approval-md 0.1.0 → 0.3.0

package/dist/src/cli/setup-service.d.ts

@@ -0,0 +1,96 @@
+/**
+ * `approval setup service` — the login service that runs the ambient runtime
+ * (SPEC.md §10.2, APRV-110).
+ *
+ * `approval up` is a foreground process. This verb writes the one file that
+ * makes it start at login and stay started: a launchd user agent on macOS, or a
+ * systemd user unit on Linux. It is the fifth member of the `setup` family and
+ * it obeys the family's rules — interactive by refusal, human-only, appending
+ * nothing to the log, editing no policy — with two of its own.
+ *
+ * ## It never copies a value
+ *
+ * A unit file is world-readable configuration that survives reboots and gets
+ * backed up. A bot token in one is a bot token in a backup. So the unit NAMES
+ * where the environment comes from and never carries it:
+ *
+ * - by default it runs a WRAPPER the human reads in the printed unit —
+ *   `eval "$(approval env)"` and then `exec approval up` — so the keystore
+ *   references stay in the keystore and `approval env` stays the only thing
+ *   that resolves them (SPEC.md §11.1 invariant 7: nothing loads that file
+ *   implicitly, and here it is a human's line in a file they approved);
+ * - or, with `--env-file`, it points at a file THE OPERATOR AUTHORED, which
+ *   this verb neither writes nor reads.
+ *
+ * ## It prints the unit before it writes it, and it does not arm it
+ *
+ * The whole file goes to stdout first, and nothing is written until the operator
+ * confirms. Loading it is a separate act: this verb prints the exact
+ * `launchctl` or `systemctl` line and stops there. A login service is a standing
+ * capability on someone's machine — it will start a process that holds a
+ * credential and can put prompts on a phone — and a wizard that armed one as a
+ * side effect of writing a file would be making that decision on the operator's
+ * behalf. Printing the command costs one paste and buys an explicit act.
+ *
+ * ## Logs never go into `.approval/`
+ *
+ * The service's stdout and stderr go where the operator chooses, defaulting to
+ * the platform's own log home. A path inside the approval home is REFUSED:
+ * `.approval/` holds the log, the queue projection, the payload store, the
+ * vault and the environment source map, and a service that appended its console
+ * output beside them would put unverifiable text in the one directory whose
+ * contents are supposed to mean something.
+ */
+import type { Streams } from "./main.js";
+import { type SetupDeps } from "./setup-common.js";
+/** The two service managers this verb writes for. */
+export type ServicePlatform = "launchd" | "systemd";
+/** The conventional names. `--label` overrides both. */
+export declare const LAUNCHD_LABEL = "md.approval.up";
+export declare const SYSTEMD_UNIT = "approval-up";
+/** Which manager this machine has, or `null` when it has neither. */
+export declare function platformFor(platform: NodeJS.Platform): ServicePlatform | null;
+/** Where the unit file belongs, for a platform and a label. */
+export declare function unitPathFor(platform: ServicePlatform, label: string, home: string): string;
+/** Where the platform keeps a user's own logs. */
+export declare function defaultLogsDir(platform: ServicePlatform, home: string): string;
+/** The command that arms the written unit, printed and never run. */
+export declare function armCommand(platform: ServicePlatform, label: string, path: string): string;
+/**
+ * The command that disarms it, printed before the file is removed.
+ *
+ * Takes no path, unlike {@link armCommand}: launchd boots a service OUT by its
+ * label, and the plist it was booted in from may already be gone.
+ */
+export declare function disarmCommand(platform: ServicePlatform, label: string): string;
+/** Everything a unit is generated from, all of it already resolved. */
+export interface ServicePlan {
+    platform: ServicePlatform;
+    label: string;
+    /** The unit file this would be written to. */
+    path: string;
+    /** The primary checkout the runtime is started in. */
+    workingDir: string;
+    /** The `approval` invocation, as argv words. */
+    exec: string[];
+    /** An operator-authored EnvironmentFile, or `null` for the `approval env` wrapper. */
+    envFile: string | null;
+    outLog: string;
+    errLog: string;
+    /** The variable NAMES the runtime will look for. Printed as a comment only. */
+    variables: string[];
+}
+/** One `sh -lc` script: the wrapper the operator reads inside the unit. */
+export declare function wrapperScript(plan: ServicePlan): string;
+/** The whole unit file, as the operator will read it and as it will be written. */
+export declare function renderUnit(plan: ServicePlan): string;
+/**
+ * The approval invocation this process was started as.
+ *
+ * `node dist/src/cli/main.js` and the installed `approval` bin are both
+ * legitimate, and a unit that named the wrong one would fail at login rather
+ * than here. `--exec` overrides for the case neither guess fits.
+ */
+export declare function execWords(override: string | null, argv: readonly string[]): string[];
+/** `approval setup service` — write the login unit. HUMAN-ONLY, INTERACTIVE. */
+export declare function commandSetupService(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): number;

package/dist/src/cli/setup.d.ts

@@ -0,0 +1,204 @@
+/**
+ * `approval setup` — the interactive configuration family (SPEC.md §5.2, §10.1).
+ *
+ * APRV-73 gave `.approval/env` a format and `approval env` a reader. This verb
+ * is the writer, and it is the only one: it establishes the things an operator
+ * must have before any gate operation works — a declared human identity, a
+ * vault passphrase, a sampling secret, a live Telegram bot and chat, and an
+ * adapter's credentials — by putting each VALUE where that kind of value
+ * belongs and each SOURCE in `.approval/env`.
+ *
+ * ## Who lives where
+ *
+ * This file holds the three subcommands whose subject is a value this runtime
+ * MINTS or a name it records, plus the dispatch:
+ *
+ * ```
+ * setup identity                 # APPROVAL_HUMAN, in this file
+ * setup vault                    # the vault passphrase, in this file
+ * setup sampling                 # the audit sampling secret, in this file
+ * setup checkpoint               # cli/setup-checkpoint.ts (the vault + a print)
+ * setup channel <name>           # cli/setup-channel.ts  (keystore + .approval/env)
+ * setup adapter <name>           # cli/setup-adapter.ts  (the vault)
+ * setup service                  # cli/setup-service.ts  (a launchd/systemd unit)
+ * ```
+ *
+ * The last two are **two nouns and not one list**, and the split is SPEC.md
+ * §4's: a CHANNEL surfaces requests and collects decisions and holds no state,
+ * so its setup fills the keystore and `.approval/env`; an ADAPTER executes side
+ * effects and holds credentials, so its setup fills the vault.
+ * An older build spelled the Telegram one without the `channel` noun, and that
+ * form is gone (APRV-79): the dispatch answers it with the new one and exits 2
+ * rather than aliasing it, because an alias would leave two spellings of a
+ * distinction the SPEC draws on purpose.
+ *
+ * Everything the three files share — the dependency bag, the keystore seam, the
+ * front matter, the human-only gate, the service names, the plaintext-literal
+ * offer — is `cli/setup-common.ts`, which imports from none of them. The
+ * conversation `setup channel|adapter` both run is `cli/setup-flow.ts`.
+ *
+ * ## The order these run in
+ *
+ * Nothing enforced it and nothing said it, which APRV-76 noticed the hard way.
+ * It is:
+ *
+ * ```
+ * approval init                       # the directory and the .gitignore
+ * (write APPROVAL.md)                 # the policy NAMES every variable below
+ * approval setup identity             # APPROVAL_HUMAN
+ * approval setup vault                # the passphrase, into the keystore
+ * eval "$(approval env)"              # the ONLY thing that puts them in a shell
+ * approval setup adapter <name>       # the adapter's credentials, into the vault
+ * ```
+ *
+ * The policy comes before every `setup`, because each of them reads variable
+ * NAMES out of it. The `eval` comes before `setup adapter`, because that
+ * subcommand needs the passphrase's VALUE in the environment and will not read
+ * `.approval/env` to get it (§11.1 invariant 7). `setup sampling` and
+ * `setup channel telegram` slot in anywhere after the policy.
+ *
+ * ## What this verb is not allowed to do
+ *
+ * **It never appends to the log, never attests, and never edits `APPROVAL.md`.**
+ * Configuration is not an authorized action, and the log is the record of
+ * authorized actions; a "telegram configured" event would be a line in the one
+ * file this project promises never to rewrite, saying something the log has no
+ * business knowing. `tests/cli-setup.test.ts` byte-compares `events.jsonl`
+ * across a complete run of every subcommand to keep that true by assertion.
+ * When a policy line is needed (the sampling secret's name), this verb PRINTS
+ * the `approval policy amend` invocation and stops: an amendment is a human
+ * ceremony with an attestation at the end of it, and a setup wizard that
+ * silently edited an attested policy would be forging the sign-off.
+ *
+ * It writes exactly three things: lines in `.approval/env`, through a writer
+ * that preserves every other line and comment (`core/env-file.ts`), items in
+ * the OS keystore, and entries in the vault (`setup adapter` only).
+ *
+ * ## Interactive or nothing
+ *
+ * Every subcommand refuses when stdin is not a terminal, or when `--json` was
+ * given, and exits 2 printing THE EXACT NON-INTERACTIVE ALTERNATIVE — the
+ * `security add-generic-password` line to run, or the `.approval/env` line to
+ * add, or the `export` to put in a shell profile. This is not a wizard being
+ * precious about its terminal. A `setup` that could be driven from a pipe would
+ * be a way for a CI job or an agent to write `APPROVAL_HUMAN` and a keystore
+ * item, which is precisely the boundary §11 draws: identity is config-declared,
+ * so establishing it must be an act of the human at the machine. The refusal
+ * text is the documented scripted path, so nobody has to reverse-engineer one.
+ *
+ * `setup identity` is EXEMPT from the human-only `--as` gate that every other
+ * subcommand carries, and the exemption is not a hole: identity is what that
+ * gate reads. A verb that demanded `APPROVAL_HUMAN` before it would let you set
+ * `APPROVAL_HUMAN` could only ever be run by someone who did not need it. The
+ * control on this path is the terminal itself.
+ *
+ * ## Answers, and answering again (APRV-90)
+ *
+ * Every typed question in this family runs through `prompt.ts`'s `askUntil`: a
+ * wrong answer is one line saying what was wrong and the same question again,
+ * never an exit code with a help page under it. `setup identity` also
+ * NORMALISES what it is given — `carter` is recorded as `human:carter`, and
+ * `human:carter` is taken as it stands ({@link identityFromAnswer}). The prompt
+ * still prints the `human:` prefix, because the prefix is what distinguishes
+ * the actor kinds the human-only verbs refuse, but nobody has to retype a
+ * prefix the question already showed them. `agent:` and `system:` are refused
+ * with the sentence that names why, as a reason to answer again.
+ *
+ * ## Where a secret goes, and how it gets there
+ *
+ * Three service names, one per secret, documented so an operator can find them
+ * with `security find-generic-password` or `secret-tool lookup` by hand:
+ * `approval-tg-token`, `approval-vault-passphrase`, `approval-sampling-secret`.
+ *
+ * - **macOS** (`darwin` and `security` on PATH) → `keychain:<service>`;
+ * - **Linux with `secret-tool`** → `secret-service:<service>` (the same string
+ *   is the label, so the two platforms name one secret one way);
+ * - **neither** → the operator is OFFERED a plaintext literal in
+ *   `.approval/env`, and must type `yes` in full to take it, having been shown
+ *   the same warning `approval env --check` will print at them forever after.
+ *   §5.2 permits literals for a stated reason, and refusing here would only
+ *   move the value into a shell profile where nothing can see it to report it.
+ *
+ * **A value the operator already holds is never handled by this process.** The
+ * Telegram token on macOS is collected by `security`'s OWN no-echo prompt: we
+ * spawn `security add-generic-password … -w` WITH NO VALUE and with inherited
+ * stdio, Apple's prompt reads it from the terminal, and the token reaches this
+ * runtime only afterwards, on the stdout of a `find-generic-password -w` read
+ * that puts nothing in an argv either. Off macOS it comes through
+ * `Prompter.readSecret`, which at least keeps it off the screen.
+ *
+ * **A value we generate ourselves is a different question**, and it is the one
+ * place this family makes a trade rather than following a rule. The vault
+ * passphrase and the sampling secret are `randomBytes(32)`, minted in this
+ * process, so they are already in this process and there is nobody to prompt.
+ * They reach the keystore by STDIN first: `security add-generic-password -w`
+ * with the value written to its stdin twice (the prompt asks for confirmation),
+ * and `secret-tool store`, which documents stdin as its input. Only if the
+ * stdin form FAILS does the fallback put the value in an argv (`-w <value>`),
+ * and then the outcome says so out loud. That residual exposure is a value
+ * minted one millisecond earlier, never used, visible in `ps` to the same user
+ * who is running the command and to root — which is the boundary §11 already
+ * declares undefended. It is accepted for generated values and for nothing
+ * else: no path in this family ever puts an operator's own token in an argv.
+ *
+ * **And there is one standing exception to the rule above, which
+ * `setup adapter <name>` takes.** A credential bound for the VAULT must pass
+ * through this process, because the vault is not a helper with a prompt: it is
+ * a file this runtime encrypts, so `setCredential` needs the bytes. There is
+ * nothing to delegate the typing to and no third party to hold the value. The
+ * secret is read with `Prompter.readSecret` (no echo), handed straight to the
+ * cipher, and never printed, logged, or placed in an argv — which is exactly
+ * what `approval vault set` already does when a human pastes a credential onto
+ * its stdin. The rule is "never handle a value someone else can hold for you";
+ * for the vault nobody can, so it is stated here rather than left to look like
+ * an oversight.
+ *
+ * ## Seams
+ *
+ * The prompter, the keystore, and `fetch` are injected. The alternative is a
+ * test suite that needs a terminal, writes to the developer's real Keychain,
+ * and talks to the real Bot API — and the third of those would put a real bot
+ * token in a test run. `tests/cli-setup.test.ts` drives all three through fakes
+ * and the mock Bot API on loopback, and the spawned-CLI cases never get past
+ * the terminal check, so nothing under `npm test` can reach a keystore at all.
+ */
+import { type SetupDeps } from "./setup-common.js";
+import type { Streams } from "./main.js";
+/**
+ * One typed answer to `human identity (human:<id>):`, as an identity (APRV-90).
+ *
+ * **A bare id is accepted and normalised.** The prompt prints the `human:`
+ * prefix because the prefix is load-bearing — actors are `human:`, `agent:` or
+ * `system:`, and the human-only verbs refuse the other two — so an operator who
+ * has never read SPEC.md §11 learns the shape from the question itself. Making
+ * them retype a prefix the prompt just printed adds a failure path and teaches
+ * nothing further, so `carter` becomes `human:carter` and `human:carter` is
+ * taken as it stands.
+ *
+ * An answer with a colon in it is taken as a FULL actor and validated as one,
+ * which is what makes `agent:claude` a refusal rather than `human:agent:claude`.
+ * That refusal is a reason handed back to {@link askUntil}, so the operator is
+ * asked again rather than dropped out of the verb.
+ */
+export declare function identityFromAnswer(answer: string): {
+    ok: true;
+    value: string;
+} | {
+    ok: false;
+    reason: string;
+};
+/**
+ * `approval setup identity` — declare who the human is.
+ *
+ * EXEMPT from the human-only gate, and the module doc says why: this is the
+ * verb that creates the thing the gate reads.
+ */
+export declare function commandSetupIdentity(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): number;
+/** `approval setup vault` — mint and store the vault passphrase. HUMAN-ONLY. */
+export declare function commandSetupVault(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): number;
+/** `approval setup sampling` — mint and store the audit sampling secret. HUMAN-ONLY. */
+export declare function commandSetupSampling(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): number;
+/** `approval setup sender-key` — mint and store the sender key. HUMAN-ONLY. */
+export declare function commandSetupSenderKey(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): number;
+/** `approval setup <identity|vault|sampling|channel <name>|adapter <name>>`. */
+export declare function commandSetup(argv: string[], streams: Streams, cwd: string, deps?: SetupDeps): number | Promise<number>;

package/dist/src/cli/setup.js

@@ -164,14 +164,16 @@
  */
 import { HUMAN_ACTOR_ENV, resolveHumanActor } from "../core/attest.js";
 import { readEnvFile, upsertEnvFileEntries } from "../core/env-file.js";
+import { SENDER_KEY_ENV, hashedSenderId, senderKeyFrom } from "../core/sender-identity.js";
 import { passphraseEnvFor, vaultExists, vaultPathFor } from "../core/vault.js";
+import { parseFlags, stringFlag } from "./args.js";
 import { EXIT_IO, EXIT_OK } from "./exit-codes.js";
-import { SETUP_CHANNEL_HELP, SETUP_HELP, SETUP_IDENTITY_HELP, SETUP_SAMPLING_HELP, SETUP_VAULT_HELP, } from "./help.js";
+import { SETUP_CHANNEL_HELP, SETUP_HELP, SETUP_IDENTITY_HELP, SETUP_SAMPLING_HELP, SETUP_SENDER_KEY_HELP, SETUP_VAULT_HELP, } from "./help.js";
 import { commandSetupAdapter } from "./setup-adapter.js";
 import { commandSetupCheckpoint } from "./setup-checkpoint.js";
 import { RENAMED_NOTICE, commandSetupChannel } from "./setup-channel.js";
 import { commandSetupService } from "./setup-service.js";
-import { DEFAULT_SAMPLING_ENV, emitRefusal, front, offerLiteral, promptRefusal, requireHuman, retrievalCommand, samplingEnvName, schemeFor, storageCommand, usageError, } from "./setup-common.js";
+import { DEFAULT_SAMPLING_ENV, FLAGS, emitRefusal, front, offerLiteral, promptRefusal, requireHuman, retrievalCommand, samplingEnvName, schemeFor, storageCommand, usageError, } from "./setup-common.js";
 import { PLAN_PHRASES, planWrites, reportLeftAlone } from "./setup-flow.js";
 import { askUntil } from "./prompt.js";
 // ---------------------------------------------------------------------------
@@ -425,6 +427,89 @@ export function commandSetupSampling(argv, streams, cwd, deps = {}) {
     return EXIT_OK;
 }
 // ---------------------------------------------------------------------------
+// approval setup sender-key (APRV-370)
+// ---------------------------------------------------------------------------
+const SENDER_KEY_HINT = (where) => `  # 1. store the key (the helper prompts; no value on this command line):\n  ${storageCommand(where.kind === "none" ? "keychain" : where.kind, where.services.senderKey)}\n\n  # 2. record where it lives (the name carries this instance's id; see \`approval doctor\`):\n  printf '%s\\n' '${SENDER_KEY_ENV}=${schemeFor(where.kind === "none" ? "keychain" : where.kind, where.services.senderKey) ?? ""}' >> ${where.envPath}\n  chmod 600 ${where.envPath}\n\n  # 3. turn an account id into the line the policy carries:\n  eval "$(approval env)"\n  approval setup sender-key --id <account-id>`;
+/**
+ * Print the mapping line for one account id, and mint nothing (APRV-370).
+ *
+ * The half of this verb that runs after the key exists, and the reason the
+ * proposal page an operator applies does not have to carry a placeholder they
+ * fill by hand: the digest depends on a secret only their environment holds,
+ * so the exact bytes can only be produced here, on their machine.
+ *
+ * It stores nothing, prompts for nothing, and prints no secret — a digest is a
+ * value designed to be published in a policy — so it is exempt from the
+ * terminal requirement and from the human-identity check that guard the minting
+ * path. A verb that refused to compute a public value without a TTY would be
+ * ceremony charged for nothing.
+ */
+function senderKeyDigest(argv, streams) {
+    const json = argv.includes("--json");
+    const parsed = parseFlags(argv, { ...FLAGS, "--id": "string" });
+    if (!parsed.ok)
+        return usageError(streams, json, parsed.message, SETUP_SENDER_KEY_HELP);
+    const id = stringFlag(parsed.flags, "--id") ?? "";
+    if (id.length === 0) {
+        return usageError(streams, json, "--id expects the channel account id to hash, as the transport reports it (for telegram, the decimal callback_query.from.id)", SETUP_SENDER_KEY_HELP);
+    }
+    const key = senderKeyFrom();
+    if (key === null) {
+        // Fail closed and say the whole repair. Printing a digest under a key this
+        // process invented would hand the operator a line no listener can ever
+        // match, and they would find that out at a refused tap.
+        const message = `${SENDER_KEY_ENV} is unset or empty in this process, so there is no key to hash ${JSON.stringify(id)} under and nothing was printed. Mint it with \`approval setup sender-key\` if it does not exist yet, then \`eval "$(approval env)"\` to establish it in this shell.`;
+        if (json)
+            streams.err(`${JSON.stringify({ error: { code: "sender-key-unavailable", message } })}\n`);
+        else
+            streams.err(`approval: ${message}\n`);
+        return EXIT_IO;
+    }
+    const digest = hashedSenderId(key, id);
+    if (json) {
+        streams.out(`${JSON.stringify({ id, mapping: digest, env: SENDER_KEY_ENV })}\n`);
+        return EXIT_OK;
+    }
+    streams.out(`The mapping value for account ${id}, under the key in ${SENDER_KEY_ENV}:\n\n  ${digest}\n\nIn the approver's block:\n\n    senders:\n      telegram: "${digest}"\n\nAs a policy-proposal pair (docs/proposals/README.md), with the approver id and\nthe current line replaced by what your own APPROVAL.md says:\n\n  Current:\n\n  \`\`\`yaml\n  approvers:\n    <id>:\n      channels: [telegram, cli]\n      senders:\n        telegram: "${id}"\n  \`\`\`\n\n  Replace with:\n\n  \`\`\`yaml\n  approvers:\n    <id>:\n      channels: [telegram, cli]\n      senders:\n        telegram: "${digest}"\n  \`\`\`\n\nThe digest is not a secret: it is published in the policy and in every decision\nrecord. The key it was computed under is, and it was not printed.\n`);
+    return EXIT_OK;
+}
+/** `approval setup sender-key` — mint and store the sender key. HUMAN-ONLY. */
+export function commandSetupSenderKey(argv, streams, cwd, deps = {}) {
+    // The --id path first, because it mints nothing: no keystore, no prompter, no
+    // human identity, and no terminal. `front` would refuse it for want of a TTY.
+    if (argv.includes("--id"))
+        return senderKeyDigest(argv, streams);
+    const outcome = front("sender-key", argv, streams, cwd, deps, SETUP_SENDER_KEY_HELP, SENDER_KEY_HINT, { "--id": "string" });
+    if (outcome.kind === "handled")
+        return outcome.code;
+    const context = outcome;
+    const human = requireHuman(context.flags, streams, SETUP_SENDER_KEY_HELP, "sender-key");
+    if (!human.ok)
+        return human.code;
+    streams.out(`approval setup sender-key — mints the operator-held key that turns a channel\naccount id into the value an \`approvers[id].senders\` block carries.\n\nA published policy and a published log disclose the account otherwise: once in\nthe file and then on every decision. A plain unkeyed digest would not fix that,\nbecause a Telegram id is a short decimal number and the whole space of them is\nenumerable on a laptop. This key is what makes the digest a digest of anything.\n\nIt is not an authenticator. Nothing in the gate's safety rests on its secrecy,\nand a listener that loses it can no longer RESOLVE accounts — it refuses every\ndecision on a keyed channel rather than falling back to the raw comparison.\n\n`);
+    const plan = planReplacements(streams, context.prompter, context.envPath, [SENDER_KEY_ENV]);
+    if (!plan.ok)
+        return emitRefusal(streams, plan.refusal);
+    if (plan.write.length === 0) {
+        reportSkipped(streams, context.envPath, plan.skipped);
+        return EXIT_OK;
+    }
+    const stored = storeGeneratedSecret(streams, context, context.services.senderKey, "sender key");
+    if (stored === null)
+        return EXIT_OK;
+    if ("failed" in stored)
+        return stored.code;
+    const written = writeLines(streams, context.envPath, [{ key: SENDER_KEY_ENV, value: stored.value, describe: stored.describe }], plan.write);
+    if (!written.ok)
+        return written.code;
+    reportSkipped(streams, context.envPath, plan.skipped);
+    // The value was not printed and there is no verb that prints it. What the
+    // operator needs next is the line the POLICY carries, which is a different
+    // value and is printed on demand by the `--id` path.
+    streams.out(`\nThe key is in ${SENDER_KEY_ENV}, and its value was not printed here or anywhere\nelse. Establish it, then turn an account id into the line your policy carries:\n\n  eval "$(approval env)"\n  approval setup sender-key --id <account-id>\n\nNothing changes until an \`approvers[id].senders\` entry is written in the keyed\nform, through the amendment ceremony that attests it (\`approval policy amend\`,\nor \`approval policy apply <proposal>\`). Until then every mapping stays raw and\nevery record reads exactly as it did.\n\nWHEN IT IS KEYED, the listener needs this variable in its environment or it\nrefuses every decision on that channel (\`sender-key-unavailable\`). Restart the\nlistener after establishing it, and check it with \`approval doctor\`.\n`);
+    return EXIT_OK;
+}
+// ---------------------------------------------------------------------------
 // Dispatch
 // ---------------------------------------------------------------------------
 /** `approval setup <identity|vault|sampling|channel <name>|adapter <name>>`. */
@@ -445,6 +530,13 @@ export function commandSetup(argv, streams, cwd, deps = {}) {
         return commandSetupVault(rest, streams, cwd, deps);
     if (sub === "sampling")
         return commandSetupSampling(rest, streams, cwd, deps);
+    // APRV-370. The second secret whose PUBLIC half belongs in APPROVAL.md: the
+    // key stays in `.approval/env`, and the digest of an account id under it is
+    // the value the `senders` mapping carries. Like every setup verb here it
+    // edits no policy file; unlike the rest it can be asked to compute that
+    // public half, which is what `--id` does.
+    if (sub === "sender-key")
+        return commandSetupSenderKey(rest, streams, cwd, deps);
     // APRV-257. The fourth subcommand whose subject is a value this runtime
     // MINTS, and the first whose public half belongs in APPROVAL.md rather than
     // in `.approval/env`. It prints that half and the amendment ceremony and

package/dist/src/cli/setup.js.map

@@ -1 +1 @@
-{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/cli/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmKG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAuB,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,WAAW,EACX,KAAK,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,EACd,UAAU,GAIX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE5E,OAAO,EAAE,QAAQ,EAAiB,MAAM,aAAa,CAAC;AAEtD,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,gBAAgB,CACvB,OAAgB,EAChB,QAAkB,EAClB,OAAe,EACf,IAAc;IAEd,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAElD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,OAAgB,EAAE,OAAe,EAAE,OAAiB;IACzE,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,OAAgB,EAChB,OAAe,EACf,MAA+D,EAC/D,OAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAExD,MAAM,MAAM,GAAG,oBAAoB,CACjC,OAAO,EACP,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CACjE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;IAEzE,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,gBAAgB,CAAC,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC7C,CAAC;AAaD;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAC3B,OAAgB,EAChB,OAAgB,EAChB,OAAe,EACf,IAAY;IAEZ,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,0BAA0B,OAAO,CAAC,OAAO,cAAc,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,iBAAiB,IAAI,yBAAyB,OAAO,CAAC,OAAO,6BAA6B,OAAO,CAAC,OAAO,IAAI,CAC9G,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,CACT,8BAA8B,IAAI,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,OAAO,IAAI,CAC5F,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CACT,iSAAiS,CAClS,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAW;QACpD,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAW;KACxD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2FAA2F;SACpG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;IACjE,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,6LAA6L;SAC9N,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAU,EAAE,CACnD,oFAAoF,eAAe,gGAAgG,eAAe,mBAAmB,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC;AAErR;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,OAAO,GAAG,KAAK,CACnB,UAAU,EACV,IAAI,EACJ,OAAO,EACP,GAAG,EACH,IAAI,EACJ,mBAAmB,EACnB,aAAa,CACd,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAC9C,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,2DAA2D,eAAe,6KAA6K,CACxP,CAAC;IAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CACpB,OAAO,EACP,OAAO,CAAC,QAAQ,EAChB,6CAA6C,EAC7C,kBAAkB,CACnB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,2EAA2E;QAC3E,4EAA4E;QAC5E,OAAO,aAAa,CAClB,OAAO,EACP,KAAK,CAAC,MAAM,KAAK,SAAS;YACxB,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,gCAAgC,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;IAE7B,MAAM,OAAO,GAAG,UAAU,CACxB,OAAO,EACP,OAAO,CAAC,OAAO,EACf,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAC/D,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACrC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CACT,6DAA6D,OAAO,CAAC,OAAO,8EAA8E,CAC3J,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,UAAU,GAAG,CAAC,KAAkB,EAAU,EAAE,CAChD,wIAAwI,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,uHAAuH,KAAK,CAAC,aAAa,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC;AAE7gB,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAC/B,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC9E,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CACT,mDAAmD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,uGAAuG,QAAQ,KAAK,2BAA2B,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,4BAA4B,CACtR,CAAC;IAEF,4EAA4E;IAC5E,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,YAAY,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,wRAAwR,CAClU,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,mCAAmC,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;YACpE,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CACjC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,QAAQ,CAAC,eAAe,EAChC,kBAAkB,CACnB,CAAC;IACF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpC,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAE3C,MAAM,OAAO,GAAG,UAAU,CACxB,OAAO,EACP,OAAO,CAAC,OAAO,EACf,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EACnE,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACrC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CACT,0BAA0B,QAAQ,yMAAyM,CAC5O,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAU,EAAE,CACnD,mFAAmF,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,uHAAuH,KAAK,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,OAAO,qHAAqH,KAAK,CAAC,WAAW,6BAA6B,CAAC;AAErnB,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,QAAQ,IAAI,oBAAoB,CAAC;IAElD,OAAO,CAAC,GAAG,CACT,mXAAmX,CACpX,CAAC;IAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CACjC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,QAAQ,CAAC,cAAc,EAC/B,iBAAiB,CAClB,CAAC;IACF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpC,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAE3C,MAAM,OAAO,GAAG,UAAU,CACxB,OAAO,EACP,OAAO,CAAC,OAAO,EACf,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EACnE,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACrC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,OAAO,CAAC,GAAG,CACT,6GAA6G,QAAQ,oRAAoR,QAAQ,+BAA+B,CACjb,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,+BAA+B,QAAQ,2HAA2H,CACnK,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAC1B,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,yCAAyC,EAAE,UAAU,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9E,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,GAAG,KAAK,YAAY;QAAE,OAAO,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClF,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5E,oEAAoE;IACpE,8EAA8E;IAC9E,yDAAyD;IACzD,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC7F,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAClE,UAAU,CACX,CAAC;AACJ,CAAC"}
+{"version":3,"file":"setup.js","sourceRoot":"","sources":["../../../src/cli/setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmKG;AAEH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AACvE,OAAO,EAAE,WAAW,EAAE,oBAAoB,EAAuB,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,4BAA4B,CAAC;AAC3F,OAAO,EAAE,gBAAgB,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAC/E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AACnD,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,iBAAiB,CAAC;AACnD,OAAO,EACL,kBAAkB,EAClB,UAAU,EACV,mBAAmB,EACnB,mBAAmB,EACnB,qBAAqB,EACrB,gBAAgB,GACjB,MAAM,WAAW,CAAC;AACnB,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EAAE,sBAAsB,EAAE,MAAM,uBAAuB,CAAC;AAC/D,OAAO,EAAE,cAAc,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzE,OAAO,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACzD,OAAO,EACL,oBAAoB,EACpB,KAAK,EACL,WAAW,EACX,KAAK,EACL,YAAY,EACZ,aAAa,EACb,YAAY,EACZ,gBAAgB,EAChB,eAAe,EACf,SAAS,EACT,cAAc,EACd,UAAU,GAIX,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAC;AAE5E,OAAO,EAAE,QAAQ,EAAiB,MAAM,aAAa,CAAC;AAEtD,8EAA8E;AAC9E,kCAAkC;AAClC,8EAA8E;AAE9E;;;;;;;;;;;;;;;;;GAiBG;AACH,SAAS,gBAAgB,CACvB,OAAgB,EAChB,QAAkB,EAClB,OAAe,EACf,IAAc;IAEd,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,CAAC;IAClC,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAElD,MAAM,OAAO,GAAG,IAAI,GAAG,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IAChE,MAAM,IAAI,GAAG,UAAU,CAAC,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;IAC7F,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC;AAChE,CAAC;AAED,+EAA+E;AAC/E,SAAS,aAAa,CAAC,OAAgB,EAAE,OAAe,EAAE,OAAiB;IACzE,eAAe,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,YAAY,CAAC,UAAU,CAAC,CAAC,CAAC;AACvE,CAAC;AAED;;;;;GAKG;AACH,SAAS,UAAU,CACjB,OAAgB,EAChB,OAAe,EACf,MAA+D,EAC/D,OAAiB;IAEjB,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC;IACtE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC;IAExD,MAAM,MAAM,GAAG,oBAAoB,CACjC,OAAO,EACP,OAAO,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,GAAG,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE,CAAC,CAAC,CACjE,CAAC;IACF,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,WAAW,CAAC,OAAO,EAAE,MAAM,CAAC,EAAE,CAAC;IAEzE,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,CAAC,GAAG,CAAC,WAAW,OAAO,gBAAgB,CAAC,CAAC;IACpE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,KAAK,KAAK,CAAC,GAAG,OAAO,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC;IACvD,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,OAAO,CAAC,MAAM,EAAE,CAAC;AAC7C,CAAC;AAaD;;;;;;;;;;GAUG;AACH,SAAS,oBAAoB,CAC3B,OAAgB,EAChB,OAAgB,EAChB,OAAe,EACf,IAAY;IAEZ,IAAI,OAAO,CAAC,OAAO,KAAK,MAAM,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;QACjC,IAAI,CAAC,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACjF,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,0BAA0B,OAAO,CAAC,OAAO,cAAc,EAAE,CAAC;IACtF,CAAC;IAED,MAAM,KAAK,GAAG,OAAO,CAAC,QAAQ,EAAE,CAAC;IACjC,MAAM,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,OAAO,EAAE,KAAK,CAAC,CAAC;IAChE,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,OAAO,CAAC,GAAG,CACT,iBAAiB,IAAI,yBAAyB,OAAO,CAAC,OAAO,6BAA6B,OAAO,CAAC,OAAO,IAAI,CAC9G,CAAC;QACF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,OAAO,EAAE,CAAC;IACzC,CAAC;IACD,OAAO,CAAC,GAAG,CACT,8BAA8B,IAAI,OAAO,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,OAAO,IAAI,CAC5F,CAAC;IACF,IAAI,OAAO,CAAC,OAAO,EAAE,CAAC;QACpB,OAAO,CAAC,GAAG,CACT,iSAAiS,CAClS,CAAC;IACJ,CAAC;IACD,OAAO,CAAC,GAAG,CAAC,wBAAwB,gBAAgB,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,IAAI,CAAC,CAAC;IACpF,OAAO;QACL,KAAK,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAW;QACpD,QAAQ,EAAE,SAAS,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAW;KACxD,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAAc;IAEd,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACvB,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,2FAA2F;SACpG,CAAC;IACJ,CAAC;IACD,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,KAAK,EAAE,CAAC;IACjE,IAAI,iBAAiB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,KAAK,IAAI,EAAE,CAAC;QACrD,OAAO;YACL,EAAE,EAAE,KAAK;YACT,MAAM,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,6LAA6L;SAC9N,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC;AACxC,CAAC;AAED,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAU,EAAE,CACnD,oFAAoF,eAAe,gGAAgG,eAAe,mBAAmB,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC;AAErR;;;;;GAKG;AACH,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,OAAO,GAAG,KAAK,CACnB,UAAU,EACV,IAAI,EACJ,OAAO,EACP,GAAG,EACH,IAAI,EACJ,mBAAmB,EACnB,aAAa,CACd,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,OAAO,UAAU,CACf,OAAO,EACP,KAAK,EACL,uBAAuB,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,EAAE,EAC9C,mBAAmB,CACpB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,GAAG,CACT,2DAA2D,eAAe,6KAA6K,CACxP,CAAC;IAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,eAAe,CAAC,CAAC,CAAC;IAC7F,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,KAAK,GAAG,QAAQ,CACpB,OAAO,EACP,OAAO,CAAC,QAAQ,EAChB,6CAA6C,EAC7C,kBAAkB,CACnB,CAAC;IACF,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,2EAA2E;QAC3E,4EAA4E;QAC5E,OAAO,aAAa,CAClB,OAAO,EACP,KAAK,CAAC,MAAM,KAAK,SAAS;YACxB,CAAC,CAAC,8CAA8C;YAChD,CAAC,CAAC,2BAA2B,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,gCAAgC,CACtF,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC;IAE7B,MAAM,OAAO,GAAG,UAAU,CACxB,OAAO,EACP,OAAO,CAAC,OAAO,EACf,CAAC,EAAE,GAAG,EAAE,eAAe,EAAE,KAAK,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,CAAC,EAC/D,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACrC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CACT,6DAA6D,OAAO,CAAC,OAAO,8EAA8E,CAC3J,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,uBAAuB;AACvB,8EAA8E;AAE9E,MAAM,UAAU,GAAG,CAAC,KAAkB,EAAU,EAAE,CAChD,wIAAwI,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,uHAAuH,KAAK,CAAC,aAAa,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,eAAe,CAAC,IAAI,EAAE,QAAQ,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,OAAO,EAAE,CAAC;AAE7gB,gFAAgF;AAChF,MAAM,UAAU,iBAAiB,CAC/B,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,gBAAgB,EAAE,UAAU,CAAC,CAAC;IACvF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC9E,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,MAAM,QAAQ,GAAG,gBAAgB,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,OAAO,CAAC,GAAG,CACT,mDAAmD,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,uGAAuG,QAAQ,KAAK,2BAA2B,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,EAAE,4BAA4B,CACtR,CAAC;IAEF,4EAA4E;IAC5E,2EAA2E;IAC3E,sDAAsD;IACtD,IAAI,WAAW,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC/C,OAAO,CAAC,GAAG,CACT,YAAY,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,wRAAwR,CAClU,CAAC;QACF,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,mCAAmC,CAAC,EAAE,CAAC;YACnE,OAAO,CAAC,GAAG,CAAC,sDAAsD,CAAC,CAAC;YACpE,OAAO,OAAO,CAAC;QACjB,CAAC;IACH,CAAC;IAED,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CACjC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,QAAQ,CAAC,eAAe,EAChC,kBAAkB,CACnB,CAAC;IACF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpC,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAE3C,MAAM,OAAO,GAAG,UAAU,CACxB,OAAO,EACP,OAAO,CAAC,OAAO,EACf,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EACnE,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACrC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtD,OAAO,CAAC,GAAG,CACT,0BAA0B,QAAQ,yMAAyM,CAC5O,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,0BAA0B;AAC1B,8EAA8E;AAE9E,MAAM,aAAa,GAAG,CAAC,KAAkB,EAAU,EAAE,CACnD,mFAAmF,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,uHAAuH,KAAK,CAAC,WAAW,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,EAAE,QAAQ,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,OAAO,qHAAqH,KAAK,CAAC,WAAW,6BAA6B,CAAC;AAErnB,wFAAwF;AACxF,MAAM,UAAU,oBAAoB,CAClC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,OAAO,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,EAAE,mBAAmB,EAAE,aAAa,CAAC,CAAC;IAChG,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,mBAAmB,EAAE,UAAU,CAAC,CAAC;IACpF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,MAAM,QAAQ,GAAG,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IAC/C,MAAM,QAAQ,GAAG,QAAQ,IAAI,oBAAoB,CAAC;IAElD,OAAO,CAAC,GAAG,CACT,mXAAmX,CACpX,CAAC;IAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,QAAQ,CAAC,CAAC,CAAC;IACtF,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CACjC,OAAO,EACP,OAAO,EACP,OAAO,CAAC,QAAQ,CAAC,cAAc,EAC/B,iBAAiB,CAClB,CAAC;IACF,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpC,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAE3C,MAAM,OAAO,GAAG,UAAU,CACxB,OAAO,EACP,OAAO,CAAC,OAAO,EACf,CAAC,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EACnE,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACrC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtD,IAAI,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtB,0EAA0E;QAC1E,yEAAyE;QACzE,sEAAsE;QACtE,OAAO,CAAC,GAAG,CACT,6GAA6G,QAAQ,oRAAoR,QAAQ,+BAA+B,CACjb,CAAC;IACJ,CAAC;SAAM,CAAC;QACN,OAAO,CAAC,GAAG,CACT,+BAA+B,QAAQ,2HAA2H,CACnK,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,uCAAuC;AACvC,8EAA8E;AAE9E,MAAM,eAAe,GAAG,CAAC,KAAkB,EAAU,EAAE,CACrD,gFAAgF,cAAc,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,uHAAuH,cAAc,IAAI,SAAS,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,EAAE,QAAQ,KAAK,CAAC,OAAO,iBAAiB,KAAK,CAAC,OAAO,0IAA0I,CAAC;AAE5kB;;;;;;;;;;;;;GAaG;AACH,SAAS,eAAe,CAAC,IAAc,EAAE,OAAgB;IACvD,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,IAAI,EAAE,EAAE,GAAG,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChE,IAAI,CAAC,MAAM,CAAC,EAAE;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,OAAO,EAAE,qBAAqB,CAAC,CAAC;IACxF,MAAM,EAAE,GAAG,UAAU,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;IAClD,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpB,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,6HAA6H,EAC7H,qBAAqB,CACtB,CAAC;IACJ,CAAC;IACD,MAAM,GAAG,GAAG,aAAa,EAAE,CAAC;IAC5B,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QACjB,2EAA2E;QAC3E,uEAAuE;QACvE,wDAAwD;QACxD,MAAM,OAAO,GAAG,GAAG,cAAc,kEAAkE,IAAI,CAAC,SAAS,CAAC,EAAE,CAAC,qKAAqK,CAAC;QAC3R,IAAI,IAAI;YAAE,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,wBAAwB,EAAE,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,CAAC;;YAChG,OAAO,CAAC,GAAG,CAAC,aAAa,OAAO,IAAI,CAAC,CAAC;QAC3C,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,MAAM,MAAM,GAAG,cAAc,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IACvC,IAAI,IAAI,EAAE,CAAC;QACT,OAAO,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,EAAE,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,CAAC,IAAI,CAAC,CAAC;QACjF,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,OAAO,CAAC,GAAG,CACT,iCAAiC,EAAE,sBAAsB,cAAc,UAAU,MAAM,kEAAkE,MAAM,iRAAiR,EAAE,gJAAgJ,MAAM,qKAAqK,CAC9uB,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,+EAA+E;AAC/E,MAAM,UAAU,qBAAqB,CACnC,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,8EAA8E;IAC9E,8EAA8E;IAC9E,IAAI,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC;QAAE,OAAO,eAAe,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;IAEjE,MAAM,OAAO,GAAG,KAAK,CACnB,YAAY,EACZ,IAAI,EACJ,OAAO,EACP,GAAG,EACH,IAAI,EACJ,qBAAqB,EACrB,eAAe,EACf,EAAE,MAAM,EAAE,QAAQ,EAAE,CACrB,CAAC;IACF,IAAI,OAAO,CAAC,IAAI,KAAK,SAAS;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACpD,MAAM,OAAO,GAAG,OAAO,CAAC;IAExB,MAAM,KAAK,GAAG,YAAY,CAAC,OAAO,CAAC,KAAK,EAAE,OAAO,EAAE,qBAAqB,EAAE,YAAY,CAAC,CAAC;IACxF,IAAI,CAAC,KAAK,CAAC,EAAE;QAAE,OAAO,KAAK,CAAC,IAAI,CAAC;IAEjC,OAAO,CAAC,GAAG,CACT,4sBAA4sB,CAC7sB,CAAC;IAEF,MAAM,IAAI,GAAG,gBAAgB,CAAC,OAAO,EAAE,OAAO,CAAC,QAAQ,EAAE,OAAO,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC,CAAC,CAAC;IAC5F,IAAI,CAAC,IAAI,CAAC,EAAE;QAAE,OAAO,WAAW,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IACxD,IAAI,IAAI,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC5B,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;QACtD,OAAO,OAAO,CAAC;IACjB,CAAC;IAED,MAAM,MAAM,GAAG,oBAAoB,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,CAAC,QAAQ,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAChG,IAAI,MAAM,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC;IACpC,IAAI,QAAQ,IAAI,MAAM;QAAE,OAAO,MAAM,CAAC,IAAI,CAAC;IAE3C,MAAM,OAAO,GAAG,UAAU,CACxB,OAAO,EACP,OAAO,CAAC,OAAO,EACf,CAAC,EAAE,GAAG,EAAE,cAAc,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,EACzE,IAAI,CAAC,KAAK,CACX,CAAC;IACF,IAAI,CAAC,OAAO,CAAC,EAAE;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC;IACrC,aAAa,CAAC,OAAO,EAAE,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,CAAC;IAEtD,0EAA0E;IAC1E,2EAA2E;IAC3E,qDAAqD;IACrD,OAAO,CAAC,GAAG,CACT,mBAAmB,cAAc,utBAAutB,CACzvB,CAAC;IACF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,8EAA8E;AAC9E,WAAW;AACX,8EAA8E;AAE9E,gFAAgF;AAChF,MAAM,UAAU,YAAY,CAC1B,IAAc,EACd,OAAgB,EAChB,GAAW,EACX,IAAI,GAAc,EAAE;IAEpB,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,CAAC;IACpB,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IAC3B,MAAM,IAAI,GAAG,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IAErC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACtB,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,yCAAyC,EAAE,UAAU,CAAC,CAAC;IAC1F,CAAC;IACD,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;QACvD,OAAO,CAAC,GAAG,CAAC,GAAG,UAAU,IAAI,CAAC,CAAC;QAC/B,OAAO,OAAO,CAAC;IACjB,CAAC;IACD,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9E,IAAI,GAAG,KAAK,OAAO;QAAE,OAAO,iBAAiB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACxE,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,oBAAoB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC9E,4EAA4E;IAC5E,4EAA4E;IAC5E,yEAAyE;IACzE,wEAAwE;IACxE,0CAA0C;IAC1C,IAAI,GAAG,KAAK,YAAY;QAAE,OAAO,qBAAqB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IACjF,wEAAwE;IACxE,4EAA4E;IAC5E,yEAAyE;IACzE,2EAA2E;IAC3E,4EAA4E;IAC5E,IAAI,GAAG,KAAK,YAAY;QAAE,OAAO,sBAAsB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAClF,0EAA0E;IAC1E,yEAAyE;IACzE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5E,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5E,6EAA6E;IAC7E,0EAA0E;IAC1E,sEAAsE;IACtE,IAAI,GAAG,KAAK,SAAS;QAAE,OAAO,mBAAmB,CAAC,IAAI,EAAE,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;IAC5E,oEAAoE;IACpE,8EAA8E;IAC9E,yDAAyD;IACzD,IAAI,GAAG,KAAK,UAAU;QAAE,OAAO,UAAU,CAAC,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;IAC7F,OAAO,UAAU,CACf,OAAO,EACP,IAAI,EACJ,sBAAsB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,yBAAyB,EAClE,UAAU,CACX,CAAC;AACJ,CAAC"}