@openape/apes 0.7.2 → 0.9.0

package/dist/chunk-B32ZQP5K.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/http.ts","../src/shapes/adapters.ts","../src/shapes/toml.ts","../src/shapes/audit.ts","../src/shapes/installer.ts","../src/shapes/registry.ts","../src/shapes/shell-parser.ts","../src/shapes/capabilities.ts","../src/shapes/parser.ts","../src/shapes/commands/explain.ts","../src/shapes/grants.ts","../src/shapes/config.ts","../src/shapes/http.ts","../src/shapes/request-builders.ts"],"sourcesContent":["import consola from 'consola'\nimport { getAuthToken, getIdpUrl, loadAuth, loadConfig, saveAuth } from './config'\n\nconst debug = process.argv.includes('--debug')\n\nexport class ApiError extends Error {\n  constructor(public statusCode: number, message: string, public problemDetails?: Record<string, unknown>) {\n    super(message)\n    this.name = 'ApiError'\n  }\n}\n\n// OIDC Discovery cache (one-time per CLI invocation)\nconst _discoveryCache: Record<string, Record<string, unknown>> = {}\n\nexport async function discoverEndpoints(idpUrl: string): Promise<Record<string, unknown>> {\n  if (_discoveryCache[idpUrl]) {\n    return _discoveryCache[idpUrl]\n  }\n\n  try {\n    const response = await fetch(`${idpUrl}/.well-known/openid-configuration`)\n    if (response.ok) {\n      const data = await response.json() as Record<string, unknown>\n      _discoveryCache[idpUrl] = data\n      return data\n    }\n  }\n  catch {}\n\n  // Return empty if discovery fails (graceful degradation)\n  _discoveryCache[idpUrl] = {}\n  return {}\n}\n\nexport async function getGrantsEndpoint(idpUrl: string): Promise<string> {\n  const disco = await discoverEndpoints(idpUrl)\n  return (disco.openape_grants_endpoint as string) || `${idpUrl}/api/grants`\n}\n\nexport async function getAgentChallengeEndpoint(idpUrl: string): Promise<string> {\n  const disco = await discoverEndpoints(idpUrl)\n  return (disco.ddisa_agent_challenge_endpoint as string) || `${idpUrl}/api/agent/challenge`\n}\n\nexport async function getAgentAuthenticateEndpoint(idpUrl: string): Promise<string> {\n  const disco = await discoverEndpoints(idpUrl)\n  return (disco.ddisa_agent_authenticate_endpoint as string) || `${idpUrl}/api/agent/authenticate`\n}\n\nexport async function getDelegationsEndpoint(idpUrl: string): Promise<string> {\n  const disco = await discoverEndpoints(idpUrl)\n  return (disco.openape_delegations_endpoint as string) || `${idpUrl}/api/delegations`\n}\n\n/**\n * Re-authenticate an agent using Ed25519 challenge-response.\n * Called automatically when the token is expired.\n */\nasync function refreshAgentToken(): Promise<string | null> {\n  const auth = loadAuth()\n  if (!auth)\n    return null\n\n  const config = loadConfig()\n  const keyPath = config.agent?.key\n  if (!keyPath)\n    return null\n\n  try {\n    const { readFileSync } = await import('node:fs')\n    const { sign } = await import('node:crypto')\n    const { homedir } = await import('node:os')\n    const { loadEd25519PrivateKey } = await import('./ssh-key.js')\n\n    const resolved = keyPath.replace(/^~/, homedir())\n    const keyContent = readFileSync(resolved, 'utf-8')\n    const privateKey = loadEd25519PrivateKey(keyContent)\n\n    const challengeUrl = await getAgentChallengeEndpoint(auth.idp)\n    const challengeResp = await fetch(challengeUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ agent_id: auth.email }),\n    })\n\n    if (!challengeResp.ok)\n      return null\n\n    const { challenge } = await challengeResp.json() as { challenge: string }\n    const { Buffer } = await import('node:buffer')\n    const signature = sign(null, Buffer.from(challenge), privateKey).toString('base64')\n\n    const authenticateUrl = await getAgentAuthenticateEndpoint(auth.idp)\n    const authResp = await fetch(authenticateUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/json' },\n      body: JSON.stringify({ agent_id: auth.email, challenge, signature }),\n    })\n\n    if (!authResp.ok)\n      return null\n\n    const { token, expires_in } = await authResp.json() as { token: string, expires_in: number }\n\n    saveAuth({\n      ...auth,\n      access_token: token,\n      expires_at: Math.floor(Date.now() / 1000) + (expires_in || 3600),\n    })\n\n    if (debug) {\n      consola.debug('Token refreshed via Ed25519 challenge-response')\n    }\n\n    return token\n  }\n  catch {\n    return null\n  }\n}\n\n/**\n * Refresh an OAuth2 access token using a stored refresh_token. Used for\n * PKCE/browser login sessions where no Ed25519 agent key is configured.\n *\n * Serialized via a file lock so concurrent apes/ape-shell invocations don't\n * both consume the same rotating refresh token (which would revoke the\n * entire family server-side).\n */\nasync function refreshOAuthToken(): Promise<string | null> {\n  const auth = loadAuth()\n  if (!auth?.refresh_token)\n    return null\n\n  const { acquireAuthLock, releaseAuthLock } = await import('./auth-lock.js')\n  const lock = await acquireAuthLock({ timeoutMs: 5000 })\n  if (!lock) {\n    // Another process is refreshing. It should have updated auth.json by now;\n    // re-read and return whatever fresh token is there (may still be null).\n    return getAuthToken()\n  }\n\n  try {\n    // Re-read auth.json inside the lock — another holder may already have\n    // refreshed while we were waiting, in which case we reuse the new token.\n    const latest = loadAuth()\n    if (latest?.expires_at && Date.now() / 1000 < latest.expires_at - 30)\n      return latest.access_token\n\n    const activeRefreshToken = latest?.refresh_token ?? auth.refresh_token\n    if (!activeRefreshToken)\n      return null\n\n    const disco = await discoverEndpoints(auth.idp)\n    const tokenEndpoint = (disco.token_endpoint as string) || `${auth.idp}/token`\n\n    const body = new URLSearchParams({\n      grant_type: 'refresh_token',\n      refresh_token: activeRefreshToken,\n    })\n\n    const resp = await fetch(tokenEndpoint, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: body.toString(),\n    })\n\n    if (!resp.ok) {\n      // Family may have been revoked server-side — clear refresh_token to\n      // prevent an infinite retry loop on every subsequent apes invocation.\n      if (resp.status === 400 || resp.status === 401) {\n        const base = latest ?? auth\n        saveAuth({ ...base, refresh_token: undefined })\n      }\n      return null\n    }\n\n    const tokens = await resp.json() as {\n      access_token: string\n      refresh_token?: string\n      expires_in?: number\n    }\n\n    const base = latest ?? auth\n    saveAuth({\n      ...base,\n      access_token: tokens.access_token,\n      refresh_token: tokens.refresh_token ?? base.refresh_token,\n      expires_at: Math.floor(Date.now() / 1000) + (tokens.expires_in || 300),\n    })\n\n    if (debug)\n      consola.debug('Token refreshed via OAuth refresh_token')\n\n    return tokens.access_token\n  }\n  finally {\n    await releaseAuthLock(lock)\n  }\n}\n\nexport async function apiFetch<T = unknown>(\n  path: string,\n  options: {\n    method?: string\n    body?: unknown\n    idp?: string\n    token?: string\n  } = {},\n): Promise<T> {\n  let token = options.token || getAuthToken()\n\n  // Auto-refresh: priority (1) ed25519 agent key, (2) OAuth refresh_token.\n  // Agent-key first because it is concurrency-safe — every challenge is\n  // independent server-side, so parallel ape-shell spawns don't race.\n  if (!token) {\n    token = await refreshAgentToken()\n    if (!token)\n      token = await refreshOAuthToken()\n  }\n\n  if (!token) {\n    throw new Error('Not authenticated (token expired). Run `apes login` first.')\n  }\n\n  let url: string\n  if (path.startsWith('http')) {\n    url = path\n  }\n  else {\n    const idp = options.idp || getIdpUrl()\n    if (!idp) {\n      throw new Error('No IdP URL configured. Run `apes login` first or pass --idp.')\n    }\n    url = `${idp}${path}`\n  }\n  const method = options.method || 'GET'\n  const headers: Record<string, string> = {\n    'Authorization': `Bearer ${token}`,\n    'Content-Type': 'application/json',\n  }\n\n  if (debug) {\n    consola.debug(`${method} ${url}`)\n    consola.debug(`Token: ${token.substring(0, 20)}...${token.substring(token.length - 10)}`)\n  }\n\n  const response = await fetch(url, {\n    method,\n    headers,\n    body: options.body ? JSON.stringify(options.body) : undefined,\n  })\n\n  if (debug) {\n    consola.debug(`Response: ${response.status} ${response.statusText}`)\n  }\n\n  if (!response.ok) {\n    const contentType = response.headers.get('content-type') || ''\n\n    // Parse RFC 7807 Problem Details\n    if (contentType.includes('application/problem+json') || contentType.includes('application/json')) {\n      try {\n        const problem = await response.json() as Record<string, unknown>\n        const message = (problem.detail as string) || (problem.title as string) || (problem.statusMessage as string) || (problem.message as string) || `${response.status} ${response.statusText}`\n        throw new ApiError(response.status, message, problem)\n      }\n      catch (e) {\n        if (e instanceof ApiError)\n          throw e\n      }\n    }\n\n    const text = await response.text()\n    throw new ApiError(response.status, text || `${response.status} ${response.statusText}`)\n  }\n\n  return response.json() as Promise<T>\n}\n","import { createHash } from 'node:crypto'\nimport { existsSync, readdirSync, readFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { basename, join } from 'node:path'\nimport type { LoadedAdapter } from './types.js'\nimport { parseAdapterToml } from './toml.js'\n\nfunction digest(content: string): string {\n  return `SHA-256:${createHash('sha256').update(content).digest('hex')}`\n}\n\nfunction adapterDirs(): string[] {\n  return [\n    join(process.cwd(), '.openape', 'shapes', 'adapters'),\n    join(homedir(), '.openape', 'shapes', 'adapters'),\n    join('/etc', 'openape', 'shapes', 'adapters'),\n  ]\n}\n\nfunction findByExecutable(executable: string): string | undefined {\n  for (const dir of adapterDirs()) {\n    if (!existsSync(dir))\n      continue\n    try {\n      const files = readdirSync(dir).filter(f => f.endsWith('.toml'))\n      for (const file of files) {\n        const path = join(dir, file)\n        const content = readFileSync(path, 'utf-8')\n        const match = content.match(/^\\s*executable\\s*=\\s*\"([^\"]+)\"/m)\n        if (match && match[1] === executable)\n          return path\n      }\n    }\n    catch {\n      // directory not readable\n    }\n  }\n  return undefined\n}\n\nexport function resolveAdapterPath(cliId: string, explicitPath?: string): string {\n  if (explicitPath) {\n    if (existsSync(explicitPath))\n      return explicitPath\n    throw new Error(`Adapter file not found: ${explicitPath}`)\n  }\n\n  // Try direct lookup by ID\n  const candidates = adapterDirs().map(dir => join(dir, `${cliId}.toml`))\n  const match = candidates.find(path => existsSync(path))\n  if (match)\n    return match\n\n  // Fallback: scan for adapter with matching executable name\n  const byExec = findByExecutable(cliId)\n  if (byExec)\n    return byExec\n\n  throw new Error(`No adapter found for ${cliId}`)\n}\n\nexport function loadAdapter(cliId: string, explicitPath?: string): LoadedAdapter {\n  const source = resolveAdapterPath(cliId, explicitPath)\n  const content = readFileSync(source, 'utf-8')\n  const adapter = parseAdapterToml(content)\n\n  // Accept if either the adapter ID or the executable matches the requested cliId\n  const idMatch = adapter.cli.id === cliId\n  const fileMatch = basename(source) === `${cliId}.toml`\n  const execMatch = adapter.cli.executable === cliId\n  if (!idMatch && !fileMatch && !execMatch)\n    throw new Error(`Adapter ${source} does not match requested CLI ${cliId}`)\n\n  return {\n    adapter,\n    source,\n    digest: digest(content),\n  }\n}\n\n/** Try to load an adapter locally, return null instead of throwing when not found. */\nexport function tryLoadAdapter(cliId: string, explicitPath?: string): LoadedAdapter | null {\n  try {\n    return loadAdapter(cliId, explicitPath)\n  }\n  catch {\n    return null\n  }\n}\n","import type { ShapesAdapter, ShapesOperation } from './types.js'\n\ninterface AdapterTomlFile {\n  schema?: string\n  cli?: ShapesAdapter['cli']\n  operation?: ShapesOperation[]\n}\n\nfunction parseKeyValue(line: string): { key: string, value: string } | null {\n  const eqIndex = line.indexOf('=')\n  if (eqIndex === -1)\n    return null\n  const key = line.slice(0, eqIndex).trim()\n  const value = line.slice(eqIndex + 1).trim()\n  if (!key || !value)\n    return null\n  return { key, value }\n}\n\nfunction parseTomlValue(raw: string): unknown {\n  const trimmed = raw.trim()\n\n  if (trimmed.startsWith('\"') && trimmed.endsWith('\"'))\n    return trimmed.slice(1, -1)\n  if (trimmed === 'true')\n    return true\n  if (trimmed === 'false')\n    return false\n  if (trimmed.startsWith('[') && trimmed.endsWith(']')) {\n    const inner = trimmed.slice(1, -1).trim()\n    if (!inner)\n      return []\n    return inner.split(',').map(value => value.trim().replace(/^\"|\"$/g, ''))\n  }\n\n  return trimmed\n}\n\nexport function parseAdapterToml(content: string): ShapesAdapter {\n  const result: AdapterTomlFile = {}\n  const operations: ShapesOperation[] = []\n  let currentSection: 'root' | 'cli' | 'operation' = 'root'\n  let currentEntry: Record<string, unknown> = {}\n\n  const flushOperation = () => {\n    if (currentSection === 'operation' && Object.keys(currentEntry).length > 0) {\n      operations.push(currentEntry as unknown as ShapesOperation)\n      currentEntry = {}\n    }\n  }\n\n  for (const rawLine of content.split('\\n')) {\n    const line = rawLine.trim()\n    if (!line || line.startsWith('#'))\n      continue\n\n    if (line === '[cli]') {\n      flushOperation()\n      currentSection = 'cli'\n      result.cli = {} as ShapesAdapter['cli']\n      continue\n    }\n\n    if (line === '[[operation]]') {\n      flushOperation()\n      currentSection = 'operation'\n      currentEntry = {}\n      continue\n    }\n\n    const kv = parseKeyValue(line)\n    if (!kv)\n      continue\n\n    const value = parseTomlValue(kv.value)\n    if (currentSection === 'root') {\n      ;(result as Record<string, unknown>)[kv.key] = value\n    }\n    else if (currentSection === 'cli') {\n      ;(result.cli as Record<string, unknown>)[kv.key] = value\n    }\n    else {\n      currentEntry[kv.key] = value\n    }\n  }\n\n  flushOperation()\n  result.operation = operations\n\n  if (result.schema !== 'openape-shapes/v1') {\n    throw new Error(`Unsupported adapter schema: ${result.schema ?? 'missing'}`)\n  }\n  if (!result.cli?.id || !result.cli.executable) {\n    throw new Error('Adapter is missing cli.id or cli.executable')\n  }\n  if (!result.operation?.length) {\n    throw new Error('Adapter must define at least one [[operation]] entry')\n  }\n\n  return {\n    schema: result.schema,\n    cli: {\n      id: String(result.cli.id),\n      executable: String(result.cli.executable),\n      ...(result.cli.audience ? { audience: String(result.cli.audience) } : {}),\n      ...(result.cli.version ? { version: String(result.cli.version) } : {}),\n    },\n    operations: result.operation.map((operation) => {\n      if (!Array.isArray(operation.command) || operation.command.some(token => typeof token !== 'string')) {\n        throw new Error(`Operation ${String(operation.id ?? '<unknown>')} is missing command[]`)\n      }\n      if (!Array.isArray(operation.resource_chain) || operation.resource_chain.some(token => typeof token !== 'string')) {\n        throw new Error(`Operation ${String(operation.id ?? '<unknown>')} is missing resource_chain[]`)\n      }\n      if (typeof operation.id !== 'string' || typeof operation.display !== 'string' || typeof operation.action !== 'string') {\n        throw new TypeError('Operation must define id, display, and action')\n      }\n      return {\n        id: operation.id,\n        command: operation.command as string[],\n        ...(Array.isArray(operation.positionals) ? { positionals: operation.positionals as string[] } : {}),\n        ...(Array.isArray(operation.required_options) ? { required_options: operation.required_options as string[] } : {}),\n        display: operation.display,\n        action: operation.action,\n        risk: (operation.risk as ShapesOperation['risk']) || 'low',\n        resource_chain: operation.resource_chain as string[],\n        ...(operation.exact_command !== undefined ? { exact_command: Boolean(operation.exact_command) } : {}),\n      }\n    }),\n  }\n}\n","import { appendFileSync, existsSync, mkdirSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { dirname, join } from 'node:path'\n\n/** Single audit log entry. Always includes a timestamp and an action string. */\nexport interface AuditEntry {\n  action: string\n  timestamp: number\n  [key: string]: unknown\n}\n\nfunction auditPath(): string {\n  return join(homedir(), '.config', 'apes', 'audit.jsonl')\n}\n\n/**\n * Append a single entry to the audit log at ~/.config/apes/audit.jsonl.\n * Failures are swallowed — the audit log should never break the actual flow.\n */\nexport function appendAuditLog(entry: { action: string, timestamp?: number } & Record<string, unknown>): void {\n  const full: AuditEntry = {\n    ...entry,\n    action: entry.action,\n    timestamp: entry.timestamp ?? Date.now(),\n  }\n  const path = auditPath()\n  const dir = dirname(path)\n  try {\n    if (!existsSync(dir)) mkdirSync(dir, { recursive: true })\n    appendFileSync(path, `${JSON.stringify(full)}\\n`)\n  }\n  catch {\n    // intentionally ignored — audit log must never break the flow\n  }\n}\n","import { createHash } from 'node:crypto'\nimport { existsSync, mkdirSync, readdirSync, readFileSync, unlinkSync, writeFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport type { RegistryEntry } from './types.js'\n\nfunction adapterDir(local: boolean): string {\n  const base = local ? process.cwd() : homedir()\n  return join(base, '.openape', 'shapes', 'adapters')\n}\n\nfunction adapterPath(id: string, local: boolean): string {\n  return join(adapterDir(local), `${id}.toml`)\n}\n\nfunction sha256(content: string): string {\n  return `SHA-256:${createHash('sha256').update(content).digest('hex')}`\n}\n\nexport interface InstallResult {\n  id: string\n  path: string\n  digest: string\n  updated: boolean\n}\n\nexport async function installAdapter(entry: RegistryEntry, options: { local?: boolean } = {}): Promise<InstallResult> {\n  const local = options.local ?? false\n  const dest = adapterPath(entry.id, local)\n  const dir = adapterDir(local)\n\n  const response = await fetch(entry.download_url)\n  if (!response.ok)\n    throw new Error(`Failed to download adapter ${entry.id}: ${response.status} ${response.statusText}`)\n\n  const content = await response.text()\n  const digest = sha256(content)\n\n  if (digest !== entry.digest)\n    throw new Error(`Digest mismatch for ${entry.id}: expected ${entry.digest}, got ${digest}`)\n\n  const updated = existsSync(dest)\n\n  if (!existsSync(dir))\n    mkdirSync(dir, { recursive: true })\n\n  writeFileSync(dest, content)\n\n  return { id: entry.id, path: dest, digest, updated }\n}\n\nexport function getInstalledDigest(id: string, local: boolean): string | null {\n  const path = adapterPath(id, local)\n  if (!existsSync(path))\n    return null\n\n  const content = readFileSync(path, 'utf-8')\n  return sha256(content)\n}\n\nexport function isInstalled(id: string, local: boolean): boolean {\n  return existsSync(adapterPath(id, local))\n}\n\nexport function getInstalledPath(id: string, local: boolean): string {\n  return adapterPath(id, local)\n}\n\nexport function removeAdapter(id: string, local: boolean): boolean {\n  const path = adapterPath(id, local)\n  if (!existsSync(path))\n    return false\n  unlinkSync(path)\n  return true\n}\n\nexport interface ConflictingAdapter {\n  file: string\n  path: string\n  adapterId: string\n  executable: string\n}\n\nexport function findConflictingAdapters(executable: string, excludeId: string): ConflictingAdapter[] {\n  const conflicts: ConflictingAdapter[] = []\n  const dirs = [\n    join(process.cwd(), '.openape', 'shapes', 'adapters'),\n    join(homedir(), '.openape', 'shapes', 'adapters'),\n  ]\n\n  for (const dir of dirs) {\n    if (!existsSync(dir))\n      continue\n    try {\n      for (const file of readdirSync(dir).filter(f => f.endsWith('.toml'))) {\n        const path = join(dir, file)\n        const content = readFileSync(path, 'utf-8')\n        const execMatch = content.match(/^\\s*executable\\s*=\\s*\"([^\"]+)\"/m)\n        const idMatch = content.match(/^\\s*id\\s*=\\s*\"([^\"]+)\"/m)\n        if (execMatch?.[1] === executable && idMatch?.[1] !== excludeId) {\n          conflicts.push({ file, path, adapterId: idMatch?.[1] ?? file, executable })\n        }\n      }\n    }\n    catch {\n      // directory not readable\n    }\n  }\n\n  return conflicts\n}\n","import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport type { RegistryEntry, RegistryIndex } from './types.js'\n\nconst REGISTRY_URL = process.env.SHAPES_REGISTRY_URL\n  ?? 'https://raw.githubusercontent.com/openape-ai/shapes-registry/main/registry.json'\n\nconst CACHE_TTL_MS = 60 * 60 * 1000 // 1 hour\n\nfunction cacheDir(): string {\n  return join(homedir(), '.openape', 'shapes', 'cache')\n}\n\nfunction cachePath(): string {\n  return join(cacheDir(), 'registry.json')\n}\n\nfunction readCache(): RegistryIndex | null {\n  const path = cachePath()\n  if (!existsSync(path))\n    return null\n\n  try {\n    const raw = readFileSync(path, 'utf-8')\n    const stat = JSON.parse(raw) as RegistryIndex & { _cached_at?: number }\n    if (stat._cached_at && Date.now() - stat._cached_at > CACHE_TTL_MS)\n      return null\n    return stat\n  }\n  catch {\n    return null\n  }\n}\n\nfunction writeCache(index: RegistryIndex): void {\n  const dir = cacheDir()\n  if (!existsSync(dir))\n    mkdirSync(dir, { recursive: true })\n\n  writeFileSync(cachePath(), JSON.stringify({ ...index, _cached_at: Date.now() }, null, 2))\n}\n\nexport async function fetchRegistry(forceRefresh = false): Promise<RegistryIndex> {\n  if (!forceRefresh) {\n    const cached = readCache()\n    if (cached)\n      return cached\n  }\n\n  const response = await fetch(REGISTRY_URL)\n  if (!response.ok)\n    throw new Error(`Failed to fetch registry: ${response.status} ${response.statusText}`)\n\n  const index = await response.json() as RegistryIndex\n  writeCache(index)\n  return index\n}\n\nexport function searchAdapters(index: RegistryIndex, query: string): RegistryEntry[] {\n  const q = query.toLowerCase()\n  return index.adapters.filter(a =>\n    a.id.includes(q)\n    || a.name.toLowerCase().includes(q)\n    || a.description.toLowerCase().includes(q)\n    || a.tags.some(t => t.includes(q))\n    || a.category.includes(q),\n  )\n}\n\n/**\n * Look up a registry entry by its id or its executable field. This lets callers\n * pass either the registry id (\"o365\") or the binary name (\"o365-cli\"); most\n * adapters have id === executable, but the two can diverge.\n */\nexport function findAdapter(index: RegistryIndex, idOrExecutable: string): RegistryEntry | undefined {\n  return index.adapters.find(\n    a => a.id === idOrExecutable || a.executable === idOrExecutable,\n  )\n}\n","import { basename } from 'node:path'\nimport consola from 'consola'\nimport { parse as shellParse } from 'shell-quote'\nimport { loadAdapter, tryLoadAdapter } from './adapters.js'\nimport { installAdapter } from './installer.js'\nimport { fetchRegistry, findAdapter } from './registry.js'\nimport { appendAuditLog } from './audit.js'\nimport type { LoadedAdapter } from './types.js'\n\n/** A parsed shell command string with the executable and its argv extracted. */\nexport interface ParsedShellCommand {\n  /** The program to run (first token, e.g. \"rm\") */\n  executable: string\n  /** Remaining tokens after the executable (e.g. [\"-f\", \"/tmp/foo.txt\"]) */\n  argv: string[]\n  /**\n   * true if the command contains compound operators (&&, ||, ;, |),\n   * subshells ($(...)), or backticks. These cannot be safely handled\n   * by the adapter mode and must fall back to the generic shell grant flow.\n   */\n  isCompound: boolean\n  /** The original command string for display/logging */\n  raw: string\n}\n\nconst COMPOUND_OPERATORS = new Set(['&&', '||', ';', '|', '&', '>', '>>', '<'])\n\ntype ShellQuoteToken = string | { op: string } | { comment: string } | { pattern: string }\n\n/**\n * Parse a shell command string like `rm /tmp/foo.txt` or `git commit -m \"hello\"` into\n * its executable and argv. Uses `shell-quote` to handle quoting correctly.\n *\n * Returns null for empty/whitespace-only input.\n */\nexport function parseShellCommand(raw: string): ParsedShellCommand | null {\n  const trimmed = raw.trim()\n  if (trimmed.length === 0) return null\n\n  let tokens: ShellQuoteToken[]\n  try {\n    tokens = shellParse(trimmed) as ShellQuoteToken[]\n  }\n  catch {\n    return null\n  }\n\n  // Detect compound operators and subshells\n  const hasShellExpansion = /\\$\\(|`/.test(trimmed)\n  const hasOperatorToken = tokens.some(t => typeof t === 'object' && t !== null && 'op' in t && COMPOUND_OPERATORS.has(t.op))\n  const isCompound = hasShellExpansion || hasOperatorToken\n\n  // Extract leading string tokens up to the first operator object\n  const stringTokens: string[] = []\n  for (const t of tokens) {\n    if (typeof t === 'string') {\n      stringTokens.push(t)\n    }\n    else {\n      break\n    }\n  }\n\n  if (stringTokens.length === 0) return null\n\n  return {\n    executable: stringTokens[0]!,\n    argv: stringTokens.slice(1),\n    isCompound,\n    raw: trimmed,\n  }\n}\n\n/**\n * Extract the command string from an `apes run --shell -- bash -c \"…\"` argv.\n * Returns null if the argv does not follow that shape.\n */\nexport function extractShellCommandString(command: string[]): string | null {\n  if (command.length < 3) return null\n  if (command[0] !== 'bash' && command[0] !== 'sh') return null\n  if (command[1] !== '-c') return null\n  // Everything after `-c` is the quoted command string\n  return command.slice(2).join(' ')\n}\n\n/**\n * Load an adapter for the given CLI id. If the adapter is not installed locally,\n * try to fetch it from the shapes registry and auto-install it.\n *\n * Returns null when no adapter exists in either location, or when any step fails.\n * Failures are logged but never thrown — callers should fall back to the generic flow.\n */\nexport async function loadOrInstallAdapter(cliId: string): Promise<LoadedAdapter | null> {\n  // Absolute or relative paths like `/usr/local/bin/o365-cli` must be reduced\n  // to the binary name before any lookup — neither the local file scan nor the\n  // registry knows how to match a path.\n  const lookupId = basename(cliId)\n\n  // 1. Try local\n  const local = tryLoadAdapter(lookupId)\n  if (local) return local\n\n  // 2. Remote registry lookup + auto-install.\n  // findAdapter matches both `id` and `executable`, so a bare binary name\n  // like `o365-cli` resolves to a registry entry whose id is `o365`.\n  try {\n    const index = await fetchRegistry()\n    const entry = findAdapter(index, lookupId)\n    if (!entry) return null\n\n    consola.info(`Installing shapes adapter for ${entry.id} from registry...`)\n    await installAdapter(entry, { local: false })\n    appendAuditLog({\n      action: 'adapter-auto-install',\n      cli_id: entry.id,\n      digest: entry.digest,\n      source: 'ape-shell',\n    })\n\n    // Adapters are installed under their registry `id` — always reload by id\n    // even if the caller passed the executable name.\n    return tryLoadAdapter(entry.id)\n  }\n  catch (err) {\n    consola.debug(`ape-shell adapter auto-install failed for ${lookupId}:`, err)\n    return null\n  }\n}\n\n// Re-export loadAdapter so callers can import everything from one module\nexport { loadAdapter }\n","import type { OpenApeCliAuthorizationDetail, OpenApeCliResourceRef } from '@openape/core'\nimport { canonicalizeCliPermission } from '@openape/grants'\nimport type { LoadedAdapter, ResolvedCapability, ShapesOperation } from './types.js'\n\ninterface ParsedOperationChainEntry {\n  resource: string\n  selectorKeys: string[]\n}\n\nfunction parseOperationChainEntry(entry: string): ParsedOperationChainEntry {\n  const [resource, selectorSpec = '*'] = entry.split(':', 2)\n  if (!resource) {\n    throw new Error(`Invalid resource chain entry: ${entry}`)\n  }\n\n  if (selectorSpec === '*') {\n    return { resource, selectorKeys: [] }\n  }\n\n  const selectorKeys = selectorSpec.split(',')\n    .map((segment) => {\n      const [key] = segment.split('=', 2)\n      if (!key)\n        throw new Error(`Invalid selector segment: ${segment}`)\n      return key\n    })\n\n  return { resource, selectorKeys }\n}\n\nfunction operationChain(operation: ShapesOperation): ParsedOperationChainEntry[] {\n  return operation.resource_chain.map(parseOperationChainEntry)\n}\n\nfunction knownSelectorKeys(operations: ShapesOperation[], resource: string): string[] {\n  const keys = new Set<string>()\n  for (const operation of operations) {\n    for (const entry of operationChain(operation)) {\n      if (entry.resource !== resource)\n        continue\n      for (const key of entry.selectorKeys) {\n        keys.add(key)\n      }\n    }\n  }\n  return Array.from(keys).sort()\n}\n\nfunction parseResourceSelector(raw: string): { resource: string, key: string, value: string } {\n  const [lhs, value] = raw.split('=', 2)\n  if (!lhs || !value) {\n    throw new Error(`Invalid selector: ${raw}`)\n  }\n\n  const [resource, key] = lhs.split('.', 2)\n  if (!resource || !key) {\n    throw new Error(`Selectors must be in resource.key=value form: ${raw}`)\n  }\n\n  return { resource, key, value }\n}\n\nfunction formatSelector(selector?: Record<string, string>): string {\n  if (!selector || Object.keys(selector).length === 0)\n    return '*'\n  return Object.entries(selector)\n    .sort(([a], [b]) => a.localeCompare(b))\n    .map(([key, value]) => `${key}=${value}`)\n    .join(',')\n}\n\nfunction summarizeDetail(detail: OpenApeCliAuthorizationDetail): string {\n  const chain = detail.resource_chain\n    .map(resource => `${resource.resource}[${formatSelector(resource.selector)}]`)\n    .join(' -> ')\n  return `Allow ${detail.action} on ${detail.cli_id} ${chain}`\n}\n\nexport function resolveCapabilityRequest(\n  loaded: LoadedAdapter,\n  params: {\n    resources: string[]\n    selectors?: string[]\n    actions: string[]\n  },\n): ResolvedCapability {\n  if (params.resources.length === 0) {\n    throw new Error('At least one --resource is required')\n  }\n  if (params.actions.length === 0) {\n    throw new Error('At least one --action is required')\n  }\n\n  const selectorMap = new Map<string, Record<string, string>>()\n  for (const rawSelector of params.selectors ?? []) {\n    const { resource, key, value } = parseResourceSelector(rawSelector)\n    const current = selectorMap.get(resource) ?? {}\n    current[key] = value\n    selectorMap.set(resource, current)\n  }\n\n  const resource_chain: OpenApeCliResourceRef[] = params.resources.map((resource) => {\n    const selector = selectorMap.get(resource)\n    const knownKeys = knownSelectorKeys(loaded.adapter.operations, resource)\n    if (selector) {\n      for (const key of Object.keys(selector)) {\n        if (!knownKeys.includes(key)) {\n          throw new Error(`Unknown selector ${resource}.${key} for adapter ${loaded.adapter.cli.id}`)\n        }\n      }\n    }\n    return selector && Object.keys(selector).length > 0 ? { resource, selector } : { resource }\n  })\n\n  const requestedSequence = params.resources.join('\\0')\n  const matchingOperations = loaded.adapter.operations.filter((operation) => {\n    const sequence = operationChain(operation).map(entry => entry.resource).join('\\0')\n    return sequence === requestedSequence || sequence.startsWith(`${requestedSequence}\\0`)\n  })\n\n  if (matchingOperations.length === 0) {\n    throw new Error(`No adapter operation supports resource chain: ${params.resources.join(' -> ')}`)\n  }\n\n  const details = params.actions.map((action) => {\n    const matchingActionOps = matchingOperations.filter(operation => operation.action === action)\n    if (matchingActionOps.length === 0) {\n      throw new Error(`Action ${action} is not valid for resource chain: ${params.resources.join(' -> ')}`)\n    }\n\n    const exact_command = matchingActionOps.every(operation => operation.exact_command === true)\n    const risks = ['low', 'medium', 'high', 'critical'] as const\n    const risk = matchingActionOps.reduce<typeof risks[number]>((current, operation) => {\n      return risks.indexOf(operation.risk) > risks.indexOf(current) ? operation.risk : current\n    }, 'low')\n\n    const detail: OpenApeCliAuthorizationDetail = {\n      type: 'openape_cli',\n      cli_id: loaded.adapter.cli.id,\n      operation_id: `capability.${action}`,\n      resource_chain,\n      action,\n      permission: '',\n      display: '',\n      risk,\n      ...(exact_command ? { constraints: { exact_command: true } } : {}),\n    }\n    detail.permission = canonicalizeCliPermission(detail)\n    detail.display = summarizeDetail(detail)\n    return detail\n  })\n\n  return {\n    adapter: loaded.adapter,\n    source: loaded.source,\n    digest: loaded.digest,\n    executable: loaded.adapter.cli.executable,\n    details,\n    executionContext: {\n      adapter_id: loaded.adapter.cli.id,\n      adapter_version: loaded.adapter.cli.version ?? loaded.adapter.schema,\n      adapter_digest: loaded.digest,\n      resolved_executable: loaded.adapter.cli.executable,\n      context_bindings: Object.fromEntries(\n        Array.from(selectorMap.entries()).flatMap(([resource, selector]) =>\n          Object.entries(selector).map(([key, value]) => [`${resource}.${key}`, value] as const),\n        ),\n      ),\n    },\n    permissions: details.map(detail => detail.permission),\n    summary: details.map(detail => detail.display).join('; '),\n  }\n}\n","import type { OpenApeCliAuthorizationDetail, OpenApeCliResourceRef } from '@openape/core'\nimport { canonicalizeCliPermission, computeArgvHash } from '@openape/grants'\nimport type { LoadedAdapter, ResolvedCommand, ShapesOperation } from './types.js'\n\nfunction parseOptionArgs(tokens: string[], valueOptions?: string[]): { options: Record<string, string>, positionals: string[] } {\n  const options: Record<string, string> = {}\n  const positionals: string[] = []\n  const takesValue = new Set(valueOptions ?? [])\n\n  for (let index = 0; index < tokens.length; index += 1) {\n    const token = tokens[index]!\n\n    if (token.startsWith('--')) {\n      // Long option: --name value or --name=value\n      const stripped = token.slice(2)\n      const eqIndex = stripped.indexOf('=')\n      if (eqIndex >= 0) {\n        options[stripped.slice(0, eqIndex)] = stripped.slice(eqIndex + 1)\n        continue\n      }\n\n      const next = tokens[index + 1]\n      if (next && !next.startsWith('-')) {\n        options[stripped] = next\n        index += 1\n        continue\n      }\n\n      options[stripped] = 'true'\n    }\n    else if (token.startsWith('-') && token.length > 1 && !/^-\\d/.test(token)) {\n      // Short option: -name value, -f value, or -l (boolean)\n      const key = token.slice(1)\n\n      if (key.length === 1 && !takesValue.has(key)) {\n        // Single-char flag not in required_options → boolean\n        options[key] = 'true'\n      }\n      else {\n        // Multi-char option (-name) or known value option (-f) → consume next as value\n        const next = tokens[index + 1]\n        if (next && !next.startsWith('-')) {\n          options[key] = next\n          index += 1\n        }\n        else {\n          options[key] = 'true'\n        }\n      }\n    }\n    else {\n      positionals.push(token)\n    }\n  }\n\n  return { options, positionals }\n}\n\nfunction resolveBindingToken(binding: string, bindings: Record<string, string>): string {\n  const match = binding.match(/^\\{([^}|]+)(?:\\|([^}]+))?\\}$/)\n  if (!match)\n    return binding\n\n  const [, name, transform] = match\n  const value = bindings[name]\n  if (!value)\n    throw new Error(`Missing binding: ${name}`)\n  if (!transform)\n    return value\n\n  if (transform === 'owner' || transform === 'name') {\n    const [owner, repo] = value.split('/')\n    if (!owner || !repo)\n      throw new Error(`Binding ${name} must be in owner/name form`)\n    return transform === 'owner' ? owner : repo\n  }\n\n  throw new Error(`Unsupported binding transform: ${transform}`)\n}\n\nfunction renderTemplate(template: string, bindings: Record<string, string>): string {\n  return template.replace(/\\{([^}]+)\\}/g, (_, expression: string) => resolveBindingToken(`{${expression}}`, bindings))\n}\n\nfunction parseResourceChain(chain: string[], bindings: Record<string, string>): OpenApeCliResourceRef[] {\n  return chain.map((entry) => {\n    const [resource, selectorSpec = '*'] = entry.split(':', 2)\n    if (!resource)\n      throw new Error(`Invalid resource chain entry: ${entry}`)\n\n    if (selectorSpec === '*') {\n      return { resource }\n    }\n\n    const selector = Object.fromEntries(\n      selectorSpec.split(',').map((segment) => {\n        const [key, rawValue] = segment.split('=', 2)\n        if (!key || !rawValue)\n          throw new Error(`Invalid selector segment: ${segment}`)\n        return [key, renderTemplate(rawValue, bindings)]\n      }),\n    )\n\n    return { resource, selector }\n  })\n}\n\nfunction matchOperation(operation: ShapesOperation, argv: string[]): Record<string, string> | null {\n  if (argv.length < operation.command.length)\n    return null\n\n  const prefix = argv.slice(0, operation.command.length)\n  if (prefix.join('\\0') !== operation.command.join('\\0'))\n    return null\n\n  const remainder = argv.slice(operation.command.length)\n  const { options, positionals } = parseOptionArgs(remainder, operation.required_options)\n\n  const expectedPositionals = operation.positionals ?? []\n  if (positionals.length !== expectedPositionals.length)\n    return null\n\n  for (const option of operation.required_options ?? []) {\n    if (!options[option])\n      return null\n  }\n\n  const bindings: Record<string, string> = { ...options }\n  expectedPositionals.forEach((name, index) => {\n    bindings[name] = positionals[index]!\n  })\n  return bindings\n}\n\nfunction expandCombinedFlags(argv: string[]): string[] {\n  return argv.flatMap((token) => {\n    // Expand -rl into -r, -l (only single-letter combined flags)\n    if (token.startsWith('-') && !token.startsWith('--') && token.length > 2 && /^-[a-z]+$/i.test(token)) {\n      return Array.from(token.slice(1), c => `-${c}`)\n    }\n    return [token]\n  })\n}\n\nfunction tryMatch(operations: ShapesOperation[], argv: string[]) {\n  return operations.flatMap((operation) => {\n    try {\n      const bindings = matchOperation(operation, argv)\n      return bindings ? [{ operation, bindings }] : []\n    }\n    catch {\n      return []\n    }\n  })\n}\n\nexport async function resolveCommand(loaded: LoadedAdapter, fullArgv: string[]): Promise<ResolvedCommand> {\n  const [executable, ...commandArgv] = fullArgv\n  if (!executable) {\n    throw new Error('Missing wrapped command')\n  }\n  if (executable !== loaded.adapter.cli.executable) {\n    throw new Error(`Adapter ${loaded.adapter.cli.id} expects executable ${loaded.adapter.cli.executable}, got ${executable}`)\n  }\n\n  // Pass 1: exact match\n  let matches = tryMatch(loaded.adapter.operations, commandArgv)\n\n  // Pass 2: try with expanded combined flags (e.g. -rl → -r -l)\n  if (matches.length === 0) {\n    const expanded = expandCombinedFlags(commandArgv)\n    if (expanded.length !== commandArgv.length) {\n      matches = tryMatch(loaded.adapter.operations, expanded)\n    }\n  }\n\n  if (matches.length === 0) {\n    throw new Error(`No adapter operation matched: ${fullArgv.join(' ')}`)\n  }\n  if (matches.length > 1) {\n    // Prefer the most specific match (longest command prefix)\n    matches.sort((a, b) => b.operation.command.length - a.operation.command.length)\n    matches = [matches[0]!]\n  }\n\n  const { operation, bindings } = matches[0]!\n  const resource_chain = parseResourceChain(operation.resource_chain, bindings)\n  const detail: OpenApeCliAuthorizationDetail = {\n    type: 'openape_cli',\n    cli_id: loaded.adapter.cli.id,\n    operation_id: operation.id,\n    resource_chain,\n    action: operation.action,\n    permission: '',\n    display: renderTemplate(operation.display, bindings),\n    risk: operation.risk,\n    ...(operation.exact_command ? { constraints: { exact_command: true } } : {}),\n  }\n  detail.permission = canonicalizeCliPermission(detail)\n\n  return {\n    adapter: loaded.adapter,\n    source: loaded.source,\n    digest: loaded.digest,\n    executable,\n    commandArgv,\n    bindings,\n    detail,\n    executionContext: {\n      argv: fullArgv,\n      argv_hash: await computeArgvHash(fullArgv),\n      adapter_id: loaded.adapter.cli.id,\n      adapter_version: loaded.adapter.cli.version ?? loaded.adapter.schema,\n      adapter_digest: loaded.digest,\n      resolved_executable: executable,\n      context_bindings: bindings,\n    },\n    permission: detail.permission,\n  }\n}\n","import { defineCommand } from 'citty'\nimport { loadAdapter } from '../adapters.js'\nimport { resolveCommand } from '../parser.js'\n\nexport const explainCommand = defineCommand({\n  meta: {\n    name: 'explain',\n    description: 'Show what permission a wrapped command would need',\n  },\n  args: {\n    adapter: {\n      type: 'string',\n      description: 'Explicit path to adapter TOML file',\n    },\n    _: {\n      type: 'positional',\n      description: 'Wrapped command (after --)',\n      required: false,\n    },\n  },\n  async run({ rawArgs }) {\n    const command = extractWrappedCommand(rawArgs ?? [])\n    if (command.length === 0)\n      throw new Error('Missing wrapped command. Usage: shapes explain [--adapter <file>] -- <cli> ...')\n\n    const adapterOpt = extractOption(rawArgs ?? [], 'adapter')\n    const loaded = loadAdapter(command[0]!, adapterOpt)\n    const resolved = await resolveCommand(loaded, command)\n\n    process.stdout.write(`${JSON.stringify({\n      adapter: resolved.adapter.cli.id,\n      source: resolved.source,\n      operation: resolved.detail.operation_id,\n      display: resolved.detail.display,\n      permission: resolved.permission,\n      resource_chain: resolved.detail.resource_chain,\n      exact_command: resolved.detail.constraints?.exact_command ?? false,\n      adapter_digest: resolved.digest,\n    }, null, 2)}\\n`)\n  },\n})\n\nexport function extractWrappedCommand(args: string[]): string[] {\n  const delimiter = args.indexOf('--')\n  return delimiter >= 0 ? args.slice(delimiter + 1) : []\n}\n\nexport function extractOption(args: string[], name: string): string | undefined {\n  const delimiter = args.indexOf('--')\n  const optionArgs = delimiter >= 0 ? args.slice(0, delimiter) : args\n  const index = optionArgs.indexOf(`--${name}`)\n  if (index >= 0 && index + 1 < optionArgs.length)\n    return optionArgs[index + 1]\n  return undefined\n}\n","import type { OpenApeCliAuthorizationDetail, OpenApeGrant } from '@openape/core'\nimport { computeCmdHash } from '@openape/core'\nimport { cliAuthorizationDetailCovers, verifyAuthzJWT } from '@openape/grants'\nimport { execFileSync } from 'node:child_process'\nimport { hostname } from 'node:os'\nimport consola from 'consola'\nimport { getRequesterIdentity } from './config.js'\nimport type { ResolvedCommand } from './types.js'\nimport { apiFetch, discoverEndpoints, getGrantsEndpoint } from './http.js'\n\nfunction decodePayload(token: string): Record<string, unknown> {\n  const [, payload] = token.split('.')\n  if (!payload)\n    throw new Error('Invalid JWT')\n  return JSON.parse(Buffer.from(payload, 'base64url').toString('utf-8')) as Record<string, unknown>\n}\n\ninterface SimilarGrantsInfo {\n  similar_grants: Array<{ grant: { id: string }, similar_detail_indices: number[] }>\n  widened_details: Array<{ permission: string }>\n  merged_details: Array<{ permission: string }>\n}\n\nexport async function createShapesGrant(\n  resolved: ResolvedCommand,\n  params: {\n    idp: string\n    approval: 'once' | 'timed' | 'always'\n    reason?: string\n  },\n): Promise<{ id: string, status: string, similar_grants?: SimilarGrantsInfo }> {\n  const grantsEndpoint = await getGrantsEndpoint(params.idp)\n  const requester = getRequesterIdentity()\n  if (!requester) {\n    throw new Error('No requester identity available. Run `apes login` first.')\n  }\n  return apiFetch<{ id: string, status: string, similar_grants?: SimilarGrantsInfo }>(grantsEndpoint, {\n    method: 'POST',\n    idp: params.idp,\n    body: {\n      requester,\n      target_host: hostname(),\n      audience: resolved.adapter.cli.audience ?? 'shapes',\n      grant_type: params.approval,\n      command: resolved.executionContext.argv,\n      reason: params.reason ?? resolved.detail.display,\n      permissions: [resolved.permission],\n      authorization_details: [resolved.detail],\n      execution_context: resolved.executionContext,\n    },\n  })\n}\n\nexport async function waitForGrantStatus(idp: string, grantId: string): Promise<'approved' | 'denied' | 'revoked'> {\n  const grantsEndpoint = await getGrantsEndpoint(idp)\n  const deadline = Date.now() + 300_000\n\n  while (Date.now() < deadline) {\n    const grant = await apiFetch<{ status: 'pending' | 'approved' | 'denied' | 'revoked' }>(`${grantsEndpoint}/${grantId}`, { idp })\n    if (grant.status === 'approved' || grant.status === 'denied' || grant.status === 'revoked')\n      return grant.status\n    await new Promise(resolve => setTimeout(resolve, 3000))\n  }\n\n  throw new Error('Timed out waiting for grant approval')\n}\n\nexport async function fetchGrantToken(idp: string, grantId: string): Promise<string> {\n  const grantsEndpoint = await getGrantsEndpoint(idp)\n  const response = await apiFetch<{ authz_jwt: string }>(`${grantsEndpoint}/${grantId}/token`, {\n    method: 'POST',\n    idp,\n  })\n  return response.authz_jwt\n}\n\nfunction grantedCliDetails(claims: Record<string, unknown>): OpenApeCliAuthorizationDetail[] {\n  const details = claims.authorization_details\n  if (!Array.isArray(details))\n    return []\n\n  return details.filter((detail): detail is OpenApeCliAuthorizationDetail =>\n    typeof detail === 'object'\n    && detail !== null\n    && (detail as Record<string, unknown>).type === 'openape_cli',\n  )\n}\n\nfunction hasStructuredCliGrant(claims: Record<string, unknown>): boolean {\n  return grantedCliDetails(claims).length > 0\n}\n\n/**\n * Verifies a grant token against the resolved command and marks the grant\n * as consumed on the IdP. Does NOT execute anything — callers that want\n * the one-shot behavior should use `verifyAndExecute`, callers that want\n * to run the command themselves (e.g. the interactive REPL piping through\n * a persistent bash pty) should call this and then do their own execution.\n *\n * Split out so the interactive shell can re-use the verify + consume path\n * without being forced into the `execFileSync`-based one-shot execution.\n */\nexport async function verifyAndConsume(token: string, resolved: ResolvedCommand): Promise<void> {\n  const payload = decodePayload(token)\n  const issuer = String(payload.iss ?? '')\n  if (!issuer)\n    throw new Error('Grant token is missing issuer')\n\n  const discovery = await discoverEndpoints(issuer)\n  const jwksUri = String(discovery.jwks_uri ?? `${issuer}/.well-known/jwks.json`)\n  const result = await verifyAuthzJWT(token, {\n    expectedIss: issuer,\n    expectedAud: resolved.adapter.cli.audience ?? 'shapes',\n    jwksUri,\n  })\n\n  if (!result.valid || !result.claims) {\n    throw new Error(result.error ?? 'Grant verification failed')\n  }\n\n  const claims = result.claims\n  const details = grantedCliDetails(claims as unknown as Record<string, unknown>)\n\n  if (claims.execution_context?.adapter_digest && claims.execution_context.adapter_digest !== resolved.digest) {\n    throw new Error('Adapter digest mismatch')\n  }\n\n  if (!hasStructuredCliGrant(claims as unknown as Record<string, unknown>)) {\n    const argv = resolved.executionContext.argv\n    if (!argv?.length) {\n      throw new Error('Resolved command is missing argv')\n    }\n    const expectedCmdHash = await computeCmdHash(argv.join(' '))\n    if (claims.command?.join('\\0') !== argv.join('\\0')) {\n      throw new Error('Granted command does not match current argv')\n    }\n    if (claims.cmd_hash && claims.cmd_hash !== expectedCmdHash) {\n      throw new Error('Granted command does not match current argv')\n    }\n    if (!claims.command?.length && !claims.cmd_hash) {\n      throw new Error('Grant is not a structured CLI grant and is missing command binding')\n    }\n  }\n  else {\n    if (!details.some(detail => cliAuthorizationDetailCovers(detail, resolved.detail))) {\n      throw new Error(`Grant does not cover required permission: ${resolved.permission}`)\n    }\n\n    const exactRequired = details.some(detail =>\n      cliAuthorizationDetailCovers(detail, resolved.detail) && detail.constraints?.exact_command,\n    )\n\n    const isOnce = claims.grant_type === 'once' || claims.approval === 'once'\n    const enforceArgvHash = exactRequired || (isOnce && !!claims.execution_context?.argv_hash)\n\n    if (enforceArgvHash && claims.execution_context?.argv_hash !== resolved.executionContext.argv_hash) {\n      throw new Error('Granted command does not match current argv')\n    }\n  }\n\n  const grantsEndpoint = await getGrantsEndpoint(issuer)\n  const consume = await fetch(`${grantsEndpoint}/${claims.grant_id}/consume`, {\n    method: 'POST',\n    headers: {\n      Authorization: `Bearer ${token}`,\n    },\n  })\n\n  if (!consume.ok) {\n    throw new Error(`Consume failed: ${consume.status} ${consume.statusText}`)\n  }\n\n  const consumeResult = await consume.json() as { error?: string }\n  if (consumeResult.error) {\n    throw new Error(`Grant rejected at consume step: ${consumeResult.error}`)\n  }\n}\n\n/**\n * Execute a verified + consumed resolved command directly via execFileSync,\n * inheriting stdio so the caller's terminal is handed to the child. Used by\n * the one-shot `apes run --shell` path.\n */\nexport function executeResolvedViaExec(resolved: ResolvedCommand): void {\n  consola.info(`Executing ${(resolved.executionContext.argv ?? [resolved.executable, ...resolved.commandArgv]).join(' ')}`)\n  execFileSync(resolved.executable, resolved.commandArgv, { stdio: 'inherit' })\n}\n\n/**\n * One-shot verify + consume + execute. Preserves the legacy behavior of\n * the `apes run --shell` path so existing callers keep working unchanged.\n */\nexport async function verifyAndExecute(token: string, resolved: ResolvedCommand): Promise<void> {\n  await verifyAndConsume(token, resolved)\n  executeResolvedViaExec(resolved)\n}\n\nexport async function findExistingGrant(\n  resolved: ResolvedCommand,\n  idp: string,\n): Promise<string | null> {\n  const grantsEndpoint = await getGrantsEndpoint(idp)\n  const response = await apiFetch<{ data: OpenApeGrant[] }>(\n    `${grantsEndpoint}?status=approved`,\n    { idp },\n  )\n\n  const now = Math.floor(Date.now() / 1000)\n  const expectedAudience = resolved.adapter.cli.audience ?? 'shapes'\n\n  for (const grant of response.data) {\n    const req = grant.request\n    if (req.grant_type === 'once')\n      continue\n    if (req.grant_type === 'timed' && grant.expires_at && grant.expires_at <= now)\n      continue\n    if (req.audience !== expectedAudience)\n      continue\n    if (req.execution_context?.adapter_digest && req.execution_context.adapter_digest !== resolved.digest)\n      continue\n\n    const cliDetails = (req.authorization_details ?? []).filter(\n      (d): d is OpenApeCliAuthorizationDetail => d.type === 'openape_cli',\n    )\n\n    if (cliDetails.length > 0) {\n      if (cliDetails.some(detail => cliAuthorizationDetailCovers(detail, resolved.detail)))\n        return grant.id\n    }\n    else if (req.permissions?.includes(resolved.permission)) {\n      return grant.id\n    }\n  }\n\n  return null\n}\n","import { existsSync, readFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\n\ninterface AuthData {\n  idp: string\n  access_token: string\n  email: string\n  expires_at: number\n}\n\nconst AUTH_FILE = join(homedir(), '.config', 'apes', 'auth.json')\n\nexport function loadAuth(): AuthData | null {\n  if (!existsSync(AUTH_FILE))\n    return null\n  try {\n    return JSON.parse(readFileSync(AUTH_FILE, 'utf-8')) as AuthData\n  }\n  catch {\n    return null\n  }\n}\n\nexport function getIdpUrl(explicit?: string): string | null {\n  if (explicit)\n    return explicit\n  if (process.env.APES_IDP)\n    return process.env.APES_IDP\n  if (process.env.SHAPES_IDP)\n    return process.env.SHAPES_IDP\n  return loadAuth()?.idp ?? null\n}\n\nexport function getAuthToken(): string | null {\n  const auth = loadAuth()\n  if (!auth)\n    return null\n  if (auth.expires_at && Date.now() / 1000 > auth.expires_at - 30)\n    return null\n  return auth.access_token\n}\n\nexport function getRequesterIdentity(): string | null {\n  return loadAuth()?.email ?? null\n}\n","import { getAuthToken, getIdpUrl } from './config.js'\n\nexport async function discoverEndpoints(idpUrl: string): Promise<Record<string, unknown>> {\n  const response = await fetch(`${idpUrl}/.well-known/openid-configuration`)\n  if (!response.ok)\n    return {}\n  return response.json() as Promise<Record<string, unknown>>\n}\n\nexport async function getGrantsEndpoint(idpUrl: string): Promise<string> {\n  const discovery = await discoverEndpoints(idpUrl)\n  return String(discovery.openape_grants_endpoint ?? `${idpUrl}/api/grants`)\n}\n\nexport async function apiFetch<T>(\n  path: string,\n  options: {\n    method?: string\n    body?: unknown\n    idp?: string\n    token?: string\n  } = {},\n): Promise<T> {\n  const token = options.token ?? getAuthToken()\n  if (!token)\n    throw new Error('Not authenticated. Run `apes login` first.')\n\n  const idp = options.idp ?? getIdpUrl()\n  if (!path.startsWith('http') && !idp)\n    throw new Error('No IdP URL configured. Use --idp or log in with apes.')\n\n  const url = path.startsWith('http') ? path : `${idp}${path}`\n  const response = await fetch(url, {\n    method: options.method ?? 'GET',\n    headers: {\n      Authorization: `Bearer ${token}`,\n      'Content-Type': 'application/json',\n    },\n    body: options.body ? JSON.stringify(options.body) : undefined,\n  })\n\n  if (!response.ok) {\n    const text = await response.text()\n    throw new Error(text || `${response.status} ${response.statusText}`)\n  }\n\n  return response.json() as Promise<T>\n}\n","import { computeCmdHash } from '@openape/core'\nimport type { BuiltGrantRequest, GrantRequestOptions, ResolvedCapability, ResolvedCommand } from './types.js'\n\nexport async function buildExactCommandGrantRequest(\n  command: string[],\n  options: GrantRequestOptions & {\n    audience: string\n  },\n): Promise<BuiltGrantRequest> {\n  return {\n    request: {\n      requester: options.requester,\n      target_host: options.target_host,\n      audience: options.audience,\n      grant_type: options.grant_type,\n      command,\n      cmd_hash: await computeCmdHash(command.join(' ')),\n      ...(options.reason ? { reason: options.reason } : {}),\n      ...(options.run_as ? { run_as: options.run_as } : {}),\n    },\n  }\n}\n\nexport async function buildStructuredCliGrantRequest(\n  resolved: ResolvedCommand | ResolvedCapability,\n  options: GrantRequestOptions,\n): Promise<BuiltGrantRequest> {\n  const details = 'detail' in resolved ? [resolved.detail] : resolved.details\n  const permissions = 'permission' in resolved ? [resolved.permission] : resolved.permissions\n  const command = 'executionContext' in resolved && resolved.executionContext.argv?.length\n    ? resolved.executionContext.argv\n    : undefined\n\n  return {\n    request: {\n      requester: options.requester,\n      target_host: options.target_host,\n      audience: resolved.adapter.cli.audience ?? 'shapes',\n      grant_type: options.grant_type,\n      permissions,\n      authorization_details: details,\n      execution_context: resolved.executionContext,\n      ...(command ? { command } : {}),\n      ...(options.reason ? { reason: options.reason } : { reason: 'summary' in resolved ? resolved.summary : details[0]?.display }),\n      ...(options.run_as ? { run_as: options.run_as } : {}),\n    },\n  }\n}\n"],"mappings":";;;;;;;;;;AAAA,OAAO,aAAa;AAGpB,IAAM,QAAQ,QAAQ,KAAK,SAAS,SAAS;AAEtC,IAAM,WAAN,cAAuB,MAAM;AAAA,EAClC,YAAmB,YAAoB,SAAwB,gBAA0C;AACvG,UAAM,OAAO;AADI;AAA4C;AAE7D,SAAK,OAAO;AAAA,EACd;AACF;AAGA,IAAM,kBAA2D,CAAC;AAElE,eAAsB,kBAAkB,QAAkD;AACxF,MAAI,gBAAgB,MAAM,GAAG;AAC3B,WAAO,gBAAgB,MAAM;AAAA,EAC/B;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,MAAM,GAAG,MAAM,mCAAmC;AACzE,QAAI,SAAS,IAAI;AACf,YAAM,OAAO,MAAM,SAAS,KAAK;AACjC,sBAAgB,MAAM,IAAI;AAC1B,aAAO;AAAA,IACT;AAAA,EACF,QACM;AAAA,EAAC;AAGP,kBAAgB,MAAM,IAAI,CAAC;AAC3B,SAAO,CAAC;AACV;AAEA,eAAsB,kBAAkB,QAAiC;AACvE,QAAM,QAAQ,MAAM,kBAAkB,MAAM;AAC5C,SAAQ,MAAM,2BAAsC,GAAG,MAAM;AAC/D;AAEA,eAAsB,0BAA0B,QAAiC;AAC/E,QAAM,QAAQ,MAAM,kBAAkB,MAAM;AAC5C,SAAQ,MAAM,kCAA6C,GAAG,MAAM;AACtE;AAEA,eAAsB,6BAA6B,QAAiC;AAClF,QAAM,QAAQ,MAAM,kBAAkB,MAAM;AAC5C,SAAQ,MAAM,qCAAgD,GAAG,MAAM;AACzE;AAEA,eAAsB,uBAAuB,QAAiC;AAC5E,QAAM,QAAQ,MAAM,kBAAkB,MAAM;AAC5C,SAAQ,MAAM,gCAA2C,GAAG,MAAM;AACpE;AAMA,eAAe,oBAA4C;AACzD,QAAM,OAAO,SAAS;AACtB,MAAI,CAAC;AACH,WAAO;AAET,QAAM,SAAS,WAAW;AAC1B,QAAM,UAAU,OAAO,OAAO;AAC9B,MAAI,CAAC;AACH,WAAO;AAET,MAAI;AACF,UAAM,EAAE,cAAAA,cAAa,IAAI,MAAM,OAAO,IAAS;AAC/C,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,QAAa;AAC3C,UAAM,EAAE,SAAAC,SAAQ,IAAI,MAAM,OAAO,IAAS;AAC1C,UAAM,EAAE,sBAAsB,IAAI,MAAM,OAAO,uBAAc;AAE7D,UAAM,WAAW,QAAQ,QAAQ,MAAMA,SAAQ,CAAC;AAChD,UAAM,aAAaD,cAAa,UAAU,OAAO;AACjD,UAAM,aAAa,sBAAsB,UAAU;AAEnD,UAAM,eAAe,MAAM,0BAA0B,KAAK,GAAG;AAC7D,UAAM,gBAAgB,MAAM,MAAM,cAAc;AAAA,MAC9C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,KAAK,MAAM,CAAC;AAAA,IAC/C,CAAC;AAED,QAAI,CAAC,cAAc;AACjB,aAAO;AAET,UAAM,EAAE,UAAU,IAAI,MAAM,cAAc,KAAK;AAC/C,UAAM,EAAE,QAAAE,QAAO,IAAI,MAAM,OAAO,QAAa;AAC7C,UAAM,YAAY,KAAK,MAAMA,QAAO,KAAK,SAAS,GAAG,UAAU,EAAE,SAAS,QAAQ;AAElF,UAAM,kBAAkB,MAAM,6BAA6B,KAAK,GAAG;AACnE,UAAM,WAAW,MAAM,MAAM,iBAAiB;AAAA,MAC5C,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,UAAU,KAAK,OAAO,WAAW,UAAU,CAAC;AAAA,IACrE,CAAC;AAED,QAAI,CAAC,SAAS;AACZ,aAAO;AAET,UAAM,EAAE,OAAO,WAAW,IAAI,MAAM,SAAS,KAAK;AAElD,aAAS;AAAA,MACP,GAAG;AAAA,MACH,cAAc;AAAA,MACd,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,cAAc;AAAA,IAC7D,CAAC;AAED,QAAI,OAAO;AACT,cAAQ,MAAM,gDAAgD;AAAA,IAChE;AAEA,WAAO;AAAA,EACT,QACM;AACJ,WAAO;AAAA,EACT;AACF;AAUA,eAAe,oBAA4C;AACzD,QAAM,OAAO,SAAS;AACtB,MAAI,CAAC,MAAM;AACT,WAAO;AAET,QAAM,EAAE,iBAAiB,gBAAgB,IAAI,MAAM,OAAO,yBAAgB;AAC1E,QAAM,OAAO,MAAM,gBAAgB,EAAE,WAAW,IAAK,CAAC;AACtD,MAAI,CAAC,MAAM;AAGT,WAAO,aAAa;AAAA,EACtB;AAEA,MAAI;AAGF,UAAM,SAAS,SAAS;AACxB,QAAI,QAAQ,cAAc,KAAK,IAAI,IAAI,MAAO,OAAO,aAAa;AAChE,aAAO,OAAO;AAEhB,UAAM,qBAAqB,QAAQ,iBAAiB,KAAK;AACzD,QAAI,CAAC;AACH,aAAO;AAET,UAAM,QAAQ,MAAM,kBAAkB,KAAK,GAAG;AAC9C,UAAM,gBAAiB,MAAM,kBAA6B,GAAG,KAAK,GAAG;AAErE,UAAM,OAAO,IAAI,gBAAgB;AAAA,MAC/B,YAAY;AAAA,MACZ,eAAe;AAAA,IACjB,CAAC;AAED,UAAM,OAAO,MAAM,MAAM,eAAe;AAAA,MACtC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,oCAAoC;AAAA,MAC/D,MAAM,KAAK,SAAS;AAAA,IACtB,CAAC;AAED,QAAI,CAAC,KAAK,IAAI;AAGZ,UAAI,KAAK,WAAW,OAAO,KAAK,WAAW,KAAK;AAC9C,cAAMC,QAAO,UAAU;AACvB,iBAAS,EAAE,GAAGA,OAAM,eAAe,OAAU,CAAC;AAAA,MAChD;AACA,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,MAAM,KAAK,KAAK;AAM/B,UAAM,OAAO,UAAU;AACvB,aAAS;AAAA,MACP,GAAG;AAAA,MACH,cAAc,OAAO;AAAA,MACrB,eAAe,OAAO,iBAAiB,KAAK;AAAA,MAC5C,YAAY,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI,KAAK,OAAO,cAAc;AAAA,IACpE,CAAC;AAED,QAAI;AACF,cAAQ,MAAM,yCAAyC;AAEzD,WAAO,OAAO;AAAA,EAChB,UACA;AACE,UAAM,gBAAgB,IAAI;AAAA,EAC5B;AACF;AAEA,eAAsB,SACpB,MACA,UAKI,CAAC,GACO;AACZ,MAAI,QAAQ,QAAQ,SAAS,aAAa;AAK1C,MAAI,CAAC,OAAO;AACV,YAAQ,MAAM,kBAAkB;AAChC,QAAI,CAAC;AACH,cAAQ,MAAM,kBAAkB;AAAA,EACpC;AAEA,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,MAAI;AACJ,MAAI,KAAK,WAAW,MAAM,GAAG;AAC3B,UAAM;AAAA,EACR,OACK;AACH,UAAM,MAAM,QAAQ,OAAO,UAAU;AACrC,QAAI,CAAC,KAAK;AACR,YAAM,IAAI,MAAM,8DAA8D;AAAA,IAChF;AACA,UAAM,GAAG,GAAG,GAAG,IAAI;AAAA,EACrB;AACA,QAAM,SAAS,QAAQ,UAAU;AACjC,QAAM,UAAkC;AAAA,IACtC,iBAAiB,UAAU,KAAK;AAAA,IAChC,gBAAgB;AAAA,EAClB;AAEA,MAAI,OAAO;AACT,YAAQ,MAAM,GAAG,MAAM,IAAI,GAAG,EAAE;AAChC,YAAQ,MAAM,UAAU,MAAM,UAAU,GAAG,EAAE,CAAC,MAAM,MAAM,UAAU,MAAM,SAAS,EAAE,CAAC,EAAE;AAAA,EAC1F;AAEA,QAAM,WAAW,MAAM,MAAM,KAAK;AAAA,IAChC;AAAA,IACA;AAAA,IACA,MAAM,QAAQ,OAAO,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,EACtD,CAAC;AAED,MAAI,OAAO;AACT,YAAQ,MAAM,aAAa,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAAA,EACrE;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,cAAc,SAAS,QAAQ,IAAI,cAAc,KAAK;AAG5D,QAAI,YAAY,SAAS,0BAA0B,KAAK,YAAY,SAAS,kBAAkB,GAAG;AAChG,UAAI;AACF,cAAM,UAAU,MAAM,SAAS,KAAK;AACpC,cAAM,UAAW,QAAQ,UAAsB,QAAQ,SAAqB,QAAQ,iBAA6B,QAAQ,WAAsB,GAAG,SAAS,MAAM,IAAI,SAAS,UAAU;AACxL,cAAM,IAAI,SAAS,SAAS,QAAQ,SAAS,OAAO;AAAA,MACtD,SACO,GAAG;AACR,YAAI,aAAa;AACf,gBAAM;AAAA,MACV;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,IAAI,SAAS,SAAS,QAAQ,QAAQ,GAAG,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAAA,EACzF;AAEA,SAAO,SAAS,KAAK;AACvB;;;ACvRA,SAAS,kBAAkB;AAC3B,SAAS,YAAY,aAAa,oBAAoB;AACtD,SAAS,eAAe;AACxB,SAAS,UAAU,YAAY;;;ACK/B,SAAS,cAAc,MAAqD;AAC1E,QAAM,UAAU,KAAK,QAAQ,GAAG;AAChC,MAAI,YAAY;AACd,WAAO;AACT,QAAM,MAAM,KAAK,MAAM,GAAG,OAAO,EAAE,KAAK;AACxC,QAAM,QAAQ,KAAK,MAAM,UAAU,CAAC,EAAE,KAAK;AAC3C,MAAI,CAAC,OAAO,CAAC;AACX,WAAO;AACT,SAAO,EAAE,KAAK,MAAM;AACtB;AAEA,SAAS,eAAe,KAAsB;AAC5C,QAAM,UAAU,IAAI,KAAK;AAEzB,MAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG;AACjD,WAAO,QAAQ,MAAM,GAAG,EAAE;AAC5B,MAAI,YAAY;AACd,WAAO;AACT,MAAI,YAAY;AACd,WAAO;AACT,MAAI,QAAQ,WAAW,GAAG,KAAK,QAAQ,SAAS,GAAG,GAAG;AACpD,UAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,EAAE,KAAK;AACxC,QAAI,CAAC;AACH,aAAO,CAAC;AACV,WAAO,MAAM,MAAM,GAAG,EAAE,IAAI,WAAS,MAAM,KAAK,EAAE,QAAQ,UAAU,EAAE,CAAC;AAAA,EACzE;AAEA,SAAO;AACT;AAEO,SAAS,iBAAiB,SAAgC;AAC/D,QAAM,SAA0B,CAAC;AACjC,QAAM,aAAgC,CAAC;AACvC,MAAI,iBAA+C;AACnD,MAAI,eAAwC,CAAC;AAE7C,QAAM,iBAAiB,MAAM;AAC3B,QAAI,mBAAmB,eAAe,OAAO,KAAK,YAAY,EAAE,SAAS,GAAG;AAC1E,iBAAW,KAAK,YAA0C;AAC1D,qBAAe,CAAC;AAAA,IAClB;AAAA,EACF;AAEA,aAAW,WAAW,QAAQ,MAAM,IAAI,GAAG;AACzC,UAAM,OAAO,QAAQ,KAAK;AAC1B,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG;AAC9B;AAEF,QAAI,SAAS,SAAS;AACpB,qBAAe;AACf,uBAAiB;AACjB,aAAO,MAAM,CAAC;AACd;AAAA,IACF;AAEA,QAAI,SAAS,iBAAiB;AAC5B,qBAAe;AACf,uBAAiB;AACjB,qBAAe,CAAC;AAChB;AAAA,IACF;AAEA,UAAM,KAAK,cAAc,IAAI;AAC7B,QAAI,CAAC;AACH;AAEF,UAAM,QAAQ,eAAe,GAAG,KAAK;AACrC,QAAI,mBAAmB,QAAQ;AAC7B;AAAC,MAAC,OAAmC,GAAG,GAAG,IAAI;AAAA,IACjD,WACS,mBAAmB,OAAO;AACjC;AAAC,MAAC,OAAO,IAAgC,GAAG,GAAG,IAAI;AAAA,IACrD,OACK;AACH,mBAAa,GAAG,GAAG,IAAI;AAAA,IACzB;AAAA,EACF;AAEA,iBAAe;AACf,SAAO,YAAY;AAEnB,MAAI,OAAO,WAAW,qBAAqB;AACzC,UAAM,IAAI,MAAM,+BAA+B,OAAO,UAAU,SAAS,EAAE;AAAA,EAC7E;AACA,MAAI,CAAC,OAAO,KAAK,MAAM,CAAC,OAAO,IAAI,YAAY;AAC7C,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AACA,MAAI,CAAC,OAAO,WAAW,QAAQ;AAC7B,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AAEA,SAAO;AAAA,IACL,QAAQ,OAAO;AAAA,IACf,KAAK;AAAA,MACH,IAAI,OAAO,OAAO,IAAI,EAAE;AAAA,MACxB,YAAY,OAAO,OAAO,IAAI,UAAU;AAAA,MACxC,GAAI,OAAO,IAAI,WAAW,EAAE,UAAU,OAAO,OAAO,IAAI,QAAQ,EAAE,IAAI,CAAC;AAAA,MACvE,GAAI,OAAO,IAAI,UAAU,EAAE,SAAS,OAAO,OAAO,IAAI,OAAO,EAAE,IAAI,CAAC;AAAA,IACtE;AAAA,IACA,YAAY,OAAO,UAAU,IAAI,CAAC,cAAc;AAC9C,UAAI,CAAC,MAAM,QAAQ,UAAU,OAAO,KAAK,UAAU,QAAQ,KAAK,WAAS,OAAO,UAAU,QAAQ,GAAG;AACnG,cAAM,IAAI,MAAM,aAAa,OAAO,UAAU,MAAM,WAAW,CAAC,uBAAuB;AAAA,MACzF;AACA,UAAI,CAAC,MAAM,QAAQ,UAAU,cAAc,KAAK,UAAU,eAAe,KAAK,WAAS,OAAO,UAAU,QAAQ,GAAG;AACjH,cAAM,IAAI,MAAM,aAAa,OAAO,UAAU,MAAM,WAAW,CAAC,8BAA8B;AAAA,MAChG;AACA,UAAI,OAAO,UAAU,OAAO,YAAY,OAAO,UAAU,YAAY,YAAY,OAAO,UAAU,WAAW,UAAU;AACrH,cAAM,IAAI,UAAU,+CAA+C;AAAA,MACrE;AACA,aAAO;AAAA,QACL,IAAI,UAAU;AAAA,QACd,SAAS,UAAU;AAAA,QACnB,GAAI,MAAM,QAAQ,UAAU,WAAW,IAAI,EAAE,aAAa,UAAU,YAAwB,IAAI,CAAC;AAAA,QACjG,GAAI,MAAM,QAAQ,UAAU,gBAAgB,IAAI,EAAE,kBAAkB,UAAU,iBAA6B,IAAI,CAAC;AAAA,QAChH,SAAS,UAAU;AAAA,QACnB,QAAQ,UAAU;AAAA,QAClB,MAAO,UAAU,QAAoC;AAAA,QACrD,gBAAgB,UAAU;AAAA,QAC1B,GAAI,UAAU,kBAAkB,SAAY,EAAE,eAAe,QAAQ,UAAU,aAAa,EAAE,IAAI,CAAC;AAAA,MACrG;AAAA,IACF,CAAC;AAAA,EACH;AACF;;;AD3HA,SAAS,OAAO,SAAyB;AACvC,SAAO,WAAW,WAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;AACtE;AAEA,SAAS,cAAwB;AAC/B,SAAO;AAAA,IACL,KAAK,QAAQ,IAAI,GAAG,YAAY,UAAU,UAAU;AAAA,IACpD,KAAK,QAAQ,GAAG,YAAY,UAAU,UAAU;AAAA,IAChD,KAAK,QAAQ,WAAW,UAAU,UAAU;AAAA,EAC9C;AACF;AAEA,SAAS,iBAAiB,YAAwC;AAChE,aAAW,OAAO,YAAY,GAAG;AAC/B,QAAI,CAAC,WAAW,GAAG;AACjB;AACF,QAAI;AACF,YAAM,QAAQ,YAAY,GAAG,EAAE,OAAO,OAAK,EAAE,SAAS,OAAO,CAAC;AAC9D,iBAAW,QAAQ,OAAO;AACxB,cAAM,OAAO,KAAK,KAAK,IAAI;AAC3B,cAAM,UAAU,aAAa,MAAM,OAAO;AAC1C,cAAM,QAAQ,QAAQ,MAAM,iCAAiC;AAC7D,YAAI,SAAS,MAAM,CAAC,MAAM;AACxB,iBAAO;AAAA,MACX;AAAA,IACF,QACM;AAAA,IAEN;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAe,cAA+B;AAC/E,MAAI,cAAc;AAChB,QAAI,WAAW,YAAY;AACzB,aAAO;AACT,UAAM,IAAI,MAAM,2BAA2B,YAAY,EAAE;AAAA,EAC3D;AAGA,QAAM,aAAa,YAAY,EAAE,IAAI,SAAO,KAAK,KAAK,GAAG,KAAK,OAAO,CAAC;AACtE,QAAM,QAAQ,WAAW,KAAK,UAAQ,WAAW,IAAI,CAAC;AACtD,MAAI;AACF,WAAO;AAGT,QAAM,SAAS,iBAAiB,KAAK;AACrC,MAAI;AACF,WAAO;AAET,QAAM,IAAI,MAAM,wBAAwB,KAAK,EAAE;AACjD;AAEO,SAAS,YAAY,OAAe,cAAsC;AAC/E,QAAM,SAAS,mBAAmB,OAAO,YAAY;AACrD,QAAM,UAAU,aAAa,QAAQ,OAAO;AAC5C,QAAM,UAAU,iBAAiB,OAAO;AAGxC,QAAM,UAAU,QAAQ,IAAI,OAAO;AACnC,QAAM,YAAY,SAAS,MAAM,MAAM,GAAG,KAAK;AAC/C,QAAM,YAAY,QAAQ,IAAI,eAAe;AAC7C,MAAI,CAAC,WAAW,CAAC,aAAa,CAAC;AAC7B,UAAM,IAAI,MAAM,WAAW,MAAM,iCAAiC,KAAK,EAAE;AAE3E,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ,OAAO,OAAO;AAAA,EACxB;AACF;AAGO,SAAS,eAAe,OAAe,cAA6C;AACzF,MAAI;AACF,WAAO,YAAY,OAAO,YAAY;AAAA,EACxC,QACM;AACJ,WAAO;AAAA,EACT;AACF;;;AExFA,SAAS,gBAAgB,cAAAC,aAAY,iBAAiB;AACtD,SAAS,WAAAC,gBAAe;AACxB,SAAS,SAAS,QAAAC,aAAY;AAS9B,SAAS,YAAoB;AAC3B,SAAOA,MAAKD,SAAQ,GAAG,WAAW,QAAQ,aAAa;AACzD;AAMO,SAAS,eAAe,OAA+E;AAC5G,QAAM,OAAmB;AAAA,IACvB,GAAG;AAAA,IACH,QAAQ,MAAM;AAAA,IACd,WAAW,MAAM,aAAa,KAAK,IAAI;AAAA,EACzC;AACA,QAAM,OAAO,UAAU;AACvB,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI;AACF,QAAI,CAACD,YAAW,GAAG,EAAG,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AACxD,mBAAe,MAAM,GAAG,KAAK,UAAU,IAAI,CAAC;AAAA,CAAI;AAAA,EAClD,QACM;AAAA,EAEN;AACF;;;AClCA,SAAS,cAAAG,mBAAkB;AAC3B,SAAS,cAAAC,aAAY,aAAAC,YAAW,eAAAC,cAAa,gBAAAC,eAAc,YAAY,qBAAqB;AAC5F,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,aAAY;AAGrB,SAAS,WAAW,OAAwB;AAC1C,QAAM,OAAO,QAAQ,QAAQ,IAAI,IAAID,SAAQ;AAC7C,SAAOC,MAAK,MAAM,YAAY,UAAU,UAAU;AACpD;AAEA,SAAS,YAAY,IAAY,OAAwB;AACvD,SAAOA,MAAK,WAAW,KAAK,GAAG,GAAG,EAAE,OAAO;AAC7C;AAEA,SAAS,OAAO,SAAyB;AACvC,SAAO,WAAWN,YAAW,QAAQ,EAAE,OAAO,OAAO,EAAE,OAAO,KAAK,CAAC;AACtE;AASA,eAAsB,eAAe,OAAsB,UAA+B,CAAC,GAA2B;AACpH,QAAM,QAAQ,QAAQ,SAAS;AAC/B,QAAM,OAAO,YAAY,MAAM,IAAI,KAAK;AACxC,QAAM,MAAM,WAAW,KAAK;AAE5B,QAAM,WAAW,MAAM,MAAM,MAAM,YAAY;AAC/C,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,8BAA8B,MAAM,EAAE,KAAK,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAErG,QAAM,UAAU,MAAM,SAAS,KAAK;AACpC,QAAMO,UAAS,OAAO,OAAO;AAE7B,MAAIA,YAAW,MAAM;AACnB,UAAM,IAAI,MAAM,uBAAuB,MAAM,EAAE,cAAc,MAAM,MAAM,SAASA,OAAM,EAAE;AAE5F,QAAM,UAAUN,YAAW,IAAI;AAE/B,MAAI,CAACA,YAAW,GAAG;AACjB,IAAAC,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAEpC,gBAAc,MAAM,OAAO;AAE3B,SAAO,EAAE,IAAI,MAAM,IAAI,MAAM,MAAM,QAAAK,SAAQ,QAAQ;AACrD;AAEO,SAAS,mBAAmB,IAAY,OAA+B;AAC5E,QAAM,OAAO,YAAY,IAAI,KAAK;AAClC,MAAI,CAACN,YAAW,IAAI;AAClB,WAAO;AAET,QAAM,UAAUG,cAAa,MAAM,OAAO;AAC1C,SAAO,OAAO,OAAO;AACvB;AAEO,SAAS,YAAY,IAAY,OAAyB;AAC/D,SAAOH,YAAW,YAAY,IAAI,KAAK,CAAC;AAC1C;AAMO,SAAS,cAAc,IAAY,OAAyB;AACjE,QAAM,OAAO,YAAY,IAAI,KAAK;AAClC,MAAI,CAACO,YAAW,IAAI;AAClB,WAAO;AACT,aAAW,IAAI;AACf,SAAO;AACT;AASO,SAAS,wBAAwB,YAAoB,WAAyC;AACnG,QAAM,YAAkC,CAAC;AACzC,QAAM,OAAO;AAAA,IACXC,MAAK,QAAQ,IAAI,GAAG,YAAY,UAAU,UAAU;AAAA,IACpDA,MAAKC,SAAQ,GAAG,YAAY,UAAU,UAAU;AAAA,EAClD;AAEA,aAAW,OAAO,MAAM;AACtB,QAAI,CAACF,YAAW,GAAG;AACjB;AACF,QAAI;AACF,iBAAW,QAAQG,aAAY,GAAG,EAAE,OAAO,OAAK,EAAE,SAAS,OAAO,CAAC,GAAG;AACpE,cAAM,OAAOF,MAAK,KAAK,IAAI;AAC3B,cAAM,UAAUG,cAAa,MAAM,OAAO;AAC1C,cAAM,YAAY,QAAQ,MAAM,iCAAiC;AACjE,cAAM,UAAU,QAAQ,MAAM,yBAAyB;AACvD,YAAI,YAAY,CAAC,MAAM,cAAc,UAAU,CAAC,MAAM,WAAW;AAC/D,oBAAU,KAAK,EAAE,MAAM,MAAM,WAAW,UAAU,CAAC,KAAK,MAAM,WAAW,CAAC;AAAA,QAC5E;AAAA,MACF;AAAA,IACF,QACM;AAAA,IAEN;AAAA,EACF;AAEA,SAAO;AACT;;;AC9GA,SAAS,cAAAC,aAAY,aAAAC,YAAW,gBAAAC,eAAc,iBAAAC,sBAAqB;AACnE,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,aAAY;AAGrB,IAAM,eAAe,QAAQ,IAAI,uBAC5B;AAEL,IAAM,eAAe,KAAK,KAAK;AAE/B,SAAS,WAAmB;AAC1B,SAAOA,MAAKD,SAAQ,GAAG,YAAY,UAAU,OAAO;AACtD;AAEA,SAAS,YAAoB;AAC3B,SAAOC,MAAK,SAAS,GAAG,eAAe;AACzC;AAEA,SAAS,YAAkC;AACzC,QAAM,OAAO,UAAU;AACvB,MAAI,CAACL,YAAW,IAAI;AAClB,WAAO;AAET,MAAI;AACF,UAAM,MAAME,cAAa,MAAM,OAAO;AACtC,UAAM,OAAO,KAAK,MAAM,GAAG;AAC3B,QAAI,KAAK,cAAc,KAAK,IAAI,IAAI,KAAK,aAAa;AACpD,aAAO;AACT,WAAO;AAAA,EACT,QACM;AACJ,WAAO;AAAA,EACT;AACF;AAEA,SAAS,WAAW,OAA4B;AAC9C,QAAM,MAAM,SAAS;AACrB,MAAI,CAACF,YAAW,GAAG;AACjB,IAAAC,WAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAEpC,EAAAE,eAAc,UAAU,GAAG,KAAK,UAAU,EAAE,GAAG,OAAO,YAAY,KAAK,IAAI,EAAE,GAAG,MAAM,CAAC,CAAC;AAC1F;AAEA,eAAsB,cAAc,eAAe,OAA+B;AAChF,MAAI,CAAC,cAAc;AACjB,UAAM,SAAS,UAAU;AACzB,QAAI;AACF,aAAO;AAAA,EACX;AAEA,QAAM,WAAW,MAAM,MAAM,YAAY;AACzC,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI,MAAM,6BAA6B,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAEvF,QAAM,QAAQ,MAAM,SAAS,KAAK;AAClC,aAAW,KAAK;AAChB,SAAO;AACT;AAEO,SAAS,eAAe,OAAsB,OAAgC;AACnF,QAAM,IAAI,MAAM,YAAY;AAC5B,SAAO,MAAM,SAAS;AAAA,IAAO,OAC3B,EAAE,GAAG,SAAS,CAAC,KACZ,EAAE,KAAK,YAAY,EAAE,SAAS,CAAC,KAC/B,EAAE,YAAY,YAAY,EAAE,SAAS,CAAC,KACtC,EAAE,KAAK,KAAK,OAAK,EAAE,SAAS,CAAC,CAAC,KAC9B,EAAE,SAAS,SAAS,CAAC;AAAA,EAC1B;AACF;AAOO,SAAS,YAAY,OAAsB,gBAAmD;AACnG,SAAO,MAAM,SAAS;AAAA,IACpB,OAAK,EAAE,OAAO,kBAAkB,EAAE,eAAe;AAAA,EACnD;AACF;;;AC/EA,SAAS,YAAAG,iBAAgB;AACzB,OAAOC,cAAa;AACpB,SAAS,SAAS,kBAAkB;AAuBpC,IAAM,qBAAqB,oBAAI,IAAI,CAAC,MAAM,MAAM,KAAK,KAAK,KAAK,KAAK,MAAM,GAAG,CAAC;AAUvE,SAAS,kBAAkB,KAAwC;AACxE,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,QAAQ,WAAW,EAAG,QAAO;AAEjC,MAAI;AACJ,MAAI;AACF,aAAS,WAAW,OAAO;AAAA,EAC7B,QACM;AACJ,WAAO;AAAA,EACT;AAGA,QAAM,oBAAoB,SAAS,KAAK,OAAO;AAC/C,QAAM,mBAAmB,OAAO,KAAK,OAAK,OAAO,MAAM,YAAY,MAAM,QAAQ,QAAQ,KAAK,mBAAmB,IAAI,EAAE,EAAE,CAAC;AAC1H,QAAM,aAAa,qBAAqB;AAGxC,QAAM,eAAyB,CAAC;AAChC,aAAW,KAAK,QAAQ;AACtB,QAAI,OAAO,MAAM,UAAU;AACzB,mBAAa,KAAK,CAAC;AAAA,IACrB,OACK;AACH;AAAA,IACF;AAAA,EACF;AAEA,MAAI,aAAa,WAAW,EAAG,QAAO;AAEtC,SAAO;AAAA,IACL,YAAY,aAAa,CAAC;AAAA,IAC1B,MAAM,aAAa,MAAM,CAAC;AAAA,IAC1B;AAAA,IACA,KAAK;AAAA,EACP;AACF;AAMO,SAAS,0BAA0B,SAAkC;AAC1E,MAAI,QAAQ,SAAS,EAAG,QAAO;AAC/B,MAAI,QAAQ,CAAC,MAAM,UAAU,QAAQ,CAAC,MAAM,KAAM,QAAO;AACzD,MAAI,QAAQ,CAAC,MAAM,KAAM,QAAO;AAEhC,SAAO,QAAQ,MAAM,CAAC,EAAE,KAAK,GAAG;AAClC;AASA,eAAsB,qBAAqB,OAA8C;AAIvF,QAAM,WAAWC,UAAS,KAAK;AAG/B,QAAM,QAAQ,eAAe,QAAQ;AACrC,MAAI,MAAO,QAAO;AAKlB,MAAI;AACF,UAAM,QAAQ,MAAM,cAAc;AAClC,UAAM,QAAQ,YAAY,OAAO,QAAQ;AACzC,QAAI,CAAC,MAAO,QAAO;AAEnB,IAAAC,SAAQ,KAAK,iCAAiC,MAAM,EAAE,mBAAmB;AACzE,UAAM,eAAe,OAAO,EAAE,OAAO,MAAM,CAAC;AAC5C,mBAAe;AAAA,MACb,QAAQ;AAAA,MACR,QAAQ,MAAM;AAAA,MACd,QAAQ,MAAM;AAAA,MACd,QAAQ;AAAA,IACV,CAAC;AAID,WAAO,eAAe,MAAM,EAAE;AAAA,EAChC,SACO,KAAK;AACV,IAAAA,SAAQ,MAAM,6CAA6C,QAAQ,KAAK,GAAG;AAC3E,WAAO;AAAA,EACT;AACF;;;AC9HA,SAAS,iCAAiC;AAQ1C,SAAS,yBAAyB,OAA0C;AAC1E,QAAM,CAAC,UAAU,eAAe,GAAG,IAAI,MAAM,MAAM,KAAK,CAAC;AACzD,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,MAAM,iCAAiC,KAAK,EAAE;AAAA,EAC1D;AAEA,MAAI,iBAAiB,KAAK;AACxB,WAAO,EAAE,UAAU,cAAc,CAAC,EAAE;AAAA,EACtC;AAEA,QAAM,eAAe,aAAa,MAAM,GAAG,EACxC,IAAI,CAAC,YAAY;AAChB,UAAM,CAAC,GAAG,IAAI,QAAQ,MAAM,KAAK,CAAC;AAClC,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,6BAA6B,OAAO,EAAE;AACxD,WAAO;AAAA,EACT,CAAC;AAEH,SAAO,EAAE,UAAU,aAAa;AAClC;AAEA,SAAS,eAAe,WAAyD;AAC/E,SAAO,UAAU,eAAe,IAAI,wBAAwB;AAC9D;AAEA,SAAS,kBAAkB,YAA+B,UAA4B;AACpF,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,aAAa,YAAY;AAClC,eAAW,SAAS,eAAe,SAAS,GAAG;AAC7C,UAAI,MAAM,aAAa;AACrB;AACF,iBAAW,OAAO,MAAM,cAAc;AACpC,aAAK,IAAI,GAAG;AAAA,MACd;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI,EAAE,KAAK;AAC/B;AAEA,SAAS,sBAAsB,KAA+D;AAC5F,QAAM,CAAC,KAAK,KAAK,IAAI,IAAI,MAAM,KAAK,CAAC;AACrC,MAAI,CAAC,OAAO,CAAC,OAAO;AAClB,UAAM,IAAI,MAAM,qBAAqB,GAAG,EAAE;AAAA,EAC5C;AAEA,QAAM,CAAC,UAAU,GAAG,IAAI,IAAI,MAAM,KAAK,CAAC;AACxC,MAAI,CAAC,YAAY,CAAC,KAAK;AACrB,UAAM,IAAI,MAAM,iDAAiD,GAAG,EAAE;AAAA,EACxE;AAEA,SAAO,EAAE,UAAU,KAAK,MAAM;AAChC;AAEA,SAAS,eAAe,UAA2C;AACjE,MAAI,CAAC,YAAY,OAAO,KAAK,QAAQ,EAAE,WAAW;AAChD,WAAO;AACT,SAAO,OAAO,QAAQ,QAAQ,EAC3B,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,EACrC,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,GAAG,GAAG,IAAI,KAAK,EAAE,EACvC,KAAK,GAAG;AACb;AAEA,SAAS,gBAAgB,QAA+C;AACtE,QAAM,QAAQ,OAAO,eAClB,IAAI,cAAY,GAAG,SAAS,QAAQ,IAAI,eAAe,SAAS,QAAQ,CAAC,GAAG,EAC5E,KAAK,MAAM;AACd,SAAO,SAAS,OAAO,MAAM,OAAO,OAAO,MAAM,IAAI,KAAK;AAC5D;AAEO,SAAS,yBACd,QACA,QAKoB;AACpB,MAAI,OAAO,UAAU,WAAW,GAAG;AACjC,UAAM,IAAI,MAAM,qCAAqC;AAAA,EACvD;AACA,MAAI,OAAO,QAAQ,WAAW,GAAG;AAC/B,UAAM,IAAI,MAAM,mCAAmC;AAAA,EACrD;AAEA,QAAM,cAAc,oBAAI,IAAoC;AAC5D,aAAW,eAAe,OAAO,aAAa,CAAC,GAAG;AAChD,UAAM,EAAE,UAAU,KAAK,MAAM,IAAI,sBAAsB,WAAW;AAClE,UAAM,UAAU,YAAY,IAAI,QAAQ,KAAK,CAAC;AAC9C,YAAQ,GAAG,IAAI;AACf,gBAAY,IAAI,UAAU,OAAO;AAAA,EACnC;AAEA,QAAM,iBAA0C,OAAO,UAAU,IAAI,CAAC,aAAa;AACjF,UAAM,WAAW,YAAY,IAAI,QAAQ;AACzC,UAAM,YAAY,kBAAkB,OAAO,QAAQ,YAAY,QAAQ;AACvE,QAAI,UAAU;AACZ,iBAAW,OAAO,OAAO,KAAK,QAAQ,GAAG;AACvC,YAAI,CAAC,UAAU,SAAS,GAAG,GAAG;AAC5B,gBAAM,IAAI,MAAM,oBAAoB,QAAQ,IAAI,GAAG,gBAAgB,OAAO,QAAQ,IAAI,EAAE,EAAE;AAAA,QAC5F;AAAA,MACF;AAAA,IACF;AACA,WAAO,YAAY,OAAO,KAAK,QAAQ,EAAE,SAAS,IAAI,EAAE,UAAU,SAAS,IAAI,EAAE,SAAS;AAAA,EAC5F,CAAC;AAED,QAAM,oBAAoB,OAAO,UAAU,KAAK,IAAI;AACpD,QAAM,qBAAqB,OAAO,QAAQ,WAAW,OAAO,CAAC,cAAc;AACzE,UAAM,WAAW,eAAe,SAAS,EAAE,IAAI,WAAS,MAAM,QAAQ,EAAE,KAAK,IAAI;AACjF,WAAO,aAAa,qBAAqB,SAAS,WAAW,GAAG,iBAAiB,IAAI;AAAA,EACvF,CAAC;AAED,MAAI,mBAAmB,WAAW,GAAG;AACnC,UAAM,IAAI,MAAM,iDAAiD,OAAO,UAAU,KAAK,MAAM,CAAC,EAAE;AAAA,EAClG;AAEA,QAAM,UAAU,OAAO,QAAQ,IAAI,CAAC,WAAW;AAC7C,UAAM,oBAAoB,mBAAmB,OAAO,eAAa,UAAU,WAAW,MAAM;AAC5F,QAAI,kBAAkB,WAAW,GAAG;AAClC,YAAM,IAAI,MAAM,UAAU,MAAM,qCAAqC,OAAO,UAAU,KAAK,MAAM,CAAC,EAAE;AAAA,IACtG;AAEA,UAAM,gBAAgB,kBAAkB,MAAM,eAAa,UAAU,kBAAkB,IAAI;AAC3F,UAAM,QAAQ,CAAC,OAAO,UAAU,QAAQ,UAAU;AAClD,UAAM,OAAO,kBAAkB,OAA6B,CAAC,SAAS,cAAc;AAClF,aAAO,MAAM,QAAQ,UAAU,IAAI,IAAI,MAAM,QAAQ,OAAO,IAAI,UAAU,OAAO;AAAA,IACnF,GAAG,KAAK;AAER,UAAM,SAAwC;AAAA,MAC5C,MAAM;AAAA,MACN,QAAQ,OAAO,QAAQ,IAAI;AAAA,MAC3B,cAAc,cAAc,MAAM;AAAA,MAClC;AAAA,MACA;AAAA,MACA,YAAY;AAAA,MACZ,SAAS;AAAA,MACT;AAAA,MACA,GAAI,gBAAgB,EAAE,aAAa,EAAE,eAAe,KAAK,EAAE,IAAI,CAAC;AAAA,IAClE;AACA,WAAO,aAAa,0BAA0B,MAAM;AACpD,WAAO,UAAU,gBAAgB,MAAM;AACvC,WAAO;AAAA,EACT,CAAC;AAED,SAAO;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf,YAAY,OAAO,QAAQ,IAAI;AAAA,IAC/B;AAAA,IACA,kBAAkB;AAAA,MAChB,YAAY,OAAO,QAAQ,IAAI;AAAA,MAC/B,iBAAiB,OAAO,QAAQ,IAAI,WAAW,OAAO,QAAQ;AAAA,MAC9D,gBAAgB,OAAO;AAAA,MACvB,qBAAqB,OAAO,QAAQ,IAAI;AAAA,MACxC,kBAAkB,OAAO;AAAA,QACvB,MAAM,KAAK,YAAY,QAAQ,CAAC,EAAE;AAAA,UAAQ,CAAC,CAAC,UAAU,QAAQ,MAC5D,OAAO,QAAQ,QAAQ,EAAE,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,GAAG,QAAQ,IAAI,GAAG,IAAI,KAAK,CAAU;AAAA,QACvF;AAAA,MACF;AAAA,IACF;AAAA,IACA,aAAa,QAAQ,IAAI,YAAU,OAAO,UAAU;AAAA,IACpD,SAAS,QAAQ,IAAI,YAAU,OAAO,OAAO,EAAE,KAAK,IAAI;AAAA,EAC1D;AACF;;;AC3KA,SAAS,6BAAAC,4BAA2B,uBAAuB;AAG3D,SAAS,gBAAgB,QAAkB,cAAqF;AAC9H,QAAM,UAAkC,CAAC;AACzC,QAAM,cAAwB,CAAC;AAC/B,QAAM,aAAa,IAAI,IAAI,gBAAgB,CAAC,CAAC;AAE7C,WAAS,QAAQ,GAAG,QAAQ,OAAO,QAAQ,SAAS,GAAG;AACrD,UAAM,QAAQ,OAAO,KAAK;AAE1B,QAAI,MAAM,WAAW,IAAI,GAAG;AAE1B,YAAM,WAAW,MAAM,MAAM,CAAC;AAC9B,YAAM,UAAU,SAAS,QAAQ,GAAG;AACpC,UAAI,WAAW,GAAG;AAChB,gBAAQ,SAAS,MAAM,GAAG,OAAO,CAAC,IAAI,SAAS,MAAM,UAAU,CAAC;AAChE;AAAA,MACF;AAEA,YAAM,OAAO,OAAO,QAAQ,CAAC;AAC7B,UAAI,QAAQ,CAAC,KAAK,WAAW,GAAG,GAAG;AACjC,gBAAQ,QAAQ,IAAI;AACpB,iBAAS;AACT;AAAA,MACF;AAEA,cAAQ,QAAQ,IAAI;AAAA,IACtB,WACS,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,KAAK,CAAC,OAAO,KAAK,KAAK,GAAG;AAEzE,YAAM,MAAM,MAAM,MAAM,CAAC;AAEzB,UAAI,IAAI,WAAW,KAAK,CAAC,WAAW,IAAI,GAAG,GAAG;AAE5C,gBAAQ,GAAG,IAAI;AAAA,MACjB,OACK;AAEH,cAAM,OAAO,OAAO,QAAQ,CAAC;AAC7B,YAAI,QAAQ,CAAC,KAAK,WAAW,GAAG,GAAG;AACjC,kBAAQ,GAAG,IAAI;AACf,mBAAS;AAAA,QACX,OACK;AACH,kBAAQ,GAAG,IAAI;AAAA,QACjB;AAAA,MACF;AAAA,IACF,OACK;AACH,kBAAY,KAAK,KAAK;AAAA,IACxB;AAAA,EACF;AAEA,SAAO,EAAE,SAAS,YAAY;AAChC;AAEA,SAAS,oBAAoB,SAAiB,UAA0C;AACtF,QAAM,QAAQ,QAAQ,MAAM,8BAA8B;AAC1D,MAAI,CAAC;AACH,WAAO;AAET,QAAM,CAAC,EAAE,MAAM,SAAS,IAAI;AAC5B,QAAM,QAAQ,SAAS,IAAI;AAC3B,MAAI,CAAC;AACH,UAAM,IAAI,MAAM,oBAAoB,IAAI,EAAE;AAC5C,MAAI,CAAC;AACH,WAAO;AAET,MAAI,cAAc,WAAW,cAAc,QAAQ;AACjD,UAAM,CAAC,OAAO,IAAI,IAAI,MAAM,MAAM,GAAG;AACrC,QAAI,CAAC,SAAS,CAAC;AACb,YAAM,IAAI,MAAM,WAAW,IAAI,6BAA6B;AAC9D,WAAO,cAAc,UAAU,QAAQ;AAAA,EACzC;AAEA,QAAM,IAAI,MAAM,kCAAkC,SAAS,EAAE;AAC/D;AAEA,SAAS,eAAe,UAAkB,UAA0C;AAClF,SAAO,SAAS,QAAQ,gBAAgB,CAAC,GAAG,eAAuB,oBAAoB,IAAI,UAAU,KAAK,QAAQ,CAAC;AACrH;AAEA,SAAS,mBAAmB,OAAiB,UAA2D;AACtG,SAAO,MAAM,IAAI,CAAC,UAAU;AAC1B,UAAM,CAAC,UAAU,eAAe,GAAG,IAAI,MAAM,MAAM,KAAK,CAAC;AACzD,QAAI,CAAC;AACH,YAAM,IAAI,MAAM,iCAAiC,KAAK,EAAE;AAE1D,QAAI,iBAAiB,KAAK;AACxB,aAAO,EAAE,SAAS;AAAA,IACpB;AAEA,UAAM,WAAW,OAAO;AAAA,MACtB,aAAa,MAAM,GAAG,EAAE,IAAI,CAAC,YAAY;AACvC,cAAM,CAAC,KAAK,QAAQ,IAAI,QAAQ,MAAM,KAAK,CAAC;AAC5C,YAAI,CAAC,OAAO,CAAC;AACX,gBAAM,IAAI,MAAM,6BAA6B,OAAO,EAAE;AACxD,eAAO,CAAC,KAAK,eAAe,UAAU,QAAQ,CAAC;AAAA,MACjD,CAAC;AAAA,IACH;AAEA,WAAO,EAAE,UAAU,SAAS;AAAA,EAC9B,CAAC;AACH;AAEA,SAAS,eAAe,WAA4B,MAA+C;AACjG,MAAI,KAAK,SAAS,UAAU,QAAQ;AAClC,WAAO;AAET,QAAM,SAAS,KAAK,MAAM,GAAG,UAAU,QAAQ,MAAM;AACrD,MAAI,OAAO,KAAK,IAAI,MAAM,UAAU,QAAQ,KAAK,IAAI;AACnD,WAAO;AAET,QAAM,YAAY,KAAK,MAAM,UAAU,QAAQ,MAAM;AACrD,QAAM,EAAE,SAAS,YAAY,IAAI,gBAAgB,WAAW,UAAU,gBAAgB;AAEtF,QAAM,sBAAsB,UAAU,eAAe,CAAC;AACtD,MAAI,YAAY,WAAW,oBAAoB;AAC7C,WAAO;AAET,aAAW,UAAU,UAAU,oBAAoB,CAAC,GAAG;AACrD,QAAI,CAAC,QAAQ,MAAM;AACjB,aAAO;AAAA,EACX;AAEA,QAAM,WAAmC,EAAE,GAAG,QAAQ;AACtD,sBAAoB,QAAQ,CAAC,MAAM,UAAU;AAC3C,aAAS,IAAI,IAAI,YAAY,KAAK;AAAA,EACpC,CAAC;AACD,SAAO;AACT;AAEA,SAAS,oBAAoB,MAA0B;AACrD,SAAO,KAAK,QAAQ,CAAC,UAAU;AAE7B,QAAI,MAAM,WAAW,GAAG,KAAK,CAAC,MAAM,WAAW,IAAI,KAAK,MAAM,SAAS,KAAK,aAAa,KAAK,KAAK,GAAG;AACpG,aAAO,MAAM,KAAK,MAAM,MAAM,CAAC,GAAG,OAAK,IAAI,CAAC,EAAE;AAAA,IAChD;AACA,WAAO,CAAC,KAAK;AAAA,EACf,CAAC;AACH;AAEA,SAAS,SAAS,YAA+B,MAAgB;AAC/D,SAAO,WAAW,QAAQ,CAAC,cAAc;AACvC,QAAI;AACF,YAAM,WAAW,eAAe,WAAW,IAAI;AAC/C,aAAO,WAAW,CAAC,EAAE,WAAW,SAAS,CAAC,IAAI,CAAC;AAAA,IACjD,QACM;AACJ,aAAO,CAAC;AAAA,IACV;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,eAAe,QAAuB,UAA8C;AACxG,QAAM,CAAC,YAAY,GAAG,WAAW,IAAI;AACrC,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AACA,MAAI,eAAe,OAAO,QAAQ,IAAI,YAAY;AAChD,UAAM,IAAI,MAAM,WAAW,OAAO,QAAQ,IAAI,EAAE,uBAAuB,OAAO,QAAQ,IAAI,UAAU,SAAS,UAAU,EAAE;AAAA,EAC3H;AAGA,MAAI,UAAU,SAAS,OAAO,QAAQ,YAAY,WAAW;AAG7D,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,WAAW,oBAAoB,WAAW;AAChD,QAAI,SAAS,WAAW,YAAY,QAAQ;AAC1C,gBAAU,SAAS,OAAO,QAAQ,YAAY,QAAQ;AAAA,IACxD;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,IAAI,MAAM,iCAAiC,SAAS,KAAK,GAAG,CAAC,EAAE;AAAA,EACvE;AACA,MAAI,QAAQ,SAAS,GAAG;AAEtB,YAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,QAAQ,SAAS,EAAE,UAAU,QAAQ,MAAM;AAC9E,cAAU,CAAC,QAAQ,CAAC,CAAE;AAAA,EACxB;AAEA,QAAM,EAAE,WAAW,SAAS,IAAI,QAAQ,CAAC;AACzC,QAAM,iBAAiB,mBAAmB,UAAU,gBAAgB,QAAQ;AAC5E,QAAM,SAAwC;AAAA,IAC5C,MAAM;AAAA,IACN,QAAQ,OAAO,QAAQ,IAAI;AAAA,IAC3B,cAAc,UAAU;AAAA,IACxB;AAAA,IACA,QAAQ,UAAU;AAAA,IAClB,YAAY;AAAA,IACZ,SAAS,eAAe,UAAU,SAAS,QAAQ;AAAA,IACnD,MAAM,UAAU;AAAA,IAChB,GAAI,UAAU,gBAAgB,EAAE,aAAa,EAAE,eAAe,KAAK,EAAE,IAAI,CAAC;AAAA,EAC5E;AACA,SAAO,aAAaA,2BAA0B,MAAM;AAEpD,SAAO;AAAA,IACL,SAAS,OAAO;AAAA,IAChB,QAAQ,OAAO;AAAA,IACf,QAAQ,OAAO;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,kBAAkB;AAAA,MAChB,MAAM;AAAA,MACN,WAAW,MAAM,gBAAgB,QAAQ;AAAA,MACzC,YAAY,OAAO,QAAQ,IAAI;AAAA,MAC/B,iBAAiB,OAAO,QAAQ,IAAI,WAAW,OAAO,QAAQ;AAAA,MAC9D,gBAAgB,OAAO;AAAA,MACvB,qBAAqB;AAAA,MACrB,kBAAkB;AAAA,IACpB;AAAA,IACA,YAAY,OAAO;AAAA,EACrB;AACF;;;AC3NA,SAAS,qBAAqB;AAIvB,IAAM,iBAAiB,cAAc;AAAA,EAC1C,MAAM;AAAA,IACJ,MAAM;AAAA,IACN,aAAa;AAAA,EACf;AAAA,EACA,MAAM;AAAA,IACJ,SAAS;AAAA,MACP,MAAM;AAAA,MACN,aAAa;AAAA,IACf;AAAA,IACA,GAAG;AAAA,MACD,MAAM;AAAA,MACN,aAAa;AAAA,MACb,UAAU;AAAA,IACZ;AAAA,EACF;AAAA,EACA,MAAM,IAAI,EAAE,QAAQ,GAAG;AACrB,UAAM,UAAU,sBAAsB,WAAW,CAAC,CAAC;AACnD,QAAI,QAAQ,WAAW;AACrB,YAAM,IAAI,MAAM,gFAAgF;AAElG,UAAM,aAAa,cAAc,WAAW,CAAC,GAAG,SAAS;AACzD,UAAM,SAAS,YAAY,QAAQ,CAAC,GAAI,UAAU;AAClD,UAAM,WAAW,MAAM,eAAe,QAAQ,OAAO;AAErD,YAAQ,OAAO,MAAM,GAAG,KAAK,UAAU;AAAA,MACrC,SAAS,SAAS,QAAQ,IAAI;AAAA,MAC9B,QAAQ,SAAS;AAAA,MACjB,WAAW,SAAS,OAAO;AAAA,MAC3B,SAAS,SAAS,OAAO;AAAA,MACzB,YAAY,SAAS;AAAA,MACrB,gBAAgB,SAAS,OAAO;AAAA,MAChC,eAAe,SAAS,OAAO,aAAa,iBAAiB;AAAA,MAC7D,gBAAgB,SAAS;AAAA,IAC3B,GAAG,MAAM,CAAC,CAAC;AAAA,CAAI;AAAA,EACjB;AACF,CAAC;AAEM,SAAS,sBAAsB,MAA0B;AAC9D,QAAM,YAAY,KAAK,QAAQ,IAAI;AACnC,SAAO,aAAa,IAAI,KAAK,MAAM,YAAY,CAAC,IAAI,CAAC;AACvD;AAEO,SAAS,cAAc,MAAgB,MAAkC;AAC9E,QAAM,YAAY,KAAK,QAAQ,IAAI;AACnC,QAAM,aAAa,aAAa,IAAI,KAAK,MAAM,GAAG,SAAS,IAAI;AAC/D,QAAM,QAAQ,WAAW,QAAQ,KAAK,IAAI,EAAE;AAC5C,MAAI,SAAS,KAAK,QAAQ,IAAI,WAAW;AACvC,WAAO,WAAW,QAAQ,CAAC;AAC7B,SAAO;AACT;;;ACrDA,SAAS,sBAAsB;AAC/B,SAAS,8BAA8B,sBAAsB;AAC7D,SAAS,oBAAoB;AAC7B,SAAS,gBAAgB;AACzB,OAAOC,cAAa;;;ACLpB,SAAS,cAAAC,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,WAAAC,gBAAe;AACxB,SAAS,QAAAC,aAAY;AASrB,IAAM,YAAYA,MAAKD,SAAQ,GAAG,WAAW,QAAQ,WAAW;AAEzD,SAASE,YAA4B;AAC1C,MAAI,CAACJ,YAAW,SAAS;AACvB,WAAO;AACT,MAAI;AACF,WAAO,KAAK,MAAMC,cAAa,WAAW,OAAO,CAAC;AAAA,EACpD,QACM;AACJ,WAAO;AAAA,EACT;AACF;AAEO,SAASI,WAAU,UAAkC;AAC1D,MAAI;AACF,WAAO;AACT,MAAI,QAAQ,IAAI;AACd,WAAO,QAAQ,IAAI;AACrB,MAAI,QAAQ,IAAI;AACd,WAAO,QAAQ,IAAI;AACrB,SAAOD,UAAS,GAAG,OAAO;AAC5B;AAEO,SAASE,gBAA8B;AAC5C,QAAM,OAAOF,UAAS;AACtB,MAAI,CAAC;AACH,WAAO;AACT,MAAI,KAAK,cAAc,KAAK,IAAI,IAAI,MAAO,KAAK,aAAa;AAC3D,WAAO;AACT,SAAO,KAAK;AACd;AAEO,SAAS,uBAAsC;AACpD,SAAOA,UAAS,GAAG,SAAS;AAC9B;;;AC3CA,eAAsBG,mBAAkB,QAAkD;AACxF,QAAM,WAAW,MAAM,MAAM,GAAG,MAAM,mCAAmC;AACzE,MAAI,CAAC,SAAS;AACZ,WAAO,CAAC;AACV,SAAO,SAAS,KAAK;AACvB;AAEA,eAAsBC,mBAAkB,QAAiC;AACvE,QAAM,YAAY,MAAMD,mBAAkB,MAAM;AAChD,SAAO,OAAO,UAAU,2BAA2B,GAAG,MAAM,aAAa;AAC3E;AAEA,eAAsBE,UACpB,MACA,UAKI,CAAC,GACO;AACZ,QAAM,QAAQ,QAAQ,SAASC,cAAa;AAC5C,MAAI,CAAC;AACH,UAAM,IAAI,MAAM,4CAA4C;AAE9D,QAAM,MAAM,QAAQ,OAAOC,WAAU;AACrC,MAAI,CAAC,KAAK,WAAW,MAAM,KAAK,CAAC;AAC/B,UAAM,IAAI,MAAM,uDAAuD;AAEzE,QAAM,MAAM,KAAK,WAAW,MAAM,IAAI,OAAO,GAAG,GAAG,GAAG,IAAI;AAC1D,QAAM,WAAW,MAAM,MAAM,KAAK;AAAA,IAChC,QAAQ,QAAQ,UAAU;AAAA,IAC1B,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,MAC9B,gBAAgB;AAAA,IAClB;AAAA,IACA,MAAM,QAAQ,OAAO,KAAK,UAAU,QAAQ,IAAI,IAAI;AAAA,EACtD,CAAC;AAED,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,OAAO,MAAM,SAAS,KAAK;AACjC,UAAM,IAAI,MAAM,QAAQ,GAAG,SAAS,MAAM,IAAI,SAAS,UAAU,EAAE;AAAA,EACrE;AAEA,SAAO,SAAS,KAAK;AACvB;;;AFrCA,SAAS,cAAc,OAAwC;AAC7D,QAAM,CAAC,EAAE,OAAO,IAAI,MAAM,MAAM,GAAG;AACnC,MAAI,CAAC;AACH,UAAM,IAAI,MAAM,aAAa;AAC/B,SAAO,KAAK,MAAM,OAAO,KAAK,SAAS,WAAW,EAAE,SAAS,OAAO,CAAC;AACvE;AAQA,eAAsB,kBACpB,UACA,QAK6E;AAC7E,QAAM,iBAAiB,MAAMC,mBAAkB,OAAO,GAAG;AACzD,QAAM,YAAY,qBAAqB;AACvC,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AACA,SAAOC,UAA6E,gBAAgB;AAAA,IAClG,QAAQ;AAAA,IACR,KAAK,OAAO;AAAA,IACZ,MAAM;AAAA,MACJ;AAAA,MACA,aAAa,SAAS;AAAA,MACtB,UAAU,SAAS,QAAQ,IAAI,YAAY;AAAA,MAC3C,YAAY,OAAO;AAAA,MACnB,SAAS,SAAS,iBAAiB;AAAA,MACnC,QAAQ,OAAO,UAAU,SAAS,OAAO;AAAA,MACzC,aAAa,CAAC,SAAS,UAAU;AAAA,MACjC,uBAAuB,CAAC,SAAS,MAAM;AAAA,MACvC,mBAAmB,SAAS;AAAA,IAC9B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,mBAAmB,KAAa,SAA6D;AACjH,QAAM,iBAAiB,MAAMD,mBAAkB,GAAG;AAClD,QAAM,WAAW,KAAK,IAAI,IAAI;AAE9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,UAAM,QAAQ,MAAMC,UAAoE,GAAG,cAAc,IAAI,OAAO,IAAI,EAAE,IAAI,CAAC;AAC/H,QAAI,MAAM,WAAW,cAAc,MAAM,WAAW,YAAY,MAAM,WAAW;AAC/E,aAAO,MAAM;AACf,UAAM,IAAI,QAAQ,aAAW,WAAW,SAAS,GAAI,CAAC;AAAA,EACxD;AAEA,QAAM,IAAI,MAAM,sCAAsC;AACxD;AAEA,eAAsB,gBAAgB,KAAa,SAAkC;AACnF,QAAM,iBAAiB,MAAMD,mBAAkB,GAAG;AAClD,QAAM,WAAW,MAAMC,UAAgC,GAAG,cAAc,IAAI,OAAO,UAAU;AAAA,IAC3F,QAAQ;AAAA,IACR;AAAA,EACF,CAAC;AACD,SAAO,SAAS;AAClB;AAEA,SAAS,kBAAkB,QAAkE;AAC3F,QAAM,UAAU,OAAO;AACvB,MAAI,CAAC,MAAM,QAAQ,OAAO;AACxB,WAAO,CAAC;AAEV,SAAO,QAAQ;AAAA,IAAO,CAAC,WACrB,OAAO,WAAW,YACf,WAAW,QACV,OAAmC,SAAS;AAAA,EAClD;AACF;AAEA,SAAS,sBAAsB,QAA0C;AACvE,SAAO,kBAAkB,MAAM,EAAE,SAAS;AAC5C;AAYA,eAAsB,iBAAiB,OAAe,UAA0C;AAC9F,QAAM,UAAU,cAAc,KAAK;AACnC,QAAM,SAAS,OAAO,QAAQ,OAAO,EAAE;AACvC,MAAI,CAAC;AACH,UAAM,IAAI,MAAM,+BAA+B;AAEjD,QAAM,YAAY,MAAMC,mBAAkB,MAAM;AAChD,QAAM,UAAU,OAAO,UAAU,YAAY,GAAG,MAAM,wBAAwB;AAC9E,QAAM,SAAS,MAAM,eAAe,OAAO;AAAA,IACzC,aAAa;AAAA,IACb,aAAa,SAAS,QAAQ,IAAI,YAAY;AAAA,IAC9C;AAAA,EACF,CAAC;AAED,MAAI,CAAC,OAAO,SAAS,CAAC,OAAO,QAAQ;AACnC,UAAM,IAAI,MAAM,OAAO,SAAS,2BAA2B;AAAA,EAC7D;AAEA,QAAM,SAAS,OAAO;AACtB,QAAM,UAAU,kBAAkB,MAA4C;AAE9E,MAAI,OAAO,mBAAmB,kBAAkB,OAAO,kBAAkB,mBAAmB,SAAS,QAAQ;AAC3G,UAAM,IAAI,MAAM,yBAAyB;AAAA,EAC3C;AAEA,MAAI,CAAC,sBAAsB,MAA4C,GAAG;AACxE,UAAM,OAAO,SAAS,iBAAiB;AACvC,QAAI,CAAC,MAAM,QAAQ;AACjB,YAAM,IAAI,MAAM,kCAAkC;AAAA,IACpD;AACA,UAAM,kBAAkB,MAAM,eAAe,KAAK,KAAK,GAAG,CAAC;AAC3D,QAAI,OAAO,SAAS,KAAK,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG;AAClD,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AACA,QAAI,OAAO,YAAY,OAAO,aAAa,iBAAiB;AAC1D,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AACA,QAAI,CAAC,OAAO,SAAS,UAAU,CAAC,OAAO,UAAU;AAC/C,YAAM,IAAI,MAAM,oEAAoE;AAAA,IACtF;AAAA,EACF,OACK;AACH,QAAI,CAAC,QAAQ,KAAK,YAAU,6BAA6B,QAAQ,SAAS,MAAM,CAAC,GAAG;AAClF,YAAM,IAAI,MAAM,6CAA6C,SAAS,UAAU,EAAE;AAAA,IACpF;AAEA,UAAM,gBAAgB,QAAQ;AAAA,MAAK,YACjC,6BAA6B,QAAQ,SAAS,MAAM,KAAK,OAAO,aAAa;AAAA,IAC/E;AAEA,UAAM,SAAS,OAAO,eAAe,UAAU,OAAO,aAAa;AACnE,UAAM,kBAAkB,iBAAkB,UAAU,CAAC,CAAC,OAAO,mBAAmB;AAEhF,QAAI,mBAAmB,OAAO,mBAAmB,cAAc,SAAS,iBAAiB,WAAW;AAClG,YAAM,IAAI,MAAM,6CAA6C;AAAA,IAC/D;AAAA,EACF;AAEA,QAAM,iBAAiB,MAAMF,mBAAkB,MAAM;AACrD,QAAM,UAAU,MAAM,MAAM,GAAG,cAAc,IAAI,OAAO,QAAQ,YAAY;AAAA,IAC1E,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,eAAe,UAAU,KAAK;AAAA,IAChC;AAAA,EACF,CAAC;AAED,MAAI,CAAC,QAAQ,IAAI;AACf,UAAM,IAAI,MAAM,mBAAmB,QAAQ,MAAM,IAAI,QAAQ,UAAU,EAAE;AAAA,EAC3E;AAEA,QAAM,gBAAgB,MAAM,QAAQ,KAAK;AACzC,MAAI,cAAc,OAAO;AACvB,UAAM,IAAI,MAAM,mCAAmC,cAAc,KAAK,EAAE;AAAA,EAC1E;AACF;AAOO,SAAS,uBAAuB,UAAiC;AACtE,EAAAG,SAAQ,KAAK,cAAc,SAAS,iBAAiB,QAAQ,CAAC,SAAS,YAAY,GAAG,SAAS,WAAW,GAAG,KAAK,GAAG,CAAC,EAAE;AACxH,eAAa,SAAS,YAAY,SAAS,aAAa,EAAE,OAAO,UAAU,CAAC;AAC9E;AAMA,eAAsB,iBAAiB,OAAe,UAA0C;AAC9F,QAAM,iBAAiB,OAAO,QAAQ;AACtC,yBAAuB,QAAQ;AACjC;AAEA,eAAsB,kBACpB,UACA,KACwB;AACxB,QAAM,iBAAiB,MAAMH,mBAAkB,GAAG;AAClD,QAAM,WAAW,MAAMC;AAAA,IACrB,GAAG,cAAc;AAAA,IACjB,EAAE,IAAI;AAAA,EACR;AAEA,QAAM,MAAM,KAAK,MAAM,KAAK,IAAI,IAAI,GAAI;AACxC,QAAM,mBAAmB,SAAS,QAAQ,IAAI,YAAY;AAE1D,aAAW,SAAS,SAAS,MAAM;AACjC,UAAM,MAAM,MAAM;AAClB,QAAI,IAAI,eAAe;AACrB;AACF,QAAI,IAAI,eAAe,WAAW,MAAM,cAAc,MAAM,cAAc;AACxE;AACF,QAAI,IAAI,aAAa;AACnB;AACF,QAAI,IAAI,mBAAmB,kBAAkB,IAAI,kBAAkB,mBAAmB,SAAS;AAC7F;AAEF,UAAM,cAAc,IAAI,yBAAyB,CAAC,GAAG;AAAA,MACnD,CAAC,MAA0C,EAAE,SAAS;AAAA,IACxD;AAEA,QAAI,WAAW,SAAS,GAAG;AACzB,UAAI,WAAW,KAAK,YAAU,6BAA6B,QAAQ,SAAS,MAAM,CAAC;AACjF,eAAO,MAAM;AAAA,IACjB,WACS,IAAI,aAAa,SAAS,SAAS,UAAU,GAAG;AACvD,aAAO,MAAM;AAAA,IACf;AAAA,EACF;AAEA,SAAO;AACT;;;AG3OA,SAAS,kBAAAG,uBAAsB;AAG/B,eAAsB,8BACpB,SACA,SAG4B;AAC5B,SAAO;AAAA,IACL,SAAS;AAAA,MACP,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,UAAU,QAAQ;AAAA,MAClB,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA,UAAU,MAAMA,gBAAe,QAAQ,KAAK,GAAG,CAAC;AAAA,MAChD,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,MACnD,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AAAA,EACF;AACF;AAEA,eAAsB,+BACpB,UACA,SAC4B;AAC5B,QAAM,UAAU,YAAY,WAAW,CAAC,SAAS,MAAM,IAAI,SAAS;AACpE,QAAM,cAAc,gBAAgB,WAAW,CAAC,SAAS,UAAU,IAAI,SAAS;AAChF,QAAM,UAAU,sBAAsB,YAAY,SAAS,iBAAiB,MAAM,SAC9E,SAAS,iBAAiB,OAC1B;AAEJ,SAAO;AAAA,IACL,SAAS;AAAA,MACP,WAAW,QAAQ;AAAA,MACnB,aAAa,QAAQ;AAAA,MACrB,UAAU,SAAS,QAAQ,IAAI,YAAY;AAAA,MAC3C,YAAY,QAAQ;AAAA,MACpB;AAAA,MACA,uBAAuB;AAAA,MACvB,mBAAmB,SAAS;AAAA,MAC5B,GAAI,UAAU,EAAE,QAAQ,IAAI,CAAC;AAAA,MAC7B,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,EAAE,QAAQ,aAAa,WAAW,SAAS,UAAU,QAAQ,CAAC,GAAG,QAAQ;AAAA,MAC3H,GAAI,QAAQ,SAAS,EAAE,QAAQ,QAAQ,OAAO,IAAI,CAAC;AAAA,IACrD;AAAA,EACF;AACF;","names":["readFileSync","homedir","Buffer","base","existsSync","homedir","join","createHash","existsSync","mkdirSync","readdirSync","readFileSync","homedir","join","digest","existsSync","join","homedir","readdirSync","readFileSync","existsSync","mkdirSync","readFileSync","writeFileSync","homedir","join","basename","consola","basename","consola","canonicalizeCliPermission","consola","existsSync","readFileSync","homedir","join","loadAuth","getIdpUrl","getAuthToken","discoverEndpoints","getGrantsEndpoint","apiFetch","getAuthToken","getIdpUrl","getGrantsEndpoint","apiFetch","discoverEndpoints","consola","computeCmdHash"]}

package/dist/chunk-TBYYREL6.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/config.ts"],"sourcesContent":["import { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\n\nexport interface AuthData {\n  idp: string\n  access_token: string\n  refresh_token?: string\n  email: string\n  expires_at: number\n}\n\nexport interface ApesConfig {\n  defaults?: {\n    idp?: string\n    approval?: string\n  }\n  agent?: {\n    key?: string\n    email?: string\n  }\n}\n\nconst CONFIG_DIR = join(homedir(), '.config', 'apes')\nconst AUTH_FILE = join(CONFIG_DIR, 'auth.json')\nconst CONFIG_FILE = join(CONFIG_DIR, 'config.toml')\n\nfunction ensureDir() {\n  if (!existsSync(CONFIG_DIR)) {\n    mkdirSync(CONFIG_DIR, { recursive: true })\n  }\n}\n\nexport function loadAuth(): AuthData | null {\n  if (!existsSync(AUTH_FILE))\n    return null\n  try {\n    return JSON.parse(readFileSync(AUTH_FILE, 'utf-8'))\n  }\n  catch {\n    return null\n  }\n}\n\nexport function saveAuth(data: AuthData): void {\n  ensureDir()\n  writeFileSync(AUTH_FILE, JSON.stringify(data, null, 2), { mode: 0o600 })\n}\n\nexport function clearAuth(): void {\n  if (existsSync(AUTH_FILE)) {\n    writeFileSync(AUTH_FILE, '', { mode: 0o600 })\n  }\n  // Also wipe the [agent] section from config.toml so logout disables\n  // auto-refresh. Preserves [defaults] so the IdP URL stays configured.\n  if (existsSync(CONFIG_FILE)) {\n    const existing = loadConfig()\n    if (existing.agent) {\n      const { agent: _removed, ...rest } = existing\n      saveConfig(rest)\n    }\n  }\n}\n\nexport function loadConfig(): ApesConfig {\n  if (!existsSync(CONFIG_FILE))\n    return {}\n  try {\n    return parseTOML(readFileSync(CONFIG_FILE, 'utf-8'))\n  }\n  catch {\n    return {}\n  }\n}\n\nfunction parseTOML(content: string): ApesConfig {\n  const config: ApesConfig = {}\n  let section = ''\n\n  for (const line of content.split('\\n')) {\n    const trimmed = line.trim()\n    if (!trimmed || trimmed.startsWith('#'))\n      continue\n\n    const sectionMatch = trimmed.match(/^\\[(.+)\\]$/)\n    if (sectionMatch) {\n      section = sectionMatch[1]!\n      continue\n    }\n\n    const kvMatch = trimmed.match(/^(\\w+)\\s*=\\s*\"(.+)\"$/)\n    if (kvMatch) {\n      const [, key, value] = kvMatch\n      if (section === 'defaults') {\n        config.defaults = config.defaults || {}\n        ;(config.defaults as Record<string, string>)[key!] = value!\n      }\n      else if (section === 'agent') {\n        config.agent = config.agent || {}\n        ;(config.agent as Record<string, string>)[key!] = value!\n      }\n    }\n  }\n\n  return config\n}\n\nexport function saveConfig(config: ApesConfig): void {\n  ensureDir()\n  const lines: string[] = []\n\n  if (config.defaults) {\n    lines.push('[defaults]')\n    for (const [key, value] of Object.entries(config.defaults)) {\n      if (value)\n        lines.push(`${key} = \"${value}\"`)\n    }\n    lines.push('')\n  }\n\n  if (config.agent) {\n    lines.push('[agent]')\n    for (const [key, value] of Object.entries(config.agent)) {\n      if (value)\n        lines.push(`${key} = \"${value}\"`)\n    }\n    lines.push('')\n  }\n\n  writeFileSync(CONFIG_FILE, lines.join('\\n'), { mode: 0o600 })\n}\n\nexport function getIdpUrl(explicit?: string): string | null {\n  if (explicit)\n    return explicit\n  if (process.env.APES_IDP)\n    return process.env.APES_IDP\n\n  const auth = loadAuth()\n  if (auth?.idp)\n    return auth.idp\n\n  const config = loadConfig()\n  if (config.defaults?.idp)\n    return config.defaults.idp\n\n  return null\n}\n\nexport function getAuthToken(): string | null {\n  const auth = loadAuth()\n  if (!auth)\n    return null\n\n  // Check expiry (with 30s buffer)\n  if (auth.expires_at && Date.now() / 1000 > auth.expires_at - 30) {\n    return null // expired\n  }\n\n  return auth.access_token\n}\n\nexport function getRequesterIdentity(): string | null {\n  return loadAuth()?.email ?? null\n}\n\nexport { CONFIG_DIR, AUTH_FILE }\n"],"mappings":";;;AAAA,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,eAAe;AACxB,SAAS,YAAY;AAqBrB,IAAM,aAAa,KAAK,QAAQ,GAAG,WAAW,MAAM;AACpD,IAAM,YAAY,KAAK,YAAY,WAAW;AAC9C,IAAM,cAAc,KAAK,YAAY,aAAa;AAElD,SAAS,YAAY;AACnB,MAAI,CAAC,WAAW,UAAU,GAAG;AAC3B,cAAU,YAAY,EAAE,WAAW,KAAK,CAAC;AAAA,EAC3C;AACF;AAEO,SAAS,WAA4B;AAC1C,MAAI,CAAC,WAAW,SAAS;AACvB,WAAO;AACT,MAAI;AACF,WAAO,KAAK,MAAM,aAAa,WAAW,OAAO,CAAC;AAAA,EACpD,QACM;AACJ,WAAO;AAAA,EACT;AACF;AAEO,SAAS,SAAS,MAAsB;AAC7C,YAAU;AACV,gBAAc,WAAW,KAAK,UAAU,MAAM,MAAM,CAAC,GAAG,EAAE,MAAM,IAAM,CAAC;AACzE;AAEO,SAAS,YAAkB;AAChC,MAAI,WAAW,SAAS,GAAG;AACzB,kBAAc,WAAW,IAAI,EAAE,MAAM,IAAM,CAAC;AAAA,EAC9C;AAGA,MAAI,WAAW,WAAW,GAAG;AAC3B,UAAM,WAAW,WAAW;AAC5B,QAAI,SAAS,OAAO;AAClB,YAAM,EAAE,OAAO,UAAU,GAAG,KAAK,IAAI;AACrC,iBAAW,IAAI;AAAA,IACjB;AAAA,EACF;AACF;AAEO,SAAS,aAAyB;AACvC,MAAI,CAAC,WAAW,WAAW;AACzB,WAAO,CAAC;AACV,MAAI;AACF,WAAO,UAAU,aAAa,aAAa,OAAO,CAAC;AAAA,EACrD,QACM;AACJ,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,UAAU,SAA6B;AAC9C,QAAM,SAAqB,CAAC;AAC5B,MAAI,UAAU;AAEd,aAAW,QAAQ,QAAQ,MAAM,IAAI,GAAG;AACtC,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,CAAC,WAAW,QAAQ,WAAW,GAAG;AACpC;AAEF,UAAM,eAAe,QAAQ,MAAM,YAAY;AAC/C,QAAI,cAAc;AAChB,gBAAU,aAAa,CAAC;AACxB;AAAA,IACF;AAEA,UAAM,UAAU,QAAQ,MAAM,sBAAsB;AACpD,QAAI,SAAS;AACX,YAAM,CAAC,EAAE,KAAK,KAAK,IAAI;AACvB,UAAI,YAAY,YAAY;AAC1B,eAAO,WAAW,OAAO,YAAY,CAAC;AACrC,QAAC,OAAO,SAAoC,GAAI,IAAI;AAAA,MACvD,WACS,YAAY,SAAS;AAC5B,eAAO,QAAQ,OAAO,SAAS,CAAC;AAC/B,QAAC,OAAO,MAAiC,GAAI,IAAI;AAAA,MACpD;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,WAAW,QAA0B;AACnD,YAAU;AACV,QAAM,QAAkB,CAAC;AAEzB,MAAI,OAAO,UAAU;AACnB,UAAM,KAAK,YAAY;AACvB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,QAAQ,GAAG;AAC1D,UAAI;AACF,cAAM,KAAK,GAAG,GAAG,OAAO,KAAK,GAAG;AAAA,IACpC;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AAEA,MAAI,OAAO,OAAO;AAChB,UAAM,KAAK,SAAS;AACpB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,KAAK,GAAG;AACvD,UAAI;AACF,cAAM,KAAK,GAAG,GAAG,OAAO,KAAK,GAAG;AAAA,IACpC;AACA,UAAM,KAAK,EAAE;AAAA,EACf;AAEA,gBAAc,aAAa,MAAM,KAAK,IAAI,GAAG,EAAE,MAAM,IAAM,CAAC;AAC9D;AAEO,SAAS,UAAU,UAAkC;AAC1D,MAAI;AACF,WAAO;AACT,MAAI,QAAQ,IAAI;AACd,WAAO,QAAQ,IAAI;AAErB,QAAM,OAAO,SAAS;AACtB,MAAI,MAAM;AACR,WAAO,KAAK;AAEd,QAAM,SAAS,WAAW;AAC1B,MAAI,OAAO,UAAU;AACnB,WAAO,OAAO,SAAS;AAEzB,SAAO;AACT;AAEO,SAAS,eAA8B;AAC5C,QAAM,OAAO,SAAS;AACtB,MAAI,CAAC;AACH,WAAO;AAGT,MAAI,KAAK,cAAc,KAAK,IAAI,IAAI,MAAO,KAAK,aAAa,IAAI;AAC/D,WAAO;AAAA,EACT;AAEA,SAAO,KAAK;AACd;AAEO,SAAS,uBAAsC;AACpD,SAAO,SAAS,GAAG,SAAS;AAC9B;","names":[]}

package/dist/orchestrator-JAMWD6DD.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/shell/orchestrator.ts","../src/shell/grant-dispatch.ts","../src/shell/pty-bridge.ts","../src/shell/repl.ts","../src/shell/multi-line.ts","../src/shell/session.ts"],"sourcesContent":["import { hostname } from 'node:os'\nimport consola from 'consola'\nimport { loadAuth } from '../config.js'\nimport { requestGrantForShellLine } from './grant-dispatch.js'\nimport { PtyBridge } from './pty-bridge.js'\nimport { ShellRepl } from './repl.js'\nimport { ShellSession } from './session.js'\n\n/**\n * Orchestrates the interactive ape-shell session by wiring the user-facing\n * REPL to a persistent bash child via the PtyBridge. Keeps both components\n * decoupled so each can be unit-tested in isolation.\n *\n * Flow per user-entered line:\n *   1. ShellRepl emits onLine with the completed (possibly multi-line) buffer\n *   2. Line goes through the grant flow. If denied: session logs the denial,\n *      we surface the reason, and return without touching bash.\n *   3. On approval we enter \"output mode\" (raw stdin passthrough so TUI apps\n *      like vim/less/top receive raw keystrokes) and write the line to bash.\n *   4. bash output streams back to stdout live via PtyBridge.onOutput\n *   5. When the marker-bearing PS1 reappears we resolve the pending promise,\n *      readline takes back the terminal, and the next prompt is drawn.\n *\n * The orchestrator also owns the lifecycle niceties:\n *   - SIGWINCH is forwarded to the pty so TUI apps re-render at the right size\n *   - SIGTERM / SIGHUP trigger a clean shutdown (kill bash, restore TTY mode,\n *     close the audit session)\n *   - An emergency process.on('exit') handler restores the terminal out of\n *     raw mode in case a crash left it there\n *\n * Every line is recorded in the audit log via the ShellSession — granted,\n * denied, and done events with seq numbers correlating each event to its\n * parent line within the session.\n */\nexport async function runInteractiveShell(): Promise<void> {\n  /**\n   * When a line is written into the bash pty, handleLine stashes a\n   * resolver here so the PtyBridge's onLineDone can wake it up.\n   */\n  let pendingResolve: (() => void) | null = null\n  let lastExitCode = 0\n  let shuttingDown = false\n  // Forward reference to the REPL so the bridge's onExit can stop it when\n  // bash dies. Assigned after construction below.\n  let repl: ShellRepl | null = null\n\n  // Spawn the bash child up-front so the REPL can write to it as soon as the\n  // first line is accepted. Output from bash goes straight to the terminal.\n  const bridge = new PtyBridge(\n    {\n      onOutput: (chunk) => {\n        // Live streaming to the user's terminal. Always written straight\n        // through so TUI apps (vim, less, top) get their escape sequences\n        // on time.\n        process.stdout.write(chunk)\n      },\n      onLineDone: (frame) => {\n        if (pendingResolve) {\n          const r = pendingResolve\n          pendingResolve = null\n          lastExitCode = frame.exitCode\n          r()\n        }\n      },\n      onExit: (exitCode) => {\n        // bash itself died — typically because the user ran `exit`.\n        // Tear down the REPL so run() returns cleanly.\n        if (!shuttingDown) {\n          process.stdout.write(`\\n[bash exited with code ${exitCode}]\\n`)\n          repl?.stop()\n        }\n      },\n    },\n  )\n\n  await bridge.waitForReady()\n\n  const targetHost = hostname()\n  const auth = loadAuth()\n  const session = new ShellSession({\n    host: targetHost,\n    requester: auth?.email ?? 'unknown',\n  })\n\n  repl = new ShellRepl(\n    {\n      onLine: async (line) => {\n        // --- 1. Gate the line through the grant flow BEFORE bash sees it ---\n        const grant = await requestGrantForShellLine(line, {\n          targetHost,\n          approval: 'once',\n        })\n\n        if (grant.kind === 'denied') {\n          session.logLineDenied({ line, reason: grant.reason })\n          consola.error(grant.reason)\n          return\n        }\n\n        const seq = session.logLineGranted({\n          line,\n          grantId: grant.grantId,\n          grantMode: grant.mode,\n        })\n\n        // --- 2. Raw-mode stdin passthrough while bash runs the line ---\n        const wasRaw = process.stdin.isTTY && (process.stdin as NodeJS.ReadStream).isRaw\n        if (process.stdin.isTTY && !wasRaw)\n          (process.stdin as NodeJS.ReadStream).setRawMode(true)\n\n        const forward = (chunk: Buffer) => {\n          bridge.writeRaw(chunk.toString())\n        }\n        const rawInputAvailable = process.stdin.isTTY === true\n        if (rawInputAvailable)\n          process.stdin.on('data', forward)\n\n        try {\n          await new Promise<void>((resolve) => {\n            pendingResolve = resolve\n            bridge.writeLine(line)\n          })\n        }\n        finally {\n          if (rawInputAvailable) {\n            process.stdin.off('data', forward)\n            if (!wasRaw && process.stdin.isTTY)\n              (process.stdin as NodeJS.ReadStream).setRawMode(false)\n          }\n        }\n\n        session.logLineDone({ seq, exitCode: lastExitCode })\n\n        if (lastExitCode !== 0) {\n          consola.debug(`(exit ${lastExitCode})`)\n        }\n      },\n      onExit: () => {\n        shuttingDown = true\n        session.close()\n        try {\n          bridge.kill()\n        }\n        catch {}\n      },\n    },\n  )\n\n  // SIGWINCH forwarding so TUI apps re-render at the right dimensions.\n  const onResize = () => {\n    const cols = process.stdout.columns ?? 80\n    const rows = process.stdout.rows ?? 24\n    try {\n      bridge.resize(cols, rows)\n    }\n    catch {}\n  }\n  process.stdout.on('resize', onResize)\n\n  // Emergency TTY restore — if a crash leaves stdin in raw mode, subsequent\n  // terminal input becomes unusable until the user manually runs `reset`.\n  // This handler fires on clean exit and on uncaught exceptions.\n  const restoreTty = () => {\n    if (process.stdin.isTTY && (process.stdin as NodeJS.ReadStream).isRaw) {\n      try {\n        (process.stdin as NodeJS.ReadStream).setRawMode(false)\n      }\n      catch {}\n    }\n  }\n  process.on('exit', restoreTty)\n\n  // Clean shutdown on termination signals. kill() is idempotent in node-pty,\n  // and session.close() swallows audit-log errors internally, so this is safe\n  // to call even if already shutting down.\n  const gracefulShutdown = () => {\n    if (shuttingDown)\n      return\n    shuttingDown = true\n    restoreTty()\n    try {\n      session.close()\n    }\n    catch {}\n    try {\n      bridge.kill()\n    }\n    catch {}\n    try {\n      repl?.stop()\n    }\n    catch {}\n  }\n  process.on('SIGTERM', gracefulShutdown)\n  process.on('SIGHUP', gracefulShutdown)\n\n  try {\n    await repl.run()\n  }\n  finally {\n    process.stdout.off('resize', onResize)\n    process.off('exit', restoreTty)\n    process.off('SIGTERM', gracefulShutdown)\n    process.off('SIGHUP', gracefulShutdown)\n  }\n}\n","import { basename } from 'node:path'\nimport consola from 'consola'\nimport { loadAuth } from '../config.js'\nimport { apiFetch, getGrantsEndpoint } from '../http.js'\nimport {\n  createShapesGrant,\n  fetchGrantToken,\n  findExistingGrant,\n  loadOrInstallAdapter,\n  parseShellCommand,\n  resolveCommand,\n  verifyAndConsume,\n  waitForGrantStatus,\n} from '../shapes/index.js'\n\n/**\n * Result of attempting to obtain a grant for a shell line. On success the\n * REPL may proceed to execute the line in its persistent bash pty. On\n * failure the caller should surface `reason` and discard the line.\n */\nexport type GrantLineResult =\n  | { kind: 'approved', grantId: string, mode: 'adapter' | 'session' }\n  | { kind: 'denied', reason: string }\n\n/**\n * Options the orchestrator passes to `requestGrantForShellLine`. They\n * mirror what the `apes run --shell` path reads from its citty args, but\n * come directly from the shell session context instead.\n */\nexport interface GrantLineOptions {\n  /** Target host name. Usually `os.hostname()`. */\n  targetHost: string\n  /** Approval mode — almost always 'once' for interactive shell lines. */\n  approval?: 'once' | 'timed' | 'always'\n}\n\n/**\n * Obtain a grant for a shell line so the interactive REPL may execute it\n * against its persistent bash child.\n *\n * Dispatch strategy mirrors the existing one-shot `tryAdapterModeFromShell`\n * flow:\n *   1. Try to resolve the line as an adapter-backed command (structured\n *      grant with resource chain / permission).\n *   2. If the adapter path succeeds, reuse an existing matching grant or\n *      request a new one, verify + consume it.\n *   3. If the adapter path fails (compound line, no matching adapter,\n *      resolve failure) fall back to a generic `ape-shell` session grant\n *      for the target host.\n *\n * Returns without executing anything. The caller (the orchestrator)\n * decides how to run the line — typically by writing it to bash's pty.\n */\nexport async function requestGrantForShellLine(\n  line: string,\n  options: GrantLineOptions,\n): Promise<GrantLineResult> {\n  const auth = loadAuth()\n  if (!auth) {\n    return { kind: 'denied', reason: 'Not logged in. Run `apes login` first.' }\n  }\n  const idp = auth.idp\n  if (!idp) {\n    return { kind: 'denied', reason: 'No IdP URL configured. Run `apes login` first.' }\n  }\n\n  // --- 1. Adapter path ---\n  const parsed = parseShellCommand(line)\n  if (parsed && !parsed.isCompound) {\n    try {\n      const loaded = await loadOrInstallAdapter(parsed.executable)\n      if (loaded) {\n        const normalizedExecutable = basename(parsed.executable)\n        const resolved = await resolveCommand(loaded, [normalizedExecutable, ...parsed.argv])\n\n        // Try to reuse an existing matching grant first.\n        try {\n          const existingGrantId = await findExistingGrant(resolved, idp)\n          if (existingGrantId) {\n            consola.info(`Reusing grant ${existingGrantId} for: ${resolved.detail.display}`)\n            const token = await fetchGrantToken(idp, existingGrantId)\n            await verifyAndConsume(token, resolved)\n            return { kind: 'approved', grantId: existingGrantId, mode: 'adapter' }\n          }\n        }\n        catch (err) {\n          consola.debug(`ape-shell: findExistingGrant failed, will request new grant:`, err)\n        }\n\n        // Request a new adapter-backed grant.\n        consola.info(`Requesting grant for: ${resolved.detail.display}`)\n        const grant = await createShapesGrant(resolved, {\n          idp,\n          approval: options.approval ?? 'once',\n          reason: `ape-shell: ${resolved.detail.display}`,\n        })\n        consola.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`)\n\n        const status = await waitForGrantStatus(idp, grant.id)\n        if (status !== 'approved') {\n          return { kind: 'denied', reason: `Grant ${status}` }\n        }\n\n        const token = await fetchGrantToken(idp, grant.id)\n        await verifyAndConsume(token, resolved)\n        return { kind: 'approved', grantId: grant.id, mode: 'adapter' }\n      }\n    }\n    catch (err) {\n      // Adapter resolution failed — debug-log and fall through to the\n      // generic session grant path.\n      consola.debug(`ape-shell: adapter resolve failed, falling back to session grant:`, err)\n    }\n  }\n\n  // --- 2. Generic session grant (ape-shell audience) ---\n  const grantsUrl = await getGrantsEndpoint(idp)\n\n  // Try to reuse an existing timed/always session grant first.\n  try {\n    const grants = await apiFetch<{ data: Array<{ id: string, status: string, request: { audience: string, target_host: string, grant_type: string } }> }>(\n      `${grantsUrl}?requester=${encodeURIComponent(auth.email)}&status=approved&limit=20`,\n    )\n    const sessionGrant = grants.data.find(g =>\n      g.request.audience === 'ape-shell'\n      && g.request.target_host === options.targetHost\n      && g.request.grant_type !== 'once',\n    )\n    if (sessionGrant) {\n      return { kind: 'approved', grantId: sessionGrant.id, mode: 'session' }\n    }\n  }\n  catch (err) {\n    consola.debug(`ape-shell: session grant lookup failed:`, err)\n  }\n\n  // Request a new session grant. The approver sees the literal shell line.\n  consola.info(`Requesting ape-shell session grant on ${options.targetHost}`)\n  try {\n    const grant = await apiFetch<{ id: string, status: string }>(grantsUrl, {\n      method: 'POST',\n      body: {\n        requester: auth.email,\n        target_host: options.targetHost,\n        audience: 'ape-shell',\n        grant_type: options.approval ?? 'once',\n        command: ['bash', '-c', line],\n        reason: `Shell session: ${line.slice(0, 100)}`,\n      },\n    })\n    consola.info(`Approve at: ${idp}/grant-approval?grant_id=${grant.id}`)\n\n    const maxWait = 300_000\n    const interval = 3_000\n    const start = Date.now()\n\n    while (Date.now() - start < maxWait) {\n      const status = await apiFetch<{ status: string }>(`${grantsUrl}/${grant.id}`)\n      if (status.status === 'approved')\n        return { kind: 'approved', grantId: grant.id, mode: 'session' }\n      if (status.status === 'denied' || status.status === 'revoked')\n        return { kind: 'denied', reason: `Grant ${status.status}` }\n      await new Promise(r => setTimeout(r, interval))\n    }\n\n    return { kind: 'denied', reason: 'Grant approval timed out after 5 minutes' }\n  }\n  catch (err) {\n    const msg = err instanceof Error ? err.message : String(err)\n    return { kind: 'denied', reason: `Grant request failed: ${msg}` }\n  }\n}\n","import { randomBytes } from 'node:crypto'\nimport type { IPty } from 'node-pty'\nimport * as pty from 'node-pty'\n\n/**\n * Frame returned when the bash child finishes executing a line and is ready\n * for the next one. The `output` is everything bash printed since the last\n * frame, with the marker line stripped.\n */\nexport interface CompletedLineFrame {\n  output: string\n  exitCode: number\n}\n\n/**\n * Callbacks the PtyBridge delivers to its owner. `onOutput` fires with\n * streaming pty output chunks (marker content already stripped). `onLineDone`\n * fires once per completed shell line with the cumulative output and the\n * exit code extracted from the prompt marker. `onExit` fires when the bash\n * child itself has terminated (user typed `exit`, or the process died).\n */\nexport interface PtyBridgeEvents {\n  onOutput: (chunk: string) => void\n  onLineDone: (frame: CompletedLineFrame) => void\n  onExit: (exitCode: number, signal: number | undefined) => void\n}\n\n/**\n * Wraps a persistent bash child running inside a pty. Each time the frontend\n * feeds a line via `writeLine`, the bridge streams bash's stdout back through\n * `onOutput` until it detects the marker-bearing PS1 — at which point the\n * line is considered complete and `onLineDone` fires with the captured\n * output and the exit code.\n *\n * The marker format embedded in PS1 is:\n *   __APES_<random-hex>__:<exit-code>:__END__\n * The leading token is a 32-char random hex so output collisions are\n * effectively impossible. `<exit-code>` is `$?` at prompt render time.\n *\n * The marker itself is stripped from the output stream before it is\n * forwarded to the caller, so consumers never see it on their terminal.\n */\nexport class PtyBridge {\n  private readonly marker: string\n  /** Compiled once. Captures the exit code in group 1. */\n  private readonly markerRegex: RegExp\n  private readonly term: IPty\n  private readonly events: PtyBridgeEvents\n  /** Bytes received since the last completed line. Searched for the marker. */\n  private pending = ''\n  /**\n   * Accumulated output for the current in-flight line. Streams to `onOutput`\n   * live as chunks arrive, and is handed to `onLineDone` in full when the\n   * marker is matched. Resets at that point.\n   */\n  private currentLineBuffer = ''\n  /** True until bash prints its first marker-prompt. */\n  private readyForFirstLine = false\n  private awaitingInitialPrompt: ((value: void) => void) | null = null\n\n  constructor(events: PtyBridgeEvents, options: { cols?: number, rows?: number, cwd?: string } = {}) {\n    this.events = events\n    this.marker = randomBytes(16).toString('hex')\n    // Example match: __APES_abc123…__:0:__END__\n    // The `\\r?\\n?` tolerates line endings around the marker depending on\n    // how bash renders PS1 on a fresh line.\n    this.markerRegex = new RegExp(\n      `__APES_${this.marker}__:(-?\\\\d+):__END__\\\\r?\\\\n?`,\n    )\n\n    const cols = options.cols ?? process.stdout.columns ?? 80\n    const rows = options.rows ?? process.stdout.rows ?? 24\n\n    // We spawn bash as `--login -i` so the user's ~/.bash_profile / ~/.bashrc\n    // runs and they get their aliases/functions. Trade-off: if the user\n    // overrides PS1 in their rcfile, our marker detection breaks. We protect\n    // against that by re-exporting PS1 via PROMPT_COMMAND on every prompt.\n    //\n    // PROMPT_COMMAND also runs `stty -echo` so the pty line discipline stops\n    // echoing user input back to us. Without this, every line the frontend\n    // writes to the pty gets echoed into the output stream — causing the\n    // command to appear twice in the user's terminal (once from readline,\n    // once from the pty echo). The frontend already owns its own display of\n    // what the user typed; the pty echo is redundant and surprising.\n    // Interactive TUI apps (vim/less/top) set their own termios when they\n    // start, so they are unaffected.\n    this.term = pty.spawn('bash', ['--login', '-i'], {\n      name: 'xterm-256color',\n      cols,\n      rows,\n      cwd: options.cwd ?? process.cwd(),\n      env: {\n        ...process.env,\n        // Force our marker PS1 on every prompt and keep pty echo off —\n        // both survive .bashrc overrides because PROMPT_COMMAND runs\n        // before each prompt.\n        PROMPT_COMMAND: `stty -echo 2>/dev/null; PS1='__APES_${this.marker}__:$?:__END__'`,\n        // Also set it initially so the very first prompt carries the marker.\n        PS1: `__APES_${this.marker}__:$?:__END__`,\n        PS2: '> ',\n        // Silence bash-specific onboarding that would pollute our output.\n        BASH_SILENCE_DEPRECATION_WARNING: '1',\n      },\n    })\n\n    this.term.onData(chunk => this.handleData(chunk))\n    this.term.onExit(({ exitCode, signal }) => {\n      this.events.onExit(exitCode, signal)\n    })\n  }\n\n  /**\n   * Resolves once bash has printed its very first marker-bearing prompt,\n   * which means it has finished sourcing ~/.bashrc and is ready to accept\n   * input. Callers should await this before sending the first line.\n   */\n  waitForReady(): Promise<void> {\n    if (this.readyForFirstLine)\n      return Promise.resolve()\n    return new Promise((resolve) => {\n      this.awaitingInitialPrompt = resolve\n    })\n  }\n\n  /**\n   * Write a shell command line to bash's stdin. The caller must ensure the\n   * line has already been approved by the grant flow. The bridge does NOT\n   * validate or filter the line.\n   */\n  writeLine(line: string): void {\n    // Trim trailing newlines and always append exactly one, so pasting a\n    // multi-line string works naturally.\n    const clean = line.replace(/\\r?\\n+$/, '')\n    this.term.write(`${clean}\\n`)\n  }\n\n  /**\n   * Raw passthrough write — used for forwarding user keystrokes during\n   * interactive output mode (e.g. while vim is running).\n   */\n  writeRaw(data: string): void {\n    this.term.write(data)\n  }\n\n  /** Resize the underlying pty. Called on SIGWINCH. */\n  resize(cols: number, rows: number): void {\n    this.term.resize(cols, rows)\n  }\n\n  /** Kill the bash child. Called on Ctrl-D / shell exit. */\n  kill(signal?: string): void {\n    this.term.kill(signal)\n  }\n\n  /** Process id of the bash child, for logging / debugging. */\n  get pid(): number {\n    return this.term.pid\n  }\n\n  /** Exposed for tests that want to look at the raw marker. */\n  getMarkerForTest(): string {\n    return this.marker\n  }\n\n  // ----- internals -----\n\n  private handleData(chunk: string): void {\n    this.pending += chunk\n\n    // Walk through any complete marker matches. Each marker ends the current\n    // in-flight line; the `before` slice is its final output.\n    for (;;) {\n      const match = this.pending.match(this.markerRegex)\n      if (!match || match.index === undefined)\n        break\n\n      const before = this.pending.slice(0, match.index)\n      const exitCode = Number(match[1])\n      // Stream the pre-marker portion live (for REPL display) AND fold it\n      // into the per-line buffer so the `onLineDone` frame is complete.\n      if (before.length > 0) {\n        this.currentLineBuffer += before\n        if (this.readyForFirstLine)\n          this.events.onOutput(before)\n      }\n      // Drop the matched marker and everything before it from the buffer\n      this.pending = this.pending.slice(match.index + match[0].length)\n\n      if (!this.readyForFirstLine) {\n        // Bootstrap prompt: discard any bash startup noise we captured and\n        // signal readiness. onLineDone does NOT fire for the implicit\n        // first prompt — that would confuse consumers.\n        this.readyForFirstLine = true\n        this.currentLineBuffer = ''\n        const resolve = this.awaitingInitialPrompt\n        this.awaitingInitialPrompt = null\n        if (resolve)\n          resolve()\n        continue\n      }\n\n      // Real command completion: hand over the accumulated line buffer.\n      const frame = { output: this.currentLineBuffer, exitCode }\n      this.currentLineBuffer = ''\n      this.events.onLineDone(frame)\n    }\n\n    // No more markers in the buffer. If we're past bootstrap, stream any\n    // complete lines that have accumulated so the user sees live output,\n    // and keep any partial tail in `pending` in case the marker is still\n    // mid-chunk.\n    if (!this.readyForFirstLine)\n      return\n\n    const lastNewline = this.pending.lastIndexOf('\\n')\n    if (lastNewline >= 0) {\n      const ready = this.pending.slice(0, lastNewline + 1)\n      this.pending = this.pending.slice(lastNewline + 1)\n      if (ready.length > 0) {\n        this.currentLineBuffer += ready\n        this.events.onOutput(ready)\n      }\n    }\n  }\n}\n","import { createInterface  } from 'node:readline'\nimport type { Interface as ReadlineInterface } from 'node:readline'\nimport { homedir } from 'node:os'\nimport { join } from 'node:path'\nimport consola from 'consola'\nimport { checkMultiLineStatus } from './multi-line.js'\n\n/**\n * Where the REPL persists its input history across sessions. Lives alongside\n * the existing apes config so we don't add a new top-level dotfile.\n */\nconst HISTORY_FILE = join(homedir(), '.config', 'apes', 'shell-history')\n\n/**\n * Primary and continuation prompts. PS1 shows when the REPL is ready for a\n * fresh command; PS2 shows when bash syntax is incomplete and the user needs\n * to keep typing (e.g., inside a for-loop or heredoc).\n */\nconst PS1 = 'apes$ '\nconst PS2 = '> '\n\n/**\n * Event sink for the REPL. Keeps the loop decoupled from I/O sinks so tests\n * can feed lines and observe outcomes without touching real stdin/stdout.\n */\nexport interface ReplEvents {\n  /**\n   * Fires when a complete shell line has been accumulated (possibly across\n   * multiple input lines via continuation). The handler is responsible for\n   * actually running the line — typically by handing it to the grant flow\n   * and then to the pty bridge. In M2 this is just logged; the real wiring\n   * lands in M3/M4.\n   */\n  onLine: (line: string) => void | Promise<void>\n\n  /**\n   * Fires when the REPL is about to exit (user pressed Ctrl-D or called\n   * `stop`). Gives owners a chance to tear down resources.\n   */\n  onExit: () => void | Promise<void>\n}\n\n/**\n * Optional overrides for tests. Real usage defaults to `process.stdin`,\n * `process.stdout`, and the standard history file path.\n */\nexport interface ReplOptions {\n  input?: NodeJS.ReadableStream\n  output?: NodeJS.WritableStream\n  historyFile?: string\n  /** Disables the session-start banner — handy in tests. */\n  quiet?: boolean\n}\n\n/**\n * Interactive REPL loop for `ape-shell`. Implements the state machine:\n *\n *   PROMPT → (line entered) → MULTILINE? → (continue) → PROMPT\n *                                 │\n *                                 └─── complete → emit onLine → PROMPT\n *\n * The loop uses node:readline for line editing, history, and signal\n * handling. Multi-line detection runs a `bash -n` dry-parse on Enter to\n * decide whether to fold the input into a longer buffer or submit it.\n *\n * The REPL does NOT know about pty, grants, or bash internals. Owners wire\n * those in via the `onLine` callback. This keeps M2 independently testable.\n */\nexport class ShellRepl {\n  private readonly events: ReplEvents\n  private readonly input: NodeJS.ReadableStream\n  private readonly output: NodeJS.WritableStream\n  private readonly quiet: boolean\n  private rl: ReadlineInterface | null = null\n  /** Accumulated input across multi-line continuations. */\n  private buffer = ''\n  /** Whether the REPL has called `stop`. */\n  private stopped = false\n\n  constructor(events: ReplEvents, options: ReplOptions = {}) {\n    this.events = events\n    this.input = options.input ?? process.stdin\n    this.output = options.output ?? process.stdout\n    this.quiet = options.quiet ?? false\n  }\n\n  /**\n   * Start the REPL. Resolves when the user ends the session (Ctrl-D) or\n   * `stop()` is called from outside. Errors bubble out of `onLine` and\n   * cause the line to be rejected, but do NOT tear down the REPL.\n   */\n  async run(): Promise<void> {\n    if (this.stopped)\n      return\n\n    this.rl = createInterface({\n      input: this.input,\n      output: this.output,\n      prompt: PS1,\n      historySize: 1000,\n      // Enable tab completion fallback (file names + history) via default.\n      terminal: true,\n    })\n\n    if (!this.quiet)\n      this.writeBanner()\n\n    this.safePrompt(PS1)\n\n    return new Promise<void>((resolve) => {\n      this.rl!.on('line', async (line) => {\n        try {\n          await this.handleLine(line)\n        }\n        catch (err) {\n          const msg = err instanceof Error ? err.message : String(err)\n          consola.error(`Shell error: ${msg}`)\n          this.resetBuffer()\n          this.safePrompt(PS1)\n        }\n      })\n\n      this.rl!.on('SIGINT', () => {\n        // Ctrl-C in prompt mode: clear the buffer, draw a new prompt.\n        if (this.buffer.length > 0)\n          this.output.write('\\n')\n        this.resetBuffer()\n        this.safePrompt(PS1)\n      })\n\n      this.rl!.on('close', async () => {\n        // Ctrl-D or stop() — we're done.\n        this.stopped = true\n        await this.events.onExit()\n        resolve()\n      })\n    })\n  }\n\n  /**\n   * Request the REPL to stop cleanly. Equivalent to the user pressing\n   * Ctrl-D. Typically called during shutdown or after a fatal error.\n   */\n  stop(): void {\n    if (this.rl)\n      this.rl.close()\n  }\n\n  // ----- internals -----\n\n  private writeBanner(): void {\n    this.output.write('apes interactive shell\\n')\n    this.output.write('Ctrl-D to exit.\\n')\n    this.output.write('\\n')\n  }\n\n  private async handleLine(rawLine: string): Promise<void> {\n    // Append the new line to the existing buffer. Use a literal newline so\n    // bash sees the multi-line structure correctly on `bash -n`.\n    this.buffer = this.buffer.length === 0\n      ? rawLine\n      : `${this.buffer}\\n${rawLine}`\n\n    const status = checkMultiLineStatus(this.buffer)\n\n    if (status.kind === 'continue') {\n      this.safePrompt(PS2)\n      return\n    }\n\n    if (status.kind === 'error') {\n      this.output.write(`${status.message}\\n`)\n      this.resetBuffer()\n      this.safePrompt(PS1)\n      return\n    }\n\n    // Complete. Hand off to the owner.\n    const completeLine = this.buffer\n    this.resetBuffer()\n\n    // If the buffer was pure whitespace, skip the callback and re-prompt.\n    if (completeLine.trim().length === 0) {\n      this.safePrompt(PS1)\n      return\n    }\n\n    await this.events.onLine(completeLine)\n\n    // Back to prompt mode. Owners of onLine can await and drive their own\n    // output before we show the next prompt.\n    this.safePrompt(PS1)\n  }\n\n  /**\n   * Draw a prompt, but only if the readline interface is still alive.\n   * The onLine callback may have triggered `stop()` (e.g., bash exited),\n   * in which case setPrompt/prompt would throw ERR_USE_AFTER_CLOSE.\n   */\n  private safePrompt(prompt: string): void {\n    if (this.stopped || !this.rl)\n      return\n    try {\n      this.rl.setPrompt(prompt)\n      this.rl.prompt()\n    }\n    catch (err) {\n      // Swallow ERR_USE_AFTER_CLOSE which races with shutdown.\n      const code = (err as NodeJS.ErrnoException)?.code\n      if (code !== 'ERR_USE_AFTER_CLOSE')\n        throw err\n    }\n  }\n\n  private resetBuffer(): void {\n    this.buffer = ''\n  }\n}\n\nexport { HISTORY_FILE }\n","import { spawnSync } from 'node:child_process'\n\n/**\n * Result of checking whether a shell command buffer is syntactically\n * complete. The REPL uses this to decide whether to submit the line for\n * execution or to keep reading more lines with a continuation prompt.\n */\nexport type MultiLineStatus =\n  | { kind: 'complete' }\n  | { kind: 'continue' }\n  | { kind: 'error', message: string }\n\n/**\n * Patterns that bash writes to stderr when it encounters a syntax error\n * caused by an incomplete construct (missing `done`, unterminated quote,\n * unclosed `$(` or heredoc, etc.). If any of these patterns match, the\n * buffer is treated as incomplete and the REPL shows a continuation prompt\n * instead of reporting an error.\n */\nconst CONTINUE_PATTERNS: RegExp[] = [\n  /syntax error: unexpected end of file/i,\n  /unexpected end of file/i,\n  /here-document.+delimited by end-of-file/i,\n  /unexpected EOF while looking for matching/i,\n]\n\n/**\n * Detects an unterminated here-document in the buffer. `bash -n` accepts\n * these as \"complete\" (it treats end-of-input as the delimiter) so we have\n * to catch them ourselves to match interactive bash's behavior of showing\n * a continuation prompt until the user types the delimiter on its own line.\n *\n * Matches `<<` or `<<-` followed by an optionally-quoted identifier. For\n * each match we scan the remaining lines of the buffer for a line whose\n * content (after leading tabs, which `<<-` strips) equals the delimiter.\n * If no closing line is found, the heredoc is unterminated → continue.\n */\nfunction hasUnterminatedHeredoc(buffer: string): boolean {\n  // Match <<-? optional whitespace, optional ' or \" around the word.\n  // We deliberately don't try to parse bash quoting fully — this is a\n  // best-effort heuristic that catches the common cases.\n  const pattern = /<<(-?)\\s*(['\"]?)([A-Z_]\\w*)\\2/gi\n  for (const match of buffer.matchAll(pattern)) {\n    const stripTabs = match[1] === '-'\n    const delimiter = match[3]!\n    // Look at every line AFTER the match start\n    const afterMatch = buffer.slice((match.index ?? 0) + match[0].length)\n    const lines = afterMatch.split('\\n').slice(1) // skip the rest of the opening line\n    const terminated = lines.some((line) => {\n      const compare = stripTabs ? line.replace(/^\\t+/, '') : line\n      return compare === delimiter\n    })\n    if (!terminated)\n      return true\n  }\n  return false\n}\n\n/**\n * Check whether a (possibly multi-line) shell command buffer forms a\n * complete statement. Runs `bash -n -c <buffer>` in a separate process —\n * `-n` makes bash parse without executing, so there are no side effects.\n *\n * Design note: we spawn bash once per check. That's typically <10ms on\n * modern machines and only happens when the user presses Enter, not per\n * keystroke, so the cost is negligible.\n */\nexport function checkMultiLineStatus(buffer: string): MultiLineStatus {\n  if (buffer.trim().length === 0)\n    return { kind: 'complete' } // empty line is a no-op, treat as complete\n\n  // Heredoc check first — bash -n accepts unterminated heredocs but an\n  // interactive shell should ask for more input until the delimiter line.\n  if (hasUnterminatedHeredoc(buffer))\n    return { kind: 'continue' }\n\n  const result = spawnSync('bash', ['-n', '-c', buffer], {\n    stdio: ['ignore', 'ignore', 'pipe'],\n    encoding: 'utf-8',\n  })\n\n  if (result.error) {\n    // Bash itself couldn't be spawned — treat as a hard error so the REPL\n    // can surface it. This should be vanishingly rare.\n    return { kind: 'error', message: `Failed to spawn bash for syntax check: ${result.error.message}` }\n  }\n\n  if (result.status === 0)\n    return { kind: 'complete' }\n\n  const stderr = result.stderr || ''\n  for (const pattern of CONTINUE_PATTERNS) {\n    if (pattern.test(stderr))\n      return { kind: 'continue' }\n  }\n\n  // Anything else is a genuine syntax error — caller should show it and\n  // reset the buffer instead of accumulating more lines.\n  return { kind: 'error', message: stderr.trim() || 'Syntax error' }\n}\n","import { randomBytes } from 'node:crypto'\nimport { appendAuditLog } from '../shapes/index.js'\n\n/**\n * A single interactive ape-shell session. Tracks a stable session id plus a\n * monotonic sequence number so individual lines can be correlated back to\n * their session in the audit log.\n */\nexport class ShellSession {\n  readonly id: string\n  readonly startedAt: number\n  private lineSeq = 0\n\n  constructor(options: { host: string, requester: string }) {\n    this.id = randomBytes(8).toString('hex')\n    this.startedAt = Date.now()\n    appendAuditLog({\n      action: 'shell-session-start',\n      session_id: this.id,\n      host: options.host,\n      requester: options.requester,\n    })\n  }\n\n  /**\n   * Record a granted line that was approved for execution. Called after the\n   * grant flow returns approval but before (or right after) bash runs the\n   * command. Stores the grant id so the line can be traced back to the\n   * specific grant that authorized it.\n   */\n  logLineGranted(params: {\n    line: string\n    grantId: string\n    grantMode: 'adapter' | 'session'\n  }): number {\n    const seq = ++this.lineSeq\n    appendAuditLog({\n      action: 'shell-session-line',\n      session_id: this.id,\n      seq,\n      line: params.line,\n      grant_id: params.grantId,\n      grant_mode: params.grantMode,\n      status: 'executing',\n    })\n    return seq\n  }\n\n  /** Record the final exit code of a previously-granted line. */\n  logLineDone(params: { seq: number, exitCode: number }): void {\n    appendAuditLog({\n      action: 'shell-session-line-done',\n      session_id: this.id,\n      seq: params.seq,\n      exit_code: params.exitCode,\n    })\n  }\n\n  /** Record that a line was denied by the grant flow and never reached bash. */\n  logLineDenied(params: { line: string, reason: string }): void {\n    const seq = ++this.lineSeq\n    appendAuditLog({\n      action: 'shell-session-line',\n      session_id: this.id,\n      seq,\n      line: params.line,\n      status: 'denied',\n      reason: params.reason,\n    })\n  }\n\n  /** Record session termination. Fires on clean Ctrl-D or bash death. */\n  close(): void {\n    appendAuditLog({\n      action: 'shell-session-end',\n      session_id: this.id,\n      duration_ms: Date.now() - this.startedAt,\n      lines: this.lineSeq,\n    })\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;AAAA,SAAS,gBAAgB;AACzB,OAAOA,cAAa;;;ACDpB,SAAS,gBAAgB;AACzB,OAAO,aAAa;AAoDpB,eAAsB,yBACpB,MACA,SAC0B;AAC1B,QAAM,OAAO,SAAS;AACtB,MAAI,CAAC,MAAM;AACT,WAAO,EAAE,MAAM,UAAU,QAAQ,yCAAyC;AAAA,EAC5E;AACA,QAAM,MAAM,KAAK;AACjB,MAAI,CAAC,KAAK;AACR,WAAO,EAAE,MAAM,UAAU,QAAQ,iDAAiD;AAAA,EACpF;AAGA,QAAM,SAAS,kBAAkB,IAAI;AACrC,MAAI,UAAU,CAAC,OAAO,YAAY;AAChC,QAAI;AACF,YAAM,SAAS,MAAM,qBAAqB,OAAO,UAAU;AAC3D,UAAI,QAAQ;AACV,cAAM,uBAAuB,SAAS,OAAO,UAAU;AACvD,cAAM,WAAW,MAAM,eAAe,QAAQ,CAAC,sBAAsB,GAAG,OAAO,IAAI,CAAC;AAGpF,YAAI;AACF,gBAAM,kBAAkB,MAAM,kBAAkB,UAAU,GAAG;AAC7D,cAAI,iBAAiB;AACnB,oBAAQ,KAAK,iBAAiB,eAAe,SAAS,SAAS,OAAO,OAAO,EAAE;AAC/E,kBAAMC,SAAQ,MAAM,gBAAgB,KAAK,eAAe;AACxD,kBAAM,iBAAiBA,QAAO,QAAQ;AACtC,mBAAO,EAAE,MAAM,YAAY,SAAS,iBAAiB,MAAM,UAAU;AAAA,UACvE;AAAA,QACF,SACO,KAAK;AACV,kBAAQ,MAAM,gEAAgE,GAAG;AAAA,QACnF;AAGA,gBAAQ,KAAK,yBAAyB,SAAS,OAAO,OAAO,EAAE;AAC/D,cAAM,QAAQ,MAAM,kBAAkB,UAAU;AAAA,UAC9C;AAAA,UACA,UAAU,QAAQ,YAAY;AAAA,UAC9B,QAAQ,cAAc,SAAS,OAAO,OAAO;AAAA,QAC/C,CAAC;AACD,gBAAQ,KAAK,eAAe,GAAG,4BAA4B,MAAM,EAAE,EAAE;AAErE,cAAM,SAAS,MAAM,mBAAmB,KAAK,MAAM,EAAE;AACrD,YAAI,WAAW,YAAY;AACzB,iBAAO,EAAE,MAAM,UAAU,QAAQ,SAAS,MAAM,GAAG;AAAA,QACrD;AAEA,cAAM,QAAQ,MAAM,gBAAgB,KAAK,MAAM,EAAE;AACjD,cAAM,iBAAiB,OAAO,QAAQ;AACtC,eAAO,EAAE,MAAM,YAAY,SAAS,MAAM,IAAI,MAAM,UAAU;AAAA,MAChE;AAAA,IACF,SACO,KAAK;AAGV,cAAQ,MAAM,qEAAqE,GAAG;AAAA,IACxF;AAAA,EACF;AAGA,QAAM,YAAY,MAAM,kBAAkB,GAAG;AAG7C,MAAI;AACF,UAAM,SAAS,MAAM;AAAA,MACnB,GAAG,SAAS,cAAc,mBAAmB,KAAK,KAAK,CAAC;AAAA,IAC1D;AACA,UAAM,eAAe,OAAO,KAAK;AAAA,MAAK,OACpC,EAAE,QAAQ,aAAa,eACpB,EAAE,QAAQ,gBAAgB,QAAQ,cAClC,EAAE,QAAQ,eAAe;AAAA,IAC9B;AACA,QAAI,cAAc;AAChB,aAAO,EAAE,MAAM,YAAY,SAAS,aAAa,IAAI,MAAM,UAAU;AAAA,IACvE;AAAA,EACF,SACO,KAAK;AACV,YAAQ,MAAM,2CAA2C,GAAG;AAAA,EAC9D;AAGA,UAAQ,KAAK,yCAAyC,QAAQ,UAAU,EAAE;AAC1E,MAAI;AACF,UAAM,QAAQ,MAAM,SAAyC,WAAW;AAAA,MACtE,QAAQ;AAAA,MACR,MAAM;AAAA,QACJ,WAAW,KAAK;AAAA,QAChB,aAAa,QAAQ;AAAA,QACrB,UAAU;AAAA,QACV,YAAY,QAAQ,YAAY;AAAA,QAChC,SAAS,CAAC,QAAQ,MAAM,IAAI;AAAA,QAC5B,QAAQ,kBAAkB,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,MAC9C;AAAA,IACF,CAAC;AACD,YAAQ,KAAK,eAAe,GAAG,4BAA4B,MAAM,EAAE,EAAE;AAErE,UAAM,UAAU;AAChB,UAAM,WAAW;AACjB,UAAM,QAAQ,KAAK,IAAI;AAEvB,WAAO,KAAK,IAAI,IAAI,QAAQ,SAAS;AACnC,YAAM,SAAS,MAAM,SAA6B,GAAG,SAAS,IAAI,MAAM,EAAE,EAAE;AAC5E,UAAI,OAAO,WAAW;AACpB,eAAO,EAAE,MAAM,YAAY,SAAS,MAAM,IAAI,MAAM,UAAU;AAChE,UAAI,OAAO,WAAW,YAAY,OAAO,WAAW;AAClD,eAAO,EAAE,MAAM,UAAU,QAAQ,SAAS,OAAO,MAAM,GAAG;AAC5D,YAAM,IAAI,QAAQ,OAAK,WAAW,GAAG,QAAQ,CAAC;AAAA,IAChD;AAEA,WAAO,EAAE,MAAM,UAAU,QAAQ,2CAA2C;AAAA,EAC9E,SACO,KAAK;AACV,UAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,WAAO,EAAE,MAAM,UAAU,QAAQ,yBAAyB,GAAG,GAAG;AAAA,EAClE;AACF;;;AC3KA,SAAS,mBAAmB;AAE5B,YAAY,SAAS;AAwCd,IAAM,YAAN,MAAgB;AAAA,EACJ;AAAA;AAAA,EAEA;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAET,UAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMV,oBAAoB;AAAA;AAAA,EAEpB,oBAAoB;AAAA,EACpB,wBAAwD;AAAA,EAEhE,YAAY,QAAyB,UAA0D,CAAC,GAAG;AACjG,SAAK,SAAS;AACd,SAAK,SAAS,YAAY,EAAE,EAAE,SAAS,KAAK;AAI5C,SAAK,cAAc,IAAI;AAAA,MACrB,UAAU,KAAK,MAAM;AAAA,IACvB;AAEA,UAAM,OAAO,QAAQ,QAAQ,QAAQ,OAAO,WAAW;AACvD,UAAM,OAAO,QAAQ,QAAQ,QAAQ,OAAO,QAAQ;AAepD,SAAK,OAAW,UAAM,QAAQ,CAAC,WAAW,IAAI,GAAG;AAAA,MAC/C,MAAM;AAAA,MACN;AAAA,MACA;AAAA,MACA,KAAK,QAAQ,OAAO,QAAQ,IAAI;AAAA,MAChC,KAAK;AAAA,QACH,GAAG,QAAQ;AAAA;AAAA;AAAA;AAAA,QAIX,gBAAgB,uCAAuC,KAAK,MAAM;AAAA;AAAA,QAElE,KAAK,UAAU,KAAK,MAAM;AAAA,QAC1B,KAAK;AAAA;AAAA,QAEL,kCAAkC;AAAA,MACpC;AAAA,IACF,CAAC;AAED,SAAK,KAAK,OAAO,WAAS,KAAK,WAAW,KAAK,CAAC;AAChD,SAAK,KAAK,OAAO,CAAC,EAAE,UAAU,OAAO,MAAM;AACzC,WAAK,OAAO,OAAO,UAAU,MAAM;AAAA,IACrC,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,eAA8B;AAC5B,QAAI,KAAK;AACP,aAAO,QAAQ,QAAQ;AACzB,WAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,WAAK,wBAAwB;AAAA,IAC/B,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,UAAU,MAAoB;AAG5B,UAAM,QAAQ,KAAK,QAAQ,WAAW,EAAE;AACxC,SAAK,KAAK,MAAM,GAAG,KAAK;AAAA,CAAI;AAAA,EAC9B;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,SAAS,MAAoB;AAC3B,SAAK,KAAK,MAAM,IAAI;AAAA,EACtB;AAAA;AAAA,EAGA,OAAO,MAAc,MAAoB;AACvC,SAAK,KAAK,OAAO,MAAM,IAAI;AAAA,EAC7B;AAAA;AAAA,EAGA,KAAK,QAAuB;AAC1B,SAAK,KAAK,KAAK,MAAM;AAAA,EACvB;AAAA;AAAA,EAGA,IAAI,MAAc;AAChB,WAAO,KAAK,KAAK;AAAA,EACnB;AAAA;AAAA,EAGA,mBAA2B;AACzB,WAAO,KAAK;AAAA,EACd;AAAA;AAAA,EAIQ,WAAW,OAAqB;AACtC,SAAK,WAAW;AAIhB,eAAS;AACP,YAAM,QAAQ,KAAK,QAAQ,MAAM,KAAK,WAAW;AACjD,UAAI,CAAC,SAAS,MAAM,UAAU;AAC5B;AAEF,YAAM,SAAS,KAAK,QAAQ,MAAM,GAAG,MAAM,KAAK;AAChD,YAAM,WAAW,OAAO,MAAM,CAAC,CAAC;AAGhC,UAAI,OAAO,SAAS,GAAG;AACrB,aAAK,qBAAqB;AAC1B,YAAI,KAAK;AACP,eAAK,OAAO,SAAS,MAAM;AAAA,MAC/B;AAEA,WAAK,UAAU,KAAK,QAAQ,MAAM,MAAM,QAAQ,MAAM,CAAC,EAAE,MAAM;AAE/D,UAAI,CAAC,KAAK,mBAAmB;AAI3B,aAAK,oBAAoB;AACzB,aAAK,oBAAoB;AACzB,cAAM,UAAU,KAAK;AACrB,aAAK,wBAAwB;AAC7B,YAAI;AACF,kBAAQ;AACV;AAAA,MACF;AAGA,YAAM,QAAQ,EAAE,QAAQ,KAAK,mBAAmB,SAAS;AACzD,WAAK,oBAAoB;AACzB,WAAK,OAAO,WAAW,KAAK;AAAA,IAC9B;AAMA,QAAI,CAAC,KAAK;AACR;AAEF,UAAM,cAAc,KAAK,QAAQ,YAAY,IAAI;AACjD,QAAI,eAAe,GAAG;AACpB,YAAM,QAAQ,KAAK,QAAQ,MAAM,GAAG,cAAc,CAAC;AACnD,WAAK,UAAU,KAAK,QAAQ,MAAM,cAAc,CAAC;AACjD,UAAI,MAAM,SAAS,GAAG;AACpB,aAAK,qBAAqB;AAC1B,aAAK,OAAO,SAAS,KAAK;AAAA,MAC5B;AAAA,IACF;AAAA,EACF;AACF;;;AChOA,SAAS,uBAAwB;AAEjC,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB,OAAOC,cAAa;;;ACJpB,SAAS,iBAAiB;AAmB1B,IAAM,oBAA8B;AAAA,EAClC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAaA,SAAS,uBAAuB,QAAyB;AAIvD,QAAM,UAAU;AAChB,aAAW,SAAS,OAAO,SAAS,OAAO,GAAG;AAC5C,UAAM,YAAY,MAAM,CAAC,MAAM;AAC/B,UAAM,YAAY,MAAM,CAAC;AAEzB,UAAM,aAAa,OAAO,OAAO,MAAM,SAAS,KAAK,MAAM,CAAC,EAAE,MAAM;AACpE,UAAM,QAAQ,WAAW,MAAM,IAAI,EAAE,MAAM,CAAC;AAC5C,UAAM,aAAa,MAAM,KAAK,CAAC,SAAS;AACtC,YAAM,UAAU,YAAY,KAAK,QAAQ,QAAQ,EAAE,IAAI;AACvD,aAAO,YAAY;AAAA,IACrB,CAAC;AACD,QAAI,CAAC;AACH,aAAO;AAAA,EACX;AACA,SAAO;AACT;AAWO,SAAS,qBAAqB,QAAiC;AACpE,MAAI,OAAO,KAAK,EAAE,WAAW;AAC3B,WAAO,EAAE,MAAM,WAAW;AAI5B,MAAI,uBAAuB,MAAM;AAC/B,WAAO,EAAE,MAAM,WAAW;AAE5B,QAAM,SAAS,UAAU,QAAQ,CAAC,MAAM,MAAM,MAAM,GAAG;AAAA,IACrD,OAAO,CAAC,UAAU,UAAU,MAAM;AAAA,IAClC,UAAU;AAAA,EACZ,CAAC;AAED,MAAI,OAAO,OAAO;AAGhB,WAAO,EAAE,MAAM,SAAS,SAAS,0CAA0C,OAAO,MAAM,OAAO,GAAG;AAAA,EACpG;AAEA,MAAI,OAAO,WAAW;AACpB,WAAO,EAAE,MAAM,WAAW;AAE5B,QAAM,SAAS,OAAO,UAAU;AAChC,aAAW,WAAW,mBAAmB;AACvC,QAAI,QAAQ,KAAK,MAAM;AACrB,aAAO,EAAE,MAAM,WAAW;AAAA,EAC9B;AAIA,SAAO,EAAE,MAAM,SAAS,SAAS,OAAO,KAAK,KAAK,eAAe;AACnE;;;ADxFA,IAAM,eAAe,KAAK,QAAQ,GAAG,WAAW,QAAQ,eAAe;AAOvE,IAAM,MAAM;AACZ,IAAM,MAAM;AAiDL,IAAM,YAAN,MAAgB;AAAA,EACJ;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACT,KAA+B;AAAA;AAAA,EAE/B,SAAS;AAAA;AAAA,EAET,UAAU;AAAA,EAElB,YAAY,QAAoB,UAAuB,CAAC,GAAG;AACzD,SAAK,SAAS;AACd,SAAK,QAAQ,QAAQ,SAAS,QAAQ;AACtC,SAAK,SAAS,QAAQ,UAAU,QAAQ;AACxC,SAAK,QAAQ,QAAQ,SAAS;AAAA,EAChC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOA,MAAM,MAAqB;AACzB,QAAI,KAAK;AACP;AAEF,SAAK,KAAK,gBAAgB;AAAA,MACxB,OAAO,KAAK;AAAA,MACZ,QAAQ,KAAK;AAAA,MACb,QAAQ;AAAA,MACR,aAAa;AAAA;AAAA,MAEb,UAAU;AAAA,IACZ,CAAC;AAED,QAAI,CAAC,KAAK;AACR,WAAK,YAAY;AAEnB,SAAK,WAAW,GAAG;AAEnB,WAAO,IAAI,QAAc,CAAC,YAAY;AACpC,WAAK,GAAI,GAAG,QAAQ,OAAO,SAAS;AAClC,YAAI;AACF,gBAAM,KAAK,WAAW,IAAI;AAAA,QAC5B,SACO,KAAK;AACV,gBAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,UAAAC,SAAQ,MAAM,gBAAgB,GAAG,EAAE;AACnC,eAAK,YAAY;AACjB,eAAK,WAAW,GAAG;AAAA,QACrB;AAAA,MACF,CAAC;AAED,WAAK,GAAI,GAAG,UAAU,MAAM;AAE1B,YAAI,KAAK,OAAO,SAAS;AACvB,eAAK,OAAO,MAAM,IAAI;AACxB,aAAK,YAAY;AACjB,aAAK,WAAW,GAAG;AAAA,MACrB,CAAC;AAED,WAAK,GAAI,GAAG,SAAS,YAAY;AAE/B,aAAK,UAAU;AACf,cAAM,KAAK,OAAO,OAAO;AACzB,gBAAQ;AAAA,MACV,CAAC;AAAA,IACH,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,OAAa;AACX,QAAI,KAAK;AACP,WAAK,GAAG,MAAM;AAAA,EAClB;AAAA;AAAA,EAIQ,cAAoB;AAC1B,SAAK,OAAO,MAAM,0BAA0B;AAC5C,SAAK,OAAO,MAAM,mBAAmB;AACrC,SAAK,OAAO,MAAM,IAAI;AAAA,EACxB;AAAA,EAEA,MAAc,WAAW,SAAgC;AAGvD,SAAK,SAAS,KAAK,OAAO,WAAW,IACjC,UACA,GAAG,KAAK,MAAM;AAAA,EAAK,OAAO;AAE9B,UAAM,SAAS,qBAAqB,KAAK,MAAM;AAE/C,QAAI,OAAO,SAAS,YAAY;AAC9B,WAAK,WAAW,GAAG;AACnB;AAAA,IACF;AAEA,QAAI,OAAO,SAAS,SAAS;AAC3B,WAAK,OAAO,MAAM,GAAG,OAAO,OAAO;AAAA,CAAI;AACvC,WAAK,YAAY;AACjB,WAAK,WAAW,GAAG;AACnB;AAAA,IACF;AAGA,UAAM,eAAe,KAAK;AAC1B,SAAK,YAAY;AAGjB,QAAI,aAAa,KAAK,EAAE,WAAW,GAAG;AACpC,WAAK,WAAW,GAAG;AACnB;AAAA,IACF;AAEA,UAAM,KAAK,OAAO,OAAO,YAAY;AAIrC,SAAK,WAAW,GAAG;AAAA,EACrB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,WAAW,QAAsB;AACvC,QAAI,KAAK,WAAW,CAAC,KAAK;AACxB;AACF,QAAI;AACF,WAAK,GAAG,UAAU,MAAM;AACxB,WAAK,GAAG,OAAO;AAAA,IACjB,SACO,KAAK;AAEV,YAAM,OAAQ,KAA+B;AAC7C,UAAI,SAAS;AACX,cAAM;AAAA,IACV;AAAA,EACF;AAAA,EAEQ,cAAoB;AAC1B,SAAK,SAAS;AAAA,EAChB;AACF;;;AEzNA,SAAS,eAAAC,oBAAmB;AAQrB,IAAM,eAAN,MAAmB;AAAA,EACf;AAAA,EACA;AAAA,EACD,UAAU;AAAA,EAElB,YAAY,SAA8C;AACxD,SAAK,KAAKC,aAAY,CAAC,EAAE,SAAS,KAAK;AACvC,SAAK,YAAY,KAAK,IAAI;AAC1B,mBAAe;AAAA,MACb,QAAQ;AAAA,MACR,YAAY,KAAK;AAAA,MACjB,MAAM,QAAQ;AAAA,MACd,WAAW,QAAQ;AAAA,IACrB,CAAC;AAAA,EACH;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,eAAe,QAIJ;AACT,UAAM,MAAM,EAAE,KAAK;AACnB,mBAAe;AAAA,MACb,QAAQ;AAAA,MACR,YAAY,KAAK;AAAA,MACjB;AAAA,MACA,MAAM,OAAO;AAAA,MACb,UAAU,OAAO;AAAA,MACjB,YAAY,OAAO;AAAA,MACnB,QAAQ;AAAA,IACV,CAAC;AACD,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,YAAY,QAAiD;AAC3D,mBAAe;AAAA,MACb,QAAQ;AAAA,MACR,YAAY,KAAK;AAAA,MACjB,KAAK,OAAO;AAAA,MACZ,WAAW,OAAO;AAAA,IACpB,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,cAAc,QAAgD;AAC5D,UAAM,MAAM,EAAE,KAAK;AACnB,mBAAe;AAAA,MACb,QAAQ;AAAA,MACR,YAAY,KAAK;AAAA,MACjB;AAAA,MACA,MAAM,OAAO;AAAA,MACb,QAAQ;AAAA,MACR,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,QAAc;AACZ,mBAAe;AAAA,MACb,QAAQ;AAAA,MACR,YAAY,KAAK;AAAA,MACjB,aAAa,KAAK,IAAI,IAAI,KAAK;AAAA,MAC/B,OAAO,KAAK;AAAA,IACd,CAAC;AAAA,EACH;AACF;;;AL9CA,eAAsB,sBAAqC;AAKzD,MAAI,iBAAsC;AAC1C,MAAI,eAAe;AACnB,MAAI,eAAe;AAGnB,MAAI,OAAyB;AAI7B,QAAM,SAAS,IAAI;AAAA,IACjB;AAAA,MACE,UAAU,CAAC,UAAU;AAInB,gBAAQ,OAAO,MAAM,KAAK;AAAA,MAC5B;AAAA,MACA,YAAY,CAAC,UAAU;AACrB,YAAI,gBAAgB;AAClB,gBAAM,IAAI;AACV,2BAAiB;AACjB,yBAAe,MAAM;AACrB,YAAE;AAAA,QACJ;AAAA,MACF;AAAA,MACA,QAAQ,CAAC,aAAa;AAGpB,YAAI,CAAC,cAAc;AACjB,kBAAQ,OAAO,MAAM;AAAA,yBAA4B,QAAQ;AAAA,CAAK;AAC9D,gBAAM,KAAK;AAAA,QACb;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,aAAa;AAE1B,QAAM,aAAa,SAAS;AAC5B,QAAM,OAAO,SAAS;AACtB,QAAM,UAAU,IAAI,aAAa;AAAA,IAC/B,MAAM;AAAA,IACN,WAAW,MAAM,SAAS;AAAA,EAC5B,CAAC;AAED,SAAO,IAAI;AAAA,IACT;AAAA,MACE,QAAQ,OAAO,SAAS;AAEtB,cAAM,QAAQ,MAAM,yBAAyB,MAAM;AAAA,UACjD;AAAA,UACA,UAAU;AAAA,QACZ,CAAC;AAED,YAAI,MAAM,SAAS,UAAU;AAC3B,kBAAQ,cAAc,EAAE,MAAM,QAAQ,MAAM,OAAO,CAAC;AACpD,UAAAC,SAAQ,MAAM,MAAM,MAAM;AAC1B;AAAA,QACF;AAEA,cAAM,MAAM,QAAQ,eAAe;AAAA,UACjC;AAAA,UACA,SAAS,MAAM;AAAA,UACf,WAAW,MAAM;AAAA,QACnB,CAAC;AAGD,cAAM,SAAS,QAAQ,MAAM,SAAU,QAAQ,MAA4B;AAC3E,YAAI,QAAQ,MAAM,SAAS,CAAC;AAC1B,UAAC,QAAQ,MAA4B,WAAW,IAAI;AAEtD,cAAM,UAAU,CAAC,UAAkB;AACjC,iBAAO,SAAS,MAAM,SAAS,CAAC;AAAA,QAClC;AACA,cAAM,oBAAoB,QAAQ,MAAM,UAAU;AAClD,YAAI;AACF,kBAAQ,MAAM,GAAG,QAAQ,OAAO;AAElC,YAAI;AACF,gBAAM,IAAI,QAAc,CAAC,YAAY;AACnC,6BAAiB;AACjB,mBAAO,UAAU,IAAI;AAAA,UACvB,CAAC;AAAA,QACH,UACA;AACE,cAAI,mBAAmB;AACrB,oBAAQ,MAAM,IAAI,QAAQ,OAAO;AACjC,gBAAI,CAAC,UAAU,QAAQ,MAAM;AAC3B,cAAC,QAAQ,MAA4B,WAAW,KAAK;AAAA,UACzD;AAAA,QACF;AAEA,gBAAQ,YAAY,EAAE,KAAK,UAAU,aAAa,CAAC;AAEnD,YAAI,iBAAiB,GAAG;AACtB,UAAAA,SAAQ,MAAM,SAAS,YAAY,GAAG;AAAA,QACxC;AAAA,MACF;AAAA,MACA,QAAQ,MAAM;AACZ,uBAAe;AACf,gBAAQ,MAAM;AACd,YAAI;AACF,iBAAO,KAAK;AAAA,QACd,QACM;AAAA,QAAC;AAAA,MACT;AAAA,IACF;AAAA,EACF;AAGA,QAAM,WAAW,MAAM;AACrB,UAAM,OAAO,QAAQ,OAAO,WAAW;AACvC,UAAM,OAAO,QAAQ,OAAO,QAAQ;AACpC,QAAI;AACF,aAAO,OAAO,MAAM,IAAI;AAAA,IAC1B,QACM;AAAA,IAAC;AAAA,EACT;AACA,UAAQ,OAAO,GAAG,UAAU,QAAQ;AAKpC,QAAM,aAAa,MAAM;AACvB,QAAI,QAAQ,MAAM,SAAU,QAAQ,MAA4B,OAAO;AACrE,UAAI;AACF,QAAC,QAAQ,MAA4B,WAAW,KAAK;AAAA,MACvD,QACM;AAAA,MAAC;AAAA,IACT;AAAA,EACF;AACA,UAAQ,GAAG,QAAQ,UAAU;AAK7B,QAAM,mBAAmB,MAAM;AAC7B,QAAI;AACF;AACF,mBAAe;AACf,eAAW;AACX,QAAI;AACF,cAAQ,MAAM;AAAA,IAChB,QACM;AAAA,IAAC;AACP,QAAI;AACF,aAAO,KAAK;AAAA,IACd,QACM;AAAA,IAAC;AACP,QAAI;AACF,YAAM,KAAK;AAAA,IACb,QACM;AAAA,IAAC;AAAA,EACT;AACA,UAAQ,GAAG,WAAW,gBAAgB;AACtC,UAAQ,GAAG,UAAU,gBAAgB;AAErC,MAAI;AACF,UAAM,KAAK,IAAI;AAAA,EACjB,UACA;AACE,YAAQ,OAAO,IAAI,UAAU,QAAQ;AACrC,YAAQ,IAAI,QAAQ,UAAU;AAC9B,YAAQ,IAAI,WAAW,gBAAgB;AACvC,YAAQ,IAAI,UAAU,gBAAgB;AAAA,EACxC;AACF;","names":["consola","token","consola","consola","randomBytes","randomBytes","consola"]}