@kindgi/cli 0.1.5 → 0.1.6-rc.0

package/dist/dev/sandbox/seatbelt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"seatbelt.js","sourceRoot":"","sources":["../../../src/dev/sandbox/seatbelt.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,WAAW,CAAC;AAEjD,OAAO,EACL,gBAAgB,EAChB,UAAU,EACV,YAAY,EACZ,SAAS,EACT,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,aAAa,CAAC;AAGrB,wCAAwC;AACxC,SAAS,GAAG,CAAC,IAAY;IACvB,OAAO,IAAI,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,GAAG,CAAC;AACjE,CAAC;AAED,4CAA4C;AAC5C,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,EAAE,GAAG,IAAI,CAAC;IACd,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;IAC9B,OAAO,EAAE,KAAK,IAAI,EAAE,CAAC;QACnB,EAAE,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QACjB,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,MAAqB;IACnD,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC;IACrC,MAAM,KAAK,GAAG,MAAM,CAAC,SAAS,CAAC;IAC/B,MAAM,QAAQ,GAAG;QACf,GAAG,IAAI,GAAG,CAAC;YACT,GAAG,CAAC,GAAG,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,CAAC;YACjF,IAAI,CAAC,GAAG,EAAE,SAAS,CAAC;YACpB,IAAI,CAAC,GAAG,EAAE,SAAS,EAAE,KAAK,CAAC;SAC5B,CAAC;KACH,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,YAAY,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,GAAG;QACnC,YAAY,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC,GAAG;QAC1C,YAAY,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC,GAAG;QAC3C,GAAG;YACD,YAAY,CAAC,GAAG,CAAC;YACjB,kBAAkB,CAAC,GAAG,CAAC;YACvB,sBAAsB,CAAC,GAAG,CAAC;YAC3B,gBAAgB,CAAC,GAAG,CAAC;SACtB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;KACpC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC;IACnE,MAAM,OAAO,GAAG;QACd,iDAAiD;QACjD,GAAG,MAAM,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,iBAAiB,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC;KAClE,CAAC;IACF,OAAO;QACL,2FAA2F;QAC3F,aAAa;QACb,iBAAiB;QACjB,8CAA8C;QAC9C,oBAAoB;QACpB,EAAE;QACF,wDAAwD;QACxD,yCAAyC,GAAG,CAAC,IAAI,CAAC,8DAA8D;QAChH,uEAAuE;QACvE,0CAA0C,GAAG,CAAC,MAAM,CAAC,IAAI;QACzD,2FAA2F;QAC3F,oEAAoE;QACpE,oCAAoC;QACpC,yIAAyI;QACzI,EAAE;QACF,2EAA2E;QAC3E,6BAA6B,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QACpF,4EAA4E;QAC5E,GAAG,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YAClB,CAAC,CAAC,CAAC,qBAAqB,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC;YAC7E,CAAC,CAAC,EAAE,CAAC;QACP,0CAA0C,GAAG,CAAC,GAAG,CAAC,IAAI;QACtD,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC;YACzB,CAAC,CAAC;gBACE,kFAAkF;gBAClF,qBAAqB,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;aACtF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,EAAE;QACF,6CAA6C;QAC7C,8BAA8B;QAC9B,4BAA4B;QAC5B,yFAAyF;QACzF,2BAA2B;QAC3B,+BAA+B;QAC/B,yCAAyC;QACzC,qBAAqB,UAAU,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAC5C,GAAG,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC;YACrB,CAAC,CAAC;gBACE,oCAAoC;gBACpC,iCAAiC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;aACvD;YACH,CAAC,CAAC,EAAE,CAAC;QACP,sFAAsF;QACtF,qBAAqB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QAC1C,EAAE;QACF,iGAAiG;QACjG,8CAA8C;QAC9C,2BAA2B,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,uBAAuB,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QACvF,EAAE;QACF,yEAAyE;QACzE,wBAAwB;QACxB,2KAA2K;QAC3K,iGAAiG;QACjG,kKAAkK;QAClK,EAAE;KACH,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACf,CAAC"}

package/dist/dev/sandbox/settings.d.ts

@@ -0,0 +1,30 @@
+import type { PackConfigRecord } from '../../pack-config.js';
+/** The variable that sets {@link DevSandboxMode}. */
+export declare const DEV_SANDBOX_VAR = "KINDGI_DEV_SANDBOX";
+export type DevSandboxMode = 'on' | 'off' | 'required';
+export interface DevSandboxSettings {
+    readonly mode: DevSandboxMode;
+    /** What set the mode: nothing, `KINDGI_DEV_SANDBOX`, or `dev.sandbox`. */
+    readonly source: 'default' | 'env' | 'config';
+    /** Absolute paths the pack service may also read (`dev.sandbox.allowRead`). */
+    readonly allowRead: readonly string[];
+    /** Absolute paths of UNIX sockets it may also connect to (`dev.sandbox.allowUnixSockets`). */
+    readonly allowUnixSockets: readonly string[];
+}
+export type DevSandboxSettingsOutcome = {
+    readonly kind: 'ok';
+    readonly value: DevSandboxSettings;
+} | {
+    readonly kind: 'invalid';
+    readonly message: string;
+};
+/**
+ * The settings from the environment and the config. `KINDGI_DEV_SANDBOX`
+ * wins over `dev.sandbox` for the mode; the allow lists come from the
+ * config. A path is absolute, `~/…`, or relative to the pack root.
+ */
+export declare function devSandboxSettings(config: PackConfigRecord | undefined, env: Readonly<Record<string, string | undefined>>, paths: {
+    readonly packDir: string;
+    readonly home: string;
+}): DevSandboxSettingsOutcome;
+//# sourceMappingURL=settings.d.ts.map

package/dist/dev/sandbox/settings.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.d.ts","sourceRoot":"","sources":["../../../src/dev/sandbox/settings.ts"],"names":[],"mappings":"AAoBA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AAE7D,qDAAqD;AACrD,eAAO,MAAM,eAAe,uBAAuB,CAAC;AAEpD,MAAM,MAAM,cAAc,GAAG,IAAI,GAAG,KAAK,GAAG,UAAU,CAAC;AAEvD,MAAM,WAAW,kBAAkB;IACjC,QAAQ,CAAC,IAAI,EAAE,cAAc,CAAC;IAC9B,0EAA0E;IAC1E,QAAQ,CAAC,MAAM,EAAE,SAAS,GAAG,KAAK,GAAG,QAAQ,CAAC;IAC9C,+EAA+E;IAC/E,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC,8FAA8F;IAC9F,QAAQ,CAAC,gBAAgB,EAAE,SAAS,MAAM,EAAE,CAAC;CAC9C;AAED,MAAM,MAAM,yBAAyB,GACjC;IAAE,QAAQ,CAAC,IAAI,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,kBAAkB,CAAA;CAAE,GAC3D;IAAE,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAE3D;;;;GAIG;AACH,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,EACjD,KAAK,EAAE;IAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GACzD,yBAAyB,CA4B3B"}

package/dist/dev/sandbox/settings.js

@@ -0,0 +1,97 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * Whether `kindgi dev` runs the pack service sandboxed, and what the
+ * sandbox lets through: `KINDGI_DEV_SANDBOX` and `dev.sandbox` in the
+ * pack's config.
+ *
+ * - `on` (the default): sandboxed where this machine can; where it
+ *   can't, `kindgi dev` warns and runs it without.
+ * - `off`: never (`KINDGI_DEV_SANDBOX=off`, or `dev.sandbox: false`).
+ * - `required`: sandboxed, or the pack service doesn't start.
+ *
+ * `dev.sandbox.allowRead` and `dev.sandbox.allowUnixSockets` open a path
+ * or a socket outside the app, such as `~/.aws` for a tool on the AWS
+ * SDK's credential chain. `kindgi dev` names them at every start.
+ */
+import { isAbsolute, join, resolve } from 'node:path';
+/** The variable that sets {@link DevSandboxMode}. */
+export const DEV_SANDBOX_VAR = 'KINDGI_DEV_SANDBOX';
+/**
+ * The settings from the environment and the config. `KINDGI_DEV_SANDBOX`
+ * wins over `dev.sandbox` for the mode; the allow lists come from the
+ * config. A path is absolute, `~/…`, or relative to the pack root.
+ */
+export function devSandboxSettings(config, env, paths) {
+    const raw = env[DEV_SANDBOX_VAR];
+    if (raw !== undefined && raw !== '' && raw !== 'on' && raw !== 'off' && raw !== 'required') {
+        return {
+            kind: 'invalid',
+            message: `${DEV_SANDBOX_VAR} must be \`on\`, \`off\` or \`required\`, not ${JSON.stringify(raw)}`,
+        };
+    }
+    const dev = config?.dev;
+    const sandbox = dev !== null && typeof dev === 'object' && !Array.isArray(dev)
+        ? dev.sandbox
+        : undefined;
+    const fromConfig = configSandbox(sandbox, paths);
+    if (fromConfig.kind === 'invalid')
+        return fromConfig;
+    const { enabled, allowRead, allowUnixSockets } = fromConfig.value;
+    if (raw !== undefined && raw !== '') {
+        return { kind: 'ok', value: { mode: raw, source: 'env', allowRead, allowUnixSockets } };
+    }
+    return {
+        kind: 'ok',
+        value: {
+            mode: enabled ? 'on' : 'off',
+            source: enabled ? 'default' : 'config',
+            allowRead,
+            allowUnixSockets,
+        },
+    };
+}
+function configSandbox(sandbox, paths) {
+    if (sandbox === undefined || sandbox === true) {
+        return { kind: 'ok', value: { enabled: true, allowRead: [], allowUnixSockets: [] } };
+    }
+    if (sandbox === false) {
+        return { kind: 'ok', value: { enabled: false, allowRead: [], allowUnixSockets: [] } };
+    }
+    const shape = '`dev.sandbox` must be `false`, or an object with `allowRead` and `allowUnixSockets` (lists of paths)';
+    if (sandbox === null || typeof sandbox !== 'object' || Array.isArray(sandbox)) {
+        return { kind: 'invalid', message: shape };
+    }
+    const record = sandbox;
+    const unknownKeys = Object.keys(record).filter((k) => k !== 'allowRead' && k !== 'allowUnixSockets');
+    if (unknownKeys.length > 0) {
+        return {
+            kind: 'invalid',
+            message: `${shape}; not ${unknownKeys.map((k) => `\`${k}\``).join(', ')}`,
+        };
+    }
+    const lists = {
+        allowRead: [],
+        allowUnixSockets: [],
+    };
+    for (const key of ['allowRead', 'allowUnixSockets']) {
+        const list = record[key];
+        if (list === undefined)
+            continue;
+        if (!Array.isArray(list) ||
+            !list.every((p) => typeof p === 'string' && p.trim() !== '')) {
+            return { kind: 'invalid', message: `\`dev.sandbox.${key}\` must be a list of paths` };
+        }
+        lists[key] = list.map((p) => expandPath(p.trim(), paths));
+    }
+    return { kind: 'ok', value: { enabled: true, ...lists } };
+}
+/** `~/x` under home, a relative path under the pack root, an absolute one as is. */
+function expandPath(path, paths) {
+    if (path === '~')
+        return paths.home;
+    if (path.startsWith('~/'))
+        return join(paths.home, path.slice(2));
+    return isAbsolute(path) ? path : resolve(paths.packDir, path);
+}
+//# sourceMappingURL=settings.js.map

package/dist/dev/sandbox/settings.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"settings.js","sourceRoot":"","sources":["../../../src/dev/sandbox/settings.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;GAaG;AAEH,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAItD,qDAAqD;AACrD,MAAM,CAAC,MAAM,eAAe,GAAG,oBAAoB,CAAC;AAkBpD;;;;GAIG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAoC,EACpC,GAAiD,EACjD,KAA0D;IAE1D,MAAM,GAAG,GAAG,GAAG,CAAC,eAAe,CAAC,CAAC;IACjC,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,UAAU,EAAE,CAAC;QAC3F,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,GAAG,eAAe,iDAAiD,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,EAAE;SAClG,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,MAAM,EAAE,GAAG,CAAC;IACxB,MAAM,OAAO,GACX,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAC5D,CAAC,CAAE,GAA+B,CAAC,OAAO;QAC1C,CAAC,CAAC,SAAS,CAAC;IAChB,MAAM,UAAU,GAAG,aAAa,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,UAAU,CAAC;IACrD,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,gBAAgB,EAAE,GAAG,UAAU,CAAC,KAAK,CAAC;IAClE,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,KAAK,EAAE,EAAE,CAAC;QACpC,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,gBAAgB,EAAE,EAAE,CAAC;IAC1F,CAAC;IACD,OAAO;QACL,IAAI,EAAE,IAAI;QACV,KAAK,EAAE;YACL,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK;YAC5B,MAAM,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ;YACtC,SAAS;YACT,gBAAgB;SACjB;KACF,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CACpB,OAAgB,EAChB,KAA0D;IAW1D,IAAI,OAAO,KAAK,SAAS,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QAC9C,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,CAAC;IACvF,CAAC;IACD,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,EAAE,EAAE,gBAAgB,EAAE,EAAE,EAAE,EAAE,CAAC;IACxF,CAAC;IACD,MAAM,KAAK,GACT,sGAAsG,CAAC;IACzG,IAAI,OAAO,KAAK,IAAI,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QAC9E,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAC7C,CAAC;IACD,MAAM,MAAM,GAAG,OAAkC,CAAC;IAClD,MAAM,WAAW,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAC5C,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,KAAK,WAAW,IAAI,CAAC,KAAK,kBAAkB,CACrD,CAAC;IACF,IAAI,WAAW,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3B,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,GAAG,KAAK,SAAS,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE;SAC1E,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAuD;QAChE,SAAS,EAAE,EAAE;QACb,gBAAgB,EAAE,EAAE;KACrB,CAAC;IACF,KAAK,MAAM,GAAG,IAAI,CAAC,WAAW,EAAE,kBAAkB,CAAU,EAAE,CAAC;QAC7D,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QACzB,IAAI,IAAI,KAAK,SAAS;YAAE,SAAS;QACjC,IACE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACpB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EACzE,CAAC;YACD,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,iBAAiB,GAAG,4BAA4B,EAAE,CAAC;QACxF,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAC5D,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,KAAK,EAAE,EAAE,CAAC;AAC5D,CAAC;AAED,oFAAoF;AACpF,SAAS,UAAU,CACjB,IAAY,EACZ,KAA0D;IAE1D,IAAI,IAAI,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IACpC,IAAI,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;IAClE,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;AAChE,CAAC"}

package/dist/env/provider-keys.d.ts

@@ -0,0 +1,35 @@
+import type { KindgiClient, Provider } from '@kindgi/client';
+import type { DeclaredProvider } from '../dev/providers.js';
+import type { ProviderPreset } from '../providers/preset-loader.js';
+/** Every provider of the tenant, all pages. */
+export declare function listAllProviders(client: KindgiClient): Promise<readonly Provider[]>;
+/** The names the runtime's providers resolve their keys from in `local`, through `client`. */
+export declare function providerKeyNamesFromRuntime(client: KindgiClient, presets: Readonly<Record<string, ProviderPreset>>): Promise<Set<string>>;
+/** A provider's key reference, by name. */
+export interface ProviderKeyRef {
+    readonly envName: string;
+    readonly name: string;
+}
+/** The names the declared providers' keys resolve from in `local`. */
+export declare function declaredProviderKeyNames(declared: readonly DeclaredProvider[]): Set<string>;
+export interface RuntimeProviderKeyNamesInput {
+    /** The tenant's providers (every page). */
+    readonly providers: readonly {
+        readonly id: string;
+    }[];
+    /** `GET /v1/providers/:id/check`; a failure counts as "no `secretRef`". */
+    readonly check: (providerId: string) => Promise<{
+        readonly secretRef?: ProviderKeyRef;
+    }>;
+    /** The presets, by name: the fallback for a provider whose check carries no `secretRef`. */
+    readonly presets: Readonly<Record<string, ProviderPreset>>;
+}
+/** The names the runtime's providers resolve their keys from in `local`. */
+export declare function runtimeProviderKeyNames(input: RuntimeProviderKeyNamesInput): Promise<Set<string>>;
+/** Where `kindgi dev` records the names it learned from the runtime. */
+export declare function providerKeysRecordPath(packDir: string): string;
+/** The recorded names; empty when there's no record (or it can't be read). */
+export declare function readProviderKeysRecord(packDir: string): Promise<Set<string>>;
+/** Record the names (sorted, names only); best effort. */
+export declare function writeProviderKeysRecord(packDir: string, names: ReadonlySet<string>): Promise<void>;
+//# sourceMappingURL=provider-keys.d.ts.map

package/dist/env/provider-keys.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-keys.d.ts","sourceRoot":"","sources":["../../src/env/provider-keys.ts"],"names":[],"mappings":"AA4BA,OAAO,KAAK,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE7D,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AAC5D,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AAEpE,+CAA+C;AAC/C,wBAAsB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,OAAO,CAAC,SAAS,QAAQ,EAAE,CAAC,CAYzF;AAED,8FAA8F;AAC9F,wBAAsB,2BAA2B,CAC/C,MAAM,EAAE,YAAY,EACpB,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,GAChD,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAMtB;AAED,2CAA2C;AAC3C,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB;AAED,sEAAsE;AACtE,wBAAgB,wBAAwB,CAAC,QAAQ,EAAE,SAAS,gBAAgB,EAAE,GAAG,GAAG,CAAC,MAAM,CAAC,CAO3F;AAED,MAAM,WAAW,4BAA4B;IAC3C,2CAA2C;IAC3C,QAAQ,CAAC,SAAS,EAAE,SAAS;QAAE,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;IACvD,2EAA2E;IAC3E,QAAQ,CAAC,KAAK,EAAE,CAAC,UAAU,EAAE,MAAM,KAAK,OAAO,CAAC;QAAE,QAAQ,CAAC,SAAS,CAAC,EAAE,cAAc,CAAA;KAAE,CAAC,CAAC;IACzF,4FAA4F;IAC5F,QAAQ,CAAC,OAAO,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;CAC5D;AAED,4EAA4E;AAC5E,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,4BAA4B,GAClC,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAuBtB;AAED,wEAAwE;AACxE,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAE9D;AAED,8EAA8E;AAC9E,wBAAsB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC,CAQlF;AAED,0DAA0D;AAC1D,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,MAAM,EACf,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,GACzB,OAAO,CAAC,IAAI,CAAC,CAUf"}

package/dist/env/provider-keys.js

@@ -0,0 +1,108 @@
+// SPDX-License-Identifier: Apache-2.0
+// Copyright (C) 2026 Kindgi Inc.
+/**
+ * The names model providers resolve their keys from in `local` (the
+ * environment `kindgi dev` runs as). `kindgi dev` keeps them out of the
+ * pack service's environment, whatever file holds them, and `kindgi
+ * secrets copy` copies them from the app's env files into Kindgi's own.
+ *
+ * Three sources, unioned:
+ *
+ *   - the providers `kindgi.config` declares (`providers`): their
+ *     `secret_ref`, known before the runtime starts;
+ *   - the runtime's providers: `GET /v1/providers/:id/check` carries
+ *     each one's `secretRef`, by name only (a runtime from 0.1.6 on);
+ *   - a runtime provider whose check carries none (an older runtime) and
+ *     whose id is a preset's: that preset's key name.
+ *
+ * `kindgi dev` records the last names it learned from the runtime in
+ * `.kindgi/dev/provider-keys.json` (names only), so the pack service it
+ * starts before the runtime answers already leaves them out.
+ */
+import { readFile, writeFile } from 'node:fs/promises';
+import { join } from 'node:path';
+import { LOCAL_ENV_NAME } from '@kindgi/secrets-dotenv';
+/** Every provider of the tenant, all pages. */
+export async function listAllProviders(client) {
+    const providers = [];
+    let cursor;
+    do {
+        const page = await client.providers.list({
+            limit: 100,
+            ...(cursor !== undefined && { cursor }),
+        });
+        providers.push(...page.data);
+        cursor = page.hasMore ? page.nextCursor : undefined;
+    } while (cursor !== undefined);
+    return providers;
+}
+/** The names the runtime's providers resolve their keys from in `local`, through `client`. */
+export async function providerKeyNamesFromRuntime(client, presets) {
+    return runtimeProviderKeyNames({
+        providers: await listAllProviders(client),
+        check: (id) => client.providers.check(id),
+        presets,
+    });
+}
+/** The names the declared providers' keys resolve from in `local`. */
+export function declaredProviderKeyNames(declared) {
+    const names = new Set();
+    for (const p of declared) {
+        const ref = p.input.secret_ref;
+        if (ref !== undefined && ref.envName === LOCAL_ENV_NAME)
+            names.add(ref.name);
+    }
+    return names;
+}
+/** The names the runtime's providers resolve their keys from in `local`. */
+export async function runtimeProviderKeyNames(input) {
+    const presetKeyById = new Map();
+    for (const preset of Object.values(input.presets)) {
+        if (preset.secret !== undefined)
+            presetKeyById.set(preset.metadata.id, preset.secret);
+    }
+    const names = new Set();
+    await Promise.all(input.providers.map(async (p) => {
+        let ref;
+        try {
+            ref = (await input.check(p.id)).secretRef;
+        }
+        catch {
+            ref = undefined;
+        }
+        if (ref !== undefined) {
+            if (ref.envName === LOCAL_ENV_NAME)
+                names.add(ref.name);
+            return;
+        }
+        const preset = presetKeyById.get(p.id);
+        if (preset !== undefined)
+            names.add(preset);
+    }));
+    return names;
+}
+/** Where `kindgi dev` records the names it learned from the runtime. */
+export function providerKeysRecordPath(packDir) {
+    return join(packDir, '.kindgi', 'dev', 'provider-keys.json');
+}
+/** The recorded names; empty when there's no record (or it can't be read). */
+export async function readProviderKeysRecord(packDir) {
+    try {
+        const parsed = JSON.parse(await readFile(providerKeysRecordPath(packDir), 'utf8'));
+        const names = parsed.names;
+        return new Set(Array.isArray(names) ? names.filter((n) => typeof n === 'string') : []);
+    }
+    catch {
+        return new Set();
+    }
+}
+/** Record the names (sorted, names only); best effort. */
+export async function writeProviderKeysRecord(packDir, names) {
+    try {
+        await writeFile(providerKeysRecordPath(packDir), `${JSON.stringify({ names: [...names].sort() }, null, 2)}\n`, { encoding: 'utf8', mode: 0o600 });
+    }
+    catch {
+        // The record only saves the next boot a pack service restart.
+    }
+}
+//# sourceMappingURL=provider-keys.js.map

package/dist/env/provider-keys.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"provider-keys.js","sourceRoot":"","sources":["../../src/env/provider-keys.ts"],"names":[],"mappings":"AAAA,sCAAsC;AACtC,iCAAiC;AAEjC;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,cAAc,EAAE,MAAM,wBAAwB,CAAC;AAOxD,+CAA+C;AAC/C,MAAM,CAAC,KAAK,UAAU,gBAAgB,CAAC,MAAoB;IACzD,MAAM,SAAS,GAAe,EAAE,CAAC;IACjC,IAAI,MAA0B,CAAC;IAC/B,GAAG,CAAC;QACF,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC;YACvC,KAAK,EAAE,GAAG;YACV,GAAG,CAAC,MAAM,KAAK,SAAS,IAAI,EAAE,MAAM,EAAE,CAAC;SACxC,CAAC,CAAC;QACH,SAAS,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,IAAI,CAAC,CAAC;QAC7B,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,CAAC;IACtD,CAAC,QAAQ,MAAM,KAAK,SAAS,EAAE;IAC/B,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,2BAA2B,CAC/C,MAAoB,EACpB,OAAiD;IAEjD,OAAO,uBAAuB,CAAC;QAC7B,SAAS,EAAE,MAAM,gBAAgB,CAAC,MAAM,CAAC;QACzC,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,CAAC;QACzC,OAAO;KACR,CAAC,CAAC;AACL,CAAC;AAQD,sEAAsE;AACtE,MAAM,UAAU,wBAAwB,CAAC,QAAqC;IAC5E,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,KAAK,MAAM,CAAC,IAAI,QAAQ,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,CAAC,CAAC,KAAK,CAAC,UAAU,CAAC;QAC/B,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc;YAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAWD,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAmC;IAEnC,MAAM,aAAa,GAAG,IAAI,GAAG,EAAkB,CAAC;IAChD,KAAK,MAAM,MAAM,IAAI,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;QAClD,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;YAAE,aAAa,CAAC,GAAG,CAAC,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC;IACxF,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,GAAG,EAAU,CAAC;IAChC,MAAM,OAAO,CAAC,GAAG,CACf,KAAK,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE;QAC9B,IAAI,GAA+B,CAAC;QACpC,IAAI,CAAC;YACH,GAAG,GAAG,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAC5C,CAAC;QAAC,MAAM,CAAC;YACP,GAAG,GAAG,SAAS,CAAC;QAClB,CAAC;QACD,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;YACtB,IAAI,GAAG,CAAC,OAAO,KAAK,cAAc;gBAAE,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;YACxD,OAAO;QACT,CAAC;QACD,MAAM,MAAM,GAAG,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACvC,IAAI,MAAM,KAAK,SAAS;YAAE,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC9C,CAAC,CAAC,CACH,CAAC;IACF,OAAO,KAAK,CAAC;AACf,CAAC;AAED,wEAAwE;AACxE,MAAM,UAAU,sBAAsB,CAAC,OAAe;IACpD,OAAO,IAAI,CAAC,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,oBAAoB,CAAC,CAAC;AAC/D,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,KAAK,UAAU,sBAAsB,CAAC,OAAe;IAC1D,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,sBAAsB,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QAC5F,MAAM,KAAK,GAAI,MAA8B,CAAC,KAAK,CAAC;QACpD,OAAO,IAAI,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACzF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,GAAG,EAAE,CAAC;IACnB,CAAC;AACH,CAAC;AAED,0DAA0D;AAC1D,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,OAAe,EACf,KAA0B;IAE1B,IAAI,CAAC;QACH,MAAM,SAAS,CACb,sBAAsB,CAAC,OAAO,CAAC,EAC/B,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,GAAG,KAAK,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAC5D,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAClC,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;AACH,CAAC"}

package/dist/init/agent-access.d.ts

@@ -0,0 +1,119 @@
+import { type PatchResult } from './gitignore-patcher.js';
+/**
+ * The files that hold keys and tokens, relative to the project root: the
+ * app's env files (model keys added by hand, the app's own secrets), Kindgi's
+ * own secrets file, the dev runtime's settings (its token, the database
+ * URL), and a self-hosted deployment's env files.
+ *
+ * Not `.kindgirc.json`: it holds the dev token the agent's own `kindgi`
+ * commands read to reach `kindgi dev`, and with Claude Code's sandbox on, a
+ * `Read` deny rule binds the shell's commands too (measured with Claude Code
+ * 2.1.288), so denying it would break every `kindgi` command the agent runs.
+ * The same list serves a sandbox's `denyRead`.
+ */
+export declare const KEY_FILES: readonly string[];
+/**
+ * Claude Code's permission rules for `KEY_FILES` (they cover Read, Grep and
+ * Glob, and the sandbox when it's on), under `prefix`: the pack's folder
+ * from the repository's root, for the root's settings. A bare `./.env*`
+ * matches at any depth below where the session starts; a path with a folder
+ * in it is anchored there.
+ */
+export declare function claudeReadDenyRules(prefix?: string): readonly string[];
+/**
+ * A folder path as a literal in a gitignore-style pattern, for Claude Code's
+ * rules and other agents' ignore files alike: `\`, `*`, `?`, `[` and `]`
+ * escaped, and a leading `#` or `!` (a comment, a negation in an ignore
+ * file). Unescaped, `apps/[legacy]/agent` is a character class and the rule
+ * misses the folder (measured with Claude Code 2.1.288; escaped, it matches).
+ */
+export declare function globLiteral(path: string): string;
+/**
+ * The git repository's root at or above `dir`: the nearest folder holding a
+ * `.git` (a directory, or a worktree's or submodule's file). No git binary.
+ */
+export declare function gitRootOf(dir: string): Promise<string | undefined>;
+export interface ClaudeSettingsResult {
+    readonly kind: 'created' | 'patched' | 'already-present' | 'error';
+    /** The rules appended to `permissions.deny`. */
+    readonly appended: readonly string[];
+    readonly message?: string;
+}
+/**
+ * Merge `rules` (by default `claudeReadDenyRules()`) into `permissions.deny`
+ * of the settings file at `path`, creating the file when it doesn't exist. A
+ * file that isn't valid JSON, or whose `permissions.deny` isn't a list, is
+ * left as it is, and the message says what to add. A leading byte-order mark
+ * is kept.
+ */
+export declare function patchClaudeSettings(path: string, rules?: readonly string[]): Promise<ClaudeSettingsResult>;
+type OtherAgentFiles = readonly {
+    readonly file: string;
+    readonly result: PatchResult;
+}[];
+export interface AgentAccessResult {
+    /** `.claude/settings.json`. */
+    readonly claude: ClaudeSettingsResult;
+    /** Other agents' ignore files that exist, by file name. */
+    readonly others: OtherAgentFiles;
+    /**
+     * Only when the pack's folder is below its git repository's root: the same
+     * rules under `prefix` (the pack's folder from the root, `/`-separated) in
+     * the root's `.claude/settings.json`, and in other agents' ignore files
+     * that exist there.
+     */
+    readonly repoRoot?: {
+        readonly dir: string;
+        readonly prefix: string;
+        readonly claude: ClaudeSettingsResult;
+        readonly others: OtherAgentFiles;
+    }
+    /**
+     * The repository's root is the home folder (a dotfiles repository):
+     * its `.claude/settings.json` is Claude Code's user-wide settings, so
+     * nothing is written there, and init says so.
+     */
+     | {
+        readonly dir: string;
+        readonly prefix: string;
+        readonly skipped: 'home';
+    };
+}
+export interface PatchAgentAccessOptions {
+    /** The home folder (the CLI's own); by default the process's. */
+    readonly home?: string;
+}
+/** Keep the project's coding agents out of the key files (see the module comment). */
+export declare function patchAgentAccess(projectDir: string, options?: PatchAgentAccessOptions): Promise<AgentAccessResult>;
+export interface AgentAccessRows {
+    readonly created: readonly string[];
+    readonly skipped: readonly string[];
+    readonly warnings: readonly string[];
+    /**
+     * What was written outside the pack's folder (the repository root's
+     * files), one line each, with why: init prints these whatever else it
+     * summarizes.
+     */
+    readonly outside: readonly string[];
+}
+/**
+ * `kindgi init`'s summary rows for `patchAgentAccess`: what was created or
+ * patched, what already had the rules, and warnings (a file left as it was,
+ * with what to add by hand). Never a failure: init goes on either way.
+ */
+export declare function agentAccessRows(projectDir: string, result: AgentAccessResult): AgentAccessRows;
+/**
+ * For a new pack (`kindgi init`, not augment): the files written in the
+ * pack's folder, for init's list, and the lines init prints: what it wrote
+ * outside the folder (`✓`), and warnings (`⚠`: a file left as it was, with
+ * what to add by hand). Never a failure: `--force` over a folder whose
+ * settings file isn't valid JSON scaffolds and says so.
+ */
+export declare function writeAgentAccess(projectDir: string, options?: PatchAgentAccessOptions): Promise<{
+    readonly files: readonly string[];
+    readonly lines: readonly string[];
+}>;
+/** The lines init prints for `rows`, whatever else it summarizes: what it wrote outside the pack's folder, and the warnings. */
+export declare function agentAccessLines(rows: AgentAccessRows): readonly string[];
+export {};
+//# sourceMappingURL=agent-access.d.ts.map

package/dist/init/agent-access.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"agent-access.d.ts","sourceRoot":"","sources":["../../src/init/agent-access.ts"],"names":[],"mappings":"AA6BA,OAAO,EAAE,KAAK,WAAW,EAAmB,MAAM,wBAAwB,CAAC;AAE3E;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,SAAS,EAAE,SAAS,MAAM,EAMtC,CAAC;AAEF;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,SAAK,GAAG,SAAS,MAAM,EAAE,CAElE;AAOD;;;;;;GAMG;AACH,wBAAgB,WAAW,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAEhD;AAED;;;GAGG;AACH,wBAAsB,SAAS,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAaxE;AASD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,IAAI,EAAE,SAAS,GAAG,SAAS,GAAG,iBAAiB,GAAG,OAAO,CAAC;IACnE,gDAAgD;IAChD,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;;;;GAMG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,MAAM,EACZ,KAAK,GAAE,SAAS,MAAM,EAA0B,GAC/C,OAAO,CAAC,oBAAoB,CAAC,CAkF/B;AAED,KAAK,eAAe,GAAG,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAA;CAAE,EAAE,CAAC;AAE1F,MAAM,WAAW,iBAAiB;IAChC,+BAA+B;IAC/B,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;IACtC,2DAA2D;IAC3D,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;IACjC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EACd;QACE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,MAAM,EAAE,oBAAoB,CAAC;QACtC,QAAQ,CAAC,MAAM,EAAE,eAAe,CAAC;KAClC;IACH;;;;OAIG;OACD;QAAE,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC;CACjF;AAED,MAAM,WAAW,uBAAuB;IACtC,iEAAiE;IACjE,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,sFAAsF;AACtF,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC,iBAAiB,CAAC,CAwB5B;AAuBD,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;IACpC,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC;;;;OAIG;IACH,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;CACrC;AAED;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,iBAAiB,GAAG,eAAe,CA4B9F;AAwCD;;;;;;GAMG;AACH,wBAAsB,gBAAgB,CACpC,UAAU,EAAE,MAAM,EAClB,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC;IAAE,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,CAWnF;AAED,gIAAgI;AAChI,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,eAAe,GAAG,SAAS,MAAM,EAAE,CAEzE"}