@productbrain/cli 0.1.0-beta.1414 → 0.1.0-beta.14155

package/dist/lib/pinnedRole.js

@@ -0,0 +1,115 @@
+/**
+ * A folder's default acting role (DEC-1961, TASK-639, WP-809).
+ *
+ * `.productbrain/config.local.json` may carry `role` beside `profile`: the role id (ROL-N) this
+ * folder's sessions act as. `pb session start --role` wins over it. The role binds at session
+ * start (DEC-1715) and only labels attribution; a person key never carries it (DEC-1923), and a key bound to one role
+ * for an AI agent (DEC-2226) acts only as that role, so the kernel refuses any other pin. The kernel
+ * decides whether the person holds it (RULE-128): a role not held is refused, never swapped for
+ * another (RULE-632). A role id names a role in ONE workspace, so the pin's role is sent only when
+ * the pin's own profile supplies the key; under any other key it is not sent, and that is said.
+ *
+ * A refusal is thrown once and printed once, on stderr; the SessionStart hook pb installs runs
+ * `pb session start 2>&1`, so the agent reads it there (TASK-649, WP-810). Older installs and
+ * machine-level hooks may still discard stderr (TEN-3736). Only role refusals get
+ * this framing: any other failure is rethrown unchanged.
+ */
+import { readLocalProjectConfig } from './config.js';
+import { CLIError, ErrorCode } from './errors.js';
+import { resolveReportedProfile } from './reportedProfile.js';
+import { describeReportedTenant } from './workspaceNotice.js';
+const PIN = '.productbrain/config.local.json';
+// TEN-4893: a start after `pb session close` asking for another role begins a fresh session, so no reset is needed.
+const ROLE_SWITCH_FIX = 'If this conversation already has a session bound to another role, run `pb session close`, then start again.';
+const PIN_FIX = `Fix: put a role id you hold in the "role" field of ${PIN}, or remove the field.`;
+const PINNED_ROLE_FIX = `${PIN_FIX} ${ROLE_SWITCH_FIX}`;
+/**
+ * The kernel's role refusals at session start. VALIDATION_FAILED counts only because a role was
+ * sent: on this path it comes from the role reference (an unknown id, or a record that is not a role).
+ */
+const ROLE_REFUSALS = new Set([
+    ErrorCode.ROLE_NOT_OWNER, ErrorCode.NO_ROLE, ErrorCode.MULTI_ROLE, ErrorCode.ROLE_SWITCH_REFUSED, ErrorCode.VALIDATION_FAILED,
+]);
+/** The one test for a role refusal; session.ts's stale-preview-key recovery uses it too, so a role refusal is never relabelled. */
+export const isRoleRefusal = (err) => err instanceof CLIError && ROLE_REFUSALS.has(err.code);
+/** The same refusal, same message and code, with one more line of guidance. */
+function withGuidance(err, extra) {
+    return new CLIError(err.message, {
+        code: err.code, category: err.category, authority: err.authority,
+        guidance: [err.guidance, extra].filter(Boolean).join('\n'),
+    });
+}
+/** DEC-2226, DEC-2298: the refusal's data flags a key bound to one role (`boundKey`) or a seat an AI agent holds (`heldByAgent`). */
+const flagged = (err, flag) => err.details?.some((d) => d?.[flag] === true) === true;
+/** Closing a session cannot help either, so no close-the-session line is added (RULE-662). */
+const noSwitchHelps = (err) => flagged(err, 'boundKey') || flagged(err, 'heldByAgent');
+/** A role refusal while the pin's role was in play: names the pin. Keeps the kernel's code. A bound key's refusal keeps the pin's own fix
+ *  and drops only the close-the-session line, which cannot help it (DEC-2226). */
+function pinnedRoleRefusal(role, err) {
+    const fix = flagged(err, 'boundKey') ? PIN_FIX : PINNED_ROLE_FIX;
+    // JSON.stringify quotes the hand-written value and escapes any control character in it.
+    return new CLIError(`This folder pins role ${JSON.stringify(role)} in ${PIN}, and the session did not start: ${err.message}`, {
+        code: err.code, category: err.category, authority: err.authority,
+        guidance: [err.guidance, fix].filter(Boolean).join('\n'),
+    });
+}
+/**
+ * The pin's role, when it applies: only when the pin's own profile supplies the key. Under an
+ * exported key, a preview binding or any other source, it is not sent, and one line says why.
+ */
+function pinnedRoleInPlay(json) {
+    const pin = readLocalProjectConfig();
+    if (!pin?.role && !pin?.roleMalformed)
+        return { malformed: false };
+    const { profile, source } = resolveReportedProfile();
+    if (source !== 'local') {
+        const line = `folder role ${pin.role ?? '(not a role id)'} not applied: the key comes from ${describeReportedTenant(profile, source) ?? source}\n`;
+        (json ? process.stderr : process.stdout).write(line);
+        return { malformed: false };
+    }
+    return { role: pin.role, malformed: pin.roleMalformed === true };
+}
+/**
+ * Run a session start with `--role`, else the pin's role. A role refusal under `--role` gains the
+ * close-then-start fix (a role switch already names it); under the pin it names the pin and its fix. With no role asked for, `multi_role` gains
+ * the folder-pin way to name one, and `no_role` keeps the kernel's fix. Every other failure is
+ * rethrown unchanged.
+ */
+export async function startWithPinnedRole(options, json, start) {
+    if (options.role) {
+        // role_switch_refused carries the kernel's own way in (close, then start as the seat): nothing to add (TEN-4893).
+        try {
+            return await start(options);
+        }
+        catch (err) {
+            throw isRoleRefusal(err) && err.code !== ErrorCode.ROLE_SWITCH_REFUSED && !noSwitchHelps(err) ? withGuidance(err, ROLE_SWITCH_FIX) : err;
+        }
+    }
+    const { role, malformed } = pinnedRoleInPlay(json);
+    if (malformed) {
+        throw new CLIError(`The "role" field in ${PIN} is not a role id (ROL- followed by a number), so the session did not start.`, {
+            code: ErrorCode.CONFIG_INVALID, category: 'config', guidance: PINNED_ROLE_FIX,
+        });
+    }
+    if (!role) {
+        try {
+            return await start(options);
+        }
+        catch (err) {
+            if (err instanceof CLIError && err.code === ErrorCode.MULTI_ROLE) {
+                throw withGuidance(err, `Or name this folder's role once: add "role": "<ROLE-ID>" to ${PIN}.`);
+            }
+            throw err;
+        }
+    }
+    try {
+        await start({ ...options, role });
+    }
+    catch (err) {
+        // DEC-2298: a seat an AI agent holds is no fault of the pin, so the kernel's two lines stand alone.
+        if (isRoleRefusal(err))
+            throw flagged(err, 'heldByAgent') ? err : pinnedRoleRefusal(role, err);
+        throw err;
+    }
+}
+//# sourceMappingURL=pinnedRole.js.map

package/dist/lib/pinnedRole.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pinnedRole.js","sourceRoot":"","sources":["../../src/lib/pinnedRole.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAuB,MAAM,aAAa,CAAC;AAEvE,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAC9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,sBAAsB,CAAC;AAE9D,MAAM,GAAG,GAAG,iCAAiC,CAAC;AAE9C,oHAAoH;AACpH,MAAM,eAAe,GACnB,6GAA6G,CAAC;AAEhH,MAAM,OAAO,GAAG,sDAAsD,GAAG,wBAAwB,CAAC;AAClG,MAAM,eAAe,GAAG,GAAG,OAAO,IAAI,eAAe,EAAE,CAAC;AAExD;;;GAGG;AACH,MAAM,aAAa,GAAG,IAAI,GAAG,CAAiB;IAC5C,SAAS,CAAC,cAAc,EAAE,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,UAAU,EAAE,SAAS,CAAC,mBAAmB,EAAE,SAAS,CAAC,iBAAiB;CAC9H,CAAC,CAAC;AACH,mIAAmI;AACnI,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,GAAY,EAAmB,EAAE,CAAC,GAAG,YAAY,QAAQ,IAAI,aAAa,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEvH,+EAA+E;AAC/E,SAAS,YAAY,CAAC,GAAa,EAAE,KAAa;IAChD,OAAO,IAAI,QAAQ,CAAC,GAAG,CAAC,OAAO,EAAE;QAC/B,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS;QAChE,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED,qIAAqI;AACrI,MAAM,OAAO,GAAG,CAAC,GAAY,EAAE,IAAoE,EAAE,EAAE,CACpG,GAA+B,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAE,CAAmC,EAAE,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,KAAK,IAAI,CAAC;AACxH,8FAA8F;AAC9F,MAAM,aAAa,GAAG,CAAC,GAAY,EAAE,EAAE,CAAC,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,IAAI,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;AAEhG;kFACkF;AAClF,SAAS,iBAAiB,CAAC,IAAY,EAAE,GAAa;IACpD,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,EAAE,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,eAAe,CAAC;IACjE,wFAAwF;IACxF,OAAO,IAAI,QAAQ,CAAC,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,GAAG,oCAAoC,GAAG,CAAC,OAAO,EAAE,EAAE;QAC5H,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS;QAChE,QAAQ,EAAE,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;KACzD,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,SAAS,gBAAgB,CAAC,IAAa;IACrC,MAAM,GAAG,GAAG,sBAAsB,EAAE,CAAC;IACrC,IAAI,CAAC,GAAG,EAAE,IAAI,IAAI,CAAC,GAAG,EAAE,aAAa;QAAE,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IACnE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,sBAAsB,EAAE,CAAC;IACrD,IAAI,MAAM,KAAK,OAAO,EAAE,CAAC;QACvB,MAAM,IAAI,GAAG,eAAe,GAAG,CAAC,IAAI,IAAI,iBAAiB,oCAAoC,sBAAsB,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,IAAI,CAAC;QACnJ,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACrD,OAAO,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC;IAC9B,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,EAAE,SAAS,EAAE,GAAG,CAAC,aAAa,KAAK,IAAI,EAAE,CAAC;AACnE,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,OAAU,EACV,IAAa,EACb,KAAoC;IAEpC,IAAI,OAAO,CAAC,IAAI,EAAE,CAAC;QACjB,kHAAkH;QAClH,IAAI,CAAC;YAAC,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAChD,MAAM,aAAa,CAAC,GAAG,CAAC,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,mBAAmB,IAAI,CAAC,aAAa,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,GAAG,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC;QAC3I,CAAC;IACH,CAAC;IACD,MAAM,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,gBAAgB,CAAC,IAAI,CAAC,CAAC;IACnD,IAAI,SAAS,EAAE,CAAC;QACd,MAAM,IAAI,QAAQ,CAAC,uBAAuB,GAAG,8EAA8E,EAAE;YAC3H,IAAI,EAAE,SAAS,CAAC,cAAc,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe;SAC9E,CAAC,CAAC;IACL,CAAC;IACD,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,IAAI,CAAC;YAAC,OAAO,MAAM,KAAK,CAAC,OAAO,CAAC,CAAC;QAAC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YAChD,IAAI,GAAG,YAAY,QAAQ,IAAI,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,UAAU,EAAE,CAAC;gBACjE,MAAM,YAAY,CAAC,GAAG,EAAE,+DAA+D,GAAG,GAAG,CAAC,CAAC;YACjG,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IACD,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IACpC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oGAAoG;QACpG,IAAI,aAAa,CAAC,GAAG,CAAC;YAAE,MAAM,OAAO,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,iBAAiB,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC;QAC/F,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC"}

package/dist/lib/platformGlossary.d.ts

@@ -0,0 +1,22 @@
+/**
+ * The platform's glossary: four governance words every workspace shares, served from code (TEN-4475,
+ * DEC-1949, DEC-1947). No workspace stores them and no team edits them; a team adds its own terms
+ * as glossary entries, and those are listed after these. A platform term has no entry id.
+ *
+ * Readers: the build context
+ * (convex/agentKnowledge/intelligence.ts), the kernel search that matches them for pb search, MCP
+ * search and the Glossary page's list (convex/agentKnowledge/entryReadQueries.ts, TASK-854, TASK-855), and pb glossary
+ * and the MCP terminology resource through generated copies (scripts/generate-mcp-embedded-copies.mjs).
+ * Zero imports, so the generator copies it verbatim.
+ */
+/** The product's name, declared once (TASK-797, TEN-4824, RULE-664). The web app (wordmark, invite and
+ *  join pages), the kernel's invite email and the MCP wordmark all read it. */
+export declare const PRODUCT_NAME = "Product Brain";
+/** The word that marks a platform term wherever one is listed (RULE-664, RULE-675, DEC-1958). */
+export declare const PLATFORM_TERM_LABEL = "Platform";
+export interface PlatformGlossaryTerm {
+    name: string;
+    definition: string;
+}
+export declare const PLATFORM_GLOSSARY_TERMS: readonly PlatformGlossaryTerm[];
+//# sourceMappingURL=platformGlossary.d.ts.map

package/dist/lib/platformGlossary.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"platformGlossary.d.ts","sourceRoot":"","sources":["../../src/lib/platformGlossary.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;GAUG;AAEH;+EAC+E;AAC/E,eAAO,MAAM,YAAY,kBAAkB,CAAC;AAE5C,iGAAiG;AACjG,eAAO,MAAM,mBAAmB,aAAa,CAAC;AAE9C,MAAM,WAAW,oBAAoB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACnB;AAED,eAAO,MAAM,uBAAuB,EAAE,SAAS,oBAAoB,EAKlE,CAAC"}

package/dist/lib/platformGlossary.js

@@ -0,0 +1,26 @@
+// GENERATED by scripts/generate-mcp-embedded-copies.mjs from kernel/governance/platformGlossary.ts.
+// DO NOT EDIT. Run `npm run mcp:embedded-copies` to regenerate.
+// Local runtime copy for the isolated connector build.
+/**
+ * The platform's glossary: four governance words every workspace shares, served from code (TEN-4475,
+ * DEC-1949, DEC-1947). No workspace stores them and no team edits them; a team adds its own terms
+ * as glossary entries, and those are listed after these. A platform term has no entry id.
+ *
+ * Readers: the build context
+ * (convex/agentKnowledge/intelligence.ts), the kernel search that matches them for pb search, MCP
+ * search and the Glossary page's list (convex/agentKnowledge/entryReadQueries.ts, TASK-854, TASK-855), and pb glossary
+ * and the MCP terminology resource through generated copies (scripts/generate-mcp-embedded-copies.mjs).
+ * Zero imports, so the generator copies it verbatim.
+ */
+/** The product's name, declared once (TASK-797, TEN-4824, RULE-664). The web app (wordmark, invite and
+ *  join pages), the kernel's invite email and the MCP wordmark all read it. */
+export const PRODUCT_NAME = 'Product Brain';
+/** The word that marks a platform term wherever one is listed (RULE-664, RULE-675, DEC-1958). */
+export const PLATFORM_TERM_LABEL = 'Platform';
+export const PLATFORM_GLOSSARY_TERMS = [
+    { name: 'Team', definition: 'A group of people and agents working toward one purpose; its roles own its decisions, rules and work.' },
+    { name: 'Team Lead', definition: 'The role accountable for its team having what it needs to achieve its purpose; it holds every role in its team with no one seated, covering it.' },
+    { name: 'Role', definition: 'A named set of responsibilities; the role decides and accepts the entries it owns, and whoever holds its seat acts for it.' },
+    { name: 'Tension', definition: 'A gap someone notices between how things are and how they should be; linking one to an entry is how you say you disagree with it.' },
+];
+//# sourceMappingURL=platformGlossary.js.map

package/dist/lib/platformGlossary.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"platformGlossary.js","sourceRoot":"","sources":["../../src/lib/platformGlossary.ts"],"names":[],"mappings":"AAAA,oGAAoG;AACpG,gEAAgE;AAChE,uDAAuD;AAEvD;;;;;;;;;;GAUG;AAEH;+EAC+E;AAC/E,MAAM,CAAC,MAAM,YAAY,GAAG,eAAe,CAAC;AAE5C,iGAAiG;AACjG,MAAM,CAAC,MAAM,mBAAmB,GAAG,UAAU,CAAC;AAO9C,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACvE,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,uGAAuG,EAAE;IACrI,EAAE,IAAI,EAAE,WAAW,EAAE,UAAU,EAAE,iJAAiJ,EAAE;IACpL,EAAE,IAAI,EAAE,MAAM,EAAE,UAAU,EAAE,4HAA4H,EAAE;IAC1J,EAAE,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,mIAAmI,EAAE;CACpK,CAAC"}

package/dist/lib/previewBanner.d.ts

@@ -0,0 +1,9 @@
+import type { Command } from 'commander';
+/**
+ * Print a loud PREVIEW banner to stderr when pb is bound to a throwaway preview.
+ *
+ * This is intentionally synchronous and never throws: it must not disrupt command
+ * execution, JSON stdout, or the root command lifecycle.
+ */
+export declare function printPreviewBanner(actionCommand: Command): void;
+//# sourceMappingURL=previewBanner.d.ts.map

package/dist/lib/previewBanner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"previewBanner.d.ts","sourceRoot":"","sources":["../../src/lib/previewBanner.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAgBzC;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,aAAa,EAAE,OAAO,GAAG,IAAI,CAiB/D"}

package/dist/lib/previewBanner.js

@@ -0,0 +1,36 @@
+import { getPreviewBinding } from './config.js';
+import { bold, yellow } from './style.js';
+/** Top-level Chain-write commands that need the throwaway-writes advisory. */
+const PREVIEW_WRITE_COMMANDS = new Set([
+    'capture',
+    'update',
+    'verify',
+    'promote',
+    'relate',
+    'unrelate',
+    'accept',
+    'reject',
+]);
+/**
+ * Print a loud PREVIEW banner to stderr when pb is bound to a throwaway preview.
+ *
+ * This is intentionally synchronous and never throws: it must not disrupt command
+ * execution, JSON stdout, or the root command lifecycle.
+ */
+export function printPreviewBanner(actionCommand) {
+    try {
+        const binding = getPreviewBinding();
+        if (!binding)
+            return;
+        const name = binding.workspaceName ?? 'preview';
+        process.stderr.write(yellow(bold(`⚠ PREVIEW ${name} — writes are throwaway. npm run pb:real to return to the real Chain`)) + '\n');
+        const isTopLevel = actionCommand.parent?.name() === 'pb';
+        if (isTopLevel && PREVIEW_WRITE_COMMANDS.has(actionCommand.name())) {
+            process.stderr.write('  → real learnings belong in the real Chain. Switch back with: npm run pb:real\n');
+        }
+    }
+    catch {
+        // Never let the banner crash the CLI.
+    }
+}
+//# sourceMappingURL=previewBanner.js.map

package/dist/lib/previewBanner.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"previewBanner.js","sourceRoot":"","sources":["../../src/lib/previewBanner.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAChD,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,YAAY,CAAC;AAE1C,8EAA8E;AAC9E,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACrC,SAAS;IACT,QAAQ;IACR,QAAQ;IACR,SAAS;IACT,QAAQ;IACR,UAAU;IACV,QAAQ;IACR,QAAQ;CACT,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CAAC,aAAsB;IACvD,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,iBAAiB,EAAE,CAAC;QACpC,IAAI,CAAC,OAAO;YAAE,OAAO;QACrB,MAAM,IAAI,GAAG,OAAO,CAAC,aAAa,IAAI,SAAS,CAAC;QAChD,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,MAAM,CAAC,IAAI,CAAC,aAAa,IAAI,sEAAsE,CAAC,CAAC,GAAG,IAAI,CAC7G,CAAC;QACF,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC;QACzD,IAAI,UAAU,IAAI,sBAAsB,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,MAAM,CAAC,KAAK,CAClB,kFAAkF,CACnF,CAAC;QACJ,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,sCAAsC;IACxC,CAAC;AACH,CAAC"}

package/dist/lib/priority.d.ts

@@ -0,0 +1,64 @@
+/**
+ * The priority a work package or a task carries, in Linear's five levels (DEC-2416). The catalog
+ * stores only the token (dev-system-collections.json, the `priority` select on work-packages and
+ * tasks); every surface reads the word, the order, the Linear integer and the icon key from here,
+ * so one change updates web, CLI, MCP and kernel alike. Each level's `line` is its meaning under the word in the picker
+ * and its `question` asks the why of a change to it (DEC-2460, signed by Voice in QUE-211). No priority has no token: a field never set is
+ * absent, and a clear stores "" (the CLI's empty -f value) or null (MCP data), so undefined, null, "" and
+ * any other non-token value all read as No priority through priorityOf.
+ *
+ * Dependency-free: copied verbatim into both connector packages by
+ * scripts/generate-mcp-embedded-copies.mjs, since neither connector can import the kernel at runtime.
+ */
+export declare const PRIORITY_LEVELS: {
+    readonly urgent: {
+        readonly word: "Urgent";
+        readonly order: 1;
+        readonly linearInt: 1;
+        readonly icon: "alert";
+        readonly line: "Fix now: hurts customers, money or security";
+        readonly question: "Who is hurt, or which promise slips?";
+    };
+    readonly high: {
+        readonly word: "High";
+        readonly order: 2;
+        readonly linearInt: 2;
+        readonly icon: "bars-3";
+        readonly line: "A goal we set is stuck without this";
+        readonly question: "Which goal is stuck without this?";
+    };
+    readonly medium: {
+        readonly word: "Medium";
+        readonly order: 3;
+        readonly linearInt: 3;
+        readonly icon: "bars-2";
+        readonly line: "Helps a goal we set, but can wait";
+        readonly question: "Which goal does this help?";
+    };
+    readonly low: {
+        readonly word: "Low";
+        readonly order: 4;
+        readonly linearInt: 4;
+        readonly icon: "bars-1";
+        readonly line: "Nice to have, or keeping things tidy";
+        readonly question: "Why can this wait?";
+    };
+};
+export type PriorityToken = keyof typeof PRIORITY_LEVELS;
+/** The stored tokens, most urgent first: exactly the catalog select's options. */
+export declare const PRIORITY_TOKENS: readonly PriorityToken[];
+/** An entry with no priority token. It sorts after Low; Linear's integer for it is 0. */
+export declare const NO_PRIORITY: {
+    readonly word: "No priority";
+    readonly order: 5;
+    readonly linearInt: 0;
+    readonly icon: "dashes";
+    readonly line: "Not judged yet";
+    readonly question: "Why clear the priority?";
+};
+/** A level's word, line, question and icon, No priority included: what a picker row and the why step read. */
+export type PriorityLevel = (typeof PRIORITY_LEVELS)[PriorityToken] | typeof NO_PRIORITY;
+export declare const priorityLevel: (token: PriorityToken | null) => PriorityLevel;
+/** The stored token, or null for No priority: the one read every surface uses, so none re-derives it. */
+export declare function priorityOf(value: unknown): PriorityToken | null;
+//# sourceMappingURL=priority.d.ts.map

package/dist/lib/priority.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"priority.d.ts","sourceRoot":"","sources":["../../src/lib/priority.ts"],"names":[],"mappings":"AAIA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAKlB,CAAC;AAEX,MAAM,MAAM,aAAa,GAAG,MAAM,OAAO,eAAe,CAAC;AAEzD,kFAAkF;AAClF,eAAO,MAAM,eAAe,EAAmC,SAAS,aAAa,EAAE,CAAC;AAExF,yFAAyF;AACzF,eAAO,MAAM,WAAW;;;;;;;CAAwI,CAAC;AAEjK,8GAA8G;AAC9G,MAAM,MAAM,aAAa,GAAG,CAAC,OAAO,eAAe,CAAC,CAAC,aAAa,CAAC,GAAG,OAAO,WAAW,CAAC;AACzF,eAAO,MAAM,aAAa,GAAI,OAAO,aAAa,GAAG,IAAI,KAAG,aAA+D,CAAC;AAE5H,yGAAyG;AACzG,wBAAgB,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,aAAa,GAAG,IAAI,CAE/D"}

package/dist/lib/priority.js

@@ -0,0 +1,31 @@
+// GENERATED by scripts/generate-mcp-embedded-copies.mjs from kernel/entries/priority.ts.
+// DO NOT EDIT. Run `npm run mcp:embedded-copies` to regenerate.
+// Local runtime copy for the isolated connector build.
+/**
+ * The priority a work package or a task carries, in Linear's five levels (DEC-2416). The catalog
+ * stores only the token (dev-system-collections.json, the `priority` select on work-packages and
+ * tasks); every surface reads the word, the order, the Linear integer and the icon key from here,
+ * so one change updates web, CLI, MCP and kernel alike. Each level's `line` is its meaning under the word in the picker
+ * and its `question` asks the why of a change to it (DEC-2460, signed by Voice in QUE-211). No priority has no token: a field never set is
+ * absent, and a clear stores "" (the CLI's empty -f value) or null (MCP data), so undefined, null, "" and
+ * any other non-token value all read as No priority through priorityOf.
+ *
+ * Dependency-free: copied verbatim into both connector packages by
+ * scripts/generate-mcp-embedded-copies.mjs, since neither connector can import the kernel at runtime.
+ */
+export const PRIORITY_LEVELS = {
+    urgent: { word: 'Urgent', order: 1, linearInt: 1, icon: 'alert', line: 'Fix now: hurts customers, money or security', question: 'Who is hurt, or which promise slips?' },
+    high: { word: 'High', order: 2, linearInt: 2, icon: 'bars-3', line: 'A goal we set is stuck without this', question: 'Which goal is stuck without this?' },
+    medium: { word: 'Medium', order: 3, linearInt: 3, icon: 'bars-2', line: 'Helps a goal we set, but can wait', question: 'Which goal does this help?' },
+    low: { word: 'Low', order: 4, linearInt: 4, icon: 'bars-1', line: 'Nice to have, or keeping things tidy', question: 'Why can this wait?' },
+};
+/** The stored tokens, most urgent first: exactly the catalog select's options. */
+export const PRIORITY_TOKENS = Object.keys(PRIORITY_LEVELS);
+/** An entry with no priority token. It sorts after Low; Linear's integer for it is 0. */
+export const NO_PRIORITY = { word: 'No priority', order: 5, linearInt: 0, icon: 'dashes', line: 'Not judged yet', question: 'Why clear the priority?' };
+export const priorityLevel = (token) => (token ? PRIORITY_LEVELS[token] : NO_PRIORITY);
+/** The stored token, or null for No priority: the one read every surface uses, so none re-derives it. */
+export function priorityOf(value) {
+    return typeof value === 'string' && Object.prototype.hasOwnProperty.call(PRIORITY_LEVELS, value) ? value : null;
+}
+//# sourceMappingURL=priority.js.map

package/dist/lib/priority.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"priority.js","sourceRoot":"","sources":["../../src/lib/priority.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,gEAAgE;AAChE,uDAAuD;AAEvD;;;;;;;;;;;GAWG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG;IAC9B,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,6CAA6C,EAAE,QAAQ,EAAE,sCAAsC,EAAE;IACxK,IAAI,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,qCAAqC,EAAE,QAAQ,EAAE,mCAAmC,EAAE;IAC1J,MAAM,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,mCAAmC,EAAE,QAAQ,EAAE,4BAA4B,EAAE;IACrJ,GAAG,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,sCAAsC,EAAE,QAAQ,EAAE,oBAAoB,EAAE;CACjI,CAAC;AAIX,kFAAkF;AAClF,MAAM,CAAC,MAAM,eAAe,GAAG,MAAM,CAAC,IAAI,CAAC,eAAe,CAA6B,CAAC;AAExF,yFAAyF;AACzF,MAAM,CAAC,MAAM,WAAW,GAAG,EAAE,IAAI,EAAE,aAAa,EAAE,KAAK,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,gBAAgB,EAAE,QAAQ,EAAE,yBAAyB,EAAW,CAAC;AAIjK,MAAM,CAAC,MAAM,aAAa,GAAG,CAAC,KAA2B,EAAiB,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC;AAE5H,yGAAyG;AACzG,MAAM,UAAU,UAAU,CAAC,KAAc;IACxC,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,MAAM,CAAC,SAAS,CAAC,cAAc,CAAC,IAAI,CAAC,eAAe,EAAE,KAAK,CAAC,CAAC,CAAC,CAAE,KAAuB,CAAC,CAAC,CAAC,IAAI,CAAC;AACpI,CAAC"}

package/dist/lib/privateFile.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The one way a key, token or file that may hold one is written: by the CLI, by the repo's scripts (they import this
+ * file) and by the MCP setup (packages/mcp-server/src/lib/privateFile.ts, generated from this one). Readable and
+ * writable by its owner only (0600). The content goes into a new file created at 0600 and is renamed over the
+ * target, so it is never written into an inode an older writer left at 0644, where a descriptor opened earlier could
+ * still read it. A symlinked target (a dotfiles-managed ~/.cursor/mcp.json) is followed, also when it dangles: the
+ * file it points at is written (created if missing) and the link stays. On any failure the target is untouched and no temp file is left. `exclusive` creates
+ * only, failing with EEXIST.
+ */
+export declare function writePrivateFile(path: string, content: string, opts?: {
+    exclusive?: boolean;
+}): void;
+//# sourceMappingURL=privateFile.d.ts.map

package/dist/lib/privateFile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateFile.d.ts","sourceRoot":"","sources":["../../src/lib/privateFile.ts"],"names":[],"mappings":"AAKA;;;;;;;;GAQG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,IAAI,CAgBxG"}

package/dist/lib/privateFile.js

@@ -0,0 +1,65 @@
+import { closeSync, fchmodSync, lstatSync, openSync, readlinkSync, realpathSync, renameSync, unlinkSync, writeFileSync } from 'fs';
+import { dirname, resolve } from 'path';
+let seq = 0;
+/**
+ * The one way a key, token or file that may hold one is written: by the CLI, by the repo's scripts (they import this
+ * file) and by the MCP setup (packages/mcp-server/src/lib/privateFile.ts, generated from this one). Readable and
+ * writable by its owner only (0600). The content goes into a new file created at 0600 and is renamed over the
+ * target, so it is never written into an inode an older writer left at 0644, where a descriptor opened earlier could
+ * still read it. A symlinked target (a dotfiles-managed ~/.cursor/mcp.json) is followed, also when it dangles: the
+ * file it points at is written (created if missing) and the link stays. On any failure the target is untouched and no temp file is left. `exclusive` creates
+ * only, failing with EEXIST.
+ */
+export function writePrivateFile(path, content, opts = {}) {
+    if (!opts.exclusive)
+        path = realPathOrSelf(path);
+    const target = opts.exclusive ? path : `${path}.${process.pid}.${Date.now()}.${seq++}.tmp`;
+    const fd = openSync(target, 'wx', 0o600);
+    try {
+        try {
+            fchmodSync(fd, 0o600); // exactly 0600 whatever the umask
+            writeFileSync(fd, content);
+        }
+        finally {
+            closeSync(fd);
+        }
+        if (!opts.exclusive)
+            renameSync(target, path);
+    }
+    catch (err) {
+        try {
+            unlinkSync(target);
+        }
+        catch { /* already gone */ }
+        throw err;
+    }
+}
+/**
+ * The file a symlink points at, so the rename replaces it and not the link. A dangling link (its target not created
+ * yet) is followed hop by hop, at most 40 hops; a path with nothing at it is returned as it is.
+ */
+function realPathOrSelf(path) {
+    let p = path;
+    for (let hop = 0; hop <= 40; hop++) {
+        try {
+            return realpathSync(p);
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+        let link = false;
+        try {
+            link = lstatSync(p).isSymbolicLink();
+        }
+        catch (err) {
+            if (err.code !== 'ENOENT')
+                throw err;
+        }
+        if (!link)
+            return p;
+        p = resolve(dirname(p), readlinkSync(p));
+    }
+    throw new Error(`Too many symbolic links: ${path}`);
+}
+//# sourceMappingURL=privateFile.js.map

package/dist/lib/privateFile.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateFile.js","sourceRoot":"","sources":["../../src/lib/privateFile.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACnI,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAExC,IAAI,GAAG,GAAG,CAAC,CAAC;AAEZ;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,IAAY,EAAE,OAAe,EAAE,OAAgC,EAAE;IAChG,IAAI,CAAC,IAAI,CAAC,SAAS;QAAE,IAAI,GAAG,cAAc,CAAC,IAAI,CAAC,CAAC;IACjD,MAAM,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG,EAAE,MAAM,CAAC;IAC3F,MAAM,EAAE,GAAG,QAAQ,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;IACzC,IAAI,CAAC;QACH,IAAI,CAAC;YACH,UAAU,CAAC,EAAE,EAAE,KAAK,CAAC,CAAC,CAAC,kCAAkC;YACzD,aAAa,CAAC,EAAE,EAAE,OAAO,CAAC,CAAC;QAC7B,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,EAAE,CAAC,CAAC;QAChB,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,UAAU,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAChD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,CAAC;YAAC,UAAU,CAAC,MAAM,CAAC,CAAC;QAAC,CAAC;QAAC,MAAM,CAAC,CAAC,kBAAkB,CAAC,CAAC;QACxD,MAAM,GAAG,CAAC;IACZ,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,cAAc,CAAC,IAAY;IAClC,IAAI,CAAC,GAAG,IAAI,CAAC;IACb,KAAK,IAAI,GAAG,GAAG,CAAC,EAAE,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,CAAC;QACnC,IAAI,CAAC;YACH,OAAO,YAAY,CAAC,CAAC,CAAC,CAAC;QACzB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QACD,IAAI,IAAI,GAAG,KAAK,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC,cAAc,EAAE,CAAC;QACvC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;gBAAE,MAAM,GAAG,CAAC;QAClE,CAAC;QACD,IAAI,CAAC,IAAI;YAAE,OAAO,CAAC,CAAC;QACpB,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,YAAY,CAAC,CAAC,CAAC,CAAC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4BAA4B,IAAI,EAAE,CAAC,CAAC;AACtD,CAAC"}

package/dist/lib/privateFile.test.d.ts

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=privateFile.test.d.ts.map

package/dist/lib/privateFile.test.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateFile.test.d.ts","sourceRoot":"","sources":["../../src/lib/privateFile.test.ts"],"names":[],"mappings":""}

package/dist/lib/privateFile.test.js

@@ -0,0 +1,76 @@
+// TASK-1080 (F72): every key file is owner-only, also one an older writer left world-readable.
+import { closeSync, lstatSync, mkdtempSync, openSync, readdirSync, readFileSync, readlinkSync, rmSync, statSync, symlinkSync, writeFileSync } from 'fs';
+import { tmpdir } from 'os';
+import { join } from 'path';
+import { afterEach, describe, expect, it } from 'vitest';
+import { writePrivateFile } from './privateFile';
+const dirs = [];
+const scratch = () => { const d = mkdtempSync(join(tmpdir(), 'private-file-')); dirs.push(d); return d; };
+const mode = (p) => statSync(p).mode & 0o777;
+afterEach(() => { for (const d of dirs.splice(0))
+    rmSync(d, { recursive: true, force: true }); });
+describe('writePrivateFile', () => {
+    it('creates a file at 0600', () => {
+        const p = join(scratch(), 'key.json');
+        writePrivateFile(p, '{"apiKey":"pb_sk_test"}\n');
+        expect(mode(p)).toBe(0o600);
+    });
+    it('tightens a file that already exists at 0644', () => {
+        const p = join(scratch(), 'config.local.json');
+        writeFileSync(p, '{}\n', { mode: 0o644 });
+        expect(mode(p)).toBe(0o644);
+        writePrivateFile(p, '{"apiKey":"pb_sk_test"}\n');
+        expect(mode(p)).toBe(0o600);
+    });
+    it('a descriptor opened on the old 0644 file never reads the new key (Codex P1 on #1985)', () => {
+        const d = scratch();
+        const p = join(d, 'preview-admin.json');
+        writeFileSync(p, 'old', { mode: 0o644 });
+        const early = openSync(p, 'r');
+        try {
+            writePrivateFile(p, 'pb_sk_new');
+            expect(readFileSync(early, 'utf8')).toBe('old');
+        }
+        finally {
+            closeSync(early);
+        }
+        expect(readFileSync(p, 'utf8')).toBe('pb_sk_new');
+        expect(readdirSync(d)).toEqual(['preview-admin.json']); // no temp file left behind
+    });
+    it('a symlinked target keeps its link: the file it points at is replaced (dotfiles-managed configs)', () => {
+        const d = scratch();
+        const real = join(d, 'dotfiles-mcp.json');
+        const link = join(d, 'mcp.json');
+        writeFileSync(real, 'old', { mode: 0o644 });
+        symlinkSync(real, link);
+        writePrivateFile(link, 'pb_sk_new');
+        expect(lstatSync(link).isSymbolicLink()).toBe(true);
+        expect(readlinkSync(link)).toBe(real);
+        expect(readFileSync(real, 'utf8')).toBe('pb_sk_new');
+        expect(mode(real)).toBe(0o600);
+        expect(readdirSync(d).sort()).toEqual(['dotfiles-mcp.json', 'mcp.json']);
+    });
+    it('a dangling symlink keeps its link: the file it names is created at 0600 (Codex P2 on #1988)', () => {
+        const d = scratch();
+        const real = join(d, 'dotfiles-mcp.json');
+        const link = join(d, 'mcp.json');
+        symlinkSync('dotfiles-mcp.json', link); // relative, and nothing there yet
+        writePrivateFile(link, 'pb_sk_new');
+        expect(lstatSync(link).isSymbolicLink()).toBe(true);
+        expect(readFileSync(real, 'utf8')).toBe('pb_sk_new');
+        expect(mode(real)).toBe(0o600);
+        expect(readdirSync(d).sort()).toEqual(['dotfiles-mcp.json', 'mcp.json']);
+    });
+    it('a symlink loop is refused, not followed forever', () => {
+        const d = scratch();
+        symlinkSync(join(d, 'b'), join(d, 'a'));
+        symlinkSync(join(d, 'a'), join(d, 'b'));
+        expect(() => writePrivateFile(join(d, 'a'), 'x')).toThrow();
+    });
+    it('exclusive refuses a file that is there', () => {
+        const p = join(scratch(), 'profile');
+        writePrivateFile(p, 'a', { exclusive: true });
+        expect(() => writePrivateFile(p, 'b', { exclusive: true })).toThrow(expect.objectContaining({ code: 'EEXIST' }));
+    });
+});
+//# sourceMappingURL=privateFile.test.js.map

package/dist/lib/privateFile.test.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"privateFile.test.js","sourceRoot":"","sources":["../../src/lib/privateFile.test.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,QAAQ,EAAE,WAAW,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,IAAI,CAAC;AACxJ,OAAO,EAAE,MAAM,EAAE,MAAM,IAAI,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,QAAQ,CAAC;AACzD,OAAO,EAAE,gBAAgB,EAAE,MAAM,eAAe,CAAC;AAEjD,MAAM,IAAI,GAAa,EAAE,CAAC;AAC1B,MAAM,OAAO,GAAG,GAAG,EAAE,GAAG,MAAM,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1G,MAAM,IAAI,GAAG,CAAC,CAAS,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC;AACrD,SAAS,CAAC,GAAG,EAAE,GAAG,KAAK,MAAM,CAAC,IAAI,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC;IAAE,MAAM,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AAElG,QAAQ,CAAC,kBAAkB,EAAE,GAAG,EAAE;IAChC,EAAE,CAAC,wBAAwB,EAAE,GAAG,EAAE;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,UAAU,CAAC,CAAC;QACtC,gBAAgB,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6CAA6C,EAAE,GAAG,EAAE;QACrD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,mBAAmB,CAAC,CAAC;QAC/C,aAAa,CAAC,CAAC,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC1C,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC5B,gBAAgB,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;QACjD,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAC9B,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,sFAAsF,EAAE,GAAG,EAAE;QAC9F,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,EAAE,oBAAoB,CAAC,CAAC;QACxC,aAAa,CAAC,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QACzC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;QAC/B,IAAI,CAAC;YACH,gBAAgB,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;YACjC,MAAM,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAClD,CAAC;gBAAS,CAAC;YACT,SAAS,CAAC,KAAK,CAAC,CAAC;QACnB,CAAC;QACD,MAAM,CAAC,YAAY,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QAClD,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC,2BAA2B;IACrF,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iGAAiG,EAAE,GAAG,EAAE;QACzG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACjC,aAAa,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAC5C,WAAW,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;QACxB,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtC,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,6FAA6F,EAAE,GAAG,EAAE;QACrG,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,mBAAmB,CAAC,CAAC;QAC1C,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,EAAE,UAAU,CAAC,CAAC;QACjC,WAAW,CAAC,mBAAmB,EAAE,IAAI,CAAC,CAAC,CAAC,kCAAkC;QAC1E,gBAAgB,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC;QACpC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,cAAc,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACpD,MAAM,CAAC,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC;QACrD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC/B,MAAM,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC,CAAC,OAAO,CAAC,CAAC,mBAAmB,EAAE,UAAU,CAAC,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,iDAAiD,EAAE,GAAG,EAAE;QACzD,MAAM,CAAC,GAAG,OAAO,EAAE,CAAC;QACpB,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;QACxC,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;IAC9D,CAAC,CAAC,CAAC;IAEH,EAAE,CAAC,wCAAwC,EAAE,GAAG,EAAE;QAChD,MAAM,CAAC,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC,CAAC;QACrC,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC9C,MAAM,CAAC,GAAG,EAAE,CAAC,gBAAgB,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,CAAC,CAAC,CAAC;IACnH,CAAC,CAAC,CAAC;AACL,CAAC,CAAC,CAAC"}