@splitin/verification-cli 0.1.0-beta.0

package/dist/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/argv.ts","../src/redact.ts","../src/config.ts","../src/migrations.ts","../src/scaffold.ts","../src/commands.ts","../src/cli.ts"],"names":["dirname","join","existsSync","readFileSync","mkdirSync","writeFileSync","results","failed","resolve","VERIFICATION_ADAPTER_CONTRACT_VERSION","ENGINE_CONTRACT_VERSION","pathToFileURL"],"mappings":";;;;;;;;AAOA,IAAM,wBAAA,uBAA+B,GAAA,CAAI,CAAC,UAAU,IAAA,EAAM,UAAA,EAAY,UAAA,EAAY,SAAS,CAAC,CAAA;AAErF,SAAS,UAAU,IAAA,EAA4B;AACpD,EAAA,MAAM,MAAA,GAAS,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC3B,EAAA,MAAM,QAA0C,EAAC;AACjD,EAAA,MAAM,OAAiB,EAAC;AAExB,EAAA,KAAA,IAAS,QAAQ,CAAA,EAAG,KAAA,GAAQ,MAAA,CAAO,MAAA,EAAQ,SAAS,CAAA,EAAG;AACrD,IAAA,MAAM,KAAA,GAAQ,OAAO,KAAK,CAAA;AAC1B,IAAA,IAAI,UAAU,IAAA,EAAM;AAClB,MAAA,IAAA,CAAK,KAAK,GAAG,MAAA,CAAO,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAC,CAAA;AACpC,MAAA;AAAA,IACF;AACA,IAAA,IAAI,KAAA,CAAM,UAAA,CAAW,IAAI,CAAA,EAAG;AAC1B,MAAA,MAAM,EAAA,GAAK,KAAA,CAAM,OAAA,CAAQ,GAAG,CAAA;AAC5B,MAAA,IAAI,OAAO,EAAA,EAAI;AACb,QAAA,KAAA,CAAM,KAAA,CAAM,MAAM,CAAA,EAAG,EAAE,CAAC,CAAA,GAAI,KAAA,CAAM,KAAA,CAAM,EAAA,GAAK,CAAC,CAAA;AAC9C,QAAA;AAAA,MACF;AACA,MAAA,MAAM,GAAA,GAAM,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA;AACzB,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,GAAQ,CAAC,CAAA;AAC7B,MAAA,IAAI,IAAA,IAAQ,CAAC,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AACjC,QAAA,KAAA,CAAM,GAAG,CAAA,GAAI,IAAA;AACb,QAAA,KAAA,IAAS,CAAA;AAAA,MACX,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,GAAG,CAAA,GAAI,IAAA;AAAA,MACf;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAI,MAAM,UAAA,CAAW,GAAG,CAAA,IAAK,KAAA,CAAM,WAAW,CAAA,EAAG;AAC/C,MAAA,MAAM,GAAA,GAAM,KAAA,CAAM,KAAA,CAAM,CAAC,CAAA;AACzB,MAAA,MAAM,IAAA,GAAO,MAAA,CAAO,KAAA,GAAQ,CAAC,CAAA;AAC7B,MAAA,IAAI,IAAA,IAAQ,CAAC,IAAA,CAAK,UAAA,CAAW,GAAG,CAAA,EAAG;AACjC,QAAA,KAAA,CAAM,GAAG,CAAA,GAAI,IAAA;AACb,QAAA,KAAA,IAAS,CAAA;AAAA,MACX,CAAA,MAAO;AACL,QAAA,KAAA,CAAM,GAAG,CAAA,GAAI,IAAA;AAAA,MACf;AACA,MAAA;AAAA,IACF;AACA,IAAA,IAAA,CAAK,KAAK,KAAK,CAAA;AAAA,EACjB;AAEA,EAAA,MAAM,OAAA,GAAU,IAAA,CAAK,CAAC,CAAA,IAAK,MAAA;AAC3B,EAAA,IAAI,UAAA,GAA4B,IAAA;AAChC,EAAA,IAAI,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,CAAC,CAAA;AAC9B,EAAA,IAAI,wBAAA,CAAyB,GAAA,CAAI,OAAO,CAAA,IAAK,WAAA,CAAY,CAAC,CAAA,IAAK,CAAC,WAAA,CAAY,CAAC,CAAA,CAAE,UAAA,CAAW,GAAG,CAAA,EAAG;AAC9F,IAAA,UAAA,GAAa,YAAY,CAAC,CAAA;AAC1B,IAAA,WAAA,GAAc,WAAA,CAAY,MAAM,CAAC,CAAA;AAAA,EACnC;AACA,EAAA,IAAI,KAAA,CAAM,IAAA,KAAS,IAAA,IAAQ,KAAA,CAAM,MAAM,IAAA,EAAM;AAC3C,IAAA,OAAO,EAAE,OAAA,EAAS,OAAA,KAAY,MAAA,GAAS,SAAS,OAAA,EAAS,UAAA,EAAY,WAAA,EAAa,KAAA,EAAO,EAAE,GAAG,KAAA,EAAO,IAAA,EAAM,MAAK,EAAE;AAAA,EACpH;AACA,EAAA,OAAO,EAAE,OAAA,EAAS,UAAA,EAAY,WAAA,EAAa,KAAA,EAAM;AACnD;AAEO,SAAS,UAAA,CAAW,KAAA,EAAyC,IAAA,EAAc,QAAA,GAAW,EAAA,EAAY;AACvG,EAAA,MAAM,KAAA,GAAQ,MAAM,IAAI,CAAA;AACxB,EAAA,OAAO,OAAO,KAAA,KAAU,QAAA,GAAW,KAAA,GAAQ,QAAA;AAC7C;AAEO,SAAS,WAAA,CAAY,OAAyC,IAAA,EAAuB;AAC1F,EAAA,OAAO,KAAA,CAAM,IAAI,CAAA,KAAM,IAAA,IAAQ,KAAA,CAAM,IAAI,CAAA,KAAM,MAAA,IAAU,KAAA,CAAM,IAAI,CAAA,KAAM,GAAA;AAC3E;;;ACtEA,IAAM,aAAA,GAAgB,uCAAA;AACtB,IAAM,gBAAA,GAAmB,uJAAA;AACzB,IAAM,MAAA,GAAS,mCAAA;AACf,IAAM,GAAA,GAAM,gDAAA;AAEL,SAAS,cAAc,KAAA,EAAuB;AACnD,EAAA,OAAO,MACJ,OAAA,CAAQ,MAAA,EAAQ,YAAY,CAAA,CAC5B,QAAQ,GAAA,EAAK,KAAK,CAAA,CAClB,OAAA,CAAQ,eAAe,CAAC,CAAA,EAAG,UAAkB,CAAA,EAAG,KAAA,CAAM,MAAM,CAAA,EAAG,KAAA,CAAM,OAAA,CAAQ,GAAG,IAAI,CAAC,CAAC,CAAA,GAAA,CAAK,CAAA,CAC3F,QAAQ,gBAAA,EAAkB,CAAC,CAAA,EAAG,MAAA,EAAgB,UAAkB,CAAA,EAAG,MAAM,GAAG,KAAK,CAAA,GAAA,EAAM,KAAK,CAAA,CAAE,CAAA;AACnG;AAEO,SAAS,YAAY,KAAA,EAAyB;AACnD,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,OAAO,cAAc,KAAK,CAAA;AACzD,EAAA,IAAI,MAAM,OAAA,CAAQ,KAAK,GAAG,OAAO,KAAA,CAAM,IAAI,WAAW,CAAA;AACtD,EAAA,IAAI,KAAA,IAAS,OAAO,KAAA,KAAU,QAAA,EAAU;AACtC,IAAA,MAAM,OAAA,GAAU,MAAA,CAAO,OAAA,CAAQ,KAAgC,CAAA,CAAE,IAAI,CAAC,CAAC,GAAA,EAAK,MAAM,CAAA,KAAM;AACtF,MAAA,IAAI,WAAA,CAAY,GAAG,CAAA,IAAK,OAAO,WAAW,QAAA,IAAY,MAAA,CAAO,SAAS,CAAA,EAAG;AACvE,QAAA,OAAO,CAAC,KAAK,aAAA,CAAc,MAAM,MAAM,MAAA,GAAS,KAAA,GAAQ,aAAA,CAAc,MAAM,CAAC,CAAA;AAAA,MAC/E;AACA,MAAA,OAAO,CAAC,GAAA,EAAK,WAAA,CAAY,MAAM,CAAC,CAAA;AAAA,IAClC,CAAC,CAAA;AACD,IAAA,OAAO,MAAA,CAAO,YAAY,OAAO,CAAA;AAAA,EACnC;AACA,EAAA,OAAO,KAAA;AACT;AAEO,SAAS,YAAY,GAAA,EAAsB;AAChD,EAAA,OAAO,0EAAA,CAA2E,KAAK,GAAG,CAAA;AAC5F;;;ACnBO,IAAM,gBAAA,GAAmB,0BAAA;AACzB,IAAM,WAAA,GAAc,cAAA;AAoCpB,SAAS,aAAA,GAAuC;AACrD,EAAA,OAAO;AAAA,IACL,eAAA,EAAiB,qCAAA;AAAA,IACjB,mBAAA,EAAqB,uBAAA;AAAA,IACrB,WAAA,EAAa,SAAA;AAAA,IACb,iBAAA,EAAmB,KAAA;AAAA,IACnB,uBAAA,EAAyB,KAAA;AAAA,IACzB,QAAA,EAAU;AAAA,MACR,GAAA,EAAK,EAAA;AAAA,MACL,MAAA,EAAQ,cAAA;AAAA,MACR,mBAAA,EAAqB;AAAA,KACvB;AAAA,IACA,QAAA,EAAU;AAAA,MACR,aAAA,EAAe,EAAA;AAAA,MACf,gBAAA,EAAkB;AAAA,KACpB;AAAA,IACA,OAAA,EAAS;AAAA,MACP,iBAAiB;AAAC,KACpB;AAAA,IACA,OAAA,EAAS;AAAA,MACP,eAAA,EAAiB,WAAA;AAAA,MACjB,KAAA,EAAO,CAAC,EAAE,WAAA,EAAa,aAAa,QAAA,EAAU,WAAA,EAAa,WAAA,EAAa,IAAA,EAAM;AAAA,KAChF;AAAA,IACA,SAAA,EAAW;AAAA,MACT,SAAA,EAAW,gBAAA,CAAiB,SAAA,EAAW,QAAQ,CAAA;AAAA,MAC/C,eAAA,EAAiB,gBAAA,CAAiB,SAAA,EAAW,YAAY,CAAA;AAAA,MACzD,OAAA,EAAS,gBAAA,CAAiB,SAAA,EAAW,YAAY,CAAA;AAAA,MACjD,SAAA,EAAW,gBAAA,CAAiB,SAAA,EAAW,YAAY;AAAA;AACrD,GACF;AACF;AAEA,SAAS,gBAAA,CAAiB,aAAuC,UAAA,EAA8C;AAC7G,EAAA,OAAO;AAAA,IACL,OAAA,EAAS,KAAA;AAAA,IACT,WAAA;AAAA,IACA,SAAA,EAAW,EAAA;AAAA,IACX,aAAA,EAAe,EAAA;AAAA,IACf,cAAA,EAAgB,EAAA;AAAA,IAChB;AAAA,GACF;AACF;AAEO,SAAS,WAAW,GAAA,EAAqB;AAC9C,EAAA,OAAO,IAAA,CAAK,KAAK,gBAAgB,CAAA;AACnC;AAEO,SAAS,WAAW,GAAA,EAAoC;AAC7D,EAAA,MAAM,IAAA,GAAO,WAAW,GAAG,CAAA;AAC3B,EAAA,IAAI,CAAC,UAAA,CAAW,IAAI,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,QAAA,EAAW,gBAAgB,CAAA,0CAAA,CAA4C,CAAA;AAAA,EACzF;AACA,EAAA,MAAM,SAAS,IAAA,CAAK,KAAA,CAAM,YAAA,CAAa,IAAA,EAAM,MAAM,CAAC,CAAA;AACpD,EAAA,OAAO,EAAE,GAAG,aAAA,EAAc,EAAG,GAAG,MAAA,EAAQ,SAAA,EAAW,EAAE,GAAG,eAAc,CAAE,SAAA,EAAW,GAAG,MAAA,CAAO,WAAU,EAAE;AAC3G;AAEO,SAAS,WAAA,CAAY,KAAa,MAAA,EAAuC;AAC9E,EAAA,MAAM,IAAA,GAAO,WAAW,GAAG,CAAA;AAC3B,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC5C,EAAA,aAAA,CAAc,MAAM,CAAA,EAAG,IAAA,CAAK,UAAU,MAAA,EAAQ,IAAA,EAAM,CAAC,CAAC;AAAA,CAAA,EAAM,MAAM,CAAA;AAClE,EAAA,OAAO,IAAA;AACT;AAEO,SAAS,eAAe,MAAA,EAAwC;AACrE,EAAA,OAAO,YAAY,MAAM,CAAA;AAC3B;AAOO,SAAS,sBAAsB,MAAA,EAAqD;AACzF,EAAA,MAAM,SAA+B,EAAC;AACtC,EAAA,IAAI,MAAA,CAAO,oBAAoB,qCAAA,EAAuC;AACpE,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,kBAAA;AAAA,MACN,OAAA,EAAS,CAAA,gBAAA,EAAmB,MAAA,CAAO,eAAe,uBAAuB,qCAAqC,CAAA,CAAA;AAAA,KAC/G,CAAA;AAAA,EACH;AACA,EAAA,IAAI,CAAC,gBAAA,CAAiB,MAAA,CAAO,mBAAA,EAAqB,uBAAuB,CAAA,EAAG;AAC1E,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,qBAAA;AAAA,MACN,OAAA,EAAS,CAAA,qBAAA,EAAwB,MAAA,CAAO,mBAAmB,2BAA2B,uBAAuB,CAAA,CAAA;AAAA,KAC9G,CAAA;AAAA,EACH;AACA,EAAA,IAAI,OAAO,iBAAA,IAAqB,MAAA,CAAO,uBAAA,IAA2B,MAAA,CAAO,gBAAgB,YAAA,EAAc;AACrG,IAAA,MAAA,CAAO,IAAA,CAAK;AAAA,MACV,IAAA,EAAM,qBAAA;AAAA,MACN,OAAA,EAAS;AAAA,KACV,CAAA;AAAA,EACH;AACA,EAAA,OAAO,MAAA;AACT;AAYO,SAAS,4BAA4B,MAAA,EAAkD;AAC5F,EAAA,MAAM,SAA4B,EAAC;AACnC,EAAA,KAAA,MAAW,CAAC,UAAU,WAAW,CAAA,IAAK,OAAO,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,EAAG;AACtE,IAAA,IAAI,CAAC,YAAY,OAAA,EAAS;AAC1B,IAAA,IAAI,YAAY,WAAA,KAAgB,YAAA,IAAgB,mBAAA,CAAoB,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1F,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,QAAA;AAAA,QACA,IAAA,EAAM,+BAAA;AAAA,QACN,OAAA,EAAS,aAAa,QAAQ,CAAA,0FAAA;AAAA,OAC/B,CAAA;AAAA,IACH;AACA,IAAA,IAAI,WAAA,CAAY,SAAA,IAAa,CAAC,sBAAA,CAAuB,WAAA,CAAY,SAAS,CAAA,IAAK,CAAC,mBAAA,CAAoB,WAAA,CAAY,SAAS,CAAA,EAAG;AAC1H,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,QAAA;AAAA,QACA,IAAA,EAAM,4BAAA;AAAA,QACN,OAAA,EAAS,aAAa,QAAQ,CAAA,4EAAA;AAAA,OAC/B,CAAA;AAAA,IACH;AACA,IAAA,IAAI,WAAA,CAAY,iBAAiB,CAAC,WAAA,CAAY,cAAc,UAAA,CAAW,QAAQ,CAAA,IAAK,QAAA,KAAa,WAAA,EAAa;AAC5G,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,QAAA;AAAA,QACA,IAAA,EAAM,sBAAA;AAAA,QACN,OAAA,EAAS,aAAa,QAAQ,CAAA,+EAAA;AAAA,OAC/B,CAAA;AAAA,IACH;AACA,IAAA,IAAI,CAAC,WAAA,CAAY,UAAA,CAAW,IAAA,EAAK,EAAG;AAClC,MAAA,MAAA,CAAO,IAAA,CAAK;AAAA,QACV,QAAA;AAAA,QACA,IAAA,EAAM,qBAAA;AAAA,QACN,OAAA,EAAS,aAAa,QAAQ,CAAA,kCAAA;AAAA,OAC/B,CAAA;AAAA,IACH;AAAA,EACF;AACA,EAAA,OAAO,MAAA;AACT;AAEO,SAAS,oBAAoB,KAAA,EAAwB;AAC1D,EAAA,OAAO,wBAAA,CAAyB,IAAA,CAAK,KAAK,CAAA,IAAM,KAAA,CAAM,UAAA,CAAW,KAAK,CAAA,IAAK,CAAC,KAAA,CAAM,QAAA,CAAS,MAAM,CAAA;AACnG;AAEO,SAAS,uBAAuB,KAAA,EAAwB;AAC7D,EAAA,OAAO,wCAAwC,IAAA,CAAK,KAAK,CAAA,IAAK,KAAA,CAAM,WAAW,YAAY,CAAA;AAC7F;AAEO,SAAS,WAAW,KAAA,EAAiD;AAC1E,EAAA,MAAM,GAAA,GAAM,KAAA,CAAM,GAAA,IAAO,KAAA,CAAM,CAAA;AAC/B,EAAA,OAAO,OAAA,CAAQ,OAAO,GAAA,KAAQ,QAAA,IAAY,GAAA,CAAI,SAAS,CAAA,GAAI,GAAA,GAAM,OAAA,CAAQ,GAAA,EAAK,CAAA;AAChF;AAEO,SAAS,SAAA,CAAU,MAAc,QAAA,EAAwB;AAC9D,EAAA,SAAA,CAAU,QAAQ,IAAI,CAAA,EAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AAC5C,EAAA,aAAA,CAAc,IAAA,EAAM,UAAU,MAAM,CAAA;AACtC;AAEO,SAAS,UAAA,GAAqB;AACnC,EAAA,OAAO,CAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA,CAAA;AAwBT;AC3NA,IAAM,eAAA,GAAkB;AAAA,EACtB,EAAE,OAAA,EAAS,KAAA,EAAO,IAAA,EAAM,MAAA,EAAO;AAAA,EAC/B,EAAE,OAAA,EAAS,KAAA,EAAO,IAAA,EAAM,MAAA,EAAO;AAAA,EAC/B,EAAE,OAAA,EAAS,KAAA,EAAO,IAAA,EAAM,WAAA;AAC1B,CAAA;AAEA,SAAS,mBAAA,GAA8B;AACrC,EAAA,MAAM,IAAA,GAAOA,OAAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AACnD,EAAA,MAAM,UAAA,GAAa;AAAA,IACjBC,IAAAA,CAAK,IAAA,EAAM,IAAA,EAAM,YAAY,CAAA;AAAA,IAC7BA,IAAAA,CAAK,IAAA,EAAM,IAAA,EAAM,IAAA,EAAM,yBAAyB,YAAY;AAAA,GAC9D;AACA,EAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,IAAA,IAAIC,WAAWD,IAAAA,CAAK,SAAA,EAAW,cAAc,CAAC,GAAG,OAAO,SAAA;AAAA,EAC1D;AACA,EAAA,MAAM,IAAI,MAAM,qDAAqD,CAAA;AACvE;AAEA,SAAS,qBAAA,GAAqC;AAC5C,EAAA,MAAM,YAAY,mBAAA,EAAoB;AACtC,EAAA,OAAO,eAAA,CAAgB,GAAA,CAAI,CAAC,IAAA,MAAU;AAAA,IACpC,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,MAAM,IAAA,CAAK,IAAA;AAAA,IACX,EAAA,EAAIE,YAAAA,CAAaF,IAAAA,CAAK,SAAA,EAAW,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,IAAA,CAAM,CAAA,EAAG,MAAM,CAAA;AAAA,IAC5E,IAAA,EAAME,YAAAA,CAAaF,IAAAA,CAAK,SAAA,EAAW,CAAA,EAAG,IAAA,CAAK,OAAO,CAAA,CAAA,EAAI,IAAA,CAAK,IAAI,CAAA,SAAA,CAAW,CAAA,EAAG,MAAM;AAAA,GACrF,CAAE,CAAA;AACJ;AAEO,IAAM,oBAAiC,qBAAA,EAAsB;AAEpE,IAAM,UAAA,GAAa,qCAAA;AAMnB,SAAS,UAAU,GAAA,EAAqB;AACtC,EAAA,OAAOA,IAAAA,CAAK,KAAK,UAAU,CAAA;AAC7B;AAEA,SAAS,UAAU,GAAA,EAA6B;AAC9C,EAAA,MAAM,IAAA,GAAO,UAAU,GAAG,CAAA;AAC1B,EAAA,IAAI,CAACC,WAAW,IAAI,CAAA,SAAU,EAAE,OAAA,EAAS,EAAC,EAAE;AAC5C,EAAA,OAAO,IAAA,CAAK,KAAA,CAAMC,YAAAA,CAAa,IAAA,EAAM,MAAM,CAAC,CAAA;AAC9C;AAEA,SAAS,UAAA,CAAW,KAAa,KAAA,EAA6B;AAC5D,EAAAC,SAAAA,CAAUH,KAAK,GAAA,EAAK,eAAe,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACzD,EAAAI,aAAAA,CAAc,SAAA,CAAU,GAAG,CAAA,EAAG,CAAA,EAAG,KAAK,SAAA,CAAU,KAAA,EAAO,IAAA,EAAM,CAAC,CAAC;AAAA,CAAA,EAAM,MAAM,CAAA;AAC7E;AAEO,SAAS,mBAAA,CAAoB,KAAa,MAAA,EAAuC;AACtF,EAAA,MAAM,SAAA,GAAYJ,IAAAA,CAAK,GAAA,EAAK,MAAA,CAAO,SAAS,mBAAmB,CAAA;AAC/D,EAAAG,SAAAA,CAAU,SAAA,EAAW,EAAE,SAAA,EAAW,MAAM,CAAA;AACxC,EAAA,KAAA,MAAW,aAAa,iBAAA,EAAmB;AACzC,IAAAC,aAAAA,CAAcJ,IAAAA,CAAK,SAAA,EAAW,CAAA,EAAG,SAAA,CAAU,OAAO,CAAA,CAAA,EAAI,SAAA,CAAU,IAAI,CAAA,OAAA,CAAS,CAAA,EAAG,SAAA,CAAU,IAAI,MAAM,CAAA;AACpG,IAAAI,aAAAA,CAAcJ,IAAAA,CAAK,SAAA,EAAW,CAAA,EAAG,SAAA,CAAU,OAAO,CAAA,CAAA,EAAI,SAAA,CAAU,IAAI,CAAA,SAAA,CAAW,CAAA,EAAG,SAAA,CAAU,MAAM,MAAM,CAAA;AAAA,EAC1G;AACA,EAAA,OAAO,SAAA;AACT;AAEO,SAAS,SAAA,CAAU,KAAa,MAAA,EAAqE;AAC1G,EAAA,mBAAA,CAAoB,KAAK,MAAM,CAAA;AAC/B,EAAA,MAAM,KAAA,GAAQ,UAAU,GAAG,CAAA;AAC3B,EAAA,MAAM,UAAoB,EAAC;AAC3B,EAAA,MAAM,MAAgB,EAAC;AACvB,EAAA,KAAA,MAAW,aAAa,iBAAA,EAAmB;AACzC,IAAA,IAAI,KAAA,CAAM,OAAA,CAAQ,QAAA,CAAS,SAAA,CAAU,OAAO,CAAA,EAAG;AAC/C,IAAA,GAAA,CAAI,IAAA,CAAK,UAAU,EAAE,CAAA;AACrB,IAAA,KAAA,CAAM,OAAA,CAAQ,IAAA,CAAK,SAAA,CAAU,OAAO,CAAA;AACpC,IAAA,OAAA,CAAQ,KAAK,CAAA,EAAG,SAAA,CAAU,OAAO,CAAA,CAAA,EAAI,SAAA,CAAU,IAAI,CAAA,CAAE,CAAA;AAAA,EACvD;AACA,EAAA,UAAA,CAAW,KAAK,KAAK,CAAA;AACrB,EAAA,OAAO,EAAE,SAAS,GAAA,EAAI;AACxB;AAEO,SAAS,WAAA,CAAY,KAAa,MAAA,EAA6E;AACpH,EAAA,mBAAA,CAAoB,KAAK,MAAM,CAAA;AAC/B,EAAA,MAAM,KAAA,GAAQ,UAAU,GAAG,CAAA;AAC3B,EAAA,MAAM,OAAA,GAAU,KAAA,CAAM,OAAA,CAAQ,EAAA,CAAG,EAAE,CAAA;AACnC,EAAA,IAAI,CAAC,SAAS,OAAO,EAAE,YAAY,IAAA,EAAM,GAAA,EAAK,EAAC,EAAE;AACjD,EAAA,MAAM,YAAY,iBAAA,CAAkB,IAAA,CAAK,CAAC,IAAA,KAAS,IAAA,CAAK,YAAY,OAAO,CAAA;AAC3E,EAAA,IAAI,CAAC,WAAW,OAAO,EAAE,YAAY,IAAA,EAAM,GAAA,EAAK,EAAC,EAAE;AACnD,EAAA,KAAA,CAAM,UAAU,KAAA,CAAM,OAAA,CAAQ,OAAO,CAAC,IAAA,KAAS,SAAS,OAAO,CAAA;AAC/D,EAAA,UAAA,CAAW,KAAK,KAAK,CAAA;AACrB,EAAA,OAAO,EAAE,UAAA,EAAY,CAAA,EAAG,SAAA,CAAU,OAAO,CAAA,CAAA,EAAI,SAAA,CAAU,IAAI,CAAA,CAAA,EAAI,GAAA,EAAK,CAAC,SAAA,CAAU,IAAI,CAAA,EAAE;AACvF;AAEO,SAAS,kBAAkB,GAAA,EAAuB;AACvD,EAAA,OAAO,SAAA,CAAU,GAAG,CAAA,CAAE,OAAA;AACxB;AAEO,SAAS,oBAAA,CAAqB,KAAa,MAAA,EAAyC;AACzF,EAAA,MAAM,SAAA,GAAYA,IAAAA,CAAK,GAAA,EAAK,MAAA,CAAO,SAAS,mBAAmB,CAAA;AAC/D,EAAA,IAAI,CAACC,UAAAA,CAAW,SAAS,CAAA,SAAU,EAAC;AACpC,EAAA,OAAO,WAAA,CAAY,SAAS,CAAA,CAAE,MAAA,CAAO,CAAC,IAAA,KAAS,IAAA,CAAK,QAAA,CAAS,MAAM,CAAC,CAAA,CAAE,IAAA,EAAK;AAC7E;ACzGO,IAAM,gBAAA,GAAmB,4BAAA;AACzB,IAAM,iBAAA,GAAoB,wBAAA;AAE1B,SAAS,gBAAA,CAAiB,GAAA,EAAa,SAAA,GAAY,CAAA,SAAA,EAAY,iBAAiB,CAAA,CAAA,EAAY;AACjG,EAAA,MAAM,IAAA,GAAOD,IAAAA,CAAK,GAAA,EAAK,SAAS,CAAA;AAChC,EAAA,SAAA,CAAUA,KAAK,IAAA,EAAM,cAAc,CAAA,EAAG,CAAA,EAAG,KAAK,SAAA,CAAU;AAAA,IACtD,IAAA,EAAM,YAAY,iBAAiB,CAAA,CAAA;AAAA,IACnC,OAAA,EAAS,cAAA;AAAA,IACT,OAAA,EAAS,IAAA;AAAA,IACT,IAAA,EAAM,QAAA;AAAA,IACN,OAAA,EAAS,KAAA;AAAA,IACT,WAAA,EAAa,8CAA8C,gBAAgB,CAAA,CAAA,CAAA;AAAA,IAC3E,IAAA,EAAM,gBAAA;AAAA,IACN,YAAA,EAAc;AAAA,MACZ,mCAAA,EAAqC;AAAA;AACvC,GACF,EAAG,IAAA,EAAM,CAAC,CAAC;AAAA,CAAI,CAAA;AACf,EAAA,SAAA,CAAUA,IAAAA,CAAK,IAAA,EAAM,WAAW,CAAA,EAAG,CAAA;;AAAA,2CAAA,EAEQ,gBAAgB,CAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA,CAS5D,CAAA;AACC,EAAA,SAAA,CAAUA,IAAAA,CAAK,IAAA,EAAM,iBAAiB,CAAA,EAAG,CAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA,aAAA,EAU5B,iBAAiB,CAAA;AAAA;AAAA;AAAA,uBAAA,EAGP,gBAAgB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CA4BxC,CAAA;AACC,EAAA,SAAA,CAAUA,IAAAA,CAAK,IAAA,EAAM,cAAc,CAAA,EAAG,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA,uBAAA,EAyBf,iBAAiB,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA,iCAAA,EAeP,gBAAgB,CAAA;AAAA,kFAAA,EACiC,gBAAgB,CAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAAA,EAuBlE,gBAAgB,CAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAuCjD,CAAA;AACC,EAAA,OAAO,IAAA;AACT;;;ACzIA,eAAsB,SAAS,MAAA,EAA4C;AACzE,EAAA,IAAI,MAAA,CAAO,MAAM,IAAA,KAAS,IAAA,IAAQ,OAAO,OAAA,KAAY,MAAA,IAAU,MAAA,CAAO,OAAA,KAAY,QAAA,EAAU;AAC1F,IAAA,OAAO,EAAA,CAAG,OAAO,CAAA;AAAA,EACnB;AACA,EAAA,IAAI,MAAA,CAAO,OAAA,KAAY,SAAA,IAAa,MAAA,CAAO,KAAA,CAAM,YAAY,IAAA,IAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,KAAM,IAAA,EAAM;AAC5F,IAAA,OAAO,EAAA,CAAG,GAAG,WAAW;AAAA,CAAI,CAAA;AAAA,EAC9B;AACA,EAAA,QAAQ,OAAO,OAAA;AAAS,IACtB,KAAK,MAAA;AACH,MAAA,OAAO,QAAQ,MAAM,CAAA;AAAA,IACvB,KAAK,QAAA;AACH,MAAA,OAAO,OAAO,UAAA,KAAe,UAAA,GAAa,iBAAA,CAAkB,MAAM,IAAI,IAAA,CAAK,CAAA;AAAA,CAAoD,CAAA;AAAA,IACjI,KAAK,QAAA;AACH,MAAA,OAAO,UAAU,MAAM,CAAA;AAAA,IACzB,KAAK,IAAA;AACH,MAAA,IAAI,MAAA,CAAO,UAAA,KAAe,SAAA,EAAW,OAAO,aAAa,MAAM,CAAA;AAC/D,MAAA,IAAI,MAAA,CAAO,UAAA,KAAe,UAAA,EAAY,OAAO,cAAc,MAAM,CAAA;AACjE,MAAA,OAAO,KAAK,0DAA0D,CAAA;AAAA,IACxE,KAAK,UAAA;AACH,MAAA,IAAI,MAAA,CAAO,UAAA,KAAe,UAAA,EAAY,OAAO,oBAAoB,MAAM,CAAA;AACvE,MAAA,IAAI,MAAA,CAAO,UAAA,KAAe,aAAA,EAAe,OAAO,uBAAuB,MAAM,CAAA;AAC7E,MAAA,OAAO,KAAK,gFAAgF,CAAA;AAAA,IAC9F,KAAK,UAAA;AACH,MAAA,OAAO,OAAO,UAAA,KAAe,UAAA,GAAa,oBAAoB,MAAM,CAAA,GAAI,KAAK,sDAAsD,CAAA;AAAA,IACrI,KAAK,KAAA;AACH,MAAA,OAAO,OAAO,MAAM,CAAA;AAAA,IACtB,KAAK,SAAA;AACH,MAAA,OAAO,OAAO,UAAA,KAAe,QAAA,GAAW,iBAAiB,MAAM,CAAA,GAAI,KAAK,kDAAkD,CAAA;AAAA,IAC5H;AACE,MAAA,OAAO,IAAA,CAAK,CAAA,iBAAA,EAAoB,MAAA,CAAO,OAAO,CAAA;;AAAA,EAAS,KAAA,EAAO,CAAA,CAAE,CAAA;AAAA;AAEtE;AAEA,SAAS,QAAQ,MAAA,EAAmC;AAClD,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,MAAM,KAAA,GAAQ,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO,OAAO,CAAA;AAC/C,EAAA,MAAM,SAAS,aAAA,EAAc;AAC7B,EAAA,MAAM,IAAA,GAAOA,IAAAA,CAAK,GAAA,EAAK,0BAA0B,CAAA;AACjD,EAAA,IAAIC,UAAAA,CAAW,IAAI,CAAA,IAAK,CAAC,KAAA,EAAO;AAC9B,IAAA,OAAO,IAAA,CAAK,yBAAyB,IAAI,CAAA;AAAA,CAAiC,CAAA;AAAA,EAC5E;AACA,EAAA,WAAA,CAAY,KAAK,MAAM,CAAA;AACvB,EAAA,SAAA,CAAUD,IAAAA,CAAK,GAAA,EAAK,cAAc,CAAA,EAAG,YAAY,CAAA;AACjD,EAAA,SAAA,CAAUA,IAAAA,CAAK,GAAA,EAAK,wBAAwB,CAAA,EAAG,EAAE,CAAA;AACjD,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,8DAAA;AAAA,IACA,SAAS,IAAI,CAAA,CAAA;AAAA,IACb,+CAAA;AAAA,IACA,2EAAA;AAAA,IACA,gFAAA;AAAA,IACA,2EAAA;AAAA,IACA;AAAA,GACF,CAAE,KAAK,IAAI,CAAA;AACX,EAAA,OAAO,GAAG,MAAM,CAAA;AAClB;AAEA,SAAS,kBAAkB,MAAA,EAAmC;AAC5D,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,WAAW,GAAG,CAAA;AAC7B,EAAA,MAAM,aAAA,GAAgB,sBAAsB,MAAM,CAAA;AAClD,EAAA,MAAM,WAAA,GAAc,4BAA4B,MAAM,CAAA;AACtD,EAAA,MAAM,OAAO,IAAA,CAAK,SAAA,CAAU,eAAe,MAAM,CAAA,EAAG,MAAM,CAAC,CAAA;AAC3D,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,CAAA,gBAAA,EAAmB,MAAA,CAAO,eAAe,CAAA,qBAAA,EAAwB,OAAO,mBAAmB,CAAA,CAAA;AAAA,IAC3F,CAAA,kBAAA,EAAqB,MAAA,CAAO,iBAAiB,CAAA,yBAAA,EAA4B,OAAO,uBAAuB,CAAA,CAAA;AAAA,IACvG,wGAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAI,aAAA,CAAc,MAAA,IAAU,WAAA,CAAY,MAAA,EAAQ;AAC9C,IAAA,KAAA,MAAW,KAAA,IAAS,aAAA,EAAe,KAAA,CAAM,IAAA,CAAK,CAAA,MAAA,EAAS,MAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AACrF,IAAA,KAAA,MAAW,KAAA,IAAS,WAAA,EAAa,KAAA,CAAM,IAAA,CAAK,CAAA,MAAA,EAAS,KAAA,CAAM,QAAQ,CAAA,CAAA,EAAI,KAAA,CAAM,IAAI,CAAA,EAAA,EAAK,KAAA,CAAM,OAAO,CAAA,CAAE,CAAA;AACrG,IAAA,OAAO,EAAE,UAAU,CAAA,EAAG,MAAA,EAAQ,cAAc,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA,EAAG,QAAQ,EAAA,EAAG;AAAA,EACnF;AACA,EAAA,KAAA,CAAM,KAAK,iDAAiD,CAAA;AAC5D,EAAA,OAAO,EAAA,CAAG,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA;AACnC;AAEA,SAAS,UAAU,MAAA,EAAmC;AACpD,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,WAAW,GAAG,CAAA;AAC7B,EAAA,MAAM,MAAA,GAAS;AAAA,IACb,gBAAA,CAAiB,QAAQ,GAAG,CAAA;AAAA,IAC5B,iBAAiB,MAAM,CAAA;AAAA,IACvB,kBAAkB,MAAM,CAAA;AAAA,IACxB,oBAAoB,MAAM,CAAA;AAAA,IAC1B,gBAAgB,MAAM;AAAA,GACxB;AACA,EAAA,MAAM,KAAA,GAAQ,CAAC,6BAAA,EAA+B,GAAG,OAAO,GAAA,CAAI,CAAC,UAAU,CAAA,EAAG,KAAA,CAAM,KAAK,IAAA,GAAO,MAAM,KAAK,KAAA,CAAM,IAAI,KAAK,KAAA,CAAM,MAAM,EAAE,CAAC,CAAA;AACrI,EAAA,MAAM,SAAS,MAAA,CAAO,IAAA,CAAK,CAAC,KAAA,KAAU,CAAC,MAAM,EAAE,CAAA;AAC/C,EAAA,OAAO,EAAE,QAAA,EAAU,MAAA,GAAS,CAAA,GAAI,CAAA,EAAG,MAAA,EAAQ,aAAA,CAAc,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA,EAAG,QAAQ,EAAA,EAAG;AAChG;AAEA,SAAS,gBAAA,CAAiB,QAA+B,GAAA,EAAa;AACpE,EAAA,MAAM,OAAA,GAAU,kBAAkB,GAAG,CAAA;AACrC,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,MAAA,EAAQ;AAC3B,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,IAAA,EAAM,UAAA,EAAY,QAAQ,uBAAA,EAAwB;AAAA,EACxE;AACA,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,GAAA,EAAK;AACxB,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,IAAA;AAAA,MACJ,IAAA,EAAM,UAAA;AAAA,MACN,MAAA,EAAQ,CAAA,yBAAA,EAA4B,MAAA,CAAO,QAAA,CAAS,MAAM,6CAA6C,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAA,IAAK,MAAM,CAAA,CAAA;AAAA,KACrI;AAAA,EACF;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAA,CAAO,SAAS,GAAG,CAAA;AACvC,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,GAAA,CAAI,QAAA,KAAa,WAAA,IAAe,IAAI,QAAA,KAAa,aAAA;AAAA,MACrD,IAAA,EAAM,UAAA;AAAA,MACN,QAAQ,CAAA,KAAA,EAAQ,GAAA,CAAI,QAAQ,CAAA,QAAA,EAAW,MAAA,CAAO,SAAS,MAAM,CAAA,oDAAA;AAAA,KAC/D;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,IAAA,EAAM,UAAA,EAAY,QAAQ,4DAAA,EAA6D;AAAA,EAC7G;AACF;AAEA,SAAS,iBAAiB,MAAA,EAA+B;AACvD,EAAA,IAAI,CAAC,MAAA,CAAO,QAAA,CAAS,aAAA,EAAe;AAClC,IAAA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,IAAA,EAAM,SAAA,EAAW,QAAQ,gEAAA,EAAiE;AAAA,EAC/G;AACA,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,IAAI,GAAA,CAAI,MAAA,CAAO,SAAS,aAAa,CAAA;AACjD,IAAA,MAAM,OAAA,GAAU,IAAI,QAAA,KAAa,QAAA,IAAY,IAAI,QAAA,KAAa,WAAA,IAAe,IAAI,QAAA,KAAa,WAAA;AAC9F,IAAA,OAAO;AAAA,MACL,EAAA,EAAI,OAAA;AAAA,MACJ,IAAA,EAAM,SAAA;AAAA,MACN,MAAA,EAAQ,UACJ,CAAA,gBAAA,EAAmB,GAAA,CAAI,MAAM,CAAA,WAAA,EAAc,MAAA,CAAO,QAAA,CAAS,gBAAgB,CAAA,EAAA,CAAA,GAC3E;AAAA,KACN;AAAA,EACF,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,QAAQ,kCAAA,EAAmC;AAAA,EAClF;AACF;AAEA,SAAS,kBAAkB,MAAA,EAA+B;AACxD,EAAA,MAAM,WAAA,GAAc,4BAA4B,MAAM,CAAA;AACtD,EAAA,MAAM,OAAA,GAAU,OAAO,OAAA,CAAQ,MAAA,CAAO,SAAS,CAAA,CAAE,MAAA,CAAO,CAAC,GAAG,KAAK,CAAA,KAAM,KAAA,CAAM,OAAO,CAAA,CAAE,GAAA,CAAI,CAAC,CAAC,IAAI,MAAM,IAAI,CAAA;AAC1G,EAAA,IAAI,YAAY,MAAA,EAAQ;AACtB,IAAA,OAAO,EAAE,IAAI,KAAA,EAAO,IAAA,EAAM,YAAY,MAAA,EAAQ,WAAA,CAAY,IAAI,CAAC,KAAA,KAAU,GAAG,KAAA,CAAM,QAAQ,IAAI,KAAA,CAAM,IAAI,EAAE,CAAA,CAAE,IAAA,CAAK,IAAI,CAAA,EAAE;AAAA,EACzH;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,IAAA,EAAM,UAAA;AAAA,IACN,MAAA,EAAQ,QAAQ,MAAA,GACZ,CAAA,2BAAA,EAA8B,QAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,kCAAA,CAAA,GAChD;AAAA,GACN;AACF;AAEA,SAAS,oBAAoB,MAAA,EAA+B;AAC1D,EAAA,MAAM,IAAA,GAAO,MAAA,CAAO,IAAA,CAAK,MAAA,CAAO,QAAQ,eAAe,CAAA;AACvD,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,IAAA,EAAM,aAAA;AAAA,IACN,MAAA,EAAQ,KAAK,MAAA,GACT,CAAA,6BAAA,EAAgC,KAAK,IAAA,CAAK,IAAI,CAAC,CAAA,kBAAA,CAAA,GAC/C;AAAA,GACN;AACF;AAEA,SAAS,gBAAgB,MAAA,EAA+B;AACtD,EAAA,IAAI,CAAC,MAAA,CAAO,OAAA,CAAQ,eAAA,EAAiB;AACnC,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,QAAQ,8BAAA,EAA+B;AAAA,EAC9E;AACA,EAAA,MAAM,KAAA,GAAQ,MAAA,CAAO,SAAA,CAAU,MAAA,CAAO,QAAQ,eAAe,CAAA;AAC7D,EAAA,IAAI,CAAC,KAAA,IAAS,MAAA,CAAO,OAAA,CAAQ,oBAAoB,WAAA,EAAa;AAC5D,IAAA,OAAO,EAAE,EAAA,EAAI,KAAA,EAAO,IAAA,EAAM,SAAA,EAAW,QAAQ,CAAA,kBAAA,EAAqB,MAAA,CAAO,OAAA,CAAQ,eAAe,CAAA,uBAAA,CAAA,EAA0B;AAAA,EAC5H;AACA,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,IAAA;AAAA,IACJ,IAAA,EAAM,SAAA;AAAA,IACN,MAAA,EAAQ,WAAW,MAAA,CAAO,OAAA,CAAQ,eAAe,CAAA,EAAA,EAAK,MAAA,CAAO,OAAA,CAAQ,KAAA,CAAM,MAAM,CAAA,iDAAA;AAAA,GACnF;AACF;AAEA,SAAS,aAAa,MAAA,EAAmC;AACvD,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,WAAW,GAAG,CAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,SAAA,CAAU,GAAA,EAAK,MAAM,CAAA;AACpC,EAAA,MAAM,KAAA,GAAQ,oBAAA,CAAqB,GAAA,EAAK,MAAM,CAAA;AAC9C,EAAA,OAAO,EAAA,CAAG;AAAA,IACR,MAAA,CAAO,QAAQ,MAAA,GAAS,CAAA,QAAA,EAAW,OAAO,OAAA,CAAQ,IAAA,CAAK,IAAI,CAAC,CAAA,CAAA,CAAA,GAAM,wBAAA;AAAA,IAClE,6BAA6B,MAAA,CAAO,QAAA,CAAS,mBAAmB,CAAA,EAAA,EAAK,MAAM,MAAM,CAAA,QAAA,CAAA;AAAA,IACjF,yFAAA;AAAA,IACA;AAAA,GACF,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AACd;AAEA,SAAS,cAAc,MAAA,EAAmC;AACxD,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,WAAW,GAAG,CAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,WAAA,CAAY,GAAA,EAAK,MAAM,CAAA;AACtC,EAAA,OAAO,EAAA,CAAG,MAAA,CAAO,UAAA,GACb,CAAA,YAAA,EAAe,OAAO,UAAU,CAAA;AAAA,CAAA,GAChC,uCAAuC,CAAA;AAC7C;AAEA,SAAS,oBAAoB,MAAA,EAAmC;AAC9D,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,MAAM,SAAA,GAAY,WAAW,MAAA,CAAO,KAAA,EAAO,KAAK,CAAA,IAAK,MAAA,CAAO,YAAY,CAAC,CAAA;AACzE,EAAA,MAAM,IAAA,GAAO,gBAAA,CAAiB,GAAA,EAAK,SAAS,CAAA;AAC5C,EAAA,OAAO,EAAA,CAAG;AAAA,IACR,sCAAsC,IAAI,CAAA,CAAA;AAAA,IAC1C,mBAAmB,gBAAgB,CAAA,CAAA;AAAA,IACnC,0EAAA;AAAA,IACA;AAAA,GACF,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AACd;AAEA,eAAe,uBAAuB,MAAA,EAA4C;AAChF,EAAA,MAAM,OAAA,GAAU;AAAA,IACd,SAAA,EAAW,qBAAA;AAAA,IACX,gBAAA,EAAkB,wBAAA;AAAA,IAClB,WAAA,EAAa,WAAA;AAAA,IACb,WAAA,EAAa,IAAA;AAAA,IACb,cAAA,EAAgB,sBAAA;AAAA,IAChB,qBAAA,EAAuB;AAAA,GACzB;AACA,EAAA,MAAM,UAAA,GAAa,UAAA,CAAW,MAAA,CAAO,KAAA,EAAO,QAAQ,CAAA;AACpD,EAAA,MAAM,QAAkB,EAAC;AACzB,EAAA,IAAI;AACF,IAAA,IAAI,CAAC,UAAA,EAAY;AACf,MAAA,MAAM,OAAA,GAAU,6BAA6B,gBAAgB,CAAA;AAC7D,MAAA,MAAMK,QAAAA,GAAU,MAAM,qBAAA,CAAsB,OAAA,EAAS,OAAO,CAAA;AAC5D,MAAA,KAAA,CAAM,IAAA;AAAA,QACJ,mGAAA;AAAA,QACA,mFAAA;AAAA,QACA,GAAG,kBAAkBA,QAAO;AAAA,OAC9B;AACA,MAAA,MAAMC,UAASD,QAAAA,CAAQ,MAAA,CAAO,CAAC,MAAA,KAAW,CAAC,OAAO,MAAM,CAAA;AACxD,MAAA,OAAO,EAAE,QAAA,EAAUC,OAAAA,CAAO,MAAA,GAAS,CAAA,GAAI,CAAA,EAAG,MAAA,EAAQ,aAAA,CAAc,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA,EAAG,QAAQ,EAAA,EAAG;AAAA,IACvG;AAEA,IAAA,MAAM,SAAS,MAAM,qBAAA,CAAsB,YAAY,UAAA,CAAW,MAAA,CAAO,KAAK,CAAC,CAAA;AAC/E,IAAA,MAAM,OAAA,GAAU,MAAM,qBAAA,CAAsB,MAAA,CAAO,SAAS,OAAO,CAAA;AACnE,IAAA,KAAA,CAAM,IAAA;AAAA,MACJ,gDAAgD,UAAU,CAAA,CAAA,CAAA;AAAA,MAC1D,yFAAA;AAAA,MACA,GAAG,kBAAkB,OAAO;AAAA,KAC9B;AACA,IAAA,IAAI,OAAO,OAAA,EAAS;AAClB,MAAA,MAAM,SAAA,GAAY,MAAM,8BAAA,CAA+B,MAAA,CAAO,SAAS,OAAO,CAAA;AAC9E,MAAA,KAAA,CAAM,IAAA,CAAK,kEAAA,EAAoE,GAAG,iBAAA,CAAkB,SAAS,CAAC,CAAA;AAC9G,MAAA,OAAA,CAAQ,IAAA,CAAK,GAAG,SAAS,CAAA;AAAA,IAC3B;AACA,IAAA,MAAM,SAAS,OAAA,CAAQ,MAAA,CAAO,CAAC,MAAA,KAAW,CAAC,OAAO,MAAM,CAAA;AACxD,IAAA,OAAO,EAAE,QAAA,EAAU,MAAA,CAAO,MAAA,GAAS,CAAA,GAAI,CAAA,EAAG,MAAA,EAAQ,aAAA,CAAc,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA,EAAG,QAAQ,EAAA,EAAG;AAAA,EACvG,SAAS,KAAA,EAAO;AACd,IAAA,MAAM,MAAA,GAAS,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,qCAAA;AACxD,IAAA,OAAO,IAAA,CAAK,uCAAuC,MAAM;AAAA,CAAI,CAAA;AAAA,EAC/D;AACF;AAEA,SAAS,kBAAkB,OAAA,EAA8E;AACvG,EAAA,OAAO,OAAA,CAAQ,IAAI,CAAC,MAAA,KAAW,GAAG,MAAA,CAAO,MAAA,GAAS,SAAS,MAAM,CAAA,EAAA,EAAK,OAAO,IAAI,CAAA,EAAG,OAAO,MAAA,GAAS,CAAA,EAAA,EAAK,OAAO,MAAM,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AACjI;AAEA,eAAe,qBAAA,CACb,YACA,GAAA,EACgG;AAChG,EAAA,MAAM,WAAW,UAAA,CAAW,UAAU,IAAI,UAAA,GAAaC,OAAAA,CAAQ,KAAK,UAAU,CAAA;AAC9E,EAAA,MAAM,QAAA,GAAW,MAAM,OAAO,aAAA,CAAc,QAAQ,CAAA,CAAE,IAAA,CAAA;AACtD,EAAA,MAAM,gBAAA,GAAmB,YAAA;AAAA,IACvB,QAAA,CAAS,wBAAA;AAAA,IACT,QAAA,CAAS,aAAA;AAAA,IACT,QAAA,CAAS;AAAA,GACX;AACA,EAAA,MAAM,iBAAA,GAAoB,OAAO,gBAAA,KAAqB,UAAA,IAAc,iBAAiB,MAAA,IAAU,CAAA;AAC/F,EAAA,MAAM,OAAA,GAAU,UAAU,QAAA,CAAS,OAAO,IACtC,QAAA,CAAS,OAAA,GACT,UAAU,QAAA,CAAS,aAAa,IAC9B,QAAA,CAAS,aAAA,GACT,OAAO,gBAAA,KAAqB,UAAA,GAC1B,MAAO,gBAAA,CAAoD,iBAAA,GAAoB,gBAAA,GAAmB,MAAS,CAAA,GAC3G,IAAA;AACR,EAAA,IAAI,CAAC,SAAA,CAAU,OAAO,CAAA,EAAG;AACvB,IAAA,MAAM,IAAI,MAAM,mFAAmF,CAAA;AAAA,EACrG;AACA,EAAA,OAAO;AAAA,IACL,OAAA;AAAA,IACA,OAAA,EAAS,oBAAqB,gBAAA,GAAyD;AAAA,GACzF;AACF;AAEA,SAAS,gBAAgB,UAAA,EAA+D;AACtF,EAAA,KAAA,MAAW,aAAa,UAAA,EAAY;AAClC,IAAA,IAAI,OAAO,SAAA,KAAc,UAAA,EAAY,OAAO,SAAA;AAAA,EAC9C;AACA,EAAA,OAAO,IAAA;AACT;AAEA,SAAS,UAAU,KAAA,EAAgD;AACjE,EAAA,OAAO,OAAA,CAAQ,KAAK,CAAA,IACf,OAAO,KAAA,KAAU,QAAA,IACjB,OAAQ,KAAA,CAAgC,aAAA,KAAkB,UAAA,IAC1D,OAAQ,KAAA,CAAgC,eAAA,KAAoB,UAAA;AACnE;AAEA,SAAS,oBAAoB,MAAA,EAAmC;AAC9D,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,WAAW,GAAG,CAAA;AAC7B,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,KAAA,EAAO,OAAO,wCAAwC,CAAA;AACpF,EAAA,MAAM,QAAA,GAAW,CAAA;AAAA,kDAAA,EACiC,IAAA,CAAK,SAAA,CAAUC,qCAAqC,CAAC,CAAA;AAAA,iDAAA,EACtD,IAAA,CAAK,SAAA,CAAUC,uBAAuB,CAAC,CAAA;AAAA,sCAAA,EAClD,IAAA,CAAK,SAAA,CAAU,WAAW,CAAC,CAAA;AAAA,oCAAA,EAC7B,IAAA,CAAK,SAAA,CAAU,sBAAA,EAAwB,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,wCAAA,EAC3C,IAAA,CAAK,SAAA,CAAU,0BAAA,EAA4B,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,iCAAA,EAC1D,IAAA,CAAK,SAAA,CAAU,kBAAA,EAAoB,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA,mCAAA,EACzC,IAAA,CAAK,UAAU,MAAA,CAAO,IAAA,CAAK,OAAO,SAAS,CAAA,EAAG,IAAA,EAAM,CAAC,CAAC,CAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAKzF,EAAA,SAAA,CAAUT,IAAAA,CAAK,GAAA,EAAK,GAAG,CAAA,EAAG,QAAQ,CAAA;AAClC,EAAA,OAAO,EAAA,CAAG,wBAAwB,GAAG,CAAA;AAAA,CAAoC,CAAA;AAC3E;AAEA,SAAS,OAAO,MAAA,EAAmC;AACjD,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,MAAM,MAAA,GAAS,WAAW,GAAG,CAAA;AAC7B,EAAA,IAAI,MAAA,CAAO,iBAAA,IAAqB,MAAA,CAAO,uBAAA,EAAyB;AAC9D,IAAA,OAAO,KAAK,yFAAyF,CAAA;AAAA,EACvG;AACA,EAAA,MAAM,IAAA,GAAO,OAAO,UAAA,CAAW,MAAA,CAAO,OAAO,MAAA,EAAQ,MAAM,CAAC,CAAA,IAAK,IAAA;AACjE,EAAA,IAAI,WAAA,CAAY,MAAA,CAAO,KAAA,EAAO,YAAY,CAAA,EAAG;AAC3C,IAAA,OAAO,EAAA,CAAG,6CAA6C,IAAI,CAAA;AAAA,CAAsC,CAAA;AAAA,EACnG;AACA,EAAA,MAAM,MAAA,GAAS,YAAA,CAAa,CAAC,OAAA,EAAS,QAAA,KAAa;AACjD,IAAA,KAAK,gBAAA,CAAiB,SAAS,QAAQ,CAAA;AAAA,EACzC,CAAC,CAAA;AACD,EAAA,MAAA,CAAO,MAAA,CAAO,MAAM,WAAW,CAAA;AAC/B,EAAA,OAAO,EAAA,CAAG,qDAAqD,IAAI;AAAA;AAAA,CAAsE,CAAA;AAC3I;AAEA,eAAe,gBAAA,CAAiB,SAA0B,QAAA,EAAyC;AACjG,EAAA,MAAM,MAAM,IAAI,GAAA,CAAI,OAAA,CAAQ,GAAA,IAAO,KAAK,kBAAkB,CAAA;AAC1D,EAAA,IAAI,GAAA,CAAI,aAAa,SAAA,EAAW;AAC9B,IAAA,IAAA,CAAK,QAAA,EAAU,KAAK,EAAE,EAAA,EAAI,MAAM,WAAA,EAAa,SAAA,EAAW,uBAAA,EAAyB,KAAA,EAAO,CAAA;AACxF,IAAA;AAAA,EACF;AACA,EAAA,IAAI,GAAA,CAAI,SAAS,UAAA,CAAW,MAAM,KAAK,GAAA,CAAI,QAAA,CAAS,UAAA,CAAW,cAAc,CAAA,EAAG;AAC9E,IAAA,IAAA,CAAK,QAAA,EAAU,GAAA,EAAK,EAAE,KAAA,EAAO,8BAA8B,CAAA;AAC3D,IAAA;AAAA,EACF;AACA,EAAA,IAAI,OAAA,CAAQ,MAAA,KAAW,MAAA,IAAU,GAAA,CAAI,aAAa,mBAAA,EAAqB;AACrE,IAAA,MAAM,OAAA,GAAU,6BAA6B,gBAAgB,CAAA;AAC7D,IAAA,MAAM,OAAA,GAAU,MAAM,OAAA,CAAQ,aAAA,CAAc;AAAA,MAC1C,SAAA,EAAW,eAAA;AAAA,MACX,gBAAA,EAAkB,gBAAA;AAAA,MAClB,WAAA,EAAa,WAAA;AAAA,MACb,WAAA,EAAa,IAAA;AAAA,MACb,cAAA,EAAgB,gBAAA;AAAA,MAChB,qBAAA,EAAuB;AAAA,KACxB,CAAA;AACD,IAAA,IAAA,CAAK,QAAA,EAAU,KAAK,WAAA,CAAY;AAAA,MAC9B,WAAW,OAAA,CAAQ,SAAA;AAAA,MACnB,oBAAoB,OAAA,CAAQ,kBAAA;AAAA,MAC5B,iBAAiB,OAAA,CAAQ,eAAA;AAAA,MACzB,WAAA,EAAa,QAAQ,MAAA,CAAO;AAAA,KAC7B,CAAC,CAAA;AACF,IAAA;AAAA,EACF;AACA,EAAA,IAAA,CAAK,QAAA,EAAU,GAAA,EAAK,EAAE,KAAA,EAAO,aAAa,CAAA;AAC5C;AAEA,SAAS,IAAA,CAAK,QAAA,EAA0B,MAAA,EAAgB,IAAA,EAAqB;AAC3E,EAAA,QAAA,CAAS,SAAA,CAAU,MAAA,EAAQ,EAAE,cAAA,EAAgB,oBAAoB,CAAA;AACjE,EAAA,QAAA,CAAS,GAAA,CAAI,CAAA,EAAG,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC;AAAA,CAAI,CAAA;AAC1C;AAEA,SAAS,iBAAiB,MAAA,EAAmC;AAC3D,EAAA,MAAM,GAAA,GAAM,UAAA,CAAW,MAAA,CAAO,KAAK,CAAA;AACnC,EAAA,MAAM,KAAA,GAAQ;AAAA,IACZ,CAAA,IAAA,EAAO,WAAW,CAAA,UAAA,EAAaQ,qCAAqC,WAAWC,uBAAuB,CAAA,CAAA;AAAA,IACtG,oFAAA;AAAA,IACA,gFAAA;AAAA,IACA;AAAA,GACF;AACA,EAAA,IAAIR,UAAAA,CAAWD,IAAAA,CAAK,GAAA,EAAK,0BAA0B,CAAC,CAAA,EAAG;AACrD,IAAA,MAAM,MAAA,GAAS,WAAW,GAAG,CAAA;AAC7B,IAAA,IAAI,MAAA,CAAO,iBAAA,IAAqB,MAAA,CAAO,uBAAA,EAAyB;AAC9D,MAAA,OAAO,IAAA,CAAK,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA;AAAA,CAAmF,CAAA;AAAA,IACpH;AAAA,EACF;AACA,EAAA,KAAA,CAAM,KAAK,2BAA2B,CAAA;AACtC,EAAA,OAAO,EAAA,CAAG,CAAA,EAAG,KAAA,CAAM,IAAA,CAAK,IAAI,CAAC;AAAA,CAAI,CAAA;AACnC;AAEA,SAAS,KAAA,GAAgB;AACvB,EAAA,OAAO,wBAAwB,WAAW;;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,8DAAA,EAUoB,gBAAgB,CAAA;AAAA;AAAA;AAAA;AAAA;;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhF;AAEA,SAAS,GAAG,MAAA,EAA+B;AACzC,EAAA,OAAO,EAAE,UAAU,CAAA,EAAG,MAAA,EAAQ,cAAc,MAAM,CAAA,EAAG,QAAQ,EAAA,EAAG;AAClE;AAEA,SAAS,KAAK,MAAA,EAA+B;AAC3C,EAAA,OAAO,EAAE,UAAU,CAAA,EAAG,MAAA,EAAQ,IAAI,MAAA,EAAQ,aAAA,CAAc,MAAM,CAAA,EAAE;AAClE;;;ACtcA,eAAsB,GAAA,CAAI,IAAA,GAAiB,OAAA,CAAQ,IAAA,EAA8B;AAC/E,EAAA,MAAM,MAAA,GAAS,UAAU,IAAI,CAAA;AAC7B,EAAA,OAAO,SAAS,MAAM,CAAA;AACxB;AAEA,IAAM,MAAA,GAAS,OAAA,CAAQ,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAC,CAAA,IAAK,MAAA,CAAA,IAAA,CAAY,GAAA,KAAQU,aAAAA,CAAc,OAAA,CAAQ,IAAA,CAAK,CAAC,CAAE,CAAA,CAAE,IAAA;AAE/F,IAAI,MAAA,EAAQ;AACV,EAAA,KAAK,GAAA,EAAI,CAAE,IAAA,CAAK,CAAC,MAAA,KAAW;AAC1B,IAAA,IAAI,OAAO,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,OAAO,MAAM,CAAA;AACrD,IAAA,IAAI,OAAO,MAAA,EAAQ,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,OAAO,MAAM,CAAA;AACrD,IAAA,MAAM,MAAA,GAAS,SAAA,CAAU,OAAA,CAAQ,IAAI,CAAA;AACrC,IAAA,IAAI,MAAA,CAAO,OAAA,KAAY,KAAA,IAAS,MAAA,CAAO,KAAA,CAAM,YAAY,CAAA,KAAM,IAAA,IAAQ,MAAA,CAAO,QAAA,KAAa,CAAA,EAAG;AAC5F,MAAA;AAAA,IACF;AACA,IAAA,OAAA,CAAQ,IAAA,CAAK,OAAO,QAAQ,CAAA;AAAA,EAC9B,CAAC,CAAA,CAAE,KAAA,CAAM,CAAC,KAAA,KAAmB;AAC3B,IAAA,MAAM,OAAA,GAAU,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,sBAAA;AACzD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,EAAG,OAAO;AAAA,CAAI,CAAA;AACnC,IAAA,OAAA,CAAQ,KAAK,CAAC,CAAA;AAAA,EAChB,CAAC,CAAA;AACH","file":"cli.js","sourcesContent":["export interface ParsedArgv {\n  command: string;\n  subcommand: string | null;\n  positionals: string[];\n  flags: Record<string, string | boolean>;\n}\n\nconst COMMANDS_WITH_SUBCOMMAND = new Set(['config', 'db', 'provider', 'registry', 'release']);\n\nexport function parseArgv(argv: string[]): ParsedArgv {\n  const tokens = argv.slice(2);\n  const flags: Record<string, string | boolean> = {};\n  const rest: string[] = [];\n\n  for (let index = 0; index < tokens.length; index += 1) {\n    const token = tokens[index]!;\n    if (token === '--') {\n      rest.push(...tokens.slice(index + 1));\n      break;\n    }\n    if (token.startsWith('--')) {\n      const eq = token.indexOf('=');\n      if (eq !== -1) {\n        flags[token.slice(2, eq)] = token.slice(eq + 1);\n        continue;\n      }\n      const key = token.slice(2);\n      const next = tokens[index + 1];\n      if (next && !next.startsWith('-')) {\n        flags[key] = next;\n        index += 1;\n      } else {\n        flags[key] = true;\n      }\n      continue;\n    }\n    if (token.startsWith('-') && token.length === 2) {\n      const key = token.slice(1);\n      const next = tokens[index + 1];\n      if (next && !next.startsWith('-')) {\n        flags[key] = next;\n        index += 1;\n      } else {\n        flags[key] = true;\n      }\n      continue;\n    }\n    rest.push(token);\n  }\n\n  const command = rest[0] ?? 'help';\n  let subcommand: string | null = null;\n  let positionals = rest.slice(1);\n  if (COMMANDS_WITH_SUBCOMMAND.has(command) && positionals[0] && !positionals[0].startsWith('-')) {\n    subcommand = positionals[0]!;\n    positionals = positionals.slice(1);\n  }\n  if (flags.help === true || flags.h === true) {\n    return { command: command === 'help' ? 'help' : command, subcommand, positionals, flags: { ...flags, help: true } };\n  }\n  return { command, subcommand, positionals, flags };\n}\n\nexport function flagString(flags: Record<string, string | boolean>, name: string, fallback = ''): string {\n  const value = flags[name];\n  return typeof value === 'string' ? value : fallback;\n}\n\nexport function flagBoolean(flags: Record<string, string | boolean>, name: string): boolean {\n  return flags[name] === true || flags[name] === 'true' || flags[name] === '1';\n}\n","const SECRET_PREFIX = /\\b((?:sk_|rk_|whsec_)[A-Za-z0-9_-]+)/g;\nconst TOKEN_ASSIGNMENT = /(\\b(?:token|access_token|refresh_token|id_token|api[_-]?key|client[_-]?secret|private[_-]?key|signing[_-]?secret)\\b\\s*[:=]\\s*)([\"']?)([^\\s\"',}]+)\\2/gi;\nconst BEARER = /\\bBearer\\s+[A-Za-z0-9._~+/-]+=*/gi;\nconst JWT = /\\beyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9._~+/-]+=*/g;\n\nexport function redactSecrets(value: string): string {\n  return value\n    .replace(BEARER, 'Bearer ***')\n    .replace(JWT, '***')\n    .replace(SECRET_PREFIX, (_, match: string) => `${match.slice(0, match.indexOf('_') + 1)}***`)\n    .replace(TOKEN_ASSIGNMENT, (_, prefix: string, quote: string) => `${prefix}${quote}***${quote}`);\n}\n\nexport function redactValue(value: unknown): unknown {\n  if (typeof value === 'string') return redactSecrets(value);\n  if (Array.isArray(value)) return value.map(redactValue);\n  if (value && typeof value === 'object') {\n    const entries = Object.entries(value as Record<string, unknown>).map(([key, nested]) => {\n      if (isSecretKey(key) && typeof nested === 'string' && nested.length > 0) {\n        return [key, redactSecrets(nested) === nested ? '***' : redactSecrets(nested)];\n      }\n      return [key, redactValue(nested)];\n    });\n    return Object.fromEntries(entries);\n  }\n  return value;\n}\n\nexport function isSecretKey(key: string): boolean {\n  return /secret|token|password|authorization|api[_-]?key|private[_-]?key|signing/i.test(key);\n}\n\nexport function assertNoSecrets(value: string): void {\n  if (SECRET_PREFIX.test(value) || BEARER.test(value) || JWT.test(value)) {\n    SECRET_PREFIX.lastIndex = 0;\n    BEARER.lastIndex = 0;\n    JWT.lastIndex = 0;\n    throw new Error('A secret would have been printed. Values matching sk_, rk_, whsec_, or tokens are redacted.');\n  }\n  SECRET_PREFIX.lastIndex = 0;\n  BEARER.lastIndex = 0;\n  JWT.lastIndex = 0;\n}\n","import { mkdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';\nimport { dirname, join, resolve } from 'node:path';\n\nimport {\n  ENGINE_CONTRACT_VERSION,\n  VERIFICATION_ADAPTER_CONTRACT_VERSION,\n  majorsCompatible,\n} from '@splitin/verification-adapter-sdk';\n\nimport { redactValue } from './redact.ts';\n\nexport const CONFIG_FILE_NAME = 'verification.config.json';\nexport const CLI_VERSION = '0.1.0-beta.0';\n\nexport interface ProviderCredentialConfig {\n  enabled: boolean;\n  environment: 'sandbox' | 'production';\n  secretKey: string;\n  webhookSecret: string;\n  publishableKey: string;\n  apiVersion: string;\n}\n\nexport interface VerificationCliConfig {\n  contractVersion: string;\n  engineCompatibility: string;\n  environment: 'sandbox' | 'production';\n  productionEnabled: boolean;\n  productionRoutesEnabled: boolean;\n  database: {\n    url: string;\n    schema: string;\n    migrationsDirectory: string;\n  };\n  webhooks: {\n    publicBaseUrl: string;\n    toleranceSeconds: number;\n  };\n  browser: {\n    publishableKeys: Record<string, string>;\n  };\n  routing: {\n    defaultProvider: string;\n    rules: Array<{ packageCode: string; provider: string; countryCode?: string }>;\n  };\n  providers: Record<string, ProviderCredentialConfig>;\n}\n\nexport function defaultConfig(): VerificationCliConfig {\n  return {\n    contractVersion: VERIFICATION_ADAPTER_CONTRACT_VERSION,\n    engineCompatibility: ENGINE_CONTRACT_VERSION,\n    environment: 'sandbox',\n    productionEnabled: false,\n    productionRoutesEnabled: false,\n    database: {\n      url: '',\n      schema: 'verification',\n      migrationsDirectory: 'migrations/verification',\n    },\n    webhooks: {\n      publicBaseUrl: '',\n      toleranceSeconds: 300,\n    },\n    browser: {\n      publishableKeys: {},\n    },\n    routing: {\n      defaultProvider: 'test_fake',\n      rules: [{ packageCode: 'human_idv', provider: 'test_fake', countryCode: 'US' }],\n    },\n    providers: {\n      test_fake: disabledProvider('sandbox', 'fake-1'),\n      stripe_identity: disabledProvider('sandbox', '2024-06-20'),\n      persona: disabledProvider('sandbox', '2023-01-05'),\n      plaid_idv: disabledProvider('sandbox', '2020-09-14'),\n    },\n  };\n}\n\nfunction disabledProvider(environment: 'sandbox' | 'production', apiVersion: string): ProviderCredentialConfig {\n  return {\n    enabled: false,\n    environment,\n    secretKey: '',\n    webhookSecret: '',\n    publishableKey: '',\n    apiVersion,\n  };\n}\n\nexport function configPath(cwd: string): string {\n  return join(cwd, CONFIG_FILE_NAME);\n}\n\nexport function loadConfig(cwd: string): VerificationCliConfig {\n  const path = configPath(cwd);\n  if (!existsSync(path)) {\n    throw new Error(`Missing ${CONFIG_FILE_NAME}. Run \\`splitin-verification init\\` first.`);\n  }\n  const parsed = JSON.parse(readFileSync(path, 'utf8')) as VerificationCliConfig;\n  return { ...defaultConfig(), ...parsed, providers: { ...defaultConfig().providers, ...parsed.providers } };\n}\n\nexport function writeConfig(cwd: string, config: VerificationCliConfig): string {\n  const path = configPath(cwd);\n  mkdirSync(dirname(path), { recursive: true });\n  writeFileSync(path, `${JSON.stringify(config, null, 2)}\\n`, 'utf8');\n  return path;\n}\n\nexport function safeConfigView(config: VerificationCliConfig): unknown {\n  return redactValue(config);\n}\n\nexport interface CompatibilityIssue {\n  code: string;\n  message: string;\n}\n\nexport function validateCompatibility(config: VerificationCliConfig): CompatibilityIssue[] {\n  const issues: CompatibilityIssue[] = [];\n  if (config.contractVersion !== VERIFICATION_ADAPTER_CONTRACT_VERSION) {\n    issues.push({\n      code: 'contract_version',\n      message: `Config contract ${config.contractVersion} does not match SDK ${VERIFICATION_ADAPTER_CONTRACT_VERSION}.`,\n    });\n  }\n  if (!majorsCompatible(config.engineCompatibility, ENGINE_CONTRACT_VERSION)) {\n    issues.push({\n      code: 'engine_incompatible',\n      message: `Engine compatibility ${config.engineCompatibility} is not compatible with ${ENGINE_CONTRACT_VERSION}.`,\n    });\n  }\n  if (config.productionEnabled || config.productionRoutesEnabled || config.environment === 'production') {\n    issues.push({\n      code: 'production_disabled',\n      message: 'Production routes and production environment are disabled until sandbox certification.',\n    });\n  }\n  return issues;\n}\n\nexport interface CredentialIssue {\n  provider: string;\n  code: string;\n  message: string;\n}\n\n/**\n * Validates credential *shape* and sandbox/production split without creating\n * Identity sessions, Persona inquiries, or Plaid IDV attempts.\n */\nexport function validateProviderCredentials(config: VerificationCliConfig): CredentialIssue[] {\n  const issues: CredentialIssue[] = [];\n  for (const [provider, credentials] of Object.entries(config.providers)) {\n    if (!credentials.enabled) continue;\n    if (credentials.environment === 'production' || looksLikeLiveSecret(credentials.secretKey)) {\n      issues.push({\n        provider,\n        code: 'production_credential_blocked',\n        message: `Provider \"${provider}\" has a live or production credential. The CLI never creates billable production attempts.`,\n      });\n    }\n    if (credentials.secretKey && !looksLikeSandboxSecret(credentials.secretKey) && !looksLikeLiveSecret(credentials.secretKey)) {\n      issues.push({\n        provider,\n        code: 'unrecognized_secret_prefix',\n        message: `Provider \"${provider}\" secret does not use a recognized sandbox prefix. Values are never printed.`,\n      });\n    }\n    if (credentials.webhookSecret && !credentials.webhookSecret.startsWith('whsec_') && provider !== 'test_fake') {\n      issues.push({\n        provider,\n        code: 'webhook_secret_shape',\n        message: `Provider \"${provider}\" webhook secret should use a sandbox webhook prefix. The value is not printed.`,\n      });\n    }\n    if (!credentials.apiVersion.trim()) {\n      issues.push({\n        provider,\n        code: 'api_version_missing',\n        message: `Provider \"${provider}\" is missing a pinned API version.`,\n      });\n    }\n  }\n  return issues;\n}\n\nexport function looksLikeLiveSecret(value: string): boolean {\n  return /^(?:sk_live_|rk_live_)/.test(value) || (value.startsWith('sk_') && !value.includes('test'));\n}\n\nexport function looksLikeSandboxSecret(value: string): boolean {\n  return /^(?:sk_test_|rk_test_|test_|sandbox_)/.test(value) || value.startsWith('whsec_test');\n}\n\nexport function resolveCwd(flags: Record<string, string | boolean>): string {\n  const cwd = flags.cwd ?? flags.C;\n  return resolve(typeof cwd === 'string' && cwd.length > 0 ? cwd : process.cwd());\n}\n\nexport function writeText(path: string, contents: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  writeFileSync(path, contents, 'utf8');\n}\n\nexport function envExample(): string {\n  return `# SplitIn verification adapter SDK — development placeholders only.\n# Production is disabled. Never commit real secrets.\n\nVERIFICATION_ENVIRONMENT=sandbox\nVERIFICATION_PRODUCTION_ENABLED=false\nVERIFICATION_PRODUCTION_ROUTES_ENABLED=false\n\nDATABASE_URL=\nVERIFICATION_DATABASE_SCHEMA=verification\n\nSTRIPE_IDENTITY_SECRET_KEY=\nSTRIPE_IDENTITY_WEBHOOK_SECRET=\nSTRIPE_IDENTITY_PUBLISHABLE_KEY=\n\nPERSONA_API_KEY=\nPERSONA_WEBHOOK_SECRET=\n\nPLAID_CLIENT_ID=\nPLAID_SECRET=\nPLAID_WEBHOOK_SECRET=\n\nVERIFICATION_WEBHOOK_PUBLIC_BASE_URL=\nVERIFICATION_BROWSER_PUBLISHABLE_KEY=\n`;\n}\n","import { existsSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from 'node:fs';\nimport { dirname, join } from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nimport type { VerificationCliConfig } from './config.ts';\n\nexport interface Migration {\n  version: string;\n  name: string;\n  up: string;\n  down: string;\n}\n\nconst MIGRATION_FILES = [\n  { version: '001', name: 'init' },\n  { version: '002', name: 'seed' },\n  { version: '003', name: 'retention' },\n] as const;\n\nfunction migrationsDirectory(): string {\n  const here = dirname(fileURLToPath(import.meta.url));\n  const candidates = [\n    join(here, '..', 'migrations'),\n    join(here, '..', '..', 'verification-postgres', 'migrations'),\n  ];\n  for (const directory of candidates) {\n    if (existsSync(join(directory, '001_init.sql'))) return directory;\n  }\n  throw new Error('Bundled verification SQL migrations were not found.');\n}\n\nfunction loadBundledMigrations(): Migration[] {\n  const directory = migrationsDirectory();\n  return MIGRATION_FILES.map((item) => ({\n    version: item.version,\n    name: item.name,\n    up: readFileSync(join(directory, `${item.version}_${item.name}.sql`), 'utf8'),\n    down: readFileSync(join(directory, `${item.version}_${item.name}.down.sql`), 'utf8'),\n  }));\n}\n\nexport const bundledMigrations: Migration[] = loadBundledMigrations();\n\nconst STATE_FILE = '.verification/migrations-state.json';\n\ninterface MigrationState {\n  applied: string[];\n}\n\nfunction statePath(cwd: string): string {\n  return join(cwd, STATE_FILE);\n}\n\nfunction readState(cwd: string): MigrationState {\n  const path = statePath(cwd);\n  if (!existsSync(path)) return { applied: [] };\n  return JSON.parse(readFileSync(path, 'utf8')) as MigrationState;\n}\n\nfunction writeState(cwd: string, state: MigrationState): void {\n  mkdirSync(join(cwd, '.verification'), { recursive: true });\n  writeFileSync(statePath(cwd), `${JSON.stringify(state, null, 2)}\\n`, 'utf8');\n}\n\nexport function writeMigrationFiles(cwd: string, config: VerificationCliConfig): string {\n  const directory = join(cwd, config.database.migrationsDirectory);\n  mkdirSync(directory, { recursive: true });\n  for (const migration of bundledMigrations) {\n    writeFileSync(join(directory, `${migration.version}_${migration.name}.up.sql`), migration.up, 'utf8');\n    writeFileSync(join(directory, `${migration.version}_${migration.name}.down.sql`), migration.down, 'utf8');\n  }\n  return directory;\n}\n\nexport function migrateUp(cwd: string, config: VerificationCliConfig): { applied: string[]; sql: string[] } {\n  writeMigrationFiles(cwd, config);\n  const state = readState(cwd);\n  const applied: string[] = [];\n  const sql: string[] = [];\n  for (const migration of bundledMigrations) {\n    if (state.applied.includes(migration.version)) continue;\n    sql.push(migration.up);\n    state.applied.push(migration.version);\n    applied.push(`${migration.version}_${migration.name}`);\n  }\n  writeState(cwd, state);\n  return { applied, sql };\n}\n\nexport function migrateDown(cwd: string, config: VerificationCliConfig): { rolledBack: string | null; sql: string[] } {\n  writeMigrationFiles(cwd, config);\n  const state = readState(cwd);\n  const version = state.applied.at(-1);\n  if (!version) return { rolledBack: null, sql: [] };\n  const migration = bundledMigrations.find((item) => item.version === version);\n  if (!migration) return { rolledBack: null, sql: [] };\n  state.applied = state.applied.filter((item) => item !== version);\n  writeState(cwd, state);\n  return { rolledBack: `${migration.version}_${migration.name}`, sql: [migration.down] };\n}\n\nexport function appliedMigrations(cwd: string): string[] {\n  return readState(cwd).applied;\n}\n\nexport function listedMigrationFiles(cwd: string, config: VerificationCliConfig): string[] {\n  const directory = join(cwd, config.database.migrationsDirectory);\n  if (!existsSync(directory)) return [];\n  return readdirSync(directory).filter((name) => name.endsWith('.sql')).sort();\n}\n","import { join } from 'node:path';\n\nimport { writeText } from './config.ts';\n\nexport const SCAFFOLD_PACKAGE = 'com.example.employee_check';\nexport const SCAFFOLD_PROVIDER = 'example_employee_check';\n\nexport function scaffoldProvider(cwd: string, directory = `adapters/${SCAFFOLD_PROVIDER}`): string {\n  const root = join(cwd, directory);\n  writeText(join(root, 'package.json'), `${JSON.stringify({\n    name: `@example/${SCAFFOLD_PROVIDER}`,\n    version: '0.1.0-beta.0',\n    private: true,\n    type: 'module',\n    license: 'MIT',\n    description: `Fourth-party verification adapter stub for ${SCAFFOLD_PACKAGE}.`,\n    main: './src/index.ts',\n    dependencies: {\n      '@splitin/verification-adapter-sdk': '0.1.0-beta.0',\n    },\n  }, null, 2)}\\n`);\n  writeText(join(root, 'README.md'), `# Example employee-check adapter\n\nFourth-party adapter stub. Package code: \\`${SCAFFOLD_PACKAGE}\\`.\n\nThis adapter is sandbox-only. Production routes stay disabled until you run\n\\`splitin-verification provider conformance\\` against a non-billable fake or\nsandbox fixture.\n\n\\`\\`\\`ts\nimport { ExampleEmployeeCheckAdapter } from './src/index.ts';\n\\`\\`\\`\n`);\n  writeText(join(root, 'src/manifest.ts'), `import {\n  defineProviderManifest,\n  emptyConfigurationSchema,\n  VERIFICATION_ADAPTER_CONTRACT_VERSION,\n} from '@splitin/verification-adapter-sdk';\n\nexport const exampleEmployeeCheckManifest = defineProviderManifest({\n  contractVersion: VERIFICATION_ADAPTER_CONTRACT_VERSION,\n  adapterVersion: '1.0.0',\n  engineCompatibility: '1.0.0',\n  provider: '${SCAFFOLD_PROVIDER}',\n  displayName: 'Example Employee Check',\n  description: 'Fourth-party adapter stub. Replace the retrieve mapping before production.',\n  supportedPackages: ['${SCAFFOLD_PACKAGE}'],\n  supportedCountries: ['US'],\n  environments: ['sandbox'],\n  capabilities: {\n    presentations: ['hosted'],\n    canResume: true,\n    canRetry: true,\n    canCancel: true,\n    canRedact: true,\n  },\n  launcherKeys: ['hosted'],\n  launchPresentations: ['hosted'],\n  configurationSchemaVersion: 'urn:example:employee-check:config:v1',\n  configurationSchema: emptyConfigurationSchema,\n  webhook: { protocol: 'none', eventFamilies: ['employee_check'] },\n  dataPolicy: {\n    classifications: ['normalized_status'],\n    prohibitedPersistence: ['raw_webhook', 'launch_secret', 'document', 'selfie'],\n    rawPayloadPersistence: false,\n    browserSecretPersistence: false,\n    governmentIdentifierPersistence: false,\n  },\n  retry: { sameResourceWhenResumable: true, newAttemptAfterTerminal: true },\n  cancellation: { supported: true, terminal: true },\n  redaction: { supported: true, asynchronous: false },\n  apiHosts: ['127.0.0.1'],\n  testedApiVersions: ['example-1'],\n});\n`);\n  writeText(join(root, 'src/index.ts'), `import type {\n  NormalizedProviderEvent,\n  NormalizedProviderSnapshot,\n  ProviderAttemptCommand,\n  ProviderAttemptResult,\n  ProviderLaunchEnvelope,\n  ProviderOperationResult,\n  ProviderRedactionCommand,\n  ProviderRedactionResult,\n  ProviderResourceCommand,\n  ProviderRetryCommand,\n  ProviderRuntimeContext,\n  VerificationAdapterV1,\n  VerifiedWebhookEnvelope,\n} from '@splitin/verification-adapter-sdk';\nimport {\n  ProviderError,\n  VERIFICATION_ADAPTER_CONTRACT_VERSION,\n  createDefaultRuntime,\n} from '@splitin/verification-adapter-sdk';\nimport { exampleEmployeeCheckManifest } from './manifest.ts';\n\nexport class ExampleEmployeeCheckAdapter implements VerificationAdapterV1<Record<string, never>> {\n  readonly contractVersion = VERIFICATION_ADAPTER_CONTRACT_VERSION;\n  readonly manifest = exampleEmployeeCheckManifest;\n  readonly provider = '${SCAFFOLD_PROVIDER}';\n  readonly environment = 'sandbox' as const;\n  readonly runtime: ProviderRuntimeContext<Record<string, never>>;\n\n  constructor(runtime?: ProviderRuntimeContext<Record<string, never>>) {\n    this.runtime = runtime ?? createDefaultRuntime('sandbox', {}, { allowedHosts: ['127.0.0.1'] });\n  }\n\n  validateConfiguration(): void {\n    if (this.runtime.environment !== 'sandbox') {\n      throw new ProviderError('INVALID_CONFIGURATION', 'The example adapter is sandbox-only.');\n    }\n  }\n\n  async createAttempt(command: ProviderAttemptCommand): Promise<ProviderAttemptResult> {\n    if (command.packageCode !== '${SCAFFOLD_PACKAGE}') {\n      throw new ProviderError('UNSUPPORTED_CAPABILITY', 'This adapter only serves ${SCAFFOLD_PACKAGE}.');\n    }\n    const providerResourceId = \\`eec_\\${command.attemptId.replace(/[^a-zA-Z0-9]/g, '')}\\`;\n    return {\n      attemptId: command.attemptId,\n      providerResourceId,\n      providerStatus: 'pending_user_input',\n      canonicalStatus: 'pending_user_input',\n      launch: this.launch(command.attemptId),\n    };\n  }\n\n  async resumeAttempt(command: ProviderResourceCommand): Promise<ProviderLaunchEnvelope> {\n    return this.launch(command.attemptId);\n  }\n\n  async retrieveAttempt(command: ProviderResourceCommand): Promise<NormalizedProviderSnapshot> {\n    return {\n      providerResourceId: command.providerResourceId,\n      providerStatus: 'pending_user_input',\n      canonicalStatus: 'pending_user_input',\n      occurredAt: this.runtime.now().toISOString(),\n      normalizedReasonCodes: [],\n      safeMetadata: { package: '${SCAFFOLD_PACKAGE}' },\n    };\n  }\n\n  async retryAttempt(command: ProviderRetryCommand): Promise<ProviderAttemptResult> {\n    return this.createAttempt({ ...command, attemptId: \\`\\${command.attemptId}_retry\\` });\n  }\n\n  async cancelAttempt(): Promise<ProviderOperationResult> {\n    return { accepted: true, providerStatus: 'canceled', canonicalStatus: 'canceled' };\n  }\n\n  async redactSubject(_command: ProviderRedactionCommand): Promise<ProviderRedactionResult> {\n    return { completed: true, retryable: false, disposition: 'redacted' };\n  }\n\n  async verifyWebhook(): Promise<VerifiedWebhookEnvelope> {\n    throw new ProviderError('UNSUPPORTED_CAPABILITY', 'This stub does not receive webhooks.', {\n      safeCode: 'webhooks_not_supported',\n    });\n  }\n\n  async normalizeWebhook(_input: VerifiedWebhookEnvelope): Promise<NormalizedProviderEvent> {\n    throw new ProviderError('UNSUPPORTED_CAPABILITY', 'This stub does not receive webhooks.', {\n      safeCode: 'webhooks_not_supported',\n    });\n  }\n\n  private launch(attemptId: string): ProviderLaunchEnvelope {\n    return {\n      attemptId,\n      canonicalStatus: 'pending_user_input',\n      launcherKey: 'hosted',\n      presentation: 'hosted',\n      hostedUrl: 'https://127.0.0.1/example-employee-check',\n      continuationReference: \\`cont_\\${attemptId}\\`,\n    };\n  }\n}\n`);\n  return root;\n}\n","import { existsSync } from 'node:fs';\nimport { createServer, type IncomingMessage, type ServerResponse } from 'node:http';\nimport { isAbsolute, join, resolve } from 'node:path';\nimport { pathToFileURL } from 'node:url';\n\nimport {\n  createFakeAdapterForScenario,\n  runAdapterConformance,\n  runAdapterConformanceScenarios,\n  VERIFICATION_ADAPTER_CONTRACT_VERSION,\n  ENGINE_CONTRACT_VERSION,\n  STANDARD_PACKAGE_CODES,\n  STANDARD_WEBHOOK_PROTOCOLS,\n  CANONICAL_STATUSES,\n  type AdapterConformanceScenarioFactory,\n  type VerificationAdapterV1,\n} from '@splitin/verification-adapter-sdk';\n\nimport type { ParsedArgv } from './argv.ts';\nimport { flagBoolean, flagString } from './argv.ts';\nimport {\n  CLI_VERSION,\n  defaultConfig,\n  envExample,\n  loadConfig,\n  resolveCwd,\n  safeConfigView,\n  validateCompatibility,\n  validateProviderCredentials,\n  writeConfig,\n  writeText,\n  type VerificationCliConfig,\n} from './config.ts';\nimport { appliedMigrations, listedMigrationFiles, migrateDown, migrateUp } from './migrations.ts';\nimport { redactSecrets, redactValue } from './redact.ts';\nimport { SCAFFOLD_PACKAGE, scaffoldProvider } from './scaffold.ts';\n\nexport interface CommandResult {\n  exitCode: number;\n  stdout: string;\n  stderr: string;\n}\n\nexport async function dispatch(parsed: ParsedArgv): Promise<CommandResult> {\n  if (parsed.flags.help === true || parsed.command === 'help' || parsed.command === '--help') {\n    return ok(usage());\n  }\n  if (parsed.command === 'version' || parsed.flags.version === true || parsed.flags.v === true) {\n    return ok(`${CLI_VERSION}\\n`);\n  }\n  switch (parsed.command) {\n    case 'init':\n      return cmdInit(parsed);\n    case 'config':\n      return parsed.subcommand === 'validate' ? cmdConfigValidate(parsed) : fail(`Unknown config command. Use \\`config validate\\`.\\n`);\n    case 'doctor':\n      return cmdDoctor(parsed);\n    case 'db':\n      if (parsed.subcommand === 'migrate') return cmdDbMigrate(parsed);\n      if (parsed.subcommand === 'rollback') return cmdDbRollback(parsed);\n      return fail('Unknown db command. Use `db migrate` or `db rollback`.\\n');\n    case 'provider':\n      if (parsed.subcommand === 'scaffold') return cmdProviderScaffold(parsed);\n      if (parsed.subcommand === 'conformance') return cmdProviderConformance(parsed);\n      return fail('Unknown provider command. Use `provider scaffold` or `provider conformance`.\\n');\n    case 'registry':\n      return parsed.subcommand === 'generate' ? cmdRegistryGenerate(parsed) : fail('Unknown registry command. Use `registry generate`.\\n');\n    case 'dev':\n      return cmdDev(parsed);\n    case 'release':\n      return parsed.subcommand === 'verify' ? cmdReleaseVerify(parsed) : fail('Unknown release command. Use `release verify`.\\n');\n    default:\n      return fail(`Unknown command \"${parsed.command}\".\\n\\n${usage()}`);\n  }\n}\n\nfunction cmdInit(parsed: ParsedArgv): CommandResult {\n  const cwd = resolveCwd(parsed.flags);\n  const force = flagBoolean(parsed.flags, 'force');\n  const config = defaultConfig();\n  const path = join(cwd, 'verification.config.json');\n  if (existsSync(path) && !force) {\n    return fail(`Refusing to overwrite ${path}. Pass --force to replace it.\\n`);\n  }\n  writeConfig(cwd, config);\n  writeText(join(cwd, '.env.example'), envExample());\n  writeText(join(cwd, 'src/generated/.gitkeep'), '');\n  const stdout = [\n    'Initialized a disabled-by-default development configuration.',\n    `Wrote ${path}`,\n    'Wrote .env.example (empty placeholders only).',\n    'productionEnabled=false productionRoutesEnabled=false environment=sandbox',\n    'Fill sandbox credentials locally. The CLI redacts provider secrets and tokens.',\n    'Next: splitin-verification config validate && splitin-verification doctor',\n    '',\n  ].join('\\n');\n  return ok(stdout);\n}\n\nfunction cmdConfigValidate(parsed: ParsedArgv): CommandResult {\n  const cwd = resolveCwd(parsed.flags);\n  const config = loadConfig(cwd);\n  const compatibility = validateCompatibility(config);\n  const credentials = validateProviderCredentials(config);\n  const view = JSON.stringify(safeConfigView(config), null, 2);\n  const lines = [\n    `contractVersion=${config.contractVersion} engineCompatibility=${config.engineCompatibility}`,\n    `productionEnabled=${config.productionEnabled} productionRoutesEnabled=${config.productionRoutesEnabled}`,\n    'Credential check is shape-only. No Identity session, Persona inquiry, or Plaid IDV attempt is created.',\n    view,\n  ];\n  if (compatibility.length || credentials.length) {\n    for (const issue of compatibility) lines.push(`ERROR ${issue.code}: ${issue.message}`);\n    for (const issue of credentials) lines.push(`ERROR ${issue.provider}/${issue.code}: ${issue.message}`);\n    return { exitCode: 1, stdout: redactSecrets(`${lines.join('\\n')}\\n`), stderr: '' };\n  }\n  lines.push('Configuration is valid for sandbox development.');\n  return ok(`${lines.join('\\n')}\\n`);\n}\n\nfunction cmdDoctor(parsed: ParsedArgv): CommandResult {\n  const cwd = resolveCwd(parsed.flags);\n  const config = loadConfig(cwd);\n  const checks = [\n    diagnoseDatabase(config, cwd),\n    diagnoseWebhooks(config),\n    diagnoseProviders(config),\n    diagnoseBrowserKeys(config),\n    diagnoseRouting(config),\n  ];\n  const lines = ['Verification adapter doctor', ...checks.map((check) => `${check.ok ? 'ok' : 'fail'}  ${check.name}: ${check.detail}`)];\n  const failed = checks.some((check) => !check.ok);\n  return { exitCode: failed ? 1 : 0, stdout: redactSecrets(`${lines.join('\\n')}\\n`), stderr: '' };\n}\n\nfunction diagnoseDatabase(config: VerificationCliConfig, cwd: string) {\n  const applied = appliedMigrations(cwd);\n  if (!config.database.schema) {\n    return { ok: false, name: 'database', detail: 'Schema name is empty.' };\n  }\n  if (!config.database.url) {\n    return {\n      ok: true,\n      name: 'database',\n      detail: `No DATABASE_URL. Schema \"${config.database.schema}\" is configured. Applied local revisions: ${applied.join(', ') || 'none'}.`,\n    };\n  }\n  try {\n    const url = new URL(config.database.url);\n    return {\n      ok: url.protocol === 'postgres:' || url.protocol === 'postgresql:',\n      name: 'database',\n      detail: `Host ${url.hostname} schema ${config.database.schema}. Doctor does not open a live connection or run SQL.`,\n    };\n  } catch {\n    return { ok: false, name: 'database', detail: 'DATABASE_URL is not a valid URL. The value is not printed.' };\n  }\n}\n\nfunction diagnoseWebhooks(config: VerificationCliConfig) {\n  if (!config.webhooks.publicBaseUrl) {\n    return { ok: true, name: 'webhook', detail: 'Public webhook base URL is unset (expected for local sandbox).' };\n  }\n  try {\n    const url = new URL(config.webhooks.publicBaseUrl);\n    const okHttps = url.protocol === 'https:' || url.hostname === '127.0.0.1' || url.hostname === 'localhost';\n    return {\n      ok: okHttps,\n      name: 'webhook',\n      detail: okHttps\n        ? `Endpoint origin ${url.origin} tolerance=${config.webhooks.toleranceSeconds}s.`\n        : 'Webhook public URL must be HTTPS or loopback.',\n    };\n  } catch {\n    return { ok: false, name: 'webhook', detail: 'Webhook public URL is malformed.' };\n  }\n}\n\nfunction diagnoseProviders(config: VerificationCliConfig) {\n  const credentials = validateProviderCredentials(config);\n  const enabled = Object.entries(config.providers).filter(([, value]) => value.enabled).map(([name]) => name);\n  if (credentials.length) {\n    return { ok: false, name: 'provider', detail: credentials.map((issue) => `${issue.provider}:${issue.code}`).join(', ') };\n  }\n  return {\n    ok: true,\n    name: 'provider',\n    detail: enabled.length\n      ? `Enabled sandbox providers: ${enabled.join(', ')}. No billable production attempts.`\n      : 'No third-party provider enabled. Fake provider remains the default route.',\n  };\n}\n\nfunction diagnoseBrowserKeys(config: VerificationCliConfig) {\n  const keys = Object.keys(config.browser.publishableKeys);\n  return {\n    ok: true,\n    name: 'browser-key',\n    detail: keys.length\n      ? `Publishable keys present for ${keys.join(', ')}. Values redacted.`\n      : 'No browser publishable keys configured (sandbox fake launcher does not need them).',\n  };\n}\n\nfunction diagnoseRouting(config: VerificationCliConfig) {\n  if (!config.routing.defaultProvider) {\n    return { ok: false, name: 'routing', detail: 'Default provider is missing.' };\n  }\n  const known = config.providers[config.routing.defaultProvider];\n  if (!known && config.routing.defaultProvider !== 'test_fake') {\n    return { ok: false, name: 'routing', detail: `Default provider \"${config.routing.defaultProvider}\" is not in the config.` };\n  }\n  return {\n    ok: true,\n    name: 'routing',\n    detail: `Default ${config.routing.defaultProvider}; ${config.routing.rules.length} package rule(s). Production routing is disabled.`,\n  };\n}\n\nfunction cmdDbMigrate(parsed: ParsedArgv): CommandResult {\n  const cwd = resolveCwd(parsed.flags);\n  const config = loadConfig(cwd);\n  const result = migrateUp(cwd, config);\n  const files = listedMigrationFiles(cwd, config);\n  return ok([\n    result.applied.length ? `Applied ${result.applied.join(', ')}.` : 'No pending migrations.',\n    `Wrote SQL templates under ${config.database.migrationsDirectory} (${files.length} files).`,\n    'SQL is not executed against production. Apply with your own postgres client when ready.',\n    '',\n  ].join('\\n'));\n}\n\nfunction cmdDbRollback(parsed: ParsedArgv): CommandResult {\n  const cwd = resolveCwd(parsed.flags);\n  const config = loadConfig(cwd);\n  const result = migrateDown(cwd, config);\n  return ok(result.rolledBack\n    ? `Rolled back ${result.rolledBack}. SQL was not executed against a live database.\\n`\n    : 'No applied migrations to roll back.\\n');\n}\n\nfunction cmdProviderScaffold(parsed: ParsedArgv): CommandResult {\n  const cwd = resolveCwd(parsed.flags);\n  const directory = flagString(parsed.flags, 'out') || parsed.positionals[0];\n  const root = scaffoldProvider(cwd, directory);\n  return ok([\n    `Wrote fourth-party adapter stub at ${root}`,\n    `Custom package: ${SCAFFOLD_PACKAGE}`,\n    'The stub is sandbox-only and does not create billable provider attempts.',\n    '',\n  ].join('\\n'));\n}\n\nasync function cmdProviderConformance(parsed: ParsedArgv): Promise<CommandResult> {\n  const command = {\n    attemptId: 'att_conformance_cli',\n    subjectReference: 'sub_opaque_conformance',\n    packageCode: 'human_idv' as const,\n    countryCode: 'US',\n    idempotencyKey: 'idem_conformance_cli',\n    configurationRevision: 'cfg_cli',\n  };\n  const modulePath = flagString(parsed.flags, 'module');\n  const lines: string[] = [];\n  try {\n    if (!modulePath) {\n      const adapter = createFakeAdapterForScenario('input_required');\n      const results = await runAdapterConformance(adapter, command);\n      lines.push(\n        'Running @splitin/verification-adapter-sdk runAdapterConformance against the sandbox fake adapter.',\n        'This does not call Stripe, Persona, or Plaid and cannot create billable attempts.',\n        ...formatConformance(results),\n      );\n      const failed = results.filter((result) => !result.passed);\n      return { exitCode: failed.length ? 1 : 0, stdout: redactSecrets(`${lines.join('\\n')}\\n`), stderr: '' };\n    }\n\n    const loaded = await loadConformanceModule(modulePath, resolveCwd(parsed.flags));\n    const results = await runAdapterConformance(loaded.adapter, command);\n    lines.push(\n      `Running runAdapterConformance against module ${modulePath}.`,\n      'Adapter output is redacted. Secrets, tokens, and credential material are never printed.',\n      ...formatConformance(results),\n    );\n    if (loaded.factory) {\n      const scenarios = await runAdapterConformanceScenarios(loaded.factory, command);\n      lines.push('Running runAdapterConformanceScenarios for the exported factory.', ...formatConformance(scenarios));\n      results.push(...scenarios);\n    }\n    const failed = results.filter((result) => !result.passed);\n    return { exitCode: failed.length ? 1 : 0, stdout: redactSecrets(`${lines.join('\\n')}\\n`), stderr: '' };\n  } catch (error) {\n    const detail = error instanceof Error ? error.message : 'Unknown conformance module failure.';\n    return fail(`Unable to run provider conformance. ${detail}\\n`);\n  }\n}\n\nfunction formatConformance(results: Array<{ name: string; passed: boolean; detail?: string }>): string[] {\n  return results.map((result) => `${result.passed ? 'pass' : 'fail'}  ${result.name}${result.detail ? `  ${result.detail}` : ''}`);\n}\n\nasync function loadConformanceModule(\n  modulePath: string,\n  cwd: string,\n): Promise<{ adapter: VerificationAdapterV1; factory: AdapterConformanceScenarioFactory | null }> {\n  const absolute = isAbsolute(modulePath) ? modulePath : resolve(cwd, modulePath);\n  const imported = await import(pathToFileURL(absolute).href) as Record<string, unknown>;\n  const factoryCandidate = pickFunction(\n    imported.createAdapterForScenario,\n    imported.createAdapter,\n    imported.default,\n  );\n  const isScenarioFactory = typeof factoryCandidate === 'function' && factoryCandidate.length >= 1;\n  const adapter = isAdapter(imported.default)\n    ? imported.default\n    : isAdapter(imported.createAdapter)\n      ? imported.createAdapter\n      : typeof factoryCandidate === 'function'\n        ? await (factoryCandidate as (scenario?: string) => unknown)(isScenarioFactory ? 'input_required' : undefined)\n        : null;\n  if (!isAdapter(adapter)) {\n    throw new Error('Module must export a default adapter, createAdapter, or createAdapterForScenario.');\n  }\n  return {\n    adapter,\n    factory: isScenarioFactory ? (factoryCandidate as AdapterConformanceScenarioFactory) : null,\n  };\n}\n\nfunction pickFunction(...candidates: unknown[]): ((...args: never[]) => unknown) | null {\n  for (const candidate of candidates) {\n    if (typeof candidate === 'function') return candidate as (...args: never[]) => unknown;\n  }\n  return null;\n}\n\nfunction isAdapter(value: unknown): value is VerificationAdapterV1 {\n  return Boolean(value)\n    && typeof value === 'object'\n    && typeof (value as VerificationAdapterV1).createAttempt === 'function'\n    && typeof (value as VerificationAdapterV1).retrieveAttempt === 'function';\n}\n\nfunction cmdRegistryGenerate(parsed: ParsedArgv): CommandResult {\n  const cwd = resolveCwd(parsed.flags);\n  const config = loadConfig(cwd);\n  const out = flagString(parsed.flags, 'out', 'src/generated/verification-registry.ts');\n  const contents = `/* Generated by splitin-verification registry generate. Do not edit. */\nexport const verificationAdapterContractVersion = ${JSON.stringify(VERIFICATION_ADAPTER_CONTRACT_VERSION)} as const;\nexport const verificationEngineContractVersion = ${JSON.stringify(ENGINE_CONTRACT_VERSION)} as const;\nexport const verificationCliVersion = ${JSON.stringify(CLI_VERSION)} as const;\nexport const standardPackageCodes = ${JSON.stringify(STANDARD_PACKAGE_CODES, null, 2)} as const;\nexport const standardWebhookProtocols = ${JSON.stringify(STANDARD_WEBHOOK_PROTOCOLS, null, 2)} as const;\nexport const canonicalStatuses = ${JSON.stringify(CANONICAL_STATUSES, null, 2)} as const;\nexport const configuredProviders = ${JSON.stringify(Object.keys(config.providers), null, 2)} as const;\nexport const productionRoutesEnabled = false;\nexport type StandardPackageCode = typeof standardPackageCodes[number];\nexport type ConfiguredProvider = typeof configuredProviders[number];\n`;\n  writeText(join(cwd, out), contents);\n  return ok(`Wrote typed registry ${out}. productionRoutesEnabled=false.\\n`);\n}\n\nfunction cmdDev(parsed: ParsedArgv): CommandResult {\n  const cwd = resolveCwd(parsed.flags);\n  const config = loadConfig(cwd);\n  if (config.productionEnabled || config.productionRoutesEnabled) {\n    return fail('Refusing to start because production routes are enabled. Set productionEnabled=false.\\n');\n  }\n  const port = Number(flagString(parsed.flags, 'port', '8787')) || 8787;\n  if (flagBoolean(parsed.flags, 'print-only')) {\n    return ok(`Sandbox dev listener would bind 127.0.0.1:${port}. Production routes stay disabled.\\n`);\n  }\n  const server = createServer((request, response) => {\n    void handleDevRequest(request, response);\n  });\n  server.listen(port, '127.0.0.1');\n  return ok(`Sandbox verification listener on http://127.0.0.1:${port}\\nProduction routes disabled. GET /health, POST /sandbox/attempts.\\n`);\n}\n\nasync function handleDevRequest(request: IncomingMessage, response: ServerResponse): Promise<void> {\n  const url = new URL(request.url ?? '/', 'http://127.0.0.1');\n  if (url.pathname === '/health') {\n    json(response, 200, { ok: true, environment: 'sandbox', productionRoutesEnabled: false });\n    return;\n  }\n  if (url.pathname.startsWith('/v1/') || url.pathname.startsWith('/production/')) {\n    json(response, 403, { error: 'production_routes_disabled' });\n    return;\n  }\n  if (request.method === 'POST' && url.pathname === '/sandbox/attempts') {\n    const adapter = createFakeAdapterForScenario('input_required');\n    const created = await adapter.createAttempt({\n      attemptId: 'att_dev_local',\n      subjectReference: 'sub_opaque_dev',\n      packageCode: 'human_idv',\n      countryCode: 'US',\n      idempotencyKey: 'idem_dev_local',\n      configurationRevision: 'cfg_dev',\n    });\n    json(response, 201, redactValue({\n      attemptId: created.attemptId,\n      providerResourceId: created.providerResourceId,\n      canonicalStatus: created.canonicalStatus,\n      launcherKey: created.launch.launcherKey,\n    }));\n    return;\n  }\n  json(response, 404, { error: 'not_found' });\n}\n\nfunction json(response: ServerResponse, status: number, body: unknown): void {\n  response.writeHead(status, { 'content-type': 'application/json' });\n  response.end(`${JSON.stringify(body)}\\n`);\n}\n\nfunction cmdReleaseVerify(parsed: ParsedArgv): CommandResult {\n  const cwd = resolveCwd(parsed.flags);\n  const lines = [\n    `cli=${CLI_VERSION} contract=${VERIFICATION_ADAPTER_CONTRACT_VERSION} engine=${ENGINE_CONTRACT_VERSION}`,\n    'npm trusted publishing must use OIDC (id-token: write). Do not embed an npm token.',\n    'Publish 0.1.0-beta.0 first. Promote to 1.0.0 only after sandbox certification.',\n    'productionEnabled must remain false in distributed examples.',\n  ];\n  if (existsSync(join(cwd, 'verification.config.json'))) {\n    const config = loadConfig(cwd);\n    if (config.productionEnabled || config.productionRoutesEnabled) {\n      return fail(`${lines.join('\\n')}\\nERROR production_disabled: release artifacts must keep production routes off.\\n`);\n    }\n  }\n  lines.push('Release preflight passed.');\n  return ok(`${lines.join('\\n')}\\n`);\n}\n\nfunction usage(): string {\n  return `splitin-verification ${CLI_VERSION}\n\nUsage: splitin-verification <command> [subcommand] [options]\n\nCommands:\n  init                     Write disabled-by-default sandbox configuration\n  config validate          Validate contract/API versions and credential shape\n  doctor                   Diagnose database, webhook, provider, browser-key, routing\n  db migrate               Write and record SQL migrations (does not apply to prod)\n  db rollback              Roll back the last recorded local migration\n  provider scaffold        Write a fourth-party adapter stub (${SCAFFOLD_PACKAGE})\n  provider conformance     Run @splitin/verification-adapter-sdk runAdapterConformance\n  registry generate        Write a typed provider/package registry\n  dev                      Bind a sandbox-only listener (production routes disabled)\n  release verify           Check versions, provenance policy, and production flags\n\nGlobal options:\n  --cwd <dir>              Working directory\n  --module <path>          Adapter module for \\`provider conformance\\` (default: fake)\n  --help                   Show this help\n`;\n}\n\nfunction ok(stdout: string): CommandResult {\n  return { exitCode: 0, stdout: redactSecrets(stdout), stderr: '' };\n}\n\nfunction fail(stderr: string): CommandResult {\n  return { exitCode: 1, stdout: '', stderr: redactSecrets(stderr) };\n}\n","import { pathToFileURL } from 'node:url';\n\nimport { parseArgv } from './argv.ts';\nimport { dispatch, type CommandResult } from './commands.ts';\n\nexport { parseArgv } from './argv.ts';\nexport { dispatch } from './commands.ts';\nexport { redactSecrets, redactValue } from './redact.ts';\nexport { defaultConfig } from './config.ts';\n\nexport async function run(argv: string[] = process.argv): Promise<CommandResult> {\n  const parsed = parseArgv(argv);\n  return dispatch(parsed);\n}\n\nconst isMain = Boolean(process.argv[1]) && import.meta.url === pathToFileURL(process.argv[1]!).href;\n\nif (isMain) {\n  void run().then((result) => {\n    if (result.stdout) process.stdout.write(result.stdout);\n    if (result.stderr) process.stderr.write(result.stderr);\n    const parsed = parseArgv(process.argv);\n    if (parsed.command === 'dev' && parsed.flags['print-only'] !== true && result.exitCode === 0) {\n      return;\n    }\n    process.exit(result.exitCode);\n  }).catch((error: unknown) => {\n    const message = error instanceof Error ? error.message : 'Unknown CLI failure.';\n    process.stderr.write(`${message}\\n`);\n    process.exit(1);\n  });\n}\n"]}

package/migrations/001_init.down.sql

@@ -0,0 +1,25 @@
+DROP TRIGGER IF EXISTS audit_events_immutable ON verification.audit_events;
+DROP FUNCTION IF EXISTS verification.reject_audit_mutation();
+DROP TABLE IF EXISTS verification.continuations;
+DROP TABLE IF EXISTS verification.audit_events;
+DROP TABLE IF EXISTS verification.manual_decision_proposals;
+DROP TABLE IF EXISTS verification.review_cases;
+DROP TABLE IF EXISTS verification.appeals;
+DROP TABLE IF EXISTS verification.circuits;
+DROP TABLE IF EXISTS verification.provider_health_observations;
+DROP TABLE IF EXISTS verification.redaction_jobs;
+DROP TABLE IF EXISTS verification.reconciliation_jobs;
+DROP TABLE IF EXISTS verification.webhook_leases;
+DROP TABLE IF EXISTS verification.webhook_events;
+DROP TABLE IF EXISTS verification.idempotency_claims;
+DROP TABLE IF EXISTS verification.decisions;
+DROP TABLE IF EXISTS verification.provider_resource_lineage;
+DROP TABLE IF EXISTS verification.attempts;
+DROP TABLE IF EXISTS verification.protected_action_requirements;
+DROP TABLE IF EXISTS verification.policy_versions;
+DROP TABLE IF EXISTS verification.route_change_requests;
+DROP TABLE IF EXISTS verification.routes;
+DROP TABLE IF EXISTS verification.provider_definitions;
+DROP TABLE IF EXISTS verification.configuration_revisions;
+DROP TABLE IF EXISTS verification.tenants;
+DROP SCHEMA IF EXISTS verification;

package/migrations/001_init.sql

@@ -0,0 +1,419 @@
+-- verification schema: provider-neutral persistence for @splitin/verification-engine
+-- Stores normalized statuses, reason codes, timestamps, hashes, and opaque provider IDs only.
+-- Never persist raw webhooks, launch credentials, hosted URLs, documents, selfies, or expanded identity outputs.
+
+CREATE SCHEMA IF NOT EXISTS verification;
+
+CREATE TABLE verification.tenants (
+  tenant_key text PRIMARY KEY,
+  display_name text NOT NULL,
+  hash_secret_id text NOT NULL DEFAULT 'injected',
+  continuation_destinations text[] NOT NULL DEFAULT ARRAY['verification.resume'],
+  created_at timestamptz NOT NULL DEFAULT now()
+);
+
+CREATE TABLE verification.configuration_revisions (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  provider text NOT NULL CHECK (provider ~ '^[a-z][a-z0-9_]{1,63}$'),
+  environment text NOT NULL CHECK (environment IN ('sandbox', 'production')),
+  revision integer NOT NULL CHECK (revision > 0),
+  configuration_digest text NOT NULL CHECK (configuration_digest ~ '^[a-f0-9]{64}$'),
+  lifecycle text NOT NULL CHECK (lifecycle IN ('draft', 'approved', 'retired')),
+  proposed_by_actor_id text,
+  approved_by_actor_id text,
+  approved_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id),
+  UNIQUE (tenant_key, provider, environment, revision),
+  CHECK (proposed_by_actor_id IS NULL OR approved_by_actor_id IS NULL OR proposed_by_actor_id <> approved_by_actor_id)
+);
+
+CREATE TABLE verification.provider_definitions (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  provider text NOT NULL CHECK (provider ~ '^[a-z][a-z0-9_]{1,63}$'),
+  environment text NOT NULL CHECK (environment IN ('sandbox', 'production')),
+  adapter_version text NOT NULL,
+  manifest_digest text NOT NULL CHECK (manifest_digest ~ '^[a-f0-9]{64}$'),
+  compiled_in_registry boolean NOT NULL DEFAULT true,
+  production_eligible boolean NOT NULL DEFAULT false,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, provider, environment)
+);
+
+CREATE TABLE verification.routes (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  provider text NOT NULL CHECK (provider ~ '^[a-z][a-z0-9_]{1,63}$'),
+  environment text NOT NULL CHECK (environment IN ('sandbox', 'production')),
+  package_code text NOT NULL,
+  country_code text CHECK (country_code IS NULL OR country_code ~ '^[A-Z]{2}$'),
+  required_capability text,
+  priority integer NOT NULL DEFAULT 100 CHECK (priority BETWEEN 0 AND 10000),
+  cohort_min integer NOT NULL DEFAULT 0 CHECK (cohort_min BETWEEN 0 AND 99),
+  cohort_max integer NOT NULL DEFAULT 99 CHECK (cohort_max BETWEEN 0 AND 99),
+  window_start timestamptz,
+  window_end timestamptz,
+  allowlist_required boolean NOT NULL DEFAULT false,
+  allowlisted_subject_hashes text[] NOT NULL DEFAULT '{}',
+  configuration_revision_id text NOT NULL,
+  policy_version_id text NOT NULL,
+  lifecycle text NOT NULL CHECK (lifecycle IN ('draft', 'approved', 'active', 'retired')),
+  proposed_by_actor_id text,
+  approved_by_actor_id text,
+  approved_at timestamptz,
+  activated_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id),
+  CHECK (cohort_min <= cohort_max),
+  CHECK (
+    environment <> 'production'
+    OR lifecycle <> 'active'
+    OR (approved_by_actor_id IS NOT NULL AND proposed_by_actor_id IS DISTINCT FROM approved_by_actor_id)
+  )
+);
+
+CREATE TABLE verification.route_change_requests (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  route_id text,
+  proposed_payload jsonb NOT NULL DEFAULT '{}'::jsonb,
+  status text NOT NULL CHECK (status IN ('proposed', 'approved', 'rejected')),
+  reason text NOT NULL,
+  policy_version text NOT NULL,
+  proposed_by_actor_id text NOT NULL,
+  approved_by_actor_id text,
+  approved_at timestamptz,
+  expires_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id),
+  CHECK (proposed_by_actor_id IS DISTINCT FROM approved_by_actor_id OR approved_by_actor_id IS NULL),
+  CHECK (jsonb_typeof(proposed_payload) = 'object')
+);
+
+CREATE TABLE verification.policy_versions (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  version text NOT NULL,
+  environment text NOT NULL CHECK (environment IN ('sandbox', 'production')),
+  lifecycle text NOT NULL CHECK (lifecycle IN ('draft', 'approved', 'active', 'retired')),
+  reason text NOT NULL,
+  expires_at timestamptz,
+  proposed_by_actor_id text,
+  approved_by_actor_id text,
+  approved_at timestamptz,
+  activated_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id),
+  UNIQUE (tenant_key, version),
+  CHECK (proposed_by_actor_id IS NULL OR approved_by_actor_id IS NULL OR proposed_by_actor_id <> approved_by_actor_id),
+  CHECK ((lifecycle = 'active' AND activated_at IS NOT NULL) OR lifecycle <> 'active')
+);
+
+CREATE TABLE verification.protected_action_requirements (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  action text NOT NULL,
+  package_code text NOT NULL,
+  policy_version_id text NOT NULL,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id),
+  UNIQUE (tenant_key, action, package_code, policy_version_id)
+);
+
+CREATE TABLE verification.attempts (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  subject_hash text NOT NULL CHECK (subject_hash ~ '^[a-f0-9]{64}$'),
+  package_code text NOT NULL,
+  country_code text NOT NULL CHECK (country_code ~ '^[A-Z]{2}$'),
+  provider text NOT NULL,
+  environment text NOT NULL CHECK (environment IN ('sandbox', 'production')),
+  adapter_version text NOT NULL,
+  manifest_digest text NOT NULL CHECK (manifest_digest ~ '^[a-f0-9]{64}$'),
+  configuration_revision text NOT NULL,
+  policy_version text NOT NULL,
+  provider_resource_id text,
+  provider_status text,
+  canonical_status text NOT NULL,
+  status_version bigint NOT NULL DEFAULT 0 CHECK (status_version >= 0),
+  idempotency_key text NOT NULL,
+  parent_attempt_id text,
+  purpose_action text,
+  purpose_resource_hash text CHECK (purpose_resource_hash IS NULL OR purpose_resource_hash ~ '^[a-f0-9]{64}$'),
+  route_id text NOT NULL,
+  selection_reason text NOT NULL,
+  normalized_reason_codes text[] NOT NULL DEFAULT '{}',
+  expires_at timestamptz,
+  create_claim_id text,
+  create_claim_expires_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id),
+  UNIQUE (tenant_key, idempotency_key),
+  UNIQUE (tenant_key, provider, provider_resource_id)
+);
+
+CREATE TABLE verification.provider_resource_lineage (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  attempt_id text NOT NULL,
+  resource_type text NOT NULL,
+  provider_resource_id text NOT NULL,
+  relationship_code text NOT NULL,
+  provider_status text NOT NULL,
+  occurred_at timestamptz NOT NULL,
+  PRIMARY KEY (tenant_key, id),
+  UNIQUE (tenant_key, provider_resource_id, resource_type)
+);
+
+CREATE TABLE verification.decisions (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  subject_hash text NOT NULL CHECK (subject_hash ~ '^[a-f0-9]{64}$'),
+  package_code text NOT NULL,
+  attempt_id text,
+  status text NOT NULL CHECK (status IN ('verified', 'declined', 'revoked', 'expired')),
+  source text NOT NULL CHECK (source IN ('provider', 'manual')),
+  policy_version text NOT NULL,
+  reason_codes text[] NOT NULL DEFAULT '{}',
+  effective_at timestamptz NOT NULL,
+  expires_at timestamptz,
+  revoked_at timestamptz,
+  proposer_actor_id text,
+  approver_actor_id text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id),
+  CHECK (expires_at IS NULL OR expires_at > effective_at),
+  CHECK (proposer_actor_id IS NULL OR approver_actor_id IS NULL OR proposer_actor_id <> approver_actor_id)
+);
+
+CREATE TABLE verification.idempotency_claims (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  claim_key text NOT NULL,
+  operation text NOT NULL,
+  attempt_id text,
+  state text NOT NULL CHECK (state IN ('claimed', 'completed', 'failed')),
+  result_ref text,
+  error_code text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  completed_at timestamptz,
+  PRIMARY KEY (tenant_key, claim_key)
+);
+
+CREATE TABLE verification.webhook_events (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  provider text NOT NULL,
+  provider_event_key text NOT NULL CHECK (length(provider_event_key) BETWEEN 8 AND 256),
+  provider_resource_id text NOT NULL,
+  event_type text NOT NULL,
+  occurred_at timestamptz NOT NULL,
+  body_sha256 text NOT NULL CHECK (body_sha256 ~ '^[a-f0-9]{64}$'),
+  safe_metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  state text NOT NULL CHECK (state IN ('accepted', 'processing', 'completed', 'retryable', 'dead_letter')),
+  received_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id),
+  UNIQUE (tenant_key, provider, provider_event_key),
+  CHECK (jsonb_typeof(safe_metadata) = 'object')
+);
+
+CREATE TABLE verification.webhook_leases (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  event_id text NOT NULL,
+  lease_id text,
+  worker_id text,
+  expires_at timestamptz,
+  attempt_count integer NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  next_attempt_at timestamptz NOT NULL DEFAULT now(),
+  last_error_code text,
+  PRIMARY KEY (tenant_key, event_id)
+);
+
+CREATE TABLE verification.reconciliation_jobs (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  attempt_id text NOT NULL,
+  state text NOT NULL CHECK (state IN ('scheduled', 'processing', 'retryable', 'completed', 'dead_letter')),
+  lease_id text,
+  lease_expires_at timestamptz,
+  attempt_count integer NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  next_attempt_at timestamptz NOT NULL DEFAULT now(),
+  last_error_code text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id)
+);
+
+CREATE TABLE verification.redaction_jobs (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  subject_hash text NOT NULL CHECK (subject_hash ~ '^[a-f0-9]{64}$'),
+  attempt_id text,
+  provider_resource_id text,
+  status text NOT NULL CHECK (status IN ('scheduled', 'processing', 'retryable', 'redacted', 'not_applicable', 'dead_letter')),
+  lease_id text,
+  lease_expires_at timestamptz,
+  attempt_count integer NOT NULL DEFAULT 0 CHECK (attempt_count >= 0),
+  next_attempt_at timestamptz NOT NULL DEFAULT now(),
+  last_error_code text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id)
+);
+
+CREATE TABLE verification.provider_health_observations (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  provider text NOT NULL,
+  environment text NOT NULL CHECK (environment IN ('sandbox', 'production')),
+  operation text NOT NULL,
+  outcome text NOT NULL CHECK (outcome IN ('success', 'retryable_failure', 'terminal_failure', 'unknown_status')),
+  safe_code text NOT NULL,
+  observed_at timestamptz NOT NULL,
+  latency_ms integer,
+  PRIMARY KEY (tenant_key, id)
+);
+
+CREATE TABLE verification.circuits (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  provider text NOT NULL,
+  environment text NOT NULL CHECK (environment IN ('sandbox', 'production')),
+  state text NOT NULL CHECK (state IN ('closed', 'open', 'half_open')),
+  reason_code text,
+  open_until timestamptz,
+  consecutive_failures integer NOT NULL DEFAULT 0 CHECK (consecutive_failures >= 0),
+  drained_by_actor_id text,
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, provider, environment)
+);
+
+CREATE TABLE verification.appeals (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  attempt_id text NOT NULL,
+  subject_hash text NOT NULL CHECK (subject_hash ~ '^[a-f0-9]{64}$'),
+  status text NOT NULL CHECK (status IN ('open', 'approved', 'denied', 'more_information_requested', 'revoked', 'expired')),
+  reason text NOT NULL,
+  policy_version text NOT NULL,
+  proposed_by_actor_id text NOT NULL,
+  decided_by_actor_id text,
+  expires_at timestamptz,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id)
+);
+
+CREATE TABLE verification.review_cases (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  attempt_id text NOT NULL,
+  subject_hash text NOT NULL CHECK (subject_hash ~ '^[a-f0-9]{64}$'),
+  status text NOT NULL CHECK (status IN ('open', 'in_review', 'approved', 'denied', 'more_information_requested', 'revoked', 'expired')),
+  reason text NOT NULL,
+  policy_version text NOT NULL,
+  assigned_actor_id text,
+  created_at timestamptz NOT NULL DEFAULT now(),
+  updated_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id)
+);
+
+CREATE TABLE verification.manual_decision_proposals (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  review_case_id text,
+  attempt_id text NOT NULL,
+  proposed_status text NOT NULL CHECK (proposed_status IN ('verified', 'declined', 'revoked', 'expired')),
+  reason text NOT NULL,
+  policy_version text NOT NULL,
+  expires_at timestamptz,
+  proposed_by_actor_id text NOT NULL,
+  approved_by_actor_id text,
+  status text NOT NULL CHECK (status IN ('proposed', 'approved', 'rejected')),
+  created_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id),
+  CHECK (proposed_by_actor_id IS DISTINCT FROM approved_by_actor_id OR approved_by_actor_id IS NULL)
+);
+
+CREATE TABLE verification.audit_events (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  id text NOT NULL,
+  actor_id text NOT NULL,
+  actor_type text NOT NULL CHECK (actor_type IN ('user', 'operator', 'system')),
+  operation text NOT NULL,
+  resource_type text NOT NULL,
+  resource_id text,
+  reason_code text,
+  safe_metadata jsonb NOT NULL DEFAULT '{}'::jsonb,
+  occurred_at timestamptz NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_key, id),
+  CHECK (jsonb_typeof(safe_metadata) = 'object')
+);
+
+CREATE TABLE verification.continuations (
+  tenant_key text NOT NULL REFERENCES verification.tenants(tenant_key) ON DELETE RESTRICT,
+  key text NOT NULL,
+  token_hash text NOT NULL CHECK (token_hash ~ '^[a-f0-9]{64}$'),
+  action text NOT NULL,
+  resource_hash text NOT NULL CHECK (resource_hash ~ '^[a-f0-9]{64}$'),
+  subject_hash text NOT NULL CHECK (subject_hash ~ '^[a-f0-9]{64}$'),
+  destination_key text NOT NULL,
+  expires_at timestamptz NOT NULL,
+  consumed_at timestamptz,
+  PRIMARY KEY (tenant_key, key)
+);
+
+CREATE INDEX routes_active_selection_idx
+  ON verification.routes (tenant_key, environment, package_code, country_code, priority, id)
+  WHERE lifecycle = 'active';
+
+CREATE INDEX attempts_active_idx
+  ON verification.attempts (tenant_key, subject_hash, package_code, updated_at DESC)
+  WHERE canonical_status IN ('created', 'pending_user_input', 'paused', 'processing', 'manual_review_required');
+
+CREATE INDEX attempts_provider_resource_idx
+  ON verification.attempts (tenant_key, provider, provider_resource_id)
+  WHERE provider_resource_id IS NOT NULL;
+
+CREATE INDEX decisions_valid_idx
+  ON verification.decisions (tenant_key, subject_hash, package_code, expires_at DESC)
+  WHERE status = 'verified' AND revoked_at IS NULL;
+
+CREATE INDEX webhook_events_pending_idx
+  ON verification.webhook_events (tenant_key, provider, received_at, id)
+  WHERE state IN ('accepted', 'retryable', 'processing');
+
+CREATE INDEX webhook_leases_work_idx
+  ON verification.webhook_leases (tenant_key, next_attempt_at, event_id)
+  WHERE lease_id IS NULL OR expires_at IS NOT NULL;
+
+CREATE INDEX reconciliation_pending_idx
+  ON verification.reconciliation_jobs (tenant_key, next_attempt_at, id)
+  WHERE state IN ('scheduled', 'retryable', 'processing');
+
+CREATE INDEX redaction_pending_idx
+  ON verification.redaction_jobs (tenant_key, next_attempt_at, id)
+  WHERE status IN ('scheduled', 'retryable', 'processing');
+
+CREATE INDEX health_provider_idx
+  ON verification.provider_health_observations (tenant_key, provider, environment, observed_at DESC);
+
+CREATE INDEX audit_tenant_idx
+  ON verification.audit_events (tenant_key, occurred_at DESC, id);
+
+CREATE UNIQUE INDEX policy_one_active_per_env
+  ON verification.policy_versions (tenant_key, environment)
+  WHERE lifecycle = 'active';
+
+CREATE OR REPLACE FUNCTION verification.reject_audit_mutation()
+RETURNS trigger
+LANGUAGE plpgsql
+AS $$
+BEGIN
+  RAISE EXCEPTION 'audit_events are insert-only';
+END;
+$$;
+
+CREATE TRIGGER audit_events_immutable
+BEFORE UPDATE OR DELETE ON verification.audit_events
+FOR EACH ROW EXECUTE PROCEDURE verification.reject_audit_mutation();

package/migrations/002_seed.down.sql

@@ -0,0 +1,4 @@
+DELETE FROM verification.routes WHERE tenant_key = 'default' AND id = 'rte_sandbox_example_human_idv';
+DELETE FROM verification.configuration_revisions WHERE tenant_key = 'default' AND id = 'cfg_sandbox_example';
+DELETE FROM verification.policy_versions WHERE tenant_key = 'default' AND id IN ('pol_sandbox_example', 'pol_production_unactivated');
+DELETE FROM verification.tenants WHERE tenant_key = 'default';