@miakapp/cli 4.0.0-alpha.5 → 4.0.0-alpha.6

package/README.md

@@ -1,6 +1,6 @@
 # @miakapp/cli
 
-Build, validate, publish and roll back one Miakapp home component.
+Pair, build, validate, publish and roll back independent Miakapp house applications.
 
 The CLI is the deployment mechanism, not the source of truth. **Git belongs to
 you**: this tool never commits, never rewrites sources it did not generate and
@@ -12,11 +12,19 @@ stable exit code and one stable failure kind, and `--json` prints exactly one
 object on stdout.
 
 ```bash
-bunx @miakapp/cli init --home my-home --control-plane https://control.miakapp.app
+printf '%s\n' "$CODE" | bunx @miakapp/cli pair --issuer "$MIAKAPP_ISSUER"
+bunx @miakapp/cli init                            # home and issuer from the paired context
 bunx @miakapp/cli check
-bunx @miakapp/cli publish --expected-generation 0
+bunx @miakapp/cli publish
+bunx @miakapp/cli status                          # verify what is live
 ```
 
+Use the exact issuer command shown by your deployment's `/pair` page; do not
+guess a staging issuer. `init` writes the project manifest, not an application:
+build your house UI as one classic-script IIFE (the `@miakapp/app` SDK is
+optional), then run `check` and `publish`. Open and verify the returned
+`home_url` as a resident before handing it over.
+
 ## The project file
 
 `miakapp.yaml` sits at the root of your repository:
@@ -24,24 +32,25 @@ bunx @miakapp/cli publish --expected-generation 0
 ```yaml
 schema: miakapp.project/1
 home: my-home
-control_plane: https://control.miakapp.app
+control_plane: https://control.example.test
 
-component:
-  artifact: dist/component.js
-  release: 2026-09-13.1
+app:
+  artifact: dist/app.js
+  release: 2026-10-03.1
   requires:
     state_read:
       - climate.living_room.temperature
-    event_subscribe: []
-    event_publish: []
     call:
       - lighting.set
-    presentation: []
 
 coordinator:
   entry: coordinator/main.ts
 ```
 
+`app` declares only `state_read` and `call`; events, media and reserved
+`miakapp.*` calls are unavailable. Use `miakapp init --kind component` for the
+semantic component ABI instead. Choose exactly one of `app` and `component`.
+
 `requires` is the closed RFC 0002 capability object. Lists are de-duplicated and
 sorted before they are bound into an upload capability, so the value the CLI
 sends is byte-identical on every later reconciliation read.
@@ -55,10 +64,13 @@ duplicate keys — is rejected with the offending line rather than guessed at.
 
 | Command | What it does |
 | --- | --- |
+| `pair` | Redeems a one-time pairing code into a new stored context. |
+| `context list\|show\|use\|remove` | Manages stored contexts. Never prints a key. |
 | `init` | Writes `miakapp.yaml`. Never overwrites an existing one. |
 | `agent-pack` | Offline. Installs the guide and the MCP wiring into a repository. |
 | `discover` | Offline. Inventories a Node-RED installation from its flows export. |
 | `check` | Offline. Parses the project, verifies the artifact, prints the digest. |
+| `status` | Reads the live generation, release and digest of the home. |
 | `publish` | Capability → delivery → finalization → activation, in one run. |
 | `activate` | Activates an already finalized digest at a new generation. |
 | `rollback` | Alias of `activate`, for returning to a known-good digest. |
@@ -111,9 +123,9 @@ place instead of appending another copy. `.mcp.json` is merged as a structure
 one key, by name — so every other server in it survives, and a file that does
 not parse is refused rather than replaced with a valid one.
 
-The server is registered as the bare `miakapp` command rather than an absolute
-path, because the file is committed and the next machine to check it out will
-not have this one's directory layout.
+The generated server entry uses `npx -y @miakapp/cli@<installed-version> mcp`,
+so a new machine gets the same executable as the bundled guide without relying
+on a global binary or this machine's directory layout.
 
 Run it again whenever the CLI is upgraded: an unchanged file is reported
 `unchanged`, and a guide that moved on is reported `updated`.
@@ -129,8 +141,7 @@ tools over newline-delimited JSON-RPC on stdio.
   "mcpServers": {
     "miakapp": {
       "command": "bunx",
-      "args": ["@miakapp/cli", "mcp"],
-      "env": { "MIAKAPP_HOME_KEY": "${MIAKAPP_HOME_KEY}" }
+      "args": ["@miakapp/cli", "mcp"]
     }
   }
 }
@@ -138,6 +149,12 @@ tools over newline-delimited JSON-RPC on stdio.
 
 | Tool | Command | |
 | --- | --- | --- |
+| `miakapp_pair` | `pair` | stores a new context; the code is a tool argument |
+| `miakapp_context_list` | `context list` | read-only, offline |
+| `miakapp_context_show` | `context show` | read-only, offline |
+| `miakapp_context_use` | `context use` | offline, changes the current context |
+| `miakapp_context_remove` | `context remove` | **deletes a stored key — needs `confirm: true`** |
+| `miakapp_status` | `status` | read-only |
 | `miakapp_discover` | `discover` | read-only, offline |
 | `miakapp_check` | `check` | read-only, offline |
 | `miakapp_release` | `release` | read-only |
@@ -154,7 +171,8 @@ drift apart. A tool argument is the option name with `_` for `-`
 (`expected_generation` → `--expected-generation`); an argument the tool does not
 declare is refused rather than ignored.
 
-The three pointer-moving tools additionally require `confirm: true`. It is
+The three pointer-moving tools and `miakapp_context_remove` additionally
+require `confirm: true`. It is
 checked before anything else and never reaches the command line, so a model that
 hallucinated a publication spends the mistake on an argument check instead of on
 a generation.
@@ -165,20 +183,69 @@ remedy — not as a JSON-RPC error. That distinction matters: a protocol error
 means the call never happened, while a publication that reached the control
 plane and failed did happen, and only `kind` says whether to reconcile.
 
-## Authorization
+## Access: pairing and contexts
+
+The owner grants access in their own browser; the agent never signs in. They
+open `https://miakapp.com/pair`, choose the home, confirm, and send the
+one-time code, which `pair` trades for a **new, separately revocable** Home Key:
+
+```bash
+printf '%s\n' "$CODE" | miakapp pair      # or run it in a terminal: hidden prompt
+miakapp pair --code "$CODE"               # allowed, but lands in shell history
+```
+
+| Option | Default |
+| --- | --- |
+| `--issuer <https url>` | `https://control.miakapp.com` |
+| `--label <label>` | `miakapp-cli@<host name>`, shown in the owner's key list |
+| `--name <context>` | the paired home ID (`-2`, `-3`… if taken) |
+
+Before the code is sent, the issuer must serve a discovery document naming
+exactly itself; redirects are refused. The redeem response —
+`POST {issuer}/v1/pairing/redeem` with `{code, label}`, answered with
+`{home_key, home_id, key_id, issuer}` and `Cache-Control: no-store` — must name
+the same issuer and a key whose ID is embedded in the key. The code is sent
+once and never retried: a lost response is exit 7, because a key may exist.
+`pair` then exchanges the key for a publication token, reported as
+`publish_access`, so a key without the publish scope is caught now rather than
+at the first publication.
+
+Contexts live in `~/.miakapp` (or `$MIAKAPP_CONFIG_DIR`, absolute):
+
+| File | Holds | Mode |
+| --- | --- | --- |
+| `config.json` | context names, home IDs, issuers, key IDs, labels, current context | 0600 |
+| `credentials.json` | the Home Keys, nothing else | 0600 |
 
-The Home Key is read from `MIAKAPP_HOME_KEY` and from nowhere else. No command
-accepts it as an argument, because an argument lands in shell history, in a
-process listing and in most CI logs.
+The directory is 0700. Both files are replaced through a temporary file, an
+fsync and a rename, under a lock file, so concurrent runs never lose a context
+and a crash never leaves half a file. A credentials file readable by another
+account, a symbolic link, a foreign owner or a key that is not the one the
+context was paired with is refused rather than used.
 
 ```bash
-export MIAKAPP_HOME_KEY="$(op read op://home/miakapp/home-key)"   # or your own vault
-bunx @miakapp/cli publish --expected-generation 4
+miakapp context list
+miakapp context show [name]     # credential: stored (never printed)
+miakapp context use <name>
+miakapp context remove <name>   # local only: the owner revokes the key server-side
 ```
 
-The key is exchanged for a five-minute `components:publish` token before every
-run. Publication endpoints never accept the Home Key itself, and the CLI never
-prints either credential.
+Which Home Key a command uses, highest precedence first:
+
+1. `--context <name>`, then `MIAKAPP_CONTEXT=<name>`;
+2. `MIAKAPP_HOME_KEY` — a raw key, kept for CI and compatibility;
+3. the stored context whose home and issuer match `miakapp.yaml`, the current
+   context breaking a tie between keys for that same home.
+
+A selected context for another home — or a `MIAKAPP_HOME_KEY` this machine
+knows was paired with another home — is refused before any request, so a key
+can never publish into the wrong house. Every networked result reports
+`credential_source` and `context`, never the key.
+
+No command accepts a Home Key as an argument: an argument lands in shell
+history, in a process listing and in most CI logs. The key is exchanged for a
+five-minute `components:publish` token before every run, and publication
+endpoints never see the Home Key itself.
 
 ## Generations
 
@@ -187,11 +254,11 @@ believe the pointer holds, and `--generation` (default: expected + 1) is the one
 you are publishing. A stale expectation fails with `generation_conflict` and
 exit code 6 rather than last-write-wins.
 
-`--expected-generation` is required rather than discovered, because RFC 0004
-§13.2 publishes no read for the current pointer: the pointer lives in
-`components/{homeID}` and reaches clients as authenticated platform data. Until
-that surface exists, the CLI asks you for the number instead of guessing one —
-inventing an endpoint would be worse than an explicit flag.
+Without `--expected-generation`, `publish` and `activate` read the live pointer
+first (`GET /v1/homes/{homeId}/component-pointer`, RFC 0004 §13.2) and use its
+generation. That read takes no lock, so the activation is still a
+compare-and-set: a publication that lands in between makes this one fail with
+exit 6, never overwrites it. `miakapp status` prints the same read.
 
 ## Exit codes
 
@@ -213,14 +280,14 @@ committed, so the next step is a read — `miakapp upload <id>` or
 ## Failure output
 
 ```console
-$ miakapp publish --expected-generation 0
+$ miakapp publish
 miakapp: conflict: Activation failed with HTTP 409 generation_conflict (request Zq1...)
   Another publication advanced the pointer. Read the active generation and retry
   the activation with the observed expected_generation.
 ```
 
 ```console
-$ miakapp publish --expected-generation 0 --json
+$ miakapp publish --json
 {"ok":false,"kind":"conflict","exit_code":6,"message":"...","remedy":"..."}
 ```
 

package/assets/agent-guide.md

@@ -10,6 +10,43 @@ Everything below is true of the code in this repository. Where a rule exists for
 a reason that is not obvious, the reason is given, because a rule whose purpose
 you cannot see is one you will optimize away.
 
+## 0. What "done" means
+
+The owner asked for a home they can use, not for a picture of one. You are done
+when the household can open the published interface, read real values from it
+and use every control the owner authorized — and you checked that yourself.
+Concretely:
+
+- **Publish, then verify.** A build that only runs on your machine, a mockup, a
+  prototype kept offline or a screenshot is an intermediate result, never the
+  deliverable. Do not stop to show one and ask whether to continue: the owner
+  asked for the home, and publication is reversible in one command (§8).
+- **Hand over a link that works.** Give the owner the `home_url` that
+  `miakapp publish` and `miakapp status` print — the Miakapp address where the
+  home opens for its members — and say what you verified there. The
+  `artifact_url` (JSON `url`) is the raw bundle, not an interface: never send it
+  as "the link". If the control plane advertises no `home_url`, say so instead of
+  inventing one, and say what `miakapp status` proved.
+- **Ask once, at the start, and only for what you cannot find.** Access comes
+  from pairing (§9), the existing installation from inventory (§3). Repeated
+  permission questions in the middle of the work are a failure of the work.
+- **You need nothing from the platform's source.** This guide, the CLI, the
+  public packages and `templates/home` are the whole toolchain. Never edit or
+  redeploy the Miakapp platform to make one house work; if a capability is
+  missing, report it to the owner as missing instead of patching around it.
+
+Two scopes must not be confused:
+
+| In scope by default | Needs the owner's explicit, separate request |
+| --- | --- |
+| reading the existing installation (§3) | changing flows, automations, brokers or devices that already run the house |
+| writing and testing a coordinator and a component | granting a physical action (heat, lock, unlock, open, close) that the owner has not named |
+| publishing, verifying and rolling back the V4 interface | anything on the owner's own machines beyond the coordinator you were asked to run |
+
+Caution about the second column is not a reason to withhold the first. A new V4
+interface that only reads is still a useful, publishable V1; say plainly which
+controls are not offered and why.
+
 ## 1. What you are building
 
 Three artifacts, and no more:
@@ -17,10 +54,16 @@ Three artifacts, and no more:
 | Artifact | Where it runs | What it owns |
 | --- | --- | --- |
 | Coordinator | the owner's machine, under Bun | state, events, functions, **authorization** |
-| Component | a sandboxed Worker in the household's browser | the interface |
-| `miakapp.yaml` | neither; it is the contract | what the component may ask for |
+| Interface | an isolated frame (app) or sandboxed Worker (component) in the household's browser | what residents see and touch |
+| `miakapp.yaml` | neither; it is the contract | what the interface may ask for |
+
+The interface is, by default, a **whole-house application** (`app:` in
+`miakapp.yaml`, ABI `miakapp.app/1`): your own layout, styles, navigation and
+libraries, bundled into one file. A semantic **component** (`component:`,
+`miakapp.component/1`) is still supported for a minimal tree Miakapp draws for
+you. §5 covers both.
 
-The coordinator is trusted. The component is not. The relay between them is
+The coordinator is trusted. The interface is not. The relay between them is
 platform-untrusted but not blind: it terminates TLS, stores plaintext state and
 enforces routing, so self-hosting it does not give end-to-end confidentiality.
 Do not tell the owner otherwise.
@@ -94,6 +137,37 @@ Write down what you found before you write the configuration. The state paths yo
 choose become a disclosure boundary and a public interface at the same time, and
 renaming one after the household has used it is not free.
 
+### The inventory comes before the design
+
+Commit the inventory as `docs/inventory.md` in the home repository, one line per
+datum or action, before you design a single screen:
+
+| Field | Example |
+| --- | --- |
+| source | `zigbee2mqtt/salon_thermo` over the house broker |
+| what it is | temperature, °C, one decimal |
+| how fresh | reports every ~60 s; last seen 2 min ago |
+| who may read it | every member / owner only |
+| command | none — a measurement, not a control |
+
+Then design **from** it: the V1 shows every datum the household would care
+about and every action that is both technically possible and authorized,
+grouped the way people live in the house — by room or by use, not by device
+or protocol. Anything you leave out, leave out on purpose, and say why in the
+inventory. A V1 that shows three values when the house reports twenty is not a
+first version; it is an unfinished one.
+
+What the interface must never do:
+
+- **invent data.** A value with no source is shown as absent, never filled in
+  with a plausible number or a demo fixture;
+- **blur freshness.** Distinguish *current*, *stale* (with its age) and
+  *unavailable* for every value, in words a resident understands;
+- **spend space on plumbing.** No protocol or platform vocabulary
+  (`ACCEPTED`, "relay connected", ABI, schema names, IDs), no banner restating
+  that a view is read-only, no title repeating the home's name on every card.
+  Every line of text is either information or an action.
+
 ### Reading a V3 house you inherited
 
 Most houses arriving at V4 already run Node-RED with the v3 MiakAPI nodes. Ask
@@ -180,7 +254,43 @@ The relay keeps ownership tables for topics, state paths and functions, detects
 collisions and rejects with `4409`. If you claim `lighting.set` for the whole
 house, you have taken a name another integration may need; scope what you own.
 
-## 5. The component
+## 5. The interface
+
+### A whole-house application (default)
+
+`miakapp init` writes an `app:` section; `templates/home/app/` is a working
+example. You own the document: build any DOM, ship your own CSS, route with
+`location.hash`, use React, Svelte, Vue, charts or WebAssembly — anything a
+bundler can inline. The deliverable is **one classic-script IIFE** of at most
+2 MiB, with no `import()` and no source map:
+
+```bash
+bun build app/main.ts --format=iife --minify --outfile dist/app.js
+```
+
+Miakapp runs it in an isolated, opaque-origin frame below a permanent Miakapp
+bar, after the resident agreed to open the home. The frame has no network, no
+cookies or storage, no popups and no fullscreen; assets go in the bundle as
+`data:`/`blob:` URLs. Its only way to the home is `@miakapp/app`:
+
+```ts
+import { callErrorCode, connect } from '@miakapp/app';
+
+const home = connect();
+home.subscribe((state) => render(state));        // also called once immediately
+await home.call('lighting.set', { on: true });   // rejects with a closed code
+```
+
+Declare every state path (exact or `prefix.*`) under `app.requires.state_read`
+and every function under `app.requires.call`. Events, media and `miakapp.*`
+functions are refused by `miakapp check`. Show `state.stale`, disable controls
+while it is true, and handle `outcome_unknown` exactly as below.
+
+**The bundle is not private.** Any signed-in user who learns its digest can
+fetch it. Put no household data in it — no names, rooms, devices or accounts —
+and read everything from state, which the coordinator filters per resident.
+
+### A semantic component (compatible)
 
 Import from `@miakapp/component`. The whole public surface is one module, and the
 whole rendering vocabulary is `ui.*`:
@@ -305,25 +415,35 @@ writes no history, rewrites no source it did not generate, and invents no
 control-plane endpoint. The repository is the owner's.
 
 ```bash
-miakapp agent-pack                                             # once, per repository
-miakapp init --home <homeId> --control-plane <https url>
+miakapp docs start                             # this guide, from the installed CLI
+miakapp pair                                   # once per home and machine (§9)
+miakapp agent-pack                             # once, per repository
+miakapp init                                   # app: by default; --kind component for a semantic tree
 miakapp check
-miakapp publish  --expected-generation <n>
-miakapp activate --sha256 <digest> --expected-generation <n>
-miakapp rollback --sha256 <digest> --expected-generation <n>   # alias of activate
+miakapp status                                 # what is live now: generation, release, digest
+miakapp publish                                # upload, finalize, activate
+miakapp status                                 # verify the new digest is what is live
+miakapp activate --sha256 <digest>             # promote an already finalized digest
+miakapp rollback --sha256 <digest>             # alias of activate
 miakapp release <sha256>      # read one finalized release
 miakapp upload  <uploadId>    # reconcile a lost request
 ```
 
-`--expected-generation` is a compare-and-swap on the home's component pointer: the
-generation you believe it currently holds. It is `0` for a home that has never
-published. It is required, and it is what stops two agents from silently
-overwriting each other.
+Activation is a compare-and-set on the home's component pointer. Without
+`--expected-generation` the CLI reads the live generation first and activates
+the next one; the read takes no lock, so another publication landing in between
+still fails with `conflict` instead of being overwritten. Pass
+`--expected-generation <n>` when you want to assert the state you reviewed.
 
 Rollback is `activate` pointed at a digest you already trust. Keep the digest of
 every release you shipped; a rollback you can perform in one command is worth
 more than an incident you can explain.
 
+`miakapp status` after `publish` is the minimum verification: the live `sha256`
+must be the one you just built. It proves what the home runs, not that the
+interface is right — open its `home_url` as a member would before telling the
+owner it works.
+
 ### Driving the CLI as a program
 
 Every failure maps to exactly one stable exit code and one stable
@@ -366,22 +486,68 @@ Three differences are worth knowing before you call anything:
 `packages/cli/README.md` lists the tools. The exit codes above are the
 `exit_code` field in every result, so branch on the same table either way.
 
-## 9. Secrets
+## 9. Access: pairing and contexts
+
+You never sign in as the owner and never ask for a password, a Google login or
+an existing key. The owner grants access to one home, in their own browser:
+
+1. Ask the owner to open **https://miakapp.com/pair**, sign in to their own
+   account, choose the home (or create it), confirm the access it grants, and
+   send you the one-time code it shows. A code works once, for ten minutes.
+2. Redeem it. The code is read from stdin and never echoed:
 
-`MIAKAPP_HOME_KEY` comes from the environment. It is never a command-line
-argument, never printed, never written into a project file. No command accepts
-one, deliberately: an argument lands in shell history, in a process listing and
-in most CI logs.
+   ```bash
+   printf '%s\n' "<code>" | miakapp pair            # add --issuer <url> if the page shows one
+   ```
+
+   Over MCP, call `miakapp_pair` with `code`. Never repeat the code back in a
+   message, and never retry a refused code — ask for a new one.
+3. `pair` stores a **new, separately revocable** Home Key for this machine as a
+   context in `~/.miakapp`, keeps every other context, makes the new one
+   current, and proves the key can publish. It prints the key ID and label,
+   never the key.
 
 ```bash
-export MIAKAPP_HOME_KEY="$(your-secret-manager read miakapp/home-key)"
+miakapp context list          # every home this machine can publish to
+miakapp context show [name]   # one context; the key is never printed
+miakapp context use <name>    # make a context current
+miakapp context remove <name> # delete it locally (the owner revokes it server-side)
 ```
 
-If you are about to write a secret into `miakapp.yaml` so something works, stop:
-that is the failure this design exists to prevent.
+`~/.miakapp/config.json` holds names, homes, issuers and key IDs;
+`credentials.json` holds the keys. Both are mode 0600 in a 0700 directory and
+are replaced atomically; the CLI refuses a credentials file other accounts can
+read. `MIAKAPP_CONFIG_DIR` relocates the directory.
+
+Which key a command uses, highest precedence first:
+
+1. `--context <name>`, then `MIAKAPP_CONTEXT=<name>`;
+2. `MIAKAPP_HOME_KEY`, a raw key for CI and compatibility;
+3. the stored context paired with the home and issuer in `miakapp.yaml` — the
+   current context breaks a tie between two keys for that same home.
+
+A context, or a known key, for a different home than `miakapp.yaml` names is
+refused before any request: a key can never publish into the wrong house.
+
+Prefer one key per agent or machine, so the owner can revoke one without
+breaking the others. A coordinator running on the owner's machine still reads
+its own key from its environment (`templates/home/README.md`).
+
+If you are about to write a secret into `miakapp.yaml` or any file in the
+repository so something works, stop: that is the failure this design exists to
+prevent.
 
 ## 10. Before you tell the owner you are done
 
+- [ ] `docs/inventory.md` lists every source, datum and action you found, and
+      the interface covers it or says why not.
+- [ ] Every value shows whether it is current, stale or unavailable; nothing is
+      invented, and no technical vocabulary is on screen.
+- [ ] The interface is published, `miakapp status` shows your digest live, and
+      you opened it as a member would — or you say precisely what you could not
+      check.
+- [ ] The owner received a working link and the rollback digest, not a
+      screenshot or a mockup.
 - [ ] Every physically consequential function authorizes its caller on its first
       line, and a test proves an unauthorized caller is refused.
 - [ ] Every name in `miakapp.yaml` is covered by the coordinator, and a test
@@ -390,11 +556,16 @@ that is the failure this design exists to prevent.
 - [ ] No call path retries an unknown outcome.
 - [ ] State is written before its event is published.
 - [ ] `bun run check` is green, and CI ran it — not just you.
-- [ ] The Home Key exists only in the environment.
+- [ ] The Home Key exists only in `~/.miakapp` or the environment, never in the
+      repository.
 - [ ] You recorded the digest of what you published, so rollback is one command.
 
 ## Where to read further
 
+Everything a home needs is above, in the CLI and in the template. The RFCs and
+platform paths below explain *why* the platform behaves as it does; you never
+need them, or the platform repository, to build and publish a home.
+
 - `packages/cli/README.md` — every command and every tool, including what the
   pack writes and what it refuses to overwrite.
 - `templates/home/README.md` — the mechanics of the template itself.

package/bin/miakapp.js

@@ -1,10 +1,14 @@
 #!/usr/bin/env node
 import { run } from '../dist/main.js';
+import { readSecret } from '../dist/terminal.js';
+
+const writeError = (text) => void process.stderr.write(text);
 
 process.exitCode = await run(process.argv.slice(2), {
   write: (text) => void process.stdout.write(text),
-  writeError: (text) => void process.stderr.write(text),
+  writeError,
   cwd: () => process.cwd(),
   env: (name) => process.env[name],
   input: process.stdin,
+  readSecret: (prompt) => readSecret(process.stdin, prompt, writeError),
 });

package/dist/agent-pack.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"agent-pack.d.ts","sourceRoot":"","sources":["../src/agent-pack.ts"],"names":[],"mappings":"AAsBA,6DAA6D;AAC7D,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC,sEAAsE;AACtE,eAAO,MAAM,UAAU,4BAAqC,CAAC;AAE7D,4EAA4E;AAC5E,eAAO,MAAM,QAAQ,cAAc,CAAC;AAEpC,yEAAyE;AACzE,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAG1F,CAAC;AAEF,eAAO,MAAM,YAAY,2BAA2B,CAAC;AACrD,eAAO,MAAM,UAAU,yBAAyB,CAAC;AAEjD,uEAAuE;AACvE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;AAE7D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAoCD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CA8BvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBrF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMrD;AAMD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CA+BnE;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAiBrB"}
+{"version":3,"file":"agent-pack.d.ts","sourceRoot":"","sources":["../src/agent-pack.ts"],"names":[],"mappings":"AAsBA,6DAA6D;AAC7D,eAAO,MAAM,cAAc,aAAa,CAAC;AAEzC,sEAAsE;AACtE,eAAO,MAAM,UAAU,4BAAqC,CAAC;AAE7D,4EAA4E;AAC5E,eAAO,MAAM,QAAQ,cAAc,CAAC;AAEpC,yEAAyE;AACzE,eAAO,MAAM,WAAW,YAAY,CAAC;AAErC;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,EAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAG1F,CAAC;AAEF,eAAO,MAAM,YAAY,2BAA2B,CAAC;AACrD,eAAO,MAAM,UAAU,yBAAyB,CAAC;AAEjD,uEAAuE;AACvE,MAAM,MAAM,UAAU,GAAG,SAAS,GAAG,SAAS,GAAG,WAAW,CAAC;AAE7D,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,UAAU,CAAC;CAC7B;AAED,MAAM,WAAW,SAAS;IACxB,IAAI,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;IACxC,KAAK,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACxD,MAAM,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC;IACvC,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC5C;AAoCD;;;;;;GAMG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAqCvD;AAED;;;;;;;GAOG;AACH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAiBrF;AAED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAMrD;AAMD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,CA+BnE;AAED,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,UAAU,EAAE,CAAC;CACvC;AAED;;;;;GAKG;AACH,wBAAsB,WAAW,CAC/B,KAAK,EAAE,SAAS,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,UAAU,CAAC,CAiBrB"}

package/dist/agent-pack.js

@@ -76,8 +76,9 @@ export function instructionBlock(client) {
 ## Miakapp
 
 This repository is a Miakapp home: a coordinator that runs on the owner's
-machine and owns state, events and authorization, and a component that runs
-sandboxed in the household's browser and owns nothing but the interface.
+machine and owns state, events and authorization, and an interface — by default
+a whole-house application bundled as one IIFE — that runs isolated in the
+household's browser and owns nothing but what residents see.
 
 **Read \`${GUIDE_FILE}\` before writing or publishing anything here.** It is the
 full guide, copied into this repository so it is readable offline, and it is the
@@ -88,9 +89,13 @@ inventory an existing installation, validate the project, publish, and roll back
 The same commands exist as \`${SERVER_NAME}\` on the command line; they are one
 implementation, so neither surface can drift from the other.
 
-Three rules the guide explains and this file repeats because getting them wrong
+Four rules the guide explains and this file repeats because getting them wrong
 is expensive:
 
+- Done means published and verified: inventory the house first, publish a V1
+  that covers the real data, check \`${SERVER_NAME} status\`, open it as a member
+  would, and hand the owner the printed \`home_url\` — never the artifact URL, a
+  screenshot or a mockup.
 - \`publish\`, \`activate\` and \`rollback\` change what every device in the home
   runs. Over MCP they refuse to act without \`confirm: true\`. Set it when the
   owner asked for that publication, never to get past an error.
@@ -98,8 +103,10 @@ is expensive:
   \`conflict\` means re-read the pointer; \`unknown_outcome\` means the effect is
   undetermined — reconcile with \`${SERVER_NAME} release\` or \`${SERVER_NAME} upload\`
   before acting again, and never retry it.
-- The Home Key lives in \`MIAKAPP_HOME_KEY\` in the environment. No command
-  accepts it as an argument, and it belongs in no file in this repository.
+- Access comes from \`${SERVER_NAME} pair\`: the owner confirms the home at
+  https://miakapp.com/pair and sends a one-time code; never ask for a login or
+  a key. Keys live in \`~/.miakapp\` (or \`MIAKAPP_HOME_KEY\` for CI), never in
+  this repository and never in a command argument.
 ${END_MARKER}`;
 }
 /**

package/dist/agent-pack.js.map

@@ -1 +1 @@
-{"version":3,"file":"agent-pack.js","sourceRoot":"","sources":["../src/agent-pack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,cAAc,iBAAiB,CAAC;AAE7D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAC;AAEpC,yEAAyE;AACzE,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAkE;IAC9F,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;IACtC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE;CAC7C,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,MAAM,CAAC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAkBjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,MAAM,CAAC,KAAiB,EAAE,IAAY;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAChB,GAAG,IAAI,gCAAgC,EACvC,oFAAoF,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,GAAG,CAChB,KAAgB,EAChB,IAAY,EACZ,OAAe;IAEf,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3F,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,GAAG,YAAY;;;;;;;WAOb,UAAU;;;;QAIb,WAAW,sBAAsB,QAAQ,+BAA+B,MAAM;;+BAEvD,WAAW;;;;;;;;;;;oCAWN,WAAW,mBAAmB,WAAW;;;;EAI3E,UAAU,EAAE,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA4B,EAAE,KAAa;IAC3E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,GAAG,KAAK,IAAI,CAAC;IAE1E,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,IAAI,CAAC;IAC7C,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,YAAY,CAChB,mBAAmB,YAAY,6BAA6B,EAC5D,iBAAiB,UAAU,+CAA+C,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,YAAY,IAAI,WAAW,EAAE,EAAE,KAAK,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAA4B;IACzD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,CAChB,GAAG,QAAQ,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,EAC3F,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,YAAY,CAChB,GAAG,QAAQ,0BAA0B,EACrC,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,YAAY,CAChB,GAAG,QAAQ,gDAAgD,EAC3D,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC;IACpE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAgB,EAChB,IAAY,EACZ,KAAa;IAEb,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,cAAc,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAE/D,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEhE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC"}
+{"version":3,"file":"agent-pack.js","sourceRoot":"","sources":["../src/agent-pack.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,cAAc,CAAC;AAEzD,6DAA6D;AAC7D,MAAM,CAAC,MAAM,cAAc,GAAG,UAAU,CAAC;AAEzC,sEAAsE;AACtE,MAAM,CAAC,MAAM,UAAU,GAAG,GAAG,cAAc,iBAAiB,CAAC;AAE7D,4EAA4E;AAC5E,MAAM,CAAC,MAAM,QAAQ,GAAG,WAAW,CAAC;AAEpC,yEAAyE;AACzE,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC;AAErC;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAkE;IAC9F,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,OAAO,EAAE;IACtC,EAAE,IAAI,EAAE,WAAW,EAAE,MAAM,EAAE,aAAa,EAAE;CAC7C,CAAC;AAEF,MAAM,CAAC,MAAM,YAAY,GAAG,wBAAwB,CAAC;AACrD,MAAM,CAAC,MAAM,UAAU,GAAG,sBAAsB,CAAC;AAkBjD,MAAM,OAAO,GAAG,IAAI,WAAW,EAAE,CAAC;AAElC,SAAS,MAAM,CAAC,KAAiB,EAAE,IAAY;IAC7C,IAAI,CAAC;QACH,OAAO,IAAI,WAAW,CAAC,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACjE,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,YAAY,CAChB,GAAG,IAAI,gCAAgC,EACvC,oFAAoF,CACrF,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,GAAG,CAChB,KAAgB,EAChB,IAAY,EACZ,OAAe;IAEf,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;QAC9B,MAAM,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC/B,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,OAAO;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC;IAC3F,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACjC,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC;AACrC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAc;IAC7C,OAAO,GAAG,YAAY;;;;;;;;WAQb,UAAU;;;;QAIb,WAAW,sBAAsB,QAAQ,+BAA+B,MAAM;;+BAEvD,WAAW;;;;;;;uCAOH,WAAW;;;;;;;;oCAQd,WAAW,mBAAmB,WAAW;;wBAErD,WAAW;;;;EAIjC,UAAU,EAAE,CAAC;AACf,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAAC,QAA4B,EAAE,KAAa;IAC3E,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE;QAAE,OAAO,GAAG,KAAK,IAAI,CAAC;IAE1E,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;IAC7C,IAAI,KAAK,KAAK,CAAC,CAAC,EAAE,CAAC;QACjB,MAAM,SAAS,GAAG,QAAQ,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC;QAC1D,OAAO,GAAG,QAAQ,GAAG,SAAS,GAAG,KAAK,IAAI,CAAC;IAC7C,CAAC;IAED,MAAM,GAAG,GAAG,QAAQ,CAAC,OAAO,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IAChD,IAAI,GAAG,KAAK,CAAC,CAAC,EAAE,CAAC;QACf,MAAM,YAAY,CAChB,mBAAmB,YAAY,6BAA6B,EAC5D,iBAAiB,UAAU,+CAA+C,CAC3E,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,GAAG,KAAK,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;AACpF,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,WAAW;IACzB,OAAO;QACL,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,KAAK;QACd,IAAI,EAAE,CAAC,IAAI,EAAE,GAAG,YAAY,IAAI,WAAW,EAAE,EAAE,KAAK,CAAC;KACtD,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,KAAc;IACnC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;AAC9E,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,cAAc,CAAC,QAA4B;IACzD,IAAI,QAAQ,GAA4B,EAAE,CAAC;IAC3C,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QACrD,IAAI,MAAe,CAAC;QACpB,IAAI,CAAC;YACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;QAChC,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,YAAY,CAChB,GAAG,QAAQ,uBAAuB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,cAAc,EAAE,EAC3F,uFAAuF,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3B,MAAM,YAAY,CAChB,GAAG,QAAQ,0BAA0B,EACrC,mEAAmE,CACpE,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,MAAM,CAAC;IACpB,CAAC;IAED,MAAM,OAAO,GAAG,QAAQ,CAAC,YAAY,CAAC,CAAC;IACvC,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,EAAE,CAAC;QACrD,MAAM,YAAY,CAChB,GAAG,QAAQ,gDAAgD,EAC3D,mEAAmE,CACpE,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,EAAE,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC,WAAW,CAAC,EAAE,WAAW,EAAE,EAAE,CAAC;IACpE,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,QAAQ,EAAE,UAAU,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC;AAC7E,CAAC;AAOD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,KAAgB,EAChB,IAAY,EACZ,KAAa;IAEb,MAAM,OAAO,GAAiB,EAAE,CAAC;IAEjC,MAAM,KAAK,CAAC,aAAa,CAAC,GAAG,IAAI,IAAI,cAAc,EAAE,CAAC,CAAC;IACvD,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,GAAG,IAAI,IAAI,UAAU,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC;IAE/D,KAAK,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,iBAAiB,EAAE,CAAC;QACjD,MAAM,IAAI,GAAG,GAAG,IAAI,IAAI,IAAI,EAAE,CAAC;QAC/B,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QAC7F,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,iBAAiB,CAAC,QAAQ,EAAE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,OAAO,GAAG,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACpG,OAAO,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,cAAc,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;IAEhE,OAAO,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC"}