@runcofactor/cli 0.55.0 → 0.56.0

package/dist/{chunk-QVMGXMP5.js → chunk-6ILWJFKY.js}

@@ -2,25 +2,383 @@ import { createRequire as __cr } from "module"; import { fileURLToPath as __fup
 import {
   ENV_VAR_NAME,
   updateEnvVarDefinitions
-} from "./chunk-ZH7HWVEE.js";
+} from "./chunk-VMJ7TBVM.js";
 import {
   UUID_RE,
   apiRequest,
   fetchProperties,
   readStdin,
   stripOneTrailingNewline
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
+} from "./chunk-2OHYMT3A.js";
 
 // src/environment.ts
 import process from "process";
+
+// ../ids/src/registry.ts
+var EntityPrefix = {
+  agentEval: "aeval",
+  agentEvalCase: "aecase",
+  agentEvalRun: "aerun",
+  agentEvalAttempt: "aeatt",
+  organization: "org",
+  workflow: "wf",
+  workflowTestExecution: "exec",
+  workflowTestRun: "trun",
+  workflowRun: "wrun",
+  adhocTest: "adhoc",
+  exploratoryTest: "expt",
+  perfTest: "ptest",
+  perfRun: "prun",
+  issue: "iss",
+  property: "prop",
+  credential: "cred",
+  credentialTemplate: "ctpl",
+  syntheticUniverse: "su",
+  syntheticUser: "sp",
+  syntheticUserRun: "sr",
+  userEvent: "uev",
+  userEventDashboard: "ued",
+  userEventDashboardCard: "uedc",
+  triageRun: "trg",
+  triageFinding: "trgf",
+  phoneNumber: "phn",
+  textMessage: "sms",
+  productArea: "parea",
+  productCapability: "pcap",
+  productCapabilityRule: "prule",
+  landingPage: "lp",
+  prReview: "prr",
+  digest: "dig",
+  explorationCycle: "excy",
+  explorationLead: "exld",
+  testSignInProvider: "tsp",
+  testSignInClient: "tsc",
+  testSignInGrant: "tsg",
+  pullRequestProofRecord: "proof",
+  adeSession: "ades"
+};
+var ENTITY_REGISTRY = {
+  aeval: { tableName: "agent_evals", orgIdColumn: "org_id", idColumn: "id" },
+  aecase: { tableName: "agent_eval_cases", orgIdColumn: "org_id", idColumn: "id" },
+  aerun: { tableName: "agent_eval_runs", orgIdColumn: "org_id", idColumn: "id" },
+  aeatt: { tableName: "agent_eval_attempts", orgIdColumn: "org_id", idColumn: "id" },
+  org: {
+    tableName: "organizations",
+    orgIdColumn: null,
+    idColumn: "id"
+  },
+  wf: {
+    tableName: "workflows",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/flows/${prefixedId}`
+  },
+  exec: {
+    tableName: "workflow_test_executions",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/runs/test/${prefixedId}`
+  },
+  trun: {
+    tableName: "workflow_test_runs",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ parentPrefixedId }) => `/runs/test/${parentPrefixedId}`,
+    parentLookup: {
+      foreignKey: "execution_id",
+      parentPrefix: "exec"
+    }
+  },
+  wrun: {
+    tableName: "workflow_runs",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+    // Needs propertyId parent — not yet implemented
+  },
+  adhoc: {
+    tableName: "adhoc_tests",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/exploratory/${prefixedId}`
+  },
+  expt: {
+    tableName: "exploratory_tests",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  ptest: {
+    tableName: "perf_tests",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  prun: {
+    tableName: "perf_runs",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  iss: {
+    tableName: "issues",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/issues?issueId=${prefixedId}`
+  },
+  prop: {
+    tableName: "org_properties",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/properties/${prefixedId}`
+  },
+  cred: {
+    tableName: "org_property_credentials",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  ctpl: {
+    tableName: "credential_templates",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  su: {
+    tableName: "synthetic_universes",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/synthetic-users/${prefixedId}`
+  },
+  sp: {
+    tableName: "synthetic_users",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  sr: {
+    tableName: "synthetic_user_runs",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  uev: {
+    tableName: "user_events",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  ued: {
+    tableName: "user_event_dashboards",
+    orgIdColumn: null,
+    idColumn: "id"
+  },
+  uedc: {
+    tableName: "user_event_dashboard_cards",
+    orgIdColumn: null,
+    idColumn: "id"
+  },
+  trg: {
+    tableName: "triage_runs",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ parentPrefixedId }) => parentPrefixedId ? `/runs/test/${parentPrefixedId}?tab=triage` : "/runs/test",
+    parentLookup: {
+      foreignKey: "workflow_test_execution_id",
+      parentPrefix: "exec"
+    }
+  },
+  trgf: {
+    tableName: "triage_findings",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  phn: {
+    tableName: "messaging_phone_numbers",
+    orgIdColumn: "owner_org_id",
+    idColumn: "id"
+  },
+  sms: {
+    tableName: "text_messages",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  parea: {
+    tableName: "product_areas",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/product-map?area=${prefixedId}`,
+    naturalCodePrefix: "ARE"
+  },
+  pcap: {
+    tableName: "product_capabilities",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/product-map?capability=${prefixedId}`,
+    naturalCodePrefix: "CAP"
+  },
+  prule: {
+    tableName: "product_capability_rules",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  // No buildUrl: landing pages are authored from the CLI and served at
+  // runcofactor.com/lp/<slug> — there is no in-app detail route to link to.
+  //
+  // Deliberately NO `lpv` prefix for landing_page_variants. That table has no
+  // org_id column, and `orgIdColumn: null` does not mean "child table" here —
+  // resolveEntityOrg (apps/api/src/middleware/resolve-entity-org.ts) reads it
+  // as "the ID *is* the orgId" and compares the UUID against the caller's org,
+  // so a variant routed through the generic middleware would be rejected for
+  // the wrong reason. Variants are addressed by (page slug, variant name);
+  // add a prefix only together with real parent-resolving lookup support.
+  lp: {
+    tableName: "landing_pages",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  prr: {
+    tableName: "pr_reviews",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/pr-reviews/${prefixedId}`
+  },
+  dig: {
+    tableName: "org_digests",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/digests/${prefixedId}`
+  },
+  excy: {
+    tableName: "exploration_cycles",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/explore/cycles/${prefixedId}`
+  },
+  exld: {
+    tableName: "exploration_leads",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  tsp: {
+    tableName: "test_sign_in_providers",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  tsc: {
+    tableName: "test_sign_in_clients",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  tsg: {
+    tableName: "test_sign_in_grants",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  },
+  proof: {
+    tableName: "pull_request_proof_records",
+    orgIdColumn: "org_id",
+    idColumn: "id",
+    buildUrl: ({ prefixedId }) => `/proofs/${prefixedId}`
+  },
+  ades: {
+    tableName: "ade_sessions",
+    orgIdColumn: "org_id",
+    idColumn: "id"
+  }
+};
+Object.freeze(ENTITY_REGISTRY);
+var SAFE_IDENT = /^[a-z_][a-z0-9_]*$/;
+for (const [prefix, entry] of Object.entries(ENTITY_REGISTRY)) {
+  for (const field of [entry.tableName, entry.orgIdColumn, entry.idColumn].filter(
+    Boolean
+  )) {
+    if (!SAFE_IDENT.test(field)) {
+      throw new Error(`Invalid identifier in ENTITY_REGISTRY['${prefix}']: "${field}"`);
+    }
+  }
+}
+var VALID_PREFIXES = new Set(Object.keys(ENTITY_REGISTRY));
+
+// ../ids/src/base58.ts
+var ALPHABET = "123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz";
+var BASE = 58;
+var ALPHABET_MAP = /* @__PURE__ */ new Map();
+for (let i = 0; i < ALPHABET.length; i++) {
+  ALPHABET_MAP.set(ALPHABET[i], i);
+}
+function decodeBase58(str) {
+  if (str.length === 0) return new Uint8Array(0);
+  let leadingOnes = 0;
+  while (leadingOnes < str.length && str[leadingOnes] === ALPHABET[0]) {
+    leadingOnes++;
+  }
+  const bytes = [];
+  for (let i = leadingOnes; i < str.length; i++) {
+    const value = ALPHABET_MAP.get(str[i]);
+    if (value === void 0) return null;
+    let carry = value;
+    for (let j = 0; j < bytes.length; j++) {
+      carry += bytes[j] * BASE;
+      bytes[j] = carry & 255;
+      carry >>= 8;
+    }
+    while (carry > 0) {
+      bytes.push(carry & 255);
+      carry >>= 8;
+    }
+  }
+  const result = new Uint8Array(leadingOnes + bytes.length);
+  for (let i = 0; i < bytes.length; i++) {
+    result[leadingOnes + i] = bytes[bytes.length - 1 - i];
+  }
+  return result;
+}
+
+// ../ids/src/prefixed-id.ts
+var UUID_RE2 = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+var PREFIXED_RE = /^([a-z]{2,6})_([1-9A-HJ-NP-Za-km-z]+)$/;
+function bytesToUuid(bytes) {
+  const hex = Array.from(bytes).map((b) => b.toString(16).padStart(2, "0")).join("");
+  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;
+}
+function decodePrefixedId(id) {
+  const match = id.match(PREFIXED_RE);
+  if (!match) return null;
+  const prefix = match[1];
+  if (!VALID_PREFIXES.has(prefix)) return null;
+  const decoded = decodeBase58(match[2]);
+  if (!decoded || decoded.length < 16 || decoded.length > 17) return null;
+  let normalized = decoded;
+  if (decoded.length === 17) {
+    if (decoded[0] !== 0) return null;
+    normalized = decoded.slice(1);
+  }
+  return { prefix, uuid: bytesToUuid(normalized) };
+}
+function parseAnyId(input) {
+  const decoded = decodePrefixedId(input);
+  if (decoded) return { kind: "prefixed", ...decoded };
+  if (UUID_RE2.test(input)) return { kind: "raw_uuid", uuid: input.toLowerCase() };
+  return { kind: "invalid" };
+}
+
+// ../ids/src/entity-link.ts
+var prefixAlternation = Object.values(EntityPrefix).sort((left, right) => right.length - left.length).join("|");
+var BARE_ENTITY_ID = new RegExp(
+  `(^|[^A-Za-z0-9_])((?:${prefixAlternation})_[1-9A-HJ-NP-Za-km-z]+)(?![A-Za-z0-9_])`,
+  "g"
+);
+
+// ../ids/src/types.ts
+function extractUuid(raw) {
+  if (!raw) return null;
+  const parsed = parseAnyId(raw);
+  if (parsed.kind === "prefixed") return parsed.uuid.toLowerCase();
+  if (parsed.kind === "raw_uuid") return parsed.uuid.toLowerCase();
+  return null;
+}
+
+// src/environment.ts
 var SET_VAR_VALUE_FLAGS = /* @__PURE__ */ new Set(["--application", "--property", "--environment"]);
 function parseEnvVarAssignments(argv) {
   const assignments = {};
@@ -139,7 +497,10 @@ async function findApplication(argv, apiUrl, token) {
     process.exit(1);
   }
   const properties = await fetchProperties(apiUrl, token);
-  const match = properties.find((p) => p.id === arg || p.name.toLowerCase() === arg.toLowerCase());
+  const applicationUuid = arg.startsWith("prop_") ? extractUuid(arg) : null;
+  const match = properties.find(
+    (p) => p.id === arg || p.id === applicationUuid || p.name.toLowerCase() === arg.toLowerCase()
+  );
   const notFound = () => {
     console.error(`Error: Application "${arg}" not found.`);
     if (properties.length > 0) {
@@ -396,6 +757,7 @@ async function runEnvironment(argv) {
 }
 
 export {
+  extractUuid,
   parseEnvVarAssignments,
   stdinAssignment,
   resolveApplicationId,
@@ -405,4 +767,4 @@ export {
   handleSetVar,
   runEnvironment
 };
-//# sourceMappingURL=chunk-QVMGXMP5.js.map
+//# sourceMappingURL=chunk-6ILWJFKY.js.map

package/dist/chunk-6ILWJFKY.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/environment.ts","../../ids/src/registry.ts","../../ids/src/base58.ts","../../ids/src/prefixed-id.ts","../../ids/src/entity-link.ts","../../ids/src/types.ts"],"sourcesContent":["/**\n * CLI Environment Management\n *\n * List, create, and set the default environment for an application, including\n * `type='sandbox'` environments backed by a verified sandbox template or by a\n * Sandboxes v2 environment (a repo's `cofactor.sandbox.yaml`). Reuses the\n * existing `/org/properties/:id/environments` endpoints — no new API.\n */\n\nimport process from 'node:process';\nimport { extractUuid } from '@chatsdet/ids';\nimport { resolveConfig, hasFlag, getArgValue } from './auth.js';\nimport {\n  fetchProperties,\n  apiRequest,\n  UUID_RE,\n  readStdin,\n  stripOneTrailingNewline,\n} from './cli-helpers.js';\nimport { writeRawOutput } from './brand.js';\nimport { ENV_VAR_NAME, updateEnvVarDefinitions } from './env-var-definitions.js';\n\nexport type EnvironmentItem = {\n  id: string;\n  name: string;\n  type: 'permanent' | 'ephemeral' | 'local' | 'sandbox';\n  url: string;\n  isDefault: boolean;\n  sandboxTemplateId: string | null;\n  /** The application definition's environment a Sandboxes v2 environment runs; null for any other. */\n  sandboxV2Environment: string | null;\n  environmentKindId: string | null;\n  environmentKindName: string | null;\n  /**\n   * Values this environment supplies for the application's declared variables,\n   * injected at run time as `$var.ENV.<name>`. Values of variables the property\n   * marks sensitive arrive masked, not in the clear.\n   */\n  envVarValues: Record<string, string>;\n};\n\n/**\n * Flags in `set-var` that consume the following argv entry as their value.\n * Keep in lockstep with the `Set-var options` block in `printHelp` — a\n * value-taking flag missing here has its value parsed as a `NAME=value` pair.\n */\nconst SET_VAR_VALUE_FLAGS = new Set(['--application', '--property', '--environment']);\n\n/**\n * Collect the positional `NAME=value` pairs of a `set-var` invocation, skipping\n * flags and the values they consume (a flag value may itself contain `=`).\n *\n * An empty value is legal — `NAME=` sets the variable to the empty string, which\n * is distinct from leaving it unset.\n */\nexport function parseEnvVarAssignments(argv: string[]): Record<string, string> {\n  const assignments: Record<string, string> = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    if (SET_VAR_VALUE_FLAGS.has(arg)) {\n      i++;\n      continue;\n    }\n    if (arg.startsWith('--')) continue;\n\n    const separator = arg.indexOf('=');\n    if (separator <= 0) {\n      throw new Error(`Expected NAME=value, got \"${arg}\".`);\n    }\n    const name = arg.slice(0, separator);\n    // Mirrors the server's `EnvVarValues` name regex so an obvious typo fails\n    // before the round trip. The server remains the authority and additionally\n    // caps name and value length, which is left to it rather than duplicated.\n    if (!ENV_VAR_NAME.test(name)) {\n      throw new Error(\n        `Invalid variable name \"${name}\" — names must be alphanumeric/underscore and may not start with a digit.`\n      );\n    }\n    // A repeated name is last-wins, matching how the shell treats repeated flags.\n    assignments[name] = arg.slice(separator + 1);\n  }\n  return assignments;\n}\n\n/**\n * `set-var --stdin NAME`: the value of the one bare NAME, read from stdin, so a\n * secret never appears in the command line or shell history. One trailing\n * newline (`\\n` from `echo`, or `\\r\\n`) is dropped; anything else is kept.\n */\nexport function stdinAssignment(argv: string[], stdin: string): Record<string, string> {\n  const names: string[] = [];\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i];\n    if (SET_VAR_VALUE_FLAGS.has(arg)) {\n      i++;\n      continue;\n    }\n    if (!arg.startsWith('--')) names.push(arg);\n  }\n  if (names.length !== 1 || names[0].includes('=')) {\n    throw new Error(\n      '--stdin takes one bare NAME (not NAME=value) and reads its value from stdin, e.g. ' +\n        '`printf %s \"$TOKEN\" | canary env set-var --application A --environment E --stdin API_TOKEN`.'\n    );\n  }\n  const name = names[0];\n  if (!ENV_VAR_NAME.test(name)) {\n    throw new Error(\n      `Invalid variable name \"${name}\" — names must be alphanumeric/underscore and may not start with a digit.`\n    );\n  }\n  const value = stripOneTrailingNewline(stdin);\n  // An empty pipe is far more often an unset shell variable than an intended\n  // empty value, and writing it would wipe the stored secret. `NAME=` sets \"\".\n  if (value === '') {\n    throw new Error(`stdin was empty; nothing to set for ${name}. To set an empty value, pass ${name}= instead.`);\n  }\n  return { [name]: value };\n}\n\nfunction pad(s: string, n: number): string {\n  return s.padEnd(n);\n}\n\nfunction printHelp(): void {\n  console.log(\n    [\n      'canary environment: Manage application environments (alias: canary env)',\n      '',\n      'Sub-commands:',\n      '  list [options]                    List environments for an application',\n      '  create [options]                  Create an environment (incl. sandbox)',\n      '  set-default [options]             Set an environment as the application default',\n      '  set-var [options] NAME=value ...  Set per-environment variable values',\n      '  set-var [options] --stdin NAME    Set one value read from stdin (keeps secrets out of shell history)',\n      '',\n      'List options:',\n      '  --application <name|id>           Application (required; alias: --property)',\n      '',\n      'Create options:',\n      '  --application <name|id>           Application (required; alias: --property)',\n      '  --name <name>                     Environment name (required)',\n      '  --stage <name|id>                 Shared deployment stage (e.g. staging)',\n      '  --type <permanent|ephemeral|local|sandbox>   Environment type (default: permanent)',\n      '  --url <url>                       Base URL (required unless --type sandbox)',\n      '  --sandbox-template <uuid>         Backing template (required with --type sandbox)',\n      '  --login-path </path>              Per-env login path override',\n      '  --description <text>              Optional description',\n      '  --default                         Set this environment as the application default',\n      '',\n      'Set-default options:',\n      '  --application <name|id>           Application (required; alias: --property)',\n      '  --environment <name|id>           Environment to make default (required)',\n      '',\n      'Set-var options:',\n      '  --application <name|id>           Application (required; alias: --property)',\n      '  --environment <name|id>           Environment to update (required)',\n      '  --stdin                           Read the value of the one NAME from stdin',\n      '  --sensitive                       Mark the named variables sensitive on the application',\n      '                                    first (declaring them if needed); their values then',\n      '                                    read back masked. Applies to every environment.',\n      '',\n      '  Values merge into the environment; variables you do not name keep their',\n      '  current value. Injected at run time as $var.ENV.<name>.',\n      '',\n      '  canary env set-var --application \"Acme Web\" --environment Staging \\\\',\n      '    salesforce_url=https://example.my.salesforce.com',\n      '  printf %s \"$API_TOKEN\" | canary env set-var --application \"Acme Web\" \\\\',\n      '    --environment Staging --sensitive --stdin API_TOKEN',\n      '',\n      '  To mark an existing variable sensitive without changing its values:',\n      '  canary application update \"Acme Web\" --env-var API_TOKEN:sensitive',\n      '',\n      'Common options:',\n      '  --json                            Output as JSON',\n      '',\n      \"Sandboxes v2 environments are not created here: each environment in the application's\",\n      'cofactor.sandbox.yaml becomes one when you run `cofactor sandbox connect` or `cofactor sandbox push`.',\n    ].join('\\n')\n  );\n}\n\n/** The `--application`/`--property` argument and the application it names, if any. */\nasync function findApplication(argv: string[], apiUrl: string, token: string) {\n  const arg = getArgValue(argv, '--application') ?? getArgValue(argv, '--property');\n  if (!arg) {\n    console.error('Error: --application <name|id> is required.');\n    process.exit(1);\n  }\n  const properties = await fetchProperties(apiUrl, token);\n  const applicationUuid = arg.startsWith('prop_') ? extractUuid(arg) : null;\n  const match = properties.find(\n    (p) => p.id === arg || p.id === applicationUuid || p.name.toLowerCase() === arg.toLowerCase()\n  );\n  const notFound = (): never => {\n    console.error(`Error: Application \"${arg}\" not found.`);\n    if (properties.length > 0) {\n      console.error('Available applications:');\n      for (const p of properties) console.error(`  - ${p.name} (${p.id})`);\n    }\n    process.exit(1);\n  };\n  return { arg, match, notFound, names: properties.map((p) => p.name) };\n}\n\n/** Resolve `--application`/`--property` (name or id) to a property id. */\nexport async function resolveApplicationId(\n  argv: string[],\n  apiUrl: string,\n  token: string\n): Promise<string> {\n  const { match, notFound } = await findApplication(argv, apiUrl, token);\n  return match ? match.id : notFound();\n}\n\n/**\n * Resolve `--application`/`--property` for `cofactor sandbox push` and\n * `connect`, creating the application when the name is new: its default\n * environment is its sandbox `default` environment, so no base URL is asked\n * for. An id that matches no application is still an error, not the name of\n * a new one.\n */\nexport async function resolveOrCreateSandboxApplication(\n  argv: string[],\n  apiUrl: string,\n  token: string,\n  // `connect` checks what it needs (GitHub, the repository) here, so a refusal creates nothing; `push` has no check.\n  beforeCreate?: () => Promise<void>\n): Promise<string> {\n  const { arg, match, notFound, names } = await findApplication(argv, apiUrl, token);\n  if (match) return match.id;\n  // An application id, raw or prefixed (`prop_…`), names an existing application.\n  if (UUID_RE.test(arg) || arg.startsWith('prop_')) notFound();\n  await beforeCreate?.();\n  const created = await apiRequest<{ ok: boolean; id?: string; error?: string }>(apiUrl, token, 'POST', '/org/properties', {\n    name: arg,\n    defaultEnvironment: { sandboxV2Environment: 'default' },\n  });\n  if (!created.ok || !created.id) {\n    console.error(`Error: creating application \"${arg}\": ${created.error ?? 'unknown error'}`);\n    process.exit(1);\n  }\n  // Said even with --json: a mistyped name makes a new application rather than failing, and if\n  // what follows fails, the application stays (a retry under another name may exceed the quota).\n  const others = names.length > 0 ? ` The organization's other applications: ${names.join(', ')}.` : '';\n  console.error(\n    `Created application \"${arg}\"; its sandbox environment \\`default\\` is its default environment. If this fails, re-run with the same --application.${others}`\n  );\n  return created.id;\n}\n\nexport async function fetchEnvironments(\n  propertyId: string,\n  apiUrl: string,\n  token: string\n): Promise<EnvironmentItem[]> {\n  const res = await apiRequest<{ ok: boolean; items?: EnvironmentItem[]; error?: string }>(\n    apiUrl,\n    token,\n    'GET',\n    `/org/properties/${propertyId}/environments`\n  );\n  if (!res.ok) {\n    console.error(`Error: ${res.error ?? 'Failed to list environments'}`);\n    process.exit(1);\n  }\n  return res.items ?? [];\n}\n\n/** The Template column: a v1 template id, or the definition environment a v2 one runs. */\nfunction sandboxBacking(e: EnvironmentItem): string {\n  if (e.sandboxV2Environment) return `v2 #${e.sandboxV2Environment}`;\n  return e.sandboxTemplateId ?? '';\n}\n\nasync function handleList(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const json = hasFlag(argv, '--json');\n  const propertyId = await resolveApplicationId(argv, apiUrl, token);\n  const items = await fetchEnvironments(propertyId, apiUrl, token);\n\n  if (json) {\n    writeRawOutput(JSON.stringify(items, null, 2));\n    return;\n  }\n  if (items.length === 0) {\n    console.log('No environments found.');\n    return;\n  }\n  console.log(\n    `${pad('Name', 28)} ${pad('Stage', 14)} ${pad('Type', 11)} ${pad('Default', 8)} ${pad('URL', 36)} Template`\n  );\n  for (const e of items) {\n    console.log(\n      `${pad(e.name, 28)} ${pad(e.environmentKindName ?? '', 14)} ${pad(e.type, 11)} ${pad(e.isDefault ? 'yes' : '', 8)} ` +\n        `${pad(e.url || '(none)', 36)} ${sandboxBacking(e)}`\n    );\n  }\n}\n\nasync function handleCreate(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const json = hasFlag(argv, '--json');\n  const propertyId = await resolveApplicationId(argv, apiUrl, token);\n  const name = getArgValue(argv, '--name');\n  const type = (getArgValue(argv, '--type') ?? 'permanent') as EnvironmentItem['type'];\n  const url = getArgValue(argv, '--url');\n  const sandboxTemplateId = getArgValue(argv, '--sandbox-template');\n  const loginPath = getArgValue(argv, '--login-path');\n  const description = getArgValue(argv, '--description');\n  const stage = getArgValue(argv, '--stage');\n  const isDefault = hasFlag(argv, '--default');\n\n  if (!name) {\n    console.error('Error: --name is required.');\n    process.exit(1);\n  }\n  if (type === 'sandbox' && !sandboxTemplateId) {\n    console.error(\n      \"Error: --type sandbox needs --sandbox-template <uuid>. (A Sandboxes v2 environment comes from the application's cofactor.sandbox.yaml: `cofactor sandbox connect` or `cofactor sandbox push`.)\"\n    );\n    process.exit(1);\n  }\n  if (type !== 'sandbox' && !url) {\n    console.error(`Error: --url is required for --type ${type}.`);\n    process.exit(1);\n  }\n\n  const body: Record<string, unknown> = { name, type };\n  if (url !== undefined) body.url = url;\n  if (sandboxTemplateId !== undefined) body.sandboxTemplateId = sandboxTemplateId;\n  if (loginPath !== undefined) body.loginPath = loginPath;\n  if (description !== undefined) body.description = description;\n  if (stage !== undefined) {\n    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(stage)) {\n      body.environmentKindId = stage;\n    } else {\n      body.environmentKindName = stage;\n    }\n  }\n  if (isDefault) body.isDefault = true;\n\n  const result = await apiRequest<{\n    ok: boolean;\n    item?: EnvironmentItem;\n    error?: string;\n    /** A Sandboxes v2 definition that failed validation, one entry per problem. */\n    issues?: Array<{ path: string; message: string }>;\n  }>(apiUrl, token, 'POST', `/org/properties/${propertyId}/environments`, body);\n\n  if (!result.ok) {\n    if (json) writeRawOutput(JSON.stringify(result, null, 2));\n    else {\n      console.error(`Error: ${result.error ?? 'Unknown error'}`);\n      for (const issue of result.issues ?? []) console.error(`  ${issue.path}: ${issue.message}`);\n    }\n    process.exit(1);\n  }\n  if (json) {\n    writeRawOutput(JSON.stringify(result, null, 2));\n    return;\n  }\n  console.log(`Created ${type} environment \"${name}\" (${result.item?.id ?? '?'})`);\n}\n\nasync function handleSetDefault(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const json = hasFlag(argv, '--json');\n  const propertyId = await resolveApplicationId(argv, apiUrl, token);\n  const envArg = getArgValue(argv, '--environment');\n  if (!envArg) {\n    console.error('Error: --environment <name|id> is required.');\n    process.exit(1);\n  }\n\n  const items = await fetchEnvironments(propertyId, apiUrl, token);\n  const match = resolveEnvironment(items, envArg);\n\n  const result = await apiRequest<{ ok: boolean; error?: string }>(\n    apiUrl,\n    token,\n    'POST',\n    `/org/properties/${propertyId}/environments/${match.id}/set-default`\n  );\n\n  if (!result.ok) {\n    if (json) writeRawOutput(JSON.stringify(result, null, 2));\n    else console.error(`Error: ${result.error ?? 'Unknown error'}`);\n    process.exit(1);\n  }\n  if (json) {\n    writeRawOutput(JSON.stringify({ ok: true, environmentId: match.id }, null, 2));\n    return;\n  }\n  console.log(`Set \"${match.name}\" (${match.id}) as the default environment.`);\n}\n\n/** Resolve `--environment` (name or id) against the application's environments. */\nexport function resolveEnvironment(items: EnvironmentItem[], envArg: string): EnvironmentItem {\n  const match = items.find((e) => e.id === envArg || e.name.toLowerCase() === envArg.toLowerCase());\n  if (!match) {\n    console.error(`Error: Environment \"${envArg}\" not found for this application.`);\n    if (items.length > 0) {\n      console.error('Available environments:');\n      for (const e of items) console.error(`  - ${e.name} (${e.id})`);\n    }\n    process.exit(1);\n  }\n  return match;\n}\n\nexport async function handleSetVar(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const json = hasFlag(argv, '--json');\n  const propertyId = await resolveApplicationId(argv, apiUrl, token);\n  const envArg = getArgValue(argv, '--environment');\n  if (!envArg) {\n    console.error('Error: --environment <name|id> is required.');\n    process.exit(1);\n  }\n\n  if (hasFlag(argv, '--stdin') && process.stdin.isTTY) {\n    console.error('Error: --stdin reads the value from a pipe, e.g. `printf %s \"$TOKEN\" | canary env set-var ... --stdin NAME`.');\n    process.exit(1);\n  }\n\n  let assignments: Record<string, string>;\n  try {\n    assignments = hasFlag(argv, '--stdin')\n      ? stdinAssignment(argv, await readStdin())\n      : parseEnvVarAssignments(argv);\n  } catch (err) {\n    console.error(`Error: ${err instanceof Error ? err.message : String(err)}`);\n    process.exit(1);\n  }\n  if (Object.keys(assignments).length === 0) {\n    console.error('Error: at least one NAME=value assignment is required.');\n    process.exit(1);\n  }\n\n  // Resolved first, so a mistyped --environment changes nothing.\n  const items = await fetchEnvironments(propertyId, apiUrl, token);\n  const match = resolveEnvironment(items, envArg);\n\n  // Marked before the values are written: a value written first would be\n  // readable in the clear from the environment list until it was marked.\n  if (hasFlag(argv, '--sensitive')) {\n    await updateEnvVarDefinitions(\n      propertyId,\n      Object.keys(assignments).map((name) => ({ name, sensitive: true })),\n      apiUrl,\n      token\n    );\n  }\n\n  // The update endpoint replaces `envVarValues` wholesale, so the full map goes\n  // back or every unlisted variable is destroyed. Masked sensitive values ride\n  // along untouched — the server substitutes the stored plaintext for any entry\n  // equal to the mask, the same round-trip the UI relies on.\n  //\n  // This read-then-write is last-writer-wins: a concurrent edit landing between\n  // the two calls is overwritten with this snapshot. The endpoint offers no\n  // compare-and-swap, so avoid setting variables on one environment from two\n  // places at once.\n  const envVarValues = { ...match.envVarValues, ...assignments };\n\n  const result = await apiRequest<{ ok: boolean; item?: EnvironmentItem; error?: string }>(\n    apiUrl,\n    token,\n    'PUT',\n    `/org/properties/${propertyId}/environments/${match.id}`,\n    { envVarValues }\n  );\n\n  if (!result.ok) {\n    if (json) writeRawOutput(JSON.stringify(result, null, 2));\n    else console.error(`Error: ${result.error ?? 'Unknown error'}`);\n    process.exit(1);\n  }\n  if (json) {\n    writeRawOutput(JSON.stringify(\n        { ok: true, environmentId: match.id, envVarValues: result.item?.envVarValues ?? {} },\n        null,\n        2\n      )\n    );\n    return;\n  }\n  const names = Object.keys(assignments).join(', ');\n  console.log(`Set ${names} on \"${match.name}\" (${match.id}).`);\n}\n\nexport async function runEnvironment(argv: string[]): Promise<void> {\n  const [subCommand, ...rest] = argv;\n\n  if (!subCommand || subCommand === 'help' || hasFlag(argv, '--help', '-h')) {\n    printHelp();\n    return;\n  }\n\n  const { apiUrl, token } = await resolveConfig(argv);\n\n  const globalFlags = new Set(['--env', '--api-url', '--token', '--org']);\n  const args = rest.filter((arg, i) => {\n    if (globalFlags.has(arg)) return false;\n    if (i > 0 && globalFlags.has(rest[i - 1])) return false;\n    return true;\n  });\n\n  switch (subCommand) {\n    case 'list':\n      await handleList(args, apiUrl, token);\n      break;\n    case 'create':\n      await handleCreate(args, apiUrl, token);\n      break;\n    case 'set-default':\n      await handleSetDefault(args, apiUrl, token);\n      break;\n    case 'set-var':\n      await handleSetVar(args, apiUrl, token);\n      break;\n    default:\n      console.error(`Unknown sub-command: ${subCommand}`);\n      printHelp();\n      process.exit(1);\n  }\n}\n","/**\n * Entity prefix registry — the central map from prefix to table metadata.\n *\n * Powers both ID encoding/decoding and the generic org-lookup middleware.\n * To add a new entity prefix, add an entry here and the system picks it up.\n *\n * @module EntityRegistry\n * @see docs/project/prefixed-ids.md\n */\n\nexport const EntityPrefix = {\n  agentEval: 'aeval',\n  agentEvalCase: 'aecase',\n  agentEvalRun: 'aerun',\n  agentEvalAttempt: 'aeatt',\n  organization: 'org',\n  workflow: 'wf',\n  workflowTestExecution: 'exec',\n  workflowTestRun: 'trun',\n  workflowRun: 'wrun',\n  adhocTest: 'adhoc',\n  exploratoryTest: 'expt',\n  perfTest: 'ptest',\n  perfRun: 'prun',\n  issue: 'iss',\n  property: 'prop',\n  credential: 'cred',\n  credentialTemplate: 'ctpl',\n  syntheticUniverse: 'su',\n  syntheticUser: 'sp',\n  syntheticUserRun: 'sr',\n  userEvent: 'uev',\n  userEventDashboard: 'ued',\n  userEventDashboardCard: 'uedc',\n  triageRun: 'trg',\n  triageFinding: 'trgf',\n  phoneNumber: 'phn',\n  textMessage: 'sms',\n  productArea: 'parea',\n  productCapability: 'pcap',\n  productCapabilityRule: 'prule',\n  landingPage: 'lp',\n  prReview: 'prr',\n  digest: 'dig',\n  explorationCycle: 'excy',\n  explorationLead: 'exld',\n  testSignInProvider: 'tsp',\n  testSignInClient: 'tsc',\n  testSignInGrant: 'tsg',\n  pullRequestProofRecord: 'proof',\n  adeSession: 'ades',\n} as const;\n\nexport type EntityPrefixValue = (typeof EntityPrefix)[keyof typeof EntityPrefix];\n\nexport type EntityRegistryEntry = {\n  /** PostgreSQL table name */\n  tableName: string;\n  /** Column containing the owning org's ID. null for entities that ARE orgs. */\n  orgIdColumn: string | null;\n  /** Primary key column name (usually 'id') */\n  idColumn: string;\n  /** Build the frontend URL for this entity. Returns a path string. */\n  buildUrl?: (opts: { prefixedId: string; parentPrefixedId?: string }) => string;\n  /**\n   * Uppercase prefix for this entity's *natural* code, when it has one.\n   *\n   * A few entities carry a short human-citable code alongside their opaque\n   * prefixed id — `CAP-CMM-001` next to `pcap_…`. Both encodings answer \"what\n   * kind of thing is this?\", so both are declared here rather than in a second\n   * parallel vocabulary that could drift out of step with this one. Absent for\n   * the entities addressed only by prefixed id.\n   */\n  naturalCodePrefix?: string;\n  /** For entities whose URL requires a parent's ID (e.g., test runs need execution ID) */\n  parentLookup?: {\n    /** Foreign key column on this entity's table pointing to the parent */\n    foreignKey: string;\n    /** Prefix for encoding the parent entity's ID */\n    parentPrefix: EntityPrefixValue;\n  };\n};\n\nexport const ENTITY_REGISTRY: Record<EntityPrefixValue, EntityRegistryEntry> = {\n  aeval: { tableName: 'agent_evals', orgIdColumn: 'org_id', idColumn: 'id' },\n  aecase: { tableName: 'agent_eval_cases', orgIdColumn: 'org_id', idColumn: 'id' },\n  aerun: { tableName: 'agent_eval_runs', orgIdColumn: 'org_id', idColumn: 'id' },\n  aeatt: { tableName: 'agent_eval_attempts', orgIdColumn: 'org_id', idColumn: 'id' },\n  org: {\n    tableName: 'organizations',\n    orgIdColumn: null,\n    idColumn: 'id',\n  },\n  wf: {\n    tableName: 'workflows',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/flows/${prefixedId}`,\n  },\n  exec: {\n    tableName: 'workflow_test_executions',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/runs/test/${prefixedId}`,\n  },\n  trun: {\n    tableName: 'workflow_test_runs',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ parentPrefixedId }) => `/runs/test/${parentPrefixedId}`,\n    parentLookup: {\n      foreignKey: 'execution_id',\n      parentPrefix: 'exec',\n    },\n  },\n  wrun: {\n    tableName: 'workflow_runs',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    // Needs propertyId parent — not yet implemented\n  },\n  adhoc: {\n    tableName: 'adhoc_tests',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/exploratory/${prefixedId}`,\n  },\n  expt: {\n    tableName: 'exploratory_tests',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  ptest: {\n    tableName: 'perf_tests',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  prun: {\n    tableName: 'perf_runs',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  iss: {\n    tableName: 'issues',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/issues?issueId=${prefixedId}`,\n  },\n  prop: {\n    tableName: 'org_properties',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/properties/${prefixedId}`,\n  },\n  cred: {\n    tableName: 'org_property_credentials',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  ctpl: {\n    tableName: 'credential_templates',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  su: {\n    tableName: 'synthetic_universes',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/synthetic-users/${prefixedId}`,\n  },\n  sp: {\n    tableName: 'synthetic_users',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  sr: {\n    tableName: 'synthetic_user_runs',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  uev: {\n    tableName: 'user_events',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  ued: {\n    tableName: 'user_event_dashboards',\n    orgIdColumn: null,\n    idColumn: 'id',\n  },\n  uedc: {\n    tableName: 'user_event_dashboard_cards',\n    orgIdColumn: null,\n    idColumn: 'id',\n  },\n  trg: {\n    tableName: 'triage_runs',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ parentPrefixedId }) =>\n      parentPrefixedId ? `/runs/test/${parentPrefixedId}?tab=triage` : '/runs/test',\n    parentLookup: {\n      foreignKey: 'workflow_test_execution_id',\n      parentPrefix: 'exec',\n    },\n  },\n  trgf: {\n    tableName: 'triage_findings',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  phn: {\n    tableName: 'messaging_phone_numbers',\n    orgIdColumn: 'owner_org_id',\n    idColumn: 'id',\n  },\n  sms: {\n    tableName: 'text_messages',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  parea: {\n    tableName: 'product_areas',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/product-map?area=${prefixedId}`,\n    naturalCodePrefix: 'ARE',\n  },\n  pcap: {\n    tableName: 'product_capabilities',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/product-map?capability=${prefixedId}`,\n    naturalCodePrefix: 'CAP',\n  },\n  prule: {\n    tableName: 'product_capability_rules',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  // No buildUrl: landing pages are authored from the CLI and served at\n  // runcofactor.com/lp/<slug> — there is no in-app detail route to link to.\n  //\n  // Deliberately NO `lpv` prefix for landing_page_variants. That table has no\n  // org_id column, and `orgIdColumn: null` does not mean \"child table\" here —\n  // resolveEntityOrg (apps/api/src/middleware/resolve-entity-org.ts) reads it\n  // as \"the ID *is* the orgId\" and compares the UUID against the caller's org,\n  // so a variant routed through the generic middleware would be rejected for\n  // the wrong reason. Variants are addressed by (page slug, variant name);\n  // add a prefix only together with real parent-resolving lookup support.\n  lp: {\n    tableName: 'landing_pages',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  prr: {\n    tableName: 'pr_reviews',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/pr-reviews/${prefixedId}`,\n  },\n  dig: {\n    tableName: 'org_digests',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/digests/${prefixedId}`,\n  },\n  excy: {\n    tableName: 'exploration_cycles',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/explore/cycles/${prefixedId}`,\n  },\n  exld: {\n    tableName: 'exploration_leads',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  tsp: {\n    tableName: 'test_sign_in_providers',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  tsc: {\n    tableName: 'test_sign_in_clients',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  tsg: {\n    tableName: 'test_sign_in_grants',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n  proof: {\n    tableName: 'pull_request_proof_records',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n    buildUrl: ({ prefixedId }) => `/proofs/${prefixedId}`,\n  },\n  ades: {\n    tableName: 'ade_sessions',\n    orgIdColumn: 'org_id',\n    idColumn: 'id',\n  },\n} as const;\n\n// Freeze the registry — sql.raw() safety depends on these being immutable string literals\nObject.freeze(ENTITY_REGISTRY);\n\n/** Strict SQL identifier pattern — registry values must match this. */\nconst SAFE_IDENT = /^[a-z_][a-z0-9_]*$/;\n\n// Validate all registry entries at module load time\nfor (const [prefix, entry] of Object.entries(ENTITY_REGISTRY)) {\n  for (const field of [entry.tableName, entry.orgIdColumn, entry.idColumn].filter(\n    Boolean\n  ) as string[]) {\n    if (!SAFE_IDENT.test(field)) {\n      throw new Error(`Invalid identifier in ENTITY_REGISTRY['${prefix}']: \"${field}\"`);\n    }\n  }\n}\n\n/** All valid prefix strings, derived from the registry. */\nexport const VALID_PREFIXES = new Set<string>(Object.keys(ENTITY_REGISTRY));\n\n/** Look up a registry entry by prefix string. Returns undefined for unknown prefixes. */\nexport function getRegistryEntry(prefix: string): EntityRegistryEntry | undefined {\n  return ENTITY_REGISTRY[prefix as EntityPrefixValue];\n}\n","/**\n * Base58 encoding/decoding using the Bitcoin alphabet.\n *\n * Encodes arbitrary byte arrays into URL-safe, human-readable strings\n * without ambiguous characters (0/O, l/1, +, /).\n *\n * @module Base58\n * @see docs/project/prefixed-ids.md\n */\n\nconst ALPHABET = '123456789ABCDEFGHJKLMNPQRSTUVWXYZabcdefghijkmnopqrstuvwxyz';\nconst BASE = 58;\n\nconst ALPHABET_MAP = new Map<string, number>();\nfor (let i = 0; i < ALPHABET.length; i++) {\n  ALPHABET_MAP.set(ALPHABET[i]!, i);\n}\n\n/** Encode a Uint8Array into a base58 string. */\nexport function encodeBase58(bytes: Uint8Array): string {\n  if (bytes.length === 0) return '';\n\n  // Count leading zero bytes (they map to '1' in base58)\n  let leadingZeros = 0;\n  while (leadingZeros < bytes.length && bytes[leadingZeros] === 0) {\n    leadingZeros++;\n  }\n\n  // Work on a copy as a big-endian number\n  const digits: number[] = [];\n  for (let i = leadingZeros; i < bytes.length; i++) {\n    let carry = bytes[i]!;\n    for (let j = 0; j < digits.length; j++) {\n      carry += digits[j]! * 256;\n      digits[j] = carry % BASE;\n      carry = Math.floor(carry / BASE);\n    }\n    while (carry > 0) {\n      digits.push(carry % BASE);\n      carry = Math.floor(carry / BASE);\n    }\n  }\n\n  // Build result: leading '1's + reversed digits\n  let result = ALPHABET[0]!.repeat(leadingZeros);\n  for (let i = digits.length - 1; i >= 0; i--) {\n    result += ALPHABET[digits[i]!];\n  }\n\n  return result;\n}\n\n/** Decode a base58 string back to a Uint8Array. Returns null on invalid input. */\nexport function decodeBase58(str: string): Uint8Array | null {\n  if (str.length === 0) return new Uint8Array(0);\n\n  // Count leading '1's (they map to 0x00 bytes)\n  let leadingOnes = 0;\n  while (leadingOnes < str.length && str[leadingOnes] === ALPHABET[0]) {\n    leadingOnes++;\n  }\n\n  const bytes: number[] = [];\n  for (let i = leadingOnes; i < str.length; i++) {\n    const value = ALPHABET_MAP.get(str[i]!);\n    if (value === undefined) return null; // invalid character\n\n    let carry = value;\n    for (let j = 0; j < bytes.length; j++) {\n      carry += bytes[j]! * BASE;\n      bytes[j] = carry & 0xff;\n      carry >>= 8;\n    }\n    while (carry > 0) {\n      bytes.push(carry & 0xff);\n      carry >>= 8;\n    }\n  }\n\n  // Combine leading zeros + reversed bytes\n  const result = new Uint8Array(leadingOnes + bytes.length);\n  // leadingOnes positions are already 0\n  for (let i = 0; i < bytes.length; i++) {\n    result[leadingOnes + i] = bytes[bytes.length - 1 - i]!;\n  }\n\n  return result;\n}\n","/**\n * Prefixed ID encoding, decoding, and parsing.\n *\n * Format: `{prefix}_{base58(uuid_bytes)}`\n * Example: `exec_6ByM4qP5NH7t4DtaCHeALh`\n *\n * @module PrefixedId\n * @see docs/project/prefixed-ids.md\n */\n\nimport { encodeBase58, decodeBase58 } from './base58.js';\nimport { VALID_PREFIXES, type EntityPrefixValue } from './registry.js';\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;\nconst PREFIXED_RE = /^([a-z]{2,6})_([1-9A-HJ-NP-Za-km-z]+)$/;\n\n/**\n * Whether a string is a UUID in the canonical hyphenated form.\n *\n * Callers that pass a path or query parameter straight into a `uuid` column\n * need this: Postgres rejects a value it cannot parse with `22P02` at bind\n * time, so the query fails outright instead of returning an empty result set.\n *\n * Deliberately stricter than Postgres, which also accepts the unhyphenated\n * 32-hex and brace-wrapped forms. We only ever emit the canonical form, so\n * `isUuid(x) === false` means \"not one of ours\", not \"Postgres would reject x\".\n */\nexport function isUuid(value: string): boolean {\n  return UUID_RE.test(value);\n}\n\n/** Convert a UUID hex string (with or without hyphens) to a 16-byte Uint8Array. */\nfunction uuidToBytes(uuid: string): Uint8Array {\n  const hex = uuid.replace(/-/g, '');\n  const bytes = new Uint8Array(16);\n  for (let i = 0; i < 16; i++) {\n    bytes[i] = parseInt(hex.slice(i * 2, i * 2 + 2), 16);\n  }\n  return bytes;\n}\n\n/** Convert a 16-byte Uint8Array to a hyphenated UUID string. */\nfunction bytesToUuid(bytes: Uint8Array): string {\n  const hex = Array.from(bytes)\n    .map((b) => b.toString(16).padStart(2, '0'))\n    .join('');\n  return `${hex.slice(0, 8)}-${hex.slice(8, 12)}-${hex.slice(12, 16)}-${hex.slice(16, 20)}-${hex.slice(20)}`;\n}\n\n/** Encode a raw UUID into a prefixed ID string. */\nexport function encodePrefixedId(prefix: EntityPrefixValue, uuid: string): string {\n  const bytes = uuidToBytes(uuid);\n  return `${prefix}_${encodeBase58(bytes)}`;\n}\n\n/** Decode a prefixed ID string back to { prefix, uuid }. Returns null on invalid input. */\nexport function decodePrefixedId(\n  id: string\n): { prefix: EntityPrefixValue; uuid: string } | null {\n  const match = id.match(PREFIXED_RE);\n  if (!match) return null;\n\n  const prefix = match[1]!;\n  if (!VALID_PREFIXES.has(prefix)) return null;\n\n  const decoded = decodeBase58(match[2]!);\n  if (!decoded || decoded.length < 16 || decoded.length > 17) return null;\n\n  // Base58 decoding may produce 17 bytes for some UUIDs — strip leading zero byte\n  let normalized = decoded;\n  if (decoded.length === 17) {\n    if (decoded[0] !== 0) return null; // corrupted input\n    normalized = decoded.slice(1);\n  }\n\n  return { prefix: prefix as EntityPrefixValue, uuid: bytesToUuid(normalized) };\n}\n\nexport type ParsedId =\n  | { kind: 'prefixed'; prefix: EntityPrefixValue; uuid: string }\n  | { kind: 'raw_uuid'; uuid: string }\n  | { kind: 'invalid' };\n\n/**\n * Parse any ID input — accepts a prefixed ID, a raw UUID, or returns invalid.\n * This is the backwards-compatible entry point used during migration.\n */\nexport function parseAnyId(input: string): ParsedId {\n  // Try prefixed first\n  const decoded = decodePrefixedId(input);\n  if (decoded) return { kind: 'prefixed', ...decoded };\n\n  // Try raw UUID\n  if (UUID_RE.test(input)) return { kind: 'raw_uuid', uuid: input.toLowerCase() };\n\n  return { kind: 'invalid' };\n}\n\n","/**\n * Shared logic for finding bare registered prefixed entity IDs inside\n * markdown text — the single source for both the web app's\n * `EntityLinkMarkdown` linkifier and any server-side markdown-entity\n * resolution (e.g. product-map capability bodies).\n *\n * @module EntityLink\n */\n\nimport { EntityPrefix } from './registry.js';\n\nconst prefixAlternation = Object.values(EntityPrefix)\n  .sort((left, right) => right.length - left.length)\n  .join('|');\n\n/** Matches a bare registered prefixed entity ID, e.g. `wf_abc123`. */\nexport const BARE_ENTITY_ID = new RegExp(\n  `(^|[^A-Za-z0-9_])((?:${prefixAlternation})_[1-9A-HJ-NP-Za-km-z]+)(?![A-Za-z0-9_])`,\n  'g'\n);\n\n/** Matches fenced code blocks, inline code, and existing markdown links — segments to skip. */\nexport const PROTECTED_MARKDOWN = /(```[\\s\\S]*?```|`[^`\\n]+`|\\[[^\\]]*\\]\\([^)]+\\))/g;\n\nfunction shortEntityId(id: string): string {\n  if (id.length <= 18) return id;\n  const separator = id.indexOf('_');\n  return `${id.slice(0, separator + 1)}${id.slice(separator + 1, separator + 9)}…`;\n}\n\n/**\n * Splits markdown into segments, tagging each as protected (fenced code,\n * inline code, existing markdown links) or plain. Protected segments must be\n * left untouched by both linkification and entity-id extraction.\n */\nfunction splitProtectedSegments(markdown: string): Array<{ text: string; protected: boolean }> {\n  return markdown\n    .split(PROTECTED_MARKDOWN)\n    .map((text) => ({ text, protected: Boolean(text.match(PROTECTED_MARKDOWN)) }));\n}\n\nfunction linkifyPlainSegment(segment: string): string {\n  return segment.replace(BARE_ENTITY_ID, (_match, leading: string, id: string) => {\n    return `${leading}[${shortEntityId(id)}](/lookup/${id})`;\n  });\n}\n\n/**\n * Linkifies bare registered entity IDs while leaving fenced code blocks,\n * inline code, and existing markdown links untouched. Markdown links\n * intentionally route through `/lookup` so org checks and canonical entity\n * URLs stay centralized.\n */\nexport function linkifyEntityIds(markdown: string): string {\n  return splitProtectedSegments(markdown)\n    .map(({ text, protected: isProtected }) => (isProtected ? text : linkifyPlainSegment(text)))\n    .join('');\n}\n\n/**\n * Extracts the bare registered prefixed entity IDs appearing in a markdown\n * string, skipping fenced code blocks, inline code, and existing markdown\n * links. Order-preserving, de-duplicated.\n */\nexport function extractEntityIds(markdown: string): string[] {\n  const ids: string[] = [];\n  const seen = new Set<string>();\n  for (const { text, protected: isProtected } of splitProtectedSegments(markdown)) {\n    if (isProtected) continue;\n    for (const match of text.matchAll(BARE_ENTITY_ID)) {\n      const id = match[2];\n      if (id && !seen.has(id)) {\n        seen.add(id);\n        ids.push(id);\n      }\n    }\n  }\n  return ids;\n}\n","/**\n * Branded ID types for compile-time safety across the prefixed ID boundary.\n *\n * Per-entity types use template literals so the compiler enforces prefix matching:\n *   FlowId = `wf_${string}`   — only matches \"wf_abc123\", not \"exec_abc123\"\n *   FlowUuid = Uuid & { __entity: 'wf' } — a UUID known to reference a workflow\n *\n * @module types\n * @see packages/ids/src/prefixed-id.ts\n */\n\nimport { parseAnyId } from './prefixed-id.js';\nimport type { EntityPrefix } from './registry.js';\n\n// ---------------------------------------------------------------------------\n// Base branded types\n// ---------------------------------------------------------------------------\n\n/** A raw UUID. What the DB stores. What repos, services, and DB code accept. */\nexport type Uuid = string & { readonly __brand: 'Uuid' };\n\n/** A prefixed entity ID like `wf_abc123`. What users see in URLs. */\nexport type EntityId = string & { readonly __brand: 'EntityId' };\n\n/** Union: accepts both prefixed IDs and raw UUIDs (route params during migration). */\nexport type AnyEntityId = EntityId | Uuid;\n\n// ---------------------------------------------------------------------------\n// Per-entity prefixed ID types (template literal — compiler checks the prefix)\n// ---------------------------------------------------------------------------\n\n/** Derive a prefixed ID type from a prefix string: `wf_${string}` */\ntype PrefixedId<P extends string> = `${P}_${string}` & { readonly __brand: 'EntityId' };\n\nexport type OrganizationId = PrefixedId<typeof EntityPrefix.organization>;\nexport type FlowId = PrefixedId<typeof EntityPrefix.workflow>;\nexport type ExecutionId = PrefixedId<typeof EntityPrefix.workflowTestExecution>;\nexport type TestRunId = PrefixedId<typeof EntityPrefix.workflowTestRun>;\nexport type WorkflowRunId = PrefixedId<typeof EntityPrefix.workflowRun>;\nexport type IssueId = PrefixedId<typeof EntityPrefix.issue>;\nexport type PropertyId = PrefixedId<typeof EntityPrefix.property>;\nexport type CredentialId = PrefixedId<typeof EntityPrefix.credential>;\nexport type PerfTestId = PrefixedId<typeof EntityPrefix.perfTest>;\nexport type PerfRunId = PrefixedId<typeof EntityPrefix.perfRun>;\n\n// ---------------------------------------------------------------------------\n// Per-entity UUID types (branded — a UUID known to reference a specific entity)\n// ---------------------------------------------------------------------------\n\n/** A UUID branded with the entity type it references. */\ntype EntityUuid<P extends string> = Uuid & { readonly __entity: P };\n\nexport type OrganizationUuid = EntityUuid<typeof EntityPrefix.organization>;\nexport type FlowUuid = EntityUuid<typeof EntityPrefix.workflow>;\nexport type ExecutionUuid = EntityUuid<typeof EntityPrefix.workflowTestExecution>;\nexport type TestRunUuid = EntityUuid<typeof EntityPrefix.workflowTestRun>;\nexport type WorkflowRunUuid = EntityUuid<typeof EntityPrefix.workflowRun>;\nexport type IssueUuid = EntityUuid<typeof EntityPrefix.issue>;\nexport type PropertyUuid = EntityUuid<typeof EntityPrefix.property>;\nexport type CredentialUuid = EntityUuid<typeof EntityPrefix.credential>;\nexport type PerfTestUuid = EntityUuid<typeof EntityPrefix.perfTest>;\nexport type PerfRunUuid = EntityUuid<typeof EntityPrefix.perfRun>;\n\n// ---------------------------------------------------------------------------\n// Constructors\n// ---------------------------------------------------------------------------\n\n/** Brand a validated prefixed ID string. Returns null if not a valid prefixed format. */\nexport function toEntityId(value: string): EntityId | null {\n  const parsed = parseAnyId(value);\n  return parsed.kind === 'prefixed' ? (value as EntityId) : null;\n}\n\n/** Brand a known-valid UUID string. Use `extractUuid` for route params that may be prefixed. */\nexport function toUuid(value: string): Uuid | null {\n  const parsed = parseAnyId(value);\n  if (parsed.kind === 'raw_uuid') return parsed.uuid as Uuid;\n  return null;\n}\n\n/** Brand any valid ID (prefixed or UUID). Returns null if invalid format. */\nexport function toAnyEntityId(value: string): AnyEntityId | null {\n  const parsed = parseAnyId(value);\n  return parsed.kind !== 'invalid' ? (value as AnyEntityId) : null;\n}\n\n// ---------------------------------------------------------------------------\n// Pure extraction (the main function most routes use)\n// ---------------------------------------------------------------------------\n\n/**\n * Extract a UUID from any entity ID format (prefixed or raw UUID).\n *\n * Pure compute — no DB, no Effect, no org check. Returns a branded `Uuid`\n * that repos and services can accept. Returns null if unparseable.\n *\n * Most routes should use this. Only cross-org redirect endpoints need\n * the full `resolveEntityOrg` middleware.\n */\nexport function extractUuid(raw: string | null | undefined): Uuid | null {\n  if (!raw) return null;\n  const parsed = parseAnyId(raw);\n  if (parsed.kind === 'prefixed') return parsed.uuid.toLowerCase() as Uuid;\n  if (parsed.kind === 'raw_uuid') return parsed.uuid.toLowerCase() as Uuid;\n  return null;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AASA,OAAO,aAAa;;;ACCb,IAAM,eAAe;AAAA,EAC1B,WAAW;AAAA,EACX,eAAe;AAAA,EACf,cAAc;AAAA,EACd,kBAAkB;AAAA,EAClB,cAAc;AAAA,EACd,UAAU;AAAA,EACV,uBAAuB;AAAA,EACvB,iBAAiB;AAAA,EACjB,aAAa;AAAA,EACb,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,UAAU;AAAA,EACV,SAAS;AAAA,EACT,OAAO;AAAA,EACP,UAAU;AAAA,EACV,YAAY;AAAA,EACZ,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,oBAAoB;AAAA,EACpB,wBAAwB;AAAA,EACxB,WAAW;AAAA,EACX,eAAe;AAAA,EACf,aAAa;AAAA,EACb,aAAa;AAAA,EACb,aAAa;AAAA,EACb,mBAAmB;AAAA,EACnB,uBAAuB;AAAA,EACvB,aAAa;AAAA,EACb,UAAU;AAAA,EACV,QAAQ;AAAA,EACR,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,oBAAoB;AAAA,EACpB,kBAAkB;AAAA,EAClB,iBAAiB;AAAA,EACjB,wBAAwB;AAAA,EACxB,YAAY;AACd;AAgCO,IAAM,kBAAkE;AAAA,EAC7E,OAAO,EAAE,WAAW,eAAe,aAAa,UAAU,UAAU,KAAK;AAAA,EACzE,QAAQ,EAAE,WAAW,oBAAoB,aAAa,UAAU,UAAU,KAAK;AAAA,EAC/E,OAAO,EAAE,WAAW,mBAAmB,aAAa,UAAU,UAAU,KAAK;AAAA,EAC7E,OAAO,EAAE,WAAW,uBAAuB,aAAa,UAAU,UAAU,KAAK;AAAA,EACjF,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,IAAI;AAAA,IACF,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,UAAU,UAAU;AAAA,EACpD;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,cAAc,UAAU;AAAA,EACxD;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,iBAAiB,MAAM,cAAc,gBAAgB;AAAA,IAClE,cAAc;AAAA,MACZ,YAAY;AAAA,MACZ,cAAc;AAAA,IAChB;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA;AAAA,EAEZ;AAAA,EACA,OAAO;AAAA,IACL,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,gBAAgB,UAAU;AAAA,EAC1D;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,OAAO;AAAA,IACL,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,mBAAmB,UAAU;AAAA,EAC7D;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,eAAe,UAAU;AAAA,EACzD;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,IAAI;AAAA,IACF,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,oBAAoB,UAAU;AAAA,EAC9D;AAAA,EACA,IAAI;AAAA,IACF,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,IAAI;AAAA,IACF,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,iBAAiB,MAC5B,mBAAmB,cAAc,gBAAgB,gBAAgB;AAAA,IACnE,cAAc;AAAA,MACZ,YAAY;AAAA,MACZ,cAAc;AAAA,IAChB;AAAA,EACF;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,OAAO;AAAA,IACL,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,qBAAqB,UAAU;AAAA,IAC7D,mBAAmB;AAAA,EACrB;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,2BAA2B,UAAU;AAAA,IACnE,mBAAmB;AAAA,EACrB;AAAA,EACA,OAAO;AAAA,IACL,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAWA,IAAI;AAAA,IACF,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,eAAe,UAAU;AAAA,EACzD;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,YAAY,UAAU;AAAA,EACtD;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,mBAAmB,UAAU;AAAA,EAC7D;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,KAAK;AAAA,IACH,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AAAA,EACA,OAAO;AAAA,IACL,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,IACV,UAAU,CAAC,EAAE,WAAW,MAAM,WAAW,UAAU;AAAA,EACrD;AAAA,EACA,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,aAAa;AAAA,IACb,UAAU;AAAA,EACZ;AACF;AAGA,OAAO,OAAO,eAAe;AAG7B,IAAM,aAAa;AAGnB,WAAW,CAAC,QAAQ,KAAK,KAAK,OAAO,QAAQ,eAAe,GAAG;AAC7D,aAAW,SAAS,CAAC,MAAM,WAAW,MAAM,aAAa,MAAM,QAAQ,EAAE;AAAA,IACvE;AAAA,EACF,GAAe;AACb,QAAI,CAAC,WAAW,KAAK,KAAK,GAAG;AAC3B,YAAM,IAAI,MAAM,0CAA0C,MAAM,QAAQ,KAAK,GAAG;AAAA,IAClF;AAAA,EACF;AACF;AAGO,IAAM,iBAAiB,IAAI,IAAY,OAAO,KAAK,eAAe,CAAC;;;AC1T1E,IAAM,WAAW;AACjB,IAAM,OAAO;AAEb,IAAM,eAAe,oBAAI,IAAoB;AAC7C,SAAS,IAAI,GAAG,IAAI,SAAS,QAAQ,KAAK;AACxC,eAAa,IAAI,SAAS,CAAC,GAAI,CAAC;AAClC;AAqCO,SAAS,aAAa,KAAgC;AAC3D,MAAI,IAAI,WAAW,EAAG,QAAO,IAAI,WAAW,CAAC;AAG7C,MAAI,cAAc;AAClB,SAAO,cAAc,IAAI,UAAU,IAAI,WAAW,MAAM,SAAS,CAAC,GAAG;AACnE;AAAA,EACF;AAEA,QAAM,QAAkB,CAAC;AACzB,WAAS,IAAI,aAAa,IAAI,IAAI,QAAQ,KAAK;AAC7C,UAAM,QAAQ,aAAa,IAAI,IAAI,CAAC,CAAE;AACtC,QAAI,UAAU,OAAW,QAAO;AAEhC,QAAI,QAAQ;AACZ,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,eAAS,MAAM,CAAC,IAAK;AACrB,YAAM,CAAC,IAAI,QAAQ;AACnB,gBAAU;AAAA,IACZ;AACA,WAAO,QAAQ,GAAG;AAChB,YAAM,KAAK,QAAQ,GAAI;AACvB,gBAAU;AAAA,IACZ;AAAA,EACF;AAGA,QAAM,SAAS,IAAI,WAAW,cAAc,MAAM,MAAM;AAExD,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,WAAO,cAAc,CAAC,IAAI,MAAM,MAAM,SAAS,IAAI,CAAC;AAAA,EACtD;AAEA,SAAO;AACT;;;AC1EA,IAAMA,WAAU;AAChB,IAAM,cAAc;AA4BpB,SAAS,YAAY,OAA2B;AAC9C,QAAM,MAAM,MAAM,KAAK,KAAK,EACzB,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,EAAE,SAAS,GAAG,GAAG,CAAC,EAC1C,KAAK,EAAE;AACV,SAAO,GAAG,IAAI,MAAM,GAAG,CAAC,CAAC,IAAI,IAAI,MAAM,GAAG,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,IAAI,EAAE,CAAC,IAAI,IAAI,MAAM,EAAE,CAAC;AAC1G;AASO,SAAS,iBACd,IACoD;AACpD,QAAM,QAAQ,GAAG,MAAM,WAAW;AAClC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,SAAS,MAAM,CAAC;AACtB,MAAI,CAAC,eAAe,IAAI,MAAM,EAAG,QAAO;AAExC,QAAM,UAAU,aAAa,MAAM,CAAC,CAAE;AACtC,MAAI,CAAC,WAAW,QAAQ,SAAS,MAAM,QAAQ,SAAS,GAAI,QAAO;AAGnE,MAAI,aAAa;AACjB,MAAI,QAAQ,WAAW,IAAI;AACzB,QAAI,QAAQ,CAAC,MAAM,EAAG,QAAO;AAC7B,iBAAa,QAAQ,MAAM,CAAC;AAAA,EAC9B;AAEA,SAAO,EAAE,QAAqC,MAAM,YAAY,UAAU,EAAE;AAC9E;AAWO,SAAS,WAAW,OAAyB;AAElD,QAAM,UAAU,iBAAiB,KAAK;AACtC,MAAI,QAAS,QAAO,EAAE,MAAM,YAAY,GAAG,QAAQ;AAGnD,MAAIC,SAAQ,KAAK,KAAK,EAAG,QAAO,EAAE,MAAM,YAAY,MAAM,MAAM,YAAY,EAAE;AAE9E,SAAO,EAAE,MAAM,UAAU;AAC3B;;;ACrFA,IAAM,oBAAoB,OAAO,OAAO,YAAY,EACjD,KAAK,CAAC,MAAM,UAAU,MAAM,SAAS,KAAK,MAAM,EAChD,KAAK,GAAG;AAGJ,IAAM,iBAAiB,IAAI;AAAA,EAChC,wBAAwB,iBAAiB;AAAA,EACzC;AACF;;;ACgFO,SAAS,YAAY,KAA6C;AACvE,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,WAAW,GAAG;AAC7B,MAAI,OAAO,SAAS,WAAY,QAAO,OAAO,KAAK,YAAY;AAC/D,MAAI,OAAO,SAAS,WAAY,QAAO,OAAO,KAAK,YAAY;AAC/D,SAAO;AACT;;;AL3DA,IAAM,sBAAsB,oBAAI,IAAI,CAAC,iBAAiB,cAAc,eAAe,CAAC;AAS7E,SAAS,uBAAuB,MAAwC;AAC7E,QAAM,cAAsC,CAAC;AAC7C,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,oBAAoB,IAAI,GAAG,GAAG;AAChC;AACA;AAAA,IACF;AACA,QAAI,IAAI,WAAW,IAAI,EAAG;AAE1B,UAAM,YAAY,IAAI,QAAQ,GAAG;AACjC,QAAI,aAAa,GAAG;AAClB,YAAM,IAAI,MAAM,6BAA6B,GAAG,IAAI;AAAA,IACtD;AACA,UAAM,OAAO,IAAI,MAAM,GAAG,SAAS;AAInC,QAAI,CAAC,aAAa,KAAK,IAAI,GAAG;AAC5B,YAAM,IAAI;AAAA,QACR,0BAA0B,IAAI;AAAA,MAChC;AAAA,IACF;AAEA,gBAAY,IAAI,IAAI,IAAI,MAAM,YAAY,CAAC;AAAA,EAC7C;AACA,SAAO;AACT;AAOO,SAAS,gBAAgB,MAAgB,OAAuC;AACrF,QAAM,QAAkB,CAAC;AACzB,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,oBAAoB,IAAI,GAAG,GAAG;AAChC;AACA;AAAA,IACF;AACA,QAAI,CAAC,IAAI,WAAW,IAAI,EAAG,OAAM,KAAK,GAAG;AAAA,EAC3C;AACA,MAAI,MAAM,WAAW,KAAK,MAAM,CAAC,EAAE,SAAS,GAAG,GAAG;AAChD,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,QAAM,OAAO,MAAM,CAAC;AACpB,MAAI,CAAC,aAAa,KAAK,IAAI,GAAG;AAC5B,UAAM,IAAI;AAAA,MACR,0BAA0B,IAAI;AAAA,IAChC;AAAA,EACF;AACA,QAAM,QAAQ,wBAAwB,KAAK;AAG3C,MAAI,UAAU,IAAI;AAChB,UAAM,IAAI,MAAM,uCAAuC,IAAI,iCAAiC,IAAI,YAAY;AAAA,EAC9G;AACA,SAAO,EAAE,CAAC,IAAI,GAAG,MAAM;AACzB;AAEA,SAAS,IAAI,GAAW,GAAmB;AACzC,SAAO,EAAE,OAAO,CAAC;AACnB;AAEA,SAAS,YAAkB;AACzB,UAAQ;AAAA,IACN;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;AAGA,eAAe,gBAAgB,MAAgB,QAAgB,OAAe;AAC5E,QAAM,MAAM,YAAY,MAAM,eAAe,KAAK,YAAY,MAAM,YAAY;AAChF,MAAI,CAAC,KAAK;AACR,YAAQ,MAAM,6CAA6C;AAC3D,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,aAAa,MAAM,gBAAgB,QAAQ,KAAK;AACtD,QAAM,kBAAkB,IAAI,WAAW,OAAO,IAAI,YAAY,GAAG,IAAI;AACrE,QAAM,QAAQ,WAAW;AAAA,IACvB,CAAC,MAAM,EAAE,OAAO,OAAO,EAAE,OAAO,mBAAmB,EAAE,KAAK,YAAY,MAAM,IAAI,YAAY;AAAA,EAC9F;AACA,QAAM,WAAW,MAAa;AAC5B,YAAQ,MAAM,uBAAuB,GAAG,cAAc;AACtD,QAAI,WAAW,SAAS,GAAG;AACzB,cAAQ,MAAM,yBAAyB;AACvC,iBAAW,KAAK,WAAY,SAAQ,MAAM,OAAO,EAAE,IAAI,KAAK,EAAE,EAAE,GAAG;AAAA,IACrE;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,SAAO,EAAE,KAAK,OAAO,UAAU,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;AACtE;AAGA,eAAsB,qBACpB,MACA,QACA,OACiB;AACjB,QAAM,EAAE,OAAO,SAAS,IAAI,MAAM,gBAAgB,MAAM,QAAQ,KAAK;AACrE,SAAO,QAAQ,MAAM,KAAK,SAAS;AACrC;AASA,eAAsB,kCACpB,MACA,QACA,OAEA,cACiB;AACjB,QAAM,EAAE,KAAK,OAAO,UAAU,MAAM,IAAI,MAAM,gBAAgB,MAAM,QAAQ,KAAK;AACjF,MAAI,MAAO,QAAO,MAAM;AAExB,MAAI,QAAQ,KAAK,GAAG,KAAK,IAAI,WAAW,OAAO,EAAG,UAAS;AAC3D,QAAM,eAAe;AACrB,QAAM,UAAU,MAAM,WAAyD,QAAQ,OAAO,QAAQ,mBAAmB;AAAA,IACvH,MAAM;AAAA,IACN,oBAAoB,EAAE,sBAAsB,UAAU;AAAA,EACxD,CAAC;AACD,MAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,IAAI;AAC9B,YAAQ,MAAM,gCAAgC,GAAG,MAAM,QAAQ,SAAS,eAAe,EAAE;AACzF,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,QAAM,SAAS,MAAM,SAAS,IAAI,2CAA2C,MAAM,KAAK,IAAI,CAAC,MAAM;AACnG,UAAQ;AAAA,IACN,wBAAwB,GAAG,wHAAwH,MAAM;AAAA,EAC3J;AACA,SAAO,QAAQ;AACjB;AAEA,eAAsB,kBACpB,YACA,QACA,OAC4B;AAC5B,QAAM,MAAM,MAAM;AAAA,IAChB;AAAA,IACA;AAAA,IACA;AAAA,IACA,mBAAmB,UAAU;AAAA,EAC/B;AACA,MAAI,CAAC,IAAI,IAAI;AACX,YAAQ,MAAM,UAAU,IAAI,SAAS,6BAA6B,EAAE;AACpE,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,SAAO,IAAI,SAAS,CAAC;AACvB;AAGA,SAAS,eAAe,GAA4B;AAClD,MAAI,EAAE,qBAAsB,QAAO,OAAO,EAAE,oBAAoB;AAChE,SAAO,EAAE,qBAAqB;AAChC;AAEA,eAAe,WAAW,MAAgB,QAAgB,OAA8B;AACtF,QAAM,OAAO,QAAQ,MAAM,QAAQ;AACnC,QAAM,aAAa,MAAM,qBAAqB,MAAM,QAAQ,KAAK;AACjE,QAAM,QAAQ,MAAM,kBAAkB,YAAY,QAAQ,KAAK;AAE/D,MAAI,MAAM;AACR,mBAAe,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAC7C;AAAA,EACF;AACA,MAAI,MAAM,WAAW,GAAG;AACtB,YAAQ,IAAI,wBAAwB;AACpC;AAAA,EACF;AACA,UAAQ;AAAA,IACN,GAAG,IAAI,QAAQ,EAAE,CAAC,IAAI,IAAI,SAAS,EAAE,CAAC,IAAI,IAAI,QAAQ,EAAE,CAAC,IAAI,IAAI,WAAW,CAAC,CAAC,IAAI,IAAI,OAAO,EAAE,CAAC;AAAA,EAClG;AACA,aAAW,KAAK,OAAO;AACrB,YAAQ;AAAA,MACN,GAAG,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,uBAAuB,IAAI,EAAE,CAAC,IAAI,IAAI,EAAE,MAAM,EAAE,CAAC,IAAI,IAAI,EAAE,YAAY,QAAQ,IAAI,CAAC,CAAC,IAC5G,IAAI,EAAE,OAAO,UAAU,EAAE,CAAC,IAAI,eAAe,CAAC,CAAC;AAAA,IACtD;AAAA,EACF;AACF;AAEA,eAAe,aAAa,MAAgB,QAAgB,OAA8B;AACxF,QAAM,OAAO,QAAQ,MAAM,QAAQ;AACnC,QAAM,aAAa,MAAM,qBAAqB,MAAM,QAAQ,KAAK;AACjE,QAAM,OAAO,YAAY,MAAM,QAAQ;AACvC,QAAM,OAAQ,YAAY,MAAM,QAAQ,KAAK;AAC7C,QAAM,MAAM,YAAY,MAAM,OAAO;AACrC,QAAM,oBAAoB,YAAY,MAAM,oBAAoB;AAChE,QAAM,YAAY,YAAY,MAAM,cAAc;AAClD,QAAM,cAAc,YAAY,MAAM,eAAe;AACrD,QAAM,QAAQ,YAAY,MAAM,SAAS;AACzC,QAAM,YAAY,QAAQ,MAAM,WAAW;AAE3C,MAAI,CAAC,MAAM;AACT,YAAQ,MAAM,4BAA4B;AAC1C,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,SAAS,aAAa,CAAC,mBAAmB;AAC5C,YAAQ;AAAA,MACN;AAAA,IACF;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,SAAS,aAAa,CAAC,KAAK;AAC9B,YAAQ,MAAM,uCAAuC,IAAI,GAAG;AAC5D,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,OAAgC,EAAE,MAAM,KAAK;AACnD,MAAI,QAAQ,OAAW,MAAK,MAAM;AAClC,MAAI,sBAAsB,OAAW,MAAK,oBAAoB;AAC9D,MAAI,cAAc,OAAW,MAAK,YAAY;AAC9C,MAAI,gBAAgB,OAAW,MAAK,cAAc;AAClD,MAAI,UAAU,QAAW;AACvB,QAAI,kEAAkE,KAAK,KAAK,GAAG;AACjF,WAAK,oBAAoB;AAAA,IAC3B,OAAO;AACL,WAAK,sBAAsB;AAAA,IAC7B;AAAA,EACF;AACA,MAAI,UAAW,MAAK,YAAY;AAEhC,QAAM,SAAS,MAAM,WAMlB,QAAQ,OAAO,QAAQ,mBAAmB,UAAU,iBAAiB,IAAI;AAE5E,MAAI,CAAC,OAAO,IAAI;AACd,QAAI,KAAM,gBAAe,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,SACnD;AACH,cAAQ,MAAM,UAAU,OAAO,SAAS,eAAe,EAAE;AACzD,iBAAW,SAAS,OAAO,UAAU,CAAC,EAAG,SAAQ,MAAM,KAAK,MAAM,IAAI,KAAK,MAAM,OAAO,EAAE;AAAA,IAC5F;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,MAAM;AACR,mBAAe,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC9C;AAAA,EACF;AACA,UAAQ,IAAI,WAAW,IAAI,iBAAiB,IAAI,MAAM,OAAO,MAAM,MAAM,GAAG,GAAG;AACjF;AAEA,eAAe,iBAAiB,MAAgB,QAAgB,OAA8B;AAC5F,QAAM,OAAO,QAAQ,MAAM,QAAQ;AACnC,QAAM,aAAa,MAAM,qBAAqB,MAAM,QAAQ,KAAK;AACjE,QAAM,SAAS,YAAY,MAAM,eAAe;AAChD,MAAI,CAAC,QAAQ;AACX,YAAQ,MAAM,6CAA6C;AAC3D,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,QAAM,QAAQ,MAAM,kBAAkB,YAAY,QAAQ,KAAK;AAC/D,QAAM,QAAQ,mBAAmB,OAAO,MAAM;AAE9C,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,mBAAmB,UAAU,iBAAiB,MAAM,EAAE;AAAA,EACxD;AAEA,MAAI,CAAC,OAAO,IAAI;AACd,QAAI,KAAM,gBAAe,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,QACnD,SAAQ,MAAM,UAAU,OAAO,SAAS,eAAe,EAAE;AAC9D,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,MAAM;AACR,mBAAe,KAAK,UAAU,EAAE,IAAI,MAAM,eAAe,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC;AAC7E;AAAA,EACF;AACA,UAAQ,IAAI,QAAQ,MAAM,IAAI,MAAM,MAAM,EAAE,+BAA+B;AAC7E;AAGO,SAAS,mBAAmB,OAA0B,QAAiC;AAC5F,QAAM,QAAQ,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,UAAU,EAAE,KAAK,YAAY,MAAM,OAAO,YAAY,CAAC;AAChG,MAAI,CAAC,OAAO;AACV,YAAQ,MAAM,uBAAuB,MAAM,mCAAmC;AAC9E,QAAI,MAAM,SAAS,GAAG;AACpB,cAAQ,MAAM,yBAAyB;AACvC,iBAAW,KAAK,MAAO,SAAQ,MAAM,OAAO,EAAE,IAAI,KAAK,EAAE,EAAE,GAAG;AAAA,IAChE;AACA,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,SAAO;AACT;AAEA,eAAsB,aAAa,MAAgB,QAAgB,OAA8B;AAC/F,QAAM,OAAO,QAAQ,MAAM,QAAQ;AACnC,QAAM,aAAa,MAAM,qBAAqB,MAAM,QAAQ,KAAK;AACjE,QAAM,SAAS,YAAY,MAAM,eAAe;AAChD,MAAI,CAAC,QAAQ;AACX,YAAQ,MAAM,6CAA6C;AAC3D,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI,QAAQ,MAAM,SAAS,KAAK,QAAQ,MAAM,OAAO;AACnD,YAAQ,MAAM,8GAA8G;AAC5H,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,MAAI;AACJ,MAAI;AACF,kBAAc,QAAQ,MAAM,SAAS,IACjC,gBAAgB,MAAM,MAAM,UAAU,CAAC,IACvC,uBAAuB,IAAI;AAAA,EACjC,SAAS,KAAK;AACZ,YAAQ,MAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC1E,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,OAAO,KAAK,WAAW,EAAE,WAAW,GAAG;AACzC,YAAQ,MAAM,wDAAwD;AACtE,YAAQ,KAAK,CAAC;AAAA,EAChB;AAGA,QAAM,QAAQ,MAAM,kBAAkB,YAAY,QAAQ,KAAK;AAC/D,QAAM,QAAQ,mBAAmB,OAAO,MAAM;AAI9C,MAAI,QAAQ,MAAM,aAAa,GAAG;AAChC,UAAM;AAAA,MACJ;AAAA,MACA,OAAO,KAAK,WAAW,EAAE,IAAI,CAAC,UAAU,EAAE,MAAM,WAAW,KAAK,EAAE;AAAA,MAClE;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAWA,QAAM,eAAe,EAAE,GAAG,MAAM,cAAc,GAAG,YAAY;AAE7D,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,mBAAmB,UAAU,iBAAiB,MAAM,EAAE;AAAA,IACtD,EAAE,aAAa;AAAA,EACjB;AAEA,MAAI,CAAC,OAAO,IAAI;AACd,QAAI,KAAM,gBAAe,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,QACnD,SAAQ,MAAM,UAAU,OAAO,SAAS,eAAe,EAAE;AAC9D,YAAQ,KAAK,CAAC;AAAA,EAChB;AACA,MAAI,MAAM;AACR;AAAA,MAAe,KAAK;AAAA,QAChB,EAAE,IAAI,MAAM,eAAe,MAAM,IAAI,cAAc,OAAO,MAAM,gBAAgB,CAAC,EAAE;AAAA,QACnF;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,QAAQ,OAAO,KAAK,WAAW,EAAE,KAAK,IAAI;AAChD,UAAQ,IAAI,OAAO,KAAK,QAAQ,MAAM,IAAI,MAAM,MAAM,EAAE,IAAI;AAC9D;AAEA,eAAsB,eAAe,MAA+B;AAClE,QAAM,CAAC,YAAY,GAAG,IAAI,IAAI;AAE9B,MAAI,CAAC,cAAc,eAAe,UAAU,QAAQ,MAAM,UAAU,IAAI,GAAG;AACzE,cAAU;AACV;AAAA,EACF;AAEA,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,cAAc,IAAI;AAElD,QAAM,cAAc,oBAAI,IAAI,CAAC,SAAS,aAAa,WAAW,OAAO,CAAC;AACtE,QAAM,OAAO,KAAK,OAAO,CAAC,KAAK,MAAM;AACnC,QAAI,YAAY,IAAI,GAAG,EAAG,QAAO;AACjC,QAAI,IAAI,KAAK,YAAY,IAAI,KAAK,IAAI,CAAC,CAAC,EAAG,QAAO;AAClD,WAAO;AAAA,EACT,CAAC;AAED,UAAQ,YAAY;AAAA,IAClB,KAAK;AACH,YAAM,WAAW,MAAM,QAAQ,KAAK;AACpC;AAAA,IACF,KAAK;AACH,YAAM,aAAa,MAAM,QAAQ,KAAK;AACtC;AAAA,IACF,KAAK;AACH,YAAM,iBAAiB,MAAM,QAAQ,KAAK;AAC1C;AAAA,IACF,KAAK;AACH,YAAM,aAAa,MAAM,QAAQ,KAAK;AACtC;AAAA,IACF;AACE,cAAQ,MAAM,wBAAwB,UAAU,EAAE;AAClD,gBAAU;AACV,cAAQ,KAAK,CAAC;AAAA,EAClB;AACF;","names":["UUID_RE","UUID_RE"]}

package/dist/{chunk-6X6ZTDXP.js → chunk-BDOL622T.js}

@@ -1,16 +1,16 @@
 import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
 import {
   apiRequest
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput,
   writeUntrustedText
-} from "./chunk-KL2ARGH6.js";
+} from "./chunk-2OHYMT3A.js";
 
 // src/triage.ts
 import process from "process";
@@ -274,4 +274,4 @@ export {
   printTriageSummary,
   runTriage
 };
-//# sourceMappingURL=chunk-6X6ZTDXP.js.map
+//# sourceMappingURL=chunk-BDOL622T.js.map

package/dist/{chunk-L4JQ236V.js → chunk-C3CXVX2B.js}

@@ -1,15 +1,15 @@
 import { createRequire as __cr } from "module"; import { fileURLToPath as __fup } from "url"; import { dirname as __dn } from "path"; const require = __cr(import.meta.url); const __filename = __fup(import.meta.url); const __dirname = __dn(__filename);
 import {
   apiRequest
-} from "./chunk-WWUEKQLR.js";
+} from "./chunk-EWK44F6V.js";
 import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-BJHAVM7Z.js";
+} from "./chunk-4MFMPC5P.js";
 import {
   writeRawOutput
-} from "./chunk-KL2ARGH6.js";
+} from "./chunk-2OHYMT3A.js";
 
 // src/tag.ts
 import process from "process";
@@ -438,4 +438,4 @@ export {
   updateEntityTags,
   runTag
 };
-//# sourceMappingURL=chunk-L4JQ236V.js.map
+//# sourceMappingURL=chunk-C3CXVX2B.js.map

package/dist/{chunk-33U56YGD.js → chunk-CWICLBLU.js}

@@ -3932,6 +3932,7 @@ function writeRecord(req, state) {
   const changes = /* @__PURE__ */ new Map();
   for (const [key2, raw] of form) {
     if (key2.startsWith("_") || key2.toLowerCase() === "apikey") continue;
+    if (key2.toLowerCase() === "rowstamp") continue;
     const def = writable.attributes.get(key2.toUpperCase());
     if (!def) throw new MaximoError(400, `Unknown attribute ${key2.toUpperCase().slice(0, 64)} on ${object}`);
     if (def.name === writable.idAttribute) throw new MaximoError(400, `${def.name} on ${object} is read-only`);
@@ -4945,4 +4946,4 @@ export {
   OIDC_GATE_ROUTE_KEY,
   oidcGateBrowserRoutes
 };
-//# sourceMappingURL=chunk-33U56YGD.js.map
+//# sourceMappingURL=chunk-CWICLBLU.js.map