@ia-qa/self-healing 1.18.0 → 1.19.1

package/dist/secretStore.d.ts

@@ -0,0 +1,49 @@
+/**
+ * The OS credential store, as a third `source` for a secret reference.
+ *
+ * **What this buys, precisely.** `source: "env"` protects three real things — the value never
+ * reaches a committed file, a transcript, or a tool argument. It does not protect the
+ * *process*: once a human exports the key, everything an agent launches inherits it, which is
+ * how `dotenv-cli -- ia-qa-discover-ai plan` works at all. Measured on a real shell: a spawned
+ * process read the whole 164-character key out of `process.env`.
+ *
+ * With `source: "keychain"` the value stops being **ambient**. Only this tool asks the OS for
+ * it, at the moment it needs it, and nothing else in the session inherits it.
+ *
+ * **What it does not buy, and must never be sold as.** It is not a barrier against an agent
+ * that decides to read the key: an agent can run the same OS command. What changes is that
+ * obtaining the value becomes an explicit, visible act in the transcript rather than an
+ * ambient inheritance — something a human reviewing the session can see, and something the
+ * skill files forbid by name. Anyone describing this as "the agent cannot read the key" is
+ * describing a different feature.
+ *
+ * **No home-made vault.** Where the OS has no store this refuses and names `env`, rather than
+ * inventing an encrypted file and calling it a keychain. A vault this package wrote would be
+ * a vault this package would have to defend.
+ */
+/** Everything lands under one service name, so `list` and `rm` need no bookkeeping per key. */
+export declare const SERVICE = "ia-qa";
+export type StoreKind = 'macos' | 'windows' | 'linux' | 'unsupported';
+export declare function storeKind(platform?: NodeJS.Platform): StoreKind;
+/** Where the names live. Names only — a value is never written here. */
+export declare function indexPath(home?: string): string;
+export type StoreResult = {
+    ok: true;
+    value?: string;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function writeSecret(name: string, value: string, home?: string): StoreResult;
+export declare function readSecret(name: string, home?: string): StoreResult;
+export declare function removeSecret(name: string, home?: string): StoreResult;
+/**
+ * The names this tool has stored, and only the names.
+ *
+ * Kept in a file of our own rather than asked of the OS: the three stores list their contents
+ * three different ways, and one of them (`security dump-keychain`) prompts the user. A names
+ * index is the same everywhere and holds nothing worth protecting.
+ */
+export declare function listSecrets(home?: string): string[];
+/** One line for a human deciding whether this machine can do it at all. */
+export declare function storeDescription(kind?: StoreKind): string;

package/dist/secretStore.js

@@ -0,0 +1,244 @@
+"use strict";
+var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    var desc = Object.getOwnPropertyDescriptor(m, k);
+    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
+      desc = { enumerable: true, get: function() { return m[k]; } };
+    }
+    Object.defineProperty(o, k2, desc);
+}) : (function(o, m, k, k2) {
+    if (k2 === undefined) k2 = k;
+    o[k2] = m[k];
+}));
+var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
+    Object.defineProperty(o, "default", { enumerable: true, value: v });
+}) : function(o, v) {
+    o["default"] = v;
+});
+var __importStar = (this && this.__importStar) || (function () {
+    var ownKeys = function(o) {
+        ownKeys = Object.getOwnPropertyNames || function (o) {
+            var ar = [];
+            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
+            return ar;
+        };
+        return ownKeys(o);
+    };
+    return function (mod) {
+        if (mod && mod.__esModule) return mod;
+        var result = {};
+        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
+        __setModuleDefault(result, mod);
+        return result;
+    };
+})();
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.SERVICE = void 0;
+exports.storeKind = storeKind;
+exports.indexPath = indexPath;
+exports.writeSecret = writeSecret;
+exports.readSecret = readSecret;
+exports.removeSecret = removeSecret;
+exports.listSecrets = listSecrets;
+exports.storeDescription = storeDescription;
+const child_process_1 = require("child_process");
+const fs = __importStar(require("fs"));
+const os = __importStar(require("os"));
+const path = __importStar(require("path"));
+/**
+ * The OS credential store, as a third `source` for a secret reference.
+ *
+ * **What this buys, precisely.** `source: "env"` protects three real things — the value never
+ * reaches a committed file, a transcript, or a tool argument. It does not protect the
+ * *process*: once a human exports the key, everything an agent launches inherits it, which is
+ * how `dotenv-cli -- ia-qa-discover-ai plan` works at all. Measured on a real shell: a spawned
+ * process read the whole 164-character key out of `process.env`.
+ *
+ * With `source: "keychain"` the value stops being **ambient**. Only this tool asks the OS for
+ * it, at the moment it needs it, and nothing else in the session inherits it.
+ *
+ * **What it does not buy, and must never be sold as.** It is not a barrier against an agent
+ * that decides to read the key: an agent can run the same OS command. What changes is that
+ * obtaining the value becomes an explicit, visible act in the transcript rather than an
+ * ambient inheritance — something a human reviewing the session can see, and something the
+ * skill files forbid by name. Anyone describing this as "the agent cannot read the key" is
+ * describing a different feature.
+ *
+ * **No home-made vault.** Where the OS has no store this refuses and names `env`, rather than
+ * inventing an encrypted file and calling it a keychain. A vault this package wrote would be
+ * a vault this package would have to defend.
+ */
+/** Everything lands under one service name, so `list` and `rm` need no bookkeeping per key. */
+exports.SERVICE = 'ia-qa';
+function storeKind(platform = process.platform) {
+    if (platform === 'darwin')
+        return 'macos';
+    if (platform === 'win32')
+        return 'windows';
+    if (platform === 'linux')
+        return 'linux';
+    return 'unsupported';
+}
+/** Where the names live. Names only — a value is never written here. */
+function indexPath(home = os.homedir()) {
+    return path.join(home, '.ia-qa', 'secrets.json');
+}
+/** Windows keeps one DPAPI blob per name: encrypted for this user account, on this machine. */
+function blobPath(name, home = os.homedir()) {
+    return path.join(home, '.ia-qa', 'secrets', `${encodeURIComponent(name)}.dpapi`);
+}
+const UNSUPPORTED = (kind) => kind === 'linux'
+    ? 'No OS credential store here: `secret-tool` (libsecret) is not installed. Install it, or use ' +
+        '{ "source": "env", "key": "…" } and export the value in your shell.'
+    : `No OS credential store on this platform (${process.platform}). Use ` +
+        '{ "source": "env", "key": "…" } and export the value in your shell.';
+function sh(cmd, args, input, env) {
+    const r = (0, child_process_1.spawnSync)(cmd, args, {
+        encoding: 'utf8',
+        input: input ?? '',
+        windowsHide: true,
+        ...(env ? { env: { ...process.env, ...env } } : {}),
+    });
+    return { code: r.status ?? 1, out: `${r.stdout ?? ''}${r.stderr ?? ''}` };
+}
+const hasBinary = (cmd) => sh(process.platform === 'win32' ? 'where' : 'which', [cmd]).code === 0;
+/**
+ * PowerShell reads the value from **stdin**, never from a command line.
+ *
+ * An argument is visible in the process list and in the shell history for as long as the
+ * process lives. This is the one place in the package where a plaintext secret exists in
+ * memory at all, so it does not also get a second home.
+ */
+// The path travels in an environment variable, not in `$args`: `powershell -Command "<script>"
+// followed by more words does NOT bind them to `$args`, which produced a null `Split-Path`
+// argument on the first real run. An env var also sidesteps a whole class of quoting bugs on
+// a path with a space in it — and a path is not a secret.
+const PS_WRITE = `$ErrorActionPreference='Stop';$v=[Console]::In.ReadToEnd().TrimEnd("\`r","\`n");` +
+    `$p=$env:IAQA_BLOB;$dir=Split-Path -Parent $p;if(-not(Test-Path $dir)){New-Item -ItemType Directory -Path $dir -Force|Out-Null};` +
+    `ConvertTo-SecureString -String $v -AsPlainText -Force|ConvertFrom-SecureString|Set-Content -Path $p -Encoding ascii`;
+// `.Trim()` is load-bearing: `Set-Content` writes a trailing newline, `-Raw` keeps it, and
+// `ConvertTo-SecureString` rejects the result with "the input string format is incorrect".
+// Found on the first real write/read round-trip, not by reading the code.
+const PS_READ = `$ErrorActionPreference='Stop';$s=(Get-Content -Path $env:IAQA_BLOB -Raw).Trim()|ConvertTo-SecureString;` +
+    `$b=[Runtime.InteropServices.Marshal]::SecureStringToBSTR($s);` +
+    `[Console]::Out.Write([Runtime.InteropServices.Marshal]::PtrToStringAuto($b));` +
+    `[Runtime.InteropServices.Marshal]::ZeroFreeBSTR($b)`;
+function writeSecret(name, value, home = os.homedir()) {
+    const kind = storeKind();
+    if (kind === 'macos') {
+        // The value goes on the command line here — `security` takes it no other way. It is
+        // visible to `ps` for this user for the instant the process lives. Said out loud rather
+        // than left for someone to discover.
+        const r = sh('security', ['add-generic-password', '-U', '-s', exports.SERVICE, '-a', name, '-w', value]);
+        if (r.code !== 0)
+            return { ok: false, reason: `macOS keychain refused it: ${r.out.trim() || `exit ${r.code}`}` };
+    }
+    else if (kind === 'windows') {
+        const r = sh('powershell', ['-NoProfile', '-NonInteractive', '-Command', PS_WRITE], value, { IAQA_BLOB: blobPath(name, home) });
+        if (r.code !== 0)
+            return { ok: false, reason: `Windows DPAPI refused it: ${r.out.trim() || `exit ${r.code}`}` };
+    }
+    else if (kind === 'linux') {
+        if (!hasBinary('secret-tool'))
+            return { ok: false, reason: UNSUPPORTED('linux') };
+        const r = sh('secret-tool', ['store', '--label', `${exports.SERVICE} ${name}`, 'service', exports.SERVICE, 'account', name], value);
+        if (r.code !== 0)
+            return { ok: false, reason: `secret-tool refused it: ${r.out.trim() || `exit ${r.code}`}` };
+    }
+    else {
+        return { ok: false, reason: UNSUPPORTED(kind) };
+    }
+    rememberName(name, home);
+    return { ok: true };
+}
+function readSecret(name, home = os.homedir()) {
+    const kind = storeKind();
+    if (kind === 'macos') {
+        const r = sh('security', ['find-generic-password', '-s', exports.SERVICE, '-a', name, '-w']);
+        if (r.code !== 0)
+            return { ok: false, reason: `not in the macOS keychain under ${exports.SERVICE}/${name}` };
+        return { ok: true, value: r.out.replace(/\r?\n$/, '') };
+    }
+    if (kind === 'windows') {
+        const file = blobPath(name, home);
+        if (!fs.existsSync(file))
+            return { ok: false, reason: `not stored here (${file} does not exist)` };
+        const r = sh('powershell', ['-NoProfile', '-NonInteractive', '-Command', PS_READ], '', { IAQA_BLOB: file });
+        if (r.code !== 0) {
+            // The likely cause is named, and what actually happened is shown. An error message
+            // that asserts a cause it did not verify is the thing this package spends its design
+            // refusing — the first draft of this branch blamed cross-account DPAPI for what was a
+            // trailing newline.
+            return {
+                ok: false,
+                reason: `stored, but it could not be decrypted here. A DPAPI blob is bound to the Windows user ` +
+                    `AND the machine that wrote it, so copying .ia-qa/secrets between machines or accounts ` +
+                    `does not work — set it again on this one. What the store said: ${r.out.trim().split('\n')[0] || `exit ${r.code}`}`,
+            };
+        }
+        return { ok: true, value: r.out };
+    }
+    if (kind === 'linux') {
+        if (!hasBinary('secret-tool'))
+            return { ok: false, reason: UNSUPPORTED('linux') };
+        const r = sh('secret-tool', ['lookup', 'service', exports.SERVICE, 'account', name]);
+        if (r.code !== 0 || !r.out)
+            return { ok: false, reason: `not in the keyring under ${exports.SERVICE}/${name}` };
+        return { ok: true, value: r.out.replace(/\r?\n$/, '') };
+    }
+    return { ok: false, reason: UNSUPPORTED(kind) };
+}
+function removeSecret(name, home = os.homedir()) {
+    const kind = storeKind();
+    if (kind === 'macos')
+        sh('security', ['delete-generic-password', '-s', exports.SERVICE, '-a', name]);
+    else if (kind === 'windows')
+        fs.rmSync(blobPath(name, home), { force: true });
+    else if (kind === 'linux')
+        sh('secret-tool', ['clear', 'service', exports.SERVICE, 'account', name]);
+    else
+        return { ok: false, reason: UNSUPPORTED(kind) };
+    forgetName(name, home);
+    return { ok: true };
+}
+/**
+ * The names this tool has stored, and only the names.
+ *
+ * Kept in a file of our own rather than asked of the OS: the three stores list their contents
+ * three different ways, and one of them (`security dump-keychain`) prompts the user. A names
+ * index is the same everywhere and holds nothing worth protecting.
+ */
+function listSecrets(home = os.homedir()) {
+    try {
+        const parsed = JSON.parse(fs.readFileSync(indexPath(home), 'utf8'));
+        return Array.isArray(parsed) ? parsed.filter((n) => typeof n === 'string').sort() : [];
+    }
+    catch {
+        return [];
+    }
+}
+function saveNames(names, home) {
+    const file = indexPath(home);
+    fs.mkdirSync(path.dirname(file), { recursive: true });
+    fs.writeFileSync(file, `${JSON.stringify([...new Set(names)].sort(), null, 2)}\n`, 'utf8');
+}
+function rememberName(name, home) {
+    saveNames([...listSecrets(home), name], home);
+}
+function forgetName(name, home) {
+    saveNames(listSecrets(home).filter((n) => n !== name), home);
+}
+/** One line for a human deciding whether this machine can do it at all. */
+function storeDescription(kind = storeKind()) {
+    switch (kind) {
+        case 'macos':
+            return 'the macOS keychain (`security`)';
+        case 'windows':
+            return 'Windows DPAPI — encrypted for this user account, on this machine';
+        case 'linux':
+            return hasBinary('secret-tool') ? 'the desktop keyring (`secret-tool`)' : 'nothing: `secret-tool` (libsecret) is not installed';
+        default:
+            return `nothing: no credential store on ${process.platform}`;
+    }
+}
+//# sourceMappingURL=secretStore.js.map

package/dist/secretStore.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretStore.js","sourceRoot":"","sources":["../src/secretStore.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,8BAKC;AAGD,8BAEC;AAmDD,kCAoBC;AAED,gCAiCC;AAED,oCAQC;AASD,kCAOC;AAiBD,4CAWC;AA5MD,iDAA0C;AAC1C,uCAAyB;AACzB,uCAAyB;AACzB,2CAA6B;AAE7B;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,+FAA+F;AAClF,QAAA,OAAO,GAAG,OAAO,CAAC;AAI/B,SAAgB,SAAS,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACpE,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC;IAC1C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,SAAS,CAAC;IAC3C,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO,OAAO,CAAC;IACzC,OAAO,aAAa,CAAC;AACvB,CAAC;AAED,wEAAwE;AACxE,SAAgB,SAAS,CAAC,OAAe,EAAE,CAAC,OAAO,EAAE;IACnD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,cAAc,CAAC,CAAC;AACnD,CAAC;AAED,+FAA+F;AAC/F,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAe,EAAE,CAAC,OAAO,EAAE;IACzD,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,QAAQ,EAAE,SAAS,EAAE,GAAG,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACnF,CAAC;AAID,MAAM,WAAW,GAAG,CAAC,IAAe,EAAU,EAAE,CAC9C,IAAI,KAAK,OAAO;IACd,CAAC,CAAC,8FAA8F;QAC9F,qEAAqE;IACvE,CAAC,CAAC,4CAA4C,OAAO,CAAC,QAAQ,SAAS;QACrE,qEAAqE,CAAC;AAE5E,SAAS,EAAE,CAAC,GAAW,EAAE,IAAc,EAAE,KAAc,EAAE,GAA4B;IACnF,MAAM,CAAC,GAAG,IAAA,yBAAS,EAAC,GAAG,EAAE,IAAI,EAAE;QAC7B,QAAQ,EAAE,MAAM;QAChB,KAAK,EAAE,KAAK,IAAI,EAAE;QAClB,WAAW,EAAE,IAAI;QACjB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;KACpD,CAAC,CAAC;IACH,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,GAAG,CAAC,CAAC,MAAM,IAAI,EAAE,EAAE,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,SAAS,GAAG,CAAC,GAAW,EAAW,EAAE,CAAC,EAAE,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC;AAEnH;;;;;;GAMG;AACH,+FAA+F;AAC/F,2FAA2F;AAC3F,6FAA6F;AAC7F,0DAA0D;AAC1D,MAAM,QAAQ,GAAG,kFAAkF;IACjG,iIAAiI;IACjI,qHAAqH,CAAC;AAExH,2FAA2F;AAC3F,2FAA2F;AAC3F,0EAA0E;AAC1E,MAAM,OAAO,GAAG,yGAAyG;IACvH,+DAA+D;IAC/D,+EAA+E;IAC/E,qDAAqD,CAAC;AAExD,SAAgB,WAAW,CAAC,IAAY,EAAE,KAAa,EAAE,OAAe,EAAE,CAAC,OAAO,EAAE;IAClF,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,oFAAoF;QACpF,wFAAwF;QACxF,qCAAqC;QACrC,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,sBAAsB,EAAE,IAAI,EAAE,IAAI,EAAE,eAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QACjG,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,8BAA8B,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IACnH,CAAC;SAAM,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,SAAS,EAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;QAChI,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,6BAA6B,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAClH,CAAC;SAAM,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,GAAG,eAAO,IAAI,IAAI,EAAE,EAAE,SAAS,EAAE,eAAO,EAAE,SAAS,EAAE,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;QACpH,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,2BAA2B,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,CAAC;IAChH,CAAC;SAAM,CAAC;QACN,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;IAClD,CAAC;IACD,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,SAAgB,UAAU,CAAC,IAAY,EAAE,OAAe,EAAE,CAAC,OAAO,EAAE;IAClE,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,MAAM,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,CAAC,uBAAuB,EAAE,IAAI,EAAE,eAAO,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACrF,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,mCAAmC,eAAO,IAAI,IAAI,EAAE,EAAE,CAAC;QACrG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QAClC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,IAAI,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,IAAI,kBAAkB,EAAE,CAAC;QACnG,MAAM,CAAC,GAAG,EAAE,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,iBAAiB,EAAE,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5G,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;YACjB,mFAAmF;YACnF,qFAAqF;YACrF,sFAAsF;YACtF,oBAAoB;YACpB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,MAAM,EACJ,wFAAwF;oBACxF,wFAAwF;oBACxF,kEAAkE,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,QAAQ,CAAC,CAAC,IAAI,EAAE,EAAE;aACtH,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,EAAE,CAAC;IACpC,CAAC;IACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;QACrB,IAAI,CAAC,SAAS,CAAC,aAAa,CAAC;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,EAAE,CAAC;QAClF,MAAM,CAAC,GAAG,EAAE,CAAC,aAAa,EAAE,CAAC,QAAQ,EAAE,SAAS,EAAE,eAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;QAC7E,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,4BAA4B,eAAO,IAAI,IAAI,EAAE,EAAE,CAAC;QACxG,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,CAAC;IAC1D,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;AAClD,CAAC;AAED,SAAgB,YAAY,CAAC,IAAY,EAAE,OAAe,EAAE,CAAC,OAAO,EAAE;IACpE,MAAM,IAAI,GAAG,SAAS,EAAE,CAAC;IACzB,IAAI,IAAI,KAAK,OAAO;QAAE,EAAE,CAAC,UAAU,EAAE,CAAC,yBAAyB,EAAE,IAAI,EAAE,eAAO,EAAE,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;SACxF,IAAI,IAAI,KAAK,SAAS;QAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;SACzE,IAAI,IAAI,KAAK,OAAO;QAAE,EAAE,CAAC,aAAa,EAAE,CAAC,OAAO,EAAE,SAAS,EAAE,eAAO,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC;;QACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,IAAI,CAAC,EAAE,CAAC;IACrD,UAAU,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACvB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,SAAgB,WAAW,CAAC,OAAe,EAAE,CAAC,OAAO,EAAE;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC,CAAY,CAAC;QAC/E,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;IACtG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS,CAAC,KAAe,EAAE,IAAY;IAC9C,MAAM,IAAI,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAC7B,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACtD,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;AAC7F,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,IAAY;IAC9C,SAAS,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY,EAAE,IAAY;IAC5C,SAAS,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,2EAA2E;AAC3E,SAAgB,gBAAgB,CAAC,OAAkB,SAAS,EAAE;IAC5D,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,OAAO;YACV,OAAO,iCAAiC,CAAC;QAC3C,KAAK,SAAS;YACZ,OAAO,kEAAkE,CAAC;QAC5E,KAAK,OAAO;YACV,OAAO,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,qCAAqC,CAAC,CAAC,CAAC,qDAAqD,CAAC;QAClI;YACE,OAAO,mCAAmC,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjE,CAAC;AACH,CAAC"}

package/dist/sessionCheck.d.ts

@@ -0,0 +1,96 @@
+/**
+ * Why a session is not opening the app — told apart, not listed.
+ *
+ * `assertLanded` names three causes: "expired, rotated, or never covering this domain". All
+ * three are true statements about the world and the message offers no way to choose between
+ * them, so the reader is left to guess — and one of them means "run `login` again" while
+ * another means "your `baseUrl` and your session are about different hosts", which no amount
+ * of logging in will fix. A field report ended with someone writing their own
+ * `check-session.mjs` to answer it.
+ *
+ * **Two of the three are answerable from the file alone**, which is the finding that makes
+ * this verb worth having rather than a second wrapper around a browser:
+ *
+ *  - **expired** — a cookie carries its own `expires`. A file whose session cookies are all
+ *    in the past cannot authenticate anything, and no request has to be made to know it.
+ *  - **wrong-host** — a cookie carries its `domain`. If nothing in the file is scoped to the
+ *    host `baseUrl` points at, the session was taken somewhere else. This is the one a
+ *    person can stare at for an hour: the session works, the app works, and they are not the
+ *    same app. `www.` and an apex fold together, as everywhere else in this package.
+ *  - **rotated** — cookies present, unexpired, correctly scoped, and the app still answers
+ *    with a login. Only the server knows why (a deploy, a secret rotation, a forced logout),
+ *    and only a request can observe it.
+ *
+ * So the offline analysis runs first and the browser is used only for the question it is the
+ * only witness to. Everything here is pure; the I/O lives in `cli/session.ts`.
+ */
+/** Playwright's storageState, as much of it as this file needs. */
+export interface StoredSession {
+    cookies?: Array<{
+        name: string;
+        domain?: string;
+        path?: string;
+        expires?: number;
+    }>;
+    origins?: Array<{
+        origin: string;
+        localStorage?: Array<{
+            name: string;
+            value: string;
+        }>;
+    }>;
+}
+export type SessionCause = 
+/** Every cookie's `expires` is in the past. */
+'expired'
+/** Nothing in the file is scoped to the host `baseUrl` names. */
+ | 'wrong-host'
+/** The file looks usable and the app still shows a login — the server dropped it. */
+ | 'rotated'
+/** A storageState with nothing in it: this app keeps its token where the file cannot reach. */
+ | 'empty'
+/** It opens the app. */
+ | 'holds'
+/** The check could not run — a navigation error is not a verdict about the session. */
+ | 'unknown';
+export interface SessionFacts {
+    cookies: number;
+    origins: number;
+    /** Cookies whose `expires` is in the past, and the soonest one still valid. */
+    expired: number;
+    /** Seconds until the first cookie expires, when any says. Negative: all gone. */
+    expiresInSeconds: number | null;
+    /** Cookie domains, as written in the file. */
+    domains: string[];
+    /** True when at least one cookie or origin is scoped to the app's host. */
+    coversHost: boolean;
+    host: string;
+}
+/** `www.` and an apex are one site, the same fold `discover --sitemap` applies. */
+export declare function foldHost(host: string): string;
+/** A cookie domain (`.example.com`) covers a host when the host ends with it. */
+export declare function domainCovers(domain: string, host: string): boolean;
+export declare function readFacts(state: StoredSession, baseUrl: string, now?: number): SessionFacts;
+export interface SessionVerdict {
+    cause: SessionCause;
+    /** True only when the app was actually opened and did not show a login. */
+    holds: boolean;
+    headline: string;
+    /** What to do, or nothing when it holds — a remedy printed on a good run is noise. */
+    remedy: string[];
+}
+/**
+ * The verdict, from the file's own facts plus — when one was possible — what the app
+ * answered.
+ *
+ * `landed` is undefined when no request was made, which is a legitimate state: the offline
+ * causes are conclusive on their own, and opening a browser to re-confirm an expiry date is
+ * a request nobody needs to make.
+ */
+export declare function judgeSession(facts: SessionFacts, replay?: {
+    landed: string;
+    wall: boolean;
+    error?: string;
+}, loginCommand?: string): SessionVerdict;
+/** "3 days", "4 hours", "12 minutes" — enough precision to act, never a timestamp to parse. */
+export declare function describeAge(seconds: number): string;

package/dist/sessionCheck.js

@@ -0,0 +1,182 @@
+"use strict";
+/**
+ * Why a session is not opening the app — told apart, not listed.
+ *
+ * `assertLanded` names three causes: "expired, rotated, or never covering this domain". All
+ * three are true statements about the world and the message offers no way to choose between
+ * them, so the reader is left to guess — and one of them means "run `login` again" while
+ * another means "your `baseUrl` and your session are about different hosts", which no amount
+ * of logging in will fix. A field report ended with someone writing their own
+ * `check-session.mjs` to answer it.
+ *
+ * **Two of the three are answerable from the file alone**, which is the finding that makes
+ * this verb worth having rather than a second wrapper around a browser:
+ *
+ *  - **expired** — a cookie carries its own `expires`. A file whose session cookies are all
+ *    in the past cannot authenticate anything, and no request has to be made to know it.
+ *  - **wrong-host** — a cookie carries its `domain`. If nothing in the file is scoped to the
+ *    host `baseUrl` points at, the session was taken somewhere else. This is the one a
+ *    person can stare at for an hour: the session works, the app works, and they are not the
+ *    same app. `www.` and an apex fold together, as everywhere else in this package.
+ *  - **rotated** — cookies present, unexpired, correctly scoped, and the app still answers
+ *    with a login. Only the server knows why (a deploy, a secret rotation, a forced logout),
+ *    and only a request can observe it.
+ *
+ * So the offline analysis runs first and the browser is used only for the question it is the
+ * only witness to. Everything here is pure; the I/O lives in `cli/session.ts`.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.foldHost = foldHost;
+exports.domainCovers = domainCovers;
+exports.readFacts = readFacts;
+exports.judgeSession = judgeSession;
+exports.describeAge = describeAge;
+/** `www.` and an apex are one site, the same fold `discover --sitemap` applies. */
+function foldHost(host) {
+    return host.replace(/^www\./i, '').toLowerCase();
+}
+/** A cookie domain (`.example.com`) covers a host when the host ends with it. */
+function domainCovers(domain, host) {
+    const d = foldHost(domain.replace(/^\./, ''));
+    const h = foldHost(host);
+    return h === d || h.endsWith(`.${d}`);
+}
+function readFacts(state, baseUrl, now = Date.now()) {
+    let host = '';
+    try {
+        // `hostname`, never `host`: a cookie is not scoped by port (RFC 6265 ignores it
+        // entirely), so comparing `127.0.0.1` against `127.0.0.1:49331` reports a session on
+        // the right machine as belonging to another application. Caught by the live test on the
+        // first run, and it would have hit every `localhost:3000` in existence — a confidently
+        // wrong diagnosis, in the one verb written to stop those.
+        host = new URL(baseUrl).hostname;
+    }
+    catch {
+        /* an unusable baseUrl is the caller's problem to report */
+    }
+    const cookies = state.cookies ?? [];
+    const origins = state.origins ?? [];
+    // `expires` is seconds since epoch, and -1 means a session cookie: no stated expiry, which
+    // is not the same as expired. Counting those as gone would report a live session as dead.
+    const dated = cookies.filter((c) => typeof c.expires === 'number' && c.expires > 0);
+    const nowSeconds = now / 1000;
+    const expired = dated.filter((c) => c.expires < nowSeconds).length;
+    const future = dated.filter((c) => c.expires >= nowSeconds).map((c) => c.expires);
+    const expiresInSeconds = future.length > 0
+        ? Math.round(Math.min(...future) - nowSeconds)
+        : dated.length > 0
+            ? Math.round(Math.max(...dated.map((c) => c.expires)) - nowSeconds)
+            : null;
+    const domains = [...new Set(cookies.map((c) => c.domain ?? '').filter(Boolean))];
+    const coversHost = host === '' ||
+        domains.some((d) => domainCovers(d, host)) ||
+        origins.some((o) => {
+            try {
+                return foldHost(new URL(o.origin).hostname) === foldHost(host);
+            }
+            catch {
+                return false;
+            }
+        });
+    return { cookies: cookies.length, origins: origins.length, expired, expiresInSeconds, domains, coversHost, host };
+}
+/**
+ * The verdict, from the file's own facts plus — when one was possible — what the app
+ * answered.
+ *
+ * `landed` is undefined when no request was made, which is a legitimate state: the offline
+ * causes are conclusive on their own, and opening a browser to re-confirm an expiry date is
+ * a request nobody needs to make.
+ */
+function judgeSession(facts, replay, loginCommand = 'ia-qa-heal login') {
+    if (facts.cookies === 0 && facts.origins === 0) {
+        return {
+            cause: 'empty',
+            holds: false,
+            headline: 'This session file holds nothing — no cookies, no local storage.',
+            remedy: [
+                'A storageState carries cookies and local storage, and nothing else. An app that keeps',
+                'its token in IndexedDB, in memory or in a service worker leaves nothing for it to hold,',
+                'however logged in the browser was.',
+                `For those, capture during your own suite's run instead: IAQA_CAPTURE=1 with "testCommand".`,
+            ],
+        };
+    }
+    if (facts.cookies > 0 && facts.expired === facts.cookies) {
+        const ago = facts.expiresInSeconds === null ? '' : ` (the last one ${describeAge(-facts.expiresInSeconds)} ago)`;
+        return {
+            cause: 'expired',
+            holds: false,
+            headline: `Every cookie in this session has expired${ago}.`,
+            remedy: [`A person logs in again: ${loginCommand}`, 'Nothing about your app or your config is wrong.'],
+        };
+    }
+    if (!facts.coversHost) {
+        return {
+            cause: 'wrong-host',
+            holds: false,
+            headline: `Nothing in this session is scoped to ${facts.host} — its cookies are for ${facts.domains.length > 0 ? facts.domains.join(', ') : '(no domain stated)'}.`,
+            remedy: [
+                'The session and the baseUrl are about different applications, so logging in again will',
+                'produce the same file. Either point baseUrl at the host this session was taken on, or',
+                `take one on this host: ${loginCommand} --url ${facts.host ? `https://${facts.host}` : '<your app>'}`,
+                '(www. and the apex are treated as one host, so that difference is not the cause here.)',
+            ],
+        };
+    }
+    if (replay?.error) {
+        return {
+            cause: 'unknown',
+            holds: false,
+            headline: `The session looks usable, but the app could not be opened to confirm it: ${replay.error}`,
+            remedy: [
+                'This is not a verdict about the session — nothing was proven either way.',
+                'Check that the app is reachable from this machine, then run this again.',
+            ],
+        };
+    }
+    if (replay && !replay.wall) {
+        return {
+            cause: 'holds',
+            holds: true,
+            headline: `This session opens the app — landed on ${replay.landed}, no login form.`,
+            remedy: [],
+        };
+    }
+    if (replay?.wall) {
+        return {
+            cause: 'rotated',
+            holds: false,
+            headline: `The cookies are valid and scoped to ${facts.host}, but the app still answered with a login (landed on ${replay.landed}).`,
+            remedy: [
+                'The server dropped this session: a deploy, a secret rotation, a forced logout, or a',
+                'second factor it now asks for. Nothing in the file can say which.',
+                `A person logs in again: ${loginCommand}`,
+            ],
+        };
+    }
+    // No replay was attempted and no offline cause fired: the file is plausible, and plausible
+    // is not the same as working. Saying "holds" here is the exact false green this package
+    // exists to refuse.
+    return {
+        cause: 'unknown',
+        holds: false,
+        headline: 'This session file looks usable, but nothing opened the app to prove it.',
+        remedy: ['Run the check without --offline to find out.'],
+    };
+}
+/** "3 days", "4 hours", "12 minutes" — enough precision to act, never a timestamp to parse. */
+function describeAge(seconds) {
+    const s = Math.abs(Math.round(seconds));
+    if (s < 90)
+        return `${s} second${s === 1 ? '' : 's'}`;
+    const m = Math.round(s / 60);
+    if (m < 90)
+        return `${m} minute${m === 1 ? '' : 's'}`;
+    const h = Math.round(m / 60);
+    if (h < 48)
+        return `${h} hour${h === 1 ? '' : 's'}`;
+    const d = Math.round(h / 24);
+    return `${d} day${d === 1 ? '' : 's'}`;
+}
+//# sourceMappingURL=sessionCheck.js.map

package/dist/sessionCheck.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessionCheck.js","sourceRoot":"","sources":["../src/sessionCheck.ts"],"names":[],"mappings":";AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;;AAqCH,4BAEC;AAGD,oCAIC;AAED,8BAyCC;AAmBD,oCAwFC;AAGD,kCASC;AA5KD,mFAAmF;AACnF,SAAgB,QAAQ,CAAC,IAAY;IACnC,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC;AACnD,CAAC;AAED,iFAAiF;AACjF,SAAgB,YAAY,CAAC,MAAc,EAAE,IAAY;IACvD,MAAM,CAAC,GAAG,QAAQ,CAAC,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,CAAC;IAC9C,MAAM,CAAC,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IACzB,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AACxC,CAAC;AAED,SAAgB,SAAS,CAAC,KAAoB,EAAE,OAAe,EAAE,MAAc,IAAI,CAAC,GAAG,EAAE;IACvF,IAAI,IAAI,GAAG,EAAE,CAAC;IACd,IAAI,CAAC;QACH,gFAAgF;QAChF,qFAAqF;QACrF,wFAAwF;QACxF,uFAAuF;QACvF,0DAA0D;QAC1D,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;IACnC,CAAC;IAAC,MAAM,CAAC;QACP,2DAA2D;IAC7D,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IACpC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;IAEpC,2FAA2F;IAC3F,0FAA0F;IAC1F,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,CAAC,OAAO,KAAK,QAAQ,IAAI,CAAC,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC;IACpF,MAAM,UAAU,GAAG,GAAG,GAAG,IAAI,CAAC;IAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAAkB,GAAG,UAAU,CAAC,CAAC,MAAM,CAAC;IAC/E,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAC,CAAC,OAAkB,IAAI,UAAU,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAiB,CAAC,CAAC;IACxG,MAAM,gBAAgB,GACpB,MAAM,CAAC,MAAM,GAAG,CAAC;QACf,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,GAAG,UAAU,CAAC;QAC9C,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAChB,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,OAAiB,CAAC,CAAC,GAAG,UAAU,CAAC;YAC7E,CAAC,CAAC,IAAI,CAAC;IAEb,MAAM,OAAO,GAAG,CAAC,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IACjF,MAAM,UAAU,GACd,IAAI,KAAK,EAAE;QACX,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC;QAC1C,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE;YACjB,IAAI,CAAC;gBACH,OAAO,QAAQ,CAAC,IAAI,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,QAAQ,CAAC,KAAK,QAAQ,CAAC,IAAI,CAAC,CAAC;YACjE,CAAC;YAAC,MAAM,CAAC;gBACP,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC,CAAC,CAAC;IAEL,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;AACpH,CAAC;AAWD;;;;;;;GAOG;AACH,SAAgB,YAAY,CAC1B,KAAmB,EACnB,MAA0D,EAC1D,YAAY,GAAG,kBAAkB;IAEjC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,CAAC,EAAE,CAAC;QAC/C,OAAO;YACL,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,iEAAiE;YAC3E,MAAM,EAAE;gBACN,uFAAuF;gBACvF,yFAAyF;gBACzF,oCAAoC;gBACpC,4FAA4F;aAC7F;SACF,CAAC;IACJ,CAAC;IAED,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,IAAI,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC;QACzD,MAAM,GAAG,GAAG,KAAK,CAAC,gBAAgB,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,kBAAkB,WAAW,CAAC,CAAC,KAAK,CAAC,gBAAgB,CAAC,OAAO,CAAC;QACjH,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,2CAA2C,GAAG,GAAG;YAC3D,MAAM,EAAE,CAAC,2BAA2B,YAAY,EAAE,EAAE,iDAAiD,CAAC;SACvG,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;QACtB,OAAO;YACL,KAAK,EAAE,YAAY;YACnB,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,wCAAwC,KAAK,CAAC,IAAI,0BAC1D,KAAK,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,oBACxD,GAAG;YACH,MAAM,EAAE;gBACN,wFAAwF;gBACxF,uFAAuF;gBACvF,0BAA0B,YAAY,UAAU,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,YAAY,EAAE;gBACrG,wFAAwF;aACzF;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,KAAK,EAAE,CAAC;QAClB,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,4EAA4E,MAAM,CAAC,KAAK,EAAE;YACpG,MAAM,EAAE;gBACN,0EAA0E;gBAC1E,yEAAyE;aAC1E;SACF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3B,OAAO;YACL,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,IAAI;YACX,QAAQ,EAAE,0CAA0C,MAAM,CAAC,MAAM,kBAAkB;YACnF,MAAM,EAAE,EAAE;SACX,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,EAAE,IAAI,EAAE,CAAC;QACjB,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,KAAK,EAAE,KAAK;YACZ,QAAQ,EAAE,uCAAuC,KAAK,CAAC,IAAI,wDAAwD,MAAM,CAAC,MAAM,IAAI;YACpI,MAAM,EAAE;gBACN,qFAAqF;gBACrF,mEAAmE;gBACnE,2BAA2B,YAAY,EAAE;aAC1C;SACF,CAAC;IACJ,CAAC;IAED,2FAA2F;IAC3F,wFAAwF;IACxF,oBAAoB;IACpB,OAAO;QACL,KAAK,EAAE,SAAS;QAChB,KAAK,EAAE,KAAK;QACZ,QAAQ,EAAE,yEAAyE;QACnF,MAAM,EAAE,CAAC,8CAA8C,CAAC;KACzD,CAAC;AACJ,CAAC;AAED,+FAA+F;AAC/F,SAAgB,WAAW,CAAC,OAAe;IACzC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;IACxC,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACtD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACtD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,IAAI,CAAC,GAAG,EAAE;QAAE,OAAO,GAAG,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;IACpD,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC;IAC7B,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;AACzC,CAAC"}