@productbrain/cli 0.1.0-beta.29 → 0.1.0-beta.2914

package/dist/lib/canonicalRefs.js

@@ -0,0 +1,150 @@
+/**
+ * Synced from convex/lib/canonicalRefs.ts (WP-345: canonical refs, NG4: CLI import boundary).
+ */
+/**
+ * Canonical Refs — pure parser for semantic ref syntax.
+ *
+ * Zero Convex imports. This file is drift-synced to:
+ *   - packages/cli/src/lib/canonicalRefs.ts (CLI copy — identical logic)
+ *   - packages/mcp-server/src/lib/canonicalRefs.ts (MCP copy — identical logic)
+ *
+ * NG4 (WP-345): CLI/MCP MUST NOT import the resolver (convex/canonicalRefs.ts).
+ * They import only this pure parser module.
+ *
+ * DEC-A/WP-354: semantic refs syntax is {{ref:canonicalKey}},
+ * {{ref:canonicalKey:display}}, {{ref:domain:data/analytics}}, or
+ * {{ref:entry:DEC-123}}.
+ * Chain: WP-345 E4, DEC-K (projection hash trailer)
+ *
+ * WP-436 S1 — Axis 2 vocabulary resolver (DEC-1021, STD-253):
+ * {{vocab:<canonicalKey>.<form>}} tokens + getCollectionLabel resolver.
+ * PAT-230: resolver is pure — no Convex import, workspace context passed as arg.
+ */
+/**
+ * Regex for matching semantic refs. Captures: [1] ref key/path, [2] optional display label.
+ */
+const SEMANTIC_REF_REGEX = /\{\{ref:([a-zA-Z0-9_./-]+(?::[a-zA-Z0-9_./-]+)?)(?::([^}]+))?\}\}/g;
+/**
+ * Extracts canonical keys from a body string.
+ * Handles {{ref:key}} and {{ref:key:display}}.
+ *
+ * Returns deduplicated array of canonical keys in order of first appearance.
+ */
+export function parseSemanticRefs(body) {
+    if (!body || body.length === 0)
+        return [];
+    const keys = [];
+    const seen = new Set();
+    // Reset lastIndex for global regex before each use
+    const regex = new RegExp(SEMANTIC_REF_REGEX.source, 'g');
+    let match;
+    while ((match = regex.exec(body)) !== null) {
+        const key = match[1];
+        if (key && !seen.has(key)) {
+            seen.add(key);
+            keys.push(key);
+        }
+    }
+    return keys;
+}
+/**
+ * Renders a resolved ref for display in projected output.
+ * Falls back to the raw key wrapped in brackets if no resolved name is available.
+ *
+ * Examples:
+ *   renderSemanticRef('bet', 'Active Bets')  → 'Active Bets'
+ *   renderSemanticRef('bet')                 → '[bet]'
+ *   renderSemanticRef('bet', undefined)      → '[bet]'
+ */
+export function renderSemanticRef(key, resolvedName) {
+    if (resolvedName && resolvedName.trim().length > 0) {
+        return resolvedName.trim();
+    }
+    return `[${key}]`;
+}
+/**
+ * Replaces all semantic refs in a body string with their resolved display names.
+ *
+ * resolvedMap: Map<canonicalKey, resolvedName> — keys not in the map are rendered
+ * as [unresolved: key] to make missing refs visible.
+ */
+export function replaceSemanticRefs(body, resolvedMap) {
+    if (!body || body.length === 0)
+        return body;
+    const regex = new RegExp(SEMANTIC_REF_REGEX.source, 'g');
+    return body.replace(regex, (_match, key, displayLabel) => {
+        // If an inline display label is provided, it takes precedence over the resolved name
+        if (displayLabel && displayLabel.trim().length > 0) {
+            return displayLabel.trim();
+        }
+        const resolved = resolvedMap.get(key);
+        if (resolved) {
+            return resolved;
+        }
+        return `[unresolved: ${key}]`;
+    });
+}
+/**
+ * Regex for matching vocab tokens: {{vocab:<canonicalKey>.<form>}}
+ * STD-253: canonicalKey + form are both lowercase snake_case.
+ * Captures: [1] canonicalKey, [2] form.
+ */
+export const VOCAB_TOKEN_REGEX = /\{\{vocab:([a-z_]+)\.([a-z_]+)\}\}/g;
+/**
+ * Resolve the display label for a canonical type + form.
+ *
+ * Resolution chain (DEC-1021):
+ *   1. workspaceCtx.collectionLabels[canonicalKey][form]  — workspace override
+ *   2. collectionCtx.labels[form]                         — collection default
+ *   3. canonicalKey literal                               — fallback (no throw)
+ *
+ * Pure function. No Convex imports. No side effects. (PAT-230)
+ *
+ * @param canonicalKey - e.g. 'work_package', 'decision'
+ * @param form - e.g. 'singular', 'plural', 'verb_start'
+ * @param workspaceCtx - optional workspace-level override context
+ * @param collectionCtx - optional collection-level default context
+ * @returns resolved label string
+ */
+export function getCollectionLabel(canonicalKey, form, workspaceCtx, collectionCtx) {
+    // Layer 1: workspace override
+    const wsLabels = workspaceCtx?.collectionLabels?.[canonicalKey];
+    if (wsLabels) {
+        const wsVal = wsLabels[form];
+        if (wsVal !== undefined && wsVal.length > 0)
+            return wsVal;
+    }
+    // Layer 2: explicit collection ctx (granular call sites — handshake projector)
+    const colLabels = collectionCtx?.labels;
+    if (colLabels) {
+        const colVal = colLabels[form];
+        if (colVal !== undefined && colVal.length > 0)
+            return colVal;
+    }
+    // Layer 2.5: collection defaults from WorkspaceVocabCtx (threaded via chain.getVocabulary)
+    // New: wires the dead Layer 2 path for consumers that don't pass explicit collectionCtx.
+    const defaultLabels = workspaceCtx?.collectionDefaults?.[canonicalKey];
+    if (defaultLabels) {
+        const defVal = defaultLabels[form];
+        if (defVal !== undefined && defVal.length > 0)
+            return defVal;
+    }
+    // Layer 3: canonicalKey literal fallback
+    return canonicalKey;
+}
+/**
+ * Replace all {{vocab:<canonicalKey>.<form>}} tokens in a string.
+ *
+ * For each token, calls getCollectionLabel with the provided contexts.
+ * STD-253.
+ */
+export function replaceVocabTokens(body, workspaceCtx, collectionCtxMap) {
+    if (!body || body.length === 0)
+        return body;
+    const regex = new RegExp(VOCAB_TOKEN_REGEX.source, 'g');
+    return body.replace(regex, (_match, canonicalKey, form) => {
+        const collectionCtx = collectionCtxMap?.get(canonicalKey);
+        return getCollectionLabel(canonicalKey, form, workspaceCtx, collectionCtx);
+    });
+}
+//# sourceMappingURL=canonicalRefs.js.map

package/dist/lib/canonicalRefs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"canonicalRefs.js","sourceRoot":"","sources":["../../src/lib/canonicalRefs.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH;;;;;;;;;;;;;;;;;;GAkBG;AAkCH;;GAEG;AACH,MAAM,kBAAkB,GAAG,oEAAoE,CAAC;AAEhG;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,IAAY;IAC7C,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IAE1C,MAAM,IAAI,GAAa,EAAE,CAAC;IAC1B,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;IAE/B,mDAAmD;IACnD,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACzD,IAAI,KAA6B,CAAC;IAElC,OAAO,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC;QACrB,IAAI,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YAC3B,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACd,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAChB,CAAC;IACF,CAAC;IAED,OAAO,IAAI,CAAC;AACb,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,iBAAiB,CAAC,GAAW,EAAE,YAAqB;IACnE,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACpD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;IAC5B,CAAC;IACD,OAAO,IAAI,GAAG,GAAG,CAAC;AACnB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,mBAAmB,CAAC,IAAY,EAAE,WAAgC;IACjF,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAEzD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,GAAW,EAAE,YAAgC,EAAE,EAAE;QACpF,qFAAqF;QACrF,IAAI,YAAY,IAAI,YAAY,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACpD,OAAO,YAAY,CAAC,IAAI,EAAE,CAAC;QAC5B,CAAC;QACD,MAAM,QAAQ,GAAG,WAAW,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QACtC,IAAI,QAAQ,EAAE,CAAC;YACd,OAAO,QAAQ,CAAC;QACjB,CAAC;QACD,OAAO,gBAAgB,GAAG,GAAG,CAAC;IAC/B,CAAC,CAAC,CAAC;AACJ,CAAC;AAiDD;;;;GAIG;AACH,MAAM,CAAC,MAAM,iBAAiB,GAAG,qCAAqC,CAAC;AAEvE;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CACjC,YAAoB,EACpB,IAAY,EACZ,YAAgC,EAChC,aAAkC;IAElC,8BAA8B;IAC9B,MAAM,QAAQ,GAAG,YAAY,EAAE,gBAAgB,EAAE,CAAC,YAAY,CAAC,CAAC;IAChE,IAAI,QAAQ,EAAE,CAAC;QACd,MAAM,KAAK,GAAI,QAA+C,CAAC,IAAI,CAAC,CAAC;QACrE,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;IAC3D,CAAC;IAED,+EAA+E;IAC/E,MAAM,SAAS,GAAG,aAAa,EAAE,MAAM,CAAC;IACxC,IAAI,SAAS,EAAE,CAAC;QACf,MAAM,MAAM,GAAI,SAAgD,CAAC,IAAI,CAAC,CAAC;QACvE,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IAC9D,CAAC;IAED,2FAA2F;IAC3F,yFAAyF;IACzF,MAAM,aAAa,GAAG,YAAY,EAAE,kBAAkB,EAAE,CAAC,YAAY,CAAC,CAAC;IACvE,IAAI,aAAa,EAAE,CAAC;QACnB,MAAM,MAAM,GAAI,aAAoD,CAAC,IAAI,CAAC,CAAC;QAC3E,IAAI,MAAM,KAAK,SAAS,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,MAAM,CAAC;IAC9D,CAAC;IAED,yCAAyC;IACzC,OAAO,YAAY,CAAC;AACrB,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,kBAAkB,CACjC,IAAY,EACZ,YAAgC,EAChC,gBAAkD;IAElD,IAAI,CAAC,IAAI,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE5C,MAAM,KAAK,GAAG,IAAI,MAAM,CAAC,iBAAiB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IAExD,OAAO,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,YAAoB,EAAE,IAAY,EAAE,EAAE;QACzE,MAAM,aAAa,GAAG,gBAAgB,EAAE,GAAG,CAAC,YAAY,CAAC,CAAC;QAC1D,OAAO,kBAAkB,CAAC,YAAY,EAAE,IAAI,EAAE,YAAY,EAAE,aAAa,CAAC,CAAC;IAC5E,CAAC,CAAC,CAAC;AACJ,CAAC"}

package/dist/lib/client.d.ts

@@ -9,6 +9,7 @@
  * sandboxed environments (Claude Code, Cursor) without requiring
  * NODE_OPTIONS="--use-env-proxy".
  */
+import { CLIError } from './errors.js';
 /** Structured field-level detail from a VALIDATION_FAILED response. */
 export interface ValidationErrorDetail {
     fieldKey: string;
@@ -18,15 +19,44 @@ export interface ValidationErrorDetail {
     errorType: 'type_mismatch' | 'invalid_option' | 'required';
     message: string;
 }
-/** Error thrown by mcpCall/mcpCallWithSession when the server returns a non-OK response. */
-export declare class McpError extends Error {
+/** Error thrown by kernelCall/kernelCallWithSession when the server returns a non-OK response. */
+export declare class McpError extends CLIError {
     details?: ValidationErrorDetail[];
-    code?: string;
     constructor(message: string, code?: string, details?: ValidationErrorDetail[]);
 }
-export declare function mcpCall<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
+/** Result of validateKey — used by `pb login` to verify a key before saving. */
+export type ValidateKeyResult = {
+    valid: true;
+    workspaceId: string;
+} | {
+    valid: false;
+    error: string;
+};
 /**
- * mcpCall variant that injects X-Agent-Session-Id header for write operations.
+ * Validate an API key against the server before saving it.
+ * Uses `resolveWorkspace` as a lightweight health check — if it returns data, the key works.
+ *
+ * Returns { valid: true, workspaceId } on success.
+ * Returns { valid: false, error } on auth failure (401) or other server error.
+ * Throws on network/timeout errors so the caller can distinguish "bad key" from "can't reach server".
+ */
+export declare function validateKey(apiKey: string, siteUrl: string, timeoutMs?: number): Promise<ValidateKeyResult>;
+/** Get a human-friendly spinner label for an MCP function name. */
+export declare function spinnerLabel(fn: string): string;
+/**
+ * POST to the admin gateway (/api/admin) — separate from /api/aki (STD-101, BR-109).
+ * Admin operations are not knowledge operations — they target the operator surface.
+ *
+ * No built-in spinner: callers wrap with withSpinner when appropriate.
+ * Throws CLIError on auth failure or non-OK response.
+ */
+export declare function adminCall(command: string, args?: Record<string, unknown>): Promise<unknown>;
+export declare function kernelCall<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
+/**
+ * kernelCall variant for write operations. Callers that need server-side session
+ * validation (e.g. `chain.verifyEntry`) pass `sessionId` in `args` explicitly —
+ * it now travels in the request body, not a header (http.ts never read the old
+ * `X-Agent-Session-Id` header).
  * All write commands (update, relate, unrelate, capture) should use this.
  *
  * After a successful write, fires a non-blocking `agent.touchSession` call to
@@ -35,5 +65,5 @@ export declare function mcpCall<T = unknown>(fn: string, args?: Record<string, u
  * are silently swallowed. No touch is attempted if no session is active or if
  * the write itself fails.
  */
-export declare function mcpCallWithSession<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
+export declare function kernelCallWithSession<T = unknown>(fn: string, args?: Record<string, unknown>): Promise<T>;
 //# sourceMappingURL=client.d.ts.map

package/dist/lib/client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAKH,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,UAAU,CAAC;IAC3D,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,4FAA4F;AAC5F,qBAAa,QAAS,SAAQ,KAAK;IACjC,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;IAClC,IAAI,CAAC,EAAE,MAAM,CAAC;gBAEF,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,EAAE;CAM9E;AAuCD,wBAAsB,OAAO,CAAC,CAAC,GAAG,OAAO,EACvC,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CAsBZ;AAED;;;;;;;;;GASG;AACH,wBAAsB,kBAAkB,CAAC,CAAC,GAAG,OAAO,EAClD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CAoCZ"}
+{"version":3,"file":"client.d.ts","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAIH,OAAO,EAAE,QAAQ,EAAa,MAAM,aAAa,CAAC;AAKlD,uEAAuE;AACvE,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,YAAY,EAAE,OAAO,CAAC;IACtB,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,EAAE,eAAe,GAAG,gBAAgB,GAAG,UAAU,CAAC;IAC3D,OAAO,EAAE,MAAM,CAAC;CACjB;AA8CD,kGAAkG;AAClG,qBAAa,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAAC,EAAE,qBAAqB,EAAE,CAAC;gBAEtB,OAAO,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,qBAAqB,EAAE;CAc9E;AA2DD,gFAAgF;AAChF,MAAM,MAAM,iBAAiB,GACzB;IAAE,KAAK,EAAE,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAA;CAAE,GACpC;IAAE,KAAK,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAEpC;;;;;;;GAOG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,OAAO,EAAE,MAAM,EACf,SAAS,SAAO,GACf,OAAO,CAAC,iBAAiB,CAAC,CAqC5B;AA6BD,mEAAmE;AACnE,wBAAgB,YAAY,CAAC,EAAE,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED;;;;;;GAMG;AACH,wBAAsB,SAAS,CAC7B,OAAO,EAAE,MAAM,EACf,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC7B,OAAO,CAAC,OAAO,CAAC,CAsBlB;AASD,wBAAsB,UAAU,CAAC,CAAC,GAAG,OAAO,EAC1C,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CA2BZ;AA0BD;;;;;;;;;;;;GAYG;AACH,wBAAsB,qBAAqB,CAAC,CAAC,GAAG,OAAO,EACrD,EAAE,EAAE,MAAM,EACV,IAAI,GAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAM,GACjC,OAAO,CAAC,CAAC,CAAC,CAuCZ"}

package/dist/lib/client.js

@@ -9,19 +9,82 @@
  * sandboxed environments (Claude Code, Cursor) without requiring
  * NODE_OPTIONS="--use-env-proxy".
  */
-import { getConfig } from './config.js';
+import { getConfig, resolveAdminConfig } from './config.js';
 import { readSession } from './session.js';
-/** Error thrown by mcpCall/mcpCallWithSession when the server returns a non-OK response. */
-export class McpError extends Error {
+import { CLIError, ErrorCode } from './errors.js';
+import { withSpinner } from './spinner.js';
+import { recordServerLatest } from './update-check.js';
+/**
+ * Map MCP server error codes to CLIError categories.
+ * Keeps backward compat: McpError.code is still a free string from the server,
+ * but category and guidance are derived for the global error handler.
+ */
+function mcpCodeToCategory(code) {
+    if (!code)
+        return 'internal';
+    if (code.startsWith('AUTH') || code === 'UNAUTHORIZED')
+        return 'auth';
+    if (code === 'VALIDATION_FAILED' ||
+        code === 'QUALITY_GATE_BLOCKED' ||
+        code === 'GROUNDING_GATE_BLOCKED' ||
+        code === 'SEMANTIC_QUALITY_GATE_BLOCKED' ||
+        // WP-485 Slice 2b (FEAT-1370): commitEntry's contradiction gate (dead-but-typed while
+        // DEC-1321 keeps `graduated: false` — see promote.ts's handling) throws this on block.
+        // A 400 the caller fixes by resolving the contradiction, not an internal fault.
+        code === 'CONTRADICTION_BLOCKED' ||
+        // WP-477 / FEAT-1350: both are 400s the caller fixes by changing an argument
+        // (pass the issued cursor verbatim / ask for a smaller numItems) — not internal faults.
+        code === 'CURSOR_QUERY_MISMATCH' ||
+        code === 'PAGE_SPLIT_REQUIRED' ||
+        // TEN-2647: Convex's own arg-validator rejection — a 400 the caller fixes by correcting
+        // the offending argument (missing/unknown/wrong-typed), not an internal fault.
+        code === 'ARGUMENT_VALIDATION_FAILED' ||
+        // WP-494 (TEN-2742): `pb feedback submit` refused because the workspace switched off
+        // agent-submitted feedback — a policy gate, not an internal fault (mirrors the
+        // GATE_BLOCKED family above).
+        code === 'AGENT_FEEDBACK_DISABLED')
+        return 'validation';
+    if (code === 'SESSION_REQUIRED')
+        return 'session';
+    // TEN-656: per-key API quota — a 429 the caller fixes by WAITING, not by changing the
+    // call. Categorized as network so the global handler renders it as retryable, never
+    // as an internal fault.
+    if (code === 'rate-limited')
+        return 'network';
+    return 'internal';
+}
+function normalizeMcpCode(code) {
+    // Convex names the internal protocol condition; the public CLI exposes its
+    // stable, harness-independent error taxonomy to people and agents.
+    if (code === 'AUTHZ_PERMISSION_DENIED')
+        return ErrorCode.AUTH_DENIED;
+    return code ?? ErrorCode.INTERNAL;
+}
+/** Error thrown by kernelCall/kernelCallWithSession when the server returns a non-OK response. */
+export class McpError extends CLIError {
     details;
-    code;
     constructor(message, code, details) {
-        super(message);
+        super(message, {
+            code: normalizeMcpCode(code),
+            category: mcpCodeToCategory(code),
+            // TEN-656 / TEN-2655: the rate-limit refusal must be agent-legible — say exactly
+            // what to do (wait, then retry unchanged), because autonomous chained runs have
+            // no human to interpret a bare 429.
+            guidance: code === 'rate-limited'
+                ? 'This API key hit its request quota (HTTP 429). Wait the number of seconds in the message (also in the Retry-After header), then retry the same call unchanged — it is safe to retry.'
+                : undefined,
+        });
         this.name = 'McpError';
-        this.code = code;
         this.details = details;
     }
 }
+function recordLatestFromResponse(res) {
+    recordServerLatest(res.headers?.get?.('pb-latest-cli-version') ?? null);
+}
+async function parseKernelEnvelope(res) {
+    recordLatestFromResponse(res);
+    return (await res.json().catch(() => ({})));
+}
 // Configure proxy at module load — runs once, before any fetch call.
 // Node.js fetch (undici) ignores HTTPS_PROXY env vars. We detect the proxy
 // and install a ProxyAgent as the global dispatcher so all fetch() calls
@@ -42,46 +105,180 @@ function rethrowWithGuidance(err, siteUrl) {
     if (msg === 'fetch failed' || msg.includes('ECONNREFUSED') || msg.includes('ENOTFOUND')) {
         const host = new URL(siteUrl).hostname;
         const proxy = process.env.https_proxy || process.env.HTTPS_PROXY;
-        // When a proxy is set, the sandbox is routing traffic through it.
-        // Node.js fetch (undici) does NOT respect proxy env vars by default.
-        // The fix is --use-env-proxy (Node 22.14+), not adding the host to the allowlist.
         const proxyHint = proxy
             ? `A proxy is configured (${proxy}) but Node.js fetch() is not using it.\n` +
                 `Fix: set NODE_OPTIONS="--use-env-proxy" in your environment,\n` +
-                `  or re-run with: NODE_OPTIONS="--use-env-proxy" pb <command>\n`
+                `  or re-run with: NODE_OPTIONS="--use-env-proxy" pb <command>`
             : `If you are running inside an AI code editor sandbox (Claude Code, Cursor, etc.),\n` +
                 `the sandbox may be blocking outbound connections.\n\n` +
                 `Fix: add "${host}" to your sandbox network allowlist.\n` +
-                `  • Claude Code: run /sandbox → add network host\n` +
-                `  • Or re-run: pb handshake --init (configures sandbox automatically)\n`;
-        throw new Error(`Could not reach ${host}.\n\n${proxyHint}`);
+                `  - Claude Code: run /sandbox -> add network host\n` +
+                `  - Or re-run: pb handshake --init (configures sandbox automatically)`;
+        throw new CLIError(`Could not reach ${host}.`, {
+            code: ErrorCode.NETWORK_UNREACHABLE,
+            category: 'network',
+            guidance: proxyHint,
+        });
     }
     throw err;
 }
-export async function mcpCall(fn, args = {}) {
-    const { apiKey, siteUrl } = getConfig();
+/**
+ * Validate an API key against the server before saving it.
+ * Uses `resolveWorkspace` as a lightweight health check — if it returns data, the key works.
+ *
+ * Returns { valid: true, workspaceId } on success.
+ * Returns { valid: false, error } on auth failure (401) or other server error.
+ * Throws on network/timeout errors so the caller can distinguish "bad key" from "can't reach server".
+ */
+export async function validateKey(apiKey, siteUrl, timeoutMs = 5000) {
+    return withSpinner('Validating API key', async () => {
+        const controller = new AbortController();
+        const timer = setTimeout(() => controller.abort(), timeoutMs);
+        try {
+            const res = await fetch(`${siteUrl}/api/aki`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${apiKey}`,
+                },
+                body: JSON.stringify({ fn: 'resolveWorkspace', args: {} }),
+                signal: controller.signal,
+            });
+            clearTimeout(timer);
+            // Record header BEFORE the 401/403 short-circuit — auth-fail responses still carry the version skew signal.
+            recordLatestFromResponse(res);
+            if (res.status === 401 || res.status === 403) {
+                return { valid: false, error: 'Invalid API key.' };
+            }
+            const envelope = await parseKernelEnvelope(res);
+            if (!res.ok || envelope.ok === false) {
+                return { valid: false, error: envelope.message || envelope.error || `Server error (${res.status})` };
+            }
+            return { valid: true, workspaceId: envelope.data?._id ?? 'unknown' };
+        }
+        catch (err) {
+            clearTimeout(timer);
+            // Re-throw network/timeout errors — caller handles the "offline" case
+            throw err;
+        }
+    });
+}
+/**
+ * Map MCP function names to human-friendly spinner labels.
+ * Unknown functions get a generic fallback.
+ */
+const SPINNER_LABELS = {
+    orient: 'Loading workspace overview',
+    'entries.get': 'Loading entry',
+    'entries.search': 'Searching entries',
+    'entries.create': 'Creating entry',
+    'entries.update': 'Updating entry',
+    'capture-quick': 'Capturing to Chain',
+    'propose-capture': 'Preparing capture',
+    'commit-entry': 'Committing entry',
+    'agent.startSession': 'Starting session',
+    'agent.closeSession': 'Closing session',
+    'agent.touchSession': 'Refreshing session',
+    resolveWorkspace: 'Resolving workspace',
+    'onboarding.chat': 'Thinking',
+    context: 'Loading context',
+    'entries.relate': 'Creating relation',
+    'entries.unrelate': 'Removing relation',
+    constellation: 'Loading constellation',
+    'conflicts.list': 'Loading open conflicts',
+    'conflicts.resolve': 'Recording verdict',
+    'conflicts.summary': 'Loading precision summary',
+};
+/** Get a human-friendly spinner label for an MCP function name. */
+export function spinnerLabel(fn) {
+    return SPINNER_LABELS[fn] || `Loading ${fn.replace(/\./g, ' ')}`;
+}
+/**
+ * POST to the admin gateway (/api/admin) — separate from /api/aki (STD-101, BR-109).
+ * Admin operations are not knowledge operations — they target the operator surface.
+ *
+ * No built-in spinner: callers wrap with withSpinner when appropriate.
+ * Throws CLIError on auth failure or non-OK response.
+ */
+export async function adminCall(command, args) {
+    const { apiKey, siteUrl } = resolveAdminConfig();
     let res;
     try {
-        res = await fetch(`${siteUrl}/api/mcp`, {
+        res = await fetch(`${siteUrl}/api/admin`, {
             method: 'POST',
             headers: {
                 'Content-Type': 'application/json',
                 Authorization: `Bearer ${apiKey}`,
             },
-            body: JSON.stringify({ fn, args }),
+            body: JSON.stringify({ command, args }),
         });
     }
     catch (err) {
         rethrowWithGuidance(err, siteUrl);
     }
-    const json = (await res.json());
-    if (!res.ok || json.error) {
-        throw new McpError(json.error ?? res.statusText, json.code, json.details);
+    const response = (await res.json().catch(() => ({})));
+    if (response.ok === false || (!res.ok && response.ok == null)) {
+        throw new McpError((response.message ?? response.error ?? res.statusText) || 'Admin request failed', response.code);
     }
-    return json.data;
+    return response.data;
+}
+/**
+ * Connector identity for the gateway's context.served shared seam (DEC-1207). Sent as the
+ * `x-pb-source` header on gateway calls so the server-side emit can attribute this connector;
+ * the gateway defaults to `api` if it is ever absent.
+ */
+const PB_TELEMETRY_SOURCE = 'cli';
+export async function kernelCall(fn, args = {}) {
+    const { apiKey, siteUrl } = getConfig();
+    const label = spinnerLabel(fn);
+    return withSpinner(label, async () => {
+        let res;
+        try {
+            res = await fetch(`${siteUrl}/api/aki`, {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json',
+                    Authorization: `Bearer ${apiKey}`,
+                    // DEC-1207: attribute this connector for the gateway's context.served seam.
+                    'x-pb-source': PB_TELEMETRY_SOURCE,
+                },
+                body: JSON.stringify({ fn, args }),
+            });
+        }
+        catch (err) {
+            rethrowWithGuidance(err, siteUrl);
+        }
+        const envelope = await parseKernelEnvelope(res);
+        if (!res.ok || envelope.ok === false) {
+            throw new McpError(envelope.message || envelope.error || res.statusText, envelope.code, envelope.details);
+        }
+        return envelope.data;
+    });
 }
 /**
- * mcpCall variant that injects X-Agent-Session-Id header for write operations.
+ * Raw fetch to the gateway — no spinner, swallows errors.
+ * Used for fire-and-forget operations (e.g. session touch) where visible feedback is noise.
+ */
+async function mcpFetchRaw(fn, args, apiKey, siteUrl) {
+    try {
+        await fetch(`${siteUrl}/api/aki`, {
+            method: 'POST',
+            headers: {
+                'Content-Type': 'application/json',
+                Authorization: `Bearer ${apiKey}`,
+            },
+            body: JSON.stringify({ fn, args }),
+        });
+    }
+    catch {
+        // Best-effort — silently swallow all errors
+    }
+}
+/**
+ * kernelCall variant for write operations. Callers that need server-side session
+ * validation (e.g. `chain.verifyEntry`) pass `sessionId` in `args` explicitly —
+ * it now travels in the request body, not a header (http.ts never read the old
+ * `X-Agent-Session-Id` header).
  * All write commands (update, relate, unrelate, capture) should use this.
  *
  * After a successful write, fires a non-blocking `agent.touchSession` call to
@@ -90,37 +287,40 @@ export async function mcpCall(fn, args = {}) {
  * are silently swallowed. No touch is attempted if no session is active or if
  * the write itself fails.
  */
-export async function mcpCallWithSession(fn, args = {}) {
+export async function kernelCallWithSession(fn, args = {}) {
     const { apiKey, siteUrl } = getConfig();
     const session = readSession();
+    const label = spinnerLabel(fn);
     const headers = {
         'Content-Type': 'application/json',
         Authorization: `Bearer ${apiKey}`,
+        // DEC-1207: attribute this connector for the gateway's context.served seam.
+        'x-pb-source': PB_TELEMETRY_SOURCE,
     };
-    if (session?.sessionId) {
-        headers['X-Agent-Session-Id'] = session.sessionId;
-    }
-    let res;
-    try {
-        res = await fetch(`${siteUrl}/api/mcp`, {
-            method: 'POST',
-            headers,
-            body: JSON.stringify({ fn, args }),
-        });
-    }
-    catch (err) {
-        rethrowWithGuidance(err, siteUrl);
-    }
-    const json = (await res.json());
-    if (!res.ok || json.error) {
-        throw new McpError(json.error ?? res.statusText, json.code, json.details);
-    }
+    const result = await withSpinner(label, async () => {
+        let res;
+        try {
+            res = await fetch(`${siteUrl}/api/aki`, {
+                method: 'POST',
+                headers,
+                body: JSON.stringify({ fn, args }),
+            });
+        }
+        catch (err) {
+            rethrowWithGuidance(err, siteUrl);
+        }
+        const envelope = await parseKernelEnvelope(res);
+        if (!res.ok || envelope.ok === false) {
+            throw new McpError(envelope.message || envelope.error || res.statusText, envelope.code, envelope.details);
+        }
+        return envelope.data;
+    });
     // Fire-and-forget session touch — best-effort, never blocks the write response.
-    // Only touch when a session is active. Uses mcpCall (not mcpCallWithSession) to
-    // avoid recursion.
+    // Uses mcpFetchRaw (not kernelCall) to avoid recursion and suppress the visible spinner
+    // that would appear if kernelCall were used here (background ops are silent noise).
     if (session?.sessionId) {
-        mcpCall('agent.touchSession', { sessionId: session.sessionId }).catch(() => { });
+        void mcpFetchRaw('agent.touchSession', { sessionId: session.sessionId }, apiKey, siteUrl);
     }
-    return json.data;
+    return result;
 }
 //# sourceMappingURL=client.js.map

package/dist/lib/client.js.map

@@ -1 +1 @@
-{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AACxC,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAY3C,4FAA4F;AAC5F,MAAM,OAAO,QAAS,SAAQ,KAAK;IACjC,OAAO,CAA2B;IAClC,IAAI,CAAU;IAEd,YAAY,OAAe,EAAE,IAAa,EAAE,OAAiC;QAC3E,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,IAAI,GAAG,IAAI,CAAC;QACjB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AACjD,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnE,mBAAmB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAAC,MAAM,CAAC;IACP,8EAA8E;AAChF,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,GAAY,EAAE,OAAe;IACxD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACjE,kEAAkE;QAClE,qEAAqE;QACrE,kFAAkF;QAClF,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,0BAA0B,KAAK,0CAA0C;gBACzE,gEAAgE;gBAChE,iEAAiE;YACnE,CAAC,CAAC,oFAAoF;gBACpF,uDAAuD;gBACvD,aAAa,IAAI,wCAAwC;gBACzD,oDAAoD;gBACpD,yEAAyE,CAAC;QAC9E,MAAM,IAAI,KAAK,CAAC,mBAAmB,IAAI,QAAQ,SAAS,EAAE,CAAC,CAAC;IAC9D,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAC3B,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IAExC,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmF,CAAC;IAClH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IACD,OAAO,IAAI,CAAC,IAAS,CAAC;AACxB,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAE9B,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,MAAM,EAAE;KAClC,CAAC;IACF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,oBAAoB,CAAC,GAAG,OAAO,CAAC,SAAS,CAAC;IACpD,CAAC;IAED,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YACtC,MAAM,EAAE,MAAM;YACd,OAAO;YACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAmF,CAAC;IAClH,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,IAAI,CAAC,KAAK,EAAE,CAAC;QAC1B,MAAM,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAC5E,CAAC;IAED,gFAAgF;IAChF,gFAAgF;IAChF,mBAAmB;IACnB,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,OAAO,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;IAClF,CAAC;IAED,OAAO,IAAI,CAAC,IAAS,CAAC;AACxB,CAAC"}
+{"version":3,"file":"client.js","sourceRoot":"","sources":["../../src/lib/client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,EAAE,SAAS,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,aAAa,CAAC;AAElD,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAC3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AAYvD;;;;GAIG;AACH,SAAS,iBAAiB,CAAC,IAAa;IACtC,IAAI,CAAC,IAAI;QAAE,OAAO,UAAU,CAAC;IAC7B,IAAI,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,MAAM,CAAC;IACtE,IACE,IAAI,KAAK,mBAAmB;QAC5B,IAAI,KAAK,sBAAsB;QAC/B,IAAI,KAAK,wBAAwB;QACjC,IAAI,KAAK,+BAA+B;QACxC,sFAAsF;QACtF,uFAAuF;QACvF,gFAAgF;QAChF,IAAI,KAAK,uBAAuB;QAChC,6EAA6E;QAC7E,wFAAwF;QACxF,IAAI,KAAK,uBAAuB;QAChC,IAAI,KAAK,qBAAqB;QAC9B,wFAAwF;QACxF,+EAA+E;QAC/E,IAAI,KAAK,4BAA4B;QACrC,qFAAqF;QACrF,+EAA+E;QAC/E,8BAA8B;QAC9B,IAAI,KAAK,yBAAyB;QAClC,OAAO,YAAY,CAAC;IACtB,IAAI,IAAI,KAAK,kBAAkB;QAAE,OAAO,SAAS,CAAC;IAClD,sFAAsF;IACtF,oFAAoF;IACpF,wBAAwB;IACxB,IAAI,IAAI,KAAK,cAAc;QAAE,OAAO,SAAS,CAAC;IAC9C,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAa;IACtC,2EAA2E;IAC3E,mEAAmE;IACnE,IAAI,IAAI,KAAK,yBAAyB;QAAE,OAAO,SAAS,CAAC,WAAW,CAAC;IACrE,OAAQ,IAAmC,IAAI,SAAS,CAAC,QAAQ,CAAC;AACnE,CAAC;AAED,kGAAkG;AAClG,MAAM,OAAO,QAAS,SAAQ,QAAQ;IACpC,OAAO,CAA2B;IAElC,YAAY,OAAe,EAAE,IAAa,EAAE,OAAiC;QAC3E,KAAK,CAAC,OAAO,EAAE;YAChB,IAAI,EAAE,gBAAgB,CAAC,IAAI,CAAC;YACzB,QAAQ,EAAE,iBAAiB,CAAC,IAAI,CAAC;YACjC,iFAAiF;YACjF,gFAAgF;YAChF,oCAAoC;YACpC,QAAQ,EAAE,IAAI,KAAK,cAAc;gBAC/B,CAAC,CAAC,sLAAsL;gBACxL,CAAC,CAAC,SAAS;SACd,CAAC,CAAC;QACH,IAAI,CAAC,IAAI,GAAG,UAAU,CAAC;QACvB,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF;AAYD,SAAS,wBAAwB,CAAC,GAAa;IAC7C,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,EAAE,CAAC,uBAAuB,CAAC,IAAI,IAAI,CAAC,CAAC;AAC1E,CAAC;AAED,KAAK,UAAU,mBAAmB,CAAI,GAAa;IACjD,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC9B,OAAO,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAsB,CAAC;AACnE,CAAC;AAED,qEAAqE;AACrE,2EAA2E;AAC3E,yEAAyE;AACzE,iDAAiD;AACjD,IAAI,CAAC;IACH,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;IAClE,IAAI,MAAM,EAAE,CAAC;QACX,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,MAAM,MAAM,CAAC,QAAQ,CAAC,CAAC;QACnE,mBAAmB,CAAC,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC,CAAC;IAC9C,CAAC;AACH,CAAC;AAAC,MAAM,CAAC;IACP,8EAA8E;AAChF,CAAC;AAED,yEAAyE;AACzE,SAAS,mBAAmB,CAAC,GAAY,EAAE,OAAe;IACxD,MAAM,GAAG,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;IAC7D,IAAI,GAAG,KAAK,cAAc,IAAI,GAAG,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,CAAC;QACxF,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC,QAAQ,CAAC;QACvC,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC;QACjE,MAAM,SAAS,GAAG,KAAK;YACrB,CAAC,CAAC,0BAA0B,KAAK,0CAA0C;gBACzE,gEAAgE;gBAChE,+DAA+D;YACjE,CAAC,CAAC,oFAAoF;gBACpF,uDAAuD;gBACvD,aAAa,IAAI,wCAAwC;gBACzD,qDAAqD;gBACrD,uEAAuE,CAAC;QAC5E,MAAM,IAAI,QAAQ,CAAC,mBAAmB,IAAI,GAAG,EAAE;YAC7C,IAAI,EAAE,SAAS,CAAC,mBAAmB;YACnC,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;SACpB,CAAC,CAAC;IACL,CAAC;IACD,MAAM,GAAG,CAAC;AACZ,CAAC;AAOD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAe,EACf,SAAS,GAAG,IAAI;IAEhB,OAAO,WAAW,CAAC,oBAAoB,EAAE,KAAK,IAAI,EAAE;QAClD,MAAM,UAAU,GAAG,IAAI,eAAe,EAAE,CAAC;QACzC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,EAAE,EAAE,SAAS,CAAC,CAAC;QAE9D,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBAC5C,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;iBAClC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,EAAE,CAAC;gBAC1D,MAAM,EAAE,UAAU,CAAC,MAAM;aAC1B,CAAC,CAAC;YAEH,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,4GAA4G;YAC5G,wBAAwB,CAAC,GAAG,CAAC,CAAC;YAE9B,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG,EAAE,CAAC;gBAC7C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,kBAAkB,EAAE,CAAC;YACrD,CAAC;YAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAmB,GAAG,CAAC,CAAC;YAElE,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;gBACrC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,iBAAiB,GAAG,CAAC,MAAM,GAAG,EAAE,CAAC;YACvG,CAAC;YAED,OAAO,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,EAAE,QAAQ,CAAC,IAAI,EAAE,GAAG,IAAI,SAAS,EAAE,CAAC;QACvE,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,YAAY,CAAC,KAAK,CAAC,CAAC;YACpB,sEAAsE;YACtE,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,cAAc,GAA2B;IAC7C,MAAM,EAAE,4BAA4B;IACpC,aAAa,EAAE,eAAe;IAC9B,gBAAgB,EAAE,mBAAmB;IACrC,gBAAgB,EAAE,gBAAgB;IAClC,gBAAgB,EAAE,gBAAgB;IAClC,eAAe,EAAE,oBAAoB;IACrC,iBAAiB,EAAE,mBAAmB;IACtC,cAAc,EAAE,kBAAkB;IAClC,oBAAoB,EAAE,kBAAkB;IACxC,oBAAoB,EAAE,iBAAiB;IACvC,oBAAoB,EAAE,oBAAoB;IAC1C,gBAAgB,EAAE,qBAAqB;IACvC,iBAAiB,EAAE,UAAU;IAC7B,OAAO,EAAE,iBAAiB;IAC1B,gBAAgB,EAAE,mBAAmB;IACrC,kBAAkB,EAAE,mBAAmB;IACvC,aAAa,EAAE,uBAAuB;IACtC,gBAAgB,EAAE,wBAAwB;IAC1C,mBAAmB,EAAE,mBAAmB;IACxC,mBAAmB,EAAE,2BAA2B;CACjD,CAAC;AAEF,mEAAmE;AACnE,MAAM,UAAU,YAAY,CAAC,EAAU;IACrC,OAAO,cAAc,CAAC,EAAE,CAAC,IAAI,WAAW,EAAE,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;AACnE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,OAAe,EACf,IAA8B;IAE9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,kBAAkB,EAAE,CAAC;IAEjD,IAAI,GAAa,CAAC;IAClB,IAAI,CAAC;QACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,YAAY,EAAE;YACxC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;SACxC,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IACpC,CAAC;IAEG,MAAM,QAAQ,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAsF,CAAC;IAC/I,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,IAAI,CAAC,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,IAAI,IAAI,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,QAAQ,CAAC,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,CAAC,IAAI,sBAAsB,EAAE,QAAQ,CAAC,IAAI,CAAC,CAAC;IACtH,CAAC;IACD,OAAO,QAAQ,CAAC,IAAI,CAAC;AACvB,CAAC;AAED;;;;GAIG;AACH,MAAM,mBAAmB,GAAG,KAAK,CAAC;AAElC,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAE/B,OAAO,WAAW,CAAC,KAAK,EAAE,KAAK,IAAI,EAAE;QACnC,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE;oBACP,cAAc,EAAE,kBAAkB;oBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;oBACjC,4EAA4E;oBAC5E,aAAa,EAAE,mBAAmB;iBACnC;gBACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAI,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,QAAQ,CAAC,IAAS,CAAC;IAC5B,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,WAAW,CACxB,EAAU,EACV,IAA6B,EAC7B,MAAc,EACd,OAAe;IAEf,IAAI,CAAC;QACH,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;YAChC,MAAM,EAAE,MAAM;YACd,OAAO,EAAE;gBACP,cAAc,EAAE,kBAAkB;gBAClC,aAAa,EAAE,UAAU,MAAM,EAAE;aAClC;YACD,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;SACnC,CAAC,CAAC;IACL,CAAC;IAAC,MAAM,CAAC;QACP,4CAA4C;IAC9C,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,EAAU,EACV,OAAgC,EAAE;IAElC,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,SAAS,EAAE,CAAC;IACxC,MAAM,OAAO,GAAG,WAAW,EAAE,CAAC;IAC9B,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAE/B,MAAM,OAAO,GAA2B;QACtC,cAAc,EAAE,kBAAkB;QAClC,aAAa,EAAE,UAAU,MAAM,EAAE;QACjC,4EAA4E;QAC5E,aAAa,EAAE,mBAAmB;KACnC,CAAC;IAEF,MAAM,MAAM,GAAG,MAAM,WAAW,CAAI,KAAK,EAAE,KAAK,IAAI,EAAE;QACpD,IAAI,GAAa,CAAC;QAClB,IAAI,CAAC;YACH,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,OAAO,UAAU,EAAE;gBACtC,MAAM,EAAE,MAAM;gBACd,OAAO;gBACP,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;aACnC,CAAC,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,mBAAmB,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,mBAAmB,CAAI,GAAG,CAAC,CAAC;QACnD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,QAAQ,CAAC,EAAE,KAAK,KAAK,EAAE,CAAC;YACrC,MAAM,IAAI,QAAQ,CAAC,QAAQ,CAAC,OAAO,IAAI,QAAQ,CAAC,KAAK,IAAI,GAAG,CAAC,UAAU,EAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC;QAC5G,CAAC;QACD,OAAO,QAAQ,CAAC,IAAS,CAAC;IAC5B,CAAC,CAAC,CAAC;IAEH,gFAAgF;IAChF,wFAAwF;IACxF,oFAAoF;IACpF,IAAI,OAAO,EAAE,SAAS,EAAE,CAAC;QACvB,KAAK,WAAW,CAAC,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,CAAC,SAAS,EAAE,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;IAC5F,CAAC;IAED,OAAO,MAAM,CAAC;AAChB,CAAC"}