@runcofactor/cli 0.57.0 → 0.58.0

package/dist/dev-MU45HWAN.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/dev-aws.ts","../src/dev.ts","../../sandbox-helper/src/ade-manifest.ts","../src/dev-ssh.ts","../../ade-relay-protocol/src/index.ts","../src/dev-browser.ts","../../sandbox-helper/ade/ade-start.sh","../../sandbox-helper/ade/ade-sync-repos.sh","../../sandbox-helper/src/ade-scripts.ts","../../sandbox-helper/src/ade-open.ts","../src/dev-home.ts","../src/dev-setup.ts","../src/dev-home-transfer.ts"],"sourcesContent":["/** AWS credential_process. The only stdout is provider JSON; runtime files contain no credentials. */\nimport { readFileSync, writeFileSync, renameSync, statSync } from 'node:fs';\nimport { getArgValue, resolveConfig } from './auth.js';\nimport { apiRequest } from './cli-helpers.js';\nimport { writeRawOutput } from './brand.js';\n\ntype Manifest = {\n  version: 1;\n  execution: { id: string; orgId: string };\n  access: Array<{\n    grantId: string;\n    provider: string;\n    status: string;\n    expiresAt?: string;\n    reason?: string;\n    helper: { profile: string };\n  }>;\n};\ntype CredentialResponse = {\n  ok: boolean;\n  error?: string;\n  data?: {\n    Version: 1;\n    AccessKeyId: string;\n    SecretAccessKey: string;\n    SessionToken: string;\n    Expiration: string;\n  };\n};\nexport async function awsCredentials(argv: string[]): Promise<void> {\n  const manifestPath = process.env.COFACTOR_ACCESS_MANIFEST;\n  const profile = getArgValue(argv, '--aws-profile'),\n    org = getArgValue(argv, '--org');\n  if (\n    process.env.COFACTOR_ENV !== 'ade' ||\n    manifestPath !== '/run/cofactor/access/manifest.json' ||\n    !profile ||\n    !org\n  )\n    throw new Error('AWS credentials require a managed ADE profile and its pinned org.');\n  if ((statSync(manifestPath).mode & 0o077) !== 0)\n    throw new Error('Invalid AWS access manifest permissions.');\n  const manifest: Manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));\n  if (manifest.version !== 1 || manifest.execution.orgId !== org)\n    throw new Error('AWS profile organization mismatch.');\n  const entry = manifest.access.find(\n    (item) => item.provider === 'aws' && item.helper.profile === profile\n  );\n  if (!entry) throw new Error('The AWS profile is not selected for this development environment.');\n  const { apiUrl, token } = await resolveConfig(argv);\n  const result = await apiRequest<CredentialResponse>(\n    apiUrl,\n    token,\n    'POST',\n    `/org/ade/sessions/${encodeURIComponent(manifest.execution.id)}/aws-credentials`,\n    { grantId: entry.grantId }\n  );\n  entry.status = result.ok ? 'ready' : 'unavailable';\n  if (result.ok && result.data) {\n    entry.expiresAt = result.data.Expiration;\n    delete entry.reason;\n  } else {\n    entry.reason = 'The broker refused credential issuance. Re-claim after checking access.';\n    delete entry.expiresAt;\n  }\n  const temp = `${manifestPath}.${process.pid}.tmp`;\n  writeFileSync(temp, JSON.stringify(manifest), { mode: 0o600, flag: 'wx' });\n  renameSync(temp, manifestPath);\n  if (!result.ok || !result.data)\n    throw new Error(\n      'AWS credential issuance was refused; no ambient credential fallback is available.'\n    );\n  writeRawOutput(JSON.stringify(result.data));\n}\n\n/** Admin-only policy writer; emits non-secret role-binding metadata for operator trust approval. */\nexport async function configureAwsPolicy(argv: string[]): Promise<void> {\n  const org = getArgValue(argv, '--org'),\n    policyFile = getArgValue(argv, '--policy'),\n    connectionId = getArgValue(argv, '--connection');\n  if (!org || !policyFile || !connectionId)\n    throw new Error(\n      'Usage: cofactor dev aws-policy --connection <id> --policy <file.json> --org <org>'\n    );\n  const body: unknown = JSON.parse(readFileSync(policyFile, 'utf8'));\n  if (!body || typeof body !== 'object' || Array.isArray(body))\n    throw new Error('The policy file must contain a JSON object.');\n  const { apiUrl, token } = await resolveConfig(argv);\n  const result = await apiRequest<{ ok: boolean; error?: string; data?: unknown }>(\n    apiUrl,\n    token,\n    'PUT',\n    `/org/ade/aws-policies/${encodeURIComponent(connectionId)}`,\n    body as Record<string, unknown>\n  );\n  if (!result.ok) throw new Error(result.error ?? 'AWS policy update was refused.');\n  writeRawOutput(JSON.stringify(result.data));\n}\n","import { awsCredentials, configureAwsPolicy } from './dev-aws.js';\n/**\n * `cofactor dev`: dev environments (ADEs), remote sandboxes a coding agent\n * works in.\n *\n *   cofactor dev [--template <name>]                 claim a session, follow its phases, and attach once its home is mounted\n *   cofactor dev attach [<id>]                       SSH into a session's tmux from this machine (grants this machine's key)\n *   cofactor dev proxy <id>                          ssh's ProxyCommand (written into ~/.ssh/config.d/cofactor-ade)\n *   cofactor dev list [--all]                        your sessions (`--all`: and those ended in the last 7 days)\n *   cofactor dev destroy <id>                        end a session, wait, and print the final save's result\n *   cofactor dev template publish [<path-to-yaml>]   admin: publish a pushed cofactor.ade.yaml and wait for its build\n *   cofactor dev template list                       versions, status, source commit, setup-prompt hash\n *\n * @module dev\n * @see docs/ade/guidance.md\n */\nimport { execFileSync } from 'node:child_process';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { stripVTControlCharacters } from 'node:util';\nimport { ADE_MANIFEST_FILE, validateAdeManifest } from '@chatsdet/sandbox-helper/ade-manifest';\nimport { GLOBAL_VALUE_FLAGS, getArgValue, hasFlag, resolveConfig } from './auth.js';\nimport { writeRawOutput } from './brand.js';\nimport { apiRequest, getPositionalArg } from './cli-helpers.js';\nimport { attachWithReconnect, grantAndConfigure, runProxy } from './dev-ssh.js';\nimport { prepareLaptopSetup, type LaptopSetup } from './dev-home.js';\nimport { parseSetupArgs, runLaptopSetup } from './dev-setup.js';\nimport { printServedGuide } from './guide.js';\nimport { deliverLaptopSetup } from './dev-home-transfer.js';\nimport { ProcessExitSignal } from './user-event-tracking.js';\n\ntype TemplateVersion = {\n  id: string;\n  name: string;\n  version: number;\n  status: 'building' | 'ready' | 'failed';\n  sourceRepo: string;\n  repos: string[];\n  sourceCommit: string;\n  baseVersion: number;\n  setupPromptSha256: string;\n  error: string | null;\n  createdAt: string;\n};\n\ntype VersionResponse = { ok: boolean; error?: string; data?: TemplateVersion };\ntype PublishResponse = {\n  ok: boolean;\n  error?: string;\n  issues?: Array<{ path: string; message: string }>;\n  data?: { id: string; name: string; version: number };\n};\n\ntype Session = {\n  id: string;\n  templateId: string;\n  status: 'requested' | 'claiming' | 'provisioning' | 'running' | 'ending' | 'ended';\n  phase: string | null;\n  endReason: string | null;\n  endDetail: string | null;\n  vcpus: number;\n  memoryMib: number;\n  leaseCapAt: string | null;\n  /** The guest's latest event; guest-written, so printed through `guestText`. */\n  lastEvent: {\n    homeWarning?: string;\n    identity?: string;\n    error?: string;\n    branches?: string[];\n  } | null;\n  createdAt: string;\n  endedAt: string | null;\n};\n\ntype SessionResponse = { ok: boolean; error?: string; data?: Session };\n\n/** A build takes minutes (a base import, apt and agent installs); its status is polled at this interval. */\nconst POLL_MS = 5_000;\n/**\n * `dev destroy` waits for `ended`. The final save is bounded at 5 min; a session\n * that runs out of time is finished by the first 5-min reconcile pass after it\n * has been ending for 10 min, so up to about 15.\n */\nconst DESTROY_WAIT_MS = 16 * 60_000;\nconst DEV_VALUE_FLAGS = [...GLOBAL_VALUE_FLAGS, '--template', '--aws-connection', '--aws-profile'];\n\nfunction printHelp(): void {\n  console.log(\n    [\n      'Usage: cofactor dev [<sub-command>] [options]',\n      '',\n      'Dev environments (ADEs): remote sandboxes a coding agent works in.',\n      '',\n      'Sub-commands:',\n      '  (none) [--template <name>]  Claim a session and attach when its home is mounted (sign-in/setup may still need you). --template is required when the org has several',\n      '  setup [--plan [--json]]      Inspect laptop setup read-only; show decisions and browser-only steps',\n      '  setup --yes <decisions>      Save explicit choices without prompts (see --plan for exact flags)',\n      '  guide [section] [--json]     Agent guide: plan, ask the user, apply choices, then claim',\n      '  attach [<id>]               SSH into a session (your only live one by default) from this machine. Makes',\n      '                              ~/.config/cofactor/ade/id_ed25519 (no passphrase) once; each grant lasts 12 h',\n      '  proxy <id>                  The SSH ProxyCommand `cofactor dev attach` writes; not run by hand',\n      '  list [--all]                Your sessions: status, phase, size, lease end, last event; --all adds those ended in 7 days',\n      '  destroy <id>                End a session (its home is saved), wait for it, and print the result',\n      `  template publish [<path>]   Admin. Publish a pushed ${ADE_MANIFEST_FILE} (default: the repo root's) and wait for its build`,\n      '  template list               Template versions: status, source commit, setup-prompt hash, error',\n      '',\n      '  aws-policy --connection <id> --policy <file> --org <org>  Admin: configure AWS grant policy',\n      '  aws-credentials --aws-profile <name>  Managed AWS credential_process (inside the ADE only)',\n      '',\n      'Options:',\n      '  --aws-connection <name>     Select an approved AWS connection at claim; repeatable, default none',\n      '  --json                      Output raw JSON (list, template list)',\n      '  --env <env>                 Target environment (prod, dev, local)',\n    ].join('\\n')\n  );\n}\n\nfunction fail(message: string): never {\n  console.error(`Error: ${message}`);\n  process.exit(1);\n}\n\nconst git = (cwd: string, ...args: string[]) =>\n  execFileSync('git', args, { cwd, encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });\n\n/** `owner/name` of a github.com remote URL (https or ssh), or null. */\nfunction githubRepoOf(url: string): string | null {\n  const match = url.match(\n    /^(?:https:\\/\\/github\\.com\\/|git@github\\.com:|ssh:\\/\\/git@github\\.com\\/)([A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+?)(?:\\.git)?\\/?$/\n  );\n  return match ? match[1]! : null;\n}\n\n/** The template's repo; `commit` (HEAD, the commit the template records) must be on its upstream. */\nfunction publishedRepo(root: string, commit: string): string {\n  let upstream: string;\n  try {\n    upstream = git(root, 'rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}').trim();\n  } catch {\n    fail('this branch has no upstream: push it first (git push -u)');\n  }\n  try {\n    git(root, 'merge-base', '--is-ancestor', commit, '@{u}');\n  } catch {\n    fail(`HEAD (${commit.slice(0, 12)}) is not on ${upstream}: push it first`);\n  }\n  const remote = upstream.split('/')[0]!;\n  const repo = githubRepoOf(git(root, 'remote', 'get-url', remote).trim());\n  if (!repo) fail(`the ${remote} remote is not a github.com repository`);\n  return repo;\n}\n\n/**\n * A file as committed at `commit`, never the working tree: the bytes published\n * are exactly the commit's, and a committed symlink is read as its link text,\n * not followed to a file outside the repo.\n */\nfunction committed(root: string, commit: string, file: string): string {\n  try {\n    return git(root, 'show', `${commit}:${file}`);\n  } catch {\n    fail(\n      `${file} is not committed at ${commit.slice(0, 12)} (paths in ${ADE_MANIFEST_FILE} are relative to the repo root)`\n    );\n  }\n}\n\n/** Every page of a cursor-paged list route (`?limit=100&cursor=`), or exit with its error. */\nasync function allPages<T>(\n  apiUrl: string,\n  token: string,\n  route: string,\n  what: string\n): Promise<T[]> {\n  const items: T[] = [];\n  let cursor: string | null = null;\n  do {\n    const separator = route.includes('?') ? '&' : '?';\n    const query: string = `${separator}limit=100${cursor ? `&cursor=${encodeURIComponent(cursor)}` : ''}`;\n    const page = await apiRequest<{\n      ok: boolean;\n      error?: string;\n      data?: T[];\n      nextCursor?: string | null;\n    }>(apiUrl, token, 'GET', `${route}${query}`);\n    if (!page.ok || !page.data) fail(page.error ?? `could not list ${what}`);\n    items.push(...page.data);\n    cursor = page.nextCursor ?? null;\n  } while (cursor);\n  return items;\n}\n\nconst allTemplates = (apiUrl: string, token: string) =>\n  allPages<TemplateVersion>(apiUrl, token, '/org/ade/templates', 'templates');\n\nfunction printVersion(template: TemplateVersion): void {\n  const source = `${template.sourceRepo}@${template.sourceCommit.slice(0, 12)}`;\n  console.log(\n    `${template.name} v${template.version}  ${template.status.padEnd(8)}  ${source}  base v${template.baseVersion}  setup-prompt ${template.setupPromptSha256.slice(0, 12)}`\n  );\n  if (template.status === 'failed' && template.error)\n    console.log(`  ${template.error.trim().split('\\n').slice(-20).join('\\n  ')}`);\n}\n\nasync function publish(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const given = getPositionalArg(argv, GLOBAL_VALUE_FLAGS);\n  const start = given ? path.dirname(path.resolve(given)) : process.cwd();\n  let root: string;\n  try {\n    root = git(start, 'rev-parse', '--show-toplevel').trim();\n  } catch {\n    fail(`${start} is not inside a git repository`);\n  }\n  const yamlFile = given ? path.relative(root, path.resolve(given)) : ADE_MANIFEST_FILE;\n  if (yamlFile.startsWith('..')) fail(`${given} is outside the repository at ${root}`);\n  const commit = git(root, 'rev-parse', 'HEAD').trim();\n  const yaml = committed(root, commit, yamlFile);\n  const { manifest, issues } = validateAdeManifest(yaml);\n  if (!manifest) {\n    console.error(`Error: ${yamlFile} is invalid:`);\n    for (const issue of issues) console.error(`  ${issue.path}: ${issue.message}`);\n    process.exit(1);\n  }\n  const repo = publishedRepo(root, commit);\n  if (\n    git(\n      root,\n      'status',\n      '--porcelain',\n      '--',\n      yamlFile,\n      manifest.setup_prompt,\n      manifest.guidance\n    ).trim() !== ''\n  ) {\n    console.error(\n      `Note: uncommitted changes to the template's files are not published; publishing them as of ${commit.slice(0, 12)}.`\n    );\n  }\n\n  const result = await apiRequest<PublishResponse>(\n    apiUrl,\n    token,\n    'POST',\n    '/org/ade/templates/publish',\n    {\n      yaml,\n      setupPrompt: committed(root, commit, manifest.setup_prompt),\n      guidance: committed(root, commit, manifest.guidance),\n      repo,\n      commit,\n    }\n  );\n  if (!result.ok || !result.data) {\n    console.error(`Error: ${result.error ?? 'publish failed'}`);\n    for (const issue of result.issues ?? []) console.error(`  ${issue.path}: ${issue.message}`);\n    process.exit(1);\n  }\n  const { id, name, version } = result.data;\n  console.log(\n    `Published ${name} v${version} (${id}) from ${repo}@${commit.slice(0, 12)}; building…`\n  );\n  console.log('Ctrl-C stops waiting; the build carries on (`cofactor dev template list`).');\n  const started = Date.now();\n  // The server always moves the version out of `building` (the job's onFailure marks it failed).\n  for (;;) {\n    await new Promise((resolve) => setTimeout(resolve, POLL_MS));\n    const current = await apiRequest<VersionResponse>(\n      apiUrl,\n      token,\n      'GET',\n      `/org/ade/templates/${id}`\n    );\n    // A transport failure already exited in `apiRequest`; the build carries on server-side either way.\n    if (!current.ok || !current.data) {\n      fail(\n        `could not read the build's status (${current.error ?? 'unknown error'}); it carries on: check \\`cofactor dev template list\\``\n      );\n    }\n    if (current.data.status === 'building') continue;\n    console.log(\n      `${current.data.status === 'ready' ? '✓' : '✗'} after ${Math.round((Date.now() - started) / 1000)} s`\n    );\n    printVersion(current.data);\n    if (current.data.status === 'failed') process.exit(1);\n    return;\n  }\n}\n\nasync function list(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const templates = await allTemplates(apiUrl, token);\n  if (hasFlag(argv, '--json')) {\n    writeRawOutput(JSON.stringify(templates, null, 2));\n    return;\n  }\n  if (templates.length === 0) {\n    console.log('No ADE templates yet. Publish one with `cofactor dev template publish`.');\n    return;\n  }\n  for (const template of templates) printVersion(template);\n}\n\n/**\n * Text the guest wrote (`last_event`), printed with control characters removed:\n * the guest is untrusted, and an escape sequence must not reach the terminal.\n */\nconst guestText = (value: string | undefined | null) =>\n  // eslint-disable-next-line no-control-regex -- C0 and C1 controls are exactly what is stripped\n  value ? stripVTControlCharacters(value).replace(/[\\u0000-\\u001f\\u007f-\\u009f]/g, ' ') : '';\n\nfunction printSession(session: Session): void {\n  if (session.lastEvent?.homeWarning)\n    console.log(`  Warning: ${guestText(session.lastEvent.homeWarning)}`);\n  const size = `${session.vcpus}c/${Math.round(session.memoryMib / 1024)}G`;\n  const lease = session.leaseCapAt ? `  lease ends ${session.leaseCapAt}` : '';\n  console.log(\n    `${session.id}  ${session.status.padEnd(12)}  ${session.phase ?? '-'}  ${size}${lease}`\n  );\n  if (session.lastEvent?.identity)\n    console.log(`  logged in as ${guestText(session.lastEvent.identity)}`);\n  if (session.lastEvent?.branches?.length)\n    console.log(`  branches: ${session.lastEvent.branches.map(guestText).join(', ')}`);\n  if (session.lastEvent?.error) console.log(`  ${guestText(session.lastEvent.error)}`);\n  if (session.endReason)\n    console.log(\n      `  ended: ${session.endReason}${session.endDetail ? ` (${session.endDetail})` : ''}`\n    );\n}\n\n/** The template to claim: `--template`, else the org's only one. */\nasync function templateToClaim(\n  argv: string[],\n  apiUrl: string,\n  token: string,\n  templates?: TemplateVersion[]\n): Promise<string> {\n  const given = getArgValue(argv, '--template');\n  if (given) return given;\n  const names = new Set(\n    (templates ?? (await allTemplates(apiUrl, token))).map((template) => template.name)\n  );\n  if (names.size === 1) return [...names][0]!;\n  if (names.size === 0)\n    fail(\n      'this org has no ADE template yet: an admin publishes one with `cofactor dev template publish`'\n    );\n  fail(\n    `this org has several ADE templates; pass --template <name> (one of: ${[...names].sort().join(', ')})`\n  );\n}\n\n/** Phases after which the box has its home and tmux: attach can start (the setup prompt may still be waiting on the user). */\nconst ATTACHABLE_PHASES = new Set([\n  'home_mounted',\n  'setup_done',\n  'needs_user',\n  'repos_synced',\n  'agent_started',\n]);\n/** How long `dev` and `attach` follow a session before giving up on it becoming attachable. */\nconst ATTACH_WAIT_MS = 70 * 60_000;\n\n/** `--env`, `--api-url`, `--org`, `--target-org` as given, so the ProxyCommand reaches the same API and org. */\nfunction envArgs(argv: string[]): string[] {\n  const out: string[] = [];\n  for (const flag of ['--env', '--api-url', '--org', '--target-org']) {\n    const value = getArgValue(argv, flag);\n    if (value) out.push(flag, value);\n  }\n  return out;\n}\n\n/** Poll until the session can be attached, printing each status and phase change. */\nasync function followUntilAttachable(apiUrl: string, token: string, id: string): Promise<Session> {\n  const sessionPath = `/org/ade/sessions/${encodeURIComponent(id)}`;\n  const deadline = Date.now() + ATTACH_WAIT_MS;\n  let shown = '';\n  for (;;) {\n    const current = await apiRequest<SessionResponse>(apiUrl, token, 'GET', sessionPath);\n    if (!current.ok || !current.data) fail(current.error ?? 'could not read the session');\n    const session = current.data;\n    const state = `${session.status}${session.phase ? ` (${session.phase})` : ''}`;\n    if (state !== shown) {\n      console.log(`  ${state}`);\n      shown = state;\n    }\n    if (session.status === 'ending' || session.status === 'ended') {\n      printSession(session);\n      process.exit(1);\n    }\n    if (session.status === 'running' || (session.phase && ATTACHABLE_PHASES.has(session.phase)))\n      return session;\n    if (Date.now() > deadline)\n      fail(`${id} is still ${state}; it carries on: check \\`cofactor dev list\\``);\n    await new Promise((resolve) => setTimeout(resolve, 3_000));\n  }\n}\n\nasync function attach(\n  id: string,\n  argv: string[],\n  apiUrl: string,\n  token: string,\n  setup?: LaptopSetup\n): Promise<void> {\n  await followUntilAttachable(apiUrl, token, id);\n  const alias = await grantAndConfigure(apiUrl, token, id, envArgs(argv)).catch((error: unknown) =>\n    fail(error instanceof Error ? error.message : String(error))\n  );\n  if (setup) deliverLaptopSetup(alias, setup);\n  console.log(\n    `Attaching to ${id} (ssh ${alias}). Detach with Ctrl-b d; reattach with \\`cofactor dev attach ${id}\\`.`\n  );\n  process.exit(await attachWithReconnect(alias, apiUrl, token, id, envArgs(argv)));\n}\n\nasync function claim(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const template = await templateToClaim(argv, apiUrl, token);\n  const home = await apiRequest<{ ok: boolean; data?: { setupComplete: boolean }; error?: string }>(\n    apiUrl,\n    token,\n    'GET',\n    `/org/ade/home?template=${encodeURIComponent(template)}`\n  );\n  if (!home.ok || !home.data) fail(home.error ?? 'could not read saved home status');\n  const setup = home.data.setupComplete ? null : await prepareLaptopSetup();\n  if (home.data.setupComplete)\n    console.log('ADE: restoring your prepared home; laptop setup is already complete.');\n  const result = await apiRequest<SessionResponse>(apiUrl, token, 'POST', '/org/ade/sessions', {\n    template,\n    awsConnections: argv.flatMap((value, index) =>\n      value === '--aws-connection' && argv[index + 1]\n        ? [argv[index + 1]!]\n        : value.startsWith('--aws-connection=')\n          ? [value.slice(17)]\n          : []\n    ),\n  });\n  if (!result.ok || !result.data) fail(result.error ?? 'the claim failed');\n  console.log(\n    `Claimed ${result.data.id} from ${template}. Ctrl-C stops following; the session carries on.`\n  );\n  await attach(\n    result.data.id,\n    argv,\n    apiUrl,\n    token,\n    home.data.setupComplete\n      ? undefined\n      : (setup ?? { files: [], env: {}, githubToken: null, git: null })\n  );\n}\n\n/** `attach`'s session: the one named, else the user's only live one. */\nasync function sessionToAttach(argv: string[], apiUrl: string, token: string): Promise<string> {\n  const given = getPositionalArg(argv, DEV_VALUE_FLAGS);\n  if (given) return given;\n  const live = await allPages<Session>(apiUrl, token, '/org/ade/sessions', 'sessions');\n  if (live.length === 1) return live[0]!.id;\n  if (live.length === 0) fail('you have no live ADE session: claim one with `cofactor dev`');\n  fail(`you have several live sessions; pass one: ${live.map((session) => session.id).join(', ')}`);\n}\n\nasync function listSessions(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const all = hasFlag(argv, '--all');\n  const sessions = await allPages<Session>(\n    apiUrl,\n    token,\n    all ? '/org/ade/sessions?all=true' : '/org/ade/sessions',\n    'sessions'\n  );\n  if (hasFlag(argv, '--json')) {\n    writeRawOutput(JSON.stringify(sessions, null, 2));\n    return;\n  }\n  if (sessions.length === 0) {\n    console.log(\n      all\n        ? 'No ADE sessions in the last 7 days.'\n        : 'No live ADE sessions. Claim one with `cofactor dev`.'\n    );\n    return;\n  }\n  for (const session of sessions) printSession(session);\n}\n\nasync function destroy(argv: string[], apiUrl: string, token: string): Promise<void> {\n  const id = getPositionalArg(argv, DEV_VALUE_FLAGS);\n  if (!id) fail('usage: cofactor dev destroy <id>');\n  const sessionPath = `/org/ade/sessions/${encodeURIComponent(id)}`;\n  const result = await apiRequest<SessionResponse>(apiUrl, token, 'DELETE', sessionPath);\n  if (!result.ok || !result.data) fail(result.error ?? 'the destroy failed');\n  console.log(`Ending ${id}…`);\n  const deadline = Date.now() + DESTROY_WAIT_MS;\n  let session = result.data;\n  while (session.status !== 'ended') {\n    if (Date.now() > deadline)\n      fail(`${id} is still ${session.status}; it carries on: check \\`cofactor dev list --all\\``);\n    await new Promise((resolve) => setTimeout(resolve, 3_000));\n    const current = await apiRequest<SessionResponse>(apiUrl, token, 'GET', sessionPath);\n    if (!current.ok || !current.data) fail(current.error ?? 'could not read the session');\n    session = current.data;\n  }\n  printSession(session);\n  // The API's FINAL_SAVE_FAILED (apps/api/src/ade/destroy.job.ts).\n  if (session.endDetail === 'final save failed')\n    console.log(\n      'Warning: the final save of the home failed; changes since its last save are lost.'\n    );\n}\n\nexport async function runDev(argv: string[]): Promise<void> {\n  const [group, subCommand, ...rest] = argv;\n  if (group === 'aws-policy') {\n    await configureAwsPolicy(argv.slice(1));\n    return;\n  }\n  if (group === 'aws-credentials') {\n    await awsCredentials(argv.slice(1));\n    return;\n  }\n  if (group === 'guide') {\n    await printServedGuide('dev', argv.slice(1));\n    return;\n  }\n  if (group === 'help' || hasFlag(argv, '--help', '-h')) {\n    printHelp();\n    return;\n  }\n  if (group === 'setup') {\n    const args = argv.slice(1);\n    const setupArgs = parseSetupArgs(args);\n    const { apiUrl, token } = await resolveConfig(args);\n    const templates = await allTemplates(apiUrl, token);\n    const name = await templateToClaim(args, apiUrl, token, templates);\n    const template = templates.find(\n      (template) => template.name === name && template.status === 'ready'\n    );\n    if (!template) fail('No ready version of the selected ADE template.');\n    if (!Array.isArray(template.repos))\n      fail(\n        'The ADE API must be updated to provide template repositories before setup can be planned.'\n      );\n    await runLaptopSetup(setupArgs, { name, repos: template.repos });\n    return;\n  }\n  // `cofactor dev [--template <name>]`: no sub-command claims.\n  if (group === undefined || group.startsWith('--')) {\n    const { apiUrl, token } = await resolveConfig(argv);\n    await claim(argv, apiUrl, token);\n    return;\n  }\n  if (group === 'attach' || group === 'proxy') {\n    const args = argv.slice(1);\n    const { apiUrl, token } = await resolveConfig(args);\n    if (group === 'attach') {\n      await attach(await sessionToAttach(args, apiUrl, token), args, apiUrl, token);\n      return;\n    }\n    const id = getPositionalArg(args, DEV_VALUE_FLAGS);\n    if (!id) fail('usage: cofactor dev proxy <id>');\n    const status = await runProxy(apiUrl, token, id, envArgs(args)).catch((error: unknown) => {\n      // The CLI's own exit (an auth failure inside apiRequest) already said why: pass it on.\n      if (error instanceof ProcessExitSignal) throw error;\n      console.error(\n        `cofactor dev proxy: ${error instanceof Error ? error.message : String(error)}`\n      );\n      return 1;\n    });\n    process.exit(status);\n  }\n  if (group === 'list' || group === 'destroy') {\n    const args = argv.slice(1);\n    const { apiUrl, token } = await resolveConfig(args);\n    if (group === 'list') await listSessions(args, apiUrl, token);\n    else await destroy(args, apiUrl, token);\n    return;\n  }\n  if (group !== 'template' || (subCommand !== 'publish' && subCommand !== 'list')) {\n    console.error(`Unknown dev sub-command: ${[group, subCommand].filter(Boolean).join(' ')}`);\n    printHelp();\n    process.exit(1);\n  }\n  const { apiUrl, token } = await resolveConfig(rest);\n  if (subCommand === 'publish') await publish(rest, apiUrl, token);\n  else await list(rest, apiUrl, token);\n}\n","/**\n * `cofactor.ade.yaml`: an org's ADE (agentic development environment)\n * template, parsed by the CLI before it publishes and by the API that builds\n * it. A separate lineage from `cofactor.sandbox.yaml` (manifest.ts): an ADE\n * template holds a toolchain and coding agents, never a checkout, so its\n * build needs no repository credential.\n *\n * The build reuses the sbv2 supervisor's one-shot root `setup`, which parses\n * only an sbv2 definition, so `synthesizeBuildDefinition` wraps the template\n * in the smallest sbv2-valid definition that carries one setup script.\n *\n * @module ade-manifest\n * @see specs/pending/ade.md (`cofactor.ade.yaml` schema, Template build)\n */\nimport { parse, stringify } from 'yaml';\nimport { z } from 'zod';\n\n/** The file `cofactor dev template publish` reads by default, at the repo root. */\nexport const ADE_MANIFEST_FILE = 'cofactor.ade.yaml';\n\n/**\n * The ADE base image's version: the published platform image plus the\n * `packages/sandbox-helper/ade/` layer, tagged `adeBaseImageTag` by\n * `ade-image.sh`. A published tag is never rebuilt, so a change to that layer\n * needs a bump (ade-base-version.test.ts fails until the new hash is\n * recorded). A template records the version it was built on.\n *\n * 1: Ubuntu 24.04, tmux, git, gh, OpenSSH, Node 24 with npm, the cofactor CLI,\n * and the uid-1000 account renamed to `agent` (home `/home/agent`).\n * 2: `ade-init` (the claim's CLI login) and a no-op `ade-home`, the agent-owned\n * `/run/cofactor/ade`, and `COFACTOR_CONFIG_DIR` in `/etc/profile.d`.\n * 3: the uid-1000 account is renamed by editing the account files\n * (`rename-account.sh`), not usermod, which refuses while the build's own\n * uid-1000 process runs: every v2 build failed with \"user ubuntu is currently\n * used by process\" (prod 2026-11-05).\n * 4: `ade-start` (the session's tmux window: phases, the setup prompt on a\n * first claim, the agent), `ade-sync-repos`, `ade-event`, and `COFACTOR_ENV=ade`\n * in `/etc/profile.d`.\n * 5: terminal-safe, idempotent attach; agent authentication before first-claim\n * setup; modern terminal entries.\n * 6: laptop setup handshake, password-free repo sync and browser forwarding.\n * 9: pinned, checksummed AWS CLI v2 from AWS's official linux/amd64 installer.\n * 10: persistent GitHub HTTPS credentials for ordinary git pushes.\n * 11: S3 home-upload failures report their error code and message.\n */\nexport const ADE_BASE_VERSION = 11;\n\n/**\n * The published platform image (`platformImageTag`, manifest.ts) the ADE base\n * image is built on: its sandbox-helper supervisor runs the build's root\n * `setup`. Pinned here, not read from `PLATFORM_VERSION`, so an sbv2 platform\n * bump does not force every ADE template to republish. Moving it changes the\n * base image, so it comes with an `ADE_BASE_VERSION` bump.\n *\n * The contract this creates: `synthesizeBuildDefinition`'s output, and every\n * `cofactor-sandbox` call the API makes on an ADE sandbox, must be accepted by\n * this version's helper, not only by the current `parseDefinition`. An sbv2\n * change to those fields moves the pin (and so bumps `ADE_BASE_VERSION`).\n */\nexport const ADE_PLATFORM_VERSION = 22;\n\n/** The ADE base image's tag in the platform repository (immutable). */\nexport function adeBaseImageTag(version: number): string {\n  return `ade-base-v${version}`;\n}\n\n/** Root-run base install inside the ADE base image; the first line of every build's setup. */\nconst ADE_BASE_SETUP = '/usr/local/lib/cofactor-ade/base-setup.sh';\n\n/** Where the build writes the template's files for the guest; root-owned, read-only. */\nconst ADE_ETC_DIR = '/etc/cofactor/ade';\n\nconst KIB = 1024;\n/** The setup prompt and guidance each travel base64 inside one `bash -c` argument (Linux caps one at 128 KiB). */\nconst ADE_TEXT_MAX_BYTES = 32 * KIB;\n/** The whole synthesized setup script. */\nconst ADE_SETUP_MAX_BYTES = 96 * KIB;\n\n/** A template or agent name: also part of a Blackcat template name. */\nconst NAME = /^[a-z][a-z0-9-]{0,31}$/;\n/** `owner/name` on github.com; `.` and `..` segments are refused separately. */\nconst GITHUB_REPO = /^[A-Za-z0-9_.-]+\\/[A-Za-z0-9_.-]+$/;\n\n/** A relative path inside the repo: no leading `/`, and no empty, `.` or `..` segment. */\nconst repoPath = z\n  .string()\n  .min(1)\n  .refine(\n    (value) =>\n      !value.startsWith('/') &&\n      value.split('/').every((segment) => segment !== '' && segment !== '.' && segment !== '..'),\n    'must be a relative path inside the repo'\n  );\n\nconst command = z.string().trim().min(1);\n\nconst repoSchema = z.strictObject({\n  github: z\n    .string()\n    .regex(GITHUB_REPO, 'must be owner/name on github.com')\n    .refine(\n      (value) => value.split('/').every((segment) => segment !== '.' && segment !== '..'),\n      'must be owner/name on github.com'\n    ),\n  install: z.array(command),\n});\n\nconst agentSchema = z.strictObject({\n  install: command,\n  run: command,\n  /** The headless command for `--task`; an agent without one is interactive-only. */\n  task: command.optional(),\n  /** Omitted for agents that need no login; both commands are required otherwise. */\n  auth: z.strictObject({ status: command, login: command }).optional(),\n});\n\n/**\n * The largest template a Blackcat worker in every stage can build, so a larger\n * shape fails at publish (here, in the API and in the CLI) instead of in the\n * build. A template build boots a fresh guest that takes host vCPUs one for one\n * (no overcommit), on an otherwise empty worker.\n *\n * The authority is production's `blackcat fleet capacity-shapes`, which on\n * 2026-11-05 offered at most 14 guest vCPU / 31130 MiB: Blackcat refused a\n * 16 vCPU / 32768 MiB build with exactly that. Memory is rounded down to a\n * whole GiB. infra/components/blackcat-dev.constants.ts also lists c7i.8xlarge\n * and m7i.4xlarge for production, which capacity-shapes did not offer then;\n * dev offers more. One ceiling for every stage, the smallest.\n *\n * Raising it, once production's capacity-shapes offers more: change it here,\n * deploy the API, and release the CLI (an older CLI keeps refusing the larger\n * shape). If the fleet ever offers less, the build's unplaceable failure\n * (template-build.job.ts) is the backstop.\n */\nconst ADE_MAX_SHAPE = { vcpus: 14, memory_mib: 30720 } as const;\n\nconst largestShape = `the largest template a Blackcat worker can build is ${ADE_MAX_SHAPE.vcpus} vCPU / ${ADE_MAX_SHAPE.memory_mib} MiB`;\n\nconst memoryMib = z\n  .number()\n  .int()\n  .min(1024)\n  .max(ADE_MAX_SHAPE.memory_mib, `at most ${ADE_MAX_SHAPE.memory_mib}: ${largestShape}`)\n  .refine((value) => value % 128 === 0, 'must be a multiple of 128');\n\n/*\n * `max` (the `--size` ceiling) and `secrets` arrive in S6 and `github_app_proxy`\n * in S3b; until then the strict schema rejects them as unrecognized keys.\n */\nconst adeManifestSchema = z.strictObject({\n  version: z.literal(1),\n  name: z\n    .string()\n    .regex(NAME, 'must be lowercase letters, digits and -, starting with a letter (at most 32)'),\n  resources: z.strictObject({\n    vcpus: z\n      .number()\n      .int()\n      .min(1)\n      .max(ADE_MAX_SHAPE.vcpus, `at most ${ADE_MAX_SHAPE.vcpus}: ${largestShape}`),\n    memory_mib: memoryMib,\n    disk_gib: z.number().int().min(1).max(256),\n  }),\n  /** Root commands run once per template version at build; absent when the base image's toolchain is enough. */\n  setup: z.array(command).optional(),\n  repos: z\n    .array(repoSchema)\n    .min(1)\n    .superRefine((repos, ctx) => {\n      const seen = new Set<string>();\n      repos.forEach((repo, index) => {\n        const name = repo.github.split('/')[1] ?? '';\n        if (seen.has(name)) {\n          ctx.addIssue({\n            code: 'custom',\n            path: [index, 'github'],\n            message: `another repo is also named ${name}: both would be /workspace/${name}`,\n          });\n        }\n        seen.add(name);\n      });\n    }),\n  agents: z\n    .record(\n      z.string().regex(NAME, 'agent names must be lowercase letters, digits and -'),\n      agentSchema\n    )\n    .refine((agents) => Object.keys(agents).length > 0, 'list at least one agent'),\n  setup_prompt: repoPath,\n  guidance: repoPath,\n});\n\nexport type AdeManifest = z.infer<typeof adeManifestSchema>;\ntype AdeManifestIssue = { path: string; message: string };\n\n/** Parse and validate the yaml; each issue names its field path. */\nexport function validateAdeManifest(yamlText: string): {\n  manifest?: AdeManifest;\n  issues: AdeManifestIssue[];\n} {\n  let raw: unknown;\n  try {\n    raw = parse(yamlText);\n  } catch (error) {\n    return {\n      issues: [\n        {\n          path: '',\n          message: `invalid YAML: ${error instanceof Error ? error.message : String(error)}`,\n        },\n      ],\n    };\n  }\n  const parsed = adeManifestSchema.safeParse(raw);\n  if (!parsed.success) {\n    return {\n      issues: parsed.error.issues.map((issue) => ({\n        path: issue.path.map(String).join('.') || '(root)',\n        message: issue.message,\n      })),\n    };\n  }\n  return { manifest: parsed.data, issues: [] };\n}\n\n/** A manifest the API stored after validating it (`ade_templates.definition`); throws if it no longer parses. */\nexport function adeManifestFromStored(value: unknown): AdeManifest {\n  return adeManifestSchema.parse(value);\n}\n\n/**\n * The base template a template of this shape builds on. A Blackcat checkpoint\n * fixes its vCPUs, memory hot-plug region and writable disk, so there is one\n * per shape, imported from the base image the first time a template of that\n * shape is built. `0h`: no hot-plug region until S6 adds `max`.\n */\nexport function adeBaseTemplateName(resources: AdeManifest['resources'], version: number): string {\n  return `ade-base-v${version}-${resources.vcpus}c-${resources.memory_mib}m-0h-${resources.disk_gib}d`;\n}\n\n/** One built template version's Blackcat name; the org id keeps orgs' templates apart. */\nexport function adeTemplateName(orgId: string, name: string, version: number): string {\n  return `ade-${orgId}-${name}-v${version}`;\n}\n\n/** What the guest reads from `/etc/cofactor/ade/template.json`. */\nfunction adeTemplateJson(manifest: AdeManifest): string {\n  return JSON.stringify({\n    name: manifest.name,\n    repos: manifest.repos,\n    agents: manifest.agents,\n  });\n}\n\n/** `printf %s <base64> | base64 -d > path`: no heredoc, so no content can end a delimiter early. */\nconst writeFile = (path: string, content: string) =>\n  `printf %s '${Buffer.from(content, 'utf8').toString('base64')}' | base64 -d > ${path}`;\n\n/**\n * The template's root build script: the base install, the template's\n * `setup`, each agent's `install`, then the guest's files, root-owned and\n * read-only. The supervisor's prelude (`set -euo pipefail`) runs first, so the\n * first failing line fails the build.\n */\nexport function adeSetupScript(\n  manifest: AdeManifest,\n  setupPrompt: string,\n  guidance: string\n): string {\n  return [\n    `bash ${ADE_BASE_SETUP}`,\n    ...(manifest.setup ?? []),\n    ...Object.values(manifest.agents).map((agent) => agent.install),\n    `install -d -o root -g root -m 0755 ${ADE_ETC_DIR}`,\n    writeFile(`${ADE_ETC_DIR}/template.json`, adeTemplateJson(manifest)),\n    writeFile(`${ADE_ETC_DIR}/setup-prompt.md`, setupPrompt),\n    writeFile(`${ADE_ETC_DIR}/guidance.md`, guidance),\n    `chown root:root ${ADE_ETC_DIR}/*`,\n    `chmod 0444 ${ADE_ETC_DIR}/*`,\n    '',\n  ].join('\\n');\n}\n\n/**\n * A validated template plus its two files; else the issues. The files' caps\n * and the build script's are checked here, so a template that cannot build\n * fails at publish.\n */\nexport function validateAdeTemplate(\n  yamlText: string,\n  setupPrompt: string,\n  guidance: string\n): { manifest?: AdeManifest; issues: AdeManifestIssue[] } {\n  const { manifest, issues } = validateAdeManifest(yamlText);\n  if (!manifest) return { issues };\n  const tooLarge: AdeManifestIssue[] = [];\n  if (Buffer.byteLength(setupPrompt) > ADE_TEXT_MAX_BYTES) {\n    tooLarge.push({\n      path: 'setup_prompt',\n      message: `${manifest.setup_prompt} is larger than ${ADE_TEXT_MAX_BYTES / KIB} KiB`,\n    });\n  }\n  if (Buffer.byteLength(guidance) > ADE_TEXT_MAX_BYTES) {\n    tooLarge.push({\n      path: 'guidance',\n      message: `${manifest.guidance} is larger than ${ADE_TEXT_MAX_BYTES / KIB} KiB`,\n    });\n  }\n  if (tooLarge.length > 0) return { issues: tooLarge };\n  if (Buffer.byteLength(adeSetupScript(manifest, setupPrompt, guidance)) > ADE_SETUP_MAX_BYTES) {\n    return {\n      issues: [\n        {\n          path: 'setup',\n          message: `the build script (setup, agent installs, setup prompt and guidance) is larger than ${ADE_SETUP_MAX_BYTES / KIB} KiB`,\n        },\n      ],\n    };\n  }\n  return { manifest, issues: [] };\n}\n\n/**\n * The sbv2 definition the supervisor's root `setup` parses: only the\n * template's `{vcpus, memory_mib}` (disk is the base template's), the empty\n * records the strict schema requires, a `lifecycle.build` step that never\n * runs, and the one setup script.\n */\nexport function synthesizeBuildDefinition(manifest: AdeManifest, setupScript: string): string {\n  return stringify({\n    version: 1,\n    resources: { vcpus: manifest.resources.vcpus, memory_mib: manifest.resources.memory_mib },\n    setup: setupScript,\n    ports: {},\n    params: {},\n    env: {},\n    services: {},\n    lifecycle: { build: [{ name: 'unused', run: 'true', inputs: ['**'] }], prepare: [] },\n    environments: { default: { description: 'ADE template build; never prepared.' } },\n  });\n}\n","/**\n * SSH into an ADE session from the laptop (specs/pending/ade.md, SSH and\n * attach; D16/D22):\n *\n * - **One key per machine** at `~/.config/cofactor/ade/id_ed25519`, made on\n *   first use. Only its public half leaves the machine: `ssh-grant` asks\n *   Blackcat to accept it on the box for 12 h.\n * - **The host key is pinned**: the grant returns it, and it is the only entry\n *   for the session's host in `~/.config/cofactor/ade/known_hosts`.\n * - **`Host ade-<short>`** in `~/.ssh/config.d/cofactor-ade`, which\n *   `~/.ssh/config` includes, so plain `ssh ade-<short>` (and scp, rsync) work.\n *   Its `ProxyCommand` is `cofactor dev proxy <id>`.\n * - **The proxy** asks the API for a 60 s relay ticket and carries ssh's bytes\n *   over a WebSocket to `ade-relay`, offering the ticket as a subprotocol so it\n *   is never in a URL. It re-grants when the grant has under 1 h left.\n */\nimport { createHash } from 'node:crypto';\nimport { spawn, spawnSync } from 'node:child_process';\nimport { existsSync, lstatSync, mkdirSync, readFileSync, readlinkSync, renameSync, writeFileSync } from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport process from 'node:process';\nimport { createInterface } from 'node:readline';\nimport { setTimeout as delay } from 'node:timers/promises';\nimport { ADE_SSH_SUBPROTOCOL } from '@chatsdet/ade-relay-protocol';\nimport { apiRequest } from './cli-helpers.js';\nimport { apiFetch } from './api-fetch.js';\nimport { prepareBrowserRequests, watchBrowserRequests } from './dev-browser.js';\nimport { ProcessExitSignal } from './user-event-tracking.js';\n\nconst adeDir = () => path.join(os.homedir(), '.config', 'cofactor', 'ade');\nconst keyPath = () => path.join(adeDir(), 'id_ed25519');\nconst knownHostsPath = () => path.join(adeDir(), 'known_hosts');\nconst grantsPath = () => path.join(adeDir(), 'grants.json');\nconst sshConfigDir = () => path.join(os.homedir(), '.ssh', 'config.d');\nconst sshConfigPath = () => path.join(sshConfigDir(), 'cofactor-ade');\n\n/** The proxy re-grants once a grant has less than this left. */\nconst REGRANT_BEFORE_MS = 3600_000;\n/** Failed WebSocket upgrades the proxy retries, each with a fresh ticket. */\nconst PROXY_ATTEMPTS = 5;\n/** What to do next, by the relay's close code (apps/ade-relay/src/relay.ts `CLOSE`). */\nconst RELAY_CLOSE_HINTS: Record<number, string> = {\n  4001: 'the relay restarted; run `cofactor dev attach` again',\n  4410: 'the session has ended (`cofactor dev list --all`)',\n  4502: 'the box could not be reached; it is being woken, so try again in a minute',\n  4503: 'the Cofactor API did not answer; try again shortly',\n};\n\n/** stdin the proxy holds while it (re)connects; ssh sends its version line and key exchange first. */\nconst MAX_BUFFERED_STDIN = 1024 * 1024;\n\ntype Grant = { user: string; hostKey: string; expiresAt: string };\ntype GrantResponse = { ok: boolean; error?: string; data?: Grant };\ntype TicketResponse = { ok: boolean; error?: string; data?: { ticket: string; url: string; expiresAt: string } };\n\nclass BootstrapFailure extends Error {\n  constructor(message: string, readonly retryable: boolean) { super(message); }\n}\n\n/** Unlike apiRequest, preserve transport failures for attach's bounded recovery loop. */\nasync function bootstrapRequest<T>(apiUrl: string, token: string, route: string, method: string, body: Record<string, string> | null, signal: AbortSignal): Promise<T> {\n  const result = await apiFetch(`${apiUrl}/org/ade/sessions/${route}`, {\n    method, token, signal, timeoutMs: 30_000,\n    headers: { Authorization: `Bearer ${token}`, 'Content-Type': 'application/json', 'User-Agent': 'Cofactor-CLI' },\n    ...(body ? { body: JSON.stringify(body) } : {}),\n  });\n  if (!result.ok) {\n    const failure = result.failure;\n    throw new BootstrapFailure(failure.message, failure.kind === 'network' || (failure.kind === 'http-error' && (failure.status === 429 || (failure.status !== null && failure.status >= 500))));\n  }\n  return await result.response.json() as T;\n}\n\n/** A whole ADE session id: it is written into the SSH config, so nothing else may pass. */\nconst SESSION_ID = /^ades_([1-9A-HJ-NP-Za-km-z]{8})[1-9A-HJ-NP-Za-km-z]*$/;\n/** One shell word, single-quoted: ssh runs `ProxyCommand` through the user's shell. */\nconst shellQuote = (value: string) => `'${value.replaceAll(\"'\", `'\\\\''`)}'`;\n\n/** `ades_<base58>` → `ade-<first 8>`: the SSH host alias. Throws on anything that is not a session id. */\nexport function adeHostAlias(sessionId: string): string {\n  const match = SESSION_ID.exec(sessionId);\n  if (!match) throw new Error(`not an ADE session id: ${JSON.stringify(sessionId)}`);\n  return `ade-${match[1]}`;\n}\n\n/**\n * A relay URL the ticket may be sent to: `wss://`, or `ws://` to this machine\n * (a local stack). Anything else would carry the ticket in clear.\n */\nexport function isTicketSafeUrl(url: string): boolean {\n  try {\n    const parsed = new URL(url);\n    return parsed.protocol === 'wss:' || (parsed.protocol === 'ws:' && ['localhost', '127.0.0.1', '[::1]'].includes(parsed.hostname));\n  } catch {\n    return false;\n  }\n}\n\n/** Write through a temp file and a rename, so a reader never sees half a file. */\nfunction writeAtomic(file: string, content: string, mode: number): void {\n  const temp = `${file}.${process.pid}.tmp`;\n  writeFileSync(temp, content, { mode });\n  renameSync(temp, file);\n}\n\n/** The machine's key pair, made once; returns the public key line. */\nexport function ensureMachineKey(): string {\n  mkdirSync(adeDir(), { recursive: true, mode: 0o700 });\n  if (!existsSync(keyPath())) {\n    // stdout is ignored: under `dev proxy` it is ssh's connection.\n    const made = spawnSync('ssh-keygen', ['-q', '-t', 'ed25519', '-N', '', '-C', `cofactor-ade@${os.hostname()}`, '-f', keyPath()], {\n      stdio: ['ignore', 'ignore', 'inherit'],\n    });\n    if (made.error || made.status !== 0) throw new Error('ssh-keygen failed: install the OpenSSH client and retry');\n  }\n  return readFileSync(`${keyPath()}.pub`, 'utf8').trim();\n}\n\nfunction readGrants(): Record<string, Grant> {\n  try {\n    return JSON.parse(readFileSync(grantsPath(), 'utf8')) as Record<string, Grant>;\n  } catch {\n    return {};\n  }\n}\n\n/** Replace `alias`'s lines in a file of blocks or entries keyed by it. */\nexport function replaceEntry(existing: string, alias: string, entry: string, isOwn: (line: string) => boolean): string {\n  const kept = existing.split('\\n').filter((line) => line.trim() !== '' && !isOwn(line));\n  return [...kept, entry].join('\\n') + '\\n';\n}\n\n/** The `Host` block `ssh ade-<short>` uses. */\nexport function sshConfigBlock(alias: string, sessionId: string, user: string, envArgs: string[]): string {\n  adeHostAlias(sessionId);\n  // A line break would end the directive and start another; nothing else is unsafe once quoted.\n  if (envArgs.some((arg) => /[\\r\\n]/.test(arg))) throw new Error('a CLI flag value with a line break cannot go into the SSH config');\n  return [\n    `Host ${alias}`,\n    `  HostName ${alias}`,\n    `  User ${user}`,\n    `  IdentityFile \"${keyPath()}\"`,\n    '  IdentitiesOnly yes',\n    `  UserKnownHostsFile \"${knownHostsPath()}\"`,\n    '  StrictHostKeyChecking yes',\n    '  ForwardAgent no',\n    '  ServerAliveInterval 30',\n    '  ServerAliveCountMax 4',\n    // `%` would be one of ssh's own tokens (`%h`); `%%` is a literal one.\n    `  ProxyCommand cofactor dev proxy ${[sessionId, ...envArgs].map(shellQuote).join(' ').replaceAll('%', '%%')}`,\n  ].join('\\n');\n}\n\n/** `~/.ssh/config` includes `config.d/*` once, ahead of every other block. */\nfunction ensureSshInclude(): void {\n  // A dotfile manager's symlink (even one whose target is not there yet) is followed, so the\n  // link survives and its target gets the line.\n  const link = path.join(os.homedir(), '.ssh', 'config');\n  const isLink = lstatSync(link, { throwIfNoEntry: false })?.isSymbolicLink() ?? false;\n  const config = isLink ? path.resolve(path.dirname(link), readlinkSync(link)) : link;\n  mkdirSync(sshConfigDir(), { recursive: true, mode: 0o700 });\n  const existing = existsSync(config) ? readFileSync(config, 'utf8') : '';\n  if (/^\\s*Include\\s+config\\.d\\/\\*\\s*$/m.test(existing)) return;\n  try {\n    writeAtomic(config, `Include config.d/*\\n\\n${existing}`, 0o600);\n  } catch (error) {\n    // A read-only config (a store path, say): say what to add rather than fail the attach.\n    throw new Error(`could not add \\`Include config.d/*\\` to ${config} (${error instanceof Error ? error.message : String(error)}); add it at the top yourself, then retry`);\n  }\n}\n\n/**\n * Grant this machine's key on the session's box, pin the host key it returns,\n * and write the session's `Host` block. Returns the alias to `ssh`.\n */\nexport async function grantAndConfigure(apiUrl: string, token: string, sessionId: string, envArgs: string[], signal?: AbortSignal): Promise<string> {\n  const publicKey = ensureMachineKey();\n  const result = await bootstrapRequest<GrantResponse>(apiUrl, token, `${encodeURIComponent(sessionId)}/ssh-grant`, 'POST', { publicKey }, signal ?? new AbortController().signal);\n  if (!result.ok || !result.data) throw new Error(result.error ?? 'the SSH grant failed');\n  const { user, hostKey, expiresAt } = result.data;\n  if (!/^ssh-ed25519 [A-Za-z0-9+/=]+(?: \\S*)?$/.test(hostKey)) throw new Error('the box returned an unexpected host key');\n  if (!/^[a-z_][a-z0-9_-]{0,31}$/.test(user)) throw new Error('the box returned an unexpected login user');\n  const alias = adeHostAlias(sessionId);\n\n  const known = existsSync(knownHostsPath()) ? readFileSync(knownHostsPath(), 'utf8') : '';\n  const pinned = hostKey.split(' ').slice(0, 2).join(' ');\n  writeAtomic(knownHostsPath(), replaceEntry(known, alias, `${alias} ${pinned}`, (line) => line.startsWith(`${alias} `)), 0o600);\n\n  ensureSshInclude();\n  const config = existsSync(sshConfigPath()) ? readFileSync(sshConfigPath(), 'utf8') : '';\n  const blocks = config.split(/\\n(?=Host )/).filter((block) => block.trim() !== '' && !block.startsWith(`Host ${alias}\\n`));\n  writeAtomic(sshConfigPath(), [...blocks.map((block) => block.trimEnd()), sshConfigBlock(alias, sessionId, user, envArgs)].join('\\n\\n') + '\\n', 0o600);\n\n  writeAtomic(grantsPath(), JSON.stringify({ ...readGrants(), [sessionId]: { user, hostKey: pinned, expiresAt } }, null, 2), 0o600);\n  return alias;\n}\n\n/** Install this terminal's entry as agent, once per session and TERM. */\nfunction prepareTerminal(alias: string): string {\n  const term = process.env.TERM;\n  const fallback = 'xterm-256color';\n  // TERM is also an infocmp argument; refuse option-like names and path separators.\n  if (!term || !/^[a-zA-Z0-9][a-zA-Z0-9+_.-]*$/.test(term)) return fallback;\n  const hash = createHash('sha256').update(term).digest('hex');\n  const marker = path.join(adeDir(), `terminfo-${alias}-${hash}`);\n  if (existsSync(marker)) return term;\n  const entry = spawnSync('infocmp', ['-x', term], { encoding: 'utf8', stdio: ['ignore', 'pipe', 'ignore'] });\n  if (!entry.error && entry.status === 0) {\n    const install = spawnSync('ssh', ['-T', alias, [\n      `if infocmp -x ${shellQuote(term)} >/dev/null 2>&1; then exit 0; fi`,\n      'mkdir -p \"$HOME/.terminfo\" && tic -x -o \"$HOME/.terminfo\" -',\n    ].join('\\n')], { input: entry.stdout, stdio: ['pipe', 'ignore', 'inherit'] });\n    if (!install.error && install.status === 0) {\n      mkdirSync(adeDir(), { recursive: true, mode: 0o700 });\n      writeAtomic(marker, term, 0o600);\n      return term;\n    }\n  }\n  console.error('cofactor dev attach: terminal entry unavailable; using TERM=xterm-256color.');\n  return fallback;\n}\n\n/** Attach or recreate window 0 with a PTY, preserving a terminal the guest can use. */\nasync function attachSsh(alias: string, term: string, connected: () => void, signal: AbortSignal, deadline: number | null): Promise<number> {\n  const stopBrowser = watchBrowserRequests(alias);\n  // Loading the user environment in the pane also supports existing published guests.\n  const start = `bash -lc ${shellQuote('if [ -f \"$HOME/.config/cofactor/ade-env.sh\" ]; then . \"$HOME/.config/cofactor/ade-env.sh\"; fi; export PATH=\"$HOME/.local/share/cofactor/bin:$PATH\"; export BROWSER=\"$HOME/.local/share/cofactor/bin/ade-open\"; export GH_BROWSER=\"$BROWSER\"; exec \"$HOME/.local/share/cofactor/bin/ade-start\"')}`;\n  const ssh = spawn('ssh', ['-o', 'ServerAliveInterval=2', '-o', 'ServerAliveCountMax=3', '-o', 'ConnectTimeout=10', '-o', 'BatchMode=yes', '-o', 'PermitLocalCommand=yes', '-o', \"LocalCommand=printf 'cofactor-ade-ready\\\\n' >&2\", '-tt', alias, `touch /var/lib/ade/local/laptop-setup-ready; exec tmux new-session -A -s ade ${shellQuote(start)}`], {\n    stdio: ['inherit', 'inherit', 'pipe'], env: { ...process.env, TERM: term },\n  });\n  let refused = false;\n  const terminate = () => { stopBrowser(); ssh.kill('SIGTERM'); };\n  const pending = deadline === null ? null : setTimeout(terminate, Math.max(1, deadline - Date.now()));\n  signal.addEventListener('abort', terminate, { once: true });\n  const diagnostics = createInterface({ input: ssh.stderr });\n  diagnostics.on('line', (line) => {\n    // OpenSSH LocalCommand runs locally after authentication, so a remote PTY cannot merge this into stdout.\n    if (line.trim() === 'cofactor-ade-ready') { if (pending) clearTimeout(pending); connected(); return; }\n    console.error(line);\n    // SSH uses 255 for both transport loss and security refusals. Never retry the latter.\n    refused ||= /Permission denied|Host key verification failed|REMOTE HOST IDENTIFICATION HAS CHANGED|Too many authentication failures|no matching host key|Bad configuration|Bad owner or permissions|UNPROTECTED PRIVATE KEY/i.test(line);\n  });\n  return new Promise<number>((resolve, reject) => {\n    const cleanup = () => {\n      if (pending) clearTimeout(pending);\n      signal.removeEventListener('abort', terminate);\n      diagnostics.close();\n      process.off('SIGTERM', terminate);\n      process.off('SIGINT', terminate);\n      stopBrowser();\n    };\n    process.once('SIGTERM', terminate);\n    process.once('SIGINT', terminate);\n    ssh.on('error', () => { cleanup(); reject(new Error('ssh failed to start')); });\n    ssh.on('close', (code) => { cleanup(); resolve(refused ? 1 : (code ?? (signal.aborted ? 130 : 255))); });\n  });\n}\n\n/** Recover the observed Wi-Fi/sleep transport loss; tmux, not local input, survives. */\nexport async function attachWithReconnect(alias: string, apiUrl: string, token: string, sessionId: string, envArgs: string[]): Promise<number> {\n  const controller = new AbortController();\n  const cancel = () => controller.abort();\n  process.once('SIGINT', cancel);\n  process.once('SIGTERM', cancel);\n  let deadline: number | null = null;\n  let attempt = 0;\n  let stopDiscarding = () => {};\n  try {\n    // Preparation happens once, before interactive recovery, not on each disconnected attempt.\n    const term = prepareTerminal(alias);\n    prepareBrowserRequests(alias);\n    for (;;) {\n      const code = await attachSsh(alias, term, () => { stopDiscarding(); deadline = null; attempt = 0; }, controller.signal, deadline);\n      if (controller.signal.aborted) return 130;\n      if (code !== 255) return code; // Normal tmux detach/exit and security refusals are terminal.\n      if (deadline === null) {\n        console.error('cofactor dev attach: Reconnecting to the surviving session (Ctrl-C to stop)…');\n        deadline = Date.now() + 60_000;\n        if (process.stdin.isTTY) {\n          const wasRaw = process.stdin.isRaw;\n          process.stdin.setRawMode(true);\n          const discard = (chunk: Buffer) => { if (chunk.includes(3)) cancel(); };\n          process.stdin.on('data', discard);\n          process.stdin.resume();\n          stopDiscarding = () => {\n            process.stdin.pause();\n            process.stdin.off('data', discard);\n            process.stdin.setRawMode(wasRaw);\n          };\n        }\n      }\n      for (;;) {\n        if (Date.now() >= deadline) throw new Error('reconnect timed out after 60 seconds; run `cofactor dev attach` to try again');\n        await delay(Math.min(500 * 2 ** Math.min(attempt++, 4), 4_000, Math.max(1, deadline - Date.now())), undefined, { signal: controller.signal });\n        try {\n          const signal = AbortSignal.any([controller.signal, AbortSignal.timeout(Math.max(1, deadline - Date.now()))]);\n          const current = await bootstrapRequest<{ ok: boolean; error?: string; data?: { status: string; leaseCapAt: string | null } }>(apiUrl, token, encodeURIComponent(sessionId), 'GET', null, signal);\n          if (!current.ok || !current.data) throw new Error(current.error ?? 'could not read the session');\n          if (current.data.status === 'ending' || current.data.status === 'ended' || (current.data.leaseCapAt !== null && Date.parse(current.data.leaseCapAt) <= Date.now())) {\n            throw new Error('the session has ended or expired; reconnect stopped');\n          }\n          alias = await grantAndConfigure(apiUrl, token, sessionId, envArgs, signal);\n          break;\n        } catch (error) {\n          if (!(error instanceof BootstrapFailure) || !error.retryable) throw error;\n        }\n      }\n    }\n  } catch (error) {\n    if (controller.signal.aborted) return 130;\n    console.error(`cofactor dev attach: ${error instanceof Error ? error.message : String(error)}`);\n    return 1;\n  } finally {\n    stopDiscarding();\n    process.off('SIGINT', cancel);\n    process.off('SIGTERM', cancel);\n  }\n}\n\n/**\n * `cofactor dev proxy <id>`: ssh's ProxyCommand. stdin and stdout are ssh's\n * connection, so everything else goes to stderr. A failed upgrade is retried\n * with a fresh ticket, up to 5 attempts, replaying what ssh already sent.\n * Resolves with the exit status once the connection ends.\n */\nexport async function runProxy(apiUrl: string, token: string, sessionId: string, envArgs: string[]): Promise<number> {\n  const grant = readGrants()[sessionId];\n  if (!grant || new Date(grant.expiresAt).getTime() - Date.now() < REGRANT_BEFORE_MS) {\n    await grantAndConfigure(apiUrl, token, sessionId, envArgs);\n  }\n\n  let resolveFinished: (status: number) => void = () => undefined;\n  const finished = new Promise<number>((resolve) => {\n    resolveFinished = resolve;\n  });\n  // Releasing stdin lets the process end even when the CLI's exit is a no-op (a clean 0), so ssh sees EOF.\n  const finish = (status: number) => {\n    process.stdin.destroy();\n    resolveFinished(status);\n  };\n  const buffered: Buffer[] = [];\n  let bufferedBytes = 0;\n  let socket: WebSocket | null = null;\n  let stdinEnded = false;\n  process.stdin.on('data', (chunk: Buffer) => {\n    if (socket?.readyState === WebSocket.OPEN) {\n      socket.send(new Uint8Array(chunk));\n      return;\n    }\n    bufferedBytes += chunk.length;\n    if (bufferedBytes > MAX_BUFFERED_STDIN) {\n      console.error('cofactor dev proxy: ssh sent too much before the relay answered');\n      finish(1);\n      return;\n    }\n    buffered.push(chunk);\n  });\n  process.stdin.on('end', () => {\n    stdinEnded = true;\n    socket?.close(1000);\n  });\n\n  const connect = async (attempt: number): Promise<void> => {\n    const ticket = await apiRequest<TicketResponse>(apiUrl, token, 'POST', `/org/ade/sessions/${encodeURIComponent(sessionId)}/relay-ticket`);\n    if (!ticket.ok || !ticket.data) {\n      console.error(`cofactor dev proxy: ${ticket.error ?? 'no relay ticket'}`);\n      finish(1);\n      return;\n    }\n    if (!isTicketSafeUrl(ticket.data.url)) {\n      console.error('cofactor dev proxy: the API returned a relay URL that is not wss://; refusing to send the ticket');\n      finish(1);\n      return;\n    }\n    const ws = new WebSocket(ticket.data.url, [ADE_SSH_SUBPROTOCOL, ticket.data.ticket]);\n    ws.binaryType = 'arraybuffer';\n    ws.onopen = () => {\n      socket = ws;\n      for (const chunk of buffered.splice(0)) ws.send(new Uint8Array(chunk));\n      if (stdinEnded) ws.close(1000);\n    };\n    ws.onmessage = (event) => {\n      process.stdout.write(Buffer.from(event.data as ArrayBuffer));\n    };\n    ws.onclose = (event) => {\n      if (socket === ws) {\n        if (event.code !== 1000) {\n          console.error(`cofactor dev proxy: the relay closed the connection (${event.code}${event.reason ? `: ${event.reason}` : ''})`);\n          const hint = RELAY_CLOSE_HINTS[event.code];\n          if (hint) console.error(`cofactor dev proxy: ${hint}`);\n        }\n        finish(event.code === 1000 ? 0 : 1);\n        return;\n      }\n      // The upgrade failed: try again with a fresh ticket.\n      if (attempt >= PROXY_ATTEMPTS) {\n        console.error(`cofactor dev proxy: could not reach the relay after ${PROXY_ATTEMPTS} attempts`);\n        finish(1);\n        return;\n      }\n      setTimeout(() => {\n        connect(attempt + 1).catch((error: unknown) => {\n          // The CLI's own exit (an auth failure inside apiRequest) already said why.\n          if (error instanceof ProcessExitSignal) {\n            finish(error.exitCode);\n            return;\n          }\n          console.error(`cofactor dev proxy: ${error instanceof Error ? error.message : String(error)}`);\n          finish(1);\n        });\n      }, attempt * 500);\n    };\n  };\n  await connect(1);\n  return finished;\n}\n","/**\n * The wire contract between the Cofactor API and `ade-relay` (apps/ade-relay):\n * the relay ticket the API issues and the relay verifies, and the activity\n * calls the relay makes back to the API. See specs/pending/ade.md (SSH and\n * attach).\n *\n * This package imports nothing but Node built-ins, and the relay imports no\n * other workspace package (the boundary check in infra/ade-relay.test.ts), so the relay\n * image changes only when its own inputs do.\n *\n * Changing the ticket or the activity schema is two PRs, relay first: bump\n * {@link ADE_RELAY_PROTOCOL_VERSION}, ship a relay that accepts both, then\n * move the API.\n */\nimport { createHmac, timingSafeEqual } from 'node:crypto';\n\nexport const ADE_RELAY_PROTOCOL_VERSION = 1;\n\n/** The `Sec-WebSocket-Protocol` value the proxy offers ahead of its ticket. */\nexport const ADE_SSH_SUBPROTOCOL = 'ade-ssh.v1';\n\n/** The shortest ticket key and service token the API and the relay accept. */\nexport const ADE_RELAY_SECRET_MIN_LENGTH = 32;\n\n/** A ticket is good for this long after issue. */\nexport const ADE_RELAY_TICKET_TTL_SECONDS = 60;\n\n/** What a relay ticket binds. `exp` is epoch seconds. */\nexport interface AdeRelayTicketClaims {\n  v: typeof ADE_RELAY_PROTOCOL_VERSION;\n  orgId: string;\n  sessionId: string;\n  userId: string;\n  sandboxId: string;\n  exp: number;\n}\n\n/**\n * The client address the load balancer appended: the last `X-Forwarded-For`\n * entry, which a client cannot choose (it can only prepend). Both the relay and\n * the API's activity route key their failed-check limits on it.\n */\nexport function forwardedClientAddress(forwardedFor: string | null): string {\n  return forwardedFor?.split(',').at(-1)?.trim() || 'unknown';\n}\n\nexport type AdeRelayTicketResult =\n  | { ok: true; claims: AdeRelayTicketClaims }\n  | { ok: false; reason: 'malformed' | 'signature' | 'version' | 'expired' };\n\nconst TICKET_PART = /^[A-Za-z0-9_-]+$/;\n/** Org, session, user and sandbox ids: UUIDs and prefixed ids, safe in a URL path. */\nconst ID = /^[A-Za-z0-9_-]{1,128}$/;\n/** How far past a fresh ticket's expiry a verified `exp` may sit (the API's and relay's clocks differ). */\nconst EXPIRY_SLACK_SECONDS = 5;\n\nfunction sign(payload: string, key: string): string {\n  return createHmac('sha256', key).update(payload).digest('base64url');\n}\n\nfunction isId(value: unknown): value is string {\n  return typeof value === 'string' && ID.test(value);\n}\n\n/**\n * `<base64url(JSON claims)>.<base64url(HMAC-SHA256)>`. Both halves use only\n * HTTP token characters, so the ticket travels in `Sec-WebSocket-Protocol`.\n */\nexport function encodeAdeRelayTicket(\n  input: Omit<AdeRelayTicketClaims, 'v' | 'exp'>,\n  key: string,\n  nowMs: number\n): { ticket: string; claims: AdeRelayTicketClaims } {\n  if (key.length < ADE_RELAY_SECRET_MIN_LENGTH) throw new Error('ade relay ticket key is too short');\n  for (const id of [input.orgId, input.sessionId, input.userId, input.sandboxId]) {\n    if (!isId(id)) throw new Error('ade relay ticket ids must match [A-Za-z0-9_-]{1,128}');\n  }\n  const claims: AdeRelayTicketClaims = {\n    v: ADE_RELAY_PROTOCOL_VERSION,\n    orgId: input.orgId,\n    sessionId: input.sessionId,\n    userId: input.userId,\n    sandboxId: input.sandboxId,\n    exp: Math.floor(nowMs / 1000) + ADE_RELAY_TICKET_TTL_SECONDS,\n  };\n  const payload = Buffer.from(JSON.stringify(claims)).toString('base64url');\n  return { ticket: `${payload}.${sign(payload, key)}`, claims };\n}\n\n/** Checks the signature before reading anything the ticket claims. */\nexport function verifyAdeRelayTicket(\n  ticket: string,\n  key: string,\n  nowMs: number\n): AdeRelayTicketResult {\n  if (ticket.length > 2048) return { ok: false, reason: 'malformed' };\n  const parts = ticket.split('.');\n  if (parts.length !== 2) return { ok: false, reason: 'malformed' };\n  const [payload, signature] = parts as [string, string];\n  if (!TICKET_PART.test(payload) || !TICKET_PART.test(signature)) {\n    return { ok: false, reason: 'malformed' };\n  }\n  const expected = Buffer.from(sign(payload, key));\n  const given = Buffer.from(signature);\n  if (expected.length !== given.length || !timingSafeEqual(expected, given)) {\n    return { ok: false, reason: 'signature' };\n  }\n  let raw: unknown;\n  try {\n    raw = JSON.parse(Buffer.from(payload, 'base64url').toString('utf8'));\n  } catch {\n    return { ok: false, reason: 'malformed' };\n  }\n  if (typeof raw !== 'object' || raw === null) return { ok: false, reason: 'malformed' };\n  const claims = raw as Record<string, unknown>;\n  if (claims.v !== ADE_RELAY_PROTOCOL_VERSION) return { ok: false, reason: 'version' };\n  const { orgId, sessionId, userId, sandboxId, exp } = claims;\n  if (\n    !isId(orgId) ||\n    !isId(sessionId) ||\n    !isId(userId) ||\n    !isId(sandboxId) ||\n    typeof exp !== 'number' ||\n    !Number.isInteger(exp)\n  ) {\n    return { ok: false, reason: 'malformed' };\n  }\n  if (exp * 1000 <= nowMs) return { ok: false, reason: 'expired' };\n  // A ticket never lives longer than the API issues it for, whoever signed it.\n  if (exp * 1000 > nowMs + (ADE_RELAY_TICKET_TTL_SECONDS + EXPIRY_SLACK_SECONDS) * 1000) {\n    return { ok: false, reason: 'malformed' };\n  }\n  return {\n    ok: true,\n    claims: { v: ADE_RELAY_PROTOCOL_VERSION, orgId, sessionId, userId, sandboxId, exp },\n  };\n}\n\n/**\n * `POST /internal/ade/relay/:sessionId/activity`, authenticated by the relay's\n * service token. `open` before the gateway CONNECT, `heartbeat` each minute\n * while open, `close` and `connect_failed` for audit. `connId` names one relayed\n * connection, so a retried audit event can be told apart from a second one.\n */\nexport const ADE_RELAY_ACTIVITY_EVENTS = ['open', 'heartbeat', 'close', 'connect_failed'] as const;\nexport type AdeRelayActivityEvent = (typeof ADE_RELAY_ACTIVITY_EVENTS)[number];\n\nexport interface AdeRelayActivityRequest {\n  v: typeof ADE_RELAY_PROTOCOL_VERSION;\n  event: AdeRelayActivityEvent;\n  connId: string;\n  /** From the verified ticket: the API scopes its lookup to this org and user. */\n  orgId: string;\n  userId: string;\n  sandboxId: string;\n}\n\n/** `close: true` means the relay must close the connection now. */\nexport interface AdeRelayActivityResponse {\n  status: string;\n  close: boolean;\n}\n\nconst CONN_ID = /^[A-Za-z0-9_-]{8,64}$/;\n\nexport function parseAdeRelayActivityRequest(value: unknown): AdeRelayActivityRequest | null {\n  if (typeof value !== 'object' || value === null) return null;\n  const body = value as Record<string, unknown>;\n  if (body.v !== ADE_RELAY_PROTOCOL_VERSION) return null;\n  const { event, connId, orgId, userId, sandboxId } = body;\n  if (!ADE_RELAY_ACTIVITY_EVENTS.includes(event as AdeRelayActivityEvent)) return null;\n  if (typeof connId !== 'string' || !CONN_ID.test(connId)) return null;\n  if (!isId(orgId) || !isId(userId) || !isId(sandboxId)) return null;\n  return {\n    v: ADE_RELAY_PROTOCOL_VERSION,\n    event: event as AdeRelayActivityEvent,\n    connId,\n    orgId,\n    userId,\n    sandboxId,\n  };\n}\n\nexport function parseAdeRelayActivityResponse(value: unknown): AdeRelayActivityResponse | null {\n  if (typeof value !== 'object' || value === null) return null;\n  const body = value as Record<string, unknown>;\n  if (typeof body.status !== 'string' || typeof body.close !== 'boolean') return null;\n  return { status: body.status, close: body.close };\n}\n","/** Follow ADE browser requests over SSH while the interactive terminal is attached. */\nimport { spawn, spawnSync } from 'node:child_process';\nimport { ADE_START_SCRIPT, ADE_SYNC_SCRIPT } from '@chatsdet/sandbox-helper/ade-scripts';\nimport { ADE_OPEN_SCRIPT } from '@chatsdet/sandbox-helper/ade-open';\nimport { createInterface } from 'node:readline';\n\nfunction httpsBrowserUrl(value: string): boolean {\n  if (/[\\u0000-\\u0020\\u007f-\\u009f]/.test(value)) return false; // eslint-disable-line no-control-regex\n  try {\n    const url = new URL(value);\n    return url.protocol === 'https:' && !url.username && !url.password;\n  } catch { return false; }\n}\n\nexport function prepareBrowserRequests(alias: string): void {\n  // Existing published guests do not yet have the image's ade-open command.\n  const installed = spawnSync('ssh', ['-T', alias, `node -e 'const fs=require(\"node:fs\"),p=require(\"node:path\"),h=require(\"node:os\").homedir(); const dir=p.join(h,\".local/share/cofactor/bin\"); fs.mkdirSync(dir,{recursive:true,mode:0o700}); if(!fs.realpathSync(dir).startsWith(fs.realpathSync(h)+\"/\"))process.exit(1);const scripts=JSON.parse(fs.readFileSync(0,\"utf8\"));for(const name of [\"ade-open\",\"ade-start\",\"ade-sync-repos\"]){const file=p.join(dir,name);if(fs.lstatSync(file,{throwIfNoEntry:false})?.isSymbolicLink())process.exit(1);const temp=file+\".ade-\"+process.pid;fs.writeFileSync(temp,scripts[name],{flag:\"wx\",mode:0o700});fs.renameSync(temp,file);}'`], { input: JSON.stringify({ 'ade-open': ADE_OPEN_SCRIPT, 'ade-start': ADE_START_SCRIPT, 'ade-sync-repos': ADE_SYNC_SCRIPT }), stdio: ['pipe', 'ignore', 'ignore'] });\n  if (installed.status !== 0) throw new Error('ADE startup helpers could not be installed safely; retry the attach after checking SSH access.');\n}\n\nexport function watchBrowserRequests(alias: string): () => void {\n  const watcher = spawn('ssh', ['-T', alias, 'umask 077; touch /var/lib/ade/local/open-urls; exec tail -n 1 -F /var/lib/ade/local/open-urls'], { stdio: ['ignore', 'pipe', 'ignore'] });\n  let stopped = false;\n  const lines = createInterface({ input: watcher.stdout });\n  const opened = new Set<string>();\n  lines.on('line', (line) => {\n    if (!httpsBrowserUrl(line) || opened.has(line)) return;\n    opened.add(line);\n    const opener = spawn(process.platform === 'darwin' ? 'open' : 'xdg-open', [line], { stdio: 'ignore' });\n    opener.on('error', () => console.error('ADE: could not open the laptop browser; use the URL printed in the remote terminal.'));\n    opener.on('close', (code) => { if (code !== null && code !== 0) console.error('ADE: the laptop opener failed; use the URL printed in the remote terminal.'); });\n  });\n  watcher.on('error', () => console.error('ADE: browser forwarding unavailable; use the URLs printed in the remote terminal.'));\n  watcher.on('exit', () => { if (!stopped) console.error('ADE: browser forwarding ended; use the URLs printed in the remote terminal.'); });\n  return () => { stopped = true; lines.close(); watcher.kill('SIGTERM'); };\n}\n","#!/usr/bin/env bash\n# ade-start: the session's tmux window 0 (tmux session `ade`), started by the\n# API's ade.claim after ade-init. Runs as agent and reports each phase to the\n# API (ade-event), which `cofactor dev` shows and `agent_started` turns into\n# `running`:\n#\n#   home_mounted   ade-home mount (until S4, the box's own empty home)\n#   setup_done     the user's ~/.config/cofactor/ade-setup.sh, if any\n#   needs_user     first claim of this template (no setup marker): the setup\n#                  agent runs the template's setup prompt with the user attached\n#   repos_synced   ade-sync-repos; on a failure (usually a GitHub login) the\n#                  session goes back to needs_user and a shell opens to fix it\n#   agent_started  the template's first agent, in /workspace/<first repo>\n#\n# A heartbeat re-posts the current phase every 5 min. A failure before\n# home_mounted ends the session; after it, the session ends with its home saved.\n#\n# Part of the ADE base image (ADE_BASE_VERSION). specs/pending/ade.md (Guest phases).\nset -uo pipefail\n\n# A plain SSH login must take the same path as `cofactor dev attach`: tmux\n# owns the agent's controlling PTY, including when window 0 must be recreated.\nif [[ -z ${TMUX:-} ]]; then\n  if [[ ! -t 0 || ! -t 1 ]]; then\n    echo 'ade-start: a terminal is required; reconnect with ssh -t.' >&2\n    exit 1\n  fi\n  touch /var/lib/ade/local/laptop-setup-ready\n  stty sane\n  if ! infocmp -x \"${TERM:-}\" >/dev/null 2>&1; then\n    echo 'ade-start: terminal entry unavailable; using TERM=xterm-256color.' >&2\n    export TERM=xterm-256color\n  fi\n  error=$(mktemp)\n  tmux new-session -A -s ade \"$0\" 2>\"$error\"\n  status=$?\n  if ((status != 0)) && grep -Eq 'missing or unsuitable terminal|unknown terminal|terminal does not support' \"$error\" && [[ $TERM != xterm-256color ]]; then\n    echo 'ade-start: tmux could not use this terminal; retrying with TERM=xterm-256color.' >&2\n    TERM=xterm-256color tmux new-session -A -s ade \"$0\"\n    status=$?\n  else\n    cat \"$error\" >&2\n  fi\n  rm -- \"$error\"\n  exit \"$status\"\nfi\n\n# Bind all agent I/O to the pane's terminal. An exec transport's pipes or a\n# caller's redirection must never become the interactive agent's stdin.\nexec </dev/tty >/dev/tty 2>&1\nstty sane\nsource /usr/local/lib/cofactor-ade/ade-aws-env.sh\n\ntemplate=/etc/cofactor/ade/template.json\nprompt_file=/etc/cofactor/ade/setup-prompt.md\nevent_file=/var/lib/ade/local/last-event\n\n# Keep an event for the heartbeat, written whole then renamed, so it never reads half of one.\nkeep_event() {\n  printf '%s' \"$1\" >\"$event_file.tmp\" && mv \"$event_file.tmp\" \"$event_file\"\n}\n\n# Post a phase (optionally with its whole event) and keep it for the heartbeat.\nreport() {\n  local event=${2:-$(jq -cn --arg phase \"$1\" '{phase: $phase}')}\n  keep_event \"$event\"\n  ade-event \"$event\" || echo \"ade-start: could not report $1 (the heartbeat retries)\" >&2\n}\n\nfail() {\n  echo \"ade-start: $1\" >&2\n  local event\n  event=$(jq -cn --arg error \"$1\" '{phase: \"failed\", error: $error}')\n  keep_event \"$event\"\n  ade-event \"$event\" || echo 'ade-start: could not report the failure (the heartbeat retries)' >&2\n  exec bash -l\n}\n\n# The heartbeat: re-post the latest event (a phase, its repair hint, or a\n# failure), so a lost post or an API deploy loses nothing. It starts before\n# anything can fail; until the first report there is nothing to post.\n(\n  sleeper=\n  trap '[[ -z $sleeper ]] || kill \"$sleeper\" 2>/dev/null; exit' TERM INT\n  checkpoints=0\n  while true; do\n    sleep 300 &\n    sleeper=$!\n    wait \"$sleeper\" || exit\n    checkpoints=$((checkpoints + 1))\n    if ((checkpoints % 3 == 0)); then ade-home save || echo 'ADE: home checkpoint failed; the previous saved home is retained.' >&2; fi\n    [[ -f $event_file ]] && { ade-event \"$(cat \"$event_file\")\" >/dev/null 2>&1 || true; }\n  done\n) &\nheartbeat=$!\ntrap 'kill \"$heartbeat\" 2>/dev/null || true; wait \"$heartbeat\" 2>/dev/null || true; ade-home save || echo \"ADE: exit home save failed.\" >&2' EXIT\n\nbanner() { printf '\\n\\033[1m== %s ==\\033[0m\\n\\n' \"$*\"; }\n\nname=$(jq -er '.name' \"$template\") || fail 'the template has no name'\n# The name becomes a path under the home (the setup marker); the manifest allows only this shape.\n[[ $name =~ ^[a-z][a-z0-9-]{0,31}$ ]] || fail \"the template name $name is not a valid template name\"\nagent=$(jq -er '.agents | keys_unsorted[0]' \"$template\") || fail 'the template lists no agent'\nrun=$(jq -er --arg agent \"$agent\" '.agents[$agent].run' \"$template\") || fail \"agent $agent has no run command\"\nfirst_repo=$(jq -er '.repos[0].github | split(\"/\")[1]' \"$template\") || fail 'the template lists no repo'\n\nade-home mount || fail 'ade-home mount failed'\nreport home_mounted\nade-access || fail 'AWS access bootstrap failed'\nif [[ -f /var/lib/ade/local/home-warning ]]; then\n  tmux set-option -g status-right 'HOME NOT SAVED: another writer'\nfi\nif [[ ! -f $HOME/.config/cofactor/ade-setup/$name ]]; then\nreport needs_user \"$(jq -cn '{phase: \"needs_user\", error: \"Complete laptop setup with cofactor dev attach\"}')\"\nwhile [[ ! -f /var/lib/ade/local/laptop-setup-ready ]]; do sleep 1; done\nfi\n[[ ! -f $HOME/.config/cofactor/ade-env.sh ]] || source \"$HOME/.config/cofactor/ade-env.sh\"\n\npersonal=$HOME/.config/cofactor/ade-setup.sh\nif [[ -f $personal ]]; then\n  banner \"Your setup script ($personal)\"\n  bash \"$personal\" || echo \"ade-start: $personal exited $?; carrying on\" >&2\nfi\nreport setup_done\n\n# Login shells may reset PATH: reload the selected environment after their profile.\nagent_shell() {\n  bash -lc '\n    [[ ! -f $HOME/.config/cofactor/ade-env.sh ]] || source \"$HOME/.config/cofactor/ade-env.sh\"\n    if [[ -d $HOME/.local/share/cofactor/bin ]]; then\n      export PATH=\"$HOME/.local/share/cofactor/bin:$PATH\"\n      export BROWSER=\"$HOME/.local/share/cofactor/bin/ade-open\"\n      export GH_BROWSER=\"$BROWSER\"\n    fi\n    source /usr/local/lib/cofactor-ade/ade-aws-env.sh\n    exec bash -c \"$@\"\n  ' ade-agent \"$@\"\n}\n\nauth_status=$(jq -r --arg agent \"$agent\" '.agents[$agent].auth.status // empty' \"$template\")\nauth_login=$(jq -r --arg agent \"$agent\" '.agents[$agent].auth.login // empty' \"$template\")\n# Published v4 templates predate auth commands; their real callers are Claude/Codex.\nif [[ -z $auth_status ]]; then\n  case $agent in\n    claude) auth_status='claude auth status'; auth_login='claude auth login';;\n    codex) auth_status='codex login status'; auth_login='codex login --device-auth';;\n  esac\nfi\nif [[ $agent == codex && -n ${OPENAI_API_KEY:-} ]]; then\n  printf '%s' \"$OPENAI_API_KEY\" | agent_shell 'codex login --with-api-key' >/dev/null 2>&1 || echo 'ade-start: Codex API-key login failed; interactive sign-in is required.' >&2\nfi\nlaptop_ready=false\nif [[ -f $HOME/.config/cofactor/ade-env.sh ]] && gh auth status --hostname github.com >/dev/null 2>&1; then\n  if [[ -z $auth_status ]] || agent_shell \"$auth_status\" >/dev/null 2>&1; then laptop_ready=true; fi\nfi\n\n# Fallback only: normal laptop delivery already supplied these logins.\nwhile ! gh auth status --hostname github.com >/dev/null 2>&1; do\n  report needs_user \"$(jq -cn '{phase: \"needs_user\", error: \"GitHub sign-in required\"}')\"\n  echo 'ade-start: GitHub sign-in is required; complete the browser flow on your laptop.'\n  gh auth login --hostname github.com --git-protocol https --web || { echo 'ade-start: GitHub sign-in interrupted; attach again to retry.' >&2; exit 1; }\ndone\nif [[ -n $auth_status ]]; then\n  while ! agent_shell \"$auth_status\" >/dev/null 2>&1; do\n    report needs_user \"$(jq -cn --arg agent \"$agent\" '{phase: \"needs_user\", error: ($agent + \" sign-in required before setup\")}')\"\n    echo \"ade-start: sign in to $agent first; open its URL on your laptop and complete the instructions here.\"\n    agent_shell \"$auth_login\" || { echo 'ade-start: sign-in was interrupted; attach again to retry.' >&2; exit 1; }\n  done\nfi\n\nprompt_hash=$(sha256sum \"$prompt_file\" | cut -c1-64)\nmarker=$HOME/.config/cofactor/ade-setup/$name\nif [[ ! -f $marker ]] && [[ $laptop_ready != true ]]; then\n  [[ ! -e /var/lib/ade/local/setup-complete ]] || rm -- /var/lib/ade/local/setup-complete || exit 1\n  report needs_user\n  banner \"First claim of $name: $agent runs the setup prompt (sha256 ${prompt_hash:0:12}). Exit $agent when it is done.\"\n  (cd /workspace && agent_shell \"$run \\\"\\$1\\\"\" ade-setup \"$(cat \"$prompt_file\")\n\nADE startup has already handled all login steps. Perform only any remaining repository-specific manual setup. The startup runner owns clone/install; do not run ade-sync-repos here. When finished, run touch /var/lib/ade/local/setup-complete before exiting. An empty exit or cancellation is not completion.\")\n  status=$?\n  if ((status != 0)) || [[ ! -f /var/lib/ade/local/setup-complete ]]; then\n    echo \"ade-start: setup exited $status; attach again to retry (setup is not marked complete).\" >&2\n    exit 1\n  fi\nelif [[ -f $marker && $(cat \"$marker\") != \"$prompt_hash\" ]]; then\n  echo \"ade-start: the setup prompt changed since your first claim (now sha256 ${prompt_hash:0:12}); its new steps have not run\" >&2\nfi\n\nuntil ade-sync-repos; do\n  report needs_user \"$(jq -cn '{phase: \"needs_user\", error: \"ade-sync-repos failed: check `gh auth status`\"}')\"\n  banner \"ade-sync-repos failed. Fix it in this shell (usually: gh auth login --web; gh auth setup-git), then exit to retry.\"\n  agent_shell 'exec bash -i'\ndone\nreport repos_synced\nmkdir -p \"$(dirname \"$marker\")\"\nprintf '%s\\n' \"$prompt_hash\" >\"$marker\"\n\n# The events route keeps at most 20 (display only).\nbranches=$(for dir in /workspace/*/.git; do git -C \"${dir%/.git}\" branch --show-current; done | jq -Rsc 'split(\"\\n\") | map(select(length > 0)) | .[0:20]')\ncd \"/workspace/$first_repo\" || fail \"/workspace/$first_repo is missing after ade-sync-repos\"\nreport agent_started \"$(jq -cn --arg agent \"$agent\" --argjson branches \"$branches\" '{phase: \"agent_started\", agent: $agent, branches: $branches}')\"\ntmux set-option -w remain-on-exit on\nagent_shell \"exec $run\"\n","#!/usr/bin/env bash\n# ade-sync-repos: bring every template repo to this session's branch, as agent,\n# with the user's own GitHub login (gh's credential helper), never Cofactor's.\n#\n#   1. Clone https://github.com/<owner>/<name> to /workspace/<name>\n#      (--filter=blob:none), or fetch it if it is already there.\n#   2. Check out `ade/<session short id>`, created from up-to-date\n#      `origin/<default branch>` the first time.\n#   3. Run the repo's `install` commands in it, in a login shell.\n#\n# Idempotent: the setup prompt runs it, and ade-start runs it again. Repo names\n# are checked again here (the template was validated at publish) so the user's\n# token can only ever go to github.com, and nothing reaches git as an option.\n#\n# Part of the ADE base image (ADE_BASE_VERSION). specs/pending/ade.md (Repos and the first claim).\nset -euo pipefail\nexport GIT_TERMINAL_PROMPT=0\nif ! gh auth status --hostname github.com >/dev/null 2>&1; then\n  echo 'ade-sync-repos: run gh auth login --web, then ade-sync-repos' >&2\n  exit 1\nfi\n\n# Persist the helper: the agent’s ordinary git push must use the same HTTPS login.\ngh auth setup-git --hostname github.com\n\ntemplate=/etc/cofactor/ade/template.json\nsession=$(jq -er '.sessionId' /run/cofactor/ade/session.json)\n[[ $session =~ ^ades_([1-9A-HJ-NP-Za-km-z]{8}) ]] || { echo \"ade-sync-repos: invalid session id\" >&2; exit 2; }\nbranch=\"ade/${BASH_REMATCH[1]}\"\ngit check-ref-format --branch \"$branch\" >/dev/null\n\ngitgh() { git -c credential.helper= -c 'credential.helper=!gh auth git-credential' \"$@\"; }\n\nmapfile -t repos < <(jq -c '.repos[]' \"$template\")\nfor repo in \"${repos[@]}\"; do\n  full=$(jq -er '.github' <<<\"$repo\")\n  if [[ ! $full =~ ^[A-Za-z0-9_.-]+/[A-Za-z0-9_.-]+$ ]] || [[ /$full/ == */./* || /$full/ == */../* ]]; then\n    echo \"ade-sync-repos: refusing repo name $full\" >&2\n    exit 2\n  fi\n  name=${full#*/}\n  dest=/workspace/$name\n  if [[ -d $dest/.git ]]; then\n    echo \"── fetch $full\"\n    gitgh -C \"$dest\" fetch --prune origin\n  else\n    echo \"── clone $full\"\n    gitgh clone --filter=blob:none -- \"https://github.com/$full.git\" \"$dest\"\n  fi\n  default=$(git -C \"$dest\" symbolic-ref --short refs/remotes/origin/HEAD)\n  default=${default#origin/}\n  if git -C \"$dest\" rev-parse --verify --quiet \"refs/heads/$branch\" >/dev/null; then\n    git -C \"$dest\" checkout --quiet \"$branch\"\n  else\n    git -C \"$dest\" checkout --quiet -b \"$branch\" \"origin/$default\"\n  fi\n  echo \"── $name on $branch (from origin/$default)\"\n  mapfile -t installs < <(jq -r '.install[]' <<<\"$repo\")\n  for command in \"${installs[@]}\"; do\n    echo \"── $name: $command\"\n    (cd \"$dest\" && bash -lc '[[ ! -f $HOME/.config/cofactor/ade-env.sh ]] || source \"$HOME/.config/cofactor/ade-env.sh\"; exec bash -c \"$1\"' ade-install \"$command\") </dev/null\n  done\ndone\necho \"ade-sync-repos: done\"\n","/// <reference path=\"./shell-assets.d.ts\" />\n/** One source for image-baked and laptop-installed guest commands. */\nimport start from '../ade/ade-start.sh' with { type: 'text' };\nimport sync from '../ade/ade-sync-repos.sh' with { type: 'text' };\nexport const ADE_START_SCRIPT = start;\nexport const ADE_SYNC_SCRIPT = sync;\n","/** Browser forwarding uses a private per-session queue, never the home archive. */\nexport const ADE_OPEN_SCRIPT = `#!/usr/bin/env bash\nset -euo pipefail\n[[ $# == 1 ]] || { echo 'ade-open: expected one HTTPS URL' >&2; exit 2; }\nnode -e 'try { const u = new URL(process.argv[1]); if (u.protocol !== \"https:\" || u.username || u.password || /[\\\\x00-\\\\x20\\\\x7f-\\\\x9f]/.test(process.argv[1])) process.exit(1); } catch { process.exit(1); }' \"$1\" || { echo 'ade-open: only HTTPS URLs are allowed' >&2; exit 2; }\numask 077\nqueue=/var/lib/ade/local/open-urls\ntouch \"$queue\"\nchmod 600 \"$queue\"\nprintf '\\\\nOpen on your laptop: %s\\\\n' \"$1\"\nprintf '%s\\\\n' \"$1\" >>\"$queue\"\n`;\n","/**\n * Laptop ADE decisions, read-only inspection and consented home preparation.\n * @module dev-home\n * @see docs/ade/guidance.md\n */\nimport { spawn, spawnSync } from 'node:child_process';\nimport {\n  chmodSync,\n  existsSync,\n  lstatSync,\n  mkdirSync,\n  readdirSync,\n  readFileSync,\n  writeFileSync,\n} from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { createInterface } from 'node:readline/promises';\nimport { stripVTControlCharacters } from 'node:util';\n\nexport type HomeFile = { path: string; content: string };\nexport type LaptopSetup = {\n  files: HomeFile[];\n  env: Record<string, string>;\n  githubToken: string | null;\n  git: { name: string; email: string } | null;\n};\nexport const FILE_GROUPS = [\n  'claude-settings',\n  'claude-skills',\n  'claude-memory',\n  'codex-config',\n  'shell',\n] as const;\ntype FileGroup = (typeof FILE_GROUPS)[number];\nexport type SetupChoices = {\n  github: 'token' | 'none';\n  claude: 'token' | 'in-box';\n  codexKey: boolean;\n  gitIdentity: boolean;\n  include: FileGroup[];\n};\ntype Candidate = { source: string; path: string; size: number };\ntype Decision = {\n  id: string;\n  question: string;\n  found: string[];\n  current: string | null;\n  recommendedDefault: string;\n  options: Array<{ value: string; flag: string; consequence: string }>;\n};\nexport type SetupPlan = {\n  template: { name: string; repos: string[] };\n  decisions: Decision[];\n  suggestedCommand: string;\n  needsYou: Array<{ id: string; reason: string; command: string }>;\n};\nconst configDir = () => path.join(os.homedir(), '.config/cofactor/ade');\nconst capture = (command: string, args: string[]) =>\n  spawnSync(command, args, { encoding: 'utf8', stdio: ['ignore', 'pipe', 'pipe'] });\n\nfunction readJson(file: string): unknown {\n  try {\n    return JSON.parse(readFileSync(file, 'utf8'));\n  } catch {\n    throw new Error(`Could not read ADE setup JSON at ${file}`);\n  }\n}\nfunction privateJson(file: string, value: unknown): void {\n  mkdirSync(path.dirname(file), { recursive: true, mode: 0o700 });\n  if (existsSync(file)) chmodSync(file, 0o600);\n  writeFileSync(file, JSON.stringify(value), { mode: 0o600 });\n}\nasync function ask(question: string, yes: boolean): Promise<boolean> {\n  const input = createInterface({ input: process.stdin, output: process.stdout });\n  try {\n    const answer = (await input.question(`${question} ${yes ? '[Y/n]' : '[y/N]'} `))\n      .trim()\n      .toLowerCase();\n    return answer === '' ? yes : answer === 'y' || answer === 'yes';\n  } finally {\n    input.close();\n  }\n}\n\n/** Symlinks and hardlinks are excluded; inspection reads metadata, never file contents. */\nfunction collect(relative: string, destination = relative): Candidate[] {\n  let ancestor = os.homedir();\n  for (const part of relative.split('/')) {\n    ancestor = path.join(ancestor, part);\n    if (existsSync(ancestor) && lstatSync(ancestor).isSymbolicLink()) return [];\n  }\n  const file = path.join(os.homedir(), relative);\n  if (!existsSync(file) || lstatSync(file).isSymbolicLink()) return [];\n  if (lstatSync(file).isDirectory())\n    return readdirSync(file).flatMap((name) =>\n      collect(`${relative}/${name}`, `${destination}/${name}`)\n    );\n  const stat = lstatSync(file);\n  return stat.isFile() && stat.nlink === 1\n    ? [{ source: relative, path: destination, size: stat.size }]\n    : [];\n}\nfunction fileGroups(): Record<FileGroup, Candidate[]> {\n  const repo = capture('git', ['worktree', 'list', '--porcelain'])\n    .stdout.split('\\n')\n    .find((line) => line.startsWith('worktree '))\n    ?.slice(9);\n  const remote = capture('git', ['remote', 'get-url', 'origin']).stdout.trim();\n  const repoName = remote.match(/\\/([^/]+?)(?:\\.git)?$/)?.[1];\n  return {\n    'claude-settings': collect('.claude/settings.json'),\n    'claude-skills': collect('.claude/skills'),\n    'claude-memory':\n      repo && repoName\n        ? collect(\n            `.claude/projects/${repo.replace(/[^a-zA-Z0-9]/g, '-')}/memory`,\n            `.claude/projects/-workspace-${repoName}/memory`\n          )\n        : [],\n    'codex-config': [...collect('.codex/config.toml'), ...collect('.codex/AGENTS.md')],\n    shell: ['.bashrc', '.bash_profile', '.zshrc', '.profile', '.inputrc'].flatMap((file) =>\n      collect(file)\n    ),\n  };\n}\nfunction claudeToken(): string | null {\n  if (process.env.CLAUDE_CODE_OAUTH_TOKEN) return process.env.CLAUDE_CODE_OAUTH_TOKEN;\n  const file = path.join(configDir(), 'claude-setup-token.json');\n  if (!existsSync(file)) return null;\n  const cached = readJson(file);\n  return typeof cached === 'object' &&\n    cached !== null &&\n    'token' in cached &&\n    typeof cached.token === 'string' &&\n    cached.token\n    ? cached.token\n    : null;\n}\nfunction gitIdentity(): LaptopSetup['git'] {\n  const name = capture('git', ['config', '--global', 'user.name']).stdout.trim();\n  const email = capture('git', ['config', '--global', 'user.email']).stdout.trim();\n  return name && email ? { name, email } : null;\n}\n\n/** The returned plan contains presence and file metadata only, never credentials or file contents. */\nexport function inspectLaptopSetup(template: SetupPlan['template']): SetupPlan {\n  const saved = savedChoices();\n  const github = capture('gh', ['auth', 'status', '--hostname', 'github.com']).status === 0;\n  const claude = Boolean(claudeToken());\n  const identity = Boolean(gitIdentity());\n  const groups = fileGroups();\n  const option = (value: string, flag: string, consequence: string) => ({\n    value,\n    flag,\n    consequence,\n  });\n  const plan = {\n    template,\n    decisions: [\n      {\n        id: 'github',\n        current: saved?.github ?? null,\n        question: 'Use your existing GitHub login to clone and push repositories in the ADE?',\n        found: [\n          github\n            ? 'GitHub CLI is signed in on this laptop (credential hidden).'\n            : 'No usable GitHub CLI login found.',\n        ],\n        recommendedDefault: github ? 'token' : 'none',\n        options: [\n          option(\n            'token',\n            '--github=token',\n            'Send the existing gh token privately to ~/.config/gh/hosts.yml. Clone and push over HTTPS with gh auth git-credential; no new GitHub key or deploy key is created.'\n          ),\n          option(\n            'none',\n            '--github=none',\n            'Send no GitHub token. Sign in with a browser inside the ADE before private repositories can clone or push.'\n          ),\n        ],\n      },\n      {\n        id: 'claude',\n        current: saved?.claude ?? null,\n        question: 'Use a dedicated Claude token to avoid signing in again inside the ADE?',\n        found: [\n          claude\n            ? 'Dedicated Claude token found in CLAUDE_CODE_OAUTH_TOKEN or the local ADE cache (value hidden).'\n            : 'No dedicated Claude token found in the environment or ADE cache.',\n        ],\n        recommendedDefault: claude ? 'token' : 'in-box',\n        options: [\n          option(\n            'token',\n            '--claude=token',\n            'Send the dedicated token privately to ~/.config/cofactor/ade-env.sh. Browser approval is needed on the laptop if no token is available. Laptop OAuth refresh credentials are excluded.'\n          ),\n          option(\n            'in-box',\n            '--claude=in-box',\n            'Send no Claude token. Complete browser sign-in from the attached ADE when Claude needs it.'\n          ),\n        ],\n      },\n      {\n        id: 'codex-key',\n        current: saved ? (saved.codexKey ? 'yes' : 'no') : null,\n        question: 'Send the explicit OpenAI API key for Codex API billing?',\n        found: [\n          process.env.OPENAI_API_KEY\n            ? 'OPENAI_API_KEY is present (value hidden).'\n            : 'OPENAI_API_KEY is absent.',\n        ],\n        recommendedDefault: 'no',\n        options: [\n          option(\n            'yes',\n            '--codex-key=yes',\n            'Send OPENAI_API_KEY privately to ~/.config/cofactor/ade-env.sh. Codex uses API billing; requires the key in this command’s environment.'\n          ),\n          option(\n            'no',\n            '--codex-key=no',\n            'Send no API key. Use browser sign-in inside the ADE if Codex is selected. Codex OAuth auth.json is never copied.'\n          ),\n        ],\n      },\n      {\n        id: 'git-identity',\n        current: saved ? (saved.gitIdentity ? 'yes' : 'no') : null,\n        question: 'Use the laptop’s global git author name and email for commits in the ADE?',\n        found: [\n          identity\n            ? 'Both global git user.name and user.email are configured.'\n            : 'Global git user.name or user.email is missing.',\n        ],\n        recommendedDefault: identity ? 'yes' : 'no',\n        options: [\n          option(\n            'yes',\n            '--git-identity=yes',\n            'Write the global author name and email to the guest ~/.gitconfig. This does not authenticate GitHub or create a key.'\n          ),\n          option(\n            'no',\n            '--git-identity=no',\n            'Send no identity. Configure git user.name and user.email inside the ADE before committing.'\n          ),\n        ],\n      },\n      {\n        id: 'include',\n        current: saved ? saved.include.join(',') || 'none' : null,\n        question: 'Which optional settings and dotfiles should be copied to each new ADE home?',\n        found: FILE_GROUPS.map(\n          (group) =>\n            `${group}: ${groups[group].length ? groups[group].map((file) => `~/${file.source} → guest ~/${file.path} (${file.size} bytes)`).join('; ') : 'no eligible files found'}`\n        ),\n        recommendedDefault: 'none',\n        options: [\n          option('none', '--include=none', 'Copy no optional files; use the template defaults.'),\n          ...FILE_GROUPS.map((group) =>\n            option(\n              group,\n              `--include=${group}`,\n              `Copy ${group} files listed above (combine groups with commas). Review their contents locally first: they may contain secrets or machine-specific commands. Claude settings.env is removed; symlinks and hardlinks are excluded.`\n            )\n          ),\n        ],\n      },\n    ],\n    needsYou: [\n      ...(!github\n        ? [\n            {\n              id: 'github',\n              reason:\n                'Browser required only if you choose --github=token; otherwise sign in inside the ADE.',\n              command: '!gh auth login --hostname github.com --git-protocol https --web',\n            },\n          ]\n        : []),\n      ...(!claude\n        ? [\n            {\n              id: 'claude',\n              reason:\n                'Browser required only if you choose --claude=token. Run locally, then export the dedicated token as CLAUDE_CODE_OAUTH_TOKEN in the setup command’s environment. Keep the value out of chat and logs.',\n              command: '!claude setup-token',\n            },\n          ]\n        : []),\n    ],\n  };\n  return {\n    ...plan,\n    suggestedCommand: `cofactor dev setup --yes ${plan.decisions\n      .map((decision) => `--${decision.id}=${decision.current ?? decision.recommendedDefault}`)\n      .join(' ')}`,\n  };\n}\n\nfunction savedChoices(): SetupChoices | null {\n  const file = path.join(configDir(), 'setup-answers.json');\n  if (!existsSync(file)) return null;\n  const saved = readJson(file);\n  if (typeof saved !== 'object' || saved === null || Array.isArray(saved))\n    throw new Error('Invalid saved ADE choices; run `cofactor dev setup --plan`.');\n  const s = saved as Record<string, unknown>;\n  // The old wizard saved only booleans after consent. Its obsolete SSH field is intentionally ignored.\n  if (typeof s.github === 'boolean' && typeof s.claude === 'boolean') {\n    const oldGroups = {\n      claudeSettings: 'claude-settings',\n      claudeSkills: 'claude-skills',\n      claudeMemory: 'claude-memory',\n      codexConfig: 'codex-config',\n      shell: 'shell',\n    } as const;\n    return {\n      github: s.github ? 'token' : 'none',\n      claude: s.claude ? 'token' : 'in-box',\n      codexKey: s.codexKey === true,\n      gitIdentity: s.identity === true,\n      include: Object.entries(oldGroups).flatMap(([key, group]) =>\n        s[key] === true ? [group] : []\n      ),\n    };\n  }\n  if (\n    (s.github !== 'token' && s.github !== 'none') ||\n    (s.claude !== 'token' && s.claude !== 'in-box') ||\n    typeof s.codexKey !== 'boolean' ||\n    typeof s.gitIdentity !== 'boolean' ||\n    !Array.isArray(s.include) ||\n    !s.include.every(\n      (group): group is FileGroup =>\n        typeof group === 'string' && FILE_GROUPS.some((allowed) => allowed === group)\n    )\n  )\n    throw new Error('Invalid saved ADE choices; run `cofactor dev setup --plan`.');\n  return {\n    github: s.github,\n    claude: s.claude,\n    codexKey: s.codexKey,\n    gitIdentity: s.gitIdentity,\n    include: s.include,\n  };\n}\nasync function setupToken(): Promise<string | null> {\n  console.log(\n    'Creating a dedicated Claude token on this laptop. Complete the browser approval locally.'\n  );\n  return new Promise((resolve) => {\n    const child = spawn('claude', ['setup-token'], { stdio: ['inherit', 'pipe', 'pipe'] });\n    let token: string | null = null;\n    let pending = '';\n    let codePromptShown = false;\n    const codePrompt = () => {\n      if (!codePromptShown) {\n        console.log('Claude: paste the browser code in this local terminal, then press Enter.');\n        codePromptShown = true;\n      }\n    };\n    const line = (raw: string) => {\n      const text = stripVTControlCharacters(raw);\n      const found = text.match(/sk-ant-oat01-[A-Za-z0-9_-]+/);\n      if (found) {\n        token = found[0];\n        return;\n      }\n      // Do not mirror arbitrary provider output: the dedicated token must never reach logs.\n      if (text.includes('sk-ant-')) return;\n      const url = text.match(/https:\\/\\/[^\\s]+/);\n      if (url) console.log(url[0]);\n      else if (/paste.*code/i.test(text)) codePrompt();\n      else if (/browser|authorize/i.test(text))\n        console.log('Complete Claude authorization in the laptop browser.');\n    };\n    const read = (chunk: Buffer) => {\n      pending += chunk.toString();\n      const lines = pending.split(/\\r?\\n/);\n      pending = lines.pop() ?? '';\n      for (const value of lines) line(value);\n      if (/paste.*code.*>/i.test(stripVTControlCharacters(pending))) codePrompt();\n    };\n    child.stdout.on('data', read);\n    child.stderr.on('data', read);\n    child.on('error', () => resolve(null));\n    child.on('close', (code) => {\n      line(pending);\n      resolve(code === 0 ? token : null);\n    });\n  });\n}\n\n/** Explicit setup asks once; claims consume complete saved consent, including without a terminal. */\nexport async function prepareLaptopSetup(\n  options: { edit?: boolean; choices?: SetupChoices } = {}\n): Promise<LaptopSetup | null> {\n  let choices = options.choices ?? (!options.edit ? savedChoices() : null);\n  const interactive = !choices;\n  if (!choices) {\n    if (!process.stdin.isTTY || !process.stdout.isTTY) {\n      if (options.edit)\n        throw new Error(\n          'No terminal: run `cofactor dev setup --plan`, then `cofactor dev setup --yes` with every decision flag.'\n        );\n      console.log(\n        'ADE: no saved laptop choices; run `cofactor dev setup --plan` to prepare unattended. Attach will offer browser sign-in inside the ADE.'\n      );\n      return null;\n    }\n    const plan = inspectLaptopSetup({ name: 'claim', repos: [] });\n    const saved = savedChoices();\n    const answers: Record<string, boolean> = {};\n    for (const decision of plan.decisions.filter((d) => d.id !== 'include')) {\n      console.log(`\\n${decision.question}`);\n      for (const found of decision.found) console.log(`  ${found}`);\n      for (const option of decision.options) console.log(`  ${option.flag}: ${option.consequence}`);\n      const prior =\n        decision.id === 'github'\n          ? saved\n            ? saved.github === 'token'\n            : undefined\n          : decision.id === 'claude'\n            ? saved\n              ? saved.claude === 'token'\n              : undefined\n            : decision.id === 'codex-key'\n              ? saved?.codexKey\n              : saved?.gitIdentity;\n      answers[decision.id] = await ask(\n        `Choose ${decision.options[0]!.flag}?`,\n        prior ?? decision.recommendedDefault === decision.options[0]!.value\n      );\n    }\n    const include: FileGroup[] = [];\n    const files = plan.decisions.find((d) => d.id === 'include')!;\n    console.log(`\\n${files.question}`);\n    for (const group of FILE_GROUPS) {\n      console.log(`  ${files.found.find((found) => found.startsWith(`${group}:`))}`);\n      if (\n        await ask(\n          `${files.options.find((option) => option.value === group)!.consequence} Include ${group}?`,\n          saved?.include.includes(group) ?? false\n        )\n      )\n        include.push(group);\n    }\n    choices = {\n      github: answers.github ? 'token' : 'none',\n      claude: answers.claude ? 'token' : 'in-box',\n      codexKey: answers['codex-key']!,\n      gitIdentity: answers['git-identity']!,\n      include,\n    };\n  }\n  const result: LaptopSetup = { files: [], env: {}, githubToken: null, git: null };\n  if (choices.github === 'token') {\n    let status = capture('gh', ['auth', 'status', '--hostname', 'github.com']);\n    if (\n      interactive &&\n      status.status !== 0 &&\n      (await ask('Browser required: sign in to GitHub on this laptop now?', true))\n    )\n      status = spawnSync(\n        'gh',\n        ['auth', 'login', '--hostname', 'github.com', '--git-protocol', 'https', '--web'],\n        { encoding: 'utf8', stdio: 'inherit' }\n      );\n    const token =\n      status.status === 0 ? capture('gh', ['auth', 'token', '--hostname', 'github.com']) : null;\n    if (token?.status !== 0 || !token.stdout.trim())\n      throw new Error(\n        'GitHub token unavailable. Run `cofactor dev setup --plan` for the browser sign-in command or choose --github=none.'\n      );\n    result.githubToken = token.stdout.trim();\n  }\n  if (choices.claude === 'token') {\n    let token = claudeToken();\n    if (\n      !token &&\n      interactive &&\n      (await ask(\n        'Browser required: create and cache a dedicated Claude token on this laptop?',\n        true\n      ))\n    ) {\n      token = await setupToken();\n      if (token) privateJson(path.join(configDir(), 'claude-setup-token.json'), { token });\n    }\n    if (!token)\n      throw new Error(\n        'Claude dedicated token unavailable. Run `cofactor dev setup --plan` for browser approval instructions or choose --claude=in-box.'\n      );\n    result.env.CLAUDE_CODE_OAUTH_TOKEN = token;\n  }\n  if (choices.codexKey) {\n    if (!process.env.OPENAI_API_KEY)\n      throw new Error(\n        'OPENAI_API_KEY is missing. Run `cofactor dev setup --plan`, supply it privately in the environment or choose --codex-key=no.'\n      );\n    result.env.OPENAI_API_KEY = process.env.OPENAI_API_KEY;\n  }\n  if (choices.gitIdentity) {\n    result.git = gitIdentity();\n    if (!result.git)\n      throw new Error(\n        'Global git identity is incomplete. Run `cofactor dev setup --plan`, configure git user.name and user.email or choose --git-identity=no.'\n      );\n  }\n  const groups = fileGroups();\n  const selected = choices.include.flatMap((group) => groups[group]);\n  console.log('\\nTransfer preview (your own new session only; files mode 0600):');\n  if (result.githubToken)\n    console.log('  gh login → guest ~/.config/gh/hosts.yml (token hidden; HTTPS clone and push)');\n  if (result.git) console.log('  global git author → guest ~/.gitconfig');\n  for (const key of Object.keys(result.env))\n    console.log(`  ${key} → guest ~/.config/cofactor/ade-env.sh (value hidden)`);\n  for (const file of selected)\n    console.log(`  ~/${file.source} → guest ~/${file.path} (${file.size} bytes)`);\n  console.log('  Managed startup/browser helpers → guest ~/.local/share/cofactor/bin/ (0700)');\n  if (\n    interactive &&\n    !(await ask('Send these items to each new ADE session using these choices?', true))\n  )\n    return null;\n  for (const file of selected) {\n    let content = readFileSync(path.join(os.homedir(), file.source));\n    if (file.path === '.claude/settings.json') {\n      const settings = readJson(path.join(os.homedir(), file.source));\n      if (typeof settings !== 'object' || settings === null || Array.isArray(settings))\n        throw new Error('Claude settings must be a JSON object.');\n      const { env: _excluded, ...safe } = settings as Record<string, unknown>;\n      content = Buffer.from(JSON.stringify(safe));\n    }\n    result.files.push({ path: file.path, content: content.toString('base64') });\n  }\n  privateJson(path.join(configDir(), 'setup-answers.json'), choices);\n  return result;\n}\n","/**\n * Strict setup flags and the read-only plan presentation.\n * @module dev-setup\n * @see docs/ade/guidance.md\n */\nimport { GLOBAL_VALUE_FLAGS } from './auth.js';\nimport {\n  FILE_GROUPS,\n  inspectLaptopSetup,\n  prepareLaptopSetup,\n  type SetupChoices,\n  type SetupPlan,\n} from './dev-home.js';\n\nexport function parseSetupArgs(argv: string[]): {\n  plan: boolean;\n  json: boolean;\n  choices?: SetupChoices;\n} {\n  const values = new Map<string, string>();\n  const switches = new Set<string>();\n  const decisionFlags = ['--github', '--claude', '--codex-key', '--git-identity', '--include'];\n  function invalid(reason: string): never {\n    throw new Error(\n      `${reason} Run \\`cofactor dev setup --plan\\` to review decisions and exact flags.`\n    );\n  }\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i]!;\n    const equals = arg.indexOf('=');\n    const flag = equals === -1 ? arg : arg.slice(0, equals);\n    if (['--plan', '--json', '--yes'].includes(flag)) {\n      if (equals !== -1 || switches.has(flag)) invalid('Invalid or duplicate setup switch.');\n      switches.add(flag);\n    } else if ([...GLOBAL_VALUE_FLAGS, '--template', ...decisionFlags].includes(flag)) {\n      if (values.has(flag)) invalid('Duplicate setup flag.');\n      const value = equals === -1 ? argv[++i] : arg.slice(equals + 1);\n      if (!value || value.startsWith('--')) invalid('A setup flag requires a value.');\n      values.set(flag, value);\n    } else invalid('Unknown setup option.');\n  }\n  const plan = switches.has('--plan');\n  const yes = switches.has('--yes');\n  if (plan && (yes || decisionFlags.some((flag) => values.has(flag))))\n    invalid('--plan cannot apply decisions.');\n  if (switches.has('--json') && !plan) invalid('--json requires --plan.');\n  if (!yes && decisionFlags.some((flag) => values.has(flag)))\n    invalid('Decision flags require --yes.');\n  if (!yes) return { plan, json: switches.has('--json') };\n  for (const flag of decisionFlags)\n    if (!values.has(flag)) invalid(`Missing required decision ${flag}.`);\n  const github = values.get('--github');\n  const claude = values.get('--claude');\n  const codexKey = values.get('--codex-key');\n  const identity = values.get('--git-identity');\n  if (github !== 'token' && github !== 'none') invalid('--github accepts token or none.');\n  if (claude !== 'token' && claude !== 'in-box') invalid('--claude accepts token or in-box.');\n  if (codexKey !== 'yes' && codexKey !== 'no') invalid('--codex-key accepts yes or no.');\n  if (identity !== 'yes' && identity !== 'no') invalid('--git-identity accepts yes or no.');\n  const include = values.get('--include') === 'none' ? [] : values.get('--include')!.split(',');\n  if (\n    !include.every((group): group is (typeof FILE_GROUPS)[number] =>\n      FILE_GROUPS.some((allowed) => group === allowed)\n    ) ||\n    new Set(include).size !== include.length\n  )\n    invalid(`--include accepts none or a comma-separated list of ${FILE_GROUPS.join(', ')}.`);\n  return {\n    plan,\n    json: false,\n    choices: {\n      github,\n      claude,\n      codexKey: codexKey === 'yes',\n      gitIdentity: identity === 'yes',\n      include,\n    },\n  };\n}\n\nexport async function runLaptopSetup(\n  args: ReturnType<typeof parseSetupArgs>,\n  template: SetupPlan['template']\n): Promise<void> {\n  if (args.plan) {\n    const plan = inspectLaptopSetup(template);\n    if (args.json) console.log(JSON.stringify(plan, null, 2));\n    else {\n      console.log(\n        `ADE setup plan for ${template.name} (read-only; no files sent or choices saved).`\n      );\n      console.log(`Repositories: ${template.repos.join(', ')} (HTTPS via GitHub login)`);\n      for (const decision of plan.decisions) {\n        console.log(`\\n${decision.question} [${decision.id}]`);\n        for (const found of decision.found) console.log(`  Found: ${found}`);\n        console.log(`  Current: ${decision.current ?? 'no saved choice'}`);\n        console.log(`  Recommended: ${decision.recommendedDefault}`);\n        for (const option of decision.options)\n          console.log(`  ${option.flag}: ${option.consequence}`);\n      }\n      for (const step of plan.needsYou)\n        console.log(`\\nNeeds you (${step.id}): ${step.reason}\\n  ${step.command}`);\n      console.log(\n        `\\nSuggested command (saved choices when present, otherwise recommended defaults):\\n  ${plan.suggestedCommand}\\nAsk the user to review and edit the choices before applying. Keep the same org, environment and template selectors. Read \\`cofactor dev guide\\` for the agent procedure.`\n      );\n    }\n    return;\n  }\n  const setup = await prepareLaptopSetup({ edit: true, choices: args.choices });\n  console.log(\n    setup\n      ? 'ADE laptop setup choices saved for new homes; subsequent claims use them without prompts. Prepared homes reuse their saved files.'\n      : 'ADE setup cancelled; choices were not saved.'\n  );\n}\n","/** Direct, owner-home-only transfer. No credential enters a Cofactor API request. */\nimport { spawnSync } from 'node:child_process';\nimport { ADE_START_SCRIPT, ADE_SYNC_SCRIPT } from '@chatsdet/sandbox-helper/ade-scripts';\nimport { ADE_OPEN_SCRIPT } from '@chatsdet/sandbox-helper/ade-open';\nimport type { LaptopSetup } from './dev-home.js';\n\n// This program runs as the SSH user. Payload bytes stay on stdin, never argv or logs.\nconst RECEIVE = String.raw`\nconst fs = require('node:fs'), path = require('node:path'), os = require('node:os');\nlet input;\ntry { input = JSON.parse(fs.readFileSync(0, 'utf8')); } catch { console.error('ADE: invalid setup payload'); process.exit(1); }\nprocess.umask(0o077);\nconst home = os.homedir();\nfunction write(relative, bytes, mode = 0o600) {\n  if (typeof relative !== 'string' || relative.startsWith('/') || relative.split('/')[0] === '.ssh' || relative.split('/').some(x => !x || x === '.' || x === '..')) throw Error('invalid home destination');\n  let current = home;\n  for (const part of relative.split('/')) {\n    current = path.join(current, part);\n    if (fs.lstatSync(current, { throwIfNoEntry: false })?.isSymbolicLink()) throw Error('refusing a symlink destination');\n  }\n  fs.mkdirSync(path.dirname(current), { recursive: true, mode: 0o700 });\n  const temp = current + '.ade-' + process.pid;\n  fs.writeFileSync(temp, bytes, { flag: 'wx', mode });\n  fs.renameSync(temp, current);\n}\ntry {\n  for (const file of input.files) write(file.path, Buffer.from(file.content, 'base64'));\n  if (input.githubToken) write('.config/gh/hosts.yml', JSON.stringify({ 'github.com': { oauth_token: input.githubToken, git_protocol: 'https' } }));\n  const allowed = ['CLAUDE_CODE_OAUTH_TOKEN', 'OPENAI_API_KEY'];\n  const quote = value => \"'\" + value.replaceAll(\"'\", \"'\\\\''\") + \"'\";\n  const env = Object.entries(input.env).map(([key, value]) => {\n    if (!allowed.includes(key) || typeof value !== 'string') throw Error('invalid credential environment');\n    return 'export ' + key + '=' + quote(value);\n  });\n  env.push('export PATH=\"$HOME/.local/share/cofactor/bin:$PATH\"', 'export BROWSER=\"$HOME/.local/share/cofactor/bin/ade-open\"', 'export GH_BROWSER=\"$BROWSER\"');\n  write('.config/cofactor/ade-env.sh', env.join('\\n') + '\\n');\n  write('.local/share/cofactor/bin/ade-open', input.browser, 0o700);\n  write('.local/share/cofactor/bin/ade-start', input.start, 0o700);\n  write('.local/share/cofactor/bin/ade-sync-repos', input.sync, 0o700);\n  if (input.git) {\n    const gitConfig = path.join(home, '.gitconfig');\n    if (fs.lstatSync(gitConfig, { throwIfNoEntry: false })?.isSymbolicLink()) throw Error('refusing a symlink git config');\n    const cp = require('node:child_process');\n    for (const [key, value] of Object.entries(input.git)) {\n      if (!['name', 'email'].includes(key) || typeof value !== 'string') throw Error('invalid git identity');\n      const result = cp.spawnSync('git', ['config', '--global', 'user.' + key, value]);\n      if (result.status !== 0) throw Error('could not set git identity');\n    }\n  }\n  if (input.git) fs.chmodSync(path.join(home, '.gitconfig'), 0o600);\n  if (input.env.CLAUDE_CODE_OAUTH_TOKEN) {\n    const file = path.join(home, '.claude.json');\n    if (fs.lstatSync(file, { throwIfNoEntry: false })?.isSymbolicLink()) throw Error('refusing a symlink Claude config');\n    const config = fs.existsSync(file) ? JSON.parse(fs.readFileSync(file, 'utf8')) : {};\n    write('.claude.json', JSON.stringify({ ...config, hasCompletedOnboarding: true }));\n  }\n  console.log('ADE: selected laptop files delivered privately.');\n} catch { console.error('ADE: setup transfer failed; check the selected paths and permissions.'); process.exit(1); }\n`;\nconst quote = (value: string) => `'${value.replaceAll(\"'\", `'\\\\''`)}'`;\n\n/** New claims only: no existing working agent is replaced by `dev attach`. */\nexport function deliverLaptopSetup(alias: string, setup: LaptopSetup): boolean {\n  const stop = spawnSync('ssh', ['-T', alias, 'tmux kill-session -t ade 2>/dev/null || true'], {\n    stdio: ['ignore', 'ignore', 'inherit'],\n  });\n  if (stop.status !== 0)\n    throw new Error('Could not prepare the new ADE terminal for laptop setup.');\n  const received = spawnSync('ssh', ['-T', alias, `node -e ${quote(RECEIVE)}`], {\n    input: JSON.stringify({\n      ...setup,\n      browser: ADE_OPEN_SCRIPT,\n      start: ADE_START_SCRIPT,\n      sync: ADE_SYNC_SCRIPT,\n    }),\n    stdio: ['pipe', 'inherit', 'inherit'],\n  });\n  if (received.status !== 0)\n    console.error(\n      'ADE: laptop delivery is incomplete; continuing with browser-forwarded setup in the box.'\n    );\n  return received.status === 0;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AACA,SAAS,cAAc,eAAe,YAAY,gBAAgB;AA4BlE,eAAsB,eAAe,MAA+B;AAClE,QAAM,eAAe,QAAQ,IAAI;AACjC,QAAM,UAAU,YAAY,MAAM,eAAe,GAC/C,MAAM,YAAY,MAAM,OAAO;AACjC,MACE,QAAQ,IAAI,iBAAiB,SAC7B,iBAAiB,wCACjB,CAAC,WACD,CAAC;AAED,UAAM,IAAI,MAAM,mEAAmE;AACrF,OAAK,SAAS,YAAY,EAAE,OAAO,QAAW;AAC5C,UAAM,IAAI,MAAM,0CAA0C;AAC5D,QAAM,WAAqB,KAAK,MAAM,aAAa,cAAc,MAAM,CAAC;AACxE,MAAI,SAAS,YAAY,KAAK,SAAS,UAAU,UAAU;AACzD,UAAM,IAAI,MAAM,oCAAoC;AACtD,QAAM,QAAQ,SAAS,OAAO;AAAA,IAC5B,CAAC,SAAS,KAAK,aAAa,SAAS,KAAK,OAAO,YAAY;AAAA,EAC/D;AACA,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,mEAAmE;AAC/F,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,cAAc,IAAI;AAClD,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqB,mBAAmB,SAAS,UAAU,EAAE,CAAC;AAAA,IAC9D,EAAE,SAAS,MAAM,QAAQ;AAAA,EAC3B;AACA,QAAM,SAAS,OAAO,KAAK,UAAU;AACrC,MAAI,OAAO,MAAM,OAAO,MAAM;AAC5B,UAAM,YAAY,OAAO,KAAK;AAC9B,WAAO,MAAM;AAAA,EACf,OAAO;AACL,UAAM,SAAS;AACf,WAAO,MAAM;AAAA,EACf;AACA,QAAM,OAAO,GAAG,YAAY,IAAI,QAAQ,GAAG;AAC3C,gBAAc,MAAM,KAAK,UAAU,QAAQ,GAAG,EAAE,MAAM,KAAO,MAAM,KAAK,CAAC;AACzE,aAAW,MAAM,YAAY;AAC7B,MAAI,CAAC,OAAO,MAAM,CAAC,OAAO;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACF,iBAAe,KAAK,UAAU,OAAO,IAAI,CAAC;AAC5C;AAGA,eAAsB,mBAAmB,MAA+B;AACtE,QAAM,MAAM,YAAY,MAAM,OAAO,GACnC,aAAa,YAAY,MAAM,UAAU,GACzC,eAAe,YAAY,MAAM,cAAc;AACjD,MAAI,CAAC,OAAO,CAAC,cAAc,CAAC;AAC1B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AACF,QAAM,OAAgB,KAAK,MAAM,aAAa,YAAY,MAAM,CAAC;AACjE,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI;AACzD,UAAM,IAAI,MAAM,6CAA6C;AAC/D,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,cAAc,IAAI;AAClD,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA,yBAAyB,mBAAmB,YAAY,CAAC;AAAA,IACzD;AAAA,EACF;AACA,MAAI,CAAC,OAAO,GAAI,OAAM,IAAI,MAAM,OAAO,SAAS,gCAAgC;AAChF,iBAAe,KAAK,UAAU,OAAO,IAAI,CAAC;AAC5C;;;ACjFA,SAAS,oBAAoB;AAC7B,OAAOA,WAAU;AACjB,OAAOC,cAAa;AACpB,SAAS,4BAAAC,iCAAgC;;;ACLzC,SAAS,OAAO,iBAAiB;AACjC,SAAS,SAAS;AAGX,IAAM,oBAAoB;AAsDjC,IAAM,MAAM;AAEZ,IAAM,qBAAqB,KAAK;AAEhC,IAAM,sBAAsB,KAAK;AAGjC,IAAM,OAAO;AAEb,IAAM,cAAc;AAGpB,IAAM,WAAW,EACd,OAAO,EACP,IAAI,CAAC,EACL;AAAA,EACC,CAAC,UACC,CAAC,MAAM,WAAW,GAAG,KACrB,MAAM,MAAM,GAAG,EAAE,MAAM,CAAC,YAAY,YAAY,MAAM,YAAY,OAAO,YAAY,IAAI;AAAA,EAC3F;AACF;AAEF,IAAM,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC;AAEvC,IAAM,aAAa,EAAE,aAAa;AAAA,EAChC,QAAQ,EACL,OAAO,EACP,MAAM,aAAa,kCAAkC,EACrD;AAAA,IACC,CAAC,UAAU,MAAM,MAAM,GAAG,EAAE,MAAM,CAAC,YAAY,YAAY,OAAO,YAAY,IAAI;AAAA,IAClF;AAAA,EACF;AAAA,EACF,SAAS,EAAE,MAAM,OAAO;AAC1B,CAAC;AAED,IAAM,cAAc,EAAE,aAAa;AAAA,EACjC,SAAS;AAAA,EACT,KAAK;AAAA;AAAA,EAEL,MAAM,QAAQ,SAAS;AAAA;AAAA,EAEvB,MAAM,EAAE,aAAa,EAAE,QAAQ,SAAS,OAAO,QAAQ,CAAC,EAAE,SAAS;AACrE,CAAC;AAoBD,IAAM,gBAAgB,EAAE,OAAO,IAAI,YAAY,MAAM;AAErD,IAAM,eAAe,uDAAuD,cAAc,KAAK,WAAW,cAAc,UAAU;AAElI,IAAM,YAAY,EACf,OAAO,EACP,IAAI,EACJ,IAAI,IAAI,EACR,IAAI,cAAc,YAAY,WAAW,cAAc,UAAU,KAAK,YAAY,EAAE,EACpF,OAAO,CAAC,UAAU,QAAQ,QAAQ,GAAG,2BAA2B;AAMnE,IAAM,oBAAoB,EAAE,aAAa;AAAA,EACvC,SAAS,EAAE,QAAQ,CAAC;AAAA,EACpB,MAAM,EACH,OAAO,EACP,MAAM,MAAM,8EAA8E;AAAA,EAC7F,WAAW,EAAE,aAAa;AAAA,IACxB,OAAO,EACJ,OAAO,EACP,IAAI,EACJ,IAAI,CAAC,EACL,IAAI,cAAc,OAAO,WAAW,cAAc,KAAK,KAAK,YAAY,EAAE;AAAA,IAC7E,YAAY;AAAA,IACZ,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC3C,CAAC;AAAA;AAAA,EAED,OAAO,EAAE,MAAM,OAAO,EAAE,SAAS;AAAA,EACjC,OAAO,EACJ,MAAM,UAAU,EAChB,IAAI,CAAC,EACL,YAAY,CAAC,OAAO,QAAQ;AAC3B,UAAM,OAAO,oBAAI,IAAY;AAC7B,UAAM,QAAQ,CAAC,MAAM,UAAU;AAC7B,YAAM,OAAO,KAAK,OAAO,MAAM,GAAG,EAAE,CAAC,KAAK;AAC1C,UAAI,KAAK,IAAI,IAAI,GAAG;AAClB,YAAI,SAAS;AAAA,UACX,MAAM;AAAA,UACN,MAAM,CAAC,OAAO,QAAQ;AAAA,UACtB,SAAS,8BAA8B,IAAI,8BAA8B,IAAI;AAAA,QAC/E,CAAC;AAAA,MACH;AACA,WAAK,IAAI,IAAI;AAAA,IACf,CAAC;AAAA,EACH,CAAC;AAAA,EACH,QAAQ,EACL;AAAA,IACC,EAAE,OAAO,EAAE,MAAM,MAAM,qDAAqD;AAAA,IAC5E;AAAA,EACF,EACC,OAAO,CAAC,WAAW,OAAO,KAAK,MAAM,EAAE,SAAS,GAAG,yBAAyB;AAAA,EAC/E,cAAc;AAAA,EACd,UAAU;AACZ,CAAC;AAMM,SAAS,oBAAoB,UAGlC;AACA,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,QAAQ;AAAA,EACtB,SAAS,OAAO;AACd,WAAO;AAAA,MACL,QAAQ;AAAA,QACN;AAAA,UACE,MAAM;AAAA,UACN,SAAS,iBAAiB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,QAClF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAS,kBAAkB,UAAU,GAAG;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO;AAAA,MACL,QAAQ,OAAO,MAAM,OAAO,IAAI,CAAC,WAAW;AAAA,QAC1C,MAAM,MAAM,KAAK,IAAI,MAAM,EAAE,KAAK,GAAG,KAAK;AAAA,QAC1C,SAAS,MAAM;AAAA,MACjB,EAAE;AAAA,IACJ;AAAA,EACF;AACA,SAAO,EAAE,UAAU,OAAO,MAAM,QAAQ,CAAC,EAAE;AAC7C;;;AC/MA,SAAS,kBAAkB;AAC3B,SAAS,SAAAC,QAAO,aAAAC,kBAAiB;AACjC,SAAS,YAAY,WAAW,WAAW,gBAAAC,eAAc,cAAc,cAAAC,aAAY,iBAAAC,sBAAqB;AACxG,OAAO,QAAQ;AACf,OAAO,UAAU;AACjB,OAAOC,cAAa;AACpB,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,cAAc,aAAa;;;ACTpC,SAAS,YAAY,uBAAuB;AAKrC,IAAM,sBAAsB;;;AClBnC,SAAS,OAAO,iBAAiB;;;ACDjC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACIO,IAAM,mBAAmB;AACzB,IAAM,kBAAkB;;;ACJxB,IAAM,kBAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;AJG/B,SAAS,uBAAuB;AAEhC,SAAS,gBAAgB,OAAwB;AAC/C,MAAI,+BAA+B,KAAK,KAAK,EAAG,QAAO;AACvD,MAAI;AACF,UAAM,MAAM,IAAI,IAAI,KAAK;AACzB,WAAO,IAAI,aAAa,YAAY,CAAC,IAAI,YAAY,CAAC,IAAI;AAAA,EAC5D,QAAQ;AAAE,WAAO;AAAA,EAAO;AAC1B;AAEO,SAAS,uBAAuB,OAAqB;AAE1D,QAAM,YAAY,UAAU,OAAO,CAAC,MAAM,OAAO,imBAAimB,GAAG,EAAE,OAAO,KAAK,UAAU,EAAE,YAAY,iBAAiB,aAAa,kBAAkB,kBAAkB,gBAAgB,CAAC,GAAG,OAAO,CAAC,QAAQ,UAAU,QAAQ,EAAE,CAAC;AACtzB,MAAI,UAAU,WAAW,EAAG,OAAM,IAAI,MAAM,gGAAgG;AAC9I;AAEO,SAAS,qBAAqB,OAA2B;AAC9D,QAAM,UAAU,MAAM,OAAO,CAAC,MAAM,OAAO,+FAA+F,GAAG,EAAE,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC;AACpL,MAAI,UAAU;AACd,QAAM,QAAQ,gBAAgB,EAAE,OAAO,QAAQ,OAAO,CAAC;AACvD,QAAM,SAAS,oBAAI,IAAY;AAC/B,QAAM,GAAG,QAAQ,CAAC,SAAS;AACzB,QAAI,CAAC,gBAAgB,IAAI,KAAK,OAAO,IAAI,IAAI,EAAG;AAChD,WAAO,IAAI,IAAI;AACf,UAAM,SAAS,MAAM,QAAQ,aAAa,WAAW,SAAS,YAAY,CAAC,IAAI,GAAG,EAAE,OAAO,SAAS,CAAC;AACrG,WAAO,GAAG,SAAS,MAAM,QAAQ,MAAM,qFAAqF,CAAC;AAC7H,WAAO,GAAG,SAAS,CAAC,SAAS;AAAE,UAAI,SAAS,QAAQ,SAAS,EAAG,SAAQ,MAAM,4EAA4E;AAAA,IAAG,CAAC;AAAA,EAChK,CAAC;AACD,UAAQ,GAAG,SAAS,MAAM,QAAQ,MAAM,mFAAmF,CAAC;AAC5H,UAAQ,GAAG,QAAQ,MAAM;AAAE,QAAI,CAAC,QAAS,SAAQ,MAAM,6EAA6E;AAAA,EAAG,CAAC;AACxI,SAAO,MAAM;AAAE,cAAU;AAAM,UAAM,MAAM;AAAG,YAAQ,KAAK,SAAS;AAAA,EAAG;AACzE;;;AFLA,IAAM,SAAS,MAAM,KAAK,KAAK,GAAG,QAAQ,GAAG,WAAW,YAAY,KAAK;AACzE,IAAM,UAAU,MAAM,KAAK,KAAK,OAAO,GAAG,YAAY;AACtD,IAAM,iBAAiB,MAAM,KAAK,KAAK,OAAO,GAAG,aAAa;AAC9D,IAAM,aAAa,MAAM,KAAK,KAAK,OAAO,GAAG,aAAa;AAC1D,IAAM,eAAe,MAAM,KAAK,KAAK,GAAG,QAAQ,GAAG,QAAQ,UAAU;AACrE,IAAM,gBAAgB,MAAM,KAAK,KAAK,aAAa,GAAG,cAAc;AAGpE,IAAM,oBAAoB;AAE1B,IAAM,iBAAiB;AAEvB,IAAM,oBAA4C;AAAA,EAChD,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AAAA,EACN,MAAM;AACR;AAGA,IAAM,qBAAqB,OAAO;AAMlC,IAAM,mBAAN,cAA+B,MAAM;AAAA,EACnC,YAAY,SAA0B,WAAoB;AAAE,UAAM,OAAO;AAAnC;AAAA,EAAsC;AAAA,EAAtC;AACxC;AAGA,eAAe,iBAAoB,QAAgB,OAAe,OAAe,QAAgB,MAAqC,QAAiC;AACrK,QAAM,SAAS,MAAM,SAAS,GAAG,MAAM,qBAAqB,KAAK,IAAI;AAAA,IACnE;AAAA,IAAQ;AAAA,IAAO;AAAA,IAAQ,WAAW;AAAA,IAClC,SAAS,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,oBAAoB,cAAc,eAAe;AAAA,IAC9G,GAAI,OAAO,EAAE,MAAM,KAAK,UAAU,IAAI,EAAE,IAAI,CAAC;AAAA,EAC/C,CAAC;AACD,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO;AACvB,UAAM,IAAI,iBAAiB,QAAQ,SAAS,QAAQ,SAAS,aAAc,QAAQ,SAAS,iBAAiB,QAAQ,WAAW,OAAQ,QAAQ,WAAW,QAAQ,QAAQ,UAAU,IAAM;AAAA,EAC7L;AACA,SAAO,MAAM,OAAO,SAAS,KAAK;AACpC;AAGA,IAAM,aAAa;AAEnB,IAAM,aAAa,CAAC,UAAkB,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAGjE,SAAS,aAAa,WAA2B;AACtD,QAAM,QAAQ,WAAW,KAAK,SAAS;AACvC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,0BAA0B,KAAK,UAAU,SAAS,CAAC,EAAE;AACjF,SAAO,OAAO,MAAM,CAAC,CAAC;AACxB;AAMO,SAAS,gBAAgB,KAAsB;AACpD,MAAI;AACF,UAAM,SAAS,IAAI,IAAI,GAAG;AAC1B,WAAO,OAAO,aAAa,UAAW,OAAO,aAAa,SAAS,CAAC,aAAa,aAAa,OAAO,EAAE,SAAS,OAAO,QAAQ;AAAA,EACjI,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,YAAY,MAAc,SAAiB,MAAoB;AACtE,QAAM,OAAO,GAAG,IAAI,IAAIC,SAAQ,GAAG;AACnC,EAAAC,eAAc,MAAM,SAAS,EAAE,KAAK,CAAC;AACrC,EAAAC,YAAW,MAAM,IAAI;AACvB;AAGO,SAAS,mBAA2B;AACzC,YAAU,OAAO,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACpD,MAAI,CAAC,WAAW,QAAQ,CAAC,GAAG;AAE1B,UAAM,OAAOC,WAAU,cAAc,CAAC,MAAM,MAAM,WAAW,MAAM,IAAI,MAAM,gBAAgB,GAAG,SAAS,CAAC,IAAI,MAAM,QAAQ,CAAC,GAAG;AAAA,MAC9H,OAAO,CAAC,UAAU,UAAU,SAAS;AAAA,IACvC,CAAC;AACD,QAAI,KAAK,SAAS,KAAK,WAAW,EAAG,OAAM,IAAI,MAAM,yDAAyD;AAAA,EAChH;AACA,SAAOC,cAAa,GAAG,QAAQ,CAAC,QAAQ,MAAM,EAAE,KAAK;AACvD;AAEA,SAAS,aAAoC;AAC3C,MAAI;AACF,WAAO,KAAK,MAAMA,cAAa,WAAW,GAAG,MAAM,CAAC;AAAA,EACtD,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAGO,SAAS,aAAa,UAAkB,OAAe,OAAe,OAA0C;AACrH,QAAM,OAAO,SAAS,MAAM,IAAI,EAAE,OAAO,CAAC,SAAS,KAAK,KAAK,MAAM,MAAM,CAAC,MAAM,IAAI,CAAC;AACrF,SAAO,CAAC,GAAG,MAAM,KAAK,EAAE,KAAK,IAAI,IAAI;AACvC;AAGO,SAAS,eAAe,OAAe,WAAmB,MAAcC,UAA2B;AACxG,eAAa,SAAS;AAEtB,MAAIA,SAAQ,KAAK,CAAC,QAAQ,SAAS,KAAK,GAAG,CAAC,EAAG,OAAM,IAAI,MAAM,kEAAkE;AACjI,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb,cAAc,KAAK;AAAA,IACnB,UAAU,IAAI;AAAA,IACd,mBAAmB,QAAQ,CAAC;AAAA,IAC5B;AAAA,IACA,yBAAyB,eAAe,CAAC;AAAA,IACzC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA;AAAA,IAEA,qCAAqC,CAAC,WAAW,GAAGA,QAAO,EAAE,IAAI,UAAU,EAAE,KAAK,GAAG,EAAE,WAAW,KAAK,IAAI,CAAC;AAAA,EAC9G,EAAE,KAAK,IAAI;AACb;AAGA,SAAS,mBAAyB;AAGhC,QAAM,OAAO,KAAK,KAAK,GAAG,QAAQ,GAAG,QAAQ,QAAQ;AACrD,QAAM,SAAS,UAAU,MAAM,EAAE,gBAAgB,MAAM,CAAC,GAAG,eAAe,KAAK;AAC/E,QAAM,SAAS,SAAS,KAAK,QAAQ,KAAK,QAAQ,IAAI,GAAG,aAAa,IAAI,CAAC,IAAI;AAC/E,YAAU,aAAa,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAC1D,QAAM,WAAW,WAAW,MAAM,IAAID,cAAa,QAAQ,MAAM,IAAI;AACrE,MAAI,mCAAmC,KAAK,QAAQ,EAAG;AACvD,MAAI;AACF,gBAAY,QAAQ;AAAA;AAAA,EAAyB,QAAQ,IAAI,GAAK;AAAA,EAChE,SAAS,OAAO;AAEd,UAAM,IAAI,MAAM,2CAA2C,MAAM,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,2CAA2C;AAAA,EACzK;AACF;AAMA,eAAsB,kBAAkB,QAAgB,OAAe,WAAmBC,UAAmB,QAAuC;AAClJ,QAAM,YAAY,iBAAiB;AACnC,QAAM,SAAS,MAAM,iBAAgC,QAAQ,OAAO,GAAG,mBAAmB,SAAS,CAAC,cAAc,QAAQ,EAAE,UAAU,GAAG,UAAU,IAAI,gBAAgB,EAAE,MAAM;AAC/K,MAAI,CAAC,OAAO,MAAM,CAAC,OAAO,KAAM,OAAM,IAAI,MAAM,OAAO,SAAS,sBAAsB;AACtF,QAAM,EAAE,MAAM,SAAS,UAAU,IAAI,OAAO;AAC5C,MAAI,CAAC,yCAAyC,KAAK,OAAO,EAAG,OAAM,IAAI,MAAM,yCAAyC;AACtH,MAAI,CAAC,2BAA2B,KAAK,IAAI,EAAG,OAAM,IAAI,MAAM,2CAA2C;AACvG,QAAM,QAAQ,aAAa,SAAS;AAEpC,QAAM,QAAQ,WAAW,eAAe,CAAC,IAAID,cAAa,eAAe,GAAG,MAAM,IAAI;AACtF,QAAM,SAAS,QAAQ,MAAM,GAAG,EAAE,MAAM,GAAG,CAAC,EAAE,KAAK,GAAG;AACtD,cAAY,eAAe,GAAG,aAAa,OAAO,OAAO,GAAG,KAAK,IAAI,MAAM,IAAI,CAAC,SAAS,KAAK,WAAW,GAAG,KAAK,GAAG,CAAC,GAAG,GAAK;AAE7H,mBAAiB;AACjB,QAAM,SAAS,WAAW,cAAc,CAAC,IAAIA,cAAa,cAAc,GAAG,MAAM,IAAI;AACrF,QAAM,SAAS,OAAO,MAAM,aAAa,EAAE,OAAO,CAAC,UAAU,MAAM,KAAK,MAAM,MAAM,CAAC,MAAM,WAAW,QAAQ,KAAK;AAAA,CAAI,CAAC;AACxH,cAAY,cAAc,GAAG,CAAC,GAAG,OAAO,IAAI,CAAC,UAAU,MAAM,QAAQ,CAAC,GAAG,eAAe,OAAO,WAAW,MAAMC,QAAO,CAAC,EAAE,KAAK,MAAM,IAAI,MAAM,GAAK;AAEpJ,cAAY,WAAW,GAAG,KAAK,UAAU,EAAE,GAAG,WAAW,GAAG,CAAC,SAAS,GAAG,EAAE,MAAM,SAAS,QAAQ,UAAU,EAAE,GAAG,MAAM,CAAC,GAAG,GAAK;AAChI,SAAO;AACT;AAGA,SAAS,gBAAgB,OAAuB;AAC9C,QAAM,OAAOL,SAAQ,IAAI;AACzB,QAAM,WAAW;AAEjB,MAAI,CAAC,QAAQ,CAAC,gCAAgC,KAAK,IAAI,EAAG,QAAO;AACjE,QAAM,OAAO,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAC3D,QAAM,SAAS,KAAK,KAAK,OAAO,GAAG,YAAY,KAAK,IAAI,IAAI,EAAE;AAC9D,MAAI,WAAW,MAAM,EAAG,QAAO;AAC/B,QAAM,QAAQG,WAAU,WAAW,CAAC,MAAM,IAAI,GAAG,EAAE,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAC1G,MAAI,CAAC,MAAM,SAAS,MAAM,WAAW,GAAG;AACtC,UAAM,UAAUA,WAAU,OAAO,CAAC,MAAM,OAAO;AAAA,MAC7C,iBAAiB,WAAW,IAAI,CAAC;AAAA,MACjC;AAAA,IACF,EAAE,KAAK,IAAI,CAAC,GAAG,EAAE,OAAO,MAAM,QAAQ,OAAO,CAAC,QAAQ,UAAU,SAAS,EAAE,CAAC;AAC5E,QAAI,CAAC,QAAQ,SAAS,QAAQ,WAAW,GAAG;AAC1C,gBAAU,OAAO,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACpD,kBAAY,QAAQ,MAAM,GAAK;AAC/B,aAAO;AAAA,IACT;AAAA,EACF;AACA,UAAQ,MAAM,6EAA6E;AAC3F,SAAO;AACT;AAGA,eAAe,UAAU,OAAe,MAAc,WAAuB,QAAqB,UAA0C;AAC1I,QAAM,cAAc,qBAAqB,KAAK;AAE9C,QAAM,QAAQ,YAAY,WAAW,+RAA+R,CAAC;AACrU,QAAM,MAAMG,OAAM,OAAO,CAAC,MAAM,yBAAyB,MAAM,yBAAyB,MAAM,qBAAqB,MAAM,iBAAiB,MAAM,0BAA0B,MAAM,mDAAmD,OAAO,OAAO,gFAAgF,WAAW,KAAK,CAAC,EAAE,GAAG;AAAA,IACrV,OAAO,CAAC,WAAW,WAAW,MAAM;AAAA,IAAG,KAAK,EAAE,GAAGN,SAAQ,KAAK,MAAM,KAAK;AAAA,EAC3E,CAAC;AACD,MAAI,UAAU;AACd,QAAM,YAAY,MAAM;AAAE,gBAAY;AAAG,QAAI,KAAK,SAAS;AAAA,EAAG;AAC9D,QAAM,UAAU,aAAa,OAAO,OAAO,WAAW,WAAW,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC;AACnG,SAAO,iBAAiB,SAAS,WAAW,EAAE,MAAM,KAAK,CAAC;AAC1D,QAAM,cAAcO,iBAAgB,EAAE,OAAO,IAAI,OAAO,CAAC;AACzD,cAAY,GAAG,QAAQ,CAAC,SAAS;AAE/B,QAAI,KAAK,KAAK,MAAM,sBAAsB;AAAE,UAAI,QAAS,cAAa,OAAO;AAAG,gBAAU;AAAG;AAAA,IAAQ;AACrG,YAAQ,MAAM,IAAI;AAElB,gBAAY,kNAAkN,KAAK,IAAI;AAAA,EACzO,CAAC;AACD,SAAO,IAAI,QAAgB,CAAC,SAAS,WAAW;AAC9C,UAAM,UAAU,MAAM;AACpB,UAAI,QAAS,cAAa,OAAO;AACjC,aAAO,oBAAoB,SAAS,SAAS;AAC7C,kBAAY,MAAM;AAClB,MAAAP,SAAQ,IAAI,WAAW,SAAS;AAChC,MAAAA,SAAQ,IAAI,UAAU,SAAS;AAC/B,kBAAY;AAAA,IACd;AACA,IAAAA,SAAQ,KAAK,WAAW,SAAS;AACjC,IAAAA,SAAQ,KAAK,UAAU,SAAS;AAChC,QAAI,GAAG,SAAS,MAAM;AAAE,cAAQ;AAAG,aAAO,IAAI,MAAM,qBAAqB,CAAC;AAAA,IAAG,CAAC;AAC9E,QAAI,GAAG,SAAS,CAAC,SAAS;AAAE,cAAQ;AAAG,cAAQ,UAAU,IAAK,SAAS,OAAO,UAAU,MAAM,IAAK;AAAA,IAAG,CAAC;AAAA,EACzG,CAAC;AACH;AAGA,eAAsB,oBAAoB,OAAe,QAAgB,OAAe,WAAmBK,UAAoC;AAC7I,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,SAAS,MAAM,WAAW,MAAM;AACtC,EAAAL,SAAQ,KAAK,UAAU,MAAM;AAC7B,EAAAA,SAAQ,KAAK,WAAW,MAAM;AAC9B,MAAI,WAA0B;AAC9B,MAAI,UAAU;AACd,MAAI,iBAAiB,MAAM;AAAA,EAAC;AAC5B,MAAI;AAEF,UAAM,OAAO,gBAAgB,KAAK;AAClC,2BAAuB,KAAK;AAC5B,eAAS;AACP,YAAM,OAAO,MAAM,UAAU,OAAO,MAAM,MAAM;AAAE,uBAAe;AAAG,mBAAW;AAAM,kBAAU;AAAA,MAAG,GAAG,WAAW,QAAQ,QAAQ;AAChI,UAAI,WAAW,OAAO,QAAS,QAAO;AACtC,UAAI,SAAS,IAAK,QAAO;AACzB,UAAI,aAAa,MAAM;AACrB,gBAAQ,MAAM,mFAA8E;AAC5F,mBAAW,KAAK,IAAI,IAAI;AACxB,YAAIA,SAAQ,MAAM,OAAO;AACvB,gBAAM,SAASA,SAAQ,MAAM;AAC7B,UAAAA,SAAQ,MAAM,WAAW,IAAI;AAC7B,gBAAM,UAAU,CAAC,UAAkB;AAAE,gBAAI,MAAM,SAAS,CAAC,EAAG,QAAO;AAAA,UAAG;AACtE,UAAAA,SAAQ,MAAM,GAAG,QAAQ,OAAO;AAChC,UAAAA,SAAQ,MAAM,OAAO;AACrB,2BAAiB,MAAM;AACrB,YAAAA,SAAQ,MAAM,MAAM;AACpB,YAAAA,SAAQ,MAAM,IAAI,QAAQ,OAAO;AACjC,YAAAA,SAAQ,MAAM,WAAW,MAAM;AAAA,UACjC;AAAA,QACF;AAAA,MACF;AACA,iBAAS;AACP,YAAI,KAAK,IAAI,KAAK,SAAU,OAAM,IAAI,MAAM,8EAA8E;AAC1H,cAAM,MAAM,KAAK,IAAI,MAAM,KAAK,KAAK,IAAI,WAAW,CAAC,GAAG,KAAO,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,GAAG,QAAW,EAAE,QAAQ,WAAW,OAAO,CAAC;AAC5I,YAAI;AACF,gBAAM,SAAS,YAAY,IAAI,CAAC,WAAW,QAAQ,YAAY,QAAQ,KAAK,IAAI,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC;AAC3G,gBAAM,UAAU,MAAM,iBAAwG,QAAQ,OAAO,mBAAmB,SAAS,GAAG,OAAO,MAAM,MAAM;AAC/L,cAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,KAAM,OAAM,IAAI,MAAM,QAAQ,SAAS,4BAA4B;AAC/F,cAAI,QAAQ,KAAK,WAAW,YAAY,QAAQ,KAAK,WAAW,WAAY,QAAQ,KAAK,eAAe,QAAQ,KAAK,MAAM,QAAQ,KAAK,UAAU,KAAK,KAAK,IAAI,GAAI;AAClK,kBAAM,IAAI,MAAM,qDAAqD;AAAA,UACvE;AACA,kBAAQ,MAAM,kBAAkB,QAAQ,OAAO,WAAWK,UAAS,MAAM;AACzE;AAAA,QACF,SAAS,OAAO;AACd,cAAI,EAAE,iBAAiB,qBAAqB,CAAC,MAAM,UAAW,OAAM;AAAA,QACtE;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,OAAO;AACd,QAAI,WAAW,OAAO,QAAS,QAAO;AACtC,YAAQ,MAAM,wBAAwB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAC9F,WAAO;AAAA,EACT,UAAE;AACA,mBAAe;AACf,IAAAL,SAAQ,IAAI,UAAU,MAAM;AAC5B,IAAAA,SAAQ,IAAI,WAAW,MAAM;AAAA,EAC/B;AACF;AAQA,eAAsB,SAAS,QAAgB,OAAe,WAAmBK,UAAoC;AACnH,QAAM,QAAQ,WAAW,EAAE,SAAS;AACpC,MAAI,CAAC,SAAS,IAAI,KAAK,MAAM,SAAS,EAAE,QAAQ,IAAI,KAAK,IAAI,IAAI,mBAAmB;AAClF,UAAM,kBAAkB,QAAQ,OAAO,WAAWA,QAAO;AAAA,EAC3D;AAEA,MAAI,kBAA4C,MAAM;AACtD,QAAM,WAAW,IAAI,QAAgB,CAAC,YAAY;AAChD,sBAAkB;AAAA,EACpB,CAAC;AAED,QAAM,SAAS,CAAC,WAAmB;AACjC,IAAAL,SAAQ,MAAM,QAAQ;AACtB,oBAAgB,MAAM;AAAA,EACxB;AACA,QAAM,WAAqB,CAAC;AAC5B,MAAI,gBAAgB;AACpB,MAAI,SAA2B;AAC/B,MAAI,aAAa;AACjB,EAAAA,SAAQ,MAAM,GAAG,QAAQ,CAAC,UAAkB;AAC1C,QAAI,QAAQ,eAAe,UAAU,MAAM;AACzC,aAAO,KAAK,IAAI,WAAW,KAAK,CAAC;AACjC;AAAA,IACF;AACA,qBAAiB,MAAM;AACvB,QAAI,gBAAgB,oBAAoB;AACtC,cAAQ,MAAM,iEAAiE;AAC/E,aAAO,CAAC;AACR;AAAA,IACF;AACA,aAAS,KAAK,KAAK;AAAA,EACrB,CAAC;AACD,EAAAA,SAAQ,MAAM,GAAG,OAAO,MAAM;AAC5B,iBAAa;AACb,YAAQ,MAAM,GAAI;AAAA,EACpB,CAAC;AAED,QAAM,UAAU,OAAO,YAAmC;AACxD,UAAM,SAAS,MAAM,WAA2B,QAAQ,OAAO,QAAQ,qBAAqB,mBAAmB,SAAS,CAAC,eAAe;AACxI,QAAI,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;AAC9B,cAAQ,MAAM,uBAAuB,OAAO,SAAS,iBAAiB,EAAE;AACxE,aAAO,CAAC;AACR;AAAA,IACF;AACA,QAAI,CAAC,gBAAgB,OAAO,KAAK,GAAG,GAAG;AACrC,cAAQ,MAAM,kGAAkG;AAChH,aAAO,CAAC;AACR;AAAA,IACF;AACA,UAAM,KAAK,IAAI,UAAU,OAAO,KAAK,KAAK,CAAC,qBAAqB,OAAO,KAAK,MAAM,CAAC;AACnF,OAAG,aAAa;AAChB,OAAG,SAAS,MAAM;AAChB,eAAS;AACT,iBAAW,SAAS,SAAS,OAAO,CAAC,EAAG,IAAG,KAAK,IAAI,WAAW,KAAK,CAAC;AACrE,UAAI,WAAY,IAAG,MAAM,GAAI;AAAA,IAC/B;AACA,OAAG,YAAY,CAAC,UAAU;AACxB,MAAAA,SAAQ,OAAO,MAAM,OAAO,KAAK,MAAM,IAAmB,CAAC;AAAA,IAC7D;AACA,OAAG,UAAU,CAAC,UAAU;AACtB,UAAI,WAAW,IAAI;AACjB,YAAI,MAAM,SAAS,KAAM;AACvB,kBAAQ,MAAM,wDAAwD,MAAM,IAAI,GAAG,MAAM,SAAS,KAAK,MAAM,MAAM,KAAK,EAAE,GAAG;AAC7H,gBAAM,OAAO,kBAAkB,MAAM,IAAI;AACzC,cAAI,KAAM,SAAQ,MAAM,uBAAuB,IAAI,EAAE;AAAA,QACvD;AACA,eAAO,MAAM,SAAS,MAAO,IAAI,CAAC;AAClC;AAAA,MACF;AAEA,UAAI,WAAW,gBAAgB;AAC7B,gBAAQ,MAAM,uDAAuD,cAAc,WAAW;AAC9F,eAAO,CAAC;AACR;AAAA,MACF;AACA,iBAAW,MAAM;AACf,gBAAQ,UAAU,CAAC,EAAE,MAAM,CAAC,UAAmB;AAE7C,cAAI,iBAAiB,mBAAmB;AACtC,mBAAO,MAAM,QAAQ;AACrB;AAAA,UACF;AACA,kBAAQ,MAAM,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC,EAAE;AAC7F,iBAAO,CAAC;AAAA,QACV,CAAC;AAAA,MACH,GAAG,UAAU,GAAG;AAAA,IAClB;AAAA,EACF;AACA,QAAM,QAAQ,CAAC;AACf,SAAO;AACT;;;AO3ZA,SAAS,SAAAQ,QAAO,aAAAC,kBAAiB;AACjC;AAAA,EACE;AAAA,EACA,cAAAC;AAAA,EACA,aAAAC;AAAA,EACA,aAAAC;AAAA,EACA;AAAA,EACA,gBAAAC;AAAA,EACA,iBAAAC;AAAA,OACK;AACP,OAAOC,SAAQ;AACf,OAAOC,WAAU;AACjB,SAAS,mBAAAC,wBAAuB;AAChC,SAAS,gCAAgC;AASlC,IAAM,cAAc;AAAA,EACzB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAwBA,IAAM,YAAY,MAAMD,MAAK,KAAKD,IAAG,QAAQ,GAAG,sBAAsB;AACtE,IAAM,UAAU,CAACG,UAAiB,SAChCT,WAAUS,UAAS,MAAM,EAAE,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AAElF,SAAS,SAAS,MAAuB;AACvC,MAAI;AACF,WAAO,KAAK,MAAML,cAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,UAAM,IAAI,MAAM,oCAAoC,IAAI,EAAE;AAAA,EAC5D;AACF;AACA,SAAS,YAAY,MAAc,OAAsB;AACvD,EAAAD,WAAUI,MAAK,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AAC9D,MAAIN,YAAW,IAAI,EAAG,WAAU,MAAM,GAAK;AAC3C,EAAAI,eAAc,MAAM,KAAK,UAAU,KAAK,GAAG,EAAE,MAAM,IAAM,CAAC;AAC5D;AACA,eAAe,IAAI,UAAkB,KAAgC;AACnE,QAAM,QAAQG,iBAAgB,EAAE,OAAO,QAAQ,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC9E,MAAI;AACF,UAAM,UAAU,MAAM,MAAM,SAAS,GAAG,QAAQ,IAAI,MAAM,UAAU,OAAO,GAAG,GAC3E,KAAK,EACL,YAAY;AACf,WAAO,WAAW,KAAK,MAAM,WAAW,OAAO,WAAW;AAAA,EAC5D,UAAE;AACA,UAAM,MAAM;AAAA,EACd;AACF;AAGA,SAAS,QAAQ,UAAkB,cAAc,UAAuB;AACtE,MAAI,WAAWF,IAAG,QAAQ;AAC1B,aAAW,QAAQ,SAAS,MAAM,GAAG,GAAG;AACtC,eAAWC,MAAK,KAAK,UAAU,IAAI;AACnC,QAAIN,YAAW,QAAQ,KAAKC,WAAU,QAAQ,EAAE,eAAe,EAAG,QAAO,CAAC;AAAA,EAC5E;AACA,QAAM,OAAOK,MAAK,KAAKD,IAAG,QAAQ,GAAG,QAAQ;AAC7C,MAAI,CAACL,YAAW,IAAI,KAAKC,WAAU,IAAI,EAAE,eAAe,EAAG,QAAO,CAAC;AACnE,MAAIA,WAAU,IAAI,EAAE,YAAY;AAC9B,WAAO,YAAY,IAAI,EAAE;AAAA,MAAQ,CAAC,SAChC,QAAQ,GAAG,QAAQ,IAAI,IAAI,IAAI,GAAG,WAAW,IAAI,IAAI,EAAE;AAAA,IACzD;AACF,QAAM,OAAOA,WAAU,IAAI;AAC3B,SAAO,KAAK,OAAO,KAAK,KAAK,UAAU,IACnC,CAAC,EAAE,QAAQ,UAAU,MAAM,aAAa,MAAM,KAAK,KAAK,CAAC,IACzD,CAAC;AACP;AACA,SAAS,aAA6C;AACpD,QAAM,OAAO,QAAQ,OAAO,CAAC,YAAY,QAAQ,aAAa,CAAC,EAC5D,OAAO,MAAM,IAAI,EACjB,KAAK,CAAC,SAAS,KAAK,WAAW,WAAW,CAAC,GAC1C,MAAM,CAAC;AACX,QAAM,SAAS,QAAQ,OAAO,CAAC,UAAU,WAAW,QAAQ,CAAC,EAAE,OAAO,KAAK;AAC3E,QAAM,WAAW,OAAO,MAAM,uBAAuB,IAAI,CAAC;AAC1D,SAAO;AAAA,IACL,mBAAmB,QAAQ,uBAAuB;AAAA,IAClD,iBAAiB,QAAQ,gBAAgB;AAAA,IACzC,iBACE,QAAQ,WACJ;AAAA,MACE,oBAAoB,KAAK,QAAQ,iBAAiB,GAAG,CAAC;AAAA,MACtD,+BAA+B,QAAQ;AAAA,IACzC,IACA,CAAC;AAAA,IACP,gBAAgB,CAAC,GAAG,QAAQ,oBAAoB,GAAG,GAAG,QAAQ,kBAAkB,CAAC;AAAA,IACjF,OAAO,CAAC,WAAW,iBAAiB,UAAU,YAAY,UAAU,EAAE;AAAA,MAAQ,CAAC,SAC7E,QAAQ,IAAI;AAAA,IACd;AAAA,EACF;AACF;AACA,SAAS,cAA6B;AACpC,MAAI,QAAQ,IAAI,wBAAyB,QAAO,QAAQ,IAAI;AAC5D,QAAM,OAAOK,MAAK,KAAK,UAAU,GAAG,yBAAyB;AAC7D,MAAI,CAACN,YAAW,IAAI,EAAG,QAAO;AAC9B,QAAM,SAAS,SAAS,IAAI;AAC5B,SAAO,OAAO,WAAW,YACvB,WAAW,QACX,WAAW,UACX,OAAO,OAAO,UAAU,YACxB,OAAO,QACL,OAAO,QACP;AACN;AACA,SAAS,cAAkC;AACzC,QAAM,OAAO,QAAQ,OAAO,CAAC,UAAU,YAAY,WAAW,CAAC,EAAE,OAAO,KAAK;AAC7E,QAAM,QAAQ,QAAQ,OAAO,CAAC,UAAU,YAAY,YAAY,CAAC,EAAE,OAAO,KAAK;AAC/E,SAAO,QAAQ,QAAQ,EAAE,MAAM,MAAM,IAAI;AAC3C;AAGO,SAAS,mBAAmB,UAA4C;AAC7E,QAAM,QAAQ,aAAa;AAC3B,QAAM,SAAS,QAAQ,MAAM,CAAC,QAAQ,UAAU,cAAc,YAAY,CAAC,EAAE,WAAW;AACxF,QAAM,SAAS,QAAQ,YAAY,CAAC;AACpC,QAAM,WAAW,QAAQ,YAAY,CAAC;AACtC,QAAM,SAAS,WAAW;AAC1B,QAAM,SAAS,CAAC,OAAe,MAAc,iBAAyB;AAAA,IACpE;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,QAAM,OAAO;AAAA,IACX;AAAA,IACA,WAAW;AAAA,MACT;AAAA,QACE,IAAI;AAAA,QACJ,SAAS,OAAO,UAAU;AAAA,QAC1B,UAAU;AAAA,QACV,OAAO;AAAA,UACL,SACI,gEACA;AAAA,QACN;AAAA,QACA,oBAAoB,SAAS,UAAU;AAAA,QACvC,SAAS;AAAA,UACP;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS,OAAO,UAAU;AAAA,QAC1B,UAAU;AAAA,QACV,OAAO;AAAA,UACL,SACI,mGACA;AAAA,QACN;AAAA,QACA,oBAAoB,SAAS,UAAU;AAAA,QACvC,SAAS;AAAA,UACP;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS,QAAS,MAAM,WAAW,QAAQ,OAAQ;AAAA,QACnD,UAAU;AAAA,QACV,OAAO;AAAA,UACL,QAAQ,IAAI,iBACR,8CACA;AAAA,QACN;AAAA,QACA,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS,QAAS,MAAM,cAAc,QAAQ,OAAQ;AAAA,QACtD,UAAU;AAAA,QACV,OAAO;AAAA,UACL,WACI,6DACA;AAAA,QACN;AAAA,QACA,oBAAoB,WAAW,QAAQ;AAAA,QACvC,SAAS;AAAA,UACP;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,UACA;AAAA,YACE;AAAA,YACA;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,SAAS,QAAQ,MAAM,QAAQ,KAAK,GAAG,KAAK,SAAS;AAAA,QACrD,UAAU;AAAA,QACV,OAAO,YAAY;AAAA,UACjB,CAAC,UACC,GAAG,KAAK,KAAK,OAAO,KAAK,EAAE,SAAS,OAAO,KAAK,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,MAAM,mBAAc,KAAK,IAAI,KAAK,KAAK,IAAI,SAAS,EAAE,KAAK,IAAI,IAAI,yBAAyB;AAAA,QAC1K;AAAA,QACA,oBAAoB;AAAA,QACpB,SAAS;AAAA,UACP,OAAO,QAAQ,kBAAkB,oDAAoD;AAAA,UACrF,GAAG,YAAY;AAAA,YAAI,CAAC,UAClB;AAAA,cACE;AAAA,cACA,aAAa,KAAK;AAAA,cAClB,QAAQ,KAAK;AAAA,YACf;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,IACA,UAAU;AAAA,MACR,GAAI,CAAC,SACD;AAAA,QACE;AAAA,UACE,IAAI;AAAA,UACJ,QACE;AAAA,UACF,SAAS;AAAA,QACX;AAAA,MACF,IACA,CAAC;AAAA,MACL,GAAI,CAAC,SACD;AAAA,QACE;AAAA,UACE,IAAI;AAAA,UACJ,QACE;AAAA,UACF,SAAS;AAAA,QACX;AAAA,MACF,IACA,CAAC;AAAA,IACP;AAAA,EACF;AACA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,kBAAkB,4BAA4B,KAAK,UAChD,IAAI,CAAC,aAAa,KAAK,SAAS,EAAE,IAAI,SAAS,WAAW,SAAS,kBAAkB,EAAE,EACvF,KAAK,GAAG,CAAC;AAAA,EACd;AACF;AAEA,SAAS,eAAoC;AAC3C,QAAM,OAAOM,MAAK,KAAK,UAAU,GAAG,oBAAoB;AACxD,MAAI,CAACN,YAAW,IAAI,EAAG,QAAO;AAC9B,QAAM,QAAQ,SAAS,IAAI;AAC3B,MAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK;AACpE,UAAM,IAAI,MAAM,6DAA6D;AAC/E,QAAM,IAAI;AAEV,MAAI,OAAO,EAAE,WAAW,aAAa,OAAO,EAAE,WAAW,WAAW;AAClE,UAAM,YAAY;AAAA,MAChB,gBAAgB;AAAA,MAChB,cAAc;AAAA,MACd,cAAc;AAAA,MACd,aAAa;AAAA,MACb,OAAO;AAAA,IACT;AACA,WAAO;AAAA,MACL,QAAQ,EAAE,SAAS,UAAU;AAAA,MAC7B,QAAQ,EAAE,SAAS,UAAU;AAAA,MAC7B,UAAU,EAAE,aAAa;AAAA,MACzB,aAAa,EAAE,aAAa;AAAA,MAC5B,SAAS,OAAO,QAAQ,SAAS,EAAE;AAAA,QAAQ,CAAC,CAAC,KAAK,KAAK,MACrD,EAAE,GAAG,MAAM,OAAO,CAAC,KAAK,IAAI,CAAC;AAAA,MAC/B;AAAA,IACF;AAAA,EACF;AACA,MACG,EAAE,WAAW,WAAW,EAAE,WAAW,UACrC,EAAE,WAAW,WAAW,EAAE,WAAW,YACtC,OAAO,EAAE,aAAa,aACtB,OAAO,EAAE,gBAAgB,aACzB,CAAC,MAAM,QAAQ,EAAE,OAAO,KACxB,CAAC,EAAE,QAAQ;AAAA,IACT,CAAC,UACC,OAAO,UAAU,YAAY,YAAY,KAAK,CAAC,YAAY,YAAY,KAAK;AAAA,EAChF;AAEA,UAAM,IAAI,MAAM,6DAA6D;AAC/E,SAAO;AAAA,IACL,QAAQ,EAAE;AAAA,IACV,QAAQ,EAAE;AAAA,IACV,UAAU,EAAE;AAAA,IACZ,aAAa,EAAE;AAAA,IACf,SAAS,EAAE;AAAA,EACb;AACF;AACA,eAAe,aAAqC;AAClD,UAAQ;AAAA,IACN;AAAA,EACF;AACA,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,UAAM,QAAQF,OAAM,UAAU,CAAC,aAAa,GAAG,EAAE,OAAO,CAAC,WAAW,QAAQ,MAAM,EAAE,CAAC;AACrF,QAAI,QAAuB;AAC3B,QAAI,UAAU;AACd,QAAI,kBAAkB;AACtB,UAAM,aAAa,MAAM;AACvB,UAAI,CAAC,iBAAiB;AACpB,gBAAQ,IAAI,0EAA0E;AACtF,0BAAkB;AAAA,MACpB;AAAA,IACF;AACA,UAAM,OAAO,CAAC,QAAgB;AAC5B,YAAM,OAAO,yBAAyB,GAAG;AACzC,YAAM,QAAQ,KAAK,MAAM,6BAA6B;AACtD,UAAI,OAAO;AACT,gBAAQ,MAAM,CAAC;AACf;AAAA,MACF;AAEA,UAAI,KAAK,SAAS,SAAS,EAAG;AAC9B,YAAM,MAAM,KAAK,MAAM,kBAAkB;AACzC,UAAI,IAAK,SAAQ,IAAI,IAAI,CAAC,CAAC;AAAA,eAClB,eAAe,KAAK,IAAI,EAAG,YAAW;AAAA,eACtC,qBAAqB,KAAK,IAAI;AACrC,gBAAQ,IAAI,sDAAsD;AAAA,IACtE;AACA,UAAM,OAAO,CAAC,UAAkB;AAC9B,iBAAW,MAAM,SAAS;AAC1B,YAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,gBAAU,MAAM,IAAI,KAAK;AACzB,iBAAW,SAAS,MAAO,MAAK,KAAK;AACrC,UAAI,kBAAkB,KAAK,yBAAyB,OAAO,CAAC,EAAG,YAAW;AAAA,IAC5E;AACA,UAAM,OAAO,GAAG,QAAQ,IAAI;AAC5B,UAAM,OAAO,GAAG,QAAQ,IAAI;AAC5B,UAAM,GAAG,SAAS,MAAM,QAAQ,IAAI,CAAC;AACrC,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,WAAK,OAAO;AACZ,cAAQ,SAAS,IAAI,QAAQ,IAAI;AAAA,IACnC,CAAC;AAAA,EACH,CAAC;AACH;AAGA,eAAsB,mBACpB,UAAsD,CAAC,GAC1B;AAC7B,MAAI,UAAU,QAAQ,YAAY,CAAC,QAAQ,OAAO,aAAa,IAAI;AACnE,QAAM,cAAc,CAAC;AACrB,MAAI,CAAC,SAAS;AACZ,QAAI,CAAC,QAAQ,MAAM,SAAS,CAAC,QAAQ,OAAO,OAAO;AACjD,UAAI,QAAQ;AACV,cAAM,IAAI;AAAA,UACR;AAAA,QACF;AACF,cAAQ;AAAA,QACN;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,UAAM,OAAO,mBAAmB,EAAE,MAAM,SAAS,OAAO,CAAC,EAAE,CAAC;AAC5D,UAAM,QAAQ,aAAa;AAC3B,UAAM,UAAmC,CAAC;AAC1C,eAAW,YAAY,KAAK,UAAU,OAAO,CAAC,MAAM,EAAE,OAAO,SAAS,GAAG;AACvE,cAAQ,IAAI;AAAA,EAAK,SAAS,QAAQ,EAAE;AACpC,iBAAW,SAAS,SAAS,MAAO,SAAQ,IAAI,KAAK,KAAK,EAAE;AAC5D,iBAAW,UAAU,SAAS,QAAS,SAAQ,IAAI,KAAK,OAAO,IAAI,KAAK,OAAO,WAAW,EAAE;AAC5F,YAAM,QACJ,SAAS,OAAO,WACZ,QACE,MAAM,WAAW,UACjB,SACF,SAAS,OAAO,WACd,QACE,MAAM,WAAW,UACjB,SACF,SAAS,OAAO,cACd,OAAO,WACP,OAAO;AACjB,cAAQ,SAAS,EAAE,IAAI,MAAM;AAAA,QAC3B,UAAU,SAAS,QAAQ,CAAC,EAAG,IAAI;AAAA,QACnC,SAAS,SAAS,uBAAuB,SAAS,QAAQ,CAAC,EAAG;AAAA,MAChE;AAAA,IACF;AACA,UAAM,UAAuB,CAAC;AAC9B,UAAM,QAAQ,KAAK,UAAU,KAAK,CAAC,MAAM,EAAE,OAAO,SAAS;AAC3D,YAAQ,IAAI;AAAA,EAAK,MAAM,QAAQ,EAAE;AACjC,eAAW,SAAS,aAAa;AAC/B,cAAQ,IAAI,KAAK,MAAM,MAAM,KAAK,CAAC,UAAU,MAAM,WAAW,GAAG,KAAK,GAAG,CAAC,CAAC,EAAE;AAC7E,UACE,MAAM;AAAA,QACJ,GAAG,MAAM,QAAQ,KAAK,CAAC,WAAW,OAAO,UAAU,KAAK,EAAG,WAAW,YAAY,KAAK;AAAA,QACvF,OAAO,QAAQ,SAAS,KAAK,KAAK;AAAA,MACpC;AAEA,gBAAQ,KAAK,KAAK;AAAA,IACtB;AACA,cAAU;AAAA,MACR,QAAQ,QAAQ,SAAS,UAAU;AAAA,MACnC,QAAQ,QAAQ,SAAS,UAAU;AAAA,MACnC,UAAU,QAAQ,WAAW;AAAA,MAC7B,aAAa,QAAQ,cAAc;AAAA,MACnC;AAAA,IACF;AAAA,EACF;AACA,QAAM,SAAsB,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,aAAa,MAAM,KAAK,KAAK;AAC/E,MAAI,QAAQ,WAAW,SAAS;AAC9B,QAAI,SAAS,QAAQ,MAAM,CAAC,QAAQ,UAAU,cAAc,YAAY,CAAC;AACzE,QACE,eACA,OAAO,WAAW,KACjB,MAAM,IAAI,2DAA2D,IAAI;AAE1E,eAASC;AAAA,QACP;AAAA,QACA,CAAC,QAAQ,SAAS,cAAc,cAAc,kBAAkB,SAAS,OAAO;AAAA,QAChF,EAAE,UAAU,QAAQ,OAAO,UAAU;AAAA,MACvC;AACF,UAAM,QACJ,OAAO,WAAW,IAAI,QAAQ,MAAM,CAAC,QAAQ,SAAS,cAAc,YAAY,CAAC,IAAI;AACvF,QAAI,OAAO,WAAW,KAAK,CAAC,MAAM,OAAO,KAAK;AAC5C,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AACF,WAAO,cAAc,MAAM,OAAO,KAAK;AAAA,EACzC;AACA,MAAI,QAAQ,WAAW,SAAS;AAC9B,QAAI,QAAQ,YAAY;AACxB,QACE,CAAC,SACD,eACC,MAAM;AAAA,MACL;AAAA,MACA;AAAA,IACF,GACA;AACA,cAAQ,MAAM,WAAW;AACzB,UAAI,MAAO,aAAYO,MAAK,KAAK,UAAU,GAAG,yBAAyB,GAAG,EAAE,MAAM,CAAC;AAAA,IACrF;AACA,QAAI,CAAC;AACH,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AACF,WAAO,IAAI,0BAA0B;AAAA,EACvC;AACA,MAAI,QAAQ,UAAU;AACpB,QAAI,CAAC,QAAQ,IAAI;AACf,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AACF,WAAO,IAAI,iBAAiB,QAAQ,IAAI;AAAA,EAC1C;AACA,MAAI,QAAQ,aAAa;AACvB,WAAO,MAAM,YAAY;AACzB,QAAI,CAAC,OAAO;AACV,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,EACJ;AACA,QAAM,SAAS,WAAW;AAC1B,QAAM,WAAW,QAAQ,QAAQ,QAAQ,CAAC,UAAU,OAAO,KAAK,CAAC;AACjE,UAAQ,IAAI,kEAAkE;AAC9E,MAAI,OAAO;AACT,YAAQ,IAAI,qFAAgF;AAC9F,MAAI,OAAO,IAAK,SAAQ,IAAI,+CAA0C;AACtE,aAAW,OAAO,OAAO,KAAK,OAAO,GAAG;AACtC,YAAQ,IAAI,KAAK,GAAG,4DAAuD;AAC7E,aAAW,QAAQ;AACjB,YAAQ,IAAI,OAAO,KAAK,MAAM,mBAAc,KAAK,IAAI,KAAK,KAAK,IAAI,SAAS;AAC9E,UAAQ,IAAI,oFAA+E;AAC3F,MACE,eACA,CAAE,MAAM,IAAI,iEAAiE,IAAI;AAEjF,WAAO;AACT,aAAW,QAAQ,UAAU;AAC3B,QAAI,UAAUH,cAAaG,MAAK,KAAKD,IAAG,QAAQ,GAAG,KAAK,MAAM,CAAC;AAC/D,QAAI,KAAK,SAAS,yBAAyB;AACzC,YAAM,WAAW,SAASC,MAAK,KAAKD,IAAG,QAAQ,GAAG,KAAK,MAAM,CAAC;AAC9D,UAAI,OAAO,aAAa,YAAY,aAAa,QAAQ,MAAM,QAAQ,QAAQ;AAC7E,cAAM,IAAI,MAAM,wCAAwC;AAC1D,YAAM,EAAE,KAAK,WAAW,GAAG,KAAK,IAAI;AACpC,gBAAU,OAAO,KAAK,KAAK,UAAU,IAAI,CAAC;AAAA,IAC5C;AACA,WAAO,MAAM,KAAK,EAAE,MAAM,KAAK,MAAM,SAAS,QAAQ,SAAS,QAAQ,EAAE,CAAC;AAAA,EAC5E;AACA,cAAYC,MAAK,KAAK,UAAU,GAAG,oBAAoB,GAAG,OAAO;AACjE,SAAO;AACT;;;AChhBO,SAAS,eAAe,MAI7B;AACA,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,WAAW,oBAAI,IAAY;AACjC,QAAM,gBAAgB,CAAC,YAAY,YAAY,eAAe,kBAAkB,WAAW;AAC3F,WAAS,QAAQ,QAAuB;AACtC,UAAM,IAAI;AAAA,MACR,GAAG,MAAM;AAAA,IACX;AAAA,EACF;AACA,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,UAAM,SAAS,IAAI,QAAQ,GAAG;AAC9B,UAAM,OAAO,WAAW,KAAK,MAAM,IAAI,MAAM,GAAG,MAAM;AACtD,QAAI,CAAC,UAAU,UAAU,OAAO,EAAE,SAAS,IAAI,GAAG;AAChD,UAAI,WAAW,MAAM,SAAS,IAAI,IAAI,EAAG,SAAQ,oCAAoC;AACrF,eAAS,IAAI,IAAI;AAAA,IACnB,WAAW,CAAC,GAAG,oBAAoB,cAAc,GAAG,aAAa,EAAE,SAAS,IAAI,GAAG;AACjF,UAAI,OAAO,IAAI,IAAI,EAAG,SAAQ,uBAAuB;AACrD,YAAM,QAAQ,WAAW,KAAK,KAAK,EAAE,CAAC,IAAI,IAAI,MAAM,SAAS,CAAC;AAC9D,UAAI,CAAC,SAAS,MAAM,WAAW,IAAI,EAAG,SAAQ,gCAAgC;AAC9E,aAAO,IAAI,MAAM,KAAK;AAAA,IACxB,MAAO,SAAQ,uBAAuB;AAAA,EACxC;AACA,QAAM,OAAO,SAAS,IAAI,QAAQ;AAClC,QAAM,MAAM,SAAS,IAAI,OAAO;AAChC,MAAI,SAAS,OAAO,cAAc,KAAK,CAAC,SAAS,OAAO,IAAI,IAAI,CAAC;AAC/D,YAAQ,gCAAgC;AAC1C,MAAI,SAAS,IAAI,QAAQ,KAAK,CAAC,KAAM,SAAQ,yBAAyB;AACtE,MAAI,CAAC,OAAO,cAAc,KAAK,CAAC,SAAS,OAAO,IAAI,IAAI,CAAC;AACvD,YAAQ,+BAA+B;AACzC,MAAI,CAAC,IAAK,QAAO,EAAE,MAAM,MAAM,SAAS,IAAI,QAAQ,EAAE;AACtD,aAAW,QAAQ;AACjB,QAAI,CAAC,OAAO,IAAI,IAAI,EAAG,SAAQ,6BAA6B,IAAI,GAAG;AACrE,QAAM,SAAS,OAAO,IAAI,UAAU;AACpC,QAAM,SAAS,OAAO,IAAI,UAAU;AACpC,QAAM,WAAW,OAAO,IAAI,aAAa;AACzC,QAAM,WAAW,OAAO,IAAI,gBAAgB;AAC5C,MAAI,WAAW,WAAW,WAAW,OAAQ,SAAQ,iCAAiC;AACtF,MAAI,WAAW,WAAW,WAAW,SAAU,SAAQ,mCAAmC;AAC1F,MAAI,aAAa,SAAS,aAAa,KAAM,SAAQ,gCAAgC;AACrF,MAAI,aAAa,SAAS,aAAa,KAAM,SAAQ,mCAAmC;AACxF,QAAM,UAAU,OAAO,IAAI,WAAW,MAAM,SAAS,CAAC,IAAI,OAAO,IAAI,WAAW,EAAG,MAAM,GAAG;AAC5F,MACE,CAAC,QAAQ;AAAA,IAAM,CAAC,UACd,YAAY,KAAK,CAAC,YAAY,UAAU,OAAO;AAAA,EACjD,KACA,IAAI,IAAI,OAAO,EAAE,SAAS,QAAQ;AAElC,YAAQ,uDAAuD,YAAY,KAAK,IAAI,CAAC,GAAG;AAC1F,SAAO;AAAA,IACL;AAAA,IACA,MAAM;AAAA,IACN,SAAS;AAAA,MACP;AAAA,MACA;AAAA,MACA,UAAU,aAAa;AAAA,MACvB,aAAa,aAAa;AAAA,MAC1B;AAAA,IACF;AAAA,EACF;AACF;AAEA,eAAsB,eACpB,MACA,UACe;AACf,MAAI,KAAK,MAAM;AACb,UAAM,OAAO,mBAAmB,QAAQ;AACxC,QAAI,KAAK,KAAM,SAAQ,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,SACnD;AACH,cAAQ;AAAA,QACN,sBAAsB,SAAS,IAAI;AAAA,MACrC;AACA,cAAQ,IAAI,iBAAiB,SAAS,MAAM,KAAK,IAAI,CAAC,2BAA2B;AACjF,iBAAW,YAAY,KAAK,WAAW;AACrC,gBAAQ,IAAI;AAAA,EAAK,SAAS,QAAQ,KAAK,SAAS,EAAE,GAAG;AACrD,mBAAW,SAAS,SAAS,MAAO,SAAQ,IAAI,YAAY,KAAK,EAAE;AACnE,gBAAQ,IAAI,cAAc,SAAS,WAAW,iBAAiB,EAAE;AACjE,gBAAQ,IAAI,kBAAkB,SAAS,kBAAkB,EAAE;AAC3D,mBAAW,UAAU,SAAS;AAC5B,kBAAQ,IAAI,KAAK,OAAO,IAAI,KAAK,OAAO,WAAW,EAAE;AAAA,MACzD;AACA,iBAAW,QAAQ,KAAK;AACtB,gBAAQ,IAAI;AAAA,aAAgB,KAAK,EAAE,MAAM,KAAK,MAAM;AAAA,IAAO,KAAK,OAAO,EAAE;AAC3E,cAAQ;AAAA,QACN;AAAA;AAAA,IAAwF,KAAK,gBAAgB;AAAA;AAAA,MAC/G;AAAA,IACF;AACA;AAAA,EACF;AACA,QAAM,QAAQ,MAAM,mBAAmB,EAAE,MAAM,MAAM,SAAS,KAAK,QAAQ,CAAC;AAC5E,UAAQ;AAAA,IACN,QACI,sIACA;AAAA,EACN;AACF;;;ACjHA,SAAS,aAAAG,kBAAiB;AAM1B,IAAM,UAAU,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAoDvB,IAAM,QAAQ,CAAC,UAAkB,IAAI,MAAM,WAAW,KAAK,OAAO,CAAC;AAG5D,SAAS,mBAAmB,OAAe,OAA6B;AAC7E,QAAM,OAAOC,WAAU,OAAO,CAAC,MAAM,OAAO,8CAA8C,GAAG;AAAA,IAC3F,OAAO,CAAC,UAAU,UAAU,SAAS;AAAA,EACvC,CAAC;AACD,MAAI,KAAK,WAAW;AAClB,UAAM,IAAI,MAAM,0DAA0D;AAC5E,QAAM,WAAWA,WAAU,OAAO,CAAC,MAAM,OAAO,WAAW,MAAM,OAAO,CAAC,EAAE,GAAG;AAAA,IAC5E,OAAO,KAAK,UAAU;AAAA,MACpB,GAAG;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,MAAM;AAAA,IACR,CAAC;AAAA,IACD,OAAO,CAAC,QAAQ,WAAW,SAAS;AAAA,EACtC,CAAC;AACD,MAAI,SAAS,WAAW;AACtB,YAAQ;AAAA,MACN;AAAA,IACF;AACF,SAAO,SAAS,WAAW;AAC7B;;;AXLA,IAAM,UAAU;AAMhB,IAAM,kBAAkB,KAAK;AAC7B,IAAM,kBAAkB,CAAC,GAAG,oBAAoB,cAAc,oBAAoB,eAAe;AAEjG,SAAS,YAAkB;AACzB,UAAQ;AAAA,IACN;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,yDAAyD,iBAAiB;AAAA,MAC1E;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AAAA,EACb;AACF;AAEA,SAAS,KAAK,SAAwB;AACpC,UAAQ,MAAM,UAAU,OAAO,EAAE;AACjC,EAAAC,SAAQ,KAAK,CAAC;AAChB;AAEA,IAAM,MAAM,CAAC,QAAgB,SAC3B,aAAa,OAAO,MAAM,EAAE,KAAK,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,MAAM,EAAE,CAAC;AAGxF,SAAS,aAAa,KAA4B;AAChD,QAAM,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,SAAO,QAAQ,MAAM,CAAC,IAAK;AAC7B;AAGA,SAAS,cAAc,MAAc,QAAwB;AAC3D,MAAI;AACJ,MAAI;AACF,eAAW,IAAI,MAAM,aAAa,gBAAgB,wBAAwB,MAAM,EAAE,KAAK;AAAA,EACzF,QAAQ;AACN,SAAK,0DAA0D;AAAA,EACjE;AACA,MAAI;AACF,QAAI,MAAM,cAAc,iBAAiB,QAAQ,MAAM;AAAA,EACzD,QAAQ;AACN,SAAK,SAAS,OAAO,MAAM,GAAG,EAAE,CAAC,eAAe,QAAQ,iBAAiB;AAAA,EAC3E;AACA,QAAM,SAAS,SAAS,MAAM,GAAG,EAAE,CAAC;AACpC,QAAM,OAAO,aAAa,IAAI,MAAM,UAAU,WAAW,MAAM,EAAE,KAAK,CAAC;AACvE,MAAI,CAAC,KAAM,MAAK,OAAO,MAAM,wCAAwC;AACrE,SAAO;AACT;AAOA,SAAS,UAAU,MAAc,QAAgB,MAAsB;AACrE,MAAI;AACF,WAAO,IAAI,MAAM,QAAQ,GAAG,MAAM,IAAI,IAAI,EAAE;AAAA,EAC9C,QAAQ;AACN;AAAA,MACE,GAAG,IAAI,wBAAwB,OAAO,MAAM,GAAG,EAAE,CAAC,cAAc,iBAAiB;AAAA,IACnF;AAAA,EACF;AACF;AAGA,eAAe,SACb,QACA,OACA,OACA,MACc;AACd,QAAM,QAAa,CAAC;AACpB,MAAI,SAAwB;AAC5B,KAAG;AACD,UAAM,YAAY,MAAM,SAAS,GAAG,IAAI,MAAM;AAC9C,UAAM,QAAgB,GAAG,SAAS,YAAY,SAAS,WAAW,mBAAmB,MAAM,CAAC,KAAK,EAAE;AACnG,UAAM,OAAO,MAAM,WAKhB,QAAQ,OAAO,OAAO,GAAG,KAAK,GAAG,KAAK,EAAE;AAC3C,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,KAAM,MAAK,KAAK,SAAS,kBAAkB,IAAI,EAAE;AACvE,UAAM,KAAK,GAAG,KAAK,IAAI;AACvB,aAAS,KAAK,cAAc;AAAA,EAC9B,SAAS;AACT,SAAO;AACT;AAEA,IAAM,eAAe,CAAC,QAAgB,UACpC,SAA0B,QAAQ,OAAO,sBAAsB,WAAW;AAE5E,SAAS,aAAa,UAAiC;AACrD,QAAM,SAAS,GAAG,SAAS,UAAU,IAAI,SAAS,aAAa,MAAM,GAAG,EAAE,CAAC;AAC3E,UAAQ;AAAA,IACN,GAAG,SAAS,IAAI,KAAK,SAAS,OAAO,KAAK,SAAS,OAAO,OAAO,CAAC,CAAC,KAAK,MAAM,WAAW,SAAS,WAAW,kBAAkB,SAAS,kBAAkB,MAAM,GAAG,EAAE,CAAC;AAAA,EACxK;AACA,MAAI,SAAS,WAAW,YAAY,SAAS;AAC3C,YAAQ,IAAI,KAAK,SAAS,MAAM,KAAK,EAAE,MAAM,IAAI,EAAE,MAAM,GAAG,EAAE,KAAK,MAAM,CAAC,EAAE;AAChF;AAEA,eAAe,QAAQ,MAAgB,QAAgB,OAA8B;AACnF,QAAM,QAAQ,iBAAiB,MAAM,kBAAkB;AACvD,QAAM,QAAQ,QAAQC,MAAK,QAAQA,MAAK,QAAQ,KAAK,CAAC,IAAID,SAAQ,IAAI;AACtE,MAAI;AACJ,MAAI;AACF,WAAO,IAAI,OAAO,aAAa,iBAAiB,EAAE,KAAK;AAAA,EACzD,QAAQ;AACN,SAAK,GAAG,KAAK,iCAAiC;AAAA,EAChD;AACA,QAAM,WAAW,QAAQC,MAAK,SAAS,MAAMA,MAAK,QAAQ,KAAK,CAAC,IAAI;AACpE,MAAI,SAAS,WAAW,IAAI,EAAG,MAAK,GAAG,KAAK,iCAAiC,IAAI,EAAE;AACnF,QAAM,SAAS,IAAI,MAAM,aAAa,MAAM,EAAE,KAAK;AACnD,QAAM,OAAO,UAAU,MAAM,QAAQ,QAAQ;AAC7C,QAAM,EAAE,UAAU,OAAO,IAAI,oBAAoB,IAAI;AACrD,MAAI,CAAC,UAAU;AACb,YAAQ,MAAM,UAAU,QAAQ,cAAc;AAC9C,eAAW,SAAS,OAAQ,SAAQ,MAAM,KAAK,MAAM,IAAI,KAAK,MAAM,OAAO,EAAE;AAC7E,IAAAD,SAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,OAAO,cAAc,MAAM,MAAM;AACvC,MACE;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,SAAS;AAAA,EACX,EAAE,KAAK,MAAM,IACb;AACA,YAAQ;AAAA,MACN,8FAA8F,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,IACnH;AAAA,EACF;AAEA,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,aAAa,UAAU,MAAM,QAAQ,SAAS,YAAY;AAAA,MAC1D,UAAU,UAAU,MAAM,QAAQ,SAAS,QAAQ;AAAA,MACnD;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,OAAO,MAAM,CAAC,OAAO,MAAM;AAC9B,YAAQ,MAAM,UAAU,OAAO,SAAS,gBAAgB,EAAE;AAC1D,eAAW,SAAS,OAAO,UAAU,CAAC,EAAG,SAAQ,MAAM,KAAK,MAAM,IAAI,KAAK,MAAM,OAAO,EAAE;AAC1F,IAAAA,SAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,EAAE,IAAI,MAAM,QAAQ,IAAI,OAAO;AACrC,UAAQ;AAAA,IACN,aAAa,IAAI,KAAK,OAAO,KAAK,EAAE,UAAU,IAAI,IAAI,OAAO,MAAM,GAAG,EAAE,CAAC;AAAA,EAC3E;AACA,UAAQ,IAAI,4EAA4E;AACxF,QAAM,UAAU,KAAK,IAAI;AAEzB,aAAS;AACP,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,OAAO,CAAC;AAC3D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,MACA,sBAAsB,EAAE;AAAA,IAC1B;AAEA,QAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,MAAM;AAChC;AAAA,QACE,sCAAsC,QAAQ,SAAS,eAAe;AAAA,MACxE;AAAA,IACF;AACA,QAAI,QAAQ,KAAK,WAAW,WAAY;AACxC,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,WAAW,UAAU,WAAM,QAAG,UAAU,KAAK,OAAO,KAAK,IAAI,IAAI,WAAW,GAAI,CAAC;AAAA,IACnG;AACA,iBAAa,QAAQ,IAAI;AACzB,QAAI,QAAQ,KAAK,WAAW,SAAU,CAAAA,SAAQ,KAAK,CAAC;AACpD;AAAA,EACF;AACF;AAEA,eAAe,KAAK,MAAgB,QAAgB,OAA8B;AAChF,QAAM,YAAY,MAAM,aAAa,QAAQ,KAAK;AAClD,MAAI,QAAQ,MAAM,QAAQ,GAAG;AAC3B,mBAAe,KAAK,UAAU,WAAW,MAAM,CAAC,CAAC;AACjD;AAAA,EACF;AACA,MAAI,UAAU,WAAW,GAAG;AAC1B,YAAQ,IAAI,yEAAyE;AACrF;AAAA,EACF;AACA,aAAW,YAAY,UAAW,cAAa,QAAQ;AACzD;AAMA,IAAM,YAAY,CAAC;AAAA;AAAA,EAEjB,QAAQE,0BAAyB,KAAK,EAAE,QAAQ,iCAAiC,GAAG,IAAI;AAAA;AAE1F,SAAS,aAAa,SAAwB;AAC5C,MAAI,QAAQ,WAAW;AACrB,YAAQ,IAAI,cAAc,UAAU,QAAQ,UAAU,WAAW,CAAC,EAAE;AACtE,QAAM,OAAO,GAAG,QAAQ,KAAK,KAAK,KAAK,MAAM,QAAQ,YAAY,IAAI,CAAC;AACtE,QAAM,QAAQ,QAAQ,aAAa,gBAAgB,QAAQ,UAAU,KAAK;AAC1E,UAAQ;AAAA,IACN,GAAG,QAAQ,EAAE,KAAK,QAAQ,OAAO,OAAO,EAAE,CAAC,KAAK,QAAQ,SAAS,GAAG,KAAK,IAAI,GAAG,KAAK;AAAA,EACvF;AACA,MAAI,QAAQ,WAAW;AACrB,YAAQ,IAAI,kBAAkB,UAAU,QAAQ,UAAU,QAAQ,CAAC,EAAE;AACvE,MAAI,QAAQ,WAAW,UAAU;AAC/B,YAAQ,IAAI,eAAe,QAAQ,UAAU,SAAS,IAAI,SAAS,EAAE,KAAK,IAAI,CAAC,EAAE;AACnF,MAAI,QAAQ,WAAW,MAAO,SAAQ,IAAI,KAAK,UAAU,QAAQ,UAAU,KAAK,CAAC,EAAE;AACnF,MAAI,QAAQ;AACV,YAAQ;AAAA,MACN,YAAY,QAAQ,SAAS,GAAG,QAAQ,YAAY,KAAK,QAAQ,SAAS,MAAM,EAAE;AAAA,IACpF;AACJ;AAGA,eAAe,gBACb,MACA,QACA,OACA,WACiB;AACjB,QAAM,QAAQ,YAAY,MAAM,YAAY;AAC5C,MAAI,MAAO,QAAO;AAClB,QAAM,QAAQ,IAAI;AAAA,KACf,aAAc,MAAM,aAAa,QAAQ,KAAK,GAAI,IAAI,CAAC,aAAa,SAAS,IAAI;AAAA,EACpF;AACA,MAAI,MAAM,SAAS,EAAG,QAAO,CAAC,GAAG,KAAK,EAAE,CAAC;AACzC,MAAI,MAAM,SAAS;AACjB;AAAA,MACE;AAAA,IACF;AACF;AAAA,IACE,uEAAuE,CAAC,GAAG,KAAK,EAAE,KAAK,EAAE,KAAK,IAAI,CAAC;AAAA,EACrG;AACF;AAGA,IAAM,oBAAoB,oBAAI,IAAI;AAAA,EAChC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,iBAAiB,KAAK;AAG5B,SAAS,QAAQ,MAA0B;AACzC,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,CAAC,SAAS,aAAa,SAAS,cAAc,GAAG;AAClE,UAAM,QAAQ,YAAY,MAAM,IAAI;AACpC,QAAI,MAAO,KAAI,KAAK,MAAM,KAAK;AAAA,EACjC;AACA,SAAO;AACT;AAGA,eAAe,sBAAsB,QAAgB,OAAe,IAA8B;AAChG,QAAM,cAAc,qBAAqB,mBAAmB,EAAE,CAAC;AAC/D,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,MAAI,QAAQ;AACZ,aAAS;AACP,UAAM,UAAU,MAAM,WAA4B,QAAQ,OAAO,OAAO,WAAW;AACnF,QAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,KAAM,MAAK,QAAQ,SAAS,4BAA4B;AACpF,UAAM,UAAU,QAAQ;AACxB,UAAM,QAAQ,GAAG,QAAQ,MAAM,GAAG,QAAQ,QAAQ,KAAK,QAAQ,KAAK,MAAM,EAAE;AAC5E,QAAI,UAAU,OAAO;AACnB,cAAQ,IAAI,KAAK,KAAK,EAAE;AACxB,cAAQ;AAAA,IACV;AACA,QAAI,QAAQ,WAAW,YAAY,QAAQ,WAAW,SAAS;AAC7D,mBAAa,OAAO;AACpB,MAAAF,SAAQ,KAAK,CAAC;AAAA,IAChB;AACA,QAAI,QAAQ,WAAW,aAAc,QAAQ,SAAS,kBAAkB,IAAI,QAAQ,KAAK;AACvF,aAAO;AACT,QAAI,KAAK,IAAI,IAAI;AACf,WAAK,GAAG,EAAE,aAAa,KAAK,8CAA8C;AAC5E,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAK,CAAC;AAAA,EAC3D;AACF;AAEA,eAAe,OACb,IACA,MACA,QACA,OACA,OACe;AACf,QAAM,sBAAsB,QAAQ,OAAO,EAAE;AAC7C,QAAM,QAAQ,MAAM,kBAAkB,QAAQ,OAAO,IAAI,QAAQ,IAAI,CAAC,EAAE;AAAA,IAAM,CAAC,UAC7E,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,EAC7D;AACA,MAAI,MAAO,oBAAmB,OAAO,KAAK;AAC1C,UAAQ;AAAA,IACN,gBAAgB,EAAE,SAAS,KAAK,gEAAgE,EAAE;AAAA,EACpG;AACA,EAAAA,SAAQ,KAAK,MAAM,oBAAoB,OAAO,QAAQ,OAAO,IAAI,QAAQ,IAAI,CAAC,CAAC;AACjF;AAEA,eAAe,MAAM,MAAgB,QAAgB,OAA8B;AACjF,QAAM,WAAW,MAAM,gBAAgB,MAAM,QAAQ,KAAK;AAC1D,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,IACA,0BAA0B,mBAAmB,QAAQ,CAAC;AAAA,EACxD;AACA,MAAI,CAAC,KAAK,MAAM,CAAC,KAAK,KAAM,MAAK,KAAK,SAAS,kCAAkC;AACjF,QAAM,QAAQ,KAAK,KAAK,gBAAgB,OAAO,MAAM,mBAAmB;AACxE,MAAI,KAAK,KAAK;AACZ,YAAQ,IAAI,sEAAsE;AACpF,QAAM,SAAS,MAAM,WAA4B,QAAQ,OAAO,QAAQ,qBAAqB;AAAA,IAC3F;AAAA,IACA,gBAAgB,KAAK;AAAA,MAAQ,CAAC,OAAO,UACnC,UAAU,sBAAsB,KAAK,QAAQ,CAAC,IAC1C,CAAC,KAAK,QAAQ,CAAC,CAAE,IACjB,MAAM,WAAW,mBAAmB,IAClC,CAAC,MAAM,MAAM,EAAE,CAAC,IAChB,CAAC;AAAA,IACT;AAAA,EACF,CAAC;AACD,MAAI,CAAC,OAAO,MAAM,CAAC,OAAO,KAAM,MAAK,OAAO,SAAS,kBAAkB;AACvE,UAAQ;AAAA,IACN,WAAW,OAAO,KAAK,EAAE,SAAS,QAAQ;AAAA,EAC5C;AACA,QAAM;AAAA,IACJ,OAAO,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA,KAAK,KAAK,gBACN,SACC,SAAS,EAAE,OAAO,CAAC,GAAG,KAAK,CAAC,GAAG,aAAa,MAAM,KAAK,KAAK;AAAA,EACnE;AACF;AAGA,eAAe,gBAAgB,MAAgB,QAAgB,OAAgC;AAC7F,QAAM,QAAQ,iBAAiB,MAAM,eAAe;AACpD,MAAI,MAAO,QAAO;AAClB,QAAM,OAAO,MAAM,SAAkB,QAAQ,OAAO,qBAAqB,UAAU;AACnF,MAAI,KAAK,WAAW,EAAG,QAAO,KAAK,CAAC,EAAG;AACvC,MAAI,KAAK,WAAW,EAAG,MAAK,6DAA6D;AACzF,OAAK,6CAA6C,KAAK,IAAI,CAAC,YAAY,QAAQ,EAAE,EAAE,KAAK,IAAI,CAAC,EAAE;AAClG;AAEA,eAAe,aAAa,MAAgB,QAAgB,OAA8B;AACxF,QAAM,MAAM,QAAQ,MAAM,OAAO;AACjC,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA,MAAM,+BAA+B;AAAA,IACrC;AAAA,EACF;AACA,MAAI,QAAQ,MAAM,QAAQ,GAAG;AAC3B,mBAAe,KAAK,UAAU,UAAU,MAAM,CAAC,CAAC;AAChD;AAAA,EACF;AACA,MAAI,SAAS,WAAW,GAAG;AACzB,YAAQ;AAAA,MACN,MACI,wCACA;AAAA,IACN;AACA;AAAA,EACF;AACA,aAAW,WAAW,SAAU,cAAa,OAAO;AACtD;AAEA,eAAe,QAAQ,MAAgB,QAAgB,OAA8B;AACnF,QAAM,KAAK,iBAAiB,MAAM,eAAe;AACjD,MAAI,CAAC,GAAI,MAAK,kCAAkC;AAChD,QAAM,cAAc,qBAAqB,mBAAmB,EAAE,CAAC;AAC/D,QAAM,SAAS,MAAM,WAA4B,QAAQ,OAAO,UAAU,WAAW;AACrF,MAAI,CAAC,OAAO,MAAM,CAAC,OAAO,KAAM,MAAK,OAAO,SAAS,oBAAoB;AACzE,UAAQ,IAAI,UAAU,EAAE,QAAG;AAC3B,QAAM,WAAW,KAAK,IAAI,IAAI;AAC9B,MAAI,UAAU,OAAO;AACrB,SAAO,QAAQ,WAAW,SAAS;AACjC,QAAI,KAAK,IAAI,IAAI;AACf,WAAK,GAAG,EAAE,aAAa,QAAQ,MAAM,oDAAoD;AAC3F,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,GAAK,CAAC;AACzD,UAAM,UAAU,MAAM,WAA4B,QAAQ,OAAO,OAAO,WAAW;AACnF,QAAI,CAAC,QAAQ,MAAM,CAAC,QAAQ,KAAM,MAAK,QAAQ,SAAS,4BAA4B;AACpF,cAAU,QAAQ;AAAA,EACpB;AACA,eAAa,OAAO;AAEpB,MAAI,QAAQ,cAAc;AACxB,YAAQ;AAAA,MACN;AAAA,IACF;AACJ;AAEA,eAAsB,OAAO,MAA+B;AAC1D,QAAM,CAAC,OAAO,YAAY,GAAG,IAAI,IAAI;AACrC,MAAI,UAAU,cAAc;AAC1B,UAAM,mBAAmB,KAAK,MAAM,CAAC,CAAC;AACtC;AAAA,EACF;AACA,MAAI,UAAU,mBAAmB;AAC/B,UAAM,eAAe,KAAK,MAAM,CAAC,CAAC;AAClC;AAAA,EACF;AACA,MAAI,UAAU,SAAS;AACrB,UAAM,iBAAiB,OAAO,KAAK,MAAM,CAAC,CAAC;AAC3C;AAAA,EACF;AACA,MAAI,UAAU,UAAU,QAAQ,MAAM,UAAU,IAAI,GAAG;AACrD,cAAU;AACV;AAAA,EACF;AACA,MAAI,UAAU,SAAS;AACrB,UAAM,OAAO,KAAK,MAAM,CAAC;AACzB,UAAM,YAAY,eAAe,IAAI;AACrC,UAAM,EAAE,QAAAG,SAAQ,OAAAC,OAAM,IAAI,MAAM,cAAc,IAAI;AAClD,UAAM,YAAY,MAAM,aAAaD,SAAQC,MAAK;AAClD,UAAM,OAAO,MAAM,gBAAgB,MAAMD,SAAQC,QAAO,SAAS;AACjE,UAAM,WAAW,UAAU;AAAA,MACzB,CAACC,cAAaA,UAAS,SAAS,QAAQA,UAAS,WAAW;AAAA,IAC9D;AACA,QAAI,CAAC,SAAU,MAAK,gDAAgD;AACpE,QAAI,CAAC,MAAM,QAAQ,SAAS,KAAK;AAC/B;AAAA,QACE;AAAA,MACF;AACF,UAAM,eAAe,WAAW,EAAE,MAAM,OAAO,SAAS,MAAM,CAAC;AAC/D;AAAA,EACF;AAEA,MAAI,UAAU,UAAa,MAAM,WAAW,IAAI,GAAG;AACjD,UAAM,EAAE,QAAAF,SAAQ,OAAAC,OAAM,IAAI,MAAM,cAAc,IAAI;AAClD,UAAM,MAAM,MAAMD,SAAQC,MAAK;AAC/B;AAAA,EACF;AACA,MAAI,UAAU,YAAY,UAAU,SAAS;AAC3C,UAAM,OAAO,KAAK,MAAM,CAAC;AACzB,UAAM,EAAE,QAAAD,SAAQ,OAAAC,OAAM,IAAI,MAAM,cAAc,IAAI;AAClD,QAAI,UAAU,UAAU;AACtB,YAAM,OAAO,MAAM,gBAAgB,MAAMD,SAAQC,MAAK,GAAG,MAAMD,SAAQC,MAAK;AAC5E;AAAA,IACF;AACA,UAAM,KAAK,iBAAiB,MAAM,eAAe;AACjD,QAAI,CAAC,GAAI,MAAK,gCAAgC;AAC9C,UAAM,SAAS,MAAM,SAASD,SAAQC,QAAO,IAAI,QAAQ,IAAI,CAAC,EAAE,MAAM,CAAC,UAAmB;AAExF,UAAI,iBAAiB,kBAAmB,OAAM;AAC9C,cAAQ;AAAA,QACN,uBAAuB,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,MAC/E;AACA,aAAO;AAAA,IACT,CAAC;AACD,IAAAJ,SAAQ,KAAK,MAAM;AAAA,EACrB;AACA,MAAI,UAAU,UAAU,UAAU,WAAW;AAC3C,UAAM,OAAO,KAAK,MAAM,CAAC;AACzB,UAAM,EAAE,QAAAG,SAAQ,OAAAC,OAAM,IAAI,MAAM,cAAc,IAAI;AAClD,QAAI,UAAU,OAAQ,OAAM,aAAa,MAAMD,SAAQC,MAAK;AAAA,QACvD,OAAM,QAAQ,MAAMD,SAAQC,MAAK;AACtC;AAAA,EACF;AACA,MAAI,UAAU,cAAe,eAAe,aAAa,eAAe,QAAS;AAC/E,YAAQ,MAAM,4BAA4B,CAAC,OAAO,UAAU,EAAE,OAAO,OAAO,EAAE,KAAK,GAAG,CAAC,EAAE;AACzF,cAAU;AACV,IAAAJ,SAAQ,KAAK,CAAC;AAAA,EAChB;AACA,QAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,cAAc,IAAI;AAClD,MAAI,eAAe,UAAW,OAAM,QAAQ,MAAM,QAAQ,KAAK;AAAA,MAC1D,OAAM,KAAK,MAAM,QAAQ,KAAK;AACrC;","names":["path","process","stripVTControlCharacters","spawn","spawnSync","readFileSync","renameSync","writeFileSync","process","createInterface","process","writeFileSync","renameSync","spawnSync","readFileSync","envArgs","spawn","createInterface","spawn","spawnSync","existsSync","lstatSync","mkdirSync","readFileSync","writeFileSync","os","path","createInterface","command","spawnSync","spawnSync","process","path","stripVTControlCharacters","apiUrl","token","template"]}

package/dist/{digest-54VJ7KTF.js → digest-4PABSK2F.js}

@@ -5,25 +5,25 @@ import {
   formatSlackChannel,
   loadSlackChannels,
   resolveSlackChannelIds
-} from "./chunk-T6KTBHWD.js";
-import "./chunk-TG32WC4J.js";
-import "./chunk-FBEQNW2P.js";
+} from "./chunk-LZLSRN5Q.js";
+import "./chunk-W6TPKE5S.js";
+import "./chunk-DFN2NH37.js";
 import "./chunk-DEK6B6LX.js";
 import {
   apiRequest,
   getPositionalArgs
-} from "./chunk-72Y65NWI.js";
+} from "./chunk-WY4R4IL5.js";
 import "./chunk-S3Q7MDCS.js";
 import {
   GLOBAL_VALUE_FLAGS,
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-IIDQM4MY.js";
+} from "./chunk-BMFD4OPC.js";
 import {
   writeRawOutput
-} from "./chunk-T6ZNIMI4.js";
-import "./chunk-EYHJ5FIA.js";
+} from "./chunk-LRIP5IQD.js";
+import "./chunk-C6SNLHVE.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/digest.ts
@@ -303,4 +303,4 @@ export {
   formatDigest,
   runDigest
 };
-//# sourceMappingURL=digest-54VJ7KTF.js.map
+//# sourceMappingURL=digest-4PABSK2F.js.map

package/dist/{docs-PPQSNRP6.js → docs-ZL5QOHCB.js}

@@ -2,7 +2,7 @@ import { createRequire as __cr } from "module"; import { fileURLToPath as __fup
 import {
   apiRequest,
   getPositionalArgs
-} from "./chunk-72Y65NWI.js";
+} from "./chunk-WY4R4IL5.js";
 import {
   getSubDir
 } from "./chunk-S3Q7MDCS.js";
@@ -11,11 +11,11 @@ import {
   getArgValue,
   hasFlag,
   resolveConfig
-} from "./chunk-IIDQM4MY.js";
+} from "./chunk-BMFD4OPC.js";
 import {
   writeRawOutput
-} from "./chunk-T6ZNIMI4.js";
-import "./chunk-EYHJ5FIA.js";
+} from "./chunk-LRIP5IQD.js";
+import "./chunk-C6SNLHVE.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/docs.ts
@@ -451,4 +451,4 @@ async function runDocs(argv) {
 export {
   runDocs
 };
-//# sourceMappingURL=docs-PPQSNRP6.js.map
+//# sourceMappingURL=docs-ZL5QOHCB.js.map

package/dist/{doctor-CXFGSPWH.js → doctor-J5X2HSLJ.js}

@@ -12,10 +12,10 @@ import {
   printNoSessionForOrg,
   readAllProfiles,
   readStoredAuth
-} from "./chunk-IIDQM4MY.js";
+} from "./chunk-BMFD4OPC.js";
 import {
   readBrandEnv
-} from "./chunk-T6ZNIMI4.js";
+} from "./chunk-LRIP5IQD.js";
 import "./chunk-TOWZAG3I.js";
 
 // src/doctor.ts
@@ -154,4 +154,4 @@ async function runAuthDoctor(argv) {
 export {
   runAuthDoctor
 };
-//# sourceMappingURL=doctor-CXFGSPWH.js.map
+//# sourceMappingURL=doctor-J5X2HSLJ.js.map

package/dist/{environment-6MXRQV5L.js → environment-7Q6WDKMM.js}

@@ -8,13 +8,13 @@ import {
   resolveOrCreateSandboxApplication,
   runEnvironment,
   stdinAssignment
-} from "./chunk-YFXTMFYB.js";
-import "./chunk-SBQLD7X6.js";
-import "./chunk-72Y65NWI.js";
+} from "./chunk-V6OC2WQL.js";
+import "./chunk-PN5IK7CJ.js";
+import "./chunk-WY4R4IL5.js";
 import "./chunk-S3Q7MDCS.js";
-import "./chunk-IIDQM4MY.js";
-import "./chunk-T6ZNIMI4.js";
-import "./chunk-EYHJ5FIA.js";
+import "./chunk-BMFD4OPC.js";
+import "./chunk-LRIP5IQD.js";
+import "./chunk-C6SNLHVE.js";
 import "./chunk-TOWZAG3I.js";
 export {
   fetchEnvironments,
@@ -26,4 +26,4 @@ export {
   runEnvironment,
   stdinAssignment
 };
-//# sourceMappingURL=environment-6MXRQV5L.js.map
+//# sourceMappingURL=environment-7Q6WDKMM.js.map