@pithy-sh/core 0.8.0 → 0.10.0

package/dist/cli/commandFacts.d.ts

@@ -0,0 +1,164 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+/**
+ * **What the catalog cannot say about a `pithy` command, written down once (#711).**
+ *
+ * `commandCatalog.generated.ts` is the parser's own account of every command: its arguments, its flags, which
+ * are required, which have defaults, which go together. Four facts are not in any parser, and each was the
+ * fault behind a line that did not run as written:
+ *
+ * - **Which commands act on one Worker**, and are refused `input/required` without `--worker` where a project
+ *   has several. `packages/cli/src/ci/runnableCommands.test.ts` proves every entry by running it in a
+ *   two-Worker project, and fails on a command that takes `--worker` and is not classified here.
+ * - **Which flag's default changes what the command acts on.** `pithy vector provision` with no `--env`
+ *   provisions `dev`, so a line about staging that leaves it off sends the reader to the wrong environment.
+ * - **Which commands destroy something**, and are never a remedy for a smaller fault. `pithy feature destroy`
+ *   was offered as the fix for one mis-shaped vector index.
+ * - **Which flag needs another beside it** that the parser does not enforce: `pithy provision --env` is refused
+ *   without `--yes`, at run time.
+ *
+ * `command.ts` builds every command a line names from these and the catalog, and refuses one that breaks them.
+ * Nothing here imports anything, so a Worker that names a command pays for two tables and nothing more.
+ */
+/**
+ * The commands that act on exactly one Worker, and refuse `input/required` without `--worker` when a project
+ * has several and the run cannot ask. Every line that names one names the Worker, by its `apps/` directory.
+ */
+export declare const WORKER_SCOPED: readonly ["add", "dashboard connect", "email provision", "media provision", "payments provision", "storage provision", "support provision", "testers provision", "turnstile deprovision", "turnstile provision", "ui add", "ui sync", "vector provision", "vector reprocess", "vector reset", "worker sync"];
+/** A command that acts on one Worker. */
+export type WorkerScopedPath = (typeof WORKER_SCOPED)[number];
+/**
+ * The commands that take `--worker` and do not need it: each fans out over every Worker, or falls back to the
+ * first that answers, and the flag narrows.
+ */
+export declare const WORKER_NARROWS: readonly ["contract", "dashboard disconnect", "dashboard revoke-key", "dashboard rotate", "dashboard status", "doctor", "env", "init", "migrate", "seed", "support deprovision", "upgrade"];
+/**
+ * A command only a person runs, at a terminal, where the Worker is asked for. `pithy remove` refuses every run
+ * that cannot ask (`core/person_required`).
+ */
+export declare const PERSON_ONLY: readonly ["remove"];
+/** A flag that turns a Worker-scoped command into one that acts on no Worker: `pithy add --list` reads the catalog. */
+export declare const NO_WORKER_MODES: Readonly<Record<string, readonly string[]>>;
+/**
+ * **A flag whose default decides what the command acts on.** Left off a line, the command still runs — on the
+ * default, which is rarely the environment the line was about. Every `--env` with a default is one: `dev` for
+ * `vector provision`, `migrate` and `testers list`, `staging` for `payments reconcile`. A line names it, always.
+ */
+export declare const MEANING_FLAGS: readonly ["--env"];
+/**
+ * The commands whose `--env` decides nothing until another flag asks it to: `pithy remove` touches no database
+ * without `--drop`, and `pithy upgrade` migrates none without `--migrate`. Without that flag a line need not
+ * name the environment; with it, it must.
+ */
+export declare const MEANING_ONLY_WITH: {
+    readonly remove: "--drop";
+    readonly upgrade: "--migrate";
+};
+/**
+ * **The commands that destroy something, by what they destroy.** None is ever built as a remedy: a line that
+ * names one says it is a person's decision and what it deletes (`command.ts`'s `personDecision`), and carries
+ * no `fix`. `packages/core/src/cli/command.test.ts` holds every command the catalog has to this list or to
+ * {@link NOT_DESTRUCTIVE}, so a new one cannot arrive unexamined.
+ */
+export declare const DESTRUCTIVE_COMMANDS: {
+    readonly "dashboard disconnect": "the environment's dashboard connection and the key it signs with";
+    readonly "dashboard revoke-key": "a signing key the dashboard holds";
+    readonly "email deprovision": "the email Workers, and with --suppression the suppression database";
+    readonly "feature destroy": "the feature's worktree, its branch and every resource it provisioned";
+    readonly "media deprovision": "the media Worker, and with --storage its bucket";
+    readonly remove: "a capability's wiring";
+    readonly "secrets deprovision": "the secrets manager, and with --keys the store's keys";
+    readonly "secrets rm": "a stored secret";
+    readonly "storage deprovision": "the storage Worker, and with --storage its bucket";
+    readonly "support deprovision": "the support Workers, and with --storage its attachments";
+    readonly "testers deprovision": "the testers Worker";
+    readonly "token revoke": "an API token";
+    readonly "turnstile deprovision": "the Turnstile widget, whose sitekey every client embeds";
+    readonly "vector reset": "every vector in the index";
+    readonly "worker remove": "a Worker's directory";
+};
+/** A command that destroys something. */
+export type DestructivePath = keyof typeof DESTRUCTIVE_COMMANDS;
+/**
+ * **The flags that make a command destroy something**, on any command that declares them. Each is refused by
+ * the builder; a line that needs one is a person's decision.
+ */
+export declare const DESTRUCTIVE_FLAGS: {
+    readonly "--destroy-retained": "a resource kept for recovery";
+    readonly "--drop": "a capability's tables";
+    readonly "--redo": "the data a seed wrote";
+    readonly "--rollback": "the schema a migration group applied";
+};
+/** A flag that makes a command destroy something. */
+export type DestructiveFlag = keyof typeof DESTRUCTIVE_FLAGS;
+/**
+ * The commands whose name reads as destructive and which are not, and why. A command named here is built like
+ * any other.
+ */
+export declare const NOT_DESTRUCTIVE: Readonly<Record<string, string>>;
+/**
+ * **A flag whose value is a person's confirmation**, never written into a line an agent reads: a phrase spelled
+ * in a remedy is a confirmation nobody gave. A person's decision names the flag and leaves the phrase to them.
+ */
+export declare const CONFIRM_FLAGS: readonly ["--confirm", "--confirm-production", "--confirm-reset", "--confirm-rollback"];
+/**
+ * When a command asks for a confirmation: always, when a flag is passed (`when`), or in every environment but the
+ * ones it trusts (`unlessEnv`) — `vector reset` asks nothing of `dev`, whose index is a laptop's.
+ */
+export declare const CONFIRMATIONS: readonly {
+    path: string;
+    when?: string;
+    unlessEnv?: readonly string[];
+    flag: string;
+}[];
+/**
+ * **A flag whose value is a credential**, never written into a line: an error's action reaches logs, a terminal
+ * scrollback and a `--json` consumer, none of which should hold a key. A run named again carries the flag's name
+ * and leaves its value to whoever passed it.
+ */
+export declare const CREDENTIAL_FLAGS: readonly ["--api-token", "--r2-access-key-id", "--r2-api-token", "--r2-secret-access-key"];
+/**
+ * The environments every project treats as production. A project can name more in `seed.productionEnvironments`;
+ * a builder that has them passes them.
+ */
+export declare const PRODUCTION_ENVIRONMENTS: readonly ["prod", "production"];
+/**
+ * **What a production run of a command needs from a person**, by command: the confirmation it asks for, or `null`
+ * for one that asks none. A production provision or seed is never a remedy — a line names it as a person's
+ * decision either way, and names a confirmation only when the command declares it: `testers provision` and
+ * `vector provision` take no `--confirm`, and a line that told a person to pass one would be refused.
+ */
+export declare const PRODUCTION_CONFIRMS: {
+    readonly provision: "--confirm";
+    readonly seed: "--confirm-production";
+    readonly "secrets provision": null;
+    readonly "testers provision": null;
+    readonly "vector provision": null;
+};
+/** A command whose production run is a person's decision. */
+export type ProductionPath = keyof typeof PRODUCTION_CONFIRMS;
+/**
+ * **A command that acts on every environment when its `--env` is left off (#711)**, production among them. `pithy
+ * testers provision` with no `--env` provisions every declared environment, so the bare line touches production as
+ * surely as `--env prod` does, and is a person's decision for the same reason. Each declares `--env` with no
+ * default; `command.test.ts` holds that against the catalog.
+ */
+export declare const EVERY_ENVIRONMENT_WITHOUT_ENV: readonly ["testers provision"];
+/**
+ * **A command that acts on every environment on every run (#711)**, production among them, with no `--env` to narrow
+ * it. `pithy secrets provision` deploys each declared environment's manager and mints its store entries, so every line
+ * naming it touches production and is a person's decision — never the fix for one binding, one database or one
+ * setting. None declares `--env`; `command.test.ts` holds that against the catalog.
+ */
+export declare const EVERY_ENVIRONMENT_ALWAYS: readonly ["secrets provision"];
+/**
+ * A flag a command refuses to run without, beside another, that the parser does not enforce. `pithy provision
+ * --env <env>` with no `--yes` is refused before it does anything; a dry run needs neither.
+ */
+export declare const REQUIRED_BESIDE: readonly {
+    path: string;
+    with: string;
+    needs: string;
+    unless: string;
+}[];
+//# sourceMappingURL=commandFacts.d.ts.map

package/dist/cli/commandFacts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"commandFacts.d.ts","sourceRoot":"","sources":["../../src/cli/commandFacts.ts"],"names":[],"mappings":"AAGA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH;;;GAGG;AACH,eAAO,MAAM,aAAa,YACxB,KAAK,EACL,mBAAmB,EACnB,iBAAiB,EACjB,iBAAiB,EACjB,oBAAoB,EACpB,mBAAmB,EACnB,mBAAmB,EACnB,mBAAmB,EACnB,uBAAuB,EACvB,qBAAqB,EACrB,QAAQ,EACR,SAAS,EACT,kBAAkB,EAClB,kBAAkB,EAClB,cAAc,EACd,aAAa,CACL,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,gBAAgB,GAAG,CAAC,OAAO,aAAa,CAAC,CAAC,MAAM,CAAC,CAAC;AAE9D;;;GAGG;AACH,eAAO,MAAM,cAAc,YACzB,UAAU,EACV,sBAAsB,EACtB,sBAAsB,EACtB,kBAAkB,EAClB,kBAAkB,EAClB,QAAQ,EACR,KAAK,EACL,MAAM,EACN,SAAS,EACT,MAAM,EACN,qBAAqB,EACrB,SAAS,CACD,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,WAAW,YAAI,QAAQ,CAAU,CAAC;AAE/C,uHAAuH;AACvH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC,CAAuB,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,aAAa,YAAI,OAAO,CAAU,CAAC;AAEhD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB;aAAK,MAAM,EAAE,QAAQ;aAAE,OAAO,EAAE,WAAW;CAAW,CAAC;AAErF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;aAC/B,sBAAsB,EAAE,kEAAkE;aAC1F,sBAAsB,EAAE,mCAAmC;aAC3D,mBAAmB,EAAE,oEAAoE;aACzF,iBAAiB,EAAE,sEAAsE;aACzF,mBAAmB,EAAE,iDAAiD;aACtE,MAAM,EAAE,uBAAuB;aAC/B,qBAAqB,EAAE,uDAAuD;aAC9E,YAAY,EAAE,iBAAiB;aAC/B,qBAAqB,EAAE,mDAAmD;aAC1E,qBAAqB,EAAE,yDAAyD;aAChF,qBAAqB,EAAE,oBAAoB;aAC3C,cAAc,EAAE,cAAc;aAC9B,uBAAuB,EAAE,yDAAyD;aAClF,cAAc,EAAE,2BAA2B;aAC3C,eAAe,EAAE,sBAAsB;CAC/B,CAAC;AAEX,yCAAyC;AACzC,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,oBAAoB,CAAC;AAEhE;;;GAGG;AACH,eAAO,MAAM,iBAAiB;aAC5B,oBAAoB,EAAE,8BAA8B;aACpD,QAAQ,EAAE,uBAAuB;aACjC,QAAQ,EAAE,uBAAuB;aACjC,YAAY,EAAE,sCAAsC;CAC5C,CAAC;AAEX,qDAAqD;AACrD,MAAM,MAAM,eAAe,GAAG,MAAM,OAAO,iBAAiB,CAAC;AAE7D;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAM5D,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,aAAa,YAAI,WAAW,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,oBAAoB,CAAU,CAAC;AAErH;;;GAGG;AACH,eAAO,MAAM,aAAa,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,EAIhH,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,YAC3B,aAAa,EACb,oBAAoB,EACpB,gBAAgB,EAChB,wBAAwB,CAChB,CAAC;AAEX;;;GAGG;AACH,eAAO,MAAM,uBAAuB,YAAI,MAAM,EAAE,YAAY,CAAU,CAAC;AAEvE;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB;wBACnB,WAAW;mBAChB,sBAAsB;;;;CAI8B,CAAC;AAE7D,6DAA6D;AAC7D,MAAM,MAAM,cAAc,GAAG,MAAM,OAAO,mBAAmB,CAAC;AAE9D;;;;;GAKG;AACH,eAAO,MAAM,6BAA6B,gCAAqE,CAAC;AAEhH;;;;;GAKG;AACH,eAAO,MAAM,wBAAwB,gCAAqE,CAAC;AAE3G;;;GAGG;AACH,eAAO,MAAM,eAAe,EAAE,SAAS;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,EAEnG,CAAC"}

package/dist/cli/commandFacts.js

@@ -0,0 +1,215 @@
+// SPDX-FileCopyrightText: 2026 Pithy
+// SPDX-License-Identifier: MIT
+//#region src/cli/commandFacts.ts
+/**
+* **What the catalog cannot say about a `pithy` command, written down once (#711).**
+*
+* `commandCatalog.generated.ts` is the parser's own account of every command: its arguments, its flags, which
+* are required, which have defaults, which go together. Four facts are not in any parser, and each was the
+* fault behind a line that did not run as written:
+*
+* - **Which commands act on one Worker**, and are refused `input/required` without `--worker` where a project
+*   has several. `packages/cli/src/ci/runnableCommands.test.ts` proves every entry by running it in a
+*   two-Worker project, and fails on a command that takes `--worker` and is not classified here.
+* - **Which flag's default changes what the command acts on.** `pithy vector provision` with no `--env`
+*   provisions `dev`, so a line about staging that leaves it off sends the reader to the wrong environment.
+* - **Which commands destroy something**, and are never a remedy for a smaller fault. `pithy feature destroy`
+*   was offered as the fix for one mis-shaped vector index.
+* - **Which flag needs another beside it** that the parser does not enforce: `pithy provision --env` is refused
+*   without `--yes`, at run time.
+*
+* `command.ts` builds every command a line names from these and the catalog, and refuses one that breaks them.
+* Nothing here imports anything, so a Worker that names a command pays for two tables and nothing more.
+*/
+/**
+* The commands that act on exactly one Worker, and refuse `input/required` without `--worker` when a project
+* has several and the run cannot ask. Every line that names one names the Worker, by its `apps/` directory.
+*/
+const WORKER_SCOPED = [
+	"add",
+	"dashboard connect",
+	"email provision",
+	"media provision",
+	"payments provision",
+	"storage provision",
+	"support provision",
+	"testers provision",
+	"turnstile deprovision",
+	"turnstile provision",
+	"ui add",
+	"ui sync",
+	"vector provision",
+	"vector reprocess",
+	"vector reset",
+	"worker sync"
+];
+/**
+* The commands that take `--worker` and do not need it: each fans out over every Worker, or falls back to the
+* first that answers, and the flag narrows.
+*/
+const WORKER_NARROWS = [
+	"contract",
+	"dashboard disconnect",
+	"dashboard revoke-key",
+	"dashboard rotate",
+	"dashboard status",
+	"doctor",
+	"env",
+	"init",
+	"migrate",
+	"seed",
+	"support deprovision",
+	"upgrade"
+];
+/**
+* A command only a person runs, at a terminal, where the Worker is asked for. `pithy remove` refuses every run
+* that cannot ask (`core/person_required`).
+*/
+const PERSON_ONLY = ["remove"];
+/** A flag that turns a Worker-scoped command into one that acts on no Worker: `pithy add --list` reads the catalog. */
+const NO_WORKER_MODES = { add: ["--list"] };
+/**
+* **A flag whose default decides what the command acts on.** Left off a line, the command still runs — on the
+* default, which is rarely the environment the line was about. Every `--env` with a default is one: `dev` for
+* `vector provision`, `migrate` and `testers list`, `staging` for `payments reconcile`. A line names it, always.
+*/
+const MEANING_FLAGS = ["--env"];
+/**
+* The commands whose `--env` decides nothing until another flag asks it to: `pithy remove` touches no database
+* without `--drop`, and `pithy upgrade` migrates none without `--migrate`. Without that flag a line need not
+* name the environment; with it, it must.
+*/
+const MEANING_ONLY_WITH = {
+	remove: "--drop",
+	upgrade: "--migrate"
+};
+/**
+* **The commands that destroy something, by what they destroy.** None is ever built as a remedy: a line that
+* names one says it is a person's decision and what it deletes (`command.ts`'s `personDecision`), and carries
+* no `fix`. `packages/core/src/cli/command.test.ts` holds every command the catalog has to this list or to
+* {@link NOT_DESTRUCTIVE}, so a new one cannot arrive unexamined.
+*/
+const DESTRUCTIVE_COMMANDS = {
+	"dashboard disconnect": "the environment's dashboard connection and the key it signs with",
+	"dashboard revoke-key": "a signing key the dashboard holds",
+	"email deprovision": "the email Workers, and with --suppression the suppression database",
+	"feature destroy": "the feature's worktree, its branch and every resource it provisioned",
+	"media deprovision": "the media Worker, and with --storage its bucket",
+	remove: "a capability's wiring",
+	"secrets deprovision": "the secrets manager, and with --keys the store's keys",
+	"secrets rm": "a stored secret",
+	"storage deprovision": "the storage Worker, and with --storage its bucket",
+	"support deprovision": "the support Workers, and with --storage its attachments",
+	"testers deprovision": "the testers Worker",
+	"token revoke": "an API token",
+	"turnstile deprovision": "the Turnstile widget, whose sitekey every client embeds",
+	"vector reset": "every vector in the index",
+	"worker remove": "a Worker's directory"
+};
+/**
+* **The flags that make a command destroy something**, on any command that declares them. Each is refused by
+* the builder; a line that needs one is a person's decision.
+*/
+const DESTRUCTIVE_FLAGS = {
+	"--destroy-retained": "a resource kept for recovery",
+	"--drop": "a capability's tables",
+	"--redo": "the data a seed wrote",
+	"--rollback": "the schema a migration group applied"
+};
+/**
+* The commands whose name reads as destructive and which are not, and why. A command named here is built like
+* any other.
+*/
+const NOT_DESTRUCTIVE = {
+	"cloudflare disconnect": "revokes a sign-in and deletes no data, which `cloudflare connect` gives back",
+	"docs disconnect": "removes the docs server from an editor's config, which `docs connect` restores",
+	"feature prune": "forgets worktrees that are already gone",
+	"testers close": "stops a cohort accruing, and keeps its history",
+	"testers remove": "takes one tester off a roster, which `testers invite` reverses"
+};
+/**
+* **A flag whose value is a person's confirmation**, never written into a line an agent reads: a phrase spelled
+* in a remedy is a confirmation nobody gave. A person's decision names the flag and leaves the phrase to them.
+*/
+const CONFIRM_FLAGS = [
+	"--confirm",
+	"--confirm-production",
+	"--confirm-reset",
+	"--confirm-rollback"
+];
+/**
+* When a command asks for a confirmation: always, when a flag is passed (`when`), or in every environment but the
+* ones it trusts (`unlessEnv`) — `vector reset` asks nothing of `dev`, whose index is a laptop's.
+*/
+const CONFIRMATIONS = [
+	{
+		path: "vector reset",
+		unlessEnv: ["dev"],
+		flag: "--confirm-reset"
+	},
+	{
+		path: "migrate",
+		when: "--rollback",
+		flag: "--confirm-rollback"
+	},
+	{
+		path: "seed",
+		when: "--redo",
+		flag: "--confirm-reset"
+	}
+];
+/**
+* **A flag whose value is a credential**, never written into a line: an error's action reaches logs, a terminal
+* scrollback and a `--json` consumer, none of which should hold a key. A run named again carries the flag's name
+* and leaves its value to whoever passed it.
+*/
+const CREDENTIAL_FLAGS = [
+	"--api-token",
+	"--r2-access-key-id",
+	"--r2-api-token",
+	"--r2-secret-access-key"
+];
+/**
+* The environments every project treats as production. A project can name more in `seed.productionEnvironments`;
+* a builder that has them passes them.
+*/
+const PRODUCTION_ENVIRONMENTS = ["prod", "production"];
+/**
+* **What a production run of a command needs from a person**, by command: the confirmation it asks for, or `null`
+* for one that asks none. A production provision or seed is never a remedy — a line names it as a person's
+* decision either way, and names a confirmation only when the command declares it: `testers provision` and
+* `vector provision` take no `--confirm`, and a line that told a person to pass one would be refused.
+*/
+const PRODUCTION_CONFIRMS = {
+	provision: "--confirm",
+	seed: "--confirm-production",
+	"secrets provision": null,
+	"testers provision": null,
+	"vector provision": null
+};
+/**
+* **A command that acts on every environment when its `--env` is left off (#711)**, production among them. `pithy
+* testers provision` with no `--env` provisions every declared environment, so the bare line touches production as
+* surely as `--env prod` does, and is a person's decision for the same reason. Each declares `--env` with no
+* default; `command.test.ts` holds that against the catalog.
+*/
+const EVERY_ENVIRONMENT_WITHOUT_ENV = ["testers provision"];
+/**
+* **A command that acts on every environment on every run (#711)**, production among them, with no `--env` to narrow
+* it. `pithy secrets provision` deploys each declared environment's manager and mints its store entries, so every line
+* naming it touches production and is a person's decision — never the fix for one binding, one database or one
+* setting. None declares `--env`; `command.test.ts` holds that against the catalog.
+*/
+const EVERY_ENVIRONMENT_ALWAYS = ["secrets provision"];
+/**
+* A flag a command refuses to run without, beside another, that the parser does not enforce. `pithy provision
+* --env <env>` with no `--yes` is refused before it does anything; a dry run needs neither.
+*/
+const REQUIRED_BESIDE = [{
+	path: "provision",
+	with: "--env",
+	needs: "--yes",
+	unless: "--dry-run"
+}];
+//#endregion
+export { CONFIRMATIONS, CONFIRM_FLAGS, CREDENTIAL_FLAGS, DESTRUCTIVE_COMMANDS, DESTRUCTIVE_FLAGS, EVERY_ENVIRONMENT_ALWAYS, EVERY_ENVIRONMENT_WITHOUT_ENV, MEANING_FLAGS, MEANING_ONLY_WITH, NOT_DESTRUCTIVE, NO_WORKER_MODES, PERSON_ONLY, PRODUCTION_CONFIRMS, PRODUCTION_ENVIRONMENTS, REQUIRED_BESIDE, WORKER_NARROWS, WORKER_SCOPED };

package/dist/controlPlane/error/errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/error/errors.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;;;;GAYG;AAEH,UAAU,qBAAqB;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,UAAU;IAC3D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF;AAED,sEAAsE;AACtE,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF;AAED,0DAA0D;AAC1D,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF"}
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/error/errors.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AAExD;;;;;;;;;;;;GAYG;AAEH,UAAU,qBAAqB;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;OAGG;IACH,MAAM,CAAC,EAAE,aAAa,CAAC;CACxB;AAED;;;GAGG;AACH,qBAAa,6BAA8B,SAAQ,UAAU;IAC3D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED;;;GAGG;AACH,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED,sEAAsE;AACtE,qBAAa,kCAAmC,SAAQ,UAAU;IAChE,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAc1E;CACF;AAED,0DAA0D;AAC1D,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF;AAED;;;;GAIG;AACH,qBAAa,4BAA6B,SAAQ,UAAU;IAC1D,YAAY,IAAI,GAAE,qBAA0B,EAAE,OAAO,CAAC,EAAE;QAAE,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,EAY1E;CACF"}

package/dist/controlPlane/error/errors.js

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { PithyError } from "../../error/pithyError.js";
+import { commandName } from "../../cli/command.js";
 //#region src/controlPlane/error/errors.ts
 /**
 * No connection is registered for this environment. The shipped default of a Worker that composes the
@@ -12,7 +13,7 @@ var ControlPlaneNotConnectedError = class extends PithyError {
 			code: "controlplane/not_connected",
 			status: 403,
 			message: args.message ?? "No management client is connected to this environment.",
-			action: args.action ?? "Run pithy dashboard connect --env <environment> to register one.",
+			action: args.action ?? `Register one for this environment with ${commandName("dashboard connect")}, naming it with --env.`,
 			detail: args.detail,
 			params: args.params
 		}, options);
@@ -28,7 +29,7 @@ var ControlPlaneInvalidCredentialError = class extends PithyError {
 			code: "controlplane/invalid_credential",
 			status: 401,
 			message: args.message ?? "That credential is not valid here.",
-			action: args.action ?? "Rotate the connection's key, or re-run pithy dashboard connect --update.",
+			action: args.action ?? `Rotate the connection's key, or update this environment's connection with ${commandName("dashboard connect")} and its --update flag.`,
 			detail: args.detail,
 			params: args.params
 		}, options);
@@ -41,7 +42,7 @@ var ControlPlaneInsufficientScopeError = class extends PithyError {
 			code: "controlplane/insufficient_scope",
 			status: 403,
 			message: args.message ?? "This connection is not scoped for that operation.",
-			action: args.action ?? "Re-run pithy dashboard connect --update and grant the scope this call needs.",
+			action: args.action ?? `Update this environment's connection with ${commandName("dashboard connect")} and its --update flag, granting the scope this call needs.`,
 			detail: args.detail,
 			params: args.params
 		}, options);

package/dist/controlPlane/http/guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/guard.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAIhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,KAAK,sBAAsB,EAA0B,MAAM,UAAU,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,uBAAuB,KACjC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAElC;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,sBAAsB,GAAG,oBAAoB,CAgB7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzE;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,eAAwC,CAAC;AAEzE,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,uBAAuB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAkEzG"}
+{"version":3,"file":"guard.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/guard.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,MAAM,CAAC;AAC9C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAMhE,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AAEtD,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAE9D,OAAO,EAAE,KAAK,sBAAsB,EAA0B,MAAM,UAAU,CAAC;AAE/E;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AAEH;;;GAGG;AACH,MAAM,MAAM,oBAAoB,GAAG,CACjC,OAAO,EAAE,OAAO,EAChB,WAAW,EAAE,uBAAuB,KACjC,OAAO,CAAC,mBAAmB,CAAC,CAAC;AAElC;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,IAAI,EAAE,sBAAsB,GAAG,oBAAoB,CAgB7F;AAED;;;;;;;;;;;;;GAaG;AACH,wBAAgB,oBAAoB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAMzE;AAED;;;;;;GAMG;AACH;;;;;;;GAOG;AACH,eAAO,MAAM,mBAAmB,eAAwC,CAAC;AAEzE,yDAAyD;AACzD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAE7D;AAED,wBAAgB,mBAAmB,CAAC,WAAW,EAAE,uBAAuB,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAkEzG"}

package/dist/controlPlane/http/guard.js

@@ -1,7 +1,9 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { PithyError } from "../../error/pithyError.js";
+import { commandName, remedy } from "../../cli/command.js";
 import { workerVersionMetadata } from "../../worker/identity.js";
+import { compositionEnvironment } from "../../env/ambient.js";
 import { ControlPlaneAuditActions, safeEmit } from "../audit/actions.js";
 import { ControlPlaneNotConnectedError } from "../error/errors.js";
 import { CONTROL_PLANE_VERSION_CREATED_HEADER, CONTROL_PLANE_VERSION_HEADER } from "../wire.js";
@@ -69,7 +71,7 @@ function requireControlPlane(requirement) {
 		if (!verify) {
 			const denial = new ControlPlaneNotConnectedError({
 				message: "This deployment does not accept management-client calls.",
-				action: "Add `controlplane()` to this Worker's pithy.config.ts, then run pithy dashboard connect.",
+				action: `Add \`controlplane()\` to this Worker's pithy.config.ts, then ${connectStep(compositionEnvironment(c.env))}.`,
 				detail: "no control-plane verifier on the request — the controlplane capability is not composed"
 			});
 			await auditDenial(c, requirement, denial);
@@ -140,5 +142,13 @@ async function auditDenial(c, requirement, cause) {
 		}
 	}, c.var.log);
 }
+/**
+* The step that connects a management client, as this deployed Worker can name it: with its own environment when
+* it knows it, and never with a Worker — it cannot know the `apps/` directory that provisioned it (#711).
+*/
+function connectStep(env) {
+	if (env === void 0) return `connect one with ${commandName("dashboard connect")}, naming this environment with --env`;
+	return remedy("dashboard connect", { flags: { "--env": env } }, { runtime: true }).say((command) => `run ${command}`);
+}
 //#endregion
 export { CONTROL_PLANE_GUARD, createControlPlaneVerifier, isControlPlaneGuard, requireControlPlane, workerVersionHeaders };

package/dist/controlPlane/http/routes.d.ts

@@ -2,7 +2,7 @@
 // SPDX-License-Identifier: MIT
 import type { Hono } from "hono";
 import type { PithyHonoEnv } from "../../capability/capability";
-import type { AdminRoute } from "../discovery/adminRoute";
+import { type AdminRoute } from "../discovery/adminRoute";
 import { type ControlPlaneHandlerDeps } from "./handlers";
 /**
  * The seam's own routes, distinct from the admin routes capabilities contribute.

package/dist/controlPlane/http/routes.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/routes.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAEhE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,yBAAyB,CAAC;AAG1D,OAAO,EACL,KAAK,uBAAuB,EAM7B,MAAM,YAAY,CAAC;AAGpB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAiC3E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CAqBN"}
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../../src/controlPlane/http/routes.ts"],"names":[],"mappings":"AAGA,OAAO,KAAK,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACjC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAGhE,OAAO,EAAE,KAAK,UAAU,EAAwB,MAAM,yBAAyB,CAAC;AAGhF,OAAO,EACL,KAAK,uBAAuB,EAM7B,MAAM,YAAY,CAAC;AASpB;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH;;;;;;;;;GASG;AACH,wBAAgB,4BAA4B,CAAC,QAAQ,EAAE,MAAM,GAAG,UAAU,EAAE,CAiC3E;AAED,wBAAgB,0BAA0B,CACxC,GAAG,EAAE,IAAI,CAAC,YAAY,CAAC,EACvB,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,uBAAuB,GAC5B,IAAI,CA+DN"}

package/dist/controlPlane/http/routes.js

@@ -2,10 +2,12 @@
 // SPDX-License-Identifier: MIT
 import { ANY_VERIFIED_CALLER, KEYS_ROTATE_SCOPE, MANIFEST_READ_SCOPE } from "../scope/scope.js";
 import { requireControlPlane } from "./guard.js";
-import { validationHook } from "../../http/validation.js";
+import { describeRoute } from "../../http/routeSpec.js";
+import { validate } from "../../http/validation.js";
+import { ControlPlaneManifest } from "../discovery/adminRoute.js";
 import { expireKeyHandler, listKeysHandler, manifestHandler, pingHandler, registerKeyHandler } from "./handlers.js";
+import { ControlPlaneKeysResponse, ControlPlanePingResponse, ExpireKeyResponse, RegisterKeyResponse } from "./responses.js";
 import { ExpireKeyParams, ExpireKeyRequest, RegisterKeyRequest } from "./schemas.js";
-import { zValidator } from "@hono/zod-validator";
 //#region src/controlPlane/http/routes.ts
 /**
 * The seam's own routes, distinct from the admin routes capabilities contribute.
@@ -75,11 +77,36 @@ function controlPlaneRouteDescriptors(basePath) {
 	];
 }
 function registerControlPlaneRoutes(app, basePath, deps) {
-	app.get(`${basePath}/ping`, requireControlPlane(ANY_VERIFIED_CALLER), pingHandler(deps));
-	app.get(`${basePath}/manifest`, requireControlPlane(MANIFEST_READ_SCOPE), manifestHandler(deps));
-	app.get(`${basePath}/keys`, requireControlPlane(KEYS_ROTATE_SCOPE), listKeysHandler(deps));
-	app.post(`${basePath}/keys`, requireControlPlane(KEYS_ROTATE_SCOPE), zValidator("json", RegisterKeyRequest, validationHook), (c) => registerKeyHandler(deps)(c, c.req.valid("json")));
-	app.post(`${basePath}/keys/:keyId/expire`, requireControlPlane(KEYS_ROTATE_SCOPE), zValidator("param", ExpireKeyParams, validationHook), zValidator("json", ExpireKeyRequest, validationHook), (c) => expireKeyHandler(deps)(c, c.req.valid("param"), c.req.valid("json")));
+	app.get(`${basePath}/ping`, describeRoute({
+		summary: "Prove the connection and the key it signs with.",
+		verification: "control-plane",
+		responses: { 200: ControlPlanePingResponse }
+	}), requireControlPlane(ANY_VERIFIED_CALLER), pingHandler(deps));
+	app.get(`${basePath}/manifest`, describeRoute({
+		summary: "Describe what this Worker composes and how to call its admin surface.",
+		verification: "control-plane",
+		scopes: [MANIFEST_READ_SCOPE],
+		responses: { 200: ControlPlaneManifest }
+	}), requireControlPlane(MANIFEST_READ_SCOPE), manifestHandler(deps));
+	app.get(`${basePath}/keys`, describeRoute({
+		summary: "Read the connection's key registration state.",
+		verification: "control-plane",
+		scopes: [KEYS_ROTATE_SCOPE],
+		responses: { 200: ControlPlaneKeysResponse }
+	}), requireControlPlane(KEYS_ROTATE_SCOPE), listKeysHandler(deps));
+	app.post(`${basePath}/keys`, describeRoute({
+		summary: "Register a key for the connection.",
+		verification: "control-plane",
+		scopes: [KEYS_ROTATE_SCOPE],
+		responses: { 201: RegisterKeyResponse }
+	}), requireControlPlane(KEYS_ROTATE_SCOPE), validate("json", RegisterKeyRequest), (c) => registerKeyHandler(deps)(c, c.req.valid("json")));
+	app.post(`${basePath}/keys/:keyId/expire`, describeRoute({
+		summary: "Retire a superseded key.",
+		description: "Must be signed with the successor it names as proven.",
+		verification: "control-plane",
+		scopes: [KEYS_ROTATE_SCOPE],
+		responses: { 200: ExpireKeyResponse }
+	}), requireControlPlane(KEYS_ROTATE_SCOPE), validate("param", ExpireKeyParams), validate("json", ExpireKeyRequest), (c) => expireKeyHandler(deps)(c, c.req.valid("param"), c.req.valid("json")));
 }
 //#endregion
 export { controlPlaneRouteDescriptors, registerControlPlaneRoutes };

package/dist/createBackend.d.ts

@@ -1,6 +1,7 @@
 // SPDX-FileCopyrightText: 2026 Pithy
 // SPDX-License-Identifier: MIT
 import { Hono } from "hono";
+import { z } from "zod";
 import type { Capability, MergedDatabases, MergedKvNamespaces, MergedWorkflowParams, PithyVars } from "./capability/capability";
 import { type DbRegistry } from "./data/databases";
 import { type KvRegistry } from "./kv/namespaces";
@@ -39,6 +40,12 @@ type BackendEnv<Caps extends readonly Capability[]> = {
         workflows: WorkflowDispatcher<MergedWorkflowParams<Caps>>;
     };
 };
+/** What `GET /health` answers. */
+export declare const HealthBody: z.ZodObject<{
+    status: z.ZodLiteral<"ok">;
+    version: z.ZodNullable<z.ZodString>;
+}, z.core.$strip>;
+export type HealthBody = z.infer<typeof HealthBody>;
 /**
  * Assemble capabilities into a deployable Hono app — a valid Worker `fetch` handler.
  *

package/dist/createBackend.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"createBackend.d.ts","sourceRoot":"","sources":["../src/createBackend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAG5B,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EAEpB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAKjC,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAKtF,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAK9C,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,oGAAoG;AACpG,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EAAE,GAAG,SAAS,UAAU;IAC9F,2EAA2E;IAC3E,YAAY,EAAE,IAAI,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iHAAiH;AACjH,KAAK,UAAU,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,GAAG;QACtD,EAAE,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,EAAE,EAAE,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,SAAS,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH,CAAC;AAuCF;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CA0KrF"}
+{"version":3,"file":"createBackend.d.ts","sourceRoot":"","sources":["../src/createBackend.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,KAAK,EACV,UAAU,EACV,eAAe,EACf,kBAAkB,EAClB,oBAAoB,EAEpB,SAAS,EACV,MAAM,yBAAyB,CAAC;AAMjC,OAAO,EAAqC,KAAK,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAMtF,OAAO,EAA8B,KAAK,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE9E,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,iBAAiB,CAAC;AAO9C,OAAO,EAA2B,KAAK,kBAAkB,EAAE,MAAM,qBAAqB,CAAC;AAGvF,oGAAoG;AACpG,MAAM,WAAW,oBAAoB,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EAAE,GAAG,SAAS,UAAU;IAC9F,2EAA2E;IAC3E,YAAY,EAAE,IAAI,CAAC;IACnB;;;OAGG;IACH,GAAG,CAAC,EAAE,GAAG,CAAC;IACV;;;;;OAKG;IACH,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB;;;;;OAKG;IACH,GAAG,CAAC,EAAE,MAAM,CAAC;CACd;AAED,iHAAiH;AACjH,KAAK,UAAU,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,IAAI;IACpD,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,IAAI,GAAG,IAAI,GAAG,WAAW,CAAC,GAAG;QACtD,EAAE,EAAE,UAAU,CAAC,eAAe,CAAC,IAAI,CAAC,CAAC,CAAC;QACtC,EAAE,EAAE,UAAU,CAAC,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC;QACzC,SAAS,EAAE,kBAAkB,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;KAC3D,CAAC;CACH,CAAC;AAuCF,kCAAkC;AAClC,eAAO,MAAM,UAAU;;;iBAQ+B,CAAC;AACvD,MAAM,MAAM,UAAU,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,UAAU,CAAC,CAAC;AAEpD;;;;;;;;;;;;;;;;GAgBG;AACH,wBAAgB,aAAa,CAC3B,KAAK,CAAC,IAAI,SAAS,SAAS,UAAU,EAAE,EACxC,KAAK,CAAC,GAAG,SAAS,UAAU,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,EACrF,OAAO,EAAE,oBAAoB,CAAC,IAAI,EAAE,GAAG,CAAC,GAAG,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,GAAG,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,CA0LrF"}