@osva-ai/cli 1.1.0 → 1.1.2

package/dist/setup/installation-status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"installation-status.js","sourceRoot":"","sources":["../../src/setup/installation-status.ts"],"names":[],"mappings":"AAoBA,MAAM,UAAU,2BAA2B,CACzC,MAAc;IAEd,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC9B,MAAM,QAAQ,GACZ,OAAO;SACJ,KAAK,CAAC,OAAO,CAAC;SACd,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,IAAI,OAAO,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAA+B,CAAC;IAClE,IAAI,MAAM,CAAC,aAAa,KAAK,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CACb,kDAAkD,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,GAAG,CAClF,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,MAAM,UAAU,mCAAmC,CACjD,MAAkC;IAElC,IAAI,MAAM,CAAC,iBAAiB,GAAG,CAAC,EAAE,CAAC;QACjC,IAAI,MAAM,CAAC,qBAAqB,GAAG,CAAC,EAAE,CAAC;YACrC,OAAO,sCAAsC,CAAC;QAChD,CAAC;QACD,IAAI,MAAM,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;YAC9B,OAAO,qBAAqB,CAAC;QAC/B,CAAC;IACH,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,IAAI,MAAM,CAAC,cAAc,GAAG,CAAC,EAAE,CAAC;QAC1E,OAAO,qBAAqB,CAAC;IAC/B,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3C,OAAO,8BAA8B,CAAC;IACxC,CAAC;IAED,IAAI,MAAM,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,uCAAuC,CAAC;IACjD,CAAC;IAED,IAAI,MAAM,CAAC,cAAc,KAAK,CAAC,IAAI,MAAM,CAAC,WAAW,KAAK,CAAC,EAAE,CAAC;QAC5D,OAAO,oBAAoB,CAAC;IAC9B,CAAC;IAED,OAAO,2BAA2B,CAAC;AACrC,CAAC"}

package/dist/setup/materialize-install.d.ts

@@ -0,0 +1,24 @@
+import type { ComposeDistribution } from "./distribution.js";
+import { type InstallEnvValues } from "./env-file.js";
+import { type InstallDirectoryAssessment } from "./installation-state.js";
+import type { SetupOptions } from "./read-options.js";
+export interface MaterializeInstallResult {
+    readonly assessment: InstallDirectoryAssessment;
+    readonly envValues: InstallEnvValues;
+    readonly envPath: string;
+    readonly composePath: string;
+    readonly markerPath: string;
+    readonly preservedSecrets: boolean;
+    readonly wroteCompose: boolean;
+    readonly wroteEnv: boolean;
+}
+export declare function materializeInstallation(input: {
+    readonly options: SetupOptions;
+    readonly distribution: ComposeDistribution;
+    readonly processEnv: NodeJS.ProcessEnv;
+}): Promise<MaterializeInstallResult>;
+export declare class MaterializeInstallError extends Error {
+    readonly code: "foreign_directory" | "env_conflict";
+    constructor(code: "foreign_directory" | "env_conflict", message: string);
+}
+//# sourceMappingURL=materialize-install.d.ts.map

package/dist/setup/materialize-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"materialize-install.d.ts","sourceRoot":"","sources":["../../src/setup/materialize-install.ts"],"names":[],"mappings":"AAKA,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAC7D,OAAO,EAKL,KAAK,gBAAgB,EACtB,MAAM,eAAe,CAAC;AACvB,OAAO,EAIL,KAAK,0BAA0B,EAChC,MAAM,yBAAyB,CAAC;AAIjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,UAAU,EAAE,0BAA0B,CAAC;IAChD,QAAQ,CAAC,SAAS,EAAE,gBAAgB,CAAC;IACrC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,gBAAgB,EAAE,OAAO,CAAC;IACnC,QAAQ,CAAC,YAAY,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B;AAED,wBAAsB,uBAAuB,CAAC,KAAK,EAAE;IACnD,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,YAAY,EAAE,mBAAmB,CAAC;IAC3C,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC,UAAU,CAAC;CACxC,GAAG,OAAO,CAAC,wBAAwB,CAAC,CA6EpC;AA6CD,qBAAa,uBAAwB,SAAQ,KAAK;IAChD,QAAQ,CAAC,IAAI,EAAE,mBAAmB,GAAG,cAAc,CAAC;gBAExC,IAAI,EAAE,mBAAmB,GAAG,cAAc,EAAE,OAAO,EAAE,MAAM;CAIxE"}

package/dist/setup/materialize-install.js

@@ -0,0 +1,108 @@
+import { mkdir, readFile, stat } from "node:fs/promises";
+import path from "node:path";
+import { CLI_VERSION } from "../version.js";
+import { writeFileAtomic } from "./atomic-write.js";
+import { buildInstallEnvValues, detectShellEnvConflicts, readInstallEnvFile, renderInstallEnvFile, } from "./env-file.js";
+import { assessInstallDirectory, INSTALLATION_MARKER_RELATIVE, renderInstallationMarker, } from "./installation-state.js";
+import { resolveSetupImageRef } from "./acceptance-install.js";
+import { deriveComposeProjectName } from "./compose-project.js";
+import { generateSecretHex } from "./secrets.js";
+export async function materializeInstallation(input) {
+    const installDir = input.options.installDir;
+    const assessment = await assessInstallDirectory(installDir);
+    if (assessment.kind === "foreign") {
+        throw new MaterializeInstallError("foreign_directory", `Installation directory contains unrelated files: ${assessment.foreignEntries.join(", ")}`);
+    }
+    if (assessment.foreignEntries.length > 0) {
+        throw new MaterializeInstallError("foreign_directory", `Installation directory contains unrelated files: ${assessment.foreignEntries.join(", ")}`);
+    }
+    await mkdir(installDir, { recursive: true });
+    await mkdir(path.join(installDir, ".osva"), { recursive: true });
+    const envPath = path.join(installDir, ".env");
+    const composePath = path.join(installDir, "compose.yml");
+    const markerPath = path.join(installDir, INSTALLATION_MARKER_RELATIVE);
+    const existingEnv = await readInstallEnvFile(envPath);
+    const preservedSecrets = existingEnv !== undefined;
+    const composeProjectName = deriveComposeProjectName(installDir);
+    const envValues = buildInstallEnvValues({
+        imageRef: resolveSetupImageRef({
+            distributionImageRef: input.distribution.manifest.imageRef,
+            processEnv: input.processEnv,
+        }),
+        composeProjectName,
+        webPort: input.options.webPort,
+        mcpPort: input.options.mcpPort,
+        consolePort: input.options.consolePort,
+        existing: existingEnv,
+        generateSecret: () => generateSecretHex(32),
+    });
+    const conflicts = detectShellEnvConflicts(envValues, input.processEnv);
+    if (conflicts.length > 0) {
+        const keys = conflicts.map((conflict) => conflict.key).join(", ");
+        throw new MaterializeInstallError("env_conflict", `Host environment variables override installation secrets and differ from ${path.basename(envPath)}: ${keys}. Unset them or align values before retrying.`);
+    }
+    const wroteCompose = await writeComposeIfNeeded(composePath, input.distribution.composeYaml, assessment, input.options.authorizeExisting);
+    const wroteEnv = await writeEnvIfNeeded(envPath, envValues, existingEnv);
+    const marker = renderInstallationMarker({
+        platformVersion: input.distribution.manifest.platformVersion,
+        imageRef: envValues.OSVA_IMAGE,
+        cliVersion: CLI_VERSION,
+        installDir,
+        composeProjectName: envValues.COMPOSE_PROJECT_NAME,
+        existing: assessment.marker,
+    });
+    await writeFileAtomic(markerPath, `${JSON.stringify(marker, null, 2)}\n`, {
+        restrictPermissions: true,
+    });
+    return {
+        assessment,
+        envValues,
+        envPath,
+        composePath,
+        markerPath,
+        preservedSecrets,
+        wroteCompose,
+        wroteEnv,
+    };
+}
+async function writeComposeIfNeeded(composePath, composeYaml, assessment, authorizeExisting) {
+    const exists = await pathExists(composePath);
+    if (exists && assessment.kind === "osva_installation" && !authorizeExisting) {
+        return false;
+    }
+    await writeFileAtomic(composePath, composeYaml);
+    return true;
+}
+async function writeEnvIfNeeded(envPath, values, existing) {
+    const rendered = renderInstallEnvFile(values);
+    if (existing !== undefined) {
+        try {
+            const current = await readFile(envPath, "utf8");
+            if (current === rendered) {
+                return false;
+            }
+        }
+        catch {
+            // write below
+        }
+    }
+    await writeFileAtomic(envPath, rendered, { restrictPermissions: true });
+    return true;
+}
+async function pathExists(targetPath) {
+    try {
+        await stat(targetPath);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+export class MaterializeInstallError extends Error {
+    code;
+    constructor(code, message) {
+        super(message);
+        this.code = code;
+    }
+}
+//# sourceMappingURL=materialize-install.js.map

package/dist/setup/materialize-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"materialize-install.js","sourceRoot":"","sources":["../../src/setup/materialize-install.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,kBAAkB,CAAC;AACzD,OAAO,IAAI,MAAM,WAAW,CAAC;AAE7B,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EACL,qBAAqB,EACrB,uBAAuB,EACvB,kBAAkB,EAClB,oBAAoB,GAErB,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,sBAAsB,EACtB,4BAA4B,EAC5B,wBAAwB,GAEzB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,oBAAoB,EAAE,MAAM,yBAAyB,CAAC;AAC/D,OAAO,EAAE,wBAAwB,EAAE,MAAM,sBAAsB,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,MAAM,cAAc,CAAC;AAcjD,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAAC,KAI7C;IACC,MAAM,UAAU,GAAG,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC;IAC5C,MAAM,UAAU,GAAG,MAAM,sBAAsB,CAAC,UAAU,CAAC,CAAC;IAC5D,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAClC,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,oDAAoD,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IACD,IAAI,UAAU,CAAC,cAAc,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,IAAI,uBAAuB,CAC/B,mBAAmB,EACnB,oDAAoD,UAAU,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAC3F,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,OAAO,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,MAAM,CAAC,CAAC;IAC9C,MAAM,WAAW,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,aAAa,CAAC,CAAC;IACzD,MAAM,UAAU,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,EAAE,4BAA4B,CAAC,CAAC;IAEvE,MAAM,WAAW,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,gBAAgB,GAAG,WAAW,KAAK,SAAS,CAAC;IACnD,MAAM,kBAAkB,GAAG,wBAAwB,CAAC,UAAU,CAAC,CAAC;IAChE,MAAM,SAAS,GAAG,qBAAqB,CAAC;QACtC,QAAQ,EAAE,oBAAoB,CAAC;YAC7B,oBAAoB,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,QAAQ;YAC1D,UAAU,EAAE,KAAK,CAAC,UAAU;SAC7B,CAAC;QACF,kBAAkB;QAClB,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;QAC9B,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,OAAO;QAC9B,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,WAAW;QACtC,QAAQ,EAAE,WAAW;QACrB,cAAc,EAAE,GAAG,EAAE,CAAC,iBAAiB,CAAC,EAAE,CAAC;KAC5C,CAAC,CAAC;IAEH,MAAM,SAAS,GAAG,uBAAuB,CAAC,SAAS,EAAE,KAAK,CAAC,UAAU,CAAC,CAAC;IACvE,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,SAAS,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,IAAI,uBAAuB,CAC/B,cAAc,EACd,4EAA4E,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,IAAI,+CAA+C,CAC3J,CAAC;IACJ,CAAC;IAED,MAAM,YAAY,GAAG,MAAM,oBAAoB,CAC7C,WAAW,EACX,KAAK,CAAC,YAAY,CAAC,WAAW,EAC9B,UAAU,EACV,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAChC,CAAC;IACF,MAAM,QAAQ,GAAG,MAAM,gBAAgB,CAAC,OAAO,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC;IACzE,MAAM,MAAM,GAAG,wBAAwB,CAAC;QACtC,eAAe,EAAE,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,eAAe;QAC5D,QAAQ,EAAE,SAAS,CAAC,UAAU;QAC9B,UAAU,EAAE,WAAW;QACvB,UAAU;QACV,kBAAkB,EAAE,SAAS,CAAC,oBAAoB;QAClD,QAAQ,EAAE,UAAU,CAAC,MAAM;KAC5B,CAAC,CAAC;IACH,MAAM,eAAe,CAAC,UAAU,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE;QACxE,mBAAmB,EAAE,IAAI;KAC1B,CAAC,CAAC;IAEH,OAAO;QACL,UAAU;QACV,SAAS;QACT,OAAO;QACP,WAAW;QACX,UAAU;QACV,gBAAgB;QAChB,YAAY;QACZ,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,oBAAoB,CACjC,WAAmB,EACnB,WAAmB,EACnB,UAAsC,EACtC,iBAA0B;IAE1B,MAAM,MAAM,GAAG,MAAM,UAAU,CAAC,WAAW,CAAC,CAAC;IAC7C,IAAI,MAAM,IAAI,UAAU,CAAC,IAAI,KAAK,mBAAmB,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC5E,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,eAAe,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC;IAChD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,gBAAgB,CAC7B,OAAe,EACf,MAAwB,EACxB,QAAyC;IAEzC,MAAM,QAAQ,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAC;IAC9C,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC3B,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC;YAChD,IAAI,OAAO,KAAK,QAAQ,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC;YACf,CAAC;QACH,CAAC;QAAC,MAAM,CAAC;YACP,cAAc;QAChB,CAAC;IACH,CAAC;IACD,MAAM,eAAe,CAAC,OAAO,EAAE,QAAQ,EAAE,EAAE,mBAAmB,EAAE,IAAI,EAAE,CAAC,CAAC;IACxE,OAAO,IAAI,CAAC;AACd,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,UAAkB;IAC1C,IAAI,CAAC;QACH,MAAM,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,OAAO,uBAAwB,SAAQ,KAAK;IACvC,IAAI,CAAuC;IAEpD,YAAY,IAA0C,EAAE,OAAe;QACrE,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/setup/probe-spawn.d.ts

@@ -0,0 +1,16 @@
+export interface ProbeSpawnResult {
+    readonly status: number | null;
+    readonly stdout: string;
+    readonly stderr: string;
+    readonly error: NodeJS.ErrnoException | undefined;
+}
+export type ProbeSpawnFn = (executable: string, args: readonly string[], timeoutMs: number, processEnv?: NodeJS.ProcessEnv) => ProbeSpawnResult;
+/** Cap Docker probe output buffering (spawnSync default is 1 MiB). */
+export declare const PROBE_SPAWN_MAX_BUFFER_BYTES: number;
+export declare function defaultProbeSpawn(executable: string, args: readonly string[], timeoutMs: number, processEnv?: NodeJS.ProcessEnv): ProbeSpawnResult;
+/** Stream subprocess stdout/stderr with bounded chunk-safe secret redaction. */
+export declare function spawnStreamingCommand(executable: string, args: readonly string[], processEnv?: NodeJS.ProcessEnv): Promise<{
+    readonly exitCode: number | null;
+    readonly signal: NodeJS.Signals | null;
+}>;
+//# sourceMappingURL=probe-spawn.d.ts.map

package/dist/setup/probe-spawn.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-spawn.d.ts","sourceRoot":"","sources":["../../src/setup/probe-spawn.ts"],"names":[],"mappings":"AASA,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,cAAc,GAAG,SAAS,CAAC;CACnD;AAED,MAAM,MAAM,YAAY,GAAG,CACzB,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,MAAM,EACjB,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,KAC3B,gBAAgB,CAAC;AAEtB,sEAAsE;AACtE,eAAO,MAAM,4BAA4B,QAAa,CAAC;AAEvD,wBAAgB,iBAAiB,CAC/B,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,SAAS,EAAE,MAAM,EACjB,UAAU,GAAE,MAAM,CAAC,UAAwB,GAC1C,gBAAgB,CA0BlB;AAED,gFAAgF;AAChF,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,UAAU,GAAE,MAAM,CAAC,UAAwB,GAC1C,OAAO,CAAC;IACT,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC;CACxC,CAAC,CAyDD"}

package/dist/setup/probe-spawn.js

@@ -0,0 +1,87 @@
+import { spawn, spawnSync, } from "node:child_process";
+import { createStreamingSecretRedactor } from "../doctor/streaming-redact.js";
+/** Cap Docker probe output buffering (spawnSync default is 1 MiB). */
+export const PROBE_SPAWN_MAX_BUFFER_BYTES = 256 * 1024;
+export function defaultProbeSpawn(executable, args, timeoutMs, processEnv = process.env) {
+    let result;
+    try {
+        result = spawnSync(executable, [...args], {
+            encoding: "utf8",
+            stdio: "pipe",
+            shell: false,
+            timeout: timeoutMs,
+            maxBuffer: PROBE_SPAWN_MAX_BUFFER_BYTES,
+            env: processEnv,
+        });
+    }
+    catch (error) {
+        const errno = error;
+        return {
+            status: null,
+            stdout: "",
+            stderr: errno.message ?? String(error),
+            error: errno,
+        };
+    }
+    return {
+        status: result.status,
+        stdout: result.stdout ?? "",
+        stderr: result.stderr ?? "",
+        error: result.error,
+    };
+}
+/** Stream subprocess stdout/stderr with bounded chunk-safe secret redaction. */
+export function spawnStreamingCommand(executable, args, processEnv = process.env) {
+    return new Promise((resolve, reject) => {
+        let child;
+        try {
+            child = spawn(executable, [...args], {
+                stdio: ["ignore", "pipe", "pipe"],
+                shell: false,
+                env: processEnv,
+            });
+        }
+        catch (error) {
+            reject(error);
+            return;
+        }
+        const stdoutRedactor = createStreamingSecretRedactor((text) => {
+            process.stdout.write(text);
+        });
+        const stderrRedactor = createStreamingSecretRedactor((text) => {
+            process.stderr.write(text);
+        });
+        child.stdout?.on("data", (chunk) => {
+            stdoutRedactor.write(typeof chunk === "string" ? chunk : chunk.toString("utf8"));
+        });
+        child.stderr?.on("data", (chunk) => {
+            stderrRedactor.write(typeof chunk === "string" ? chunk : chunk.toString("utf8"));
+        });
+        const onInterrupt = () => {
+            if (child.killed) {
+                return;
+            }
+            if (process.platform === "win32") {
+                child.kill();
+            }
+            else {
+                child.kill("SIGTERM");
+            }
+        };
+        process.on("SIGINT", onInterrupt);
+        process.on("SIGTERM", onInterrupt);
+        child.on("error", (error) => {
+            process.off("SIGINT", onInterrupt);
+            process.off("SIGTERM", onInterrupt);
+            reject(error);
+        });
+        child.on("close", (exitCode, signal) => {
+            stdoutRedactor.flush();
+            stderrRedactor.flush();
+            process.off("SIGINT", onInterrupt);
+            process.off("SIGTERM", onInterrupt);
+            resolve({ exitCode, signal });
+        });
+    });
+}
+//# sourceMappingURL=probe-spawn.js.map

package/dist/setup/probe-spawn.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"probe-spawn.js","sourceRoot":"","sources":["../../src/setup/probe-spawn.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,KAAK,EACL,SAAS,GAGV,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,6BAA6B,EAAE,MAAM,+BAA+B,CAAC;AAgB9E,sEAAsE;AACtE,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,GAAG,IAAI,CAAC;AAEvD,MAAM,UAAU,iBAAiB,CAC/B,UAAkB,EAClB,IAAuB,EACvB,SAAiB,EACjB,aAAgC,OAAO,CAAC,GAAG;IAE3C,IAAI,MAAgC,CAAC;IACrC,IAAI,CAAC;QACH,MAAM,GAAG,SAAS,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;YACxC,QAAQ,EAAE,MAAM;YAChB,KAAK,EAAE,MAAM;YACb,KAAK,EAAE,KAAK;YACZ,OAAO,EAAE,SAAS;YAClB,SAAS,EAAE,4BAA4B;YACvC,GAAG,EAAE,UAAU;SAChB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,KAAK,GAAG,KAA8B,CAAC;QAC7C,OAAO;YACL,MAAM,EAAE,IAAI;YACZ,MAAM,EAAE,EAAE;YACV,MAAM,EAAE,KAAK,CAAC,OAAO,IAAI,MAAM,CAAC,KAAK,CAAC;YACtC,KAAK,EAAE,KAAK;SACb,CAAC;IACJ,CAAC;IACD,OAAO;QACL,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,MAAM,EAAE,MAAM,CAAC,MAAM,IAAI,EAAE;QAC3B,KAAK,EAAE,MAAM,CAAC,KAAK;KACpB,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CACnC,UAAkB,EAClB,IAAuB,EACvB,aAAgC,OAAO,CAAC,GAAG;IAK3C,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,KAAmB,CAAC;QACxB,IAAI,CAAC;YACH,KAAK,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,GAAG,IAAI,CAAC,EAAE;gBACnC,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;gBACjC,KAAK,EAAE,KAAK;gBACZ,GAAG,EAAE,UAAU;aAChB,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,MAAM,CAAC,KAAK,CAAC,CAAC;YACd,OAAO;QACT,CAAC;QAED,MAAM,cAAc,GAAG,6BAA6B,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,MAAM,cAAc,GAAG,6BAA6B,CAAC,CAAC,IAAI,EAAE,EAAE;YAC5D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAC7B,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAClD,cAAc,CAAC,KAAK,CAClB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,KAAsB,EAAE,EAAE;YAClD,cAAc,CAAC,KAAK,CAClB,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAC3D,CAAC;QACJ,CAAC,CAAC,CAAC;QAEH,MAAM,WAAW,GAAG,GAAS,EAAE;YAC7B,IAAI,KAAK,CAAC,MAAM,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,IAAI,OAAO,CAAC,QAAQ,KAAK,OAAO,EAAE,CAAC;gBACjC,KAAK,CAAC,IAAI,EAAE,CAAC;YACf,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC;YACxB,CAAC;QACH,CAAC,CAAC;QACF,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;QAClC,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;QAEnC,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,KAAK,EAAE,EAAE;YAC1B,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACpC,MAAM,CAAC,KAAK,CAAC,CAAC;QAChB,CAAC,CAAC,CAAC;QACH,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE;YACrC,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,cAAc,CAAC,KAAK,EAAE,CAAC;YACvB,OAAO,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,CAAC;YACnC,OAAO,CAAC,GAAG,CAAC,SAAS,EAAE,WAAW,CAAC,CAAC;YACpC,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/setup/read-options.d.ts

@@ -0,0 +1,15 @@
+export interface SetupOptions {
+    readonly webPort: number;
+    readonly mcpPort: number;
+    readonly consolePort: number;
+    readonly installDir: string;
+    readonly preflightOnly: boolean;
+    readonly authorizeExisting: boolean;
+    readonly adminEmail: string;
+    readonly adminName: string;
+    readonly organizationName: string;
+    readonly workspaceName: string;
+}
+export declare function readSetupOptions(flags: Readonly<Record<string, string | boolean>>, env?: NodeJS.ProcessEnv, platform?: NodeJS.Platform): SetupOptions;
+export declare function parsePortNumber(raw: string, flagName: string): number;
+//# sourceMappingURL=read-options.d.ts.map

package/dist/setup/read-options.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-options.d.ts","sourceRoot":"","sources":["../../src/setup/read-options.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,YAAY;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,gBAAgB,EAAE,MAAM,CAAC;IAClC,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;CAChC;AAED,wBAAgB,gBAAgB,CAC9B,KAAK,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC,EACjD,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,QAAQ,GAAE,MAAM,CAAC,QAA2B,GAC3C,YAAY,CAgEd;AAkCD,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,GAAG,MAAM,CAarE"}

package/dist/setup/read-options.js

@@ -0,0 +1,69 @@
+import { resolveInstallDir } from "./install-path.js";
+export function readSetupOptions(flags, env = process.env, platform = process.platform) {
+    const webPort = parsePortFlag(flags["web-port"], env.OSVA_PUBLISH_WEB_PORT, 8080, "web-port");
+    const mcpPort = parsePortFlag(flags["mcp-port"], env.OSVA_PUBLISH_MCP_PORT, 3100, "mcp-port");
+    const consolePort = parsePortFlag(flags["console-port"], env.OSVA_PUBLISH_CONSOLE_PORT, 4174, "console-port");
+    const publishPorts = [
+        { port: webPort, label: "web" },
+        { port: mcpPort, label: "mcp" },
+        { port: consolePort, label: "console" },
+    ];
+    for (let left = 0; left < publishPorts.length; left += 1) {
+        for (let right = left + 1; right < publishPorts.length; right += 1) {
+            const a = publishPorts[left];
+            const b = publishPorts[right];
+            if (a !== undefined && b !== undefined && a.port === b.port) {
+                throw new Error(`Publish ports must be distinct (${a.label} and ${b.label} both use ${String(a.port)}).`);
+            }
+        }
+    }
+    const adminEmail = readOptionalStringFlag(flags["admin-email"], env.OSVA_SETUP_ADMIN_EMAIL);
+    const adminName = readOptionalStringFlag(flags["admin-name"], env.OSVA_SETUP_ADMIN_NAME) ??
+        "Initial Owner";
+    const organizationName = readOptionalStringFlag(flags["organization-name"], env.OSVA_SETUP_ORGANIZATION_NAME) ?? "Default Organization";
+    const workspaceName = readOptionalStringFlag(flags["workspace-name"], env.OSVA_BOOTSTRAP_WORKSPACE_NAME) ?? "Default Workspace";
+    return {
+        webPort,
+        mcpPort,
+        consolePort,
+        installDir: resolveInstallDir(flags, env, platform),
+        preflightOnly: flags["preflight-only"] === true,
+        authorizeExisting: flags.yes === true,
+        adminEmail: adminEmail ?? "",
+        adminName,
+        organizationName,
+        workspaceName,
+    };
+}
+function readOptionalStringFlag(flagValue, envValue) {
+    if (typeof flagValue === "string" && flagValue.trim().length > 0) {
+        return flagValue.trim();
+    }
+    const trimmedEnv = envValue?.trim();
+    return trimmedEnv === undefined || trimmedEnv.length === 0
+        ? undefined
+        : trimmedEnv;
+}
+function parsePortFlag(flagValue, envValue, fallback, flagName) {
+    if (typeof flagValue === "boolean") {
+        throw new Error(`--${flagName} requires a port number.`);
+    }
+    const raw = typeof flagValue === "string" && flagValue.trim().length > 0
+        ? flagValue.trim()
+        : envValue?.trim();
+    if (raw === undefined || raw.length === 0) {
+        return fallback;
+    }
+    return parsePortNumber(raw, flagName);
+}
+export function parsePortNumber(raw, flagName) {
+    if (!/^\d+$/.test(raw)) {
+        throw new Error(`Invalid --${flagName} or OSVA_PUBLISH_* value '${raw}'; use an integer from 1 to 65535.`);
+    }
+    const port = Number(raw);
+    if (!Number.isInteger(port) || port < 1 || port > 65_535) {
+        throw new Error(`Invalid --${flagName} or OSVA_PUBLISH_* value '${raw}'; use an integer from 1 to 65535.`);
+    }
+    return port;
+}
+//# sourceMappingURL=read-options.js.map

package/dist/setup/read-options.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"read-options.js","sourceRoot":"","sources":["../../src/setup/read-options.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAetD,MAAM,UAAU,gBAAgB,CAC9B,KAAiD,EACjD,MAAyB,OAAO,CAAC,GAAG,EACpC,WAA4B,OAAO,CAAC,QAAQ;IAE5C,MAAM,OAAO,GAAG,aAAa,CAC3B,KAAK,CAAC,UAAU,CAAC,EACjB,GAAG,CAAC,qBAAqB,EACzB,IAAI,EACJ,UAAU,CACX,CAAC;IACF,MAAM,OAAO,GAAG,aAAa,CAC3B,KAAK,CAAC,UAAU,CAAC,EACjB,GAAG,CAAC,qBAAqB,EACzB,IAAI,EACJ,UAAU,CACX,CAAC;IACF,MAAM,WAAW,GAAG,aAAa,CAC/B,KAAK,CAAC,cAAc,CAAC,EACrB,GAAG,CAAC,yBAAyB,EAC7B,IAAI,EACJ,cAAc,CACf,CAAC;IACF,MAAM,YAAY,GAAG;QACnB,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;QAC/B,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE;QAC/B,EAAE,IAAI,EAAE,WAAW,EAAE,KAAK,EAAE,SAAS,EAAE;KACxC,CAAC;IACF,KAAK,IAAI,IAAI,GAAG,CAAC,EAAE,IAAI,GAAG,YAAY,CAAC,MAAM,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QACzD,KAAK,IAAI,KAAK,GAAG,IAAI,GAAG,CAAC,EAAE,KAAK,GAAG,YAAY,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC;YACnE,MAAM,CAAC,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;YAC7B,MAAM,CAAC,GAAG,YAAY,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,KAAK,SAAS,IAAI,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;gBAC5D,MAAM,IAAI,KAAK,CACb,mCAAmC,CAAC,CAAC,KAAK,QAAQ,CAAC,CAAC,KAAK,aAAa,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CACzF,CAAC;YACJ,CAAC;QACH,CAAC;IACH,CAAC;IACD,MAAM,UAAU,GAAG,sBAAsB,CACvC,KAAK,CAAC,aAAa,CAAC,EACpB,GAAG,CAAC,sBAAsB,CAC3B,CAAC;IACF,MAAM,SAAS,GACb,sBAAsB,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,GAAG,CAAC,qBAAqB,CAAC;QACtE,eAAe,CAAC;IAClB,MAAM,gBAAgB,GACpB,sBAAsB,CACpB,KAAK,CAAC,mBAAmB,CAAC,EAC1B,GAAG,CAAC,4BAA4B,CACjC,IAAI,sBAAsB,CAAC;IAC9B,MAAM,aAAa,GACjB,sBAAsB,CACpB,KAAK,CAAC,gBAAgB,CAAC,EACvB,GAAG,CAAC,6BAA6B,CAClC,IAAI,mBAAmB,CAAC;IAC3B,OAAO;QACL,OAAO;QACP,OAAO;QACP,WAAW;QACX,UAAU,EAAE,iBAAiB,CAAC,KAAK,EAAE,GAAG,EAAE,QAAQ,CAAC;QACnD,aAAa,EAAE,KAAK,CAAC,gBAAgB,CAAC,KAAK,IAAI;QAC/C,iBAAiB,EAAE,KAAK,CAAC,GAAG,KAAK,IAAI;QACrC,UAAU,EAAE,UAAU,IAAI,EAAE;QAC5B,SAAS;QACT,gBAAgB;QAChB,aAAa;KACd,CAAC;AACJ,CAAC;AAED,SAAS,sBAAsB,CAC7B,SAAuC,EACvC,QAA4B;IAE5B,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,OAAO,SAAS,CAAC,IAAI,EAAE,CAAC;IAC1B,CAAC;IACD,MAAM,UAAU,GAAG,QAAQ,EAAE,IAAI,EAAE,CAAC;IACpC,OAAO,UAAU,KAAK,SAAS,IAAI,UAAU,CAAC,MAAM,KAAK,CAAC;QACxD,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,UAAU,CAAC;AACjB,CAAC;AAED,SAAS,aAAa,CACpB,SAAuC,EACvC,QAA4B,EAC5B,QAAgB,EAChB,QAAgB;IAEhB,IAAI,OAAO,SAAS,KAAK,SAAS,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,KAAK,QAAQ,0BAA0B,CAAC,CAAC;IAC3D,CAAC;IACD,MAAM,GAAG,GACP,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAC1D,CAAC,CAAC,SAAS,CAAC,IAAI,EAAE;QAClB,CAAC,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC;IACvB,IAAI,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC1C,OAAO,QAAQ,CAAC;IAClB,CAAC;IACD,OAAO,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;AACxC,CAAC;AAED,MAAM,UAAU,eAAe,CAAC,GAAW,EAAE,QAAgB;IAC3D,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,6BAA6B,GAAG,oCAAoC,CAC1F,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;IACzB,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,IAAI,GAAG,CAAC,IAAI,IAAI,GAAG,MAAM,EAAE,CAAC;QACzD,MAAM,IAAI,KAAK,CACb,aAAa,QAAQ,6BAA6B,GAAG,oCAAoC,CAC1F,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/dist/setup/run-onboarding.d.ts

@@ -0,0 +1,22 @@
+import type { DoctorCheck } from "../doctor/types.js";
+import { type ComposeExecContext } from "./compose-exec.js";
+import { type AdministratorBootstrapPhase } from "./installation-status.js";
+import type { ProbeSpawnFn } from "./probe-spawn.js";
+import type { SetupOptions } from "./read-options.js";
+export declare const COMPOSE_ONBOARDING_TIMEOUT_MS = 300000;
+export interface OnboardingResult {
+    readonly checks: readonly DoctorCheck[];
+    readonly consoleUrl: string;
+    /** One-time password setup token for interactive display only (never persisted). */
+    readonly setupTokenForOperator?: string;
+    readonly administratorPhase: AdministratorBootstrapPhase | undefined;
+}
+export declare function runSetupOnboarding(input: {
+    readonly options: SetupOptions;
+    readonly execCtx: ComposeExecContext;
+    readonly spawn: ProbeSpawnFn | undefined;
+    readonly fetch: typeof fetch;
+    readonly mutateInstallation: boolean;
+    readonly processEnv?: NodeJS.ProcessEnv;
+}): Promise<OnboardingResult>;
+//# sourceMappingURL=run-onboarding.d.ts.map

package/dist/setup/run-onboarding.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"run-onboarding.d.ts","sourceRoot":"","sources":["../../src/setup/run-onboarding.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AAOtD,OAAO,EAKL,KAAK,kBAAkB,EACxB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAGL,KAAK,2BAA2B,EAEjC,MAAM,0BAA0B,CAAC;AAClC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAKrD,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,eAAO,MAAM,6BAA6B,SAAU,CAAC;AAErD,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,SAAS,WAAW,EAAE,CAAC;IACxC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,oFAAoF;IACpF,QAAQ,CAAC,qBAAqB,CAAC,EAAE,MAAM,CAAC;IACxC,QAAQ,CAAC,kBAAkB,EAAE,2BAA2B,GAAG,SAAS,CAAC;CACtE;AAED,wBAAsB,kBAAkB,CAAC,KAAK,EAAE;IAC9C,QAAQ,CAAC,OAAO,EAAE,YAAY,CAAC;IAC/B,QAAQ,CAAC,OAAO,EAAE,kBAAkB,CAAC;IACrC,QAAQ,CAAC,KAAK,EAAE,YAAY,GAAG,SAAS,CAAC;IACzC,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC;IAC7B,QAAQ,CAAC,kBAAkB,EAAE,OAAO,CAAC;IACrC,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC,UAAU,CAAC;CACzC,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAgQ5B"}