,WAAW,CAAC,EAAE,OAAO,CAAC;CACvB;AAED,MAAM,MAAM,oBAAoB,GAC5B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,SAAS,EAAE,YAAY,EAAE,CAAA;CAAE,GACvC;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEjC;;;;;;;;;;GAUG;AACH,wBAAgB,2BAA2B,CAAC,IAAI,EAAE,SAAS,GAAG,oBAAoB,CAiCjF;AAED;;;;;;;;GAQG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,EAAE;IAC5C,KAAK,EAAE,KAAK,CAAC;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;CAC3F,GAAG;IAAE,SAAS,EAAE,YAAY,EAAE,CAAC;IAAC,KAAK,EAAE,MAAM,EAAE,CAAA;CAAE,CAcjD"}

package/dist/lib/only-selectors.js

@@ -0,0 +1,79 @@
+/**
+ * only-selectors.ts — pure, unit-testable builders for the B2 M3 `{id, rowIndex}`
+ * "only" selector protocol at the CLI surface.
+ *
+ * Two entry points:
+ *  - `buildOnlySelectorsFromFlags` — the single validation gate for the
+ *    `--only-id` / `--row` / `--rerun-failed` flag combination. Returns the
+ *    selector set for the explicit (`--only-id`/`--row`) path, or a clear error.
+ *  - `deriveRerunSelectors` — turns a prior `last-run.result.json` into the
+ *    failed-subset selectors + the distinct files those failures live in.
+ *
+ * The protocol shape (`OnlySelector`) and matching/collection semantics
+ * (`collectFailedSelectors`) are reused from `@glubean/runner` so the CLI, the
+ * SDK runner, and the cloud harness all speak ONE protocol.
+ */
+import { collectFailedSelectors } from "@glubean/runner";
+/**
+ * Validate the flag combination and build selectors for the explicit
+ * `--only-id` / `--row` path.
+ *
+ * Validation:
+ *  - `--rerun-failed` is mutually exclusive with `--only-id` / `--row`.
+ *  - `--row` requires EXACTLY one `--only-id` (it pins a single `.each` row).
+ *
+ * Returns `{ selectors: [] }` for the conflict-free `--rerun-failed` case — the
+ * caller sources the actual selectors from the last run via `deriveRerunSelectors`.
+ */
+export function buildOnlySelectorsFromFlags(opts) {
+    const onlyId = opts.onlyId ?? [];
+    const hasRow = opts.row !== undefined;
+    const rerun = !!opts.rerunFailed;
+    // --rerun-failed reuses the last run's failed set; it can't be combined with
+    // an explicit --only-id / --row target.
+    if (rerun && (onlyId.length > 0 || hasRow)) {
+        return {
+            ok: false,
+            error: "--rerun-failed cannot be combined with --only-id or --row (it reuses the last run's failed set).",
+        };
+    }
+    // --row pins a single .each row, so it needs exactly one --only-id to attach to.
+    if (hasRow && onlyId.length !== 1) {
+        return {
+            ok: false,
+            error: onlyId.length === 0
+                ? "--row requires --only-id (the id whose .each row you want to isolate)."
+                : `--row requires exactly one --only-id (got ${onlyId.length}). Drop --row to run multiple ids.`,
+        };
+    }
+    // Conflict-free rerun mode: no flag-derived selectors — they come from the file.
+    if (rerun)
+        return { ok: true, selectors: [] };
+    if (hasRow) {
+        return { ok: true, selectors: [{ id: onlyId[0], rowIndex: opts.row }] };
+    }
+    return { ok: true, selectors: onlyId.map((id) => ({ id })) };
+}
+/**
+ * Derive the `--rerun-failed` selector set + the distinct files those failures
+ * came from, off a prior run's `last-run.result.json` `tests` array.
+ *
+ * `selectors` reuses `collectFailedSelectors` (failed records with an id → bare
+ * `{id}` or row-pinned `{id, rowIndex}`). `files` is the de-duplicated list of
+ * `filePath`s of failed records (declaration order preserved) so the caller can
+ * narrow discovery to only the files that actually contained a failure.
+ */
+export function deriveRerunSelectors(lastRun) {
+    const tests = lastRun.tests ?? [];
+    const selectors = collectFailedSelectors(tests.map((t) => ({ id: t.testId, rowIndex: t.rowIndex, success: t.success })));
+    const files = [];
+    const seen = new Set();
+    for (const t of tests) {
+        if (t.success === false && t.filePath && !seen.has(t.filePath)) {
+            seen.add(t.filePath);
+            files.push(t.filePath);
+        }
+    }
+    return { selectors, files };
+}
+//# sourceMappingURL=only-selectors.js.map

package/dist/lib/only-selectors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"only-selectors.js","sourceRoot":"","sources":["../../src/lib/only-selectors.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,EAAE,sBAAsB,EAAqB,MAAM,iBAAiB,CAAC;AAY5E;;;;;;;;;;GAUG;AACH,MAAM,UAAU,2BAA2B,CAAC,IAAe;IACzD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,EAAE,CAAC;IACjC,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,KAAK,SAAS,CAAC;IACtC,MAAM,KAAK,GAAG,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC;IAEjC,6EAA6E;IAC7E,wCAAwC;IACxC,IAAI,KAAK,IAAI,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,EAAE,CAAC;QAC3C,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,kGAAkG;SACrG,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,IAAI,MAAM,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClC,OAAO;YACL,EAAE,EAAE,KAAK;YACT,KAAK,EACH,MAAM,CAAC,MAAM,KAAK,CAAC;gBACjB,CAAC,CAAC,wEAAwE;gBAC1E,CAAC,CAAC,6CAA6C,MAAM,CAAC,MAAM,oCAAoC;SACrG,CAAC;IACJ,CAAC;IAED,iFAAiF;IACjF,IAAI,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC;IAE9C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,CAAC,CAAC,CAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAI,EAAE,CAAC,EAAE,CAAC;IAC5E,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAAC,OAEpC;IACC,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC;IAClC,MAAM,SAAS,GAAG,sBAAsB,CACtC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,OAAO,EAAE,CAAC,CAAC,CAC/E,CAAC;IACF,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAC/B,KAAK,MAAM,CAAC,IAAI,KAAK,EAAE,CAAC;QACtB,IAAI,CAAC,CAAC,OAAO,KAAK,KAAK,IAAI,CAAC,CAAC,QAAQ,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC;YAC/D,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;YACrB,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;QACzB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;AAC9B,CAAC"}