@creatornader/agent-bridge 0.2.0 → 0.3.1

package/dist/chunk-NCO7RLBM.js

@@ -0,0 +1,146 @@
+#!/usr/bin/env node
+
+// src/private-path.ts
+import { chmodSync, existsSync, lstatSync, mkdirSync } from "fs";
+import { dirname, resolve } from "path";
+import { spawnSync } from "child_process";
+var PrivatePathError = class extends Error {
+};
+var defaults = {
+  platform: process.platform,
+  execute: (command, args, env) => spawnSync(command, args, {
+    encoding: "utf8",
+    windowsHide: true,
+    env
+  }),
+  inspect: (path) => lstatSync(path)
+};
+function windowsScript(kind, apply) {
+  const flags = kind === "directory" ? "[System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'" : "[System.Security.AccessControl.InheritanceFlags]::None";
+  const pathInfo = kind === "directory" ? "[System.IO.DirectoryInfo]::new($p)" : "[System.IO.FileInfo]::new($p)";
+  return [
+    "$p=$env:AGENT_BRIDGE_PRIVATE_PATH",
+    "$identity=[System.Security.Principal.WindowsIdentity]::GetCurrent()",
+    "$sid=$identity.User",
+    "$tokenOwner=$identity.Owner",
+    `$pathInfo=${pathInfo}`,
+    "$pathInfo.Refresh()",
+    "if(($pathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}",
+    `$flags=${flags}`,
+    "$sections=[System.Security.AccessControl.AccessControlSections]([System.Security.AccessControl.AccessControlSections]::Owner -bor [System.Security.AccessControl.AccessControlSections]::Access)",
+    "$before=$pathInfo.GetAccessControl($sections)",
+    "$beforeOwner=$before.GetOwner([System.Security.Principal.SecurityIdentifier])",
+    "$beforeMatchesUser=$false",
+    "$beforeMatchesToken=$false",
+    "if($null -ne $beforeOwner){$beforeMatchesUser=$beforeOwner.Equals($sid);if($null -ne $tokenOwner){$beforeMatchesToken=$beforeOwner.Equals($tokenOwner)}}",
+    'if(-not $beforeMatchesUser -and -not $beforeMatchesToken){Write-Output ("explicit owner present {0}; matches user {1}; matches token {2}" -f ($null -ne $beforeOwner),$beforeMatchesUser,$beforeMatchesToken);exit 24}',
+    ...apply ? [
+      "$acl=$before",
+      "$acl.SetAccessRuleProtection($true,$false)",
+      "$existingRules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))",
+      "foreach($existing in $existingRules){$acl.RemoveAccessRuleSpecific($existing)}",
+      "$acl.SetOwner($sid)",
+      "$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow)",
+      "$acl.AddAccessRule($rule)",
+      "$pathInfo.SetAccessControl($acl)"
+    ] : [],
+    `$checkPathInfo=${pathInfo}`,
+    "$checkPathInfo.Refresh()",
+    "if(($checkPathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}",
+    "$check=$checkPathInfo.GetAccessControl($sections)",
+    "$owner=$check.GetOwner([System.Security.Principal.SecurityIdentifier])",
+    "$ownerMatches=$false",
+    "if($null -ne $owner){$ownerMatches=$owner.Equals($sid)}",
+    "$rules=@($check.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))",
+    "$ruleMatches=$false",
+    "$ruleInherited=$true",
+    "$ruleAllow=$false",
+    "$rightsExact=$false",
+    "$inheritanceExact=$false",
+    "$propagationExact=$false",
+    "if($rules.Count -eq 1){$ruleSid=$rules[0].IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]);$ruleMatches=$ruleSid.Equals($sid);$ruleInherited=$rules[0].IsInherited;$ruleAllow=$rules[0].AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow;$rightsExact=$rules[0].FileSystemRights -eq [System.Security.AccessControl.FileSystemRights]::FullControl;$inheritanceExact=$rules[0].InheritanceFlags -eq $flags;$propagationExact=$rules[0].PropagationFlags -eq [System.Security.AccessControl.PropagationFlags]::None}",
+    'if(-not $ownerMatches -or -not $check.AreAccessRulesProtected -or $rules.Count -ne 1 -or -not $ruleMatches -or $ruleInherited -or -not $ruleAllow -or -not $rightsExact -or -not $inheritanceExact -or -not $propagationExact){Write-Output ("final owner {0}; protected {1}; rules {2}; sid {3}; inherited {4}; allow {5}; rights {6}; inheritance {7}; propagation {8}" -f $ownerMatches,$check.AreAccessRulesProtected,$rules.Count,$ruleMatches,$ruleInherited,$ruleAllow,$rightsExact,$inheritanceExact,$propagationExact);exit 23}'
+  ].join(";");
+}
+function windowsPrivatePath(path, kind, apply, dependencies) {
+  const before = dependencies.inspect(path);
+  if (before.isSymbolicLink() || (kind === "file" ? !before.isFile() : !before.isDirectory())) {
+    throw new PrivatePathError("private Windows paths cannot be symlinks, junctions, or reparse objects");
+  }
+  const result = dependencies.execute("powershell.exe", [
+    "-NoProfile",
+    "-NonInteractive",
+    "-Command",
+    windowsScript(kind, apply)
+  ], { ...process.env, AGENT_BRIDGE_PRIVATE_PATH: path });
+  if (result.status !== 0) {
+    const phase = result.status === 23 ? `final ACL verification failed${result.stdout.trim() ? ` (${result.stdout.trim()})` : ""}` : result.status === 24 ? `the existing owner is not trusted${result.stdout.trim() ? ` (${result.stdout.trim()})` : ""}` : result.status === 25 ? "the path is a reparse object" : "the native ACL command failed";
+    throw new PrivatePathError(`${apply ? "cannot apply" : "path does not satisfy"} the current-user private path policy: ${phase}`);
+  }
+  const after = dependencies.inspect(path);
+  if (after.isSymbolicLink() || (kind === "file" ? !after.isFile() : !after.isDirectory()) || after.dev !== before.dev || after.ino !== before.ino) {
+    throw new PrivatePathError("private Windows path identity changed during policy validation");
+  }
+}
+function posixPrivatePath(path, kind, apply) {
+  const details = lstatSync(path);
+  if (details.isSymbolicLink() || (kind === "file" ? !details.isFile() : !details.isDirectory())) {
+    throw new PrivatePathError("private path has the wrong file type");
+  }
+  if (typeof process.getuid === "function" && details.uid !== process.getuid()) {
+    throw new PrivatePathError("private path must be owned by the current user");
+  }
+  const mode = kind === "file" ? 384 : 448;
+  if (apply) chmodSync(path, mode);
+  const secured = lstatSync(path);
+  if ((secured.mode & 511) !== mode) {
+    throw new PrivatePathError("private path permissions are not owner-only");
+  }
+}
+function securePrivatePath(path, kind, dependencies = defaults) {
+  if (dependencies.platform === "win32") windowsPrivatePath(path, kind, true, dependencies);
+  else posixPrivatePath(path, kind, true);
+}
+function verifyPrivatePathAccess(path, kind, dependencies = defaults) {
+  if (dependencies.platform === "win32") windowsPrivatePath(path, kind, false, dependencies);
+  else posixPrivatePath(path, kind, false);
+}
+function preparePrivateFileLocation(path, createParent = false) {
+  const target = resolve(path);
+  const parent = dirname(target);
+  const parentExisted = existsSync(parent);
+  if (createParent && !parentExisted) mkdirSync(parent, { recursive: true, mode: 448 });
+  if (!existsSync(parent)) throw new PrivatePathError("private path parent does not exist");
+  if (!parentExisted) securePrivatePath(parent, "directory");
+  verifyPrivatePathAccess(parent, "directory");
+  if (existsSync(target)) verifyPrivatePathAccess(target, "file");
+  return target;
+}
+function securePrivateSqliteFiles(path) {
+  if (path === ":memory:") return;
+  const target = resolve(path);
+  verifyPrivatePathAccess(dirname(target), "directory");
+  for (const candidate of [target, `${target}-wal`, `${target}-shm`]) {
+    if (!existsSync(candidate)) continue;
+    securePrivatePath(candidate, "file");
+    verifyPrivatePathAccess(candidate, "file");
+  }
+}
+function preparePrivateSqliteLocation(path, createParent = false) {
+  if (path === ":memory:") return path;
+  const target = preparePrivateFileLocation(path, createParent);
+  for (const candidate of [`${target}-wal`, `${target}-shm`]) {
+    if (existsSync(candidate)) securePrivatePath(candidate, "file");
+  }
+  return target;
+}
+
+export {
+  PrivatePathError,
+  securePrivatePath,
+  verifyPrivatePathAccess,
+  preparePrivateFileLocation,
+  securePrivateSqliteFiles,
+  preparePrivateSqliteLocation
+};
+//# sourceMappingURL=chunk-NCO7RLBM.js.map

package/dist/chunk-NCO7RLBM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/private-path.ts"],"sourcesContent":["import { chmodSync, existsSync, lstatSync, mkdirSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { spawnSync, type SpawnSyncReturns } from \"node:child_process\";\n\nexport type PrivatePathKind = \"file\" | \"directory\";\n\nexport class PrivatePathError extends Error {}\n\ninterface PrivatePathDependencies {\n  platform: NodeJS.Platform;\n  execute(command: string, args: string[], env: NodeJS.ProcessEnv): SpawnSyncReturns<string>;\n  inspect(path: string): {\n    dev: number;\n    ino: number;\n    isSymbolicLink(): boolean;\n    isFile(): boolean;\n    isDirectory(): boolean;\n  };\n}\n\nconst defaults: PrivatePathDependencies = {\n  platform: process.platform,\n  execute: (command, args, env) => spawnSync(command, args, {\n    encoding: \"utf8\",\n    windowsHide: true,\n    env,\n  }),\n  inspect: (path) => lstatSync(path),\n};\n\nfunction windowsScript(kind: PrivatePathKind, apply: boolean): string {\n  const flags = kind === \"directory\"\n    ? \"[System.Security.AccessControl.InheritanceFlags]'ContainerInherit,ObjectInherit'\"\n    : \"[System.Security.AccessControl.InheritanceFlags]::None\";\n  const pathInfo = kind === \"directory\"\n    ? \"[System.IO.DirectoryInfo]::new($p)\"\n    : \"[System.IO.FileInfo]::new($p)\";\n  return [\n    \"$p=$env:AGENT_BRIDGE_PRIVATE_PATH\",\n    \"$identity=[System.Security.Principal.WindowsIdentity]::GetCurrent()\",\n    \"$sid=$identity.User\",\n    \"$tokenOwner=$identity.Owner\",\n    `$pathInfo=${pathInfo}`,\n    \"$pathInfo.Refresh()\",\n    \"if(($pathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}\",\n    `$flags=${flags}`,\n    \"$sections=[System.Security.AccessControl.AccessControlSections]([System.Security.AccessControl.AccessControlSections]::Owner -bor [System.Security.AccessControl.AccessControlSections]::Access)\",\n    \"$before=$pathInfo.GetAccessControl($sections)\",\n    \"$beforeOwner=$before.GetOwner([System.Security.Principal.SecurityIdentifier])\",\n    \"$beforeMatchesUser=$false\",\n    \"$beforeMatchesToken=$false\",\n    \"if($null -ne $beforeOwner){$beforeMatchesUser=$beforeOwner.Equals($sid);if($null -ne $tokenOwner){$beforeMatchesToken=$beforeOwner.Equals($tokenOwner)}}\",\n    \"if(-not $beforeMatchesUser -and -not $beforeMatchesToken){Write-Output (\\\"explicit owner present {0}; matches user {1}; matches token {2}\\\" -f ($null -ne $beforeOwner),$beforeMatchesUser,$beforeMatchesToken);exit 24}\",\n    ...(apply ? [\n      \"$acl=$before\",\n      \"$acl.SetAccessRuleProtection($true,$false)\",\n      \"$existingRules=@($acl.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))\",\n      \"foreach($existing in $existingRules){$acl.RemoveAccessRuleSpecific($existing)}\",\n      \"$acl.SetOwner($sid)\",\n      \"$rule=New-Object System.Security.AccessControl.FileSystemAccessRule($sid,'FullControl',$flags,[System.Security.AccessControl.PropagationFlags]::None,[System.Security.AccessControl.AccessControlType]::Allow)\",\n      \"$acl.AddAccessRule($rule)\",\n      \"$pathInfo.SetAccessControl($acl)\",\n    ] : []),\n    `$checkPathInfo=${pathInfo}`,\n    \"$checkPathInfo.Refresh()\",\n    \"if(($checkPathInfo.Attributes -band [System.IO.FileAttributes]::ReparsePoint) -ne 0){exit 25}\",\n    \"$check=$checkPathInfo.GetAccessControl($sections)\",\n    \"$owner=$check.GetOwner([System.Security.Principal.SecurityIdentifier])\",\n    \"$ownerMatches=$false\",\n    \"if($null -ne $owner){$ownerMatches=$owner.Equals($sid)}\",\n    \"$rules=@($check.GetAccessRules($true,$true,[System.Security.Principal.SecurityIdentifier]))\",\n    \"$ruleMatches=$false\",\n    \"$ruleInherited=$true\",\n    \"$ruleAllow=$false\",\n    \"$rightsExact=$false\",\n    \"$inheritanceExact=$false\",\n    \"$propagationExact=$false\",\n    \"if($rules.Count -eq 1){$ruleSid=$rules[0].IdentityReference.Translate([System.Security.Principal.SecurityIdentifier]);$ruleMatches=$ruleSid.Equals($sid);$ruleInherited=$rules[0].IsInherited;$ruleAllow=$rules[0].AccessControlType -eq [System.Security.AccessControl.AccessControlType]::Allow;$rightsExact=$rules[0].FileSystemRights -eq [System.Security.AccessControl.FileSystemRights]::FullControl;$inheritanceExact=$rules[0].InheritanceFlags -eq $flags;$propagationExact=$rules[0].PropagationFlags -eq [System.Security.AccessControl.PropagationFlags]::None}\",\n    \"if(-not $ownerMatches -or -not $check.AreAccessRulesProtected -or $rules.Count -ne 1 -or -not $ruleMatches -or $ruleInherited -or -not $ruleAllow -or -not $rightsExact -or -not $inheritanceExact -or -not $propagationExact){Write-Output (\\\"final owner {0}; protected {1}; rules {2}; sid {3}; inherited {4}; allow {5}; rights {6}; inheritance {7}; propagation {8}\\\" -f $ownerMatches,$check.AreAccessRulesProtected,$rules.Count,$ruleMatches,$ruleInherited,$ruleAllow,$rightsExact,$inheritanceExact,$propagationExact);exit 23}\",\n  ].join(\";\");\n}\n\nfunction windowsPrivatePath(\n  path: string,\n  kind: PrivatePathKind,\n  apply: boolean,\n  dependencies: PrivatePathDependencies,\n): void {\n  const before = dependencies.inspect(path);\n  if (before.isSymbolicLink()\n    || (kind === \"file\" ? !before.isFile() : !before.isDirectory())) {\n    throw new PrivatePathError(\"private Windows paths cannot be symlinks, junctions, or reparse objects\");\n  }\n  const result = dependencies.execute(\"powershell.exe\", [\n    \"-NoProfile\", \"-NonInteractive\", \"-Command\", windowsScript(kind, apply),\n  ], { ...process.env, AGENT_BRIDGE_PRIVATE_PATH: path });\n  if (result.status !== 0) {\n    const phase = result.status === 23\n      ? `final ACL verification failed${result.stdout.trim() ? ` (${result.stdout.trim()})` : \"\"}`\n      : result.status === 24\n        ? `the existing owner is not trusted${result.stdout.trim() ? ` (${result.stdout.trim()})` : \"\"}`\n        : result.status === 25\n          ? \"the path is a reparse object\"\n          : \"the native ACL command failed\";\n    throw new PrivatePathError(`${apply\n      ? \"cannot apply\"\n      : \"path does not satisfy\"} the current-user private path policy: ${phase}`);\n  }\n  const after = dependencies.inspect(path);\n  if (after.isSymbolicLink()\n    || (kind === \"file\" ? !after.isFile() : !after.isDirectory())\n    || after.dev !== before.dev || after.ino !== before.ino) {\n    throw new PrivatePathError(\"private Windows path identity changed during policy validation\");\n  }\n}\n\nfunction posixPrivatePath(path: string, kind: PrivatePathKind, apply: boolean): void {\n  const details = lstatSync(path);\n  if (details.isSymbolicLink()\n    || (kind === \"file\" ? !details.isFile() : !details.isDirectory())) {\n    throw new PrivatePathError(\"private path has the wrong file type\");\n  }\n  if (typeof process.getuid === \"function\" && details.uid !== process.getuid()) {\n    throw new PrivatePathError(\"private path must be owned by the current user\");\n  }\n  const mode = kind === \"file\" ? 0o600 : 0o700;\n  if (apply) chmodSync(path, mode);\n  const secured = lstatSync(path);\n  if ((secured.mode & 0o777) !== mode) {\n    throw new PrivatePathError(\"private path permissions are not owner-only\");\n  }\n}\n\nexport function securePrivatePath(\n  path: string,\n  kind: PrivatePathKind,\n  dependencies: PrivatePathDependencies = defaults,\n): void {\n  if (dependencies.platform === \"win32\") windowsPrivatePath(path, kind, true, dependencies);\n  else posixPrivatePath(path, kind, true);\n}\n\nexport function verifyPrivatePathAccess(\n  path: string,\n  kind: PrivatePathKind,\n  dependencies: PrivatePathDependencies = defaults,\n): void {\n  if (dependencies.platform === \"win32\") windowsPrivatePath(path, kind, false, dependencies);\n  else posixPrivatePath(path, kind, false);\n}\n\n/** Prepare an immediate parent and reject link-like file locations before use. */\nexport function preparePrivateFileLocation(path: string, createParent = false): string {\n  const target = resolve(path);\n  const parent = dirname(target);\n  const parentExisted = existsSync(parent);\n  if (createParent && !parentExisted) mkdirSync(parent, { recursive: true, mode: 0o700 });\n  if (!existsSync(parent)) throw new PrivatePathError(\"private path parent does not exist\");\n  if (!parentExisted) securePrivatePath(parent, \"directory\");\n  verifyPrivatePathAccess(parent, \"directory\");\n  if (existsSync(target)) verifyPrivatePathAccess(target, \"file\");\n  return target;\n}\n\n/** Apply and verify owner-only policy for a SQLite database and live sidecars. */\nexport function securePrivateSqliteFiles(path: string): void {\n  if (path === \":memory:\") return;\n  const target = resolve(path);\n  verifyPrivatePathAccess(dirname(target), \"directory\");\n  for (const candidate of [target, `${target}-wal`, `${target}-shm`]) {\n    if (!existsSync(candidate)) continue;\n    securePrivatePath(candidate, \"file\");\n    verifyPrivatePathAccess(candidate, \"file\");\n  }\n}\n\nexport function preparePrivateSqliteLocation(path: string, createParent = false): string {\n  if (path === \":memory:\") return path;\n  const target = preparePrivateFileLocation(path, createParent);\n  for (const candidate of [`${target}-wal`, `${target}-shm`]) {\n    if (existsSync(candidate)) securePrivatePath(candidate, \"file\");\n  }\n  return target;\n}\n"],"mappings":";;;AAAA,SAAS,WAAW,YAAY,WAAW,iBAAiB;AAC5D,SAAS,SAAS,eAAe;AACjC,SAAS,iBAAwC;AAI1C,IAAM,mBAAN,cAA+B,MAAM;AAAC;AAc7C,IAAM,WAAoC;AAAA,EACxC,UAAU,QAAQ;AAAA,EAClB,SAAS,CAAC,SAAS,MAAM,QAAQ,UAAU,SAAS,MAAM;AAAA,IACxD,UAAU;AAAA,IACV,aAAa;AAAA,IACb;AAAA,EACF,CAAC;AAAA,EACD,SAAS,CAAC,SAAS,UAAU,IAAI;AACnC;AAEA,SAAS,cAAc,MAAuB,OAAwB;AACpE,QAAM,QAAQ,SAAS,cACnB,qFACA;AACJ,QAAM,WAAW,SAAS,cACtB,uCACA;AACJ,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,aAAa,QAAQ;AAAA,IACrB;AAAA,IACA;AAAA,IACA,UAAU,KAAK;AAAA,IACf;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,GAAI,QAAQ;AAAA,MACV;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,IAAI,CAAC;AAAA,IACL,kBAAkB,QAAQ;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EAAE,KAAK,GAAG;AACZ;AAEA,SAAS,mBACP,MACA,MACA,OACA,cACM;AACN,QAAM,SAAS,aAAa,QAAQ,IAAI;AACxC,MAAI,OAAO,eAAe,MACpB,SAAS,SAAS,CAAC,OAAO,OAAO,IAAI,CAAC,OAAO,YAAY,IAAI;AACjE,UAAM,IAAI,iBAAiB,yEAAyE;AAAA,EACtG;AACA,QAAM,SAAS,aAAa,QAAQ,kBAAkB;AAAA,IACpD;AAAA,IAAc;AAAA,IAAmB;AAAA,IAAY,cAAc,MAAM,KAAK;AAAA,EACxE,GAAG,EAAE,GAAG,QAAQ,KAAK,2BAA2B,KAAK,CAAC;AACtD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,QAAQ,OAAO,WAAW,KAC5B,gCAAgC,OAAO,OAAO,KAAK,IAAI,KAAK,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,KACxF,OAAO,WAAW,KAChB,oCAAoC,OAAO,OAAO,KAAK,IAAI,KAAK,OAAO,OAAO,KAAK,CAAC,MAAM,EAAE,KAC5F,OAAO,WAAW,KAChB,iCACA;AACR,UAAM,IAAI,iBAAiB,GAAG,QAC1B,iBACA,uBAAuB,0CAA0C,KAAK,EAAE;AAAA,EAC9E;AACA,QAAM,QAAQ,aAAa,QAAQ,IAAI;AACvC,MAAI,MAAM,eAAe,MACnB,SAAS,SAAS,CAAC,MAAM,OAAO,IAAI,CAAC,MAAM,YAAY,MACxD,MAAM,QAAQ,OAAO,OAAO,MAAM,QAAQ,OAAO,KAAK;AACzD,UAAM,IAAI,iBAAiB,gEAAgE;AAAA,EAC7F;AACF;AAEA,SAAS,iBAAiB,MAAc,MAAuB,OAAsB;AACnF,QAAM,UAAU,UAAU,IAAI;AAC9B,MAAI,QAAQ,eAAe,MACrB,SAAS,SAAS,CAAC,QAAQ,OAAO,IAAI,CAAC,QAAQ,YAAY,IAAI;AACnE,UAAM,IAAI,iBAAiB,sCAAsC;AAAA,EACnE;AACA,MAAI,OAAO,QAAQ,WAAW,cAAc,QAAQ,QAAQ,QAAQ,OAAO,GAAG;AAC5E,UAAM,IAAI,iBAAiB,gDAAgD;AAAA,EAC7E;AACA,QAAM,OAAO,SAAS,SAAS,MAAQ;AACvC,MAAI,MAAO,WAAU,MAAM,IAAI;AAC/B,QAAM,UAAU,UAAU,IAAI;AAC9B,OAAK,QAAQ,OAAO,SAAW,MAAM;AACnC,UAAM,IAAI,iBAAiB,6CAA6C;AAAA,EAC1E;AACF;AAEO,SAAS,kBACd,MACA,MACA,eAAwC,UAClC;AACN,MAAI,aAAa,aAAa,QAAS,oBAAmB,MAAM,MAAM,MAAM,YAAY;AAAA,MACnF,kBAAiB,MAAM,MAAM,IAAI;AACxC;AAEO,SAAS,wBACd,MACA,MACA,eAAwC,UAClC;AACN,MAAI,aAAa,aAAa,QAAS,oBAAmB,MAAM,MAAM,OAAO,YAAY;AAAA,MACpF,kBAAiB,MAAM,MAAM,KAAK;AACzC;AAGO,SAAS,2BAA2B,MAAc,eAAe,OAAe;AACrF,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,SAAS,QAAQ,MAAM;AAC7B,QAAM,gBAAgB,WAAW,MAAM;AACvC,MAAI,gBAAgB,CAAC,cAAe,WAAU,QAAQ,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACtF,MAAI,CAAC,WAAW,MAAM,EAAG,OAAM,IAAI,iBAAiB,oCAAoC;AACxF,MAAI,CAAC,cAAe,mBAAkB,QAAQ,WAAW;AACzD,0BAAwB,QAAQ,WAAW;AAC3C,MAAI,WAAW,MAAM,EAAG,yBAAwB,QAAQ,MAAM;AAC9D,SAAO;AACT;AAGO,SAAS,yBAAyB,MAAoB;AAC3D,MAAI,SAAS,WAAY;AACzB,QAAM,SAAS,QAAQ,IAAI;AAC3B,0BAAwB,QAAQ,MAAM,GAAG,WAAW;AACpD,aAAW,aAAa,CAAC,QAAQ,GAAG,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG;AAClE,QAAI,CAAC,WAAW,SAAS,EAAG;AAC5B,sBAAkB,WAAW,MAAM;AACnC,4BAAwB,WAAW,MAAM;AAAA,EAC3C;AACF;AAEO,SAAS,6BAA6B,MAAc,eAAe,OAAe;AACvF,MAAI,SAAS,WAAY,QAAO;AAChC,QAAM,SAAS,2BAA2B,MAAM,YAAY;AAC5D,aAAW,aAAa,CAAC,GAAG,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG;AAC1D,QAAI,WAAW,SAAS,EAAG,mBAAkB,WAAW,MAAM;AAAA,EAChE;AACA,SAAO;AACT;","names":[]}