@clawops/cli 2.0.1 → 2.1.0

package/dist/{harden-72JMRT4E.js → harden-3KKCR7BL.js}

@@ -1,10 +1,17 @@
 #!/usr/bin/env node
+import {
+  makeTailscaleModule,
+  tailscaleModule
+} from "./chunk-X56CQ6GB.js";
 import {
   acquireSession,
   drainPool
 } from "./chunk-2Z7J3ERQ.js";
 import "./chunk-E4NJSJ54.js";
 import "./chunk-MC5ATCXS.js";
+import {
+  managementToken
+} from "./chunk-BTW7NHOH.js";
 import {
   PUBLISH_INSPECT_CMD,
   publishForRestart,
@@ -14,12 +21,24 @@ import {
   GATEWAY_PORT
 } from "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
+import "./chunk-FEK7VJAY.js";
+import {
+  resolveSubscriptionId
+} from "./chunk-RHOWYIWT.js";
+import {
+  resolveProjectId
+} from "./chunk-TC2VYPLH.js";
+import "./chunk-64PONSA5.js";
 import "./chunk-KGXPLI7W.js";
 
 // src/harden/types.ts
 var SENTINEL_DIR = "/etc/clawops/hardening";
 
 // src/harden/runner.ts
+import { Readable } from "stream";
+function remoteExecFor(session, signal) {
+  return (command, execOpts) => execOpts?.stdin === void 0 ? session.exec(command, execOpts?.signal ?? signal) : session.execWithInput(command, Readable.from([execOpts.stdin]), execOpts.signal ?? signal);
+}
 async function runHardening(conn, opts) {
   const { session, release } = await acquireSession({
     host: conn.host,
@@ -29,7 +48,7 @@ async function runHardening(conn, opts) {
     knownHostsPath: conn.knownHostsPath,
     signal: opts.signal
   });
-  const exec = (command, execOpts) => session.exec(command, execOpts?.signal ?? opts.signal);
+  const exec = remoteExecFor(session, opts.signal);
   const results = [];
   try {
     for (const mod of opts.modules) {
@@ -73,7 +92,7 @@ async function withRemoteExec(conn, signal, fn) {
     signal
   });
   try {
-    return await fn((cmd, opts) => session.exec(cmd, opts?.signal ?? signal));
+    return await fn(remoteExecFor(session, signal));
   } finally {
     release();
   }
@@ -747,6 +766,505 @@ var awsGuardDutyModule = {
   }
 };
 
+// src/harden/gcp-api.ts
+async function gcpContext() {
+  const project = resolveProjectId();
+  if (!project) return void 0;
+  try {
+    const { GoogleAuth } = await import("google-auth-library");
+    const auth = new GoogleAuth({ scopes: ["https://www.googleapis.com/auth/cloud-platform"] });
+    const client = await auth.getClient();
+    const raw = await client.getAccessToken();
+    const token = typeof raw === "string" ? raw : raw.token ?? void 0;
+    return token ? { project, token } : void 0;
+  } catch {
+    return void 0;
+  }
+}
+async function computeGet(ctx, pathAndQuery, signal) {
+  try {
+    const res = await fetch(
+      `https://compute.googleapis.com/compute/v1/projects/${ctx.project}/${pathAndQuery}`,
+      { headers: { authorization: `Bearer ${ctx.token}` }, signal }
+    );
+    if (!res.ok) return void 0;
+    return await res.json();
+  } catch {
+    return void 0;
+  }
+}
+async function findClawopsInstance(ctx, signal) {
+  const body = await computeGet(ctx, "aggregated/instances", signal);
+  for (const scope of Object.values(body?.items ?? {})) {
+    for (const inst of scope.instances ?? []) {
+      if (isClawopsInstance(inst.name)) return inst;
+    }
+  }
+  return void 0;
+}
+function isClawopsInstance(name) {
+  return typeof name === "string" && name.startsWith("clawops-instance");
+}
+function metadataValue(inst, key) {
+  return inst.metadata?.items?.find((i) => i.key === key)?.value;
+}
+
+// src/harden/modules/gcp-firewall-audit.ts
+var WORLD2 = /* @__PURE__ */ new Set(["0.0.0.0/0", "::/0"]);
+var NAMED_PORTS2 = { "22": "SSH", [String(GATEWAY_PORT)]: "the OpenClaw gateway" };
+function describePorts(allowed) {
+  const parts = [];
+  for (const rule of allowed ?? []) {
+    const proto = rule.IPProtocol ?? "all";
+    if (!rule.ports || rule.ports.length === 0) {
+      parts.push(`all ${proto} ports`);
+      continue;
+    }
+    for (const p of rule.ports) {
+      const named = NAMED_PORTS2[p];
+      parts.push(named ? `port ${p} (${named})` : `port ${p}`);
+    }
+  }
+  return parts.length > 0 ? parts.join(", ") : "no ports";
+}
+function networkName(selfLink) {
+  return selfLink.split("/").pop() ?? "";
+}
+function openFindings(firewalls) {
+  const out = [];
+  for (const fw of firewalls) {
+    if (fw.disabled) continue;
+    if ((fw.direction ?? "INGRESS") !== "INGRESS") continue;
+    if (!networkName(fw.network ?? "").startsWith("clawops-")) continue;
+    const world = (fw.sourceRanges ?? []).filter((r) => WORLD2.has(r));
+    if (world.length === 0) continue;
+    out.push(`${fw.name ?? "unnamed rule"} admits ${world.join(" and ")} on ${describePorts(fw.allowed)}`);
+  }
+  return out;
+}
+var gcpFirewallAuditModule = {
+  id: "gcp-firewall-audit",
+  label: "GCP firewall audit (check-only)",
+  defaultOn: true,
+  providers: ["gcp"],
+  async check(_exec) {
+    const ctx = await gcpContext();
+    if (!ctx) {
+      return {
+        status: "skipped",
+        detail: "No GCP credentials or project resolved, so the firewall could not be read. This says nothing about the rules themselves."
+      };
+    }
+    const body = await computeGet(ctx, "global/firewalls");
+    if (!body) {
+      return {
+        status: "skipped",
+        detail: `Could not list firewall rules in ${ctx.project}. The identity needs compute.firewalls.list; nothing else clawops does requires it.`
+      };
+    }
+    const findings = openFindings(body.items ?? []);
+    return findings.length === 0 ? { status: "applied", detail: `No clawops firewall rule admits the internet in ${ctx.project}.` } : { status: "drifted", detail: `Open to the internet: ${findings.join("; ")}.` };
+  },
+  async apply(_exec) {
+    return {
+      changed: false,
+      detail: "The firewall audit only reports. Narrow the rule in your plan with --ssh-cidr or --gateway-cidr and re-apply, so the change survives the next deploy."
+    };
+  }
+};
+
+// src/harden/modules/gcp-shielded-vm.ts
+function missingProtections(s) {
+  const out = [];
+  if (!s.secureBoot) out.push("Secure Boot");
+  if (!s.vtpm) out.push("vTPM");
+  if (!s.integrityMonitoring) out.push("integrity monitoring");
+  return out;
+}
+var gcpShieldedVmModule = {
+  id: "gcp-shielded-vm",
+  label: "GCP Shielded VM check (check-only)",
+  defaultOn: true,
+  providers: ["gcp"],
+  async check(_exec) {
+    const ctx = await gcpContext();
+    if (!ctx) {
+      return { status: "skipped", detail: "No GCP credentials or project resolved, so the instance could not be read." };
+    }
+    const inst = await findClawopsInstance(ctx);
+    if (!inst) {
+      return {
+        status: "skipped",
+        detail: `No instance named clawops-instance found in ${ctx.project}. Either the stack is not deployed there or the identity cannot list instances.`
+      };
+    }
+    const cfg = inst.shieldedInstanceConfig ?? {};
+    const state = {
+      secureBoot: cfg.enableSecureBoot === true,
+      vtpm: cfg.enableVtpm === true,
+      integrityMonitoring: cfg.enableIntegrityMonitoring === true
+    };
+    const missing = missingProtections(state);
+    return missing.length === 0 ? { status: "applied", detail: "Secure Boot, vTPM and integrity monitoring are all on." } : {
+      status: "missing",
+      detail: `Not enabled: ${missing.join(", ")}. Turning these on requires stopping the instance, so clawops does not do it to a running gateway.`
+    };
+  },
+  async apply(_exec) {
+    return {
+      changed: false,
+      detail: "Shielded VM settings cannot be changed on a running instance. Stop the instance and set them, accepting the downtime, or recreate the stack with them enabled."
+    };
+  }
+};
+
+// src/harden/modules/gcp-os-login.ts
+function osLoginEnabled(value) {
+  if (value === void 0) return false;
+  const v = value.trim().toLowerCase();
+  return v === "true" || v === "1" || v === "yes";
+}
+var gcpOsLoginModule = {
+  id: "gcp-os-login",
+  label: "GCP OS Login check (check-only)",
+  defaultOn: false,
+  providers: ["gcp"],
+  async check(_exec) {
+    const ctx = await gcpContext();
+    if (!ctx) {
+      return { status: "skipped", detail: "No GCP credentials or project resolved, so OS Login could not be read." };
+    }
+    const inst = await findClawopsInstance(ctx);
+    if (!inst) {
+      return { status: "skipped", detail: `No instance named clawops-instance found in ${ctx.project}.` };
+    }
+    const enabled = osLoginEnabled(metadataValue(inst, "enable-oslogin"));
+    return enabled ? {
+      status: "drifted",
+      detail: "OS Login is enabled, so the instance ignores metadata SSH keys. clawops authenticates with a metadata key, so its day-two commands will not connect unless your identity has roles/compute.osLogin and you reach the host another way."
+    } : {
+      status: "applied",
+      detail: "OS Login is off, which is what clawops key-based access requires. Enabling it is a stronger posture and would cut clawops off from this host."
+    };
+  },
+  async apply(_exec) {
+    return {
+      changed: false,
+      detail: "clawops will not enable OS Login: the instance would stop accepting the metadata key clawops connects with, and every day-two command would fail."
+    };
+  }
+};
+
+// src/harden/azure-api.ts
+var ARM = "https://management.azure.com";
+async function azureContext(signal) {
+  const subscriptionId = resolveSubscriptionId();
+  if (!subscriptionId) return void 0;
+  const token = await managementToken(signal);
+  return token ? { subscriptionId, token } : void 0;
+}
+async function armGet(ctx, pathAndQuery, signal) {
+  let res;
+  try {
+    res = await fetch(`${ARM}/subscriptions/${ctx.subscriptionId}${pathAndQuery}`, {
+      headers: { authorization: `Bearer ${ctx.token}` },
+      signal: signal ?? AbortSignal.timeout(2e4)
+    });
+  } catch {
+    return { ok: false, reason: "error" };
+  }
+  if (res.ok) return { ok: true, body: await res.json() };
+  if (res.status === 403) return { ok: false, reason: "forbidden" };
+  if (res.status === 404) {
+    const body = await res.text().catch(() => "");
+    if (/not registered/i.test(body)) {
+      const ns = /providers\/([^/?]+)/.exec(pathAndQuery)?.[1] ?? "the resource provider";
+      return { ok: false, reason: "unregistered", namespace: ns };
+    }
+  }
+  return { ok: false, reason: "error", status: res.status };
+}
+function explainFailure(f, subject, permission) {
+  if (f.reason === "unregistered") {
+    return `The ${f.namespace} resource provider is not registered on this subscription, so ${subject} could not be read. Register it with \`az provider register --namespace ${f.namespace}\`, which costs nothing and turns nothing on by itself.`;
+  }
+  if (f.reason === "forbidden") {
+    return `The identity is not allowed to read ${subject}. It needs ${permission}; nothing else clawops does requires it.`;
+  }
+  return `Could not read ${subject}${f.status ? ` (HTTP ${f.status})` : ""}.`;
+}
+async function providerRegistered(ctx, namespace, signal) {
+  const r = await armGet(
+    ctx,
+    `/providers/${namespace}?api-version=2021-04-01`,
+    signal
+  );
+  if (!r.ok) return void 0;
+  return (r.body.registrationState ?? "").toLowerCase() === "registered";
+}
+async function armGetById(ctx, id, apiVersion, signal) {
+  try {
+    const res = await fetch(`${ARM}${id}?api-version=${apiVersion}`, {
+      headers: { authorization: `Bearer ${ctx.token}` },
+      signal: signal ?? AbortSignal.timeout(2e4)
+    });
+    if (!res.ok) return void 0;
+    return await res.json();
+  } catch {
+    return void 0;
+  }
+}
+function isClawopsResource(name, prefix) {
+  return typeof name === "string" && name.startsWith(prefix);
+}
+async function findClawopsVm(ctx, signal) {
+  const r = await armGet(
+    ctx,
+    "/providers/Microsoft.Compute/virtualMachines?api-version=2023-09-01",
+    signal
+  );
+  if (!r.ok) return void 0;
+  return (r.body.value ?? []).find((vm) => isClawopsResource(vm.name, "clawops-vm"));
+}
+
+// src/harden/modules/azure-nsg-audit.ts
+var WORLD3 = /* @__PURE__ */ new Set(["*", "internet", "any", "0.0.0.0/0", "::/0"]);
+var NAMED_PORTS3 = {
+  "22": "SSH",
+  [String(GATEWAY_PORT)]: "the OpenClaw gateway"
+};
+function worldSources(rule) {
+  const p = rule.properties ?? {};
+  const all = [...p.sourceAddressPrefix ? [p.sourceAddressPrefix] : [], ...p.sourceAddressPrefixes ?? []];
+  return all.filter((s) => WORLD3.has(s.trim().toLowerCase()));
+}
+function describePorts2(rule) {
+  const p = rule.properties ?? {};
+  const ranges = [
+    ...p.destinationPortRange ? [p.destinationPortRange] : [],
+    ...p.destinationPortRanges ?? []
+  ];
+  if (ranges.length === 0) return "no ports";
+  const proto = (p.protocol ?? "*") === "*" ? "any protocol" : p.protocol;
+  const parts = ranges.map((r) => {
+    if (r === "*") return `every port on ${proto}`;
+    const named = NAMED_PORTS3[r];
+    if (named) return `port ${r} (${named})`;
+    return r.includes("-") ? `ports ${r}` : `port ${r}`;
+  });
+  return parts.join(", ");
+}
+function openFindings2(groups) {
+  const out = [];
+  for (const nsg of groups) {
+    if (!isClawopsResource(nsg.name, "clawops-nsg")) continue;
+    for (const rule of nsg.properties?.securityRules ?? []) {
+      const p = rule.properties ?? {};
+      if ((p.direction ?? "").toLowerCase() !== "inbound") continue;
+      if ((p.access ?? "").toLowerCase() !== "allow") continue;
+      const world = worldSources(rule);
+      if (world.length === 0) continue;
+      out.push(
+        `${nsg.name}/${rule.name ?? "unnamed rule"} admits ${world.join(" and ")} on ${describePorts2(rule)}`
+      );
+    }
+  }
+  return out;
+}
+var azureNsgAuditModule = {
+  id: "azure-nsg-audit",
+  label: "Azure NSG audit (check-only)",
+  defaultOn: true,
+  providers: ["azure"],
+  async check(_exec) {
+    const ctx = await azureContext();
+    if (!ctx) {
+      return {
+        status: "skipped",
+        detail: "No Azure credentials or subscription resolved, so the network security groups could not be read. This says nothing about the rules themselves."
+      };
+    }
+    const r = await armGet(
+      ctx,
+      "/providers/Microsoft.Network/networkSecurityGroups?api-version=2023-05-01"
+    );
+    if (!r.ok) {
+      return {
+        status: "skipped",
+        detail: explainFailure(r, "the network security groups", "Microsoft.Network/networkSecurityGroups/read") + " This says nothing about the rules themselves."
+      };
+    }
+    const findings = openFindings2(r.body.value ?? []);
+    return findings.length === 0 ? { status: "applied", detail: "No clawops NSG rule admits the internet in this subscription." } : { status: "drifted", detail: `Open to the internet: ${findings.join("; ")}.` };
+  },
+  async apply(_exec) {
+    return {
+      changed: false,
+      detail: "The NSG audit only reports. Narrow the rule in your plan with --ssh-cidr or --gateway-cidr and re-apply, so the change survives the next deploy."
+    };
+  }
+};
+
+// src/harden/modules/azure-disk-encryption.ts
+function posture(vm, disk) {
+  const type = disk?.properties?.encryption?.type ?? "";
+  return {
+    atRest: true,
+    customerKey: type.includes("CustomerKey"),
+    atHost: vm.properties?.securityProfile?.encryptionAtHost === true
+  };
+}
+function describe2(p) {
+  const gaps = [];
+  if (!p.atHost) gaps.push("encryption at host is off, so the temp disk and the OS disk cache are written to the host unencrypted");
+  if (!p.customerKey) gaps.push("the disk uses a platform-managed key rather than one of yours");
+  return gaps;
+}
+var azureDiskEncryptionModule = {
+  id: "azure-disk-encryption",
+  label: "Azure disk encryption check (check-only)",
+  defaultOn: true,
+  providers: ["azure"],
+  async check(_exec) {
+    const ctx = await azureContext();
+    if (!ctx) {
+      return {
+        status: "skipped",
+        detail: "No Azure credentials or subscription resolved, so the disk could not be read."
+      };
+    }
+    const vm = await findClawopsVm(ctx);
+    if (!vm) {
+      return {
+        status: "skipped",
+        detail: `No VM named clawops-vm found in ${ctx.subscriptionId}. Either the stack is not deployed there or the identity cannot list virtual machines.`
+      };
+    }
+    const diskId = vm.properties?.storageProfile?.osDisk?.managedDisk?.id;
+    const disk = diskId ? await armGetById(ctx, diskId, "2023-04-02") : void 0;
+    const gaps = describe2(posture(vm, disk));
+    return gaps.length === 0 ? {
+      status: "applied",
+      detail: "Encrypted at rest with a customer-managed key, and encryption at host is on."
+    } : {
+      status: "missing",
+      detail: `The OS disk is encrypted at rest, which Azure does for every managed disk. Beyond that: ${gaps.join("; ")}.`
+    };
+  },
+  async apply(_exec) {
+    return {
+      changed: false,
+      detail: "Encryption at host cannot be turned on while the VM is running, and moving to a customer-managed key means a disk encryption set and a Key Vault that outlive the stack. Both belong in the deploy rather than in a running host."
+    };
+  }
+};
+
+// src/harden/modules/azure-defender.ts
+var RELEVANT_PLANS = ["VirtualMachines", "KeyVaults"];
+function unprotectedPlans(pricings) {
+  const wanted = new Set(RELEVANT_PLANS);
+  return pricings.filter((p) => p.name && wanted.has(p.name)).filter((p) => (p.properties?.pricingTier ?? "Free").toLowerCase() !== "standard").map((p) => p.name);
+}
+var azureDefenderModule = {
+  id: "azure-defender",
+  label: "Azure Defender for Cloud check (check-only)",
+  defaultOn: true,
+  providers: ["azure"],
+  async check(_exec) {
+    const ctx = await azureContext();
+    if (!ctx) {
+      return {
+        status: "skipped",
+        detail: "No Azure credentials or subscription resolved, so Defender could not be read."
+      };
+    }
+    const r = await armGet(
+      ctx,
+      "/providers/Microsoft.Security/pricings?api-version=2023-01-01"
+    );
+    if (!r.ok) {
+      return {
+        status: "skipped",
+        detail: explainFailure(r, "Defender pricing", "Microsoft.Security/pricings/read")
+      };
+    }
+    const off = unprotectedPlans(r.body.value ?? []);
+    return off.length === 0 ? { status: "applied", detail: "Defender covers virtual machines and Key Vault on this subscription." } : {
+      status: "missing",
+      detail: `Defender is on the free tier for: ${off.join(", ")}. The free tier reports recommendations and does not protect anything.`
+    };
+  },
+  async apply(_exec) {
+    return {
+      changed: false,
+      detail: "Defender is billed per resource per month, so clawops will not turn it on for you. Enable it per plan in Defender for Cloud once you have priced it for this subscription."
+    };
+  }
+};
+
+// src/harden/modules/azure-jit.ts
+function resourceName(id) {
+  if (!id) return void 0;
+  const last = id.split("/").pop();
+  return last === "" ? void 0 : last;
+}
+function coversClawopsVm(policies) {
+  return policies.some(
+    (p) => (p.properties?.virtualMachines ?? []).some(
+      (vm) => isClawopsResource(resourceName(vm.id), "clawops-vm")
+    )
+  );
+}
+var azureJitModule = {
+  id: "azure-jit",
+  label: "Azure JIT VM access check (check-only)",
+  defaultOn: false,
+  providers: ["azure"],
+  async check(_exec) {
+    const ctx = await azureContext();
+    if (!ctx) {
+      return {
+        status: "skipped",
+        detail: "No Azure credentials or subscription resolved, so JIT policies could not be read."
+      };
+    }
+    const vm = await findClawopsVm(ctx);
+    if (!vm) {
+      return {
+        status: "skipped",
+        detail: `No VM named clawops-vm found in ${ctx.subscriptionId}, so there is nothing for a JIT policy to cover.`
+      };
+    }
+    const registered = await providerRegistered(ctx, "Microsoft.Security");
+    if (registered === false) {
+      return {
+        status: "skipped",
+        detail: "The Microsoft.Security resource provider is not registered on this subscription, so it has no Defender and therefore no JIT. Register it with `az provider register --namespace Microsoft.Security` if you want these checks to report."
+      };
+    }
+    const r = await armGet(
+      ctx,
+      "/providers/Microsoft.Security/jitNetworkAccessPolicies?api-version=2020-01-01"
+    );
+    if (!r.ok) {
+      return {
+        status: "skipped",
+        detail: explainFailure(r, "JIT policies", "Microsoft.Security/jitNetworkAccessPolicies/read") + " JIT also requires Defender for Servers Plan 2, which this subscription may not have."
+      };
+    }
+    return coversClawopsVm(r.body.value ?? []) ? { status: "applied", detail: "A JIT policy covers the clawops VM." } : {
+      status: "missing",
+      detail: "No JIT policy covers the clawops VM. SSH and the gateway stay open to whatever CIDRs the plan named, rather than opening per request."
+    };
+  },
+  async apply(_exec) {
+    return {
+      changed: false,
+      detail: "JIT needs Defender for Servers Plan 2, which is billed per VM per month, and it takes the NSG rules over from the plan that wrote them. Enable it in Defender for Cloud if you want it, and expect clawops plan to report the rules as drifted afterwards."
+    };
+  }
+};
+
 // src/harden/index.ts
 var MODULE_CATALOG = [
   // ON by default — common
@@ -763,7 +1281,18 @@ var MODULE_CATALOG = [
   awsSgAuditModule,
   awsSsmCheckModule,
   awsFlowLogsModule,
-  awsGuardDutyModule
+  awsGuardDutyModule,
+  // GCP-specific
+  gcpFirewallAuditModule,
+  gcpShieldedVmModule,
+  gcpOsLoginModule,
+  // Azure-specific
+  azureNsgAuditModule,
+  azureDiskEncryptionModule,
+  azureDefenderModule,
+  azureJitModule,
+  // Every provider, off by default
+  tailscaleModule
 ];
 export {
   MODULE_CATALOG,
@@ -773,15 +1302,24 @@ export {
   awsGuardDutyModule,
   awsSgAuditModule,
   awsSsmCheckModule,
+  azureDefenderModule,
+  azureDiskEncryptionModule,
+  azureJitModule,
+  azureNsgAuditModule,
   dockerSocketModule,
   fail2banModule,
   formatHardenSummary,
+  gcpFirewallAuditModule,
+  gcpOsLoginModule,
+  gcpShieldedVmModule,
   lynisModule,
+  makeTailscaleModule,
   makeUfwModule,
   resolveModules,
   runHardening,
   sshModule,
   sysctlModule,
+  tailscaleModule,
   ufwModule,
   unattendedUpgradesModule,
   withRemoteExec

package/dist/{mcp-wire-3SWBM7D6.js → mcp-wire-TE2ZL6HD.js}

@@ -1,21 +1,21 @@
 #!/usr/bin/env node
 import {
   MCP_HTTP_PORT
-} from "./chunk-KC3GC3PE.js";
-import "./chunk-LBE6COC4.js";
+} from "./chunk-AYUX4FOF.js";
+import "./chunk-R3DTA35B.js";
 import "./chunk-BOPSG2LI.js";
 import "./chunk-6ZFIFDBJ.js";
 import "./chunk-3QJBNAHW.js";
 import "./chunk-2I7KCMXZ.js";
-import "./chunk-HSPHXG6W.js";
+import "./chunk-3Z5TDXCJ.js";
 import "./chunk-AEEMRFZV.js";
-import "./chunk-STLRHLLV.js";
-import "./chunk-BSLIYB5Q.js";
+import "./chunk-A2DS5SB7.js";
+import "./chunk-XFN3YDZE.js";
 import "./chunk-2Z7J3ERQ.js";
 import "./chunk-E4NJSJ54.js";
 import "./chunk-MC5ATCXS.js";
-import "./chunk-5XT5IAJK.js";
-import "./chunk-IVWP4QUJ.js";
+import "./chunk-QDNFADJI.js";
+import "./chunk-GFUK6KDR.js";
 import "./chunk-NUL5F6YV.js";
 import "./chunk-3OLUJPCB.js";
 import {
@@ -23,7 +23,7 @@ import {
 } from "./chunk-NUDIHZEH.js";
 import "./chunk-JW5A7E3X.js";
 import "./chunk-LT4XMO5D.js";
-import "./chunk-LEVIW2PV.js";
+import "./chunk-BELTQGHT.js";
 import "./chunk-GIEVAGEK.js";
 import "./chunk-VOEJYRIK.js";
 import "./chunk-EI7CQQ7D.js";
@@ -31,8 +31,8 @@ import "./chunk-FEK7VJAY.js";
 import "./chunk-RHOWYIWT.js";
 import "./chunk-Q7NQY5HV.js";
 import "./chunk-N4WZLWJ4.js";
-import "./chunk-A2I76FTA.js";
-import "./chunk-CX5SL5HP.js";
+import "./chunk-ELU3XQEA.js";
+import "./chunk-64PONSA5.js";
 import "./chunk-KGXPLI7W.js";
 import "./chunk-VUFMZEIM.js";