sporades 0.9.38 → 0.9.40

package/CHANGES.md

@@ -1,5 +1,58 @@
 # Changes
 
+## v0.9.40 - 2026-10-23
+
+Changes since v0.9.39.
+
+### 📝 Documentation
+
+- Upgrade Capsule base to Node 24 LTS and normalize npm pack JSON (#288) (8f5ecc5b).
+
+### 🧪 Tests
+
+- Describe SQLite inspection columns without StatementSync#columns() (#287) (9b29b3d5).
+
+## v0.9.39 - 2026-10-22
+
+Changes since v0.9.38.
+
+### 🚀 Features
+
+- Add read-only sporades host db list|dump|query (#286) (c9f0d358).
+
+## Unreleased
+
+### 📦 Packaging
+
+- Upgrade the default Capsule Base image to `0.3.0-node24-alpine`, using Node
+  24.22.1 LTS on Alpine 3.23 with a pinned upstream image digest. Upgrade the CLI
+  and Host helper and redeploy to replace existing containers; restarting a
+  release preserves its pinned image. Keep explicit image overrides unchanged.
+- Normalize npm pack JSON metadata across flat and package-keyed formats in
+  release verification and packaged compatibility checks, preserving artifact
+  hashes and rejecting ambiguous output.
+
+### 🚀 Features
+
+- Add read-only `sporades host db list|dump|query` for running Hosted Capsules (#285).
+  It runs the Host helper over the operator's existing SSH access and the
+  generated Bundle's one-shot action seam, opens the Capsule SQLite file
+  read-only and query-only without stopping the Capsule, and refuses mutating
+  SQL both locally and in the runtime. `--json` output matches
+  `sporades db list|dump|query --json` against a Dev session. `--subname`
+  defaults to the project's Host binding. Requires `sporades host upgrade` and
+  a redeploy with this CLI; no public route is added.
+
+### 🐛 Bug Fixes
+
+- Fix `sporades host db query` failing with "columns is not a function" on
+  Hosted Capsules. The previous Base image ran Node 22.14, whose `node:sqlite` lacks
+  `StatementSync#columns()` (added in 22.16). SQLite inspection queries now
+  describe their columns without it, including zero-row results, so Hosted,
+  Dev and MCP ops queries on Node 22.13–22.15 return the same
+  `{ ok, data: { columns, rows }, error }` envelope. Requires a redeploy with
+  this CLI.
+
 ## v0.9.38 - 2026-10-22
 
 Changes since v0.9.37.

package/Dockerfile.base

@@ -1,12 +1,12 @@
-FROM node:22.14-alpine
+FROM node:24.22.1-alpine3.23@sha256:0468540aa58203ff9e40c2aab3907c52644ab818af6176b1c70a026137dc92a2
 
 LABEL org.opencontainers.image.title="Sporades Base Image"
-LABEL org.opencontainers.image.description="Thin Node 22 Base image for Sporades Container sessions and Hosted Capsules"
-LABEL org.opencontainers.image.version="0.2.0-node22-alpine"
+LABEL org.opencontainers.image.description="Thin Node 24 LTS Base image for Sporades Container sessions and Hosted Capsules"
+LABEL org.opencontainers.image.version="0.3.0-node24-alpine"
 LABEL org.opencontainers.image.source="https://github.com/sporades/sporades"
 LABEL com.sporades.base-image.name="sporades-base"
-LABEL com.sporades.base-image.version="0.2.0-node22-alpine"
-LABEL com.sporades.base-image.node="22"
+LABEL com.sporades.base-image.version="0.3.0-node24-alpine"
+LABEL com.sporades.base-image.node="24"
 
 RUN apk add --no-cache openssh-server fail2ban clamav clamav-daemon \
   && addgroup -g 10001 -S sporades \

package/bin/sporades-host-helper.js

@@ -256,8 +256,8 @@ var init_base_image = __esm({
     "use strict";
     SPORADES_BASE_IMAGE = {
       name: "sporades-base",
-      image: "ghcr.io/sporades/sporades-base:0.2.0-node22-alpine",
-      version: "0.2.0-node22-alpine",
+      image: "ghcr.io/sporades/sporades-base:0.3.0-node24-alpine",
+      version: "0.3.0-node24-alpine",
       runtimeUser: "sporades",
       runtimeUid: 10001,
       runtimeGid: 10001,
@@ -46183,7 +46183,7 @@ var mutationExecution = new MutationExecutionStorage();
 init_cli_support();
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.38";
+var CLI_VERSION = "0.9.40";
 
 // src/cli/schedule-inspection-envelope.ts
 var SCHEDULE_DIAGNOSTIC_FIELDS = /* @__PURE__ */ new Set([
@@ -46258,6 +46258,40 @@ function sanitizeScheduleInspectionEnvelope(envelope, invalid4) {
   return { ok: true, data: { capsule: { name: envelope.data.capsule.name }, schedules }, error: null };
 }
 
+// src/cli/database-inspection-envelope.ts
+var DATABASE_INSPECTION_ACTIONS = ["db.list", "db.dump", "db.query"];
+var DATABASE_INSPECTION_INPUT_BYTE_LIMIT = 24 * 1024;
+function encodeDatabaseInspectionInput(sql) {
+  const encoded = Buffer.from(JSON.stringify({ sql }), "utf8").toString("base64url");
+  return encoded.length <= DATABASE_INSPECTION_INPUT_BYTE_LIMIT ? encoded : null;
+}
+var DATABASE_INSPECTION_MAX_BUFFER = 128 * 1024 * 1024;
+function isDatabaseInspectionAction(action) {
+  return DATABASE_INSPECTION_ACTIONS.includes(action);
+}
+function sanitizeDatabaseInspectionEnvelope(action, envelope, invalid4) {
+  const data2 = envelope?.data;
+  if (envelope?.ok === true && data2 && typeof data2 === "object" && !Array.isArray(data2)) {
+    if (action === "db.query" && Array.isArray(data2.columns) && Array.isArray(data2.rows)) {
+      return { ok: true, data: { columns: data2.columns, rows: data2.rows }, error: null };
+    }
+    if (action !== "db.query" && Array.isArray(data2.tables)) {
+      return { ok: true, data: { tables: data2.tables }, error: null };
+    }
+  }
+  if (envelope?.ok === false && typeof envelope.error?.message === "string") {
+    return {
+      ok: false,
+      data: null,
+      error: {
+        message: envelope.error.message,
+        hint: typeof envelope.error.hint === "string" ? envelope.error.hint : "Check the SQL and retry the command."
+      }
+    };
+  }
+  return invalid4();
+}
+
 // src/cli/host-helper-archive.ts
 import { spawnSync } from "node:child_process";
 import { readFileSync } from "node:fs";
@@ -48806,6 +48840,10 @@ async function dispatchMain(request2) {
     runCapsuleAccessKeyAction(request2);
     return;
   }
+  if (isDatabaseInspectionAction(request2.action)) {
+    inspectCapsuleDatabase(request2);
+    return;
+  }
   if (request2.action === "host.stats") {
     await statsHost(request2);
     return;
@@ -48852,6 +48890,19 @@ function runCapsuleAccessKeyAction(request2) {
     Buffer.from(JSON.stringify(accessKeys), "utf8").toString("base64url")
   ]);
 }
+function inspectCapsuleDatabase(request2) {
+  const action = request2.action;
+  if (!isDatabaseInspectionAction(action)) throw helperError("Unsupported Host helper action.", "Update the Host helper or use a supported Sporades host command.");
+  const exactKeys2 = (value, keys2) => Object.keys(value).length === keys2.length && Object.keys(value).every((key) => keys2.includes(key));
+  const query = action === "db.query";
+  const sql = request2.db?.sql;
+  if (!exactKeys2(request2, query ? ["action", "host", "capsule", "db"] : ["action", "host", "capsule"]) || !request2.host || typeof request2.host !== "object" || Array.isArray(request2.host) || !exactKeys2(request2.host, ["alias", "domain", "scheme", "remoteRoot"]) || !request2.capsule || typeof request2.capsule !== "object" || Array.isArray(request2.capsule) || !exactKeys2(request2.capsule, ["subname"]) || query && (!exactKeys2(request2.db ?? {}, ["sql"]) || typeof sql !== "string" || !encodeDatabaseInspectionInput(sql))) {
+    throw helperError("Invalid Hosted database inspection request.", "Upgrade the local Sporades CLI and Host helper together.");
+  }
+  inspectCapsuleRuntime(request2, action, "database", (envelope) => sanitizeDatabaseInspectionEnvelope(action, envelope, () => {
+    throw helperError("Hosted database inspection returned an invalid response.", "Run `sporades host upgrade`, redeploy the Capsule, and retry the command.");
+  }), query ? ["--sporades-action-input", encodeDatabaseInspectionInput(sql)] : []);
+}
 function inspectCapsuleRuntime(request2, action, label, sanitize = (envelope) => envelope, extraArgs = [], preserveBoundedDiagnostics = false) {
   const containerName = createHostedContainerName(request2.host.domain, request2.capsule.subname);
   if (!checkContainerRunning(containerName)) {
@@ -48860,7 +48911,7 @@ function inspectCapsuleRuntime(request2, action, label, sanitize = (envelope) =>
     throw error;
   }
   const result = runDocker(["exec", containerName, "node", "/app/server.mjs", "--sporades-action", action, ...extraArgs], {
-    maxBuffer: label === "Access-key" ? ACCESS_KEY_OPERATOR_PROCESS_MAX_BUFFER : void 0
+    maxBuffer: label === "Access-key" ? ACCESS_KEY_OPERATOR_PROCESS_MAX_BUFFER : label === "database" ? DATABASE_INSPECTION_MAX_BUFFER : void 0
   });
   let envelope;
   try {

package/bin/sporades.js

@@ -124294,7 +124294,7 @@ function createSharedDatabaseAdapterMethods(dialect) {
           (columnMetadata) => thenIfPromise(statement.all(), (allRows) => ({
             ok: true,
             data: {
-              columns: columnMetadata.map((column) => column.name),
+              columns: columnMetadata?.map((column) => column.name) ?? Object.keys(allRows[0] ?? {}),
               rows: allRows.filter((row) => !isInternalLogIndexMetadataRow(row, sql3))
             },
             error: null
@@ -124315,6 +124315,19 @@ function createSharedDatabaseAdapterMethods(dialect) {
     }
   };
 }
+function describeSqliteColumns(connection, statement, sql2) {
+  if (typeof statement.columns === "function") return statement.columns();
+  let row;
+  try {
+    row = connection.prepare(
+      `SELECT __sporades_columns.* FROM (SELECT 1) LEFT JOIN (${sqlWithoutTrailingTerminator(sql2)}
+) AS __sporades_columns ON 1 LIMIT 1`
+    ).get();
+  } catch {
+    return null;
+  }
+  return Object.keys(row ?? {}).map((name2) => ({ name: name2 }));
+}
 async function createSqliteDatabaseAdapter(databasePath, options = {}) {
   const { DatabaseSync } = await import("node:sqlite");
   const path24 = await import("node:path");
@@ -124365,7 +124378,7 @@ async function createSqliteDatabaseAdapter(databasePath, options = {}) {
             }));
           },
           columns() {
-            return run2(() => useConnection(() => connection.prepare(sql2).columns()));
+            return run2(() => useConnection(() => describeSqliteColumns(connection, connection.prepare(sql2), sql2)));
           }
         };
       }
@@ -124417,7 +124430,7 @@ async function createSqliteDatabaseAdapter(databasePath, options = {}) {
                 recordLiveQueryStatementWrite(sql2, result);
                 return result;
               },
-              columns: () => statement.columns()
+              columns: () => describeSqliteColumns(dedicated, statement, sql2)
             });
           }
         };
@@ -133948,8 +133961,8 @@ function errorCode2(error) {
 // src/base-image.ts
 var SPORADES_BASE_IMAGE = {
   name: "sporades-base",
-  image: "ghcr.io/sporades/sporades-base:0.2.0-node22-alpine",
-  version: "0.2.0-node22-alpine",
+  image: "ghcr.io/sporades/sporades-base:0.3.0-node24-alpine",
+  version: "0.3.0-node24-alpine",
   runtimeUser: "sporades",
   runtimeUid: 10001,
   runtimeGid: 10001,
@@ -149965,6 +149978,8 @@ Capsule commands:
                       Restore a stopped Capsule; optionally --to-subname <destination>
   backup status       Report last successful backup age for each Capsule
   bind <subname>      Bind this project to a Hosted Capsule
+  db list|dump|query <sql> [--subname <name>]
+                      Read a running Hosted Capsule's database over SSH
   register <subname>  Register a Hosted Capsule
   canonical set <subname> <alias>|clear <subname>
                       Select the public origin; restart a running Capsule
@@ -150849,6 +150864,18 @@ function sanitizeScheduleInspectionEnvelope(envelope, invalid4) {
   return { ok: true, data: { capsule: { name: envelope.data.capsule.name }, schedules }, error: null };
 }
 
+// src/cli/database-inspection-envelope.ts
+var DATABASE_INSPECTION_ACTIONS = ["db.list", "db.dump", "db.query"];
+var DATABASE_INSPECTION_INPUT_BYTE_LIMIT = 24 * 1024;
+function encodeDatabaseInspectionInput(sql2) {
+  const encoded = Buffer.from(JSON.stringify({ sql: sql2 }), "utf8").toString("base64url");
+  return encoded.length <= DATABASE_INSPECTION_INPUT_BYTE_LIMIT ? encoded : null;
+}
+var DATABASE_INSPECTION_MAX_BUFFER = 128 * 1024 * 1024;
+function isDatabaseInspectionAction(action) {
+  return DATABASE_INSPECTION_ACTIONS.includes(action);
+}
+
 // src/cli/server-env-check.ts
 import path20 from "node:path";
 async function readProjectServerEnv(projectDir) {
@@ -153035,7 +153062,7 @@ jobs:
 }
 
 // src/cli/cli-version.ts
-var CLI_VERSION = "0.9.38";
+var CLI_VERSION = "0.9.40";
 
 // src/cli/sporades.ts
 var SUPPORTED_TEMPLATES = new Set(CLIENT_TEMPLATES);
@@ -154261,7 +154288,7 @@ function parseHostArgs(args) {
         force = true;
         break;
       default:
-        if (arg.startsWith("--")) {
+        if (arg.startsWith("--") && subcommand !== "db") {
           throw commandError2(
             `Unknown flag: ${arg}`,
             "Use `sporades host add`, `sporades host use`, `sporades host current`, `sporades host health`, `sporades host bind`, `sporades host register`, `sporades host rotate-key`, `sporades host unregister`, `sporades host delete`, `sporades host push`, `sporades host bootstrap`, `sporades host upgrade`, `sporades host list`, `sporades host releases`, `sporades host rollback`, `sporades host reconcile`, `sporades host stats`, `sporades host logs`, or `sporades host invoke`."
@@ -154437,6 +154464,16 @@ function parseHostArgs(args) {
       validateCapsuleSubname(subname);
       return { subcommand, ...parsePolicyOperation(positional), hostAlias, subname, json: json2, projectDir: process.cwd() };
     }
+    case "db": {
+      const [operation, ...sqlParts] = positional;
+      const usage = "Use `sporades host db list`, `sporades host db dump`, or `sporades host db query <sql>`, with optional `--subname <name> --host <alias>`.";
+      if (!["list", "dump", "query"].includes(operation)) throw commandError2(`Unknown host db command: ${operation ?? ""}`.trim(), usage);
+      if (operation !== "query" && sqlParts.length > 0) throw commandError2("Too many positional arguments.", `Use \`sporades host db ${operation} --json\`.`);
+      if (operation === "query" && sqlParts.length === 0) throw commandError2("Missing SQL query.", "Use `sporades host db query <sql>`.");
+      if (hostAlias) validateHostAlias(hostAlias);
+      if (subname) validateCapsuleSubname(subname);
+      return { subcommand, operation, ...operation === "query" ? { sql: sqlParts.join(" ") } : {}, subname, hostAlias, json: json2, projectDir: process.cwd() };
+    }
     case "jobs":
       if (positional.length > 0) throw commandError2("Too many positional arguments.", "Use `sporades host jobs --host <alias> --subname <name>`.");
       if (!hostAlias) throw commandError2("Missing Host profile alias.", "Pass `--host <alias>`.");
@@ -156856,6 +156893,31 @@ async function manageHost(options) {
       writeResult(result, !result.ok);
       return;
     }
+    case "db": {
+      if (options.operation === "query") {
+        assertReadOnlyInspectionSql(options.sql);
+        if (!encodeDatabaseInspectionInput(options.sql)) {
+          throw commandError2("SQL query is too large for Hosted inspection.", "Keep `sporades host db query` SQL under about 16 KiB.");
+        }
+      }
+      const config = await readHostConfig();
+      const target = await resolveHostPushTarget(config, options);
+      let result = invokeRemoteHostHelper({
+        alias: target.alias,
+        profile: target.profile,
+        action: `db.${options.operation}`,
+        subname: target.subname,
+        projectDir: options.projectDir,
+        ...options.operation === "query" ? { db: { sql: options.sql } } : {}
+      });
+      if (!result.ok && /Unsupported Host helper action/i.test(result.error.message)) {
+        result = { ok: false, data: null, error: { code: "HOST_HELPER_UPGRADE_REQUIRED", message: "The Host server CLI does not support database inspection.", hint: `Run \`sporades host upgrade --host ${target.alias}\`, then retry the command.` } };
+      } else if (!result.ok && /Unsupported Sporades runtime action/i.test(result.error.message)) {
+        result = { ok: false, data: null, error: { code: "HOSTED_BUNDLE_UPGRADE_REQUIRED", message: "The Hosted Capsule's Bundle does not support database inspection.", hint: `Redeploy it with this CLI (\`sporades host push --restart --host ${target.alias}\`), then retry the command.` } };
+      }
+      printDatabaseInspection(options.operation, result, options.json);
+      return;
+    }
     case "jobs": {
       const config = await readHostConfig();
       const resolved = resolveHostProfile(config, options.hostAlias);
@@ -158196,21 +158258,24 @@ function inspectedSshPort(inspected) {
   return Number.isInteger(port) ? { host: entry.HostIp ?? null, port } : null;
 }
 async function inspectDatabase(options) {
-  if (options.subcommand === "query") {
-    const validation = validateReadOnlyInspectionSql(options.sql);
-    if (!validation.ok) {
-      throw commandError2(validation.error.message, validation.error.hint);
-    }
+  if (options.subcommand === "query") assertReadOnlyInspectionSql(options.sql);
+  printDatabaseInspection(options.subcommand, await fetchInspectionDatabase(options), options.json);
+}
+function assertReadOnlyInspectionSql(sql2) {
+  const validation = validateReadOnlyInspectionSql(sql2);
+  if (!validation.ok) {
+    throw commandError2(validation.error.message, validation.error.hint);
   }
-  const result = await fetchInspectionDatabase(options);
-  if (options.json) {
+}
+function printDatabaseInspection(subcommand, result, json2) {
+  if (json2) {
     writeResult(result, !result.ok);
     return;
   }
   if (!result.ok) {
     throw commandError2(result.error.message, result.error.hint);
   }
-  switch (options.subcommand) {
+  switch (subcommand) {
     case "list":
       for (const table of result.data.tables) {
         process.stdout.write(`${table}
@@ -158859,6 +158924,7 @@ function invokeRemoteHostHelper(options) {
   if (options.accessKeys) {
     request.accessKeys = options.accessKeys;
   }
+  if (options.db) request.db = options.db;
   if (options.verification) {
     request.verification = options.verification;
   }
@@ -158876,6 +158942,7 @@ function invokeRemoteHostHelper(options) {
     encoding: "utf8",
     ...String(options.action).startsWith("access-keys.") ? { maxBuffer: ACCESS_KEY_OPERATOR_PROCESS_MAX_BUFFER } : {},
     ...String(options.action).includes(".backup.") ? { maxBuffer: 16 * 1024 * 1024 } : {},
+    ...isDatabaseInspectionAction(options.action) ? { maxBuffer: DATABASE_INSPECTION_MAX_BUFFER } : {},
     input: `${JSON.stringify(request)}
 `
   });

package/dist/base-image.js

@@ -1,7 +1,7 @@
 export const SPORADES_BASE_IMAGE = {
     name: "sporades-base",
-    image: "ghcr.io/sporades/sporades-base:0.2.0-node22-alpine",
-    version: "0.2.0-node22-alpine",
+    image: "ghcr.io/sporades/sporades-base:0.3.0-node24-alpine",
+    version: "0.3.0-node24-alpine",
     runtimeUser: "sporades",
     runtimeUid: 10001,
     runtimeGid: 10001,

package/dist/cli/cli-help.d.ts

@@ -25,7 +25,7 @@ Options:
     readonly monitoring: "Usage: sporades monitoring stack <init|validate|upgrade|rollback|backup|restore> [options]\n       sporades monitoring sender <issue|rotate|commit|cancel|revoke|export|status|legacy-revoke> [options]\n\nGenerate or inspect the versioned trace stack from an installed Sporades package.\nInitialization creates a reviewable directory; it does not start services.\nSender operations run locally on the Monitoring server; results contain no secrets.\nRotation stages a second generation; commit retires the old one after sender verification.\n\nOptions:\n  --dir <path>        Target stack directory (default: current directory)\n  --backup <path>     Protected cold snapshot directory (backup/restore)\n  --baseline <path>   Trusted prior release assets for a schema-3 upgrade\n  --sender <name>     Named sender for lifecycle operations (optional for status)\n  --host <identity>   Exact inventory Host scope (issue or legacy-revoke only)\n  --out <path>        New mode-0600 credential handoff file (export only)\n  --generation <n>    Verified pending generation to activate (commit only)\n  --ingest            Disable shared legacy ingestion (legacy-revoke only)\n  --json              Write { ok, data, error } JSON output\n  --help, -h          Show this help\n";
     readonly telemetry: "Usage: sporades telemetry profile <add|list|show|remove> [name] [options]\n\nRegister and inspect operator-owned OTLP/HTTP Telemetry profiles. Descriptors store only\ncredential environment and private CA file references; they never store secret values.\nDev sessions use --telemetry <name> first, then sporades.json telemetry.profile, then no export.\n\nOptions for profile add:\n  --endpoint <url>        OTLP/HTTP base origin (HTTPS, or HTTP loopback with --loopback)\n  --dashboard <url>       Optional dashboard HTTPS URL\n  --credential-env <KEY>  Environment variable containing the ingestion bearer token\n  --inventory-credential-env <KEY>  Exact Host-scoped lifecycle inventory token\n  --inventory-host <id>   Stable inventory identity (default: first connected domain)\n  --metrics-interval-ms <N>  Metrics export period, 5000-300000 ms (default 15000)\n  --trace-propagation-origin <origin>  Approve exact fetch origin (repeatable, max 32)\n  --event-loop-delay-resolution-ms <N>  Delay timer precision, 10-1000 ms (default 20)\n  --ca-file <path>        Absolute private CA certificate path for verified TLS\n  --loopback              Permit a local HTTP collector for development\n  --json                  Write { ok, data, error } JSON output\n  --help, -h              Show this help\n";
     readonly deploy: "Usage: sporades deploy [status|stop|restart|reconcile|remove|reset|ssh] [options]\n\nStart and manage a local Container session.\n\nCommands:\n  deploy              Start a local Container session\n  deploy status       Print Container session status\n  deploy stop         Stop the running Container session\n  deploy restart      Restart the running Container session\n  deploy policy publish <file>|remove\n                      Publish or remove the declared admission policy\n  deploy reconcile    Settle an interrupted deployment-file attempt\n  deploy ssh          Inspect effective Container SSH access\n  deploy remove       Remove the Container session\n  deploy reset        Remove the Container session and local container state\n\nOptions:\n  --port <number>     Published local port when starting\n  --telemetry <name>  Export HTTP traces using a registered Telemetry profile\n  --no-telemetry      Disable export for this Container session\n  --force             Replace stale or conflicting container state when starting\n  --json              Write JSON output\n  --help, -h          Show this help\n";
-    readonly host: "Usage: sporades host <command> [options]\n\nManage Host profiles and Hosted Capsules.\n\nProfile commands:\n  add <alias>         Add a Host profile\n  use <alias>         Set the default Host profile\n  current             Print the selected Host profile\n  bootstrap           Provision the remote Host server\n  upgrade             Copy the local Host helper to the Host server\n  health [subname]    Check Host server or Hosted Capsule health\n  services enable|disable|uninstall|status observability [--on <alias>]\n                      Manage pinned GlitchTip and Umami (opt-in)\n  services connect <subname> [--host <Capsule-host>] [--on <ops-host>]\n                      Seal configured error/analytics env; push to activate\n  services backup|backups observability [--on <alias>]\n                      Snapshot or list service databases using Host backup policy\n  services restore observability --id <snapshot> --confirm observability\n                      Restore disabled services; enable again after inspection\n  telemetry connect|migrate|reconcile|status|check\n  telemetry inventory-export|inventory-reconcile\n                      Manage the shared Host Telemetry relay\n  telemetry exports-disable|remove-agents\n                       Disable exports; remove agents after inventory acknowledgement\n  telemetry resources-enable|resources-disable|resources-remove\n                     Manage Host OS and Caddy collection independently of Capsules\n  telemetry enable|disable <subname>\n                      Change a Hosted Capsule's Telemetry opt-out\n\nCapsule commands:\n  backup configure --file <policy.json>\n                      Configure encrypted backups and an optional Host timer\n  backup create|list|prune --subname <name>\n                      Manage encrypted SQLite and files snapshots\n  backup restore --subname <source> --id <full-id> --confirm <destination>\n                      Restore a stopped Capsule; optionally --to-subname <destination>\n  backup status       Report last successful backup age for each Capsule\n  bind <subname>      Bind this project to a Hosted Capsule\n  register <subname>  Register a Hosted Capsule\n  canonical set <subname> <alias>|clear <subname>\n                      Select the public origin; restart a running Capsule\n  push                Push and install a Hosted Capsule release\n  start <subname>     Start a Hosted Capsule\n  stop <subname>      Stop a Hosted Capsule\n  restart <subname>   Restart a Hosted Capsule\n  policy publish <file>|remove --host <alias> --subname <name>\n                      Publish or remove the recorded admission policy\n  reconcile <subname> Settle an interrupted deployment-file attempt\n  ssh [subname]       Inspect effective Hosted Capsule SSH access\n  stats [subname]     Print Host server or Hosted Capsule stats\n  logs [source]       Print Hosted Capsule logs\n  releases <subname>  List Hosted Capsule releases\n  rollback <subname> <release-id>\n                      Roll back to a previous release\n  rotate-key <subname>\n                      Rotate Hosted Capsule Sealed Server env keys\n  unregister <subname>\n                      Unregister a Hosted Capsule\n  delete <subname>    Delete Hosted Capsule storage\n\nOther commands:\n  list                List Hosted Capsules\n  github workflow write\n                      Write a GitHub Actions deploy workflow\n  invoke <action>     Invoke a low-level remote Host helper action\n\nOptions:\n  --host <alias>      Host profile alias\n  --profile <name>    Verified HTTPS Telemetry profile for connect or migrate\n  --query-credential-env <name>\n                      Ephemeral operator user:password for check or migrate\n  --server <target>   SSH target for host add\n  --domain <domain>   Hosted domain for host add\n  --canonical-domain <hostname>\n                      Public HTTPS link origin for register\n  --alias-domain <hostname>\n                      Custom HTTPS domain for register (repeatable)\n  --remote-root <path>\n                      Remote root path for host add\n  --tls <mode>        TLS mode: automatic or cloudflare-origin\n  --subname <name>    Hosted Capsule subname\n  --lines <n>, -n <n> Log line count\n  --allow-missing-env  Push despite missing required Server env keys\n  --restart           Restart after host push\n  --verify            Verify release health after host push\n  --fallback-to-previous-release\n                      Roll back when verified push fails\n  --branch <name>     GitHub workflow branch\n  --file <path>       GitHub workflow output path\n  --dry-run           Print workflow without writing it\n  --force             Overwrite workflow output when writing it\n  --json              Write JSON output\n  --help, -h          Show this help\n";
+    readonly host: "Usage: sporades host <command> [options]\n\nManage Host profiles and Hosted Capsules.\n\nProfile commands:\n  add <alias>         Add a Host profile\n  use <alias>         Set the default Host profile\n  current             Print the selected Host profile\n  bootstrap           Provision the remote Host server\n  upgrade             Copy the local Host helper to the Host server\n  health [subname]    Check Host server or Hosted Capsule health\n  services enable|disable|uninstall|status observability [--on <alias>]\n                      Manage pinned GlitchTip and Umami (opt-in)\n  services connect <subname> [--host <Capsule-host>] [--on <ops-host>]\n                      Seal configured error/analytics env; push to activate\n  services backup|backups observability [--on <alias>]\n                      Snapshot or list service databases using Host backup policy\n  services restore observability --id <snapshot> --confirm observability\n                      Restore disabled services; enable again after inspection\n  telemetry connect|migrate|reconcile|status|check\n  telemetry inventory-export|inventory-reconcile\n                      Manage the shared Host Telemetry relay\n  telemetry exports-disable|remove-agents\n                       Disable exports; remove agents after inventory acknowledgement\n  telemetry resources-enable|resources-disable|resources-remove\n                     Manage Host OS and Caddy collection independently of Capsules\n  telemetry enable|disable <subname>\n                      Change a Hosted Capsule's Telemetry opt-out\n\nCapsule commands:\n  backup configure --file <policy.json>\n                      Configure encrypted backups and an optional Host timer\n  backup create|list|prune --subname <name>\n                      Manage encrypted SQLite and files snapshots\n  backup restore --subname <source> --id <full-id> --confirm <destination>\n                      Restore a stopped Capsule; optionally --to-subname <destination>\n  backup status       Report last successful backup age for each Capsule\n  bind <subname>      Bind this project to a Hosted Capsule\n  db list|dump|query <sql> [--subname <name>]\n                      Read a running Hosted Capsule's database over SSH\n  register <subname>  Register a Hosted Capsule\n  canonical set <subname> <alias>|clear <subname>\n                      Select the public origin; restart a running Capsule\n  push                Push and install a Hosted Capsule release\n  start <subname>     Start a Hosted Capsule\n  stop <subname>      Stop a Hosted Capsule\n  restart <subname>   Restart a Hosted Capsule\n  policy publish <file>|remove --host <alias> --subname <name>\n                      Publish or remove the recorded admission policy\n  reconcile <subname> Settle an interrupted deployment-file attempt\n  ssh [subname]       Inspect effective Hosted Capsule SSH access\n  stats [subname]     Print Host server or Hosted Capsule stats\n  logs [source]       Print Hosted Capsule logs\n  releases <subname>  List Hosted Capsule releases\n  rollback <subname> <release-id>\n                      Roll back to a previous release\n  rotate-key <subname>\n                      Rotate Hosted Capsule Sealed Server env keys\n  unregister <subname>\n                      Unregister a Hosted Capsule\n  delete <subname>    Delete Hosted Capsule storage\n\nOther commands:\n  list                List Hosted Capsules\n  github workflow write\n                      Write a GitHub Actions deploy workflow\n  invoke <action>     Invoke a low-level remote Host helper action\n\nOptions:\n  --host <alias>      Host profile alias\n  --profile <name>    Verified HTTPS Telemetry profile for connect or migrate\n  --query-credential-env <name>\n                      Ephemeral operator user:password for check or migrate\n  --server <target>   SSH target for host add\n  --domain <domain>   Hosted domain for host add\n  --canonical-domain <hostname>\n                      Public HTTPS link origin for register\n  --alias-domain <hostname>\n                      Custom HTTPS domain for register (repeatable)\n  --remote-root <path>\n                      Remote root path for host add\n  --tls <mode>        TLS mode: automatic or cloudflare-origin\n  --subname <name>    Hosted Capsule subname\n  --lines <n>, -n <n> Log line count\n  --allow-missing-env  Push despite missing required Server env keys\n  --restart           Restart after host push\n  --verify            Verify release health after host push\n  --fallback-to-previous-release\n                      Roll back when verified push fails\n  --branch <name>     GitHub workflow branch\n  --file <path>       GitHub workflow output path\n  --dry-run           Print workflow without writing it\n  --force             Overwrite workflow output when writing it\n  --json              Write JSON output\n  --help, -h          Show this help\n";
     readonly logs: "Usage: sporades logs [tail] [options]\n\nPrint Dev session logs.\n\nCommands:\n  logs                Print recent Dev session logs\n  logs tail           Follow Dev session logs\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n";
     readonly db: "Usage: sporades db <command> [options]\n\nInspect the Dev session database.\n\nCommands:\n  list                List database tables\n  dump                Dump database contents\n  query <sql>         Run a read-only SQL query\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n";
     readonly default: "Usage: sporades <command> [options]\n    \n    Commands:\n      stripe-fake    Run the local Team Billing test provider\n      create <name>  Scaffold a new Capsule\n      dev            Start a local Dev session\n      auth           Manage local auth configuration and simulation\n      access-keys    Inspect and retire Access keys through a running Capsule\n      security       Inspect effective Capsule security policy\n      doctor         Run read-only Sporades diagnostics\n      env            Manage Sealed Server env\n      monitoring     Generate and validate a monitoring stack\n      telemetry      Register operator Telemetry profiles\n      deploy         Start a local Container session\n      host           Manage Host profiles and Hosted Capsules\n      logs           Print Dev session logs\n      db             Inspect the Dev session database\n    \n    Options:\n      --help, -h     Show help for command\n      --version, -v  Show CLI version\n      --host <alias> Show Host server CLI version with --version\n      --json         Write JSON output when supported by the command\n    ";
@@ -46,6 +46,6 @@ Options:
   --no-git            Skip git initialization
   --json              Write JSON output
   --help, -h          Show this help
-` | "Usage: sporades dev [status|stop|reset] [options]\n\nStart and manage a local Dev session.\n\nCommands:\n  dev                 Start a Dev session\n  dev status          Print Dev session status\n  dev stop            Stop the running Dev session\n  dev reset           Stop the Dev session and remove local Dev state\n\nOptions:\n  --port <number>     Dev session port when starting\n  --public            Allow non-localhost access when starting\n  --telemetry <name>  Export HTTP traces using a registered Telemetry profile\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades auth <command> [options]\n\nManage local auth configuration and identity simulation.\n\nCommands:\n  status              Print auth provider status\n  clients             List connected Dev session clients\n  set <provider>      Configure or disable anonymous, email, Google, Microsoft, Apple, or Facebook\n  as email            Simulate a local email identity\n\nOptions:\n  --client-id <id>        OAuth client/app ID (Apple Services ID)\n  --client-secret <secret> OAuth client/app secret\n  --client-json <path>    Read provider-specific credentials JSON\n  --tenant <tenant>       Microsoft tenant (default: common)\n  --team-id <id>          Apple Developer Team ID\n  --key-id <id>           Apple Sign in key ID\n  --private-key <pem>     Apple private key (stored only in Server env)\n  --graph-version <name>  Facebook Graph API version\n  --disable               Disable the selected provider without changing siblings\n  --email <address>       Simulated email identity\n  --display-name <name>   Simulated display name\n  --picture <url>         Simulated profile picture URL\n  --port <number>         Target Dev session port\n  --client <target>       Delivery target: current, all, or a client ID\n  --json                  Write JSON output\n  --help, -h              Show this help\n" | "Usage: sporades access-keys <command> [options]\n\nInspect and retire Access keys through a running Capsule.\n\nCommands:\n  list --user-id <id>       List one owner's Access-key metadata\n  inspect <key-id>          Inspect one Access key\n  revoke <key-id>           Revoke one Access key\n  revoke-all --user-id <id> Revoke one owner's current Access keys\n  delete <key-id>           Delete revoked Access-key history\n\nOptions:\n  --session <name>    Session: dev, container, or hosted (default: dev)\n  --host <alias>      Host profile alias for a Hosted Capsule\n  --subname <name>    Hosted Capsule subname\n  --cursor <cursor>   Opaque list cursor\n  --limit <n>         List page size from 1 through 100\n  --status <status>   List active, expired, or revoked keys\n  --yes               Explicitly approve a destructive operation\n  --json              Write structured JSON; does not imply consent\n  --help, -h          Show this help\n" | "Usage: sporades security [options]\n\nInspect effective Capsule security policy.\n\nOptions:\n  --session <name>    Session: dev, public-dev, container, or hosted\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades doctor [options]\n\nRun read-only Sporades diagnostics.\n\nOptions:\n  --session <name>    Session: dev, public-dev, container, or hosted\n  --host <alias>      Host profile alias for Hosted Capsule checks\n  --subname <name>    Hosted Capsule subname\n  --strict            Exit non-zero on warnings as well as failures\n  --json              Write structured JSON output\n  --help, -h          Show this help\n" | "Usage: sporades env <command> [options]\n\nManage Sealed Server env.\n\nCommands:\n  set <name>          Read one value from stdin and seal it\n  has <name>          Test whether a Server env key is defined\n  init                Create local Sealed Server env key material\n  import              Import Server env values from a file\n  status              Print Sealed Server env status\n  export              Export Sealed Server env for a Host profile\n  reencrypt           Re-encrypt local Sealed Server env material\n\nOptions:\n  --stdin             Read the value for env set from stdin\n  --file <path>       Input file for import or export\n  --host <alias>      Host profile alias\n  --subname <name>    Hosted Capsule subname\n  --output <path>     Export output path\n  --sealed            Treat input as an already sealed export\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades monitoring stack <init|validate|upgrade|rollback|backup|restore> [options]\n       sporades monitoring sender <issue|rotate|commit|cancel|revoke|export|status|legacy-revoke> [options]\n\nGenerate or inspect the versioned trace stack from an installed Sporades package.\nInitialization creates a reviewable directory; it does not start services.\nSender operations run locally on the Monitoring server; results contain no secrets.\nRotation stages a second generation; commit retires the old one after sender verification.\n\nOptions:\n  --dir <path>        Target stack directory (default: current directory)\n  --backup <path>     Protected cold snapshot directory (backup/restore)\n  --baseline <path>   Trusted prior release assets for a schema-3 upgrade\n  --sender <name>     Named sender for lifecycle operations (optional for status)\n  --host <identity>   Exact inventory Host scope (issue or legacy-revoke only)\n  --out <path>        New mode-0600 credential handoff file (export only)\n  --generation <n>    Verified pending generation to activate (commit only)\n  --ingest            Disable shared legacy ingestion (legacy-revoke only)\n  --json              Write { ok, data, error } JSON output\n  --help, -h          Show this help\n" | "Usage: sporades telemetry profile <add|list|show|remove> [name] [options]\n\nRegister and inspect operator-owned OTLP/HTTP Telemetry profiles. Descriptors store only\ncredential environment and private CA file references; they never store secret values.\nDev sessions use --telemetry <name> first, then sporades.json telemetry.profile, then no export.\n\nOptions for profile add:\n  --endpoint <url>        OTLP/HTTP base origin (HTTPS, or HTTP loopback with --loopback)\n  --dashboard <url>       Optional dashboard HTTPS URL\n  --credential-env <KEY>  Environment variable containing the ingestion bearer token\n  --inventory-credential-env <KEY>  Exact Host-scoped lifecycle inventory token\n  --inventory-host <id>   Stable inventory identity (default: first connected domain)\n  --metrics-interval-ms <N>  Metrics export period, 5000-300000 ms (default 15000)\n  --trace-propagation-origin <origin>  Approve exact fetch origin (repeatable, max 32)\n  --event-loop-delay-resolution-ms <N>  Delay timer precision, 10-1000 ms (default 20)\n  --ca-file <path>        Absolute private CA certificate path for verified TLS\n  --loopback              Permit a local HTTP collector for development\n  --json                  Write { ok, data, error } JSON output\n  --help, -h              Show this help\n" | "Usage: sporades deploy [status|stop|restart|reconcile|remove|reset|ssh] [options]\n\nStart and manage a local Container session.\n\nCommands:\n  deploy              Start a local Container session\n  deploy status       Print Container session status\n  deploy stop         Stop the running Container session\n  deploy restart      Restart the running Container session\n  deploy policy publish <file>|remove\n                      Publish or remove the declared admission policy\n  deploy reconcile    Settle an interrupted deployment-file attempt\n  deploy ssh          Inspect effective Container SSH access\n  deploy remove       Remove the Container session\n  deploy reset        Remove the Container session and local container state\n\nOptions:\n  --port <number>     Published local port when starting\n  --telemetry <name>  Export HTTP traces using a registered Telemetry profile\n  --no-telemetry      Disable export for this Container session\n  --force             Replace stale or conflicting container state when starting\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades host <command> [options]\n\nManage Host profiles and Hosted Capsules.\n\nProfile commands:\n  add <alias>         Add a Host profile\n  use <alias>         Set the default Host profile\n  current             Print the selected Host profile\n  bootstrap           Provision the remote Host server\n  upgrade             Copy the local Host helper to the Host server\n  health [subname]    Check Host server or Hosted Capsule health\n  services enable|disable|uninstall|status observability [--on <alias>]\n                      Manage pinned GlitchTip and Umami (opt-in)\n  services connect <subname> [--host <Capsule-host>] [--on <ops-host>]\n                      Seal configured error/analytics env; push to activate\n  services backup|backups observability [--on <alias>]\n                      Snapshot or list service databases using Host backup policy\n  services restore observability --id <snapshot> --confirm observability\n                      Restore disabled services; enable again after inspection\n  telemetry connect|migrate|reconcile|status|check\n  telemetry inventory-export|inventory-reconcile\n                      Manage the shared Host Telemetry relay\n  telemetry exports-disable|remove-agents\n                       Disable exports; remove agents after inventory acknowledgement\n  telemetry resources-enable|resources-disable|resources-remove\n                     Manage Host OS and Caddy collection independently of Capsules\n  telemetry enable|disable <subname>\n                      Change a Hosted Capsule's Telemetry opt-out\n\nCapsule commands:\n  backup configure --file <policy.json>\n                      Configure encrypted backups and an optional Host timer\n  backup create|list|prune --subname <name>\n                      Manage encrypted SQLite and files snapshots\n  backup restore --subname <source> --id <full-id> --confirm <destination>\n                      Restore a stopped Capsule; optionally --to-subname <destination>\n  backup status       Report last successful backup age for each Capsule\n  bind <subname>      Bind this project to a Hosted Capsule\n  register <subname>  Register a Hosted Capsule\n  canonical set <subname> <alias>|clear <subname>\n                      Select the public origin; restart a running Capsule\n  push                Push and install a Hosted Capsule release\n  start <subname>     Start a Hosted Capsule\n  stop <subname>      Stop a Hosted Capsule\n  restart <subname>   Restart a Hosted Capsule\n  policy publish <file>|remove --host <alias> --subname <name>\n                      Publish or remove the recorded admission policy\n  reconcile <subname> Settle an interrupted deployment-file attempt\n  ssh [subname]       Inspect effective Hosted Capsule SSH access\n  stats [subname]     Print Host server or Hosted Capsule stats\n  logs [source]       Print Hosted Capsule logs\n  releases <subname>  List Hosted Capsule releases\n  rollback <subname> <release-id>\n                      Roll back to a previous release\n  rotate-key <subname>\n                      Rotate Hosted Capsule Sealed Server env keys\n  unregister <subname>\n                      Unregister a Hosted Capsule\n  delete <subname>    Delete Hosted Capsule storage\n\nOther commands:\n  list                List Hosted Capsules\n  github workflow write\n                      Write a GitHub Actions deploy workflow\n  invoke <action>     Invoke a low-level remote Host helper action\n\nOptions:\n  --host <alias>      Host profile alias\n  --profile <name>    Verified HTTPS Telemetry profile for connect or migrate\n  --query-credential-env <name>\n                      Ephemeral operator user:password for check or migrate\n  --server <target>   SSH target for host add\n  --domain <domain>   Hosted domain for host add\n  --canonical-domain <hostname>\n                      Public HTTPS link origin for register\n  --alias-domain <hostname>\n                      Custom HTTPS domain for register (repeatable)\n  --remote-root <path>\n                      Remote root path for host add\n  --tls <mode>        TLS mode: automatic or cloudflare-origin\n  --subname <name>    Hosted Capsule subname\n  --lines <n>, -n <n> Log line count\n  --allow-missing-env  Push despite missing required Server env keys\n  --restart           Restart after host push\n  --verify            Verify release health after host push\n  --fallback-to-previous-release\n                      Roll back when verified push fails\n  --branch <name>     GitHub workflow branch\n  --file <path>       GitHub workflow output path\n  --dry-run           Print workflow without writing it\n  --force             Overwrite workflow output when writing it\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades logs [tail] [options]\n\nPrint Dev session logs.\n\nCommands:\n  logs                Print recent Dev session logs\n  logs tail           Follow Dev session logs\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades db <command> [options]\n\nInspect the Dev session database.\n\nCommands:\n  list                List database tables\n  dump                Dump database contents\n  query <sql>         Run a read-only SQL query\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n";
+` | "Usage: sporades dev [status|stop|reset] [options]\n\nStart and manage a local Dev session.\n\nCommands:\n  dev                 Start a Dev session\n  dev status          Print Dev session status\n  dev stop            Stop the running Dev session\n  dev reset           Stop the Dev session and remove local Dev state\n\nOptions:\n  --port <number>     Dev session port when starting\n  --public            Allow non-localhost access when starting\n  --telemetry <name>  Export HTTP traces using a registered Telemetry profile\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades auth <command> [options]\n\nManage local auth configuration and identity simulation.\n\nCommands:\n  status              Print auth provider status\n  clients             List connected Dev session clients\n  set <provider>      Configure or disable anonymous, email, Google, Microsoft, Apple, or Facebook\n  as email            Simulate a local email identity\n\nOptions:\n  --client-id <id>        OAuth client/app ID (Apple Services ID)\n  --client-secret <secret> OAuth client/app secret\n  --client-json <path>    Read provider-specific credentials JSON\n  --tenant <tenant>       Microsoft tenant (default: common)\n  --team-id <id>          Apple Developer Team ID\n  --key-id <id>           Apple Sign in key ID\n  --private-key <pem>     Apple private key (stored only in Server env)\n  --graph-version <name>  Facebook Graph API version\n  --disable               Disable the selected provider without changing siblings\n  --email <address>       Simulated email identity\n  --display-name <name>   Simulated display name\n  --picture <url>         Simulated profile picture URL\n  --port <number>         Target Dev session port\n  --client <target>       Delivery target: current, all, or a client ID\n  --json                  Write JSON output\n  --help, -h              Show this help\n" | "Usage: sporades access-keys <command> [options]\n\nInspect and retire Access keys through a running Capsule.\n\nCommands:\n  list --user-id <id>       List one owner's Access-key metadata\n  inspect <key-id>          Inspect one Access key\n  revoke <key-id>           Revoke one Access key\n  revoke-all --user-id <id> Revoke one owner's current Access keys\n  delete <key-id>           Delete revoked Access-key history\n\nOptions:\n  --session <name>    Session: dev, container, or hosted (default: dev)\n  --host <alias>      Host profile alias for a Hosted Capsule\n  --subname <name>    Hosted Capsule subname\n  --cursor <cursor>   Opaque list cursor\n  --limit <n>         List page size from 1 through 100\n  --status <status>   List active, expired, or revoked keys\n  --yes               Explicitly approve a destructive operation\n  --json              Write structured JSON; does not imply consent\n  --help, -h          Show this help\n" | "Usage: sporades security [options]\n\nInspect effective Capsule security policy.\n\nOptions:\n  --session <name>    Session: dev, public-dev, container, or hosted\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades doctor [options]\n\nRun read-only Sporades diagnostics.\n\nOptions:\n  --session <name>    Session: dev, public-dev, container, or hosted\n  --host <alias>      Host profile alias for Hosted Capsule checks\n  --subname <name>    Hosted Capsule subname\n  --strict            Exit non-zero on warnings as well as failures\n  --json              Write structured JSON output\n  --help, -h          Show this help\n" | "Usage: sporades env <command> [options]\n\nManage Sealed Server env.\n\nCommands:\n  set <name>          Read one value from stdin and seal it\n  has <name>          Test whether a Server env key is defined\n  init                Create local Sealed Server env key material\n  import              Import Server env values from a file\n  status              Print Sealed Server env status\n  export              Export Sealed Server env for a Host profile\n  reencrypt           Re-encrypt local Sealed Server env material\n\nOptions:\n  --stdin             Read the value for env set from stdin\n  --file <path>       Input file for import or export\n  --host <alias>      Host profile alias\n  --subname <name>    Hosted Capsule subname\n  --output <path>     Export output path\n  --sealed            Treat input as an already sealed export\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades monitoring stack <init|validate|upgrade|rollback|backup|restore> [options]\n       sporades monitoring sender <issue|rotate|commit|cancel|revoke|export|status|legacy-revoke> [options]\n\nGenerate or inspect the versioned trace stack from an installed Sporades package.\nInitialization creates a reviewable directory; it does not start services.\nSender operations run locally on the Monitoring server; results contain no secrets.\nRotation stages a second generation; commit retires the old one after sender verification.\n\nOptions:\n  --dir <path>        Target stack directory (default: current directory)\n  --backup <path>     Protected cold snapshot directory (backup/restore)\n  --baseline <path>   Trusted prior release assets for a schema-3 upgrade\n  --sender <name>     Named sender for lifecycle operations (optional for status)\n  --host <identity>   Exact inventory Host scope (issue or legacy-revoke only)\n  --out <path>        New mode-0600 credential handoff file (export only)\n  --generation <n>    Verified pending generation to activate (commit only)\n  --ingest            Disable shared legacy ingestion (legacy-revoke only)\n  --json              Write { ok, data, error } JSON output\n  --help, -h          Show this help\n" | "Usage: sporades telemetry profile <add|list|show|remove> [name] [options]\n\nRegister and inspect operator-owned OTLP/HTTP Telemetry profiles. Descriptors store only\ncredential environment and private CA file references; they never store secret values.\nDev sessions use --telemetry <name> first, then sporades.json telemetry.profile, then no export.\n\nOptions for profile add:\n  --endpoint <url>        OTLP/HTTP base origin (HTTPS, or HTTP loopback with --loopback)\n  --dashboard <url>       Optional dashboard HTTPS URL\n  --credential-env <KEY>  Environment variable containing the ingestion bearer token\n  --inventory-credential-env <KEY>  Exact Host-scoped lifecycle inventory token\n  --inventory-host <id>   Stable inventory identity (default: first connected domain)\n  --metrics-interval-ms <N>  Metrics export period, 5000-300000 ms (default 15000)\n  --trace-propagation-origin <origin>  Approve exact fetch origin (repeatable, max 32)\n  --event-loop-delay-resolution-ms <N>  Delay timer precision, 10-1000 ms (default 20)\n  --ca-file <path>        Absolute private CA certificate path for verified TLS\n  --loopback              Permit a local HTTP collector for development\n  --json                  Write { ok, data, error } JSON output\n  --help, -h              Show this help\n" | "Usage: sporades deploy [status|stop|restart|reconcile|remove|reset|ssh] [options]\n\nStart and manage a local Container session.\n\nCommands:\n  deploy              Start a local Container session\n  deploy status       Print Container session status\n  deploy stop         Stop the running Container session\n  deploy restart      Restart the running Container session\n  deploy policy publish <file>|remove\n                      Publish or remove the declared admission policy\n  deploy reconcile    Settle an interrupted deployment-file attempt\n  deploy ssh          Inspect effective Container SSH access\n  deploy remove       Remove the Container session\n  deploy reset        Remove the Container session and local container state\n\nOptions:\n  --port <number>     Published local port when starting\n  --telemetry <name>  Export HTTP traces using a registered Telemetry profile\n  --no-telemetry      Disable export for this Container session\n  --force             Replace stale or conflicting container state when starting\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades host <command> [options]\n\nManage Host profiles and Hosted Capsules.\n\nProfile commands:\n  add <alias>         Add a Host profile\n  use <alias>         Set the default Host profile\n  current             Print the selected Host profile\n  bootstrap           Provision the remote Host server\n  upgrade             Copy the local Host helper to the Host server\n  health [subname]    Check Host server or Hosted Capsule health\n  services enable|disable|uninstall|status observability [--on <alias>]\n                      Manage pinned GlitchTip and Umami (opt-in)\n  services connect <subname> [--host <Capsule-host>] [--on <ops-host>]\n                      Seal configured error/analytics env; push to activate\n  services backup|backups observability [--on <alias>]\n                      Snapshot or list service databases using Host backup policy\n  services restore observability --id <snapshot> --confirm observability\n                      Restore disabled services; enable again after inspection\n  telemetry connect|migrate|reconcile|status|check\n  telemetry inventory-export|inventory-reconcile\n                      Manage the shared Host Telemetry relay\n  telemetry exports-disable|remove-agents\n                       Disable exports; remove agents after inventory acknowledgement\n  telemetry resources-enable|resources-disable|resources-remove\n                     Manage Host OS and Caddy collection independently of Capsules\n  telemetry enable|disable <subname>\n                      Change a Hosted Capsule's Telemetry opt-out\n\nCapsule commands:\n  backup configure --file <policy.json>\n                      Configure encrypted backups and an optional Host timer\n  backup create|list|prune --subname <name>\n                      Manage encrypted SQLite and files snapshots\n  backup restore --subname <source> --id <full-id> --confirm <destination>\n                      Restore a stopped Capsule; optionally --to-subname <destination>\n  backup status       Report last successful backup age for each Capsule\n  bind <subname>      Bind this project to a Hosted Capsule\n  db list|dump|query <sql> [--subname <name>]\n                      Read a running Hosted Capsule's database over SSH\n  register <subname>  Register a Hosted Capsule\n  canonical set <subname> <alias>|clear <subname>\n                      Select the public origin; restart a running Capsule\n  push                Push and install a Hosted Capsule release\n  start <subname>     Start a Hosted Capsule\n  stop <subname>      Stop a Hosted Capsule\n  restart <subname>   Restart a Hosted Capsule\n  policy publish <file>|remove --host <alias> --subname <name>\n                      Publish or remove the recorded admission policy\n  reconcile <subname> Settle an interrupted deployment-file attempt\n  ssh [subname]       Inspect effective Hosted Capsule SSH access\n  stats [subname]     Print Host server or Hosted Capsule stats\n  logs [source]       Print Hosted Capsule logs\n  releases <subname>  List Hosted Capsule releases\n  rollback <subname> <release-id>\n                      Roll back to a previous release\n  rotate-key <subname>\n                      Rotate Hosted Capsule Sealed Server env keys\n  unregister <subname>\n                      Unregister a Hosted Capsule\n  delete <subname>    Delete Hosted Capsule storage\n\nOther commands:\n  list                List Hosted Capsules\n  github workflow write\n                      Write a GitHub Actions deploy workflow\n  invoke <action>     Invoke a low-level remote Host helper action\n\nOptions:\n  --host <alias>      Host profile alias\n  --profile <name>    Verified HTTPS Telemetry profile for connect or migrate\n  --query-credential-env <name>\n                      Ephemeral operator user:password for check or migrate\n  --server <target>   SSH target for host add\n  --domain <domain>   Hosted domain for host add\n  --canonical-domain <hostname>\n                      Public HTTPS link origin for register\n  --alias-domain <hostname>\n                      Custom HTTPS domain for register (repeatable)\n  --remote-root <path>\n                      Remote root path for host add\n  --tls <mode>        TLS mode: automatic or cloudflare-origin\n  --subname <name>    Hosted Capsule subname\n  --lines <n>, -n <n> Log line count\n  --allow-missing-env  Push despite missing required Server env keys\n  --restart           Restart after host push\n  --verify            Verify release health after host push\n  --fallback-to-previous-release\n                      Roll back when verified push fails\n  --branch <name>     GitHub workflow branch\n  --file <path>       GitHub workflow output path\n  --dry-run           Print workflow without writing it\n  --force             Overwrite workflow output when writing it\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades logs [tail] [options]\n\nPrint Dev session logs.\n\nCommands:\n  logs                Print recent Dev session logs\n  logs tail           Follow Dev session logs\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n" | "Usage: sporades db <command> [options]\n\nInspect the Dev session database.\n\nCommands:\n  list                List database tables\n  dump                Dump database contents\n  query <sql>         Run a read-only SQL query\n\nOptions:\n  --port <number>     Target Dev session or local Container port\n  --json              Write JSON output\n  --help, -h          Show this help\n";
 export {};
 //# sourceMappingURL=cli-help.d.ts.map

package/dist/cli/cli-help.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../../src/cli/cli-help.ts"],"names":[],"mappings":"AAMA,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+VL,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,OAAO,SAAS,EAAE,SAAS,CAAC,CAAC;AAErE,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;s6aAE7C"}
+{"version":3,"file":"cli-help.d.ts","sourceRoot":"","sources":["../../src/cli/cli-help.ts"],"names":[],"mappings":"AAMA,QAAA,MAAM,SAAS;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAiWL,CAAC;AAEX,MAAM,MAAM,cAAc,GAAG,MAAM,IAAI,CAAC,OAAO,SAAS,EAAE,SAAS,CAAC,CAAC;AAErE,wBAAgB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM;;;;;;;;;;;;;;;8hbAE7C"}

package/dist/cli/cli-help.js

@@ -246,6 +246,8 @@ Capsule commands:
                       Restore a stopped Capsule; optionally --to-subname <destination>
   backup status       Report last successful backup age for each Capsule
   bind <subname>      Bind this project to a Hosted Capsule
+  db list|dump|query <sql> [--subname <name>]
+                      Read a running Hosted Capsule's database over SSH
   register <subname>  Register a Hosted Capsule
   canonical set <subname> <alias>|clear <subname>
                       Select the public origin; restart a running Capsule

package/dist/cli/cli-help.js.map

@@ -1 +1 @@
-{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../../src/cli/cli-help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnG,MAAM,aAAa,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AACnJ,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnH,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAElF,MAAM,SAAS,GAAG;IAChB,aAAa,EAAE;;;;;;;;;;;;;CAahB;IACC,MAAM,EAAE;;;;;;;;0CAQgC,aAAa;0CACb,aAAa;kCACrB,YAAY;;;;;CAK7C;IACC,GAAG,EAAE;;;;;;;;;;;;;;;;CAgBN;IACC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BP;IACC,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBhB;IACC,QAAQ,EAAE;;;;;;;;CAQX;IACC,MAAM,EAAE;;;;;;;;;;;CAWT;IACC,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBN;IACC,UAAU,EAAE;;;;;;;;;;;;;;;;;;;CAmBb;IACC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;CAmBZ;IACC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;CAuBT;IACC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA6FP;IACC,IAAI,EAAE;;;;;;;;;;;;CAYP;IACC,EAAE,EAAE;;;;;;;;;;;;;CAaL;IACC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;KAuBN;CACK,CAAC;AAIX,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,SAAS,CAAC,OAAyB,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC;AACnE,CAAC"}
+{"version":3,"file":"cli-help.js","sourceRoot":"","sources":["../../src/cli/cli-help.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,iBAAiB,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAEnG,MAAM,aAAa,GAAG,CAAC,GAAG,iBAAiB,CAAC,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,SAAS,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AACnJ,MAAM,aAAa,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,SAAS,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;AACnH,MAAM,YAAY,GAAG,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,OAAO,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC;AAElF,MAAM,SAAS,GAAG;IAChB,aAAa,EAAE;;;;;;;;;;;;;CAahB;IACC,MAAM,EAAE;;;;;;;;0CAQgC,aAAa;0CACb,aAAa;kCACrB,YAAY;;;;;CAK7C;IACC,GAAG,EAAE;;;;;;;;;;;;;;;;CAgBN;IACC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2BP;IACC,aAAa,EAAE;;;;;;;;;;;;;;;;;;;;;CAqBhB;IACC,QAAQ,EAAE;;;;;;;;CAQX;IACC,MAAM,EAAE;;;;;;;;;;;CAWT;IACC,GAAG,EAAE;;;;;;;;;;;;;;;;;;;;;;CAsBN;IACC,UAAU,EAAE;;;;;;;;;;;;;;;;;;;CAmBb;IACC,SAAS,EAAE;;;;;;;;;;;;;;;;;;;CAmBZ;IACC,MAAM,EAAE;;;;;;;;;;;;;;;;;;;;;;;CAuBT;IACC,IAAI,EAAE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+FP;IACC,IAAI,EAAE;;;;;;;;;;;;CAYP;IACC,EAAE,EAAE;;;;;;;;;;;;;CAaL;IACC,OAAO,EAAE;;;;;;;;;;;;;;;;;;;;;;;KAuBN;CACK,CAAC;AAIX,MAAM,UAAU,aAAa,CAAC,OAAgB;IAC5C,OAAO,SAAS,CAAC,OAAyB,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC;AACnE,CAAC"}

package/dist/cli/cli-version.d.ts

@@ -1,2 +1,2 @@
-export declare const CLI_VERSION = "0.9.38";
+export declare const CLI_VERSION = "0.9.40";
 //# sourceMappingURL=cli-version.d.ts.map

package/dist/cli/cli-version.js

@@ -1,3 +1,3 @@
 // Generated by `npm run build` from package.json. Do not edit by hand.
-export const CLI_VERSION = "0.9.38";
+export const CLI_VERSION = "0.9.40";
 //# sourceMappingURL=cli-version.js.map

package/dist/cli/database-inspection-envelope.d.ts

@@ -0,0 +1,9 @@
+type LooseRecord = Record<string, any>;
+export declare const DATABASE_INSPECTION_ACTIONS: readonly ["db.list", "db.dump", "db.query"];
+export type DatabaseInspectionAction = (typeof DATABASE_INSPECTION_ACTIONS)[number];
+export declare function encodeDatabaseInspectionInput(sql: string): string | null;
+export declare const DATABASE_INSPECTION_MAX_BUFFER: number;
+export declare function isDatabaseInspectionAction(action: unknown): action is DatabaseInspectionAction;
+export declare function sanitizeDatabaseInspectionEnvelope(action: DatabaseInspectionAction, envelope: LooseRecord, invalid: () => never): LooseRecord;
+export {};
+//# sourceMappingURL=database-inspection-envelope.d.ts.map

package/dist/cli/database-inspection-envelope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-inspection-envelope.d.ts","sourceRoot":"","sources":["../../src/cli/database-inspection-envelope.ts"],"names":[],"mappings":"AAIA,KAAK,WAAW,GAAG,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEvC,eAAO,MAAM,2BAA2B,6CAA8C,CAAC;AACvF,MAAM,MAAM,wBAAwB,GAAG,CAAC,OAAO,2BAA2B,CAAC,CAAC,MAAM,CAAC,CAAC;AAOpF,wBAAgB,6BAA6B,CAAC,GAAG,EAAE,MAAM,iBAGxD;AAID,eAAO,MAAM,8BAA8B,QAAoB,CAAC;AAEhE,wBAAgB,0BAA0B,CAAC,MAAM,EAAE,OAAO,GAAG,MAAM,IAAI,wBAAwB,CAE9F;AAED,wBAAgB,kCAAkC,CAAC,MAAM,EAAE,wBAAwB,EAAE,QAAQ,EAAE,WAAW,EAAE,OAAO,EAAE,MAAM,KAAK,GAAG,WAAW,CAqB7I"}

package/dist/cli/database-inspection-envelope.js

@@ -0,0 +1,38 @@
+export const DATABASE_INSPECTION_ACTIONS = ["db.list", "db.dump", "db.query"];
+// The Bundle refuses `--sporades-action-input` over 24 KiB of base64url, so SQL whose encoded
+// input is larger could not reach the read-only gate in one piece. Measuring the encoded form, not
+// the raw SQL, keeps heavily escaped SQL from passing here and failing as malformed input there.
+const DATABASE_INSPECTION_INPUT_BYTE_LIMIT = 24 * 1024;
+export function encodeDatabaseInspectionInput(sql) {
+    const encoded = Buffer.from(JSON.stringify({ sql }), "utf8").toString("base64url");
+    return encoded.length <= DATABASE_INSPECTION_INPUT_BYTE_LIMIT ? encoded : null;
+}
+// A dump answers with every inspectable row, so its frame is bounded by the Capsule's data rather
+// than by Sporades. This is the ceiling on what one SSH or `docker exec` hop will buffer.
+export const DATABASE_INSPECTION_MAX_BUFFER = 128 * 1024 * 1024;
+export function isDatabaseInspectionAction(action) {
+    return DATABASE_INSPECTION_ACTIONS.includes(action);
+}
+export function sanitizeDatabaseInspectionEnvelope(action, envelope, invalid) {
+    const data = envelope?.data;
+    if (envelope?.ok === true && data && typeof data === "object" && !Array.isArray(data)) {
+        if (action === "db.query" && Array.isArray(data.columns) && Array.isArray(data.rows)) {
+            return { ok: true, data: { columns: data.columns, rows: data.rows }, error: null };
+        }
+        if (action !== "db.query" && Array.isArray(data.tables)) {
+            return { ok: true, data: { tables: data.tables }, error: null };
+        }
+    }
+    if (envelope?.ok === false && typeof envelope.error?.message === "string") {
+        return {
+            ok: false,
+            data: null,
+            error: {
+                message: envelope.error.message,
+                hint: typeof envelope.error.hint === "string" ? envelope.error.hint : "Check the SQL and retry the command.",
+            },
+        };
+    }
+    return invalid();
+}
+//# sourceMappingURL=database-inspection-envelope.js.map

package/dist/cli/database-inspection-envelope.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"database-inspection-envelope.js","sourceRoot":"","sources":["../../src/cli/database-inspection-envelope.ts"],"names":[],"mappings":"AAMA,MAAM,CAAC,MAAM,2BAA2B,GAAG,CAAC,SAAS,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAGvF,8FAA8F;AAC9F,mGAAmG;AACnG,iGAAiG;AACjG,MAAM,oCAAoC,GAAG,EAAE,GAAG,IAAI,CAAC;AAEvD,MAAM,UAAU,6BAA6B,CAAC,GAAW;IACvD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,EAAE,MAAM,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,CAAC;IACnF,OAAO,OAAO,CAAC,MAAM,IAAI,oCAAoC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AACjF,CAAC;AAED,kGAAkG;AAClG,0FAA0F;AAC1F,MAAM,CAAC,MAAM,8BAA8B,GAAG,GAAG,GAAG,IAAI,GAAG,IAAI,CAAC;AAEhE,MAAM,UAAU,0BAA0B,CAAC,MAAe;IACxD,OAAQ,2BAAkD,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;AAC9E,CAAC;AAED,MAAM,UAAU,kCAAkC,CAAC,MAAgC,EAAE,QAAqB,EAAE,OAAoB;IAC9H,MAAM,IAAI,GAAG,QAAQ,EAAE,IAAI,CAAC;IAC5B,IAAI,QAAQ,EAAE,EAAE,KAAK,IAAI,IAAI,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC;QACtF,IAAI,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrF,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACrF,CAAC;QACD,IAAI,MAAM,KAAK,UAAU,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;YACxD,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QAClE,CAAC;IACH,CAAC;IACD,IAAI,QAAQ,EAAE,EAAE,KAAK,KAAK,IAAI,OAAO,QAAQ,CAAC,KAAK,EAAE,OAAO,KAAK,QAAQ,EAAE,CAAC;QAC1E,OAAO;YACL,EAAE,EAAE,KAAK;YACT,IAAI,EAAE,IAAI;YACV,KAAK,EAAE;gBACL,OAAO,EAAE,QAAQ,CAAC,KAAK,CAAC,OAAO;gBAC/B,IAAI,EAAE,OAAO,QAAQ,CAAC,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,sCAAsC;aAC7G;SACF,CAAC;IACJ,CAAC;IACD,OAAO,OAAO,EAAE,CAAC;AACnB,CAAC"}