orizu 0.5.20 → 0.5.22

package/dist/deploy-key-merge-core.d.ts

@@ -0,0 +1,121 @@
+/**
+ * Transport-agnostic deploy-key merge core (ALI-1084, merge-sandbox-job
+ * Phase 0). Extracted VERBATIM from `lib/git-ssh-merge.ts` so both the server
+ * (`lib/`) and the published CLI (`orizu internal merge-job`, Phase 2) run the
+ * EXACT SAME merge logic — no forked implementations, one place where the
+ * ADR-007 §4 `--no-ff` invariant is asserted on the exact argv.
+ *
+ * DELIBERATELY NO `import 'server-only'`: this module runs inside the one-shot
+ * merge sandbox (a plain Node process) as well as on the server. It must not
+ * import anything outside the CLI package root (bun-bundled) — node builtins
+ * only. `lib/git-ssh-merge.ts` re-exports everything here so every existing
+ * server import path and test keeps working unchanged.
+ *
+ * SECURITY PROPERTIES (unchanged from the lib original):
+ *   - throwaway temp worktree + isolated SSH identity (key file mode 0600);
+ *   - pinned GitHub host keys (StrictHostKeyChecking=yes, own known_hosts);
+ *   - expected-head verification: the merge targets the REVIEWED SHA, never a
+ *     branch name;
+ *   - `merge-base --is-ancestor` alreadyMerged idempotency check;
+ *   - argv-asserted commit-preserving `--no-ff` merge (ADR-007 §4).
+ */
+export interface MergeBranchWithDeployKeyInput {
+    base: string;
+    sourceBranch: string;
+    expectedHeadSha: string;
+    commitMessage: string;
+    privateKeyPem: string;
+}
+export interface GitCommandResult {
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+}
+export type GitCommandRunner = (args: string[], options: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}) => Promise<GitCommandResult>;
+export interface MergeBranchWithDeployKeyDeps {
+    runGit?: GitCommandRunner;
+    /**
+     * D8 pre-push gate (merge-sandbox-job Phase 2): called IMMEDIATELY before
+     * `git push`, after the merge commit exists locally. Returning `false`
+     * aborts WITHOUT pushing (`superseded: true` in the result) — a manifest
+     * rejected while the job was in flight must never reach `main`. Absent
+     * (the local/server executor), the merge pushes unconditionally as before.
+     */
+    prePushGate?: () => Promise<boolean>;
+}
+/**
+ * The merge outcome contract. Structurally identical to `MergeResult` in
+ * `lib/github-repo-ops.ts` (which cannot be imported from the CLI package —
+ * it is server-only); TypeScript's structural typing keeps the two
+ * assignable, and `lib/git-ssh-merge.ts` continues to expose the lib-side
+ * type to server callers.
+ */
+export interface DeployKeyMergeResult {
+    merged: boolean;
+    sha: string | null;
+    /** true when the base already contained head (GitHub 204 equivalent). */
+    alreadyMerged: boolean;
+    /** true when git reported a merge conflict (409 equivalent). */
+    conflict: boolean;
+    /** true when the D8 pre-push gate refused the push (manifest no longer
+     *  appliable) — the merge commit was built but NEVER pushed. */
+    superseded?: boolean;
+    status: number;
+}
+/**
+ * Assert a git invocation is the commit-preserving seal merge ADR-007 §4
+ * requires. Called on the exact argv the merge runs with, so the invariant is
+ * enforced where the merge happens rather than by reviewer vigilance.
+ */
+export declare function assertCommitPreservingMergeArgs(args: readonly string[]): void;
+/**
+ * Strip git's repo-context env vars from a child git's environment. Git
+ * EXPORTS these into hook subprocesses (from a linked worktree, GIT_DIR is an
+ * ABSOLUTE path into the shared .git), so any descendant git command that
+ * inherits the parent env operates on THAT repo instead of its own cwd —
+ * `git config` writes land in the shared .git/config and `git init` flips it
+ * to core.bare=true (both observed when the pre-push hook ran the test suite
+ * from a worktree). Every real-git spawn must build its env through this.
+ */
+export declare function scrubGitRepoContextEnv(env?: NodeJS.ProcessEnv): NodeJS.ProcessEnv;
+export declare function defaultRunGit(args: string[], options: {
+    cwd: string;
+    env: NodeJS.ProcessEnv;
+}): Promise<GitCommandResult>;
+export declare function sshRemote(repoFullName: string): string;
+/**
+ * The SSH-over-the-HTTPS-port remote (GitHub-supported: `ssh.github.com:443`
+ * speaks the same SSH protocol, same auth, same host-key set). The MERGE core
+ * uses this endpoint because the merge sandbox's egress firewall enforces at
+ * the SNI/CIDR layer and reset raw SSH on :22 in the first live run
+ * (ALI-1084); :443 within GitHub's published git CIDRs is the compatible
+ * path. Equivalent from dev machines, so local/sandbox parity holds (D6).
+ * The push/read paths (D9/Phase 6) keep `sshRemote` untouched.
+ */
+export declare function sshRemoteOverHttpsPort(repoFullName: string): string;
+/** Exported for `lib/git-ssh-merge.ts` (pushFilesWithDeployKey keeps living
+ *  there — D9 scopes the push path as a follow-on, not part of the core). */
+export declare function assertGitOk(result: GitCommandResult, operation: string): void;
+export interface DeployKeyGitContext {
+    dir: string;
+    git: (args: string[]) => Promise<GitCommandResult>;
+    gitOk: (args: string[], operation: string) => Promise<GitCommandResult>;
+}
+/**
+ * Run a callback inside a throwaway git worktree wired to the repo's merge
+ * deploy key (isolated SSH identity + pinned GitHub host keys). Exported for
+ * the ADR-007 read path (lib/artifact-git-read.ts), which reuses the same
+ * clone/pack infrastructure for bulk artifact reads.
+ */
+export declare function withDeployKeyGit<T>(privateKeyPem: string, runGit: GitCommandRunner, tempPrefix: string, callback: (context: DeployKeyGitContext) => Promise<T>): Promise<T>;
+/**
+ * Merge a reviewed session/revert branch head into the default branch using the
+ * server-only merge deploy key. The source branch is fetched only so GitHub can
+ * prove the reviewed SHA is still the branch tip; the merge itself targets the
+ * expected SHA, preserving the manifest CAS guarantee.
+ */
+export declare function mergeBranchWithDeployKey(repoFullName: string, input: MergeBranchWithDeployKeyInput, deps?: MergeBranchWithDeployKeyDeps): Promise<DeployKeyMergeResult>;
+//# sourceMappingURL=deploy-key-merge-core.d.ts.map

package/dist/deploy-key-merge-core.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"deploy-key-merge-core.d.ts","sourceRoot":"","sources":["../src/deploy-key-merge-core.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAOH,MAAM,WAAW,6BAA6B;IAC5C,IAAI,EAAE,MAAM,CAAA;IACZ,YAAY,EAAE,MAAM,CAAA;IACpB,eAAe,EAAE,MAAM,CAAA;IACvB,aAAa,EAAE,MAAM,CAAA;IACrB,aAAa,EAAE,MAAM,CAAA;CACtB;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,MAAM,CAAA;IACd,MAAM,EAAE,MAAM,CAAA;CACf;AAED,MAAM,MAAM,gBAAgB,GAAG,CAC7B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,KAC7C,OAAO,CAAC,gBAAgB,CAAC,CAAA;AAE9B,MAAM,WAAW,4BAA4B;IAC3C,MAAM,CAAC,EAAE,gBAAgB,CAAA;IACzB;;;;;;OAMG;IACH,WAAW,CAAC,EAAE,MAAM,OAAO,CAAC,OAAO,CAAC,CAAA;CACrC;AAED;;;;;;GAMG;AACH,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,OAAO,CAAA;IACf,GAAG,EAAE,MAAM,GAAG,IAAI,CAAA;IAClB,yEAAyE;IACzE,aAAa,EAAE,OAAO,CAAA;IACtB,gEAAgE;IAChE,QAAQ,EAAE,OAAO,CAAA;IACjB;oEACgE;IAChE,UAAU,CAAC,EAAE,OAAO,CAAA;IACpB,MAAM,EAAE,MAAM,CAAA;CACf;AAaD;;;;GAIG;AACH,wBAAgB,+BAA+B,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAgB7E;AA0BD;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,GAAE,MAAM,CAAC,UAAwB,GAAG,MAAM,CAAC,UAAU,CAS9F;AAID,wBAAgB,aAAa,CAC3B,IAAI,EAAE,MAAM,EAAE,EACd,OAAO,EAAE;IAAE,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC,UAAU,CAAA;CAAE,GAC/C,OAAO,CAAC,gBAAgB,CAAC,CAgB3B;AAED,wBAAgB,SAAS,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAKtD;AAED;;;;;;;;GAQG;AACH,wBAAgB,sBAAsB,CAAC,YAAY,EAAE,MAAM,GAAG,MAAM,CAKnE;AAMD;6EAC6E;AAC7E,wBAAgB,WAAW,CAAC,MAAM,EAAE,gBAAgB,EAAE,SAAS,EAAE,MAAM,GAAG,IAAI,CAI7E;AAOD,MAAM,WAAW,mBAAmB;IAClC,GAAG,EAAE,MAAM,CAAA;IACX,GAAG,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;IAClD,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,gBAAgB,CAAC,CAAA;CACxE;AAED;;;;;GAKG;AACH,wBAAsB,gBAAgB,CAAC,CAAC,EACtC,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,gBAAgB,EACxB,UAAU,EAAE,MAAM,EAClB,QAAQ,EAAE,CAAC,OAAO,EAAE,mBAAmB,KAAK,OAAO,CAAC,CAAC,CAAC,GACrD,OAAO,CAAC,CAAC,CAAC,CAwCZ;AAED;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,YAAY,EAAE,MAAM,EACpB,KAAK,EAAE,6BAA6B,EACpC,IAAI,GAAE,4BAAiC,GACtC,OAAO,CAAC,oBAAoB,CAAC,CAsE/B"}

package/dist/diff-comments-cli.d.ts

@@ -0,0 +1,12 @@
+export interface DiffCommentsCliContext {
+    getArg: (name: string) => string | null;
+    rejectDashPrefixedOptionValue: (name: string, value: string | null) => void;
+    authedFetch: (path: string, init?: RequestInit) => Promise<Response>;
+    parseJsonResponse: <T>(response: Response, context: string) => Promise<T>;
+    hasJsonFlag: () => boolean;
+    printJson: (value: Record<string, unknown>) => void;
+    printLine: (message?: string) => void;
+    sanitizeTerminalText: (value: unknown) => string;
+}
+export declare function diffCommentsCommand(ctx: DiffCommentsCliContext): Promise<void>;
+//# sourceMappingURL=diff-comments-cli.d.ts.map

package/dist/diff-comments-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"diff-comments-cli.d.ts","sourceRoot":"","sources":["../src/diff-comments-cli.ts"],"names":[],"mappings":"AAyFA,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAA;IACvC,6BAA6B,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,CAAA;IAC3E,WAAW,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;IACpE,iBAAiB,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,QAAQ,EAAE,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,CAAA;IACzE,WAAW,EAAE,MAAM,OAAO,CAAA;IAC1B,SAAS,EAAE,CAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,IAAI,CAAA;IACnD,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,KAAK,IAAI,CAAA;IACrC,oBAAoB,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,MAAM,CAAA;CACjD;AAwTD,wBAAsB,mBAAmB,CAAC,GAAG,EAAE,sBAAsB,iBAiBpE"}

package/dist/diff-comments-cli.js

@@ -198,6 +198,9 @@ function printDiffComments(ctx, payload) {
                 `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.anchor.side)} line ` +
                 `${sanitizeHumanInlineText(ctx.sanitizeTerminalText, String(comment.anchor.line + 1))}`);
             printHumanTextBlock(ctx, comment.body);
+            if (typeof comment.componentKey === 'string' && comment.componentKey) {
+                ctx.printLine(`    Component: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.componentKey)}`);
+            }
             if (comment.contextUnavailableReason) {
                 ctx.printLine(`    Context unavailable: ${sanitizeHumanInlineText(ctx.sanitizeTerminalText, comment.contextUnavailableReason)}`);
                 if (comment.context) {

package/dist/egress-allowlist-cli.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Per-team ADDITIVE egress allowlist CLI (ALI-1006 / G5):
+ *   orizu team egress-allowlist <team>                 # show extra domains
+ *   orizu team egress-allowlist <team> --add <domain>
+ *   orizu team egress-allowlist <team> --remove <domain>
+ *   orizu team egress-allowlist <team> --set a.com,b.com
+ *   orizu team egress-allowlist <team> --clear
+ *
+ * The BASE allowlist (Orizu API + model provider + git host) is code-owned and
+ * NOT shown/managed here — this surface only widens a team's egress with domains
+ * a customer workflow needs. Human ADMIN only: the server rejects agent bearers
+ * and non-admins (the definer RPC gates on is_team_admin). Pure command logic
+ * with an injected fetcher.
+ */
+export type CliFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+export interface EgressAllowlistCommandIo {
+    json: boolean;
+    print: (line: string) => void;
+    printErr?: (line: string) => void;
+    fetcher?: CliFetcher;
+}
+export declare function egressAllowlistCommand(args: string[], io: EgressAllowlistCommandIo): Promise<number>;
+//# sourceMappingURL=egress-allowlist-cli.d.ts.map

package/dist/egress-allowlist-cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-allowlist-cli.d.ts","sourceRoot":"","sources":["../src/egress-allowlist-cli.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAWH,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAEhF,MAAM,WAAW,wBAAwB;IACvC,IAAI,EAAE,OAAO,CAAA;IACb,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IACjC,OAAO,CAAC,EAAE,UAAU,CAAA;CACrB;AAiID,wBAAsB,sBAAsB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,EAAE,EAAE,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,CA4D1G"}

package/dist/egress-policy.d.ts

@@ -0,0 +1,108 @@
+/**
+ * G5 — sandbox egress policy builder (ALI-1006, per the hosted-agent threat
+ * model T1). Owns the ALLOWLIST CONTENT the `SandboxProvider` seam plumbs to the
+ * sandbox firewall at create (`packages/cli/src/vercel-sandbox-provider.ts` →
+ * Vercel `networkPolicy`). The Vercel adapter is a pass-through; this file is
+ * where "default-deny with a per-team allowlist (Orizu API, model providers, git
+ * host); blocked attempts logged" is actually decided.
+ *
+ * The policy is DEFAULT-DENY: the record form `{ allow: { host: rules } }` denies
+ * everything NOT explicitly listed, so the correctness invariant is simply that
+ * we NEVER emit a `"*"` allow entry (which would re-open the sandbox). The
+ * model-key credential broker (G3 / `buildModelKeyBrokerPolicy`) is COMPOSED onto
+ * the model host's rule here so brokering + allowlisting are ONE coherent policy,
+ * not two policies that could disagree.
+ *
+ * SNI matching (verified against @vercel/sandbox@1.10.2 `NetworkPolicy`): an
+ * allow entry matches the exact SNI host; a LEADING-wildcard entry (`*.orizu.ai`)
+ * matches any single-or-multi-label subdomain but NOT the apex — so a host that
+ * must serve BOTH apex and subdomains is listed twice (`orizu.ai` +
+ * `*.orizu.ai`). Domains are hostnames only — never a protocol, path, or port.
+ *
+ * The BASE allowlist (Orizu API + model provider + git host) is CODE-OWNED and
+ * non-negotiable: `buildEgressPolicy` always includes it and per-team config can
+ * only ADD to it, never remove a base host. See
+ * docs/requirements/hosted-customer-workbench/sandbox-egress-policy.md for the
+ * rationale per host and the honest statement of what Vercel enforces (firewall,
+ * SNI-level) vs. what we generate (blocked-attempt evidence via the canary).
+ */
+import type { SandboxEgressPolicy } from './sandbox-provider.js';
+/** Default model-provider endpoint (Anthropic) the broker injects a key for. */
+export declare const ANTHROPIC_API_HOST = "api.anthropic.com";
+/** Anthropic authenticates with `x-api-key` (not a Bearer Authorization). */
+export declare const ANTHROPIC_API_KEY_HEADER = "x-api-key";
+/** GitHub git-over-HTTPS SNIs. `git clone`/`git push` over the smart HTTP
+ *  protocol connect to `github.com`; `codeload.github.com` serves repository
+ *  archive/tarball fetches (release assets, `pip`/`go` github-archive installs).
+ *  Both are allowed so the agent's git work AND any archive fetch its workflow
+ *  triggers succeed — everything else on github's infra stays denied. */
+export declare const GIT_HOST_DOMAINS: readonly ["github.com", "codeload.github.com"];
+/** Default host the startup canary probes to PROVE the policy is live (a known
+ *  non-allowlisted host: reaching it means egress is NOT enforced). */
+export declare const DEFAULT_EGRESS_CANARY_HOST = "example.com";
+/**
+ * Resolve the Orizu control-plane host from a base URL and CONSERVATIVELY
+ * wildcard its registrable base domain so the policy survives the API moving to
+ * a subdomain (e.g. `api.orizu.ai`) without re-opening egress. Returns the apex
+ * PLUS a leading-wildcard for its subdomains: `orizu.ai` + `*.orizu.ai`. A
+ * loopback/localhost base (rehearsal) yields just the bare host (no wildcard —
+ * there is nothing to broaden and the firewall does not enforce it anyway).
+ */
+export declare function orizuEgressDomains(baseUrl: string | undefined): string[];
+/**
+ * Normalize a per-team extra domain to a bare hostname (or leading-wildcard).
+ * Strips protocol/path/port, lowercases, and validates the SNI shape. Returns
+ * null for anything that is not a plausible hostname so a bad config entry is
+ * dropped rather than silently widening the policy in an unexpected way.
+ */
+export declare function normalizeEgressDomain(input: string): string | null;
+export interface EgressModelKeyBroker {
+    /** The raw model API key. It lives ONLY in the policy the host sends to the
+     *  firewall control plane; it never enters the sandbox env/disk/run events. */
+    apiKey: string;
+    /** Domain to inject the key for (default api.anthropic.com). */
+    host?: string;
+    /** Header the endpoint authenticates with (default x-api-key). */
+    headerName?: string;
+}
+export interface BuildEgressPolicyOptions {
+    /** Orizu control-plane base URL (default env ORIZU_BASE_URL / orizu.ai). */
+    orizuBaseUrl?: string;
+    /** Additional model-provider hosts to allow WITHOUT a key transform. The broker
+     *  host (below) is added automatically; list only extra providers here. */
+    modelHosts?: readonly string[];
+    /** Compose the G3 model-key broker transform onto its host's allow rule, so
+     *  brokering and the allowlist are one policy. */
+    modelKeyBroker?: EgressModelKeyBroker;
+    /** Per-team ADDITIVE domains (a customer's own API a workflow needs). Base
+     *  hosts can never be removed; these only widen. Invalid entries are dropped. */
+    extraDomains?: readonly string[];
+    /** Exact server-derived Git remote hosts needed in addition to the legacy
+     * GitHub migration hosts. Artifacts account hosts are passed here only after
+     * strict remote validation; never use a broad wildcard. */
+    repositoryHosts?: readonly string[];
+}
+/**
+ * Compute the ordered list of BASE (code-owned, non-removable) allow domains for
+ * an Orizu base URL: the Orizu control-plane host(s), the model provider host,
+ * and the git host(s). Exported so tests and the policy doc assert the exact set.
+ */
+export declare function baseEgressDomains(opts?: {
+    orizuBaseUrl?: string;
+    modelHost?: string;
+    modelHosts?: readonly string[];
+    repositoryHosts?: readonly string[];
+}): string[];
+/**
+ * Build a DEFAULT-DENY Vercel network policy whose allowlist is exactly the base
+ * hosts (Orizu API + model provider + git) plus any valid per-team extra domains,
+ * with the model-key broker transform COMPOSED onto the model host's rule.
+ *
+ * Correctness invariants (unit-tested):
+ *   - record form → default-deny (no `"*"` key is EVER emitted);
+ *   - every base host is present;
+ *   - the broker transform sits on the model host's rule (one coherent policy);
+ *   - base hosts survive regardless of `extraDomains` (cannot be removed).
+ */
+export declare function buildEgressPolicy(opts?: BuildEgressPolicyOptions): SandboxEgressPolicy;
+//# sourceMappingURL=egress-policy.d.ts.map

package/dist/egress-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"egress-policy.d.ts","sourceRoot":"","sources":["../src/egress-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,KAAK,EAAE,mBAAmB,EAAqB,MAAM,uBAAuB,CAAA;AAEnF,gFAAgF;AAChF,eAAO,MAAM,kBAAkB,sBAAsB,CAAA;AACrD,6EAA6E;AAC7E,eAAO,MAAM,wBAAwB,cAAc,CAAA;AAEnD;;;;yEAIyE;AACzE,eAAO,MAAM,gBAAgB,gDAAiD,CAAA;AAE9E;uEACuE;AACvE,eAAO,MAAM,0BAA0B,gBAAgB,CAAA;AAKvD;;;;;;;GAOG;AACH,wBAAgB,kBAAkB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CAwBxE;AAED;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAelE;AAED,MAAM,WAAW,oBAAoB;IACnC;mFAC+E;IAC/E,MAAM,EAAE,MAAM,CAAA;IACd,gEAAgE;IAChE,IAAI,CAAC,EAAE,MAAM,CAAA;IACb,kEAAkE;IAClE,UAAU,CAAC,EAAE,MAAM,CAAA;CACpB;AAED,MAAM,WAAW,wBAAwB;IACvC,4EAA4E;IAC5E,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB;+EAC2E;IAC3E,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B;sDACkD;IAClD,cAAc,CAAC,EAAE,oBAAoB,CAAA;IACrC;qFACiF;IACjF,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAChC;;+DAE2D;IAC3D,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CACpC;AAED;;;;GAIG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE;IACtC,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;IAC9B,eAAe,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAC/B,GAAG,MAAM,EAAE,CAuBhB;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,iBAAiB,CAAC,IAAI,GAAE,wBAA6B,GAAG,mBAAmB,CA6B1F"}

package/dist/error-response.d.ts

@@ -0,0 +1,9 @@
+interface ErrorResponsePayload {
+    error?: string;
+}
+export declare function isJsonErrorResponsePayload(response: Response, payload: unknown): payload is ErrorResponsePayload & {
+    error: string;
+};
+export declare function extractErrorMessage(response: Response): Promise<string>;
+export {};
+//# sourceMappingURL=error-response.d.ts.map

package/dist/error-response.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"error-response.d.ts","sourceRoot":"","sources":["../src/error-response.ts"],"names":[],"mappings":"AAEA,UAAU,oBAAoB;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAID,wBAAgB,0BAA0B,CACxC,QAAQ,EAAE,QAAQ,EAClB,OAAO,EAAE,OAAO,GACf,OAAO,IAAI,oBAAoB,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CASrD;AAMD,wBAAsB,mBAAmB,CAAC,QAAQ,EAAE,QAAQ,GAAG,OAAO,CAAC,MAAM,CAAC,CAa7E"}

package/dist/file-parser.d.ts

@@ -0,0 +1,5 @@
+export declare function parseDatasetFile(filePath: string): {
+    rows: Array<Record<string, unknown>>;
+    sourceType: 'csv' | 'json' | 'jsonl';
+};
+//# sourceMappingURL=file-parser.d.ts.map

package/dist/file-parser.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"file-parser.d.ts","sourceRoot":"","sources":["../src/file-parser.ts"],"names":[],"mappings":"AAIA,wBAAgB,gBAAgB,CAAC,QAAQ,EAAE,MAAM,GAAG;IAClD,IAAI,EAAE,KAAK,CAAC,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC,CAAA;IACpC,UAAU,EAAE,KAAK,GAAG,MAAM,GAAG,OAAO,CAAA;CACrC,CA6DA"}

package/dist/gepa-engine-dispatch.d.ts

@@ -0,0 +1,9 @@
+export type GepaEngine = 'official' | 'legacy';
+export interface GepaEngineDispatch {
+    engine: GepaEngine;
+    args: string[];
+    environment: NodeJS.ProcessEnv;
+    module: string;
+}
+export declare function dispatchGepaEngine(args: string[], project: string, environment: NodeJS.ProcessEnv): GepaEngineDispatch;
+//# sourceMappingURL=gepa-engine-dispatch.d.ts.map

package/dist/gepa-engine-dispatch.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gepa-engine-dispatch.d.ts","sourceRoot":"","sources":["../src/gepa-engine-dispatch.ts"],"names":[],"mappings":"AAIA,MAAM,MAAM,UAAU,GAAG,UAAU,GAAG,QAAQ,CAAA;AAE9C,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,UAAU,CAAA;IAClB,IAAI,EAAE,MAAM,EAAE,CAAA;IACd,WAAW,EAAE,MAAM,CAAC,UAAU,CAAA;IAC9B,MAAM,EAAE,MAAM,CAAA;CACf;AAyUD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,kBAAkB,CAmBtH"}

package/dist/gepa-engine-dispatch.js

@@ -1,4 +1,5 @@
 import { existsSync, readFileSync } from 'fs';
+import { normalizedSkilledProposerConfig } from './skilled-proposer-config.js';
 const VALUE_OPTIONS = [
     { flag: '--optimizer-version-id', environment: 'ORIZU_OPTIMIZER_VERSION_ID' },
     { flag: '--candidate-version-id', environment: 'ORIZU_PROMPT_VERSION_ID' },
@@ -16,6 +17,8 @@ const VALUE_OPTIONS = [
     { flag: '--budget', environment: 'ORIZU_BUDGET' },
     { flag: '--max-iterations', environment: 'ORIZU_MAX_ITERATIONS' },
     { flag: '--max-candidate-proposals', environment: 'ORIZU_MAX_CANDIDATE_PROPOSALS' },
+    { flag: '--proposal-max-calls', environment: 'ORIZU_PROPOSAL_MAX_CALLS' },
+    { flag: '--proposal-max-tokens', environment: 'ORIZU_PROPOSAL_MAX_TOKENS' },
     { flag: '--max-full-evals', environment: 'ORIZU_MAX_FULL_EVALS' },
     { flag: '--max-metric-calls', environment: 'ORIZU_MAX_METRIC_CALLS' },
     { flag: '--minibatch-size', environment: 'ORIZU_MINIBATCH_SIZE' },
@@ -33,6 +36,8 @@ const VALUE_OPTIONS = [
     { flag: '--seed', environment: 'ORIZU_SEED' },
     { flag: '--promotion-label', environment: 'ORIZU_PROMOTION_LABEL', allowEmpty: true },
     { flag: '--log-dir', environment: 'ORIZU_LOCAL_LOG_DIR' },
+    { flag: '--instruction-set', environment: 'ORIZU_INSTRUCTION_SET_NAME' },
+    { flag: '--model-config', environment: 'ORIZU_MODEL_CONFIG_IDENTITY' },
 ];
 const BOOLEAN_OPTIONS = [
     ['--allow-degenerate-seed', 'ORIZU_ALLOW_DEGENERATE_SEED', '1'],
@@ -139,6 +144,13 @@ const CONTROLLED_ENVIRONMENT_NAMES = new Set([
     'ORIZU_SAMPLING_STRATEGY',
     'ORIZU_SELECTION_STRATEGY',
     'ORIZU_MAX_PAYLOAD_CHARS',
+    'ORIZU_INSTRUCTION_SET_PROFILE_VERSION_ID',
+    // Candidate selection is an explicit opt-in.  Clearing it before option
+    // translation prevents an inherited environment from selecting a proposer
+    // on an otherwise byte-for-byte normal official-GEPA launch.
+    'ORIZU_CANDIDATE_PROPOSER',
+    'ORIZU_SKILLED_PROPOSER_CONFIG',
+    'ORIZU_COMPONENT_SELECTOR',
 ]);
 function optionValueOrThrow(args, index, flag, allowEmpty = false) {
     const argument = args[index];
@@ -163,6 +175,9 @@ function translateOfficialOptions(args, project, environment) {
     }
     connectorEnvironment.ORIZU_PROJECT = project;
     let metadata;
+    let candidateProposerConfig;
+    let hasInstructionSet = false;
+    let hasCandidateVersion = false;
     const budgetFlags = [];
     for (let index = 0; index < args.length; index += 1) {
         const argument = args[index];
@@ -170,6 +185,8 @@ function translateOfficialOptions(args, project, environment) {
             throw new Error(`Unexpected run-gepa argument ${argument}`);
         }
         const flag = argument.includes('=') ? argument.slice(0, argument.indexOf('=')) : argument;
+        if (flag === '--candidate-version-id')
+            hasCandidateVersion = true;
         if (flag === '--project') {
             const parsed = optionValueOrThrow(args, index, flag);
             connectorEnvironment.ORIZU_PROJECT = parsed.value;
@@ -182,6 +199,21 @@ function translateOfficialOptions(args, project, environment) {
             index = parsed.nextIndex;
             continue;
         }
+        if (flag === '--candidate-proposer') {
+            const parsed = optionValueOrThrow(args, index, flag);
+            if (parsed.value !== 'skilled-proposer') {
+                throw new Error('--candidate-proposer must be skilled-proposer');
+            }
+            connectorEnvironment.ORIZU_CANDIDATE_PROPOSER = parsed.value;
+            index = parsed.nextIndex;
+            continue;
+        }
+        if (flag === '--candidate-proposer-config') {
+            const parsed = optionValueOrThrow(args, index, flag);
+            candidateProposerConfig = parsed.value;
+            index = parsed.nextIndex;
+            continue;
+        }
         const option = VALUE_OPTIONS_BY_FLAG.get(flag);
         if (option) {
             const parsed = optionValueOrThrow(args, index, flag, option.allowEmpty);
@@ -203,6 +235,16 @@ function translateOfficialOptions(args, project, environment) {
             connectorEnvironment[option.environment] = option.json
                 ? jsonObjectValue(parsed.value, option.flag)
                 : option.readFile ? textValue(parsed.value) : parsed.value;
+            if (flag === '--instruction-set')
+                hasInstructionSet = true;
+            index = parsed.nextIndex;
+            continue;
+        }
+        if (flag === '--component-selector') {
+            const parsed = optionValueOrThrow(args, index, flag);
+            if (!['round-robin', 'all'].includes(parsed.value))
+                throw new Error('--component-selector must be one of round-robin, all');
+            connectorEnvironment.ORIZU_COMPONENT_SELECTOR = parsed.value.replace('-', '_');
             index = parsed.nextIndex;
             continue;
         }
@@ -222,6 +264,27 @@ function translateOfficialOptions(args, project, environment) {
     if (budgetFlags.length > 1) {
         throw new Error('Budget options are mutually exclusive; choose at most one of --budget, --max-metric-calls, --max-full-evals, --max-iterations, --max-candidate-proposals');
     }
+    if (hasInstructionSet && hasCandidateVersion)
+        throw new Error('--instruction-set and --candidate-version-id are mutually exclusive');
+    if (hasInstructionSet && connectorEnvironment.ORIZU_MODEL_CONFIG_IDENTITY === undefined)
+        throw new Error('--instruction-set requires --model-config');
+    if (hasInstructionSet && connectorEnvironment.ORIZU_COMPONENT_SELECTOR === undefined)
+        connectorEnvironment.ORIZU_COMPONENT_SELECTOR = 'round_robin';
+    if ((connectorEnvironment.ORIZU_PROPOSAL_MAX_CALLS !== undefined
+        || connectorEnvironment.ORIZU_PROPOSAL_MAX_TOKENS !== undefined)
+        && connectorEnvironment.ORIZU_CANDIDATE_PROPOSER !== 'skilled-proposer') {
+        throw new Error('--proposal-max-calls and --proposal-max-tokens require --candidate-proposer skilled-proposer');
+    }
+    if (candidateProposerConfig !== undefined) {
+        if (connectorEnvironment.ORIZU_CANDIDATE_PROPOSER !== 'skilled-proposer') {
+            throw new Error('--candidate-proposer-config requires --candidate-proposer skilled-proposer');
+        }
+        connectorEnvironment.ORIZU_SKILLED_PROPOSER_CONFIG = normalizedSkilledProposerConfig(candidateProposerConfig);
+    }
+    if (connectorEnvironment.ORIZU_CANDIDATE_PROPOSER === 'skilled-proposer'
+        && connectorEnvironment.ORIZU_REFLECTION_PROMPT_TEMPLATE !== undefined) {
+        throw new Error('--reflection-prompt-template is incompatible with --candidate-proposer skilled-proposer');
+    }
     const reflectionModel = connectorEnvironment.ORIZU_REFLECTION_MODEL ?? 'anthropic/claude-opus-4-7';
     if (!reflectionModel.startsWith('openai/') && connectorEnvironment.ORIZU_REFLECTION_MAX_TOKENS === undefined) {
         throw new Error('--reflection-max-tokens is required for Anthropic reflection models');
@@ -245,8 +308,10 @@ function validatedMetadata(raw) {
 export function dispatchGepaEngine(args, project, environment) {
     const selected = removeEngine(args);
     if (selected.engine === 'legacy') {
-        if (selected.args.some(argument => argument === '--max-candidate-proposals' || argument.startsWith('--max-candidate-proposals='))) {
-            throw new Error('--max-candidate-proposals is supported by the official GEPA engine only');
+        for (const flag of ['--instruction-set', '--model-config', '--component-selector', '--max-candidate-proposals', '--candidate-proposer', '--candidate-proposer-config', '--proposal-max-calls', '--proposal-max-tokens']) {
+            if (selected.args.some(argument => argument === flag || argument.startsWith(`${flag}=`))) {
+                throw new Error(`${flag} is supported by the official GEPA engine only`);
+            }
         }
         validateLegacyMetadata(selected.args);
         return {

package/dist/gepa-python-command.d.ts

@@ -0,0 +1,6 @@
+export interface GepaPythonCommand {
+    python: string;
+    args: string[];
+}
+export declare function getGepaPythonCommand(args: string[], environment: NodeJS.ProcessEnv): GepaPythonCommand;
+//# sourceMappingURL=gepa-python-command.d.ts.map

package/dist/gepa-python-command.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gepa-python-command.d.ts","sourceRoot":"","sources":["../src/gepa-python-command.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAA;IACd,IAAI,EAAE,MAAM,EAAE,CAAA;CACf;AAED,wBAAgB,oBAAoB,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,MAAM,CAAC,UAAU,GAAG,iBAAiB,CAyBtG"}

package/dist/gepa-python-paths.d.ts

@@ -0,0 +1,6 @@
+export declare function resolveGepaPythonPath(candidates: string[], pathExists?: (candidate: string) => boolean): string | null;
+export declare function bundledOrizuGepaPythonPath(): string | null;
+export declare function bundledOrizuGepaConnectorPythonPath(): string | null;
+export declare function bundledOfficialGepaPythonPath(): string | null;
+export declare function getGepaPythonPathEntries(existingPythonPath: string | undefined): string[];
+//# sourceMappingURL=gepa-python-paths.d.ts.map

package/dist/gepa-python-paths.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"gepa-python-paths.d.ts","sourceRoot":"","sources":["../src/gepa-python-paths.ts"],"names":[],"mappings":"AAaA,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAAE,EACpB,UAAU,GAAE,CAAC,SAAS,EAAE,MAAM,KAAK,OAAoB,GACtD,MAAM,GAAG,IAAI,CAEf;AAED,wBAAgB,0BAA0B,IAAI,MAAM,GAAG,IAAI,CAM1D;AAED,wBAAgB,mCAAmC,IAAI,MAAM,GAAG,IAAI,CAMnE;AAED,wBAAgB,6BAA6B,IAAI,MAAM,GAAG,IAAI,CA0B7D;AAED,wBAAgB,wBAAwB,CAAC,kBAAkB,EAAE,MAAM,GAAG,SAAS,GAAG,MAAM,EAAE,CASzF"}

package/dist/gepa-python-paths.js

@@ -1,4 +1,5 @@
 import { existsSync } from 'fs';
+import { execFileSync } from 'child_process';
 import { fileURLToPath } from 'url';
 import { isOrizuSourceCheckout } from '../scripts/orizu-source-checkout.mjs';
 function prefersLiveSource() {
@@ -23,10 +24,31 @@ export function bundledOrizuGepaConnectorPythonPath() {
     return resolveGepaPythonPath(candidates);
 }
 export function bundledOfficialGepaPythonPath() {
-    const candidates = [
-        fileURLToPath(new URL('../vendor/gepa-python/src', import.meta.url)),
-    ];
-    return resolveGepaPythonPath(candidates);
+    const vendor = fileURLToPath(new URL('../vendor/gepa-python/src', import.meta.url));
+    if (prefersLiveSource()) {
+        const requiredVendorFiles = [
+            fileURLToPath(new URL('../vendor/gepa-python/manifest.json', import.meta.url)),
+            fileURLToPath(new URL('../vendor/gepa-python/src/gepa/__init__.py', import.meta.url)),
+            fileURLToPath(new URL('../vendor/gepa-python/src/gepa/adapters/optimize_anything_adapter/optimize_anything_adapter.py', import.meta.url)),
+        ];
+        if (!requiredVendorFiles.every(existsSync)) {
+            const vendoringScript = fileURLToPath(new URL('../scripts/vendor-gepa-python.mjs', import.meta.url));
+            try {
+                execFileSync(process.execPath, [vendoringScript], { stdio: 'pipe' });
+            }
+            catch (error) {
+                const details = error instanceof Error ? error.message : String(error);
+                throw new Error(`Unable to materialize bundled official GEPA: ${details}`);
+            }
+            if (!requiredVendorFiles.every(existsSync)) {
+                throw new Error('Unable to materialize bundled official GEPA: extracted tree is incomplete');
+            }
+        }
+    }
+    // zipimport cannot resolve GEPA's namespace-package adapters on every
+    // supported Python minor. Both source and published CLIs execute only the
+    // verified tree materialized from the pinned wheel.
+    return resolveGepaPythonPath([vendor]);
 }
 export function getGepaPythonPathEntries(existingPythonPath) {
     const pythonPathEntries = [

package/dist/git-credential.d.ts

@@ -0,0 +1,69 @@
+/**
+ * Git credential helper (ALI-971 / WS-D).
+ *
+ * Implements git's credential-helper protocol on stdin/stdout so teammates can
+ * `git pull`/`git push` the hosted workbench repo with NO GitHub identity: git
+ * asks this helper for a credential, we broker a short-lived, downscoped
+ * installation token from Orizu and hand it back as `x-access-token:<token>`.
+ * The token is never written to disk (60-min TTL is the backstop).
+ *
+ * Protocol: git runs `orizu git-credential <op>` where op is get|store|erase
+ * and feeds `key=value` lines on stdin terminated by a blank line. Only `get`
+ * does work; `store`/`erase` are no-ops. For `get` we respond only when the
+ * host is github.com AND the cwd resolves to an attached Orizu workspace —
+ * otherwise we stay silent so git falls through to its normal handling.
+ *
+ * Purpose selection: git does not tell us read-vs-write intent, so we mint
+ * `write` first (the common push case for curators) and fall back to `read` on
+ * a 403 (plain members). Pure logic + injected fetcher/io: index.ts stays thin.
+ */
+export type GitCredentialFetcher = (path: string, init?: RequestInit) => Promise<Response>;
+export interface GitCredentialIo {
+    stdin: string;
+    cwd: string;
+    print: (line: string) => void;
+    printErr: (line: string) => void;
+    fetcher?: GitCredentialFetcher;
+    /** Explicit workspace id (tests / clone-time). Overrides env + cwd lookup. */
+    workspaceId?: string;
+    /**
+     * Exact logical capability configured for this remote. Artifacts credentials
+     * require this value because Git's helper protocol does not identify whether
+     * an operation is a fetch or push and host-only selection is unsafe.
+     */
+    purpose?: RepoTokenPurpose;
+    /** Injectable clock for strict provider credential expiry validation. */
+    nowMs?: () => number;
+}
+export declare const REPO_TOKEN_PURPOSES: readonly ["read", "write"];
+export type RepoTokenPurpose = (typeof REPO_TOKEN_PURPOSES)[number];
+export interface GitCredentialInvocation {
+    readonly operation: 'get' | 'store' | 'erase';
+    readonly purpose: RepoTokenPurpose | null;
+}
+/**
+ * Git appends get/store/erase after the configured helper command, so an
+ * explicit path-aware configuration looks like:
+ * `!orizu git-credential --purpose=write`.
+ *
+ * Session credentials use the hosted runtime helper, which carries the
+ * server-bound session ID. This local helper deliberately accepts only
+ * sessionless developer read/write purposes.
+ */
+export declare function parseGitCredentialInvocation(args: readonly string[]): GitCredentialInvocation | null;
+export declare function runGitCredentialInvocation(args: readonly string[], io: GitCredentialIo): Promise<number>;
+export declare function parseCredentialInput(stdin: string): Record<string, string>;
+/**
+ * Walk up from `cwd` to the workspace root (the dir holding orizu.team.json) and
+ * return its bound workspace id, or null if this is not an attached workspace.
+ */
+export declare function resolveAttachedWorkspaceId(cwd: string): string | null;
+/**
+ * Resolve the workspace id, preferring an explicit override, then the
+ * `ORIZU_WORKSPACE_ID` env var (set during `git clone` so the helper works
+ * before the working tree — and thus orizu.team.json — exists), then the cwd
+ * manifest walk for steady-state pull/push.
+ */
+export declare function resolveWorkspaceId(io: GitCredentialIo): string | null;
+export declare function runGitCredential(op: string, io: GitCredentialIo): Promise<number>;
+//# sourceMappingURL=git-credential.d.ts.map

package/dist/git-credential.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"git-credential.d.ts","sourceRoot":"","sources":["../src/git-credential.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH,MAAM,MAAM,oBAAoB,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,CAAC,EAAE,WAAW,KAAK,OAAO,CAAC,QAAQ,CAAC,CAAA;AAE1F,MAAM,WAAW,eAAe;IAC9B,KAAK,EAAE,MAAM,CAAA;IACb,GAAG,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAC7B,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,OAAO,CAAC,EAAE,oBAAoB,CAAA;IAC9B,8EAA8E;IAC9E,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,OAAO,CAAC,EAAE,gBAAgB,CAAA;IAC1B,yEAAyE;IACzE,KAAK,CAAC,EAAE,MAAM,MAAM,CAAA;CACrB;AAmBD,eAAO,MAAM,mBAAmB,4BAGtB,CAAA;AAEV,MAAM,MAAM,gBAAgB,GAC1B,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAA;AAEtC,MAAM,WAAW,uBAAuB;IACtC,QAAQ,CAAC,SAAS,EAAE,KAAK,GAAG,OAAO,GAAG,OAAO,CAAA;IAC7C,QAAQ,CAAC,OAAO,EAAE,gBAAgB,GAAG,IAAI,CAAA;CAC1C;AAQD;;;;;;;;GAQG;AACH,wBAAgB,4BAA4B,CAC1C,IAAI,EAAE,SAAS,MAAM,EAAE,GACtB,uBAAuB,GAAG,IAAI,CA8BhC;AAED,wBAAsB,0BAA0B,CAC9C,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,EAAE,EAAE,eAAe,GAClB,OAAO,CAAC,MAAM,CAAC,CAUjB;AAED,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAU1E;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CA0BrE;AAED;;;;;GAKG;AACH,wBAAgB,kBAAkB,CAAC,EAAE,EAAE,eAAe,GAAG,MAAM,GAAG,IAAI,CAKrE;AA0RD,wBAAsB,gBAAgB,CAAC,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,eAAe,GAAG,OAAO,CAAC,MAAM,CAAC,CA+FvF"}