wicked-crew 0.7.46 → 0.7.48

package/dist/decisions/types.js

@@ -0,0 +1,19 @@
+/**
+ * Decision capture — the ledger's shapes (DES-decision-capture §4.2.1, DC-S4a).
+ *
+ * The ledger is the ONLY source of ORIGIN: the operator's verbatim words, who typed them (a human
+ * actor — an agent's words are never recorded), and the auth mode that decides auto eligibility.
+ * One append-only JSONL file per project; a line is a `record` or an `outcome`, and a read folds
+ * them into a {@link DecisionView} (api-types 0.80.0).
+ */
+/**
+ * Resolve the switch. Default `ledger`: record and label, no chips and no auto — the live-precision
+ * mode §8 runs before `on` (the corpus gate). An unknown value is `ledger`, never `on`.
+ */
+export function resolveDecisionsMode(env = process.env) {
+    const raw = (env['WICKED_DECISIONS'] ?? '').trim().toLowerCase();
+    if (raw === 'off' || raw === 'on' || raw === 'ledger')
+        return raw;
+    return 'ledger';
+}
+//# sourceMappingURL=types.js.map

package/dist/decisions/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../src/decisions/types.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAuGH;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAyB,OAAO,CAAC,GAAG;IACvE,MAAM,GAAG,GAAG,CAAC,GAAG,CAAC,kBAAkB,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IACjE,IAAI,GAAG,KAAK,KAAK,IAAI,GAAG,KAAK,IAAI,IAAI,GAAG,KAAK,QAAQ;QAAE,OAAO,GAAG,CAAC;IAClE,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/editors/csp.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The two Content-Security-Policies of the editor plugin contract (DES-artifact-editor-plugins §8.2,
+ * EP-C1). Spelled once, pinned by test — a header is only as good as its exact text.
+ *
+ *  - {@link bundleHeaders}: on the bundle response. `sandbox allow-scripts` sandboxes the bundle even
+ *    when opened top-level; `default-src 'none'` + `connect-src 'none'` is the line that protects the
+ *    local no-auth daemon (no fetch, XHR, WebSocket, EventSource or beacon); `form-action 'none'`,
+ *    `base-uri 'none'`, no workers, no manifest. `script-src 'unsafe-inline'` is acceptable only
+ *    because the bundle is ONE hashed file and nothing else can load. An editor holding
+ *    `network.media` (first-party `wicked-page`: agent-authored pages use web images) gets
+ *    `img-src … https:` and `font-src … https:` — a GET-only channel, never `connect-src`.
+ *    `navigate-to` / `prefetch-src` are deliberately absent: no browser enforces them (review B1).
+ *  - {@link shellCsp}: on studio's own shell document. A sandboxed frame may navigate ITSELF, and
+ *    once it does the bundle's policy is gone — so the shell limits what any frame may point at:
+ *    crew's own editors route, crew's interactive proxy (today's Document mode), `blob:` and
+ *    `data:`. The origin is written per response because a path cannot follow `'self'`.
+ */
+import type { EditorRecord } from './registry.js';
+export declare const BUNDLE_CSP_BASE: string;
+/** Exactly the §8.2 header set for one editor's bundle. */
+export declare function bundleHeaders(record: Pick<EditorRecord, 'manifest' | 'firstParty'>): Record<string, string>;
+/** The shell's `frame-src` policy for the request's own origin (`scheme://host[:port]`). */
+export declare function shellCsp(origin: string): string;
+/** `scheme://host` of a request, from what the client sent (a hosted skin may sit behind a proxy). */
+export declare function requestOrigin(req: {
+    protocol?: string | undefined;
+    headers: {
+        host?: string | undefined;
+    };
+}): string;
+//# sourceMappingURL=csp.d.ts.map

package/dist/editors/csp.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.d.ts","sourceRoot":"","sources":["../../src/editors/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAElD,eAAO,MAAM,eAAe,QAIc,CAAC;AAE3C,2DAA2D;AAC3D,wBAAgB,aAAa,CAAC,MAAM,EAAE,IAAI,CAAC,YAAY,EAAE,UAAU,GAAG,YAAY,CAAC,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAY3G;AAED,4FAA4F;AAC5F,wBAAgB,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAE/C;AAED,sGAAsG;AACtG,wBAAgB,aAAa,CAAC,GAAG,EAAE;IAAE,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAAC,OAAO,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAA;KAAE,CAAA;CAAE,GAAG,MAAM,CAIpH"}

package/dist/editors/csp.js

@@ -0,0 +1,46 @@
+/**
+ * The two Content-Security-Policies of the editor plugin contract (DES-artifact-editor-plugins §8.2,
+ * EP-C1). Spelled once, pinned by test — a header is only as good as its exact text.
+ *
+ *  - {@link bundleHeaders}: on the bundle response. `sandbox allow-scripts` sandboxes the bundle even
+ *    when opened top-level; `default-src 'none'` + `connect-src 'none'` is the line that protects the
+ *    local no-auth daemon (no fetch, XHR, WebSocket, EventSource or beacon); `form-action 'none'`,
+ *    `base-uri 'none'`, no workers, no manifest. `script-src 'unsafe-inline'` is acceptable only
+ *    because the bundle is ONE hashed file and nothing else can load. An editor holding
+ *    `network.media` (first-party `wicked-page`: agent-authored pages use web images) gets
+ *    `img-src … https:` and `font-src … https:` — a GET-only channel, never `connect-src`.
+ *    `navigate-to` / `prefetch-src` are deliberately absent: no browser enforces them (review B1).
+ *  - {@link shellCsp}: on studio's own shell document. A sandboxed frame may navigate ITSELF, and
+ *    once it does the bundle's policy is gone — so the shell limits what any frame may point at:
+ *    crew's own editors route, crew's interactive proxy (today's Document mode), `blob:` and
+ *    `data:`. The origin is written per response because a path cannot follow `'self'`.
+ */
+export const BUNDLE_CSP_BASE = "sandbox allow-scripts; default-src 'none'; script-src 'unsafe-inline'; style-src 'unsafe-inline'; " +
+    "img-src data: blob:{MEDIA}; media-src blob:; font-src data:{MEDIA}; frame-src blob: data: about:; " +
+    "child-src blob: data: about:; connect-src 'none'; form-action 'none'; base-uri 'none'; " +
+    "worker-src 'none'; manifest-src 'none'";
+/** Exactly the §8.2 header set for one editor's bundle. */
+export function bundleHeaders(record) {
+    // `network.media` widens only for a first-party editor: a third-party one would have to ASK
+    // (§6.1), and no third-party editor can be installed before EP-C8.
+    const media = record.firstParty && record.manifest.permissions.some((p) => p.id === 'network.media') ? ' https:' : '';
+    return {
+        'Content-Security-Policy': BUNDLE_CSP_BASE.replaceAll('{MEDIA}', media),
+        'Cross-Origin-Resource-Policy': 'same-origin',
+        'X-Content-Type-Options': 'nosniff',
+        'X-DNS-Prefetch-Control': 'off',
+        'Referrer-Policy': 'no-referrer',
+        'Cache-Control': 'no-store',
+    };
+}
+/** The shell's `frame-src` policy for the request's own origin (`scheme://host[:port]`). */
+export function shellCsp(origin) {
+    return `frame-src ${origin}/api/v1/editors/ ${origin}/api/v1/projects/ blob: data:`;
+}
+/** `scheme://host` of a request, from what the client sent (a hosted skin may sit behind a proxy). */
+export function requestOrigin(req) {
+    const proto = req.protocol === 'https' ? 'https' : 'http';
+    const host = typeof req.headers.host === 'string' && req.headers.host !== '' ? req.headers.host : 'localhost';
+    return `${proto}://${host}`;
+}
+//# sourceMappingURL=csp.js.map

package/dist/editors/csp.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csp.js","sourceRoot":"","sources":["../../src/editors/csp.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAIH,MAAM,CAAC,MAAM,eAAe,GAC1B,oGAAoG;IACpG,oGAAoG;IACpG,yFAAyF;IACzF,wCAAwC,CAAC;AAE3C,2DAA2D;AAC3D,MAAM,UAAU,aAAa,CAAC,MAAqD;IACjF,4FAA4F;IAC5F,mEAAmE;IACnE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAU,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,eAAe,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC;IACtH,OAAO;QACL,yBAAyB,EAAE,eAAe,CAAC,UAAU,CAAC,SAAS,EAAE,KAAK,CAAC;QACvE,8BAA8B,EAAE,aAAa;QAC7C,wBAAwB,EAAE,SAAS;QACnC,wBAAwB,EAAE,KAAK;QAC/B,iBAAiB,EAAE,aAAa;QAChC,eAAe,EAAE,UAAU;KAC5B,CAAC;AACJ,CAAC;AAED,4FAA4F;AAC5F,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,OAAO,aAAa,MAAM,oBAAoB,MAAM,+BAA+B,CAAC;AACtF,CAAC;AAED,sGAAsG;AACtG,MAAM,UAAU,aAAa,CAAC,GAA8E;IAC1G,MAAM,KAAK,GAAG,GAAG,CAAC,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC;IAC1D,MAAM,IAAI,GAAG,OAAO,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,QAAQ,IAAI,GAAG,CAAC,OAAO,CAAC,IAAI,KAAK,EAAE,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,WAAW,CAAC;IAC9G,OAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC9B,CAAC"}

package/dist/editors/pack-install.d.ts

@@ -0,0 +1,28 @@
+/**
+ * A pack install, as far as it goes before EP-C8 (DES-artifact-editor-plugins §5.2, §9.2; EP-C1).
+ *
+ * Install is human-only (§6.4) and runs garden's fail-closed gate FIRST: `pack check --json` on the
+ * pack root (schema, every editor's entry inside the pack, its hash, its size, nothing loaded from
+ * outside). Then crew reads the spec-2 manifest and lists what the operator would be asked to
+ * approve — the editors, the blocks and the pack's skills (§3.2 "Add these") — and REFUSES with 501
+ * `third_party_editors_not_available`: an unverified editor must pass the install-time conformance
+ * run (cases 1-12 against the bundle, headless Chrome) before it may be installed, and that run is
+ * EP-C8. Nothing is written. The refusal carries the check verdict and the approval list, so the
+ * operator sees exactly what will be asked once installs open.
+ */
+import type { InstallEditorRefusal, PackCheckResult } from '../core/types.js';
+export type PackCheckRunner = (packRoot: string) => Promise<PackCheckResult>;
+/**
+ * Garden's gate, run as a child: `python3 <garden>/scripts/pack/check.py <pack> --json --garden-root <garden>`
+ * (`python` when `python3` is not on PATH). A missing garden or an unparseable verdict is a FAILED
+ * check with the reason — never a pass.
+ */
+export declare function gardenPackCheck(gardenRoot: string | null): PackCheckRunner;
+export declare class PackInstallError extends Error {
+    readonly status: 400 | 404 | 422;
+    readonly check?: PackCheckResult | undefined;
+    constructor(status: 400 | 404 | 422, message: string, check?: PackCheckResult | undefined);
+}
+/** What `POST /editors` reads of a pack before refusing: the approval list (§3.2). */
+export declare function previewPackInstall(packRootRaw: string, check: PackCheckRunner): Promise<InstallEditorRefusal>;
+//# sourceMappingURL=pack-install.d.ts.map

package/dist/editors/pack-install.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-install.d.ts","sourceRoot":"","sources":["../../src/editors/pack-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAKH,OAAO,KAAK,EAAE,oBAAoB,EAAE,eAAe,EAAE,MAAM,kBAAkB,CAAC;AAG9E,MAAM,MAAM,eAAe,GAAG,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC,eAAe,CAAC,CAAC;AAiB7E;;;;GAIG;AACH,wBAAgB,eAAe,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,GAAG,eAAe,CAiC1E;AAED,qBAAa,gBAAiB,SAAQ,KAAK;IAEvC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG;IAEhC,QAAQ,CAAC,KAAK,CAAC,EAAE,eAAe;gBAFvB,MAAM,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,EAChC,OAAO,EAAE,MAAM,EACN,KAAK,CAAC,EAAE,eAAe,YAAA;CAKnC;AAED,sFAAsF;AACtF,wBAAsB,kBAAkB,CAAC,WAAW,EAAE,MAAM,EAAE,KAAK,EAAE,eAAe,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAgEnH"}

package/dist/editors/pack-install.js

@@ -0,0 +1,153 @@
+/**
+ * A pack install, as far as it goes before EP-C8 (DES-artifact-editor-plugins §5.2, §9.2; EP-C1).
+ *
+ * Install is human-only (§6.4) and runs garden's fail-closed gate FIRST: `pack check --json` on the
+ * pack root (schema, every editor's entry inside the pack, its hash, its size, nothing loaded from
+ * outside). Then crew reads the spec-2 manifest and lists what the operator would be asked to
+ * approve — the editors, the blocks and the pack's skills (§3.2 "Add these") — and REFUSES with 501
+ * `third_party_editors_not_available`: an unverified editor must pass the install-time conformance
+ * run (cases 1-12 against the bundle, headless Chrome) before it may be installed, and that run is
+ * EP-C8. Nothing is written. The refusal carries the check verdict and the approval list, so the
+ * operator sees exactly what will be asked once installs open.
+ */
+import { existsSync, readdirSync, readFileSync, statSync } from 'node:fs';
+import { isAbsolute, join, resolve } from 'node:path';
+import { execCapped } from '../core/exec.js';
+/** The verdict shape garden's `scripts/pack/check.py --json` prints. */
+function parseCheckOutput(stdout) {
+    try {
+        const raw = JSON.parse(stdout);
+        if (typeof raw !== 'object' || raw === null || typeof raw.ok !== 'boolean')
+            return null;
+        const findings = (list) => Array.isArray(list)
+            ? list.flatMap((f) => (typeof f === 'object' && f !== null ? [f] : []))
+            : [];
+        return { ok: raw.ok, errors: findings(raw.errors), warnings: findings(raw.warnings) };
+    }
+    catch {
+        return null;
+    }
+}
+/**
+ * Garden's gate, run as a child: `python3 <garden>/scripts/pack/check.py <pack> --json --garden-root <garden>`
+ * (`python` when `python3` is not on PATH). A missing garden or an unparseable verdict is a FAILED
+ * check with the reason — never a pass.
+ */
+export function gardenPackCheck(gardenRoot) {
+    return async (packRoot) => {
+        if (gardenRoot === null) {
+            return { ok: false, errors: [{ level: 'error', code: 'garden-missing', message: 'no wicked-garden plugin found to run `pack check`' }], warnings: [] };
+        }
+        const script = join(gardenRoot, 'scripts', 'pack', 'check.py');
+        if (!existsSync(script)) {
+            return { ok: false, errors: [{ level: 'error', code: 'garden-too-old', message: `this wicked-garden has no scripts/pack/check.py (needs >= 12.40.0)` }], warnings: [] };
+        }
+        const args = [script, packRoot, '--json', '--garden-root', gardenRoot];
+        let stdout = '';
+        for (const bin of ['python3', 'python']) {
+            try {
+                const out = await execCapped(bin, args, { timeout: 60_000, windowsHide: true });
+                stdout = out.stdout;
+                break;
+            }
+            catch (err) {
+                const e = err;
+                if (e.code === 'ENOENT')
+                    continue; // no such interpreter: try the next spelling
+                // A failing check exits 1 with the JSON verdict on stdout.
+                if (typeof e.stdout === 'string' && e.stdout.trim() !== '') {
+                    stdout = e.stdout;
+                    break;
+                }
+                return { ok: false, errors: [{ level: 'error', code: 'check-failed', message: `pack check did not run: ${e.message}` }], warnings: [] };
+            }
+        }
+        const parsed = parseCheckOutput(stdout);
+        if (parsed === null) {
+            return { ok: false, errors: [{ level: 'error', code: 'check-unreadable', message: stdout === '' ? 'no python interpreter found (python3 / python)' : 'pack check printed no readable verdict' }], warnings: [] };
+        }
+        return parsed;
+    };
+}
+export class PackInstallError extends Error {
+    status;
+    check;
+    constructor(status, message, check) {
+        super(message);
+        this.status = status;
+        this.check = check;
+        this.name = 'PackInstallError';
+    }
+}
+/** What `POST /editors` reads of a pack before refusing: the approval list (§3.2). */
+export async function previewPackInstall(packRootRaw, check) {
+    if (typeof packRootRaw !== 'string' || packRootRaw.trim() === '' || !isAbsolute(packRootRaw)) {
+        throw new PackInstallError(400, '`packRoot` must be an absolute path to a directory holding wicked-pack.json');
+    }
+    const packRoot = resolve(packRootRaw);
+    let isDir = false;
+    try {
+        isDir = statSync(packRoot).isDirectory();
+    }
+    catch {
+        isDir = false;
+    }
+    if (!isDir)
+        throw new PackInstallError(404, `no directory at ${packRoot}`);
+    const manifestPath = join(packRoot, 'wicked-pack.json');
+    if (!existsSync(manifestPath))
+        throw new PackInstallError(400, `${packRoot} holds no wicked-pack.json`);
+    // Garden's gate first (fail closed): a refused manifest never gets as far as a listing.
+    const verdict = await check(packRoot);
+    if (!verdict.ok) {
+        throw new PackInstallError(422, `wicked-garden pack check refused the pack (${verdict.errors.length} error${verdict.errors.length === 1 ? '' : 's'})`, verdict);
+    }
+    let manifest;
+    try {
+        manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+    }
+    catch (err) {
+        throw new PackInstallError(400, `wicked-pack.json is not JSON: ${err instanceof Error ? err.message : String(err)}`);
+    }
+    const editors = Array.isArray(manifest['editors']) ? manifest['editors'] : [];
+    if (manifest['spec'] !== 2 || editors.length === 0) {
+        throw new PackInstallError(400, 'the pack declares no editors (spec 2 `editors[]`); there is nothing to install here');
+    }
+    const blocks = Array.isArray(manifest['blocks']) ? manifest['blocks'] : [];
+    const skillsDir = typeof manifest['skills_dir'] === 'string' ? manifest['skills_dir'] : 'skills';
+    let skills = [];
+    try {
+        const dir = join(packRoot, skillsDir);
+        if (statSync(dir).isDirectory())
+            skills = readdirSync(dir).filter((n) => !n.startsWith('.')).sort();
+    }
+    catch {
+        skills = [];
+    }
+    const str = (v) => (typeof v === 'string' ? v : '');
+    const strs = (v) => (Array.isArray(v) ? v.filter((x) => typeof x === 'string') : []);
+    return {
+        code: 'third_party_editors_not_available',
+        error: 'third-party editors cannot be installed yet: the install-time conformance run (DES-artifact-editor-plugins EP-C8) ' +
+            'has not shipped, and an unverified editor is never installed. The pack passed wicked-garden `pack check`; ' +
+            'this is what the install would ask you to approve.',
+        check: verdict,
+        pack: {
+            name: str(manifest['name']),
+            vendor: str(manifest['vendor']),
+            version: str(manifest['version']),
+            editors: editors.map((e) => ({
+                id: str(e['id']),
+                title: str(e['title']),
+                version: str(e['version']),
+                kinds: strs(e['kinds']),
+                permissions: Array.isArray(e['permissions'])
+                    ? e['permissions'].map((p) => ({ id: str(p['id']), why: str(p['why']) }))
+                    : [],
+            })),
+            blocks: blocks.map((b) => ({ id: str(b['id']), label: str(b['label']), produces_kind: str(b['produces_kind']), skills: strs(b['skills']) })),
+            skills,
+        },
+    };
+}
+//# sourceMappingURL=pack-install.js.map

package/dist/editors/pack-install.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"pack-install.js","sourceRoot":"","sources":["../../src/editors/pack-install.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AAEH,OAAO,EAAE,UAAU,EAAE,WAAW,EAAE,YAAY,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAC1E,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AAGtD,OAAO,EAAE,UAAU,EAAE,MAAM,iBAAiB,CAAC;AAI7C,wEAAwE;AACxE,SAAS,gBAAgB,CAAC,MAAc;IACtC,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAA6B,CAAC;QAC3D,IAAI,OAAO,GAAG,KAAK,QAAQ,IAAI,GAAG,KAAK,IAAI,IAAI,OAAO,GAAG,CAAC,EAAE,KAAK,SAAS;YAAE,OAAO,IAAI,CAAC;QACxF,MAAM,QAAQ,GAAG,CAAC,IAAa,EAA6B,EAAE,CAC5D,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC;YACjB,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,CAAC,CAAC,CAAC,CAAsC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5G,CAAC,CAAC,EAAE,CAAC;QACT,OAAO,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,QAAQ,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,CAAC;IACxF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAAC,UAAyB;IACvD,OAAO,KAAK,EAAE,QAAQ,EAAE,EAAE;QACxB,IAAI,UAAU,KAAK,IAAI,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,mDAAmD,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACzJ,CAAC;QACD,MAAM,MAAM,GAAG,IAAI,CAAC,UAAU,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;QAC/D,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC;YACxB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,gBAAgB,EAAE,OAAO,EAAE,oEAAoE,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QAC1K,CAAC;QACD,MAAM,IAAI,GAAG,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,eAAe,EAAE,UAAU,CAAC,CAAC;QACvE,IAAI,MAAM,GAAG,EAAE,CAAC;QAChB,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,CAAC;YACxC,IAAI,CAAC;gBACH,MAAM,GAAG,GAAG,MAAM,UAAU,CAAC,GAAG,EAAE,IAAI,EAAE,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC,CAAC;gBAChF,MAAM,GAAG,GAAG,CAAC,MAAM,CAAC;gBACpB,MAAM;YACR,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,MAAM,CAAC,GAAG,GAA0E,CAAC;gBACrF,IAAI,CAAC,CAAC,IAAI,KAAK,QAAQ;oBAAE,SAAS,CAAC,6CAA6C;gBAChF,2DAA2D;gBAC3D,IAAI,OAAO,CAAC,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;oBAC3D,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC;oBAClB,MAAM;gBACR,CAAC;gBACD,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,cAAc,EAAE,OAAO,EAAE,2BAA2B,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;YAC1I,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI,EAAE,CAAC;YACpB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,EAAE,kBAAkB,EAAE,OAAO,EAAE,MAAM,KAAK,EAAE,CAAC,CAAC,CAAC,gDAAgD,CAAC,CAAC,CAAC,wCAAwC,EAAE,CAAC,EAAE,QAAQ,EAAE,EAAE,EAAE,CAAC;QACnN,CAAC;QACD,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;AACJ,CAAC;AAED,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IAE9B;IAEA;IAHX,YACW,MAAuB,EAChC,OAAe,EACN,KAAuB;QAEhC,KAAK,CAAC,OAAO,CAAC,CAAC;QAJN,WAAM,GAAN,MAAM,CAAiB;QAEvB,UAAK,GAAL,KAAK,CAAkB;QAGhC,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;IACjC,CAAC;CACF;AAED,sFAAsF;AACtF,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,WAAmB,EAAE,KAAsB;IAClF,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,KAAK,EAAE,IAAI,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;QAC7F,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,6EAA6E,CAAC,CAAC;IACjH,CAAC;IACD,MAAM,QAAQ,GAAG,OAAO,CAAC,WAAW,CAAC,CAAC;IACtC,IAAI,KAAK,GAAG,KAAK,CAAC;IAClB,IAAI,CAAC;QACH,KAAK,GAAG,QAAQ,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC;IAC3C,CAAC;IAAC,MAAM,CAAC;QACP,KAAK,GAAG,KAAK,CAAC;IAChB,CAAC;IACD,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,mBAAmB,QAAQ,EAAE,CAAC,CAAC;IAC3E,MAAM,YAAY,GAAG,IAAI,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC;IACxD,IAAI,CAAC,UAAU,CAAC,YAAY,CAAC;QAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,GAAG,QAAQ,4BAA4B,CAAC,CAAC;IACxG,wFAAwF;IACxF,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,QAAQ,CAAC,CAAC;IACtC,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,CAAC;QAChB,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,8CAA8C,OAAO,CAAC,MAAM,CAAC,MAAM,SAAS,OAAO,CAAC,MAAM,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,GAAG,GAAG,EAAE,OAAO,CAAC,CAAC;IAClK,CAAC;IACD,IAAI,QAAiC,CAAC;IACtC,IAAI,CAAC;QACH,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,YAAY,EAAE,MAAM,CAAC,CAA4B,CAAC;IACvF,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,iCAAiC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;IACvH,CAAC;IACD,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,SAAS,CAAoC,CAAC,CAAC,CAAC,EAAE,CAAC;IAClH,IAAI,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACnD,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,qFAAqF,CAAC,CAAC;IACzH,CAAC;IACD,MAAM,MAAM,GAAG,KAAK,CAAC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAE,QAAQ,CAAC,QAAQ,CAAoC,CAAC,CAAC,CAAC,EAAE,CAAC;IAC/G,MAAM,SAAS,GAAG,OAAO,QAAQ,CAAC,YAAY,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;IACjG,IAAI,MAAM,GAAa,EAAE,CAAC;IAC1B,IAAI,CAAC;QACH,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC;QACtC,IAAI,QAAQ,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE;YAAE,MAAM,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;IACtG,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,GAAG,EAAE,CAAC;IACd,CAAC;IACD,MAAM,GAAG,GAAG,CAAC,CAAU,EAAU,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrE,MAAM,IAAI,GAAG,CAAC,CAAU,EAAY,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC;IACrH,OAAO;QACL,IAAI,EAAE,mCAAmC;QACzC,KAAK,EACH,oHAAoH;YACpH,4GAA4G;YAC5G,oDAAoD;QACtD,KAAK,EAAE,OAAO;QACd,IAAI,EAAE;YACJ,IAAI,EAAE,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;YAC3B,MAAM,EAAE,GAAG,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;YAC/B,OAAO,EAAE,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,CAAC;YACjC,OAAO,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;gBAC3B,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;gBAChB,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACtB,OAAO,EAAE,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;gBAC1B,KAAK,EAAE,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC;gBACvB,WAAW,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC;oBAC1C,CAAC,CAAE,CAAC,CAAC,aAAa,CAAoC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,GAAG,EAAE,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;oBAC7G,CAAC,CAAC,EAAE;aACP,CAAC,CAAC;YACH,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,EAAE,KAAK,EAAE,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,EAAE,aAAa,EAAE,GAAG,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC,CAAC;YAC5I,MAAM;SACP;KACF,CAAC;AACJ,CAAC"}

package/dist/editors/registry.d.ts

@@ -0,0 +1,142 @@
+/**
+ * The artifact-editor registry (DES-artifact-editor-plugins §5.2, §8.6, §9.1; EP-C1).
+ *
+ * Two kinds of editor exist in the design; one exists today:
+ *
+ *  - **First-party** editors ship INSIDE studio's bundle (§8.6): `<studio dist>/editors/<id>/editor.json`
+ *    beside the ONE self-contained `index.html` entry. Crew discovers them at boot, pins each entry's
+ *    sha256 and byte size, and serves the entry through the hashed bundle route (`routes.ts`) with
+ *    the §8.2 headers. Their ids are `wicked-*` — the reserved first-party namespace every pack is
+ *    refused (garden `wicked-pack.schema.json`).
+ *  - **Third-party** editors arrive as garden packs (spec 2 `editors[]`). Their install is REFUSED
+ *    until the install-time conformance run ships (EP-C8, LATER): `pack-install.ts` still runs
+ *    garden's fail-closed `pack check` and lists what the operator would be asked to approve, then
+ *    answers 501. Nothing of a pack is ever written by this registry.
+ *
+ * Persisted state is ONE file, `<state home>/daemon-editors.json` — the enable/disable flags the
+ * operator sets in Settings → Editors (§6.4, human-only). It sits under the `daemon-` prefix both
+ * crew's state-home registry and the engine's worker fence already classify (crew#756), so no new
+ * top-level entry is introduced; a pack install (EP-C8) will need a registered `editors/` subtree in
+ * both repos first.
+ */
+import { z } from 'zod';
+import type { EditorView } from '../core/types.js';
+/** The persisted flags file, under the registered `daemon-` prefix. */
+export declare const EDITORS_STATE_FILENAME = "daemon-editors.json";
+/** Where first-party manifests live inside the studio bundle. */
+export declare const STUDIO_EDITORS_DIRNAME = "editors";
+/** The host's bundle cap (§8.5); a pack's `limits.bundleBytes` may only be lower. */
+export declare const HOST_BUNDLE_CAP_BYTES: number;
+export declare const EDITOR_PERMISSIONS: readonly ["artifact.read", "artifact.write", "selection.chip", "composer.draft", "checks.read", "checks.contribute", "sources.read", "media.read", "artifact.export", "ui.fullscreen", "network.media"];
+/** Editor ids: lowercase dash-words, ≤ 64 (garden's shape); first-party ones start with `wicked-`. */
+export declare const EDITOR_ID: RegExp;
+export declare const FIRST_PARTY_ID: RegExp;
+/** Anchored SemVer (garden's shape). */
+export declare const EDITOR_VERSION: RegExp;
+export declare const EditorManifestSchema: z.ZodObject<{
+    id: z.ZodString;
+    title: z.ZodString;
+    version: z.ZodString;
+    protocol: z.ZodArray<z.ZodNumber, "many">;
+    kinds: z.ZodArray<z.ZodString, "many">;
+    entry: z.ZodDefault<z.ZodString>;
+    sizes: z.ZodEffects<z.ZodArray<z.ZodEnum<["inline", "pane", "full"]>, "many">, ("inline" | "pane" | "full")[], ("inline" | "pane" | "full")[]>;
+    panels: z.ZodOptional<z.ZodArray<z.ZodEnum<["checks"]>, "many">>;
+    permissions: z.ZodArray<z.ZodObject<{
+        id: z.ZodEnum<["artifact.read", "artifact.write", "selection.chip", "composer.draft", "checks.read", "checks.contribute", "sources.read", "media.read", "artifact.export", "ui.fullscreen", "network.media"]>;
+        why: z.ZodString;
+    }, "strip", z.ZodTypeAny, {
+        id: "artifact.read" | "artifact.write" | "selection.chip" | "composer.draft" | "checks.read" | "checks.contribute" | "sources.read" | "media.read" | "artifact.export" | "ui.fullscreen" | "network.media";
+        why: string;
+    }, {
+        id: "artifact.read" | "artifact.write" | "selection.chip" | "composer.draft" | "checks.read" | "checks.contribute" | "sources.read" | "media.read" | "artifact.export" | "ui.fullscreen" | "network.media";
+        why: string;
+    }>, "many">;
+    limits: z.ZodOptional<z.ZodObject<{
+        bundleBytes: z.ZodNumber;
+    }, "strip", z.ZodTypeAny, {
+        bundleBytes: number;
+    }, {
+        bundleBytes: number;
+    }>>;
+}, "strip", z.ZodTypeAny, {
+    id: string;
+    title: string;
+    version: string;
+    entry: string;
+    protocol: number[];
+    kinds: string[];
+    sizes: ("inline" | "pane" | "full")[];
+    permissions: {
+        id: "artifact.read" | "artifact.write" | "selection.chip" | "composer.draft" | "checks.read" | "checks.contribute" | "sources.read" | "media.read" | "artifact.export" | "ui.fullscreen" | "network.media";
+        why: string;
+    }[];
+    panels?: "checks"[] | undefined;
+    limits?: {
+        bundleBytes: number;
+    } | undefined;
+}, {
+    id: string;
+    title: string;
+    version: string;
+    protocol: number[];
+    kinds: string[];
+    sizes: ("inline" | "pane" | "full")[];
+    permissions: {
+        id: "artifact.read" | "artifact.write" | "selection.chip" | "composer.draft" | "checks.read" | "checks.contribute" | "sources.read" | "media.read" | "artifact.export" | "ui.fullscreen" | "network.media";
+        why: string;
+    }[];
+    entry?: string | undefined;
+    panels?: "checks"[] | undefined;
+    limits?: {
+        bundleBytes: number;
+    } | undefined;
+}>;
+export type EditorManifest = z.infer<typeof EditorManifestSchema>;
+export interface EditorRecord {
+    manifest: EditorManifest;
+    /** The full 64-hex sha256 of the entry file, pinned when the registry read it. */
+    sha256: string;
+    bytes: number;
+    /** Absolute path of the entry file. Never on the wire. */
+    entryPath: string;
+    firstParty: boolean;
+    source: 'studio-bundle';
+    enabled: boolean;
+}
+export declare function sha256Of(buf: Buffer): string;
+/**
+ * A path is served from the bundle only if it IS what it looks like: a real directory or a real
+ * file, never a link (codex r1 — a link under `editors/` could point outside the bundle and be
+ * served as first-party). `null` = fine; else the reason.
+ */
+export declare function notRealEntry(path: string, want: 'dir' | 'file'): string | null;
+/** The entry must be ONE self-contained file: nothing loaded from outside it (§5.2; the CSP would block it anyway). */
+export declare function externalReferences(html: string): string[];
+/**
+ * Read the first-party editors a studio bundle ships. A malformed manifest, a missing or oversized
+ * entry, an entry with outside references, or a non-`wicked-*` id is skipped with a reason — never
+ * served half-right.
+ */
+export declare function discoverStudioEditors(studioRoot: string, log?: (msg: string) => void): Array<Omit<EditorRecord, 'enabled'>>;
+export declare class EditorRegistry {
+    private readonly records;
+    private readonly stateFile;
+    private readonly log;
+    constructor(opts?: {
+        stateHome?: string;
+        studioRoot?: string;
+        log?: (msg: string) => void;
+    });
+    private readState;
+    private writeState;
+    /** Where the flags live (diagnostics / tests). */
+    get stateFilePath(): string;
+    list(): EditorRecord[];
+    get(id: string): EditorRecord | null;
+    /** Enable or disable (§6.4: the operator's click). Returns the record, or `null` for an unknown id. */
+    setEnabled(id: string, enabled: boolean): EditorRecord | null;
+    /** The wire view: no paths, the hashed entry URL instead. */
+    static view(r: EditorRecord): EditorView;
+}
+//# sourceMappingURL=registry.d.ts.map

package/dist/editors/registry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/editors/registry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAKH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,KAAK,EAAoB,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGrE,uEAAuE;AACvE,eAAO,MAAM,sBAAsB,wBAAwB,CAAC;AAC5D,iEAAiE;AACjE,eAAO,MAAM,sBAAsB,YAAY,CAAC;AAChD,qFAAqF;AACrF,eAAO,MAAM,qBAAqB,QAAkB,CAAC;AAErD,eAAO,MAAM,kBAAkB,yMAYqB,CAAC;AAErD,sGAAsG;AACtG,eAAO,MAAM,SAAS,QAAgC,CAAC;AACvD,eAAO,MAAM,cAAc,QAAuC,CAAC;AACnE,wCAAwC;AACxC,eAAO,MAAM,cAAc,QAA8D,CAAC;AAG1F,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAW/B,CAAC;AACH,MAAM,MAAM,cAAc,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAElE,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,cAAc,CAAC;IACzB,kFAAkF;IAClF,MAAM,EAAE,MAAM,CAAC;IACf,KAAK,EAAE,MAAM,CAAC;IACd,0DAA0D;IAC1D,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,OAAO,CAAC;IACpB,MAAM,EAAE,eAAe,CAAC;IACxB,OAAO,EAAE,OAAO,CAAC;CAClB;AAED,wBAAgB,QAAQ,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,CAE5C;AAED;;;;GAIG;AACH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,MAAM,GAAG,IAAI,CAW9E;AAED,uHAAuH;AACvH,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,CAWzD;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,CACnC,UAAU,EAAE,MAAM,EAClB,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,GAC1B,KAAK,CAAC,IAAI,CAAC,YAAY,EAAE,SAAS,CAAC,CAAC,CA+DtC;AAOD,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAmC;IAC3D,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAwB;gBAEhC,IAAI,GAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,CAAA;KAAO;IAW/F,OAAO,CAAC,SAAS;IAWjB,OAAO,CAAC,UAAU;IAUlB,kDAAkD;IAClD,IAAI,aAAa,IAAI,MAAM,CAE1B;IAED,IAAI,IAAI,YAAY,EAAE;IAItB,GAAG,CAAC,EAAE,EAAE,MAAM,GAAG,YAAY,GAAG,IAAI;IAIpC,uGAAuG;IACvG,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,GAAG,YAAY,GAAG,IAAI;IAS7D,6DAA6D;IAC7D,MAAM,CAAC,IAAI,CAAC,CAAC,EAAE,YAAY,GAAG,UAAU;CAmBzC"}