orizu 0.5.20 → 0.5.22

package/README.md

@@ -9,7 +9,7 @@ Orizu is a platform that helps you build continually learning agents and other L
 There are 3 key pillars to Orizu:
 1. **Human evaluation:** We consider human evaluation to be the gold standard, particularly when the humans involved are people with deep context and understanding of the output being evaluated. This is often the cross-functional team behind a product (product managers, engineers, designers, content writers, researchers, etc) or external experts (lawyers, engineers, writers, etc). Any good evaluation system relies on the presence of such high quality judgment to compare to. We provide tools that simplify the process of collecting the feedback from this audience.
 2. **Auto evaluation:** Ultimately, human experts can only review so much. As your data scales, you need to encode their knowledge, their opinions, their taste and judgment into auto-evaluations. We automate this for you using the data we help you collect above.
-3. **Optimization:** We turn your evals into an asset for you by building an automated hill-climbing workflow. We've started with prompt optimization because multiple studies and our own experience with our customers has shown strong measurable lifts with even relatively small datasets. Over time, we'll introduce additional capabilities, including optimizing your skills and other contextual information, and even model weights if your model provider allows finetuning.
+3. **Optimization:** We turn your evals into an asset for you by building an automated hill-climbing workflow. We've started with instruction optimization because multiple studies and our own experience with our customers has shown strong measurable lifts with even relatively small datasets. Over time, we'll introduce additional capabilities, including optimizing your skills and other contextual information, and even model weights if your model provider allows finetuning.
 
 ## CLI and Agent Skills
 
@@ -109,6 +109,9 @@ Agents are first-class users of this CLI: **every command supports `--json`**
 (as a prefix, `orizu --json teams list`, or a trailing flag) and emits a single
 machine-readable JSON document instead of formatted text. Discover the full
 command surface, including global options, with `orizu capabilities --json`.
+Hosted agents may read and sync instruction sets and prepare complete manifests,
+but a human curator using the local CLI with a user token must run instruction
+create, push, shape, archive, restore, and production/default pointer mutations.
 
 ## Authentication
 
@@ -186,19 +189,19 @@ orizu logout
     <td><code>orizu projects create --name "Support QA" --team ops-eval</code></td>
   </tr>
   <tr>
-    <td colspan="2"><strong>Prompts</strong></td>
+    <td colspan="2"><strong>Instruction sets and prompt reads</strong></td>
   </tr>
   <tr>
     <td>List prompts</td>
     <td><code>orizu prompts list --project ops-eval/support-qa [--status active|archived|all]</code></td>
   </tr>
   <tr>
-    <td>Archive or restore a prompt</td>
-    <td><code>orizu prompts archive &lt;promptIdOrName&gt; --project ops-eval/support-qa</code><br><code>orizu prompts restore &lt;promptIdOrName&gt; --project ops-eval/support-qa</code></td>
+    <td>Archive or restore an instruction set (human/local CLI only)</td>
+    <td><code>orizu instructions archive &lt;slug-or-exact-name&gt; --project ops-eval/support-qa</code><br><code>orizu instructions restore &lt;slug-or-exact-name&gt; --project ops-eval/support-qa</code></td>
   </tr>
   <tr>
-    <td>Push a prompt with a report</td>
-    <td><code>orizu prompts push ./prompts/support --project ops-eval/support-qa --report-file ./prompt-report.md</code></td>
+    <td>Push an instruction-set manifest (human/local CLI only)</td>
+    <td><code>orizu instructions push ./orizu.instruction-set.json --project ops-eval/support-qa --set &lt;slug-or-exact-name&gt;</code></td>
   </tr>
   <tr>
     <td>Upload a report for an existing prompt version</td>

package/dist/archive-artifacts-cli.d.ts

@@ -0,0 +1,50 @@
+/**
+ * ALI-1199 archive/restore commands and assignment inventory.
+ *
+ * Kept outside index.ts per the CLI line ratchet. The server owns
+ * authorization and idempotency; this module validates the CLI grammar and
+ * renders the canonical response without inventing client-side state.
+ */
+export interface ArchiveArtifactsIo {
+    json: boolean;
+    print: (line: string) => void;
+    resolveProjectSlug: (projectArg: string | null) => Promise<string>;
+    fetcher?: (path: string, init?: RequestInit) => Promise<Response>;
+}
+interface TaskSummary {
+    id: string;
+    title: string;
+    status: string;
+    archiveStatus?: string;
+    teamSlug?: string;
+    projectSlug?: string;
+}
+interface AppSummary {
+    id: string;
+    name: string;
+    currentVersionNum?: number;
+    status?: string;
+}
+interface DatasetSummary {
+    id: string;
+    name: string;
+    rowCount: number | string;
+    status?: string;
+}
+interface ScorerSummary {
+    id: string;
+    name: string;
+    mode: string;
+    metricLabel: string;
+    implementationKind: string;
+    status?: string;
+}
+type PrintLine = (line: string) => void;
+export declare function printTaskSummaries(items: TaskSummary[], print: PrintLine): void;
+export declare function printAppSummaries(items: AppSummary[], print: PrintLine): void;
+export declare function printDatasetSummaries(items: DatasetSummary[], print: PrintLine): void;
+export declare function printScorerSummaries(items: ScorerSummary[], print: PrintLine): void;
+export declare function archiveArtifactCommand(args: string[], io: ArchiveArtifactsIo): Promise<void>;
+export declare function listAssignmentsCommand(args: string[], io: ArchiveArtifactsIo): Promise<void>;
+export {};
+//# sourceMappingURL=archive-artifacts-cli.d.ts.map

package/dist/archive-artifacts-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"archive-artifacts-cli.d.ts","sourceRoot":"","sources":["../src/archive-artifacts-cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAgBH,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAqBD,UAAU,WAAW;IACnB,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,MAAM,EAAE,MAAM,CAAA;IACd,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,WAAW,CAAC,EAAE,MAAM,CAAA;CACrB;AAED,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,cAAc;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,GAAG,MAAM,CAAA;IACzB,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,EAAE,MAAM,CAAA;IACnB,kBAAkB,EAAE,MAAM,CAAA;IAC1B,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED,KAAK,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;AA+CvC,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,WAAW,EAAE,EAAE,KAAK,EAAE,SAAS,QAexE;AAED,wBAAgB,iBAAiB,CAAC,KAAK,EAAE,UAAU,EAAE,EAAE,KAAK,EAAE,SAAS,QAYtE;AAED,wBAAgB,qBAAqB,CACnC,KAAK,EAAE,cAAc,EAAE,EACvB,KAAK,EAAE,SAAS,QAajB;AAED,wBAAgB,oBAAoB,CAClC,KAAK,EAAE,aAAa,EAAE,EACtB,KAAK,EAAE,SAAS,QAejB;AAyCD,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,kBAAkB,GACrB,OAAO,CAAC,IAAI,CAAC,CA8Df;AAED,wBAAsB,sBAAsB,CAC1C,IAAI,EAAE,MAAM,EAAE,EACd,EAAE,EAAE,kBAAkB,GACrB,OAAO,CAAC,IAAI,CAAC,CAwEf"}

package/dist/artifact-archive.d.ts

@@ -0,0 +1,48 @@
+export interface StoredZipEntry {
+    path: string;
+    data: Buffer;
+    /**
+     * Original file mode (ALI-1159, codex round 7): NOT part of the archive or
+     * the content hash (the deterministic zip stores fixed attributes), but the
+     * verified-snapshot materialization carries it over so an executable
+     * `./run.sh` runner keeps its +x bit when executed from the snapshot.
+     */
+    mode?: number;
+}
+export interface ArtifactArchive {
+    zipBase64: string;
+    contentSha256: string;
+}
+/** Exported for runner-dir-verify (ALI-1159): the pre-exec scan must resolve
+ * the same directory this module hashes and the runner later executes. */
+export declare function expandHomePath(path: string): string;
+/**
+ * Archives must be byte-identical for identical logical content across machines
+ * because content-addressed deduplication depends on deterministic inputs.
+ *
+ * Tradeoff: runner artifacts are downloaded, unzipped, and executed directly
+ * (there is no install step), so vendored dependency trees such as
+ * node_modules, .venv/venv, and build outputs are legitimate runtime payload
+ * and are deliberately NOT excluded — hash reproducibility therefore depends
+ * on the author shipping identical vendored trees across machines. Only true
+ * junk (.git, .DS_Store, __pycache__, .pytest_cache, .orizu) and secrets
+ * (.env, .env.*) are stripped: secrets must never ship, because runners
+ * receive their configuration at exec time.
+ */
+export declare function shouldExcludeArtifactPath(relativePath: string): boolean;
+export declare function collectArtifactFiles(sourceDir: string, relativeDir?: string): string[];
+export declare const ZIP_GENERAL_PURPOSE_UTF8 = 2048;
+export declare const ZIP_DOS_TIME_2000_01_01 = 0;
+export declare const ZIP_DOS_DATE_2000_01_01: number;
+export declare function createStoredZip(entries: StoredZipEntry[]): Buffer;
+/**
+ * Read the exact entry set the deterministic archive covers (sorted relative
+ * paths + bytes). Exported for runner-dir-verify (ALI-1159): the verified
+ * snapshot must be materialized from the SAME in-memory bytes that were
+ * hashed, so a post-hash mutation of the directory cannot change what runs.
+ */
+export declare function readArtifactEntries(dirArg: string): StoredZipEntry[];
+/** Deterministic archive of an already-read entry set. */
+export declare function archiveArtifactEntries(entries: StoredZipEntry[]): ArtifactArchive;
+export declare function zipDirectoryToBase64(dirArg: string): ArtifactArchive;
+//# sourceMappingURL=artifact-archive.d.ts.map

package/dist/artifact-archive.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-archive.d.ts","sourceRoot":"","sources":["../src/artifact-archive.ts"],"names":[],"mappings":"AAIA,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,MAAM,CAAA;IACZ;;;;;OAKG;IACH,IAAI,CAAC,EAAE,MAAM,CAAA;CACd;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,EAAE,MAAM,CAAA;CACtB;AAcD;0EAC0E;AAC1E,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOnD;AAED;;;;;;;;;;;;GAYG;AACH,wBAAgB,yBAAyB,CAAC,YAAY,EAAE,MAAM,GAAG,OAAO,CAOvE;AAED,wBAAgB,oBAAoB,CAAC,SAAS,EAAE,MAAM,EAAE,WAAW,SAAK,GAAG,MAAM,EAAE,CAclF;AAED,eAAO,MAAM,wBAAwB,OAAS,CAAA;AAC9C,eAAO,MAAM,uBAAuB,IAAI,CAAA;AACxC,eAAO,MAAM,uBAAuB,QAAsC,CAAA;AAkB1E,wBAAgB,eAAe,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,MAAM,CA2DjE;AAED;;;;;GAKG;AACH,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,MAAM,GAAG,cAAc,EAAE,CAwBpE;AAED,0DAA0D;AAC1D,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,eAAe,CAMjF;AAED,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,MAAM,GAAG,eAAe,CAEpE"}

package/dist/artifact-pull.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Runner/optimizer artifact commands: list (discover names, version ids, and
+ * labels) and pull (symmetric with `runners push` / `optimizers push` —
+ * resolve by id or name, download the content-addressed zip from storage,
+ * and extract it into --out). Pull writes version metadata to
+ * .orizu/pull.json — .orizu/ is excluded from artifact zips (see
+ * artifact-archive.ts), so a pulled directory re-pushes with an identical
+ * content hash.
+ *
+ * Lives outside index.ts per the CLI index line ratchet (ALI-976): this module
+ * owns its own argument parsing and printing via injected io.
+ */
+export type PullableArtifactKind = 'runner' | 'optimizer';
+export interface PullArtifactIo {
+    json: boolean;
+    print: (line: string) => void;
+    resolveProjectSlug: (projectArg: string | null) => Promise<string>;
+    fetcher?: (path: string, init?: RequestInit) => Promise<Response>;
+}
+export declare const ARTIFACT_MAX_BYTES: number;
+export declare function runnerOptimizerCommand(args: string[], io: PullArtifactIo): Promise<void>;
+//# sourceMappingURL=artifact-pull.d.ts.map

package/dist/artifact-pull.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"artifact-pull.d.ts","sourceRoot":"","sources":["../src/artifact-pull.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAWH,MAAM,MAAM,oBAAoB,GAAG,QAAQ,GAAG,WAAW,CAAA;AAEzD,MAAM,WAAW,cAAc;IAC7B,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,kBAAkB,EAAE,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;IAClE,OAAO,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;CAClE;AAGD,eAAO,MAAM,kBAAkB,QAAmB,CAAA;AA8DlD,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,cAAc,iBAM9E"}

package/dist/banner.d.ts

@@ -0,0 +1,3 @@
+export declare const ORIZU_BANNER = "     \u2584\u2584\n   \u2584\u259C\u259B \u2588\u2588\u2599\n  \u259F\u2580   \u25E5\u2588\u2588\u259B\n        \u2580\u259C\u2584\n       \u2584\u259F\u2588\n     \u2584\u2588\u2588\u2588\n   \u2584\u2588\u2588\u2588\u2588\u25E4        \u2584\u2584\u2584\u2588\u259B\n \u259F\u2588\u2588\u2588\u2588\u2588\u25E4     \u2584\u2584\u2588\u2588\u2588\u2588\u2588\u259B\n \u2584\u2580\u2588\u2588\u2588\u25E4  \u2584\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u259B\n \u25E5\u2588\u2584\u2580\u259B\u2590\u2588\u2584\u25E5\u259C\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u259B \u2588\u2588\u2588\u2580\n  \u259C\u2588\u2588 \u2588\u2588\u2588\u2588\u2584\u25E5\u259C\u2588\u2588\u2588\u2588\u259B \u2588\u2588\u2580\n   \u2588 \u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2584 \u259C\u2588\u259B \u2588\u2580\n    \u2590\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u2588\u25E3  \u2580";
+export declare function renderBanner(): string;
+//# sourceMappingURL=banner.d.ts.map

package/dist/banner.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"banner.d.ts","sourceRoot":"","sources":["../src/banner.ts"],"names":[],"mappings":"AAIA,eAAO,MAAM,YAAY,m4BAYN,CAAA;AAEnB,wBAAgB,YAAY,IAAI,MAAM,CAErC"}

package/dist/connectors-cli.d.ts

@@ -0,0 +1,31 @@
+/**
+ * Connector readiness CLI (ALI-903). Thin, read-only consumer of the
+ * project-scoped `/api/cli/connectors` endpoint. Pure command logic with an
+ * injected fetcher and project resolver; the entry point owns argument parsing
+ * and human/JSON output. Secret material is never printed (the endpoint already
+ * redacts config and surfaces credentials only as a boolean).
+ */
+export type CliFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+export interface ConnectorReadiness {
+    type: string;
+    status: string;
+    hasCredentials: boolean;
+    updatedAt: string | null;
+    config: Record<string, unknown>;
+}
+export interface ConnectorsResult {
+    connectors: ConnectorReadiness[];
+}
+export interface FetchConnectorsOptions {
+    fetcher?: CliFetcher;
+    projectSlug: string;
+}
+export interface ConnectorsCommandIo {
+    json: boolean;
+    print: (line: string) => void;
+    fetcher?: CliFetcher;
+    resolveProjectSlug?: (arg: string | null) => Promise<string>;
+}
+export declare function fetchConnectors(opts: FetchConnectorsOptions): Promise<ConnectorsResult>;
+export declare function connectorsCommand(args: string[], io: ConnectorsCommandIo): Promise<number>;
+//# sourceMappingURL=connectors-cli.d.ts.map

package/dist/connectors-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"connectors-cli.d.ts","sourceRoot":"","sources":["../src/connectors-cli.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAIH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,kBAAkB;IACjC,IAAI,EAAE,MAAM,CAAA;IACZ,MAAM,EAAE,MAAM,CAAA;IACd,cAAc,EAAE,OAAO,CAAA;IACvB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAA;IACxB,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAChC;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,EAAE,kBAAkB,EAAE,CAAA;CACjC;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,WAAW,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,mBAAmB;IAClC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,OAAO,CAAC,EAAE,UAAU,CAAA;IACpB,kBAAkB,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,KAAK,OAAO,CAAC,MAAM,CAAC,CAAA;CAC7D;AAaD,wBAAsB,eAAe,CAAC,IAAI,EAAE,sBAAsB,GAAG,OAAO,CAAC,gBAAgB,CAAC,CAQ7F;AAgCD,wBAAsB,iBAAiB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CA2BhG"}

package/dist/credentials.d.ts

@@ -0,0 +1,46 @@
+import { ServerCredentials, StoredCredentialsV2, StoredCredentialsV3 } from './types.js';
+export declare function loadCredentialsConfig(): StoredCredentialsV2 | StoredCredentialsV3 | null;
+export declare function getServerCredentials(baseUrl: string): ServerCredentials | null;
+export declare function saveServerCredentials(baseUrl: string, credentials: ServerCredentials): void;
+export declare function updateServerCredentials(baseUrl: string, credentials: ServerCredentials): void;
+export declare function getActiveBaseUrl(): string | null;
+/**
+ * In-sandbox bearer resolution (ALI-1044). Resolves a bearer supplied out-of-band
+ * to the hosted agent, WITHOUT consulting credentials.json:
+ *   1. `ORIZU_TOKEN` — an explicit bearer in the environment (wins if present).
+ *   2. `ORIZU_TOKEN_FILE` — an absolute path to a 0600 file whose TRIMMED contents
+ *      are the bearer.
+ * Returns null when neither is set, so callers fall through to credentials.json.
+ *
+ * The token file is read FRESH on EVERY call and never cached: the hosted loop
+ * ROTATES the file underneath a long-lived agent process, so caching the value
+ * would pin a stale (soon-expired) bearer. The token is never logged, echoed, or
+ * passed via argv — only returned to the caller for a single request's header.
+ *
+ * A set-but-unreadable/empty `ORIZU_TOKEN_FILE` throws a clear error rather than
+ * returning null, so a misconfigured sandbox fails loudly instead of silently
+ * falling back to (absent) credentials.json and emitting a confusing "not logged
+ * in" message.
+ */
+export declare function resolveEnvBearerToken(): string | null;
+/**
+ * THE uniform bearer resolution for every CLI command (ALI-1090). Exactly the
+ * order `authedFetch` uses: `ORIZU_TOKEN` env → `ORIZU_TOKEN_FILE` (both via
+ * resolveEnvBearerToken, read FRESH per call — never cached, so hosted token
+ * rotations are picked up) → stored credentials.json. Commands that need a raw
+ * bearer (`orizu env`, the run-gepa wrapper) MUST use this instead of reading
+ * credentials.json directly, or they break in hosted sandboxes that are
+ * pre-authenticated via ORIZU_TOKEN_FILE and never ran `orizu login`.
+ */
+export declare function resolveAuthTokenForBaseUrl(baseUrl: string): string;
+/**
+ * Non-throwing "is any auth available?" check (login --no-prompt-if-logged-in,
+ * setup status). Mirrors resolveAuthTokenForBaseUrl's order so an env bearer
+ * counts as signed in. A misconfigured ORIZU_TOKEN_FILE reports false here —
+ * actual requests still fail loudly via resolveEnvBearerToken.
+ */
+export declare function hasResolvableAuth(baseUrl: string): boolean;
+export declare function setActiveBaseUrl(baseUrl: string | null): void;
+export declare function clearServerCredentials(baseUrl: string): boolean;
+export declare function clearCredentialsFile(): void;
+//# sourceMappingURL=credentials.d.ts.map

package/dist/credentials.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credentials.d.ts","sourceRoot":"","sources":["../src/credentials.ts"],"names":[],"mappings":"AAeA,OAAO,EACL,iBAAiB,EAEjB,mBAAmB,EACnB,mBAAmB,EACpB,MAAM,YAAY,CAAA;AAkHnB,wBAAgB,qBAAqB,IAAI,mBAAmB,GAAG,mBAAmB,GAAG,IAAI,CA8BxF;AAED,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,iBAAiB,GAAG,IAAI,CAW9E;AAED,wBAAgB,qBAAqB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAapF;AAED,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,iBAAiB,QAWtF;AAED,wBAAgB,gBAAgB,IAAI,MAAM,GAAG,IAAI,CAGhD;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,wBAAgB,qBAAqB,IAAI,MAAM,GAAG,IAAI,CA0BrD;AAED;;;;;;;;GAQG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,EAAE,MAAM,GAAG,MAAM,CAYlE;AAED;;;;;GAKG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAS1D;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,QAItD;AAED,wBAAgB,sBAAsB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAY/D;AAED,wBAAgB,oBAAoB,SAKnC"}

package/dist/csv.d.ts

@@ -0,0 +1,49 @@
+/**
+ * CSV parsing utilities with RFC 4180 compliance.
+ *
+ * This is the single canonical implementation shared by the web app and the
+ * published CLI: lib/csv-utils.ts re-exports from here. It lives inside
+ * packages/cli because the CLI is published standalone to npm and cannot
+ * import files outside its package root, while the app can import anything.
+ *
+ * Resource limits are enforced while parsing so a hostile CSV cannot exhaust
+ * memory. The numeric defaults are inlined here (this package cannot import
+ * @/lib/resource-limits) and mirror RESOURCE_LIMITS.CSV_* in that module —
+ * keep the two in sync.
+ */
+export declare class CSVResourceLimitError extends Error {
+    constructor(message: string);
+}
+export interface CSVParseOptions {
+    maxBytes?: number;
+    maxRows?: number;
+    maxFields?: number;
+    maxFieldBytes?: number;
+}
+/**
+ * Parses CSV text into a 2D array of strings, handling quoted fields, escaped
+ * quotes, multiline fields, and different line endings (CRLF, LF, CR).
+ * Completely empty rows are skipped.
+ *
+ * Resource limits (size, rows, fields, field size) are enforced during
+ * parsing; pass `options` to override the defaults. A violation throws
+ * {@link CSVResourceLimitError}.
+ *
+ * @example
+ * ```typescript
+ * const csv = 'name,age,city\nJohn,25,"New York"'
+ * parseCSV(csv) // [['name', 'age', 'city'], ['John', '25', 'New York']]
+ * ```
+ */
+export declare function parseCSV(csvText: string, options?: CSVParseOptions): string[][];
+/**
+ * Parses CSV data into an array of objects using the first row as headers.
+ *
+ * @example
+ * ```typescript
+ * const csv = 'name,age\nJohn,25'
+ * parseCSVToObjects(csv) // [{ name: 'John', age: '25' }]
+ * ```
+ */
+export declare function parseCSVToObjects(csvText: string, options?: CSVParseOptions): Record<string, string>[];
+//# sourceMappingURL=csv.d.ts.map

package/dist/csv.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csv.d.ts","sourceRoot":"","sources":["../src/csv.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,qBAAa,qBAAsB,SAAQ,KAAK;gBAClC,OAAO,EAAE,MAAM;CAI5B;AAED,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,aAAa,CAAC,EAAE,MAAM,CAAA;CACvB;AA6ED;;;;;;;;;;;;;;GAcG;AACH,wBAAgB,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,GAAE,eAAoB,GAAG,MAAM,EAAE,EAAE,CA+DnF;AAED;;;;;;;;GAQG;AACH,wBAAgB,iBAAiB,CAC/B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,eAAoB,GAC5B,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAiB1B"}

package/dist/dataset-download.d.ts

@@ -0,0 +1,6 @@
+export interface ParsedDatasetReference {
+    datasetId: string;
+    project?: string;
+}
+export declare function parseDatasetReference(input: string): ParsedDatasetReference;
+//# sourceMappingURL=dataset-download.d.ts.map

package/dist/dataset-download.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-download.d.ts","sourceRoot":"","sources":["../src/dataset-download.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,OAAO,CAAC,EAAE,MAAM,CAAA;CACjB;AAID,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,sBAAsB,CA4B3E"}

package/dist/dataset-edit-rows.d.ts

@@ -0,0 +1,10 @@
+export interface DatasetEditRowsOptions {
+    datasetId: string;
+    file: string;
+    json: boolean;
+    printJson: (value: Record<string, unknown>) => void;
+    printLine: (value: string) => void;
+    sanitize: (value: string) => string;
+}
+export declare function editDatasetRows(options: DatasetEditRowsOptions): Promise<void>;
+//# sourceMappingURL=dataset-edit-rows.d.ts.map

package/dist/dataset-edit-rows.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-edit-rows.d.ts","sourceRoot":"","sources":["../src/dataset-edit-rows.ts"],"names":[],"mappings":"AAeA,MAAM,WAAW,sBAAsB;IACrC,SAAS,EAAE,MAAM,CAAA;IACjB,IAAI,EAAE,MAAM,CAAA;IACZ,IAAI,EAAE,OAAO,CAAA;IACb,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACnD,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,IAAI,CAAA;IAClC,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,CAAA;CACpC;AAsDD,wBAAsB,eAAe,CAAC,OAAO,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CA+CpF"}

package/dist/dataset-upload-snapshot.d.ts

@@ -0,0 +1,13 @@
+interface UploadedDatasetIdentity {
+    id: string;
+    name: string;
+    rowCount: number;
+}
+interface DatasetVersionSnapshot {
+    datasetVersion: {
+        id: string;
+    };
+}
+export declare function ensureDatasetUploadSnapshot<T extends DatasetVersionSnapshot>(dataset: UploadedDatasetIdentity, jsonOutput: boolean, createSnapshot: (datasetId: string) => Promise<T>): Promise<T>;
+export {};
+//# sourceMappingURL=dataset-upload-snapshot.d.ts.map

package/dist/dataset-upload-snapshot.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dataset-upload-snapshot.d.ts","sourceRoot":"","sources":["../src/dataset-upload-snapshot.ts"],"names":[],"mappings":"AAAA,UAAU,uBAAuB;IAC/B,EAAE,EAAE,MAAM,CAAA;IACV,IAAI,EAAE,MAAM,CAAA;IACZ,QAAQ,EAAE,MAAM,CAAA;CACjB;AAED,UAAU,sBAAsB;IAC9B,cAAc,EAAE;QACd,EAAE,EAAE,MAAM,CAAA;KACX,CAAA;CACF;AAED,wBAAsB,2BAA2B,CAAC,CAAC,SAAS,sBAAsB,EAChF,OAAO,EAAE,uBAAuB,EAChC,UAAU,EAAE,OAAO,EACnB,cAAc,EAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,GAChD,OAAO,CAAC,CAAC,CAAC,CAwBZ"}

package/dist/daytona-slice-rehearsal.d.ts

@@ -0,0 +1,89 @@
+/**
+ * Self-contained rehearsal harness for the Daytona slice (ALI-973 / WS-F).
+ *
+ * Extends the smoke test's in-memory fake-server technique to the WS-F broker /
+ * session-branch / finish-branch / apply contracts, and backs it with a REAL
+ * local bare git repo so the whole flow (clone → commit → push → merge) runs
+ * against genuine git. Consumed by BOTH the unit test and the local-sim
+ * rehearsal in `scripts/daytona-workbench-slice.mjs`, so the two never drift.
+ *
+ * This is the piece that makes `--provider local-sim` a rehearsal, not a mock:
+ * `finish-branch` and `apply` shell out to git on the bare repo (rev-list /
+ * update-ref), so a session branch really is merged into `main`.
+ */
+import type { SliceConfig, SliceFetcher } from './daytona-slice.js';
+import type { SandboxProvider } from './sandbox-provider.js';
+export interface SeededBareRepo {
+    gitDir: string;
+    repoFullName: string;
+    defaultBranch: string;
+}
+/**
+ * Create a bare git repo seeded with the Phase-1 workbench contract (matching
+ * `lib/workbench-repo-contract.ts`) on a `main` branch: root manifests, a
+ * `.gitignore` that ignores `.orizu/`, and a project stub.
+ */
+export declare function seedLocalBareRepo(baseDir: string, config: SliceConfig): SeededBareRepo;
+interface StoredSession {
+    id: string;
+    workspaceId: string;
+    branch: string | null;
+    headSha: string | null;
+    projectSlug: string | null;
+}
+interface StoredMint {
+    id: string;
+    workspaceId: string;
+    purpose: string;
+    revoked: boolean;
+}
+interface StoredManifest {
+    id: string;
+    status: string;
+    branch: string;
+    headSha: string;
+    outcome: Record<string, unknown>;
+}
+/**
+ * In-memory WS-F control plane over a real bare repo. Session-start cuts a real
+ * branch; finish-branch diffs it; apply fast-forwards `main`. Tracks token mints
+ * so revocation is observable and asserts tokens never leak into stored state.
+ */
+export declare class FakeWorkbenchApi {
+    private readonly repo;
+    workspaces: Map<string, {
+        id: string;
+        teamSlug: string;
+        slug: string;
+    }>;
+    sessions: Map<string, StoredSession>;
+    mints: Map<string, StoredMint>;
+    manifests: Map<string, StoredManifest>;
+    tokensIssued: string[];
+    private counter;
+    constructor(repo: SeededBareRepo);
+    private id;
+    private branchHead;
+    newFetcher(): SliceFetcher;
+}
+export interface SliceRehearsal {
+    config: SliceConfig;
+    api: FakeWorkbenchApi;
+    provider: SandboxProvider;
+    makeFetcher: () => SliceFetcher;
+    resolveCloneUrl: (repo: string) => string;
+    bareRepoDir: string;
+    defaultBranch: () => string;
+    cleanup: () => void;
+}
+/**
+ * Wire a full self-contained rehearsal: seed a bare repo, stand up the fake
+ * control plane, and hand back a local-sim provider + resolveCloneUrl that maps
+ * the broker's repo name to the bare repo path.
+ */
+export declare function createSliceRehearsal(options?: {
+    config?: Partial<SliceConfig>;
+    keep?: boolean;
+}): SliceRehearsal;
+export {};
+//# sourceMappingURL=daytona-slice-rehearsal.d.ts.map

package/dist/daytona-slice-rehearsal.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daytona-slice-rehearsal.d.ts","sourceRoot":"","sources":["../src/daytona-slice-rehearsal.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAQH,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AAEnE,OAAO,KAAK,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAA;AA2B5D,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAA;IACd,YAAY,EAAE,MAAM,CAAA;IACpB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,WAAW,GAAG,cAAc,CAmCtF;AAED,UAAU,aAAa;IACrB,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAA;IACrB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAA;IACtB,WAAW,EAAE,MAAM,GAAG,IAAI,CAAA;CAC3B;AAED,UAAU,UAAU;IAClB,EAAE,EAAE,MAAM,CAAA;IACV,WAAW,EAAE,MAAM,CAAA;IACnB,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,OAAO,CAAA;CACjB;AAED,UAAU,cAAc;IACtB,EAAE,EAAE,MAAM,CAAA;IACV,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CACjC;AAMD;;;;GAIG;AACH,qBAAa,gBAAgB;IAQf,OAAO,CAAC,QAAQ,CAAC,IAAI;IAPjC,UAAU;YAAyB,MAAM;kBAAY,MAAM;cAAQ,MAAM;OAAK;IAC9E,QAAQ,6BAAmC;IAC3C,KAAK,0BAAgC;IACrC,SAAS,8BAAoC;IAC7C,YAAY,EAAE,MAAM,EAAE,CAAK;IAC3B,OAAO,CAAC,OAAO,CAAI;gBAEU,IAAI,EAAE,cAAc;IAEjD,OAAO,CAAC,EAAE;IAKV,OAAO,CAAC,UAAU;IAIlB,UAAU,IAAI,YAAY;CAkI3B;AAED,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,WAAW,CAAA;IACnB,GAAG,EAAE,gBAAgB,CAAA;IACrB,QAAQ,EAAE,eAAe,CAAA;IACzB,WAAW,EAAE,MAAM,YAAY,CAAA;IAC/B,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,MAAM,CAAA;IAC3B,OAAO,EAAE,MAAM,IAAI,CAAA;CACpB;AAED;;;;GAIG;AACH,wBAAgB,oBAAoB,CAAC,OAAO,GAAE;IAAE,MAAM,CAAC,EAAE,OAAO,CAAC,WAAW,CAAC,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,cAAc,CAuBpH"}

package/dist/daytona-slice.d.ts

@@ -0,0 +1,106 @@
+/**
+ * Daytona thin-slice load path — pure step logic (ALI-973 / WS-F).
+ *
+ * smoke.ts-style: an importable eight-step workflow with an injected fetcher
+ * factory + an injected `SandboxProvider` (ADR-003 seam). The `scripts/daytona-
+ * workbench-slice.mjs` driver supplies a live-server fetcher + a real provider;
+ * the unit test and the local-sim rehearsal supply an in-memory API fake + the
+ * local-sim provider. No process/argv/print here.
+ *
+ * The slice proves the full hosted-agent load path against the GitHub-hosted
+ * repo, deliberately thin — its purpose is to pin the token-broker API shape
+ * before Phase 3:
+ *   1. resolve workspace + start a session on its own repo branch,
+ *   2. create a sandbox via the provider,
+ *   3. mint a READ token and clone the session branch INSIDE the sandbox,
+ *   4. read + parse the root manifests (orizu.team.json, schemaVersion),
+ *   5. resolve one object ref WITHOUT committing bytes (falls back to proving
+ *      `.orizu/` is the git-ignored materialization target when the exemplar
+ *      workspace carries no object refs),
+ *   6. write a small generated file + commit inside the sandbox,
+ *   7. mint a WRITE token, push the session branch, revoke BOTH tokens,
+ *   8. token-hygiene sweep (no token residue on the sandbox fs), then finish-
+ *      branch → approve → apply via the API, then destroy the sandbox.
+ */
+import type { SandboxProvider, SandboxProviderKind, SandboxSession } from './sandbox-provider.js';
+import { type HygieneFinding } from './sandbox-hygiene.js';
+export type SliceFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+export interface SliceConfig {
+    teamSlug: string;
+    projectSlug: string;
+    workspaceSlug: string;
+}
+export interface SliceStepPlan {
+    index: number;
+    key: string;
+    title: string;
+    plan: string;
+}
+export interface SliceStepReport {
+    index: number;
+    key: string;
+    title: string;
+    ok: boolean;
+    detail: string;
+    durationMs: number;
+}
+export interface SliceReport {
+    ok: boolean;
+    provider: SandboxProviderKind;
+    steps: SliceStepReport[];
+    failedStep: SliceStepReport | null;
+    totalMs: number;
+    hygiene: {
+        clean: boolean;
+        findings: HygieneFinding[];
+    } | null;
+    ids: {
+        workspaceId?: string;
+        sessionId?: string;
+        branch?: string;
+        repo?: string;
+        sandboxId?: string;
+        readMintId?: string;
+        writeMintId?: string;
+        manifestId?: string;
+        commitSha?: string;
+        mergeOutcome?: string;
+        /** Set on the error path when a session branch was pushed but the run did
+         *  not reach the merge — names the branch left on the remote for cleanup. */
+        orphanedBranch?: string;
+    };
+}
+export interface SliceHooks {
+    /** Test seam: run after commit/push, immediately BEFORE the hygiene sweep.
+     *  Used to plant a credential so the sweep's detection power is provable. */
+    beforeHygiene?: (session: SandboxSession, ctx: {
+        repoPath: string;
+    }) => Promise<void> | void;
+}
+export interface RunSliceOptions {
+    config: SliceConfig;
+    makeFetcher: () => SliceFetcher;
+    provider: SandboxProvider;
+    /** Map the broker's repo full-name to a clone URL the provider understands.
+     *  Live: `https://github.com/<repo>.git`. Local-sim: the bare repo path. */
+    resolveCloneUrl: (repo: string) => string;
+    now?: () => number;
+    onStep?: (step: SliceStepReport) => void;
+    keep?: boolean;
+    generatedFileName?: string;
+    generatedFileBody?: string;
+    hooks?: SliceHooks;
+}
+export declare function planSliceSteps(): SliceStepPlan[];
+export interface ProviderSelectionInput {
+    providerFlag?: string | null;
+    hasDaytonaKey: boolean;
+}
+/**
+ * Resolve the provider kind. An explicit `--provider` flag always wins; with no
+ * flag the default is `local-sim` when DAYTONA_API_KEY is absent, and `daytona`
+ * when it is present (the live run is founder-gated by that key).
+ */
+export declare function selectProviderKind(input: ProviderSelectionInput): SandboxProviderKind;
+export declare function runDaytonaSlice(opts: RunSliceOptions): Promise<SliceReport>;
+//# sourceMappingURL=daytona-slice.d.ts.map

package/dist/daytona-slice.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"daytona-slice.d.ts","sourceRoot":"","sources":["../src/daytona-slice.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAGH,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACjG,OAAO,EAAwB,KAAK,cAAc,EAAE,MAAM,sBAAsB,CAAA;AAEhF,MAAM,MAAM,YAAY,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAElF,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAA;IAChB,WAAW,EAAE,MAAM,CAAA;IACnB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,aAAa;IAC5B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,IAAI,EAAE,MAAM,CAAA;CACb;AAED,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,EAAE,EAAE,OAAO,CAAA;IACX,MAAM,EAAE,MAAM,CAAA;IACd,UAAU,EAAE,MAAM,CAAA;CACnB;AAED,MAAM,WAAW,WAAW;IAC1B,EAAE,EAAE,OAAO,CAAA;IACX,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,KAAK,EAAE,eAAe,EAAE,CAAA;IACxB,UAAU,EAAE,eAAe,GAAG,IAAI,CAAA;IAClC,OAAO,EAAE,MAAM,CAAA;IACf,OAAO,EAAE;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,EAAE,cAAc,EAAE,CAAA;KAAE,GAAG,IAAI,CAAA;IAC9D,GAAG,EAAE;QACH,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,MAAM,CAAC,EAAE,MAAM,CAAA;QACf,IAAI,CAAC,EAAE,MAAM,CAAA;QACb,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,WAAW,CAAC,EAAE,MAAM,CAAA;QACpB,UAAU,CAAC,EAAE,MAAM,CAAA;QACnB,SAAS,CAAC,EAAE,MAAM,CAAA;QAClB,YAAY,CAAC,EAAE,MAAM,CAAA;QACrB;qFAC6E;QAC7E,cAAc,CAAC,EAAE,MAAM,CAAA;KACxB,CAAA;CACF;AAED,MAAM,WAAW,UAAU;IACzB;iFAC6E;IAC7E,aAAa,CAAC,EAAE,CAAC,OAAO,EAAE,cAAc,EAAE,GAAG,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAA;KAAE,KAAK,OAAO,CAAC,IAAI,CAAC,GAAG,IAAI,CAAA;CAC7F;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,WAAW,CAAA;IACnB,WAAW,EAAE,MAAM,YAAY,CAAA;IAC/B,QAAQ,EAAE,eAAe,CAAA;IACzB;gFAC4E;IAC5E,eAAe,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,CAAA;IACzC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,eAAe,KAAK,IAAI,CAAA;IACxC,IAAI,CAAC,EAAE,OAAO,CAAA;IACd,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,iBAAiB,CAAC,EAAE,MAAM,CAAA;IAC1B,KAAK,CAAC,EAAE,UAAU,CAAA;CACnB;AAgBD,wBAAgB,cAAc,IAAI,aAAa,EAAE,CAEhD;AAYD,MAAM,WAAW,sBAAsB;IACrC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;IAC5B,aAAa,EAAE,OAAO,CAAA;CACvB;AAED;;;;GAIG;AACH,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,sBAAsB,GAAG,mBAAmB,CASrF;AA2GD,wBAAsB,eAAe,CAAC,IAAI,EAAE,eAAe,GAAG,OAAO,CAAC,WAAW,CAAC,CAoRjF"}