@agentwares/agentguard 0.1.7 → 0.1.10

package/dist/chunk-IEJK7N3B.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/commands/init.ts"],"sourcesContent":["/**\n * `okgate init` — the 60-second install. Reads the agent's existing MCP config, probes the\n * servers, writes `okgate.yaml` (dry-run by default) and rewrites the config so everything\n * goes through the proxy. `--undo` restores the backup.\n */\nimport { existsSync, writeFileSync } from \"node:fs\";\nimport { relative, resolve } from \"node:path\";\nimport YAML from \"yaml\";\nimport { type Upstream } from \"@agentwares/agentguard-core\";\nimport { flagBool, flagString, type ParsedArgs } from \"../args.js\";\nimport {\n  describeConfigPath,\n  detectClientConfigs,\n  readServers,\n  restoreClientConfig,\n  rewriteClientConfig,\n  serversToUpstreams,\n  type ClientConfigFile,\n} from \"../configs.js\";\nimport { homeFrom, policyPathFrom, type Io } from \"../context.js\";\nimport { RUN } from \"../install.js\";\nimport { probeUpstreams, type ProbedTool } from \"./tools.js\";\n\nexport interface StarterPolicyOptions {\n  upstreams: Upstream[];\n  tools?: ProbedTool[];\n  mode?: \"dry-run\" | \"enforce\";\n  generatedAt?: Date;\n  probeErrors?: string[];\n}\n\nfunction dump(value: unknown, indent = 0): string {\n  const text = YAML.stringify(value, { indent: 2, lineWidth: 100 }).trimEnd();\n  const pad = \" \".repeat(indent);\n  return text\n    .split(\"\\n\")\n    .map((l) => pad + l)\n    .join(\"\\n\");\n}\n\nfunction flow(list: string[]): string {\n  return list.length === 0 ? \"[]\" : `[${list.map((s) => JSON.stringify(s)).join(\", \")}]`;\n}\n\n/** The commented starter policy — the file people read, so every knob explains itself. */\nexport function renderStarterPolicy(opts: StarterPolicyOptions): string {\n  const tools = opts.tools ?? [];\n  const unknown = tools.filter((t) => t.classification.class === \"unknown\").map((t) => t.name);\n  const destructive = tools\n    .filter((t) => t.classification.destructive || t.classification.verb === \"delete\")\n    .map((t) => t.name);\n  const spend = tools.filter((t) => t.classification.class === \"spend\").map((t) => t.name);\n  const date = (opts.generatedAt ?? new Date()).toISOString().slice(0, 10);\n  const counts = tools.reduce<Record<string, number>>(\n    (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),\n    {},\n  );\n  const detected =\n    tools.length === 0\n      ? [\"#   (no upstreams probed — run `okgate tools` after fixing the upstreams above)\"]\n      : tools.map(\n          (t) =>\n            `#   ${t.name.padEnd(36)} ${t.classification.class.padEnd(8)} ${t.classification.verb.padEnd(8)} ${t.classification.source}: ${t.classification.reason}`,\n        );\n  const probeNotes = (opts.probeErrors ?? []).map((e) => `#   ! ${e}`);\n  const upstreamsYaml = opts.upstreams.length\n    ? dump({ upstreams: opts.upstreams.map(cleanUpstream) })\n    : 'upstreams: []\\n  # - name: crm\\n  #   url: https://mcp.example.com/mcp\\n  #   auth: ${CRM_TOKEN}\\n  # - name: files\\n  #   command: npx\\n  #   args: [-y, \"@modelcontextprotocol/server-filesystem\", \".\"]';\n\n  return `# okgate.yaml — generated by \\`okgate init\\` on ${date}\n# Every knob is explained inline. Docs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli#policy\nversion: 1\n\n# dry-run: reads pass through; writes and spends are FAKED (plausible success, nothing executes)\n# and recorded. Run your agent once, then \\`okgate report\\` and \\`okgate diff\\`.\n# Flip to \\`enforce\\` when the diff looks right. Caps and the loop breaker apply in both modes.\nmode: ${opts.mode ?? \"dry-run\"}\n\n# The servers your agent used to talk to directly. okgate connects to them and holds their\n# credentials; your agent only talks to okgate. Use \\${ENV_VAR} for secrets.\n${upstreamsYaml}\n\n# Detected tools (${tools.length}${\n    tools.length\n      ? `: ${Object.entries(counts)\n          .map(([k, v]) => `${v} ${k}`)\n          .join(\", \")}`\n      : \"\"\n  }):\n${[...detected, ...probeNotes].join(\"\\n\")}\n# readOnlyHint annotations and verb heuristics classify most tools. List anything that is wrong here;\n# these patterns win over annotations. \\`*\\` matches anything.\nclassify:\n  read: []\n  write: ${flow(unknown)}${unknown.length ? \"   # could not be classified — treated as writes; move to read: if they only read\" : \"\"}\n  spend: ${flow(spend)}\n  unknown: write   # a tool nobody can classify counts as a write (alternatives: read | block)\n\n# Blast-radius caps. The call that would exceed a cap gets CAP_EXCEEDED with the remaining budget.\n# \\`writes\\` counts every write or spend; \\`deletes\\`/\\`emails\\` count the subsets matched by \\`counters\\`.\ncaps:\n  per_run:\n    tool_calls: 400\n    writes: 50\n    deletes: 10\n    emails: 5\n    spend_usd: 25\n  per_day:\n    spend_usd: 200\n\n# Dollar amounts. Declare how to read the amount from a spend tool's arguments; results reporting\n# cost_usd / amount_usd are picked up automatically. Unknown spend tools cost \\`default_usd\\`.\nspend:\n  tools: {}\n  #  stripe_create_charge: { amount_arg: amount, divisor: 100, currency_arg: currency }\n  #  openai_*: { fixed_usd: 0.01 }\n  default_usd: 0\n\n# Semantic loop breaker: the same (tool, normalized arguments) ${3} times in the last 30 calls, or a\n# repeating A→B→A→B cycle, returns LOOP_DETECTED. Timestamps, ids and whitespace are ignored.\nloop:\n  window: 30\n  max_repeats: 3\n  max_cycle_len: 4\n  max_read_repeats: 10\n\n# Always fake these, even in enforce mode. Remove entries as you gain trust.\ndry_run:\n  tools: []\n  synthesize: true\n\n# Destructive actions that need a human. The agent gets APPROVAL_REQUIRED with an id; you run\n# \\`okgate approve <id>\\` (or click the link in Slack); the agent retries the identical call once.\napproval:\n  tools: ${flow(destructive)}\n  wait_s: 0          # > 0 holds the call open this long waiting for the decision\n  ttl_s: 3600\n  # notify:\n  #   slack: \\${SLACK_WEBHOOK_URL}\n\n# Kill switch: \\`okgate kill\\` creates this file (or POST /kill on the HTTP proxy); every call\n# returns KILLED until \\`okgate resume\\`. OKGATE_KILL=1 (or AGENTGUARD_KILL=1) in the environment does the same.\nkill:\n  file: .okgate/KILL\n\n# Scoped agent keys for the HTTP proxy: \\`okgate key create deployer --allow 'crm_get_*'\\`.\n# Only the key's hash is stored here; the agent sends the key as a Bearer token.\nagents: []\n\n# Alerts on halts (Slack incoming webhook or any HTTPS endpoint; signed with X-Agentwares-Signature).\n# alerts:\n#   slack: \\${SLACK_WEBHOOK_URL}\n#   on: [LOOP_DETECTED, CAP_EXCEEDED, KILLED, APPROVAL_REQUIRED]\n\n# Hash-chained JSONL of every call; \\`okgate verify\\` proves it was not edited.\naudit:\n  path: .okgate/audit.jsonl\n  redact: true\n  include_results: false\n`;\n}\n\nfunction cleanUpstream(u: Upstream): Record<string, unknown> {\n  const out: Record<string, unknown> = { name: u.name };\n  if (u.url) {\n    out.url = u.url;\n    if (Object.keys(u.headers).length) out.headers = u.headers;\n  } else {\n    out.command = u.command;\n    if (u.args.length) out.args = u.args;\n    if (Object.keys(u.env).length) out.env = u.env;\n    if (u.cwd) out.cwd = u.cwd;\n  }\n  return out;\n}\n\nexport async function initCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const policyPath = policyPathFrom(args, io);\n  const explicit = flagString(args, \"client\");\n  const configs: ClientConfigFile[] = explicit\n    ? [describeConfigPath(resolve(io.cwd, explicit))]\n    : detectClientConfigs(io.cwd, homeFrom(io), io.env);\n  const rel = (p: string): string => {\n    const r = relative(io.cwd, p);\n    return r.startsWith(\"..\") ? p : r || \".\";\n  };\n\n  if (flagBool(args, \"undo\")) {\n    let restored = 0;\n    for (const c of configs) {\n      if (restoreClientConfig(c)) {\n        io.out(`restored ${rel(c.path)} from backup`);\n        restored += 1;\n      }\n    }\n    if (restored === 0)\n      io.err(\n        \"nothing to undo (no *.okgate-backup or *.agentguard-backup files next to your MCP configs)\",\n      );\n    return 0;\n  }\n\n  // Only project-level configs are rewritten by default. User-level files (Claude Desktop,\n  // ~/.cursor, Windsurf, ~/.claude.json) affect every project, so they need an explicit --client.\n  const projectLevel = configs.filter((c) => c.path.startsWith(io.cwd + \"/\"));\n  const userLevel = configs.filter((c) => !projectLevel.includes(c));\n  let chosen: ClientConfigFile[];\n  if (explicit) chosen = configs;\n  else if (flagBool(args, \"all\")) chosen = configs;\n  else chosen = projectLevel.slice(0, 1);\n  if (!explicit && !flagBool(args, \"all\")) {\n    for (const c of userLevel)\n      io.out(\n        `found   ${c.path} (${c.label}, user-level) — not touched; pass --client ${JSON.stringify(c.path)} to route it through okgate`,\n      );\n  }\n  if (!chosen.every((c) => existsSync(c.path))) {\n    io.err(`no MCP config at ${chosen.map((c) => c.path).join(\", \")}`);\n    return 1;\n  }\n\n  const servers: Record<string, ReturnType<typeof readServers>[string]> = {};\n  for (const c of chosen) {\n    const found = readServers(c);\n    io.out(\n      `found   ${rel(c.path)} (${c.label}) → ${Object.keys(found).length} server${Object.keys(found).length === 1 ? \"\" : \"s\"}: ${Object.keys(found).join(\", \") || \"none\"}`,\n    );\n    for (const [name, entry] of Object.entries(found))\n      if (!(name in servers)) servers[name] = entry;\n  }\n  if (chosen.length === 0)\n    io.out(\n      \"found   no MCP config (Claude Code .mcp.json, Cursor, VS Code, Claude Desktop, Windsurf, Gemini CLI) — writing a policy with no upstreams\",\n    );\n  const { upstreams, skipped } = serversToUpstreams(servers);\n  for (const s of skipped) io.err(`skipped ${s.name}: ${s.reason}`);\n  if (\n    skipped.some((s) => s.reason.includes(\"already\")) &&\n    upstreams.length === 0 &&\n    existsSync(policyPath)\n  ) {\n    io.out(\n      `already initialized: ${rel(policyPath)} exists and ${chosen.map((c) => rel(c.path)).join(\", \")} already points at okgate`,\n    );\n    return 0;\n  }\n\n  let probed: ProbedTool[] = [];\n  const probeErrors: string[] = [];\n  if (flagBool(args, \"probe\") !== false && upstreams.length > 0) {\n    io.out(`probing ${upstreams.length} upstream${upstreams.length === 1 ? \"\" : \"s\"}…`);\n    const result = await probeUpstreams(upstreams, {\n      log: () => undefined,\n      env: io.env,\n      timeoutMs: 20_000,\n    });\n    probed = result.tools;\n    for (const u of result.upstreams) {\n      if (u.connected) io.out(`        ${u.name}: ${u.tools} tools`);\n      else {\n        io.err(\n          `        ${u.name}: could not connect (${u.error}) — the proxy will keep retrying at start; fix the entry in okgate.yaml`,\n        );\n        probeErrors.push(`${u.name}: ${u.error}`);\n      }\n    }\n  }\n\n  const mode = (flagString(args, \"mode\") as \"dry-run\" | \"enforce\" | undefined) ?? \"dry-run\";\n  if (existsSync(policyPath) && !flagBool(args, \"force\")) {\n    io.out(`kept    ${rel(policyPath)} (exists; pass --force to regenerate)`);\n  } else {\n    writeFileSync(policyPath, renderStarterPolicy({ upstreams, tools: probed, mode, probeErrors }));\n    const counts = probed.reduce<Record<string, number>>(\n      (acc, t) => ({ ...acc, [t.classification.class]: (acc[t.classification.class] ?? 0) + 1 }),\n      {},\n    );\n    io.out(\n      `wrote   ${rel(policyPath)} (mode: ${mode}, ${upstreams.length} upstream${upstreams.length === 1 ? \"\" : \"s\"}${\n        probed.length\n          ? `, ${probed.length} tools: ${Object.entries(counts)\n              .map(([k, v]) => `${v} ${k}`)\n              .join(\", \")}`\n          : \"\"\n      })`,\n    );\n  }\n\n  if (flagBool(args, \"rewrite\") !== false) {\n    for (const c of chosen) {\n      // `--config` names the policy file, and `--client` names the client's. Point both at the\n      // same file — easy, because an MCP client's file is also called a config — and the\n      // rewrite replaces the policy with the proxy entry and then points the proxy at that.\n      // The upstreams survive only in the backup, and the proxy starts with nothing to guard.\n      if (resolve(c.path) === resolve(policyPath)) {\n        throw new Error(\n          `refusing: ${rel(c.path)} is both the policy file (--config) and a client config. ` +\n            `Rewriting it would replace the policy with the proxy entry and leave the proxy ` +\n            `pointing at itself. Use --config for the policy path and --client for the ` +\n            `client's config, or let --config default to okgate.yaml.`,\n        );\n      }\n      const { backup, replaced } = rewriteClientConfig(c, policyPath, {\n        agent: flagString(args, \"agent\"),\n      });\n      io.out(\n        `rewrote ${rel(c.path)} → ${replaced.length ? `${replaced.join(\", \")} now go through` : \"points at\"} \\`${RUN} proxy\\` (backup: ${rel(backup)})`,\n      );\n    }\n  }\n\n  io.out(\"\");\n  io.out(\"Next:\");\n  io.out(\n    `  1. restart your MCP client so it re-reads ${chosen.map((c) => rel(c.path)).join(\", \") || \"its config\"}`,\n  );\n  io.out(\n    `  2. run your agent once — ${mode === \"dry-run\" ? \"writes are faked; nothing executes upstream\" : \"enforce mode: caps, loop breaker and approvals are live\"}`,\n  );\n  io.out(\"  3. okgate report    # what this run would have destroyed / spent\");\n  io.out(\"     okgate diff      # the record-by-record mutation diff\");\n  if (mode === \"dry-run\")\n    io.out(`  4. set \\`mode: enforce\\` in ${rel(policyPath)} when it looks right`);\n  io.out(\"  undo any time: okgate init --undo\");\n  return 0;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAKA,SAAS,YAAY,qBAAqB;AAC1C,SAAS,UAAU,eAAe;AAClC,OAAO,UAAU;AAwBjB,SAAS,KAAK,OAAgB,SAAS,GAAW;AAChD,QAAM,OAAO,KAAK,UAAU,OAAO,EAAE,QAAQ,GAAG,WAAW,IAAI,CAAC,EAAE,QAAQ;AAC1E,QAAM,MAAM,IAAI,OAAO,MAAM;AAC7B,SAAO,KACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,MAAM,CAAC,EAClB,KAAK,IAAI;AACd;AAEA,SAAS,KAAK,MAAwB;AACpC,SAAO,KAAK,WAAW,IAAI,OAAO,IAAI,KAAK,IAAI,CAAC,MAAM,KAAK,UAAU,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC;AACrF;AAGO,SAAS,oBAAoB,MAAoC;AACtE,QAAM,QAAQ,KAAK,SAAS,CAAC;AAC7B,QAAM,UAAU,MAAM,OAAO,CAAC,MAAM,EAAE,eAAe,UAAU,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAC3F,QAAM,cAAc,MACjB,OAAO,CAAC,MAAM,EAAE,eAAe,eAAe,EAAE,eAAe,SAAS,QAAQ,EAChF,IAAI,CAAC,MAAM,EAAE,IAAI;AACpB,QAAM,QAAQ,MAAM,OAAO,CAAC,MAAM,EAAE,eAAe,UAAU,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AACvF,QAAM,QAAQ,KAAK,eAAe,oBAAI,KAAK,GAAG,YAAY,EAAE,MAAM,GAAG,EAAE;AACvE,QAAM,SAAS,MAAM;AAAA,IACnB,CAAC,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,eAAe,KAAK,IAAI,IAAI,EAAE,eAAe,KAAK,KAAK,KAAK,EAAE;AAAA,IACxF,CAAC;AAAA,EACH;AACA,QAAM,WACJ,MAAM,WAAW,IACb,CAAC,sFAAiF,IAClF,MAAM;AAAA,IACJ,CAAC,MACC,OAAO,EAAE,KAAK,OAAO,EAAE,CAAC,IAAI,EAAE,eAAe,MAAM,OAAO,CAAC,CAAC,IAAI,EAAE,eAAe,KAAK,OAAO,CAAC,CAAC,IAAI,EAAE,eAAe,MAAM,KAAK,EAAE,eAAe,MAAM;AAAA,EAC1J;AACN,QAAM,cAAc,KAAK,eAAe,CAAC,GAAG,IAAI,CAAC,MAAM,SAAS,CAAC,EAAE;AACnE,QAAM,gBAAgB,KAAK,UAAU,SACjC,KAAK,EAAE,WAAW,KAAK,UAAU,IAAI,aAAa,EAAE,CAAC,IACrD;AAEJ,SAAO,wDAAmD,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,QAOxD,KAAK,QAAQ,SAAS;AAAA;AAAA;AAAA;AAAA,EAI5B,aAAa;AAAA;AAAA,oBAEK,MAAM,MAAM,GAC5B,MAAM,SACF,KAAK,OAAO,QAAQ,MAAM,EACvB,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAC3B,KAAK,IAAI,CAAC,KACb,EACN;AAAA,EACA,CAAC,GAAG,UAAU,GAAG,UAAU,EAAE,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA,WAK9B,KAAK,OAAO,CAAC,GAAG,QAAQ,SAAS,2FAAsF,EAAE;AAAA,WACzH,KAAK,KAAK,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iEAuB2C,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,WAgBvD,KAAK,WAAW,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AA0B5B;AAEA,SAAS,cAAc,GAAsC;AAC3D,QAAM,MAA+B,EAAE,MAAM,EAAE,KAAK;AACpD,MAAI,EAAE,KAAK;AACT,QAAI,MAAM,EAAE;AACZ,QAAI,OAAO,KAAK,EAAE,OAAO,EAAE,OAAQ,KAAI,UAAU,EAAE;AAAA,EACrD,OAAO;AACL,QAAI,UAAU,EAAE;AAChB,QAAI,EAAE,KAAK,OAAQ,KAAI,OAAO,EAAE;AAChC,QAAI,OAAO,KAAK,EAAE,GAAG,EAAE,OAAQ,KAAI,MAAM,EAAE;AAC3C,QAAI,EAAE,IAAK,KAAI,MAAM,EAAE;AAAA,EACzB;AACA,SAAO;AACT;AAEA,eAAsB,YAAY,MAAkB,IAAyB;AAC3E,QAAM,aAAa,eAAe,MAAM,EAAE;AAC1C,QAAM,WAAW,WAAW,MAAM,QAAQ;AAC1C,QAAM,UAA8B,WAChC,CAAC,mBAAmB,QAAQ,GAAG,KAAK,QAAQ,CAAC,CAAC,IAC9C,oBAAoB,GAAG,KAAK,SAAS,EAAE,GAAG,GAAG,GAAG;AACpD,QAAM,MAAM,CAAC,MAAsB;AACjC,UAAM,IAAI,SAAS,GAAG,KAAK,CAAC;AAC5B,WAAO,EAAE,WAAW,IAAI,IAAI,IAAI,KAAK;AAAA,EACvC;AAEA,MAAI,SAAS,MAAM,MAAM,GAAG;AAC1B,QAAI,WAAW;AACf,eAAW,KAAK,SAAS;AACvB,UAAI,oBAAoB,CAAC,GAAG;AAC1B,WAAG,IAAI,YAAY,IAAI,EAAE,IAAI,CAAC,cAAc;AAC5C,oBAAY;AAAA,MACd;AAAA,IACF;AACA,QAAI,aAAa;AACf,SAAG;AAAA,QACD;AAAA,MACF;AACF,WAAO;AAAA,EACT;AAIA,QAAM,eAAe,QAAQ,OAAO,CAAC,MAAM,EAAE,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC;AAC1E,QAAM,YAAY,QAAQ,OAAO,CAAC,MAAM,CAAC,aAAa,SAAS,CAAC,CAAC;AACjE,MAAI;AACJ,MAAI,SAAU,UAAS;AAAA,WACd,SAAS,MAAM,KAAK,EAAG,UAAS;AAAA,MACpC,UAAS,aAAa,MAAM,GAAG,CAAC;AACrC,MAAI,CAAC,YAAY,CAAC,SAAS,MAAM,KAAK,GAAG;AACvC,eAAW,KAAK;AACd,SAAG;AAAA,QACD,WAAW,EAAE,IAAI,KAAK,EAAE,KAAK,mDAA8C,KAAK,UAAU,EAAE,IAAI,CAAC;AAAA,MACnG;AAAA,EACJ;AACA,MAAI,CAAC,OAAO,MAAM,CAAC,MAAM,WAAW,EAAE,IAAI,CAAC,GAAG;AAC5C,OAAG,IAAI,oBAAoB,OAAO,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,EAAE;AACjE,WAAO;AAAA,EACT;AAEA,QAAM,UAAkE,CAAC;AACzE,aAAW,KAAK,QAAQ;AACtB,UAAM,QAAQ,YAAY,CAAC;AAC3B,OAAG;AAAA,MACD,WAAW,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,YAAO,OAAO,KAAK,KAAK,EAAE,MAAM,UAAU,OAAO,KAAK,KAAK,EAAE,WAAW,IAAI,KAAK,GAAG,KAAK,OAAO,KAAK,KAAK,EAAE,KAAK,IAAI,KAAK,MAAM;AAAA,IACpK;AACA,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,KAAK;AAC9C,UAAI,EAAE,QAAQ,SAAU,SAAQ,IAAI,IAAI;AAAA,EAC5C;AACA,MAAI,OAAO,WAAW;AACpB,OAAG;AAAA,MACD;AAAA,IACF;AACF,QAAM,EAAE,WAAW,QAAQ,IAAI,mBAAmB,OAAO;AACzD,aAAW,KAAK,QAAS,IAAG,IAAI,WAAW,EAAE,IAAI,KAAK,EAAE,MAAM,EAAE;AAChE,MACE,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,SAAS,SAAS,CAAC,KAChD,UAAU,WAAW,KACrB,WAAW,UAAU,GACrB;AACA,OAAG;AAAA,MACD,wBAAwB,IAAI,UAAU,CAAC,eAAe,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,CAAC;AAAA,IACjG;AACA,WAAO;AAAA,EACT;AAEA,MAAI,SAAuB,CAAC;AAC5B,QAAM,cAAwB,CAAC;AAC/B,MAAI,SAAS,MAAM,OAAO,MAAM,SAAS,UAAU,SAAS,GAAG;AAC7D,OAAG,IAAI,WAAW,UAAU,MAAM,YAAY,UAAU,WAAW,IAAI,KAAK,GAAG,QAAG;AAClF,UAAM,SAAS,MAAM,eAAe,WAAW;AAAA,MAC7C,KAAK,MAAM;AAAA,MACX,KAAK,GAAG;AAAA,MACR,WAAW;AAAA,IACb,CAAC;AACD,aAAS,OAAO;AAChB,eAAW,KAAK,OAAO,WAAW;AAChC,UAAI,EAAE,UAAW,IAAG,IAAI,WAAW,EAAE,IAAI,KAAK,EAAE,KAAK,QAAQ;AAAA,WACxD;AACH,WAAG;AAAA,UACD,WAAW,EAAE,IAAI,wBAAwB,EAAE,KAAK;AAAA,QAClD;AACA,oBAAY,KAAK,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,EAAE;AAAA,MAC1C;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAQ,WAAW,MAAM,MAAM,KAA2C;AAChF,MAAI,WAAW,UAAU,KAAK,CAAC,SAAS,MAAM,OAAO,GAAG;AACtD,OAAG,IAAI,WAAW,IAAI,UAAU,CAAC,uCAAuC;AAAA,EAC1E,OAAO;AACL,kBAAc,YAAY,oBAAoB,EAAE,WAAW,OAAO,QAAQ,MAAM,YAAY,CAAC,CAAC;AAC9F,UAAM,SAAS,OAAO;AAAA,MACpB,CAAC,KAAK,OAAO,EAAE,GAAG,KAAK,CAAC,EAAE,eAAe,KAAK,IAAI,IAAI,EAAE,eAAe,KAAK,KAAK,KAAK,EAAE;AAAA,MACxF,CAAC;AAAA,IACH;AACA,OAAG;AAAA,MACD,WAAW,IAAI,UAAU,CAAC,WAAW,IAAI,KAAK,UAAU,MAAM,YAAY,UAAU,WAAW,IAAI,KAAK,GAAG,GACzG,OAAO,SACH,KAAK,OAAO,MAAM,WAAW,OAAO,QAAQ,MAAM,EAC/C,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,EAAE,EAC3B,KAAK,IAAI,CAAC,KACb,EACN;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,MAAM,SAAS,MAAM,OAAO;AACvC,eAAW,KAAK,QAAQ;AAKtB,UAAI,QAAQ,EAAE,IAAI,MAAM,QAAQ,UAAU,GAAG;AAC3C,cAAM,IAAI;AAAA,UACR,aAAa,IAAI,EAAE,IAAI,CAAC;AAAA,QAI1B;AAAA,MACF;AACA,YAAM,EAAE,QAAQ,SAAS,IAAI,oBAAoB,GAAG,YAAY;AAAA,QAC9D,OAAO,WAAW,MAAM,OAAO;AAAA,MACjC,CAAC;AACD,SAAG;AAAA,QACD,WAAW,IAAI,EAAE,IAAI,CAAC,WAAM,SAAS,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC,oBAAoB,WAAW,MAAM,GAAG,qBAAqB,IAAI,MAAM,CAAC;AAAA,MAC9I;AAAA,IACF;AAAA,EACF;AAEA,KAAG,IAAI,EAAE;AACT,KAAG,IAAI,OAAO;AACd,KAAG;AAAA,IACD,+CAA+C,OAAO,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,CAAC,EAAE,KAAK,IAAI,KAAK,YAAY;AAAA,EAC1G;AACA,KAAG;AAAA,IACD,mCAA8B,SAAS,YAAY,gDAAgD,yDAAyD;AAAA,EAC9J;AACA,KAAG,IAAI,oEAAoE;AAC3E,KAAG,IAAI,4DAA4D;AACnE,MAAI,SAAS;AACX,OAAG,IAAI,iCAAiC,IAAI,UAAU,CAAC,sBAAsB;AAC/E,KAAG,IAAI,qCAAqC;AAC5C,SAAO;AACT;","names":[]}