@the-librarian/cli 1.0.0-rc.21

package/dist/server/up.js

@@ -0,0 +1,625 @@
+// `librarian server up` — build + run the all-in-one container.
+//
+// This is the loop-closer: on a fresh Docker host it clones the monorepo at the
+// resolved release tag, builds `the-librarian:<tag>`, mints the master key +
+// agent token into a 0600 deploy env-file, runs the all-in-one container with
+// `docker run --env-file` (ADR 0008 P4 — secrets off argv), waits for it to
+// report healthy, surfaces the CLI-MINTED master key ONCE, and prints the MCP
+// URL + dashboard URL + the agent token ready to paste into `librarian install`.
+//
+// ADR 0008 P3: there is no admin token. The admin tRPC API is served only on the
+// trusted internal listener (off the network), so `server up` neither reads back
+// nor surfaces an admin token, regardless of bind host.
+//
+// Bind host (spec §5.3 / §6): the default is `127.0.0.1` (host loopback only).
+// `--host <addr>` sets it explicitly. Best-effort, an interactive run with no
+// `--host` is OFFERED a detected Tailscale tailnet IP. Binding to `0.0.0.0`
+// (all interfaces) is ask-first. We NEVER default to `0.0.0.0`, and a
+// non-interactive/`--yes` run never silently exposes the server beyond
+// localhost.
+//
+// The bind choice drives the localhost no-auth bypass via `LIBRARIAN_ALLOW_NO_AUTH`
+// (the image always binds `0.0.0.0` internally, so the server can't see the host
+// publish address — spec §6). Post ADR 0008 P4 it lives in the deploy env-file,
+// not inline on argv:
+//   - `127.0.0.1`        → env-file carries `LIBRARIAN_ALLOW_NO_AUTH=true`; /mcp
+//                          grants the agent role without a token (loopback bypass).
+//   - tailnet / `0.0.0.0`→ OMIT it; /mcp requires the agent token. (The admin
+//                          tRPC API is off the network entirely — ADR 0008.)
+//
+// EVERYTHING that touches the system is injected (`docker.ts` runner — which
+// also routes the Tailscale probe, the latest-release fetcher, the prompter,
+// `home`, the interactivity flag, and the health-poll sleep), so the whole flow
+// is exercised in tests WITHOUT a real daemon, network, git, or tailscale.
+//
+// Security (AGENTS.md): the agent token + master key ride ONLY in the 0600
+// deploy env-file fed to `docker run --env-file` (ADR 0008 P4) — never inline
+// on argv. `--env-file` keeps them off the process argv (and out of any
+// argv-echoing error); it does NOT hide them from `docker inspect .Config.Env`
+// (docker expands the file client-side into the same env list) — that's an
+// accepted trade-off (the wins are off-argv + off `/data`; truly hiding from
+// `docker inspect` would need a mounted-file+entrypoint approach we deliberately
+// did not build). The agent token may ALSO (if the user accepts) land in
+// `~/.librarian/env` via env.ts. The master key is surfaced to stdout exactly
+// once and is NEVER written to any host file other than the 0600 deploy env-file.
+import { randomBytes } from "node:crypto";
+import fs from "node:fs";
+import { isIP } from "node:net";
+import path from "node:path";
+import { readEnvFile, writeEnvFile } from "../env.js";
+import { librarianDir } from "../paths.js";
+import { fetchLatestVersion } from "../status.js";
+import { enableBoot } from "./boot.js";
+import { writeDeployState } from "./deploy-state.js";
+import { run, which } from "./docker.js";
+import { preflight } from "./preflight.js";
+import { redactSecrets } from "./redact.js";
+// Re-exported from its shared home so existing importers (`update.ts`) keep
+// working; new code should import from `./redact.js` directly.
+export { redactSecrets } from "./redact.js";
+/** The repository the deploy dir clones (same repo the latest-tag fetch targets). */
+export const REPO_URL = "https://github.com/JimJafar/the-librarian";
+/** The container name every `server` command operates on (single instance per host). */
+export const CONTAINER_NAME = "the-librarian";
+/** The named data volume default (`--data-volume` overrides). The volume is sacred. */
+export const DEFAULT_DATA_VOLUME = "librarian_data";
+/** Host loopback — the default, only-reachable-locally bind (spec §5/§6). */
+export const LOCALHOST = "127.0.0.1";
+/** Bind-all-interfaces — never the default; ask-first (spec §5.3, §11). */
+export const ALL_INTERFACES = "0.0.0.0";
+/** The warning printed beside the one-time master-key surfacing (spec §5.4). */
+export const SAVE_KEY_WARNING = "SAVE THIS KEY — excluded from backups";
+/**
+ * The 0600 deploy env-file fed to `docker run --env-file` (ADR 0008 P4). It
+ * lives in the deploy dir (alongside `deploy-state.json`) and carries the agent
+ * token + master key + (loopback) `LIBRARIAN_ALLOW_NO_AUTH`. It is DISTINCT from
+ * the client `~/.librarian/env` (env.ts). 0600, by construction.
+ */
+export const DEPLOY_ENV_FILE = "deploy.env";
+/** `<deployDir>/deploy.env` — the 0600 deploy env-file path within a deploy dir. */
+export function deployEnvFilePath(deployDir) {
+    return path.join(deployDir, DEPLOY_ENV_FILE);
+}
+const realSleep = (ms) => new Promise((resolve) => setTimeout(resolve, ms));
+let sleepImpl = realSleep;
+/** Override the health-poll sleep (tests inject a no-op so polling is instant). */
+export function setSleep(next) {
+    sleepImpl = next;
+}
+/** Restore the real sleep (tests). */
+export function resetSleep() {
+    sleepImpl = realSleep;
+}
+const realMinter = () => randomBytes(32).toString("hex");
+let minter = realMinter;
+/** Override the agent-token minter (tests). */
+export function setTokenMinter(next) {
+    minter = next;
+}
+/** Restore the real CSPRNG minter (tests). */
+export function resetTokenMinter() {
+    minter = realMinter;
+}
+/**
+ * Mint one agent token through the CURRENT minter. Exported so `update` mints a
+ * fresh token (when the old container's token can't be read back) via the same
+ * injectable seam `up` uses — a single deterministic value in tests.
+ */
+export function mintAgentToken() {
+    return minter();
+}
+const realKeyMinter = () => randomBytes(32).toString("hex");
+let keyMinter = realKeyMinter;
+/** Override the master-key minter (tests). */
+export function setSecretKeyMinter(next) {
+    keyMinter = next;
+}
+/** Restore the real CSPRNG master-key minter (tests). */
+export function resetSecretKeyMinter() {
+    keyMinter = realKeyMinter;
+}
+/**
+ * Mint one master key through the CURRENT minter. Exported so `update` can mint a
+ * fresh key (only when the old container's key can't be read back) via the same
+ * injectable seam `up` uses — a single deterministic value in tests.
+ */
+export function mintSecretKey() {
+    return keyMinter();
+}
+/** A teaching error from `up`; the runtime renders `.message` as one stderr line. */
+export class UpError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "UpError";
+    }
+}
+/**
+ * Construct the `docker run` argv (everything after `docker`). The SINGLE place
+ * the run vector is assembled.
+ *
+ * Secrets are delivered via `--env-file <path>` — NOT inline `-e` — so the agent
+ * token, the master key, and (loopback only) `LIBRARIAN_ALLOW_NO_AUTH` never
+ * appear on argv (ADR 0008 P4). `--env-file` keeps them off argv (and out of any
+ * argv-echoing error); it does NOT hide them from `docker inspect .Config.Env`
+ * (docker expands the file client-side into the same env list) — an accepted
+ * trade-off (the wins are off-argv + the master key off `/data`).
+ *
+ * The image runs `tini` as PID 1, so `--init` is deliberately omitted. The
+ * publish address is derived from `host`; the loopback no-auth bypass
+ * (`LIBRARIAN_ALLOW_NO_AUTH`) lives INSIDE the env-file (loopback-only — see
+ * {@link writeDeployEnvFile}), not on this argv.
+ */
+export function buildRunArgs(input) {
+    const { host, dataVolume, tag, envFile } = input;
+    return [
+        "run",
+        "-d",
+        "--name",
+        CONTAINER_NAME,
+        "--restart",
+        "unless-stopped",
+        "-p",
+        `${host}:3000:3000`,
+        "-p",
+        `${host}:3838:3838`,
+        "-v",
+        `${dataVolume}:/data`,
+        "--env-file",
+        envFile,
+        `${CONTAINER_NAME}:${tag}`,
+    ];
+}
+/**
+ * Write the 0600 deploy env-file `docker run --env-file` reads, returning its
+ * path. It carries `LIBRARIAN_AGENT_TOKEN`, `LIBRARIAN_SECRET_KEY` (when
+ * supplied), and (loopback only) `LIBRARIAN_ALLOW_NO_AUTH=true`. Mode 0600 on
+ * create AND an unconditional `chmodSync(0o600)` so a pre-existing looser file is
+ * tightened (same discipline as env.ts `writeEnvFile`). The directory is created
+ * if missing.
+ *
+ * Format is `KEY=VALUE` lines (docker's `--env-file` syntax — NOT shell, so no
+ * quoting/`export`). The minted secrets are 64-hex with no special chars, so a
+ * raw value is safe; we reject a value with a newline (it would corrupt the file
+ * / smuggle a second var) rather than emit a malformed file.
+ */
+export function writeDeployEnvFile(deployDir, input) {
+    const secretKey = input.secretKey?.trim() ?? "";
+    for (const [name, value] of [
+        ["LIBRARIAN_AGENT_TOKEN", input.agentToken],
+        ["LIBRARIAN_SECRET_KEY", secretKey],
+    ]) {
+        if (/[\r\n]/.test(value)) {
+            throw new UpError(`Refusing to write ${name} containing a newline to the deploy env-file.`);
+        }
+    }
+    fs.mkdirSync(deployDir, { recursive: true });
+    const lines = [`LIBRARIAN_AGENT_TOKEN=${input.agentToken}`];
+    // Omit the key line entirely when absent (update's read-back-failed path) — the
+    // server then resolves it from /data/secret.key, preserving encrypted secrets.
+    if (secretKey) {
+        lines.push(`LIBRARIAN_SECRET_KEY=${secretKey}`);
+    }
+    if (input.host === LOCALHOST) {
+        lines.push("LIBRARIAN_ALLOW_NO_AUTH=true");
+    }
+    const file = deployEnvFilePath(deployDir);
+    fs.writeFileSync(file, `${lines.join("\n")}\n`, { encoding: "utf8", mode: 0o600 });
+    // writeFileSync only applies `mode` on create; chmod unconditionally so a
+    // pre-existing looser file is tightened (env.ts discipline).
+    fs.chmodSync(file, 0o600);
+    return file;
+}
+/**
+ * Run `server up`. Throws `UpError` (teaching message) on any failure; on a
+ * failed health-wait it rolls the container back first so no half-up state is
+ * left behind. Works for any resolved bind host (loopback / tailnet / all
+ * interfaces); the bind choice drives the auth model (§6).
+ */
+export async function runUp(options, deps) {
+    // 1) Preflight: docker (daemon reachable) + git, or a teaching error.
+    await preflight(deps.platform ? { platform: deps.platform } : {});
+    // 2) Resolve the bind host (default loopback; Tailscale offer; `0.0.0.0`
+    //    ask-first). May throw `UpError` if the user declines a `0.0.0.0` bind —
+    //    BEFORE any clone/build/run, so a declined exposure leaves nothing behind.
+    const host = await resolveBindHost(options, deps);
+    const dataVolume = options.dataVolume ?? DEFAULT_DATA_VOLUME;
+    const deployDir = options.dir ?? path.join(librarianDir(deps.home), "server");
+    // 3) Resolve the ref (default = latest release tag), then the deploy dir.
+    const tag = await resolveRef(options.ref);
+    await prepareDeployDir(deployDir, tag);
+    // 4) Mint the secrets the CLI owns (the loop-closer). Both are CSPRNG and
+    //    NEVER logged: the agent token, and — ADR 0008 P4 — the master key. The
+    //    CLI minting the master key (env wins in core's `env → file → generate`)
+    //    is what keeps it OFF `/data/secret.key`. They ride only in the 0600
+    //    deploy env-file fed to `--env-file`, never inline on argv.
+    const agentToken = minter();
+    const masterKey = mintSecretKey();
+    const envFile = writeDeployEnvFile(deployDir, { agentToken, secretKey: masterKey, host });
+    // 5) Build the image, then run the container (secrets via `--env-file`).
+    await build(deployDir, tag);
+    await dockerRun(buildRunArgs({ host, dataVolume, tag, envFile }), deployDir);
+    // 6+7) Wait for health. ANY failure in this post-`docker run` phase — a
+    //      timeout/unhealthy report or an exception from `docker inspect`/`sleep`
+    //      — MUST force-remove the container so no half-up state is left behind
+    //      (spec §11). `waitForHealthy` already rolls back on its own
+    //      timeout/unhealthy path; this guard catches the throwing cases it
+    //      can't (the second `rm -f` is best-effort + idempotent).
+    //
+    //      ADR 0008 P4: the master key is no longer READ BACK from the container
+    //      (`docker exec cat /data/secret.key`) — the CLI minted it and supplied
+    //      it via env, so the server never writes that file. We surface the
+    //      key we minted.
+    try {
+        await waitForHealthy(options);
+    }
+    catch (error) {
+        await run("docker", ["rm", "-f", CONTAINER_NAME]).catch(() => undefined);
+        throw error;
+    }
+    // 7b) Persist the NON-SECRET deploy-state so `update` can recreate the
+    //     container with the same config and `status` can report the deployed
+    //     ref reliably. This carries the bind host / data volume / ref / image
+    //     tag / container name — NEVER a token or key (deploy-state.ts whitelists
+    //     the fields). Only after a confirmed-healthy run, so the recorded state
+    //     reflects a container that actually came up.
+    writeDeployState(deployDir, {
+        containerName: CONTAINER_NAME,
+        host,
+        dataVolume,
+        ref: tag,
+        imageTag: `${CONTAINER_NAME}:${tag}`,
+    });
+    // 8) Boot persistence (opt-in, spec §5.8). With `--enable-boot`, install +
+    //    enable the systemd unit AFTER a healthy up (so the named container the
+    //    unit references actually exists). On macOS this prints the deferred
+    //    notice and continues — the `up` still succeeds. The unit references the
+    //    EXISTING container by name and carries NO secret (boot.ts).
+    const lines = [];
+    if (options.enableBoot) {
+        const bootResult = await enableBoot(deps.platform ? { platform: deps.platform } : {});
+        lines.push(bootResult.output, "");
+    }
+    // 9) Close the loop: surface secrets/URLs + offer the local env write.
+    await closeTheLoop(lines, { host, agentToken, masterKey, options, deps });
+    return { output: lines.join("\n") };
+}
+// --- bind-host resolution (spec §5.3, §6) -------------------------------
+/**
+ * Resolve the host the container publishes on:
+ *   - `--host <addr>` wins (explicit). `0.0.0.0` is still ask-first.
+ *   - no `--host`, interactive, not `--yes`, and `tailscale ip -4` yields a
+ *     tailnet IP → OFFER it (default: keep loopback).
+ *   - otherwise → `127.0.0.1` (we never silently expose beyond localhost).
+ *
+ * Binding to `0.0.0.0` requires explicit confirmation (`--yes` auto-accepts);
+ * declining aborts with a teaching error BEFORE any clone/build/run.
+ */
+async function resolveBindHost(options, deps) {
+    // An empty/whitespace `--host` (e.g. `--host ""`) is treated as "not provided"
+    // rather than slipping through as `""` — which would publish `-p :3000:3000`
+    // (ALL interfaces) with no ask-first (I1). Fall through to the default path.
+    if (options.host !== undefined && options.host.trim().length > 0) {
+        const host = normalizeHost(options.host.trim());
+        if (host === ALL_INTERFACES) {
+            await confirmAllInterfaces(options, deps);
+        }
+        else if (isIpv6Literal(host)) {
+            // `::1` already normalized to loopback above; any OTHER IPv6 literal is
+            // beyond this slice's scope (the `-p` arg would need bracketing and the
+            // exposure path would need IPv6 reasoning). Teach rather than emit a
+            // malformed `-p ::ffff:…:3000:3000`.
+            throw new UpError(`IPv6 bind addresses other than loopback (::1) are not supported yet (got '${host}'). ` +
+                "Use an IPv4 address (e.g. a tailnet IP) or '0.0.0.0' to bind all interfaces.");
+        }
+        return host;
+    }
+    // No explicit host: best-effort offer the Tailscale IP (interactive only).
+    const interactive = deps.interactive ?? true;
+    if (interactive && options.yes !== true) {
+        const tailnetIp = await detectTailscaleIp();
+        if (tailnetIp) {
+            const answer = await deps.prompter.promptText(`Detected a Tailscale address (${tailnetIp}). Bind the server to it so your ` +
+                `tailnet can reach it (instead of localhost only)? [y/N]`, { default: "n" });
+            if (isYes(answer))
+                return tailnetIp;
+        }
+    }
+    return LOCALHOST;
+}
+/**
+ * Normalize loopback spellings to the canonical `127.0.0.1` (I3). The server
+ * treats `localhost` / `::1` / `127.0.0.1` identically (loopback no-auth bypass),
+ * so the CLI must too — otherwise `--host localhost` would omit `ALLOW_NO_AUTH`
+ * and needlessly require an agent token for a loopback-only server. Any other
+ * value is returned unchanged (the caller decides whether it's allowed).
+ */
+function normalizeHost(host) {
+    const lower = host.toLowerCase();
+    if (lower === "localhost" || lower === "::1" || lower === LOCALHOST)
+        return LOCALHOST;
+    return host;
+}
+/** True for a genuine IPv6 literal (after loopback normalization). */
+function isIpv6Literal(host) {
+    return isIP(host) === 6;
+}
+/**
+ * Confirm an all-interfaces (`0.0.0.0`) bind. `--yes` auto-accepts; otherwise
+ * prompt (default no). Declining throws `UpError` — exposing every interface is
+ * never something we do without an explicit yes.
+ */
+async function confirmAllInterfaces(options, deps) {
+    if (options.yes === true)
+        return;
+    const answer = await deps.prompter.promptText(`Binding to 0.0.0.0 exposes the server on ALL network interfaces — anyone who ` +
+        `can reach this machine can reach it. Continue? [y/N]`, { default: "n" });
+    if (!isYes(answer)) {
+        throw new UpError("Aborted: binding to 0.0.0.0 (all interfaces) was declined. " +
+            "Re-run without --host for a localhost-only server, or with --host <tailnet-ip> " +
+            "for a specific reachable address.");
+    }
+}
+/**
+ * Best-effort probe for this machine's Tailscale IPv4 address, routed through
+ * the injectable `docker.ts` runner (so tests stub it; no real tailscale).
+ * Returns `null` when `tailscale` is absent or yields no usable IPv4 — the
+ * caller then stays on loopback. Never throws: a probe failure is silent.
+ */
+async function detectTailscaleIp() {
+    if ((await which("tailscale")) === null)
+        return null;
+    try {
+        const result = await run("tailscale", ["ip", "-4"]);
+        if (result.code !== 0)
+            return null;
+        // Use `node:net` `isIP` so invalid octets (e.g. `999.1.2.3`) are rejected —
+        // a loose `\d{1,3}` regex would accept them (S1).
+        const ip = result.stdout
+            .split("\n")
+            .map((l) => l.trim())
+            .find((l) => isIP(l) === 4);
+        return ip ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+// --- step helpers --------------------------------------------------------
+/** Resolve the ref to deploy: an explicit `--ref` wins; else the latest tag. */
+async function resolveRef(ref) {
+    if (ref && ref.trim().length > 0)
+        return ref.trim();
+    const latest = await fetchLatestVersion();
+    if (!latest) {
+        throw new UpError("Could not resolve the latest release tag from GitHub. " +
+            "Check your network, or pin a ref with `--ref <tag|main>`.");
+    }
+    // `fetchLatestVersion` strips the leading `v`; the tag we check out keeps it.
+    return `v${latest}`;
+}
+/**
+ * Ready the deploy dir at `tag`:
+ *   - absent → `git clone <repo> <dir>` then checkout the ref;
+ *   - already OUR managed clone → `git fetch` + checkout the ref;
+ *   - exists but isn't our clone (different remote / dirty) → STOP and ask.
+ * Never clobbers a dir we didn't create.
+ */
+async function prepareDeployDir(dir, tag) {
+    const gitDir = path.join(dir, ".git");
+    if (!(await pathExists(gitDir))) {
+        if (await pathExists(dir)) {
+            // A non-empty dir that isn't a git repo → not ours; don't clobber.
+            if (!(await isEmptyDir(dir))) {
+                throw new UpError(`Deploy dir ${dir} exists but is not a Librarian clone (no .git). ` +
+                    "Refusing to overwrite a directory I didn't create — " +
+                    "remove it or choose another path with `--dir <path>`.");
+            }
+        }
+        await git(["clone", REPO_URL, dir]);
+        await checkoutRef(dir, tag);
+        return;
+    }
+    // It's a git repo — confirm it's OUR clone before touching it.
+    const originResult = await run("git", ["-C", dir, "remote", "get-url", "origin"]);
+    const origin = originResult.stdout.trim();
+    if (!sameRepo(origin, REPO_URL)) {
+        throw new UpError(`Deploy dir ${dir} is a git repo with a different remote (${origin || "none"}). ` +
+            "Refusing to touch a clone I didn't create — choose another path with `--dir <path>`.");
+    }
+    await git(["-C", dir, "fetch", "--tags", "origin"]);
+    await checkoutRef(dir, tag);
+}
+/** True iff `origin` points at the same repo as `REPO_URL` (scheme/.git tolerant). */
+function sameRepo(origin, repo) {
+    const norm = (u) => u
+        .trim()
+        .replace(/\.git$/, "")
+        .replace(/\/$/, "")
+        .replace(/^git@github\.com:/, "https://github.com/")
+        .toLowerCase();
+    return norm(origin) === norm(repo);
+}
+/** Build the all-in-one image from the deploy dir (the VERIFIED build command). */
+async function build(deployDir, tag) {
+    await dockerInDir(["build", "-f", "docker/all-in-one.Dockerfile", "-t", `${CONTAINER_NAME}:${tag}`, "."], deployDir);
+}
+/** Run the container (the assembled run argv) from the deploy dir. */
+async function dockerRun(args, deployDir) {
+    await dockerInDir(args, deployDir);
+}
+/**
+ * Poll `docker inspect … Health.Status` until `healthy`, bounded. On timeout or
+ * an unhealthy report: surface `docker logs --tail` (REDACTED), roll the
+ * container back (`docker rm -f`), and throw — leaving NO half-up container.
+ *
+ * Exported so `update` recreates with the IDENTICAL health-wait + rollback
+ * pattern (a failed recreate force-removes the new container and never advances
+ * deploy-state). The thrown `UpError`'s message is already secret-redacted.
+ */
+export async function waitForHealthy(options) {
+    const attempts = options.healthAttempts ?? 60;
+    const intervalMs = options.healthIntervalMs ?? 2000;
+    const tail = options.logTailLines ?? 50;
+    for (let i = 0; i < attempts; i += 1) {
+        const result = await run("docker", [
+            "inspect",
+            "--format",
+            "{{.State.Health.Status}}",
+            CONTAINER_NAME,
+        ]);
+        const state = result.stdout.trim();
+        if (state === "healthy")
+            return;
+        if (state === "unhealthy")
+            break; // no point waiting out the bound
+        if (i < attempts - 1)
+            await sleepImpl(intervalMs);
+    }
+    // Failed: surface the recent logs for triage, but REDACT first. Post-ADR-0008-P3
+    // the server no longer logs an admin token, but the redactor still scrubs the
+    // legacy generation line and any `libadmin_`/bearer token in the captured output
+    // (defense-in-depth, e.g. an older image) — none of that may reach an error
+    // message (spec §5.6 wants logs surfaced, just not secrets). Then roll back so
+    // no half-up container survives.
+    const logs = await run("docker", ["logs", "--tail", String(tail), CONTAINER_NAME]);
+    await run("docker", ["rm", "-f", CONTAINER_NAME]);
+    const detail = redactSecrets(logs.stdout.trim() || logs.stderr.trim());
+    throw new UpError(`The server did not become healthy in time and was rolled back ` +
+        `(container removed; the data volume is untouched). Recent logs:\n` +
+        (detail ? detail : "(no log output captured)") +
+        `\n\nFix the cause above, then re-run \`librarian server up\`.`);
+}
+/**
+ * Close the loop: surface the master key ONCE (with the SAVE warning), print the
+ * MCP + dashboard URLs and the minted agent token, and OFFER to write this
+ * machine's `~/.librarian/env` when it's absent/incomplete (`--yes` auto-accepts).
+ *
+ * ADR 0008 P4: the master key surfaced here is the one the CLI MINTED (and
+ * delivered via the deploy env-file) — it is no longer read back from
+ * `/data/secret.key` (the server never writes that file when the key is env-
+ * supplied). It is never written to any host file (only the 0600 deploy env-file).
+ *
+ * ADR 0008 P3: no admin token is surfaced — the admin tRPC API is off the network
+ * (internal listener only), so there is no admin token to mint or paste anywhere.
+ */
+async function closeTheLoop(lines, ctx) {
+    const { host, agentToken, masterKey, options, deps } = ctx;
+    const mcpUrl = `http://${host}:3838/mcp`;
+    const dashboardUrl = `http://${host}:3000`;
+    lines.push("The Librarian server is up and healthy.", "", `  MCP URL:     ${mcpUrl}`, `  Dashboard:   ${dashboardUrl}`, `  Agent token: ${agentToken}`, "");
+    // `0.0.0.0` is a bind directive, not a connectable address — point clients at
+    // the machine's real reachable IP rather than over-engineering auto-detection.
+    if (host === ALL_INTERFACES) {
+        // S2: a `--yes` run auto-accepts the all-interfaces bind with no prompt, so
+        // print a one-line trace of that exposure — otherwise it's invisible in CI
+        // logs (the only record of "we bound every interface, unattended").
+        if (options.yes === true) {
+            lines.push("Note: binding 0.0.0.0 (all interfaces) — auto-accepted via --yes.", "");
+        }
+        lines.push("Note: 0.0.0.0 binds every interface but is NOT a connectable address — " +
+            "clients should use this machine's reachable LAN/tailnet IP in the URLs above.", "");
+    }
+    lines.push("Paste the MCP URL + agent token into `librarian install` on your clients.", "", 
+    // The ONE-TIME master-key surfacing (the CLI-minted key — ADR 0008 P4).
+    // Never written to any host file other than the 0600 deploy env-file.
+    `Master key (${SAVE_KEY_WARNING}):`, `  ${masterKey}`, "");
+    await offerLocalEnv(lines, { mcpUrl, agentToken, options, deps });
+}
+/**
+ * Offer to write this machine's own `~/.librarian/env` (so single-box dev gets
+ * server + client in one shot). OFFER, never force: prompt (default no), or
+ * auto-accept with `--yes`. Reuses env.ts so the token lands chmod-600 and is
+ * never logged. Only offers when the env is absent/incomplete.
+ */
+async function offerLocalEnv(lines, ctx) {
+    const { mcpUrl, agentToken, options, deps } = ctx;
+    const existing = readEnvFile(deps.home);
+    const complete = Boolean(existing?.mcpUrl && existing?.token);
+    if (complete) {
+        lines.push("This machine's `~/.librarian/env` is already configured — left as is.");
+        return;
+    }
+    let accepted = options.yes === true;
+    if (!accepted) {
+        const answer = await deps.prompter.promptText("Write this machine's own ~/.librarian/env so local agents use this server? [y/N]", { default: "n" });
+        accepted = isYes(answer);
+    }
+    if (accepted) {
+        writeEnvFile({ mcpUrl, token: agentToken }, deps.home);
+        lines.push("Wrote ~/.librarian/env (chmod 600) — local agents now point at this server.");
+    }
+    else {
+        lines.push("Left ~/.librarian/env untouched. Configure a client later with:", `  librarian config --mcp-url ${mcpUrl} --token <the agent token above>`);
+    }
+}
+function isYes(answer) {
+    const a = answer.trim().toLowerCase();
+    return a === "y" || a === "yes";
+}
+// --- thin runner wrappers (teaching errors on a non-zero exit) ----------
+/** Run a `git …` command from anywhere; a non-zero exit is a teaching error. */
+async function git(args) {
+    const result = await run("git", args);
+    failIfNonZero("git", args, result);
+}
+/**
+ * Check out `ref` in `dir` without letting a `--…`-shaped ref inject a git
+ * option (S-1). `git checkout` does NOT honor `--end-of-options` — it reads the
+ * marker itself as a pathspec (`pathspec '--end-of-options' did not match`,
+ * verified on git 2.43), so guarding the ref on the checkout fails outright.
+ * `git rev-parse` DOES honor `--end-of-options`, so we resolve the ref to a
+ * commit SHA there (the injection guard that actually works), then check out
+ * that SHA — a hex object id can never be parsed as an option.
+ */
+export async function checkoutRef(dir, ref) {
+    const resolved = await run("git", [
+        "-C",
+        dir,
+        "rev-parse",
+        "--verify",
+        "--end-of-options",
+        `${ref}^{commit}`,
+    ]);
+    failIfNonZero("git", ["-C", dir, "rev-parse", ref], resolved);
+    await git(["-C", dir, "checkout", resolved.stdout.trim()]);
+}
+/** Run a `docker …` command from the deploy dir; non-zero exit → teaching error. */
+async function dockerInDir(args, cwd) {
+    const result = await run("docker", args, { cwd });
+    failIfNonZero("docker", args, result);
+}
+function failIfNonZero(cmd, args, result) {
+    if (result.code === 0)
+        return;
+    // Redact in case a failed docker/git step echoed a secret-shaped value. Post
+    // ADR 0008 P4 the secrets ride in the 0600 deploy env-file (via `--env-file`),
+    // NOT inline on argv — so an argv-echoing `build`/`run` failure no longer
+    // carries them. We still redact defensively (e.g. a daemon that prints the
+    // expanded env, or an older code path) so no 64-hex secret reaches the message.
+    const detail = redactSecrets(result.stderr.trim() || result.stdout.trim());
+    throw new UpError(`\`${cmd} ${args[0]}\` failed (exit ${result.code ?? "signal"})` +
+        (detail ? `:\n${detail}` : ".") +
+        "\n\nResolve the error above, then re-run `librarian server up`.");
+}
+// --- tiny fs probes (kept here so the flow stays self-contained) ---------
+async function pathExists(p) {
+    const fs = await import("node:fs/promises");
+    try {
+        await fs.access(p);
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+async function isEmptyDir(p) {
+    const fs = await import("node:fs/promises");
+    try {
+        const entries = await fs.readdir(p);
+        return entries.length === 0;
+    }
+    catch {
+        return false;
+    }
+}
+//# sourceMappingURL=up.js.map

package/dist/server/up.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"up.js","sourceRoot":"","sources":["../../src/server/up.ts"],"names":[],"mappings":"AAAA,gEAAgE;AAChE,EAAE;AACF,gFAAgF;AAChF,6EAA6E;AAC7E,8EAA8E;AAC9E,4EAA4E;AAC5E,8EAA8E;AAC9E,iFAAiF;AACjF,EAAE;AACF,iFAAiF;AACjF,iFAAiF;AACjF,wDAAwD;AACxD,EAAE;AACF,+EAA+E;AAC/E,8EAA8E;AAC9E,4EAA4E;AAC5E,sEAAsE;AACtE,uEAAuE;AACvE,aAAa;AACb,EAAE;AACF,oFAAoF;AACpF,iFAAiF;AACjF,gFAAgF;AAChF,sBAAsB;AACtB,iFAAiF;AACjF,oFAAoF;AACpF,8EAA8E;AAC9E,6EAA6E;AAC7E,EAAE;AACF,6EAA6E;AAC7E,6EAA6E;AAC7E,gFAAgF;AAChF,2EAA2E;AAC3E,EAAE;AACF,2EAA2E;AAC3E,8EAA8E;AAC9E,wEAAwE;AACxE,+EAA+E;AAC/E,2EAA2E;AAC3E,6EAA6E;AAC7E,iFAAiF;AACjF,yEAAyE;AACzE,8EAA8E;AAC9E,kFAAkF;AAElF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,MAAM,SAAS,CAAC;AACzB,OAAO,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAChC,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAE3C,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACvC,OAAO,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AACrD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAkB,MAAM,aAAa,CAAC;AACzD,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,4EAA4E;AAC5E,+DAA+D;AAC/D,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,qFAAqF;AACrF,MAAM,CAAC,MAAM,QAAQ,GAAG,2CAA2C,CAAC;AAEpE,wFAAwF;AACxF,MAAM,CAAC,MAAM,cAAc,GAAG,eAAe,CAAC;AAE9C,uFAAuF;AACvF,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AAEpD,6EAA6E;AAC7E,MAAM,CAAC,MAAM,SAAS,GAAG,WAAW,CAAC;AAErC,2EAA2E;AAC3E,MAAM,CAAC,MAAM,cAAc,GAAG,SAAS,CAAC;AAExC,gFAAgF;AAChF,MAAM,CAAC,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AAExE;;;;;GAKG;AACH,MAAM,CAAC,MAAM,eAAe,GAAG,YAAY,CAAC;AAE5C,oFAAoF;AACpF,MAAM,UAAU,iBAAiB,CAAC,SAAiB;IACjD,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,eAAe,CAAC,CAAC;AAC/C,CAAC;AAOD,MAAM,SAAS,GAAU,CAAC,EAAE,EAAE,EAAE,CAAC,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAC;AAEnF,IAAI,SAAS,GAAU,SAAS,CAAC;AAEjC,mFAAmF;AACnF,MAAM,UAAU,QAAQ,CAAC,IAAW;IAClC,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,sCAAsC;AACtC,MAAM,UAAU,UAAU;IACxB,SAAS,GAAG,SAAS,CAAC;AACxB,CAAC;AAOD,MAAM,UAAU,GAAgB,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAEtE,IAAI,MAAM,GAAgB,UAAU,CAAC;AAErC,+CAA+C;AAC/C,MAAM,UAAU,cAAc,CAAC,IAAiB;IAC9C,MAAM,GAAG,IAAI,CAAC;AAChB,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,gBAAgB;IAC9B,MAAM,GAAG,UAAU,CAAC;AACtB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc;IAC5B,OAAO,MAAM,EAAE,CAAC;AAClB,CAAC;AAYD,MAAM,aAAa,GAAoB,GAAG,EAAE,CAAC,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;AAE7E,IAAI,SAAS,GAAoB,aAAa,CAAC;AAE/C,8CAA8C;AAC9C,MAAM,UAAU,kBAAkB,CAAC,IAAqB;IACtD,SAAS,GAAG,IAAI,CAAC;AACnB,CAAC;AAED,yDAAyD;AACzD,MAAM,UAAU,oBAAoB;IAClC,SAAS,GAAG,aAAa,CAAC;AAC5B,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,aAAa;IAC3B,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAgDD,qFAAqF;AACrF,MAAM,OAAO,OAAQ,SAAQ,KAAK;IAChC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,SAAS,CAAC;IACxB,CAAC;CACF;AAiBD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,YAAY,CAAC,KAAmB;IAC9C,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,GAAG,KAAK,CAAC;IACjD,OAAO;QACL,KAAK;QACL,IAAI;QACJ,QAAQ;QACR,cAAc;QACd,WAAW;QACX,gBAAgB;QAChB,IAAI;QACJ,GAAG,IAAI,YAAY;QACnB,IAAI;QACJ,GAAG,IAAI,YAAY;QACnB,IAAI;QACJ,GAAG,UAAU,QAAQ;QACrB,YAAY;QACZ,OAAO;QACP,GAAG,cAAc,IAAI,GAAG,EAAE;KAC3B,CAAC;AACJ,CAAC;AAsBD;;;;;;;;;;;;GAYG;AACH,MAAM,UAAU,kBAAkB,CAAC,SAAiB,EAAE,KAAqB;IACzE,MAAM,SAAS,GAAG,KAAK,CAAC,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,CAAC;IAChD,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI;QAC1B,CAAC,uBAAuB,EAAE,KAAK,CAAC,UAAU,CAAC;QAC3C,CAAC,sBAAsB,EAAE,SAAS,CAAC;KAC3B,EAAE,CAAC;QACX,IAAI,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACzB,MAAM,IAAI,OAAO,CAAC,qBAAqB,IAAI,+CAA+C,CAAC,CAAC;QAC9F,CAAC;IACH,CAAC;IACD,EAAE,CAAC,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC7C,MAAM,KAAK,GAAG,CAAC,yBAAyB,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;IAC5D,gFAAgF;IAChF,+EAA+E;IAC/E,IAAI,SAAS,EAAE,CAAC;QACd,KAAK,CAAC,IAAI,CAAC,wBAAwB,SAAS,EAAE,CAAC,CAAC;IAClD,CAAC;IACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC7B,KAAK,CAAC,IAAI,CAAC,8BAA8B,CAAC,CAAC;IAC7C,CAAC;IACD,MAAM,IAAI,GAAG,iBAAiB,CAAC,SAAS,CAAC,CAAC;IAC1C,EAAE,CAAC,aAAa,CAAC,IAAI,EAAE,GAAG,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACnF,0EAA0E;IAC1E,6DAA6D;IAC7D,EAAE,CAAC,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IAC1B,OAAO,IAAI,CAAC;AACd,CAAC;AASD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,KAAK,CAAC,OAAkB,EAAE,IAAY;IAC1D,sEAAsE;IACtE,MAAM,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAElE,yEAAyE;IACzE,6EAA6E;IAC7E,+EAA+E;IAC/E,MAAM,IAAI,GAAG,MAAM,eAAe,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAElD,MAAM,UAAU,GAAG,OAAO,CAAC,UAAU,IAAI,mBAAmB,CAAC;IAC7D,MAAM,SAAS,GAAG,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;IAE9E,0EAA0E;IAC1E,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,gBAAgB,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAEvC,0EAA0E;IAC1E,4EAA4E;IAC5E,6EAA6E;IAC7E,yEAAyE;IACzE,gEAAgE;IAChE,MAAM,UAAU,GAAG,MAAM,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAG,aAAa,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,kBAAkB,CAAC,SAAS,EAAE,EAAE,UAAU,EAAE,SAAS,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1F,yEAAyE;IACzE,MAAM,KAAK,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IAC5B,MAAM,SAAS,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,OAAO,EAAE,CAAC,EAAE,SAAS,CAAC,CAAC;IAE7E,wEAAwE;IACxE,8EAA8E;IAC9E,4EAA4E;IAC5E,kEAAkE;IAClE,wEAAwE;IACxE,+DAA+D;IAC/D,EAAE;IACF,6EAA6E;IAC7E,6EAA6E;IAC7E,wEAAwE;IACxE,sBAAsB;IACtB,IAAI,CAAC;QACH,MAAM,cAAc,CAAC,OAAO,CAAC,CAAC;IAChC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACzE,MAAM,KAAK,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,0EAA0E;IAC1E,2EAA2E;IAC3E,8EAA8E;IAC9E,6EAA6E;IAC7E,kDAAkD;IAClD,gBAAgB,CAAC,SAAS,EAAE;QAC1B,aAAa,EAAE,cAAc;QAC7B,IAAI;QACJ,UAAU;QACV,GAAG,EAAE,GAAG;QACR,QAAQ,EAAE,GAAG,cAAc,IAAI,GAAG,EAAE;KACrC,CAAC,CAAC;IAEH,2EAA2E;IAC3E,4EAA4E;IAC5E,yEAAyE;IACzE,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,IAAI,OAAO,CAAC,UAAU,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,MAAM,UAAU,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;QACtF,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;IACpC,CAAC;IAED,uEAAuE;IACvE,MAAM,YAAY,CAAC,KAAK,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;IAE1E,OAAO,EAAE,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;AACtC,CAAC;AAED,2EAA2E;AAE3E;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAAC,OAAkB,EAAE,IAAY;IAC7D,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,CAAC;QAChD,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;YAC5B,MAAM,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;QAC5C,CAAC;aAAM,IAAI,aAAa,CAAC,IAAI,CAAC,EAAE,CAAC;YAC/B,wEAAwE;YACxE,wEAAwE;YACxE,qEAAqE;YACrE,qCAAqC;YACrC,MAAM,IAAI,OAAO,CACf,6EAA6E,IAAI,MAAM;gBACrF,8EAA8E,CACjF,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,2EAA2E;IAC3E,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC;IAC7C,IAAI,WAAW,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;QACxC,MAAM,SAAS,GAAG,MAAM,iBAAiB,EAAE,CAAC;QAC5C,IAAI,SAAS,EAAE,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAC3C,iCAAiC,SAAS,mCAAmC;gBAC3E,yDAAyD,EAC3D,EAAE,OAAO,EAAE,GAAG,EAAE,CACjB,CAAC;YACF,IAAI,KAAK,CAAC,MAAM,CAAC;gBAAE,OAAO,SAAS,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;;;;GAMG;AACH,SAAS,aAAa,CAAC,IAAY;IACjC,MAAM,KAAK,GAAG,IAAI,CAAC,WAAW,EAAE,CAAC;IACjC,IAAI,KAAK,KAAK,WAAW,IAAI,KAAK,KAAK,KAAK,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACtF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,sEAAsE;AACtE,SAAS,aAAa,CAAC,IAAY;IACjC,OAAO,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AAC1B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,oBAAoB,CAAC,OAAkB,EAAE,IAAY;IAClE,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI;QAAE,OAAO;IAEjC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAC3C,+EAA+E;QAC7E,sDAAsD,EACxD,EAAE,OAAO,EAAE,GAAG,EAAE,CACjB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;QACnB,MAAM,IAAI,OAAO,CACf,6DAA6D;YAC3D,iFAAiF;YACjF,mCAAmC,CACtC,CAAC;IACJ,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,iBAAiB;IAC9B,IAAI,CAAC,MAAM,KAAK,CAAC,WAAW,CAAC,CAAC,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IACrD,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC,CAAC;QACpD,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QACnC,4EAA4E;QAC5E,kDAAkD;QAClD,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM;aACrB,KAAK,CAAC,IAAI,CAAC;aACX,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;aACpB,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC;QAC9B,OAAO,EAAE,IAAI,IAAI,CAAC;IACpB,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,4EAA4E;AAE5E,gFAAgF;AAChF,KAAK,UAAU,UAAU,CAAC,GAAuB;IAC/C,IAAI,GAAG,IAAI,GAAG,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,GAAG,CAAC,IAAI,EAAE,CAAC;IACpD,MAAM,MAAM,GAAG,MAAM,kBAAkB,EAAE,CAAC;IAC1C,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,OAAO,CACf,wDAAwD;YACtD,2DAA2D,CAC9D,CAAC;IACJ,CAAC;IACD,8EAA8E;IAC9E,OAAO,IAAI,MAAM,EAAE,CAAC;AACtB,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,gBAAgB,CAAC,GAAW,EAAE,GAAW;IACtD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC;QAChC,IAAI,MAAM,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;YAC1B,mEAAmE;YACnE,IAAI,CAAC,CAAC,MAAM,UAAU,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;gBAC7B,MAAM,IAAI,OAAO,CACf,cAAc,GAAG,kDAAkD;oBACjE,sDAAsD;oBACtD,uDAAuD,CAC1D,CAAC;YACJ,CAAC;QACH,CAAC;QACD,MAAM,GAAG,CAAC,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,CAAC,CAAC,CAAC;QACpC,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC5B,OAAO;IACT,CAAC;IAED,+DAA+D;IAC/D,MAAM,YAAY,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,CAAC,CAAC,CAAC;IAClF,MAAM,MAAM,GAAG,YAAY,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;IAC1C,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,EAAE,CAAC;QAChC,MAAM,IAAI,OAAO,CACf,cAAc,GAAG,2CAA2C,MAAM,IAAI,MAAM,KAAK;YAC/E,sFAAsF,CACzF,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,OAAO,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC;IACpD,MAAM,WAAW,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;AAC9B,CAAC;AAED,sFAAsF;AACtF,SAAS,QAAQ,CAAC,MAAc,EAAE,IAAY;IAC5C,MAAM,IAAI,GAAG,CAAC,CAAS,EAAU,EAAE,CACjC,CAAC;SACE,IAAI,EAAE;SACN,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC;SACrB,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC;SAClB,OAAO,CAAC,mBAAmB,EAAE,qBAAqB,CAAC;SACnD,WAAW,EAAE,CAAC;IACnB,OAAO,IAAI,CAAC,MAAM,CAAC,KAAK,IAAI,CAAC,IAAI,CAAC,CAAC;AACrC,CAAC;AAED,mFAAmF;AACnF,KAAK,UAAU,KAAK,CAAC,SAAiB,EAAE,GAAW;IACjD,MAAM,WAAW,CACf,CAAC,OAAO,EAAE,IAAI,EAAE,8BAA8B,EAAE,IAAI,EAAE,GAAG,cAAc,IAAI,GAAG,EAAE,EAAE,GAAG,CAAC,EACtF,SAAS,CACV,CAAC;AACJ,CAAC;AAED,sEAAsE;AACtE,KAAK,UAAU,SAAS,CAAC,IAAc,EAAE,SAAiB;IACxD,MAAM,WAAW,CAAC,IAAI,EAAE,SAAS,CAAC,CAAC;AACrC,CAAC;AAgBD;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAA0B;IAC7D,MAAM,QAAQ,GAAG,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC;IAC9C,MAAM,UAAU,GAAG,OAAO,CAAC,gBAAgB,IAAI,IAAI,CAAC;IACpD,MAAM,IAAI,GAAG,OAAO,CAAC,YAAY,IAAI,EAAE,CAAC;IAExC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC;QACrC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE;YACjC,SAAS;YACT,UAAU;YACV,0BAA0B;YAC1B,cAAc;SACf,CAAC,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACnC,IAAI,KAAK,KAAK,SAAS;YAAE,OAAO;QAChC,IAAI,KAAK,KAAK,WAAW;YAAE,MAAM,CAAC,iCAAiC;QACnE,IAAI,CAAC,GAAG,QAAQ,GAAG,CAAC;YAAE,MAAM,SAAS,CAAC,UAAU,CAAC,CAAC;IACpD,CAAC;IAED,iFAAiF;IACjF,8EAA8E;IAC9E,iFAAiF;IACjF,4EAA4E;IAC5E,+EAA+E;IAC/E,iCAAiC;IACjC,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,CAAC,EAAE,cAAc,CAAC,CAAC,CAAC;IACnF,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,cAAc,CAAC,CAAC,CAAC;IAElD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IACvE,MAAM,IAAI,OAAO,CACf,gEAAgE;QAC9D,mEAAmE;QACnE,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,0BAA0B,CAAC;QAC9C,+DAA+D,CAClE,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,KAAK,UAAU,YAAY,CACzB,KAAe,EACf,GAMC;IAED,MAAM,EAAE,IAAI,EAAE,UAAU,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IAC3D,MAAM,MAAM,GAAG,UAAU,IAAI,WAAW,CAAC;IACzC,MAAM,YAAY,GAAG,UAAU,IAAI,OAAO,CAAC;IAE3C,KAAK,CAAC,IAAI,CACR,yCAAyC,EACzC,EAAE,EACF,kBAAkB,MAAM,EAAE,EAC1B,kBAAkB,YAAY,EAAE,EAChC,kBAAkB,UAAU,EAAE,EAC9B,EAAE,CACH,CAAC;IAEF,8EAA8E;IAC9E,+EAA+E;IAC/E,IAAI,IAAI,KAAK,cAAc,EAAE,CAAC;QAC5B,4EAA4E;QAC5E,2EAA2E;QAC3E,oEAAoE;QACpE,IAAI,OAAO,CAAC,GAAG,KAAK,IAAI,EAAE,CAAC;YACzB,KAAK,CAAC,IAAI,CAAC,mEAAmE,EAAE,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,KAAK,CAAC,IAAI,CACR,yEAAyE;YACvE,+EAA+E,EACjF,EAAE,CACH,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,IAAI,CACR,2EAA2E,EAC3E,EAAE;IACF,wEAAwE;IACxE,sEAAsE;IACtE,eAAe,gBAAgB,IAAI,EACnC,KAAK,SAAS,EAAE,EAChB,EAAE,CACH,CAAC;IAEF,MAAM,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAC;AACpE,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,aAAa,CAC1B,KAAe,EACf,GAKC;IAED,MAAM,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,GAAG,CAAC;IAClD,MAAM,QAAQ,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,EAAE,MAAM,IAAI,QAAQ,EAAE,KAAK,CAAC,CAAC;IAC9D,IAAI,QAAQ,EAAE,CAAC;QACb,KAAK,CAAC,IAAI,CAAC,uEAAuE,CAAC,CAAC;QACpF,OAAO;IACT,CAAC;IAED,IAAI,QAAQ,GAAG,OAAO,CAAC,GAAG,KAAK,IAAI,CAAC;IACpC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,QAAQ,CAAC,UAAU,CAC3C,kFAAkF,EAClF,EAAE,OAAO,EAAE,GAAG,EAAE,CACjB,CAAC;QACF,QAAQ,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC;IAC3B,CAAC;IAED,IAAI,QAAQ,EAAE,CAAC;QACb,YAAY,CAAC,EAAE,MAAM,EAAE,KAAK,EAAE,UAAU,EAAE,EAAE,IAAI,CAAC,IAAI,CAAC,CAAC;QACvD,KAAK,CAAC,IAAI,CAAC,6EAA6E,CAAC,CAAC;IAC5F,CAAC;SAAM,CAAC;QACN,KAAK,CAAC,IAAI,CACR,iEAAiE,EACjE,gCAAgC,MAAM,kCAAkC,CACzE,CAAC;IACJ,CAAC;AACH,CAAC;AAED,SAAS,KAAK,CAAC,MAAc;IAC3B,MAAM,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACtC,OAAO,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,KAAK,CAAC;AAClC,CAAC;AAED,2EAA2E;AAE3E,gFAAgF;AAChF,KAAK,UAAU,GAAG,CAAC,IAAc;IAC/B,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,aAAa,CAAC,KAAK,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,GAAW,EAAE,GAAW;IACxD,MAAM,QAAQ,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE;QAChC,IAAI;QACJ,GAAG;QACH,WAAW;QACX,UAAU;QACV,kBAAkB;QAClB,GAAG,GAAG,WAAW;KAClB,CAAC,CAAC;IACH,aAAa,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,WAAW,EAAE,GAAG,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC9D,MAAM,GAAG,CAAC,CAAC,IAAI,EAAE,GAAG,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AAC7D,CAAC;AAED,oFAAoF;AACpF,KAAK,UAAU,WAAW,CAAC,IAAc,EAAE,GAAW;IACpD,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,CAAC,CAAC;IAClD,aAAa,CAAC,QAAQ,EAAE,IAAI,EAAE,MAAM,CAAC,CAAC;AACxC,CAAC;AAED,SAAS,aAAa,CAAC,GAAW,EAAE,IAAc,EAAE,MAAiB;IACnE,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO;IAC9B,6EAA6E;IAC7E,+EAA+E;IAC/E,0EAA0E;IAC1E,2EAA2E;IAC3E,gFAAgF;IAChF,MAAM,MAAM,GAAG,aAAa,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC;IAC3E,MAAM,IAAI,OAAO,CACf,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,mBAAmB,MAAM,CAAC,IAAI,IAAI,QAAQ,GAAG;QAC9D,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;QAC/B,iEAAiE,CACpE,CAAC;AACJ,CAAC;AAED,4EAA4E;AAE5E,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC;QACnB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,CAAS;IACjC,MAAM,EAAE,GAAG,MAAM,MAAM,CAAC,kBAAkB,CAAC,CAAC;IAC5C,IAAI,CAAC;QACH,MAAM,OAAO,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;QACpC,OAAO,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC;IAC9B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC"}