@the-librarian/cli 1.0.0-rc.21

package/dist/server/logs.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"logs.js","sourceRoot":"","sources":["../../src/server/logs.ts"],"names":[],"mappings":"AAAA,8DAA8D;AAC9D,EAAE;AACF,2EAA2E;AAC3E,oFAAoF;AACpF,iFAAiF;AACjF,0EAA0E;AAC1E,EAAE;AACF,0DAA0D;AAC1D,+EAA+E;AAC/E,qFAAqF;AACrF,sEAAsE;AACtE,+EAA+E;AAC/E,kFAAkF;AAClF,2EAA2E;AAC3E,gFAAgF;AAChF,yCAAyC;AACzC,EAAE;AACF,+EAA+E;AAC/E,oCAAoC;AACpC,+EAA+E;AAC/E,+EAA+E;AAC/E,kEAAkE;AAClE,6EAA6E;AAC7E,8EAA8E;AAC9E,iFAAiF;AACjF,gFAAgF;AAChF,gFAAgF;AAChF,2EAA2E;AAC3E,wEAAwE;AACxE,8BAA8B;AAE9B,OAAO,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAKzC,MAAM,QAAQ,GAA2B,CAAC,KAAK,EAAE,WAAW,EAAE,KAAK,CAAC,CAAC;AAkBrE,uFAAuF;AACvF,MAAM,OAAO,SAAU,SAAQ,KAAK;IAClC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,WAAW,CAAC;IAC1B,CAAC;CACF;AAgBD,2EAA2E;AAC3E,SAAS,cAAc,CAAC,GAAuB;IAC7C,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACpC,IAAK,QAA8B,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,GAAkB,CAAC;IAC7E,MAAM,IAAI,SAAS,CACjB,sBAAsB,GAAG,kDAAkD;QACzE,8EAA8E;QAC9E,gCAAgC,CACnC,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IAC3C,IAAI,CAAC;QACH,MAAM,MAAM,GAAY,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAC5C,OAAO,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,KAAK,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACjF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,SAAS,QAAQ,CAAC,IAAY,EAAE,OAAoB;IAClD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,SAAS,CAAC,IAAI,CAAC,CAAC;IAC9C,8EAA8E;IAC9E,uBAAuB;IACvB,OAAO,IAAI,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC;AACpD,CAAC;AAED,wFAAwF;AACxF,SAAS,eAAe,CAAC,IAAY,EAAE,OAAoB;IACzD,IAAI,OAAO,KAAK,KAAK;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;SACnC,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED;;;;;GAKG;AACH,SAAS,cAAc,CACrB,OAAoB,EACpB,KAA8B;IAE9B,IAAI,MAAM,GAAG,EAAE,CAAC;IAChB,MAAM,IAAI,GAAG,CAAC,IAAY,EAAQ,EAAE;QAClC,IAAI,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;YAAE,KAAK,CAAC,IAAI,GAAG,IAAI,CAAC,CAAC;IAClD,CAAC,CAAC;IACF,OAAO;QACL,IAAI,CAAC,KAAa;YAChB,MAAM,IAAI,KAAK,CAAC;YAChB,IAAI,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC9B,OAAO,EAAE,KAAK,CAAC,CAAC,EAAE,CAAC;gBACjB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;gBAC1B,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;gBAC9B,EAAE,GAAG,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC5B,CAAC;QACH,CAAC;QACD,KAAK;YACH,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBACtB,IAAI,CAAC,MAAM,CAAC,CAAC;gBACb,MAAM,GAAG,EAAE,CAAC;YACd,CAAC;QACH,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,UAAuB,EAAE;IACrD,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IAExE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,yDAAyD;QACzD,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,CAAC,CAAC,KAAa,EAAE,EAAE,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;QAChF,MAAM,MAAM,GAAG,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;QAC9C,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,cAAc,CAAC,EAAE;YACtE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;YACvC,uEAAuE;YACvE,iEAAiE;YACjE,QAAQ,EAAE,CAAC,KAAK,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;SACxC,CAAC,CAAC;QACH,MAAM,CAAC,KAAK,EAAE,CAAC;QACf,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,QAAQ,EAAE,CAAC;IAClC,CAAC;IAED,4EAA4E;IAC5E,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IAC7D,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACtB,MAAM,MAAM,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5D,MAAM,IAAI,SAAS,CACjB,iBAAiB,cAAc,mBAAmB,MAAM,CAAC,IAAI,IAAI,QAAQ,GAAG;YAC1E,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC;YAC/B,sDAAsD,CACzD,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;AACpF,CAAC"}

package/dist/server/preflight.d.ts

@@ -0,0 +1,24 @@
+/**
+ * A preflight failure carrying an actionable, teaching message. The CLI
+ * runtime renders `error.message` as one clean stderr line (no stack trace),
+ * so this message IS what the user reads.
+ */
+export declare class PreflightError extends Error {
+    constructor(message: string);
+}
+export interface PreflightOptions {
+    /**
+     * The host platform, defaulting to `process.platform`. Injectable so the
+     * macOS "Docker Desktop" daemon hint is testable from any host.
+     */
+    platform?: NodeJS.Platform;
+}
+/**
+ * Confirm `docker` (daemon reachable) and `git` are available, or throw a
+ * `PreflightError` with a teaching message. Resolves to nothing on success.
+ *
+ * Order matters: report a missing binary before probing the daemon, so a host
+ * without Docker is told to install it (not told the daemon is down).
+ */
+export declare function preflight(options?: PreflightOptions): Promise<void>;
+//# sourceMappingURL=preflight.d.ts.map

package/dist/server/preflight.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.d.ts","sourceRoot":"","sources":["../../src/server/preflight.ts"],"names":[],"mappings":"AAcA;;;;GAIG;AACH,qBAAa,cAAe,SAAQ,KAAK;gBAC3B,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,gBAAgB;IAC/B;;;OAGG;IACH,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC;CAC5B;AAoBD;;;;;;GAMG;AACH,wBAAsB,SAAS,CAAC,OAAO,GAAE,gBAAqB,GAAG,OAAO,CAAC,IAAI,CAAC,CAiB7E"}

package/dist/server/preflight.js

@@ -0,0 +1,58 @@
+// Preflight for the `server` command group.
+//
+// Every `server` subcommand that drives a container (up / update / down /
+// status / logs / boot / admin) first confirms the host actually has the tools
+// it needs: `docker` installed AND its daemon reachable, and `git` installed.
+// A missing or unreachable tool is a TEACHING error (what to install, or "is
+// the daemon running?") — never a stack trace, never a bare "error".
+//
+// The check goes through the `docker.ts` seam, so tests stub it and a real
+// daemon is never contacted. `platform` is injectable so the macOS-specific
+// "Docker Desktop" hint is testable on any host.
+import { run, which } from "./docker.js";
+/**
+ * A preflight failure carrying an actionable, teaching message. The CLI
+ * runtime renders `error.message` as one clean stderr line (no stack trace),
+ * so this message IS what the user reads.
+ */
+export class PreflightError extends Error {
+    constructor(message) {
+        super(message);
+        this.name = "PreflightError";
+    }
+}
+const DOCKER_INSTALL = "Docker is required but was not found on your PATH. " +
+    "Install Docker Engine (Linux) or Docker Desktop (macOS) — " +
+    "see https://docs.docker.com/get-docker/ — then re-run this command.";
+const GIT_INSTALL = "git is required but was not found on your PATH. " +
+    "Install git (e.g. `apt install git`, `brew install git`, or " +
+    "https://git-scm.com/downloads), then re-run this command.";
+function dockerDaemonHint(platform) {
+    const start = platform === "darwin"
+        ? "Is Docker Desktop running? Start Docker Desktop and wait for it to report ready, then re-run this command."
+        : "Is the Docker daemon running? Start it (e.g. `sudo systemctl start docker`) and confirm `docker info` succeeds, then re-run this command.";
+    return `Docker is installed but its daemon is unreachable. ${start}`;
+}
+/**
+ * Confirm `docker` (daemon reachable) and `git` are available, or throw a
+ * `PreflightError` with a teaching message. Resolves to nothing on success.
+ *
+ * Order matters: report a missing binary before probing the daemon, so a host
+ * without Docker is told to install it (not told the daemon is down).
+ */
+export async function preflight(options = {}) {
+    const platform = options.platform ?? process.platform;
+    if ((await which("docker")) === null) {
+        throw new PreflightError(DOCKER_INSTALL);
+    }
+    // Daemon probe: `docker info` exits non-zero (and prints to stderr) when the
+    // engine isn't reachable. We only care about the exit code here.
+    const info = await run("docker", ["info"]);
+    if (info.code !== 0) {
+        throw new PreflightError(dockerDaemonHint(platform));
+    }
+    if ((await which("git")) === null) {
+        throw new PreflightError(GIT_INSTALL);
+    }
+}
+//# sourceMappingURL=preflight.js.map

package/dist/server/preflight.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"preflight.js","sourceRoot":"","sources":["../../src/server/preflight.ts"],"names":[],"mappings":"AAAA,4CAA4C;AAC5C,EAAE;AACF,0EAA0E;AAC1E,+EAA+E;AAC/E,8EAA8E;AAC9E,6EAA6E;AAC7E,qEAAqE;AACrE,EAAE;AACF,2EAA2E;AAC3E,4EAA4E;AAC5E,iDAAiD;AAEjD,OAAO,EAAE,GAAG,EAAE,KAAK,EAAE,MAAM,aAAa,CAAC;AAEzC;;;;GAIG;AACH,MAAM,OAAO,cAAe,SAAQ,KAAK;IACvC,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,gBAAgB,CAAC;IAC/B,CAAC;CACF;AAUD,MAAM,cAAc,GAClB,qDAAqD;IACrD,4DAA4D;IAC5D,qEAAqE,CAAC;AAExE,MAAM,WAAW,GACf,kDAAkD;IAClD,8DAA8D;IAC9D,2DAA2D,CAAC;AAE9D,SAAS,gBAAgB,CAAC,QAAyB;IACjD,MAAM,KAAK,GACT,QAAQ,KAAK,QAAQ;QACnB,CAAC,CAAC,4GAA4G;QAC9G,CAAC,CAAC,2IAA2I,CAAC;IAClJ,OAAO,sDAAsD,KAAK,EAAE,CAAC;AACvE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,UAA4B,EAAE;IAC5D,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;IAEtD,IAAI,CAAC,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QACrC,MAAM,IAAI,cAAc,CAAC,cAAc,CAAC,CAAC;IAC3C,CAAC;IAED,6EAA6E;IAC7E,iEAAiE;IACjE,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC;IAC3C,IAAI,IAAI,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACpB,MAAM,IAAI,cAAc,CAAC,gBAAgB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACvD,CAAC;IAED,IAAI,CAAC,MAAM,KAAK,CAAC,KAAK,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAClC,MAAM,IAAI,cAAc,CAAC,WAAW,CAAC,CAAC;IACxC,CAAC;AACH,CAAC"}

package/dist/server/redact.d.ts

@@ -0,0 +1,2 @@
+export declare function redactSecrets(text: string): string;
+//# sourceMappingURL=redact.d.ts.map

package/dist/server/redact.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.d.ts","sourceRoot":"","sources":["../../src/server/redact.ts"],"names":[],"mappings":"AAiBA,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOlD"}

package/dist/server/redact.js

@@ -0,0 +1,26 @@
+// Secret redaction for captured docker/git output before it reaches a
+// user-facing error or log (C1 / I-3 / S-2).
+//
+// `up`, `update`, and `admin` all surface a failed step's stderr/stdout so the
+// operator can triage — but those streams can carry secrets: the server's
+// one-time admin-token generation notice emits the token BY VALUE
+// (`packages/mcp-server/src/bin/http.ts`), a `docker run -e
+// LIBRARIAN_AGENT_TOKEN=…`/`restore --secret-key …` failure can echo the argv,
+// and a master key is a raw 64-hex run. This single helper is the shared choke
+// point so every surface redacts identically (no surface forgets).
+//
+// We defend three ways:
+//   - drop any whole line carrying the admin-token generation notice;
+//   - redact any `libadmin_<base64url>` token substring (the bearer shape);
+//   - redact any standalone 64-hex run (a raw key/token shape: the master key
+//     and the CSPRNG agent token are both 64-hex).
+// The redacted remainder is still surfaced so debugging works — just no secrets.
+export function redactSecrets(text) {
+    return text
+        .split("\n")
+        .filter((line) => !/Generated a new admin token/i.test(line))
+        .join("\n")
+        .replace(/libadmin_[A-Za-z0-9_-]+/g, "[redacted-admin-token]")
+        .replace(/\b[0-9a-fA-F]{64}\b/g, "[redacted]");
+}
+//# sourceMappingURL=redact.js.map

package/dist/server/redact.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"redact.js","sourceRoot":"","sources":["../../src/server/redact.ts"],"names":[],"mappings":"AAAA,sEAAsE;AACtE,6CAA6C;AAC7C,EAAE;AACF,+EAA+E;AAC/E,0EAA0E;AAC1E,kEAAkE;AAClE,4DAA4D;AAC5D,+EAA+E;AAC/E,+EAA+E;AAC/E,mEAAmE;AACnE,EAAE;AACF,wBAAwB;AACxB,sEAAsE;AACtE,4EAA4E;AAC5E,8EAA8E;AAC9E,mDAAmD;AACnD,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,IAAY;IACxC,OAAO,IAAI;SACR,KAAK,CAAC,IAAI,CAAC;SACX,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,8BAA8B,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;SAC5D,IAAI,CAAC,IAAI,CAAC;SACV,OAAO,CAAC,0BAA0B,EAAE,wBAAwB,CAAC;SAC7D,OAAO,CAAC,sBAAsB,EAAE,YAAY,CAAC,CAAC;AACnD,CAAC"}

package/dist/server/status.d.ts

@@ -0,0 +1,20 @@
+export interface ServerStatusOptions {
+    /** Override home (tests). */
+    home?: string | undefined;
+    /** Deploy dir override. Default: `~/.librarian/server`. */
+    dir?: string | undefined;
+    /** Platform for preflight's daemon hint. Default `process.platform`. */
+    platform?: NodeJS.Platform | undefined;
+}
+export interface ServerStatusResult {
+    /** The rendered status report for stdout. */
+    output: string;
+}
+/**
+ * Run `server status`. Preflights docker, probes the container's running/health
+ * state, resolves the deployed + latest versions, and renders the report. Never
+ * throws on an offline latest-fetch or an absent deploy dir — those degrade to
+ * `unknown`/`?`.
+ */
+export declare function serverStatus(options?: ServerStatusOptions): Promise<ServerStatusResult>;
+//# sourceMappingURL=status.d.ts.map

package/dist/server/status.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.d.ts","sourceRoot":"","sources":["../../src/server/status.ts"],"names":[],"mappings":"AA2BA,MAAM,WAAW,mBAAmB;IAClC,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;CACxC;AAED,MAAM,WAAW,kBAAkB;IACjC,6CAA6C;IAC7C,MAAM,EAAE,MAAM,CAAC;CAChB;AAkCD;;;;;GAKG;AACH,wBAAsB,YAAY,CAAC,OAAO,GAAE,mBAAwB,GAAG,OAAO,CAAC,kBAAkB,CAAC,CAcjG"}

package/dist/server/status.js

@@ -0,0 +1,103 @@
+// `librarian server status` — running? healthy? deployed-vs-latest.
+//
+// Reports, all from the injectable `docker.ts` runner + the injectable
+// latest-release fetcher (so tests never touch a real daemon/network):
+//   - container running? (`docker inspect --format {{.State.Status}}`)
+//   - health (`docker inspect --format {{.State.Health.Status}}`)
+//   - the DEPLOYED version — the ref recorded in deploy-state.json, falling back
+//     to `git -C <dir> describe --tags` when no state file exists (e.g. a clone
+//     made before deploy-state existed)
+//   - the LATEST release (`fetchLatestVersion` — the same fetch `librarian
+//     status` uses for the harnesses)
+//   - an `up-to-date | update-available` badge via `isBehind(deployed, latest)`
+//
+// OFFLINE TOLERANCE (mirrors src/status.ts): an unreachable GitHub resolves
+// latest to `unknown` and the badge to `?`; an unknown deployed version does the
+// same. The command never crashes because the network was down or the deploy dir
+// wasn't a git repo — it renders `unknown`/`?` and exits 0.
+import path from "node:path";
+import { librarianDir } from "../paths.js";
+import { isBehind } from "../semver.js";
+import { fetchLatestVersion } from "../status.js";
+import { readDeployState } from "./deploy-state.js";
+import { run } from "./docker.js";
+import { preflight } from "./preflight.js";
+import { CONTAINER_NAME } from "./up.js";
+/** The deploy dir `status` reads its recorded ref / git-describe fallback from. */
+function resolveDeployDir(options) {
+    return options.dir ?? path.join(librarianDir(options.home), "server");
+}
+/**
+ * Read the container's `State.Status` (running / exited / …). Returns `null`
+ * when `docker inspect` fails — the container doesn't exist → "not running".
+ */
+async function inspectField(format) {
+    const result = await run("docker", ["inspect", "--format", format, CONTAINER_NAME]);
+    if (result.code !== 0)
+        return null;
+    return result.stdout.trim();
+}
+/**
+ * Resolve the deployed version: the deploy-state ref first (authoritative — it's
+ * exactly what `up` checked out + built), else `git -C <dir> describe --tags`.
+ * Returns `null` (→ "unknown") when neither is available.
+ */
+async function resolveDeployed(deployDir) {
+    const state = readDeployState(deployDir);
+    if (state?.ref)
+        return state.ref;
+    const described = await run("git", ["-C", deployDir, "describe", "--tags"]);
+    if (described.code === 0) {
+        const tag = described.stdout.trim();
+        if (tag)
+            return tag;
+    }
+    return null;
+}
+/**
+ * Run `server status`. Preflights docker, probes the container's running/health
+ * state, resolves the deployed + latest versions, and renders the report. Never
+ * throws on an offline latest-fetch or an absent deploy dir — those degrade to
+ * `unknown`/`?`.
+ */
+export async function serverStatus(options = {}) {
+    await preflight(options.platform ? { platform: options.platform } : {});
+    const deployDir = resolveDeployDir(options);
+    // Probe the container. A null status means `docker inspect` failed → absent.
+    const statusField = await inspectField("{{.State.Status}}");
+    const running = statusField === "running";
+    // Health is only meaningful when the container exists; an empty health string
+    // (no healthcheck, or container absent) renders "unknown".
+    const health = statusField === null ? null : await inspectField("{{.State.Health.Status}}");
+    const [deployed, latest] = await Promise.all([resolveDeployed(deployDir), fetchLatestVersion()]);
+    return { output: render({ statusField, running, health, deployed, latest }) };
+}
+/**
+ * The `up-to-date | update-available | ?` badge. `?` whenever either version is
+ * unknown — an offline run never lies about an available update (mirrors the
+ * harness `status` table's `update?` column).
+ */
+function badge(deployed, latest) {
+    if (!deployed || !latest)
+        return "?";
+    return isBehind(deployed, latest) ? "update-available" : "up-to-date";
+}
+function render(input) {
+    const { statusField, running, health, deployed, latest } = input;
+    const runningLabel = statusField === null ? "not running" : running ? "running" : statusField;
+    const healthLabel = health && health.length > 0 ? health : "unknown";
+    const lines = [
+        `The Librarian server (${CONTAINER_NAME}):`,
+        "",
+        `  Running:    ${runningLabel}`,
+        `  Health:     ${runningLabel === "not running" ? "—" : healthLabel}`,
+        `  Deployed:   ${deployed ?? "unknown"}`,
+        `  Latest:     ${latest ?? "unknown"}`,
+        `  Update:     ${badge(deployed, latest)}`,
+    ];
+    if (latest === null) {
+        lines.push("", "latest release unknown (could not reach GitHub) — Update shows ?");
+    }
+    return lines.join("\n");
+}
+//# sourceMappingURL=status.js.map

package/dist/server/status.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"status.js","sourceRoot":"","sources":["../../src/server/status.ts"],"names":[],"mappings":"AAAA,oEAAoE;AACpE,EAAE;AACF,uEAAuE;AACvE,uEAAuE;AACvE,uEAAuE;AACvE,kEAAkE;AAClE,iFAAiF;AACjF,gFAAgF;AAChF,wCAAwC;AACxC,2EAA2E;AAC3E,sCAAsC;AACtC,gFAAgF;AAChF,EAAE;AACF,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,4DAA4D;AAE5D,OAAO,IAAI,MAAM,WAAW,CAAC;AAC7B,OAAO,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAC3C,OAAO,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AACxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,cAAc,CAAC;AAClD,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,GAAG,EAAE,MAAM,aAAa,CAAC;AAClC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC;AAC3C,OAAO,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAgBzC,mFAAmF;AACnF,SAAS,gBAAgB,CAAC,OAA4B;IACpD,OAAO,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,QAAQ,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,KAAK,UAAU,YAAY,CAAC,MAAc;IACxC,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,QAAQ,EAAE,CAAC,SAAS,EAAE,UAAU,EAAE,MAAM,EAAE,cAAc,CAAC,CAAC,CAAC;IACpF,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,OAAO,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;AAC9B,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,MAAM,KAAK,GAAG,eAAe,CAAC,SAAS,CAAC,CAAC;IACzC,IAAI,KAAK,EAAE,GAAG;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC;IAEjC,MAAM,SAAS,GAAG,MAAM,GAAG,CAAC,KAAK,EAAE,CAAC,IAAI,EAAE,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,IAAI,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,GAAG;YAAE,OAAO,GAAG,CAAC;IACtB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAAC,UAA+B,EAAE;IAClE,MAAM,SAAS,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACxE,MAAM,SAAS,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;IAE5C,6EAA6E;IAC7E,MAAM,WAAW,GAAG,MAAM,YAAY,CAAC,mBAAmB,CAAC,CAAC;IAC5D,MAAM,OAAO,GAAG,WAAW,KAAK,SAAS,CAAC;IAC1C,8EAA8E;IAC9E,2DAA2D;IAC3D,MAAM,MAAM,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,YAAY,CAAC,0BAA0B,CAAC,CAAC;IAE5F,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,GAAG,MAAM,OAAO,CAAC,GAAG,CAAC,CAAC,eAAe,CAAC,SAAS,CAAC,EAAE,kBAAkB,EAAE,CAAC,CAAC,CAAC;IAEjG,OAAO,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,EAAE,CAAC;AAChF,CAAC;AAUD;;;;GAIG;AACH,SAAS,KAAK,CAAC,QAAuB,EAAE,MAAqB;IAC3D,IAAI,CAAC,QAAQ,IAAI,CAAC,MAAM;QAAE,OAAO,GAAG,CAAC;IACrC,OAAO,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,YAAY,CAAC;AACxE,CAAC;AAED,SAAS,MAAM,CAAC,KAAkB;IAChC,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACjE,MAAM,YAAY,GAAG,WAAW,KAAK,IAAI,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9F,MAAM,WAAW,GAAG,MAAM,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC;IAErE,MAAM,KAAK,GAAG;QACZ,yBAAyB,cAAc,IAAI;QAC3C,EAAE;QACF,iBAAiB,YAAY,EAAE;QAC/B,iBAAiB,YAAY,KAAK,aAAa,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE;QACrE,iBAAiB,QAAQ,IAAI,SAAS,EAAE;QACxC,iBAAiB,MAAM,IAAI,SAAS,EAAE;QACtC,iBAAiB,KAAK,CAAC,QAAQ,EAAE,MAAM,CAAC,EAAE;KAC3C,CAAC;IAEF,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;QACpB,KAAK,CAAC,IAAI,CAAC,EAAE,EAAE,kEAAkE,CAAC,CAAC;IACrF,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC"}

package/dist/server/up.d.ts

@@ -0,0 +1,211 @@
+import type { Prompter } from "../prompt.js";
+export { redactSecrets } from "./redact.js";
+/** The repository the deploy dir clones (same repo the latest-tag fetch targets). */
+export declare const REPO_URL = "https://github.com/JimJafar/the-librarian";
+/** The container name every `server` command operates on (single instance per host). */
+export declare const CONTAINER_NAME = "the-librarian";
+/** The named data volume default (`--data-volume` overrides). The volume is sacred. */
+export declare const DEFAULT_DATA_VOLUME = "librarian_data";
+/** Host loopback — the default, only-reachable-locally bind (spec §5/§6). */
+export declare const LOCALHOST = "127.0.0.1";
+/** Bind-all-interfaces — never the default; ask-first (spec §5.3, §11). */
+export declare const ALL_INTERFACES = "0.0.0.0";
+/** The warning printed beside the one-time master-key surfacing (spec §5.4). */
+export declare const SAVE_KEY_WARNING = "SAVE THIS KEY \u2014 excluded from backups";
+/**
+ * The 0600 deploy env-file fed to `docker run --env-file` (ADR 0008 P4). It
+ * lives in the deploy dir (alongside `deploy-state.json`) and carries the agent
+ * token + master key + (loopback) `LIBRARIAN_ALLOW_NO_AUTH`. It is DISTINCT from
+ * the client `~/.librarian/env` (env.ts). 0600, by construction.
+ */
+export declare const DEPLOY_ENV_FILE = "deploy.env";
+/** `<deployDir>/deploy.env` — the 0600 deploy env-file path within a deploy dir. */
+export declare function deployEnvFilePath(deployDir: string): string;
+/** A sleep used between health polls. Injectable so tests don't actually wait. */
+export type Sleep = (ms: number) => Promise<void>;
+/** Override the health-poll sleep (tests inject a no-op so polling is instant). */
+export declare function setSleep(next: Sleep): void;
+/** Restore the real sleep (tests). */
+export declare function resetSleep(): void;
+/** Mint one CSPRNG agent token. Injectable so tests assert a deterministic value. */
+export type TokenMinter = () => string;
+/** Override the agent-token minter (tests). */
+export declare function setTokenMinter(next: TokenMinter): void;
+/** Restore the real CSPRNG minter (tests). */
+export declare function resetTokenMinter(): void;
+/**
+ * Mint one agent token through the CURRENT minter. Exported so `update` mints a
+ * fresh token (when the old container's token can't be read back) via the same
+ * injectable seam `up` uses — a single deterministic value in tests.
+ */
+export declare function mintAgentToken(): string;
+/**
+ * Mint one CSPRNG master key (`LIBRARIAN_SECRET_KEY`). The format MUST be one
+ * `resolveSecretKey` (core) accepts — a 64-char hex string — so the server boots
+ * with the CLI-supplied key (env wins) and never writes `/data/secret.key`.
+ * Injectable so tests assert a deterministic value (mirrors {@link TokenMinter}).
+ */
+export type SecretKeyMinter = () => string;
+/** Override the master-key minter (tests). */
+export declare function setSecretKeyMinter(next: SecretKeyMinter): void;
+/** Restore the real CSPRNG master-key minter (tests). */
+export declare function resetSecretKeyMinter(): void;
+/**
+ * Mint one master key through the CURRENT minter. Exported so `update` can mint a
+ * fresh key (only when the old container's key can't be read back) via the same
+ * injectable seam `up` uses — a single deterministic value in tests.
+ */
+export declare function mintSecretKey(): string;
+export interface UpOptions {
+    /** Pinned ref (`vX.Y.Z` tag or `main`). Default: the latest release tag. */
+    ref?: string | undefined;
+    /** Deploy dir override. Default: `~/.librarian/server`. */
+    dir?: string | undefined;
+    /**
+     * Bind host. Default `127.0.0.1` (loopback only). `--host <addr>` sets it
+     * explicitly; `0.0.0.0` (all interfaces) is ask-first. An interactive run
+     * with no `--host` may be offered a detected Tailscale IP instead (§5.3).
+     */
+    host?: string | undefined;
+    /** Named data volume. Default: `librarian_data`. */
+    dataVolume?: string | undefined;
+    /**
+     * Enable boot persistence after a successful `up` (S6). On Linux, installs +
+     * enables the systemd unit; on macOS, prints the deferred notice and the `up`
+     * still succeeds. Opt-in: a plain `up` never enables boot silently.
+     */
+    enableBoot?: boolean | undefined;
+    /** Auto-accept prompts (loop-closer `~/.librarian/env` offer). */
+    yes?: boolean | undefined;
+    /** Health-wait bound: how many polls before declaring failure (small in tests). */
+    healthAttempts?: number | undefined;
+    /** Milliseconds between health polls (0 in tests). */
+    healthIntervalMs?: number | undefined;
+    /** Lines of `docker logs` to surface on a failed health-wait. */
+    logTailLines?: number | undefined;
+}
+export interface UpDeps {
+    /** Override home (tests). */
+    home?: string | undefined;
+    /** Prompter for the loop-closer env offer and the bind-host offers. */
+    prompter: Prompter;
+    /** Platform for preflight's daemon hint. Default `process.platform`. */
+    platform?: NodeJS.Platform | undefined;
+    /**
+     * Whether the run is interactive (a TTY is attached). Gates the best-effort
+     * Tailscale offer and the `0.0.0.0` confirm — a non-interactive run never
+     * silently exposes the server beyond localhost. Default `true`.
+     */
+    interactive?: boolean | undefined;
+}
+/** A teaching error from `up`; the runtime renders `.message` as one stderr line. */
+export declare class UpError extends Error {
+    constructor(message: string);
+}
+export interface RunArgsInput {
+    host: string;
+    dataVolume: string;
+    tag: string;
+    /**
+     * Absolute path to the 0600 deploy env-file ({@link writeDeployEnvFile}). The
+     * secrets (`LIBRARIAN_AGENT_TOKEN`, `LIBRARIAN_SECRET_KEY`) and the loopback
+     * `LIBRARIAN_ALLOW_NO_AUTH` are delivered via `--env-file <path>`, never inline
+     * on argv (ADR 0008 P4).
+     */
+    envFile: string;
+}
+/**
+ * Construct the `docker run` argv (everything after `docker`). The SINGLE place
+ * the run vector is assembled.
+ *
+ * Secrets are delivered via `--env-file <path>` — NOT inline `-e` — so the agent
+ * token, the master key, and (loopback only) `LIBRARIAN_ALLOW_NO_AUTH` never
+ * appear on argv (ADR 0008 P4). `--env-file` keeps them off argv (and out of any
+ * argv-echoing error); it does NOT hide them from `docker inspect .Config.Env`
+ * (docker expands the file client-side into the same env list) — an accepted
+ * trade-off (the wins are off-argv + the master key off `/data`).
+ *
+ * The image runs `tini` as PID 1, so `--init` is deliberately omitted. The
+ * publish address is derived from `host`; the loopback no-auth bypass
+ * (`LIBRARIAN_ALLOW_NO_AUTH`) lives INSIDE the env-file (loopback-only — see
+ * {@link writeDeployEnvFile}), not on this argv.
+ */
+export declare function buildRunArgs(input: RunArgsInput): string[];
+/** The secrets the deploy env-file carries (off argv, into `--env-file`). */
+export interface DeployEnvInput {
+    /** The agent token (`LIBRARIAN_AGENT_TOKEN`) — minted by `up`, reused by `update`. */
+    agentToken: string;
+    /**
+     * The master key (`LIBRARIAN_SECRET_KEY`). `up` always supplies the CLI-minted
+     * key. `update` supplies the PRESERVED key read back from the old container, or
+     * OMITS it (undefined/empty) when the old env is unreadable — then the server
+     * resolves the key from `/data/secret.key` (env → file → generate), never a
+     * destructive fresh mint that would orphan already-encrypted secrets.
+     */
+    secretKey?: string | undefined;
+    /**
+     * The resolved bind host — drives the loopback-only `LIBRARIAN_ALLOW_NO_AUTH`.
+     * `127.0.0.1` → write `LIBRARIAN_ALLOW_NO_AUTH=true` (loopback no-auth bypass);
+     * beyond localhost → omit it so /mcp requires the agent token (spec §6).
+     */
+    host: string;
+}
+/**
+ * Write the 0600 deploy env-file `docker run --env-file` reads, returning its
+ * path. It carries `LIBRARIAN_AGENT_TOKEN`, `LIBRARIAN_SECRET_KEY` (when
+ * supplied), and (loopback only) `LIBRARIAN_ALLOW_NO_AUTH=true`. Mode 0600 on
+ * create AND an unconditional `chmodSync(0o600)` so a pre-existing looser file is
+ * tightened (same discipline as env.ts `writeEnvFile`). The directory is created
+ * if missing.
+ *
+ * Format is `KEY=VALUE` lines (docker's `--env-file` syntax — NOT shell, so no
+ * quoting/`export`). The minted secrets are 64-hex with no special chars, so a
+ * raw value is safe; we reject a value with a newline (it would corrupt the file
+ * / smuggle a second var) rather than emit a malformed file.
+ */
+export declare function writeDeployEnvFile(deployDir: string, input: DeployEnvInput): string;
+export interface UpResult {
+    /** Human-readable report for stdout (carries the master key ONCE). */
+    output: string;
+}
+/**
+ * Run `server up`. Throws `UpError` (teaching message) on any failure; on a
+ * failed health-wait it rolls the container back first so no half-up state is
+ * left behind. Works for any resolved bind host (loopback / tailnet / all
+ * interfaces); the bind choice drives the auth model (§6).
+ */
+export declare function runUp(options: UpOptions, deps: UpDeps): Promise<UpResult>;
+/**
+ * Health-wait tuning shared by `up` and `update` (the bounded poll + log-tail).
+ * A subset of `UpOptions` so `update` can reuse {@link waitForHealthy} without
+ * importing the whole `UpOptions` shape.
+ */
+export interface HealthWaitOptions {
+    /** Health-wait bound: how many polls before declaring failure (small in tests). */
+    healthAttempts?: number | undefined;
+    /** Milliseconds between health polls (0 in tests). */
+    healthIntervalMs?: number | undefined;
+    /** Lines of `docker logs` to surface on a failed health-wait. */
+    logTailLines?: number | undefined;
+}
+/**
+ * Poll `docker inspect … Health.Status` until `healthy`, bounded. On timeout or
+ * an unhealthy report: surface `docker logs --tail` (REDACTED), roll the
+ * container back (`docker rm -f`), and throw — leaving NO half-up container.
+ *
+ * Exported so `update` recreates with the IDENTICAL health-wait + rollback
+ * pattern (a failed recreate force-removes the new container and never advances
+ * deploy-state). The thrown `UpError`'s message is already secret-redacted.
+ */
+export declare function waitForHealthy(options: HealthWaitOptions): Promise<void>;
+/**
+ * Check out `ref` in `dir` without letting a `--…`-shaped ref inject a git
+ * option (S-1). `git checkout` does NOT honor `--end-of-options` — it reads the
+ * marker itself as a pathspec (`pathspec '--end-of-options' did not match`,
+ * verified on git 2.43), so guarding the ref on the checkout fails outright.
+ * `git rev-parse` DOES honor `--end-of-options`, so we resolve the ref to a
+ * commit SHA there (the injection guard that actually works), then check out
+ * that SHA — a hex object id can never be parsed as an option.
+ */
+export declare function checkoutRef(dir: string, ref: string): Promise<void>;
+//# sourceMappingURL=up.d.ts.map

package/dist/server/up.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"up.d.ts","sourceRoot":"","sources":["../../src/server/up.ts"],"names":[],"mappings":"AAmDA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,cAAc,CAAC;AAU7C,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAE5C,qFAAqF;AACrF,eAAO,MAAM,QAAQ,8CAA8C,CAAC;AAEpE,wFAAwF;AACxF,eAAO,MAAM,cAAc,kBAAkB,CAAC;AAE9C,uFAAuF;AACvF,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,6EAA6E;AAC7E,eAAO,MAAM,SAAS,cAAc,CAAC;AAErC,2EAA2E;AAC3E,eAAO,MAAM,cAAc,YAAY,CAAC;AAExC,gFAAgF;AAChF,eAAO,MAAM,gBAAgB,+CAA0C,CAAC;AAExE;;;;;GAKG;AACH,eAAO,MAAM,eAAe,eAAe,CAAC;AAE5C,oFAAoF;AACpF,wBAAgB,iBAAiB,CAAC,SAAS,EAAE,MAAM,GAAG,MAAM,CAE3D;AAID,kFAAkF;AAClF,MAAM,MAAM,KAAK,GAAG,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;AAMlD,mFAAmF;AACnF,wBAAgB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,IAAI,CAE1C;AAED,sCAAsC;AACtC,wBAAgB,UAAU,IAAI,IAAI,CAEjC;AAID,qFAAqF;AACrF,MAAM,MAAM,WAAW,GAAG,MAAM,MAAM,CAAC;AAMvC,+CAA+C;AAC/C,wBAAgB,cAAc,CAAC,IAAI,EAAE,WAAW,GAAG,IAAI,CAEtD;AAED,8CAA8C;AAC9C,wBAAgB,gBAAgB,IAAI,IAAI,CAEvC;AAED;;;;GAIG;AACH,wBAAgB,cAAc,IAAI,MAAM,CAEvC;AAID;;;;;GAKG;AACH,MAAM,MAAM,eAAe,GAAG,MAAM,MAAM,CAAC;AAM3C,8CAA8C;AAC9C,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,eAAe,GAAG,IAAI,CAE9D;AAED,yDAAyD;AACzD,wBAAgB,oBAAoB,IAAI,IAAI,CAE3C;AAED;;;;GAIG;AACH,wBAAgB,aAAa,IAAI,MAAM,CAEtC;AAID,MAAM,WAAW,SAAS;IACxB,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,2DAA2D;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;;;;OAIG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oDAAoD;IACpD,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC;;;;OAIG;IACH,UAAU,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACjC,kEAAkE;IAClE,GAAG,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC1B,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED,MAAM,WAAW,MAAM;IACrB,6BAA6B;IAC7B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,uEAAuE;IACvE,QAAQ,EAAE,QAAQ,CAAC;IACnB,wEAAwE;IACxE,QAAQ,CAAC,EAAE,MAAM,CAAC,QAAQ,GAAG,SAAS,CAAC;IACvC;;;;OAIG;IACH,WAAW,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;CACnC;AAED,qFAAqF;AACrF,qBAAa,OAAQ,SAAQ,KAAK;gBACpB,OAAO,EAAE,MAAM;CAI5B;AAID,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE,MAAM,CAAC;IACZ;;;;;OAKG;IACH,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,YAAY,CAAC,KAAK,EAAE,YAAY,GAAG,MAAM,EAAE,CAmB1D;AAED,6EAA6E;AAC7E,MAAM,WAAW,cAAc;IAC7B,sFAAsF;IACtF,UAAU,EAAE,MAAM,CAAC;IACnB;;;;;;OAMG;IACH,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B;;;;OAIG;IACH,IAAI,EAAE,MAAM,CAAC;CACd;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,cAAc,GAAG,MAAM,CA0BnF;AAID,MAAM,WAAW,QAAQ;IACvB,sEAAsE;IACtE,MAAM,EAAE,MAAM,CAAC;CAChB;AAED;;;;;GAKG;AACH,wBAAsB,KAAK,CAAC,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,QAAQ,CAAC,CA4E/E;AAkMD;;;;GAIG;AACH,MAAM,WAAW,iBAAiB;IAChC,mFAAmF;IACnF,cAAc,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,sDAAsD;IACtD,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,iEAAiE;IACjE,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACnC;AAED;;;;;;;;GAQG;AACH,wBAAsB,cAAc,CAAC,OAAO,EAAE,iBAAiB,GAAG,OAAO,CAAC,IAAI,CAAC,CAkC9E;AA2HD;;;;;;;;GAQG;AACH,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAWzE"}