@agentwares/agentguard 0.1.9 → 0.1.10

package/dist/chunk-6S7LYVOC.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/commands/audit.ts","../src/audit/cache.ts","../src/audit/enforce.ts","../src/audit/read.ts","../src/audit/repo.ts","../src/audit/sources.ts"],"sourcesContent":["/**\n * `agentguard audit [--since 7d|30d|all|YYYY-MM-DD] [--client claude|codex|all] [--json]\n *  [--enforce [--preview] [--yes]]`\n *\n * Which written rules the coding agents broke in this repository: the rules come from the repo's\n * CLAUDE.md, AGENTS.md, GEMINI.md, .cursor/rules (and agentguard.yaml `audit.rules`); the\n * sessions are this machine's Claude Code and Codex transcripts whose working directory is in the\n * repo. Per rule: sessions checked, sessions broken, the last three dates — and on screen only,\n * the command or path that broke it. No network, no telemetry, no LLM: nothing leaves the\n * machine. `--json` (what `/agentguard:audit` reads) carries counts, rule ids and dates, never a\n * command, a path or a prompt from a transcript.\n *\n * `--enforce` writes the checkable rules into agentguard.yaml as hook-mode rules — in dry-run;\n * it never switches `hooks.mode` to enforce — shows the diff, and installs the hook if it is not.\n */\nimport { writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join, resolve } from \"node:path\";\nimport {\n  NOT_CHECKABLE_HINT,\n  applicableNoun,\n  describeStep,\n  evaluateChecks,\n  extractRules,\n  planEnforcement,\n  stableHash,\n  summarizeAudit,\n  type AuditClient,\n  type AuditContext,\n  type AuditStep,\n  type GroupAudit,\n  type LocatedBreak,\n  type Rule,\n  type RuleCheck,\n  type RuleSummary,\n} from \"@agentwares/agentguard-core\";\nimport { flagBool, flagList, flagString, parseArgs, type ParsedArgs } from \"../args.js\";\nimport { homeFrom, type Io } from \"../context.js\";\nimport { AuditCache, sha } from \"../audit/cache.js\";\nimport { applyEnforcePlan, lineDiff } from \"../audit/enforce.js\";\nimport { fetchSteps, readGroup } from \"../audit/read.js\";\nimport { findRepo, readConfigRules, readRuleFiles, repoMatcher } from \"../audit/repo.js\";\nimport {\n  claudeGroups,\n  claudeProjectDirs,\n  codexGroups,\n  sourceDirs,\n  type TranscriptGroup,\n} from \"../audit/sources.js\";\nimport { installedHandlers, hookTarget } from \"../hooks/clients.js\";\nimport { version } from \"../version.js\";\nimport { hooksCommand } from \"./hooks.js\";\n\n/** The willingness-to-pay test: a page that says what the team view would be, and one button. */\nexport const TEAM_HISTORY_URL = \"https://agentwares-agentguard.vercel.app/team-history\";\nexport const TEAM_HISTORY_LINE = `Team adherence history across repos and developers is coming — ${TEAM_HISTORY_URL}`;\n\nconst CLIENT_LABEL: Record<AuditClient, string> = { \"claude-code\": \"Claude Code\", codex: \"Codex\" };\n\n/** `7d`, `30d`, `24h`, `all`, or a date. Undefined: all history. */\nexport function parseSince(value: string | undefined, now: Date): number | undefined {\n  const v = (value ?? \"7d\").trim().toLowerCase();\n  if (v === \"all\") return undefined;\n  const rel = /^(\\d+)\\s*([dhw])$/.exec(v);\n  if (rel) {\n    const n = Number(rel[1]);\n    const unit = rel[2] === \"h\" ? 3_600_000 : rel[2] === \"w\" ? 7 * 86_400_000 : 86_400_000;\n    return now.getTime() - n * unit;\n  }\n  const t = Date.parse(/^\\d{4}-\\d{2}-\\d{2}$/.test(v) ? `${v}T00:00:00` : v);\n  if (!Number.isFinite(t))\n    throw new Error(`--since \"${value}\": use 7d, 30d, 24h, all or a date (YYYY-MM-DD)`);\n  return t;\n}\n\nfunction clientsFrom(args: ParsedArgs): AuditClient[] {\n  const names = flagList(args, \"client\").map((n) => n.trim().toLowerCase());\n  if (names.length === 0 || names.includes(\"all\")) return [\"claude-code\", \"codex\"];\n  return names.map((n) => {\n    if (n === \"claude\" || n === \"claude-code\") return \"claude-code\";\n    if (n === \"codex\") return \"codex\";\n    throw new Error(`unknown --client \"${n}\" (claude, codex or all)`);\n  });\n}\n\nconst pad = (n: number): string => String(n).padStart(2, \"0\");\nconst localTime = (ms: number): string => {\n  const d = new Date(ms);\n  return `${d.getFullYear()}-${pad(d.getMonth() + 1)}-${pad(d.getDate())} ${pad(d.getHours())}:${pad(d.getMinutes())}`;\n};\nconst localDay = (ms: number): string => localTime(ms).slice(0, 10);\nconst plural = (n: number, one: string, many = `${one}s`): string => `${n} ${n === 1 ? one : many}`;\nconst clip = (s: string, n: number): string => (s.length > n ? `${s.slice(0, n - 1)}…` : s);\n\ninterface Entry {\n  group?: TranscriptGroup;\n  audit: GroupAudit;\n  /** steps kept from a group read this run, for the evidence */\n  steps?: Map<string, AuditStep>;\n}\n\ninterface SourceCount {\n  transcripts: number;\n  read: number;\n  cached: number;\n  retained: number;\n  /** groups last written before the window: not read */\n  older: number;\n}\n\nasync function pool<T>(\n  items: readonly T[],\n  size: number,\n  work: (item: T) => Promise<void>,\n): Promise<void> {\n  let next = 0;\n  const run = async (): Promise<void> => {\n    while (next < items.length) await work(items[next++]!);\n  };\n  await Promise.all(Array.from({ length: Math.min(size, items.length) }, run));\n}\n\n/** The hook-rule list a check would be enforced through, or \"audit-only\". */\nfunction enforceTarget(check: RuleCheck): string {\n  switch (check.spec.kind) {\n    case \"run-before\":\n    case \"no-commit-to\":\n      return \"audit-only\";\n    case \"no-edit\":\n      return \"hooks.paths.deny\";\n    case \"no-new-deps\":\n      return check.spec.unlessAsked ? \"hooks.shell.approval\" : \"hooks.shell.deny\";\n    case \"no-rm-outside\":\n    case \"no-publish\":\n      return \"hooks.irreversible.builtins\";\n    case \"no-deploy\":\n      return \"hooks.irreversible.rules\";\n    default:\n      return \"hooks.shell.deny\";\n  }\n}\n\nexport async function auditCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const now = new Date();\n  const json = flagBool(args, \"json\") === true;\n  const since = parseSince(flagString(args, \"since\"), now);\n  const clients = clientsFrom(args);\n  const home = homeFrom(io);\n  const repo = findRepo(resolve(io.cwd, flagString(args, \"repo\") ?? \".\"));\n  const policyPath = resolve(\n    repo.checkout,\n    flagString(args, \"config\") ?? io.env.AGENTGUARD_CONFIG ?? \"agentguard.yaml\",\n  );\n\n  // the rules\n  const files = readRuleFiles(repo.checkout, flagList(args, \"rules\"));\n  const config = readConfigRules(policyPath);\n  const { rules, errors } = extractRules(files, config.rules, \"agentguard.yaml\");\n  const warnings = [\n    ...(config.warning ? [config.warning] : []),\n    ...errors.map((e) => `${e.file}:${e.line}: ${e.message}`),\n  ];\n  const checks = rules.flatMap((r) => r.checks);\n  const keys = [...new Set(checks.map((c) => c.key))];\n\n  if (flagBool(args, \"enforce\")) return enforce(args, io, rules, policyPath, repo.checkout, json);\n\n  // the sessions\n  const dirs = sourceDirs(io.env, home, {\n    claudeDir: flagString(args, \"claude-dir\"),\n    codexDir: flagString(args, \"codex-dir\"),\n  });\n  const groups: TranscriptGroup[] = [\n    ...(clients.includes(\"claude-code\")\n      ? claudeGroups(claudeProjectDirs(dirs[\"claude-code\"], repo.root))\n      : []),\n    ...(clients.includes(\"codex\") ? codexGroups(dirs.codex) : []),\n  ];\n  const cache = new AuditCache(\n    resolve(io.cwd, flagString(args, \"cache-dir\") ?? join(home, \".agentguard\")),\n    sha(repo.root),\n    flagBool(args, \"cache\") !== false,\n  );\n  const inRepo = repoMatcher(repo.root);\n  const ctx: AuditContext = {\n    repoRoot: repo.root,\n    home,\n    tmpDirs: [\n      tmpdir(),\n      io.env.TMPDIR ?? \"\",\n      \"/tmp\",\n      \"/private/tmp\",\n      \"/var/folders\",\n      \"/private/var/folders\",\n    ].filter(Boolean),\n  };\n  const counts: Record<AuditClient, SourceCount> = {\n    \"claude-code\": { transcripts: 0, read: 0, cached: 0, retained: 0, older: 0 },\n    codex: { transcripts: 0, read: 0, cached: 0, retained: 0, older: 0 },\n  };\n  const entries: Entry[] = [];\n  const evidence = !json && flagBool(args, \"evidence\") !== false;\n  await pool(groups, 6, async (group) => {\n    const c = counts[group.client];\n    c.transcripts += group.files.length;\n    const hit = cache.lookup(group, keys);\n    if (hit) {\n      c.cached += group.files.length;\n      entries.push({ group, audit: hit });\n      return;\n    }\n    if (since !== undefined && group.lastWrite < since) {\n      c.older += group.files.length;\n      return;\n    }\n    let read;\n    try {\n      read = await readGroup(group, { inRepo });\n    } catch {\n      return; // unreadable (permissions, deleted mid-run): skip, never fail the audit\n    }\n    c.read += group.files.length;\n    const audit = evaluateChecks(checks, read, ctx);\n    cache.store(group, audit);\n    const hasBreaks = Object.values(audit.checks).some((o) => o.breaks.length > 0);\n    entries.push({\n      group,\n      audit,\n      ...(evidence && hasBreaks\n        ? { steps: new Map(read.steps.map((s) => [stableHash(s.id), s])) }\n        : {}),\n    });\n  });\n  const present = new Set(groups.map((g) => cache.groupKey(g)));\n  for (const client of clients)\n    for (const audit of cache.retained(present, client)) {\n      counts[client].retained += 1;\n      entries.push({ audit });\n    }\n\n  const summary = summarizeAudit(\n    rules,\n    entries.map((e) => e.audit),\n    { since },\n  );\n  const plan = planEnforcement(rules);\n  const enforceable = new Set([\n    ...plan.items.map((i) => i.rule.id),\n    ...plan.builtins.map((b) => b.rule.id),\n    ...plan.irreversible.map((r) => r.rule.id),\n  ]);\n\n  if (json) {\n    io.out(\n      JSON.stringify(\n        {\n          tool: \"agentguard audit\",\n          version: version(),\n          repo: repo.root,\n          checkout: repo.checkout,\n          since: since === undefined ? null : new Date(since).toISOString(),\n          until: now.toISOString(),\n          rule_files: files.map((f) => f.path),\n          sources: counts,\n          sessions: {\n            total: summary.sessions,\n            \"claude-code\": summary.sessionsByClient[\"claude-code\"],\n            codex: summary.sessionsByClient.codex,\n          },\n          unread_tool_calls: summary.unread,\n          rules: summary.rules.map((r) => ({\n            id: r.rule.id,\n            n: r.rule.n,\n            file: r.rule.file,\n            line: r.rule.line,\n            text: r.rule.text,\n            status: r.status,\n            checkable: r.rule.checks.length > 0,\n            ...(r.rule.silenced ? { marked_not_checkable: true } : {}),\n            sessions_broken: r.sessionsBroken,\n            last_broken: r.last.map((b) => new Date(b.at).toISOString()),\n            checks: r.checks.map((c, k) => ({\n              check: c.label,\n              kind: c.kind,\n              via: c.via,\n              enforce: enforceTarget(r.rule.checks[k]!),\n              sessions_applicable: c.sessionsApplicable,\n              sessions_broken: c.sessionsBroken,\n              sessions_on_request: c.sessionsOnRequest,\n              sessions_undetermined: c.sessionsUndetermined,\n              breaks: c.breaks,\n              refused: c.refused,\n            })),\n          })),\n          not_checkable: {\n            count: summary.rules.filter((r) => r.status === \"not-checkable\").length,\n            hint: NOT_CHECKABLE_HINT,\n          },\n          warnings,\n          enforce: {\n            command: \"agentguard audit --enforce\",\n            rules: enforceable.size,\n            note: \"writes hook-mode rules into agentguard.yaml in dry-run; nothing is blocked until hooks.mode is enforce\",\n          },\n          team_history: { available: false, url: TEAM_HISTORY_URL },\n          privacy:\n            \"counts, rule ids and dates only: no command, path or prompt from a transcript is in this output, and nothing was sent anywhere\",\n        },\n        null,\n        2,\n      ),\n    );\n    return 0;\n  }\n\n  // evidence for the latest breaks, on this screen only\n  const lines = new Map<string, string>();\n  if (evidence) {\n    const wanted = new Map<number, LocatedBreak[]>();\n    for (const r of summary.rules)\n      for (const b of r.last) {\n        const list = wanted.get(b.group) ?? [];\n        list.push(b);\n        wanted.set(b.group, list);\n      }\n    for (const [gi, breaks] of wanted) {\n      const entry = entries[gi];\n      if (!entry?.group) continue;\n      let steps = entry.steps;\n      if (!steps) {\n        try {\n          steps = await fetchSteps(entry.group, breaks, { inRepo });\n        } catch {\n          continue;\n        }\n      }\n      for (const b of breaks) {\n        const step = steps.get(b.step);\n        if (step) lines.set(`${gi}:${b.step}:${b.what}:${b.index}`, describeStep(step, b, ctx));\n      }\n    }\n  }\n\n  renderHuman(io, {\n    root: repo.root,\n    since,\n    files: files.map((f) => f.path),\n    counts,\n    clients,\n    summary,\n    evidence: evidence\n      ? (b) =>\n          lines.get(`${b.group}:${b.step}:${b.what}:${b.index}`) ?? \"(transcript no longer on disk)\"\n      : () => undefined,\n    enforceable: enforceable.size,\n    warnings,\n  });\n  return 0;\n}\n\ninterface View {\n  root: string;\n  since?: number;\n  files: string[];\n  counts: Record<AuditClient, SourceCount>;\n  clients: AuditClient[];\n  summary: ReturnType<typeof summarizeAudit>;\n  evidence: (b: LocatedBreak) => string | undefined;\n  enforceable: number;\n  warnings: string[];\n}\n\nfunction ruleHead(r: RuleSummary): string {\n  const id = `R${r.rule.n}`.padEnd(4);\n  return `  ${id} ${clip(r.rule.text, 78)}   (${r.rule.file}:${r.rule.line})`;\n}\n\nfunction renderHuman(io: Io, v: View): void {\n  const s = v.summary;\n  const window = v.since === undefined ? \"all history\" : `since ${localDay(v.since)}`;\n  io.out(`agentguard audit — ${v.root} · ${window}`);\n  const read = v.clients.map((c) => {\n    const n = v.counts[c];\n    const parts = [`${n.read} read`, `${n.cached} from cache`];\n    if (n.retained) parts.push(`${n.retained} kept from deleted transcripts`);\n    if (n.older) parts.push(`${n.older} older than the window`);\n    return `${CLIENT_LABEL[c]}: ${plural(n.transcripts, \"transcript\")} (${parts.join(\", \")})`;\n  });\n  io.out(read.join(\" · \"));\n  const byClient = v.clients\n    .filter((c) => s.sessionsByClient[c] > 0)\n    .map((c) => `${CLIENT_LABEL[c]} ${s.sessionsByClient[c]}`);\n  io.out(\n    `${plural(s.sessions, \"session\")} in this repository${byClient.length ? ` (${byClient.join(\", \")})` : \"\"}. Read on this machine; nothing was sent anywhere.`,\n  );\n  if (s.unread > 0)\n    io.out(\n      `${plural(s.unread, \"Codex tool call\")} ran JavaScript (\\`exec\\`), not a command line, and ${s.unread === 1 ? \"was\" : \"were\"} not read.`,\n    );\n  for (const w of v.warnings) io.out(`warning: ${w}`);\n  io.out(\"\");\n\n  if (v.files.length === 0 && s.rules.length === 0) {\n    io.out(\n      \"No rule files here (CLAUDE.md, AGENTS.md, GEMINI.md, .cursor/rules, …) and no audit.rules in agentguard.yaml: nothing to audit.\",\n    );\n    io.out(\"\");\n    io.out(TEAM_HISTORY_LINE);\n    return;\n  }\n  const checkable = s.rules.filter((r) => r.status !== \"not-checkable\");\n  const perFile = new Map<string, number>();\n  for (const r of s.rules) perFile.set(r.rule.file, (perFile.get(r.rule.file) ?? 0) + 1);\n  io.out(\n    `${plural(s.rules.length, \"rule\")} found (${[...perFile].map(([f, n]) => `${n} in ${f}`).join(\", \")}); ${checkable.length} checkable.`,\n  );\n  if (s.sessions === 0)\n    io.out(\n      `No Claude Code or Codex sessions in ${v.root} ${window}. Transcripts are read from ~/.claude/projects and ~/.codex/sessions (--claude-dir, --codex-dir); try --since 30d or --since all.`,\n    );\n\n  const section = (title: string, list: RuleSummary[], body: (r: RuleSummary) => void): void => {\n    if (list.length === 0) return;\n    io.out(\"\");\n    io.out(title);\n    for (const r of list) {\n      io.out(ruleHead(r));\n      body(r);\n    }\n  };\n  const checkLines = (r: RuleSummary): void => {\n    r.rule.checks.forEach((check, k) => {\n      const c = r.checks[k]!;\n      const noun = applicableNoun(c.kind, check.spec);\n      const scope = noun ? ` (${c.sessionsApplicable} ${noun})` : \"\";\n      let verdict: string;\n      if (c.sessionsBroken > 0) {\n        verdict = `broken in ${c.sessionsBroken} of ${s.sessions} sessions${scope}`;\n        const extra: string[] = [];\n        if (c.breaks > c.sessionsBroken) extra.push(`${c.breaks} times`);\n        if (c.sessionsOnRequest > 0)\n          extra.push(`${c.sessionsOnRequest} on a turn that asked for it`);\n        if (c.refused > 0) extra.push(`${c.refused} refused by the harness`);\n        if (extra.length) verdict += `; ${extra.join(\", \")}`;\n      } else if (c.sessionsApplicable > 0 || !noun) {\n        const n = noun ? c.sessionsApplicable : s.sessions;\n        verdict =\n          n === 1\n            ? `kept in the 1 session${noun ? ` that ${noun}` : \"\"}`\n            : `kept in all ${n} sessions${noun ? ` that ${noun}` : \"\"}`;\n      } else verdict = `nothing in these sessions could break it`;\n      if (c.sessionsUndetermined > 0)\n        verdict += `; ${c.sessionsUndetermined} more in sessions that do not say who asked (Codex)`;\n      io.out(`       ${c.label} — ${verdict}`);\n    });\n    for (const b of r.last) {\n      const what = v.evidence(b);\n      io.out(\n        `         ${localTime(b.at)}${what ? `  ${what}` : \"\"}${b.refused ? \"  [refused]\" : \"\"}${b.asked ? \"  [asked]\" : \"\"}  · session ${b.session.slice(0, 8)}`,\n      );\n    }\n  };\n  section(\n    \"BROKEN\",\n    s.rules\n      .filter((r) => r.status === \"broken\")\n      .sort((a, b) => b.sessionsBroken - a.sessionsBroken),\n    checkLines,\n  );\n  section(\n    \"KEPT\",\n    s.rules.filter((r) => r.status === \"kept\"),\n    checkLines,\n  );\n  section(\n    \"NOTHING IN THESE SESSIONS COULD BREAK IT\",\n    s.rules.filter((r) => r.status === \"not-applicable\"),\n    checkLines,\n  );\n  const notCheckable = s.rules.filter((r) => r.status === \"not-checkable\");\n  if (notCheckable.length > 0) {\n    io.out(\"\");\n    io.out(\n      `NOT CHECKABLE MECHANICALLY (${notCheckable.length}) — ${NOT_CHECKABLE_HINT.replace(/^not checkable mechanically — /, \"\")}`,\n    );\n    for (const r of notCheckable)\n      io.out(`${ruleHead(r)}${r.rule.silenced ? \"  [marked none]\" : \"\"}`);\n  }\n  io.out(\"\");\n  if (v.enforceable > 0)\n    io.out(\n      `Enforce: agentguard audit --enforce   writes ${plural(v.enforceable, \"rule\")} into agentguard.yaml as hook rules, in dry-run (nothing is blocked until hooks.mode: enforce)`,\n    );\n  io.out(TEAM_HISTORY_LINE);\n}\n\nasync function enforce(\n  args: ParsedArgs,\n  io: Io,\n  rules: Rule[],\n  policyPath: string,\n  checkout: string,\n  json: boolean,\n): Promise<number> {\n  const plan = planEnforcement(rules);\n  const preview = flagBool(args, \"preview\") === true;\n  const edit = applyEnforcePlan(policyPath, plan);\n  const diff = lineDiff(edit.before, edit.after);\n  const changed = edit.before !== edit.after;\n  const blocked = edit.mode === \"enforce\" && flagBool(args, \"yes\") !== true;\n  const write = changed && !preview && !blocked;\n  if (write) writeFileSync(policyPath, edit.after);\n\n  // the hook: install it (project level) if no agentguard hook is in place for Claude Code\n  const home = homeFrom(io);\n  const installed = ([\"project\", \"user\"] as const).some((scope) => {\n    try {\n      return (\n        installedHandlers(hookTarget(\"claude-code\", scope, { cwd: checkout, home }, \"\")).length > 0\n      );\n    } catch {\n      return true; // an unreadable settings file: leave it to `hooks status`\n    }\n  });\n  let hookInstalled = installed;\n  const hookOut: string[] = [];\n  if (!installed && !preview && !blocked) {\n    const sub: Io = { ...io, cwd: checkout, out: (l) => hookOut.push(l) };\n    const passthrough = [\"hooks\", \"install\"];\n    const config = flagString(args, \"config\");\n    if (config) passthrough.push(\"--config\", resolve(io.cwd, config));\n    const command = flagString(args, \"command\");\n    if (command) passthrough.push(\"--command\", command);\n    await hooksCommand(parseArgs(passthrough), sub);\n    hookInstalled = true;\n  }\n\n  if (json) {\n    io.out(\n      JSON.stringify(\n        {\n          policy: policyPath,\n          written: write,\n          preview,\n          hooks_mode: edit.mode,\n          added: edit.added,\n          audit_only: plan.auditOnly.map((a) => ({\n            rule: a.rule.id,\n            check: a.check.label,\n            why: a.why,\n          })),\n          notes: plan.notes,\n          hook_installed: hookInstalled,\n        },\n        null,\n        2,\n      ),\n    );\n    return blocked && changed ? 1 : 0;\n  }\n\n  if (!changed)\n    io.out(`agentguard.yaml already has a hook rule for every enforceable rule (${policyPath}).`);\n  else {\n    io.out(\n      `${write ? (edit.created ? \"wrote\" : \"updated\") : \"would update\"} ${policyPath} — ${plural(edit.added.length, \"hook rule\")}:`,\n    );\n    for (const line of diff) io.out(`  ${line}`);\n  }\n  if (plan.auditOnly.length > 0) {\n    io.out(\"\");\n    io.out(\"Audit only (a pre-execution hook cannot check these):\");\n    for (const a of plan.auditOnly) io.out(`  R${a.rule.n} ${a.check.label} — ${a.why}`);\n  }\n  if (plan.notes.length > 0) {\n    io.out(\"\");\n    for (const n of plan.notes) io.out(`note: ${n}`);\n  }\n  io.out(\"\");\n  if (blocked && changed) {\n    io.out(\n      \"hooks.mode is enforce in this agentguard.yaml, so these rules would block at once. Nothing was written. Rerun with --enforce --yes to add them anyway, or set hooks.mode: dry-run first.\",\n    );\n    return 1;\n  }\n  if (preview) {\n    io.out(\"Preview only: nothing was written. Run agentguard audit --enforce to write it.\");\n    return 0;\n  }\n  for (const l of hookOut) io.out(l);\n  if (installed) io.out(\"The agentguard hook is already installed (agentguard hooks status).\");\n  io.out(\n    `hooks.mode is ${edit.mode}: ${edit.mode === \"dry-run\" ? \"every decision is logged and nothing is blocked. Read agentguard report, then set hooks.mode: enforce yourself.\" : \"the rules apply from the next session.\"}`,\n  );\n  return 0;\n}\n","/**\n * The audit's own copy of the counts, one small file per transcript group under\n * `~/.agentguard/audit-cache-v1/`, the way seatledger keeps its own (PROD-1A):\n *\n * 1. Speed: a group whose files are unchanged (same size and mtime) is not read again for checks\n *    it already answered.\n * 2. History: Claude Code deletes transcripts older than `cleanupPeriodDays` (30 by default). The\n *    counts already taken from a deleted transcript stay here, so a 30- or 90-day audit keeps its\n *    history. Delete the directory to forget it.\n *\n * Only what `GroupAudit` holds is written — session ids, times, line numbers, hashed call ids and\n * per-check counts — plus SHA-256 hashes of the repository and transcript paths. Never a command,\n * a path, a prompt or anything else a transcript says.\n */\nimport { createHash } from \"node:crypto\";\nimport { mkdirSync, readFileSync, readdirSync, renameSync, writeFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport type {\n  AuditClient,\n  CheckBreak,\n  CheckOutcome,\n  GroupAudit,\n} from \"@agentwares/agentguard-core\";\nimport type { TranscriptGroup } from \"./sources.js\";\n\nexport const CACHE_DIR = \"audit-cache-v1\";\n/** Bump when the readers or the checks change what they count: every entry is then re-read. */\nexport const ENGINE = \"1\";\n\nexport const sha = (text: string): string => createHash(\"sha256\").update(text).digest(\"hex\");\n\ntype WireBreak = [\n  at: number,\n  session: string,\n  step: string,\n  file: number,\n  line: number,\n  what: 0 | 1 | 2,\n  index: number,\n  asked: 0 | 1 | 2,\n  refused: 0 | 1,\n];\n\ninterface Wire {\n  v: 1;\n  engine: string;\n  repo: string;\n  group: string;\n  client: AuditClient;\n  files: [src: string, size: number, mtimeMs: number][];\n  sessions: [id: string, client: AuditClient, start: number, end: number, turnsKnown: 0 | 1][];\n  unread: number;\n  checks: Record<string, { a: string[]; b: WireBreak[] }>;\n}\n\nexport interface CacheEntry {\n  repo: string;\n  group: string;\n  client: AuditClient;\n  files: [string, number, number][];\n  audit: GroupAudit;\n}\n\nconst WHAT = [\"command\", \"path\", \"call\"] as const;\n\nfunction encodeBreak(b: CheckBreak): WireBreak {\n  return [\n    b.at,\n    b.session,\n    b.step,\n    b.file,\n    b.line,\n    WHAT.indexOf(b.what) as 0 | 1 | 2,\n    b.index,\n    b.asked === null ? 2 : b.asked ? 1 : 0,\n    b.refused ? 1 : 0,\n  ];\n}\n\nfunction decodeBreak(w: WireBreak): CheckBreak {\n  return {\n    at: w[0],\n    session: w[1],\n    step: w[2],\n    file: w[3],\n    line: w[4],\n    what: WHAT[w[5]] ?? \"call\",\n    index: w[6],\n    asked: w[7] === 2 ? null : w[7] === 1,\n    refused: w[8] === 1,\n  };\n}\n\nexport function fileSignature(group: TranscriptGroup): [string, number, number][] {\n  return group.files.map((f) => [sha(f.path), f.size, Math.round(f.mtimeMs)]);\n}\n\nexport class AuditCache {\n  private readonly dir: string;\n  private readonly entries = new Map<string, CacheEntry>();\n\n  constructor(\n    home: string,\n    private readonly repo: string,\n    private readonly enabled = true,\n  ) {\n    this.dir = join(home, CACHE_DIR);\n    if (!enabled) return;\n    let names: string[];\n    try {\n      names = readdirSync(this.dir);\n    } catch {\n      return;\n    }\n    for (const name of names) {\n      if (!name.endsWith(\".json\")) continue;\n      try {\n        const w = JSON.parse(readFileSync(join(this.dir, name), \"utf8\")) as Wire;\n        if (w.v !== 1 || w.engine !== ENGINE || w.repo !== repo) continue;\n        this.entries.set(w.group, {\n          repo: w.repo,\n          group: w.group,\n          client: w.client,\n          files: w.files,\n          audit: {\n            sessions: w.sessions.map(([id, client, start, end, known]) => ({\n              id,\n              client,\n              start,\n              end,\n              turnsKnown: known === 1,\n            })),\n            unread: w.unread,\n            checks: Object.fromEntries(\n              Object.entries(w.checks).map(([k, c]): [string, CheckOutcome] => [\n                k,\n                { applicable: c.a, breaks: c.b.map(decodeBreak) },\n              ]),\n            ),\n          },\n        });\n      } catch {\n        // a partial write from an interrupted run: re-read from the transcript\n      }\n    }\n  }\n\n  groupKey(group: TranscriptGroup): string {\n    return sha(`${this.repo}\\u0000${group.key}`);\n  }\n\n  /** The cached counts for a group, if its files are unchanged and every check is answered. */\n  lookup(group: TranscriptGroup, keys: readonly string[]): GroupAudit | undefined {\n    const hit = this.entries.get(this.groupKey(group));\n    if (!hit) return undefined;\n    if (JSON.stringify(hit.files) !== JSON.stringify(fileSignature(group))) return undefined;\n    if (!keys.every((k) => hit.audit.checks[k])) return undefined;\n    return hit.audit;\n  }\n\n  /** Counts kept from groups whose transcripts are gone (deleted by the client's cleanup). */\n  retained(present: ReadonlySet<string>, client: AuditClient): GroupAudit[] {\n    const out: GroupAudit[] = [];\n    for (const e of this.entries.values())\n      if (e.client === client && !present.has(e.group)) out.push(e.audit);\n    return out;\n  }\n\n  /** Best effort: a cache that cannot be written only costs speed and history. */\n  store(group: TranscriptGroup, audit: GroupAudit): void {\n    const key = this.groupKey(group);\n    const files = fileSignature(group);\n    const prev = this.entries.get(key);\n    // checks this run did not ask for stay valid while the files are unchanged\n    const checks =\n      prev && JSON.stringify(prev.files) === JSON.stringify(files)\n        ? { ...prev.audit.checks, ...audit.checks }\n        : audit.checks;\n    const merged: GroupAudit = { ...audit, checks };\n    this.entries.set(key, {\n      repo: this.repo,\n      group: key,\n      client: group.client,\n      files,\n      audit: merged,\n    });\n    if (!this.enabled) return;\n    const wire: Wire = {\n      v: 1,\n      engine: ENGINE,\n      repo: this.repo,\n      group: key,\n      client: group.client,\n      files,\n      sessions: merged.sessions.map((s) => [s.id, s.client, s.start, s.end, s.turnsKnown ? 1 : 0]),\n      unread: merged.unread,\n      checks: Object.fromEntries(\n        Object.entries(merged.checks).map(([k, c]) => [\n          k,\n          { a: c.applicable, b: c.breaks.map(encodeBreak) },\n        ]),\n      ),\n    };\n    try {\n      mkdirSync(this.dir, { recursive: true, mode: 0o700 });\n      const file = join(this.dir, `${key.slice(0, 32)}.json`);\n      const tmp = `${file}.${process.pid}.tmp`;\n      writeFileSync(tmp, JSON.stringify(wire), { mode: 0o600 });\n      renameSync(tmp, file);\n    } catch {\n      // read-only home, full disk: the next run reads the transcripts again\n    }\n  }\n}\n","/**\n * `agentguard audit --enforce`: write the plan `planEnforcement` made into agentguard.yaml with\n * the `yaml` document API, so every comment and setting already there stays. Each added rule\n * carries a comment naming the rule it came from. `hooks.mode` is never touched: a new policy, or\n * a new hooks block, starts in dry-run.\n */\nimport { existsSync, readFileSync } from \"node:fs\";\nimport YAML, { isMap, isScalar, isSeq, type Document, type Scalar, type YAMLSeq } from \"yaml\";\nimport type { EnforcePlan, Rule } from \"@agentwares/agentguard-core\";\nimport { HOOKS_POLICY_BLOCK, renderHooksStarterPolicy } from \"../commands/hooks.js\";\n\nexport interface EnforceEdit {\n  /** the policy before (empty when there was none) and after */\n  before: string;\n  after: string;\n  created: boolean;\n  /** one line per hook rule added */\n  added: string[];\n  mode: \"dry-run\" | \"enforce\";\n}\n\nconst origin = (rule: Rule): string => ` R${rule.n} ${rule.file}:${rule.line}`;\n\nfunction seqAt(doc: Document, path: string[]): YAMLSeq {\n  let node = doc.getIn(path, true);\n  if (!isSeq(node)) {\n    doc.setIn(path, doc.createNode([]));\n    node = doc.getIn(path, true);\n  }\n  const seq = node as YAMLSeq;\n  seq.flow = false;\n  return seq;\n}\n\nconst values = (seq: YAMLSeq): string[] =>\n  seq.items.map((n) => (isScalar(n) ? String(n.value) : \"\")).map((v) => v.toLowerCase());\n\n/** The policy text with the plan applied. Throws on a policy that is not valid YAML. */\nexport function applyEnforcePlan(\n  policyPath: string,\n  plan: EnforcePlan,\n  now = new Date(),\n): EnforceEdit {\n  const created = !existsSync(policyPath);\n  const before = created ? \"\" : readFileSync(policyPath, \"utf8\");\n  let text = created ? renderHooksStarterPolicy(now) : before;\n  if (!/^hooks\\s*:/m.test(text)) text = `${text.replace(/\\n*$/, \"\\n\")}${HOOKS_POLICY_BLOCK}`;\n  const doc = YAML.parseDocument(text);\n  if (doc.errors.length > 0)\n    throw new Error(`${policyPath} is not valid YAML: ${doc.errors[0]!.message}`);\n  const added: string[] = [];\n\n  for (const item of plan.items) {\n    const seq = seqAt(doc, item.list.split(\".\"));\n    if (values(seq).includes(item.pattern.toLowerCase())) continue;\n    const node = doc.createNode(item.pattern) as Scalar;\n    node.comment = origin(item.rule);\n    seq.items.push(node);\n    added.push(`${item.list}: ${item.pattern}  (R${item.rule.n}, ${item.check.label})`);\n  }\n\n  if (plan.builtins.length > 0) {\n    const path = [\"hooks\", \"irreversible\", \"builtins\"];\n    const node = doc.getIn(path, true);\n    const enabled = isScalar(node) ? node.value : undefined;\n    if (enabled === false || isSeq(node)) {\n      const seq = seqAt(doc, path);\n      for (const b of plan.builtins) {\n        if (values(seq).includes(b.name)) continue;\n        const scalar = doc.createNode(b.name) as Scalar;\n        scalar.comment = origin(b.rule);\n        seq.items.push(scalar);\n        added.push(`hooks.irreversible.builtins: ${b.name}  (R${b.rule.n}, ${b.check.label})`);\n      }\n    }\n    // `true` or absent: every built-in class is already on\n  }\n\n  if (plan.irreversible.length > 0) {\n    const seq = seqAt(doc, [\"hooks\", \"irreversible\", \"rules\"]);\n    const names = new Set(\n      seq.items.map((n) => (isMap(n) ? String(n.get(\"name\") ?? \"\") : \"\")).filter(Boolean),\n    );\n    for (const r of plan.irreversible) {\n      if (names.has(r.name)) continue;\n      const node = doc.createNode({ name: r.name, shell: r.shell, mentions: r.mentions });\n      if (isMap(node)) node.commentBefore = origin(r.rule);\n      seq.items.push(node);\n      added.push(\n        `hooks.irreversible.rules: ${r.name} (${r.shell.length} commands)  (R${r.rule.n}, ${r.check.label})`,\n      );\n    }\n  }\n\n  const mode = doc.getIn([\"hooks\", \"mode\"]) === \"enforce\" ? \"enforce\" : \"dry-run\";\n  return { before, after: doc.toString({ lineWidth: 0 }), created, added, mode };\n}\n\n/** A unified-style line diff, with `context` unchanged lines around each change. */\nexport function lineDiff(a: string, b: string, context = 2): string[] {\n  const x = a === \"\" ? [] : a.replace(/\\n$/, \"\").split(\"\\n\");\n  const y = b.replace(/\\n$/, \"\").split(\"\\n\");\n  const n = x.length;\n  const m = y.length;\n  // longest common subsequence, small files only\n  const lcs: number[][] = Array.from({ length: n + 1 }, () => new Array<number>(m + 1).fill(0));\n  for (let i = n - 1; i >= 0; i -= 1)\n    for (let j = m - 1; j >= 0; j -= 1)\n      lcs[i]![j] =\n        x[i] === y[j] ? lcs[i + 1]![j + 1]! + 1 : Math.max(lcs[i + 1]![j]!, lcs[i]![j + 1]!);\n  const ops: { op: \" \" | \"+\" | \"-\"; line: string }[] = [];\n  let i = 0;\n  let j = 0;\n  while (i < n || j < m) {\n    if (i < n && j < m && x[i] === y[j]) {\n      ops.push({ op: \" \", line: x[i]! });\n      i += 1;\n      j += 1;\n    } else if (j < m && (i >= n || lcs[i]![j + 1]! >= lcs[i + 1]![j]!)) {\n      ops.push({ op: \"+\", line: y[j]! });\n      j += 1;\n    } else {\n      ops.push({ op: \"-\", line: x[i]! });\n      i += 1;\n    }\n  }\n  const keep = new Set<number>();\n  ops.forEach((o, k) => {\n    if (o.op === \" \") return;\n    for (let d = -context; d <= context; d += 1) keep.add(k + d);\n  });\n  const out: string[] = [];\n  let last = -2;\n  ops.forEach((o, k) => {\n    if (!keep.has(k)) return;\n    if (k !== last + 1 && out.length > 0) out.push(\"  …\");\n    out.push(`${o.op} ${o.line}`);\n    last = k;\n  });\n  return out;\n}\n","/**\n * Stream a transcript group through agentguard-core's readers. Transcripts run to hundreds of\n * megabytes and most of every line is text the audit never needs, so a substring test decides\n * which lines are parsed at all. Nothing read here is written anywhere: the readers' steps and\n * turns stay in memory, and only `evaluateChecks`' counts reach the cache.\n */\nimport { createReadStream } from \"node:fs\";\nimport { createInterface } from \"node:readline\";\nimport {\n  ClaudeCodeAuditReader,\n  CodexAuditReader,\n  stableHash,\n  type AuditReaderOptions,\n  type AuditStep,\n  type TranscriptAudit,\n} from \"@agentwares/agentguard-core\";\nimport type { TranscriptGroup } from \"./sources.js\";\n\nconst CLAUDE_WANTED = (raw: string): boolean =>\n  raw.includes('\"type\":\"assistant\"') || raw.includes('\"type\":\"user\"');\nconst CODEX_WANTED = (raw: string): boolean =>\n  raw.includes('\"session_meta\"') ||\n  raw.includes('\"turn_context\"') ||\n  raw.includes('\"function_call\"') ||\n  raw.includes('\"local_shell_call\"') ||\n  raw.includes('\"custom_tool_call\"');\n\n/**\n * Each line of a file, 1-based. `onLine` returns false to stop early. Lines that are not JSON\n * (a transcript being written ends mid-line) are skipped.\n */\nasync function eachLine(\n  path: string,\n  wanted: (raw: string, line: number) => boolean,\n  onLine: (value: unknown, line: number) => boolean | void,\n): Promise<void> {\n  const stream = createReadStream(path, { encoding: \"utf8\", highWaterMark: 1 << 20 });\n  const lines = createInterface({ input: stream, crlfDelay: Infinity });\n  let n = 0;\n  try {\n    for await (const raw of lines) {\n      n += 1;\n      if (raw.length === 0 || !wanted(raw, n)) continue;\n      let value: unknown;\n      try {\n        value = JSON.parse(raw);\n      } catch {\n        continue;\n      }\n      if (onLine(value, n) === false) break;\n    }\n  } finally {\n    lines.close();\n    stream.destroy();\n  }\n}\n\n/** Every step and turn in a group that happened in the repository. */\nexport async function readGroup(\n  group: TranscriptGroup,\n  opts: AuditReaderOptions,\n): Promise<TranscriptAudit> {\n  if (group.client === \"codex\") {\n    const reader = new CodexAuditReader(opts);\n    await eachLine(group.files[0]!.path, CODEX_WANTED, (value, line) => {\n      reader.add(value, line, 0);\n      return reader.relevant;\n    });\n    return reader.result();\n  }\n  const reader = new ClaudeCodeAuditReader(opts);\n  for (const [i, file] of group.files.entries())\n    await eachLine(file.path, CLAUDE_WANTED, (value, line) => reader.add(value, line, i));\n  return reader.result();\n}\n\n/**\n * The steps behind a few breaks, for the evidence on screen: only the lines that hold them are\n * parsed (and, for Codex, the lines that say where the rollout ran).\n */\nexport async function fetchSteps(\n  group: TranscriptGroup,\n  wanted: readonly { file: number; line: number; step: string }[],\n  opts: AuditReaderOptions,\n): Promise<Map<string, AuditStep>> {\n  const out = new Map<string, AuditStep>();\n  const byFile = new Map<number, Set<number>>();\n  for (const w of wanted) {\n    const set = byFile.get(w.file) ?? new Set<number>();\n    set.add(w.line);\n    byFile.set(w.file, set);\n  }\n  for (const [fileIndex, lines] of byFile) {\n    const file = group.files[fileIndex];\n    if (!file) continue;\n    const last = Math.max(...lines);\n    const reader =\n      group.client === \"codex\" ? new CodexAuditReader(opts) : new ClaudeCodeAuditReader(opts);\n    await eachLine(\n      file.path,\n      (raw, n) =>\n        lines.has(n) ||\n        (group.client === \"codex\" &&\n          (raw.includes('\"session_meta\"') || raw.includes('\"turn_context\"'))),\n      (value, n) => {\n        reader.add(value, n, fileIndex);\n        return n < last;\n      },\n    );\n    for (const step of reader.result().steps) out.set(stableHash(step.id), step);\n  }\n  return out;\n}\n","/**\n * The repository being audited: where its rule files are, and which working directories count\n * as \"in it\" when matching sessions.\n */\nimport { existsSync, readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { dirname, isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport YAML from \"yaml\";\nimport {\n  AuditRulesSchema,\n  isWithin,\n  normalizePath,\n  type ConfigRule,\n  type RuleFileInput,\n} from \"@agentwares/agentguard-core\";\nimport { pathForms } from \"./sources.js\";\n\nexport interface AuditRepo {\n  /** where the rule files are read from: the checkout the command ran in */\n  checkout: string;\n  /**\n   * the repository sessions are matched against: the main checkout when `checkout` is a git\n   * worktree, so sessions in its other worktrees (`.claude/worktrees/*`) count too\n   */\n  root: string;\n}\n\n/** The git checkout holding `cwd` (or `cwd` itself outside git), and its main checkout. */\nexport function findRepo(cwd: string): AuditRepo {\n  let dir = resolve(cwd);\n  for (let i = 0; i < 64; i += 1) {\n    const dotgit = join(dir, \".git\");\n    if (existsSync(dotgit)) {\n      let root = dir;\n      try {\n        if (statSync(dotgit).isFile()) {\n          // a worktree: `gitdir: <main>/.git/worktrees/<name>`\n          const m = /^gitdir:\\s*(.+)$/m.exec(readFileSync(dotgit, \"utf8\"));\n          const gitdir = m ? resolve(dir, m[1]!.trim()) : \"\";\n          const at = gitdir.lastIndexOf(`${sep}.git${sep}worktrees${sep}`);\n          if (at > 0) root = gitdir.slice(0, at);\n        }\n      } catch {\n        // unreadable .git file: audit this checkout alone\n      }\n      return { checkout: dir, root };\n    }\n    const parent = dirname(dir);\n    if (parent === dir) break;\n    dir = parent;\n  }\n  return { checkout: resolve(cwd), root: resolve(cwd) };\n}\n\n/** Is a session's working directory inside the repository (in any form its path can take)? */\nexport function repoMatcher(root: string): (cwd: string) => boolean {\n  const forms = pathForms(root).map(normalizePath);\n  return (cwd: string) => forms.some((f) => isWithin(normalizePath(cwd), f));\n}\n\n/** Rule files at the root of a checkout, as agentsmd-lint looks for them, plus Cursor's rules. */\nexport const RULE_FILES = [\n  \"CLAUDE.md\",\n  \"CLAUDE.local.md\",\n  \".claude/CLAUDE.md\",\n  \"AGENTS.md\",\n  \"GEMINI.md\",\n  \".cursorrules\",\n  \".github/copilot-instructions.md\",\n  \".windsurfrules\",\n  \".clinerules\",\n] as const;\n\nconst MAX_CURSOR_RULES = 20;\nconst MAX_BYTES = 512 * 1024;\n\nfunction cursorRules(dir: string, out: string[], depth = 0): void {\n  if (depth > 3 || out.length >= MAX_CURSOR_RULES) return;\n  let entries;\n  try {\n    entries = readdirSync(dir, { withFileTypes: true });\n  } catch {\n    return;\n  }\n  for (const e of entries.sort((a, b) => a.name.localeCompare(b.name))) {\n    const p = join(dir, e.name);\n    if (e.isDirectory()) cursorRules(p, out, depth + 1);\n    else if (e.isFile() && /\\.(mdc|md)$/.test(e.name) && out.length < MAX_CURSOR_RULES) out.push(p);\n  }\n}\n\n/** The rule files this checkout has, repo-relative, plus any named with `--rules`. */\nexport function readRuleFiles(checkout: string, extra: readonly string[] = []): RuleFileInput[] {\n  const paths: string[] = RULE_FILES.map((f) => join(checkout, f));\n  cursorRules(join(checkout, \".cursor\", \"rules\"), paths);\n  for (const e of extra) paths.push(isAbsolute(e) ? e : resolve(checkout, e));\n  const out: RuleFileInput[] = [];\n  const seen = new Set<string>();\n  for (const p of paths) {\n    if (seen.has(p)) continue;\n    seen.add(p);\n    try {\n      if (!statSync(p).isFile()) continue;\n      const text = readFileSync(p, \"utf8\").slice(0, MAX_BYTES);\n      const rel = relative(checkout, p);\n      out.push({ path: rel.startsWith(\"..\") ? p : rel.split(sep).join(\"/\"), text });\n    } catch {\n      // absent\n    }\n  }\n  return out;\n}\n\n/**\n * `audit.rules` from agentguard.yaml, read on its own so a policy that fails for another reason\n * (an unset `${VAR}`, say) does not hide them. Returns a warning instead of throwing.\n */\nexport function readConfigRules(policyPath: string): { rules: ConfigRule[]; warning?: string } {\n  if (!existsSync(policyPath)) return { rules: [] };\n  let raw: unknown;\n  try {\n    raw = YAML.parse(readFileSync(policyPath, \"utf8\"));\n  } catch (err) {\n    return {\n      rules: [],\n      warning: `${policyPath} is not valid YAML (${err instanceof Error ? err.message : String(err)}); its audit.rules were skipped`,\n    };\n  }\n  const audit = raw && typeof raw === \"object\" ? (raw as Record<string, unknown>).audit : undefined;\n  const rules =\n    audit && typeof audit === \"object\" ? (audit as Record<string, unknown>).rules : undefined;\n  if (rules === undefined) return { rules: [] };\n  const parsed = AuditRulesSchema.safeParse(rules);\n  if (!parsed.success)\n    return {\n      rules: [],\n      warning: `audit.rules in ${policyPath} is invalid (${parsed.error.issues\n        .map((i) => `${i.path.join(\".\")}: ${i.message}`)\n        .join(\"; \")}); skipped`,\n    };\n  return { rules: parsed.data };\n}\n","/**\n * Where coding agents keep their transcripts, and which of them are about one repository.\n *\n * The layout is the one seatledger reads (apps/seatledger-cli/src/paths.ts, PROD-1A), kept in\n * step with it rather than imported: seatledger is not on npm yet, and the public agentguard repo\n * is generated without it (see docs/reports/AG-AUDIT.md).\n *\n * - Claude Code: `$CLAUDE_CONFIG_DIR/projects` (comma-separated for several), else\n *   `~/.claude/projects` and `~/.config/claude/projects`. One directory per working directory,\n *   named after its path with every character that is not a letter or digit turned into `-`;\n *   a session is `<session>.jsonl` there, its subagents under `<session>/subagents/`.\n * - Codex: `$CODEX_HOME/sessions` and `$CODEX_HOME/archived_sessions`, `CODEX_HOME` defaulting\n *   to `~/.codex`. One rollout per thread, by date; its first line names the working directory.\n */\nimport { existsSync, readdirSync, realpathSync, statSync } from \"node:fs\";\nimport { basename, join, resolve } from \"node:path\";\nimport type { AuditClient } from \"@agentwares/agentguard-core\";\n\nexport interface SourceDirs {\n  \"claude-code\": string[];\n  codex: string[];\n}\n\nexport function sourceDirs(\n  env: NodeJS.ProcessEnv,\n  home: string,\n  overrides: { claudeDir?: string; codexDir?: string } = {},\n): SourceDirs {\n  const claude = overrides.claudeDir\n    ? [resolve(overrides.claudeDir)]\n    : env.CLAUDE_CONFIG_DIR\n      ? env.CLAUDE_CONFIG_DIR.split(\",\")\n          .map((d) => d.trim())\n          .filter(Boolean)\n          .map((d) => join(resolve(d), \"projects\"))\n      : [join(home, \".claude\", \"projects\"), join(home, \".config\", \"claude\", \"projects\")];\n  const codexHome = env.CODEX_HOME ? resolve(env.CODEX_HOME) : join(home, \".codex\");\n  const codex = overrides.codexDir\n    ? [resolve(overrides.codexDir)]\n    : [join(codexHome, \"sessions\"), join(codexHome, \"archived_sessions\")];\n  return { \"claude-code\": claude, codex };\n}\n\nexport interface TranscriptFile {\n  path: string;\n  size: number;\n  mtimeMs: number;\n}\n\n/** What is read, cached and evaluated together: a session and its subagents, or a rollout. */\nexport interface TranscriptGroup {\n  client: AuditClient;\n  /** the main transcript's path (the session directory for subagents with no main file) */\n  key: string;\n  files: TranscriptFile[];\n  /** the latest write to any of its files */\n  lastWrite: number;\n}\n\n/** Spilled tool output and memory notes live beside transcripts; neither is a transcript. */\nconst SKIP_DIRS = new Set([\"tool-results\", \"memory\", \"node_modules\", \".git\"]);\n\nfunction stat(path: string): TranscriptFile | undefined {\n  try {\n    const s = statSync(path);\n    return s.isFile() ? { path, size: s.size, mtimeMs: s.mtimeMs } : undefined;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction jsonlUnder(dir: string, out: TranscriptFile[], depth = 0): void {\n  if (depth > 6) return;\n  let entries;\n  try {\n    entries = readdirSync(dir, { withFileTypes: true });\n  } catch {\n    return;\n  }\n  for (const e of entries) {\n    const p = join(dir, e.name);\n    if (e.isDirectory()) {\n      if (!SKIP_DIRS.has(e.name)) jsonlUnder(p, out, depth + 1);\n    } else if (e.isFile() && e.name.endsWith(\".jsonl\")) {\n      const f = stat(p);\n      if (f) out.push(f);\n    }\n  }\n}\n\n/** Claude Code's directory name for a working directory. */\nexport function claudeProjectName(dir: string): string {\n  return dir.replace(/[^a-zA-Z0-9]/g, \"-\");\n}\n\n/** The forms a path can take in a transcript: as given, and with symlinks resolved (/var → /private/var). */\nexport function pathForms(dir: string): string[] {\n  const forms = new Set([resolve(dir)]);\n  try {\n    forms.add(realpathSync(dir));\n  } catch {\n    // not on disk (a deleted checkout): the given form only\n  }\n  return [...forms];\n}\n\n/**\n * Claude Code project directories that can hold sessions for `repoRoot`: its own, and any whose\n * name starts with it (subdirectories, worktrees under it). The name is lossy, so the\n * transcripts' own `cwd` decides in the end.\n */\nexport function claudeProjectDirs(roots: readonly string[], repoRoot: string): string[] {\n  const names = pathForms(repoRoot).map(claudeProjectName);\n  const out: string[] = [];\n  for (const root of roots) {\n    let entries;\n    try {\n      entries = readdirSync(root, { withFileTypes: true });\n    } catch {\n      continue;\n    }\n    for (const e of entries) {\n      if (!e.isDirectory()) continue;\n      if (names.some((n) => e.name === n || e.name.startsWith(`${n}-`)))\n        out.push(join(root, e.name));\n    }\n  }\n  return out;\n}\n\n/** Sessions in Claude Code project directories, each with its subagents. */\nexport function claudeGroups(projectDirs: readonly string[]): TranscriptGroup[] {\n  const groups: TranscriptGroup[] = [];\n  for (const dir of projectDirs) {\n    let entries;\n    try {\n      entries = readdirSync(dir, { withFileTypes: true });\n    } catch {\n      continue;\n    }\n    const mains = new Map<string, TranscriptFile>();\n    const subdirs: string[] = [];\n    for (const e of entries) {\n      const p = join(dir, e.name);\n      if (e.isFile() && e.name.endsWith(\".jsonl\")) {\n        const f = stat(p);\n        if (f) mains.set(basename(e.name, \".jsonl\"), f);\n      } else if (e.isDirectory() && !SKIP_DIRS.has(e.name)) subdirs.push(e.name);\n    }\n    for (const [id, main] of mains) {\n      const files = [main];\n      if (subdirs.includes(id)) jsonlUnder(join(dir, id), files);\n      groups.push(group(\"claude-code\", main.path, files));\n    }\n    for (const id of subdirs) {\n      if (mains.has(id)) continue;\n      const files: TranscriptFile[] = [];\n      jsonlUnder(join(dir, id), files);\n      if (files.length > 0) groups.push(group(\"claude-code\", join(dir, id), files));\n    }\n  }\n  return groups;\n}\n\n/** Codex rollouts, one group each. */\nexport function codexGroups(roots: readonly string[]): TranscriptGroup[] {\n  const files: TranscriptFile[] = [];\n  for (const root of roots) if (existsSync(root)) jsonlUnder(root, files);\n  return files.map((f) => group(\"codex\", f.path, [f]));\n}\n\nfunction group(client: AuditClient, key: string, files: TranscriptFile[]): TranscriptGroup {\n  files.sort((a, b) => (a.path === key ? -1 : b.path === key ? 1 : a.path.localeCompare(b.path)));\n  return { client, key, files, lastWrite: Math.max(...files.map((f) => f.mtimeMs)) };\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAeA,SAAS,iBAAAA,sBAAqB;AAC9B,SAAS,cAAc;AACvB,SAAS,QAAAC,OAAM,WAAAC,gBAAe;AAC9B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,cAAAC;AAAA,EACA;AAAA,OASK;;;ACrBP,SAAS,kBAAkB;AAC3B,SAAS,WAAW,cAAc,aAAa,YAAY,qBAAqB;AAChF,SAAS,YAAY;AASd,IAAM,YAAY;AAElB,IAAM,SAAS;AAEf,IAAM,MAAM,CAAC,SAAyB,WAAW,QAAQ,EAAE,OAAO,IAAI,EAAE,OAAO,KAAK;AAkC3F,IAAM,OAAO,CAAC,WAAW,QAAQ,MAAM;AAEvC,SAAS,YAAY,GAA0B;AAC7C,SAAO;AAAA,IACL,EAAE;AAAA,IACF,EAAE;AAAA,IACF,EAAE;AAAA,IACF,EAAE;AAAA,IACF,EAAE;AAAA,IACF,KAAK,QAAQ,EAAE,IAAI;AAAA,IACnB,EAAE;AAAA,IACF,EAAE,UAAU,OAAO,IAAI,EAAE,QAAQ,IAAI;AAAA,IACrC,EAAE,UAAU,IAAI;AAAA,EAClB;AACF;AAEA,SAAS,YAAY,GAA0B;AAC7C,SAAO;AAAA,IACL,IAAI,EAAE,CAAC;AAAA,IACP,SAAS,EAAE,CAAC;AAAA,IACZ,MAAM,EAAE,CAAC;AAAA,IACT,MAAM,EAAE,CAAC;AAAA,IACT,MAAM,EAAE,CAAC;AAAA,IACT,MAAM,KAAK,EAAE,CAAC,CAAC,KAAK;AAAA,IACpB,OAAO,EAAE,CAAC;AAAA,IACV,OAAO,EAAE,CAAC,MAAM,IAAI,OAAO,EAAE,CAAC,MAAM;AAAA,IACpC,SAAS,EAAE,CAAC,MAAM;AAAA,EACpB;AACF;AAEO,SAAS,cAAcC,QAAoD;AAChF,SAAOA,OAAM,MAAM,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,IAAI,GAAG,EAAE,MAAM,KAAK,MAAM,EAAE,OAAO,CAAC,CAAC;AAC5E;AAEO,IAAM,aAAN,MAAiB;AAAA,EAItB,YACE,MACiB,MACA,UAAU,MAC3B;AAFiB;AACA;AAEjB,SAAK,MAAM,KAAK,MAAM,SAAS;AAC/B,QAAI,CAAC,QAAS;AACd,QAAI;AACJ,QAAI;AACF,cAAQ,YAAY,KAAK,GAAG;AAAA,IAC9B,QAAQ;AACN;AAAA,IACF;AACA,eAAW,QAAQ,OAAO;AACxB,UAAI,CAAC,KAAK,SAAS,OAAO,EAAG;AAC7B,UAAI;AACF,cAAM,IAAI,KAAK,MAAM,aAAa,KAAK,KAAK,KAAK,IAAI,GAAG,MAAM,CAAC;AAC/D,YAAI,EAAE,MAAM,KAAK,EAAE,WAAW,UAAU,EAAE,SAAS,KAAM;AACzD,aAAK,QAAQ,IAAI,EAAE,OAAO;AAAA,UACxB,MAAM,EAAE;AAAA,UACR,OAAO,EAAE;AAAA,UACT,QAAQ,EAAE;AAAA,UACV,OAAO,EAAE;AAAA,UACT,OAAO;AAAA,YACL,UAAU,EAAE,SAAS,IAAI,CAAC,CAAC,IAAI,QAAQ,OAAO,KAAK,KAAK,OAAO;AAAA,cAC7D;AAAA,cACA;AAAA,cACA;AAAA,cACA;AAAA,cACA,YAAY,UAAU;AAAA,YACxB,EAAE;AAAA,YACF,QAAQ,EAAE;AAAA,YACV,QAAQ,OAAO;AAAA,cACb,OAAO,QAAQ,EAAE,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAA8B;AAAA,gBAC/D;AAAA,gBACA,EAAE,YAAY,EAAE,GAAG,QAAQ,EAAE,EAAE,IAAI,WAAW,EAAE;AAAA,cAClD,CAAC;AAAA,YACH;AAAA,UACF;AAAA,QACF,CAAC;AAAA,MACH,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EA1CmB;AAAA,EACA;AAAA,EANF;AAAA,EACA,UAAU,oBAAI,IAAwB;AAAA,EAgDvD,SAASA,QAAgC;AACvC,WAAO,IAAI,GAAG,KAAK,IAAI,KAASA,OAAM,GAAG,EAAE;AAAA,EAC7C;AAAA;AAAA,EAGA,OAAOA,QAAwB,MAAiD;AAC9E,UAAM,MAAM,KAAK,QAAQ,IAAI,KAAK,SAASA,MAAK,CAAC;AACjD,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,KAAK,UAAU,IAAI,KAAK,MAAM,KAAK,UAAU,cAAcA,MAAK,CAAC,EAAG,QAAO;AAC/E,QAAI,CAAC,KAAK,MAAM,CAAC,MAAM,IAAI,MAAM,OAAO,CAAC,CAAC,EAAG,QAAO;AACpD,WAAO,IAAI;AAAA,EACb;AAAA;AAAA,EAGA,SAAS,SAA8B,QAAmC;AACxE,UAAM,MAAoB,CAAC;AAC3B,eAAW,KAAK,KAAK,QAAQ,OAAO;AAClC,UAAI,EAAE,WAAW,UAAU,CAAC,QAAQ,IAAI,EAAE,KAAK,EAAG,KAAI,KAAK,EAAE,KAAK;AACpE,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAMA,QAAwB,OAAyB;AACrD,UAAM,MAAM,KAAK,SAASA,MAAK;AAC/B,UAAM,QAAQ,cAAcA,MAAK;AACjC,UAAM,OAAO,KAAK,QAAQ,IAAI,GAAG;AAEjC,UAAM,SACJ,QAAQ,KAAK,UAAU,KAAK,KAAK,MAAM,KAAK,UAAU,KAAK,IACvD,EAAE,GAAG,KAAK,MAAM,QAAQ,GAAG,MAAM,OAAO,IACxC,MAAM;AACZ,UAAM,SAAqB,EAAE,GAAG,OAAO,OAAO;AAC9C,SAAK,QAAQ,IAAI,KAAK;AAAA,MACpB,MAAM,KAAK;AAAA,MACX,OAAO;AAAA,MACP,QAAQA,OAAM;AAAA,MACd;AAAA,MACA,OAAO;AAAA,IACT,CAAC;AACD,QAAI,CAAC,KAAK,QAAS;AACnB,UAAM,OAAa;AAAA,MACjB,GAAG;AAAA,MACH,QAAQ;AAAA,MACR,MAAM,KAAK;AAAA,MACX,OAAO;AAAA,MACP,QAAQA,OAAM;AAAA,MACd;AAAA,MACA,UAAU,OAAO,SAAS,IAAI,CAAC,MAAM,CAAC,EAAE,IAAI,EAAE,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,aAAa,IAAI,CAAC,CAAC;AAAA,MAC3F,QAAQ,OAAO;AAAA,MACf,QAAQ,OAAO;AAAA,QACb,OAAO,QAAQ,OAAO,MAAM,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM;AAAA,UAC5C;AAAA,UACA,EAAE,GAAG,EAAE,YAAY,GAAG,EAAE,OAAO,IAAI,WAAW,EAAE;AAAA,QAClD,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI;AACF,gBAAU,KAAK,KAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACpD,YAAM,OAAO,KAAK,KAAK,KAAK,GAAG,IAAI,MAAM,GAAG,EAAE,CAAC,OAAO;AACtD,YAAM,MAAM,GAAG,IAAI,IAAI,QAAQ,GAAG;AAClC,oBAAc,KAAK,KAAK,UAAU,IAAI,GAAG,EAAE,MAAM,IAAM,CAAC;AACxD,iBAAW,KAAK,IAAI;AAAA,IACtB,QAAQ;AAAA,IAER;AAAA,EACF;AACF;;;AC/MA,SAAS,YAAY,gBAAAC,qBAAoB;AACzC,OAAO,QAAQ,OAAO,UAAU,aAAuD;AAcvF,IAAM,SAAS,CAAC,SAAuB,KAAK,KAAK,CAAC,IAAI,KAAK,IAAI,IAAI,KAAK,IAAI;AAE5E,SAAS,MAAM,KAAe,MAAyB;AACrD,MAAI,OAAO,IAAI,MAAM,MAAM,IAAI;AAC/B,MAAI,CAAC,MAAM,IAAI,GAAG;AAChB,QAAI,MAAM,MAAM,IAAI,WAAW,CAAC,CAAC,CAAC;AAClC,WAAO,IAAI,MAAM,MAAM,IAAI;AAAA,EAC7B;AACA,QAAM,MAAM;AACZ,MAAI,OAAO;AACX,SAAO;AACT;AAEA,IAAM,SAAS,CAAC,QACd,IAAI,MAAM,IAAI,CAAC,MAAO,SAAS,CAAC,IAAI,OAAO,EAAE,KAAK,IAAI,EAAG,EAAE,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;AAGhF,SAAS,iBACd,YACA,MACA,MAAM,oBAAI,KAAK,GACF;AACb,QAAM,UAAU,CAAC,WAAW,UAAU;AACtC,QAAM,SAAS,UAAU,KAAKC,cAAa,YAAY,MAAM;AAC7D,MAAI,OAAO,UAAU,yBAAyB,GAAG,IAAI;AACrD,MAAI,CAAC,cAAc,KAAK,IAAI,EAAG,QAAO,GAAG,KAAK,QAAQ,QAAQ,IAAI,CAAC,GAAG,kBAAkB;AACxF,QAAM,MAAM,KAAK,cAAc,IAAI;AACnC,MAAI,IAAI,OAAO,SAAS;AACtB,UAAM,IAAI,MAAM,GAAG,UAAU,uBAAuB,IAAI,OAAO,CAAC,EAAG,OAAO,EAAE;AAC9E,QAAM,QAAkB,CAAC;AAEzB,aAAW,QAAQ,KAAK,OAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,KAAK,KAAK,MAAM,GAAG,CAAC;AAC3C,QAAI,OAAO,GAAG,EAAE,SAAS,KAAK,QAAQ,YAAY,CAAC,EAAG;AACtD,UAAM,OAAO,IAAI,WAAW,KAAK,OAAO;AACxC,SAAK,UAAU,OAAO,KAAK,IAAI;AAC/B,QAAI,MAAM,KAAK,IAAI;AACnB,UAAM,KAAK,GAAG,KAAK,IAAI,KAAK,KAAK,OAAO,OAAO,KAAK,KAAK,CAAC,KAAK,KAAK,MAAM,KAAK,GAAG;AAAA,EACpF;AAEA,MAAI,KAAK,SAAS,SAAS,GAAG;AAC5B,UAAM,OAAO,CAAC,SAAS,gBAAgB,UAAU;AACjD,UAAM,OAAO,IAAI,MAAM,MAAM,IAAI;AACjC,UAAM,UAAU,SAAS,IAAI,IAAI,KAAK,QAAQ;AAC9C,QAAI,YAAY,SAAS,MAAM,IAAI,GAAG;AACpC,YAAM,MAAM,MAAM,KAAK,IAAI;AAC3B,iBAAW,KAAK,KAAK,UAAU;AAC7B,YAAI,OAAO,GAAG,EAAE,SAAS,EAAE,IAAI,EAAG;AAClC,cAAM,SAAS,IAAI,WAAW,EAAE,IAAI;AACpC,eAAO,UAAU,OAAO,EAAE,IAAI;AAC9B,YAAI,MAAM,KAAK,MAAM;AACrB,cAAM,KAAK,gCAAgC,EAAE,IAAI,OAAO,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,KAAK,GAAG;AAAA,MACvF;AAAA,IACF;AAAA,EAEF;AAEA,MAAI,KAAK,aAAa,SAAS,GAAG;AAChC,UAAM,MAAM,MAAM,KAAK,CAAC,SAAS,gBAAgB,OAAO,CAAC;AACzD,UAAM,QAAQ,IAAI;AAAA,MAChB,IAAI,MAAM,IAAI,CAAC,MAAO,MAAM,CAAC,IAAI,OAAO,EAAE,IAAI,MAAM,KAAK,EAAE,IAAI,EAAG,EAAE,OAAO,OAAO;AAAA,IACpF;AACA,eAAW,KAAK,KAAK,cAAc;AACjC,UAAI,MAAM,IAAI,EAAE,IAAI,EAAG;AACvB,YAAM,OAAO,IAAI,WAAW,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,UAAU,EAAE,SAAS,CAAC;AAClF,UAAI,MAAM,IAAI,EAAG,MAAK,gBAAgB,OAAO,EAAE,IAAI;AACnD,UAAI,MAAM,KAAK,IAAI;AACnB,YAAM;AAAA,QACJ,6BAA6B,EAAE,IAAI,KAAK,EAAE,MAAM,MAAM,iBAAiB,EAAE,KAAK,CAAC,KAAK,EAAE,MAAM,KAAK;AAAA,MACnG;AAAA,IACF;AAAA,EACF;AAEA,QAAM,OAAO,IAAI,MAAM,CAAC,SAAS,MAAM,CAAC,MAAM,YAAY,YAAY;AACtE,SAAO,EAAE,QAAQ,OAAO,IAAI,SAAS,EAAE,WAAW,EAAE,CAAC,GAAG,SAAS,OAAO,KAAK;AAC/E;AAGO,SAAS,SAAS,GAAW,GAAW,UAAU,GAAa;AACpE,QAAM,IAAI,MAAM,KAAK,CAAC,IAAI,EAAE,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AACzD,QAAM,IAAI,EAAE,QAAQ,OAAO,EAAE,EAAE,MAAM,IAAI;AACzC,QAAM,IAAI,EAAE;AACZ,QAAM,IAAI,EAAE;AAEZ,QAAM,MAAkB,MAAM,KAAK,EAAE,QAAQ,IAAI,EAAE,GAAG,MAAM,IAAI,MAAc,IAAI,CAAC,EAAE,KAAK,CAAC,CAAC;AAC5F,WAASC,KAAI,IAAI,GAAGA,MAAK,GAAGA,MAAK;AAC/B,aAASC,KAAI,IAAI,GAAGA,MAAK,GAAGA,MAAK;AAC/B,UAAID,EAAC,EAAGC,EAAC,IACP,EAAED,EAAC,MAAM,EAAEC,EAAC,IAAI,IAAID,KAAI,CAAC,EAAGC,KAAI,CAAC,IAAK,IAAI,KAAK,IAAI,IAAID,KAAI,CAAC,EAAGC,EAAC,GAAI,IAAID,EAAC,EAAGC,KAAI,CAAC,CAAE;AACzF,QAAM,MAA+C,CAAC;AACtD,MAAI,IAAI;AACR,MAAI,IAAI;AACR,SAAO,IAAI,KAAK,IAAI,GAAG;AACrB,QAAI,IAAI,KAAK,IAAI,KAAK,EAAE,CAAC,MAAM,EAAE,CAAC,GAAG;AACnC,UAAI,KAAK,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC,EAAG,CAAC;AACjC,WAAK;AACL,WAAK;AAAA,IACP,WAAW,IAAI,MAAM,KAAK,KAAK,IAAI,CAAC,EAAG,IAAI,CAAC,KAAM,IAAI,IAAI,CAAC,EAAG,CAAC,IAAK;AAClE,UAAI,KAAK,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC,EAAG,CAAC;AACjC,WAAK;AAAA,IACP,OAAO;AACL,UAAI,KAAK,EAAE,IAAI,KAAK,MAAM,EAAE,CAAC,EAAG,CAAC;AACjC,WAAK;AAAA,IACP;AAAA,EACF;AACA,QAAM,OAAO,oBAAI,IAAY;AAC7B,MAAI,QAAQ,CAAC,GAAG,MAAM;AACpB,QAAI,EAAE,OAAO,IAAK;AAClB,aAAS,IAAI,CAAC,SAAS,KAAK,SAAS,KAAK,EAAG,MAAK,IAAI,IAAI,CAAC;AAAA,EAC7D,CAAC;AACD,QAAM,MAAgB,CAAC;AACvB,MAAI,OAAO;AACX,MAAI,QAAQ,CAAC,GAAG,MAAM;AACpB,QAAI,CAAC,KAAK,IAAI,CAAC,EAAG;AAClB,QAAI,MAAM,OAAO,KAAK,IAAI,SAAS,EAAG,KAAI,KAAK,UAAK;AACpD,QAAI,KAAK,GAAG,EAAE,EAAE,IAAI,EAAE,IAAI,EAAE;AAC5B,WAAO;AAAA,EACT,CAAC;AACD,SAAO;AACT;;;ACtIA,SAAS,wBAAwB;AACjC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAIK;AAGP,IAAM,gBAAgB,CAAC,QACrB,IAAI,SAAS,oBAAoB,KAAK,IAAI,SAAS,eAAe;AACpE,IAAM,eAAe,CAAC,QACpB,IAAI,SAAS,gBAAgB,KAC7B,IAAI,SAAS,gBAAgB,KAC7B,IAAI,SAAS,iBAAiB,KAC9B,IAAI,SAAS,oBAAoB,KACjC,IAAI,SAAS,oBAAoB;AAMnC,eAAe,SACb,MACA,QACA,QACe;AACf,QAAM,SAAS,iBAAiB,MAAM,EAAE,UAAU,QAAQ,eAAe,KAAK,GAAG,CAAC;AAClF,QAAM,QAAQ,gBAAgB,EAAE,OAAO,QAAQ,WAAW,SAAS,CAAC;AACpE,MAAI,IAAI;AACR,MAAI;AACF,qBAAiB,OAAO,OAAO;AAC7B,WAAK;AACL,UAAI,IAAI,WAAW,KAAK,CAAC,OAAO,KAAK,CAAC,EAAG;AACzC,UAAI;AACJ,UAAI;AACF,gBAAQ,KAAK,MAAM,GAAG;AAAA,MACxB,QAAQ;AACN;AAAA,MACF;AACA,UAAI,OAAO,OAAO,CAAC,MAAM,MAAO;AAAA,IAClC;AAAA,EACF,UAAE;AACA,UAAM,MAAM;AACZ,WAAO,QAAQ;AAAA,EACjB;AACF;AAGA,eAAsB,UACpBC,QACA,MAC0B;AAC1B,MAAIA,OAAM,WAAW,SAAS;AAC5B,UAAMC,UAAS,IAAI,iBAAiB,IAAI;AACxC,UAAM,SAASD,OAAM,MAAM,CAAC,EAAG,MAAM,cAAc,CAAC,OAAO,SAAS;AAClE,MAAAC,QAAO,IAAI,OAAO,MAAM,CAAC;AACzB,aAAOA,QAAO;AAAA,IAChB,CAAC;AACD,WAAOA,QAAO,OAAO;AAAA,EACvB;AACA,QAAM,SAAS,IAAI,sBAAsB,IAAI;AAC7C,aAAW,CAAC,GAAG,IAAI,KAAKD,OAAM,MAAM,QAAQ;AAC1C,UAAM,SAAS,KAAK,MAAM,eAAe,CAAC,OAAO,SAAS,OAAO,IAAI,OAAO,MAAM,CAAC,CAAC;AACtF,SAAO,OAAO,OAAO;AACvB;AAMA,eAAsB,WACpBA,QACA,QACA,MACiC;AACjC,QAAM,MAAM,oBAAI,IAAuB;AACvC,QAAM,SAAS,oBAAI,IAAyB;AAC5C,aAAW,KAAK,QAAQ;AACtB,UAAM,MAAM,OAAO,IAAI,EAAE,IAAI,KAAK,oBAAI,IAAY;AAClD,QAAI,IAAI,EAAE,IAAI;AACd,WAAO,IAAI,EAAE,MAAM,GAAG;AAAA,EACxB;AACA,aAAW,CAAC,WAAW,KAAK,KAAK,QAAQ;AACvC,UAAM,OAAOA,OAAM,MAAM,SAAS;AAClC,QAAI,CAAC,KAAM;AACX,UAAM,OAAO,KAAK,IAAI,GAAG,KAAK;AAC9B,UAAM,SACJA,OAAM,WAAW,UAAU,IAAI,iBAAiB,IAAI,IAAI,IAAI,sBAAsB,IAAI;AACxF,UAAM;AAAA,MACJ,KAAK;AAAA,MACL,CAAC,KAAK,MACJ,MAAM,IAAI,CAAC,KACVA,OAAM,WAAW,YACf,IAAI,SAAS,gBAAgB,KAAK,IAAI,SAAS,gBAAgB;AAAA,MACpE,CAAC,OAAO,MAAM;AACZ,eAAO,IAAI,OAAO,GAAG,SAAS;AAC9B,eAAO,IAAI;AAAA,MACb;AAAA,IACF;AACA,eAAW,QAAQ,OAAO,OAAO,EAAE,MAAO,KAAI,IAAI,WAAW,KAAK,EAAE,GAAG,IAAI;AAAA,EAC7E;AACA,SAAO;AACT;;;AC5GA,SAAS,cAAAE,aAAY,gBAAAC,eAAc,eAAAC,cAAa,YAAAC,iBAAgB;AAChE,SAAS,SAAS,YAAY,QAAAC,OAAM,UAAU,WAAAC,UAAS,WAAW;AAClE,OAAOC,WAAU;AACjB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACCP,SAAS,cAAAC,aAAY,eAAAC,cAAa,cAAc,gBAAgB;AAChE,SAAS,UAAU,QAAAC,OAAM,eAAe;AAQjC,SAAS,WACd,KACA,MACA,YAAuD,CAAC,GAC5C;AACZ,QAAM,SAAS,UAAU,YACrB,CAAC,QAAQ,UAAU,SAAS,CAAC,IAC7B,IAAI,oBACF,IAAI,kBAAkB,MAAM,GAAG,EAC5B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,OAAO,EACd,IAAI,CAAC,MAAMA,MAAK,QAAQ,CAAC,GAAG,UAAU,CAAC,IAC1C,CAACA,MAAK,MAAM,WAAW,UAAU,GAAGA,MAAK,MAAM,WAAW,UAAU,UAAU,CAAC;AACrF,QAAM,YAAY,IAAI,aAAa,QAAQ,IAAI,UAAU,IAAIA,MAAK,MAAM,QAAQ;AAChF,QAAM,QAAQ,UAAU,WACpB,CAAC,QAAQ,UAAU,QAAQ,CAAC,IAC5B,CAACA,MAAK,WAAW,UAAU,GAAGA,MAAK,WAAW,mBAAmB,CAAC;AACtE,SAAO,EAAE,eAAe,QAAQ,MAAM;AACxC;AAmBA,IAAM,YAAY,oBAAI,IAAI,CAAC,gBAAgB,UAAU,gBAAgB,MAAM,CAAC;AAE5E,SAAS,KAAK,MAA0C;AACtD,MAAI;AACF,UAAM,IAAI,SAAS,IAAI;AACvB,WAAO,EAAE,OAAO,IAAI,EAAE,MAAM,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ,IAAI;AAAA,EACnE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,WAAW,KAAa,KAAuB,QAAQ,GAAS;AACvE,MAAI,QAAQ,EAAG;AACf,MAAI;AACJ,MAAI;AACF,cAAUD,aAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,EACpD,QAAQ;AACN;AAAA,EACF;AACA,aAAW,KAAK,SAAS;AACvB,UAAM,IAAIC,MAAK,KAAK,EAAE,IAAI;AAC1B,QAAI,EAAE,YAAY,GAAG;AACnB,UAAI,CAAC,UAAU,IAAI,EAAE,IAAI,EAAG,YAAW,GAAG,KAAK,QAAQ,CAAC;AAAA,IAC1D,WAAW,EAAE,OAAO,KAAK,EAAE,KAAK,SAAS,QAAQ,GAAG;AAClD,YAAM,IAAI,KAAK,CAAC;AAChB,UAAI,EAAG,KAAI,KAAK,CAAC;AAAA,IACnB;AAAA,EACF;AACF;AAGO,SAAS,kBAAkB,KAAqB;AACrD,SAAO,IAAI,QAAQ,iBAAiB,GAAG;AACzC;AAGO,SAAS,UAAU,KAAuB;AAC/C,QAAM,QAAQ,oBAAI,IAAI,CAAC,QAAQ,GAAG,CAAC,CAAC;AACpC,MAAI;AACF,UAAM,IAAI,aAAa,GAAG,CAAC;AAAA,EAC7B,QAAQ;AAAA,EAER;AACA,SAAO,CAAC,GAAG,KAAK;AAClB;AAOO,SAAS,kBAAkB,OAA0B,UAA4B;AACtF,QAAM,QAAQ,UAAU,QAAQ,EAAE,IAAI,iBAAiB;AACvD,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,OAAO;AACxB,QAAI;AACJ,QAAI;AACF,gBAAUD,aAAY,MAAM,EAAE,eAAe,KAAK,CAAC;AAAA,IACrD,QAAQ;AACN;AAAA,IACF;AACA,eAAW,KAAK,SAAS;AACvB,UAAI,CAAC,EAAE,YAAY,EAAG;AACtB,UAAI,MAAM,KAAK,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,KAAK,WAAW,GAAG,CAAC,GAAG,CAAC;AAC9D,YAAI,KAAKC,MAAK,MAAM,EAAE,IAAI,CAAC;AAAA,IAC/B;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,aAAa,aAAmD;AAC9E,QAAM,SAA4B,CAAC;AACnC,aAAW,OAAO,aAAa;AAC7B,QAAI;AACJ,QAAI;AACF,gBAAUD,aAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,IACpD,QAAQ;AACN;AAAA,IACF;AACA,UAAM,QAAQ,oBAAI,IAA4B;AAC9C,UAAM,UAAoB,CAAC;AAC3B,eAAW,KAAK,SAAS;AACvB,YAAM,IAAIC,MAAK,KAAK,EAAE,IAAI;AAC1B,UAAI,EAAE,OAAO,KAAK,EAAE,KAAK,SAAS,QAAQ,GAAG;AAC3C,cAAM,IAAI,KAAK,CAAC;AAChB,YAAI,EAAG,OAAM,IAAI,SAAS,EAAE,MAAM,QAAQ,GAAG,CAAC;AAAA,MAChD,WAAW,EAAE,YAAY,KAAK,CAAC,UAAU,IAAI,EAAE,IAAI,EAAG,SAAQ,KAAK,EAAE,IAAI;AAAA,IAC3E;AACA,eAAW,CAAC,IAAI,IAAI,KAAK,OAAO;AAC9B,YAAM,QAAQ,CAAC,IAAI;AACnB,UAAI,QAAQ,SAAS,EAAE,EAAG,YAAWA,MAAK,KAAK,EAAE,GAAG,KAAK;AACzD,aAAO,KAAK,MAAM,eAAe,KAAK,MAAM,KAAK,CAAC;AAAA,IACpD;AACA,eAAW,MAAM,SAAS;AACxB,UAAI,MAAM,IAAI,EAAE,EAAG;AACnB,YAAM,QAA0B,CAAC;AACjC,iBAAWA,MAAK,KAAK,EAAE,GAAG,KAAK;AAC/B,UAAI,MAAM,SAAS,EAAG,QAAO,KAAK,MAAM,eAAeA,MAAK,KAAK,EAAE,GAAG,KAAK,CAAC;AAAA,IAC9E;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,YAAY,OAA6C;AACvE,QAAM,QAA0B,CAAC;AACjC,aAAW,QAAQ,MAAO,KAAIF,YAAW,IAAI,EAAG,YAAW,MAAM,KAAK;AACtE,SAAO,MAAM,IAAI,CAAC,MAAM,MAAM,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;AACrD;AAEA,SAAS,MAAM,QAAqB,KAAa,OAA0C;AACzF,QAAM,KAAK,CAAC,GAAG,MAAO,EAAE,SAAS,MAAM,KAAK,EAAE,SAAS,MAAM,IAAI,EAAE,KAAK,cAAc,EAAE,IAAI,CAAE;AAC9F,SAAO,EAAE,QAAQ,KAAK,OAAO,WAAW,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE;AACnF;;;ADnJO,SAAS,SAAS,KAAwB;AAC/C,MAAI,MAAMG,SAAQ,GAAG;AACrB,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG;AAC9B,UAAM,SAASC,MAAK,KAAK,MAAM;AAC/B,QAAIC,YAAW,MAAM,GAAG;AACtB,UAAI,OAAO;AACX,UAAI;AACF,YAAIC,UAAS,MAAM,EAAE,OAAO,GAAG;AAE7B,gBAAM,IAAI,oBAAoB,KAAKC,cAAa,QAAQ,MAAM,CAAC;AAC/D,gBAAM,SAAS,IAAIJ,SAAQ,KAAK,EAAE,CAAC,EAAG,KAAK,CAAC,IAAI;AAChD,gBAAM,KAAK,OAAO,YAAY,GAAG,GAAG,OAAO,GAAG,YAAY,GAAG,EAAE;AAC/D,cAAI,KAAK,EAAG,QAAO,OAAO,MAAM,GAAG,EAAE;AAAA,QACvC;AAAA,MACF,QAAQ;AAAA,MAER;AACA,aAAO,EAAE,UAAU,KAAK,KAAK;AAAA,IAC/B;AACA,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK;AACpB,UAAM;AAAA,EACR;AACA,SAAO,EAAE,UAAUA,SAAQ,GAAG,GAAG,MAAMA,SAAQ,GAAG,EAAE;AACtD;AAGO,SAAS,YAAY,MAAwC;AAClE,QAAM,QAAQ,UAAU,IAAI,EAAE,IAAI,aAAa;AAC/C,SAAO,CAAC,QAAgB,MAAM,KAAK,CAAC,MAAM,SAAS,cAAc,GAAG,GAAG,CAAC,CAAC;AAC3E;AAGO,IAAM,aAAa;AAAA,EACxB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,mBAAmB;AACzB,IAAM,YAAY,MAAM;AAExB,SAAS,YAAY,KAAa,KAAe,QAAQ,GAAS;AAChE,MAAI,QAAQ,KAAK,IAAI,UAAU,iBAAkB;AACjD,MAAI;AACJ,MAAI;AACF,cAAUK,aAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,EACpD,QAAQ;AACN;AAAA,EACF;AACA,aAAW,KAAK,QAAQ,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,cAAc,EAAE,IAAI,CAAC,GAAG;AACpE,UAAM,IAAIJ,MAAK,KAAK,EAAE,IAAI;AAC1B,QAAI,EAAE,YAAY,EAAG,aAAY,GAAG,KAAK,QAAQ,CAAC;AAAA,aACzC,EAAE,OAAO,KAAK,cAAc,KAAK,EAAE,IAAI,KAAK,IAAI,SAAS,iBAAkB,KAAI,KAAK,CAAC;AAAA,EAChG;AACF;AAGO,SAAS,cAAc,UAAkB,QAA2B,CAAC,GAAoB;AAC9F,QAAM,QAAkB,WAAW,IAAI,CAAC,MAAMA,MAAK,UAAU,CAAC,CAAC;AAC/D,cAAYA,MAAK,UAAU,WAAW,OAAO,GAAG,KAAK;AACrD,aAAW,KAAK,MAAO,OAAM,KAAK,WAAW,CAAC,IAAI,IAAID,SAAQ,UAAU,CAAC,CAAC;AAC1E,QAAM,MAAuB,CAAC;AAC9B,QAAM,OAAO,oBAAI,IAAY;AAC7B,aAAW,KAAK,OAAO;AACrB,QAAI,KAAK,IAAI,CAAC,EAAG;AACjB,SAAK,IAAI,CAAC;AACV,QAAI;AACF,UAAI,CAACG,UAAS,CAAC,EAAE,OAAO,EAAG;AAC3B,YAAM,OAAOC,cAAa,GAAG,MAAM,EAAE,MAAM,GAAG,SAAS;AACvD,YAAM,MAAM,SAAS,UAAU,CAAC;AAChC,UAAI,KAAK,EAAE,MAAM,IAAI,WAAW,IAAI,IAAI,IAAI,IAAI,MAAM,GAAG,EAAE,KAAK,GAAG,GAAG,KAAK,CAAC;AAAA,IAC9E,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAMO,SAAS,gBAAgB,YAA+D;AAC7F,MAAI,CAACF,YAAW,UAAU,EAAG,QAAO,EAAE,OAAO,CAAC,EAAE;AAChD,MAAI;AACJ,MAAI;AACF,UAAMI,MAAK,MAAMF,cAAa,YAAY,MAAM,CAAC;AAAA,EACnD,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,OAAO,CAAC;AAAA,MACR,SAAS,GAAG,UAAU,uBAAuB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC/F;AAAA,EACF;AACA,QAAM,QAAQ,OAAO,OAAO,QAAQ,WAAY,IAAgC,QAAQ;AACxF,QAAM,QACJ,SAAS,OAAO,UAAU,WAAY,MAAkC,QAAQ;AAClF,MAAI,UAAU,OAAW,QAAO,EAAE,OAAO,CAAC,EAAE;AAC5C,QAAM,SAAS,iBAAiB,UAAU,KAAK;AAC/C,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,OAAO,CAAC;AAAA,MACR,SAAS,kBAAkB,UAAU,gBAAgB,OAAO,MAAM,OAC/D,IAAI,CAAC,MAAM,GAAG,EAAE,KAAK,KAAK,GAAG,CAAC,KAAK,EAAE,OAAO,EAAE,EAC9C,KAAK,IAAI,CAAC;AAAA,IACf;AACF,SAAO,EAAE,OAAO,OAAO,KAAK;AAC9B;;;AJtFO,IAAM,mBAAmB;AACzB,IAAM,oBAAoB,uEAAkE,gBAAgB;AAEnH,IAAM,eAA4C,EAAE,eAAe,eAAe,OAAO,QAAQ;AAG1F,SAAS,WAAW,OAA2B,KAA+B;AACnF,QAAM,KAAK,SAAS,MAAM,KAAK,EAAE,YAAY;AAC7C,MAAI,MAAM,MAAO,QAAO;AACxB,QAAM,MAAM,oBAAoB,KAAK,CAAC;AACtC,MAAI,KAAK;AACP,UAAM,IAAI,OAAO,IAAI,CAAC,CAAC;AACvB,UAAM,OAAO,IAAI,CAAC,MAAM,MAAM,OAAY,IAAI,CAAC,MAAM,MAAM,IAAI,QAAa;AAC5E,WAAO,IAAI,QAAQ,IAAI,IAAI;AAAA,EAC7B;AACA,QAAM,IAAI,KAAK,MAAM,sBAAsB,KAAK,CAAC,IAAI,GAAG,CAAC,cAAc,CAAC;AACxE,MAAI,CAAC,OAAO,SAAS,CAAC;AACpB,UAAM,IAAI,MAAM,YAAY,KAAK,iDAAiD;AACpF,SAAO;AACT;AAEA,SAAS,YAAY,MAAiC;AACpD,QAAM,QAAQ,SAAS,MAAM,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE,YAAY,CAAC;AACxE,MAAI,MAAM,WAAW,KAAK,MAAM,SAAS,KAAK,EAAG,QAAO,CAAC,eAAe,OAAO;AAC/E,SAAO,MAAM,IAAI,CAAC,MAAM;AACtB,QAAI,MAAM,YAAY,MAAM,cAAe,QAAO;AAClD,QAAI,MAAM,QAAS,QAAO;AAC1B,UAAM,IAAI,MAAM,qBAAqB,CAAC,0BAA0B;AAAA,EAClE,CAAC;AACH;AAEA,IAAM,MAAM,CAAC,MAAsB,OAAO,CAAC,EAAE,SAAS,GAAG,GAAG;AAC5D,IAAM,YAAY,CAAC,OAAuB;AACxC,QAAM,IAAI,IAAI,KAAK,EAAE;AACrB,SAAO,GAAG,EAAE,YAAY,CAAC,IAAI,IAAI,EAAE,SAAS,IAAI,CAAC,CAAC,IAAI,IAAI,EAAE,QAAQ,CAAC,CAAC,IAAI,IAAI,EAAE,SAAS,CAAC,CAAC,IAAI,IAAI,EAAE,WAAW,CAAC,CAAC;AACpH;AACA,IAAM,WAAW,CAAC,OAAuB,UAAU,EAAE,EAAE,MAAM,GAAG,EAAE;AAClE,IAAM,SAAS,CAAC,GAAW,KAAa,OAAO,GAAG,GAAG,QAAgB,GAAG,CAAC,IAAI,MAAM,IAAI,MAAM,IAAI;AACjG,IAAM,OAAO,CAAC,GAAW,MAAuB,EAAE,SAAS,IAAI,GAAG,EAAE,MAAM,GAAG,IAAI,CAAC,CAAC,WAAM;AAkBzF,eAAe,KACb,OACA,MACA,MACe;AACf,MAAI,OAAO;AACX,QAAM,MAAM,YAA2B;AACrC,WAAO,OAAO,MAAM,OAAQ,OAAM,KAAK,MAAM,MAAM,CAAE;AAAA,EACvD;AACA,QAAM,QAAQ,IAAI,MAAM,KAAK,EAAE,QAAQ,KAAK,IAAI,MAAM,MAAM,MAAM,EAAE,GAAG,GAAG,CAAC;AAC7E;AAGA,SAAS,cAAc,OAA0B;AAC/C,UAAQ,MAAM,KAAK,MAAM;AAAA,IACvB,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO,MAAM,KAAK,cAAc,yBAAyB;AAAA,IAC3D,KAAK;AAAA,IACL,KAAK;AACH,aAAO;AAAA,IACT,KAAK;AACH,aAAO;AAAA,IACT;AACE,aAAO;AAAA,EACX;AACF;AAEA,eAAsB,aAAa,MAAkB,IAAyB;AAC5E,QAAM,MAAM,oBAAI,KAAK;AACrB,QAAM,OAAO,SAAS,MAAM,MAAM,MAAM;AACxC,QAAM,QAAQ,WAAW,WAAW,MAAM,OAAO,GAAG,GAAG;AACvD,QAAM,UAAU,YAAY,IAAI;AAChC,QAAM,OAAO,SAAS,EAAE;AACxB,QAAM,OAAO,SAASG,SAAQ,GAAG,KAAK,WAAW,MAAM,MAAM,KAAK,GAAG,CAAC;AACtE,QAAM,aAAaA;AAAA,IACjB,KAAK;AAAA,IACL,WAAW,MAAM,QAAQ,KAAK,GAAG,IAAI,qBAAqB;AAAA,EAC5D;AAGA,QAAM,QAAQ,cAAc,KAAK,UAAU,SAAS,MAAM,OAAO,CAAC;AAClE,QAAM,SAAS,gBAAgB,UAAU;AACzC,QAAM,EAAE,OAAO,OAAO,IAAI,aAAa,OAAO,OAAO,OAAO,iBAAiB;AAC7E,QAAM,WAAW;AAAA,IACf,GAAI,OAAO,UAAU,CAAC,OAAO,OAAO,IAAI,CAAC;AAAA,IACzC,GAAG,OAAO,IAAI,CAAC,MAAM,GAAG,EAAE,IAAI,IAAI,EAAE,IAAI,KAAK,EAAE,OAAO,EAAE;AAAA,EAC1D;AACA,QAAM,SAAS,MAAM,QAAQ,CAAC,MAAM,EAAE,MAAM;AAC5C,QAAM,OAAO,CAAC,GAAG,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAElD,MAAI,SAAS,MAAM,SAAS,EAAG,QAAO,QAAQ,MAAM,IAAI,OAAO,YAAY,KAAK,UAAU,IAAI;AAG9F,QAAM,OAAO,WAAW,GAAG,KAAK,MAAM;AAAA,IACpC,WAAW,WAAW,MAAM,YAAY;AAAA,IACxC,UAAU,WAAW,MAAM,WAAW;AAAA,EACxC,CAAC;AACD,QAAM,SAA4B;AAAA,IAChC,GAAI,QAAQ,SAAS,aAAa,IAC9B,aAAa,kBAAkB,KAAK,aAAa,GAAG,KAAK,IAAI,CAAC,IAC9D,CAAC;AAAA,IACL,GAAI,QAAQ,SAAS,OAAO,IAAI,YAAY,KAAK,KAAK,IAAI,CAAC;AAAA,EAC7D;AACA,QAAM,QAAQ,IAAI;AAAA,IAChBA,SAAQ,GAAG,KAAK,WAAW,MAAM,WAAW,KAAKC,MAAK,MAAM,aAAa,CAAC;AAAA,IAC1E,IAAI,KAAK,IAAI;AAAA,IACb,SAAS,MAAM,OAAO,MAAM;AAAA,EAC9B;AACA,QAAM,SAAS,YAAY,KAAK,IAAI;AACpC,QAAM,MAAoB;AAAA,IACxB,UAAU,KAAK;AAAA,IACf;AAAA,IACA,SAAS;AAAA,MACP,OAAO;AAAA,MACP,GAAG,IAAI,UAAU;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,OAAO,OAAO;AAAA,EAClB;AACA,QAAM,SAA2C;AAAA,IAC/C,eAAe,EAAE,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,EAAE;AAAA,IAC3E,OAAO,EAAE,aAAa,GAAG,MAAM,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,EAAE;AAAA,EACrE;AACA,QAAM,UAAmB,CAAC;AAC1B,QAAM,WAAW,CAAC,QAAQ,SAAS,MAAM,UAAU,MAAM;AACzD,QAAM,KAAK,QAAQ,GAAG,OAAOC,WAAU;AACrC,UAAM,IAAI,OAAOA,OAAM,MAAM;AAC7B,MAAE,eAAeA,OAAM,MAAM;AAC7B,UAAM,MAAM,MAAM,OAAOA,QAAO,IAAI;AACpC,QAAI,KAAK;AACP,QAAE,UAAUA,OAAM,MAAM;AACxB,cAAQ,KAAK,EAAE,OAAAA,QAAO,OAAO,IAAI,CAAC;AAClC;AAAA,IACF;AACA,QAAI,UAAU,UAAaA,OAAM,YAAY,OAAO;AAClD,QAAE,SAASA,OAAM,MAAM;AACvB;AAAA,IACF;AACA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,UAAUA,QAAO,EAAE,OAAO,CAAC;AAAA,IAC1C,QAAQ;AACN;AAAA,IACF;AACA,MAAE,QAAQA,OAAM,MAAM;AACtB,UAAM,QAAQ,eAAe,QAAQ,MAAM,GAAG;AAC9C,UAAM,MAAMA,QAAO,KAAK;AACxB,UAAM,YAAY,OAAO,OAAO,MAAM,MAAM,EAAE,KAAK,CAAC,MAAM,EAAE,OAAO,SAAS,CAAC;AAC7E,YAAQ,KAAK;AAAA,MACX,OAAAA;AAAA,MACA;AAAA,MACA,GAAI,YAAY,YACZ,EAAE,OAAO,IAAI,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,CAACC,YAAW,EAAE,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAC/D,CAAC;AAAA,IACP,CAAC;AAAA,EACH,CAAC;AACD,QAAM,UAAU,IAAI,IAAI,OAAO,IAAI,CAAC,MAAM,MAAM,SAAS,CAAC,CAAC,CAAC;AAC5D,aAAW,UAAU;AACnB,eAAW,SAAS,MAAM,SAAS,SAAS,MAAM,GAAG;AACnD,aAAO,MAAM,EAAE,YAAY;AAC3B,cAAQ,KAAK,EAAE,MAAM,CAAC;AAAA,IACxB;AAEF,QAAM,UAAU;AAAA,IACd;AAAA,IACA,QAAQ,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,IAC1B,EAAE,MAAM;AAAA,EACV;AACA,QAAM,OAAO,gBAAgB,KAAK;AAClC,QAAM,cAAc,oBAAI,IAAI;AAAA,IAC1B,GAAG,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE;AAAA,IAClC,GAAG,KAAK,SAAS,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE;AAAA,IACrC,GAAG,KAAK,aAAa,IAAI,CAAC,MAAM,EAAE,KAAK,EAAE;AAAA,EAC3C,CAAC;AAED,MAAI,MAAM;AACR,OAAG;AAAA,MACD,KAAK;AAAA,QACH;AAAA,UACE,MAAM;AAAA,UACN,SAAS,QAAQ;AAAA,UACjB,MAAM,KAAK;AAAA,UACX,UAAU,KAAK;AAAA,UACf,OAAO,UAAU,SAAY,OAAO,IAAI,KAAK,KAAK,EAAE,YAAY;AAAA,UAChE,OAAO,IAAI,YAAY;AAAA,UACvB,YAAY,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,UACnC,SAAS;AAAA,UACT,UAAU;AAAA,YACR,OAAO,QAAQ;AAAA,YACf,eAAe,QAAQ,iBAAiB,aAAa;AAAA,YACrD,OAAO,QAAQ,iBAAiB;AAAA,UAClC;AAAA,UACA,mBAAmB,QAAQ;AAAA,UAC3B,OAAO,QAAQ,MAAM,IAAI,CAAC,OAAO;AAAA,YAC/B,IAAI,EAAE,KAAK;AAAA,YACX,GAAG,EAAE,KAAK;AAAA,YACV,MAAM,EAAE,KAAK;AAAA,YACb,MAAM,EAAE,KAAK;AAAA,YACb,MAAM,EAAE,KAAK;AAAA,YACb,QAAQ,EAAE;AAAA,YACV,WAAW,EAAE,KAAK,OAAO,SAAS;AAAA,YAClC,GAAI,EAAE,KAAK,WAAW,EAAE,sBAAsB,KAAK,IAAI,CAAC;AAAA,YACxD,iBAAiB,EAAE;AAAA,YACnB,aAAa,EAAE,KAAK,IAAI,CAAC,MAAM,IAAI,KAAK,EAAE,EAAE,EAAE,YAAY,CAAC;AAAA,YAC3D,QAAQ,EAAE,OAAO,IAAI,CAAC,GAAG,OAAO;AAAA,cAC9B,OAAO,EAAE;AAAA,cACT,MAAM,EAAE;AAAA,cACR,KAAK,EAAE;AAAA,cACP,SAAS,cAAc,EAAE,KAAK,OAAO,CAAC,CAAE;AAAA,cACxC,qBAAqB,EAAE;AAAA,cACvB,iBAAiB,EAAE;AAAA,cACnB,qBAAqB,EAAE;AAAA,cACvB,uBAAuB,EAAE;AAAA,cACzB,QAAQ,EAAE;AAAA,cACV,SAAS,EAAE;AAAA,YACb,EAAE;AAAA,UACJ,EAAE;AAAA,UACF,eAAe;AAAA,YACb,OAAO,QAAQ,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,eAAe,EAAE;AAAA,YACjE,MAAM;AAAA,UACR;AAAA,UACA;AAAA,UACA,SAAS;AAAA,YACP,SAAS;AAAA,YACT,OAAO,YAAY;AAAA,YACnB,MAAM;AAAA,UACR;AAAA,UACA,cAAc,EAAE,WAAW,OAAO,KAAK,iBAAiB;AAAA,UACxD,SACE;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAGA,QAAM,QAAQ,oBAAI,IAAoB;AACtC,MAAI,UAAU;AACZ,UAAM,SAAS,oBAAI,IAA4B;AAC/C,eAAW,KAAK,QAAQ;AACtB,iBAAW,KAAK,EAAE,MAAM;AACtB,cAAM,OAAO,OAAO,IAAI,EAAE,KAAK,KAAK,CAAC;AACrC,aAAK,KAAK,CAAC;AACX,eAAO,IAAI,EAAE,OAAO,IAAI;AAAA,MAC1B;AACF,eAAW,CAAC,IAAI,MAAM,KAAK,QAAQ;AACjC,YAAM,QAAQ,QAAQ,EAAE;AACxB,UAAI,CAAC,OAAO,MAAO;AACnB,UAAI,QAAQ,MAAM;AAClB,UAAI,CAAC,OAAO;AACV,YAAI;AACF,kBAAQ,MAAM,WAAW,MAAM,OAAO,QAAQ,EAAE,OAAO,CAAC;AAAA,QAC1D,QAAQ;AACN;AAAA,QACF;AAAA,MACF;AACA,iBAAW,KAAK,QAAQ;AACtB,cAAM,OAAO,MAAM,IAAI,EAAE,IAAI;AAC7B,YAAI,KAAM,OAAM,IAAI,GAAG,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,KAAK,IAAI,aAAa,MAAM,GAAG,GAAG,CAAC;AAAA,MACxF;AAAA,IACF;AAAA,EACF;AAEA,cAAY,IAAI;AAAA,IACd,MAAM,KAAK;AAAA,IACX;AAAA,IACA,OAAO,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAC9B;AAAA,IACA;AAAA,IACA;AAAA,IACA,UAAU,WACN,CAAC,MACC,MAAM,IAAI,GAAG,EAAE,KAAK,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,mCAC5D,MAAM;AAAA,IACV,aAAa,YAAY;AAAA,IACzB;AAAA,EACF,CAAC;AACD,SAAO;AACT;AAcA,SAAS,SAAS,GAAwB;AACxC,QAAM,KAAK,IAAI,EAAE,KAAK,CAAC,GAAG,OAAO,CAAC;AAClC,SAAO,KAAK,EAAE,IAAI,KAAK,EAAE,KAAK,MAAM,EAAE,CAAC,OAAO,EAAE,KAAK,IAAI,IAAI,EAAE,KAAK,IAAI;AAC1E;AAEA,SAAS,YAAY,IAAQ,GAAe;AAC1C,QAAM,IAAI,EAAE;AACZ,QAAM,SAAS,EAAE,UAAU,SAAY,gBAAgB,SAAS,SAAS,EAAE,KAAK,CAAC;AACjF,KAAG,IAAI,2BAAsB,EAAE,IAAI,SAAM,MAAM,EAAE;AACjD,QAAM,OAAO,EAAE,QAAQ,IAAI,CAAC,MAAM;AAChC,UAAM,IAAI,EAAE,OAAO,CAAC;AACpB,UAAM,QAAQ,CAAC,GAAG,EAAE,IAAI,SAAS,GAAG,EAAE,MAAM,aAAa;AACzD,QAAI,EAAE,SAAU,OAAM,KAAK,GAAG,EAAE,QAAQ,gCAAgC;AACxE,QAAI,EAAE,MAAO,OAAM,KAAK,GAAG,EAAE,KAAK,wBAAwB;AAC1D,WAAO,GAAG,aAAa,CAAC,CAAC,KAAK,OAAO,EAAE,aAAa,YAAY,CAAC,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,EACxF,CAAC;AACD,KAAG,IAAI,KAAK,KAAK,QAAK,CAAC;AACvB,QAAM,WAAW,EAAE,QAChB,OAAO,CAAC,MAAM,EAAE,iBAAiB,CAAC,IAAI,CAAC,EACvC,IAAI,CAAC,MAAM,GAAG,aAAa,CAAC,CAAC,IAAI,EAAE,iBAAiB,CAAC,CAAC,EAAE;AAC3D,KAAG;AAAA,IACD,GAAG,OAAO,EAAE,UAAU,SAAS,CAAC,sBAAsB,SAAS,SAAS,KAAK,SAAS,KAAK,IAAI,CAAC,MAAM,EAAE;AAAA,EAC1G;AACA,MAAI,EAAE,SAAS;AACb,OAAG;AAAA,MACD,GAAG,OAAO,EAAE,QAAQ,iBAAiB,CAAC,uDAAuD,EAAE,WAAW,IAAI,QAAQ,MAAM;AAAA,IAC9H;AACF,aAAW,KAAK,EAAE,SAAU,IAAG,IAAI,YAAY,CAAC,EAAE;AAClD,KAAG,IAAI,EAAE;AAET,MAAI,EAAE,MAAM,WAAW,KAAK,EAAE,MAAM,WAAW,GAAG;AAChD,OAAG;AAAA,MACD;AAAA,IACF;AACA,OAAG,IAAI,EAAE;AACT,OAAG,IAAI,iBAAiB;AACxB;AAAA,EACF;AACA,QAAM,YAAY,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,eAAe;AACpE,QAAM,UAAU,oBAAI,IAAoB;AACxC,aAAW,KAAK,EAAE,MAAO,SAAQ,IAAI,EAAE,KAAK,OAAO,QAAQ,IAAI,EAAE,KAAK,IAAI,KAAK,KAAK,CAAC;AACrF,KAAG;AAAA,IACD,GAAG,OAAO,EAAE,MAAM,QAAQ,MAAM,CAAC,WAAW,CAAC,GAAG,OAAO,EAAE,IAAI,CAAC,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC,MAAM,UAAU,MAAM;AAAA,EAC3H;AACA,MAAI,EAAE,aAAa;AACjB,OAAG;AAAA,MACD,uCAAuC,EAAE,IAAI,IAAI,MAAM;AAAA,IACzD;AAEF,QAAM,UAAU,CAAC,OAAe,MAAqB,SAAyC;AAC5F,QAAI,KAAK,WAAW,EAAG;AACvB,OAAG,IAAI,EAAE;AACT,OAAG,IAAI,KAAK;AACZ,eAAW,KAAK,MAAM;AACpB,SAAG,IAAI,SAAS,CAAC,CAAC;AAClB,WAAK,CAAC;AAAA,IACR;AAAA,EACF;AACA,QAAM,aAAa,CAAC,MAAyB;AAC3C,MAAE,KAAK,OAAO,QAAQ,CAAC,OAAO,MAAM;AAClC,YAAM,IAAI,EAAE,OAAO,CAAC;AACpB,YAAM,OAAO,eAAe,EAAE,MAAM,MAAM,IAAI;AAC9C,YAAM,QAAQ,OAAO,KAAK,EAAE,kBAAkB,IAAI,IAAI,MAAM;AAC5D,UAAI;AACJ,UAAI,EAAE,iBAAiB,GAAG;AACxB,kBAAU,aAAa,EAAE,cAAc,OAAO,EAAE,QAAQ,YAAY,KAAK;AACzE,cAAM,QAAkB,CAAC;AACzB,YAAI,EAAE,SAAS,EAAE,eAAgB,OAAM,KAAK,GAAG,EAAE,MAAM,QAAQ;AAC/D,YAAI,EAAE,oBAAoB;AACxB,gBAAM,KAAK,GAAG,EAAE,iBAAiB,8BAA8B;AACjE,YAAI,EAAE,UAAU,EAAG,OAAM,KAAK,GAAG,EAAE,OAAO,yBAAyB;AACnE,YAAI,MAAM,OAAQ,YAAW,KAAK,MAAM,KAAK,IAAI,CAAC;AAAA,MACpD,WAAW,EAAE,qBAAqB,KAAK,CAAC,MAAM;AAC5C,cAAM,IAAI,OAAO,EAAE,qBAAqB,EAAE;AAC1C,kBACE,MAAM,IACF,wBAAwB,OAAO,SAAS,IAAI,KAAK,EAAE,KACnD,eAAe,CAAC,YAAY,OAAO,SAAS,IAAI,KAAK,EAAE;AAAA,MAC/D,MAAO,WAAU;AACjB,UAAI,EAAE,uBAAuB;AAC3B,mBAAW,KAAK,EAAE,oBAAoB;AACxC,SAAG,IAAI,UAAU,EAAE,KAAK,WAAM,OAAO,EAAE;AAAA,IACzC,CAAC;AACD,eAAW,KAAK,EAAE,MAAM;AACtB,YAAM,OAAO,EAAE,SAAS,CAAC;AACzB,SAAG;AAAA,QACD,YAAY,UAAU,EAAE,EAAE,CAAC,GAAG,OAAO,KAAK,IAAI,KAAK,EAAE,GAAG,EAAE,UAAU,gBAAgB,EAAE,GAAG,EAAE,QAAQ,cAAc,EAAE,kBAAe,EAAE,QAAQ,MAAM,GAAG,CAAC,CAAC;AAAA,MACzJ;AAAA,IACF;AAAA,EACF;AACA;AAAA,IACE;AAAA,IACA,EAAE,MACC,OAAO,CAAC,MAAM,EAAE,WAAW,QAAQ,EACnC,KAAK,CAAC,GAAG,MAAM,EAAE,iBAAiB,EAAE,cAAc;AAAA,IACrD;AAAA,EACF;AACA;AAAA,IACE;AAAA,IACA,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM;AAAA,IACzC;AAAA,EACF;AACA;AAAA,IACE;AAAA,IACA,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,gBAAgB;AAAA,IACnD;AAAA,EACF;AACA,QAAM,eAAe,EAAE,MAAM,OAAO,CAAC,MAAM,EAAE,WAAW,eAAe;AACvE,MAAI,aAAa,SAAS,GAAG;AAC3B,OAAG,IAAI,EAAE;AACT,OAAG;AAAA,MACD,+BAA+B,aAAa,MAAM,YAAO,mBAAmB,QAAQ,kCAAkC,EAAE,CAAC;AAAA,IAC3H;AACA,eAAW,KAAK;AACd,SAAG,IAAI,GAAG,SAAS,CAAC,CAAC,GAAG,EAAE,KAAK,WAAW,oBAAoB,EAAE,EAAE;AAAA,EACtE;AACA,KAAG,IAAI,EAAE;AACT,MAAI,EAAE,cAAc;AAClB,OAAG;AAAA,MACD,gDAAgD,OAAO,EAAE,aAAa,MAAM,CAAC;AAAA,IAC/E;AACF,KAAG,IAAI,iBAAiB;AAC1B;AAEA,eAAe,QACb,MACA,IACA,OACA,YACA,UACA,MACiB;AACjB,QAAM,OAAO,gBAAgB,KAAK;AAClC,QAAM,UAAU,SAAS,MAAM,SAAS,MAAM;AAC9C,QAAM,OAAO,iBAAiB,YAAY,IAAI;AAC9C,QAAM,OAAO,SAAS,KAAK,QAAQ,KAAK,KAAK;AAC7C,QAAM,UAAU,KAAK,WAAW,KAAK;AACrC,QAAM,UAAU,KAAK,SAAS,aAAa,SAAS,MAAM,KAAK,MAAM;AACrE,QAAM,QAAQ,WAAW,CAAC,WAAW,CAAC;AACtC,MAAI,MAAO,CAAAC,eAAc,YAAY,KAAK,KAAK;AAG/C,QAAM,OAAO,SAAS,EAAE;AACxB,QAAM,YAAa,CAAC,WAAW,MAAM,EAAY,KAAK,CAAC,UAAU;AAC/D,QAAI;AACF,aACE,kBAAkB,WAAW,eAAe,OAAO,EAAE,KAAK,UAAU,KAAK,GAAG,EAAE,CAAC,EAAE,SAAS;AAAA,IAE9F,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF,CAAC;AACD,MAAI,gBAAgB;AACpB,QAAM,UAAoB,CAAC;AAC3B,MAAI,CAAC,aAAa,CAAC,WAAW,CAAC,SAAS;AACtC,UAAM,MAAU,EAAE,GAAG,IAAI,KAAK,UAAU,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,EAAE;AACpE,UAAM,cAAc,CAAC,SAAS,SAAS;AACvC,UAAM,SAAS,WAAW,MAAM,QAAQ;AACxC,QAAI,OAAQ,aAAY,KAAK,YAAYJ,SAAQ,GAAG,KAAK,MAAM,CAAC;AAChE,UAAM,UAAU,WAAW,MAAM,SAAS;AAC1C,QAAI,QAAS,aAAY,KAAK,aAAa,OAAO;AAClD,UAAM,aAAa,UAAU,WAAW,GAAG,GAAG;AAC9C,oBAAgB;AAAA,EAClB;AAEA,MAAI,MAAM;AACR,OAAG;AAAA,MACD,KAAK;AAAA,QACH;AAAA,UACE,QAAQ;AAAA,UACR,SAAS;AAAA,UACT;AAAA,UACA,YAAY,KAAK;AAAA,UACjB,OAAO,KAAK;AAAA,UACZ,YAAY,KAAK,UAAU,IAAI,CAAC,OAAO;AAAA,YACrC,MAAM,EAAE,KAAK;AAAA,YACb,OAAO,EAAE,MAAM;AAAA,YACf,KAAK,EAAE;AAAA,UACT,EAAE;AAAA,UACF,OAAO,KAAK;AAAA,UACZ,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO,WAAW,UAAU,IAAI;AAAA,EAClC;AAEA,MAAI,CAAC;AACH,OAAG,IAAI,uEAAuE,UAAU,IAAI;AAAA,OACzF;AACH,OAAG;AAAA,MACD,GAAG,QAAS,KAAK,UAAU,UAAU,YAAa,cAAc,IAAI,UAAU,WAAM,OAAO,KAAK,MAAM,QAAQ,WAAW,CAAC;AAAA,IAC5H;AACA,eAAW,QAAQ,KAAM,IAAG,IAAI,KAAK,IAAI,EAAE;AAAA,EAC7C;AACA,MAAI,KAAK,UAAU,SAAS,GAAG;AAC7B,OAAG,IAAI,EAAE;AACT,OAAG,IAAI,uDAAuD;AAC9D,eAAW,KAAK,KAAK,UAAW,IAAG,IAAI,MAAM,EAAE,KAAK,CAAC,IAAI,EAAE,MAAM,KAAK,WAAM,EAAE,GAAG,EAAE;AAAA,EACrF;AACA,MAAI,KAAK,MAAM,SAAS,GAAG;AACzB,OAAG,IAAI,EAAE;AACT,eAAW,KAAK,KAAK,MAAO,IAAG,IAAI,SAAS,CAAC,EAAE;AAAA,EACjD;AACA,KAAG,IAAI,EAAE;AACT,MAAI,WAAW,SAAS;AACtB,OAAG;AAAA,MACD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,SAAS;AACX,OAAG,IAAI,gFAAgF;AACvF,WAAO;AAAA,EACT;AACA,aAAW,KAAK,QAAS,IAAG,IAAI,CAAC;AACjC,MAAI,UAAW,IAAG,IAAI,qEAAqE;AAC3F,KAAG;AAAA,IACD,iBAAiB,KAAK,IAAI,KAAK,KAAK,SAAS,YAAY,oHAAoH,wCAAwC;AAAA,EACvN;AACA,SAAO;AACT;","names":["writeFileSync","join","resolve","stableHash","group","readFileSync","readFileSync","i","j","group","reader","existsSync","readFileSync","readdirSync","statSync","join","resolve","YAML","existsSync","readdirSync","join","resolve","join","existsSync","statSync","readFileSync","readdirSync","YAML","resolve","join","group","stableHash","writeFileSync"]}

package/dist/chunk-6TUQD666.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/commands/connect.ts","../src/commands/control.ts","../src/commands/hook.ts","../src/hooks/transcript-file.ts","../src/commands/keys.ts","../src/commands/permission-diff.ts","../src/commands/report.ts","../src/cli.ts"],"sourcesContent":["/**\n * `agentguard connect <key>` — point this machine's MCP client at a hosted agentguard proxy.\n *\n * The OSS CLI enforces policy locally and needs no account. The hosted tiers move that\n * enforcement server-side, so \"connecting\" is not an install: it is resolving a key to the\n * customer's own proxy URL and writing one remote MCP server into the client config.\n *\n * Everything the command prints comes from the server, so the CLI never has to know the\n * shape of a proxy id, a band, or the URL scheme — it stays correct when those change.\n */\nimport { existsSync } from \"node:fs\";\nimport { relative } from \"node:path\";\nimport { flagBool, flagString, type ParsedArgs } from \"../args.js\";\nimport {\n  describeConfigPath,\n  detectClientConfigs,\n  isGeminiConfig,\n  mergeServerIntoConfig,\n  PROXY_SERVER_NAME,\n  type ClientConfigFile,\n  type ServerEntry,\n} from \"../configs.js\";\nimport { homeFrom, type Io } from \"../context.js\";\n\nexport const DEFAULT_PROXY_URL = \"https://agentwares-agentguard-proxy.vercel.app\";\n\n/** What POST /connect answers with. Optional fields are tolerated so an older CLI still works. */\ninterface ConnectResponse {\n  proxyId: string;\n  slug: string;\n  mode: string;\n  mcpUrl: string;\n  headers: Record<string, string>;\n  upstreams?: string[];\n  band?: { tier: string; quantity: number };\n  dashboardUrl?: string;\n  mcpServers: Record<string, ServerEntry>;\n  claudeCode?: string;\n}\n\ninterface StructuredError {\n  code: string;\n  cause: string;\n  fix?: string;\n  retryable?: boolean;\n}\n\nfunction fail(e: StructuredError): never {\n  throw e;\n}\n\nexport async function connectCommand(\n  args: ParsedArgs,\n  io: Io,\n  fetchImpl: typeof fetch = fetch,\n): Promise<number> {\n  const key = args.positionals[0] ?? io.env.AGENTGUARD_KEY;\n  if (!key) {\n    io.err(\"usage: agentguard connect <key> [--write] [--client <path>] [--url <proxy-url>]\");\n    io.err(\"  the key is on your dashboard; it starts with agk_\");\n    return 2;\n  }\n\n  const base = (\n    flagString(args, \"url\") ??\n    io.env.AGENTGUARD_PROXY_URL ??\n    DEFAULT_PROXY_URL\n  ).replace(/\\/+$/, \"\");\n\n  let res: Response;\n  try {\n    res = await fetchImpl(`${base}/connect`, {\n      method: \"POST\",\n      headers: { \"content-type\": \"application/json\" },\n      body: JSON.stringify({ key }),\n    });\n  } catch (err) {\n    // A network failure is the one retryable case here; everything else is a bad key or a bad URL.\n    fail({\n      code: \"PROXY_UNREACHABLE\",\n      cause: `could not reach ${base}: ${err instanceof Error ? err.message : String(err)}`,\n      fix: \"check the network, or pass --url if you run your own proxy\",\n      retryable: true,\n    });\n  }\n\n  const text = await res.text();\n  let body: unknown;\n  try {\n    body = JSON.parse(text);\n  } catch {\n    fail({\n      code: \"PROXY_BAD_RESPONSE\",\n      cause: `${base}/connect returned ${res.status} that was not JSON: ${text.slice(0, 200)}`,\n      fix: \"check --url points at an agentguard proxy, not at the dashboard\",\n      retryable: false,\n    });\n  }\n  if (!res.ok) {\n    const e = body as Partial<StructuredError>;\n    fail({\n      code: e.code ?? \"CONNECT_REFUSED\",\n      cause: e.cause ?? `${base}/connect returned ${res.status}`,\n      fix: e.fix ?? \"check the key on your dashboard; revoked keys stop working immediately\",\n      retryable: e.retryable ?? false,\n    });\n  }\n  const conn = body as ConnectResponse;\n\n  if (flagBool(args, \"json\")) {\n    io.out(JSON.stringify(conn, null, 2));\n    return 0;\n  }\n\n  const rel = (p: string) => (p.startsWith(io.cwd + \"/\") ? relative(io.cwd, p) : p);\n  const entry = conn.mcpServers[PROXY_SERVER_NAME] ?? {\n    type: \"http\",\n    url: conn.mcpUrl,\n    headers: conn.headers,\n  };\n\n  if (!flagBool(args, \"write\")) {\n    io.out(JSON.stringify({ mcpServers: { [PROXY_SERVER_NAME]: entry } }, null, 2));\n  } else {\n    const explicit = flagString(args, \"client\");\n    const configs = explicit\n      ? [describeConfigPath(explicit)]\n      : detectClientConfigs(io.cwd, homeFrom(io), io.env);\n    // Same rule as `init`: a user-level config affects every project on the machine, so it is\n    // only written when named explicitly.\n    const projectLevel = configs.filter((c) => c.path.startsWith(io.cwd + \"/\"));\n    let chosen: ClientConfigFile[];\n    if (explicit || flagBool(args, \"all\")) chosen = configs;\n    else chosen = projectLevel.slice(0, 1);\n\n    if (chosen.length === 0) {\n      io.err(\n        \"no MCP config found here (.mcp.json, .cursor/mcp.json, .vscode/mcp.json). Create one, or paste this into your client:\",\n      );\n      io.out(JSON.stringify({ mcpServers: { [PROXY_SERVER_NAME]: entry } }, null, 2));\n      return 1;\n    }\n    for (const c of chosen) {\n      if (!existsSync(c.path)) {\n        io.err(`no MCP config at ${c.path}`);\n        return 1;\n      }\n      // Gemini CLI takes Streamable HTTP as `httpUrl`; its `url` would be dialled as SSE.\n      const forClient: ServerEntry = isGeminiConfig(c)\n        ? { httpUrl: entry.url, ...(entry.headers ? { headers: entry.headers } : {}) }\n        : entry;\n      const { backup, replaced } = mergeServerIntoConfig(c, PROXY_SERVER_NAME, forClient);\n      io.out(\n        `${replaced ? \"updated\" : \"wrote  \"} ${rel(c.path)} (${c.label}) → ${PROXY_SERVER_NAME} = ${conn.mcpUrl}`,\n      );\n      io.out(`backup  ${rel(backup)}`);\n    }\n    for (const c of configs.filter((c) => !chosen.includes(c)))\n      io.out(\n        `found   ${c.path} (${c.label}, user-level) — not touched; pass --client ${JSON.stringify(c.path)} to write it too`,\n      );\n  }\n\n  const band = conn.band ? ` band=${conn.band.tier} (${conn.band.quantity} calls/mo)` : \"\";\n  io.out(`\\nproxy ${conn.slug} (${conn.proxyId}) mode=${conn.mode}${band}`);\n  if (conn.upstreams?.length) io.out(`upstreams: ${conn.upstreams.join(\", \")}`);\n  if (conn.dashboardUrl) io.out(`dashboard: ${conn.dashboardUrl}`);\n  if (conn.claudeCode) io.out(`claude code: ${conn.claudeCode}`);\n  if (!flagBool(args, \"write\"))\n    io.out(`\\nrun again with --write to add this to your MCP client config`);\n  return 0;\n}\n","/**\n * `agentguard kill|resume|approve|deny|approvals` — the human side of the loop.\n */\nimport { flagBool, flagString, type ParsedArgs } from \"../args.js\";\nimport { createFileGuard, loadPolicyFor, readRegistration, type Io } from \"../context.js\";\n\nasync function pokeHttp(\n  io: Io,\n  reg: ReturnType<typeof readRegistration>,\n  path: string,\n  body?: unknown,\n): Promise<void> {\n  if (!reg) return;\n  try {\n    const res = await fetch(`${reg.baseUrl}${path}`, {\n      method: \"POST\",\n      headers: { Authorization: `Bearer ${reg.token}`, \"Content-Type\": \"application/json\" },\n      body: body === undefined ? undefined : JSON.stringify(body),\n      signal: AbortSignal.timeout(2000),\n    });\n    if (!res.ok)\n      io.err(\n        `running proxy at ${reg.baseUrl} answered ${res.status} (the file switch still applies)`,\n      );\n  } catch {\n    io.err(\n      `no proxy answering at ${reg.baseUrl} (stale ${reg.pid}?) — the file switch still applies`,\n    );\n  }\n}\n\nexport async function killCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const { kill } = createFileGuard(loaded, { alerts: false, env: io.env });\n  const reason =\n    args.positionals.join(\" \") ||\n    flagString(args, \"reason\") ||\n    `agentguard kill by ${io.env.USER ?? \"operator\"}`;\n  kill.kill(reason);\n  await pokeHttp(io, readRegistration(loaded), \"/kill\", { reason });\n  io.out(\n    `KILLED: ${kill.path} written — every tool call through this policy now returns KILLED. Clear with: agentguard resume`,\n  );\n  return 0;\n}\n\nexport async function resumeCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const { kill } = createFileGuard(loaded, { alerts: false, env: io.env });\n  kill.resume();\n  await pokeHttp(io, readRegistration(loaded), \"/resume\");\n  io.out(`resumed: ${kill.path} removed`);\n  if (io.env[loaded.policy.kill.env])\n    io.err(\n      `note: ${loaded.policy.kill.env} is set in this shell's environment; proxies started from it stay killed`,\n    );\n  return 0;\n}\n\nexport async function decideCommand(\n  decision: \"approved\" | \"denied\",\n  args: ParsedArgs,\n  io: Io,\n): Promise<number> {\n  const id = args.positionals[0];\n  if (!id) {\n    io.err(\n      `usage: agentguard ${decision === \"approved\" ? \"approve\" : \"deny\"} <approval-id> [--by name] [--note text]`,\n    );\n    return 1;\n  }\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });\n  const record = await guard.decide(\n    id,\n    decision,\n    flagString(args, \"by\") ?? io.env.USER ?? \"cli\",\n    flagString(args, \"note\"),\n  );\n  if (!record) {\n    io.err(`no approval ${id} — pending ones: agentguard approvals`);\n    return 1;\n  }\n  io.out(\n    `${record.status}: ${record.tool} (${record.id}, run ${record.run_id})${record.status === \"approved\" ? \" — the agent may now retry the identical call once\" : \"\"}`,\n  );\n  return 0;\n}\n\nexport async function approvalsCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const { guard } = createFileGuard(loaded, { alerts: false, env: io.env });\n  const list = await guard.approvals.list(flagBool(args, \"all\") ? undefined : \"pending\");\n  if (flagBool(args, \"json\")) {\n    io.out(JSON.stringify(list, null, 2));\n    return 0;\n  }\n  if (list.length === 0) {\n    io.out(flagBool(args, \"all\") ? \"no approvals recorded\" : \"no pending approvals\");\n    return 0;\n  }\n  for (const r of list) {\n    io.out(\n      `${r.id}  ${r.status.padEnd(9)} ${r.tool}  run ${r.run_id}${r.agent ? ` agent ${r.agent}` : \"\"}  expires ${r.expires_at}`,\n    );\n    io.out(`  args: ${JSON.stringify(r.args).slice(0, 300)}`);\n    if (r.status === \"pending\")\n      io.out(`  → agentguard approve ${r.id}   |   agentguard deny ${r.id}`);\n  }\n  return 0;\n}\n","/**\n * `agentguard hook pre-tool-use` — what a coding agent's pre-execution hook runs for each shell\n * command, file edit and MCP tool call: Claude Code `PreToolUse`, Codex `PreToolUse`, Gemini CLI\n * `BeforeTool`. Reads the harness's JSON on stdin and answers in that harness's format on\n * stdout (nothing else may go to stdout).\n *\n * - allow: no output, exit 0. The harness's own permission flow still applies; agentguard never\n *   answers \"allow\", so it can only take permissions away.\n * - deny: Claude Code / Codex `hookSpecificOutput.permissionDecision: \"deny\"`, Gemini CLI\n *   `decision: \"deny\"`, with the agentguard error body (`code`, `cause`, `fix`, `retryable`) as\n *   the reason the model reads, and a one-line `systemMessage` for the person.\n * - dry-run would-have-stopped: a `systemMessage` only; the call runs.\n * - an error inside agentguard: a `systemMessage` saying the call was NOT checked, exit 0. A\n *   broken policy file must not stop the agent; it must not pass silently either.\n */\nimport { existsSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { dirname, join, resolve } from \"node:path\";\nimport {\n  assessHookAction,\n  detectHookClient,\n  hookActionFromInput,\n  type HookClient,\n  type PreflightResult,\n} from \"@agentwares/agentguard-core\";\nimport { flagString, type ParsedArgs } from \"../args.js\";\nimport {\n  approvalUrlFor,\n  createFileGuard,\n  describeError,\n  homeFrom,\n  readRegistration,\n  DEFAULT_POLICY_FILE,\n  type Io,\n} from \"../context.js\";\nimport { CLIENT_ALIASES, hookSettingsFiles } from \"../hooks/clients.js\";\nimport { humanTurnFromTranscript } from \"../hooks/transcript-file.js\";\nimport { loadPolicyFile } from \"@agentwares/agentguard-core/node\";\n\nconst RUN_PREFIX: Record<HookClient, string> = {\n  \"claude-code\": \"cc\",\n  codex: \"codex\",\n  \"gemini-cli\": \"gemini\",\n};\n\n/** Walk up from `start` to the filesystem root looking for agentguard.yaml. */\nfunction findPolicyUpwards(start: string): string | undefined {\n  let dir = resolve(start);\n  for (let i = 0; i < 64; i += 1) {\n    const candidate = join(dir, DEFAULT_POLICY_FILE);\n    if (existsSync(candidate)) return candidate;\n    const parent = dirname(dir);\n    if (parent === dir) return undefined;\n    dir = parent;\n  }\n  return undefined;\n}\n\nfunction projectDir(io: Io, inputCwd: string | undefined): string | undefined {\n  return io.env.CLAUDE_PROJECT_DIR || io.env.GEMINI_PROJECT_DIR || inputCwd || undefined;\n}\n\n/** --config → AGENTGUARD_CONFIG → agentguard.yaml at or above the project → --fallback-config. */\nexport function resolveHookPolicy(\n  args: ParsedArgs,\n  io: Io,\n  inputCwd: string | undefined,\n): { path: string; found: \"flag\" | \"env\" | \"project\" | \"fallback\" } | undefined {\n  const flag = flagString(args, \"config\");\n  if (flag) return { path: resolve(io.cwd, flag), found: \"flag\" };\n  if (io.env.AGENTGUARD_CONFIG)\n    return { path: resolve(io.cwd, io.env.AGENTGUARD_CONFIG), found: \"env\" };\n  const start = projectDir(io, inputCwd) ?? io.cwd;\n  const near = findPolicyUpwards(start);\n  if (near) return { path: near, found: \"project\" };\n  const fallback = flagString(args, \"fallback-config\");\n  if (fallback && existsSync(resolve(io.cwd, fallback)))\n    return { path: resolve(io.cwd, fallback), found: \"fallback\" };\n  return undefined;\n}\n\nfunction out(io: Io, value: unknown): void {\n  io.out(JSON.stringify(value));\n}\n\n/** A systemMessage reaches the person in all three harnesses and changes no decision. */\nfunction warn(io: Io, message: string): void {\n  out(io, { systemMessage: message });\n}\n\nfunction respond(\n  io: Io,\n  client: HookClient,\n  result: PreflightResult,\n  summary: string,\n  approveCommand: (id: string) => string,\n): void {\n  if (result.decision === \"deny\" && result.error) {\n    const e = result.error;\n    const reason = JSON.stringify(e);\n    const id = result.approvalId ? `, approval ${result.approvalId}` : \"\";\n    const approve =\n      e.code === \"APPROVAL_REQUIRED\" && result.approvalId\n        ? ` To let this exact command run once: ${approveCommand(result.approvalId)}`\n        : \"\";\n    const systemMessage = `agentguard refused \"${summary.slice(0, 120)}\" (${e.code}${id}): ${e.cause}${approve}`;\n    if (client === \"gemini-cli\") out(io, { decision: \"deny\", reason, systemMessage });\n    else\n      out(io, {\n        hookSpecificOutput: {\n          hookEventName: \"PreToolUse\",\n          permissionDecision: \"deny\",\n          permissionDecisionReason: reason,\n        },\n        systemMessage,\n      });\n    return;\n  }\n  if (result.would) {\n    out(io, {\n      systemMessage: `agentguard (hooks.mode: dry-run) would have stopped \"${summary.slice(0, 120)}\" with ${result.would.code}: ${result.would.cause} — it ran; nothing is blocked until hooks.mode is enforce`,\n    });\n  }\n}\n\nexport async function hookCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const event = args.positionals[0];\n  if (event !== \"pre-tool-use\") {\n    io.err(\n      \"usage: agentguard hook pre-tool-use [--client claude|codex|gemini] [--config agentguard.yaml] [--fallback-config path]\\n\" +\n        \"  run by a coding agent's pre-execution hook, with the hook's JSON on stdin; `agentguard hooks install` sets it up\",\n    );\n    return 1;\n  }\n  const flagClient = flagString(args, \"client\");\n  let client: HookClient = (flagClient && CLIENT_ALIASES[flagClient]) || \"claude-code\";\n  try {\n    const raw = (await io.stdin?.()) ?? \"\";\n    const input = JSON.parse(raw) as Record<string, unknown>;\n    if (!flagClient) client = detectHookClient(input);\n    const inputCwd = typeof input.cwd === \"string\" ? input.cwd : undefined;\n    const policyRef = resolveHookPolicy(args, io, inputCwd);\n    if (!policyRef) return 0; // no agentguard.yaml for this project: nothing to enforce\n    const loaded = loadPolicyFile(policyRef.path, { env: io.env, allowMissingEnv: true });\n    const action = hookActionFromInput(client, input, inputCwd ?? io.cwd);\n    if (!action) return 0;\n    const home = homeFrom(io);\n    const workspace =\n      projectDir(io, undefined) ??\n      (policyRef.found === \"project\" ? dirname(policyRef.path) : undefined) ??\n      action.cwd;\n    const tmpDirs = [\n      tmpdir(),\n      io.env.TMPDIR,\n      typeof input.scratchpad_dir === \"string\" ? input.scratchpad_dir : undefined,\n      \"/tmp\",\n      \"/private/tmp\",\n      \"/var/folders\",\n      \"/private/var/folders\",\n    ].filter((d): d is string => Boolean(d));\n    const ctx = {\n      workspace: resolve(workspace),\n      home,\n      tmpDirs,\n      stateDir: loaded.stateDir,\n      guardFiles: [loaded.path, ...hookSettingsFiles({ cwd: resolve(workspace), home })],\n    };\n    const assessment = assessHookAction(loaded.policy, action, ctx);\n    const reg = readRegistration(loaded);\n    const { guard } = createFileGuard(loaded, {\n      env: io.env,\n      approvalUrl: approvalUrlFor(reg),\n      log: (line) => io.err(line),\n    });\n    const configHint =\n      policyRef.found === \"project\" && dirname(policyRef.path) === resolve(workspace)\n        ? \"\"\n        : ` --config ${JSON.stringify(policyRef.path)}`;\n    const approveCommand = (id: string): string =>\n      `npx @agentwares/agentguard approve ${id}${configHint}`;\n    const result = await guard.preflight({\n      action,\n      assessment,\n      runId: `${RUN_PREFIX[client]}_${action.sessionId}`,\n      humanTurn: () =>\n        client === \"claude-code\"\n          ? humanTurnFromTranscript(action.transcriptPath, {\n              requireOrigin: loaded.policy.hooks.irreversible.require_origin,\n            })\n          : {\n              missing: `${client} transcripts are not a verified format for this check, so an irreversible command needs \\`agentguard approve\\``,\n            },\n      approveCommand,\n    });\n    respond(io, client, result, assessment.summary, approveCommand);\n    return 0;\n  } catch (err) {\n    warn(\n      io,\n      `agentguard hook error — this call was NOT checked: ${describeError(err).replace(/\\s+/g, \" \").slice(0, 400)}`,\n    );\n    return 0;\n  }\n}\n","/**\n * Read the end of a coding agent's transcript and find the latest turn a person typed. Long\n * sessions write tens of megabytes; the latest human turn is almost always near the end, so read\n * the last 1 MB first and widen only when it holds none.\n */\nimport { closeSync, existsSync, openSync, readSync, statSync } from \"node:fs\";\nimport { scanTranscript, type HumanTurn, type TranscriptScan } from \"@agentwares/agentguard-core\";\n\nconst STEPS = [1 << 20, 8 << 20, 64 << 20];\n\nexport interface TranscriptEvidence {\n  turn?: HumanTurn;\n  /** why there is no turn */\n  missing?: string;\n  scan?: TranscriptScan;\n}\n\nfunction readTail(path: string, bytes: number, size: number): string {\n  const length = Math.min(bytes, size);\n  const fd = openSync(path, \"r\");\n  try {\n    const buf = Buffer.alloc(length);\n    readSync(fd, buf, 0, length, size - length);\n    return buf.toString(\"utf8\");\n  } finally {\n    closeSync(fd);\n  }\n}\n\nexport function humanTurnFromTranscript(\n  path: string | undefined,\n  opts: { requireOrigin?: boolean } = {},\n): TranscriptEvidence {\n  if (!path) return { missing: \"the hook input carried no transcript_path\" };\n  if (!existsSync(path)) return { missing: `no transcript at ${path}` };\n  let size: number;\n  try {\n    size = statSync(path).size;\n  } catch (err) {\n    return {\n      missing: `transcript unreadable: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n  let scan: TranscriptScan | undefined;\n  for (const step of STEPS) {\n    try {\n      scan = scanTranscript(readTail(path, step, size), opts);\n    } catch (err) {\n      return {\n        missing: `transcript unreadable: ${err instanceof Error ? err.message : String(err)}`,\n      };\n    }\n    if (scan.turn || step >= size) break;\n  }\n  if (scan?.turn) return { turn: scan.turn, scan };\n  return {\n    missing:\n      size > STEPS[STEPS.length - 1]! ? \"none in the last 64 MB of the transcript\" : undefined,\n    scan,\n  };\n}\n","/**\n * `agentguard key create|list|revoke` — scoped agent credentials. The proxy holds upstream tokens;\n * each agent gets its own `agk_…` key whose hash and scope live in agentguard.yaml.\n */\nimport { readFileSync, writeFileSync } from \"node:fs\";\nimport YAML, { isMap, isSeq, YAMLSeq, type YAMLMap } from \"yaml\";\nimport { generateAgentKey, hashAgentKey } from \"@agentwares/agentguard-core\";\nimport { flagList, flagNumber, flagString, type ParsedArgs } from \"../args.js\";\nimport { policyPathFrom, type Io } from \"../context.js\";\n\nexport async function keyCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const [sub, name] = args.positionals;\n  const path = policyPathFrom(args, io);\n  const doc = YAML.parseDocument(readFileSync(path, \"utf8\"));\n  let agents = doc.get(\"agents\");\n  if (!isSeq(agents)) {\n    agents = new YAMLSeq();\n    doc.set(\"agents\", agents);\n  }\n  const seq = agents as YAMLSeq;\n  const items = seq.items.filter(isMap) as YAMLMap[];\n\n  if (sub === \"list\" || sub === undefined) {\n    if (items.length === 0)\n      io.out(\n        \"no agents in agentguard.yaml — create one: agentguard key create <name> --allow 'crm_get_*'\",\n      );\n    for (const a of items) {\n      const allow = a.get(\"allow\");\n      io.out(\n        `${String(a.get(\"name\")).padEnd(20)} key: ${a.get(\"key_hash\") ? \"set\" : \"none (stdio --agent only)\"}  allow: ${isSeq(allow) ? allow.items.map(String).join(\", \") : \"all\"}`,\n      );\n    }\n    return 0;\n  }\n  if (!name) {\n    io.err(\n      \"usage: agentguard key create <agent> [--allow pattern]... [--deny pattern]... [--writes n] [--spend n] [--deletes n] [--emails n] [--tool-calls n] [--mode dry-run|enforce] [--upstream name]...\",\n    );\n    return 1;\n  }\n  if (sub === \"revoke\") {\n    const idx = items.findIndex((a) => a.get(\"name\") === name);\n    if (idx < 0) {\n      io.err(`no agent \"${name}\"`);\n      return 1;\n    }\n    seq.items.splice(seq.items.indexOf(items[idx]!), 1);\n    writeFileSync(path, doc.toString());\n    io.out(`revoked ${name}: removed from agentguard.yaml (running proxies pick it up on restart)`);\n    return 0;\n  }\n  if (sub !== \"create\") {\n    io.err(`unknown subcommand \"${sub}\" — use create, list or revoke`);\n    return 1;\n  }\n  const key = generateAgentKey();\n  const keyHash = await hashAgentKey(key);\n  const existing = items.find((a) => a.get(\"name\") === name);\n  const entry: Record<string, unknown> = { name, key_hash: keyHash };\n  const allow = flagList(args, \"allow\");\n  const deny = flagList(args, \"deny\");\n  if (allow.length) entry.allow = allow;\n  if (deny.length) entry.deny = deny;\n  const upstreams = flagList(args, \"upstream\");\n  if (upstreams.length) entry.upstreams = upstreams;\n  const mode = flagString(args, \"mode\");\n  if (mode) entry.mode = mode;\n  const perRun: Record<string, number> = {};\n  for (const [flag, counter] of [\n    [\"writes\", \"writes\"],\n    [\"spend\", \"spend_usd\"],\n    [\"deletes\", \"deletes\"],\n    [\"emails\", \"emails\"],\n    [\"tool-calls\", \"tool_calls\"],\n  ] as const) {\n    const n = flagNumber(args, flag);\n    if (n !== undefined) perRun[counter] = n;\n  }\n  if (Object.keys(perRun).length) entry.caps = { per_run: perRun };\n  if (existing) {\n    for (const [k, v] of Object.entries(entry)) existing.set(k, v);\n  } else {\n    seq.add(doc.createNode(entry));\n  }\n  writeFileSync(path, doc.toString());\n  io.err(\n    `${existing ? \"rotated\" : \"created\"} agent \"${name}\" in ${path}${allow.length ? ` (allow: ${allow.join(\", \")})` : \" (allow: all tools)\"}`,\n  );\n  io.err(\n    \"the key is shown once; give it to the agent as `Authorization: Bearer <key>` (HTTP) — over stdio use `agentguard proxy --agent \" +\n      name +\n      \"`\",\n  );\n  io.out(key);\n  return 0;\n}\n","/**\n * `agentguard permission-diff` — which changes between two git refs widen what an agent may do\n * (agentguard.yaml, .claude/settings.json, mcp.json). The GitHub Action posts the markdown.\n */\nimport { execFileSync } from \"node:child_process\";\nimport {\n  diffPermissionFile,\n  renderPermissionDiffMarkdown,\n  type Finding,\n} from \"@agentwares/agentguard-core\";\nimport { flagBool, flagList, flagString, type ParsedArgs } from \"../args.js\";\nimport type { Io } from \"../context.js\";\n\nexport const DEFAULT_PERMISSION_PATHS = [\n  \"agentguard.yaml\",\n  \"agentguard.yml\",\n  \".claude/settings.json\",\n  \".claude/settings.local.json\",\n  \".mcp.json\",\n  \"mcp.json\",\n  \".cursor/mcp.json\",\n  \".vscode/mcp.json\",\n];\n\nconst PERMISSION_FILE =\n  /(^|\\/)(agentguard[^/]*\\.ya?ml|\\.claude\\/settings(\\.local)?\\.json|[^/]*mcp[^/]*\\.json|claude_desktop_config\\.json)$/;\n\nfunction git(cwd: string, argv: string[]): string | undefined {\n  try {\n    return execFileSync(\"git\", argv, {\n      cwd,\n      encoding: \"utf8\",\n      stdio: [\"ignore\", \"pipe\", \"ignore\"],\n    });\n  } catch {\n    return undefined;\n  }\n}\n\nexport function showAt(cwd: string, ref: string, path: string): string | undefined {\n  return git(cwd, [\"show\", `${ref}:${path}`]);\n}\n\nexport function changedPermissionFiles(cwd: string, base: string, head: string): string[] {\n  const out = git(cwd, [\"diff\", \"--name-only\", base, head]) ?? \"\";\n  return out\n    .split(\"\\n\")\n    .map((l) => l.trim())\n    .filter((l) => l && PERMISSION_FILE.test(l));\n}\n\nexport function resolveBase(cwd: string, explicit: string | undefined): string {\n  if (explicit) return explicit;\n  for (const candidate of [\"origin/main\", \"main\", \"origin/master\", \"master\"]) {\n    if (git(cwd, [\"rev-parse\", \"--verify\", \"--quiet\", candidate]) !== undefined) return candidate;\n  }\n  return \"HEAD~1\";\n}\n\nexport interface PermissionDiffResult {\n  base: string;\n  head: string;\n  files: string[];\n  findings: Finding[];\n  markdown: string;\n}\n\nexport function runPermissionDiff(\n  cwd: string,\n  opts: { base?: string; head?: string; paths?: string[]; title?: string },\n): PermissionDiffResult {\n  const base = resolveBase(cwd, opts.base);\n  const head = opts.head ?? \"HEAD\";\n  const files = [\n    ...new Set([\n      ...(opts.paths ?? DEFAULT_PERMISSION_PATHS),\n      ...changedPermissionFiles(cwd, base, head),\n    ]),\n  ];\n  const findings: Finding[] = [];\n  const touched: string[] = [];\n  for (const file of files) {\n    const before = showAt(cwd, base, file);\n    const after = showAt(cwd, head, file);\n    if (before === undefined && after === undefined) continue;\n    if (before === after) continue;\n    touched.push(file);\n    findings.push(...diffPermissionFile(file, before, after));\n  }\n  return {\n    base,\n    head,\n    files: touched,\n    findings,\n    markdown: renderPermissionDiffMarkdown(findings, { title: opts.title }),\n  };\n}\n\nexport async function permissionDiffCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const paths = flagList(args, \"paths\");\n  const result = runPermissionDiff(io.cwd, {\n    base: flagString(args, \"base\"),\n    head: flagString(args, \"head\"),\n    paths: paths.length ? paths : undefined,\n  });\n  const format = flagString(args, \"format\") ?? (flagBool(args, \"json\") ? \"json\" : \"markdown\");\n  if (format === \"json\") io.out(JSON.stringify(result, null, 2));\n  else io.out(result.markdown);\n  const widen = result.findings.filter((f) => f.severity === \"widen\").length;\n  if (flagBool(args, \"fail-on-widen\") && widen > 0) return 1;\n  return 0;\n}\n","/**\n * `agentguard report` (the incident-shaped summary), `diff` (mutation diff), `verify` (audit\n * chain), `status` (counters and remaining budget).\n */\nimport { resolve } from \"node:path\";\nimport {\n  buildReport,\n  latestRunId,\n  listRuns,\n  renderMutationDiff,\n  renderReportMarkdown,\n} from \"@agentwares/agentguard-core\";\nimport { readAuditFile, verifyAuditFile } from \"@agentwares/agentguard-core/node\";\nimport { flagBool, flagString, type ParsedArgs } from \"../args.js\";\nimport { createFileGuard, loadPolicyFor, readRegistration, type Io } from \"../context.js\";\n\nfunction pickRun(args: ParsedArgs, entries: ReturnType<typeof readAuditFile>): string | undefined {\n  if (flagBool(args, \"all\")) return undefined;\n  return flagString(args, \"run\") ?? latestRunId(entries);\n}\n\nexport async function reportCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const entries = readAuditFile(loaded.auditPath);\n  const runId = pickRun(args, entries);\n  const report = buildReport(entries, { runId });\n  if (flagBool(args, \"json\")) {\n    io.out(\n      JSON.stringify(\n        {\n          ...report,\n          mutations: report.mutations.map((m) => ({\n            seq: m.seq,\n            ts: m.ts,\n            tool: m.tool,\n            mutation: m.mutation,\n          })),\n        },\n        null,\n        2,\n      ),\n    );\n    return 0;\n  }\n  io.out(renderReportMarkdown(report));\n  const chain = await verifyAuditFile(loaded.auditPath);\n  io.out(\n    chain.ok\n      ? `Audit chain: ${chain.entries} entries, verified (${loaded.auditPath}).`\n      : `Audit chain BROKEN at entry ${chain.brokenAt}: ${chain.reason}`,\n  );\n  if (runId && listRuns(entries).length > 1) io.out(`Other runs: agentguard report --all`);\n  return 0;\n}\n\nexport async function diffCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const entries = readAuditFile(loaded.auditPath);\n  const runId = pickRun(args, entries);\n  io.out(renderMutationDiff(entries, { runId }).trimEnd());\n  return 0;\n}\n\nexport async function verifyCommand(args: ParsedArgs, io: Io): Promise<number> {\n  let path = args.positionals[0];\n  if (!path) path = loadPolicyFor(args, io, { allowMissingEnv: true }).auditPath;\n  path = resolve(io.cwd, path);\n  const result = await verifyAuditFile(path);\n  if (flagBool(args, \"json\")) io.out(JSON.stringify({ path, ...result }));\n  else if (result.ok)\n    io.out(\n      `ok: ${result.entries} entries, chain intact, head ${result.head?.slice(0, 16)}… (${path})`,\n    );\n  else io.out(`BROKEN at entry ${result.brokenAt}: ${result.reason} (${path})`);\n  return result.ok ? 0 : 1;\n}\n\nexport async function statusCommand(args: ParsedArgs, io: Io): Promise<number> {\n  const loaded = loadPolicyFor(args, io, { allowMissingEnv: true });\n  const { guard, kill } = createFileGuard(loaded, { alerts: false, env: io.env });\n  const entries = readAuditFile(loaded.auditPath);\n  const runId = flagString(args, \"run\") ?? latestRunId(entries) ?? \"(none yet)\";\n  const status = await guard.status(runId);\n  const killed = kill.check();\n  const reg = readRegistration(loaded);\n  const pending = await guard.approvals.list(\"pending\");\n  if (flagBool(args, \"json\")) {\n    io.out(\n      JSON.stringify(\n        {\n          policy: loaded.path,\n          mode: loaded.policy.mode,\n          runId,\n          ...status,\n          killed,\n          pendingApprovals: pending.length,\n          http: reg ? { url: reg.url, pid: reg.pid } : undefined,\n        },\n        null,\n        2,\n      ),\n    );\n    return 0;\n  }\n  io.out(\n    `policy   ${loaded.path} (mode: ${loaded.policy.mode}, ${loaded.policy.upstreams.length} upstreams)`,\n  );\n  io.out(\n    `kill     ${killed.killed ? `ON — ${killed.reason} (agentguard resume to clear)` : \"off\"}`,\n  );\n  io.out(\n    `http     ${reg ? `${reg.url} (pid ${reg.pid})` : \"not running (agentguard proxy --http)\"}`,\n  );\n  io.out(`audit    ${entries.length} entries in ${loaded.auditPath}`);\n  io.out(\n    `pending  ${pending.length} approval${pending.length === 1 ? \"\" : \"s\"}${pending.length ? ` — agentguard approvals` : \"\"}`,\n  );\n  io.out(`run      ${runId}`);\n  const fmt = (scope: \"per_run\" | \"per_day\"): string =>\n    Object.entries(status.caps[scope])\n      .map(([k, limit]) => `${k} ${status.usage[scope][k] ?? 0}/${limit}`)\n      .join(\"  \") || \"no caps\";\n  io.out(`  per_run  ${fmt(\"per_run\")}`);\n  io.out(`  per_day  ${fmt(\"per_day\")}`);\n  return 0;\n}\n","#!/usr/bin/env node\n/**\n * `agentguard` — MCP policy proxy: hard spend limits, destructive-action gating with approvals,\n * a kill switch, scoped credentials, dry-run writes, a loop breaker, blast-radius caps and a\n * hash-chained audit log. No LLM calls, no phone-home, no account.\n */\nimport { parseArgs, type ParsedArgs } from \"./args.js\";\nimport { version } from \"./version.js\";\n\nexport { version };\nimport { defaultIo, describeError, type Io } from \"./context.js\";\nimport { connectCommand } from \"./commands/connect.js\";\nimport { approvalsCommand, decideCommand, killCommand, resumeCommand } from \"./commands/control.js\";\nimport { hookCommand } from \"./commands/hook.js\";\nimport { hooksCommand } from \"./commands/hooks.js\";\nimport { keyCommand } from \"./commands/keys.js\";\nimport { permissionDiffCommand } from \"./commands/permission-diff.js\";\nimport { diffCommand, reportCommand, statusCommand, verifyCommand } from \"./commands/report.js\";\n\n// The MCP SDK costs ~110 ms to load. `agentguard hook pre-tool-use` runs before every guarded\n// tool call of a coding agent and never needs it, so the commands that do load it on demand.\nconst proxyCommand = async (args: ParsedArgs, io: Io): Promise<number> =>\n  (await import(\"./commands/proxy.js\")).proxyCommand(args, io);\nconst initCommand = async (args: ParsedArgs, io: Io): Promise<number> =>\n  (await import(\"./commands/init.js\")).initCommand(args, io);\nconst toolsCommand = async (args: ParsedArgs, io: Io): Promise<number> =>\n  (await import(\"./commands/tools.js\")).toolsCommand(args, io);\nconst auditCommand = async (args: ParsedArgs, io: Io): Promise<number> =>\n  (await import(\"./commands/audit.js\")).auditCommand(args, io);\n\nexport const HELP = `agentguard — MCP policy proxy for agents that touch production\n\n  npx @agentwares/agentguard init                 read your MCP config, write agentguard.yaml (dry-run), route every server through the proxy\n  agentguard report [--run id|--all]  what this run did / would have destroyed / spent, where it was halted\n  agentguard diff [--run id]          record-by-record mutation diff from a dry run\n  agentguard verify [audit.jsonl]     prove the hash-chained audit log was not edited\n  agentguard connect <key> [--write]  point this machine at your hosted proxy (paid tiers)\n\n  agentguard hooks install [--project|--user] [--client claude|codex|gemini|all]\n                                      check a coding agent's own shell commands and file edits against agentguard.yaml (dry-run first);\n                                      irreversible commands (push, merge, publish, send, rm outside the repo) only on a turn a person typed\n  agentguard hooks uninstall | status\n  agentguard hook pre-tool-use        what the installed hook runs (reads the harness's JSON on stdin)\n\n  agentguard audit [--since 7d|30d|all] [--client claude|codex|all] [--json]\n                                      which rules in CLAUDE.md / AGENTS.md / GEMINI.md / .cursor/rules your coding agents broke,\n                                      from this machine's Claude Code and Codex sessions in this repo (nothing is sent anywhere)\n  agentguard audit --enforce [--preview]\n                                      write the checkable rules into agentguard.yaml as hook rules, in dry-run, and install the hook\n\n  agentguard proxy [--http --port 8788] [--agent name] [--run-id id] [--mode dry-run|enforce]\n  agentguard tools [--json]           the tools your agent will see, with class and why\n  agentguard status [--run id]        counters vs caps, kill state, pending approvals\n\n  agentguard kill [reason]            halt every run now (file + running HTTP proxy);  agentguard resume\n  agentguard approvals [--all]        pending approvals;  agentguard approve <id> | deny <id> [--note text]\n  agentguard key create <agent> [--allow 'crm_get_*']... [--deny p] [--writes n] [--spend n] [--mode m]\n  agentguard key list | revoke <agent>\n  agentguard permission-diff [--base ref] [--head ref] [--paths a,b] [--format markdown|json] [--fail-on-widen]\n\nOptions: --config <agentguard.yaml> (or AGENTGUARD_CONFIG), --json, --help, --version\nDocs: https://github.com/agentwares/agentguard/tree/main/apps/agentguard-cli`;\n\nexport async function main(argv: readonly string[], io: Io = defaultIo()): Promise<number> {\n  const args: ParsedArgs = parseArgs(argv);\n  if (args.flags.version) {\n    io.out(version());\n    return 0;\n  }\n  if (args.command === undefined && !args.flags.help && io.tty === false) {\n    // An MCP client spawned bare `npx @agentwares/agentguard` — that is what server.json registers — and is\n    // waiting for JSON-RPC on stdout. Serve the proxy instead of printing help into the stream.\n    try {\n      return await proxyCommand(args, io);\n    } catch (err) {\n      io.err(describeError(err));\n      return 1;\n    }\n  }\n  if (args.flags.help || args.command === undefined || args.command === \"help\") {\n    io.out(HELP);\n    return args.command === undefined && !args.flags.help ? 1 : 0;\n  }\n  try {\n    switch (args.command) {\n      case \"init\":\n        return await initCommand(args, io);\n      case \"proxy\":\n      case \"serve\":\n        return await proxyCommand(args, io);\n      case \"report\":\n        return await reportCommand(args, io);\n      case \"diff\":\n        return await diffCommand(args, io);\n      case \"verify\":\n        return await verifyCommand(args, io);\n      case \"connect\":\n        return await connectCommand(args, io);\n      case \"status\":\n        return await statusCommand(args, io);\n      case \"tools\":\n        return await toolsCommand(args, io);\n      case \"kill\":\n        return await killCommand(args, io);\n      case \"resume\":\n        return await resumeCommand(args, io);\n      case \"approve\":\n        return await decideCommand(\"approved\", args, io);\n      case \"deny\":\n        return await decideCommand(\"denied\", args, io);\n      case \"approvals\":\n        return await approvalsCommand(args, io);\n      case \"key\":\n      case \"keys\":\n        return await keyCommand(args, io);\n      case \"permission-diff\":\n        return await permissionDiffCommand(args, io);\n      case \"hook\":\n        return await hookCommand(args, io);\n      case \"hooks\":\n        return await hooksCommand(args, io);\n      case \"audit\":\n        return await auditCommand(args, io);\n      default:\n        io.err(`unknown command \"${args.command}\"\\n`);\n        io.err(HELP);\n        return 1;\n    }\n  } catch (err) {\n    io.err(describeError(err));\n    return 1;\n  }\n}\n\nconst isMain =\n  process.argv[1] !== undefined && /(^|\\/)(cli\\.[cm]?[jt]s|agentguard)$/.test(process.argv[1]);\nif (isMain) {\n  main(process.argv.slice(2)).then(\n    (code) => {\n      if (code !== 0) process.exitCode = code;\n    },\n    (err: unknown) => {\n      process.stderr.write(`${describeError(err)}\\n`);\n      process.exitCode = 1;\n    },\n  );\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAUA,SAAS,kBAAkB;AAC3B,SAAS,gBAAgB;AAalB,IAAM,oBAAoB;AAuBjC,SAAS,KAAK,GAA2B;AACvC,QAAM;AACR;AAEA,eAAsB,eACpB,MACA,IACA,YAA0B,OACT;AACjB,QAAM,MAAM,KAAK,YAAY,CAAC,KAAK,GAAG,IAAI;AAC1C,MAAI,CAAC,KAAK;AACR,OAAG,IAAI,iFAAiF;AACxF,OAAG,IAAI,qDAAqD;AAC5D,WAAO;AAAA,EACT;AAEA,QAAM,QACJ,WAAW,MAAM,KAAK,KACtB,GAAG,IAAI,wBACP,mBACA,QAAQ,QAAQ,EAAE;AAEpB,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,UAAU,GAAG,IAAI,YAAY;AAAA,MACvC,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,IAAI,CAAC;AAAA,IAC9B,CAAC;AAAA,EACH,SAAS,KAAK;AAEZ,SAAK;AAAA,MACH,MAAM;AAAA,MACN,OAAO,mBAAmB,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACnF,KAAK;AAAA,MACL,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AAEA,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI;AACJ,MAAI;AACF,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,SAAK;AAAA,MACH,MAAM;AAAA,MACN,OAAO,GAAG,IAAI,qBAAqB,IAAI,MAAM,uBAAuB,KAAK,MAAM,GAAG,GAAG,CAAC;AAAA,MACtF,KAAK;AAAA,MACL,WAAW;AAAA,IACb,CAAC;AAAA,EACH;AACA,MAAI,CAAC,IAAI,IAAI;AACX,UAAM,IAAI;AACV,SAAK;AAAA,MACH,MAAM,EAAE,QAAQ;AAAA,MAChB,OAAO,EAAE,SAAS,GAAG,IAAI,qBAAqB,IAAI,MAAM;AAAA,MACxD,KAAK,EAAE,OAAO;AAAA,MACd,WAAW,EAAE,aAAa;AAAA,IAC5B,CAAC;AAAA,EACH;AACA,QAAM,OAAO;AAEb,MAAI,SAAS,MAAM,MAAM,GAAG;AAC1B,OAAG,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AACpC,WAAO;AAAA,EACT;AAEA,QAAM,MAAM,CAAC,MAAe,EAAE,WAAW,GAAG,MAAM,GAAG,IAAI,SAAS,GAAG,KAAK,CAAC,IAAI;AAC/E,QAAM,QAAQ,KAAK,WAAW,iBAAiB,KAAK;AAAA,IAClD,MAAM;AAAA,IACN,KAAK,KAAK;AAAA,IACV,SAAS,KAAK;AAAA,EAChB;AAEA,MAAI,CAAC,SAAS,MAAM,OAAO,GAAG;AAC5B,OAAG,IAAI,KAAK,UAAU,EAAE,YAAY,EAAE,CAAC,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AAAA,EAChF,OAAO;AACL,UAAM,WAAW,WAAW,MAAM,QAAQ;AAC1C,UAAM,UAAU,WACZ,CAAC,mBAAmB,QAAQ,CAAC,IAC7B,oBAAoB,GAAG,KAAK,SAAS,EAAE,GAAG,GAAG,GAAG;AAGpD,UAAM,eAAe,QAAQ,OAAO,CAAC,MAAM,EAAE,KAAK,WAAW,GAAG,MAAM,GAAG,CAAC;AAC1E,QAAI;AACJ,QAAI,YAAY,SAAS,MAAM,KAAK,EAAG,UAAS;AAAA,QAC3C,UAAS,aAAa,MAAM,GAAG,CAAC;AAErC,QAAI,OAAO,WAAW,GAAG;AACvB,SAAG;AAAA,QACD;AAAA,MACF;AACA,SAAG,IAAI,KAAK,UAAU,EAAE,YAAY,EAAE,CAAC,iBAAiB,GAAG,MAAM,EAAE,GAAG,MAAM,CAAC,CAAC;AAC9E,aAAO;AAAA,IACT;AACA,eAAW,KAAK,QAAQ;AACtB,UAAI,CAAC,WAAW,EAAE,IAAI,GAAG;AACvB,WAAG,IAAI,oBAAoB,EAAE,IAAI,EAAE;AACnC,eAAO;AAAA,MACT;AAEA,YAAM,YAAyB,eAAe,CAAC,IAC3C,EAAE,SAAS,MAAM,KAAK,GAAI,MAAM,UAAU,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC,EAAG,IAC3E;AACJ,YAAM,EAAE,QAAQ,SAAS,IAAI,sBAAsB,GAAG,mBAAmB,SAAS;AAClF,SAAG;AAAA,QACD,GAAG,WAAW,YAAY,SAAS,IAAI,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,KAAK,YAAO,iBAAiB,MAAM,KAAK,MAAM;AAAA,MACzG;AACA,SAAG,IAAI,WAAW,IAAI,MAAM,CAAC,EAAE;AAAA,IACjC;AACA,eAAW,KAAK,QAAQ,OAAO,CAACA,OAAM,CAAC,OAAO,SAASA,EAAC,CAAC;AACvD,SAAG;AAAA,QACD,WAAW,EAAE,IAAI,KAAK,EAAE,KAAK,mDAA8C,KAAK,UAAU,EAAE,IAAI,CAAC;AAAA,MACnG;AAAA,EACJ;AAEA,QAAM,OAAO,KAAK,OAAO,SAAS,KAAK,KAAK,IAAI,KAAK,KAAK,KAAK,QAAQ,eAAe;AACtF,KAAG,IAAI;AAAA,QAAW,KAAK,IAAI,KAAK,KAAK,OAAO,UAAU,KAAK,IAAI,GAAG,IAAI,EAAE;AACxE,MAAI,KAAK,WAAW,OAAQ,IAAG,IAAI,cAAc,KAAK,UAAU,KAAK,IAAI,CAAC,EAAE;AAC5E,MAAI,KAAK,aAAc,IAAG,IAAI,cAAc,KAAK,YAAY,EAAE;AAC/D,MAAI,KAAK,WAAY,IAAG,IAAI,gBAAgB,KAAK,UAAU,EAAE;AAC7D,MAAI,CAAC,SAAS,MAAM,OAAO;AACzB,OAAG,IAAI;AAAA,6DAAgE;AACzE,SAAO;AACT;;;ACrKA,eAAe,SACb,IACA,KACA,MACA,MACe;AACf,MAAI,CAAC,IAAK;AACV,MAAI;AACF,UAAM,MAAM,MAAM,MAAM,GAAG,IAAI,OAAO,GAAG,IAAI,IAAI;AAAA,MAC/C,QAAQ;AAAA,MACR,SAAS,EAAE,eAAe,UAAU,IAAI,KAAK,IAAI,gBAAgB,mBAAmB;AAAA,MACpF,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC1D,QAAQ,YAAY,QAAQ,GAAI;AAAA,IAClC,CAAC;AACD,QAAI,CAAC,IAAI;AACP,SAAG;AAAA,QACD,oBAAoB,IAAI,OAAO,aAAa,IAAI,MAAM;AAAA,MACxD;AAAA,EACJ,QAAQ;AACN,OAAG;AAAA,MACD,yBAAyB,IAAI,OAAO,WAAW,IAAI,GAAG;AAAA,IACxD;AAAA,EACF;AACF;AAEA,eAAsB,YAAY,MAAkB,IAAyB;AAC3E,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,EAAE,KAAK,IAAI,gBAAgB,QAAQ,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;AACvE,QAAM,SACJ,KAAK,YAAY,KAAK,GAAG,KACzB,WAAW,MAAM,QAAQ,KACzB,sBAAsB,GAAG,IAAI,QAAQ,UAAU;AACjD,OAAK,KAAK,MAAM;AAChB,QAAM,SAAS,IAAI,iBAAiB,MAAM,GAAG,SAAS,EAAE,OAAO,CAAC;AAChE,KAAG;AAAA,IACD,WAAW,KAAK,IAAI;AAAA,EACtB;AACA,SAAO;AACT;AAEA,eAAsB,cAAc,MAAkB,IAAyB;AAC7E,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,EAAE,KAAK,IAAI,gBAAgB,QAAQ,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;AACvE,OAAK,OAAO;AACZ,QAAM,SAAS,IAAI,iBAAiB,MAAM,GAAG,SAAS;AACtD,KAAG,IAAI,YAAY,KAAK,IAAI,UAAU;AACtC,MAAI,GAAG,IAAI,OAAO,OAAO,KAAK,GAAG;AAC/B,OAAG;AAAA,MACD,SAAS,OAAO,OAAO,KAAK,GAAG;AAAA,IACjC;AACF,SAAO;AACT;AAEA,eAAsB,cACpB,UACA,MACA,IACiB;AACjB,QAAM,KAAK,KAAK,YAAY,CAAC;AAC7B,MAAI,CAAC,IAAI;AACP,OAAG;AAAA,MACD,qBAAqB,aAAa,aAAa,YAAY,MAAM;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AACA,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,EAAE,MAAM,IAAI,gBAAgB,QAAQ,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;AACxE,QAAM,SAAS,MAAM,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,WAAW,MAAM,IAAI,KAAK,GAAG,IAAI,QAAQ;AAAA,IACzC,WAAW,MAAM,MAAM;AAAA,EACzB;AACA,MAAI,CAAC,QAAQ;AACX,OAAG,IAAI,eAAe,EAAE,4CAAuC;AAC/D,WAAO;AAAA,EACT;AACA,KAAG;AAAA,IACD,GAAG,OAAO,MAAM,KAAK,OAAO,IAAI,KAAK,OAAO,EAAE,SAAS,OAAO,MAAM,IAAI,OAAO,WAAW,aAAa,4DAAuD,EAAE;AAAA,EAClK;AACA,SAAO;AACT;AAEA,eAAsB,iBAAiB,MAAkB,IAAyB;AAChF,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,EAAE,MAAM,IAAI,gBAAgB,QAAQ,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;AACxE,QAAM,OAAO,MAAM,MAAM,UAAU,KAAK,SAAS,MAAM,KAAK,IAAI,SAAY,SAAS;AACrF,MAAI,SAAS,MAAM,MAAM,GAAG;AAC1B,OAAG,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AACpC,WAAO;AAAA,EACT;AACA,MAAI,KAAK,WAAW,GAAG;AACrB,OAAG,IAAI,SAAS,MAAM,KAAK,IAAI,0BAA0B,sBAAsB;AAC/E,WAAO;AAAA,EACT;AACA,aAAW,KAAK,MAAM;AACpB,OAAG;AAAA,MACD,GAAG,EAAE,EAAE,KAAK,EAAE,OAAO,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,SAAS,EAAE,MAAM,GAAG,EAAE,QAAQ,UAAU,EAAE,KAAK,KAAK,EAAE,aAAa,EAAE,UAAU;AAAA,IACzH;AACA,OAAG,IAAI,WAAW,KAAK,UAAU,EAAE,IAAI,EAAE,MAAM,GAAG,GAAG,CAAC,EAAE;AACxD,QAAI,EAAE,WAAW;AACf,SAAG,IAAI,+BAA0B,EAAE,EAAE,0BAA0B,EAAE,EAAE,EAAE;AAAA,EACzE;AACA,SAAO;AACT;;;AC/FA,SAAS,cAAAC,mBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,SAAS,MAAM,eAAe;AACvC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACnBP,SAAS,WAAW,cAAAC,aAAY,UAAU,UAAU,gBAAgB;AACpE,SAAS,sBAA2D;AAEpE,IAAM,QAAQ,CAAC,KAAK,IAAI,KAAK,IAAI,MAAM,EAAE;AASzC,SAAS,SAAS,MAAc,OAAe,MAAsB;AACnE,QAAM,SAAS,KAAK,IAAI,OAAO,IAAI;AACnC,QAAM,KAAK,SAAS,MAAM,GAAG;AAC7B,MAAI;AACF,UAAM,MAAM,OAAO,MAAM,MAAM;AAC/B,aAAS,IAAI,KAAK,GAAG,QAAQ,OAAO,MAAM;AAC1C,WAAO,IAAI,SAAS,MAAM;AAAA,EAC5B,UAAE;AACA,cAAU,EAAE;AAAA,EACd;AACF;AAEO,SAAS,wBACd,MACA,OAAoC,CAAC,GACjB;AACpB,MAAI,CAAC,KAAM,QAAO,EAAE,SAAS,4CAA4C;AACzE,MAAI,CAACA,YAAW,IAAI,EAAG,QAAO,EAAE,SAAS,oBAAoB,IAAI,GAAG;AACpE,MAAI;AACJ,MAAI;AACF,WAAO,SAAS,IAAI,EAAE;AAAA,EACxB,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,SAAS,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACrF;AAAA,EACF;AACA,MAAI;AACJ,aAAW,QAAQ,OAAO;AACxB,QAAI;AACF,aAAO,eAAe,SAAS,MAAM,MAAM,IAAI,GAAG,IAAI;AAAA,IACxD,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,SAAS,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACrF;AAAA,IACF;AACA,QAAI,KAAK,QAAQ,QAAQ,KAAM;AAAA,EACjC;AACA,MAAI,MAAM,KAAM,QAAO,EAAE,MAAM,KAAK,MAAM,KAAK;AAC/C,SAAO;AAAA,IACL,SACE,OAAO,MAAM,MAAM,SAAS,CAAC,IAAK,6CAA6C;AAAA,IACjF;AAAA,EACF;AACF;;;ADvBA,SAAS,sBAAsB;AAE/B,IAAM,aAAyC;AAAA,EAC7C,eAAe;AAAA,EACf,OAAO;AAAA,EACP,cAAc;AAChB;AAGA,SAAS,kBAAkB,OAAmC;AAC5D,MAAI,MAAM,QAAQ,KAAK;AACvB,WAAS,IAAI,GAAG,IAAI,IAAI,KAAK,GAAG;AAC9B,UAAM,YAAY,KAAK,KAAK,mBAAmB;AAC/C,QAAIC,YAAW,SAAS,EAAG,QAAO;AAClC,UAAM,SAAS,QAAQ,GAAG;AAC1B,QAAI,WAAW,IAAK,QAAO;AAC3B,UAAM;AAAA,EACR;AACA,SAAO;AACT;AAEA,SAAS,WAAW,IAAQ,UAAkD;AAC5E,SAAO,GAAG,IAAI,sBAAsB,GAAG,IAAI,sBAAsB,YAAY;AAC/E;AAGO,SAAS,kBACd,MACA,IACA,UAC8E;AAC9E,QAAM,OAAO,WAAW,MAAM,QAAQ;AACtC,MAAI,KAAM,QAAO,EAAE,MAAM,QAAQ,GAAG,KAAK,IAAI,GAAG,OAAO,OAAO;AAC9D,MAAI,GAAG,IAAI;AACT,WAAO,EAAE,MAAM,QAAQ,GAAG,KAAK,GAAG,IAAI,iBAAiB,GAAG,OAAO,MAAM;AACzE,QAAM,QAAQ,WAAW,IAAI,QAAQ,KAAK,GAAG;AAC7C,QAAM,OAAO,kBAAkB,KAAK;AACpC,MAAI,KAAM,QAAO,EAAE,MAAM,MAAM,OAAO,UAAU;AAChD,QAAM,WAAW,WAAW,MAAM,iBAAiB;AACnD,MAAI,YAAYA,YAAW,QAAQ,GAAG,KAAK,QAAQ,CAAC;AAClD,WAAO,EAAE,MAAM,QAAQ,GAAG,KAAK,QAAQ,GAAG,OAAO,WAAW;AAC9D,SAAO;AACT;AAEA,SAAS,IAAI,IAAQ,OAAsB;AACzC,KAAG,IAAI,KAAK,UAAU,KAAK,CAAC;AAC9B;AAGA,SAAS,KAAK,IAAQ,SAAuB;AAC3C,MAAI,IAAI,EAAE,eAAe,QAAQ,CAAC;AACpC;AAEA,SAAS,QACP,IACA,QACA,QACA,SACA,gBACM;AACN,MAAI,OAAO,aAAa,UAAU,OAAO,OAAO;AAC9C,UAAM,IAAI,OAAO;AACjB,UAAM,SAAS,KAAK,UAAU,CAAC;AAC/B,UAAM,KAAK,OAAO,aAAa,cAAc,OAAO,UAAU,KAAK;AACnE,UAAM,UACJ,EAAE,SAAS,uBAAuB,OAAO,aACrC,wCAAwC,eAAe,OAAO,UAAU,CAAC,KACzE;AACN,UAAM,gBAAgB,uBAAuB,QAAQ,MAAM,GAAG,GAAG,CAAC,MAAM,EAAE,IAAI,GAAG,EAAE,MAAM,EAAE,KAAK,GAAG,OAAO;AAC1G,QAAI,WAAW,aAAc,KAAI,IAAI,EAAE,UAAU,QAAQ,QAAQ,cAAc,CAAC;AAAA;AAE9E,UAAI,IAAI;AAAA,QACN,oBAAoB;AAAA,UAClB,eAAe;AAAA,UACf,oBAAoB;AAAA,UACpB,0BAA0B;AAAA,QAC5B;AAAA,QACA;AAAA,MACF,CAAC;AACH;AAAA,EACF;AACA,MAAI,OAAO,OAAO;AAChB,QAAI,IAAI;AAAA,MACN,eAAe,wDAAwD,QAAQ,MAAM,GAAG,GAAG,CAAC,UAAU,OAAO,MAAM,IAAI,KAAK,OAAO,MAAM,KAAK;AAAA,IAChJ,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,YAAY,MAAkB,IAAyB;AAC3E,QAAM,QAAQ,KAAK,YAAY,CAAC;AAChC,MAAI,UAAU,gBAAgB;AAC5B,OAAG;AAAA,MACD;AAAA,IAEF;AACA,WAAO;AAAA,EACT;AACA,QAAM,aAAa,WAAW,MAAM,QAAQ;AAC5C,MAAI,SAAsB,cAAc,eAAe,UAAU,KAAM;AACvE,MAAI;AACF,UAAM,MAAO,MAAM,GAAG,QAAQ,KAAM;AACpC,UAAM,QAAQ,KAAK,MAAM,GAAG;AAC5B,QAAI,CAAC,WAAY,UAAS,iBAAiB,KAAK;AAChD,UAAM,WAAW,OAAO,MAAM,QAAQ,WAAW,MAAM,MAAM;AAC7D,UAAM,YAAY,kBAAkB,MAAM,IAAI,QAAQ;AACtD,QAAI,CAAC,UAAW,QAAO;AACvB,UAAM,SAAS,eAAe,UAAU,MAAM,EAAE,KAAK,GAAG,KAAK,iBAAiB,KAAK,CAAC;AACpF,UAAM,SAAS,oBAAoB,QAAQ,OAAO,YAAY,GAAG,GAAG;AACpE,QAAI,CAAC,OAAQ,QAAO;AACpB,UAAM,OAAO,SAAS,EAAE;AACxB,UAAM,YACJ,WAAW,IAAI,MAAS,MACvB,UAAU,UAAU,YAAY,QAAQ,UAAU,IAAI,IAAI,WAC3D,OAAO;AACT,UAAM,UAAU;AAAA,MACd,OAAO;AAAA,MACP,GAAG,IAAI;AAAA,MACP,OAAO,MAAM,mBAAmB,WAAW,MAAM,iBAAiB;AAAA,MAClE;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,OAAO,CAAC,MAAmB,QAAQ,CAAC,CAAC;AACvC,UAAM,MAAM;AAAA,MACV,WAAW,QAAQ,SAAS;AAAA,MAC5B;AAAA,MACA;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,YAAY,CAAC,OAAO,MAAM,GAAG,kBAAkB,EAAE,KAAK,QAAQ,SAAS,GAAG,KAAK,CAAC,CAAC;AAAA,IACnF;AACA,UAAM,aAAa,iBAAiB,OAAO,QAAQ,QAAQ,GAAG;AAC9D,UAAM,MAAM,iBAAiB,MAAM;AACnC,UAAM,EAAE,MAAM,IAAI,gBAAgB,QAAQ;AAAA,MACxC,KAAK,GAAG;AAAA,MACR,aAAa,eAAe,GAAG;AAAA,MAC/B,KAAK,CAAC,SAAS,GAAG,IAAI,IAAI;AAAA,IAC5B,CAAC;AACD,UAAM,aACJ,UAAU,UAAU,aAAa,QAAQ,UAAU,IAAI,MAAM,QAAQ,SAAS,IAC1E,KACA,aAAa,KAAK,UAAU,UAAU,IAAI,CAAC;AACjD,UAAM,iBAAiB,CAAC,OACtB,sCAAsC,EAAE,GAAG,UAAU;AACvD,UAAM,SAAS,MAAM,MAAM,UAAU;AAAA,MACnC;AAAA,MACA;AAAA,MACA,OAAO,GAAG,WAAW,MAAM,CAAC,IAAI,OAAO,SAAS;AAAA,MAChD,WAAW,MACT,WAAW,gBACP,wBAAwB,OAAO,gBAAgB;AAAA,QAC7C,eAAe,OAAO,OAAO,MAAM,aAAa;AAAA,MAClD,CAAC,IACD;AAAA,QACE,SAAS,GAAG,MAAM;AAAA,MACpB;AAAA,MACN;AAAA,IACF,CAAC;AACD,YAAQ,IAAI,QAAQ,QAAQ,WAAW,SAAS,cAAc;AAC9D,WAAO;AAAA,EACT,SAAS,KAAK;AACZ;AAAA,MACE;AAAA,MACA,2DAAsD,cAAc,GAAG,EAAE,QAAQ,QAAQ,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC;AAAA,IAC7G;AACA,WAAO;AAAA,EACT;AACF;;;AEvMA,SAAS,cAAc,qBAAqB;AAC5C,OAAO,QAAQ,OAAO,OAAO,eAA6B;AAC1D,SAAS,kBAAkB,oBAAoB;AAI/C,eAAsB,WAAW,MAAkB,IAAyB;AAC1E,QAAM,CAAC,KAAK,IAAI,IAAI,KAAK;AACzB,QAAM,OAAO,eAAe,MAAM,EAAE;AACpC,QAAM,MAAM,KAAK,cAAc,aAAa,MAAM,MAAM,CAAC;AACzD,MAAI,SAAS,IAAI,IAAI,QAAQ;AAC7B,MAAI,CAAC,MAAM,MAAM,GAAG;AAClB,aAAS,IAAI,QAAQ;AACrB,QAAI,IAAI,UAAU,MAAM;AAAA,EAC1B;AACA,QAAM,MAAM;AACZ,QAAM,QAAQ,IAAI,MAAM,OAAO,KAAK;AAEpC,MAAI,QAAQ,UAAU,QAAQ,QAAW;AACvC,QAAI,MAAM,WAAW;AACnB,SAAG;AAAA,QACD;AAAA,MACF;AACF,eAAW,KAAK,OAAO;AACrB,YAAMC,SAAQ,EAAE,IAAI,OAAO;AAC3B,SAAG;AAAA,QACD,GAAG,OAAO,EAAE,IAAI,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,SAAS,EAAE,IAAI,UAAU,IAAI,QAAQ,2BAA2B,YAAY,MAAMA,MAAK,IAAIA,OAAM,MAAM,IAAI,MAAM,EAAE,KAAK,IAAI,IAAI,KAAK;AAAA,MAC1K;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAC,MAAM;AACT,OAAG;AAAA,MACD;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,UAAU;AACpB,UAAM,MAAM,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,MAAM,MAAM,IAAI;AACzD,QAAI,MAAM,GAAG;AACX,SAAG,IAAI,aAAa,IAAI,GAAG;AAC3B,aAAO;AAAA,IACT;AACA,QAAI,MAAM,OAAO,IAAI,MAAM,QAAQ,MAAM,GAAG,CAAE,GAAG,CAAC;AAClD,kBAAc,MAAM,IAAI,SAAS,CAAC;AAClC,OAAG,IAAI,WAAW,IAAI,wEAAwE;AAC9F,WAAO;AAAA,EACT;AACA,MAAI,QAAQ,UAAU;AACpB,OAAG,IAAI,uBAAuB,GAAG,qCAAgC;AACjE,WAAO;AAAA,EACT;AACA,QAAM,MAAM,iBAAiB;AAC7B,QAAM,UAAU,MAAM,aAAa,GAAG;AACtC,QAAM,WAAW,MAAM,KAAK,CAAC,MAAM,EAAE,IAAI,MAAM,MAAM,IAAI;AACzD,QAAM,QAAiC,EAAE,MAAM,UAAU,QAAQ;AACjE,QAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,QAAM,OAAO,SAAS,MAAM,MAAM;AAClC,MAAI,MAAM,OAAQ,OAAM,QAAQ;AAChC,MAAI,KAAK,OAAQ,OAAM,OAAO;AAC9B,QAAM,YAAY,SAAS,MAAM,UAAU;AAC3C,MAAI,UAAU,OAAQ,OAAM,YAAY;AACxC,QAAM,OAAO,WAAW,MAAM,MAAM;AACpC,MAAI,KAAM,OAAM,OAAO;AACvB,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,MAAM,OAAO,KAAK;AAAA,IAC5B,CAAC,UAAU,QAAQ;AAAA,IACnB,CAAC,SAAS,WAAW;AAAA,IACrB,CAAC,WAAW,SAAS;AAAA,IACrB,CAAC,UAAU,QAAQ;AAAA,IACnB,CAAC,cAAc,YAAY;AAAA,EAC7B,GAAY;AACV,UAAM,IAAI,WAAW,MAAM,IAAI;AAC/B,QAAI,MAAM,OAAW,QAAO,OAAO,IAAI;AAAA,EACzC;AACA,MAAI,OAAO,KAAK,MAAM,EAAE,OAAQ,OAAM,OAAO,EAAE,SAAS,OAAO;AAC/D,MAAI,UAAU;AACZ,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAK,EAAG,UAAS,IAAI,GAAG,CAAC;AAAA,EAC/D,OAAO;AACL,QAAI,IAAI,IAAI,WAAW,KAAK,CAAC;AAAA,EAC/B;AACA,gBAAc,MAAM,IAAI,SAAS,CAAC;AAClC,KAAG;AAAA,IACD,GAAG,WAAW,YAAY,SAAS,WAAW,IAAI,QAAQ,IAAI,GAAG,MAAM,SAAS,YAAY,MAAM,KAAK,IAAI,CAAC,MAAM,qBAAqB;AAAA,EACzI;AACA,KAAG;AAAA,IACD,yIACE,OACA;AAAA,EACJ;AACA,KAAG,IAAI,GAAG;AACV,SAAO;AACT;;;AC5FA,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,OAEK;AAIA,IAAM,2BAA2B;AAAA,EACtC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAEA,IAAM,kBACJ;AAEF,SAAS,IAAI,KAAa,MAAoC;AAC5D,MAAI;AACF,WAAO,aAAa,OAAO,MAAM;AAAA,MAC/B;AAAA,MACA,UAAU;AAAA,MACV,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,IACpC,CAAC;AAAA,EACH,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,OAAO,KAAa,KAAa,MAAkC;AACjF,SAAO,IAAI,KAAK,CAAC,QAAQ,GAAG,GAAG,IAAI,IAAI,EAAE,CAAC;AAC5C;AAEO,SAAS,uBAAuB,KAAa,MAAc,MAAwB;AACxF,QAAMC,OAAM,IAAI,KAAK,CAAC,QAAQ,eAAe,MAAM,IAAI,CAAC,KAAK;AAC7D,SAAOA,KACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,KAAK,gBAAgB,KAAK,CAAC,CAAC;AAC/C;AAEO,SAAS,YAAY,KAAa,UAAsC;AAC7E,MAAI,SAAU,QAAO;AACrB,aAAW,aAAa,CAAC,eAAe,QAAQ,iBAAiB,QAAQ,GAAG;AAC1E,QAAI,IAAI,KAAK,CAAC,aAAa,YAAY,WAAW,SAAS,CAAC,MAAM,OAAW,QAAO;AAAA,EACtF;AACA,SAAO;AACT;AAUO,SAAS,kBACd,KACA,MACsB;AACtB,QAAM,OAAO,YAAY,KAAK,KAAK,IAAI;AACvC,QAAM,OAAO,KAAK,QAAQ;AAC1B,QAAM,QAAQ;AAAA,IACZ,GAAG,oBAAI,IAAI;AAAA,MACT,GAAI,KAAK,SAAS;AAAA,MAClB,GAAG,uBAAuB,KAAK,MAAM,IAAI;AAAA,IAC3C,CAAC;AAAA,EACH;AACA,QAAM,WAAsB,CAAC;AAC7B,QAAM,UAAoB,CAAC;AAC3B,aAAW,QAAQ,OAAO;AACxB,UAAM,SAAS,OAAO,KAAK,MAAM,IAAI;AACrC,UAAM,QAAQ,OAAO,KAAK,MAAM,IAAI;AACpC,QAAI,WAAW,UAAa,UAAU,OAAW;AACjD,QAAI,WAAW,MAAO;AACtB,YAAQ,KAAK,IAAI;AACjB,aAAS,KAAK,GAAG,mBAAmB,MAAM,QAAQ,KAAK,CAAC;AAAA,EAC1D;AACA,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,OAAO;AAAA,IACP;AAAA,IACA,UAAU,6BAA6B,UAAU,EAAE,OAAO,KAAK,MAAM,CAAC;AAAA,EACxE;AACF;AAEA,eAAsB,sBAAsB,MAAkB,IAAyB;AACrF,QAAM,QAAQ,SAAS,MAAM,OAAO;AACpC,QAAM,SAAS,kBAAkB,GAAG,KAAK;AAAA,IACvC,MAAM,WAAW,MAAM,MAAM;AAAA,IAC7B,MAAM,WAAW,MAAM,MAAM;AAAA,IAC7B,OAAO,MAAM,SAAS,QAAQ;AAAA,EAChC,CAAC;AACD,QAAM,SAAS,WAAW,MAAM,QAAQ,MAAM,SAAS,MAAM,MAAM,IAAI,SAAS;AAChF,MAAI,WAAW,OAAQ,IAAG,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,MACxD,IAAG,IAAI,OAAO,QAAQ;AAC3B,QAAM,QAAQ,OAAO,SAAS,OAAO,CAAC,MAAM,EAAE,aAAa,OAAO,EAAE;AACpE,MAAI,SAAS,MAAM,eAAe,KAAK,QAAQ,EAAG,QAAO;AACzD,SAAO;AACT;;;AC3GA,SAAS,WAAAC,gBAAe;AACxB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,eAAe,uBAAuB;AAI/C,SAAS,QAAQ,MAAkB,SAA+D;AAChG,MAAI,SAAS,MAAM,KAAK,EAAG,QAAO;AAClC,SAAO,WAAW,MAAM,KAAK,KAAK,YAAY,OAAO;AACvD;AAEA,eAAsB,cAAc,MAAkB,IAAyB;AAC7E,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,UAAU,cAAc,OAAO,SAAS;AAC9C,QAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,QAAM,SAAS,YAAY,SAAS,EAAE,MAAM,CAAC;AAC7C,MAAI,SAAS,MAAM,MAAM,GAAG;AAC1B,OAAG;AAAA,MACD,KAAK;AAAA,QACH;AAAA,UACE,GAAG;AAAA,UACH,WAAW,OAAO,UAAU,IAAI,CAAC,OAAO;AAAA,YACtC,KAAK,EAAE;AAAA,YACP,IAAI,EAAE;AAAA,YACN,MAAM,EAAE;AAAA,YACR,UAAU,EAAE;AAAA,UACd,EAAE;AAAA,QACJ;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,KAAG,IAAI,qBAAqB,MAAM,CAAC;AACnC,QAAM,QAAQ,MAAM,gBAAgB,OAAO,SAAS;AACpD,KAAG;AAAA,IACD,MAAM,KACF,gBAAgB,MAAM,OAAO,uBAAuB,OAAO,SAAS,OACpE,+BAA+B,MAAM,QAAQ,KAAK,MAAM,MAAM;AAAA,EACpE;AACA,MAAI,SAAS,SAAS,OAAO,EAAE,SAAS,EAAG,IAAG,IAAI,qCAAqC;AACvF,SAAO;AACT;AAEA,eAAsB,YAAY,MAAkB,IAAyB;AAC3E,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,UAAU,cAAc,OAAO,SAAS;AAC9C,QAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,KAAG,IAAI,mBAAmB,SAAS,EAAE,MAAM,CAAC,EAAE,QAAQ,CAAC;AACvD,SAAO;AACT;AAEA,eAAsB,cAAc,MAAkB,IAAyB;AAC7E,MAAI,OAAO,KAAK,YAAY,CAAC;AAC7B,MAAI,CAAC,KAAM,QAAO,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC,EAAE;AACrE,SAAOC,SAAQ,GAAG,KAAK,IAAI;AAC3B,QAAM,SAAS,MAAM,gBAAgB,IAAI;AACzC,MAAI,SAAS,MAAM,MAAM,EAAG,IAAG,IAAI,KAAK,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,CAAC;AAAA,WAC7D,OAAO;AACd,OAAG;AAAA,MACD,OAAO,OAAO,OAAO,gCAAgC,OAAO,MAAM,MAAM,GAAG,EAAE,CAAC,WAAM,IAAI;AAAA,IAC1F;AAAA,MACG,IAAG,IAAI,mBAAmB,OAAO,QAAQ,KAAK,OAAO,MAAM,KAAK,IAAI,GAAG;AAC5E,SAAO,OAAO,KAAK,IAAI;AACzB;AAEA,eAAsB,cAAc,MAAkB,IAAyB;AAC7E,QAAM,SAAS,cAAc,MAAM,IAAI,EAAE,iBAAiB,KAAK,CAAC;AAChE,QAAM,EAAE,OAAO,KAAK,IAAI,gBAAgB,QAAQ,EAAE,QAAQ,OAAO,KAAK,GAAG,IAAI,CAAC;AAC9E,QAAM,UAAU,cAAc,OAAO,SAAS;AAC9C,QAAM,QAAQ,WAAW,MAAM,KAAK,KAAK,YAAY,OAAO,KAAK;AACjE,QAAM,SAAS,MAAM,MAAM,OAAO,KAAK;AACvC,QAAM,SAAS,KAAK,MAAM;AAC1B,QAAM,MAAM,iBAAiB,MAAM;AACnC,QAAM,UAAU,MAAM,MAAM,UAAU,KAAK,SAAS;AACpD,MAAI,SAAS,MAAM,MAAM,GAAG;AAC1B,OAAG;AAAA,MACD,KAAK;AAAA,QACH;AAAA,UACE,QAAQ,OAAO;AAAA,UACf,MAAM,OAAO,OAAO;AAAA,UACpB;AAAA,UACA,GAAG;AAAA,UACH;AAAA,UACA,kBAAkB,QAAQ;AAAA,UAC1B,MAAM,MAAM,EAAE,KAAK,IAAI,KAAK,KAAK,IAAI,IAAI,IAAI;AAAA,QAC/C;AAAA,QACA;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AACA,KAAG;AAAA,IACD,YAAY,OAAO,IAAI,WAAW,OAAO,OAAO,IAAI,KAAK,OAAO,OAAO,UAAU,MAAM;AAAA,EACzF;AACA,KAAG;AAAA,IACD,YAAY,OAAO,SAAS,aAAQ,OAAO,MAAM,kCAAkC,KAAK;AAAA,EAC1F;AACA,KAAG;AAAA,IACD,YAAY,MAAM,GAAG,IAAI,GAAG,SAAS,IAAI,GAAG,MAAM,uCAAuC;AAAA,EAC3F;AACA,KAAG,IAAI,YAAY,QAAQ,MAAM,eAAe,OAAO,SAAS,EAAE;AAClE,KAAG;AAAA,IACD,YAAY,QAAQ,MAAM,YAAY,QAAQ,WAAW,IAAI,KAAK,GAAG,GAAG,QAAQ,SAAS,iCAA4B,EAAE;AAAA,EACzH;AACA,KAAG,IAAI,YAAY,KAAK,EAAE;AAC1B,QAAM,MAAM,CAAC,UACX,OAAO,QAAQ,OAAO,KAAK,KAAK,CAAC,EAC9B,IAAI,CAAC,CAAC,GAAG,KAAK,MAAM,GAAG,CAAC,IAAI,OAAO,MAAM,KAAK,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,EAAE,EAClE,KAAK,IAAI,KAAK;AACnB,KAAG,IAAI,cAAc,IAAI,SAAS,CAAC,EAAE;AACrC,KAAG,IAAI,cAAc,IAAI,SAAS,CAAC,EAAE;AACrC,SAAO;AACT;;;ACxGA,IAAM,eAAe,OAAO,MAAkB,QAC3C,MAAM,OAAO,qBAAqB,GAAG,aAAa,MAAM,EAAE;AAC7D,IAAM,cAAc,OAAO,MAAkB,QAC1C,MAAM,OAAO,oBAAoB,GAAG,YAAY,MAAM,EAAE;AAC3D,IAAM,eAAe,OAAO,MAAkB,QAC3C,MAAM,OAAO,qBAAqB,GAAG,aAAa,MAAM,EAAE;AAC7D,IAAM,eAAe,OAAO,MAAkB,QAC3C,MAAM,OAAO,qBAAqB,GAAG,aAAa,MAAM,EAAE;AAEtD,IAAM,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAiCpB,eAAsB,KAAK,MAAyB,KAAS,UAAU,GAAoB;AACzF,QAAM,OAAmB,UAAU,IAAI;AACvC,MAAI,KAAK,MAAM,SAAS;AACtB,OAAG,IAAI,QAAQ,CAAC;AAChB,WAAO;AAAA,EACT;AACA,MAAI,KAAK,YAAY,UAAa,CAAC,KAAK,MAAM,QAAQ,GAAG,QAAQ,OAAO;AAGtE,QAAI;AACF,aAAO,MAAM,aAAa,MAAM,EAAE;AAAA,IACpC,SAAS,KAAK;AACZ,SAAG,IAAI,cAAc,GAAG,CAAC;AACzB,aAAO;AAAA,IACT;AAAA,EACF;AACA,MAAI,KAAK,MAAM,QAAQ,KAAK,YAAY,UAAa,KAAK,YAAY,QAAQ;AAC5E,OAAG,IAAI,IAAI;AACX,WAAO,KAAK,YAAY,UAAa,CAAC,KAAK,MAAM,OAAO,IAAI;AAAA,EAC9D;AACA,MAAI;AACF,YAAQ,KAAK,SAAS;AAAA,MACpB,KAAK;AACH,eAAO,MAAM,YAAY,MAAM,EAAE;AAAA,MACnC,KAAK;AAAA,MACL,KAAK;AACH,eAAO,MAAM,aAAa,MAAM,EAAE;AAAA,MACpC,KAAK;AACH,eAAO,MAAM,cAAc,MAAM,EAAE;AAAA,MACrC,KAAK;AACH,eAAO,MAAM,YAAY,MAAM,EAAE;AAAA,MACnC,KAAK;AACH,eAAO,MAAM,cAAc,MAAM,EAAE;AAAA,MACrC,KAAK;AACH,eAAO,MAAM,eAAe,MAAM,EAAE;AAAA,MACtC,KAAK;AACH,eAAO,MAAM,cAAc,MAAM,EAAE;AAAA,MACrC,KAAK;AACH,eAAO,MAAM,aAAa,MAAM,EAAE;AAAA,MACpC,KAAK;AACH,eAAO,MAAM,YAAY,MAAM,EAAE;AAAA,MACnC,KAAK;AACH,eAAO,MAAM,cAAc,MAAM,EAAE;AAAA,MACrC,KAAK;AACH,eAAO,MAAM,cAAc,YAAY,MAAM,EAAE;AAAA,MACjD,KAAK;AACH,eAAO,MAAM,cAAc,UAAU,MAAM,EAAE;AAAA,MAC/C,KAAK;AACH,eAAO,MAAM,iBAAiB,MAAM,EAAE;AAAA,MACxC,KAAK;AAAA,MACL,KAAK;AACH,eAAO,MAAM,WAAW,MAAM,EAAE;AAAA,MAClC,KAAK;AACH,eAAO,MAAM,sBAAsB,MAAM,EAAE;AAAA,MAC7C,KAAK;AACH,eAAO,MAAM,YAAY,MAAM,EAAE;AAAA,MACnC,KAAK;AACH,eAAO,MAAM,aAAa,MAAM,EAAE;AAAA,MACpC,KAAK;AACH,eAAO,MAAM,aAAa,MAAM,EAAE;AAAA,MACpC;AACE,WAAG,IAAI,oBAAoB,KAAK,OAAO;AAAA,CAAK;AAC5C,WAAG,IAAI,IAAI;AACX,eAAO;AAAA,IACX;AAAA,EACF,SAAS,KAAK;AACZ,OAAG,IAAI,cAAc,GAAG,CAAC;AACzB,WAAO;AAAA,EACT;AACF;AAEA,IAAM,SACJ,QAAQ,KAAK,CAAC,MAAM,UAAa,sCAAsC,KAAK,QAAQ,KAAK,CAAC,CAAC;AAC7F,IAAI,QAAQ;AACV,OAAK,QAAQ,KAAK,MAAM,CAAC,CAAC,EAAE;AAAA,IAC1B,CAAC,SAAS;AACR,UAAI,SAAS,EAAG,SAAQ,WAAW;AAAA,IACrC;AAAA,IACA,CAAC,QAAiB;AAChB,cAAQ,OAAO,MAAM,GAAG,cAAc,GAAG,CAAC;AAAA,CAAI;AAC9C,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF;AACF;","names":["c","existsSync","existsSync","existsSync","allow","out","resolve","resolve"]}

package/dist/chunk-BKXXTWIS.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/fixtures/demo-agent.ts"],"sourcesContent":["#!/usr/bin/env node\n/**\n * A scripted \"agent\" that misbehaves on purpose: reads, then writes, then loops, then bursts\n * writes past the cap. Run it against the proxy to see dry-run diffs, LOOP_DETECTED and\n * CAP_EXCEEDED in `agentguard report`.\n *\n *   node dist/fixtures/demo-agent.js --config agentguard.yaml   # spawns `agentguard proxy` over stdio\n */\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StdioClientTransport } from \"@modelcontextprotocol/sdk/client/stdio.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { CallToolResult } from \"@modelcontextprotocol/sdk/types.js\";\nimport { fileURLToPath } from \"node:url\";\nimport path from \"node:path\";\n\nexport interface DemoStep {\n  step: string;\n  tool: string;\n  ok: boolean;\n  code?: string;\n  dryRun?: boolean;\n  text?: string;\n}\n\nexport interface DemoOptions {\n  /** how many writes to burst at the end (default 60 — past a `writes: 50` cap) */\n  burst?: number;\n  /** how many times to repeat the identical update (default 5 — past `max_repeats: 3`) */\n  loop?: number;\n  runId?: string;\n  log?: (line: string) => void;\n}\n\nfunction summarize(result: CallToolResult): {\n  ok: boolean;\n  code?: string;\n  dryRun?: boolean;\n  text?: string;\n} {\n  const text = result.content.find((c) => c.type === \"text\")?.text;\n  const meta = (result._meta as { agentguard?: { dryRun?: boolean } } | undefined)?.agentguard;\n  if (result.isError) {\n    let code: string | undefined;\n    try {\n      code = (JSON.parse(text ?? \"{}\") as { code?: string }).code;\n    } catch {\n      // not JSON\n    }\n    return { ok: false, code, text };\n  }\n  return { ok: true, dryRun: meta?.dryRun, text };\n}\n\n/** Drive a connected client through the scripted scenario. Returns every step's outcome. */\nexport async function runDemoAgent(client: Client, opts: DemoOptions = {}): Promise<DemoStep[]> {\n  const steps: DemoStep[] = [];\n  const log = opts.log ?? (() => undefined);\n  const meta = opts.runId ? { runId: opts.runId } : undefined;\n  const call = async (\n    step: string,\n    tool: string,\n    args: Record<string, unknown>,\n  ): Promise<DemoStep> => {\n    const result = (await client.callTool({\n      name: tool,\n      arguments: args,\n      _meta: meta,\n    })) as CallToolResult;\n    const s = { step, tool, ...summarize(result) };\n    steps.push(s);\n    log(\n      `${s.ok ? (s.dryRun ? \"faked \" : \"ok    \") : `${s.code ?? \"error\"}`.padEnd(6)} ${step}: ${tool}`,\n    );\n    return s;\n  };\n\n  await call(\"read: list contacts\", \"crm_list_contacts\", { limit: 10 });\n  await call(\"read: get one\", \"crm_get_contact\", { id: \"c_1\" });\n  await call(\"write: create\", \"crm_create_contact\", {\n    name: \"Demo Person\",\n    email: \"demo@example.com\",\n  });\n  await call(\"write: update\", \"crm_update_contact\", { id: \"c_1\", fields: { name: \"Ada L.\" } });\n  await call(\"write: delete (destructive)\", \"crm_delete_contact\", { id: \"c_2\" });\n  await call(\"write: send email\", \"crm_send_email\", {\n    to: \"ada@example.com\",\n    subject: \"Hi\",\n    body: \"Hello from the demo agent\",\n  });\n  await call(\"spend: charge $12\", \"crm_charge_card\", {\n    customer_id: \"c_1\",\n    amount_cents: 1200,\n    currency: \"usd\",\n  });\n\n  const loops = opts.loop ?? 5;\n  for (let i = 0; i < loops; i += 1) {\n    const s = await call(`loop ${i + 1}/${loops}: identical update`, \"crm_update_contact\", {\n      id: \"c_3\",\n      fields: { name: \"Same Thing\" },\n    });\n    if (s.code === \"LOOP_DETECTED\") break;\n  }\n\n  const burst = opts.burst ?? 60;\n  for (let i = 0; i < burst; i += 1) {\n    const s = await call(`burst ${i + 1}/${burst}: create`, \"crm_create_contact\", {\n      name: `Bulk ${i}`,\n      email: `bulk${i}@example.com`,\n    });\n    if (s.code === \"CAP_EXCEEDED\") break;\n  }\n  return steps;\n}\n\nconst isMain = process.argv[1] !== undefined && /demo-agent\\.[cm]?[jt]s$/.test(process.argv[1]);\nif (isMain) {\n  const argv = process.argv.slice(2);\n  const arg = (name: string): string | undefined => {\n    const i = argv.indexOf(name);\n    return i >= 0 ? argv[i + 1] : undefined;\n  };\n  const url = arg(\"--url\");\n  const config = arg(\"--config\") ?? \"agentguard.yaml\";\n  const client = new Client({ name: \"agentguard-demo-agent\", version: \"0.1.0\" });\n  if (url) {\n    await client.connect(\n      new StreamableHTTPClientTransport(new URL(url), {\n        requestInit: {\n          headers: { \"X-Run-Id\": arg(\"--run-id\") ?? `demo_${Date.now().toString(36)}` },\n        },\n      }),\n    );\n  } else {\n    const cli = path.resolve(path.dirname(fileURLToPath(import.meta.url)), \"../cli.js\");\n    await client.connect(\n      new StdioClientTransport({\n        command: process.execPath,\n        args: [cli, \"proxy\", \"--config\", config],\n        stderr: \"inherit\",\n      }),\n    );\n  }\n  try {\n    const steps = await runDemoAgent(client, {\n      log: (l) => console.log(l),\n      runId: arg(\"--run-id\"),\n    });\n    const halts = steps.filter((s) => !s.ok).map((s) => s.code);\n    console.log(\n      `\\n${steps.length} calls; halts: ${halts.join(\", \") || \"none\"}. Now run: agentguard report`,\n    );\n  } finally {\n    await client.close();\n  }\n}\n"],"mappings":";AAQA,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAE9C,SAAS,qBAAqB;AAC9B,OAAO,UAAU;AAoBjB,SAAS,UAAU,QAKjB;AACA,QAAM,OAAO,OAAO,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,MAAM,GAAG;AAC5D,QAAM,OAAQ,OAAO,OAA6D;AAClF,MAAI,OAAO,SAAS;AAClB,QAAI;AACJ,QAAI;AACF,aAAQ,KAAK,MAAM,QAAQ,IAAI,EAAwB;AAAA,IACzD,QAAQ;AAAA,IAER;AACA,WAAO,EAAE,IAAI,OAAO,MAAM,KAAK;AAAA,EACjC;AACA,SAAO,EAAE,IAAI,MAAM,QAAQ,MAAM,QAAQ,KAAK;AAChD;AAGA,eAAsB,aAAa,QAAgB,OAAoB,CAAC,GAAwB;AAC9F,QAAM,QAAoB,CAAC;AAC3B,QAAM,MAAM,KAAK,QAAQ,MAAM;AAC/B,QAAM,OAAO,KAAK,QAAQ,EAAE,OAAO,KAAK,MAAM,IAAI;AAClD,QAAM,OAAO,OACX,MACA,MACA,SACsB;AACtB,UAAM,SAAU,MAAM,OAAO,SAAS;AAAA,MACpC,MAAM;AAAA,MACN,WAAW;AAAA,MACX,OAAO;AAAA,IACT,CAAC;AACD,UAAM,IAAI,EAAE,MAAM,MAAM,GAAG,UAAU,MAAM,EAAE;AAC7C,UAAM,KAAK,CAAC;AACZ;AAAA,MACE,GAAG,EAAE,KAAM,EAAE,SAAS,WAAW,WAAY,GAAG,EAAE,QAAQ,OAAO,GAAG,OAAO,CAAC,CAAC,IAAI,IAAI,KAAK,IAAI;AAAA,IAChG;AACA,WAAO;AAAA,EACT;AAEA,QAAM,KAAK,uBAAuB,qBAAqB,EAAE,OAAO,GAAG,CAAC;AACpE,QAAM,KAAK,iBAAiB,mBAAmB,EAAE,IAAI,MAAM,CAAC;AAC5D,QAAM,KAAK,iBAAiB,sBAAsB;AAAA,IAChD,MAAM;AAAA,IACN,OAAO;AAAA,EACT,CAAC;AACD,QAAM,KAAK,iBAAiB,sBAAsB,EAAE,IAAI,OAAO,QAAQ,EAAE,MAAM,SAAS,EAAE,CAAC;AAC3F,QAAM,KAAK,+BAA+B,sBAAsB,EAAE,IAAI,MAAM,CAAC;AAC7E,QAAM,KAAK,qBAAqB,kBAAkB;AAAA,IAChD,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,MAAM;AAAA,EACR,CAAC;AACD,QAAM,KAAK,qBAAqB,mBAAmB;AAAA,IACjD,aAAa;AAAA,IACb,cAAc;AAAA,IACd,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,QAAQ,KAAK,QAAQ;AAC3B,WAAS,IAAI,GAAG,IAAI,OAAO,KAAK,GAAG;AACjC,UAAM,IAAI,MAAM,KAAK,QAAQ,IAAI,CAAC,IAAI,KAAK,sBAAsB,sBAAsB;AAAA,MACrF,IAAI;AAAA,MACJ,QAAQ,EAAE,MAAM,aAAa;AAAA,IAC/B,CAAC;AACD,QAAI,EAAE,SAAS,gBAAiB;AAAA,EAClC;AAEA,QAAM,QAAQ,KAAK,SAAS;AAC5B,WAAS,IAAI,GAAG,IAAI,OAAO,KAAK,GAAG;AACjC,UAAM,IAAI,MAAM,KAAK,SAAS,IAAI,CAAC,IAAI,KAAK,YAAY,sBAAsB;AAAA,MAC5E,MAAM,QAAQ,CAAC;AAAA,MACf,OAAO,OAAO,CAAC;AAAA,IACjB,CAAC;AACD,QAAI,EAAE,SAAS,eAAgB;AAAA,EACjC;AACA,SAAO;AACT;AAEA,IAAM,SAAS,QAAQ,KAAK,CAAC,MAAM,UAAa,0BAA0B,KAAK,QAAQ,KAAK,CAAC,CAAC;AAC9F,IAAI,QAAQ;AACV,QAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AACjC,QAAM,MAAM,CAAC,SAAqC;AAChD,UAAM,IAAI,KAAK,QAAQ,IAAI;AAC3B,WAAO,KAAK,IAAI,KAAK,IAAI,CAAC,IAAI;AAAA,EAChC;AACA,QAAM,MAAM,IAAI,OAAO;AACvB,QAAM,SAAS,IAAI,UAAU,KAAK;AAClC,QAAM,SAAS,IAAI,OAAO,EAAE,MAAM,yBAAyB,SAAS,QAAQ,CAAC;AAC7E,MAAI,KAAK;AACP,UAAM,OAAO;AAAA,MACX,IAAI,8BAA8B,IAAI,IAAI,GAAG,GAAG;AAAA,QAC9C,aAAa;AAAA,UACX,SAAS,EAAE,YAAY,IAAI,UAAU,KAAK,QAAQ,KAAK,IAAI,EAAE,SAAS,EAAE,CAAC,GAAG;AAAA,QAC9E;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF,OAAO;AACL,UAAM,MAAM,KAAK,QAAQ,KAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,GAAG,WAAW;AAClF,UAAM,OAAO;AAAA,MACX,IAAI,qBAAqB;AAAA,QACvB,SAAS,QAAQ;AAAA,QACjB,MAAM,CAAC,KAAK,SAAS,YAAY,MAAM;AAAA,QACvC,QAAQ;AAAA,MACV,CAAC;AAAA,IACH;AAAA,EACF;AACA,MAAI;AACF,UAAM,QAAQ,MAAM,aAAa,QAAQ;AAAA,MACvC,KAAK,CAAC,MAAM,QAAQ,IAAI,CAAC;AAAA,MACzB,OAAO,IAAI,UAAU;AAAA,IACvB,CAAC;AACD,UAAM,QAAQ,MAAM,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAC1D,YAAQ;AAAA,MACN;AAAA,EAAK,MAAM,MAAM,kBAAkB,MAAM,KAAK,IAAI,KAAK,MAAM;AAAA,IAC/D;AAAA,EACF,UAAE;AACA,UAAM,OAAO,MAAM;AAAA,EACrB;AACF;","names":[]}

package/dist/chunk-D66U3PVB.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/proxy/runtime.ts"],"sourcesContent":["/**\n * Upstream side of the proxy: one MCP client per upstream (stdio or Streamable HTTP), the merged\n * tool table, resource/prompt routing, notification fan-out to downstream sessions, and\n * `callTool` through the policy engine.\n */\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { version as cliVersion } from \"../version.js\";\nimport {\n  getDefaultEnvironment,\n  StdioClientTransport,\n} from \"@modelcontextprotocol/sdk/client/stdio.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport type { McpServer } from \"@modelcontextprotocol/sdk/server/mcp.js\";\nimport {\n  CreateMessageRequestSchema,\n  ElicitRequestSchema,\n  LoggingMessageNotificationSchema,\n  PromptListChangedNotificationSchema,\n  ResourceListChangedNotificationSchema,\n  ResourceUpdatedNotificationSchema,\n  ToolListChangedNotificationSchema,\n  type CallToolResult,\n  type CompleteRequest,\n  type CompleteResult,\n  type GetPromptResult,\n  type ListPromptsResult,\n  type ListResourceTemplatesResult,\n  type ListResourcesResult,\n  type LoggingLevel,\n  type Prompt,\n  type ReadResourceResult,\n  type Resource,\n  type ResourceTemplate,\n  type Tool,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport type { RequestId } from \"@modelcontextprotocol/sdk/types.js\";\nimport {\n  GuardError,\n  classifyTool,\n  upstreamHeaders,\n  type AgentScope,\n  type Classification,\n  type Guard,\n  type GuardResult,\n  type Upstream,\n} from \"@agentwares/agentguard-core\";\nimport type { LoadedPolicy } from \"@agentwares/agentguard-core/node\";\n// The root export, not `@agentwares/mcp-kit/paging`: tsup bundles mcp-kit into the published CLI\n// by an exact-name match, and a subpath would be left as an undeclared runtime dependency.\nimport { readAllPages } from \"@agentwares/mcp-kit\";\n\nexport interface ExposedTool {\n  /** the name the agent sees */\n  name: string;\n  upstream: string;\n  /** the name the upstream knows */\n  original: string;\n  tool: Tool;\n  classification: Classification;\n}\n\nexport interface DownstreamSession {\n  id: string;\n  server: McpServer;\n  lastActive: number;\n  /** upstream name → downstream request ids currently waiting on it (newest last) */\n  inflight: Map<string, RequestId[]>;\n}\n\nexport interface UpstreamStatus {\n  name: string;\n  connected: boolean;\n  tools: number;\n  transport: \"stdio\" | \"http\";\n  error?: string;\n}\n\ninterface Connection {\n  upstream: Upstream;\n  client: Client;\n  tools: Tool[];\n  capabilities: ReturnType<Client[\"getServerCapabilities\"]>;\n  connected: boolean;\n  error?: string;\n}\n\nexport interface RuntimeOptions {\n  loaded: LoadedPolicy;\n  guard: Guard;\n  /** fixed agent scope for stdio (`--agent`) */\n  agent?: AgentScope | null;\n  /** run id when neither `X-Run-Id` nor `_meta.runId` is present */\n  defaultRunId: string;\n  log?: (line: string) => void;\n  /** connect timeout per upstream (ms) */\n  connectTimeoutMs?: number;\n  /** in-process upstreams for tests: name → already-connected client */\n  clients?: Record<string, Client>;\n  /**\n   * false when no policy file was found and the proxy runs on the default policy with no\n   * upstreams, serving only its own read-only tools (default true)\n   */\n  configured?: boolean;\n}\n\nexport interface CallContext {\n  runId: string;\n  agent?: AgentScope | null;\n  sessionId?: string;\n  onprogress?: (progress: { progress: number; total?: number; message?: string }) => void;\n  /** downstream session + request id, so upstream notifications can be related to this call */\n  session?: DownstreamSession;\n  requestId?: RequestId;\n}\n\nexport class ProxyRuntime {\n  readonly loaded: LoadedPolicy;\n  readonly guard: Guard;\n  readonly agent: AgentScope | null | undefined;\n  readonly defaultRunId: string;\n  readonly configured: boolean;\n  readonly sessions = new Set<DownstreamSession>();\n  private readonly connections = new Map<string, Connection>();\n  private exposed: ExposedTool[] = [];\n  private readonly resourceOwner = new Map<string, string>();\n  private readonly templateOwner = new Map<string, string>();\n  private readonly promptOwner = new Map<string, { upstream: string; original: string }>();\n  private readonly log: (line: string) => void;\n  private readonly connectTimeoutMs: number;\n  private readonly testClients: Record<string, Client>;\n  /** stop relaying upstream stderr once we are tearing down — shutdown noise is not the user's problem */\n  private closing = false;\n\n  constructor(opts: RuntimeOptions) {\n    this.loaded = opts.loaded;\n    this.guard = opts.guard;\n    this.agent = opts.agent;\n    this.defaultRunId = opts.defaultRunId;\n    this.configured = opts.configured ?? true;\n    this.log = opts.log ?? ((line) => process.stderr.write(`[agentguard] ${line}\\n`));\n    this.connectTimeoutMs = opts.connectTimeoutMs ?? 15_000;\n    this.testClients = opts.clients ?? {};\n  }\n\n  get policy() {\n    return this.loaded.policy;\n  }\n\n  async start(): Promise<void> {\n    await Promise.all(this.policy.upstreams.map((u) => this.connect(u)));\n    for (const [name, client] of Object.entries(this.testClients)) {\n      if (this.connections.has(name)) continue;\n      const upstream: Upstream = {\n        name,\n        command: \"in-memory\",\n        args: [],\n        env: {},\n        headers: {},\n        prefix: false,\n        timeout_ms: 60_000,\n      };\n      const conn: Connection = {\n        upstream,\n        client,\n        tools: [],\n        capabilities: client.getServerCapabilities(),\n        connected: true,\n      };\n      this.connections.set(name, conn);\n      this.wire(conn);\n      await this.refreshTools(name);\n    }\n    this.rebuildExposed();\n    const status = this.upstreamStatus();\n    this.log(\n      `connected ${status.filter((s) => s.connected).length}/${status.length} upstreams, ${this.exposed.length} tools, mode ${this.policy.mode}`,\n    );\n  }\n\n  private async connect(upstream: Upstream): Promise<void> {\n    const client = new Client(\n      { name: \"agentguard\", version: cliVersion() },\n      { capabilities: { sampling: {}, elicitation: {} } },\n    );\n    const conn: Connection = {\n      upstream,\n      client,\n      tools: [],\n      capabilities: undefined,\n      connected: false,\n    };\n    this.connections.set(upstream.name, conn);\n    try {\n      const transport = upstream.url\n        ? new StreamableHTTPClientTransport(new URL(upstream.url), {\n            requestInit: { headers: upstreamHeaders(upstream) },\n          })\n        : new StdioClientTransport({\n            command: upstream.command!,\n            args: upstream.args,\n            env: { ...getDefaultEnvironment(), ...upstream.env },\n            cwd: upstream.cwd,\n            stderr: \"pipe\",\n          });\n      if (transport instanceof StdioClientTransport) {\n        transport.stderr?.on(\"data\", (chunk: Buffer) => {\n          if (this.closing) return;\n          for (const line of chunk.toString(\"utf8\").split(\"\\n\"))\n            if (line.trim()) this.log(`${upstream.name}: ${line}`);\n        });\n      }\n      await withTimeout(\n        client.connect(transport),\n        this.connectTimeoutMs,\n        `connect to upstream \"${upstream.name}\"`,\n      );\n      conn.capabilities = client.getServerCapabilities();\n      conn.connected = true;\n      this.wire(conn);\n      await this.refreshTools(upstream.name);\n    } catch (err) {\n      conn.connected = false;\n      conn.error = err instanceof Error ? err.message : String(err);\n      this.log(`upstream \"${upstream.name}\" unavailable: ${conn.error}`);\n    }\n  }\n\n  private wire(conn: Connection): void {\n    const { client, upstream } = conn;\n    client.onclose = () => {\n      conn.connected = false;\n      conn.error = \"connection closed\";\n      if (!this.closing) this.log(`upstream \"${upstream.name}\" closed`);\n    };\n    client.setNotificationHandler(LoggingMessageNotificationSchema, async (n) => {\n      await this.broadcast(upstream.name, n.method, n.params);\n    });\n    client.setNotificationHandler(ResourceUpdatedNotificationSchema, async (n) => {\n      await this.broadcast(upstream.name, n.method, n.params);\n    });\n    client.setNotificationHandler(ResourceListChangedNotificationSchema, async () => {\n      this.resourceOwner.clear();\n      await this.broadcast(upstream.name, \"notifications/resources/list_changed\", undefined);\n    });\n    client.setNotificationHandler(PromptListChangedNotificationSchema, async () => {\n      this.promptOwner.clear();\n      await this.broadcast(upstream.name, \"notifications/prompts/list_changed\", undefined);\n    });\n    client.setNotificationHandler(ToolListChangedNotificationSchema, async () => {\n      await this.refreshTools(upstream.name);\n      this.rebuildExposed();\n      for (const s of this.sessions) s.server.server.sendToolListChanged().catch(() => undefined);\n    });\n    // Relay server→client requests (sampling, elicitation) to the downstream session that is\n    // waiting on this upstream. Clients created without those capabilities (tests) skip this.\n    try {\n      client.setRequestHandler(CreateMessageRequestSchema, async (req) => {\n        const session = this.pickSession(upstream.name);\n        if (!session) throw new Error(\"no downstream client is connected to relay sampling to\");\n        const related = session.inflight.get(upstream.name)?.at(-1);\n        return session.server.server.createMessage(req.params, { relatedRequestId: related });\n      });\n      client.setRequestHandler(ElicitRequestSchema, async (req) => {\n        const session = this.pickSession(upstream.name);\n        if (!session) throw new Error(\"no downstream client is connected to relay elicitation to\");\n        const related = session.inflight.get(upstream.name)?.at(-1);\n        return session.server.server.elicitInput(req.params, { relatedRequestId: related });\n      });\n    } catch {\n      // client declared no sampling/elicitation capability\n    }\n  }\n\n  private pickSession(upstream: string): DownstreamSession | undefined {\n    let best: DownstreamSession | undefined;\n    for (const s of this.sessions) {\n      if ((s.inflight.get(upstream)?.length ?? 0) > 0) return s;\n      if (!best || s.lastActive > best.lastActive) best = s;\n    }\n    return best;\n  }\n\n  private async broadcast(upstream: string, method: string, params: unknown): Promise<void> {\n    for (const s of this.sessions) {\n      const related = s.inflight.get(upstream)?.at(-1);\n      try {\n        await s.server.server.notification(\n          { method, params: params as Record<string, unknown> | undefined },\n          related !== undefined ? { relatedRequestId: related } : undefined,\n        );\n      } catch {\n        // session gone\n      }\n    }\n  }\n\n  /**\n   * Re-read an upstream's tools, every page (mcp-kit's `readAllPages`): at most 20 requests, each\n   * under the upstream's `timeout_ms`, ending at a cursor already followed. It used to follow\n   * `nextCursor` with no bound, so an upstream that echoed its cursor kept the proxy asking for\n   * the same page forever. A refresh that fails, or stops at the 20-page / 2,000-tool ceiling,\n   * changes nothing: the agent keeps the last good list, and the log says why.\n   */\n  private async refreshTools(name: string): Promise<void> {\n    const conn = this.connections.get(name);\n    if (!conn?.connected) return;\n    if (conn.capabilities && !conn.capabilities.tools) {\n      conn.tools = [];\n      return;\n    }\n    const kept = () =>\n      `keeping the last good list (${conn.tools.length} tool${conn.tools.length === 1 ? \"\" : \"s\"})`;\n    try {\n      const read = await readAllPages<Tool>(async (cursor) => {\n        const page = await conn.client.listTools(cursor ? { cursor } : undefined, {\n          timeout: conn.upstream.timeout_ms,\n        });\n        return { items: page.tools, nextCursor: page.nextCursor };\n      });\n      if (read.truncated) {\n        this.log(`tools/list for \"${name}\" not applied: ${read.truncated.reason}; ${kept()}`);\n        return;\n      }\n      conn.tools = read.items;\n    } catch (err) {\n      this.log(\n        `tools/list failed for \"${name}\": ${err instanceof Error ? err.message : String(err)}; ${kept()}`,\n      );\n    }\n  }\n\n  private rebuildExposed(): void {\n    const taken = new Set<string>();\n    const out: ExposedTool[] = [];\n    const order = [...this.policy.upstreams.map((u) => u.name), ...Object.keys(this.testClients)];\n    for (const name of order) {\n      const conn = this.connections.get(name);\n      if (!conn) continue;\n      const prefix =\n        conn.upstream.prefix === true\n          ? name\n          : typeof conn.upstream.prefix === \"string\"\n            ? conn.upstream.prefix\n            : undefined;\n      for (const tool of conn.tools) {\n        let exposedName = prefix ? `${prefix}__${tool.name}` : tool.name;\n        if (taken.has(exposedName)) exposedName = `${name}__${tool.name}`;\n        if (taken.has(exposedName)) {\n          this.log(`skipping duplicate tool ${exposedName} from ${name}`);\n          continue;\n        }\n        taken.add(exposedName);\n        out.push({\n          name: exposedName,\n          upstream: name,\n          original: tool.name,\n          tool,\n          classification: classifyTool(\n            {\n              name: exposedName,\n              description: tool.description,\n              annotations: tool.annotations,\n              inputSchema: tool.inputSchema,\n              outputSchema: tool.outputSchema,\n            },\n            this.policy,\n          ),\n        });\n      }\n    }\n    this.exposed = out;\n  }\n\n  listTools(agent?: AgentScope | null): ExposedTool[] {\n    if (agent?.upstreams) return this.exposed.filter((t) => agent.upstreams!.includes(t.upstream));\n    return this.exposed;\n  }\n\n  findTool(name: string): ExposedTool | undefined {\n    return this.exposed.find((t) => t.name === name);\n  }\n\n  upstreamStatus(): UpstreamStatus[] {\n    return [...this.connections.values()].map((c) => ({\n      name: c.upstream.name,\n      connected: c.connected,\n      tools: c.tools.length,\n      transport: c.upstream.url ? \"http\" : \"stdio\",\n      error: c.error,\n    }));\n  }\n\n  attach(session: DownstreamSession): void {\n    this.sessions.add(session);\n  }\n  detach(session: DownstreamSession): void {\n    this.sessions.delete(session);\n  }\n\n  /** Run a tool call through the policy engine and, if allowed, the upstream. */\n  async callTool(\n    name: string,\n    args: unknown,\n    ctx: CallContext,\n  ): Promise<{ result: GuardResult; tool?: ExposedTool }> {\n    const tool = this.findTool(name);\n    const agent = ctx.agent === undefined ? this.agent : ctx.agent;\n    if (!tool) {\n      const result = await this.guard.run(\n        { tool: { name }, args, runId: ctx.runId, agent, sessionId: ctx.sessionId },\n        async () => {\n          throw new GuardError({\n            code: \"UNKNOWN_TOOL\",\n            cause: `no upstream exposes a tool named \"${name}\"`,\n            fix: \"call tools/list and use one of the listed names\",\n            retryable: false,\n          });\n        },\n      );\n      return { result };\n    }\n    const conn = this.connections.get(tool.upstream);\n    const track = (): (() => void) => {\n      if (!ctx.session || ctx.requestId === undefined) return () => undefined;\n      const list = ctx.session.inflight.get(tool.upstream) ?? [];\n      list.push(ctx.requestId);\n      ctx.session.inflight.set(tool.upstream, list);\n      return () => {\n        const l = ctx.session!.inflight.get(tool.upstream) ?? [];\n        const i = l.indexOf(ctx.requestId!);\n        if (i >= 0) l.splice(i, 1);\n      };\n    };\n    const result = await this.guard.run(\n      {\n        tool: {\n          name: tool.name,\n          description: tool.tool.description,\n          annotations: tool.tool.annotations,\n          inputSchema: tool.tool.inputSchema,\n          outputSchema: tool.tool.outputSchema,\n        },\n        args,\n        runId: ctx.runId,\n        agent,\n        sessionId: ctx.sessionId,\n        upstream: tool.upstream,\n      },\n      async (finalArgs) => {\n        if (!conn?.connected) {\n          throw new GuardError({\n            code: \"UPSTREAM_ERROR\",\n            cause: `upstream \"${tool.upstream}\" is not connected${conn?.error ? ` (${conn.error})` : \"\"}`,\n            fix: \"check the upstream command/url in agentguard.yaml and restart the proxy\",\n            retryable: true,\n          });\n        }\n        const untrack = track();\n        try {\n          return (await conn.client.callTool(\n            { name: tool.original, arguments: (finalArgs ?? {}) as Record<string, unknown> },\n            undefined,\n            {\n              timeout: conn.upstream.timeout_ms,\n              resetTimeoutOnProgress: true,\n              onprogress: ctx.onprogress,\n            },\n          )) as CallToolResult;\n        } finally {\n          untrack();\n        }\n      },\n    );\n    return { result, tool };\n  }\n\n  private connectedWith(\n    capability: \"resources\" | \"prompts\" | \"completions\" | \"logging\",\n  ): Connection[] {\n    return [...this.connections.values()].filter(\n      (c) => c.connected && (c.capabilities?.[capability] || c.capabilities === undefined),\n    );\n  }\n\n  async listResources(): Promise<ListResourcesResult> {\n    const resources: Resource[] = [];\n    for (const conn of this.connectedWith(\"resources\")) {\n      try {\n        const page = await conn.client.listResources(undefined, {\n          timeout: conn.upstream.timeout_ms,\n        });\n        for (const r of page.resources) {\n          this.resourceOwner.set(r.uri, conn.upstream.name);\n          resources.push(r);\n        }\n      } catch {\n        // upstream has no resources\n      }\n    }\n    return { resources };\n  }\n\n  async listResourceTemplates(): Promise<ListResourceTemplatesResult> {\n    const resourceTemplates: ResourceTemplate[] = [];\n    for (const conn of this.connectedWith(\"resources\")) {\n      try {\n        const page = await conn.client.listResourceTemplates(undefined, {\n          timeout: conn.upstream.timeout_ms,\n        });\n        for (const t of page.resourceTemplates) {\n          this.templateOwner.set(t.uriTemplate, conn.upstream.name);\n          resourceTemplates.push(t);\n        }\n      } catch {\n        // none\n      }\n    }\n    return { resourceTemplates };\n  }\n\n  private ownerForUri(uri: string): Connection[] {\n    const owner = this.resourceOwner.get(uri);\n    if (owner && this.connections.get(owner)?.connected) return [this.connections.get(owner)!];\n    for (const [template, name] of this.templateOwner) {\n      if (templateMatches(template, uri) && this.connections.get(name)?.connected)\n        return [this.connections.get(name)!];\n    }\n    return this.connectedWith(\"resources\");\n  }\n\n  async readResource(uri: string): Promise<ReadResourceResult> {\n    let lastError: unknown;\n    for (const conn of this.ownerForUri(uri)) {\n      try {\n        const result = await conn.client.readResource(\n          { uri },\n          { timeout: conn.upstream.timeout_ms },\n        );\n        this.resourceOwner.set(uri, conn.upstream.name);\n        return result;\n      } catch (err) {\n        lastError = err;\n      }\n    }\n    throw lastError ?? new Error(`no upstream serves resource ${uri}`);\n  }\n\n  async subscribe(uri: string, on: boolean): Promise<void> {\n    for (const conn of this.ownerForUri(uri)) {\n      try {\n        if (on) await conn.client.subscribeResource({ uri });\n        else await conn.client.unsubscribeResource({ uri });\n        return;\n      } catch {\n        // try next\n      }\n    }\n  }\n\n  async listPrompts(): Promise<ListPromptsResult> {\n    const prompts: Prompt[] = [];\n    const taken = new Set<string>();\n    this.promptOwner.clear();\n    for (const conn of this.connectedWith(\"prompts\")) {\n      try {\n        const page = await conn.client.listPrompts(undefined, {\n          timeout: conn.upstream.timeout_ms,\n        });\n        for (const p of page.prompts) {\n          const name = taken.has(p.name) ? `${conn.upstream.name}__${p.name}` : p.name;\n          taken.add(name);\n          this.promptOwner.set(name, { upstream: conn.upstream.name, original: p.name });\n          prompts.push({ ...p, name });\n        }\n      } catch {\n        // none\n      }\n    }\n    return { prompts };\n  }\n\n  async getPrompt(\n    name: string,\n    args: Record<string, string> | undefined,\n  ): Promise<GetPromptResult> {\n    if (this.promptOwner.size === 0) await this.listPrompts();\n    const owner = this.promptOwner.get(name);\n    const conns = owner ? [this.connections.get(owner.upstream)!] : this.connectedWith(\"prompts\");\n    let lastError: unknown;\n    for (const conn of conns) {\n      try {\n        return await conn.client.getPrompt(\n          { name: owner?.original ?? name, arguments: args },\n          { timeout: conn.upstream.timeout_ms },\n        );\n      } catch (err) {\n        lastError = err;\n      }\n    }\n    throw lastError ?? new Error(`no upstream serves prompt ${name}`);\n  }\n\n  async complete(params: CompleteRequest[\"params\"]): Promise<CompleteResult> {\n    let conns: Connection[];\n    if (params.ref.type === \"ref/prompt\") {\n      if (this.promptOwner.size === 0) await this.listPrompts();\n      const owner = this.promptOwner.get(params.ref.name);\n      conns = owner ? [this.connections.get(owner.upstream)!] : this.connectedWith(\"completions\");\n      if (owner) params = { ...params, ref: { ...params.ref, name: owner.original } };\n    } else {\n      if (this.templateOwner.size === 0) await this.listResourceTemplates();\n      conns = this.ownerForUri(params.ref.uri);\n    }\n    let lastError: unknown;\n    for (const conn of conns) {\n      try {\n        return await conn.client.complete(params, { timeout: conn.upstream.timeout_ms });\n      } catch (err) {\n        lastError = err;\n      }\n    }\n    throw lastError ?? new Error(\"no upstream supports completions\");\n  }\n\n  async setLevel(level: LoggingLevel): Promise<void> {\n    await Promise.all(\n      this.connectedWith(\"logging\").map((c) =>\n        c.client.setLoggingLevel(level).catch(() => undefined),\n      ),\n    );\n  }\n\n  async close(): Promise<void> {\n    this.closing = true;\n    for (const conn of this.connections.values()) {\n      try {\n        await conn.client.close();\n      } catch {\n        // already closed\n      }\n    }\n    this.connections.clear();\n  }\n}\n\nfunction templateMatches(template: string, uri: string): boolean {\n  const re = new RegExp(\n    \"^\" + template.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\").replace(/\\\\\\{[^}]+\\\\\\}/g, \"[^/]+\") + \"$\",\n  );\n  return re.test(uri);\n}\n\nexport async function withTimeout<T>(promise: Promise<T>, ms: number, what: string): Promise<T> {\n  let timer: NodeJS.Timeout | undefined;\n  const timeout = new Promise<never>((_, reject) => {\n    timer = setTimeout(() => reject(new Error(`${what} timed out after ${ms}ms`)), ms);\n  });\n  try {\n    return await Promise.race([promise, timeout]);\n  } finally {\n    if (timer) clearTimeout(timer);\n  }\n}\n"],"mappings":";;;;;;;;AAKA,SAAS,cAAc;AAEvB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,qCAAqC;AAE9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAcK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OAMK;AAsEA,IAAM,eAAN,MAAmB;AAAA,EACf;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA,WAAW,oBAAI,IAAuB;AAAA,EAC9B,cAAc,oBAAI,IAAwB;AAAA,EACnD,UAAyB,CAAC;AAAA,EACjB,gBAAgB,oBAAI,IAAoB;AAAA,EACxC,gBAAgB,oBAAI,IAAoB;AAAA,EACxC,cAAc,oBAAI,IAAoD;AAAA,EACtE;AAAA,EACA;AAAA,EACA;AAAA;AAAA,EAET,UAAU;AAAA,EAElB,YAAY,MAAsB;AAChC,SAAK,SAAS,KAAK;AACnB,SAAK,QAAQ,KAAK;AAClB,SAAK,QAAQ,KAAK;AAClB,SAAK,eAAe,KAAK;AACzB,SAAK,aAAa,KAAK,cAAc;AACrC,SAAK,MAAM,KAAK,QAAQ,CAAC,SAAS,QAAQ,OAAO,MAAM,gBAAgB,IAAI;AAAA,CAAI;AAC/E,SAAK,mBAAmB,KAAK,oBAAoB;AACjD,SAAK,cAAc,KAAK,WAAW,CAAC;AAAA,EACtC;AAAA,EAEA,IAAI,SAAS;AACX,WAAO,KAAK,OAAO;AAAA,EACrB;AAAA,EAEA,MAAM,QAAuB;AAC3B,UAAM,QAAQ,IAAI,KAAK,OAAO,UAAU,IAAI,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC;AACnE,eAAW,CAAC,MAAM,MAAM,KAAK,OAAO,QAAQ,KAAK,WAAW,GAAG;AAC7D,UAAI,KAAK,YAAY,IAAI,IAAI,EAAG;AAChC,YAAM,WAAqB;AAAA,QACzB;AAAA,QACA,SAAS;AAAA,QACT,MAAM,CAAC;AAAA,QACP,KAAK,CAAC;AAAA,QACN,SAAS,CAAC;AAAA,QACV,QAAQ;AAAA,QACR,YAAY;AAAA,MACd;AACA,YAAM,OAAmB;AAAA,QACvB;AAAA,QACA;AAAA,QACA,OAAO,CAAC;AAAA,QACR,cAAc,OAAO,sBAAsB;AAAA,QAC3C,WAAW;AAAA,MACb;AACA,WAAK,YAAY,IAAI,MAAM,IAAI;AAC/B,WAAK,KAAK,IAAI;AACd,YAAM,KAAK,aAAa,IAAI;AAAA,IAC9B;AACA,SAAK,eAAe;AACpB,UAAM,SAAS,KAAK,eAAe;AACnC,SAAK;AAAA,MACH,aAAa,OAAO,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,IAAI,OAAO,MAAM,eAAe,KAAK,QAAQ,MAAM,gBAAgB,KAAK,OAAO,IAAI;AAAA,IAC1I;AAAA,EACF;AAAA,EAEA,MAAc,QAAQ,UAAmC;AACvD,UAAM,SAAS,IAAI;AAAA,MACjB,EAAE,MAAM,cAAc,SAAS,QAAW,EAAE;AAAA,MAC5C,EAAE,cAAc,EAAE,UAAU,CAAC,GAAG,aAAa,CAAC,EAAE,EAAE;AAAA,IACpD;AACA,UAAM,OAAmB;AAAA,MACvB;AAAA,MACA;AAAA,MACA,OAAO,CAAC;AAAA,MACR,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AACA,SAAK,YAAY,IAAI,SAAS,MAAM,IAAI;AACxC,QAAI;AACF,YAAM,YAAY,SAAS,MACvB,IAAI,8BAA8B,IAAI,IAAI,SAAS,GAAG,GAAG;AAAA,QACvD,aAAa,EAAE,SAAS,gBAAgB,QAAQ,EAAE;AAAA,MACpD,CAAC,IACD,IAAI,qBAAqB;AAAA,QACvB,SAAS,SAAS;AAAA,QAClB,MAAM,SAAS;AAAA,QACf,KAAK,EAAE,GAAG,sBAAsB,GAAG,GAAG,SAAS,IAAI;AAAA,QACnD,KAAK,SAAS;AAAA,QACd,QAAQ;AAAA,MACV,CAAC;AACL,UAAI,qBAAqB,sBAAsB;AAC7C,kBAAU,QAAQ,GAAG,QAAQ,CAAC,UAAkB;AAC9C,cAAI,KAAK,QAAS;AAClB,qBAAW,QAAQ,MAAM,SAAS,MAAM,EAAE,MAAM,IAAI;AAClD,gBAAI,KAAK,KAAK,EAAG,MAAK,IAAI,GAAG,SAAS,IAAI,KAAK,IAAI,EAAE;AAAA,QACzD,CAAC;AAAA,MACH;AACA,YAAM;AAAA,QACJ,OAAO,QAAQ,SAAS;AAAA,QACxB,KAAK;AAAA,QACL,wBAAwB,SAAS,IAAI;AAAA,MACvC;AACA,WAAK,eAAe,OAAO,sBAAsB;AACjD,WAAK,YAAY;AACjB,WAAK,KAAK,IAAI;AACd,YAAM,KAAK,aAAa,SAAS,IAAI;AAAA,IACvC,SAAS,KAAK;AACZ,WAAK,YAAY;AACjB,WAAK,QAAQ,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC5D,WAAK,IAAI,aAAa,SAAS,IAAI,kBAAkB,KAAK,KAAK,EAAE;AAAA,IACnE;AAAA,EACF;AAAA,EAEQ,KAAK,MAAwB;AACnC,UAAM,EAAE,QAAQ,SAAS,IAAI;AAC7B,WAAO,UAAU,MAAM;AACrB,WAAK,YAAY;AACjB,WAAK,QAAQ;AACb,UAAI,CAAC,KAAK,QAAS,MAAK,IAAI,aAAa,SAAS,IAAI,UAAU;AAAA,IAClE;AACA,WAAO,uBAAuB,kCAAkC,OAAO,MAAM;AAC3E,YAAM,KAAK,UAAU,SAAS,MAAM,EAAE,QAAQ,EAAE,MAAM;AAAA,IACxD,CAAC;AACD,WAAO,uBAAuB,mCAAmC,OAAO,MAAM;AAC5E,YAAM,KAAK,UAAU,SAAS,MAAM,EAAE,QAAQ,EAAE,MAAM;AAAA,IACxD,CAAC;AACD,WAAO,uBAAuB,uCAAuC,YAAY;AAC/E,WAAK,cAAc,MAAM;AACzB,YAAM,KAAK,UAAU,SAAS,MAAM,wCAAwC,MAAS;AAAA,IACvF,CAAC;AACD,WAAO,uBAAuB,qCAAqC,YAAY;AAC7E,WAAK,YAAY,MAAM;AACvB,YAAM,KAAK,UAAU,SAAS,MAAM,sCAAsC,MAAS;AAAA,IACrF,CAAC;AACD,WAAO,uBAAuB,mCAAmC,YAAY;AAC3E,YAAM,KAAK,aAAa,SAAS,IAAI;AACrC,WAAK,eAAe;AACpB,iBAAW,KAAK,KAAK,SAAU,GAAE,OAAO,OAAO,oBAAoB,EAAE,MAAM,MAAM,MAAS;AAAA,IAC5F,CAAC;AAGD,QAAI;AACF,aAAO,kBAAkB,4BAA4B,OAAO,QAAQ;AAClE,cAAM,UAAU,KAAK,YAAY,SAAS,IAAI;AAC9C,YAAI,CAAC,QAAS,OAAM,IAAI,MAAM,wDAAwD;AACtF,cAAM,UAAU,QAAQ,SAAS,IAAI,SAAS,IAAI,GAAG,GAAG,EAAE;AAC1D,eAAO,QAAQ,OAAO,OAAO,cAAc,IAAI,QAAQ,EAAE,kBAAkB,QAAQ,CAAC;AAAA,MACtF,CAAC;AACD,aAAO,kBAAkB,qBAAqB,OAAO,QAAQ;AAC3D,cAAM,UAAU,KAAK,YAAY,SAAS,IAAI;AAC9C,YAAI,CAAC,QAAS,OAAM,IAAI,MAAM,2DAA2D;AACzF,cAAM,UAAU,QAAQ,SAAS,IAAI,SAAS,IAAI,GAAG,GAAG,EAAE;AAC1D,eAAO,QAAQ,OAAO,OAAO,YAAY,IAAI,QAAQ,EAAE,kBAAkB,QAAQ,CAAC;AAAA,MACpF,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAAA,EAEQ,YAAY,UAAiD;AACnE,QAAI;AACJ,eAAW,KAAK,KAAK,UAAU;AAC7B,WAAK,EAAE,SAAS,IAAI,QAAQ,GAAG,UAAU,KAAK,EAAG,QAAO;AACxD,UAAI,CAAC,QAAQ,EAAE,aAAa,KAAK,WAAY,QAAO;AAAA,IACtD;AACA,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,UAAU,UAAkB,QAAgB,QAAgC;AACxF,eAAW,KAAK,KAAK,UAAU;AAC7B,YAAM,UAAU,EAAE,SAAS,IAAI,QAAQ,GAAG,GAAG,EAAE;AAC/C,UAAI;AACF,cAAM,EAAE,OAAO,OAAO;AAAA,UACpB,EAAE,QAAQ,OAAsD;AAAA,UAChE,YAAY,SAAY,EAAE,kBAAkB,QAAQ,IAAI;AAAA,QAC1D;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EASA,MAAc,aAAa,MAA6B;AACtD,UAAM,OAAO,KAAK,YAAY,IAAI,IAAI;AACtC,QAAI,CAAC,MAAM,UAAW;AACtB,QAAI,KAAK,gBAAgB,CAAC,KAAK,aAAa,OAAO;AACjD,WAAK,QAAQ,CAAC;AACd;AAAA,IACF;AACA,UAAM,OAAO,MACX,+BAA+B,KAAK,MAAM,MAAM,QAAQ,KAAK,MAAM,WAAW,IAAI,KAAK,GAAG;AAC5F,QAAI;AACF,YAAM,OAAO,MAAM,aAAmB,OAAO,WAAW;AACtD,cAAM,OAAO,MAAM,KAAK,OAAO,UAAU,SAAS,EAAE,OAAO,IAAI,QAAW;AAAA,UACxE,SAAS,KAAK,SAAS;AAAA,QACzB,CAAC;AACD,eAAO,EAAE,OAAO,KAAK,OAAO,YAAY,KAAK,WAAW;AAAA,MAC1D,CAAC;AACD,UAAI,KAAK,WAAW;AAClB,aAAK,IAAI,mBAAmB,IAAI,kBAAkB,KAAK,UAAU,MAAM,KAAK,KAAK,CAAC,EAAE;AACpF;AAAA,MACF;AACA,WAAK,QAAQ,KAAK;AAAA,IACpB,SAAS,KAAK;AACZ,WAAK;AAAA,QACH,0BAA0B,IAAI,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,KAAK,KAAK,CAAC;AAAA,MACjG;AAAA,IACF;AAAA,EACF;AAAA,EAEQ,iBAAuB;AAC7B,UAAM,QAAQ,oBAAI,IAAY;AAC9B,UAAM,MAAqB,CAAC;AAC5B,UAAM,QAAQ,CAAC,GAAG,KAAK,OAAO,UAAU,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,GAAG,OAAO,KAAK,KAAK,WAAW,CAAC;AAC5F,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,KAAK,YAAY,IAAI,IAAI;AACtC,UAAI,CAAC,KAAM;AACX,YAAM,SACJ,KAAK,SAAS,WAAW,OACrB,OACA,OAAO,KAAK,SAAS,WAAW,WAC9B,KAAK,SAAS,SACd;AACR,iBAAW,QAAQ,KAAK,OAAO;AAC7B,YAAI,cAAc,SAAS,GAAG,MAAM,KAAK,KAAK,IAAI,KAAK,KAAK;AAC5D,YAAI,MAAM,IAAI,WAAW,EAAG,eAAc,GAAG,IAAI,KAAK,KAAK,IAAI;AAC/D,YAAI,MAAM,IAAI,WAAW,GAAG;AAC1B,eAAK,IAAI,2BAA2B,WAAW,SAAS,IAAI,EAAE;AAC9D;AAAA,QACF;AACA,cAAM,IAAI,WAAW;AACrB,YAAI,KAAK;AAAA,UACP,MAAM;AAAA,UACN,UAAU;AAAA,UACV,UAAU,KAAK;AAAA,UACf;AAAA,UACA,gBAAgB;AAAA,YACd;AAAA,cACE,MAAM;AAAA,cACN,aAAa,KAAK;AAAA,cAClB,aAAa,KAAK;AAAA,cAClB,aAAa,KAAK;AAAA,cAClB,cAAc,KAAK;AAAA,YACrB;AAAA,YACA,KAAK;AAAA,UACP;AAAA,QACF,CAAC;AAAA,MACH;AAAA,IACF;AACA,SAAK,UAAU;AAAA,EACjB;AAAA,EAEA,UAAU,OAA0C;AAClD,QAAI,OAAO,UAAW,QAAO,KAAK,QAAQ,OAAO,CAAC,MAAM,MAAM,UAAW,SAAS,EAAE,QAAQ,CAAC;AAC7F,WAAO,KAAK;AAAA,EACd;AAAA,EAEA,SAAS,MAAuC;AAC9C,WAAO,KAAK,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AAAA,EACjD;AAAA,EAEA,iBAAmC;AACjC,WAAO,CAAC,GAAG,KAAK,YAAY,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO;AAAA,MAChD,MAAM,EAAE,SAAS;AAAA,MACjB,WAAW,EAAE;AAAA,MACb,OAAO,EAAE,MAAM;AAAA,MACf,WAAW,EAAE,SAAS,MAAM,SAAS;AAAA,MACrC,OAAO,EAAE;AAAA,IACX,EAAE;AAAA,EACJ;AAAA,EAEA,OAAO,SAAkC;AACvC,SAAK,SAAS,IAAI,OAAO;AAAA,EAC3B;AAAA,EACA,OAAO,SAAkC;AACvC,SAAK,SAAS,OAAO,OAAO;AAAA,EAC9B;AAAA;AAAA,EAGA,MAAM,SACJ,MACA,MACA,KACsD;AACtD,UAAM,OAAO,KAAK,SAAS,IAAI;AAC/B,UAAM,QAAQ,IAAI,UAAU,SAAY,KAAK,QAAQ,IAAI;AACzD,QAAI,CAAC,MAAM;AACT,YAAMA,UAAS,MAAM,KAAK,MAAM;AAAA,QAC9B,EAAE,MAAM,EAAE,KAAK,GAAG,MAAM,OAAO,IAAI,OAAO,OAAO,WAAW,IAAI,UAAU;AAAA,QAC1E,YAAY;AACV,gBAAM,IAAI,WAAW;AAAA,YACnB,MAAM;AAAA,YACN,OAAO,qCAAqC,IAAI;AAAA,YAChD,KAAK;AAAA,YACL,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AAAA,MACF;AACA,aAAO,EAAE,QAAAA,QAAO;AAAA,IAClB;AACA,UAAM,OAAO,KAAK,YAAY,IAAI,KAAK,QAAQ;AAC/C,UAAM,QAAQ,MAAoB;AAChC,UAAI,CAAC,IAAI,WAAW,IAAI,cAAc,OAAW,QAAO,MAAM;AAC9D,YAAM,OAAO,IAAI,QAAQ,SAAS,IAAI,KAAK,QAAQ,KAAK,CAAC;AACzD,WAAK,KAAK,IAAI,SAAS;AACvB,UAAI,QAAQ,SAAS,IAAI,KAAK,UAAU,IAAI;AAC5C,aAAO,MAAM;AACX,cAAM,IAAI,IAAI,QAAS,SAAS,IAAI,KAAK,QAAQ,KAAK,CAAC;AACvD,cAAM,IAAI,EAAE,QAAQ,IAAI,SAAU;AAClC,YAAI,KAAK,EAAG,GAAE,OAAO,GAAG,CAAC;AAAA,MAC3B;AAAA,IACF;AACA,UAAM,SAAS,MAAM,KAAK,MAAM;AAAA,MAC9B;AAAA,QACE,MAAM;AAAA,UACJ,MAAM,KAAK;AAAA,UACX,aAAa,KAAK,KAAK;AAAA,UACvB,aAAa,KAAK,KAAK;AAAA,UACvB,aAAa,KAAK,KAAK;AAAA,UACvB,cAAc,KAAK,KAAK;AAAA,QAC1B;AAAA,QACA;AAAA,QACA,OAAO,IAAI;AAAA,QACX;AAAA,QACA,WAAW,IAAI;AAAA,QACf,UAAU,KAAK;AAAA,MACjB;AAAA,MACA,OAAO,cAAc;AACnB,YAAI,CAAC,MAAM,WAAW;AACpB,gBAAM,IAAI,WAAW;AAAA,YACnB,MAAM;AAAA,YACN,OAAO,aAAa,KAAK,QAAQ,qBAAqB,MAAM,QAAQ,KAAK,KAAK,KAAK,MAAM,EAAE;AAAA,YAC3F,KAAK;AAAA,YACL,WAAW;AAAA,UACb,CAAC;AAAA,QACH;AACA,cAAM,UAAU,MAAM;AACtB,YAAI;AACF,iBAAQ,MAAM,KAAK,OAAO;AAAA,YACxB,EAAE,MAAM,KAAK,UAAU,WAAY,aAAa,CAAC,EAA8B;AAAA,YAC/E;AAAA,YACA;AAAA,cACE,SAAS,KAAK,SAAS;AAAA,cACvB,wBAAwB;AAAA,cACxB,YAAY,IAAI;AAAA,YAClB;AAAA,UACF;AAAA,QACF,UAAE;AACA,kBAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AACA,WAAO,EAAE,QAAQ,KAAK;AAAA,EACxB;AAAA,EAEQ,cACN,YACc;AACd,WAAO,CAAC,GAAG,KAAK,YAAY,OAAO,CAAC,EAAE;AAAA,MACpC,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,UAAU,KAAK,EAAE,iBAAiB;AAAA,IAC5E;AAAA,EACF;AAAA,EAEA,MAAM,gBAA8C;AAClD,UAAM,YAAwB,CAAC;AAC/B,eAAW,QAAQ,KAAK,cAAc,WAAW,GAAG;AAClD,UAAI;AACF,cAAM,OAAO,MAAM,KAAK,OAAO,cAAc,QAAW;AAAA,UACtD,SAAS,KAAK,SAAS;AAAA,QACzB,CAAC;AACD,mBAAW,KAAK,KAAK,WAAW;AAC9B,eAAK,cAAc,IAAI,EAAE,KAAK,KAAK,SAAS,IAAI;AAChD,oBAAU,KAAK,CAAC;AAAA,QAClB;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,EAAE,UAAU;AAAA,EACrB;AAAA,EAEA,MAAM,wBAA8D;AAClE,UAAM,oBAAwC,CAAC;AAC/C,eAAW,QAAQ,KAAK,cAAc,WAAW,GAAG;AAClD,UAAI;AACF,cAAM,OAAO,MAAM,KAAK,OAAO,sBAAsB,QAAW;AAAA,UAC9D,SAAS,KAAK,SAAS;AAAA,QACzB,CAAC;AACD,mBAAW,KAAK,KAAK,mBAAmB;AACtC,eAAK,cAAc,IAAI,EAAE,aAAa,KAAK,SAAS,IAAI;AACxD,4BAAkB,KAAK,CAAC;AAAA,QAC1B;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,EAAE,kBAAkB;AAAA,EAC7B;AAAA,EAEQ,YAAY,KAA2B;AAC7C,UAAM,QAAQ,KAAK,cAAc,IAAI,GAAG;AACxC,QAAI,SAAS,KAAK,YAAY,IAAI,KAAK,GAAG,UAAW,QAAO,CAAC,KAAK,YAAY,IAAI,KAAK,CAAE;AACzF,eAAW,CAAC,UAAU,IAAI,KAAK,KAAK,eAAe;AACjD,UAAI,gBAAgB,UAAU,GAAG,KAAK,KAAK,YAAY,IAAI,IAAI,GAAG;AAChE,eAAO,CAAC,KAAK,YAAY,IAAI,IAAI,CAAE;AAAA,IACvC;AACA,WAAO,KAAK,cAAc,WAAW;AAAA,EACvC;AAAA,EAEA,MAAM,aAAa,KAA0C;AAC3D,QAAI;AACJ,eAAW,QAAQ,KAAK,YAAY,GAAG,GAAG;AACxC,UAAI;AACF,cAAM,SAAS,MAAM,KAAK,OAAO;AAAA,UAC/B,EAAE,IAAI;AAAA,UACN,EAAE,SAAS,KAAK,SAAS,WAAW;AAAA,QACtC;AACA,aAAK,cAAc,IAAI,KAAK,KAAK,SAAS,IAAI;AAC9C,eAAO;AAAA,MACT,SAAS,KAAK;AACZ,oBAAY;AAAA,MACd;AAAA,IACF;AACA,UAAM,aAAa,IAAI,MAAM,+BAA+B,GAAG,EAAE;AAAA,EACnE;AAAA,EAEA,MAAM,UAAU,KAAa,IAA4B;AACvD,eAAW,QAAQ,KAAK,YAAY,GAAG,GAAG;AACxC,UAAI;AACF,YAAI,GAAI,OAAM,KAAK,OAAO,kBAAkB,EAAE,IAAI,CAAC;AAAA,YAC9C,OAAM,KAAK,OAAO,oBAAoB,EAAE,IAAI,CAAC;AAClD;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,cAA0C;AAC9C,UAAM,UAAoB,CAAC;AAC3B,UAAM,QAAQ,oBAAI,IAAY;AAC9B,SAAK,YAAY,MAAM;AACvB,eAAW,QAAQ,KAAK,cAAc,SAAS,GAAG;AAChD,UAAI;AACF,cAAM,OAAO,MAAM,KAAK,OAAO,YAAY,QAAW;AAAA,UACpD,SAAS,KAAK,SAAS;AAAA,QACzB,CAAC;AACD,mBAAW,KAAK,KAAK,SAAS;AAC5B,gBAAM,OAAO,MAAM,IAAI,EAAE,IAAI,IAAI,GAAG,KAAK,SAAS,IAAI,KAAK,EAAE,IAAI,KAAK,EAAE;AACxE,gBAAM,IAAI,IAAI;AACd,eAAK,YAAY,IAAI,MAAM,EAAE,UAAU,KAAK,SAAS,MAAM,UAAU,EAAE,KAAK,CAAC;AAC7E,kBAAQ,KAAK,EAAE,GAAG,GAAG,KAAK,CAAC;AAAA,QAC7B;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AACA,WAAO,EAAE,QAAQ;AAAA,EACnB;AAAA,EAEA,MAAM,UACJ,MACA,MAC0B;AAC1B,QAAI,KAAK,YAAY,SAAS,EAAG,OAAM,KAAK,YAAY;AACxD,UAAM,QAAQ,KAAK,YAAY,IAAI,IAAI;AACvC,UAAM,QAAQ,QAAQ,CAAC,KAAK,YAAY,IAAI,MAAM,QAAQ,CAAE,IAAI,KAAK,cAAc,SAAS;AAC5F,QAAI;AACJ,eAAW,QAAQ,OAAO;AACxB,UAAI;AACF,eAAO,MAAM,KAAK,OAAO;AAAA,UACvB,EAAE,MAAM,OAAO,YAAY,MAAM,WAAW,KAAK;AAAA,UACjD,EAAE,SAAS,KAAK,SAAS,WAAW;AAAA,QACtC;AAAA,MACF,SAAS,KAAK;AACZ,oBAAY;AAAA,MACd;AAAA,IACF;AACA,UAAM,aAAa,IAAI,MAAM,6BAA6B,IAAI,EAAE;AAAA,EAClE;AAAA,EAEA,MAAM,SAAS,QAA4D;AACzE,QAAI;AACJ,QAAI,OAAO,IAAI,SAAS,cAAc;AACpC,UAAI,KAAK,YAAY,SAAS,EAAG,OAAM,KAAK,YAAY;AACxD,YAAM,QAAQ,KAAK,YAAY,IAAI,OAAO,IAAI,IAAI;AAClD,cAAQ,QAAQ,CAAC,KAAK,YAAY,IAAI,MAAM,QAAQ,CAAE,IAAI,KAAK,cAAc,aAAa;AAC1F,UAAI,MAAO,UAAS,EAAE,GAAG,QAAQ,KAAK,EAAE,GAAG,OAAO,KAAK,MAAM,MAAM,SAAS,EAAE;AAAA,IAChF,OAAO;AACL,UAAI,KAAK,cAAc,SAAS,EAAG,OAAM,KAAK,sBAAsB;AACpE,cAAQ,KAAK,YAAY,OAAO,IAAI,GAAG;AAAA,IACzC;AACA,QAAI;AACJ,eAAW,QAAQ,OAAO;AACxB,UAAI;AACF,eAAO,MAAM,KAAK,OAAO,SAAS,QAAQ,EAAE,SAAS,KAAK,SAAS,WAAW,CAAC;AAAA,MACjF,SAAS,KAAK;AACZ,oBAAY;AAAA,MACd;AAAA,IACF;AACA,UAAM,aAAa,IAAI,MAAM,kCAAkC;AAAA,EACjE;AAAA,EAEA,MAAM,SAAS,OAAoC;AACjD,UAAM,QAAQ;AAAA,MACZ,KAAK,cAAc,SAAS,EAAE;AAAA,QAAI,CAAC,MACjC,EAAE,OAAO,gBAAgB,KAAK,EAAE,MAAM,MAAM,MAAS;AAAA,MACvD;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,QAAuB;AAC3B,SAAK,UAAU;AACf,eAAW,QAAQ,KAAK,YAAY,OAAO,GAAG;AAC5C,UAAI;AACF,cAAM,KAAK,OAAO,MAAM;AAAA,MAC1B,QAAQ;AAAA,MAER;AAAA,IACF;AACA,SAAK,YAAY,MAAM;AAAA,EACzB;AACF;AAEA,SAAS,gBAAgB,UAAkB,KAAsB;AAC/D,QAAM,KAAK,IAAI;AAAA,IACb,MAAM,SAAS,QAAQ,uBAAuB,MAAM,EAAE,QAAQ,kBAAkB,OAAO,IAAI;AAAA,EAC7F;AACA,SAAO,GAAG,KAAK,GAAG;AACpB;AAEA,eAAsB,YAAe,SAAqB,IAAY,MAA0B;AAC9F,MAAI;AACJ,QAAM,UAAU,IAAI,QAAe,CAAC,GAAG,WAAW;AAChD,YAAQ,WAAW,MAAM,OAAO,IAAI,MAAM,GAAG,IAAI,oBAAoB,EAAE,IAAI,CAAC,GAAG,EAAE;AAAA,EACnF,CAAC;AACD,MAAI;AACF,WAAO,MAAM,QAAQ,KAAK,CAAC,SAAS,OAAO,CAAC;AAAA,EAC9C,UAAE;AACA,QAAI,MAAO,cAAa,KAAK;AAAA,EAC/B;AACF;","names":["result"]}