@untangle-code/cli 0.0.0-stage → 0.1.1

package/dist/commands/extensions/configure.js

@@ -0,0 +1,58 @@
+/** User-private credential configuration; values never appear in output or argv. */
+import { readFile } from "node:fs/promises";
+import { stringFlag } from "../../cli/args.js";
+import { EXIT, OperationalError, UsageError } from "../../cli/exit.js";
+import { line } from "../../cli/io.js";
+import { explainMissing, findExtension, loadExtensionContext } from "./context.js";
+import { resolveUserPath } from "./environment.js";
+import { emitJson } from "./render.js";
+import { parseSecretValues, readStoredSecrets, secretStorePath, withSecretLock, writeStoredSecrets, } from "./secret-store.js";
+export async function runConfigure(environment, args, io, format) {
+    const id = args.positionals[1];
+    if (!id || args.positionals.length !== 2)
+        throw new UsageError("configure needs exactly one extension id.", "untangle extensions configure <id> [--from=<private-json-file>]");
+    const context = await loadExtensionContext(environment);
+    const extension = findExtension(context, id);
+    if (!extension)
+        throw new OperationalError(explainMissing(context, id), "Install the extension first.");
+    const manifest = extension.manifest;
+    const source = stringFlag(args, "from");
+    let imported = {};
+    if (source !== undefined) {
+        let content;
+        try {
+            content = JSON.parse(await readFile(resolveUserPath(environment.cwd, source), "utf8"));
+        }
+        catch {
+            throw new UsageError("Cannot read credential JSON; its contents were withheld.", "Use a JSON object keyed by the secret names declared in the manifest.");
+        }
+        imported = parseSecretValues(content, manifest);
+    }
+    const values = await withSecretLock(environment, id, async () => {
+        const stored = await readStoredSecrets(environment, manifest);
+        const values = {
+            ...Object.fromEntries(manifest.secrets.map((secret) => [secret.name, ""])),
+            ...stored,
+            ...imported,
+        };
+        await writeStoredSecrets(environment, manifest, values);
+        return values;
+    });
+    const path = secretStorePath(environment, id);
+    const secrets = manifest.secrets.map((secret) => ({
+        name: secret.name,
+        envVar: secret.envVar,
+        configured: Boolean(values[secret.name]),
+        setupOnly: secret.setupOnly ?? false,
+    }));
+    if (format === "json")
+        emitJson(io, { command: "extensions configure", extensionId: id, path, secrets });
+    else {
+        line(io, `Private credential configuration (0600): ${path}`);
+        for (const secret of secrets)
+            line(io, `  ${secret.name}: ${secret.configured ? "configured" : "not set"}; environment override: ${secret.envVar}${secret.setupOnly ? " (setup only)" : ""}`);
+        line(io, `Edit the secrets object in that file, then run: untangle extensions setup ${id} --yes`);
+    }
+    return EXIT.ok;
+}
+//# sourceMappingURL=configure.js.map

package/dist/commands/extensions/configure.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"configure.js","sourceRoot":"","sources":["../../../src/commands/extensions/configure.ts"],"names":[],"mappings":"AAAA,oFAAoF;AACpF,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,OAAO,EAAE,UAAU,EAAmB,MAAM,mBAAmB,CAAC;AAChE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAW,MAAM,iBAAiB,CAAC;AAEhD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AACnF,OAAO,EAAE,eAAe,EAA+B,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,eAAe,EACf,cAAc,EACd,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAE3B,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,WAAmC,EACnC,IAAgB,EAChB,EAAM,EACN,MAAuB;IAEvB,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IAC/B,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,WAAW,CAAC,MAAM,KAAK,CAAC;QACtC,MAAM,IAAI,UAAU,CAClB,2CAA2C,EAC3C,iEAAiE,CAClE,CAAC;IACJ,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAC7C,IAAI,CAAC,SAAS;QACZ,MAAM,IAAI,gBAAgB,CAAC,cAAc,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,8BAA8B,CAAC,CAAC;IAC1F,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAC;IACpC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;IACxC,IAAI,QAAQ,GAA2B,EAAE,CAAC;IAC1C,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,IAAI,OAAgB,CAAC;QACrB,IAAI,CAAC;YACH,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,QAAQ,CAAC,eAAe,CAAC,WAAW,CAAC,GAAG,EAAE,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;QACzF,CAAC;QAAC,MAAM,CAAC;YACP,MAAM,IAAI,UAAU,CAClB,0DAA0D,EAC1D,uEAAuE,CACxE,CAAC;QACJ,CAAC;QACD,QAAQ,GAAG,iBAAiB,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IAClD,CAAC;IACD,MAAM,MAAM,GAAG,MAAM,cAAc,CAAC,WAAW,EAAE,EAAE,EAAE,KAAK,IAAI,EAAE;QAC9D,MAAM,MAAM,GAAG,MAAM,iBAAiB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAC;QAC9D,MAAM,MAAM,GAAG;YACb,GAAG,MAAM,CAAC,WAAW,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC;YAC1E,GAAG,MAAM;YACT,GAAG,QAAQ;SACZ,CAAC;QACF,MAAM,kBAAkB,CAAC,WAAW,EAAE,QAAQ,EAAE,MAAM,CAAC,CAAC;QACxD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,eAAe,CAAC,WAAW,EAAE,EAAE,CAAC,CAAC;IAC9C,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QAChD,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,MAAM,EAAE,MAAM,CAAC,MAAM;QACrB,UAAU,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;QACxC,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;KACrC,CAAC,CAAC,CAAC;IACJ,IAAI,MAAM,KAAK,MAAM;QACnB,QAAQ,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,sBAAsB,EAAE,WAAW,EAAE,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC,CAAC;SAC/E,CAAC;QACJ,IAAI,CAAC,EAAE,EAAE,4CAA4C,IAAI,EAAE,CAAC,CAAC;QAC7D,KAAK,MAAM,MAAM,IAAI,OAAO;YAC1B,IAAI,CACF,EAAE,EACF,KAAK,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,2BAA2B,MAAM,CAAC,MAAM,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,EAAE,EAAE,CACtJ,CAAC;QACJ,IAAI,CACF,EAAE,EACF,6EAA6E,EAAE,QAAQ,CACxF,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC"}

package/dist/commands/extensions/container.d.ts

@@ -0,0 +1,15 @@
+import { type ContainerRuntimePort } from "@untangle-code/extension-runtime";
+import type { ProcessLimitsV1, ProcessRunnerPort } from "@untangle-code/extension-runtime";
+/** Vorgabe des Kommandos; ueberschreibbar mit `UNTANGLE_CONTAINER_CLI`. */
+export declare const DEFAULT_CONTAINER_CLI = "docker";
+/** Name des Containers einer Extension — bewusst vorhersagbar, nie geraten. */
+export declare function containerNameFor(extensionId: string): string;
+export interface ContainerCliOptions {
+    processRunner: ProcessRunnerPort;
+    limits: ProcessLimitsV1;
+    /** Kommando der Container-Runtime; kommt aus der Umgebung, nicht aus dem Quelltext. */
+    command?: string;
+    env?: Readonly<Record<string, string>>;
+}
+export declare function createContainerCli(options: ContainerCliOptions): ContainerRuntimePort;
+//# sourceMappingURL=container.d.ts.map

package/dist/commands/extensions/container.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.d.ts","sourceRoot":"","sources":["../../../src/commands/extensions/container.ts"],"names":[],"mappings":"AAuBA,OAAO,EAQL,KAAK,oBAAoB,EAG1B,MAAM,kCAAkC,CAAC;AAC1C,OAAO,KAAK,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,kCAAkC,CAAC;AAE3F,2EAA2E;AAC3E,eAAO,MAAM,qBAAqB,WAAW,CAAC;AAE9C,+EAA+E;AAC/E,wBAAgB,gBAAgB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAE5D;AAOD,MAAM,WAAW,mBAAmB;IAClC,aAAa,EAAE,iBAAiB,CAAC;IACjC,MAAM,EAAE,eAAe,CAAC;IACxB,uFAAuF;IACvF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,GAAG,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;CACxC;AAED,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,mBAAmB,GAAG,oBAAoB,CAsJrF"}

package/dist/commands/extensions/container.js

@@ -0,0 +1,135 @@
+import { composeProjectName, EXTENSION_LABEL, MANAGED_LABEL, } from "@untangle-code/extension-runtime";
+/** Vorgabe des Kommandos; ueberschreibbar mit `UNTANGLE_CONTAINER_CLI`. */
+export const DEFAULT_CONTAINER_CLI = "docker";
+/** Name des Containers einer Extension — bewusst vorhersagbar, nie geraten. */
+export function containerNameFor(extensionId) {
+    return `untangle-ext-${extensionId}`;
+}
+const INSPECT_FORMAT = `{{index .Config.Labels "${MANAGED_LABEL}"}}\t` +
+    `{{index .Config.Labels "${EXTENSION_LABEL}"}}\t` +
+    `{{.State.Running}}\t{{.Config.Image}}`;
+export function createContainerCli(options) {
+    const command = options.command ?? DEFAULT_CONTAINER_CLI;
+    const run = async (args, signal) => {
+        const result = await options.processRunner.run({
+            command,
+            args: [...args],
+            ...(options.env === undefined ? {} : { env: options.env }),
+        }, options.limits, signal === undefined ? {} : { signal });
+        const ok = result.outcome === "completed" && (result.exitCode ?? 1) === 0;
+        return {
+            ok,
+            stdout: result.stdout,
+            stderr: result.stderr,
+            detail: ok
+                ? `${command} ${args[0] ?? ""} succeeded`
+                : `${command} ${args.join(" ")} failed (${result.outcome}, exit ${String(result.exitCode)})` +
+                    `${result.stderr.trim() === "" ? "" : `: ${result.stderr.trim().slice(0, 300)}`}`,
+        };
+    };
+    return {
+        async available(opts = {}) {
+            const result = await run(["version", "--format", "{{.Server.Version}}"], opts.signal);
+            if (!result.ok) {
+                return {
+                    available: false,
+                    detail: `no container runtime answered: ${result.detail}. Untangle neither ships nor starts ` +
+                        `one; set UNTANGLE_CONTAINER_CLI if the command is named differently.`,
+                };
+            }
+            const version = result.stdout.trim();
+            return {
+                available: true,
+                detail: `container runtime ${version} answered on "${command}"`,
+                ...(version === "" ? {} : { version }),
+            };
+        },
+        async inspect(manifest, opts = {}) {
+            const name = containerNameFor(manifest.id);
+            const result = await run(["inspect", name, "--format", INSPECT_FORMAT], opts.signal);
+            if (!result.ok) {
+                return {
+                    exists: false,
+                    running: false,
+                    ownedByUntangle: false,
+                    detail: `no container named "${name}" exists`,
+                };
+            }
+            const [managed, extensionId, running, image] = result.stdout.trim().split("\t");
+            const owned = managed === "true" && extensionId === manifest.id;
+            if (!owned) {
+                // Der Name allein beweist nichts. Ohne beide Labels ist der Container
+                // fremd, und fremde Container fasst Untangle nicht an (spec.md §3.2).
+                return {
+                    exists: true,
+                    running: running === "true",
+                    ownedByUntangle: false,
+                    detail: `a container named "${name}" exists but does not carry ${MANAGED_LABEL}=true and ` +
+                        `${EXTENSION_LABEL}=${manifest.id}; Untangle does not touch containers it did not create`,
+                };
+            }
+            const digest = /@(sha256:[0-9a-f]{64})$/.exec(image ?? "")?.[1];
+            return {
+                exists: true,
+                running: running === "true",
+                ownedByUntangle: true,
+                ...(digest === undefined ? {} : { imageDigest: digest }),
+                detail: `container "${name}" is ${running === "true" ? "running" : "stopped"}`,
+            };
+        },
+        async up(input, opts = {}) {
+            const state = await this.inspect(input.manifest, opts);
+            if (state.exists && !state.ownedByUntangle) {
+                return { ok: false, detail: state.detail };
+            }
+            const result = await run([
+                "compose",
+                "--project-name",
+                composeProjectName(input.manifest.id),
+                "--file",
+                input.composeFilePath,
+                "up",
+                "--detach",
+            ], opts.signal);
+            return { ok: result.ok, detail: result.detail };
+        },
+        async down(input, opts = {}) {
+            const state = await this.inspect(input.manifest, opts);
+            if (state.exists && !state.ownedByUntangle) {
+                return { ok: false, detail: state.detail };
+            }
+            const result = await run([
+                "compose",
+                "--project-name",
+                composeProjectName(input.manifest.id),
+                "--file",
+                input.composeFilePath,
+                "down",
+                ...(input.removeVolumes ? ["--volumes"] : []),
+            ], opts.signal);
+            return { ok: result.ok, detail: result.detail };
+        },
+        async logs(input, opts = {}) {
+            const state = await this.inspect(input.manifest, opts);
+            if (state.exists && !state.ownedByUntangle) {
+                return { ok: false, text: "", detail: state.detail };
+            }
+            if (!state.exists) {
+                return { ok: false, text: "", detail: state.detail };
+            }
+            const result = await run([
+                "compose",
+                "--project-name",
+                composeProjectName(input.manifest.id),
+                "--file",
+                input.composeFilePath,
+                "logs",
+                "--no-color",
+                "--tail",
+                String(input.tail),
+            ], opts.signal);
+            return { ok: result.ok, text: result.stdout, detail: result.detail };
+        },
+    };
+}
+//# sourceMappingURL=container.js.map

package/dist/commands/extensions/container.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"container.js","sourceRoot":"","sources":["../../../src/commands/extensions/container.ts"],"names":[],"mappings":"AAuBA,OAAO,EACL,kBAAkB,EAClB,eAAe,EACf,aAAa,GAQd,MAAM,kCAAkC,CAAC;AAG1C,2EAA2E;AAC3E,MAAM,CAAC,MAAM,qBAAqB,GAAG,QAAQ,CAAC;AAE9C,+EAA+E;AAC/E,MAAM,UAAU,gBAAgB,CAAC,WAAmB;IAClD,OAAO,gBAAgB,WAAW,EAAE,CAAC;AACvC,CAAC;AAED,MAAM,cAAc,GAClB,2BAA2B,aAAa,OAAO;IAC/C,2BAA2B,eAAe,OAAO;IACjD,uCAAuC,CAAC;AAU1C,MAAM,UAAU,kBAAkB,CAAC,OAA4B;IAC7D,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,qBAAqB,CAAC;IAEzD,MAAM,GAAG,GAAG,KAAK,EACf,IAAuB,EACvB,MAAoB,EACsD,EAAE;QAC5E,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,aAAa,CAAC,GAAG,CAC5C;YACE,OAAO;YACP,IAAI,EAAE,CAAC,GAAG,IAAI,CAAC;YACf,GAAG,CAAC,OAAO,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,OAAO,CAAC,GAAG,EAAE,CAAC;SAC3D,EACD,OAAO,CAAC,MAAM,EACd,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CACvC,CAAC;QACF,MAAM,EAAE,GAAG,MAAM,CAAC,OAAO,KAAK,WAAW,IAAI,CAAC,MAAM,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC;QAC1E,OAAO;YACL,EAAE;YACF,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,MAAM,CAAC,MAAM;YACrB,MAAM,EAAE,EAAE;gBACR,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,CAAC,CAAC,IAAI,EAAE,YAAY;gBACzC,CAAC,CAAC,GAAG,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,YAAY,MAAM,CAAC,OAAO,UAAU,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,GAAG;oBAC1F,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,EAAE;SACtF,CAAC;IACJ,CAAC,CAAC;IAEF,OAAO;QACL,KAAK,CAAC,SAAS,CAAC,IAAI,GAAG,EAAE;YACvB,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,UAAU,EAAE,qBAAqB,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACtF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,SAAS,EAAE,KAAK;oBAChB,MAAM,EACJ,kCAAkC,MAAM,CAAC,MAAM,sCAAsC;wBACrF,sEAAsE;iBACzE,CAAC;YACJ,CAAC;YACD,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;YACrC,OAAO;gBACL,SAAS,EAAE,IAAI;gBACf,MAAM,EAAE,qBAAqB,OAAO,iBAAiB,OAAO,GAAG;gBAC/D,GAAG,CAAC,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC;aACvC,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,OAAO,CAAC,QAA6B,EAAE,IAAI,GAAG,EAAE;YACpD,MAAM,IAAI,GAAG,gBAAgB,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC;YAC3C,MAAM,MAAM,GAAG,MAAM,GAAG,CAAC,CAAC,SAAS,EAAE,IAAI,EAAE,UAAU,EAAE,cAAc,CAAC,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;YACrF,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;gBACf,OAAO;oBACL,MAAM,EAAE,KAAK;oBACb,OAAO,EAAE,KAAK;oBACd,eAAe,EAAE,KAAK;oBACtB,MAAM,EAAE,uBAAuB,IAAI,UAAU;iBAC9C,CAAC;YACJ,CAAC;YACD,MAAM,CAAC,OAAO,EAAE,WAAW,EAAE,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;YAChF,MAAM,KAAK,GAAG,OAAO,KAAK,MAAM,IAAI,WAAW,KAAK,QAAQ,CAAC,EAAE,CAAC;YAChE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,sEAAsE;gBACtE,sEAAsE;gBACtE,OAAO;oBACL,MAAM,EAAE,IAAI;oBACZ,OAAO,EAAE,OAAO,KAAK,MAAM;oBAC3B,eAAe,EAAE,KAAK;oBACtB,MAAM,EACJ,sBAAsB,IAAI,+BAA+B,aAAa,YAAY;wBAClF,GAAG,eAAe,IAAI,QAAQ,CAAC,EAAE,wDAAwD;iBAC5F,CAAC;YACJ,CAAC;YACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;YAChE,OAAO;gBACL,MAAM,EAAE,IAAI;gBACZ,OAAO,EAAE,OAAO,KAAK,MAAM;gBAC3B,eAAe,EAAE,IAAI;gBACrB,GAAG,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC;gBACxD,MAAM,EAAE,cAAc,IAAI,QAAQ,OAAO,KAAK,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,EAAE;aAC/E,CAAC;QACJ,CAAC;QAED,KAAK,CAAC,EAAE,CAAC,KAAyB,EAAE,IAAI,GAAG,EAAE;YAC3C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7C,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB;gBACE,SAAS;gBACT,gBAAgB;gBAChB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,QAAQ;gBACR,KAAK,CAAC,eAAe;gBACrB,IAAI;gBACJ,UAAU;aACX,EACD,IAAI,CAAC,MAAM,CACZ,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,IAAI,CAAC,KAA2B,EAAE,IAAI,GAAG,EAAE;YAC/C,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YAC7C,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB;gBACE,SAAS;gBACT,gBAAgB;gBAChB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,QAAQ;gBACR,KAAK,CAAC,eAAe;gBACrB,MAAM;gBACN,GAAG,CAAC,KAAK,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;aAC9C,EACD,IAAI,CAAC,MAAM,CACZ,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QAClD,CAAC;QAED,KAAK,CAAC,IAAI,CACR,KAA+E,EAC/E,IAAI,GAAG,EAAE;YAET,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;YACvD,IAAI,KAAK,CAAC,MAAM,IAAI,CAAC,KAAK,CAAC,eAAe,EAAE,CAAC;gBAC3C,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACvD,CAAC;YACD,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;gBAClB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,CAAC;YACvD,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,GAAG,CACtB;gBACE,SAAS;gBACT,gBAAgB;gBAChB,kBAAkB,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;gBACrC,QAAQ;gBACR,KAAK,CAAC,eAAe;gBACrB,MAAM;gBACN,YAAY;gBACZ,QAAQ;gBACR,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC;aACnB,EACD,IAAI,CAAC,MAAM,CACZ,CAAC;YACF,OAAO,EAAE,EAAE,EAAE,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,CAAC;QACvE,CAAC;KACF,CAAC;AACJ,CAAC"}

package/dist/commands/extensions/context.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The shared read path of the extension commands.
+ *
+ * Every command starts from the same picture: which manifests were found in
+ * the user roots, which were rejected and why, which were deliberately
+ * ignored and why, which acknowledgments exist, and what the CLI recorded
+ * about earlier runs. Building that once keeps `list`, `run` and `enable`
+ * from drifting apart in what they consider "installed".
+ */
+import { type ExtensionDiscoveryResultV1, type LicenseAcknowledgmentV1, type LicenseGateDecisionV1, type LoadedExtensionV1 } from "@untangle-code/extension-runtime";
+import type { ExtensionEnvironmentV1 } from "./environment.js";
+import { type CliStateV1 } from "./state.js";
+export interface ExtensionContextV1 {
+    discovery: ExtensionDiscoveryResultV1;
+    acknowledgments: LicenseAcknowledgmentV1[];
+    state: CliStateV1;
+    /** Everything that was skipped, unreadable or ignored, with its reason (E4). */
+    warnings: string[];
+}
+/** Reads discovery, acknowledgments and CLI state in one go. */
+export declare function loadExtensionContext(environment: ExtensionEnvironmentV1): Promise<ExtensionContextV1>;
+/** Finds a loaded extension by id, or null. */
+export declare function findExtension(context: ExtensionContextV1, extensionId: string): LoadedExtensionV1 | null;
+/**
+ * Evaluates both gates for one extension against the stored acknowledgments.
+ *
+ * `ruleset` is the effective ruleset of the intended run; without one the
+ * manifest's `defaultRuleset` applies, which is what the runtime would use.
+ */
+export declare function gateFor(context: ExtensionContextV1, extension: LoadedExtensionV1, ruleset?: string): LicenseGateDecisionV1;
+/**
+ * Explains why an id is not installed, naming the manifests that were
+ * rejected or ignored for it. "Not found" without a reason is exactly the
+ * silent skip E4 forbids.
+ */
+export declare function explainMissing(context: ExtensionContextV1, extensionId: string): string;
+//# sourceMappingURL=context.d.ts.map

package/dist/commands/extensions/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../../src/commands/extensions/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EAIL,KAAK,0BAA0B,EAC/B,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACvB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAC/D,OAAO,EAAgB,KAAK,UAAU,EAAE,MAAM,YAAY,CAAC;AAE3D,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,0BAA0B,CAAC;IACtC,eAAe,EAAE,uBAAuB,EAAE,CAAC;IAC3C,KAAK,EAAE,UAAU,CAAC;IAClB,gFAAgF;IAChF,QAAQ,EAAE,MAAM,EAAE,CAAC;CACpB;AAED,gEAAgE;AAChE,wBAAsB,oBAAoB,CACxC,WAAW,EAAE,sBAAsB,GAClC,OAAO,CAAC,kBAAkB,CAAC,CAgB7B;AAED,+CAA+C;AAC/C,wBAAgB,aAAa,CAC3B,OAAO,EAAE,kBAAkB,EAC3B,WAAW,EAAE,MAAM,GAClB,iBAAiB,GAAG,IAAI,CAE1B;AAED;;;;;GAKG;AACH,wBAAgB,OAAO,CACrB,OAAO,EAAE,kBAAkB,EAC3B,SAAS,EAAE,iBAAiB,EAC5B,OAAO,CAAC,EAAE,MAAM,GACf,qBAAqB,CAOvB;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,OAAO,EAAE,kBAAkB,EAAE,WAAW,EAAE,MAAM,GAAG,MAAM,CAyBvF"}

package/dist/commands/extensions/context.js

@@ -0,0 +1,72 @@
+/**
+ * The shared read path of the extension commands.
+ *
+ * Every command starts from the same picture: which manifests were found in
+ * the user roots, which were rejected and why, which were deliberately
+ * ignored and why, which acknowledgments exist, and what the CLI recorded
+ * about earlier runs. Building that once keeps `list`, `run` and `enable`
+ * from drifting apart in what they consider "installed".
+ */
+import { discoverExtensions, evaluateLicenseGate, loadLicenseAcknowledgments, } from "@untangle-code/extension-runtime";
+import { loadCliState } from "./state.js";
+/** Reads discovery, acknowledgments and CLI state in one go. */
+export async function loadExtensionContext(environment) {
+    const discovery = await discoverExtensions(environment.fs, {
+        roots: environment.roots,
+        projectRoots: environment.projectRoots,
+    });
+    const acknowledgments = await loadLicenseAcknowledgments(environment.fs, {
+        userDataDirectory: environment.userDataDir,
+        projectRoots: environment.projectRoots,
+    });
+    const state = await loadCliState(environment.fs, environment.userDataDir);
+    return {
+        discovery,
+        acknowledgments: acknowledgments.acknowledgments,
+        state: state.state,
+        warnings: [...acknowledgments.warnings, ...state.warnings],
+    };
+}
+/** Finds a loaded extension by id, or null. */
+export function findExtension(context, extensionId) {
+    return context.discovery.extensions.find((entry) => entry.manifest.id === extensionId) ?? null;
+}
+/**
+ * Evaluates both gates for one extension against the stored acknowledgments.
+ *
+ * `ruleset` is the effective ruleset of the intended run; without one the
+ * manifest's `defaultRuleset` applies, which is what the runtime would use.
+ */
+export function gateFor(context, extension, ruleset) {
+    const effective = ruleset ?? extension.manifest.defaultRuleset;
+    return evaluateLicenseGate({
+        extension,
+        acknowledgments: context.acknowledgments,
+        ...(effective === undefined ? {} : { ruleset: effective }),
+    });
+}
+/**
+ * Explains why an id is not installed, naming the manifests that were
+ * rejected or ignored for it. "Not found" without a reason is exactly the
+ * silent skip E4 forbids.
+ */
+export function explainMissing(context, extensionId) {
+    const rejected = context.discovery.rejected.filter((entry) => entry.directoryName === extensionId || entry.manifestPath.includes(`/${extensionId}/`));
+    if (rejected.length > 0) {
+        const reasons = rejected
+            .flatMap((entry) => entry.issues.map((issue) => `${issue.field}: ${issue.message}`))
+            .join("; ");
+        return `extension "${extensionId}" has a manifest but it was rejected — ${reasons}`;
+    }
+    const ignored = context.discovery.ignored.filter((entry) => entry.manifestPath.includes(`/${extensionId}/`));
+    if (ignored.length > 0) {
+        const reasons = ignored.map((entry) => `${entry.reason}: ${entry.detail}`).join("; ");
+        return `extension "${extensionId}" was found but not loaded — ${reasons}`;
+    }
+    const roots = context.discovery.rootsScanned
+        .map((entry) => `${entry.root}${entry.exists ? "" : " (does not exist)"}`)
+        .join(", ");
+    return (`no extension "${extensionId}" is installed; searched: ${roots}. ` +
+        `Install one with: untangle extensions add --from <path-or-url>`);
+}
+//# sourceMappingURL=context.js.map

package/dist/commands/extensions/context.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.js","sourceRoot":"","sources":["../../../src/commands/extensions/context.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AACH,OAAO,EACL,kBAAkB,EAClB,mBAAmB,EACnB,0BAA0B,GAK3B,MAAM,kCAAkC,CAAC;AAG1C,OAAO,EAAE,YAAY,EAAmB,MAAM,YAAY,CAAC;AAU3D,gEAAgE;AAChE,MAAM,CAAC,KAAK,UAAU,oBAAoB,CACxC,WAAmC;IAEnC,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,WAAW,CAAC,EAAE,EAAE;QACzD,KAAK,EAAE,WAAW,CAAC,KAAK;QACxB,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC,CAAC;IACH,MAAM,eAAe,GAAG,MAAM,0BAA0B,CAAC,WAAW,CAAC,EAAE,EAAE;QACvE,iBAAiB,EAAE,WAAW,CAAC,WAAW;QAC1C,YAAY,EAAE,WAAW,CAAC,YAAY;KACvC,CAAC,CAAC;IACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,WAAW,CAAC,CAAC;IAC1E,OAAO;QACL,SAAS;QACT,eAAe,EAAE,eAAe,CAAC,eAAe;QAChD,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,CAAC,GAAG,eAAe,CAAC,QAAQ,EAAE,GAAG,KAAK,CAAC,QAAQ,CAAC;KAC3D,CAAC;AACJ,CAAC;AAED,+CAA+C;AAC/C,MAAM,UAAU,aAAa,CAC3B,OAA2B,EAC3B,WAAmB;IAEnB,OAAO,OAAO,CAAC,SAAS,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,WAAW,CAAC,IAAI,IAAI,CAAC;AACjG,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,OAAO,CACrB,OAA2B,EAC3B,SAA4B,EAC5B,OAAgB;IAEhB,MAAM,SAAS,GAAG,OAAO,IAAI,SAAS,CAAC,QAAQ,CAAC,cAAc,CAAC;IAC/D,OAAO,mBAAmB,CAAC;QACzB,SAAS;QACT,eAAe,EAAE,OAAO,CAAC,eAAe;QACxC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;KAC3D,CAAC,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,OAA2B,EAAE,WAAmB;IAC7E,MAAM,QAAQ,GAAG,OAAO,CAAC,SAAS,CAAC,QAAQ,CAAC,MAAM,CAChD,CAAC,KAAK,EAAE,EAAE,CACR,KAAK,CAAC,aAAa,KAAK,WAAW,IAAI,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,WAAW,GAAG,CAAC,CACzF,CAAC;IACF,IAAI,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,OAAO,GAAG,QAAQ;aACrB,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,KAAK,KAAK,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;aACnF,IAAI,CAAC,IAAI,CAAC,CAAC;QACd,OAAO,cAAc,WAAW,0CAA0C,OAAO,EAAE,CAAC;IACtF,CAAC;IACD,MAAM,OAAO,GAAG,OAAO,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CACzD,KAAK,CAAC,YAAY,CAAC,QAAQ,CAAC,IAAI,WAAW,GAAG,CAAC,CAChD,CAAC;IACF,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,OAAO,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACtF,OAAO,cAAc,WAAW,gCAAgC,OAAO,EAAE,CAAC;IAC5E,CAAC;IACD,MAAM,KAAK,GAAG,OAAO,CAAC,SAAS,CAAC,YAAY;SACzC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,GAAG,KAAK,CAAC,IAAI,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;SACzE,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,OAAO,CACL,iBAAiB,WAAW,6BAA6B,KAAK,IAAI;QAClE,gEAAgE,CACjE,CAAC;AACJ,CAAC"}

package/dist/commands/extensions/enable.d.ts

@@ -0,0 +1,6 @@
+import { type ParsedArgs } from "../../cli/args.js";
+import { type Io } from "../../cli/io.js";
+import type { ExtensionEnvironmentV1 } from "./environment.js";
+export declare function runEnable(environment: ExtensionEnvironmentV1, args: ParsedArgs, io: Io, format: "text" | "json"): Promise<number>;
+export declare function runDisable(environment: ExtensionEnvironmentV1, args: ParsedArgs, io: Io, format: "text" | "json"): Promise<number>;
+//# sourceMappingURL=enable.d.ts.map

package/dist/commands/extensions/enable.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable.d.ts","sourceRoot":"","sources":["../../../src/commands/extensions/enable.ts"],"names":[],"mappings":"AAuBA,OAAO,EAAsB,KAAK,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAExE,OAAO,EAAc,KAAK,EAAE,EAAE,MAAM,iBAAiB,CAAC;AAItD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,kBAAkB,CAAC;AAU/D,wBAAsB,SAAS,CAC7B,WAAW,EAAE,sBAAsB,EACnC,IAAI,EAAE,UAAU,EAChB,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC,CAkGjB;AAED,wBAAsB,UAAU,CAC9B,WAAW,EAAE,sBAAsB,EACnC,IAAI,EAAE,UAAU,EAChB,EAAE,EAAE,EAAE,EACN,MAAM,EAAE,MAAM,GAAG,MAAM,GACtB,OAAO,CAAC,MAAM,CAAC,CAuFjB"}

package/dist/commands/extensions/enable.js

@@ -0,0 +1,180 @@
+/**
+ * `untangle extensions enable <id>` / `disable <id>`
+ *
+ * These exist because the runtime's license gate prints them. When a gate is
+ * unacknowledged the runtime hands back the exact command that would grant
+ * the acknowledgment (extensions.md §9.5), and a printed command that does
+ * not exist is worse than no hint at all.
+ *
+ * `enable` records the opt-in and, with the acknowledgment flags, the
+ * personal license declaration. It starts nothing: no process, no pull, no
+ * container (X1). `disable` reverses the opt-in and, with `--revoke-license`,
+ * the declaration (§9.3).
+ *
+ * The tool gate and the ruleset gate are separate. `--acknowledge-license`
+ * covers the tool ONLY; a restricted ruleset still needs its own
+ * `--acknowledge-ruleset=<id>`, which is repeatable.
+ */
+import { buildAcknowledgment, createNodeProcessRunner, defaultProcessLimits, } from "@untangle-code/extension-runtime";
+import { boolFlag, listFlag } from "../../cli/args.js";
+import { EXIT, OperationalError, UsageError } from "../../cli/exit.js";
+import { line, note } from "../../cli/io.js";
+import { createContainerCli } from "./container.js";
+import { explainMissing, findExtension, gateFor, loadExtensionContext } from "./context.js";
+import { composeFilePath } from "./provision.js";
+import { emitJson } from "./render.js";
+import { revokeAcknowledgments, saveAcknowledgments, saveCliState, upsertAcknowledgment, } from "./state.js";
+export async function runEnable(environment, args, io, format) {
+    const extensionId = args.positionals[1];
+    if (extensionId === undefined) {
+        throw new UsageError("`untangle extensions enable` needs an extension id.", "Run `untangle extensions list` to see the installed ids.");
+    }
+    const context = await loadExtensionContext(environment);
+    const extension = findExtension(context, extensionId);
+    if (extension === null) {
+        throw new OperationalError(explainMissing(context, extensionId), "Install it first: untangle extensions add --from=<path-or-url>");
+    }
+    let acknowledgments = context.acknowledgments;
+    const acknowledgedNow = [];
+    if (boolFlag(args, "acknowledge-license")) {
+        acknowledgments = upsertAcknowledgment(acknowledgments, buildAcknowledgment({
+            manifest: extension.manifest,
+            acknowledgedAt: environment.clock.nowIso(),
+            acknowledgedBy: environment.userName,
+        }));
+        acknowledgedNow.push(`tool:${extensionId}`);
+    }
+    for (const ruleset of listFlag(args, "acknowledge-ruleset")) {
+        acknowledgments = upsertAcknowledgment(acknowledgments, buildAcknowledgment({
+            manifest: extension.manifest,
+            ruleset,
+            acknowledgedAt: environment.clock.nowIso(),
+            acknowledgedBy: environment.userName,
+        }));
+        acknowledgedNow.push(`ruleset:${ruleset}`);
+    }
+    let acknowledgmentFile;
+    if (acknowledgedNow.length > 0) {
+        acknowledgmentFile = await saveAcknowledgments(environment.fs, environment.userDataDir, acknowledgments);
+    }
+    const enabled = context.state.enabled.includes(extensionId)
+        ? context.state.enabled
+        : [...context.state.enabled, extensionId];
+    const statePath = await saveCliState(environment.fs, environment.userDataDir, {
+        ...context.state,
+        enabled,
+    });
+    const gate = gateFor({ ...context, acknowledgments }, extension);
+    if (format === "json") {
+        emitJson(io, {
+            command: "extensions enable",
+            extensionId,
+            enabled: true,
+            started: false,
+            stateFile: statePath,
+            acknowledgedNow,
+            acknowledgmentFile,
+            licenseGate: {
+                allowed: gate.allowed,
+                tool: { status: gate.tool.status, reason: gate.tool.reason },
+                rulesets: gate.rulesets.map((entry) => ({
+                    ruleset: entry.ruleset,
+                    status: entry.status,
+                    reason: entry.reason,
+                })),
+                acknowledgeCommands: gate.acknowledgeCommands,
+            },
+        });
+    }
+    else {
+        line(io, `enabled "${extensionId}" — nothing was started (X1).`);
+        line(io, `  state       ${statePath}`);
+        line(io, `  license     ${gate.tool.status} — ${gate.tool.reason}`);
+        for (const entry of gate.rulesets) {
+            line(io, `  ruleset     ${entry.ruleset}: ${entry.status} — ${entry.reason}`);
+        }
+    }
+    if (!gate.allowed) {
+        note(io, "The license gate is still open; run:");
+        for (const command of gate.acknowledgeCommands) {
+            note(io, `  ${command}`);
+        }
+        return EXIT.environment;
+    }
+    return EXIT.ok;
+}
+export async function runDisable(environment, args, io, format) {
+    const extensionId = args.positionals[1];
+    if (extensionId === undefined) {
+        throw new UsageError("`untangle extensions disable` needs an extension id.", "Run `untangle extensions list` to see the installed ids.");
+    }
+    // Die Flag-Pruefung steht VOR jeder Zustandsaenderung. Zuvor lag sie danach:
+    // ein Aufruf, den die CLI im selben Atemzug als Aufruffehler zurueckwies,
+    // hatte die Extension bereits deaktiviert. Ein abgelehnter Befehl darf nichts
+    // getan haben.
+    const removeContainer = boolFlag(args, "remove-container");
+    const removeVolumes = boolFlag(args, "remove-volumes");
+    if (removeVolumes && !removeContainer) {
+        throw new UsageError("--remove-volumes only applies together with --remove-container.", `Run untangle extensions disable ${extensionId} --remove-container --remove-volumes`);
+    }
+    const context = await loadExtensionContext(environment);
+    const statePath = await saveCliState(environment.fs, environment.userDataDir, {
+        ...context.state,
+        enabled: context.state.enabled.filter((id) => id !== extensionId),
+    });
+    // `--remove-container` fasst NUR den eigenen Container an; die Besitzprobe
+    // liegt im Adapter und laesst einen fremden gleichen Namens unberuehrt.
+    // Volumes bleiben ohne die zweite, ausdrueckliche Anweisung erhalten: ein
+    // geloeschtes Volume ist die einzige hier moegliche Handlung, die Arbeit
+    // vernichtet, die niemand wiederherstellen kann.
+    let containerDetail;
+    if (removeContainer) {
+        const installed = findExtension(context, extensionId);
+        const manifest = installed?.manifest;
+        if (manifest?.container === undefined) {
+            containerDetail = `"${extensionId}" declares no container; nothing to remove`;
+        }
+        else {
+            const containerCli = createContainerCli({
+                processRunner: createNodeProcessRunner(environment.clock),
+                limits: { ...defaultProcessLimits(), timeoutMs: 120_000 },
+                ...(environment.env["UNTANGLE_CONTAINER_CLI"] === undefined
+                    ? {}
+                    : { command: environment.env["UNTANGLE_CONTAINER_CLI"] }),
+            });
+            const down = await containerCli.down({
+                manifest,
+                composeFilePath: composeFilePath(environment.userDataDir, manifest.id),
+                removeVolumes,
+            });
+            containerDetail = down.detail;
+        }
+    }
+    let acknowledgmentFile;
+    const revoked = boolFlag(args, "revoke-license");
+    if (revoked) {
+        acknowledgmentFile = await saveAcknowledgments(environment.fs, environment.userDataDir, revokeAcknowledgments(context.acknowledgments, extensionId, environment.clock.nowIso()));
+    }
+    if (format === "json") {
+        emitJson(io, {
+            command: "extensions disable",
+            extensionId,
+            enabled: false,
+            stateFile: statePath,
+            licenseAcknowledgment: revoked ? "revoked" : "kept",
+            acknowledgmentFile,
+            ...(containerDetail === undefined ? {} : { container: containerDetail }),
+        });
+    }
+    else {
+        line(io, `disabled "${extensionId}".`);
+        line(io, revoked
+            ? `  license     acknowledgment revoked in ${String(acknowledgmentFile)}`
+            : "  license     acknowledgment kept (use --revoke-license to drop it)");
+        if (containerDetail !== undefined) {
+            line(io, `  container   ${containerDetail}`);
+        }
+    }
+    return EXIT.ok;
+}
+//# sourceMappingURL=enable.js.map

package/dist/commands/extensions/enable.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"enable.js","sourceRoot":"","sources":["../../../src/commands/extensions/enable.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EACL,mBAAmB,EACnB,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,kCAAkC,CAAC;AAE1C,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAmB,MAAM,mBAAmB,CAAC;AACxE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,IAAI,EAAE,IAAI,EAAW,MAAM,iBAAiB,CAAC;AAEtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,gBAAgB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAE5F,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,mBAAmB,EACnB,YAAY,EACZ,oBAAoB,GACrB,MAAM,YAAY,CAAC;AAEpB,MAAM,CAAC,KAAK,UAAU,SAAS,CAC7B,WAAmC,EACnC,IAAgB,EAChB,EAAM,EACN,MAAuB;IAEvB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAClB,qDAAqD,EACrD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IACtD,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,MAAM,IAAI,gBAAgB,CACxB,cAAc,CAAC,OAAO,EAAE,WAAW,CAAC,EACpC,gEAAgE,CACjE,CAAC;IACJ,CAAC;IAED,IAAI,eAAe,GAAG,OAAO,CAAC,eAAe,CAAC;IAC9C,MAAM,eAAe,GAAa,EAAE,CAAC;IACrC,IAAI,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAC1C,eAAe,GAAG,oBAAoB,CACpC,eAAe,EACf,mBAAmB,CAAC;YAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,cAAc,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE;YAC1C,cAAc,EAAE,WAAW,CAAC,QAAQ;SACrC,CAAC,CACH,CAAC;QACF,eAAe,CAAC,IAAI,CAAC,QAAQ,WAAW,EAAE,CAAC,CAAC;IAC9C,CAAC;IACD,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,IAAI,EAAE,qBAAqB,CAAC,EAAE,CAAC;QAC5D,eAAe,GAAG,oBAAoB,CACpC,eAAe,EACf,mBAAmB,CAAC;YAClB,QAAQ,EAAE,SAAS,CAAC,QAAQ;YAC5B,OAAO;YACP,cAAc,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE;YAC1C,cAAc,EAAE,WAAW,CAAC,QAAQ;SACrC,CAAC,CACH,CAAC;QACF,eAAe,CAAC,IAAI,CAAC,WAAW,OAAO,EAAE,CAAC,CAAC;IAC7C,CAAC;IACD,IAAI,kBAAsC,CAAC;IAC3C,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC/B,kBAAkB,GAAG,MAAM,mBAAmB,CAC5C,WAAW,CAAC,EAAE,EACd,WAAW,CAAC,WAAW,EACvB,eAAe,CAChB,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,WAAW,CAAC;QACzD,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,OAAO;QACvB,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;IAC5C,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,WAAW,EAAE;QAC5E,GAAG,OAAO,CAAC,KAAK;QAChB,OAAO;KACR,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,OAAO,CAAC,EAAE,GAAG,OAAO,EAAE,eAAe,EAAE,EAAE,SAAS,CAAC,CAAC;IAEjE,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,QAAQ,CAAC,EAAE,EAAE;YACX,OAAO,EAAE,mBAAmB;YAC5B,WAAW;YACX,OAAO,EAAE,IAAI;YACb,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,SAAS;YACpB,eAAe;YACf,kBAAkB;YAClB,WAAW,EAAE;gBACX,OAAO,EAAE,IAAI,CAAC,OAAO;gBACrB,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE;gBAC5D,QAAQ,EAAE,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;oBACtC,OAAO,EAAE,KAAK,CAAC,OAAO;oBACtB,MAAM,EAAE,KAAK,CAAC,MAAM;oBACpB,MAAM,EAAE,KAAK,CAAC,MAAM;iBACrB,CAAC,CAAC;gBACH,mBAAmB,EAAE,IAAI,CAAC,mBAAmB;aAC9C;SACF,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,EAAE,EAAE,YAAY,WAAW,+BAA+B,CAAC,CAAC;QACjE,IAAI,CAAC,EAAE,EAAE,iBAAiB,SAAS,EAAE,CAAC,CAAC;QACvC,IAAI,CAAC,EAAE,EAAE,iBAAiB,IAAI,CAAC,IAAI,CAAC,MAAM,MAAM,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC;QACpE,KAAK,MAAM,KAAK,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClC,IAAI,CAAC,EAAE,EAAE,iBAAiB,KAAK,CAAC,OAAO,KAAK,KAAK,CAAC,MAAM,MAAM,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;QAChF,CAAC;IACH,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,CAAC;QAClB,IAAI,CAAC,EAAE,EAAE,sCAAsC,CAAC,CAAC;QACjD,KAAK,MAAM,OAAO,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;YAC/C,IAAI,CAAC,EAAE,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,IAAI,CAAC,WAAW,CAAC;IAC1B,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,WAAmC,EACnC,IAAgB,EAChB,EAAM,EACN,MAAuB;IAEvB,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACxC,IAAI,WAAW,KAAK,SAAS,EAAE,CAAC;QAC9B,MAAM,IAAI,UAAU,CAClB,sDAAsD,EACtD,0DAA0D,CAC3D,CAAC;IACJ,CAAC;IACD,6EAA6E;IAC7E,0EAA0E;IAC1E,8EAA8E;IAC9E,eAAe;IACf,MAAM,eAAe,GAAG,QAAQ,CAAC,IAAI,EAAE,kBAAkB,CAAC,CAAC;IAC3D,MAAM,aAAa,GAAG,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACvD,IAAI,aAAa,IAAI,CAAC,eAAe,EAAE,CAAC;QACtC,MAAM,IAAI,UAAU,CAClB,iEAAiE,EACjE,mCAAmC,WAAW,sCAAsC,CACrF,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,oBAAoB,CAAC,WAAW,CAAC,CAAC;IACxD,MAAM,SAAS,GAAG,MAAM,YAAY,CAAC,WAAW,CAAC,EAAE,EAAE,WAAW,CAAC,WAAW,EAAE;QAC5E,GAAG,OAAO,CAAC,KAAK;QAChB,OAAO,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,WAAW,CAAC;KAClE,CAAC,CAAC;IACH,2EAA2E;IAC3E,wEAAwE;IACxE,0EAA0E;IAC1E,yEAAyE;IACzE,iDAAiD;IACjD,IAAI,eAAmC,CAAC;IACxC,IAAI,eAAe,EAAE,CAAC;QACpB,MAAM,SAAS,GAAG,aAAa,CAAC,OAAO,EAAE,WAAW,CAAC,CAAC;QACtD,MAAM,QAAQ,GAAG,SAAS,EAAE,QAAQ,CAAC;QACrC,IAAI,QAAQ,EAAE,SAAS,KAAK,SAAS,EAAE,CAAC;YACtC,eAAe,GAAG,IAAI,WAAW,4CAA4C,CAAC;QAChF,CAAC;aAAM,CAAC;YACN,MAAM,YAAY,GAAG,kBAAkB,CAAC;gBACtC,aAAa,EAAE,uBAAuB,CAAC,WAAW,CAAC,KAAK,CAAC;gBACzD,MAAM,EAAE,EAAE,GAAG,oBAAoB,EAAE,EAAE,SAAS,EAAE,OAAO,EAAE;gBACzD,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,wBAAwB,CAAC,KAAK,SAAS;oBACzD,CAAC,CAAC,EAAE;oBACJ,CAAC,CAAC,EAAE,OAAO,EAAE,WAAW,CAAC,GAAG,CAAC,wBAAwB,CAAC,EAAE,CAAC;aAC5D,CAAC,CAAC;YACH,MAAM,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC;gBACnC,QAAQ;gBACR,eAAe,EAAE,eAAe,CAAC,WAAW,CAAC,WAAW,EAAE,QAAQ,CAAC,EAAE,CAAC;gBACtE,aAAa;aACd,CAAC,CAAC;YACH,eAAe,GAAG,IAAI,CAAC,MAAM,CAAC;QAChC,CAAC;IACH,CAAC;IAED,IAAI,kBAAsC,CAAC;IAC3C,MAAM,OAAO,GAAG,QAAQ,CAAC,IAAI,EAAE,gBAAgB,CAAC,CAAC;IACjD,IAAI,OAAO,EAAE,CAAC;QACZ,kBAAkB,GAAG,MAAM,mBAAmB,CAC5C,WAAW,CAAC,EAAE,EACd,WAAW,CAAC,WAAW,EACvB,qBAAqB,CAAC,OAAO,CAAC,eAAe,EAAE,WAAW,EAAE,WAAW,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,CACxF,CAAC;IACJ,CAAC;IAED,IAAI,MAAM,KAAK,MAAM,EAAE,CAAC;QACtB,QAAQ,CAAC,EAAE,EAAE;YACX,OAAO,EAAE,oBAAoB;YAC7B,WAAW;YACX,OAAO,EAAE,KAAK;YACd,SAAS,EAAE,SAAS;YACpB,qBAAqB,EAAE,OAAO,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM;YACnD,kBAAkB;YAClB,GAAG,CAAC,eAAe,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,eAAe,EAAE,CAAC;SACzE,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,IAAI,CAAC,EAAE,EAAE,aAAa,WAAW,IAAI,CAAC,CAAC;QACvC,IAAI,CACF,EAAE,EACF,OAAO;YACL,CAAC,CAAC,2CAA2C,MAAM,CAAC,kBAAkB,CAAC,EAAE;YACzE,CAAC,CAAC,qEAAqE,CAC1E,CAAC;QACF,IAAI,eAAe,KAAK,SAAS,EAAE,CAAC;YAClC,IAAI,CAAC,EAAE,EAAE,iBAAiB,eAAe,EAAE,CAAC,CAAC;QAC/C,CAAC;IACH,CAAC;IACD,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC"}

package/dist/commands/extensions/environment.d.ts

@@ -0,0 +1,74 @@
+import type { Clock, FileSystemPort, Random } from "@untangle-code/domain";
+export interface ExtensionEnvironmentV1 {
+    fs: FileSystemPort;
+    clock: Clock;
+    random: Random;
+    /** Directory the user invoked the CLI from, canonicalized where possible. */
+    cwd: string;
+    /** Search roots for user-installed extensions; `roots[0]` is the install target. */
+    roots: string[];
+    /** OS-specific user data directory (holds the acknowledgment file). */
+    userDataDir: string;
+    /** Directories that MUST NOT be scanned for manifests. */
+    projectRoots: string[];
+    /** OS user name — an acknowledgment is a personal declaration. */
+    userName: string;
+    env: Readonly<Record<string, string | undefined>>;
+}
+export interface CreateExtensionEnvironmentOptions {
+    cwd: string;
+    env: Readonly<Record<string, string | undefined>>;
+    fs?: FileSystemPort;
+    clock?: Clock;
+    random?: Random;
+    homeDir?: string;
+    platform?: string;
+    userName?: string;
+}
+export declare function createExtensionEnvironment(options: CreateExtensionEnvironmentOptions): Promise<ExtensionEnvironmentV1>;
+/**
+ * Determines which directories must be treated as project directories.
+ *
+ * Walks from `start` up to the filesystem root and collects every directory
+ * carrying a project marker; if at least one is found, `start` itself joins
+ * the list, because the working directory inside a project is part of that
+ * project.
+ *
+ * Two deliberate exclusions:
+ *
+ * - **The home directory is never a project root.** A dotfiles repository in
+ *   `$HOME` is ordinary, and treating `$HOME` as a project would put
+ *   `~/.untangle/extensions` inside a project directory — which would make the
+ *   user's own extension root unscannable the moment they ran the CLI from
+ *   their home directory. The boundary is meant to keep a stranger's
+ *   repository out, not to lock people out of their own profile.
+ * - **A directory with no marker anywhere above it yields no project roots at
+ *   all.** Without a marker there is no project to protect, and a bare
+ *   directory the user made themselves is theirs. The consequence is stated
+ *   openly: `add --from ./manifest.toml` in such a directory is NOT refused.
+ *   A cloned repository always carries `.git`, so the case the boundary exists
+ *   for is still covered.
+ */
+export declare function discoverProjectRoots(fs: FileSystemPort, start: string, homeDir?: string): Promise<string[]>;
+/** True when `candidate` lies inside any of `roots`. */
+export declare function isInsideAnyRoot(candidate: string, roots: readonly string[]): boolean;
+/** Resolves a user-supplied path against the working directory. */
+export declare function resolveUserPath(cwd: string, path: string): string;
+/**
+ * Canonical form of a path, with symlinks resolved.
+ *
+ * This is not cosmetic. `isProjectLocalManifest` and `isInsideDirectory`
+ * compare LEXICALLY and say so: they never resolve symlinks, and the caller is
+ * expected to hand them canonical paths. Skipping this step would leave the
+ * project boundary trivially escapable — a symlink, or on macOS merely the
+ * `/var` → `/private/var` alias, is enough to make a path inside a project
+ * compare as if it were outside one.
+ *
+ * A path that does not exist yet still gets canonicalized as far as it does
+ * exist: the deepest existing ancestor is resolved and the remaining segments
+ * are re-appended. Failing the whole command over a not-yet-created file would
+ * be worse than a partially canonical answer, and the ancestor is the part
+ * that decides containment.
+ */
+export declare function canonicalize(fs: FileSystemPort, path: string): Promise<string>;
+//# sourceMappingURL=environment.d.ts.map

package/dist/commands/extensions/environment.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment.d.ts","sourceRoot":"","sources":["../../../src/commands/extensions/environment.ts"],"names":[],"mappings":"AAwBA,OAAO,KAAK,EAAE,KAAK,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,uBAAuB,CAAC;AAW3E,MAAM,WAAW,sBAAsB;IACrC,EAAE,EAAE,cAAc,CAAC;IACnB,KAAK,EAAE,KAAK,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,6EAA6E;IAC7E,GAAG,EAAE,MAAM,CAAC;IACZ,oFAAoF;IACpF,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,uEAAuE;IACvE,WAAW,EAAE,MAAM,CAAC;IACpB,0DAA0D;IAC1D,YAAY,EAAE,MAAM,EAAE,CAAC;IACvB,kEAAkE;IAClE,QAAQ,EAAE,MAAM,CAAC;IACjB,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,iCAAiC;IAChD,GAAG,EAAE,MAAM,CAAC;IACZ,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC;IAClD,EAAE,CAAC,EAAE,cAAc,CAAC;IACpB,KAAK,CAAC,EAAE,KAAK,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,wBAAsB,0BAA0B,CAC9C,OAAO,EAAE,iCAAiC,GACzC,OAAO,CAAC,sBAAsB,CAAC,CAsBjC;AAUD;;;;;;;;;;;;;;;;;;;;;;GAsBG;AACH,wBAAsB,oBAAoB,CACxC,EAAE,EAAE,cAAc,EAClB,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,MAAM,EAAE,CAAC,CAkBnB;AAWD,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,SAAS,MAAM,EAAE,GAAG,OAAO,CAEpF;AAED,mEAAmE;AACnE,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,MAAM,CAEjE;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAsB,YAAY,CAAC,EAAE,EAAE,cAAc,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgBpF"}