@datasynx/agentic-ai-cartography 2.0.0 → 2.2.0

package/llms.txt

@@ -0,0 +1,24 @@
+# @datasynx/agentic-ai-cartography
+
+> MCP-first infrastructure & agentic-AI cartography — install once, every AI agent knows your system landscape. Read-only discovery exposed over the Model Context Protocol.
+
+Cartography discovers your services, databases, SaaS tools and dependencies
+(read-only, deterministic) and exposes the topology over the Model Context
+Protocol. Install once and any MCP host or agent framework can query it.
+
+## Getting started
+
+- [Quickstart](https://datasynx.github.io/agentic-ai-cartography/#quickstart): From zero to an agent that knows your system.
+- [Install into a client](https://datasynx.github.io/agentic-ai-cartography/#install): Write the MCP config for any supported host.
+
+## Reference
+
+- [MCP tools & resources](https://datasynx.github.io/agentic-ai-cartography/#tools): Resources, tools and prompts the server exposes.
+- [CLI](https://datasynx.github.io/agentic-ai-cartography/#cli): datasynx-cartography commands and flags.
+- [Supported clients](https://datasynx.github.io/agentic-ai-cartography/#clients): The host install matrix.
+- [Non-MCP frameworks](https://datasynx.github.io/agentic-ai-cartography/#adapters): LangGraph, CrewAI, Vercel AI SDK and more.
+
+## Explanation
+
+- [Why MCP-first](https://datasynx.github.io/agentic-ai-cartography/#architecture): The design rationale.
+- [Threat model](https://github.com/datasynx/agentic-ai-cartography/blob/main/docs/explanation/threat-model.md): Attacker model, trust boundaries and mitigations.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@datasynx/agentic-ai-cartography",
-  "version": "2.0.0",
+  "version": "2.2.0",
   "description": "MCP-first infrastructure & agentic-AI cartography — install once, every AI agent knows your system landscape. Read-only discovery exposed over the Model Context Protocol.",
   "type": "module",
   "sideEffects": false,
@@ -30,19 +30,25 @@
     "scripts",
     "server.json",
     "README.md",
-    "LICENSE"
+    "AGENTS.md",
+    "LICENSE",
+    "llms.txt",
+    "llms-full.txt"
   ],
   "scripts": {
     "build": "tsup",
+    "build:mcpb": "node scripts/build-mcpb.mjs",
     "dev": "tsx src/cli.ts",
     "test": "vitest run",
     "test:watch": "vitest",
     "test:coverage": "vitest run --coverage",
+    "docs:llms": "node scripts/build-llms.mjs",
+    "docs:tables": "tsx scripts/gen-docs.ts",
+    "docs:build": "npm run docs:tables && npm run docs:llms",
     "lint": "tsc --noEmit",
     "typecheck": "tsc --noEmit",
     "release": "semantic-release",
-    "prepublishOnly": "npm run lint && npm run test && npm run build",
-    "postinstall": "node scripts/postinstall.mjs"
+    "prepublishOnly": "npm run lint && npm run test && npm run build"
   },
   "engines": {
     "node": ">=20.0.0"
@@ -81,20 +87,29 @@
     "provenance": true
   },
   "license": "MIT",
+  "overrides": {
+    "tmp": "^0.2.7",
+    "hono": "^4.12.25"
+  },
   "dependencies": {
     "@modelcontextprotocol/sdk": "^1.29.0",
-    "better-sqlite3": "^12.6.0",
+    "better-sqlite3": "^12.10.0",
     "commander": "^14.0.0",
-    "zod": "^4.3.6"
+    "smol-toml": "^1.6.1",
+    "yaml": "^2.9.0",
+    "zod": "^4.4.3"
   },
   "optionalDependencies": {
-    "@anthropic-ai/claude-agent-sdk": "^0.2.59",
-    "@anthropic-ai/sdk": "^0.78.0",
+    "@anthropic-ai/claude-agent-sdk": ">=0.2.70 <0.4.0",
+    "@anthropic-ai/sdk": "^0.104.0",
     "@huggingface/transformers": "^4.2.0",
+    "openai": "^4.104.0",
     "sqlite-vec": "^0.1.9"
   },
   "devDependencies": {
+    "@anthropic-ai/mcpb": "^2.1.2",
     "@arethetypeswrong/cli": "^0.18.2",
+    "ajv": "^8.20.0",
     "@semantic-release/changelog": "^6.0.3",
     "@semantic-release/git": "^10.0.1",
     "@semantic-release/github": "^11.0.1",

package/scripts/build-llms.mjs

@@ -0,0 +1,89 @@
+#!/usr/bin/env node
+/**
+ * Generate llms.txt (a curated, LLM-friendly navigation map) and llms-full.txt
+ * (the full documentation text in one file) from the docs/ sources, per the
+ * llmstxt.org convention. Canonical output lives at the repo root so the files
+ * ship in the npm package and are agent-discoverable; `docs:build` also copies
+ * them into docs/public so the site serves them at its domain root.
+ *
+ * Run via `npm run docs:llms`. Kept in lockstep with the docs by a drift test.
+ */
+
+import { readFileSync, writeFileSync, mkdirSync, copyFileSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const SITE = 'https://datasynx.github.io/agentic-ai-cartography';
+
+/** Curated documentation index. Links point to anchors on the single-page site. */
+const SECTIONS = [
+  {
+    heading: 'Getting started',
+    pages: [
+      { file: 'docs/tutorials/index.md', url: `${SITE}/#quickstart`, title: 'Quickstart', desc: 'From zero to an agent that knows your system.' },
+      { file: 'docs/how-to/install.md', url: `${SITE}/#install`, title: 'Install into a client', desc: 'Write the MCP config for any supported host.' },
+    ],
+  },
+  {
+    heading: 'Reference',
+    pages: [
+      { file: 'docs/reference/mcp.md', url: `${SITE}/#tools`, title: 'MCP tools & resources', desc: 'Resources, tools and prompts the server exposes.' },
+      { file: 'docs/reference/cli.md', url: `${SITE}/#cli`, title: 'CLI', desc: 'datasynx-cartography commands and flags.' },
+      { file: 'docs/reference/clients.md', url: `${SITE}/#clients`, title: 'Supported clients', desc: 'The host install matrix.' },
+      { file: 'docs/adapters.md', url: `${SITE}/#adapters`, title: 'Non-MCP frameworks', desc: 'LangGraph, CrewAI, Vercel AI SDK and more.' },
+    ],
+  },
+  {
+    heading: 'Explanation',
+    pages: [
+      { file: 'docs/explanation/index.md', url: `${SITE}/#architecture`, title: 'Why MCP-first', desc: 'The design rationale.' },
+      { file: 'docs/explanation/threat-model.md', url: 'https://github.com/datasynx/agentic-ai-cartography/blob/main/docs/explanation/threat-model.md', title: 'Threat model', desc: 'Attacker model, trust boundaries and mitigations.' },
+    ],
+  },
+];
+
+const stripFrontmatter = (s) => s.replace(/^---\n[\s\S]*?\n---\n/, '');
+
+/** Pure: build both files' contents from the docs sources. Side-effect free. */
+export function generate() {
+  const pkg = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8'));
+  const SUMMARY = pkg.description;
+
+  const llms = [`# ${pkg.name}`, '', `> ${SUMMARY}`, ''];
+  llms.push(
+    'Cartography discovers your services, databases, SaaS tools and dependencies',
+    '(read-only, deterministic) and exposes the topology over the Model Context',
+    'Protocol. Install once and any MCP host or agent framework can query it.',
+    '',
+  );
+  for (const section of SECTIONS) {
+    llms.push(`## ${section.heading}`, '');
+    for (const p of section.pages) llms.push(`- [${p.title}](${p.url}): ${p.desc}`);
+    llms.push('');
+  }
+  const llmsTxt = llms.join('\n');
+
+  const full = [`# ${pkg.name} — full documentation`, '', `> ${SUMMARY}`, ''];
+  for (const section of SECTIONS) {
+    for (const p of section.pages) {
+      full.push('', '---', '', `<!-- source: ${p.file} -->`, '', stripFrontmatter(readFileSync(resolve(root, p.file), 'utf8')).trim(), '');
+    }
+  }
+  const llmsFullTxt = full.join('\n') + '\n';
+  return { llmsTxt, llmsFullTxt };
+}
+
+/** Write the canonical root files and mirror them into docs/ so Pages serves them at its root. */
+export function write() {
+  const { llmsTxt, llmsFullTxt } = generate();
+  writeFileSync(resolve(root, 'llms.txt'), llmsTxt);
+  writeFileSync(resolve(root, 'llms-full.txt'), llmsFullTxt);
+  copyFileSync(resolve(root, 'llms.txt'), resolve(root, 'docs', 'llms.txt'));
+  copyFileSync(resolve(root, 'llms-full.txt'), resolve(root, 'docs', 'llms-full.txt'));
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  write();
+  console.log('✓ Wrote llms.txt and llms-full.txt (+ docs/public mirror)');
+}

package/scripts/build-mcpb.mjs

@@ -0,0 +1,31 @@
+#!/usr/bin/env node
+/**
+ * Build the Claude Desktop one-click bundle: keep `mcpb/manifest.json` in sync
+ * with package.json's version, then pack `mcpb/` into `dist/cartography.mcpb`
+ * using the official @anthropic-ai/mcpb CLI.
+ */
+
+import { readFileSync, writeFileSync, mkdirSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { dirname, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const pkg = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8'));
+const manifestPath = resolve(root, 'mcpb', 'manifest.json');
+const manifest = JSON.parse(readFileSync(manifestPath, 'utf8'));
+
+// Single source of truth: the npm version drives the manifest version.
+if (manifest.version !== pkg.version) {
+  manifest.version = pkg.version;
+  writeFileSync(manifestPath, JSON.stringify(manifest, null, 2) + '\n');
+  console.log(`Synced manifest version → ${pkg.version}`);
+}
+
+mkdirSync(resolve(root, 'dist'), { recursive: true });
+const out = resolve(root, 'dist', 'cartography.mcpb');
+
+const npx = process.platform === 'win32' ? 'npx.cmd' : 'npx';
+execFileSync(npx, ['mcpb', 'validate', manifestPath], { stdio: 'inherit', cwd: root });
+execFileSync(npx, ['mcpb', 'pack', resolve(root, 'mcpb'), out], { stdio: 'inherit', cwd: root });
+console.log(`\n✓ Wrote ${out}`);

package/scripts/gen-docs.ts

@@ -0,0 +1,123 @@
+/**
+ * Regenerate the auto-generated documentation blocks from the single source of
+ * truth (the code), so the tool table and client matrix can never drift:
+ *
+ *  - docs/reference/mcp.md      → AUTO-GENERATED:tools       (live MCP tool list)
+ *  - docs/reference/clients.md  → AUTO-GENERATED:clients     (registry matrix)
+ *                               → AUTO-GENERATED:quickstarts (per-host config block)
+ *  - AGENTS.md                  → the standard config block for agent context
+ *
+ * Run via `npm run docs:tables`. Guarded against drift by a test.
+ */
+
+import { readFileSync, writeFileSync } from 'node:fs';
+import { resolve } from 'node:path';
+import { Client } from '@modelcontextprotocol/sdk/client/index.js';
+import { InMemoryTransport } from '@modelcontextprotocol/sdk/inMemory.js';
+import { createMcpServer } from '../src/mcp/server.js';
+import { CartographyDB } from '../src/db.js';
+import { defaultConfig } from '../src/types.js';
+import { listClients, getClient, planInstall, defaultServerEntry } from '../src/installer/index.js';
+import type { ResolveContext } from '../src/installer/index.js';
+
+const root = resolve(import.meta.dirname, '..');
+
+function replaceBlock(content: string, name: string, body: string): string {
+  const re = new RegExp(`(<!-- AUTO-GENERATED:${name} START[^\\n]*-->\\n)[\\s\\S]*?(<!-- AUTO-GENERATED:${name} END -->)`);
+  if (!re.test(content)) throw new Error(`marker ${name} not found`);
+  return content.replace(re, `$1${body}\n$2`);
+}
+
+/** Live tool list from the running MCP server (single source of truth). */
+async function toolTable(): Promise<string> {
+  const db = new CartographyDB(':memory:');
+  db.createSession('discover', defaultConfig());
+  const server = createMcpServer({ db, discovery: async () => ({ nodes: 0, edges: 0 }) });
+  const [ct, st] = InMemoryTransport.createLinkedPair();
+  const client = new Client({ name: 'gen-docs', version: '1.0.0' });
+  await Promise.all([client.connect(ct), server.connect(st)]);
+  const { tools } = await client.listTools();
+  await client.close();
+  db.close();
+  const rows = tools
+    .sort((a, b) => a.name.localeCompare(b.name))
+    .map((t) => `| \`${t.name}\` | ${t.annotations?.readOnlyHint ? '✅' : '—'} | ${(t.description ?? '').split('\n')[0]} |`);
+  return ['| Tool | Read-only | Description |', '| --- | --- | --- |', ...rows].join('\n');
+}
+
+function clientMatrix(): string {
+  const rows = listClients().map((c) => `| \`${c.id}\` | ${c.label} | ${c.format} | ${c.note ?? ''} |`);
+  return ['| id | Host | Format | Notes |', '| --- | --- | --- | --- |', ...rows].join('\n');
+}
+
+function quickstarts(): string {
+  const ctx: ResolveContext = { scope: 'global', os: 'linux', home: '~', cwd: '.', env: {} };
+  const entry = defaultServerEntry();
+  const out: string[] = [];
+  for (const c of listClients()) {
+    const spec = getClient(c.id)!;
+    const plan = planInstall(spec, ctx, { entry });
+    const lang = plan.format === 'json' ? 'json' : plan.format;
+    out.push(`### ${c.label} (\`${c.id}\`)`, '', `\`${plan.path}\``, '', '```' + lang, plan.after.trim(), '```', '');
+  }
+  return out.join('\n');
+}
+
+function agentsMd(): string {
+  const entry = defaultServerEntry();
+  const block = JSON.stringify({ mcpServers: { cartography: { command: entry.command, args: entry.args } } }, null, 2);
+  return `# Working with Cartography
+
+This project can use **Cartography** — an MCP server that maps the system landscape
+(services, datastores, SaaS tools, dependencies) read-only.
+
+## Enable it
+
+\`\`\`json
+${block}
+\`\`\`
+
+Or run \`datasynx-cartography install --client <id>\` (see \`list-clients\`).
+
+## Use it
+
+- Read \`cartography://graph/summary\` first — a low-token overview.
+- Then drill in with \`query_infrastructure\`, \`get_dependencies\`, \`get_node\`.
+- All tools are read-only; run \`run_discovery\` to (re)scan the local system.
+
+<!-- Generated by \`npm run docs:tables\`; edit scripts/gen-docs.ts, not this file. -->
+`;
+}
+
+export interface GeneratedDocs {
+  mcpPath: string;
+  mcp: string;
+  clientsPath: string;
+  clients: string;
+  agentsPath: string;
+  agents: string;
+}
+
+/** Pure: compute the regenerated file contents from the current sources. */
+export async function buildDocs(): Promise<GeneratedDocs> {
+  const mcpPath = resolve(root, 'docs/reference/mcp.md');
+  const mcp = replaceBlock(readFileSync(mcpPath, 'utf8'), 'tools', await toolTable());
+
+  const clientsPath = resolve(root, 'docs/reference/clients.md');
+  let clients = readFileSync(clientsPath, 'utf8');
+  clients = replaceBlock(clients, 'clients', clientMatrix());
+  clients = replaceBlock(clients, 'quickstarts', quickstarts());
+
+  return { mcpPath, mcp, clientsPath, clients, agentsPath: resolve(root, 'AGENTS.md'), agents: agentsMd() };
+}
+
+export async function generateDocs(): Promise<void> {
+  const d = await buildDocs();
+  writeFileSync(d.mcpPath, d.mcp);
+  writeFileSync(d.clientsPath, d.clients);
+  writeFileSync(d.agentsPath, d.agents);
+}
+
+if (import.meta.url === `file://${process.argv[1]}`) {
+  generateDocs().then(() => console.log('✓ Regenerated tool table, client matrix, quickstarts, AGENTS.md'));
+}

package/scripts/validate-server-json.mjs

@@ -0,0 +1,54 @@
+#!/usr/bin/env node
+// Validate server.json before it ships:
+//   (1) version parity with package.json            [hard fail]
+//   (2) required-field structure                    [hard fail]
+//   (3) JSON-schema validation against $schema       [hard on real violations,
+//       warn-and-skip on network/$ref errors so CI never flakes]
+// Authoritative schema validation also runs at publish time via mcp-publisher
+// (.github/workflows/mcp-publish.yml).
+
+import { readFileSync } from 'node:fs';
+import { resolve, dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const root = resolve(dirname(fileURLToPath(import.meta.url)), '..');
+const pkg = JSON.parse(readFileSync(resolve(root, 'package.json'), 'utf8'));
+const server = JSON.parse(readFileSync(resolve(root, 'server.json'), 'utf8'));
+
+const fail = (m) => { console.error(`::error::${m}`); process.exitCode = 1; };
+
+// (1) version parity
+if (server.version !== pkg.version) {
+  fail(`server.json version (${server.version}) != package.json version (${pkg.version})`);
+}
+
+// (2) required structure
+for (const key of ['$schema', 'name', 'version', 'packages']) {
+  if (server[key] === undefined) fail(`server.json missing required field: ${key}`);
+}
+if (Array.isArray(server.packages)) {
+  server.packages.forEach((p, i) => {
+    for (const k of ['identifier', 'version', 'transport']) {
+      if (p[k] === undefined) fail(`server.json packages[${i}] missing: ${k}`);
+    }
+  });
+} else if (server.packages !== undefined) {
+  fail('server.json packages must be an array');
+}
+
+// (3) best-effort schema validation
+try {
+  const { default: Ajv } = await import('ajv');
+  const res = await fetch(server.$schema, { signal: AbortSignal.timeout(10_000) });
+  if (!res.ok) throw new Error(`schema fetch ${res.status}`);
+  const schema = await res.json();
+  const ajv = new Ajv({ strict: false, allErrors: true, validateFormats: false });
+  const validate = ajv.compile(schema);
+  if (!validate(server)) {
+    for (const e of validate.errors ?? []) fail(`schema: ${e.instancePath || '/'} ${e.message}`);
+  }
+} catch (err) {
+  console.warn(`::warning::Skipped remote schema validation (${err instanceof Error ? err.message : String(err)}); parity + structure checks still enforced.`);
+}
+
+if (!process.exitCode) console.log(`server.json OK — version parity + structure (${pkg.version})`);

package/server.json

@@ -1,8 +1,8 @@
 {
-  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-09-08/server.schema.json",
+  "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.datasynx/cartography",
-  "description": "MCP-first infrastructure & agentic-AI cartography — read-only discovery of your system landscape (services, databases, SaaS tools, dependencies) exposed as MCP resources, tools and prompts.",
-  "version": "2.0.0",
+  "description": "MCP-first read-only discovery of your infra & SaaS landscape as MCP resources, tools and prompts.",
+  "version": "2.2.0",
   "repository": {
     "url": "https://github.com/datasynx/agentic-ai-cartography",
     "source": "github"
@@ -12,7 +12,7 @@
       "registryType": "npm",
       "registryBaseUrl": "https://registry.npmjs.org",
       "identifier": "@datasynx/agentic-ai-cartography",
-      "version": "2.0.0",
+      "version": "2.2.0",
       "runtimeHint": "npx",
       "transport": { "type": "stdio" },
       "runtimeArguments": [

package/dist/chunk-CJ2PITFA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/bookmarks.ts","../src/platform.ts","../src/allowlist.ts","../src/logger.ts"],"sourcesContent":["import { tmpdir } from 'node:os';\nimport { existsSync, readFileSync, readdirSync, copyFileSync, statSync, unlinkSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { HOME, IS_WIN, IS_MAC, browserBasePaths, firefoxBaseDirs } from './platform.js';\n\n/**\n * Remove orphaned temp files from previous bookmark/history scans.\n * Call at startup to prevent /tmp accumulation after crashes.\n */\nexport function cleanupTempFiles(): number {\n  let cleaned = 0;\n  const tmp = tmpdir();\n  try {\n    for (const f of readdirSync(tmp)) {\n      if (f.startsWith('cartograph_') && f.endsWith('.sqlite')) {\n        try {\n          unlinkSync(join(tmp, f));\n          cleaned++;\n        } catch { /* file in use or already gone */ }\n      }\n    }\n  } catch { /* tmpdir not readable */ }\n  return cleaned;\n}\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n\nexport interface BookmarkHost {\n  hostname: string;\n  port: number;\n  protocol: 'http' | 'https';\n  source: string;\n}\n\nexport interface HistoryHost extends BookmarkHost {\n  visitCount: number;\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nexport function extractHost(rawUrl: string, source: string): BookmarkHost | null {\n  try {\n    const u = new URL(rawUrl);\n    if (u.protocol !== 'http:' && u.protocol !== 'https:') return null;\n    const protocol = u.protocol === 'https:' ? 'https' as const : 'http' as const;\n    // Strip: no paths, no params, no credentials — hostname only\n    const port = u.port ? parseInt(u.port, 10) : (protocol === 'https' ? 443 : 80);\n    const hostname = u.hostname.toLowerCase();\n    if (!hostname || hostname === 'localhost' || hostname === '127.0.0.1') return null;\n    return { hostname, port, protocol, source };\n  } catch {\n    return null;\n  }\n}\n\n// Chrome/Edge/Brave JSON format\nexport interface ChromeNode {\n  type?: string;\n  url?: string;\n  children?: ChromeNode[];\n}\n\nexport function walkChrome(node: ChromeNode, source: string, out: BookmarkHost[]): void {\n  if (node.type === 'url' && node.url) {\n    const h = extractHost(node.url, source);\n    if (h) out.push(h);\n  }\n  if (node.children) {\n    for (const child of node.children) walkChrome(child, source, out);\n  }\n}\n\nexport function readChromeLike(filePath: string, source: string): BookmarkHost[] {\n  if (!existsSync(filePath)) return [];\n  try {\n    const raw = JSON.parse(readFileSync(filePath, 'utf8')) as {\n      roots: Record<string, ChromeNode>;\n    };\n    const out: BookmarkHost[] = [];\n    for (const root of Object.values(raw.roots)) {\n      if (root) walkChrome(root, source, out);\n    }\n    return out;\n  } catch {\n    return [];\n  }\n}\n\nasync function queryBrowserDb<T>(srcPath: string, tmpPrefix: string, query: string): Promise<T[]> {\n  if (!existsSync(srcPath)) return [];\n  const tmp = join(tmpdir(), `cartograph_${tmpPrefix}_${Date.now()}.sqlite`);\n  try {\n    copyFileSync(srcPath, tmp);\n    const { default: Database } = await import('better-sqlite3');\n    const db = new Database(tmp, { readonly: true, fileMustExist: true });\n    try {\n      return db.prepare(query).all() as T[];\n    } finally {\n      db.close();\n    }\n  } catch {\n    return [];\n  } finally {\n    try { unlinkSync(tmp); } catch { /* ignore */ }\n  }\n}\n\nasync function readFirefoxBookmarks(profileDir: string): Promise<BookmarkHost[]> {\n  const rows = await queryBrowserDb<{ url: string }>(\n    join(profileDir, 'places.sqlite'), 'ff_bm',\n    `SELECT DISTINCT p.url FROM moz_places p\n     JOIN moz_bookmarks b ON b.fk = p.id\n     WHERE b.type = 1 AND p.url NOT LIKE 'place:%' LIMIT 3000`,\n  );\n  return rows.map(r => extractHost(r.url, 'firefox')).filter((h): h is BookmarkHost => h !== null);\n}\n\nexport async function readFirefoxHistory(profileDir: string): Promise<HistoryHost[]> {\n  const rows = await queryBrowserDb<{ url: string; visit_count: number }>(\n    join(profileDir, 'places.sqlite'), 'ff_hist',\n    `SELECT url, visit_count FROM moz_places\n     WHERE url NOT LIKE 'place:%' AND visit_count > 0\n     ORDER BY visit_count DESC LIMIT 5000`,\n  );\n  return rows\n    .map(r => {\n      const h = extractHost(r.url, 'firefox');\n      return h ? { ...h, visitCount: r.visit_count } : null;\n    })\n    .filter((h): h is HistoryHost => h !== null);\n}\n\nasync function readChromiumHistory(historyPath: string, source: string): Promise<HistoryHost[]> {\n  const rows = await queryBrowserDb<{ url: string; visit_count: number }>(\n    historyPath, 'ch_hist',\n    `SELECT url, visit_count FROM urls\n     WHERE hidden = 0 AND visit_count > 0\n     ORDER BY visit_count DESC LIMIT 5000`,\n  );\n  return rows\n    .map(r => {\n      const h = extractHost(r.url, source);\n      return h ? { ...h, visitCount: r.visit_count } : null;\n    })\n    .filter((h): h is HistoryHost => h !== null);\n}\n\n// ── Platform paths ────────────────────────────────────────────────────────────\n// Uses centralized platform.ts for Linux/macOS/Windows browser base paths.\n\nconst IS_LINUX = !IS_MAC && !IS_WIN;\n\n// Browser bookmark file paths (multiple profiles supported)\nexport function chromeLikePaths(base: string): string[] {\n  const paths: string[] = [];\n  const defaultPath = join(base, 'Default', 'Bookmarks');\n  if (existsSync(defaultPath)) paths.push(defaultPath);\n  // Also check Profile 1, Profile 2, etc.\n  if (existsSync(base)) {\n    try {\n      for (const entry of readdirSync(base)) {\n        if (entry.startsWith('Profile ')) {\n          const p = join(base, entry, 'Bookmarks');\n          if (existsSync(p)) paths.push(p);\n        }\n      }\n    } catch { /* ignore */ }\n  }\n  return paths;\n}\n\nexport function chromeLikeHistoryPaths(base: string): string[] {\n  const paths: string[] = [];\n  const defaultPath = join(base, 'Default', 'History');\n  if (existsSync(defaultPath)) paths.push(defaultPath);\n  if (existsSync(base)) {\n    try {\n      for (const entry of readdirSync(base)) {\n        if (entry.startsWith('Profile ')) {\n          const p = join(base, entry, 'History');\n          if (existsSync(p)) paths.push(p);\n        }\n      }\n    } catch { /* ignore */ }\n  }\n  return paths;\n}\n\n// Get browser bases from centralized platform module\nconst BROWSER_BASES = browserBasePaths();\n\nconst CHROME_BASE = BROWSER_BASES.chrome;\nconst CHROMIUM_BASE = BROWSER_BASES.chromium;\nconst EDGE_BASE = BROWSER_BASES.edge;\nconst BRAVE_BASE = BROWSER_BASES.brave;\nconst VIVALDI_BASE = BROWSER_BASES.vivaldi;\nconst OPERA_BASE = BROWSER_BASES.opera;\n\n// Snap / Flatpak variants (Linux only)\nconst CHROMIUM_SNAP_BASE = join(HOME, 'snap', 'chromium', 'common', 'chromium');\nconst CHROMIUM_FLATPAK_BASE = join(HOME, '.var', 'app', 'org.chromium.Chromium', 'config', 'chromium');\nconst CHROME_FLATPAK_BASE = join(HOME, '.var', 'app', 'com.google.Chrome', 'config', 'google-chrome');\nconst BRAVE_FLATPAK_BASE = join(HOME, '.var', 'app', 'com.brave.Browser', 'config', 'BraveSoftware', 'Brave-Browser');\nconst EDGE_FLATPAK_BASE = join(HOME, '.var', 'app', 'com.microsoft.Edge', 'config', 'microsoft-edge');\n\nfunction firefoxProfileDirs(): string[] {\n  const bases = firefoxBaseDirs();\n  const dirs: string[] = [];\n  for (const base of bases) {\n    if (!existsSync(base)) continue;\n    try {\n      for (const d of readdirSync(base)) {\n        const full = join(base, d);\n        try {\n          if (statSync(full).isDirectory() && existsSync(join(full, 'places.sqlite'))) {\n            dirs.push(full);\n          }\n        } catch { /* ignore */ }\n      }\n    } catch { /* ignore */ }\n  }\n  return dirs;\n}\n\n// ── Public API ────────────────────────────────────────────────────────────────\n\nexport async function scanAllBookmarks(): Promise<BookmarkHost[]> {\n  const all: BookmarkHost[] = [];\n\n  // Standard browser paths\n  for (const p of chromeLikePaths(CHROME_BASE))   all.push(...readChromeLike(p, 'chrome'));\n  for (const p of chromeLikePaths(CHROMIUM_BASE)) all.push(...readChromeLike(p, 'chromium'));\n  for (const p of chromeLikePaths(EDGE_BASE))     all.push(...readChromeLike(p, 'edge'));\n  for (const p of chromeLikePaths(BRAVE_BASE))    all.push(...readChromeLike(p, 'brave'));\n  for (const p of chromeLikePaths(VIVALDI_BASE))  all.push(...readChromeLike(p, 'vivaldi'));\n  for (const p of chromeLikePaths(OPERA_BASE))    all.push(...readChromeLike(p, 'opera'));\n\n  // Snap / Flatpak paths (Linux only — not macOS, not Windows)\n  if (IS_LINUX) {\n    for (const p of chromeLikePaths(CHROMIUM_SNAP_BASE))    all.push(...readChromeLike(p, 'chromium-snap'));\n    for (const p of chromeLikePaths(CHROMIUM_FLATPAK_BASE)) all.push(...readChromeLike(p, 'chromium-flatpak'));\n    for (const p of chromeLikePaths(CHROME_FLATPAK_BASE))   all.push(...readChromeLike(p, 'chrome-flatpak'));\n    for (const p of chromeLikePaths(BRAVE_FLATPAK_BASE))    all.push(...readChromeLike(p, 'brave-flatpak'));\n    for (const p of chromeLikePaths(EDGE_FLATPAK_BASE))     all.push(...readChromeLike(p, 'edge-flatpak'));\n  }\n\n  // Firefox: standard + snap + flatpak\n  for (const dir of firefoxProfileDirs()) {\n    all.push(...await readFirefoxBookmarks(dir));\n  }\n\n  // Deduplicate by hostname\n  const seen = new Set<string>();\n  return all.filter(h => {\n    if (seen.has(h.hostname)) return false;\n    seen.add(h.hostname);\n    return true;\n  });\n}\n\nexport async function scanAllHistory(): Promise<HistoryHost[]> {\n  const all: HistoryHost[] = [];\n\n  // Standard browser paths\n  for (const p of chromeLikeHistoryPaths(CHROME_BASE))   all.push(...await readChromiumHistory(p, 'chrome'));\n  for (const p of chromeLikeHistoryPaths(CHROMIUM_BASE)) all.push(...await readChromiumHistory(p, 'chromium'));\n  for (const p of chromeLikeHistoryPaths(EDGE_BASE))     all.push(...await readChromiumHistory(p, 'edge'));\n  for (const p of chromeLikeHistoryPaths(BRAVE_BASE))    all.push(...await readChromiumHistory(p, 'brave'));\n  for (const p of chromeLikeHistoryPaths(VIVALDI_BASE))  all.push(...await readChromiumHistory(p, 'vivaldi'));\n  for (const p of chromeLikeHistoryPaths(OPERA_BASE))    all.push(...await readChromiumHistory(p, 'opera'));\n\n  // Snap / Flatpak paths (Linux only — not macOS, not Windows)\n  if (IS_LINUX) {\n    for (const p of chromeLikeHistoryPaths(CHROMIUM_SNAP_BASE))    all.push(...await readChromiumHistory(p, 'chromium-snap'));\n    for (const p of chromeLikeHistoryPaths(CHROMIUM_FLATPAK_BASE)) all.push(...await readChromiumHistory(p, 'chromium-flatpak'));\n    for (const p of chromeLikeHistoryPaths(CHROME_FLATPAK_BASE))   all.push(...await readChromiumHistory(p, 'chrome-flatpak'));\n    for (const p of chromeLikeHistoryPaths(BRAVE_FLATPAK_BASE))    all.push(...await readChromiumHistory(p, 'brave-flatpak'));\n    for (const p of chromeLikeHistoryPaths(EDGE_FLATPAK_BASE))     all.push(...await readChromiumHistory(p, 'edge-flatpak'));\n  }\n\n  // Firefox: standard + snap + flatpak\n  for (const dir of firefoxProfileDirs()) {\n    all.push(...await readFirefoxHistory(dir));\n  }\n\n  // Deduplicate by hostname, summing visit counts\n  const byHost = new Map<string, HistoryHost>();\n  for (const h of all) {\n    const existing = byHost.get(h.hostname);\n    if (existing) {\n      existing.visitCount += h.visitCount;\n    } else {\n      byHost.set(h.hostname, { ...h });\n    }\n  }\n\n  // Sort by visit count descending\n  return [...byHost.values()].sort((a, b) => b.visitCount - a.visitCount);\n}\n","/**\n * Cross-platform utilities for Linux, macOS, and Windows.\n * Centralizes all OS-specific logic so scanning tools work everywhere.\n */\n\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\nimport { execSync } from 'node:child_process';\nimport { existsSync } from 'node:fs';\nimport { checkReadOnly } from './allowlist.js';\nimport { logWarn } from './logger.js';\n\n// ── Platform detection ───────────────────────────────────────────────────────\n\nexport type Platform = 'linux' | 'darwin' | 'win32';\n\nexport const PLATFORM: Platform = process.platform as Platform;\nexport const IS_WIN = PLATFORM === 'win32';\nexport const IS_MAC = PLATFORM === 'darwin';\nexport const IS_LINUX = PLATFORM === 'linux';\nexport const HOME = homedir();\n\n// ── Shell selection ──────────────────────────────────────────────────────────\n\n/**\n * Returns the correct shell for execSync on each platform.\n * - Windows: PowerShell (pwsh if available, otherwise powershell.exe)\n * - macOS/Linux: /bin/sh\n */\nexport function platformShell(): string {\n  if (!IS_WIN) return '/bin/sh';\n  // Prefer pwsh (PowerShell 7+) over powershell.exe (5.1)\n  try {\n    execSync('pwsh -Version', { stdio: 'pipe', timeout: 3000 });\n    return 'pwsh';\n  } catch {\n    return 'powershell.exe';\n  }\n}\n\n/** Cached shell value (computed once) */\nlet _shell: string | undefined;\nexport function getShell(): string {\n  if (!_shell) _shell = platformShell();\n  return _shell;\n}\n\n// ── Cross-platform command runner ────────────────────────────────────────────\n\nexport interface RunOptions {\n  timeout?: number;\n  env?: NodeJS.ProcessEnv;\n}\n\n/**\n * Run a shell command, returning stdout as string. Returns '' on error.\n * Automatically uses the correct shell for the platform.\n */\n/** Safe environment variables — excludes secrets from child processes */\nconst SAFE_ENV_KEYS = [\n  'PATH', 'HOME', 'USER', 'LANG', 'LC_ALL', 'TERM', 'SHELL',\n  'USERPROFILE', 'LOCALAPPDATA', 'APPDATA', 'PROGRAMFILES',\n  'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_RUNTIME_DIR',\n  'AWS_DEFAULT_REGION', 'AWS_PROFILE', 'AWS_CONFIG_FILE',\n  'KUBECONFIG', 'GOOGLE_APPLICATION_CREDENTIALS',\n  'AZURE_CONFIG_DIR',\n];\n\nexport function safeEnv(): NodeJS.ProcessEnv {\n  const env: NodeJS.ProcessEnv = {};\n  for (const key of SAFE_ENV_KEYS) {\n    if (process.env[key]) env[key] = process.env[key];\n  }\n  return env;\n}\n\nexport function run(cmd: string, opts: RunOptions = {}): string {\n  // Defense in depth: never spawn a command that is not on the read-only allowlist,\n  // regardless of where it originated (scanner template, agent, or MCP tool).\n  const policy = checkReadOnly(cmd, { shell: IS_WIN ? 'powershell' : 'posix' });\n  if (!policy.allowed) {\n    logWarn(`Blocked non-read-only command: ${policy.reason}`);\n    return '';\n  }\n  try {\n    return execSync(cmd, {\n      stdio: 'pipe',\n      timeout: opts.timeout ?? 10_000,\n      shell: getShell(),\n      env: opts.env ?? safeEnv(),\n    }).toString().trim();\n  } catch {\n    return '';\n  }\n}\n\n// ── Command existence check (cross-platform `which`) ─────────────────────────\n\n/**\n * Check if a command exists. Returns its path or '' if not found.\n * - Unix: `which <cmd>`\n * - Windows: `Get-Command <cmd>` via PowerShell\n */\nexport function commandExists(cmd: string): string {\n  if (IS_WIN) {\n    const r = run(`Get-Command ${cmd} -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Source`, { timeout: 5000 });\n    return r;\n  }\n  return run(`which ${cmd} 2>/dev/null`);\n}\n\n// ── Null device ──────────────────────────────────────────────────────────────\n\nexport const NULL_DEV = IS_WIN ? 'NUL' : '/dev/null';\n\n// ── App data directories ─────────────────────────────────────────────────────\n\n/** Returns the platform-specific user app data directory */\nexport function appDataDir(): string {\n  if (IS_WIN) return process.env.LOCALAPPDATA ?? join(HOME, 'AppData', 'Local');\n  if (IS_MAC) return join(HOME, 'Library', 'Application Support');\n  return process.env.XDG_CONFIG_HOME ?? join(HOME, '.config');\n}\n\n/** Returns the platform-specific user data directory (broader than config) */\nexport function userDataDir(): string {\n  if (IS_WIN) return process.env.APPDATA ?? join(HOME, 'AppData', 'Roaming');\n  if (IS_MAC) return join(HOME, 'Library', 'Application Support');\n  return process.env.XDG_DATA_HOME ?? join(HOME, '.local', 'share');\n}\n\n// ── Browser profile base paths (Chromium-based) ──────────────────────────────\n\nexport interface BrowserPaths {\n  chrome: string;\n  chromium: string;\n  edge: string;\n  brave: string;\n  vivaldi: string;\n  opera: string;\n}\n\nexport function browserBasePaths(): BrowserPaths {\n  if (IS_WIN) {\n    const local = process.env.LOCALAPPDATA ?? join(HOME, 'AppData', 'Local');\n    return {\n      chrome:   join(local, 'Google', 'Chrome', 'User Data'),\n      chromium: join(local, 'Chromium', 'User Data'),\n      edge:     join(local, 'Microsoft', 'Edge', 'User Data'),\n      brave:    join(local, 'BraveSoftware', 'Brave-Browser', 'User Data'),\n      vivaldi:  join(local, 'Vivaldi', 'User Data'),\n      opera:    join(userDataDir(), 'Opera Software', 'Opera Stable'),\n    };\n  }\n  if (IS_MAC) {\n    const lib = join(HOME, 'Library', 'Application Support');\n    return {\n      chrome:   join(lib, 'Google', 'Chrome'),\n      chromium: join(lib, 'Chromium'),\n      edge:     join(lib, 'Microsoft Edge'),\n      brave:    join(lib, 'BraveSoftware', 'Brave-Browser'),\n      vivaldi:  join(lib, 'Vivaldi'),\n      opera:    join(lib, 'com.operasoftware.Opera'),\n    };\n  }\n  // Linux\n  return {\n    chrome:   join(HOME, '.config', 'google-chrome'),\n    chromium: join(HOME, '.config', 'chromium'),\n    edge:     join(HOME, '.config', 'microsoft-edge'),\n    brave:    join(HOME, '.config', 'BraveSoftware', 'Brave-Browser'),\n    vivaldi:  join(HOME, '.config', 'vivaldi'),\n    opera:    join(HOME, '.config', 'opera'),\n  };\n}\n\n/** Firefox profile parent directories per platform */\nexport function firefoxBaseDirs(): string[] {\n  if (IS_WIN) {\n    const roaming = process.env.APPDATA ?? join(HOME, 'AppData', 'Roaming');\n    return [join(roaming, 'Mozilla', 'Firefox', 'Profiles')];\n  }\n  if (IS_MAC) {\n    return [join(HOME, 'Library', 'Application Support', 'Firefox', 'Profiles')];\n  }\n  // Linux: standard + snap + flatpak\n  return [\n    join(HOME, '.mozilla', 'firefox'),\n    join(HOME, 'snap', 'firefox', 'common', '.mozilla', 'firefox'),\n    join(HOME, '.var', 'app', 'org.mozilla.firefox', '.mozilla', 'firefox'),\n  ];\n}\n\n// ── Database scan directories ────────────────────────────────────────────────\n\n/** Returns directories to search for SQLite/DB files per platform */\nexport function dbScanDirs(): string[] {\n  const dirs: string[] = [];\n  if (IS_WIN) {\n    const local = process.env.LOCALAPPDATA ?? join(HOME, 'AppData', 'Local');\n    const roaming = process.env.APPDATA ?? join(HOME, 'AppData', 'Roaming');\n    dirs.push(local, roaming);\n    const pd = join(HOME, 'AppData', 'Local', 'Programs');\n    if (existsSync(pd)) dirs.push(pd);\n  } else if (IS_MAC) {\n    dirs.push(join(HOME, 'Library', 'Application Support'));\n    if (existsSync('/var/lib')) dirs.push('/var/lib');\n  } else {\n    const configDir = join(HOME, '.config');\n    const dataDir = join(HOME, '.local', 'share');\n    if (existsSync(configDir)) dirs.push(configDir);\n    if (existsSync(dataDir)) dirs.push(dataDir);\n    if (existsSync('/var/lib')) dirs.push('/var/lib');\n  }\n  return dirs.filter(d => existsSync(d));\n}\n\n// ── File search (cross-platform find) ────────────────────────────────────────\n\n/**\n * Search for files matching glob patterns in given directories.\n * - Unix: `find` command\n * - Windows: PowerShell `Get-ChildItem`\n */\nexport function findFiles(dirs: string[], patterns: string[], maxDepth: number, limit: number): string {\n  if (dirs.length === 0) return '';\n  if (IS_WIN) {\n    const includes = patterns.map(p => `'${p}'`).join(',');\n    const pathList = dirs.map(d => `'${d}'`).join(',');\n    return run(\n      `Get-ChildItem -Path ${pathList} -Recurse -Depth ${maxDepth} -Include ${includes} -ErrorAction SilentlyContinue | Select-Object -First ${limit} -ExpandProperty FullName`,\n      { timeout: 15_000 },\n    );\n  }\n  const nameArgs = patterns.map(p => `-name \"${p}\"`).join(' -o ');\n  const findCmds = dirs.map(d => `find \"${d}\" -maxdepth ${maxDepth} \\\\( ${nameArgs} \\\\) 2>/dev/null`).join('; ');\n  return run(`{ ${findCmds}; } | head -${limit}`, { timeout: 15_000 });\n}\n\n// ── Network scanning ─────────────────────────────────────────────────────────\n\n/** Get all listening TCP ports and the processes behind them */\nexport function scanListeningPorts(): string {\n  if (IS_WIN) {\n    // PowerShell: Get-NetTCPConnection for listening ports + owning process\n    return run(\n      `Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | ` +\n      `ForEach-Object { $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue; ` +\n      `\"$($_.LocalAddress):$($_.LocalPort) PID=$($_.OwningProcess) $($p.ProcessName)\" } | ` +\n      `Sort-Object -Unique`,\n      { timeout: 15_000 },\n    );\n  }\n  if (IS_MAC) {\n    // macOS: lsof is the most reliable way (ss not available)\n    return run('sudo lsof -iTCP -sTCP:LISTEN -n -P 2>/dev/null || lsof -iTCP -sTCP:LISTEN -n -P 2>/dev/null', { timeout: 15_000 });\n  }\n  // Linux: ss is the standard tool\n  return run('ss -tlnp 2>/dev/null', { timeout: 10_000 });\n}\n\n/** Get running processes (cross-platform) */\nexport function scanProcesses(): string {\n  if (IS_WIN) {\n    return run(\n      `Get-Process | Select-Object -Property Id, ProcessName, Path | Format-Table -AutoSize | Out-String -Width 200`,\n      { timeout: 15_000 },\n    );\n  }\n  return run('ps aux 2>/dev/null', { timeout: 10_000 });\n}\n\n// ── Windows-specific: installed programs ─────────────────────────────────────\n\n/** Scan Windows registry for installed programs */\nexport function scanWindowsPrograms(): string {\n  if (!IS_WIN) return '';\n  return run(\n    `$paths = @(` +\n    `'HKLM:\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*',` +\n    `'HKLM:\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*',` +\n    `'HKCU:\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*'` +\n    `); Get-ItemProperty $paths -ErrorAction SilentlyContinue | ` +\n    `Where-Object { $_.DisplayName } | ` +\n    `Select-Object -Property DisplayName, Publisher, DisplayVersion | ` +\n    `Sort-Object DisplayName | ` +\n    `Format-Table -AutoSize | Out-String -Width 300`,\n    { timeout: 20_000 },\n  );\n}\n\n/** Scan Windows services for database engines */\nexport function scanWindowsDbServices(): string {\n  if (!IS_WIN) return '';\n  return run(\n    `Get-Service | Where-Object { ` +\n    `$_.Name -match 'postgres|mysql|mariadb|mongo|redis|MSSQL|elastic|clickhouse|cassandra' ` +\n    `} | Select-Object Name, DisplayName, Status, StartType | Format-Table -AutoSize`,\n    { timeout: 10_000 },\n  );\n}\n\n// ── file:// URL helper ───────────────────────────────────────────────────────\n\n/** Generate a correct file:// URL for the current platform */\nexport function fileUrl(absPath: string): string {\n  if (IS_WIN) {\n    // Windows: file:///C:/Users/... (forward slashes, triple slash)\n    const normalized = absPath.replace(/\\\\/g, '/');\n    return `file:///${normalized}`;\n  }\n  return `file://${absPath}`;\n}\n","/**\n * Read-only command policy — a strict allowlist.\n *\n * Unlike a denylist (which is inherently leaky — novel destructive commands slip\n * through), this module permits only commands that are known to be read-only and\n * rejects everything else. It is the authoritative safety boundary for every\n * command the package spawns, independent of which agent or LLM is driving.\n *\n * The check is shell-aware: it splits a command line into segments on the control\n * operators `|`, `&&`, `||`, `;` (respecting single/double quotes), then validates\n * the leading executable of each segment plus its sub-command/arguments.\n */\n\n/** Plain read-only executables — no sub-command restriction needed. */\nconst READONLY_BINARIES = new Set<string>([\n  // shell & text utilities\n  'echo', 'printf', 'true', 'false', 'test', 'cat', 'head', 'tail', 'grep', 'egrep',\n  'fgrep', 'awk', 'sed', 'cut', 'sort', 'uniq', 'wc', 'tr', 'xargs', 'tee',\n  'ls', 'find', 'which', 'command', 'type', 'basename', 'dirname', 'realpath',\n  'readlink', 'stat', 'file', 'printenv', 'date', 'hostname', 'uname',\n  'whoami', 'id', 'pwd', 'expr', 'seq', 'tac', 'rev', 'column', 'paste',\n  // network & process inspection (read-only)\n  'ss', 'netstat', 'lsof', 'ps', 'ip', 'ifconfig', 'arp', 'dig', 'nslookup', 'host',\n  // database clients (read-only usage is enforced separately for risky verbs)\n  'psql', 'mysql', 'mysqladmin', 'mongosh', 'redis-cli', 'sqlite3', 'pg_lsclusters',\n  'clickhouse-client',\n  // macOS\n  'mdfind',\n]);\n\n/** `tee` is read-only only when writing to the bit bucket; otherwise it writes files. */\nconst CONDITIONAL_BINARIES = new Set<string>(['tee']);\n\n/** Package managers: list/query only — reject install/remove/upgrade-style verbs and flags. */\nconst PKG_MANAGERS = new Set<string>(['dpkg', 'rpm', 'snap', 'flatpak', 'brew', 'winget', 'choco', 'scoop', 'apt-cache']);\nconst MUTATING_PKG = /^(install|uninstall|reinstall|remove|purge|erase|upgrade|update|add|delete|pin|enable|disable|-i|--install|-r|--remove|-P|--purge|-e|--erase|-U|--upgrade|-F|--freshen)$/i;\n\n/** Executables that run another command supplied as an argument — must be validated recursively. */\nconst COMMAND_RUNNERS = new Set<string>(['xargs', 'env', 'nice', 'nohup', 'timeout', 'time', 'stdbuf', 'watch', 'sudo']);\n\n/** Mutating PowerShell cmdlets and Windows commands — rejected in PowerShell mode. */\nconst DANGEROUS_PS = /\\b(Remove-Item|Remove-ItemProperty|Move-Item|Copy-Item|Rename-Item|New-Item|New-Service|Set-Content|Add-Content|Clear-Content|Out-File|Set-ItemProperty|Set-Service|Stop-Process|Stop-Service|Start-Service|Restart-Service|Stop-Computer|Restart-Computer|Format-Volume|Clear-Disk|Remove-\\w+|Uninstall-\\w+|Install-\\w+|Set-\\w+|New-\\w+|Start-\\w+|Stop-\\w+|Restart-\\w+|Invoke-Expression|iex|Invoke-WebRequest|Invoke-RestMethod|Invoke-Command|Start-Process|Register-\\w+|Unregister-\\w+|Disable-\\w+|Enable-\\w+|Reset-\\w+|del|rmdir|rd)\\b/i;\n\n/** Coarse Unix destructive denylist — defense-in-depth backstop. */\nconst DANGEROUS_POSIX = /\\b(rm|rmdir|mv|dd|mkfs|chmod|chown|chgrp|kill|killall|pkill|reboot|shutdown|poweroff|halt|truncate|shred|fdisk|parted)\\b/i;\n\n/**\n * Multi-verb tools: the first non-flag token after the binary (and, for some, the\n * whole token list) must satisfy a read-only predicate.\n */\nconst SUBCOMMAND_RULES: Record<string, (tokens: string[]) => boolean> = {\n  kubectl: (t) => allowFirstVerb(t, ['get', 'describe', 'top', 'logs', 'explain', 'config', 'version', 'cluster-info', 'api-resources', 'api-versions', 'auth']),\n  docker: (t) => allowFirstVerb(t, ['ps', 'images', 'inspect', 'version', 'info', 'logs', 'stats', 'top', 'port', 'history', 'diff', 'system', 'context', 'volume', 'network', 'image', 'container']) && !hasMutatingDockerVerb(t),\n  podman: (t) => SUBCOMMAND_RULES['docker']!(t),\n  helm: (t) => allowFirstVerb(t, ['list', 'ls', 'status', 'get', 'show', 'history', 'version', 'repo', 'search', 'env']),\n  systemctl: (t) => allowFirstVerb(t, ['status', 'show', 'list-units', 'list-unit-files', 'list-sockets', 'list-timers', 'list-dependencies', 'is-active', 'is-enabled', 'is-failed', 'cat', 'get-default', 'show-environment']),\n  service: (t) => t.some((x) => /^status$/i.test(x)),\n  // cloud CLIs: read-only actions only — must contain a read verb, never a mutating one\n  aws: (t) => containsAwsReadAction(t) && !hasMutatingCloudVerb(t),\n  gcloud: (t) => (hasToken(t, ['list', 'describe']) || isInfoOnly(t)) && !hasMutatingCloudVerb(t),\n  az: (t) => (hasToken(t, ['list', 'show']) || isInfoOnly(t)) && !hasMutatingCloudVerb(t),\n  // version control (read-only verbs only)\n  git: (t) => allowFirstVerb(t, ['status', 'log', 'show', 'diff', 'branch', 'remote', 'config', 'rev-parse', 'ls-files', 'ls-remote', 'describe', 'tag', 'shortlog', 'cat-file', 'symbolic-ref']),\n  gh: (t) => allowFirstVerb(t, ['repo', 'pr', 'issue', 'release', 'api', 'auth', 'status']) && hasToken(t, ['list', 'view', 'status', 'get']),\n};\n\n/** curl/wget: GET-only, no file writes, no request methods or bodies. */\nconst FETCH_RULES: Record<string, (tokens: string[]) => boolean> = {\n  curl: (t) => !t.some((x) => /^-X$/i.test(x) || /^--request$/i.test(x) || /^-[dF]$/.test(x) || /^--data/i.test(x) || /^--form$/i.test(x) || /^-[oO]$/.test(x) || /^--output$/i.test(x) || /^--upload-file$/i.test(x)),\n  wget: (t) => !t.some((x) => /^-O$/.test(x) || /^--output-document/i.test(x) || /^--post-data/i.test(x) || /^--method/i.test(x) || /^-i$/.test(x)),\n};\n\n/** Read-only PowerShell verbs (cmdlets are `Verb-Noun`). */\nconst READONLY_PS_VERBS = new Set<string>([\n  'get', 'select', 'where', 'measure', 'sort', 'format', 'out', 'convertto',\n  'convertfrom', 'compare', 'test', 'resolve', 'split', 'join', 'group', 'foreach',\n  'write', 'read', 'show', 'find', 'search', 'tee',\n]);\n\n/** Bare PowerShell helpers / aliases that are read-only. */\nconst READONLY_PS_BARE = new Set<string>(['where', 'select', 'sort', 'foreach', 'ft', 'fl', 'gci', 'gc', 'gm', 'gps', 'gsv', 'echo', 'write-host', 'write-output']);\n\nexport interface PolicyResult {\n  allowed: boolean;\n  reason?: string;\n}\n\nexport type ShellKind = 'posix' | 'powershell';\n\n// ── Helpers ──────────────────────────────────────────────────────────────────\n\nfunction allowFirstVerb(tokens: string[], verbs: string[]): boolean {\n  const verb = tokens.find((t) => !t.startsWith('-'));\n  return verb !== undefined && verbs.includes(verb.toLowerCase());\n}\n\nfunction hasToken(tokens: string[], any: string[]): boolean {\n  const lower = tokens.map((t) => t.toLowerCase());\n  return any.some((a) => lower.includes(a));\n}\n\nfunction isInfoOnly(tokens: string[]): boolean {\n  // e.g. `gcloud config list ...`, `az account show`\n  return hasToken(tokens, ['config', 'account', 'version', 'info']);\n}\n\nconst MUTATING_CLOUD = /^(create|delete|update|put|set|add|remove|deploy|run|start|stop|restart|reboot|terminate|modify|attach|detach|associate|disassociate|enable|disable|invoke|exec|apply|destroy|scale|patch|register|deregister|import|copy|move|rename|reset|rotate|revoke|grant)([-_].*)?$/i;\n\nfunction hasMutatingCloudVerb(tokens: string[]): boolean {\n  return tokens.some((t) => !t.startsWith('-') && MUTATING_CLOUD.test(t));\n}\n\nfunction containsAwsReadAction(tokens: string[]): boolean {\n  // aws <service> <action> — action must be read-only\n  return tokens.some((t) => /^(describe|list|get|lookup|search|scan|view|ls)[-_a-z0-9]*$/i.test(t) || t.toLowerCase() === 'ls');\n}\n\nfunction hasMutatingDockerVerb(tokens: string[]): boolean {\n  return tokens.some((t) => /^(run|rm|rmi|exec|build|push|pull|start|stop|kill|create|commit|cp|save|load|tag|login|logout|prune|kill|restart|pause|unpause|rename|update|export|import)$/i.test(t));\n}\n\n/** Split a command line on shell control operators, honoring single/double quotes. */\nexport function splitSegments(cmd: string): string[] {\n  const segments: string[] = [];\n  let buf = '';\n  let quote: '\"' | \"'\" | null = null;\n  for (let i = 0; i < cmd.length; i++) {\n    const c = cmd[i]!;\n    const next = cmd[i + 1];\n    if (quote) {\n      buf += c;\n      if (c === quote) quote = null;\n      continue;\n    }\n    if (c === '\"' || c === \"'\") { quote = c; buf += c; continue; }\n    // command substitution is rejected wholesale elsewhere; treat `$(` as a break too\n    if ((c === '|' && next === '|') || (c === '&' && next === '&')) { segments.push(buf); buf = ''; i++; continue; }\n    if (c === '|' || c === ';' || c === '\\n') { segments.push(buf); buf = ''; continue; }\n    buf += c;\n  }\n  segments.push(buf);\n  return segments.map((s) => s.trim()).filter(Boolean);\n}\n\n/** Tokenize one segment into words, honoring quotes and stripping them. */\nfunction tokenize(segment: string): string[] {\n  const tokens: string[] = [];\n  let buf = '';\n  let quote: '\"' | \"'\" | null = null;\n  let started = false;\n  const push = () => { if (started) { tokens.push(buf); buf = ''; started = false; } };\n  for (let i = 0; i < segment.length; i++) {\n    const c = segment[i]!;\n    if (quote) { if (c === quote) quote = null; else buf += c; started = true; continue; }\n    if (c === '\"' || c === \"'\") { quote = c; started = true; continue; }\n    if (c === ' ' || c === '\\t') { push(); continue; }\n    buf += c; started = true;\n  }\n  push();\n  return tokens;\n}\n\nfunction baseName(executable: string): string {\n  const noPath = executable.split(/[\\\\/]/).pop() ?? executable;\n  return noPath.toLowerCase();\n}\n\n/** `find` is read-only unless it is asked to execute or delete. */\nfunction findIsReadOnly(rest: string[]): boolean {\n  return !rest.some((t) => /^-(exec|execdir|ok|okdir|delete|fprintf|fprint|fls)$/i.test(t));\n}\n\n/** Guard `awk`/`sed` programs against shelling out. */\nfunction awkSedIsReadOnly(exe: string, rest: string[]): boolean {\n  const program = rest.join(' ');\n  if (exe === 'awk') return !/\\bsystem\\s*\\(/.test(program) && !/\\|\\s*[\"']/.test(program) && !/print\\s*>/.test(program);\n  // sed: reject the `e` (execute) command and the s///e flag and `w` (write file)\n  return !/(^|;|\\{|\\s)e\\b/.test(program) && !/s[^\\s]*\\/[a-z]*e[a-z]*\\b/i.test(program) && !/\\bw\\s+\\S/.test(program);\n}\n\nfunction isWriteRedirect(segment: string): boolean {\n  // Allow only redirects to the bit bucket / stderr merge: 2>/dev/null, >/dev/null, 2>&1, *> $null, Out-Null\n  // Reject any other `>` or `>>` (file writes).\n  const stripped = segment\n    .replace(/\\d?>>?\\s*\\/dev\\/null/g, '')\n    .replace(/\\d?>\\s*&\\s*\\d/g, '')\n    .replace(/\\d?>\\s*\\$null/gi, '');\n  return /(^|[^0-9&])>>?/.test(stripped);\n}\n\n// ── Public API ─────────────────────────────────────────────────────────────────\n\n/**\n * Decide whether a command line is read-only and therefore safe to execute.\n * Returns `{ allowed: false, reason }` for anything not explicitly permitted.\n */\nexport function checkReadOnly(command: string, opts: { shell?: ShellKind } = {}): PolicyResult {\n  const cmd = command.trim();\n  if (!cmd) return { allowed: false, reason: 'empty command' };\n\n  // PowerShell uses `$(...)`, `;`-in-blocks and `{}` legitimately, so a POSIX parser\n  // would mis-fire. In PowerShell mode we reject file writes and mutating cmdlets instead.\n  if (opts.shell === 'powershell') {\n    if (isWriteRedirect(cmd)) return { allowed: false, reason: 'file-writing redirect is not allowed' };\n    if (DANGEROUS_PS.test(cmd)) return { allowed: false, reason: 'mutating PowerShell cmdlet is not allowed' };\n    if (DANGEROUS_POSIX.test(cmd)) return { allowed: false, reason: 'destructive command is not allowed' };\n    return { allowed: true };\n  }\n\n  // Reject command substitution and backticks — they hide arbitrary execution.\n  if (/\\$\\(|`/.test(cmd)) return { allowed: false, reason: 'command substitution is not allowed' };\n\n  // Reject file-writing redirects (anything other than /dev/null or stderr merge).\n  if (isWriteRedirect(cmd)) return { allowed: false, reason: 'file-writing redirect is not allowed' };\n\n  for (const segment of splitSegments(cmd)) {\n    const r = checkSegment(segment);\n    if (!r.allowed) return r;\n  }\n\n  return { allowed: true };\n}\n\n/** Validate a single pipeline segment's leading executable and its arguments. */\nfunction checkSegment(segment: string): PolicyResult {\n  // Drop leading inline env assignments (`FOO=bar cmd`) and shell grouping tokens (`{ } ( )`).\n  let tokens = tokenize(segment)\n    .filter((t) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))\n    .filter((t) => t !== '{' && t !== '}' && t !== '(' && t !== ')');\n  if (tokens.length === 0) return { allowed: true };\n\n  let exe = baseName(tokens[0]!);\n  let rest = tokens.slice(1);\n\n  // Command runners (xargs, timeout, nice, env, ...): unwrap to the inner command and validate it.\n  while (COMMAND_RUNNERS.has(exe)) {\n    // skip the runner's own flags and their values, plus xargs replace-string (-I {})\n    const inner: string[] = [];\n    let i = 0;\n    for (; i < rest.length; i++) {\n      const t = rest[i]!;\n      if (t.startsWith('-')) { if (/^-(I|n|L|P|d|s|E|u|g)$/.test(t)) i++; continue; }\n      inner.push(...rest.slice(i));\n      break;\n    }\n    if (inner.length === 0) return { allowed: true }; // runner with no inner command (e.g. `env`, `xargs echo`-less)\n    exe = baseName(inner[0]!);\n    rest = inner.slice(1);\n  }\n\n  if (exe === 'find') {\n    if (!findIsReadOnly(rest)) return { allowed: false, reason: 'find: -exec/-delete is not allowed' };\n    return { allowed: true };\n  }\n  if (exe === 'awk' || exe === 'sed') {\n    if (!awkSedIsReadOnly(exe, rest)) return { allowed: false, reason: `${exe}: program may not shell out or write files` };\n    return { allowed: true };\n  }\n  if (PKG_MANAGERS.has(exe)) {\n    if (rest.some((t) => MUTATING_PKG.test(t))) return { allowed: false, reason: `${exe}: only list/query sub-commands are allowed` };\n    return { allowed: true };\n  }\n  if (FETCH_RULES[exe]) {\n    if (!FETCH_RULES[exe]!(rest)) return { allowed: false, reason: `${exe}: only read-only GET requests are allowed` };\n    return { allowed: true };\n  }\n  if (SUBCOMMAND_RULES[exe]) {\n    if (!SUBCOMMAND_RULES[exe]!(rest)) return { allowed: false, reason: `${exe}: sub-command is not read-only` };\n    return { allowed: true };\n  }\n  if (CONDITIONAL_BINARIES.has(exe)) {\n    if (rest.some((t) => !t.startsWith('-') && t !== '/dev/null')) return { allowed: false, reason: 'tee may only write to /dev/null' };\n    return { allowed: true };\n  }\n  if (READONLY_BINARIES.has(exe)) return { allowed: true };\n  if (READONLY_PS_BARE.has(exe)) return { allowed: true };\n\n  // PowerShell cmdlet fallback: Verb-Noun where the verb must be read-only.\n  if (exe.includes('-') && /^[a-z]+-[a-z]/.test(exe)) {\n    const verb = exe.split('-')[0]!;\n    if (READONLY_PS_VERBS.has(verb)) return { allowed: true };\n    return { allowed: false, reason: `PowerShell cmdlet not read-only: ${exe}` };\n  }\n\n  return { allowed: false, reason: `command not on read-only allowlist: ${exe}` };\n}\n\n/** Convenience boolean form. */\nexport function isReadOnlyCommand(command: string): boolean {\n  return checkReadOnly(command).allowed;\n}\n\n/** Throwing form for guard sites that prefer exceptions. */\nexport function assertReadOnly(command: string): void {\n  const r = checkReadOnly(command);\n  if (!r.allowed) throw new Error(`Blocked by read-only allowlist: ${r.reason}`);\n}\n","/**\n * Structured logging for enterprise observability.\n * Outputs JSON to stderr for compatibility with ELK, Datadog, Splunk, CloudWatch.\n */\n\nexport type LogLevel = 'DEBUG' | 'INFO' | 'WARN' | 'ERROR';\n\nexport interface LogEntry {\n  timestamp: string;\n  level: LogLevel;\n  message: string;\n  context?: Record<string, unknown>;\n}\n\nlet verboseMode = false;\n\nexport function setVerbose(v: boolean): void {\n  verboseMode = v;\n}\n\nexport function log(level: LogLevel, message: string, context?: Record<string, unknown>): void {\n  if (level === 'DEBUG' && !verboseMode) return;\n\n  const entry: LogEntry = {\n    timestamp: new Date().toISOString(),\n    level,\n    message,\n    ...(context && Object.keys(context).length > 0 ? { context } : {}),\n  };\n  process.stderr.write(JSON.stringify(entry) + '\\n');\n}\n\nexport function logDebug(message: string, context?: Record<string, unknown>): void {\n  log('DEBUG', message, context);\n}\n\nexport function logInfo(message: string, context?: Record<string, unknown>): void {\n  log('INFO', message, context);\n}\n\nexport function logWarn(message: string, context?: Record<string, unknown>): void {\n  log('WARN', message, context);\n}\n\nexport function logError(message: string, context?: Record<string, unknown>): void {\n  log('ERROR', message, context);\n}\n"],"mappings":";;;AAAA,SAAS,cAAc;AACvB,SAAS,cAAAA,aAAY,cAAc,aAAa,cAAc,UAAU,kBAAkB;AAC1F,SAAS,QAAAC,aAAY;;;ACGrB,SAAS,eAAe;AACxB,SAAS,YAAY;AACrB,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;;;ACM3B,IAAM,oBAAoB,oBAAI,IAAY;AAAA;AAAA,EAExC;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAC1E;AAAA,EAAS;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAM;AAAA,EAAS;AAAA,EACnE;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAW;AAAA,EACjE;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAY;AAAA,EAC5D;AAAA,EAAU;AAAA,EAAM;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAU;AAAA;AAAA,EAE9D;AAAA,EAAM;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAM;AAAA,EAAY;AAAA,EAAO;AAAA,EAAO;AAAA,EAAY;AAAA;AAAA,EAE3E;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAc;AAAA,EAAW;AAAA,EAAa;AAAA,EAAW;AAAA,EAClE;AAAA;AAAA,EAEA;AACF,CAAC;AAGD,IAAM,uBAAuB,oBAAI,IAAY,CAAC,KAAK,CAAC;AAGpD,IAAM,eAAe,oBAAI,IAAY,CAAC,QAAQ,OAAO,QAAQ,WAAW,QAAQ,UAAU,SAAS,SAAS,WAAW,CAAC;AACxH,IAAM,eAAe;AAGrB,IAAM,kBAAkB,oBAAI,IAAY,CAAC,SAAS,OAAO,QAAQ,SAAS,WAAW,QAAQ,UAAU,SAAS,MAAM,CAAC;AAGvH,IAAM,eAAe;AAGrB,IAAM,kBAAkB;AAMxB,IAAM,mBAAkE;AAAA,EACtE,SAAS,CAAC,MAAM,eAAe,GAAG,CAAC,OAAO,YAAY,OAAO,QAAQ,WAAW,UAAU,WAAW,gBAAgB,iBAAiB,gBAAgB,MAAM,CAAC;AAAA,EAC7J,QAAQ,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,UAAU,WAAW,WAAW,QAAQ,QAAQ,SAAS,OAAO,QAAQ,WAAW,QAAQ,UAAU,WAAW,UAAU,WAAW,SAAS,WAAW,CAAC,KAAK,CAAC,sBAAsB,CAAC;AAAA,EAC/N,QAAQ,CAAC,MAAM,iBAAiB,QAAQ,EAAG,CAAC;AAAA,EAC5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAQ,MAAM,UAAU,OAAO,QAAQ,WAAW,WAAW,QAAQ,UAAU,KAAK,CAAC;AAAA,EACrH,WAAW,CAAC,MAAM,eAAe,GAAG,CAAC,UAAU,QAAQ,cAAc,mBAAmB,gBAAgB,eAAe,qBAAqB,aAAa,cAAc,aAAa,OAAO,eAAe,kBAAkB,CAAC;AAAA,EAC7N,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC;AAAA;AAAA,EAEjD,KAAK,CAAC,MAAM,sBAAsB,CAAC,KAAK,CAAC,qBAAqB,CAAC;AAAA,EAC/D,QAAQ,CAAC,OAAO,SAAS,GAAG,CAAC,QAAQ,UAAU,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC;AAAA,EAC9F,IAAI,CAAC,OAAO,SAAS,GAAG,CAAC,QAAQ,MAAM,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC;AAAA;AAAA,EAEtF,KAAK,CAAC,MAAM,eAAe,GAAG,CAAC,UAAU,OAAO,QAAQ,QAAQ,UAAU,UAAU,UAAU,aAAa,YAAY,aAAa,YAAY,OAAO,YAAY,YAAY,cAAc,CAAC;AAAA,EAC9L,IAAI,CAAC,MAAM,eAAe,GAAG,CAAC,QAAQ,MAAM,SAAS,WAAW,OAAO,QAAQ,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC,QAAQ,QAAQ,UAAU,KAAK,CAAC;AAC5I;AAGA,IAAM,cAA6D;AAAA,EACjE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,KAAK,eAAe,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,KAAK,WAAW,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,KAAK,mBAAmB,KAAK,CAAC,CAAC;AAAA,EACnN,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,KAAK,sBAAsB,KAAK,CAAC,KAAK,gBAAgB,KAAK,CAAC,KAAK,aAAa,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC;AAClJ;AAGA,IAAM,oBAAoB,oBAAI,IAAY;AAAA,EACxC;AAAA,EAAO;AAAA,EAAU;AAAA,EAAS;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAO;AAAA,EAC9D;AAAA,EAAe;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAS;AAAA,EACvE;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAU;AAC7C,CAAC;AAGD,IAAM,mBAAmB,oBAAI,IAAY,CAAC,SAAS,UAAU,QAAQ,WAAW,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,OAAO,QAAQ,cAAc,cAAc,CAAC;AAWlK,SAAS,eAAe,QAAkB,OAA0B;AAClE,QAAM,OAAO,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAClD,SAAO,SAAS,UAAa,MAAM,SAAS,KAAK,YAAY,CAAC;AAChE;AAEA,SAAS,SAAS,QAAkB,KAAwB;AAC1D,QAAM,QAAQ,OAAO,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;AAC/C,SAAO,IAAI,KAAK,CAAC,MAAM,MAAM,SAAS,CAAC,CAAC;AAC1C;AAEA,SAAS,WAAW,QAA2B;AAE7C,SAAO,SAAS,QAAQ,CAAC,UAAU,WAAW,WAAW,MAAM,CAAC;AAClE;AAEA,IAAM,iBAAiB;AAEvB,SAAS,qBAAqB,QAA2B;AACvD,SAAO,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,KAAK,eAAe,KAAK,CAAC,CAAC;AACxE;AAEA,SAAS,sBAAsB,QAA2B;AAExD,SAAO,OAAO,KAAK,CAAC,MAAM,+DAA+D,KAAK,CAAC,KAAK,EAAE,YAAY,MAAM,IAAI;AAC9H;AAEA,SAAS,sBAAsB,QAA2B;AACxD,SAAO,OAAO,KAAK,CAAC,MAAM,gKAAgK,KAAK,CAAC,CAAC;AACnM;AAGO,SAAS,cAAc,KAAuB;AACnD,QAAM,WAAqB,CAAC;AAC5B,MAAI,MAAM;AACV,MAAI,QAA0B;AAC9B,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,UAAM,IAAI,IAAI,CAAC;AACf,UAAM,OAAO,IAAI,IAAI,CAAC;AACtB,QAAI,OAAO;AACT,aAAO;AACP,UAAI,MAAM,MAAO,SAAQ;AACzB;AAAA,IACF;AACA,QAAI,MAAM,OAAO,MAAM,KAAK;AAAE,cAAQ;AAAG,aAAO;AAAG;AAAA,IAAU;AAE7D,QAAK,MAAM,OAAO,SAAS,OAAS,MAAM,OAAO,SAAS,KAAM;AAAE,eAAS,KAAK,GAAG;AAAG,YAAM;AAAI;AAAK;AAAA,IAAU;AAC/G,QAAI,MAAM,OAAO,MAAM,OAAO,MAAM,MAAM;AAAE,eAAS,KAAK,GAAG;AAAG,YAAM;AAAI;AAAA,IAAU;AACpF,WAAO;AAAA,EACT;AACA,WAAS,KAAK,GAAG;AACjB,SAAO,SAAS,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACrD;AAGA,SAAS,SAAS,SAA2B;AAC3C,QAAM,SAAmB,CAAC;AAC1B,MAAI,MAAM;AACV,MAAI,QAA0B;AAC9B,MAAI,UAAU;AACd,QAAM,OAAO,MAAM;AAAE,QAAI,SAAS;AAAE,aAAO,KAAK,GAAG;AAAG,YAAM;AAAI,gBAAU;AAAA,IAAO;AAAA,EAAE;AACnF,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAM,IAAI,QAAQ,CAAC;AACnB,QAAI,OAAO;AAAE,UAAI,MAAM,MAAO,SAAQ;AAAA,UAAW,QAAO;AAAG,gBAAU;AAAM;AAAA,IAAU;AACrF,QAAI,MAAM,OAAO,MAAM,KAAK;AAAE,cAAQ;AAAG,gBAAU;AAAM;AAAA,IAAU;AACnE,QAAI,MAAM,OAAO,MAAM,KAAM;AAAE,WAAK;AAAG;AAAA,IAAU;AACjD,WAAO;AAAG,cAAU;AAAA,EACtB;AACA,OAAK;AACL,SAAO;AACT;AAEA,SAAS,SAAS,YAA4B;AAC5C,QAAM,SAAS,WAAW,MAAM,OAAO,EAAE,IAAI,KAAK;AAClD,SAAO,OAAO,YAAY;AAC5B;AAGA,SAAS,eAAe,MAAyB;AAC/C,SAAO,CAAC,KAAK,KAAK,CAAC,MAAM,wDAAwD,KAAK,CAAC,CAAC;AAC1F;AAGA,SAAS,iBAAiB,KAAa,MAAyB;AAC9D,QAAM,UAAU,KAAK,KAAK,GAAG;AAC7B,MAAI,QAAQ,MAAO,QAAO,CAAC,gBAAgB,KAAK,OAAO,KAAK,CAAC,YAAY,KAAK,OAAO,KAAK,CAAC,YAAY,KAAK,OAAO;AAEnH,SAAO,CAAC,iBAAiB,KAAK,OAAO,KAAK,CAAC,4BAA4B,KAAK,OAAO,KAAK,CAAC,WAAW,KAAK,OAAO;AAClH;AAEA,SAAS,gBAAgB,SAA0B;AAGjD,QAAM,WAAW,QACd,QAAQ,yBAAyB,EAAE,EACnC,QAAQ,kBAAkB,EAAE,EAC5B,QAAQ,mBAAmB,EAAE;AAChC,SAAO,iBAAiB,KAAK,QAAQ;AACvC;AAQO,SAAS,cAAc,SAAiB,OAA8B,CAAC,GAAiB;AAC7F,QAAM,MAAM,QAAQ,KAAK;AACzB,MAAI,CAAC,IAAK,QAAO,EAAE,SAAS,OAAO,QAAQ,gBAAgB;AAI3D,MAAI,KAAK,UAAU,cAAc;AAC/B,QAAI,gBAAgB,GAAG,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,uCAAuC;AAClG,QAAI,aAAa,KAAK,GAAG,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,4CAA4C;AACzG,QAAI,gBAAgB,KAAK,GAAG,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,qCAAqC;AACrG,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AAGA,MAAI,SAAS,KAAK,GAAG,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,sCAAsC;AAG/F,MAAI,gBAAgB,GAAG,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,uCAAuC;AAElG,aAAW,WAAW,cAAc,GAAG,GAAG;AACxC,UAAM,IAAI,aAAa,OAAO;AAC9B,QAAI,CAAC,EAAE,QAAS,QAAO;AAAA,EACzB;AAEA,SAAO,EAAE,SAAS,KAAK;AACzB;AAGA,SAAS,aAAa,SAA+B;AAEnD,MAAI,SAAS,SAAS,OAAO,EAC1B,OAAO,CAAC,MAAM,CAAC,2BAA2B,KAAK,CAAC,CAAC,EACjD,OAAO,CAAC,MAAM,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,GAAG;AACjE,MAAI,OAAO,WAAW,EAAG,QAAO,EAAE,SAAS,KAAK;AAEhD,MAAI,MAAM,SAAS,OAAO,CAAC,CAAE;AAC7B,MAAI,OAAO,OAAO,MAAM,CAAC;AAGzB,SAAO,gBAAgB,IAAI,GAAG,GAAG;AAE/B,UAAM,QAAkB,CAAC;AACzB,QAAI,IAAI;AACR,WAAO,IAAI,KAAK,QAAQ,KAAK;AAC3B,YAAM,IAAI,KAAK,CAAC;AAChB,UAAI,EAAE,WAAW,GAAG,GAAG;AAAE,YAAI,yBAAyB,KAAK,CAAC,EAAG;AAAK;AAAA,MAAU;AAC9E,YAAM,KAAK,GAAG,KAAK,MAAM,CAAC,CAAC;AAC3B;AAAA,IACF;AACA,QAAI,MAAM,WAAW,EAAG,QAAO,EAAE,SAAS,KAAK;AAC/C,UAAM,SAAS,MAAM,CAAC,CAAE;AACxB,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AAEA,MAAI,QAAQ,QAAQ;AAClB,QAAI,CAAC,eAAe,IAAI,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,qCAAqC;AACjG,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,QAAQ,SAAS,QAAQ,OAAO;AAClC,QAAI,CAAC,iBAAiB,KAAK,IAAI,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,GAAG,6CAA6C;AACtH,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,aAAa,IAAI,GAAG,GAAG;AACzB,QAAI,KAAK,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,CAAC,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,GAAG,6CAA6C;AAChI,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,YAAY,GAAG,GAAG;AACpB,QAAI,CAAC,YAAY,GAAG,EAAG,IAAI,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,GAAG,4CAA4C;AACjH,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,iBAAiB,GAAG,GAAG;AACzB,QAAI,CAAC,iBAAiB,GAAG,EAAG,IAAI,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,GAAG,iCAAiC;AAC3G,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,qBAAqB,IAAI,GAAG,GAAG;AACjC,QAAI,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,KAAK,MAAM,WAAW,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,kCAAkC;AAClI,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,kBAAkB,IAAI,GAAG,EAAG,QAAO,EAAE,SAAS,KAAK;AACvD,MAAI,iBAAiB,IAAI,GAAG,EAAG,QAAO,EAAE,SAAS,KAAK;AAGtD,MAAI,IAAI,SAAS,GAAG,KAAK,gBAAgB,KAAK,GAAG,GAAG;AAClD,UAAM,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AAC7B,QAAI,kBAAkB,IAAI,IAAI,EAAG,QAAO,EAAE,SAAS,KAAK;AACxD,WAAO,EAAE,SAAS,OAAO,QAAQ,oCAAoC,GAAG,GAAG;AAAA,EAC7E;AAEA,SAAO,EAAE,SAAS,OAAO,QAAQ,uCAAuC,GAAG,GAAG;AAChF;;;AC/QA,IAAI,cAAc;AAEX,SAAS,WAAW,GAAkB;AAC3C,gBAAc;AAChB;AAEO,SAAS,IAAI,OAAiB,SAAiB,SAAyC;AAC7F,MAAI,UAAU,WAAW,CAAC,YAAa;AAEvC,QAAM,QAAkB;AAAA,IACtB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,GAAI,WAAW,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,UAAQ,OAAO,MAAM,KAAK,UAAU,KAAK,IAAI,IAAI;AACnD;AAEO,SAAS,SAAS,SAAiB,SAAyC;AACjF,MAAI,SAAS,SAAS,OAAO;AAC/B;AAEO,SAAS,QAAQ,SAAiB,SAAyC;AAChF,MAAI,QAAQ,SAAS,OAAO;AAC9B;AAEO,SAAS,QAAQ,SAAiB,SAAyC;AAChF,MAAI,QAAQ,SAAS,OAAO;AAC9B;AAEO,SAAS,SAAS,SAAiB,SAAyC;AACjF,MAAI,SAAS,SAAS,OAAO;AAC/B;;;AF9BO,IAAM,WAAqB,QAAQ;AACnC,IAAM,SAAS,aAAa;AAC5B,IAAM,SAAS,aAAa;AAC5B,IAAM,WAAW,aAAa;AAC9B,IAAM,OAAO,QAAQ;AASrB,SAAS,gBAAwB;AACtC,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,aAAS,iBAAiB,EAAE,OAAO,QAAQ,SAAS,IAAK,CAAC;AAC1D,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,IAAI;AACG,SAAS,WAAmB;AACjC,MAAI,CAAC,OAAQ,UAAS,cAAc;AACpC,SAAO;AACT;AAcA,IAAM,gBAAgB;AAAA,EACpB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAQ;AAAA,EAClD;AAAA,EAAe;AAAA,EAAgB;AAAA,EAAW;AAAA,EAC1C;AAAA,EAAmB;AAAA,EAAiB;AAAA,EACpC;AAAA,EAAsB;AAAA,EAAe;AAAA,EACrC;AAAA,EAAc;AAAA,EACd;AACF;AAEO,SAAS,UAA6B;AAC3C,QAAM,MAAyB,CAAC;AAChC,aAAW,OAAO,eAAe;AAC/B,QAAI,QAAQ,IAAI,GAAG,EAAG,KAAI,GAAG,IAAI,QAAQ,IAAI,GAAG;AAAA,EAClD;AACA,SAAO;AACT;AAEO,SAAS,IAAI,KAAa,OAAmB,CAAC,GAAW;AAG9D,QAAM,SAAS,cAAc,KAAK,EAAE,OAAO,SAAS,eAAe,QAAQ,CAAC;AAC5E,MAAI,CAAC,OAAO,SAAS;AACnB,YAAQ,kCAAkC,OAAO,MAAM,EAAE;AACzD,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,SAAS,KAAK;AAAA,MACnB,OAAO;AAAA,MACP,SAAS,KAAK,WAAW;AAAA,MACzB,OAAO,SAAS;AAAA,MAChB,KAAK,KAAK,OAAO,QAAQ;AAAA,IAC3B,CAAC,EAAE,SAAS,EAAE,KAAK;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,cAAc,KAAqB;AACjD,MAAI,QAAQ;AACV,UAAM,IAAI,IAAI,eAAe,GAAG,yEAAyE,EAAE,SAAS,IAAK,CAAC;AAC1H,WAAO;AAAA,EACT;AACA,SAAO,IAAI,SAAS,GAAG,cAAc;AACvC;AAgBO,SAAS,cAAsB;AACpC,MAAI,OAAQ,QAAO,QAAQ,IAAI,WAAW,KAAK,MAAM,WAAW,SAAS;AACzE,MAAI,OAAQ,QAAO,KAAK,MAAM,WAAW,qBAAqB;AAC9D,SAAO,QAAQ,IAAI,iBAAiB,KAAK,MAAM,UAAU,OAAO;AAClE;AAaO,SAAS,mBAAiC;AAC/C,MAAI,QAAQ;AACV,UAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,MAAM,WAAW,OAAO;AACvE,WAAO;AAAA,MACL,QAAU,KAAK,OAAO,UAAU,UAAU,WAAW;AAAA,MACrD,UAAU,KAAK,OAAO,YAAY,WAAW;AAAA,MAC7C,MAAU,KAAK,OAAO,aAAa,QAAQ,WAAW;AAAA,MACtD,OAAU,KAAK,OAAO,iBAAiB,iBAAiB,WAAW;AAAA,MACnE,SAAU,KAAK,OAAO,WAAW,WAAW;AAAA,MAC5C,OAAU,KAAK,YAAY,GAAG,kBAAkB,cAAc;AAAA,IAChE;AAAA,EACF;AACA,MAAI,QAAQ;AACV,UAAM,MAAM,KAAK,MAAM,WAAW,qBAAqB;AACvD,WAAO;AAAA,MACL,QAAU,KAAK,KAAK,UAAU,QAAQ;AAAA,MACtC,UAAU,KAAK,KAAK,UAAU;AAAA,MAC9B,MAAU,KAAK,KAAK,gBAAgB;AAAA,MACpC,OAAU,KAAK,KAAK,iBAAiB,eAAe;AAAA,MACpD,SAAU,KAAK,KAAK,SAAS;AAAA,MAC7B,OAAU,KAAK,KAAK,yBAAyB;AAAA,IAC/C;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAU,KAAK,MAAM,WAAW,eAAe;AAAA,IAC/C,UAAU,KAAK,MAAM,WAAW,UAAU;AAAA,IAC1C,MAAU,KAAK,MAAM,WAAW,gBAAgB;AAAA,IAChD,OAAU,KAAK,MAAM,WAAW,iBAAiB,eAAe;AAAA,IAChE,SAAU,KAAK,MAAM,WAAW,SAAS;AAAA,IACzC,OAAU,KAAK,MAAM,WAAW,OAAO;AAAA,EACzC;AACF;AAGO,SAAS,kBAA4B;AAC1C,MAAI,QAAQ;AACV,UAAM,UAAU,QAAQ,IAAI,WAAW,KAAK,MAAM,WAAW,SAAS;AACtE,WAAO,CAAC,KAAK,SAAS,WAAW,WAAW,UAAU,CAAC;AAAA,EACzD;AACA,MAAI,QAAQ;AACV,WAAO,CAAC,KAAK,MAAM,WAAW,uBAAuB,WAAW,UAAU,CAAC;AAAA,EAC7E;AAEA,SAAO;AAAA,IACL,KAAK,MAAM,YAAY,SAAS;AAAA,IAChC,KAAK,MAAM,QAAQ,WAAW,UAAU,YAAY,SAAS;AAAA,IAC7D,KAAK,MAAM,QAAQ,OAAO,uBAAuB,YAAY,SAAS;AAAA,EACxE;AACF;AAKO,SAAS,aAAuB;AACrC,QAAM,OAAiB,CAAC;AACxB,MAAI,QAAQ;AACV,UAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,MAAM,WAAW,OAAO;AACvE,UAAM,UAAU,QAAQ,IAAI,WAAW,KAAK,MAAM,WAAW,SAAS;AACtE,SAAK,KAAK,OAAO,OAAO;AACxB,UAAM,KAAK,KAAK,MAAM,WAAW,SAAS,UAAU;AACpD,QAAI,WAAW,EAAE,EAAG,MAAK,KAAK,EAAE;AAAA,EAClC,WAAW,QAAQ;AACjB,SAAK,KAAK,KAAK,MAAM,WAAW,qBAAqB,CAAC;AACtD,QAAI,WAAW,UAAU,EAAG,MAAK,KAAK,UAAU;AAAA,EAClD,OAAO;AACL,UAAM,YAAY,KAAK,MAAM,SAAS;AACtC,UAAM,UAAU,KAAK,MAAM,UAAU,OAAO;AAC5C,QAAI,WAAW,SAAS,EAAG,MAAK,KAAK,SAAS;AAC9C,QAAI,WAAW,OAAO,EAAG,MAAK,KAAK,OAAO;AAC1C,QAAI,WAAW,UAAU,EAAG,MAAK,KAAK,UAAU;AAAA,EAClD;AACA,SAAO,KAAK,OAAO,OAAK,WAAW,CAAC,CAAC;AACvC;AASO,SAAS,UAAU,MAAgB,UAAoB,UAAkB,OAAuB;AACrG,MAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,MAAI,QAAQ;AACV,UAAM,WAAW,SAAS,IAAI,OAAK,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG;AACrD,UAAM,WAAW,KAAK,IAAI,OAAK,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG;AACjD,WAAO;AAAA,MACL,uBAAuB,QAAQ,oBAAoB,QAAQ,aAAa,QAAQ,yDAAyD,KAAK;AAAA,MAC9I,EAAE,SAAS,KAAO;AAAA,IACpB;AAAA,EACF;AACA,QAAM,WAAW,SAAS,IAAI,OAAK,UAAU,CAAC,GAAG,EAAE,KAAK,MAAM;AAC9D,QAAM,WAAW,KAAK,IAAI,OAAK,SAAS,CAAC,eAAe,QAAQ,QAAQ,QAAQ,kBAAkB,EAAE,KAAK,IAAI;AAC7G,SAAO,IAAI,KAAK,QAAQ,eAAe,KAAK,IAAI,EAAE,SAAS,KAAO,CAAC;AACrE;AAKO,SAAS,qBAA6B;AAC3C,MAAI,QAAQ;AAEV,WAAO;AAAA,MACL;AAAA,MAIA,EAAE,SAAS,KAAO;AAAA,IACpB;AAAA,EACF;AACA,MAAI,QAAQ;AAEV,WAAO,IAAI,+FAA+F,EAAE,SAAS,KAAO,CAAC;AAAA,EAC/H;AAEA,SAAO,IAAI,wBAAwB,EAAE,SAAS,IAAO,CAAC;AACxD;AAgBO,SAAS,sBAA8B;AAC5C,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO;AAAA,IACL;AAAA,IASA,EAAE,SAAS,IAAO;AAAA,EACpB;AACF;AAGO,SAAS,wBAAgC;AAC9C,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO;AAAA,IACL;AAAA,IAGA,EAAE,SAAS,IAAO;AAAA,EACpB;AACF;;;ADnSO,SAAS,mBAA2B;AACzC,MAAI,UAAU;AACd,QAAM,MAAM,OAAO;AACnB,MAAI;AACF,eAAW,KAAK,YAAY,GAAG,GAAG;AAChC,UAAI,EAAE,WAAW,aAAa,KAAK,EAAE,SAAS,SAAS,GAAG;AACxD,YAAI;AACF,qBAAWC,MAAK,KAAK,CAAC,CAAC;AACvB;AAAA,QACF,QAAQ;AAAA,QAAoC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAA4B;AACpC,SAAO;AACT;AAiBO,SAAS,YAAY,QAAgB,QAAqC;AAC/E,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,MAAM;AACxB,QAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAAU,QAAO;AAC9D,UAAM,WAAW,EAAE,aAAa,WAAW,UAAmB;AAE9D,UAAM,OAAO,EAAE,OAAO,SAAS,EAAE,MAAM,EAAE,IAAK,aAAa,UAAU,MAAM;AAC3E,UAAM,WAAW,EAAE,SAAS,YAAY;AACxC,QAAI,CAAC,YAAY,aAAa,eAAe,aAAa,YAAa,QAAO;AAC9E,WAAO,EAAE,UAAU,MAAM,UAAU,OAAO;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,WAAW,MAAkB,QAAgB,KAA2B;AACtF,MAAI,KAAK,SAAS,SAAS,KAAK,KAAK;AACnC,UAAM,IAAI,YAAY,KAAK,KAAK,MAAM;AACtC,QAAI,EAAG,KAAI,KAAK,CAAC;AAAA,EACnB;AACA,MAAI,KAAK,UAAU;AACjB,eAAW,SAAS,KAAK,SAAU,YAAW,OAAO,QAAQ,GAAG;AAAA,EAClE;AACF;AAEO,SAAS,eAAe,UAAkB,QAAgC;AAC/E,MAAI,CAACC,YAAW,QAAQ,EAAG,QAAO,CAAC;AACnC,MAAI;AACF,UAAM,MAAM,KAAK,MAAM,aAAa,UAAU,MAAM,CAAC;AAGrD,UAAM,MAAsB,CAAC;AAC7B,eAAW,QAAQ,OAAO,OAAO,IAAI,KAAK,GAAG;AAC3C,UAAI,KAAM,YAAW,MAAM,QAAQ,GAAG;AAAA,IACxC;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,eAAkB,SAAiB,WAAmB,OAA6B;AAChG,MAAI,CAACA,YAAW,OAAO,EAAG,QAAO,CAAC;AAClC,QAAM,MAAMD,MAAK,OAAO,GAAG,cAAc,SAAS,IAAI,KAAK,IAAI,CAAC,SAAS;AACzE,MAAI;AACF,iBAAa,SAAS,GAAG;AACzB,UAAM,EAAE,SAAS,SAAS,IAAI,MAAM,OAAO,gBAAgB;AAC3D,UAAM,KAAK,IAAI,SAAS,KAAK,EAAE,UAAU,MAAM,eAAe,KAAK,CAAC;AACpE,QAAI;AACF,aAAO,GAAG,QAAQ,KAAK,EAAE,IAAI;AAAA,IAC/B,UAAE;AACA,SAAG,MAAM;AAAA,IACX;AAAA,EACF,QAAQ;AACN,WAAO,CAAC;AAAA,EACV,UAAE;AACA,QAAI;AAAE,iBAAW,GAAG;AAAA,IAAG,QAAQ;AAAA,IAAe;AAAA,EAChD;AACF;AAEA,eAAe,qBAAqB,YAA6C;AAC/E,QAAM,OAAO,MAAM;AAAA,IACjBA,MAAK,YAAY,eAAe;AAAA,IAAG;AAAA,IACnC;AAAA;AAAA;AAAA,EAGF;AACA,SAAO,KAAK,IAAI,OAAK,YAAY,EAAE,KAAK,SAAS,CAAC,EAAE,OAAO,CAAC,MAAyB,MAAM,IAAI;AACjG;AAEA,eAAsB,mBAAmB,YAA4C;AACnF,QAAM,OAAO,MAAM;AAAA,IACjBA,MAAK,YAAY,eAAe;AAAA,IAAG;AAAA,IACnC;AAAA;AAAA;AAAA,EAGF;AACA,SAAO,KACJ,IAAI,OAAK;AACR,UAAM,IAAI,YAAY,EAAE,KAAK,SAAS;AACtC,WAAO,IAAI,EAAE,GAAG,GAAG,YAAY,EAAE,YAAY,IAAI;AAAA,EACnD,CAAC,EACA,OAAO,CAAC,MAAwB,MAAM,IAAI;AAC/C;AAEA,eAAe,oBAAoB,aAAqB,QAAwC;AAC9F,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IAAa;AAAA,IACb;AAAA;AAAA;AAAA,EAGF;AACA,SAAO,KACJ,IAAI,OAAK;AACR,UAAM,IAAI,YAAY,EAAE,KAAK,MAAM;AACnC,WAAO,IAAI,EAAE,GAAG,GAAG,YAAY,EAAE,YAAY,IAAI;AAAA,EACnD,CAAC,EACA,OAAO,CAAC,MAAwB,MAAM,IAAI;AAC/C;AAKA,IAAME,YAAW,CAAC,UAAU,CAAC;AAGtB,SAAS,gBAAgB,MAAwB;AACtD,QAAM,QAAkB,CAAC;AACzB,QAAM,cAAcF,MAAK,MAAM,WAAW,WAAW;AACrD,MAAIC,YAAW,WAAW,EAAG,OAAM,KAAK,WAAW;AAEnD,MAAIA,YAAW,IAAI,GAAG;AACpB,QAAI;AACF,iBAAW,SAAS,YAAY,IAAI,GAAG;AACrC,YAAI,MAAM,WAAW,UAAU,GAAG;AAChC,gBAAM,IAAID,MAAK,MAAM,OAAO,WAAW;AACvC,cAAIC,YAAW,CAAC,EAAG,OAAM,KAAK,CAAC;AAAA,QACjC;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAe;AAAA,EACzB;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,MAAwB;AAC7D,QAAM,QAAkB,CAAC;AACzB,QAAM,cAAcD,MAAK,MAAM,WAAW,SAAS;AACnD,MAAIC,YAAW,WAAW,EAAG,OAAM,KAAK,WAAW;AACnD,MAAIA,YAAW,IAAI,GAAG;AACpB,QAAI;AACF,iBAAW,SAAS,YAAY,IAAI,GAAG;AACrC,YAAI,MAAM,WAAW,UAAU,GAAG;AAChC,gBAAM,IAAID,MAAK,MAAM,OAAO,SAAS;AACrC,cAAIC,YAAW,CAAC,EAAG,OAAM,KAAK,CAAC;AAAA,QACjC;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAe;AAAA,EACzB;AACA,SAAO;AACT;AAGA,IAAM,gBAAgB,iBAAiB;AAEvC,IAAM,cAAc,cAAc;AAClC,IAAM,gBAAgB,cAAc;AACpC,IAAM,YAAY,cAAc;AAChC,IAAM,aAAa,cAAc;AACjC,IAAM,eAAe,cAAc;AACnC,IAAM,aAAa,cAAc;AAGjC,IAAM,qBAAqBD,MAAK,MAAM,QAAQ,YAAY,UAAU,UAAU;AAC9E,IAAM,wBAAwBA,MAAK,MAAM,QAAQ,OAAO,yBAAyB,UAAU,UAAU;AACrG,IAAM,sBAAsBA,MAAK,MAAM,QAAQ,OAAO,qBAAqB,UAAU,eAAe;AACpG,IAAM,qBAAqBA,MAAK,MAAM,QAAQ,OAAO,qBAAqB,UAAU,iBAAiB,eAAe;AACpH,IAAM,oBAAoBA,MAAK,MAAM,QAAQ,OAAO,sBAAsB,UAAU,gBAAgB;AAEpG,SAAS,qBAA+B;AACtC,QAAM,QAAQ,gBAAgB;AAC9B,QAAM,OAAiB,CAAC;AACxB,aAAW,QAAQ,OAAO;AACxB,QAAI,CAACC,YAAW,IAAI,EAAG;AACvB,QAAI;AACF,iBAAW,KAAK,YAAY,IAAI,GAAG;AACjC,cAAM,OAAOD,MAAK,MAAM,CAAC;AACzB,YAAI;AACF,cAAI,SAAS,IAAI,EAAE,YAAY,KAAKC,YAAWD,MAAK,MAAM,eAAe,CAAC,GAAG;AAC3E,iBAAK,KAAK,IAAI;AAAA,UAChB;AAAA,QACF,QAAQ;AAAA,QAAe;AAAA,MACzB;AAAA,IACF,QAAQ;AAAA,IAAe;AAAA,EACzB;AACA,SAAO;AACT;AAIA,eAAsB,mBAA4C;AAChE,QAAM,MAAsB,CAAC;AAG7B,aAAW,KAAK,gBAAgB,WAAW,EAAK,KAAI,KAAK,GAAG,eAAe,GAAG,QAAQ,CAAC;AACvF,aAAW,KAAK,gBAAgB,aAAa,EAAG,KAAI,KAAK,GAAG,eAAe,GAAG,UAAU,CAAC;AACzF,aAAW,KAAK,gBAAgB,SAAS,EAAO,KAAI,KAAK,GAAG,eAAe,GAAG,MAAM,CAAC;AACrF,aAAW,KAAK,gBAAgB,UAAU,EAAM,KAAI,KAAK,GAAG,eAAe,GAAG,OAAO,CAAC;AACtF,aAAW,KAAK,gBAAgB,YAAY,EAAI,KAAI,KAAK,GAAG,eAAe,GAAG,SAAS,CAAC;AACxF,aAAW,KAAK,gBAAgB,UAAU,EAAM,KAAI,KAAK,GAAG,eAAe,GAAG,OAAO,CAAC;AAGtF,MAAIE,WAAU;AACZ,eAAW,KAAK,gBAAgB,kBAAkB,EAAM,KAAI,KAAK,GAAG,eAAe,GAAG,eAAe,CAAC;AACtG,eAAW,KAAK,gBAAgB,qBAAqB,EAAG,KAAI,KAAK,GAAG,eAAe,GAAG,kBAAkB,CAAC;AACzG,eAAW,KAAK,gBAAgB,mBAAmB,EAAK,KAAI,KAAK,GAAG,eAAe,GAAG,gBAAgB,CAAC;AACvG,eAAW,KAAK,gBAAgB,kBAAkB,EAAM,KAAI,KAAK,GAAG,eAAe,GAAG,eAAe,CAAC;AACtG,eAAW,KAAK,gBAAgB,iBAAiB,EAAO,KAAI,KAAK,GAAG,eAAe,GAAG,cAAc,CAAC;AAAA,EACvG;AAGA,aAAW,OAAO,mBAAmB,GAAG;AACtC,QAAI,KAAK,GAAG,MAAM,qBAAqB,GAAG,CAAC;AAAA,EAC7C;AAGA,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,IAAI,OAAO,OAAK;AACrB,QAAI,KAAK,IAAI,EAAE,QAAQ,EAAG,QAAO;AACjC,SAAK,IAAI,EAAE,QAAQ;AACnB,WAAO;AAAA,EACT,CAAC;AACH;AAEA,eAAsB,iBAAyC;AAC7D,QAAM,MAAqB,CAAC;AAG5B,aAAW,KAAK,uBAAuB,WAAW,EAAK,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACzG,aAAW,KAAK,uBAAuB,aAAa,EAAG,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAC3G,aAAW,KAAK,uBAAuB,SAAS,EAAO,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACvG,aAAW,KAAK,uBAAuB,UAAU,EAAM,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACxG,aAAW,KAAK,uBAAuB,YAAY,EAAI,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAC1G,aAAW,KAAK,uBAAuB,UAAU,EAAM,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAGxG,MAAIA,WAAU;AACZ,eAAW,KAAK,uBAAuB,kBAAkB,EAAM,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACxH,eAAW,KAAK,uBAAuB,qBAAqB,EAAG,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAC3H,eAAW,KAAK,uBAAuB,mBAAmB,EAAK,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACzH,eAAW,KAAK,uBAAuB,kBAAkB,EAAM,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACxH,eAAW,KAAK,uBAAuB,iBAAiB,EAAO,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAAA,EACzH;AAGA,aAAW,OAAO,mBAAmB,GAAG;AACtC,QAAI,KAAK,GAAG,MAAM,mBAAmB,GAAG,CAAC;AAAA,EAC3C;AAGA,QAAM,SAAS,oBAAI,IAAyB;AAC5C,aAAW,KAAK,KAAK;AACnB,UAAM,WAAW,OAAO,IAAI,EAAE,QAAQ;AACtC,QAAI,UAAU;AACZ,eAAS,cAAc,EAAE;AAAA,IAC3B,OAAO;AACL,aAAO,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAAA,IACjC;AAAA,EACF;AAGA,SAAO,CAAC,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU;AACxE;","names":["existsSync","join","join","existsSync","IS_LINUX"]}

package/dist/chunk-D6SRSLBF.js

@@ -1,48 +0,0 @@
-var __create = Object.create;
-var __defProp = Object.defineProperty;
-var __getOwnPropDesc = Object.getOwnPropertyDescriptor;
-var __getOwnPropNames = Object.getOwnPropertyNames;
-var __getProtoOf = Object.getPrototypeOf;
-var __hasOwnProp = Object.prototype.hasOwnProperty;
-var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
-  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
-}) : x)(function(x) {
-  if (typeof require !== "undefined") return require.apply(this, arguments);
-  throw Error('Dynamic require of "' + x + '" is not supported');
-});
-var __glob = (map) => (path) => {
-  var fn = map[path];
-  if (fn) return fn();
-  throw new Error("Module not found in bundle: " + path);
-};
-var __esm = (fn, res) => function __init() {
-  return fn && (res = (0, fn[__getOwnPropNames(fn)[0]])(fn = 0)), res;
-};
-var __commonJS = (cb, mod) => function __require2() {
-  return mod || (0, cb[__getOwnPropNames(cb)[0]])((mod = { exports: {} }).exports, mod), mod.exports;
-};
-var __copyProps = (to, from, except, desc) => {
-  if (from && typeof from === "object" || typeof from === "function") {
-    for (let key of __getOwnPropNames(from))
-      if (!__hasOwnProp.call(to, key) && key !== except)
-        __defProp(to, key, { get: () => from[key], enumerable: !(desc = __getOwnPropDesc(from, key)) || desc.enumerable });
-  }
-  return to;
-};
-var __toESM = (mod, isNodeMode, target) => (target = mod != null ? __create(__getProtoOf(mod)) : {}, __copyProps(
-  // If the importer is in node compatibility mode or this is not an ESM
-  // file that has been converted to a CommonJS file using a Babel-
-  // compatible transform (i.e. "__esModule" has not been set), then set
-  // "default" to the CommonJS "module.exports" for node compatibility.
-  isNodeMode || !mod || !mod.__esModule ? __defProp(target, "default", { value: mod, enumerable: true }) : target,
-  mod
-));
-
-export {
-  __require,
-  __glob,
-  __esm,
-  __commonJS,
-  __toESM
-};
-//# sourceMappingURL=chunk-D6SRSLBF.js.map