primitive-admin 1.0.60 → 1.0.62

package/dist/src/lib/app-settings-descriptor.js

@@ -13,80 +13,88 @@
  * `RECOGNIZED_AUTH_KEYS` pattern to every section, and fully replaces it.
  *
  * Design decisions of record (issue #1033):
- *  - `googleClientSecret` is a secret: never written to `app.toml` on pull, and
- *    a hard error (abort before any PUT) if hand-added on push. Non-secret
- *    `googleClientId` syncs normally.
+ *  - Google is a typed client MAP (#2891): `googleClients` renders as
+ *    `[auth.google.clients.<type>]`, and each entry's `clientSecret` holds a
+ *    whole `{{secrets.KEY}}` reference rather than the secret itself, so the
+ *    map round-trips through `app.toml` like any other setting.
  *  - `[cors]` is always emitted (the `mode` key is `emit: "always"`), even in
  *    universal mode. A one-time diff on the next pull for existing apps is
  *    acceptable.
  *  - `[invitations]` is an additive table for the member-invitation fields.
- *  - Legacy `passkeyRpId` / `passkeyRpName` are still writable server-side but
- *    excluded from TOML (superseded by `passkeyRpConfig` -> `[auth.passkeys]`).
- *    The coverage test classifies them as deprecated-writable exclusions, NOT
- *    computed/read-only.
+ *  - Nothing is writable-but-excluded any more (#2891). The legacy passkey
+ *    pair and the three Google/redirect scalars are RETIRED: not writable, not
+ *    synced, and refused by name with their own guidance when an old
+ *    `app.toml` still carries them.
  *  - Push type mismatches are field-named validation errors — no silent
  *    coercion of a mistyped TOML value.
+ *  - THE FILE IS THE WHOLE TRUTH (#2880, sponsor 2026-08-21). `app.toml` used
+ *    to be the one surface where an omitted key preserved the server's value,
+ *    while every other type follows "the local file is the source of truth"
+ *    (#1567). That exception is gone: push emits a value for EVERY writable
+ *    field, and a key the file does not carry clears the field or resets it to
+ *    its declared default (`APP_SETTINGS_ABSENT_VALUES`). `[app].name` and
+ *    `[app].mode` are the two exceptions — no default, identity-critical, and
+ *    `mode: null` is a 400 — so their absence is a validation error instead.
  */
+import { findUnknownDocumentKeys, requireConfigSurface, } from "./config-surface.js";
+import { retiredConfigKey } from "./generated-config-surfaces.js";
+import { canonicalizeSecretReference } from "./server-text-normalization.js";
 /**
- * Every field that round-trips through `app.toml`. 26 entries — the server's
- * `PUT /settings` allow-list minus the two deprecated legacy passkey fields.
- * `googleClientSecret` is present but flagged `secret` (excluded from TOML).
- */
-export const APP_SETTINGS_DESCRIPTOR = [
-    // ---- [app] --------------------------------------------------------------
-    { field: "name", section: "app", key: "name", type: "string", emit: "always" },
-    { field: "mode", section: "app", key: "mode", type: "string", emit: "always" },
-    { field: "baseUrl", section: "app", key: "baseUrl", type: "string", emit: "whenSet" },
-    { field: "waitlistEnabled", section: "app", key: "waitlistEnabled", type: "boolean", emit: "always" },
-    { field: "waitlistNotifyAdmins", section: "app", key: "waitlistNotifyAdmins", type: "boolean", emit: "always" },
-    { field: "allowedDomains", section: "app", key: "allowedDomains", type: "string[]", emit: "whenSet" },
-    { field: "testAccountBaseEmails", section: "app", key: "testAccountBaseEmails", type: "string[]", emit: "whenSet" },
-    // ---- [auth] -------------------------------------------------------------
-    { field: "googleOAuthEnabled", section: "auth", key: "googleOAuthEnabled", type: "boolean", emit: "whenSet" },
-    { field: "googleClientId", section: "auth", key: "googleClientId", type: "string", emit: "whenSet" },
-    // Secret — omitted on pull, hard error on push. See GOOGLE_CLIENT_SECRET_PUSH_ERROR.
-    { field: "googleClientSecret", section: "auth", key: "googleClientSecret", type: "string", emit: "whenSet", secret: true },
-    { field: "passkeyEnabled", section: "auth", key: "passkeyEnabled", type: "boolean", emit: "always" },
-    { field: "magicLinkEnabled", section: "auth", key: "magicLinkEnabled", type: "boolean", emit: "always" },
-    { field: "appleSignInEnabled", section: "auth", key: "appleSignInEnabled", type: "boolean", emit: "whenSet" },
-    { field: "otpEnabled", section: "auth", key: "otpEnabled", type: "boolean", emit: "whenSet" },
-    { field: "appleAudiences", section: "auth", key: "appleAudiences", type: "string[]", emit: "whenSet" },
-    { field: "redirectUris", section: "auth", key: "redirectUris", type: "string[]", emit: "whenSet" },
-    // passkeyRpConfig <-> [auth.passkeys] (nested object of rpId -> { name }).
-    { field: "passkeyRpConfig", section: "auth", key: "passkeys", type: "object", emit: "whenSet" },
-    // ---- [cors] -------------------------------------------------------------
-    // `mode` is `always` so the [cors] table is always emitted (decision 3).
-    { field: "corsMode", section: "cors", key: "mode", type: "string", emit: "always" },
-    { field: "corsAllowedOrigins", section: "cors", key: "allowedOrigins", type: "string[]", emit: "whenSet" },
-    { field: "corsAllowCredentials", section: "cors", key: "allowCredentials", type: "boolean", emit: "whenSet" },
-    { field: "corsAllowedMethods", section: "cors", key: "allowedMethods", type: "string[]", emit: "whenSet" },
-    { field: "corsAllowedHeaders", section: "cors", key: "allowedHeaders", type: "string[]", emit: "whenSet" },
-    { field: "corsExposedHeaders", section: "cors", key: "exposedHeaders", type: "string[]", emit: "whenSet" },
-    { field: "corsMaxAge", section: "cors", key: "maxAge", type: "number", emit: "whenSet" },
-    // ---- [invitations] ------------------------------------------------------
-    { field: "memberInvitationsEnabled", section: "invitations", key: "enabled", type: "boolean", emit: "always" },
-    { field: "memberInvitationLimit", section: "invitations", key: "limit", type: "number", emit: "always" },
-];
-/** Section render order for a stable, diff-friendly `app.toml`. */
-export const APP_SETTINGS_SECTIONS = [
-    "app",
-    "auth",
-    "cors",
-    "invitations",
-];
+ * The vendored `app-settings` definition (#2644) this module projects. Read
+ * once at load; a missing definition fails loudly rather than yielding an
+ * empty descriptor that would silently sync nothing.
+ */
+const APP_SETTINGS_SURFACE = requireConfigSurface("app-settings");
+/**
+ * Every field that round-trips through `app.toml` — DERIVED from the
+ * `app-settings` configuration-object definition (#2644), not listed.
+ *
+ * The definition already states each field's section (its table's TOML path),
+ * its `app.toml` key, its type and its `emit` rule, and the coverage guard
+ * holds it against the `App` model. Restating those 26 entries here made
+ * adding a setting two edits that a parity test then compared — the "two lists
+ * and a test they agree" shape the design gate rejected (2026-08-12). One edit
+ * in the definition now reaches the server allow-list
+ * (`settings-fields.ts`), this descriptor, and both directions of the sync.
+ *
+ * `json` in the definition is this module's `object` — the same shape under the
+ * name each side has always used for it.
+ */
+export const APP_SETTINGS_DESCRIPTOR = APP_SETTINGS_SURFACE.tables.flatMap((table) => table.fields.map((field) => ({
+    field: field.field,
+    section: table.tomlPath[0],
+    key: field.tomlKey,
+    type: (field.type === "json" ? "object" : field.type),
+    emit: field.emit,
+})));
+/**
+ * Section render order for a stable, diff-friendly `app.toml` — the
+ * definition's table order (#2644), so a new section is rendered by being
+ * declared there.
+ */
+export const APP_SETTINGS_SECTIONS = APP_SETTINGS_SURFACE.tables.map((table) => table.tomlPath[0]);
 /**
  * `GET /settings` keys that are computed/read-only and never sync (no server
  * setter). The external coverage drift test classifies these here.
  */
 export const IGNORED_GET_KEYS = new Set([
     "appId",
-    "hasGoogleAuth",
-    // Computed presence flag for the write-only Google client secret (#1603).
-    // GET returns the boolean instead of the secret value; there is no server
-    // setter, so it never syncs — same classification as `hasGoogleAuth`.
-    "googleClientSecretSet",
+    // `hasGoogleAuth`, `googleClientSecretSet` and `googleClientSecretStatus` are
+    // GONE (#2891), not ignored: the first could not describe a per-platform
+    // configuration, and the other two existed only to report a value the server
+    // refused to send back. The map states availability per entry and the stored
+    // reference is echoed, so a response still carrying any of them is a server
+    // this CLI does not understand — worth failing the drift guard over.
+    //
+    // `hasAppleAuth` / `hasPasskey` stay: the asymmetry is deliberate, since
+    // Apple and passkeys have no map to derive per-platform truth from.
     "hasAppleAuth",
     "hasPasskey",
+    // #2884 — compatibility fields DERIVED from the one email sign-in flow; the
+    // tenant PUT and app.toml retired them, GET still emits both for older
+    // clients. Computed, never synced.
+    "magicLinkEnabled",
+    "otpEnabled",
     "createdAt",
     "modifiedAt",
 ]);
@@ -97,14 +105,212 @@ export const IGNORED_GET_KEYS = new Set([
  * "every allow-listed field is covered" claim stays true — these are excluded,
  * not read-only. (Codex design-review concern #1.)
  */
-export const DEPRECATED_WRITABLE_EXCLUDED = new Set([
-    "passkeyRpId",
-    "passkeyRpName",
-]);
-/** Push error for a hand-added `googleClientSecret` — points at a real command. */
-export const GOOGLE_CLIENT_SECRET_PUSH_ERROR = 'app.toml must not contain a "googleClientSecret" key under [auth]. ' +
-    "Secrets are excluded from synced config by design. Remove the key, then set " +
-    "the secret with:\n  primitive apps update <appId> --google-client-secret <secret>";
+export const DEPRECATED_WRITABLE_EXCLUDED = new Set(
+// Derived (#2644): `deprecated` is exactly "still writable, superseded by
+// another field", which is what this set has always meant.
+APP_SETTINGS_SURFACE.tables.flatMap((table) => Object.entries(table.notExposed)
+    .filter(([, classification]) => classification.kind === "deprecated")
+    .map(([field]) => field)));
+export const APP_SETTINGS_ABSENT_VALUES = {
+    // [app]
+    name: { required: true },
+    mode: { required: true },
+    baseUrl: { value: null },
+    waitlistEnabled: { value: false },
+    waitlistNotifyAdmins: { value: true },
+    directLlmEnabled: { value: false },
+    allowedDomains: { value: null },
+    testAccountBaseEmails: { value: null },
+    // [auth]
+    googleOAuthEnabled: { value: null },
+    googleClients: { value: null },
+    passkeyEnabled: { value: false },
+    // #2884: the one email sign-in setting, absent ⇒ `true` because that is what
+    // `GET /settings` reports for a row storing none of the three fields
+    // (`isEmailSignInEnabled`) — the equality the table above exists to hold.
+    // Stated consequence: a hand-authored file that never carried the key pushes
+    // email sign-in ON, exactly as omitting `magicLinkEnabled` / `otpEnabled`
+    // did before the collapse. A pulled file always states the setting
+    // (`emit: "always"`), so this only bites a file authored without it.
+    emailSignInEnabled: { value: true },
+    appleSignInEnabled: { value: null },
+    appleAudiences: { value: null },
+    emailRedirectUris: { value: null },
+    passkeyRpConfig: { value: null },
+    // [cors]
+    corsMode: { value: "universal" },
+    corsAllowedOrigins: { value: null },
+    corsAllowCredentials: { value: false },
+    corsAllowedMethods: { value: null },
+    corsAllowedHeaders: { value: null },
+    corsExposedHeaders: { value: null },
+    corsMaxAge: { value: null },
+    // [invitations]
+    memberInvitationsEnabled: { value: false },
+    memberInvitationLimit: { value: 5 },
+};
+/**
+ * The absent-key rule for one field, or a loud failure.
+ *
+ * Deliberately a throw rather than a `?? null` fallback: under whole-truth push
+ * an unlisted field would be CLEARED on every push by a table nobody updated.
+ */
+export function appSettingAbsentValue(field) {
+    const entry = APP_SETTINGS_ABSENT_VALUES[field];
+    if (!entry) {
+        throw new Error(`app.toml: no absent-key rule declared for the setting \`${field}\`. ` +
+            `Add it to APP_SETTINGS_ABSENT_VALUES (cli/src/lib/app-settings-descriptor.ts) ` +
+            `— push sends a value for every writable field (#2880).`);
+    }
+    return entry;
+}
+/** Fields whose absence is a validation error rather than a clear (#2880). */
+export const REQUIRED_APP_SETTING_FIELDS = APP_SETTINGS_DESCRIPTOR.filter((d) => APP_SETTINGS_ABSENT_VALUES[d.field]?.required === true).map((d) => d.field);
+/**
+ * The value the SERVER would hold after accepting this one (#2880 DSO-003).
+ *
+ * The comparison runs on the local side only: push forwards what the file says
+ * and the server normalizes it, so without this an authored-but-noncanonical
+ * value (`baseUrl` with a trailing slash, a mixed-case test-account email)
+ * differs from the record the server returns FOREVER — and baseline restamping
+ * cannot save it, because after an apply the remote hash matches the new
+ * baseline while the local hash still does not, re-classifying `local-edited`
+ * on every run.
+ *
+ * Mirrors the rules in `settings-controller.ts` (`baseUrl` trim + trailing
+ * slash), `validateTestAccountBaseEmails` (trim, lower-case, dedupe) and
+ * `validateRedirectUris` (trim, dedupe). Only the NORMALIZATION is mirrored,
+ * never the rejection: an entry the server would refuse stays as authored so
+ * the server's own 400 is what the operator sees.
+ */
+export function canonicalizeAppSettingValue(field, value) {
+    if (value === null || value === undefined)
+        return value;
+    if (field === "baseUrl") {
+        if (typeof value !== "string")
+            return value;
+        const trimmed = value.trim().replace(/\/+$/, "");
+        return trimmed === "" ? null : trimmed;
+    }
+    if (field === "testAccountBaseEmails" || field === "emailRedirectUris") {
+        if (!Array.isArray(value))
+            return value;
+        const lower = field === "testAccountBaseEmails";
+        const seen = new Set();
+        const out = [];
+        for (const entry of value) {
+            if (typeof entry !== "string") {
+                out.push(entry);
+                continue;
+            }
+            const normalized = lower ? entry.trim().toLowerCase() : entry.trim();
+            if (seen.has(normalized))
+                continue;
+            seen.add(normalized);
+            out.push(normalized);
+        }
+        return out;
+    }
+    if (field === "appleAudiences") {
+        if (!Array.isArray(value))
+            return value;
+        // The controller filters non-empty strings and stores `null` for an empty
+        // result, so a list of blanks is the same state as no list at all.
+        return value.filter((v) => typeof v === "string" && v.length > 0);
+    }
+    if (field === "googleClients")
+        return canonicalizeGoogleClients(value);
+    return value;
+}
+/**
+ * The typed Google client map as the server STORES it (#2880 DSO-003).
+ *
+ * `validateGoogleClientsWrite` (`src/services/google-clients.ts`) rewrites each
+ * accepted entry: the `clientId` is trimmed, the `clientSecret` is stored as
+ * the canonical `{{secrets.KEY}}` reference, the redirect URIs are trimmed and
+ * de-duplicated (`validateRedirectUris`), and an entry that states none at all
+ * stores the empty list. Without mirroring that, an authored
+ * `clientId = " 123.apps... "` — or a `{{ secrets.KEY }}` written with the
+ * spacing TOML makes easy — is a `Modified` row on every run against a value
+ * push already applied.
+ *
+ * Normalization only, never rejection: an entry the server would refuse (a
+ * `clientSecret` that is not a reference, a URI it will not take) is left as
+ * authored so the `PUT`'s own 400 is what the operator sees.
+ */
+function canonicalizeGoogleClients(value) {
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        return value;
+    const clients = value.clients;
+    if (!clients || typeof clients !== "object" || Array.isArray(clients)) {
+        return value;
+    }
+    const out = {};
+    for (const [type, entry] of Object.entries(clients)) {
+        if (!entry || typeof entry !== "object" || Array.isArray(entry)) {
+            out[type] = entry;
+            continue;
+        }
+        const source = entry;
+        const canonical = { ...source };
+        if (typeof source.clientId === "string") {
+            canonical.clientId = source.clientId.trim();
+        }
+        if (source.clientSecret !== undefined) {
+            canonical.clientSecret = canonicalizeSecretReference(source.clientSecret);
+        }
+        // Trimmed and de-duplicated, and materialized when the entry states none —
+        // the server stores `[]` either way, so "no key" and "empty list" are one
+        // state rather than a difference no push can close.
+        canonical.redirectUris = Array.isArray(source.redirectUris)
+            ? [
+                ...new Set(source.redirectUris.map((uri) => typeof uri === "string" ? uri.trim() : uri)),
+            ]
+            : [];
+        out[type] = canonical;
+    }
+    return { clients: out };
+}
+/**
+ * One field's comparable value — what `config diff` and the push gate both read.
+ *
+ * Canonicalized as above, then flattened to `null` when the value is "empty"
+ * under an `emit: "whenSet"` field's own rule. That second step is the
+ * app-settings copy of what `projectConfigForComparison` does for every other
+ * type (#2731): pull OMITS an empty `whenSet` value, so the file it round-trips
+ * to has no key, and comparing `[]` against "no key" would be a difference no
+ * push could ever converge.
+ */
+export function comparableAppSettingValue(descriptor, value) {
+    const canonical = canonicalizeAppSettingValue(descriptor.field, value);
+    if (canonical === undefined)
+        return null;
+    if (descriptor.emit === "whenSet" && isEmptyForEmit(canonical, descriptor.type)) {
+        return null;
+    }
+    return canonical ?? null;
+}
+/**
+ * Project a settings record (either side) onto the full writable field set.
+ *
+ * `excludeName` is the cross-app rule (#2880 DSO-001): while a cross-app push's
+ * name exclusion is active, BOTH sides and the stamped baseline are hashed
+ * without `name`, so `classifyPushChange`'s `remoteHash === baselineHash ⇒
+ * local-edited` arithmetic stays valid.
+ */
+export function projectAppSettingsForComparison(settings, options = {}) {
+    const projected = {};
+    for (const d of APP_SETTINGS_DESCRIPTOR) {
+        if (options.excludeName && d.field === "name")
+            continue;
+        const raw = settings?.[d.field];
+        const absent = APP_SETTINGS_ABSENT_VALUES[d.field];
+        projected[d.field] = comparableAppSettingValue(d, raw === undefined && absent && absent.required !== true
+            ? absent.value
+            : raw);
+    }
+    return projected;
+}
 const DESCRIPTOR_BY_SECTION = (() => {
     const m = new Map();
     for (const d of APP_SETTINGS_DESCRIPTOR) {
@@ -173,14 +379,12 @@ function typeError(descriptor, value) {
 }
 /**
  * Build one `app.toml` section object from server settings (pull direction).
- * Secret fields are never written. Applies each field's `emit` rule; a `null`
- * value is always omitted (TOML cannot encode null).
+ * Applies each field's `emit` rule; a `null` value is always omitted (TOML
+ * cannot encode null).
  */
 export function serializeSection(settings, section) {
     const out = {};
     for (const d of DESCRIPTOR_BY_SECTION.get(section) ?? []) {
-        if (d.secret)
-            continue;
         const value = settings[d.field];
         if (value === null || value === undefined)
             continue;
@@ -205,18 +409,53 @@ export function serializeAppSettingsToToml(settings) {
     return data;
 }
 /**
- * Translate a parsed `app.toml` object into a `PUT /settings` payload (push
- * direction). Only keys present in the TOML are forwarded — an omitted key
- * never overwrites server state. Unknown keys warn; type mismatches and any
- * secret key are hard errors that the caller must treat as abort-before-PUT.
+ * Is `[app].name` out of this call entirely? ONE reading of the two spellings
+ * the callers use (#2936), so the parse and the payload can never disagree
+ * about whether the field is in play: `isCrossAppPush` is the raw cross-app
+ * determination, `excludeName` the already-computed answer from
+ * `appSettingsNameExcluded` (which also covers the recorded-exclusion case).
+ */
+function appSettingsNameStripped(options) {
+    return !!(options.isCrossAppPush || options.excludeName);
+}
+/**
+ * Translate a parsed `app.toml` object into the settings the FILE STATES —
+ * only the keys it carries. This is the parse half; `buildAppSettingsPayload`
+ * below turns it into the whole-truth `PUT /settings` body by filling in what
+ * the file omits. An unrecognized key or table and a type
+ * mismatch are both hard errors the caller must treat as abort-before-PUT
+ * (#2644 criterion 6: push rejects what it does not recognize, for every
+ * configuration surface, so a typo fails locally instead of being ignored).
+ *
+ * A per-entry `clientSecret` that is not a whole `{{secrets.KEY}}` reference is
+ * the server's rejection to make (#2256): the push forwards the map and the
+ * `PUT` answers 400 with `GOOGLE_CLIENT_SECRET_MUST_BE_SECRET_REF`. Duplicating
+ * the shape rule here would put two definitions of "valid reference" in play.
+ *
+ * A RETIRED key (#2891) is different: it is not a value the server can judge,
+ * it is a line that has to be deleted, so the parser refuses it locally with
+ * the guidance that names its replacement.
  *
- * `isCrossAppPush` strips `name` so a cross-app push never overwrites the
- * target app's name.
+ * `isCrossAppPush` — or `excludeName`, the same rule as the caller computed it
+ * (#2880 DSO-001, `appSettingsNameExcluded`) — strips `name` so a cross-app
+ * push never overwrites the target app's name. The strip has to happen HERE and
+ * not only in the payload builder below (#2936): a field the body will not
+ * carry is not a field this file gets to refuse, or a slot bound to another app
+ * aborts diff and push over a `[app].name` neither of them was going to send.
  */
 export function parseTomlToAppSettings(tomlData, options = {}) {
+    const excludeName = appSettingsNameStripped(options);
     const settings = {};
     const warnings = [];
     const errors = [];
+    // #2644 criterion 6 — a top-level table the definition does not declare is a
+    // hard error, the same posture every per-entity file has. Silently ignoring
+    // it made a typo'd header (`[curs]`) push as though the section it meant were
+    // absent, so the settings it carried were never applied.
+    for (const key of findUnknownDocumentKeys(tomlData, APP_SETTINGS_SURFACE)) {
+        errors.push(`app.toml: unrecognized top-level table [${key}]. Check the spelling ` +
+            `against the tables app.toml accepts (${APP_SETTINGS_SECTIONS.map((s) => `[${s}]`).join(", ")}), or upgrade the CLI if the server is newer than this one.`);
+    }
     for (const section of APP_SETTINGS_SECTIONS) {
         const sectionData = tomlData?.[section];
         if (sectionData === undefined || sectionData === null)
@@ -230,15 +469,27 @@ export function parseTomlToAppSettings(tomlData, options = {}) {
         for (const key of Object.keys(sectionData)) {
             const d = byKey.get(key);
             if (!d) {
-                warnings.push(`Unrecognized [${section}] key "${key}" in app.toml — ignored. ` +
+                // A RETIRED key is not an unknown key (#2803's rule, extended to
+                // app-settings by #2891/DSO-2891-005). "Check the spelling, or upgrade
+                // the CLI" is exactly backwards for a key the platform removed on
+                // purpose, and every pre-reshape `app.toml` still carries these lines —
+                // so the parser consults the shared retired set directly and says where
+                // the value moved to. Keyed under `app`, the app-settings surface's
+                // identifier, whichever section the key was authored in.
+                const retired = retiredConfigKey("app", key);
+                if (retired) {
+                    errors.push(`app.toml: [${section}].${key} — ${retired.toml}`);
+                    continue;
+                }
+                // #2644 criterion 6 — REJECTED, not warned-and-ignored. `app.toml` is a
+                // registered configuration surface like every other file, and an
+                // ignored key is a setting the author believes they changed.
+                errors.push(`app.toml: unrecognized key [${section}].${key}. Remove it or ` +
+                    `upgrade the CLI if the server is newer than this one. ` +
                     `Recognized keys: ${descriptors.map((x) => x.key).join(", ")}.`);
                 continue;
             }
-            if (d.secret) {
-                errors.push(GOOGLE_CLIENT_SECRET_PUSH_ERROR);
-                continue;
-            }
-            if (options.isCrossAppPush && d.field === "name")
+            if (excludeName && d.field === "name")
                 continue;
             const value = sectionData[key];
             const err = typeError(d, value);
@@ -251,4 +502,74 @@ export function parseTomlToAppSettings(tomlData, options = {}) {
     }
     return { settings, warnings, errors };
 }
+/**
+ * `[app].name` / `[app].mode` absent — the two keys whole-truth push refuses to
+ * fill in for the author (#2880).
+ *
+ * Read from the DOCUMENT rather than the parse result, so a cross-app push
+ * (which strips `name` before validating) still requires the file to state one.
+ * `mode` has no default and `mode: null` is a 400; more to the point, a deleted
+ * `mode` line silently resetting an invite-only app to public is the wrong
+ * failure to choose.
+ */
+export function missingRequiredKeyErrors(tomlData) {
+    const errors = [];
+    for (const field of REQUIRED_APP_SETTING_FIELDS) {
+        const d = APP_SETTINGS_DESCRIPTOR.find((x) => x.field === field);
+        if (!d)
+            continue;
+        const section = tomlData?.[d.section];
+        const present = section !== null &&
+            typeof section === "object" &&
+            !Array.isArray(section) &&
+            section[d.key] !== undefined;
+        if (present)
+            continue;
+        errors.push(`app.toml: [${d.section}].${d.key} is required — \`config push\` applies ` +
+            `app.toml as the whole truth, and this field has no default to fall ` +
+            `back to. Add the line (\`config pull --only app\` writes it).`);
+    }
+    return errors;
+}
+/**
+ * The whole-truth `PUT /settings` body (#2880 criterion 4).
+ *
+ * Every writable field gets a value: the authored one where the file carries
+ * the key, its `APP_SETTINGS_ABSENT_VALUES` entry where it does not. That is
+ * what makes `app.toml` mean what every other configuration file means — the
+ * local file is the state, not a patch over whatever the server happens to
+ * hold (#1567). The controller applies only the keys in the body (`if (field in
+ * updates)`), so the completeness has to come from here.
+ *
+ * Values are forwarded AS AUTHORED, never canonicalized: the server owns its
+ * own normalization, and a CLI that rewrote the value before sending it would
+ * be pushing something the operator did not write. The canonicalization in
+ * `canonicalizeAppSettingValue` is for the local COMPARISON only.
+ *
+ * `excludeName` (and `isCrossAppPush`, which implies it) leaves `name` out of
+ * the body entirely, so a cross-app push never renames the target app.
+ */
+export function buildAppSettingsPayload(tomlData, options = {}) {
+    const parsed = parseTomlToAppSettings(tomlData, options);
+    const errors = [...parsed.errors, ...missingRequiredKeyErrors(tomlData)];
+    if (errors.length > 0) {
+        return { settings: {}, warnings: parsed.warnings, errors };
+    }
+    const excludeName = appSettingsNameStripped(options);
+    const settings = {};
+    for (const d of APP_SETTINGS_DESCRIPTOR) {
+        if (excludeName && d.field === "name")
+            continue;
+        if (d.field in parsed.settings) {
+            settings[d.field] = parsed.settings[d.field];
+            continue;
+        }
+        const absent = appSettingAbsentValue(d.field);
+        // Required fields never reach here — their absence already errored above.
+        if (absent.required === true)
+            continue;
+        settings[d.field] = absent.value;
+    }
+    return { settings, warnings: parsed.warnings, errors: [] };
+}
 //# sourceMappingURL=app-settings-descriptor.js.map

package/dist/src/lib/app-settings-descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"app-settings-descriptor.js","sourceRoot":"","sources":["../../../src/lib/app-settings-descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAgCH;;;;GAIG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAoC;IACtE,4EAA4E;IAC5E,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9E,EAAE,KAAK,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9E,EAAE,KAAK,EAAE,SAAS,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;IACrF,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,iBAAiB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACrG,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,sBAAsB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC/G,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IACrG,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,KAAK,EAAE,GAAG,EAAE,uBAAuB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IAEnH,4EAA4E;IAC5E,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7G,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;IACpG,qFAAqF;IACrF,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE;IAC1H,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACpG,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IACxG,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,oBAAoB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7G,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,YAAY,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7F,EAAE,KAAK,EAAE,gBAAgB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IACtG,EAAE,KAAK,EAAE,cAAc,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,cAAc,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IAClG,2EAA2E;IAC3E,EAAE,KAAK,EAAE,iBAAiB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,UAAU,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;IAE/F,4EAA4E;IAC5E,yEAAyE;IACzE,EAAE,KAAK,EAAE,UAAU,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;IACnF,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1G,EAAE,KAAK,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,kBAAkB,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE;IAC7G,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1G,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1G,EAAE,KAAK,EAAE,oBAAoB,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,gBAAgB,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,SAAS,EAAE;IAC1G,EAAE,KAAK,EAAE,YAAY,EAAE,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,SAAS,EAAE;IAExF,4EAA4E;IAC5E,EAAE,KAAK,EAAE,0BAA0B,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,SAAS,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,EAAE;IAC9G,EAAE,KAAK,EAAE,uBAAuB,EAAE,OAAO,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE;CAChG,CAAC;AAEX,mEAAmE;AACnE,MAAM,CAAC,MAAM,qBAAqB,GAAiC;IACjE,KAAK;IACL,MAAM;IACN,MAAM;IACN,aAAa;CACd,CAAC;AAEF;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,OAAO;IACP,eAAe;IACf,0EAA0E;IAC1E,0EAA0E;IAC1E,sEAAsE;IACtE,uBAAuB;IACvB,cAAc;IACd,YAAY;IACZ,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG,CAAC;IACvE,aAAa;IACb,eAAe;CAChB,CAAC,CAAC;AAEH,mFAAmF;AACnF,MAAM,CAAC,MAAM,+BAA+B,GAC1C,qEAAqE;IACrE,8EAA8E;IAC9E,mFAAmF,CAAC;AAEtF,MAAM,qBAAqB,GACzB,CAAC,GAAG,EAAE;IACJ,MAAM,CAAC,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEP,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAC3D,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAC5C,CAAC;AAEF,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iEAAiE;AACjE,SAAS,cAAc,CAAC,KAAc,EAAE,IAAoB;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5E,IAAI,IAAI,KAAK,QAAQ;QACnB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,MAAM,KAAK,CAAC,CAC1C,CAAC;IACJ,OAAO,KAAK,CAAC,CAAC,+DAA+D;AAC/E,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,UAAgC,EAChC,KAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC/E,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,GAAG,qCAAqC,MAAM,GAAG,CAAC;QACjG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,GAAG,yBAAyB,MAAM,GAAG,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,GAAG,cAAc,UAAU,CAAC,IAAI,SAAS,MAAM,GAAG,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA6B,EAC7B,OAA0B;IAE1B,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,IAAI,CAAC,CAAC,MAAM;YAAE,SAAS;QACvB,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACpE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAA6B;IAE7B,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAWD;;;;;;;;GAQG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAA6B,EAC7B,UAAwC,EAAE;IAE1C,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI;YAAE,SAAS;QAChE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,mBAAmB,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,QAAQ,CAAC,IAAI,CACX,iBAAiB,OAAO,UAAU,GAAG,2BAA2B;oBAC9D,oBAAoB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClE,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,CAAC,CAAC,MAAM,EAAE,CAAC;gBACb,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC;gBAC7C,SAAS;YACX,CAAC;YACD,IAAI,OAAO,CAAC,cAAc,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;gBAAE,SAAS;YAC3D,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAChC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC"}
+{"version":3,"file":"app-settings-descriptor.js","sourceRoot":"","sources":["../../../src/lib/app-settings-descriptor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EACL,uBAAuB,EACvB,oBAAoB,GACrB,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EAAE,gBAAgB,EAAE,MAAM,gCAAgC,CAAC;AAClE,OAAO,EAAE,2BAA2B,EAAE,MAAM,gCAAgC,CAAC;AAE7E;;;;GAIG;AACH,MAAM,oBAAoB,GAAG,oBAAoB,CAAC,cAAc,CAAC,CAAC;AA8BlE;;;;;;;;;;;;;;GAcG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAClC,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5C,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC3B,KAAK,EAAE,KAAK,CAAC,KAAK;IAClB,OAAO,EAAE,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAsB;IAC/C,GAAG,EAAE,KAAK,CAAC,OAAO;IAClB,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAmB;IACvE,IAAI,EAAE,KAAK,CAAC,IAAI;CACjB,CAAC,CAAC,CACJ,CAAC;AAEJ;;;;GAIG;AACH,MAAM,CAAC,MAAM,qBAAqB,GAChC,oBAAoB,CAAC,MAAM,CAAC,GAAG,CAC7B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,QAAQ,CAAC,CAAC,CAAsB,CAClD,CAAC;AAEJ;;;GAGG;AACH,MAAM,CAAC,MAAM,gBAAgB,GAAwB,IAAI,GAAG,CAAC;IAC3D,OAAO;IACP,8EAA8E;IAC9E,yEAAyE;IACzE,6EAA6E;IAC7E,6EAA6E;IAC7E,4EAA4E;IAC5E,qEAAqE;IACrE,EAAE;IACF,yEAAyE;IACzE,oEAAoE;IACpE,cAAc;IACd,YAAY;IACZ,4EAA4E;IAC5E,uEAAuE;IACvE,mCAAmC;IACnC,kBAAkB;IAClB,YAAY;IACZ,WAAW;IACX,YAAY;CACb,CAAC,CAAC;AAEH;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,4BAA4B,GAAwB,IAAI,GAAG;AACtE,0EAA0E;AAC1E,2DAA2D;AAC3D,oBAAoB,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,KAAK,EAAE,EAAE,CAC5C,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,UAAU,CAAC;KAC7B,MAAM,CAAC,CAAC,CAAC,EAAE,cAAc,CAAC,EAAE,EAAE,CAAC,cAAc,CAAC,IAAI,KAAK,YAAY,CAAC;KACpE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,CAC3B,CACF,CAAC;AAgCF,MAAM,CAAC,MAAM,0BAA0B,GAEnC;IACF,QAAQ;IACR,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxB,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE;IACxB,OAAO,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACxB,eAAe,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;IACjC,oBAAoB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACrC,gBAAgB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;IAClC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAC/B,qBAAqB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACtC,SAAS;IACT,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,aAAa,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAC9B,cAAc,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;IAChC,6EAA6E;IAC7E,qEAAqE;IACrE,0EAA0E;IAC1E,6EAA6E;IAC7E,0EAA0E;IAC1E,mEAAmE;IACnE,qEAAqE;IACrE,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,cAAc,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAC/B,iBAAiB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAClC,eAAe,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAChC,SAAS;IACT,QAAQ,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;IAChC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,oBAAoB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;IACtC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,kBAAkB,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IACnC,UAAU,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE;IAC3B,gBAAgB;IAChB,wBAAwB,EAAE,EAAE,KAAK,EAAE,KAAK,EAAE;IAC1C,qBAAqB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE;CACpC,CAAC;AAEF;;;;;GAKG;AACH,MAAM,UAAU,qBAAqB,CAAC,KAAa;IACjD,MAAM,KAAK,GAAG,0BAA0B,CAAC,KAAK,CAAC,CAAC;IAChD,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,IAAI,KAAK,CACb,2DAA2D,KAAK,MAAM;YACpE,gFAAgF;YAChF,wDAAwD,CAC3D,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED,8EAA8E;AAC9E,MAAM,CAAC,MAAM,2BAA2B,GACtC,uBAAuB,CAAC,MAAM,CAC5B,CAAC,CAAC,EAAE,EAAE,CAAC,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,EAAE,QAAQ,KAAK,IAAI,CAC9D,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;AAExB;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,UAAU,2BAA2B,CACzC,KAAa,EACb,KAAc;IAEd,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,KAAK,CAAC;IACxD,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;QACxB,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAC5C,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAC;QACjD,OAAO,OAAO,KAAK,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;IACzC,CAAC;IACD,IAAI,KAAK,KAAK,uBAAuB,IAAI,KAAK,KAAK,mBAAmB,EAAE,CAAC;QACvE,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,MAAM,KAAK,GAAG,KAAK,KAAK,uBAAuB,CAAC;QAChD,MAAM,IAAI,GAAG,IAAI,GAAG,EAAU,CAAC;QAC/B,MAAM,GAAG,GAAc,EAAE,CAAC;QAC1B,KAAK,MAAM,KAAK,IAAI,KAAK,EAAE,CAAC;YAC1B,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;gBAC9B,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;gBAChB,SAAS;YACX,CAAC;YACD,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC;YACrE,IAAI,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC;gBAAE,SAAS;YACnC,IAAI,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;YACrB,GAAG,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;QACvB,CAAC;QACD,OAAO,GAAG,CAAC;IACb,CAAC;IACD,IAAI,KAAK,KAAK,gBAAgB,EAAE,CAAC;QAC/B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QACxC,0EAA0E;QAC1E,mEAAmE;QACnE,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpE,CAAC;IACD,IAAI,KAAK,KAAK,eAAe;QAAE,OAAO,yBAAyB,CAAC,KAAK,CAAC,CAAC;IACvE,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;;GAeG;AACH,SAAS,yBAAyB,CAAC,KAAc;IAC/C,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC;IAC9E,MAAM,OAAO,GAAI,KAA+B,CAAC,OAAO,CAAC;IACzD,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,CAAC;QACtE,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAA4B,EAAE,CAAC;IACxC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACxC,OAAkC,CACnC,EAAE,CAAC;QACF,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,EAAE,CAAC;YAChE,GAAG,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,KAAgC,CAAC;QAChD,MAAM,SAAS,GAA4B,EAAE,GAAG,MAAM,EAAE,CAAC;QACzD,IAAI,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YACxC,SAAS,CAAC,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC9C,CAAC;QACD,IAAI,MAAM,CAAC,YAAY,KAAK,SAAS,EAAE,CAAC;YACtC,SAAS,CAAC,YAAY,GAAG,2BAA2B,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;QAC5E,CAAC;QACD,2EAA2E;QAC3E,0EAA0E;QAC1E,oDAAoD;QACpD,SAAS,CAAC,YAAY,GAAG,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC;YACzD,CAAC,CAAC;gBACE,GAAG,IAAI,GAAG,CACR,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B,OAAO,GAAG,KAAK,QAAQ,CAAC,CAAC,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC,GAAG,CAC3C,CACF;aACF;YACH,CAAC,CAAC,EAAE,CAAC;QACP,GAAG,CAAC,IAAI,CAAC,GAAG,SAAS,CAAC;IACxB,CAAC;IACD,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1B,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CACvC,UAAgC,EAChC,KAAc;IAEd,MAAM,SAAS,GAAG,2BAA2B,CAAC,UAAU,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IACvE,IAAI,SAAS,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACzC,IAAI,UAAU,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;QAChF,OAAO,IAAI,CAAC;IACd,CAAC;IACD,OAAO,SAAS,IAAI,IAAI,CAAC;AAC3B,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,+BAA+B,CAC7C,QAAgD,EAChD,UAAqC,EAAE;IAEvC,MAAM,SAAS,GAA4B,EAAE,CAAC;IAC9C,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;QACxC,IAAI,OAAO,CAAC,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;YAAE,SAAS;QACxD,MAAM,GAAG,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChC,MAAM,MAAM,GAAG,0BAA0B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QACnD,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,yBAAyB,CAC5C,CAAC,EACD,GAAG,KAAK,SAAS,IAAI,MAAM,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YACrD,CAAC,CAAC,MAAM,CAAC,KAAK;YACd,CAAC,CAAC,GAAG,CACR,CAAC;IACJ,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,MAAM,qBAAqB,GACzB,CAAC,GAAG,EAAE;IACJ,MAAM,CAAC,GAAG,IAAI,GAAG,EAA6C,CAAC;IAC/D,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;QACxC,MAAM,IAAI,GAAG,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QACpC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACb,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC;IACzB,CAAC;IACD,OAAO,CAAC,CAAC;AACX,CAAC,CAAC,EAAE,CAAC;AAEP,2DAA2D;AAC3D,MAAM,CAAC,MAAM,iBAAiB,GAAwB,IAAI,GAAG,CAC3D,uBAAuB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAC5C,CAAC;AAEF,SAAS,WAAW,CAAC,KAAc;IACjC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,MAAM,CAAC;IACzD,IAAI,OAAO,KAAK,KAAK,SAAS;QAAE,OAAO,SAAS,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,UAAU,CAAC;IAC5C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAC/C,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,iEAAiE;AACjE,SAAS,cAAc,CAAC,KAAc,EAAE,IAAoB;IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IACvD,IAAI,IAAI,KAAK,QAAQ;QAAE,OAAO,KAAK,KAAK,EAAE,CAAC;IAC3C,IAAI,IAAI,KAAK,UAAU;QAAE,OAAO,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,CAAC;IAC5E,IAAI,IAAI,KAAK,QAAQ;QACnB,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;YACzB,KAAK,KAAK,IAAI;YACd,MAAM,CAAC,IAAI,CAAC,KAAe,CAAC,CAAC,MAAM,KAAK,CAAC,CAC1C,CAAC;IACJ,OAAO,KAAK,CAAC,CAAC,+DAA+D;AAC/E,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAChB,UAAgC,EAChC,KAAc;IAEd,MAAM,MAAM,GAAG,WAAW,CAAC,KAAK,CAAC,CAAC;IAClC,IAAI,MAAM,KAAK,MAAM;QAAE,OAAO,IAAI,CAAC,CAAC,2CAA2C;IAC/E,IAAI,UAAU,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;QACnC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,EAAE,CAAC;YACxE,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,GAAG,qCAAqC,MAAM,GAAG,CAAC;QACjG,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,UAAU,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC;QACjC,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;YACxB,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,GAAG,yBAAyB,MAAM,GAAG,CAAC;QACrF,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;IACD,IAAI,MAAM,KAAK,UAAU,CAAC,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,UAAU,CAAC,OAAO,KAAK,UAAU,CAAC,GAAG,cAAc,UAAU,CAAC,IAAI,SAAS,MAAM,GAAG,CAAC;IAClG,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gBAAgB,CAC9B,QAA6B,EAC7B,OAA0B;IAE1B,MAAM,GAAG,GAAwB,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,EAAE,CAAC;QACzD,MAAM,KAAK,GAAG,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QACpD,IAAI,CAAC,CAAC,IAAI,KAAK,SAAS,IAAI,cAAc,CAAC,KAAK,EAAE,CAAC,CAAC,IAAI,CAAC;YAAE,SAAS;QACpE,GAAG,CAAC,CAAC,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACrB,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B,CACxC,QAA6B;IAE7B,MAAM,IAAI,GAAwB,EAAE,CAAC;IACrC,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,GAAG,GAAG,gBAAgB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAChD,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC;YAAE,IAAI,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC;IACvD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAeD;;;;;;GAMG;AACH,SAAS,uBAAuB,CAAC,OAGhC;IACC,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,cAAc,IAAI,OAAO,CAAC,WAAW,CAAC,CAAC;AAC3D,CAAC;AAED;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,MAAM,UAAU,sBAAsB,CACpC,QAA6B,EAC7B,UAA+D,EAAE;IAEjE,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,6EAA6E;IAC7E,4EAA4E;IAC5E,8EAA8E;IAC9E,yDAAyD;IACzD,KAAK,MAAM,GAAG,IAAI,uBAAuB,CAAC,QAAQ,EAAE,oBAAoB,CAAC,EAAE,CAAC;QAC1E,MAAM,CAAC,IAAI,CACT,2CAA2C,GAAG,wBAAwB;YACpE,wCAAwC,qBAAqB,CAAC,GAAG,CAC/D,CAAC,CAAC,EAAE,EAAE,CAAC,IAAI,CAAC,GAAG,CAChB,CAAC,IAAI,CAAC,IAAI,CAAC,6DAA6D,CAC5E,CAAC;IACJ,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,qBAAqB,EAAE,CAAC;QAC5C,MAAM,WAAW,GAAG,QAAQ,EAAE,CAAC,OAAO,CAAC,CAAC;QACxC,IAAI,WAAW,KAAK,SAAS,IAAI,WAAW,KAAK,IAAI;YAAE,SAAS;QAChE,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,CAAC;YAClE,MAAM,CAAC,IAAI,CAAC,IAAI,OAAO,mBAAmB,CAAC,CAAC;YAC5C,SAAS;QACX,CAAC;QACD,MAAM,WAAW,GAAG,qBAAqB,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;QAC7D,MAAM,KAAK,GAAG,IAAI,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;QAE1D,KAAK,MAAM,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,GAAG,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;YACzB,IAAI,CAAC,CAAC,EAAE,CAAC;gBACP,iEAAiE;gBACjE,uEAAuE;gBACvE,kEAAkE;gBAClE,wEAAwE;gBACxE,wEAAwE;gBACxE,oEAAoE;gBACpE,yDAAyD;gBACzD,MAAM,OAAO,GAAG,gBAAgB,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC7C,IAAI,OAAO,EAAE,CAAC;oBACZ,MAAM,CAAC,IAAI,CAAC,cAAc,OAAO,KAAK,GAAG,MAAM,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC;oBAC/D,SAAS;gBACX,CAAC;gBACD,wEAAwE;gBACxE,iEAAiE;gBACjE,6DAA6D;gBAC7D,MAAM,CAAC,IAAI,CACT,+BAA+B,OAAO,KAAK,GAAG,iBAAiB;oBAC7D,wDAAwD;oBACxD,oBAAoB,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAClE,CAAC;gBACF,SAAS;YACX,CAAC;YACD,IAAI,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;gBAAE,SAAS;YAChD,MAAM,KAAK,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC;YAC/B,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC;YAChC,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;gBACjB,SAAS;YACX,CAAC;YACD,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,KAAK,CAAC;QAC5B,CAAC;IACH,CAAC;IAED,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC;AACxC,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,wBAAwB,CACtC,QAA6B;IAE7B,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,KAAK,IAAI,2BAA2B,EAAE,CAAC;QAChD,MAAM,CAAC,GAAG,uBAAuB,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;QACjE,IAAI,CAAC,CAAC;YAAE,SAAS;QACjB,MAAM,OAAO,GAAG,QAAQ,EAAE,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;QACtC,MAAM,OAAO,GACX,OAAO,KAAK,IAAI;YAChB,OAAO,OAAO,KAAK,QAAQ;YAC3B,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YACvB,OAAO,CAAC,CAAC,CAAC,GAAG,CAAC,KAAK,SAAS,CAAC;QAC/B,IAAI,OAAO;YAAE,SAAS;QACtB,MAAM,CAAC,IAAI,CACT,cAAc,CAAC,CAAC,OAAO,KAAK,CAAC,CAAC,GAAG,yCAAyC;YACxE,qEAAqE;YACrE,+DAA+D,CAClE,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;;;;;;;;;;;;;;;;GAiBG;AACH,MAAM,UAAU,uBAAuB,CACrC,QAA6B,EAC7B,UAA+D,EAAE;IAEjE,MAAM,MAAM,GAAG,sBAAsB,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IACzD,MAAM,MAAM,GAAG,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzE,IAAI,MAAM,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACtB,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,CAAC;IAC7D,CAAC;IAED,MAAM,WAAW,GAAG,uBAAuB,CAAC,OAAO,CAAC,CAAC;IACrD,MAAM,QAAQ,GAAwB,EAAE,CAAC;IACzC,KAAK,MAAM,CAAC,IAAI,uBAAuB,EAAE,CAAC;QACxC,IAAI,WAAW,IAAI,CAAC,CAAC,KAAK,KAAK,MAAM;YAAE,SAAS;QAChD,IAAI,CAAC,CAAC,KAAK,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YAC/B,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC7C,SAAS;QACX,CAAC;QACD,MAAM,MAAM,GAAG,qBAAqB,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;QAC9C,0EAA0E;QAC1E,IAAI,MAAM,CAAC,QAAQ,KAAK,IAAI;YAAE,SAAS;QACvC,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IACnC,CAAC;IACD,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AAC7D,CAAC"}

package/dist/src/lib/canonical-json.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Canonical JSON serialization used for content comparison and hashing.
+ *
+ * Key order is normalized (sorted) so two structurally identical objects
+ * always produce the same string, while array order is preserved (step order
+ * matters in workflows).
+ *
+ * Lives in `lib/` rather than inside `commands/sync.ts` so both the sync
+ * command and the workflow-include reconciliation helper can compare values
+ * the same way without a circular import.
+ */
+export declare function canonicalJsonStringify(value: any): string;