@knowzai/cli 0.1.0 → 0.2.0

package/dist/lib/repo-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-scope.d.ts","sourceRoot":"","sources":["../../src/lib/repo-scope.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,qBAAqB,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AACvF,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAErD,KAAK,oBAAoB,GAAG;IAC1B,wBAAwB,IAAI,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC,CAAC;IACvE,cAAc,IAAI,OAAO,CAAC,mBAAmB,CAAC,CAAC;CAChD,CAAC;AAEF,wBAAsB,oBAAoB,CACxC,KAAK,EAAE,oBAAoB,EAC3B,OAAO,EAAE,IAAI,CAAC,WAAW,EAAE,SAAS,GAAG,WAAW,CAAC,GAClD,OAAO,CAAC,IAAI,CAAC,CAkBf"}

package/dist/lib/repo-scope.js

@@ -0,0 +1,15 @@
+import { ExitCode, KnowzError } from '@knowzai/core';
+export async function assertRepoScopeReady(store, binding) {
+    const pending = await store.getPendingScopeMigration();
+    if (pending) {
+        const expected = binding.vaultId === pending.oldVaultId ? pending.newVaultId : pending.oldVaultId;
+        throw new KnowzError(`Repository scope migration is incomplete (binding=${binding.vaultId}, other=${expected}). ` +
+            'Rerun `knowz repo setup --vault <hosted>` before serving, indexing, or searching.', ExitCode.Usage);
+    }
+    const inventory = await store.scopeInventory();
+    const foreign = inventory.vaultIds.filter((vaultId) => vaultId !== binding.vaultId);
+    if (foreign.length > 0 || inventory.unscopedItemCount > 0) {
+        throw new KnowzError('Repository binding/store scope mismatch. Re-run repository setup or rebuild the local index.', ExitCode.Usage);
+    }
+}
+//# sourceMappingURL=repo-scope.js.map

package/dist/lib/repo-scope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"repo-scope.js","sourceRoot":"","sources":["../../src/lib/repo-scope.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AASrD,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,KAA2B,EAC3B,OAAmD;IAEnD,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,wBAAwB,EAAE,CAAC;IACvD,IAAI,OAAO,EAAE,CAAC;QACZ,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC,UAAU,CAAC;QAClG,MAAM,IAAI,UAAU,CAClB,qDAAqD,OAAO,CAAC,OAAO,WAAW,QAAQ,KAAK;YAC1F,mFAAmF,EACrF,QAAQ,CAAC,KAAK,CACf,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,MAAM,KAAK,CAAC,cAAc,EAAE,CAAC;IAC/C,MAAM,OAAO,GAAG,SAAS,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,OAAO,CAAC,OAAO,CAAC,CAAC;IACpF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,SAAS,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QAC1D,MAAM,IAAI,UAAU,CAClB,8FAA8F,EAC9F,QAAQ,CAAC,KAAK,CACf,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/lib/safe-file.d.ts

@@ -0,0 +1,141 @@
+import { type Stats } from 'node:fs';
+import { homedir } from 'node:os';
+/**
+ * CLI_SecurityReleaseReadiness H7 — one shared gate for every path the CLI reads
+ * on the user's behalf and then ships somewhere durable.
+ *
+ * Four file-consuming surfaces existed with four different (or absent) checks:
+ * `knowledge attach` only asked "is this a regular file?", `knowledge create
+ * --file` and `ingest add` asked nothing at all, and `index scan` skipped
+ * dotfiles during a directory WALK but happily indexed one named directly.
+ * So `knowz ingest add ~/.ssh/id_rsa` or `knowz knowledge create k --file .env`
+ * uploaded credentials to the cloud, and a symlink planted in a shared
+ * checkout could redirect an otherwise-innocent path at anything readable.
+ *
+ * Three enforcements, applied uniformly:
+ *
+ *  1. DENIED PATHS — well-known credential files, matched on the RESOLVED path
+ *     so a symlink or `..` cannot route around the list.
+ *  2. SYMLINKS — rejected outright (`lstat`, not `stat`). A symlink is the
+ *     mechanism by which a path the user vetted becomes a path they did not.
+ *  3. BOUNDED SIZE — a hard ceiling, so a multi-gigabyte or pseudo-infinite file
+ *     cannot be read into memory in one `readFileSync`.
+ *
+ * A check that only inspects a PATH is advisory: between the `lstat` that
+ * approved it and the `readFileSync` that consumed it, the path can be replaced
+ * with a symlink to anything readable. So the reading surfaces do not re-resolve
+ * the path at all — `openSafeFile`/`readSafeFile` open ONCE with `O_NOFOLLOW`,
+ * `fstat` that descriptor, and consume that same descriptor. The file that was
+ * judged is the file that is read. (Same shape as the indexer's own read loop,
+ * `packages/indexer/src/indexer.ts`.)
+ *
+ * This gate fails CLOSED and deliberately ships no override flag: nothing in the
+ * established UX depends on ingesting a credential file, and an `--allow-secrets`
+ * escape hatch would be a permanent invitation to do exactly the thing the gate
+ * exists to prevent. Users who genuinely need a secret file in a vault can copy
+ * it to a non-denied path, which is an explicit, auditable act.
+ */
+/**
+ * Ceiling for paths read WHOLE into memory (`readFileSync`) — knowledge
+ * `--file`, `ingest add`, `index scan`. Matches the indexer's own `maxFileBytes`
+ * so the three text surfaces agree on what "too big to hold" means.
+ */
+export declare const MAX_SAFE_TEXT_BYTES = 1000000;
+/**
+ * Ceiling for paths STREAMED to the cloud (`knowledge attach`). The uploader
+ * reads at the server-dictated chunk size, so this is not a memory bound — it is
+ * a sanity ceiling that stops a runaway or pseudo-infinite file (a device node
+ * that stats as huge, a sparse multi-terabyte file) from becoming an unbounded
+ * upload. Deliberately far above any real attachment.
+ */
+export declare const MAX_SAFE_UPLOAD_BYTES: number;
+/** Back-compat alias for the in-memory ceiling. */
+export declare const MAX_SAFE_FILE_BYTES = 1000000;
+export interface SafeFileOptions {
+    /** Override the size ceiling (bytes). */
+    maxBytes?: number;
+    /** Label used in the error message, e.g. `knowledge attach`. */
+    operation?: string;
+}
+export interface SafeFileRejection {
+    path: string;
+    reason: string;
+}
+/**
+ * Classify one path. Returns a rejection reason, or undefined when the path is
+ * safe to read. Never throws — callers aggregate so every offender is named.
+ */
+export declare function checkSafeFile(path: string, opts?: SafeFileOptions): SafeFileRejection | undefined;
+/**
+ * Gate a batch of paths. Throws a single `KnowzError` naming EVERY offender and
+ * why, so a user with ten files does not discover the problems one run at a time.
+ *
+ * This is the BATCH pre-flight — it reports every offender before any work
+ * starts. It is not, on its own, the thing that makes a read safe: a path
+ * approved here can be swapped before it is consumed. Every surface that then
+ * READS the bytes must go through `openSafeFile`/`readSafeFile`.
+ */
+export declare function assertSafeFiles(paths: readonly string[], opts?: SafeFileOptions): void;
+/** An open, policy-approved descriptor. The caller owns closing `fd`. */
+export interface SafeFileHandle {
+    /** Open descriptor, already judged. Read from THIS — never re-open the path. */
+    fd: number;
+    /** `fstat` of the open descriptor, so size/mtime describe the judged file. */
+    stat: Stats;
+    /** The resolved path the descriptor was opened from (for messages only). */
+    path: string;
+}
+/** True only when Node can bind policy to the opened final path component. */
+export declare function supportsRaceResistantSafeOpen(platform?: NodeJS.Platform): boolean;
+/**
+ * Open a path under the full policy and hand back the OPEN DESCRIPTOR.
+ *
+ * The name policy is applied to the resolved path first (cheap, and it keeps
+ * the credential list authoritative), then the file is opened exactly once with
+ * `O_NOFOLLOW` and judged by `fstat` on that descriptor. Nothing after this
+ * point re-resolves the path, so there is no window in which the approved file
+ * and the consumed file can differ.
+ *
+ * Throws the same `KnowzError` shape as `assertSafeFiles`. The caller MUST
+ * `closeSync(handle.fd)`; `readSafeFile` does that for you.
+ */
+export declare function openSafeFile(path: string, opts?: SafeFileOptions): SafeFileHandle;
+/** Content plus the `fstat` of the descriptor it was read from. */
+export interface SafeFileContent {
+    content: string;
+    stat: Stats;
+    path: string;
+}
+/**
+ * Read a whole file under the policy, from the descriptor that was judged.
+ *
+ * Returns the `fstat` alongside the content so callers that record size/mtime
+ * (e.g. `ingest add`'s file state) describe the bytes they actually read rather
+ * than whatever a later `statSync` of the path would report.
+ */
+export declare function readSafeFile(path: string, opts?: SafeFileOptions): SafeFileContent;
+/**
+ * Re-run the open-time policy and immediately release the descriptor.
+ *
+ * A last-moment re-judgement for surfaces that can only hand a PATH to whatever
+ * consumes the bytes. It catches a swap that happened after the batch
+ * pre-flight, but it does NOT close the race — the consumer still re-opens the
+ * name afterwards. Prefer `openSafeFile` and pass the descriptor along;
+ * `knowledge attach` does exactly that (`lib/attach.ts` → `FilesApi.upload`'s
+ * `fd`). Reach for this only where handing a descriptor over is impossible.
+ */
+export declare function assertSafeFileAtOpen(path: string, opts?: SafeFileOptions): Stats;
+/**
+ * Directory-walk predicate for `index scan`: the same policy, expressed as a
+ * skip decision rather than an error, because a walk over a large tree should
+ * step over a denied file instead of aborting the whole scan.
+ */
+export declare function isSafeToIndex(path: string): boolean;
+/** Exposed for tests and for callers that want to explain the policy. */
+export declare const SAFE_FILE_POLICY: {
+    readonly deniedBasenames: Set<string>;
+    readonly deniedExtensions: Set<string>;
+    readonly deniedDirectorySegments: Set<string>;
+    readonly homeDir: typeof homedir;
+};
+//# sourceMappingURL=safe-file.d.ts.map

package/dist/lib/safe-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-file.d.ts","sourceRoot":"","sources":["../../src/lib/safe-file.ts"],"names":[],"mappings":"AAAA,OAAO,EAQL,KAAK,KAAK,EACX,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAGlC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,UAAY,CAAC;AAE7C;;;;;;GAMG;AACH,eAAO,MAAM,qBAAqB,QAAyB,CAAC;AAE5D,mDAAmD;AACnD,eAAO,MAAM,mBAAmB,UAAsB,CAAC;AA8CvD,MAAM,WAAW,eAAe;IAC9B,yCAAyC;IACzC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gEAAgE;IAChE,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;CAChB;AA6CD;;;GAGG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,iBAAiB,GAAG,SAAS,CA0BrG;AAYD;;;;;;;;GAQG;AACH,wBAAgB,eAAe,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,EAAE,IAAI,GAAE,eAAoB,GAAG,IAAI,CAI1F;AAED,yEAAyE;AACzE,MAAM,WAAW,cAAc;IAC7B,gFAAgF;IAChF,EAAE,EAAE,MAAM,CAAC;IACX,8EAA8E;IAC9E,IAAI,EAAE,KAAK,CAAC;IACZ,4EAA4E;IAC5E,IAAI,EAAE,MAAM,CAAC;CACd;AASD,8EAA8E;AAC9E,wBAAgB,6BAA6B,CAAC,QAAQ,kBAAmB,GAAG,OAAO,CAElF;AAED;;;;;;;;;;;GAWG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,cAAc,CAwCrF;AAED,mEAAmE;AACnE,MAAM,WAAW,eAAe;IAC9B,OAAO,EAAE,MAAM,CAAC;IAChB,IAAI,EAAE,KAAK,CAAC;IACZ,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;GAMG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,eAAe,CAOtF;AAED;;;;;;;;;GASG;AACH,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,GAAE,eAAoB,GAAG,KAAK,CAIpF;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEnD;AAED,yEAAyE;AACzE,eAAO,MAAM,gBAAgB;;;;;CAKnB,CAAC"}

package/dist/lib/safe-file.js

@@ -0,0 +1,296 @@
+import { closeSync, constants as fsConstants, fstatSync, lstatSync, openSync, readFileSync, realpathSync, } from 'node:fs';
+import { basename, isAbsolute, resolve, sep } from 'node:path';
+import { homedir } from 'node:os';
+import { ExitCode, KnowzError } from '@knowzai/core';
+/**
+ * CLI_SecurityReleaseReadiness H7 — one shared gate for every path the CLI reads
+ * on the user's behalf and then ships somewhere durable.
+ *
+ * Four file-consuming surfaces existed with four different (or absent) checks:
+ * `knowledge attach` only asked "is this a regular file?", `knowledge create
+ * --file` and `ingest add` asked nothing at all, and `index scan` skipped
+ * dotfiles during a directory WALK but happily indexed one named directly.
+ * So `knowz ingest add ~/.ssh/id_rsa` or `knowz knowledge create k --file .env`
+ * uploaded credentials to the cloud, and a symlink planted in a shared
+ * checkout could redirect an otherwise-innocent path at anything readable.
+ *
+ * Three enforcements, applied uniformly:
+ *
+ *  1. DENIED PATHS — well-known credential files, matched on the RESOLVED path
+ *     so a symlink or `..` cannot route around the list.
+ *  2. SYMLINKS — rejected outright (`lstat`, not `stat`). A symlink is the
+ *     mechanism by which a path the user vetted becomes a path they did not.
+ *  3. BOUNDED SIZE — a hard ceiling, so a multi-gigabyte or pseudo-infinite file
+ *     cannot be read into memory in one `readFileSync`.
+ *
+ * A check that only inspects a PATH is advisory: between the `lstat` that
+ * approved it and the `readFileSync` that consumed it, the path can be replaced
+ * with a symlink to anything readable. So the reading surfaces do not re-resolve
+ * the path at all — `openSafeFile`/`readSafeFile` open ONCE with `O_NOFOLLOW`,
+ * `fstat` that descriptor, and consume that same descriptor. The file that was
+ * judged is the file that is read. (Same shape as the indexer's own read loop,
+ * `packages/indexer/src/indexer.ts`.)
+ *
+ * This gate fails CLOSED and deliberately ships no override flag: nothing in the
+ * established UX depends on ingesting a credential file, and an `--allow-secrets`
+ * escape hatch would be a permanent invitation to do exactly the thing the gate
+ * exists to prevent. Users who genuinely need a secret file in a vault can copy
+ * it to a non-denied path, which is an explicit, auditable act.
+ */
+/**
+ * Ceiling for paths read WHOLE into memory (`readFileSync`) — knowledge
+ * `--file`, `ingest add`, `index scan`. Matches the indexer's own `maxFileBytes`
+ * so the three text surfaces agree on what "too big to hold" means.
+ */
+export const MAX_SAFE_TEXT_BYTES = 1_000_000;
+/**
+ * Ceiling for paths STREAMED to the cloud (`knowledge attach`). The uploader
+ * reads at the server-dictated chunk size, so this is not a memory bound — it is
+ * a sanity ceiling that stops a runaway or pseudo-infinite file (a device node
+ * that stats as huge, a sparse multi-terabyte file) from becoming an unbounded
+ * upload. Deliberately far above any real attachment.
+ */
+export const MAX_SAFE_UPLOAD_BYTES = 2 * 1024 * 1024 * 1024;
+/** Back-compat alias for the in-memory ceiling. */
+export const MAX_SAFE_FILE_BYTES = MAX_SAFE_TEXT_BYTES;
+/**
+ * Exact basenames that are credential material by convention. Matched
+ * case-insensitively on the resolved path's final segment.
+ */
+const DENIED_BASENAMES = new Set([
+    '.env',
+    '.envrc',
+    '.netrc',
+    '_netrc',
+    '.pgpass',
+    '.npmrc',
+    '.yarnrc',
+    '.git-credentials',
+    '.htpasswd',
+    'credentials',
+    'credentials.json',
+    'id_rsa',
+    'id_dsa',
+    'id_ecdsa',
+    'id_ed25519',
+    'known_hosts',
+    'authorized_keys',
+    'secring.gpg',
+    'shadow',
+    'terraform.tfstate',
+]);
+/** Extensions that carry private-key or certificate material. */
+const DENIED_EXTENSIONS = new Set(['pem', 'key', 'p12', 'pfx', 'jks', 'keystore', 'asc', 'ppk']);
+/**
+ * Directory segments whose contents are credential stores. Matched as a full
+ * path segment on the resolved path, so `./my.aws/notes.md` is unaffected.
+ */
+const DENIED_DIRECTORY_SEGMENTS = new Set([
+    '.ssh',
+    '.gnupg',
+    '.aws',
+    '.azure',
+    '.kube',
+    '.docker',
+    '.knowz',
+]);
+function deniedReason(resolvedPath) {
+    const name = basename(resolvedPath).toLowerCase();
+    if (DENIED_BASENAMES.has(name))
+        return `"${basename(resolvedPath)}" is a well-known credential file`;
+    if (/^secrets?\./i.test(name))
+        return `"${basename(resolvedPath)}" is a secret file`;
+    // EVERY `.env.*` is denied — `.env.local`, `.env.production`, and the
+    // "template" spellings alike. The redaction policy (`lib/redact.ts`) already
+    // treats the whole family as sensitive, and a per-name allowlist is exactly
+    // the wrong shape here: `.env.example` files routinely accumulate real values
+    // as people edit in place, and one allowed spelling is all an attacker needs
+    // (`cp .env .env.sample`). Uniformity is the property worth having; a genuine
+    // template can be copied to a non-`.env` name, which is an explicit act.
+    if (name.startsWith('.env.'))
+        return `"${basename(resolvedPath)}" is an environment secret file`;
+    const ext = name.includes('.') ? name.slice(name.lastIndexOf('.') + 1) : '';
+    if (ext && DENIED_EXTENSIONS.has(ext))
+        return `".${ext}" files carry private-key or certificate material`;
+    const segments = resolvedPath.split(sep).slice(0, -1);
+    for (const segment of segments) {
+        if (DENIED_DIRECTORY_SEGMENTS.has(segment.toLowerCase())) {
+            return `it lives under a credential directory ("${segment}")`;
+        }
+    }
+    return undefined;
+}
+/**
+ * Resolve a path for policy checks WITHOUT following the final symlink — the
+ * link itself is rejected, so `realpath` is only used to normalise `..` and
+ * intermediate links for the denied-path match.
+ */
+function policyPath(path) {
+    const absolute = isAbsolute(path) ? path : resolve(process.cwd(), path);
+    try {
+        // realpath the PARENT so intermediate symlinks are normalised while the
+        // final component stays exactly what the user named.
+        const parent = resolve(absolute, '..');
+        return resolve(realpathSync(parent), basename(absolute));
+    }
+    catch {
+        return absolute;
+    }
+}
+/**
+ * Classify one path. Returns a rejection reason, or undefined when the path is
+ * safe to read. Never throws — callers aggregate so every offender is named.
+ */
+export function checkSafeFile(path, opts = {}) {
+    const maxBytes = opts.maxBytes ?? MAX_SAFE_TEXT_BYTES;
+    const resolved = policyPath(path);
+    let stat;
+    try {
+        stat = lstatSync(resolved);
+    }
+    catch {
+        return { path, reason: 'it does not exist or is not readable' };
+    }
+    if (stat.isSymbolicLink()) {
+        return {
+            path,
+            reason: 'it is a symbolic link (a link can point somewhere you did not intend; pass the real path)',
+        };
+    }
+    if (!stat.isFile())
+        return { path, reason: 'it is not a regular file' };
+    const denied = deniedReason(resolved);
+    if (denied)
+        return { path, reason: denied };
+    if (stat.size > maxBytes) {
+        return { path, reason: `it is ${stat.size} bytes, over the ${maxBytes}-byte limit for a single file` };
+    }
+    return undefined;
+}
+/** One message shape for every refusal, whether it names one path or ten. */
+function refusal(rejections, opts) {
+    const operation = opts.operation ? `${opts.operation}: ` : '';
+    const detail = rejections.map((r) => `  ${r.path} — ${r.reason}`).join('\n');
+    return new KnowzError(`${operation}refusing to read ${rejections.length} path(s):\n${detail}`, ExitCode.Usage);
+}
+/**
+ * Gate a batch of paths. Throws a single `KnowzError` naming EVERY offender and
+ * why, so a user with ten files does not discover the problems one run at a time.
+ *
+ * This is the BATCH pre-flight — it reports every offender before any work
+ * starts. It is not, on its own, the thing that makes a read safe: a path
+ * approved here can be swapped before it is consumed. Every surface that then
+ * READS the bytes must go through `openSafeFile`/`readSafeFile`.
+ */
+export function assertSafeFiles(paths, opts = {}) {
+    const rejections = paths.map((p) => checkSafeFile(p, opts)).filter((r) => Boolean(r));
+    if (!rejections.length)
+        return;
+    throw refusal(rejections, opts);
+}
+/**
+ * `O_NOFOLLOW` makes the kernel refuse to open a symlink at all, which closes
+ * the check-then-open race for the final path component. Windows has no such
+ * flag; there `checkSafeFile`'s `lstat` remains the (advisory) symlink guard.
+ */
+const O_NOFOLLOW = fsConstants.O_NOFOLLOW ?? 0;
+/** True only when Node can bind policy to the opened final path component. */
+export function supportsRaceResistantSafeOpen(platform = process.platform) {
+    return platform !== 'win32' && O_NOFOLLOW !== 0;
+}
+/**
+ * Open a path under the full policy and hand back the OPEN DESCRIPTOR.
+ *
+ * The name policy is applied to the resolved path first (cheap, and it keeps
+ * the credential list authoritative), then the file is opened exactly once with
+ * `O_NOFOLLOW` and judged by `fstat` on that descriptor. Nothing after this
+ * point re-resolves the path, so there is no window in which the approved file
+ * and the consumed file can differ.
+ *
+ * Throws the same `KnowzError` shape as `assertSafeFiles`. The caller MUST
+ * `closeSync(handle.fd)`; `readSafeFile` does that for you.
+ */
+export function openSafeFile(path, opts = {}) {
+    const maxBytes = opts.maxBytes ?? MAX_SAFE_TEXT_BYTES;
+    const resolved = policyPath(path);
+    const denied = deniedReason(resolved);
+    if (denied)
+        throw refusal([{ path, reason: denied }], opts);
+    let fd;
+    try {
+        fd = openSync(resolved, fsConstants.O_RDONLY | O_NOFOLLOW);
+    }
+    catch (e) {
+        const code = e.code;
+        // ELOOP (Linux/macOS) / EMLINK (some BSDs) is O_NOFOLLOW refusing a symlink.
+        if (code === 'ELOOP' || code === 'EMLINK') {
+            throw refusal([{ path, reason: 'it is a symbolic link (a link can point somewhere you did not intend; pass the real path)' }], opts);
+        }
+        if (code === 'EISDIR')
+            throw refusal([{ path, reason: 'it is not a regular file' }], opts);
+        throw refusal([{ path, reason: 'it does not exist or is not readable' }], opts);
+    }
+    try {
+        const stat = fstatSync(fd);
+        // A symlink cannot reach here on a platform with O_NOFOLLOW; on one without
+        // it, `fstat` still catches the non-regular targets that matter (device
+        // nodes, FIFOs, directories).
+        if (!stat.isFile())
+            throw refusal([{ path, reason: 'it is not a regular file' }], opts);
+        if (stat.size > maxBytes) {
+            throw refusal([{ path, reason: `it is ${stat.size} bytes, over the ${maxBytes}-byte limit for a single file` }], opts);
+        }
+        return { fd, stat, path: resolved };
+    }
+    catch (e) {
+        closeSync(fd);
+        throw e;
+    }
+}
+/**
+ * Read a whole file under the policy, from the descriptor that was judged.
+ *
+ * Returns the `fstat` alongside the content so callers that record size/mtime
+ * (e.g. `ingest add`'s file state) describe the bytes they actually read rather
+ * than whatever a later `statSync` of the path would report.
+ */
+export function readSafeFile(path, opts = {}) {
+    const handle = openSafeFile(path, opts);
+    try {
+        return { content: readFileSync(handle.fd, 'utf8'), stat: handle.stat, path: handle.path };
+    }
+    finally {
+        closeSync(handle.fd);
+    }
+}
+/**
+ * Re-run the open-time policy and immediately release the descriptor.
+ *
+ * A last-moment re-judgement for surfaces that can only hand a PATH to whatever
+ * consumes the bytes. It catches a swap that happened after the batch
+ * pre-flight, but it does NOT close the race — the consumer still re-opens the
+ * name afterwards. Prefer `openSafeFile` and pass the descriptor along;
+ * `knowledge attach` does exactly that (`lib/attach.ts` → `FilesApi.upload`'s
+ * `fd`). Reach for this only where handing a descriptor over is impossible.
+ */
+export function assertSafeFileAtOpen(path, opts = {}) {
+    const handle = openSafeFile(path, opts);
+    closeSync(handle.fd);
+    return handle.stat;
+}
+/**
+ * Directory-walk predicate for `index scan`: the same policy, expressed as a
+ * skip decision rather than an error, because a walk over a large tree should
+ * step over a denied file instead of aborting the whole scan.
+ */
+export function isSafeToIndex(path) {
+    return checkSafeFile(path) === undefined;
+}
+/** Exposed for tests and for callers that want to explain the policy. */
+export const SAFE_FILE_POLICY = {
+    deniedBasenames: DENIED_BASENAMES,
+    deniedExtensions: DENIED_EXTENSIONS,
+    deniedDirectorySegments: DENIED_DIRECTORY_SEGMENTS,
+    homeDir: homedir,
+};
+//# sourceMappingURL=safe-file.js.map

package/dist/lib/safe-file.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"safe-file.js","sourceRoot":"","sources":["../../src/lib/safe-file.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,SAAS,EACT,SAAS,IAAI,WAAW,EACxB,SAAS,EACT,SAAS,EACT,QAAQ,EACR,YAAY,EACZ,YAAY,GAEb,MAAM,SAAS,CAAC;AACjB,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,WAAW,CAAC;AAC/D,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,MAAM,eAAe,CAAC;AAErD;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AAEH;;;;GAIG;AACH,MAAM,CAAC,MAAM,mBAAmB,GAAG,SAAS,CAAC;AAE7C;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAAG,CAAC,GAAG,IAAI,GAAG,IAAI,GAAG,IAAI,CAAC;AAE5D,mDAAmD;AACnD,MAAM,CAAC,MAAM,mBAAmB,GAAG,mBAAmB,CAAC;AAEvD;;;GAGG;AACH,MAAM,gBAAgB,GAAG,IAAI,GAAG,CAAC;IAC/B,MAAM;IACN,QAAQ;IACR,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,SAAS;IACT,kBAAkB;IAClB,WAAW;IACX,aAAa;IACb,kBAAkB;IAClB,QAAQ;IACR,QAAQ;IACR,UAAU;IACV,YAAY;IACZ,aAAa;IACb,iBAAiB;IACjB,aAAa;IACb,QAAQ;IACR,mBAAmB;CACpB,CAAC,CAAC;AAEH,iEAAiE;AACjE,MAAM,iBAAiB,GAAG,IAAI,GAAG,CAAC,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC;AAEjG;;;GAGG;AACH,MAAM,yBAAyB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM;IACN,QAAQ;IACR,MAAM;IACN,QAAQ;IACR,OAAO;IACP,SAAS;IACT,QAAQ;CACT,CAAC,CAAC;AAcH,SAAS,YAAY,CAAC,YAAoB;IACxC,MAAM,IAAI,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC,WAAW,EAAE,CAAC;IAElD,IAAI,gBAAgB,CAAC,GAAG,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,YAAY,CAAC,mCAAmC,CAAC;IACrG,IAAI,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,YAAY,CAAC,oBAAoB,CAAC;IACrF,sEAAsE;IACtE,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,6EAA6E;IAC7E,8EAA8E;IAC9E,yEAAyE;IACzE,IAAI,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,IAAI,QAAQ,CAAC,YAAY,CAAC,iCAAiC,CAAC;IAEjG,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC5E,IAAI,GAAG,IAAI,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,GAAG,mDAAmD,CAAC;IAE1G,MAAM,QAAQ,GAAG,YAAY,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACtD,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,yBAAyB,CAAC,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YACzD,OAAO,2CAA2C,OAAO,IAAI,CAAC;QAChE,CAAC;IACH,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;GAIG;AACH,SAAS,UAAU,CAAC,IAAY;IAC9B,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,CAAC;QACH,wEAAwE;QACxE,qDAAqD;QACrD,MAAM,MAAM,GAAG,OAAO,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC,YAAY,CAAC,MAAM,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC3D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY,EAAE,OAAwB,EAAE;IACpE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAElC,IAAI,IAAI,CAAC;IACT,IAAI,CAAC;QACH,IAAI,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC7B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC;IAClE,CAAC;IAED,IAAI,IAAI,CAAC,cAAc,EAAE,EAAE,CAAC;QAC1B,OAAO;YACL,IAAI;YACJ,MAAM,EAAE,2FAA2F;SACpG,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC;IAExE,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC;IAE5C,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;QACzB,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,IAAI,CAAC,IAAI,oBAAoB,QAAQ,+BAA+B,EAAE,CAAC;IACzG,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,6EAA6E;AAC7E,SAAS,OAAO,CAAC,UAAwC,EAAE,IAAqB;IAC9E,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,GAAG,IAAI,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;IAC9D,MAAM,MAAM,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC7E,OAAO,IAAI,UAAU,CACnB,GAAG,SAAS,oBAAoB,UAAU,CAAC,MAAM,cAAc,MAAM,EAAE,EACvE,QAAQ,CAAC,KAAK,CACf,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,KAAwB,EAAE,OAAwB,EAAE;IAClF,MAAM,UAAU,GAAG,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAA0B,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9G,IAAI,CAAC,UAAU,CAAC,MAAM;QAAE,OAAO;IAC/B,MAAM,OAAO,CAAC,UAAU,EAAE,IAAI,CAAC,CAAC;AAClC,CAAC;AAYD;;;;GAIG;AACH,MAAM,UAAU,GAAI,WAAuC,CAAC,UAAU,IAAI,CAAC,CAAC;AAE5E,8EAA8E;AAC9E,MAAM,UAAU,6BAA6B,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ;IACvE,OAAO,QAAQ,KAAK,OAAO,IAAI,UAAU,KAAK,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAwB,EAAE;IACnE,MAAM,QAAQ,GAAG,IAAI,CAAC,QAAQ,IAAI,mBAAmB,CAAC;IACtD,MAAM,QAAQ,GAAG,UAAU,CAAC,IAAI,CAAC,CAAC;IAElC,MAAM,MAAM,GAAG,YAAY,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,MAAM;QAAE,MAAM,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAE5D,IAAI,EAAU,CAAC;IACf,IAAI,CAAC;QACH,EAAE,GAAG,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,QAAQ,GAAG,UAAU,CAAC,CAAC;IAC7D,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,MAAM,IAAI,GAAI,CAA2B,CAAC,IAAI,CAAC;QAC/C,6EAA6E;QAC7E,IAAI,IAAI,KAAK,OAAO,IAAI,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,OAAO,CACX,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,2FAA2F,EAAE,CAAC,EAC/G,IAAI,CACL,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,KAAK,QAAQ;YAAE,MAAM,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QAC3F,MAAM,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,sCAAsC,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;IAClF,CAAC;IAED,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,SAAS,CAAC,EAAE,CAAC,CAAC;QAC3B,4EAA4E;QAC5E,wEAAwE;QACxE,8BAA8B;QAC9B,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;YAAE,MAAM,OAAO,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,0BAA0B,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC;QACxF,IAAI,IAAI,CAAC,IAAI,GAAG,QAAQ,EAAE,CAAC;YACzB,MAAM,OAAO,CACX,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,IAAI,CAAC,IAAI,oBAAoB,QAAQ,+BAA+B,EAAE,CAAC,EACjG,IAAI,CACL,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC;IACtC,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,SAAS,CAAC,EAAE,CAAC,CAAC;QACd,MAAM,CAAC,CAAC;IACV,CAAC;AACH,CAAC;AASD;;;;;;GAMG;AACH,MAAM,UAAU,YAAY,CAAC,IAAY,EAAE,OAAwB,EAAE;IACnE,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,MAAM,CAAC,EAAE,EAAE,MAAM,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5F,CAAC;YAAS,CAAC;QACT,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,oBAAoB,CAAC,IAAY,EAAE,OAAwB,EAAE;IAC3E,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACxC,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrB,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,aAAa,CAAC,IAAI,CAAC,KAAK,SAAS,CAAC;AAC3C,CAAC;AAED,yEAAyE;AACzE,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC9B,eAAe,EAAE,gBAAgB;IACjC,gBAAgB,EAAE,iBAAiB;IACnC,uBAAuB,EAAE,yBAAyB;IAClD,OAAO,EAAE,OAAO;CACR,CAAC"}

package/dist/lib/setup-console.d.ts

@@ -25,7 +25,7 @@ export interface SetupConsoleOptions {
         mcp: boolean;
         publicSite: boolean;
     }>;
-    imageMode?: 'build' | 'pull';
+    imageMode?: 'build' | 'pull' | 'preloaded';
     account?: {
         name: string;
         email: string;

package/dist/lib/setup-console.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-console.d.ts","sourceRoot":"","sources":["../../src/lib/setup-console.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAQrE,OAAO,EAAqD,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EACL,cAAc,EACd,cAAc,EAEd,KAAK,eAAe,EAEpB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,eAAe,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAClD,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACrC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,UAAU,CAAC,EAAE,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5D,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC;IAC7B,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;IAClC,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;IAClC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACnD;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,GAClD,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAsDD,8FAA8F;AAC9F,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,mBAAmB,EAC5B,YAAY,GAAE,wBAA6B,GAC1C,OAAO,CAAC,eAAe,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CA+G5C"}
+{"version":3,"file":"setup-console.d.ts","sourceRoot":"","sources":["../../src/lib/setup-console.ts"],"names":[],"mappings":"AACA,OAAO,EAAkB,KAAK,eAAe,EAAE,MAAM,eAAe,CAAC;AAQrE,OAAO,EAAqD,KAAK,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAC9G,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAE1D,OAAO,EACL,cAAc,EACd,cAAc,EAEd,KAAK,eAAe,EAEpB,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,eAAe,CAAC;IACvB,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAClD,KAAK,EAAE,OAAO,CAAC;IACf,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IAC7B,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,EAAE,aAAa,CAAC,UAAU,CAAC,CAAC;IACrC,KAAK,CAAC,EAAE,OAAO,CAAC;QAAE,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,UAAU,CAAC,EAAE,OAAO,CAAC;QAAE,GAAG,EAAE,OAAO,CAAC;QAAC,UAAU,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5D,SAAS,CAAC,EAAE,OAAO,GAAG,MAAM,GAAG,WAAW,CAAC;IAC3C,OAAO,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC;CAC3C;AAED,MAAM,WAAW,wBAAwB;IACvC,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;IAClC,SAAS,CAAC,EAAE,OAAO,cAAc,CAAC;IAClC,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,UAAU,CAAC,OAAO,cAAc,CAAC,KAAK,OAAO,CAAC,kBAAkB,CAAC,CAAC;IACtF,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAC;IACpC,aAAa,CAAC,EAAE,MAAM,OAAO,CAAC,kBAAkB,CAAC,CAAC;CACnD;AAED,wBAAsB,uBAAuB,CAC3C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,OAAO,GAAE,OAAO,UAAU,CAAC,KAAwB,GAClD,OAAO,CAAC,kBAAkB,CAAC,CAe7B;AAsDD,8FAA8F;AAC9F,wBAAsB,kBAAkB,CACtC,OAAO,EAAE,mBAAmB,EAC5B,YAAY,GAAE,wBAA6B,GAC1C,OAAO,CAAC,eAAe,GAAG;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,CAAC,CAiH5C"}

package/dist/lib/setup-console.js

@@ -107,7 +107,9 @@ export async function launchSetupConsole(options, dependencies = {}) {
         ports,
         storage: detectedState?.storage,
         components,
-        imageMode: options.imageMode ?? (detectedState?.imageMode === 'build' ? 'build' : 'pull'),
+        // §2026-08-31 R-U4: straight seed — a detected preloaded (possibly air-gapped)
+        // stack must never be silently coerced to pulling. Explicit flag still wins.
+        imageMode: options.imageMode ?? detectedState?.imageMode ?? 'pull',
         account: options.account,
     };
     const formSchema = deriveSetupFormSchema(loadRequiredEnvByPreset(), FIELD_MAP);

package/dist/lib/setup-console.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-console.js","sourceRoot":"","sources":["../../src/lib/setup-console.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,cAAc,EAAwB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,qBAAqB,EAAkB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,GAIjB,MAAM,mBAAmB,CAAC;AA6B3B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,aAAqB,EACrB,UAAmC,UAAU,CAAC,KAAK;IAEnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE;QACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAiD,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC;IAClC,IAAI,MAAM,EAAE,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtD,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAkB;IACpD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACnH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAA2B,CAAC;QAC3F,IAAI,MAAM,EAAE,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC1E,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAClD,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YACzF,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,QAAgB,EAAU,EAAE,CACxD,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3G,MAAM,GAAG,GAAG,CAAC,KAAc,EAAE,QAAgB,EAAU,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvG,0EAA0E;QAC1E,+CAA+C;QAC/C,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,IAAI;YACJ,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;YACvF,QAAQ,EAAE,QAAqC;YAC/C,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO;YACjE,WAAW,EAAE,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI;gBACnB,EAAE,EAAE,SAAS;gBACb,eAAe,EAAE,MAAM;gBACvB,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,MAAM;aACtB;YACD,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;gBAClC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;gBAClC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;gBAClC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC;aACjD;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,uBAAuB,CAAC;gBAC1D,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,uBAAuB,CAAC;gBAC1D,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,uBAAuB,CAAC;gBAC1D,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,uBAAuB,CAAC;aACzE;YACD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS;gBACzE,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS;gBACjD,CAAC,CAAC,MAAM,CAAC,UAAU;gBACnB,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YACvG,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;SACxE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA4B,EAC5B,eAAyC,EAAE;IAE3C,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,cAAc,CAAC,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,IAAI,cAAc,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,gBAAgB,CAAC;IACjE,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,IAAI,WAAW,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC;IACrC,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG;QACZ,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI;QAC5D,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI;QAC5D,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI;QAC5D,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,IAAI,aAAa,EAAE,KAAK,EAAE,UAAU,IAAI,IAAI;KAClF,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI;QACtE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,UAAU,IAAI,KAAK;KAC7F,CAAC;IACF,MAAM,YAAY,GAAuB;QACvC,IAAI;QACJ,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,aAAa,EAAE,OAAO,IAAI,wBAAwB;QAC9E,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa,EAAE,QAAQ;QACrD,KAAK;QACL,OAAO,EAAE,aAAa,EAAE,OAAO;QAC/B,UAAU;QACV,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,CAAC,aAAa,EAAE,SAAS,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;QACzF,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,MAAM,UAAU,GAAG,qBAAqB,CAAC,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,sBAAsB,CAAC;IACzF,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,8BAA8B,IAAI,aAAa,CAAC;IACxH,CAAC;IACD,MAAM,OAAO,GAAoB;QAC/B,KAAK;QACL,UAAU;QACV,YAAY;QACZ,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa;QACjC,SAAS,EAAE,GAAG,EAAE,CAAC,YAAY,CAC3B,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EACzD,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAC9B;QACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACtC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;YACjB,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,KAAK,CAAC,eAAe;gBACnB,OAAO,CAAC,eAAe,KAAK,IAAI;oBAChC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC;YAC9C,OAAO,YAAY,CACjB,KAAK,EACL,2BAA2B,CAAC;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,KAAK;gBACZ,qBAAqB,EAAE,KAAK;gBAC5B,gBAAgB,EAAE,IAAI;gBACtB,IAAI,EAAE,YAAY;aACnB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC;QACtD,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAChD,eAAe,EAAE,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,aAAa,EAAE;gBACpD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE,OAAO;gBACpB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC5D,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,UAAU,CAAC;QAC3B,CAAC;QACD,qBAAqB,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,wBAAwB,CAAC,UAAU,CAAC;QAC3E,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAChD,WAAW,EAAE;YACX,MAAM,EAAE,oBAAoB,KAAK,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,oBAAoB,KAAK,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,oBAAoB,KAAK,CAAC,GAAG,EAAE;YACvC,aAAa,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SAC1F;QACD,kBAAkB,EAAE,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO;QACzE,aAAa,EAAE,YAAY,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,uBAAuB,CACzE,oBAAoB,KAAK,CAAC,GAAG,EAAE,EAC/B,aAAa,CACd,CAAC;KACH,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjD,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QAC5C,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}
+{"version":3,"file":"setup-console.js","sourceRoot":"","sources":["../../src/lib/setup-console.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACnD,OAAO,EAAE,cAAc,EAAwB,MAAM,eAAe,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,SAAS,EAAE,MAAM,+BAA+B,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,MAAM,iCAAiC,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,uBAAuB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC1G,OAAO,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AAC9E,OAAO,EAAE,wBAAwB,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,8BAA8B,CAAC;AACnG,OAAO,EAAE,iBAAiB,EAAE,MAAM,eAAe,CAAC;AAClD,OAAO,EAAE,iBAAiB,EAAE,QAAQ,EAAE,oBAAoB,EAAsB,MAAM,uBAAuB,CAAC;AAE9G,OAAO,EAAE,qBAAqB,EAAkB,MAAM,iBAAiB,CAAC;AACxE,OAAO,EACL,cAAc,EACd,cAAc,EACd,gBAAgB,GAIjB,MAAM,mBAAmB,CAAC;AA6B3B,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,MAAc,EACd,aAAqB,EACrB,UAAmC,UAAU,CAAC,KAAK;IAEnD,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,WAAW,EAAE;QACtE,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,KAAK,CAAC;KACnC,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IAC3C,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAiD,CAAC;IAClF,MAAM,MAAM,GAAG,IAAI,CAAC,aAAa,CAAC;IAClC,IAAI,MAAM,EAAE,MAAM,KAAK,IAAI;QAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC;IACtD,OAAO;QACL,MAAM,EAAE,IAAI;QACZ,GAAG,CAAC,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC1E,GAAG,CAAC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QACtF,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,IAAY,EAAE,SAAkB;IACpD,MAAM,KAAK,GAAG,oBAAoB,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;IACpD,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,WAAW,CAAC,IAAI,CAAC,UAAU,CAAC,KAAK,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAC;IACnH,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,CAAC,SAAS,EAAE,MAAM,CAAC,CAA2B,CAAC;QAC3F,IAAI,MAAM,EAAE,aAAa,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;YAAE,OAAO,SAAS,CAAC;QAC1E,MAAM,QAAQ,GAAG,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YAClD,CAAC,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,EAAE,mBAAmB,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC;YACzF,CAAC,CAAC,MAAM,CAAC,QAAQ;YACjB,CAAC,CAAC,SAAS,CAAC;QACd,MAAM,IAAI,GAAG,CAAC,KAAc,EAAE,QAAgB,EAAU,EAAE,CACxD,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,IAAI,KAAK,IAAI,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC3G,MAAM,GAAG,GAAG,CAAC,KAAc,EAAE,QAAgB,EAAU,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvG,0EAA0E;QAC1E,+CAA+C;QAC/C,OAAO;YACL,aAAa,EAAE,CAAC;YAChB,IAAI;YACJ,OAAO,EAAE,OAAO,MAAM,CAAC,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,wBAAwB;YACvF,QAAQ,EAAE,QAAqC;YAC/C,OAAO,EAAE,MAAM,CAAC,OAAO,KAAK,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO;YACjE,WAAW,EAAE,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE;YACxD,IAAI,EAAE,MAAM,CAAC,IAAI,IAAI;gBACnB,EAAE,EAAE,SAAS;gBACb,eAAe,EAAE,MAAM;gBACvB,MAAM,EAAE,MAAM;gBACd,aAAa,EAAE,MAAM;aACtB;YACD,KAAK,EAAE;gBACL,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;gBAClC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;gBAClC,GAAG,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,GAAG,EAAE,IAAI,CAAC;gBAClC,UAAU,EAAE,IAAI,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,EAAE,IAAI,CAAC;aACjD;YACD,WAAW,EAAE;gBACX,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,uBAAuB,CAAC;gBAC1D,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,uBAAuB,CAAC;gBAC1D,GAAG,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,EAAE,uBAAuB,CAAC;gBAC1D,UAAU,EAAE,GAAG,CAAC,MAAM,CAAC,WAAW,EAAE,UAAU,EAAE,uBAAuB,CAAC;aACzE;YACD,UAAU,EAAE,MAAM,CAAC,UAAU,IAAI,OAAO,MAAM,CAAC,UAAU,CAAC,GAAG,KAAK,SAAS;gBACzE,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,KAAK,SAAS;gBACjD,CAAC,CAAC,MAAM,CAAC,UAAU;gBACnB,CAAC,CAAC,SAAS;YACb,SAAS,EAAE,MAAM,CAAC,SAAS,KAAK,OAAO,IAAI,MAAM,CAAC,SAAS,KAAK,WAAW,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YACvG,SAAS,EAAE,OAAO,MAAM,CAAC,SAAS,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE;SACxE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED,8FAA8F;AAC9F,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,OAA4B,EAC5B,eAAyC,EAAE;IAE3C,MAAM,KAAK,GAAG,CAAC,YAAY,CAAC,SAAS,IAAI,cAAc,CAAC,EAAE,CAAC;IAC3D,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,IAAI,cAAc,CAAC;IAC3D,MAAM,WAAW,GAAG,YAAY,CAAC,WAAW,IAAI,gBAAgB,CAAC;IACjE,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,IAAI,WAAW,CAAC;IACxD,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,OAAO,CAAC;IACrC,MAAM,aAAa,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC5D,MAAM,KAAK,GAAG;QACZ,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI;QAC5D,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI;QAC5D,GAAG,EAAE,OAAO,CAAC,KAAK,EAAE,GAAG,IAAI,aAAa,EAAE,KAAK,EAAE,GAAG,IAAI,IAAI;QAC5D,UAAU,EAAE,OAAO,CAAC,KAAK,EAAE,UAAU,IAAI,aAAa,EAAE,KAAK,EAAE,UAAU,IAAI,IAAI;KAClF,CAAC;IACF,MAAM,UAAU,GAAG;QACjB,GAAG,EAAE,OAAO,CAAC,UAAU,EAAE,GAAG,IAAI,aAAa,EAAE,UAAU,EAAE,GAAG,IAAI,IAAI;QACtE,UAAU,EAAE,OAAO,CAAC,UAAU,EAAE,UAAU,IAAI,aAAa,EAAE,UAAU,EAAE,UAAU,IAAI,KAAK;KAC7F,CAAC;IACF,MAAM,YAAY,GAAuB;QACvC,IAAI;QACJ,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,aAAa,EAAE,OAAO,IAAI,wBAAwB;QAC9E,QAAQ,EAAE,OAAO,CAAC,QAAQ,IAAI,aAAa,EAAE,QAAQ;QACrD,KAAK;QACL,OAAO,EAAE,aAAa,EAAE,OAAO;QAC/B,UAAU;QACV,+EAA+E;QAC/E,6EAA6E;QAC7E,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,aAAa,EAAE,SAAS,IAAI,MAAM;QAClE,OAAO,EAAE,OAAO,CAAC,OAAO;KACzB,CAAC;IACF,MAAM,UAAU,GAAG,qBAAqB,CAAC,uBAAuB,EAAE,EAAE,SAAS,CAAC,CAAC;IAC/E,MAAM,aAAa,GAAG,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IACpE,IAAI,aAAa,GAAG,OAAO,CAAC,GAAG,CAAC,8BAA8B,IAAI,sBAAsB,CAAC;IACzF,IAAI,UAAU,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACtC,aAAa,GAAG,QAAQ,CAAC,YAAY,CAAC,aAAa,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,8BAA8B,IAAI,aAAa,CAAC;IACxH,CAAC;IACD,MAAM,OAAO,GAAoB;QAC/B,KAAK;QACL,UAAU;QACV,YAAY;QACZ,YAAY,EAAE,GAAG,EAAE,CAAC,aAAa;QACjC,SAAS,EAAE,GAAG,EAAE,CAAC,YAAY,CAC3B,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,EACzD,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAC9B;QACD,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,YAAY,EAAE,EAAE;YACtC,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC;YAClB,KAAK,CAAC,GAAG,GAAG,IAAI,CAAC;YACjB,KAAK,CAAC,UAAU,GAAG,OAAO,CAAC,UAAU,CAAC;YACtC,KAAK,CAAC,eAAe;gBACnB,OAAO,CAAC,eAAe,KAAK,IAAI;oBAChC,KAAK,CAAC,IAAI,CAAC,OAAO,KAAK,YAAY,CAAC,OAAO,CAAC;YAC9C,OAAO,YAAY,CACjB,KAAK,EACL,2BAA2B,CAAC;gBAC1B,KAAK,EAAE,OAAO,CAAC,KAAK;gBACpB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,KAAK,EAAE,KAAK;gBACZ,KAAK,EAAE,KAAK;gBACZ,qBAAqB,EAAE,KAAK;gBAC5B,gBAAgB,EAAE,IAAI;gBACtB,IAAI,EAAE,YAAY;aACnB,CAAC,CACH,CAAC;QACJ,CAAC;QACD,aAAa,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,aAAa,CAAC,SAAS,CAAC;QACtD,UAAU,EAAE,CAAC,SAAS,EAAE,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;QAChD,eAAe,EAAE,KAAK,IAAI,EAAE;YAC1B,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,aAAa,EAAE;gBACpD,KAAK,EAAE,UAAU,CAAC,KAAK;gBACvB,MAAM,EAAE,iBAAiB;gBACzB,WAAW,EAAE,OAAO;gBACpB,GAAG,EAAE,IAAI,CAAC,GAAG;gBACb,KAAK,EAAE,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;gBAChE,IAAI,EAAE,CAAC,IAAI,EAAE,EAAE,GAAG,IAAI,CAAC,OAAO,CAAC,KAAK;oBAAE,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;aAC5D,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,gBAAgB,EAAE,IAAI,EAAE,CAAC,CAAC;YAClD,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;YAClC,OAAO,MAAM,CAAC,UAAU,CAAC;QAC3B,CAAC;QACD,qBAAqB,EAAE,CAAC,UAAU,EAAE,EAAE,CAAC,wBAAwB,CAAC,UAAU,CAAC;QAC3E,SAAS,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,qBAAqB,CAAC,IAAI,CAAC;QAChD,WAAW,EAAE;YACX,MAAM,EAAE,oBAAoB,KAAK,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,oBAAoB,KAAK,CAAC,GAAG,EAAE;YACvC,MAAM,EAAE,oBAAoB,KAAK,CAAC,GAAG,EAAE;YACvC,aAAa,EAAE,UAAU,CAAC,UAAU,CAAC,CAAC,CAAC,oBAAoB,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,SAAS;SAC1F;QACD,kBAAkB,EAAE,oBAAoB,CAAC,IAAI,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC,OAAO;QACzE,aAAa,EAAE,YAAY,CAAC,aAAa,IAAI,CAAC,GAAG,EAAE,CAAC,uBAAuB,CACzE,oBAAoB,KAAK,CAAC,GAAG,EAAE,EAC/B,aAAa,CACd,CAAC;KACH,CAAC;IACF,MAAM,GAAG,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IAC/B,MAAM,OAAO,GAAG,MAAM,WAAW,CAAC,GAAG,CAAC,CAAC;IACvC,IAAI,CAAC,OAAO,CAAC,KAAK;QAAE,OAAO,CAAC,IAAI,CAAC,iCAAiC,OAAO,CAAC,GAAG,EAAE,CAAC,CAAC;IACjF,IAAI,OAAO,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAEjD,MAAM,WAAW,GAAG,GAAS,EAAE;QAC7B,KAAK,OAAO,CAAC,KAAK,EAAE,CAAC;IACvB,CAAC,CAAC;IACF,OAAO,CAAC,IAAI,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IACpC,IAAI,CAAC;QACH,MAAM,UAAU,GAAG,MAAM,OAAO,CAAC,UAAU,CAAC;QAC5C,MAAM,OAAO,CAAC,KAAK,EAAE,CAAC;QACtB,IAAI,UAAU,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;QACrE,CAAC;QACD,OAAO,EAAE,GAAG,UAAU,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;IAC7C,CAAC;YAAS,CAAC;QACT,OAAO,CAAC,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;IAChD,CAAC;AACH,CAAC"}

package/dist/lib/setup-page.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"setup-page.d.ts","sourceRoot":"","sources":["../../src/lib/setup-page.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AAEvF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,eAAe,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,kBAAkB,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AA0CD,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAsmBxD"}
+{"version":3,"file":"setup-page.d.ts","sourceRoot":"","sources":["../../src/lib/setup-page.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAC;AAI/D,OAAO,KAAK,EAAE,eAAe,EAAE,SAAS,EAAuB,MAAM,iBAAiB,CAAC;AAGvF,MAAM,WAAW,cAAc;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,EAAE,eAAe,CAAC;IACxB,SAAS,EAAE,eAAe,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,QAAQ,EAAE,OAAO,CAAC,SAAS,CAAC,CAAC;IAC7B,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,aAAa,CAAC,EAAE,kBAAkB,CAAC;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,OAAO,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AA0CD,uFAAuF;AACvF,wBAAgB,UAAU,CAAC,KAAK,EAAE,cAAc,GAAG,MAAM,CAinBxD"}