@event4u/agent-config 2.26.0 → 3.0.0

package/dist/discovery/discovery-manifest.json.sha256

@@ -0,0 +1 @@
+8eb370ada0d403b9d94a186773b0766c9f7dae9cf144278e5392a3c3e07893fb  discovery-manifest.json

package/dist/discovery/discovery-manifest.summary.md

@@ -0,0 +1,93 @@
+# Discovery Manifest — Summary
+
+- Generated: `2026-05-21T07:20:57Z`
+- Scanner: `9dad9aa8b222`
+- Artefacts: **419**
+- Unassigned: **0**
+
+## `engineering` — Engineering
+
+> Code, tests, CI, reviews, architecture.
+
+| Pack | Artefacts |
+|---|---|
+| `engineering-base` — Engineering Base | 83 |
+| `php` — PHP | 6 |
+| `laravel` — Laravel | 25 |
+| `symfony` — Symfony | 3 |
+| `javascript` — JavaScript | 0 |
+| `typescript` — TypeScript | 1 |
+| `react` — React | 3 |
+| `nextjs` — Next.js | 2 |
+| `python` — Python | 1 |
+
+## `product` — Product
+
+> Discovery, roadmaps, prioritisation, AC tightening.
+
+| Pack | Artefacts |
+|---|---|
+| `product-basic` — Product Basic | 11 |
+| `product-discovery` — Product Discovery | 4 |
+
+## `finance` — Finance / CFO
+
+> Cashflow, forecasting, DCF, board reporting.
+
+| Pack | Artefacts |
+|---|---|
+| `finance-basic` — Finance Basic | 3 |
+| `finance-advanced` — Finance Advanced | 2 |
+
+## `founder` — Founder
+
+> Strategy, fundraising, vision, board narrative.
+
+| Pack | Artefacts |
+|---|---|
+| `founder-strategy` — Founder — Strategy | 7 |
+| `finance-basic` — Finance Basic | 3 |
+| `gtm-marketing` — GTM — Marketing | 8 |
+
+## `gtm` — Go-to-Market
+
+> Sales pipeline, marketing, positioning, launch.
+
+| Pack | Artefacts |
+|---|---|
+| `gtm-sales` — GTM — Sales | 4 |
+| `gtm-marketing` — GTM — Marketing | 8 |
+
+## `ops` — Operations
+
+> Hiring, comp, perf, org design, runbooks.
+
+| Pack | Artefacts |
+|---|---|
+| `ops-people` — Operations — People | 8 |
+
+## `small-business` — Small Business
+
+> Self-employed / SMB-shaped owner workflows.
+
+| Pack | Artefacts |
+|---|---|
+| `small-business` — Small Business | 0 |
+| `ai-video` — AI Video | 6 |
+
+## `construction` — Construction
+
+> Trade-business workflows (planning, quotes).
+
+| Pack | Artefacts |
+|---|---|
+| `construction` — Construction | 0 |
+
+## `agent-config-maintainer` — Maintainer
+
+> Skills/rules/commands that maintain this package.
+
+| Pack | Artefacts |
+|---|---|
+| `meta` — Meta | 242 |
+

package/dist/mcp/awesome-mcp-servers.row.md

@@ -0,0 +1 @@
+| [@event4u/agent-config](https://github.com/event4u-app/agent-config#readme) | Universal AI Agent OS — audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot). | 20 tools (stdio, worker) | `pip install agent-config[mcp] && ./agent-config mcp:run` |

package/dist/mcp/mcp-cloudflare-catalogue.json

@@ -0,0 +1,27 @@
+{
+  "description": "Universal AI Agent OS \u2014 audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
+  "homepage": "https://github.com/event4u-app/agent-config#readme",
+  "install_hint_stdio": "pip install agent-config[mcp] && ./agent-config mcp:run",
+  "name": "agent-config-mcp",
+  "repository": "https://github.com/event4u-app/agent-config",
+  "tools_count": 20,
+  "topics": [
+    "agent-governance",
+    "ai-agent",
+    "ai-video",
+    "claude-code",
+    "copilot",
+    "cursor",
+    "llm",
+    "mcp",
+    "prompt-engineering",
+    "python",
+    "skills",
+    "typescript",
+    "windsurf"
+  ],
+  "transports": [
+    "stdio",
+    "worker"
+  ]
+}

package/dist/mcp/registry-manifest.json

@@ -0,0 +1,63 @@
+{
+  "discovery": {
+    "artefact_count": 419,
+    "scanner_version": "9dad9aa8b222"
+  },
+  "generated_at": "2026-05-21",
+  "package": {
+    "description": "Universal AI Agent OS \u2014 audited skills, governance rules, commands, and templates for AI coding tools (Claude Code, Cursor, Windsurf, Copilot).",
+    "homepage": "https://github.com/event4u-app/agent-config#readme",
+    "name": "@event4u/agent-config",
+    "repository": "https://github.com/event4u-app/agent-config",
+    "version": "3.0.0"
+  },
+  "registries": [
+    {
+      "id": "awesome-mcp-servers",
+      "label": "punkpeye/awesome-mcp-servers",
+      "last_verified": null,
+      "listing_format": "markdown-row",
+      "pr_url": null,
+      "rendered_payload": "dist/mcp/awesome-mcp-servers.row.md",
+      "status": "pending",
+      "submission_url": "https://github.com/punkpeye/awesome-mcp-servers",
+      "submitted_at": null
+    },
+    {
+      "id": "mcp-cloudflare-catalogue",
+      "label": "Cloudflare MCP catalogue",
+      "last_verified": null,
+      "listing_format": "json-entry",
+      "pr_url": null,
+      "rendered_payload": "dist/mcp/mcp-cloudflare-catalogue.json",
+      "status": "pending",
+      "submission_url": "https://github.com/cloudflare/mcp-server-cloudflare",
+      "submitted_at": null
+    }
+  ],
+  "server": {
+    "install_hint_stdio": "pip install agent-config[mcp] && ./agent-config mcp:run",
+    "name": "agent-config-mcp",
+    "tools_count": 20,
+    "transports": [
+      "stdio",
+      "worker"
+    ]
+  },
+  "topics": [
+    "agent-governance",
+    "ai-agent",
+    "ai-video",
+    "claude-code",
+    "copilot",
+    "cursor",
+    "llm",
+    "mcp",
+    "prompt-engineering",
+    "python",
+    "skills",
+    "typescript",
+    "windsurf"
+  ],
+  "version": 1
+}

package/dist/server/app.js

@@ -0,0 +1,117 @@
+/**
+ * Fastify app factory for the local server.
+ *
+ * Security stance — council security-engineer mandate:
+ *
+ *   1. Bind to 127.0.0.1 only (enforced by the caller in
+ *      `src/cli/commands/uiServe.ts`).
+ *   2. `Host` header must be `127.0.0.1:<port>` or
+ *      `localhost:<port>`. Rejected with HTTP 421 otherwise.
+ *   3. `Origin` header (when present) must be the same origin as
+ *      the server. Rejected with HTTP 403 otherwise.
+ *   4. `/api/*` routes require `Authorization: Bearer <token>` or
+ *      a `token=<token>` query parameter. Rejected with HTTP 401
+ *      otherwise. The token is minted per process by
+ *      `src/server/token.ts`.
+ *
+ * Static files under `/` (the Vite UI bundle) are served without
+ * auth so the browser can bootstrap. The UI then includes the token
+ * on every API call.
+ */
+import Fastify from 'fastify';
+import fastifyStatic from '@fastify/static';
+import { tokensMatch } from './token.js';
+import { pingRoute } from './routes/ping.js';
+import { discoveryRoute } from './routes/discovery.js';
+import { schemaRoute } from './routes/schema.js';
+import { settingsRoute } from './routes/settings.js';
+import { userMdRoute } from './routes/userMd.js';
+import { wizardRoute } from './routes/wizard.js';
+import { replayPendingCommits } from './io/atomicMultiWrite.js';
+import { PACKAGE_ROOT } from '../cli/paths.js';
+const ALLOWED_HOSTS = (port) => new Set([`127.0.0.1:${port}`, `localhost:${port}`]);
+const ALLOWED_ORIGINS = (port) => new Set([`http://127.0.0.1:${port}`, `http://localhost:${port}`]);
+function extractToken(authHeader, queryToken) {
+    if (typeof authHeader === 'string' && authHeader.startsWith('Bearer ')) {
+        return authHeader.slice('Bearer '.length).trim();
+    }
+    if (typeof queryToken === 'string' && queryToken.length > 0)
+        return queryToken;
+    return null;
+}
+export async function createApp(opts) {
+    const app = Fastify({
+        logger: { level: opts.logLevel ?? (process.env.AGENT_CONFIG_LOG ?? 'warn') },
+    });
+    const allowedHosts = ALLOWED_HOSTS(opts.expectedPort);
+    const allowedOrigins = ALLOWED_ORIGINS(opts.expectedPort);
+    // Host-header guard (CSRF defence-in-depth — runs on every request).
+    app.addHook('onRequest', async (request, reply) => {
+        const host = request.headers.host;
+        if (typeof host !== 'string' || !allowedHosts.has(host)) {
+            await reply.code(421).send({ error: 'Misdirected Request: invalid Host header' });
+            return reply;
+        }
+        return undefined;
+    });
+    // Origin allow-list (browser-issued requests only — server-to-server
+    // skips this header).
+    app.addHook('onRequest', async (request, reply) => {
+        const origin = request.headers.origin;
+        if (typeof origin === 'string' && !allowedOrigins.has(origin)) {
+            await reply.code(403).send({ error: 'Forbidden: origin not allowed' });
+            return reply;
+        }
+        return undefined;
+    });
+    // Bearer-token gate for /api/*. Static UI files are NOT gated so
+    // the browser can bootstrap and read the token from the page URL.
+    app.addHook('onRequest', async (request, reply) => {
+        if (!request.url.startsWith('/api/'))
+            return undefined;
+        const query = request.query;
+        const queryToken = typeof query?.['token'] === 'string' ? query['token'] : undefined;
+        const provided = extractToken(request.headers.authorization, queryToken);
+        if (provided === null || !tokensMatch(provided, opts.token)) {
+            await reply.code(401).send({ error: 'Unauthorized: missing or invalid token' });
+            return reply;
+        }
+        return undefined;
+    });
+    await app.register(fastifyStatic, {
+        root: opts.uiDistDir,
+        prefix: '/',
+        decorateReply: false,
+    });
+    const packageRoot = opts.packageRoot ?? PACKAGE_ROOT;
+    const dryRun = opts.dryRun === true;
+    const writeRoot = opts.writeRoot ?? opts.projectRoot;
+    if (writeRoot === undefined) {
+        throw new Error('createApp: writeRoot (or projectRoot) is required');
+    }
+    const legacyReadRoot = opts.legacyReadRoot ?? null;
+    const mode = opts.mode ?? 'global';
+    await app.register(pingRoute({ writeRoot, mode, dryRun }));
+    await app.register(discoveryRoute(opts.discoveryManifestPath ? { manifestPath: opts.discoveryManifestPath } : {}));
+    await app.register(schemaRoute());
+    await app.register(settingsRoute({ writeRoot, legacyReadRoot, dryRun }));
+    await app.register(userMdRoute({ writeRoot, legacyReadRoot, dryRun }));
+    await app.register(wizardRoute({ writeRoot, packageRoot, dryRun }));
+    // Boot-time 2PC replay — finishes or aborts any wizard commit that
+    // crashed mid-rename. Idempotent; failures are logged and ignored so
+    // a corrupt marker never blocks server start. Skipped in dry-run: a
+    // crashed real run must not be auto-finished by a maintainer preview.
+    if (opts.skipReplay !== true && !dryRun) {
+        try {
+            const result = await replayPendingCommits(writeRoot);
+            if (result.completed.length > 0 || result.aborted.length > 0) {
+                app.log.warn({ completed: result.completed, aborted: result.aborted }, '2PC replay: pending wizard commits resolved');
+            }
+        }
+        catch (err) {
+            app.log.error({ err }, '2PC replay: unexpected error (ignored)');
+        }
+    }
+    return app;
+}
+//# sourceMappingURL=app.js.map

package/dist/server/app.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"app.js","sourceRoot":"","sources":["../../src/server/app.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AAEH,OAAO,OAAiC,MAAM,SAAS,CAAC;AACxD,OAAO,aAAa,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,WAAW,EAAE,MAAM,YAAY,CAAC;AACzC,OAAO,EAAE,SAAS,EAAE,MAAM,kBAAkB,CAAC;AAC7C,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,sBAAsB,CAAC;AACrD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,WAAW,EAAE,MAAM,oBAAoB,CAAC;AACjD,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAwD/C,MAAM,aAAa,GAAG,CAAC,IAAY,EAAuB,EAAE,CACxD,IAAI,GAAG,CAAC,CAAC,aAAa,IAAI,EAAE,EAAE,aAAa,IAAI,EAAE,CAAC,CAAC,CAAC;AAExD,MAAM,eAAe,GAAG,CAAC,IAAY,EAAuB,EAAE,CAC1D,IAAI,GAAG,CAAC,CAAC,oBAAoB,IAAI,EAAE,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC,CAAC;AAEtE,SAAS,YAAY,CAAC,UAA8B,EAAE,UAA8B;IAChF,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;QACrE,OAAO,UAAU,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,IAAI,EAAE,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,UAAU,CAAC;IAC/E,OAAO,IAAI,CAAC;AAChB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,SAAS,CAAC,IAAsB;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC;QAChB,MAAM,EAAE,EAAE,KAAK,EAAE,IAAI,CAAC,QAAQ,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,MAAM,CAAC,EAAE;KAC/E,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,aAAa,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IACtD,MAAM,cAAc,GAAG,eAAe,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC;IAE1D,qEAAqE;IACrE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,IAAI,GAAG,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC;QAClC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YACtD,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,0CAA0C,EAAE,CAAC,CAAC;YAClF,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,qEAAqE;IACrE,sBAAsB;IACtB,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9C,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC;QACtC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,MAAM,CAAC,EAAE,CAAC;YAC5D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,+BAA+B,EAAE,CAAC,CAAC;YACvE,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,iEAAiE;IACjE,kEAAkE;IAClE,GAAG,CAAC,OAAO,CAAC,WAAW,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE;QAC9C,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,OAAO,CAAC;YAAE,OAAO,SAAS,CAAC;QACvD,MAAM,KAAK,GAAG,OAAO,CAAC,KAA4C,CAAC;QACnE,MAAM,UAAU,GAAG,OAAO,KAAK,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC,CAAE,KAAK,CAAC,OAAO,CAAY,CAAC,CAAC,CAAC,SAAS,CAAC;QACjG,MAAM,QAAQ,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,CAAC,aAAa,EAAE,UAAU,CAAC,CAAC;QACzE,IAAI,QAAQ,KAAK,IAAI,IAAI,CAAC,WAAW,CAAC,QAAQ,EAAE,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YAC1D,MAAM,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,wCAAwC,EAAE,CAAC,CAAC;YAChF,OAAO,KAAK,CAAC;QACjB,CAAC;QACD,OAAO,SAAS,CAAC;IACrB,CAAC,CAAC,CAAC;IAEH,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,EAAE;QAC9B,IAAI,EAAE,IAAI,CAAC,SAAS;QACpB,MAAM,EAAE,GAAG;QACX,aAAa,EAAE,KAAK;KACvB,CAAC,CAAC;IAEH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,YAAY,CAAC;IACrD,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,KAAK,IAAI,CAAC;IACpC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,CAAC;IACrD,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;QAC1B,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IACzE,CAAC;IACD,MAAM,cAAc,GAAG,IAAI,CAAC,cAAc,IAAI,IAAI,CAAC;IACnD,MAAM,IAAI,GAAgB,IAAI,CAAC,IAAI,IAAI,QAAQ,CAAC;IAEhD,MAAM,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAC3D,MAAM,GAAG,CAAC,QAAQ,CACd,cAAc,CAAC,IAAI,CAAC,qBAAqB,CAAC,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CACjG,CAAC;IACF,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAC,CAAC;IAClC,MAAM,GAAG,CAAC,QAAQ,CAAC,aAAa,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACzE,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,cAAc,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IACvE,MAAM,GAAG,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS,EAAE,WAAW,EAAE,MAAM,EAAE,CAAC,CAAC,CAAC;IAEpE,mEAAmE;IACnE,qEAAqE;IACrE,oEAAoE;IACpE,sEAAsE;IACtE,IAAI,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;QACtC,IAAI,CAAC;YACD,MAAM,MAAM,GAAG,MAAM,oBAAoB,CAAC,SAAS,CAAC,CAAC;YACrD,IAAI,MAAM,CAAC,SAAS,CAAC,MAAM,GAAG,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;gBAC3D,GAAG,CAAC,GAAG,CAAC,IAAI,CACR,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,OAAO,EAAE,MAAM,CAAC,OAAO,EAAE,EACxD,6CAA6C,CAChD,CAAC;YACN,CAAC;QACL,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,GAAG,EAAE,EAAE,wCAAwC,CAAC,CAAC;QACrE,CAAC;IACL,CAAC;IAED,OAAO,GAAG,CAAC;AACf,CAAC"}

package/dist/server/io/atomicMultiWrite.js

@@ -0,0 +1,202 @@
+/**
+ * Multi-file atomic write with a 2PC intent marker.
+ *
+ * The wizard commits `.agent-settings.yml` and `.agent-user.md` in one
+ * gesture. A crash between the two renames would leave the project in a
+ * mixed state — settings new, user-md stale, or vice versa — which the
+ * council's HIGH-severity finding flagged as the worst case.
+ *
+ * Protocol (write phase):
+ *   1. Write every payload to its `<target>.tmp-<txnId>` sibling, fsync.
+ *   2. Write a `state/wizard-intent-<txnId>.json` marker listing the
+ *      `{tmp,target}` pairs. fsync the marker.
+ *   3. For each pair: rename tmp → target.
+ *   4. Unlink the marker.
+ *
+ * Crash recovery (replay on next boot, `replayPendingCommits`):
+ *   - Marker present + every `tmp` exists → finish the renames, unlink.
+ *   - Marker present + any `tmp` missing → assume aborted mid-prepare:
+ *     unlink the leftover tmps and the marker (target untouched).
+ *
+ * State dir lives under `<writeRoot>/state/` — in package-sandbox mode
+ * `writeRoot` is `<repo>/agents/`, so the marker dir is the gitignored
+ * `agents/runtime/state/` already shipped by the package gitignore template. In
+ * global mode `writeRoot` is `~/.event4u/agent-config/` and the marker
+ * dir lives outside any project tree.
+ */
+import { promises as fs } from 'node:fs';
+import { randomUUID } from 'node:crypto';
+import { dirname, join } from 'node:path';
+import { tempPathFor } from './atomicWrite.js';
+const DEFAULT_MODE = 0o600;
+const STATE_SUBDIR = 'state';
+function markerPath(writeRoot, txnId) {
+    return join(writeRoot, STATE_SUBDIR, `wizard-intent-${txnId}.json`);
+}
+async function fsyncFile(path) {
+    const handle = await fs.open(path, 'r+');
+    try {
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+async function writeJsonFsync(path, body) {
+    await fs.mkdir(dirname(path), { recursive: true });
+    const handle = await fs.open(path, 'w', 0o600);
+    try {
+        await handle.writeFile(JSON.stringify(body, null, 2));
+        await handle.sync();
+    }
+    finally {
+        await handle.close();
+    }
+}
+/**
+ * Commit every payload atomically. Resolves only after the marker has
+ * been unlinked — meaning every rename succeeded. On error, the caller
+ * sees the original files untouched; replay handles any leftover tmps.
+ */
+export async function commitMulti(payloads, opts) {
+    if (payloads.length === 0) {
+        throw new Error('commitMulti: at least one payload required');
+    }
+    const txnId = opts.txnId ?? randomUUID();
+    const entries = payloads.map((p) => ({
+        tmp: tempPathFor(p.target, txnId),
+        target: p.target,
+        mode: p.mode ?? DEFAULT_MODE,
+    }));
+    // Phase 1: write every tmp with fsync.
+    for (let i = 0; i < payloads.length; i++) {
+        const payload = payloads[i];
+        const entry = entries[i];
+        const { contents } = payload;
+        const { tmp, mode } = entry;
+        const handle = await fs.open(tmp, 'w', mode);
+        try {
+            const buf = typeof contents === 'string' ? Buffer.from(contents, 'utf8') : contents;
+            await handle.writeFile(buf);
+            await handle.sync();
+        }
+        finally {
+            await handle.close();
+        }
+    }
+    // Phase 2: write intent marker, fsync.
+    const marker = {
+        version: 1,
+        txnId,
+        createdAt: new Date().toISOString(),
+        entries,
+    };
+    const mPath = markerPath(opts.writeRoot, txnId);
+    await writeJsonFsync(mPath, marker);
+    // Phase 3: rename every tmp → target. A crash here is recoverable
+    // because the marker still points at every pending rename.
+    try {
+        for (const entry of entries) {
+            try {
+                await fs.rename(entry.tmp, entry.target);
+            }
+            catch (err) {
+                if (err.code === 'EPERM') {
+                    await fs.unlink(entry.target).catch(() => undefined);
+                    await fs.rename(entry.tmp, entry.target);
+                }
+                else {
+                    throw err;
+                }
+            }
+            await fs.chmod(entry.target, entry.mode).catch(() => undefined);
+        }
+    }
+    catch (err) {
+        // Mid-commit failure: leave the marker for replay, surface the error.
+        throw err;
+    }
+    // Phase 4: marker no longer needed.
+    await fs.unlink(mPath).catch(() => undefined);
+    await fsyncFile(dirname(mPath)).catch(() => undefined);
+    return { txnId };
+}
+/**
+ * Replay pending commit-intent markers at boot. For each marker:
+ *   - Every tmp exists → finish the renames (commit was in-flight).
+ *   - Any tmp missing → assume aborted; unlink leftover tmps and the
+ *     marker (target was never touched).
+ *
+ * Idempotent: safe to call on every server start. Never throws on a
+ * single corrupted marker — that marker is skipped and reported via
+ * the returned arrays so the caller can log and continue.
+ */
+export async function replayPendingCommits(writeRoot) {
+    const stateDir = join(writeRoot, STATE_SUBDIR);
+    let names;
+    try {
+        names = await fs.readdir(stateDir);
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return { completed: [], aborted: [] };
+        throw err;
+    }
+    const completed = [];
+    const aborted = [];
+    for (const name of names) {
+        if (!name.startsWith('wizard-intent-') || !name.endsWith('.json'))
+            continue;
+        const mPath = join(stateDir, name);
+        let marker;
+        try {
+            const raw = await fs.readFile(mPath, 'utf8');
+            marker = JSON.parse(raw);
+            if (marker.version !== 1 || !Array.isArray(marker.entries))
+                throw new Error('bad marker');
+        }
+        catch {
+            aborted.push(name);
+            await fs.unlink(mPath).catch(() => undefined);
+            continue;
+        }
+        const presence = await Promise.all(marker.entries.map(async (e) => fs
+            .stat(e.tmp)
+            .then(() => true)
+            .catch(() => false)));
+        const allTmpsPresent = presence.every(Boolean);
+        if (allTmpsPresent) {
+            try {
+                for (const entry of marker.entries) {
+                    try {
+                        await fs.rename(entry.tmp, entry.target);
+                    }
+                    catch (err) {
+                        if (err.code === 'EPERM') {
+                            await fs.unlink(entry.target).catch(() => undefined);
+                            await fs.rename(entry.tmp, entry.target);
+                        }
+                        else {
+                            throw err;
+                        }
+                    }
+                    await fs.chmod(entry.target, entry.mode).catch(() => undefined);
+                }
+                await fs.unlink(mPath).catch(() => undefined);
+                completed.push(marker.txnId);
+            }
+            catch {
+                aborted.push(marker.txnId);
+            }
+        }
+        else {
+            for (const entry of marker.entries) {
+                await fs.unlink(entry.tmp).catch(() => undefined);
+            }
+            await fs.unlink(mPath).catch(() => undefined);
+            aborted.push(marker.txnId);
+        }
+    }
+    return { completed, aborted };
+}
+//# sourceMappingURL=atomicMultiWrite.js.map

package/dist/server/io/atomicMultiWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomicMultiWrite.js","sourceRoot":"","sources":["../../../src/server/io/atomicMultiWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,kBAAkB,CAAC;AA+B/C,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,YAAY,GAAG,OAAO,CAAC;AAE7B,SAAS,UAAU,CAAC,SAAiB,EAAE,KAAa;IAChD,OAAO,IAAI,CAAC,SAAS,EAAE,YAAY,EAAE,iBAAiB,KAAK,OAAO,CAAC,CAAC;AACxE,CAAC;AAED,KAAK,UAAU,SAAS,CAAC,IAAY;IACjC,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,IAAI,CAAC,CAAC;IACzC,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACP,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;AACL,CAAC;AAED,KAAK,UAAU,cAAc,CAAC,IAAY,EAAE,IAAa;IACrD,MAAM,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,CAAC;QACD,MAAM,MAAM,CAAC,SAAS,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC;QACtD,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;IACxB,CAAC;YAAS,CAAC;QACP,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;IACzB,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC7B,QAAyB,EACzB,IAAmB;IAEnB,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CAAC,4CAA4C,CAAC,CAAC;IAClE,CAAC;IACD,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,UAAU,EAAE,CAAC;IACzC,MAAM,OAAO,GAAkB,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC;QAChD,GAAG,EAAE,WAAW,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,CAAC;QACjC,MAAM,EAAE,CAAC,CAAC,MAAM;QAChB,IAAI,EAAE,CAAC,CAAC,IAAI,IAAI,YAAY;KAC/B,CAAC,CAAC,CAAC;IAEJ,uCAAuC;IACvC,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACvC,MAAM,OAAO,GAAG,QAAQ,CAAC,CAAC,CAAE,CAAC;QAC7B,MAAM,KAAK,GAAG,OAAO,CAAC,CAAC,CAAE,CAAC;QAC1B,MAAM,EAAE,QAAQ,EAAE,GAAG,OAAO,CAAC;QAC7B,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,GAAG,KAAK,CAAC;QAC5B,MAAM,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QAC7C,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;YACpF,MAAM,MAAM,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;YAC5B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACxB,CAAC;gBAAS,CAAC;YACP,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACzB,CAAC;IACL,CAAC;IAED,uCAAuC;IACvC,MAAM,MAAM,GAAW;QACnB,OAAO,EAAE,CAAC;QACV,KAAK;QACL,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO;KACV,CAAC;IACF,MAAM,KAAK,GAAG,UAAU,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,CAAC,CAAC;IAChD,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;IAEpC,kEAAkE;IAClE,2DAA2D;IAC3D,IAAI,CAAC;QACD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;YAC1B,IAAI,CAAC;gBACD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;YAC7C,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACX,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAClD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;oBACrD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;gBAC7C,CAAC;qBAAM,CAAC;oBACJ,MAAM,GAAG,CAAC;gBACd,CAAC;YACL,CAAC;YACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACpE,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,sEAAsE;QACtE,MAAM,GAAG,CAAC;IACd,CAAC;IAED,oCAAoC;IACpC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC9C,MAAM,SAAS,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACvD,OAAO,EAAE,KAAK,EAAE,CAAC;AACrB,CAAC;AAOD;;;;;;;;;GASG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,SAAiB;IACxD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,EAAE,YAAY,CAAC,CAAC;IAC/C,IAAI,KAAe,CAAC;IACpB,IAAI,CAAC;QACD,KAAK,GAAG,MAAM,EAAE,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACvC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAK,GAA6B,CAAC,IAAI,KAAK,QAAQ;YAAE,OAAO,EAAE,SAAS,EAAE,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;QAC5F,MAAM,GAAG,CAAC;IACd,CAAC;IACD,MAAM,SAAS,GAAa,EAAE,CAAC;IAC/B,MAAM,OAAO,GAAa,EAAE,CAAC;IAC7B,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACvB,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QAC5E,MAAM,KAAK,GAAG,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,CAAC;QACnC,IAAI,MAAc,CAAC;QACnB,IAAI,CAAC;YACD,MAAM,GAAG,GAAG,MAAM,EAAE,CAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;YAC7C,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAW,CAAC;YACnC,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,CAAC;gBAAE,MAAM,IAAI,KAAK,CAAC,YAAY,CAAC,CAAC;QAC9F,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;YACnB,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,SAAS;QACb,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,OAAO,CAAC,GAAG,CAC9B,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,EAAE,EAAE,CAC3B,EAAE;aACG,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC;aACX,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC;aAChB,KAAK,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,CAC1B,CACJ,CAAC;QACF,MAAM,cAAc,GAAG,QAAQ,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;QAE/C,IAAI,cAAc,EAAE,CAAC;YACjB,IAAI,CAAC;gBACD,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;oBACjC,IAAI,CAAC;wBACD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;oBAC7C,CAAC;oBAAC,OAAO,GAAG,EAAE,CAAC;wBACX,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;4BAClD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;4BACrD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,MAAM,CAAC,CAAC;wBAC7C,CAAC;6BAAM,CAAC;4BACJ,MAAM,GAAG,CAAC;wBACd,CAAC;oBACL,CAAC;oBACD,MAAM,EAAE,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBACpE,CAAC;gBACD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC9C,SAAS,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACjC,CAAC;YAAC,MAAM,CAAC;gBACL,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC/B,CAAC;QACL,CAAC;aAAM,CAAC;YACJ,KAAK,MAAM,KAAK,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;gBACjC,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtD,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YAC9C,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;QAC/B,CAAC;IACL,CAAC;IACD,OAAO,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;AAClC,CAAC"}

package/dist/server/io/atomicWrite.js

@@ -0,0 +1,79 @@
+/**
+ * Single-file atomic write.
+ *
+ * Phase 1 of `unified-setup-and-settings-gui` (roadmap step 1.3). The wizard
+ * and settings editor MUST never leave a half-written `.agent-settings.yml`
+ * or `.agent-user.md` on disk. The contract is: after `writeAtomic` resolves,
+ * the target file either holds the new contents in full, or — on any error
+ * — the file is untouched (the prior contents survive).
+ *
+ * Implementation: write to a `<target>.tmp-<pid>-<rand>` sibling, fsync the
+ * file descriptor (so the new bytes hit the platter before the rename),
+ * `fs.rename` over the target (atomic on POSIX, link-then-unlink fallback
+ * on Windows when `rename` raises EPERM), then chmod the final path to the
+ * caller-requested mode (default 0600 — council security mandate).
+ *
+ * Caller is responsible for ensuring the parent directory exists; the
+ * helper does not auto-mkdir to avoid masking misrouted writes.
+ */
+import { promises as fs } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { dirname, join } from 'node:path';
+const DEFAULT_MODE = 0o600;
+function tmpName(target, suffix) {
+    const dir = dirname(target);
+    const base = target.slice(dir.length + 1);
+    const tag = suffix ?? `${process.pid}-${randomBytes(6).toString('hex')}`;
+    return join(dir, `${base}.tmp-${tag}`);
+}
+/**
+ * Write `contents` to `target` atomically. After resolve, the target
+ * file holds the new bytes in full or — on any thrown error — was
+ * never touched. The temp file is best-effort unlinked on failure.
+ */
+export async function writeAtomic(target, contents, opts = {}) {
+    const tmp = tmpName(target, opts.suffix);
+    const mode = opts.mode ?? DEFAULT_MODE;
+    let handle = null;
+    try {
+        handle = await fs.open(tmp, 'w', mode);
+        const buffer = typeof contents === 'string' ? Buffer.from(contents, 'utf8') : contents;
+        await handle.writeFile(buffer);
+        await handle.sync();
+        await handle.close();
+        handle = null;
+        try {
+            await fs.rename(tmp, target);
+        }
+        catch (err) {
+            // Windows: rename over an existing file can raise EPERM; fall
+            // back to link-unlink-rename.
+            if (err.code === 'EPERM') {
+                await fs.unlink(target).catch(() => undefined);
+                await fs.rename(tmp, target);
+            }
+            else {
+                throw err;
+            }
+        }
+        // chmod after rename — on some platforms (Windows, certain mounts)
+        // a non-default umask survives the open(); explicit chmod is the
+        // only portable knob.
+        await fs.chmod(target, mode).catch(() => undefined);
+    }
+    catch (err) {
+        if (handle)
+            await handle.close().catch(() => undefined);
+        await fs.unlink(tmp).catch(() => undefined);
+        throw err;
+    }
+}
+/**
+ * `<target>.tmp-*` sibling name generator — exported for the multi-write
+ * 2PC machinery which needs to write the same temp filename twice (prepare
+ * + commit) under one transaction id.
+ */
+export function tempPathFor(target, txnId) {
+    return tmpName(target, txnId);
+}
+//# sourceMappingURL=atomicWrite.js.map

package/dist/server/io/atomicWrite.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"atomicWrite.js","sourceRoot":"","sources":["../../../src/server/io/atomicWrite.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AAEH,OAAO,EAAE,QAAQ,IAAI,EAAE,EAAE,MAAM,SAAS,CAAC;AACzC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AAS1C,MAAM,YAAY,GAAG,KAAK,CAAC;AAE3B,SAAS,OAAO,CAAC,MAAc,EAAE,MAAe;IAC5C,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC;IAC5B,MAAM,IAAI,GAAG,MAAM,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAC1C,MAAM,GAAG,GAAG,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,CAAC;IACzE,OAAO,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,QAAQ,GAAG,EAAE,CAAC,CAAC;AAC3C,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC7B,MAAc,EACd,QAAyB,EACzB,OAA2B,EAAE;IAE7B,MAAM,GAAG,GAAG,OAAO,CAAC,MAAM,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IACzC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,YAAY,CAAC;IAEvC,IAAI,MAAM,GAAyB,IAAI,CAAC;IACxC,IAAI,CAAC;QACD,MAAM,GAAG,MAAM,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,CAAC;QACvC,MAAM,MAAM,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QACvF,MAAM,MAAM,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC/B,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC;QACpB,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC;QACrB,MAAM,GAAG,IAAI,CAAC;QAEd,IAAI,CAAC;YACD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;QACjC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACX,8DAA8D;YAC9D,8BAA8B;YAC9B,IAAK,GAA6B,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;gBAClD,MAAM,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;gBAC/C,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACJ,MAAM,GAAG,CAAC;YACd,CAAC;QACL,CAAC;QAED,mEAAmE;QACnE,iEAAiE;QACjE,sBAAsB;QACtB,MAAM,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IACxD,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACX,IAAI,MAAM;YAAE,MAAM,MAAM,CAAC,KAAK,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QACxD,MAAM,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC5C,MAAM,GAAG,CAAC;IACd,CAAC;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,WAAW,CAAC,MAAc,EAAE,KAAa;IACrD,OAAO,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC;AAClC,CAAC"}