approval-md 0.0.1 → 0.2.0

package/dist/src/cli/checkpoint-tap.d.ts

@@ -0,0 +1,169 @@
+/**
+ * The checkpoint tap: custody, the offer, the prompt text, the signature
+ * (APRV-257, the delivery half of APRV-220).
+ *
+ * APRV-220 built the record and gave a human exactly one way to sign one:
+ * `approval log checkpoint` at a terminal, remembered. This file is what makes
+ * it happen without the remembering, and it is deliberately the ONLY file
+ * between a channel and a signature.
+ *
+ * ## Why custody lives here now
+ *
+ * `core/checkpoint.ts` takes the private key as a value and reads it from
+ * nowhere, so that one file decides where a checkpoint key may come from. Until
+ * this task that file was `cli/log-checkpoint.ts`, because the terminal verb was
+ * the only caller. It is not any more: the Telegram listener and the CLI channel
+ * both sign now. So the decision moved here rather than being copied, and
+ * `cli/log-checkpoint.ts` calls {@link resolveCheckpointKey} like everyone else.
+ * There is still exactly one place to read to learn every way a key can reach a
+ * signature, which was the whole property.
+ *
+ * Two sources, in this order, unchanged from APRV-220:
+ *
+ * 1. `--key-file <path>`, for a key an operator keeps outside the vault.
+ * 2. The credential vault, under `approval.checkpoint.key`. Encrypted at rest
+ *    under the passphrase `vault.passphrase_env` names, which
+ *    `core/child-env.ts` strips from every child this runtime spawns
+ *    (APRV-205), behind a file whose reading classifies `account.credential`.
+ *
+ * There is no `--key` flag and no environment variable holding the key.
+ *
+ * ## Why an agent-launched process cannot reach any of this
+ *
+ * Three independent locks, and the tap adds none of its own — it inherits all
+ * three, which is why the tap can be built at all:
+ *
+ * 1. **Classification.** `approval log checkpoint` and `approval setup
+ *    checkpoint` classify `policy.core` in `core/command-class.ts`, which the
+ *    reference policy holds `human-only`, so the Claude Code hook denies both
+ *    with `hook-class-human-only` before a process starts.
+ * 2. **The passphrase.** `core/child-env.ts` strips `vault.passphrase_env` from
+ *    every child this runtime spawns, so a process an agent launched cannot
+ *    open the vault even if it ran this code.
+ * 3. **The launch.** The listener holds the passphrase because a HUMAN
+ *    exported it into the shell they started `approval up` in. Nothing an agent
+ *    can do puts it into a process the agent controls.
+ *
+ * `tests/checkpoint-tap.test.ts` proves the first two and proves the third
+ * structurally: the hook's module graph never reaches this file.
+ *
+ * ## What the human is shown is what gets signed
+ *
+ * The offer carries a `(seq, hash)`; the prompt prints it; the signature covers
+ * it. The head may have moved several times over between the prompt and the tap
+ * — a phone is in a pocket and a daemon is not — and
+ * {@link ../core/checkpoint.js appendCheckpointAt} signs the head that was on
+ * the screen, checking first that this chain still carries those bytes at that
+ * seq. APRV-220's verify rule (a checkpoint signs any seq below its own) exists
+ * precisely so this is a legal record rather than a clever one.
+ */
+import { type CheckpointOffer } from "../core/checkpoint.js";
+/** Where a policy is, spelled the way every CLI verb spells it. */
+export interface PolicyWhere {
+    file?: string;
+    dir?: string;
+}
+/** Everything a surface needs to offer and take a checkpoint. */
+export interface CheckpointTap {
+    logPath: string;
+    policy: PolicyWhere;
+    /** `--key-file`, absolute, or `null` for the vault. */
+    keyFile: string | null;
+    /** An explicit vault path, or `null` for the one beside the log. */
+    vault: string | null;
+    schemaDir?: string;
+}
+/** Why no key could be had. One code: the repair is the message, not a branch. */
+export declare const CHECKPOINT_KEY_REFUSAL = "checkpoint-key-unreadable";
+export type KeyResolution = {
+    ok: true;
+    privateKey: string;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+/**
+ * The private key, or a refusal naming which source failed and how to fix it.
+ *
+ * Moved verbatim from `cli/log-checkpoint.ts` (APRV-257) so that the terminal
+ * verb, the Telegram listener and the CLI channel share one answer to "where
+ * may a checkpoint key come from". The sentences are unchanged: an operator who
+ * has seen this refusal once should not meet it in new words on another
+ * surface.
+ */
+export declare function resolveCheckpointKey(keyFile: string | null, logPath: string, vaultFlag: string | null, policyWhere: PolicyWhere, cwd: string, 
+/**
+ * Where the passphrase is read from. `process.env` in production.
+ *
+ * A seam and not a back door, and the same one `setup adapter` carries: it
+ * goes through {@link passphraseFrom}, which is the function `approval vault
+ * set` uses, and it never resolves `.approval/env` (SPEC.md §11.1 invariant
+ * 7). Injectable so a suite can prove the vault path without mutating an
+ * environment every other test in the process shares.
+ */
+env?: NodeJS.ProcessEnv): KeyResolution;
+/**
+ * The checkpoint this log is owed, or `null`.
+ *
+ * Reads the policy first and gives up the moment it names no cadence, so a
+ * dispatch cycle on a gate that has never turned checkpoints on pays one policy
+ * load and no log walk. Everything after that is
+ * {@link ../core/checkpoint.js checkpointDue} over verified records, which is
+ * the same call the daemon's warning and doctor's row make: three surfaces,
+ * one rule, no arrangement in which they disagree.
+ *
+ * A log that does not verify produces no offer and no complaint. A chain that
+ * is not fit to be read is not fit to be signed either, and the surfaces that
+ * exist to shout about a bad chain — `approval log verify`, the daemon's
+ * re-proof, doctor's `log` row — are already shouting.
+ */
+export declare function checkpointOfferFor(tap: CheckpointTap, now?: number): CheckpointOffer | null;
+/**
+ * What a human reads before they tap, on every channel.
+ *
+ * One text for every surface, because the thing being consented to is identical
+ * and a phone that phrased it differently from a terminal would be two claims
+ * about one gesture. The `(seq, hash)` is first and whole: it is the entire
+ * content of the signature, and an approver who cannot see what they are
+ * signing is not approving anything.
+ *
+ * The last line is the one that keeps this honest. Declining costs nothing —
+ * there is no path in this runtime from a checkpoint that is due to a refusal
+ * of anything — and a prompt that implied otherwise would be manufacturing
+ * pressure for a signature.
+ */
+export declare function checkpointPromptLines(offer: CheckpointOffer): string[];
+export type CheckpointTapResult = {
+    ok: true;
+    seq: number;
+    signed: {
+        seq: number;
+        hash: string;
+    };
+    fingerprint: string;
+} | {
+    ok: false;
+    code: string;
+    message: string;
+};
+/**
+ * Sign one head and append the record, on the machine the channel runs on.
+ *
+ * `head` is the `(seq, hash)` that was on the screen, handed back by the
+ * channel unchanged. It is a head rather than the whole offer on purpose: by
+ * tap time the offer's cadence arithmetic is hours stale and nothing should be
+ * tempted to read it, while the head is the one part that must survive
+ * verbatim.
+ *
+ * The key is resolved at TAP time and not at offer time, and that ordering is
+ * the point: a prompt sitting on a phone for an hour holds no key material
+ * anywhere, and a listener whose vault the operator has since re-keyed refuses
+ * the tap with a sentence rather than signing with something stale.
+ */
+export declare function signCheckpointOffer(tap: CheckpointTap, head: {
+    seq: number;
+    hash: string;
+}, actor: string, channel: string, cwd: string): CheckpointTapResult;
+/** What a channel says on the message it just edited, once a tap has landed. */
+export declare function checkpointSignedLines(result: CheckpointTapResult): string[];

package/dist/src/cli/checkpoint-tap.js

@@ -0,0 +1,238 @@
+/**
+ * The checkpoint tap: custody, the offer, the prompt text, the signature
+ * (APRV-257, the delivery half of APRV-220).
+ *
+ * APRV-220 built the record and gave a human exactly one way to sign one:
+ * `approval log checkpoint` at a terminal, remembered. This file is what makes
+ * it happen without the remembering, and it is deliberately the ONLY file
+ * between a channel and a signature.
+ *
+ * ## Why custody lives here now
+ *
+ * `core/checkpoint.ts` takes the private key as a value and reads it from
+ * nowhere, so that one file decides where a checkpoint key may come from. Until
+ * this task that file was `cli/log-checkpoint.ts`, because the terminal verb was
+ * the only caller. It is not any more: the Telegram listener and the CLI channel
+ * both sign now. So the decision moved here rather than being copied, and
+ * `cli/log-checkpoint.ts` calls {@link resolveCheckpointKey} like everyone else.
+ * There is still exactly one place to read to learn every way a key can reach a
+ * signature, which was the whole property.
+ *
+ * Two sources, in this order, unchanged from APRV-220:
+ *
+ * 1. `--key-file <path>`, for a key an operator keeps outside the vault.
+ * 2. The credential vault, under `approval.checkpoint.key`. Encrypted at rest
+ *    under the passphrase `vault.passphrase_env` names, which
+ *    `core/child-env.ts` strips from every child this runtime spawns
+ *    (APRV-205), behind a file whose reading classifies `account.credential`.
+ *
+ * There is no `--key` flag and no environment variable holding the key.
+ *
+ * ## Why an agent-launched process cannot reach any of this
+ *
+ * Three independent locks, and the tap adds none of its own — it inherits all
+ * three, which is why the tap can be built at all:
+ *
+ * 1. **Classification.** `approval log checkpoint` and `approval setup
+ *    checkpoint` classify `policy.core` in `core/command-class.ts`, which the
+ *    reference policy holds `human-only`, so the Claude Code hook denies both
+ *    with `hook-class-human-only` before a process starts.
+ * 2. **The passphrase.** `core/child-env.ts` strips `vault.passphrase_env` from
+ *    every child this runtime spawns, so a process an agent launched cannot
+ *    open the vault even if it ran this code.
+ * 3. **The launch.** The listener holds the passphrase because a HUMAN
+ *    exported it into the shell they started `approval up` in. Nothing an agent
+ *    can do puts it into a process the agent controls.
+ *
+ * `tests/checkpoint-tap.test.ts` proves the first two and proves the third
+ * structurally: the hook's module graph never reaches this file.
+ *
+ * ## What the human is shown is what gets signed
+ *
+ * The offer carries a `(seq, hash)`; the prompt prints it; the signature covers
+ * it. The head may have moved several times over between the prompt and the tap
+ * — a phone is in a pocket and a daemon is not — and
+ * {@link ../core/checkpoint.js appendCheckpointAt} signs the head that was on
+ * the screen, checking first that this chain still carries those bytes at that
+ * seq. APRV-220's verify rule (a checkpoint signs any seq below its own) exists
+ * precisely so this is a legal record rather than a clever one.
+ */
+import { readFileSync } from "node:fs";
+import { isAbsolute, resolve } from "node:path";
+import { appendCheckpointAt, checkpointDue, checkpointPolicyOf, CHECKPOINT_KEY_CREDENTIAL, } from "../core/checkpoint.js";
+import { readVerifiedRecords } from "../core/state.js";
+import { loadPolicy } from "../core/policy-load.js";
+import { getCredential, passphraseEnvFor, passphraseFrom, vaultPathFor } from "../core/vault.js";
+/** Why no key could be had. One code: the repair is the message, not a branch. */
+export const CHECKPOINT_KEY_REFUSAL = "checkpoint-key-unreadable";
+function absolute(path, cwd) {
+    return isAbsolute(path) ? path : resolve(cwd, path);
+}
+/**
+ * The private key, or a refusal naming which source failed and how to fix it.
+ *
+ * Moved verbatim from `cli/log-checkpoint.ts` (APRV-257) so that the terminal
+ * verb, the Telegram listener and the CLI channel share one answer to "where
+ * may a checkpoint key come from". The sentences are unchanged: an operator who
+ * has seen this refusal once should not meet it in new words on another
+ * surface.
+ */
+export function resolveCheckpointKey(keyFile, logPath, vaultFlag, policyWhere, cwd, 
+/**
+ * Where the passphrase is read from. `process.env` in production.
+ *
+ * A seam and not a back door, and the same one `setup adapter` carries: it
+ * goes through {@link passphraseFrom}, which is the function `approval vault
+ * set` uses, and it never resolves `.approval/env` (SPEC.md §11.1 invariant
+ * 7). Injectable so a suite can prove the vault path without mutating an
+ * environment every other test in the process shares.
+ */
+env) {
+    if (keyFile !== null) {
+        const path = absolute(keyFile, cwd);
+        let text;
+        try {
+            text = readFileSync(path, "utf8").trim();
+        }
+        catch (cause) {
+            return {
+                ok: false,
+                code: CHECKPOINT_KEY_REFUSAL,
+                message: `--key-file ${path} could not be read (${cause instanceof Error ? cause.message : String(cause)}); nothing was appended`,
+            };
+        }
+        if (text.length === 0) {
+            return {
+                ok: false,
+                code: CHECKPOINT_KEY_REFUSAL,
+                message: `--key-file ${path} is empty; a checkpoint key is a base64 PKCS#8 Ed25519 private key on one line. Nothing was appended`,
+            };
+        }
+        return { ok: true, privateKey: text };
+    }
+    const vaultPath = vaultFlag === null ? vaultPathFor(logPath) : absolute(vaultFlag, cwd);
+    const passphraseEnv = passphraseEnvFor(loadPolicy(policyWhere));
+    const passphrase = passphraseFrom(passphraseEnv, env ?? process.env);
+    if (passphrase === null) {
+        return {
+            ok: false,
+            code: CHECKPOINT_KEY_REFUSAL,
+            message: `${passphraseEnv} is unset or empty, so the vault holding ${CHECKPOINT_KEY_CREDENTIAL} could not be opened. The passphrase is read from that variable and from nowhere else; there is no --passphrase flag. Nothing was appended`,
+        };
+    }
+    const credential = getCredential(vaultPath, passphrase, CHECKPOINT_KEY_CREDENTIAL);
+    if (!credential.ok) {
+        return {
+            ok: false,
+            code: CHECKPOINT_KEY_REFUSAL,
+            message: `the checkpoint signing key could not be read from ${vaultPath} (${credential.code}: ${credential.message}). Mint one with \`approval setup checkpoint\`, or pass --key-file. Nothing was appended`,
+        };
+    }
+    return { ok: true, privateKey: credential.value };
+}
+// ---------------------------------------------------------------------------
+// The offer
+// ---------------------------------------------------------------------------
+/**
+ * The checkpoint this log is owed, or `null`.
+ *
+ * Reads the policy first and gives up the moment it names no cadence, so a
+ * dispatch cycle on a gate that has never turned checkpoints on pays one policy
+ * load and no log walk. Everything after that is
+ * {@link ../core/checkpoint.js checkpointDue} over verified records, which is
+ * the same call the daemon's warning and doctor's row make: three surfaces,
+ * one rule, no arrangement in which they disagree.
+ *
+ * A log that does not verify produces no offer and no complaint. A chain that
+ * is not fit to be read is not fit to be signed either, and the surfaces that
+ * exist to shout about a bad chain — `approval log verify`, the daemon's
+ * re-proof, doctor's `log` row — are already shouting.
+ */
+export function checkpointOfferFor(tap, now) {
+    const configured = checkpointPolicyOf(tap.policy, tap.schemaDir);
+    if (configured.checkpointEveryMs === null || configured.publicKeys.length === 0)
+        return null;
+    const read = readVerifiedRecords(tap.logPath, tap.schemaDir === undefined ? {} : { schemaDir: tap.schemaDir });
+    if (!read.ok)
+        return null;
+    return checkpointDue({
+        records: read.records,
+        publicKeys: configured.publicKeys,
+        checkpointEveryMs: configured.checkpointEveryMs,
+        ...(now === undefined ? {} : { now }),
+    });
+}
+/**
+ * What a human reads before they tap, on every channel.
+ *
+ * One text for every surface, because the thing being consented to is identical
+ * and a phone that phrased it differently from a terminal would be two claims
+ * about one gesture. The `(seq, hash)` is first and whole: it is the entire
+ * content of the signature, and an approver who cannot see what they are
+ * signing is not approving anything.
+ *
+ * The last line is the one that keeps this honest. Declining costs nothing —
+ * there is no path in this runtime from a checkpoint that is due to a refusal
+ * of anything — and a prompt that implied otherwise would be manufacturing
+ * pressure for a signature.
+ */
+export function checkpointPromptLines(offer) {
+    return [
+        `CHECKPOINT DUE — sign the log head at seq ${String(offer.head.seq)}?`,
+        `head  seq ${String(offer.head.seq)}  ${offer.head.hash}`,
+        offer.since === null
+            ? "This log has never been checkpointed."
+            : `The newest checkpoint is at seq ${String(offer.since)}.`,
+        offer.warning,
+        "Signing appends one log.checkpoint saying that a key no agent process holds saw this head. It authorizes nothing, spends nothing, and decides no request.",
+        "The head may move before you tap. What is signed is the head named above, which is the one you are looking at.",
+        "Not signing is not a refusal of anything: a checkpoint that is owed is a warning at every layer and never a reason to hold up an action.",
+    ];
+}
+/**
+ * Sign one head and append the record, on the machine the channel runs on.
+ *
+ * `head` is the `(seq, hash)` that was on the screen, handed back by the
+ * channel unchanged. It is a head rather than the whole offer on purpose: by
+ * tap time the offer's cadence arithmetic is hours stale and nothing should be
+ * tempted to read it, while the head is the one part that must survive
+ * verbatim.
+ *
+ * The key is resolved at TAP time and not at offer time, and that ordering is
+ * the point: a prompt sitting on a phone for an hour holds no key material
+ * anywhere, and a listener whose vault the operator has since re-keyed refuses
+ * the tap with a sentence rather than signing with something stale.
+ */
+export function signCheckpointOffer(tap, head, actor, channel, cwd) {
+    const key = resolveCheckpointKey(tap.keyFile, tap.logPath, tap.vault, tap.policy, cwd);
+    if (!key.ok)
+        return key;
+    const appended = appendCheckpointAt(tap.logPath, key.privateKey, actor, head, {
+        channel,
+        ...(tap.schemaDir === undefined ? {} : { schemaDir: tap.schemaDir }),
+    });
+    if (!appended.ok)
+        return { ok: false, code: appended.code, message: appended.message };
+    return {
+        ok: true,
+        seq: appended.record.seq,
+        signed: { seq: appended.head.seq, hash: appended.head.hash },
+        fingerprint: appended.fingerprint,
+    };
+}
+/** What a channel says on the message it just edited, once a tap has landed. */
+export function checkpointSignedLines(result) {
+    if (!result.ok) {
+        return [
+            "NOT CHECKPOINTED",
+            `${result.code}: ${result.message}`,
+            "Nothing was appended. The log is unchanged and no verdict anywhere depends on this.",
+        ];
+    }
+    return [
+        "CHECKPOINTED",
+        `log.checkpoint at seq ${String(result.seq)}, signing head seq ${String(result.signed.seq)} ${result.signed.hash}`,
+        `key ${result.fingerprint}`,
+    ];
+}
+//# sourceMappingURL=checkpoint-tap.js.map

package/dist/src/cli/checkpoint-tap.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"checkpoint-tap.js","sourceRoot":"","sources":["../../../src/cli/checkpoint-tap.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0DG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEhD,OAAO,EACL,kBAAkB,EAClB,aAAa,EACb,kBAAkB,EAClB,yBAAyB,GAE1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AACvD,OAAO,EAAE,UAAU,EAAE,MAAM,wBAAwB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAmBjG,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GAAG,2BAA2B,CAAC;AAMlE,SAAS,QAAQ,CAAC,IAAY,EAAE,GAAW;IACzC,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB,CAClC,OAAsB,EACtB,OAAe,EACf,SAAwB,EACxB,WAAwB,EACxB,GAAW;AACX;;;;;;;;GAQG;AACH,GAAuB;IAEvB,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;QACrB,MAAM,IAAI,GAAG,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;QACpC,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACH,IAAI,GAAG,YAAY,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;QAC3C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YACf,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,cAAc,IAAI,uBACzB,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CACvD,yBAAyB;aAC1B,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACtB,OAAO;gBACL,EAAE,EAAE,KAAK;gBACT,IAAI,EAAE,sBAAsB;gBAC5B,OAAO,EAAE,cAAc,IAAI,sGAAsG;aAClI,CAAC;QACJ,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC;IACxC,CAAC;IAED,MAAM,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,CAAC;IACxF,MAAM,aAAa,GAAG,gBAAgB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC;IAChE,MAAM,UAAU,GAAG,cAAc,CAAC,aAAa,EAAE,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,GAAG,aAAa,4CAA4C,yBAAyB,4IAA4I;SAC3O,CAAC;IACJ,CAAC;IACD,MAAM,UAAU,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,yBAAyB,CAAC,CAAC;IACnF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,sBAAsB;YAC5B,OAAO,EAAE,qDAAqD,SAAS,KAAK,UAAU,CAAC,IAAI,KAAK,UAAU,CAAC,OAAO,0FAA0F;SAC7M,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,UAAU,CAAC,KAAK,EAAE,CAAC;AACpD,CAAC;AAED,8EAA8E;AAC9E,YAAY;AACZ,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,GAAkB,EAAE,GAAY;IACjE,MAAM,UAAU,GAAG,kBAAkB,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,SAAS,CAAC,CAAC;IACjE,IAAI,UAAU,CAAC,iBAAiB,KAAK,IAAI,IAAI,UAAU,CAAC,UAAU,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAE7F,MAAM,IAAI,GAAG,mBAAmB,CAC9B,GAAG,CAAC,OAAO,EACX,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAChE,CAAC;IACF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,IAAI,CAAC;IAE1B,OAAO,aAAa,CAAC;QACnB,OAAO,EAAE,IAAI,CAAC,OAAO;QACrB,UAAU,EAAE,UAAU,CAAC,UAAU;QACjC,iBAAiB,EAAE,UAAU,CAAC,iBAAiB;QAC/C,GAAG,CAAC,GAAG,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,CAAC;KACtC,CAAC,CAAC;AACL,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAsB;IAC1D,OAAO;QACL,6CAA6C,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG;QACtE,aAAa,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE;QACzD,KAAK,CAAC,KAAK,KAAK,IAAI;YAClB,CAAC,CAAC,uCAAuC;YACzC,CAAC,CAAC,mCAAmC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG;QAC7D,KAAK,CAAC,OAAO;QACb,2JAA2J;QAC3J,gHAAgH;QAChH,0IAA0I;KAC3I,CAAC;AACJ,CAAC;AAUD;;;;;;;;;;;;;GAaG;AACH,MAAM,UAAU,mBAAmB,CACjC,GAAkB,EAClB,IAAmC,EACnC,KAAa,EACb,OAAe,EACf,GAAW;IAEX,MAAM,GAAG,GAAG,oBAAoB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;IACvF,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,GAAG,CAAC;IAExB,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,OAAO,EAAE,GAAG,CAAC,UAAU,EAAE,KAAK,EAAE,IAAI,EAAE;QAC5E,OAAO;QACP,GAAG,CAAC,GAAG,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,SAAS,EAAE,CAAC;KACrE,CAAC,CAAC;IACH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,CAAC;IACvF,OAAO;QACL,EAAE,EAAE,IAAI;QACR,GAAG,EAAE,QAAQ,CAAC,MAAM,CAAC,GAAG;QACxB,MAAM,EAAE,EAAE,GAAG,EAAE,QAAQ,CAAC,IAAI,CAAC,GAAG,EAAE,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,IAAI,EAAE;QAC5D,WAAW,EAAE,QAAQ,CAAC,WAAW;KAClC,CAAC;AACJ,CAAC;AAED,gFAAgF;AAChF,MAAM,UAAU,qBAAqB,CAAC,MAA2B;IAC/D,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,kBAAkB;YAClB,GAAG,MAAM,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE;YACnC,qFAAqF;SACtF,CAAC;IACJ,CAAC;IACD,OAAO;QACL,cAAc;QACd,yBAAyB,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,sBAAsB,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE;QAClH,OAAO,MAAM,CAAC,WAAW,EAAE;KAC5B,CAAC;AACJ,CAAC"}

package/dist/src/cli/codex.d.ts

@@ -0,0 +1,2 @@
+import type { Streams } from "./main.js";
+export declare function commandCodex(argv: string[], streams: Streams, cwd: string): number;

package/dist/src/cli/codex.js

@@ -0,0 +1,172 @@
+import { resolve } from "node:path";
+import { boolFlag, parseFlags, stringFlag } from "./args.js";
+import { EXIT_INTEGRITY, EXIT_IO, EXIT_OK, EXIT_USAGE } from "./exit-codes.js";
+import { CODEX_HELP } from "./help.js";
+import { usageErrorText } from "./usage.js";
+import { strictDoctor } from "../codex/doctor.js";
+import { checkBundle, prepareBundle } from "../codex/templates.js";
+function emitError(streams, json, code, message) {
+    if (json)
+        streams.err(`${JSON.stringify({ error: { code, message } })}\n`);
+    else
+        streams.err(`approval: ${message}\n`);
+}
+function usage(streams, json, message) {
+    if (json)
+        emitError(streams, true, "usage", message);
+    else
+        streams.err(usageErrorText(message, CODEX_HELP));
+    return EXIT_USAGE;
+}
+function required(flags, name) {
+    const value = stringFlag(flags, name);
+    return value === null || value.length === 0 ? null : value;
+}
+export function commandCodex(argv, streams, cwd) {
+    const json = argv.includes("--json");
+    const subcommand = argv[0];
+    const rest = argv.slice(1);
+    if (subcommand === undefined || subcommand === "--help" || subcommand === "-h") {
+        streams.out(`${CODEX_HELP}\n`);
+        return subcommand === undefined ? EXIT_USAGE : EXIT_OK;
+    }
+    if (subcommand === "prepare") {
+        const parsed = parseFlags(rest, {
+            "--instance": "string",
+            "--workspace": "string",
+            "--primary": "string",
+            "--install-root": "string",
+            "--output": "string",
+            "--codex": "string",
+            "--node": "string",
+            "--json": "boolean",
+            "--help": "boolean",
+            "-h": "boolean",
+        });
+        if (!parsed.ok)
+            return usage(streams, json, parsed.message);
+        if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+            streams.out(`${CODEX_HELP}\n`);
+            return EXIT_OK;
+        }
+        if (parsed.positionals.length > 0)
+            return usage(streams, json, "prepare takes flags only");
+        const names = ["--instance", "--workspace", "--primary", "--install-root", "--output", "--codex", "--node"];
+        const values = Object.fromEntries(names.map((name) => [name, required(parsed.flags, name)]));
+        const missing = names.find((name) => values[name] === null);
+        if (missing !== undefined)
+            return usage(streams, json, `prepare requires ${missing}`);
+        const result = prepareBundle({
+            instanceId: values["--instance"],
+            workspace: resolve(cwd, values["--workspace"]),
+            primary: resolve(cwd, values["--primary"]),
+            installRoot: resolve(cwd, values["--install-root"]),
+            output: resolve(cwd, values["--output"]),
+            codexExecutable: resolve(cwd, values["--codex"]),
+            nodeExecutable: resolve(cwd, values["--node"]),
+        });
+        if (!result.ok) {
+            emitError(streams, json, result.code, result.message);
+            return result.code === "manifest-invalid" || result.code === "output-overlap" ? EXIT_INTEGRITY : EXIT_IO;
+        }
+        if (json)
+            streams.out(`${JSON.stringify({ ok: true, inert: true, output: result.output, files: result.files, manifest: result.manifest })}\n`);
+        else
+            streams.out(`Prepared inert Codex host bundle at ${result.output}. Review it; no host configuration changed.\n`);
+        return EXIT_OK;
+    }
+    if (subcommand === "setup") {
+        const parsed = parseFlags(rest, {
+            "--check": "string",
+            "--json": "boolean",
+            "--help": "boolean",
+            "-h": "boolean",
+        });
+        if (!parsed.ok)
+            return usage(streams, json, parsed.message);
+        if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+            streams.out(`${CODEX_HELP}\n`);
+            return EXIT_OK;
+        }
+        if (parsed.positionals.length > 0)
+            return usage(streams, json, "setup takes flags only");
+        const directory = required(parsed.flags, "--check");
+        if (directory === null)
+            return usage(streams, json, "setup requires --check <bundle>");
+        const result = checkBundle(resolve(cwd, directory));
+        if (!result.ok) {
+            emitError(streams, json, result.code, result.message);
+            return EXIT_INTEGRITY;
+        }
+        const response = {
+            ok: true,
+            inert: true,
+            ready: false,
+            bundle: resolve(cwd, directory),
+            files: result.files,
+            reason: "broker-and-runner-not-shipped",
+        };
+        if (json)
+            streams.out(`${JSON.stringify(response)}\n`);
+        else
+            streams.out("Bundle is internally consistent and inert. Broker and runner are not shipped; do not activate it.\n");
+        return EXIT_OK;
+    }
+    if (subcommand === "doctor") {
+        const parsed = parseFlags(rest, {
+            "--manifest": "string",
+            "--strict": "boolean",
+            "--json": "boolean",
+            "--help": "boolean",
+            "-h": "boolean",
+        });
+        if (!parsed.ok)
+            return usage(streams, json, parsed.message);
+        if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+            streams.out(`${CODEX_HELP}\n`);
+            return EXIT_OK;
+        }
+        if (parsed.positionals.length > 0)
+            return usage(streams, json, "doctor takes flags only");
+        if (!boolFlag(parsed.flags, "--strict"))
+            return usage(streams, json, "doctor requires --strict");
+        const manifest = required(parsed.flags, "--manifest");
+        if (manifest === null)
+            return usage(streams, json, "doctor requires --manifest <path>");
+        const result = strictDoctor(resolve(cwd, manifest));
+        if (!result.ok) {
+            if (json)
+                streams.err(`${JSON.stringify({ ok: false, ready: false, error: { code: result.code, message: result.message }, findings: result.report?.findings ?? [] })}\n`);
+            else {
+                streams.err(`approval: ${result.message}\n`);
+                for (const finding of result.report?.findings ?? []) {
+                    streams.err(`  ${finding.code}${finding.path === undefined ? "" : ` ${finding.path}`}: ${finding.message}\n`);
+                }
+            }
+            return EXIT_INTEGRITY;
+        }
+        return EXIT_OK;
+    }
+    if (subcommand === "start" || subcommand === "serve") {
+        const parsed = parseFlags(rest, {
+            "--manifest": "string",
+            "--json": "boolean",
+            "--help": "boolean",
+            "-h": "boolean",
+        });
+        if (!parsed.ok)
+            return usage(streams, json, parsed.message);
+        if (boolFlag(parsed.flags, "--help") || boolFlag(parsed.flags, "-h")) {
+            streams.out(`${CODEX_HELP}\n`);
+            return EXIT_OK;
+        }
+        if (parsed.positionals.length > 0)
+            return usage(streams, json, `${subcommand} takes flags only`);
+        if (required(parsed.flags, "--manifest") === null)
+            return usage(streams, json, `${subcommand} requires --manifest <path>`);
+        emitError(streams, json, "codex-not-ready", `codex ${subcommand} is not implemented until APRV-325.2 and APRV-325.3 provide the broker and runner`);
+        return EXIT_INTEGRITY;
+    }
+    return usage(streams, json, `unknown codex subcommand ${JSON.stringify(subcommand)}`);
+}
+//# sourceMappingURL=codex.js.map

package/dist/src/cli/codex.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"codex.js","sourceRoot":"","sources":["../../../src/cli/codex.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAEpC,OAAO,EAAE,QAAQ,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAEvC,OAAO,EAAE,cAAc,EAAE,MAAM,YAAY,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,WAAW,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAEnE,SAAS,SAAS,CAAC,OAAgB,EAAE,IAAa,EAAE,IAAY,EAAE,OAAe;IAC/E,IAAI,IAAI;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;QACtE,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,KAAK,CAAC,OAAgB,EAAE,IAAa,EAAE,OAAe;IAC7D,IAAI,IAAI;QAAE,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,CAAC,CAAC;;QAChD,OAAO,CAAC,GAAG,CAAC,cAAc,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC,CAAC;IACtD,OAAO,UAAU,CAAC;AACpB,CAAC;AAED,SAAS,QAAQ,CAAC,KAAuC,EAAE,IAAY;IACrE,MAAM,KAAK,GAAG,UAAU,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IACtC,OAAO,KAAK,KAAK,IAAI,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC;AAC7D,CAAC;AAED,MAAM,UAAU,YAAY,CAAC,IAAc,EAAE,OAAgB,EAAE,GAAW;IACxE,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,UAAU,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,IAAI,UAAU,KAAK,SAAS,IAAI,UAAU,KAAK,QAAQ,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QAC/E,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAC/B,OAAO,UAAU,KAAK,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,OAAO,CAAC;IACzD,CAAC;IAED,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE;YAC9B,YAAY,EAAE,QAAQ;YACtB,aAAa,EAAE,QAAQ;YACvB,WAAW,EAAE,QAAQ;YACrB,gBAAgB,EAAE,QAAQ;YAC1B,UAAU,EAAE,QAAQ;YACpB,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,QAAQ;YAClB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC;QAC3F,MAAM,KAAK,GAAG,CAAC,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,gBAAgB,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,CAAU,CAAC;QACrH,MAAM,MAAM,GAAG,MAAM,CAAC,WAAW,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;QAC7F,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC;QAC5D,IAAI,OAAO,KAAK,SAAS;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,oBAAoB,OAAO,EAAE,CAAC,CAAC;QACtF,MAAM,MAAM,GAAG,aAAa,CAAC;YAC3B,UAAU,EAAE,MAAM,CAAC,YAAY,CAAW;YAC1C,SAAS,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,aAAa,CAAW,CAAC;YACxD,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,WAAW,CAAW,CAAC;YACpD,WAAW,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,gBAAgB,CAAW,CAAC;YAC7D,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAW,CAAC;YAClD,eAAe,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,SAAS,CAAW,CAAC;YAC1D,cAAc,EAAE,OAAO,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAW,CAAC;SACzD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACtD,OAAO,MAAM,CAAC,IAAI,KAAK,kBAAkB,IAAI,MAAM,CAAC,IAAI,KAAK,gBAAgB,CAAC,CAAC,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC;QAC3G,CAAC;QACD,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,IAAI,CAAC,CAAC;;YAC1I,OAAO,CAAC,GAAG,CAAC,uCAAuC,MAAM,CAAC,MAAM,+CAA+C,CAAC,CAAC;QACtH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QAC3B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE;YAC9B,SAAS,EAAE,QAAQ;YACnB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,wBAAwB,CAAC,CAAC;QACzF,MAAM,SAAS,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,SAAS,CAAC,CAAC;QACpD,IAAI,SAAS,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,iCAAiC,CAAC,CAAC;QACvF,MAAM,MAAM,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;YACtD,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,MAAM,QAAQ,GAAG;YACf,EAAE,EAAE,IAAI;YACR,KAAK,EAAE,IAAI;YACX,KAAK,EAAE,KAAK;YACZ,MAAM,EAAE,OAAO,CAAC,GAAG,EAAE,SAAS,CAAC;YAC/B,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,MAAM,EAAE,+BAA+B;SACxC,CAAC;QACF,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;;YAClD,OAAO,CAAC,GAAG,CAAC,qGAAqG,CAAC,CAAC;QACxH,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE;YAC9B,YAAY,EAAE,QAAQ;YACtB,UAAU,EAAE,SAAS;YACrB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,yBAAyB,CAAC,CAAC;QAC1F,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,0BAA0B,CAAC,CAAC;QACjG,MAAM,QAAQ,GAAG,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,CAAC;QACtD,IAAI,QAAQ,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,mCAAmC,CAAC,CAAC;QACxF,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC,CAAC;QACpD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,IAAI,IAAI;gBAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;iBACrK,CAAC;gBACJ,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,OAAO,IAAI,CAAC,CAAC;gBAC7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,MAAM,EAAE,QAAQ,IAAI,EAAE,EAAE,CAAC;oBACpD,OAAO,CAAC,GAAG,CAAC,KAAK,OAAO,CAAC,IAAI,GAAG,OAAO,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,OAAO,CAAC,IAAI,EAAE,KAAK,OAAO,CAAC,OAAO,IAAI,CAAC,CAAC;gBAChH,CAAC;YACH,CAAC;YACD,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,IAAI,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,OAAO,EAAE,CAAC;QACrD,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE;YAC9B,YAAY,EAAE,QAAQ;YACtB,QAAQ,EAAE,SAAS;YACnB,QAAQ,EAAE,SAAS;YACnB,IAAI,EAAE,SAAS;SAChB,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,CAAC;QAC5D,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,IAAI,CAAC,EAAE,CAAC;YACrE,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;YAC/B,OAAO,OAAO,CAAC;QACjB,CAAC;QACD,IAAI,MAAM,CAAC,WAAW,CAAC,MAAM,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,UAAU,mBAAmB,CAAC,CAAC;QACjG,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,EAAE,YAAY,CAAC,KAAK,IAAI;YAAE,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,GAAG,UAAU,6BAA6B,CAAC,CAAC;QAC3H,SAAS,CAAC,OAAO,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,UAAU,mFAAmF,CAAC,CAAC;QACpJ,OAAO,cAAc,CAAC;IACxB,CAAC;IAED,OAAO,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,4BAA4B,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC,CAAC;AACxF,CAAC"}