approval-md 0.1.0 → 0.2.0

package/dist/src/cli/sandbox.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `approval sandbox` — run a command with no way out to the network (APRV-193).
+ *
+ * ## Why a verb, when `approval run` already sandboxes
+ *
+ * `approval run` covers the actions the gate SEES: it holds a grant or it does
+ * not, it appends `execution.started`, and since APRV-193 it puts an ungranted
+ * child in a room with no doors. It does not cover the commands the harness
+ * runs on its own — `npm test`, `node scripts/whatever.mjs` — which the hook
+ * classifies `files.write.workspace`, allows, and then never touches again,
+ * because the hook DECIDES and the harness EXECUTES. Those are the commands that
+ * run code an agent wrote a minute ago, and they are the whole of the
+ * laundering hole this task exists to close.
+ *
+ * The hook cannot close it: a `PreToolUse` verdict is allow or deny, and it
+ * cannot rewrite the command into a wrapper. So the wrapper is a verb the
+ * command is written with, `approval sandbox -- npm test`, and two things make
+ * that more than a convention an agent could simply not type:
+ *
+ * 1. `core/command-class.ts` classifies the wrapper as its INNER argv, so
+ *    running something safely is no longer punished with `hook-unclassified`
+ *    (before this task, `sandbox-exec …` was denied while the bare command was
+ *    allowed — the hook actively penalised the safe spelling), and the wrapper
+ *    cannot launder anything either, because the class the hook resolves is the
+ *    inner command's own.
+ * 2. `APPROVAL_HOOK_REQUIRE_SANDBOX=1` makes the hook DENY an allowed-class
+ *    exec that is not written this way, with a message naming the spelling that
+ *    works. It is off by default and turning it on can only ever refuse more,
+ *    which is why an environment variable is an acceptable home for it.
+ *
+ * ## What it does
+ *
+ * Builds the profile (`core/sandbox.ts`), scrubs the credential-bearing
+ * variables out of the child's environment (`core/child-env.ts`, APRV-205),
+ * spawns, and exits with the child's own exit code. It appends NOTHING: this
+ * verb removes a capability, it does not authorize anything, and a log entry
+ * per `npm test` would be the transparency log inheriting a database's problem
+ * (SPEC.md §2, and the reason gate-routed editing was rejected on this task).
+ *
+ * ## What it fails at, stated plainly
+ *
+ * An agent HARNESS cannot run under this. `claude` and `cursor-agent` talk to a
+ * model over the network, and this verb denies exactly that, so
+ * `approval sandbox -- claude` is a session that cannot think. Sandboxing a
+ * whole session needs an egress allowlist reaching one host, which Seatbelt
+ * cannot express by hostname and which the prior art (Claude Code's own sandbox
+ * mode) solves with a local proxy. That is a follow-up, and until it exists the
+ * unit this verb protects is the COMMAND rather than the session.
+ */
+import type { Streams } from "./main.js";
+export declare function commandSandbox(argv: string[], streams: Streams, cwd: string): number;

package/dist/src/cli/scaffold.d.ts

@@ -0,0 +1,79 @@
+/**
+ * The bytes `approval init` scaffolds, and the one-line rationale for each.
+ *
+ * These constants live apart from both `init.ts` and `help.ts` because both
+ * need them: the verb writes them and the help text quotes them, and a help text
+ * that quoted a stale copy would be the second-worst kind of documentation — the
+ * confident kind. One definition, two readers, no cycle.
+ */
+/**
+ * SPEC.md §5.1's canonical example, byte for byte.
+ *
+ * This constant and `schema/fixtures/policy-md/valid/canonical.md` are the same
+ * bytes, and `tests/cli-init.test.ts` asserts it: the fixture is frozen (every
+ * policy-loading test descends from it) and the spec section it transcribes is
+ * what a reader compares the scaffolded file against. A copy that drifted from
+ * either would hand a new user a policy the documentation does not describe.
+ *
+ * It is embedded here rather than read from `schema/` because the published
+ * package ships the CLI and the spec, not the test fixtures, and a scaffolding
+ * verb that fails on an installed copy is a verb that only ever worked in this
+ * checkout.
+ *
+ * The closing sentence is not in SPEC.md §5.1's fence — it is the fixture's own
+ * trailing prose, kept because it says the one thing a first-time reader of this
+ * file needs to know: the prose is not the policy.
+ */
+export declare const CANONICAL_POLICY = "# Approval Policy\n\nAgents working in this project handle my life admin. Anything that leaves\nthe machine gets declared, and the classes below say what I sign off on.\n\n```yaml approval-policy\nversion: \"0.1\"\n\ndefaults:\n  autonomy: manual          # unknown/undeclared classes require sign-off\n  channel: telegram\n  approval_ttl: 24h         # pending requests expire\n  on_expiry: reject\n\napprovers:\n  alice:\n    channels: [telegram, cli]\n\nclasses:\n  read.*:                       { autonomy: autonomous }\n  files.write.workspace:        { autonomy: autonomous }\n  calendar.write.own:           { autonomy: supervised }\n  communicate.email.draft:      { autonomy: autonomous }\n  communicate.email.external:\n    autonomy: manual\n    approvers: [alice]\n  financial.spend:\n    autonomy: manual\n    approvers: [alice]\n    limits: { per_action_usd: 25, daily_usd: 100 }\n  public.post:                  { autonomy: manual }\n  data.delete:                  { autonomy: manual }\n  account.auth:                 { autonomy: manual }\n\nbudgets:\n  global: { daily_usd: 100, daily_actions: 200 }\n\naudit:\n  supervised_sample_rate: 0.10   # fraction of supervised actions escalated\n                                 # for retrospective human review\n\nchannels:\n  telegram:\n    chat_id_env: APPROVAL_TG_CHAT\n    token_env: APPROVAL_TG_TOKEN\n  web:\n    port: 4680\n```\n\nEverything after the block is prose again and is ignored by the parser.\n";
+/**
+ * The comment the merged `.gitignore` lines live under.
+ *
+ * A marker rather than a bare append, so a second `init` can tell its own lines
+ * from the operator's and add only what is missing, and so a human reading the
+ * file knows which lines they are allowed to delete.
+ */
+export declare const GITIGNORE_MARKER = "# approval.md";
+/**
+ * The ignore lines, and why each one is there.
+ *
+ * - `.approval/*.sqlite` — the index is a projection (SPEC.md §9.2). It rebuilds
+ *   from the log with `approval reindex`; committing it would put a cache in the
+ *   history of the thing it caches.
+ * - `.approval/vault.enc` — the encrypted credential store (M7). Encrypted or
+ *   not, the vault is the one file in the layout whose contents are secrets, and
+ *   secrets do not go in a repository.
+ * - `.approval/env` — the environment source map (APRV-73). Usually it holds
+ *   only keychain service names, and it is ignored anyway: the format permits a
+ *   plaintext literal, an operator will eventually paste one in, and the day
+ *   they do must not be the day a bot token lands in a commit. Ignoring it also
+ *   states the intent — the environment is per-machine, not per-repository.
+ * - `.approval/keys/` — the per-request X25519 private keys of sealed token
+ *   delivery (APRV-105). Per-machine by construction: the whole design is that
+ *   the log, which IS shared, carries only ciphertext, and a key committed to a
+ *   shared history would hand every reader of that history the ability to open
+ *   an unspent token inside its TTL. Written whether or not a policy has opted
+ *   into `token_delivery: sealed`, because the line an operator needs is the one
+ *   that is already there on the day they turn the knob.
+ * - `.approval/**\/*.tmp-*` — the atomic-write temp files. Both writers that
+ *   rename into place (`channels/render-queue.ts`, `core/payload-store.ts`) name
+ *   their temp `.<basename>.tmp-<pid>-<counter>`, so this pattern is written to
+ *   match what those two actually produce, at both levels of the tree. A crashed
+ *   write leaves one behind; nobody should be asked to review it.
+ *
+ * - `.approval-journal/` — the ungated free-text channel of `approval journal`
+ *   (APRV-195). Ignored rather than tracked because it is not truth and not
+ *   evidence: the log is the record of what happened and it is committed, while
+ *   the journal is what an agent said about working here, which the operator
+ *   reads locally. Committing it would also turn an outlet into a publication,
+ *   and an agent writing for a public repository is an agent writing for an
+ *   audience — the pressure this channel exists to be free of. An operator who
+ *   wants the history keeps it by deleting the line.
+ *
+ * `.approval/log/` is deliberately absent: the log is the truth and belongs in
+ * the history. So is `.approval/payloads/`, which holds the bytes each approval
+ * bound to — evidence defaults to tracked, and the next steps `init` prints say
+ * so, along with the one line that reverses the choice.
+ */
+export declare const GITIGNORE_ENTRIES: readonly string[];
+/** The same entries, indented for the help text so the two cannot disagree. */
+export declare const GITIGNORE_ENTRY_LINES: string;

package/dist/src/cli/setup-adapter.d.ts

@@ -0,0 +1,137 @@
+/**
+ * `approval setup adapter <name>` — fill the vault for one adapter (APRV-78).
+ *
+ * SPEC.md §10.4 gives adapters an encrypted vault and `approval vault set` as
+ * the way in, and that verb is deliberately austere: one credential, one call,
+ * no prompt, the value from stdin or a named variable. It is the right shape
+ * for a script and the wrong shape for a person, who has to know that the email
+ * adapter wants five values, what each of them is called, which of them are
+ * secrets, that the port must be a port and the security setting one of three
+ * words, and that the user and the password are both-or-neither. All of that
+ * was written down only inside `adapters/email.ts`'s `act`, where nobody
+ * setting a machine up can read it.
+ *
+ * This verb reads the adapter's own manifest instead. The conversation is
+ * `cli/setup-flow.ts` and knows nothing about SMTP; the manifest is
+ * `EMAIL_CREDENTIAL_SPECS` and knows nothing about vaults or terminals; this
+ * file is the ten lines that join them, plus the two things that are genuinely
+ * about the pairing: what to do with the passphrase, and how to prove the
+ * result without sending anything.
+ *
+ * ## Where the values go, and where they do NOT
+ *
+ * **Into the vault, always.** Not the OS keystore, which is where `setup
+ * vault|sampling|channel <name>` put their secrets, and not `.approval/env`. The
+ * distinction is the one §10.4 draws: `.approval/env` holds what unlocks the
+ * machine (the human identity, the passphrase's source, the channel's token),
+ * and the vault holds what a gated adapter SPENDS inside a verified-token
+ * window. An SMTP password in `.approval/env` would be readable by
+ * `approval env` on demand, which is exactly the journey the vault exists to
+ * forbid.
+ *
+ * ## The passphrase is read, never established
+ *
+ * From the shell environment, under the name the policy declares, through
+ * {@link passphraseFrom} — and from nowhere else. **This verb never resolves
+ * `.approval/env` itself** (SPEC.md §11.1 invariant 7: no command loads that
+ * file implicitly, because a working-tree file any process read on its own
+ * would let anything able to write it act as you). It does READ the file, for
+ * one thing only: whether a line for the passphrase variable exists, which
+ * decides whether the refusal tells you to run `approval setup vault` or just
+ * to `eval "$(approval env)"`. A key's PRESENCE is not its value, and
+ * `planReplacements` has always read the file for exactly that.
+ *
+ * ## Verification sends nothing
+ *
+ * The proof is {@link probeSmtp}: the same session `sendMail` runs, up to and
+ * including AUTH, and then QUIT. It proves the host resolves, the port answers,
+ * the TLS mode is the one the server offers, and the credential is accepted. It
+ * does not prove a message would be delivered, and it puts no message on the
+ * wire — a setup verb that emailed somebody to prove itself would be a verb
+ * people run once and then avoid, which is `approval doctor`'s argument for
+ * calling `getMe` and nothing else.
+ *
+ * It is OFFERED, defaulting to YES, and a failure does not delete anything: the
+ * values stay, the refusal names the SMTP code and the server's first line
+ * (redacted), and the undo is printed as `approval vault remove <name>`. Values
+ * discarded by a wizard because a laptop was on a captive portal would be five
+ * more things to type.
+ *
+ * A PARTIAL RE-RUN is offered the same proof over the STORED set (APRV-99). It
+ * holds only what it just collected, so it reads the rest through
+ * {@link readEmailSmtpConfig} over a {@link vaultCredentialProvider}: the exact
+ * path `approval adapter email` takes at send time, in this process, printed by
+ * nothing. That is not a hole in "there is no verb that reads a credential
+ * out" — that rule is about what reaches a terminal, and nothing here does.
+ * Rotating an app password is the common case for this verb, and a probe no
+ * wider than the send it proves is the difference between a rotation you have
+ * checked and one you find out about from a bounce.
+ */
+import type { CredentialSpec } from "../core/credential-spec.js";
+import type { CredentialProvider } from "../adapters/contract.js";
+import { probeSmtp } from "../adapters/smtp.js";
+import type { Streams } from "./main.js";
+import { type Prompter } from "./prompt.js";
+import { type HintContext, type SetupDeps } from "./setup-common.js";
+import { type VerifyOutcome } from "./setup-flow.js";
+/** What a verify hook is handed beyond the values: what the run actually did. */
+export interface VerifyContext {
+    written: readonly string[];
+    skipped: readonly string[];
+    streams: Streams;
+    prompter: Prompter;
+    probe: typeof probeSmtp;
+    /**
+     * The API root the AgentMail probe reads (APRV-223), or `undefined` for the
+     * public one. Threaded from `SetupDeps.apiBase`, which is how every other
+     * setup verb points a probe at a loopback fixture; there is no relaxation
+     * here to keep inside a test, because the probe is one HTTPS GET.
+     */
+    apiBase?: string | undefined;
+    /**
+     * The adapter's own credential provider, over the vault this run just wrote
+     * to (APRV-99). Lazy: a first run never opens it, because a first run holds
+     * everything already. A partial re-run opens it to probe the MERGED set, and
+     * that read is the one the adapter performs at send time, in this process,
+     * printed by nothing.
+     */
+    credentials: CredentialProvider;
+}
+/** One adapter, as this verb needs to see it. */
+export interface AdapterSetupEntry {
+    /** The manifest, declared by the adapter itself. */
+    specs: readonly CredentialSpec[];
+    /**
+     * The adapter's cross-field rule, or `undefined` when it has none. `kept`
+     * names the values already in the store that this run left alone (APRV-98):
+     * the flow never reads a value back, but presence is a fact it does know.
+     */
+    check?(values: Record<string, string>, kept: readonly string[]): string | null;
+    /** One line of what this adapter is, for the title. */
+    summary: string;
+    /**
+     * This adapter's own help, printed for `--help` and beside every usage error
+     * from here down (APRV-221). On the entry rather than in a `name === "email"`
+     * branch: an adapter's help is the adapter's, and a branch is a place for the
+     * next adapter's help to be forgotten.
+     */
+    help: string;
+    /** The non-interactive path: the exact `vault set` calls, generated. */
+    hint(context: HintContext): string;
+    /** Prove the stored configuration against the far end, sending nothing. */
+    verify(values: Record<string, string>, context: VerifyContext): Promise<VerifyOutcome>;
+    /** What to tell the operator to do next. */
+    nextSteps: readonly string[];
+}
+/** Every adapter this verb can configure. Keyed by the `adapter <name>` name. */
+export declare const ADAPTER_SETUPS: Record<string, AdapterSetupEntry>;
+/** The known names, sorted, for a usage error and for the help text. */
+export declare function knownAdapterNames(): string[];
+/**
+ * `approval setup adapter <name>` — the interactive writer for one adapter's
+ * credentials. HUMAN-ONLY.
+ *
+ * `argv` starts at the adapter's name: `commandSetup` has already eaten
+ * `adapter`.
+ */
+export declare function commandSetupAdapter(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): Promise<number>;

package/dist/src/cli/setup-adapter.js

@@ -71,10 +71,11 @@ import { envFilePathFor, readEnvFile } from "../core/env-file.js";
 import { passphraseEnvFor, passphraseFrom, vaultExists, vaultPathFor } from "../core/vault.js";
 import { DEFAULT_CREDENTIAL_NAMES, EMAIL_CREDENTIAL_SPECS, checkEmailCredentialSet, readEmailSmtpConfig, } from "../adapters/email.js";
 import { AGENTMAIL_CREDENTIAL_SPECS, AGENTMAIL_SEND_PERMISSIONS, DEFAULT_AGENTMAIL_CREDENTIAL_NAMES, probeAgentmail, readAgentmailConfig, } from "../adapters/agentmail.js";
+import { probeZzz, ZZZ_CREDENTIAL_SPECS, ZZZ_TOKEN_NAME, } from "../adapters/zzz.js";
 import { vaultCredentialProvider } from "../adapters/vault-provider.js";
 import { isSmtpSecurity, probeSmtp } from "../adapters/smtp.js";
 import { EXIT_OK } from "./exit-codes.js";
-import { SETUP_ADAPTER_AGENTMAIL_HELP, SETUP_ADAPTER_EMAIL_HELP, SETUP_ADAPTER_HELP, } from "./help.js";
+import { SETUP_ADAPTER_AGENTMAIL_HELP, SETUP_ADAPTER_EMAIL_HELP, SETUP_ADAPTER_HELP, SETUP_ADAPTER_ZZZ_HELP, } from "./help.js";
 import { refusal as renderRefusal, style } from "./style.js";
 import { confirmUntil } from "./prompt.js";
 import { front, requireHuman, usageError, } from "./setup-common.js";
@@ -329,12 +330,30 @@ async function verifyAgentmail(values, context) {
     }
     return probeAgentmailAndReport(configured.config, redactor([...Object.values(values), ...configured.secrets]), probe, context.apiBase, context.written);
 }
+async function verifyZzz(values, context) {
+    if (!confirmUntil(context.streams, context.prompter, "ask zzz.bot to authenticate the stored token with one read-only room-list request? Nothing is posted", true)) {
+        return { ok: true, declined: true, detail: "\nstored and unverified: no request was made.\n" };
+    }
+    const current = values[ZZZ_TOKEN_NAME] === undefined
+        ? context.credentials.get(ZZZ_TOKEN_NAME)
+        : { ok: true, value: values[ZZZ_TOKEN_NAME] };
+    if (!current.ok)
+        return { ok: false, detail: `${renderRefusal(style(), current.code, current.message)}\n` };
+    const result = await probeZzz(current.value, context.apiBase === undefined ? {} : { origins: { production: context.apiBase } });
+    if (result.ok) {
+        return {
+            ok: true,
+            detail: "\nverified: zzz.bot accepted the token on one read-only room-list request. No message was posted. This does not prove write scope, room membership, or private-room workflow evidence; those are checked by zzz.bot when the approved message is sent.\n",
+        };
+    }
+    return { ok: false, detail: `${renderRefusal(style(), result.code, result.message)}\nThe value remains stored; replace it or retry the probe after connectivity is restored.\n` };
+}
 /** Every adapter this verb can configure. Keyed by the `adapter <name>` name. */
 export const ADAPTER_SETUPS = {
     email: {
         specs: EMAIL_CREDENTIAL_SPECS,
         check: (values, kept) => checkEmailCredentialSet(values, DEFAULT_CREDENTIAL_NAMES, kept),
-        summary: "the SMTP settings `approval adapter email` reads inside the verified-token window",
+        summary: "the SMTP settings `approval adapter email` reads inside the verified execution window",
         help: SETUP_ADAPTER_EMAIL_HELP,
         hint: (context) => manifestHint(EMAIL_CREDENTIAL_SPECS, context),
         verify: verifyEmail,
@@ -343,12 +362,12 @@ export const ADAPTER_SETUPS = {
             ``,
             `  approval vault list --as human:<id>`,
             ``,
-            `The adapter reads them itself, inside the token window; nothing else does.`,
+            `The adapter reads them itself, inside the verified execution window; nothing else does.`,
         ],
     },
     agentmail: {
         specs: AGENTMAIL_CREDENTIAL_SPECS,
-        summary: "the AgentMail inbox and sending key `approval adapter agentmail` reads inside the verified-token window",
+        summary: "the AgentMail inbox and sending key `approval adapter agentmail` reads inside the verified execution window",
         help: SETUP_ADAPTER_AGENTMAIL_HELP,
         hint: (context) => manifestHint(AGENTMAIL_CREDENTIAL_SPECS, context),
         verify: verifyAgentmail,
@@ -362,6 +381,21 @@ export const ADAPTER_SETUPS = {
             `drafts, and \`approval payload agentmail-draft\` snapshots one for a human to read.`,
         ],
     },
+    zzz: {
+        specs: ZZZ_CREDENTIAL_SPECS,
+        summary: "the invited zzz.bot agent token `approval adapter zzz` reads inside the verified execution window",
+        help: SETUP_ADAPTER_ZZZ_HELP,
+        hint: (context) => manifestHint(ZZZ_CREDENTIAL_SPECS, context),
+        verify: verifyZzz,
+        nextSteps: [
+            `Check the credential name (never its value) with:`,
+            ``,
+            `  approval vault list --as human:<id>`,
+            ``,
+            `Keep this write-capable token out of the agent environment. For a private room,`,
+            `zzz.bot also requires active membership and accepted approval.md workflow evidence.`,
+        ],
+    },
 };
 /** The known names, sorted, for a usage error and for the help text. */
 export function knownAdapterNames() {

package/dist/src/cli/setup-adapter.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup-adapter.js","sourceRoot":"","sources":["../../../src/cli/setup-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAGH,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,kCAAkC,EAClC,cAAc,EACd,mBAAmB,GAEpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAqB,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,GACnB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,KAAK,EACL,YAAY,EACZ,UAAU,GAGX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAyDzB,4EAA4E;AAC5E,SAAS,eAAe,CAAC,IAAyB,EAAE,IAAY;IAC9D,OAAO,IAAI,KAAK,gBAAgB;QAC9B,CAAC,CAAC,+BAA+B,IAAI,EAAE;QACvC,CAAC,CAAC,gDAAgD,IAAI,KAAK,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,KAAgC,EAAE,OAAoB;IAC1E,MAAM,KAAK,GAAa;QACtB,4CAA4C,OAAO,CAAC,aAAa,qBAAqB;QACtF,gFAAgF;QAChF,wCAAwC;QACxC,0BAA0B;QAC1B,EAAE;QACF,2EAA2E;QAC3E,iFAAiF;KAClF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,sBAAsB,IAAI,CAAC,IAAI,gCAAgC,CAAC;QAC7E,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CACR,UAAU,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,EAC7D,OAAO,IAAI,EAAE,CACd,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC;YAC5E,KAAK,CAAC,IAAI,CAAC,QAAQ,WAAW,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,OAA0B;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAY,EAAU,EAAE;QAC9B,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,OAA0B;IAChD,OAAO,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,0PAA0P,CAAC;AAClV,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAC3B,MAAuB,EACvB,KAA+B,EAC/B,KAAuB,EACvB,IAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,qBAAqB,EAAE,IAAI;QAC3B,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,eAAe,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,QAAQ,KACxF,MAAM,CAAC,aAAa,KAAK,IAAI;gBAC3B,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,yCAAyC,MAAM,CAAC,aAAa,EACnE,kEAAkE;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,2BAA2B,IAAI,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,OAAO;QACL,EAAE,EAAE,KAAK;QACT,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,gOAAgO,KAAK,IAAI;KAC/S,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,KAAK,UAAU,YAAY,CACzB,MAA8B,EAC9B,OAAsB;IAEtB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9C,IACE,CAAC,YAAY,CACX,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,EAChB,kEAAkE,EAClE,IAAI,CACL,EACD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IACtF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,GAAG,OAAO,8BAA8B,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI;SAC9E,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CACnB,UAAU,CAAC,MAAM,EACjB,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,EAC3D,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,OAAO,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CACxB,MAA8B,EAC9B,OAAsB;IAEtB,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2CAA2C,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,QAAQ,IAAI;SACvG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAErD,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CACvB,2BAA2B,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAC9E,KAAK,CACN,EACD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,wKAAwK;SACjL,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CACnB;QACE,IAAI;QACJ,IAAI;QACJ,QAAQ,EAAE,QAAwB;QAClC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAChD,EACD,KAAK,EACL,OAAO,CAAC,KAAK,EACb,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CACzE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CACrC,CACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,SAAmC;IAC1D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,qHAAqH,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,0CAA0C,CAAC;IACjN,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,mBAAmB,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,wCAAwC,CAAC;IAC7G,CAAC;IACD,OAAO,oCAAoC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,4MAA4M,CAAC;AAC/Q,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAuB,EACvB,KAA+B,EAC/B,KAA4B,EAC5B,OAA2B,EAC3B,IAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7E,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,wCAAwC,MAAM,CAAC,OAAO,oBAAoB,MAAM,CAAC,OAAO,+DAA+D,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI;SACvM,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,2BAA2B,IAAI,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,uNAAuN,KAAK,IAAI;KACtS,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,MAA8B,EAC9B,OAAsB;IAEtB,MAAM,KAAK,GAAG,kCAAkC,CAAC;IACjD,MAAM,KAAK,GAAG,cAAc,CAAC;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9C,IACE,CAAC,YAAY,CACX,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,EAChB,iEAAiE,EACjE,IAAI,CACL,EACD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,uKAAuK;SAChL,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,uBAAuB,CAC5B,EAAE,OAAO,EAAE,MAAM,EAAE,EACnB,KAAK,EACL,KAAK,EACL,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,OAAO,CAChB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,8BAA8B,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI;SACtG,CAAC;IACJ,CAAC;IACD,OAAO,uBAAuB,CAC5B,UAAU,CAAC,MAAM,EACjB,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,EAC3D,KAAK,EACL,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,OAAO,CAChB,CAAC;AACJ,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAsC;IAC/D,KAAK,EAAE;QACL,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,EAAE,IAAI,CAAC;QACxF,OAAO,EACL,mFAAmF;QACrF,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,sBAAsB,EAAE,OAAO,CAAC;QAChE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE;YACT,0CAA0C;YAC1C,EAAE;YACF,uCAAuC;YACvC,EAAE;YACF,4EAA4E;SAC7E;KACF;IACD,SAAS,EAAE;QACT,KAAK,EAAE,0BAA0B;QACjC,OAAO,EACL,yGAAyG;QAC3G,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,0BAA0B,EAAE,OAAO,CAAC;QACpE,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE;YACT,0CAA0C;YAC1C,EAAE;YACF,uCAAuC;YACvC,EAAE;YACF,+EAA+E;YAC/E,WAAW,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,2CAA2C;YAC7F,qFAAqF;SACtF;KACF;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAe,EACf,OAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,OAAO,IAAI,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,OAAO,WAAW;QAChB,CAAC,CAAC,kGAAkG;QACpG,CAAC,CAAC,sJAAsJ,CAAC;AAC7J,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAErB,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,IAAI,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,kEAAkE,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAClG,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC5F,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;IAE5B,MAAM,OAAO,GAAG,KAAK,CACnB,WAAW,IAAI,EAAE,EACjB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EACb,OAAO,EACP,GAAG,EACH,IAAI,EACJ,QAAQ,EACR,CAAC,OAAoB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAC9C,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAwB,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,GAAG,QAAQ,oMAAoM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAC3R,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,iDAAiD;IACjD,MAAM,WAAW,GACf,IAAI,CAAC,WAAW;QAChB,uBAAuB,CACrB,EAAE,SAAS,EAAE,EACb,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAC1D,CAAC;IAEJ,MAAM,MAAM,GAAe,MAAM,iBAAiB,CAAC;QACjD,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC;QACpD,MAAM,EAAE;YACN,KAAK,EAAE,0BAA0B,IAAI,MAAM,KAAK,CAAC,OAAO,GAAG;YAC3D,MAAM,EAAE,gOAAgO;YACxO,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;QACD,KAAK,EAAE;YACL,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5D,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAC3B,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO;gBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK;gBACL,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAChE,WAAW;aACZ,CAAC;SACL;KACF,CAAC,CAAC;IAEH,2DAA2D;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}
+{"version":3,"file":"setup-adapter.js","sourceRoot":"","sources":["../../../src/cli/setup-adapter.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAoEG;AAGH,OAAO,EAAE,cAAc,EAAE,WAAW,EAAE,MAAM,qBAAqB,CAAC;AAElE,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,EACL,wBAAwB,EACxB,sBAAsB,EACtB,uBAAuB,EACvB,mBAAmB,GAEpB,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,0BAA0B,EAC1B,0BAA0B,EAC1B,kCAAkC,EAClC,cAAc,EACd,mBAAmB,GAEpB,MAAM,0BAA0B,CAAC;AAClC,OAAO,EACL,QAAQ,EACR,oBAAoB,EACpB,cAAc,GACf,MAAM,oBAAoB,CAAC;AAE5B,OAAO,EAAE,uBAAuB,EAAE,MAAM,+BAA+B,CAAC;AACxE,OAAO,EAAE,cAAc,EAAE,SAAS,EAAqB,MAAM,qBAAqB,CAAC;AACnF,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AAC1C,OAAO,EACL,4BAA4B,EAC5B,wBAAwB,EACxB,kBAAkB,EAClB,sBAAsB,GACvB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,OAAO,IAAI,aAAa,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAE7D,OAAO,EAAE,YAAY,EAAiB,MAAM,aAAa,CAAC;AAC1D,OAAO,EACL,KAAK,EACL,YAAY,EACZ,UAAU,GAGX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,gBAAgB,GAGjB,MAAM,iBAAiB,CAAC;AAyDzB,4EAA4E;AAC5E,SAAS,eAAe,CAAC,IAAyB,EAAE,IAAY;IAC9D,OAAO,IAAI,KAAK,gBAAgB;QAC9B,CAAC,CAAC,+BAA+B,IAAI,EAAE;QACvC,CAAC,CAAC,gDAAgD,IAAI,KAAK,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,YAAY,CAAC,KAAgC,EAAE,OAAoB;IAC1E,MAAM,KAAK,GAAa;QACtB,4CAA4C,OAAO,CAAC,aAAa,qBAAqB;QACtF,gFAAgF;QAChF,wCAAwC;QACxC,0BAA0B;QAC1B,EAAE;QACF,2EAA2E;QAC3E,iFAAiF;KAClF,CAAC;IACF,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,IAAI,GAAG,sBAAsB,IAAI,CAAC,IAAI,gCAAgC,CAAC;QAC7E,IAAI,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;YAC3B,KAAK,CAAC,IAAI,CACR,UAAU,eAAe,CAAC,OAAO,CAAC,IAAI,EAAE,aAAa,CAAC,OAAO,EAC7D,OAAO,IAAI,EAAE,CACd,CAAC;QACJ,CAAC;aAAM,CAAC;YACN,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,IAAI,IAAI,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,EAAE,GAAG,CAAC,GAAG,CAAC;YAC5E,KAAK,CAAC,IAAI,CAAC,QAAQ,WAAW,KAAK,IAAI,EAAE,CAAC,CAAC;QAC7C,CAAC;IACH,CAAC;IACD,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,kFAAkF;AAClF,SAAS,QAAQ,CAAC,OAA0B;IAC1C,MAAM,OAAO,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC9D,OAAO,CAAC,IAAY,EAAU,EAAE;QAC9B,IAAI,GAAG,GAAG,IAAI,CAAC;QACf,KAAK,MAAM,MAAM,IAAI,OAAO;YAAE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;QACzE,OAAO,GAAG,CAAC;IACb,CAAC,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,cAAc,CAAC,OAA0B;IAChD,OAAO,mBAAmB,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,0PAA0P,CAAC;AAClV,CAAC;AAED;;;;;;;;GAQG;AACH,KAAK,UAAU,cAAc,CAC3B,MAAuB,EACvB,KAA+B,EAC/B,KAAuB,EACvB,IAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC;QACzB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,IAAI,EAAE,MAAM,CAAC,IAAI;QACjB,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,GAAG,CAAC,MAAM,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QAC3D,GAAG,CAAC,MAAM,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC;QACvE,qBAAqB,EAAE,IAAI;QAC3B,MAAM,EAAE,KAAK;KACd,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,eAAe,MAAM,CAAC,IAAI,IAAI,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,MAAM,CAAC,QAAQ,KACxF,MAAM,CAAC,aAAa,KAAK,IAAI;gBAC3B,CAAC,CAAC,yDAAyD;gBAC3D,CAAC,CAAC,yCAAyC,MAAM,CAAC,aAAa,EACnE,kEAAkE;SACnE,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,2BAA2B,IAAI,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,OAAO;QACL,EAAE,EAAE,KAAK;QACT,yEAAyE;QACzE,kEAAkE;QAClE,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,gOAAgO,KAAK,IAAI;KAC/S,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,KAAK,UAAU,YAAY,CACzB,MAA8B,EAC9B,OAAsB;IAEtB,MAAM,OAAO,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9C,IACE,CAAC,YAAY,CACX,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,EAChB,kEAAkE,EAClE,IAAI,CACL,EACD,CAAC;QACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,wBAAwB,CAAC,CAAC;IACtF,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,GAAG,OAAO,8BAA8B,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI;SAC9E,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CACnB,UAAU,CAAC,MAAM,EACjB,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,EAC3D,OAAO,CAAC,KAAK,EACb,OAAO,CAAC,OAAO,CAChB,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,KAAK,UAAU,WAAW,CACxB,MAA8B,EAC9B,OAAsB;IAEtB,MAAM,KAAK,GAAG,wBAAwB,CAAC;IACvC,IAAI,OAAO,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAErE,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC;IACxC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC/E,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,2CAA2C,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,IAAI,QAAQ,KAAK,CAAC,QAAQ,IAAI;SACvG,CAAC;IACJ,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAChC,MAAM,QAAQ,GAAG,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC;IACxC,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,IAAI,IAAI,EAAE,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,CAAC;IAErD,IACE,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CACvB,2BAA2B,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,+BAA+B,EAC9E,KAAK,CACN,EACD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,wKAAwK;SACjL,CAAC;IACJ,CAAC;IAED,OAAO,cAAc,CACnB;QACE,IAAI;QACJ,IAAI;QACJ,QAAQ,EAAE,QAAwB;QAClC,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,CAAC;QACvC,GAAG,CAAC,QAAQ,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,CAAC;KAChD,EACD,KAAK,EACL,OAAO,CAAC,KAAK,EACb,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,EAAE,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,MAAM,CACzE,CAAC,IAAI,EAAE,EAAE,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,SAAS,CACrC,CACF,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E;;;;;;;;;;;GAWG;AACH,SAAS,eAAe,CAAC,SAAmC;IAC1D,IAAI,SAAS,KAAK,IAAI,EAAE,CAAC;QACvB,OAAO,qHAAqH,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,0CAA0C,CAAC;IACjN,CAAC;IACD,MAAM,OAAO,GAAG,0BAA0B,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,mBAAmB,0BAA0B,CAAC,IAAI,CAAC,OAAO,CAAC,wCAAwC,CAAC;IAC7G,CAAC;IACD,OAAO,oCAAoC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,4MAA4M,CAAC;AAC/Q,CAAC;AAED;;;;;;;GAOG;AACH,KAAK,UAAU,uBAAuB,CACpC,MAAuB,EACvB,KAA+B,EAC/B,KAA4B,EAC5B,OAA2B,EAC3B,IAAuB;IAEvB,MAAM,MAAM,GAAG,MAAM,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC;IAE7E,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,wCAAwC,MAAM,CAAC,OAAO,oBAAoB,MAAM,CAAC,OAAO,+DAA+D,eAAe,CAAC,MAAM,CAAC,WAAW,CAAC,IAAI;SACvM,CAAC;IACJ,CAAC;IAED,MAAM,KAAK,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,2BAA2B,IAAI,kBAAkB,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/F,OAAO;QACL,EAAE,EAAE,KAAK;QACT,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,uNAAuN,KAAK,IAAI;KACtS,CAAC;AACJ,CAAC;AAED;;;;;;;;;GASG;AACH,KAAK,UAAU,eAAe,CAC5B,MAA8B,EAC9B,OAAsB;IAEtB,MAAM,KAAK,GAAG,kCAAkC,CAAC;IACjD,MAAM,KAAK,GAAG,cAAc,CAAC;IAC7B,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC;IAE9C,IACE,CAAC,YAAY,CACX,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,QAAQ,EAChB,iEAAiE,EACjE,IAAI,CACL,EACD,CAAC;QACD,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,uKAAuK;SAChL,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IACtC,MAAM,MAAM,GAAG,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,OAAO,KAAK,SAAS,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QAClD,OAAO,uBAAuB,CAC5B,EAAE,OAAO,EAAE,MAAM,EAAE,EACnB,KAAK,EACL,KAAK,EACL,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,OAAO,CAChB,CAAC;IACJ,CAAC;IAED,6EAA6E;IAC7E,MAAM,UAAU,GAAG,mBAAmB,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACnE,IAAI,CAAC,UAAU,CAAC,EAAE,EAAE,CAAC;QACnB,OAAO;YACL,EAAE,EAAE,IAAI;YACR,QAAQ,EAAE,IAAI;YACd,MAAM,EAAE,GAAG,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,8BAA8B,KAAK,CAAC,UAAU,CAAC,OAAO,CAAC,IAAI;SACtG,CAAC;IACJ,CAAC;IACD,OAAO,uBAAuB,CAC5B,UAAU,CAAC,MAAM,EACjB,QAAQ,CAAC,CAAC,GAAG,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,EAC3D,KAAK,EACL,OAAO,CAAC,OAAO,EACf,OAAO,CAAC,OAAO,CAChB,CAAC;AACJ,CAAC;AAED,KAAK,UAAU,SAAS,CACtB,MAA8B,EAC9B,OAAsB;IAEtB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,sGAAsG,EAAE,IAAI,CAAC,EAAE,CAAC;QACnK,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,MAAM,EAAE,iDAAiD,EAAE,CAAC;IACjG,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,cAAc,CAAC,KAAK,SAAS;QAClD,CAAC,CAAC,OAAO,CAAC,WAAW,CAAC,GAAG,CAAC,cAAc,CAAC;QACzC,CAAC,CAAC,EAAE,EAAE,EAAE,IAAa,EAAE,KAAK,EAAE,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IAC5G,MAAM,MAAM,GAAG,MAAM,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,UAAU,EAAE,OAAO,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC;IAChI,IAAI,MAAM,CAAC,EAAE,EAAE,CAAC;QACd,OAAO;YACL,EAAE,EAAE,IAAI;YACR,MAAM,EAAE,0PAA0P;SACnQ,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,GAAG,aAAa,CAAC,KAAK,EAAE,EAAE,MAAM,CAAC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,6FAA6F,EAAE,CAAC;AACpL,CAAC;AAED,iFAAiF;AACjF,MAAM,CAAC,MAAM,cAAc,GAAsC;IAC/D,KAAK,EAAE;QACL,KAAK,EAAE,sBAAsB;QAC7B,KAAK,EAAE,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC,uBAAuB,CAAC,MAAM,EAAE,wBAAwB,EAAE,IAAI,CAAC;QACxF,OAAO,EACL,uFAAuF;QACzF,IAAI,EAAE,wBAAwB;QAC9B,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,sBAAsB,EAAE,OAAO,CAAC;QAChE,MAAM,EAAE,WAAW;QACnB,SAAS,EAAE;YACT,0CAA0C;YAC1C,EAAE;YACF,uCAAuC;YACvC,EAAE;YACF,yFAAyF;SAC1F;KACF;IACD,SAAS,EAAE;QACT,KAAK,EAAE,0BAA0B;QACjC,OAAO,EACL,6GAA6G;QAC/G,IAAI,EAAE,4BAA4B;QAClC,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,0BAA0B,EAAE,OAAO,CAAC;QACpE,MAAM,EAAE,eAAe;QACvB,SAAS,EAAE;YACT,0CAA0C;YAC1C,EAAE;YACF,uCAAuC;YACvC,EAAE;YACF,+EAA+E;YAC/E,WAAW,0BAA0B,CAAC,IAAI,CAAC,MAAM,CAAC,2CAA2C;YAC7F,qFAAqF;SACtF;KACF;IACD,GAAG,EAAE;QACH,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,mGAAmG;QAC5G,IAAI,EAAE,sBAAsB;QAC5B,IAAI,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,YAAY,CAAC,oBAAoB,EAAE,OAAO,CAAC;QAC9D,MAAM,EAAE,SAAS;QACjB,SAAS,EAAE;YACT,mDAAmD;YACnD,EAAE;YACF,uCAAuC;YACvC,EAAE;YACF,iFAAiF;YACjF,qFAAqF;SACtF;KACF;CACF,CAAC;AAEF,wEAAwE;AACxE,MAAM,UAAU,iBAAiB;IAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC,IAAI,EAAE,CAAC;AAC5C,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E;;;;;;;;GAQG;AACH,SAAS,cAAc,CACrB,QAAgB,EAChB,OAAe,EACf,OAAe;IAEf,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,sEAAsE;IACtE,0EAA0E;IAC1E,6EAA6E;IAC7E,+DAA+D;IAC/D,MAAM,OAAO,GAAG,IAAI,CAAC,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,KAAK,QAAQ,CAAC,CAAC;IAChF,MAAM,WAAW,GAAG,OAAO,IAAI,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAC;IAClE,OAAO,WAAW;QAChB,CAAC,CAAC,kGAAkG;QACpG,CAAC,CAAC,sJAAsJ,CAAC;AAC7J,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IAErB,6EAA6E;IAC7E,uEAAuE;IACvE,IAAI,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,IAAI,IAAI,KAAK,MAAM,EAAE,CAAC;QAC1D,OAAO,CAAC,GAAG,CAAC,GAAG,kBAAkB,IAAI,CAAC,CAAC;QACvC,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,IAAI,KAAK,SAAS,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC/C,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,kEAAkE,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAClG,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,2EAA2E;IAC3E,MAAM,KAAK,GAAG,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,IAAI,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;IACrF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,mBAAmB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,qBAAqB,iBAAiB,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAC5F,kBAAkB,CACnB,CAAC;IACJ,CAAC;IACD,yEAAyE;IACzE,yEAAyE;IACzE,6CAA6C;IAC7C,MAAM,QAAQ,GAAG,KAAK,CAAC,IAAI,CAAC;IAE5B,MAAM,OAAO,GAAG,KAAK,CACnB,WAAW,IAAI,EAAE,EACjB,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,EACb,OAAO,EACP,GAAG,EACH,IAAI,EACJ,QAAQ,EACR,CAAC,OAAoB,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,OAAO,CAAC,CAC9C,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CAAC,OAAO,EAAE,KAAK,EAAE,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;IAC9F,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,WAAW,IAAI,EAAE,CAAC,CAAC;IAChF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,4EAA4E;IAC5E,oDAAoD;IACpD,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAwB,CAAC,CAAC;IACpE,MAAM,UAAU,GAAG,cAAc,CAAC,QAAQ,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,CAAC,CAAC;IACrE,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,GAAG,QAAQ,oMAAoM,cAAc,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,cAAc,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,EAC3R,QAAQ,CACT,CAAC;IACJ,CAAC;IAED,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;IAChD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,SAAS,CAAC;IACtC,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,iDAAiD;IACjD,MAAM,WAAW,GACf,IAAI,CAAC,WAAW;QAChB,uBAAuB,CACrB,EAAE,SAAS,EAAE,EACb,EAAE,aAAa,EAAE,QAAQ,EAAE,GAAG,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE,CAC1D,CAAC;IAEJ,MAAM,MAAM,GAAe,MAAM,iBAAiB,CAAC;QACjD,OAAO;QACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,WAAW,EAAE,gBAAgB,CAAC,SAAS,EAAE,UAAU,CAAC;QACpD,MAAM,EAAE;YACN,KAAK,EAAE,0BAA0B,IAAI,MAAM,KAAK,CAAC,OAAO,GAAG;YAC3D,MAAM,EAAE,gOAAgO;YACxO,SAAS,EAAE,KAAK,CAAC,SAAS;SAC3B;QACD,KAAK,EAAE;YACL,GAAG,CAAC,KAAK,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC;YAC5D,MAAM,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,EAAE,CAC3B,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE;gBACnB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO,EAAE,QAAQ,CAAC,OAAO;gBACzB,OAAO;gBACP,QAAQ,EAAE,OAAO,CAAC,QAAQ;gBAC1B,KAAK;gBACL,GAAG,CAAC,IAAI,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;gBAChE,WAAW;aACZ,CAAC;SACL;KACF,CAAC,CAAC;IAEH,2DAA2D;IAC3D,OAAO,MAAM,CAAC,IAAI,CAAC;AACrB,CAAC"}

package/dist/src/cli/setup-channel.d.ts

@@ -0,0 +1,117 @@
+/**
+ * `approval setup channel <name>` — configure one channel (APRV-79).
+ *
+ * SPEC.md §4 draws a line this verb's NAME now carries: a **channel** surfaces
+ * requests and collects decisions and holds no state; an **adapter** executes
+ * side effects and holds credentials. `approval setup adapter <name>` (APRV-78)
+ * fills the VAULT from an adapter's manifest. This verb fills the OS keystore
+ * and `.approval/env` from a channel's, because what a channel needs is not a
+ * credential an action spends inside a token window: it is the transport
+ * credential that lets the runtime ask a human anything at all.
+ *
+ * An older build spelled the Telegram one without the `channel` noun. That form
+ * is gone rather than aliased — the dispatch in `cli/setup.ts` answers it at
+ * exit 2 with the new one, in {@link RENAMED_NOTICE} — because two spellings of
+ * a distinction the SPEC draws on purpose is exactly how the distinction stops
+ * being drawn.
+ *
+ * ## What Telegram's flow keeps, unchanged
+ *
+ * The conversation is now `cli/setup-flow.ts`'s, the same one `setup adapter`
+ * runs, over the manifest `core/telegram-config.ts` declares. Everything that
+ * was a decision rather than a phrasing survives it, and each of these is
+ * asserted in `tests/cli-setup.test.ts`:
+ *
+ * - **`getMe` happens before anything is written.** It runs at the END of the
+ *   token's collection (step five of the flow), not after the write (step
+ *   seven), so a token the Bot API refuses costs the operator one line of
+ *   output and leaves `.approval/env` untouched. The chat discovery below it
+ *   also needs the bot's username, and asking `getMe` for it is the same call.
+ * - **No `getUpdates` from this verb carries an offset, ever.** An offset is an
+ *   ACKNOWLEDGEMENT: it tells the Bot API that everything below it may be
+ *   discarded, and a decision tap consumed here would never reach the listener
+ *   that was waiting for it. `allowed_updates` is `["message"]`, so a pending
+ *   `callback_query` is not even delivered to this process.
+ * - **The token is never typed into this process** on a machine with a
+ *   keystore: the helper's own no-echo prompt collects it and this runtime
+ *   learns it by reading the item back on stdout.
+ * - **The chat id is a literal.** A chat id is not a secret; the token is.
+ * - "send the bot a message", the 409 hint, the manual-curl refusal when nothing
+ *   arrives, and the optional send-a-test-message proof that defaults to NO.
+ *   What changed in APRV-96 is only WHEN the read happens: the verb long-polls
+ *   continuously until a message arrives or {@link DISCOVERY_DEADLINE_MS}
+ *   passes, instead of asking the operator to press Enter between reads.
+ *
+ * ## Where the two hooks sit, and why
+ *
+ * The flow asks its questions in one fixed order, and Telegram's shape falls
+ * out of it: the token is `collect`, because a human supplies it; the chat id is
+ * `discover`, because the SERVICE supplies it and the human's only part is
+ * sending a message and picking from what arrived. That is the hook APRV-78
+ * reserved and did not call. The proof is `verify`, which runs after the write —
+ * later than the old hand-rolled flow ran it, and correct in the same way the
+ * adapter's SMTP probe is: what is being proved is the stored configuration.
+ */
+import type { CredentialSpec } from "../core/credential-spec.js";
+import type { PolicyLoadResult } from "../core/policy-load.js";
+import type { Streams } from "./main.js";
+import { type Context, type HintContext, type SetupDeps } from "./setup-common.js";
+import { type FlowHooks } from "./setup-flow.js";
+/**
+ * The Telegram-only dependency, kept local to this file ON PURPOSE.
+ *
+ * `SetupDeps` is `setup-common.ts`'s, shared by every subcommand, and a
+ * discovery deadline is not something `setup vault` or `setup adapter email`
+ * has any meaning for. Tests inject a short one so the deadline path costs the
+ * suite milliseconds rather than a minute and a half; no operator has a reason
+ * to change it, so it is not a flag either.
+ */
+export interface ChannelSetupDeps extends SetupDeps {
+    /** The chat-discovery deadline in ms. {@link DISCOVERY_DEADLINE_MS} default. */
+    discoveryDeadlineMs?: number;
+}
+/**
+ * The refusal for the OLD spelling, as one constant on one line.
+ *
+ * One line and one identifier, because `tests/setup-rename.test.ts` sweeps
+ * `src/`, `docs/`, `examples/`, `README.md` and `SPEC.md` for the bare phrase
+ * and exempts exactly the lines that also name `RENAMED_NOTICE`. That is the
+ * whole exemption mechanism: a future line that reintroduces the old spelling
+ * cannot claim the exemption without saying this constant's name out loud.
+ */
+export declare const RENAMED_NOTICE = "`approval setup telegram` is now `approval setup channel telegram`, and there is no alias. A channel surfaces requests and collects decisions and holds no state; an adapter executes side effects and holds credentials. The two setup verbs fill different stores, so a channel's name belongs under `channel` (the OS keystore and .approval/env) and an adapter's under `adapter` (the vault)";
+/** One channel, as this verb needs to see it. Symmetric with ADAPTER_SETUPS. */
+export interface ChannelSetupEntry {
+    /** The manifest, declared by the channel itself, resolved against the policy. */
+    specs(load: PolicyLoadResult): readonly CredentialSpec[];
+    /** One line of what this channel is, for the title. */
+    summary: string;
+    /** The prerequisite paragraph, printed under the title. */
+    prereq: string;
+    /** The non-interactive path: the exact commands, generated. */
+    hint(context: HintContext): string;
+    /** The channel-specific conversation, as the flow's hooks. */
+    hooks(context: Context, deps: SetupDeps, streams: Streams, helpText: string): FlowHooks;
+    /** What to tell the operator to do next. */
+    nextSteps: readonly string[];
+    /** The per-channel help, for `--help` and for every refusal. */
+    help: string;
+}
+/** Every channel this verb can configure. Keyed by the `channel <name>` name. */
+export declare const CHANNEL_SETUPS: Record<string, ChannelSetupEntry>;
+/** The known names, sorted, for a usage error and for the help text. */
+export declare function knownChannelNames(): string[];
+/**
+ * `approval setup channel <name>` — the interactive writer for one channel's
+ * transport credentials. HUMAN-ONLY.
+ *
+ * The human-only gate is NEW in APRV-79. The Telegram help text had said
+ * HUMAN-ONLY since APRV-74 and nothing enforced it: the verb stores a bot
+ * credential and writes `.approval/env`, which is exactly what `vault` and
+ * `sampling` are gated for, and a help text that claims a control the code does
+ * not apply is worse than no claim at all.
+ *
+ * `argv` starts at the channel's name: `commandSetup` has already eaten
+ * `channel`.
+ */
+export declare function commandSetupChannel(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): Promise<number>;

package/dist/src/cli/setup-checkpoint.d.ts

@@ -0,0 +1,57 @@
+/**
+ * `approval setup checkpoint` — mint the key a human signs the log with
+ * (APRV-257, the ceremony half of APRV-220).
+ *
+ * APRV-220 built the record, the signature and the verify rule, and left the
+ * key to an operator with a Node REPL. This is the ceremony that replaces the
+ * REPL, and it is shaped like every other `approval setup` subcommand for the
+ * reason that family exists: establishing a secret is an act of the human at
+ * the machine, so the verb refuses a non-terminal stdin and prints the scripted
+ * alternative instead of accepting a pipe.
+ *
+ * ## The two halves go to two different places, and that is the whole design
+ *
+ * The PRIVATE half goes into the vault, under the reserved name
+ * `approval.checkpoint.key`. Encrypted at rest under the passphrase
+ * `vault.passphrase_env` names, which `core/child-env.ts` strips from every
+ * child this runtime spawns (APRV-205), behind a file whose reading classifies
+ * `account.credential`. `core/vault.ts`'s header records why it belongs there
+ * and not in the OS keystore.
+ *
+ * The PUBLIC half is PRINTED, with the exact `audit.checkpoint_keys` line to
+ * paste, and this verb goes no further. **Nothing an agent runs writes that
+ * line**, and nothing this verb runs writes it either: `APPROVAL.md` is
+ * attested, an edit de-attests it until a human re-attests, and a setup wizard
+ * that silently edited an attested policy would be forging the sign-off. The
+ * same rule `setup sampling` already keeps for `audit.sampling_secret_env`.
+ *
+ * So the key is INERT when this verb finishes, and the verb says so: a
+ * checkpoint signed by a key the policy does not list is
+ * `checkpoint-key-unknown`, which is a refusal. The ceremony is two steps and
+ * the second one is the human's.
+ *
+ * ## Rotation appends; it never drops
+ *
+ * `--rotate` mints a second key and prints the list with BOTH in it. Retiring
+ * is a separate, deliberate act (`--retire <fingerprint>`), and it is REFUSED
+ * for any key that signed a checkpoint in the log, naming the seqs that would
+ * stop verifying. That is not caution: removing such a key turns every
+ * checkpoint it signed into `checkpoint-key-unknown` for the life of the log,
+ * which is the cost APRV-220 accepted knowingly when it made an unlisted key a
+ * refusal rather than a shrug. A key that has signed nothing may be dropped,
+ * and this verb prints the line that does it.
+ *
+ * ## Human-only, three times over
+ *
+ * The terminal check (this family's own rule), the `--as human:<id>` gate
+ * (`requireHuman`), and — since APRV-257 — the classification: `approval setup
+ * checkpoint` classifies `policy.core` in `core/command-class.ts`, which the
+ * reference policy holds human-only, so the Claude Code hook denies an agent
+ * running it with `hook-class-human-only` before a process starts. It mints no
+ * new class (SPEC.md §11.1 invariant 9): `policy.core` already exists and
+ * already covers `gate open`, `gate close` and `log checkpoint`.
+ */
+import type { Streams } from "./main.js";
+import { type SetupDeps } from "./setup-common.js";
+/** `approval setup checkpoint` — mint the checkpoint keypair. HUMAN-ONLY. */
+export declare function commandSetupCheckpoint(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): number;