aweshare 0.3.3 → 0.3.5

package/README.md

@@ -14,7 +14,7 @@
     <a href="https://ko-fi.com/mugpeng"><img src="https://img.shields.io/badge/Ko--fi-Buy%20me%20a%20coffee-FF5E5B?style=flat-square&logo=ko-fi&logoColor=white" alt="Ko-fi"></a>
   </p>
   <p>
-     <a href="https://github.com/wehuman01/aweshare-source/releases"><img src="https://img.shields.io/badge/version-0.3.3-7C3AED?style=flat-square" alt="Version"></a>
+     <a href="https://github.com/wehuman01/aweshare-source/releases"><img src="https://img.shields.io/badge/version-0.3.5-7C3AED?style=flat-square" alt="Version"></a>
     <a href="https://github.com/wehuman01/aweshare"><img src="https://img.shields.io/badge/node-%E2%89%A522-0EA5E9?style=flat-square" alt="Node"></a>
     <a href="https://github.com/wehuman01/aweshare/blob/main/LICENSE"><img src="https://img.shields.io/badge/license-proprietary-E34F26?style=flat-square" alt="License"></a>
     <a href="https://www.npmjs.com/package/aweshare"><img src="https://img.shields.io/badge/npm-aweshare-7C3AED?style=flat-square" alt="npm package"></a>
@@ -55,7 +55,8 @@ Consumer (standard SDK, zero changes)         Producer side
 ## Trust boundary (read this first)
 
 - To route and meter, **consumer prompts and model responses transit the hub in plaintext — this is not end-to-end encryption**. The hub persists no request/response content, but the hub operator can technically see it. Only use a hub instance you trust — which is why the hub is open source and self-hostable.
-- Upstream API keys never leave the producer's device and are never sent to consumers; the hub authenticates tokens by SHA-256 hash. Since v4 the hub also stores the plaintext of tokens and invite codes it issues (NULL for older rows) so admins can re-display them with `hub token list --reveal` / `hub invite list --reveal` — treat the hub database as secret-bearing: a DB leak exposes every secret issued since v4.
+- Upstream API keys never leave the producer's device and are never sent to consumers. Tokens are stored **hash-only** (peppered SHA-256): the plaintext is shown exactly once at issue/redeem and can never be re-displayed. Invite codes are the deliberate exception — their plaintext is kept so the operator can re-view them with `hub list --reveal`; a DB leak exposes unredeemed codes, but no tokens.
+- Token revocation is **reversible suspension** (`hub revoke --id N` / `hub restore --id N`, by invite), and an invite and the producer it minted move together: revoking a redeemed code suspends that producer (and closes its tunnel), and restoring from either handle revives both. Nothing is deleted on revoke — grants, offerings and usage history survive a suspension.
 
 ### Compliance and disclaimer
 
@@ -86,42 +87,47 @@ docker run -d --name aweshare-hub --restart unless-stopped \
 docker exec aweshare-hub aweshare hub init   # first run: prints the admin token, save it
 ```
 
-Then issue tokens (admin token in hand):
-
-```bash
-aweshare hub token issue --role producer --name peng     # → asp_..., give to the producer
-aweshare hub token issue --role consumer --name alice    # → asc_..., give to the consumer
-```
-
-For producers there is also a self-service path — invite codes (`asi_…`, single use). Two modes:
+Then bring people in. Producers join on their own — invite codes (`asi_…`, single use). Two modes:
 
 ```bash
 # bound: lock the code to a specific name ("inviting that user")
-aweshare hub invite create --name peng [--expires-in 7d]      # → asi_..., send to the producer
+aweshare hub invite --name peng [--expires-in 7d]      # → asi_..., send to the producer
 
 # unbound: batch hand-out; the producer submits name + email at redeem (stored on the hub)
-aweshare hub invite create --count 10 [--expires-in 7d]
+aweshare hub invite --count 10 [--expires-in 7d]
 
 # the producer redeems it themselves (no token hand-off needed):
 aweshare agent join --hub https://hub.example.com --code asi_... [--name NAME --email YOU@EXAMPLE.COM]
 ```
 
+Consumers are few and known — their keys (`asc_…`) are issued directly via the admin API (the hub CLI is invite-only):
+
+```bash
+curl -X POST https://hub.example.com/admin/v1/tokens \
+  -H "Authorization: Bearer asa_... (the admin token)" -H "content-type: application/json" \
+  -d '{"role":"consumer","name":"alice"}'      # → asc_..., give to the consumer
+```
+
 Three token roles, one per party:
 
 | Role | Who holds it | How it's used |
 |---|---|---|
-| `admin` | hub operator (you only) | management commands: `hub token issue` / `grant add` / `token revoke` / `usage` |
+| `admin` | hub operator (you only) | the admin REST API (`/admin/v1/*`); CLI side: `hub invite` / `list` / `revoke` / `restore` |
 | `producer` (`asp_...`) | the agent on the producer's machine | set as `token` in `~/.aweshare/config.toml`; the agent registers its offerings with it |
 | `consumer` (`asc_...`) | whoever calls the models | set in SDK env vars (`ANTHROPIC_AUTH_TOKEN` / `OPENAI_API_KEY`); the hub uses it to decide which aliases they may call |
 
 The producer's `name` becomes their alias namespace (the `peng/` in `peng/gpt-4o`).
 
+Identity and permission are deliberately split. The operator issues identities — invite codes for producers, `asc_…` keys for consumers — while each producer alone decides who may call their own aliases (`aweshare agent grant`; the admin API can read grants for audit but cannot write them). A fresh consumer key can call nothing until a producer grants it, so the hub works the same whether you run everything yourself (private hub) or producers who don't know each other share yours (community hub).
+
 ### 2. Producer first run (in this order)
 
 ```bash
 npm install -g aweshare   # ⓪ once, on the producer machine (Node ≥ 22)
 
-# ① init: writes ~/.aweshare/config.toml + secrets.json (0600)
+# ① join with your invite code (writes ~/.aweshare/config.toml + secrets.json, 0600)
+aweshare agent join --hub https://hub.example.com --code asi_...
+#    or, with a producer token handed to you directly:
 aweshare agent init --hub https://hub.example.com --token asp_...
 
 # ② Edit the config (see below); put upstream keys in secrets.json — they never leave this machine
@@ -146,7 +152,7 @@ curl https://hub.example.com/v1/chat/completions \
   -d '{"model":"peng/qwen2.5.7b","messages":[{"role":"user","content":"ping"}]}'
 
 # ② configure your tool (below) → run one minimal task
-# ③ check usage: aweshare hub usage --alias peng/qwen2.5.7b
+# ③ check usage: GET /admin/v1/usage with your consumer key (you only see your own rows)
 # ④ only then move to real workloads
 ```
 
@@ -215,10 +221,13 @@ Key hygiene: use dedicated, least-privilege, revocable keys with budget alerts;
 Every consumer gets the hub-wide defaults (`AWESHARE_CONSUMER_RPS` / `BURST` / `CONCURRENCY`, see Operations). On top of that, the hub admin can set **sparse per-consumer overrides** — only the keys you set take effect, everything else keeps the defaults:
 
 ```bash
-aweshare hub consumer limits --name alice            # show current overrides
-aweshare hub consumer limits --name alice --tpm 60000 --max-total-tokens 5000000
-aweshare hub consumer limits --name alice --rps 2    # later calls merge, not replace
-aweshare hub consumer limits --name alice --clear    # back to hub-wide defaults
+# PUT /admin/v1/consumers/{name}/limits — sparse JSON; unset keys keep the defaults,
+# later PUTs merge into what is stored
+curl -X PUT https://hub.example.com/admin/v1/consumers/alice/limits \
+  -H "Authorization: Bearer asa_... (the admin token)" -H "content-type: application/json" \
+  -d '{"tpm":60000,"maxTotalTokens":5000000}'
+
+# DELETE the same path clears all overrides back to the hub-wide defaults
 ```
 
 | Key | Meaning | Enforcement |
@@ -227,9 +236,9 @@ aweshare hub consumer limits --name alice --clear    # back to hub-wide defaults
 | `tpm` | max tokens (prompt + completion) in any sliding 60s window | 429 `RATE_LIMITED` (in-memory window, like the RPS bucket) |
 | `maxTotalTokens` | lifetime token budget for this consumer | 429 `QUOTA_EXCEEDED` (sums `usage_events`) |
 
-Grants can also carry an expiry: `aweshare hub grant add --alias peng/gpt-4o --consumer alice --expires-in 7d` (or `aweshare agent grant … --expires-in 7d` on the producer side). An expired grant returns `403 GRANT_EXPIRED`; re-granting refreshes the expiry.
+Grants can also carry an expiry: `aweshare agent grant --alias peng/gpt-4o --consumer alice --expires-in 7d`. Grant writes are producer-owned — the admin API keeps read-only audit access but rejects admin-token writes with `403 NOT_GRANTED`. An expired grant returns `403 GRANT_EXPIRED`; re-granting refreshes the expiry.
 
-Honest limits: token-based caps count what upstreams report — Ollama streams report no usage, so they contribute 0. TPM is best-effort (concurrent requests that all pass before any finishes can overshoot); the lifetime budget is exact because it sums persisted rows.
+Honest limits: token-based caps count what upstreams report — Ollama streams report no usage, so they contribute 0. Both TPM and the lifetime budget are observed-usage thresholds, not hard reservations: one request can cross the threshold, and concurrent requests that start before earlier usage is recorded can overshoot it further. Once recorded usage has reached the threshold, new requests are rejected.
 
 ## Endpoints and errors
 
@@ -238,11 +247,11 @@ Honest limits: token-based caps count what upstreams report — Ollama streams r
 | `POST /v1/chat/completions` · `POST /v1/messages` · `POST /v1/responses` | inference (Bearer or `x-api-key`) |
 | `GET /v1/models` | aliases visible to this key, with status |
 | `GET /healthz` | liveness |
-| `/admin/v1/*` | token/grant/usage management (admin or producer token) · consumer limit overrides: `GET`/`PUT`/`DELETE /admin/v1/consumers/{name}/limits` (admin only) |
+| `/admin/v1/*` | token/limit/usage management (admin or producer token) · grants: writes producer-only, admin reads for audit · consumer limit overrides: `GET`/`PUT`/`DELETE /admin/v1/consumers/{name}/limits` (admin only) |
 
-Error semantics: `401` invalid key · `403` not granted or `GRANT_EXPIRED` · `404` unknown alias · `400 PROTOCOL_MISMATCH` protocol/alias mismatch · `429` rate limit, TPM or producer concurrency cap (`QUOTA_EXCEEDED` = lifetime token budget hit) · `502` upstream/tunnel failure (upstream 4xx/5xx passes through verbatim) · `503` producer offline / backend degraded · `504` timeout. Errors carry `{error:{code,message,requestId}}`; the requestId spans both sides' logs.
+Error semantics: `401` invalid key · `401 TOKEN_REVOKED` suspended token (ask the operator to restore it) · `403` not granted or `GRANT_EXPIRED` · `403 HUB_FULL` producer capacity reached · `404` unknown alias · `400 PROTOCOL_MISMATCH` protocol/alias mismatch · `429` rate limit, TPM or producer concurrency cap (`QUOTA_EXCEEDED` = lifetime token budget hit) · `502` upstream/tunnel failure (upstream 4xx/5xx passes through verbatim) · `503` producer offline / backend degraded · `504` timeout. Errors carry `{error:{code,message,requestId}}`; the requestId spans both sides' logs.
 
-Usage metering: one row per request (alias, real model, status, duration, byte counts, best-effort token counts), **zero content stored**. Producers list grants with `aweshare agent list`; query usage with `aweshare hub usage`.
+Usage metering: one row per request (alias, real model, status, duration, byte counts, best-effort token counts), **zero content stored**. Producers list grants with `aweshare agent list`; usage is queried via `GET /admin/v1/usage` (admin sees everything, producers and consumers their own slice).
 
 ## Command reference
 
@@ -254,16 +263,13 @@ Both sides at a glance — details in the sections above.
 |---|---|
 | `aweshare hub init` | create data dir + admin token (printed once) |
 | `aweshare hub serve [--host H] [--port N]` | run the hub |
-| `aweshare hub token issue --role producer\|consumer --name NAME` | issue a producer (`asp_…`) or consumer (`asc_…`) token |
-| `aweshare hub token list [--reveal]` · `aweshare hub token revoke --role R --id N` | list / revoke tokens (`--reveal` also shows the stored plaintext of tokens issued since v4) |
-| `aweshare hub invite create [--name NAME] [--count N] [--expires-in 7d]` | create one-time invite codes (`asi_…`, printed once; re-view with `invite list --reveal`); with `--name` bound to that producer, without it the producer submits name + email at redeem |
-| `aweshare hub invite list [--reveal]` · `aweshare hub invite revoke --id N` | list / revoke (unredeemed) invites (`--reveal` re-shows codes created since v4) |
-| `aweshare hub grant add --alias ns/model --consumer NAME [--expires-in 7d]` | grant (or refresh) access to an alias |
-| `aweshare hub grant list` · `aweshare hub grant remove --alias A --consumer NAME` | list / remove grants |
-| `aweshare hub consumer limits --name NAME [--rps N] [--burst N] [--concurrency N] [--tpm N] [--max-total-tokens N] [--clear]` | per-consumer overrides (see Consumer limits) |
-| `aweshare hub usage [--alias A] [--limit N]` | usage metering |
+| `aweshare hub invite [--name NAME] [--count N] [--expires-in 7d]` | mint one-time invite codes (`asi_…`, printed once; re-view with `list --reveal`); with `--name` bound to that producer, without it the producer submits name + email at redeem |
+| `aweshare hub list [--reveal] [--token]` | list invites (status: pending/used/suspended/revoked/expired); `--reveal` shows the codes, `--token` shows the producer token each minted, with last seen |
+| `aweshare hub revoke --id N` · `aweshare hub restore --id N` | kill an invite / undo — a redeemed code suspends the producer it minted, restore revives both |
+
+The CLI is invite-only: token issuance, consumer limits and usage left it when it narrowed — they live on the admin REST API (`/admin/v1/*`, see Endpoints and errors). Grants are producer-owned and were never the operator's CLI: manage them with `aweshare agent grant`/`revoke`/`list` on the producer machine (the admin API keeps read-only audit access).
 
-List and usage commands print aligned tables by default; append `--json` for the raw API response.
+`list` prints an aligned table by default; append `--json` for the raw API response.
 
 **Agent (producer)** — runs on the producer's machine (the one with the backends); consumers run no aweshare commands — they point a standard SDK at the hub (see Consumer tool configuration):
 
@@ -289,6 +295,8 @@ CLI maintenance: `aweshare self-update [--check]` updates the npm-installed CLI
 | `AWESHARE_CONSUMER_RPS` / `BURST` / `CONCURRENCY` | 10 / 20 / 8 | per-consumer limits |
 | `AWESHARE_HEAD_TIMEOUT_MS` / `IDLE_TIMEOUT_MS` | 120000 / 300000 | response-head timeout / stream idle timeout |
 | `AWESHARE_MAX_BODY_BYTES` | 32MB | request body cap |
+| `AWESHARE_INVITE_REDEEM_PER_MIN` | 10 | rate limit for the unauthenticated redeem endpoint |
+| `AWESHARE_MAX_PRODUCERS` | 10 | max active producers — token issuance (admin API), invite redeem and restore refuse with `403 HUB_FULL` when full |
 | `AWESHARE_NO_UPDATE_CHECK` | unset | set to `1` to disable the passive update reminder |
 
 Health: agent heartbeats every 15s, silent 45s = dead; backends with 2 consecutive AUTH/QUOTA failures auto-degrade (alias shows `degraded`, dispatch stops), 30s probes recover. A new connection with the same producer token replaces the old one (latest-wins).

package/apps/agent/dist/cli.js

@@ -8,37 +8,89 @@ import { agentDir, applyJoinToConfig, CONFIG_TEMPLATE, loadAgentConfig, redactCo
 import { AgentConnection } from './connection.js';
 import { runDoctor } from './doctor.js';
 import { renderGrants } from './table.js';
-const VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
-const USAGE = `aweshare agent — share local/authorized AI capacity through an aweshare hub
+const VERSION = JSON.parse(readFileSync(new URL('../../../package.json', import.meta.url), 'utf8')).version;
+// One-liners only; flags per command live in their own -h, everything else in README.
+const USAGE = `Usage: aweshare agent [OPTIONS] COMMAND [ARGS]...
 
-Usage: aweshare agent <command>
+  Share local/authorized AI capacity through an aweshare hub.
 
-Onboarding:
-  init [--hub URL] [--token asp_...]            write config template + empty secrets
-  join --hub URL --code asi_... [--name NAME] [--email EMAIL]
-                                                redeem an invite into a producer token
-                                                (unbound codes ask for --name/--email)
+Options:
+  -v, --version  Show the version and exit.
+  -h, --help     Show this message and exit.
 
-Config:
-  config path                                   print config path
-  config show                                   show config with secrets redacted
-  config edit                                   open config in $VISUAL, $EDITOR or vi
-  config init                                   write config template + empty secrets
+Commands:
+  init    Write the config template and empty secrets.
+  join    Redeem an invite code into a producer token.
+  config  Show or edit the config (path | show | edit).
+  doctor  Pre-flight checks: config, backends, hub.
+  start   Connect, register offerings, relay requests.
+  grant   Allow a consumer to call your offering.
+  revoke  Remove a grant.
+  list    List grants for your namespace.`;
+const COMMAND_HELP = {
+    init: `Usage: aweshare agent init [OPTIONS]
 
-Run:
-  start                                         connect, register offerings, relay
-  doctor                                        pre-flight checks (direct replay first, hub last)
+  Write the config template and empty secrets (kept if they exist).
 
-Grants:
-  grant --alias ALIAS --consumer NAME [--expires-in 7d|12h|30m|90s]
-                                                allow a consumer to call your offering
-  revoke --alias ALIAS --consumer NAME          remove a grant
-  list [--json]                                 list grants for your namespace
+Options:
+  --hub URL      Pre-fill the hub URL in the template.
+  --token ASP    Pre-fill a producer token (asp_...) in the template.
+  -h, --help     Show this message and exit.`,
+    join: `Usage: aweshare agent join [OPTIONS]
 
-  --json on list prints the raw API response instead of a table.
+  Redeem an invite code into a producer token and write the config.
 
-Environment:
-  AWESHARE_AGENT_DIR   config directory (default ~/.aweshare)`;
+Options:
+  --hub URL      The hub to join (required, http(s) URL).
+  --code CODE    The invite code from the hub operator (asi_..., required).
+  --name NAME    Your producer name (unbound codes only — bound ones ignore it).
+  --email EMAIL  Your contact email (unbound codes only).
+  -h, --help     Show this message and exit.`,
+    config: `Usage: aweshare agent config [COMMAND]
+
+  Show or edit the config (default: path).
+
+Commands:
+  path  Print the config path.
+  show  Show the config with secrets redacted.
+  edit  Open the config in $VISUAL, $EDITOR or vi.`,
+    doctor: `Usage: aweshare agent doctor
+
+  Pre-flight checks: config validity, backend reachability, hub connectivity.
+
+Options:
+  -h, --help  Show this message and exit.`,
+    start: `Usage: aweshare agent start
+
+  Connect to the hub, register offerings, relay requests (runs in the foreground).
+
+Options:
+  -h, --help  Show this message and exit.`,
+    grant: `Usage: aweshare agent grant [OPTIONS]
+
+  Allow a consumer to call your offering.
+
+Options:
+  --alias ALIAS      The offering alias, e.g. your-name/model (required).
+  --consumer NAME    Who may call it (required).
+  --expires-in D     Optional expiry: 90s, 30m, 12h or 7d.
+  -h, --help         Show this message and exit.`,
+    revoke: `Usage: aweshare agent revoke [OPTIONS]
+
+  Remove a grant.
+
+Options:
+  --alias ALIAS    The offering alias (required).
+  --consumer NAME  Whose grant to remove (required).
+  -h, --help       Show this message and exit.`,
+    list: `Usage: aweshare agent list [OPTIONS]
+
+  List grants for your namespace.
+
+Options:
+  --json      Print the raw API response instead of a table.
+  -h, --help  Show this message and exit.`,
+};
 function parseFlags(argv) {
     const positional = [];
     const flags = new Map();
@@ -66,6 +118,12 @@ function fail(message) {
     console.error(`error: ${message}`);
     process.exit(1);
 }
+/** Only `config` takes a positional (its subcommand); every other command is flags-only. */
+function noPositionals(cmd, positional) {
+    const arg = positional[0];
+    if (arg)
+        fail(`unexpected argument '${arg}' — this command takes flags only (see: aweshare agent ${cmd} -h)`);
+}
 /** Node fetch reports "fetch failed" without the reason; surface the cause. */
 function errorMessage(err) {
     if (err instanceof Error) {
@@ -89,13 +147,19 @@ async function main() {
         console.log(`aweshare agent ${VERSION}`);
         return;
     }
-    if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h' || flags.get('help') === 'true') {
+    if (!cmd || cmd === 'help' || cmd === '--help' || cmd === '-h') {
         console.log(USAGE);
         return;
     }
+    const help = COMMAND_HELP[cmd];
+    if (help && (positional.includes('-h') || flags.get('help') === 'true')) {
+        console.log(help);
+        return;
+    }
     const dir = agentDir();
     switch (cmd) {
         case 'init': {
+            noPositionals(cmd, positional);
             const configPath = join(dir, 'config.toml');
             const secretsPath = join(dir, 'secrets.json');
             if (!existsSync(configPath)) {
@@ -128,6 +192,7 @@ async function main() {
             return;
         }
         case 'join': {
+            noPositionals(cmd, positional);
             const hub = flags.get('hub');
             const code = flags.get('code');
             if (!hub || !/^https?:\/\//.test(hub))
@@ -189,30 +254,16 @@ async function main() {
             }
             else if (sub === 'show') {
                 if (!existsSync(configPath)) {
-                    fail(`no config at ${configPath} — run 'aweshare agent config init' first`);
+                    fail(`no config at ${configPath} — run 'aweshare agent init' first`);
                 }
                 console.log(redactConfig(readFileSync(configPath, 'utf8'), existsSync(secretsPath) ? readFileSync(secretsPath, 'utf8') : undefined));
             }
             else if (sub === 'init') {
-                // same as top-level init: write templates only if missing
-                if (!existsSync(configPath)) {
-                    writeFileAtomic(configPath, CONFIG_TEMPLATE, 0o600);
-                    console.log(`wrote ${configPath}`);
-                }
-                else {
-                    console.log(`exists, kept: ${configPath}`);
-                }
-                if (!existsSync(secretsPath)) {
-                    writeFileAtomic(secretsPath, SECRETS_TEMPLATE, 0o600);
-                    console.log(`wrote ${secretsPath}`);
-                }
-                else {
-                    console.log(`exists, kept: ${secretsPath}`);
-                }
+                fail(`config init is now 'aweshare agent init' (same behavior, plus --hub/--token pre-fill)`);
             }
             else if (sub === 'edit') {
                 if (!existsSync(configPath)) {
-                    fail(`no config at ${configPath} — run 'aweshare agent config init' first`);
+                    fail(`no config at ${configPath} — run 'aweshare agent init' first`);
                 }
                 const editor = process.env.VISUAL ?? process.env.EDITOR ?? 'vi';
                 const child = spawn(editor, [configPath], { stdio: 'inherit' });
@@ -220,11 +271,12 @@ async function main() {
                 return await new Promise(() => { });
             }
             else {
-                fail(`unknown config subcommand: ${sub} (expected path, show, edit or init)`);
+                fail(`unknown config subcommand: ${sub} (expected path, show or edit)`);
             }
             return;
         }
         case 'doctor': {
+            noPositionals(cmd, positional);
             const report = await runDoctor(dir);
             for (const check of report.checks) {
                 console.log(`${check.ok ? '  ok ' : 'FAIL '} ${check.name}: ${check.detail}`);
@@ -234,6 +286,7 @@ async function main() {
             return;
         }
         case 'start': {
+            noPositionals(cmd, positional);
             const { config, secrets } = loadAgentConfig(dir);
             const connection = new AgentConnection({
                 config,
@@ -252,6 +305,7 @@ async function main() {
         case 'grant':
         case 'revoke':
         case 'list': {
+            noPositionals(cmd, positional);
             const { config } = loadAgentConfig(dir);
             const base = config.hubUrl;
             const auth = { authorization: `Bearer ${config.token}`, 'content-type': 'application/json' };

package/apps/agent/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAqB,YAAY,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,iBAAiB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAG7E,CAAC,OAAO,CAAA;AAET,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;8DA6BgD,CAAA;AAE9D,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAW,CAAA;QAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACzB,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBACZ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YAC5C,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAW,CAAC,CAAA;YAC5C,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAI,GAA+D,CAAC,KAAK,CAAA;QACpF,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;AACpB,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,yDAAyD,GAAG,GAAG,CAAC,CAAA;IAC7E,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAA0B,CAAC,CAAA;IAC/F,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;AAC5B,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5C,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAA;QACxC,OAAM;IACR,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,EAAE,CAAC;QAC/F,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAClB,OAAM;IACR,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;IAEtB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC7C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5B,IAAI,QAAQ,GAAG,eAAe,CAAA;gBAC9B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,kCAAkC,EAClC,aAAa,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CACjC,CAAA;gBACH,CAAC;gBACD,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,oCAAoC,EACpC,YAAY,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAClC,CAAA;gBACH,CAAC;gBACD,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAA;YAC5C,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,eAAe,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAA;gBACrD,OAAO,CAAC,GAAG,CAAC,SAAS,WAAW,EAAE,CAAC,CAAA;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAA;YAC7C,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YAC5B,OAAO,CAAC,GAAG,CACT,oFAAoF,CACrF,CAAA;YACD,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAA;YACrF,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;YACzE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;YAC1E,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;YACxC,OAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9B,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;YAC3E,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;YACxF,uEAAuE;YACvE,MAAM,UAAU,GAA2B,EAAE,IAAI,EAAE,CAAA;YACnD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,UAAU,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAW,CAAA;YACpE,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAW,CAAA;YACvE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,EAAE;gBACtE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;aACjC,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAI/C,CAAA;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACzC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YAChE,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;YACxB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC7C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,eAAe,CAAA;gBAChF,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;gBAC1C,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,+DAA+D;oBAC/D,IAAI,CACF,+DAA+D,UAAU,mCAAmC,KAAK,EAAE,CACpH,CAAA;gBACH,CAAC;gBACD,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;gBAC3C,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,EAAE,CAAC,CAAA;YACtC,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,eAAe,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAA;gBACrD,OAAO,CAAC,GAAG,CAAC,SAAS,WAAW,EAAE,CAAC,CAAA;YACrC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,iBAAiB,IAAI,OAAO,CAAC,CAAA;YACxE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YAC5B,OAAO,CAAC,GAAG,CAAC,wEAAwE,IAAI,IAAI,CAAC,CAAA;YAC7F,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAA;YACrF,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;YACzE,OAAO,CAAC,GAAG,CAAC,qCAAqC,IAAI,wBAAwB,CAAC,CAAA;YAC9E,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;YACxC,OAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;YACnC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC7C,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACzB,CAAC;iBAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,gBAAgB,UAAU,2CAA2C,CAAC,CAAA;gBAC7E,CAAC;gBACD,OAAO,CAAC,GAAG,CACT,YAAY,CACV,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,EAChC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CACxE,CACF,CAAA;YACH,CAAC;iBAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,0DAA0D;gBAC1D,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,eAAe,CAAC,UAAU,EAAE,eAAe,EAAE,KAAK,CAAC,CAAA;oBACnD,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;gBACpC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAA;gBAC5C,CAAC;gBACD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;oBAC7B,eAAe,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAA;oBACrD,OAAO,CAAC,GAAG,CAAC,SAAS,WAAW,EAAE,CAAC,CAAA;gBACrC,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAA;gBAC7C,CAAC;YACH,CAAC;iBAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,gBAAgB,UAAU,2CAA2C,CAAC,CAAA;gBAC7E,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAA;gBAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;gBAC/D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;gBACnD,OAAO,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,8BAA8B,GAAG,sCAAsC,CAAC,CAAA;YAC/E,CAAC;YACD,OAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;YACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC/E,CAAC;YACD,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iDAAiD,CACtF,CAAA;YACD,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,OAAM;QACR,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAChD,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC;gBACrC,MAAM;gBACN,OAAO;gBACP,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;aACzD,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,GAAG,EAAE;gBACpB,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;gBACjC,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YACpD,CAAC,CAAA;YACD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;YAC/B,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAA;YAC1B,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;YAC5F,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACtC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;oBAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;gBACpE,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;gBACxD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;gBACzC,IAAI,GAAG,KAAK,OAAO,IAAI,SAAS,EAAE,CAAC;oBACjC,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;gBAChF,CAAC;gBACD,MAAM,GAAG,GACP,GAAG,KAAK,OAAO;oBACb,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,IAAI,kBAAkB,EAAE;wBACrC,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CAAC;oBACJ,CAAC,CAAC,MAAM,KAAK,CACT,GAAG,IAAI,0BAA0B,kBAAkB,CAAC,KAAK,CAAC,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EACrG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CACpC,CAAA;gBACP,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAqC,CAAA;gBACrF,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;gBAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;gBACjC,OAAM;YACR,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YACrE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE/C,CAAA;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YAC3E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9F,OAAM;QACR,CAAC;QAED;YACE,IAAI,CAAC,oBAAoB,GAAG,OAAO,KAAK,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA"}
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AAC1C,OAAO,EAAE,UAAU,EAAE,YAAY,EAAE,MAAM,SAAS,CAAA;AAClD,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAA;AAChC,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAA;AAClD,OAAO,IAAI,MAAM,MAAM,CAAA;AACvB,OAAO,EACL,QAAQ,EACR,iBAAiB,EACjB,eAAe,EACf,eAAe,EACf,YAAY,EACZ,gBAAgB,EAChB,eAAe,GAChB,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,eAAe,EAAE,MAAM,iBAAiB,CAAA;AACjD,OAAO,EAAE,SAAS,EAAE,MAAM,aAAa,CAAA;AACvC,OAAO,EAAqB,YAAY,EAAE,MAAM,YAAY,CAAA;AAE5D,MAAM,OAAO,GACX,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,uBAAuB,EAAE,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE,MAAM,CAAC,CAGnF,CAAC,OAAO,CAAA;AAET,sFAAsF;AACtF,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;0CAgB4B,CAAA;AAE1C,MAAM,YAAY,GAA2B;IAC3C,IAAI,EAAE;;;;;;;6CAOqC;IAC3C,IAAI,EAAE;;;;;;;;;6CASqC;IAC3C,MAAM,EAAE;;;;;;;mDAOyC;IACjD,MAAM,EAAE;;;;;0CAKgC;IACxC,KAAK,EAAE;;;;;0CAKiC;IACxC,KAAK,EAAE;;;;;;;;iDAQwC;IAC/C,MAAM,EAAE;;;;;;;+CAOqC;IAC7C,IAAI,EAAE;;;;;;0CAMkC;CACzC,CAAA;AAED,SAAS,UAAU,CAAC,IAAc;IAChC,MAAM,UAAU,GAAa,EAAE,CAAA;IAC/B,MAAM,KAAK,GAAG,IAAI,GAAG,EAAkB,CAAA;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAW,CAAA;QAC3B,IAAI,CAAC,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACvB,MAAM,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;YACzB,IAAI,EAAE,IAAI,CAAC,EAAE,CAAC;gBACZ,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAA;YAC5C,CAAC;iBAAM,IAAI,CAAC,GAAG,CAAC,GAAG,IAAI,CAAC,MAAM,IAAI,CAAE,IAAI,CAAC,CAAC,GAAG,CAAC,CAAY,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;gBAC5E,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAW,CAAC,CAAA;YAC5C,CAAC;iBAAM,CAAC;gBACN,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAA;YAC/B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,UAAU,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;QACpB,CAAC;IACH,CAAC;IACD,OAAO,EAAE,UAAU,EAAE,KAAK,EAAE,CAAA;AAC9B,CAAC;AAED,SAAS,IAAI,CAAC,OAAe;IAC3B,OAAO,CAAC,KAAK,CAAC,UAAU,OAAO,EAAE,CAAC,CAAA;IAClC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAA;AACjB,CAAC;AAED,4FAA4F;AAC5F,SAAS,aAAa,CAAC,GAAW,EAAE,UAAoB;IACtD,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,CAAA;IACzB,IAAI,GAAG;QACL,IAAI,CACF,wBAAwB,GAAG,0DAA0D,GAAG,MAAM,CAC/F,CAAA;AACL,CAAC;AAED,+EAA+E;AAC/E,SAAS,YAAY,CAAC,GAAY;IAChC,IAAI,GAAG,YAAY,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAI,GAA+D,CAAC,KAAK,CAAA;QACpF,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,OAAO,KAAK,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAA;IAChF,CAAC;IACD,OAAO,MAAM,CAAC,GAAG,CAAC,CAAA;AACpB,CAAC;AAED,uEAAuE;AACvE,SAAS,aAAa,CAAC,GAAW;IAChC,MAAM,CAAC,GAAG,iBAAiB,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACrC,IAAI,CAAC,CAAC;QAAE,IAAI,CAAC,yDAAyD,GAAG,GAAG,CAAC,CAAA;IAC7E,MAAM,IAAI,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,CAAC,EAAE,MAAM,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,EAAE,UAAU,EAAE,CAAC,CAAC,CAAC,CAAC,CAA0B,CAAC,CAAA;IAC/F,OAAO,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,CAAA;AAC5B,CAAC;AAED,KAAK,UAAU,IAAI;IACjB,MAAM,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,GAAG,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC,CAAA;IAC5C,MAAM,EAAE,UAAU,EAAE,KAAK,EAAE,GAAG,UAAU,CAAC,IAAI,CAAC,CAAA;IAC9C,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,WAAW,EAAE,CAAC;QACxC,OAAO,CAAC,GAAG,CAAC,kBAAkB,OAAO,EAAE,CAAC,CAAA;QACxC,OAAM;IACR,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,MAAM,IAAI,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;QAC/D,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;QAClB,OAAM;IACR,CAAC;IACD,MAAM,IAAI,GAAG,YAAY,CAAC,GAAG,CAAC,CAAA;IAC9B,IAAI,IAAI,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,EAAE,CAAC;QACxE,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,CAAA;QACjB,OAAM;IACR,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAA;IAEtB,QAAQ,GAAG,EAAE,CAAC;QACZ,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAC9B,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC7C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5B,IAAI,QAAQ,GAAG,eAAe,CAAA;gBAC9B,IAAI,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;oBACrB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,kCAAkC,EAClC,aAAa,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CACjC,CAAA;gBACH,CAAC;gBACD,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;oBACvB,QAAQ,GAAG,QAAQ,CAAC,OAAO,CACzB,oCAAoC,EACpC,YAAY,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,GAAG,CAClC,CAAA;gBACH,CAAC;gBACD,eAAe,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,CAAA;gBAC5C,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,UAAU,EAAE,CAAC,CAAA;YAC5C,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,eAAe,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAA;gBACrD,OAAO,CAAC,GAAG,CAAC,SAAS,WAAW,EAAE,CAAC,CAAA;YACrC,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,GAAG,CAAC,iBAAiB,WAAW,EAAE,CAAC,CAAA;YAC7C,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YAC5B,OAAO,CAAC,GAAG,CACT,oFAAoF,CACrF,CAAA;YACD,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAA;YACrF,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;YACzE,OAAO,CAAC,GAAG,CAAC,6DAA6D,CAAC,CAAA;YAC1E,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;YACxC,OAAM;QACR,CAAC;QAED,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAC9B,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;YAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAA;YAC9B,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,GAAG,CAAC;gBAAE,IAAI,CAAC,8BAA8B,CAAC,CAAA;YAC3E,IAAI,CAAC,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,CAAC,IAAI,CAAC;gBAAE,IAAI,CAAC,yCAAyC,CAAC,CAAA;YACxF,uEAAuE;YACvE,MAAM,UAAU,GAA2B,EAAE,IAAI,EAAE,CAAA;YACnD,IAAI,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC;gBAAE,UAAU,CAAC,IAAI,GAAG,KAAK,CAAC,GAAG,CAAC,MAAM,CAAW,CAAA;YACpE,IAAI,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC;gBAAE,UAAU,CAAC,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAW,CAAA;YACvE,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,GAAG,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,oBAAoB,EAAE;gBACtE,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;gBAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC;aACjC,CAAC,CAAA;YACF,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAI/C,CAAA;YACD,IAAI,CAAC,GAAG,CAAC,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,KAAK,EAAE,CAAC;gBACzC,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YAChE,CAAC;YACD,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,CAAA;YACtB,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAA;YACxB,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC7C,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;gBAC5B,MAAM,MAAM,GAAG,iBAAiB,CAAC,eAAe,EAAE,GAAG,EAAE,KAAK,CAAC,IAAI,eAAe,CAAA;gBAChF,eAAe,CAAC,UAAU,EAAE,MAAM,EAAE,KAAK,CAAC,CAAA;gBAC1C,OAAO,CAAC,GAAG,CAAC,SAAS,UAAU,EAAE,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,MAAM,OAAO,GAAG,iBAAiB,CAAC,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,EAAE,GAAG,EAAE,KAAK,CAAC,CAAA;gBAC/E,IAAI,OAAO,KAAK,IAAI,EAAE,CAAC;oBACrB,+DAA+D;oBAC/D,IAAI,CACF,+DAA+D,UAAU,mCAAmC,KAAK,EAAE,CACpH,CAAA;gBACH,CAAC;gBACD,eAAe,CAAC,UAAU,EAAE,OAAO,EAAE,KAAK,CAAC,CAAA;gBAC3C,OAAO,CAAC,GAAG,CAAC,WAAW,UAAU,EAAE,CAAC,CAAA;YACtC,CAAC;YACD,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;gBAC7B,eAAe,CAAC,WAAW,EAAE,gBAAgB,EAAE,KAAK,CAAC,CAAA;gBACrD,OAAO,CAAC,GAAG,CAAC,SAAS,WAAW,EAAE,CAAC,CAAA;YACrC,CAAC;YACD,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,iBAAiB,IAAI,OAAO,CAAC,CAAA;YACxE,OAAO,CAAC,GAAG,CAAC,eAAe,CAAC,CAAA;YAC5B,OAAO,CAAC,GAAG,CAAC,wEAAwE,IAAI,IAAI,CAAC,CAAA;YAC7F,OAAO,CAAC,GAAG,CAAC,wEAAwE,CAAC,CAAA;YACrF,OAAO,CAAC,GAAG,CAAC,4DAA4D,CAAC,CAAA;YACzE,OAAO,CAAC,GAAG,CAAC,qCAAqC,IAAI,wBAAwB,CAAC,CAAA;YAC9E,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,CAAA;YACxC,OAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,MAAM,GAAG,GAAG,UAAU,CAAC,CAAC,CAAC,IAAI,MAAM,CAAA;YACnC,MAAM,UAAU,GAAG,IAAI,CAAC,GAAG,EAAE,aAAa,CAAC,CAAA;YAC3C,MAAM,WAAW,GAAG,IAAI,CAAC,GAAG,EAAE,cAAc,CAAC,CAAA;YAC7C,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBACnB,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;YACzB,CAAC;iBAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,gBAAgB,UAAU,oCAAoC,CAAC,CAAA;gBACtE,CAAC;gBACD,OAAO,CAAC,GAAG,CACT,YAAY,CACV,YAAY,CAAC,UAAU,EAAE,MAAM,CAAC,EAChC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,WAAW,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,SAAS,CACxE,CACF,CAAA;YACH,CAAC;iBAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,IAAI,CACF,uFAAuF,CACxF,CAAA;YACH,CAAC;iBAAM,IAAI,GAAG,KAAK,MAAM,EAAE,CAAC;gBAC1B,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;oBAC5B,IAAI,CAAC,gBAAgB,UAAU,oCAAoC,CAAC,CAAA;gBACtE,CAAC;gBACD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,OAAO,CAAC,GAAG,CAAC,MAAM,IAAI,IAAI,CAAA;gBAC/D,MAAM,KAAK,GAAG,KAAK,CAAC,MAAM,EAAE,CAAC,UAAU,CAAC,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAA;gBAC/D,KAAK,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,CAAC,CAAC,CAAA;gBACnD,OAAO,MAAM,IAAI,OAAO,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;YACpC,CAAC;iBAAM,CAAC;gBACN,IAAI,CAAC,8BAA8B,GAAG,gCAAgC,CAAC,CAAA;YACzE,CAAC;YACD,OAAM;QACR,CAAC;QAED,KAAK,QAAQ,CAAC,CAAC,CAAC;YACd,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAC9B,MAAM,MAAM,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAA;YACnC,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,MAAM,EAAE,CAAC;gBAClC,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,IAAI,KAAK,CAAC,IAAI,KAAK,KAAK,CAAC,MAAM,EAAE,CAAC,CAAA;YAC/E,CAAC;YACD,OAAO,CAAC,GAAG,CACT,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,qBAAqB,CAAC,CAAC,CAAC,iDAAiD,CACtF,CAAA;YACD,OAAO,CAAC,QAAQ,GAAG,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAA;YACpC,OAAM;QACR,CAAC;QAED,KAAK,OAAO,CAAC,CAAC,CAAC;YACb,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAC9B,MAAM,EAAE,MAAM,EAAE,OAAO,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YAChD,MAAM,UAAU,GAAG,IAAI,eAAe,CAAC;gBACrC,MAAM;gBACN,OAAO;gBACP,GAAG,EAAE,IAAI,CAAC,EAAE,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,YAAY,IAAI,MAAM,EAAE,CAAC;aACzD,CAAC,CAAA;YACF,MAAM,QAAQ,GAAG,GAAG,EAAE;gBACpB,OAAO,CAAC,KAAK,CAAC,kBAAkB,CAAC,CAAA;gBACjC,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAA;YACpD,CAAC,CAAA;YACD,OAAO,CAAC,EAAE,CAAC,QAAQ,EAAE,QAAQ,CAAC,CAAA;YAC9B,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAA;YAC/B,MAAM,UAAU,CAAC,KAAK,EAAE,CAAA;YACxB,OAAM;QACR,CAAC;QAED,KAAK,OAAO,CAAC;QACb,KAAK,QAAQ,CAAC;QACd,KAAK,MAAM,CAAC,CAAC,CAAC;YACZ,aAAa,CAAC,GAAG,EAAE,UAAU,CAAC,CAAA;YAC9B,MAAM,EAAE,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,CAAA;YACvC,MAAM,IAAI,GAAG,MAAM,CAAC,MAAM,CAAA;YAC1B,MAAM,IAAI,GAAG,EAAE,aAAa,EAAE,UAAU,MAAM,CAAC,KAAK,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,CAAA;YAC5F,IAAI,GAAG,KAAK,OAAO,IAAI,GAAG,KAAK,QAAQ,EAAE,CAAC;gBACxC,MAAM,KAAK,GAAG,KAAK,CAAC,GAAG,CAAC,OAAO,CAAC,CAAA;gBAChC,MAAM,QAAQ,GAAG,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAA;gBACtC,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;oBAAE,IAAI,CAAC,qCAAqC,CAAC,CAAA;gBACpE,MAAM,IAAI,GAA2B,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAA;gBACxD,MAAM,SAAS,GAAG,KAAK,CAAC,GAAG,CAAC,YAAY,CAAC,CAAA;gBACzC,IAAI,GAAG,KAAK,OAAO,IAAI,SAAS,EAAE,CAAC;oBACjC,IAAI,CAAC,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,aAAa,CAAC,SAAS,CAAC,CAAC,CAAC,WAAW,EAAE,CAAA;gBAChF,CAAC;gBACD,MAAM,GAAG,GACP,GAAG,KAAK,OAAO;oBACb,CAAC,CAAC,MAAM,KAAK,CAAC,GAAG,IAAI,kBAAkB,EAAE;wBACrC,MAAM,EAAE,KAAK;wBACb,OAAO,EAAE,IAAI;wBACb,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC;qBAC3B,CAAC;oBACJ,CAAC,CAAC,MAAM,KAAK,CACT,GAAG,IAAI,0BAA0B,kBAAkB,CAAC,KAAK,CAAC,aAAa,kBAAkB,CAAC,QAAQ,CAAC,EAAE,EACrG,EAAE,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,CACpC,CAAA;gBACP,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAAqC,CAAA;gBACrF,IAAI,CAAC,GAAG,CAAC,EAAE;oBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;gBAC3E,OAAO,CAAC,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;gBACjC,OAAM;YACR,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,KAAK,CAAC,GAAG,IAAI,kBAAkB,EAAE,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC,CAAA;YACrE,MAAM,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAAC,CAAC,CAE/C,CAAA;YACD,IAAI,CAAC,GAAG,CAAC,EAAE;gBAAE,IAAI,CAAC,GAAG,GAAG,CAAC,MAAM,IAAI,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI,GAAG,CAAC,UAAU,EAAE,CAAC,CAAA;YAC3E,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC,CAAA;YAC9F,OAAM;QACR,CAAC;QAED;YACE,IAAI,CAAC,oBAAoB,GAAG,OAAO,KAAK,EAAE,CAAC,CAAA;IAC/C,CAAC;AACH,CAAC;AAED,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,CAAC,CAAA"}

package/apps/hub/dist/admin.d.ts

@@ -1,10 +1,13 @@
 import type Database from 'better-sqlite3';
 import type { Logger } from 'pino';
 import type { AuthContext } from './auth.js';
+import type { HubConfig } from './config.js';
 import { type Router } from './http.js';
 export interface AdminDeps {
     db: Database.Database;
     auth: AuthContext;
     log: Logger;
+    config: HubConfig;
+    onProducerRevoked: (producerId: number) => void;
 }
 export declare function registerAdminRoutes(router: Router, deps: AdminDeps): void;

package/apps/hub/dist/admin.js

@@ -1,25 +1,38 @@
 import { parseAlias, roleForToken } from '../../../packages/protocol/dist/index.js';
 import { requireAdmin, requireConsumer, requireProducer } from './auth.js';
-import { addGrant, getConsumerByName, getProducerByName, insertConsumer, insertProducer, listGrants, listTokens, queryUsage, removeGrant, revokeToken, setConsumerConfig, } from './db.js';
+import { addGrant, countActiveProducers, getConsumerById, getConsumerByName, getProducerById, getProducerByName, insertConsumer, insertProducer, listGrants, listTokens, queryUsage, removeGrant, restoreProducer, restoreToken, revokeToken, setConsumerConfig, suspendProducer, } from './db.js';
 import { HttpError, readJson, sendJson } from './http.js';
 import { parseLimits, safeParseLimits } from './limits.js';
 import { generateToken, hashToken } from './tokens.js';
-/** Grants are managed by the producer owning the alias namespace, or by admin. */
+/** Producer admission and restore share one scarce resource: active tenant slots. */
+function requireProducerCapacity(db, config) {
+    const active = countActiveProducers(db);
+    if (active >= config.maxProducers) {
+        throw new HttpError(403, 'HUB_FULL', `hub is full (${active} active producers, max ${config.maxProducers}) — suspend one first: aweshare hub revoke --id N`);
+    }
+}
+function tokenRoleParam(raw) {
+    if (raw === 'producers')
+        return 'producer';
+    if (raw === 'consumers')
+        return 'consumer';
+    throw new HttpError(400, 'INVALID_ROLE', 'path must be /admin/v1/tokens/{producers|consumers}/{id}[/restore]');
+}
+function tokenIdParam(raw) {
+    const id = Number(raw);
+    if (!Number.isInteger(id))
+        throw new HttpError(400, 'INVALID_ID', 'token id must be an integer');
+    return id;
+}
+/** Grants are producer-owned: only the producer of the alias namespace may change them. */
 function authorizeGrantChange(req, auth, alias) {
     const token = req.headers.authorization?.startsWith('Bearer ')
         ? req.headers.authorization.slice(7).trim()
         : null;
     if (!token)
-        throw new HttpError(401, 'INVALID_KEY', 'admin or producer token required');
+        throw new HttpError(401, 'INVALID_KEY', 'producer token required');
     if (roleForToken(token) === 'admin') {
-        requireAdmin(req, auth);
-        const parsed = parseAlias(alias);
-        if (!parsed)
-            throw new HttpError(400, 'PROTOCOL_MISMATCH', `invalid alias: ${alias}`);
-        const producer = getProducerByName(auth.db, parsed.namespace);
-        if (!producer)
-            throw new HttpError(404, 'ALIAS_NOT_FOUND', `unknown producer namespace: ${parsed.namespace}`);
-        return { producerId: producer.id };
+        throw new HttpError(403, 'NOT_GRANTED', 'grants are producer-owned — manage them with the producer token (aweshare agent grant)');
     }
     if (roleForToken(token) === 'consumer') {
         throw new HttpError(403, 'NOT_GRANTED', 'consumer keys cannot manage grants');
@@ -42,6 +55,9 @@ export function registerAdminRoutes(router, deps) {
         if (typeof body.name !== 'string' || !/^[a-z0-9][a-z0-9-]{1,31}$/.test(body.name)) {
             throw new HttpError(400, 'INVALID_NAME', 'name must match ^[a-z0-9][a-z0-9-]{1,31}$ (it becomes the alias namespace for producers)');
         }
+        if (getProducerByName(db, body.name) || getConsumerByName(db, body.name)) {
+            throw new HttpError(409, 'NAME_TAKEN', `the name '${body.name}' is already in use`);
+        }
         let email = null;
         if (body.email !== undefined) {
             if (typeof body.email !== 'string' || !/^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(body.email)) {
@@ -49,37 +65,62 @@ export function registerAdminRoutes(router, deps) {
             }
             email = body.email;
         }
+        if (body.role === 'producer')
+            requireProducerCapacity(db, deps.config);
         const token = generateToken(body.role);
         const tokenHash = hashToken(token, auth.pepper);
         const row = body.role === 'producer'
-            ? insertProducer(db, body.name, tokenHash, email, token)
-            : insertConsumer(db, body.name, tokenHash, token);
+            ? insertProducer(db, body.name, tokenHash, email)
+            : insertConsumer(db, body.name, tokenHash);
         deps.log.info({ role: body.role, name: body.name }, 'token issued');
         sendJson(ctx.res, 201, { id: row.id, role: body.role, name: row.name, token });
     });
     router.add('GET', '/admin/v1/tokens', (ctx) => {
         requireAdmin(ctx.req, auth);
-        // ?reveal=true adds each row's stored plaintext (post-v4 issuances only) —
-        // admin-only by construction, but it is the secret itself: log nothing.
-        sendJson(ctx.res, 200, listTokens(db, ctx.query.get('reveal') === 'true'));
+        sendJson(ctx.res, 200, listTokens(db));
     });
     router.add('DELETE', '/admin/v1/tokens/:role/:id', (ctx) => {
         requireAdmin(ctx.req, auth);
-        const role = ctx.params.role === 'producers'
-            ? 'producer'
-            : ctx.params.role === 'consumers'
-                ? 'consumer'
-                : null;
-        if (role !== 'producer' && role !== 'consumer') {
-            throw new HttpError(400, 'INVALID_ROLE', 'path must be /admin/v1/tokens/{producers|consumers}/{id}');
-        }
-        const id = Number(ctx.params.id);
-        if (!Number.isInteger(id))
-            throw new HttpError(400, 'INVALID_ID', 'token id must be an integer');
-        revokeToken(db, role, id);
-        deps.log.info({ role, id }, 'token revoked');
+        const role = tokenRoleParam(ctx.params.role);
+        const id = tokenIdParam(ctx.params.id);
+        if (role === 'producer') {
+            // suspension also flags the invite that redeemed this producer — one
+            // pairing, one state, whichever handle the operator revokes through
+            suspendProducer(db, id);
+            deps.onProducerRevoked(id);
+        }
+        else {
+            revokeToken(db, role, id);
+        }
+        deps.log.info({ role, id }, 'token suspended (restorable)');
         sendJson(ctx.res, 200, { revoked: true, role, id });
     });
+    // The undo of DELETE above: revocation is reversible suspension, and slots
+    // freed by a revoke are retaken here — restoring re-runs the capacity check.
+    router.add('POST', '/admin/v1/tokens/:role/:id/restore', (ctx) => {
+        requireAdmin(ctx.req, auth);
+        const role = tokenRoleParam(ctx.params.role);
+        const id = tokenIdParam(ctx.params.id);
+        if (role === 'producer') {
+            const producer = getProducerById(db, id);
+            if (!producer)
+                throw new HttpError(404, 'NOT_FOUND', `no producer token with id ${id}`);
+            if (producer.revoked_at)
+                requireProducerCapacity(db, deps.config);
+            const restored = restoreProducer(db, id);
+            if (restored)
+                deps.log.info({ role, id }, 'producer token restored');
+            sendJson(ctx.res, 200, { restored, role, id });
+            return;
+        }
+        const consumer = getConsumerById(db, id);
+        if (!consumer)
+            throw new HttpError(404, 'NOT_FOUND', `no consumer token with id ${id}`);
+        const restored = restoreToken(db, role, id);
+        if (restored)
+            deps.log.info({ role, id }, 'consumer token restored');
+        sendJson(ctx.res, 200, { restored, role, id });
+    });
     router.add('PUT', '/admin/v1/grants', async (ctx) => {
         const body = (await readJson(ctx.req, 64 * 1024));
         if (typeof body.alias !== 'string' || typeof body.consumer !== 'string') {