approval-md 0.0.1 → 0.2.0

package/dist/src/cli/setup-flow.js

@@ -0,0 +1,476 @@
+/**
+ * The credential-collection flow (SPEC.md §5.2, §10.1, §10.4; APRV-78).
+ *
+ * `setup identity|vault|sampling|telegram` each hand-rolled their own
+ * conversation, and that was right while there were four of them and each was
+ * different. `setup adapter <name>` was the first verb whose conversation is
+ * DERIVED — from a manifest of {@link CredentialSpec}s an adapter declares — so
+ * the conversation itself becomes a function, and this file is that function.
+ * APRV-79 made it the second caller's too: `setup channel telegram` runs this
+ * flow over the Telegram channel's manifest, into `.approval/env` instead of
+ * into the vault, which is what the destination seam was built for.
+ *
+ * It knows nothing about email, SMTP, Telegram, or the vault's file format. It
+ * is handed a list of specs, somewhere to put the values
+ * ({@link FlowDestination}), and up to four hooks, and it runs one fixed order:
+ *
+ * 1. the title and the prerequisite line;
+ * 2. **the checklist** — one line per spec, before a single question is asked,
+ *    so an operator can see the whole shape of what is about to be demanded and
+ *    where it will land, and abandon at zero cost if it is the wrong vault;
+ * 3. **the preflight** ({@link FlowDestination.present}), which for a vault
+ *    means OPENING it. This is why it is step three and not step six: a wrong
+ *    passphrase must refuse before the operator has typed a password, not
+ *    after. The set it returns is also what step four reads;
+ * 4. **the replacement plan** ({@link planWrites}), asked up front for the same
+ *    reason `setup`'s own does: a confirmation asked after the value had been
+ *    replaced is a question whose "no" no longer means anything. A name the
+ *    operator declines is never even asked for;
+ * 5. **collection**, in manifest order;
+ * 6. **the cross-field check** ({@link FlowHooks.check}), before any write, so
+ *    a half-configured pair costs nothing;
+ * 7. **the writes**, in manifest order — which is why an adapter puts its
+ *    secret last: a destination that refuses half way reports exactly which
+ *    names landed and stops. **There is no rollback**, deliberately: deleting
+ *    credentials in response to a write failure is a destructive act taken by a
+ *    wizard on its own authority, over a store whose previous contents it
+ *    cannot restore;
+ * 8. **verification** ({@link FlowHooks.verify}), after the write, because the
+ *    thing being verified is the stored configuration; and
+ * 9. **the report** — where, how many, which names — and the next steps.
+ *
+ * **Values are held in this process and printed by nothing.** The flow must
+ * hold them: it collected them and it is about to write them. Every line it
+ * emits names a CREDENTIAL NAME, a kind, a count, or a path, and the suite in
+ * `tests/cli-setup.test.ts` sweeps every captured byte for the fixture secrets
+ * with no exemption on this path.
+ */
+import { envFilePathFor, readEnvFile, upsertEnvFileEntries, } from "../core/env-file.js";
+import { listCredentials, setCredential, vaultExists, } from "../core/vault.js";
+import { EXIT_INTEGRITY, EXIT_IO, EXIT_OK, EXIT_USAGE } from "./exit-codes.js";
+import { askUntil } from "./prompt.js";
+import { refusal as renderRefusal, style } from "./style.js";
+/** A vault refusal onto the exit table, exactly as `cli/vault.ts` maps it. */
+function vaultExit(refusal) {
+    return {
+        code: refusal.code,
+        message: refusal.message,
+        exitCode: refusal.code === "vault-io" || refusal.code === "vault-write-failed"
+            ? EXIT_IO
+            : EXIT_INTEGRITY,
+    };
+}
+/** An env-file refusal onto the exit table, exactly as `cli/setup.ts` maps it. */
+function envExit(refusal) {
+    return {
+        code: refusal.code,
+        message: refusal.message,
+        exitCode: refusal.code === "env-file-io" || refusal.code === "env-file-mode"
+            ? EXIT_IO
+            : EXIT_INTEGRITY,
+    };
+}
+/**
+ * The encrypted credential store (SPEC.md §10.4).
+ *
+ * `present()` is where the passphrase is proved. A vault that does not exist
+ * yet holds nothing and refuses nothing: the first `write` creates it, which is
+ * what `approval vault set` does too. A vault that DOES exist is opened here
+ * and nowhere later, so a wrong passphrase costs the operator one line of
+ * output rather than five typed values.
+ */
+export function vaultDestination(vaultPath, passphrase) {
+    return {
+        kind: "vault",
+        where: () => vaultPath,
+        present() {
+            if (!vaultExists(vaultPath))
+                return { ok: true, names: new Set() };
+            const listed = listCredentials(vaultPath, passphrase);
+            if (!listed.ok)
+                return { ok: false, ...vaultExit(listed) };
+            return { ok: true, names: new Set(listed.names) };
+        },
+        write(name, value) {
+            const stored = setCredential(vaultPath, passphrase, name, value);
+            if (!stored.ok)
+                return { ok: false, ...vaultExit(stored) };
+            return { ok: true };
+        },
+    };
+}
+/**
+ * The `.approval/env` source map (SPEC.md §5.2).
+ *
+ * Unused by `setup adapter` — an adapter's credentials go to the vault, never
+ * to this file — and used by `setup channel telegram`, which is what a channel's
+ * two values are: a source for the token and a literal chat id, both of them
+ * things that unlock the machine rather than things an adapter spends.
+ *
+ * The value written is whatever the caller collected, which on this path is a
+ * SOURCE (`keychain:<service>`), an identity, or a chat id. Nothing here decides
+ * that; {@link upsertEnvFileEntries} preserves every other line and comment.
+ */
+export function envFileDestination(envPath) {
+    return {
+        kind: "env-file",
+        where: () => envPath,
+        present() {
+            const file = readEnvFile(envPath);
+            if (!file.ok)
+                return { ok: false, ...envExit(file) };
+            return { ok: true, names: new Set(file.entries.map((entry) => entry.key)) };
+        },
+        write(name, value) {
+            const written = upsertEnvFileEntries(envPath, [{ key: name, value }]);
+            if (!written.ok)
+                return { ok: false, ...envExit(written) };
+            return { ok: true };
+        },
+    };
+}
+/** The env file for a log path, re-exported so a caller needs one import. */
+export { envFilePathFor };
+/**
+ * The two phrasings, kept as data.
+ *
+ * The env-file wording is BYTE-FOR-BYTE what `setup identity|vault|sampling|
+ * telegram` printed before this file existed, because those sentences are
+ * asserted on and, more to the point, an operator who has run `setup` before
+ * should not be told the same fact in new words for no reason.
+ */
+export const PLAN_PHRASES = {
+    "env-file": {
+        present: (name, where) => `${name} already has a line in ${where} (its value is not printed here).\n`,
+        replace: (name) => `replace the ${name} line?`,
+        leftAlone: (names, where) => `left alone in ${where}: ${names.join(", ")} (the existing line${names.length === 1 ? " is" : "s are"} unchanged)\n`,
+    },
+    vault: {
+        present: (name, where) => `${name} is already in ${where} (its value is not printed here).\n`,
+        replace: (name) => `replace ${name}?`,
+        leftAlone: (names, where) => `left alone in ${where}: ${names.join(", ")} (the existing value${names.length === 1 ? " is" : "s are"} unchanged)\n`,
+    },
+};
+/**
+ * Which names to ask for, given which are already there.
+ *
+ * Asked BEFORE any work is done, and no previous VALUE is ever printed — not
+ * even one that is not a secret. A store may legitimately hold anything under
+ * any name, the operator put it there, and a verb that echoed "replacing
+ * smtp.user (you@example.net)?" would publish it into a terminal on their
+ * behalf.
+ */
+export function planWrites(streams, prompter, present, where, names, phrases) {
+    const write = [];
+    const skipped = [];
+    for (const name of names) {
+        if (!present.has(name)) {
+            write.push(name);
+            continue;
+        }
+        streams.out(phrases.present(name, where));
+        if (prompter.confirm(phrases.replace(name)))
+            write.push(name);
+        else
+            skipped.push(name);
+    }
+    return { write, skipped };
+}
+/** Report what was left alone, so a re-run's "no" is visible in the output. */
+export function reportLeftAlone(streams, where, skipped, phrases) {
+    if (skipped.length === 0)
+        return;
+    streams.out(phrases.leftAlone([...skipped], where));
+}
+// ---------------------------------------------------------------------------
+// Picking from a closed set
+// ---------------------------------------------------------------------------
+/**
+ * A numbered picker over a closed list.
+ *
+ * Extracted from the Telegram chat picker, which is the same conversation over
+ * different nouns: print the options with an index and read a number. Both
+ * callers use this one (APRV-79).
+ *
+ * **An unparseable answer is asked again** (APRV-90). It used to be a refusal,
+ * on the argument that a wizard which loops on one question and not the others
+ * is unpredictable — the answer to which turned out to be that every question
+ * loops, not that none of them does. The options are printed once; only the
+ * question repeats, under one line saying which number was not on the list.
+ * `ok: false` now means the human withdrew (Ctrl-D) or ran out of attempts, and
+ * the message says which.
+ */
+export function pickOne(streams, prompter, options) {
+    streams.out(options.heading);
+    options.items.forEach((item, index) => {
+        const marker = index === options.defaultIndex ? " (default)" : "";
+        streams.out(`  ${String(index + 1)}. ${options.label(item)}${marker}\n`);
+    });
+    const range = `1-${String(options.items.length)}`;
+    const picked = askUntil(streams, prompter, options.prompt, (answer) => {
+        const typed = answer.trim();
+        if (typed.length === 0 && options.defaultIndex !== null) {
+            return { ok: true, value: options.items[options.defaultIndex] };
+        }
+        const index = Number.parseInt(typed, 10);
+        if (!Number.isInteger(index) || index < 1 || index > options.items.length) {
+            return { ok: false, reason: `${JSON.stringify(typed)} is not one of ${range}` };
+        }
+        return { ok: true, value: options.items[index - 1] };
+    });
+    if (!picked.ok) {
+        return {
+            ok: false,
+            message: picked.reason === "aborted"
+                ? `nothing was picked from ${range}`
+                : `no answer in ${range} after ${String(picked.attempts)} attempts`,
+        };
+    }
+    return { ok: true, item: picked.value };
+}
+// ---------------------------------------------------------------------------
+// Collection
+// ---------------------------------------------------------------------------
+/**
+ * A Google app password as the account page displays it: four groups of four
+ * characters separated by single spaces (APRV-97, APRV-98). Matched on SHAPE
+ * (`\S{4}` groups, `\s` separators) rather than on an alphabet, because the
+ * first field run met a 19-character paste that a `[a-z]`-only pattern did not
+ * recognise, and a copy from a browser can carry U+00A0 for the space. The
+ * count is printed and the strip is a `[Y/n]` question, so a genuine password
+ * of this exact shape that contains spaces is one keystroke from being kept.
+ */
+const DISPLAY_SPACED_APP_PASSWORD = /^\S{4}\s\S{4}\s\S{4}\s\S{4}$/u;
+/** The built-in prompts, one per {@link CredentialSpec.kind}. */
+function collectDefault(streams, prompter, spec) {
+    if (spec.kind === "secret") {
+        const read = prompter.readSecret(`${spec.label} (not echoed): `);
+        if (!read.ok)
+            return { kind: "abort", message: `the entry for ${spec.name} was aborted` };
+        let value = read.value;
+        if (value.length === 0) {
+            return spec.required
+                ? { kind: "abort", message: `${spec.name} is required and nothing was entered` }
+                : { kind: "skip" };
+        }
+        // The count, never the value (APRV-97). What setup collects are app
+        // passwords and tokens whose lengths are public, so a count leaks nothing
+        // and turns "blind paste, then a provider's 535" into "received 19".
+        streams.out(`  received ${String(value.length)} character(s)\n`);
+        // Outer whitespace is a paste artefact far more often than it is part of a
+        // secret (APRV-98: a copy from a web page arrived with a trailing space,
+        // and a provider's 535 was the only symptom). It is trimmed, and said.
+        const trimmed = value.trim();
+        if (trimmed.length !== value.length) {
+            streams.out(`  trimmed ${String(value.length - trimmed.length)} leading/trailing whitespace character(s); ${String(trimmed.length)} remain\n`);
+            value = trimmed;
+        }
+        if (DISPLAY_SPACED_APP_PASSWORD.test(value)) {
+            // Google shows app passwords as four groups with display spaces, and
+            // Gmail's AUTH rejects the spaced form. The shape is unmistakable, so
+            // the offer defaults to yes; it is still an offer, because a secret
+            // that genuinely contains spaces is stored exactly as typed.
+            const strip = prompter.confirm(`  that is the shape of a Google app password pasted with its display spaces (16 letters shown as 4 groups); store the 16 characters without the spaces?`, false);
+            if (strip) {
+                value = value.replace(/\s/gu, "");
+                streams.out(`  storing ${String(value.length)} character(s)\n`);
+            }
+        }
+        return { kind: "value", value };
+    }
+    if (spec.kind === "choice") {
+        const choices = spec.choices ?? [];
+        if (choices.length === 0) {
+            return { kind: "abort", message: `${spec.name} declares no choices to pick from` };
+        }
+        const defaultIndex = choices.findIndex((choice) => choice.value === spec.default);
+        const picked = pickOne(streams, prompter, {
+            heading: `\n${spec.label} — ${spec.describe}:\n`,
+            items: choices,
+            label: (choice) => `${choice.value} — ${choice.describe}`,
+            prompt: `which one? [1-${String(choices.length)}]: `,
+            defaultIndex: defaultIndex === -1 ? null : defaultIndex,
+        });
+        if (!picked.ok)
+            return { kind: "abort", message: `${spec.name}: ${picked.message}` };
+        return { kind: "value", value: picked.item.value };
+    }
+    // A config value, asked until it is one (APRV-90). The spec's OWN validator
+    // runs here rather than only after collection, so a mistyped port is one line
+    // and the same question instead of an exit code and a help page. The sentence
+    // is unchanged either way: it is the adapter's refusal, the one the operator
+    // would have been shown at send time.
+    const suffix = spec.default === undefined ? "" : ` [${spec.default}]`;
+    const asked = askUntil(streams, prompter, `${spec.label}${suffix}: `, (answer) => {
+        const typed = answer.trim();
+        const value = typed.length === 0 ? (spec.default ?? "") : typed;
+        if (value.length === 0) {
+            // `null` is "nothing to store", which is legitimate for an optional
+            // spec and is the one thing a required spec may not be answered with.
+            return spec.required
+                ? { ok: false, reason: `${spec.name} is required; nothing was entered` }
+                : { ok: true, value: null };
+        }
+        const verdict = spec.validate?.(value) ?? { ok: true };
+        return verdict.ok ? { ok: true, value } : { ok: false, reason: verdict.message };
+    });
+    if (!asked.ok) {
+        return {
+            kind: "abort",
+            message: asked.reason === "aborted"
+                ? `the entry for ${spec.name} was aborted`
+                : `${spec.name}: no valid value after ${String(asked.attempts)} attempts`,
+        };
+    }
+    return asked.value === null ? { kind: "skip" } : { kind: "value", value: asked.value };
+}
+/** The kind, in the one word the checklist prints. */
+function kindWord(spec) {
+    if (spec.kind === "secret")
+        return "secret";
+    if (spec.kind === "choice")
+        return "choice";
+    return "config";
+}
+// ---------------------------------------------------------------------------
+// The flow
+// ---------------------------------------------------------------------------
+/**
+ * Run one credential conversation, start to finish. Never throws.
+ *
+ * The caller has already done everything that is its own business: flags, the
+ * terminal check, the human-only gate, and resolving the passphrase out of the
+ * environment. What arrives here is a manifest and somewhere to put it.
+ */
+export async function runCredentialFlow(flow) {
+    const { streams, prompter, specs, destination, labels } = flow;
+    const hooks = flow.hooks ?? {};
+    const where = destination.where();
+    const phrases = PLAN_PHRASES[destination.kind];
+    const nothing = {
+        code: EXIT_OK,
+        written: [],
+        skipped: [],
+        verified: "not-attempted",
+    };
+    // (1) What this is, and what must already be true.
+    streams.out(`${labels.title}\n`);
+    if (labels.prereq !== undefined)
+        streams.out(`${labels.prereq}\n`);
+    // (2) The whole demand, before the first question.
+    streams.out(`\nIt will ask for ${String(specs.length)} value(s), all of them into ${where}:\n`);
+    for (const spec of specs) {
+        streams.out(`  ${spec.name} (${kindWord(spec)}${spec.required ? "" : ", optional"}) — ${spec.describe}\n`);
+    }
+    streams.out("\n");
+    // (3) The preflight. For a vault this is where the passphrase is proved, and
+    //     it is here rather than at the first write so that a wrong one refuses
+    //     before a password has been typed.
+    const present = destination.present();
+    if (!present.ok) {
+        streams.err(`${renderRefusal(style(), present.code, present.message)}\n`);
+        streams.err(`  nothing was collected and nothing was written to ${where}\n`);
+        return { ...nothing, code: present.exitCode };
+    }
+    // (4) What is already there, and whether to replace it.
+    const plan = planWrites(streams, prompter, present.names, where, specs.map((spec) => spec.name), phrases);
+    const wanted = specs.filter((spec) => plan.write.includes(spec.name));
+    if (wanted.length === 0) {
+        reportLeftAlone(streams, where, plan.skipped, phrases);
+        streams.out(`nothing to do: every name is already in ${where}\n`);
+        return { ...nothing, skipped: plan.skipped };
+    }
+    // (5) Collection, in manifest order. A skipped name is never asked for.
+    const values = {};
+    for (const spec of wanted) {
+        let collected = hooks.collect === undefined
+            ? collectDefault(streams, prompter, spec)
+            : await hooks.collect(spec, values);
+        // Discovery is the second chance, not the first: a value the operator
+        // typed is never overwritten by one the service reported. The hook runs
+        // only where collection left a hole, which for a channel is exactly the
+        // spec whose value the service is the authority on.
+        if (collected.kind === "skip" && hooks.discover !== undefined) {
+            collected = await hooks.discover(spec, values);
+        }
+        if (collected.kind === "refused") {
+            // The hook has already said what happened and why, in the words of the
+            // far end it was talking to. Nothing is added here.
+            return { ...nothing, code: collected.code, skipped: plan.skipped };
+        }
+        if (collected.kind === "abort") {
+            streams.err(`approval: ${collected.message}; nothing was written to ${where}\n`);
+            return { ...nothing, code: EXIT_USAGE, skipped: plan.skipped };
+        }
+        if (collected.kind === "skip") {
+            if (spec.required) {
+                streams.err(`approval: ${spec.name} is required and no value was given; nothing was written to ${where}\n`);
+                return { ...nothing, code: EXIT_USAGE, skipped: plan.skipped };
+            }
+            continue;
+        }
+        const verdict = spec.validate?.(collected.value) ?? { ok: true };
+        if (!verdict.ok) {
+            // The backstop, not the front line (APRV-90). A value the operator TYPED
+            // has already been validated inside the prompt loop and asked for again
+            // if it did not fit; what reaches here and fails is a value a
+            // {@link FlowHooks.collect} or {@link FlowHooks.discover} hook produced,
+            // which no re-prompt can fix because no question was asked. The sentence
+            // is the adapter's own refusal either way.
+            streams.err(`approval: ${spec.name}: ${verdict.message}; nothing was written to ${where}\n`);
+            return { ...nothing, code: EXIT_USAGE, skipped: plan.skipped };
+        }
+        values[spec.name] = collected.value;
+    }
+    // (6) The cross-field rule, before anything is stored.
+    const crossField = hooks.check?.(values, plan.skipped) ?? null;
+    if (crossField !== null) {
+        streams.err(`approval: ${crossField}; nothing was written to ${where}\n`);
+        return { ...nothing, code: EXIT_USAGE, skipped: plan.skipped };
+    }
+    // (7) The writes, in manifest order, with no rollback on a partial failure.
+    const written = [];
+    for (const spec of wanted) {
+        const value = values[spec.name];
+        if (value === undefined)
+            continue;
+        const stored = destination.write(spec.name, value);
+        if (!stored.ok) {
+            streams.err(`${renderRefusal(style(), stored.code, stored.message)}\n`);
+            streams.err(written.length === 0
+                ? `  nothing was written to ${where}\n`
+                : `  ${String(written.length)} value(s) had already landed in ${where}: ${written.join(", ")}. They are NOT rolled back — undoing a write this verb did not understand would be a destructive act taken on its own authority — so re-run this verb, or remove them by hand\n`);
+            return { code: stored.exitCode, written, skipped: plan.skipped, verified: "not-attempted" };
+        }
+        written.push(spec.name);
+    }
+    // (8) The proof, against the far end, over what was just stored.
+    let verified = "not-attempted";
+    let verifyCode = EXIT_OK;
+    if (hooks.verify !== undefined) {
+        const outcome = await hooks.verify(values, { written, skipped: plan.skipped });
+        if (outcome.declined === true) {
+            verified = "declined";
+            streams.out(outcome.detail);
+        }
+        else if (outcome.ok) {
+            verified = "passed";
+            streams.out(outcome.detail);
+        }
+        else {
+            verified = "failed";
+            verifyCode = EXIT_INTEGRITY;
+            streams.err(outcome.detail);
+        }
+    }
+    // (9) The report. Names, counts, and a path; never a value.
+    streams.out(`\nstored ${String(written.length)} value(s) in ${where}: ${written.join(", ")}\n`);
+    reportLeftAlone(streams, where, plan.skipped, phrases);
+    if (labels.nextSteps !== undefined && labels.nextSteps.length > 0) {
+        streams.out("\n");
+        for (const line of labels.nextSteps)
+            streams.out(`${line}\n`);
+    }
+    return { code: verifyCode, written, skipped: plan.skipped, verified };
+}
+//# sourceMappingURL=setup-flow.js.map

package/dist/src/cli/setup-flow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"setup-flow.js","sourceRoot":"","sources":["../../../src/cli/setup-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AAGH,OAAO,EACL,cAAc,EACd,WAAW,EACX,oBAAoB,GAErB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,eAAe,EACf,aAAa,EACb,WAAW,GAEZ,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAE/E,OAAO,EAAE,QAAQ,EAAqC,MAAM,aAAa,CAAC;AAC1E,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAmC7D,8EAA8E;AAC9E,SAAS,SAAS,CAAC,OAAqB;IACtC,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EACN,OAAO,CAAC,IAAI,KAAK,UAAU,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB;YAClE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,cAAc;KACrB,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,OAAO,CAAC,OAAuB;IACtC,OAAO;QACL,IAAI,EAAE,OAAO,CAAC,IAAI;QAClB,OAAO,EAAE,OAAO,CAAC,OAAO;QACxB,QAAQ,EACN,OAAO,CAAC,IAAI,KAAK,aAAa,IAAI,OAAO,CAAC,IAAI,KAAK,eAAe;YAChE,CAAC,CAAC,OAAO;YACT,CAAC,CAAC,cAAc;KACrB,CAAC;AACJ,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,gBAAgB,CAAC,SAAiB,EAAE,UAAkB;IACpE,OAAO;QACL,IAAI,EAAE,OAAO;QACb,KAAK,EAAE,GAAG,EAAE,CAAC,SAAS;QACtB,OAAO;YACL,IAAI,CAAC,WAAW,CAAC,SAAS,CAAC;gBAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,EAAU,EAAE,CAAC;YAC3E,MAAM,MAAM,GAAG,eAAe,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;YACtD,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC;QACpD,CAAC;QACD,KAAK,CAAC,IAAY,EAAE,KAAa;YAC/B,MAAM,MAAM,GAAG,aAAa,CAAC,SAAS,EAAE,UAAU,EAAE,IAAI,EAAE,KAAK,CAAC,CAAC;YACjE,IAAI,CAAC,MAAM,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,SAAS,CAAC,MAAM,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;GAWG;AACH,MAAM,UAAU,kBAAkB,CAAC,OAAe;IAChD,OAAO;QACL,IAAI,EAAE,UAAU;QAChB,KAAK,EAAE,GAAG,EAAE,CAAC,OAAO;QACpB,OAAO;YACL,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;YAClC,IAAI,CAAC,IAAI,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;YACrD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC;QAC9E,CAAC;QACD,KAAK,CAAC,IAAY,EAAE,KAAa;YAC/B,MAAM,OAAO,GAAG,oBAAoB,CAAC,OAAO,EAAE,CAAC,EAAE,GAAG,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;YACtE,IAAI,CAAC,OAAO,CAAC,EAAE;gBAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,GAAG,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3D,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;QACtB,CAAC;KACF,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,OAAO,EAAE,cAAc,EAAE,CAAC;AAgB1B;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,YAAY,GAAiD;IACxE,UAAU,EAAE;QACV,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACvB,GAAG,IAAI,0BAA0B,KAAK,qCAAqC;QAC7E,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,eAAe,IAAI,QAAQ;QAC9C,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAC1B,iBAAiB,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,sBAAsB,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,eAAe;KACvH;IACD,KAAK,EAAE;QACL,OAAO,EAAE,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CACvB,GAAG,IAAI,kBAAkB,KAAK,qCAAqC;QACrE,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,WAAW,IAAI,GAAG;QACrC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAC1B,iBAAiB,KAAK,KAAK,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,uBAAuB,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,OAAO,eAAe;KACxH;CACF,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,UAAU,UAAU,CACxB,OAAgB,EAChB,QAAkB,EAClB,OAA4B,EAC5B,KAAa,EACb,KAAwB,EACxB,OAAoB;IAEpB,MAAM,KAAK,GAAa,EAAE,CAAC;IAC3B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACjB,SAAS;QACX,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC,CAAC;QAC1C,IAAI,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAAE,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;;YACzD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC;AAC5B,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,eAAe,CAC7B,OAAgB,EAChB,KAAa,EACb,OAA0B,EAC1B,OAAoB;IAEpB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO;IACjC,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC,GAAG,OAAO,CAAC,EAAE,KAAK,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,8EAA8E;AAC9E,4BAA4B;AAC5B,8EAA8E;AAE9E;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,OAAO,CACrB,OAAgB,EAChB,QAAkB,EAClB,OAOC;IAED,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAC7B,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE;QACpC,MAAM,MAAM,GAAG,KAAK,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,KAAK,MAAM,CAAC,KAAK,GAAG,CAAC,CAAC,KAAK,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,MAAM,IAAI,CAAC,CAAC;IAC3E,CAAC,CAAC,CAAC;IAEH,MAAM,KAAK,GAAG,KAAK,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,MAAM,CAAC,EAAE,CAAC;IAClD,MAAM,MAAM,GAAG,QAAQ,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC,MAAM,EAAoB,EAAE;QACtF,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,IAAI,OAAO,CAAC,YAAY,KAAK,IAAI,EAAE,CAAC;YACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAM,EAAE,CAAC;QACvE,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,CAAC,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;QACzC,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,GAAG,CAAC,IAAI,KAAK,GAAG,OAAO,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC1E,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,kBAAkB,KAAK,EAAE,EAAE,CAAC;QAClF,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,KAAK,CAAC,KAAK,GAAG,CAAC,CAAM,EAAE,CAAC;IAC5D,CAAC,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,OAAO;YACL,EAAE,EAAE,KAAK;YACT,OAAO,EACL,MAAM,CAAC,MAAM,KAAK,SAAS;gBACzB,CAAC,CAAC,2BAA2B,KAAK,EAAE;gBACpC,CAAC,CAAC,gBAAgB,KAAK,UAAU,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,WAAW;SACxE,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,KAAK,EAAE,CAAC;AAC1C,CAAC;AAmHD,8EAA8E;AAC9E,aAAa;AACb,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,MAAM,2BAA2B,GAAG,+BAA+B,CAAC;AAQpE,iEAAiE;AACjE,SAAS,cAAc,CACrB,OAAgB,EAChB,QAAkB,EAClB,IAAoB;IAEpB,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,IAAI,GAAG,QAAQ,CAAC,UAAU,CAAC,GAAG,IAAI,CAAC,KAAK,iBAAiB,CAAC,CAAC;QACjE,IAAI,CAAC,IAAI,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,iBAAiB,IAAI,CAAC,IAAI,cAAc,EAAE,CAAC;QAC1F,IAAI,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;QACvB,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,OAAO,IAAI,CAAC,QAAQ;gBAClB,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,sCAAsC,EAAE;gBAChF,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC;QACvB,CAAC;QACD,oEAAoE;QACpE,0EAA0E;QAC1E,qEAAqE;QACrE,OAAO,CAAC,GAAG,CAAC,cAAc,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;QACjE,2EAA2E;QAC3E,yEAAyE;QACzE,uEAAuE;QACvE,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC;YACpC,OAAO,CAAC,GAAG,CACT,aAAa,MAAM,CAAC,KAAK,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,8CAA8C,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAClI,CAAC;YACF,KAAK,GAAG,OAAO,CAAC;QAClB,CAAC;QACD,IAAI,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC5C,qEAAqE;YACrE,sEAAsE;YACtE,oEAAoE;YACpE,6DAA6D;YAC7D,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAC5B,yJAAyJ,EACzJ,KAAK,CACN,CAAC;YACF,IAAI,KAAK,EAAE,CAAC;gBACV,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,aAAa,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC;YAClE,CAAC;QACH,CAAC;QACD,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;IAClC,CAAC;IAED,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QAC3B,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC;QACnC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACzB,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,mCAAmC,EAAE,CAAC;QACrF,CAAC;QACD,MAAM,YAAY,GAAG,OAAO,CAAC,SAAS,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,KAAK,IAAI,CAAC,OAAO,CAAC,CAAC;QAClF,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,EAAE,QAAQ,EAAE;YACxC,OAAO,EAAE,KAAK,IAAI,CAAC,KAAK,MAAM,IAAI,CAAC,QAAQ,KAAK;YAChD,KAAK,EAAE,OAAO;YACd,KAAK,EAAE,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,CAAC,KAAK,MAAM,MAAM,CAAC,QAAQ,EAAE;YACzD,MAAM,EAAE,iBAAiB,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK;YACpD,YAAY,EAAE,YAAY,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,YAAY;SACxD,CAAC,CAAC;QACH,IAAI,CAAC,MAAM,CAAC,EAAE;YAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,IAAI,CAAC,IAAI,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC;QACrF,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;IACrD,CAAC;IAED,4EAA4E;IAC5E,8EAA8E;IAC9E,8EAA8E;IAC9E,6EAA6E;IAC7E,sCAAsC;IACtC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,KAAK,IAAI,CAAC,OAAO,GAAG,CAAC;IACtE,MAAM,KAAK,GAAG,QAAQ,CACpB,OAAO,EACP,QAAQ,EACR,GAAG,IAAI,CAAC,KAAK,GAAG,MAAM,IAAI,EAC1B,CAAC,MAAM,EAAgC,EAAE;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;QAC5B,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC;QAChE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvB,oEAAoE;YACpE,sEAAsE;YACtE,OAAO,IAAI,CAAC,QAAQ;gBAClB,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC,IAAI,mCAAmC,EAAE;gBACxE,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAChC,CAAC;QACD,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;QAChE,OAAO,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC;IACnF,CAAC,CACF,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO;YACL,IAAI,EAAE,OAAO;YACb,OAAO,EACL,KAAK,CAAC,MAAM,KAAK,SAAS;gBACxB,CAAC,CAAC,iBAAiB,IAAI,CAAC,IAAI,cAAc;gBAC1C,CAAC,CAAC,GAAG,IAAI,CAAC,IAAI,0BAA0B,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,WAAW;SAC9E,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC,KAAK,KAAK,IAAI,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;AACzF,CAAC;AAED,sDAAsD;AACtD,SAAS,QAAQ,CAAC,IAAoB;IACpC,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC5C,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC5C,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,IAAoB;IAC1D,MAAM,EAAE,OAAO,EAAE,QAAQ,EAAE,KAAK,EAAE,WAAW,EAAE,MAAM,EAAE,GAAG,IAAI,CAAC;IAC/D,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,EAAE,CAAC;IAC/B,MAAM,KAAK,GAAG,WAAW,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,YAAY,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,OAAO,GAAe;QAC1B,IAAI,EAAE,OAAO;QACb,OAAO,EAAE,EAAE;QACX,OAAO,EAAE,EAAE;QACX,QAAQ,EAAE,eAAe;KAC1B,CAAC;IAEF,mDAAmD;IACnD,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,KAAK,IAAI,CAAC,CAAC;IACjC,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS;QAAE,OAAO,CAAC,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC;IAEnE,mDAAmD;IACnD,OAAO,CAAC,GAAG,CAAC,qBAAqB,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,+BAA+B,KAAK,KAAK,CAAC,CAAC;IAChG,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,OAAO,CAAC,GAAG,CACT,KAAK,IAAI,CAAC,IAAI,KAAK,QAAQ,CAAC,IAAI,CAAC,GAAG,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,OAAO,IAAI,CAAC,QAAQ,IAAI,CAC9F,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAElB,6EAA6E;IAC7E,4EAA4E;IAC5E,wCAAwC;IACxC,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,EAAE,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QAC1E,OAAO,CAAC,GAAG,CAAC,sDAAsD,KAAK,IAAI,CAAC,CAAC;QAC7E,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,OAAO,CAAC,QAAQ,EAAE,CAAC;IAChD,CAAC;IAED,wDAAwD;IACxD,MAAM,IAAI,GAAG,UAAU,CACrB,OAAO,EACP,QAAQ,EACR,OAAO,CAAC,KAAK,EACb,KAAK,EACL,KAAK,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAC9B,OAAO,CACR,CAAC;IACF,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACtE,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,2CAA2C,KAAK,IAAI,CAAC,CAAC;QAClE,OAAO,EAAE,GAAG,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IAC/C,CAAC;IAED,wEAAwE;IACxE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,IAAI,SAAS,GACX,KAAK,CAAC,OAAO,KAAK,SAAS;YACzB,CAAC,CAAC,cAAc,CAAC,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC;YACzC,CAAC,CAAC,MAAM,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAExC,sEAAsE;QACtE,wEAAwE;QACxE,wEAAwE;QACxE,oDAAoD;QACpD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,IAAI,KAAK,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC9D,SAAS,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QACjD,CAAC;QAED,IAAI,SAAS,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;YACjC,uEAAuE;YACvE,oDAAoD;YACpD,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,SAAS,CAAC,IAAI,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACrE,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,OAAO,CAAC,GAAG,CAAC,aAAa,SAAS,CAAC,OAAO,4BAA4B,KAAK,IAAI,CAAC,CAAC;YACjF,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACjE,CAAC;QACD,IAAI,SAAS,CAAC,IAAI,KAAK,MAAM,EAAE,CAAC;YAC9B,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO,CAAC,GAAG,CACT,aAAa,IAAI,CAAC,IAAI,+DAA+D,KAAK,IAAI,CAC/F,CAAC;gBACF,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;YACjE,CAAC;YACD,SAAS;QACX,CAAC;QAED,MAAM,OAAO,GAAG,IAAI,CAAC,QAAQ,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,EAAE,IAAa,EAAE,CAAC;QAC1E,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;YAChB,yEAAyE;YACzE,wEAAwE;YACxE,8DAA8D;YAC9D,yEAAyE;YACzE,yEAAyE;YACzE,2CAA2C;YAC3C,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,CAAC,IAAI,KAAK,OAAO,CAAC,OAAO,4BAA4B,KAAK,IAAI,CAAC,CAAC;YAC7F,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;QACjE,CAAC;QACD,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC,KAAK,CAAC;IACtC,CAAC;IAED,uDAAuD;IACvD,MAAM,UAAU,GAAG,KAAK,CAAC,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,CAAC;IAC/D,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,CAAC,GAAG,CAAC,aAAa,UAAU,4BAA4B,KAAK,IAAI,CAAC,CAAC;QAC1E,OAAO,EAAE,GAAG,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;IACjE,CAAC;IAED,4EAA4E;IAC5E,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,MAAM,EAAE,CAAC;QAC1B,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;QACnD,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;YACf,OAAO,CAAC,GAAG,CAAC,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YACxE,OAAO,CAAC,GAAG,CACT,OAAO,CAAC,MAAM,KAAK,CAAC;gBAClB,CAAC,CAAC,4BAA4B,KAAK,IAAI;gBACvC,CAAC,CAAC,KAAK,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,mCAAmC,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,iLAAiL,CAChR,CAAC;YACF,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,eAAe,EAAE,CAAC;QAC9F,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC1B,CAAC;IAED,iEAAiE;IACjE,IAAI,QAAQ,GAA2B,eAAe,CAAC;IACvD,IAAI,UAAU,GAAG,OAAO,CAAC;IACzB,IAAI,KAAK,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC/B,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,CAAC;QAC/E,IAAI,OAAO,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;YAC9B,QAAQ,GAAG,UAAU,CAAC;YACtB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,IAAI,OAAO,CAAC,EAAE,EAAE,CAAC;YACtB,QAAQ,GAAG,QAAQ,CAAC;YACpB,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;aAAM,CAAC;YACN,QAAQ,GAAG,QAAQ,CAAC;YACpB,UAAU,GAAG,cAAc,CAAC;YAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC9B,CAAC;IACH,CAAC;IAED,4DAA4D;IAC5D,OAAO,CAAC,GAAG,CACT,YAAY,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,gBAAgB,KAAK,KAAK,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CACnF,CAAC;IACF,eAAe,CAAC,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACvD,IAAI,MAAM,CAAC,SAAS,KAAK,SAAS,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAClE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;QAClB,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,SAAS;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,CAAC;IAChE,CAAC;IAED,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,QAAQ,EAAE,CAAC;AACxE,CAAC"}

package/dist/src/cli/setup-service.d.ts

@@ -0,0 +1,96 @@
+/**
+ * `approval setup service` — the login service that runs the ambient runtime
+ * (SPEC.md §10.2, APRV-110).
+ *
+ * `approval up` is a foreground process. This verb writes the one file that
+ * makes it start at login and stay started: a launchd user agent on macOS, or a
+ * systemd user unit on Linux. It is the fifth member of the `setup` family and
+ * it obeys the family's rules — interactive by refusal, human-only, appending
+ * nothing to the log, editing no policy — with two of its own.
+ *
+ * ## It never copies a value
+ *
+ * A unit file is world-readable configuration that survives reboots and gets
+ * backed up. A bot token in one is a bot token in a backup. So the unit NAMES
+ * where the environment comes from and never carries it:
+ *
+ * - by default it runs a WRAPPER the human reads in the printed unit —
+ *   `eval "$(approval env)"` and then `exec approval up` — so the keystore
+ *   references stay in the keystore and `approval env` stays the only thing
+ *   that resolves them (SPEC.md §11.1 invariant 7: nothing loads that file
+ *   implicitly, and here it is a human's line in a file they approved);
+ * - or, with `--env-file`, it points at a file THE OPERATOR AUTHORED, which
+ *   this verb neither writes nor reads.
+ *
+ * ## It prints the unit before it writes it, and it does not arm it
+ *
+ * The whole file goes to stdout first, and nothing is written until the operator
+ * confirms. Loading it is a separate act: this verb prints the exact
+ * `launchctl` or `systemctl` line and stops there. A login service is a standing
+ * capability on someone's machine — it will start a process that holds a
+ * credential and can put prompts on a phone — and a wizard that armed one as a
+ * side effect of writing a file would be making that decision on the operator's
+ * behalf. Printing the command costs one paste and buys an explicit act.
+ *
+ * ## Logs never go into `.approval/`
+ *
+ * The service's stdout and stderr go where the operator chooses, defaulting to
+ * the platform's own log home. A path inside the approval home is REFUSED:
+ * `.approval/` holds the log, the queue projection, the payload store, the
+ * vault and the environment source map, and a service that appended its console
+ * output beside them would put unverifiable text in the one directory whose
+ * contents are supposed to mean something.
+ */
+import type { Streams } from "./main.js";
+import { type SetupDeps } from "./setup-common.js";
+/** The two service managers this verb writes for. */
+export type ServicePlatform = "launchd" | "systemd";
+/** The conventional names. `--label` overrides both. */
+export declare const LAUNCHD_LABEL = "md.approval.up";
+export declare const SYSTEMD_UNIT = "approval-up";
+/** Which manager this machine has, or `null` when it has neither. */
+export declare function platformFor(platform: NodeJS.Platform): ServicePlatform | null;
+/** Where the unit file belongs, for a platform and a label. */
+export declare function unitPathFor(platform: ServicePlatform, label: string, home: string): string;
+/** Where the platform keeps a user's own logs. */
+export declare function defaultLogsDir(platform: ServicePlatform, home: string): string;
+/** The command that arms the written unit, printed and never run. */
+export declare function armCommand(platform: ServicePlatform, label: string, path: string): string;
+/**
+ * The command that disarms it, printed before the file is removed.
+ *
+ * Takes no path, unlike {@link armCommand}: launchd boots a service OUT by its
+ * label, and the plist it was booted in from may already be gone.
+ */
+export declare function disarmCommand(platform: ServicePlatform, label: string): string;
+/** Everything a unit is generated from, all of it already resolved. */
+export interface ServicePlan {
+    platform: ServicePlatform;
+    label: string;
+    /** The unit file this would be written to. */
+    path: string;
+    /** The primary checkout the runtime is started in. */
+    workingDir: string;
+    /** The `approval` invocation, as argv words. */
+    exec: string[];
+    /** An operator-authored EnvironmentFile, or `null` for the `approval env` wrapper. */
+    envFile: string | null;
+    outLog: string;
+    errLog: string;
+    /** The variable NAMES the runtime will look for. Printed as a comment only. */
+    variables: string[];
+}
+/** One `sh -lc` script: the wrapper the operator reads inside the unit. */
+export declare function wrapperScript(plan: ServicePlan): string;
+/** The whole unit file, as the operator will read it and as it will be written. */
+export declare function renderUnit(plan: ServicePlan): string;
+/**
+ * The approval invocation this process was started as.
+ *
+ * `node dist/src/cli/main.js` and the installed `approval` bin are both
+ * legitimate, and a unit that named the wrong one would fail at login rather
+ * than here. `--exec` overrides for the case neither guess fits.
+ */
+export declare function execWords(override: string | null, argv: readonly string[]): string[];
+/** `approval setup service` — write the login unit. HUMAN-ONLY, INTERACTIVE. */
+export declare function commandSetupService(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): number;