autonomous-sdlc-harness 0.1.0

package/dist/commands/config.js

@@ -0,0 +1,561 @@
+/**
+ * Command: `config` — read and update `harness.config.json`.
+ *
+ * **The rule this module exists to enforce: this command is exactly as wide as the one line the
+ * shipped documentation promises for it — read and update — and no wider.** It addresses one value
+ * at a time by a dotted key path, prints it or replaces it, and hands every judgement about whether
+ * the result is a legal config to `config/check.ts`. It is **not** a validator: the gate that checks
+ * a file against `schemas/harness.config.schema.json` is `npm run validate:config`, whose validator
+ * is a workspace development dependency this package does not ship and this command does not read.
+ * The structural check that does run here runs on the **result of the edit**, and exists for exactly
+ * one reason — to stop this command corrupting the file it was asked to change. It also runs on the
+ * **input**: `get` and `set` refuse a `harness.config.json` that already carries an `error` problem,
+ * before a value is read or a mutator applied. `list` does not — see below.
+ *
+ * ## Three non-obvious choices, and where each comes from
+ *
+ * 1. **There is no key table in this file.** A typo (`commands.tset`), an unknown section and a
+ *    value whose type contradicts the one its key holds are all refused by the same mechanism: the
+ *    edit is applied to a private copy and `config/check.ts` is run over the whole result, which
+ *    already reports an unknown key at *every* level and the declared type of every declared key. A
+ *    second table here would be a third copy of the key set — after the declared contract and
+ *    `config/model.ts` — and the day it drifted, this command would refuse a legal key or write an
+ *    illegal one.
+ * 2. **`set` applies its write plan with `force: true`, always, and never with `--force`.**
+ *    `config/io.ts` enqueues the update as `create-if-absent`, which is the write engine's only
+ *    content-replacing policy; applied without force, the engine would record `kept` and the edit
+ *    would silently not land. Forcing is therefore not an escalation here, it is the ordinary path —
+ *    and it carries a safety property worth having for the one command whose job is to change a file
+ *    the adopter owns: the engine copies the previous file to a `.bak` sibling before replacing it,
+ *    so the values that were there stay one file away. The global `--force` flag is not consulted:
+ *    there is nothing about this command for it to escalate.
+ * 3. **A value is read as JSON first and as a plain string second.** `set phases.qa true` has to set
+ *    the boolean rather than the four-letter word, and `set commands.test "bash scripts/test.sh"`
+ *    has to set the string rather than fail to parse. Trying JSON and falling back gives both
+ *    without a type flag, and a caller who wants the *string* `3` writes it as `'"3"'`.
+ *
+ * ## What this command deliberately does not do
+ *
+ * - **It does not fill in defaults.** `list` prints the file as it stands, because `get` reports an
+ *   unset key as absent and exits non-zero; a `list` that merged declared defaults in would answer a
+ *   question `get` answers differently, and the two views would disagree about the same file.
+ * - **It does not refuse to `list` a broken config.** `list` is the one verb that prints a file
+ *   carrying shape errors, reporting each as a warning on stderr, so the configuration most in need
+ *   of repair is the one an adopter can still read. `get` and `set` refuse it: both act on a single
+ *   value, and a value read out of a file whose shape is wrong is not one to act on.
+ * - **It does not address a list element by element.** `layers` and `protectedBranches` are set and
+ *   printed whole. Order matters in both, and a flat string path is a poor way to express an
+ *   insertion, a removal or a reorder.
+ * - **It does not remove a key.** A value can be replaced; deleting an optional key is a hand edit,
+ *   which keeps the number of ways this command can shrink an adopter's config at zero.
+ * - **It writes nothing but `harness.config.json`** (plus that file's `.bak` sibling, written by the
+ *   engine), and it runs no external command. It does *read* one other file: a `set` of a branch-guard
+ *   key opens the generated pre-push hook to grade its `case` label against the set the result
+ *   resolves, because the alternative is asserting that state unread ({@link guardState}).
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { formatProblem } from '../config/check.js';
+import { readParsedConfig, requireConfig, updateConfig } from '../config/io.js';
+import { COMMAND_NONE_SENTINEL, CONFIG_FILENAME, DEFAULTS, NONE_SENTINEL_KEY, } from '../config/model.js';
+import { EXIT, HarnessError } from '../core/errors.js';
+import { resolveRepoRoot } from '../core/git.js';
+import { formatJson, isJsonObject } from '../core/json.js';
+import { WritePlan } from '../core/writer.js';
+import { caseLabelMatches, PRE_PUSH_HOOK, readProtectedCaseLabel, resolveGithooksDir, resolveProtectedBranches, } from '../generators/githooks.js';
+import { configKeyPath, wrappedKeyMismatch, wrappedKeyMismatchMessage, WRAPPER_SCRIPTS, } from '../generators/scripts.js';
+/**
+ * The command's one-line summary, in the usage block and at the head of its own `--help`.
+ *
+ * It is the string the registry has carried since the skeleton, and `cli/README.md` repeats it. This
+ * command implements that promise; it does not restate it more widely.
+ */
+const SUMMARY = 'Read and update harness.config.json';
+/** The roadmap item this command belongs to, as the registry reports it. */
+const ROADMAP_ITEM = 13;
+/** How the CLI is typed, for the messages that tell an operator what to run next. The `npx` prefix is not decoration: the rule for which occurrences carry it is stated once in `commands/init.ts`, beside its own `CLI`. */
+const CLI = 'npx autonomous-sdlc-harness';
+/** The three verbs, in the order `--help` lists them. */
+const VERBS = ['list', 'get', 'set'];
+/** What each verb takes after itself, named as `--help` names it. The arity check reads this. */
+const OPERANDS = {
+    list: [],
+    get: ['<key>'],
+    set: ['<key>', '<value>'],
+};
+/**
+ * How the command is invoked, written once: the registry's generic `config [options]` synopsis line
+ * cannot show a required verb, and a refusal quotes the same form back at whoever typed it wrong.
+ */
+const INVOCATION_FORM = `${CLI} config list | get <key> | set <key> <value>`;
+/** The lines the registry renders under this command's synopsis. */
+const CONFIG_USAGE = Object.freeze([
+    `The verb is required: ${INVOCATION_FORM}`,
+    '',
+    'Verbs:',
+    `  list               Print ${CONFIG_FILENAME} as it stands, formatted, problems and all`,
+    '  get <key>          Print one value, addressed by a dotted key path',
+    '  set <key> <value>  Replace one value and write the file back',
+    '',
+    '<key> is a dotted path into the file: defaultBranch, commands.test, phases.qa, qa.portSeed,',
+    'layers. A list is addressed as a whole — get layers prints it and set layers <json> replaces',
+    'it — never element by element.',
+    '',
+    '<value> is read as JSON when it parses as JSON, and as a plain string when it does not:',
+    '  set phases.qa true                       the boolean true',
+    '  set qa.portSeed 3001                     the number 3001',
+    '  set commands.test "bash scripts/test.sh" that string',
+    `  ${`set commands.${NONE_SENTINEL_KEY} "${COMMAND_NONE_SENTINEL}"`.padEnd(40)} the answer that this repository has no type check`,
+    '  set projectName \'"3"\'                    the string 3 rather than the number',
+    '',
+    'A <value> that would be read as one of the global options above is separated with --, which',
+    'stops flag parsing: set commands.build -- --version.',
+    '',
+    'get prints a string raw and anything else as JSON, so a shell can consume it directly, and it',
+    'exits non-zero when the key is not set. An optional key with no value is absent from the file',
+    'rather than written as null, and no declared default is filled in for it.',
+    '',
+    'set refuses and writes nothing when the key is not one the file may carry — a typo is an error,',
+    'not a new setting — when the value contradicts the type that key holds, or when the result would',
+    'fail the structural check; every problem found is reported, not only the first. A dot-named',
+    'stateDir is refused there, because the run-artifact tree has to be writable by an unattended run.',
+    '',
+    'set accepts a raw command line at commands.typecheck, commands.test, commands.devServer or',
+    'deploy.command and reports it, because the next init writes the wrapper script from that line and',
+    'the value the permission profile allow-lists is bash <scriptsDir>/<name>.sh.',
+    '',
+    `set commands.${NONE_SENTINEL_KEY} "${COMMAND_NONE_SENTINEL}" is the answer that this repository has no type check: exactly`,
+    'that, unquoted and lower-case. It is an answer rather than an unfilled key, so it is accepted',
+    `without a warning, no ${NONE_SENTINEL_KEY}.sh is written for it and no permission entry is implied. It is`,
+    'recognised on that one key — written into any other commands.* key it is stored and run as a',
+    'command line, and set says so — and a near miss such as none or <None> is a command line too,',
+    'reported by name.',
+    '',
+    'set defaultBranch or protectedBranches reports what the edit leaves behind: the guards resolve the',
+    'two keys into one protected set, so setting one alone leaves the other in it, and the committed',
+    '<githooksDir>/pre-push hook keeps the branch set it was rendered with until init re-renders it.',
+    '',
+    `get and set refuse a ${CONFIG_FILENAME} that already fails the structural check, before the key is`,
+    'read or the edit applied; every problem in it is named. list does not — it prints what parsed and',
+    'reports the problems as warnings, so a config with a typo can still be read here and repaired by',
+    'hand. Nothing that did not parse is printed: an absent or unparsable file is refused by all three.',
+    '',
+    `set writes a ${CONFIG_FILENAME}.bak sibling before replacing the file, every time, so the previous`,
+    'values stay one file away. Key order and formatting are preserved, so the diff is the changed',
+    'value and nothing else.',
+    '',
+    '--dry-run prints the before and after values and writes nothing. Every refusal still applies',
+    'under it, so a dry run cannot report a success a real run would not have.',
+    '',
+    'This command reads and updates the file; it does not validate it against the contract published',
+    'for editors and CI. `npm run validate:config` at the workspace root is that gate.',
+]);
+/** `list, get or set` — the verb list as a sentence, for a refusal. */
+function verbList() {
+    return `${VERBS.slice(0, -1).join(', ')} or ${VERBS[VERBS.length - 1]}`;
+}
+/** The usage a bad invocation is refused with: the form, and where the rest of it is. */
+function usageHint() {
+    return `usage: \`${INVOCATION_FORM}\` — run \`${CLI} config --help\` for the full usage`;
+}
+/**
+ * Parse the verb and its operands, positionally.
+ *
+ * The operands are taken by position rather than by pattern, so a value that begins with `-` is
+ * still a value: `set commands.build "-x"` is a legal thing to want, and a parser that treated it as
+ * a flag would refuse it. The one exception is a value spelled exactly like one of the six global
+ * options, which the entry point consumes before this command is reached; `--` stops that parsing,
+ * which is why the usage names it. A token in the *verb* or *key* position that begins with `-` is
+ * refused, since neither can legally start that way and a mistyped flag is the likely cause.
+ *
+ * A missing verb, an unknown verb and a wrong operand count are refusals rather than defaults: `set`
+ * changes a file the adopter owns, and there is no verb harmless enough to be the default.
+ */
+function parseInvocation(argv) {
+    const [verbToken, ...rest] = argv;
+    if (verbToken === undefined) {
+        throw new HarnessError(`config: no verb given — expected ${verbList()}; ${usageHint()}`);
+    }
+    if (verbToken.startsWith('-')) {
+        throw new HarnessError(`config: unknown option ${JSON.stringify(verbToken)} — ${usageHint()}`);
+    }
+    if (!VERBS.includes(verbToken)) {
+        throw new HarnessError(`config: unknown verb ${JSON.stringify(verbToken)} — expected ${verbList()}; ${usageHint()}`);
+    }
+    const verb = verbToken;
+    const expected = OPERANDS[verb];
+    if (rest.length < expected.length) {
+        throw new HarnessError(`config ${verb}: expected \`config ${verb} ${expected.join(' ')}\` — ${usageHint()}`);
+    }
+    if (rest.length > expected.length) {
+        const takes = expected.length === 0 ? 'takes no arguments' : `takes exactly ${expected.join(' ')}`;
+        throw new HarnessError(`config ${verb}: unexpected argument ${JSON.stringify(rest[expected.length])} — config ${verb} ${takes}; ${usageHint()}`);
+    }
+    if (verb === 'list')
+        return { verb };
+    // Present by the arity check above.
+    const key = rest[0];
+    if (key.startsWith('-')) {
+        throw new HarnessError(`config ${verb}: unknown option ${JSON.stringify(key)} — ${usageHint()}`);
+    }
+    return verb === 'get' ? { verb, key } : { verb, key, value: rest[1] };
+}
+/** A key path split into its segments, refusing anything that cannot address a key. */
+function parseKeyPath(key) {
+    if (key === '')
+        throw new HarnessError(`config: the key is empty — ${usageHint()}`);
+    const segments = key.split('.');
+    if (segments.some((segment) => segment === '')) {
+        throw new HarnessError(`config: ${JSON.stringify(key)} is not a key path: one of its segments is empty`);
+    }
+    return segments;
+}
+/** What a value is, for a message: `a list`, `a string`, `null`. */
+function describe(value) {
+    if (value === null)
+        return 'null';
+    if (Array.isArray(value))
+        return 'a list';
+    return `a ${typeof value}`;
+}
+/**
+ * The refusal for a key path that tries to descend through something with no keys beneath it.
+ *
+ * The list case gets its own sentence because it has a different answer: the value is reachable, it
+ * is simply addressed whole.
+ */
+function notAContainer(key, walked, value) {
+    if (Array.isArray(value)) {
+        return new HarnessError(`config: ${key} reaches into ${walked}, which is a list — a list is addressed as a whole: \`${CLI} config get ${walked}\` prints it, and \`${CLI} config set ${walked} '<json>'\` replaces it`);
+    }
+    return new HarnessError(`config: ${key} reaches into ${walked}, which holds ${describe(value)}, so it has no keys beneath it`);
+}
+/** The value at a key path, or `undefined` when nothing is set there. */
+function readValue(config, key, segments) {
+    let current = config;
+    let walked = '';
+    for (const segment of segments) {
+        if (!isJsonObject(current))
+            throw notAContainer(key, walked, current);
+        if (!Object.hasOwn(current, segment))
+            return undefined;
+        current = current[segment];
+        walked = walked === '' ? segment : `${walked}.${segment}`;
+    }
+    return current;
+}
+/**
+ * Set the value at a key path on a config object, in place, and report what was there.
+ *
+ * A **missing** intermediate section is created rather than refused, because that is the ordinary
+ * case: `set qa.credentialsPath …` on a config with no `qa` section has to work. Creating it is safe
+ * precisely because nothing here decides whether the section is a legal one — a mistyped section
+ * name is created too, and is then reported by the structural check over the result, which names it
+ * as an unknown key and refuses the write.
+ */
+function assignValue(config, key, segments, value) {
+    const last = segments[segments.length - 1];
+    let current = config;
+    let walked = '';
+    for (const segment of segments.slice(0, -1)) {
+        walked = walked === '' ? segment : `${walked}.${segment}`;
+        const existing = Object.hasOwn(current, segment) ? current[segment] : undefined;
+        if (existing === undefined) {
+            const created = {};
+            current[segment] = created;
+            current = created;
+            continue;
+        }
+        if (!isJsonObject(existing))
+            throw notAContainer(key, walked, existing);
+        current = existing;
+    }
+    const existed = Object.hasOwn(current, last);
+    const previous = existed ? current[last] : undefined;
+    current[last] = value;
+    return { existed, previous };
+}
+/**
+ * A `<value>` operand as the JSON it parses as, or as itself when it does not parse.
+ *
+ * Falling back rather than refusing is what makes the common case typeable: almost every command
+ * line, branch name and path an adopter sets here is not valid JSON, and requiring them to be
+ * quoted twice would make the string case the awkward one.
+ */
+function parseValue(raw) {
+    try {
+        return JSON.parse(raw);
+    }
+    catch {
+        return raw;
+    }
+}
+/**
+ * One value as a line of output: a string raw, anything else as the same JSON the file is written
+ * in, minus the trailing newline the reporter adds itself.
+ *
+ * Raw for a string so `commands.test` can be substituted straight into a shell; JSON for everything
+ * else so a list or an object round-trips back through `set`.
+ */
+function render(value) {
+    return typeof value === 'string' ? value : formatJson(value).trimEnd();
+}
+/**
+ * `config list`: the file as it stands, in the CLI's single JSON format.
+ *
+ * It prints a config **carrying shape errors**, reporting each as a warning, where `get` and `set`
+ * refuse one. That is what "as it stands" has to mean: an unknown-key typo or an out-of-range value
+ * is exactly the state an adopter needs to see printed to repair it, and a `list` that refused it
+ * would leave them with no way to read the file through this command at all. Nothing that did not
+ * parse is printed — absent, unparsable or not a JSON object is still a refusal.
+ */
+function list(ctx) {
+    const repoRoot = resolveRepoRoot(ctx.cwd);
+    const loaded = readParsedConfig(repoRoot);
+    ctx.report.result(render(loaded.config));
+    // After the result, and on stderr, so the printed file stays a parsable document on stdout.
+    for (const problem of loaded.problems)
+        ctx.report.warn(formatProblem(problem));
+    return EXIT.OK;
+}
+/** `config get <key>`: one value, or a non-zero refusal naming the key that is not set. */
+function get(ctx, key) {
+    const repoRoot = resolveRepoRoot(ctx.cwd);
+    const config = requireConfig(repoRoot);
+    const value = readValue(config, key, parseKeyPath(key));
+    if (value === undefined) {
+        throw new HarnessError(`config get: ${key} is not set in ${CONFIG_FILENAME} — run \`${CLI} config list\` for every key the file carries. An optional key with no value is absent from the file rather than written as null, and no declared default is filled in for it`);
+    }
+    ctx.report.result(render(value));
+    return EXIT.OK;
+}
+/**
+ * The wrapper keys a dotted `<key>` can have changed: the one it names, or **every** wrapper key
+ * beneath it when the value set was the enclosing object. `set commands '<json>'` writes the same
+ * values a per-key `set` would, so the boundary report has to see it too (`docs/cli.md` §5).
+ *
+ * Matched against {@link configKeyPath} over {@link WRAPPER_SCRIPTS} rather than against four path
+ * literals here: `deploy`'s command lives at `deploy.command` rather than under `commands`, and a
+ * second copy of that mapping is the key table choice 1 of the module header refuses to keep.
+ */
+function wrapperKeysFor(key) {
+    return WRAPPER_SCRIPTS.filter((entry) => {
+        const path = configKeyPath(entry.key);
+        return path === key || path.startsWith(`${key}.`);
+    }).map((entry) => entry.key);
+}
+/**
+ * The two keys the branch guards read **together**: the protected set every guard enforces is
+ * `protectedBranches` unioned with `defaultBranch` (`generators/githooks.ts` →
+ * `resolveProtectedBranches`), so an edit to either one moves the set and neither moves it alone.
+ *
+ * Typed as key names of {@link HarnessConfig} rather than written as path literals, so a release
+ * that renames either key stops compiling here instead of leaving a report addressing a key the
+ * file no longer carries — the second key table choice 1 of the module header refuses to keep.
+ */
+const BRANCH_GUARD_KEYS = ['defaultBranch', 'protectedBranches'];
+/**
+ * The branch-guard keys a dotted `<key>` can have changed, on {@link wrapperKeysFor}'s shape: the
+ * one it names, or **every** guard key beneath it when the value set was an enclosing object.
+ *
+ * Both keys sit at the top level today, so `set protectedBranches '<json>'` — the whole list at
+ * once — is reached by the **equality** arm, and the prefix arm has no subject in this release. It
+ * is carried rather than dropped because it is what makes the helper survive either key moving
+ * under a section, which is the one shape {@link wrapperKeysFor} already has and this one does not:
+ * there, `test`'s command line is nested at `commands.test`, and the prefix arm is what
+ * `set commands '<json>'` is matched by. A `<key>` addressing the document itself is refused by
+ * {@link parseKeyPath} as an empty key path.
+ */
+function branchGuardKeysFor(key) {
+    return BRANCH_GUARD_KEYS.filter((path) => path === key || path.startsWith(`${key}.`));
+}
+/**
+ * Where the guard git runs lives, resolved through the generator that writes it.
+ *
+ * Caught rather than propagated: a `githooksDir` naming the repository root is refused by `init` and
+ * graded by `doctor` (`generators/githooks.ts` → `resolveGithooksDir`), and a `set` that has already
+ * written the file it was asked to change may not turn into that refusal on a key that has nothing to
+ * do with it. Where the directory does not resolve, the hook is named by its filename alone.
+ */
+function guardHookPath(config) {
+    try {
+        return `${resolveGithooksDir(config)}/${PRE_PUSH_HOOK}`;
+    }
+    catch {
+        return PRE_PUSH_HOOK;
+    }
+}
+/**
+ * What the guard on disk enforces, against the set the config now resolves.
+ *
+ * The label is **read** through the generator's own reader rather than asserted, which is the
+ * discipline `doctor`'s `pre-push-guard` check and `writeGitHooks`' re-render arm already apply to
+ * the same file: a `set` that told an adopter to run `init --force` over a guard that was already
+ * right would spend the write engine's one `.bak` generation for nothing, on every generated
+ * `create-if-absent` artifact in the repository.
+ *
+ * Both catches answer with a state rather than propagating, for {@link guardHookPath}'s reason — a
+ * `set` that has already written the file it was asked to change may not turn into a refusal. An
+ * unresolvable set is answered `'behind'`: it is the sentence this report carried before anything
+ * was read, and a value no hook can be rendered from is not one the hook on disk carries.
+ */
+function guardState(repoRoot, config, hookPath) {
+    let hookText;
+    try {
+        hookText = readFileSync(join(repoRoot, hookPath), 'utf8');
+    }
+    catch {
+        return 'absent';
+    }
+    const label = readProtectedCaseLabel(hookText);
+    if (label === undefined)
+        return 'unreadable';
+    try {
+        return caseLabelMatches(label, resolveProtectedBranches(config, () => { })) ? 'in-step' : 'behind';
+    }
+    catch {
+        return 'behind';
+    }
+}
+/** Branch patterns as a sentence: `"main", "release/*"` — a list rendered inline rather than as the multi-line JSON {@link render} produces for one. */
+function patternList(patterns) {
+    return patterns.map((pattern) => JSON.stringify(pattern)).join(', ');
+}
+/**
+ * What the sibling key holds while `defaultBranch` is being set, in the three states it can be in:
+ * unset, and therefore standing at the schema default the guards are rendered from; listing nothing,
+ * which resolves to the default branch and nothing else; or listing the names it lists.
+ */
+function siblingKeyState(listed) {
+    if (listed === undefined) {
+        return `protectedBranches is not set here, so it stands at its schema default (${patternList(DEFAULTS.protectedBranches)})`;
+    }
+    if (listed.length === 0)
+        return 'protectedBranches lists no branch, so the set is defaultBranch and nothing else';
+    return `protectedBranches still lists ${patternList(listed)}`;
+}
+/**
+ * What an edit to one half of the guard pair leaves behind, in one line.
+ *
+ * The sibling half is written only for `defaultBranch`, because that is the direction with a value
+ * to name: the key the adopter did **not** set still lists what it listed, and it is reported rather
+ * than offered as a change — narrowing a protected set is the one direction that fails unsafely, and
+ * this command does not remove a key at all (module header). The hook half is written for both, from
+ * `writeGitHooks`' own note, so the two re-render routes are named here in the words that note and
+ * `doctor`'s `pre-push-guard` check name them in — but only in the one state that is owed them:
+ * {@link guardState} grades the file first, so a hook already carrying this set, a hook that is not
+ * there and a hook nothing can read out of are each reported as themselves.
+ */
+function branchGuardMessage(repoRoot, config, matched) {
+    const hookPath = guardHookPath(config);
+    const sibling = !matched.includes('defaultBranch')
+        ? ''
+        : ` ${siblingKeyState(config.protectedBranches)}, and \`${CLI} config set protectedBranches '<json>'\` is what changes it: nothing removes an entry automatically and nothing will, because narrowing a protected set is the one direction that fails unsafely, so the edit is yours.`;
+    const state = guardState(repoRoot, config, hookPath);
+    const hook = state === 'behind'
+        ? ` The committed ${hookPath} hook carries the branch set it was rendered with rather than the set the configuration resolves, and a push is judged by that file: re-render it with \`${CLI} init --force\`, which copies ${hookPath} to ${hookPath}.bak and re-renders it from the config in effect; without --force, delete ${hookPath} and re-run \`${CLI} init\`, which re-renders the hook because it is create-if-absent`
+        : state === 'in-step'
+            ? ` The committed ${hookPath} hook already carries the set this configuration resolves, so nothing is owed to it by this edit.`
+            : state === 'absent'
+                ? ` There is no readable ${hookPath}, so nothing in this checkout judges a push against this set: re-run \`${CLI} init\`, which writes the hook because it is create-if-absent.`
+                : ` ${hookPath} carries no case label in the generated shape, so what it protects cannot be read out of it and cannot be compared with this set — \`${CLI} doctor\`'s pre-push-guard check reports that state on every run.`;
+    return (`the protected set every guard resolves is protectedBranches unioned with defaultBranch, so setting one of those two keys alone leaves the other in the set.${sibling}` +
+        hook);
+}
+/**
+ * `config set <key> <value>`: replace one value, guarded, and write the file back.
+ *
+ * The edit goes through `config/io.ts`'s update path, which re-reads the file, applies the mutator
+ * to a private copy, re-runs the structural check and refuses on any `error` — so a refusal here
+ * leaves the file exactly as it was, whichever of the guards produced it. Key order and formatting
+ * survive because the mutated object *is* the parsed file, written back through the one serializer.
+ *
+ * **The boundary.** This is the command an adopter fills a wrapped `commands.*` key in with, and the
+ * last point at which the raw command line they typed and the wrapper invocation the permission
+ * profile allow-lists are still distinguishable — by the time an agent is refused on the raw line,
+ * neither `init` nor `doctor` can tell which of the two the adopter meant. So the value is reported
+ * here, through {@link wrappedKeyMismatch}, whose sentence and condition this command shares with
+ * those two rather than restating.
+ *
+ * It is a **warning, not a refusal**, and the value is stored exactly as typed: the schema accepts it,
+ * the wrapper the next `init` writes runs it, and the documented repair for an undetected command is
+ * a two-step that passes through this state (set the raw line, re-run `init`, set the wrapper form).
+ * Normalising the value here — writing the invocation and putting the raw line in the wrapper —
+ * would make `get` answer something other than what was `set`, and would break the module header's
+ * *"It writes nothing but `harness.config.json`"*.
+ */
+function set(ctx, key, raw) {
+    const repoRoot = resolveRepoRoot(ctx.cwd);
+    const segments = parseKeyPath(key);
+    const value = parseValue(raw);
+    const plan = new WritePlan();
+    let assignment;
+    const updated = updateConfig(repoRoot, (config) => {
+        assignment = assignValue(config, key, segments, value);
+    }, plan);
+    if (assignment === undefined) {
+        throw new HarnessError('config set: the update was enqueued without the edit having been applied', EXIT.INTERNAL);
+    }
+    ctx.report.step(ctx.flags.dryRun ? `config set ${key} (dry run — nothing is written)` : `config set ${key}`);
+    ctx.report.result(assignment.existed ? `${key} was ${render(assignment.previous)}` : `${key} was not set`);
+    // Nothing to write is reported rather than performed: replacing a file with its own bytes would
+    // still make a .bak sibling and still log a replacement, which reads as a change that was not one.
+    const unchanged = assignment.existed && formatJson(assignment.previous) === formatJson(value);
+    if (unchanged) {
+        ctx.report.result(`${key} already holds that value, so ${CONFIG_FILENAME} was not rewritten`);
+    }
+    else {
+        ctx.report.result(ctx.flags.dryRun ? `${key} would become ${render(value)}` : `${key} is now ${render(value)}`);
+        // `force: true` unconditionally, and never `ctx.flags.force` — see choice 2 in the module header:
+        // the update is enqueued as create-if-absent, so an unforced apply would keep the file and the
+        // edit would silently not land. The engine writes the `.bak` sibling before replacing.
+        plan.apply({ repoRoot, report: ctx.report, dryRun: ctx.flags.dryRun, force: true });
+    }
+    // Asked of `updated.config` — the value that is landing, not the one that was there — and outside
+    // the arms above, so all three reach it: a `--dry-run` that withheld the line would report a
+    // success a real run would not have, and a `set` that changed nothing still leaves a repository
+    // carrying the defect.
+    for (const wrapperKey of wrapperKeysFor(key)) {
+        const mismatch = wrappedKeyMismatch(updated.config, wrapperKey);
+        if (mismatch !== undefined)
+            ctx.report.warn(wrappedKeyMismatchMessage(wrapperKey, mismatch));
+    }
+    // Beside the wrapper report, asked of the same object and outside the same arms, for the same
+    // reason: an edit to one half of the guard pair leaves the sibling key behind on every path, and a
+    // preview that withheld the line would report a success a real run would not have. What it says
+    // about the hook is graded against the file rather than assumed — including on a --dry-run, where
+    // the hook on disk is the one a real run would have left behind. One warning, whichever half was
+    // matched.
+    const branchGuardKeys = branchGuardKeysFor(key);
+    if (branchGuardKeys.length > 0)
+        ctx.report.warn(branchGuardMessage(repoRoot, updated.config, branchGuardKeys));
+    // Warnings only — an error would have been refused above. Reported because a `set` is often the
+    // fix for one of them, and the ones still outstanding are worth naming while the adopter is here.
+    for (const problem of updated.problems)
+        ctx.report.warn(formatProblem(problem));
+    return EXIT.OK;
+}
+/** Parse the verb and hand off. Every verb returns its own exit code and throws to refuse. */
+async function run(ctx) {
+    const invocation = parseInvocation(ctx.argv);
+    if (invocation.verb === 'list')
+        return list(ctx);
+    if (invocation.verb === 'get')
+        return get(ctx, invocation.key);
+    return set(ctx, invocation.key, invocation.value);
+}
+/**
+ * The registry row for this command.
+ *
+ * Exported as the row itself rather than as a `run` the table wraps, so the summary, the usage lines
+ * and the behaviour stay in the file that owns them. The import back to `commands/registry.ts` is
+ * type-only and therefore erased, so the table can list this row without a runtime cycle.
+ */
+export const CONFIG_COMMAND = {
+    name: 'config',
+    summary: SUMMARY,
+    roadmapItem: ROADMAP_ITEM,
+    usage: CONFIG_USAGE,
+    run,
+};
+//# sourceMappingURL=config.js.map

package/dist/commands/config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.js","sourceRoot":"","sources":["../../src/commands/config.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAEjC,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,gBAAgB,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAChF,OAAO,EACL,qBAAqB,EACrB,eAAe,EACf,QAAQ,EACR,iBAAiB,GAElB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,IAAI,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACvD,OAAO,EAAE,eAAe,EAAE,MAAM,gBAAgB,CAAC;AACjD,OAAO,EAAE,UAAU,EAAE,YAAY,EAAmC,MAAM,iBAAiB,CAAC;AAC5F,OAAO,EAAE,SAAS,EAAE,MAAM,mBAAmB,CAAC;AAC9C,OAAO,EACL,gBAAgB,EAChB,aAAa,EACb,sBAAsB,EACtB,kBAAkB,EAClB,wBAAwB,GACzB,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,yBAAyB,EACzB,eAAe,GAEhB,MAAM,0BAA0B,CAAC;AAGlC;;;;;GAKG;AACH,MAAM,OAAO,GAAG,qCAAqC,CAAC;AAEtD,4EAA4E;AAC5E,MAAM,YAAY,GAAG,EAAE,CAAC;AAExB,6NAA6N;AAC7N,MAAM,GAAG,GAAG,6BAA6B,CAAC;AAE1C,yDAAyD;AACzD,MAAM,KAAK,GAAG,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAU,CAAC;AAK9C,iGAAiG;AACjG,MAAM,QAAQ,GAAoD;IAChE,IAAI,EAAE,EAAE;IACR,GAAG,EAAE,CAAC,OAAO,CAAC;IACd,GAAG,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC;CAC1B,CAAC;AAEF;;;GAGG;AACH,MAAM,eAAe,GAAG,GAAG,GAAG,8CAA8C,CAAC;AAE7E,oEAAoE;AACpE,MAAM,YAAY,GAAsB,MAAM,CAAC,MAAM,CAAC;IACpD,yBAAyB,eAAe,EAAE;IAC1C,EAAE;IACF,QAAQ;IACR,8BAA8B,eAAe,4CAA4C;IACzF,sEAAsE;IACtE,gEAAgE;IAChE,EAAE;IACF,6FAA6F;IAC7F,8FAA8F;IAC9F,gCAAgC;IAChC,EAAE;IACF,yFAAyF;IACzF,6DAA6D;IAC7D,4DAA4D;IAC5D,wDAAwD;IACxD,KAAK,gBAAgB,iBAAiB,KAAK,qBAAqB,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC,oDAAoD;IAClI,kFAAkF;IAClF,EAAE;IACF,6FAA6F;IAC7F,sDAAsD;IACtD,EAAE;IACF,+FAA+F;IAC/F,+FAA+F;IAC/F,2EAA2E;IAC3E,EAAE;IACF,iGAAiG;IACjG,kGAAkG;IAClG,6FAA6F;IAC7F,mGAAmG;IACnG,EAAE;IACF,4FAA4F;IAC5F,mGAAmG;IACnG,8EAA8E;IAC9E,EAAE;IACF,gBAAgB,iBAAiB,KAAK,qBAAqB,iEAAiE;IAC5H,+FAA+F;IAC/F,yBAAyB,iBAAiB,iEAAiE;IAC3G,8FAA8F;IAC9F,+FAA+F;IAC/F,mBAAmB;IACnB,EAAE;IACF,oGAAoG;IACpG,iGAAiG;IACjG,iGAAiG;IACjG,EAAE;IACF,wBAAwB,eAAe,6DAA6D;IACpG,mGAAmG;IACnG,kGAAkG;IAClG,oGAAoG;IACpG,EAAE;IACF,gBAAgB,eAAe,qEAAqE;IACpG,+FAA+F;IAC/F,yBAAyB;IACzB,EAAE;IACF,8FAA8F;IAC9F,2EAA2E;IAC3E,EAAE;IACF,iGAAiG;IACjG,mFAAmF;CACpF,CAAC,CAAC;AAQH,uEAAuE;AACvE,SAAS,QAAQ;IACf,OAAO,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAW,EAAE,CAAC;AACpF,CAAC;AAED,yFAAyF;AACzF,SAAS,SAAS;IAChB,OAAO,YAAY,eAAe,cAAc,GAAG,qCAAqC,CAAC;AAC3F,CAAC;AAED;;;;;;;;;;;;GAYG;AACH,SAAS,eAAe,CAAC,IAAuB;IAC9C,MAAM,CAAC,SAAS,EAAE,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC;IAElC,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC5B,MAAM,IAAI,YAAY,CAAC,oCAAoC,QAAQ,EAAE,KAAK,SAAS,EAAE,EAAE,CAAC,CAAC;IAC3F,CAAC;IACD,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QAC9B,MAAM,IAAI,YAAY,CAAC,0BAA0B,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,MAAM,SAAS,EAAE,EAAE,CAAC,CAAC;IACjG,CAAC;IACD,IAAI,CAAE,KAA2B,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,YAAY,CAAC,wBAAwB,IAAI,CAAC,SAAS,CAAC,SAAS,CAAC,eAAe,QAAQ,EAAE,KAAK,SAAS,EAAE,EAAE,CAAC,CAAC;IACvH,CAAC;IAED,MAAM,IAAI,GAAG,SAAuB,CAAC;IACrC,MAAM,QAAQ,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC;IAChC,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,IAAI,YAAY,CAAC,UAAU,IAAI,uBAAuB,IAAI,IAAI,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,QAAQ,SAAS,EAAE,EAAE,CAAC,CAAC;IAC/G,CAAC;IACD,IAAI,IAAI,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC;QAClC,MAAM,KAAK,GAAG,QAAQ,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,iBAAiB,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;QACnG,MAAM,IAAI,YAAY,CACpB,UAAU,IAAI,yBAAyB,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,aAAa,IAAI,IAAI,KAAK,KAAK,SAAS,EAAE,EAAE,CACzH,CAAC;IACJ,CAAC;IAED,IAAI,IAAI,KAAK,MAAM;QAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAErC,oCAAoC;IACpC,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;IAC9B,IAAI,GAAG,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CAAC,UAAU,IAAI,oBAAoB,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,SAAS,EAAE,EAAE,CAAC,CAAC;IACnG,CAAC;IACD,OAAO,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC,CAAW,EAAE,CAAC;AAClF,CAAC;AAED,uFAAuF;AACvF,SAAS,YAAY,CAAC,GAAW;IAC/B,IAAI,GAAG,KAAK,EAAE;QAAE,MAAM,IAAI,YAAY,CAAC,8BAA8B,SAAS,EAAE,EAAE,CAAC,CAAC;IACpF,MAAM,QAAQ,GAAG,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAChC,IAAI,QAAQ,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,KAAK,EAAE,CAAC,EAAE,CAAC;QAC/C,MAAM,IAAI,YAAY,CAAC,WAAW,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,kDAAkD,CAAC,CAAC;IAC3G,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,oEAAoE;AACpE,SAAS,QAAQ,CAAC,KAAgB;IAChC,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,MAAM,CAAC;IAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,QAAQ,CAAC;IAC1C,OAAO,KAAK,OAAO,KAAK,EAAE,CAAC;AAC7B,CAAC;AAED;;;;;GAKG;AACH,SAAS,aAAa,CAAC,GAAW,EAAE,MAAc,EAAE,KAAgB;IAClE,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;QACzB,OAAO,IAAI,YAAY,CACrB,WAAW,GAAG,iBAAiB,MAAM,yDAAyD,GAAG,eAAe,MAAM,uBAAuB,GAAG,eAAe,MAAM,yBAAyB,CAC/L,CAAC;IACJ,CAAC;IACD,OAAO,IAAI,YAAY,CAAC,WAAW,GAAG,iBAAiB,MAAM,iBAAiB,QAAQ,CAAC,KAAK,CAAC,gCAAgC,CAAC,CAAC;AACjI,CAAC;AAED,yEAAyE;AACzE,SAAS,SAAS,CAAC,MAAkB,EAAE,GAAW,EAAE,QAA2B;IAC7E,IAAI,OAAO,GAAc,MAAM,CAAC;IAChC,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC;YAAE,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,CAAC,CAAC;QACtE,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACvD,OAAO,GAAG,OAAO,CAAC,OAAO,CAAc,CAAC;QACxC,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;IAC5D,CAAC;IACD,OAAO,OAAO,CAAC;AACjB,CAAC;AASD;;;;;;;;GAQG;AACH,SAAS,WAAW,CAAC,MAAkB,EAAE,GAAW,EAAE,QAA2B,EAAE,KAAgB;IACjG,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC,MAAM,GAAG,CAAC,CAAW,CAAC;IACrD,IAAI,OAAO,GAAe,MAAM,CAAC;IACjC,IAAI,MAAM,GAAG,EAAE,CAAC;IAEhB,KAAK,MAAM,OAAO,IAAI,QAAQ,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5C,MAAM,GAAG,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,MAAM,IAAI,OAAO,EAAE,CAAC;QAC1D,MAAM,QAAQ,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC,CAAE,OAAO,CAAC,OAAO,CAAe,CAAC,CAAC,CAAC,SAAS,CAAC;QAC/F,IAAI,QAAQ,KAAK,SAAS,EAAE,CAAC;YAC3B,MAAM,OAAO,GAAe,EAAE,CAAC;YAC/B,OAAO,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC;YAC3B,OAAO,GAAG,OAAO,CAAC;YAClB,SAAS;QACX,CAAC;QACD,IAAI,CAAC,YAAY,CAAC,QAAQ,CAAC;YAAE,MAAM,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;QACxE,OAAO,GAAG,QAAQ,CAAC;IACrB,CAAC;IAED,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IAC7C,MAAM,QAAQ,GAAG,OAAO,CAAC,CAAC,CAAE,OAAO,CAAC,IAAI,CAAe,CAAC,CAAC,CAAC,SAAS,CAAC;IACpE,OAAO,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;IACtB,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,CAAC;AAC/B,CAAC;AAED;;;;;;GAMG;AACH,SAAS,UAAU,CAAC,GAAW;IAC7B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAc,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,GAAG,CAAC;IACb,CAAC;AACH,CAAC;AAED;;;;;;GAMG;AACH,SAAS,MAAM,CAAC,KAAgB;IAC9B,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC,OAAO,EAAE,CAAC;AACzE,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,IAAI,CAAC,GAAmB;IAC/B,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,QAAQ,CAAC,CAAC;IAC1C,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAA8B,CAAC,CAAC,CAAC;IACjE,4FAA4F;IAC5F,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ;QAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAC/E,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,2FAA2F;AAC3F,SAAS,GAAG,CAAC,GAAmB,EAAE,GAAW;IAC3C,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,aAAa,CAAC,QAAQ,CAA0B,CAAC;IAChE,MAAM,KAAK,GAAG,SAAS,CAAC,MAAM,EAAE,GAAG,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC;IAExD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,MAAM,IAAI,YAAY,CACpB,eAAe,GAAG,kBAAkB,eAAe,YAAY,GAAG,+KAA+K,CAClP,CAAC;IACJ,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACjC,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED;;;;;;;;GAQG;AACH,SAAS,cAAc,CAAC,GAAW;IACjC,OAAO,eAAe,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE;QACtC,MAAM,IAAI,GAAG,aAAa,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;QACtC,OAAO,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC;IACpD,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;AAC/B,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,iBAAiB,GAAqC,CAAC,eAAe,EAAE,mBAAmB,CAAC,CAAC;AAEnG;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CAAC,GAAW;IACrC,OAAO,iBAAiB,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,KAAK,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC;AACxF,CAAC;AAED;;;;;;;GAOG;AACH,SAAS,aAAa,CAAC,MAAqB;IAC1C,IAAI,CAAC;QACH,OAAO,GAAG,kBAAkB,CAAC,MAAM,CAAC,IAAI,aAAa,EAAE,CAAC;IAC1D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,aAAa,CAAC;IACvB,CAAC;AACH,CAAC;AAED;;;;;;;;;;;;;GAaG;AACH,SAAS,UAAU,CACjB,QAAgB,EAChB,MAAqB,EACrB,QAAgB;IAEhB,IAAI,QAAgB,CAAC;IACrB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC;IAC5D,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,MAAM,KAAK,GAAG,sBAAsB,CAAC,QAAQ,CAAC,CAAC;IAC/C,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,YAAY,CAAC;IAE7C,IAAI,CAAC;QACH,OAAO,gBAAgB,CAAC,KAAK,EAAE,wBAAwB,CAAC,MAAM,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;IACpG,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,QAAQ,CAAC;IAClB,CAAC;AACH,CAAC;AAED,wJAAwJ;AACxJ,SAAS,WAAW,CAAC,QAA2B;IAC9C,OAAO,QAAQ,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;AACvE,CAAC;AAED;;;;GAIG;AACH,SAAS,eAAe,CAAC,MAAqC;IAC5D,IAAI,MAAM,KAAK,SAAS,EAAE,CAAC;QACzB,OAAO,0EAA0E,WAAW,CAAC,QAAQ,CAAC,iBAAiB,CAAC,GAAG,CAAC;IAC9H,CAAC;IACD,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,iFAAiF,CAAC;IAClH,OAAO,iCAAiC,WAAW,CAAC,MAAM,CAAC,EAAE,CAAC;AAChE,CAAC;AAED;;;;;;;;;;;GAWG;AACH,SAAS,kBAAkB,CACzB,QAAgB,EAChB,MAAqB,EACrB,OAAyC;IAEzC,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,CAAC,eAAe,CAAC;QAChD,CAAC,CAAC,EAAE;QACJ,CAAC,CAAC,IAAI,eAAe,CAAC,MAAM,CAAC,iBAAiB,CAAC,WAAW,GAAG,yNAAyN,CAAC;IACzR,MAAM,KAAK,GAAG,UAAU,CAAC,QAAQ,EAAE,MAAM,EAAE,QAAQ,CAAC,CAAC;IACrD,MAAM,IAAI,GACR,KAAK,KAAK,QAAQ;QAChB,CAAC,CAAC,kBAAkB,QAAQ,4JAA4J,GAAG,iCAAiC,QAAQ,OAAO,QAAQ,6EAA6E,QAAQ,iBAAiB,GAAG,mEAAmE;QAC/Z,CAAC,CAAC,KAAK,KAAK,SAAS;YACnB,CAAC,CAAC,kBAAkB,QAAQ,mGAAmG;YAC/H,CAAC,CAAC,KAAK,KAAK,QAAQ;gBAClB,CAAC,CAAC,yBAAyB,QAAQ,0EAA0E,GAAG,gEAAgE;gBAChL,CAAC,CAAC,IAAI,QAAQ,wIAAwI,GAAG,mEAAmE,CAAC;IACrO,OAAO,CACL,8JAA8J,OAAO,EAAE;QACvK,IAAI,CACL,CAAC;AACJ,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;GAqBG;AACH,SAAS,GAAG,CAAC,GAAmB,EAAE,GAAW,EAAE,GAAW;IACxD,MAAM,QAAQ,GAAG,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;IAC1C,MAAM,QAAQ,GAAG,YAAY,CAAC,GAAG,CAAC,CAAC;IACnC,MAAM,KAAK,GAAG,UAAU,CAAC,GAAG,CAAC,CAAC;IAE9B,MAAM,IAAI,GAAG,IAAI,SAAS,EAAE,CAAC;IAC7B,IAAI,UAAkC,CAAC;IACvC,MAAM,OAAO,GAAG,YAAY,CAC1B,QAAQ,EACR,CAAC,MAAM,EAAE,EAAE;QACT,UAAU,GAAG,WAAW,CAAC,MAA+B,EAAE,GAAG,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAC;IAClF,CAAC,EACD,IAAI,CACL,CAAC;IACF,IAAI,UAAU,KAAK,SAAS,EAAE,CAAC;QAC7B,MAAM,IAAI,YAAY,CAAC,0EAA0E,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpH,CAAC;IAED,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,cAAc,GAAG,iCAAiC,CAAC,CAAC,CAAC,cAAc,GAAG,EAAE,CAAC,CAAC;IAC7G,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,GAAG,GAAG,QAAQ,MAAM,CAAC,UAAU,CAAC,QAAqB,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,cAAc,CAAC,CAAC;IAExH,gGAAgG;IAChG,mGAAmG;IACnG,MAAM,SAAS,GAAG,UAAU,CAAC,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,QAAqB,CAAC,KAAK,UAAU,CAAC,KAAK,CAAC,CAAC;IAC3G,IAAI,SAAS,EAAE,CAAC;QACd,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,GAAG,iCAAiC,eAAe,oBAAoB,CAAC,CAAC;IAChG,CAAC;SAAM,CAAC;QACN,GAAG,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,GAAG,GAAG,iBAAiB,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,WAAW,MAAM,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAChH,kGAAkG;QAClG,+FAA+F;QAC/F,uFAAuF;QACvF,IAAI,CAAC,KAAK,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACtF,CAAC;IAED,kGAAkG;IAClG,6FAA6F;IAC7F,gGAAgG;IAChG,uBAAuB;IACvB,KAAK,MAAM,UAAU,IAAI,cAAc,CAAC,GAAG,CAAC,EAAE,CAAC;QAC7C,MAAM,QAAQ,GAAG,kBAAkB,CAAC,OAAO,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;QAChE,IAAI,QAAQ,KAAK,SAAS;YAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,yBAAyB,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC,CAAC;IAC/F,CAAC;IAED,8FAA8F;IAC9F,mGAAmG;IACnG,gGAAgG;IAChG,kGAAkG;IAClG,iGAAiG;IACjG,WAAW;IACX,MAAM,eAAe,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAC;IAChD,IAAI,eAAe,CAAC,MAAM,GAAG,CAAC;QAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,kBAAkB,CAAC,QAAQ,EAAE,OAAO,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC,CAAC;IAE/G,gGAAgG;IAChG,kGAAkG;IAClG,KAAK,MAAM,OAAO,IAAI,OAAO,CAAC,QAAQ;QAAE,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,aAAa,CAAC,OAAO,CAAC,CAAC,CAAC;IAEhF,OAAO,IAAI,CAAC,EAAE,CAAC;AACjB,CAAC;AAED,8FAA8F;AAC9F,KAAK,UAAU,GAAG,CAAC,GAAmB;IACpC,MAAM,UAAU,GAAG,eAAe,CAAC,GAAG,CAAC,IAAI,CAAC,CAAC;IAC7C,IAAI,UAAU,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC;IACjD,IAAI,UAAU,CAAC,IAAI,KAAK,KAAK;QAAE,OAAO,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,CAAC,CAAC;IAC/D,OAAO,GAAG,CAAC,GAAG,EAAE,UAAU,CAAC,GAAG,EAAE,UAAU,CAAC,KAAK,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,cAAc,GAAe;IACxC,IAAI,EAAE,QAAQ;IACd,OAAO,EAAE,OAAO;IAChB,WAAW,EAAE,YAAY;IACzB,KAAK,EAAE,YAAY;IACnB,GAAG;CACJ,CAAC"}