@openrig/cli 0.3.4 → 0.4.1

package/dist/lib/codex-auth.js

@@ -0,0 +1,418 @@
+// OPR.0.4.1.29 — rig auth secret-safe core (CLI-LOCAL / daemon-free).
+//
+// This module operates directly on the operator's Codex auth files under CODEX_HOME and is invoked
+// only from the `rig auth` CLI command — it NEVER touches the daemon, so a token can never enter the
+// daemon queue / SSE stream / SQLite / event log (never-queued/never-streamed is true BY CONSTRUCTION).
+//
+// SECRET INVARIANTS (non-negotiable): no auth/refresh/access token value is ever returned in, or used
+// to build, any human-facing string. Functions return STRUCTURED, non-secret result objects
+// (presence / mode / parseability / login-state / names / counts); the auth FILE is snapshotted as a
+// file (mode-guarded byte copy), never read into a printed value. CODEX_HOME defaults to $HOME/.codex
+// and is env-overridable (tests point it at a fixture); no personal/operator path is baked in.
+import path from "node:path";
+import fs from "node:fs";
+import { spawnSync } from "node:child_process";
+/** Strict profile-name whitelist: alnum-led, then [A-Za-z0-9._-], 1..64 chars. Excludes /, \, ~,
+ *  leading dot, whitespace, control, and shell metacharacters. Fail closed. */
+const PROFILE_NAME_RE = /^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/;
+export function validateProfileName(name) {
+    return typeof name === "string" && name.length > 0 && name.length <= 64 && PROFILE_NAME_RE.test(name);
+}
+/** Resolve the Codex paths from an env map (default process.env). CODEX_HOME wins; else $HOME/.codex. */
+export function resolveCodexHome(env = process.env) {
+    const codexHome = typeof env.CODEX_HOME === "string" && env.CODEX_HOME.length > 0
+        ? env.CODEX_HOME
+        : path.join(env.HOME ?? "", ".codex");
+    return {
+        codexHome,
+        profileDir: path.join(codexHome, "auth-profiles"),
+        activeAuth: path.join(codexHome, "auth.json"),
+        registryPath: path.join(codexHome, "auth-seat-registry.tsv"),
+    };
+}
+// --- secret-safe fs helpers (no contents ever read into a returned/printed value) ---
+function lstatSafe(p) {
+    try {
+        return fs.lstatSync(p);
+    }
+    catch {
+        return null;
+    }
+}
+function isDir(p) {
+    const st = lstatSafe(p);
+    return st !== null && st.isDirectory();
+}
+function isFile(p) {
+    const st = lstatSafe(p);
+    return st !== null && st.isFile();
+}
+/** Octal permission string (e.g. "600") or null when the path is absent/unstatable. */
+function fileModeOctal(p) {
+    const st = lstatSafe(p);
+    if (st === null)
+        return null;
+    return (st.mode & 0o777).toString(8).padStart(3, "0");
+}
+/** A profile file is safe iff it exists, is a regular file (not a symlink — which could redirect us
+ *  out of the profile dir), has link count 1 (a hardlink shares an inode that may live outside the
+ *  profile dir), and lives directly in profileDir. */
+function isSafeProfileFile(p, profileDir) {
+    const st = lstatSafe(p);
+    if (st === null || st.isSymbolicLink() || !st.isFile() || st.nlink !== 1)
+        return false;
+    return path.dirname(p) === profileDir;
+}
+/** True iff `dir` really resolves INSIDE realpath(codexHome). realpath follows every symlink in the
+ *  chain, so a symlinked parent (e.g. an auth-profiles dir pointing outside) resolves out and is
+ *  rejected — a lexical startsWith would be fooled. Returns false if either path can't be resolved. */
+function realDirContained(dir, codexHome) {
+    try {
+        const root = fs.realpathSync(codexHome);
+        const resolved = fs.realpathSync(dir);
+        return resolved === root || resolved.startsWith(root + path.sep);
+    }
+    catch {
+        return false;
+    }
+}
+/** A destination we are about to write SECRET bytes onto is safe to replace iff it is absent, or a
+ *  regular file (not a symlink) with link count 1. A symlink redirects the write; a hardlink (nlink>1)
+ *  shares an inode that may live outside CODEX_HOME — writing through either leaks secret bytes out. */
+function destReplaceable(p) {
+    const st = lstatSafe(p);
+    if (st === null)
+        return true;
+    return !st.isSymbolicLink() && st.isFile() && st.nlink === 1;
+}
+/** Copy `source` onto `dest` so secret bytes (a) never enter JS memory [copyFileSync does the byte
+ *  copy] and (b) are never written THROUGH a pre-existing inode at dest: we copy into a freshly
+ *  created (COPYFILE_EXCL) temp in dest's dir, then atomically rename over dest. Rename swaps the
+ *  directory entry — any pre-existing hardlink/symlink inode is unlinked, never written. Caller must
+ *  have already verified dest's parent containment and that dest is replaceable. */
+function copyOntoFresh(source, dest) {
+    const tmp = `${dest}.tmp-${process.pid}`;
+    try {
+        try {
+            fs.rmSync(tmp, { force: true });
+        }
+        catch {
+            /* ignore */
+        }
+        fs.copyFileSync(source, tmp, fs.constants.COPYFILE_EXCL); // fresh inode; never through an existing one
+        fs.chmodSync(tmp, 0o600);
+        fs.renameSync(tmp, dest); // atomic dir-entry swap; old inode unlinked, not written
+        fs.chmodSync(dest, 0o600);
+        return true;
+    }
+    catch {
+        try {
+            fs.rmSync(tmp, { force: true });
+        }
+        catch {
+            /* ignore */
+        }
+        return false;
+    }
+}
+function countProfiles(profileDir) {
+    try {
+        return fs.readdirSync(profileDir).filter((n) => n.endsWith(".json") && isFile(path.join(profileDir, n))).length;
+    }
+    catch {
+        return 0;
+    }
+}
+/** True iff the string contains a control character (<=0x1f or 0x7f), incl. tab/newline/CR which would
+ *  corrupt a TSV row. Printable chars (spaces, hyphens, '@', '/') are allowed. Regex-free on purpose. */
+function hasControlChar(v) {
+    for (let i = 0; i < v.length; i++) {
+        const c = v.charCodeAt(i);
+        if (c <= 0x1f || c === 0x7f)
+            return true;
+    }
+    return false;
+}
+/** Default login-state probe: exit code only, output never captured (stdio: ignore = no leak path). */
+function defaultLoginStatus(codexHome) {
+    const r = spawnSync("codex", ["login", "status"], {
+        stdio: "ignore",
+        env: { ...process.env, CODEX_HOME: codexHome },
+    });
+    if (r.error)
+        return "unavailable";
+    return r.status === 0 ? "logged_in" : "not_logged_in";
+}
+/** Report auth-file presence/mode/safety + profile count + login-state. NEVER reads token contents. */
+export function authStatus(paths, deps = {}) {
+    const activeAuthPresent = isFile(paths.activeAuth);
+    const activeAuthMode = activeAuthPresent ? fileModeOctal(paths.activeAuth) : null;
+    return {
+        codexHome: paths.codexHome,
+        codexHomePresent: isDir(paths.codexHome),
+        profileDirPresent: isDir(paths.profileDir),
+        activeAuthPresent,
+        activeAuthMode,
+        activeAuthModeSafe: activeAuthMode === null ? "unknown" : activeAuthMode === "600",
+        profileCount: countProfiles(paths.profileDir),
+        loginStatus: (deps.loginStatus ?? defaultLoginStatus)(paths.codexHome),
+    };
+}
+/** Validate a saved profile: name whitelist -> safe regular file -> 0600 -> JSON parseable. The
+ *  parse is in-memory and the result is discarded; on failure we return a FIXED reason and never the
+ *  JSON.parse error (its message can include a snippet of the file = a secret). */
+export function authValidate(paths, name) {
+    if (!validateProfileName(name))
+        return { ok: false, reason: "invalid_profile" };
+    const target = path.join(paths.profileDir, `${name}.json`);
+    if (lstatSafe(target) === null)
+        return { ok: false, reason: "missing_profile" };
+    // Safe regular file (no symlink/hardlink) AND a profile dir that really resolves inside CODEX_HOME.
+    if (!isSafeProfileFile(target, paths.profileDir) || !realDirContained(paths.profileDir, paths.codexHome)) {
+        return { ok: false, reason: "unsafe_path" };
+    }
+    if (fileModeOctal(target) !== "600")
+        return { ok: false, reason: "unsafe_permissions" };
+    let content;
+    try {
+        content = fs.readFileSync(target, "utf8");
+    }
+    catch {
+        return { ok: false, reason: "parse_check_unavailable" };
+    }
+    try {
+        JSON.parse(content);
+    }
+    catch {
+        // Intentionally ignore the error object — its message can echo file content (a secret).
+        return { ok: false, reason: "malformed_json" };
+    }
+    return { ok: true, name, path: target, mode: "600" };
+}
+/** Snapshot the active auth file into a named profile (0600 file in the 0700 profile dir). Byte-copy
+ *  via copyFileSync — contents never enter JS memory; result reports name/path/mode only. */
+export function authSave(paths, name) {
+    if (!validateProfileName(name))
+        return { ok: false, reason: "invalid_profile" };
+    if (!isFile(paths.activeAuth))
+        return { ok: false, reason: "not_configured" };
+    const target = path.join(paths.profileDir, `${name}.json`);
+    // Refuse a symlinked profile-dir BEFORE mkdir/chmod so we never follow it out of CODEX_HOME or
+    // mutate the outside target's mode.
+    const pdStat = lstatSafe(paths.profileDir);
+    if (pdStat !== null && pdStat.isSymbolicLink())
+        return { ok: false, reason: "unsafe_path" };
+    try {
+        fs.mkdirSync(paths.profileDir, { recursive: true });
+        fs.chmodSync(paths.profileDir, 0o700);
+    }
+    catch {
+        return { ok: false, reason: "io_error" };
+    }
+    // Parent must REALLY resolve inside CODEX_HOME (defeats a symlinked auth-profiles parent), and the
+    // existing target must not be a symlink/hardlink/non-regular file (defeats writing secret bytes
+    // through an inode that lives outside CODEX_HOME).
+    if (!realDirContained(paths.profileDir, paths.codexHome))
+        return { ok: false, reason: "unsafe_path" };
+    if (!destReplaceable(target))
+        return { ok: false, reason: "unsafe_path" };
+    if (!copyOntoFresh(paths.activeAuth, target))
+        return { ok: false, reason: "io_error" };
+    return { ok: true, name, path: target, mode: "600" };
+}
+/** Activate a saved profile (copy it onto the active auth at 0600). Refuses to widen perms over an
+ *  existing unsafe active file. Byte-copy; no content echoed. */
+export function authSwitch(paths, name) {
+    if (!validateProfileName(name))
+        return { ok: false, reason: "invalid_profile" };
+    const source = path.join(paths.profileDir, `${name}.json`);
+    if (lstatSafe(source) === null)
+        return { ok: false, reason: "missing_profile" };
+    if (!isSafeProfileFile(source, paths.profileDir))
+        return { ok: false, reason: "unsafe_path" };
+    // Destination guard: a symlink/non-regular OR hardlinked (nlink>1) active auth would let the copy
+    // write the selected profile's SECRET bytes THROUGH an inode living outside CODEX_HOME. Refuse it
+    // (isFile() is false for a symlink, so the old isFile-gated check silently missed both cases).
+    if (!destReplaceable(paths.activeAuth))
+        return { ok: false, reason: "unsafe_path" };
+    if (isFile(paths.activeAuth)) {
+        const m = fileModeOctal(paths.activeAuth);
+        if (m !== null && m !== "600")
+            return { ok: false, reason: "unsafe_permissions" };
+    }
+    try {
+        fs.mkdirSync(paths.codexHome, { recursive: true });
+    }
+    catch {
+        return { ok: false, reason: "io_error" };
+    }
+    if (!realDirContained(paths.codexHome, paths.codexHome))
+        return { ok: false, reason: "unsafe_path" };
+    if (!copyOntoFresh(source, paths.activeAuth))
+        return { ok: false, reason: "io_error" };
+    return {
+        ok: true,
+        name,
+        activePath: paths.activeAuth,
+        mode: "600",
+        note: "live Codex sessions do not switch accounts in place; restart the affected seats to pick up the new profile.",
+    };
+}
+/** List saved profile names (safe regular *.json files in the profile dir), sorted. No contents read.
+ *  Refuses to list through a symlinked / out-of-tree profile dir (returns []), so a redirected parent
+ *  never exposes file names from outside CODEX_HOME. */
+export function authList(paths) {
+    if (!realDirContained(paths.profileDir, paths.codexHome))
+        return [];
+    try {
+        return fs
+            .readdirSync(paths.profileDir)
+            .filter((n) => n.endsWith(".json") && isSafeProfileFile(path.join(paths.profileDir, n), paths.profileDir))
+            .map((n) => n.slice(0, -".json".length))
+            .sort();
+    }
+    catch {
+        return [];
+    }
+}
+// --- Auth-B: seat -> profile METADATA registry (product-native; NO resume_token per orch D2) ---
+/** Stated in command output + docs: a seat label is metadata, never proof of a live account. */
+export const SEAT_REGISTRY_DISCLAIMER = "Seat labels are metadata only; they do NOT prove a running session is actually using that account/profile.";
+// 6 columns; NO resume_token (a print surface is the worst place to hold a secret-class token).
+const SEAT_COLUMNS = ["seat", "rig", "runtime", "cwd", "auth_profile", "updated_ts"];
+const SEAT_HEADER = SEAT_COLUMNS.join("\t");
+const SEAT_TAB_COUNT = SEAT_COLUMNS.length - 1;
+function isSafeRegistryFile(p) {
+    const st = lstatSafe(p);
+    return st !== null && !st.isSymbolicLink() && st.isFile();
+}
+/** Reject empty + any control character (covers tab/newline/CR, which would corrupt the TSV). */
+function validRegistryField(v) {
+    return v.length > 0 && !hasControlChar(v);
+}
+function rawRegistryLines(registryPath) {
+    let text;
+    try {
+        text = fs.readFileSync(registryPath, "utf8");
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    let first = true;
+    for (const line of text.split("\n")) {
+        if (line === "" || line.startsWith("#"))
+            continue;
+        if (first) {
+            first = false; // skip header
+            continue;
+        }
+        out.push(line);
+    }
+    return out;
+}
+function rowMalformed(line) {
+    const tabs = (line.match(/\t/g) ?? []).length;
+    if (tabs !== SEAT_TAB_COUNT)
+        return true;
+    return line.split("\t")[0] === "";
+}
+function parseRow(line) {
+    // Callers pre-filter via rowMalformed (guaranteed 6 fields); ?? "" satisfies strict indexing.
+    const f = line.split("\t");
+    return {
+        seat: f[0] ?? "",
+        rig: f[1] ?? "",
+        runtime: f[2] ?? "",
+        cwd: f[3] ?? "",
+        authProfile: f[4] ?? "",
+        updatedTs: f[5] ?? "",
+    };
+}
+/** Atomic upsert of a seat metadata row (tmp + rename). Drops pre-existing malformed rows rather than
+ *  re-emitting fabricated metadata. `now` is injectable for deterministic tests. */
+export function authSeatSet(paths, fields, now = () => new Date().toISOString()) {
+    if (!validRegistryField(fields.seat))
+        return { ok: false, reason: "invalid_seat" };
+    if (!validRegistryField(fields.rig))
+        return { ok: false, reason: "invalid_rig" };
+    if (fields.runtime !== "codex")
+        return { ok: false, reason: "invalid_runtime" }; // v0 whitelist
+    const cwd = fields.cwd && fields.cwd.length > 0 ? fields.cwd : "unknown";
+    if (!validRegistryField(cwd))
+        return { ok: false, reason: "invalid_cwd" };
+    const profile = fields.authProfile && fields.authProfile.length > 0 ? fields.authProfile : "unknown";
+    if (profile !== "unknown" && !validateProfileName(profile))
+        return { ok: false, reason: "invalid_profile" };
+    if (lstatSafe(paths.registryPath) !== null && !isSafeRegistryFile(paths.registryPath)) {
+        return { ok: false, reason: "unsafe_path" };
+    }
+    const kept = rawRegistryLines(paths.registryPath)
+        .filter((l) => !rowMalformed(l))
+        .filter((l) => l.split("\t")[0] !== fields.seat);
+    const newRow = [fields.seat, fields.rig, "codex", cwd, profile, now()].join("\t");
+    const body = [SEAT_HEADER, ...kept, newRow].join("\n") + "\n";
+    const tmp = `${paths.registryPath}.${process.pid}.tmp`;
+    try {
+        fs.mkdirSync(path.dirname(paths.registryPath), { recursive: true });
+        fs.writeFileSync(tmp, body, { mode: 0o600 });
+        fs.chmodSync(tmp, 0o600);
+        fs.renameSync(tmp, paths.registryPath);
+        fs.chmodSync(paths.registryPath, 0o600);
+    }
+    catch {
+        try {
+            fs.rmSync(tmp, { force: true });
+        }
+        catch {
+            /* ignore */
+        }
+        return { ok: false, reason: "io_error" };
+    }
+    return { ok: true, seat: fields.seat, registryPath: paths.registryPath, mode: "600", disclaimer: SEAT_REGISTRY_DISCLAIMER };
+}
+/** List well-formed seat rows (malformed rows skipped). */
+export function authSeatsList(paths) {
+    return rawRegistryLines(paths.registryPath)
+        .filter((l) => !rowMalformed(l))
+        .map(parseRow);
+}
+export function authSeatShow(paths, seat) {
+    if (!validRegistryField(seat))
+        return { ok: false, reason: "invalid_seat" };
+    if (lstatSafe(paths.registryPath) !== null && !isSafeRegistryFile(paths.registryPath)) {
+        return { ok: false, reason: "unsafe_path" };
+    }
+    const row = authSeatsList(paths).find((r) => r.seat === seat);
+    return row ? { ok: true, row } : { ok: false, reason: "missing_seat" };
+}
+export function authSeatsReport(paths) {
+    const present = isFile(paths.registryPath);
+    const mode = present ? fileModeOctal(paths.registryPath) : null;
+    let total = 0;
+    let known = 0;
+    let unknown = 0;
+    let malformed = 0;
+    for (const line of rawRegistryLines(paths.registryPath)) {
+        if (rowMalformed(line)) {
+            malformed += 1;
+            continue;
+        }
+        total += 1;
+        const profile = line.split("\t")[4];
+        if (!profile || profile === "unknown")
+            unknown += 1;
+        else
+            known += 1;
+    }
+    return {
+        registryPresent: present,
+        registryMode: mode,
+        registryModeSafe: mode === null ? "unknown" : mode === "600",
+        total,
+        known,
+        unknown,
+        malformed,
+    };
+}
+//# sourceMappingURL=codex-auth.js.map

package/dist/lib/codex-auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex-auth.js","sourceRoot":"","sources":["../../src/lib/codex-auth.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,EAAE;AACF,mGAAmG;AACnG,qGAAqG;AACrG,wGAAwG;AACxG,EAAE;AACF,sGAAsG;AACtG,4FAA4F;AAC5F,qGAAqG;AACrG,sGAAsG;AACtG,+FAA+F;AAC/F,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,SAAS,EAAE,MAAM,oBAAoB,CAAC;AAE/C;+EAC+E;AAC/E,MAAM,eAAe,GAAG,mCAAmC,CAAC;AAE5D,MAAM,UAAU,mBAAmB,CAAC,IAAa;IAC/C,OAAO,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACxG,CAAC;AAaD,yGAAyG;AACzG,MAAM,UAAU,gBAAgB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACnE,MAAM,SAAS,GACb,OAAO,GAAG,CAAC,UAAU,KAAK,QAAQ,IAAI,GAAG,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC;QAC7D,CAAC,CAAC,GAAG,CAAC,UAAU;QAChB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC1C,OAAO;QACL,SAAS;QACT,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC;QACjD,UAAU,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,WAAW,CAAC;QAC7C,YAAY,EAAE,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,wBAAwB,CAAC;KAC7D,CAAC;AACJ,CAAC;AAED,uFAAuF;AAEvF,SAAS,SAAS,CAAC,CAAS;IAC1B,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC;IACzB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,CAAS;IACtB,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,MAAM,CAAC,CAAS;IACvB,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;AACpC,CAAC;AAED,uFAAuF;AACvF,SAAS,aAAa,CAAC,CAAS;IAC9B,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;AACxD,CAAC;AAED;;sDAEsD;AACtD,SAAS,iBAAiB,CAAC,CAAS,EAAE,UAAkB;IACtD,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,KAAK,IAAI,IAAI,EAAE,CAAC,cAAc,EAAE,IAAI,CAAC,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IACvF,OAAO,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,KAAK,UAAU,CAAC;AACxC,CAAC;AAED;;uGAEuG;AACvG,SAAS,gBAAgB,CAAC,GAAW,EAAE,SAAiB;IACtD,IAAI,CAAC;QACH,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACxC,MAAM,QAAQ,GAAG,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,QAAQ,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,CAAC,IAAI,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC;IACnE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;wGAEwG;AACxG,SAAS,eAAe,CAAC,CAAS;IAChC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,IAAI,EAAE,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAC7B,OAAO,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,KAAK,KAAK,CAAC,CAAC;AAC/D,CAAC;AAED;;;;oFAIoF;AACpF,SAAS,aAAa,CAAC,MAAc,EAAE,IAAY;IACjD,MAAM,GAAG,GAAG,GAAG,IAAI,QAAQ,OAAO,CAAC,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC;QACH,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,GAAG,EAAE,EAAE,CAAC,SAAS,CAAC,aAAa,CAAC,CAAC,CAAC,6CAA6C;QACvG,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC,yDAAyD;QACnF,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QAC1B,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,UAAkB;IACvC,IAAI,CAAC;QACH,OAAO,EAAE,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;IAClH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,CAAC,CAAC;IACX,CAAC;AACH,CAAC;AAED;yGACyG;AACzG,SAAS,cAAc,CAAC,CAAS;IAC/B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QAClC,MAAM,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC;QAC1B,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,KAAK,IAAI;YAAE,OAAO,IAAI,CAAC;IAC3C,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AASD,uGAAuG;AACvG,SAAS,kBAAkB,CAAC,SAAiB;IAC3C,MAAM,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC,EAAE;QAChD,KAAK,EAAE,QAAQ;QACf,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,EAAE,SAAS,EAAE;KAC/C,CAAC,CAAC;IACH,IAAI,CAAC,CAAC,KAAK;QAAE,OAAO,aAAa,CAAC;IAClC,OAAO,CAAC,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,eAAe,CAAC;AACxD,CAAC;AAaD,uGAAuG;AACvG,MAAM,UAAU,UAAU,CAAC,KAAqB,EAAE,OAAsB,EAAE;IACxE,MAAM,iBAAiB,GAAG,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IACnD,MAAM,cAAc,GAAG,iBAAiB,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,OAAO;QACL,SAAS,EAAE,KAAK,CAAC,SAAS;QAC1B,gBAAgB,EAAE,KAAK,CAAC,KAAK,CAAC,SAAS,CAAC;QACxC,iBAAiB,EAAE,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC;QAC1C,iBAAiB;QACjB,cAAc;QACd,kBAAkB,EAAE,cAAc,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,cAAc,KAAK,KAAK;QAClF,YAAY,EAAE,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC;QAC7C,WAAW,EAAE,CAAC,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAC,CAAC,KAAK,CAAC,SAAS,CAAC;KACvE,CAAC;AACJ,CAAC;AASD;;mFAEmF;AACnF,MAAM,UAAU,YAAY,CAAC,KAAqB,EAAE,IAAY;IAC9D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChF,oGAAoG;IACpG,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC;QACzG,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,IAAI,aAAa,CAAC,MAAM,CAAC,KAAK,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACxF,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,yBAAyB,EAAE,CAAC;IAC1D,CAAC;IACD,IAAI,CAAC;QACH,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtB,CAAC;IAAC,MAAM,CAAC;QACP,wFAAwF;QACxF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IACjD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACvD,CAAC;AAMD;6FAC6F;AAC7F,MAAM,UAAU,QAAQ,CAAC,KAAqB,EAAE,IAAY;IAC1D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChF,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,gBAAgB,EAAE,CAAC;IAC9E,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAC3D,+FAA+F;IAC/F,oCAAoC;IACpC,MAAM,MAAM,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC3C,IAAI,MAAM,KAAK,IAAI,IAAI,MAAM,CAAC,cAAc,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC5F,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,mGAAmG;IACnG,gGAAgG;IAChG,mDAAmD;IACnD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACtG,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1E,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,UAAU,EAAE,MAAM,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC;AACvD,CAAC;AAMD;iEACiE;AACjE,MAAM,UAAU,UAAU,CAAC,KAAqB,EAAE,IAAY;IAC5D,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChF,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,GAAG,IAAI,OAAO,CAAC,CAAC;IAC3D,IAAI,SAAS,CAAC,MAAM,CAAC,KAAK,IAAI;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAChF,IAAI,CAAC,iBAAiB,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9F,kGAAkG;IAClG,kGAAkG;IAClG,+FAA+F;IAC/F,IAAI,CAAC,eAAe,CAAC,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACpF,IAAI,MAAM,CAAC,KAAK,CAAC,UAAU,CAAC,EAAE,CAAC;QAC7B,MAAM,CAAC,GAAG,aAAa,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,CAAC,KAAK,IAAI,IAAI,CAAC,KAAK,KAAK;YAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,oBAAoB,EAAE,CAAC;IACpF,CAAC;IACD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,SAAS,EAAE,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACrG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,UAAU,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IACvF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,IAAI;QACJ,UAAU,EAAE,KAAK,CAAC,UAAU;QAC5B,IAAI,EAAE,KAAK;QACX,IAAI,EAAE,6GAA6G;KACpH,CAAC;AACJ,CAAC;AAED;;wDAEwD;AACxD,MAAM,UAAU,QAAQ,CAAC,KAAqB;IAC5C,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,UAAU,EAAE,KAAK,CAAC,SAAS,CAAC;QAAE,OAAO,EAAE,CAAC;IACpE,IAAI,CAAC;QACH,OAAO,EAAE;aACN,WAAW,CAAC,KAAK,CAAC,UAAU,CAAC;aAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAC,OAAO,CAAC,IAAI,iBAAiB,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;aACzG,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;aACvC,IAAI,EAAE,CAAC;IACZ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,kGAAkG;AAElG,gGAAgG;AAChG,MAAM,CAAC,MAAM,wBAAwB,GACnC,4GAA4G,CAAC;AAE/G,gGAAgG;AAChG,MAAM,YAAY,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,SAAS,EAAE,KAAK,EAAE,cAAc,EAAE,YAAY,CAAU,CAAC;AAC9F,MAAM,WAAW,GAAG,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC5C,MAAM,cAAc,GAAG,YAAY,CAAC,MAAM,GAAG,CAAC,CAAC;AAmB/C,SAAS,kBAAkB,CAAC,CAAS;IACnC,MAAM,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;IACxB,OAAO,EAAE,KAAK,IAAI,IAAI,CAAC,EAAE,CAAC,cAAc,EAAE,IAAI,EAAE,CAAC,MAAM,EAAE,CAAC;AAC5D,CAAC;AAED,iGAAiG;AACjG,SAAS,kBAAkB,CAAC,CAAS;IACnC,OAAO,CAAC,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,CAAC,CAAC;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,YAAoB;IAC5C,IAAI,IAAY,CAAC;IACjB,IAAI,CAAC;QACH,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAAC;IAC/C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;IACD,MAAM,GAAG,GAAa,EAAE,CAAC;IACzB,IAAI,KAAK,GAAG,IAAI,CAAC;IACjB,KAAK,MAAM,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACpC,IAAI,IAAI,KAAK,EAAE,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,SAAS;QAClD,IAAI,KAAK,EAAE,CAAC;YACV,KAAK,GAAG,KAAK,CAAC,CAAC,cAAc;YAC7B,SAAS;QACX,CAAC;QACD,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACjB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAC9C,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,IAAI,CAAC;IACzC,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC;AACpC,CAAC;AAED,SAAS,QAAQ,CAAC,IAAY;IAC5B,8FAA8F;IAC9F,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC3B,OAAO;QACL,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QAChB,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACf,OAAO,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACnB,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACf,WAAW,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;QACvB,SAAS,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;KACtB,CAAC;AACJ,CAAC;AAMD;oFACoF;AACpF,MAAM,UAAU,WAAW,CACzB,KAAqB,EACrB,MAAqB,EACrB,MAAoB,GAAG,EAAE,CAAC,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;IAElD,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IACnF,IAAI,CAAC,kBAAkB,CAAC,MAAM,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IACjF,IAAI,MAAM,CAAC,OAAO,KAAK,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC,CAAC,eAAe;IAChG,MAAM,GAAG,GAAG,MAAM,CAAC,GAAG,IAAI,MAAM,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC;IACzE,IAAI,CAAC,kBAAkB,CAAC,GAAG,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC1E,MAAM,OAAO,GAAG,MAAM,CAAC,WAAW,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,SAAS,CAAC;IACrG,IAAI,OAAO,KAAK,SAAS,IAAI,CAAC,mBAAmB,CAAC,OAAO,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,iBAAiB,EAAE,CAAC;IAE5G,IAAI,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,IAAI,GAAG,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC;SAC9C,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;SAC/B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,IAAI,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAClF,MAAM,IAAI,GAAG,CAAC,WAAW,EAAE,GAAG,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC;IAE9D,MAAM,GAAG,GAAG,GAAG,KAAK,CAAC,YAAY,IAAI,OAAO,CAAC,GAAG,MAAM,CAAC;IACvD,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpE,EAAE,CAAC,aAAa,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC7C,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACzB,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,YAAY,CAAC,CAAC;QACvC,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,YAAY,EAAE,KAAK,CAAC,CAAC;IAC1C,CAAC;IAAC,MAAM,CAAC;QACP,IAAI,CAAC;YACH,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QAClC,CAAC;QAAC,MAAM,CAAC;YACP,YAAY;QACd,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,UAAU,EAAE,CAAC;IAC3C,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY,EAAE,IAAI,EAAE,KAAK,EAAE,UAAU,EAAE,wBAAwB,EAAE,CAAC;AAC9H,CAAC;AAED,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,KAAqB;IACjD,OAAO,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC;SACxC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;SAC/B,GAAG,CAAC,QAAQ,CAAC,CAAC;AACnB,CAAC;AAID,MAAM,UAAU,YAAY,CAAC,KAAqB,EAAE,IAAY;IAC9D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;IAC5E,IAAI,SAAS,CAAC,KAAK,CAAC,YAAY,CAAC,KAAK,IAAI,IAAI,CAAC,kBAAkB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACtF,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,aAAa,EAAE,CAAC;IAC9C,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;IAC9D,OAAO,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,cAAc,EAAE,CAAC;AACzE,CAAC;AAYD,MAAM,UAAU,eAAe,CAAC,KAAqB;IACnD,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;IAC3C,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;IAChE,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,KAAK,GAAG,CAAC,CAAC;IACd,IAAI,OAAO,GAAG,CAAC,CAAC;IAChB,IAAI,SAAS,GAAG,CAAC,CAAC;IAClB,KAAK,MAAM,IAAI,IAAI,gBAAgB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,CAAC;QACxD,IAAI,YAAY,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,SAAS,IAAI,CAAC,CAAC;YACf,SAAS;QACX,CAAC;QACD,KAAK,IAAI,CAAC,CAAC;QACX,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QACpC,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC,CAAC;;YAC/C,KAAK,IAAI,CAAC,CAAC;IAClB,CAAC;IACD,OAAO;QACL,eAAe,EAAE,OAAO;QACxB,YAAY,EAAE,IAAI;QAClB,gBAAgB,EAAE,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,KAAK,KAAK;QAC5D,KAAK;QACL,KAAK;QACL,OAAO;QACP,SAAS;KACV,CAAC;AACJ,CAAC"}

package/dist/lib/scope/progress-edit.d.ts

@@ -0,0 +1,42 @@
+export type ProgressStatus = "active" | "done" | "blocked";
+export declare const PROGRESS_STATUSES: ReadonlyArray<ProgressStatus>;
+export declare const DEFAULT_PROGRESS_SECTION = "Rail";
+/** Map a status word to the single indexer indicator character. */
+export declare function statusIndicator(status: ProgressStatus): " " | "x" | "~";
+/** Validate + narrow an arbitrary string to a ProgressStatus, or throw
+ *  the 3-part error. The status vocabulary is the ONLY three the indexer
+ *  understands. */
+export declare function parseStatus(raw: string): ProgressStatus;
+export interface ProgressEditResult {
+    content: string;
+    changed: boolean;
+}
+/**
+ * Append a `- [<indicator>] <text>` row under `## <section>`.
+ * - Creates the `## <section>` heading (appended after the last existing
+ *   section) when it is absent.
+ * - Idempotent: an identical (section, text, status) row is a no-op.
+ * - Refuses to create a conflicting duplicate (same text, different
+ *   status) — that is a `--set` operation, not an `--add`.
+ * - Never touches the frontmatter, the `# H1`, or unrelated lines.
+ */
+export declare function addProgressRow(content: string, opts: {
+    section: string;
+    text: string;
+    status: ProgressStatus;
+}): ProgressEditResult;
+/**
+ * Rewrite the indicator of the single row whose trimmed text EXACTLY
+ * matches `text`. Row selection is exact-trimmed-text (not line number,
+ * not a generated id — the indexer mints neither).
+ * - 0 matches → error (names the missing text).
+ * - >1 matches → error (ambiguous; v0 refuses rather than guess).
+ * - Idempotent: setting a row to its current status is a no-op.
+ * - Rewrites ONLY the matched line's indicator char; the rest is
+ *   preserved byte-for-byte.
+ */
+export declare function setProgressRow(content: string, opts: {
+    text: string;
+    status: ProgressStatus;
+}): ProgressEditResult;
+//# sourceMappingURL=progress-edit.d.ts.map

package/dist/lib/scope/progress-edit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"progress-edit.d.ts","sourceRoot":"","sources":["../../../src/lib/scope/progress-edit.ts"],"names":[],"mappings":"AAcA,MAAM,MAAM,cAAc,GAAG,QAAQ,GAAG,MAAM,GAAG,SAAS,CAAC;AAE3D,eAAO,MAAM,iBAAiB,EAAE,aAAa,CAAC,cAAc,CAAiC,CAAC;AAE9F,eAAO,MAAM,wBAAwB,SAAS,CAAC;AAE/C,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,CAMvE;AASD;;mBAEmB;AACnB,wBAAgB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,cAAc,CASvD;AAgBD,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED;;;;;;;;GAQG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GAC9D,kBAAkB,CAyDpB;AAED;;;;;;;;;GASG;AACH,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,IAAI,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,cAAc,CAAA;CAAE,GAC7C,kBAAkB,CAiCpB"}

package/dist/lib/scope/progress-edit.js

@@ -0,0 +1,171 @@
+// OPR.0.4.0.33 — pure, surgical markdown editors for PROGRESS rails.
+//
+// These back `rig scope ... progress`. They consume the UI parser
+// contract in packages/daemon/src/domain/progress/progress-indexer.ts:
+//   - title comes from the FIRST `# H1` only (frontmatter is skipped),
+//   - section hierarchy from `##`/`###`/`####` headings,
+//   - rows from `- [ ]` / `- [x]` / `- [~]` checkbox lines.
+// So every edit preserves the `# H1` + the YAML frontmatter verbatim
+// and writes rows in exactly that shape. The functions are pure (string
+// in, string out) so the command layer stays thin and the behavior is
+// unit-testable without a filesystem.
+import { ScopeCliError } from "./types.js";
+export const PROGRESS_STATUSES = ["active", "done", "blocked"];
+export const DEFAULT_PROGRESS_SECTION = "Rail";
+/** Map a status word to the single indexer indicator character. */
+export function statusIndicator(status) {
+    switch (status) {
+        case "active": return " ";
+        case "done": return "x";
+        case "blocked": return "~";
+    }
+}
+function indicatorToStatus(indicator) {
+    const c = indicator.toLowerCase();
+    if (c === "x")
+        return "done";
+    if (c === "~")
+        return "blocked";
+    return "active";
+}
+/** Validate + narrow an arbitrary string to a ProgressStatus, or throw
+ *  the 3-part error. The status vocabulary is the ONLY three the indexer
+ *  understands. */
+export function parseStatus(raw) {
+    if (PROGRESS_STATUSES.includes(raw)) {
+        return raw;
+    }
+    throw new ScopeCliError({
+        fact: `Unknown --status "${raw}".`,
+        consequence: "No progress row was written.",
+        action: `Use one of: ${PROGRESS_STATUSES.join(", ")}.`,
+    });
+}
+// Indexer-aligned row matcher: optional indent, optional `- `/`* ` bullet,
+// `[ x ~]` indicator, then the row text.
+const ROW_RE = /^(\s*)(?:[-*]\s+)?\[([ xX~])\]\s+(.+?)\s*$/;
+const HEADING_RE = /^(#{1,6})\s+(.+?)\s*$/;
+/** Index of the first body line (after any leading YAML frontmatter). */
+function bodyStartIndex(lines) {
+    if ((lines[0] ?? "").trim() !== "---")
+        return 0;
+    for (let i = 1; i < lines.length; i++) {
+        if (lines[i].trim() === "---")
+            return i + 1;
+    }
+    return 0; // unterminated frontmatter — treat as no frontmatter
+}
+/**
+ * Append a `- [<indicator>] <text>` row under `## <section>`.
+ * - Creates the `## <section>` heading (appended after the last existing
+ *   section) when it is absent.
+ * - Idempotent: an identical (section, text, status) row is a no-op.
+ * - Refuses to create a conflicting duplicate (same text, different
+ *   status) — that is a `--set` operation, not an `--add`.
+ * - Never touches the frontmatter, the `# H1`, or unrelated lines.
+ */
+export function addProgressRow(content, opts) {
+    const section = opts.section.trim();
+    const text = opts.text.trim();
+    if (!text) {
+        throw new ScopeCliError({
+            fact: "The --add row text is empty.",
+            consequence: "No progress row was written.",
+            action: 'Pass a non-empty row, e.g. --add "Guard approved".',
+        });
+    }
+    const newRow = `- [${statusIndicator(opts.status)}] ${text}`;
+    const lines = content.split("\n");
+    const start = bodyStartIndex(lines);
+    // Locate the target section heading.
+    let sectionIdx = -1;
+    for (let i = start; i < lines.length; i++) {
+        const h = lines[i].match(HEADING_RE);
+        if (h && h[2].trim() === section) {
+            sectionIdx = i;
+            break;
+        }
+    }
+    if (sectionIdx === -1) {
+        // Create the section, appended after the last existing content.
+        let end = lines.length;
+        while (end > start && lines[end - 1].trim() === "")
+            end--;
+        const head = lines.slice(0, end);
+        const rebuilt = [...head, "", `## ${section}`, "", newRow, ""].join("\n");
+        return { content: rebuilt, changed: true };
+    }
+    // Section block = [sectionIdx+1, nextHeadingOrEOF).
+    let blockEnd = lines.length;
+    for (let i = sectionIdx + 1; i < lines.length; i++) {
+        if (HEADING_RE.test(lines[i])) {
+            blockEnd = i;
+            break;
+        }
+    }
+    // Idempotency / conflict scan within the section.
+    for (let i = sectionIdx + 1; i < blockEnd; i++) {
+        const cb = lines[i].match(ROW_RE);
+        if (cb && cb[3].trim() === text) {
+            const current = indicatorToStatus(cb[2]);
+            if (current === opts.status)
+                return { content, changed: false };
+            throw new ScopeCliError({
+                fact: `A row "${text}" already exists in section "${section}" with status ${current}.`,
+                consequence: "Refusing to add a conflicting duplicate row.",
+                action: `Use: rig scope ... progress --set "${text}" --status ${opts.status} to change its status.`,
+            });
+        }
+    }
+    // Insert after the last non-blank line in the section block.
+    let insertAt = sectionIdx + 1;
+    for (let i = sectionIdx + 1; i < blockEnd; i++) {
+        if (lines[i].trim() !== "")
+            insertAt = i + 1;
+    }
+    lines.splice(insertAt, 0, newRow);
+    return { content: lines.join("\n"), changed: true };
+}
+/**
+ * Rewrite the indicator of the single row whose trimmed text EXACTLY
+ * matches `text`. Row selection is exact-trimmed-text (not line number,
+ * not a generated id — the indexer mints neither).
+ * - 0 matches → error (names the missing text).
+ * - >1 matches → error (ambiguous; v0 refuses rather than guess).
+ * - Idempotent: setting a row to its current status is a no-op.
+ * - Rewrites ONLY the matched line's indicator char; the rest is
+ *   preserved byte-for-byte.
+ */
+export function setProgressRow(content, opts) {
+    const text = opts.text.trim();
+    const lines = content.split("\n");
+    const start = bodyStartIndex(lines);
+    const matches = [];
+    for (let i = start; i < lines.length; i++) {
+        const cb = lines[i].match(ROW_RE);
+        if (cb && cb[3].trim() === text)
+            matches.push(i);
+    }
+    if (matches.length === 0) {
+        throw new ScopeCliError({
+            fact: `No progress row matches the exact text "${text}".`,
+            consequence: "Nothing was changed.",
+            action: 'Check the row text (exact, trimmed match), or add it with --add. List rows with: rig scope ... show.',
+        });
+    }
+    if (matches.length > 1) {
+        throw new ScopeCliError({
+            fact: `${matches.length} rows match the text "${text}" (ambiguous).`,
+            consequence: "v0 refuses to guess which row to update; nothing was changed.",
+            action: "Make the row text unique, then retry.",
+        });
+    }
+    const i = matches[0];
+    const indMatch = lines[i].match(/\[([ xX~])\]/);
+    if (indicatorToStatus(indMatch[1]) === opts.status) {
+        return { content, changed: false };
+    }
+    lines[i] = lines[i].replace(/\[([ xX~])\]/, `[${statusIndicator(opts.status)}]`);
+    return { content: lines.join("\n"), changed: true };
+}
+//# sourceMappingURL=progress-edit.js.map