@hearsay-tools/squawk 0.0.0-stage → 0.17.0-dev.5685

package/dist/paths.d.ts

@@ -0,0 +1,118 @@
+import type { AgentHomePaths } from './agent-config/catalog.ts';
+import type { Home } from './home/home.ts';
+/**
+ * Test writers must never reach the account's real cezar home. HOME can be a
+ * sandbox, so read the account home from the OS. Runner detection belongs to
+ * the process: a caller's custom env must not disable this guard.
+ */
+export declare function assertCezarHomeWriteIsSandboxed(path: string, _env?: NodeJS.ProcessEnv): void;
+/**
+ * The default server-install instance id. An install with no `--domain` (the
+ * original single-cockpit-per-host flow) is this instance, and it keeps the
+ * legacy `~/.cezar/server.json` path so existing hosts upgrade in place.
+ */
+export declare const DEFAULT_SERVER_INSTANCE = "default";
+/**
+ * Turn a public domain into a stable, filesystem- and systemd-safe instance
+ * slug — the key that lets one host run several independent cockpits, each for
+ * a different domain (nginx site `cezar-<slug>`, unit `cezar-<slug>.service`,
+ * state file `server-instances/<slug>.json`). Lowercased; every run of
+ * non-`[a-z0-9]` becomes a single `-`; leading/trailing `-` trimmed. A `.` in a
+ * systemd unit name is a type separator, so dots collapse to `-` too. Returns
+ * `default` for empty/degenerate input so a bad value can never escape the
+ * instance namespace.
+ */
+export declare function instanceSlug(domain: string | undefined | null): string;
+/** The directory holding per-domain (named) server-install state files. */
+export declare function serverInstancesDir(home: Home): string;
+/**
+ * Host-level record written by `server-install` (spec 2026-07-16-server-installer).
+ * The `default` instance keeps the original `~/.cezar/server.json`; a named
+ * (domain-keyed) instance lives at `~/.cezar/server-instances/<slug>.json`, so
+ * a second install for a different domain never resumes or clobbers the first.
+ * Distinct from the per-user project registry the multi-project workspace keeps
+ * inside `~/.cezar/config.json` (see `workspaceConfigPath`) — they coexist.
+ */
+export declare function serverStatePath(instance: string | undefined, home: Home): string;
+/**
+ * Per-user workspace config (spec 2026-07-20-multi-project-workspace): schema
+ * version, global defaults, and the project registry — every repo cezar has
+ * been booted in. The legacy layout keeps it under `Home.root`, so the `CEZ_HOME`
+ * override applies (tests/containers never touch a real home dir).
+ */
+export declare function workspaceConfigPath(env: NodeJS.ProcessEnv | undefined, home: Home): string;
+/**
+ * Global GUI state — the workspace twin of the per-repo
+ * `.ai/cezar/ui-state.json`. Cross-project UI prefs live here; per-project
+ * state (pinned runs, templates) stays in each repo's file.
+ */
+export declare function workspaceUiStatePath(home: Home): string;
+/**
+ * Agent accounts and per-project selections use their own file. Account deletion and selection
+ * cleanup share one atomic write.
+ */
+export declare function agentAccountsPath(home: Home): string;
+/**
+ * Expand a leading `~` to the user's home. Lives here with the other homedir
+ * logic (see the module note above — one place owns `homedir()`): the
+ * workspace browse/checkout roots are stored as the user wrote them (a literal `~`), so
+ * every consumer that must touch the REAL directory — the writability probe on
+ * `PUT /api/workspace/config`, the browse root in
+ * `src/server/fs-browse.ts` — expands it through this one helper.
+ */
+export declare function expandTilde(path: string): string;
+/**
+ * Single-writer lock the installer/uninstaller hold for a whole run. Per
+ * instance, so installing/uninstalling one cockpit never blocks work on another
+ * on the same host. The host-level installer is not concurrency-safe with
+ * itself *for the same instance*.
+ */
+export declare function serverLockPath(instance: string | undefined, home: Home): string;
+/**
+ * Where each coding agent keeps its per-user config, honouring the env vars the
+ * vendors document: `$CLAUDE_CONFIG_DIR` relocates Claude Code's home;
+ * `$CODEX_HOME` relocates Codex's; `$XDG_CONFIG_HOME` relocates OpenCode's config
+ * dir (falling back to `~/.config`); `$PI_CODING_AGENT_DIR` relocates Pi's agent dir
+ * (default `~/.pi/agent`); OMP reads that variable too unless `$OMP_PROFILE` selects a profile
+ * (`ompAgentDir`). Read per call so tests and ops can set env live.
+ *
+ * These are the DEFAULT profile's dirs. A second login of the same CLI is an
+ * agent profile (`src/core/agent-profiles.ts`) and resolves through
+ * `agentHomePathsForProfiles` instead — what this function answers is what the
+ * host is configured for when nothing overrides it.
+ */
+export declare function agentHomePaths(env?: NodeJS.ProcessEnv): AgentHomePaths;
+/**
+ * Where omp keeps its named profiles, `~/<PI_CONFIG_DIR or .omp>/profiles`. A named omp account
+ * is one folder in here: `OMP_PROFILE` takes a name, so a folder anywhere else could not be
+ * selected (see `ompProfileDirError` in `workspace/agent-profiles.ts`).
+ */
+export declare function ompProfilesDir(env?: NodeJS.ProcessEnv): string;
+/**
+ * Where Claude Code keeps `.claude.json` — its MCP/state file — for a given config dir. The
+ * location is NOT uniform: by default the file is a SIBLING of `~/.claude`, but under a
+ * `CLAUDE_CONFIG_DIR` override it moves INSIDE the overridden dir (verified against the shipped CLI
+ * 2026-07-29, and against a real second-account dir on disk). Reading it from `dirname(configDir)`
+ * unconditionally — as this repo did — lands on `~/.claude.json` for a `~/.claude-klaudiusz`
+ * profile, i.e. the wrong account's file.
+ *
+ * The condition below reads like two heuristics OR-ed together; it is one exact rule. The file sits
+ * inside precisely when the CLI will SEE `CLAUDE_CONFIG_DIR` for this dir, and cezar knows when
+ * that is:
+ *
+ *   - a stored account is always spawned with it (`profileEnv`), and its dir is by construction not
+ *     `~/.claude` — the route refuses a dir that is already the discovered account's;
+ *   - the DISCOVERED account is spawned with nothing added, so it sees the variable only when the
+ *     cezar process itself carries one — and it does reach the child, because `CLAUDE_` is in
+ *     `BACKEND_ALLOW_PREFIXES`.
+ *
+ * One case is worth naming because it looks like a bug and is not. Start cezar with
+ * `CLAUDE_CONFIG_DIR=/opt/work` and add `~/.claude` as a NAMED account (legal — the discovered
+ * account is `/opt/work`, so `~/.claude` is not a duplicate). This answers `~/.claude/.claude.json`,
+ * not the sibling `~/.claude.json`, and "Show details" can therefore say "not signed in" for a
+ * folder a bare `claude` would treat as signed in. That is correct rather than unfortunate: cezar
+ * will run that account as `CLAUDE_CONFIG_DIR=~/.claude claude`, and under that invocation the
+ * state file the CLI reads and writes IS the one inside. Reporting the sibling would describe a
+ * login this account will never use.
+ */
+export declare function claudeStateFilePath(claudeHome: string, env?: NodeJS.ProcessEnv): string;

package/dist/paths.js

@@ -0,0 +1,192 @@
+import { logPrefix } from './home/display.js';
+import { homedir } from 'node:os';
+import { dirname, join } from 'node:path';
+import { isOmpProfileName } from './core/agent-profiles.js';
+import { assertOutsideAccountHome } from './home/protected-roots.js';
+/**
+ * Test writers must never reach the account's real cezar home. HOME can be a
+ * sandbox, so read the account home from the OS. Runner detection belongs to
+ * the process: a caller's custom env must not disable this guard.
+ */
+export function assertCezarHomeWriteIsSandboxed(path, _env = process.env) {
+    const testing = process.env.VITEST || process.env.NODE_TEST_CONTEXT || process.env.JEST_WORKER_ID
+        || Object.keys(process.env).some((key) => key.startsWith('STRYKER_'));
+    if (!testing)
+        return;
+    assertOutsideAccountHome(path, () => new Error(`${logPrefix()} refusing to write ${path} from a test run — CEZ_HOME is not pinned to a sandbox. ` +
+        'Pin it to a test sandbox so the suite never touches the real cezar home.'));
+}
+/**
+ * The default server-install instance id. An install with no `--domain` (the
+ * original single-cockpit-per-host flow) is this instance, and it keeps the
+ * legacy `~/.cezar/server.json` path so existing hosts upgrade in place.
+ */
+export const DEFAULT_SERVER_INSTANCE = 'default';
+/**
+ * Turn a public domain into a stable, filesystem- and systemd-safe instance
+ * slug — the key that lets one host run several independent cockpits, each for
+ * a different domain (nginx site `cezar-<slug>`, unit `cezar-<slug>.service`,
+ * state file `server-instances/<slug>.json`). Lowercased; every run of
+ * non-`[a-z0-9]` becomes a single `-`; leading/trailing `-` trimmed. A `.` in a
+ * systemd unit name is a type separator, so dots collapse to `-` too. Returns
+ * `default` for empty/degenerate input so a bad value can never escape the
+ * instance namespace.
+ */
+export function instanceSlug(domain) {
+    const slug = String(domain ?? '')
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+    return slug || DEFAULT_SERVER_INSTANCE;
+}
+/** The directory holding per-domain (named) server-install state files. */
+export function serverInstancesDir(home) {
+    return home.serverInstances;
+}
+/**
+ * Host-level record written by `server-install` (spec 2026-07-16-server-installer).
+ * The `default` instance keeps the original `~/.cezar/server.json`; a named
+ * (domain-keyed) instance lives at `~/.cezar/server-instances/<slug>.json`, so
+ * a second install for a different domain never resumes or clobbers the first.
+ * Distinct from the per-user project registry the multi-project workspace keeps
+ * inside `~/.cezar/config.json` (see `workspaceConfigPath`) — they coexist.
+ */
+export function serverStatePath(instance = DEFAULT_SERVER_INSTANCE, home) {
+    return home.serverState(instance);
+}
+/**
+ * Per-user workspace config (spec 2026-07-20-multi-project-workspace): schema
+ * version, global defaults, and the project registry — every repo cezar has
+ * been booted in. The legacy layout keeps it under `Home.root`, so the `CEZ_HOME`
+ * override applies (tests/containers never touch a real home dir).
+ */
+export function workspaceConfigPath(env = process.env, home) {
+    return home.workspaceConfig;
+}
+/**
+ * Global GUI state — the workspace twin of the per-repo
+ * `.ai/cezar/ui-state.json`. Cross-project UI prefs live here; per-project
+ * state (pinned runs, templates) stays in each repo's file.
+ */
+export function workspaceUiStatePath(home) {
+    return home.workspaceUiState;
+}
+/**
+ * Agent accounts and per-project selections use their own file. Account deletion and selection
+ * cleanup share one atomic write.
+ */
+export function agentAccountsPath(home) {
+    return home.agentAccounts;
+}
+/**
+ * Expand a leading `~` to the user's home. Lives here with the other homedir
+ * logic (see the module note above — one place owns `homedir()`): the
+ * workspace browse/checkout roots are stored as the user wrote them (a literal `~`), so
+ * every consumer that must touch the REAL directory — the writability probe on
+ * `PUT /api/workspace/config`, the browse root in
+ * `src/server/fs-browse.ts` — expands it through this one helper.
+ */
+export function expandTilde(path) {
+    if (path === '~')
+        return homedir();
+    return path.startsWith('~/') ? join(homedir(), path.slice(2)) : path;
+}
+/**
+ * Single-writer lock the installer/uninstaller hold for a whole run. Per
+ * instance, so installing/uninstalling one cockpit never blocks work on another
+ * on the same host. The host-level installer is not concurrency-safe with
+ * itself *for the same instance*.
+ */
+export function serverLockPath(instance = DEFAULT_SERVER_INSTANCE, home) {
+    return home.serverLock(instance);
+}
+/**
+ * Where each coding agent keeps its per-user config, honouring the env vars the
+ * vendors document: `$CLAUDE_CONFIG_DIR` relocates Claude Code's home;
+ * `$CODEX_HOME` relocates Codex's; `$XDG_CONFIG_HOME` relocates OpenCode's config
+ * dir (falling back to `~/.config`); `$PI_CODING_AGENT_DIR` relocates Pi's agent dir
+ * (default `~/.pi/agent`); OMP reads that variable too unless `$OMP_PROFILE` selects a profile
+ * (`ompAgentDir`). Read per call so tests and ops can set env live.
+ *
+ * These are the DEFAULT profile's dirs. A second login of the same CLI is an
+ * agent profile (`src/core/agent-profiles.ts`) and resolves through
+ * `agentHomePathsForProfiles` instead — what this function answers is what the
+ * host is configured for when nothing overrides it.
+ */
+export function agentHomePaths(env = process.env) {
+    const home = env.HOME || env.USERPROFILE || homedir();
+    const xdgConfig = env.XDG_CONFIG_HOME?.trim() || join(home, '.config');
+    return {
+        claude: env.CLAUDE_CONFIG_DIR?.trim() || join(home, '.claude'),
+        codex: env.CODEX_HOME?.trim() || join(home, '.codex'),
+        opencodeConfig: join(xdgConfig, 'opencode'),
+        pi: env.PI_CODING_AGENT_DIR?.trim() || join(home, '.pi', 'agent'),
+        cursor: env.CURSOR_CONFIG_DIR?.trim()
+            || ((process.platform === 'linux' || process.platform === 'freebsd') && env.XDG_CONFIG_HOME?.trim()
+                ? join(env.XDG_CONFIG_HOME.trim(), 'cursor') : join(home, '.cursor')),
+        omp: ompAgentDir(env, home),
+    };
+}
+/**
+ * OMP's (Oh My Pi's) agent dir under `env`, mirroring how omp 18.8.0 resolves it
+ * (`packages/utils/src/dirs.ts`):
+ *
+ * - a profile — `OMP_PROFILE` when it is set at all, else `PI_PROFILE` — selects
+ *   `<root>/profiles/<name>/agent`, and omp then ignores `PI_CODING_AGENT_DIR`;
+ * - otherwise `PI_CODING_AGENT_DIR`, else `<root>/agent`;
+ *
+ * where `<root>` is `~/<PI_CONFIG_DIR or .omp>`. A host that exports a profile therefore moves the
+ * DEFAULT account (see `PROFILE_ENV_VAR` in `core/agent-profiles.ts`). `default`, a blank value
+ * and a name omp would refuse select no profile.
+ */
+function ompAgentDir(env, home) {
+    const root = ompRootDir(env, home);
+    const selected = (env.OMP_PROFILE !== undefined ? env.OMP_PROFILE : env.PI_PROFILE)?.trim();
+    if (selected && isOmpProfileName(selected))
+        return join(root, 'profiles', selected, 'agent');
+    return env.PI_CODING_AGENT_DIR?.trim() || join(root, 'agent');
+}
+function ompRootDir(env, home) {
+    return join(home, env.PI_CONFIG_DIR?.trim() || '.omp');
+}
+/**
+ * Where omp keeps its named profiles, `~/<PI_CONFIG_DIR or .omp>/profiles`. A named omp account
+ * is one folder in here: `OMP_PROFILE` takes a name, so a folder anywhere else could not be
+ * selected (see `ompProfileDirError` in `workspace/agent-profiles.ts`).
+ */
+export function ompProfilesDir(env = process.env) {
+    return join(ompRootDir(env, env.HOME || env.USERPROFILE || homedir()), 'profiles');
+}
+/**
+ * Where Claude Code keeps `.claude.json` — its MCP/state file — for a given config dir. The
+ * location is NOT uniform: by default the file is a SIBLING of `~/.claude`, but under a
+ * `CLAUDE_CONFIG_DIR` override it moves INSIDE the overridden dir (verified against the shipped CLI
+ * 2026-07-29, and against a real second-account dir on disk). Reading it from `dirname(configDir)`
+ * unconditionally — as this repo did — lands on `~/.claude.json` for a `~/.claude-klaudiusz`
+ * profile, i.e. the wrong account's file.
+ *
+ * The condition below reads like two heuristics OR-ed together; it is one exact rule. The file sits
+ * inside precisely when the CLI will SEE `CLAUDE_CONFIG_DIR` for this dir, and cezar knows when
+ * that is:
+ *
+ *   - a stored account is always spawned with it (`profileEnv`), and its dir is by construction not
+ *     `~/.claude` — the route refuses a dir that is already the discovered account's;
+ *   - the DISCOVERED account is spawned with nothing added, so it sees the variable only when the
+ *     cezar process itself carries one — and it does reach the child, because `CLAUDE_` is in
+ *     `BACKEND_ALLOW_PREFIXES`.
+ *
+ * One case is worth naming because it looks like a bug and is not. Start cezar with
+ * `CLAUDE_CONFIG_DIR=/opt/work` and add `~/.claude` as a NAMED account (legal — the discovered
+ * account is `/opt/work`, so `~/.claude` is not a duplicate). This answers `~/.claude/.claude.json`,
+ * not the sibling `~/.claude.json`, and "Show details" can therefore say "not signed in" for a
+ * folder a bare `claude` would treat as signed in. That is correct rather than unfortunate: cezar
+ * will run that account as `CLAUDE_CONFIG_DIR=~/.claude claude`, and under that invocation the
+ * state file the CLI reads and writes IS the one inside. Reporting the sibling would describe a
+ * login this account will never use.
+ */
+export function claudeStateFilePath(claudeHome, env = process.env) {
+    const seesOverride = (env.CLAUDE_CONFIG_DIR?.trim() || '') !== ''
+        || claudeHome !== join(env.HOME || env.USERPROFILE || homedir(), '.claude');
+    return seesOverride ? join(claudeHome, '.claude.json') : join(dirname(claudeHome), '.claude.json');
+}
+//# sourceMappingURL=paths.js.map

package/dist/paths.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"paths.js","sourceRoot":"","sources":["../src/paths.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAE1C,OAAO,EAAE,gBAAgB,EAAE,MAAM,0BAA0B,CAAC;AAE5D,OAAO,EAAE,wBAAwB,EAAE,MAAM,2BAA2B,CAAC;AAGrE;;;;GAIG;AACH,MAAM,UAAU,+BAA+B,CAAC,IAAY,EAAE,IAAI,GAAsB,OAAO,CAAC,GAAG;IACjG,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,iBAAiB,IAAI,OAAO,CAAC,GAAG,CAAC,cAAc;WAC5F,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC;IACxE,IAAI,CAAC,OAAO;QAAE,OAAO;IACrB,wBAAwB,CAAC,IAAI,EAAE,GAAG,EAAE,CAAC,IAAI,KAAK,CAC5C,GAAG,SAAS,EAAE,sBAAsB,IAAI,0DAA0D;QAChG,0EAA0E,CAC7E,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,SAAS,CAAC;AAEjD;;;;;;;;;GASG;AACH,MAAM,UAAU,YAAY,CAAC,MAAiC;IAC5D,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,IAAI,EAAE,CAAC;SAC9B,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;IAC3B,OAAO,IAAI,IAAI,uBAAuB,CAAC;AACzC,CAAC;AAED,2EAA2E;AAC3E,MAAM,UAAU,kBAAkB,CAAC,IAAU;IAC3C,OAAO,IAAI,CAAC,eAAe,CAAC;AAC9B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,eAAe,CAAC,QAAQ,GAAW,uBAAuB,EAAE,IAAU;IACpF,OAAO,IAAI,CAAC,WAAW,CAAC,QAAQ,CAAC,CAAC;AACpC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG,EAAE,IAAU;IAClF,OAAO,IAAI,CAAC,eAAe,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAU;IAC7C,OAAO,IAAI,CAAC,gBAAgB,CAAC;AAC/B,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAU;IAC1C,OAAO,IAAI,CAAC,aAAa,CAAC;AAC5B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,WAAW,CAAC,IAAY;IACtC,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,OAAO,EAAE,CAAC;IACnC,OAAO,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,QAAQ,GAAW,uBAAuB,EAAE,IAAU;IACnF,OAAO,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,CAAC;AACnC,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,cAAc,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACjE,MAAM,IAAI,GAAG,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC;IACtD,MAAM,SAAS,GAAG,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACvE,OAAO;QACL,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC;QAC9D,KAAK,EAAE,GAAG,CAAC,UAAU,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,QAAQ,CAAC;QACrD,cAAc,EAAE,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC;QAC3C,EAAE,EAAE,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC;QACjE,MAAM,EAAE,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE;eAChC,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,IAAI,OAAO,CAAC,QAAQ,KAAK,SAAS,CAAC,IAAI,GAAG,CAAC,eAAe,EAAE,IAAI,EAAE;gBACjG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,eAAe,CAAC,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;QACzE,GAAG,EAAE,WAAW,CAAC,GAAG,EAAE,IAAI,CAAC;KAC5B,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,WAAW,CAAC,GAAsB,EAAE,IAAY;IACvD,MAAM,IAAI,GAAG,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;IACnC,MAAM,QAAQ,GAAG,CAAC,GAAG,CAAC,WAAW,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,IAAI,EAAE,CAAC;IAC5F,IAAI,QAAQ,IAAI,gBAAgB,CAAC,QAAQ,CAAC;QAAE,OAAO,IAAI,CAAC,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC7F,OAAO,GAAG,CAAC,mBAAmB,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAChE,CAAC;AAED,SAAS,UAAU,CAAC,GAAsB,EAAE,IAAY;IACtD,OAAO,IAAI,CAAC,IAAI,EAAE,GAAG,CAAC,aAAa,EAAE,IAAI,EAAE,IAAI,MAAM,CAAC,CAAC;AACzD,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAAG,GAAsB,OAAO,CAAC,GAAG;IACjE,OAAO,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,CAAC,EAAE,UAAU,CAAC,CAAC;AACrF,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,MAAM,UAAU,mBAAmB,CAAC,UAAkB,EAAE,GAAG,GAAsB,OAAO,CAAC,GAAG;IAC1F,MAAM,YAAY,GAAG,CAAC,GAAG,CAAC,iBAAiB,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC,KAAK,EAAE;WAC5D,UAAU,KAAK,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,GAAG,CAAC,WAAW,IAAI,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;IAC9E,OAAO,YAAY,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,EAAE,cAAc,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,cAAc,CAAC,CAAC;AACrG,CAAC"}

package/dist/planner.d.ts

@@ -0,0 +1,30 @@
+import type { Home } from './home/home.ts';
+import { z } from 'zod';
+import type { RunnerFactory } from './core/agent-runner.ts';
+import { type Skill } from './skills.ts';
+import { type WorkflowStepDef } from './workflows/types.ts';
+export interface PlanResult {
+    /** The proposed workflow title (kebab-case slug), when the planner named one. The auto chain
+     *  creator pre-fills the builder's name field with it. Absent on the degraded fallback. */
+    name?: string;
+    steps: WorkflowStepDef[];
+    rationale: string;
+    /** True when this is the degraded one-step quick-task plan. */
+    fallback: boolean;
+}
+export declare function planChain(repoRoot: string, task: string, builtin: readonly Skill[] | undefined, home: Home, createRunner: RunnerFactory): Promise<PlanResult>;
+export declare function slugify(name: string): string;
+/**
+ * The proposed workflow title, normalized to the same kebab-case slug the builder saves as a
+ * file name — so what the auto chain creator pre-fills is already a valid workflow name. A blank
+ * or slug-less title (e.g. all punctuation) answers undefined, and the caller keeps the current
+ * name instead of blanking it.
+ */
+export declare function proposeWorkflowName(raw: string | undefined): string | undefined;
+/**
+ * Best-effort structured-output extraction (trimmed from @cezar/core's
+ * `parseStructured`): try the whole string after stripping a ```json fence,
+ * then scan for balanced top-level `{...}` blocks and return the first that
+ * validates. Null when nothing does — the caller decides how to recover.
+ */
+export declare function parseStructured<T>(raw: string, schema: z.ZodType<T, unknown>): T | null;

package/dist/planner.js

@@ -0,0 +1,270 @@
+import { readFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { z } from 'zod';
+import { loadConfig } from './config.js';
+import { discoverSkills } from './skills.js';
+import { resolveProfileEnvForRoot } from './workspace/agent-profiles.js';
+import { workflowStepSchema } from './workflows/types.js';
+/**
+ * Chain-from-prompt (spec 008): one cheap `claude` call turns the user's task
+ * into a proposed chain of workflow steps built from the skills at hand plus a
+ * detected verification command. The planner NEVER blocks the user — any
+ * error, timeout or unparseable answer degrades to a one-step quick-task plan
+ * with `fallback: true` so the GUI can show a dim note.
+ */
+const PLANNER_TIMEOUT_MS = 60_000;
+const PLANNER_SYSTEM_PROMPT = 'You are a planning assistant for an AI coding agent cockpit. Respond with ONLY a JSON object: ' +
+    '{"title":string,"steps":[{"skill"?:string,"name":string,"prompt"?:string,"command"?:string}],"rationale":string}. ' +
+    'Rules: pick skills ONLY from the provided catalog; a step has either "prompt" (an agent step) or ' +
+    '"command" (a shell verification check); include the {{task}} placeholder in agent prompts where ' +
+    "the user's task text belongs; 1-5 steps; prefer fewer; \"title\" is a short kebab-case name for " +
+    'the whole workflow (2-4 words, e.g. "fix-and-review").';
+const plannerResponseSchema = z.object({
+    /** A short workflow name the builder pre-fills. Optional so older / partial answers still parse. */
+    title: z.string().optional(),
+    steps: z
+        .array(z.object({
+        skill: z.string().optional(),
+        name: z.string().min(1),
+        prompt: z.string().optional(),
+        command: z.string().optional(),
+    }))
+        .min(1)
+        .max(5),
+    rationale: z.string().default(''),
+});
+export async function planChain(repoRoot, task, builtin = [], home, createRunner) {
+    const [skills, config, verifyCommands] = await Promise.all([
+        discoverSkills(repoRoot, { builtin }, home),
+        loadConfig(repoRoot, home),
+        detectVerifyCommands(repoRoot),
+    ]);
+    const skillNames = new Set(skills.map((s) => s.name));
+    const userPrompt = buildPlannerPrompt(task, skills, verifyCommands);
+    // Plan with the configured default runner. `plannerModel` ("sonnet") is a
+    // Claude alias, so only pass it when the planner runs on Claude — Codex /
+    // OpenCode pick their own default model instead.
+    const runner = createRunner(config.defaultRunner);
+    const plannerModel = config.defaultRunner === 'claude' ? config.plannerModel : undefined;
+    // Plan under the SAME agent account this project's tasks run on (spec
+    // 2026-07-29-agent-profiles). Without this the planner would quietly bill the personal
+    // subscription for a project the user pointed at their work account. An account cezar refuses
+    // to spawn (`AgentAccountUnavailableError`) plans nothing and takes the fallback below, for the
+    // same reason.
+    const account = await resolveProfileEnvForRoot(repoRoot, config.defaultRunner, undefined, process.env, home).catch(() => null);
+    const profileEnv = account?.env ?? {};
+    // One retry on an unparseable answer; a runner error goes straight to fallback.
+    for (let attempt = 0; account !== null && attempt < 2; attempt++) {
+        let text;
+        try {
+            const result = await runner.run({
+                systemPrompt: PLANNER_SYSTEM_PROMPT,
+                userPrompt,
+                cwd: repoRoot,
+                toolGrant: { kind: 'explicit', tools: [] },
+                ...(Object.keys(profileEnv).length > 0 ? { env: profileEnv } : {}),
+                model: plannerModel,
+                timeoutMs: PLANNER_TIMEOUT_MS,
+            });
+            text = result.text;
+        }
+        catch {
+            break;
+        }
+        const parsed = parseStructured(text, plannerResponseSchema);
+        if (!parsed)
+            continue;
+        const steps = sanitizeSteps(parsed.steps, skillNames);
+        if (steps.length === 0)
+            break; // everything got rejected — degrade
+        const name = proposeWorkflowName(parsed.title);
+        return { ...(name ? { name } : {}), steps, rationale: parsed.rationale, fallback: false };
+    }
+    return {
+        steps: [{ id: 'task', name: 'Do the task', prompt: '{{task}}' }],
+        rationale: 'planner unavailable — single-step plan',
+        fallback: true,
+    };
+}
+/** The `[cez-planner]` marker lets the CEZ_DRY_RUN mock recognize a planning call. */
+function buildPlannerPrompt(task, skills, verifyCommands) {
+    const catalog = skills.length
+        ? skills.map((s) => `- ${s.name} — ${s.description ?? ''}`).join('\n')
+        : '(no skills available)';
+    const verify = verifyCommands.length
+        ? verifyCommands.map((c) => `- ${c}`).join('\n')
+        : '(none detected)';
+    return [
+        '[cez-planner] Plan a chain of steps for this task.',
+        '',
+        'Task:',
+        task,
+        '',
+        'Skill catalog (name — description):',
+        catalog,
+        '',
+        'Verification commands detected in this repo:',
+        verify,
+    ].join('\n');
+}
+/**
+ * Detect verification commands the planner may propose as `check` steps:
+ * `package.json` scripts (test/lint/build) and Makefile targets (first 50
+ * lines). Best effort — an unreadable file just contributes nothing.
+ */
+async function detectVerifyCommands(repoRoot) {
+    const out = [];
+    const pkgSchema = z.object({ scripts: z.record(z.string(), z.string()).default({}) });
+    try {
+        const raw = JSON.parse(await readFile(join(repoRoot, 'package.json'), 'utf8'));
+        const pkg = pkgSchema.safeParse(raw);
+        if (pkg.success) {
+            if (pkg.data.scripts['test'])
+                out.push('npm test');
+            if (pkg.data.scripts['lint'])
+                out.push('npm run lint');
+            if (pkg.data.scripts['build'])
+                out.push('npm run build');
+        }
+    }
+    catch {
+        // no package.json — fine
+    }
+    try {
+        const make = await readFile(join(repoRoot, 'Makefile'), 'utf8');
+        for (const line of make.split('\n').slice(0, 50)) {
+            const m = /^([A-Za-z0-9_.-]+):(?!=)/.exec(line);
+            if (m && m[1] && !m[1].startsWith('.'))
+                out.push(`make ${m[1]}`);
+            if (out.length >= 8)
+                break;
+        }
+    }
+    catch {
+        // no Makefile — fine
+    }
+    return out;
+}
+/**
+ * Turn the model's raw steps into valid `WorkflowStepDef`s: exactly one of
+ * prompt/command, unknown skills stripped (the prompt still carries the step),
+ * ids derived from names with `-2`-style dedup. Steps that can't be repaired
+ * are dropped — the caller falls back when nothing survives.
+ */
+function sanitizeSteps(raw, skillNames) {
+    const out = [];
+    const usedIds = new Set();
+    for (const s of raw) {
+        let skill = s.skill?.trim() || undefined;
+        const prompt = s.prompt?.trim() || undefined;
+        const command = s.command?.trim() || undefined;
+        if (Boolean(prompt) === Boolean(command))
+            continue; // needs exactly one
+        if (command)
+            skill = undefined; // a shell check carries no skill
+        if (skill && !skillNames.has(skill))
+            skill = undefined; // unknown skill → plain prompt
+        const id = uniqueId(slugify(s.name) || 'step', usedIds);
+        const candidate = workflowStepSchema.safeParse({
+            id,
+            name: s.name,
+            ...(skill ? { skill } : {}),
+            ...(prompt ? { prompt } : {}),
+            ...(command ? { command } : {}),
+        });
+        if (!candidate.success)
+            continue;
+        usedIds.add(id);
+        out.push(candidate.data);
+    }
+    return out;
+}
+export function slugify(name) {
+    return name
+        .toLowerCase()
+        .replace(/[^a-z0-9]+/g, '-')
+        .replace(/^-+|-+$/g, '');
+}
+/**
+ * The proposed workflow title, normalized to the same kebab-case slug the builder saves as a
+ * file name — so what the auto chain creator pre-fills is already a valid workflow name. A blank
+ * or slug-less title (e.g. all punctuation) answers undefined, and the caller keeps the current
+ * name instead of blanking it.
+ */
+export function proposeWorkflowName(raw) {
+    const slug = slugify((raw ?? '').trim());
+    return slug || undefined;
+}
+function uniqueId(base, used) {
+    if (!used.has(base))
+        return base;
+    for (let n = 2;; n++) {
+        const id = `${base}-${n}`;
+        if (!used.has(id))
+            return id;
+    }
+}
+/**
+ * Best-effort structured-output extraction (trimmed from @cezar/core's
+ * `parseStructured`): try the whole string after stripping a ```json fence,
+ * then scan for balanced top-level `{...}` blocks and return the first that
+ * validates. Null when nothing does — the caller decides how to recover.
+ */
+export function parseStructured(raw, schema) {
+    const cleaned = raw
+        .replace(/^```(?:json|javascript|js|jsonl)?\s*\n?/im, '')
+        .replace(/\n?```\s*$/m, '')
+        .trim();
+    try {
+        return schema.parse(JSON.parse(cleaned));
+    }
+    catch {
+        for (const candidate of extractJsonObjectCandidates(raw)) {
+            try {
+                return schema.parse(JSON.parse(candidate));
+            }
+            catch {
+                continue;
+            }
+        }
+        return null;
+    }
+}
+function extractJsonObjectCandidates(raw) {
+    const candidates = [];
+    let start = -1;
+    let depth = 0;
+    let inString = false;
+    let escaped = false;
+    for (let i = 0; i < raw.length; i++) {
+        const ch = raw[i];
+        if (inString) {
+            if (escaped)
+                escaped = false;
+            else if (ch === '\\')
+                escaped = true;
+            else if (ch === '"')
+                inString = false;
+            continue;
+        }
+        if (ch === '"') {
+            inString = true;
+        }
+        else if (ch === '{') {
+            if (depth === 0)
+                start = i;
+            depth++;
+        }
+        else if (ch === '}') {
+            if (depth === 0)
+                continue;
+            depth--;
+            if (depth === 0 && start >= 0) {
+                candidates.push(raw.slice(start, i + 1));
+                start = -1;
+            }
+        }
+    }
+    return candidates;
+}
+//# sourceMappingURL=planner.js.map

package/dist/planner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"planner.js","sourceRoot":"","sources":["../src/planner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAC5C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,cAAc,EAAc,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,wBAAwB,EAAE,MAAM,+BAA+B,CAAC;AACzE,OAAO,EAAE,kBAAkB,EAAwB,MAAM,sBAAsB,CAAC;AAEhF;;;;;;GAMG;AAEH,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAElC,MAAM,qBAAqB,GACzB,gGAAgG;IAChG,oHAAoH;IACpH,mGAAmG;IACnG,kGAAkG;IAClG,kGAAkG;IAClG,wDAAwD,CAAC;AAE3D,MAAM,qBAAqB,GAAG,CAAC,CAAC,MAAM,CAAC;IACrC,oGAAoG;IACpG,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;IAC5B,KAAK,EAAE,CAAC;SACL,KAAK,CACJ,CAAC,CAAC,MAAM,CAAC;QACP,KAAK,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC5B,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC;QACvB,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;QAC7B,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE;KAC/B,CAAC,CACH;SACA,GAAG,CAAC,CAAC,CAAC;SACN,GAAG,CAAC,CAAC,CAAC;IACT,SAAS,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,OAAO,CAAC,EAAE,CAAC;CAClC,CAAC,CAAC;AAYH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,QAAgB,EAAE,IAAY,EAAE,OAAO,GAAqB,EAAE,EAAE,IAAU,EAAE,YAA2B;IACrI,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,cAAc,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC;QACzD,cAAc,CAAC,QAAQ,EAAE,EAAE,OAAO,EAAE,EAAE,IAAI,CAAC;QAC3C,UAAU,CAAC,QAAQ,EAAE,IAAI,CAAC;QAC1B,oBAAoB,CAAC,QAAQ,CAAC;KAC/B,CAAC,CAAC;IACH,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC;IACtD,MAAM,UAAU,GAAG,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC;IAEpE,0EAA0E;IAC1E,0EAA0E;IAC1E,iDAAiD;IACjD,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC;IAClD,MAAM,YAAY,GAAG,MAAM,CAAC,aAAa,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC;IACzF,sEAAsE;IACtE,uFAAuF;IACvF,8FAA8F;IAC9F,gGAAgG;IAChG,eAAe;IACf,MAAM,OAAO,GAAG,MAAM,wBAAwB,CAAC,QAAQ,EAAE,MAAM,CAAC,aAAa,EAAE,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAC;IAC/H,MAAM,UAAU,GAAG,OAAO,EAAE,GAAG,IAAI,EAAE,CAAC;IACtC,gFAAgF;IAChF,KAAK,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE,OAAO,EAAE,EAAE,CAAC;QACjE,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,GAAG,CAAC;gBAC9B,YAAY,EAAE,qBAAqB;gBACnC,UAAU;gBACV,GAAG,EAAE,QAAQ;gBACb,SAAS,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,KAAK,EAAE,EAAE,EAAE;gBAC1C,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBAClE,KAAK,EAAE,YAAY;gBACnB,SAAS,EAAE,kBAAkB;aAC9B,CAAC,CAAC;YACH,IAAI,GAAG,MAAM,CAAC,IAAI,CAAC;QACrB,CAAC;QAAC,MAAM,CAAC;YACP,MAAM;QACR,CAAC;QACD,MAAM,MAAM,GAAG,eAAe,CAAC,IAAI,EAAE,qBAAqB,CAAC,CAAC;QAC5D,IAAI,CAAC,MAAM;YAAE,SAAS;QACtB,MAAM,KAAK,GAAG,aAAa,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC,CAAC;QACtD,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC;YAAE,MAAM,CAAC,oCAAoC;QACnE,MAAM,IAAI,GAAG,mBAAmB,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/C,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC;IAC5F,CAAC;IAED,OAAO;QACL,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,MAAM,EAAE,IAAI,EAAE,aAAa,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;QAChE,SAAS,EAAE,wCAAwC;QACnD,QAAQ,EAAE,IAAI;KACf,CAAC;AACJ,CAAC;AAED,sFAAsF;AACtF,SAAS,kBAAkB,CAAC,IAAY,EAAE,MAAe,EAAE,cAAwB;IACjF,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM;QAC3B,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QACtE,CAAC,CAAC,uBAAuB,CAAC;IAC5B,MAAM,MAAM,GAAG,cAAc,CAAC,MAAM;QAClC,CAAC,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;QAChD,CAAC,CAAC,iBAAiB,CAAC;IACtB,OAAO;QACL,oDAAoD;QACpD,EAAE;QACF,OAAO;QACP,IAAI;QACJ,EAAE;QACF,qCAAqC;QACrC,OAAO;QACP,EAAE;QACF,8CAA8C;QAC9C,MAAM;KACP,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAAC,QAAgB;IAClD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,MAAM,SAAS,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,OAAO,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC;IACtF,IAAI,CAAC;QACH,MAAM,GAAG,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,cAAc,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACxF,MAAM,GAAG,GAAG,SAAS,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACrC,IAAI,GAAG,CAAC,OAAO,EAAE,CAAC;YAChB,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;YACnD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;YACvD,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,eAAe,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,yBAAyB;IAC3B,CAAC;IACD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,UAAU,CAAC,EAAE,MAAM,CAAC,CAAC;QAChE,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC;YACjD,MAAM,CAAC,GAAG,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YAChD,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC;gBAAE,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YACjE,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC;gBAAE,MAAM;QAC7B,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,qBAAqB;IACvB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CACpB,GAAmH,EACnH,UAAuB;IAEvB,MAAM,GAAG,GAAsB,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,IAAI,GAAG,EAAU,CAAC;IAClC,KAAK,MAAM,CAAC,IAAI,GAAG,EAAE,CAAC;QACpB,IAAI,KAAK,GAAG,CAAC,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QACzC,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAC7C,MAAM,OAAO,GAAG,CAAC,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,SAAS,CAAC;QAC/C,IAAI,OAAO,CAAC,MAAM,CAAC,KAAK,OAAO,CAAC,OAAO,CAAC;YAAE,SAAS,CAAC,oBAAoB;QACxE,IAAI,OAAO;YAAE,KAAK,GAAG,SAAS,CAAC,CAAC,iCAAiC;QACjE,IAAI,KAAK,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,KAAK,GAAG,SAAS,CAAC,CAAC,+BAA+B;QACvF,MAAM,EAAE,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,MAAM,EAAE,OAAO,CAAC,CAAC;QACxD,MAAM,SAAS,GAAG,kBAAkB,CAAC,SAAS,CAAC;YAC7C,EAAE;YACF,IAAI,EAAE,CAAC,CAAC,IAAI;YACZ,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC3B,GAAG,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7B,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAChC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,OAAO;YAAE,SAAS;QACjC,OAAO,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QAChB,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;IAC3B,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,MAAM,UAAU,OAAO,CAAC,IAAY;IAClC,OAAO,IAAI;SACR,WAAW,EAAE;SACb,OAAO,CAAC,aAAa,EAAE,GAAG,CAAC;SAC3B,OAAO,CAAC,UAAU,EAAE,EAAE,CAAC,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,GAAuB;IACzD,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,GAAG,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC;IACzC,OAAO,IAAI,IAAI,SAAS,CAAC;AAC3B,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY,EAAE,IAAiB;IAC/C,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACjC,KAAK,IAAI,CAAC,GAAG,CAAC,GAAI,CAAC,EAAE,EAAE,CAAC;QACtB,MAAM,EAAE,GAAG,GAAG,IAAI,IAAI,CAAC,EAAE,CAAC;QAC1B,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YAAE,OAAO,EAAE,CAAC;IAC/B,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAAI,GAAW,EAAE,MAA6B;IAC3E,MAAM,OAAO,GAAG,GAAG;SAChB,OAAO,CAAC,2CAA2C,EAAE,EAAE,CAAC;SACxD,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC;SAC1B,IAAI,EAAE,CAAC;IACV,IAAI,CAAC;QACH,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,MAAM,SAAS,IAAI,2BAA2B,CAAC,GAAG,CAAC,EAAE,CAAC;YACzD,IAAI,CAAC;gBACH,OAAO,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC,CAAC;YAC7C,CAAC;YAAC,MAAM,CAAC;gBACP,SAAS;YACX,CAAC;QACH,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,2BAA2B,CAAC,GAAW;IAC9C,MAAM,UAAU,GAAa,EAAE,CAAC;IAChC,IAAI,KAAK,GAAG,CAAC,CAAC,CAAC;IACf,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,GAAG,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,MAAM,EAAE,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;QAClB,IAAI,QAAQ,EAAE,CAAC;YACb,IAAI,OAAO;gBAAE,OAAO,GAAG,KAAK,CAAC;iBACxB,IAAI,EAAE,KAAK,IAAI;gBAAE,OAAO,GAAG,IAAI,CAAC;iBAChC,IAAI,EAAE,KAAK,GAAG;gBAAE,QAAQ,GAAG,KAAK,CAAC;YACtC,SAAS;QACX,CAAC;QACD,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACf,QAAQ,GAAG,IAAI,CAAC;QAClB,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,KAAK,KAAK,CAAC;gBAAE,KAAK,GAAG,CAAC,CAAC;YAC3B,KAAK,EAAE,CAAC;QACV,CAAC;aAAM,IAAI,EAAE,KAAK,GAAG,EAAE,CAAC;YACtB,IAAI,KAAK,KAAK,CAAC;gBAAE,SAAS;YAC1B,KAAK,EAAE,CAAC;YACR,IAAI,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,EAAE,CAAC;gBAC9B,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;gBACzC,KAAK,GAAG,CAAC,CAAC,CAAC;YACb,CAAC;QACH,CAAC;IACH,CAAC;IACD,OAAO,UAAU,CAAC;AACpB,CAAC"}