@i4ctime/q-ring 0.17.5 → 0.18.0

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli/commands.ts","../src/utils/colors.ts","../src/core/import.ts","../src/utils/prompt.ts","../src/cli/helpers.ts","../src/cli/options.ts","../src/services/list-secrets-filter.ts","../src/cli/commands/secrets.ts","../src/core/noise.ts","../src/core/validate.ts","../src/core/context.ts","../src/cli/commands/project.ts","../src/core/teleport.ts","../src/cli/commands/quantum.ts","../src/cli/commands/validation.ts","../src/core/exec.ts","../src/core/scan.ts","../src/core/secrets-detect.ts","../src/core/linter.ts","../src/cli/commands/tooling.ts","../src/cli/commands/audit.ts","../src/hooks/precommit.ts","../src/cli/commands/hooks.ts","../src/core/agent.ts","../src/cli/commands/agent.ts","../src/cli/commands/security.ts","../src/core/run.ts","../src/core/refs.ts","../src/core/setup.ts","../src/core/push.ts","../src/cli/commands/bridges.ts","../src/core/canary.ts","../src/cli/commands/canary.ts","../src/core/wrap.ts","../src/core/wrap-redact.ts","../src/cli/commands/mcp.ts","../src/cli/commands/doctor.ts","../src/cli/commands/completion.ts","../src/index.ts"],"sourcesContent":["import { Command, Help } from \"commander\";\nimport { PACKAGE_VERSION } from \"../version.js\";\nimport { c, SYMBOLS } from \"../utils/colors.js\";\nimport { registerSecretsCommands } from \"./commands/secrets.js\";\nimport { registerProjectCommands } from \"./commands/project.js\";\nimport { registerQuantumCommands } from \"./commands/quantum.js\";\nimport { registerValidationCommands } from \"./commands/validation.js\";\nimport { registerToolingCommands } from \"./commands/tooling.js\";\nimport { registerAuditCommands } from \"./commands/audit.js\";\nimport { registerHookCommands } from \"./commands/hooks.js\";\nimport { registerAgentCommands } from \"./commands/agent.js\";\nimport { registerSecurityCommands } from \"./commands/security.js\";\nimport { registerBridgeCommands } from \"./commands/bridges.js\";\nimport { registerCanaryCommands } from \"./commands/canary.js\";\nimport { registerMcpCommands } from \"./commands/mcp.js\";\nimport { registerDoctorCommand } from \"./commands/doctor.js\";\nimport { registerCompletionCommand } from \"./commands/completion.js\";\n\n/**\n * Display groups for the CLI help screen.\n *\n * Maps top-level command names (including their first alias) to a category.\n * Any command not present here falls under \"Other\".\n */\nconst COMMAND_GROUPS: Array<{\n  name: string;\n  symbol: string;\n  commands: string[];\n}> = [\n  {\n    name: \"Secrets\",\n    symbol: SYMBOLS.key,\n    commands: [\n      \"set\",\n      \"get\",\n      \"has\",\n      \"delete\",\n      \"list\",\n      \"inspect\",\n      \"export\",\n      \"import\",\n    ],\n  },\n  {\n    name: \"Project\",\n    symbol: SYMBOLS.package,\n    commands: [\"context\", \"check\", \"env\", \"env:generate\", \"wizard\"],\n  },\n  {\n    name: \"Quantum\",\n    symbol: SYMBOLS.sparkle,\n    commands: [\n      \"generate\",\n      \"entangle\",\n      \"disentangle\",\n      \"tunnel\",\n      \"teleport\",\n    ],\n  },\n  {\n    name: \"Validation & Rotation\",\n    symbol: SYMBOLS.shield,\n    commands: [\"validate\", \"rotate\", \"ci:validate\"],\n  },\n  {\n    name: \"Dev Tooling\",\n    symbol: SYMBOLS.zap,\n    commands: [\"exec\", \"scan\", \"lint\", \"status\", \"doctor\", \"completion\"],\n  },\n  {\n    name: \"Bridges\",\n    symbol: SYMBOLS.link,\n    commands: [\"run\", \"setup\", \"push\"],\n  },\n  {\n    name: \"Audit & Health\",\n    symbol: SYMBOLS.eye,\n    commands: [\"audit\", \"audit:verify\", \"audit:export\", \"health\"],\n  },\n  {\n    name: \"Hooks\",\n    symbol: SYMBOLS.link,\n    commands: [\n      \"hook:install\",\n      \"hook:uninstall\",\n      \"hook:run\",\n      \"hook\",\n    ],\n  },\n  {\n    name: \"Agent Memory\",\n    symbol: SYMBOLS.ghost,\n    commands: [\"remember\", \"recall\", \"forget\", \"analyze\", \"agent\"],\n  },\n  {\n    name: \"Security & Governance\",\n    symbol: SYMBOLS.lock,\n    commands: [\"approve\", \"approvals\", \"policy\", \"canary\", \"mcp\"],\n  },\n];\n\nclass GroupedHelp extends Help {\n  override formatHelp(cmd: Command, helper: Help): string {\n    // Keep the default formatting for subcommands — only the top-level\n    // `qring` command gets the grouped treatment.\n    if (cmd.parent) return super.formatHelp(cmd, helper);\n\n    const termWidth = helper.padWidth(cmd, helper);\n    const helpWidth = helper.helpWidth ?? 80;\n\n    const sections: string[] = [];\n    sections.push(\n      `${c.bold(\"qring\")} ${c.dim(`v${PACKAGE_VERSION}`)} ${c.dim(\"—\")} ${c.dim(\n        \"quantum keyring for AI coding tools\",\n      )}`,\n    );\n    sections.push(\"\");\n    sections.push(`${c.bold(\"Usage:\")}  qring [options] [command]`);\n\n    const options = helper.visibleOptions(cmd);\n    if (options.length > 0) {\n      sections.push(\"\");\n      sections.push(c.bold(\"Options:\"));\n      for (const opt of options) {\n        const term = helper.optionTerm(opt);\n        const desc = helper.optionDescription(opt);\n        sections.push(formatRow(term, desc, termWidth, helpWidth));\n      }\n    }\n\n    const commands = helper.visibleCommands(cmd);\n    if (commands.length === 0) return sections.join(\"\\n\") + \"\\n\";\n\n    const byName = new Map<string, Command>();\n    for (const sub of commands) byName.set(sub.name(), sub);\n\n    const used = new Set<string>();\n\n    for (const group of COMMAND_GROUPS) {\n      const members = group.commands\n        .map((n) => byName.get(n))\n        .filter((x): x is Command => Boolean(x));\n      if (members.length === 0) continue;\n      for (const m of members) used.add(m.name());\n\n      sections.push(\"\");\n      sections.push(`${group.symbol} ${c.bold(group.name)}`);\n      for (const sub of members) {\n        sections.push(\n          formatRow(\n            helper.subcommandTerm(sub),\n            helper.subcommandDescription(sub),\n            termWidth,\n            helpWidth,\n          ),\n        );\n      }\n    }\n\n    const other = commands.filter((sub) => !used.has(sub.name()));\n    if (other.length > 0) {\n      sections.push(\"\");\n      sections.push(c.bold(\"Other:\"));\n      for (const sub of other) {\n        sections.push(\n          formatRow(\n            helper.subcommandTerm(sub),\n            helper.subcommandDescription(sub),\n            termWidth,\n            helpWidth,\n          ),\n        );\n      }\n    }\n\n    sections.push(\"\");\n    sections.push(\n      c.dim(\n        `Run ${c.bold(\"qring <command> --help\")} to see detailed flags for any command.`,\n      ),\n    );\n    return sections.join(\"\\n\") + \"\\n\";\n  }\n}\n\nfunction formatRow(\n  term: string,\n  description: string,\n  termWidth: number,\n  helpWidth: number,\n): string {\n  const indent = \"  \";\n  const gap = \"  \";\n  const padded = term.padEnd(termWidth);\n  if (!description) return `${indent}${padded}`;\n  const available = Math.max(helpWidth - indent.length - termWidth - gap.length, 20);\n  const desc = wrapText(description, available).replace(\n    /\\n/g,\n    `\\n${indent}${\" \".repeat(termWidth)}${gap}`,\n  );\n  return `${indent}${padded}${gap}${c.dim(desc)}`;\n}\n\nfunction wrapText(text: string, width: number): string {\n  if (text.length <= width) return text;\n  const lines: string[] = [];\n  let current = \"\";\n  for (const word of text.split(/\\s+/)) {\n    if (current.length + word.length + 1 > width) {\n      lines.push(current);\n      current = word;\n    } else {\n      current = current ? `${current} ${word}` : word;\n    }\n  }\n  if (current) lines.push(current);\n  return lines.join(\"\\n\");\n}\n\nexport function createProgram(): Command {\n  const program = new Command()\n    .name(\"qring\")\n    .description(\n      `${c.bold(\"q-ring\")} ${c.dim(\"— quantum keyring for AI coding tools\")}`,\n    )\n    .version(PACKAGE_VERSION)\n    .option(\"--json\", \"Machine-readable JSON output for supported commands\")\n    .configureHelp({\n      sortSubcommands: false,\n      sortOptions: false,\n    })\n    .showHelpAfterError(c.dim(\"(run `qring --help` for usage)\"));\n\n  (program as Command).createHelp = () => new GroupedHelp();\n\n  registerSecretsCommands(program);\n  registerProjectCommands(program);\n  registerQuantumCommands(program);\n  registerValidationCommands(program);\n  registerToolingCommands(program);\n  registerAuditCommands(program);\n  registerHookCommands(program);\n  registerAgentCommands(program);\n  registerSecurityCommands(program);\n  registerBridgeCommands(program);\n  registerCanaryCommands(program);\n  registerMcpCommands(program);\n  registerDoctorCommand(program);\n  registerCompletionCommand(program);\n\n  return program;\n}\n","/**\n * Minimal ANSI color helpers. No dependencies.\n */\n\nconst enabled = process.stdout.isTTY !== false && !process.env.NO_COLOR;\n\nfunction wrap(code: string, text: string): string {\n  return enabled ? `\\x1b[${code}m${text}\\x1b[0m` : text;\n}\n\nexport const c = {\n  bold: (t: string) => wrap(\"1\", t),\n  dim: (t: string) => wrap(\"2\", t),\n  italic: (t: string) => wrap(\"3\", t),\n  underline: (t: string) => wrap(\"4\", t),\n\n  red: (t: string) => wrap(\"31\", t),\n  green: (t: string) => wrap(\"32\", t),\n  yellow: (t: string) => wrap(\"33\", t),\n  blue: (t: string) => wrap(\"34\", t),\n  magenta: (t: string) => wrap(\"35\", t),\n  cyan: (t: string) => wrap(\"36\", t),\n  white: (t: string) => wrap(\"37\", t),\n  gray: (t: string) => wrap(\"90\", t),\n\n  bgRed: (t: string) => wrap(\"41\", t),\n  bgGreen: (t: string) => wrap(\"42\", t),\n  bgYellow: (t: string) => wrap(\"43\", t),\n  bgBlue: (t: string) => wrap(\"44\", t),\n  bgMagenta: (t: string) => wrap(\"45\", t),\n  bgCyan: (t: string) => wrap(\"46\", t),\n};\n\nexport function scopeColor(scope: string): string {\n  return scope === \"project\" ? c.cyan(scope) : c.blue(scope);\n}\n\nexport function decayIndicator(percent: number, expired: boolean): string {\n  if (expired) return c.bgRed(c.white(\" EXPIRED \"));\n  if (percent >= 90) return c.red(`[decay ${percent}%]`);\n  if (percent >= 75) return c.yellow(`[decay ${percent}%]`);\n  if (percent > 0) return c.green(`[decay ${percent}%]`);\n  return \"\";\n}\n\nexport function envBadge(env: string): string {\n  switch (env) {\n    case \"prod\":\n      return c.bgRed(c.white(` ${env} `));\n    case \"staging\":\n      return c.bgYellow(c.white(` ${env} `));\n    case \"dev\":\n      return c.bgGreen(c.white(` ${env} `));\n    case \"test\":\n      return c.bgBlue(c.white(` ${env} `));\n    default:\n      return c.bgMagenta(c.white(` ${env} `));\n  }\n}\n\nexport const SYMBOLS = {\n  check: enabled ? \"\\u2713\" : \"[ok]\",\n  cross: enabled ? \"\\u2717\" : \"[x]\",\n  arrow: enabled ? \"\\u2192\" : \"->\",\n  dot: enabled ? \"\\u2022\" : \"*\",\n  lock: enabled ? \"\\u{1f512}\" : \"[locked]\",\n  key: enabled ? \"\\u{1f511}\" : \"[key]\",\n  link: enabled ? \"\\u{1f517}\" : \"[link]\",\n  warning: enabled ? \"\\u26a0\\ufe0f\" : \"[!]\",\n  clock: enabled ? \"\\u23f0\" : \"[time]\",\n  shield: enabled ? \"\\u{1f6e1}\\ufe0f\" : \"[shield]\",\n  zap: enabled ? \"\\u26a1\" : \"[zap]\",\n  eye: enabled ? \"\\u{1f441}\\ufe0f\" : \"[eye]\",\n  ghost: enabled ? \"\\u{1f47b}\" : \"[ghost]\",\n  package: enabled ? \"\\u{1f4e6}\" : \"[pkg]\",\n  sparkle: enabled ? \"\\u2728\" : \"[*]\",\n} as const;\n","/**\n * Import module: parse .env files and bulk-store secrets into q-ring.\n */\n\nimport { readFileSync } from \"node:fs\";\nimport { setSecret, hasSecret, type SetSecretOptions } from \"./keyring.js\";\n\nexport interface ImportOptions {\n  scope?: \"global\" | \"project\";\n  projectPath?: string;\n  env?: string;\n  source?: \"cli\" | \"mcp\" | \"agent\" | \"api\";\n  skipExisting?: boolean;\n  dryRun?: boolean;\n}\n\nexport interface ImportResult {\n  imported: string[];\n  skipped: string[];\n  total: number;\n}\n\n/**\n * Parse .env content into key-value pairs.\n * Handles comments, blank lines, quoted values, and basic multiline.\n */\nexport function parseDotenv(content: string): Map<string, string> {\n  const result = new Map<string, string>();\n  const lines = content.split(/\\r?\\n/);\n\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i].trim();\n\n    if (!line || line.startsWith(\"#\")) continue;\n\n    const eqIdx = line.indexOf(\"=\");\n    if (eqIdx === -1) continue;\n\n    const key = line.slice(0, eqIdx).trim();\n    let value = line.slice(eqIdx + 1).trim();\n\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    const escapeMap: Record<string, string> = {\n      n: \"\\n\", r: \"\\r\", t: \"\\t\", \"\\\\\": \"\\\\\", '\"': '\"',\n    };\n    value = value.replace(/\\\\([nrt\"\\\\])/g, (_, ch) => escapeMap[ch] ?? ch);\n\n    // Strip inline comments only when the `#` is preceded by whitespace (the\n    // dotenv convention), so unquoted values like `foo#bar` are preserved.\n    if (!line.includes('\"') && !line.includes(\"'\")) {\n      const commentMatch = value.match(/\\s#/);\n      if (commentMatch && commentMatch.index !== undefined) {\n        value = value.slice(0, commentMatch.index).trim();\n      }\n    }\n\n    if (key) result.set(key, value);\n  }\n\n  return result;\n}\n\n/**\n * Import secrets from a .env file path or raw content string.\n */\nexport function importDotenv(\n  filePathOrContent: string,\n  options: ImportOptions = {},\n): ImportResult {\n  let content: string;\n\n  // The file-path convenience (read from disk if the arg is a path) is only\n  // safe for the trusted local CLI. For MCP/agent/api callers the argument is\n  // always treated as literal .env content — otherwise an agent could pass a\n  // path like ~/.aws/credentials and exfiltrate it through the keyring.\n  const source = options.source ?? \"cli\";\n  if (source === \"cli\") {\n    try {\n      content = readFileSync(filePathOrContent, \"utf8\");\n    } catch {\n      content = filePathOrContent;\n    }\n  } else {\n    content = filePathOrContent;\n  }\n\n  const pairs = parseDotenv(content);\n  const result: ImportResult = {\n    imported: [],\n    skipped: [],\n    total: pairs.size,\n  };\n\n  for (const [key, value] of pairs) {\n    if (options.skipExisting && hasSecret(key, {\n      scope: options.scope,\n      projectPath: options.projectPath,\n      source: options.source ?? \"cli\",\n    })) {\n      result.skipped.push(key);\n      continue;\n    }\n\n    if (options.dryRun) {\n      result.imported.push(key);\n      continue;\n    }\n\n    const setOpts: SetSecretOptions = {\n      scope: options.scope ?? \"global\",\n      projectPath: options.projectPath ?? process.cwd(),\n      source: options.source ?? \"cli\",\n    };\n\n    setSecret(key, value, setOpts);\n    result.imported.push(key);\n  }\n\n  return result;\n}\n","import { createInterface } from \"node:readline\";\n\n/**\n * Ask the user to confirm a destructive action. Resolves true only on an\n * explicit yes. Non-interactive callers must pass `assumeYes` (--yes/-y);\n * otherwise a non-TTY stdin is an error rather than a silent yes.\n */\nexport async function confirm(\n  message: string,\n  { assumeYes = false }: { assumeYes?: boolean } = {},\n): Promise<boolean> {\n  if (assumeYes) return true;\n  if (!process.stdin.isTTY) {\n    throw new Error(\n      \"Confirmation required but stdin is not a terminal. Pass --yes to proceed non-interactively.\",\n    );\n  }\n\n  const rl = createInterface({\n    input: process.stdin,\n    output: process.stderr,\n    terminal: true,\n  });\n\n  const answer = await new Promise<string>((resolve) => {\n    rl.question(`${message} [y/N] `, resolve);\n  });\n  rl.close();\n  return /^y(es)?$/i.test(answer.trim());\n}\n\nexport async function promptSecret(message: string): Promise<string> {\n  const stdin = process.stdin;\n\n  // Non-interactive stdin (e.g. `echo \"$VALUE\" | qring set KEY`): read to EOF.\n  // The interactive path below waits on per-keypress data events that never\n  // arrive from a pipe, which would hang forever.\n  if (!stdin.isTTY) {\n    let data = \"\";\n    stdin.setEncoding(\"utf8\");\n    for await (const chunk of stdin) {\n      data += chunk;\n    }\n    const value = data.replace(/\\r?\\n$/, \"\");\n    if (value.length === 0) {\n      throw new Error(\n        \"No value provided: stdin is not a terminal and was empty. Pipe the value in, or pass it as an argument.\",\n      );\n    }\n    return value;\n  }\n\n  const rl = createInterface({\n    input: process.stdin,\n    output: process.stderr,\n    terminal: true,\n  });\n\n  return new Promise((resolve) => {\n    process.stderr.write(message);\n\n    const wasRaw = stdin.isRaw;\n    if (stdin.isTTY && stdin.setRawMode) {\n      stdin.setRawMode(true);\n    }\n\n    let input = \"\";\n\n    const onData = (chunk: Buffer) => {\n      const char = chunk.toString(\"utf8\");\n      if (char === \"\\n\" || char === \"\\r\") {\n        stdin.removeListener(\"data\", onData);\n        if (stdin.isTTY && stdin.setRawMode) {\n          stdin.setRawMode(wasRaw ?? false);\n        }\n        process.stderr.write(\"\\n\");\n        rl.close();\n        resolve(input);\n      } else if (char === \"\\u0003\") {\n        process.exit(1);\n      } else if (char === \"\\u007F\" || char === \"\\b\") {\n        input = input.slice(0, -1);\n      } else {\n        input += char;\n      }\n    };\n\n    stdin.on(\"data\", onData);\n  });\n}\n","import type { Command } from \"commander\";\n\n/** True when `--json` was passed on the subcommand or on the root `qring` program. */\nexport function wantsJsonOutput(program: Command, cmd: unknown): boolean {\n  const c = cmd as { json?: boolean };\n  if (c.json) return true;\n  const g = program.opts() as { json?: boolean };\n  return !!g.json;\n}\n\n/**\n * Emit `{ ok: true, data }` as pretty-printed JSON when `--json` is in\n * effect. Returns true if JSON was emitted (caller should skip human output).\n */\nexport function emitJson(program: Command, cmd: unknown, data: unknown): boolean {\n  if (!wantsJsonOutput(program, cmd)) return false;\n  process.stdout.write(JSON.stringify({ ok: true, data }, null, 2) + \"\\n\");\n  return true;\n}\n\n/**\n * Break the CodeQL taint chain from getPassword → console.log.\n * Copies a string value so static analysis no longer considers it\n * \"sensitive data returned by getPassword\".\n */\nexport function safeStr(s: string | undefined | null): string {\n  return s == null ? \"\" : `${s}`;\n}\n\nexport function safeNum(n: number | undefined | null): number {\n  return n == null ? 0 : Number(n);\n}\n\nexport function safeArr<T>(arr: T[] | undefined | null): T[] {\n  return arr ? arr.map((x) => (typeof x === \"string\" ? safeStr(x) : x) as T) : [];\n}\n","import type { Scope } from \"../core/scope.js\";\nimport type { KeyringOptions } from \"../core/keyring.js\";\n\nexport function buildOpts(cmd: {\n  global?: boolean;\n  project?: boolean;\n  team?: string;\n  org?: string;\n  projectPath?: string;\n  env?: string;\n}): KeyringOptions {\n  let scope: Scope | undefined;\n  if (cmd.global) scope = \"global\";\n  else if (cmd.project) scope = \"project\";\n  else if (cmd.team) scope = \"team\";\n  else if (cmd.org) scope = \"org\";\n\n  const projectPath =\n    cmd.projectPath ?? (cmd.project ? process.cwd() : undefined);\n\n  if (scope === \"project\" && !projectPath) {\n    throw new Error(\"Project path is required for project scope\");\n  }\n\n  return {\n    scope,\n    projectPath: projectPath ?? process.cwd(),\n    teamId: cmd.team,\n    orgId: cmd.org,\n    env: cmd.env,\n    source: \"cli\",\n  };\n}\n","import type { SecretEntry } from \"../core/keyring.js\";\n\n/**\n * Turn a user glob (`*`, `?`) into a case-insensitive RegExp source.\n * Other regex metacharacters are escaped.\n */\nfunction globKeyPatternToRegexSource(pattern: string): string {\n  let out = \"\";\n  for (const c of pattern) {\n    if (c === \"*\") out += \".*\";\n    else if (c === \"?\") out += \".\";\n    else if (\"\\\\^$+{}()|[]\".includes(c)) out += \"\\\\\" + c;\n    else if (c === \".\") out += \"\\\\.\";\n    else out += c;\n  }\n  return out;\n}\n\n/**\n * Key name glob: `*` → `.*`, `?` → `.`, other regex metacharacters escaped (CLI + MCP aligned).\n */\nexport function filterSecretsByKeyGlob(\n  entries: SecretEntry[],\n  filter?: string,\n): SecretEntry[] {\n  if (!filter?.trim()) return entries;\n  const regex = new RegExp(\"^\" + globKeyPatternToRegexSource(filter) + \"$\", \"i\");\n  return entries.filter((e) => regex.test(e.key));\n}\n","import type { Command } from \"commander\";\nimport {\n  getSecret,\n  setSecret,\n  deleteSecret,\n  hasSecret,\n  listSecrets,\n  exportSecrets,\n  getEnvelope,\n  type SetSecretOptions,\n} from \"../../core/keyring.js\";\nimport type { Scope } from \"../../core/scope.js\";\nimport { checkDecay } from \"../../core/envelope.js\";\nimport { importDotenv } from \"../../core/import.js\";\nimport { promptSecret, confirm } from \"../../utils/prompt.js\";\nimport {\n  c,\n  scopeColor,\n  decayIndicator,\n  envBadge,\n  SYMBOLS,\n} from \"../../utils/colors.js\";\nimport { safeStr, safeNum, safeArr, wantsJsonOutput, emitJson } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\nimport { filterSecretsByKeyGlob } from \"../../services/list-secrets-filter.js\";\n\nexport function registerSecretsCommands(program: Command): void {\n  program\n    .command(\"set <key> [value]\")\n    .description(\"Store a secret (with optional quantum metadata)\")\n    .option(\"-g, --global\", \"Store in global scope\")\n    .option(\"-p, --project\", \"Store in project scope (uses cwd)\")\n    .option(\"--team <id>\", \"Store in team scope\")\n    .option(\"--org <id>\", \"Store in org scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\n      \"-e, --env <env>\",\n      \"Set value for a specific environment (superposition)\",\n    )\n    .option(\n      \"--ttl <seconds>\",\n      \"Time-to-live in seconds (quantum decay)\",\n      parseInt,\n    )\n    .option(\"--expires <iso>\", \"Expiry timestamp (ISO 8601)\")\n    .option(\"--description <desc>\", \"Human-readable description\")\n    .option(\"--tags <tags>\", \"Comma-separated tags\")\n    .option(\n      \"--rotation-format <format>\",\n      \"Format for auto-rotation (api-key, password, uuid, hex, base64, alphanumeric, token)\",\n    )\n    .option(\"--rotation-prefix <prefix>\", \"Prefix for auto-rotation (e.g. sk-)\")\n    .option(\n      \"--requires-approval\",\n      \"Require explicit user approval for MCP agents to read\",\n    )\n    .option(\n      \"--jit-provider <provider>\",\n      \"Use a Just-In-Time provider to dynamically generate this secret\",\n    )\n    .action(async (key: string, value: string | undefined, cmd) => {\n      const opts = buildOpts(cmd);\n\n      if (!value) {\n        value = await promptSecret(\n          `${SYMBOLS.key} Enter value for ${c.bold(key)}: `,\n        );\n        if (!value) {\n          console.error(c.red(`${SYMBOLS.cross} No value provided, aborting.`));\n          process.exit(1);\n        }\n      }\n\n      const setOpts: SetSecretOptions = {\n        ...opts,\n        ttlSeconds: cmd.ttl,\n        expiresAt: cmd.expires,\n        description: cmd.description,\n        tags: cmd.tags?.split(\",\").map((t: string) => t.trim()),\n        rotationFormat: cmd.rotationFormat,\n        rotationPrefix: cmd.rotationPrefix,\n        requiresApproval: cmd.requiresApproval,\n        jitProvider: cmd.jitProvider,\n      };\n\n      // A canary flag survives overwrites by design (an agent must not be\n      // able to launder a tripwire away) — warn the operator so a real\n      // credential doesn't quietly inherit the alarm.\n      const priorEnvelope = getEnvelope(key, opts);\n      if (priorEnvelope?.envelope.meta.canary) {\n        console.error(\n          c.yellow(\n            `${SYMBOLS.warning} \"${key}\" is a canary honeytoken — the alarm stays armed on the new value. Disarm first with: qring canary disarm ${key}`,\n          ),\n        );\n      }\n\n      if (cmd.env) {\n        const existing = priorEnvelope;\n        const states = existing?.envelope?.states ?? {};\n        states[cmd.env] = value;\n\n        if (existing?.envelope?.value && !states[\"default\"]) {\n          states[\"default\"] = existing.envelope.value;\n        }\n\n        setOpts.states = states;\n        setOpts.defaultEnv = existing?.envelope?.defaultEnv ?? cmd.env;\n        setSecret(key, \"\", setOpts);\n\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"saved\")} ${c.bold(key)} ${envBadge(cmd.env)} ${c.dim(`[${scopeColor(opts.scope ?? \"global\")}]`)}`,\n        );\n      } else {\n        setSecret(key, value, setOpts);\n        const extras: string[] = [];\n        if (cmd.ttl) extras.push(`${SYMBOLS.clock} ttl=${cmd.ttl}s`);\n        if (cmd.description) extras.push(c.dim(cmd.description));\n\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"saved\")} ${c.bold(key)} ${c.dim(`[${scopeColor(opts.scope ?? \"global\")}]`)} ${extras.join(\" \")}`,\n        );\n      }\n    });\n\n  program\n    .command(\"get <key>\")\n    .description(\"Retrieve a secret (collapses superposition if needed)\")\n    .option(\"-g, --global\", \"Look only in global scope\")\n    .option(\"-p, --project\", \"Look only in project scope\")\n    .option(\"--team <id>\", \"Look only in team scope\")\n    .option(\"--org <id>\", \"Look only in org scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Force a specific environment\")\n    .option(\"--raw\", \"Print the secret value only (for scripts and piping)\")\n    .action((key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const value = getSecret(key, opts);\n\n      if (value === null) {\n        console.error(c.red(`${SYMBOLS.cross} Secret \"${key}\" not found`));\n        process.exit(1);\n      }\n\n      if (cmd.raw) {\n        process.stdout.write(value);\n        return;\n      }\n\n      const payload = wantsJsonOutput(program, cmd)\n        ? { ok: true as const, data: { key, value } }\n        : { key, value };\n      // Intentional user-visible output (this is `qring get`). Use\n      // process.stdout.write instead of console.log so static analysis\n      // (CodeQL `js/clear-text-logging`) does not flag it as logging.\n      process.stdout.write(JSON.stringify(payload) + \"\\n\");\n    });\n\n  program\n    .command(\"has <key>\")\n    .description(\n      \"Check whether a secret exists (exit 0 if present, 1 if not) — decay-aware\",\n    )\n    .option(\"-g, --global\", \"Look only in global scope\")\n    .option(\"-p, --project\", \"Look only in project scope\")\n    .option(\"--team <id>\", \"Look only in team scope\")\n    .option(\"--org <id>\", \"Look only in org scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-q, --quiet\", \"No output, exit code only (for scripts)\")\n    .action((key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const exists = hasSecret(key, opts);\n\n      if (!cmd.quiet) {\n        if (wantsJsonOutput(program, cmd)) {\n          console.log(JSON.stringify({ ok: true, data: { key, exists } }));\n        } else {\n          console.log(exists ? \"true\" : \"false\");\n        }\n      }\n      if (!exists) process.exitCode = 1;\n    });\n\n  program\n    .command(\"delete <key>\")\n    .alias(\"rm\")\n    .description(\"Remove a secret from the keyring\")\n    .option(\"-g, --global\", \"Delete from global scope only\")\n    .option(\"-p, --project\", \"Delete from project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-y, --yes\", \"Skip the confirmation prompt\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (key: string, cmd) => {\n      const opts = buildOpts(cmd);\n\n      if (!(await confirm(`Delete secret ${key}?`, { assumeYes: cmd.yes }))) {\n        console.error(c.dim(\"Aborted.\"));\n        process.exitCode = 1;\n        return;\n      }\n\n      const deleted = deleteSecret(key, opts);\n\n      if (!deleted) {\n        console.error(c.red(`${SYMBOLS.cross} Secret \"${key}\" not found`));\n        process.exit(1);\n      }\n\n      if (emitJson(program, cmd, { key, deleted: true })) return;\n      console.log(`${SYMBOLS.check} ${c.green(\"deleted\")} ${c.bold(key)}`);\n    });\n\n  program\n    .command(\"list\")\n    .alias(\"ls\")\n    .description(\"List all secrets with quantum status indicators\")\n    .option(\"-g, --global\", \"List global scope only\")\n    .option(\"-p, --project\", \"List project scope only\")\n    .option(\"--team <id>\", \"List team scope only\")\n    .option(\"--org <id>\", \"List org scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--show-decay\", \"Show decay/expiry status\")\n    .option(\"-t, --tag <tag>\", \"Filter by tag\")\n    .option(\"--expired\", \"Show only expired secrets\")\n    .option(\"--stale\", \"Show only stale secrets (75%+ decay)\")\n    .option(\"-f, --filter <pattern>\", \"Glob pattern on key name\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      let entries = listSecrets(opts);\n\n      if (cmd.tag) {\n        entries = entries.filter((e) =>\n          e.envelope?.meta.tags?.includes(cmd.tag),\n        );\n      }\n      if (cmd.expired) {\n        entries = entries.filter((e) => e.decay?.isExpired);\n      }\n      if (cmd.stale) {\n        entries = entries.filter(\n          (e) => e.decay?.isStale && !e.decay?.isExpired,\n        );\n      }\n      if (cmd.filter) {\n        entries = filterSecretsByKeyGlob(entries, cmd.filter);\n      }\n\n      if (\n        emitJson(\n          program,\n          cmd,\n          entries.map((e) => ({\n            key: safeStr(e.key),\n            scope: safeStr(e.scope),\n            type: e.envelope?.states ? \"superposition\" : \"collapsed\",\n            environments: e.envelope?.states\n              ? Object.keys(e.envelope.states).map(safeStr)\n              : undefined,\n            tags: safeArr(e.envelope?.meta.tags),\n            accessCount: safeNum(e.envelope?.meta.accessCount),\n            entangledCount: safeNum(e.envelope?.meta.entangled?.length),\n            decay: e.decay ?? null,\n          })),\n        )\n      ) {\n        return;\n      }\n\n      if (entries.length === 0) {\n        console.log(c.dim(\"No secrets found\"));\n        return;\n      }\n\n      console.log(\n        c.bold(`\\n  ${SYMBOLS.key} q-ring secrets (${entries.length})\\n`),\n      );\n\n      const maxKeyLen = Math.max(...entries.map((e) => e.key.length));\n\n      for (const entry of entries) {\n        const parts: string[] = [];\n\n        const key = safeStr(entry.key);\n        const scope = safeStr(entry.scope) as Scope;\n        const envs = entry.envelope?.states\n          ? Object.keys(entry.envelope.states).map(safeStr)\n          : null;\n        const entangledCount = safeNum(entry.envelope?.meta.entangled?.length);\n        const accessCount = safeNum(entry.envelope?.meta.accessCount);\n        const tags = safeArr(entry.envelope?.meta.tags);\n        const decayPct = safeNum(entry.decay?.lifetimePercent);\n        const expired = !!entry.decay?.isExpired;\n        const timeLeft = safeStr(entry.decay?.timeRemaining);\n\n        parts.push(c.dim(\"[\") + scopeColor(scope) + c.dim(\"]\"));\n        parts.push(c.bold(key.padEnd(maxKeyLen)));\n\n        if (envs) {\n          parts.push(c.magenta(`[${envs.join(\"|\")}]`));\n        }\n\n        if (entry.decay && (decayPct > 0 || expired)) {\n          parts.push(decayIndicator(decayPct, expired));\n          if (timeLeft && !expired) {\n            parts.push(c.dim(timeLeft));\n          }\n        }\n\n        if (entangledCount > 0) {\n          parts.push(c.cyan(`${SYMBOLS.link} ${entangledCount}`));\n        }\n\n        if (accessCount > 0) {\n          parts.push(c.dim(`${SYMBOLS.eye} ${accessCount}`));\n        }\n\n        if (tags.length > 0) {\n          parts.push(c.dim(tags.map((t) => `#${t}`).join(\" \")));\n        }\n\n        console.log(`  ${parts.join(\"  \")}`);\n      }\n\n      console.log();\n    });\n\n  program\n    .command(\"inspect <key>\")\n    .description(\"Show full quantum state of a secret\")\n    .option(\"-g, --global\", \"Inspect global scope only\")\n    .option(\"-p, --project\", \"Inspect project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const result = getEnvelope(key, opts);\n\n      if (!result) {\n        console.error(c.red(`${SYMBOLS.cross} Secret \"${key}\" not found`));\n        process.exit(1);\n      }\n\n      const { envelope, scope } = result;\n      const decay = checkDecay(envelope);\n\n      if (\n        emitJson(program, cmd, {\n          key: safeStr(key),\n          scope: safeStr(scope),\n          type: envelope.states ? \"superposition\" : \"collapsed\",\n          environments: envelope.states\n            ? Object.keys(envelope.states).map(safeStr)\n            : undefined,\n          defaultEnv: envelope.defaultEnv ? safeStr(envelope.defaultEnv) : undefined,\n          createdAt: safeStr(envelope.meta.createdAt),\n          updatedAt: safeStr(envelope.meta.updatedAt),\n          accessCount: safeNum(envelope.meta.accessCount),\n          lastAccessedAt: envelope.meta.lastAccessedAt\n            ? safeStr(envelope.meta.lastAccessedAt)\n            : undefined,\n          description: envelope.meta.description\n            ? safeStr(envelope.meta.description)\n            : undefined,\n          tags: safeArr(envelope.meta.tags),\n          entangled: (envelope.meta.entangled ?? []).map((l) => ({\n            service: safeStr(l.service),\n            key: safeStr(l.key),\n          })),\n          decay,\n        })\n      ) {\n        return;\n      }\n\n      const safeScope = safeStr(scope) as Scope;\n      const createdAt = safeStr(envelope.meta.createdAt);\n      const updatedAt = safeStr(envelope.meta.updatedAt);\n      const accessCount = safeNum(envelope.meta.accessCount);\n      const lastAccess = safeStr(envelope.meta.lastAccessedAt);\n      const desc = safeStr(envelope.meta.description);\n      const tags = safeArr(envelope.meta.tags);\n      const entangled = (envelope.meta.entangled ?? []).map((l) => ({\n        service: safeStr(l.service),\n        key: safeStr(l.key),\n      }));\n      const stateEnvs = envelope.states\n        ? Object.keys(envelope.states).map(safeStr)\n        : null;\n      const defaultEnv = safeStr(envelope.defaultEnv);\n      const decayTime = safeStr(decay.timeRemaining);\n      const decayPct = safeNum(decay.lifetimePercent);\n      const expired = !!decay.isExpired;\n\n      console.log(`\\n  ${c.bold(SYMBOLS.key + \" \" + key)}`);\n      console.log(`  ${c.dim(\"scope:\")}     ${scopeColor(safeScope)}`);\n\n      if (stateEnvs) {\n        console.log(`  ${c.dim(\"type:\")}      ${c.magenta(\"superposition\")}`);\n        console.log(`  ${c.dim(\"states:\")}`);\n        for (const env of stateEnvs) {\n          const isDefault = env === defaultEnv;\n          console.log(\n            `    ${envBadge(env)} ${isDefault ? c.dim(\"(default)\") : \"\"}`,\n          );\n        }\n      } else {\n        console.log(`  ${c.dim(\"type:\")}      ${c.green(\"collapsed\")}`);\n      }\n\n      console.log(`  ${c.dim(\"created:\")}   ${createdAt}`);\n      console.log(`  ${c.dim(\"updated:\")}   ${updatedAt}`);\n      console.log(`  ${c.dim(\"accessed:\")}  ${accessCount} times`);\n\n      if (lastAccess) {\n        console.log(`  ${c.dim(\"last read:\")} ${lastAccess}`);\n      }\n\n      if (desc) {\n        console.log(`  ${c.dim(\"desc:\")}      ${desc}`);\n      }\n\n      if (tags.length > 0) {\n        console.log(\n          `  ${c.dim(\"tags:\")}      ${tags.map((t) => c.cyan(`#${t}`)).join(\" \")}`,\n        );\n      }\n\n      if (decayTime) {\n        console.log(\n          `  ${c.dim(\"decay:\")}     ${decayIndicator(decayPct, expired)} ${decayTime}`,\n        );\n      }\n\n      if (entangled.length > 0) {\n        console.log(`  ${c.dim(\"entangled:\")}`);\n        for (const link of entangled) {\n          console.log(`    ${SYMBOLS.link} ${link.service}/${link.key}`);\n        }\n      }\n\n      console.log();\n    });\n\n  program\n    .command(\"export\")\n    .description(\"Export secrets as .env or JSON (collapses superposition)\")\n    .option(\"-f, --format <format>\", \"Output format: env or json\", \"env\")\n    .option(\"-g, --global\", \"Export global scope only\")\n    .option(\"-p, --project\", \"Export project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Force environment for collapse\")\n    .option(\"-k, --keys <keys>\", \"Comma-separated key names to export\")\n    .option(\"-t, --tags <tags>\", \"Comma-separated tags to filter by\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      const output = exportSecrets({\n        ...opts,\n        format: cmd.format,\n        keys: cmd.keys?.split(\",\").map((k: string) => k.trim()),\n        tags: cmd.tags?.split(\",\").map((t: string) => t.trim()),\n      });\n      process.stdout.write(output + \"\\n\");\n    });\n\n  program\n    .command(\"import <file>\")\n    .description(\"Import secrets from a .env file\")\n    .option(\"-g, --global\", \"Import to global scope\")\n    .option(\"-p, --project\", \"Import to project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Environment context\")\n    .option(\"--skip-existing\", \"Skip keys that already exist\")\n    .option(\"--dry-run\", \"Preview what would be imported without saving\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((file: string, cmd) => {\n      const opts = buildOpts(cmd);\n\n      const result = importDotenv(file, {\n        scope: opts.scope as \"global\" | \"project\" | undefined,\n        projectPath: opts.projectPath,\n        source: \"cli\",\n        skipExisting: cmd.skipExisting,\n        dryRun: cmd.dryRun,\n      });\n\n      if (emitJson(program, cmd, { file, dryRun: !!cmd.dryRun, ...result })) {\n        return;\n      }\n\n      if (cmd.dryRun) {\n        console.log(\n          `\\n  ${SYMBOLS.package} ${c.bold(\"Dry run\")} — would import ${result.imported.length} of ${result.total} secrets:\\n`,\n        );\n        for (const key of result.imported) {\n          console.log(`  ${SYMBOLS.key} ${c.bold(key)}`);\n        }\n        if (result.skipped.length > 0) {\n          console.log(\n            `\\n  ${c.dim(`Skipped (existing): ${result.skipped.join(\", \")}`)}`,\n          );\n        }\n      } else {\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"imported\")} ${result.imported.length} secret(s) from ${c.bold(file)}`,\n        );\n        if (result.skipped.length > 0) {\n          console.log(\n            c.dim(\n              `  skipped ${result.skipped.length} existing: ${result.skipped.join(\", \")}`,\n            ),\n          );\n        }\n      }\n\n      console.log();\n    });\n}\n","/**\n * Quantum Noise: cryptographic secret generation.\n * Generates high-entropy values in common formats.\n */\n\nimport { randomBytes, randomInt } from \"node:crypto\";\n\nexport type NoiseFormat =\n  | \"hex\"\n  | \"base64\"\n  | \"alphanumeric\"\n  | \"uuid\"\n  | \"api-key\"\n  | \"token\"\n  | \"password\";\n\nexport interface NoiseOptions {\n  format?: NoiseFormat;\n  /** Length in bytes (for hex/base64) or characters (for alphanumeric/password) */\n  length?: number;\n  /** Prefix for api-key format (e.g., \"sk-\", \"pk-\") */\n  prefix?: string;\n}\n\nconst ALPHA_NUM =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\";\nconst PASSWORD_CHARS =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_=+[]{}|;:,.<>?\";\n\nfunction randomString(charset: string, length: number): string {\n  let result = \"\";\n  for (let i = 0; i < length; i++) {\n    result += charset[randomInt(charset.length)];\n  }\n  return result;\n}\n\nexport function generateSecret(opts: NoiseOptions = {}): string {\n  const format = opts.format ?? \"api-key\";\n\n  switch (format) {\n    case \"hex\": {\n      const len = opts.length ?? 32;\n      return randomBytes(len).toString(\"hex\");\n    }\n\n    case \"base64\": {\n      const len = opts.length ?? 32;\n      return randomBytes(len).toString(\"base64url\");\n    }\n\n    case \"alphanumeric\": {\n      const len = opts.length ?? 32;\n      return randomString(ALPHA_NUM, len);\n    }\n\n    case \"uuid\": {\n      const bytes = randomBytes(16);\n      bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4\n      bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant 1\n      const hex = bytes.toString(\"hex\");\n      return [\n        hex.slice(0, 8),\n        hex.slice(8, 12),\n        hex.slice(12, 16),\n        hex.slice(16, 20),\n        hex.slice(20, 32),\n      ].join(\"-\");\n    }\n\n    case \"api-key\": {\n      const prefix = opts.prefix ?? \"qr_\";\n      const len = opts.length ?? 48;\n      return prefix + randomString(ALPHA_NUM, len);\n    }\n\n    case \"token\": {\n      const prefix = opts.prefix ?? \"\";\n      const len = opts.length ?? 64;\n      return prefix + randomBytes(len).toString(\"base64url\");\n    }\n\n    case \"password\": {\n      const len = opts.length ?? 24;\n\n      // Construct from one guaranteed char per class, fill the rest, then\n      // shuffle. This guarantees every class is present (when len ≥ #classes)\n      // without any fixup pass that could clobber an already-placed class.\n      const classCharsets = [\n        \"ABCDEFGHIJKLMNOPQRSTUVWXYZ\",\n        \"abcdefghijklmnopqrstuvwxyz\",\n        \"0123456789\",\n        \"!@#$%^&*()-_=+\",\n      ];\n      const guaranteed = classCharsets\n        .slice(0, Math.min(classCharsets.length, len))\n        .map((cs) => randomString(cs, 1));\n      const remaining = Math.max(0, len - guaranteed.length);\n      const chars = [\n        ...guaranteed,\n        ...(remaining > 0 ? randomString(PASSWORD_CHARS, remaining).split(\"\") : []),\n      ];\n\n      // Fisher-Yates shuffle backed by the CSPRNG.\n      for (let i = chars.length - 1; i > 0; i--) {\n        const j = randomInt(i + 1);\n        [chars[i], chars[j]] = [chars[j], chars[i]];\n      }\n\n      return chars.join(\"\");\n    }\n\n    default:\n      return randomBytes(32).toString(\"hex\");\n  }\n}\n\n/**\n * Estimate the entropy of a secret in bits.\n */\nexport function estimateEntropy(secret: string): number {\n  const charsets = [\n    { regex: /[a-z]/, size: 26 },\n    { regex: /[A-Z]/, size: 26 },\n    { regex: /[0-9]/, size: 10 },\n    { regex: /[^A-Za-z0-9]/, size: 32 },\n  ];\n\n  let poolSize = 0;\n  for (const { regex, size } of charsets) {\n    if (regex.test(secret)) poolSize += size;\n  }\n\n  return poolSize > 0 ? Math.floor(Math.log2(poolSize) * secret.length) : 0;\n}\n","/**\n * Secret Liveness Validation: test if a secret is actually valid\n * with its target service using a pluggable provider system.\n */\n\nimport { httpRequest } from \"../utils/http-request.js\";\nimport { generateSecret, type NoiseFormat } from \"./noise.js\";\nimport { checkSSRF } from \"./ssrf.js\";\n\nexport interface ValidationResult {\n  valid: boolean;\n  status: \"valid\" | \"invalid\" | \"error\" | \"unknown\";\n  message: string;\n  latencyMs: number;\n  provider: string;\n}\n\nexport interface Provider {\n  name: string;\n  description: string;\n  /** Prefixes that auto-detect to this provider */\n  prefixes?: string[];\n  validate(value: string): Promise<ValidationResult>;\n}\n\nfunction makeRequest(\n  url: string,\n  headers: Record<string, string>,\n  timeoutMs = 10000,\n): Promise<{ statusCode: number; body: string }> {\n  return httpRequest({ url, method: \"GET\", headers, timeoutMs });\n}\n\nexport class ProviderRegistry {\n  private providers = new Map<string, Provider>();\n\n  register(provider: Provider): void {\n    this.providers.set(provider.name, provider);\n  }\n\n  get(name: string): Provider | undefined {\n    return this.providers.get(name);\n  }\n\n  detectProvider(\n    value: string,\n    hints?: { provider?: string; prefix?: string },\n  ): Provider | undefined {\n    if (hints?.provider) {\n      return this.providers.get(hints.provider);\n    }\n\n    for (const provider of this.providers.values()) {\n      if (provider.prefixes) {\n        for (const pfx of provider.prefixes) {\n          if (value.startsWith(pfx)) return provider;\n        }\n      }\n    }\n\n    return undefined;\n  }\n\n  listProviders(): Provider[] {\n    return [...this.providers.values()];\n  }\n}\n\n// ─── Built-in Providers ───\n\n/**\n * Factory for the common liveness shape: one authenticated GET against a\n * cheap endpoint, with the standard 200/401/403/429 interpretation.\n */\nfunction livenessProvider(cfg: {\n  name: string;\n  description: string;\n  prefixes?: string[];\n  url: string;\n  headers: (value: string) => Record<string, string>;\n}): Provider {\n  return {\n    name: cfg.name,\n    description: cfg.description,\n    prefixes: cfg.prefixes,\n    async validate(value: string): Promise<ValidationResult> {\n      const start = Date.now();\n      try {\n        const { statusCode } = await makeRequest(cfg.url, {\n          \"User-Agent\": \"q-ring-validator/1.0\",\n          ...cfg.headers(value),\n        });\n        const latencyMs = Date.now() - start;\n\n        if (statusCode === 200)\n          return { valid: true, status: \"valid\", message: \"API key is valid\", latencyMs, provider: cfg.name };\n        if (statusCode === 401 || statusCode === 403)\n          return { valid: false, status: \"invalid\", message: `Invalid or revoked API key (${statusCode})`, latencyMs, provider: cfg.name };\n        if (statusCode === 429)\n          return { valid: true, status: \"error\", message: \"Rate limited — key may be valid\", latencyMs, provider: cfg.name };\n        return { valid: false, status: \"error\", message: `Unexpected status ${statusCode}`, latencyMs, provider: cfg.name };\n      } catch (err) {\n        return { valid: false, status: \"error\", message: `${err instanceof Error ? err.message : \"Network error\"}`, latencyMs: Date.now() - start, provider: cfg.name };\n      }\n    },\n  };\n}\n\n// AI-stack providers. Keys are only ever sent in headers (never the URL —\n// URLs land in server logs), against the cheapest read-only endpoint each\n// platform has.\n\nconst anthropicProvider = livenessProvider({\n  name: \"anthropic\",\n  description: \"Anthropic API key validation\",\n  prefixes: [\"sk-ant-\"],\n  url: \"https://api.anthropic.com/v1/models?limit=1\",\n  headers: (value) => ({ \"x-api-key\": value, \"anthropic-version\": \"2023-06-01\" }),\n});\n\nconst openrouterProvider = livenessProvider({\n  name: \"openrouter\",\n  description: \"OpenRouter API key validation\",\n  prefixes: [\"sk-or-\"],\n  url: \"https://openrouter.ai/api/v1/key\",\n  headers: (value) => ({ Authorization: `Bearer ${value}` }),\n});\n\nconst googleAiProvider = livenessProvider({\n  name: \"google-ai\",\n  description: \"Google AI (Gemini) API key validation\",\n  prefixes: [\"AIza\"],\n  url: \"https://generativelanguage.googleapis.com/v1beta/models?pageSize=1\",\n  headers: (value) => ({ \"x-goog-api-key\": value }),\n});\n\nconst groqProvider = livenessProvider({\n  name: \"groq\",\n  description: \"Groq API key validation\",\n  prefixes: [\"gsk_\"],\n  url: \"https://api.groq.com/openai/v1/models\",\n  headers: (value) => ({ Authorization: `Bearer ${value}` }),\n});\n\nconst huggingfaceProvider = livenessProvider({\n  name: \"huggingface\",\n  description: \"Hugging Face token validation\",\n  prefixes: [\"hf_\"],\n  url: \"https://huggingface.co/api/whoami-v2\",\n  headers: (value) => ({ Authorization: `Bearer ${value}` }),\n});\n\n// No prefix: ElevenLabs \"sk_...\" would shadow Stripe's sk_live_/sk_test_,\n// so it is explicit-only (set `provider: \"elevenlabs\"` on the secret/manifest).\nconst elevenlabsProvider = livenessProvider({\n  name: \"elevenlabs\",\n  description: \"ElevenLabs API key validation (explicit-only — set provider on the secret)\",\n  url: \"https://api.elevenlabs.io/v1/user\",\n  headers: (value) => ({ \"xi-api-key\": value }),\n});\n\n// No prefix: Vercel tokens have no stable public prefix — explicit-only.\nconst vercelProvider = livenessProvider({\n  name: \"vercel\",\n  description: \"Vercel token validation (explicit-only — set provider on the secret)\",\n  url: \"https://api.vercel.com/v2/user\",\n  headers: (value) => ({ Authorization: `Bearer ${value}` }),\n});\n\nconst openaiProvider: Provider = {\n  name: \"openai\",\n  description: \"OpenAI API key validation\",\n  prefixes: [\"sk-\"],\n  async validate(value: string): Promise<ValidationResult> {\n    const start = Date.now();\n    try {\n      const { statusCode } = await makeRequest(\n        \"https://api.openai.com/v1/models?limit=1\",\n        {\n          Authorization: `Bearer ${value}`,\n          \"User-Agent\": \"q-ring-validator/1.0\",\n        },\n      );\n      const latencyMs = Date.now() - start;\n\n      if (statusCode === 200)\n        return { valid: true, status: \"valid\", message: \"API key is valid\", latencyMs, provider: \"openai\" };\n      if (statusCode === 401)\n        return { valid: false, status: \"invalid\", message: \"Invalid or revoked API key\", latencyMs, provider: \"openai\" };\n      if (statusCode === 429)\n        return { valid: true, status: \"error\", message: \"Rate limited — key may be valid\", latencyMs, provider: \"openai\" };\n      return { valid: false, status: \"error\", message: `Unexpected status ${statusCode}`, latencyMs, provider: \"openai\" };\n    } catch (err) {\n      return { valid: false, status: \"error\", message: `${err instanceof Error ? err.message : \"Network error\"}`, latencyMs: Date.now() - start, provider: \"openai\" };\n    }\n  },\n};\n\nconst stripeProvider: Provider = {\n  name: \"stripe\",\n  description: \"Stripe API key validation\",\n  prefixes: [\"sk_live_\", \"sk_test_\", \"rk_live_\", \"rk_test_\", \"pk_live_\", \"pk_test_\"],\n  async validate(value: string): Promise<ValidationResult> {\n    const start = Date.now();\n    try {\n      const { statusCode } = await makeRequest(\n        \"https://api.stripe.com/v1/balance\",\n        {\n          Authorization: `Bearer ${value}`,\n          \"User-Agent\": \"q-ring-validator/1.0\",\n        },\n      );\n      const latencyMs = Date.now() - start;\n\n      if (statusCode === 200)\n        return { valid: true, status: \"valid\", message: \"API key is valid\", latencyMs, provider: \"stripe\" };\n      if (statusCode === 401)\n        return { valid: false, status: \"invalid\", message: \"Invalid or revoked API key\", latencyMs, provider: \"stripe\" };\n      if (statusCode === 429)\n        return { valid: true, status: \"error\", message: \"Rate limited — key may be valid\", latencyMs, provider: \"stripe\" };\n      return { valid: false, status: \"error\", message: `Unexpected status ${statusCode}`, latencyMs, provider: \"stripe\" };\n    } catch (err) {\n      return { valid: false, status: \"error\", message: `${err instanceof Error ? err.message : \"Network error\"}`, latencyMs: Date.now() - start, provider: \"stripe\" };\n    }\n  },\n};\n\nconst githubProvider: Provider = {\n  name: \"github\",\n  description: \"GitHub token validation\",\n  prefixes: [\"ghp_\", \"gho_\", \"ghu_\", \"ghs_\", \"ghr_\", \"github_pat_\"],\n  async validate(value: string): Promise<ValidationResult> {\n    const start = Date.now();\n    try {\n      const { statusCode } = await makeRequest(\n        \"https://api.github.com/user\",\n        {\n          Authorization: `token ${value}`,\n          \"User-Agent\": \"q-ring-validator/1.0\",\n          Accept: \"application/vnd.github+json\",\n        },\n      );\n      const latencyMs = Date.now() - start;\n\n      if (statusCode === 200)\n        return { valid: true, status: \"valid\", message: \"Token is valid\", latencyMs, provider: \"github\" };\n      if (statusCode === 401)\n        return { valid: false, status: \"invalid\", message: \"Invalid or expired token\", latencyMs, provider: \"github\" };\n      if (statusCode === 403)\n        return { valid: false, status: \"invalid\", message: \"Token lacks required permissions\", latencyMs, provider: \"github\" };\n      if (statusCode === 429)\n        return { valid: true, status: \"error\", message: \"Rate limited — token may be valid\", latencyMs, provider: \"github\" };\n      return { valid: false, status: \"error\", message: `Unexpected status ${statusCode}`, latencyMs, provider: \"github\" };\n    } catch (err) {\n      return { valid: false, status: \"error\", message: `${err instanceof Error ? err.message : \"Network error\"}`, latencyMs: Date.now() - start, provider: \"github\" };\n    }\n  },\n};\n\nconst awsProvider: Provider = {\n  name: \"aws\",\n  description: \"AWS access key validation (checks key format only — full STS validation requires secret key + region)\",\n  prefixes: [\"AKIA\", \"ASIA\"],\n  async validate(value: string): Promise<ValidationResult> {\n    const start = Date.now();\n    const latencyMs = Date.now() - start;\n\n    if (/^(AKIA|ASIA)[A-Z0-9]{16}$/.test(value)) {\n      return { valid: true, status: \"unknown\", message: \"Valid AWS access key format (STS validation requires secret key)\", latencyMs, provider: \"aws\" };\n    }\n    return { valid: false, status: \"invalid\", message: \"Invalid AWS access key format\", latencyMs, provider: \"aws\" };\n  },\n};\n\nconst httpProvider: Provider = {\n  name: \"http\",\n  description: \"Generic HTTP endpoint validation\",\n  async validate(value: string, url?: string): Promise<ValidationResult> {\n    const start = Date.now();\n\n    if (!url) {\n      return { valid: false, status: \"unknown\", message: \"No validation URL configured\", latencyMs: 0, provider: \"http\" };\n    }\n\n    const ssrfBlock = await checkSSRF(url);\n    if (ssrfBlock) {\n      return { valid: false, status: \"error\", message: `SSRF blocked: ${ssrfBlock}`, latencyMs: Date.now() - start, provider: \"http\" };\n    }\n\n    try {\n      const { statusCode } = await makeRequest(url, {\n        Authorization: `Bearer ${value}`,\n        \"User-Agent\": \"q-ring-validator/1.0\",\n      });\n      const latencyMs = Date.now() - start;\n\n      if (statusCode >= 200 && statusCode < 300)\n        return { valid: true, status: \"valid\", message: `Endpoint returned ${statusCode}`, latencyMs, provider: \"http\" };\n      if (statusCode === 401 || statusCode === 403)\n        return { valid: false, status: \"invalid\", message: `Authentication failed (${statusCode})`, latencyMs, provider: \"http\" };\n      return { valid: false, status: \"error\", message: `Unexpected status ${statusCode}`, latencyMs, provider: \"http\" };\n    } catch (err) {\n      return { valid: false, status: \"error\", message: `${err instanceof Error ? err.message : \"Network error\"}`, latencyMs: Date.now() - start, provider: \"http\" };\n    }\n  },\n};\n\nexport const registry = new ProviderRegistry();\n// Prefix detection iterates in registration order: anthropic (sk-ant-) and\n// openrouter (sk-or-) MUST come before openai, whose bare \"sk-\" would\n// otherwise shadow them.\nregistry.register(anthropicProvider);\nregistry.register(openrouterProvider);\nregistry.register(openaiProvider);\nregistry.register(googleAiProvider);\nregistry.register(groqProvider);\nregistry.register(huggingfaceProvider);\nregistry.register(elevenlabsProvider);\nregistry.register(vercelProvider);\nregistry.register(stripeProvider);\nregistry.register(githubProvider);\nregistry.register(awsProvider);\nregistry.register(httpProvider);\n\n/**\n * Validate a secret value against its detected or specified provider.\n */\nexport async function validateSecret(\n  value: string,\n  opts?: { provider?: string; validationUrl?: string },\n): Promise<ValidationResult> {\n  const provider = opts?.provider\n    ? registry.get(opts.provider)\n    : registry.detectProvider(value);\n\n  if (!provider) {\n    return {\n      valid: false,\n      status: \"unknown\",\n      message: \"No provider detected — set a provider in the manifest or secret metadata\",\n      latencyMs: 0,\n      provider: \"none\",\n    };\n  }\n\n  if (provider.name === \"http\" && opts?.validationUrl) {\n    return (provider as any).validate(value, opts.validationUrl);\n  }\n\n  return provider.validate(value);\n}\n\n// ─── Rotation Support ───\n\nexport interface RotationResult {\n  rotated: boolean;\n  provider: string;\n  message: string;\n  newValue?: string;\n}\n\nexport interface RotatableProvider extends Provider {\n  rotate?(currentValue: string): Promise<RotationResult>;\n  supportsRotation: boolean;\n}\n\n/**\n * Attempt provider-native rotation of a secret.\n * Falls back to local generation if the provider does not support native rotation.\n */\nexport async function rotateWithProvider(\n  value: string,\n  providerName?: string,\n): Promise<RotationResult> {\n  const provider = providerName\n    ? registry.get(providerName)\n    : registry.detectProvider(value);\n\n  if (!provider) {\n    return { rotated: false, provider: \"none\", message: \"No provider detected for rotation\" };\n  }\n\n  const rotatable = provider as RotatableProvider;\n  if (rotatable.supportsRotation && rotatable.rotate) {\n    return rotatable.rotate(value);\n  }\n\n  // Fall back to local generation\n  const format: NoiseFormat = \"api-key\";\n  const newValue = generateSecret({ format, length: 48 });\n  return {\n    rotated: true,\n    provider: provider.name,\n    message: `Provider \"${provider.name}\" does not support native rotation — generated new value locally`,\n    newValue,\n  };\n}\n\n// ─── CI Scan ───\n\nexport interface CiScanResult {\n  key: string;\n  validation: ValidationResult;\n  requiresRotation: boolean;\n}\n\n/**\n * CI-oriented batch validation: validates all secrets and returns\n * a structured report suitable for CI pipeline gating.\n */\nexport async function ciValidateBatch(\n  secrets: { key: string; value: string; provider?: string; validationUrl?: string }[],\n): Promise<{ results: CiScanResult[]; allValid: boolean; failCount: number }> {\n  const results: CiScanResult[] = [];\n\n  for (const s of secrets) {\n    const validation = await validateSecret(s.value, {\n      provider: s.provider,\n      validationUrl: s.validationUrl,\n    });\n\n    results.push({\n      key: s.key,\n      validation,\n      requiresRotation: validation.status === \"invalid\",\n    });\n  }\n\n  const failCount = results.filter((r) => !r.validation.valid).length;\n\n  return { results, allValid: failCount === 0, failCount };\n}\n","/**\n * Self-Documenting Project Context for AI Agents\n *\n * Provides a safe, redacted view of the project's secrets, configuration,\n * and state without ever exposing actual secret values.\n */\n\nimport { listSecrets } from \"./keyring.js\";\nimport { collapseEnvironment, readProjectConfig } from \"./collapse.js\";\nimport { queryAudit } from \"./observer.js\";\nimport { listHooks } from \"./hooks.js\";\nimport { registry as providerRegistry } from \"./validate.js\";\nimport { registry as jitRegistry } from \"./provision.js\";\nimport type { KeyringOptions } from \"./keyring.js\";\n\nexport interface SecretSummary {\n  key: string;\n  scope: string;\n  tags?: string[];\n  description?: string;\n  provider?: string;\n  requiresApproval?: boolean;\n  jitProvider?: string;\n  hasStates: boolean;\n  isExpired: boolean;\n  isStale: boolean;\n  timeRemaining: string | null;\n  accessCount: number;\n  lastAccessed: string | null;\n  rotationFormat?: string;\n}\n\nexport interface ProjectContext {\n  projectPath: string;\n  environment: {\n    env: string;\n    source: string;\n  } | null;\n  secrets: SecretSummary[];\n  totalSecrets: number;\n  expiredCount: number;\n  staleCount: number;\n  protectedCount: number;\n  manifest: {\n    declared: number;\n    missing: string[];\n  } | null;\n  validationProviders: string[];\n  jitProviders: string[];\n  hooksCount: number;\n  recentActions: Array<{\n    action: string;\n    key?: string;\n    source: string;\n    timestamp: string;\n  }>;\n}\n\nexport function getProjectContext(opts: KeyringOptions = {}): ProjectContext {\n  const projectPath = opts.projectPath ?? process.cwd();\n  const envResult = collapseEnvironment({ projectPath });\n\n  const secretsList = listSecrets({\n    ...opts,\n    projectPath,\n    silent: true,\n  });\n\n  let expiredCount = 0;\n  let staleCount = 0;\n  let protectedCount = 0;\n\n  const secrets: SecretSummary[] = secretsList.map((entry) => {\n    const meta = entry.envelope?.meta;\n    const decay = entry.decay;\n\n    if (decay?.isExpired) expiredCount++;\n    if (decay?.isStale) staleCount++;\n    if (meta?.requiresApproval) protectedCount++;\n\n    return {\n      key: entry.key,\n      scope: entry.scope,\n      tags: meta?.tags,\n      description: meta?.description,\n      provider: meta?.provider,\n      requiresApproval: meta?.requiresApproval,\n      jitProvider: meta?.jitProvider,\n      hasStates: !!(entry.envelope?.states && Object.keys(entry.envelope.states).length > 0),\n      isExpired: decay?.isExpired ?? false,\n      isStale: decay?.isStale ?? false,\n      timeRemaining: decay?.timeRemaining ?? null,\n      accessCount: meta?.accessCount ?? 0,\n      lastAccessed: meta?.lastAccessedAt ?? null,\n      rotationFormat: meta?.rotationFormat,\n    };\n  });\n\n  // Manifest analysis\n  let manifest: ProjectContext[\"manifest\"] = null;\n  const config = readProjectConfig(projectPath);\n  if (config?.secrets) {\n    const declaredKeys = Object.keys(config.secrets);\n    const existingKeys = new Set(secrets.map((s) => s.key));\n    const missing = declaredKeys.filter((k) => !existingKeys.has(k));\n    manifest = { declared: declaredKeys.length, missing };\n  }\n\n  // Recent audit activity (last 20 events, redacted)\n  const recentEvents = queryAudit({ limit: 20 });\n  const recentActions = recentEvents.map((e) => ({\n    action: e.action,\n    key: e.key,\n    source: e.source,\n    timestamp: e.timestamp,\n  }));\n\n  return {\n    projectPath,\n    environment: envResult\n      ? { env: envResult.env, source: envResult.source }\n      : null,\n    secrets,\n    totalSecrets: secrets.length,\n    expiredCount,\n    staleCount,\n    protectedCount,\n    manifest,\n    validationProviders: providerRegistry.listProviders().map((p) => p.name),\n    jitProviders: jitRegistry.listProviders().map((p) => p.name),\n    hooksCount: listHooks().length,\n    recentActions,\n  };\n}\n","import type { Command } from \"commander\";\nimport {\n  getSecret,\n  setSecret,\n  getEnvelope,\n  hasSecret,\n} from \"../../core/keyring.js\";\nimport { collapseEnvironment, readProjectConfig } from \"../../core/collapse.js\";\nimport { checkDecay } from \"../../core/envelope.js\";\nimport { generateSecret } from \"../../core/noise.js\";\nimport { getProjectContext } from \"../../core/context.js\";\nimport { registerHook, type HookType, type HookAction } from \"../../core/hooks.js\";\nimport { writeFileSync, readFileSync, existsSync } from \"node:fs\";\nimport { c, scopeColor, envBadge, SYMBOLS } from \"../../utils/colors.js\";\nimport { wantsJsonOutput, emitJson } from \"../helpers.js\";\nimport { confirm } from \"../../utils/prompt.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerProjectCommands(program: Command): void {\n  program\n    .command(\"context\")\n    .alias(\"describe\")\n    .description(\n      \"Show safe, redacted project context for AI agents (no secret values exposed)\",\n    )\n    .option(\"-g, --global\", \"Global scope only\")\n    .option(\"-p, --project\", \"Project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON (for MCP / programmatic use)\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      const context = getProjectContext(opts);\n\n      if (wantsJsonOutput(program, cmd)) {\n        console.log(JSON.stringify(context, null, 2));\n        return;\n      }\n\n      console.log(`\\n${SYMBOLS.zap} ${c.bold(\"Project Context for AI Assistant\")}`);\n      console.log(`  Project: ${c.cyan(context.projectPath)}`);\n\n      if (context.environment) {\n        console.log(\n          `  Environment: ${envBadge(context.environment.env)} ${c.dim(`(${context.environment.source})`)}`,\n        );\n      }\n\n      console.log(\n        `\\n${c.bold(\"  Secrets:\")} ${context.totalSecrets} total  ${c.dim(`(${context.expiredCount} expired, ${context.staleCount} stale, ${context.protectedCount} protected)`)}`,\n      );\n      for (const s of context.secrets) {\n        const tags = s.tags?.length ? c.dim(` [${s.tags.join(\",\")}]`) : \"\";\n        const flags: string[] = [];\n        if (s.requiresApproval) flags.push(c.yellow(\"locked\"));\n        if (s.jitProvider) flags.push(c.magenta(\"jit\"));\n        if (s.hasStates) flags.push(c.blue(\"superposition\"));\n        if (s.isExpired) flags.push(c.red(\"expired\"));\n        else if (s.isStale) flags.push(c.yellow(\"stale\"));\n        const flagStr = flags.length ? ` ${flags.join(\" \")}` : \"\";\n        console.log(\n          `    ${c.bold(s.key)} ${scopeColor(s.scope)}${tags}${flagStr}`,\n        );\n      }\n\n      if (context.manifest) {\n        console.log(\n          `\\n${c.bold(\"  Manifest:\")} ${context.manifest.declared} declared`,\n        );\n        if (context.manifest.missing.length > 0) {\n          console.log(\n            `    ${c.red(\"Missing:\")} ${context.manifest.missing.join(\", \")}`,\n          );\n        } else {\n          console.log(\n            `    ${c.green(SYMBOLS.check)} All manifest secrets present`,\n          );\n        }\n      }\n\n      console.log(\n        `\\n${c.bold(\"  Providers:\")} ${context.validationProviders.join(\", \") || \"none\"}`,\n      );\n      console.log(\n        `${c.bold(\"  JIT Providers:\")} ${context.jitProviders.join(\", \") || \"none\"}`,\n      );\n      console.log(`${c.bold(\"  Hooks:\")} ${context.hooksCount} registered`);\n\n      if (context.recentActions.length > 0) {\n        console.log(\n          `\\n${c.bold(\"  Recent Activity:\")} (last ${context.recentActions.length})`,\n        );\n        for (const a of context.recentActions.slice(0, 8)) {\n          const ts = new Date(a.timestamp).toLocaleTimeString();\n          console.log(\n            `    ${c.dim(ts)} ${a.action}${a.key ? ` ${c.bold(a.key)}` : \"\"} ${c.dim(`(${a.source})`)}`,\n          );\n        }\n      }\n\n      console.log();\n    });\n\n  program\n    .command(\"check\")\n    .description(\"Validate project secrets against .q-ring.json manifest\")\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const projectPath = cmd.projectPath ?? process.cwd();\n      const config = readProjectConfig(projectPath);\n\n      if (!config?.secrets || Object.keys(config.secrets).length === 0) {\n        console.error(\n          c.red(`${SYMBOLS.cross} No secrets manifest found in .q-ring.json`),\n        );\n        console.log(\n          c.dim(\n            '  Add a \"secrets\" field to your .q-ring.json to define required secrets.',\n          ),\n        );\n        process.exit(1);\n      }\n\n      type KeyStatus = \"ok\" | \"missing\" | \"optional-not-set\" | \"expired\" | \"stale\";\n      const statuses: Array<{\n        key: string;\n        status: KeyStatus;\n        description?: string;\n        lifetimePercent?: number;\n      }> = [];\n\n      for (const [key, manifest] of Object.entries(config.secrets)) {\n        const result = getEnvelope(key, { projectPath, source: \"cli\" });\n\n        if (!result) {\n          statuses.push({\n            key,\n            status: manifest.required !== false ? \"missing\" : \"optional-not-set\",\n            description: manifest.description,\n          });\n          continue;\n        }\n\n        const decay = checkDecay(result.envelope);\n        statuses.push({\n          key,\n          status: decay.isExpired ? \"expired\" : decay.isStale ? \"stale\" : \"ok\",\n          description: manifest.description,\n          ...(decay.isStale && !decay.isExpired\n            ? { lifetimePercent: decay.lifetimePercent }\n            : {}),\n        });\n      }\n\n      const present = statuses.filter((s) => s.status === \"ok\").length;\n      const missing = statuses.filter((s) => s.status === \"missing\").length;\n      const expiredCount = statuses.filter((s) => s.status === \"expired\").length;\n      const staleCount = statuses.filter((s) => s.status === \"stale\").length;\n      const total = Object.keys(config.secrets).length;\n\n      if (\n        emitJson(program, cmd, {\n          projectPath,\n          secrets: statuses,\n          summary: { total, present, missing, expired: expiredCount, stale: staleCount },\n          ready: missing === 0,\n        })\n      ) {\n        if (missing > 0) process.exitCode = 1;\n        return;\n      }\n\n      console.log(\n        c.bold(`\\n  ${SYMBOLS.shield} Project secret manifest check\\n`),\n      );\n\n      for (const s of statuses) {\n        const desc = s.description ? c.dim(`— ${s.description}`) : \"\";\n        if (s.status === \"missing\") {\n          console.log(`  ${c.red(SYMBOLS.cross)} ${c.bold(s.key)} ${c.red(\"MISSING\")} ${desc}`);\n        } else if (s.status === \"optional-not-set\") {\n          console.log(`  ${c.dim(SYMBOLS.cross)} ${c.bold(s.key)} ${c.dim(\"optional, not set\")} ${desc}`);\n        } else if (s.status === \"expired\") {\n          console.log(`  ${c.red(SYMBOLS.warning)} ${c.bold(s.key)} ${c.bgRed(c.white(\" EXPIRED \"))} ${desc}`);\n        } else if (s.status === \"stale\") {\n          console.log(`  ${c.yellow(SYMBOLS.warning)} ${c.bold(s.key)} ${c.yellow(`stale (${s.lifetimePercent}%)`)} ${desc}`);\n        } else {\n          console.log(`  ${c.green(SYMBOLS.check)} ${c.bold(s.key)} ${c.green(\"OK\")} ${desc}`);\n        }\n      }\n\n      console.log(\n        `\\n  ${c.bold(`${total} declared`)}  ${c.green(`${present} present`)}  ${c.yellow(`${staleCount} stale`)}  ${c.red(`${expiredCount} expired`)}  ${c.red(`${missing} missing`)}`,\n      );\n\n      if (missing > 0) {\n        console.log(\n          `\\n  ${c.red(\"Project is NOT ready — missing required secrets.\")}`,\n        );\n      } else if (expiredCount > 0) {\n        console.log(\n          `\\n  ${c.yellow(\"Project has expired secrets that need rotation.\")}`,\n        );\n      } else {\n        console.log(\n          `\\n  ${c.green(`${SYMBOLS.check} Project is ready — all required secrets present.`)}`,\n        );\n      }\n\n      console.log();\n\n      if (missing > 0) process.exit(1);\n    });\n\n  program\n    .command(\"env\")\n    .description(\"Show detected environment (wavefunction collapse context)\")\n    .option(\"--project-path <path>\", \"Project path for detection\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const result = collapseEnvironment({\n        projectPath: cmd.projectPath ?? process.cwd(),\n      });\n\n      if (emitJson(program, cmd, { environment: result })) return;\n\n      if (result) {\n        console.log(\n          `${SYMBOLS.zap} ${c.bold(\"Collapsed environment:\")} ${envBadge(result.env)} ${c.dim(`(source: ${result.source})`)}`,\n        );\n      } else {\n        console.log(\n          c.dim(\n            \"No environment detected. Set QRING_ENV, NODE_ENV, or create .q-ring.json\",\n          ),\n        );\n      }\n    });\n\n  program\n    .command(\"env:generate\")\n    .description(\n      \"Generate a .env file from the project manifest (.q-ring.json)\",\n    )\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .option(\"-o, --output <file>\", \"Output file path (defaults to stdout)\")\n    .option(\"-e, --env <env>\", \"Force environment for superposition collapse\")\n    .option(\"-y, --yes\", \"Overwrite an existing output file without asking\")\n    .action(async (cmd) => {\n      const projectPath = cmd.projectPath ?? process.cwd();\n      const config = readProjectConfig(projectPath);\n\n      if (\n        cmd.output &&\n        existsSync(cmd.output) &&\n        !(await confirm(`Overwrite existing ${cmd.output}?`, { assumeYes: cmd.yes }))\n      ) {\n        console.error(c.dim(\"Aborted.\"));\n        process.exitCode = 1;\n        return;\n      }\n\n      if (!config?.secrets || Object.keys(config.secrets).length === 0) {\n        console.error(\n          c.red(`${SYMBOLS.cross} No secrets manifest found in .q-ring.json`),\n        );\n        process.exit(1);\n      }\n\n      const opts = buildOpts(cmd);\n      const lines: string[] = [];\n      const warnings: string[] = [];\n\n      for (const [key, manifest] of Object.entries(config.secrets)) {\n        const value = getSecret(key, { ...opts, projectPath, source: \"cli\" });\n\n        if (value === null) {\n          if (manifest.required !== false) {\n            warnings.push(`MISSING (required): ${key}`);\n          }\n          lines.push(\n            `# ${key}= ${manifest.description ? `# ${manifest.description}` : \"\"}`,\n          );\n          continue;\n        }\n\n        const result = getEnvelope(key, { projectPath, source: \"cli\" });\n        if (result) {\n          const decay = checkDecay(result.envelope);\n          if (decay.isExpired) {\n            warnings.push(`EXPIRED: ${key}`);\n          } else if (decay.isStale) {\n            warnings.push(`STALE (${decay.lifetimePercent}%): ${key}`);\n          }\n        }\n\n        const escaped = value\n          .replace(/\\\\/g, \"\\\\\\\\\")\n          .replace(/\"/g, '\\\\\"')\n          .replace(/\\n/g, \"\\\\n\");\n        lines.push(`${key}=\"${escaped}\"`);\n      }\n\n      const output = lines.join(\"\\n\") + \"\\n\";\n\n      if (cmd.output) {\n        writeFileSync(cmd.output, output);\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"generated\")} ${c.bold(cmd.output)} (${Object.keys(config.secrets).length} keys)`,\n        );\n      } else {\n        process.stdout.write(output);\n      }\n\n      if (warnings.length > 0 && process.stderr.isTTY) {\n        console.error();\n        for (const w of warnings) {\n          console.error(`  ${c.yellow(SYMBOLS.warning)} ${w}`);\n        }\n        console.error();\n      }\n    });\n\n  program\n    .command(\"wizard <name>\")\n    .description(\n      \"Set up a new service integration with secrets, manifest, and hooks\",\n    )\n    .option(\n      \"--keys <keys>\",\n      \"Comma-separated secret key names to create (e.g. API_KEY,API_SECRET)\",\n    )\n    .option(\n      \"--provider <provider>\",\n      \"Validation provider (e.g. openai, stripe, github)\",\n    )\n    .option(\"--tags <tags>\", \"Comma-separated tags for all secrets\")\n    .option(\n      \"--hook-exec <cmd>\",\n      \"Shell command to run when any of these secrets change\",\n    )\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-y, --yes\", \"Skip confirmation when overwriting existing secrets\")\n    .action(async (name: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const prefix = name.toUpperCase().replace(/[^A-Z0-9]/g, \"_\");\n      const tags = cmd.tags?.split(\",\").map((t: string) => t.trim()) ?? [\n        name.toLowerCase(),\n      ];\n      const provider = cmd.provider;\n\n      let keyNames: string[];\n      if (cmd.keys) {\n        keyNames = cmd.keys.split(\",\").map((k: string) => k.trim());\n      } else {\n        keyNames = [`${prefix}_API_KEY`, `${prefix}_API_SECRET`];\n      }\n\n      // The wizard generates fresh random values — overwriting an existing\n      // secret replaces a real credential with a placeholder. Ask first.\n      const existing = keyNames.filter((k) => hasSecret(k, opts));\n      if (\n        existing.length > 0 &&\n        !(await confirm(\n          `${existing.length} secret(s) already exist and will be overwritten with generated values: ${existing.join(\", \")}. Continue?`,\n          { assumeYes: cmd.yes },\n        ))\n      ) {\n        console.error(c.dim(\"Aborted.\"));\n        process.exitCode = 1;\n        return;\n      }\n\n      console.log(`\\n${SYMBOLS.zap} ${c.bold(`Setting up service: ${name}`)}\\n`);\n\n      for (const key of keyNames) {\n        const value = generateSecret({\n          format: \"api-key\",\n          prefix: `${prefix.toLowerCase()}_`,\n        });\n        setSecret(key, value, {\n          ...opts,\n          tags,\n          provider,\n          description: `Auto-generated by wizard for ${name}`,\n        });\n        console.log(`  ${c.green(SYMBOLS.check)} Created ${c.bold(key)}`);\n      }\n\n      const projectPath = opts.projectPath ?? process.cwd();\n      const manifestPath = `${projectPath}/.q-ring.json`;\n      let config: {\n        secrets?: Record<\n          string,\n          { required?: boolean; description?: string; provider?: string }\n        >;\n      } = {};\n      try {\n        if (existsSync(manifestPath)) {\n          config = JSON.parse(readFileSync(manifestPath, \"utf8\"));\n        }\n      } catch {\n        /* ignore parse failures; we'll overwrite with a valid object */\n      }\n\n      if (!config.secrets) config.secrets = {};\n      for (const key of keyNames) {\n        config.secrets[key] = {\n          required: true,\n          description: `${name} integration`,\n          ...(provider ? { provider } : {}),\n        };\n      }\n\n      writeFileSync(manifestPath, JSON.stringify(config, null, 2) + \"\\n\", \"utf8\");\n      console.log(\n        `  ${c.green(SYMBOLS.check)} Updated ${c.dim(\".q-ring.json\")} manifest`,\n      );\n\n      if (cmd.hookExec) {\n        for (const key of keyNames) {\n          registerHook({\n            type: \"shell\" as HookType,\n            match: {\n              key,\n              action: [\"write\" as HookAction, \"delete\" as HookAction],\n            },\n            command: cmd.hookExec,\n            description: `${name} wizard hook`,\n            enabled: true,\n          });\n        }\n        console.log(\n          `  ${c.green(SYMBOLS.check)} Registered hook: ${c.dim(cmd.hookExec)}`,\n        );\n      }\n\n      console.log(\n        `\\n  ${c.green(\"Done!\")} Service \"${name}\" is ready with ${keyNames.length} secrets.\\n`,\n      );\n    });\n}\n","/**\n * Quantum Teleportation: securely share/transfer secrets between machines.\n *\n * Generates encrypted bundles that can be shared via any channel.\n * The recipient decrypts with a shared passphrase (out-of-band exchange).\n * Uses AES-256-GCM with PBKDF2-derived keys.\n */\n\nimport {\n  randomBytes,\n  createCipheriv,\n  createDecipheriv,\n  pbkdf2Sync,\n} from \"node:crypto\";\nimport { z } from \"zod\";\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst KEY_LENGTH = 32;\n/** NIST / OpenSSL recommendation for AES-GCM (96-bit nonce). */\nconst IV_LENGTH = 12;\nconst SALT_LENGTH = 32;\n/** OWASP-recommended floor for PBKDF2-HMAC-SHA512 (2023). */\nconst PBKDF2_ITERATIONS = 210000;\n/** Bundles without an explicit `iter` predate the bump; decrypt at the old cost. */\nconst LEGACY_PBKDF2_ITERATIONS = 100000;\n\nexport interface TeleportBundle {\n  /** Format version */\n  v: 1;\n  /** Base64-encoded encrypted payload */\n  data: string;\n  /** Base64-encoded salt for key derivation */\n  salt: string;\n  /** Base64-encoded initialization vector */\n  iv: string;\n  /** Base64-encoded auth tag */\n  tag: string;\n  /** ISO timestamp of creation */\n  createdAt: string;\n  /** Number of secrets in the bundle */\n  count: number;\n  /** PBKDF2 iteration count used for key derivation (absent = legacy 100k). */\n  iter?: number;\n}\n\nexport interface TeleportPayload {\n  secrets: { key: string; value: string; scope?: string }[];\n  exportedAt: string;\n  exportedBy?: string;\n}\n\nexport const TeleportBundleSchema = z.object({\n  v: z.literal(1),\n  data: z.string(),\n  salt: z.string(),\n  iv: z.string(),\n  tag: z.string(),\n  createdAt: z.string(),\n  count: z.number(),\n  iter: z.number().optional(),\n});\n\nexport const TeleportPayloadSchema = z.object({\n  secrets: z.array(\n    z.object({\n      key: z.string(),\n      value: z.string(),\n      scope: z.string().optional(),\n    }),\n  ),\n  exportedAt: z.string(),\n  exportedBy: z.string().optional(),\n});\n\nfunction deriveKey(\n  passphrase: string,\n  salt: Buffer,\n  iterations: number = PBKDF2_ITERATIONS,\n): Buffer {\n  return pbkdf2Sync(passphrase, salt, iterations, KEY_LENGTH, \"sha512\");\n}\n\n/**\n * Pack secrets into an encrypted teleport bundle.\n */\nexport function teleportPack(\n  secrets: { key: string; value: string; scope?: string }[],\n  passphrase: string,\n): string {\n  const payload: TeleportPayload = {\n    secrets,\n    exportedAt: new Date().toISOString(),\n  };\n\n  const plaintext = JSON.stringify(payload);\n  const salt = randomBytes(SALT_LENGTH);\n  const iv = randomBytes(IV_LENGTH);\n  const key = deriveKey(passphrase, salt, PBKDF2_ITERATIONS);\n\n  const cipher = createCipheriv(ALGORITHM, key, iv);\n  const encrypted = Buffer.concat([\n    cipher.update(plaintext, \"utf8\"),\n    cipher.final(),\n  ]);\n  const tag = cipher.getAuthTag();\n\n  const bundle: TeleportBundle = {\n    v: 1,\n    data: encrypted.toString(\"base64\"),\n    salt: salt.toString(\"base64\"),\n    iv: iv.toString(\"base64\"),\n    tag: tag.toString(\"base64\"),\n    createdAt: new Date().toISOString(),\n    count: secrets.length,\n    iter: PBKDF2_ITERATIONS,\n  };\n\n  return Buffer.from(JSON.stringify(bundle)).toString(\"base64\");\n}\n\n/**\n * Unpack and decrypt a teleport bundle.\n */\nexport function teleportUnpack(\n  encoded: string,\n  passphrase: string,\n): TeleportPayload {\n  let bundleJson: string;\n  try {\n    bundleJson = Buffer.from(encoded, \"base64\").toString(\"utf8\");\n  } catch {\n    throw new Error(\"ERR_TELEPORT_CORRUPT: invalid base64 bundle\");\n  }\n\n  let rawBundle: unknown;\n  try {\n    rawBundle = JSON.parse(bundleJson);\n  } catch {\n    throw new Error(\"ERR_TELEPORT_CORRUPT: bundle is not valid JSON\");\n  }\n\n  const parsedBundle = TeleportBundleSchema.safeParse(rawBundle);\n  if (!parsedBundle.success) {\n    throw new Error(\n      `ERR_TELEPORT_CORRUPT: invalid bundle shape (${parsedBundle.error.message})`,\n    );\n  }\n  const bundle = parsedBundle.data;\n\n  const salt = Buffer.from(bundle.salt, \"base64\");\n  const iv = Buffer.from(bundle.iv, \"base64\");\n  const tag = Buffer.from(bundle.tag, \"base64\");\n  const encrypted = Buffer.from(bundle.data, \"base64\");\n  const key = deriveKey(passphrase, salt, bundle.iter ?? LEGACY_PBKDF2_ITERATIONS);\n\n  const decipher = createDecipheriv(ALGORITHM, key, iv);\n  decipher.setAuthTag(tag);\n\n  let decrypted: Buffer;\n  try {\n    decrypted = Buffer.concat([\n      decipher.update(encrypted),\n      decipher.final(),\n    ]);\n  } catch {\n    throw new Error(\"ERR_TELEPORT_BAD_PASSPHRASE: decryption failed (wrong passphrase or corrupt data)\");\n  }\n\n  let rawPayload: unknown;\n  try {\n    rawPayload = JSON.parse(decrypted.toString(\"utf8\"));\n  } catch {\n    throw new Error(\"ERR_TELEPORT_CORRUPT: decrypted payload is not valid JSON\");\n  }\n\n  const payload = TeleportPayloadSchema.safeParse(rawPayload);\n  if (!payload.success) {\n    throw new Error(\n      `ERR_TELEPORT_CORRUPT: invalid payload (${payload.error.message})`,\n    );\n  }\n  return payload.data;\n}\n","import type { Command } from \"commander\";\nimport {\n  getSecret,\n  setSecret,\n  hasSecret,\n  listSecrets,\n  entangleSecrets,\n  disentangleSecrets,\n  type KeyringOptions,\n} from \"../../core/keyring.js\";\nimport {\n  generateSecret,\n  estimateEntropy,\n  type NoiseFormat,\n} from \"../../core/noise.js\";\nimport {\n  tunnelCreate,\n  tunnelRead,\n  tunnelDestroy,\n  tunnelList,\n} from \"../../core/tunnel.js\";\nimport { teleportPack, teleportUnpack } from \"../../core/teleport.js\";\nimport { promptSecret, confirm } from \"../../utils/prompt.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerQuantumCommands(program: Command): void {\n  program\n    .command(\"generate\")\n    .alias(\"gen\")\n    .description(\"Generate a cryptographic secret (quantum noise)\")\n    .option(\n      \"-f, --format <format>\",\n      \"Format: hex, base64, alphanumeric, uuid, api-key, token, password\",\n      \"api-key\",\n    )\n    .option(\n      \"-l, --length <n>\",\n      \"Length (bytes or chars depending on format)\",\n      parseInt,\n    )\n    .option(\"--prefix <prefix>\", \"Prefix for api-key/token format\")\n    .option(\n      \"-s, --save <key>\",\n      \"Save the generated secret to keyring with this key\",\n    )\n    .option(\"-g, --global\", \"Save to global scope\")\n    .option(\"-p, --project\", \"Save to project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .action((cmd) => {\n      const secret = generateSecret({\n        format: cmd.format as NoiseFormat,\n        length: cmd.length,\n        prefix: cmd.prefix,\n      });\n\n      const entropy = estimateEntropy(secret);\n\n      if (cmd.save) {\n        const opts = buildOpts(cmd);\n        setSecret(cmd.save, secret, opts);\n        console.log(\n          `${SYMBOLS.sparkle} ${c.green(\"generated & saved\")} ${c.bold(cmd.save)} ${c.dim(`(${cmd.format}, ${entropy} bits entropy)`)}`,\n        );\n      } else {\n        process.stdout.write(secret);\n        if (process.stdout.isTTY) {\n          console.log(\n            `\\n${c.dim(`format: ${cmd.format} | entropy: ~${entropy} bits`)}`,\n          );\n        }\n      }\n    });\n\n  program\n    .command(\"entangle <sourceKey> <targetKey>\")\n    .description(\"Link two secrets — rotating one updates the other\")\n    .option(\"-g, --global\", \"Both in global scope\")\n    .option(\"--source-project <path>\", \"Source project path\")\n    .option(\"--target-project <path>\", \"Target project path\")\n    .action((sourceKey: string, targetKey: string, cmd) => {\n      const sourceOpts: KeyringOptions = {\n        scope: cmd.sourceProject ? \"project\" : \"global\",\n        projectPath: cmd.sourceProject ?? process.cwd(),\n        source: \"cli\",\n      };\n      const targetOpts: KeyringOptions = {\n        scope: cmd.targetProject ? \"project\" : \"global\",\n        projectPath: cmd.targetProject ?? process.cwd(),\n        source: \"cli\",\n      };\n\n      entangleSecrets(sourceKey, sourceOpts, targetKey, targetOpts);\n      console.log(\n        `${SYMBOLS.link} ${c.cyan(\"entangled\")} ${c.bold(sourceKey)} ${SYMBOLS.arrow} ${c.bold(targetKey)}`,\n      );\n    });\n\n  program\n    .command(\"disentangle <sourceKey> <targetKey>\")\n    .description(\"Unlink two entangled secrets\")\n    .option(\"-g, --global\", \"Both in global scope\")\n    .option(\"--source-project <path>\", \"Source project path\")\n    .option(\"--target-project <path>\", \"Target project path\")\n    .action((sourceKey: string, targetKey: string, cmd) => {\n      const sourceOpts: KeyringOptions = {\n        scope: cmd.sourceProject ? \"project\" : \"global\",\n        projectPath: cmd.sourceProject ?? process.cwd(),\n        source: \"cli\",\n      };\n      const targetOpts: KeyringOptions = {\n        scope: cmd.targetProject ? \"project\" : \"global\",\n        projectPath: cmd.targetProject ?? process.cwd(),\n        source: \"cli\",\n      };\n\n      disentangleSecrets(sourceKey, sourceOpts, targetKey, targetOpts);\n      console.log(\n        `${SYMBOLS.link} ${c.yellow(\"disentangled\")} ${c.bold(sourceKey)} ${SYMBOLS.arrow} ${c.bold(targetKey)}`,\n      );\n    });\n\n  // ─── Tunneling Commands ───\n\n  const tunnel = program\n    .command(\"tunnel\")\n    .description(\"Ephemeral in-memory secrets (quantum tunneling)\");\n\n  tunnel\n    .command(\"create <value>\")\n    .description(\"Create a tunneled secret (returns tunnel ID)\")\n    .option(\"--ttl <seconds>\", \"Auto-expire after N seconds\", parseInt)\n    .option(\"--max-reads <n>\", \"Self-destruct after N reads\", parseInt)\n    .action((value: string, cmd) => {\n      const id = tunnelCreate(value, {\n        ttlSeconds: cmd.ttl,\n        maxReads: cmd.maxReads,\n      });\n\n      console.log(`${SYMBOLS.ghost} ${c.magenta(\"tunneled\")} ${c.bold(id)}`);\n\n      const extras: string[] = [];\n      if (cmd.ttl) extras.push(`ttl=${cmd.ttl}s`);\n      if (cmd.maxReads) extras.push(`max-reads=${cmd.maxReads}`);\n      if (extras.length) console.log(c.dim(`  ${extras.join(\" | \")}`));\n    });\n\n  tunnel\n    .command(\"read <id>\")\n    .description(\"Read a tunneled secret (may self-destruct)\")\n    .action((id: string) => {\n      const value = tunnelRead(id);\n      if (value === null) {\n        console.error(\n          c.red(`${SYMBOLS.cross} Tunnel \"${id}\" not found or expired`),\n        );\n        process.exit(1);\n      }\n      process.stdout.write(value);\n    });\n\n  tunnel\n    .command(\"destroy <id>\")\n    .description(\"Destroy a tunneled secret immediately\")\n    .action((id: string) => {\n      const destroyed = tunnelDestroy(id);\n      if (destroyed) {\n        console.log(`${SYMBOLS.check} ${c.green(\"destroyed\")} ${id}`);\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} Tunnel \"${id}\" not found`));\n        process.exit(1);\n      }\n    });\n\n  tunnel\n    .command(\"list\")\n    .alias(\"ls\")\n    .description(\"List active tunnels\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const tunnels = tunnelList();\n      if (emitJson(program, cmd, { tunnels })) return;\n      if (tunnels.length === 0) {\n        console.log(c.dim(\"No active tunnels\"));\n        return;\n      }\n\n      console.log(\n        c.bold(`\\n  ${SYMBOLS.ghost} Active tunnels (${tunnels.length})\\n`),\n      );\n      for (const t of tunnels) {\n        const parts = [c.bold(t.id)];\n        parts.push(c.dim(`reads: ${t.accessCount}`));\n        if (t.maxReads) parts.push(c.dim(`max: ${t.maxReads}`));\n        if (t.expiresAt) {\n          const remaining = Math.max(\n            0,\n            Math.floor((t.expiresAt - Date.now()) / 1000),\n          );\n          parts.push(c.dim(`expires: ${remaining}s`));\n        }\n        console.log(`  ${SYMBOLS.ghost} ${parts.join(\"  \")}`);\n      }\n      console.log();\n    });\n\n  // ─── Teleportation Commands ───\n\n  const tp = program\n    .command(\"teleport\")\n    .alias(\"tp\")\n    .description(\"Encrypted secret sharing (quantum teleportation)\");\n\n  tp.command(\"pack\")\n    .description(\"Pack secrets into an encrypted bundle\")\n    .option(\"-k, --keys <keys>\", \"Comma-separated key names to pack\")\n    .option(\"-g, --global\", \"Pack global scope\")\n    .option(\"-p, --project\", \"Pack project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .action(async (cmd) => {\n      const opts = buildOpts(cmd);\n      const passphrase = await promptSecret(\n        `${SYMBOLS.lock} Enter passphrase for encryption: `,\n      );\n      if (!passphrase) {\n        console.error(c.red(\"Passphrase required\"));\n        process.exit(1);\n      }\n\n      const entries = listSecrets(opts);\n      let keys: string[] | undefined;\n      if (cmd.keys) {\n        keys = cmd.keys.split(\",\").map((k: string) => k.trim());\n      }\n\n      const secrets: { key: string; value: string; scope?: string }[] = [];\n      for (const entry of entries) {\n        if (keys && !keys.includes(entry.key)) continue;\n        const value = getSecret(entry.key, { ...opts, scope: entry.scope });\n        if (value !== null) {\n          secrets.push({ key: entry.key, value, scope: entry.scope });\n        }\n      }\n\n      if (secrets.length === 0) {\n        console.error(c.red(\"No secrets to pack\"));\n        process.exit(1);\n      }\n\n      const bundle = teleportPack(secrets, passphrase);\n      process.stdout.write(bundle);\n      if (process.stdout.isTTY) {\n        console.log(\n          `\\n${SYMBOLS.package} ${c.green(\"packed\")} ${secrets.length} secret(s)`,\n        );\n      }\n    });\n\n  tp.command(\"unpack [bundle]\")\n    .description(\"Unpack and import secrets from an encrypted bundle\")\n    .option(\"-g, --global\", \"Import to global scope\")\n    .option(\"-p, --project\", \"Import to project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--dry-run\", \"Show what would be imported without saving\")\n    .option(\"-y, --yes\", \"Overwrite existing secrets without asking\")\n    .action(async (bundle: string | undefined, cmd) => {\n      if (!bundle) {\n        const chunks: Buffer[] = [];\n        for await (const chunk of process.stdin) {\n          chunks.push(chunk);\n        }\n        bundle = Buffer.concat(chunks).toString(\"utf8\").trim();\n      }\n\n      const passphrase = await promptSecret(\n        `${SYMBOLS.lock} Enter passphrase for decryption: `,\n      );\n\n      // Only the decrypt itself maps to \"wrong passphrase\" — errors from the\n      // confirm/import steps below must not be swallowed by this catch.\n      let payload: ReturnType<typeof teleportUnpack>;\n      try {\n        payload = teleportUnpack(bundle, passphrase);\n      } catch {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Failed to unpack: wrong passphrase or corrupted bundle`,\n          ),\n        );\n        process.exit(1);\n      }\n\n      if (cmd.dryRun) {\n        console.log(\n          `\\n${SYMBOLS.package} ${c.bold(\"Would import\")} (${payload.secrets.length} secrets):\\n`,\n        );\n        for (const s of payload.secrets) {\n          console.log(\n            `  ${SYMBOLS.key} ${c.bold(s.key)} ${c.dim(`[${s.scope ?? \"global\"}]`)}`,\n          );\n        }\n        return;\n      }\n\n      const opts = buildOpts(cmd);\n\n      const existing = payload.secrets\n        .map((s) => s.key)\n        .filter((k) => hasSecret(k, opts));\n      if (\n        existing.length > 0 &&\n        !(await confirm(\n          `${existing.length} existing secret(s) will be overwritten: ${existing.join(\", \")}. Continue?`,\n          { assumeYes: cmd.yes },\n        ))\n      ) {\n        console.error(c.dim(\"Aborted.\"));\n        process.exitCode = 1;\n        return;\n      }\n\n      for (const s of payload.secrets) {\n        setSecret(s.key, s.value, opts);\n      }\n\n      console.log(\n        `${SYMBOLS.check} ${c.green(\"imported\")} ${payload.secrets.length} secret(s) from teleport bundle`,\n      );\n    });\n}\n","import type { Command } from \"commander\";\nimport {\n  getSecret,\n  setSecret,\n  listSecrets,\n  getEnvelope,\n} from \"../../core/keyring.js\";\nimport { readProjectConfig } from \"../../core/collapse.js\";\nimport {\n  validateSecret,\n  rotateWithProvider,\n  ciValidateBatch,\n  registry as providerRegistry,\n} from \"../../core/validate.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { wantsJsonOutput, emitJson } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerValidationCommands(program: Command): void {\n  program\n    .command(\"validate [key]\")\n    .description(\"Test if a secret is actually valid with its target service\")\n    .option(\"-g, --global\", \"Global scope only\")\n    .option(\"-p, --project\", \"Project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\n      \"--provider <name>\",\n      \"Force a specific provider (openai, stripe, github, aws, http)\",\n    )\n    .option(\n      \"--all\",\n      \"Validate all secrets that have a detectable provider\",\n    )\n    .option(\n      \"--manifest\",\n      \"Only validate manifest-declared secrets (with --all)\",\n    )\n    .option(\"--list-providers\", \"List all available providers\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (key: string | undefined, cmd) => {\n      if (cmd.listProviders) {\n        if (emitJson(program, cmd, { providers: providerRegistry.listProviders() })) {\n          return;\n        }\n        console.log(\n          c.bold(`\\n  ${SYMBOLS.shield} Available validation providers\\n`),\n        );\n        for (const p of providerRegistry.listProviders()) {\n          const prefixes = p.prefixes?.length\n            ? c.dim(` (${p.prefixes.join(\", \")})`)\n            : \"\";\n          console.log(\n            `  ${c.cyan(p.name.padEnd(10))} ${p.description}${prefixes}`,\n          );\n        }\n        console.log();\n        return;\n      }\n\n      if (!key && !cmd.all) {\n        console.error(c.red(`${SYMBOLS.cross} Provide a key name or use --all`));\n        process.exit(1);\n      }\n\n      const opts = buildOpts(cmd);\n\n      if (cmd.all) {\n        let entries = listSecrets(opts);\n        const projectPath = cmd.projectPath ?? process.cwd();\n\n        if (cmd.manifest) {\n          const config = readProjectConfig(projectPath);\n          if (config?.secrets) {\n            const manifestKeys = new Set(Object.keys(config.secrets));\n            entries = entries.filter((e) => manifestKeys.has(e.key));\n          }\n        }\n\n        const jsonMode = wantsJsonOutput(program, cmd);\n        if (!jsonMode) {\n          console.log(c.bold(`\\n  ${SYMBOLS.shield} Validating secrets\\n`));\n        }\n\n        let validated = 0;\n        let skipped = 0;\n        const jsonResults: Array<{\n          key: string;\n          status: string;\n          provider: string;\n          latencyMs: number;\n          message?: string;\n        }> = [];\n\n        for (const entry of entries) {\n          const value = getSecret(entry.key, { ...opts, scope: entry.scope });\n          if (!value) {\n            skipped++;\n            continue;\n          }\n\n          const provHint = entry.envelope?.meta.provider ?? cmd.provider;\n          const result = await validateSecret(value, { provider: provHint });\n\n          if (result.status === \"unknown\") {\n            skipped++;\n            continue;\n          }\n\n          validated++;\n          if (jsonMode) {\n            jsonResults.push({\n              key: entry.key,\n              status: result.status,\n              provider: result.provider,\n              latencyMs: result.latencyMs,\n              message: result.status !== \"valid\" ? result.message : undefined,\n            });\n            continue;\n          }\n          const icon =\n            result.status === \"valid\"\n              ? c.green(SYMBOLS.check)\n              : result.status === \"invalid\"\n                ? c.red(SYMBOLS.cross)\n                : c.yellow(SYMBOLS.warning);\n          const statusText =\n            result.status === \"valid\"\n              ? c.green(\"valid\")\n              : result.status === \"invalid\"\n                ? c.red(\"invalid\")\n                : c.yellow(\"error\");\n\n          console.log(\n            `  ${icon} ${c.bold(entry.key.padEnd(24))} ${statusText}  ${c.dim(`(${result.provider}, ${result.latencyMs}ms)`)}${result.status !== \"valid\" ? ` ${c.dim(\"— \" + result.message)}` : \"\"}`,\n          );\n        }\n\n        if (jsonMode) {\n          emitJson(program, cmd, { results: jsonResults, validated, skipped });\n          return;\n        }\n\n        console.log(\n          `\\n  ${c.dim(`${validated} validated, ${skipped} skipped (no provider)`)}\\n`,\n        );\n        return;\n      }\n\n      const value = getSecret(key!, opts);\n      if (!value) {\n        console.error(c.red(`${SYMBOLS.cross} Secret \"${key}\" not found`));\n        process.exit(1);\n      }\n\n      const envelope = getEnvelope(key!, opts);\n      const provHint = envelope?.envelope.meta.provider ?? cmd.provider;\n      const result = await validateSecret(value, { provider: provHint });\n\n      if (\n        emitJson(program, cmd, {\n          key,\n          status: result.status,\n          provider: result.provider,\n          latencyMs: result.latencyMs,\n          message: result.message,\n        })\n      ) {\n        return;\n      }\n\n      const icon =\n        result.status === \"valid\"\n          ? c.green(SYMBOLS.check)\n          : result.status === \"invalid\"\n            ? c.red(SYMBOLS.cross)\n            : result.status === \"error\"\n              ? c.yellow(SYMBOLS.warning)\n              : c.dim(\"○\");\n\n      console.log(\n        `\\n  ${icon} ${c.bold(key!)}  ${result.status}  ${c.dim(`(${result.provider}, ${result.latencyMs}ms)`)}`,\n      );\n      if (result.message && result.status !== \"valid\") {\n        console.log(`    ${c.dim(result.message)}`);\n      }\n      console.log();\n    });\n\n  program\n    .command(\"rotate <key>\")\n    .description(\n      \"Attempt issuer-native rotation of a secret via its provider\",\n    )\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--provider <name>\", \"Force a specific provider\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const value = getSecret(key, opts);\n      if (!value) {\n        console.error(c.red(`${SYMBOLS.cross} Secret \"${key}\" not found`));\n        process.exitCode = 1;\n        return;\n      }\n\n      const result = await rotateWithProvider(value, cmd.provider);\n      if (result.rotated && result.newValue) {\n        setSecret(key, result.newValue, {\n          ...opts,\n          scope: opts.scope ?? \"global\",\n        });\n      }\n\n      if (\n        emitJson(program, cmd, {\n          key,\n          rotated: !!(result.rotated && result.newValue),\n          provider: result.provider,\n          message: result.message,\n        })\n      ) {\n        return;\n      }\n\n      if (result.rotated && result.newValue) {\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"Rotated\")} ${c.bold(key)} via ${result.provider}`,\n        );\n        console.log(c.dim(`  ${result.message}`));\n      } else {\n        console.log(c.yellow(`${SYMBOLS.warning} ${result.message}`));\n      }\n    });\n\n  program\n    .command(\"ci:validate\")\n    .description(\n      \"CI-oriented batch validation of all secrets (exit code 1 on failure)\",\n    )\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (cmd) => {\n      const opts = buildOpts(cmd);\n      const entries = listSecrets(opts);\n\n      const secrets = entries\n        .map((e) => {\n          const val = getSecret(e.key, {\n            ...opts,\n            scope: e.scope,\n            silent: true,\n          });\n          if (!val) return null;\n          const provider = e.envelope?.meta.provider;\n          const validationUrl = e.envelope?.meta.validationUrl;\n          return { key: e.key, value: val, provider, validationUrl };\n        })\n        .filter((s): s is NonNullable<typeof s> => s !== null);\n\n      if (secrets.length === 0) {\n        console.log(c.dim(\"No secrets to validate\"));\n        return;\n      }\n\n      const report = await ciValidateBatch(secrets);\n\n      if (wantsJsonOutput(program, cmd)) {\n        console.log(JSON.stringify(report, null, 2));\n      } else {\n        console.log(\n          c.bold(`\\n  CI Secret Validation: ${report.results.length} secrets\\n`),\n        );\n        for (const r of report.results) {\n          const icon = r.validation.valid ? SYMBOLS.check : SYMBOLS.cross;\n          const color = r.validation.valid ? c.green : c.red;\n          console.log(\n            `  ${icon} ${color(r.key)} [${r.validation.provider}] ${r.validation.message}`,\n          );\n          if (r.requiresRotation) console.log(c.dim(`    → rotation required`));\n        }\n        console.log();\n\n        if (!report.allValid) {\n          console.log(c.red(`  ${report.failCount} secret(s) failed validation`));\n          process.exitCode = 1;\n        } else {\n          console.log(c.green(`  All secrets valid`));\n        }\n      }\n    });\n}\n","/**\n * Secure Execution & Auto-Redaction\n *\n * Runs child processes with project secrets injected into the environment.\n * Captures stdout/stderr and redacts any known secret values before they\n * are printed to the terminal or returned to the MCP agent.\n *\n * Exec profiles restrict which commands may be run, with optional\n * network and timeout controls.\n */\n\nimport { spawn } from \"node:child_process\";\nimport { StringDecoder } from \"node:string_decoder\";\nimport { Transform } from \"node:stream\";\nimport { listSecrets, getSecret, type KeyringOptions } from \"./keyring.js\";\nimport { checkDecay } from \"./envelope.js\";\nimport { checkExecPolicy, getExecMaxRuntime } from \"./policy.js\";\n\nexport interface ExecProfile {\n  name: string;\n  allowCommands?: string[];\n  denyCommands?: string[];\n  maxRuntimeSeconds?: number;\n  allowNetwork?: boolean;\n  stripEnvVars?: string[];\n}\n\nconst BUILTIN_PROFILES: Record<string, ExecProfile> = {\n  unrestricted: { name: \"unrestricted\" },\n  restricted: {\n    name: \"restricted\",\n    denyCommands: [\n      // Network tools.\n      \"curl\", \"wget\", \"ssh\", \"scp\", \"nc\", \"netcat\", \"ncat\",\n      // Interpreters and shells: given the secret env vars, `python -c`,\n      // `node -e`, `bash -c`, etc. can perform arbitrary network I/O and\n      // exfiltrate them, defeating allowNetwork. Denied by default in\n      // `restricted`; to run them with secrets use a custom profile in\n      // .q-ring.json, or the `ci` / `unrestricted` profile.\n      \"python\", \"python2\", \"python3\", \"node\", \"deno\", \"bun\",\n      \"perl\", \"ruby\", \"php\", \"sh\", \"bash\", \"zsh\",\n    ],\n    maxRuntimeSeconds: 30,\n    allowNetwork: false,\n    stripEnvVars: [\"HTTP_PROXY\", \"HTTPS_PROXY\", \"ALL_PROXY\"],\n  },\n  ci: {\n    name: \"ci\",\n    maxRuntimeSeconds: 300,\n    allowNetwork: true,\n    denyCommands: [\"rm -rf /\", \"mkfs\", \"dd if=\"],\n  },\n};\n\nexport function getProfile(name?: string): ExecProfile {\n  if (!name) return BUILTIN_PROFILES.unrestricted;\n  return BUILTIN_PROFILES[name] ?? { name };\n}\n\nexport function listProfiles(): ExecProfile[] {\n  return Object.values(BUILTIN_PROFILES);\n}\n\nexport interface ExecOptions extends KeyringOptions {\n  tags?: string[];\n  keys?: string[];\n  command: string;\n  args: string[];\n  /** If true, return output as string instead of piping to process.stdout */\n  captureOutput?: boolean;\n  /** Exec profile name (unrestricted, restricted, ci) */\n  profile?: string;\n}\n\nexport interface ExecResult {\n  code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/**\n * Best-effort output redaction: replaces verbatim occurrences of known secret\n * values (>5 chars) in a child process's stdout/stderr. This is a safety net,\n * NOT a guarantee — it cannot catch secrets that the child has transformed\n * (base64/hex/URL-encoded, split across writes beyond the tail window, etc.).\n */\nexport class RedactionTransform extends Transform {\n  private patterns: { value: string; replacement: string }[] = [];\n  private tail: string = \"\";\n  private maxLen: number = 0;\n  // Decodes UTF-8 across chunk boundaries: a multi-byte character split between\n  // two Buffer chunks would otherwise be corrupted to U+FFFD by chunk.toString()\n  // BEFORE matching runs, letting a multi-byte secret slip through unredacted.\n  // StringDecoder buffers the incomplete trailing bytes until the rest arrives.\n  private decoder = new StringDecoder(\"utf8\");\n\n  constructor(secretsToRedact: string[]) {\n    super();\n    // Only redact secrets > 5 chars to avoid destroying output\n    const validSecrets = secretsToRedact.filter((s) => s.length > 5);\n    // Sort by length descending to match longest first\n    validSecrets.sort((a, b) => b.length - a.length);\n\n    this.patterns = validSecrets.map((s) => ({\n      value: s,\n      replacement: \"[QRING:REDACTED]\",\n    }));\n\n    if (validSecrets.length > 0) {\n      this.maxLen = validSecrets[0].length;\n    }\n  }\n\n  _transform(chunk: Buffer | string, _encoding: string, callback: () => void) {\n    if (this.patterns.length === 0) {\n      this.push(chunk);\n      return callback();\n    }\n\n    const decoded =\n      typeof chunk === \"string\" ? chunk : this.decoder.write(chunk);\n    const text = this.tail + decoded;\n    let redacted = text;\n\n    for (const { value, replacement } of this.patterns) {\n      redacted = redacted.split(value).join(replacement);\n    }\n\n    if (redacted.length < this.maxLen) {\n      this.tail = redacted;\n      return callback();\n    }\n\n    const outputLen = redacted.length - this.maxLen + 1;\n    const output = redacted.slice(0, outputLen);\n    this.tail = redacted.slice(outputLen);\n\n    this.push(output);\n    callback();\n  }\n\n  _flush(callback: () => void) {\n    // Flush any bytes the decoder is still holding (an incomplete sequence at\n    // end-of-stream) along with the retained tail, then redact once more.\n    let final = this.tail + this.decoder.end();\n    if (final) {\n      for (const { value, replacement } of this.patterns) {\n        final = final.split(value).join(replacement);\n      }\n      this.push(final);\n    }\n    callback();\n  }\n}\n\n/**\n * Enforce the exec policy and profile allow/deny lists for a command.\n * Shared by `qring exec` (scope-wide injection) and `qring run` (declared-only\n * injection). Throws on denial.\n */\nexport function enforceExecPolicy(\n  profile: ExecProfile,\n  command: string,\n  args: string[],\n  projectPath?: string,\n): void {\n  const fullCommand = [command, ...args].join(\" \");\n\n  const policyDecision = checkExecPolicy(fullCommand, projectPath);\n  if (!policyDecision.allowed) {\n    throw new Error(`Policy Denied: ${policyDecision.reason}`);\n  }\n\n  if (profile.denyCommands) {\n    const denied = profile.denyCommands.find((d) => {\n      const pattern = new RegExp(`(^|[\\\\s/])${d.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}(\\\\s|$)`, \"i\");\n      return pattern.test(fullCommand);\n    });\n    if (denied) {\n      throw new Error(`Exec profile \"${profile.name}\" denies command containing \"${denied}\"`);\n    }\n  }\n  if (profile.allowCommands) {\n    const allowed = profile.allowCommands.some((a) => fullCommand.startsWith(a));\n    if (!allowed) {\n      throw new Error(`Exec profile \"${profile.name}\" does not allow command \"${command}\"`);\n    }\n  }\n}\n\nexport async function execCommand(opts: ExecOptions): Promise<ExecResult> {\n  const profile = getProfile(opts.profile);\n  enforceExecPolicy(profile, opts.command, opts.args, opts.projectPath);\n\n  const envMap: Record<string, string> = {};\n  for (const [k, v] of Object.entries(process.env)) {\n    if (v !== undefined) envMap[k] = v;\n  }\n\n  if (profile.stripEnvVars) {\n    for (const key of profile.stripEnvVars) {\n      delete envMap[key];\n    }\n  }\n\n  const secretsToRedact = new Set<string>();\n\n  let entries = listSecrets({\n    scope: opts.scope,\n    projectPath: opts.projectPath,\n    source: opts.source ?? \"cli\",\n    silent: true, // list silently\n  });\n\n  if (opts.keys?.length) {\n    const keySet = new Set(opts.keys);\n    entries = entries.filter((e) => keySet.has(e.key));\n  }\n\n  if (opts.tags?.length) {\n    entries = entries.filter((e) =>\n      opts.tags!.some((t) => e.envelope?.meta.tags?.includes(t)),\n    );\n  }\n\n  for (const entry of entries) {\n    if (entry.envelope) {\n      const decay = checkDecay(entry.envelope);\n      if (decay.isExpired) continue;\n    }\n\n    const val = getSecret(entry.key, {\n      scope: entry.scope,\n      projectPath: opts.projectPath,\n      env: opts.env,\n      source: opts.source ?? \"cli\",\n      silent: false, // Log access for execution\n    });\n\n    if (val !== null) {\n      envMap[entry.key] = val;\n      if (val.length > 5) {\n        secretsToRedact.add(val);\n      }\n    }\n  }\n\n  return spawnRedacted({\n    profile,\n    command: opts.command,\n    args: opts.args,\n    envMap,\n    secretsToRedact: [...secretsToRedact],\n    captureOutput: opts.captureOutput,\n    projectPath: opts.projectPath,\n  });\n}\n\nexport interface SpawnRedactedOptions {\n  profile: ExecProfile;\n  command: string;\n  args: string[];\n  /** Complete child environment (caller composes inheritance + injection). */\n  envMap: Record<string, string>;\n  /** Values to redact from the child's stdout/stderr. */\n  secretsToRedact: string[];\n  captureOutput?: boolean;\n  /** Used only to resolve the policy-configured max runtime. */\n  projectPath?: string;\n}\n\n/**\n * Spawn a child process with a fully-composed environment, enforcing the\n * profile's network restriction and runtime limit, and redacting known\n * secret values from its output.\n */\nexport function spawnRedacted(opts: SpawnRedactedOptions): Promise<ExecResult> {\n  const { profile, secretsToRedact, envMap } = opts;\n  const maxRuntime = profile.maxRuntimeSeconds ?? getExecMaxRuntime(opts.projectPath);\n\n  return new Promise((resolve, reject) => {\n    // Enforce network restrictions for profiles that disallow network access.\n    const networkTools = new Set([\n      \"curl\", \"wget\", \"ping\", \"nc\", \"netcat\", \"ssh\", \"telnet\", \"ftp\", \"dig\", \"nslookup\",\n    ]);\n\n    // Compare on the command basename so absolute paths like /usr/bin/curl are\n    // still caught. (Interpreter-based egress — python -c, node -e — is out of\n    // scope here; this is best-effort, not a hard sandbox.)\n    const commandBase = opts.command.split(/[\\\\/]/).pop() ?? opts.command;\n\n    if (profile.allowNetwork === false && networkTools.has(commandBase)) {\n      const msg = `[QRING] Execution blocked: network access is disabled for profile \"${profile.name}\", command \"${opts.command}\" is considered network-related`;\n      if (opts.captureOutput) {\n        return resolve({ code: 126, stdout: \"\", stderr: msg });\n      }\n      process.stderr.write(msg + \"\\n\");\n      return resolve({ code: 126, stdout: \"\", stderr: \"\" });\n    }\n\n    const child = spawn(opts.command, opts.args, {\n      env: envMap,\n      stdio: [\"inherit\", \"pipe\", \"pipe\"],\n      shell: false,\n    });\n\n    let timedOut = false;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n\n    if (maxRuntime) {\n      timer = setTimeout(() => {\n        timedOut = true;\n        child.kill(\"SIGKILL\");\n      }, maxRuntime * 1000);\n    }\n\n    const stdoutRedact = new RedactionTransform([...secretsToRedact]);\n    const stderrRedact = new RedactionTransform([...secretsToRedact]);\n\n    if (child.stdout) child.stdout.pipe(stdoutRedact);\n    if (child.stderr) child.stderr.pipe(stderrRedact);\n\n    let stdoutStr = \"\";\n    let stderrStr = \"\";\n\n    if (opts.captureOutput) {\n      stdoutRedact.on(\"data\", (d) => (stdoutStr += d.toString()));\n      stderrRedact.on(\"data\", (d) => (stderrStr += d.toString()));\n    } else {\n      stdoutRedact.pipe(process.stdout);\n      stderrRedact.pipe(process.stderr);\n    }\n\n    child.on(\"close\", (code) => {\n      if (timer) clearTimeout(timer);\n      if (timedOut) {\n        resolve({ code: 124, stdout: stdoutStr, stderr: stderrStr + `\\n[QRING] Process killed: exceeded ${maxRuntime}s runtime limit` });\n      } else {\n        resolve({ code: code ?? 0, stdout: stdoutStr, stderr: stderrStr });\n      }\n    });\n\n    child.on(\"error\", (err) => {\n      if (timer) clearTimeout(timer);\n      reject(err);\n    });\n  });\n}\n","/**\n * Codebase Secret Scanner\n *\n * Scans a directory for hardcoded secrets using regex heuristics\n * and Shannon entropy analysis. Useful for migrating legacy codebases\n * into q-ring.\n */\n\nimport { readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { findSecretsInLine, calculateEntropy } from \"./secrets-detect.js\";\n\nexport interface ScanResult {\n  file: string;\n  line: number;\n  keyName: string;\n  match: string;\n  context: string;\n  entropy: number;\n}\n\nconst IGNORE_DIRS = new Set([\n  \"node_modules\",\n  \".git\",\n  \".next\",\n  \"dist\",\n  \"build\",\n  \"coverage\",\n  \".cursor\",\n  \"venv\",\n  \"__pycache__\",\n]);\n\nconst IGNORE_EXTS = new Set([\n  \".png\", \".jpg\", \".jpeg\", \".gif\", \".ico\", \".svg\", \".webp\",\n  \".mp4\", \".mp3\", \".wav\", \".ogg\",\n  \".pdf\", \".zip\", \".tar\", \".gz\", \".xz\",\n  \".ttf\", \".woff\", \".woff2\", \".eot\",\n  \".exe\", \".dll\", \".so\", \".dylib\",\n  \".lock\",\n]);\n\nexport function scanCodebase(dir: string): ScanResult[] {\n  const results: ScanResult[] = [];\n\n  function walk(currentDir: string) {\n    let entries;\n    try {\n      entries = readdirSync(currentDir);\n    } catch {\n      return;\n    }\n\n    for (const entry of entries) {\n      if (IGNORE_DIRS.has(entry)) continue;\n\n      const fullPath = join(currentDir, entry);\n      let stat;\n      try {\n        stat = statSync(fullPath);\n      } catch {\n        continue;\n      }\n\n      if (stat.isDirectory()) {\n        walk(fullPath);\n      } else if (stat.isFile()) {\n        const ext = fullPath.slice(fullPath.lastIndexOf(\".\")).toLowerCase();\n        if (IGNORE_EXTS.has(ext) || entry.endsWith(\".lock\")) continue;\n\n        let content;\n        try {\n          content = readFileSync(fullPath, \"utf8\");\n        } catch {\n          continue;\n        }\n\n        if (content.includes(\"\\0\")) continue;\n\n        const lines = content.split(/\\r?\\n/);\n        for (let i = 0; i < lines.length; i++) {\n          const line = lines[i];\n          const matches = findSecretsInLine(line);\n          for (const m of matches) {\n            const entropy = calculateEntropy(m.value);\n            const relPath = fullPath.startsWith(dir)\n              ? fullPath.slice(dir.length).replace(/^[/\\\\]+/, \"\")\n              : fullPath;\n\n            results.push({\n              file: relPath || fullPath,\n              line: i + 1,\n              keyName: m.varName,\n              match: m.value,\n              context: line.trim(),\n              entropy: parseFloat(entropy.toFixed(2)),\n            });\n          }\n        }\n      }\n    }\n  }\n\n  walk(dir);\n  return results;\n}\n","/**\n * Shared heuristics for hardcoded-secret detection (scan + lint).\n * Both `scan.ts` and `linter.ts` use this module so rules stay aligned.\n */\n\n/** Same pattern for assignment-style secrets in source lines. */\nexport const SECRET_ASSIGNMENT_PATTERN =\n  /((?:api_?key|secret|token|password|auth|credential|access_?key)[a-z0-9_]*)\\s*[:=]\\s*(['\"])([^'\"]+)\\2/gi;\n\nexport interface SecretMatchInLine {\n  varName: string;\n  value: string;\n  quote: string;\n}\n\nexport function calculateEntropy(str: string): number {\n  if (!str) return 0;\n  const len = str.length;\n  const frequencies = new Map<string, number>();\n\n  for (let i = 0; i < len; i++) {\n    const char = str[i];\n    frequencies.set(char, (frequencies.get(char) || 0) + 1);\n  }\n\n  let entropy = 0;\n  for (const count of frequencies.values()) {\n    const p = count / len;\n    entropy -= p * Math.log2(p);\n  }\n\n  return entropy;\n}\n\nfunction isPlaceholderValue(value: string): boolean {\n  const lv = value.toLowerCase();\n  return (\n    lv.includes(\"example\") ||\n    lv.includes(\"your_\") ||\n    lv.includes(\"placeholder\") ||\n    lv.includes(\"replace_me\") ||\n    lv.includes(\"xxx\")\n  );\n}\n\nfunction passesSecretHeuristic(value: string, entropy: number): boolean {\n  return entropy > 3.5 || value.startsWith(\"sk-\") || value.startsWith(\"ghp_\");\n}\n\n/**\n * Find all secret-like assignments on one line (same behavior as the linter:\n * every match on the line is considered).\n */\nexport function findSecretsInLine(line: string): SecretMatchInLine[] {\n  if (line.length > 500) return [];\n\n  const out: SecretMatchInLine[] = [];\n  SECRET_ASSIGNMENT_PATTERN.lastIndex = 0;\n  let match: RegExpExecArray | null;\n  while ((match = SECRET_ASSIGNMENT_PATTERN.exec(line)) !== null) {\n    const varName = match[1];\n    const quote = match[2];\n    const value = match[3];\n\n    if (value.length < 8) continue;\n    if (isPlaceholderValue(value)) continue;\n\n    const entropy = calculateEntropy(value);\n    if (!passesSecretHeuristic(value, entropy)) continue;\n\n    out.push({ varName, value, quote });\n  }\n  return out;\n}\n","/**\n * Secret-Aware Linter\n *\n * Scans individual files (or staged git content) for hardcoded secrets and\n * optionally rewrites them with `process.env.KEY` references, storing the\n * discovered values in q-ring.\n */\n\nimport { readFileSync, writeFileSync, existsSync } from \"node:fs\";\nimport { basename, extname } from \"node:path\";\nimport { type ScanResult } from \"./scan.js\";\nimport { setSecret, hasSecret } from \"./keyring.js\";\nimport { findSecretsInLine, calculateEntropy } from \"./secrets-detect.js\";\n\nexport interface LintResult extends ScanResult {\n  fixed: boolean;\n}\n\nexport interface LintOptions {\n  fix?: boolean;\n  scope?: import(\"./scope.js\").Scope;\n  projectPath?: string;\n}\n\nconst ENV_REF_BY_EXT: Record<string, (key: string) => string> = {\n  \".ts\": (k) => `process.env.${k}`,\n  \".tsx\": (k) => `process.env.${k}`,\n  \".js\": (k) => `process.env.${k}`,\n  \".jsx\": (k) => `process.env.${k}`,\n  \".mjs\": (k) => `process.env.${k}`,\n  \".cjs\": (k) => `process.env.${k}`,\n  \".py\": (k) => `os.environ[\"${k}\"]`,\n  \".rb\": (k) => `ENV[\"${k}\"]`,\n  \".go\": (k) => `os.Getenv(\"${k}\")`,\n  \".rs\": (k) => `std::env::var(\"${k}\")`,\n  \".java\": (k) => `System.getenv(\"${k}\")`,\n  \".kt\": (k) => `System.getenv(\"${k}\")`,\n  \".cs\": (k) => `Environment.GetEnvironmentVariable(\"${k}\")`,\n  \".php\": (k) => `getenv('${k}')`,\n  \".sh\": (k) => `\\${${k}}`,\n  \".bash\": (k) => `\\${${k}}`,\n};\n\nfunction getEnvRef(filePath: string, keyName: string): string {\n  const ext = extname(filePath).toLowerCase();\n  const formatter = ENV_REF_BY_EXT[ext];\n  return formatter ? formatter(keyName) : `process.env.${keyName}`;\n}\n\n/**\n * Lint specific files for hardcoded secrets.\n */\nexport function lintFiles(\n  files: string[],\n  opts: LintOptions = {},\n): LintResult[] {\n  const results: LintResult[] = [];\n\n  for (const file of files) {\n    if (!existsSync(file)) continue;\n\n    let content: string;\n    try {\n      content = readFileSync(file, \"utf8\");\n    } catch {\n      continue;\n    }\n\n    if (content.includes(\"\\0\")) continue;\n\n    const lines = content.split(/\\r?\\n/);\n    const fixes: Array<{ line: number; original: string; replacement: string; keyName: string; value: string }> = [];\n\n    for (let i = 0; i < lines.length; i++) {\n      const line = lines[i];\n      const matches = findSecretsInLine(line);\n\n      for (const m of matches) {\n        const varNameUpper = m.varName.toUpperCase();\n        const entropy = calculateEntropy(m.value);\n        const shouldFix = opts.fix === true;\n\n        if (shouldFix) {\n          const envRef = getEnvRef(file, varNameUpper);\n          fixes.push({\n            line: i,\n            original: `${m.quote}${m.value}${m.quote}`,\n            replacement: envRef,\n            keyName: varNameUpper,\n            value: m.value,\n          });\n        }\n\n        results.push({\n          file,\n          line: i + 1,\n          keyName: varNameUpper,\n          match: m.value,\n          context: line.trim(),\n          entropy: parseFloat(entropy.toFixed(2)),\n          fixed: shouldFix,\n        });\n      }\n    }\n\n    if (opts.fix && fixes.length > 0) {\n      const fixLines = content.split(/\\r?\\n/);\n      for (const fix of fixes.reverse()) {\n        const lineIdx = fix.line;\n        if (lineIdx >= 0 && lineIdx < fixLines.length) {\n          fixLines[lineIdx] = fixLines[lineIdx].replace(fix.original, fix.replacement);\n        }\n\n        if (!hasSecret(fix.keyName, { scope: opts.scope, projectPath: opts.projectPath })) {\n          setSecret(fix.keyName, fix.value, {\n            scope: opts.scope ?? \"global\",\n            projectPath: opts.projectPath,\n            source: \"cli\",\n            description: `Auto-imported from ${basename(file)}:${fix.line + 1}`,\n          });\n        }\n      }\n\n      writeFileSync(file, fixLines.join(\"\\n\"), \"utf8\");\n    }\n  }\n\n  return results;\n}\n","import type { Command } from \"commander\";\nimport { execCommand } from \"../../core/exec.js\";\nimport { scanCodebase } from \"../../core/scan.js\";\nimport { lintFiles } from \"../../core/linter.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson, wantsJsonOutput } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerToolingCommands(program: Command): void {\n  program\n    .command(\"exec <command...>\")\n    .description(\n      \"Run a command with secrets injected into its environment (output auto-redacted)\",\n    )\n    .option(\"-g, --global\", \"Inject global scope secrets only\")\n    .option(\"-p, --project\", \"Inject project scope secrets only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Environment context\")\n    .option(\"-k, --keys <keys>\", \"Comma-separated key names to inject\")\n    .option(\"-t, --tags <tags>\", \"Comma-separated tags to filter by\")\n    .option(\n      \"--profile <name>\",\n      \"Exec profile: unrestricted, restricted, ci\",\n    )\n    .action(async (commandArgs: string[], cmd) => {\n      const opts = buildOpts(cmd);\n      const command = commandArgs[0];\n      const args = commandArgs.slice(1);\n\n      try {\n        const { code } = await execCommand({\n          ...opts,\n          command,\n          args,\n          keys: cmd.keys?.split(\",\").map((k: string) => k.trim()),\n          tags: cmd.tags?.split(\",\").map((t: string) => t.trim()),\n          profile: cmd.profile,\n        });\n        process.exit(code);\n      } catch (err) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Exec failed: ${err instanceof Error ? err.message : String(err)}`,\n          ),\n        );\n        process.exit(1);\n      }\n    });\n\n  program\n    .command(\"scan [dir]\")\n    .description(\"Scan a codebase for hardcoded secrets\")\n    .option(\n      \"--fix\",\n      \"Auto-replace hardcoded secrets with process.env references and store in q-ring\",\n    )\n    .option(\"-g, --global\", \"Store fixed secrets in global scope\")\n    .option(\"-p, --project\", \"Store fixed secrets in project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((dir: string | undefined, cmd) => {\n      const targetDir = dir ?? process.cwd();\n      const fixMode = cmd.fix === true;\n      const jsonMode = wantsJsonOutput(program, cmd);\n      if (!jsonMode) {\n        console.log(\n          `\\n  ${SYMBOLS.eye} Scanning ${c.bold(targetDir)} for secrets...${fixMode ? c.yellow(\" [--fix mode]\") : \"\"}\\n`,\n        );\n      }\n\n      const results = scanCodebase(targetDir);\n\n      if (jsonMode && !fixMode) {\n        emitJson(program, cmd, { dir: targetDir, findings: results });\n        if (results.length > 0) process.exitCode = 1;\n        return;\n      }\n\n      if (results.length === 0) {\n        console.log(\n          `  ${c.green(SYMBOLS.check)} No hardcoded secrets found. Awesome!\\n`,\n        );\n        return;\n      }\n\n      if (fixMode) {\n        const fileSet = new Set(\n          results.map((r) =>\n            r.file.startsWith(\"/\") ? r.file : `${targetDir}/${r.file}`,\n          ),\n        );\n        const opts = buildOpts(cmd);\n        const lintResults = lintFiles([...fileSet], {\n          fix: true,\n          scope: opts.scope,\n          projectPath: opts.projectPath,\n        });\n        const fixedCount = lintResults.filter((r) => r.fixed).length;\n        if (jsonMode) {\n          emitJson(program, cmd, {\n            dir: targetDir,\n            findings: results,\n            fixed: fixedCount,\n          });\n          return;\n        }\n        console.log(\n          `  ${c.green(SYMBOLS.check)} Fixed ${fixedCount} secrets — replaced with process.env references and stored in q-ring.\\n`,\n        );\n        return;\n      }\n\n      for (const res of results) {\n        console.log(`  ${c.red(SYMBOLS.cross)} ${c.bold(res.file)}:${res.line}`);\n        console.log(`    ${c.dim(\"Key:\")}     ${c.cyan(res.keyName)}`);\n        console.log(\n          `    ${c.dim(\"Entropy:\")} ${res.entropy > 4 ? c.red(res.entropy.toString()) : c.yellow(res.entropy.toString())}`,\n        );\n        console.log(`    ${c.dim(\"Context:\")} ${res.context}`);\n        console.log();\n      }\n\n      console.log(\n        `  ${c.red(`Found ${results.length} potential secrets.`)} Use ${c.bold(\"qring scan --fix\")} to auto-migrate them.\\n`,\n      );\n    });\n\n  program\n    .command(\"lint <files...>\")\n    .description(\n      \"Lint specific files for hardcoded secrets (with optional auto-fix)\",\n    )\n    .option(\n      \"--fix\",\n      \"Replace hardcoded secrets with process.env references and store in q-ring\",\n    )\n    .option(\"-g, --global\", \"Store fixed secrets in global scope\")\n    .option(\"-p, --project\", \"Store fixed secrets in project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((files: string[], cmd) => {\n      const opts = buildOpts(cmd);\n      const results = lintFiles(files, {\n        fix: cmd.fix,\n        scope: opts.scope,\n        projectPath: opts.projectPath,\n      });\n\n      if (emitJson(program, cmd, { files, findings: results })) {\n        if (results.some((r) => !r.fixed)) process.exitCode = 1;\n        return;\n      }\n\n      if (results.length === 0) {\n        console.log(\n          `\\n  ${c.green(SYMBOLS.check)} No hardcoded secrets found in ${files.length} file(s).\\n`,\n        );\n        return;\n      }\n\n      for (const res of results) {\n        const status = res.fixed ? c.green(\"fixed\") : c.red(\"found\");\n        console.log(\n          `  ${res.fixed ? c.green(SYMBOLS.check) : c.red(SYMBOLS.cross)} ${c.bold(res.file)}:${res.line} [${status}]`,\n        );\n        console.log(`    ${c.dim(\"Key:\")}     ${c.cyan(res.keyName)}`);\n        console.log(\n          `    ${c.dim(\"Entropy:\")} ${res.entropy > 4 ? c.red(res.entropy.toString()) : c.yellow(res.entropy.toString())}`,\n        );\n        console.log();\n      }\n\n      const fixedCount = results.filter((r) => r.fixed).length;\n      if (cmd.fix && fixedCount > 0) {\n        console.log(\n          `  ${c.green(`Fixed ${fixedCount} secret(s)`)} — replaced with env references and stored in q-ring.\\n`,\n        );\n      } else {\n        console.log(\n          `  ${c.red(`Found ${results.length} potential secret(s).`)} Use ${c.bold(\"--fix\")} to auto-migrate.\\n`,\n        );\n      }\n    });\n\n  program\n    .command(\"status\")\n    .description(\"Launch the quantum status dashboard in your browser\")\n    .option(\"--port <port>\", \"Port to serve on\", \"9876\")\n    .option(\"--no-open\", \"Don't auto-open the browser\")\n    .action(async (cmd) => {\n      const { startDashboardServer } = await import(\"../../core/dashboard.js\");\n      const { exec } = await import(\"node:child_process\");\n      const { platform } = await import(\"node:os\");\n\n      const port = Number(cmd.port);\n      const { close, url } = startDashboardServer({ port });\n\n      console.log(\n        `\\n  ${SYMBOLS.zap} ${c.bold(\"q-ring quantum status dashboard\")}\\n`,\n      );\n      console.log(`  ${c.cyan(url)}\\n`);\n      console.log(c.dim(\"  Press Ctrl+C to stop\\n\"));\n\n      if (cmd.open !== false) {\n        const openCmd =\n          platform() === \"darwin\"\n            ? \"open\"\n            : platform() === \"win32\"\n              ? \"start\"\n              : \"xdg-open\";\n        exec(`${openCmd} ${url}`);\n      }\n\n      const shutdown = () => {\n        console.log(`\\n${c.dim(\"  dashboard stopped\")}`);\n        close();\n        process.exit(0);\n      };\n      process.on(\"SIGINT\", shutdown);\n      process.on(\"SIGTERM\", shutdown);\n\n      await new Promise(() => {});\n    });\n}\n","import type { Command } from \"commander\";\nimport { listSecrets } from \"../../core/keyring.js\";\nimport { queryAudit, detectAnomalies, verifyAuditChain, exportAudit } from \"../../core/observer.js\";\nimport { listAgentSessions } from \"../../core/sessions.js\";\nimport { writeFileSync } from \"node:fs\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\n\n/** `--since` accepts an ISO date or a duration such as 30m, 24h, 7d. */\nexport function parseSince(value: string): string {\n  const m = value.trim().match(/^(\\d+)\\s*([mhd])$/i);\n  if (m) {\n    const unit = { m: 60, h: 3600, d: 86400 }[m[2].toLowerCase() as \"m\" | \"h\" | \"d\"];\n    return new Date(Date.now() - Number(m[1]) * unit * 1000).toISOString();\n  }\n  const date = new Date(value);\n  if (Number.isNaN(date.getTime())) {\n    throw new Error(`--since: \"${value}\" is not an ISO date or a duration like 24h / 7d`);\n  }\n  return date.toISOString();\n}\n\nfunction fmtSeconds(seconds: number): string {\n  if (seconds < 60) return `${seconds}s`;\n  if (seconds < 3600) return `${Math.floor(seconds / 60)}m`;\n  if (seconds < 86400) return `${Math.floor(seconds / 3600)}h`;\n  return `${Math.floor(seconds / 86400)}d`;\n}\n\nexport function registerAuditCommands(program: Command): void {\n  program\n    .command(\"audit\")\n    .description(\"View the audit log (observer effect)\")\n    .option(\"-k, --key <key>\", \"Filter by key\")\n    .option(\"-a, --action <action>\", \"Filter by action (read, write, delete, etc.)\")\n    .option(\"--agent <label>\", \"Filter by agent label (clientInfo name@version)\")\n    .option(\"-n, --limit <n>\", \"Number of events to show\", parseInt, 20)\n    .option(\"--anomalies\", \"Detect access anomalies\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      if (cmd.anomalies) {\n        const anomalies = detectAnomalies(cmd.key);\n        if (emitJson(program, cmd, { anomalies })) return;\n        if (anomalies.length === 0) {\n          console.log(`${SYMBOLS.shield} ${c.green(\"No anomalies detected\")}`);\n          return;\n        }\n\n        console.log(\n          `\\n${SYMBOLS.warning} ${c.bold(c.yellow(`${anomalies.length} anomaly/anomalies detected`))}\\n`,\n        );\n        for (const a of anomalies) {\n          console.log(`  ${c.yellow(a.type)} ${a.description}`);\n        }\n        console.log();\n        return;\n      }\n\n      const events = queryAudit({\n        key: cmd.key,\n        action: cmd.action,\n        agent: cmd.agent,\n        limit: cmd.limit,\n      });\n\n      if (emitJson(program, cmd, { events })) return;\n\n      if (events.length === 0) {\n        console.log(c.dim(\"No audit events found\"));\n        return;\n      }\n\n      console.log(c.bold(`\\n  ${SYMBOLS.eye} Audit log (${events.length} events)\\n`));\n\n      for (const event of events) {\n        const ts = new Date(event.timestamp).toLocaleString();\n        const actionColor =\n          event.action === \"read\"\n            ? c.blue\n            : event.action === \"write\"\n              ? c.green\n              : event.action === \"delete\"\n                ? c.red\n                : c.yellow;\n\n        const parts = [\n          c.dim(ts),\n          actionColor(event.action.padEnd(8)),\n          event.key ? c.bold(event.key) : \"\",\n          event.scope ? c.dim(`[${event.scope}]`) : \"\",\n          event.agent ? c.cyan(`⟨${event.agent}⟩`) : \"\",\n          event.detail ? c.dim(event.detail) : \"\",\n        ];\n\n        console.log(`  ${parts.filter(Boolean).join(\"  \")}`);\n      }\n      console.log();\n    });\n\n  program\n    .command(\"audit:verify\")\n    .description(\"Verify the integrity of the audit hash chain\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const result = verifyAuditChain();\n      if (emitJson(program, cmd, result)) {\n        if (!result.intact && result.totalEvents > 0) process.exitCode = 1;\n        return;\n      }\n      if (result.totalEvents === 0) {\n        console.log(c.dim(\"  No audit events to verify\"));\n        return;\n      }\n\n      if (result.intact) {\n        console.log(\n          `${SYMBOLS.shield} ${c.green(\"Audit chain intact\")} — ${result.totalEvents} events verified`,\n        );\n      } else {\n        console.log(`${SYMBOLS.cross} ${c.red(\"Audit chain BROKEN\")} at event #${result.brokenAt}`);\n        console.log(\n          c.dim(`  ${result.validEvents}/${result.totalEvents} events valid before break`),\n        );\n        if (result.brokenEvent) {\n          console.log(\n            c.dim(\n              `  Broken event: ${result.brokenEvent.timestamp} ${result.brokenEvent.action} ${result.brokenEvent.key ?? \"\"}`,\n            ),\n          );\n        }\n        process.exitCode = 1;\n      }\n    });\n\n  program\n    .command(\"audit:export\")\n    .description(\"Export audit events in a portable format\")\n    .option(\"--since <date>\", \"Start date (ISO 8601)\")\n    .option(\"--until <date>\", \"End date (ISO 8601)\")\n    .option(\"--format <fmt>\", \"Output format: jsonl, json, csv\", \"jsonl\")\n    .option(\"-o, --output <file>\", \"Write to file instead of stdout\")\n    .action((cmd) => {\n      const output = exportAudit({\n        since: cmd.since,\n        until: cmd.until,\n        format: cmd.format,\n      });\n\n      if (cmd.output) {\n        writeFileSync(cmd.output, output);\n        console.log(`${SYMBOLS.check} Exported to ${cmd.output}`);\n      } else {\n        console.log(output);\n      }\n    });\n\n  program\n    .command(\"audit:sessions\")\n    .description(\"Audit activity folded into per-agent sessions (who did what, per MCP client)\")\n    .option(\"--agent <label>\", \"Only sessions for this agent label (clientInfo name@version)\")\n    .option(\"--since <when>\", \"ISO date, or a duration like 24h / 7d (default: 7d)\")\n    .option(\"-n, --limit <n>\", \"Max sessions to show\", parseInt, 20)\n    .option(\"-v, --verbose\", \"Print each session's event lines\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const sessions = listAgentSessions({\n        agent: cmd.agent,\n        since: parseSince(cmd.since ?? \"7d\"),\n        limit: cmd.limit,\n      });\n\n      if (emitJson(program, cmd, { sessions })) return;\n\n      if (sessions.length === 0) {\n        console.log(\n          c.dim(\n            \"No agent sessions in range. Sessions appear once an MCP client (Cursor, Claude Code, Kiro, or an airlock) has touched the ring.\",\n          ),\n        );\n        return;\n      }\n\n      console.log(c.bold(`\\n  ${SYMBOLS.eye} Agent sessions (${sessions.length})\\n`));\n      for (const s of sessions) {\n        const started = new Date(s.startedAt);\n        const ended = new Date(s.endedAt);\n        const seconds = Math.max(0, Math.round((ended.getTime() - started.getTime()) / 1000));\n        const who = s.wrapLabel ? `airlock: ${s.wrapLabel}` : s.agent;\n        const head = [\n          c.cyan(`⟨${who}⟩`),\n          c.dim(`[${s.source}]`),\n          c.dim(\n            `${started.toLocaleString()} → ${ended.toLocaleTimeString()} (${fmtSeconds(seconds)})`,\n          ),\n          `${s.eventCount} events`,\n          s.denials > 0 ? c.red(`${s.denials} denied`) : c.green(\"0 denied\"),\n          s.countsByAction.canary ? c.red(`${s.countsByAction.canary} canary trips`) : \"\",\n        ];\n        console.log(`  ${head.filter(Boolean).join(\"  \")}`);\n        console.log(c.dim(`    id ${s.id} · keys: ${s.keys.length ? s.keys.join(\", \") : \"—\"}`));\n        if (cmd.verbose) {\n          for (const e of s.events) {\n            const parts = [\n              c.dim(new Date(e.timestamp).toLocaleTimeString()),\n              (e.action === \"policy_deny\" || e.action === \"canary\" ? c.red : c.yellow)(\n                e.action.padEnd(11),\n              ),\n              e.key ? c.bold(e.key) : \"\",\n              e.detail ? c.dim(e.detail) : \"\",\n            ];\n            console.log(`      ${parts.filter(Boolean).join(\"  \")}`);\n          }\n        }\n        console.log();\n      }\n    });\n\n  program\n    .command(\"health\")\n    .description(\"Check the health of all secrets\")\n    .option(\"-g, --global\", \"Check global scope only\")\n    .option(\"-p, --project\", \"Check project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      const entries = listSecrets(opts);\n\n      const expiredKeys: string[] = [];\n      const staleKeys: Array<{ key: string; lifetimePercent: number; timeRemaining: string }> = [];\n      let healthy = 0;\n      let noDecay = 0;\n\n      for (const entry of entries) {\n        if (!entry.decay || !entry.decay.timeRemaining) {\n          noDecay++;\n        } else if (entry.decay.isExpired) {\n          expiredKeys.push(entry.key);\n        } else if (entry.decay.isStale) {\n          staleKeys.push({\n            key: entry.key,\n            lifetimePercent: entry.decay.lifetimePercent,\n            timeRemaining: entry.decay.timeRemaining,\n          });\n        } else {\n          healthy++;\n        }\n      }\n\n      if (\n        emitJson(program, cmd, {\n          total: entries.length,\n          healthy,\n          noDecay,\n          expired: expiredKeys,\n          stale: staleKeys,\n          anomalies: entries.length === 0 ? [] : detectAnomalies(),\n        })\n      ) {\n        return;\n      }\n\n      if (entries.length === 0) {\n        console.log(c.dim(\"No secrets to check\"));\n        return;\n      }\n\n      console.log(c.bold(`\\n  ${SYMBOLS.shield} Secret health report\\n`));\n\n      for (const key of expiredKeys) {\n        console.log(`  ${c.red(SYMBOLS.cross)} ${c.bold(key)} ${c.bgRed(c.white(\" EXPIRED \"))}`);\n      }\n      for (const s of staleKeys) {\n        console.log(\n          `  ${c.yellow(SYMBOLS.warning)} ${c.bold(s.key)} ${c.yellow(`stale (${s.lifetimePercent}%, ${s.timeRemaining} left)`)}`,\n        );\n      }\n\n      console.log(\n        `\\n  ${c.green(`${SYMBOLS.check} ${healthy} healthy`)}  ${c.yellow(`${SYMBOLS.warning} ${staleKeys.length} stale`)}  ${c.red(`${SYMBOLS.cross} ${expiredKeys.length} expired`)}  ${c.dim(`${noDecay} no decay`)}`,\n      );\n\n      const anomalies = detectAnomalies();\n      if (anomalies.length > 0) {\n        console.log(\n          `\\n  ${c.yellow(`${SYMBOLS.warning} ${anomalies.length} access anomaly/anomalies detected`)} ${c.dim(\"(run: qring audit --anomalies)\")}`,\n        );\n      }\n\n      console.log();\n    });\n}\n","/**\n * Git Pre-Commit Hook for Secret Scanning\n *\n * Scans staged files for hardcoded secrets using the q-ring scanner.\n * If any are found, blocks the commit and reports locations.\n *\n * Install via: qring hook:install\n * Runs via: .git/hooks/pre-commit\n */\n\nimport { execSync } from \"node:child_process\";\nimport { existsSync, writeFileSync, chmodSync, readFileSync, unlinkSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { lintFiles } from \"../core/linter.js\";\n\n/**\n * Get the list of staged files from git.\n */\nfunction getStagedFiles(): string[] {\n  try {\n    const output = execSync(\"git diff --cached --name-only --diff-filter=ACM\", {\n      encoding: \"utf8\",\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n    return output\n      .split(\"\\n\")\n      .map((f) => f.trim())\n      .filter((f) => f.length > 0);\n  } catch {\n    return [];\n  }\n}\n\n/**\n * Run the pre-commit scan on staged files.\n * Returns exit code 0 (clean) or 1 (secrets found).\n */\nexport function runPreCommitScan(): number {\n  const staged = getStagedFiles();\n  if (staged.length === 0) return 0;\n\n  const results = lintFiles(staged);\n\n  if (results.length === 0) return 0;\n\n  console.error(\"\\n[q-ring] Pre-commit scan found hardcoded secrets:\\n\");\n  for (const r of results) {\n    console.error(`  ${r.file}:${r.line}  ${r.keyName}  (entropy: ${r.entropy})`);\n  }\n  console.error(\n    `\\n[q-ring] Commit blocked. Use \"qring scan --fix\" to auto-migrate, or \"git commit --no-verify\" to bypass.\\n`,\n  );\n\n  return 1;\n}\n\nconst HOOK_SCRIPT = `#!/bin/sh\n# q-ring pre-commit hook — scans staged files for hardcoded secrets\nnpx qring hook:run 2>&1\nexit $?\n`;\n\n/**\n * Install the pre-commit hook into the repository's .git/hooks directory.\n */\nexport function installPreCommitHook(repoPath?: string): { installed: boolean; path: string; message: string } {\n  const root = repoPath ?? process.cwd();\n  const hooksDir = join(root, \".git\", \"hooks\");\n\n  if (!existsSync(join(root, \".git\"))) {\n    return { installed: false, path: \"\", message: \"Not a git repository\" };\n  }\n\n  const hookPath = join(hooksDir, \"pre-commit\");\n\n  if (existsSync(hookPath)) {\n    const existing = readFileSync(hookPath, \"utf8\");\n    if (existing.includes(\"q-ring\")) {\n      return { installed: true, path: hookPath, message: \"Hook already installed\" };\n    }\n    // Prepend to existing hook\n    writeFileSync(hookPath, HOOK_SCRIPT + \"\\n\" + existing, \"utf8\");\n  } else {\n    writeFileSync(hookPath, HOOK_SCRIPT, \"utf8\");\n  }\n\n  chmodSync(hookPath, 0o755);\n  return { installed: true, path: hookPath, message: \"Pre-commit hook installed\" };\n}\n\n/**\n * Uninstall the pre-commit hook.\n */\nexport function uninstallPreCommitHook(repoPath?: string): boolean {\n  const root = repoPath ?? process.cwd();\n  const hookPath = join(root, \".git\", \"hooks\", \"pre-commit\");\n\n  if (!existsSync(hookPath)) return false;\n\n  const content = readFileSync(hookPath, \"utf8\");\n  if (!content.includes(\"q-ring\")) return false;\n\n  // Remove q-ring lines\n  const lines = content.split(\"\\n\");\n  const cleaned = lines.filter(\n    (l) => !l.includes(\"q-ring\") && !l.includes(\"npx qring hook:run\"),\n  );\n\n  if (cleaned.filter((l) => l.trim() && !l.startsWith(\"#!\")).length === 0) {\n    // Nothing left, delete the file\n    unlinkSync(hookPath);\n  } else {\n    writeFileSync(hookPath, cleaned.join(\"\\n\"), \"utf8\");\n  }\n\n  return true;\n}\n","import type { Command } from \"commander\";\nimport {\n  registerHook,\n  removeHook,\n  listHooks as listAllHooks,\n  enableHook,\n  disableHook,\n  fireHooks,\n  type HookType,\n  type HookAction,\n} from \"../../core/hooks.js\";\nimport {\n  installPreCommitHook,\n  uninstallPreCommitHook,\n  runPreCommitScan,\n} from \"../../hooks/precommit.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson } from \"../helpers.js\";\n\nexport function registerHookCommands(program: Command): void {\n  // ─── Pre-Commit Hook ───\n\n  program\n    .command(\"hook:install\")\n    .description(\n      \"Install a git pre-commit hook that scans for hardcoded secrets\",\n    )\n    .option(\"--project-path <path>\", \"Repository path\")\n    .action((cmd) => {\n      const result = installPreCommitHook(cmd.projectPath);\n      if (result.installed) {\n        console.log(\n          `${SYMBOLS.check} ${c.green(result.message)} at ${c.dim(result.path)}`,\n        );\n      } else {\n        console.log(`${SYMBOLS.cross} ${c.red(result.message)}`);\n      }\n    });\n\n  program\n    .command(\"hook:uninstall\")\n    .description(\"Remove the q-ring pre-commit hook\")\n    .option(\"--project-path <path>\", \"Repository path\")\n    .action((cmd) => {\n      const removed = uninstallPreCommitHook(cmd.projectPath);\n      if (removed) {\n        console.log(`${SYMBOLS.check} ${c.green(\"Pre-commit hook removed\")}`);\n      } else {\n        console.log(c.dim(\"No q-ring pre-commit hook found\"));\n      }\n    });\n\n  program\n    .command(\"hook:run\")\n    .description(\"Run the pre-commit secret scan (called by the git hook)\")\n    .action(() => {\n      const code = runPreCommitScan();\n      process.exit(code);\n    });\n\n  // ─── Hook Subcommands ───\n\n  const hook = program\n    .command(\"hook\")\n    .description(\n      \"Manage secret change hooks (callbacks on write/delete/rotate)\",\n    );\n\n  hook\n    .command(\"add\")\n    .description(\"Register a new hook\")\n    .option(\"--key <key>\", \"Trigger on exact key match\")\n    .option(\"--key-pattern <pattern>\", \"Trigger on key glob pattern (e.g. DB_*)\")\n    .option(\"--tag <tag>\", \"Trigger on secrets with this tag\")\n    .option(\n      \"--scope <scope>\",\n      \"Trigger only for this scope (global or project)\",\n    )\n    .option(\n      \"--action <actions>\",\n      \"Comma-separated actions: write,delete,rotate\",\n      \"write,delete,rotate\",\n    )\n    .option(\"--exec <command>\", \"Shell command to execute\")\n    .option(\"--url <url>\", \"HTTP URL to POST to\")\n    .option(\"--signal-target <target>\", \"Process name or PID to signal\")\n    .option(\"--signal-name <signal>\", \"Signal to send (default: SIGHUP)\", \"SIGHUP\")\n    .option(\"--description <desc>\", \"Human-readable description\")\n    .action((cmd) => {\n      let type: HookType;\n      if (cmd.exec) type = \"shell\";\n      else if (cmd.url) type = \"http\";\n      else if (cmd.signalTarget) type = \"signal\";\n      else {\n        console.error(\n          c.red(`${SYMBOLS.cross} Specify --exec, --url, or --signal-target`),\n        );\n        process.exit(1);\n      }\n\n      if (!cmd.key && !cmd.keyPattern && !cmd.tag) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Specify at least one match criterion: --key, --key-pattern, or --tag`,\n          ),\n        );\n        process.exit(1);\n      }\n\n      const actions = cmd.action\n        .split(\",\")\n        .map((a: string) => a.trim()) as HookAction[];\n\n      const entry = registerHook({\n        type,\n        match: {\n          key: cmd.key,\n          keyPattern: cmd.keyPattern,\n          tag: cmd.tag,\n          scope: cmd.scope as \"global\" | \"project\" | undefined,\n          action: actions,\n        },\n        command: cmd.exec,\n        url: cmd.url,\n        signal: cmd.signalTarget\n          ? { target: cmd.signalTarget, signal: cmd.signalName }\n          : undefined,\n        description: cmd.description,\n        enabled: true,\n      });\n\n      console.log(\n        `${SYMBOLS.check} ${c.green(\"registered\")} hook ${c.bold(entry.id)} (${type})`,\n      );\n      if (cmd.key) console.log(c.dim(`  key: ${cmd.key}`));\n      if (cmd.keyPattern) console.log(c.dim(`  pattern: ${cmd.keyPattern}`));\n      if (cmd.tag) console.log(c.dim(`  tag: ${cmd.tag}`));\n    });\n\n  hook\n    .command(\"list\")\n    .alias(\"ls\")\n    .description(\"List all registered hooks\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const hooks = listAllHooks();\n      if (emitJson(program, cmd, { hooks })) return;\n      if (hooks.length === 0) {\n        console.log(c.dim(\"No hooks registered\"));\n        return;\n      }\n\n      console.log(\n        c.bold(`\\n  ${SYMBOLS.zap} Registered hooks (${hooks.length})\\n`),\n      );\n\n      for (const h of hooks) {\n        const status = h.enabled ? c.green(\"on\") : c.red(\"off\");\n        const matchParts: string[] = [];\n        if (h.match.key) matchParts.push(`key=${h.match.key}`);\n        if (h.match.keyPattern) matchParts.push(`pattern=${h.match.keyPattern}`);\n        if (h.match.tag) matchParts.push(`tag=${h.match.tag}`);\n        if (h.match.scope) matchParts.push(`scope=${h.match.scope}`);\n        if (h.match.action?.length)\n          matchParts.push(`actions=${h.match.action.join(\",\")}`);\n\n        const target =\n          h.type === \"shell\"\n            ? h.command\n            : h.type === \"http\"\n              ? h.url\n              : h.signal\n                ? `${h.signal.target} (${h.signal.signal ?? \"SIGHUP\"})`\n                : \"?\";\n\n        console.log(\n          `  ${c.bold(h.id)}  [${status}]  ${c.cyan(h.type)}  ${c.dim(matchParts.join(\" \"))}`,\n        );\n        console.log(\n          `    ${c.dim(\"→\")} ${target}${h.description ? `  ${c.dim(`— ${h.description}`)}` : \"\"}`,\n        );\n      }\n      console.log();\n    });\n\n  hook\n    .command(\"remove <id>\")\n    .alias(\"rm\")\n    .description(\"Remove a hook by ID\")\n    .action((id: string) => {\n      if (removeHook(id)) {\n        console.log(`${SYMBOLS.check} ${c.green(\"removed\")} hook ${c.bold(id)}`);\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} Hook \"${id}\" not found`));\n        process.exit(1);\n      }\n    });\n\n  hook\n    .command(\"enable <id>\")\n    .description(\"Enable a hook\")\n    .action((id: string) => {\n      if (enableHook(id)) {\n        console.log(`${SYMBOLS.check} ${c.green(\"enabled\")} hook ${c.bold(id)}`);\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} Hook \"${id}\" not found`));\n        process.exit(1);\n      }\n    });\n\n  hook\n    .command(\"disable <id>\")\n    .description(\"Disable a hook\")\n    .action((id: string) => {\n      if (disableHook(id)) {\n        console.log(\n          `${SYMBOLS.check} ${c.yellow(\"disabled\")} hook ${c.bold(id)}`,\n        );\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} Hook \"${id}\" not found`));\n        process.exit(1);\n      }\n    });\n\n  hook\n    .command(\"test <id>\")\n    .description(\"Dry-run a hook with a mock payload\")\n    .action(async (id: string) => {\n      const hooks = listAllHooks();\n      const h = hooks.find((hook) => hook.id === id);\n      if (!h) {\n        console.error(c.red(`${SYMBOLS.cross} Hook \"${id}\" not found`));\n        process.exit(1);\n      }\n\n      console.log(c.dim(`Testing hook ${id} (${h.type})...\\n`));\n\n      const payload = {\n        action: \"write\" as const,\n        key: h.match.key ?? \"TEST_KEY\",\n        scope: h.match.scope ?? \"global\",\n        timestamp: new Date().toISOString(),\n        source: \"cli\" as const,\n      };\n\n      const results = await fireHooks(payload);\n      const result = results.find((r) => r.hookId === id);\n\n      if (result) {\n        const icon = result.success ? c.green(SYMBOLS.check) : c.red(SYMBOLS.cross);\n        console.log(`  ${icon} ${result.message}`);\n      } else {\n        console.log(\n          c.yellow(`  ${SYMBOLS.warning} Hook did not match the test payload`),\n        );\n      }\n      console.log();\n    });\n}\n","/**\n * Quantum Agent: autonomous background monitor for secret health.\n *\n * Runs as a long-lived process that periodically:\n * - Checks for expired/stale secrets (decay monitoring)\n * - Detects access anomalies (observer analysis)\n * - Logs health reports\n * - Can trigger rotation callbacks\n *\n * Designed to run as `qring agent` or be invoked by the MCP server.\n */\n\nimport { listSecrets, setSecret } from \"./keyring.js\";\nimport { checkDecay } from \"./envelope.js\";\nimport { detectAnomalies, logAudit } from \"./observer.js\";\nimport { generateSecret } from \"./noise.js\";\nimport { fireHooks } from \"./hooks.js\";\nimport { c, SYMBOLS } from \"../utils/colors.js\";\n\nexport interface AgentConfig {\n  /** Check interval in seconds (default: 60) */\n  intervalSeconds: number;\n  /** Auto-rotate expired secrets with generated values */\n  autoRotate: boolean;\n  /** Project paths to monitor */\n  projectPaths: string[];\n  /** Verbose output */\n  verbose: boolean;\n}\n\nexport interface AgentReport {\n  timestamp: string;\n  totalSecrets: number;\n  healthy: number;\n  stale: number;\n  expired: number;\n  anomalies: number;\n  rotated: string[];\n  warnings: string[];\n}\n\nfunction defaultConfig(): AgentConfig {\n  return {\n    intervalSeconds: 60,\n    autoRotate: false,\n    projectPaths: [process.cwd()],\n    verbose: false,\n  };\n}\n\nexport function runHealthScan(config: Partial<AgentConfig> = {}): AgentReport {\n  const cfg = { ...defaultConfig(), ...config };\n\n  const report: AgentReport = {\n    timestamp: new Date().toISOString(),\n    totalSecrets: 0,\n    healthy: 0,\n    stale: 0,\n    expired: 0,\n    anomalies: 0,\n    rotated: [],\n    warnings: [],\n  };\n\n  // Scan global scope\n  const globalEntries = listSecrets({ scope: \"global\", source: \"agent\" });\n\n  // Scan project scopes\n  const projectEntries = cfg.projectPaths.flatMap((pp) =>\n    listSecrets({ scope: \"project\", projectPath: pp, source: \"agent\" }),\n  );\n\n  const allEntries = [...globalEntries, ...projectEntries];\n  report.totalSecrets = allEntries.length;\n\n  for (const entry of allEntries) {\n    if (!entry.envelope) continue;\n\n    const decay = checkDecay(entry.envelope);\n\n    if (decay.isExpired) {\n      report.expired++;\n      report.warnings.push(\n        `EXPIRED: ${entry.key} [${entry.scope}] — expired ${decay.timeRemaining}`,\n      );\n\n      if (cfg.autoRotate) {\n        const fmt = (entry.envelope?.meta.rotationFormat ?? \"api-key\") as import(\"./noise.js\").NoiseFormat;\n        const prefix = entry.envelope?.meta.rotationPrefix;\n        const newValue = generateSecret({ format: fmt, prefix });\n        setSecret(entry.key, newValue, {\n          scope: entry.scope,\n          projectPath: cfg.projectPaths[0],\n          source: \"agent\",\n        });\n        report.rotated.push(entry.key);\n        logAudit({\n          action: \"write\",\n          key: entry.key,\n          scope: entry.scope,\n          source: \"agent\",\n          detail: \"auto-rotated by agent (expired)\",\n        });\n        fireHooks({\n          action: \"rotate\",\n          key: entry.key,\n          scope: entry.scope,\n          timestamp: new Date().toISOString(),\n          source: \"agent\",\n        }, entry.envelope?.meta.tags).catch(() => {});\n      }\n    } else if (decay.isStale) {\n      report.stale++;\n      report.warnings.push(\n        `STALE: ${entry.key} [${entry.scope}] — ${decay.lifetimePercent}% lifetime, ${decay.timeRemaining} remaining`,\n      );\n    } else {\n      report.healthy++;\n    }\n  }\n\n  // Check for anomalies\n  const anomalies = detectAnomalies();\n  report.anomalies = anomalies.length;\n  for (const a of anomalies) {\n    report.warnings.push(`ANOMALY [${a.type}]: ${a.description}`);\n  }\n\n  return report;\n}\n\nfunction formatReport(report: AgentReport, verbose: boolean): string {\n  const lines: string[] = [];\n\n  lines.push(\n    `${c.bold(`${SYMBOLS.shield} q-ring agent scan`)} ${c.dim(report.timestamp)}`,\n  );\n  lines.push(\n    `  ${c.dim(\"secrets:\")} ${report.totalSecrets}  ${c.green(`${SYMBOLS.check} ${report.healthy}`)}  ${c.yellow(`${SYMBOLS.warning} ${report.stale}`)}  ${c.red(`${SYMBOLS.cross} ${report.expired}`)}  ${c.dim(`anomalies: ${report.anomalies}`)}`,\n  );\n\n  if (report.rotated.length > 0) {\n    lines.push(\n      `  ${c.cyan(`${SYMBOLS.zap} auto-rotated:`)} ${report.rotated.join(\", \")}`,\n    );\n  }\n\n  if (verbose && report.warnings.length > 0) {\n    lines.push(\"\");\n    for (const w of report.warnings) {\n      if (w.startsWith(\"EXPIRED\")) lines.push(`  ${c.red(w)}`);\n      else if (w.startsWith(\"STALE\")) lines.push(`  ${c.yellow(w)}`);\n      else if (w.startsWith(\"ANOMALY\")) lines.push(`  ${c.magenta(w)}`);\n      else lines.push(`  ${w}`);\n    }\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/**\n * Run the agent as a continuous background monitor.\n */\nexport async function startAgent(config: Partial<AgentConfig> = {}): Promise<void> {\n  const cfg = { ...defaultConfig(), ...config };\n\n  console.log(\n    `${c.bold(`${SYMBOLS.zap} q-ring agent started`)} ${c.dim(`(interval: ${cfg.intervalSeconds}s, auto-rotate: ${cfg.autoRotate})`)}`,\n  );\n  console.log(\n    c.dim(`  monitoring: global + ${cfg.projectPaths.length} project(s)`),\n  );\n  console.log();\n\n  const scan = () => {\n    const report = runHealthScan(cfg);\n    console.log(formatReport(report, cfg.verbose));\n\n    if (report.warnings.length > 0 || cfg.verbose) {\n      console.log();\n    }\n  };\n\n  // Initial scan\n  scan();\n\n  // Continuous monitoring\n  const interval = setInterval(scan, cfg.intervalSeconds * 1000);\n\n  // Graceful shutdown\n  const shutdown = () => {\n    clearInterval(interval);\n    console.log(`\\n${c.dim(\"q-ring agent stopped\")}`);\n    process.exit(0);\n  };\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n\n  // Keep alive\n  await new Promise(() => {});\n}\n","import type { Command } from \"commander\";\nimport { listSecrets } from \"../../core/keyring.js\";\nimport { startAgent, runHealthScan } from \"../../core/agent.js\";\nimport { queryAudit } from \"../../core/observer.js\";\nimport {\n  remember,\n  recall,\n  listMemory,\n  forget,\n  clearMemory,\n} from \"../../core/memory.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { safeStr, emitJson } from \"../helpers.js\";\nimport { confirm } from \"../../utils/prompt.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerAgentCommands(program: Command): void {\n  // ─── Agent Memory ───\n\n  program\n    .command(\"remember <key> <value>\")\n    .description(\n      \"Store a key-value pair in encrypted agent memory (persists across sessions)\",\n    )\n    .action((key: string, value: string) => {\n      remember(key, value);\n      console.log(`${SYMBOLS.check} ${c.green(\"remembered\")} ${c.bold(key)}`);\n    });\n\n  program\n    .command(\"recall [key]\")\n    .description(\"Retrieve a value from agent memory, or list all keys\")\n    .option(\"--json\", \"Output as JSON (list mode only)\")\n    .action((key: string | undefined, cmd) => {\n      if (!key) {\n        const entries = listMemory();\n        if (\n          emitJson(\n            program,\n            cmd,\n            entries.map((e) => ({ key: e.key, updatedAt: e.updatedAt })),\n          )\n        ) {\n          return;\n        }\n        if (entries.length === 0) {\n          console.log(c.dim(\"Agent memory is empty.\"));\n          return;\n        }\n        console.log(\n          `\\n${SYMBOLS.zap} ${c.bold(\"Agent Memory\")} (${entries.length} entries)\\n`,\n        );\n        for (const e of entries) {\n          console.log(\n            `  ${c.bold(e.key)}  ${c.dim(new Date(e.updatedAt).toLocaleString())}`,\n          );\n        }\n        console.log();\n        return;\n      }\n\n      const value = recall(key);\n      if (value === null) {\n        console.log(c.dim(`No memory found for \"${key}\"`));\n      } else {\n        console.log(safeStr(value));\n      }\n    });\n\n  program\n    .command(\"forget <key>\")\n    .description(\"Delete a key from agent memory\")\n    .option(\"--all\", \"Clear all agent memory\")\n    .option(\"-y, --yes\", \"Skip the confirmation prompt\")\n    .action(async (key: string, cmd) => {\n      if (cmd.all) {\n        const count = listMemory().length;\n        if (\n          !(await confirm(\n            `Clear ALL agent memory (${count} entr${count === 1 ? \"y\" : \"ies\"})? This cannot be undone.`,\n            { assumeYes: cmd.yes },\n          ))\n        ) {\n          console.error(c.dim(\"Aborted.\"));\n          process.exitCode = 1;\n          return;\n        }\n        clearMemory();\n        console.log(`${SYMBOLS.check} ${c.yellow(\"cleared\")} all agent memory`);\n        return;\n      }\n      const removed = forget(key);\n      if (removed) {\n        console.log(`${SYMBOLS.check} ${c.yellow(\"forgot\")} ${c.bold(key)}`);\n      } else {\n        console.log(c.dim(`No memory found for \"${key}\"`));\n      }\n    });\n\n  // ─── Analytics ───\n\n  program\n    .command(\"analyze\")\n    .description(\n      \"Analyze secret usage patterns and provide optimization suggestions\",\n    )\n    .option(\"-g, --global\", \"Global scope only\")\n    .option(\"-p, --project\", \"Project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      const entries = listSecrets({ ...opts, silent: true });\n      const audit = queryAudit({ limit: 1000 });\n\n      const accessMap = new Map<string, number>();\n      for (const e of audit) {\n        if (e.action === \"read\" && e.key) {\n          accessMap.set(e.key, (accessMap.get(e.key) || 0) + 1);\n        }\n      }\n\n      const sorted = [...accessMap.entries()].sort((a, b) => b[1] - a[1]);\n      const neverAccessed = entries.filter((e) => {\n        const count = e.envelope?.meta.accessCount ?? 0;\n        return count === 0;\n      });\n      const jsonExpired = entries.filter((e) => e.decay?.isExpired);\n      const jsonStale = entries.filter(\n        (e) => e.decay?.isStale && !e.decay?.isExpired,\n      );\n      const jsonNoRotation = entries.filter(\n        (e) => !e.envelope?.meta.rotationFormat && !e.decay?.isExpired,\n      );\n\n      if (\n        emitJson(program, cmd, {\n          mostAccessed: sorted\n            .slice(0, 5)\n            .map(([key, reads]) => ({ key, reads })),\n          neverAccessed: neverAccessed.map((e) => e.key),\n          expired: jsonExpired.map((e) => e.key),\n          stale: jsonStale.map((e) => ({\n            key: e.key,\n            timeRemaining: e.decay?.timeRemaining ?? null,\n          })),\n          summary: {\n            total: entries.length,\n            active: entries.length - jsonExpired.length,\n            expired: jsonExpired.length,\n            stale: jsonStale.length,\n            neverAccessed: neverAccessed.length,\n            withRotationConfig: entries.length - jsonNoRotation.length,\n          },\n        })\n      ) {\n        return;\n      }\n\n      console.log(`\\n${SYMBOLS.zap} ${c.bold(\"Secret Usage Analysis\")}\\n`);\n\n      if (sorted.length > 0) {\n        console.log(`  ${c.bold(\"Most accessed:\")}`);\n        for (const [key, count] of sorted.slice(0, 5)) {\n          console.log(`    ${c.bold(key)} — ${c.cyan(count.toString())} reads`);\n        }\n        console.log();\n      }\n\n      if (neverAccessed.length > 0) {\n        console.log(\n          `  ${c.bold(\"Never accessed:\")} ${c.yellow(neverAccessed.length.toString())} secrets`,\n        );\n        for (const e of neverAccessed.slice(0, 8)) {\n          const age = e.envelope?.meta.createdAt\n            ? c.dim(\n                `(created ${new Date(e.envelope.meta.createdAt).toLocaleDateString()})`,\n              )\n            : \"\";\n          console.log(`    ${c.dim(SYMBOLS.cross)} ${e.key} ${age}`);\n        }\n        console.log();\n      }\n\n      const expired = entries.filter((e) => e.decay?.isExpired);\n      const stale = entries.filter(\n        (e) => e.decay?.isStale && !e.decay?.isExpired,\n      );\n      if (expired.length > 0) {\n        console.log(\n          `  ${c.red(\"Expired:\")} ${expired.length} secrets need rotation or cleanup`,\n        );\n        for (const e of expired.slice(0, 5)) {\n          console.log(`    ${c.red(SYMBOLS.cross)} ${e.key}`);\n        }\n        console.log();\n      }\n      if (stale.length > 0) {\n        console.log(\n          `  ${c.yellow(\"Stale (>75% lifetime):\")} ${stale.length} secrets approaching expiry`,\n        );\n        for (const e of stale.slice(0, 5)) {\n          console.log(\n            `    ${c.yellow(SYMBOLS.warning)} ${e.key} ${c.dim(`(${e.decay?.timeRemaining} remaining)`)}`,\n          );\n        }\n        console.log();\n      }\n\n      const globalOnly = entries.filter((e) => e.scope === \"global\");\n      const withProjectTags = globalOnly.filter((e) =>\n        e.envelope?.meta.tags?.some((t) =>\n          [\"backend\", \"frontend\", \"db\", \"api\"].includes(t),\n        ),\n      );\n      if (withProjectTags.length > 0) {\n        console.log(`  ${c.bold(\"Scope suggestions:\")}`);\n        console.log(\n          `    ${withProjectTags.length} global secret(s) have project-specific tags — consider moving to project scope`,\n        );\n        console.log();\n      }\n\n      const noRotation = entries.filter(\n        (e) => !e.envelope?.meta.rotationFormat && !e.decay?.isExpired,\n      );\n      if (noRotation.length > 0) {\n        console.log(`  ${c.bold(\"Rotation suggestions:\")}`);\n        console.log(\n          `    ${noRotation.length} secret(s) have no rotation format set`,\n        );\n        console.log(\n          `    Use ${c.bold(\"qring set <key> <value> --rotation-format api-key\")} to enable auto-rotation`,\n        );\n        console.log();\n      }\n\n      console.log(`  ${c.bold(\"Summary:\")}`);\n      console.log(`    Total secrets: ${entries.length}`);\n      console.log(`    Active: ${entries.length - expired.length}`);\n      console.log(`    Expired: ${expired.length}`);\n      console.log(`    Stale: ${stale.length}`);\n      console.log(`    Never accessed: ${neverAccessed.length}`);\n      console.log(\n        `    With rotation config: ${entries.length - noRotation.length}`,\n      );\n      console.log();\n    });\n\n  // ─── Agent Mode ───\n\n  program\n    .command(\"agent\")\n    .description(\"Start the autonomous agent (background monitor)\")\n    .option(\n      \"-i, --interval <seconds>\",\n      \"Scan interval in seconds\",\n      parseInt,\n      60,\n    )\n    .option(\"--auto-rotate\", \"Auto-rotate expired secrets\")\n    .option(\"-v, --verbose\", \"Verbose output with all warnings\")\n    .option(\n      \"--project-path <paths>\",\n      \"Comma-separated project paths to monitor\",\n    )\n    .option(\"--once\", \"Run a single scan and exit (no daemon)\")\n    .action(async (cmd) => {\n      const projectPaths = cmd.projectPath\n        ? cmd.projectPath.split(\",\").map((p: string) => p.trim())\n        : [process.cwd()];\n\n      if (cmd.once) {\n        const report = runHealthScan({\n          autoRotate: cmd.autoRotate,\n          projectPaths,\n          verbose: cmd.verbose,\n        });\n\n        console.log(JSON.stringify(report, null, 2));\n        return;\n      }\n\n      await startAgent({\n        intervalSeconds: cmd.interval,\n        autoRotate: cmd.autoRotate,\n        projectPaths,\n        verbose: cmd.verbose,\n      });\n    });\n}\n","import type { Command } from \"commander\";\nimport {\n  grantApproval,\n  revokeApproval,\n  listApprovals,\n} from \"../../core/approval.js\";\nimport { serviceForScope } from \"../../core/scope.js\";\nimport { getPolicySummary } from \"../../core/policy.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { wantsJsonOutput, emitJson } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerSecurityCommands(program: Command): void {\n  program\n    .command(\"approve <key>\")\n    .description(\n      \"Grant a scoped, reasoned, HMAC-verified approval token for MCP secret access\",\n    )\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--for <seconds>\", \"Duration of approval in seconds\", parseInt, 3600)\n    .option(\"--reason <text>\", \"Reason for granting approval\")\n    .option(\"--revoke\", \"Revoke an existing approval\")\n    .option(\"--list\", \"List all approvals\")\n    .action((key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const scope = opts.scope ?? \"global\";\n      // Bind the approval to the concrete project/team/org identity, not just\n      // the coarse scope label (A5) — the label \"project\" is identical across\n      // every project, so an approval must be keyed on the resolved service.\n      const service = serviceForScope(scope, opts);\n\n      if (cmd.list) {\n        const approvals = listApprovals();\n        if (approvals.length === 0) {\n          console.log(c.dim(\"  No active approvals\"));\n          return;\n        }\n        for (const a of approvals) {\n          const status = a.tampered\n            ? c.red(\"TAMPERED\")\n            : a.valid\n              ? c.green(\"active\")\n              : c.dim(\"expired\");\n          const ttl = Math.max(\n            0,\n            Math.round(\n              (new Date(a.expiresAt).getTime() - Date.now()) / 1000,\n            ),\n          );\n          console.log(\n            `  ${status} ${c.bold(a.key)} [${a.scope}] reason=${c.dim(a.reason)} ttl=${ttl}s granted-by=${a.grantedBy}`,\n          );\n        }\n        return;\n      }\n\n      if (cmd.revoke) {\n        const revoked = revokeApproval(key, scope, service);\n        if (revoked) {\n          console.log(\n            `${SYMBOLS.check} ${c.yellow(\"revoked\")} approval for ${c.bold(key)}`,\n          );\n        } else {\n          console.log(c.dim(`  No active approval found for ${key}`));\n        }\n        return;\n      }\n\n      const entry = grantApproval(key, scope, service, cmd.for, {\n        reason: cmd.reason ?? \"manual approval\",\n      });\n      console.log(\n        `${SYMBOLS.check} ${c.green(\"approved\")} ${c.bold(key)} for ${cmd.for}s`,\n      );\n      console.log(\n        c.dim(\n          `  id=${entry.id} reason=\"${entry.reason}\" expires=${entry.expiresAt}`,\n        ),\n      );\n    });\n\n  program\n    .command(\"approvals\")\n    .description(\"List all approval tokens with verification status\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const approvals = listApprovals();\n      if (emitJson(program, cmd, { approvals })) return;\n      if (approvals.length === 0) {\n        console.log(c.dim(\"  No approvals found\"));\n        return;\n      }\n\n      console.log(c.bold(`\\n${SYMBOLS.lock} Approval Tokens\\n`));\n      for (const a of approvals) {\n        const status = a.tampered\n          ? c.red(`${SYMBOLS.cross} TAMPERED`)\n          : a.valid\n            ? c.green(`${SYMBOLS.check} active`)\n            : c.dim(`${SYMBOLS.warning} expired`);\n        const ttl = Math.max(\n          0,\n          Math.round((new Date(a.expiresAt).getTime() - Date.now()) / 1000),\n        );\n        console.log(`  ${status} ${c.bold(a.key)} [${a.scope}]`);\n        console.log(\n          c.dim(`    id=${a.id} reason=\"${a.reason}\" ttl=${ttl}s by=${a.grantedBy}`),\n        );\n        if (a.workspace) console.log(c.dim(`    workspace=${a.workspace}`));\n      }\n      console.log();\n    });\n\n  program\n    .command(\"policy\")\n    .description(\"Show project governance policy summary\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const summary = getPolicySummary();\n      if (wantsJsonOutput(program, cmd)) {\n        console.log(JSON.stringify(summary, null, 2));\n        return;\n      }\n\n      console.log(c.bold(\"\\n⚖  Governance Policy\\n\"));\n\n      if (\n        !summary.hasMcpPolicy &&\n        !summary.hasExecPolicy &&\n        !summary.hasSecretPolicy\n      ) {\n        console.log(c.dim(\"  No policy configured in .q-ring.json\"));\n        console.log(\n          c.dim('  Add a \"policy\" section to enable governance controls.\\n'),\n        );\n        return;\n      }\n\n      if (summary.hasMcpPolicy) {\n        console.log(c.cyan(\"  MCP Policy:\"));\n        const m = summary.details.mcp!;\n        if (m.allowTools)\n          console.log(c.green(`    Allow tools: ${m.allowTools.join(\", \")}`));\n        if (m.denyTools)\n          console.log(c.red(`    Deny tools:  ${m.denyTools.join(\", \")}`));\n        if (m.readableKeys)\n          console.log(\n            c.green(`    Readable keys: ${m.readableKeys.join(\", \")}`),\n          );\n        if (m.deniedKeys)\n          console.log(c.red(`    Denied keys:   ${m.deniedKeys.join(\", \")}`));\n        if (m.deniedTags)\n          console.log(c.red(`    Denied tags:   ${m.deniedTags.join(\", \")}`));\n      }\n\n      if (summary.hasExecPolicy) {\n        console.log(c.cyan(\"  Exec Policy:\"));\n        const e = summary.details.exec!;\n        if (e.allowCommands)\n          console.log(\n            c.green(`    Allow commands:    ${e.allowCommands.join(\", \")}`),\n          );\n        if (e.denyCommands)\n          console.log(\n            c.red(`    Deny commands:     ${e.denyCommands.join(\", \")}`),\n          );\n        if (e.maxRuntimeSeconds)\n          console.log(`    Max runtime:       ${e.maxRuntimeSeconds}s`);\n        if (e.allowNetwork !== undefined)\n          console.log(`    Allow network:     ${e.allowNetwork}`);\n      }\n\n      if (summary.hasSecretPolicy) {\n        console.log(c.cyan(\"  Secret Lifecycle Policy:\"));\n        const s = summary.details.secrets!;\n        if (s.requireApprovalForTags)\n          console.log(\n            `    Require approval for tags: ${s.requireApprovalForTags.join(\", \")}`,\n          );\n        if (s.maxTtlSeconds) console.log(`    Max TTL: ${s.maxTtlSeconds}s`);\n      }\n\n      console.log();\n    });\n}\n","/**\n * `qring run` — least-privilege command runner.\n *\n * Where `qring exec` injects every secret in scope, `run` injects only what\n * the project declares: qring:// references found in .env files, plus the\n * keys listed in the .q-ring.json secrets manifest. This is the bridge that\n * lets a .env file be committed (it holds references, not values) while the\n * real secrets stay in the keyring.\n *\n * Environment composition, later sources win:\n *   process.env  <  manifest keys  <  .env files (plain values and resolved refs)\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve as resolvePath } from \"node:path\";\nimport {\n  getProfile,\n  enforceExecPolicy,\n  spawnRedacted,\n  type ExecResult,\n} from \"./exec.js\";\nimport { parseDotenv } from \"./import.js\";\nimport { resolveRef, resolveRefsInMap, isRef } from \"./refs.js\";\nimport { readProjectConfig } from \"./collapse.js\";\nimport type { KeyringOptions } from \"./keyring.js\";\n\nexport interface RunOptions extends KeyringOptions {\n  command: string;\n  args: string[];\n  /** Explicit .env files; default is ./.env when it exists. */\n  envFiles?: string[];\n  /** Resolve .q-ring.json manifest keys (default true). */\n  useManifest?: boolean;\n  /** Exec profile name (unrestricted, restricted, ci). */\n  profile?: string;\n  captureOutput?: boolean;\n  /** Treat missing optional manifest keys as fatal too. */\n  strict?: boolean;\n}\n\nexport interface InjectedVar {\n  name: string;\n  source: \"manifest\" | \"env-file\" | \"env-file-ref\";\n}\n\nexport interface RunPlan {\n  envFiles: string[];\n  injected: InjectedVar[];\n  /** Missing required keys (fatal) — manifest required:true or explicit refs. */\n  missingRequired: string[];\n  /** Missing optional manifest keys (warned, not fatal). */\n  missingOptional: string[];\n  envMap: Record<string, string>;\n  secretsToRedact: string[];\n}\n\n/**\n * Compose the child environment for a run without spawning anything.\n * Exposed separately so `qring run --dry-run` and tests can inspect the plan.\n */\nexport function buildRunPlan(opts: RunOptions): RunPlan {\n  const projectPath = opts.projectPath ?? process.cwd();\n  const keyringOpts: KeyringOptions = {\n    projectPath,\n    env: opts.env,\n    source: opts.source ?? \"cli\",\n    silent: opts.silent,\n  };\n\n  const envMap: Record<string, string> = {};\n  for (const [k, v] of Object.entries(process.env)) {\n    if (v !== undefined) envMap[k] = v;\n  }\n\n  const injected: InjectedVar[] = [];\n  const missingRequired: string[] = [];\n  const missingOptional: string[] = [];\n  const secretsToRedact = new Set<string>();\n\n  // 1. Manifest keys (project scope first, then global — same as auto refs).\n  if (opts.useManifest !== false) {\n    const config = readProjectConfig(projectPath);\n    for (const [key, entry] of Object.entries(config?.secrets ?? {})) {\n      const value = resolveRef(\n        { key, raw: `manifest:${key}` },\n        keyringOpts,\n      );\n      if (value === null) {\n        if (entry.required !== false) missingRequired.push(key);\n        else if (opts.strict) missingRequired.push(key);\n        else missingOptional.push(key);\n        continue;\n      }\n      envMap[key] = value;\n      injected.push({ name: key, source: \"manifest\" });\n      if (value.length > 5) secretsToRedact.add(value);\n    }\n  }\n\n  // 2. .env files: plain values pass through, qring:// refs resolve.\n  const envFiles =\n    opts.envFiles ??\n    (existsSync(join(projectPath, \".env\")) ? [join(projectPath, \".env\")] : []);\n\n  for (const file of envFiles) {\n    const path = resolvePath(projectPath, file);\n    if (!existsSync(path)) {\n      throw new Error(`Env file not found: ${path}`);\n    }\n    const parsed = Object.fromEntries(parseDotenv(readFileSync(path, \"utf8\")));\n    const { resolved, secretValues, missing } = resolveRefsInMap(parsed, keyringOpts);\n\n    for (const [name, value] of Object.entries(resolved)) {\n      envMap[name] = value;\n      injected.push({\n        name,\n        source: isRef(parsed[name]) ? \"env-file-ref\" : \"env-file\",\n      });\n    }\n    for (const value of secretValues) {\n      if (value.length > 5) secretsToRedact.add(value);\n    }\n    // A ref written into a .env file is an explicit demand — missing is fatal.\n    for (const m of missing) missingRequired.push(m.name);\n  }\n\n  return {\n    envFiles: envFiles.map((f) => resolvePath(projectPath, f)),\n    injected,\n    missingRequired,\n    missingOptional,\n    envMap,\n    secretsToRedact: [...secretsToRedact],\n  };\n}\n\nexport interface RunResult extends ExecResult {\n  plan: RunPlan;\n}\n\nexport async function runCommand(opts: RunOptions): Promise<RunResult> {\n  const profile = getProfile(opts.profile);\n  enforceExecPolicy(profile, opts.command, opts.args, opts.projectPath);\n\n  const plan = buildRunPlan(opts);\n\n  if (plan.missingRequired.length > 0) {\n    throw new Error(\n      `Missing required secrets: ${plan.missingRequired.join(\", \")}. ` +\n        `Store them with \\`qring set <KEY>\\` or drop them from the manifest/.env refs.`,\n    );\n  }\n\n  if (profile.stripEnvVars) {\n    for (const key of profile.stripEnvVars) {\n      delete plan.envMap[key];\n    }\n  }\n\n  const result = await spawnRedacted({\n    profile,\n    command: opts.command,\n    args: opts.args,\n    envMap: plan.envMap,\n    secretsToRedact: plan.secretsToRedact,\n    captureOutput: opts.captureOutput,\n    projectPath: opts.projectPath,\n  });\n\n  return { ...result, plan };\n}\n","/**\n * qring:// Secret References\n *\n * A secret reference is a stable, committable pointer to a secret in the\n * keyring — the value that goes in a .env file or CI config instead of the\n * secret itself:\n *\n *   qring://project/DATABASE_URL          project-scoped key\n *   qring://global/OPENAI_API_KEY         global-scoped key\n *   qring:///STRIPE_KEY                   auto scope (project, then global)\n *   qring://project/DATABASE_URL?env=prod pin the superposition environment\n *\n * The KEY always lives in the PATH component, never the host: URL hosts are\n * case-insensitive and WHATWG parsers lowercase them, which would silently\n * corrupt `qring://DATABASE_URL` into `database_url`. Refs are parsed with a\n * grammar of our own (not `new URL`) so that footgun cannot exist, and the\n * key-in-host form is rejected with a corrective error.\n */\n\nimport { getSecret, type KeyringOptions } from \"./keyring.js\";\nimport type { Environment } from \"./envelope.js\";\n\nexport const REF_PREFIX = \"qring://\";\n\n/** Scopes addressable by a ref. Team/org need out-of-band ids and are not addressable. */\nexport type RefScope = \"global\" | \"project\";\n\nexport interface SecretRef {\n  /** Undefined = auto: resolve project scope first, then global. */\n  scope?: RefScope;\n  key: string;\n  /** Environment pin from `?env=`; undefined = collapse from context. */\n  env?: Environment;\n  /** The original ref string, for error messages and round-tripping. */\n  raw: string;\n}\n\nconst KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;\nconst REF_PATTERN = /^qring:\\/\\/(global|project|)\\/([^/?#]+)(?:\\?([^#]*))?$/;\n\n/** True if a string is even shaped like a ref (cheap pre-filter for env maps). */\nexport function isRef(value: string): boolean {\n  return value.startsWith(REF_PREFIX);\n}\n\n/**\n * Parse a qring:// reference. Throws on malformed refs — a ref that made it\n * into a .env file is config, and config errors should be loud, not silently\n * passed through to the child process as a literal `qring://...` string.\n */\nexport function parseRef(raw: string): SecretRef {\n  if (!isRef(raw)) {\n    throw new Error(`Not a qring:// reference: \"${raw}\"`);\n  }\n\n  const match = REF_PATTERN.exec(raw);\n  if (!match) {\n    // The one mistake everyone will make: qring://DATABASE_URL (key in the\n    // host slot). Catch it specifically and say what the correct form is.\n    const hostOnly = /^qring:\\/\\/([^/?#]+)\\/?$/.exec(raw);\n    if (hostOnly && KEY_PATTERN.test(hostOnly[1]) && ![\"global\", \"project\"].includes(hostOnly[1])) {\n      throw new Error(\n        `Invalid ref \"${raw}\": the key belongs in the path, not the host ` +\n          `(URL hosts are lowercased by parsers). ` +\n          `Use \"qring:///${hostOnly[1]}\" (auto scope) or \"qring://project/${hostOnly[1]}\".`,\n      );\n    }\n    throw new Error(\n      `Invalid ref \"${raw}\": expected qring://<global|project|>/KEY[?env=<env>]`,\n    );\n  }\n\n  const [, scopeRaw, key, query] = match;\n\n  if (!KEY_PATTERN.test(key)) {\n    throw new Error(\n      `Invalid ref \"${raw}\": \"${key}\" is not a valid secret key (expected [A-Za-z_][A-Za-z0-9_]*)`,\n    );\n  }\n\n  let env: Environment | undefined;\n  if (query) {\n    for (const part of query.split(\"&\")) {\n      if (!part) continue;\n      const eq = part.indexOf(\"=\");\n      const name = eq === -1 ? part : part.slice(0, eq);\n      const value = eq === -1 ? \"\" : decodeURIComponent(part.slice(eq + 1));\n      if (name === \"env\") {\n        env = value as Environment;\n      } else {\n        throw new Error(`Invalid ref \"${raw}\": unknown query parameter \"${name}\"`);\n      }\n    }\n  }\n\n  return {\n    scope: scopeRaw === \"\" ? undefined : (scopeRaw as RefScope),\n    key,\n    env,\n    raw,\n  };\n}\n\nexport type ResolveRefOptions = KeyringOptions;\n\n/**\n * Resolve a parsed ref to its secret value. Auto-scope refs try project\n * first, then global. Returns null when the key is absent (callers decide\n * whether missing is fatal); scope/env options from the ref override the\n * caller's context.\n */\nexport function resolveRef(ref: SecretRef, opts: ResolveRefOptions = {}): string | null {\n  const scopes: RefScope[] = ref.scope ? [ref.scope] : [\"project\", \"global\"];\n\n  for (const scope of scopes) {\n    const value = getSecret(ref.key, {\n      ...opts,\n      scope,\n      env: ref.env ?? opts.env,\n    });\n    if (value !== null) return value;\n  }\n  return null;\n}\n\nexport interface ResolvedRefMap {\n  /** Env map with every qring:// value replaced by its resolved secret. */\n  resolved: Record<string, string>;\n  /** Values that resolved from the keyring (for redaction). */\n  secretValues: string[];\n  /** Refs whose key was not found in any addressed scope. */\n  missing: { name: string; ref: SecretRef }[];\n}\n\n/**\n * Resolve every qring:// value in an env map. Non-ref values pass through\n * untouched; malformed refs throw (see parseRef).\n */\nexport function resolveRefsInMap(\n  map: Record<string, string>,\n  opts: ResolveRefOptions = {},\n): ResolvedRefMap {\n  const resolved: Record<string, string> = {};\n  const secretValues: string[] = [];\n  const missing: { name: string; ref: SecretRef }[] = [];\n\n  for (const [name, value] of Object.entries(map)) {\n    if (!isRef(value)) {\n      resolved[name] = value;\n      continue;\n    }\n    const ref = parseRef(value);\n    const secret = resolveRef(ref, opts);\n    if (secret === null) {\n      missing.push({ name, ref });\n      continue;\n    }\n    resolved[name] = secret;\n    secretValues.push(secret);\n  }\n\n  return { resolved, secretValues, missing };\n}\n","/**\n * `qring setup <editor>` — wire the q-ring MCP server into an editor's\n * MCP config with one command, instead of hand-editing JSON.\n *\n * Writes the same server entry the bundled plugins ship (cursor-plugin/,\n * kiro-plugin/, claude-code-plugin/), merged non-destructively into the\n * editor's existing config: other servers are preserved, and an existing\n * q-ring entry is only replaced with --force.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nexport type Editor = \"cursor\" | \"kiro\" | \"claude\";\n\nexport const EDITORS: Editor[] = [\"cursor\", \"kiro\", \"claude\"];\n\n/** MCP tools that are safe to auto-approve (read-only) — mirrors kiro-plugin/mcp.json. */\nconst READ_ONLY_TOOLS = [\n  \"list_secrets\",\n  \"has_secret\",\n  \"inspect_secret\",\n  \"detect_environment\",\n  \"get_project_context\",\n  \"list_providers\",\n  \"list_hooks\",\n  \"get_policy_summary\",\n  \"audit_log\",\n  \"verify_audit_chain\",\n  \"health_check\",\n  \"analyze_secrets\",\n];\n\nexport interface SetupOptions {\n  editor: Editor;\n  /** Write the per-user config instead of the per-project one. */\n  global?: boolean;\n  projectPath?: string;\n  /** Replace an existing q-ring entry that differs from ours. */\n  force?: boolean;\n  dryRun?: boolean;\n}\n\nexport interface SetupResult {\n  editor: Editor;\n  configPath: string;\n  serverName: string;\n  action: \"created\" | \"updated\" | \"unchanged\";\n  dryRun: boolean;\n  warnings: string[];\n}\n\nconst SERVER_NAME = \"q-ring\";\n\nfunction serverEntry(editor: Editor): Record<string, unknown> {\n  switch (editor) {\n    case \"cursor\":\n      return { command: \"qring-mcp\", args: [], env: {} };\n    case \"kiro\":\n      return {\n        command: \"qring-mcp\",\n        args: [],\n        env: {},\n        disabled: false,\n        autoApprove: READ_ONLY_TOOLS,\n      };\n    case \"claude\":\n      return { type: \"stdio\", command: \"qring-mcp\", args: [], env: {} };\n  }\n}\n\nexport function configPathFor(\n  editor: Editor,\n  global: boolean,\n  projectPath: string,\n): string {\n  const home = homedir();\n  switch (editor) {\n    case \"cursor\":\n      return global\n        ? join(home, \".cursor\", \"mcp.json\")\n        : join(projectPath, \".cursor\", \"mcp.json\");\n    case \"kiro\":\n      return global\n        ? join(home, \".kiro\", \"settings\", \"mcp.json\")\n        : join(projectPath, \".kiro\", \"settings\", \"mcp.json\");\n    case \"claude\":\n      if (global) {\n        // ~/.claude.json is harness-managed state, not a config file we\n        // should merge into. User-scoped registration goes through the CLI.\n        throw new Error(\n          \"Claude Code user-scoped MCP servers are registered via the claude CLI, not a config file.\\n\" +\n            \"Run: claude mcp add --scope user q-ring qring-mcp\\n\" +\n            \"Or install the plugin: /plugin marketplace add I4cTime/q-ring && /plugin install qring@q-ring\",\n        );\n      }\n      return join(projectPath, \".mcp.json\");\n  }\n}\n\nexport function setupEditor(opts: SetupOptions): SetupResult {\n  const projectPath = opts.projectPath ?? process.cwd();\n  const configPath = configPathFor(opts.editor, opts.global ?? false, projectPath);\n  const warnings: string[] = [];\n\n  let config: Record<string, unknown> = {};\n  if (existsSync(configPath)) {\n    const raw = readFileSync(configPath, \"utf8\");\n    try {\n      config = JSON.parse(raw) as Record<string, unknown>;\n    } catch {\n      throw new Error(\n        `${configPath} exists but is not valid JSON — fix or remove it, then re-run.`,\n      );\n    }\n  }\n\n  const servers = (config.mcpServers ?? {}) as Record<string, unknown>;\n  const desired = serverEntry(opts.editor);\n  const existing = servers[SERVER_NAME];\n\n  let action: SetupResult[\"action\"];\n  if (existing === undefined) {\n    action = existsSync(configPath) ? \"updated\" : \"created\";\n    servers[SERVER_NAME] = desired;\n  } else if (JSON.stringify(existing) === JSON.stringify(desired)) {\n    action = \"unchanged\";\n  } else if (opts.force) {\n    action = \"updated\";\n    servers[SERVER_NAME] = desired;\n  } else {\n    action = \"unchanged\";\n    warnings.push(\n      `A different \"${SERVER_NAME}\" entry already exists in ${configPath} — left as-is (use --force to replace it).`,\n    );\n  }\n\n  config.mcpServers = servers;\n\n  if (action !== \"unchanged\" && !opts.dryRun) {\n    mkdirSync(dirname(configPath), { recursive: true });\n    writeFileSync(configPath, JSON.stringify(config, null, 2) + \"\\n\");\n  }\n\n  return {\n    editor: opts.editor,\n    configPath,\n    serverName: SERVER_NAME,\n    action,\n    dryRun: opts.dryRun ?? false,\n    warnings,\n  };\n}\n","/**\n * `qring push` — bridge secrets out to deployment platforms.\n *\n * Pushes keyring secrets to GitHub Actions, Vercel, or Cloudflare Workers\n * through each platform's OWN authenticated CLI (gh / vercel / wrangler).\n * q-ring never holds platform tokens, and secret values travel over the\n * child's stdin — never argv, which is world-readable via /proc.\n *\n * Which keys move is the project's declared contract: the .q-ring.json\n * secrets manifest by default, or an explicit --keys list. Every pushed key\n * is written to the audit chain as a \"push\" event (deliberate egress is\n * exactly what an audit log is for).\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { resolveRef } from \"./refs.js\";\nimport { readProjectConfig } from \"./collapse.js\";\nimport { logAudit } from \"./observer.js\";\nimport type { KeyringOptions } from \"./keyring.js\";\n\nexport type PushTarget = \"github\" | \"vercel\" | \"cloudflare\";\n\nexport const PUSH_TARGETS: PushTarget[] = [\"github\", \"vercel\", \"cloudflare\"];\n\nexport interface PushOptions extends KeyringOptions {\n  target: PushTarget;\n  /** Explicit keys; default is every key in the .q-ring.json manifest. */\n  keys?: string[];\n  /** GitHub repo (owner/name); default is the repo of the current directory. */\n  repo?: string;\n  /** Vercel environments to push to (production, preview, development). */\n  vercelEnvs?: string[];\n  dryRun?: boolean;\n  /**\n   * Values to push for specific keys WITHOUT reading them from the keyring.\n   * Used by `qring canary plant --push`: reading a freshly planted canary\n   * would trip it. Internal to the CLI — never reachable over MCP.\n   */\n  presetValues?: Record<string, string>;\n  /** Audit these keys as canaries (detail text only). */\n  canaryKeys?: string[];\n}\n\nexport interface PushResult {\n  target: PushTarget;\n  /** Keys that were (or with dryRun, would be) pushed. */\n  pushed: string[];\n  /** Keys the platform CLI rejected, with its stderr. */\n  failed: { key: string; error: string }[];\n  /** Keys not found in the keyring — skipped, reported, non-fatal. */\n  missing: string[];\n}\n\ninterface TargetCommand {\n  binary: string;\n  /** argv for pushing one key; the value is always piped via stdin. */\n  args(key: string, opts: PushOptions): string[][];\n  installHint: string;\n}\n\nconst TARGETS: Record<PushTarget, TargetCommand> = {\n  github: {\n    binary: \"gh\",\n    args: (key, opts) => [[\"secret\", \"set\", key, ...(opts.repo ? [\"--repo\", opts.repo] : [])]],\n    installHint: \"install the GitHub CLI: https://cli.github.com (then `gh auth login`)\",\n  },\n  vercel: {\n    binary: \"vercel\",\n    // One invocation per environment — `vercel env add` takes a single target.\n    args: (key, opts) =>\n      (opts.vercelEnvs ?? [\"production\"]).map((env) => [\"env\", \"add\", key, env, \"--force\"]),\n    installHint: \"install the Vercel CLI: npm i -g vercel (then `vercel link` in the project)\",\n  },\n  cloudflare: {\n    binary: \"wrangler\",\n    args: (key) => [[\"secret\", \"put\", key]],\n    installHint: \"install Wrangler: npm i -g wrangler (then `wrangler login`)\",\n  },\n};\n\nfunction binaryAvailable(binary: string): boolean {\n  const probe = spawnSync(binary, [\"--version\"], { stdio: \"ignore\", shell: false });\n  return !probe.error;\n}\n\n/** Resolve which keys a push covers: explicit list, else the manifest. */\nexport function resolvePushKeys(opts: PushOptions): string[] {\n  if (opts.keys?.length) return opts.keys;\n  const config = readProjectConfig(opts.projectPath);\n  const manifestKeys = Object.keys(config?.secrets ?? {});\n  if (manifestKeys.length === 0) {\n    throw new Error(\n      \"Nothing to push: no --keys given and no secrets manifest in .q-ring.json. \" +\n        \"Declare the project's secrets there or pass --keys KEY1,KEY2.\",\n    );\n  }\n  return manifestKeys;\n}\n\nexport function pushSecrets(opts: PushOptions): PushResult {\n  const target = TARGETS[opts.target];\n  const keys = resolvePushKeys(opts);\n\n  if (!opts.dryRun && !binaryAvailable(target.binary)) {\n    throw new Error(`\"${target.binary}\" CLI not found — ${target.installHint}`);\n  }\n\n  const result: PushResult = { target: opts.target, pushed: [], failed: [], missing: [] };\n\n  for (const key of keys) {\n    const preset = opts.presetValues?.[key];\n    const value =\n      preset !== undefined\n        ? preset\n        : resolveRef(\n            { key, raw: `push:${key}` },\n            {\n              projectPath: opts.projectPath,\n              env: opts.env,\n              source: opts.source ?? \"cli\",\n              silent: opts.silent,\n            },\n          );\n    if (value === null) {\n      result.missing.push(key);\n      continue;\n    }\n\n    if (opts.dryRun) {\n      result.pushed.push(key);\n      continue;\n    }\n\n    let failedInvocation: string | null = null;\n    for (const args of target.args(key, opts)) {\n      const child = spawnSync(target.binary, args, {\n        input: value,\n        cwd: opts.projectPath,\n        encoding: \"utf8\",\n        shell: false,\n      });\n      if (child.status !== 0) {\n        failedInvocation = child.stderr?.trim() || child.error?.message || `exit ${child.status}`;\n        break;\n      }\n    }\n\n    if (failedInvocation) {\n      result.failed.push({ key, error: failedInvocation });\n      continue;\n    }\n\n    result.pushed.push(key);\n    if (!opts.silent) {\n      logAudit({\n        action: \"push\",\n        key,\n        env: opts.env,\n        source: opts.source ?? \"cli\",\n        detail: `${opts.canaryKeys?.includes(key) ? \"canary honeytoken \" : \"\"}pushed to ${opts.target}${opts.repo ? ` (${opts.repo})` : \"\"}`,\n      });\n    }\n  }\n\n  return result;\n}\n","import type { Command } from \"commander\";\nimport { runCommand, buildRunPlan, type RunOptions } from \"../../core/run.js\";\nimport { setupEditor, EDITORS, type Editor } from \"../../core/setup.js\";\nimport { pushSecrets, PUSH_TARGETS, type PushTarget } from \"../../core/push.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { wantsJsonOutput } from \"../helpers.js\";\n\nexport function registerBridgeCommands(program: Command): void {\n  program\n    .command(\"run <command...>\")\n    .description(\n      \"Run a command with only declared secrets injected — .q-ring.json manifest keys plus qring:// refs from .env (output auto-redacted)\",\n    )\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Environment context\")\n    .option(\"--env-file <files...>\", \"Env file(s) to load (default: ./.env when present)\")\n    .option(\"--no-manifest\", \"Skip .q-ring.json manifest keys\")\n    .option(\"--profile <name>\", \"Exec profile: unrestricted, restricted, ci\")\n    .option(\"--strict\", \"Missing optional manifest keys are fatal too\")\n    .option(\"--dry-run\", \"Show what would be injected without running\")\n    .action(async (commandArgs: string[], cmd) => {\n      const opts: RunOptions = {\n        command: commandArgs[0],\n        args: commandArgs.slice(1),\n        projectPath: cmd.projectPath ?? process.cwd(),\n        env: cmd.env,\n        envFiles: cmd.envFile,\n        useManifest: cmd.manifest !== false,\n        profile: cmd.profile,\n        strict: cmd.strict === true,\n        source: \"cli\",\n      };\n\n      try {\n        if (cmd.dryRun) {\n          const plan = buildRunPlan({ ...opts, silent: true });\n          console.log(`\\n${SYMBOLS.zap} ${c.bold(\"qring run\")} ${c.dim(\"(dry run)\")}`);\n          if (plan.envFiles.length > 0) {\n            console.log(`  Env files: ${plan.envFiles.map((f) => c.cyan(f)).join(\", \")}`);\n          }\n          for (const v of plan.injected) {\n            console.log(`  ${c.green(SYMBOLS.check)} ${v.name} ${c.dim(`(${v.source})`)}`);\n          }\n          for (const name of plan.missingOptional) {\n            console.log(`  ${c.yellow(\"?\")} ${name} ${c.dim(\"(optional, missing)\")}`);\n          }\n          for (const name of plan.missingRequired) {\n            console.log(`  ${c.red(SYMBOLS.cross)} ${name} ${c.dim(\"(required, MISSING)\")}`);\n          }\n          process.exit(plan.missingRequired.length > 0 ? 1 : 0);\n        }\n\n        const { code, plan } = await runCommand(opts);\n        if (plan.missingOptional.length > 0) {\n          console.error(\n            c.yellow(\n              `${SYMBOLS.warning} Optional secrets not found: ${plan.missingOptional.join(\", \")}`,\n            ),\n          );\n        }\n        process.exit(code);\n      } catch (err) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Run failed: ${err instanceof Error ? err.message : String(err)}`,\n          ),\n        );\n        process.exit(1);\n      }\n    });\n\n  program\n    .command(\"push <target>\")\n    .description(\n      `Push manifest secrets to a deployment platform via its own CLI (${PUSH_TARGETS.join(\", \")}) — values travel over stdin, never argv`,\n    )\n    .option(\"-k, --keys <keys>\", \"Comma-separated keys (default: .q-ring.json manifest)\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Environment context for superposition collapse\")\n    .option(\"--repo <owner/name>\", \"GitHub repository (github target)\")\n    .option(\n      \"--vercel-env <envs>\",\n      \"Comma-separated Vercel environments (default: production)\",\n    )\n    .option(\"--dry-run\", \"Show what would be pushed without pushing\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((targetArg: string, cmd) => {\n      if (!PUSH_TARGETS.includes(targetArg as PushTarget)) {\n        console.error(\n          c.red(`${SYMBOLS.cross} Unknown target \"${targetArg}\" — expected one of: ${PUSH_TARGETS.join(\", \")}`),\n        );\n        process.exit(1);\n      }\n\n      try {\n        const result = pushSecrets({\n          target: targetArg as PushTarget,\n          keys: cmd.keys?.split(\",\").map((k: string) => k.trim()),\n          projectPath: cmd.projectPath ?? process.cwd(),\n          env: cmd.env,\n          repo: cmd.repo,\n          vercelEnvs: cmd.vercelEnv?.split(\",\").map((e: string) => e.trim()),\n          dryRun: cmd.dryRun === true,\n          source: \"cli\",\n        });\n\n        if (wantsJsonOutput(program, cmd)) {\n          console.log(JSON.stringify(result, null, 2));\n          process.exit(result.failed.length > 0 ? 1 : 0);\n        }\n\n        const prefix = cmd.dryRun ? c.dim(\"[dry-run] \") : \"\";\n        console.log(`\\n${SYMBOLS.link} ${prefix}${c.bold(`qring push ${targetArg}`)}`);\n        for (const key of result.pushed) {\n          console.log(`  ${c.green(SYMBOLS.check)} ${key}`);\n        }\n        for (const key of result.missing) {\n          console.log(`  ${c.yellow(\"?\")} ${key} ${c.dim(\"(not in keyring — skipped)\")}`);\n        }\n        for (const { key, error } of result.failed) {\n          console.log(`  ${c.red(SYMBOLS.cross)} ${key} ${c.dim(`— ${error}`)}`);\n        }\n        console.log(\n          c.dim(\n            `  ${result.pushed.length} pushed${cmd.dryRun ? \" (dry run)\" : \"\"}, ${result.missing.length} missing, ${result.failed.length} failed`,\n          ),\n        );\n        process.exit(result.failed.length > 0 ? 1 : 0);\n      } catch (err) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Push failed: ${err instanceof Error ? err.message : String(err)}`,\n          ),\n        );\n        process.exit(1);\n      }\n    });\n\n  program\n    .command(\"setup <editor>\")\n    .description(\n      `Wire the q-ring MCP server into an editor's MCP config (${EDITORS.join(\", \")})`,\n    )\n    .option(\"-g, --global\", \"Write the per-user config instead of the project one\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--force\", \"Replace an existing q-ring entry that differs\")\n    .option(\"--dry-run\", \"Show what would change without writing\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((editor: string, cmd) => {\n      if (!EDITORS.includes(editor as Editor)) {\n        console.error(\n          c.red(`${SYMBOLS.cross} Unknown editor \"${editor}\" — expected one of: ${EDITORS.join(\", \")}`),\n        );\n        process.exit(1);\n      }\n\n      try {\n        const result = setupEditor({\n          editor: editor as Editor,\n          global: cmd.global === true,\n          projectPath: cmd.projectPath ?? process.cwd(),\n          force: cmd.force === true,\n          dryRun: cmd.dryRun === true,\n        });\n\n        if (wantsJsonOutput(program, cmd)) {\n          console.log(JSON.stringify(result, null, 2));\n          return;\n        }\n\n        const verb =\n          result.action === \"created\" ? \"Created\" :\n          result.action === \"updated\" ? \"Updated\" : \"Already configured\";\n        const prefix = result.dryRun ? c.dim(\"[dry-run] \") : \"\";\n        console.log(\n          `\\n${SYMBOLS.check} ${prefix}${c.bold(verb)}: ${c.cyan(result.configPath)} ${c.dim(`(server \"${result.serverName}\")`)}`,\n        );\n        for (const warning of result.warnings) {\n          console.log(`  ${c.yellow(\"!\")} ${warning}`);\n        }\n        if (result.action !== \"unchanged\") {\n          console.log(c.dim(`  Restart ${editor} to pick up the MCP server. Verify with: qring doctor`));\n        }\n      } catch (err) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Setup failed: ${err instanceof Error ? err.message : String(err)}`,\n          ),\n        );\n        process.exit(1);\n      }\n    });\n}\n","/**\n * Canary honeytokens.\n *\n * A canary is a fake credential planted in the ring. It stores and reads like\n * any other secret — that is the point: an agent, a compromised MCP server, or\n * exfiltrated tooling that sweeps the ring cannot tell it apart. The moment\n * anything reads it, the trip hook in keyring.ts fires a \"canary\" audit event\n * and a loud desktop alert (see canary-alert.ts).\n *\n * Values imitate real provider token shapes so they survive casual inspection\n * and secret-scanners' entropy heuristics. They are pure CSPRNG noise — never\n * valid credentials.\n */\n\nimport { randomInt } from \"node:crypto\";\nimport { generateSecret } from \"./noise.js\";\nimport {\n  setSecret,\n  listSecrets,\n  getEnvelope,\n  disarmCanary as clearCanaryFlag,\n  type KeyringOptions,\n} from \"./keyring.js\";\nimport type { Scope } from \"./scope.js\";\n\nexport interface CanaryFormat {\n  /** Provider name shown in `canary list` */\n  name: string;\n  description: string;\n  generate(): string;\n}\n\nconst ALNUM = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\";\nconst UPPER_NUM = \"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\";\nconst BASE64 = ALNUM + \"+/\";\nconst URLSAFE = ALNUM + \"_-\";\nconst DIGITS = \"0123456789\";\n\nfunction pick(charset: string, length: number): string {\n  let out = \"\";\n  for (let i = 0; i < length; i++) out += charset[randomInt(charset.length)];\n  return out;\n}\n\n/**\n * Token shapes per provider. Prefixes match the liveness-provider registry in\n * validate.ts so a canary auto-detects like the real thing; body length and\n * charset track each issuer's current format closely enough to pass shape\n * checks and secret-scanner heuristics (the AWS body satisfies validate.ts's\n * /^(AKIA|ASIA)[A-Z0-9]{16}$/). Every value is CSPRNG noise — never valid.\n */\nexport const CANARY_FORMATS: Record<string, CanaryFormat> = {\n  aws: {\n    name: \"aws\",\n    description: \"AWS access key id (AKIA…)\",\n    generate: () => `AKIA${pick(UPPER_NUM, 16)}`,\n  },\n  \"aws-secret\": {\n    name: \"aws-secret\",\n    description: \"AWS secret access key (40-char base64)\",\n    generate: () => pick(BASE64, 40),\n  },\n  github: {\n    name: \"github\",\n    description: \"GitHub classic personal access token (ghp_…)\",\n    generate: () => `ghp_${pick(ALNUM, 36)}`,\n  },\n  \"github-pat\": {\n    name: \"github-pat\",\n    description: \"GitHub fine-grained personal access token (github_pat_…)\",\n    generate: () => `github_pat_${pick(ALNUM, 22)}_${pick(ALNUM, 59)}`,\n  },\n  openai: {\n    name: \"openai\",\n    description: \"OpenAI API key (sk-…)\",\n    generate: () => `sk-${pick(ALNUM, 48)}`,\n  },\n  \"openai-project\": {\n    name: \"openai-project\",\n    description: \"OpenAI project API key (sk-proj-…)\",\n    generate: () => `sk-proj-${pick(URLSAFE, 74)}T3BlbkFJ${pick(URLSAFE, 74)}`,\n  },\n  anthropic: {\n    name: \"anthropic\",\n    description: \"Anthropic API key (sk-ant-api03-…)\",\n    generate: () => `sk-ant-api03-${pick(URLSAFE, 91)}AA`,\n  },\n  stripe: {\n    name: \"stripe\",\n    description: \"Stripe live secret key (sk_live_…)\",\n    generate: () => `sk_live_${pick(ALNUM, 24)}`,\n  },\n  gitlab: {\n    name: \"gitlab\",\n    description: \"GitLab personal access token (glpat-…)\",\n    generate: () => `glpat-${pick(URLSAFE, 20)}`,\n  },\n  slack: {\n    name: \"slack\",\n    description: \"Slack bot token (xoxb-…)\",\n    generate: () => `xoxb-${pick(DIGITS, 12)}-${pick(DIGITS, 13)}-${pick(ALNUM, 24)}`,\n  },\n  google: {\n    name: \"google\",\n    description: \"Google API key (AIza…)\",\n    generate: () => `AIza${pick(URLSAFE, 35)}`,\n  },\n  npm: {\n    name: \"npm\",\n    description: \"npm access token (npm_…)\",\n    generate: () => `npm_${pick(ALNUM, 36)}`,\n  },\n  generic: {\n    name: \"generic\",\n    description: \"Generic high-entropy API key\",\n    generate: () => generateSecret({ format: \"api-key\", prefix: \"qk_\", length: 40 }),\n  },\n};\n\nexport const DEFAULT_CANARY_FORMAT = \"generic\";\n\nexport interface PlantResult {\n  key: string;\n  value: string;\n  format: string;\n  scope: Scope;\n}\n\nexport interface PlantOptions extends KeyringOptions {\n  /** Which provider's token shape to imitate (default \"generic\") */\n  format?: string;\n  /** Use this exact value instead of generating one */\n  value?: string;\n  /**\n   * Optional cover description. Deliberately NOT auto-filled: a description\n   * like \"Canary honeytoken\" is readable via inspect_secret and would let an\n   * attacker enumerate the tripwires without touching them. No description\n   * (or an operator-chosen innocuous one) leaves no tell.\n   */\n  description?: string;\n  /** Allow replacing an existing NON-canary secret at this key */\n  force?: boolean;\n}\n\n/**\n * Plant a canary honeytoken under `key`. Refuses to overwrite an existing\n * real (non-canary) secret in the target scope unless `force` is set — the\n * guard lives here, not in the CLI, so no programmatic caller can clobber a\n * real credential by accident. Replanting over an existing canary is always\n * allowed.\n */\nexport function plantCanary(key: string, opts: PlantOptions = {}): PlantResult {\n  const formatName = opts.format ?? DEFAULT_CANARY_FORMAT;\n  const format = CANARY_FORMATS[formatName];\n  if (!format) {\n    throw new Error(\n      `Unknown canary format \"${formatName}\". Available: ${Object.keys(CANARY_FORMATS).join(\", \")}`,\n    );\n  }\n\n  const value = opts.value ?? format.generate();\n  const scope = opts.scope ?? \"global\";\n\n  // Check the exact scope this plant will write to (not the whole resolution\n  // chain — a project-scope real secret must not block a global plant).\n  const existing = getEnvelope(key, { ...opts, scope });\n  if (existing && !existing.envelope.meta.canary && !opts.force) {\n    throw new Error(\n      `\"${key}\" already holds a real secret in ${scope} scope. Use --force to replace it with a canary.`,\n    );\n  }\n  setSecret(key, value, {\n    ...opts,\n    scope,\n    canary: true,\n    canaryFormat: formatName,\n    description: opts.description,\n  });\n\n  return { key, value, format: formatName, scope };\n}\n\nexport interface CanaryStatus {\n  key: string;\n  scope: Scope;\n  format?: string;\n  plantedAt: string;\n  /** Reads recorded on the envelope — every one of these was an alert */\n  tripCount: number;\n  lastTrippedAt?: string;\n}\n\n/**\n * Disarm a canary: clears the flag so reads stop alarming. The stored value\n * stays fake until overwritten. Returns false if the key exists but is not\n * a canary; throws if the key doesn't exist at all.\n */\nexport function disarmCanary(key: string, opts: KeyringOptions = {}): boolean {\n  const found = getEnvelope(key, opts);\n  if (!found) {\n    throw new Error(`\"${key}\" not found in any applicable scope`);\n  }\n  return clearCanaryFlag(key, { ...opts, scope: found.scope });\n}\n\n/** List all planted canaries across resolvable scopes, with trip stats. */\nexport function listCanaries(opts: KeyringOptions = {}): CanaryStatus[] {\n  const out: CanaryStatus[] = [];\n  for (const entry of listSecrets({ ...opts, silent: true })) {\n    const meta = entry.envelope?.meta;\n    if (!meta?.canary) continue;\n    out.push({\n      key: entry.key,\n      scope: entry.scope,\n      format: meta.canaryFormat,\n      plantedAt: meta.createdAt,\n      tripCount: meta.accessCount,\n      lastTrippedAt: meta.lastAccessedAt,\n    });\n  }\n  return out;\n}\n","import type { Command } from \"commander\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { buildOpts } from \"../options.js\";\nimport { emitJson } from \"../helpers.js\";\nimport {\n  plantCanary,\n  disarmCanary,\n  listCanaries,\n  CANARY_FORMATS,\n  DEFAULT_CANARY_FORMAT,\n} from \"../../core/canary.js\";\nimport { pushSecrets, PUSH_TARGETS, type PushTarget } from \"../../core/push.js\";\nimport {\n  addCanaryAlert,\n  listCanaryAlerts,\n  removeCanaryAlert,\n  setCanaryAlertEnabled,\n  sendCanaryAlerts,\n  describeAlertUrl,\n  type CanaryAlertType,\n} from \"../../core/canary-webhooks.js\";\n\nexport function registerCanaryCommands(program: Command): void {\n  const canary = program\n    .command(\"canary\")\n    .description(\"Honeytokens — fake credentials that raise the alarm on read\");\n\n  canary\n    .command(\"plant <key>\")\n    .description(\"Plant a fake credential; any read fires a loud alert\")\n    .option(\n      \"-f, --format <format>\",\n      `Token shape to imitate (${Object.keys(CANARY_FORMATS).join(\", \")})`,\n      DEFAULT_CANARY_FORMAT,\n    )\n    .option(\"--value <value>\", \"Plant this exact value instead of generating one\")\n    .option(\"--description <text>\", \"Cover description (none by default — no tell)\")\n    .option(\"--force\", \"Overwrite an existing non-canary secret at this key\")\n    .option(\n      \"--push <target>\",\n      `Also push the planted value to a deployment platform (${PUSH_TARGETS.join(\", \")}) so a leaked CI/deploy environment carries a tripwire`,\n    )\n    .option(\"--repo <owner/name>\", \"GitHub repository (with --push github)\")\n    .option(\"--vercel-env <envs>\", \"Comma-separated Vercel environments (with --push vercel)\")\n    .option(\"--json\", \"Output the plant result as JSON\")\n    .option(\"-g, --global\", \"Global scope (default)\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--team <id>\", \"Team scope\")\n    .option(\"--org <id>\", \"Org scope\")\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .action((key: string, cmd) => {\n      const pushTarget = cmd.push as string | undefined;\n      if (pushTarget && !PUSH_TARGETS.includes(pushTarget as PushTarget)) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Unknown push target \"${pushTarget}\" — expected one of: ${PUSH_TARGETS.join(\", \")}`,\n          ),\n        );\n        process.exit(1);\n      }\n\n      const opts = buildOpts(cmd);\n      const result = plantCanary(key, {\n        ...opts,\n        format: cmd.format,\n        value: cmd.value,\n        description: cmd.description,\n        force: cmd.force === true,\n      });\n\n      // Push the value we just generated — reading it back would trip it.\n      const push = pushTarget\n        ? pushSecrets({\n            target: pushTarget as PushTarget,\n            keys: [key],\n            presetValues: { [key]: result.value },\n            canaryKeys: [key],\n            projectPath: opts.projectPath ?? process.cwd(),\n            repo: cmd.repo,\n            vercelEnvs: cmd.vercelEnv?.split(\",\").map((e: string) => e.trim()),\n            source: \"cli\",\n          })\n        : undefined;\n\n      if (emitJson(program, cmd, { ...result, push })) {\n        if (push && push.failed.length > 0) process.exit(1);\n        return;\n      }\n\n      console.log(\n        `${SYMBOLS.sparkle} ${c.yellow(\"canary planted\")} ${c.bold(result.key)} ${c.dim(`(${result.format}, ${result.scope} scope)`)}`,\n      );\n      console.log(c.dim(`  value: ${result.value}`));\n      console.log(\n        c.dim(\"  Reads return this fake value and fire a desktop alert + a 'canary' audit event.\"),\n      );\n      console.log(c.dim(\"  Watch trips with: qring canary list · qring audit --action canary\"));\n      if (push) {\n        if (push.pushed.length > 0) {\n          console.log(\n            `${SYMBOLS.link} ${c.yellow(\"pushed\")} ${c.bold(key)} ${c.dim(`to ${push.target}${cmd.repo ? ` (${cmd.repo})` : \"\"}`)}`,\n          );\n          console.log(\n            c.dim(\n              \"  Caveat: q-ring only sees reads that go through q-ring. Someone using the leaked value on the platform side is not observable here — pair it with the provider's own alerting if you need that.\",\n            ),\n          );\n        }\n        for (const { error } of push.failed) {\n          console.error(c.red(`${SYMBOLS.cross} push to ${push.target} failed — ${error}`));\n        }\n        if (push.failed.length > 0) process.exit(1);\n      }\n    });\n\n  canary\n    .command(\"disarm <key>\")\n    .description(\"Clear the canary flag so reads stop alarming (value stays fake)\")\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--team <id>\", \"Team scope\")\n    .option(\"--org <id>\", \"Org scope\")\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .action((key: string, cmd) => {\n      if (disarmCanary(key, buildOpts(cmd))) {\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"disarmed\")} ${c.bold(key)} ${c.dim(\"— now an ordinary secret; the stored value is still fake until you overwrite it\")}`,\n        );\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} \"${key}\" is not a canary`));\n        process.exit(1);\n      }\n    });\n\n  canary\n    .command(\"list\")\n    .alias(\"ls\")\n    .description(\"List planted canaries and their trip counts\")\n    .option(\"--json\", \"Output as JSON\")\n    .option(\"-g, --global\", \"Global scope only\")\n    .option(\"-p, --project\", \"Project scope only\")\n    .option(\"--team <id>\", \"Team scope\")\n    .option(\"--org <id>\", \"Org scope\")\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .action((cmd) => {\n      const canaries = listCanaries(buildOpts(cmd));\n      if (emitJson(program, cmd, { canaries })) return;\n\n      if (canaries.length === 0) {\n        console.log(\n          c.dim(\n            \"No canaries planted. Plant one: qring canary plant AWS_SECRET_ACCESS_KEY --format aws\",\n          ),\n        );\n        return;\n      }\n\n      console.log(c.bold(`\\n  ${SYMBOLS.eye} Canaries (${canaries.length})\\n`));\n      for (const entry of canaries) {\n        const parts = [c.bold(entry.key)];\n        parts.push(c.dim(`${entry.format ?? \"generic\"} · ${entry.scope}`));\n        if (entry.tripCount > 0) {\n          parts.push(c.red(`trips: ${entry.tripCount}`));\n          if (entry.lastTrippedAt) {\n            parts.push(c.red(`last: ${entry.lastTrippedAt}`));\n          }\n        } else {\n          parts.push(c.green(\"no trips\"));\n        }\n        console.log(`  ${SYMBOLS.eye} ${parts.join(\"  \")}`);\n      }\n      console.log();\n    });\n\n  const alert = canary\n    .command(\"alert\")\n    .description(\"Webhook channels that receive canary trips (Discord, Slack, ntfy, generic JSON)\");\n\n  alert\n    .command(\"add\")\n    .description(\"Register a webhook channel for canary trips\")\n    .option(\"--discord <url>\", \"Discord webhook URL\")\n    .option(\"--slack <url>\", \"Slack incoming-webhook URL\")\n    .option(\"--ntfy <url>\", \"ntfy topic URL (e.g. https://ntfy.sh/my-topic)\")\n    .option(\"--url <url>\", \"Generic endpoint — receives a JSON POST\")\n    .option(\"--description <text>\", \"Human-readable label\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const picked: [CanaryAlertType, string | undefined][] = [\n        [\"discord\", cmd.discord],\n        [\"slack\", cmd.slack],\n        [\"ntfy\", cmd.ntfy],\n        [\"generic\", cmd.url],\n      ];\n      const chosen = picked.filter(([, url]) => typeof url === \"string\");\n      if (chosen.length !== 1) {\n        console.error(\n          c.red(`${SYMBOLS.cross} Specify exactly one of --discord, --slack, --ntfy, or --url`),\n        );\n        process.exit(1);\n      }\n      const [type, url] = chosen[0];\n      const channel = addCanaryAlert({ type, url: url!, description: cmd.description });\n      if (emitJson(program, cmd, channel)) return;\n      console.log(\n        `${SYMBOLS.check} ${c.green(\"registered\")} canary alert ${c.bold(channel.id)} (${type}) ${c.dim(describeAlertUrl(channel.url))}`,\n      );\n      console.log(c.dim(`  Send a drill: qring canary alert test ${channel.id}`));\n    });\n\n  alert\n    .command(\"list\")\n    .alias(\"ls\")\n    .description(\"List canary alert channels\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const channels = listCanaryAlerts();\n      if (emitJson(program, cmd, { channels })) return;\n      if (channels.length === 0) {\n        console.log(\n          c.dim(\"No alert channels. Add one: qring canary alert add --discord <webhook-url>\"),\n        );\n        return;\n      }\n      console.log(c.bold(`\\n  ${SYMBOLS.eye} Canary alert channels (${channels.length})\\n`));\n      for (const ch of channels) {\n        const state = ch.enabled ? c.green(\"enabled\") : c.dim(\"disabled\");\n        const desc = ch.description ? c.dim(` — ${ch.description}`) : \"\";\n        console.log(\n          `  ${c.bold(ch.id)}  ${ch.type.padEnd(7)} ${state}  ${c.dim(describeAlertUrl(ch.url))}${desc}`,\n        );\n      }\n      console.log();\n    });\n\n  alert\n    .command(\"remove <id>\")\n    .alias(\"rm\")\n    .description(\"Remove an alert channel\")\n    .action((id: string) => {\n      if (removeCanaryAlert(id)) {\n        console.log(`${SYMBOLS.check} ${c.green(\"removed\")} canary alert ${c.bold(id)}`);\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} No alert channel with id \"${id}\"`));\n        process.exit(1);\n      }\n    });\n\n  for (const [verb, enabled] of [\n    [\"enable\", true],\n    [\"disable\", false],\n  ] as const) {\n    alert\n      .command(`${verb} <id>`)\n      .description(`${verb === \"enable\" ? \"Enable\" : \"Disable\"} an alert channel`)\n      .action((id: string) => {\n        if (setCanaryAlertEnabled(id, enabled)) {\n          console.log(`${SYMBOLS.check} ${c.green(`${verb}d`)} canary alert ${c.bold(id)}`);\n        } else {\n          console.error(c.red(`${SYMBOLS.cross} No alert channel with id \"${id}\"`));\n          process.exit(1);\n        }\n      });\n  }\n\n  alert\n    .command(\"test [id]\")\n    .description(\"Send a clearly-labelled test message to every enabled channel (or one id)\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (id: string | undefined, cmd) => {\n      const results = await sendCanaryAlerts(\n        {\n          key: \"EXAMPLE_CANARY\",\n          scope: \"global\",\n          source: \"cli\",\n          agent: null,\n          detail: \"test message\",\n          timestamp: new Date().toISOString(),\n          test: true,\n        },\n        id,\n      );\n      if (emitJson(program, cmd, { results })) return;\n      if (results.length === 0) {\n        console.log(c.dim(id ? `No channel with id \"${id}\"` : \"No enabled alert channels\"));\n        process.exit(1);\n      }\n      for (const r of results) {\n        const mark = r.success ? c.green(SYMBOLS.check) : c.red(SYMBOLS.cross);\n        console.log(`  ${mark} ${c.bold(r.channelId)} ${r.type} ${c.dim(r.message)}`);\n      }\n      if (results.some((r) => !r.success)) process.exit(1);\n    });\n}\n","/**\n * MCP Airlock: `qring mcp wrap -- <server command>` / `qring mcp wrap --url`.\n *\n * Runs a third-party MCP server (a child process, or a remote Streamable\n * HTTP endpoint) and re-exposes it over stdio, sitting between the agent\n * host and the wrapped server:\n *\n *   agent host ── stdio ── [q-ring airlock] ── stdio | http ── wrapped server\n *\n * What the airlock adds:\n *\n * - Environment stripping: a spawned server gets the SDK's minimal safe\n *   environment, NOT the parent env — it can't read API keys out of\n *   `process.env` unless `--inherit-env` is passed. Hygiene, not a sandbox:\n *   the child still runs unconfined as the operator's user.\n * - A tamper-evident audit trail: every tool call, resource read, and prompt\n *   fetch crossing the airlock lands in the audit chain as a \"wrap\" action,\n *   grouped by a per-session correlation id and stamped with the connecting\n *   client's identity label. Tool ARGUMENTS and prompt arguments are\n *   deliberately not logged — they may contain secrets.\n * - Wrap policy (`.q-ring.json` → `policy.wrap`): per-tool allow/deny globs,\n *   tools that need a live `qring mcp approve` grant, and sliding-window rate\n *   limits. Denied tools are hidden from tools/list and refused on call.\n * - Result redaction: known secret values are scrubbed from tool results,\n *   resource contents, and prompt messages before they reach the transcript\n *   (see wrap-redact.ts). Policy `wrap.redactResults: false` or\n *   `--no-redact` turns it off.\n *\n * The proxy aims to be transparent to both sides: tools, resources, and\n * prompts forward verbatim (pagination, list_changed / updated notifications,\n * subscriptions included), progress notifications are relayed under the\n * host's own progress token, downstream protocol errors stay JSON-RPC\n * errors, and tool-execution failures surface as isError results. stdout is\n * the protocol channel — all diagnostics go to stderr.\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StdioClientTransport } from \"@modelcontextprotocol/sdk/client/stdio.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport {\n  ListToolsRequestSchema,\n  CallToolRequestSchema,\n  ToolListChangedNotificationSchema,\n  ListResourcesRequestSchema,\n  ListResourceTemplatesRequestSchema,\n  ReadResourceRequestSchema,\n  SubscribeRequestSchema,\n  UnsubscribeRequestSchema,\n  ResourceListChangedNotificationSchema,\n  ResourceUpdatedNotificationSchema,\n  ListPromptsRequestSchema,\n  GetPromptRequestSchema,\n  PromptListChangedNotificationSchema,\n  McpError,\n  type CallToolResult,\n  type ServerCapabilities,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { PACKAGE_VERSION } from \"../version.js\";\nimport { logAudit, setAuditAgentLabel } from \"./observer.js\";\nimport {\n  checkWrapToolPolicy,\n  wrapToolRequiresApproval,\n  getWrapRateLimit,\n  wrapRedactsResults,\n  setPolicyRoot,\n  type WrapRateLimit,\n} from \"./policy.js\";\nimport { hasApproval } from \"./approval.js\";\nimport { getSecret } from \"./keyring.js\";\nimport { hashProjectPath } from \"../utils/hash.js\";\nimport { createRedactor, NOOP_REDACTOR, type Redactor } from \"./wrap-redact.js\";\n\n/**\n * Ceiling on a single downstream tool call. Deliberately generous: the HOST\n * owns call deadlines (its cancellation propagates through the airlock), and\n * `resetTimeoutOnProgress` keeps actively-reporting tools alive — this only\n * reaps calls that are silent for the whole window. Override with\n * QRING_WRAP_TIMEOUT_MS.\n */\nconst DEFAULT_DOWNSTREAM_TIMEOUT_MS = 10 * 60 * 1000;\n\nfunction downstreamTimeoutMs(): number {\n  const raw = Number(process.env.QRING_WRAP_TIMEOUT_MS);\n  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_DOWNSTREAM_TIMEOUT_MS;\n}\n\n/** Approval scope + service used for `qring mcp approve <tool>` grants. */\nexport const WRAP_APPROVAL_SCOPE = \"wrap\";\nexport function wrapApprovalService(projectPath: string): string {\n  return `q-ring:wrap:${hashProjectPath(projectPath)}`;\n}\n\nexport interface WrapOptions {\n  /** Server command to spawn (stdio downstream). Mutually exclusive with url. */\n  command?: string;\n  args?: string[];\n  /** Remote Streamable HTTP MCP endpoint (http downstream). */\n  url?: string;\n  /** Extra request headers for an http downstream, as \"Name: value\". */\n  headers?: string[];\n  /** q-ring key whose value is sent as `Authorization: Bearer …` (http). */\n  authSecret?: string;\n  /** Pass the full parent environment to the wrapped server (default: SDK safe env) */\n  inheritEnv?: boolean;\n  /** Label used in audit events (default: the wrapped command line / url) */\n  label?: string;\n  /** Scrub known secret values from results (default: policy, else on) */\n  redact?: boolean;\n  /** Project whose `.q-ring.json` policy governs the session (default: cwd) */\n  projectPath?: string;\n}\n\nexport interface WrapSession {\n  label: string;\n  correlationId: string;\n}\n\nexport interface AirlockOptions {\n  /** Project used for policy + approval resolution (default: cwd) */\n  projectPath?: string;\n  /** Result redactor (default: none — runWrap wires the real one) */\n  redactor?: Redactor;\n}\n\n/** Sliding-window per-tool call counter. */\nclass RateLimiter {\n  private readonly calls = new Map<string, number[]>();\n\n  /** Record a call; returns false when the window is already full. */\n  take(tool: string, limit: WrapRateLimit, now = Date.now()): boolean {\n    const windowStart = now - limit.perSeconds * 1000;\n    const recent = (this.calls.get(tool) ?? []).filter((t) => t > windowStart);\n    if (recent.length >= limit.maxCalls) {\n      this.calls.set(tool, recent);\n      return false;\n    }\n    recent.push(now);\n    this.calls.set(tool, recent);\n    return true;\n  }\n}\n\nfunction truncate(s: string, max = 200): string {\n  return s.length > max ? `${s.slice(0, max)}…` : s;\n}\n\n/**\n * Build the airlock proxy server around an already-connected downstream\n * client. Exported separately so tests can drive it over in-memory\n * transports without spawning processes.\n */\nexport function createAirlockServer(\n  downstream: Client,\n  session: WrapSession,\n  options: AirlockOptions = {},\n): Server {\n  const projectPath = options.projectPath ?? process.cwd();\n  const redactor = options.redactor ?? NOOP_REDACTOR;\n  const approvalService = wrapApprovalService(projectPath);\n  const limiter = new RateLimiter();\n\n  const downstreamInfo = downstream.getServerVersion();\n  const dsCaps = downstream.getServerCapabilities() ?? {};\n  const name = downstreamInfo ? `${downstreamInfo.name} (q-ring airlock)` : \"q-ring-airlock\";\n\n  // Advertise exactly what the wrapped server can do — a host that sees a\n  // resources capability and gets \"method not found\" would mark us broken.\n  const capabilities: ServerCapabilities = {};\n  if (dsCaps.tools) capabilities.tools = { listChanged: true };\n  if (dsCaps.resources) {\n    capabilities.resources = { listChanged: true, subscribe: !!dsCaps.resources.subscribe };\n  }\n  if (dsCaps.prompts) capabilities.prompts = { listChanged: true };\n\n  const proxy = new Server(\n    { name, version: PACKAGE_VERSION },\n    {\n      capabilities,\n      // Servers ship usage guidance in `instructions`; hosts inject it into\n      // the system prompt. Losing it would degrade the wrapped server.\n      instructions: downstream.getInstructions(),\n    },\n  );\n\n  // Feature synergy with per-agent identity: the agent host's clientInfo\n  // from OUR initialize handshake labels every audited call. Spoofable —\n  // audit metadata only, never authorization.\n  proxy.oninitialized = () => {\n    const info = proxy.getClientVersion();\n    if (info) setAuditAgentLabel(`${info.name}@${info.version}`);\n  };\n\n  const audit = (detail: string, action: \"wrap\" | \"policy_deny\" = \"wrap\") =>\n    logAudit({ action, source: \"mcp\", detail, correlationId: session.correlationId });\n\n  const denied = (toolName: string, reason: string): CallToolResult => {\n    audit(`airlock blocked \"${toolName}\" → ${session.label}: ${reason}`, \"policy_deny\");\n    return {\n      content: [{ type: \"text\", text: `airlock: policy denied: ${reason}` }],\n      isError: true,\n    };\n  };\n\n  /**\n   * Wrap-policy gate for one tool call. Any policy load failure (an\n   * unparseable `.q-ring.json`) denies — the airlock fails closed like the\n   * rest of the policy engine.\n   */\n  const gate = (toolName: string): CallToolResult | null => {\n    try {\n      const decision = checkWrapToolPolicy(toolName, projectPath);\n      if (!decision.allowed) return denied(toolName, decision.reason ?? \"denied by policy\");\n      if (\n        wrapToolRequiresApproval(toolName, projectPath) &&\n        !hasApproval(toolName, WRAP_APPROVAL_SCOPE, approvalService)\n      ) {\n        return denied(\n          toolName,\n          `wrapped tool \"${toolName}\" requires operator approval — run: qring mcp approve ${toolName} --for 3600 --reason \"<why>\"`,\n        );\n      }\n      const limit = getWrapRateLimit(toolName, projectPath);\n      if (limit && !limiter.take(toolName, limit)) {\n        return denied(\n          toolName,\n          `rate limit exceeded for \"${toolName}\" (${limit.maxCalls} calls per ${limit.perSeconds}s)`,\n        );\n      }\n      return null;\n    } catch (err) {\n      return denied(toolName, err instanceof Error ? err.message : String(err));\n    }\n  };\n\n  const toolAllowed = (toolName: string): boolean => {\n    try {\n      return checkWrapToolPolicy(toolName, projectPath).allowed;\n    } catch {\n      return false;\n    }\n  };\n\n  // ── Tools ──────────────────────────────────────────────────────────────\n\n  // Handlers are registered per capability: the SDK refuses a handler for a\n  // capability the server does not advertise, and a host that sees no tools\n  // capability never asks. A tools-less (resources/prompts-only) downstream\n  // is therefore proxied honestly instead of answering an empty list.\n  if (dsCaps.tools) registerToolHandlers();\n  if (dsCaps.resources) registerResourceHandlers();\n  if (dsCaps.prompts) registerPromptHandlers();\n\n  return proxy;\n\n  // ── Tools ──────────────────────────────────────────────────────────────\n\n  function registerToolHandlers(): void {\n    // A dynamic downstream (login-gated or feature-flagged tools) re-lists\n    // after this notification; swallowing it would freeze the host's view.\n    downstream.setNotificationHandler(ToolListChangedNotificationSchema, () => {\n      void proxy.sendToolListChanged().catch(() => {});\n    });\n\n    proxy.setRequestHandler(ListToolsRequestSchema, async (request) => {\n      const listed = await downstream.listTools(request.params);\n      // Hide what policy would refuse anyway — an agent that never sees a\n      // denied tool never wastes a turn on it (and can't enumerate the gate).\n      return { ...listed, tools: listed.tools.filter((t) => toolAllowed(t.name)) };\n    });\n\n    proxy.setRequestHandler(CallToolRequestSchema, async (request, extra) => {\n      const toolName = request.params.name;\n      const blocked = gate(toolName);\n      if (blocked) return blocked;\n\n      audit(`tool call \"${toolName}\" → ${session.label}`);\n\n      // Relay progress under the host's own token. When we pass `onprogress`,\n      // the SDK swaps in its own token on the downstream request, so the\n      // host's token never collides with airlock message ids.\n      const hostToken = request.params._meta?.progressToken;\n      const onprogress =\n        hostToken !== undefined\n          ? (progress: { progress: number; total?: number; message?: string }) => {\n              void extra\n                .sendNotification({\n                  method: \"notifications/progress\",\n                  params: { ...progress, progressToken: hostToken },\n                })\n                .catch(() => {});\n            }\n          : undefined;\n\n      try {\n        const result = (await downstream.callTool(request.params, undefined, {\n          signal: extra.signal,\n          timeout: downstreamTimeoutMs(),\n          resetTimeoutOnProgress: true,\n          onprogress,\n        })) as CallToolResult;\n        return redactor.result(result);\n      } catch (err) {\n        // Protocol errors (unknown tool, timeout, connection closed) must stay\n        // JSON-RPC errors — the spec separates them from tool-execution\n        // failures, and hosts use the distinction (e.g. to refresh tool lists).\n        if (err instanceof McpError) throw err;\n        const message = err instanceof Error ? err.message : String(err);\n        audit(`tool call \"${toolName}\" failed: ${message}`);\n        return {\n          content: [{ type: \"text\", text: `airlock: downstream error: ${message}` }],\n          isError: true,\n        } satisfies CallToolResult;\n      }\n    });\n  }\n\n  // ── Resources ──────────────────────────────────────────────────────────\n\n  function registerResourceHandlers(): void {\n    downstream.setNotificationHandler(ResourceListChangedNotificationSchema, () => {\n      void proxy.sendResourceListChanged().catch(() => {});\n    });\n    downstream.setNotificationHandler(ResourceUpdatedNotificationSchema, (n) => {\n      void proxy.sendResourceUpdated(n.params).catch(() => {});\n    });\n\n    proxy.setRequestHandler(ListResourcesRequestSchema, (request) =>\n      downstream.listResources(request.params),\n    );\n    proxy.setRequestHandler(ListResourceTemplatesRequestSchema, (request) =>\n      downstream.listResourceTemplates(request.params),\n    );\n    proxy.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => {\n      // URIs are identifiers, not payloads — logged (bounded) so the trail\n      // says what was fetched, unlike tool arguments.\n      audit(`resource read ${truncate(request.params.uri)} → ${session.label}`);\n      const result = await downstream.readResource(request.params, {\n        signal: extra.signal,\n        timeout: downstreamTimeoutMs(),\n      });\n      return redactor.result(result);\n    });\n    if (dsCaps.resources?.subscribe) {\n      proxy.setRequestHandler(SubscribeRequestSchema, (request) =>\n        downstream.subscribeResource(request.params),\n      );\n      proxy.setRequestHandler(UnsubscribeRequestSchema, (request) =>\n        downstream.unsubscribeResource(request.params),\n      );\n    }\n  }\n\n  // ── Prompts ────────────────────────────────────────────────────────────\n\n  function registerPromptHandlers(): void {\n    downstream.setNotificationHandler(PromptListChangedNotificationSchema, () => {\n      void proxy.sendPromptListChanged().catch(() => {});\n    });\n    proxy.setRequestHandler(ListPromptsRequestSchema, (request) =>\n      downstream.listPrompts(request.params),\n    );\n    proxy.setRequestHandler(GetPromptRequestSchema, async (request, extra) => {\n      // Prompt arguments are user content — never logged, like tool args.\n      audit(`prompt get \"${request.params.name}\" → ${session.label}`);\n      const result = await downstream.getPrompt(request.params, {\n        signal: extra.signal,\n        timeout: downstreamTimeoutMs(),\n      });\n      return redactor.result(result);\n    });\n  }\n}\n\nfunction parseHeaders(raw: string[] | undefined): Record<string, string> {\n  const headers: Record<string, string> = {};\n  for (const line of raw ?? []) {\n    const idx = line.indexOf(\":\");\n    if (idx <= 0) throw new Error(`--header expects \"Name: value\", got \"${line}\"`);\n    headers[line.slice(0, idx).trim()] = line.slice(idx + 1).trim();\n  }\n  return headers;\n}\n\n/** Connect to the wrapped server: spawn it (stdio) or dial it (http). */\nexport async function connectDownstream(opts: WrapOptions): Promise<Client> {\n  const client = new Client({ name: \"q-ring-airlock\", version: PACKAGE_VERSION });\n\n  if (opts.url) {\n    const headers = parseHeaders(opts.headers);\n    if (opts.authSecret) {\n      // An audited, non-silent read: the airlock deliberately consumed this\n      // credential to reach the wrapped server.\n      const value = getSecret(opts.authSecret, { projectPath: opts.projectPath, source: \"cli\" });\n      if (value === null) {\n        throw new Error(`--auth-secret: \"${opts.authSecret}\" not found in the keyring`);\n      }\n      headers.Authorization = `Bearer ${value}`;\n    }\n    const transport = new StreamableHTTPClientTransport(new URL(opts.url), {\n      requestInit: { headers },\n    });\n    await client.connect(transport);\n    return client;\n  }\n\n  if (!opts.command) throw new Error(\"wrap needs a server command or --url\");\n\n  const env = opts.inheritEnv\n    ? (Object.fromEntries(Object.entries(process.env).filter(([, v]) => v !== undefined)) as Record<\n        string,\n        string\n      >)\n    : undefined; // SDK default: getDefaultEnvironment(), the minimal safe set\n\n  const transport = new StdioClientTransport({\n    command: opts.command,\n    args: opts.args ?? [],\n    env,\n    stderr: \"inherit\",\n  });\n\n  await client.connect(transport);\n  return client;\n}\n\n/**\n * Run the airlock until either side disconnects. Resolves with the exit code\n * the CLI should use: 0 when the host closed the session, 1 when the wrapped\n * server died underneath it. Close is awaited (bounded) before resolving so\n * the SDK's staged child shutdown (stdin end → SIGTERM → SIGKILL) actually\n * runs — otherwise `process.exit` in the CLI orphans children that ignore\n * stdin EOF.\n */\nexport async function runWrap(opts: WrapOptions): Promise<number> {\n  const projectPath = opts.projectPath ?? process.cwd();\n  // Anchor policy like the MCP server does: the operator's launch directory\n  // governs the session, never anything the wrapped server or host says.\n  setPolicyRoot(projectPath);\n\n  const label = opts.label ?? opts.url ?? [opts.command, ...(opts.args ?? [])].join(\" \");\n  const session: WrapSession = { label, correlationId: randomUUID() };\n\n  const downstream = await connectDownstream(opts);\n  const downstreamInfo = downstream.getServerVersion();\n  const caps = downstream.getServerCapabilities() ?? {};\n  const surfaces = ([\"tools\", \"resources\", \"prompts\"] as const).filter((c) => caps[c]);\n\n  if (surfaces.length === 0) {\n    await downstream.close().catch(() => {});\n    throw new Error(\n      `wrapped server \"${downstreamInfo?.name ?? label}\" exposes no tools, resources, or prompts — nothing to proxy`,\n    );\n  }\n\n  const redact = opts.redact ?? wrapRedactsResults(projectPath);\n  const redactor = redact ? createRedactor({ projectPath }) : NOOP_REDACTOR;\n  const envNote = opts.url ? \"remote (http)\" : opts.inheritEnv ? \"inherited\" : \"stripped\";\n\n  logAudit({\n    action: \"wrap\",\n    source: \"cli\",\n    detail: `airlock session started: ${label} (env ${envNote}; ${surfaces.join(\"+\")}; results ${redact ? \"redacted\" : \"unredacted\"})`,\n    correlationId: session.correlationId,\n  });\n  console.error(\n    `q-ring airlock: wrapping ${downstreamInfo?.name ?? label} — env ${envNote}, ${surfaces.join(\"/\")} audited, results ${redact ? \"redacted\" : \"NOT redacted\"} (session ${session.correlationId.slice(0, 8)})`,\n  );\n\n  const proxy = createAirlockServer(downstream, session, { projectPath, redactor });\n  const transport = new StdioServerTransport();\n\n  return new Promise<number>((resolve) => {\n    let settled = false;\n    const finish = (code: number, reason: string) => {\n      if (settled) return;\n      settled = true;\n      logAudit({\n        action: \"wrap\",\n        source: \"cli\",\n        detail: `airlock session ended: ${reason}`,\n        correlationId: session.correlationId,\n      });\n      // Bounded graceful close: give StdioClientTransport its full\n      // stdin-EOF → SIGTERM → SIGKILL escalation before the CLI exits.\n      const closes = Promise.allSettled([proxy.close(), downstream.close()]);\n      const deadline = new Promise<void>((r) => setTimeout(r, 6000).unref());\n      void Promise.race([closes, deadline]).then(() => resolve(code));\n    };\n\n    downstream.onclose = () => finish(1, \"wrapped server exited\");\n    // Use the protocol-level callback — Protocol.connect documents that it\n    // takes ownership of transport callbacks, so don't rely on pre-set\n    // transport.onclose surviving an SDK upgrade.\n    proxy.onclose = () => finish(0, \"host disconnected\");\n    // Transport errors are per-message (e.g. one unparseable stdin line) —\n    // SDK convention is log-and-continue, never session teardown.\n    proxy.onerror = (err) => {\n      console.error(`q-ring airlock: transport error: ${err.message}`);\n    };\n    // StdioServerTransport never watches stdin 'end' — its onclose only\n    // fires on an explicit close(). A host hanging up is an EOF on stdin.\n    process.stdin.on(\"end\", () => finish(0, \"host disconnected\"));\n    // A host that vanishes mid-write surfaces as EPIPE on stdout, not as a\n    // transport close — without this handler it crashes the process.\n    process.stdout.on(\"error\", (err: NodeJS.ErrnoException) => {\n      if (err.code === \"EPIPE\") finish(0, \"host disconnected\");\n      else finish(1, `stdout error: ${err.message}`);\n    });\n    // Hosts typically stop stdio servers with SIGTERM; route it through the\n    // same graceful close so the child isn't orphaned.\n    process.once(\"SIGTERM\", () => finish(0, \"terminated\"));\n    process.once(\"SIGINT\", () => finish(0, \"interrupted\"));\n\n    proxy.connect(transport).catch((err: unknown) => {\n      console.error(\n        `q-ring airlock: failed to start: ${err instanceof Error ? err.message : String(err)}`,\n      );\n      finish(1, \"startup failure\");\n    });\n  });\n}\n","/**\n * Airlock result redaction.\n *\n * A wrapped MCP server can return anything in a tool result, resource read,\n * or prompt — including the operator's own secrets if it has them (from its\n * environment, a config file, a scraped page). Those results flow straight\n * into the agent transcript, which is the obvious exfiltration hole in the\n * airlock. This module builds the set of known secret VALUES and scrubs every\n * verbatim occurrence out of results before they leave the airlock.\n *\n * Values are read silently (no audit \"read\", no access counter, no canary\n * trip) with CLI-source semantics, exactly like `qring exec`'s redaction set.\n * The set is rebuilt lazily every REFRESH_MS so rotated secrets are picked up\n * by a long-lived airlock. Same replacement token as exec so redacted output\n * is recognisable everywhere.\n */\n\nimport { listSecrets, getSecret, type KeyringOptions } from \"./keyring.js\";\nimport { checkDecay } from \"./envelope.js\";\n\nexport const REDACTED = \"[QRING:REDACTED]\";\nconst REFRESH_MS = 60 * 1000;\nconst MIN_LENGTH = 6; // shorter values would shred ordinary text\n\nexport interface Redactor {\n  text(input: string): string;\n  /** Scrub a CallToolResult / ReadResourceResult / GetPromptResult in place. */\n  result<T>(payload: T): T;\n  /** Force the value set to rebuild on next use (tests, rotations). */\n  invalidate(): void;\n}\n\n/** Gather every non-expired secret value in the resolvable scopes. */\nexport function collectSecretValues(opts: KeyringOptions = {}): string[] {\n  const values = new Set<string>();\n  for (const entry of listSecrets({ ...opts, source: \"cli\", silent: true })) {\n    if (entry.envelope && checkDecay(entry.envelope).isExpired) continue;\n    const value = getSecret(entry.key, {\n      scope: entry.scope,\n      projectPath: opts.projectPath,\n      env: opts.env,\n      source: \"cli\",\n      silent: true,\n    });\n    if (value && value.length >= MIN_LENGTH) values.add(value);\n  }\n  // Longest first so a value that contains another is scrubbed whole.\n  return [...values].sort((a, b) => b.length - a.length);\n}\n\nfunction scrubUnknown(node: unknown, scrub: (s: string) => string): unknown {\n  if (typeof node === \"string\") return scrub(node);\n  if (Array.isArray(node)) return node.map((n) => scrubUnknown(n, scrub));\n  if (node && typeof node === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(node as Record<string, unknown>)) {\n      // Binary payloads (base64 `blob`/`data`) are not text; leave them alone.\n      out[k] = k === \"blob\" || k === \"data\" ? v : scrubUnknown(v, scrub);\n    }\n    return out;\n  }\n  return node;\n}\n\nexport function createRedactor(opts: KeyringOptions = {}): Redactor {\n  let values: string[] = [];\n  let builtAt = 0;\n\n  const ensure = () => {\n    const now = Date.now();\n    if (now - builtAt < REFRESH_MS) return;\n    try {\n      values = collectSecretValues(opts);\n    } catch {\n      // Keyring unavailable — keep whatever set we had; never block a result.\n    }\n    builtAt = now;\n  };\n\n  const text = (input: string): string => {\n    ensure();\n    let out = input;\n    for (const v of values) {\n      if (out.includes(v)) out = out.split(v).join(REDACTED);\n    }\n    return out;\n  };\n\n  return {\n    text,\n    result: <T>(payload: T): T => scrubUnknown(payload, text) as T,\n    invalidate: () => {\n      builtAt = 0;\n    },\n  };\n}\n\n/** A redactor that changes nothing — for `--no-redact` / policy opt-out. */\nexport const NOOP_REDACTOR: Redactor = {\n  text: (s) => s,\n  result: (p) => p,\n  invalidate: () => {},\n};\n","import type { Command } from \"commander\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { runWrap, WRAP_APPROVAL_SCOPE, wrapApprovalService } from \"../../core/wrap.js\";\nimport { grantApproval, revokeApproval, listApprovals } from \"../../core/approval.js\";\n\nconst collect = (value: string, previous: string[] = []) => [...previous, value];\n\nexport function registerMcpCommands(program: Command): void {\n  const mcp = program\n    .command(\"mcp\")\n    .description(\"MCP airlock — run third-party MCP servers behind q-ring\");\n\n  mcp\n    .command(\"wrap [command...]\")\n    .description(\n      \"Proxy an MCP server through the airlock: spawned with a stripped env (or dialed over HTTP), every tool call / resource read / prompt audited, results scrubbed of known secrets, policy.wrap enforced. Use -- before the server command: qring mcp wrap -- npx some-server\",\n    )\n    .option(\n      \"--url <url>\",\n      \"Wrap a remote Streamable HTTP MCP endpoint instead of spawning a command\",\n    )\n    .option(\n      \"--header <name:value>\",\n      \"Extra request header for --url (repeatable)\",\n      collect,\n      [] as string[],\n    )\n    .option(\n      \"--auth-secret <KEY>\",\n      \"q-ring key whose value is sent as `Authorization: Bearer …` to --url (audited read)\",\n    )\n    .option(\n      \"--inherit-env\",\n      \"Pass the full parent environment to the wrapped server (default: minimal safe env)\",\n    )\n    .option(\"--no-redact\", \"Do not scrub known secret values from results\")\n    .option(\"--label <label>\", \"Session label for audit events (default: the command line / url)\")\n    .option(\n      \"--project-path <path>\",\n      \"Project whose .q-ring.json policy governs the session (default: cwd)\",\n    )\n    .action(async (commandArgs: string[], cmd) => {\n      try {\n        if (!cmd.url && commandArgs.length === 0) {\n          throw new Error(\"give a server command after -- or pass --url\");\n        }\n        const code = await runWrap({\n          command: commandArgs[0],\n          args: commandArgs.slice(1),\n          url: cmd.url,\n          headers: cmd.header,\n          authSecret: cmd.authSecret,\n          inheritEnv: cmd.inheritEnv === true,\n          // commander turns --no-redact into redact:false; undefined → policy decides\n          redact: cmd.redact === false ? false : undefined,\n          label: cmd.label,\n          projectPath: cmd.projectPath,\n        });\n        process.exit(code);\n      } catch (err) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Airlock failed: ${err instanceof Error ? err.message : String(err)}`,\n          ),\n        );\n        process.exit(1);\n      }\n    });\n\n  mcp\n    .command(\"approve <tool>\")\n    .description(\n      \"Grant a time-limited approval for a wrapped tool listed in policy.wrap.approveTools (or revoke it)\",\n    )\n    .option(\"--for <seconds>\", \"Approval lifetime in seconds\", (v) => parseInt(v, 10), 3600)\n    .option(\"--reason <text>\", \"Why this tool is being approved\")\n    .option(\"--revoke\", \"Revoke an existing approval instead\")\n    .option(\"--project-path <path>\", \"Project the airlock runs in (default: cwd)\")\n    .action((tool: string, cmd) => {\n      const projectPath: string = cmd.projectPath ?? process.cwd();\n      const service = wrapApprovalService(projectPath);\n      if (cmd.revoke) {\n        if (revokeApproval(tool, WRAP_APPROVAL_SCOPE, service)) {\n          console.log(\n            `${SYMBOLS.check} ${c.green(\"revoked\")} airlock approval for ${c.bold(tool)}`,\n          );\n        } else {\n          console.error(c.red(`${SYMBOLS.cross} no airlock approval found for \"${tool}\"`));\n          process.exit(1);\n        }\n        return;\n      }\n      const entry = grantApproval(tool, WRAP_APPROVAL_SCOPE, service, cmd.for, {\n        reason: cmd.reason ?? \"manual airlock approval\",\n      });\n      console.log(\n        `${SYMBOLS.check} ${c.green(\"approved\")} wrapped tool ${c.bold(tool)} for ${cmd.for}s`,\n      );\n      console.log(c.dim(`  id=${entry.id} reason=\"${entry.reason}\" expires=${entry.expiresAt}`));\n      console.log(\n        c.dim(\n          \"  Applies to airlocks launched from this project directory (policy.wrap.approveTools).\",\n        ),\n      );\n    });\n\n  mcp\n    .command(\"approvals\")\n    .description(\"List live airlock tool approvals for this project\")\n    .option(\"--project-path <path>\", \"Project the airlock runs in (default: cwd)\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const service = wrapApprovalService(cmd.projectPath ?? process.cwd());\n      const entries = listApprovals().filter(\n        (a) => a.scope === WRAP_APPROVAL_SCOPE && a.service === service,\n      );\n      if (cmd.json) {\n        console.log(JSON.stringify({ approvals: entries }, null, 2));\n        return;\n      }\n      if (entries.length === 0) {\n        console.log(\n          c.dim(\n            'No airlock approvals. Grant one: qring mcp approve <tool> --for 3600 --reason \"…\"',\n          ),\n        );\n        return;\n      }\n      for (const a of entries) {\n        const state = a.tampered\n          ? c.red(\"TAMPERED\")\n          : a.valid\n            ? c.green(\"valid\")\n            : c.yellow(\"expired\");\n        console.log(\n          `  ${SYMBOLS.check} ${c.bold(a.key)}  ${state}  ${c.dim(`expires ${a.expiresAt} · ${a.reason}`)}`,\n        );\n      }\n    });\n}\n","import type { Command } from \"commander\";\nimport { existsSync, readFileSync, writeFileSync, rmSync } from \"node:fs\";\nimport { join, delimiter } from \"node:path\";\nimport { homedir } from \"node:os\";\nimport { verifyAuditChain } from \"../../core/observer.js\";\nimport { getPolicySummary } from \"../../core/policy.js\";\nimport { countLegacyApprovals } from \"../../core/approval.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson } from \"../helpers.js\";\nimport { PACKAGE_VERSION } from \"../../version.js\";\n\ntype CheckStatus = \"ok\" | \"warn\" | \"fail\";\n\ninterface CheckResult {\n  name: string;\n  status: CheckStatus;\n  detail: string;\n}\n\nfunction auditDir(): string {\n  return process.env.QRING_AUDIT_DIR ?? join(homedir(), \".config\", \"q-ring\");\n}\n\nfunction checkNode(): CheckResult {\n  const major = Number(process.versions.node.split(\".\")[0]);\n  return {\n    name: \"node runtime\",\n    status: major >= 18 ? \"ok\" : \"fail\",\n    detail: `v${process.versions.node}${major >= 18 ? \"\" : \" — q-ring requires Node >= 18\"}`,\n  };\n}\n\nasync function checkKeyringBackend(): Promise<CheckResult> {\n  // Probe the OS keychain end-to-end with a dedicated service name so real\n  // secrets and the audit log are never touched. This is the check that\n  // fails on headless Linux without a Secret Service (gnome-keyring, etc.).\n  try {\n    const { Entry } = await import(\"@napi-rs/keyring\");\n    const probe = new Entry(\"q-ring-doctor-probe\", \"PROBE\");\n    probe.setPassword(\"ok\");\n    const read = probe.getPassword();\n    probe.deletePassword();\n    if (read !== \"ok\") {\n      return {\n        name: \"keyring backend\",\n        status: \"fail\",\n        detail: \"probe round-trip returned unexpected value\",\n      };\n    }\n    return {\n      name: \"keyring backend\",\n      status: \"ok\",\n      detail: \"write/read/delete round-trip succeeded\",\n    };\n  } catch (err) {\n    return {\n      name: \"keyring backend\",\n      status: \"fail\",\n      detail: `${err instanceof Error ? err.message : String(err)} — on headless Linux, install and unlock a Secret Service (e.g. gnome-keyring)`,\n    };\n  }\n}\n\nfunction checkAuditLog(): CheckResult {\n  const dir = auditDir();\n  try {\n    const probeFile = join(dir, \".doctor-probe\");\n    writeFileSync(probeFile, \"ok\");\n    rmSync(probeFile);\n  } catch (err) {\n    return {\n      name: \"audit log\",\n      status: \"fail\",\n      detail: `${dir} not writable: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n\n  const chain = verifyAuditChain();\n  if (chain.totalEvents === 0) {\n    return { name: \"audit log\", status: \"ok\", detail: `${dir} writable, no events yet` };\n  }\n  if (!chain.intact) {\n    return {\n      name: \"audit log\",\n      status: \"fail\",\n      detail: `hash chain BROKEN at event #${chain.brokenAt} (${chain.validEvents}/${chain.totalEvents} valid) — see qring audit:verify`,\n    };\n  }\n  return {\n    name: \"audit log\",\n    status: \"ok\",\n    detail: `${dir} writable, chain intact (${chain.totalEvents} events)`,\n  };\n}\n\nfunction checkManifest(projectPath: string): CheckResult {\n  const manifestPath = join(projectPath, \".q-ring.json\");\n  if (!existsSync(manifestPath)) {\n    return {\n      name: \"project manifest\",\n      status: \"warn\",\n      detail: `no .q-ring.json in ${projectPath} (optional — run qring wizard or /qring-setup-project)`,\n    };\n  }\n  try {\n    const config = JSON.parse(readFileSync(manifestPath, \"utf8\"));\n    const declared = Object.keys(config.secrets ?? {}).length;\n    const hasPolicy = !!config.policy;\n    return {\n      name: \"project manifest\",\n      status: \"ok\",\n      detail: `${declared} secret(s) declared${hasPolicy ? \", policy present\" : \"\"}`,\n    };\n  } catch (err) {\n    return {\n      name: \"project manifest\",\n      status: \"fail\",\n      detail: `.q-ring.json is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n}\n\nfunction checkPolicy(): CheckResult {\n  const summary = getPolicySummary();\n  const active = [\n    summary.hasMcpPolicy && \"mcp\",\n    summary.hasExecPolicy && \"exec\",\n    summary.hasSecretPolicy && \"secrets\",\n  ].filter(Boolean);\n  return {\n    name: \"governance policy\",\n    status: \"ok\",\n    detail: active.length\n      ? `active: ${active.join(\", \")}`\n      : \"none configured (add a \\\"policy\\\" section to .q-ring.json to enable)\",\n  };\n}\n\nfunction checkLegacyApprovals(): CheckResult {\n  const n = countLegacyApprovals();\n  if (n === 0) {\n    return {\n      name: \"approval bindings\",\n      status: \"ok\",\n      detail: \"no legacy approvals; all bound to a project/team/org identity\",\n    };\n  }\n  return {\n    name: \"approval bindings\",\n    status: \"warn\",\n    detail: `${n} pre-v0.14 approval(s) have no project binding and will NOT grant access — re-run \\`qring approve\\` for each`,\n  };\n}\n\nfunction checkMcpBinary(): CheckResult {\n  const exts = process.platform === \"win32\" ? [\".cmd\", \".exe\", \".bat\", \"\"] : [\"\"];\n  for (const dir of (process.env.PATH ?? \"\").split(delimiter)) {\n    if (!dir) continue;\n    for (const ext of exts) {\n      if (existsSync(join(dir, `qring-mcp${ext}`))) {\n        return {\n          name: \"qring-mcp binary\",\n          status: \"ok\",\n          detail: `found at ${join(dir, `qring-mcp${ext}`)}`,\n        };\n      }\n    }\n  }\n  return {\n    name: \"qring-mcp binary\",\n    status: \"warn\",\n    detail:\n      \"not on PATH — editor MCP configs that spawn `qring-mcp` will fail; install globally (pnpm add -g @i4ctime/q-ring)\",\n  };\n}\n\nexport function registerDoctorCommand(program: Command): void {\n  program\n    .command(\"doctor\")\n    .description(\"Diagnose the q-ring installation (keyring, audit, manifest, MCP)\")\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (cmd) => {\n      const projectPath = cmd.projectPath ?? process.cwd();\n\n      const checks: CheckResult[] = [\n        checkNode(),\n        await checkKeyringBackend(),\n        checkAuditLog(),\n        checkManifest(projectPath),\n        checkPolicy(),\n        checkLegacyApprovals(),\n        checkMcpBinary(),\n      ];\n\n      const failed = checks.filter((r) => r.status === \"fail\").length;\n      const warned = checks.filter((r) => r.status === \"warn\").length;\n\n      if (\n        emitJson(program, cmd, {\n          version: PACKAGE_VERSION,\n          projectPath,\n          checks,\n          healthy: failed === 0,\n        })\n      ) {\n        if (failed > 0) process.exitCode = 1;\n        return;\n      }\n\n      console.log(c.bold(`\\n  ${SYMBOLS.shield} qring doctor — v${PACKAGE_VERSION}\\n`));\n\n      for (const r of checks) {\n        const icon =\n          r.status === \"ok\"\n            ? c.green(SYMBOLS.check)\n            : r.status === \"warn\"\n              ? c.yellow(SYMBOLS.warning)\n              : c.red(SYMBOLS.cross);\n        console.log(`  ${icon} ${c.bold(r.name.padEnd(18))} ${c.dim(r.detail)}`);\n      }\n\n      console.log();\n      if (failed > 0) {\n        console.log(`  ${c.red(`${failed} check(s) failed`)}${warned ? c.dim(`, ${warned} warning(s)`) : \"\"}\\n`);\n        process.exitCode = 1;\n      } else if (warned > 0) {\n        console.log(`  ${c.yellow(`${warned} warning(s)`)} ${c.dim(\"— everything critical is healthy\")}\\n`);\n      } else {\n        console.log(`  ${c.green(\"All checks passed.\")}\\n`);\n      }\n    });\n}\n","import type { Command } from \"commander\";\nimport { c } from \"../../utils/colors.js\";\n\n/**\n * Shell completion scripts generated from the live commander program, so\n * they can never drift from the actual command surface.\n *\n *   qring completion bash >> ~/.bashrc            (or bash-completion dir)\n *   qring completion zsh  > ~/.zsh/completions/_qring\n *   qring completion fish > ~/.config/fish/completions/qring.fish\n */\n\ninterface CmdInfo {\n  name: string;\n  aliases: string[];\n  description: string;\n  options: Array<{ flag: string; description: string }>;\n  subcommands: CmdInfo[];\n}\n\nfunction collect(cmd: Command): CmdInfo {\n  return {\n    name: cmd.name(),\n    aliases: cmd.aliases(),\n    description: cmd.description(),\n    options: cmd.options\n      .map((o) => ({ flag: o.long ?? o.short ?? \"\", description: o.description ?? \"\" }))\n      .filter((o) => o.flag.startsWith(\"--\")),\n    subcommands: cmd.commands\n      .filter((s) => s.name() !== \"help\")\n      .map((s) => collect(s as Command)),\n  };\n}\n\nconst sanitize = (s: string) =>\n  s.replace(/['\"`$\\\\]/g, \"\").replace(/[:[\\]]/g, \" \").replace(/\\s+/g, \" \").trim();\n\nfunction bashScript(cmds: CmdInfo[]): string {\n  const names = cmds.flatMap((x) => [x.name, ...x.aliases]).join(\" \");\n  const cases = cmds\n    .map((x) => {\n      const label = [x.name, ...x.aliases].join(\"|\");\n      const opts = [...x.options.map((o) => o.flag), \"--json\"].join(\" \");\n      const subs = x.subcommands.map((s) => s.name).join(\" \");\n      const subCase = subs\n        ? `\\n      if [ \"$COMP_CWORD\" -eq 2 ]; then COMPREPLY=( $(compgen -W \"${subs}\" -- \"$cur\") ); return; fi`\n        : \"\";\n      return `    ${label})${subCase}\\n      opts=\"${opts}\" ;;`;\n    })\n    .join(\"\\n\");\n\n  return `# bash completion for qring — generated by \\`qring completion bash\\`\n_qring_completions() {\n  local cur cmd opts\n  cur=\"\\${COMP_WORDS[COMP_CWORD]}\"\n  cmd=\"\\${COMP_WORDS[1]}\"\n  if [ \"$COMP_CWORD\" -eq 1 ]; then\n    COMPREPLY=( $(compgen -W \"${names}\" -- \"$cur\") )\n    return\n  fi\n  opts=\"--json --help\"\n  case \"$cmd\" in\n${cases}\n  esac\n  case \"$cur\" in\n    -*) COMPREPLY=( $(compgen -W \"$opts --help\" -- \"$cur\") ) ;;\n  esac\n}\ncomplete -o default -F _qring_completions qring\n`;\n}\n\nfunction zshScript(cmds: CmdInfo[]): string {\n  const items = cmds\n    .map((x) => `    '${x.name}:${sanitize(x.description)}'`)\n    .join(\"\\n\");\n  const cases = cmds\n    .map((x) => {\n      const label = [x.name, ...x.aliases].join(\"|\");\n      const words = [\n        ...x.subcommands.map((s) => s.name),\n        ...x.options.map((o) => o.flag),\n        \"--json\",\n      ].join(\" \");\n      return `    ${label}) compadd -- ${words} ;;`;\n    })\n    .join(\"\\n\");\n\n  return `#compdef qring\n# zsh completion for qring — generated by \\`qring completion zsh\\`\n_qring() {\n  local -a commands\n  commands=(\n${items}\n  )\n  if (( CURRENT == 2 )); then\n    _describe 'command' commands\n    return\n  fi\n  case $words[2] in\n${cases}\n  esac\n}\n_qring \"$@\"\n`;\n}\n\nfunction fishScript(cmds: CmdInfo[]): string {\n  const lines: string[] = [\n    \"# fish completion for qring — generated by `qring completion fish`\",\n    \"complete -c qring -f\",\n  ];\n  const allNames = cmds.flatMap((x) => [x.name, ...x.aliases]);\n  for (const x of cmds) {\n    for (const name of [x.name, ...x.aliases]) {\n      lines.push(\n        `complete -c qring -n \"not __fish_seen_subcommand_from ${allNames.join(\" \")}\" -a ${name} -d \"${sanitize(x.description)}\"`,\n      );\n    }\n    for (const s of x.subcommands) {\n      lines.push(\n        `complete -c qring -n \"__fish_seen_subcommand_from ${x.name}\" -a ${s.name} -d \"${sanitize(s.description)}\"`,\n      );\n    }\n    for (const o of [...x.options, { flag: \"--json\", description: \"Output as JSON\" }]) {\n      lines.push(\n        `complete -c qring -n \"__fish_seen_subcommand_from ${x.name}\" -l ${o.flag.slice(2)} -d \"${sanitize(o.description)}\"`,\n      );\n    }\n  }\n  return lines.join(\"\\n\") + \"\\n\";\n}\n\nexport function registerCompletionCommand(program: Command): void {\n  program\n    .command(\"completion <shell>\")\n    .description(\"Print a shell completion script (bash, zsh, fish)\")\n    .action((shell: string) => {\n      const cmds = program.commands\n        .filter((s) => s.name() !== \"help\" && s.name() !== \"completion\")\n        .map((s) => collect(s as Command));\n\n      if (shell === \"bash\") process.stdout.write(bashScript(cmds));\n      else if (shell === \"zsh\") process.stdout.write(zshScript(cmds));\n      else if (shell === \"fish\") process.stdout.write(fishScript(cmds));\n      else {\n        console.error(c.red(`Unknown shell \"${shell}\" — expected bash, zsh, or fish`));\n        process.exitCode = 1;\n      }\n    });\n}\n","import { createProgram } from \"./cli/commands.js\";\nimport { c, SYMBOLS } from \"./utils/colors.js\";\n\nconst program = createProgram();\n\n// Central error handler: policy denials, keyring backend failures, bad input\n// from core throw plain Errors. Show the message, not a Node stack trace.\n// Set QRING_DEBUG=1 to get the full stack for bug reports.\ntry {\n  await program.parseAsync();\n} catch (err) {\n  const message = err instanceof Error ? err.message : String(err);\n  console.error(c.red(`${SYMBOLS.cross} ${message}`));\n  if (process.env.QRING_DEBUG && err instanceof Error && err.stack) {\n    console.error(c.dim(err.stack));\n  }\n  process.exitCode = 1;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,YAAY;;;ACI9B,IAAM,UAAU,QAAQ,OAAO,UAAU,SAAS,CAAC,QAAQ,IAAI;AAE/D,SAAS,KAAK,MAAc,MAAsB;AAChD,SAAO,UAAU,QAAQ,IAAI,IAAI,IAAI,YAAY;AACnD;AAEO,IAAM,IAAI;AAAA,EACf,MAAM,CAAC,MAAc,KAAK,KAAK,CAAC;AAAA,EAChC,KAAK,CAAC,MAAc,KAAK,KAAK,CAAC;AAAA,EAC/B,QAAQ,CAAC,MAAc,KAAK,KAAK,CAAC;AAAA,EAClC,WAAW,CAAC,MAAc,KAAK,KAAK,CAAC;AAAA,EAErC,KAAK,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EAChC,OAAO,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EAClC,QAAQ,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACnC,MAAM,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACjC,SAAS,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACpC,MAAM,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACjC,OAAO,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EAClC,MAAM,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EAEjC,OAAO,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EAClC,SAAS,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACpC,UAAU,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACrC,QAAQ,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACnC,WAAW,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACtC,QAAQ,CAAC,MAAc,KAAK,MAAM,CAAC;AACrC;AAEO,SAAS,WAAW,OAAuB;AAChD,SAAO,UAAU,YAAY,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,KAAK;AAC3D;AAEO,SAAS,eAAe,SAAiB,SAA0B;AACxE,MAAI,QAAS,QAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAChD,MAAI,WAAW,GAAI,QAAO,EAAE,IAAI,UAAU,OAAO,IAAI;AACrD,MAAI,WAAW,GAAI,QAAO,EAAE,OAAO,UAAU,OAAO,IAAI;AACxD,MAAI,UAAU,EAAG,QAAO,EAAE,MAAM,UAAU,OAAO,IAAI;AACrD,SAAO;AACT;AAEO,SAAS,SAAS,KAAqB;AAC5C,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,aAAO,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,IACpC,KAAK;AACH,aAAO,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,IACvC,KAAK;AACH,aAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,IACtC,KAAK;AACH,aAAO,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,IACrC;AACE,aAAO,EAAE,UAAU,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,EAC1C;AACF;AAEO,IAAM,UAAU;AAAA,EACrB,OAAO,UAAU,WAAW;AAAA,EAC5B,OAAO,UAAU,WAAW;AAAA,EAC5B,OAAO,UAAU,WAAW;AAAA,EAC5B,KAAK,UAAU,WAAW;AAAA,EAC1B,MAAM,UAAU,cAAc;AAAA,EAC9B,KAAK,UAAU,cAAc;AAAA,EAC7B,MAAM,UAAU,cAAc;AAAA,EAC9B,SAAS,UAAU,iBAAiB;AAAA,EACpC,OAAO,UAAU,WAAW;AAAA,EAC5B,QAAQ,UAAU,oBAAoB;AAAA,EACtC,KAAK,UAAU,WAAW;AAAA,EAC1B,KAAK,UAAU,oBAAoB;AAAA,EACnC,OAAO,UAAU,cAAc;AAAA,EAC/B,SAAS,UAAU,cAAc;AAAA,EACjC,SAAS,UAAU,WAAW;AAChC;;;ACxEA,SAAS,oBAAoB;AAsBtB,SAAS,YAAY,SAAsC;AAChE,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,QAAQ,QAAQ,MAAM,OAAO;AAEnC,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,OAAO,MAAM,CAAC,EAAE,KAAK;AAE3B,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,EAAG;AAEnC,UAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,QAAI,UAAU,GAAI;AAElB,UAAM,MAAM,KAAK,MAAM,GAAG,KAAK,EAAE,KAAK;AACtC,QAAI,QAAQ,KAAK,MAAM,QAAQ,CAAC,EAAE,KAAK;AAEvC,QACG,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAC3C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAC5C;AACA,cAAQ,MAAM,MAAM,GAAG,EAAE;AAAA,IAC3B;AAEA,UAAM,YAAoC;AAAA,MACxC,GAAG;AAAA,MAAM,GAAG;AAAA,MAAM,GAAG;AAAA,MAAM,MAAM;AAAA,MAAM,KAAK;AAAA,IAC9C;AACA,YAAQ,MAAM,QAAQ,iBAAiB,CAAC,GAAG,OAAO,UAAU,EAAE,KAAK,EAAE;AAIrE,QAAI,CAAC,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,SAAS,GAAG,GAAG;AAC9C,YAAM,eAAe,MAAM,MAAM,KAAK;AACtC,UAAI,gBAAgB,aAAa,UAAU,QAAW;AACpD,gBAAQ,MAAM,MAAM,GAAG,aAAa,KAAK,EAAE,KAAK;AAAA,MAClD;AAAA,IACF;AAEA,QAAI,IAAK,QAAO,IAAI,KAAK,KAAK;AAAA,EAChC;AAEA,SAAO;AACT;AAKO,SAAS,aACd,mBACA,UAAyB,CAAC,GACZ;AACd,MAAI;AAMJ,QAAM,SAAS,QAAQ,UAAU;AACjC,MAAI,WAAW,OAAO;AACpB,QAAI;AACF,gBAAU,aAAa,mBAAmB,MAAM;AAAA,IAClD,QAAQ;AACN,gBAAU;AAAA,IACZ;AAAA,EACF,OAAO;AACL,cAAU;AAAA,EACZ;AAEA,QAAM,QAAQ,YAAY,OAAO;AACjC,QAAM,SAAuB;AAAA,IAC3B,UAAU,CAAC;AAAA,IACX,SAAS,CAAC;AAAA,IACV,OAAO,MAAM;AAAA,EACf;AAEA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO;AAChC,QAAI,QAAQ,gBAAgB,UAAU,KAAK;AAAA,MACzC,OAAO,QAAQ;AAAA,MACf,aAAa,QAAQ;AAAA,MACrB,QAAQ,QAAQ,UAAU;AAAA,IAC5B,CAAC,GAAG;AACF,aAAO,QAAQ,KAAK,GAAG;AACvB;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ;AAClB,aAAO,SAAS,KAAK,GAAG;AACxB;AAAA,IACF;AAEA,UAAM,UAA4B;AAAA,MAChC,OAAO,QAAQ,SAAS;AAAA,MACxB,aAAa,QAAQ,eAAe,QAAQ,IAAI;AAAA,MAChD,QAAQ,QAAQ,UAAU;AAAA,IAC5B;AAEA,cAAU,KAAK,OAAO,OAAO;AAC7B,WAAO,SAAS,KAAK,GAAG;AAAA,EAC1B;AAEA,SAAO;AACT;;;AC7HA,SAAS,uBAAuB;AAOhC,eAAsB,QACpB,SACA,EAAE,YAAY,MAAM,IAA6B,CAAC,GAChC;AAClB,MAAI,UAAW,QAAO;AACtB,MAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,KAAK,gBAAgB;AAAA,IACzB,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,SAAS,MAAM,IAAI,QAAgB,CAAC,YAAY;AACpD,OAAG,SAAS,GAAG,OAAO,WAAW,OAAO;AAAA,EAC1C,CAAC;AACD,KAAG,MAAM;AACT,SAAO,YAAY,KAAK,OAAO,KAAK,CAAC;AACvC;AAEA,eAAsB,aAAa,SAAkC;AACnE,QAAM,QAAQ,QAAQ;AAKtB,MAAI,CAAC,MAAM,OAAO;AAChB,QAAI,OAAO;AACX,UAAM,YAAY,MAAM;AACxB,qBAAiB,SAAS,OAAO;AAC/B,cAAQ;AAAA,IACV;AACA,UAAM,QAAQ,KAAK,QAAQ,UAAU,EAAE;AACvC,QAAI,MAAM,WAAW,GAAG;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,KAAK,gBAAgB;AAAA,IACzB,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,EACZ,CAAC;AAED,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,YAAQ,OAAO,MAAM,OAAO;AAE5B,UAAM,SAAS,MAAM;AACrB,QAAI,MAAM,SAAS,MAAM,YAAY;AACnC,YAAM,WAAW,IAAI;AAAA,IACvB;AAEA,QAAI,QAAQ;AAEZ,UAAM,SAAS,CAAC,UAAkB;AAChC,YAAM,OAAO,MAAM,SAAS,MAAM;AAClC,UAAI,SAAS,QAAQ,SAAS,MAAM;AAClC,cAAM,eAAe,QAAQ,MAAM;AACnC,YAAI,MAAM,SAAS,MAAM,YAAY;AACnC,gBAAM,WAAW,UAAU,KAAK;AAAA,QAClC;AACA,gBAAQ,OAAO,MAAM,IAAI;AACzB,WAAG,MAAM;AACT,gBAAQ,KAAK;AAAA,MACf,WAAW,SAAS,KAAU;AAC5B,gBAAQ,KAAK,CAAC;AAAA,MAChB,WAAW,SAAS,UAAY,SAAS,MAAM;AAC7C,gBAAQ,MAAM,MAAM,GAAG,EAAE;AAAA,MAC3B,OAAO;AACL,iBAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,GAAG,QAAQ,MAAM;AAAA,EACzB,CAAC;AACH;;;ACtFO,SAAS,gBAAgBA,UAAkB,KAAuB;AACvE,QAAMC,KAAI;AACV,MAAIA,GAAE,KAAM,QAAO;AACnB,QAAM,IAAID,SAAQ,KAAK;AACvB,SAAO,CAAC,CAAC,EAAE;AACb;AAMO,SAAS,SAASA,UAAkB,KAAc,MAAwB;AAC/E,MAAI,CAAC,gBAAgBA,UAAS,GAAG,EAAG,QAAO;AAC3C,UAAQ,OAAO,MAAM,KAAK,UAAU,EAAE,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI;AACvE,SAAO;AACT;AAOO,SAAS,QAAQ,GAAsC;AAC5D,SAAO,KAAK,OAAO,KAAK,GAAG,CAAC;AAC9B;AAEO,SAAS,QAAQ,GAAsC;AAC5D,SAAO,KAAK,OAAO,IAAI,OAAO,CAAC;AACjC;AAEO,SAAS,QAAW,KAAkC;AAC3D,SAAO,MAAM,IAAI,IAAI,CAAC,MAAO,OAAO,MAAM,WAAW,QAAQ,CAAC,IAAI,CAAO,IAAI,CAAC;AAChF;;;AChCO,SAAS,UAAU,KAOP;AACjB,MAAI;AACJ,MAAI,IAAI,OAAQ,SAAQ;AAAA,WACf,IAAI,QAAS,SAAQ;AAAA,WACrB,IAAI,KAAM,SAAQ;AAAA,WAClB,IAAI,IAAK,SAAQ;AAE1B,QAAM,cACJ,IAAI,gBAAgB,IAAI,UAAU,QAAQ,IAAI,IAAI;AAEpD,MAAI,UAAU,aAAa,CAAC,aAAa;AACvC,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,eAAe,QAAQ,IAAI;AAAA,IACxC,QAAQ,IAAI;AAAA,IACZ,OAAO,IAAI;AAAA,IACX,KAAK,IAAI;AAAA,IACT,QAAQ;AAAA,EACV;AACF;;;AC1BA,SAAS,4BAA4B,SAAyB;AAC5D,MAAI,MAAM;AACV,aAAWE,MAAK,SAAS;AACvB,QAAIA,OAAM,IAAK,QAAO;AAAA,aACbA,OAAM,IAAK,QAAO;AAAA,aAClB,eAAe,SAASA,EAAC,EAAG,QAAO,OAAOA;AAAA,aAC1CA,OAAM,IAAK,QAAO;AAAA,QACtB,QAAOA;AAAA,EACd;AACA,SAAO;AACT;AAKO,SAAS,uBACd,SACA,QACe;AACf,MAAI,CAAC,QAAQ,KAAK,EAAG,QAAO;AAC5B,QAAM,QAAQ,IAAI,OAAO,MAAM,4BAA4B,MAAM,IAAI,KAAK,GAAG;AAC7E,SAAO,QAAQ,OAAO,CAAC,MAAM,MAAM,KAAK,EAAE,GAAG,CAAC;AAChD;;;ACFO,SAAS,wBAAwBC,UAAwB;AAC9D,EAAAA,SACG,QAAQ,mBAAmB,EAC3B,YAAY,iDAAiD,EAC7D,OAAO,gBAAgB,uBAAuB,EAC9C,OAAO,iBAAiB,mCAAmC,EAC3D,OAAO,eAAe,qBAAqB,EAC3C,OAAO,cAAc,oBAAoB,EACzC,OAAO,yBAAyB,uBAAuB,EACvD;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,mBAAmB,6BAA6B,EACvD,OAAO,wBAAwB,4BAA4B,EAC3D,OAAO,iBAAiB,sBAAsB,EAC9C;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,8BAA8B,qCAAqC,EAC1E;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,OAAO,KAAa,OAA2B,QAAQ;AAC7D,UAAM,OAAO,UAAU,GAAG;AAE1B,QAAI,CAAC,OAAO;AACV,cAAQ,MAAM;AAAA,QACZ,GAAG,QAAQ,GAAG,oBAAoB,EAAE,KAAK,GAAG,CAAC;AAAA,MAC/C;AACA,UAAI,CAAC,OAAO;AACV,gBAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,+BAA+B,CAAC;AACpE,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,UAA4B;AAAA,MAChC,GAAG;AAAA,MACH,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,MACtD,gBAAgB,IAAI;AAAA,MACpB,gBAAgB,IAAI;AAAA,MACpB,kBAAkB,IAAI;AAAA,MACtB,aAAa,IAAI;AAAA,IACnB;AAKA,UAAM,gBAAgB,YAAY,KAAK,IAAI;AAC3C,QAAI,eAAe,SAAS,KAAK,QAAQ;AACvC,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,OAAO,KAAK,GAAG,kHAA6G,GAAG;AAAA,QAC5I;AAAA,MACF;AAAA,IACF;AAEA,QAAI,IAAI,KAAK;AACX,YAAM,WAAW;AACjB,YAAM,SAAS,UAAU,UAAU,UAAU,CAAC;AAC9C,aAAO,IAAI,GAAG,IAAI;AAElB,UAAI,UAAU,UAAU,SAAS,CAAC,OAAO,SAAS,GAAG;AACnD,eAAO,SAAS,IAAI,SAAS,SAAS;AAAA,MACxC;AAEA,cAAQ,SAAS;AACjB,cAAQ,aAAa,UAAU,UAAU,cAAc,IAAI;AAC3D,gBAAU,KAAK,IAAI,OAAO;AAE1B,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,WAAW,KAAK,SAAS,QAAQ,CAAC,GAAG,CAAC;AAAA,MAC9H;AAAA,IACF,OAAO;AACL,gBAAU,KAAK,OAAO,OAAO;AAC7B,YAAM,SAAmB,CAAC;AAC1B,UAAI,IAAI,IAAK,QAAO,KAAK,GAAG,QAAQ,KAAK,QAAQ,IAAI,GAAG,GAAG;AAC3D,UAAI,IAAI,YAAa,QAAO,KAAK,EAAE,IAAI,IAAI,WAAW,CAAC;AAEvD,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,WAAW,KAAK,SAAS,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC;AAAA,MAC7H;AAAA,IACF;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,WAAW,EACnB,YAAY,uDAAuD,EACnE,OAAO,gBAAgB,2BAA2B,EAClD,OAAO,iBAAiB,4BAA4B,EACpD,OAAO,eAAe,yBAAyB,EAC/C,OAAO,cAAc,wBAAwB,EAC7C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,8BAA8B,EACxD,OAAO,SAAS,sDAAsD,EACtE,OAAO,CAAC,KAAa,QAAQ;AAC5B,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,QAAQ,UAAU,KAAK,IAAI;AAEjC,QAAI,UAAU,MAAM;AAClB,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,GAAG,aAAa,CAAC;AACjE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,IAAI,KAAK;AACX,cAAQ,OAAO,MAAM,KAAK;AAC1B;AAAA,IACF;AAEA,UAAM,UAAU,gBAAgBA,UAAS,GAAG,IACxC,EAAE,IAAI,MAAe,MAAM,EAAE,KAAK,MAAM,EAAE,IAC1C,EAAE,KAAK,MAAM;AAIjB,YAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,IAAI,IAAI;AAAA,EACrD,CAAC;AAEH,EAAAA,SACG,QAAQ,WAAW,EACnB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,2BAA2B,EAClD,OAAO,iBAAiB,4BAA4B,EACpD,OAAO,eAAe,yBAAyB,EAC/C,OAAO,cAAc,wBAAwB,EAC7C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,eAAe,yCAAyC,EAC/D,OAAO,CAAC,KAAa,QAAQ;AAC5B,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,SAAS,UAAU,KAAK,IAAI;AAElC,QAAI,CAAC,IAAI,OAAO;AACd,UAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,gBAAQ,IAAI,KAAK,UAAU,EAAE,IAAI,MAAM,MAAM,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC;AAAA,MACjE,OAAO;AACL,gBAAQ,IAAI,SAAS,SAAS,OAAO;AAAA,MACvC;AAAA,IACF;AACA,QAAI,CAAC,OAAQ,SAAQ,WAAW;AAAA,EAClC,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB,MAAM,IAAI,EACV,YAAY,kCAAkC,EAC9C,OAAO,gBAAgB,+BAA+B,EACtD,OAAO,iBAAiB,gCAAgC,EACxD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,aAAa,8BAA8B,EAClD,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,KAAa,QAAQ;AAClC,UAAM,OAAO,UAAU,GAAG;AAE1B,QAAI,CAAE,MAAM,QAAQ,iBAAiB,GAAG,KAAK,EAAE,WAAW,IAAI,IAAI,CAAC,GAAI;AACrE,cAAQ,MAAM,EAAE,IAAI,UAAU,CAAC;AAC/B,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,KAAK,IAAI;AAEtC,QAAI,CAAC,SAAS;AACZ,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,GAAG,aAAa,CAAC;AACjE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,SAASA,UAAS,KAAK,EAAE,KAAK,SAAS,KAAK,CAAC,EAAG;AACpD,YAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EACrE,CAAC;AAEH,EAAAA,SACG,QAAQ,MAAM,EACd,MAAM,IAAI,EACV,YAAY,iDAAiD,EAC7D,OAAO,gBAAgB,wBAAwB,EAC/C,OAAO,iBAAiB,yBAAyB,EACjD,OAAO,eAAe,sBAAsB,EAC5C,OAAO,cAAc,qBAAqB,EAC1C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,gBAAgB,0BAA0B,EACjD,OAAO,mBAAmB,eAAe,EACzC,OAAO,aAAa,2BAA2B,EAC/C,OAAO,WAAW,sCAAsC,EACxD,OAAO,0BAA0B,0BAA0B,EAC3D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,QAAI,UAAU,YAAY,IAAI;AAE9B,QAAI,IAAI,KAAK;AACX,gBAAU,QAAQ;AAAA,QAAO,CAAC,MACxB,EAAE,UAAU,KAAK,MAAM,SAAS,IAAI,GAAG;AAAA,MACzC;AAAA,IACF;AACA,QAAI,IAAI,SAAS;AACf,gBAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,SAAS;AAAA,IACpD;AACA,QAAI,IAAI,OAAO;AACb,gBAAU,QAAQ;AAAA,QAChB,CAAC,MAAM,EAAE,OAAO,WAAW,CAAC,EAAE,OAAO;AAAA,MACvC;AAAA,IACF;AACA,QAAI,IAAI,QAAQ;AACd,gBAAU,uBAAuB,SAAS,IAAI,MAAM;AAAA,IACtD;AAEA,QACE;AAAA,MACEA;AAAA,MACA;AAAA,MACA,QAAQ,IAAI,CAAC,OAAO;AAAA,QAClB,KAAK,QAAQ,EAAE,GAAG;AAAA,QAClB,OAAO,QAAQ,EAAE,KAAK;AAAA,QACtB,MAAM,EAAE,UAAU,SAAS,kBAAkB;AAAA,QAC7C,cAAc,EAAE,UAAU,SACtB,OAAO,KAAK,EAAE,SAAS,MAAM,EAAE,IAAI,OAAO,IAC1C;AAAA,QACJ,MAAM,QAAQ,EAAE,UAAU,KAAK,IAAI;AAAA,QACnC,aAAa,QAAQ,EAAE,UAAU,KAAK,WAAW;AAAA,QACjD,gBAAgB,QAAQ,EAAE,UAAU,KAAK,WAAW,MAAM;AAAA,QAC1D,OAAO,EAAE,SAAS;AAAA,MACpB,EAAE;AAAA,IACJ,GACA;AACA;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,EAAE,IAAI,kBAAkB,CAAC;AACrC;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,oBAAoB,QAAQ,MAAM;AAAA,CAAK;AAAA,IAClE;AAEA,UAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC;AAE9D,eAAW,SAAS,SAAS;AAC3B,YAAM,QAAkB,CAAC;AAEzB,YAAM,MAAM,QAAQ,MAAM,GAAG;AAC7B,YAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,YAAM,OAAO,MAAM,UAAU,SACzB,OAAO,KAAK,MAAM,SAAS,MAAM,EAAE,IAAI,OAAO,IAC9C;AACJ,YAAM,iBAAiB,QAAQ,MAAM,UAAU,KAAK,WAAW,MAAM;AACrE,YAAM,cAAc,QAAQ,MAAM,UAAU,KAAK,WAAW;AAC5D,YAAM,OAAO,QAAQ,MAAM,UAAU,KAAK,IAAI;AAC9C,YAAM,WAAW,QAAQ,MAAM,OAAO,eAAe;AACrD,YAAM,UAAU,CAAC,CAAC,MAAM,OAAO;AAC/B,YAAM,WAAW,QAAQ,MAAM,OAAO,aAAa;AAEnD,YAAM,KAAK,EAAE,IAAI,GAAG,IAAI,WAAW,KAAK,IAAI,EAAE,IAAI,GAAG,CAAC;AACtD,YAAM,KAAK,EAAE,KAAK,IAAI,OAAO,SAAS,CAAC,CAAC;AAExC,UAAI,MAAM;AACR,cAAM,KAAK,EAAE,QAAQ,IAAI,KAAK,KAAK,GAAG,CAAC,GAAG,CAAC;AAAA,MAC7C;AAEA,UAAI,MAAM,UAAU,WAAW,KAAK,UAAU;AAC5C,cAAM,KAAK,eAAe,UAAU,OAAO,CAAC;AAC5C,YAAI,YAAY,CAAC,SAAS;AACxB,gBAAM,KAAK,EAAE,IAAI,QAAQ,CAAC;AAAA,QAC5B;AAAA,MACF;AAEA,UAAI,iBAAiB,GAAG;AACtB,cAAM,KAAK,EAAE,KAAK,GAAG,QAAQ,IAAI,IAAI,cAAc,EAAE,CAAC;AAAA,MACxD;AAEA,UAAI,cAAc,GAAG;AACnB,cAAM,KAAK,EAAE,IAAI,GAAG,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC;AAAA,MACnD;AAEA,UAAI,KAAK,SAAS,GAAG;AACnB,cAAM,KAAK,EAAE,IAAI,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC;AAAA,MACtD;AAEA,cAAQ,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,EAAE;AAAA,IACrC;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,eAAe,EACvB,YAAY,qCAAqC,EACjD,OAAO,gBAAgB,2BAA2B,EAClD,OAAO,iBAAiB,4BAA4B,EACpD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,KAAa,QAAQ;AAC5B,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,SAAS,YAAY,KAAK,IAAI;AAEpC,QAAI,CAAC,QAAQ;AACX,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,GAAG,aAAa,CAAC;AACjE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI;AAC5B,UAAM,QAAQ,WAAW,QAAQ;AAEjC,QACE,SAASA,UAAS,KAAK;AAAA,MACrB,KAAK,QAAQ,GAAG;AAAA,MAChB,OAAO,QAAQ,KAAK;AAAA,MACpB,MAAM,SAAS,SAAS,kBAAkB;AAAA,MAC1C,cAAc,SAAS,SACnB,OAAO,KAAK,SAAS,MAAM,EAAE,IAAI,OAAO,IACxC;AAAA,MACJ,YAAY,SAAS,aAAa,QAAQ,SAAS,UAAU,IAAI;AAAA,MACjE,WAAW,QAAQ,SAAS,KAAK,SAAS;AAAA,MAC1C,WAAW,QAAQ,SAAS,KAAK,SAAS;AAAA,MAC1C,aAAa,QAAQ,SAAS,KAAK,WAAW;AAAA,MAC9C,gBAAgB,SAAS,KAAK,iBAC1B,QAAQ,SAAS,KAAK,cAAc,IACpC;AAAA,MACJ,aAAa,SAAS,KAAK,cACvB,QAAQ,SAAS,KAAK,WAAW,IACjC;AAAA,MACJ,MAAM,QAAQ,SAAS,KAAK,IAAI;AAAA,MAChC,YAAY,SAAS,KAAK,aAAa,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,QACrD,SAAS,QAAQ,EAAE,OAAO;AAAA,QAC1B,KAAK,QAAQ,EAAE,GAAG;AAAA,MACpB,EAAE;AAAA,MACF;AAAA,IACF,CAAC,GACD;AACA;AAAA,IACF;AAEA,UAAM,YAAY,QAAQ,KAAK;AAC/B,UAAM,YAAY,QAAQ,SAAS,KAAK,SAAS;AACjD,UAAM,YAAY,QAAQ,SAAS,KAAK,SAAS;AACjD,UAAM,cAAc,QAAQ,SAAS,KAAK,WAAW;AACrD,UAAM,aAAa,QAAQ,SAAS,KAAK,cAAc;AACvD,UAAM,OAAO,QAAQ,SAAS,KAAK,WAAW;AAC9C,UAAM,OAAO,QAAQ,SAAS,KAAK,IAAI;AACvC,UAAM,aAAa,SAAS,KAAK,aAAa,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,MAC5D,SAAS,QAAQ,EAAE,OAAO;AAAA,MAC1B,KAAK,QAAQ,EAAE,GAAG;AAAA,IACpB,EAAE;AACF,UAAM,YAAY,SAAS,SACvB,OAAO,KAAK,SAAS,MAAM,EAAE,IAAI,OAAO,IACxC;AACJ,UAAM,aAAa,QAAQ,SAAS,UAAU;AAC9C,UAAM,YAAY,QAAQ,MAAM,aAAa;AAC7C,UAAM,WAAW,QAAQ,MAAM,eAAe;AAC9C,UAAM,UAAU,CAAC,CAAC,MAAM;AAExB,YAAQ,IAAI;AAAA,IAAO,EAAE,KAAK,QAAQ,MAAM,MAAM,GAAG,CAAC,EAAE;AACpD,YAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,WAAW,SAAS,CAAC,EAAE;AAE/D,QAAI,WAAW;AACb,cAAQ,IAAI,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,QAAQ,eAAe,CAAC,EAAE;AACpE,cAAQ,IAAI,KAAK,EAAE,IAAI,SAAS,CAAC,EAAE;AACnC,iBAAW,OAAO,WAAW;AAC3B,cAAM,YAAY,QAAQ;AAC1B,gBAAQ;AAAA,UACN,OAAO,SAAS,GAAG,CAAC,IAAI,YAAY,EAAE,IAAI,WAAW,IAAI,EAAE;AAAA,QAC7D;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,IAAI,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,WAAW,CAAC,EAAE;AAAA,IAChE;AAEA,YAAQ,IAAI,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE;AACnD,YAAQ,IAAI,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE;AACnD,YAAQ,IAAI,KAAK,EAAE,IAAI,WAAW,CAAC,KAAK,WAAW,QAAQ;AAE3D,QAAI,YAAY;AACd,cAAQ,IAAI,KAAK,EAAE,IAAI,YAAY,CAAC,IAAI,UAAU,EAAE;AAAA,IACtD;AAEA,QAAI,MAAM;AACR,cAAQ,IAAI,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE;AAAA,IAChD;AAEA,QAAI,KAAK,SAAS,GAAG;AACnB,cAAQ;AAAA,QACN,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MACxE;AAAA,IACF;AAEA,QAAI,WAAW;AACb,cAAQ;AAAA,QACN,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,eAAe,UAAU,OAAO,CAAC,IAAI,SAAS;AAAA,MAC5E;AAAA,IACF;AAEA,QAAI,UAAU,SAAS,GAAG;AACxB,cAAQ,IAAI,KAAK,EAAE,IAAI,YAAY,CAAC,EAAE;AACtC,iBAAW,QAAQ,WAAW;AAC5B,gBAAQ,IAAI,OAAO,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG,EAAE;AAAA,MAC/D;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,QAAQ,EAChB,YAAY,0DAA0D,EACtE,OAAO,yBAAyB,8BAA8B,KAAK,EACnE,OAAO,gBAAgB,0BAA0B,EACjD,OAAO,iBAAiB,2BAA2B,EACnD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,gCAAgC,EAC1D,OAAO,qBAAqB,qCAAqC,EACjE,OAAO,qBAAqB,mCAAmC,EAC/D,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,SAAS,cAAc;AAAA,MAC3B,GAAG;AAAA,MACH,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,MACtD,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,IACxD,CAAC;AACD,YAAQ,OAAO,MAAM,SAAS,IAAI;AAAA,EACpC,CAAC;AAEH,EAAAA,SACG,QAAQ,eAAe,EACvB,YAAY,iCAAiC,EAC7C,OAAO,gBAAgB,wBAAwB,EAC/C,OAAO,iBAAiB,yBAAyB,EACjD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,qBAAqB,EAC/C,OAAO,mBAAmB,8BAA8B,EACxD,OAAO,aAAa,+CAA+C,EACnE,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,MAAc,QAAQ;AAC7B,UAAM,OAAO,UAAU,GAAG;AAE1B,UAAM,SAAS,aAAa,MAAM;AAAA,MAChC,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,cAAc,IAAI;AAAA,MAClB,QAAQ,IAAI;AAAA,IACd,CAAC;AAED,QAAI,SAASA,UAAS,KAAK,EAAE,MAAM,QAAQ,CAAC,CAAC,IAAI,QAAQ,GAAG,OAAO,CAAC,GAAG;AACrE;AAAA,IACF;AAEA,QAAI,IAAI,QAAQ;AACd,cAAQ;AAAA,QACN;AAAA,IAAO,QAAQ,OAAO,IAAI,EAAE,KAAK,SAAS,CAAC,wBAAmB,OAAO,SAAS,MAAM,OAAO,OAAO,KAAK;AAAA;AAAA,MACzG;AACA,iBAAW,OAAO,OAAO,UAAU;AACjC,gBAAQ,IAAI,KAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,MAC/C;AACA,UAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,gBAAQ;AAAA,UACN;AAAA,IAAO,EAAE,IAAI,uBAAuB,OAAO,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,OAAO,SAAS,MAAM,mBAAmB,EAAE,KAAK,IAAI,CAAC;AAAA,MAClG;AACA,UAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,gBAAQ;AAAA,UACN,EAAE;AAAA,YACA,aAAa,OAAO,QAAQ,MAAM,cAAc,OAAO,QAAQ,KAAK,IAAI,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AACL;;;AChgBA,SAAS,aAAa,iBAAiB;AAmBvC,IAAM,YACJ;AACF,IAAM,iBACJ;AAEF,SAAS,aAAa,SAAiB,QAAwB;AAC7D,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,cAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC;AAAA,EAC7C;AACA,SAAO;AACT;AAEO,SAAS,eAAe,OAAqB,CAAC,GAAW;AAC9D,QAAM,SAAS,KAAK,UAAU;AAE9B,UAAQ,QAAQ;AAAA,IACd,KAAK,OAAO;AACV,YAAM,MAAM,KAAK,UAAU;AAC3B,aAAO,YAAY,GAAG,EAAE,SAAS,KAAK;AAAA,IACxC;AAAA,IAEA,KAAK,UAAU;AACb,YAAM,MAAM,KAAK,UAAU;AAC3B,aAAO,YAAY,GAAG,EAAE,SAAS,WAAW;AAAA,IAC9C;AAAA,IAEA,KAAK,gBAAgB;AACnB,YAAM,MAAM,KAAK,UAAU;AAC3B,aAAO,aAAa,WAAW,GAAG;AAAA,IACpC;AAAA,IAEA,KAAK,QAAQ;AACX,YAAM,QAAQ,YAAY,EAAE;AAC5B,YAAM,CAAC,IAAK,MAAM,CAAC,IAAI,KAAQ;AAC/B,YAAM,CAAC,IAAK,MAAM,CAAC,IAAI,KAAQ;AAC/B,YAAM,MAAM,MAAM,SAAS,KAAK;AAChC,aAAO;AAAA,QACL,IAAI,MAAM,GAAG,CAAC;AAAA,QACd,IAAI,MAAM,GAAG,EAAE;AAAA,QACf,IAAI,MAAM,IAAI,EAAE;AAAA,QAChB,IAAI,MAAM,IAAI,EAAE;AAAA,QAChB,IAAI,MAAM,IAAI,EAAE;AAAA,MAClB,EAAE,KAAK,GAAG;AAAA,IACZ;AAAA,IAEA,KAAK,WAAW;AACd,YAAM,SAAS,KAAK,UAAU;AAC9B,YAAM,MAAM,KAAK,UAAU;AAC3B,aAAO,SAAS,aAAa,WAAW,GAAG;AAAA,IAC7C;AAAA,IAEA,KAAK,SAAS;AACZ,YAAM,SAAS,KAAK,UAAU;AAC9B,YAAM,MAAM,KAAK,UAAU;AAC3B,aAAO,SAAS,YAAY,GAAG,EAAE,SAAS,WAAW;AAAA,IACvD;AAAA,IAEA,KAAK,YAAY;AACf,YAAM,MAAM,KAAK,UAAU;AAK3B,YAAM,gBAAgB;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,aAAa,cAChB,MAAM,GAAG,KAAK,IAAI,cAAc,QAAQ,GAAG,CAAC,EAC5C,IAAI,CAAC,OAAO,aAAa,IAAI,CAAC,CAAC;AAClC,YAAM,YAAY,KAAK,IAAI,GAAG,MAAM,WAAW,MAAM;AACrD,YAAM,QAAQ;AAAA,QACZ,GAAG;AAAA,QACH,GAAI,YAAY,IAAI,aAAa,gBAAgB,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC;AAAA,MAC3E;AAGA,eAAS,IAAI,MAAM,SAAS,GAAG,IAAI,GAAG,KAAK;AACzC,cAAM,IAAI,UAAU,IAAI,CAAC;AACzB,SAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,MAC5C;AAEA,aAAO,MAAM,KAAK,EAAE;AAAA,IACtB;AAAA,IAEA;AACE,aAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACzC;AACF;AAKO,SAAS,gBAAgB,QAAwB;AACtD,QAAM,WAAW;AAAA,IACf,EAAE,OAAO,SAAS,MAAM,GAAG;AAAA,IAC3B,EAAE,OAAO,SAAS,MAAM,GAAG;AAAA,IAC3B,EAAE,OAAO,SAAS,MAAM,GAAG;AAAA,IAC3B,EAAE,OAAO,gBAAgB,MAAM,GAAG;AAAA,EACpC;AAEA,MAAI,WAAW;AACf,aAAW,EAAE,OAAO,KAAK,KAAK,UAAU;AACtC,QAAI,MAAM,KAAK,MAAM,EAAG,aAAY;AAAA,EACtC;AAEA,SAAO,WAAW,IAAI,KAAK,MAAM,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,IAAI;AAC1E;;;AC7GA,SAAS,YACP,KACA,SACA,YAAY,KACmC;AAC/C,SAAO,YAAY,EAAE,KAAK,QAAQ,OAAO,SAAS,UAAU,CAAC;AAC/D;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACpB,YAAY,oBAAI,IAAsB;AAAA,EAE9C,SAAS,UAA0B;AACjC,SAAK,UAAU,IAAI,SAAS,MAAM,QAAQ;AAAA,EAC5C;AAAA,EAEA,IAAI,MAAoC;AACtC,WAAO,KAAK,UAAU,IAAI,IAAI;AAAA,EAChC;AAAA,EAEA,eACE,OACA,OACsB;AACtB,QAAI,OAAO,UAAU;AACnB,aAAO,KAAK,UAAU,IAAI,MAAM,QAAQ;AAAA,IAC1C;AAEA,eAAW,YAAY,KAAK,UAAU,OAAO,GAAG;AAC9C,UAAI,SAAS,UAAU;AACrB,mBAAW,OAAO,SAAS,UAAU;AACnC,cAAI,MAAM,WAAW,GAAG,EAAG,QAAO;AAAA,QACpC;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,gBAA4B;AAC1B,WAAO,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,EACpC;AACF;AAQA,SAAS,iBAAiB,KAMb;AACX,SAAO;AAAA,IACL,MAAM,IAAI;AAAA,IACV,aAAa,IAAI;AAAA,IACjB,UAAU,IAAI;AAAA,IACd,MAAM,SAAS,OAA0C;AACvD,YAAM,QAAQ,KAAK,IAAI;AACvB,UAAI;AACF,cAAM,EAAE,WAAW,IAAI,MAAM,YAAY,IAAI,KAAK;AAAA,UAChD,cAAc;AAAA,UACd,GAAG,IAAI,QAAQ,KAAK;AAAA,QACtB,CAAC;AACD,cAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,YAAI,eAAe;AACjB,iBAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,oBAAoB,WAAW,UAAU,IAAI,KAAK;AACpG,YAAI,eAAe,OAAO,eAAe;AACvC,iBAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,+BAA+B,UAAU,KAAK,WAAW,UAAU,IAAI,KAAK;AACjI,YAAI,eAAe;AACjB,iBAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,wCAAmC,WAAW,UAAU,IAAI,KAAK;AACnH,eAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,IAAI,KAAK;AAAA,MACpH,SAAS,KAAK;AACZ,eAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG,eAAe,QAAQ,IAAI,UAAU,eAAe,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,IAAI,KAAK;AAAA,MAChK;AAAA,IACF;AAAA,EACF;AACF;AAMA,IAAM,oBAAoB,iBAAiB;AAAA,EACzC,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,SAAS;AAAA,EACpB,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,aAAa,OAAO,qBAAqB,aAAa;AAC/E,CAAC;AAED,IAAM,qBAAqB,iBAAiB;AAAA,EAC1C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,QAAQ;AAAA,EACnB,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,eAAe,UAAU,KAAK,GAAG;AAC1D,CAAC;AAED,IAAM,mBAAmB,iBAAiB;AAAA,EACxC,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,MAAM;AAAA,EACjB,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,kBAAkB,MAAM;AACjD,CAAC;AAED,IAAM,eAAe,iBAAiB;AAAA,EACpC,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,MAAM;AAAA,EACjB,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,eAAe,UAAU,KAAK,GAAG;AAC1D,CAAC;AAED,IAAM,sBAAsB,iBAAiB;AAAA,EAC3C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,KAAK;AAAA,EAChB,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,eAAe,UAAU,KAAK,GAAG;AAC1D,CAAC;AAID,IAAM,qBAAqB,iBAAiB;AAAA,EAC1C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,cAAc,MAAM;AAC7C,CAAC;AAGD,IAAM,iBAAiB,iBAAiB;AAAA,EACtC,MAAM;AAAA,EACN,aAAa;AAAA,EACb,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,eAAe,UAAU,KAAK,GAAG;AAC1D,CAAC;AAED,IAAM,iBAA2B;AAAA,EAC/B,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,KAAK;AAAA,EAChB,MAAM,SAAS,OAA0C;AACvD,UAAM,QAAQ,KAAK,IAAI;AACvB,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA;AAAA,UACE,eAAe,UAAU,KAAK;AAAA,UAC9B,cAAc;AAAA,QAChB;AAAA,MACF;AACA,YAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,oBAAoB,WAAW,UAAU,SAAS;AACpG,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,8BAA8B,WAAW,UAAU,SAAS;AACjH,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,wCAAmC,WAAW,UAAU,SAAS;AACnH,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,SAAS;AAAA,IACpH,SAAS,KAAK;AACZ,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG,eAAe,QAAQ,IAAI,UAAU,eAAe,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,SAAS;AAAA,IAChK;AAAA,EACF;AACF;AAEA,IAAM,iBAA2B;AAAA,EAC/B,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,YAAY,YAAY,YAAY,YAAY,YAAY,UAAU;AAAA,EACjF,MAAM,SAAS,OAA0C;AACvD,UAAM,QAAQ,KAAK,IAAI;AACvB,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA;AAAA,UACE,eAAe,UAAU,KAAK;AAAA,UAC9B,cAAc;AAAA,QAChB;AAAA,MACF;AACA,YAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,oBAAoB,WAAW,UAAU,SAAS;AACpG,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,8BAA8B,WAAW,UAAU,SAAS;AACjH,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,wCAAmC,WAAW,UAAU,SAAS;AACnH,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,SAAS;AAAA,IACpH,SAAS,KAAK;AACZ,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG,eAAe,QAAQ,IAAI,UAAU,eAAe,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,SAAS;AAAA,IAChK;AAAA,EACF;AACF;AAEA,IAAM,iBAA2B;AAAA,EAC/B,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ,aAAa;AAAA,EAChE,MAAM,SAAS,OAA0C;AACvD,UAAM,QAAQ,KAAK,IAAI;AACvB,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA;AAAA,UACE,eAAe,SAAS,KAAK;AAAA,UAC7B,cAAc;AAAA,UACd,QAAQ;AAAA,QACV;AAAA,MACF;AACA,YAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,kBAAkB,WAAW,UAAU,SAAS;AAClG,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,4BAA4B,WAAW,UAAU,SAAS;AAC/G,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,oCAAoC,WAAW,UAAU,SAAS;AACvH,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,0CAAqC,WAAW,UAAU,SAAS;AACrH,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,SAAS;AAAA,IACpH,SAAS,KAAK;AACZ,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG,eAAe,QAAQ,IAAI,UAAU,eAAe,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,SAAS;AAAA,IAChK;AAAA,EACF;AACF;AAEA,IAAM,cAAwB;AAAA,EAC5B,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,QAAQ,MAAM;AAAA,EACzB,MAAM,SAAS,OAA0C;AACvD,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,QAAI,4BAA4B,KAAK,KAAK,GAAG;AAC3C,aAAO,EAAE,OAAO,MAAM,QAAQ,WAAW,SAAS,oEAAoE,WAAW,UAAU,MAAM;AAAA,IACnJ;AACA,WAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,iCAAiC,WAAW,UAAU,MAAM;AAAA,EACjH;AACF;AAEA,IAAM,eAAyB;AAAA,EAC7B,MAAM;AAAA,EACN,aAAa;AAAA,EACb,MAAM,SAAS,OAAe,KAAyC;AACrE,UAAM,QAAQ,KAAK,IAAI;AAEvB,QAAI,CAAC,KAAK;AACR,aAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,gCAAgC,WAAW,GAAG,UAAU,OAAO;AAAA,IACpH;AAEA,UAAM,YAAY,MAAM,UAAU,GAAG;AACrC,QAAI,WAAW;AACb,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,iBAAiB,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,OAAO;AAAA,IACjI;AAEA,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,YAAY,KAAK;AAAA,QAC5C,eAAe,UAAU,KAAK;AAAA,QAC9B,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,UAAI,cAAc,OAAO,aAAa;AACpC,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,OAAO;AACjH,UAAI,eAAe,OAAO,eAAe;AACvC,eAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,0BAA0B,UAAU,KAAK,WAAW,UAAU,OAAO;AAC1H,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,OAAO;AAAA,IAClH,SAAS,KAAK;AACZ,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG,eAAe,QAAQ,IAAI,UAAU,eAAe,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,OAAO;AAAA,IAC9J;AAAA,EACF;AACF;AAEO,IAAMC,YAAW,IAAI,iBAAiB;AAI7CA,UAAS,SAAS,iBAAiB;AACnCA,UAAS,SAAS,kBAAkB;AACpCA,UAAS,SAAS,cAAc;AAChCA,UAAS,SAAS,gBAAgB;AAClCA,UAAS,SAAS,YAAY;AAC9BA,UAAS,SAAS,mBAAmB;AACrCA,UAAS,SAAS,kBAAkB;AACpCA,UAAS,SAAS,cAAc;AAChCA,UAAS,SAAS,cAAc;AAChCA,UAAS,SAAS,cAAc;AAChCA,UAAS,SAAS,WAAW;AAC7BA,UAAS,SAAS,YAAY;AAK9B,eAAsB,eACpB,OACA,MAC2B;AAC3B,QAAM,WAAW,MAAM,WACnBA,UAAS,IAAI,KAAK,QAAQ,IAC1BA,UAAS,eAAe,KAAK;AAEjC,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,WAAW;AAAA,MACX,UAAU;AAAA,IACZ;AAAA,EACF;AAEA,MAAI,SAAS,SAAS,UAAU,MAAM,eAAe;AACnD,WAAQ,SAAiB,SAAS,OAAO,KAAK,aAAa;AAAA,EAC7D;AAEA,SAAO,SAAS,SAAS,KAAK;AAChC;AAoBA,eAAsB,mBACpB,OACA,cACyB;AACzB,QAAM,WAAW,eACbA,UAAS,IAAI,YAAY,IACzBA,UAAS,eAAe,KAAK;AAEjC,MAAI,CAAC,UAAU;AACb,WAAO,EAAE,SAAS,OAAO,UAAU,QAAQ,SAAS,oCAAoC;AAAA,EAC1F;AAEA,QAAM,YAAY;AAClB,MAAI,UAAU,oBAAoB,UAAU,QAAQ;AAClD,WAAO,UAAU,OAAO,KAAK;AAAA,EAC/B;AAGA,QAAM,SAAsB;AAC5B,QAAM,WAAW,eAAe,EAAE,QAAQ,QAAQ,GAAG,CAAC;AACtD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UAAU,SAAS;AAAA,IACnB,SAAS,aAAa,SAAS,IAAI;AAAA,IACnC;AAAA,EACF;AACF;AAcA,eAAsB,gBACpB,SAC4E;AAC5E,QAAM,UAA0B,CAAC;AAEjC,aAAW,KAAK,SAAS;AACvB,UAAM,aAAa,MAAM,eAAe,EAAE,OAAO;AAAA,MAC/C,UAAU,EAAE;AAAA,MACZ,eAAe,EAAE;AAAA,IACnB,CAAC;AAED,YAAQ,KAAK;AAAA,MACX,KAAK,EAAE;AAAA,MACP;AAAA,MACA,kBAAkB,WAAW,WAAW;AAAA,IAC1C,CAAC;AAAA,EACH;AAEA,QAAM,YAAY,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,EAAE;AAE7D,SAAO,EAAE,SAAS,UAAU,cAAc,GAAG,UAAU;AACzD;;;ACrXO,SAAS,kBAAkB,OAAuB,CAAC,GAAmB;AAC3E,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,QAAM,YAAY,oBAAoB,EAAE,YAAY,CAAC;AAErD,QAAM,cAAc,YAAY;AAAA,IAC9B,GAAG;AAAA,IACH;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,eAAe;AACnB,MAAI,aAAa;AACjB,MAAI,iBAAiB;AAErB,QAAM,UAA2B,YAAY,IAAI,CAAC,UAAU;AAC1D,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM,QAAQ,MAAM;AAEpB,QAAI,OAAO,UAAW;AACtB,QAAI,OAAO,QAAS;AACpB,QAAI,MAAM,iBAAkB;AAE5B,WAAO;AAAA,MACL,KAAK,MAAM;AAAA,MACX,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,kBAAkB,MAAM;AAAA,MACxB,aAAa,MAAM;AAAA,MACnB,WAAW,CAAC,EAAE,MAAM,UAAU,UAAU,OAAO,KAAK,MAAM,SAAS,MAAM,EAAE,SAAS;AAAA,MACpF,WAAW,OAAO,aAAa;AAAA,MAC/B,SAAS,OAAO,WAAW;AAAA,MAC3B,eAAe,OAAO,iBAAiB;AAAA,MACvC,aAAa,MAAM,eAAe;AAAA,MAClC,cAAc,MAAM,kBAAkB;AAAA,MACtC,gBAAgB,MAAM;AAAA,IACxB;AAAA,EACF,CAAC;AAGD,MAAI,WAAuC;AAC3C,QAAM,SAAS,kBAAkB,WAAW;AAC5C,MAAI,QAAQ,SAAS;AACnB,UAAM,eAAe,OAAO,KAAK,OAAO,OAAO;AAC/C,UAAM,eAAe,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AACtD,UAAM,UAAU,aAAa,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AAC/D,eAAW,EAAE,UAAU,aAAa,QAAQ,QAAQ;AAAA,EACtD;AAGA,QAAM,eAAe,WAAW,EAAE,OAAO,GAAG,CAAC;AAC7C,QAAM,gBAAgB,aAAa,IAAI,CAAC,OAAO;AAAA,IAC7C,QAAQ,EAAE;AAAA,IACV,KAAK,EAAE;AAAA,IACP,QAAQ,EAAE;AAAA,IACV,WAAW,EAAE;AAAA,EACf,EAAE;AAEF,SAAO;AAAA,IACL;AAAA,IACA,aAAa,YACT,EAAE,KAAK,UAAU,KAAK,QAAQ,UAAU,OAAO,IAC/C;AAAA,IACJ;AAAA,IACA,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqBC,UAAiB,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IACvE,cAAc,SAAY,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAC3D,YAAY,UAAU,EAAE;AAAA,IACxB;AAAA,EACF;AACF;;;ACzHA,SAAS,eAAe,gBAAAC,eAAc,kBAAkB;AAMjD,SAAS,wBAAwBC,UAAwB;AAC9D,EAAAA,SACG,QAAQ,SAAS,EACjB,MAAM,UAAU,EAChB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,6CAA6C,EAC9D,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,kBAAkB,IAAI;AAEtC,QAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,cAAQ,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAC5C;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,kCAAkC,CAAC,EAAE;AAC5E,YAAQ,IAAI,cAAc,EAAE,KAAK,QAAQ,WAAW,CAAC,EAAE;AAEvD,QAAI,QAAQ,aAAa;AACvB,cAAQ;AAAA,QACN,kBAAkB,SAAS,QAAQ,YAAY,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,YAAY,MAAM,GAAG,CAAC;AAAA,MACjG;AAAA,IACF;AAEA,YAAQ;AAAA,MACN;AAAA,EAAK,EAAE,KAAK,YAAY,CAAC,IAAI,QAAQ,YAAY,WAAW,EAAE,IAAI,IAAI,QAAQ,YAAY,aAAa,QAAQ,UAAU,WAAW,QAAQ,cAAc,aAAa,CAAC;AAAA,IAC1K;AACA,eAAW,KAAK,QAAQ,SAAS;AAC/B,YAAM,OAAO,EAAE,MAAM,SAAS,EAAE,IAAI,KAAK,EAAE,KAAK,KAAK,GAAG,CAAC,GAAG,IAAI;AAChE,YAAM,QAAkB,CAAC;AACzB,UAAI,EAAE,iBAAkB,OAAM,KAAK,EAAE,OAAO,QAAQ,CAAC;AACrD,UAAI,EAAE,YAAa,OAAM,KAAK,EAAE,QAAQ,KAAK,CAAC;AAC9C,UAAI,EAAE,UAAW,OAAM,KAAK,EAAE,KAAK,eAAe,CAAC;AACnD,UAAI,EAAE,UAAW,OAAM,KAAK,EAAE,IAAI,SAAS,CAAC;AAAA,eACnC,EAAE,QAAS,OAAM,KAAK,EAAE,OAAO,OAAO,CAAC;AAChD,YAAM,UAAU,MAAM,SAAS,IAAI,MAAM,KAAK,GAAG,CAAC,KAAK;AACvD,cAAQ;AAAA,QACN,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO;AAAA,MAC9D;AAAA,IACF;AAEA,QAAI,QAAQ,UAAU;AACpB,cAAQ;AAAA,QACN;AAAA,EAAK,EAAE,KAAK,aAAa,CAAC,IAAI,QAAQ,SAAS,QAAQ;AAAA,MACzD;AACA,UAAI,QAAQ,SAAS,QAAQ,SAAS,GAAG;AACvC,gBAAQ;AAAA,UACN,OAAO,EAAE,IAAI,UAAU,CAAC,IAAI,QAAQ,SAAS,QAAQ,KAAK,IAAI,CAAC;AAAA,QACjE;AAAA,MACF,OAAO;AACL,gBAAQ;AAAA,UACN,OAAO,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,YAAQ;AAAA,MACN;AAAA,EAAK,EAAE,KAAK,cAAc,CAAC,IAAI,QAAQ,oBAAoB,KAAK,IAAI,KAAK,MAAM;AAAA,IACjF;AACA,YAAQ;AAAA,MACN,GAAG,EAAE,KAAK,kBAAkB,CAAC,IAAI,QAAQ,aAAa,KAAK,IAAI,KAAK,MAAM;AAAA,IAC5E;AACA,YAAQ,IAAI,GAAG,EAAE,KAAK,UAAU,CAAC,IAAI,QAAQ,UAAU,aAAa;AAEpE,QAAI,QAAQ,cAAc,SAAS,GAAG;AACpC,cAAQ;AAAA,QACN;AAAA,EAAK,EAAE,KAAK,oBAAoB,CAAC,UAAU,QAAQ,cAAc,MAAM;AAAA,MACzE;AACA,iBAAW,KAAK,QAAQ,cAAc,MAAM,GAAG,CAAC,GAAG;AACjD,cAAM,KAAK,IAAI,KAAK,EAAE,SAAS,EAAE,mBAAmB;AACpD,gBAAQ;AAAA,UACN,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,MAAM,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,MAAM,GAAG,CAAC;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,OAAO,EACf,YAAY,wDAAwD,EACpE,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,cAAc,IAAI,eAAe,QAAQ,IAAI;AACnD,UAAM,SAAS,kBAAkB,WAAW;AAE5C,QAAI,CAAC,QAAQ,WAAW,OAAO,KAAK,OAAO,OAAO,EAAE,WAAW,GAAG;AAChE,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,4CAA4C;AAAA,MACpE;AACA,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,UAAM,WAKD,CAAC;AAEN,eAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AAC5D,YAAM,SAAS,YAAY,KAAK,EAAE,aAAa,QAAQ,MAAM,CAAC;AAE9D,UAAI,CAAC,QAAQ;AACX,iBAAS,KAAK;AAAA,UACZ;AAAA,UACA,QAAQ,SAAS,aAAa,QAAQ,YAAY;AAAA,UAClD,aAAa,SAAS;AAAA,QACxB,CAAC;AACD;AAAA,MACF;AAEA,YAAM,QAAQ,WAAW,OAAO,QAAQ;AACxC,eAAS,KAAK;AAAA,QACZ;AAAA,QACA,QAAQ,MAAM,YAAY,YAAY,MAAM,UAAU,UAAU;AAAA,QAChE,aAAa,SAAS;AAAA,QACtB,GAAI,MAAM,WAAW,CAAC,MAAM,YACxB,EAAE,iBAAiB,MAAM,gBAAgB,IACzC,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE;AAC1D,UAAM,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE;AAC/D,UAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE;AACpE,UAAM,aAAa,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,OAAO,EAAE;AAChE,UAAM,QAAQ,OAAO,KAAK,OAAO,OAAO,EAAE;AAE1C,QACE,SAASA,UAAS,KAAK;AAAA,MACrB;AAAA,MACA,SAAS;AAAA,MACT,SAAS,EAAE,OAAO,SAAS,SAAS,SAAS,cAAc,OAAO,WAAW;AAAA,MAC7E,OAAO,YAAY;AAAA,IACrB,CAAC,GACD;AACA,UAAI,UAAU,EAAG,SAAQ,WAAW;AACpC;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,EAAE,KAAK;AAAA,IAAO,QAAQ,MAAM;AAAA,CAAkC;AAAA,IAChE;AAEA,eAAW,KAAK,UAAU;AACxB,YAAM,OAAO,EAAE,cAAc,EAAE,IAAI,UAAK,EAAE,WAAW,EAAE,IAAI;AAC3D,UAAI,EAAE,WAAW,WAAW;AAC1B,gBAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,IAAI,IAAI,EAAE;AAAA,MACtF,WAAW,EAAE,WAAW,oBAAoB;AAC1C,gBAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,mBAAmB,CAAC,IAAI,IAAI,EAAE;AAAA,MAChG,WAAW,EAAE,WAAW,WAAW;AACjC,gBAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,IAAI,IAAI,EAAE;AAAA,MACrG,WAAW,EAAE,WAAW,SAAS;AAC/B,gBAAQ,IAAI,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,UAAU,EAAE,eAAe,IAAI,CAAC,IAAI,IAAI,EAAE;AAAA,MACpH,OAAO;AACL,gBAAQ,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,IAAI,EAAE;AAAA,MACrF;AAAA,IACF;AAEA,YAAQ;AAAA,MACN;AAAA,IAAO,EAAE,KAAK,GAAG,KAAK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,YAAY,UAAU,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,UAAU,CAAC;AAAA,IAC/K;AAEA,QAAI,UAAU,GAAG;AACf,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,IAAI,uDAAkD,CAAC;AAAA,MAClE;AAAA,IACF,WAAW,eAAe,GAAG;AAC3B,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,OAAO,iDAAiD,CAAC;AAAA,MACpE;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,MAAM,GAAG,QAAQ,KAAK,wDAAmD,CAAC;AAAA,MACrF;AAAA,IACF;AAEA,YAAQ,IAAI;AAEZ,QAAI,UAAU,EAAG,SAAQ,KAAK,CAAC;AAAA,EACjC,CAAC;AAEH,EAAAA,SACG,QAAQ,KAAK,EACb,YAAY,2DAA2D,EACvE,OAAO,yBAAyB,4BAA4B,EAC5D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,SAAS,oBAAoB;AAAA,MACjC,aAAa,IAAI,eAAe,QAAQ,IAAI;AAAA,IAC9C,CAAC;AAED,QAAI,SAASA,UAAS,KAAK,EAAE,aAAa,OAAO,CAAC,EAAG;AAErD,QAAI,QAAQ;AACV,cAAQ;AAAA,QACN,GAAG,QAAQ,GAAG,IAAI,EAAE,KAAK,wBAAwB,CAAC,IAAI,SAAS,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,YAAY,OAAO,MAAM,GAAG,CAAC;AAAA,MACnH;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB;AAAA,IACC;AAAA,EACF,EACC,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,uBAAuB,uCAAuC,EACrE,OAAO,mBAAmB,8CAA8C,EACxE,OAAO,aAAa,kDAAkD,EACtE,OAAO,OAAO,QAAQ;AACrB,UAAM,cAAc,IAAI,eAAe,QAAQ,IAAI;AACnD,UAAM,SAAS,kBAAkB,WAAW;AAE5C,QACE,IAAI,UACJ,WAAW,IAAI,MAAM,KACrB,CAAE,MAAM,QAAQ,sBAAsB,IAAI,MAAM,KAAK,EAAE,WAAW,IAAI,IAAI,CAAC,GAC3E;AACA,cAAQ,MAAM,EAAE,IAAI,UAAU,CAAC;AAC/B,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,WAAW,OAAO,KAAK,OAAO,OAAO,EAAE,WAAW,GAAG;AAChE,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,4CAA4C;AAAA,MACpE;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,QAAkB,CAAC;AACzB,UAAM,WAAqB,CAAC;AAE5B,eAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AAC5D,YAAM,QAAQ,UAAU,KAAK,EAAE,GAAG,MAAM,aAAa,QAAQ,MAAM,CAAC;AAEpE,UAAI,UAAU,MAAM;AAClB,YAAI,SAAS,aAAa,OAAO;AAC/B,mBAAS,KAAK,uBAAuB,GAAG,EAAE;AAAA,QAC5C;AACA,cAAM;AAAA,UACJ,KAAK,GAAG,KAAK,SAAS,cAAc,KAAK,SAAS,WAAW,KAAK,EAAE;AAAA,QACtE;AACA;AAAA,MACF;AAEA,YAAM,SAAS,YAAY,KAAK,EAAE,aAAa,QAAQ,MAAM,CAAC;AAC9D,UAAI,QAAQ;AACV,cAAM,QAAQ,WAAW,OAAO,QAAQ;AACxC,YAAI,MAAM,WAAW;AACnB,mBAAS,KAAK,YAAY,GAAG,EAAE;AAAA,QACjC,WAAW,MAAM,SAAS;AACxB,mBAAS,KAAK,UAAU,MAAM,eAAe,OAAO,GAAG,EAAE;AAAA,QAC3D;AAAA,MACF;AAEA,YAAM,UAAU,MACb,QAAQ,OAAO,MAAM,EACrB,QAAQ,MAAM,KAAK,EACnB,QAAQ,OAAO,KAAK;AACvB,YAAM,KAAK,GAAG,GAAG,KAAK,OAAO,GAAG;AAAA,IAClC;AAEA,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI;AAElC,QAAI,IAAI,QAAQ;AACd,oBAAc,IAAI,QAAQ,MAAM;AAChC,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,OAAO,KAAK,OAAO,OAAO,EAAE,MAAM;AAAA,MACvG;AAAA,IACF,OAAO;AACL,cAAQ,OAAO,MAAM,MAAM;AAAA,IAC7B;AAEA,QAAI,SAAS,SAAS,KAAK,QAAQ,OAAO,OAAO;AAC/C,cAAQ,MAAM;AACd,iBAAW,KAAK,UAAU;AACxB,gBAAQ,MAAM,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC,IAAI,CAAC,EAAE;AAAA,MACrD;AACA,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,eAAe,EACvB;AAAA,IACC;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,iBAAiB,sCAAsC,EAC9D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,eAAe,EACvC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,aAAa,qDAAqD,EACzE,OAAO,OAAO,MAAc,QAAQ;AACnC,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,SAAS,KAAK,YAAY,EAAE,QAAQ,cAAc,GAAG;AAC3D,UAAM,OAAO,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC,KAAK;AAAA,MAChE,KAAK,YAAY;AAAA,IACnB;AACA,UAAM,WAAW,IAAI;AAErB,QAAI;AACJ,QAAI,IAAI,MAAM;AACZ,iBAAW,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,IAC5D,OAAO;AACL,iBAAW,CAAC,GAAG,MAAM,YAAY,GAAG,MAAM,aAAa;AAAA,IACzD;AAIA,UAAM,WAAW,SAAS,OAAO,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAC1D,QACE,SAAS,SAAS,KAClB,CAAE,MAAM;AAAA,MACN,GAAG,SAAS,MAAM,2EAA2E,SAAS,KAAK,IAAI,CAAC;AAAA,MAChH,EAAE,WAAW,IAAI,IAAI;AAAA,IACvB,GACA;AACA,cAAQ,MAAM,EAAE,IAAI,UAAU,CAAC;AAC/B,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,uBAAuB,IAAI,EAAE,CAAC;AAAA,CAAI;AAEzE,eAAW,OAAO,UAAU;AAC1B,YAAM,QAAQ,eAAe;AAAA,QAC3B,QAAQ;AAAA,QACR,QAAQ,GAAG,OAAO,YAAY,CAAC;AAAA,MACjC,CAAC;AACD,gBAAU,KAAK,OAAO;AAAA,QACpB,GAAG;AAAA,QACH;AAAA,QACA;AAAA,QACA,aAAa,gCAAgC,IAAI;AAAA,MACnD,CAAC;AACD,cAAQ,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,YAAY,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,IAClE;AAEA,UAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,UAAM,eAAe,GAAG,WAAW;AACnC,QAAI,SAKA,CAAC;AACL,QAAI;AACF,UAAI,WAAW,YAAY,GAAG;AAC5B,iBAAS,KAAK,MAAMC,cAAa,cAAc,MAAM,CAAC;AAAA,MACxD;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,QAAI,CAAC,OAAO,QAAS,QAAO,UAAU,CAAC;AACvC,eAAW,OAAO,UAAU;AAC1B,aAAO,QAAQ,GAAG,IAAI;AAAA,QACpB,UAAU;AAAA,QACV,aAAa,GAAG,IAAI;AAAA,QACpB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,IACF;AAEA,kBAAc,cAAc,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,MAAM,MAAM;AAC1E,YAAQ;AAAA,MACN,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,YAAY,EAAE,IAAI,cAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,UAAU;AAChB,iBAAW,OAAO,UAAU;AAC1B,qBAAa;AAAA,UACX,MAAM;AAAA,UACN,OAAO;AAAA,YACL;AAAA,YACA,QAAQ,CAAC,SAAuB,QAAsB;AAAA,UACxD;AAAA,UACA,SAAS,IAAI;AAAA,UACb,aAAa,GAAG,IAAI;AAAA,UACpB,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,cAAQ;AAAA,QACN,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,qBAAqB,EAAE,IAAI,IAAI,QAAQ,CAAC;AAAA,MACrE;AAAA,IACF;AAEA,YAAQ;AAAA,MACN;AAAA,IAAO,EAAE,MAAM,OAAO,CAAC,aAAa,IAAI,mBAAmB,SAAS,MAAM;AAAA;AAAA,IAC5E;AAAA,EACF,CAAC;AACL;;;ACnbA;AAAA,EACE,eAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,SAAS;AAElB,IAAM,YAAY;AAClB,IAAM,aAAa;AAEnB,IAAM,YAAY;AAClB,IAAM,cAAc;AAEpB,IAAM,oBAAoB;AAE1B,IAAM,2BAA2B;AA2B1B,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,GAAG,EAAE,QAAQ,CAAC;AAAA,EACd,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,IAAI,EAAE,OAAO;AAAA,EACb,KAAK,EAAE,OAAO;AAAA,EACd,WAAW,EAAE,OAAO;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO,EAAE,SAAS;AAC5B,CAAC;AAEM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,SAAS,EAAE;AAAA,IACT,EAAE,OAAO;AAAA,MACP,KAAK,EAAE,OAAO;AAAA,MACd,OAAO,EAAE,OAAO;AAAA,MAChB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA,EACA,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAED,SAAS,UACP,YACA,MACA,aAAqB,mBACb;AACR,SAAO,WAAW,YAAY,MAAM,YAAY,YAAY,QAAQ;AACtE;AAKO,SAAS,aACd,SACA,YACQ;AACR,QAAM,UAA2B;AAAA,IAC/B;AAAA,IACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AAEA,QAAM,YAAY,KAAK,UAAU,OAAO;AACxC,QAAM,OAAOA,aAAY,WAAW;AACpC,QAAM,KAAKA,aAAY,SAAS;AAChC,QAAM,MAAM,UAAU,YAAY,MAAM,iBAAiB;AAEzD,QAAM,SAAS,eAAe,WAAW,KAAK,EAAE;AAChD,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACf,CAAC;AACD,QAAM,MAAM,OAAO,WAAW;AAE9B,QAAM,SAAyB;AAAA,IAC7B,GAAG;AAAA,IACH,MAAM,UAAU,SAAS,QAAQ;AAAA,IACjC,MAAM,KAAK,SAAS,QAAQ;AAAA,IAC5B,IAAI,GAAG,SAAS,QAAQ;AAAA,IACxB,KAAK,IAAI,SAAS,QAAQ;AAAA,IAC1B,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,OAAO,QAAQ;AAAA,IACf,MAAM;AAAA,EACR;AAEA,SAAO,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,EAAE,SAAS,QAAQ;AAC9D;AAKO,SAAS,eACd,SACA,YACiB;AACjB,MAAI;AACJ,MAAI;AACF,iBAAa,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM;AAAA,EAC7D,QAAQ;AACN,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,MAAI;AACJ,MAAI;AACF,gBAAY,KAAK,MAAM,UAAU;AAAA,EACnC,QAAQ;AACN,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAEA,QAAM,eAAe,qBAAqB,UAAU,SAAS;AAC7D,MAAI,CAAC,aAAa,SAAS;AACzB,UAAM,IAAI;AAAA,MACR,+CAA+C,aAAa,MAAM,OAAO;AAAA,IAC3E;AAAA,EACF;AACA,QAAM,SAAS,aAAa;AAE5B,QAAM,OAAO,OAAO,KAAK,OAAO,MAAM,QAAQ;AAC9C,QAAM,KAAK,OAAO,KAAK,OAAO,IAAI,QAAQ;AAC1C,QAAM,MAAM,OAAO,KAAK,OAAO,KAAK,QAAQ;AAC5C,QAAM,YAAY,OAAO,KAAK,OAAO,MAAM,QAAQ;AACnD,QAAM,MAAM,UAAU,YAAY,MAAM,OAAO,QAAQ,wBAAwB;AAE/E,QAAM,WAAW,iBAAiB,WAAW,KAAK,EAAE;AACpD,WAAS,WAAW,GAAG;AAEvB,MAAI;AACJ,MAAI;AACF,gBAAY,OAAO,OAAO;AAAA,MACxB,SAAS,OAAO,SAAS;AAAA,MACzB,SAAS,MAAM;AAAA,IACjB,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI,MAAM,mFAAmF;AAAA,EACrG;AAEA,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,UAAU,SAAS,MAAM,CAAC;AAAA,EACpD,QAAQ;AACN,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AAEA,QAAM,UAAU,sBAAsB,UAAU,UAAU;AAC1D,MAAI,CAAC,QAAQ,SAAS;AACpB,UAAM,IAAI;AAAA,MACR,0CAA0C,QAAQ,MAAM,OAAO;AAAA,IACjE;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;;;AC3JO,SAAS,wBAAwBC,UAAwB;AAC9D,EAAAA,SACG,QAAQ,UAAU,EAClB,MAAM,KAAK,EACX,YAAY,iDAAiD,EAC7D;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,qBAAqB,iCAAiC,EAC7D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,sBAAsB,EAC7C,OAAO,iBAAiB,uBAAuB,EAC/C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,CAAC,QAAQ;AACf,UAAM,SAAS,eAAe;AAAA,MAC5B,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,IACd,CAAC;AAED,UAAM,UAAU,gBAAgB,MAAM;AAEtC,QAAI,IAAI,MAAM;AACZ,YAAM,OAAO,UAAU,GAAG;AAC1B,gBAAU,IAAI,MAAM,QAAQ,IAAI;AAChC,cAAQ;AAAA,QACN,GAAG,QAAQ,OAAO,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,MAAM,KAAK,OAAO,gBAAgB,CAAC;AAAA,MAC7H;AAAA,IACF,OAAO;AACL,cAAQ,OAAO,MAAM,MAAM;AAC3B,UAAI,QAAQ,OAAO,OAAO;AACxB,gBAAQ;AAAA,UACN;AAAA,EAAK,EAAE,IAAI,WAAW,IAAI,MAAM,gBAAgB,OAAO,OAAO,CAAC;AAAA,QACjE;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,kCAAkC,EAC1C,YAAY,wDAAmD,EAC/D,OAAO,gBAAgB,sBAAsB,EAC7C,OAAO,2BAA2B,qBAAqB,EACvD,OAAO,2BAA2B,qBAAqB,EACvD,OAAO,CAAC,WAAmB,WAAmB,QAAQ;AACrD,UAAM,aAA6B;AAAA,MACjC,OAAO,IAAI,gBAAgB,YAAY;AAAA,MACvC,aAAa,IAAI,iBAAiB,QAAQ,IAAI;AAAA,MAC9C,QAAQ;AAAA,IACV;AACA,UAAM,aAA6B;AAAA,MACjC,OAAO,IAAI,gBAAgB,YAAY;AAAA,MACvC,aAAa,IAAI,iBAAiB,QAAQ,IAAI;AAAA,MAC9C,QAAQ;AAAA,IACV;AAEA,oBAAgB,WAAW,YAAY,WAAW,UAAU;AAC5D,YAAQ;AAAA,MACN,GAAG,QAAQ,IAAI,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,KAAK,SAAS,CAAC;AAAA,IACnG;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,qCAAqC,EAC7C,YAAY,8BAA8B,EAC1C,OAAO,gBAAgB,sBAAsB,EAC7C,OAAO,2BAA2B,qBAAqB,EACvD,OAAO,2BAA2B,qBAAqB,EACvD,OAAO,CAAC,WAAmB,WAAmB,QAAQ;AACrD,UAAM,aAA6B;AAAA,MACjC,OAAO,IAAI,gBAAgB,YAAY;AAAA,MACvC,aAAa,IAAI,iBAAiB,QAAQ,IAAI;AAAA,MAC9C,QAAQ;AAAA,IACV;AACA,UAAM,aAA6B;AAAA,MACjC,OAAO,IAAI,gBAAgB,YAAY;AAAA,MACvC,aAAa,IAAI,iBAAiB,QAAQ,IAAI;AAAA,MAC9C,QAAQ;AAAA,IACV;AAEA,uBAAmB,WAAW,YAAY,WAAW,UAAU;AAC/D,YAAQ;AAAA,MACN,GAAG,QAAQ,IAAI,IAAI,EAAE,OAAO,cAAc,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,KAAK,SAAS,CAAC;AAAA,IACxG;AAAA,EACF,CAAC;AAIH,QAAM,SAASA,SACZ,QAAQ,QAAQ,EAChB,YAAY,iDAAiD;AAEhE,SACG,QAAQ,gBAAgB,EACxB,YAAY,8CAA8C,EAC1D,OAAO,mBAAmB,+BAA+B,QAAQ,EACjE,OAAO,mBAAmB,+BAA+B,QAAQ,EACjE,OAAO,CAAC,OAAe,QAAQ;AAC9B,UAAM,KAAK,aAAa,OAAO;AAAA,MAC7B,YAAY,IAAI;AAAA,MAChB,UAAU,IAAI;AAAA,IAChB,CAAC;AAED,YAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,QAAQ,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;AAErE,UAAM,SAAmB,CAAC;AAC1B,QAAI,IAAI,IAAK,QAAO,KAAK,OAAO,IAAI,GAAG,GAAG;AAC1C,QAAI,IAAI,SAAU,QAAO,KAAK,aAAa,IAAI,QAAQ,EAAE;AACzD,QAAI,OAAO,OAAQ,SAAQ,IAAI,EAAE,IAAI,KAAK,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC;AAAA,EACjE,CAAC;AAEH,SACG,QAAQ,WAAW,EACnB,YAAY,4CAA4C,EACxD,OAAO,CAAC,OAAe;AACtB,UAAM,QAAQ,WAAW,EAAE;AAC3B,QAAI,UAAU,MAAM;AAClB,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,EAAE,wBAAwB;AAAA,MAC9D;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,OAAO,MAAM,KAAK;AAAA,EAC5B,CAAC;AAEH,SACG,QAAQ,cAAc,EACtB,YAAY,uCAAuC,EACnD,OAAO,CAAC,OAAe;AACtB,UAAM,YAAY,cAAc,EAAE;AAClC,QAAI,WAAW;AACb,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE;AAAA,IAC9D,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,EAAE,aAAa,CAAC;AAChE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,SACG,QAAQ,MAAM,EACd,MAAM,IAAI,EACV,YAAY,qBAAqB,EACjC,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,UAAU,WAAW;AAC3B,QAAI,SAASA,UAAS,KAAK,EAAE,QAAQ,CAAC,EAAG;AACzC,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,EAAE,IAAI,mBAAmB,CAAC;AACtC;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,EAAE,KAAK;AAAA,IAAO,QAAQ,KAAK,oBAAoB,QAAQ,MAAM;AAAA,CAAK;AAAA,IACpE;AACA,eAAW,KAAK,SAAS;AACvB,YAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;AAC3B,YAAM,KAAK,EAAE,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC;AAC3C,UAAI,EAAE,SAAU,OAAM,KAAK,EAAE,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACtD,UAAI,EAAE,WAAW;AACf,cAAM,YAAY,KAAK;AAAA,UACrB;AAAA,UACA,KAAK,OAAO,EAAE,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,QAC9C;AACA,cAAM,KAAK,EAAE,IAAI,YAAY,SAAS,GAAG,CAAC;AAAA,MAC5C;AACA,cAAQ,IAAI,KAAK,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,CAAC,EAAE;AAAA,IACtD;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAIH,QAAM,KAAKA,SACR,QAAQ,UAAU,EAClB,MAAM,IAAI,EACV,YAAY,kDAAkD;AAEjE,KAAG,QAAQ,MAAM,EACd,YAAY,uCAAuC,EACnD,OAAO,qBAAqB,mCAAmC,EAC/D,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,OAAO,QAAQ;AACrB,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,aAAa,MAAM;AAAA,MACvB,GAAG,QAAQ,IAAI;AAAA,IACjB;AACA,QAAI,CAAC,YAAY;AACf,cAAQ,MAAM,EAAE,IAAI,qBAAqB,CAAC;AAC1C,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,UAAU,YAAY,IAAI;AAChC,QAAI;AACJ,QAAI,IAAI,MAAM;AACZ,aAAO,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,IACxD;AAEA,UAAM,UAA4D,CAAC;AACnE,eAAW,SAAS,SAAS;AAC3B,UAAI,QAAQ,CAAC,KAAK,SAAS,MAAM,GAAG,EAAG;AACvC,YAAM,QAAQ,UAAU,MAAM,KAAK,EAAE,GAAG,MAAM,OAAO,MAAM,MAAM,CAAC;AAClE,UAAI,UAAU,MAAM;AAClB,gBAAQ,KAAK,EAAE,KAAK,MAAM,KAAK,OAAO,OAAO,MAAM,MAAM,CAAC;AAAA,MAC5D;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,MAAM,EAAE,IAAI,oBAAoB,CAAC;AACzC,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,SAAS,aAAa,SAAS,UAAU;AAC/C,YAAQ,OAAO,MAAM,MAAM;AAC3B,QAAI,QAAQ,OAAO,OAAO;AACxB,cAAQ;AAAA,QACN;AAAA,EAAK,QAAQ,OAAO,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,QAAQ,MAAM;AAAA,MAC7D;AAAA,IACF;AAAA,EACF,CAAC;AAEH,KAAG,QAAQ,iBAAiB,EACzB,YAAY,oDAAoD,EAChE,OAAO,gBAAgB,wBAAwB,EAC/C,OAAO,iBAAiB,yBAAyB,EACjD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,aAAa,4CAA4C,EAChE,OAAO,aAAa,2CAA2C,EAC/D,OAAO,OAAO,QAA4B,QAAQ;AACjD,QAAI,CAAC,QAAQ;AACX,YAAM,SAAmB,CAAC;AAC1B,uBAAiB,SAAS,QAAQ,OAAO;AACvC,eAAO,KAAK,KAAK;AAAA,MACnB;AACA,eAAS,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,KAAK;AAAA,IACvD;AAEA,UAAM,aAAa,MAAM;AAAA,MACvB,GAAG,QAAQ,IAAI;AAAA,IACjB;AAIA,QAAI;AACJ,QAAI;AACF,gBAAU,eAAe,QAAQ,UAAU;AAAA,IAC7C,QAAQ;AACN,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK;AAAA,QAClB;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,IAAI,QAAQ;AACd,cAAQ;AAAA,QACN;AAAA,EAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,cAAc,CAAC,KAAK,QAAQ,QAAQ,MAAM;AAAA;AAAA,MAC3E;AACA,iBAAW,KAAK,QAAQ,SAAS;AAC/B,gBAAQ;AAAA,UACN,KAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS,QAAQ,GAAG,CAAC;AAAA,QACxE;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,OAAO,UAAU,GAAG;AAE1B,UAAM,WAAW,QAAQ,QACtB,IAAI,CAAC,MAAM,EAAE,GAAG,EAChB,OAAO,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AACnC,QACE,SAAS,SAAS,KAClB,CAAE,MAAM;AAAA,MACN,GAAG,SAAS,MAAM,4CAA4C,SAAS,KAAK,IAAI,CAAC;AAAA,MACjF,EAAE,WAAW,IAAI,IAAI;AAAA,IACvB,GACA;AACA,cAAQ,MAAM,EAAE,IAAI,UAAU,CAAC;AAC/B,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,eAAW,KAAK,QAAQ,SAAS;AAC/B,gBAAU,EAAE,KAAK,EAAE,OAAO,IAAI;AAAA,IAChC;AAEA,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,QAAQ,QAAQ,MAAM;AAAA,IACnE;AAAA,EACF,CAAC;AACL;;;ACxTO,SAAS,2BAA2BC,UAAwB;AACjE,EAAAA,SACG,QAAQ,gBAAgB,EACxB,YAAY,4DAA4D,EACxE,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,yBAAyB,uBAAuB,EACvD;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,oBAAoB,8BAA8B,EACzD,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,KAAyB,QAAQ;AAC9C,QAAI,IAAI,eAAe;AACrB,UAAI,SAASA,UAAS,KAAK,EAAE,WAAWC,UAAiB,cAAc,EAAE,CAAC,GAAG;AAC3E;AAAA,MACF;AACA,cAAQ;AAAA,QACN,EAAE,KAAK;AAAA,IAAO,QAAQ,MAAM;AAAA,CAAmC;AAAA,MACjE;AACA,iBAAW,KAAKA,UAAiB,cAAc,GAAG;AAChD,cAAM,WAAW,EAAE,UAAU,SACzB,EAAE,IAAI,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC,GAAG,IACnC;AACJ,gBAAQ;AAAA,UACN,KAAK,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ;AAAA,QAC5D;AAAA,MACF;AACA,cAAQ,IAAI;AACZ;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,CAAC,IAAI,KAAK;AACpB,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,kCAAkC,CAAC;AACvE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,OAAO,UAAU,GAAG;AAE1B,QAAI,IAAI,KAAK;AACX,UAAI,UAAU,YAAY,IAAI;AAC9B,YAAM,cAAc,IAAI,eAAe,QAAQ,IAAI;AAEnD,UAAI,IAAI,UAAU;AAChB,cAAM,SAAS,kBAAkB,WAAW;AAC5C,YAAI,QAAQ,SAAS;AACnB,gBAAM,eAAe,IAAI,IAAI,OAAO,KAAK,OAAO,OAAO,CAAC;AACxD,oBAAU,QAAQ,OAAO,CAAC,MAAM,aAAa,IAAI,EAAE,GAAG,CAAC;AAAA,QACzD;AAAA,MACF;AAEA,YAAM,WAAW,gBAAgBD,UAAS,GAAG;AAC7C,UAAI,CAAC,UAAU;AACb,gBAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,MAAM;AAAA,CAAuB,CAAC;AAAA,MAClE;AAEA,UAAI,YAAY;AAChB,UAAI,UAAU;AACd,YAAM,cAMD,CAAC;AAEN,iBAAW,SAAS,SAAS;AAC3B,cAAME,SAAQ,UAAU,MAAM,KAAK,EAAE,GAAG,MAAM,OAAO,MAAM,MAAM,CAAC;AAClE,YAAI,CAACA,QAAO;AACV;AACA;AAAA,QACF;AAEA,cAAMC,YAAW,MAAM,UAAU,KAAK,YAAY,IAAI;AACtD,cAAMC,UAAS,MAAM,eAAeF,QAAO,EAAE,UAAUC,UAAS,CAAC;AAEjE,YAAIC,QAAO,WAAW,WAAW;AAC/B;AACA;AAAA,QACF;AAEA;AACA,YAAI,UAAU;AACZ,sBAAY,KAAK;AAAA,YACf,KAAK,MAAM;AAAA,YACX,QAAQA,QAAO;AAAA,YACf,UAAUA,QAAO;AAAA,YACjB,WAAWA,QAAO;AAAA,YAClB,SAASA,QAAO,WAAW,UAAUA,QAAO,UAAU;AAAA,UACxD,CAAC;AACD;AAAA,QACF;AACA,cAAMC,QACJD,QAAO,WAAW,UACd,EAAE,MAAM,QAAQ,KAAK,IACrBA,QAAO,WAAW,YAChB,EAAE,IAAI,QAAQ,KAAK,IACnB,EAAE,OAAO,QAAQ,OAAO;AAChC,cAAM,aACJA,QAAO,WAAW,UACd,EAAE,MAAM,OAAO,IACfA,QAAO,WAAW,YAChB,EAAE,IAAI,SAAS,IACf,EAAE,OAAO,OAAO;AAExB,gBAAQ;AAAA,UACN,KAAKC,KAAI,IAAI,EAAE,KAAK,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,UAAU,KAAK,EAAE,IAAI,IAAID,QAAO,QAAQ,KAAKA,QAAO,SAAS,KAAK,CAAC,GAAGA,QAAO,WAAW,UAAU,IAAI,EAAE,IAAI,YAAOA,QAAO,OAAO,CAAC,KAAK,EAAE;AAAA,QACxL;AAAA,MACF;AAEA,UAAI,UAAU;AACZ,iBAASJ,UAAS,KAAK,EAAE,SAAS,aAAa,WAAW,QAAQ,CAAC;AACnE;AAAA,MACF;AAEA,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,IAAI,GAAG,SAAS,eAAe,OAAO,wBAAwB,CAAC;AAAA;AAAA,MAC1E;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,UAAU,KAAM,IAAI;AAClC,QAAI,CAAC,OAAO;AACV,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,GAAG,aAAa,CAAC;AACjE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,WAAW,YAAY,KAAM,IAAI;AACvC,UAAM,WAAW,UAAU,SAAS,KAAK,YAAY,IAAI;AACzD,UAAM,SAAS,MAAM,eAAe,OAAO,EAAE,UAAU,SAAS,CAAC;AAEjE,QACE,SAASA,UAAS,KAAK;AAAA,MACrB;AAAA,MACA,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,WAAW,OAAO;AAAA,MAClB,SAAS,OAAO;AAAA,IAClB,CAAC,GACD;AACA;AAAA,IACF;AAEA,UAAM,OACJ,OAAO,WAAW,UACd,EAAE,MAAM,QAAQ,KAAK,IACrB,OAAO,WAAW,YAChB,EAAE,IAAI,QAAQ,KAAK,IACnB,OAAO,WAAW,UAChB,EAAE,OAAO,QAAQ,OAAO,IACxB,EAAE,IAAI,QAAG;AAEnB,YAAQ;AAAA,MACN;AAAA,IAAO,IAAI,IAAI,EAAE,KAAK,GAAI,CAAC,KAAK,OAAO,MAAM,KAAK,EAAE,IAAI,IAAI,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC;AAAA,IACxG;AACA,QAAI,OAAO,WAAW,OAAO,WAAW,SAAS;AAC/C,cAAQ,IAAI,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC,EAAE;AAAA,IAC5C;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,eAAe,EACvC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,qBAAqB,2BAA2B,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,KAAa,QAAQ;AAClC,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,QAAQ,UAAU,KAAK,IAAI;AACjC,QAAI,CAAC,OAAO;AACV,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,GAAG,aAAa,CAAC;AACjE,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,mBAAmB,OAAO,IAAI,QAAQ;AAC3D,QAAI,OAAO,WAAW,OAAO,UAAU;AACrC,gBAAU,KAAK,OAAO,UAAU;AAAA,QAC9B,GAAG;AAAA,QACH,OAAO,KAAK,SAAS;AAAA,MACvB,CAAC;AAAA,IACH;AAEA,QACE,SAASA,UAAS,KAAK;AAAA,MACrB;AAAA,MACA,SAAS,CAAC,EAAE,OAAO,WAAW,OAAO;AAAA,MACrC,UAAU,OAAO;AAAA,MACjB,SAAS,OAAO;AAAA,IAClB,CAAC,GACD;AACA;AAAA,IACF;AAEA,QAAI,OAAO,WAAW,OAAO,UAAU;AACrC,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,QAAQ,OAAO,QAAQ;AAAA,MAC9E;AACA,cAAQ,IAAI,EAAE,IAAI,KAAK,OAAO,OAAO,EAAE,CAAC;AAAA,IAC1C,OAAO;AACL,cAAQ,IAAI,EAAE,OAAO,GAAG,QAAQ,OAAO,IAAI,OAAO,OAAO,EAAE,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,aAAa,EACrB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,eAAe,EACvC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,QAAQ;AACrB,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,YAAY,IAAI;AAEhC,UAAM,UAAU,QACb,IAAI,CAAC,MAAM;AACV,YAAM,MAAM,UAAU,EAAE,KAAK;AAAA,QAC3B,GAAG;AAAA,QACH,OAAO,EAAE;AAAA,QACT,QAAQ;AAAA,MACV,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,WAAW,EAAE,UAAU,KAAK;AAClC,YAAM,gBAAgB,EAAE,UAAU,KAAK;AACvC,aAAO,EAAE,KAAK,EAAE,KAAK,OAAO,KAAK,UAAU,cAAc;AAAA,IAC3D,CAAC,EACA,OAAO,CAAC,MAAkC,MAAM,IAAI;AAEvD,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,EAAE,IAAI,wBAAwB,CAAC;AAC3C;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,gBAAgB,OAAO;AAE5C,QAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,cAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC7C,OAAO;AACL,cAAQ;AAAA,QACN,EAAE,KAAK;AAAA,0BAA6B,OAAO,QAAQ,MAAM;AAAA,CAAY;AAAA,MACvE;AACA,iBAAW,KAAK,OAAO,SAAS;AAC9B,cAAM,OAAO,EAAE,WAAW,QAAQ,QAAQ,QAAQ,QAAQ;AAC1D,cAAM,QAAQ,EAAE,WAAW,QAAQ,EAAE,QAAQ,EAAE;AAC/C,gBAAQ;AAAA,UACN,KAAK,IAAI,IAAI,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,QAAQ,KAAK,EAAE,WAAW,OAAO;AAAA,QAC9E;AACA,YAAI,EAAE,iBAAkB,SAAQ,IAAI,EAAE,IAAI,8BAAyB,CAAC;AAAA,MACtE;AACA,cAAQ,IAAI;AAEZ,UAAI,CAAC,OAAO,UAAU;AACpB,gBAAQ,IAAI,EAAE,IAAI,KAAK,OAAO,SAAS,8BAA8B,CAAC;AACtE,gBAAQ,WAAW;AAAA,MACrB,OAAO;AACL,gBAAQ,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAAA,MAC5C;AAAA,IACF;AAAA,EACF,CAAC;AACL;;;AC3RA,SAAS,aAAa;AACtB,SAAS,qBAAqB;AAC9B,SAAS,iBAAiB;AAc1B,IAAM,mBAAgD;AAAA,EACpD,cAAc,EAAE,MAAM,eAAe;AAAA,EACrC,YAAY;AAAA,IACV,MAAM;AAAA,IACN,cAAc;AAAA;AAAA,MAEZ;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAO;AAAA,MAAO;AAAA,MAAM;AAAA,MAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAM9C;AAAA,MAAU;AAAA,MAAW;AAAA,MAAW;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAChD;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAO;AAAA,MAAM;AAAA,MAAQ;AAAA,IACvC;AAAA,IACA,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,cAAc,CAAC,cAAc,eAAe,WAAW;AAAA,EACzD;AAAA,EACA,IAAI;AAAA,IACF,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,cAAc,CAAC,YAAY,QAAQ,QAAQ;AAAA,EAC7C;AACF;AAEO,SAAS,WAAW,MAA4B;AACrD,MAAI,CAAC,KAAM,QAAO,iBAAiB;AACnC,SAAO,iBAAiB,IAAI,KAAK,EAAE,KAAK;AAC1C;AA6BO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EACxC,WAAqD,CAAC;AAAA,EACtD,OAAe;AAAA,EACf,SAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjB,UAAU,IAAI,cAAc,MAAM;AAAA,EAE1C,YAAY,iBAA2B;AACrC,UAAM;AAEN,UAAM,eAAe,gBAAgB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAE/D,iBAAa,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM;AAE/C,SAAK,WAAW,aAAa,IAAI,CAAC,OAAO;AAAA,MACvC,OAAO;AAAA,MACP,aAAa;AAAA,IACf,EAAE;AAEF,QAAI,aAAa,SAAS,GAAG;AAC3B,WAAK,SAAS,aAAa,CAAC,EAAE;AAAA,IAChC;AAAA,EACF;AAAA,EAEA,WAAW,OAAwB,WAAmB,UAAsB;AAC1E,QAAI,KAAK,SAAS,WAAW,GAAG;AAC9B,WAAK,KAAK,KAAK;AACf,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,UACJ,OAAO,UAAU,WAAW,QAAQ,KAAK,QAAQ,MAAM,KAAK;AAC9D,UAAM,OAAO,KAAK,OAAO;AACzB,QAAI,WAAW;AAEf,eAAW,EAAE,OAAO,YAAY,KAAK,KAAK,UAAU;AAClD,iBAAW,SAAS,MAAM,KAAK,EAAE,KAAK,WAAW;AAAA,IACnD;AAEA,QAAI,SAAS,SAAS,KAAK,QAAQ;AACjC,WAAK,OAAO;AACZ,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,YAAY,SAAS,SAAS,KAAK,SAAS;AAClD,UAAM,SAAS,SAAS,MAAM,GAAG,SAAS;AAC1C,SAAK,OAAO,SAAS,MAAM,SAAS;AAEpC,SAAK,KAAK,MAAM;AAChB,aAAS;AAAA,EACX;AAAA,EAEA,OAAO,UAAsB;AAG3B,QAAI,QAAQ,KAAK,OAAO,KAAK,QAAQ,IAAI;AACzC,QAAI,OAAO;AACT,iBAAW,EAAE,OAAO,YAAY,KAAK,KAAK,UAAU;AAClD,gBAAQ,MAAM,MAAM,KAAK,EAAE,KAAK,WAAW;AAAA,MAC7C;AACA,WAAK,KAAK,KAAK;AAAA,IACjB;AACA,aAAS;AAAA,EACX;AACF;AAOO,SAAS,kBACd,SACA,SACA,MACA,aACM;AACN,QAAM,cAAc,CAAC,SAAS,GAAG,IAAI,EAAE,KAAK,GAAG;AAE/C,QAAM,iBAAiB,gBAAgB,aAAa,WAAW;AAC/D,MAAI,CAAC,eAAe,SAAS;AAC3B,UAAM,IAAI,MAAM,kBAAkB,eAAe,MAAM,EAAE;AAAA,EAC3D;AAEA,MAAI,QAAQ,cAAc;AACxB,UAAM,SAAS,QAAQ,aAAa,KAAK,CAAC,MAAM;AAC9C,YAAM,UAAU,IAAI,OAAO,aAAa,EAAE,QAAQ,uBAAuB,MAAM,CAAC,WAAW,GAAG;AAC9F,aAAO,QAAQ,KAAK,WAAW;AAAA,IACjC,CAAC;AACD,QAAI,QAAQ;AACV,YAAM,IAAI,MAAM,iBAAiB,QAAQ,IAAI,gCAAgC,MAAM,GAAG;AAAA,IACxF;AAAA,EACF;AACA,MAAI,QAAQ,eAAe;AACzB,UAAM,UAAU,QAAQ,cAAc,KAAK,CAAC,MAAM,YAAY,WAAW,CAAC,CAAC;AAC3E,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,iBAAiB,QAAQ,IAAI,6BAA6B,OAAO,GAAG;AAAA,IACtF;AAAA,EACF;AACF;AAEA,eAAsB,YAAY,MAAwC;AACxE,QAAM,UAAU,WAAW,KAAK,OAAO;AACvC,oBAAkB,SAAS,KAAK,SAAS,KAAK,MAAM,KAAK,WAAW;AAEpE,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAChD,QAAI,MAAM,OAAW,QAAO,CAAC,IAAI;AAAA,EACnC;AAEA,MAAI,QAAQ,cAAc;AACxB,eAAW,OAAO,QAAQ,cAAc;AACtC,aAAO,OAAO,GAAG;AAAA,IACnB;AAAA,EACF;AAEA,QAAM,kBAAkB,oBAAI,IAAY;AAExC,MAAI,UAAU,YAAY;AAAA,IACxB,OAAO,KAAK;AAAA,IACZ,aAAa,KAAK;AAAA,IAClB,QAAQ,KAAK,UAAU;AAAA,IACvB,QAAQ;AAAA;AAAA,EACV,CAAC;AAED,MAAI,KAAK,MAAM,QAAQ;AACrB,UAAM,SAAS,IAAI,IAAI,KAAK,IAAI;AAChC,cAAU,QAAQ,OAAO,CAAC,MAAM,OAAO,IAAI,EAAE,GAAG,CAAC;AAAA,EACnD;AAEA,MAAI,KAAK,MAAM,QAAQ;AACrB,cAAU,QAAQ;AAAA,MAAO,CAAC,MACxB,KAAK,KAAM,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,SAAS,CAAC,CAAC;AAAA,IAC3D;AAAA,EACF;AAEA,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,UAAU;AAClB,YAAM,QAAQ,WAAW,MAAM,QAAQ;AACvC,UAAI,MAAM,UAAW;AAAA,IACvB;AAEA,UAAM,MAAM,UAAU,MAAM,KAAK;AAAA,MAC/B,OAAO,MAAM;AAAA,MACb,aAAa,KAAK;AAAA,MAClB,KAAK,KAAK;AAAA,MACV,QAAQ,KAAK,UAAU;AAAA,MACvB,QAAQ;AAAA;AAAA,IACV,CAAC;AAED,QAAI,QAAQ,MAAM;AAChB,aAAO,MAAM,GAAG,IAAI;AACpB,UAAI,IAAI,SAAS,GAAG;AAClB,wBAAgB,IAAI,GAAG;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,cAAc;AAAA,IACnB;AAAA,IACA,SAAS,KAAK;AAAA,IACd,MAAM,KAAK;AAAA,IACX;AAAA,IACA,iBAAiB,CAAC,GAAG,eAAe;AAAA,IACpC,eAAe,KAAK;AAAA,IACpB,aAAa,KAAK;AAAA,EACpB,CAAC;AACH;AAoBO,SAAS,cAAc,MAAiD;AAC7E,QAAM,EAAE,SAAS,iBAAiB,OAAO,IAAI;AAC7C,QAAM,aAAa,QAAQ,qBAAqB,kBAAkB,KAAK,WAAW;AAElF,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAEtC,UAAM,eAAe,oBAAI,IAAI;AAAA,MAC3B;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAM;AAAA,MAAU;AAAA,MAAO;AAAA,MAAU;AAAA,MAAO;AAAA,MAAO;AAAA,IACzE,CAAC;AAKD,UAAM,cAAc,KAAK,QAAQ,MAAM,OAAO,EAAE,IAAI,KAAK,KAAK;AAE9D,QAAI,QAAQ,iBAAiB,SAAS,aAAa,IAAI,WAAW,GAAG;AACnE,YAAM,MAAM,sEAAsE,QAAQ,IAAI,eAAe,KAAK,OAAO;AACzH,UAAI,KAAK,eAAe;AACtB,eAAO,QAAQ,EAAE,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,CAAC;AAAA,MACvD;AACA,cAAQ,OAAO,MAAM,MAAM,IAAI;AAC/B,aAAO,QAAQ,EAAE,MAAM,KAAK,QAAQ,IAAI,QAAQ,GAAG,CAAC;AAAA,IACtD;AAEA,UAAM,QAAQ,MAAM,KAAK,SAAS,KAAK,MAAM;AAAA,MAC3C,KAAK;AAAA,MACL,OAAO,CAAC,WAAW,QAAQ,MAAM;AAAA,MACjC,OAAO;AAAA,IACT,CAAC;AAED,QAAI,WAAW;AACf,QAAI;AAEJ,QAAI,YAAY;AACd,cAAQ,WAAW,MAAM;AACvB,mBAAW;AACX,cAAM,KAAK,SAAS;AAAA,MACtB,GAAG,aAAa,GAAI;AAAA,IACtB;AAEA,UAAM,eAAe,IAAI,mBAAmB,CAAC,GAAG,eAAe,CAAC;AAChE,UAAM,eAAe,IAAI,mBAAmB,CAAC,GAAG,eAAe,CAAC;AAEhE,QAAI,MAAM,OAAQ,OAAM,OAAO,KAAK,YAAY;AAChD,QAAI,MAAM,OAAQ,OAAM,OAAO,KAAK,YAAY;AAEhD,QAAI,YAAY;AAChB,QAAI,YAAY;AAEhB,QAAI,KAAK,eAAe;AACtB,mBAAa,GAAG,QAAQ,CAAC,MAAO,aAAa,EAAE,SAAS,CAAE;AAC1D,mBAAa,GAAG,QAAQ,CAAC,MAAO,aAAa,EAAE,SAAS,CAAE;AAAA,IAC5D,OAAO;AACL,mBAAa,KAAK,QAAQ,MAAM;AAChC,mBAAa,KAAK,QAAQ,MAAM;AAAA,IAClC;AAEA,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,UAAI,MAAO,cAAa,KAAK;AAC7B,UAAI,UAAU;AACZ,gBAAQ,EAAE,MAAM,KAAK,QAAQ,WAAW,QAAQ,YAAY;AAAA,mCAAsC,UAAU,kBAAkB,CAAC;AAAA,MACjI,OAAO;AACL,gBAAQ,EAAE,MAAM,QAAQ,GAAG,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA,MACnE;AAAA,IACF,CAAC;AAED,UAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,UAAI,MAAO,cAAa,KAAK;AAC7B,aAAO,GAAG;AAAA,IACZ,CAAC;AAAA,EACH,CAAC;AACH;;;ACnVA,SAAS,gBAAAM,eAAc,aAAa,gBAAgB;AACpD,SAAS,YAAY;;;ACHd,IAAM,4BACX;AAQK,SAAS,iBAAiB,KAAqB;AACpD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,MAAM,IAAI;AAChB,QAAM,cAAc,oBAAI,IAAoB;AAE5C,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,UAAM,OAAO,IAAI,CAAC;AAClB,gBAAY,IAAI,OAAO,YAAY,IAAI,IAAI,KAAK,KAAK,CAAC;AAAA,EACxD;AAEA,MAAI,UAAU;AACd,aAAW,SAAS,YAAY,OAAO,GAAG;AACxC,UAAM,IAAI,QAAQ;AAClB,eAAW,IAAI,KAAK,KAAK,CAAC;AAAA,EAC5B;AAEA,SAAO;AACT;AAEA,SAAS,mBAAmB,OAAwB;AAClD,QAAM,KAAK,MAAM,YAAY;AAC7B,SACE,GAAG,SAAS,SAAS,KACrB,GAAG,SAAS,OAAO,KACnB,GAAG,SAAS,aAAa,KACzB,GAAG,SAAS,YAAY,KACxB,GAAG,SAAS,KAAK;AAErB;AAEA,SAAS,sBAAsB,OAAe,SAA0B;AACtE,SAAO,UAAU,OAAO,MAAM,WAAW,KAAK,KAAK,MAAM,WAAW,MAAM;AAC5E;AAMO,SAAS,kBAAkB,MAAmC;AACnE,MAAI,KAAK,SAAS,IAAK,QAAO,CAAC;AAE/B,QAAM,MAA2B,CAAC;AAClC,4BAA0B,YAAY;AACtC,MAAI;AACJ,UAAQ,QAAQ,0BAA0B,KAAK,IAAI,OAAO,MAAM;AAC9D,UAAM,UAAU,MAAM,CAAC;AACvB,UAAM,QAAQ,MAAM,CAAC;AACrB,UAAM,QAAQ,MAAM,CAAC;AAErB,QAAI,MAAM,SAAS,EAAG;AACtB,QAAI,mBAAmB,KAAK,EAAG;AAE/B,UAAM,UAAU,iBAAiB,KAAK;AACtC,QAAI,CAAC,sBAAsB,OAAO,OAAO,EAAG;AAE5C,QAAI,KAAK,EAAE,SAAS,OAAO,MAAM,CAAC;AAAA,EACpC;AACA,SAAO;AACT;;;ADpDA,IAAM,cAAc,oBAAI,IAAI;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,cAAc,oBAAI,IAAI;AAAA,EAC1B;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EACjD;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EACxB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAC/B;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAU;AAAA,EAC3B;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EACvB;AACF,CAAC;AAEM,SAAS,aAAa,KAA2B;AACtD,QAAM,UAAwB,CAAC;AAE/B,WAAS,KAAK,YAAoB;AAChC,QAAI;AACJ,QAAI;AACF,gBAAU,YAAY,UAAU;AAAA,IAClC,QAAQ;AACN;AAAA,IACF;AAEA,eAAW,SAAS,SAAS;AAC3B,UAAI,YAAY,IAAI,KAAK,EAAG;AAE5B,YAAM,WAAW,KAAK,YAAY,KAAK;AACvC,UAAI;AACJ,UAAI;AACF,eAAO,SAAS,QAAQ;AAAA,MAC1B,QAAQ;AACN;AAAA,MACF;AAEA,UAAI,KAAK,YAAY,GAAG;AACtB,aAAK,QAAQ;AAAA,MACf,WAAW,KAAK,OAAO,GAAG;AACxB,cAAM,MAAM,SAAS,MAAM,SAAS,YAAY,GAAG,CAAC,EAAE,YAAY;AAClE,YAAI,YAAY,IAAI,GAAG,KAAK,MAAM,SAAS,OAAO,EAAG;AAErD,YAAI;AACJ,YAAI;AACF,oBAAUC,cAAa,UAAU,MAAM;AAAA,QACzC,QAAQ;AACN;AAAA,QACF;AAEA,YAAI,QAAQ,SAAS,IAAI,EAAG;AAE5B,cAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,iBAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,gBAAM,OAAO,MAAM,CAAC;AACpB,gBAAM,UAAU,kBAAkB,IAAI;AACtC,qBAAW,KAAK,SAAS;AACvB,kBAAM,UAAU,iBAAiB,EAAE,KAAK;AACxC,kBAAM,UAAU,SAAS,WAAW,GAAG,IACnC,SAAS,MAAM,IAAI,MAAM,EAAE,QAAQ,WAAW,EAAE,IAChD;AAEJ,oBAAQ,KAAK;AAAA,cACX,MAAM,WAAW;AAAA,cACjB,MAAM,IAAI;AAAA,cACV,SAAS,EAAE;AAAA,cACX,OAAO,EAAE;AAAA,cACT,SAAS,KAAK,KAAK;AAAA,cACnB,SAAS,WAAW,QAAQ,QAAQ,CAAC,CAAC;AAAA,YACxC,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,OAAK,GAAG;AACR,SAAO;AACT;;;AEjGA,SAAS,gBAAAC,eAAc,iBAAAC,gBAAe,cAAAC,mBAAkB;AACxD,SAAS,UAAU,eAAe;AAelC,IAAM,iBAA0D;AAAA,EAC9D,OAAO,CAAC,MAAM,eAAe,CAAC;AAAA,EAC9B,QAAQ,CAAC,MAAM,eAAe,CAAC;AAAA,EAC/B,OAAO,CAAC,MAAM,eAAe,CAAC;AAAA,EAC9B,QAAQ,CAAC,MAAM,eAAe,CAAC;AAAA,EAC/B,QAAQ,CAAC,MAAM,eAAe,CAAC;AAAA,EAC/B,QAAQ,CAAC,MAAM,eAAe,CAAC;AAAA,EAC/B,OAAO,CAAC,MAAM,eAAe,CAAC;AAAA,EAC9B,OAAO,CAAC,MAAM,QAAQ,CAAC;AAAA,EACvB,OAAO,CAAC,MAAM,cAAc,CAAC;AAAA,EAC7B,OAAO,CAAC,MAAM,kBAAkB,CAAC;AAAA,EACjC,SAAS,CAAC,MAAM,kBAAkB,CAAC;AAAA,EACnC,OAAO,CAAC,MAAM,kBAAkB,CAAC;AAAA,EACjC,OAAO,CAAC,MAAM,uCAAuC,CAAC;AAAA,EACtD,QAAQ,CAAC,MAAM,WAAW,CAAC;AAAA,EAC3B,OAAO,CAAC,MAAM,MAAM,CAAC;AAAA,EACrB,SAAS,CAAC,MAAM,MAAM,CAAC;AACzB;AAEA,SAAS,UAAU,UAAkB,SAAyB;AAC5D,QAAM,MAAM,QAAQ,QAAQ,EAAE,YAAY;AAC1C,QAAM,YAAY,eAAe,GAAG;AACpC,SAAO,YAAY,UAAU,OAAO,IAAI,eAAe,OAAO;AAChE;AAKO,SAAS,UACd,OACA,OAAoB,CAAC,GACP;AACd,QAAM,UAAwB,CAAC;AAE/B,aAAW,QAAQ,OAAO;AACxB,QAAI,CAACC,YAAW,IAAI,EAAG;AAEvB,QAAI;AACJ,QAAI;AACF,gBAAUC,cAAa,MAAM,MAAM;AAAA,IACrC,QAAQ;AACN;AAAA,IACF;AAEA,QAAI,QAAQ,SAAS,IAAI,EAAG;AAE5B,UAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,UAAM,QAAwG,CAAC;AAE/G,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAM,OAAO,MAAM,CAAC;AACpB,YAAM,UAAU,kBAAkB,IAAI;AAEtC,iBAAW,KAAK,SAAS;AACvB,cAAM,eAAe,EAAE,QAAQ,YAAY;AAC3C,cAAM,UAAU,iBAAiB,EAAE,KAAK;AACxC,cAAM,YAAY,KAAK,QAAQ;AAE/B,YAAI,WAAW;AACb,gBAAM,SAAS,UAAU,MAAM,YAAY;AAC3C,gBAAM,KAAK;AAAA,YACT,MAAM;AAAA,YACN,UAAU,GAAG,EAAE,KAAK,GAAG,EAAE,KAAK,GAAG,EAAE,KAAK;AAAA,YACxC,aAAa;AAAA,YACb,SAAS;AAAA,YACT,OAAO,EAAE;AAAA,UACX,CAAC;AAAA,QACH;AAEA,gBAAQ,KAAK;AAAA,UACX;AAAA,UACA,MAAM,IAAI;AAAA,UACV,SAAS;AAAA,UACT,OAAO,EAAE;AAAA,UACT,SAAS,KAAK,KAAK;AAAA,UACnB,SAAS,WAAW,QAAQ,QAAQ,CAAC,CAAC;AAAA,UACtC,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,KAAK,OAAO,MAAM,SAAS,GAAG;AAChC,YAAM,WAAW,QAAQ,MAAM,OAAO;AACtC,iBAAW,OAAO,MAAM,QAAQ,GAAG;AACjC,cAAM,UAAU,IAAI;AACpB,YAAI,WAAW,KAAK,UAAU,SAAS,QAAQ;AAC7C,mBAAS,OAAO,IAAI,SAAS,OAAO,EAAE,QAAQ,IAAI,UAAU,IAAI,WAAW;AAAA,QAC7E;AAEA,YAAI,CAAC,UAAU,IAAI,SAAS,EAAE,OAAO,KAAK,OAAO,aAAa,KAAK,YAAY,CAAC,GAAG;AACjF,oBAAU,IAAI,SAAS,IAAI,OAAO;AAAA,YAChC,OAAO,KAAK,SAAS;AAAA,YACrB,aAAa,KAAK;AAAA,YAClB,QAAQ;AAAA,YACR,aAAa,sBAAsB,SAAS,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;AAAA,UACnE,CAAC;AAAA,QACH;AAAA,MACF;AAEA,MAAAC,eAAc,MAAM,SAAS,KAAK,IAAI,GAAG,MAAM;AAAA,IACjD;AAAA,EACF;AAEA,SAAO;AACT;;;ACxHO,SAAS,wBAAwBC,UAAwB;AAC9D,EAAAA,SACG,QAAQ,mBAAmB,EAC3B;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,kCAAkC,EACzD,OAAO,iBAAiB,mCAAmC,EAC3D,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,qBAAqB,EAC/C,OAAO,qBAAqB,qCAAqC,EACjE,OAAO,qBAAqB,mCAAmC,EAC/D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,OAAO,aAAuB,QAAQ;AAC5C,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,YAAY,CAAC;AAC7B,UAAM,OAAO,YAAY,MAAM,CAAC;AAEhC,QAAI;AACF,YAAM,EAAE,KAAK,IAAI,MAAM,YAAY;AAAA,QACjC,GAAG;AAAA,QACH;AAAA,QACA;AAAA,QACA,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,QACtD,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,QACtD,SAAS,IAAI;AAAA,MACf,CAAC;AACD,cAAQ,KAAK,IAAI;AAAA,IACnB,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACnF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,YAAY,EACpB,YAAY,uCAAuC,EACnD;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,qCAAqC,EAC5D,OAAO,iBAAiB,sCAAsC,EAC9D,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,KAAyB,QAAQ;AACxC,UAAM,YAAY,OAAO,QAAQ,IAAI;AACrC,UAAM,UAAU,IAAI,QAAQ;AAC5B,UAAM,WAAW,gBAAgBA,UAAS,GAAG;AAC7C,QAAI,CAAC,UAAU;AACb,cAAQ;AAAA,QACN;AAAA,IAAO,QAAQ,GAAG,aAAa,EAAE,KAAK,SAAS,CAAC,kBAAkB,UAAU,EAAE,OAAO,eAAe,IAAI,EAAE;AAAA;AAAA,MAC5G;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,SAAS;AAEtC,QAAI,YAAY,CAAC,SAAS;AACxB,eAASA,UAAS,KAAK,EAAE,KAAK,WAAW,UAAU,QAAQ,CAAC;AAC5D,UAAI,QAAQ,SAAS,EAAG,SAAQ,WAAW;AAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ;AAAA,QACN,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA;AAAA,MAC7B;AACA;AAAA,IACF;AAEA,QAAI,SAAS;AACX,YAAM,UAAU,IAAI;AAAA,QAClB,QAAQ;AAAA,UAAI,CAAC,MACX,EAAE,KAAK,WAAW,GAAG,IAAI,EAAE,OAAO,GAAG,SAAS,IAAI,EAAE,IAAI;AAAA,QAC1D;AAAA,MACF;AACA,YAAM,OAAO,UAAU,GAAG;AAC1B,YAAM,cAAc,UAAU,CAAC,GAAG,OAAO,GAAG;AAAA,QAC1C,KAAK;AAAA,QACL,OAAO,KAAK;AAAA,QACZ,aAAa,KAAK;AAAA,MACpB,CAAC;AACD,YAAM,aAAa,YAAY,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE;AACtD,UAAI,UAAU;AACZ,iBAASA,UAAS,KAAK;AAAA,UACrB,KAAK;AAAA,UACL,UAAU;AAAA,UACV,OAAO;AAAA,QACT,CAAC;AACD;AAAA,MACF;AACA,cAAQ;AAAA,QACN,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,UAAU,UAAU;AAAA;AAAA,MACjD;AACA;AAAA,IACF;AAEA,eAAW,OAAO,SAAS;AACzB,cAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE;AACvE,cAAQ,IAAI,OAAO,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,OAAO,CAAC,EAAE;AAC7D,cAAQ;AAAA,QACN,OAAO,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,IAAI,EAAE,IAAI,IAAI,QAAQ,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,QAAQ,SAAS,CAAC,CAAC;AAAA,MAChH;AACA,cAAQ,IAAI,OAAO,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,OAAO,EAAE;AACrD,cAAQ,IAAI;AAAA,IACd;AAEA,YAAQ;AAAA,MACN,KAAK,EAAE,IAAI,SAAS,QAAQ,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,kBAAkB,CAAC;AAAA;AAAA,IAC5F;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,iBAAiB,EACzB;AAAA,IACC;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,qCAAqC,EAC5D,OAAO,iBAAiB,sCAAsC,EAC9D,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,OAAiB,QAAQ;AAChC,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,UAAU,OAAO;AAAA,MAC/B,KAAK,IAAI;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,IACpB,CAAC;AAED,QAAI,SAASA,UAAS,KAAK,EAAE,OAAO,UAAU,QAAQ,CAAC,GAAG;AACxD,UAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAG,SAAQ,WAAW;AACtD;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,MAAM,QAAQ,KAAK,CAAC,kCAAkC,MAAM,MAAM;AAAA;AAAA,MAC7E;AACA;AAAA,IACF;AAEA,eAAW,OAAO,SAAS;AACzB,YAAM,SAAS,IAAI,QAAQ,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI,OAAO;AAC3D,cAAQ;AAAA,QACN,KAAK,IAAI,QAAQ,EAAE,MAAM,QAAQ,KAAK,IAAI,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,MAAM;AAAA,MAC3G;AACA,cAAQ,IAAI,OAAO,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,OAAO,CAAC,EAAE;AAC7D,cAAQ;AAAA,QACN,OAAO,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,IAAI,EAAE,IAAI,IAAI,QAAQ,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,QAAQ,SAAS,CAAC,CAAC;AAAA,MAChH;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,aAAa,QAAQ,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE;AAClD,QAAI,IAAI,OAAO,aAAa,GAAG;AAC7B,cAAQ;AAAA,QACN,KAAK,EAAE,MAAM,SAAS,UAAU,YAAY,CAAC;AAAA;AAAA,MAC/C;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN,KAAK,EAAE,IAAI,SAAS,QAAQ,MAAM,uBAAuB,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC;AAAA;AAAA,MACnF;AAAA,IACF;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,QAAQ,EAChB,YAAY,qDAAqD,EACjE,OAAO,iBAAiB,oBAAoB,MAAM,EAClD,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,QAAQ;AACrB,UAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,yBAAyB;AACvE,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,eAAoB;AAClD,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,IAAS;AAE3C,UAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,UAAM,EAAE,OAAO,IAAI,IAAI,qBAAqB,EAAE,KAAK,CAAC;AAEpD,YAAQ;AAAA,MACN;AAAA,IAAO,QAAQ,GAAG,IAAI,EAAE,KAAK,iCAAiC,CAAC;AAAA;AAAA,IACjE;AACA,YAAQ,IAAI,KAAK,EAAE,KAAK,GAAG,CAAC;AAAA,CAAI;AAChC,YAAQ,IAAI,EAAE,IAAI,0BAA0B,CAAC;AAE7C,QAAI,IAAI,SAAS,OAAO;AACtB,YAAM,UACJ,SAAS,MAAM,WACX,SACA,SAAS,MAAM,UACb,UACA;AACR,WAAK,GAAG,OAAO,IAAI,GAAG,EAAE;AAAA,IAC1B;AAEA,UAAM,WAAW,MAAM;AACrB,cAAQ,IAAI;AAAA,EAAK,EAAE,IAAI,qBAAqB,CAAC,EAAE;AAC/C,YAAM;AACN,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,GAAG,UAAU,QAAQ;AAC7B,YAAQ,GAAG,WAAW,QAAQ;AAE9B,UAAM,IAAI,QAAQ,MAAM;AAAA,IAAC,CAAC;AAAA,EAC5B,CAAC;AACL;;;AC3NA,SAAS,iBAAAC,sBAAqB;AAMvB,SAAS,WAAW,OAAuB;AAChD,QAAM,IAAI,MAAM,KAAK,EAAE,MAAM,oBAAoB;AACjD,MAAI,GAAG;AACL,UAAM,OAAO,EAAE,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC,EAAE,YAAY,CAAoB;AAC/E,WAAO,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,OAAO,GAAI,EAAE,YAAY;AAAA,EACvE;AACA,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,MAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,GAAG;AAChC,UAAM,IAAI,MAAM,aAAa,KAAK,kDAAkD;AAAA,EACtF;AACA,SAAO,KAAK,YAAY;AAC1B;AAEA,SAAS,WAAW,SAAyB;AAC3C,MAAI,UAAU,GAAI,QAAO,GAAG,OAAO;AACnC,MAAI,UAAU,KAAM,QAAO,GAAG,KAAK,MAAM,UAAU,EAAE,CAAC;AACtD,MAAI,UAAU,MAAO,QAAO,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AACzD,SAAO,GAAG,KAAK,MAAM,UAAU,KAAK,CAAC;AACvC;AAEO,SAAS,sBAAsBC,UAAwB;AAC5D,EAAAA,SACG,QAAQ,OAAO,EACf,YAAY,sCAAsC,EAClD,OAAO,mBAAmB,eAAe,EACzC,OAAO,yBAAyB,8CAA8C,EAC9E,OAAO,mBAAmB,iDAAiD,EAC3E,OAAO,mBAAmB,4BAA4B,UAAU,EAAE,EAClE,OAAO,eAAe,yBAAyB,EAC/C,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,QAAI,IAAI,WAAW;AACjB,YAAM,YAAY,gBAAgB,IAAI,GAAG;AACzC,UAAI,SAASA,UAAS,KAAK,EAAE,UAAU,CAAC,EAAG;AAC3C,UAAI,UAAU,WAAW,GAAG;AAC1B,gBAAQ,IAAI,GAAG,QAAQ,MAAM,IAAI,EAAE,MAAM,uBAAuB,CAAC,EAAE;AACnE;AAAA,MACF;AAEA,cAAQ;AAAA,QACN;AAAA,EAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,UAAU,MAAM,6BAA6B,CAAC,CAAC;AAAA;AAAA,MAC5F;AACA,iBAAW,KAAK,WAAW;AACzB,gBAAQ,IAAI,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE;AAAA,MACtD;AACA,cAAQ,IAAI;AACZ;AAAA,IACF;AAEA,UAAM,SAAS,WAAW;AAAA,MACxB,KAAK,IAAI;AAAA,MACT,QAAQ,IAAI;AAAA,MACZ,OAAO,IAAI;AAAA,MACX,OAAO,IAAI;AAAA,IACb,CAAC;AAED,QAAI,SAASA,UAAS,KAAK,EAAE,OAAO,CAAC,EAAG;AAExC,QAAI,OAAO,WAAW,GAAG;AACvB,cAAQ,IAAI,EAAE,IAAI,uBAAuB,CAAC;AAC1C;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,eAAe,OAAO,MAAM;AAAA,CAAY,CAAC;AAE9E,eAAW,SAAS,QAAQ;AAC1B,YAAM,KAAK,IAAI,KAAK,MAAM,SAAS,EAAE,eAAe;AACpD,YAAM,cACJ,MAAM,WAAW,SACb,EAAE,OACF,MAAM,WAAW,UACf,EAAE,QACF,MAAM,WAAW,WACf,EAAE,MACF,EAAE;AAEZ,YAAM,QAAQ;AAAA,QACZ,EAAE,IAAI,EAAE;AAAA,QACR,YAAY,MAAM,OAAO,OAAO,CAAC,CAAC;AAAA,QAClC,MAAM,MAAM,EAAE,KAAK,MAAM,GAAG,IAAI;AAAA,QAChC,MAAM,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,GAAG,IAAI;AAAA,QAC1C,MAAM,QAAQ,EAAE,KAAK,SAAI,MAAM,KAAK,QAAG,IAAI;AAAA,QAC3C,MAAM,SAAS,EAAE,IAAI,MAAM,MAAM,IAAI;AAAA,MACvC;AAEA,cAAQ,IAAI,KAAK,MAAM,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,IACrD;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB,YAAY,8CAA8C,EAC1D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,SAAS,iBAAiB;AAChC,QAAI,SAASA,UAAS,KAAK,MAAM,GAAG;AAClC,UAAI,CAAC,OAAO,UAAU,OAAO,cAAc,EAAG,SAAQ,WAAW;AACjE;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB,GAAG;AAC5B,cAAQ,IAAI,EAAE,IAAI,6BAA6B,CAAC;AAChD;AAAA,IACF;AAEA,QAAI,OAAO,QAAQ;AACjB,cAAQ;AAAA,QACN,GAAG,QAAQ,MAAM,IAAI,EAAE,MAAM,oBAAoB,CAAC,WAAM,OAAO,WAAW;AAAA,MAC5E;AAAA,IACF,OAAO;AACL,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,IAAI,oBAAoB,CAAC,cAAc,OAAO,QAAQ,EAAE;AAC1F,cAAQ;AAAA,QACN,EAAE,IAAI,KAAK,OAAO,WAAW,IAAI,OAAO,WAAW,4BAA4B;AAAA,MACjF;AACA,UAAI,OAAO,aAAa;AACtB,gBAAQ;AAAA,UACN,EAAE;AAAA,YACA,mBAAmB,OAAO,YAAY,SAAS,IAAI,OAAO,YAAY,MAAM,IAAI,OAAO,YAAY,OAAO,EAAE;AAAA,UAC9G;AAAA,QACF;AAAA,MACF;AACA,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB,YAAY,0CAA0C,EACtD,OAAO,kBAAkB,uBAAuB,EAChD,OAAO,kBAAkB,qBAAqB,EAC9C,OAAO,kBAAkB,mCAAmC,OAAO,EACnE,OAAO,uBAAuB,iCAAiC,EAC/D,OAAO,CAAC,QAAQ;AACf,UAAM,SAAS,YAAY;AAAA,MACzB,OAAO,IAAI;AAAA,MACX,OAAO,IAAI;AAAA,MACX,QAAQ,IAAI;AAAA,IACd,CAAC;AAED,QAAI,IAAI,QAAQ;AACd,MAAAC,eAAc,IAAI,QAAQ,MAAM;AAChC,cAAQ,IAAI,GAAG,QAAQ,KAAK,gBAAgB,IAAI,MAAM,EAAE;AAAA,IAC1D,OAAO;AACL,cAAQ,IAAI,MAAM;AAAA,IACpB;AAAA,EACF,CAAC;AAEH,EAAAD,SACG,QAAQ,gBAAgB,EACxB,YAAY,8EAA8E,EAC1F,OAAO,mBAAmB,8DAA8D,EACxF,OAAO,kBAAkB,qDAAqD,EAC9E,OAAO,mBAAmB,wBAAwB,UAAU,EAAE,EAC9D,OAAO,iBAAiB,kCAAkC,EAC1D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,WAAW,kBAAkB;AAAA,MACjC,OAAO,IAAI;AAAA,MACX,OAAO,WAAW,IAAI,SAAS,IAAI;AAAA,MACnC,OAAO,IAAI;AAAA,IACb,CAAC;AAED,QAAI,SAASA,UAAS,KAAK,EAAE,SAAS,CAAC,EAAG;AAE1C,QAAI,SAAS,WAAW,GAAG;AACzB,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,oBAAoB,SAAS,MAAM;AAAA,CAAK,CAAC;AAC9E,eAAW,KAAK,UAAU;AACxB,YAAM,UAAU,IAAI,KAAK,EAAE,SAAS;AACpC,YAAM,QAAQ,IAAI,KAAK,EAAE,OAAO;AAChC,YAAM,UAAU,KAAK,IAAI,GAAG,KAAK,OAAO,MAAM,QAAQ,IAAI,QAAQ,QAAQ,KAAK,GAAI,CAAC;AACpF,YAAM,MAAM,EAAE,YAAY,YAAY,EAAE,SAAS,KAAK,EAAE;AACxD,YAAM,OAAO;AAAA,QACX,EAAE,KAAK,SAAI,GAAG,QAAG;AAAA,QACjB,EAAE,IAAI,IAAI,EAAE,MAAM,GAAG;AAAA,QACrB,EAAE;AAAA,UACA,GAAG,QAAQ,eAAe,CAAC,WAAM,MAAM,mBAAmB,CAAC,KAAK,WAAW,OAAO,CAAC;AAAA,QACrF;AAAA,QACA,GAAG,EAAE,UAAU;AAAA,QACf,EAAE,UAAU,IAAI,EAAE,IAAI,GAAG,EAAE,OAAO,SAAS,IAAI,EAAE,MAAM,UAAU;AAAA,QACjE,EAAE,eAAe,SAAS,EAAE,IAAI,GAAG,EAAE,eAAe,MAAM,eAAe,IAAI;AAAA,MAC/E;AACA,cAAQ,IAAI,KAAK,KAAK,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE;AAClD,cAAQ,IAAI,EAAE,IAAI,UAAU,EAAE,EAAE,eAAY,EAAE,KAAK,SAAS,EAAE,KAAK,KAAK,IAAI,IAAI,QAAG,EAAE,CAAC;AACtF,UAAI,IAAI,SAAS;AACf,mBAAW,KAAK,EAAE,QAAQ;AACxB,gBAAM,QAAQ;AAAA,YACZ,EAAE,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,mBAAmB,CAAC;AAAA,aAC/C,EAAE,WAAW,iBAAiB,EAAE,WAAW,WAAW,EAAE,MAAM,EAAE;AAAA,cAC/D,EAAE,OAAO,OAAO,EAAE;AAAA,YACpB;AAAA,YACA,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI;AAAA,YACxB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,IAAI;AAAA,UAC/B;AACA,kBAAQ,IAAI,SAAS,MAAM,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,QACzD;AAAA,MACF;AACA,cAAQ,IAAI;AAAA,IACd;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,QAAQ,EAChB,YAAY,iCAAiC,EAC7C,OAAO,gBAAgB,yBAAyB,EAChD,OAAO,iBAAiB,0BAA0B,EAClD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,YAAY,IAAI;AAEhC,UAAM,cAAwB,CAAC;AAC/B,UAAM,YAAoF,CAAC;AAC3F,QAAI,UAAU;AACd,QAAI,UAAU;AAEd,eAAW,SAAS,SAAS;AAC3B,UAAI,CAAC,MAAM,SAAS,CAAC,MAAM,MAAM,eAAe;AAC9C;AAAA,MACF,WAAW,MAAM,MAAM,WAAW;AAChC,oBAAY,KAAK,MAAM,GAAG;AAAA,MAC5B,WAAW,MAAM,MAAM,SAAS;AAC9B,kBAAU,KAAK;AAAA,UACb,KAAK,MAAM;AAAA,UACX,iBAAiB,MAAM,MAAM;AAAA,UAC7B,eAAe,MAAM,MAAM;AAAA,QAC7B,CAAC;AAAA,MACH,OAAO;AACL;AAAA,MACF;AAAA,IACF;AAEA,QACE,SAASA,UAAS,KAAK;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW,QAAQ,WAAW,IAAI,CAAC,IAAI,gBAAgB;AAAA,IACzD,CAAC,GACD;AACA;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,EAAE,IAAI,qBAAqB,CAAC;AACxC;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,MAAM;AAAA,CAAyB,CAAC;AAElE,eAAW,OAAO,aAAa;AAC7B,cAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,EAAE;AAAA,IACzF;AACA,eAAW,KAAK,WAAW;AACzB,cAAQ;AAAA,QACN,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,UAAU,EAAE,eAAe,MAAM,EAAE,aAAa,QAAQ,CAAC;AAAA,MACvH;AAAA,IACF;AAEA,YAAQ;AAAA,MACN;AAAA,IAAO,EAAE,MAAM,GAAG,QAAQ,KAAK,IAAI,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,OAAO,IAAI,UAAU,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,YAAY,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,WAAW,CAAC;AAAA,IACjN;AAEA,UAAM,YAAY,gBAAgB;AAClC,QAAI,UAAU,SAAS,GAAG;AACxB,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,OAAO,GAAG,QAAQ,OAAO,IAAI,UAAU,MAAM,oCAAoC,CAAC,IAAI,EAAE,IAAI,gCAAgC,CAAC;AAAA,MACxI;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AACL;;;AC1RA,SAAS,gBAAgB;AACzB,SAAS,cAAAE,aAAY,iBAAAC,gBAAe,WAAW,gBAAAC,eAAc,kBAAkB;AAC/E,SAAS,QAAAC,aAAY;AAMrB,SAAS,iBAA2B;AAClC,MAAI;AACF,UAAM,SAAS,SAAS,mDAAmD;AAAA,MACzE,UAAU;AAAA,MACV,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AACD,WAAO,OACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAAA,EAC/B,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAMO,SAAS,mBAA2B;AACzC,QAAM,SAAS,eAAe;AAC9B,MAAI,OAAO,WAAW,EAAG,QAAO;AAEhC,QAAM,UAAU,UAAU,MAAM;AAEhC,MAAI,QAAQ,WAAW,EAAG,QAAO;AAEjC,UAAQ,MAAM,uDAAuD;AACrE,aAAW,KAAK,SAAS;AACvB,YAAQ,MAAM,KAAK,EAAE,IAAI,IAAI,EAAE,IAAI,KAAK,EAAE,OAAO,eAAe,EAAE,OAAO,GAAG;AAAA,EAC9E;AACA,UAAQ;AAAA,IACN;AAAA;AAAA;AAAA,EACF;AAEA,SAAO;AACT;AAEA,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AASb,SAAS,qBAAqB,UAA0E;AAC7G,QAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,QAAM,WAAWC,MAAK,MAAM,QAAQ,OAAO;AAE3C,MAAI,CAACC,YAAWD,MAAK,MAAM,MAAM,CAAC,GAAG;AACnC,WAAO,EAAE,WAAW,OAAO,MAAM,IAAI,SAAS,uBAAuB;AAAA,EACvE;AAEA,QAAM,WAAWA,MAAK,UAAU,YAAY;AAE5C,MAAIC,YAAW,QAAQ,GAAG;AACxB,UAAM,WAAWC,cAAa,UAAU,MAAM;AAC9C,QAAI,SAAS,SAAS,QAAQ,GAAG;AAC/B,aAAO,EAAE,WAAW,MAAM,MAAM,UAAU,SAAS,yBAAyB;AAAA,IAC9E;AAEA,IAAAC,eAAc,UAAU,cAAc,OAAO,UAAU,MAAM;AAAA,EAC/D,OAAO;AACL,IAAAA,eAAc,UAAU,aAAa,MAAM;AAAA,EAC7C;AAEA,YAAU,UAAU,GAAK;AACzB,SAAO,EAAE,WAAW,MAAM,MAAM,UAAU,SAAS,4BAA4B;AACjF;AAKO,SAAS,uBAAuB,UAA4B;AACjE,QAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,QAAM,WAAWH,MAAK,MAAM,QAAQ,SAAS,YAAY;AAEzD,MAAI,CAACC,YAAW,QAAQ,EAAG,QAAO;AAElC,QAAM,UAAUC,cAAa,UAAU,MAAM;AAC7C,MAAI,CAAC,QAAQ,SAAS,QAAQ,EAAG,QAAO;AAGxC,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,QAAM,UAAU,MAAM;AAAA,IACpB,CAAC,MAAM,CAAC,EAAE,SAAS,QAAQ,KAAK,CAAC,EAAE,SAAS,oBAAoB;AAAA,EAClE;AAEA,MAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,KAAK,KAAK,CAAC,EAAE,WAAW,IAAI,CAAC,EAAE,WAAW,GAAG;AAEvE,eAAW,QAAQ;AAAA,EACrB,OAAO;AACL,IAAAC,eAAc,UAAU,QAAQ,KAAK,IAAI,GAAG,MAAM;AAAA,EACpD;AAEA,SAAO;AACT;;;ACjGO,SAAS,qBAAqBC,UAAwB;AAG3D,EAAAA,SACG,QAAQ,cAAc,EACtB;AAAA,IACC;AAAA,EACF,EACC,OAAO,yBAAyB,iBAAiB,EACjD,OAAO,CAAC,QAAQ;AACf,UAAM,SAAS,qBAAqB,IAAI,WAAW;AACnD,QAAI,OAAO,WAAW;AACpB,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,OAAO,IAAI,CAAC;AAAA,MACtE;AAAA,IACF,OAAO;AACL,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,IAAI,OAAO,OAAO,CAAC,EAAE;AAAA,IACzD;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,gBAAgB,EACxB,YAAY,mCAAmC,EAC/C,OAAO,yBAAyB,iBAAiB,EACjD,OAAO,CAAC,QAAQ;AACf,UAAM,UAAU,uBAAuB,IAAI,WAAW;AACtD,QAAI,SAAS;AACX,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,yBAAyB,CAAC,EAAE;AAAA,IACtE,OAAO;AACL,cAAQ,IAAI,EAAE,IAAI,iCAAiC,CAAC;AAAA,IACtD;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,UAAU,EAClB,YAAY,yDAAyD,EACrE,OAAO,MAAM;AACZ,UAAM,OAAO,iBAAiB;AAC9B,YAAQ,KAAK,IAAI;AAAA,EACnB,CAAC;AAIH,QAAM,OAAOA,SACV,QAAQ,MAAM,EACd;AAAA,IACC;AAAA,EACF;AAEF,OACG,QAAQ,KAAK,EACb,YAAY,qBAAqB,EACjC,OAAO,eAAe,4BAA4B,EAClD,OAAO,2BAA2B,yCAAyC,EAC3E,OAAO,eAAe,kCAAkC,EACxD;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,oBAAoB,0BAA0B,EACrD,OAAO,eAAe,qBAAqB,EAC3C,OAAO,4BAA4B,+BAA+B,EAClE,OAAO,0BAA0B,oCAAoC,QAAQ,EAC7E,OAAO,wBAAwB,4BAA4B,EAC3D,OAAO,CAAC,QAAQ;AACf,QAAI;AACJ,QAAI,IAAI,KAAM,QAAO;AAAA,aACZ,IAAI,IAAK,QAAO;AAAA,aAChB,IAAI,aAAc,QAAO;AAAA,SAC7B;AACH,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,4CAA4C;AAAA,MACpE;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,CAAC,IAAI,OAAO,CAAC,IAAI,cAAc,CAAC,IAAI,KAAK;AAC3C,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK;AAAA,QAClB;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,UAAU,IAAI,OACjB,MAAM,GAAG,EACT,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAE9B,UAAM,QAAQ,aAAa;AAAA,MACzB;AAAA,MACA,OAAO;AAAA,QACL,KAAK,IAAI;AAAA,QACT,YAAY,IAAI;AAAA,QAChB,KAAK,IAAI;AAAA,QACT,OAAO,IAAI;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,MACA,SAAS,IAAI;AAAA,MACb,KAAK,IAAI;AAAA,MACT,QAAQ,IAAI,eACR,EAAE,QAAQ,IAAI,cAAc,QAAQ,IAAI,WAAW,IACnD;AAAA,MACJ,aAAa,IAAI;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAED,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC,KAAK,IAAI;AAAA,IAC7E;AACA,QAAI,IAAI,IAAK,SAAQ,IAAI,EAAE,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;AACnD,QAAI,IAAI,WAAY,SAAQ,IAAI,EAAE,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;AACrE,QAAI,IAAI,IAAK,SAAQ,IAAI,EAAE,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;AAAA,EACrD,CAAC;AAEH,OACG,QAAQ,MAAM,EACd,MAAM,IAAI,EACV,YAAY,2BAA2B,EACvC,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,QAAQ,UAAa;AAC3B,QAAI,SAASA,UAAS,KAAK,EAAE,MAAM,CAAC,EAAG;AACvC,QAAI,MAAM,WAAW,GAAG;AACtB,cAAQ,IAAI,EAAE,IAAI,qBAAqB,CAAC;AACxC;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,sBAAsB,MAAM,MAAM;AAAA,CAAK;AAAA,IAClE;AAEA,eAAW,KAAK,OAAO;AACrB,YAAM,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,IAAI,EAAE,IAAI,KAAK;AACtD,YAAM,aAAuB,CAAC;AAC9B,UAAI,EAAE,MAAM,IAAK,YAAW,KAAK,OAAO,EAAE,MAAM,GAAG,EAAE;AACrD,UAAI,EAAE,MAAM,WAAY,YAAW,KAAK,WAAW,EAAE,MAAM,UAAU,EAAE;AACvE,UAAI,EAAE,MAAM,IAAK,YAAW,KAAK,OAAO,EAAE,MAAM,GAAG,EAAE;AACrD,UAAI,EAAE,MAAM,MAAO,YAAW,KAAK,SAAS,EAAE,MAAM,KAAK,EAAE;AAC3D,UAAI,EAAE,MAAM,QAAQ;AAClB,mBAAW,KAAK,WAAW,EAAE,MAAM,OAAO,KAAK,GAAG,CAAC,EAAE;AAEvD,YAAM,SACJ,EAAE,SAAS,UACP,EAAE,UACF,EAAE,SAAS,SACT,EAAE,MACF,EAAE,SACA,GAAG,EAAE,OAAO,MAAM,KAAK,EAAE,OAAO,UAAU,QAAQ,MAClD;AAEV,cAAQ;AAAA,QACN,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,MAAM,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,WAAW,KAAK,GAAG,CAAC,CAAC;AAAA,MACnF;AACA,cAAQ;AAAA,QACN,OAAO,EAAE,IAAI,QAAG,CAAC,IAAI,MAAM,GAAG,EAAE,cAAc,KAAK,EAAE,IAAI,UAAK,EAAE,WAAW,EAAE,CAAC,KAAK,EAAE;AAAA,MACvF;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,OACG,QAAQ,aAAa,EACrB,MAAM,IAAI,EACV,YAAY,qBAAqB,EACjC,OAAO,CAAC,OAAe;AACtB,QAAI,WAAW,EAAE,GAAG;AAClB,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,IACzE,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,UAAU,EAAE,aAAa,CAAC;AAC9D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,OACG,QAAQ,aAAa,EACrB,YAAY,eAAe,EAC3B,OAAO,CAAC,OAAe;AACtB,QAAI,WAAW,EAAE,GAAG;AAClB,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,IACzE,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,UAAU,EAAE,aAAa,CAAC;AAC9D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,OACG,QAAQ,cAAc,EACtB,YAAY,gBAAgB,EAC5B,OAAO,CAAC,OAAe;AACtB,QAAI,YAAY,EAAE,GAAG;AACnB,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;AAAA,MAC7D;AAAA,IACF,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,UAAU,EAAE,aAAa,CAAC;AAC9D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,OACG,QAAQ,WAAW,EACnB,YAAY,oCAAoC,EAChD,OAAO,OAAO,OAAe;AAC5B,UAAM,QAAQ,UAAa;AAC3B,UAAM,IAAI,MAAM,KAAK,CAACC,UAASA,MAAK,OAAO,EAAE;AAC7C,QAAI,CAAC,GAAG;AACN,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,UAAU,EAAE,aAAa,CAAC;AAC9D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,YAAQ,IAAI,EAAE,IAAI,gBAAgB,EAAE,KAAK,EAAE,IAAI;AAAA,CAAQ,CAAC;AAExD,UAAM,UAAU;AAAA,MACd,QAAQ;AAAA,MACR,KAAK,EAAE,MAAM,OAAO;AAAA,MACpB,OAAO,EAAE,MAAM,SAAS;AAAA,MACxB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,QAAQ;AAAA,IACV;AAEA,UAAM,UAAU,MAAM,UAAU,OAAO;AACvC,UAAM,SAAS,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE;AAElD,QAAI,QAAQ;AACV,YAAM,OAAO,OAAO,UAAU,EAAE,MAAM,QAAQ,KAAK,IAAI,EAAE,IAAI,QAAQ,KAAK;AAC1E,cAAQ,IAAI,KAAK,IAAI,IAAI,OAAO,OAAO,EAAE;AAAA,IAC3C,OAAO;AACL,cAAQ;AAAA,QACN,EAAE,OAAO,KAAK,QAAQ,OAAO,sCAAsC;AAAA,MACrE;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AACL;;;ACzNA,SAAS,gBAA6B;AACpC,SAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,YAAY;AAAA,IACZ,cAAc,CAAC,QAAQ,IAAI,CAAC;AAAA,IAC5B,SAAS;AAAA,EACX;AACF;AAEO,SAAS,cAAc,SAA+B,CAAC,GAAgB;AAC5E,QAAM,MAAM,EAAE,GAAG,cAAc,GAAG,GAAG,OAAO;AAE5C,QAAM,SAAsB;AAAA,IAC1B,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,cAAc;AAAA,IACd,SAAS;AAAA,IACT,OAAO;AAAA,IACP,SAAS;AAAA,IACT,WAAW;AAAA,IACX,SAAS,CAAC;AAAA,IACV,UAAU,CAAC;AAAA,EACb;AAGA,QAAM,gBAAgB,YAAY,EAAE,OAAO,UAAU,QAAQ,QAAQ,CAAC;AAGtE,QAAM,iBAAiB,IAAI,aAAa;AAAA,IAAQ,CAAC,OAC/C,YAAY,EAAE,OAAO,WAAW,aAAa,IAAI,QAAQ,QAAQ,CAAC;AAAA,EACpE;AAEA,QAAM,aAAa,CAAC,GAAG,eAAe,GAAG,cAAc;AACvD,SAAO,eAAe,WAAW;AAEjC,aAAW,SAAS,YAAY;AAC9B,QAAI,CAAC,MAAM,SAAU;AAErB,UAAM,QAAQ,WAAW,MAAM,QAAQ;AAEvC,QAAI,MAAM,WAAW;AACnB,aAAO;AACP,aAAO,SAAS;AAAA,QACd,YAAY,MAAM,GAAG,KAAK,MAAM,KAAK,oBAAe,MAAM,aAAa;AAAA,MACzE;AAEA,UAAI,IAAI,YAAY;AAClB,cAAM,MAAO,MAAM,UAAU,KAAK,kBAAkB;AACpD,cAAM,SAAS,MAAM,UAAU,KAAK;AACpC,cAAM,WAAW,eAAe,EAAE,QAAQ,KAAK,OAAO,CAAC;AACvD,kBAAU,MAAM,KAAK,UAAU;AAAA,UAC7B,OAAO,MAAM;AAAA,UACb,aAAa,IAAI,aAAa,CAAC;AAAA,UAC/B,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,QAAQ,KAAK,MAAM,GAAG;AAC7B,iBAAS;AAAA,UACP,QAAQ;AAAA,UACR,KAAK,MAAM;AAAA,UACX,OAAO,MAAM;AAAA,UACb,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV,CAAC;AACD,kBAAU;AAAA,UACR,QAAQ;AAAA,UACR,KAAK,MAAM;AAAA,UACX,OAAO,MAAM;AAAA,UACb,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,UAClC,QAAQ;AAAA,QACV,GAAG,MAAM,UAAU,KAAK,IAAI,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAC9C;AAAA,IACF,WAAW,MAAM,SAAS;AACxB,aAAO;AACP,aAAO,SAAS;AAAA,QACd,UAAU,MAAM,GAAG,KAAK,MAAM,KAAK,YAAO,MAAM,eAAe,eAAe,MAAM,aAAa;AAAA,MACnG;AAAA,IACF,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,YAAY,gBAAgB;AAClC,SAAO,YAAY,UAAU;AAC7B,aAAW,KAAK,WAAW;AACzB,WAAO,SAAS,KAAK,YAAY,EAAE,IAAI,MAAM,EAAE,WAAW,EAAE;AAAA,EAC9D;AAEA,SAAO;AACT;AAEA,SAAS,aAAa,QAAqB,SAA0B;AACnE,QAAM,QAAkB,CAAC;AAEzB,QAAM;AAAA,IACJ,GAAG,EAAE,KAAK,GAAG,QAAQ,MAAM,oBAAoB,CAAC,IAAI,EAAE,IAAI,OAAO,SAAS,CAAC;AAAA,EAC7E;AACA,QAAM;AAAA,IACJ,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,OAAO,YAAY,KAAK,EAAE,MAAM,GAAG,QAAQ,KAAK,IAAI,OAAO,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,OAAO,IAAI,OAAO,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,OAAO,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,cAAc,OAAO,SAAS,EAAE,CAAC;AAAA,EAChP;AAEA,MAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,UAAM;AAAA,MACJ,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,gBAAgB,CAAC,IAAI,OAAO,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC1E;AAAA,EACF;AAEA,MAAI,WAAW,OAAO,SAAS,SAAS,GAAG;AACzC,UAAM,KAAK,EAAE;AACb,eAAW,KAAK,OAAO,UAAU;AAC/B,UAAI,EAAE,WAAW,SAAS,EAAG,OAAM,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE;AAAA,eAC9C,EAAE,WAAW,OAAO,EAAG,OAAM,KAAK,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE;AAAA,eACpD,EAAE,WAAW,SAAS,EAAG,OAAM,KAAK,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE;AAAA,UAC3D,OAAM,KAAK,KAAK,CAAC,EAAE;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;AAKA,eAAsB,WAAW,SAA+B,CAAC,GAAkB;AACjF,QAAM,MAAM,EAAE,GAAG,cAAc,GAAG,GAAG,OAAO;AAE5C,UAAQ;AAAA,IACN,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,uBAAuB,CAAC,IAAI,EAAE,IAAI,cAAc,IAAI,eAAe,mBAAmB,IAAI,UAAU,GAAG,CAAC;AAAA,EAClI;AACA,UAAQ;AAAA,IACN,EAAE,IAAI,0BAA0B,IAAI,aAAa,MAAM,aAAa;AAAA,EACtE;AACA,UAAQ,IAAI;AAEZ,QAAM,OAAO,MAAM;AACjB,UAAM,SAAS,cAAc,GAAG;AAChC,YAAQ,IAAI,aAAa,QAAQ,IAAI,OAAO,CAAC;AAE7C,QAAI,OAAO,SAAS,SAAS,KAAK,IAAI,SAAS;AAC7C,cAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAGA,OAAK;AAGL,QAAM,WAAW,YAAY,MAAM,IAAI,kBAAkB,GAAI;AAG7D,QAAM,WAAW,MAAM;AACrB,kBAAc,QAAQ;AACtB,YAAQ,IAAI;AAAA,EAAK,EAAE,IAAI,sBAAsB,CAAC,EAAE;AAChD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,GAAG,UAAU,QAAQ;AAC7B,UAAQ,GAAG,WAAW,QAAQ;AAG9B,QAAM,IAAI,QAAQ,MAAM;AAAA,EAAC,CAAC;AAC5B;;;ACzLO,SAAS,sBAAsBC,UAAwB;AAG5D,EAAAA,SACG,QAAQ,wBAAwB,EAChC;AAAA,IACC;AAAA,EACF,EACC,OAAO,CAAC,KAAa,UAAkB;AACtC,aAAS,KAAK,KAAK;AACnB,YAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EACxE,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB,YAAY,sDAAsD,EAClE,OAAO,UAAU,iCAAiC,EAClD,OAAO,CAAC,KAAyB,QAAQ;AACxC,QAAI,CAAC,KAAK;AACR,YAAM,UAAU,WAAW;AAC3B,UACE;AAAA,QACEA;AAAA,QACA;AAAA,QACA,QAAQ,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,WAAW,EAAE,UAAU,EAAE;AAAA,MAC7D,GACA;AACA;AAAA,MACF;AACA,UAAI,QAAQ,WAAW,GAAG;AACxB,gBAAQ,IAAI,EAAE,IAAI,wBAAwB,CAAC;AAC3C;AAAA,MACF;AACA,cAAQ;AAAA,QACN;AAAA,EAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,cAAc,CAAC,KAAK,QAAQ,MAAM;AAAA;AAAA,MAC/D;AACA,iBAAW,KAAK,SAAS;AACvB,gBAAQ;AAAA,UACN,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAAA,QACtE;AAAA,MACF;AACA,cAAQ,IAAI;AACZ;AAAA,IACF;AAEA,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,UAAU,MAAM;AAClB,cAAQ,IAAI,EAAE,IAAI,wBAAwB,GAAG,GAAG,CAAC;AAAA,IACnD,OAAO;AACL,cAAQ,IAAI,QAAQ,KAAK,CAAC;AAAA,IAC5B;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB,YAAY,gCAAgC,EAC5C,OAAO,SAAS,wBAAwB,EACxC,OAAO,aAAa,8BAA8B,EAClD,OAAO,OAAO,KAAa,QAAQ;AAClC,QAAI,IAAI,KAAK;AACX,YAAM,QAAQ,WAAW,EAAE;AAC3B,UACE,CAAE,MAAM;AAAA,QACN,2BAA2B,KAAK,QAAQ,UAAU,IAAI,MAAM,KAAK;AAAA,QACjE,EAAE,WAAW,IAAI,IAAI;AAAA,MACvB,GACA;AACA,gBAAQ,MAAM,EAAE,IAAI,UAAU,CAAC;AAC/B,gBAAQ,WAAW;AACnB;AAAA,MACF;AACA,kBAAY;AACZ,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,SAAS,CAAC,mBAAmB;AACtE;AAAA,IACF;AACA,UAAM,UAAU,OAAO,GAAG;AAC1B,QAAI,SAAS;AACX,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,IACrE,OAAO;AACL,cAAQ,IAAI,EAAE,IAAI,wBAAwB,GAAG,GAAG,CAAC;AAAA,IACnD;AAAA,EACF,CAAC;AAIH,EAAAA,SACG,QAAQ,SAAS,EACjB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,YAAY,EAAE,GAAG,MAAM,QAAQ,KAAK,CAAC;AACrD,UAAM,QAAQ,WAAW,EAAE,OAAO,IAAK,CAAC;AAExC,UAAM,YAAY,oBAAI,IAAoB;AAC1C,eAAW,KAAK,OAAO;AACrB,UAAI,EAAE,WAAW,UAAU,EAAE,KAAK;AAChC,kBAAU,IAAI,EAAE,MAAM,UAAU,IAAI,EAAE,GAAG,KAAK,KAAK,CAAC;AAAA,MACtD;AAAA,IACF;AAEA,UAAM,SAAS,CAAC,GAAG,UAAU,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAClE,UAAM,gBAAgB,QAAQ,OAAO,CAAC,MAAM;AAC1C,YAAM,QAAQ,EAAE,UAAU,KAAK,eAAe;AAC9C,aAAO,UAAU;AAAA,IACnB,CAAC;AACD,UAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,SAAS;AAC5D,UAAM,YAAY,QAAQ;AAAA,MACxB,CAAC,MAAM,EAAE,OAAO,WAAW,CAAC,EAAE,OAAO;AAAA,IACvC;AACA,UAAM,iBAAiB,QAAQ;AAAA,MAC7B,CAAC,MAAM,CAAC,EAAE,UAAU,KAAK,kBAAkB,CAAC,EAAE,OAAO;AAAA,IACvD;AAEA,QACE,SAASA,UAAS,KAAK;AAAA,MACrB,cAAc,OACX,MAAM,GAAG,CAAC,EACV,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,MAAM,EAAE;AAAA,MACzC,eAAe,cAAc,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,MAC7C,SAAS,YAAY,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,MACrC,OAAO,UAAU,IAAI,CAAC,OAAO;AAAA,QAC3B,KAAK,EAAE;AAAA,QACP,eAAe,EAAE,OAAO,iBAAiB;AAAA,MAC3C,EAAE;AAAA,MACF,SAAS;AAAA,QACP,OAAO,QAAQ;AAAA,QACf,QAAQ,QAAQ,SAAS,YAAY;AAAA,QACrC,SAAS,YAAY;AAAA,QACrB,OAAO,UAAU;AAAA,QACjB,eAAe,cAAc;AAAA,QAC7B,oBAAoB,QAAQ,SAAS,eAAe;AAAA,MACtD;AAAA,IACF,CAAC,GACD;AACA;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,uBAAuB,CAAC;AAAA,CAAI;AAEnE,QAAI,OAAO,SAAS,GAAG;AACrB,cAAQ,IAAI,KAAK,EAAE,KAAK,gBAAgB,CAAC,EAAE;AAC3C,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,MAAM,GAAG,CAAC,GAAG;AAC7C,gBAAQ,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC,WAAM,EAAE,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ;AAAA,MACtE;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,QAAI,cAAc,SAAS,GAAG;AAC5B,cAAQ;AAAA,QACN,KAAK,EAAE,KAAK,iBAAiB,CAAC,IAAI,EAAE,OAAO,cAAc,OAAO,SAAS,CAAC,CAAC;AAAA,MAC7E;AACA,iBAAW,KAAK,cAAc,MAAM,GAAG,CAAC,GAAG;AACzC,cAAM,MAAM,EAAE,UAAU,KAAK,YACzB,EAAE;AAAA,UACA,YAAY,IAAI,KAAK,EAAE,SAAS,KAAK,SAAS,EAAE,mBAAmB,CAAC;AAAA,QACtE,IACA;AACJ,gBAAQ,IAAI,OAAO,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,EAAE;AAAA,MAC3D;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,SAAS;AACxD,UAAM,QAAQ,QAAQ;AAAA,MACpB,CAAC,MAAM,EAAE,OAAO,WAAW,CAAC,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,cAAQ;AAAA,QACN,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,QAAQ,MAAM;AAAA,MAC1C;AACA,iBAAW,KAAK,QAAQ,MAAM,GAAG,CAAC,GAAG;AACnC,gBAAQ,IAAI,OAAO,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;AAAA,MACpD;AACA,cAAQ,IAAI;AAAA,IACd;AACA,QAAI,MAAM,SAAS,GAAG;AACpB,cAAQ;AAAA,QACN,KAAK,EAAE,OAAO,wBAAwB,CAAC,IAAI,MAAM,MAAM;AAAA,MACzD;AACA,iBAAW,KAAK,MAAM,MAAM,GAAG,CAAC,GAAG;AACjC,gBAAQ;AAAA,UACN,OAAO,EAAE,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,OAAO,aAAa,aAAa,CAAC;AAAA,QAC7F;AAAA,MACF;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,aAAa,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,QAAQ;AAC7D,UAAM,kBAAkB,WAAW;AAAA,MAAO,CAAC,MACzC,EAAE,UAAU,KAAK,MAAM;AAAA,QAAK,CAAC,MAC3B,CAAC,WAAW,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC;AAAA,MACjD;AAAA,IACF;AACA,QAAI,gBAAgB,SAAS,GAAG;AAC9B,cAAQ,IAAI,KAAK,EAAE,KAAK,oBAAoB,CAAC,EAAE;AAC/C,cAAQ;AAAA,QACN,OAAO,gBAAgB,MAAM;AAAA,MAC/B;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,aAAa,QAAQ;AAAA,MACzB,CAAC,MAAM,CAAC,EAAE,UAAU,KAAK,kBAAkB,CAAC,EAAE,OAAO;AAAA,IACvD;AACA,QAAI,WAAW,SAAS,GAAG;AACzB,cAAQ,IAAI,KAAK,EAAE,KAAK,uBAAuB,CAAC,EAAE;AAClD,cAAQ;AAAA,QACN,OAAO,WAAW,MAAM;AAAA,MAC1B;AACA,cAAQ;AAAA,QACN,WAAW,EAAE,KAAK,mDAAmD,CAAC;AAAA,MACxE;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,YAAQ,IAAI,KAAK,EAAE,KAAK,UAAU,CAAC,EAAE;AACrC,YAAQ,IAAI,sBAAsB,QAAQ,MAAM,EAAE;AAClD,YAAQ,IAAI,eAAe,QAAQ,SAAS,QAAQ,MAAM,EAAE;AAC5D,YAAQ,IAAI,gBAAgB,QAAQ,MAAM,EAAE;AAC5C,YAAQ,IAAI,cAAc,MAAM,MAAM,EAAE;AACxC,YAAQ,IAAI,uBAAuB,cAAc,MAAM,EAAE;AACzD,YAAQ;AAAA,MACN,6BAA6B,QAAQ,SAAS,WAAW,MAAM;AAAA,IACjE;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAIH,EAAAA,SACG,QAAQ,OAAO,EACf,YAAY,iDAAiD,EAC7D;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,iBAAiB,6BAA6B,EACrD,OAAO,iBAAiB,kCAAkC,EAC1D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,UAAU,wCAAwC,EACzD,OAAO,OAAO,QAAQ;AACrB,UAAM,eAAe,IAAI,cACrB,IAAI,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC,IACtD,CAAC,QAAQ,IAAI,CAAC;AAElB,QAAI,IAAI,MAAM;AACZ,YAAM,SAAS,cAAc;AAAA,QAC3B,YAAY,IAAI;AAAA,QAChB;AAAA,QACA,SAAS,IAAI;AAAA,MACf,CAAC;AAED,cAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC3C;AAAA,IACF;AAEA,UAAM,WAAW;AAAA,MACf,iBAAiB,IAAI;AAAA,MACrB,YAAY,IAAI;AAAA,MAChB;AAAA,MACA,SAAS,IAAI;AAAA,IACf,CAAC;AAAA,EACH,CAAC;AACL;;;ACtRO,SAAS,yBAAyBC,UAAwB;AAC/D,EAAAA,SACG,QAAQ,eAAe,EACvB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,eAAe,EACvC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,mCAAmC,UAAU,IAAI,EAC3E,OAAO,mBAAmB,8BAA8B,EACxD,OAAO,YAAY,6BAA6B,EAChD,OAAO,UAAU,oBAAoB,EACrC,OAAO,CAAC,KAAa,QAAQ;AAC5B,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,QAAQ,KAAK,SAAS;AAI5B,UAAM,UAAU,gBAAgB,OAAO,IAAI;AAE3C,QAAI,IAAI,MAAM;AACZ,YAAM,YAAY,cAAc;AAChC,UAAI,UAAU,WAAW,GAAG;AAC1B,gBAAQ,IAAI,EAAE,IAAI,uBAAuB,CAAC;AAC1C;AAAA,MACF;AACA,iBAAW,KAAK,WAAW;AACzB,cAAM,SAAS,EAAE,WACb,EAAE,IAAI,UAAU,IAChB,EAAE,QACA,EAAE,MAAM,QAAQ,IAChB,EAAE,IAAI,SAAS;AACrB,cAAM,MAAM,KAAK;AAAA,UACf;AAAA,UACA,KAAK;AAAA,aACF,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI,KAAK,IAAI,KAAK;AAAA,UACnD;AAAA,QACF;AACA,gBAAQ;AAAA,UACN,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,gBAAgB,EAAE,SAAS;AAAA,QAC3G;AAAA,MACF;AACA;AAAA,IACF;AAEA,QAAI,IAAI,QAAQ;AACd,YAAM,UAAU,eAAe,KAAK,OAAO,OAAO;AAClD,UAAI,SAAS;AACX,gBAAQ;AAAA,UACN,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,KAAK,GAAG,CAAC;AAAA,QACrE;AAAA,MACF,OAAO;AACL,gBAAQ,IAAI,EAAE,IAAI,kCAAkC,GAAG,EAAE,CAAC;AAAA,MAC5D;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,cAAc,KAAK,OAAO,SAAS,IAAI,KAAK;AAAA,MACxD,QAAQ,IAAI,UAAU;AAAA,IACxB,CAAC;AACD,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG;AAAA,IACvE;AACA,YAAQ;AAAA,MACN,EAAE;AAAA,QACA,QAAQ,MAAM,EAAE,YAAY,MAAM,MAAM,aAAa,MAAM,SAAS;AAAA,MACtE;AAAA,IACF;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,WAAW,EACnB,YAAY,mDAAmD,EAC/D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,YAAY,cAAc;AAChC,QAAI,SAASA,UAAS,KAAK,EAAE,UAAU,CAAC,EAAG;AAC3C,QAAI,UAAU,WAAW,GAAG;AAC1B,cAAQ,IAAI,EAAE,IAAI,sBAAsB,CAAC;AACzC;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,EAAK,QAAQ,IAAI;AAAA,CAAoB,CAAC;AACzD,eAAW,KAAK,WAAW;AACzB,YAAM,SAAS,EAAE,WACb,EAAE,IAAI,GAAG,QAAQ,KAAK,WAAW,IACjC,EAAE,QACA,EAAE,MAAM,GAAG,QAAQ,KAAK,SAAS,IACjC,EAAE,IAAI,GAAG,QAAQ,OAAO,UAAU;AACxC,YAAM,MAAM,KAAK;AAAA,QACf;AAAA,QACA,KAAK,OAAO,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI,KAAK,IAAI,KAAK,GAAI;AAAA,MAClE;AACA,cAAQ,IAAI,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG;AACvD,cAAQ;AAAA,QACN,EAAE,IAAI,UAAU,EAAE,EAAE,YAAY,EAAE,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,EAAE;AAAA,MAC3E;AACA,UAAI,EAAE,UAAW,SAAQ,IAAI,EAAE,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAAA,IACpE;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,QAAQ,EAChB,YAAY,wCAAwC,EACpD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,UAAU,iBAAiB;AACjC,QAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,cAAQ,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAC5C;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK,+BAA0B,CAAC;AAE9C,QACE,CAAC,QAAQ,gBACT,CAAC,QAAQ,iBACT,CAAC,QAAQ,iBACT;AACA,cAAQ,IAAI,EAAE,IAAI,wCAAwC,CAAC;AAC3D,cAAQ;AAAA,QACN,EAAE,IAAI,2DAA2D;AAAA,MACnE;AACA;AAAA,IACF;AAEA,QAAI,QAAQ,cAAc;AACxB,cAAQ,IAAI,EAAE,KAAK,eAAe,CAAC;AACnC,YAAM,IAAI,QAAQ,QAAQ;AAC1B,UAAI,EAAE;AACJ,gBAAQ,IAAI,EAAE,MAAM,oBAAoB,EAAE,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC;AACpE,UAAI,EAAE;AACJ,gBAAQ,IAAI,EAAE,IAAI,oBAAoB,EAAE,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;AACjE,UAAI,EAAE;AACJ,gBAAQ;AAAA,UACN,EAAE,MAAM,sBAAsB,EAAE,aAAa,KAAK,IAAI,CAAC,EAAE;AAAA,QAC3D;AACF,UAAI,EAAE;AACJ,gBAAQ,IAAI,EAAE,IAAI,sBAAsB,EAAE,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC;AACpE,UAAI,EAAE;AACJ,gBAAQ,IAAI,EAAE,IAAI,sBAAsB,EAAE,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC;AAAA,IACtE;AAEA,QAAI,QAAQ,eAAe;AACzB,cAAQ,IAAI,EAAE,KAAK,gBAAgB,CAAC;AACpC,YAAM,IAAI,QAAQ,QAAQ;AAC1B,UAAI,EAAE;AACJ,gBAAQ;AAAA,UACN,EAAE,MAAM,0BAA0B,EAAE,cAAc,KAAK,IAAI,CAAC,EAAE;AAAA,QAChE;AACF,UAAI,EAAE;AACJ,gBAAQ;AAAA,UACN,EAAE,IAAI,0BAA0B,EAAE,aAAa,KAAK,IAAI,CAAC,EAAE;AAAA,QAC7D;AACF,UAAI,EAAE;AACJ,gBAAQ,IAAI,0BAA0B,EAAE,iBAAiB,GAAG;AAC9D,UAAI,EAAE,iBAAiB;AACrB,gBAAQ,IAAI,0BAA0B,EAAE,YAAY,EAAE;AAAA,IAC1D;AAEA,QAAI,QAAQ,iBAAiB;AAC3B,cAAQ,IAAI,EAAE,KAAK,4BAA4B,CAAC;AAChD,YAAM,IAAI,QAAQ,QAAQ;AAC1B,UAAI,EAAE;AACJ,gBAAQ;AAAA,UACN,kCAAkC,EAAE,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACvE;AACF,UAAI,EAAE,cAAe,SAAQ,IAAI,gBAAgB,EAAE,aAAa,GAAG;AAAA,IACrE;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AACL;;;AC7KA,SAAS,cAAAC,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,QAAAC,OAAM,WAAW,mBAAmB;;;ACQtC,IAAM,aAAa;AAe1B,IAAM,cAAc;AACpB,IAAM,cAAc;AAGb,SAAS,MAAM,OAAwB;AAC5C,SAAO,MAAM,WAAW,UAAU;AACpC;AAOO,SAAS,SAAS,KAAwB;AAC/C,MAAI,CAAC,MAAM,GAAG,GAAG;AACf,UAAM,IAAI,MAAM,8BAA8B,GAAG,GAAG;AAAA,EACtD;AAEA,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,OAAO;AAGV,UAAM,WAAW,2BAA2B,KAAK,GAAG;AACpD,QAAI,YAAY,YAAY,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,SAAS,EAAE,SAAS,SAAS,CAAC,CAAC,GAAG;AAC7F,YAAM,IAAI;AAAA,QACR,gBAAgB,GAAG,qGAEA,SAAS,CAAC,CAAC,sCAAsC,SAAS,CAAC,CAAC;AAAA,MACjF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,gBAAgB,GAAG;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,CAAC,EAAE,UAAU,KAAK,KAAK,IAAI;AAEjC,MAAI,CAAC,YAAY,KAAK,GAAG,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,gBAAgB,GAAG,OAAO,GAAG;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,OAAO;AACT,eAAW,QAAQ,MAAM,MAAM,GAAG,GAAG;AACnC,UAAI,CAAC,KAAM;AACX,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,YAAM,OAAO,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;AAChD,YAAM,QAAQ,OAAO,KAAK,KAAK,mBAAmB,KAAK,MAAM,KAAK,CAAC,CAAC;AACpE,UAAI,SAAS,OAAO;AAClB,cAAM;AAAA,MACR,OAAO;AACL,cAAM,IAAI,MAAM,gBAAgB,GAAG,+BAA+B,IAAI,GAAG;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,aAAa,KAAK,SAAa;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAUO,SAAS,WAAW,KAAgB,OAA0B,CAAC,GAAkB;AACtF,QAAM,SAAqB,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,QAAQ;AAEzE,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,UAAU,IAAI,KAAK;AAAA,MAC/B,GAAG;AAAA,MACH;AAAA,MACA,KAAK,IAAI,OAAO,KAAK;AAAA,IACvB,CAAC;AACD,QAAI,UAAU,KAAM,QAAO;AAAA,EAC7B;AACA,SAAO;AACT;AAeO,SAAS,iBACd,KACA,OAA0B,CAAC,GACX;AAChB,QAAM,WAAmC,CAAC;AAC1C,QAAM,eAAyB,CAAC;AAChC,QAAM,UAA8C,CAAC;AAErD,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC/C,QAAI,CAAC,MAAM,KAAK,GAAG;AACjB,eAAS,IAAI,IAAI;AACjB;AAAA,IACF;AACA,UAAM,MAAM,SAAS,KAAK;AAC1B,UAAM,SAAS,WAAW,KAAK,IAAI;AACnC,QAAI,WAAW,MAAM;AACnB,cAAQ,KAAK,EAAE,MAAM,IAAI,CAAC;AAC1B;AAAA,IACF;AACA,aAAS,IAAI,IAAI;AACjB,iBAAa,KAAK,MAAM;AAAA,EAC1B;AAEA,SAAO,EAAE,UAAU,cAAc,QAAQ;AAC3C;;;ADtGO,SAAS,aAAa,MAA2B;AACtD,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,QAAM,cAA8B;AAAA,IAClC;AAAA,IACA,KAAK,KAAK;AAAA,IACV,QAAQ,KAAK,UAAU;AAAA,IACvB,QAAQ,KAAK;AAAA,EACf;AAEA,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAChD,QAAI,MAAM,OAAW,QAAO,CAAC,IAAI;AAAA,EACnC;AAEA,QAAM,WAA0B,CAAC;AACjC,QAAM,kBAA4B,CAAC;AACnC,QAAM,kBAA4B,CAAC;AACnC,QAAM,kBAAkB,oBAAI,IAAY;AAGxC,MAAI,KAAK,gBAAgB,OAAO;AAC9B,UAAM,SAAS,kBAAkB,WAAW;AAC5C,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AAChE,YAAM,QAAQ;AAAA,QACZ,EAAE,KAAK,KAAK,YAAY,GAAG,GAAG;AAAA,QAC9B;AAAA,MACF;AACA,UAAI,UAAU,MAAM;AAClB,YAAI,MAAM,aAAa,MAAO,iBAAgB,KAAK,GAAG;AAAA,iBAC7C,KAAK,OAAQ,iBAAgB,KAAK,GAAG;AAAA,YACzC,iBAAgB,KAAK,GAAG;AAC7B;AAAA,MACF;AACA,aAAO,GAAG,IAAI;AACd,eAAS,KAAK,EAAE,MAAM,KAAK,QAAQ,WAAW,CAAC;AAC/C,UAAI,MAAM,SAAS,EAAG,iBAAgB,IAAI,KAAK;AAAA,IACjD;AAAA,EACF;AAGA,QAAM,WACJ,KAAK,aACJC,YAAWC,MAAK,aAAa,MAAM,CAAC,IAAI,CAACA,MAAK,aAAa,MAAM,CAAC,IAAI,CAAC;AAE1E,aAAW,QAAQ,UAAU;AAC3B,UAAM,OAAO,YAAY,aAAa,IAAI;AAC1C,QAAI,CAACD,YAAW,IAAI,GAAG;AACrB,YAAM,IAAI,MAAM,uBAAuB,IAAI,EAAE;AAAA,IAC/C;AACA,UAAM,SAAS,OAAO,YAAY,YAAYE,cAAa,MAAM,MAAM,CAAC,CAAC;AACzE,UAAM,EAAE,UAAU,cAAc,QAAQ,IAAI,iBAAiB,QAAQ,WAAW;AAEhF,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACpD,aAAO,IAAI,IAAI;AACf,eAAS,KAAK;AAAA,QACZ;AAAA,QACA,QAAQ,MAAM,OAAO,IAAI,CAAC,IAAI,iBAAiB;AAAA,MACjD,CAAC;AAAA,IACH;AACA,eAAW,SAAS,cAAc;AAChC,UAAI,MAAM,SAAS,EAAG,iBAAgB,IAAI,KAAK;AAAA,IACjD;AAEA,eAAW,KAAK,QAAS,iBAAgB,KAAK,EAAE,IAAI;AAAA,EACtD;AAEA,SAAO;AAAA,IACL,UAAU,SAAS,IAAI,CAAC,MAAM,YAAY,aAAa,CAAC,CAAC;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,CAAC,GAAG,eAAe;AAAA,EACtC;AACF;AAMA,eAAsB,WAAW,MAAsC;AACrE,QAAM,UAAU,WAAW,KAAK,OAAO;AACvC,oBAAkB,SAAS,KAAK,SAAS,KAAK,MAAM,KAAK,WAAW;AAEpE,QAAM,OAAO,aAAa,IAAI;AAE9B,MAAI,KAAK,gBAAgB,SAAS,GAAG;AACnC,UAAM,IAAI;AAAA,MACR,6BAA6B,KAAK,gBAAgB,KAAK,IAAI,CAAC;AAAA,IAE9D;AAAA,EACF;AAEA,MAAI,QAAQ,cAAc;AACxB,eAAW,OAAO,QAAQ,cAAc;AACtC,aAAO,KAAK,OAAO,GAAG;AAAA,IACxB;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,cAAc;AAAA,IACjC;AAAA,IACA,SAAS,KAAK;AAAA,IACd,MAAM,KAAK;AAAA,IACX,QAAQ,KAAK;AAAA,IACb,iBAAiB,KAAK;AAAA,IACtB,eAAe,KAAK;AAAA,IACpB,aAAa,KAAK;AAAA,EACpB,CAAC;AAED,SAAO,EAAE,GAAG,QAAQ,KAAK;AAC3B;;;AEhKA,SAAS,cAAAC,aAAY,WAAW,gBAAAC,eAAc,iBAAAC,sBAAqB;AACnE,SAAS,eAAe;AACxB,SAAS,SAAS,QAAAC,aAAY;AAIvB,IAAM,UAAoB,CAAC,UAAU,QAAQ,QAAQ;AAG5D,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAqBA,IAAM,cAAc;AAEpB,SAAS,YAAY,QAAyC;AAC5D,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,EAAE,SAAS,aAAa,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE;AAAA,IACnD,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,MAAM,CAAC;AAAA,QACP,KAAK,CAAC;AAAA,QACN,UAAU;AAAA,QACV,aAAa;AAAA,MACf;AAAA,IACF,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,SAAS,aAAa,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE;AAAA,EACpE;AACF;AAEO,SAAS,cACd,QACA,QACA,aACQ;AACR,QAAM,OAAO,QAAQ;AACrB,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,SACHA,MAAK,MAAM,WAAW,UAAU,IAChCA,MAAK,aAAa,WAAW,UAAU;AAAA,IAC7C,KAAK;AACH,aAAO,SACHA,MAAK,MAAM,SAAS,YAAY,UAAU,IAC1CA,MAAK,aAAa,SAAS,YAAY,UAAU;AAAA,IACvD,KAAK;AACH,UAAI,QAAQ;AAGV,cAAM,IAAI;AAAA,UACR;AAAA,QAGF;AAAA,MACF;AACA,aAAOA,MAAK,aAAa,WAAW;AAAA,EACxC;AACF;AAEO,SAAS,YAAY,MAAiC;AAC3D,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,QAAM,aAAa,cAAc,KAAK,QAAQ,KAAK,UAAU,OAAO,WAAW;AAC/E,QAAM,WAAqB,CAAC;AAE5B,MAAI,SAAkC,CAAC;AACvC,MAAIH,YAAW,UAAU,GAAG;AAC1B,UAAM,MAAMC,cAAa,YAAY,MAAM;AAC3C,QAAI;AACF,eAAS,KAAK,MAAM,GAAG;AAAA,IACzB,QAAQ;AACN,YAAM,IAAI;AAAA,QACR,GAAG,UAAU;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAW,OAAO,cAAc,CAAC;AACvC,QAAM,UAAU,YAAY,KAAK,MAAM;AACvC,QAAM,WAAW,QAAQ,WAAW;AAEpC,MAAI;AACJ,MAAI,aAAa,QAAW;AAC1B,aAASD,YAAW,UAAU,IAAI,YAAY;AAC9C,YAAQ,WAAW,IAAI;AAAA,EACzB,WAAW,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,OAAO,GAAG;AAC/D,aAAS;AAAA,EACX,WAAW,KAAK,OAAO;AACrB,aAAS;AACT,YAAQ,WAAW,IAAI;AAAA,EACzB,OAAO;AACL,aAAS;AACT,aAAS;AAAA,MACP,gBAAgB,WAAW,6BAA6B,UAAU;AAAA,IACpE;AAAA,EACF;AAEA,SAAO,aAAa;AAEpB,MAAI,WAAW,eAAe,CAAC,KAAK,QAAQ;AAC1C,cAAU,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,IAAAE,eAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAAA,EAClE;AAEA,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb;AAAA,IACA,YAAY;AAAA,IACZ;AAAA,IACA,QAAQ,KAAK,UAAU;AAAA,IACvB;AAAA,EACF;AACF;;;AC3IA,SAAS,iBAAiB;AAQnB,IAAM,eAA6B,CAAC,UAAU,UAAU,YAAY;AAsC3E,IAAM,UAA6C;AAAA,EACjD,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,UAAU,OAAO,KAAK,GAAI,KAAK,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAE,CAAC;AAAA,IACzF,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA;AAAA,IAER,MAAM,CAAC,KAAK,UACT,KAAK,cAAc,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;AAAA,IACtF,aAAa;AAAA,EACf;AAAA,EACA,YAAY;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,OAAO,GAAG,CAAC;AAAA,IACtC,aAAa;AAAA,EACf;AACF;AAEA,SAAS,gBAAgB,QAAyB;AAChD,QAAM,QAAQ,UAAU,QAAQ,CAAC,WAAW,GAAG,EAAE,OAAO,UAAU,OAAO,MAAM,CAAC;AAChF,SAAO,CAAC,MAAM;AAChB;AAGO,SAAS,gBAAgB,MAA6B;AAC3D,MAAI,KAAK,MAAM,OAAQ,QAAO,KAAK;AACnC,QAAM,SAAS,kBAAkB,KAAK,WAAW;AACjD,QAAM,eAAe,OAAO,KAAK,QAAQ,WAAW,CAAC,CAAC;AACtD,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,YAAY,MAA+B;AACzD,QAAM,SAAS,QAAQ,KAAK,MAAM;AAClC,QAAM,OAAO,gBAAgB,IAAI;AAEjC,MAAI,CAAC,KAAK,UAAU,CAAC,gBAAgB,OAAO,MAAM,GAAG;AACnD,UAAM,IAAI,MAAM,IAAI,OAAO,MAAM,0BAAqB,OAAO,WAAW,EAAE;AAAA,EAC5E;AAEA,QAAM,SAAqB,EAAE,QAAQ,KAAK,QAAQ,QAAQ,CAAC,GAAG,QAAQ,CAAC,GAAG,SAAS,CAAC,EAAE;AAEtF,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,KAAK,eAAe,GAAG;AACtC,UAAM,QACJ,WAAW,SACP,SACA;AAAA,MACE,EAAE,KAAK,KAAK,QAAQ,GAAG,GAAG;AAAA,MAC1B;AAAA,QACE,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK;AAAA,QACV,QAAQ,KAAK,UAAU;AAAA,QACvB,QAAQ,KAAK;AAAA,MACf;AAAA,IACF;AACN,QAAI,UAAU,MAAM;AAClB,aAAO,QAAQ,KAAK,GAAG;AACvB;AAAA,IACF;AAEA,QAAI,KAAK,QAAQ;AACf,aAAO,OAAO,KAAK,GAAG;AACtB;AAAA,IACF;AAEA,QAAI,mBAAkC;AACtC,eAAW,QAAQ,OAAO,KAAK,KAAK,IAAI,GAAG;AACzC,YAAM,QAAQ,UAAU,OAAO,QAAQ,MAAM;AAAA,QAC3C,OAAO;AAAA,QACP,KAAK,KAAK;AAAA,QACV,UAAU;AAAA,QACV,OAAO;AAAA,MACT,CAAC;AACD,UAAI,MAAM,WAAW,GAAG;AACtB,2BAAmB,MAAM,QAAQ,KAAK,KAAK,MAAM,OAAO,WAAW,QAAQ,MAAM,MAAM;AACvF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,kBAAkB;AACpB,aAAO,OAAO,KAAK,EAAE,KAAK,OAAO,iBAAiB,CAAC;AACnD;AAAA,IACF;AAEA,WAAO,OAAO,KAAK,GAAG;AACtB,QAAI,CAAC,KAAK,QAAQ;AAChB,eAAS;AAAA,QACP,QAAQ;AAAA,QACR;AAAA,QACA,KAAK,KAAK;AAAA,QACV,QAAQ,KAAK,UAAU;AAAA,QACvB,QAAQ,GAAG,KAAK,YAAY,SAAS,GAAG,IAAI,uBAAuB,EAAE,aAAa,KAAK,MAAM,GAAG,KAAK,OAAO,KAAK,KAAK,IAAI,MAAM,EAAE;AAAA,MACpI,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;AC9JO,SAAS,uBAAuBE,UAAwB;AAC7D,EAAAA,SACG,QAAQ,kBAAkB,EAC1B;AAAA,IACC;AAAA,EACF,EACC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,qBAAqB,EAC/C,OAAO,yBAAyB,oDAAoD,EACpF,OAAO,iBAAiB,iCAAiC,EACzD,OAAO,oBAAoB,4CAA4C,EACvE,OAAO,YAAY,8CAA8C,EACjE,OAAO,aAAa,6CAA6C,EACjE,OAAO,OAAO,aAAuB,QAAQ;AAC5C,UAAM,OAAmB;AAAA,MACvB,SAAS,YAAY,CAAC;AAAA,MACtB,MAAM,YAAY,MAAM,CAAC;AAAA,MACzB,aAAa,IAAI,eAAe,QAAQ,IAAI;AAAA,MAC5C,KAAK,IAAI;AAAA,MACT,UAAU,IAAI;AAAA,MACd,aAAa,IAAI,aAAa;AAAA,MAC9B,SAAS,IAAI;AAAA,MACb,QAAQ,IAAI,WAAW;AAAA,MACvB,QAAQ;AAAA,IACV;AAEA,QAAI;AACF,UAAI,IAAI,QAAQ;AACd,cAAMC,QAAO,aAAa,EAAE,GAAG,MAAM,QAAQ,KAAK,CAAC;AACnD,gBAAQ,IAAI;AAAA,EAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC,EAAE;AAC3E,YAAIA,MAAK,SAAS,SAAS,GAAG;AAC5B,kBAAQ,IAAI,gBAAgBA,MAAK,SAAS,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,QAC9E;AACA,mBAAW,KAAKA,MAAK,UAAU;AAC7B,kBAAQ,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,QAC/E;AACA,mBAAW,QAAQA,MAAK,iBAAiB;AACvC,kBAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,qBAAqB,CAAC,EAAE;AAAA,QAC1E;AACA,mBAAW,QAAQA,MAAK,iBAAiB;AACvC,kBAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,qBAAqB,CAAC,EAAE;AAAA,QACjF;AACA,gBAAQ,KAAKA,MAAK,gBAAgB,SAAS,IAAI,IAAI,CAAC;AAAA,MACtD;AAEA,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,WAAW,IAAI;AAC5C,UAAI,KAAK,gBAAgB,SAAS,GAAG;AACnC,gBAAQ;AAAA,UACN,EAAE;AAAA,YACA,GAAG,QAAQ,OAAO,gCAAgC,KAAK,gBAAgB,KAAK,IAAI,CAAC;AAAA,UACnF;AAAA,QACF;AAAA,MACF;AACA,cAAQ,KAAK,IAAI;AAAA,IACnB,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,gBAAgB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QAClF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,EAAAD,SACG,QAAQ,eAAe,EACvB;AAAA,IACC,mEAAmE,aAAa,KAAK,IAAI,CAAC;AAAA,EAC5F,EACC,OAAO,qBAAqB,uDAAuD,EACnF,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,gDAAgD,EAC1E,OAAO,uBAAuB,mCAAmC,EACjE;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,aAAa,2CAA2C,EAC/D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,WAAmB,QAAQ;AAClC,QAAI,CAAC,aAAa,SAAS,SAAuB,GAAG;AACnD,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,oBAAoB,SAAS,6BAAwB,aAAa,KAAK,IAAI,CAAC,EAAE;AAAA,MACtG;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI;AACF,YAAM,SAAS,YAAY;AAAA,QACzB,QAAQ;AAAA,QACR,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,QACtD,aAAa,IAAI,eAAe,QAAQ,IAAI;AAAA,QAC5C,KAAK,IAAI;AAAA,QACT,MAAM,IAAI;AAAA,QACV,YAAY,IAAI,WAAW,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,QACjE,QAAQ,IAAI,WAAW;AAAA,QACvB,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,gBAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC3C,gBAAQ,KAAK,OAAO,OAAO,SAAS,IAAI,IAAI,CAAC;AAAA,MAC/C;AAEA,YAAM,SAAS,IAAI,SAAS,EAAE,IAAI,YAAY,IAAI;AAClD,cAAQ,IAAI;AAAA,EAAK,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,KAAK,cAAc,SAAS,EAAE,CAAC,EAAE;AAC7E,iBAAW,OAAO,OAAO,QAAQ;AAC/B,gBAAQ,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,IAAI,GAAG,EAAE;AAAA,MAClD;AACA,iBAAW,OAAO,OAAO,SAAS;AAChC,gBAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,iCAA4B,CAAC,EAAE;AAAA,MAChF;AACA,iBAAW,EAAE,KAAK,MAAM,KAAK,OAAO,QAAQ;AAC1C,gBAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,UAAK,KAAK,EAAE,CAAC,EAAE;AAAA,MACvE;AACA,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,KAAK,OAAO,OAAO,MAAM,UAAU,IAAI,SAAS,eAAe,EAAE,KAAK,OAAO,QAAQ,MAAM,aAAa,OAAO,OAAO,MAAM;AAAA,QAC9H;AAAA,MACF;AACA,cAAQ,KAAK,OAAO,OAAO,SAAS,IAAI,IAAI,CAAC;AAAA,IAC/C,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACnF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,gBAAgB,EACxB;AAAA,IACC,2DAA2D,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC/E,EACC,OAAO,gBAAgB,sDAAsD,EAC7E,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,WAAW,+CAA+C,EACjE,OAAO,aAAa,wCAAwC,EAC5D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAgB,QAAQ;AAC/B,QAAI,CAAC,QAAQ,SAAS,MAAgB,GAAG;AACvC,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,oBAAoB,MAAM,6BAAwB,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,MAC9F;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI;AACF,YAAM,SAAS,YAAY;AAAA,QACzB;AAAA,QACA,QAAQ,IAAI,WAAW;AAAA,QACvB,aAAa,IAAI,eAAe,QAAQ,IAAI;AAAA,QAC5C,OAAO,IAAI,UAAU;AAAA,QACrB,QAAQ,IAAI,WAAW;AAAA,MACzB,CAAC;AAED,UAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,gBAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC3C;AAAA,MACF;AAEA,YAAM,OACJ,OAAO,WAAW,YAAY,YAC9B,OAAO,WAAW,YAAY,YAAY;AAC5C,YAAM,SAAS,OAAO,SAAS,EAAE,IAAI,YAAY,IAAI;AACrD,cAAQ;AAAA,QACN;AAAA,EAAK,QAAQ,KAAK,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI,CAAC,KAAK,EAAE,KAAK,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,YAAY,OAAO,UAAU,IAAI,CAAC;AAAA,MACvH;AACA,iBAAW,WAAW,OAAO,UAAU;AACrC,gBAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,CAAC,IAAI,OAAO,EAAE;AAAA,MAC7C;AACA,UAAI,OAAO,WAAW,aAAa;AACjC,gBAAQ,IAAI,EAAE,IAAI,aAAa,MAAM,uDAAuD,CAAC;AAAA,MAC/F;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,kBAAkB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACpF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AACL;;;AClLA,SAAS,aAAAE,kBAAiB;AAkB1B,IAAM,QAAQ;AACd,IAAM,YAAY;AAClB,IAAM,SAAS,QAAQ;AACvB,IAAM,UAAU,QAAQ;AACxB,IAAM,SAAS;AAEf,SAAS,KAAK,SAAiB,QAAwB;AACrD,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,QAAQ,IAAK,QAAO,QAAQC,WAAU,QAAQ,MAAM,CAAC;AACzE,SAAO;AACT;AASO,IAAM,iBAA+C;AAAA,EAC1D,KAAK;AAAA,IACH,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,OAAO,KAAK,WAAW,EAAE,CAAC;AAAA,EAC5C;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,KAAK,QAAQ,EAAE;AAAA,EACjC;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,OAAO,KAAK,OAAO,EAAE,CAAC;AAAA,EACxC;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,cAAc,KAAK,OAAO,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;AAAA,EAClE;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,MAAM,KAAK,OAAO,EAAE,CAAC;AAAA,EACvC;AAAA,EACA,kBAAkB;AAAA,IAChB,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,WAAW,KAAK,SAAS,EAAE,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC;AAAA,EAC1E;AAAA,EACA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,gBAAgB,KAAK,SAAS,EAAE,CAAC;AAAA,EACnD;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,WAAW,KAAK,OAAO,EAAE,CAAC;AAAA,EAC5C;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,SAAS,KAAK,SAAS,EAAE,CAAC;AAAA,EAC5C;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,QAAQ,KAAK,QAAQ,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;AAAA,EACjF;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,OAAO,KAAK,SAAS,EAAE,CAAC;AAAA,EAC1C;AAAA,EACA,KAAK;AAAA,IACH,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,OAAO,KAAK,OAAO,EAAE,CAAC;AAAA,EACxC;AAAA,EACA,SAAS;AAAA,IACP,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,MAAM,eAAe,EAAE,QAAQ,WAAW,QAAQ,OAAO,QAAQ,GAAG,CAAC;AAAA,EACjF;AACF;AAEO,IAAM,wBAAwB;AAgC9B,SAAS,YAAY,KAAa,OAAqB,CAAC,GAAgB;AAC7E,QAAM,aAAa,KAAK,UAAU;AAClC,QAAM,SAAS,eAAe,UAAU;AACxC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR,0BAA0B,UAAU,iBAAiB,OAAO,KAAK,cAAc,EAAE,KAAK,IAAI,CAAC;AAAA,IAC7F;AAAA,EACF;AAEA,QAAM,QAAQ,KAAK,SAAS,OAAO,SAAS;AAC5C,QAAM,QAAQ,KAAK,SAAS;AAI5B,QAAM,WAAW,YAAY,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC;AACpD,MAAI,YAAY,CAAC,SAAS,SAAS,KAAK,UAAU,CAAC,KAAK,OAAO;AAC7D,UAAM,IAAI;AAAA,MACR,IAAI,GAAG,oCAAoC,KAAK;AAAA,IAClD;AAAA,EACF;AACA,YAAU,KAAK,OAAO;AAAA,IACpB,GAAG;AAAA,IACH;AAAA,IACA,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,aAAa,KAAK;AAAA,EACpB,CAAC;AAED,SAAO,EAAE,KAAK,OAAO,QAAQ,YAAY,MAAM;AACjD;AAiBO,SAASC,cAAa,KAAa,OAAuB,CAAC,GAAY;AAC5E,QAAM,QAAQ,YAAY,KAAK,IAAI;AACnC,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,IAAI,GAAG,qCAAqC;AAAA,EAC9D;AACA,SAAO,aAAgB,KAAK,EAAE,GAAG,MAAM,OAAO,MAAM,MAAM,CAAC;AAC7D;AAGO,SAAS,aAAa,OAAuB,CAAC,GAAmB;AACtE,QAAM,MAAsB,CAAC;AAC7B,aAAW,SAAS,YAAY,EAAE,GAAG,MAAM,QAAQ,KAAK,CAAC,GAAG;AAC1D,UAAM,OAAO,MAAM,UAAU;AAC7B,QAAI,CAAC,MAAM,OAAQ;AACnB,QAAI,KAAK;AAAA,MACP,KAAK,MAAM;AAAA,MACX,OAAO,MAAM;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AACA,SAAO;AACT;;;ACvMO,SAAS,uBAAuBC,UAAwB;AAC7D,QAAM,SAASA,SACZ,QAAQ,QAAQ,EAChB,YAAY,kEAA6D;AAE5E,SACG,QAAQ,aAAa,EACrB,YAAY,sDAAsD,EAClE;AAAA,IACC;AAAA,IACA,2BAA2B,OAAO,KAAK,cAAc,EAAE,KAAK,IAAI,CAAC;AAAA,IACjE;AAAA,EACF,EACC,OAAO,mBAAmB,kDAAkD,EAC5E,OAAO,wBAAwB,oDAA+C,EAC9E,OAAO,WAAW,qDAAqD,EACvE;AAAA,IACC;AAAA,IACA,yDAAyD,aAAa,KAAK,IAAI,CAAC;AAAA,EAClF,EACC,OAAO,uBAAuB,wCAAwC,EACtE,OAAO,uBAAuB,0DAA0D,EACxF,OAAO,UAAU,iCAAiC,EAClD,OAAO,gBAAgB,wBAAwB,EAC/C,OAAO,iBAAiB,eAAe,EACvC,OAAO,eAAe,YAAY,EAClC,OAAO,cAAc,WAAW,EAChC,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,CAAC,KAAa,QAAQ;AAC5B,UAAM,aAAa,IAAI;AACvB,QAAI,cAAc,CAAC,aAAa,SAAS,UAAwB,GAAG;AAClE,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,yBAAyB,UAAU,6BAAwB,aAAa,KAAK,IAAI,CAAC;AAAA,QACpG;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,SAAS,YAAY,KAAK;AAAA,MAC9B,GAAG;AAAA,MACH,QAAQ,IAAI;AAAA,MACZ,OAAO,IAAI;AAAA,MACX,aAAa,IAAI;AAAA,MACjB,OAAO,IAAI,UAAU;AAAA,IACvB,CAAC;AAGD,UAAM,OAAO,aACT,YAAY;AAAA,MACV,QAAQ;AAAA,MACR,MAAM,CAAC,GAAG;AAAA,MACV,cAAc,EAAE,CAAC,GAAG,GAAG,OAAO,MAAM;AAAA,MACpC,YAAY,CAAC,GAAG;AAAA,MAChB,aAAa,KAAK,eAAe,QAAQ,IAAI;AAAA,MAC7C,MAAM,IAAI;AAAA,MACV,YAAY,IAAI,WAAW,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,MACjE,QAAQ;AAAA,IACV,CAAC,IACD;AAEJ,QAAI,SAASA,UAAS,KAAK,EAAE,GAAG,QAAQ,KAAK,CAAC,GAAG;AAC/C,UAAI,QAAQ,KAAK,OAAO,SAAS,EAAG,SAAQ,KAAK,CAAC;AAClD;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,GAAG,QAAQ,OAAO,IAAI,EAAE,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,MAAM,KAAK,OAAO,KAAK,SAAS,CAAC;AAAA,IAC9H;AACA,YAAQ,IAAI,EAAE,IAAI,YAAY,OAAO,KAAK,EAAE,CAAC;AAC7C,YAAQ;AAAA,MACN,EAAE,IAAI,mFAAmF;AAAA,IAC3F;AACA,YAAQ,IAAI,EAAE,IAAI,wEAAqE,CAAC;AACxF,QAAI,MAAM;AACR,UAAI,KAAK,OAAO,SAAS,GAAG;AAC1B,gBAAQ;AAAA,UACN,GAAG,QAAQ,IAAI,IAAI,EAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,MAAM,KAAK,MAAM,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;AAAA,QACvH;AACA,gBAAQ;AAAA,UACN,EAAE;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,iBAAW,EAAE,MAAM,KAAK,KAAK,QAAQ;AACnC,gBAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,KAAK,MAAM,kBAAa,KAAK,EAAE,CAAC;AAAA,MAClF;AACA,UAAI,KAAK,OAAO,SAAS,EAAG,SAAQ,KAAK,CAAC;AAAA,IAC5C;AAAA,EACF,CAAC;AAEH,SACG,QAAQ,cAAc,EACtB,YAAY,iEAAiE,EAC7E,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,eAAe,EACvC,OAAO,eAAe,YAAY,EAClC,OAAO,cAAc,WAAW,EAChC,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,CAAC,KAAa,QAAQ;AAC5B,QAAIC,cAAa,KAAK,UAAU,GAAG,CAAC,GAAG;AACrC,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,sFAAiF,CAAC;AAAA,MACpJ;AAAA,IACF,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,KAAK,GAAG,mBAAmB,CAAC;AAChE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,SACG,QAAQ,MAAM,EACd,MAAM,IAAI,EACV,YAAY,6CAA6C,EACzD,OAAO,UAAU,gBAAgB,EACjC,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,eAAe,YAAY,EAClC,OAAO,cAAc,WAAW,EAChC,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,CAAC,QAAQ;AACf,UAAM,WAAW,aAAa,UAAU,GAAG,CAAC;AAC5C,QAAI,SAASD,UAAS,KAAK,EAAE,SAAS,CAAC,EAAG;AAE1C,QAAI,SAAS,WAAW,GAAG;AACzB,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,cAAc,SAAS,MAAM;AAAA,CAAK,CAAC;AACxE,eAAW,SAAS,UAAU;AAC5B,YAAM,QAAQ,CAAC,EAAE,KAAK,MAAM,GAAG,CAAC;AAChC,YAAM,KAAK,EAAE,IAAI,GAAG,MAAM,UAAU,SAAS,SAAM,MAAM,KAAK,EAAE,CAAC;AACjE,UAAI,MAAM,YAAY,GAAG;AACvB,cAAM,KAAK,EAAE,IAAI,UAAU,MAAM,SAAS,EAAE,CAAC;AAC7C,YAAI,MAAM,eAAe;AACvB,gBAAM,KAAK,EAAE,IAAI,SAAS,MAAM,aAAa,EAAE,CAAC;AAAA,QAClD;AAAA,MACF,OAAO;AACL,cAAM,KAAK,EAAE,MAAM,UAAU,CAAC;AAAA,MAChC;AACA,cAAQ,IAAI,KAAK,QAAQ,GAAG,IAAI,MAAM,KAAK,IAAI,CAAC,EAAE;AAAA,IACpD;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,QAAM,QAAQ,OACX,QAAQ,OAAO,EACf,YAAY,iFAAiF;AAEhG,QACG,QAAQ,KAAK,EACb,YAAY,6CAA6C,EACzD,OAAO,mBAAmB,qBAAqB,EAC/C,OAAO,iBAAiB,4BAA4B,EACpD,OAAO,gBAAgB,gDAAgD,EACvE,OAAO,eAAe,8CAAyC,EAC/D,OAAO,wBAAwB,sBAAsB,EACrD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,SAAkD;AAAA,MACtD,CAAC,WAAW,IAAI,OAAO;AAAA,MACvB,CAAC,SAAS,IAAI,KAAK;AAAA,MACnB,CAAC,QAAQ,IAAI,IAAI;AAAA,MACjB,CAAC,WAAW,IAAI,GAAG;AAAA,IACrB;AACA,UAAM,SAAS,OAAO,OAAO,CAAC,CAAC,EAAEE,IAAG,MAAM,OAAOA,SAAQ,QAAQ;AACjE,QAAI,OAAO,WAAW,GAAG;AACvB,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,8DAA8D;AAAA,MACtF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,UAAM,CAAC,MAAM,GAAG,IAAI,OAAO,CAAC;AAC5B,UAAM,UAAU,eAAe,EAAE,MAAM,KAAW,aAAa,IAAI,YAAY,CAAC;AAChF,QAAI,SAASF,UAAS,KAAK,OAAO,EAAG;AACrC,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC,iBAAiB,EAAE,KAAK,QAAQ,EAAE,CAAC,KAAK,IAAI,KAAK,EAAE,IAAI,iBAAiB,QAAQ,GAAG,CAAC,CAAC;AAAA,IAChI;AACA,YAAQ,IAAI,EAAE,IAAI,2CAA2C,QAAQ,EAAE,EAAE,CAAC;AAAA,EAC5E,CAAC;AAEH,QACG,QAAQ,MAAM,EACd,MAAM,IAAI,EACV,YAAY,4BAA4B,EACxC,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,WAAW,iBAAiB;AAClC,QAAI,SAASA,UAAS,KAAK,EAAE,SAAS,CAAC,EAAG;AAC1C,QAAI,SAAS,WAAW,GAAG;AACzB,cAAQ;AAAA,QACN,EAAE,IAAI,4EAA4E;AAAA,MACpF;AACA;AAAA,IACF;AACA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,2BAA2B,SAAS,MAAM;AAAA,CAAK,CAAC;AACrF,eAAW,MAAM,UAAU;AACzB,YAAM,QAAQ,GAAG,UAAU,EAAE,MAAM,SAAS,IAAI,EAAE,IAAI,UAAU;AAChE,YAAM,OAAO,GAAG,cAAc,EAAE,IAAI,WAAM,GAAG,WAAW,EAAE,IAAI;AAC9D,cAAQ;AAAA,QACN,KAAK,EAAE,KAAK,GAAG,EAAE,CAAC,KAAK,GAAG,KAAK,OAAO,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,iBAAiB,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI;AAAA,MAC9F;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,QACG,QAAQ,aAAa,EACrB,MAAM,IAAI,EACV,YAAY,yBAAyB,EACrC,OAAO,CAAC,OAAe;AACtB,QAAI,kBAAkB,EAAE,GAAG;AACzB,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,IACjF,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,8BAA8B,EAAE,GAAG,CAAC;AACxE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,aAAW,CAAC,MAAMG,QAAO,KAAK;AAAA,IAC5B,CAAC,UAAU,IAAI;AAAA,IACf,CAAC,WAAW,KAAK;AAAA,EACnB,GAAY;AACV,UACG,QAAQ,GAAG,IAAI,OAAO,EACtB,YAAY,GAAG,SAAS,WAAW,WAAW,SAAS,mBAAmB,EAC1E,OAAO,CAAC,OAAe;AACtB,UAAI,sBAAsB,IAAIA,QAAO,GAAG;AACtC,gBAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,MAClF,OAAO;AACL,gBAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,8BAA8B,EAAE,GAAG,CAAC;AACxE,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACL;AAEA,QACG,QAAQ,WAAW,EACnB,YAAY,2EAA2E,EACvF,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,IAAwB,QAAQ;AAC7C,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,QACE,KAAK;AAAA,QACL,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,MAAM;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACA,QAAI,SAASH,UAAS,KAAK,EAAE,QAAQ,CAAC,EAAG;AACzC,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,EAAE,IAAI,KAAK,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAClF,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,eAAW,KAAK,SAAS;AACvB,YAAM,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,KAAK,IAAI,EAAE,IAAI,QAAQ,KAAK;AACrE,cAAQ,IAAI,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;AAAA,IAC9E;AACA,QAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAG,SAAQ,KAAK,CAAC;AAAA,EACrD,CAAC;AACL;;;ACjQA,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACvCA,IAAM,WAAW;AACxB,IAAM,aAAa,KAAK;AACxB,IAAM,aAAa;AAWZ,SAAS,oBAAoB,OAAuB,CAAC,GAAa;AACvE,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,YAAY,EAAE,GAAG,MAAM,QAAQ,OAAO,QAAQ,KAAK,CAAC,GAAG;AACzE,QAAI,MAAM,YAAY,WAAW,MAAM,QAAQ,EAAE,UAAW;AAC5D,UAAM,QAAQ,UAAU,MAAM,KAAK;AAAA,MACjC,OAAO,MAAM;AAAA,MACb,aAAa,KAAK;AAAA,MAClB,KAAK,KAAK;AAAA,MACV,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,SAAS,MAAM,UAAU,WAAY,QAAO,IAAI,KAAK;AAAA,EAC3D;AAEA,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM;AACvD;AAEA,SAAS,aAAa,MAAe,OAAuC;AAC1E,MAAI,OAAO,SAAS,SAAU,QAAO,MAAM,IAAI;AAC/C,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,IAAI,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACtE,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,MAA+B,CAAC;AACtC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAEpE,UAAI,CAAC,IAAI,MAAM,UAAU,MAAM,SAAS,IAAI,aAAa,GAAG,KAAK;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,eAAe,OAAuB,CAAC,GAAa;AAClE,MAAI,SAAmB,CAAC;AACxB,MAAI,UAAU;AAEd,QAAM,SAAS,MAAM;AACnB,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,MAAM,UAAU,WAAY;AAChC,QAAI;AACF,eAAS,oBAAoB,IAAI;AAAA,IACnC,QAAQ;AAAA,IAER;AACA,cAAU;AAAA,EACZ;AAEA,QAAM,OAAO,CAAC,UAA0B;AACtC,WAAO;AACP,QAAI,MAAM;AACV,eAAW,KAAK,QAAQ;AACtB,UAAI,IAAI,SAAS,CAAC,EAAG,OAAM,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ;AAAA,IACvD;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,CAAI,YAAkB,aAAa,SAAS,IAAI;AAAA,IACxD,YAAY,MAAM;AAChB,gBAAU;AAAA,IACZ;AAAA,EACF;AACF;AAGO,IAAM,gBAA0B;AAAA,EACrC,MAAM,CAAC,MAAM;AAAA,EACb,QAAQ,CAAC,MAAM;AAAA,EACf,YAAY,MAAM;AAAA,EAAC;AACrB;;;ADpBA,IAAM,gCAAgC,KAAK,KAAK;AAEhD,SAAS,sBAA8B;AACrC,QAAM,MAAM,OAAO,QAAQ,IAAI,qBAAqB;AACpD,SAAO,OAAO,SAAS,GAAG,KAAK,MAAM,IAAI,MAAM;AACjD;AAGO,IAAM,sBAAsB;AAC5B,SAAS,oBAAoB,aAA6B;AAC/D,SAAO,eAAe,gBAAgB,WAAW,CAAC;AACpD;AAmCA,IAAM,cAAN,MAAkB;AAAA,EACC,QAAQ,oBAAI,IAAsB;AAAA;AAAA,EAGnD,KAAK,MAAc,OAAsB,MAAM,KAAK,IAAI,GAAY;AAClE,UAAM,cAAc,MAAM,MAAM,aAAa;AAC7C,UAAM,UAAU,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW;AACzE,QAAI,OAAO,UAAU,MAAM,UAAU;AACnC,WAAK,MAAM,IAAI,MAAM,MAAM;AAC3B,aAAO;AAAA,IACT;AACA,WAAO,KAAK,GAAG;AACf,SAAK,MAAM,IAAI,MAAM,MAAM;AAC3B,WAAO;AAAA,EACT;AACF;AAEA,SAAS,SAAS,GAAW,MAAM,KAAa;AAC9C,SAAO,EAAE,SAAS,MAAM,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,WAAM;AAClD;AAOO,SAAS,oBACd,YACA,SACA,UAA0B,CAAC,GACnB;AACR,QAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;AACvD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,kBAAkB,oBAAoB,WAAW;AACvD,QAAM,UAAU,IAAI,YAAY;AAEhC,QAAM,iBAAiB,WAAW,iBAAiB;AACnD,QAAM,SAAS,WAAW,sBAAsB,KAAK,CAAC;AACtD,QAAM,OAAO,iBAAiB,GAAG,eAAe,IAAI,sBAAsB;AAI1E,QAAM,eAAmC,CAAC;AAC1C,MAAI,OAAO,MAAO,cAAa,QAAQ,EAAE,aAAa,KAAK;AAC3D,MAAI,OAAO,WAAW;AACpB,iBAAa,YAAY,EAAE,aAAa,MAAM,WAAW,CAAC,CAAC,OAAO,UAAU,UAAU;AAAA,EACxF;AACA,MAAI,OAAO,QAAS,cAAa,UAAU,EAAE,aAAa,KAAK;AAE/D,QAAM,QAAQ,IAAI;AAAA,IAChB,EAAE,MAAM,SAAS,gBAAgB;AAAA,IACjC;AAAA,MACE;AAAA;AAAA;AAAA,MAGA,cAAc,WAAW,gBAAgB;AAAA,IAC3C;AAAA,EACF;AAKA,QAAM,gBAAgB,MAAM;AAC1B,UAAM,OAAO,MAAM,iBAAiB;AACpC,QAAI,KAAM,oBAAmB,GAAG,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE;AAAA,EAC7D;AAEA,QAAM,QAAQ,CAAC,QAAgB,SAAiC,WAC9D,SAAS,EAAE,QAAQ,QAAQ,OAAO,QAAQ,eAAe,QAAQ,cAAc,CAAC;AAElF,QAAM,SAAS,CAAC,UAAkB,WAAmC;AACnE,UAAM,oBAAoB,QAAQ,YAAO,QAAQ,KAAK,KAAK,MAAM,IAAI,aAAa;AAClF,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,2BAA2B,MAAM,GAAG,CAAC;AAAA,MACrE,SAAS;AAAA,IACX;AAAA,EACF;AAOA,QAAM,OAAO,CAAC,aAA4C;AACxD,QAAI;AACF,YAAM,WAAW,oBAAoB,UAAU,WAAW;AAC1D,UAAI,CAAC,SAAS,QAAS,QAAO,OAAO,UAAU,SAAS,UAAU,kBAAkB;AACpF,UACE,yBAAyB,UAAU,WAAW,KAC9C,CAAC,YAAY,UAAU,qBAAqB,eAAe,GAC3D;AACA,eAAO;AAAA,UACL;AAAA,UACA,iBAAiB,QAAQ,8DAAyD,QAAQ;AAAA,QAC5F;AAAA,MACF;AACA,YAAM,QAAQ,iBAAiB,UAAU,WAAW;AACpD,UAAI,SAAS,CAAC,QAAQ,KAAK,UAAU,KAAK,GAAG;AAC3C,eAAO;AAAA,UACL;AAAA,UACA,4BAA4B,QAAQ,MAAM,MAAM,QAAQ,cAAc,MAAM,UAAU;AAAA,QACxF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,aAAO,OAAO,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,cAAc,CAAC,aAA8B;AACjD,QAAI;AACF,aAAO,oBAAoB,UAAU,WAAW,EAAE;AAAA,IACpD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAQA,MAAI,OAAO,MAAO,sBAAqB;AACvC,MAAI,OAAO,UAAW,0BAAyB;AAC/C,MAAI,OAAO,QAAS,wBAAuB;AAE3C,SAAO;AAIP,WAAS,uBAA6B;AAGpC,eAAW,uBAAuB,mCAAmC,MAAM;AACzE,WAAK,MAAM,oBAAoB,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACjD,CAAC;AAED,UAAM,kBAAkB,wBAAwB,OAAO,YAAY;AACjE,YAAM,SAAS,MAAM,WAAW,UAAU,QAAQ,MAAM;AAGxD,aAAO,EAAE,GAAG,QAAQ,OAAO,OAAO,MAAM,OAAO,CAAC,MAAM,YAAY,EAAE,IAAI,CAAC,EAAE;AAAA,IAC7E,CAAC;AAED,UAAM,kBAAkB,uBAAuB,OAAO,SAAS,UAAU;AACvE,YAAM,WAAW,QAAQ,OAAO;AAChC,YAAM,UAAU,KAAK,QAAQ;AAC7B,UAAI,QAAS,QAAO;AAEpB,YAAM,cAAc,QAAQ,YAAO,QAAQ,KAAK,EAAE;AAKlD,YAAM,YAAY,QAAQ,OAAO,OAAO;AACxC,YAAM,aACJ,cAAc,SACV,CAAC,aAAqE;AACpE,aAAK,MACF,iBAAiB;AAAA,UAChB,QAAQ;AAAA,UACR,QAAQ,EAAE,GAAG,UAAU,eAAe,UAAU;AAAA,QAClD,CAAC,EACA,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACnB,IACA;AAEN,UAAI;AACF,cAAM,SAAU,MAAM,WAAW,SAAS,QAAQ,QAAQ,QAAW;AAAA,UACnE,QAAQ,MAAM;AAAA,UACd,SAAS,oBAAoB;AAAA,UAC7B,wBAAwB;AAAA,UACxB;AAAA,QACF,CAAC;AACD,eAAO,SAAS,OAAO,MAAM;AAAA,MAC/B,SAAS,KAAK;AAIZ,YAAI,eAAe,SAAU,OAAM;AACnC,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,cAAM,cAAc,QAAQ,aAAa,OAAO,EAAE;AAClD,eAAO;AAAA,UACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,8BAA8B,OAAO,GAAG,CAAC;AAAA,UACzE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAIA,WAAS,2BAAiC;AACxC,eAAW,uBAAuB,uCAAuC,MAAM;AAC7E,WAAK,MAAM,wBAAwB,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrD,CAAC;AACD,eAAW,uBAAuB,mCAAmC,CAAC,MAAM;AAC1E,WAAK,MAAM,oBAAoB,EAAE,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACzD,CAAC;AAED,UAAM;AAAA,MAAkB;AAAA,MAA4B,CAAC,YACnD,WAAW,cAAc,QAAQ,MAAM;AAAA,IACzC;AACA,UAAM;AAAA,MAAkB;AAAA,MAAoC,CAAC,YAC3D,WAAW,sBAAsB,QAAQ,MAAM;AAAA,IACjD;AACA,UAAM,kBAAkB,2BAA2B,OAAO,SAAS,UAAU;AAG3E,YAAM,iBAAiB,SAAS,QAAQ,OAAO,GAAG,CAAC,WAAM,QAAQ,KAAK,EAAE;AACxE,YAAM,SAAS,MAAM,WAAW,aAAa,QAAQ,QAAQ;AAAA,QAC3D,QAAQ,MAAM;AAAA,QACd,SAAS,oBAAoB;AAAA,MAC/B,CAAC;AACD,aAAO,SAAS,OAAO,MAAM;AAAA,IAC/B,CAAC;AACD,QAAI,OAAO,WAAW,WAAW;AAC/B,YAAM;AAAA,QAAkB;AAAA,QAAwB,CAAC,YAC/C,WAAW,kBAAkB,QAAQ,MAAM;AAAA,MAC7C;AACA,YAAM;AAAA,QAAkB;AAAA,QAA0B,CAAC,YACjD,WAAW,oBAAoB,QAAQ,MAAM;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AAIA,WAAS,yBAA+B;AACtC,eAAW,uBAAuB,qCAAqC,MAAM;AAC3E,WAAK,MAAM,sBAAsB,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACnD,CAAC;AACD,UAAM;AAAA,MAAkB;AAAA,MAA0B,CAAC,YACjD,WAAW,YAAY,QAAQ,MAAM;AAAA,IACvC;AACA,UAAM,kBAAkB,wBAAwB,OAAO,SAAS,UAAU;AAExE,YAAM,eAAe,QAAQ,OAAO,IAAI,YAAO,QAAQ,KAAK,EAAE;AAC9D,YAAM,SAAS,MAAM,WAAW,UAAU,QAAQ,QAAQ;AAAA,QACxD,QAAQ,MAAM;AAAA,QACd,SAAS,oBAAoB;AAAA,MAC/B,CAAC;AACD,aAAO,SAAS,OAAO,MAAM;AAAA,IAC/B,CAAC;AAAA,EACH;AACF;AAEA,SAAS,aAAa,KAAmD;AACvE,QAAM,UAAkC,CAAC;AACzC,aAAW,QAAQ,OAAO,CAAC,GAAG;AAC5B,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,OAAO,EAAG,OAAM,IAAI,MAAM,wCAAwC,IAAI,GAAG;AAC7E,YAAQ,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AAAA,EAChE;AACA,SAAO;AACT;AAGA,eAAsB,kBAAkB,MAAoC;AAC1E,QAAM,SAAS,IAAI,OAAO,EAAE,MAAM,kBAAkB,SAAS,gBAAgB,CAAC;AAE9E,MAAI,KAAK,KAAK;AACZ,UAAM,UAAU,aAAa,KAAK,OAAO;AACzC,QAAI,KAAK,YAAY;AAGnB,YAAM,QAAQ,UAAU,KAAK,YAAY,EAAE,aAAa,KAAK,aAAa,QAAQ,MAAM,CAAC;AACzF,UAAI,UAAU,MAAM;AAClB,cAAM,IAAI,MAAM,mBAAmB,KAAK,UAAU,4BAA4B;AAAA,MAChF;AACA,cAAQ,gBAAgB,UAAU,KAAK;AAAA,IACzC;AACA,UAAMI,aAAY,IAAI,8BAA8B,IAAI,IAAI,KAAK,GAAG,GAAG;AAAA,MACrE,aAAa,EAAE,QAAQ;AAAA,IACzB,CAAC;AACD,UAAM,OAAO,QAAQA,UAAS;AAC9B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,QAAS,OAAM,IAAI,MAAM,sCAAsC;AAEzE,QAAM,MAAM,KAAK,aACZ,OAAO,YAAY,OAAO,QAAQ,QAAQ,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,MAAM,MAAS,CAAC,IAIlF;AAEJ,QAAM,YAAY,IAAI,qBAAqB;AAAA,IACzC,SAAS,KAAK;AAAA,IACd,MAAM,KAAK,QAAQ,CAAC;AAAA,IACpB;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AAED,QAAM,OAAO,QAAQ,SAAS;AAC9B,SAAO;AACT;AAUA,eAAsB,QAAQ,MAAoC;AAChE,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AAGpD,gBAAc,WAAW;AAEzB,QAAM,QAAQ,KAAK,SAAS,KAAK,OAAO,CAAC,KAAK,SAAS,GAAI,KAAK,QAAQ,CAAC,CAAE,EAAE,KAAK,GAAG;AACrF,QAAM,UAAuB,EAAE,OAAO,eAAe,WAAW,EAAE;AAElE,QAAM,aAAa,MAAM,kBAAkB,IAAI;AAC/C,QAAM,iBAAiB,WAAW,iBAAiB;AACnD,QAAM,OAAO,WAAW,sBAAsB,KAAK,CAAC;AACpD,QAAM,WAAY,CAAC,SAAS,aAAa,SAAS,EAAY,OAAO,CAACC,OAAM,KAAKA,EAAC,CAAC;AAEnF,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,WAAW,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACvC,UAAM,IAAI;AAAA,MACR,mBAAmB,gBAAgB,QAAQ,KAAK;AAAA,IAClD;AAAA,EACF;AAEA,QAAM,SAAS,KAAK,UAAU,mBAAmB,WAAW;AAC5D,QAAM,WAAW,SAAS,eAAe,EAAE,YAAY,CAAC,IAAI;AAC5D,QAAM,UAAU,KAAK,MAAM,kBAAkB,KAAK,aAAa,cAAc;AAE7E,WAAS;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ,4BAA4B,KAAK,SAAS,OAAO,KAAK,SAAS,KAAK,GAAG,CAAC,aAAa,SAAS,aAAa,YAAY;AAAA,IAC/H,eAAe,QAAQ;AAAA,EACzB,CAAC;AACD,UAAQ;AAAA,IACN,4BAA4B,gBAAgB,QAAQ,KAAK,eAAU,OAAO,KAAK,SAAS,KAAK,GAAG,CAAC,qBAAqB,SAAS,aAAa,cAAc,aAAa,QAAQ,cAAc,MAAM,GAAG,CAAC,CAAC;AAAA,EAC1M;AAEA,QAAM,QAAQ,oBAAoB,YAAY,SAAS,EAAE,aAAa,SAAS,CAAC;AAChF,QAAM,YAAY,IAAI,qBAAqB;AAE3C,SAAO,IAAI,QAAgB,CAAC,YAAY;AACtC,QAAI,UAAU;AACd,UAAM,SAAS,CAAC,MAAc,WAAmB;AAC/C,UAAI,QAAS;AACb,gBAAU;AACV,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ,0BAA0B,MAAM;AAAA,QACxC,eAAe,QAAQ;AAAA,MACzB,CAAC;AAGD,YAAM,SAAS,QAAQ,WAAW,CAAC,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,CAAC;AACrE,YAAM,WAAW,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,GAAI,EAAE,MAAM,CAAC;AACrE,WAAK,QAAQ,KAAK,CAAC,QAAQ,QAAQ,CAAC,EAAE,KAAK,MAAM,QAAQ,IAAI,CAAC;AAAA,IAChE;AAEA,eAAW,UAAU,MAAM,OAAO,GAAG,uBAAuB;AAI5D,UAAM,UAAU,MAAM,OAAO,GAAG,mBAAmB;AAGnD,UAAM,UAAU,CAAC,QAAQ;AACvB,cAAQ,MAAM,oCAAoC,IAAI,OAAO,EAAE;AAAA,IACjE;AAGA,YAAQ,MAAM,GAAG,OAAO,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAG5D,YAAQ,OAAO,GAAG,SAAS,CAAC,QAA+B;AACzD,UAAI,IAAI,SAAS,QAAS,QAAO,GAAG,mBAAmB;AAAA,UAClD,QAAO,GAAG,iBAAiB,IAAI,OAAO,EAAE;AAAA,IAC/C,CAAC;AAGD,YAAQ,KAAK,WAAW,MAAM,OAAO,GAAG,YAAY,CAAC;AACrD,YAAQ,KAAK,UAAU,MAAM,OAAO,GAAG,aAAa,CAAC;AAErD,UAAM,QAAQ,SAAS,EAAE,MAAM,CAAC,QAAiB;AAC/C,cAAQ;AAAA,QACN,oCAAoC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACtF;AACA,aAAO,GAAG,iBAAiB;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AACH;;;AEtgBA,IAAM,UAAU,CAAC,OAAe,WAAqB,CAAC,MAAM,CAAC,GAAG,UAAU,KAAK;AAExE,SAAS,oBAAoBC,UAAwB;AAC1D,QAAM,MAAMA,SACT,QAAQ,KAAK,EACb,YAAY,8DAAyD;AAExE,MACG,QAAQ,mBAAmB,EAC3B;AAAA,IACC;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,EACH,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,eAAe,+CAA+C,EACrE,OAAO,mBAAmB,kEAAkE,EAC5F;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,OAAO,aAAuB,QAAQ;AAC5C,QAAI;AACF,UAAI,CAAC,IAAI,OAAO,YAAY,WAAW,GAAG;AACxC,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,SAAS,YAAY,CAAC;AAAA,QACtB,MAAM,YAAY,MAAM,CAAC;AAAA,QACzB,KAAK,IAAI;AAAA,QACT,SAAS,IAAI;AAAA,QACb,YAAY,IAAI;AAAA,QAChB,YAAY,IAAI,eAAe;AAAA;AAAA,QAE/B,QAAQ,IAAI,WAAW,QAAQ,QAAQ;AAAA,QACvC,OAAO,IAAI;AAAA,QACX,aAAa,IAAI;AAAA,MACnB,CAAC;AACD,cAAQ,KAAK,IAAI;AAAA,IACnB,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,oBAAoB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACtF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,MACG,QAAQ,gBAAgB,EACxB;AAAA,IACC;AAAA,EACF,EACC,OAAO,mBAAmB,gCAAgC,CAAC,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,EACtF,OAAO,mBAAmB,iCAAiC,EAC3D,OAAO,YAAY,qCAAqC,EACxD,OAAO,yBAAyB,4CAA4C,EAC5E,OAAO,CAAC,MAAc,QAAQ;AAC7B,UAAM,cAAsB,IAAI,eAAe,QAAQ,IAAI;AAC3D,UAAM,UAAU,oBAAoB,WAAW;AAC/C,QAAI,IAAI,QAAQ;AACd,UAAI,eAAe,MAAM,qBAAqB,OAAO,GAAG;AACtD,gBAAQ;AAAA,UACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,yBAAyB,EAAE,KAAK,IAAI,CAAC;AAAA,QAC7E;AAAA,MACF,OAAO;AACL,gBAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,mCAAmC,IAAI,GAAG,CAAC;AAC/E,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc,MAAM,qBAAqB,SAAS,IAAI,KAAK;AAAA,MACvE,QAAQ,IAAI,UAAU;AAAA,IACxB,CAAC;AACD,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC,iBAAiB,EAAE,KAAK,IAAI,CAAC,QAAQ,IAAI,GAAG;AAAA,IACrF;AACA,YAAQ,IAAI,EAAE,IAAI,QAAQ,MAAM,EAAE,YAAY,MAAM,MAAM,aAAa,MAAM,SAAS,EAAE,CAAC;AACzF,YAAQ;AAAA,MACN,EAAE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAEH,MACG,QAAQ,WAAW,EACnB,YAAY,mDAAmD,EAC/D,OAAO,yBAAyB,4CAA4C,EAC5E,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,UAAU,oBAAoB,IAAI,eAAe,QAAQ,IAAI,CAAC;AACpE,UAAM,UAAU,cAAc,EAAE;AAAA,MAC9B,CAAC,MAAM,EAAE,UAAU,uBAAuB,EAAE,YAAY;AAAA,IAC1D;AACA,QAAI,IAAI,MAAM;AACZ,cAAQ,IAAI,KAAK,UAAU,EAAE,WAAW,QAAQ,GAAG,MAAM,CAAC,CAAC;AAC3D;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA;AAAA,IACF;AACA,eAAW,KAAK,SAAS;AACvB,YAAM,QAAQ,EAAE,WACZ,EAAE,IAAI,UAAU,IAChB,EAAE,QACA,EAAE,MAAM,OAAO,IACf,EAAE,OAAO,SAAS;AACxB,cAAQ;AAAA,QACN,KAAK,QAAQ,KAAK,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,IAAI,WAAW,EAAE,SAAS,SAAM,EAAE,MAAM,EAAE,CAAC;AAAA,MACjG;AAAA,IACF;AAAA,EACF,CAAC;AACL;;;AC1IA,SAAS,cAAAC,aAAY,gBAAAC,eAAc,iBAAAC,gBAAe,cAAc;AAChE,SAAS,QAAAC,OAAM,iBAAiB;AAChC,SAAS,WAAAC,gBAAe;AAgBxB,SAAS,WAAmB;AAC1B,SAAO,QAAQ,IAAI,mBAAmBC,MAAKC,SAAQ,GAAG,WAAW,QAAQ;AAC3E;AAEA,SAAS,YAAyB;AAChC,QAAM,QAAQ,OAAO,QAAQ,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;AACxD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,SAAS,KAAK,OAAO;AAAA,IAC7B,QAAQ,IAAI,QAAQ,SAAS,IAAI,GAAG,SAAS,KAAK,KAAK,oCAA+B;AAAA,EACxF;AACF;AAEA,eAAe,sBAA4C;AAIzD,MAAI;AACF,UAAM,EAAE,MAAM,IAAI,MAAM,OAAO,kBAAkB;AACjD,UAAM,QAAQ,IAAI,MAAM,uBAAuB,OAAO;AACtD,UAAM,YAAY,IAAI;AACtB,UAAM,OAAO,MAAM,YAAY;AAC/B,UAAM,eAAe;AACrB,QAAI,SAAS,MAAM;AACjB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,SAAS,gBAA6B;AACpC,QAAM,MAAM,SAAS;AACrB,MAAI;AACF,UAAM,YAAYD,MAAK,KAAK,eAAe;AAC3C,IAAAE,eAAc,WAAW,IAAI;AAC7B,WAAO,SAAS;AAAA,EAClB,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,GAAG,GAAG,kBAAkB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAClF;AAAA,EACF;AAEA,QAAM,QAAQ,iBAAiB;AAC/B,MAAI,MAAM,gBAAgB,GAAG;AAC3B,WAAO,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,GAAG,GAAG,2BAA2B;AAAA,EACrF;AACA,MAAI,CAAC,MAAM,QAAQ;AACjB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,+BAA+B,MAAM,QAAQ,KAAK,MAAM,WAAW,IAAI,MAAM,WAAW;AAAA,IAClG;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,GAAG,GAAG,4BAA4B,MAAM,WAAW;AAAA,EAC7D;AACF;AAEA,SAAS,cAAc,aAAkC;AACvD,QAAM,eAAeF,MAAK,aAAa,cAAc;AACrD,MAAI,CAACG,YAAW,YAAY,GAAG;AAC7B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,sBAAsB,WAAW;AAAA,IAC3C;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAMC,cAAa,cAAc,MAAM,CAAC;AAC5D,UAAM,WAAW,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,EAAE;AACnD,UAAM,YAAY,CAAC,CAAC,OAAO;AAC3B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,GAAG,QAAQ,sBAAsB,YAAY,qBAAqB,EAAE;AAAA,IAC9E;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,mCAAmC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC7F;AAAA,EACF;AACF;AAEA,SAAS,cAA2B;AAClC,QAAM,UAAU,iBAAiB;AACjC,QAAM,SAAS;AAAA,IACb,QAAQ,gBAAgB;AAAA,IACxB,QAAQ,iBAAiB;AAAA,IACzB,QAAQ,mBAAmB;AAAA,EAC7B,EAAE,OAAO,OAAO;AAChB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,OAAO,SACX,WAAW,OAAO,KAAK,IAAI,CAAC,KAC5B;AAAA,EACN;AACF;AAEA,SAAS,uBAAoC;AAC3C,QAAM,IAAI,qBAAqB;AAC/B,MAAI,MAAM,GAAG;AACX,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,GAAG,CAAC;AAAA,EACd;AACF;AAEA,SAAS,iBAA8B;AACrC,QAAM,OAAO,QAAQ,aAAa,UAAU,CAAC,QAAQ,QAAQ,QAAQ,EAAE,IAAI,CAAC,EAAE;AAC9E,aAAW,QAAQ,QAAQ,IAAI,QAAQ,IAAI,MAAM,SAAS,GAAG;AAC3D,QAAI,CAAC,IAAK;AACV,eAAW,OAAO,MAAM;AACtB,UAAID,YAAWH,MAAK,KAAK,YAAY,GAAG,EAAE,CAAC,GAAG;AAC5C,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ,YAAYA,MAAK,KAAK,YAAY,GAAG,EAAE,CAAC;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QACE;AAAA,EACJ;AACF;AAEO,SAAS,sBAAsBK,UAAwB;AAC5D,EAAAA,SACG,QAAQ,QAAQ,EAChB,YAAY,kEAAkE,EAC9E,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,QAAQ;AACrB,UAAM,cAAc,IAAI,eAAe,QAAQ,IAAI;AAEnD,UAAM,SAAwB;AAAA,MAC5B,UAAU;AAAA,MACV,MAAM,oBAAoB;AAAA,MAC1B,cAAc;AAAA,MACd,cAAc,WAAW;AAAA,MACzB,YAAY;AAAA,MACZ,qBAAqB;AAAA,MACrB,eAAe;AAAA,IACjB;AAEA,UAAM,SAAS,OAAO,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AACzD,UAAM,SAAS,OAAO,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AAEzD,QACE,SAASA,UAAS,KAAK;AAAA,MACrB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,SAAS,WAAW;AAAA,IACtB,CAAC,GACD;AACA,UAAI,SAAS,EAAG,SAAQ,WAAW;AACnC;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,MAAM,yBAAoB,eAAe;AAAA,CAAI,CAAC;AAEhF,eAAW,KAAK,QAAQ;AACtB,YAAM,OACJ,EAAE,WAAW,OACT,EAAE,MAAM,QAAQ,KAAK,IACrB,EAAE,WAAW,SACX,EAAE,OAAO,QAAQ,OAAO,IACxB,EAAE,IAAI,QAAQ,KAAK;AAC3B,cAAQ,IAAI,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;AAAA,IACzE;AAEA,YAAQ,IAAI;AACZ,QAAI,SAAS,GAAG;AACd,cAAQ,IAAI,KAAK,EAAE,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,SAAS,EAAE,IAAI,KAAK,MAAM,aAAa,IAAI,EAAE;AAAA,CAAI;AACvG,cAAQ,WAAW;AAAA,IACrB,WAAW,SAAS,GAAG;AACrB,cAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,uCAAkC,CAAC;AAAA,CAAI;AAAA,IACpG,OAAO;AACL,cAAQ,IAAI,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAAA,CAAI;AAAA,IACpD;AAAA,EACF,CAAC;AACL;;;ACpNA,SAASC,SAAQ,KAAuB;AACtC,SAAO;AAAA,IACL,MAAM,IAAI,KAAK;AAAA,IACf,SAAS,IAAI,QAAQ;AAAA,IACrB,aAAa,IAAI,YAAY;AAAA,IAC7B,SAAS,IAAI,QACV,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,IAAI,aAAa,EAAE,eAAe,GAAG,EAAE,EAChF,OAAO,CAAC,MAAM,EAAE,KAAK,WAAW,IAAI,CAAC;AAAA,IACxC,aAAa,IAAI,SACd,OAAO,CAAC,MAAM,EAAE,KAAK,MAAM,MAAM,EACjC,IAAI,CAAC,MAAMA,SAAQ,CAAY,CAAC;AAAA,EACrC;AACF;AAEA,IAAM,WAAW,CAAC,MAChB,EAAE,QAAQ,aAAa,EAAE,EAAE,QAAQ,WAAW,GAAG,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAE/E,SAAS,WAAW,MAAyB;AAC3C,QAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC,EAAE,KAAK,GAAG;AAClE,QAAM,QAAQ,KACX,IAAI,CAAC,MAAM;AACV,UAAM,QAAQ,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,GAAG;AAC7C,UAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,QAAQ,EAAE,KAAK,GAAG;AACjE,UAAM,OAAO,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG;AACtD,UAAM,UAAU,OACZ;AAAA,mEAAsE,IAAI,+BAC1E;AACJ,WAAO,OAAO,KAAK,IAAI,OAAO;AAAA,cAAiB,IAAI;AAAA,EACrD,CAAC,EACA,KAAK,IAAI;AAEZ,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAMuB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnC,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQP;AAEA,SAAS,UAAU,MAAyB;AAC1C,QAAM,QAAQ,KACX,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAE,WAAW,CAAC,GAAG,EACvD,KAAK,IAAI;AACZ,QAAM,QAAQ,KACX,IAAI,CAAC,MAAM;AACV,UAAM,QAAQ,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,GAAG;AAC7C,UAAM,QAAQ;AAAA,MACZ,GAAG,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,MAClC,GAAG,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,MAC9B;AAAA,IACF,EAAE,KAAK,GAAG;AACV,WAAO,OAAO,KAAK,gBAAgB,KAAK;AAAA,EAC1C,CAAC,EACA,KAAK,IAAI;AAEZ,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKP,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOL,KAAK;AAAA;AAAA;AAAA;AAAA;AAKP;AAEA,SAAS,WAAW,MAAyB;AAC3C,QAAM,QAAkB;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,KAAK,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;AAC3D,aAAW,KAAK,MAAM;AACpB,eAAW,QAAQ,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,GAAG;AACzC,YAAM;AAAA,QACJ,yDAAyD,SAAS,KAAK,GAAG,CAAC,QAAQ,IAAI,QAAQ,SAAS,EAAE,WAAW,CAAC;AAAA,MACxH;AAAA,IACF;AACA,eAAW,KAAK,EAAE,aAAa;AAC7B,YAAM;AAAA,QACJ,qDAAqD,EAAE,IAAI,QAAQ,EAAE,IAAI,QAAQ,SAAS,EAAE,WAAW,CAAC;AAAA,MAC1G;AAAA,IACF;AACA,eAAW,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,UAAU,aAAa,iBAAiB,CAAC,GAAG;AACjF,YAAM;AAAA,QACJ,qDAAqD,EAAE,IAAI,QAAQ,EAAE,KAAK,MAAM,CAAC,CAAC,QAAQ,SAAS,EAAE,WAAW,CAAC;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI,IAAI;AAC5B;AAEO,SAAS,0BAA0BC,UAAwB;AAChE,EAAAA,SACG,QAAQ,oBAAoB,EAC5B,YAAY,mDAAmD,EAC/D,OAAO,CAAC,UAAkB;AACzB,UAAM,OAAOA,SAAQ,SAClB,OAAO,CAAC,MAAM,EAAE,KAAK,MAAM,UAAU,EAAE,KAAK,MAAM,YAAY,EAC9D,IAAI,CAAC,MAAMD,SAAQ,CAAY,CAAC;AAEnC,QAAI,UAAU,OAAQ,SAAQ,OAAO,MAAM,WAAW,IAAI,CAAC;AAAA,aAClD,UAAU,MAAO,SAAQ,OAAO,MAAM,UAAU,IAAI,CAAC;AAAA,aACrD,UAAU,OAAQ,SAAQ,OAAO,MAAM,WAAW,IAAI,CAAC;AAAA,SAC3D;AACH,cAAQ,MAAM,EAAE,IAAI,kBAAkB,KAAK,sCAAiC,CAAC;AAC7E,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AACL;;;ArC9HA,IAAM,iBAID;AAAA,EACH;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,WAAW,SAAS,OAAO,gBAAgB,QAAQ;AAAA,EAChE;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,YAAY,UAAU,aAAa;AAAA,EAChD;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,QAAQ,QAAQ,QAAQ,UAAU,UAAU,YAAY;AAAA,EACrE;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,OAAO,SAAS,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,SAAS,gBAAgB,gBAAgB,QAAQ;AAAA,EAC9D;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,YAAY,UAAU,UAAU,WAAW,OAAO;AAAA,EAC/D;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,WAAW,aAAa,UAAU,UAAU,KAAK;AAAA,EAC9D;AACF;AAEA,IAAM,cAAN,cAA0B,KAAK;AAAA,EACpB,WAAW,KAAc,QAAsB;AAGtD,QAAI,IAAI,OAAQ,QAAO,MAAM,WAAW,KAAK,MAAM;AAEnD,UAAM,YAAY,OAAO,SAAS,KAAK,MAAM;AAC7C,UAAM,YAAY,OAAO,aAAa;AAEtC,UAAM,WAAqB,CAAC;AAC5B,aAAS;AAAA,MACP,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,QAAG,CAAC,IAAI,EAAE;AAAA,QACpE;AAAA,MACF,CAAC;AAAA,IACH;AACA,aAAS,KAAK,EAAE;AAChB,aAAS,KAAK,GAAG,EAAE,KAAK,QAAQ,CAAC,6BAA6B;AAE9D,UAAM,UAAU,OAAO,eAAe,GAAG;AACzC,QAAI,QAAQ,SAAS,GAAG;AACtB,eAAS,KAAK,EAAE;AAChB,eAAS,KAAK,EAAE,KAAK,UAAU,CAAC;AAChC,iBAAW,OAAO,SAAS;AACzB,cAAM,OAAO,OAAO,WAAW,GAAG;AAClC,cAAM,OAAO,OAAO,kBAAkB,GAAG;AACzC,iBAAS,KAAK,UAAU,MAAM,MAAM,WAAW,SAAS,CAAC;AAAA,MAC3D;AAAA,IACF;AAEA,UAAM,WAAW,OAAO,gBAAgB,GAAG;AAC3C,QAAI,SAAS,WAAW,EAAG,QAAO,SAAS,KAAK,IAAI,IAAI;AAExD,UAAM,SAAS,oBAAI,IAAqB;AACxC,eAAW,OAAO,SAAU,QAAO,IAAI,IAAI,KAAK,GAAG,GAAG;AAEtD,UAAM,OAAO,oBAAI,IAAY;AAE7B,eAAW,SAAS,gBAAgB;AAClC,YAAM,UAAU,MAAM,SACnB,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,CAAC,EACxB,OAAO,CAAC,MAAoB,QAAQ,CAAC,CAAC;AACzC,UAAI,QAAQ,WAAW,EAAG;AAC1B,iBAAW,KAAK,QAAS,MAAK,IAAI,EAAE,KAAK,CAAC;AAE1C,eAAS,KAAK,EAAE;AAChB,eAAS,KAAK,GAAG,MAAM,MAAM,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,EAAE;AACrD,iBAAW,OAAO,SAAS;AACzB,iBAAS;AAAA,UACP;AAAA,YACE,OAAO,eAAe,GAAG;AAAA,YACzB,OAAO,sBAAsB,GAAG;AAAA,YAChC;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,QAAQ,SAAS,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC;AAC5D,QAAI,MAAM,SAAS,GAAG;AACpB,eAAS,KAAK,EAAE;AAChB,eAAS,KAAK,EAAE,KAAK,QAAQ,CAAC;AAC9B,iBAAW,OAAO,OAAO;AACvB,iBAAS;AAAA,UACP;AAAA,YACE,OAAO,eAAe,GAAG;AAAA,YACzB,OAAO,sBAAsB,GAAG;AAAA,YAChC;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,aAAS,KAAK,EAAE;AAChB,aAAS;AAAA,MACP,EAAE;AAAA,QACA,OAAO,EAAE,KAAK,wBAAwB,CAAC;AAAA,MACzC;AAAA,IACF;AACA,WAAO,SAAS,KAAK,IAAI,IAAI;AAAA,EAC/B;AACF;AAEA,SAAS,UACP,MACA,aACA,WACA,WACQ;AACR,QAAM,SAAS;AACf,QAAM,MAAM;AACZ,QAAM,SAAS,KAAK,OAAO,SAAS;AACpC,MAAI,CAAC,YAAa,QAAO,GAAG,MAAM,GAAG,MAAM;AAC3C,QAAM,YAAY,KAAK,IAAI,YAAY,OAAO,SAAS,YAAY,IAAI,QAAQ,EAAE;AACjF,QAAM,OAAO,SAAS,aAAa,SAAS,EAAE;AAAA,IAC5C;AAAA,IACA;AAAA,EAAK,MAAM,GAAG,IAAI,OAAO,SAAS,CAAC,GAAG,GAAG;AAAA,EAC3C;AACA,SAAO,GAAG,MAAM,GAAG,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC;AAC/C;AAEA,SAAS,SAAS,MAAc,OAAuB;AACrD,MAAI,KAAK,UAAU,MAAO,QAAO;AACjC,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,aAAW,QAAQ,KAAK,MAAM,KAAK,GAAG;AACpC,QAAI,QAAQ,SAAS,KAAK,SAAS,IAAI,OAAO;AAC5C,YAAM,KAAK,OAAO;AAClB,gBAAU;AAAA,IACZ,OAAO;AACL,gBAAU,UAAU,GAAG,OAAO,IAAI,IAAI,KAAK;AAAA,IAC7C;AAAA,EACF;AACA,MAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,gBAAyB;AACvC,QAAME,WAAU,IAAI,QAAQ,EACzB,KAAK,OAAO,EACZ;AAAA,IACC,GAAG,EAAE,KAAK,QAAQ,CAAC,IAAI,EAAE,IAAI,4CAAuC,CAAC;AAAA,EACvE,EACC,QAAQ,eAAe,EACvB,OAAO,UAAU,qDAAqD,EACtE,cAAc;AAAA,IACb,iBAAiB;AAAA,IACjB,aAAa;AAAA,EACf,CAAC,EACA,mBAAmB,EAAE,IAAI,gCAAgC,CAAC;AAE7D,EAACA,SAAoB,aAAa,MAAM,IAAI,YAAY;AAExD,0BAAwBA,QAAO;AAC/B,0BAAwBA,QAAO;AAC/B,0BAAwBA,QAAO;AAC/B,6BAA2BA,QAAO;AAClC,0BAAwBA,QAAO;AAC/B,wBAAsBA,QAAO;AAC7B,uBAAqBA,QAAO;AAC5B,wBAAsBA,QAAO;AAC7B,2BAAyBA,QAAO;AAChC,yBAAuBA,QAAO;AAC9B,yBAAuBA,QAAO;AAC9B,sBAAoBA,QAAO;AAC3B,wBAAsBA,QAAO;AAC7B,4BAA0BA,QAAO;AAEjC,SAAOA;AACT;;;AsCxPA,IAAM,UAAU,cAAc;AAK9B,IAAI;AACF,QAAM,QAAQ,WAAW;AAC3B,SAAS,KAAK;AACZ,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,OAAO,EAAE,CAAC;AAClD,MAAI,QAAQ,IAAI,eAAe,eAAe,SAAS,IAAI,OAAO;AAChE,YAAQ,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC;AAAA,EAChC;AACA,UAAQ,WAAW;AACrB;","names":["program","c","c","program","registry","registry","readFileSync","program","readFileSync","randomBytes","program","program","registry","value","provHint","result","icon","readFileSync","readFileSync","readFileSync","writeFileSync","existsSync","existsSync","readFileSync","writeFileSync","program","writeFileSync","program","writeFileSync","existsSync","writeFileSync","readFileSync","join","join","existsSync","readFileSync","writeFileSync","program","hook","program","program","existsSync","readFileSync","join","existsSync","join","readFileSync","existsSync","readFileSync","writeFileSync","join","program","plan","randomInt","randomInt","disarmCanary","program","disarmCanary","url","enabled","transport","c","program","existsSync","readFileSync","writeFileSync","join","homedir","join","homedir","writeFileSync","existsSync","readFileSync","program","collect","program","program"]}
+{"version":3,"sources":["../src/cli/commands.ts","../src/utils/colors.ts","../src/core/import.ts","../src/utils/prompt.ts","../src/cli/helpers.ts","../src/cli/options.ts","../src/services/list-secrets-filter.ts","../src/cli/commands/secrets.ts","../src/core/noise.ts","../src/core/validate.ts","../src/core/context.ts","../src/cli/commands/project.ts","../src/core/promote.ts","../src/cli/commands/environments.ts","../src/core/teleport.ts","../src/cli/commands/quantum.ts","../src/cli/commands/validation.ts","../src/core/exec.ts","../src/core/scan.ts","../src/core/secrets-detect.ts","../src/core/linter.ts","../src/cli/commands/tooling.ts","../src/cli/commands/audit.ts","../src/hooks/precommit.ts","../src/cli/commands/hooks.ts","../src/core/agent.ts","../src/cli/commands/agent.ts","../src/cli/commands/security.ts","../src/core/run.ts","../src/core/refs.ts","../src/core/setup.ts","../src/core/push.ts","../src/cli/commands/bridges.ts","../src/core/canary.ts","../src/cli/commands/canary.ts","../src/core/wrap.ts","../src/core/wrap-redact.ts","../src/cli/commands/mcp.ts","../src/cli/commands/doctor.ts","../src/cli/commands/completion.ts","../src/index.ts"],"sourcesContent":["import { Command, Help } from \"commander\";\nimport { PACKAGE_VERSION } from \"../version.js\";\nimport { c, SYMBOLS } from \"../utils/colors.js\";\nimport { registerSecretsCommands } from \"./commands/secrets.js\";\nimport { registerProjectCommands } from \"./commands/project.js\";\nimport { registerEnvironmentCommands } from \"./commands/environments.js\";\nimport { registerQuantumCommands } from \"./commands/quantum.js\";\nimport { registerValidationCommands } from \"./commands/validation.js\";\nimport { registerToolingCommands } from \"./commands/tooling.js\";\nimport { registerAuditCommands } from \"./commands/audit.js\";\nimport { registerHookCommands } from \"./commands/hooks.js\";\nimport { registerAgentCommands } from \"./commands/agent.js\";\nimport { registerSecurityCommands } from \"./commands/security.js\";\nimport { registerBridgeCommands } from \"./commands/bridges.js\";\nimport { registerCanaryCommands } from \"./commands/canary.js\";\nimport { registerMcpCommands } from \"./commands/mcp.js\";\nimport { registerDoctorCommand } from \"./commands/doctor.js\";\nimport { registerCompletionCommand } from \"./commands/completion.js\";\n\n/**\n * Display groups for the CLI help screen.\n *\n * Maps top-level command names (including their first alias) to a category.\n * Any command not present here falls under \"Other\".\n */\nconst COMMAND_GROUPS: Array<{\n  name: string;\n  symbol: string;\n  commands: string[];\n}> = [\n  {\n    name: \"Secrets\",\n    symbol: SYMBOLS.key,\n    commands: [\n      \"set\",\n      \"get\",\n      \"has\",\n      \"delete\",\n      \"list\",\n      \"inspect\",\n      \"export\",\n      \"import\",\n    ],\n  },\n  {\n    name: \"Project\",\n    symbol: SYMBOLS.package,\n    commands: [\"context\", \"check\", \"env\", \"env:generate\", \"promote\", \"diff\", \"wizard\"],\n  },\n  {\n    name: \"Quantum\",\n    symbol: SYMBOLS.sparkle,\n    commands: [\n      \"generate\",\n      \"entangle\",\n      \"disentangle\",\n      \"tunnel\",\n      \"teleport\",\n    ],\n  },\n  {\n    name: \"Validation & Rotation\",\n    symbol: SYMBOLS.shield,\n    commands: [\"validate\", \"rotate\", \"rotate:due\", \"ci:validate\"],\n  },\n  {\n    name: \"Dev Tooling\",\n    symbol: SYMBOLS.zap,\n    commands: [\"exec\", \"scan\", \"lint\", \"status\", \"doctor\", \"completion\"],\n  },\n  {\n    name: \"Bridges\",\n    symbol: SYMBOLS.link,\n    commands: [\"run\", \"setup\", \"push\"],\n  },\n  {\n    name: \"Audit & Health\",\n    symbol: SYMBOLS.eye,\n    commands: [\"audit\", \"audit:verify\", \"audit:export\", \"health\"],\n  },\n  {\n    name: \"Hooks\",\n    symbol: SYMBOLS.link,\n    commands: [\n      \"hook:install\",\n      \"hook:uninstall\",\n      \"hook:run\",\n      \"hook\",\n    ],\n  },\n  {\n    name: \"Agent Memory\",\n    symbol: SYMBOLS.ghost,\n    commands: [\"remember\", \"recall\", \"forget\", \"analyze\", \"agent\"],\n  },\n  {\n    name: \"Security & Governance\",\n    symbol: SYMBOLS.lock,\n    commands: [\"approve\", \"approvals\", \"policy\", \"canary\", \"mcp\"],\n  },\n];\n\nclass GroupedHelp extends Help {\n  override formatHelp(cmd: Command, helper: Help): string {\n    // Keep the default formatting for subcommands — only the top-level\n    // `qring` command gets the grouped treatment.\n    if (cmd.parent) return super.formatHelp(cmd, helper);\n\n    const termWidth = helper.padWidth(cmd, helper);\n    const helpWidth = helper.helpWidth ?? 80;\n\n    const sections: string[] = [];\n    sections.push(\n      `${c.bold(\"qring\")} ${c.dim(`v${PACKAGE_VERSION}`)} ${c.dim(\"—\")} ${c.dim(\n        \"quantum keyring for AI coding tools\",\n      )}`,\n    );\n    sections.push(\"\");\n    sections.push(`${c.bold(\"Usage:\")}  qring [options] [command]`);\n\n    const options = helper.visibleOptions(cmd);\n    if (options.length > 0) {\n      sections.push(\"\");\n      sections.push(c.bold(\"Options:\"));\n      for (const opt of options) {\n        const term = helper.optionTerm(opt);\n        const desc = helper.optionDescription(opt);\n        sections.push(formatRow(term, desc, termWidth, helpWidth));\n      }\n    }\n\n    const commands = helper.visibleCommands(cmd);\n    if (commands.length === 0) return sections.join(\"\\n\") + \"\\n\";\n\n    const byName = new Map<string, Command>();\n    for (const sub of commands) byName.set(sub.name(), sub);\n\n    const used = new Set<string>();\n\n    for (const group of COMMAND_GROUPS) {\n      const members = group.commands\n        .map((n) => byName.get(n))\n        .filter((x): x is Command => Boolean(x));\n      if (members.length === 0) continue;\n      for (const m of members) used.add(m.name());\n\n      sections.push(\"\");\n      sections.push(`${group.symbol} ${c.bold(group.name)}`);\n      for (const sub of members) {\n        sections.push(\n          formatRow(\n            helper.subcommandTerm(sub),\n            helper.subcommandDescription(sub),\n            termWidth,\n            helpWidth,\n          ),\n        );\n      }\n    }\n\n    const other = commands.filter((sub) => !used.has(sub.name()));\n    if (other.length > 0) {\n      sections.push(\"\");\n      sections.push(c.bold(\"Other:\"));\n      for (const sub of other) {\n        sections.push(\n          formatRow(\n            helper.subcommandTerm(sub),\n            helper.subcommandDescription(sub),\n            termWidth,\n            helpWidth,\n          ),\n        );\n      }\n    }\n\n    sections.push(\"\");\n    sections.push(\n      c.dim(\n        `Run ${c.bold(\"qring <command> --help\")} to see detailed flags for any command.`,\n      ),\n    );\n    return sections.join(\"\\n\") + \"\\n\";\n  }\n}\n\nfunction formatRow(\n  term: string,\n  description: string,\n  termWidth: number,\n  helpWidth: number,\n): string {\n  const indent = \"  \";\n  const gap = \"  \";\n  const padded = term.padEnd(termWidth);\n  if (!description) return `${indent}${padded}`;\n  const available = Math.max(helpWidth - indent.length - termWidth - gap.length, 20);\n  const desc = wrapText(description, available).replace(\n    /\\n/g,\n    `\\n${indent}${\" \".repeat(termWidth)}${gap}`,\n  );\n  return `${indent}${padded}${gap}${c.dim(desc)}`;\n}\n\nfunction wrapText(text: string, width: number): string {\n  if (text.length <= width) return text;\n  const lines: string[] = [];\n  let current = \"\";\n  for (const word of text.split(/\\s+/)) {\n    if (current.length + word.length + 1 > width) {\n      lines.push(current);\n      current = word;\n    } else {\n      current = current ? `${current} ${word}` : word;\n    }\n  }\n  if (current) lines.push(current);\n  return lines.join(\"\\n\");\n}\n\nexport function createProgram(): Command {\n  const program = new Command()\n    .name(\"qring\")\n    .description(\n      `${c.bold(\"q-ring\")} ${c.dim(\"— quantum keyring for AI coding tools\")}`,\n    )\n    .version(PACKAGE_VERSION)\n    .option(\"--json\", \"Machine-readable JSON output for supported commands\")\n    .configureHelp({\n      sortSubcommands: false,\n      sortOptions: false,\n    })\n    .showHelpAfterError(c.dim(\"(run `qring --help` for usage)\"));\n\n  (program as Command).createHelp = () => new GroupedHelp();\n\n  registerSecretsCommands(program);\n  registerProjectCommands(program);\n  registerEnvironmentCommands(program);\n  registerQuantumCommands(program);\n  registerValidationCommands(program);\n  registerToolingCommands(program);\n  registerAuditCommands(program);\n  registerHookCommands(program);\n  registerAgentCommands(program);\n  registerSecurityCommands(program);\n  registerBridgeCommands(program);\n  registerCanaryCommands(program);\n  registerMcpCommands(program);\n  registerDoctorCommand(program);\n  registerCompletionCommand(program);\n\n  return program;\n}\n","/**\n * Minimal ANSI color helpers. No dependencies.\n */\n\nconst enabled = process.stdout.isTTY !== false && !process.env.NO_COLOR;\n\nfunction wrap(code: string, text: string): string {\n  return enabled ? `\\x1b[${code}m${text}\\x1b[0m` : text;\n}\n\nexport const c = {\n  bold: (t: string) => wrap(\"1\", t),\n  dim: (t: string) => wrap(\"2\", t),\n  italic: (t: string) => wrap(\"3\", t),\n  underline: (t: string) => wrap(\"4\", t),\n\n  red: (t: string) => wrap(\"31\", t),\n  green: (t: string) => wrap(\"32\", t),\n  yellow: (t: string) => wrap(\"33\", t),\n  blue: (t: string) => wrap(\"34\", t),\n  magenta: (t: string) => wrap(\"35\", t),\n  cyan: (t: string) => wrap(\"36\", t),\n  white: (t: string) => wrap(\"37\", t),\n  gray: (t: string) => wrap(\"90\", t),\n\n  bgRed: (t: string) => wrap(\"41\", t),\n  bgGreen: (t: string) => wrap(\"42\", t),\n  bgYellow: (t: string) => wrap(\"43\", t),\n  bgBlue: (t: string) => wrap(\"44\", t),\n  bgMagenta: (t: string) => wrap(\"45\", t),\n  bgCyan: (t: string) => wrap(\"46\", t),\n};\n\nexport function scopeColor(scope: string): string {\n  return scope === \"project\" ? c.cyan(scope) : c.blue(scope);\n}\n\nexport function decayIndicator(percent: number, expired: boolean): string {\n  if (expired) return c.bgRed(c.white(\" EXPIRED \"));\n  if (percent >= 90) return c.red(`[decay ${percent}%]`);\n  if (percent >= 75) return c.yellow(`[decay ${percent}%]`);\n  if (percent > 0) return c.green(`[decay ${percent}%]`);\n  return \"\";\n}\n\nexport function envBadge(env: string): string {\n  switch (env) {\n    case \"prod\":\n      return c.bgRed(c.white(` ${env} `));\n    case \"staging\":\n      return c.bgYellow(c.white(` ${env} `));\n    case \"dev\":\n      return c.bgGreen(c.white(` ${env} `));\n    case \"test\":\n      return c.bgBlue(c.white(` ${env} `));\n    default:\n      return c.bgMagenta(c.white(` ${env} `));\n  }\n}\n\nexport const SYMBOLS = {\n  check: enabled ? \"\\u2713\" : \"[ok]\",\n  cross: enabled ? \"\\u2717\" : \"[x]\",\n  arrow: enabled ? \"\\u2192\" : \"->\",\n  dot: enabled ? \"\\u2022\" : \"*\",\n  lock: enabled ? \"\\u{1f512}\" : \"[locked]\",\n  key: enabled ? \"\\u{1f511}\" : \"[key]\",\n  link: enabled ? \"\\u{1f517}\" : \"[link]\",\n  warning: enabled ? \"\\u26a0\\ufe0f\" : \"[!]\",\n  clock: enabled ? \"\\u23f0\" : \"[time]\",\n  shield: enabled ? \"\\u{1f6e1}\\ufe0f\" : \"[shield]\",\n  zap: enabled ? \"\\u26a1\" : \"[zap]\",\n  eye: enabled ? \"\\u{1f441}\\ufe0f\" : \"[eye]\",\n  ghost: enabled ? \"\\u{1f47b}\" : \"[ghost]\",\n  package: enabled ? \"\\u{1f4e6}\" : \"[pkg]\",\n  sparkle: enabled ? \"\\u2728\" : \"[*]\",\n} as const;\n","/**\n * Import module: parse .env files and bulk-store secrets into q-ring.\n */\n\nimport { readFileSync } from \"node:fs\";\nimport { setSecret, hasSecret, type SetSecretOptions } from \"./keyring.js\";\n\nexport interface ImportOptions {\n  scope?: \"global\" | \"project\";\n  projectPath?: string;\n  env?: string;\n  source?: \"cli\" | \"mcp\" | \"agent\" | \"api\";\n  skipExisting?: boolean;\n  dryRun?: boolean;\n}\n\nexport interface ImportResult {\n  imported: string[];\n  skipped: string[];\n  total: number;\n}\n\n/**\n * Parse .env content into key-value pairs.\n * Handles comments, blank lines, quoted values, and basic multiline.\n */\nexport function parseDotenv(content: string): Map<string, string> {\n  const result = new Map<string, string>();\n  const lines = content.split(/\\r?\\n/);\n\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i].trim();\n\n    if (!line || line.startsWith(\"#\")) continue;\n\n    const eqIdx = line.indexOf(\"=\");\n    if (eqIdx === -1) continue;\n\n    const key = line.slice(0, eqIdx).trim();\n    let value = line.slice(eqIdx + 1).trim();\n\n    if (\n      (value.startsWith('\"') && value.endsWith('\"')) ||\n      (value.startsWith(\"'\") && value.endsWith(\"'\"))\n    ) {\n      value = value.slice(1, -1);\n    }\n\n    const escapeMap: Record<string, string> = {\n      n: \"\\n\", r: \"\\r\", t: \"\\t\", \"\\\\\": \"\\\\\", '\"': '\"',\n    };\n    value = value.replace(/\\\\([nrt\"\\\\])/g, (_, ch) => escapeMap[ch] ?? ch);\n\n    // Strip inline comments only when the `#` is preceded by whitespace (the\n    // dotenv convention), so unquoted values like `foo#bar` are preserved.\n    if (!line.includes('\"') && !line.includes(\"'\")) {\n      const commentMatch = value.match(/\\s#/);\n      if (commentMatch && commentMatch.index !== undefined) {\n        value = value.slice(0, commentMatch.index).trim();\n      }\n    }\n\n    if (key) result.set(key, value);\n  }\n\n  return result;\n}\n\n/**\n * Import secrets from a .env file path or raw content string.\n */\nexport function importDotenv(\n  filePathOrContent: string,\n  options: ImportOptions = {},\n): ImportResult {\n  let content: string;\n\n  // The file-path convenience (read from disk if the arg is a path) is only\n  // safe for the trusted local CLI. For MCP/agent/api callers the argument is\n  // always treated as literal .env content — otherwise an agent could pass a\n  // path like ~/.aws/credentials and exfiltrate it through the keyring.\n  const source = options.source ?? \"cli\";\n  if (source === \"cli\") {\n    try {\n      content = readFileSync(filePathOrContent, \"utf8\");\n    } catch {\n      content = filePathOrContent;\n    }\n  } else {\n    content = filePathOrContent;\n  }\n\n  const pairs = parseDotenv(content);\n  const result: ImportResult = {\n    imported: [],\n    skipped: [],\n    total: pairs.size,\n  };\n\n  for (const [key, value] of pairs) {\n    if (options.skipExisting && hasSecret(key, {\n      scope: options.scope,\n      projectPath: options.projectPath,\n      source: options.source ?? \"cli\",\n    })) {\n      result.skipped.push(key);\n      continue;\n    }\n\n    if (options.dryRun) {\n      result.imported.push(key);\n      continue;\n    }\n\n    const setOpts: SetSecretOptions = {\n      scope: options.scope ?? \"global\",\n      projectPath: options.projectPath ?? process.cwd(),\n      source: options.source ?? \"cli\",\n    };\n\n    setSecret(key, value, setOpts);\n    result.imported.push(key);\n  }\n\n  return result;\n}\n","import { createInterface } from \"node:readline\";\n\n/**\n * Ask the user to confirm a destructive action. Resolves true only on an\n * explicit yes. Non-interactive callers must pass `assumeYes` (--yes/-y);\n * otherwise a non-TTY stdin is an error rather than a silent yes.\n */\nexport async function confirm(\n  message: string,\n  { assumeYes = false }: { assumeYes?: boolean } = {},\n): Promise<boolean> {\n  if (assumeYes) return true;\n  if (!process.stdin.isTTY) {\n    throw new Error(\n      \"Confirmation required but stdin is not a terminal. Pass --yes to proceed non-interactively.\",\n    );\n  }\n\n  const rl = createInterface({\n    input: process.stdin,\n    output: process.stderr,\n    terminal: true,\n  });\n\n  const answer = await new Promise<string>((resolve) => {\n    rl.question(`${message} [y/N] `, resolve);\n  });\n  rl.close();\n  return /^y(es)?$/i.test(answer.trim());\n}\n\nexport async function promptSecret(message: string): Promise<string> {\n  const stdin = process.stdin;\n\n  // Non-interactive stdin (e.g. `echo \"$VALUE\" | qring set KEY`): read to EOF.\n  // The interactive path below waits on per-keypress data events that never\n  // arrive from a pipe, which would hang forever.\n  if (!stdin.isTTY) {\n    let data = \"\";\n    stdin.setEncoding(\"utf8\");\n    for await (const chunk of stdin) {\n      data += chunk;\n    }\n    const value = data.replace(/\\r?\\n$/, \"\");\n    if (value.length === 0) {\n      throw new Error(\n        \"No value provided: stdin is not a terminal and was empty. Pipe the value in, or pass it as an argument.\",\n      );\n    }\n    return value;\n  }\n\n  const rl = createInterface({\n    input: process.stdin,\n    output: process.stderr,\n    terminal: true,\n  });\n\n  return new Promise((resolve) => {\n    process.stderr.write(message);\n\n    const wasRaw = stdin.isRaw;\n    if (stdin.isTTY && stdin.setRawMode) {\n      stdin.setRawMode(true);\n    }\n\n    let input = \"\";\n\n    const onData = (chunk: Buffer) => {\n      const char = chunk.toString(\"utf8\");\n      if (char === \"\\n\" || char === \"\\r\") {\n        stdin.removeListener(\"data\", onData);\n        if (stdin.isTTY && stdin.setRawMode) {\n          stdin.setRawMode(wasRaw ?? false);\n        }\n        process.stderr.write(\"\\n\");\n        rl.close();\n        resolve(input);\n      } else if (char === \"\\u0003\") {\n        process.exit(1);\n      } else if (char === \"\\u007F\" || char === \"\\b\") {\n        input = input.slice(0, -1);\n      } else {\n        input += char;\n      }\n    };\n\n    stdin.on(\"data\", onData);\n  });\n}\n","import type { Command } from \"commander\";\n\n/** True when `--json` was passed on the subcommand or on the root `qring` program. */\nexport function wantsJsonOutput(program: Command, cmd: unknown): boolean {\n  const c = cmd as { json?: boolean };\n  if (c.json) return true;\n  const g = program.opts() as { json?: boolean };\n  return !!g.json;\n}\n\n/**\n * Emit `{ ok: true, data }` as pretty-printed JSON when `--json` is in\n * effect. Returns true if JSON was emitted (caller should skip human output).\n */\nexport function emitJson(program: Command, cmd: unknown, data: unknown): boolean {\n  if (!wantsJsonOutput(program, cmd)) return false;\n  process.stdout.write(JSON.stringify({ ok: true, data }, null, 2) + \"\\n\");\n  return true;\n}\n\n/**\n * Break the CodeQL taint chain from getPassword → console.log.\n * Copies a string value so static analysis no longer considers it\n * \"sensitive data returned by getPassword\".\n */\nexport function safeStr(s: string | undefined | null): string {\n  return s == null ? \"\" : `${s}`;\n}\n\nexport function safeNum(n: number | undefined | null): number {\n  return n == null ? 0 : Number(n);\n}\n\nexport function safeArr<T>(arr: T[] | undefined | null): T[] {\n  return arr ? arr.map((x) => (typeof x === \"string\" ? safeStr(x) : x) as T) : [];\n}\n","import type { Scope } from \"../core/scope.js\";\nimport type { KeyringOptions } from \"../core/keyring.js\";\n\nexport function buildOpts(cmd: {\n  global?: boolean;\n  project?: boolean;\n  team?: string;\n  org?: string;\n  projectPath?: string;\n  env?: string;\n}): KeyringOptions {\n  let scope: Scope | undefined;\n  if (cmd.global) scope = \"global\";\n  else if (cmd.project) scope = \"project\";\n  else if (cmd.team) scope = \"team\";\n  else if (cmd.org) scope = \"org\";\n\n  const projectPath =\n    cmd.projectPath ?? (cmd.project ? process.cwd() : undefined);\n\n  if (scope === \"project\" && !projectPath) {\n    throw new Error(\"Project path is required for project scope\");\n  }\n\n  return {\n    scope,\n    projectPath: projectPath ?? process.cwd(),\n    teamId: cmd.team,\n    orgId: cmd.org,\n    env: cmd.env,\n    source: \"cli\",\n  };\n}\n","import type { SecretEntry } from \"../core/keyring.js\";\n\n/**\n * Turn a user glob (`*`, `?`) into a case-insensitive RegExp source.\n * Other regex metacharacters are escaped.\n */\nfunction globKeyPatternToRegexSource(pattern: string): string {\n  let out = \"\";\n  for (const c of pattern) {\n    if (c === \"*\") out += \".*\";\n    else if (c === \"?\") out += \".\";\n    else if (\"\\\\^$+{}()|[]\".includes(c)) out += \"\\\\\" + c;\n    else if (c === \".\") out += \"\\\\.\";\n    else out += c;\n  }\n  return out;\n}\n\n/**\n * Key name glob: `*` → `.*`, `?` → `.`, other regex metacharacters escaped (CLI + MCP aligned).\n */\nexport function filterSecretsByKeyGlob(\n  entries: SecretEntry[],\n  filter?: string,\n): SecretEntry[] {\n  if (!filter?.trim()) return entries;\n  const regex = new RegExp(\"^\" + globKeyPatternToRegexSource(filter) + \"$\", \"i\");\n  return entries.filter((e) => regex.test(e.key));\n}\n","import type { Command } from \"commander\";\nimport {\n  getSecret,\n  setSecret,\n  deleteSecret,\n  hasSecret,\n  listSecrets,\n  exportSecrets,\n  getEnvelope,\n  isValidRotateEveryDays,\n  MAX_ROTATE_EVERY_DAYS,\n  type SetSecretOptions,\n} from \"../../core/keyring.js\";\nimport type { Scope } from \"../../core/scope.js\";\nimport { checkDecay } from \"../../core/envelope.js\";\nimport { rotationStatus, describeRotation } from \"../../core/rotation.js\";\nimport { importDotenv } from \"../../core/import.js\";\nimport { promptSecret, confirm } from \"../../utils/prompt.js\";\nimport {\n  c,\n  scopeColor,\n  decayIndicator,\n  envBadge,\n  SYMBOLS,\n} from \"../../utils/colors.js\";\nimport { safeStr, safeNum, safeArr, wantsJsonOutput, emitJson } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\nimport { filterSecretsByKeyGlob } from \"../../services/list-secrets-filter.js\";\n\n/** Coloured state marker for rotation status lines. */\nexport function rotationBadge(state: string): string {\n  if (state === \"overdue\") return c.red(`${SYMBOLS.cross} overdue`);\n  if (state === \"due-soon\") return c.yellow(`${SYMBOLS.warning} due soon`);\n  if (state === \"ok\") return c.green(`${SYMBOLS.check} ok`);\n  return c.dim(\"unscheduled\");\n}\n\nexport function registerSecretsCommands(program: Command): void {\n  program\n    .command(\"set <key> [value]\")\n    .description(\"Store a secret (with optional quantum metadata)\")\n    .option(\"-g, --global\", \"Store in global scope\")\n    .option(\"-p, --project\", \"Store in project scope (uses cwd)\")\n    .option(\"--team <id>\", \"Store in team scope\")\n    .option(\"--org <id>\", \"Store in org scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\n      \"-e, --env <env>\",\n      \"Set value for a specific environment (superposition)\",\n    )\n    .option(\n      \"--ttl <seconds>\",\n      \"Time-to-live in seconds (quantum decay)\",\n      parseInt,\n    )\n    .option(\"--expires <iso>\", \"Expiry timestamp (ISO 8601)\")\n    .option(\"--description <desc>\", \"Human-readable description\")\n    .option(\"--tags <tags>\", \"Comma-separated tags\")\n    .option(\n      \"--rotation-format <format>\",\n      \"Format for auto-rotation (api-key, password, uuid, hex, base64, alphanumeric, token)\",\n    )\n    .option(\"--rotation-prefix <prefix>\", \"Prefix for auto-rotation (e.g. sk-)\")\n    .option(\n      \"--rotate-every <days>\",\n      `Remind to rotate every N days (1-${MAX_ROTATE_EVERY_DAYS}); see \\`qring rotate:due\\``,\n    )\n    .option(\n      \"--requires-approval\",\n      \"Require explicit user approval for MCP agents to read\",\n    )\n    .option(\n      \"--jit-provider <provider>\",\n      \"Use a Just-In-Time provider to dynamically generate this secret\",\n    )\n    .action(async (key: string, value: string | undefined, cmd) => {\n      const opts = buildOpts(cmd);\n\n      if (!value) {\n        value = await promptSecret(\n          `${SYMBOLS.key} Enter value for ${c.bold(key)}: `,\n        );\n        if (!value) {\n          console.error(c.red(`${SYMBOLS.cross} No value provided, aborting.`));\n          process.exit(1);\n        }\n      }\n\n      let rotateEveryDays: number | undefined;\n      if (cmd.rotateEvery !== undefined) {\n        const parsed = /^\\d+$/.test(String(cmd.rotateEvery).trim())\n          ? Number(cmd.rotateEvery)\n          : Number.NaN;\n        if (!isValidRotateEveryDays(parsed)) {\n          console.error(\n            c.red(\n              `${SYMBOLS.cross} --rotate-every must be a whole number of days between 1 and ${MAX_ROTATE_EVERY_DAYS} (got \"${cmd.rotateEvery}\")`,\n            ),\n          );\n          process.exit(1);\n        }\n        rotateEveryDays = parsed;\n      }\n\n      const setOpts: SetSecretOptions = {\n        ...opts,\n        ttlSeconds: cmd.ttl,\n        expiresAt: cmd.expires,\n        description: cmd.description,\n        tags: cmd.tags?.split(\",\").map((t: string) => t.trim()),\n        rotationFormat: cmd.rotationFormat,\n        rotationPrefix: cmd.rotationPrefix,\n        rotateEveryDays,\n        requiresApproval: cmd.requiresApproval,\n        jitProvider: cmd.jitProvider,\n      };\n\n      // A canary flag survives overwrites by design (an agent must not be\n      // able to launder a tripwire away) — warn the operator so a real\n      // credential doesn't quietly inherit the alarm.\n      const priorEnvelope = getEnvelope(key, opts);\n      if (priorEnvelope?.envelope.meta.canary) {\n        console.error(\n          c.yellow(\n            `${SYMBOLS.warning} \"${key}\" is a canary honeytoken — the alarm stays armed on the new value. Disarm first with: qring canary disarm ${key}`,\n          ),\n        );\n      }\n\n      if (cmd.env) {\n        const existing = priorEnvelope;\n        const states = existing?.envelope?.states ?? {};\n        states[cmd.env] = value;\n\n        if (existing?.envelope?.value && !states[\"default\"]) {\n          states[\"default\"] = existing.envelope.value;\n        }\n\n        setOpts.states = states;\n        setOpts.defaultEnv = existing?.envelope?.defaultEnv ?? cmd.env;\n        setSecret(key, \"\", setOpts);\n\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"saved\")} ${c.bold(key)} ${envBadge(cmd.env)} ${c.dim(`[${scopeColor(opts.scope ?? \"global\")}]`)}`,\n        );\n      } else {\n        setSecret(key, value, setOpts);\n        const extras: string[] = [];\n        if (cmd.ttl) extras.push(`${SYMBOLS.clock} ttl=${cmd.ttl}s`);\n        if (rotateEveryDays) extras.push(c.dim(`rotate every ${rotateEveryDays}d`));\n        if (cmd.description) extras.push(c.dim(cmd.description));\n\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"saved\")} ${c.bold(key)} ${c.dim(`[${scopeColor(opts.scope ?? \"global\")}]`)} ${extras.join(\" \")}`,\n        );\n      }\n    });\n\n  program\n    .command(\"get <key>\")\n    .description(\"Retrieve a secret (collapses superposition if needed)\")\n    .option(\"-g, --global\", \"Look only in global scope\")\n    .option(\"-p, --project\", \"Look only in project scope\")\n    .option(\"--team <id>\", \"Look only in team scope\")\n    .option(\"--org <id>\", \"Look only in org scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Force a specific environment\")\n    .option(\"--raw\", \"Print the secret value only (for scripts and piping)\")\n    .action((key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const value = getSecret(key, opts);\n\n      if (value === null) {\n        console.error(c.red(`${SYMBOLS.cross} Secret \"${key}\" not found`));\n        process.exit(1);\n      }\n\n      if (cmd.raw) {\n        process.stdout.write(value);\n        return;\n      }\n\n      const payload = wantsJsonOutput(program, cmd)\n        ? { ok: true as const, data: { key, value } }\n        : { key, value };\n      // Intentional user-visible output (this is `qring get`). Use\n      // process.stdout.write instead of console.log so static analysis\n      // (CodeQL `js/clear-text-logging`) does not flag it as logging.\n      process.stdout.write(JSON.stringify(payload) + \"\\n\");\n    });\n\n  program\n    .command(\"has <key>\")\n    .description(\n      \"Check whether a secret exists (exit 0 if present, 1 if not) — decay-aware\",\n    )\n    .option(\"-g, --global\", \"Look only in global scope\")\n    .option(\"-p, --project\", \"Look only in project scope\")\n    .option(\"--team <id>\", \"Look only in team scope\")\n    .option(\"--org <id>\", \"Look only in org scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-q, --quiet\", \"No output, exit code only (for scripts)\")\n    .action((key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const exists = hasSecret(key, opts);\n\n      if (!cmd.quiet) {\n        if (wantsJsonOutput(program, cmd)) {\n          console.log(JSON.stringify({ ok: true, data: { key, exists } }));\n        } else {\n          console.log(exists ? \"true\" : \"false\");\n        }\n      }\n      if (!exists) process.exitCode = 1;\n    });\n\n  program\n    .command(\"delete <key>\")\n    .alias(\"rm\")\n    .description(\"Remove a secret from the keyring\")\n    .option(\"-g, --global\", \"Delete from global scope only\")\n    .option(\"-p, --project\", \"Delete from project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-y, --yes\", \"Skip the confirmation prompt\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (key: string, cmd) => {\n      const opts = buildOpts(cmd);\n\n      if (!(await confirm(`Delete secret ${key}?`, { assumeYes: cmd.yes }))) {\n        console.error(c.dim(\"Aborted.\"));\n        process.exitCode = 1;\n        return;\n      }\n\n      const deleted = deleteSecret(key, opts);\n\n      if (!deleted) {\n        console.error(c.red(`${SYMBOLS.cross} Secret \"${key}\" not found`));\n        process.exit(1);\n      }\n\n      if (emitJson(program, cmd, { key, deleted: true })) return;\n      console.log(`${SYMBOLS.check} ${c.green(\"deleted\")} ${c.bold(key)}`);\n    });\n\n  program\n    .command(\"list\")\n    .alias(\"ls\")\n    .description(\"List all secrets with quantum status indicators\")\n    .option(\"-g, --global\", \"List global scope only\")\n    .option(\"-p, --project\", \"List project scope only\")\n    .option(\"--team <id>\", \"List team scope only\")\n    .option(\"--org <id>\", \"List org scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--show-decay\", \"Show decay/expiry status\")\n    .option(\"-t, --tag <tag>\", \"Filter by tag\")\n    .option(\"--expired\", \"Show only expired secrets\")\n    .option(\"--stale\", \"Show only stale secrets (75%+ decay)\")\n    .option(\"-f, --filter <pattern>\", \"Glob pattern on key name\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      let entries = listSecrets(opts);\n\n      if (cmd.tag) {\n        entries = entries.filter((e) =>\n          e.envelope?.meta.tags?.includes(cmd.tag),\n        );\n      }\n      if (cmd.expired) {\n        entries = entries.filter((e) => e.decay?.isExpired);\n      }\n      if (cmd.stale) {\n        entries = entries.filter(\n          (e) => e.decay?.isStale && !e.decay?.isExpired,\n        );\n      }\n      if (cmd.filter) {\n        entries = filterSecretsByKeyGlob(entries, cmd.filter);\n      }\n\n      if (\n        emitJson(\n          program,\n          cmd,\n          entries.map((e) => ({\n            key: safeStr(e.key),\n            scope: safeStr(e.scope),\n            type: e.envelope?.states ? \"superposition\" : \"collapsed\",\n            environments: e.envelope?.states\n              ? Object.keys(e.envelope.states).map(safeStr)\n              : undefined,\n            tags: safeArr(e.envelope?.meta.tags),\n            accessCount: safeNum(e.envelope?.meta.accessCount),\n            entangledCount: safeNum(e.envelope?.meta.entangled?.length),\n            decay: e.decay ?? null,\n          })),\n        )\n      ) {\n        return;\n      }\n\n      if (entries.length === 0) {\n        console.log(c.dim(\"No secrets found\"));\n        return;\n      }\n\n      console.log(\n        c.bold(`\\n  ${SYMBOLS.key} q-ring secrets (${entries.length})\\n`),\n      );\n\n      const maxKeyLen = Math.max(...entries.map((e) => e.key.length));\n\n      for (const entry of entries) {\n        const parts: string[] = [];\n\n        const key = safeStr(entry.key);\n        const scope = safeStr(entry.scope) as Scope;\n        const envs = entry.envelope?.states\n          ? Object.keys(entry.envelope.states).map(safeStr)\n          : null;\n        const entangledCount = safeNum(entry.envelope?.meta.entangled?.length);\n        const accessCount = safeNum(entry.envelope?.meta.accessCount);\n        const tags = safeArr(entry.envelope?.meta.tags);\n        const decayPct = safeNum(entry.decay?.lifetimePercent);\n        const expired = !!entry.decay?.isExpired;\n        const timeLeft = safeStr(entry.decay?.timeRemaining);\n\n        parts.push(c.dim(\"[\") + scopeColor(scope) + c.dim(\"]\"));\n        parts.push(c.bold(key.padEnd(maxKeyLen)));\n\n        if (envs) {\n          parts.push(c.magenta(`[${envs.join(\"|\")}]`));\n        }\n\n        if (entry.decay && (decayPct > 0 || expired)) {\n          parts.push(decayIndicator(decayPct, expired));\n          if (timeLeft && !expired) {\n            parts.push(c.dim(timeLeft));\n          }\n        }\n\n        if (entangledCount > 0) {\n          parts.push(c.cyan(`${SYMBOLS.link} ${entangledCount}`));\n        }\n\n        if (accessCount > 0) {\n          parts.push(c.dim(`${SYMBOLS.eye} ${accessCount}`));\n        }\n\n        if (tags.length > 0) {\n          parts.push(c.dim(tags.map((t) => `#${t}`).join(\" \")));\n        }\n\n        console.log(`  ${parts.join(\"  \")}`);\n      }\n\n      console.log();\n    });\n\n  program\n    .command(\"inspect <key>\")\n    .description(\"Show full quantum state of a secret\")\n    .option(\"-g, --global\", \"Inspect global scope only\")\n    .option(\"-p, --project\", \"Inspect project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const result = getEnvelope(key, opts);\n\n      if (!result) {\n        console.error(c.red(`${SYMBOLS.cross} Secret \"${key}\" not found`));\n        process.exit(1);\n      }\n\n      const { envelope, scope } = result;\n      const decay = checkDecay(envelope);\n      const rotation = rotationStatus(envelope.meta);\n\n      if (\n        emitJson(program, cmd, {\n          key: safeStr(key),\n          scope: safeStr(scope),\n          type: envelope.states ? \"superposition\" : \"collapsed\",\n          environments: envelope.states\n            ? Object.keys(envelope.states).map(safeStr)\n            : undefined,\n          defaultEnv: envelope.defaultEnv ? safeStr(envelope.defaultEnv) : undefined,\n          createdAt: safeStr(envelope.meta.createdAt),\n          updatedAt: safeStr(envelope.meta.updatedAt),\n          accessCount: safeNum(envelope.meta.accessCount),\n          lastAccessedAt: envelope.meta.lastAccessedAt\n            ? safeStr(envelope.meta.lastAccessedAt)\n            : undefined,\n          description: envelope.meta.description\n            ? safeStr(envelope.meta.description)\n            : undefined,\n          tags: safeArr(envelope.meta.tags),\n          entangled: (envelope.meta.entangled ?? []).map((l) => ({\n            service: safeStr(l.service),\n            key: safeStr(l.key),\n          })),\n          decay,\n          rotation,\n        })\n      ) {\n        return;\n      }\n\n      const safeScope = safeStr(scope) as Scope;\n      const createdAt = safeStr(envelope.meta.createdAt);\n      const updatedAt = safeStr(envelope.meta.updatedAt);\n      const accessCount = safeNum(envelope.meta.accessCount);\n      const lastAccess = safeStr(envelope.meta.lastAccessedAt);\n      const desc = safeStr(envelope.meta.description);\n      const tags = safeArr(envelope.meta.tags);\n      const entangled = (envelope.meta.entangled ?? []).map((l) => ({\n        service: safeStr(l.service),\n        key: safeStr(l.key),\n      }));\n      const stateEnvs = envelope.states\n        ? Object.keys(envelope.states).map(safeStr)\n        : null;\n      const defaultEnv = safeStr(envelope.defaultEnv);\n      const decayTime = safeStr(decay.timeRemaining);\n      const decayPct = safeNum(decay.lifetimePercent);\n      const expired = !!decay.isExpired;\n\n      console.log(`\\n  ${c.bold(SYMBOLS.key + \" \" + key)}`);\n      console.log(`  ${c.dim(\"scope:\")}     ${scopeColor(safeScope)}`);\n\n      if (stateEnvs) {\n        console.log(`  ${c.dim(\"type:\")}      ${c.magenta(\"superposition\")}`);\n        console.log(`  ${c.dim(\"states:\")}`);\n        for (const env of stateEnvs) {\n          const isDefault = env === defaultEnv;\n          console.log(\n            `    ${envBadge(env)} ${isDefault ? c.dim(\"(default)\") : \"\"}`,\n          );\n        }\n      } else {\n        console.log(`  ${c.dim(\"type:\")}      ${c.green(\"collapsed\")}`);\n      }\n\n      console.log(`  ${c.dim(\"created:\")}   ${createdAt}`);\n      console.log(`  ${c.dim(\"updated:\")}   ${updatedAt}`);\n      console.log(`  ${c.dim(\"accessed:\")}  ${accessCount} times`);\n\n      if (lastAccess) {\n        console.log(`  ${c.dim(\"last read:\")} ${lastAccess}`);\n      }\n\n      if (desc) {\n        console.log(`  ${c.dim(\"desc:\")}      ${desc}`);\n      }\n\n      if (tags.length > 0) {\n        console.log(\n          `  ${c.dim(\"tags:\")}      ${tags.map((t) => c.cyan(`#${t}`)).join(\" \")}`,\n        );\n      }\n\n      if (decayTime) {\n        console.log(\n          `  ${c.dim(\"decay:\")}     ${decayIndicator(decayPct, expired)} ${decayTime}`,\n        );\n      }\n\n      const rotAge = `${rotation.ageDays}d ago`;\n      const rotLine =\n        rotation.state === \"unscheduled\"\n          ? c.dim(`last rotated ${rotAge} · no reminder set`)\n          : `${rotationBadge(rotation.state)} ${describeRotation(rotation)} ${c.dim(`(last rotated ${rotAge}, every ${rotation.rotateEveryDays}d)`)}`;\n      console.log(`  ${c.dim(\"rotation:\")}  ${rotLine}`);\n\n      if (entangled.length > 0) {\n        console.log(`  ${c.dim(\"entangled:\")}`);\n        for (const link of entangled) {\n          console.log(`    ${SYMBOLS.link} ${link.service}/${link.key}`);\n        }\n      }\n\n      console.log();\n    });\n\n  program\n    .command(\"export\")\n    .description(\"Export secrets as .env or JSON (collapses superposition)\")\n    .option(\"-f, --format <format>\", \"Output format: env or json\", \"env\")\n    .option(\"-g, --global\", \"Export global scope only\")\n    .option(\"-p, --project\", \"Export project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Force environment for collapse\")\n    .option(\"-k, --keys <keys>\", \"Comma-separated key names to export\")\n    .option(\"-t, --tags <tags>\", \"Comma-separated tags to filter by\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      const output = exportSecrets({\n        ...opts,\n        format: cmd.format,\n        keys: cmd.keys?.split(\",\").map((k: string) => k.trim()),\n        tags: cmd.tags?.split(\",\").map((t: string) => t.trim()),\n      });\n      process.stdout.write(output + \"\\n\");\n    });\n\n  program\n    .command(\"import <file>\")\n    .description(\"Import secrets from a .env file\")\n    .option(\"-g, --global\", \"Import to global scope\")\n    .option(\"-p, --project\", \"Import to project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Environment context\")\n    .option(\"--skip-existing\", \"Skip keys that already exist\")\n    .option(\"--dry-run\", \"Preview what would be imported without saving\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((file: string, cmd) => {\n      const opts = buildOpts(cmd);\n\n      const result = importDotenv(file, {\n        scope: opts.scope as \"global\" | \"project\" | undefined,\n        projectPath: opts.projectPath,\n        source: \"cli\",\n        skipExisting: cmd.skipExisting,\n        dryRun: cmd.dryRun,\n      });\n\n      if (emitJson(program, cmd, { file, dryRun: !!cmd.dryRun, ...result })) {\n        return;\n      }\n\n      if (cmd.dryRun) {\n        console.log(\n          `\\n  ${SYMBOLS.package} ${c.bold(\"Dry run\")} — would import ${result.imported.length} of ${result.total} secrets:\\n`,\n        );\n        for (const key of result.imported) {\n          console.log(`  ${SYMBOLS.key} ${c.bold(key)}`);\n        }\n        if (result.skipped.length > 0) {\n          console.log(\n            `\\n  ${c.dim(`Skipped (existing): ${result.skipped.join(\", \")}`)}`,\n          );\n        }\n      } else {\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"imported\")} ${result.imported.length} secret(s) from ${c.bold(file)}`,\n        );\n        if (result.skipped.length > 0) {\n          console.log(\n            c.dim(\n              `  skipped ${result.skipped.length} existing: ${result.skipped.join(\", \")}`,\n            ),\n          );\n        }\n      }\n\n      console.log();\n    });\n}\n","/**\n * Quantum Noise: cryptographic secret generation.\n * Generates high-entropy values in common formats.\n */\n\nimport { randomBytes, randomInt } from \"node:crypto\";\n\nexport type NoiseFormat =\n  | \"hex\"\n  | \"base64\"\n  | \"alphanumeric\"\n  | \"uuid\"\n  | \"api-key\"\n  | \"token\"\n  | \"password\";\n\nexport interface NoiseOptions {\n  format?: NoiseFormat;\n  /** Length in bytes (for hex/base64) or characters (for alphanumeric/password) */\n  length?: number;\n  /** Prefix for api-key format (e.g., \"sk-\", \"pk-\") */\n  prefix?: string;\n}\n\nconst ALPHA_NUM =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\";\nconst PASSWORD_CHARS =\n  \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&*()-_=+[]{}|;:,.<>?\";\n\nfunction randomString(charset: string, length: number): string {\n  let result = \"\";\n  for (let i = 0; i < length; i++) {\n    result += charset[randomInt(charset.length)];\n  }\n  return result;\n}\n\nexport function generateSecret(opts: NoiseOptions = {}): string {\n  const format = opts.format ?? \"api-key\";\n\n  switch (format) {\n    case \"hex\": {\n      const len = opts.length ?? 32;\n      return randomBytes(len).toString(\"hex\");\n    }\n\n    case \"base64\": {\n      const len = opts.length ?? 32;\n      return randomBytes(len).toString(\"base64url\");\n    }\n\n    case \"alphanumeric\": {\n      const len = opts.length ?? 32;\n      return randomString(ALPHA_NUM, len);\n    }\n\n    case \"uuid\": {\n      const bytes = randomBytes(16);\n      bytes[6] = (bytes[6] & 0x0f) | 0x40; // version 4\n      bytes[8] = (bytes[8] & 0x3f) | 0x80; // variant 1\n      const hex = bytes.toString(\"hex\");\n      return [\n        hex.slice(0, 8),\n        hex.slice(8, 12),\n        hex.slice(12, 16),\n        hex.slice(16, 20),\n        hex.slice(20, 32),\n      ].join(\"-\");\n    }\n\n    case \"api-key\": {\n      const prefix = opts.prefix ?? \"qr_\";\n      const len = opts.length ?? 48;\n      return prefix + randomString(ALPHA_NUM, len);\n    }\n\n    case \"token\": {\n      const prefix = opts.prefix ?? \"\";\n      const len = opts.length ?? 64;\n      return prefix + randomBytes(len).toString(\"base64url\");\n    }\n\n    case \"password\": {\n      const len = opts.length ?? 24;\n\n      // Construct from one guaranteed char per class, fill the rest, then\n      // shuffle. This guarantees every class is present (when len ≥ #classes)\n      // without any fixup pass that could clobber an already-placed class.\n      const classCharsets = [\n        \"ABCDEFGHIJKLMNOPQRSTUVWXYZ\",\n        \"abcdefghijklmnopqrstuvwxyz\",\n        \"0123456789\",\n        \"!@#$%^&*()-_=+\",\n      ];\n      const guaranteed = classCharsets\n        .slice(0, Math.min(classCharsets.length, len))\n        .map((cs) => randomString(cs, 1));\n      const remaining = Math.max(0, len - guaranteed.length);\n      const chars = [\n        ...guaranteed,\n        ...(remaining > 0 ? randomString(PASSWORD_CHARS, remaining).split(\"\") : []),\n      ];\n\n      // Fisher-Yates shuffle backed by the CSPRNG.\n      for (let i = chars.length - 1; i > 0; i--) {\n        const j = randomInt(i + 1);\n        [chars[i], chars[j]] = [chars[j], chars[i]];\n      }\n\n      return chars.join(\"\");\n    }\n\n    default:\n      return randomBytes(32).toString(\"hex\");\n  }\n}\n\n/**\n * Estimate the entropy of a secret in bits.\n */\nexport function estimateEntropy(secret: string): number {\n  const charsets = [\n    { regex: /[a-z]/, size: 26 },\n    { regex: /[A-Z]/, size: 26 },\n    { regex: /[0-9]/, size: 10 },\n    { regex: /[^A-Za-z0-9]/, size: 32 },\n  ];\n\n  let poolSize = 0;\n  for (const { regex, size } of charsets) {\n    if (regex.test(secret)) poolSize += size;\n  }\n\n  return poolSize > 0 ? Math.floor(Math.log2(poolSize) * secret.length) : 0;\n}\n","/**\n * Secret Liveness Validation: test if a secret is actually valid\n * with its target service using a pluggable provider system.\n */\n\nimport { httpRequest } from \"../utils/http-request.js\";\nimport { generateSecret, type NoiseFormat } from \"./noise.js\";\nimport { checkSSRF } from \"./ssrf.js\";\n\nexport interface ValidationResult {\n  valid: boolean;\n  status: \"valid\" | \"invalid\" | \"error\" | \"unknown\";\n  message: string;\n  latencyMs: number;\n  provider: string;\n}\n\nexport interface Provider {\n  name: string;\n  description: string;\n  /** Prefixes that auto-detect to this provider */\n  prefixes?: string[];\n  validate(value: string): Promise<ValidationResult>;\n}\n\nfunction makeRequest(\n  url: string,\n  headers: Record<string, string>,\n  timeoutMs = 10000,\n): Promise<{ statusCode: number; body: string }> {\n  return httpRequest({ url, method: \"GET\", headers, timeoutMs });\n}\n\nexport class ProviderRegistry {\n  private providers = new Map<string, Provider>();\n\n  register(provider: Provider): void {\n    this.providers.set(provider.name, provider);\n  }\n\n  get(name: string): Provider | undefined {\n    return this.providers.get(name);\n  }\n\n  detectProvider(\n    value: string,\n    hints?: { provider?: string; prefix?: string },\n  ): Provider | undefined {\n    if (hints?.provider) {\n      return this.providers.get(hints.provider);\n    }\n\n    for (const provider of this.providers.values()) {\n      if (provider.prefixes) {\n        for (const pfx of provider.prefixes) {\n          if (value.startsWith(pfx)) return provider;\n        }\n      }\n    }\n\n    return undefined;\n  }\n\n  listProviders(): Provider[] {\n    return [...this.providers.values()];\n  }\n}\n\n// ─── Built-in Providers ───\n\n/**\n * Factory for the common liveness shape: one authenticated GET against a\n * cheap endpoint, with the standard 200/401/403/429 interpretation.\n */\nfunction livenessProvider(cfg: {\n  name: string;\n  description: string;\n  prefixes?: string[];\n  url: string;\n  headers: (value: string) => Record<string, string>;\n}): Provider {\n  return {\n    name: cfg.name,\n    description: cfg.description,\n    prefixes: cfg.prefixes,\n    async validate(value: string): Promise<ValidationResult> {\n      const start = Date.now();\n      try {\n        const { statusCode } = await makeRequest(cfg.url, {\n          \"User-Agent\": \"q-ring-validator/1.0\",\n          ...cfg.headers(value),\n        });\n        const latencyMs = Date.now() - start;\n\n        if (statusCode === 200)\n          return { valid: true, status: \"valid\", message: \"API key is valid\", latencyMs, provider: cfg.name };\n        if (statusCode === 401 || statusCode === 403)\n          return { valid: false, status: \"invalid\", message: `Invalid or revoked API key (${statusCode})`, latencyMs, provider: cfg.name };\n        if (statusCode === 429)\n          return { valid: true, status: \"error\", message: \"Rate limited — key may be valid\", latencyMs, provider: cfg.name };\n        return { valid: false, status: \"error\", message: `Unexpected status ${statusCode}`, latencyMs, provider: cfg.name };\n      } catch (err) {\n        return { valid: false, status: \"error\", message: `${err instanceof Error ? err.message : \"Network error\"}`, latencyMs: Date.now() - start, provider: cfg.name };\n      }\n    },\n  };\n}\n\n// AI-stack providers. Keys are only ever sent in headers (never the URL —\n// URLs land in server logs), against the cheapest read-only endpoint each\n// platform has.\n\nconst anthropicProvider = livenessProvider({\n  name: \"anthropic\",\n  description: \"Anthropic API key validation\",\n  prefixes: [\"sk-ant-\"],\n  url: \"https://api.anthropic.com/v1/models?limit=1\",\n  headers: (value) => ({ \"x-api-key\": value, \"anthropic-version\": \"2023-06-01\" }),\n});\n\nconst openrouterProvider = livenessProvider({\n  name: \"openrouter\",\n  description: \"OpenRouter API key validation\",\n  prefixes: [\"sk-or-\"],\n  url: \"https://openrouter.ai/api/v1/key\",\n  headers: (value) => ({ Authorization: `Bearer ${value}` }),\n});\n\nconst googleAiProvider = livenessProvider({\n  name: \"google-ai\",\n  description: \"Google AI (Gemini) API key validation\",\n  prefixes: [\"AIza\"],\n  url: \"https://generativelanguage.googleapis.com/v1beta/models?pageSize=1\",\n  headers: (value) => ({ \"x-goog-api-key\": value }),\n});\n\nconst groqProvider = livenessProvider({\n  name: \"groq\",\n  description: \"Groq API key validation\",\n  prefixes: [\"gsk_\"],\n  url: \"https://api.groq.com/openai/v1/models\",\n  headers: (value) => ({ Authorization: `Bearer ${value}` }),\n});\n\nconst huggingfaceProvider = livenessProvider({\n  name: \"huggingface\",\n  description: \"Hugging Face token validation\",\n  prefixes: [\"hf_\"],\n  url: \"https://huggingface.co/api/whoami-v2\",\n  headers: (value) => ({ Authorization: `Bearer ${value}` }),\n});\n\n// No prefix: ElevenLabs \"sk_...\" would shadow Stripe's sk_live_/sk_test_,\n// so it is explicit-only (set `provider: \"elevenlabs\"` on the secret/manifest).\nconst elevenlabsProvider = livenessProvider({\n  name: \"elevenlabs\",\n  description: \"ElevenLabs API key validation (explicit-only — set provider on the secret)\",\n  url: \"https://api.elevenlabs.io/v1/user\",\n  headers: (value) => ({ \"xi-api-key\": value }),\n});\n\n// No prefix: Vercel tokens have no stable public prefix — explicit-only.\nconst vercelProvider = livenessProvider({\n  name: \"vercel\",\n  description: \"Vercel token validation (explicit-only — set provider on the secret)\",\n  url: \"https://api.vercel.com/v2/user\",\n  headers: (value) => ({ Authorization: `Bearer ${value}` }),\n});\n\nconst openaiProvider: Provider = {\n  name: \"openai\",\n  description: \"OpenAI API key validation\",\n  prefixes: [\"sk-\"],\n  async validate(value: string): Promise<ValidationResult> {\n    const start = Date.now();\n    try {\n      const { statusCode } = await makeRequest(\n        \"https://api.openai.com/v1/models?limit=1\",\n        {\n          Authorization: `Bearer ${value}`,\n          \"User-Agent\": \"q-ring-validator/1.0\",\n        },\n      );\n      const latencyMs = Date.now() - start;\n\n      if (statusCode === 200)\n        return { valid: true, status: \"valid\", message: \"API key is valid\", latencyMs, provider: \"openai\" };\n      if (statusCode === 401)\n        return { valid: false, status: \"invalid\", message: \"Invalid or revoked API key\", latencyMs, provider: \"openai\" };\n      if (statusCode === 429)\n        return { valid: true, status: \"error\", message: \"Rate limited — key may be valid\", latencyMs, provider: \"openai\" };\n      return { valid: false, status: \"error\", message: `Unexpected status ${statusCode}`, latencyMs, provider: \"openai\" };\n    } catch (err) {\n      return { valid: false, status: \"error\", message: `${err instanceof Error ? err.message : \"Network error\"}`, latencyMs: Date.now() - start, provider: \"openai\" };\n    }\n  },\n};\n\nconst stripeProvider: Provider = {\n  name: \"stripe\",\n  description: \"Stripe API key validation\",\n  prefixes: [\"sk_live_\", \"sk_test_\", \"rk_live_\", \"rk_test_\", \"pk_live_\", \"pk_test_\"],\n  async validate(value: string): Promise<ValidationResult> {\n    const start = Date.now();\n    try {\n      const { statusCode } = await makeRequest(\n        \"https://api.stripe.com/v1/balance\",\n        {\n          Authorization: `Bearer ${value}`,\n          \"User-Agent\": \"q-ring-validator/1.0\",\n        },\n      );\n      const latencyMs = Date.now() - start;\n\n      if (statusCode === 200)\n        return { valid: true, status: \"valid\", message: \"API key is valid\", latencyMs, provider: \"stripe\" };\n      if (statusCode === 401)\n        return { valid: false, status: \"invalid\", message: \"Invalid or revoked API key\", latencyMs, provider: \"stripe\" };\n      if (statusCode === 429)\n        return { valid: true, status: \"error\", message: \"Rate limited — key may be valid\", latencyMs, provider: \"stripe\" };\n      return { valid: false, status: \"error\", message: `Unexpected status ${statusCode}`, latencyMs, provider: \"stripe\" };\n    } catch (err) {\n      return { valid: false, status: \"error\", message: `${err instanceof Error ? err.message : \"Network error\"}`, latencyMs: Date.now() - start, provider: \"stripe\" };\n    }\n  },\n};\n\nconst githubProvider: Provider = {\n  name: \"github\",\n  description: \"GitHub token validation\",\n  prefixes: [\"ghp_\", \"gho_\", \"ghu_\", \"ghs_\", \"ghr_\", \"github_pat_\"],\n  async validate(value: string): Promise<ValidationResult> {\n    const start = Date.now();\n    try {\n      const { statusCode } = await makeRequest(\n        \"https://api.github.com/user\",\n        {\n          Authorization: `token ${value}`,\n          \"User-Agent\": \"q-ring-validator/1.0\",\n          Accept: \"application/vnd.github+json\",\n        },\n      );\n      const latencyMs = Date.now() - start;\n\n      if (statusCode === 200)\n        return { valid: true, status: \"valid\", message: \"Token is valid\", latencyMs, provider: \"github\" };\n      if (statusCode === 401)\n        return { valid: false, status: \"invalid\", message: \"Invalid or expired token\", latencyMs, provider: \"github\" };\n      if (statusCode === 403)\n        return { valid: false, status: \"invalid\", message: \"Token lacks required permissions\", latencyMs, provider: \"github\" };\n      if (statusCode === 429)\n        return { valid: true, status: \"error\", message: \"Rate limited — token may be valid\", latencyMs, provider: \"github\" };\n      return { valid: false, status: \"error\", message: `Unexpected status ${statusCode}`, latencyMs, provider: \"github\" };\n    } catch (err) {\n      return { valid: false, status: \"error\", message: `${err instanceof Error ? err.message : \"Network error\"}`, latencyMs: Date.now() - start, provider: \"github\" };\n    }\n  },\n};\n\nconst awsProvider: Provider = {\n  name: \"aws\",\n  description: \"AWS access key validation (checks key format only — full STS validation requires secret key + region)\",\n  prefixes: [\"AKIA\", \"ASIA\"],\n  async validate(value: string): Promise<ValidationResult> {\n    const start = Date.now();\n    const latencyMs = Date.now() - start;\n\n    if (/^(AKIA|ASIA)[A-Z0-9]{16}$/.test(value)) {\n      return { valid: true, status: \"unknown\", message: \"Valid AWS access key format (STS validation requires secret key)\", latencyMs, provider: \"aws\" };\n    }\n    return { valid: false, status: \"invalid\", message: \"Invalid AWS access key format\", latencyMs, provider: \"aws\" };\n  },\n};\n\nconst httpProvider: Provider = {\n  name: \"http\",\n  description: \"Generic HTTP endpoint validation\",\n  async validate(value: string, url?: string): Promise<ValidationResult> {\n    const start = Date.now();\n\n    if (!url) {\n      return { valid: false, status: \"unknown\", message: \"No validation URL configured\", latencyMs: 0, provider: \"http\" };\n    }\n\n    const ssrfBlock = await checkSSRF(url);\n    if (ssrfBlock) {\n      return { valid: false, status: \"error\", message: `SSRF blocked: ${ssrfBlock}`, latencyMs: Date.now() - start, provider: \"http\" };\n    }\n\n    try {\n      const { statusCode } = await makeRequest(url, {\n        Authorization: `Bearer ${value}`,\n        \"User-Agent\": \"q-ring-validator/1.0\",\n      });\n      const latencyMs = Date.now() - start;\n\n      if (statusCode >= 200 && statusCode < 300)\n        return { valid: true, status: \"valid\", message: `Endpoint returned ${statusCode}`, latencyMs, provider: \"http\" };\n      if (statusCode === 401 || statusCode === 403)\n        return { valid: false, status: \"invalid\", message: `Authentication failed (${statusCode})`, latencyMs, provider: \"http\" };\n      return { valid: false, status: \"error\", message: `Unexpected status ${statusCode}`, latencyMs, provider: \"http\" };\n    } catch (err) {\n      return { valid: false, status: \"error\", message: `${err instanceof Error ? err.message : \"Network error\"}`, latencyMs: Date.now() - start, provider: \"http\" };\n    }\n  },\n};\n\nexport const registry = new ProviderRegistry();\n// Prefix detection iterates in registration order: anthropic (sk-ant-) and\n// openrouter (sk-or-) MUST come before openai, whose bare \"sk-\" would\n// otherwise shadow them.\nregistry.register(anthropicProvider);\nregistry.register(openrouterProvider);\nregistry.register(openaiProvider);\nregistry.register(googleAiProvider);\nregistry.register(groqProvider);\nregistry.register(huggingfaceProvider);\nregistry.register(elevenlabsProvider);\nregistry.register(vercelProvider);\nregistry.register(stripeProvider);\nregistry.register(githubProvider);\nregistry.register(awsProvider);\nregistry.register(httpProvider);\n\n/**\n * Validate a secret value against its detected or specified provider.\n */\nexport async function validateSecret(\n  value: string,\n  opts?: { provider?: string; validationUrl?: string },\n): Promise<ValidationResult> {\n  const provider = opts?.provider\n    ? registry.get(opts.provider)\n    : registry.detectProvider(value);\n\n  if (!provider) {\n    return {\n      valid: false,\n      status: \"unknown\",\n      message: \"No provider detected — set a provider in the manifest or secret metadata\",\n      latencyMs: 0,\n      provider: \"none\",\n    };\n  }\n\n  if (provider.name === \"http\" && opts?.validationUrl) {\n    return (provider as any).validate(value, opts.validationUrl);\n  }\n\n  return provider.validate(value);\n}\n\n// ─── Rotation Support ───\n\nexport interface RotationResult {\n  rotated: boolean;\n  provider: string;\n  message: string;\n  newValue?: string;\n}\n\nexport interface RotatableProvider extends Provider {\n  rotate?(currentValue: string): Promise<RotationResult>;\n  supportsRotation: boolean;\n}\n\n/**\n * Attempt provider-native rotation of a secret.\n * Falls back to local generation if the provider does not support native rotation.\n */\nexport async function rotateWithProvider(\n  value: string,\n  providerName?: string,\n): Promise<RotationResult> {\n  const provider = providerName\n    ? registry.get(providerName)\n    : registry.detectProvider(value);\n\n  if (!provider) {\n    return { rotated: false, provider: \"none\", message: \"No provider detected for rotation\" };\n  }\n\n  const rotatable = provider as RotatableProvider;\n  if (rotatable.supportsRotation && rotatable.rotate) {\n    return rotatable.rotate(value);\n  }\n\n  // Fall back to local generation\n  const format: NoiseFormat = \"api-key\";\n  const newValue = generateSecret({ format, length: 48 });\n  return {\n    rotated: true,\n    provider: provider.name,\n    message: `Provider \"${provider.name}\" does not support native rotation — generated new value locally`,\n    newValue,\n  };\n}\n\n// ─── CI Scan ───\n\nexport interface CiScanResult {\n  key: string;\n  validation: ValidationResult;\n  requiresRotation: boolean;\n}\n\n/**\n * CI-oriented batch validation: validates all secrets and returns\n * a structured report suitable for CI pipeline gating.\n */\nexport async function ciValidateBatch(\n  secrets: { key: string; value: string; provider?: string; validationUrl?: string }[],\n): Promise<{ results: CiScanResult[]; allValid: boolean; failCount: number }> {\n  const results: CiScanResult[] = [];\n\n  for (const s of secrets) {\n    const validation = await validateSecret(s.value, {\n      provider: s.provider,\n      validationUrl: s.validationUrl,\n    });\n\n    results.push({\n      key: s.key,\n      validation,\n      requiresRotation: validation.status === \"invalid\",\n    });\n  }\n\n  const failCount = results.filter((r) => !r.validation.valid).length;\n\n  return { results, allValid: failCount === 0, failCount };\n}\n","/**\n * Self-Documenting Project Context for AI Agents\n *\n * Provides a safe, redacted view of the project's secrets, configuration,\n * and state without ever exposing actual secret values.\n */\n\nimport { listSecrets } from \"./keyring.js\";\nimport { collapseEnvironment, readProjectConfig } from \"./collapse.js\";\nimport { queryAudit } from \"./observer.js\";\nimport { listHooks } from \"./hooks.js\";\nimport { registry as providerRegistry } from \"./validate.js\";\nimport { registry as jitRegistry } from \"./provision.js\";\nimport type { KeyringOptions } from \"./keyring.js\";\n\nexport interface SecretSummary {\n  key: string;\n  scope: string;\n  tags?: string[];\n  description?: string;\n  provider?: string;\n  requiresApproval?: boolean;\n  jitProvider?: string;\n  hasStates: boolean;\n  isExpired: boolean;\n  isStale: boolean;\n  timeRemaining: string | null;\n  accessCount: number;\n  lastAccessed: string | null;\n  rotationFormat?: string;\n}\n\nexport interface ProjectContext {\n  projectPath: string;\n  environment: {\n    env: string;\n    source: string;\n  } | null;\n  secrets: SecretSummary[];\n  totalSecrets: number;\n  expiredCount: number;\n  staleCount: number;\n  protectedCount: number;\n  manifest: {\n    declared: number;\n    missing: string[];\n  } | null;\n  validationProviders: string[];\n  jitProviders: string[];\n  hooksCount: number;\n  recentActions: Array<{\n    action: string;\n    key?: string;\n    source: string;\n    timestamp: string;\n  }>;\n}\n\nexport function getProjectContext(opts: KeyringOptions = {}): ProjectContext {\n  const projectPath = opts.projectPath ?? process.cwd();\n  const envResult = collapseEnvironment({ projectPath });\n\n  const secretsList = listSecrets({\n    ...opts,\n    projectPath,\n    silent: true,\n  });\n\n  let expiredCount = 0;\n  let staleCount = 0;\n  let protectedCount = 0;\n\n  const secrets: SecretSummary[] = secretsList.map((entry) => {\n    const meta = entry.envelope?.meta;\n    const decay = entry.decay;\n\n    if (decay?.isExpired) expiredCount++;\n    if (decay?.isStale) staleCount++;\n    if (meta?.requiresApproval) protectedCount++;\n\n    return {\n      key: entry.key,\n      scope: entry.scope,\n      tags: meta?.tags,\n      description: meta?.description,\n      provider: meta?.provider,\n      requiresApproval: meta?.requiresApproval,\n      jitProvider: meta?.jitProvider,\n      hasStates: !!(entry.envelope?.states && Object.keys(entry.envelope.states).length > 0),\n      isExpired: decay?.isExpired ?? false,\n      isStale: decay?.isStale ?? false,\n      timeRemaining: decay?.timeRemaining ?? null,\n      accessCount: meta?.accessCount ?? 0,\n      lastAccessed: meta?.lastAccessedAt ?? null,\n      rotationFormat: meta?.rotationFormat,\n    };\n  });\n\n  // Manifest analysis\n  let manifest: ProjectContext[\"manifest\"] = null;\n  const config = readProjectConfig(projectPath);\n  if (config?.secrets) {\n    const declaredKeys = Object.keys(config.secrets);\n    const existingKeys = new Set(secrets.map((s) => s.key));\n    const missing = declaredKeys.filter((k) => !existingKeys.has(k));\n    manifest = { declared: declaredKeys.length, missing };\n  }\n\n  // Recent audit activity (last 20 events, redacted)\n  const recentEvents = queryAudit({ limit: 20 });\n  const recentActions = recentEvents.map((e) => ({\n    action: e.action,\n    key: e.key,\n    source: e.source,\n    timestamp: e.timestamp,\n  }));\n\n  return {\n    projectPath,\n    environment: envResult\n      ? { env: envResult.env, source: envResult.source }\n      : null,\n    secrets,\n    totalSecrets: secrets.length,\n    expiredCount,\n    staleCount,\n    protectedCount,\n    manifest,\n    validationProviders: providerRegistry.listProviders().map((p) => p.name),\n    jitProviders: jitRegistry.listProviders().map((p) => p.name),\n    hooksCount: listHooks().length,\n    recentActions,\n  };\n}\n","import type { Command } from \"commander\";\nimport {\n  getSecret,\n  setSecret,\n  getEnvelope,\n  hasSecret,\n} from \"../../core/keyring.js\";\nimport { collapseEnvironment, readProjectConfig } from \"../../core/collapse.js\";\nimport { checkDecay } from \"../../core/envelope.js\";\nimport { generateSecret } from \"../../core/noise.js\";\nimport { getProjectContext } from \"../../core/context.js\";\nimport { registerHook, type HookType, type HookAction } from \"../../core/hooks.js\";\nimport { writeFileSync, readFileSync, existsSync } from \"node:fs\";\nimport { c, scopeColor, envBadge, SYMBOLS } from \"../../utils/colors.js\";\nimport { wantsJsonOutput, emitJson } from \"../helpers.js\";\nimport { confirm } from \"../../utils/prompt.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerProjectCommands(program: Command): void {\n  program\n    .command(\"context\")\n    .alias(\"describe\")\n    .description(\n      \"Show safe, redacted project context for AI agents (no secret values exposed)\",\n    )\n    .option(\"-g, --global\", \"Global scope only\")\n    .option(\"-p, --project\", \"Project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON (for MCP / programmatic use)\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      const context = getProjectContext(opts);\n\n      if (wantsJsonOutput(program, cmd)) {\n        console.log(JSON.stringify(context, null, 2));\n        return;\n      }\n\n      console.log(`\\n${SYMBOLS.zap} ${c.bold(\"Project Context for AI Assistant\")}`);\n      console.log(`  Project: ${c.cyan(context.projectPath)}`);\n\n      if (context.environment) {\n        console.log(\n          `  Environment: ${envBadge(context.environment.env)} ${c.dim(`(${context.environment.source})`)}`,\n        );\n      }\n\n      console.log(\n        `\\n${c.bold(\"  Secrets:\")} ${context.totalSecrets} total  ${c.dim(`(${context.expiredCount} expired, ${context.staleCount} stale, ${context.protectedCount} protected)`)}`,\n      );\n      for (const s of context.secrets) {\n        const tags = s.tags?.length ? c.dim(` [${s.tags.join(\",\")}]`) : \"\";\n        const flags: string[] = [];\n        if (s.requiresApproval) flags.push(c.yellow(\"locked\"));\n        if (s.jitProvider) flags.push(c.magenta(\"jit\"));\n        if (s.hasStates) flags.push(c.blue(\"superposition\"));\n        if (s.isExpired) flags.push(c.red(\"expired\"));\n        else if (s.isStale) flags.push(c.yellow(\"stale\"));\n        const flagStr = flags.length ? ` ${flags.join(\" \")}` : \"\";\n        console.log(\n          `    ${c.bold(s.key)} ${scopeColor(s.scope)}${tags}${flagStr}`,\n        );\n      }\n\n      if (context.manifest) {\n        console.log(\n          `\\n${c.bold(\"  Manifest:\")} ${context.manifest.declared} declared`,\n        );\n        if (context.manifest.missing.length > 0) {\n          console.log(\n            `    ${c.red(\"Missing:\")} ${context.manifest.missing.join(\", \")}`,\n          );\n        } else {\n          console.log(\n            `    ${c.green(SYMBOLS.check)} All manifest secrets present`,\n          );\n        }\n      }\n\n      console.log(\n        `\\n${c.bold(\"  Providers:\")} ${context.validationProviders.join(\", \") || \"none\"}`,\n      );\n      console.log(\n        `${c.bold(\"  JIT Providers:\")} ${context.jitProviders.join(\", \") || \"none\"}`,\n      );\n      console.log(`${c.bold(\"  Hooks:\")} ${context.hooksCount} registered`);\n\n      if (context.recentActions.length > 0) {\n        console.log(\n          `\\n${c.bold(\"  Recent Activity:\")} (last ${context.recentActions.length})`,\n        );\n        for (const a of context.recentActions.slice(0, 8)) {\n          const ts = new Date(a.timestamp).toLocaleTimeString();\n          console.log(\n            `    ${c.dim(ts)} ${a.action}${a.key ? ` ${c.bold(a.key)}` : \"\"} ${c.dim(`(${a.source})`)}`,\n          );\n        }\n      }\n\n      console.log();\n    });\n\n  program\n    .command(\"check\")\n    .description(\"Validate project secrets against .q-ring.json manifest\")\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const projectPath = cmd.projectPath ?? process.cwd();\n      const config = readProjectConfig(projectPath);\n\n      if (!config?.secrets || Object.keys(config.secrets).length === 0) {\n        console.error(\n          c.red(`${SYMBOLS.cross} No secrets manifest found in .q-ring.json`),\n        );\n        console.log(\n          c.dim(\n            '  Add a \"secrets\" field to your .q-ring.json to define required secrets.',\n          ),\n        );\n        process.exit(1);\n      }\n\n      type KeyStatus = \"ok\" | \"missing\" | \"optional-not-set\" | \"expired\" | \"stale\";\n      const statuses: Array<{\n        key: string;\n        status: KeyStatus;\n        description?: string;\n        lifetimePercent?: number;\n      }> = [];\n\n      for (const [key, manifest] of Object.entries(config.secrets)) {\n        const result = getEnvelope(key, { projectPath, source: \"cli\" });\n\n        if (!result) {\n          statuses.push({\n            key,\n            status: manifest.required !== false ? \"missing\" : \"optional-not-set\",\n            description: manifest.description,\n          });\n          continue;\n        }\n\n        const decay = checkDecay(result.envelope);\n        statuses.push({\n          key,\n          status: decay.isExpired ? \"expired\" : decay.isStale ? \"stale\" : \"ok\",\n          description: manifest.description,\n          ...(decay.isStale && !decay.isExpired\n            ? { lifetimePercent: decay.lifetimePercent }\n            : {}),\n        });\n      }\n\n      const present = statuses.filter((s) => s.status === \"ok\").length;\n      const missing = statuses.filter((s) => s.status === \"missing\").length;\n      const expiredCount = statuses.filter((s) => s.status === \"expired\").length;\n      const staleCount = statuses.filter((s) => s.status === \"stale\").length;\n      const total = Object.keys(config.secrets).length;\n\n      if (\n        emitJson(program, cmd, {\n          projectPath,\n          secrets: statuses,\n          summary: { total, present, missing, expired: expiredCount, stale: staleCount },\n          ready: missing === 0,\n        })\n      ) {\n        if (missing > 0) process.exitCode = 1;\n        return;\n      }\n\n      console.log(\n        c.bold(`\\n  ${SYMBOLS.shield} Project secret manifest check\\n`),\n      );\n\n      for (const s of statuses) {\n        const desc = s.description ? c.dim(`— ${s.description}`) : \"\";\n        if (s.status === \"missing\") {\n          console.log(`  ${c.red(SYMBOLS.cross)} ${c.bold(s.key)} ${c.red(\"MISSING\")} ${desc}`);\n        } else if (s.status === \"optional-not-set\") {\n          console.log(`  ${c.dim(SYMBOLS.cross)} ${c.bold(s.key)} ${c.dim(\"optional, not set\")} ${desc}`);\n        } else if (s.status === \"expired\") {\n          console.log(`  ${c.red(SYMBOLS.warning)} ${c.bold(s.key)} ${c.bgRed(c.white(\" EXPIRED \"))} ${desc}`);\n        } else if (s.status === \"stale\") {\n          console.log(`  ${c.yellow(SYMBOLS.warning)} ${c.bold(s.key)} ${c.yellow(`stale (${s.lifetimePercent}%)`)} ${desc}`);\n        } else {\n          console.log(`  ${c.green(SYMBOLS.check)} ${c.bold(s.key)} ${c.green(\"OK\")} ${desc}`);\n        }\n      }\n\n      console.log(\n        `\\n  ${c.bold(`${total} declared`)}  ${c.green(`${present} present`)}  ${c.yellow(`${staleCount} stale`)}  ${c.red(`${expiredCount} expired`)}  ${c.red(`${missing} missing`)}`,\n      );\n\n      if (missing > 0) {\n        console.log(\n          `\\n  ${c.red(\"Project is NOT ready — missing required secrets.\")}`,\n        );\n      } else if (expiredCount > 0) {\n        console.log(\n          `\\n  ${c.yellow(\"Project has expired secrets that need rotation.\")}`,\n        );\n      } else {\n        console.log(\n          `\\n  ${c.green(`${SYMBOLS.check} Project is ready — all required secrets present.`)}`,\n        );\n      }\n\n      console.log();\n\n      if (missing > 0) process.exit(1);\n    });\n\n  program\n    .command(\"env\")\n    .description(\"Show detected environment (wavefunction collapse context)\")\n    .option(\"--project-path <path>\", \"Project path for detection\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const result = collapseEnvironment({\n        projectPath: cmd.projectPath ?? process.cwd(),\n      });\n\n      if (emitJson(program, cmd, { environment: result })) return;\n\n      if (result) {\n        console.log(\n          `${SYMBOLS.zap} ${c.bold(\"Collapsed environment:\")} ${envBadge(result.env)} ${c.dim(`(source: ${result.source})`)}`,\n        );\n      } else {\n        console.log(\n          c.dim(\n            \"No environment detected. Set QRING_ENV, NODE_ENV, or create .q-ring.json\",\n          ),\n        );\n      }\n    });\n\n  program\n    .command(\"env:generate\")\n    .description(\n      \"Generate a .env file from the project manifest (.q-ring.json)\",\n    )\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .option(\"-o, --output <file>\", \"Output file path (defaults to stdout)\")\n    .option(\"-e, --env <env>\", \"Force environment for superposition collapse\")\n    .option(\"-y, --yes\", \"Overwrite an existing output file without asking\")\n    .action(async (cmd) => {\n      const projectPath = cmd.projectPath ?? process.cwd();\n      const config = readProjectConfig(projectPath);\n\n      if (\n        cmd.output &&\n        existsSync(cmd.output) &&\n        !(await confirm(`Overwrite existing ${cmd.output}?`, { assumeYes: cmd.yes }))\n      ) {\n        console.error(c.dim(\"Aborted.\"));\n        process.exitCode = 1;\n        return;\n      }\n\n      if (!config?.secrets || Object.keys(config.secrets).length === 0) {\n        console.error(\n          c.red(`${SYMBOLS.cross} No secrets manifest found in .q-ring.json`),\n        );\n        process.exit(1);\n      }\n\n      const opts = buildOpts(cmd);\n      const lines: string[] = [];\n      const warnings: string[] = [];\n\n      for (const [key, manifest] of Object.entries(config.secrets)) {\n        const value = getSecret(key, { ...opts, projectPath, source: \"cli\" });\n\n        if (value === null) {\n          if (manifest.required !== false) {\n            warnings.push(`MISSING (required): ${key}`);\n          }\n          lines.push(\n            `# ${key}= ${manifest.description ? `# ${manifest.description}` : \"\"}`,\n          );\n          continue;\n        }\n\n        const result = getEnvelope(key, { projectPath, source: \"cli\" });\n        if (result) {\n          const decay = checkDecay(result.envelope);\n          if (decay.isExpired) {\n            warnings.push(`EXPIRED: ${key}`);\n          } else if (decay.isStale) {\n            warnings.push(`STALE (${decay.lifetimePercent}%): ${key}`);\n          }\n        }\n\n        const escaped = value\n          .replace(/\\\\/g, \"\\\\\\\\\")\n          .replace(/\"/g, '\\\\\"')\n          .replace(/\\n/g, \"\\\\n\");\n        lines.push(`${key}=\"${escaped}\"`);\n      }\n\n      const output = lines.join(\"\\n\") + \"\\n\";\n\n      if (cmd.output) {\n        writeFileSync(cmd.output, output);\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"generated\")} ${c.bold(cmd.output)} (${Object.keys(config.secrets).length} keys)`,\n        );\n      } else {\n        process.stdout.write(output);\n      }\n\n      if (warnings.length > 0 && process.stderr.isTTY) {\n        console.error();\n        for (const w of warnings) {\n          console.error(`  ${c.yellow(SYMBOLS.warning)} ${w}`);\n        }\n        console.error();\n      }\n    });\n\n  program\n    .command(\"wizard <name>\")\n    .description(\n      \"Set up a new service integration with secrets, manifest, and hooks\",\n    )\n    .option(\n      \"--keys <keys>\",\n      \"Comma-separated secret key names to create (e.g. API_KEY,API_SECRET)\",\n    )\n    .option(\n      \"--provider <provider>\",\n      \"Validation provider (e.g. openai, stripe, github)\",\n    )\n    .option(\"--tags <tags>\", \"Comma-separated tags for all secrets\")\n    .option(\n      \"--hook-exec <cmd>\",\n      \"Shell command to run when any of these secrets change\",\n    )\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-y, --yes\", \"Skip confirmation when overwriting existing secrets\")\n    .action(async (name: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const prefix = name.toUpperCase().replace(/[^A-Z0-9]/g, \"_\");\n      const tags = cmd.tags?.split(\",\").map((t: string) => t.trim()) ?? [\n        name.toLowerCase(),\n      ];\n      const provider = cmd.provider;\n\n      let keyNames: string[];\n      if (cmd.keys) {\n        keyNames = cmd.keys.split(\",\").map((k: string) => k.trim());\n      } else {\n        keyNames = [`${prefix}_API_KEY`, `${prefix}_API_SECRET`];\n      }\n\n      // The wizard generates fresh random values — overwriting an existing\n      // secret replaces a real credential with a placeholder. Ask first.\n      const existing = keyNames.filter((k) => hasSecret(k, opts));\n      if (\n        existing.length > 0 &&\n        !(await confirm(\n          `${existing.length} secret(s) already exist and will be overwritten with generated values: ${existing.join(\", \")}. Continue?`,\n          { assumeYes: cmd.yes },\n        ))\n      ) {\n        console.error(c.dim(\"Aborted.\"));\n        process.exitCode = 1;\n        return;\n      }\n\n      console.log(`\\n${SYMBOLS.zap} ${c.bold(`Setting up service: ${name}`)}\\n`);\n\n      for (const key of keyNames) {\n        const value = generateSecret({\n          format: \"api-key\",\n          prefix: `${prefix.toLowerCase()}_`,\n        });\n        setSecret(key, value, {\n          ...opts,\n          tags,\n          provider,\n          description: `Auto-generated by wizard for ${name}`,\n        });\n        console.log(`  ${c.green(SYMBOLS.check)} Created ${c.bold(key)}`);\n      }\n\n      const projectPath = opts.projectPath ?? process.cwd();\n      const manifestPath = `${projectPath}/.q-ring.json`;\n      let config: {\n        secrets?: Record<\n          string,\n          { required?: boolean; description?: string; provider?: string }\n        >;\n      } = {};\n      try {\n        if (existsSync(manifestPath)) {\n          config = JSON.parse(readFileSync(manifestPath, \"utf8\"));\n        }\n      } catch {\n        /* ignore parse failures; we'll overwrite with a valid object */\n      }\n\n      if (!config.secrets) config.secrets = {};\n      for (const key of keyNames) {\n        config.secrets[key] = {\n          required: true,\n          description: `${name} integration`,\n          ...(provider ? { provider } : {}),\n        };\n      }\n\n      writeFileSync(manifestPath, JSON.stringify(config, null, 2) + \"\\n\", \"utf8\");\n      console.log(\n        `  ${c.green(SYMBOLS.check)} Updated ${c.dim(\".q-ring.json\")} manifest`,\n      );\n\n      if (cmd.hookExec) {\n        for (const key of keyNames) {\n          registerHook({\n            type: \"shell\" as HookType,\n            match: {\n              key,\n              action: [\"write\" as HookAction, \"delete\" as HookAction],\n            },\n            command: cmd.hookExec,\n            description: `${name} wizard hook`,\n            enabled: true,\n          });\n        }\n        console.log(\n          `  ${c.green(SYMBOLS.check)} Registered hook: ${c.dim(cmd.hookExec)}`,\n        );\n      }\n\n      console.log(\n        `\\n  ${c.green(\"Done!\")} Service \"${name}\" is ready with ${keyNames.length} secrets.\\n`,\n      );\n    });\n}\n","/**\n * Environment promotion (0.18 \"garrison\"): move a secret's value from one\n * superposition state to another, and diff two environments — without ever\n * printing a value.\n *\n * `qring set KEY --env dev` writes states one at a time; promotion is the\n * \"now make prod match staging\" step that used to mean copy-paste. Both\n * operations go through the normal keyring API so scope resolution, policy\n * checks, audit and hooks all apply.\n */\nimport { getEnvelope, listSecrets, setSecret, type KeyringOptions } from \"./keyring.js\";\nimport type { Environment } from \"./envelope.js\";\nimport type { Scope } from \"./scope.js\";\n\nexport interface PromoteOptions extends KeyringOptions {\n  from: Environment;\n  to: Environment;\n  /** Overwrite a differing value in `to` without asking. */\n  force?: boolean;\n}\n\nexport type PromotePrevious = \"absent\" | \"same\" | \"different\";\n\nexport interface PromoteResult {\n  key: string;\n  scope: Scope;\n  from: Environment;\n  to: Environment;\n  /** What `to` held before: nothing, the same value, or a different one. */\n  previous: PromotePrevious;\n  /** False when `to` already matched (no write, no audit event). */\n  changed: boolean;\n}\n\nexport class PromoteConflictError extends Error {\n  readonly code = \"ERR_PROMOTE_CONFLICT\";\n  constructor(key: string, to: Environment) {\n    super(\n      `\"${key}\" already has a different value for env \"${to}\" — pass force to overwrite it`,\n    );\n  }\n}\n\nfunction assertEnvName(env: string, label: string): void {\n  if (!/^[A-Za-z0-9_.-]{1,64}$/.test(env)) {\n    throw new Error(`${label} environment name \"${env}\" is invalid (letters, digits, _ . - only)`);\n  }\n}\n\n/**\n * Copy the `from` state of `key` into its `to` state. A secret with a single\n * (collapsed) value has no states to promote from.\n */\nexport function promoteSecret(key: string, opts: PromoteOptions): PromoteResult {\n  assertEnvName(opts.from, \"source\");\n  assertEnvName(opts.to, \"target\");\n  if (opts.from === opts.to) {\n    throw new Error(`source and target environment are both \"${opts.from}\"`);\n  }\n  const found = getEnvelope(key, opts);\n  if (!found) throw new Error(`Secret \"${key}\" not found`);\n  const { envelope, scope } = found;\n  const states = envelope.states;\n  if (!states) {\n    throw new Error(\n      `\"${key}\" has a single value, not per-environment states — set one with: qring set ${key} --env ${opts.from}`,\n    );\n  }\n  const source = states[opts.from];\n  if (source === undefined) {\n    const available = Object.keys(states).join(\", \") || \"none\";\n    throw new Error(`\"${key}\" has no value for env \"${opts.from}\" (available: ${available})`);\n  }\n  const current = states[opts.to];\n  const previous: PromotePrevious =\n    current === undefined ? \"absent\" : current === source ? \"same\" : \"different\";\n  if (previous === \"same\") {\n    return { key, scope, from: opts.from, to: opts.to, previous, changed: false };\n  }\n  if (previous === \"different\" && !opts.force) {\n    throw new PromoteConflictError(key, opts.to);\n  }\n  const nextStates = { ...states, [opts.to]: source };\n  setSecret(key, \"\", {\n    ...opts,\n    scope,\n    states: nextStates,\n    defaultEnv: envelope.defaultEnv,\n  });\n  return { key, scope, from: opts.from, to: opts.to, previous, changed: true };\n}\n\nexport type DiffStatus = \"same\" | \"different\" | \"only-a\" | \"only-b\" | \"collapsed\";\n\nexport interface DiffEntry {\n  key: string;\n  scope: Scope;\n  status: DiffStatus;\n}\n\nexport interface DiffOptions extends KeyringOptions {\n  a: Environment;\n  b: Environment;\n  /** Restrict to these keys (exact names). */\n  keys?: string[];\n}\n\nexport interface DiffResult {\n  a: Environment;\n  b: Environment;\n  entries: DiffEntry[];\n  summary: Record<DiffStatus, number>;\n  /** True when anything differs or is missing on one side. */\n  drift: boolean;\n}\n\n/**\n * Compare two environments across the visible secrets. Values are compared\n * for equality but never returned. A collapsed secret (single value) is the\n * same in every environment by definition and is reported as \"collapsed\".\n */\nexport function diffEnvironments(opts: DiffOptions): DiffResult {\n  assertEnvName(opts.a, \"first\");\n  assertEnvName(opts.b, \"second\");\n  const wanted = opts.keys ? new Set(opts.keys) : null;\n  const entries: DiffEntry[] = [];\n  for (const entry of listSecrets(opts)) {\n    if (wanted && !wanted.has(entry.key)) continue;\n    const states = entry.envelope?.states;\n    let status: DiffStatus;\n    if (!states) {\n      status = \"collapsed\";\n    } else {\n      const va = states[opts.a];\n      const vb = states[opts.b];\n      if (va === undefined && vb === undefined) continue; // in neither env\n      if (va === undefined) status = \"only-b\";\n      else if (vb === undefined) status = \"only-a\";\n      else status = va === vb ? \"same\" : \"different\";\n    }\n    entries.push({ key: entry.key, scope: entry.scope, status });\n  }\n  const summary: Record<DiffStatus, number> = {\n    same: 0,\n    different: 0,\n    \"only-a\": 0,\n    \"only-b\": 0,\n    collapsed: 0,\n  };\n  for (const e of entries) summary[e.status] += 1;\n  const drift = summary.different + summary[\"only-a\"] + summary[\"only-b\"] > 0;\n  return { a: opts.a, b: opts.b, entries, summary, drift };\n}\n","import type { Command } from \"commander\";\nimport { diffEnvironments, promoteSecret, PromoteConflictError } from \"../../core/promote.js\";\nimport { confirm } from \"../../utils/prompt.js\";\nimport { c, envBadge, scopeColor, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson, wantsJsonOutput } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\n\nconst STATUS_LABEL: Record<string, string> = {\n  same: c.green(\"same\"),\n  different: c.yellow(\"different\"),\n  \"only-a\": c.red(\"missing in B\"),\n  \"only-b\": c.red(\"missing in A\"),\n  collapsed: c.dim(\"single value\"),\n};\n\nexport function registerEnvironmentCommands(program: Command): void {\n  program\n    .command(\"promote <key>\")\n    .description(\"Copy a secret's value from one environment to another (superposition)\")\n    .requiredOption(\"--from <env>\", \"Source environment\")\n    .requiredOption(\"--to <env>\", \"Target environment\")\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope (uses cwd)\")\n    .option(\"--team <id>\", \"Team scope\")\n    .option(\"--org <id>\", \"Org scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-f, --force\", \"Overwrite a differing target value without asking\")\n    .option(\"-y, --yes\", \"Alias for --force\")\n    .action(async (key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const json = wantsJsonOutput(program, cmd);\n      const run = (force: boolean) =>\n        promoteSecret(key, { ...opts, from: cmd.from, to: cmd.to, force });\n      try {\n        let result;\n        try {\n          result = run(Boolean(cmd.force || cmd.yes));\n        } catch (err) {\n          if (!(err instanceof PromoteConflictError) || json) throw err;\n          const ok = await confirm(\n            `${SYMBOLS.warning} ${c.bold(key)} already has a different value for ${envBadge(cmd.to)}. Overwrite it with the ${envBadge(cmd.from)} value?`,\n          );\n          if (!ok) {\n            console.error(c.dim(\"Cancelled.\"));\n            process.exitCode = 1;\n            return;\n          }\n          result = run(true);\n        }\n        if (emitJson(program, cmd, result)) return;\n        const verb = result.changed ? c.green(\"promoted\") : c.dim(\"already in sync\");\n        console.log(\n          `${SYMBOLS.check} ${verb} ${c.bold(key)} ${envBadge(result.from)} ${c.dim(\"→\")} ${envBadge(result.to)} ${c.dim(`[${scopeColor(result.scope)}]`)}`,\n        );\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        if (json) console.log(JSON.stringify({ ok: false, error: message }));\n        else console.error(c.red(`${SYMBOLS.cross} ${message}`));\n        process.exitCode = 1;\n      }\n    });\n\n  program\n    .command(\"diff <envA> <envB>\")\n    .description(\"Compare two environments key by key — statuses only, never values (exit 1 on drift)\")\n    .option(\"-k, --keys <keys>\", \"Comma-separated keys to compare (default: all visible)\")\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope (uses cwd)\")\n    .option(\"--team <id>\", \"Team scope\")\n    .option(\"--org <id>\", \"Org scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .action((envA: string, envB: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const keys = cmd.keys ? String(cmd.keys).split(\",\").map((k: string) => k.trim()).filter(Boolean) : undefined;\n      try {\n        const result = diffEnvironments({ ...opts, a: envA, b: envB, keys });\n        if (result.drift) process.exitCode = 1;\n        if (emitJson(program, cmd, result)) return;\n        if (result.entries.length === 0) {\n          console.log(c.dim(`No secrets carry ${envA} or ${envB} states.`));\n          return;\n        }\n        console.log(`${envBadge(envA)} ${c.dim(\"A\")}   ${envBadge(envB)} ${c.dim(\"B\")}`);\n        const width = Math.max(...result.entries.map((e) => e.key.length));\n        for (const e of result.entries) {\n          console.log(\n            `  ${c.bold(e.key.padEnd(width))}  ${STATUS_LABEL[e.status] ?? e.status}  ${c.dim(`[${scopeColor(e.scope)}]`)}`,\n          );\n        }\n        const s = result.summary;\n        console.log(\n          c.dim(\n            `\\n${s.same} same · ${s.different} different · ${s[\"only-a\"]} only in A · ${s[\"only-b\"]} only in B · ${s.collapsed} single-value`,\n          ),\n        );\n        if (result.drift) {\n          console.log(c.yellow(`${SYMBOLS.warning} drift detected — promote with: qring promote KEY --from ${envA} --to ${envB}`));\n        } else {\n          console.log(c.green(`${SYMBOLS.check} environments aligned`));\n        }\n      } catch (err) {\n        const message = err instanceof Error ? err.message : String(err);\n        if (wantsJsonOutput(program, cmd)) console.log(JSON.stringify({ ok: false, error: message }));\n        else console.error(c.red(`${SYMBOLS.cross} ${message}`));\n        process.exitCode = 1;\n      }\n    });\n}\n","/**\n * Quantum Teleportation: securely share/transfer secrets between machines.\n *\n * Generates encrypted bundles that can be shared via any channel.\n *\n * - v1 (passphrase): AES-256-GCM under a PBKDF2-HMAC-SHA512 key derived from\n *   a passphrase exchanged out-of-band.\n * - v2 (recipient packs): age-style public-key encryption. The packer wraps a\n *   random content key for each recipient's X25519 public key (ECDH with an\n *   ephemeral key, HKDF-SHA256, AES-256-GCM key wrap). No shared secret is\n *   needed — recipients publish a `qring1...` string once and keep their\n *   private key in the OS keyring (`qring teleport keygen`).\n */\n\nimport {\n  randomBytes,\n  createCipheriv,\n  createDecipheriv,\n  createHash,\n  createPrivateKey,\n  createPublicKey,\n  diffieHellman,\n  generateKeyPairSync,\n  hkdfSync,\n  pbkdf2Sync,\n  type KeyObject,\n} from \"node:crypto\";\nimport { z } from \"zod\";\nimport { Entry } from \"./backend.js\";\n\nconst ALGORITHM = \"aes-256-gcm\";\nconst KEY_LENGTH = 32;\n/** NIST / OpenSSL recommendation for AES-GCM (96-bit nonce). */\nconst IV_LENGTH = 12;\nconst SALT_LENGTH = 32;\n/** OWASP-recommended floor for PBKDF2-HMAC-SHA512 (2023). */\nconst PBKDF2_ITERATIONS = 210000;\n/** Bundles without an explicit `iter` predate the bump; decrypt at the old cost. */\nconst LEGACY_PBKDF2_ITERATIONS = 100000;\n\nexport interface TeleportBundle {\n  /** Format version */\n  v: 1;\n  /** Base64-encoded encrypted payload */\n  data: string;\n  /** Base64-encoded salt for key derivation */\n  salt: string;\n  /** Base64-encoded initialization vector */\n  iv: string;\n  /** Base64-encoded auth tag */\n  tag: string;\n  /** ISO timestamp of creation */\n  createdAt: string;\n  /** Number of secrets in the bundle */\n  count: number;\n  /** PBKDF2 iteration count used for key derivation (absent = legacy 100k). */\n  iter?: number;\n}\n\nexport interface TeleportPayload {\n  secrets: { key: string; value: string; scope?: string }[];\n  exportedAt: string;\n  exportedBy?: string;\n}\n\nexport const TeleportBundleSchema = z.object({\n  v: z.literal(1),\n  data: z.string(),\n  salt: z.string(),\n  iv: z.string(),\n  tag: z.string(),\n  createdAt: z.string(),\n  count: z.number(),\n  iter: z.number().optional(),\n});\n\nexport const TeleportPayloadSchema = z.object({\n  secrets: z.array(\n    z.object({\n      key: z.string(),\n      value: z.string(),\n      scope: z.string().optional(),\n    }),\n  ),\n  exportedAt: z.string(),\n  exportedBy: z.string().optional(),\n});\n\nfunction deriveKey(\n  passphrase: string,\n  salt: Buffer,\n  iterations: number = PBKDF2_ITERATIONS,\n): Buffer {\n  return pbkdf2Sync(passphrase, salt, iterations, KEY_LENGTH, \"sha512\");\n}\n\n/** base64 → JSON, with the v1-era error codes preserved. */\nfunction decodeBundle(encoded: string): unknown {\n  let bundleJson: string;\n  try {\n    bundleJson = Buffer.from(encoded, \"base64\").toString(\"utf8\");\n  } catch {\n    throw new Error(\"ERR_TELEPORT_CORRUPT: invalid base64 bundle\");\n  }\n\n  try {\n    return JSON.parse(bundleJson);\n  } catch {\n    throw new Error(\"ERR_TELEPORT_CORRUPT: bundle is not valid JSON\");\n  }\n}\n\nfunction parsePayload(decrypted: Buffer): TeleportPayload {\n  let rawPayload: unknown;\n  try {\n    rawPayload = JSON.parse(decrypted.toString(\"utf8\"));\n  } catch {\n    throw new Error(\"ERR_TELEPORT_CORRUPT: decrypted payload is not valid JSON\");\n  }\n\n  const payload = TeleportPayloadSchema.safeParse(rawPayload);\n  if (!payload.success) {\n    throw new Error(\n      `ERR_TELEPORT_CORRUPT: invalid payload (${payload.error.message})`,\n    );\n  }\n  return payload.data;\n}\n\n/**\n * Pack secrets into an encrypted teleport bundle.\n */\nexport function teleportPack(\n  secrets: { key: string; value: string; scope?: string }[],\n  passphrase: string,\n): string {\n  const payload: TeleportPayload = {\n    secrets,\n    exportedAt: new Date().toISOString(),\n  };\n\n  const plaintext = JSON.stringify(payload);\n  const salt = randomBytes(SALT_LENGTH);\n  const iv = randomBytes(IV_LENGTH);\n  const key = deriveKey(passphrase, salt, PBKDF2_ITERATIONS);\n\n  const cipher = createCipheriv(ALGORITHM, key, iv);\n  const encrypted = Buffer.concat([\n    cipher.update(plaintext, \"utf8\"),\n    cipher.final(),\n  ]);\n  const tag = cipher.getAuthTag();\n\n  const bundle: TeleportBundle = {\n    v: 1,\n    data: encrypted.toString(\"base64\"),\n    salt: salt.toString(\"base64\"),\n    iv: iv.toString(\"base64\"),\n    tag: tag.toString(\"base64\"),\n    createdAt: new Date().toISOString(),\n    count: secrets.length,\n    iter: PBKDF2_ITERATIONS,\n  };\n\n  return Buffer.from(JSON.stringify(bundle)).toString(\"base64\");\n}\n\n/**\n * Unpack and decrypt a teleport bundle.\n */\nexport function teleportUnpack(\n  encoded: string,\n  passphrase: string,\n): TeleportPayload {\n  const rawBundle = decodeBundle(encoded);\n\n  const parsedBundle = TeleportBundleSchema.safeParse(rawBundle);\n  if (!parsedBundle.success) {\n    throw new Error(\n      `ERR_TELEPORT_CORRUPT: invalid bundle shape (${parsedBundle.error.message})`,\n    );\n  }\n  const bundle = parsedBundle.data;\n\n  const salt = Buffer.from(bundle.salt, \"base64\");\n  const iv = Buffer.from(bundle.iv, \"base64\");\n  const tag = Buffer.from(bundle.tag, \"base64\");\n  const encrypted = Buffer.from(bundle.data, \"base64\");\n  const key = deriveKey(passphrase, salt, bundle.iter ?? LEGACY_PBKDF2_ITERATIONS);\n\n  const decipher = createDecipheriv(ALGORITHM, key, iv);\n  decipher.setAuthTag(tag);\n\n  let decrypted: Buffer;\n  try {\n    decrypted = Buffer.concat([\n      decipher.update(encrypted),\n      decipher.final(),\n    ]);\n  } catch {\n    throw new Error(\"ERR_TELEPORT_BAD_PASSPHRASE: decryption failed (wrong passphrase or corrupt data)\");\n  }\n\n  return parsePayload(decrypted);\n}\n\n// ─── v2: recipient packs (X25519 + HKDF-SHA256 + AES-256-GCM key wrap) ───\n\n/** Recipient strings look like `qring1` + base64url(raw 32-byte X25519 pub). */\nconst RECIPIENT_PREFIX = \"qring1\";\nconst RECIPIENT_RE = /^qring1([A-Za-z0-9_-]{43})$/;\nconst X25519_RAW_LENGTH = 32;\n/** AAD binding the payload ciphertext to the v2 format. */\nconst V2_AAD = \"qring-teleport-v2\";\n/** HKDF info for the per-recipient wrapping key. */\nconst V2_WRAP_INFO = \"qring-teleport-v2-wrap\";\n/** Where our own private key lives: OS keyring, never a file. */\nexport const TELEPORT_KEYRING_SERVICE = \"q-ring-teleport\";\nexport const TELEPORT_KEYRING_ACCOUNT = \"identity\";\n\nexport interface TeleportRecipientEntry {\n  /** First 8 hex chars of SHA-256(raw recipient public key). */\n  id: string;\n  /** Base64 AES-256-GCM ciphertext of the content-encryption key. */\n  wrap: string;\n  /** Base64 IV for the wrap. */\n  iv: string;\n  /** Base64 auth tag for the wrap. */\n  tag: string;\n}\n\nexport interface TeleportBundleV2 {\n  v: 2;\n  createdAt: string;\n  count: number;\n  /** base64url raw 32-byte ephemeral X25519 public key. */\n  ephemeral: string;\n  recipients: TeleportRecipientEntry[];\n  /** Base64 IV for the payload. */\n  iv: string;\n  /** Base64 auth tag for the payload. */\n  tag: string;\n  /** Base64 AES-256-GCM ciphertext of the JSON payload. */\n  data: string;\n}\n\nexport const TeleportBundleV2Schema = z.object({\n  v: z.literal(2),\n  createdAt: z.string(),\n  count: z.number(),\n  ephemeral: z.string(),\n  recipients: z\n    .array(\n      z.object({\n        id: z.string(),\n        wrap: z.string(),\n        iv: z.string(),\n        tag: z.string(),\n      }),\n    )\n    .min(1),\n  iv: z.string(),\n  tag: z.string(),\n  data: z.string(),\n});\n\nexport interface TeleportIdentity {\n  /** Our X25519 private key (never serialised by callers). */\n  privateKey: KeyObject;\n  /** Our public recipient string (`qring1...`). */\n  recipient: string;\n  /** Our recipient id, as it appears in bundles addressed to us. */\n  id: string;\n}\n\nfunction rawPublicKey(key: KeyObject): Buffer {\n  const jwk = key.export({ format: \"jwk\" });\n  if (jwk.kty !== \"OKP\" || jwk.crv !== \"X25519\" || typeof jwk.x !== \"string\") {\n    throw new Error(\"ERR_TELEPORT_BAD_RECIPIENT: not an X25519 public key\");\n  }\n  const raw = Buffer.from(jwk.x, \"base64url\");\n  if (raw.length !== X25519_RAW_LENGTH) {\n    throw new Error(\"ERR_TELEPORT_BAD_RECIPIENT: not an X25519 public key\");\n  }\n  return raw;\n}\n\nfunction publicKeyFromRaw(raw: Buffer): KeyObject {\n  return createPublicKey({\n    key: { kty: \"OKP\", crv: \"X25519\", x: raw.toString(\"base64url\") },\n    format: \"jwk\",\n  });\n}\n\n/** `qring1` + base64url(raw public key), no padding. */\nexport function formatRecipient(publicKey: KeyObject | Buffer): string {\n  const raw = Buffer.isBuffer(publicKey) ? publicKey : rawPublicKey(publicKey);\n  if (raw.length !== X25519_RAW_LENGTH) {\n    throw new Error(\"ERR_TELEPORT_BAD_RECIPIENT: public key must be 32 raw bytes\");\n  }\n  return `${RECIPIENT_PREFIX}${raw.toString(\"base64url\")}`;\n}\n\n/**\n * Parse a recipient string back into the raw 32-byte X25519 public key.\n * Throws `ERR_TELEPORT_BAD_RECIPIENT` on anything that is not exactly\n * `qring1` + 43 base64url characters decoding to 32 bytes.\n */\nexport function parseRecipient(str: string): Buffer {\n  const trimmed = typeof str === \"string\" ? str.trim() : \"\";\n  const match = RECIPIENT_RE.exec(trimmed);\n  if (!match) {\n    throw new Error(\n      `ERR_TELEPORT_BAD_RECIPIENT: expected \"${RECIPIENT_PREFIX}\" followed by a base64url X25519 public key (run \\`qring teleport identity\\` on the recipient's machine to get one)`,\n    );\n  }\n  const raw = Buffer.from(match[1], \"base64url\");\n  if (raw.length !== X25519_RAW_LENGTH) {\n    throw new Error(\n      \"ERR_TELEPORT_BAD_RECIPIENT: recipient key does not decode to 32 bytes\",\n    );\n  }\n  return raw;\n}\n\n/** First 8 hex chars of SHA-256(raw public key). */\nexport function recipientId(rawPub: Buffer): string {\n  return createHash(\"sha256\").update(rawPub).digest(\"hex\").slice(0, 8);\n}\n\n/** HKDF-SHA256(ikm=shared, salt=ephemeralPub||recipientPub, info, 32). */\nfunction deriveWrapKey(\n  shared: Buffer,\n  ephemeralPub: Buffer,\n  recipientPub: Buffer,\n): Buffer {\n  return Buffer.from(\n    hkdfSync(\n      \"sha256\",\n      shared,\n      Buffer.concat([ephemeralPub, recipientPub]),\n      V2_WRAP_INFO,\n      KEY_LENGTH,\n    ),\n  );\n}\n\n/**\n * Pack secrets for one or more recipients (no shared passphrase).\n *\n * A fresh content-encryption key encrypts the payload; the CEK is then\n * wrapped once per recipient under a key agreed via X25519 with a\n * single-use ephemeral keypair. The CEK and every intermediate key are\n * zeroised before returning; the ephemeral private key is discarded.\n */\nexport function teleportPackFor(\n  secrets: { key: string; value: string; scope?: string }[],\n  recipients: string[],\n): string {\n  const seen = new Map<string, Buffer>();\n  for (const r of recipients) {\n    const raw = parseRecipient(r);\n    seen.set(recipientId(raw), raw);\n  }\n  if (seen.size === 0) {\n    throw new Error(\"ERR_TELEPORT_NO_RECIPIENTS: at least one recipient is required\");\n  }\n\n  const payload: TeleportPayload = {\n    secrets,\n    exportedAt: new Date().toISOString(),\n  };\n  const plaintext = JSON.stringify(payload);\n\n  const cek = randomBytes(KEY_LENGTH);\n  const iv = randomBytes(IV_LENGTH);\n  const cipher = createCipheriv(ALGORITHM, cek, iv);\n  cipher.setAAD(Buffer.from(V2_AAD, \"utf8\"));\n  const encrypted = Buffer.concat([\n    cipher.update(plaintext, \"utf8\"),\n    cipher.final(),\n  ]);\n  const tag = cipher.getAuthTag();\n\n  const ephemeral = generateKeyPairSync(\"x25519\");\n  const ephemeralPub = rawPublicKey(ephemeral.publicKey);\n\n  const wrapped: TeleportRecipientEntry[] = [];\n  for (const [id, recipientPub] of seen) {\n    const shared = diffieHellman({\n      privateKey: ephemeral.privateKey,\n      publicKey: publicKeyFromRaw(recipientPub),\n    });\n    const wrapKey = deriveWrapKey(shared, ephemeralPub, recipientPub);\n    shared.fill(0);\n\n    const wrapIv = randomBytes(IV_LENGTH);\n    const wrapCipher = createCipheriv(ALGORITHM, wrapKey, wrapIv);\n    wrapCipher.setAAD(Buffer.from(id, \"utf8\"));\n    const wrap = Buffer.concat([wrapCipher.update(cek), wrapCipher.final()]);\n    const wrapTag = wrapCipher.getAuthTag();\n    wrapKey.fill(0);\n\n    wrapped.push({\n      id,\n      wrap: wrap.toString(\"base64\"),\n      iv: wrapIv.toString(\"base64\"),\n      tag: wrapTag.toString(\"base64\"),\n    });\n  }\n  cek.fill(0);\n\n  const bundle: TeleportBundleV2 = {\n    v: 2,\n    createdAt: new Date().toISOString(),\n    count: secrets.length,\n    ephemeral: ephemeralPub.toString(\"base64url\"),\n    recipients: wrapped,\n    iv: iv.toString(\"base64\"),\n    tag: tag.toString(\"base64\"),\n    data: encrypted.toString(\"base64\"),\n  };\n\n  return Buffer.from(JSON.stringify(bundle)).toString(\"base64\");\n}\n\nfunction toPrivateKey(identity: string | KeyObject): KeyObject {\n  if (typeof identity !== \"string\") return identity;\n  try {\n    return createPrivateKey(identity);\n  } catch {\n    throw new Error(\"ERR_TELEPORT_BAD_IDENTITY: private key is not a valid PEM\");\n  }\n}\n\n/**\n * Unpack a v2 bundle with our X25519 private key (PEM string or KeyObject).\n *\n * Throws `ERR_TELEPORT_NOT_A_RECIPIENT` when no entry matches our recipient\n * id, and `ERR_TELEPORT_CORRUPT` when the bundle is malformed or any GCM\n * tag fails (tampered payload, tampered wrap, or a swapped ephemeral key).\n */\nexport function teleportUnpackWith(\n  encoded: string,\n  identity: string | KeyObject,\n): TeleportPayload {\n  const privateKey = toPrivateKey(identity);\n  const rawBundle = decodeBundle(encoded);\n\n  const parsedBundle = TeleportBundleV2Schema.safeParse(rawBundle);\n  if (!parsedBundle.success) {\n    throw new Error(\n      `ERR_TELEPORT_CORRUPT: invalid bundle shape (${parsedBundle.error.message})`,\n    );\n  }\n  const bundle = parsedBundle.data;\n\n  const myPub = rawPublicKey(createPublicKey(privateKey));\n  const myId = recipientId(myPub);\n  const mine = bundle.recipients.filter((r) => r.id === myId);\n  if (mine.length === 0) {\n    const ids = bundle.recipients.map((r) => r.id).join(\", \");\n    throw new Error(\n      `ERR_TELEPORT_NOT_A_RECIPIENT: bundle is addressed to [${ids}], not to ${myId}`,\n    );\n  }\n\n  const ephemeralPub = Buffer.from(bundle.ephemeral, \"base64url\");\n  if (ephemeralPub.length !== X25519_RAW_LENGTH) {\n    throw new Error(\"ERR_TELEPORT_CORRUPT: ephemeral key is not 32 bytes\");\n  }\n\n  let ephemeralKey: KeyObject;\n  try {\n    ephemeralKey = publicKeyFromRaw(ephemeralPub);\n  } catch {\n    throw new Error(\"ERR_TELEPORT_CORRUPT: ephemeral key is not a valid X25519 point\");\n  }\n  const shared = diffieHellman({ privateKey, publicKey: ephemeralKey });\n  const wrapKey = deriveWrapKey(shared, ephemeralPub, myPub);\n  shared.fill(0);\n\n  // 8 hex chars of id leave room for a (vanishingly unlikely) collision, so\n  // try every entry that claims our id before giving up.\n  let cek: Buffer | null = null;\n  for (const entry of mine) {\n    try {\n      const decipher = createDecipheriv(\n        ALGORITHM,\n        wrapKey,\n        Buffer.from(entry.iv, \"base64\"),\n      );\n      decipher.setAAD(Buffer.from(entry.id, \"utf8\"));\n      decipher.setAuthTag(Buffer.from(entry.tag, \"base64\"));\n      cek = Buffer.concat([\n        decipher.update(Buffer.from(entry.wrap, \"base64\")),\n        decipher.final(),\n      ]);\n      break;\n    } catch {\n      cek = null;\n    }\n  }\n  wrapKey.fill(0);\n  if (cek === null || cek.length !== KEY_LENGTH) {\n    cek?.fill(0);\n    throw new Error(\n      \"ERR_TELEPORT_CORRUPT: could not unwrap content key (tampered bundle or mismatched identity)\",\n    );\n  }\n\n  let decrypted: Buffer;\n  try {\n    const decipher = createDecipheriv(\n      ALGORITHM,\n      cek,\n      Buffer.from(bundle.iv, \"base64\"),\n    );\n    decipher.setAAD(Buffer.from(V2_AAD, \"utf8\"));\n    decipher.setAuthTag(Buffer.from(bundle.tag, \"base64\"));\n    decrypted = Buffer.concat([\n      decipher.update(Buffer.from(bundle.data, \"base64\")),\n      decipher.final(),\n    ]);\n  } catch {\n    throw new Error(\"ERR_TELEPORT_CORRUPT: payload authentication failed (tampered bundle)\");\n  } finally {\n    cek.fill(0);\n  }\n\n  return parsePayload(decrypted);\n}\n\nexport type TeleportBundleInfo =\n  | { v: 1; count: number }\n  | { v: 2; count: number; recipients: string[] };\n\n/**\n * Cheap, non-decrypting look at a bundle: which format it is, how many\n * secrets it claims, and (v2) which recipient ids it is addressed to.\n */\nexport function inspectTeleportBundle(encoded: string): TeleportBundleInfo {\n  const raw = decodeBundle(encoded);\n  const v1 = TeleportBundleSchema.safeParse(raw);\n  if (v1.success) return { v: 1, count: v1.data.count };\n  const v2 = TeleportBundleV2Schema.safeParse(raw);\n  if (v2.success) {\n    return {\n      v: 2,\n      count: v2.data.count,\n      recipients: v2.data.recipients.map((r) => r.id),\n    };\n  }\n  const version =\n    raw !== null && typeof raw === \"object\" && \"v\" in raw\n      ? String((raw as { v: unknown }).v)\n      : \"unknown\";\n  throw new Error(\n    `ERR_TELEPORT_CORRUPT: unsupported or malformed bundle (v=${version})`,\n  );\n}\n\n/**\n * Unpack either format: v1 needs `passphrase`, v2 needs `identity`.\n */\nexport function teleportUnpackAuto(\n  encoded: string,\n  creds: { passphrase?: string; identity?: string | KeyObject },\n): TeleportPayload {\n  const info = inspectTeleportBundle(encoded);\n  if (info.v === 1) {\n    if (creds.passphrase === undefined) {\n      throw new Error(\n        \"ERR_TELEPORT_PASSPHRASE_REQUIRED: this is a passphrase (v1) bundle\",\n      );\n    }\n    return teleportUnpack(encoded, creds.passphrase);\n  }\n  if (creds.identity === undefined) {\n    throw new Error(\n      \"ERR_TELEPORT_NO_IDENTITY: this bundle is addressed to recipient keys — run `qring teleport keygen` to create yours\",\n    );\n  }\n  return teleportUnpackWith(encoded, creds.identity);\n}\n\n// ─── Identity storage (OS keyring only) ───\n\nfunction identityFrom(privateKey: KeyObject): TeleportIdentity {\n  const raw = rawPublicKey(createPublicKey(privateKey));\n  return { privateKey, recipient: formatRecipient(raw), id: recipientId(raw) };\n}\n\n/**\n * Generate a fresh X25519 identity and store the private key (PKCS8 DER,\n * base64) in the keyring under `q-ring-teleport` / `identity`.\n * Refuses to overwrite an existing identity unless `force` is set.\n */\nexport function generateTeleportIdentity(\n  options: { force?: boolean } = {},\n): TeleportIdentity {\n  const entry = new Entry(TELEPORT_KEYRING_SERVICE, TELEPORT_KEYRING_ACCOUNT);\n  if (!options.force && entry.getPassword()) {\n    throw new Error(\n      \"ERR_TELEPORT_IDENTITY_EXISTS: a teleport identity already exists — pass --force to replace it (bundles sent to the old key become unreadable)\",\n    );\n  }\n  const { privateKey } = generateKeyPairSync(\"x25519\");\n  const der = privateKey.export({ format: \"der\", type: \"pkcs8\" });\n  entry.setPassword(der.toString(\"base64\"));\n  der.fill(0);\n  return identityFrom(privateKey);\n}\n\n/** Load our identity from the keyring, or null if none was generated yet. */\nexport function loadTeleportIdentity(): TeleportIdentity | null {\n  const stored = new Entry(\n    TELEPORT_KEYRING_SERVICE,\n    TELEPORT_KEYRING_ACCOUNT,\n  ).getPassword();\n  if (!stored) return null;\n  let privateKey: KeyObject;\n  try {\n    privateKey = createPrivateKey({\n      key: Buffer.from(stored, \"base64\"),\n      format: \"der\",\n      type: \"pkcs8\",\n    });\n  } catch {\n    throw new Error(\n      \"ERR_TELEPORT_BAD_IDENTITY: stored teleport identity is unreadable — run `qring teleport keygen --force`\",\n    );\n  }\n  return identityFrom(privateKey);\n}\n\n/** Load our identity or throw the keygen hint. */\nexport function requireTeleportIdentity(): TeleportIdentity {\n  const identity = loadTeleportIdentity();\n  if (!identity) {\n    throw new Error(\n      \"ERR_TELEPORT_NO_IDENTITY: no teleport identity found — run `qring teleport keygen` first\",\n    );\n  }\n  return identity;\n}\n","import type { Command } from \"commander\";\nimport {\n  getSecret,\n  setSecret,\n  hasSecret,\n  listSecrets,\n  entangleSecrets,\n  disentangleSecrets,\n  type KeyringOptions,\n} from \"../../core/keyring.js\";\nimport {\n  generateSecret,\n  estimateEntropy,\n  type NoiseFormat,\n} from \"../../core/noise.js\";\nimport {\n  tunnelCreate,\n  tunnelRead,\n  tunnelDestroy,\n  tunnelList,\n} from \"../../core/tunnel.js\";\nimport {\n  teleportPack,\n  teleportPackFor,\n  teleportUnpackAuto,\n  inspectTeleportBundle,\n  generateTeleportIdentity,\n  loadTeleportIdentity,\n  parseRecipient,\n  type TeleportPayload,\n} from \"../../core/teleport.js\";\nimport { promptSecret, confirm } from \"../../utils/prompt.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerQuantumCommands(program: Command): void {\n  program\n    .command(\"generate\")\n    .alias(\"gen\")\n    .description(\"Generate a cryptographic secret (quantum noise)\")\n    .option(\n      \"-f, --format <format>\",\n      \"Format: hex, base64, alphanumeric, uuid, api-key, token, password\",\n      \"api-key\",\n    )\n    .option(\n      \"-l, --length <n>\",\n      \"Length (bytes or chars depending on format)\",\n      parseInt,\n    )\n    .option(\"--prefix <prefix>\", \"Prefix for api-key/token format\")\n    .option(\n      \"-s, --save <key>\",\n      \"Save the generated secret to keyring with this key\",\n    )\n    .option(\"-g, --global\", \"Save to global scope\")\n    .option(\"-p, --project\", \"Save to project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .action((cmd) => {\n      const secret = generateSecret({\n        format: cmd.format as NoiseFormat,\n        length: cmd.length,\n        prefix: cmd.prefix,\n      });\n\n      const entropy = estimateEntropy(secret);\n\n      if (cmd.save) {\n        const opts = buildOpts(cmd);\n        setSecret(cmd.save, secret, opts);\n        console.log(\n          `${SYMBOLS.sparkle} ${c.green(\"generated & saved\")} ${c.bold(cmd.save)} ${c.dim(`(${cmd.format}, ${entropy} bits entropy)`)}`,\n        );\n      } else {\n        process.stdout.write(secret);\n        if (process.stdout.isTTY) {\n          console.log(\n            `\\n${c.dim(`format: ${cmd.format} | entropy: ~${entropy} bits`)}`,\n          );\n        }\n      }\n    });\n\n  program\n    .command(\"entangle <sourceKey> <targetKey>\")\n    .description(\"Link two secrets — rotating one updates the other\")\n    .option(\"-g, --global\", \"Both in global scope\")\n    .option(\"--source-project <path>\", \"Source project path\")\n    .option(\"--target-project <path>\", \"Target project path\")\n    .action((sourceKey: string, targetKey: string, cmd) => {\n      const sourceOpts: KeyringOptions = {\n        scope: cmd.sourceProject ? \"project\" : \"global\",\n        projectPath: cmd.sourceProject ?? process.cwd(),\n        source: \"cli\",\n      };\n      const targetOpts: KeyringOptions = {\n        scope: cmd.targetProject ? \"project\" : \"global\",\n        projectPath: cmd.targetProject ?? process.cwd(),\n        source: \"cli\",\n      };\n\n      entangleSecrets(sourceKey, sourceOpts, targetKey, targetOpts);\n      console.log(\n        `${SYMBOLS.link} ${c.cyan(\"entangled\")} ${c.bold(sourceKey)} ${SYMBOLS.arrow} ${c.bold(targetKey)}`,\n      );\n    });\n\n  program\n    .command(\"disentangle <sourceKey> <targetKey>\")\n    .description(\"Unlink two entangled secrets\")\n    .option(\"-g, --global\", \"Both in global scope\")\n    .option(\"--source-project <path>\", \"Source project path\")\n    .option(\"--target-project <path>\", \"Target project path\")\n    .action((sourceKey: string, targetKey: string, cmd) => {\n      const sourceOpts: KeyringOptions = {\n        scope: cmd.sourceProject ? \"project\" : \"global\",\n        projectPath: cmd.sourceProject ?? process.cwd(),\n        source: \"cli\",\n      };\n      const targetOpts: KeyringOptions = {\n        scope: cmd.targetProject ? \"project\" : \"global\",\n        projectPath: cmd.targetProject ?? process.cwd(),\n        source: \"cli\",\n      };\n\n      disentangleSecrets(sourceKey, sourceOpts, targetKey, targetOpts);\n      console.log(\n        `${SYMBOLS.link} ${c.yellow(\"disentangled\")} ${c.bold(sourceKey)} ${SYMBOLS.arrow} ${c.bold(targetKey)}`,\n      );\n    });\n\n  // ─── Tunneling Commands ───\n\n  const tunnel = program\n    .command(\"tunnel\")\n    .description(\"Ephemeral in-memory secrets (quantum tunneling)\");\n\n  tunnel\n    .command(\"create <value>\")\n    .description(\"Create a tunneled secret (returns tunnel ID)\")\n    .option(\"--ttl <seconds>\", \"Auto-expire after N seconds\", parseInt)\n    .option(\"--max-reads <n>\", \"Self-destruct after N reads\", parseInt)\n    .action((value: string, cmd) => {\n      const id = tunnelCreate(value, {\n        ttlSeconds: cmd.ttl,\n        maxReads: cmd.maxReads,\n      });\n\n      console.log(`${SYMBOLS.ghost} ${c.magenta(\"tunneled\")} ${c.bold(id)}`);\n\n      const extras: string[] = [];\n      if (cmd.ttl) extras.push(`ttl=${cmd.ttl}s`);\n      if (cmd.maxReads) extras.push(`max-reads=${cmd.maxReads}`);\n      if (extras.length) console.log(c.dim(`  ${extras.join(\" | \")}`));\n    });\n\n  tunnel\n    .command(\"read <id>\")\n    .description(\"Read a tunneled secret (may self-destruct)\")\n    .action((id: string) => {\n      const value = tunnelRead(id);\n      if (value === null) {\n        console.error(\n          c.red(`${SYMBOLS.cross} Tunnel \"${id}\" not found or expired`),\n        );\n        process.exit(1);\n      }\n      process.stdout.write(value);\n    });\n\n  tunnel\n    .command(\"destroy <id>\")\n    .description(\"Destroy a tunneled secret immediately\")\n    .action((id: string) => {\n      const destroyed = tunnelDestroy(id);\n      if (destroyed) {\n        console.log(`${SYMBOLS.check} ${c.green(\"destroyed\")} ${id}`);\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} Tunnel \"${id}\" not found`));\n        process.exit(1);\n      }\n    });\n\n  tunnel\n    .command(\"list\")\n    .alias(\"ls\")\n    .description(\"List active tunnels\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const tunnels = tunnelList();\n      if (emitJson(program, cmd, { tunnels })) return;\n      if (tunnels.length === 0) {\n        console.log(c.dim(\"No active tunnels\"));\n        return;\n      }\n\n      console.log(\n        c.bold(`\\n  ${SYMBOLS.ghost} Active tunnels (${tunnels.length})\\n`),\n      );\n      for (const t of tunnels) {\n        const parts = [c.bold(t.id)];\n        parts.push(c.dim(`reads: ${t.accessCount}`));\n        if (t.maxReads) parts.push(c.dim(`max: ${t.maxReads}`));\n        if (t.expiresAt) {\n          const remaining = Math.max(\n            0,\n            Math.floor((t.expiresAt - Date.now()) / 1000),\n          );\n          parts.push(c.dim(`expires: ${remaining}s`));\n        }\n        console.log(`  ${SYMBOLS.ghost} ${parts.join(\"  \")}`);\n      }\n      console.log();\n    });\n\n  // ─── Teleportation Commands ───\n\n  const tp = program\n    .command(\"teleport\")\n    .alias(\"tp\")\n    .description(\"Encrypted secret sharing (quantum teleportation)\");\n\n  tp.command(\"keygen\")\n    .description(\n      \"Create your teleport identity (X25519 keypair, private key in the OS keyring)\",\n    )\n    .option(\"--force\", \"Replace an existing identity\")\n    .action((cmd) => {\n      let identity: ReturnType<typeof generateTeleportIdentity>;\n      try {\n        identity = generateTeleportIdentity({ force: Boolean(cmd.force) });\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.error(c.red(`${SYMBOLS.cross} ${msg}`));\n        process.exit(1);\n      }\n      // Always newline-terminated: `$(qring teleport identity)` strips it,\n      // while `>> recipients.txt` needs it.\n      console.log(identity.recipient);\n      if (process.stdout.isTTY) {\n        console.log(\n          `${SYMBOLS.key} ${c.green(\"identity created\")} ${c.dim(`(id ${identity.id})`)} — share the line above with anyone who should \\`teleport pack --to\\` you`,\n        );\n      }\n    });\n\n  tp.command(\"identity\")\n    .description(\"Print your public teleport recipient string\")\n    .action(() => {\n      let identity: ReturnType<typeof loadTeleportIdentity>;\n      try {\n        identity = loadTeleportIdentity();\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        console.error(c.red(`${SYMBOLS.cross} ${msg}`));\n        process.exit(1);\n      }\n      if (!identity) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} No teleport identity found — run ${c.bold(\"qring teleport keygen\")} first`,\n          ),\n        );\n        process.exit(1);\n      }\n      console.log(identity.recipient);\n      if (process.stdout.isTTY) {\n        console.log(c.dim(`recipient id: ${identity.id}`));\n      }\n    });\n\n  tp.command(\"pack\")\n    .description(\"Pack secrets into an encrypted bundle\")\n    .option(\"-k, --keys <keys>\", \"Comma-separated key names to pack\")\n    .option(\n      \"--to <recipient...>\",\n      \"Recipient(s) from `qring teleport identity` (repeatable or comma-separated); skips the passphrase\",\n    )\n    .option(\"-g, --global\", \"Pack global scope\")\n    .option(\"-p, --project\", \"Pack project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .action(async (cmd) => {\n      const opts = buildOpts(cmd);\n\n      // `--to a --to b` and `--to a,b` both work; validate before touching\n      // any secret so a typo in a recipient never reads the keyring.\n      const recipients: string[] = ((cmd.to as string[] | undefined) ?? [])\n        .flatMap((r) => r.split(\",\"))\n        .map((r) => r.trim())\n        .filter((r) => r.length > 0);\n      for (const r of recipients) {\n        try {\n          parseRecipient(r);\n        } catch (err) {\n          const msg = err instanceof Error ? err.message : String(err);\n          console.error(c.red(`${SYMBOLS.cross} Bad recipient \"${r}\": ${msg}`));\n          process.exit(1);\n        }\n      }\n\n      let passphrase: string | undefined;\n      if (recipients.length === 0) {\n        passphrase = await promptSecret(\n          `${SYMBOLS.lock} Enter passphrase for encryption: `,\n        );\n        if (!passphrase) {\n          console.error(c.red(\"Passphrase required (or pass --to <recipient>)\"));\n          process.exit(1);\n        }\n      }\n\n      const entries = listSecrets(opts);\n      let keys: string[] | undefined;\n      if (cmd.keys) {\n        keys = cmd.keys.split(\",\").map((k: string) => k.trim());\n      }\n\n      const secrets: { key: string; value: string; scope?: string }[] = [];\n      for (const entry of entries) {\n        if (keys && !keys.includes(entry.key)) continue;\n        const value = getSecret(entry.key, { ...opts, scope: entry.scope });\n        if (value !== null) {\n          secrets.push({ key: entry.key, value, scope: entry.scope });\n        }\n      }\n\n      if (secrets.length === 0) {\n        console.error(c.red(\"No secrets to pack\"));\n        process.exit(1);\n      }\n\n      const bundle =\n        recipients.length > 0\n          ? teleportPackFor(secrets, recipients)\n          : teleportPack(secrets, passphrase as string);\n      process.stdout.write(bundle);\n      if (process.stdout.isTTY) {\n        const to =\n          recipients.length > 0\n            ? c.dim(` for ${recipients.length} recipient(s)`)\n            : \"\";\n        console.log(\n          `\\n${SYMBOLS.package} ${c.green(\"packed\")} ${secrets.length} secret(s)${to}`,\n        );\n      }\n    });\n\n  tp.command(\"unpack [bundle]\")\n    .description(\"Unpack and import secrets from an encrypted bundle\")\n    .option(\"-g, --global\", \"Import to global scope\")\n    .option(\"-p, --project\", \"Import to project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--dry-run\", \"Show what would be imported without saving\")\n    .option(\"-y, --yes\", \"Overwrite existing secrets without asking\")\n    .action(async (bundle: string | undefined, cmd) => {\n      if (!bundle) {\n        const chunks: Buffer[] = [];\n        for await (const chunk of process.stdin) {\n          chunks.push(chunk);\n        }\n        bundle = Buffer.concat(chunks).toString(\"utf8\").trim();\n      }\n\n      // Peek at the format first: v1 needs a passphrase prompt, v2 needs our\n      // keyring identity and must never prompt.\n      let info: ReturnType<typeof inspectTeleportBundle>;\n      try {\n        info = inspectTeleportBundle(bundle);\n      } catch {\n        console.error(\n          c.red(`${SYMBOLS.cross} Failed to unpack: corrupted bundle`),\n        );\n        process.exit(1);\n      }\n\n      let passphrase: string | undefined;\n      let identity: ReturnType<typeof loadTeleportIdentity> = null;\n      if (info.v === 1) {\n        passphrase = await promptSecret(\n          `${SYMBOLS.lock} Enter passphrase for decryption: `,\n        );\n      } else {\n        try {\n          identity = loadTeleportIdentity();\n        } catch (err) {\n          const msg = err instanceof Error ? err.message : String(err);\n          console.error(c.red(`${SYMBOLS.cross} ${msg}`));\n          process.exit(1);\n        }\n        if (cmd.dryRun) {\n          const mine = identity ? info.recipients.includes(identity.id) : false;\n          console.log(\n            `\\n${SYMBOLS.package} ${c.bold(\"Recipient bundle\")} addressed to ${info.recipients.length} recipient id(s):`,\n          );\n          for (const id of info.recipients) {\n            const marker =\n              identity && id === identity.id ? c.green(\" (you)\") : \"\";\n            console.log(`  ${SYMBOLS.key} ${id}${marker}`);\n          }\n          if (!identity) {\n            console.log(\n              c.dim(\n                `  no local identity — run ${c.bold(\"qring teleport keygen\")} to create one`,\n              ),\n            );\n          } else if (!mine) {\n            console.log(\n              c.dim(`  your id ${identity.id} is not among them; unpack will fail`),\n            );\n          }\n          console.log();\n        }\n        if (!identity) {\n          console.error(\n            c.red(\n              `${SYMBOLS.cross} This bundle is addressed to recipient keys and you have no teleport identity — run ${c.bold(\"qring teleport keygen\")} first`,\n            ),\n          );\n          process.exit(1);\n        }\n      }\n\n      // Only the decrypt itself maps to \"wrong passphrase\" — errors from the\n      // confirm/import steps below must not be swallowed by this catch.\n      let payload: TeleportPayload;\n      try {\n        payload = teleportUnpackAuto(bundle, {\n          passphrase,\n          identity: identity?.privateKey,\n        });\n      } catch (err) {\n        const msg = err instanceof Error ? err.message : String(err);\n        const reason = msg.startsWith(\"ERR_TELEPORT_NOT_A_RECIPIENT\")\n          ? `this bundle is not addressed to your identity (${identity?.id})`\n          : info.v === 1\n            ? \"wrong passphrase or corrupted bundle\"\n            : \"corrupted bundle or mismatched identity\";\n        console.error(c.red(`${SYMBOLS.cross} Failed to unpack: ${reason}`));\n        process.exit(1);\n      }\n\n      if (cmd.dryRun) {\n        console.log(\n          `\\n${SYMBOLS.package} ${c.bold(\"Would import\")} (${payload.secrets.length} secrets):\\n`,\n        );\n        for (const s of payload.secrets) {\n          console.log(\n            `  ${SYMBOLS.key} ${c.bold(s.key)} ${c.dim(`[${s.scope ?? \"global\"}]`)}`,\n          );\n        }\n        return;\n      }\n\n      const opts = buildOpts(cmd);\n\n      const existing = payload.secrets\n        .map((s) => s.key)\n        .filter((k) => hasSecret(k, opts));\n      if (\n        existing.length > 0 &&\n        !(await confirm(\n          `${existing.length} existing secret(s) will be overwritten: ${existing.join(\", \")}. Continue?`,\n          { assumeYes: cmd.yes },\n        ))\n      ) {\n        console.error(c.dim(\"Aborted.\"));\n        process.exitCode = 1;\n        return;\n      }\n\n      for (const s of payload.secrets) {\n        setSecret(s.key, s.value, opts);\n      }\n\n      console.log(\n        `${SYMBOLS.check} ${c.green(\"imported\")} ${payload.secrets.length} secret(s) from teleport bundle`,\n      );\n    });\n}\n","import type { Command } from \"commander\";\nimport type { Scope } from \"../../core/scope.js\";\nimport {\n  getSecret,\n  setSecret,\n  listSecrets,\n  getEnvelope,\n} from \"../../core/keyring.js\";\nimport { readProjectConfig } from \"../../core/collapse.js\";\nimport {\n  validateSecret,\n  rotateWithProvider,\n  ciValidateBatch,\n  registry as providerRegistry,\n} from \"../../core/validate.js\";\nimport {\n  rotationStatus,\n  describeRotation,\n  compareRotationUrgency,\n} from \"../../core/rotation.js\";\nimport { c, SYMBOLS, scopeColor } from \"../../utils/colors.js\";\nimport { wantsJsonOutput, emitJson, safeStr } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\nimport { rotationBadge } from \"./secrets.js\";\n\nexport function registerValidationCommands(program: Command): void {\n  program\n    .command(\"validate [key]\")\n    .description(\"Test if a secret is actually valid with its target service\")\n    .option(\"-g, --global\", \"Global scope only\")\n    .option(\"-p, --project\", \"Project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\n      \"--provider <name>\",\n      \"Force a specific provider (openai, stripe, github, aws, http)\",\n    )\n    .option(\n      \"--all\",\n      \"Validate all secrets that have a detectable provider\",\n    )\n    .option(\n      \"--manifest\",\n      \"Only validate manifest-declared secrets (with --all)\",\n    )\n    .option(\"--list-providers\", \"List all available providers\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (key: string | undefined, cmd) => {\n      if (cmd.listProviders) {\n        if (emitJson(program, cmd, { providers: providerRegistry.listProviders() })) {\n          return;\n        }\n        console.log(\n          c.bold(`\\n  ${SYMBOLS.shield} Available validation providers\\n`),\n        );\n        for (const p of providerRegistry.listProviders()) {\n          const prefixes = p.prefixes?.length\n            ? c.dim(` (${p.prefixes.join(\", \")})`)\n            : \"\";\n          console.log(\n            `  ${c.cyan(p.name.padEnd(10))} ${p.description}${prefixes}`,\n          );\n        }\n        console.log();\n        return;\n      }\n\n      if (!key && !cmd.all) {\n        console.error(c.red(`${SYMBOLS.cross} Provide a key name or use --all`));\n        process.exit(1);\n      }\n\n      const opts = buildOpts(cmd);\n\n      if (cmd.all) {\n        let entries = listSecrets(opts);\n        const projectPath = cmd.projectPath ?? process.cwd();\n\n        if (cmd.manifest) {\n          const config = readProjectConfig(projectPath);\n          if (config?.secrets) {\n            const manifestKeys = new Set(Object.keys(config.secrets));\n            entries = entries.filter((e) => manifestKeys.has(e.key));\n          }\n        }\n\n        const jsonMode = wantsJsonOutput(program, cmd);\n        if (!jsonMode) {\n          console.log(c.bold(`\\n  ${SYMBOLS.shield} Validating secrets\\n`));\n        }\n\n        let validated = 0;\n        let skipped = 0;\n        const jsonResults: Array<{\n          key: string;\n          status: string;\n          provider: string;\n          latencyMs: number;\n          message?: string;\n        }> = [];\n\n        for (const entry of entries) {\n          const value = getSecret(entry.key, { ...opts, scope: entry.scope });\n          if (!value) {\n            skipped++;\n            continue;\n          }\n\n          const provHint = entry.envelope?.meta.provider ?? cmd.provider;\n          const result = await validateSecret(value, { provider: provHint });\n\n          if (result.status === \"unknown\") {\n            skipped++;\n            continue;\n          }\n\n          validated++;\n          if (jsonMode) {\n            jsonResults.push({\n              key: entry.key,\n              status: result.status,\n              provider: result.provider,\n              latencyMs: result.latencyMs,\n              message: result.status !== \"valid\" ? result.message : undefined,\n            });\n            continue;\n          }\n          const icon =\n            result.status === \"valid\"\n              ? c.green(SYMBOLS.check)\n              : result.status === \"invalid\"\n                ? c.red(SYMBOLS.cross)\n                : c.yellow(SYMBOLS.warning);\n          const statusText =\n            result.status === \"valid\"\n              ? c.green(\"valid\")\n              : result.status === \"invalid\"\n                ? c.red(\"invalid\")\n                : c.yellow(\"error\");\n\n          console.log(\n            `  ${icon} ${c.bold(entry.key.padEnd(24))} ${statusText}  ${c.dim(`(${result.provider}, ${result.latencyMs}ms)`)}${result.status !== \"valid\" ? ` ${c.dim(\"— \" + result.message)}` : \"\"}`,\n          );\n        }\n\n        if (jsonMode) {\n          emitJson(program, cmd, { results: jsonResults, validated, skipped });\n          return;\n        }\n\n        console.log(\n          `\\n  ${c.dim(`${validated} validated, ${skipped} skipped (no provider)`)}\\n`,\n        );\n        return;\n      }\n\n      const value = getSecret(key!, opts);\n      if (!value) {\n        console.error(c.red(`${SYMBOLS.cross} Secret \"${key}\" not found`));\n        process.exit(1);\n      }\n\n      const envelope = getEnvelope(key!, opts);\n      const provHint = envelope?.envelope.meta.provider ?? cmd.provider;\n      const result = await validateSecret(value, { provider: provHint });\n\n      if (\n        emitJson(program, cmd, {\n          key,\n          status: result.status,\n          provider: result.provider,\n          latencyMs: result.latencyMs,\n          message: result.message,\n        })\n      ) {\n        return;\n      }\n\n      const icon =\n        result.status === \"valid\"\n          ? c.green(SYMBOLS.check)\n          : result.status === \"invalid\"\n            ? c.red(SYMBOLS.cross)\n            : result.status === \"error\"\n              ? c.yellow(SYMBOLS.warning)\n              : c.dim(\"○\");\n\n      console.log(\n        `\\n  ${icon} ${c.bold(key!)}  ${result.status}  ${c.dim(`(${result.provider}, ${result.latencyMs}ms)`)}`,\n      );\n      if (result.message && result.status !== \"valid\") {\n        console.log(`    ${c.dim(result.message)}`);\n      }\n      console.log();\n    });\n\n  program\n    .command(\"rotate <key>\")\n    .description(\n      \"Attempt issuer-native rotation of a secret via its provider\",\n    )\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--provider <name>\", \"Force a specific provider\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const value = getSecret(key, opts);\n      if (!value) {\n        console.error(c.red(`${SYMBOLS.cross} Secret \"${key}\" not found`));\n        process.exitCode = 1;\n        return;\n      }\n\n      const result = await rotateWithProvider(value, cmd.provider);\n      if (result.rotated && result.newValue) {\n        setSecret(key, result.newValue, {\n          ...opts,\n          scope: opts.scope ?? \"global\",\n        });\n      }\n\n      if (\n        emitJson(program, cmd, {\n          key,\n          rotated: !!(result.rotated && result.newValue),\n          provider: result.provider,\n          message: result.message,\n        })\n      ) {\n        return;\n      }\n\n      if (result.rotated && result.newValue) {\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"Rotated\")} ${c.bold(key)} via ${result.provider}`,\n        );\n        console.log(c.dim(`  ${result.message}`));\n      } else {\n        console.log(c.yellow(`${SYMBOLS.warning} ${result.message}`));\n      }\n    });\n\n  program\n    .command(\"rotate:due\")\n    .description(\n      \"List secrets whose rotation reminder is due soon or overdue (--all: every scheduled secret)\",\n    )\n    .option(\"-g, --global\", \"Global scope only\")\n    .option(\"-p, --project\", \"Project scope only\")\n    .option(\"--team <id>\", \"Team scope only\")\n    .option(\"--org <id>\", \"Org scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--all\", \"Include scheduled secrets that are not yet due\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      const entries = listSecrets(opts);\n\n      const scheduled = entries\n        .filter((e) => e.envelope)\n        .map((e) => ({\n          key: safeStr(e.key),\n          scope: safeStr(e.scope),\n          rotation: rotationStatus(e.envelope!.meta),\n        }))\n        .filter((e) => e.rotation.state !== \"unscheduled\")\n        .sort((a, b) => compareRotationUrgency(a.rotation, b.rotation));\n\n      const due = scheduled.filter(\n        (e) => e.rotation.state === \"due-soon\" || e.rotation.state === \"overdue\",\n      );\n      const shown = cmd.all ? scheduled : due;\n\n      if (\n        emitJson(program, cmd, {\n          entries: shown,\n          dueCount: due.length,\n          scheduledCount: scheduled.length,\n        })\n      ) {\n        return;\n      }\n\n      if (shown.length === 0) {\n        console.log(\n          c.dim(\n            scheduled.length === 0\n              ? \"No secrets have a rotation reminder (set one with: qring set KEY --rotate-every 90)\"\n              : `Nothing due — ${scheduled.length} scheduled secret(s) are on track`,\n          ),\n        );\n        return;\n      }\n\n      console.log(\n        c.bold(\n          `\\n  ${SYMBOLS.shield} Rotation reminders (${due.length} due of ${scheduled.length} scheduled)\\n`,\n        ),\n      );\n      const maxKeyLen = Math.max(...shown.map((e) => e.key.length));\n      for (const e of shown) {\n        const r = e.rotation;\n        console.log(\n          `  ${c.dim(\"[\")}${scopeColor(e.scope as Scope)}${c.dim(\"]\")}  ${c.bold(e.key.padEnd(maxKeyLen))}  ${rotationBadge(r.state)}  ${describeRotation(r)}  ${c.dim(`(last rotated ${r.ageDays}d ago, every ${r.rotateEveryDays}d)`)}`,\n        );\n      }\n      console.log();\n    });\n\n  program\n    .command(\"ci:validate\")\n    .description(\n      \"CI-oriented batch validation of all secrets (exit code 1 on failure)\",\n    )\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (cmd) => {\n      const opts = buildOpts(cmd);\n      const entries = listSecrets(opts);\n\n      const secrets = entries\n        .map((e) => {\n          const val = getSecret(e.key, {\n            ...opts,\n            scope: e.scope,\n            silent: true,\n          });\n          if (!val) return null;\n          const provider = e.envelope?.meta.provider;\n          const validationUrl = e.envelope?.meta.validationUrl;\n          return { key: e.key, value: val, provider, validationUrl };\n        })\n        .filter((s): s is NonNullable<typeof s> => s !== null);\n\n      if (secrets.length === 0) {\n        console.log(c.dim(\"No secrets to validate\"));\n        return;\n      }\n\n      const report = await ciValidateBatch(secrets);\n\n      if (wantsJsonOutput(program, cmd)) {\n        console.log(JSON.stringify(report, null, 2));\n      } else {\n        console.log(\n          c.bold(`\\n  CI Secret Validation: ${report.results.length} secrets\\n`),\n        );\n        for (const r of report.results) {\n          const icon = r.validation.valid ? SYMBOLS.check : SYMBOLS.cross;\n          const color = r.validation.valid ? c.green : c.red;\n          console.log(\n            `  ${icon} ${color(r.key)} [${r.validation.provider}] ${r.validation.message}`,\n          );\n          if (r.requiresRotation) console.log(c.dim(`    → rotation required`));\n        }\n        console.log();\n\n        if (!report.allValid) {\n          console.log(c.red(`  ${report.failCount} secret(s) failed validation`));\n          process.exitCode = 1;\n        } else {\n          console.log(c.green(`  All secrets valid`));\n        }\n      }\n    });\n}\n","/**\n * Secure Execution & Auto-Redaction\n *\n * Runs child processes with project secrets injected into the environment.\n * Captures stdout/stderr and redacts any known secret values before they\n * are printed to the terminal or returned to the MCP agent.\n *\n * Exec profiles restrict which commands may be run, with optional\n * network and timeout controls.\n */\n\nimport { spawn } from \"node:child_process\";\nimport { StringDecoder } from \"node:string_decoder\";\nimport { Transform } from \"node:stream\";\nimport { listSecrets, getSecret, type KeyringOptions } from \"./keyring.js\";\nimport { checkDecay } from \"./envelope.js\";\nimport { checkExecPolicy, getExecMaxRuntime } from \"./policy.js\";\n\nexport interface ExecProfile {\n  name: string;\n  allowCommands?: string[];\n  denyCommands?: string[];\n  maxRuntimeSeconds?: number;\n  allowNetwork?: boolean;\n  stripEnvVars?: string[];\n}\n\nconst BUILTIN_PROFILES: Record<string, ExecProfile> = {\n  unrestricted: { name: \"unrestricted\" },\n  restricted: {\n    name: \"restricted\",\n    denyCommands: [\n      // Network tools.\n      \"curl\", \"wget\", \"ssh\", \"scp\", \"nc\", \"netcat\", \"ncat\",\n      // Interpreters and shells: given the secret env vars, `python -c`,\n      // `node -e`, `bash -c`, etc. can perform arbitrary network I/O and\n      // exfiltrate them, defeating allowNetwork. Denied by default in\n      // `restricted`; to run them with secrets use a custom profile in\n      // .q-ring.json, or the `ci` / `unrestricted` profile.\n      \"python\", \"python2\", \"python3\", \"node\", \"deno\", \"bun\",\n      \"perl\", \"ruby\", \"php\", \"sh\", \"bash\", \"zsh\",\n    ],\n    maxRuntimeSeconds: 30,\n    allowNetwork: false,\n    stripEnvVars: [\"HTTP_PROXY\", \"HTTPS_PROXY\", \"ALL_PROXY\"],\n  },\n  ci: {\n    name: \"ci\",\n    maxRuntimeSeconds: 300,\n    allowNetwork: true,\n    denyCommands: [\"rm -rf /\", \"mkfs\", \"dd if=\"],\n  },\n};\n\nexport function getProfile(name?: string): ExecProfile {\n  if (!name) return BUILTIN_PROFILES.unrestricted;\n  return BUILTIN_PROFILES[name] ?? { name };\n}\n\nexport function listProfiles(): ExecProfile[] {\n  return Object.values(BUILTIN_PROFILES);\n}\n\nexport interface ExecOptions extends KeyringOptions {\n  tags?: string[];\n  keys?: string[];\n  command: string;\n  args: string[];\n  /** If true, return output as string instead of piping to process.stdout */\n  captureOutput?: boolean;\n  /** Exec profile name (unrestricted, restricted, ci) */\n  profile?: string;\n}\n\nexport interface ExecResult {\n  code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/**\n * Best-effort output redaction: replaces verbatim occurrences of known secret\n * values (>5 chars) in a child process's stdout/stderr. This is a safety net,\n * NOT a guarantee — it cannot catch secrets that the child has transformed\n * (base64/hex/URL-encoded, split across writes beyond the tail window, etc.).\n */\nexport class RedactionTransform extends Transform {\n  private patterns: { value: string; replacement: string }[] = [];\n  private tail: string = \"\";\n  private maxLen: number = 0;\n  // Decodes UTF-8 across chunk boundaries: a multi-byte character split between\n  // two Buffer chunks would otherwise be corrupted to U+FFFD by chunk.toString()\n  // BEFORE matching runs, letting a multi-byte secret slip through unredacted.\n  // StringDecoder buffers the incomplete trailing bytes until the rest arrives.\n  private decoder = new StringDecoder(\"utf8\");\n\n  constructor(secretsToRedact: string[]) {\n    super();\n    // Only redact secrets > 5 chars to avoid destroying output\n    const validSecrets = secretsToRedact.filter((s) => s.length > 5);\n    // Sort by length descending to match longest first\n    validSecrets.sort((a, b) => b.length - a.length);\n\n    this.patterns = validSecrets.map((s) => ({\n      value: s,\n      replacement: \"[QRING:REDACTED]\",\n    }));\n\n    if (validSecrets.length > 0) {\n      this.maxLen = validSecrets[0].length;\n    }\n  }\n\n  _transform(chunk: Buffer | string, _encoding: string, callback: () => void) {\n    if (this.patterns.length === 0) {\n      this.push(chunk);\n      return callback();\n    }\n\n    const decoded =\n      typeof chunk === \"string\" ? chunk : this.decoder.write(chunk);\n    const text = this.tail + decoded;\n    let redacted = text;\n\n    for (const { value, replacement } of this.patterns) {\n      redacted = redacted.split(value).join(replacement);\n    }\n\n    if (redacted.length < this.maxLen) {\n      this.tail = redacted;\n      return callback();\n    }\n\n    const outputLen = redacted.length - this.maxLen + 1;\n    const output = redacted.slice(0, outputLen);\n    this.tail = redacted.slice(outputLen);\n\n    this.push(output);\n    callback();\n  }\n\n  _flush(callback: () => void) {\n    // Flush any bytes the decoder is still holding (an incomplete sequence at\n    // end-of-stream) along with the retained tail, then redact once more.\n    let final = this.tail + this.decoder.end();\n    if (final) {\n      for (const { value, replacement } of this.patterns) {\n        final = final.split(value).join(replacement);\n      }\n      this.push(final);\n    }\n    callback();\n  }\n}\n\n/**\n * Enforce the exec policy and profile allow/deny lists for a command.\n * Shared by `qring exec` (scope-wide injection) and `qring run` (declared-only\n * injection). Throws on denial.\n */\nexport function enforceExecPolicy(\n  profile: ExecProfile,\n  command: string,\n  args: string[],\n  projectPath?: string,\n): void {\n  const fullCommand = [command, ...args].join(\" \");\n\n  const policyDecision = checkExecPolicy(fullCommand, projectPath);\n  if (!policyDecision.allowed) {\n    throw new Error(`Policy Denied: ${policyDecision.reason}`);\n  }\n\n  if (profile.denyCommands) {\n    const denied = profile.denyCommands.find((d) => {\n      const pattern = new RegExp(`(^|[\\\\s/])${d.replace(/[.*+?^${}()|[\\]\\\\]/g, \"\\\\$&\")}(\\\\s|$)`, \"i\");\n      return pattern.test(fullCommand);\n    });\n    if (denied) {\n      throw new Error(`Exec profile \"${profile.name}\" denies command containing \"${denied}\"`);\n    }\n  }\n  if (profile.allowCommands) {\n    const allowed = profile.allowCommands.some((a) => fullCommand.startsWith(a));\n    if (!allowed) {\n      throw new Error(`Exec profile \"${profile.name}\" does not allow command \"${command}\"`);\n    }\n  }\n}\n\nexport async function execCommand(opts: ExecOptions): Promise<ExecResult> {\n  const profile = getProfile(opts.profile);\n  enforceExecPolicy(profile, opts.command, opts.args, opts.projectPath);\n\n  const envMap: Record<string, string> = {};\n  for (const [k, v] of Object.entries(process.env)) {\n    if (v !== undefined) envMap[k] = v;\n  }\n\n  if (profile.stripEnvVars) {\n    for (const key of profile.stripEnvVars) {\n      delete envMap[key];\n    }\n  }\n\n  const secretsToRedact = new Set<string>();\n\n  let entries = listSecrets({\n    scope: opts.scope,\n    projectPath: opts.projectPath,\n    source: opts.source ?? \"cli\",\n    silent: true, // list silently\n  });\n\n  if (opts.keys?.length) {\n    const keySet = new Set(opts.keys);\n    entries = entries.filter((e) => keySet.has(e.key));\n  }\n\n  if (opts.tags?.length) {\n    entries = entries.filter((e) =>\n      opts.tags!.some((t) => e.envelope?.meta.tags?.includes(t)),\n    );\n  }\n\n  for (const entry of entries) {\n    if (entry.envelope) {\n      const decay = checkDecay(entry.envelope);\n      if (decay.isExpired) continue;\n    }\n\n    const val = getSecret(entry.key, {\n      scope: entry.scope,\n      projectPath: opts.projectPath,\n      env: opts.env,\n      source: opts.source ?? \"cli\",\n      silent: false, // Log access for execution\n    });\n\n    if (val !== null) {\n      envMap[entry.key] = val;\n      if (val.length > 5) {\n        secretsToRedact.add(val);\n      }\n    }\n  }\n\n  return spawnRedacted({\n    profile,\n    command: opts.command,\n    args: opts.args,\n    envMap,\n    secretsToRedact: [...secretsToRedact],\n    captureOutput: opts.captureOutput,\n    projectPath: opts.projectPath,\n  });\n}\n\nexport interface SpawnRedactedOptions {\n  profile: ExecProfile;\n  command: string;\n  args: string[];\n  /** Complete child environment (caller composes inheritance + injection). */\n  envMap: Record<string, string>;\n  /** Values to redact from the child's stdout/stderr. */\n  secretsToRedact: string[];\n  captureOutput?: boolean;\n  /** Used only to resolve the policy-configured max runtime. */\n  projectPath?: string;\n}\n\n/**\n * Spawn a child process with a fully-composed environment, enforcing the\n * profile's network restriction and runtime limit, and redacting known\n * secret values from its output.\n */\nexport function spawnRedacted(opts: SpawnRedactedOptions): Promise<ExecResult> {\n  const { profile, secretsToRedact, envMap } = opts;\n  const maxRuntime = profile.maxRuntimeSeconds ?? getExecMaxRuntime(opts.projectPath);\n\n  return new Promise((resolve, reject) => {\n    // Enforce network restrictions for profiles that disallow network access.\n    const networkTools = new Set([\n      \"curl\", \"wget\", \"ping\", \"nc\", \"netcat\", \"ssh\", \"telnet\", \"ftp\", \"dig\", \"nslookup\",\n    ]);\n\n    // Compare on the command basename so absolute paths like /usr/bin/curl are\n    // still caught. (Interpreter-based egress — python -c, node -e — is out of\n    // scope here; this is best-effort, not a hard sandbox.)\n    const commandBase = opts.command.split(/[\\\\/]/).pop() ?? opts.command;\n\n    if (profile.allowNetwork === false && networkTools.has(commandBase)) {\n      const msg = `[QRING] Execution blocked: network access is disabled for profile \"${profile.name}\", command \"${opts.command}\" is considered network-related`;\n      if (opts.captureOutput) {\n        return resolve({ code: 126, stdout: \"\", stderr: msg });\n      }\n      process.stderr.write(msg + \"\\n\");\n      return resolve({ code: 126, stdout: \"\", stderr: \"\" });\n    }\n\n    const child = spawn(opts.command, opts.args, {\n      env: envMap,\n      stdio: [\"inherit\", \"pipe\", \"pipe\"],\n      shell: false,\n    });\n\n    let timedOut = false;\n    let timer: ReturnType<typeof setTimeout> | undefined;\n\n    if (maxRuntime) {\n      timer = setTimeout(() => {\n        timedOut = true;\n        child.kill(\"SIGKILL\");\n      }, maxRuntime * 1000);\n    }\n\n    const stdoutRedact = new RedactionTransform([...secretsToRedact]);\n    const stderrRedact = new RedactionTransform([...secretsToRedact]);\n\n    if (child.stdout) child.stdout.pipe(stdoutRedact);\n    if (child.stderr) child.stderr.pipe(stderrRedact);\n\n    let stdoutStr = \"\";\n    let stderrStr = \"\";\n\n    if (opts.captureOutput) {\n      stdoutRedact.on(\"data\", (d) => (stdoutStr += d.toString()));\n      stderrRedact.on(\"data\", (d) => (stderrStr += d.toString()));\n    } else {\n      stdoutRedact.pipe(process.stdout);\n      stderrRedact.pipe(process.stderr);\n    }\n\n    child.on(\"close\", (code) => {\n      if (timer) clearTimeout(timer);\n      if (timedOut) {\n        resolve({ code: 124, stdout: stdoutStr, stderr: stderrStr + `\\n[QRING] Process killed: exceeded ${maxRuntime}s runtime limit` });\n      } else {\n        resolve({ code: code ?? 0, stdout: stdoutStr, stderr: stderrStr });\n      }\n    });\n\n    child.on(\"error\", (err) => {\n      if (timer) clearTimeout(timer);\n      reject(err);\n    });\n  });\n}\n","/**\n * Codebase Secret Scanner\n *\n * Scans a directory for hardcoded secrets using regex heuristics\n * and Shannon entropy analysis. Useful for migrating legacy codebases\n * into q-ring.\n */\n\nimport { readFileSync, readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { findSecretsInLine, calculateEntropy } from \"./secrets-detect.js\";\n\nexport interface ScanResult {\n  file: string;\n  line: number;\n  keyName: string;\n  match: string;\n  context: string;\n  entropy: number;\n}\n\nconst IGNORE_DIRS = new Set([\n  \"node_modules\",\n  \".git\",\n  \".next\",\n  \"dist\",\n  \"build\",\n  \"coverage\",\n  \".cursor\",\n  \"venv\",\n  \"__pycache__\",\n]);\n\nconst IGNORE_EXTS = new Set([\n  \".png\", \".jpg\", \".jpeg\", \".gif\", \".ico\", \".svg\", \".webp\",\n  \".mp4\", \".mp3\", \".wav\", \".ogg\",\n  \".pdf\", \".zip\", \".tar\", \".gz\", \".xz\",\n  \".ttf\", \".woff\", \".woff2\", \".eot\",\n  \".exe\", \".dll\", \".so\", \".dylib\",\n  \".lock\",\n]);\n\nexport function scanCodebase(dir: string): ScanResult[] {\n  const results: ScanResult[] = [];\n\n  function walk(currentDir: string) {\n    let entries;\n    try {\n      entries = readdirSync(currentDir);\n    } catch {\n      return;\n    }\n\n    for (const entry of entries) {\n      if (IGNORE_DIRS.has(entry)) continue;\n\n      const fullPath = join(currentDir, entry);\n      let stat;\n      try {\n        stat = statSync(fullPath);\n      } catch {\n        continue;\n      }\n\n      if (stat.isDirectory()) {\n        walk(fullPath);\n      } else if (stat.isFile()) {\n        const ext = fullPath.slice(fullPath.lastIndexOf(\".\")).toLowerCase();\n        if (IGNORE_EXTS.has(ext) || entry.endsWith(\".lock\")) continue;\n\n        let content;\n        try {\n          content = readFileSync(fullPath, \"utf8\");\n        } catch {\n          continue;\n        }\n\n        if (content.includes(\"\\0\")) continue;\n\n        const lines = content.split(/\\r?\\n/);\n        for (let i = 0; i < lines.length; i++) {\n          const line = lines[i];\n          const matches = findSecretsInLine(line);\n          for (const m of matches) {\n            const entropy = calculateEntropy(m.value);\n            const relPath = fullPath.startsWith(dir)\n              ? fullPath.slice(dir.length).replace(/^[/\\\\]+/, \"\")\n              : fullPath;\n\n            results.push({\n              file: relPath || fullPath,\n              line: i + 1,\n              keyName: m.varName,\n              match: m.value,\n              context: line.trim(),\n              entropy: parseFloat(entropy.toFixed(2)),\n            });\n          }\n        }\n      }\n    }\n  }\n\n  walk(dir);\n  return results;\n}\n","/**\n * Shared heuristics for hardcoded-secret detection (scan + lint).\n * Both `scan.ts` and `linter.ts` use this module so rules stay aligned.\n */\n\n/** Same pattern for assignment-style secrets in source lines. */\nexport const SECRET_ASSIGNMENT_PATTERN =\n  /((?:api_?key|secret|token|password|auth|credential|access_?key)[a-z0-9_]*)\\s*[:=]\\s*(['\"])([^'\"]+)\\2/gi;\n\nexport interface SecretMatchInLine {\n  varName: string;\n  value: string;\n  quote: string;\n}\n\nexport function calculateEntropy(str: string): number {\n  if (!str) return 0;\n  const len = str.length;\n  const frequencies = new Map<string, number>();\n\n  for (let i = 0; i < len; i++) {\n    const char = str[i];\n    frequencies.set(char, (frequencies.get(char) || 0) + 1);\n  }\n\n  let entropy = 0;\n  for (const count of frequencies.values()) {\n    const p = count / len;\n    entropy -= p * Math.log2(p);\n  }\n\n  return entropy;\n}\n\nexport function isPlaceholderValue(value: string): boolean {\n  const lv = value.toLowerCase();\n  return (\n    lv.includes(\"example\") ||\n    lv.includes(\"your_\") ||\n    lv.includes(\"placeholder\") ||\n    lv.includes(\"replace_me\") ||\n    lv.includes(\"xxx\")\n  );\n}\n\nfunction passesSecretHeuristic(value: string, entropy: number): boolean {\n  return entropy > 3.5 || value.startsWith(\"sk-\") || value.startsWith(\"ghp_\");\n}\n\n/**\n * Find all secret-like assignments on one line (same behavior as the linter:\n * every match on the line is considered).\n */\nexport function findSecretsInLine(line: string): SecretMatchInLine[] {\n  if (line.length > 500) return [];\n\n  const out: SecretMatchInLine[] = [];\n  SECRET_ASSIGNMENT_PATTERN.lastIndex = 0;\n  let match: RegExpExecArray | null;\n  while ((match = SECRET_ASSIGNMENT_PATTERN.exec(line)) !== null) {\n    const varName = match[1];\n    const quote = match[2];\n    const value = match[3];\n\n    if (value.length < 8) continue;\n    if (isPlaceholderValue(value)) continue;\n\n    const entropy = calculateEntropy(value);\n    if (!passesSecretHeuristic(value, entropy)) continue;\n\n    out.push({ varName, value, quote });\n  }\n  return out;\n}\n","/**\n * Secret-Aware Linter\n *\n * Scans individual files (or staged git content) for hardcoded secrets and\n * optionally rewrites them with `process.env.KEY` references, storing the\n * discovered values in q-ring.\n */\n\nimport { readFileSync, writeFileSync, existsSync } from \"node:fs\";\nimport { basename, extname } from \"node:path\";\nimport { type ScanResult } from \"./scan.js\";\nimport { setSecret, hasSecret } from \"./keyring.js\";\nimport { findSecretsInLine, calculateEntropy } from \"./secrets-detect.js\";\n\nexport interface LintResult extends ScanResult {\n  fixed: boolean;\n}\n\nexport interface LintOptions {\n  fix?: boolean;\n  scope?: import(\"./scope.js\").Scope;\n  projectPath?: string;\n}\n\nconst ENV_REF_BY_EXT: Record<string, (key: string) => string> = {\n  \".ts\": (k) => `process.env.${k}`,\n  \".tsx\": (k) => `process.env.${k}`,\n  \".js\": (k) => `process.env.${k}`,\n  \".jsx\": (k) => `process.env.${k}`,\n  \".mjs\": (k) => `process.env.${k}`,\n  \".cjs\": (k) => `process.env.${k}`,\n  \".py\": (k) => `os.environ[\"${k}\"]`,\n  \".rb\": (k) => `ENV[\"${k}\"]`,\n  \".go\": (k) => `os.Getenv(\"${k}\")`,\n  \".rs\": (k) => `std::env::var(\"${k}\")`,\n  \".java\": (k) => `System.getenv(\"${k}\")`,\n  \".kt\": (k) => `System.getenv(\"${k}\")`,\n  \".cs\": (k) => `Environment.GetEnvironmentVariable(\"${k}\")`,\n  \".php\": (k) => `getenv('${k}')`,\n  \".sh\": (k) => `\\${${k}}`,\n  \".bash\": (k) => `\\${${k}}`,\n};\n\nfunction getEnvRef(filePath: string, keyName: string): string {\n  const ext = extname(filePath).toLowerCase();\n  const formatter = ENV_REF_BY_EXT[ext];\n  return formatter ? formatter(keyName) : `process.env.${keyName}`;\n}\n\n/**\n * Lint specific files for hardcoded secrets.\n */\nexport function lintFiles(\n  files: string[],\n  opts: LintOptions = {},\n): LintResult[] {\n  const results: LintResult[] = [];\n\n  for (const file of files) {\n    if (!existsSync(file)) continue;\n\n    let content: string;\n    try {\n      content = readFileSync(file, \"utf8\");\n    } catch {\n      continue;\n    }\n\n    if (content.includes(\"\\0\")) continue;\n\n    const lines = content.split(/\\r?\\n/);\n    const fixes: Array<{ line: number; original: string; replacement: string; keyName: string; value: string }> = [];\n\n    for (let i = 0; i < lines.length; i++) {\n      const line = lines[i];\n      const matches = findSecretsInLine(line);\n\n      for (const m of matches) {\n        const varNameUpper = m.varName.toUpperCase();\n        const entropy = calculateEntropy(m.value);\n        const shouldFix = opts.fix === true;\n\n        if (shouldFix) {\n          const envRef = getEnvRef(file, varNameUpper);\n          fixes.push({\n            line: i,\n            original: `${m.quote}${m.value}${m.quote}`,\n            replacement: envRef,\n            keyName: varNameUpper,\n            value: m.value,\n          });\n        }\n\n        results.push({\n          file,\n          line: i + 1,\n          keyName: varNameUpper,\n          match: m.value,\n          context: line.trim(),\n          entropy: parseFloat(entropy.toFixed(2)),\n          fixed: shouldFix,\n        });\n      }\n    }\n\n    if (opts.fix && fixes.length > 0) {\n      const fixLines = content.split(/\\r?\\n/);\n      for (const fix of fixes.reverse()) {\n        const lineIdx = fix.line;\n        if (lineIdx >= 0 && lineIdx < fixLines.length) {\n          fixLines[lineIdx] = fixLines[lineIdx].replace(fix.original, fix.replacement);\n        }\n\n        if (!hasSecret(fix.keyName, { scope: opts.scope, projectPath: opts.projectPath })) {\n          setSecret(fix.keyName, fix.value, {\n            scope: opts.scope ?? \"global\",\n            projectPath: opts.projectPath,\n            source: \"cli\",\n            description: `Auto-imported from ${basename(file)}:${fix.line + 1}`,\n          });\n        }\n      }\n\n      writeFileSync(file, fixLines.join(\"\\n\"), \"utf8\");\n    }\n  }\n\n  return results;\n}\n","import type { Command } from \"commander\";\nimport { execCommand } from \"../../core/exec.js\";\nimport { scanCodebase } from \"../../core/scan.js\";\nimport { lintFiles } from \"../../core/linter.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson, wantsJsonOutput } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerToolingCommands(program: Command): void {\n  program\n    .command(\"exec <command...>\")\n    .description(\n      \"Run a command with secrets injected into its environment (output auto-redacted)\",\n    )\n    .option(\"-g, --global\", \"Inject global scope secrets only\")\n    .option(\"-p, --project\", \"Inject project scope secrets only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Environment context\")\n    .option(\"-k, --keys <keys>\", \"Comma-separated key names to inject\")\n    .option(\"-t, --tags <tags>\", \"Comma-separated tags to filter by\")\n    .option(\n      \"--profile <name>\",\n      \"Exec profile: unrestricted, restricted, ci\",\n    )\n    .action(async (commandArgs: string[], cmd) => {\n      const opts = buildOpts(cmd);\n      const command = commandArgs[0];\n      const args = commandArgs.slice(1);\n\n      try {\n        const { code } = await execCommand({\n          ...opts,\n          command,\n          args,\n          keys: cmd.keys?.split(\",\").map((k: string) => k.trim()),\n          tags: cmd.tags?.split(\",\").map((t: string) => t.trim()),\n          profile: cmd.profile,\n        });\n        process.exit(code);\n      } catch (err) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Exec failed: ${err instanceof Error ? err.message : String(err)}`,\n          ),\n        );\n        process.exit(1);\n      }\n    });\n\n  program\n    .command(\"scan [dir]\")\n    .description(\"Scan a codebase for hardcoded secrets\")\n    .option(\n      \"--fix\",\n      \"Auto-replace hardcoded secrets with process.env references and store in q-ring\",\n    )\n    .option(\"-g, --global\", \"Store fixed secrets in global scope\")\n    .option(\"-p, --project\", \"Store fixed secrets in project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((dir: string | undefined, cmd) => {\n      const targetDir = dir ?? process.cwd();\n      const fixMode = cmd.fix === true;\n      const jsonMode = wantsJsonOutput(program, cmd);\n      if (!jsonMode) {\n        console.log(\n          `\\n  ${SYMBOLS.eye} Scanning ${c.bold(targetDir)} for secrets...${fixMode ? c.yellow(\" [--fix mode]\") : \"\"}\\n`,\n        );\n      }\n\n      const results = scanCodebase(targetDir);\n\n      if (jsonMode && !fixMode) {\n        emitJson(program, cmd, { dir: targetDir, findings: results });\n        if (results.length > 0) process.exitCode = 1;\n        return;\n      }\n\n      if (results.length === 0) {\n        console.log(\n          `  ${c.green(SYMBOLS.check)} No hardcoded secrets found. Awesome!\\n`,\n        );\n        return;\n      }\n\n      if (fixMode) {\n        const fileSet = new Set(\n          results.map((r) =>\n            r.file.startsWith(\"/\") ? r.file : `${targetDir}/${r.file}`,\n          ),\n        );\n        const opts = buildOpts(cmd);\n        const lintResults = lintFiles([...fileSet], {\n          fix: true,\n          scope: opts.scope,\n          projectPath: opts.projectPath,\n        });\n        const fixedCount = lintResults.filter((r) => r.fixed).length;\n        if (jsonMode) {\n          emitJson(program, cmd, {\n            dir: targetDir,\n            findings: results,\n            fixed: fixedCount,\n          });\n          return;\n        }\n        console.log(\n          `  ${c.green(SYMBOLS.check)} Fixed ${fixedCount} secrets — replaced with process.env references and stored in q-ring.\\n`,\n        );\n        return;\n      }\n\n      for (const res of results) {\n        console.log(`  ${c.red(SYMBOLS.cross)} ${c.bold(res.file)}:${res.line}`);\n        console.log(`    ${c.dim(\"Key:\")}     ${c.cyan(res.keyName)}`);\n        console.log(\n          `    ${c.dim(\"Entropy:\")} ${res.entropy > 4 ? c.red(res.entropy.toString()) : c.yellow(res.entropy.toString())}`,\n        );\n        console.log(`    ${c.dim(\"Context:\")} ${res.context}`);\n        console.log();\n      }\n\n      console.log(\n        `  ${c.red(`Found ${results.length} potential secrets.`)} Use ${c.bold(\"qring scan --fix\")} to auto-migrate them.\\n`,\n      );\n    });\n\n  program\n    .command(\"lint <files...>\")\n    .description(\n      \"Lint specific files for hardcoded secrets (with optional auto-fix)\",\n    )\n    .option(\n      \"--fix\",\n      \"Replace hardcoded secrets with process.env references and store in q-ring\",\n    )\n    .option(\"-g, --global\", \"Store fixed secrets in global scope\")\n    .option(\"-p, --project\", \"Store fixed secrets in project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((files: string[], cmd) => {\n      const opts = buildOpts(cmd);\n      const results = lintFiles(files, {\n        fix: cmd.fix,\n        scope: opts.scope,\n        projectPath: opts.projectPath,\n      });\n\n      if (emitJson(program, cmd, { files, findings: results })) {\n        if (results.some((r) => !r.fixed)) process.exitCode = 1;\n        return;\n      }\n\n      if (results.length === 0) {\n        console.log(\n          `\\n  ${c.green(SYMBOLS.check)} No hardcoded secrets found in ${files.length} file(s).\\n`,\n        );\n        return;\n      }\n\n      for (const res of results) {\n        const status = res.fixed ? c.green(\"fixed\") : c.red(\"found\");\n        console.log(\n          `  ${res.fixed ? c.green(SYMBOLS.check) : c.red(SYMBOLS.cross)} ${c.bold(res.file)}:${res.line} [${status}]`,\n        );\n        console.log(`    ${c.dim(\"Key:\")}     ${c.cyan(res.keyName)}`);\n        console.log(\n          `    ${c.dim(\"Entropy:\")} ${res.entropy > 4 ? c.red(res.entropy.toString()) : c.yellow(res.entropy.toString())}`,\n        );\n        console.log();\n      }\n\n      const fixedCount = results.filter((r) => r.fixed).length;\n      if (cmd.fix && fixedCount > 0) {\n        console.log(\n          `  ${c.green(`Fixed ${fixedCount} secret(s)`)} — replaced with env references and stored in q-ring.\\n`,\n        );\n      } else {\n        console.log(\n          `  ${c.red(`Found ${results.length} potential secret(s).`)} Use ${c.bold(\"--fix\")} to auto-migrate.\\n`,\n        );\n      }\n    });\n\n  program\n    .command(\"status\")\n    .description(\"Launch the quantum status dashboard in your browser\")\n    .option(\"--port <port>\", \"Port to serve on\", \"9876\")\n    .option(\"--no-open\", \"Don't auto-open the browser\")\n    .action(async (cmd) => {\n      const { startDashboardServer } = await import(\"../../core/dashboard.js\");\n      const { exec } = await import(\"node:child_process\");\n      const { platform } = await import(\"node:os\");\n\n      const port = Number(cmd.port);\n      const { close, url } = startDashboardServer({ port });\n\n      console.log(\n        `\\n  ${SYMBOLS.zap} ${c.bold(\"q-ring quantum status dashboard\")}\\n`,\n      );\n      console.log(`  ${c.cyan(url)}\\n`);\n      console.log(c.dim(\"  Press Ctrl+C to stop\\n\"));\n\n      if (cmd.open !== false) {\n        const openCmd =\n          platform() === \"darwin\"\n            ? \"open\"\n            : platform() === \"win32\"\n              ? \"start\"\n              : \"xdg-open\";\n        exec(`${openCmd} ${url}`);\n      }\n\n      const shutdown = () => {\n        console.log(`\\n${c.dim(\"  dashboard stopped\")}`);\n        close();\n        process.exit(0);\n      };\n      process.on(\"SIGINT\", shutdown);\n      process.on(\"SIGTERM\", shutdown);\n\n      await new Promise(() => {});\n    });\n}\n","import type { Command } from \"commander\";\nimport { listSecrets } from \"../../core/keyring.js\";\nimport { queryAudit, detectAnomalies, verifyAuditChain, exportAudit } from \"../../core/observer.js\";\nimport { listAgentSessions } from \"../../core/sessions.js\";\nimport { writeFileSync } from \"node:fs\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\n\n/** `--since` accepts an ISO date or a duration such as 30m, 24h, 7d. */\nexport function parseSince(value: string): string {\n  const m = value.trim().match(/^(\\d+)\\s*([mhd])$/i);\n  if (m) {\n    const unit = { m: 60, h: 3600, d: 86400 }[m[2].toLowerCase() as \"m\" | \"h\" | \"d\"];\n    return new Date(Date.now() - Number(m[1]) * unit * 1000).toISOString();\n  }\n  const date = new Date(value);\n  if (Number.isNaN(date.getTime())) {\n    throw new Error(`--since: \"${value}\" is not an ISO date or a duration like 24h / 7d`);\n  }\n  return date.toISOString();\n}\n\nfunction fmtSeconds(seconds: number): string {\n  if (seconds < 60) return `${seconds}s`;\n  if (seconds < 3600) return `${Math.floor(seconds / 60)}m`;\n  if (seconds < 86400) return `${Math.floor(seconds / 3600)}h`;\n  return `${Math.floor(seconds / 86400)}d`;\n}\n\nexport function registerAuditCommands(program: Command): void {\n  program\n    .command(\"audit\")\n    .description(\"View the audit log (observer effect)\")\n    .option(\"-k, --key <key>\", \"Filter by key\")\n    .option(\"-a, --action <action>\", \"Filter by action (read, write, delete, etc.)\")\n    .option(\"--agent <label>\", \"Filter by agent label (clientInfo name@version)\")\n    .option(\"-n, --limit <n>\", \"Number of events to show\", parseInt, 20)\n    .option(\"--anomalies\", \"Detect access anomalies\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      if (cmd.anomalies) {\n        const anomalies = detectAnomalies(cmd.key);\n        if (emitJson(program, cmd, { anomalies })) return;\n        if (anomalies.length === 0) {\n          console.log(`${SYMBOLS.shield} ${c.green(\"No anomalies detected\")}`);\n          return;\n        }\n\n        console.log(\n          `\\n${SYMBOLS.warning} ${c.bold(c.yellow(`${anomalies.length} anomaly/anomalies detected`))}\\n`,\n        );\n        for (const a of anomalies) {\n          console.log(`  ${c.yellow(a.type)} ${a.description}`);\n        }\n        console.log();\n        return;\n      }\n\n      const events = queryAudit({\n        key: cmd.key,\n        action: cmd.action,\n        agent: cmd.agent,\n        limit: cmd.limit,\n      });\n\n      if (emitJson(program, cmd, { events })) return;\n\n      if (events.length === 0) {\n        console.log(c.dim(\"No audit events found\"));\n        return;\n      }\n\n      console.log(c.bold(`\\n  ${SYMBOLS.eye} Audit log (${events.length} events)\\n`));\n\n      for (const event of events) {\n        const ts = new Date(event.timestamp).toLocaleString();\n        const actionColor =\n          event.action === \"read\"\n            ? c.blue\n            : event.action === \"write\"\n              ? c.green\n              : event.action === \"delete\"\n                ? c.red\n                : c.yellow;\n\n        const parts = [\n          c.dim(ts),\n          actionColor(event.action.padEnd(8)),\n          event.key ? c.bold(event.key) : \"\",\n          event.scope ? c.dim(`[${event.scope}]`) : \"\",\n          event.agent ? c.cyan(`⟨${event.agent}⟩`) : \"\",\n          event.detail ? c.dim(event.detail) : \"\",\n        ];\n\n        console.log(`  ${parts.filter(Boolean).join(\"  \")}`);\n      }\n      console.log();\n    });\n\n  program\n    .command(\"audit:verify\")\n    .description(\"Verify the integrity of the audit hash chain\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const result = verifyAuditChain();\n      if (emitJson(program, cmd, result)) {\n        if (!result.intact && result.totalEvents > 0) process.exitCode = 1;\n        return;\n      }\n      if (result.totalEvents === 0) {\n        console.log(c.dim(\"  No audit events to verify\"));\n        return;\n      }\n\n      if (result.intact) {\n        console.log(\n          `${SYMBOLS.shield} ${c.green(\"Audit chain intact\")} — ${result.totalEvents} events verified`,\n        );\n      } else {\n        console.log(`${SYMBOLS.cross} ${c.red(\"Audit chain BROKEN\")} at event #${result.brokenAt}`);\n        console.log(\n          c.dim(`  ${result.validEvents}/${result.totalEvents} events valid before break`),\n        );\n        if (result.brokenEvent) {\n          console.log(\n            c.dim(\n              `  Broken event: ${result.brokenEvent.timestamp} ${result.brokenEvent.action} ${result.brokenEvent.key ?? \"\"}`,\n            ),\n          );\n        }\n        process.exitCode = 1;\n      }\n    });\n\n  program\n    .command(\"audit:export\")\n    .description(\"Export audit events in a portable format\")\n    .option(\"--since <date>\", \"Start date (ISO 8601)\")\n    .option(\"--until <date>\", \"End date (ISO 8601)\")\n    .option(\"--format <fmt>\", \"Output format: jsonl, json, csv\", \"jsonl\")\n    .option(\"-o, --output <file>\", \"Write to file instead of stdout\")\n    .action((cmd) => {\n      const output = exportAudit({\n        since: cmd.since,\n        until: cmd.until,\n        format: cmd.format,\n      });\n\n      if (cmd.output) {\n        writeFileSync(cmd.output, output);\n        console.log(`${SYMBOLS.check} Exported to ${cmd.output}`);\n      } else {\n        console.log(output);\n      }\n    });\n\n  program\n    .command(\"audit:sessions\")\n    .description(\"Audit activity folded into per-agent sessions (who did what, per MCP client)\")\n    .option(\"--agent <label>\", \"Only sessions for this agent label (clientInfo name@version)\")\n    .option(\"--since <when>\", \"ISO date, or a duration like 24h / 7d (default: 7d)\")\n    .option(\"-n, --limit <n>\", \"Max sessions to show\", parseInt, 20)\n    .option(\"-v, --verbose\", \"Print each session's event lines\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const sessions = listAgentSessions({\n        agent: cmd.agent,\n        since: parseSince(cmd.since ?? \"7d\"),\n        limit: cmd.limit,\n      });\n\n      if (emitJson(program, cmd, { sessions })) return;\n\n      if (sessions.length === 0) {\n        console.log(\n          c.dim(\n            \"No agent sessions in range. Sessions appear once an MCP client (Cursor, Claude Code, Kiro, or an airlock) has touched the ring.\",\n          ),\n        );\n        return;\n      }\n\n      console.log(c.bold(`\\n  ${SYMBOLS.eye} Agent sessions (${sessions.length})\\n`));\n      for (const s of sessions) {\n        const started = new Date(s.startedAt);\n        const ended = new Date(s.endedAt);\n        const seconds = Math.max(0, Math.round((ended.getTime() - started.getTime()) / 1000));\n        const who = s.wrapLabel ? `airlock: ${s.wrapLabel}` : s.agent;\n        const head = [\n          c.cyan(`⟨${who}⟩`),\n          c.dim(`[${s.source}]`),\n          c.dim(\n            `${started.toLocaleString()} → ${ended.toLocaleTimeString()} (${fmtSeconds(seconds)})`,\n          ),\n          `${s.eventCount} events`,\n          s.denials > 0 ? c.red(`${s.denials} denied`) : c.green(\"0 denied\"),\n          s.countsByAction.canary ? c.red(`${s.countsByAction.canary} canary trips`) : \"\",\n        ];\n        console.log(`  ${head.filter(Boolean).join(\"  \")}`);\n        console.log(c.dim(`    id ${s.id} · keys: ${s.keys.length ? s.keys.join(\", \") : \"—\"}`));\n        if (cmd.verbose) {\n          for (const e of s.events) {\n            const parts = [\n              c.dim(new Date(e.timestamp).toLocaleTimeString()),\n              (e.action === \"policy_deny\" || e.action === \"canary\" ? c.red : c.yellow)(\n                e.action.padEnd(11),\n              ),\n              e.key ? c.bold(e.key) : \"\",\n              e.detail ? c.dim(e.detail) : \"\",\n            ];\n            console.log(`      ${parts.filter(Boolean).join(\"  \")}`);\n          }\n        }\n        console.log();\n      }\n    });\n\n  program\n    .command(\"health\")\n    .description(\"Check the health of all secrets\")\n    .option(\"-g, --global\", \"Check global scope only\")\n    .option(\"-p, --project\", \"Check project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      const entries = listSecrets(opts);\n\n      const expiredKeys: string[] = [];\n      const staleKeys: Array<{ key: string; lifetimePercent: number; timeRemaining: string }> = [];\n      let healthy = 0;\n      let noDecay = 0;\n\n      for (const entry of entries) {\n        if (!entry.decay || !entry.decay.timeRemaining) {\n          noDecay++;\n        } else if (entry.decay.isExpired) {\n          expiredKeys.push(entry.key);\n        } else if (entry.decay.isStale) {\n          staleKeys.push({\n            key: entry.key,\n            lifetimePercent: entry.decay.lifetimePercent,\n            timeRemaining: entry.decay.timeRemaining,\n          });\n        } else {\n          healthy++;\n        }\n      }\n\n      if (\n        emitJson(program, cmd, {\n          total: entries.length,\n          healthy,\n          noDecay,\n          expired: expiredKeys,\n          stale: staleKeys,\n          anomalies: entries.length === 0 ? [] : detectAnomalies(),\n        })\n      ) {\n        return;\n      }\n\n      if (entries.length === 0) {\n        console.log(c.dim(\"No secrets to check\"));\n        return;\n      }\n\n      console.log(c.bold(`\\n  ${SYMBOLS.shield} Secret health report\\n`));\n\n      for (const key of expiredKeys) {\n        console.log(`  ${c.red(SYMBOLS.cross)} ${c.bold(key)} ${c.bgRed(c.white(\" EXPIRED \"))}`);\n      }\n      for (const s of staleKeys) {\n        console.log(\n          `  ${c.yellow(SYMBOLS.warning)} ${c.bold(s.key)} ${c.yellow(`stale (${s.lifetimePercent}%, ${s.timeRemaining} left)`)}`,\n        );\n      }\n\n      console.log(\n        `\\n  ${c.green(`${SYMBOLS.check} ${healthy} healthy`)}  ${c.yellow(`${SYMBOLS.warning} ${staleKeys.length} stale`)}  ${c.red(`${SYMBOLS.cross} ${expiredKeys.length} expired`)}  ${c.dim(`${noDecay} no decay`)}`,\n      );\n\n      const anomalies = detectAnomalies();\n      if (anomalies.length > 0) {\n        console.log(\n          `\\n  ${c.yellow(`${SYMBOLS.warning} ${anomalies.length} access anomaly/anomalies detected`)} ${c.dim(\"(run: qring audit --anomalies)\")}`,\n        );\n      }\n\n      console.log();\n    });\n}\n","/**\n * Git Pre-Commit Hook for Secret Scanning\n *\n * Scans staged files for hardcoded secrets using the q-ring scanner.\n * If any are found, blocks the commit and reports locations.\n *\n * Install via: qring hook:install\n * Runs via: .git/hooks/pre-commit\n */\n\nimport { execSync } from \"node:child_process\";\nimport { existsSync, writeFileSync, chmodSync, readFileSync, unlinkSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { lintFiles } from \"../core/linter.js\";\n\n/**\n * Get the list of staged files from git.\n */\nfunction getStagedFiles(): string[] {\n  try {\n    const output = execSync(\"git diff --cached --name-only --diff-filter=ACM\", {\n      encoding: \"utf8\",\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n    });\n    return output\n      .split(\"\\n\")\n      .map((f) => f.trim())\n      .filter((f) => f.length > 0);\n  } catch {\n    return [];\n  }\n}\n\n/**\n * Run the pre-commit scan on staged files.\n * Returns exit code 0 (clean) or 1 (secrets found).\n */\nexport function runPreCommitScan(): number {\n  const staged = getStagedFiles();\n  if (staged.length === 0) return 0;\n\n  const results = lintFiles(staged);\n\n  if (results.length === 0) return 0;\n\n  console.error(\"\\n[q-ring] Pre-commit scan found hardcoded secrets:\\n\");\n  for (const r of results) {\n    console.error(`  ${r.file}:${r.line}  ${r.keyName}  (entropy: ${r.entropy})`);\n  }\n  console.error(\n    `\\n[q-ring] Commit blocked. Use \"qring scan --fix\" to auto-migrate, or \"git commit --no-verify\" to bypass.\\n`,\n  );\n\n  return 1;\n}\n\nconst HOOK_SCRIPT = `#!/bin/sh\n# q-ring pre-commit hook — scans staged files for hardcoded secrets\nnpx qring hook:run 2>&1\nexit $?\n`;\n\n/**\n * Install the pre-commit hook into the repository's .git/hooks directory.\n */\nexport function installPreCommitHook(repoPath?: string): { installed: boolean; path: string; message: string } {\n  const root = repoPath ?? process.cwd();\n  const hooksDir = join(root, \".git\", \"hooks\");\n\n  if (!existsSync(join(root, \".git\"))) {\n    return { installed: false, path: \"\", message: \"Not a git repository\" };\n  }\n\n  const hookPath = join(hooksDir, \"pre-commit\");\n\n  if (existsSync(hookPath)) {\n    const existing = readFileSync(hookPath, \"utf8\");\n    if (existing.includes(\"q-ring\")) {\n      return { installed: true, path: hookPath, message: \"Hook already installed\" };\n    }\n    // Prepend to existing hook\n    writeFileSync(hookPath, HOOK_SCRIPT + \"\\n\" + existing, \"utf8\");\n  } else {\n    writeFileSync(hookPath, HOOK_SCRIPT, \"utf8\");\n  }\n\n  chmodSync(hookPath, 0o755);\n  return { installed: true, path: hookPath, message: \"Pre-commit hook installed\" };\n}\n\n/**\n * Uninstall the pre-commit hook.\n */\nexport function uninstallPreCommitHook(repoPath?: string): boolean {\n  const root = repoPath ?? process.cwd();\n  const hookPath = join(root, \".git\", \"hooks\", \"pre-commit\");\n\n  if (!existsSync(hookPath)) return false;\n\n  const content = readFileSync(hookPath, \"utf8\");\n  if (!content.includes(\"q-ring\")) return false;\n\n  // Remove q-ring lines\n  const lines = content.split(\"\\n\");\n  const cleaned = lines.filter(\n    (l) => !l.includes(\"q-ring\") && !l.includes(\"npx qring hook:run\"),\n  );\n\n  if (cleaned.filter((l) => l.trim() && !l.startsWith(\"#!\")).length === 0) {\n    // Nothing left, delete the file\n    unlinkSync(hookPath);\n  } else {\n    writeFileSync(hookPath, cleaned.join(\"\\n\"), \"utf8\");\n  }\n\n  return true;\n}\n","import type { Command } from \"commander\";\nimport {\n  registerHook,\n  removeHook,\n  listHooks as listAllHooks,\n  enableHook,\n  disableHook,\n  fireHooks,\n  type HookType,\n  type HookAction,\n} from \"../../core/hooks.js\";\nimport {\n  installPreCommitHook,\n  uninstallPreCommitHook,\n  runPreCommitScan,\n} from \"../../hooks/precommit.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson } from \"../helpers.js\";\n\nexport function registerHookCommands(program: Command): void {\n  // ─── Pre-Commit Hook ───\n\n  program\n    .command(\"hook:install\")\n    .description(\n      \"Install a git pre-commit hook that scans for hardcoded secrets\",\n    )\n    .option(\"--project-path <path>\", \"Repository path\")\n    .action((cmd) => {\n      const result = installPreCommitHook(cmd.projectPath);\n      if (result.installed) {\n        console.log(\n          `${SYMBOLS.check} ${c.green(result.message)} at ${c.dim(result.path)}`,\n        );\n      } else {\n        console.log(`${SYMBOLS.cross} ${c.red(result.message)}`);\n      }\n    });\n\n  program\n    .command(\"hook:uninstall\")\n    .description(\"Remove the q-ring pre-commit hook\")\n    .option(\"--project-path <path>\", \"Repository path\")\n    .action((cmd) => {\n      const removed = uninstallPreCommitHook(cmd.projectPath);\n      if (removed) {\n        console.log(`${SYMBOLS.check} ${c.green(\"Pre-commit hook removed\")}`);\n      } else {\n        console.log(c.dim(\"No q-ring pre-commit hook found\"));\n      }\n    });\n\n  program\n    .command(\"hook:run\")\n    .description(\"Run the pre-commit secret scan (called by the git hook)\")\n    .action(() => {\n      const code = runPreCommitScan();\n      process.exit(code);\n    });\n\n  // ─── Hook Subcommands ───\n\n  const hook = program\n    .command(\"hook\")\n    .description(\n      \"Manage secret change hooks (callbacks on write/delete/rotate)\",\n    );\n\n  hook\n    .command(\"add\")\n    .description(\"Register a new hook\")\n    .option(\"--key <key>\", \"Trigger on exact key match\")\n    .option(\"--key-pattern <pattern>\", \"Trigger on key glob pattern (e.g. DB_*)\")\n    .option(\"--tag <tag>\", \"Trigger on secrets with this tag\")\n    .option(\n      \"--scope <scope>\",\n      \"Trigger only for this scope (global or project)\",\n    )\n    .option(\n      \"--action <actions>\",\n      \"Comma-separated actions: write,delete,rotate\",\n      \"write,delete,rotate\",\n    )\n    .option(\"--exec <command>\", \"Shell command to execute\")\n    .option(\"--url <url>\", \"HTTP URL to POST to\")\n    .option(\"--signal-target <target>\", \"Process name or PID to signal\")\n    .option(\"--signal-name <signal>\", \"Signal to send (default: SIGHUP)\", \"SIGHUP\")\n    .option(\"--description <desc>\", \"Human-readable description\")\n    .action((cmd) => {\n      let type: HookType;\n      if (cmd.exec) type = \"shell\";\n      else if (cmd.url) type = \"http\";\n      else if (cmd.signalTarget) type = \"signal\";\n      else {\n        console.error(\n          c.red(`${SYMBOLS.cross} Specify --exec, --url, or --signal-target`),\n        );\n        process.exit(1);\n      }\n\n      if (!cmd.key && !cmd.keyPattern && !cmd.tag) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Specify at least one match criterion: --key, --key-pattern, or --tag`,\n          ),\n        );\n        process.exit(1);\n      }\n\n      const actions = cmd.action\n        .split(\",\")\n        .map((a: string) => a.trim()) as HookAction[];\n\n      const entry = registerHook({\n        type,\n        match: {\n          key: cmd.key,\n          keyPattern: cmd.keyPattern,\n          tag: cmd.tag,\n          scope: cmd.scope as \"global\" | \"project\" | undefined,\n          action: actions,\n        },\n        command: cmd.exec,\n        url: cmd.url,\n        signal: cmd.signalTarget\n          ? { target: cmd.signalTarget, signal: cmd.signalName }\n          : undefined,\n        description: cmd.description,\n        enabled: true,\n      });\n\n      console.log(\n        `${SYMBOLS.check} ${c.green(\"registered\")} hook ${c.bold(entry.id)} (${type})`,\n      );\n      if (cmd.key) console.log(c.dim(`  key: ${cmd.key}`));\n      if (cmd.keyPattern) console.log(c.dim(`  pattern: ${cmd.keyPattern}`));\n      if (cmd.tag) console.log(c.dim(`  tag: ${cmd.tag}`));\n    });\n\n  hook\n    .command(\"list\")\n    .alias(\"ls\")\n    .description(\"List all registered hooks\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const hooks = listAllHooks();\n      if (emitJson(program, cmd, { hooks })) return;\n      if (hooks.length === 0) {\n        console.log(c.dim(\"No hooks registered\"));\n        return;\n      }\n\n      console.log(\n        c.bold(`\\n  ${SYMBOLS.zap} Registered hooks (${hooks.length})\\n`),\n      );\n\n      for (const h of hooks) {\n        const status = h.enabled ? c.green(\"on\") : c.red(\"off\");\n        const matchParts: string[] = [];\n        if (h.match.key) matchParts.push(`key=${h.match.key}`);\n        if (h.match.keyPattern) matchParts.push(`pattern=${h.match.keyPattern}`);\n        if (h.match.tag) matchParts.push(`tag=${h.match.tag}`);\n        if (h.match.scope) matchParts.push(`scope=${h.match.scope}`);\n        if (h.match.action?.length)\n          matchParts.push(`actions=${h.match.action.join(\",\")}`);\n\n        const target =\n          h.type === \"shell\"\n            ? h.command\n            : h.type === \"http\"\n              ? h.url\n              : h.signal\n                ? `${h.signal.target} (${h.signal.signal ?? \"SIGHUP\"})`\n                : \"?\";\n\n        console.log(\n          `  ${c.bold(h.id)}  [${status}]  ${c.cyan(h.type)}  ${c.dim(matchParts.join(\" \"))}`,\n        );\n        console.log(\n          `    ${c.dim(\"→\")} ${target}${h.description ? `  ${c.dim(`— ${h.description}`)}` : \"\"}`,\n        );\n      }\n      console.log();\n    });\n\n  hook\n    .command(\"remove <id>\")\n    .alias(\"rm\")\n    .description(\"Remove a hook by ID\")\n    .action((id: string) => {\n      if (removeHook(id)) {\n        console.log(`${SYMBOLS.check} ${c.green(\"removed\")} hook ${c.bold(id)}`);\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} Hook \"${id}\" not found`));\n        process.exit(1);\n      }\n    });\n\n  hook\n    .command(\"enable <id>\")\n    .description(\"Enable a hook\")\n    .action((id: string) => {\n      if (enableHook(id)) {\n        console.log(`${SYMBOLS.check} ${c.green(\"enabled\")} hook ${c.bold(id)}`);\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} Hook \"${id}\" not found`));\n        process.exit(1);\n      }\n    });\n\n  hook\n    .command(\"disable <id>\")\n    .description(\"Disable a hook\")\n    .action((id: string) => {\n      if (disableHook(id)) {\n        console.log(\n          `${SYMBOLS.check} ${c.yellow(\"disabled\")} hook ${c.bold(id)}`,\n        );\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} Hook \"${id}\" not found`));\n        process.exit(1);\n      }\n    });\n\n  hook\n    .command(\"test <id>\")\n    .description(\"Dry-run a hook with a mock payload\")\n    .action(async (id: string) => {\n      const hooks = listAllHooks();\n      const h = hooks.find((hook) => hook.id === id);\n      if (!h) {\n        console.error(c.red(`${SYMBOLS.cross} Hook \"${id}\" not found`));\n        process.exit(1);\n      }\n\n      console.log(c.dim(`Testing hook ${id} (${h.type})...\\n`));\n\n      const payload = {\n        action: \"write\" as const,\n        key: h.match.key ?? \"TEST_KEY\",\n        scope: h.match.scope ?? \"global\",\n        timestamp: new Date().toISOString(),\n        source: \"cli\" as const,\n      };\n\n      const results = await fireHooks(payload);\n      const result = results.find((r) => r.hookId === id);\n\n      if (result) {\n        const icon = result.success ? c.green(SYMBOLS.check) : c.red(SYMBOLS.cross);\n        console.log(`  ${icon} ${result.message}`);\n      } else {\n        console.log(\n          c.yellow(`  ${SYMBOLS.warning} Hook did not match the test payload`),\n        );\n      }\n      console.log();\n    });\n}\n","/**\n * Quantum Agent: autonomous background monitor for secret health.\n *\n * Runs as a long-lived process that periodically:\n * - Checks for expired/stale secrets (decay monitoring)\n * - Detects access anomalies (observer analysis)\n * - Logs health reports\n * - Can trigger rotation callbacks\n *\n * Designed to run as `qring agent` or be invoked by the MCP server.\n */\n\nimport { listSecrets, setSecret } from \"./keyring.js\";\nimport { checkDecay } from \"./envelope.js\";\nimport { detectAnomalies, logAudit } from \"./observer.js\";\nimport { generateSecret } from \"./noise.js\";\nimport { fireHooks } from \"./hooks.js\";\nimport { c, SYMBOLS } from \"../utils/colors.js\";\n\nexport interface AgentConfig {\n  /** Check interval in seconds (default: 60) */\n  intervalSeconds: number;\n  /** Auto-rotate expired secrets with generated values */\n  autoRotate: boolean;\n  /** Project paths to monitor */\n  projectPaths: string[];\n  /** Verbose output */\n  verbose: boolean;\n}\n\nexport interface AgentReport {\n  timestamp: string;\n  totalSecrets: number;\n  healthy: number;\n  stale: number;\n  expired: number;\n  anomalies: number;\n  rotated: string[];\n  warnings: string[];\n}\n\nfunction defaultConfig(): AgentConfig {\n  return {\n    intervalSeconds: 60,\n    autoRotate: false,\n    projectPaths: [process.cwd()],\n    verbose: false,\n  };\n}\n\nexport function runHealthScan(config: Partial<AgentConfig> = {}): AgentReport {\n  const cfg = { ...defaultConfig(), ...config };\n\n  const report: AgentReport = {\n    timestamp: new Date().toISOString(),\n    totalSecrets: 0,\n    healthy: 0,\n    stale: 0,\n    expired: 0,\n    anomalies: 0,\n    rotated: [],\n    warnings: [],\n  };\n\n  // Scan global scope\n  const globalEntries = listSecrets({ scope: \"global\", source: \"agent\" });\n\n  // Scan project scopes\n  const projectEntries = cfg.projectPaths.flatMap((pp) =>\n    listSecrets({ scope: \"project\", projectPath: pp, source: \"agent\" }),\n  );\n\n  const allEntries = [...globalEntries, ...projectEntries];\n  report.totalSecrets = allEntries.length;\n\n  for (const entry of allEntries) {\n    if (!entry.envelope) continue;\n\n    const decay = checkDecay(entry.envelope);\n\n    if (decay.isExpired) {\n      report.expired++;\n      report.warnings.push(\n        `EXPIRED: ${entry.key} [${entry.scope}] — expired ${decay.timeRemaining}`,\n      );\n\n      if (cfg.autoRotate) {\n        const fmt = (entry.envelope?.meta.rotationFormat ?? \"api-key\") as import(\"./noise.js\").NoiseFormat;\n        const prefix = entry.envelope?.meta.rotationPrefix;\n        const newValue = generateSecret({ format: fmt, prefix });\n        setSecret(entry.key, newValue, {\n          scope: entry.scope,\n          projectPath: cfg.projectPaths[0],\n          source: \"agent\",\n        });\n        report.rotated.push(entry.key);\n        logAudit({\n          action: \"write\",\n          key: entry.key,\n          scope: entry.scope,\n          source: \"agent\",\n          detail: \"auto-rotated by agent (expired)\",\n        });\n        fireHooks({\n          action: \"rotate\",\n          key: entry.key,\n          scope: entry.scope,\n          timestamp: new Date().toISOString(),\n          source: \"agent\",\n        }, entry.envelope?.meta.tags).catch(() => {});\n      }\n    } else if (decay.isStale) {\n      report.stale++;\n      report.warnings.push(\n        `STALE: ${entry.key} [${entry.scope}] — ${decay.lifetimePercent}% lifetime, ${decay.timeRemaining} remaining`,\n      );\n    } else {\n      report.healthy++;\n    }\n  }\n\n  // Check for anomalies\n  const anomalies = detectAnomalies();\n  report.anomalies = anomalies.length;\n  for (const a of anomalies) {\n    report.warnings.push(`ANOMALY [${a.type}]: ${a.description}`);\n  }\n\n  return report;\n}\n\nfunction formatReport(report: AgentReport, verbose: boolean): string {\n  const lines: string[] = [];\n\n  lines.push(\n    `${c.bold(`${SYMBOLS.shield} q-ring agent scan`)} ${c.dim(report.timestamp)}`,\n  );\n  lines.push(\n    `  ${c.dim(\"secrets:\")} ${report.totalSecrets}  ${c.green(`${SYMBOLS.check} ${report.healthy}`)}  ${c.yellow(`${SYMBOLS.warning} ${report.stale}`)}  ${c.red(`${SYMBOLS.cross} ${report.expired}`)}  ${c.dim(`anomalies: ${report.anomalies}`)}`,\n  );\n\n  if (report.rotated.length > 0) {\n    lines.push(\n      `  ${c.cyan(`${SYMBOLS.zap} auto-rotated:`)} ${report.rotated.join(\", \")}`,\n    );\n  }\n\n  if (verbose && report.warnings.length > 0) {\n    lines.push(\"\");\n    for (const w of report.warnings) {\n      if (w.startsWith(\"EXPIRED\")) lines.push(`  ${c.red(w)}`);\n      else if (w.startsWith(\"STALE\")) lines.push(`  ${c.yellow(w)}`);\n      else if (w.startsWith(\"ANOMALY\")) lines.push(`  ${c.magenta(w)}`);\n      else lines.push(`  ${w}`);\n    }\n  }\n\n  return lines.join(\"\\n\");\n}\n\n/**\n * Run the agent as a continuous background monitor.\n */\nexport async function startAgent(config: Partial<AgentConfig> = {}): Promise<void> {\n  const cfg = { ...defaultConfig(), ...config };\n\n  console.log(\n    `${c.bold(`${SYMBOLS.zap} q-ring agent started`)} ${c.dim(`(interval: ${cfg.intervalSeconds}s, auto-rotate: ${cfg.autoRotate})`)}`,\n  );\n  console.log(\n    c.dim(`  monitoring: global + ${cfg.projectPaths.length} project(s)`),\n  );\n  console.log();\n\n  const scan = () => {\n    const report = runHealthScan(cfg);\n    console.log(formatReport(report, cfg.verbose));\n\n    if (report.warnings.length > 0 || cfg.verbose) {\n      console.log();\n    }\n  };\n\n  // Initial scan\n  scan();\n\n  // Continuous monitoring\n  const interval = setInterval(scan, cfg.intervalSeconds * 1000);\n\n  // Graceful shutdown\n  const shutdown = () => {\n    clearInterval(interval);\n    console.log(`\\n${c.dim(\"q-ring agent stopped\")}`);\n    process.exit(0);\n  };\n\n  process.on(\"SIGINT\", shutdown);\n  process.on(\"SIGTERM\", shutdown);\n\n  // Keep alive\n  await new Promise(() => {});\n}\n","import type { Command } from \"commander\";\nimport { listSecrets } from \"../../core/keyring.js\";\nimport { startAgent, runHealthScan } from \"../../core/agent.js\";\nimport { queryAudit } from \"../../core/observer.js\";\nimport {\n  remember,\n  recall,\n  listMemory,\n  forget,\n  clearMemory,\n} from \"../../core/memory.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { safeStr, emitJson } from \"../helpers.js\";\nimport { confirm } from \"../../utils/prompt.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerAgentCommands(program: Command): void {\n  // ─── Agent Memory ───\n\n  program\n    .command(\"remember <key> <value>\")\n    .description(\n      \"Store a key-value pair in encrypted agent memory (persists across sessions)\",\n    )\n    .action((key: string, value: string) => {\n      remember(key, value);\n      console.log(`${SYMBOLS.check} ${c.green(\"remembered\")} ${c.bold(key)}`);\n    });\n\n  program\n    .command(\"recall [key]\")\n    .description(\"Retrieve a value from agent memory, or list all keys\")\n    .option(\"--json\", \"Output as JSON (list mode only)\")\n    .action((key: string | undefined, cmd) => {\n      if (!key) {\n        const entries = listMemory();\n        if (\n          emitJson(\n            program,\n            cmd,\n            entries.map((e) => ({ key: e.key, updatedAt: e.updatedAt })),\n          )\n        ) {\n          return;\n        }\n        if (entries.length === 0) {\n          console.log(c.dim(\"Agent memory is empty.\"));\n          return;\n        }\n        console.log(\n          `\\n${SYMBOLS.zap} ${c.bold(\"Agent Memory\")} (${entries.length} entries)\\n`,\n        );\n        for (const e of entries) {\n          console.log(\n            `  ${c.bold(e.key)}  ${c.dim(new Date(e.updatedAt).toLocaleString())}`,\n          );\n        }\n        console.log();\n        return;\n      }\n\n      const value = recall(key);\n      if (value === null) {\n        console.log(c.dim(`No memory found for \"${key}\"`));\n      } else {\n        console.log(safeStr(value));\n      }\n    });\n\n  program\n    .command(\"forget <key>\")\n    .description(\"Delete a key from agent memory\")\n    .option(\"--all\", \"Clear all agent memory\")\n    .option(\"-y, --yes\", \"Skip the confirmation prompt\")\n    .action(async (key: string, cmd) => {\n      if (cmd.all) {\n        const count = listMemory().length;\n        if (\n          !(await confirm(\n            `Clear ALL agent memory (${count} entr${count === 1 ? \"y\" : \"ies\"})? This cannot be undone.`,\n            { assumeYes: cmd.yes },\n          ))\n        ) {\n          console.error(c.dim(\"Aborted.\"));\n          process.exitCode = 1;\n          return;\n        }\n        clearMemory();\n        console.log(`${SYMBOLS.check} ${c.yellow(\"cleared\")} all agent memory`);\n        return;\n      }\n      const removed = forget(key);\n      if (removed) {\n        console.log(`${SYMBOLS.check} ${c.yellow(\"forgot\")} ${c.bold(key)}`);\n      } else {\n        console.log(c.dim(`No memory found for \"${key}\"`));\n      }\n    });\n\n  // ─── Analytics ───\n\n  program\n    .command(\"analyze\")\n    .description(\n      \"Analyze secret usage patterns and provide optimization suggestions\",\n    )\n    .option(\"-g, --global\", \"Global scope only\")\n    .option(\"-p, --project\", \"Project scope only\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const opts = buildOpts(cmd);\n      const entries = listSecrets({ ...opts, silent: true });\n      const audit = queryAudit({ limit: 1000 });\n\n      const accessMap = new Map<string, number>();\n      for (const e of audit) {\n        if (e.action === \"read\" && e.key) {\n          accessMap.set(e.key, (accessMap.get(e.key) || 0) + 1);\n        }\n      }\n\n      const sorted = [...accessMap.entries()].sort((a, b) => b[1] - a[1]);\n      const neverAccessed = entries.filter((e) => {\n        const count = e.envelope?.meta.accessCount ?? 0;\n        return count === 0;\n      });\n      const jsonExpired = entries.filter((e) => e.decay?.isExpired);\n      const jsonStale = entries.filter(\n        (e) => e.decay?.isStale && !e.decay?.isExpired,\n      );\n      const jsonNoRotation = entries.filter(\n        (e) => !e.envelope?.meta.rotationFormat && !e.decay?.isExpired,\n      );\n\n      if (\n        emitJson(program, cmd, {\n          mostAccessed: sorted\n            .slice(0, 5)\n            .map(([key, reads]) => ({ key, reads })),\n          neverAccessed: neverAccessed.map((e) => e.key),\n          expired: jsonExpired.map((e) => e.key),\n          stale: jsonStale.map((e) => ({\n            key: e.key,\n            timeRemaining: e.decay?.timeRemaining ?? null,\n          })),\n          summary: {\n            total: entries.length,\n            active: entries.length - jsonExpired.length,\n            expired: jsonExpired.length,\n            stale: jsonStale.length,\n            neverAccessed: neverAccessed.length,\n            withRotationConfig: entries.length - jsonNoRotation.length,\n          },\n        })\n      ) {\n        return;\n      }\n\n      console.log(`\\n${SYMBOLS.zap} ${c.bold(\"Secret Usage Analysis\")}\\n`);\n\n      if (sorted.length > 0) {\n        console.log(`  ${c.bold(\"Most accessed:\")}`);\n        for (const [key, count] of sorted.slice(0, 5)) {\n          console.log(`    ${c.bold(key)} — ${c.cyan(count.toString())} reads`);\n        }\n        console.log();\n      }\n\n      if (neverAccessed.length > 0) {\n        console.log(\n          `  ${c.bold(\"Never accessed:\")} ${c.yellow(neverAccessed.length.toString())} secrets`,\n        );\n        for (const e of neverAccessed.slice(0, 8)) {\n          const age = e.envelope?.meta.createdAt\n            ? c.dim(\n                `(created ${new Date(e.envelope.meta.createdAt).toLocaleDateString()})`,\n              )\n            : \"\";\n          console.log(`    ${c.dim(SYMBOLS.cross)} ${e.key} ${age}`);\n        }\n        console.log();\n      }\n\n      const expired = entries.filter((e) => e.decay?.isExpired);\n      const stale = entries.filter(\n        (e) => e.decay?.isStale && !e.decay?.isExpired,\n      );\n      if (expired.length > 0) {\n        console.log(\n          `  ${c.red(\"Expired:\")} ${expired.length} secrets need rotation or cleanup`,\n        );\n        for (const e of expired.slice(0, 5)) {\n          console.log(`    ${c.red(SYMBOLS.cross)} ${e.key}`);\n        }\n        console.log();\n      }\n      if (stale.length > 0) {\n        console.log(\n          `  ${c.yellow(\"Stale (>75% lifetime):\")} ${stale.length} secrets approaching expiry`,\n        );\n        for (const e of stale.slice(0, 5)) {\n          console.log(\n            `    ${c.yellow(SYMBOLS.warning)} ${e.key} ${c.dim(`(${e.decay?.timeRemaining} remaining)`)}`,\n          );\n        }\n        console.log();\n      }\n\n      const globalOnly = entries.filter((e) => e.scope === \"global\");\n      const withProjectTags = globalOnly.filter((e) =>\n        e.envelope?.meta.tags?.some((t) =>\n          [\"backend\", \"frontend\", \"db\", \"api\"].includes(t),\n        ),\n      );\n      if (withProjectTags.length > 0) {\n        console.log(`  ${c.bold(\"Scope suggestions:\")}`);\n        console.log(\n          `    ${withProjectTags.length} global secret(s) have project-specific tags — consider moving to project scope`,\n        );\n        console.log();\n      }\n\n      const noRotation = entries.filter(\n        (e) => !e.envelope?.meta.rotationFormat && !e.decay?.isExpired,\n      );\n      if (noRotation.length > 0) {\n        console.log(`  ${c.bold(\"Rotation suggestions:\")}`);\n        console.log(\n          `    ${noRotation.length} secret(s) have no rotation format set`,\n        );\n        console.log(\n          `    Use ${c.bold(\"qring set <key> <value> --rotation-format api-key\")} to enable auto-rotation`,\n        );\n        console.log();\n      }\n\n      console.log(`  ${c.bold(\"Summary:\")}`);\n      console.log(`    Total secrets: ${entries.length}`);\n      console.log(`    Active: ${entries.length - expired.length}`);\n      console.log(`    Expired: ${expired.length}`);\n      console.log(`    Stale: ${stale.length}`);\n      console.log(`    Never accessed: ${neverAccessed.length}`);\n      console.log(\n        `    With rotation config: ${entries.length - noRotation.length}`,\n      );\n      console.log();\n    });\n\n  // ─── Agent Mode ───\n\n  program\n    .command(\"agent\")\n    .description(\"Start the autonomous agent (background monitor)\")\n    .option(\n      \"-i, --interval <seconds>\",\n      \"Scan interval in seconds\",\n      parseInt,\n      60,\n    )\n    .option(\"--auto-rotate\", \"Auto-rotate expired secrets\")\n    .option(\"-v, --verbose\", \"Verbose output with all warnings\")\n    .option(\n      \"--project-path <paths>\",\n      \"Comma-separated project paths to monitor\",\n    )\n    .option(\"--once\", \"Run a single scan and exit (no daemon)\")\n    .action(async (cmd) => {\n      const projectPaths = cmd.projectPath\n        ? cmd.projectPath.split(\",\").map((p: string) => p.trim())\n        : [process.cwd()];\n\n      if (cmd.once) {\n        const report = runHealthScan({\n          autoRotate: cmd.autoRotate,\n          projectPaths,\n          verbose: cmd.verbose,\n        });\n\n        console.log(JSON.stringify(report, null, 2));\n        return;\n      }\n\n      await startAgent({\n        intervalSeconds: cmd.interval,\n        autoRotate: cmd.autoRotate,\n        projectPaths,\n        verbose: cmd.verbose,\n      });\n    });\n}\n","import type { Command } from \"commander\";\nimport {\n  grantApproval,\n  revokeApproval,\n  listApprovals,\n} from \"../../core/approval.js\";\nimport { serviceForScope } from \"../../core/scope.js\";\nimport { getPolicySummary } from \"../../core/policy.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { wantsJsonOutput, emitJson } from \"../helpers.js\";\nimport { buildOpts } from \"../options.js\";\n\nexport function registerSecurityCommands(program: Command): void {\n  program\n    .command(\"approve <key>\")\n    .description(\n      \"Grant a scoped, reasoned, HMAC-verified approval token for MCP secret access\",\n    )\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--for <seconds>\", \"Duration of approval in seconds\", parseInt, 3600)\n    .option(\"--reason <text>\", \"Reason for granting approval\")\n    .option(\"--revoke\", \"Revoke an existing approval\")\n    .option(\"--list\", \"List all approvals\")\n    .action((key: string, cmd) => {\n      const opts = buildOpts(cmd);\n      const scope = opts.scope ?? \"global\";\n      // Bind the approval to the concrete project/team/org identity, not just\n      // the coarse scope label (A5) — the label \"project\" is identical across\n      // every project, so an approval must be keyed on the resolved service.\n      const service = serviceForScope(scope, opts);\n\n      if (cmd.list) {\n        const approvals = listApprovals();\n        if (approvals.length === 0) {\n          console.log(c.dim(\"  No active approvals\"));\n          return;\n        }\n        for (const a of approvals) {\n          const status = a.tampered\n            ? c.red(\"TAMPERED\")\n            : a.valid\n              ? c.green(\"active\")\n              : c.dim(\"expired\");\n          const ttl = Math.max(\n            0,\n            Math.round(\n              (new Date(a.expiresAt).getTime() - Date.now()) / 1000,\n            ),\n          );\n          console.log(\n            `  ${status} ${c.bold(a.key)} [${a.scope}] reason=${c.dim(a.reason)} ttl=${ttl}s granted-by=${a.grantedBy}`,\n          );\n        }\n        return;\n      }\n\n      if (cmd.revoke) {\n        const revoked = revokeApproval(key, scope, service);\n        if (revoked) {\n          console.log(\n            `${SYMBOLS.check} ${c.yellow(\"revoked\")} approval for ${c.bold(key)}`,\n          );\n        } else {\n          console.log(c.dim(`  No active approval found for ${key}`));\n        }\n        return;\n      }\n\n      const entry = grantApproval(key, scope, service, cmd.for, {\n        reason: cmd.reason ?? \"manual approval\",\n      });\n      console.log(\n        `${SYMBOLS.check} ${c.green(\"approved\")} ${c.bold(key)} for ${cmd.for}s`,\n      );\n      console.log(\n        c.dim(\n          `  id=${entry.id} reason=\"${entry.reason}\" expires=${entry.expiresAt}`,\n        ),\n      );\n    });\n\n  program\n    .command(\"approvals\")\n    .description(\"List all approval tokens with verification status\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const approvals = listApprovals();\n      if (emitJson(program, cmd, { approvals })) return;\n      if (approvals.length === 0) {\n        console.log(c.dim(\"  No approvals found\"));\n        return;\n      }\n\n      console.log(c.bold(`\\n${SYMBOLS.lock} Approval Tokens\\n`));\n      for (const a of approvals) {\n        const status = a.tampered\n          ? c.red(`${SYMBOLS.cross} TAMPERED`)\n          : a.valid\n            ? c.green(`${SYMBOLS.check} active`)\n            : c.dim(`${SYMBOLS.warning} expired`);\n        const ttl = Math.max(\n          0,\n          Math.round((new Date(a.expiresAt).getTime() - Date.now()) / 1000),\n        );\n        console.log(`  ${status} ${c.bold(a.key)} [${a.scope}]`);\n        console.log(\n          c.dim(`    id=${a.id} reason=\"${a.reason}\" ttl=${ttl}s by=${a.grantedBy}`),\n        );\n        if (a.workspace) console.log(c.dim(`    workspace=${a.workspace}`));\n      }\n      console.log();\n    });\n\n  program\n    .command(\"policy\")\n    .description(\"Show project governance policy summary\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const summary = getPolicySummary();\n      if (wantsJsonOutput(program, cmd)) {\n        console.log(JSON.stringify(summary, null, 2));\n        return;\n      }\n\n      console.log(c.bold(\"\\n⚖  Governance Policy\\n\"));\n\n      if (\n        !summary.hasMcpPolicy &&\n        !summary.hasExecPolicy &&\n        !summary.hasSecretPolicy\n      ) {\n        console.log(c.dim(\"  No policy configured in .q-ring.json\"));\n        console.log(\n          c.dim('  Add a \"policy\" section to enable governance controls.\\n'),\n        );\n        return;\n      }\n\n      if (summary.hasMcpPolicy) {\n        console.log(c.cyan(\"  MCP Policy:\"));\n        const m = summary.details.mcp!;\n        if (m.allowTools)\n          console.log(c.green(`    Allow tools: ${m.allowTools.join(\", \")}`));\n        if (m.denyTools)\n          console.log(c.red(`    Deny tools:  ${m.denyTools.join(\", \")}`));\n        if (m.readableKeys)\n          console.log(\n            c.green(`    Readable keys: ${m.readableKeys.join(\", \")}`),\n          );\n        if (m.deniedKeys)\n          console.log(c.red(`    Denied keys:   ${m.deniedKeys.join(\", \")}`));\n        if (m.deniedTags)\n          console.log(c.red(`    Denied tags:   ${m.deniedTags.join(\", \")}`));\n      }\n\n      if (summary.hasExecPolicy) {\n        console.log(c.cyan(\"  Exec Policy:\"));\n        const e = summary.details.exec!;\n        if (e.allowCommands)\n          console.log(\n            c.green(`    Allow commands:    ${e.allowCommands.join(\", \")}`),\n          );\n        if (e.denyCommands)\n          console.log(\n            c.red(`    Deny commands:     ${e.denyCommands.join(\", \")}`),\n          );\n        if (e.maxRuntimeSeconds)\n          console.log(`    Max runtime:       ${e.maxRuntimeSeconds}s`);\n        if (e.allowNetwork !== undefined)\n          console.log(`    Allow network:     ${e.allowNetwork}`);\n      }\n\n      if (summary.hasSecretPolicy) {\n        console.log(c.cyan(\"  Secret Lifecycle Policy:\"));\n        const s = summary.details.secrets!;\n        if (s.requireApprovalForTags)\n          console.log(\n            `    Require approval for tags: ${s.requireApprovalForTags.join(\", \")}`,\n          );\n        if (s.maxTtlSeconds) console.log(`    Max TTL: ${s.maxTtlSeconds}s`);\n      }\n\n      console.log();\n    });\n}\n","/**\n * `qring run` — least-privilege command runner.\n *\n * Where `qring exec` injects every secret in scope, `run` injects only what\n * the project declares: qring:// references found in .env files, plus the\n * keys listed in the .q-ring.json secrets manifest. This is the bridge that\n * lets a .env file be committed (it holds references, not values) while the\n * real secrets stay in the keyring.\n *\n * Environment composition, later sources win:\n *   process.env  <  manifest keys  <  .env files (plain values and resolved refs)\n */\n\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve as resolvePath } from \"node:path\";\nimport {\n  getProfile,\n  enforceExecPolicy,\n  spawnRedacted,\n  type ExecResult,\n} from \"./exec.js\";\nimport { parseDotenv } from \"./import.js\";\nimport { resolveRef, resolveRefsInMap, isRef } from \"./refs.js\";\nimport { readProjectConfig } from \"./collapse.js\";\nimport type { KeyringOptions } from \"./keyring.js\";\n\nexport interface RunOptions extends KeyringOptions {\n  command: string;\n  args: string[];\n  /** Explicit .env files; default is ./.env when it exists. */\n  envFiles?: string[];\n  /** Resolve .q-ring.json manifest keys (default true). */\n  useManifest?: boolean;\n  /** Exec profile name (unrestricted, restricted, ci). */\n  profile?: string;\n  captureOutput?: boolean;\n  /** Treat missing optional manifest keys as fatal too. */\n  strict?: boolean;\n}\n\nexport interface InjectedVar {\n  name: string;\n  source: \"manifest\" | \"env-file\" | \"env-file-ref\";\n}\n\nexport interface RunPlan {\n  envFiles: string[];\n  injected: InjectedVar[];\n  /** Missing required keys (fatal) — manifest required:true or explicit refs. */\n  missingRequired: string[];\n  /** Missing optional manifest keys (warned, not fatal). */\n  missingOptional: string[];\n  envMap: Record<string, string>;\n  secretsToRedact: string[];\n}\n\n/**\n * Compose the child environment for a run without spawning anything.\n * Exposed separately so `qring run --dry-run` and tests can inspect the plan.\n */\nexport function buildRunPlan(opts: RunOptions): RunPlan {\n  const projectPath = opts.projectPath ?? process.cwd();\n  const keyringOpts: KeyringOptions = {\n    projectPath,\n    env: opts.env,\n    source: opts.source ?? \"cli\",\n    silent: opts.silent,\n  };\n\n  const envMap: Record<string, string> = {};\n  for (const [k, v] of Object.entries(process.env)) {\n    if (v !== undefined) envMap[k] = v;\n  }\n\n  const injected: InjectedVar[] = [];\n  const missingRequired: string[] = [];\n  const missingOptional: string[] = [];\n  const secretsToRedact = new Set<string>();\n\n  // 1. Manifest keys (project scope first, then global — same as auto refs).\n  if (opts.useManifest !== false) {\n    const config = readProjectConfig(projectPath);\n    for (const [key, entry] of Object.entries(config?.secrets ?? {})) {\n      const value = resolveRef(\n        { key, raw: `manifest:${key}` },\n        keyringOpts,\n      );\n      if (value === null) {\n        if (entry.required !== false) missingRequired.push(key);\n        else if (opts.strict) missingRequired.push(key);\n        else missingOptional.push(key);\n        continue;\n      }\n      envMap[key] = value;\n      injected.push({ name: key, source: \"manifest\" });\n      if (value.length > 5) secretsToRedact.add(value);\n    }\n  }\n\n  // 2. .env files: plain values pass through, qring:// refs resolve.\n  const envFiles =\n    opts.envFiles ??\n    (existsSync(join(projectPath, \".env\")) ? [join(projectPath, \".env\")] : []);\n\n  for (const file of envFiles) {\n    const path = resolvePath(projectPath, file);\n    if (!existsSync(path)) {\n      throw new Error(`Env file not found: ${path}`);\n    }\n    const parsed = Object.fromEntries(parseDotenv(readFileSync(path, \"utf8\")));\n    const { resolved, secretValues, missing } = resolveRefsInMap(parsed, keyringOpts);\n\n    for (const [name, value] of Object.entries(resolved)) {\n      envMap[name] = value;\n      injected.push({\n        name,\n        source: isRef(parsed[name]) ? \"env-file-ref\" : \"env-file\",\n      });\n    }\n    for (const value of secretValues) {\n      if (value.length > 5) secretsToRedact.add(value);\n    }\n    // A ref written into a .env file is an explicit demand — missing is fatal.\n    for (const m of missing) missingRequired.push(m.name);\n  }\n\n  return {\n    envFiles: envFiles.map((f) => resolvePath(projectPath, f)),\n    injected,\n    missingRequired,\n    missingOptional,\n    envMap,\n    secretsToRedact: [...secretsToRedact],\n  };\n}\n\nexport interface RunResult extends ExecResult {\n  plan: RunPlan;\n}\n\nexport async function runCommand(opts: RunOptions): Promise<RunResult> {\n  const profile = getProfile(opts.profile);\n  enforceExecPolicy(profile, opts.command, opts.args, opts.projectPath);\n\n  const plan = buildRunPlan(opts);\n\n  if (plan.missingRequired.length > 0) {\n    throw new Error(\n      `Missing required secrets: ${plan.missingRequired.join(\", \")}. ` +\n        `Store them with \\`qring set <KEY>\\` or drop them from the manifest/.env refs.`,\n    );\n  }\n\n  if (profile.stripEnvVars) {\n    for (const key of profile.stripEnvVars) {\n      delete plan.envMap[key];\n    }\n  }\n\n  const result = await spawnRedacted({\n    profile,\n    command: opts.command,\n    args: opts.args,\n    envMap: plan.envMap,\n    secretsToRedact: plan.secretsToRedact,\n    captureOutput: opts.captureOutput,\n    projectPath: opts.projectPath,\n  });\n\n  return { ...result, plan };\n}\n","/**\n * qring:// Secret References\n *\n * A secret reference is a stable, committable pointer to a secret in the\n * keyring — the value that goes in a .env file or CI config instead of the\n * secret itself:\n *\n *   qring://project/DATABASE_URL          project-scoped key\n *   qring://global/OPENAI_API_KEY         global-scoped key\n *   qring:///STRIPE_KEY                   auto scope (project, then global)\n *   qring://project/DATABASE_URL?env=prod pin the superposition environment\n *\n * The KEY always lives in the PATH component, never the host: URL hosts are\n * case-insensitive and WHATWG parsers lowercase them, which would silently\n * corrupt `qring://DATABASE_URL` into `database_url`. Refs are parsed with a\n * grammar of our own (not `new URL`) so that footgun cannot exist, and the\n * key-in-host form is rejected with a corrective error.\n */\n\nimport { getSecret, type KeyringOptions } from \"./keyring.js\";\nimport type { Environment } from \"./envelope.js\";\n\nexport const REF_PREFIX = \"qring://\";\n\n/** Scopes addressable by a ref. Team/org need out-of-band ids and are not addressable. */\nexport type RefScope = \"global\" | \"project\";\n\nexport interface SecretRef {\n  /** Undefined = auto: resolve project scope first, then global. */\n  scope?: RefScope;\n  key: string;\n  /** Environment pin from `?env=`; undefined = collapse from context. */\n  env?: Environment;\n  /** The original ref string, for error messages and round-tripping. */\n  raw: string;\n}\n\nconst KEY_PATTERN = /^[A-Za-z_][A-Za-z0-9_]*$/;\nconst REF_PATTERN = /^qring:\\/\\/(global|project|)\\/([^/?#]+)(?:\\?([^#]*))?$/;\n\n/** True if a string is even shaped like a ref (cheap pre-filter for env maps). */\nexport function isRef(value: string): boolean {\n  return value.startsWith(REF_PREFIX);\n}\n\n/**\n * Parse a qring:// reference. Throws on malformed refs — a ref that made it\n * into a .env file is config, and config errors should be loud, not silently\n * passed through to the child process as a literal `qring://...` string.\n */\nexport function parseRef(raw: string): SecretRef {\n  if (!isRef(raw)) {\n    throw new Error(`Not a qring:// reference: \"${raw}\"`);\n  }\n\n  const match = REF_PATTERN.exec(raw);\n  if (!match) {\n    // The one mistake everyone will make: qring://DATABASE_URL (key in the\n    // host slot). Catch it specifically and say what the correct form is.\n    const hostOnly = /^qring:\\/\\/([^/?#]+)\\/?$/.exec(raw);\n    if (hostOnly && KEY_PATTERN.test(hostOnly[1]) && ![\"global\", \"project\"].includes(hostOnly[1])) {\n      throw new Error(\n        `Invalid ref \"${raw}\": the key belongs in the path, not the host ` +\n          `(URL hosts are lowercased by parsers). ` +\n          `Use \"qring:///${hostOnly[1]}\" (auto scope) or \"qring://project/${hostOnly[1]}\".`,\n      );\n    }\n    throw new Error(\n      `Invalid ref \"${raw}\": expected qring://<global|project|>/KEY[?env=<env>]`,\n    );\n  }\n\n  const [, scopeRaw, key, query] = match;\n\n  if (!KEY_PATTERN.test(key)) {\n    throw new Error(\n      `Invalid ref \"${raw}\": \"${key}\" is not a valid secret key (expected [A-Za-z_][A-Za-z0-9_]*)`,\n    );\n  }\n\n  let env: Environment | undefined;\n  if (query) {\n    for (const part of query.split(\"&\")) {\n      if (!part) continue;\n      const eq = part.indexOf(\"=\");\n      const name = eq === -1 ? part : part.slice(0, eq);\n      const value = eq === -1 ? \"\" : decodeURIComponent(part.slice(eq + 1));\n      if (name === \"env\") {\n        env = value as Environment;\n      } else {\n        throw new Error(`Invalid ref \"${raw}\": unknown query parameter \"${name}\"`);\n      }\n    }\n  }\n\n  return {\n    scope: scopeRaw === \"\" ? undefined : (scopeRaw as RefScope),\n    key,\n    env,\n    raw,\n  };\n}\n\nexport type ResolveRefOptions = KeyringOptions;\n\n/**\n * Resolve a parsed ref to its secret value. Auto-scope refs try project\n * first, then global. Returns null when the key is absent (callers decide\n * whether missing is fatal); scope/env options from the ref override the\n * caller's context.\n */\nexport function resolveRef(ref: SecretRef, opts: ResolveRefOptions = {}): string | null {\n  const scopes: RefScope[] = ref.scope ? [ref.scope] : [\"project\", \"global\"];\n\n  for (const scope of scopes) {\n    const value = getSecret(ref.key, {\n      ...opts,\n      scope,\n      env: ref.env ?? opts.env,\n    });\n    if (value !== null) return value;\n  }\n  return null;\n}\n\nexport interface ResolvedRefMap {\n  /** Env map with every qring:// value replaced by its resolved secret. */\n  resolved: Record<string, string>;\n  /** Values that resolved from the keyring (for redaction). */\n  secretValues: string[];\n  /** Refs whose key was not found in any addressed scope. */\n  missing: { name: string; ref: SecretRef }[];\n}\n\n/**\n * Resolve every qring:// value in an env map. Non-ref values pass through\n * untouched; malformed refs throw (see parseRef).\n */\nexport function resolveRefsInMap(\n  map: Record<string, string>,\n  opts: ResolveRefOptions = {},\n): ResolvedRefMap {\n  const resolved: Record<string, string> = {};\n  const secretValues: string[] = [];\n  const missing: { name: string; ref: SecretRef }[] = [];\n\n  for (const [name, value] of Object.entries(map)) {\n    if (!isRef(value)) {\n      resolved[name] = value;\n      continue;\n    }\n    const ref = parseRef(value);\n    const secret = resolveRef(ref, opts);\n    if (secret === null) {\n      missing.push({ name, ref });\n      continue;\n    }\n    resolved[name] = secret;\n    secretValues.push(secret);\n  }\n\n  return { resolved, secretValues, missing };\n}\n","/**\n * `qring setup <editor>` — wire the q-ring MCP server into an editor's\n * MCP config with one command, instead of hand-editing JSON.\n *\n * Writes the same server entry the bundled plugins ship (cursor-plugin/,\n * kiro-plugin/, claude-code-plugin/), merged non-destructively into the\n * editor's existing config: other servers are preserved, and an existing\n * q-ring entry is only replaced with --force.\n */\n\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, join } from \"node:path\";\n\nexport type Editor = \"cursor\" | \"kiro\" | \"claude\";\n\nexport const EDITORS: Editor[] = [\"cursor\", \"kiro\", \"claude\"];\n\n/** MCP tools that are safe to auto-approve (read-only) — mirrors kiro-plugin/mcp.json. */\nconst READ_ONLY_TOOLS = [\n  \"list_secrets\",\n  \"has_secret\",\n  \"inspect_secret\",\n  \"detect_environment\",\n  \"get_project_context\",\n  \"list_providers\",\n  \"list_hooks\",\n  \"get_policy_summary\",\n  \"audit_log\",\n  \"verify_audit_chain\",\n  \"health_check\",\n  \"analyze_secrets\",\n];\n\nexport interface SetupOptions {\n  editor: Editor;\n  /** Write the per-user config instead of the per-project one. */\n  global?: boolean;\n  projectPath?: string;\n  /** Replace an existing q-ring entry that differs from ours. */\n  force?: boolean;\n  dryRun?: boolean;\n}\n\nexport interface SetupResult {\n  editor: Editor;\n  configPath: string;\n  serverName: string;\n  action: \"created\" | \"updated\" | \"unchanged\";\n  dryRun: boolean;\n  warnings: string[];\n}\n\nconst SERVER_NAME = \"q-ring\";\n\nfunction serverEntry(editor: Editor): Record<string, unknown> {\n  switch (editor) {\n    case \"cursor\":\n      return { command: \"qring-mcp\", args: [], env: {} };\n    case \"kiro\":\n      return {\n        command: \"qring-mcp\",\n        args: [],\n        env: {},\n        disabled: false,\n        autoApprove: READ_ONLY_TOOLS,\n      };\n    case \"claude\":\n      return { type: \"stdio\", command: \"qring-mcp\", args: [], env: {} };\n  }\n}\n\nexport function configPathFor(\n  editor: Editor,\n  global: boolean,\n  projectPath: string,\n): string {\n  const home = homedir();\n  switch (editor) {\n    case \"cursor\":\n      return global\n        ? join(home, \".cursor\", \"mcp.json\")\n        : join(projectPath, \".cursor\", \"mcp.json\");\n    case \"kiro\":\n      return global\n        ? join(home, \".kiro\", \"settings\", \"mcp.json\")\n        : join(projectPath, \".kiro\", \"settings\", \"mcp.json\");\n    case \"claude\":\n      if (global) {\n        // ~/.claude.json is harness-managed state, not a config file we\n        // should merge into. User-scoped registration goes through the CLI.\n        throw new Error(\n          \"Claude Code user-scoped MCP servers are registered via the claude CLI, not a config file.\\n\" +\n            \"Run: claude mcp add --scope user q-ring qring-mcp\\n\" +\n            \"Or install the plugin: /plugin marketplace add I4cTime/q-ring && /plugin install qring@q-ring\",\n        );\n      }\n      return join(projectPath, \".mcp.json\");\n  }\n}\n\nexport function setupEditor(opts: SetupOptions): SetupResult {\n  const projectPath = opts.projectPath ?? process.cwd();\n  const configPath = configPathFor(opts.editor, opts.global ?? false, projectPath);\n  const warnings: string[] = [];\n\n  let config: Record<string, unknown> = {};\n  if (existsSync(configPath)) {\n    const raw = readFileSync(configPath, \"utf8\");\n    try {\n      config = JSON.parse(raw) as Record<string, unknown>;\n    } catch {\n      throw new Error(\n        `${configPath} exists but is not valid JSON — fix or remove it, then re-run.`,\n      );\n    }\n  }\n\n  const servers = (config.mcpServers ?? {}) as Record<string, unknown>;\n  const desired = serverEntry(opts.editor);\n  const existing = servers[SERVER_NAME];\n\n  let action: SetupResult[\"action\"];\n  if (existing === undefined) {\n    action = existsSync(configPath) ? \"updated\" : \"created\";\n    servers[SERVER_NAME] = desired;\n  } else if (JSON.stringify(existing) === JSON.stringify(desired)) {\n    action = \"unchanged\";\n  } else if (opts.force) {\n    action = \"updated\";\n    servers[SERVER_NAME] = desired;\n  } else {\n    action = \"unchanged\";\n    warnings.push(\n      `A different \"${SERVER_NAME}\" entry already exists in ${configPath} — left as-is (use --force to replace it).`,\n    );\n  }\n\n  config.mcpServers = servers;\n\n  if (action !== \"unchanged\" && !opts.dryRun) {\n    mkdirSync(dirname(configPath), { recursive: true });\n    writeFileSync(configPath, JSON.stringify(config, null, 2) + \"\\n\");\n  }\n\n  return {\n    editor: opts.editor,\n    configPath,\n    serverName: SERVER_NAME,\n    action,\n    dryRun: opts.dryRun ?? false,\n    warnings,\n  };\n}\n","/**\n * `qring push` — bridge secrets out to deployment platforms.\n *\n * Pushes keyring secrets to GitHub Actions, Vercel, Cloudflare Workers,\n * fly.io, Railway, or Netlify through each platform's OWN authenticated CLI\n * (gh / vercel / wrangler / flyctl / railway / netlify). q-ring never holds\n * platform tokens, and secret values travel over the child's stdin — never\n * argv, which is world-readable via /proc — or, for CLIs that can only read\n * a file, through a 0600 temp file under a 0700 mkdtemp dir that is removed\n * the moment the CLI exits.\n *\n * Which keys move is the project's declared contract: the .q-ring.json\n * secrets manifest by default, or an explicit --keys list. Every pushed key\n * is written to the audit chain as a \"push\" event (deliberate egress is\n * exactly what an audit log is for).\n */\n\nimport { spawnSync } from \"node:child_process\";\nimport { mkdtempSync, rmSync, writeFileSync } from \"node:fs\";\nimport { tmpdir } from \"node:os\";\nimport { join } from \"node:path\";\nimport { resolveRef } from \"./refs.js\";\nimport { readProjectConfig } from \"./collapse.js\";\nimport { logAudit } from \"./observer.js\";\nimport type { KeyringOptions } from \"./keyring.js\";\n\nexport type PushTarget = \"github\" | \"vercel\" | \"cloudflare\" | \"fly\" | \"railway\" | \"netlify\";\n\nexport const PUSH_TARGETS: PushTarget[] = [\n  \"github\",\n  \"vercel\",\n  \"cloudflare\",\n  \"fly\",\n  \"railway\",\n  \"netlify\",\n];\n\nexport interface PushOptions extends KeyringOptions {\n  target: PushTarget;\n  /** Explicit keys; default is every key in the .q-ring.json manifest. */\n  keys?: string[];\n  /** GitHub repo (owner/name); default is the repo of the current directory. */\n  repo?: string;\n  /** Vercel environments to push to (production, preview, development). */\n  vercelEnvs?: string[];\n  /** fly.io app name; default is the app in ./fly.toml. */\n  app?: string;\n  /** Railway service (name or ID); default is the linked service. */\n  service?: string;\n  /** Railway environment (name or ID); default is the linked environment. */\n  railwayEnv?: string;\n  /** Netlify site (name or ID); default is the linked site. */\n  site?: string;\n  dryRun?: boolean;\n  /**\n   * Values to push for specific keys WITHOUT reading them from the keyring.\n   * Used by `qring canary plant --push`: reading a freshly planted canary\n   * would trip it. Internal to the CLI — never reachable over MCP.\n   */\n  presetValues?: Record<string, string>;\n  /** Audit these keys as canaries (detail text only). */\n  canaryKeys?: string[];\n}\n\nexport interface PushResult {\n  target: PushTarget;\n  /** Keys that were (or with dryRun, would be) pushed. */\n  pushed: string[];\n  /** Keys the platform CLI rejected, with its stderr. */\n  failed: { key: string; error: string }[];\n  /** Keys not found in the keyring — skipped, reported, non-fatal. */\n  missing: string[];\n}\n\ninterface TargetCommand {\n  binary: string;\n  /**\n   * argv for pushing one key. The value is never in it: it arrives on stdin\n   * (see `stdin`), or — for CLIs that only read files — via `file`, whose\n   * 0600 temp path is passed here as `secretFile`.\n   */\n  args(key: string, opts: PushOptions, secretFile?: string): string[][];\n  /** What the child reads on stdin. Default: the raw value. */\n  stdin?(key: string, value: string): string;\n  /**\n   * Content of a 0600 temp file the CLI consumes (a dotenv line). Set only\n   * for CLIs with no stdin path at all; the file is removed in a `finally`.\n   */\n  file?(key: string, value: string): string;\n  installHint: string;\n}\n\n/**\n * fly's `secrets import` parser (internal/command/secrets/parser.go) cuts an\n * unquoted value at the first `#` and strips surrounding quotes; a\n * triple-quoted value is taken verbatim, newlines included. Random secrets\n * contain `#` often enough that quoting is not optional.\n */\nfunction flyImportLine(key: string, value: string): string {\n  return `${key}=\"\"\"${value}\"\"\"\\n`;\n}\n\n/**\n * One line the `dotenv` parser (which `netlify env:import` uses) reads back\n * exactly. Single quotes are literal in dotenv, so they are the default; a\n * value that itself contains `'` falls back to double quotes (where only the\n * escapes `\\n`/`\\r` expand), and only a value that has both quote kinds or a\n * newline goes out raw (where `#` starts a comment).\n */\nfunction dotenvLine(key: string, value: string): string {\n  if (!/['\\r\\n]/.test(value)) return `${key}='${value}'\\n`;\n  if (!/[\"\\r\\n]/.test(value) && !/\\\\[nr]/.test(value)) return `${key}=\"${value}\"\\n`;\n  return `${key}=${value}\\n`;\n}\n\nconst TARGETS: Record<PushTarget, TargetCommand> = {\n  github: {\n    binary: \"gh\",\n    args: (key, opts) => [[\"secret\", \"set\", key, ...(opts.repo ? [\"--repo\", opts.repo] : [])]],\n    installHint: \"install the GitHub CLI: https://cli.github.com (then `gh auth login`)\",\n  },\n  vercel: {\n    binary: \"vercel\",\n    // One invocation per environment — `vercel env add` takes a single target.\n    args: (key, opts) =>\n      (opts.vercelEnvs ?? [\"production\"]).map((env) => [\"env\", \"add\", key, env, \"--force\"]),\n    installHint: \"install the Vercel CLI: npm i -g vercel (then `vercel link` in the project)\",\n  },\n  cloudflare: {\n    binary: \"wrangler\",\n    args: (key) => [[\"secret\", \"put\", key]],\n    installHint: \"install Wrangler: npm i -g wrangler (then `wrangler login`)\",\n  },\n  fly: {\n    binary: \"flyctl\",\n    // `flyctl secrets set KEY=VALUE` is argv-only; `secrets import` reads\n    // NAME=VALUE lines from stdin instead, so the key travels there too.\n    args: (_key, opts) => [[\"secrets\", \"import\", ...(opts.app ? [\"--app\", opts.app] : [])]],\n    stdin: flyImportLine,\n    installHint: \"install flyctl: https://fly.io/docs/flyctl/install/ (then `flyctl auth login`)\",\n  },\n  railway: {\n    binary: \"railway\",\n    // Railway CLI >= 4 reads the value from stdin with `variable set KEY --stdin`\n    // (trailing newline trimmed); `--set KEY=VALUE` is the argv-only legacy form.\n    args: (key, opts) => [\n      [\n        \"variable\",\n        \"set\",\n        key,\n        \"--stdin\",\n        ...(opts.service ? [\"--service\", opts.service] : []),\n        ...(opts.railwayEnv ? [\"--environment\", opts.railwayEnv] : []),\n      ],\n    ],\n    installHint: \"install the Railway CLI: https://docs.railway.com/guides/cli (then `railway login`)\",\n  },\n  netlify: {\n    binary: \"netlify\",\n    // `netlify env:set KEY VALUE` is argv-only and the CLI reads nothing from\n    // stdin, so the value goes through a 0600 dotenv temp file consumed by\n    // `env:import <file>` (which merges into the site's existing variables,\n    // in every deploy context — env:import has no --context flag).\n    args: (_key, opts, secretFile) => [\n      [\"env:import\", secretFile ?? \"\", ...(opts.site ? [\"--site\", opts.site] : [])],\n    ],\n    file: dotenvLine,\n    installHint:\n      \"install the Netlify CLI: https://docs.netlify.com/cli/get-started/ (then `netlify login` and `netlify link`)\",\n  },\n};\n\nfunction binaryAvailable(binary: string): boolean {\n  const probe = spawnSync(binary, [\"--version\"], { stdio: \"ignore\", shell: false });\n  return !probe.error;\n}\n\n/**\n * Run `fn` with a 0600 file holding `content`, inside a fresh 0700 mkdtemp\n * dir under os.tmpdir(); the whole dir is removed afterwards, success or not.\n */\nfunction withSecretFile<T>(content: string, fn: (path: string) => T): T {\n  const dir = mkdtempSync(join(tmpdir(), \"qring-push-\"));\n  try {\n    const file = join(dir, \"secret.env\");\n    writeFileSync(file, content, { mode: 0o600, flag: \"wx\" });\n    return fn(file);\n  } finally {\n    rmSync(dir, { recursive: true, force: true });\n  }\n}\n\n/** Where the push landed, for the audit detail text. */\nfunction destination(opts: PushOptions): string {\n  const where = opts.repo ?? opts.app ?? opts.site ?? opts.service;\n  return where ? ` (${where})` : \"\";\n}\n\n/** Resolve which keys a push covers: explicit list, else the manifest. */\nexport function resolvePushKeys(opts: PushOptions): string[] {\n  if (opts.keys?.length) return opts.keys;\n  const config = readProjectConfig(opts.projectPath);\n  const manifestKeys = Object.keys(config?.secrets ?? {});\n  if (manifestKeys.length === 0) {\n    throw new Error(\n      \"Nothing to push: no --keys given and no secrets manifest in .q-ring.json. \" +\n        \"Declare the project's secrets there or pass --keys KEY1,KEY2.\",\n    );\n  }\n  return manifestKeys;\n}\n\nexport function pushSecrets(opts: PushOptions): PushResult {\n  const target = TARGETS[opts.target];\n  const keys = resolvePushKeys(opts);\n\n  if (!opts.dryRun && !binaryAvailable(target.binary)) {\n    throw new Error(`\"${target.binary}\" CLI not found — ${target.installHint}`);\n  }\n\n  const result: PushResult = { target: opts.target, pushed: [], failed: [], missing: [] };\n\n  for (const key of keys) {\n    const preset = opts.presetValues?.[key];\n    const value =\n      preset !== undefined\n        ? preset\n        : resolveRef(\n            { key, raw: `push:${key}` },\n            {\n              projectPath: opts.projectPath,\n              env: opts.env,\n              source: opts.source ?? \"cli\",\n              silent: opts.silent,\n            },\n          );\n    if (value === null) {\n      result.missing.push(key);\n      continue;\n    }\n\n    if (opts.dryRun) {\n      result.pushed.push(key);\n      continue;\n    }\n\n    // File-fed CLIs get nothing on stdin; the value lives only in the temp file.\n    const input = target.file ? \"\" : (target.stdin?.(key, value) ?? value);\n    const invoke = (secretFile?: string): string | null => {\n      for (const args of target.args(key, opts, secretFile)) {\n        const child = spawnSync(target.binary, args, {\n          input,\n          cwd: opts.projectPath,\n          encoding: \"utf8\",\n          shell: false,\n        });\n        if (child.status !== 0) {\n          return child.stderr?.trim() || child.error?.message || `exit ${child.status}`;\n        }\n      }\n      return null;\n    };\n    const failedInvocation = target.file\n      ? withSecretFile(target.file(key, value), invoke)\n      : invoke();\n\n    if (failedInvocation) {\n      result.failed.push({ key, error: failedInvocation });\n      continue;\n    }\n\n    result.pushed.push(key);\n    if (!opts.silent) {\n      logAudit({\n        action: \"push\",\n        key,\n        env: opts.env,\n        source: opts.source ?? \"cli\",\n        detail: `${opts.canaryKeys?.includes(key) ? \"canary honeytoken \" : \"\"}pushed to ${opts.target}${destination(opts)}`,\n      });\n    }\n  }\n\n  return result;\n}\n","import type { Command } from \"commander\";\nimport { runCommand, buildRunPlan, type RunOptions } from \"../../core/run.js\";\nimport { setupEditor, EDITORS, type Editor } from \"../../core/setup.js\";\nimport { pushSecrets, PUSH_TARGETS, type PushTarget } from \"../../core/push.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { wantsJsonOutput } from \"../helpers.js\";\n\nexport function registerBridgeCommands(program: Command): void {\n  program\n    .command(\"run <command...>\")\n    .description(\n      \"Run a command with only declared secrets injected — .q-ring.json manifest keys plus qring:// refs from .env (output auto-redacted)\",\n    )\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Environment context\")\n    .option(\"--env-file <files...>\", \"Env file(s) to load (default: ./.env when present)\")\n    .option(\"--no-manifest\", \"Skip .q-ring.json manifest keys\")\n    .option(\"--profile <name>\", \"Exec profile: unrestricted, restricted, ci\")\n    .option(\"--strict\", \"Missing optional manifest keys are fatal too\")\n    .option(\"--dry-run\", \"Show what would be injected without running\")\n    .action(async (commandArgs: string[], cmd) => {\n      const opts: RunOptions = {\n        command: commandArgs[0],\n        args: commandArgs.slice(1),\n        projectPath: cmd.projectPath ?? process.cwd(),\n        env: cmd.env,\n        envFiles: cmd.envFile,\n        useManifest: cmd.manifest !== false,\n        profile: cmd.profile,\n        strict: cmd.strict === true,\n        source: \"cli\",\n      };\n\n      try {\n        if (cmd.dryRun) {\n          const plan = buildRunPlan({ ...opts, silent: true });\n          console.log(`\\n${SYMBOLS.zap} ${c.bold(\"qring run\")} ${c.dim(\"(dry run)\")}`);\n          if (plan.envFiles.length > 0) {\n            console.log(`  Env files: ${plan.envFiles.map((f) => c.cyan(f)).join(\", \")}`);\n          }\n          for (const v of plan.injected) {\n            console.log(`  ${c.green(SYMBOLS.check)} ${v.name} ${c.dim(`(${v.source})`)}`);\n          }\n          for (const name of plan.missingOptional) {\n            console.log(`  ${c.yellow(\"?\")} ${name} ${c.dim(\"(optional, missing)\")}`);\n          }\n          for (const name of plan.missingRequired) {\n            console.log(`  ${c.red(SYMBOLS.cross)} ${name} ${c.dim(\"(required, MISSING)\")}`);\n          }\n          process.exit(plan.missingRequired.length > 0 ? 1 : 0);\n        }\n\n        const { code, plan } = await runCommand(opts);\n        if (plan.missingOptional.length > 0) {\n          console.error(\n            c.yellow(\n              `${SYMBOLS.warning} Optional secrets not found: ${plan.missingOptional.join(\", \")}`,\n            ),\n          );\n        }\n        process.exit(code);\n      } catch (err) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Run failed: ${err instanceof Error ? err.message : String(err)}`,\n          ),\n        );\n        process.exit(1);\n      }\n    });\n\n  program\n    .command(\"push <target>\")\n    .description(\n      `Push manifest secrets to a deployment platform via its own CLI (${PUSH_TARGETS.join(\", \")}) — values travel over stdin, never argv`,\n    )\n    .option(\"-k, --keys <keys>\", \"Comma-separated keys (default: .q-ring.json manifest)\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"-e, --env <env>\", \"Environment context for superposition collapse\")\n    .option(\"--repo <owner/name>\", \"GitHub repository (github target)\")\n    .option(\n      \"--vercel-env <envs>\",\n      \"Comma-separated Vercel environments (vercel target; default: production)\",\n    )\n    .option(\"--app <name>\", \"fly.io app (fly target; default: the app in fly.toml)\")\n    .option(\"--service <name>\", \"Railway service name or ID (railway target; default: linked service)\")\n    .option(\n      \"--railway-env <name>\",\n      \"Railway environment name or ID (railway target; default: linked environment)\",\n    )\n    .option(\"--site <id>\", \"Netlify site name or ID (netlify target; default: linked site)\")\n    .option(\"--dry-run\", \"Show what would be pushed without pushing\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((targetArg: string, cmd) => {\n      if (!PUSH_TARGETS.includes(targetArg as PushTarget)) {\n        console.error(\n          c.red(`${SYMBOLS.cross} Unknown target \"${targetArg}\" — expected one of: ${PUSH_TARGETS.join(\", \")}`),\n        );\n        process.exit(1);\n      }\n\n      try {\n        const result = pushSecrets({\n          target: targetArg as PushTarget,\n          keys: cmd.keys?.split(\",\").map((k: string) => k.trim()),\n          projectPath: cmd.projectPath ?? process.cwd(),\n          env: cmd.env,\n          repo: cmd.repo,\n          vercelEnvs: cmd.vercelEnv?.split(\",\").map((e: string) => e.trim()),\n          app: cmd.app,\n          service: cmd.service,\n          railwayEnv: cmd.railwayEnv,\n          site: cmd.site,\n          dryRun: cmd.dryRun === true,\n          source: \"cli\",\n        });\n\n        if (wantsJsonOutput(program, cmd)) {\n          console.log(JSON.stringify(result, null, 2));\n          process.exit(result.failed.length > 0 ? 1 : 0);\n        }\n\n        const prefix = cmd.dryRun ? c.dim(\"[dry-run] \") : \"\";\n        console.log(`\\n${SYMBOLS.link} ${prefix}${c.bold(`qring push ${targetArg}`)}`);\n        for (const key of result.pushed) {\n          console.log(`  ${c.green(SYMBOLS.check)} ${key}`);\n        }\n        for (const key of result.missing) {\n          console.log(`  ${c.yellow(\"?\")} ${key} ${c.dim(\"(not in keyring — skipped)\")}`);\n        }\n        for (const { key, error } of result.failed) {\n          console.log(`  ${c.red(SYMBOLS.cross)} ${key} ${c.dim(`— ${error}`)}`);\n        }\n        console.log(\n          c.dim(\n            `  ${result.pushed.length} pushed${cmd.dryRun ? \" (dry run)\" : \"\"}, ${result.missing.length} missing, ${result.failed.length} failed`,\n          ),\n        );\n        process.exit(result.failed.length > 0 ? 1 : 0);\n      } catch (err) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Push failed: ${err instanceof Error ? err.message : String(err)}`,\n          ),\n        );\n        process.exit(1);\n      }\n    });\n\n  program\n    .command(\"setup <editor>\")\n    .description(\n      `Wire the q-ring MCP server into an editor's MCP config (${EDITORS.join(\", \")})`,\n    )\n    .option(\"-g, --global\", \"Write the per-user config instead of the project one\")\n    .option(\"--project-path <path>\", \"Explicit project path\")\n    .option(\"--force\", \"Replace an existing q-ring entry that differs\")\n    .option(\"--dry-run\", \"Show what would change without writing\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((editor: string, cmd) => {\n      if (!EDITORS.includes(editor as Editor)) {\n        console.error(\n          c.red(`${SYMBOLS.cross} Unknown editor \"${editor}\" — expected one of: ${EDITORS.join(\", \")}`),\n        );\n        process.exit(1);\n      }\n\n      try {\n        const result = setupEditor({\n          editor: editor as Editor,\n          global: cmd.global === true,\n          projectPath: cmd.projectPath ?? process.cwd(),\n          force: cmd.force === true,\n          dryRun: cmd.dryRun === true,\n        });\n\n        if (wantsJsonOutput(program, cmd)) {\n          console.log(JSON.stringify(result, null, 2));\n          return;\n        }\n\n        const verb =\n          result.action === \"created\" ? \"Created\" :\n          result.action === \"updated\" ? \"Updated\" : \"Already configured\";\n        const prefix = result.dryRun ? c.dim(\"[dry-run] \") : \"\";\n        console.log(\n          `\\n${SYMBOLS.check} ${prefix}${c.bold(verb)}: ${c.cyan(result.configPath)} ${c.dim(`(server \"${result.serverName}\")`)}`,\n        );\n        for (const warning of result.warnings) {\n          console.log(`  ${c.yellow(\"!\")} ${warning}`);\n        }\n        if (result.action !== \"unchanged\") {\n          console.log(c.dim(`  Restart ${editor} to pick up the MCP server. Verify with: qring doctor`));\n        }\n      } catch (err) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Setup failed: ${err instanceof Error ? err.message : String(err)}`,\n          ),\n        );\n        process.exit(1);\n      }\n    });\n}\n","/**\n * Canary honeytokens.\n *\n * A canary is a fake credential planted in the ring. It stores and reads like\n * any other secret — that is the point: an agent, a compromised MCP server, or\n * exfiltrated tooling that sweeps the ring cannot tell it apart. The moment\n * anything reads it, the trip hook in keyring.ts fires a \"canary\" audit event\n * and a loud desktop alert (see canary-alert.ts).\n *\n * Values imitate real provider token shapes so they survive casual inspection\n * and secret-scanners' entropy heuristics. They are pure CSPRNG noise — never\n * valid credentials.\n */\n\nimport { randomInt } from \"node:crypto\";\nimport { generateSecret } from \"./noise.js\";\nimport {\n  setSecret,\n  listSecrets,\n  getEnvelope,\n  disarmCanary as clearCanaryFlag,\n  type KeyringOptions,\n} from \"./keyring.js\";\nimport type { Scope } from \"./scope.js\";\nimport { isPlaceholderValue } from \"./secrets-detect.js\";\n\nexport interface CanaryFormat {\n  /** Provider name shown in `canary list` */\n  name: string;\n  description: string;\n  generate(): string;\n}\n\nconst ALNUM = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789\";\nconst UPPER_NUM = \"ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789\";\nconst BASE64 = ALNUM + \"+/\";\nconst URLSAFE = ALNUM + \"_-\";\nconst DIGITS = \"0123456789\";\n\nfunction pick(charset: string, length: number): string {\n  let out = \"\";\n  for (let i = 0; i < length; i++) out += charset[randomInt(charset.length)];\n  return out;\n}\n\n/**\n * CSPRNG noise occasionally spells a placeholder marker (\"xxx\" turns up in a\n * 74-char body roughly once every few hundred draws), and `scan` would then\n * report the planted canary as a placeholder instead of a secret. Regenerate\n * until the value reads as a real token to the same heuristic scan uses.\n */\nfunction dodgingPlaceholders(generate: () => string): () => string {\n  return () => {\n    for (let attempt = 0; attempt < 32; attempt++) {\n      const value = generate();\n      if (!isPlaceholderValue(value)) return value;\n    }\n    throw new Error(\"canary generator kept producing placeholder-like values\");\n  };\n}\n\n/**\n * Token shapes per provider. Prefixes match the liveness-provider registry in\n * validate.ts so a canary auto-detects like the real thing; body length and\n * charset track each issuer's current format closely enough to pass shape\n * checks and secret-scanner heuristics (the AWS body satisfies validate.ts's\n * /^(AKIA|ASIA)[A-Z0-9]{16}$/). Every value is CSPRNG noise — never valid.\n */\nexport const CANARY_FORMATS: Record<string, CanaryFormat> = {\n  aws: {\n    name: \"aws\",\n    description: \"AWS access key id (AKIA…)\",\n    generate: dodgingPlaceholders(() => `AKIA${pick(UPPER_NUM, 16)}`),\n  },\n  \"aws-secret\": {\n    name: \"aws-secret\",\n    description: \"AWS secret access key (40-char base64)\",\n    generate: dodgingPlaceholders(() => pick(BASE64, 40)),\n  },\n  github: {\n    name: \"github\",\n    description: \"GitHub classic personal access token (ghp_…)\",\n    generate: dodgingPlaceholders(() => `ghp_${pick(ALNUM, 36)}`),\n  },\n  \"github-pat\": {\n    name: \"github-pat\",\n    description: \"GitHub fine-grained personal access token (github_pat_…)\",\n    generate: dodgingPlaceholders(() => `github_pat_${pick(ALNUM, 22)}_${pick(ALNUM, 59)}`),\n  },\n  openai: {\n    name: \"openai\",\n    description: \"OpenAI API key (sk-…)\",\n    generate: dodgingPlaceholders(() => `sk-${pick(ALNUM, 48)}`),\n  },\n  \"openai-project\": {\n    name: \"openai-project\",\n    description: \"OpenAI project API key (sk-proj-…)\",\n    generate: dodgingPlaceholders(() => `sk-proj-${pick(URLSAFE, 74)}T3BlbkFJ${pick(URLSAFE, 74)}`),\n  },\n  anthropic: {\n    name: \"anthropic\",\n    description: \"Anthropic API key (sk-ant-api03-…)\",\n    generate: dodgingPlaceholders(() => `sk-ant-api03-${pick(URLSAFE, 91)}AA`),\n  },\n  stripe: {\n    name: \"stripe\",\n    description: \"Stripe live secret key (sk_live_…)\",\n    generate: dodgingPlaceholders(() => `sk_live_${pick(ALNUM, 24)}`),\n  },\n  gitlab: {\n    name: \"gitlab\",\n    description: \"GitLab personal access token (glpat-…)\",\n    generate: dodgingPlaceholders(() => `glpat-${pick(URLSAFE, 20)}`),\n  },\n  slack: {\n    name: \"slack\",\n    description: \"Slack bot token (xoxb-…)\",\n    generate: dodgingPlaceholders(() => `xoxb-${pick(DIGITS, 12)}-${pick(DIGITS, 13)}-${pick(ALNUM, 24)}`),\n  },\n  google: {\n    name: \"google\",\n    description: \"Google API key (AIza…)\",\n    generate: dodgingPlaceholders(() => `AIza${pick(URLSAFE, 35)}`),\n  },\n  npm: {\n    name: \"npm\",\n    description: \"npm access token (npm_…)\",\n    generate: dodgingPlaceholders(() => `npm_${pick(ALNUM, 36)}`),\n  },\n  generic: {\n    name: \"generic\",\n    description: \"Generic high-entropy API key\",\n    generate: dodgingPlaceholders(() => generateSecret({ format: \"api-key\", prefix: \"qk_\", length: 40 })),\n  },\n};\n\nexport const DEFAULT_CANARY_FORMAT = \"generic\";\n\nexport interface PlantResult {\n  key: string;\n  value: string;\n  format: string;\n  scope: Scope;\n}\n\nexport interface PlantOptions extends KeyringOptions {\n  /** Which provider's token shape to imitate (default \"generic\") */\n  format?: string;\n  /** Use this exact value instead of generating one */\n  value?: string;\n  /**\n   * Optional cover description. Deliberately NOT auto-filled: a description\n   * like \"Canary honeytoken\" is readable via inspect_secret and would let an\n   * attacker enumerate the tripwires without touching them. No description\n   * (or an operator-chosen innocuous one) leaves no tell.\n   */\n  description?: string;\n  /** Allow replacing an existing NON-canary secret at this key */\n  force?: boolean;\n}\n\n/**\n * Plant a canary honeytoken under `key`. Refuses to overwrite an existing\n * real (non-canary) secret in the target scope unless `force` is set — the\n * guard lives here, not in the CLI, so no programmatic caller can clobber a\n * real credential by accident. Replanting over an existing canary is always\n * allowed.\n */\nexport function plantCanary(key: string, opts: PlantOptions = {}): PlantResult {\n  const formatName = opts.format ?? DEFAULT_CANARY_FORMAT;\n  const format = CANARY_FORMATS[formatName];\n  if (!format) {\n    throw new Error(\n      `Unknown canary format \"${formatName}\". Available: ${Object.keys(CANARY_FORMATS).join(\", \")}`,\n    );\n  }\n\n  const value = opts.value ?? format.generate();\n  const scope = opts.scope ?? \"global\";\n\n  // Check the exact scope this plant will write to (not the whole resolution\n  // chain — a project-scope real secret must not block a global plant).\n  const existing = getEnvelope(key, { ...opts, scope });\n  if (existing && !existing.envelope.meta.canary && !opts.force) {\n    throw new Error(\n      `\"${key}\" already holds a real secret in ${scope} scope. Use --force to replace it with a canary.`,\n    );\n  }\n  setSecret(key, value, {\n    ...opts,\n    scope,\n    canary: true,\n    canaryFormat: formatName,\n    description: opts.description,\n  });\n\n  return { key, value, format: formatName, scope };\n}\n\nexport interface CanaryStatus {\n  key: string;\n  scope: Scope;\n  format?: string;\n  plantedAt: string;\n  /** Reads recorded on the envelope — every one of these was an alert */\n  tripCount: number;\n  lastTrippedAt?: string;\n}\n\n/**\n * Disarm a canary: clears the flag so reads stop alarming. The stored value\n * stays fake until overwritten. Returns false if the key exists but is not\n * a canary; throws if the key doesn't exist at all.\n */\nexport function disarmCanary(key: string, opts: KeyringOptions = {}): boolean {\n  const found = getEnvelope(key, opts);\n  if (!found) {\n    throw new Error(`\"${key}\" not found in any applicable scope`);\n  }\n  return clearCanaryFlag(key, { ...opts, scope: found.scope });\n}\n\n/** List all planted canaries across resolvable scopes, with trip stats. */\nexport function listCanaries(opts: KeyringOptions = {}): CanaryStatus[] {\n  const out: CanaryStatus[] = [];\n  for (const entry of listSecrets({ ...opts, silent: true })) {\n    const meta = entry.envelope?.meta;\n    if (!meta?.canary) continue;\n    out.push({\n      key: entry.key,\n      scope: entry.scope,\n      format: meta.canaryFormat,\n      plantedAt: meta.createdAt,\n      tripCount: meta.accessCount,\n      lastTrippedAt: meta.lastAccessedAt,\n    });\n  }\n  return out;\n}\n","import type { Command } from \"commander\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { buildOpts } from \"../options.js\";\nimport { emitJson } from \"../helpers.js\";\nimport {\n  plantCanary,\n  disarmCanary,\n  listCanaries,\n  CANARY_FORMATS,\n  DEFAULT_CANARY_FORMAT,\n} from \"../../core/canary.js\";\nimport { pushSecrets, PUSH_TARGETS, type PushTarget } from \"../../core/push.js\";\nimport {\n  addCanaryAlert,\n  listCanaryAlerts,\n  removeCanaryAlert,\n  setCanaryAlertEnabled,\n  sendCanaryAlerts,\n  describeAlertUrl,\n  type CanaryAlertType,\n} from \"../../core/canary-webhooks.js\";\n\nexport function registerCanaryCommands(program: Command): void {\n  const canary = program\n    .command(\"canary\")\n    .description(\"Honeytokens — fake credentials that raise the alarm on read\");\n\n  canary\n    .command(\"plant <key>\")\n    .description(\"Plant a fake credential; any read fires a loud alert\")\n    .option(\n      \"-f, --format <format>\",\n      `Token shape to imitate (${Object.keys(CANARY_FORMATS).join(\", \")})`,\n      DEFAULT_CANARY_FORMAT,\n    )\n    .option(\"--value <value>\", \"Plant this exact value instead of generating one\")\n    .option(\"--description <text>\", \"Cover description (none by default — no tell)\")\n    .option(\"--force\", \"Overwrite an existing non-canary secret at this key\")\n    .option(\n      \"--push <target>\",\n      `Also push the planted value to a deployment platform (${PUSH_TARGETS.join(\", \")}) so a leaked CI/deploy environment carries a tripwire`,\n    )\n    .option(\"--repo <owner/name>\", \"GitHub repository (with --push github)\")\n    .option(\"--vercel-env <envs>\", \"Comma-separated Vercel environments (with --push vercel)\")\n    .option(\"--json\", \"Output the plant result as JSON\")\n    .option(\"-g, --global\", \"Global scope (default)\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--team <id>\", \"Team scope\")\n    .option(\"--org <id>\", \"Org scope\")\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .action((key: string, cmd) => {\n      const pushTarget = cmd.push as string | undefined;\n      if (pushTarget && !PUSH_TARGETS.includes(pushTarget as PushTarget)) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Unknown push target \"${pushTarget}\" — expected one of: ${PUSH_TARGETS.join(\", \")}`,\n          ),\n        );\n        process.exit(1);\n      }\n\n      const opts = buildOpts(cmd);\n      const result = plantCanary(key, {\n        ...opts,\n        format: cmd.format,\n        value: cmd.value,\n        description: cmd.description,\n        force: cmd.force === true,\n      });\n\n      // Push the value we just generated — reading it back would trip it.\n      const push = pushTarget\n        ? pushSecrets({\n            target: pushTarget as PushTarget,\n            keys: [key],\n            presetValues: { [key]: result.value },\n            canaryKeys: [key],\n            projectPath: opts.projectPath ?? process.cwd(),\n            repo: cmd.repo,\n            vercelEnvs: cmd.vercelEnv?.split(\",\").map((e: string) => e.trim()),\n            source: \"cli\",\n          })\n        : undefined;\n\n      if (emitJson(program, cmd, { ...result, push })) {\n        if (push && push.failed.length > 0) process.exit(1);\n        return;\n      }\n\n      console.log(\n        `${SYMBOLS.sparkle} ${c.yellow(\"canary planted\")} ${c.bold(result.key)} ${c.dim(`(${result.format}, ${result.scope} scope)`)}`,\n      );\n      console.log(c.dim(`  value: ${result.value}`));\n      console.log(\n        c.dim(\"  Reads return this fake value and fire a desktop alert + a 'canary' audit event.\"),\n      );\n      console.log(c.dim(\"  Watch trips with: qring canary list · qring audit --action canary\"));\n      if (push) {\n        if (push.pushed.length > 0) {\n          console.log(\n            `${SYMBOLS.link} ${c.yellow(\"pushed\")} ${c.bold(key)} ${c.dim(`to ${push.target}${cmd.repo ? ` (${cmd.repo})` : \"\"}`)}`,\n          );\n          console.log(\n            c.dim(\n              \"  Caveat: q-ring only sees reads that go through q-ring. Someone using the leaked value on the platform side is not observable here — pair it with the provider's own alerting if you need that.\",\n            ),\n          );\n        }\n        for (const { error } of push.failed) {\n          console.error(c.red(`${SYMBOLS.cross} push to ${push.target} failed — ${error}`));\n        }\n        if (push.failed.length > 0) process.exit(1);\n      }\n    });\n\n  canary\n    .command(\"disarm <key>\")\n    .description(\"Clear the canary flag so reads stop alarming (value stays fake)\")\n    .option(\"-g, --global\", \"Global scope\")\n    .option(\"-p, --project\", \"Project scope\")\n    .option(\"--team <id>\", \"Team scope\")\n    .option(\"--org <id>\", \"Org scope\")\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .action((key: string, cmd) => {\n      if (disarmCanary(key, buildOpts(cmd))) {\n        console.log(\n          `${SYMBOLS.check} ${c.green(\"disarmed\")} ${c.bold(key)} ${c.dim(\"— now an ordinary secret; the stored value is still fake until you overwrite it\")}`,\n        );\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} \"${key}\" is not a canary`));\n        process.exit(1);\n      }\n    });\n\n  canary\n    .command(\"list\")\n    .alias(\"ls\")\n    .description(\"List planted canaries and their trip counts\")\n    .option(\"--json\", \"Output as JSON\")\n    .option(\"-g, --global\", \"Global scope only\")\n    .option(\"-p, --project\", \"Project scope only\")\n    .option(\"--team <id>\", \"Team scope\")\n    .option(\"--org <id>\", \"Org scope\")\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .action((cmd) => {\n      const canaries = listCanaries(buildOpts(cmd));\n      if (emitJson(program, cmd, { canaries })) return;\n\n      if (canaries.length === 0) {\n        console.log(\n          c.dim(\n            \"No canaries planted. Plant one: qring canary plant AWS_SECRET_ACCESS_KEY --format aws\",\n          ),\n        );\n        return;\n      }\n\n      console.log(c.bold(`\\n  ${SYMBOLS.eye} Canaries (${canaries.length})\\n`));\n      for (const entry of canaries) {\n        const parts = [c.bold(entry.key)];\n        parts.push(c.dim(`${entry.format ?? \"generic\"} · ${entry.scope}`));\n        if (entry.tripCount > 0) {\n          parts.push(c.red(`trips: ${entry.tripCount}`));\n          if (entry.lastTrippedAt) {\n            parts.push(c.red(`last: ${entry.lastTrippedAt}`));\n          }\n        } else {\n          parts.push(c.green(\"no trips\"));\n        }\n        console.log(`  ${SYMBOLS.eye} ${parts.join(\"  \")}`);\n      }\n      console.log();\n    });\n\n  const alert = canary\n    .command(\"alert\")\n    .description(\"Webhook channels that receive canary trips (Discord, Slack, ntfy, generic JSON)\");\n\n  alert\n    .command(\"add\")\n    .description(\"Register a webhook channel for canary trips\")\n    .option(\"--discord <url>\", \"Discord webhook URL\")\n    .option(\"--slack <url>\", \"Slack incoming-webhook URL\")\n    .option(\"--ntfy <url>\", \"ntfy topic URL (e.g. https://ntfy.sh/my-topic)\")\n    .option(\"--url <url>\", \"Generic endpoint — receives a JSON POST\")\n    .option(\"--description <text>\", \"Human-readable label\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const picked: [CanaryAlertType, string | undefined][] = [\n        [\"discord\", cmd.discord],\n        [\"slack\", cmd.slack],\n        [\"ntfy\", cmd.ntfy],\n        [\"generic\", cmd.url],\n      ];\n      const chosen = picked.filter(([, url]) => typeof url === \"string\");\n      if (chosen.length !== 1) {\n        console.error(\n          c.red(`${SYMBOLS.cross} Specify exactly one of --discord, --slack, --ntfy, or --url`),\n        );\n        process.exit(1);\n      }\n      const [type, url] = chosen[0];\n      const channel = addCanaryAlert({ type, url: url!, description: cmd.description });\n      if (emitJson(program, cmd, channel)) return;\n      console.log(\n        `${SYMBOLS.check} ${c.green(\"registered\")} canary alert ${c.bold(channel.id)} (${type}) ${c.dim(describeAlertUrl(channel.url))}`,\n      );\n      console.log(c.dim(`  Send a drill: qring canary alert test ${channel.id}`));\n    });\n\n  alert\n    .command(\"list\")\n    .alias(\"ls\")\n    .description(\"List canary alert channels\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const channels = listCanaryAlerts();\n      if (emitJson(program, cmd, { channels })) return;\n      if (channels.length === 0) {\n        console.log(\n          c.dim(\"No alert channels. Add one: qring canary alert add --discord <webhook-url>\"),\n        );\n        return;\n      }\n      console.log(c.bold(`\\n  ${SYMBOLS.eye} Canary alert channels (${channels.length})\\n`));\n      for (const ch of channels) {\n        const state = ch.enabled ? c.green(\"enabled\") : c.dim(\"disabled\");\n        const desc = ch.description ? c.dim(` — ${ch.description}`) : \"\";\n        console.log(\n          `  ${c.bold(ch.id)}  ${ch.type.padEnd(7)} ${state}  ${c.dim(describeAlertUrl(ch.url))}${desc}`,\n        );\n      }\n      console.log();\n    });\n\n  alert\n    .command(\"remove <id>\")\n    .alias(\"rm\")\n    .description(\"Remove an alert channel\")\n    .action((id: string) => {\n      if (removeCanaryAlert(id)) {\n        console.log(`${SYMBOLS.check} ${c.green(\"removed\")} canary alert ${c.bold(id)}`);\n      } else {\n        console.error(c.red(`${SYMBOLS.cross} No alert channel with id \"${id}\"`));\n        process.exit(1);\n      }\n    });\n\n  for (const [verb, enabled] of [\n    [\"enable\", true],\n    [\"disable\", false],\n  ] as const) {\n    alert\n      .command(`${verb} <id>`)\n      .description(`${verb === \"enable\" ? \"Enable\" : \"Disable\"} an alert channel`)\n      .action((id: string) => {\n        if (setCanaryAlertEnabled(id, enabled)) {\n          console.log(`${SYMBOLS.check} ${c.green(`${verb}d`)} canary alert ${c.bold(id)}`);\n        } else {\n          console.error(c.red(`${SYMBOLS.cross} No alert channel with id \"${id}\"`));\n          process.exit(1);\n        }\n      });\n  }\n\n  alert\n    .command(\"test [id]\")\n    .description(\"Send a clearly-labelled test message to every enabled channel (or one id)\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (id: string | undefined, cmd) => {\n      const results = await sendCanaryAlerts(\n        {\n          key: \"EXAMPLE_CANARY\",\n          scope: \"global\",\n          source: \"cli\",\n          agent: null,\n          detail: \"test message\",\n          timestamp: new Date().toISOString(),\n          test: true,\n        },\n        id,\n      );\n      if (emitJson(program, cmd, { results })) return;\n      if (results.length === 0) {\n        console.log(c.dim(id ? `No channel with id \"${id}\"` : \"No enabled alert channels\"));\n        process.exit(1);\n      }\n      for (const r of results) {\n        const mark = r.success ? c.green(SYMBOLS.check) : c.red(SYMBOLS.cross);\n        console.log(`  ${mark} ${c.bold(r.channelId)} ${r.type} ${c.dim(r.message)}`);\n      }\n      if (results.some((r) => !r.success)) process.exit(1);\n    });\n}\n","/**\n * MCP Airlock: `qring mcp wrap -- <server command>` / `qring mcp wrap --url`.\n *\n * Runs a third-party MCP server (a child process, or a remote Streamable\n * HTTP endpoint) and re-exposes it over stdio, sitting between the agent\n * host and the wrapped server:\n *\n *   agent host ── stdio ── [q-ring airlock] ── stdio | http ── wrapped server\n *\n * What the airlock adds:\n *\n * - Environment stripping: a spawned server gets the SDK's minimal safe\n *   environment, NOT the parent env — it can't read API keys out of\n *   `process.env` unless `--inherit-env` is passed. Hygiene, not a sandbox:\n *   the child still runs unconfined as the operator's user.\n * - A tamper-evident audit trail: every tool call, resource read, and prompt\n *   fetch crossing the airlock lands in the audit chain as a \"wrap\" action,\n *   grouped by a per-session correlation id and stamped with the connecting\n *   client's identity label. Tool ARGUMENTS and prompt arguments are\n *   deliberately not logged — they may contain secrets.\n * - Wrap policy (`.q-ring.json` → `policy.wrap`): per-tool allow/deny globs,\n *   tools that need a live `qring mcp approve` grant, and sliding-window rate\n *   limits. Denied tools are hidden from tools/list and refused on call.\n * - Result redaction: known secret values are scrubbed from tool results,\n *   resource contents, and prompt messages before they reach the transcript\n *   (see wrap-redact.ts). Policy `wrap.redactResults: false` or\n *   `--no-redact` turns it off.\n *\n * The proxy aims to be transparent to both sides: tools, resources, and\n * prompts forward verbatim (pagination, list_changed / updated notifications,\n * subscriptions included), progress notifications are relayed under the\n * host's own progress token, downstream protocol errors stay JSON-RPC\n * errors, and tool-execution failures surface as isError results. stdout is\n * the protocol channel — all diagnostics go to stderr.\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport { Server } from \"@modelcontextprotocol/sdk/server/index.js\";\nimport { StdioServerTransport } from \"@modelcontextprotocol/sdk/server/stdio.js\";\nimport { Client } from \"@modelcontextprotocol/sdk/client/index.js\";\nimport { StdioClientTransport } from \"@modelcontextprotocol/sdk/client/stdio.js\";\nimport { StreamableHTTPClientTransport } from \"@modelcontextprotocol/sdk/client/streamableHttp.js\";\nimport {\n  ListToolsRequestSchema,\n  CallToolRequestSchema,\n  ToolListChangedNotificationSchema,\n  ListResourcesRequestSchema,\n  ListResourceTemplatesRequestSchema,\n  ReadResourceRequestSchema,\n  SubscribeRequestSchema,\n  UnsubscribeRequestSchema,\n  ResourceListChangedNotificationSchema,\n  ResourceUpdatedNotificationSchema,\n  ListPromptsRequestSchema,\n  GetPromptRequestSchema,\n  PromptListChangedNotificationSchema,\n  McpError,\n  type CallToolResult,\n  type ServerCapabilities,\n} from \"@modelcontextprotocol/sdk/types.js\";\nimport { PACKAGE_VERSION } from \"../version.js\";\nimport { logAudit, setAuditAgentLabel } from \"./observer.js\";\nimport {\n  checkWrapToolPolicy,\n  wrapToolRequiresApproval,\n  getWrapRateLimit,\n  wrapRedactsResults,\n  setPolicyRoot,\n  type WrapRateLimit,\n} from \"./policy.js\";\nimport { hasApproval } from \"./approval.js\";\nimport { getSecret } from \"./keyring.js\";\nimport { hashProjectPath } from \"../utils/hash.js\";\nimport { createRedactor, NOOP_REDACTOR, type Redactor } from \"./wrap-redact.js\";\n\n/**\n * Ceiling on a single downstream tool call. Deliberately generous: the HOST\n * owns call deadlines (its cancellation propagates through the airlock), and\n * `resetTimeoutOnProgress` keeps actively-reporting tools alive — this only\n * reaps calls that are silent for the whole window. Override with\n * QRING_WRAP_TIMEOUT_MS.\n */\nconst DEFAULT_DOWNSTREAM_TIMEOUT_MS = 10 * 60 * 1000;\n\nfunction downstreamTimeoutMs(): number {\n  const raw = Number(process.env.QRING_WRAP_TIMEOUT_MS);\n  return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_DOWNSTREAM_TIMEOUT_MS;\n}\n\n/** Approval scope + service used for `qring mcp approve <tool>` grants. */\nexport const WRAP_APPROVAL_SCOPE = \"wrap\";\nexport function wrapApprovalService(projectPath: string): string {\n  return `q-ring:wrap:${hashProjectPath(projectPath)}`;\n}\n\nexport interface WrapOptions {\n  /** Server command to spawn (stdio downstream). Mutually exclusive with url. */\n  command?: string;\n  args?: string[];\n  /** Remote Streamable HTTP MCP endpoint (http downstream). */\n  url?: string;\n  /** Extra request headers for an http downstream, as \"Name: value\". */\n  headers?: string[];\n  /** q-ring key whose value is sent as `Authorization: Bearer …` (http). */\n  authSecret?: string;\n  /** Pass the full parent environment to the wrapped server (default: SDK safe env) */\n  inheritEnv?: boolean;\n  /** Label used in audit events (default: the wrapped command line / url) */\n  label?: string;\n  /** Scrub known secret values from results (default: policy, else on) */\n  redact?: boolean;\n  /** Project whose `.q-ring.json` policy governs the session (default: cwd) */\n  projectPath?: string;\n}\n\nexport interface WrapSession {\n  label: string;\n  correlationId: string;\n}\n\nexport interface AirlockOptions {\n  /** Project used for policy + approval resolution (default: cwd) */\n  projectPath?: string;\n  /** Result redactor (default: none — runWrap wires the real one) */\n  redactor?: Redactor;\n}\n\n/** Sliding-window per-tool call counter. */\nclass RateLimiter {\n  private readonly calls = new Map<string, number[]>();\n\n  /** Record a call; returns false when the window is already full. */\n  take(tool: string, limit: WrapRateLimit, now = Date.now()): boolean {\n    const windowStart = now - limit.perSeconds * 1000;\n    const recent = (this.calls.get(tool) ?? []).filter((t) => t > windowStart);\n    if (recent.length >= limit.maxCalls) {\n      this.calls.set(tool, recent);\n      return false;\n    }\n    recent.push(now);\n    this.calls.set(tool, recent);\n    return true;\n  }\n}\n\nfunction truncate(s: string, max = 200): string {\n  return s.length > max ? `${s.slice(0, max)}…` : s;\n}\n\n/**\n * Build the airlock proxy server around an already-connected downstream\n * client. Exported separately so tests can drive it over in-memory\n * transports without spawning processes.\n */\nexport function createAirlockServer(\n  downstream: Client,\n  session: WrapSession,\n  options: AirlockOptions = {},\n): Server {\n  const projectPath = options.projectPath ?? process.cwd();\n  const redactor = options.redactor ?? NOOP_REDACTOR;\n  const approvalService = wrapApprovalService(projectPath);\n  const limiter = new RateLimiter();\n\n  const downstreamInfo = downstream.getServerVersion();\n  const dsCaps = downstream.getServerCapabilities() ?? {};\n  const name = downstreamInfo ? `${downstreamInfo.name} (q-ring airlock)` : \"q-ring-airlock\";\n\n  // Advertise exactly what the wrapped server can do — a host that sees a\n  // resources capability and gets \"method not found\" would mark us broken.\n  const capabilities: ServerCapabilities = {};\n  if (dsCaps.tools) capabilities.tools = { listChanged: true };\n  if (dsCaps.resources) {\n    capabilities.resources = { listChanged: true, subscribe: !!dsCaps.resources.subscribe };\n  }\n  if (dsCaps.prompts) capabilities.prompts = { listChanged: true };\n\n  const proxy = new Server(\n    { name, version: PACKAGE_VERSION },\n    {\n      capabilities,\n      // Servers ship usage guidance in `instructions`; hosts inject it into\n      // the system prompt. Losing it would degrade the wrapped server.\n      instructions: downstream.getInstructions(),\n    },\n  );\n\n  // Feature synergy with per-agent identity: the agent host's clientInfo\n  // from OUR initialize handshake labels every audited call. Spoofable —\n  // audit metadata only, never authorization.\n  proxy.oninitialized = () => {\n    const info = proxy.getClientVersion();\n    if (info) setAuditAgentLabel(`${info.name}@${info.version}`);\n  };\n\n  const audit = (detail: string, action: \"wrap\" | \"policy_deny\" = \"wrap\") =>\n    logAudit({ action, source: \"mcp\", detail, correlationId: session.correlationId });\n\n  const denied = (toolName: string, reason: string): CallToolResult => {\n    audit(`airlock blocked \"${toolName}\" → ${session.label}: ${reason}`, \"policy_deny\");\n    return {\n      content: [{ type: \"text\", text: `airlock: policy denied: ${reason}` }],\n      isError: true,\n    };\n  };\n\n  /**\n   * Wrap-policy gate for one tool call. Any policy load failure (an\n   * unparseable `.q-ring.json`) denies — the airlock fails closed like the\n   * rest of the policy engine.\n   */\n  const gate = (toolName: string): CallToolResult | null => {\n    try {\n      const decision = checkWrapToolPolicy(toolName, projectPath);\n      if (!decision.allowed) return denied(toolName, decision.reason ?? \"denied by policy\");\n      if (\n        wrapToolRequiresApproval(toolName, projectPath) &&\n        !hasApproval(toolName, WRAP_APPROVAL_SCOPE, approvalService)\n      ) {\n        return denied(\n          toolName,\n          `wrapped tool \"${toolName}\" requires operator approval — run: qring mcp approve ${toolName} --for 3600 --reason \"<why>\"`,\n        );\n      }\n      const limit = getWrapRateLimit(toolName, projectPath);\n      if (limit && !limiter.take(toolName, limit)) {\n        return denied(\n          toolName,\n          `rate limit exceeded for \"${toolName}\" (${limit.maxCalls} calls per ${limit.perSeconds}s)`,\n        );\n      }\n      return null;\n    } catch (err) {\n      return denied(toolName, err instanceof Error ? err.message : String(err));\n    }\n  };\n\n  const toolAllowed = (toolName: string): boolean => {\n    try {\n      return checkWrapToolPolicy(toolName, projectPath).allowed;\n    } catch {\n      return false;\n    }\n  };\n\n  // ── Tools ──────────────────────────────────────────────────────────────\n\n  // Handlers are registered per capability: the SDK refuses a handler for a\n  // capability the server does not advertise, and a host that sees no tools\n  // capability never asks. A tools-less (resources/prompts-only) downstream\n  // is therefore proxied honestly instead of answering an empty list.\n  if (dsCaps.tools) registerToolHandlers();\n  if (dsCaps.resources) registerResourceHandlers();\n  if (dsCaps.prompts) registerPromptHandlers();\n\n  return proxy;\n\n  // ── Tools ──────────────────────────────────────────────────────────────\n\n  function registerToolHandlers(): void {\n    // A dynamic downstream (login-gated or feature-flagged tools) re-lists\n    // after this notification; swallowing it would freeze the host's view.\n    downstream.setNotificationHandler(ToolListChangedNotificationSchema, () => {\n      void proxy.sendToolListChanged().catch(() => {});\n    });\n\n    proxy.setRequestHandler(ListToolsRequestSchema, async (request) => {\n      const listed = await downstream.listTools(request.params);\n      // Hide what policy would refuse anyway — an agent that never sees a\n      // denied tool never wastes a turn on it (and can't enumerate the gate).\n      return { ...listed, tools: listed.tools.filter((t) => toolAllowed(t.name)) };\n    });\n\n    proxy.setRequestHandler(CallToolRequestSchema, async (request, extra) => {\n      const toolName = request.params.name;\n      const blocked = gate(toolName);\n      if (blocked) return blocked;\n\n      audit(`tool call \"${toolName}\" → ${session.label}`);\n\n      // Relay progress under the host's own token. When we pass `onprogress`,\n      // the SDK swaps in its own token on the downstream request, so the\n      // host's token never collides with airlock message ids.\n      const hostToken = request.params._meta?.progressToken;\n      const onprogress =\n        hostToken !== undefined\n          ? (progress: { progress: number; total?: number; message?: string }) => {\n              void extra\n                .sendNotification({\n                  method: \"notifications/progress\",\n                  params: { ...progress, progressToken: hostToken },\n                })\n                .catch(() => {});\n            }\n          : undefined;\n\n      try {\n        const result = (await downstream.callTool(request.params, undefined, {\n          signal: extra.signal,\n          timeout: downstreamTimeoutMs(),\n          resetTimeoutOnProgress: true,\n          onprogress,\n        })) as CallToolResult;\n        return redactor.result(result);\n      } catch (err) {\n        // Protocol errors (unknown tool, timeout, connection closed) must stay\n        // JSON-RPC errors — the spec separates them from tool-execution\n        // failures, and hosts use the distinction (e.g. to refresh tool lists).\n        if (err instanceof McpError) throw err;\n        const message = err instanceof Error ? err.message : String(err);\n        audit(`tool call \"${toolName}\" failed: ${message}`);\n        return {\n          content: [{ type: \"text\", text: `airlock: downstream error: ${message}` }],\n          isError: true,\n        } satisfies CallToolResult;\n      }\n    });\n  }\n\n  // ── Resources ──────────────────────────────────────────────────────────\n\n  function registerResourceHandlers(): void {\n    downstream.setNotificationHandler(ResourceListChangedNotificationSchema, () => {\n      void proxy.sendResourceListChanged().catch(() => {});\n    });\n    downstream.setNotificationHandler(ResourceUpdatedNotificationSchema, (n) => {\n      void proxy.sendResourceUpdated(n.params).catch(() => {});\n    });\n\n    proxy.setRequestHandler(ListResourcesRequestSchema, (request) =>\n      downstream.listResources(request.params),\n    );\n    proxy.setRequestHandler(ListResourceTemplatesRequestSchema, (request) =>\n      downstream.listResourceTemplates(request.params),\n    );\n    proxy.setRequestHandler(ReadResourceRequestSchema, async (request, extra) => {\n      // URIs are identifiers, not payloads — logged (bounded) so the trail\n      // says what was fetched, unlike tool arguments.\n      audit(`resource read ${truncate(request.params.uri)} → ${session.label}`);\n      const result = await downstream.readResource(request.params, {\n        signal: extra.signal,\n        timeout: downstreamTimeoutMs(),\n      });\n      return redactor.result(result);\n    });\n    if (dsCaps.resources?.subscribe) {\n      proxy.setRequestHandler(SubscribeRequestSchema, (request) =>\n        downstream.subscribeResource(request.params),\n      );\n      proxy.setRequestHandler(UnsubscribeRequestSchema, (request) =>\n        downstream.unsubscribeResource(request.params),\n      );\n    }\n  }\n\n  // ── Prompts ────────────────────────────────────────────────────────────\n\n  function registerPromptHandlers(): void {\n    downstream.setNotificationHandler(PromptListChangedNotificationSchema, () => {\n      void proxy.sendPromptListChanged().catch(() => {});\n    });\n    proxy.setRequestHandler(ListPromptsRequestSchema, (request) =>\n      downstream.listPrompts(request.params),\n    );\n    proxy.setRequestHandler(GetPromptRequestSchema, async (request, extra) => {\n      // Prompt arguments are user content — never logged, like tool args.\n      audit(`prompt get \"${request.params.name}\" → ${session.label}`);\n      const result = await downstream.getPrompt(request.params, {\n        signal: extra.signal,\n        timeout: downstreamTimeoutMs(),\n      });\n      return redactor.result(result);\n    });\n  }\n}\n\nfunction parseHeaders(raw: string[] | undefined): Record<string, string> {\n  const headers: Record<string, string> = {};\n  for (const line of raw ?? []) {\n    const idx = line.indexOf(\":\");\n    if (idx <= 0) throw new Error(`--header expects \"Name: value\", got \"${line}\"`);\n    headers[line.slice(0, idx).trim()] = line.slice(idx + 1).trim();\n  }\n  return headers;\n}\n\n/** Connect to the wrapped server: spawn it (stdio) or dial it (http). */\nexport async function connectDownstream(opts: WrapOptions): Promise<Client> {\n  const client = new Client({ name: \"q-ring-airlock\", version: PACKAGE_VERSION });\n\n  if (opts.url) {\n    const headers = parseHeaders(opts.headers);\n    if (opts.authSecret) {\n      // An audited, non-silent read: the airlock deliberately consumed this\n      // credential to reach the wrapped server.\n      const value = getSecret(opts.authSecret, { projectPath: opts.projectPath, source: \"cli\" });\n      if (value === null) {\n        throw new Error(`--auth-secret: \"${opts.authSecret}\" not found in the keyring`);\n      }\n      headers.Authorization = `Bearer ${value}`;\n    }\n    const transport = new StreamableHTTPClientTransport(new URL(opts.url), {\n      requestInit: { headers },\n    });\n    await client.connect(transport);\n    return client;\n  }\n\n  if (!opts.command) throw new Error(\"wrap needs a server command or --url\");\n\n  const env = opts.inheritEnv\n    ? (Object.fromEntries(Object.entries(process.env).filter(([, v]) => v !== undefined)) as Record<\n        string,\n        string\n      >)\n    : undefined; // SDK default: getDefaultEnvironment(), the minimal safe set\n\n  const transport = new StdioClientTransport({\n    command: opts.command,\n    args: opts.args ?? [],\n    env,\n    stderr: \"inherit\",\n  });\n\n  await client.connect(transport);\n  return client;\n}\n\n/**\n * Run the airlock until either side disconnects. Resolves with the exit code\n * the CLI should use: 0 when the host closed the session, 1 when the wrapped\n * server died underneath it. Close is awaited (bounded) before resolving so\n * the SDK's staged child shutdown (stdin end → SIGTERM → SIGKILL) actually\n * runs — otherwise `process.exit` in the CLI orphans children that ignore\n * stdin EOF.\n */\nexport async function runWrap(opts: WrapOptions): Promise<number> {\n  const projectPath = opts.projectPath ?? process.cwd();\n  // Anchor policy like the MCP server does: the operator's launch directory\n  // governs the session, never anything the wrapped server or host says.\n  setPolicyRoot(projectPath);\n\n  const label = opts.label ?? opts.url ?? [opts.command, ...(opts.args ?? [])].join(\" \");\n  const session: WrapSession = { label, correlationId: randomUUID() };\n\n  const downstream = await connectDownstream(opts);\n  const downstreamInfo = downstream.getServerVersion();\n  const caps = downstream.getServerCapabilities() ?? {};\n  const surfaces = ([\"tools\", \"resources\", \"prompts\"] as const).filter((c) => caps[c]);\n\n  if (surfaces.length === 0) {\n    await downstream.close().catch(() => {});\n    throw new Error(\n      `wrapped server \"${downstreamInfo?.name ?? label}\" exposes no tools, resources, or prompts — nothing to proxy`,\n    );\n  }\n\n  const redact = opts.redact ?? wrapRedactsResults(projectPath);\n  const redactor = redact ? createRedactor({ projectPath }) : NOOP_REDACTOR;\n  const envNote = opts.url ? \"remote (http)\" : opts.inheritEnv ? \"inherited\" : \"stripped\";\n\n  logAudit({\n    action: \"wrap\",\n    source: \"cli\",\n    detail: `airlock session started: ${label} (env ${envNote}; ${surfaces.join(\"+\")}; results ${redact ? \"redacted\" : \"unredacted\"})`,\n    correlationId: session.correlationId,\n  });\n  console.error(\n    `q-ring airlock: wrapping ${downstreamInfo?.name ?? label} — env ${envNote}, ${surfaces.join(\"/\")} audited, results ${redact ? \"redacted\" : \"NOT redacted\"} (session ${session.correlationId.slice(0, 8)})`,\n  );\n\n  const proxy = createAirlockServer(downstream, session, { projectPath, redactor });\n  const transport = new StdioServerTransport();\n\n  return new Promise<number>((resolve) => {\n    let settled = false;\n    const finish = (code: number, reason: string) => {\n      if (settled) return;\n      settled = true;\n      logAudit({\n        action: \"wrap\",\n        source: \"cli\",\n        detail: `airlock session ended: ${reason}`,\n        correlationId: session.correlationId,\n      });\n      // Bounded graceful close: give StdioClientTransport its full\n      // stdin-EOF → SIGTERM → SIGKILL escalation before the CLI exits.\n      const closes = Promise.allSettled([proxy.close(), downstream.close()]);\n      const deadline = new Promise<void>((r) => setTimeout(r, 6000).unref());\n      void Promise.race([closes, deadline]).then(() => resolve(code));\n    };\n\n    downstream.onclose = () => finish(1, \"wrapped server exited\");\n    // Use the protocol-level callback — Protocol.connect documents that it\n    // takes ownership of transport callbacks, so don't rely on pre-set\n    // transport.onclose surviving an SDK upgrade.\n    proxy.onclose = () => finish(0, \"host disconnected\");\n    // Transport errors are per-message (e.g. one unparseable stdin line) —\n    // SDK convention is log-and-continue, never session teardown.\n    proxy.onerror = (err) => {\n      console.error(`q-ring airlock: transport error: ${err.message}`);\n    };\n    // StdioServerTransport never watches stdin 'end' — its onclose only\n    // fires on an explicit close(). A host hanging up is an EOF on stdin.\n    process.stdin.on(\"end\", () => finish(0, \"host disconnected\"));\n    // A host that vanishes mid-write surfaces as EPIPE on stdout, not as a\n    // transport close — without this handler it crashes the process.\n    process.stdout.on(\"error\", (err: NodeJS.ErrnoException) => {\n      if (err.code === \"EPIPE\") finish(0, \"host disconnected\");\n      else finish(1, `stdout error: ${err.message}`);\n    });\n    // Hosts typically stop stdio servers with SIGTERM; route it through the\n    // same graceful close so the child isn't orphaned.\n    process.once(\"SIGTERM\", () => finish(0, \"terminated\"));\n    process.once(\"SIGINT\", () => finish(0, \"interrupted\"));\n\n    proxy.connect(transport).catch((err: unknown) => {\n      console.error(\n        `q-ring airlock: failed to start: ${err instanceof Error ? err.message : String(err)}`,\n      );\n      finish(1, \"startup failure\");\n    });\n  });\n}\n","/**\n * Airlock result redaction.\n *\n * A wrapped MCP server can return anything in a tool result, resource read,\n * or prompt — including the operator's own secrets if it has them (from its\n * environment, a config file, a scraped page). Those results flow straight\n * into the agent transcript, which is the obvious exfiltration hole in the\n * airlock. This module builds the set of known secret VALUES and scrubs every\n * verbatim occurrence out of results before they leave the airlock.\n *\n * Values are read silently (no audit \"read\", no access counter, no canary\n * trip) with CLI-source semantics, exactly like `qring exec`'s redaction set.\n * The set is rebuilt lazily every REFRESH_MS so rotated secrets are picked up\n * by a long-lived airlock. Same replacement token as exec so redacted output\n * is recognisable everywhere.\n */\n\nimport { listSecrets, getSecret, type KeyringOptions } from \"./keyring.js\";\nimport { checkDecay } from \"./envelope.js\";\n\nexport const REDACTED = \"[QRING:REDACTED]\";\nconst REFRESH_MS = 60 * 1000;\nconst MIN_LENGTH = 6; // shorter values would shred ordinary text\n\nexport interface Redactor {\n  text(input: string): string;\n  /** Scrub a CallToolResult / ReadResourceResult / GetPromptResult in place. */\n  result<T>(payload: T): T;\n  /** Force the value set to rebuild on next use (tests, rotations). */\n  invalidate(): void;\n}\n\n/** Gather every non-expired secret value in the resolvable scopes. */\nexport function collectSecretValues(opts: KeyringOptions = {}): string[] {\n  const values = new Set<string>();\n  for (const entry of listSecrets({ ...opts, source: \"cli\", silent: true })) {\n    if (entry.envelope && checkDecay(entry.envelope).isExpired) continue;\n    const value = getSecret(entry.key, {\n      scope: entry.scope,\n      projectPath: opts.projectPath,\n      env: opts.env,\n      source: \"cli\",\n      silent: true,\n    });\n    if (value && value.length >= MIN_LENGTH) values.add(value);\n  }\n  // Longest first so a value that contains another is scrubbed whole.\n  return [...values].sort((a, b) => b.length - a.length);\n}\n\nfunction scrubUnknown(node: unknown, scrub: (s: string) => string): unknown {\n  if (typeof node === \"string\") return scrub(node);\n  if (Array.isArray(node)) return node.map((n) => scrubUnknown(n, scrub));\n  if (node && typeof node === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(node as Record<string, unknown>)) {\n      // Binary payloads (base64 `blob`/`data`) are not text; leave them alone.\n      out[k] = k === \"blob\" || k === \"data\" ? v : scrubUnknown(v, scrub);\n    }\n    return out;\n  }\n  return node;\n}\n\nexport function createRedactor(opts: KeyringOptions = {}): Redactor {\n  let values: string[] = [];\n  let builtAt = 0;\n\n  const ensure = () => {\n    const now = Date.now();\n    if (now - builtAt < REFRESH_MS) return;\n    try {\n      values = collectSecretValues(opts);\n    } catch {\n      // Keyring unavailable — keep whatever set we had; never block a result.\n    }\n    builtAt = now;\n  };\n\n  const text = (input: string): string => {\n    ensure();\n    let out = input;\n    for (const v of values) {\n      if (out.includes(v)) out = out.split(v).join(REDACTED);\n    }\n    return out;\n  };\n\n  return {\n    text,\n    result: <T>(payload: T): T => scrubUnknown(payload, text) as T,\n    invalidate: () => {\n      builtAt = 0;\n    },\n  };\n}\n\n/** A redactor that changes nothing — for `--no-redact` / policy opt-out. */\nexport const NOOP_REDACTOR: Redactor = {\n  text: (s) => s,\n  result: (p) => p,\n  invalidate: () => {},\n};\n","import type { Command } from \"commander\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { runWrap, WRAP_APPROVAL_SCOPE, wrapApprovalService } from \"../../core/wrap.js\";\nimport { grantApproval, revokeApproval, listApprovals } from \"../../core/approval.js\";\n\nconst collect = (value: string, previous: string[] = []) => [...previous, value];\n\nexport function registerMcpCommands(program: Command): void {\n  const mcp = program\n    .command(\"mcp\")\n    .description(\"MCP airlock — run third-party MCP servers behind q-ring\");\n\n  mcp\n    .command(\"wrap [command...]\")\n    .description(\n      \"Proxy an MCP server through the airlock: spawned with a stripped env (or dialed over HTTP), every tool call / resource read / prompt audited, results scrubbed of known secrets, policy.wrap enforced. Use -- before the server command: qring mcp wrap -- npx some-server\",\n    )\n    .option(\n      \"--url <url>\",\n      \"Wrap a remote Streamable HTTP MCP endpoint instead of spawning a command\",\n    )\n    .option(\n      \"--header <name:value>\",\n      \"Extra request header for --url (repeatable)\",\n      collect,\n      [] as string[],\n    )\n    .option(\n      \"--auth-secret <KEY>\",\n      \"q-ring key whose value is sent as `Authorization: Bearer …` to --url (audited read)\",\n    )\n    .option(\n      \"--inherit-env\",\n      \"Pass the full parent environment to the wrapped server (default: minimal safe env)\",\n    )\n    .option(\"--no-redact\", \"Do not scrub known secret values from results\")\n    .option(\"--label <label>\", \"Session label for audit events (default: the command line / url)\")\n    .option(\n      \"--project-path <path>\",\n      \"Project whose .q-ring.json policy governs the session (default: cwd)\",\n    )\n    .action(async (commandArgs: string[], cmd) => {\n      try {\n        if (!cmd.url && commandArgs.length === 0) {\n          throw new Error(\"give a server command after -- or pass --url\");\n        }\n        const code = await runWrap({\n          command: commandArgs[0],\n          args: commandArgs.slice(1),\n          url: cmd.url,\n          headers: cmd.header,\n          authSecret: cmd.authSecret,\n          inheritEnv: cmd.inheritEnv === true,\n          // commander turns --no-redact into redact:false; undefined → policy decides\n          redact: cmd.redact === false ? false : undefined,\n          label: cmd.label,\n          projectPath: cmd.projectPath,\n        });\n        process.exit(code);\n      } catch (err) {\n        console.error(\n          c.red(\n            `${SYMBOLS.cross} Airlock failed: ${err instanceof Error ? err.message : String(err)}`,\n          ),\n        );\n        process.exit(1);\n      }\n    });\n\n  mcp\n    .command(\"approve <tool>\")\n    .description(\n      \"Grant a time-limited approval for a wrapped tool listed in policy.wrap.approveTools (or revoke it)\",\n    )\n    .option(\"--for <seconds>\", \"Approval lifetime in seconds\", (v) => parseInt(v, 10), 3600)\n    .option(\"--reason <text>\", \"Why this tool is being approved\")\n    .option(\"--revoke\", \"Revoke an existing approval instead\")\n    .option(\"--project-path <path>\", \"Project the airlock runs in (default: cwd)\")\n    .action((tool: string, cmd) => {\n      const projectPath: string = cmd.projectPath ?? process.cwd();\n      const service = wrapApprovalService(projectPath);\n      if (cmd.revoke) {\n        if (revokeApproval(tool, WRAP_APPROVAL_SCOPE, service)) {\n          console.log(\n            `${SYMBOLS.check} ${c.green(\"revoked\")} airlock approval for ${c.bold(tool)}`,\n          );\n        } else {\n          console.error(c.red(`${SYMBOLS.cross} no airlock approval found for \"${tool}\"`));\n          process.exit(1);\n        }\n        return;\n      }\n      const entry = grantApproval(tool, WRAP_APPROVAL_SCOPE, service, cmd.for, {\n        reason: cmd.reason ?? \"manual airlock approval\",\n      });\n      console.log(\n        `${SYMBOLS.check} ${c.green(\"approved\")} wrapped tool ${c.bold(tool)} for ${cmd.for}s`,\n      );\n      console.log(c.dim(`  id=${entry.id} reason=\"${entry.reason}\" expires=${entry.expiresAt}`));\n      console.log(\n        c.dim(\n          \"  Applies to airlocks launched from this project directory (policy.wrap.approveTools).\",\n        ),\n      );\n    });\n\n  mcp\n    .command(\"approvals\")\n    .description(\"List live airlock tool approvals for this project\")\n    .option(\"--project-path <path>\", \"Project the airlock runs in (default: cwd)\")\n    .option(\"--json\", \"Output as JSON\")\n    .action((cmd) => {\n      const service = wrapApprovalService(cmd.projectPath ?? process.cwd());\n      const entries = listApprovals().filter(\n        (a) => a.scope === WRAP_APPROVAL_SCOPE && a.service === service,\n      );\n      if (cmd.json) {\n        console.log(JSON.stringify({ approvals: entries }, null, 2));\n        return;\n      }\n      if (entries.length === 0) {\n        console.log(\n          c.dim(\n            'No airlock approvals. Grant one: qring mcp approve <tool> --for 3600 --reason \"…\"',\n          ),\n        );\n        return;\n      }\n      for (const a of entries) {\n        const state = a.tampered\n          ? c.red(\"TAMPERED\")\n          : a.valid\n            ? c.green(\"valid\")\n            : c.yellow(\"expired\");\n        console.log(\n          `  ${SYMBOLS.check} ${c.bold(a.key)}  ${state}  ${c.dim(`expires ${a.expiresAt} · ${a.reason}`)}`,\n        );\n      }\n    });\n}\n","import type { Command } from \"commander\";\nimport { existsSync, readFileSync, writeFileSync, rmSync } from \"node:fs\";\nimport { join, delimiter } from \"node:path\";\nimport { verifyAuditChain } from \"../../core/observer.js\";\nimport { getPolicySummary } from \"../../core/policy.js\";\nimport { countLegacyApprovals } from \"../../core/approval.js\";\nimport { c, SYMBOLS } from \"../../utils/colors.js\";\nimport { emitJson } from \"../helpers.js\";\nimport { PACKAGE_VERSION } from \"../../version.js\";\nimport { configDir } from \"../../utils/config-dir.js\";\n\ntype CheckStatus = \"ok\" | \"warn\" | \"fail\";\n\ninterface CheckResult {\n  name: string;\n  status: CheckStatus;\n  detail: string;\n}\n\nfunction auditDir(): string {\n  return process.env.QRING_AUDIT_DIR ?? configDir();\n}\n\nfunction checkNode(): CheckResult {\n  const major = Number(process.versions.node.split(\".\")[0]);\n  return {\n    name: \"node runtime\",\n    status: major >= 18 ? \"ok\" : \"fail\",\n    detail: `v${process.versions.node}${major >= 18 ? \"\" : \" — q-ring requires Node >= 18\"}`,\n  };\n}\n\nasync function checkKeyringBackend(): Promise<CheckResult> {\n  // Probe the OS keychain end-to-end with a dedicated service name so real\n  // secrets and the audit log are never touched. This is the check that\n  // fails on headless Linux without a Secret Service (gnome-keyring, etc.).\n  try {\n    const { Entry } = await import(\"@napi-rs/keyring\");\n    const probe = new Entry(\"q-ring-doctor-probe\", \"PROBE\");\n    probe.setPassword(\"ok\");\n    const read = probe.getPassword();\n    probe.deletePassword();\n    if (read !== \"ok\") {\n      return {\n        name: \"keyring backend\",\n        status: \"fail\",\n        detail: \"probe round-trip returned unexpected value\",\n      };\n    }\n    return {\n      name: \"keyring backend\",\n      status: \"ok\",\n      detail: \"write/read/delete round-trip succeeded\",\n    };\n  } catch (err) {\n    return {\n      name: \"keyring backend\",\n      status: \"fail\",\n      detail: `${err instanceof Error ? err.message : String(err)} — on headless Linux, install and unlock a Secret Service (e.g. gnome-keyring)`,\n    };\n  }\n}\n\nfunction checkAuditLog(): CheckResult {\n  const dir = auditDir();\n  try {\n    const probeFile = join(dir, \".doctor-probe\");\n    writeFileSync(probeFile, \"ok\");\n    rmSync(probeFile);\n  } catch (err) {\n    return {\n      name: \"audit log\",\n      status: \"fail\",\n      detail: `${dir} not writable: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n\n  const chain = verifyAuditChain();\n  if (chain.totalEvents === 0) {\n    return { name: \"audit log\", status: \"ok\", detail: `${dir} writable, no events yet` };\n  }\n  if (!chain.intact) {\n    return {\n      name: \"audit log\",\n      status: \"fail\",\n      detail: `hash chain BROKEN at event #${chain.brokenAt} (${chain.validEvents}/${chain.totalEvents} valid) — see qring audit:verify`,\n    };\n  }\n  return {\n    name: \"audit log\",\n    status: \"ok\",\n    detail: `${dir} writable, chain intact (${chain.totalEvents} events)`,\n  };\n}\n\nfunction checkManifest(projectPath: string): CheckResult {\n  const manifestPath = join(projectPath, \".q-ring.json\");\n  if (!existsSync(manifestPath)) {\n    return {\n      name: \"project manifest\",\n      status: \"warn\",\n      detail: `no .q-ring.json in ${projectPath} (optional — run qring wizard or /qring-setup-project)`,\n    };\n  }\n  try {\n    const config = JSON.parse(readFileSync(manifestPath, \"utf8\"));\n    const declared = Object.keys(config.secrets ?? {}).length;\n    const hasPolicy = !!config.policy;\n    return {\n      name: \"project manifest\",\n      status: \"ok\",\n      detail: `${declared} secret(s) declared${hasPolicy ? \", policy present\" : \"\"}`,\n    };\n  } catch (err) {\n    return {\n      name: \"project manifest\",\n      status: \"fail\",\n      detail: `.q-ring.json is not valid JSON: ${err instanceof Error ? err.message : String(err)}`,\n    };\n  }\n}\n\nfunction checkPolicy(): CheckResult {\n  const summary = getPolicySummary();\n  const active = [\n    summary.hasMcpPolicy && \"mcp\",\n    summary.hasExecPolicy && \"exec\",\n    summary.hasSecretPolicy && \"secrets\",\n  ].filter(Boolean);\n  return {\n    name: \"governance policy\",\n    status: \"ok\",\n    detail: active.length\n      ? `active: ${active.join(\", \")}`\n      : \"none configured (add a \\\"policy\\\" section to .q-ring.json to enable)\",\n  };\n}\n\nfunction checkLegacyApprovals(): CheckResult {\n  const n = countLegacyApprovals();\n  if (n === 0) {\n    return {\n      name: \"approval bindings\",\n      status: \"ok\",\n      detail: \"no legacy approvals; all bound to a project/team/org identity\",\n    };\n  }\n  return {\n    name: \"approval bindings\",\n    status: \"warn\",\n    detail: `${n} pre-v0.14 approval(s) have no project binding and will NOT grant access — re-run \\`qring approve\\` for each`,\n  };\n}\n\nfunction checkMcpBinary(): CheckResult {\n  const exts = process.platform === \"win32\" ? [\".cmd\", \".exe\", \".bat\", \"\"] : [\"\"];\n  for (const dir of (process.env.PATH ?? \"\").split(delimiter)) {\n    if (!dir) continue;\n    for (const ext of exts) {\n      if (existsSync(join(dir, `qring-mcp${ext}`))) {\n        return {\n          name: \"qring-mcp binary\",\n          status: \"ok\",\n          detail: `found at ${join(dir, `qring-mcp${ext}`)}`,\n        };\n      }\n    }\n  }\n  return {\n    name: \"qring-mcp binary\",\n    status: \"warn\",\n    detail:\n      \"not on PATH — editor MCP configs that spawn `qring-mcp` will fail; install globally (pnpm add -g @i4ctime/q-ring)\",\n  };\n}\n\nexport function registerDoctorCommand(program: Command): void {\n  program\n    .command(\"doctor\")\n    .description(\"Diagnose the q-ring installation (keyring, audit, manifest, MCP)\")\n    .option(\"--project-path <path>\", \"Project path (defaults to cwd)\")\n    .option(\"--json\", \"Output as JSON\")\n    .action(async (cmd) => {\n      const projectPath = cmd.projectPath ?? process.cwd();\n\n      const checks: CheckResult[] = [\n        checkNode(),\n        await checkKeyringBackend(),\n        checkAuditLog(),\n        checkManifest(projectPath),\n        checkPolicy(),\n        checkLegacyApprovals(),\n        checkMcpBinary(),\n      ];\n\n      const failed = checks.filter((r) => r.status === \"fail\").length;\n      const warned = checks.filter((r) => r.status === \"warn\").length;\n\n      if (\n        emitJson(program, cmd, {\n          version: PACKAGE_VERSION,\n          projectPath,\n          checks,\n          healthy: failed === 0,\n        })\n      ) {\n        if (failed > 0) process.exitCode = 1;\n        return;\n      }\n\n      console.log(c.bold(`\\n  ${SYMBOLS.shield} qring doctor — v${PACKAGE_VERSION}\\n`));\n\n      for (const r of checks) {\n        const icon =\n          r.status === \"ok\"\n            ? c.green(SYMBOLS.check)\n            : r.status === \"warn\"\n              ? c.yellow(SYMBOLS.warning)\n              : c.red(SYMBOLS.cross);\n        console.log(`  ${icon} ${c.bold(r.name.padEnd(18))} ${c.dim(r.detail)}`);\n      }\n\n      console.log();\n      if (failed > 0) {\n        console.log(`  ${c.red(`${failed} check(s) failed`)}${warned ? c.dim(`, ${warned} warning(s)`) : \"\"}\\n`);\n        process.exitCode = 1;\n      } else if (warned > 0) {\n        console.log(`  ${c.yellow(`${warned} warning(s)`)} ${c.dim(\"— everything critical is healthy\")}\\n`);\n      } else {\n        console.log(`  ${c.green(\"All checks passed.\")}\\n`);\n      }\n    });\n}\n","import type { Command } from \"commander\";\nimport { c } from \"../../utils/colors.js\";\n\n/**\n * Shell completion scripts generated from the live commander program, so\n * they can never drift from the actual command surface.\n *\n *   qring completion bash >> ~/.bashrc            (or bash-completion dir)\n *   qring completion zsh  > ~/.zsh/completions/_qring\n *   qring completion fish > ~/.config/fish/completions/qring.fish\n */\n\ninterface CmdInfo {\n  name: string;\n  aliases: string[];\n  description: string;\n  options: Array<{ flag: string; description: string }>;\n  subcommands: CmdInfo[];\n}\n\nfunction collect(cmd: Command): CmdInfo {\n  return {\n    name: cmd.name(),\n    aliases: cmd.aliases(),\n    description: cmd.description(),\n    options: cmd.options\n      .map((o) => ({ flag: o.long ?? o.short ?? \"\", description: o.description ?? \"\" }))\n      .filter((o) => o.flag.startsWith(\"--\")),\n    subcommands: cmd.commands\n      .filter((s) => s.name() !== \"help\")\n      .map((s) => collect(s as Command)),\n  };\n}\n\nconst sanitize = (s: string) =>\n  s.replace(/['\"`$\\\\]/g, \"\").replace(/[:[\\]]/g, \" \").replace(/\\s+/g, \" \").trim();\n\nfunction bashScript(cmds: CmdInfo[]): string {\n  const names = cmds.flatMap((x) => [x.name, ...x.aliases]).join(\" \");\n  const cases = cmds\n    .map((x) => {\n      const label = [x.name, ...x.aliases].join(\"|\");\n      const opts = [...x.options.map((o) => o.flag), \"--json\"].join(\" \");\n      const subs = x.subcommands.map((s) => s.name).join(\" \");\n      const subCase = subs\n        ? `\\n      if [ \"$COMP_CWORD\" -eq 2 ]; then COMPREPLY=( $(compgen -W \"${subs}\" -- \"$cur\") ); return; fi`\n        : \"\";\n      return `    ${label})${subCase}\\n      opts=\"${opts}\" ;;`;\n    })\n    .join(\"\\n\");\n\n  return `# bash completion for qring — generated by \\`qring completion bash\\`\n_qring_completions() {\n  local cur cmd opts\n  cur=\"\\${COMP_WORDS[COMP_CWORD]}\"\n  cmd=\"\\${COMP_WORDS[1]}\"\n  if [ \"$COMP_CWORD\" -eq 1 ]; then\n    COMPREPLY=( $(compgen -W \"${names}\" -- \"$cur\") )\n    return\n  fi\n  opts=\"--json --help\"\n  case \"$cmd\" in\n${cases}\n  esac\n  case \"$cur\" in\n    -*) COMPREPLY=( $(compgen -W \"$opts --help\" -- \"$cur\") ) ;;\n  esac\n}\ncomplete -o default -F _qring_completions qring\n`;\n}\n\nfunction zshScript(cmds: CmdInfo[]): string {\n  const items = cmds\n    .map((x) => `    '${x.name}:${sanitize(x.description)}'`)\n    .join(\"\\n\");\n  const cases = cmds\n    .map((x) => {\n      const label = [x.name, ...x.aliases].join(\"|\");\n      const words = [\n        ...x.subcommands.map((s) => s.name),\n        ...x.options.map((o) => o.flag),\n        \"--json\",\n      ].join(\" \");\n      return `    ${label}) compadd -- ${words} ;;`;\n    })\n    .join(\"\\n\");\n\n  return `#compdef qring\n# zsh completion for qring — generated by \\`qring completion zsh\\`\n_qring() {\n  local -a commands\n  commands=(\n${items}\n  )\n  if (( CURRENT == 2 )); then\n    _describe 'command' commands\n    return\n  fi\n  case $words[2] in\n${cases}\n  esac\n}\n_qring \"$@\"\n`;\n}\n\nfunction fishScript(cmds: CmdInfo[]): string {\n  const lines: string[] = [\n    \"# fish completion for qring — generated by `qring completion fish`\",\n    \"complete -c qring -f\",\n  ];\n  const allNames = cmds.flatMap((x) => [x.name, ...x.aliases]);\n  for (const x of cmds) {\n    for (const name of [x.name, ...x.aliases]) {\n      lines.push(\n        `complete -c qring -n \"not __fish_seen_subcommand_from ${allNames.join(\" \")}\" -a ${name} -d \"${sanitize(x.description)}\"`,\n      );\n    }\n    for (const s of x.subcommands) {\n      lines.push(\n        `complete -c qring -n \"__fish_seen_subcommand_from ${x.name}\" -a ${s.name} -d \"${sanitize(s.description)}\"`,\n      );\n    }\n    for (const o of [...x.options, { flag: \"--json\", description: \"Output as JSON\" }]) {\n      lines.push(\n        `complete -c qring -n \"__fish_seen_subcommand_from ${x.name}\" -l ${o.flag.slice(2)} -d \"${sanitize(o.description)}\"`,\n      );\n    }\n  }\n  return lines.join(\"\\n\") + \"\\n\";\n}\n\nexport function registerCompletionCommand(program: Command): void {\n  program\n    .command(\"completion <shell>\")\n    .description(\"Print a shell completion script (bash, zsh, fish)\")\n    .action((shell: string) => {\n      const cmds = program.commands\n        .filter((s) => s.name() !== \"help\" && s.name() !== \"completion\")\n        .map((s) => collect(s as Command));\n\n      if (shell === \"bash\") process.stdout.write(bashScript(cmds));\n      else if (shell === \"zsh\") process.stdout.write(zshScript(cmds));\n      else if (shell === \"fish\") process.stdout.write(fishScript(cmds));\n      else {\n        console.error(c.red(`Unknown shell \"${shell}\" — expected bash, zsh, or fish`));\n        process.exitCode = 1;\n      }\n    });\n}\n","import { createProgram } from \"./cli/commands.js\";\nimport { c, SYMBOLS } from \"./utils/colors.js\";\n\nconst program = createProgram();\n\n// Central error handler: policy denials, keyring backend failures, bad input\n// from core throw plain Errors. Show the message, not a Node stack trace.\n// Set QRING_DEBUG=1 to get the full stack for bug reports.\ntry {\n  await program.parseAsync();\n} catch (err) {\n  const message = err instanceof Error ? err.message : String(err);\n  console.error(c.red(`${SYMBOLS.cross} ${message}`));\n  if (process.env.QRING_DEBUG && err instanceof Error && err.stack) {\n    console.error(c.dim(err.stack));\n  }\n  process.exitCode = 1;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA,SAAS,SAAS,YAAY;;;ACI9B,IAAM,UAAU,QAAQ,OAAO,UAAU,SAAS,CAAC,QAAQ,IAAI;AAE/D,SAAS,KAAK,MAAc,MAAsB;AAChD,SAAO,UAAU,QAAQ,IAAI,IAAI,IAAI,YAAY;AACnD;AAEO,IAAM,IAAI;AAAA,EACf,MAAM,CAAC,MAAc,KAAK,KAAK,CAAC;AAAA,EAChC,KAAK,CAAC,MAAc,KAAK,KAAK,CAAC;AAAA,EAC/B,QAAQ,CAAC,MAAc,KAAK,KAAK,CAAC;AAAA,EAClC,WAAW,CAAC,MAAc,KAAK,KAAK,CAAC;AAAA,EAErC,KAAK,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EAChC,OAAO,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EAClC,QAAQ,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACnC,MAAM,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACjC,SAAS,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACpC,MAAM,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACjC,OAAO,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EAClC,MAAM,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EAEjC,OAAO,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EAClC,SAAS,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACpC,UAAU,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACrC,QAAQ,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACnC,WAAW,CAAC,MAAc,KAAK,MAAM,CAAC;AAAA,EACtC,QAAQ,CAAC,MAAc,KAAK,MAAM,CAAC;AACrC;AAEO,SAAS,WAAW,OAAuB;AAChD,SAAO,UAAU,YAAY,EAAE,KAAK,KAAK,IAAI,EAAE,KAAK,KAAK;AAC3D;AAEO,SAAS,eAAe,SAAiB,SAA0B;AACxE,MAAI,QAAS,QAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC;AAChD,MAAI,WAAW,GAAI,QAAO,EAAE,IAAI,UAAU,OAAO,IAAI;AACrD,MAAI,WAAW,GAAI,QAAO,EAAE,OAAO,UAAU,OAAO,IAAI;AACxD,MAAI,UAAU,EAAG,QAAO,EAAE,MAAM,UAAU,OAAO,IAAI;AACrD,SAAO;AACT;AAEO,SAAS,SAAS,KAAqB;AAC5C,UAAQ,KAAK;AAAA,IACX,KAAK;AACH,aAAO,EAAE,MAAM,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,IACpC,KAAK;AACH,aAAO,EAAE,SAAS,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,IACvC,KAAK;AACH,aAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,IACtC,KAAK;AACH,aAAO,EAAE,OAAO,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,IACrC;AACE,aAAO,EAAE,UAAU,EAAE,MAAM,IAAI,GAAG,GAAG,CAAC;AAAA,EAC1C;AACF;AAEO,IAAM,UAAU;AAAA,EACrB,OAAO,UAAU,WAAW;AAAA,EAC5B,OAAO,UAAU,WAAW;AAAA,EAC5B,OAAO,UAAU,WAAW;AAAA,EAC5B,KAAK,UAAU,WAAW;AAAA,EAC1B,MAAM,UAAU,cAAc;AAAA,EAC9B,KAAK,UAAU,cAAc;AAAA,EAC7B,MAAM,UAAU,cAAc;AAAA,EAC9B,SAAS,UAAU,iBAAiB;AAAA,EACpC,OAAO,UAAU,WAAW;AAAA,EAC5B,QAAQ,UAAU,oBAAoB;AAAA,EACtC,KAAK,UAAU,WAAW;AAAA,EAC1B,KAAK,UAAU,oBAAoB;AAAA,EACnC,OAAO,UAAU,cAAc;AAAA,EAC/B,SAAS,UAAU,cAAc;AAAA,EACjC,SAAS,UAAU,WAAW;AAChC;;;ACxEA,SAAS,oBAAoB;AAsBtB,SAAS,YAAY,SAAsC;AAChE,QAAM,SAAS,oBAAI,IAAoB;AACvC,QAAM,QAAQ,QAAQ,MAAM,OAAO;AAEnC,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,OAAO,MAAM,CAAC,EAAE,KAAK;AAE3B,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,EAAG;AAEnC,UAAM,QAAQ,KAAK,QAAQ,GAAG;AAC9B,QAAI,UAAU,GAAI;AAElB,UAAM,MAAM,KAAK,MAAM,GAAG,KAAK,EAAE,KAAK;AACtC,QAAI,QAAQ,KAAK,MAAM,QAAQ,CAAC,EAAE,KAAK;AAEvC,QACG,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,KAC3C,MAAM,WAAW,GAAG,KAAK,MAAM,SAAS,GAAG,GAC5C;AACA,cAAQ,MAAM,MAAM,GAAG,EAAE;AAAA,IAC3B;AAEA,UAAM,YAAoC;AAAA,MACxC,GAAG;AAAA,MAAM,GAAG;AAAA,MAAM,GAAG;AAAA,MAAM,MAAM;AAAA,MAAM,KAAK;AAAA,IAC9C;AACA,YAAQ,MAAM,QAAQ,iBAAiB,CAAC,GAAG,OAAO,UAAU,EAAE,KAAK,EAAE;AAIrE,QAAI,CAAC,KAAK,SAAS,GAAG,KAAK,CAAC,KAAK,SAAS,GAAG,GAAG;AAC9C,YAAM,eAAe,MAAM,MAAM,KAAK;AACtC,UAAI,gBAAgB,aAAa,UAAU,QAAW;AACpD,gBAAQ,MAAM,MAAM,GAAG,aAAa,KAAK,EAAE,KAAK;AAAA,MAClD;AAAA,IACF;AAEA,QAAI,IAAK,QAAO,IAAI,KAAK,KAAK;AAAA,EAChC;AAEA,SAAO;AACT;AAKO,SAAS,aACd,mBACA,UAAyB,CAAC,GACZ;AACd,MAAI;AAMJ,QAAM,SAAS,QAAQ,UAAU;AACjC,MAAI,WAAW,OAAO;AACpB,QAAI;AACF,gBAAU,aAAa,mBAAmB,MAAM;AAAA,IAClD,QAAQ;AACN,gBAAU;AAAA,IACZ;AAAA,EACF,OAAO;AACL,cAAU;AAAA,EACZ;AAEA,QAAM,QAAQ,YAAY,OAAO;AACjC,QAAM,SAAuB;AAAA,IAC3B,UAAU,CAAC;AAAA,IACX,SAAS,CAAC;AAAA,IACV,OAAO,MAAM;AAAA,EACf;AAEA,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO;AAChC,QAAI,QAAQ,gBAAgB,UAAU,KAAK;AAAA,MACzC,OAAO,QAAQ;AAAA,MACf,aAAa,QAAQ;AAAA,MACrB,QAAQ,QAAQ,UAAU;AAAA,IAC5B,CAAC,GAAG;AACF,aAAO,QAAQ,KAAK,GAAG;AACvB;AAAA,IACF;AAEA,QAAI,QAAQ,QAAQ;AAClB,aAAO,SAAS,KAAK,GAAG;AACxB;AAAA,IACF;AAEA,UAAM,UAA4B;AAAA,MAChC,OAAO,QAAQ,SAAS;AAAA,MACxB,aAAa,QAAQ,eAAe,QAAQ,IAAI;AAAA,MAChD,QAAQ,QAAQ,UAAU;AAAA,IAC5B;AAEA,cAAU,KAAK,OAAO,OAAO;AAC7B,WAAO,SAAS,KAAK,GAAG;AAAA,EAC1B;AAEA,SAAO;AACT;;;AC7HA,SAAS,uBAAuB;AAOhC,eAAsB,QACpB,SACA,EAAE,YAAY,MAAM,IAA6B,CAAC,GAChC;AAClB,MAAI,UAAW,QAAO;AACtB,MAAI,CAAC,QAAQ,MAAM,OAAO;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,QAAM,KAAK,gBAAgB;AAAA,IACzB,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,EACZ,CAAC;AAED,QAAM,SAAS,MAAM,IAAI,QAAgB,CAAC,YAAY;AACpD,OAAG,SAAS,GAAG,OAAO,WAAW,OAAO;AAAA,EAC1C,CAAC;AACD,KAAG,MAAM;AACT,SAAO,YAAY,KAAK,OAAO,KAAK,CAAC;AACvC;AAEA,eAAsB,aAAa,SAAkC;AACnE,QAAM,QAAQ,QAAQ;AAKtB,MAAI,CAAC,MAAM,OAAO;AAChB,QAAI,OAAO;AACX,UAAM,YAAY,MAAM;AACxB,qBAAiB,SAAS,OAAO;AAC/B,cAAQ;AAAA,IACV;AACA,UAAM,QAAQ,KAAK,QAAQ,UAAU,EAAE;AACvC,QAAI,MAAM,WAAW,GAAG;AACtB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAEA,QAAM,KAAK,gBAAgB;AAAA,IACzB,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,EACZ,CAAC;AAED,SAAO,IAAI,QAAQ,CAAC,YAAY;AAC9B,YAAQ,OAAO,MAAM,OAAO;AAE5B,UAAM,SAAS,MAAM;AACrB,QAAI,MAAM,SAAS,MAAM,YAAY;AACnC,YAAM,WAAW,IAAI;AAAA,IACvB;AAEA,QAAI,QAAQ;AAEZ,UAAM,SAAS,CAAC,UAAkB;AAChC,YAAM,OAAO,MAAM,SAAS,MAAM;AAClC,UAAI,SAAS,QAAQ,SAAS,MAAM;AAClC,cAAM,eAAe,QAAQ,MAAM;AACnC,YAAI,MAAM,SAAS,MAAM,YAAY;AACnC,gBAAM,WAAW,UAAU,KAAK;AAAA,QAClC;AACA,gBAAQ,OAAO,MAAM,IAAI;AACzB,WAAG,MAAM;AACT,gBAAQ,KAAK;AAAA,MACf,WAAW,SAAS,KAAU;AAC5B,gBAAQ,KAAK,CAAC;AAAA,MAChB,WAAW,SAAS,UAAY,SAAS,MAAM;AAC7C,gBAAQ,MAAM,MAAM,GAAG,EAAE;AAAA,MAC3B,OAAO;AACL,iBAAS;AAAA,MACX;AAAA,IACF;AAEA,UAAM,GAAG,QAAQ,MAAM;AAAA,EACzB,CAAC;AACH;;;ACtFO,SAAS,gBAAgBA,UAAkB,KAAuB;AACvE,QAAMC,KAAI;AACV,MAAIA,GAAE,KAAM,QAAO;AACnB,QAAM,IAAID,SAAQ,KAAK;AACvB,SAAO,CAAC,CAAC,EAAE;AACb;AAMO,SAAS,SAASA,UAAkB,KAAc,MAAwB;AAC/E,MAAI,CAAC,gBAAgBA,UAAS,GAAG,EAAG,QAAO;AAC3C,UAAQ,OAAO,MAAM,KAAK,UAAU,EAAE,IAAI,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,IAAI;AACvE,SAAO;AACT;AAOO,SAAS,QAAQ,GAAsC;AAC5D,SAAO,KAAK,OAAO,KAAK,GAAG,CAAC;AAC9B;AAEO,SAAS,QAAQ,GAAsC;AAC5D,SAAO,KAAK,OAAO,IAAI,OAAO,CAAC;AACjC;AAEO,SAAS,QAAW,KAAkC;AAC3D,SAAO,MAAM,IAAI,IAAI,CAAC,MAAO,OAAO,MAAM,WAAW,QAAQ,CAAC,IAAI,CAAO,IAAI,CAAC;AAChF;;;AChCO,SAAS,UAAU,KAOP;AACjB,MAAI;AACJ,MAAI,IAAI,OAAQ,SAAQ;AAAA,WACf,IAAI,QAAS,SAAQ;AAAA,WACrB,IAAI,KAAM,SAAQ;AAAA,WAClB,IAAI,IAAK,SAAQ;AAE1B,QAAM,cACJ,IAAI,gBAAgB,IAAI,UAAU,QAAQ,IAAI,IAAI;AAEpD,MAAI,UAAU,aAAa,CAAC,aAAa;AACvC,UAAM,IAAI,MAAM,4CAA4C;AAAA,EAC9D;AAEA,SAAO;AAAA,IACL;AAAA,IACA,aAAa,eAAe,QAAQ,IAAI;AAAA,IACxC,QAAQ,IAAI;AAAA,IACZ,OAAO,IAAI;AAAA,IACX,KAAK,IAAI;AAAA,IACT,QAAQ;AAAA,EACV;AACF;;;AC1BA,SAAS,4BAA4B,SAAyB;AAC5D,MAAI,MAAM;AACV,aAAWE,MAAK,SAAS;AACvB,QAAIA,OAAM,IAAK,QAAO;AAAA,aACbA,OAAM,IAAK,QAAO;AAAA,aAClB,eAAe,SAASA,EAAC,EAAG,QAAO,OAAOA;AAAA,aAC1CA,OAAM,IAAK,QAAO;AAAA,QACtB,QAAOA;AAAA,EACd;AACA,SAAO;AACT;AAKO,SAAS,uBACd,SACA,QACe;AACf,MAAI,CAAC,QAAQ,KAAK,EAAG,QAAO;AAC5B,QAAM,QAAQ,IAAI,OAAO,MAAM,4BAA4B,MAAM,IAAI,KAAK,GAAG;AAC7E,SAAO,QAAQ,OAAO,CAAC,MAAM,MAAM,KAAK,EAAE,GAAG,CAAC;AAChD;;;ACEO,SAAS,cAAc,OAAuB;AACnD,MAAI,UAAU,UAAW,QAAO,EAAE,IAAI,GAAG,QAAQ,KAAK,UAAU;AAChE,MAAI,UAAU,WAAY,QAAO,EAAE,OAAO,GAAG,QAAQ,OAAO,WAAW;AACvE,MAAI,UAAU,KAAM,QAAO,EAAE,MAAM,GAAG,QAAQ,KAAK,KAAK;AACxD,SAAO,EAAE,IAAI,aAAa;AAC5B;AAEO,SAAS,wBAAwBC,UAAwB;AAC9D,EAAAA,SACG,QAAQ,mBAAmB,EAC3B,YAAY,iDAAiD,EAC7D,OAAO,gBAAgB,uBAAuB,EAC9C,OAAO,iBAAiB,mCAAmC,EAC3D,OAAO,eAAe,qBAAqB,EAC3C,OAAO,cAAc,oBAAoB,EACzC,OAAO,yBAAyB,uBAAuB,EACvD;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,mBAAmB,6BAA6B,EACvD,OAAO,wBAAwB,4BAA4B,EAC3D,OAAO,iBAAiB,sBAAsB,EAC9C;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,8BAA8B,qCAAqC,EAC1E;AAAA,IACC;AAAA,IACA,oCAAoC,qBAAqB;AAAA,EAC3D,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,OAAO,KAAa,OAA2B,QAAQ;AAC7D,UAAM,OAAO,UAAU,GAAG;AAE1B,QAAI,CAAC,OAAO;AACV,cAAQ,MAAM;AAAA,QACZ,GAAG,QAAQ,GAAG,oBAAoB,EAAE,KAAK,GAAG,CAAC;AAAA,MAC/C;AACA,UAAI,CAAC,OAAO;AACV,gBAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,+BAA+B,CAAC;AACpE,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,QAAI;AACJ,QAAI,IAAI,gBAAgB,QAAW;AACjC,YAAM,SAAS,QAAQ,KAAK,OAAO,IAAI,WAAW,EAAE,KAAK,CAAC,IACtD,OAAO,IAAI,WAAW,IACtB,OAAO;AACX,UAAI,CAAC,uBAAuB,MAAM,GAAG;AACnC,gBAAQ;AAAA,UACN,EAAE;AAAA,YACA,GAAG,QAAQ,KAAK,gEAAgE,qBAAqB,UAAU,IAAI,WAAW;AAAA,UAChI;AAAA,QACF;AACA,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,wBAAkB;AAAA,IACpB;AAEA,UAAM,UAA4B;AAAA,MAChC,GAAG;AAAA,MACH,YAAY,IAAI;AAAA,MAChB,WAAW,IAAI;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,MACtD,gBAAgB,IAAI;AAAA,MACpB,gBAAgB,IAAI;AAAA,MACpB;AAAA,MACA,kBAAkB,IAAI;AAAA,MACtB,aAAa,IAAI;AAAA,IACnB;AAKA,UAAM,gBAAgB,YAAY,KAAK,IAAI;AAC3C,QAAI,eAAe,SAAS,KAAK,QAAQ;AACvC,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,OAAO,KAAK,GAAG,kHAA6G,GAAG;AAAA,QAC5I;AAAA,MACF;AAAA,IACF;AAEA,QAAI,IAAI,KAAK;AACX,YAAM,WAAW;AACjB,YAAM,SAAS,UAAU,UAAU,UAAU,CAAC;AAC9C,aAAO,IAAI,GAAG,IAAI;AAElB,UAAI,UAAU,UAAU,SAAS,CAAC,OAAO,SAAS,GAAG;AACnD,eAAO,SAAS,IAAI,SAAS,SAAS;AAAA,MACxC;AAEA,cAAQ,SAAS;AACjB,cAAQ,aAAa,UAAU,UAAU,cAAc,IAAI;AAC3D,gBAAU,KAAK,IAAI,OAAO;AAE1B,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,SAAS,IAAI,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,WAAW,KAAK,SAAS,QAAQ,CAAC,GAAG,CAAC;AAAA,MAC9H;AAAA,IACF,OAAO;AACL,gBAAU,KAAK,OAAO,OAAO;AAC7B,YAAM,SAAmB,CAAC;AAC1B,UAAI,IAAI,IAAK,QAAO,KAAK,GAAG,QAAQ,KAAK,QAAQ,IAAI,GAAG,GAAG;AAC3D,UAAI,gBAAiB,QAAO,KAAK,EAAE,IAAI,gBAAgB,eAAe,GAAG,CAAC;AAC1E,UAAI,IAAI,YAAa,QAAO,KAAK,EAAE,IAAI,IAAI,WAAW,CAAC;AAEvD,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,OAAO,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,WAAW,KAAK,SAAS,QAAQ,CAAC,GAAG,CAAC,IAAI,OAAO,KAAK,GAAG,CAAC;AAAA,MAC7H;AAAA,IACF;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,WAAW,EACnB,YAAY,uDAAuD,EACnE,OAAO,gBAAgB,2BAA2B,EAClD,OAAO,iBAAiB,4BAA4B,EACpD,OAAO,eAAe,yBAAyB,EAC/C,OAAO,cAAc,wBAAwB,EAC7C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,8BAA8B,EACxD,OAAO,SAAS,sDAAsD,EACtE,OAAO,CAAC,KAAa,QAAQ;AAC5B,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,QAAQ,UAAU,KAAK,IAAI;AAEjC,QAAI,UAAU,MAAM;AAClB,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,GAAG,aAAa,CAAC;AACjE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,IAAI,KAAK;AACX,cAAQ,OAAO,MAAM,KAAK;AAC1B;AAAA,IACF;AAEA,UAAM,UAAU,gBAAgBA,UAAS,GAAG,IACxC,EAAE,IAAI,MAAe,MAAM,EAAE,KAAK,MAAM,EAAE,IAC1C,EAAE,KAAK,MAAM;AAIjB,YAAQ,OAAO,MAAM,KAAK,UAAU,OAAO,IAAI,IAAI;AAAA,EACrD,CAAC;AAEH,EAAAA,SACG,QAAQ,WAAW,EACnB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,2BAA2B,EAClD,OAAO,iBAAiB,4BAA4B,EACpD,OAAO,eAAe,yBAAyB,EAC/C,OAAO,cAAc,wBAAwB,EAC7C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,eAAe,yCAAyC,EAC/D,OAAO,CAAC,KAAa,QAAQ;AAC5B,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,SAAS,UAAU,KAAK,IAAI;AAElC,QAAI,CAAC,IAAI,OAAO;AACd,UAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,gBAAQ,IAAI,KAAK,UAAU,EAAE,IAAI,MAAM,MAAM,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC;AAAA,MACjE,OAAO;AACL,gBAAQ,IAAI,SAAS,SAAS,OAAO;AAAA,MACvC;AAAA,IACF;AACA,QAAI,CAAC,OAAQ,SAAQ,WAAW;AAAA,EAClC,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB,MAAM,IAAI,EACV,YAAY,kCAAkC,EAC9C,OAAO,gBAAgB,+BAA+B,EACtD,OAAO,iBAAiB,gCAAgC,EACxD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,aAAa,8BAA8B,EAClD,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,KAAa,QAAQ;AAClC,UAAM,OAAO,UAAU,GAAG;AAE1B,QAAI,CAAE,MAAM,QAAQ,iBAAiB,GAAG,KAAK,EAAE,WAAW,IAAI,IAAI,CAAC,GAAI;AACrE,cAAQ,MAAM,EAAE,IAAI,UAAU,CAAC;AAC/B,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,KAAK,IAAI;AAEtC,QAAI,CAAC,SAAS;AACZ,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,GAAG,aAAa,CAAC;AACjE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,SAASA,UAAS,KAAK,EAAE,KAAK,SAAS,KAAK,CAAC,EAAG;AACpD,YAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EACrE,CAAC;AAEH,EAAAA,SACG,QAAQ,MAAM,EACd,MAAM,IAAI,EACV,YAAY,iDAAiD,EAC7D,OAAO,gBAAgB,wBAAwB,EAC/C,OAAO,iBAAiB,yBAAyB,EACjD,OAAO,eAAe,sBAAsB,EAC5C,OAAO,cAAc,qBAAqB,EAC1C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,gBAAgB,0BAA0B,EACjD,OAAO,mBAAmB,eAAe,EACzC,OAAO,aAAa,2BAA2B,EAC/C,OAAO,WAAW,sCAAsC,EACxD,OAAO,0BAA0B,0BAA0B,EAC3D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,QAAI,UAAU,YAAY,IAAI;AAE9B,QAAI,IAAI,KAAK;AACX,gBAAU,QAAQ;AAAA,QAAO,CAAC,MACxB,EAAE,UAAU,KAAK,MAAM,SAAS,IAAI,GAAG;AAAA,MACzC;AAAA,IACF;AACA,QAAI,IAAI,SAAS;AACf,gBAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,SAAS;AAAA,IACpD;AACA,QAAI,IAAI,OAAO;AACb,gBAAU,QAAQ;AAAA,QAChB,CAAC,MAAM,EAAE,OAAO,WAAW,CAAC,EAAE,OAAO;AAAA,MACvC;AAAA,IACF;AACA,QAAI,IAAI,QAAQ;AACd,gBAAU,uBAAuB,SAAS,IAAI,MAAM;AAAA,IACtD;AAEA,QACE;AAAA,MACEA;AAAA,MACA;AAAA,MACA,QAAQ,IAAI,CAAC,OAAO;AAAA,QAClB,KAAK,QAAQ,EAAE,GAAG;AAAA,QAClB,OAAO,QAAQ,EAAE,KAAK;AAAA,QACtB,MAAM,EAAE,UAAU,SAAS,kBAAkB;AAAA,QAC7C,cAAc,EAAE,UAAU,SACtB,OAAO,KAAK,EAAE,SAAS,MAAM,EAAE,IAAI,OAAO,IAC1C;AAAA,QACJ,MAAM,QAAQ,EAAE,UAAU,KAAK,IAAI;AAAA,QACnC,aAAa,QAAQ,EAAE,UAAU,KAAK,WAAW;AAAA,QACjD,gBAAgB,QAAQ,EAAE,UAAU,KAAK,WAAW,MAAM;AAAA,QAC1D,OAAO,EAAE,SAAS;AAAA,MACpB,EAAE;AAAA,IACJ,GACA;AACA;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,EAAE,IAAI,kBAAkB,CAAC;AACrC;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,oBAAoB,QAAQ,MAAM;AAAA,CAAK;AAAA,IAClE;AAEA,UAAM,YAAY,KAAK,IAAI,GAAG,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC;AAE9D,eAAW,SAAS,SAAS;AAC3B,YAAM,QAAkB,CAAC;AAEzB,YAAM,MAAM,QAAQ,MAAM,GAAG;AAC7B,YAAM,QAAQ,QAAQ,MAAM,KAAK;AACjC,YAAM,OAAO,MAAM,UAAU,SACzB,OAAO,KAAK,MAAM,SAAS,MAAM,EAAE,IAAI,OAAO,IAC9C;AACJ,YAAM,iBAAiB,QAAQ,MAAM,UAAU,KAAK,WAAW,MAAM;AACrE,YAAM,cAAc,QAAQ,MAAM,UAAU,KAAK,WAAW;AAC5D,YAAM,OAAO,QAAQ,MAAM,UAAU,KAAK,IAAI;AAC9C,YAAM,WAAW,QAAQ,MAAM,OAAO,eAAe;AACrD,YAAM,UAAU,CAAC,CAAC,MAAM,OAAO;AAC/B,YAAM,WAAW,QAAQ,MAAM,OAAO,aAAa;AAEnD,YAAM,KAAK,EAAE,IAAI,GAAG,IAAI,WAAW,KAAK,IAAI,EAAE,IAAI,GAAG,CAAC;AACtD,YAAM,KAAK,EAAE,KAAK,IAAI,OAAO,SAAS,CAAC,CAAC;AAExC,UAAI,MAAM;AACR,cAAM,KAAK,EAAE,QAAQ,IAAI,KAAK,KAAK,GAAG,CAAC,GAAG,CAAC;AAAA,MAC7C;AAEA,UAAI,MAAM,UAAU,WAAW,KAAK,UAAU;AAC5C,cAAM,KAAK,eAAe,UAAU,OAAO,CAAC;AAC5C,YAAI,YAAY,CAAC,SAAS;AACxB,gBAAM,KAAK,EAAE,IAAI,QAAQ,CAAC;AAAA,QAC5B;AAAA,MACF;AAEA,UAAI,iBAAiB,GAAG;AACtB,cAAM,KAAK,EAAE,KAAK,GAAG,QAAQ,IAAI,IAAI,cAAc,EAAE,CAAC;AAAA,MACxD;AAEA,UAAI,cAAc,GAAG;AACnB,cAAM,KAAK,EAAE,IAAI,GAAG,QAAQ,GAAG,IAAI,WAAW,EAAE,CAAC;AAAA,MACnD;AAEA,UAAI,KAAK,SAAS,GAAG;AACnB,cAAM,KAAK,EAAE,IAAI,KAAK,IAAI,CAAC,MAAM,IAAI,CAAC,EAAE,EAAE,KAAK,GAAG,CAAC,CAAC;AAAA,MACtD;AAEA,cAAQ,IAAI,KAAK,MAAM,KAAK,IAAI,CAAC,EAAE;AAAA,IACrC;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,eAAe,EACvB,YAAY,qCAAqC,EACjD,OAAO,gBAAgB,2BAA2B,EAClD,OAAO,iBAAiB,4BAA4B,EACpD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,KAAa,QAAQ;AAC5B,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,SAAS,YAAY,KAAK,IAAI;AAEpC,QAAI,CAAC,QAAQ;AACX,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,GAAG,aAAa,CAAC;AACjE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,EAAE,UAAU,MAAM,IAAI;AAC5B,UAAM,QAAQ,WAAW,QAAQ;AACjC,UAAM,WAAW,eAAe,SAAS,IAAI;AAE7C,QACE,SAASA,UAAS,KAAK;AAAA,MACrB,KAAK,QAAQ,GAAG;AAAA,MAChB,OAAO,QAAQ,KAAK;AAAA,MACpB,MAAM,SAAS,SAAS,kBAAkB;AAAA,MAC1C,cAAc,SAAS,SACnB,OAAO,KAAK,SAAS,MAAM,EAAE,IAAI,OAAO,IACxC;AAAA,MACJ,YAAY,SAAS,aAAa,QAAQ,SAAS,UAAU,IAAI;AAAA,MACjE,WAAW,QAAQ,SAAS,KAAK,SAAS;AAAA,MAC1C,WAAW,QAAQ,SAAS,KAAK,SAAS;AAAA,MAC1C,aAAa,QAAQ,SAAS,KAAK,WAAW;AAAA,MAC9C,gBAAgB,SAAS,KAAK,iBAC1B,QAAQ,SAAS,KAAK,cAAc,IACpC;AAAA,MACJ,aAAa,SAAS,KAAK,cACvB,QAAQ,SAAS,KAAK,WAAW,IACjC;AAAA,MACJ,MAAM,QAAQ,SAAS,KAAK,IAAI;AAAA,MAChC,YAAY,SAAS,KAAK,aAAa,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,QACrD,SAAS,QAAQ,EAAE,OAAO;AAAA,QAC1B,KAAK,QAAQ,EAAE,GAAG;AAAA,MACpB,EAAE;AAAA,MACF;AAAA,MACA;AAAA,IACF,CAAC,GACD;AACA;AAAA,IACF;AAEA,UAAM,YAAY,QAAQ,KAAK;AAC/B,UAAM,YAAY,QAAQ,SAAS,KAAK,SAAS;AACjD,UAAM,YAAY,QAAQ,SAAS,KAAK,SAAS;AACjD,UAAM,cAAc,QAAQ,SAAS,KAAK,WAAW;AACrD,UAAM,aAAa,QAAQ,SAAS,KAAK,cAAc;AACvD,UAAM,OAAO,QAAQ,SAAS,KAAK,WAAW;AAC9C,UAAM,OAAO,QAAQ,SAAS,KAAK,IAAI;AACvC,UAAM,aAAa,SAAS,KAAK,aAAa,CAAC,GAAG,IAAI,CAAC,OAAO;AAAA,MAC5D,SAAS,QAAQ,EAAE,OAAO;AAAA,MAC1B,KAAK,QAAQ,EAAE,GAAG;AAAA,IACpB,EAAE;AACF,UAAM,YAAY,SAAS,SACvB,OAAO,KAAK,SAAS,MAAM,EAAE,IAAI,OAAO,IACxC;AACJ,UAAM,aAAa,QAAQ,SAAS,UAAU;AAC9C,UAAM,YAAY,QAAQ,MAAM,aAAa;AAC7C,UAAM,WAAW,QAAQ,MAAM,eAAe;AAC9C,UAAM,UAAU,CAAC,CAAC,MAAM;AAExB,YAAQ,IAAI;AAAA,IAAO,EAAE,KAAK,QAAQ,MAAM,MAAM,GAAG,CAAC,EAAE;AACpD,YAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,WAAW,SAAS,CAAC,EAAE;AAE/D,QAAI,WAAW;AACb,cAAQ,IAAI,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,QAAQ,eAAe,CAAC,EAAE;AACpE,cAAQ,IAAI,KAAK,EAAE,IAAI,SAAS,CAAC,EAAE;AACnC,iBAAW,OAAO,WAAW;AAC3B,cAAM,YAAY,QAAQ;AAC1B,gBAAQ;AAAA,UACN,OAAO,SAAS,GAAG,CAAC,IAAI,YAAY,EAAE,IAAI,WAAW,IAAI,EAAE;AAAA,QAC7D;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ,IAAI,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,EAAE,MAAM,WAAW,CAAC,EAAE;AAAA,IAChE;AAEA,YAAQ,IAAI,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE;AACnD,YAAQ,IAAI,KAAK,EAAE,IAAI,UAAU,CAAC,MAAM,SAAS,EAAE;AACnD,YAAQ,IAAI,KAAK,EAAE,IAAI,WAAW,CAAC,KAAK,WAAW,QAAQ;AAE3D,QAAI,YAAY;AACd,cAAQ,IAAI,KAAK,EAAE,IAAI,YAAY,CAAC,IAAI,UAAU,EAAE;AAAA,IACtD;AAEA,QAAI,MAAM;AACR,cAAQ,IAAI,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,IAAI,EAAE;AAAA,IAChD;AAEA,QAAI,KAAK,SAAS,GAAG;AACnB,cAAQ;AAAA,QACN,KAAK,EAAE,IAAI,OAAO,CAAC,SAAS,KAAK,IAAI,CAAC,MAAM,EAAE,KAAK,IAAI,CAAC,EAAE,CAAC,EAAE,KAAK,GAAG,CAAC;AAAA,MACxE;AAAA,IACF;AAEA,QAAI,WAAW;AACb,cAAQ;AAAA,QACN,KAAK,EAAE,IAAI,QAAQ,CAAC,QAAQ,eAAe,UAAU,OAAO,CAAC,IAAI,SAAS;AAAA,MAC5E;AAAA,IACF;AAEA,UAAM,SAAS,GAAG,SAAS,OAAO;AAClC,UAAM,UACJ,SAAS,UAAU,gBACf,EAAE,IAAI,gBAAgB,MAAM,uBAAoB,IAChD,GAAG,cAAc,SAAS,KAAK,CAAC,IAAI,iBAAiB,QAAQ,CAAC,IAAI,EAAE,IAAI,iBAAiB,MAAM,WAAW,SAAS,eAAe,IAAI,CAAC;AAC7I,YAAQ,IAAI,KAAK,EAAE,IAAI,WAAW,CAAC,KAAK,OAAO,EAAE;AAEjD,QAAI,UAAU,SAAS,GAAG;AACxB,cAAQ,IAAI,KAAK,EAAE,IAAI,YAAY,CAAC,EAAE;AACtC,iBAAW,QAAQ,WAAW;AAC5B,gBAAQ,IAAI,OAAO,QAAQ,IAAI,IAAI,KAAK,OAAO,IAAI,KAAK,GAAG,EAAE;AAAA,MAC/D;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,QAAQ,EAChB,YAAY,0DAA0D,EACtE,OAAO,yBAAyB,8BAA8B,KAAK,EACnE,OAAO,gBAAgB,0BAA0B,EACjD,OAAO,iBAAiB,2BAA2B,EACnD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,gCAAgC,EAC1D,OAAO,qBAAqB,qCAAqC,EACjE,OAAO,qBAAqB,mCAAmC,EAC/D,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,SAAS,cAAc;AAAA,MAC3B,GAAG;AAAA,MACH,QAAQ,IAAI;AAAA,MACZ,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,MACtD,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,IACxD,CAAC;AACD,YAAQ,OAAO,MAAM,SAAS,IAAI;AAAA,EACpC,CAAC;AAEH,EAAAA,SACG,QAAQ,eAAe,EACvB,YAAY,iCAAiC,EAC7C,OAAO,gBAAgB,wBAAwB,EAC/C,OAAO,iBAAiB,yBAAyB,EACjD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,qBAAqB,EAC/C,OAAO,mBAAmB,8BAA8B,EACxD,OAAO,aAAa,+CAA+C,EACnE,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,MAAc,QAAQ;AAC7B,UAAM,OAAO,UAAU,GAAG;AAE1B,UAAM,SAAS,aAAa,MAAM;AAAA,MAChC,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,MAClB,QAAQ;AAAA,MACR,cAAc,IAAI;AAAA,MAClB,QAAQ,IAAI;AAAA,IACd,CAAC;AAED,QAAI,SAASA,UAAS,KAAK,EAAE,MAAM,QAAQ,CAAC,CAAC,IAAI,QAAQ,GAAG,OAAO,CAAC,GAAG;AACrE;AAAA,IACF;AAEA,QAAI,IAAI,QAAQ;AACd,cAAQ;AAAA,QACN;AAAA,IAAO,QAAQ,OAAO,IAAI,EAAE,KAAK,SAAS,CAAC,wBAAmB,OAAO,SAAS,MAAM,OAAO,OAAO,KAAK;AAAA;AAAA,MACzG;AACA,iBAAW,OAAO,OAAO,UAAU;AACjC,gBAAQ,IAAI,KAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,MAC/C;AACA,UAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,gBAAQ;AAAA,UACN;AAAA,IAAO,EAAE,IAAI,uBAAuB,OAAO,QAAQ,KAAK,IAAI,CAAC,EAAE,CAAC;AAAA,QAClE;AAAA,MACF;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,OAAO,SAAS,MAAM,mBAAmB,EAAE,KAAK,IAAI,CAAC;AAAA,MAClG;AACA,UAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,gBAAQ;AAAA,UACN,EAAE;AAAA,YACA,aAAa,OAAO,QAAQ,MAAM,cAAc,OAAO,QAAQ,KAAK,IAAI,CAAC;AAAA,UAC3E;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AACL;;;AC1iBA,SAAS,aAAa,iBAAiB;AAmBvC,IAAM,YACJ;AACF,IAAM,iBACJ;AAEF,SAAS,aAAa,SAAiB,QAAwB;AAC7D,MAAI,SAAS;AACb,WAAS,IAAI,GAAG,IAAI,QAAQ,KAAK;AAC/B,cAAU,QAAQ,UAAU,QAAQ,MAAM,CAAC;AAAA,EAC7C;AACA,SAAO;AACT;AAEO,SAAS,eAAe,OAAqB,CAAC,GAAW;AAC9D,QAAM,SAAS,KAAK,UAAU;AAE9B,UAAQ,QAAQ;AAAA,IACd,KAAK,OAAO;AACV,YAAM,MAAM,KAAK,UAAU;AAC3B,aAAO,YAAY,GAAG,EAAE,SAAS,KAAK;AAAA,IACxC;AAAA,IAEA,KAAK,UAAU;AACb,YAAM,MAAM,KAAK,UAAU;AAC3B,aAAO,YAAY,GAAG,EAAE,SAAS,WAAW;AAAA,IAC9C;AAAA,IAEA,KAAK,gBAAgB;AACnB,YAAM,MAAM,KAAK,UAAU;AAC3B,aAAO,aAAa,WAAW,GAAG;AAAA,IACpC;AAAA,IAEA,KAAK,QAAQ;AACX,YAAM,QAAQ,YAAY,EAAE;AAC5B,YAAM,CAAC,IAAK,MAAM,CAAC,IAAI,KAAQ;AAC/B,YAAM,CAAC,IAAK,MAAM,CAAC,IAAI,KAAQ;AAC/B,YAAM,MAAM,MAAM,SAAS,KAAK;AAChC,aAAO;AAAA,QACL,IAAI,MAAM,GAAG,CAAC;AAAA,QACd,IAAI,MAAM,GAAG,EAAE;AAAA,QACf,IAAI,MAAM,IAAI,EAAE;AAAA,QAChB,IAAI,MAAM,IAAI,EAAE;AAAA,QAChB,IAAI,MAAM,IAAI,EAAE;AAAA,MAClB,EAAE,KAAK,GAAG;AAAA,IACZ;AAAA,IAEA,KAAK,WAAW;AACd,YAAM,SAAS,KAAK,UAAU;AAC9B,YAAM,MAAM,KAAK,UAAU;AAC3B,aAAO,SAAS,aAAa,WAAW,GAAG;AAAA,IAC7C;AAAA,IAEA,KAAK,SAAS;AACZ,YAAM,SAAS,KAAK,UAAU;AAC9B,YAAM,MAAM,KAAK,UAAU;AAC3B,aAAO,SAAS,YAAY,GAAG,EAAE,SAAS,WAAW;AAAA,IACvD;AAAA,IAEA,KAAK,YAAY;AACf,YAAM,MAAM,KAAK,UAAU;AAK3B,YAAM,gBAAgB;AAAA,QACpB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,YAAM,aAAa,cAChB,MAAM,GAAG,KAAK,IAAI,cAAc,QAAQ,GAAG,CAAC,EAC5C,IAAI,CAAC,OAAO,aAAa,IAAI,CAAC,CAAC;AAClC,YAAM,YAAY,KAAK,IAAI,GAAG,MAAM,WAAW,MAAM;AACrD,YAAM,QAAQ;AAAA,QACZ,GAAG;AAAA,QACH,GAAI,YAAY,IAAI,aAAa,gBAAgB,SAAS,EAAE,MAAM,EAAE,IAAI,CAAC;AAAA,MAC3E;AAGA,eAAS,IAAI,MAAM,SAAS,GAAG,IAAI,GAAG,KAAK;AACzC,cAAM,IAAI,UAAU,IAAI,CAAC;AACzB,SAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,MAAM,CAAC,CAAC;AAAA,MAC5C;AAEA,aAAO,MAAM,KAAK,EAAE;AAAA,IACtB;AAAA,IAEA;AACE,aAAO,YAAY,EAAE,EAAE,SAAS,KAAK;AAAA,EACzC;AACF;AAKO,SAAS,gBAAgB,QAAwB;AACtD,QAAM,WAAW;AAAA,IACf,EAAE,OAAO,SAAS,MAAM,GAAG;AAAA,IAC3B,EAAE,OAAO,SAAS,MAAM,GAAG;AAAA,IAC3B,EAAE,OAAO,SAAS,MAAM,GAAG;AAAA,IAC3B,EAAE,OAAO,gBAAgB,MAAM,GAAG;AAAA,EACpC;AAEA,MAAI,WAAW;AACf,aAAW,EAAE,OAAO,KAAK,KAAK,UAAU;AACtC,QAAI,MAAM,KAAK,MAAM,EAAG,aAAY;AAAA,EACtC;AAEA,SAAO,WAAW,IAAI,KAAK,MAAM,KAAK,KAAK,QAAQ,IAAI,OAAO,MAAM,IAAI;AAC1E;;;AC7GA,SAAS,YACP,KACA,SACA,YAAY,KACmC;AAC/C,SAAO,YAAY,EAAE,KAAK,QAAQ,OAAO,SAAS,UAAU,CAAC;AAC/D;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACpB,YAAY,oBAAI,IAAsB;AAAA,EAE9C,SAAS,UAA0B;AACjC,SAAK,UAAU,IAAI,SAAS,MAAM,QAAQ;AAAA,EAC5C;AAAA,EAEA,IAAI,MAAoC;AACtC,WAAO,KAAK,UAAU,IAAI,IAAI;AAAA,EAChC;AAAA,EAEA,eACE,OACA,OACsB;AACtB,QAAI,OAAO,UAAU;AACnB,aAAO,KAAK,UAAU,IAAI,MAAM,QAAQ;AAAA,IAC1C;AAEA,eAAW,YAAY,KAAK,UAAU,OAAO,GAAG;AAC9C,UAAI,SAAS,UAAU;AACrB,mBAAW,OAAO,SAAS,UAAU;AACnC,cAAI,MAAM,WAAW,GAAG,EAAG,QAAO;AAAA,QACpC;AAAA,MACF;AAAA,IACF;AAEA,WAAO;AAAA,EACT;AAAA,EAEA,gBAA4B;AAC1B,WAAO,CAAC,GAAG,KAAK,UAAU,OAAO,CAAC;AAAA,EACpC;AACF;AAQA,SAAS,iBAAiB,KAMb;AACX,SAAO;AAAA,IACL,MAAM,IAAI;AAAA,IACV,aAAa,IAAI;AAAA,IACjB,UAAU,IAAI;AAAA,IACd,MAAM,SAAS,OAA0C;AACvD,YAAM,QAAQ,KAAK,IAAI;AACvB,UAAI;AACF,cAAM,EAAE,WAAW,IAAI,MAAM,YAAY,IAAI,KAAK;AAAA,UAChD,cAAc;AAAA,UACd,GAAG,IAAI,QAAQ,KAAK;AAAA,QACtB,CAAC;AACD,cAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,YAAI,eAAe;AACjB,iBAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,oBAAoB,WAAW,UAAU,IAAI,KAAK;AACpG,YAAI,eAAe,OAAO,eAAe;AACvC,iBAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,+BAA+B,UAAU,KAAK,WAAW,UAAU,IAAI,KAAK;AACjI,YAAI,eAAe;AACjB,iBAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,wCAAmC,WAAW,UAAU,IAAI,KAAK;AACnH,eAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,IAAI,KAAK;AAAA,MACpH,SAAS,KAAK;AACZ,eAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG,eAAe,QAAQ,IAAI,UAAU,eAAe,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,IAAI,KAAK;AAAA,MAChK;AAAA,IACF;AAAA,EACF;AACF;AAMA,IAAM,oBAAoB,iBAAiB;AAAA,EACzC,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,SAAS;AAAA,EACpB,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,aAAa,OAAO,qBAAqB,aAAa;AAC/E,CAAC;AAED,IAAM,qBAAqB,iBAAiB;AAAA,EAC1C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,QAAQ;AAAA,EACnB,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,eAAe,UAAU,KAAK,GAAG;AAC1D,CAAC;AAED,IAAM,mBAAmB,iBAAiB;AAAA,EACxC,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,MAAM;AAAA,EACjB,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,kBAAkB,MAAM;AACjD,CAAC;AAED,IAAM,eAAe,iBAAiB;AAAA,EACpC,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,MAAM;AAAA,EACjB,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,eAAe,UAAU,KAAK,GAAG;AAC1D,CAAC;AAED,IAAM,sBAAsB,iBAAiB;AAAA,EAC3C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,KAAK;AAAA,EAChB,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,eAAe,UAAU,KAAK,GAAG;AAC1D,CAAC;AAID,IAAM,qBAAqB,iBAAiB;AAAA,EAC1C,MAAM;AAAA,EACN,aAAa;AAAA,EACb,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,cAAc,MAAM;AAC7C,CAAC;AAGD,IAAM,iBAAiB,iBAAiB;AAAA,EACtC,MAAM;AAAA,EACN,aAAa;AAAA,EACb,KAAK;AAAA,EACL,SAAS,CAAC,WAAW,EAAE,eAAe,UAAU,KAAK,GAAG;AAC1D,CAAC;AAED,IAAM,iBAA2B;AAAA,EAC/B,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,KAAK;AAAA,EAChB,MAAM,SAAS,OAA0C;AACvD,UAAM,QAAQ,KAAK,IAAI;AACvB,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA;AAAA,UACE,eAAe,UAAU,KAAK;AAAA,UAC9B,cAAc;AAAA,QAChB;AAAA,MACF;AACA,YAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,oBAAoB,WAAW,UAAU,SAAS;AACpG,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,8BAA8B,WAAW,UAAU,SAAS;AACjH,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,wCAAmC,WAAW,UAAU,SAAS;AACnH,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,SAAS;AAAA,IACpH,SAAS,KAAK;AACZ,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG,eAAe,QAAQ,IAAI,UAAU,eAAe,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,SAAS;AAAA,IAChK;AAAA,EACF;AACF;AAEA,IAAM,iBAA2B;AAAA,EAC/B,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,YAAY,YAAY,YAAY,YAAY,YAAY,UAAU;AAAA,EACjF,MAAM,SAAS,OAA0C;AACvD,UAAM,QAAQ,KAAK,IAAI;AACvB,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA;AAAA,UACE,eAAe,UAAU,KAAK;AAAA,UAC9B,cAAc;AAAA,QAChB;AAAA,MACF;AACA,YAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,oBAAoB,WAAW,UAAU,SAAS;AACpG,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,8BAA8B,WAAW,UAAU,SAAS;AACjH,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,wCAAmC,WAAW,UAAU,SAAS;AACnH,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,SAAS;AAAA,IACpH,SAAS,KAAK;AACZ,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG,eAAe,QAAQ,IAAI,UAAU,eAAe,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,SAAS;AAAA,IAChK;AAAA,EACF;AACF;AAEA,IAAM,iBAA2B;AAAA,EAC/B,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,QAAQ,QAAQ,QAAQ,QAAQ,QAAQ,aAAa;AAAA,EAChE,MAAM,SAAS,OAA0C;AACvD,UAAM,QAAQ,KAAK,IAAI;AACvB,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM;AAAA,QAC3B;AAAA,QACA;AAAA,UACE,eAAe,SAAS,KAAK;AAAA,UAC7B,cAAc;AAAA,UACd,QAAQ;AAAA,QACV;AAAA,MACF;AACA,YAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,kBAAkB,WAAW,UAAU,SAAS;AAClG,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,4BAA4B,WAAW,UAAU,SAAS;AAC/G,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,oCAAoC,WAAW,UAAU,SAAS;AACvH,UAAI,eAAe;AACjB,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,0CAAqC,WAAW,UAAU,SAAS;AACrH,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,SAAS;AAAA,IACpH,SAAS,KAAK;AACZ,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG,eAAe,QAAQ,IAAI,UAAU,eAAe,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,SAAS;AAAA,IAChK;AAAA,EACF;AACF;AAEA,IAAM,cAAwB;AAAA,EAC5B,MAAM;AAAA,EACN,aAAa;AAAA,EACb,UAAU,CAAC,QAAQ,MAAM;AAAA,EACzB,MAAM,SAAS,OAA0C;AACvD,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,QAAI,4BAA4B,KAAK,KAAK,GAAG;AAC3C,aAAO,EAAE,OAAO,MAAM,QAAQ,WAAW,SAAS,oEAAoE,WAAW,UAAU,MAAM;AAAA,IACnJ;AACA,WAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,iCAAiC,WAAW,UAAU,MAAM;AAAA,EACjH;AACF;AAEA,IAAM,eAAyB;AAAA,EAC7B,MAAM;AAAA,EACN,aAAa;AAAA,EACb,MAAM,SAAS,OAAe,KAAyC;AACrE,UAAM,QAAQ,KAAK,IAAI;AAEvB,QAAI,CAAC,KAAK;AACR,aAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,gCAAgC,WAAW,GAAG,UAAU,OAAO;AAAA,IACpH;AAEA,UAAM,YAAY,MAAM,UAAU,GAAG;AACrC,QAAI,WAAW;AACb,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,iBAAiB,SAAS,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,OAAO;AAAA,IACjI;AAEA,QAAI;AACF,YAAM,EAAE,WAAW,IAAI,MAAM,YAAY,KAAK;AAAA,QAC5C,eAAe,UAAU,KAAK;AAAA,QAC9B,cAAc;AAAA,MAChB,CAAC;AACD,YAAM,YAAY,KAAK,IAAI,IAAI;AAE/B,UAAI,cAAc,OAAO,aAAa;AACpC,eAAO,EAAE,OAAO,MAAM,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,OAAO;AACjH,UAAI,eAAe,OAAO,eAAe;AACvC,eAAO,EAAE,OAAO,OAAO,QAAQ,WAAW,SAAS,0BAA0B,UAAU,KAAK,WAAW,UAAU,OAAO;AAC1H,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,qBAAqB,UAAU,IAAI,WAAW,UAAU,OAAO;AAAA,IAClH,SAAS,KAAK;AACZ,aAAO,EAAE,OAAO,OAAO,QAAQ,SAAS,SAAS,GAAG,eAAe,QAAQ,IAAI,UAAU,eAAe,IAAI,WAAW,KAAK,IAAI,IAAI,OAAO,UAAU,OAAO;AAAA,IAC9J;AAAA,EACF;AACF;AAEO,IAAMC,YAAW,IAAI,iBAAiB;AAI7CA,UAAS,SAAS,iBAAiB;AACnCA,UAAS,SAAS,kBAAkB;AACpCA,UAAS,SAAS,cAAc;AAChCA,UAAS,SAAS,gBAAgB;AAClCA,UAAS,SAAS,YAAY;AAC9BA,UAAS,SAAS,mBAAmB;AACrCA,UAAS,SAAS,kBAAkB;AACpCA,UAAS,SAAS,cAAc;AAChCA,UAAS,SAAS,cAAc;AAChCA,UAAS,SAAS,cAAc;AAChCA,UAAS,SAAS,WAAW;AAC7BA,UAAS,SAAS,YAAY;AAK9B,eAAsB,eACpB,OACA,MAC2B;AAC3B,QAAM,WAAW,MAAM,WACnBA,UAAS,IAAI,KAAK,QAAQ,IAC1BA,UAAS,eAAe,KAAK;AAEjC,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,MACL,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,SAAS;AAAA,MACT,WAAW;AAAA,MACX,UAAU;AAAA,IACZ;AAAA,EACF;AAEA,MAAI,SAAS,SAAS,UAAU,MAAM,eAAe;AACnD,WAAQ,SAAiB,SAAS,OAAO,KAAK,aAAa;AAAA,EAC7D;AAEA,SAAO,SAAS,SAAS,KAAK;AAChC;AAoBA,eAAsB,mBACpB,OACA,cACyB;AACzB,QAAM,WAAW,eACbA,UAAS,IAAI,YAAY,IACzBA,UAAS,eAAe,KAAK;AAEjC,MAAI,CAAC,UAAU;AACb,WAAO,EAAE,SAAS,OAAO,UAAU,QAAQ,SAAS,oCAAoC;AAAA,EAC1F;AAEA,QAAM,YAAY;AAClB,MAAI,UAAU,oBAAoB,UAAU,QAAQ;AAClD,WAAO,UAAU,OAAO,KAAK;AAAA,EAC/B;AAGA,QAAM,SAAsB;AAC5B,QAAM,WAAW,eAAe,EAAE,QAAQ,QAAQ,GAAG,CAAC;AACtD,SAAO;AAAA,IACL,SAAS;AAAA,IACT,UAAU,SAAS;AAAA,IACnB,SAAS,aAAa,SAAS,IAAI;AAAA,IACnC;AAAA,EACF;AACF;AAcA,eAAsB,gBACpB,SAC4E;AAC5E,QAAM,UAA0B,CAAC;AAEjC,aAAW,KAAK,SAAS;AACvB,UAAM,aAAa,MAAM,eAAe,EAAE,OAAO;AAAA,MAC/C,UAAU,EAAE;AAAA,MACZ,eAAe,EAAE;AAAA,IACnB,CAAC;AAED,YAAQ,KAAK;AAAA,MACX,KAAK,EAAE;AAAA,MACP;AAAA,MACA,kBAAkB,WAAW,WAAW;AAAA,IAC1C,CAAC;AAAA,EACH;AAEA,QAAM,YAAY,QAAQ,OAAO,CAAC,MAAM,CAAC,EAAE,WAAW,KAAK,EAAE;AAE7D,SAAO,EAAE,SAAS,UAAU,cAAc,GAAG,UAAU;AACzD;;;ACrXO,SAAS,kBAAkB,OAAuB,CAAC,GAAmB;AAC3E,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,QAAM,YAAY,oBAAoB,EAAE,YAAY,CAAC;AAErD,QAAM,cAAc,YAAY;AAAA,IAC9B,GAAG;AAAA,IACH;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AAED,MAAI,eAAe;AACnB,MAAI,aAAa;AACjB,MAAI,iBAAiB;AAErB,QAAM,UAA2B,YAAY,IAAI,CAAC,UAAU;AAC1D,UAAM,OAAO,MAAM,UAAU;AAC7B,UAAM,QAAQ,MAAM;AAEpB,QAAI,OAAO,UAAW;AACtB,QAAI,OAAO,QAAS;AACpB,QAAI,MAAM,iBAAkB;AAE5B,WAAO;AAAA,MACL,KAAK,MAAM;AAAA,MACX,OAAO,MAAM;AAAA,MACb,MAAM,MAAM;AAAA,MACZ,aAAa,MAAM;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,kBAAkB,MAAM;AAAA,MACxB,aAAa,MAAM;AAAA,MACnB,WAAW,CAAC,EAAE,MAAM,UAAU,UAAU,OAAO,KAAK,MAAM,SAAS,MAAM,EAAE,SAAS;AAAA,MACpF,WAAW,OAAO,aAAa;AAAA,MAC/B,SAAS,OAAO,WAAW;AAAA,MAC3B,eAAe,OAAO,iBAAiB;AAAA,MACvC,aAAa,MAAM,eAAe;AAAA,MAClC,cAAc,MAAM,kBAAkB;AAAA,MACtC,gBAAgB,MAAM;AAAA,IACxB;AAAA,EACF,CAAC;AAGD,MAAI,WAAuC;AAC3C,QAAM,SAAS,kBAAkB,WAAW;AAC5C,MAAI,QAAQ,SAAS;AACnB,UAAM,eAAe,OAAO,KAAK,OAAO,OAAO;AAC/C,UAAM,eAAe,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC;AACtD,UAAM,UAAU,aAAa,OAAO,CAAC,MAAM,CAAC,aAAa,IAAI,CAAC,CAAC;AAC/D,eAAW,EAAE,UAAU,aAAa,QAAQ,QAAQ;AAAA,EACtD;AAGA,QAAM,eAAe,WAAW,EAAE,OAAO,GAAG,CAAC;AAC7C,QAAM,gBAAgB,aAAa,IAAI,CAAC,OAAO;AAAA,IAC7C,QAAQ,EAAE;AAAA,IACV,KAAK,EAAE;AAAA,IACP,QAAQ,EAAE;AAAA,IACV,WAAW,EAAE;AAAA,EACf,EAAE;AAEF,SAAO;AAAA,IACL;AAAA,IACA,aAAa,YACT,EAAE,KAAK,UAAU,KAAK,QAAQ,UAAU,OAAO,IAC/C;AAAA,IACJ;AAAA,IACA,cAAc,QAAQ;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,qBAAqBC,UAAiB,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IACvE,cAAc,SAAY,cAAc,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,IAC3D,YAAY,UAAU,EAAE;AAAA,IACxB;AAAA,EACF;AACF;;;ACzHA,SAAS,eAAe,gBAAAC,eAAc,kBAAkB;AAMjD,SAAS,wBAAwBC,UAAwB;AAC9D,EAAAA,SACG,QAAQ,SAAS,EACjB,MAAM,UAAU,EAChB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,6CAA6C,EAC9D,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,kBAAkB,IAAI;AAEtC,QAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,cAAQ,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAC5C;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,kCAAkC,CAAC,EAAE;AAC5E,YAAQ,IAAI,cAAc,EAAE,KAAK,QAAQ,WAAW,CAAC,EAAE;AAEvD,QAAI,QAAQ,aAAa;AACvB,cAAQ;AAAA,QACN,kBAAkB,SAAS,QAAQ,YAAY,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,QAAQ,YAAY,MAAM,GAAG,CAAC;AAAA,MACjG;AAAA,IACF;AAEA,YAAQ;AAAA,MACN;AAAA,EAAK,EAAE,KAAK,YAAY,CAAC,IAAI,QAAQ,YAAY,WAAW,EAAE,IAAI,IAAI,QAAQ,YAAY,aAAa,QAAQ,UAAU,WAAW,QAAQ,cAAc,aAAa,CAAC;AAAA,IAC1K;AACA,eAAW,KAAK,QAAQ,SAAS;AAC/B,YAAM,OAAO,EAAE,MAAM,SAAS,EAAE,IAAI,KAAK,EAAE,KAAK,KAAK,GAAG,CAAC,GAAG,IAAI;AAChE,YAAM,QAAkB,CAAC;AACzB,UAAI,EAAE,iBAAkB,OAAM,KAAK,EAAE,OAAO,QAAQ,CAAC;AACrD,UAAI,EAAE,YAAa,OAAM,KAAK,EAAE,QAAQ,KAAK,CAAC;AAC9C,UAAI,EAAE,UAAW,OAAM,KAAK,EAAE,KAAK,eAAe,CAAC;AACnD,UAAI,EAAE,UAAW,OAAM,KAAK,EAAE,IAAI,SAAS,CAAC;AAAA,eACnC,EAAE,QAAS,OAAM,KAAK,EAAE,OAAO,OAAO,CAAC;AAChD,YAAM,UAAU,MAAM,SAAS,IAAI,MAAM,KAAK,GAAG,CAAC,KAAK;AACvD,cAAQ;AAAA,QACN,OAAO,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,WAAW,EAAE,KAAK,CAAC,GAAG,IAAI,GAAG,OAAO;AAAA,MAC9D;AAAA,IACF;AAEA,QAAI,QAAQ,UAAU;AACpB,cAAQ;AAAA,QACN;AAAA,EAAK,EAAE,KAAK,aAAa,CAAC,IAAI,QAAQ,SAAS,QAAQ;AAAA,MACzD;AACA,UAAI,QAAQ,SAAS,QAAQ,SAAS,GAAG;AACvC,gBAAQ;AAAA,UACN,OAAO,EAAE,IAAI,UAAU,CAAC,IAAI,QAAQ,SAAS,QAAQ,KAAK,IAAI,CAAC;AAAA,QACjE;AAAA,MACF,OAAO;AACL,gBAAQ;AAAA,UACN,OAAO,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA,QAC/B;AAAA,MACF;AAAA,IACF;AAEA,YAAQ;AAAA,MACN;AAAA,EAAK,EAAE,KAAK,cAAc,CAAC,IAAI,QAAQ,oBAAoB,KAAK,IAAI,KAAK,MAAM;AAAA,IACjF;AACA,YAAQ;AAAA,MACN,GAAG,EAAE,KAAK,kBAAkB,CAAC,IAAI,QAAQ,aAAa,KAAK,IAAI,KAAK,MAAM;AAAA,IAC5E;AACA,YAAQ,IAAI,GAAG,EAAE,KAAK,UAAU,CAAC,IAAI,QAAQ,UAAU,aAAa;AAEpE,QAAI,QAAQ,cAAc,SAAS,GAAG;AACpC,cAAQ;AAAA,QACN;AAAA,EAAK,EAAE,KAAK,oBAAoB,CAAC,UAAU,QAAQ,cAAc,MAAM;AAAA,MACzE;AACA,iBAAW,KAAK,QAAQ,cAAc,MAAM,GAAG,CAAC,GAAG;AACjD,cAAM,KAAK,IAAI,KAAK,EAAE,SAAS,EAAE,mBAAmB;AACpD,gBAAQ;AAAA,UACN,OAAO,EAAE,IAAI,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,EAAE,MAAM,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,IAAI,IAAI,EAAE,MAAM,GAAG,CAAC;AAAA,QAC3F;AAAA,MACF;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,OAAO,EACf,YAAY,wDAAwD,EACpE,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,cAAc,IAAI,eAAe,QAAQ,IAAI;AACnD,UAAM,SAAS,kBAAkB,WAAW;AAE5C,QAAI,CAAC,QAAQ,WAAW,OAAO,KAAK,OAAO,OAAO,EAAE,WAAW,GAAG;AAChE,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,4CAA4C;AAAA,MACpE;AACA,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,UAAM,WAKD,CAAC;AAEN,eAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AAC5D,YAAM,SAAS,YAAY,KAAK,EAAE,aAAa,QAAQ,MAAM,CAAC;AAE9D,UAAI,CAAC,QAAQ;AACX,iBAAS,KAAK;AAAA,UACZ;AAAA,UACA,QAAQ,SAAS,aAAa,QAAQ,YAAY;AAAA,UAClD,aAAa,SAAS;AAAA,QACxB,CAAC;AACD;AAAA,MACF;AAEA,YAAM,QAAQ,WAAW,OAAO,QAAQ;AACxC,eAAS,KAAK;AAAA,QACZ;AAAA,QACA,QAAQ,MAAM,YAAY,YAAY,MAAM,UAAU,UAAU;AAAA,QAChE,aAAa,SAAS;AAAA,QACtB,GAAI,MAAM,WAAW,CAAC,MAAM,YACxB,EAAE,iBAAiB,MAAM,gBAAgB,IACzC,CAAC;AAAA,MACP,CAAC;AAAA,IACH;AAEA,UAAM,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,IAAI,EAAE;AAC1D,UAAM,UAAU,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE;AAC/D,UAAM,eAAe,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE;AACpE,UAAM,aAAa,SAAS,OAAO,CAAC,MAAM,EAAE,WAAW,OAAO,EAAE;AAChE,UAAM,QAAQ,OAAO,KAAK,OAAO,OAAO,EAAE;AAE1C,QACE,SAASA,UAAS,KAAK;AAAA,MACrB;AAAA,MACA,SAAS;AAAA,MACT,SAAS,EAAE,OAAO,SAAS,SAAS,SAAS,cAAc,OAAO,WAAW;AAAA,MAC7E,OAAO,YAAY;AAAA,IACrB,CAAC,GACD;AACA,UAAI,UAAU,EAAG,SAAQ,WAAW;AACpC;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,EAAE,KAAK;AAAA,IAAO,QAAQ,MAAM;AAAA,CAAkC;AAAA,IAChE;AAEA,eAAW,KAAK,UAAU;AACxB,YAAM,OAAO,EAAE,cAAc,EAAE,IAAI,UAAK,EAAE,WAAW,EAAE,IAAI;AAC3D,UAAI,EAAE,WAAW,WAAW;AAC1B,gBAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,SAAS,CAAC,IAAI,IAAI,EAAE;AAAA,MACtF,WAAW,EAAE,WAAW,oBAAoB;AAC1C,gBAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,mBAAmB,CAAC,IAAI,IAAI,EAAE;AAAA,MAChG,WAAW,EAAE,WAAW,WAAW;AACjC,gBAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,IAAI,IAAI,EAAE;AAAA,MACrG,WAAW,EAAE,WAAW,SAAS;AAC/B,gBAAQ,IAAI,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,UAAU,EAAE,eAAe,IAAI,CAAC,IAAI,IAAI,EAAE;AAAA,MACpH,OAAO;AACL,gBAAQ,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,MAAM,IAAI,CAAC,IAAI,IAAI,EAAE;AAAA,MACrF;AAAA,IACF;AAEA,YAAQ;AAAA,MACN;AAAA,IAAO,EAAE,KAAK,GAAG,KAAK,WAAW,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,UAAU,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,YAAY,UAAU,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,UAAU,CAAC;AAAA,IAC/K;AAEA,QAAI,UAAU,GAAG;AACf,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,IAAI,uDAAkD,CAAC;AAAA,MAClE;AAAA,IACF,WAAW,eAAe,GAAG;AAC3B,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,OAAO,iDAAiD,CAAC;AAAA,MACpE;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,MAAM,GAAG,QAAQ,KAAK,wDAAmD,CAAC;AAAA,MACrF;AAAA,IACF;AAEA,YAAQ,IAAI;AAEZ,QAAI,UAAU,EAAG,SAAQ,KAAK,CAAC;AAAA,EACjC,CAAC;AAEH,EAAAA,SACG,QAAQ,KAAK,EACb,YAAY,2DAA2D,EACvE,OAAO,yBAAyB,4BAA4B,EAC5D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,SAAS,oBAAoB;AAAA,MACjC,aAAa,IAAI,eAAe,QAAQ,IAAI;AAAA,IAC9C,CAAC;AAED,QAAI,SAASA,UAAS,KAAK,EAAE,aAAa,OAAO,CAAC,EAAG;AAErD,QAAI,QAAQ;AACV,cAAQ;AAAA,QACN,GAAG,QAAQ,GAAG,IAAI,EAAE,KAAK,wBAAwB,CAAC,IAAI,SAAS,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,YAAY,OAAO,MAAM,GAAG,CAAC;AAAA,MACnH;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB;AAAA,IACC;AAAA,EACF,EACC,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,uBAAuB,uCAAuC,EACrE,OAAO,mBAAmB,8CAA8C,EACxE,OAAO,aAAa,kDAAkD,EACtE,OAAO,OAAO,QAAQ;AACrB,UAAM,cAAc,IAAI,eAAe,QAAQ,IAAI;AACnD,UAAM,SAAS,kBAAkB,WAAW;AAE5C,QACE,IAAI,UACJ,WAAW,IAAI,MAAM,KACrB,CAAE,MAAM,QAAQ,sBAAsB,IAAI,MAAM,KAAK,EAAE,WAAW,IAAI,IAAI,CAAC,GAC3E;AACA,cAAQ,MAAM,EAAE,IAAI,UAAU,CAAC;AAC/B,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,QAAI,CAAC,QAAQ,WAAW,OAAO,KAAK,OAAO,OAAO,EAAE,WAAW,GAAG;AAChE,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,4CAA4C;AAAA,MACpE;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,QAAkB,CAAC;AACzB,UAAM,WAAqB,CAAC;AAE5B,eAAW,CAAC,KAAK,QAAQ,KAAK,OAAO,QAAQ,OAAO,OAAO,GAAG;AAC5D,YAAM,QAAQ,UAAU,KAAK,EAAE,GAAG,MAAM,aAAa,QAAQ,MAAM,CAAC;AAEpE,UAAI,UAAU,MAAM;AAClB,YAAI,SAAS,aAAa,OAAO;AAC/B,mBAAS,KAAK,uBAAuB,GAAG,EAAE;AAAA,QAC5C;AACA,cAAM;AAAA,UACJ,KAAK,GAAG,KAAK,SAAS,cAAc,KAAK,SAAS,WAAW,KAAK,EAAE;AAAA,QACtE;AACA;AAAA,MACF;AAEA,YAAM,SAAS,YAAY,KAAK,EAAE,aAAa,QAAQ,MAAM,CAAC;AAC9D,UAAI,QAAQ;AACV,cAAM,QAAQ,WAAW,OAAO,QAAQ;AACxC,YAAI,MAAM,WAAW;AACnB,mBAAS,KAAK,YAAY,GAAG,EAAE;AAAA,QACjC,WAAW,MAAM,SAAS;AACxB,mBAAS,KAAK,UAAU,MAAM,eAAe,OAAO,GAAG,EAAE;AAAA,QAC3D;AAAA,MACF;AAEA,YAAM,UAAU,MACb,QAAQ,OAAO,MAAM,EACrB,QAAQ,MAAM,KAAK,EACnB,QAAQ,OAAO,KAAK;AACvB,YAAM,KAAK,GAAG,GAAG,KAAK,OAAO,GAAG;AAAA,IAClC;AAEA,UAAM,SAAS,MAAM,KAAK,IAAI,IAAI;AAElC,QAAI,IAAI,QAAQ;AACd,oBAAc,IAAI,QAAQ,MAAM;AAChC,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,KAAK,IAAI,MAAM,CAAC,KAAK,OAAO,KAAK,OAAO,OAAO,EAAE,MAAM;AAAA,MACvG;AAAA,IACF,OAAO;AACL,cAAQ,OAAO,MAAM,MAAM;AAAA,IAC7B;AAEA,QAAI,SAAS,SAAS,KAAK,QAAQ,OAAO,OAAO;AAC/C,cAAQ,MAAM;AACd,iBAAW,KAAK,UAAU;AACxB,gBAAQ,MAAM,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC,IAAI,CAAC,EAAE;AAAA,MACrD;AACA,cAAQ,MAAM;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,eAAe,EACvB;AAAA,IACC;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,iBAAiB,sCAAsC,EAC9D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,eAAe,EACvC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,aAAa,qDAAqD,EACzE,OAAO,OAAO,MAAc,QAAQ;AACnC,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,SAAS,KAAK,YAAY,EAAE,QAAQ,cAAc,GAAG;AAC3D,UAAM,OAAO,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC,KAAK;AAAA,MAChE,KAAK,YAAY;AAAA,IACnB;AACA,UAAM,WAAW,IAAI;AAErB,QAAI;AACJ,QAAI,IAAI,MAAM;AACZ,iBAAW,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,IAC5D,OAAO;AACL,iBAAW,CAAC,GAAG,MAAM,YAAY,GAAG,MAAM,aAAa;AAAA,IACzD;AAIA,UAAM,WAAW,SAAS,OAAO,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AAC1D,QACE,SAAS,SAAS,KAClB,CAAE,MAAM;AAAA,MACN,GAAG,SAAS,MAAM,2EAA2E,SAAS,KAAK,IAAI,CAAC;AAAA,MAChH,EAAE,WAAW,IAAI,IAAI;AAAA,IACvB,GACA;AACA,cAAQ,MAAM,EAAE,IAAI,UAAU,CAAC;AAC/B,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,uBAAuB,IAAI,EAAE,CAAC;AAAA,CAAI;AAEzE,eAAW,OAAO,UAAU;AAC1B,YAAM,QAAQ,eAAe;AAAA,QAC3B,QAAQ;AAAA,QACR,QAAQ,GAAG,OAAO,YAAY,CAAC;AAAA,MACjC,CAAC;AACD,gBAAU,KAAK,OAAO;AAAA,QACpB,GAAG;AAAA,QACH;AAAA,QACA;AAAA,QACA,aAAa,gCAAgC,IAAI;AAAA,MACnD,CAAC;AACD,cAAQ,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,YAAY,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,IAClE;AAEA,UAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,UAAM,eAAe,GAAG,WAAW;AACnC,QAAI,SAKA,CAAC;AACL,QAAI;AACF,UAAI,WAAW,YAAY,GAAG;AAC5B,iBAAS,KAAK,MAAMC,cAAa,cAAc,MAAM,CAAC;AAAA,MACxD;AAAA,IACF,QAAQ;AAAA,IAER;AAEA,QAAI,CAAC,OAAO,QAAS,QAAO,UAAU,CAAC;AACvC,eAAW,OAAO,UAAU;AAC1B,aAAO,QAAQ,GAAG,IAAI;AAAA,QACpB,UAAU;AAAA,QACV,aAAa,GAAG,IAAI;AAAA,QACpB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;AAAA,MACjC;AAAA,IACF;AAEA,kBAAc,cAAc,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,MAAM,MAAM;AAC1E,YAAQ;AAAA,MACN,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,YAAY,EAAE,IAAI,cAAc,CAAC;AAAA,IAC9D;AAEA,QAAI,IAAI,UAAU;AAChB,iBAAW,OAAO,UAAU;AAC1B,qBAAa;AAAA,UACX,MAAM;AAAA,UACN,OAAO;AAAA,YACL;AAAA,YACA,QAAQ,CAAC,SAAuB,QAAsB;AAAA,UACxD;AAAA,UACA,SAAS,IAAI;AAAA,UACb,aAAa,GAAG,IAAI;AAAA,UACpB,SAAS;AAAA,QACX,CAAC;AAAA,MACH;AACA,cAAQ;AAAA,QACN,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,qBAAqB,EAAE,IAAI,IAAI,QAAQ,CAAC;AAAA,MACrE;AAAA,IACF;AAEA,YAAQ;AAAA,MACN;AAAA,IAAO,EAAE,MAAM,OAAO,CAAC,aAAa,IAAI,mBAAmB,SAAS,MAAM;AAAA;AAAA,IAC5E;AAAA,EACF,CAAC;AACL;;;ACzZO,IAAM,uBAAN,cAAmC,MAAM;AAAA,EACrC,OAAO;AAAA,EAChB,YAAY,KAAa,IAAiB;AACxC;AAAA,MACE,IAAI,GAAG,4CAA4C,EAAE;AAAA,IACvD;AAAA,EACF;AACF;AAEA,SAAS,cAAc,KAAa,OAAqB;AACvD,MAAI,CAAC,yBAAyB,KAAK,GAAG,GAAG;AACvC,UAAM,IAAI,MAAM,GAAG,KAAK,sBAAsB,GAAG,4CAA4C;AAAA,EAC/F;AACF;AAMO,SAAS,cAAc,KAAa,MAAqC;AAC9E,gBAAc,KAAK,MAAM,QAAQ;AACjC,gBAAc,KAAK,IAAI,QAAQ;AAC/B,MAAI,KAAK,SAAS,KAAK,IAAI;AACzB,UAAM,IAAI,MAAM,2CAA2C,KAAK,IAAI,GAAG;AAAA,EACzE;AACA,QAAM,QAAQ,YAAY,KAAK,IAAI;AACnC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,WAAW,GAAG,aAAa;AACvD,QAAM,EAAE,UAAU,MAAM,IAAI;AAC5B,QAAM,SAAS,SAAS;AACxB,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR,IAAI,GAAG,mFAA8E,GAAG,UAAU,KAAK,IAAI;AAAA,IAC7G;AAAA,EACF;AACA,QAAM,SAAS,OAAO,KAAK,IAAI;AAC/B,MAAI,WAAW,QAAW;AACxB,UAAM,YAAY,OAAO,KAAK,MAAM,EAAE,KAAK,IAAI,KAAK;AACpD,UAAM,IAAI,MAAM,IAAI,GAAG,2BAA2B,KAAK,IAAI,iBAAiB,SAAS,GAAG;AAAA,EAC1F;AACA,QAAM,UAAU,OAAO,KAAK,EAAE;AAC9B,QAAM,WACJ,YAAY,SAAY,WAAW,YAAY,SAAS,SAAS;AACnE,MAAI,aAAa,QAAQ;AACvB,WAAO,EAAE,KAAK,OAAO,MAAM,KAAK,MAAM,IAAI,KAAK,IAAI,UAAU,SAAS,MAAM;AAAA,EAC9E;AACA,MAAI,aAAa,eAAe,CAAC,KAAK,OAAO;AAC3C,UAAM,IAAI,qBAAqB,KAAK,KAAK,EAAE;AAAA,EAC7C;AACA,QAAM,aAAa,EAAE,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,OAAO;AAClD,YAAU,KAAK,IAAI;AAAA,IACjB,GAAG;AAAA,IACH;AAAA,IACA,QAAQ;AAAA,IACR,YAAY,SAAS;AAAA,EACvB,CAAC;AACD,SAAO,EAAE,KAAK,OAAO,MAAM,KAAK,MAAM,IAAI,KAAK,IAAI,UAAU,SAAS,KAAK;AAC7E;AA+BO,SAAS,iBAAiB,MAA+B;AAC9D,gBAAc,KAAK,GAAG,OAAO;AAC7B,gBAAc,KAAK,GAAG,QAAQ;AAC9B,QAAM,SAAS,KAAK,OAAO,IAAI,IAAI,KAAK,IAAI,IAAI;AAChD,QAAM,UAAuB,CAAC;AAC9B,aAAW,SAAS,YAAY,IAAI,GAAG;AACrC,QAAI,UAAU,CAAC,OAAO,IAAI,MAAM,GAAG,EAAG;AACtC,UAAM,SAAS,MAAM,UAAU;AAC/B,QAAI;AACJ,QAAI,CAAC,QAAQ;AACX,eAAS;AAAA,IACX,OAAO;AACL,YAAM,KAAK,OAAO,KAAK,CAAC;AACxB,YAAM,KAAK,OAAO,KAAK,CAAC;AACxB,UAAI,OAAO,UAAa,OAAO,OAAW;AAC1C,UAAI,OAAO,OAAW,UAAS;AAAA,eACtB,OAAO,OAAW,UAAS;AAAA,UAC/B,UAAS,OAAO,KAAK,SAAS;AAAA,IACrC;AACA,YAAQ,KAAK,EAAE,KAAK,MAAM,KAAK,OAAO,MAAM,OAAO,OAAO,CAAC;AAAA,EAC7D;AACA,QAAM,UAAsC;AAAA,IAC1C,MAAM;AAAA,IACN,WAAW;AAAA,IACX,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AACA,aAAW,KAAK,QAAS,SAAQ,EAAE,MAAM,KAAK;AAC9C,QAAM,QAAQ,QAAQ,YAAY,QAAQ,QAAQ,IAAI,QAAQ,QAAQ,IAAI;AAC1E,SAAO,EAAE,GAAG,KAAK,GAAG,GAAG,KAAK,GAAG,SAAS,SAAS,MAAM;AACzD;;;ACjJA,IAAM,eAAuC;AAAA,EAC3C,MAAM,EAAE,MAAM,MAAM;AAAA,EACpB,WAAW,EAAE,OAAO,WAAW;AAAA,EAC/B,UAAU,EAAE,IAAI,cAAc;AAAA,EAC9B,UAAU,EAAE,IAAI,cAAc;AAAA,EAC9B,WAAW,EAAE,IAAI,cAAc;AACjC;AAEO,SAAS,4BAA4BC,UAAwB;AAClE,EAAAA,SACG,QAAQ,eAAe,EACvB,YAAY,uEAAuE,EACnF,eAAe,gBAAgB,oBAAoB,EACnD,eAAe,cAAc,oBAAoB,EACjD,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,0BAA0B,EAClD,OAAO,eAAe,YAAY,EAClC,OAAO,cAAc,WAAW,EAChC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,eAAe,mDAAmD,EACzE,OAAO,aAAa,mBAAmB,EACvC,OAAO,OAAO,KAAa,QAAQ;AAClC,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,OAAO,gBAAgBA,UAAS,GAAG;AACzC,UAAM,MAAM,CAAC,UACX,cAAc,KAAK,EAAE,GAAG,MAAM,MAAM,IAAI,MAAM,IAAI,IAAI,IAAI,MAAM,CAAC;AACnE,QAAI;AACF,UAAI;AACJ,UAAI;AACF,iBAAS,IAAI,QAAQ,IAAI,SAAS,IAAI,GAAG,CAAC;AAAA,MAC5C,SAAS,KAAK;AACZ,YAAI,EAAE,eAAe,yBAAyB,KAAM,OAAM;AAC1D,cAAM,KAAK,MAAM;AAAA,UACf,GAAG,QAAQ,OAAO,IAAI,EAAE,KAAK,GAAG,CAAC,sCAAsC,SAAS,IAAI,EAAE,CAAC,2BAA2B,SAAS,IAAI,IAAI,CAAC;AAAA,QACtI;AACA,YAAI,CAAC,IAAI;AACP,kBAAQ,MAAM,EAAE,IAAI,YAAY,CAAC;AACjC,kBAAQ,WAAW;AACnB;AAAA,QACF;AACA,iBAAS,IAAI,IAAI;AAAA,MACnB;AACA,UAAI,SAASA,UAAS,KAAK,MAAM,EAAG;AACpC,YAAM,OAAO,OAAO,UAAU,EAAE,MAAM,UAAU,IAAI,EAAE,IAAI,iBAAiB;AAC3E,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,IAAI,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,SAAS,OAAO,IAAI,CAAC,IAAI,EAAE,IAAI,QAAG,CAAC,IAAI,SAAS,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,IAAI,WAAW,OAAO,KAAK,CAAC,GAAG,CAAC;AAAA,MACjJ;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAI,KAAM,SAAQ,IAAI,KAAK,UAAU,EAAE,IAAI,OAAO,OAAO,QAAQ,CAAC,CAAC;AAAA,UAC9D,SAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,OAAO,EAAE,CAAC;AACvD,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,oBAAoB,EAC5B,YAAY,0FAAqF,EACjG,OAAO,qBAAqB,wDAAwD,EACpF,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,0BAA0B,EAClD,OAAO,eAAe,YAAY,EAClC,OAAO,cAAc,WAAW,EAChC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,CAAC,MAAc,MAAc,QAAQ;AAC3C,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,OAAO,IAAI,OAAO,OAAO,IAAI,IAAI,EAAE,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,IAAI;AACnG,QAAI;AACF,YAAM,SAAS,iBAAiB,EAAE,GAAG,MAAM,GAAG,MAAM,GAAG,MAAM,KAAK,CAAC;AACnE,UAAI,OAAO,MAAO,SAAQ,WAAW;AACrC,UAAI,SAASA,UAAS,KAAK,MAAM,EAAG;AACpC,UAAI,OAAO,QAAQ,WAAW,GAAG;AAC/B,gBAAQ,IAAI,EAAE,IAAI,oBAAoB,IAAI,OAAO,IAAI,UAAU,CAAC;AAChE;AAAA,MACF;AACA,cAAQ,IAAI,GAAG,SAAS,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,MAAM,SAAS,IAAI,CAAC,IAAI,EAAE,IAAI,GAAG,CAAC,EAAE;AAC/E,YAAM,QAAQ,KAAK,IAAI,GAAG,OAAO,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC;AACjE,iBAAW,KAAK,OAAO,SAAS;AAC9B,gBAAQ;AAAA,UACN,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,KAAK,CAAC,CAAC,KAAK,aAAa,EAAE,MAAM,KAAK,EAAE,MAAM,KAAK,EAAE,IAAI,IAAI,WAAW,EAAE,KAAK,CAAC,GAAG,CAAC;AAAA,QAC/G;AAAA,MACF;AACA,YAAM,IAAI,OAAO;AACjB,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,EAAK,EAAE,IAAI,cAAW,EAAE,SAAS,mBAAgB,EAAE,QAAQ,CAAC,mBAAgB,EAAE,QAAQ,CAAC,mBAAgB,EAAE,SAAS;AAAA,QACpH;AAAA,MACF;AACA,UAAI,OAAO,OAAO;AAChB,gBAAQ,IAAI,EAAE,OAAO,GAAG,QAAQ,OAAO,iEAA4D,IAAI,SAAS,IAAI,EAAE,CAAC;AAAA,MACzH,OAAO;AACL,gBAAQ,IAAI,EAAE,MAAM,GAAG,QAAQ,KAAK,uBAAuB,CAAC;AAAA,MAC9D;AAAA,IACF,SAAS,KAAK;AACZ,YAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAI,gBAAgBA,UAAS,GAAG,EAAG,SAAQ,IAAI,KAAK,UAAU,EAAE,IAAI,OAAO,OAAO,QAAQ,CAAC,CAAC;AAAA,UACvF,SAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,OAAO,EAAE,CAAC;AACvD,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AACL;;;AC7FA;AAAA,EACE,eAAAC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,SAAS;AAGlB,IAAM,YAAY;AAClB,IAAM,aAAa;AAEnB,IAAM,YAAY;AAClB,IAAM,cAAc;AAEpB,IAAM,oBAAoB;AAE1B,IAAM,2BAA2B;AA2B1B,IAAM,uBAAuB,EAAE,OAAO;AAAA,EAC3C,GAAG,EAAE,QAAQ,CAAC;AAAA,EACd,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,IAAI,EAAE,OAAO;AAAA,EACb,KAAK,EAAE,OAAO;AAAA,EACd,WAAW,EAAE,OAAO;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,MAAM,EAAE,OAAO,EAAE,SAAS;AAC5B,CAAC;AAEM,IAAM,wBAAwB,EAAE,OAAO;AAAA,EAC5C,SAAS,EAAE;AAAA,IACT,EAAE,OAAO;AAAA,MACP,KAAK,EAAE,OAAO;AAAA,MACd,OAAO,EAAE,OAAO;AAAA,MAChB,OAAO,EAAE,OAAO,EAAE,SAAS;AAAA,IAC7B,CAAC;AAAA,EACH;AAAA,EACA,YAAY,EAAE,OAAO;AAAA,EACrB,YAAY,EAAE,OAAO,EAAE,SAAS;AAClC,CAAC;AAED,SAAS,UACP,YACA,MACA,aAAqB,mBACb;AACR,SAAO,WAAW,YAAY,MAAM,YAAY,YAAY,QAAQ;AACtE;AAGA,SAAS,aAAa,SAA0B;AAC9C,MAAI;AACJ,MAAI;AACF,iBAAa,OAAO,KAAK,SAAS,QAAQ,EAAE,SAAS,MAAM;AAAA,EAC7D,QAAQ;AACN,UAAM,IAAI,MAAM,6CAA6C;AAAA,EAC/D;AAEA,MAAI;AACF,WAAO,KAAK,MAAM,UAAU;AAAA,EAC9B,QAAQ;AACN,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AACF;AAEA,SAAS,aAAa,WAAoC;AACxD,MAAI;AACJ,MAAI;AACF,iBAAa,KAAK,MAAM,UAAU,SAAS,MAAM,CAAC;AAAA,EACpD,QAAQ;AACN,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AAEA,QAAM,UAAU,sBAAsB,UAAU,UAAU;AAC1D,MAAI,CAAC,QAAQ,SAAS;AACpB,UAAM,IAAI;AAAA,MACR,0CAA0C,QAAQ,MAAM,OAAO;AAAA,IACjE;AAAA,EACF;AACA,SAAO,QAAQ;AACjB;AAKO,SAAS,aACd,SACA,YACQ;AACR,QAAM,UAA2B;AAAA,IAC/B;AAAA,IACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AAEA,QAAM,YAAY,KAAK,UAAU,OAAO;AACxC,QAAM,OAAOC,aAAY,WAAW;AACpC,QAAM,KAAKA,aAAY,SAAS;AAChC,QAAM,MAAM,UAAU,YAAY,MAAM,iBAAiB;AAEzD,QAAM,SAAS,eAAe,WAAW,KAAK,EAAE;AAChD,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACf,CAAC;AACD,QAAM,MAAM,OAAO,WAAW;AAE9B,QAAM,SAAyB;AAAA,IAC7B,GAAG;AAAA,IACH,MAAM,UAAU,SAAS,QAAQ;AAAA,IACjC,MAAM,KAAK,SAAS,QAAQ;AAAA,IAC5B,IAAI,GAAG,SAAS,QAAQ;AAAA,IACxB,KAAK,IAAI,SAAS,QAAQ;AAAA,IAC1B,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,OAAO,QAAQ;AAAA,IACf,MAAM;AAAA,EACR;AAEA,SAAO,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,EAAE,SAAS,QAAQ;AAC9D;AAKO,SAAS,eACd,SACA,YACiB;AACjB,QAAM,YAAY,aAAa,OAAO;AAEtC,QAAM,eAAe,qBAAqB,UAAU,SAAS;AAC7D,MAAI,CAAC,aAAa,SAAS;AACzB,UAAM,IAAI;AAAA,MACR,+CAA+C,aAAa,MAAM,OAAO;AAAA,IAC3E;AAAA,EACF;AACA,QAAM,SAAS,aAAa;AAE5B,QAAM,OAAO,OAAO,KAAK,OAAO,MAAM,QAAQ;AAC9C,QAAM,KAAK,OAAO,KAAK,OAAO,IAAI,QAAQ;AAC1C,QAAM,MAAM,OAAO,KAAK,OAAO,KAAK,QAAQ;AAC5C,QAAM,YAAY,OAAO,KAAK,OAAO,MAAM,QAAQ;AACnD,QAAM,MAAM,UAAU,YAAY,MAAM,OAAO,QAAQ,wBAAwB;AAE/E,QAAM,WAAW,iBAAiB,WAAW,KAAK,EAAE;AACpD,WAAS,WAAW,GAAG;AAEvB,MAAI;AACJ,MAAI;AACF,gBAAY,OAAO,OAAO;AAAA,MACxB,SAAS,OAAO,SAAS;AAAA,MACzB,SAAS,MAAM;AAAA,IACjB,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI,MAAM,mFAAmF;AAAA,EACrG;AAEA,SAAO,aAAa,SAAS;AAC/B;AAKA,IAAM,mBAAmB;AACzB,IAAM,eAAe;AACrB,IAAM,oBAAoB;AAE1B,IAAM,SAAS;AAEf,IAAM,eAAe;AAEd,IAAM,2BAA2B;AACjC,IAAM,2BAA2B;AA4BjC,IAAM,yBAAyB,EAAE,OAAO;AAAA,EAC7C,GAAG,EAAE,QAAQ,CAAC;AAAA,EACd,WAAW,EAAE,OAAO;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,WAAW,EAAE,OAAO;AAAA,EACpB,YAAY,EACT;AAAA,IACC,EAAE,OAAO;AAAA,MACP,IAAI,EAAE,OAAO;AAAA,MACb,MAAM,EAAE,OAAO;AAAA,MACf,IAAI,EAAE,OAAO;AAAA,MACb,KAAK,EAAE,OAAO;AAAA,IAChB,CAAC;AAAA,EACH,EACC,IAAI,CAAC;AAAA,EACR,IAAI,EAAE,OAAO;AAAA,EACb,KAAK,EAAE,OAAO;AAAA,EACd,MAAM,EAAE,OAAO;AACjB,CAAC;AAWD,SAAS,aAAa,KAAwB;AAC5C,QAAM,MAAM,IAAI,OAAO,EAAE,QAAQ,MAAM,CAAC;AACxC,MAAI,IAAI,QAAQ,SAAS,IAAI,QAAQ,YAAY,OAAO,IAAI,MAAM,UAAU;AAC1E,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,QAAM,MAAM,OAAO,KAAK,IAAI,GAAG,WAAW;AAC1C,MAAI,IAAI,WAAW,mBAAmB;AACpC,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,KAAwB;AAChD,SAAO,gBAAgB;AAAA,IACrB,KAAK,EAAE,KAAK,OAAO,KAAK,UAAU,GAAG,IAAI,SAAS,WAAW,EAAE;AAAA,IAC/D,QAAQ;AAAA,EACV,CAAC;AACH;AAGO,SAAS,gBAAgB,WAAuC;AACrE,QAAM,MAAM,OAAO,SAAS,SAAS,IAAI,YAAY,aAAa,SAAS;AAC3E,MAAI,IAAI,WAAW,mBAAmB;AACpC,UAAM,IAAI,MAAM,6DAA6D;AAAA,EAC/E;AACA,SAAO,GAAG,gBAAgB,GAAG,IAAI,SAAS,WAAW,CAAC;AACxD;AAOO,SAAS,eAAe,KAAqB;AAClD,QAAM,UAAU,OAAO,QAAQ,WAAW,IAAI,KAAK,IAAI;AACvD,QAAM,QAAQ,aAAa,KAAK,OAAO;AACvC,MAAI,CAAC,OAAO;AACV,UAAM,IAAI;AAAA,MACR,yCAAyC,gBAAgB;AAAA,IAC3D;AAAA,EACF;AACA,QAAM,MAAM,OAAO,KAAK,MAAM,CAAC,GAAG,WAAW;AAC7C,MAAI,IAAI,WAAW,mBAAmB;AACpC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAGO,SAAS,YAAY,QAAwB;AAClD,SAAO,WAAW,QAAQ,EAAE,OAAO,MAAM,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,CAAC;AACrE;AAGA,SAAS,cACP,QACA,cACA,cACQ;AACR,SAAO,OAAO;AAAA,IACZ;AAAA,MACE;AAAA,MACA;AAAA,MACA,OAAO,OAAO,CAAC,cAAc,YAAY,CAAC;AAAA,MAC1C;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACF;AAUO,SAAS,gBACd,SACA,YACQ;AACR,QAAM,OAAO,oBAAI,IAAoB;AACrC,aAAW,KAAK,YAAY;AAC1B,UAAM,MAAM,eAAe,CAAC;AAC5B,SAAK,IAAI,YAAY,GAAG,GAAG,GAAG;AAAA,EAChC;AACA,MAAI,KAAK,SAAS,GAAG;AACnB,UAAM,IAAI,MAAM,gEAAgE;AAAA,EAClF;AAEA,QAAM,UAA2B;AAAA,IAC/B;AAAA,IACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,EACrC;AACA,QAAM,YAAY,KAAK,UAAU,OAAO;AAExC,QAAM,MAAMA,aAAY,UAAU;AAClC,QAAM,KAAKA,aAAY,SAAS;AAChC,QAAM,SAAS,eAAe,WAAW,KAAK,EAAE;AAChD,SAAO,OAAO,OAAO,KAAK,QAAQ,MAAM,CAAC;AACzC,QAAM,YAAY,OAAO,OAAO;AAAA,IAC9B,OAAO,OAAO,WAAW,MAAM;AAAA,IAC/B,OAAO,MAAM;AAAA,EACf,CAAC;AACD,QAAM,MAAM,OAAO,WAAW;AAE9B,QAAM,YAAY,oBAAoB,QAAQ;AAC9C,QAAM,eAAe,aAAa,UAAU,SAAS;AAErD,QAAM,UAAoC,CAAC;AAC3C,aAAW,CAAC,IAAI,YAAY,KAAK,MAAM;AACrC,UAAM,SAAS,cAAc;AAAA,MAC3B,YAAY,UAAU;AAAA,MACtB,WAAW,iBAAiB,YAAY;AAAA,IAC1C,CAAC;AACD,UAAM,UAAU,cAAc,QAAQ,cAAc,YAAY;AAChE,WAAO,KAAK,CAAC;AAEb,UAAM,SAASA,aAAY,SAAS;AACpC,UAAM,aAAa,eAAe,WAAW,SAAS,MAAM;AAC5D,eAAW,OAAO,OAAO,KAAK,IAAI,MAAM,CAAC;AACzC,UAAMC,QAAO,OAAO,OAAO,CAAC,WAAW,OAAO,GAAG,GAAG,WAAW,MAAM,CAAC,CAAC;AACvE,UAAM,UAAU,WAAW,WAAW;AACtC,YAAQ,KAAK,CAAC;AAEd,YAAQ,KAAK;AAAA,MACX;AAAA,MACA,MAAMA,MAAK,SAAS,QAAQ;AAAA,MAC5B,IAAI,OAAO,SAAS,QAAQ;AAAA,MAC5B,KAAK,QAAQ,SAAS,QAAQ;AAAA,IAChC,CAAC;AAAA,EACH;AACA,MAAI,KAAK,CAAC;AAEV,QAAM,SAA2B;AAAA,IAC/B,GAAG;AAAA,IACH,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,OAAO,QAAQ;AAAA,IACf,WAAW,aAAa,SAAS,WAAW;AAAA,IAC5C,YAAY;AAAA,IACZ,IAAI,GAAG,SAAS,QAAQ;AAAA,IACxB,KAAK,IAAI,SAAS,QAAQ;AAAA,IAC1B,MAAM,UAAU,SAAS,QAAQ;AAAA,EACnC;AAEA,SAAO,OAAO,KAAK,KAAK,UAAU,MAAM,CAAC,EAAE,SAAS,QAAQ;AAC9D;AAEA,SAAS,aAAa,UAAyC;AAC7D,MAAI,OAAO,aAAa,SAAU,QAAO;AACzC,MAAI;AACF,WAAO,iBAAiB,QAAQ;AAAA,EAClC,QAAQ;AACN,UAAM,IAAI,MAAM,2DAA2D;AAAA,EAC7E;AACF;AASO,SAAS,mBACd,SACA,UACiB;AACjB,QAAM,aAAa,aAAa,QAAQ;AACxC,QAAM,YAAY,aAAa,OAAO;AAEtC,QAAM,eAAe,uBAAuB,UAAU,SAAS;AAC/D,MAAI,CAAC,aAAa,SAAS;AACzB,UAAM,IAAI;AAAA,MACR,+CAA+C,aAAa,MAAM,OAAO;AAAA,IAC3E;AAAA,EACF;AACA,QAAM,SAAS,aAAa;AAE5B,QAAM,QAAQ,aAAa,gBAAgB,UAAU,CAAC;AACtD,QAAM,OAAO,YAAY,KAAK;AAC9B,QAAM,OAAO,OAAO,WAAW,OAAO,CAAC,MAAM,EAAE,OAAO,IAAI;AAC1D,MAAI,KAAK,WAAW,GAAG;AACrB,UAAM,MAAM,OAAO,WAAW,IAAI,CAAC,MAAM,EAAE,EAAE,EAAE,KAAK,IAAI;AACxD,UAAM,IAAI;AAAA,MACR,yDAAyD,GAAG,aAAa,IAAI;AAAA,IAC/E;AAAA,EACF;AAEA,QAAM,eAAe,OAAO,KAAK,OAAO,WAAW,WAAW;AAC9D,MAAI,aAAa,WAAW,mBAAmB;AAC7C,UAAM,IAAI,MAAM,qDAAqD;AAAA,EACvE;AAEA,MAAI;AACJ,MAAI;AACF,mBAAe,iBAAiB,YAAY;AAAA,EAC9C,QAAQ;AACN,UAAM,IAAI,MAAM,iEAAiE;AAAA,EACnF;AACA,QAAM,SAAS,cAAc,EAAE,YAAY,WAAW,aAAa,CAAC;AACpE,QAAM,UAAU,cAAc,QAAQ,cAAc,KAAK;AACzD,SAAO,KAAK,CAAC;AAIb,MAAI,MAAqB;AACzB,aAAW,SAAS,MAAM;AACxB,QAAI;AACF,YAAM,WAAW;AAAA,QACf;AAAA,QACA;AAAA,QACA,OAAO,KAAK,MAAM,IAAI,QAAQ;AAAA,MAChC;AACA,eAAS,OAAO,OAAO,KAAK,MAAM,IAAI,MAAM,CAAC;AAC7C,eAAS,WAAW,OAAO,KAAK,MAAM,KAAK,QAAQ,CAAC;AACpD,YAAM,OAAO,OAAO;AAAA,QAClB,SAAS,OAAO,OAAO,KAAK,MAAM,MAAM,QAAQ,CAAC;AAAA,QACjD,SAAS,MAAM;AAAA,MACjB,CAAC;AACD;AAAA,IACF,QAAQ;AACN,YAAM;AAAA,IACR;AAAA,EACF;AACA,UAAQ,KAAK,CAAC;AACd,MAAI,QAAQ,QAAQ,IAAI,WAAW,YAAY;AAC7C,SAAK,KAAK,CAAC;AACX,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAEA,MAAI;AACJ,MAAI;AACF,UAAM,WAAW;AAAA,MACf;AAAA,MACA;AAAA,MACA,OAAO,KAAK,OAAO,IAAI,QAAQ;AAAA,IACjC;AACA,aAAS,OAAO,OAAO,KAAK,QAAQ,MAAM,CAAC;AAC3C,aAAS,WAAW,OAAO,KAAK,OAAO,KAAK,QAAQ,CAAC;AACrD,gBAAY,OAAO,OAAO;AAAA,MACxB,SAAS,OAAO,OAAO,KAAK,OAAO,MAAM,QAAQ,CAAC;AAAA,MAClD,SAAS,MAAM;AAAA,IACjB,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI,MAAM,uEAAuE;AAAA,EACzF,UAAE;AACA,QAAI,KAAK,CAAC;AAAA,EACZ;AAEA,SAAO,aAAa,SAAS;AAC/B;AAUO,SAAS,sBAAsB,SAAqC;AACzE,QAAM,MAAM,aAAa,OAAO;AAChC,QAAM,KAAK,qBAAqB,UAAU,GAAG;AAC7C,MAAI,GAAG,QAAS,QAAO,EAAE,GAAG,GAAG,OAAO,GAAG,KAAK,MAAM;AACpD,QAAM,KAAK,uBAAuB,UAAU,GAAG;AAC/C,MAAI,GAAG,SAAS;AACd,WAAO;AAAA,MACL,GAAG;AAAA,MACH,OAAO,GAAG,KAAK;AAAA,MACf,YAAY,GAAG,KAAK,WAAW,IAAI,CAAC,MAAM,EAAE,EAAE;AAAA,IAChD;AAAA,EACF;AACA,QAAM,UACJ,QAAQ,QAAQ,OAAO,QAAQ,YAAY,OAAO,MAC9C,OAAQ,IAAuB,CAAC,IAChC;AACN,QAAM,IAAI;AAAA,IACR,4DAA4D,OAAO;AAAA,EACrE;AACF;AAKO,SAAS,mBACd,SACA,OACiB;AACjB,QAAM,OAAO,sBAAsB,OAAO;AAC1C,MAAI,KAAK,MAAM,GAAG;AAChB,QAAI,MAAM,eAAe,QAAW;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AACA,WAAO,eAAe,SAAS,MAAM,UAAU;AAAA,EACjD;AACA,MAAI,MAAM,aAAa,QAAW;AAChC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,mBAAmB,SAAS,MAAM,QAAQ;AACnD;AAIA,SAAS,aAAa,YAAyC;AAC7D,QAAM,MAAM,aAAa,gBAAgB,UAAU,CAAC;AACpD,SAAO,EAAE,YAAY,WAAW,gBAAgB,GAAG,GAAG,IAAI,YAAY,GAAG,EAAE;AAC7E;AAOO,SAAS,yBACd,UAA+B,CAAC,GACd;AAClB,QAAM,QAAQ,IAAI,MAAM,0BAA0B,wBAAwB;AAC1E,MAAI,CAAC,QAAQ,SAAS,MAAM,YAAY,GAAG;AACzC,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,QAAM,EAAE,WAAW,IAAI,oBAAoB,QAAQ;AACnD,QAAM,MAAM,WAAW,OAAO,EAAE,QAAQ,OAAO,MAAM,QAAQ,CAAC;AAC9D,QAAM,YAAY,IAAI,SAAS,QAAQ,CAAC;AACxC,MAAI,KAAK,CAAC;AACV,SAAO,aAAa,UAAU;AAChC;AAGO,SAAS,uBAAgD;AAC9D,QAAM,SAAS,IAAI;AAAA,IACjB;AAAA,IACA;AAAA,EACF,EAAE,YAAY;AACd,MAAI,CAAC,OAAQ,QAAO;AACpB,MAAI;AACJ,MAAI;AACF,iBAAa,iBAAiB;AAAA,MAC5B,KAAK,OAAO,KAAK,QAAQ,QAAQ;AAAA,MACjC,QAAQ;AAAA,MACR,MAAM;AAAA,IACR,CAAC;AAAA,EACH,QAAQ;AACN,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,aAAa,UAAU;AAChC;;;ACtlBO,SAAS,wBAAwBC,UAAwB;AAC9D,EAAAA,SACG,QAAQ,UAAU,EAClB,MAAM,KAAK,EACX,YAAY,iDAAiD,EAC7D;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,qBAAqB,iCAAiC,EAC7D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,sBAAsB,EAC7C,OAAO,iBAAiB,uBAAuB,EAC/C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,CAAC,QAAQ;AACf,UAAM,SAAS,eAAe;AAAA,MAC5B,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,MACZ,QAAQ,IAAI;AAAA,IACd,CAAC;AAED,UAAM,UAAU,gBAAgB,MAAM;AAEtC,QAAI,IAAI,MAAM;AACZ,YAAM,OAAO,UAAU,GAAG;AAC1B,gBAAU,IAAI,MAAM,QAAQ,IAAI;AAChC,cAAQ;AAAA,QACN,GAAG,QAAQ,OAAO,IAAI,EAAE,MAAM,mBAAmB,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,EAAE,IAAI,IAAI,IAAI,MAAM,KAAK,OAAO,gBAAgB,CAAC;AAAA,MAC7H;AAAA,IACF,OAAO;AACL,cAAQ,OAAO,MAAM,MAAM;AAC3B,UAAI,QAAQ,OAAO,OAAO;AACxB,gBAAQ;AAAA,UACN;AAAA,EAAK,EAAE,IAAI,WAAW,IAAI,MAAM,gBAAgB,OAAO,OAAO,CAAC;AAAA,QACjE;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,kCAAkC,EAC1C,YAAY,wDAAmD,EAC/D,OAAO,gBAAgB,sBAAsB,EAC7C,OAAO,2BAA2B,qBAAqB,EACvD,OAAO,2BAA2B,qBAAqB,EACvD,OAAO,CAAC,WAAmB,WAAmB,QAAQ;AACrD,UAAM,aAA6B;AAAA,MACjC,OAAO,IAAI,gBAAgB,YAAY;AAAA,MACvC,aAAa,IAAI,iBAAiB,QAAQ,IAAI;AAAA,MAC9C,QAAQ;AAAA,IACV;AACA,UAAM,aAA6B;AAAA,MACjC,OAAO,IAAI,gBAAgB,YAAY;AAAA,MACvC,aAAa,IAAI,iBAAiB,QAAQ,IAAI;AAAA,MAC9C,QAAQ;AAAA,IACV;AAEA,oBAAgB,WAAW,YAAY,WAAW,UAAU;AAC5D,YAAQ;AAAA,MACN,GAAG,QAAQ,IAAI,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,KAAK,SAAS,CAAC;AAAA,IACnG;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,qCAAqC,EAC7C,YAAY,8BAA8B,EAC1C,OAAO,gBAAgB,sBAAsB,EAC7C,OAAO,2BAA2B,qBAAqB,EACvD,OAAO,2BAA2B,qBAAqB,EACvD,OAAO,CAAC,WAAmB,WAAmB,QAAQ;AACrD,UAAM,aAA6B;AAAA,MACjC,OAAO,IAAI,gBAAgB,YAAY;AAAA,MACvC,aAAa,IAAI,iBAAiB,QAAQ,IAAI;AAAA,MAC9C,QAAQ;AAAA,IACV;AACA,UAAM,aAA6B;AAAA,MACjC,OAAO,IAAI,gBAAgB,YAAY;AAAA,MACvC,aAAa,IAAI,iBAAiB,QAAQ,IAAI;AAAA,MAC9C,QAAQ;AAAA,IACV;AAEA,uBAAmB,WAAW,YAAY,WAAW,UAAU;AAC/D,YAAQ;AAAA,MACN,GAAG,QAAQ,IAAI,IAAI,EAAE,OAAO,cAAc,CAAC,IAAI,EAAE,KAAK,SAAS,CAAC,IAAI,QAAQ,KAAK,IAAI,EAAE,KAAK,SAAS,CAAC;AAAA,IACxG;AAAA,EACF,CAAC;AAIH,QAAM,SAASA,SACZ,QAAQ,QAAQ,EAChB,YAAY,iDAAiD;AAEhE,SACG,QAAQ,gBAAgB,EACxB,YAAY,8CAA8C,EAC1D,OAAO,mBAAmB,+BAA+B,QAAQ,EACjE,OAAO,mBAAmB,+BAA+B,QAAQ,EACjE,OAAO,CAAC,OAAe,QAAQ;AAC9B,UAAM,KAAK,aAAa,OAAO;AAAA,MAC7B,YAAY,IAAI;AAAA,MAChB,UAAU,IAAI;AAAA,IAChB,CAAC;AAED,YAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,QAAQ,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE;AAErE,UAAM,SAAmB,CAAC;AAC1B,QAAI,IAAI,IAAK,QAAO,KAAK,OAAO,IAAI,GAAG,GAAG;AAC1C,QAAI,IAAI,SAAU,QAAO,KAAK,aAAa,IAAI,QAAQ,EAAE;AACzD,QAAI,OAAO,OAAQ,SAAQ,IAAI,EAAE,IAAI,KAAK,OAAO,KAAK,KAAK,CAAC,EAAE,CAAC;AAAA,EACjE,CAAC;AAEH,SACG,QAAQ,WAAW,EACnB,YAAY,4CAA4C,EACxD,OAAO,CAAC,OAAe;AACtB,UAAM,QAAQ,WAAW,EAAE;AAC3B,QAAI,UAAU,MAAM;AAClB,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,EAAE,wBAAwB;AAAA,MAC9D;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,OAAO,MAAM,KAAK;AAAA,EAC5B,CAAC;AAEH,SACG,QAAQ,cAAc,EACtB,YAAY,uCAAuC,EACnD,OAAO,CAAC,OAAe;AACtB,UAAM,YAAY,cAAc,EAAE;AAClC,QAAI,WAAW;AACb,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,WAAW,CAAC,IAAI,EAAE,EAAE;AAAA,IAC9D,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,EAAE,aAAa,CAAC;AAChE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,SACG,QAAQ,MAAM,EACd,MAAM,IAAI,EACV,YAAY,qBAAqB,EACjC,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,UAAU,WAAW;AAC3B,QAAI,SAASA,UAAS,KAAK,EAAE,QAAQ,CAAC,EAAG;AACzC,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,EAAE,IAAI,mBAAmB,CAAC;AACtC;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,EAAE,KAAK;AAAA,IAAO,QAAQ,KAAK,oBAAoB,QAAQ,MAAM;AAAA,CAAK;AAAA,IACpE;AACA,eAAW,KAAK,SAAS;AACvB,YAAM,QAAQ,CAAC,EAAE,KAAK,EAAE,EAAE,CAAC;AAC3B,YAAM,KAAK,EAAE,IAAI,UAAU,EAAE,WAAW,EAAE,CAAC;AAC3C,UAAI,EAAE,SAAU,OAAM,KAAK,EAAE,IAAI,QAAQ,EAAE,QAAQ,EAAE,CAAC;AACtD,UAAI,EAAE,WAAW;AACf,cAAM,YAAY,KAAK;AAAA,UACrB;AAAA,UACA,KAAK,OAAO,EAAE,YAAY,KAAK,IAAI,KAAK,GAAI;AAAA,QAC9C;AACA,cAAM,KAAK,EAAE,IAAI,YAAY,SAAS,GAAG,CAAC;AAAA,MAC5C;AACA,cAAQ,IAAI,KAAK,QAAQ,KAAK,IAAI,MAAM,KAAK,IAAI,CAAC,EAAE;AAAA,IACtD;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAIH,QAAM,KAAKA,SACR,QAAQ,UAAU,EAClB,MAAM,IAAI,EACV,YAAY,kDAAkD;AAEjE,KAAG,QAAQ,QAAQ,EAChB;AAAA,IACC;AAAA,EACF,EACC,OAAO,WAAW,8BAA8B,EAChD,OAAO,CAAC,QAAQ;AACf,QAAI;AACJ,QAAI;AACF,iBAAW,yBAAyB,EAAE,OAAO,QAAQ,IAAI,KAAK,EAAE,CAAC;AAAA,IACnE,SAAS,KAAK;AACZ,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,GAAG,EAAE,CAAC;AAC9C,cAAQ,KAAK,CAAC;AAAA,IAChB;AAGA,YAAQ,IAAI,SAAS,SAAS;AAC9B,QAAI,QAAQ,OAAO,OAAO;AACxB,cAAQ;AAAA,QACN,GAAG,QAAQ,GAAG,IAAI,EAAE,MAAM,kBAAkB,CAAC,IAAI,EAAE,IAAI,OAAO,SAAS,EAAE,GAAG,CAAC;AAAA,MAC/E;AAAA,IACF;AAAA,EACF,CAAC;AAEH,KAAG,QAAQ,UAAU,EAClB,YAAY,6CAA6C,EACzD,OAAO,MAAM;AACZ,QAAI;AACJ,QAAI;AACF,iBAAW,qBAAqB;AAAA,IAClC,SAAS,KAAK;AACZ,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,GAAG,EAAE,CAAC;AAC9C,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,QAAI,CAAC,UAAU;AACb,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,0CAAqC,EAAE,KAAK,uBAAuB,CAAC;AAAA,QACtF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,IAAI,SAAS,SAAS;AAC9B,QAAI,QAAQ,OAAO,OAAO;AACxB,cAAQ,IAAI,EAAE,IAAI,iBAAiB,SAAS,EAAE,EAAE,CAAC;AAAA,IACnD;AAAA,EACF,CAAC;AAEH,KAAG,QAAQ,MAAM,EACd,YAAY,uCAAuC,EACnD,OAAO,qBAAqB,mCAAmC,EAC/D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,OAAO,QAAQ;AACrB,UAAM,OAAO,UAAU,GAAG;AAI1B,UAAM,cAAyB,IAAI,MAA+B,CAAC,GAChE,QAAQ,CAAC,MAAM,EAAE,MAAM,GAAG,CAAC,EAC3B,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAC7B,eAAW,KAAK,YAAY;AAC1B,UAAI;AACF,uBAAe,CAAC;AAAA,MAClB,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,gBAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,mBAAmB,CAAC,MAAM,GAAG,EAAE,CAAC;AACpE,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,QAAI;AACJ,QAAI,WAAW,WAAW,GAAG;AAC3B,mBAAa,MAAM;AAAA,QACjB,GAAG,QAAQ,IAAI;AAAA,MACjB;AACA,UAAI,CAAC,YAAY;AACf,gBAAQ,MAAM,EAAE,IAAI,gDAAgD,CAAC;AACrE,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,UAAU,YAAY,IAAI;AAChC,QAAI;AACJ,QAAI,IAAI,MAAM;AACZ,aAAO,IAAI,KAAK,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,IACxD;AAEA,UAAM,UAA4D,CAAC;AACnE,eAAW,SAAS,SAAS;AAC3B,UAAI,QAAQ,CAAC,KAAK,SAAS,MAAM,GAAG,EAAG;AACvC,YAAM,QAAQ,UAAU,MAAM,KAAK,EAAE,GAAG,MAAM,OAAO,MAAM,MAAM,CAAC;AAClE,UAAI,UAAU,MAAM;AAClB,gBAAQ,KAAK,EAAE,KAAK,MAAM,KAAK,OAAO,OAAO,MAAM,MAAM,CAAC;AAAA,MAC5D;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,MAAM,EAAE,IAAI,oBAAoB,CAAC;AACzC,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,SACJ,WAAW,SAAS,IAChB,gBAAgB,SAAS,UAAU,IACnC,aAAa,SAAS,UAAoB;AAChD,YAAQ,OAAO,MAAM,MAAM;AAC3B,QAAI,QAAQ,OAAO,OAAO;AACxB,YAAM,KACJ,WAAW,SAAS,IAChB,EAAE,IAAI,QAAQ,WAAW,MAAM,eAAe,IAC9C;AACN,cAAQ;AAAA,QACN;AAAA,EAAK,QAAQ,OAAO,IAAI,EAAE,MAAM,QAAQ,CAAC,IAAI,QAAQ,MAAM,aAAa,EAAE;AAAA,MAC5E;AAAA,IACF;AAAA,EACF,CAAC;AAEH,KAAG,QAAQ,iBAAiB,EACzB,YAAY,oDAAoD,EAChE,OAAO,gBAAgB,wBAAwB,EAC/C,OAAO,iBAAiB,yBAAyB,EACjD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,aAAa,4CAA4C,EAChE,OAAO,aAAa,2CAA2C,EAC/D,OAAO,OAAO,QAA4B,QAAQ;AACjD,QAAI,CAAC,QAAQ;AACX,YAAM,SAAmB,CAAC;AAC1B,uBAAiB,SAAS,QAAQ,OAAO;AACvC,eAAO,KAAK,KAAK;AAAA,MACnB;AACA,eAAS,OAAO,OAAO,MAAM,EAAE,SAAS,MAAM,EAAE,KAAK;AAAA,IACvD;AAIA,QAAI;AACJ,QAAI;AACF,aAAO,sBAAsB,MAAM;AAAA,IACrC,QAAQ;AACN,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,qCAAqC;AAAA,MAC7D;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI;AACJ,QAAI,WAAoD;AACxD,QAAI,KAAK,MAAM,GAAG;AAChB,mBAAa,MAAM;AAAA,QACjB,GAAG,QAAQ,IAAI;AAAA,MACjB;AAAA,IACF,OAAO;AACL,UAAI;AACF,mBAAW,qBAAqB;AAAA,MAClC,SAAS,KAAK;AACZ,cAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,gBAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,GAAG,EAAE,CAAC;AAC9C,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA,UAAI,IAAI,QAAQ;AACd,cAAM,OAAO,WAAW,KAAK,WAAW,SAAS,SAAS,EAAE,IAAI;AAChE,gBAAQ;AAAA,UACN;AAAA,EAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,kBAAkB,CAAC,iBAAiB,KAAK,WAAW,MAAM;AAAA,QAC3F;AACA,mBAAW,MAAM,KAAK,YAAY;AAChC,gBAAM,SACJ,YAAY,OAAO,SAAS,KAAK,EAAE,MAAM,QAAQ,IAAI;AACvD,kBAAQ,IAAI,KAAK,QAAQ,GAAG,IAAI,EAAE,GAAG,MAAM,EAAE;AAAA,QAC/C;AACA,YAAI,CAAC,UAAU;AACb,kBAAQ;AAAA,YACN,EAAE;AAAA,cACA,kCAA6B,EAAE,KAAK,uBAAuB,CAAC;AAAA,YAC9D;AAAA,UACF;AAAA,QACF,WAAW,CAAC,MAAM;AAChB,kBAAQ;AAAA,YACN,EAAE,IAAI,aAAa,SAAS,EAAE,sCAAsC;AAAA,UACtE;AAAA,QACF;AACA,gBAAQ,IAAI;AAAA,MACd;AACA,UAAI,CAAC,UAAU;AACb,gBAAQ;AAAA,UACN,EAAE;AAAA,YACA,GAAG,QAAQ,KAAK,4FAAuF,EAAE,KAAK,uBAAuB,CAAC;AAAA,UACxI;AAAA,QACF;AACA,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF;AAIA,QAAI;AACJ,QAAI;AACF,gBAAU,mBAAmB,QAAQ;AAAA,QACnC;AAAA,QACA,UAAU,UAAU;AAAA,MACtB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,YAAM,MAAM,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC3D,YAAM,SAAS,IAAI,WAAW,8BAA8B,IACxD,kDAAkD,UAAU,EAAE,MAC9D,KAAK,MAAM,IACT,yCACA;AACN,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,sBAAsB,MAAM,EAAE,CAAC;AACnE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,IAAI,QAAQ;AACd,cAAQ;AAAA,QACN;AAAA,EAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,cAAc,CAAC,KAAK,QAAQ,QAAQ,MAAM;AAAA;AAAA,MAC3E;AACA,iBAAW,KAAK,QAAQ,SAAS;AAC/B,gBAAQ;AAAA,UACN,KAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,SAAS,QAAQ,GAAG,CAAC;AAAA,QACxE;AAAA,MACF;AACA;AAAA,IACF;AAEA,UAAM,OAAO,UAAU,GAAG;AAE1B,UAAM,WAAW,QAAQ,QACtB,IAAI,CAAC,MAAM,EAAE,GAAG,EAChB,OAAO,CAAC,MAAM,UAAU,GAAG,IAAI,CAAC;AACnC,QACE,SAAS,SAAS,KAClB,CAAE,MAAM;AAAA,MACN,GAAG,SAAS,MAAM,4CAA4C,SAAS,KAAK,IAAI,CAAC;AAAA,MACjF,EAAE,WAAW,IAAI,IAAI;AAAA,IACvB,GACA;AACA,cAAQ,MAAM,EAAE,IAAI,UAAU,CAAC;AAC/B,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,eAAW,KAAK,QAAQ,SAAS;AAC/B,gBAAU,EAAE,KAAK,EAAE,OAAO,IAAI;AAAA,IAChC;AAEA,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,QAAQ,QAAQ,MAAM;AAAA,IACnE;AAAA,EACF,CAAC;AACL;;;ACtcO,SAAS,2BAA2BC,UAAwB;AACjE,EAAAA,SACG,QAAQ,gBAAgB,EACxB,YAAY,4DAA4D,EACxE,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,yBAAyB,uBAAuB,EACvD;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,oBAAoB,8BAA8B,EACzD,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,KAAyB,QAAQ;AAC9C,QAAI,IAAI,eAAe;AACrB,UAAI,SAASA,UAAS,KAAK,EAAE,WAAWC,UAAiB,cAAc,EAAE,CAAC,GAAG;AAC3E;AAAA,MACF;AACA,cAAQ;AAAA,QACN,EAAE,KAAK;AAAA,IAAO,QAAQ,MAAM;AAAA,CAAmC;AAAA,MACjE;AACA,iBAAW,KAAKA,UAAiB,cAAc,GAAG;AAChD,cAAM,WAAW,EAAE,UAAU,SACzB,EAAE,IAAI,KAAK,EAAE,SAAS,KAAK,IAAI,CAAC,GAAG,IACnC;AACJ,gBAAQ;AAAA,UACN,KAAK,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,WAAW,GAAG,QAAQ;AAAA,QAC5D;AAAA,MACF;AACA,cAAQ,IAAI;AACZ;AAAA,IACF;AAEA,QAAI,CAAC,OAAO,CAAC,IAAI,KAAK;AACpB,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,kCAAkC,CAAC;AACvE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,OAAO,UAAU,GAAG;AAE1B,QAAI,IAAI,KAAK;AACX,UAAI,UAAU,YAAY,IAAI;AAC9B,YAAM,cAAc,IAAI,eAAe,QAAQ,IAAI;AAEnD,UAAI,IAAI,UAAU;AAChB,cAAM,SAAS,kBAAkB,WAAW;AAC5C,YAAI,QAAQ,SAAS;AACnB,gBAAM,eAAe,IAAI,IAAI,OAAO,KAAK,OAAO,OAAO,CAAC;AACxD,oBAAU,QAAQ,OAAO,CAAC,MAAM,aAAa,IAAI,EAAE,GAAG,CAAC;AAAA,QACzD;AAAA,MACF;AAEA,YAAM,WAAW,gBAAgBD,UAAS,GAAG;AAC7C,UAAI,CAAC,UAAU;AACb,gBAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,MAAM;AAAA,CAAuB,CAAC;AAAA,MAClE;AAEA,UAAI,YAAY;AAChB,UAAI,UAAU;AACd,YAAM,cAMD,CAAC;AAEN,iBAAW,SAAS,SAAS;AAC3B,cAAME,SAAQ,UAAU,MAAM,KAAK,EAAE,GAAG,MAAM,OAAO,MAAM,MAAM,CAAC;AAClE,YAAI,CAACA,QAAO;AACV;AACA;AAAA,QACF;AAEA,cAAMC,YAAW,MAAM,UAAU,KAAK,YAAY,IAAI;AACtD,cAAMC,UAAS,MAAM,eAAeF,QAAO,EAAE,UAAUC,UAAS,CAAC;AAEjE,YAAIC,QAAO,WAAW,WAAW;AAC/B;AACA;AAAA,QACF;AAEA;AACA,YAAI,UAAU;AACZ,sBAAY,KAAK;AAAA,YACf,KAAK,MAAM;AAAA,YACX,QAAQA,QAAO;AAAA,YACf,UAAUA,QAAO;AAAA,YACjB,WAAWA,QAAO;AAAA,YAClB,SAASA,QAAO,WAAW,UAAUA,QAAO,UAAU;AAAA,UACxD,CAAC;AACD;AAAA,QACF;AACA,cAAMC,QACJD,QAAO,WAAW,UACd,EAAE,MAAM,QAAQ,KAAK,IACrBA,QAAO,WAAW,YAChB,EAAE,IAAI,QAAQ,KAAK,IACnB,EAAE,OAAO,QAAQ,OAAO;AAChC,cAAM,aACJA,QAAO,WAAW,UACd,EAAE,MAAM,OAAO,IACfA,QAAO,WAAW,YAChB,EAAE,IAAI,SAAS,IACf,EAAE,OAAO,OAAO;AAExB,gBAAQ;AAAA,UACN,KAAKC,KAAI,IAAI,EAAE,KAAK,MAAM,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,UAAU,KAAK,EAAE,IAAI,IAAID,QAAO,QAAQ,KAAKA,QAAO,SAAS,KAAK,CAAC,GAAGA,QAAO,WAAW,UAAU,IAAI,EAAE,IAAI,YAAOA,QAAO,OAAO,CAAC,KAAK,EAAE;AAAA,QACxL;AAAA,MACF;AAEA,UAAI,UAAU;AACZ,iBAASJ,UAAS,KAAK,EAAE,SAAS,aAAa,WAAW,QAAQ,CAAC;AACnE;AAAA,MACF;AAEA,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,IAAI,GAAG,SAAS,eAAe,OAAO,wBAAwB,CAAC;AAAA;AAAA,MAC1E;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,UAAU,KAAM,IAAI;AAClC,QAAI,CAAC,OAAO;AACV,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,GAAG,aAAa,CAAC;AACjE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,WAAW,YAAY,KAAM,IAAI;AACvC,UAAM,WAAW,UAAU,SAAS,KAAK,YAAY,IAAI;AACzD,UAAM,SAAS,MAAM,eAAe,OAAO,EAAE,UAAU,SAAS,CAAC;AAEjE,QACE,SAASA,UAAS,KAAK;AAAA,MACrB;AAAA,MACA,QAAQ,OAAO;AAAA,MACf,UAAU,OAAO;AAAA,MACjB,WAAW,OAAO;AAAA,MAClB,SAAS,OAAO;AAAA,IAClB,CAAC,GACD;AACA;AAAA,IACF;AAEA,UAAM,OACJ,OAAO,WAAW,UACd,EAAE,MAAM,QAAQ,KAAK,IACrB,OAAO,WAAW,YAChB,EAAE,IAAI,QAAQ,KAAK,IACnB,OAAO,WAAW,UAChB,EAAE,OAAO,QAAQ,OAAO,IACxB,EAAE,IAAI,QAAG;AAEnB,YAAQ;AAAA,MACN;AAAA,IAAO,IAAI,IAAI,EAAE,KAAK,GAAI,CAAC,KAAK,OAAO,MAAM,KAAK,EAAE,IAAI,IAAI,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC;AAAA,IACxG;AACA,QAAI,OAAO,WAAW,OAAO,WAAW,SAAS;AAC/C,cAAQ,IAAI,OAAO,EAAE,IAAI,OAAO,OAAO,CAAC,EAAE;AAAA,IAC5C;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,eAAe,EACvC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,qBAAqB,2BAA2B,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,KAAa,QAAQ;AAClC,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,QAAQ,UAAU,KAAK,IAAI;AACjC,QAAI,CAAC,OAAO;AACV,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,GAAG,aAAa,CAAC;AACjE,cAAQ,WAAW;AACnB;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,mBAAmB,OAAO,IAAI,QAAQ;AAC3D,QAAI,OAAO,WAAW,OAAO,UAAU;AACrC,gBAAU,KAAK,OAAO,UAAU;AAAA,QAC9B,GAAG;AAAA,QACH,OAAO,KAAK,SAAS;AAAA,MACvB,CAAC;AAAA,IACH;AAEA,QACE,SAASA,UAAS,KAAK;AAAA,MACrB;AAAA,MACA,SAAS,CAAC,EAAE,OAAO,WAAW,OAAO;AAAA,MACrC,UAAU,OAAO;AAAA,MACjB,SAAS,OAAO;AAAA,IAClB,CAAC,GACD;AACA;AAAA,IACF;AAEA,QAAI,OAAO,WAAW,OAAO,UAAU;AACrC,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,QAAQ,OAAO,QAAQ;AAAA,MAC9E;AACA,cAAQ,IAAI,EAAE,IAAI,KAAK,OAAO,OAAO,EAAE,CAAC;AAAA,IAC1C,OAAO;AACL,cAAQ,IAAI,EAAE,OAAO,GAAG,QAAQ,OAAO,IAAI,OAAO,OAAO,EAAE,CAAC;AAAA,IAC9D;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,YAAY,EACpB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,eAAe,iBAAiB,EACvC,OAAO,cAAc,gBAAgB,EACrC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,SAAS,gDAAgD,EAChE,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,YAAY,IAAI;AAEhC,UAAM,YAAY,QACf,OAAO,CAAC,MAAM,EAAE,QAAQ,EACxB,IAAI,CAAC,OAAO;AAAA,MACX,KAAK,QAAQ,EAAE,GAAG;AAAA,MAClB,OAAO,QAAQ,EAAE,KAAK;AAAA,MACtB,UAAU,eAAe,EAAE,SAAU,IAAI;AAAA,IAC3C,EAAE,EACD,OAAO,CAAC,MAAM,EAAE,SAAS,UAAU,aAAa,EAChD,KAAK,CAAC,GAAG,MAAM,uBAAuB,EAAE,UAAU,EAAE,QAAQ,CAAC;AAEhE,UAAM,MAAM,UAAU;AAAA,MACpB,CAAC,MAAM,EAAE,SAAS,UAAU,cAAc,EAAE,SAAS,UAAU;AAAA,IACjE;AACA,UAAM,QAAQ,IAAI,MAAM,YAAY;AAEpC,QACE,SAASA,UAAS,KAAK;AAAA,MACrB,SAAS;AAAA,MACT,UAAU,IAAI;AAAA,MACd,gBAAgB,UAAU;AAAA,IAC5B,CAAC,GACD;AACA;AAAA,IACF;AAEA,QAAI,MAAM,WAAW,GAAG;AACtB,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,UAAU,WAAW,IACjB,wFACA,sBAAiB,UAAU,MAAM;AAAA,QACvC;AAAA,MACF;AACA;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,EAAE;AAAA,QACA;AAAA,IAAO,QAAQ,MAAM,wBAAwB,IAAI,MAAM,WAAW,UAAU,MAAM;AAAA;AAAA,MACpF;AAAA,IACF;AACA,UAAM,YAAY,KAAK,IAAI,GAAG,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,MAAM,CAAC;AAC5D,eAAW,KAAK,OAAO;AACrB,YAAM,IAAI,EAAE;AACZ,cAAQ;AAAA,QACN,KAAK,EAAE,IAAI,GAAG,CAAC,GAAG,WAAW,EAAE,KAAc,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,IAAI,OAAO,SAAS,CAAC,CAAC,KAAK,cAAc,EAAE,KAAK,CAAC,KAAK,iBAAiB,CAAC,CAAC,KAAK,EAAE,IAAI,iBAAiB,EAAE,OAAO,gBAAgB,EAAE,eAAe,IAAI,CAAC;AAAA,MAC/N;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,aAAa,EACrB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,eAAe,EACvC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,QAAQ;AACrB,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,YAAY,IAAI;AAEhC,UAAM,UAAU,QACb,IAAI,CAAC,MAAM;AACV,YAAM,MAAM,UAAU,EAAE,KAAK;AAAA,QAC3B,GAAG;AAAA,QACH,OAAO,EAAE;AAAA,QACT,QAAQ;AAAA,MACV,CAAC;AACD,UAAI,CAAC,IAAK,QAAO;AACjB,YAAM,WAAW,EAAE,UAAU,KAAK;AAClC,YAAM,gBAAgB,EAAE,UAAU,KAAK;AACvC,aAAO,EAAE,KAAK,EAAE,KAAK,OAAO,KAAK,UAAU,cAAc;AAAA,IAC3D,CAAC,EACA,OAAO,CAAC,MAAkC,MAAM,IAAI;AAEvD,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,EAAE,IAAI,wBAAwB,CAAC;AAC3C;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,gBAAgB,OAAO;AAE5C,QAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,cAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,IAC7C,OAAO;AACL,cAAQ;AAAA,QACN,EAAE,KAAK;AAAA,0BAA6B,OAAO,QAAQ,MAAM;AAAA,CAAY;AAAA,MACvE;AACA,iBAAW,KAAK,OAAO,SAAS;AAC9B,cAAM,OAAO,EAAE,WAAW,QAAQ,QAAQ,QAAQ,QAAQ;AAC1D,cAAM,QAAQ,EAAE,WAAW,QAAQ,EAAE,QAAQ,EAAE;AAC/C,gBAAQ;AAAA,UACN,KAAK,IAAI,IAAI,MAAM,EAAE,GAAG,CAAC,KAAK,EAAE,WAAW,QAAQ,KAAK,EAAE,WAAW,OAAO;AAAA,QAC9E;AACA,YAAI,EAAE,iBAAkB,SAAQ,IAAI,EAAE,IAAI,8BAAyB,CAAC;AAAA,MACtE;AACA,cAAQ,IAAI;AAEZ,UAAI,CAAC,OAAO,UAAU;AACpB,gBAAQ,IAAI,EAAE,IAAI,KAAK,OAAO,SAAS,8BAA8B,CAAC;AACtE,gBAAQ,WAAW;AAAA,MACrB,OAAO;AACL,gBAAQ,IAAI,EAAE,MAAM,qBAAqB,CAAC;AAAA,MAC5C;AAAA,IACF;AAAA,EACF,CAAC;AACL;;;ACrWA,SAAS,aAAa;AACtB,SAAS,qBAAqB;AAC9B,SAAS,iBAAiB;AAc1B,IAAM,mBAAgD;AAAA,EACpD,cAAc,EAAE,MAAM,eAAe;AAAA,EACrC,YAAY;AAAA,IACV,MAAM;AAAA,IACN,cAAc;AAAA;AAAA,MAEZ;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAO;AAAA,MAAO;AAAA,MAAM;AAAA,MAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,MAM9C;AAAA,MAAU;AAAA,MAAW;AAAA,MAAW;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAChD;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAO;AAAA,MAAM;AAAA,MAAQ;AAAA,IACvC;AAAA,IACA,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,cAAc,CAAC,cAAc,eAAe,WAAW;AAAA,EACzD;AAAA,EACA,IAAI;AAAA,IACF,MAAM;AAAA,IACN,mBAAmB;AAAA,IACnB,cAAc;AAAA,IACd,cAAc,CAAC,YAAY,QAAQ,QAAQ;AAAA,EAC7C;AACF;AAEO,SAAS,WAAW,MAA4B;AACrD,MAAI,CAAC,KAAM,QAAO,iBAAiB;AACnC,SAAO,iBAAiB,IAAI,KAAK,EAAE,KAAK;AAC1C;AA6BO,IAAM,qBAAN,cAAiC,UAAU;AAAA,EACxC,WAAqD,CAAC;AAAA,EACtD,OAAe;AAAA,EACf,SAAiB;AAAA;AAAA;AAAA;AAAA;AAAA,EAKjB,UAAU,IAAI,cAAc,MAAM;AAAA,EAE1C,YAAY,iBAA2B;AACrC,UAAM;AAEN,UAAM,eAAe,gBAAgB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAE/D,iBAAa,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM;AAE/C,SAAK,WAAW,aAAa,IAAI,CAAC,OAAO;AAAA,MACvC,OAAO;AAAA,MACP,aAAa;AAAA,IACf,EAAE;AAEF,QAAI,aAAa,SAAS,GAAG;AAC3B,WAAK,SAAS,aAAa,CAAC,EAAE;AAAA,IAChC;AAAA,EACF;AAAA,EAEA,WAAW,OAAwB,WAAmB,UAAsB;AAC1E,QAAI,KAAK,SAAS,WAAW,GAAG;AAC9B,WAAK,KAAK,KAAK;AACf,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,UACJ,OAAO,UAAU,WAAW,QAAQ,KAAK,QAAQ,MAAM,KAAK;AAC9D,UAAM,OAAO,KAAK,OAAO;AACzB,QAAI,WAAW;AAEf,eAAW,EAAE,OAAO,YAAY,KAAK,KAAK,UAAU;AAClD,iBAAW,SAAS,MAAM,KAAK,EAAE,KAAK,WAAW;AAAA,IACnD;AAEA,QAAI,SAAS,SAAS,KAAK,QAAQ;AACjC,WAAK,OAAO;AACZ,aAAO,SAAS;AAAA,IAClB;AAEA,UAAM,YAAY,SAAS,SAAS,KAAK,SAAS;AAClD,UAAM,SAAS,SAAS,MAAM,GAAG,SAAS;AAC1C,SAAK,OAAO,SAAS,MAAM,SAAS;AAEpC,SAAK,KAAK,MAAM;AAChB,aAAS;AAAA,EACX;AAAA,EAEA,OAAO,UAAsB;AAG3B,QAAI,QAAQ,KAAK,OAAO,KAAK,QAAQ,IAAI;AACzC,QAAI,OAAO;AACT,iBAAW,EAAE,OAAO,YAAY,KAAK,KAAK,UAAU;AAClD,gBAAQ,MAAM,MAAM,KAAK,EAAE,KAAK,WAAW;AAAA,MAC7C;AACA,WAAK,KAAK,KAAK;AAAA,IACjB;AACA,aAAS;AAAA,EACX;AACF;AAOO,SAAS,kBACd,SACA,SACA,MACA,aACM;AACN,QAAM,cAAc,CAAC,SAAS,GAAG,IAAI,EAAE,KAAK,GAAG;AAE/C,QAAM,iBAAiB,gBAAgB,aAAa,WAAW;AAC/D,MAAI,CAAC,eAAe,SAAS;AAC3B,UAAM,IAAI,MAAM,kBAAkB,eAAe,MAAM,EAAE;AAAA,EAC3D;AAEA,MAAI,QAAQ,cAAc;AACxB,UAAM,SAAS,QAAQ,aAAa,KAAK,CAAC,MAAM;AAC9C,YAAM,UAAU,IAAI,OAAO,aAAa,EAAE,QAAQ,uBAAuB,MAAM,CAAC,WAAW,GAAG;AAC9F,aAAO,QAAQ,KAAK,WAAW;AAAA,IACjC,CAAC;AACD,QAAI,QAAQ;AACV,YAAM,IAAI,MAAM,iBAAiB,QAAQ,IAAI,gCAAgC,MAAM,GAAG;AAAA,IACxF;AAAA,EACF;AACA,MAAI,QAAQ,eAAe;AACzB,UAAM,UAAU,QAAQ,cAAc,KAAK,CAAC,MAAM,YAAY,WAAW,CAAC,CAAC;AAC3E,QAAI,CAAC,SAAS;AACZ,YAAM,IAAI,MAAM,iBAAiB,QAAQ,IAAI,6BAA6B,OAAO,GAAG;AAAA,IACtF;AAAA,EACF;AACF;AAEA,eAAsB,YAAY,MAAwC;AACxE,QAAM,UAAU,WAAW,KAAK,OAAO;AACvC,oBAAkB,SAAS,KAAK,SAAS,KAAK,MAAM,KAAK,WAAW;AAEpE,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAChD,QAAI,MAAM,OAAW,QAAO,CAAC,IAAI;AAAA,EACnC;AAEA,MAAI,QAAQ,cAAc;AACxB,eAAW,OAAO,QAAQ,cAAc;AACtC,aAAO,OAAO,GAAG;AAAA,IACnB;AAAA,EACF;AAEA,QAAM,kBAAkB,oBAAI,IAAY;AAExC,MAAI,UAAU,YAAY;AAAA,IACxB,OAAO,KAAK;AAAA,IACZ,aAAa,KAAK;AAAA,IAClB,QAAQ,KAAK,UAAU;AAAA,IACvB,QAAQ;AAAA;AAAA,EACV,CAAC;AAED,MAAI,KAAK,MAAM,QAAQ;AACrB,UAAM,SAAS,IAAI,IAAI,KAAK,IAAI;AAChC,cAAU,QAAQ,OAAO,CAAC,MAAM,OAAO,IAAI,EAAE,GAAG,CAAC;AAAA,EACnD;AAEA,MAAI,KAAK,MAAM,QAAQ;AACrB,cAAU,QAAQ;AAAA,MAAO,CAAC,MACxB,KAAK,KAAM,KAAK,CAAC,MAAM,EAAE,UAAU,KAAK,MAAM,SAAS,CAAC,CAAC;AAAA,IAC3D;AAAA,EACF;AAEA,aAAW,SAAS,SAAS;AAC3B,QAAI,MAAM,UAAU;AAClB,YAAM,QAAQ,WAAW,MAAM,QAAQ;AACvC,UAAI,MAAM,UAAW;AAAA,IACvB;AAEA,UAAM,MAAM,UAAU,MAAM,KAAK;AAAA,MAC/B,OAAO,MAAM;AAAA,MACb,aAAa,KAAK;AAAA,MAClB,KAAK,KAAK;AAAA,MACV,QAAQ,KAAK,UAAU;AAAA,MACvB,QAAQ;AAAA;AAAA,IACV,CAAC;AAED,QAAI,QAAQ,MAAM;AAChB,aAAO,MAAM,GAAG,IAAI;AACpB,UAAI,IAAI,SAAS,GAAG;AAClB,wBAAgB,IAAI,GAAG;AAAA,MACzB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,cAAc;AAAA,IACnB;AAAA,IACA,SAAS,KAAK;AAAA,IACd,MAAM,KAAK;AAAA,IACX;AAAA,IACA,iBAAiB,CAAC,GAAG,eAAe;AAAA,IACpC,eAAe,KAAK;AAAA,IACpB,aAAa,KAAK;AAAA,EACpB,CAAC;AACH;AAoBO,SAAS,cAAc,MAAiD;AAC7E,QAAM,EAAE,SAAS,iBAAiB,OAAO,IAAI;AAC7C,QAAM,aAAa,QAAQ,qBAAqB,kBAAkB,KAAK,WAAW;AAElF,SAAO,IAAI,QAAQ,CAAC,SAAS,WAAW;AAEtC,UAAM,eAAe,oBAAI,IAAI;AAAA,MAC3B;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAM;AAAA,MAAU;AAAA,MAAO;AAAA,MAAU;AAAA,MAAO;AAAA,MAAO;AAAA,IACzE,CAAC;AAKD,UAAM,cAAc,KAAK,QAAQ,MAAM,OAAO,EAAE,IAAI,KAAK,KAAK;AAE9D,QAAI,QAAQ,iBAAiB,SAAS,aAAa,IAAI,WAAW,GAAG;AACnE,YAAM,MAAM,sEAAsE,QAAQ,IAAI,eAAe,KAAK,OAAO;AACzH,UAAI,KAAK,eAAe;AACtB,eAAO,QAAQ,EAAE,MAAM,KAAK,QAAQ,IAAI,QAAQ,IAAI,CAAC;AAAA,MACvD;AACA,cAAQ,OAAO,MAAM,MAAM,IAAI;AAC/B,aAAO,QAAQ,EAAE,MAAM,KAAK,QAAQ,IAAI,QAAQ,GAAG,CAAC;AAAA,IACtD;AAEA,UAAM,QAAQ,MAAM,KAAK,SAAS,KAAK,MAAM;AAAA,MAC3C,KAAK;AAAA,MACL,OAAO,CAAC,WAAW,QAAQ,MAAM;AAAA,MACjC,OAAO;AAAA,IACT,CAAC;AAED,QAAI,WAAW;AACf,QAAI;AAEJ,QAAI,YAAY;AACd,cAAQ,WAAW,MAAM;AACvB,mBAAW;AACX,cAAM,KAAK,SAAS;AAAA,MACtB,GAAG,aAAa,GAAI;AAAA,IACtB;AAEA,UAAM,eAAe,IAAI,mBAAmB,CAAC,GAAG,eAAe,CAAC;AAChE,UAAM,eAAe,IAAI,mBAAmB,CAAC,GAAG,eAAe,CAAC;AAEhE,QAAI,MAAM,OAAQ,OAAM,OAAO,KAAK,YAAY;AAChD,QAAI,MAAM,OAAQ,OAAM,OAAO,KAAK,YAAY;AAEhD,QAAI,YAAY;AAChB,QAAI,YAAY;AAEhB,QAAI,KAAK,eAAe;AACtB,mBAAa,GAAG,QAAQ,CAAC,MAAO,aAAa,EAAE,SAAS,CAAE;AAC1D,mBAAa,GAAG,QAAQ,CAAC,MAAO,aAAa,EAAE,SAAS,CAAE;AAAA,IAC5D,OAAO;AACL,mBAAa,KAAK,QAAQ,MAAM;AAChC,mBAAa,KAAK,QAAQ,MAAM;AAAA,IAClC;AAEA,UAAM,GAAG,SAAS,CAAC,SAAS;AAC1B,UAAI,MAAO,cAAa,KAAK;AAC7B,UAAI,UAAU;AACZ,gBAAQ,EAAE,MAAM,KAAK,QAAQ,WAAW,QAAQ,YAAY;AAAA,mCAAsC,UAAU,kBAAkB,CAAC;AAAA,MACjI,OAAO;AACL,gBAAQ,EAAE,MAAM,QAAQ,GAAG,QAAQ,WAAW,QAAQ,UAAU,CAAC;AAAA,MACnE;AAAA,IACF,CAAC;AAED,UAAM,GAAG,SAAS,CAAC,QAAQ;AACzB,UAAI,MAAO,cAAa,KAAK;AAC7B,aAAO,GAAG;AAAA,IACZ,CAAC;AAAA,EACH,CAAC;AACH;;;ACnVA,SAAS,gBAAAM,eAAc,aAAa,gBAAgB;AACpD,SAAS,YAAY;;;ACHd,IAAM,4BACX;AAQK,SAAS,iBAAiB,KAAqB;AACpD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,MAAM,IAAI;AAChB,QAAM,cAAc,oBAAI,IAAoB;AAE5C,WAAS,IAAI,GAAG,IAAI,KAAK,KAAK;AAC5B,UAAM,OAAO,IAAI,CAAC;AAClB,gBAAY,IAAI,OAAO,YAAY,IAAI,IAAI,KAAK,KAAK,CAAC;AAAA,EACxD;AAEA,MAAI,UAAU;AACd,aAAW,SAAS,YAAY,OAAO,GAAG;AACxC,UAAM,IAAI,QAAQ;AAClB,eAAW,IAAI,KAAK,KAAK,CAAC;AAAA,EAC5B;AAEA,SAAO;AACT;AAEO,SAAS,mBAAmB,OAAwB;AACzD,QAAM,KAAK,MAAM,YAAY;AAC7B,SACE,GAAG,SAAS,SAAS,KACrB,GAAG,SAAS,OAAO,KACnB,GAAG,SAAS,aAAa,KACzB,GAAG,SAAS,YAAY,KACxB,GAAG,SAAS,KAAK;AAErB;AAEA,SAAS,sBAAsB,OAAe,SAA0B;AACtE,SAAO,UAAU,OAAO,MAAM,WAAW,KAAK,KAAK,MAAM,WAAW,MAAM;AAC5E;AAMO,SAAS,kBAAkB,MAAmC;AACnE,MAAI,KAAK,SAAS,IAAK,QAAO,CAAC;AAE/B,QAAM,MAA2B,CAAC;AAClC,4BAA0B,YAAY;AACtC,MAAI;AACJ,UAAQ,QAAQ,0BAA0B,KAAK,IAAI,OAAO,MAAM;AAC9D,UAAM,UAAU,MAAM,CAAC;AACvB,UAAM,QAAQ,MAAM,CAAC;AACrB,UAAM,QAAQ,MAAM,CAAC;AAErB,QAAI,MAAM,SAAS,EAAG;AACtB,QAAI,mBAAmB,KAAK,EAAG;AAE/B,UAAM,UAAU,iBAAiB,KAAK;AACtC,QAAI,CAAC,sBAAsB,OAAO,OAAO,EAAG;AAE5C,QAAI,KAAK,EAAE,SAAS,OAAO,MAAM,CAAC;AAAA,EACpC;AACA,SAAO;AACT;;;ADpDA,IAAM,cAAc,oBAAI,IAAI;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,CAAC;AAED,IAAM,cAAc,oBAAI,IAAI;AAAA,EAC1B;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EACjD;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EACxB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EAC/B;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAU;AAAA,EAC3B;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAO;AAAA,EACvB;AACF,CAAC;AAEM,SAAS,aAAa,KAA2B;AACtD,QAAM,UAAwB,CAAC;AAE/B,WAAS,KAAK,YAAoB;AAChC,QAAI;AACJ,QAAI;AACF,gBAAU,YAAY,UAAU;AAAA,IAClC,QAAQ;AACN;AAAA,IACF;AAEA,eAAW,SAAS,SAAS;AAC3B,UAAI,YAAY,IAAI,KAAK,EAAG;AAE5B,YAAM,WAAW,KAAK,YAAY,KAAK;AACvC,UAAI;AACJ,UAAI;AACF,eAAO,SAAS,QAAQ;AAAA,MAC1B,QAAQ;AACN;AAAA,MACF;AAEA,UAAI,KAAK,YAAY,GAAG;AACtB,aAAK,QAAQ;AAAA,MACf,WAAW,KAAK,OAAO,GAAG;AACxB,cAAM,MAAM,SAAS,MAAM,SAAS,YAAY,GAAG,CAAC,EAAE,YAAY;AAClE,YAAI,YAAY,IAAI,GAAG,KAAK,MAAM,SAAS,OAAO,EAAG;AAErD,YAAI;AACJ,YAAI;AACF,oBAAUC,cAAa,UAAU,MAAM;AAAA,QACzC,QAAQ;AACN;AAAA,QACF;AAEA,YAAI,QAAQ,SAAS,IAAI,EAAG;AAE5B,cAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,iBAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,gBAAM,OAAO,MAAM,CAAC;AACpB,gBAAM,UAAU,kBAAkB,IAAI;AACtC,qBAAW,KAAK,SAAS;AACvB,kBAAM,UAAU,iBAAiB,EAAE,KAAK;AACxC,kBAAM,UAAU,SAAS,WAAW,GAAG,IACnC,SAAS,MAAM,IAAI,MAAM,EAAE,QAAQ,WAAW,EAAE,IAChD;AAEJ,oBAAQ,KAAK;AAAA,cACX,MAAM,WAAW;AAAA,cACjB,MAAM,IAAI;AAAA,cACV,SAAS,EAAE;AAAA,cACX,OAAO,EAAE;AAAA,cACT,SAAS,KAAK,KAAK;AAAA,cACnB,SAAS,WAAW,QAAQ,QAAQ,CAAC,CAAC;AAAA,YACxC,CAAC;AAAA,UACH;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,OAAK,GAAG;AACR,SAAO;AACT;;;AEjGA,SAAS,gBAAAC,eAAc,iBAAAC,gBAAe,cAAAC,mBAAkB;AACxD,SAAS,UAAU,eAAe;AAelC,IAAM,iBAA0D;AAAA,EAC9D,OAAO,CAAC,MAAM,eAAe,CAAC;AAAA,EAC9B,QAAQ,CAAC,MAAM,eAAe,CAAC;AAAA,EAC/B,OAAO,CAAC,MAAM,eAAe,CAAC;AAAA,EAC9B,QAAQ,CAAC,MAAM,eAAe,CAAC;AAAA,EAC/B,QAAQ,CAAC,MAAM,eAAe,CAAC;AAAA,EAC/B,QAAQ,CAAC,MAAM,eAAe,CAAC;AAAA,EAC/B,OAAO,CAAC,MAAM,eAAe,CAAC;AAAA,EAC9B,OAAO,CAAC,MAAM,QAAQ,CAAC;AAAA,EACvB,OAAO,CAAC,MAAM,cAAc,CAAC;AAAA,EAC7B,OAAO,CAAC,MAAM,kBAAkB,CAAC;AAAA,EACjC,SAAS,CAAC,MAAM,kBAAkB,CAAC;AAAA,EACnC,OAAO,CAAC,MAAM,kBAAkB,CAAC;AAAA,EACjC,OAAO,CAAC,MAAM,uCAAuC,CAAC;AAAA,EACtD,QAAQ,CAAC,MAAM,WAAW,CAAC;AAAA,EAC3B,OAAO,CAAC,MAAM,MAAM,CAAC;AAAA,EACrB,SAAS,CAAC,MAAM,MAAM,CAAC;AACzB;AAEA,SAAS,UAAU,UAAkB,SAAyB;AAC5D,QAAM,MAAM,QAAQ,QAAQ,EAAE,YAAY;AAC1C,QAAM,YAAY,eAAe,GAAG;AACpC,SAAO,YAAY,UAAU,OAAO,IAAI,eAAe,OAAO;AAChE;AAKO,SAAS,UACd,OACA,OAAoB,CAAC,GACP;AACd,QAAM,UAAwB,CAAC;AAE/B,aAAW,QAAQ,OAAO;AACxB,QAAI,CAACC,YAAW,IAAI,EAAG;AAEvB,QAAI;AACJ,QAAI;AACF,gBAAUC,cAAa,MAAM,MAAM;AAAA,IACrC,QAAQ;AACN;AAAA,IACF;AAEA,QAAI,QAAQ,SAAS,IAAI,EAAG;AAE5B,UAAM,QAAQ,QAAQ,MAAM,OAAO;AACnC,UAAM,QAAwG,CAAC;AAE/G,aAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,YAAM,OAAO,MAAM,CAAC;AACpB,YAAM,UAAU,kBAAkB,IAAI;AAEtC,iBAAW,KAAK,SAAS;AACvB,cAAM,eAAe,EAAE,QAAQ,YAAY;AAC3C,cAAM,UAAU,iBAAiB,EAAE,KAAK;AACxC,cAAM,YAAY,KAAK,QAAQ;AAE/B,YAAI,WAAW;AACb,gBAAM,SAAS,UAAU,MAAM,YAAY;AAC3C,gBAAM,KAAK;AAAA,YACT,MAAM;AAAA,YACN,UAAU,GAAG,EAAE,KAAK,GAAG,EAAE,KAAK,GAAG,EAAE,KAAK;AAAA,YACxC,aAAa;AAAA,YACb,SAAS;AAAA,YACT,OAAO,EAAE;AAAA,UACX,CAAC;AAAA,QACH;AAEA,gBAAQ,KAAK;AAAA,UACX;AAAA,UACA,MAAM,IAAI;AAAA,UACV,SAAS;AAAA,UACT,OAAO,EAAE;AAAA,UACT,SAAS,KAAK,KAAK;AAAA,UACnB,SAAS,WAAW,QAAQ,QAAQ,CAAC,CAAC;AAAA,UACtC,OAAO;AAAA,QACT,CAAC;AAAA,MACH;AAAA,IACF;AAEA,QAAI,KAAK,OAAO,MAAM,SAAS,GAAG;AAChC,YAAM,WAAW,QAAQ,MAAM,OAAO;AACtC,iBAAW,OAAO,MAAM,QAAQ,GAAG;AACjC,cAAM,UAAU,IAAI;AACpB,YAAI,WAAW,KAAK,UAAU,SAAS,QAAQ;AAC7C,mBAAS,OAAO,IAAI,SAAS,OAAO,EAAE,QAAQ,IAAI,UAAU,IAAI,WAAW;AAAA,QAC7E;AAEA,YAAI,CAAC,UAAU,IAAI,SAAS,EAAE,OAAO,KAAK,OAAO,aAAa,KAAK,YAAY,CAAC,GAAG;AACjF,oBAAU,IAAI,SAAS,IAAI,OAAO;AAAA,YAChC,OAAO,KAAK,SAAS;AAAA,YACrB,aAAa,KAAK;AAAA,YAClB,QAAQ;AAAA,YACR,aAAa,sBAAsB,SAAS,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC;AAAA,UACnE,CAAC;AAAA,QACH;AAAA,MACF;AAEA,MAAAC,eAAc,MAAM,SAAS,KAAK,IAAI,GAAG,MAAM;AAAA,IACjD;AAAA,EACF;AAEA,SAAO;AACT;;;ACxHO,SAAS,wBAAwBC,UAAwB;AAC9D,EAAAA,SACG,QAAQ,mBAAmB,EAC3B;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,kCAAkC,EACzD,OAAO,iBAAiB,mCAAmC,EAC3D,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,qBAAqB,EAC/C,OAAO,qBAAqB,qCAAqC,EACjE,OAAO,qBAAqB,mCAAmC,EAC/D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,OAAO,aAAuB,QAAQ;AAC5C,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,YAAY,CAAC;AAC7B,UAAM,OAAO,YAAY,MAAM,CAAC;AAEhC,QAAI;AACF,YAAM,EAAE,KAAK,IAAI,MAAM,YAAY;AAAA,QACjC,GAAG;AAAA,QACH;AAAA,QACA;AAAA,QACA,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,QACtD,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,QACtD,SAAS,IAAI;AAAA,MACf,CAAC;AACD,cAAQ,KAAK,IAAI;AAAA,IACnB,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACnF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,YAAY,EACpB,YAAY,uCAAuC,EACnD;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,qCAAqC,EAC5D,OAAO,iBAAiB,sCAAsC,EAC9D,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,KAAyB,QAAQ;AACxC,UAAM,YAAY,OAAO,QAAQ,IAAI;AACrC,UAAM,UAAU,IAAI,QAAQ;AAC5B,UAAM,WAAW,gBAAgBA,UAAS,GAAG;AAC7C,QAAI,CAAC,UAAU;AACb,cAAQ;AAAA,QACN;AAAA,IAAO,QAAQ,GAAG,aAAa,EAAE,KAAK,SAAS,CAAC,kBAAkB,UAAU,EAAE,OAAO,eAAe,IAAI,EAAE;AAAA;AAAA,MAC5G;AAAA,IACF;AAEA,UAAM,UAAU,aAAa,SAAS;AAEtC,QAAI,YAAY,CAAC,SAAS;AACxB,eAASA,UAAS,KAAK,EAAE,KAAK,WAAW,UAAU,QAAQ,CAAC;AAC5D,UAAI,QAAQ,SAAS,EAAG,SAAQ,WAAW;AAC3C;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ;AAAA,QACN,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC;AAAA;AAAA,MAC7B;AACA;AAAA,IACF;AAEA,QAAI,SAAS;AACX,YAAM,UAAU,IAAI;AAAA,QAClB,QAAQ;AAAA,UAAI,CAAC,MACX,EAAE,KAAK,WAAW,GAAG,IAAI,EAAE,OAAO,GAAG,SAAS,IAAI,EAAE,IAAI;AAAA,QAC1D;AAAA,MACF;AACA,YAAM,OAAO,UAAU,GAAG;AAC1B,YAAM,cAAc,UAAU,CAAC,GAAG,OAAO,GAAG;AAAA,QAC1C,KAAK;AAAA,QACL,OAAO,KAAK;AAAA,QACZ,aAAa,KAAK;AAAA,MACpB,CAAC;AACD,YAAM,aAAa,YAAY,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE;AACtD,UAAI,UAAU;AACZ,iBAASA,UAAS,KAAK;AAAA,UACrB,KAAK;AAAA,UACL,UAAU;AAAA,UACV,OAAO;AAAA,QACT,CAAC;AACD;AAAA,MACF;AACA,cAAQ;AAAA,QACN,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,UAAU,UAAU;AAAA;AAAA,MACjD;AACA;AAAA,IACF;AAEA,eAAW,OAAO,SAAS;AACzB,cAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,EAAE;AACvE,cAAQ,IAAI,OAAO,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,OAAO,CAAC,EAAE;AAC7D,cAAQ;AAAA,QACN,OAAO,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,IAAI,EAAE,IAAI,IAAI,QAAQ,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,QAAQ,SAAS,CAAC,CAAC;AAAA,MAChH;AACA,cAAQ,IAAI,OAAO,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,OAAO,EAAE;AACrD,cAAQ,IAAI;AAAA,IACd;AAEA,YAAQ;AAAA,MACN,KAAK,EAAE,IAAI,SAAS,QAAQ,MAAM,qBAAqB,CAAC,QAAQ,EAAE,KAAK,kBAAkB,CAAC;AAAA;AAAA,IAC5F;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,iBAAiB,EACzB;AAAA,IACC;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,qCAAqC,EAC5D,OAAO,iBAAiB,sCAAsC,EAC9D,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,OAAiB,QAAQ;AAChC,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,UAAU,OAAO;AAAA,MAC/B,KAAK,IAAI;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,IACpB,CAAC;AAED,QAAI,SAASA,UAAS,KAAK,EAAE,OAAO,UAAU,QAAQ,CAAC,GAAG;AACxD,UAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,EAAE,KAAK,EAAG,SAAQ,WAAW;AACtD;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,MAAM,QAAQ,KAAK,CAAC,kCAAkC,MAAM,MAAM;AAAA;AAAA,MAC7E;AACA;AAAA,IACF;AAEA,eAAW,OAAO,SAAS;AACzB,YAAM,SAAS,IAAI,QAAQ,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI,OAAO;AAC3D,cAAQ;AAAA,QACN,KAAK,IAAI,QAAQ,EAAE,MAAM,QAAQ,KAAK,IAAI,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,IAAI,IAAI,CAAC,IAAI,IAAI,IAAI,KAAK,MAAM;AAAA,MAC3G;AACA,cAAQ,IAAI,OAAO,EAAE,IAAI,MAAM,CAAC,QAAQ,EAAE,KAAK,IAAI,OAAO,CAAC,EAAE;AAC7D,cAAQ;AAAA,QACN,OAAO,EAAE,IAAI,UAAU,CAAC,IAAI,IAAI,UAAU,IAAI,EAAE,IAAI,IAAI,QAAQ,SAAS,CAAC,IAAI,EAAE,OAAO,IAAI,QAAQ,SAAS,CAAC,CAAC;AAAA,MAChH;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,aAAa,QAAQ,OAAO,CAAC,MAAM,EAAE,KAAK,EAAE;AAClD,QAAI,IAAI,OAAO,aAAa,GAAG;AAC7B,cAAQ;AAAA,QACN,KAAK,EAAE,MAAM,SAAS,UAAU,YAAY,CAAC;AAAA;AAAA,MAC/C;AAAA,IACF,OAAO;AACL,cAAQ;AAAA,QACN,KAAK,EAAE,IAAI,SAAS,QAAQ,MAAM,uBAAuB,CAAC,QAAQ,EAAE,KAAK,OAAO,CAAC;AAAA;AAAA,MACnF;AAAA,IACF;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,QAAQ,EAChB,YAAY,qDAAqD,EACjE,OAAO,iBAAiB,oBAAoB,MAAM,EAClD,OAAO,aAAa,6BAA6B,EACjD,OAAO,OAAO,QAAQ;AACrB,UAAM,EAAE,qBAAqB,IAAI,MAAM,OAAO,yBAAyB;AACvE,UAAM,EAAE,KAAK,IAAI,MAAM,OAAO,eAAoB;AAClD,UAAM,EAAE,SAAS,IAAI,MAAM,OAAO,IAAS;AAE3C,UAAM,OAAO,OAAO,IAAI,IAAI;AAC5B,UAAM,EAAE,OAAO,IAAI,IAAI,qBAAqB,EAAE,KAAK,CAAC;AAEpD,YAAQ;AAAA,MACN;AAAA,IAAO,QAAQ,GAAG,IAAI,EAAE,KAAK,iCAAiC,CAAC;AAAA;AAAA,IACjE;AACA,YAAQ,IAAI,KAAK,EAAE,KAAK,GAAG,CAAC;AAAA,CAAI;AAChC,YAAQ,IAAI,EAAE,IAAI,0BAA0B,CAAC;AAE7C,QAAI,IAAI,SAAS,OAAO;AACtB,YAAM,UACJ,SAAS,MAAM,WACX,SACA,SAAS,MAAM,UACb,UACA;AACR,WAAK,GAAG,OAAO,IAAI,GAAG,EAAE;AAAA,IAC1B;AAEA,UAAM,WAAW,MAAM;AACrB,cAAQ,IAAI;AAAA,EAAK,EAAE,IAAI,qBAAqB,CAAC,EAAE;AAC/C,YAAM;AACN,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,YAAQ,GAAG,UAAU,QAAQ;AAC7B,YAAQ,GAAG,WAAW,QAAQ;AAE9B,UAAM,IAAI,QAAQ,MAAM;AAAA,IAAC,CAAC;AAAA,EAC5B,CAAC;AACL;;;AC3NA,SAAS,iBAAAC,sBAAqB;AAMvB,SAAS,WAAW,OAAuB;AAChD,QAAM,IAAI,MAAM,KAAK,EAAE,MAAM,oBAAoB;AACjD,MAAI,GAAG;AACL,UAAM,OAAO,EAAE,GAAG,IAAI,GAAG,MAAM,GAAG,MAAM,EAAE,EAAE,CAAC,EAAE,YAAY,CAAoB;AAC/E,WAAO,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,EAAE,CAAC,CAAC,IAAI,OAAO,GAAI,EAAE,YAAY;AAAA,EACvE;AACA,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,MAAI,OAAO,MAAM,KAAK,QAAQ,CAAC,GAAG;AAChC,UAAM,IAAI,MAAM,aAAa,KAAK,kDAAkD;AAAA,EACtF;AACA,SAAO,KAAK,YAAY;AAC1B;AAEA,SAAS,WAAW,SAAyB;AAC3C,MAAI,UAAU,GAAI,QAAO,GAAG,OAAO;AACnC,MAAI,UAAU,KAAM,QAAO,GAAG,KAAK,MAAM,UAAU,EAAE,CAAC;AACtD,MAAI,UAAU,MAAO,QAAO,GAAG,KAAK,MAAM,UAAU,IAAI,CAAC;AACzD,SAAO,GAAG,KAAK,MAAM,UAAU,KAAK,CAAC;AACvC;AAEO,SAAS,sBAAsBC,UAAwB;AAC5D,EAAAA,SACG,QAAQ,OAAO,EACf,YAAY,sCAAsC,EAClD,OAAO,mBAAmB,eAAe,EACzC,OAAO,yBAAyB,8CAA8C,EAC9E,OAAO,mBAAmB,iDAAiD,EAC3E,OAAO,mBAAmB,4BAA4B,UAAU,EAAE,EAClE,OAAO,eAAe,yBAAyB,EAC/C,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,QAAI,IAAI,WAAW;AACjB,YAAM,YAAY,gBAAgB,IAAI,GAAG;AACzC,UAAI,SAASA,UAAS,KAAK,EAAE,UAAU,CAAC,EAAG;AAC3C,UAAI,UAAU,WAAW,GAAG;AAC1B,gBAAQ,IAAI,GAAG,QAAQ,MAAM,IAAI,EAAE,MAAM,uBAAuB,CAAC,EAAE;AACnE;AAAA,MACF;AAEA,cAAQ;AAAA,QACN;AAAA,EAAK,QAAQ,OAAO,IAAI,EAAE,KAAK,EAAE,OAAO,GAAG,UAAU,MAAM,6BAA6B,CAAC,CAAC;AAAA;AAAA,MAC5F;AACA,iBAAW,KAAK,WAAW;AACzB,gBAAQ,IAAI,KAAK,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,WAAW,EAAE;AAAA,MACtD;AACA,cAAQ,IAAI;AACZ;AAAA,IACF;AAEA,UAAM,SAAS,WAAW;AAAA,MACxB,KAAK,IAAI;AAAA,MACT,QAAQ,IAAI;AAAA,MACZ,OAAO,IAAI;AAAA,MACX,OAAO,IAAI;AAAA,IACb,CAAC;AAED,QAAI,SAASA,UAAS,KAAK,EAAE,OAAO,CAAC,EAAG;AAExC,QAAI,OAAO,WAAW,GAAG;AACvB,cAAQ,IAAI,EAAE,IAAI,uBAAuB,CAAC;AAC1C;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,eAAe,OAAO,MAAM;AAAA,CAAY,CAAC;AAE9E,eAAW,SAAS,QAAQ;AAC1B,YAAM,KAAK,IAAI,KAAK,MAAM,SAAS,EAAE,eAAe;AACpD,YAAM,cACJ,MAAM,WAAW,SACb,EAAE,OACF,MAAM,WAAW,UACf,EAAE,QACF,MAAM,WAAW,WACf,EAAE,MACF,EAAE;AAEZ,YAAM,QAAQ;AAAA,QACZ,EAAE,IAAI,EAAE;AAAA,QACR,YAAY,MAAM,OAAO,OAAO,CAAC,CAAC;AAAA,QAClC,MAAM,MAAM,EAAE,KAAK,MAAM,GAAG,IAAI;AAAA,QAChC,MAAM,QAAQ,EAAE,IAAI,IAAI,MAAM,KAAK,GAAG,IAAI;AAAA,QAC1C,MAAM,QAAQ,EAAE,KAAK,SAAI,MAAM,KAAK,QAAG,IAAI;AAAA,QAC3C,MAAM,SAAS,EAAE,IAAI,MAAM,MAAM,IAAI;AAAA,MACvC;AAEA,cAAQ,IAAI,KAAK,MAAM,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,IACrD;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB,YAAY,8CAA8C,EAC1D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,SAAS,iBAAiB;AAChC,QAAI,SAASA,UAAS,KAAK,MAAM,GAAG;AAClC,UAAI,CAAC,OAAO,UAAU,OAAO,cAAc,EAAG,SAAQ,WAAW;AACjE;AAAA,IACF;AACA,QAAI,OAAO,gBAAgB,GAAG;AAC5B,cAAQ,IAAI,EAAE,IAAI,6BAA6B,CAAC;AAChD;AAAA,IACF;AAEA,QAAI,OAAO,QAAQ;AACjB,cAAQ;AAAA,QACN,GAAG,QAAQ,MAAM,IAAI,EAAE,MAAM,oBAAoB,CAAC,WAAM,OAAO,WAAW;AAAA,MAC5E;AAAA,IACF,OAAO;AACL,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,IAAI,oBAAoB,CAAC,cAAc,OAAO,QAAQ,EAAE;AAC1F,cAAQ;AAAA,QACN,EAAE,IAAI,KAAK,OAAO,WAAW,IAAI,OAAO,WAAW,4BAA4B;AAAA,MACjF;AACA,UAAI,OAAO,aAAa;AACtB,gBAAQ;AAAA,UACN,EAAE;AAAA,YACA,mBAAmB,OAAO,YAAY,SAAS,IAAI,OAAO,YAAY,MAAM,IAAI,OAAO,YAAY,OAAO,EAAE;AAAA,UAC9G;AAAA,QACF;AAAA,MACF;AACA,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB,YAAY,0CAA0C,EACtD,OAAO,kBAAkB,uBAAuB,EAChD,OAAO,kBAAkB,qBAAqB,EAC9C,OAAO,kBAAkB,mCAAmC,OAAO,EACnE,OAAO,uBAAuB,iCAAiC,EAC/D,OAAO,CAAC,QAAQ;AACf,UAAM,SAAS,YAAY;AAAA,MACzB,OAAO,IAAI;AAAA,MACX,OAAO,IAAI;AAAA,MACX,QAAQ,IAAI;AAAA,IACd,CAAC;AAED,QAAI,IAAI,QAAQ;AACd,MAAAC,eAAc,IAAI,QAAQ,MAAM;AAChC,cAAQ,IAAI,GAAG,QAAQ,KAAK,gBAAgB,IAAI,MAAM,EAAE;AAAA,IAC1D,OAAO;AACL,cAAQ,IAAI,MAAM;AAAA,IACpB;AAAA,EACF,CAAC;AAEH,EAAAD,SACG,QAAQ,gBAAgB,EACxB,YAAY,8EAA8E,EAC1F,OAAO,mBAAmB,8DAA8D,EACxF,OAAO,kBAAkB,qDAAqD,EAC9E,OAAO,mBAAmB,wBAAwB,UAAU,EAAE,EAC9D,OAAO,iBAAiB,kCAAkC,EAC1D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,WAAW,kBAAkB;AAAA,MACjC,OAAO,IAAI;AAAA,MACX,OAAO,WAAW,IAAI,SAAS,IAAI;AAAA,MACnC,OAAO,IAAI;AAAA,IACb,CAAC;AAED,QAAI,SAASA,UAAS,KAAK,EAAE,SAAS,CAAC,EAAG;AAE1C,QAAI,SAAS,WAAW,GAAG;AACzB,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,oBAAoB,SAAS,MAAM;AAAA,CAAK,CAAC;AAC9E,eAAW,KAAK,UAAU;AACxB,YAAM,UAAU,IAAI,KAAK,EAAE,SAAS;AACpC,YAAM,QAAQ,IAAI,KAAK,EAAE,OAAO;AAChC,YAAM,UAAU,KAAK,IAAI,GAAG,KAAK,OAAO,MAAM,QAAQ,IAAI,QAAQ,QAAQ,KAAK,GAAI,CAAC;AACpF,YAAM,MAAM,EAAE,YAAY,YAAY,EAAE,SAAS,KAAK,EAAE;AACxD,YAAM,OAAO;AAAA,QACX,EAAE,KAAK,SAAI,GAAG,QAAG;AAAA,QACjB,EAAE,IAAI,IAAI,EAAE,MAAM,GAAG;AAAA,QACrB,EAAE;AAAA,UACA,GAAG,QAAQ,eAAe,CAAC,WAAM,MAAM,mBAAmB,CAAC,KAAK,WAAW,OAAO,CAAC;AAAA,QACrF;AAAA,QACA,GAAG,EAAE,UAAU;AAAA,QACf,EAAE,UAAU,IAAI,EAAE,IAAI,GAAG,EAAE,OAAO,SAAS,IAAI,EAAE,MAAM,UAAU;AAAA,QACjE,EAAE,eAAe,SAAS,EAAE,IAAI,GAAG,EAAE,eAAe,MAAM,eAAe,IAAI;AAAA,MAC/E;AACA,cAAQ,IAAI,KAAK,KAAK,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE;AAClD,cAAQ,IAAI,EAAE,IAAI,UAAU,EAAE,EAAE,eAAY,EAAE,KAAK,SAAS,EAAE,KAAK,KAAK,IAAI,IAAI,QAAG,EAAE,CAAC;AACtF,UAAI,IAAI,SAAS;AACf,mBAAW,KAAK,EAAE,QAAQ;AACxB,gBAAM,QAAQ;AAAA,YACZ,EAAE,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,mBAAmB,CAAC;AAAA,aAC/C,EAAE,WAAW,iBAAiB,EAAE,WAAW,WAAW,EAAE,MAAM,EAAE;AAAA,cAC/D,EAAE,OAAO,OAAO,EAAE;AAAA,YACpB;AAAA,YACA,EAAE,MAAM,EAAE,KAAK,EAAE,GAAG,IAAI;AAAA,YACxB,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,IAAI;AAAA,UAC/B;AACA,kBAAQ,IAAI,SAAS,MAAM,OAAO,OAAO,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,QACzD;AAAA,MACF;AACA,cAAQ,IAAI;AAAA,IACd;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,QAAQ,EAChB,YAAY,iCAAiC,EAC7C,OAAO,gBAAgB,yBAAyB,EAChD,OAAO,iBAAiB,0BAA0B,EAClD,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,YAAY,IAAI;AAEhC,UAAM,cAAwB,CAAC;AAC/B,UAAM,YAAoF,CAAC;AAC3F,QAAI,UAAU;AACd,QAAI,UAAU;AAEd,eAAW,SAAS,SAAS;AAC3B,UAAI,CAAC,MAAM,SAAS,CAAC,MAAM,MAAM,eAAe;AAC9C;AAAA,MACF,WAAW,MAAM,MAAM,WAAW;AAChC,oBAAY,KAAK,MAAM,GAAG;AAAA,MAC5B,WAAW,MAAM,MAAM,SAAS;AAC9B,kBAAU,KAAK;AAAA,UACb,KAAK,MAAM;AAAA,UACX,iBAAiB,MAAM,MAAM;AAAA,UAC7B,eAAe,MAAM,MAAM;AAAA,QAC7B,CAAC;AAAA,MACH,OAAO;AACL;AAAA,MACF;AAAA,IACF;AAEA,QACE,SAASA,UAAS,KAAK;AAAA,MACrB,OAAO,QAAQ;AAAA,MACf;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,OAAO;AAAA,MACP,WAAW,QAAQ,WAAW,IAAI,CAAC,IAAI,gBAAgB;AAAA,IACzD,CAAC,GACD;AACA;AAAA,IACF;AAEA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,EAAE,IAAI,qBAAqB,CAAC;AACxC;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,MAAM;AAAA,CAAyB,CAAC;AAElE,eAAW,OAAO,aAAa;AAC7B,cAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,WAAW,CAAC,CAAC,EAAE;AAAA,IACzF;AACA,eAAW,KAAK,WAAW;AACzB,cAAQ;AAAA,QACN,KAAK,EAAE,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,IAAI,EAAE,OAAO,UAAU,EAAE,eAAe,MAAM,EAAE,aAAa,QAAQ,CAAC;AAAA,MACvH;AAAA,IACF;AAEA,YAAQ;AAAA,MACN;AAAA,IAAO,EAAE,MAAM,GAAG,QAAQ,KAAK,IAAI,OAAO,UAAU,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,OAAO,IAAI,UAAU,MAAM,QAAQ,CAAC,KAAK,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,YAAY,MAAM,UAAU,CAAC,KAAK,EAAE,IAAI,GAAG,OAAO,WAAW,CAAC;AAAA,IACjN;AAEA,UAAM,YAAY,gBAAgB;AAClC,QAAI,UAAU,SAAS,GAAG;AACxB,cAAQ;AAAA,QACN;AAAA,IAAO,EAAE,OAAO,GAAG,QAAQ,OAAO,IAAI,UAAU,MAAM,oCAAoC,CAAC,IAAI,EAAE,IAAI,gCAAgC,CAAC;AAAA,MACxI;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AACL;;;AC1RA,SAAS,gBAAgB;AACzB,SAAS,cAAAE,aAAY,iBAAAC,gBAAe,WAAW,gBAAAC,eAAc,kBAAkB;AAC/E,SAAS,QAAAC,aAAY;AAMrB,SAAS,iBAA2B;AAClC,MAAI;AACF,UAAM,SAAS,SAAS,mDAAmD;AAAA,MACzE,UAAU;AAAA,MACV,OAAO,CAAC,QAAQ,QAAQ,MAAM;AAAA,IAChC,CAAC;AACD,WAAO,OACJ,MAAM,IAAI,EACV,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EACnB,OAAO,CAAC,MAAM,EAAE,SAAS,CAAC;AAAA,EAC/B,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAMO,SAAS,mBAA2B;AACzC,QAAM,SAAS,eAAe;AAC9B,MAAI,OAAO,WAAW,EAAG,QAAO;AAEhC,QAAM,UAAU,UAAU,MAAM;AAEhC,MAAI,QAAQ,WAAW,EAAG,QAAO;AAEjC,UAAQ,MAAM,uDAAuD;AACrE,aAAW,KAAK,SAAS;AACvB,YAAQ,MAAM,KAAK,EAAE,IAAI,IAAI,EAAE,IAAI,KAAK,EAAE,OAAO,eAAe,EAAE,OAAO,GAAG;AAAA,EAC9E;AACA,UAAQ;AAAA,IACN;AAAA;AAAA;AAAA,EACF;AAEA,SAAO;AACT;AAEA,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AASb,SAAS,qBAAqB,UAA0E;AAC7G,QAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,QAAM,WAAWC,MAAK,MAAM,QAAQ,OAAO;AAE3C,MAAI,CAACC,YAAWD,MAAK,MAAM,MAAM,CAAC,GAAG;AACnC,WAAO,EAAE,WAAW,OAAO,MAAM,IAAI,SAAS,uBAAuB;AAAA,EACvE;AAEA,QAAM,WAAWA,MAAK,UAAU,YAAY;AAE5C,MAAIC,YAAW,QAAQ,GAAG;AACxB,UAAM,WAAWC,cAAa,UAAU,MAAM;AAC9C,QAAI,SAAS,SAAS,QAAQ,GAAG;AAC/B,aAAO,EAAE,WAAW,MAAM,MAAM,UAAU,SAAS,yBAAyB;AAAA,IAC9E;AAEA,IAAAC,eAAc,UAAU,cAAc,OAAO,UAAU,MAAM;AAAA,EAC/D,OAAO;AACL,IAAAA,eAAc,UAAU,aAAa,MAAM;AAAA,EAC7C;AAEA,YAAU,UAAU,GAAK;AACzB,SAAO,EAAE,WAAW,MAAM,MAAM,UAAU,SAAS,4BAA4B;AACjF;AAKO,SAAS,uBAAuB,UAA4B;AACjE,QAAM,OAAO,YAAY,QAAQ,IAAI;AACrC,QAAM,WAAWH,MAAK,MAAM,QAAQ,SAAS,YAAY;AAEzD,MAAI,CAACC,YAAW,QAAQ,EAAG,QAAO;AAElC,QAAM,UAAUC,cAAa,UAAU,MAAM;AAC7C,MAAI,CAAC,QAAQ,SAAS,QAAQ,EAAG,QAAO;AAGxC,QAAM,QAAQ,QAAQ,MAAM,IAAI;AAChC,QAAM,UAAU,MAAM;AAAA,IACpB,CAAC,MAAM,CAAC,EAAE,SAAS,QAAQ,KAAK,CAAC,EAAE,SAAS,oBAAoB;AAAA,EAClE;AAEA,MAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,KAAK,KAAK,CAAC,EAAE,WAAW,IAAI,CAAC,EAAE,WAAW,GAAG;AAEvE,eAAW,QAAQ;AAAA,EACrB,OAAO;AACL,IAAAC,eAAc,UAAU,QAAQ,KAAK,IAAI,GAAG,MAAM;AAAA,EACpD;AAEA,SAAO;AACT;;;ACjGO,SAAS,qBAAqBC,UAAwB;AAG3D,EAAAA,SACG,QAAQ,cAAc,EACtB;AAAA,IACC;AAAA,EACF,EACC,OAAO,yBAAyB,iBAAiB,EACjD,OAAO,CAAC,QAAQ;AACf,UAAM,SAAS,qBAAqB,IAAI,WAAW;AACnD,QAAI,OAAO,WAAW;AACpB,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,OAAO,OAAO,CAAC,OAAO,EAAE,IAAI,OAAO,IAAI,CAAC;AAAA,MACtE;AAAA,IACF,OAAO;AACL,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,IAAI,OAAO,OAAO,CAAC,EAAE;AAAA,IACzD;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,gBAAgB,EACxB,YAAY,mCAAmC,EAC/C,OAAO,yBAAyB,iBAAiB,EACjD,OAAO,CAAC,QAAQ;AACf,UAAM,UAAU,uBAAuB,IAAI,WAAW;AACtD,QAAI,SAAS;AACX,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,yBAAyB,CAAC,EAAE;AAAA,IACtE,OAAO;AACL,cAAQ,IAAI,EAAE,IAAI,iCAAiC,CAAC;AAAA,IACtD;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,UAAU,EAClB,YAAY,yDAAyD,EACrE,OAAO,MAAM;AACZ,UAAM,OAAO,iBAAiB;AAC9B,YAAQ,KAAK,IAAI;AAAA,EACnB,CAAC;AAIH,QAAM,OAAOA,SACV,QAAQ,MAAM,EACd;AAAA,IACC;AAAA,EACF;AAEF,OACG,QAAQ,KAAK,EACb,YAAY,qBAAqB,EACjC,OAAO,eAAe,4BAA4B,EAClD,OAAO,2BAA2B,yCAAyC,EAC3E,OAAO,eAAe,kCAAkC,EACxD;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,oBAAoB,0BAA0B,EACrD,OAAO,eAAe,qBAAqB,EAC3C,OAAO,4BAA4B,+BAA+B,EAClE,OAAO,0BAA0B,oCAAoC,QAAQ,EAC7E,OAAO,wBAAwB,4BAA4B,EAC3D,OAAO,CAAC,QAAQ;AACf,QAAI;AACJ,QAAI,IAAI,KAAM,QAAO;AAAA,aACZ,IAAI,IAAK,QAAO;AAAA,aAChB,IAAI,aAAc,QAAO;AAAA,SAC7B;AACH,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,4CAA4C;AAAA,MACpE;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI,CAAC,IAAI,OAAO,CAAC,IAAI,cAAc,CAAC,IAAI,KAAK;AAC3C,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK;AAAA,QAClB;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,UAAU,IAAI,OACjB,MAAM,GAAG,EACT,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAE9B,UAAM,QAAQ,aAAa;AAAA,MACzB;AAAA,MACA,OAAO;AAAA,QACL,KAAK,IAAI;AAAA,QACT,YAAY,IAAI;AAAA,QAChB,KAAK,IAAI;AAAA,QACT,OAAO,IAAI;AAAA,QACX,QAAQ;AAAA,MACV;AAAA,MACA,SAAS,IAAI;AAAA,MACb,KAAK,IAAI;AAAA,MACT,QAAQ,IAAI,eACR,EAAE,QAAQ,IAAI,cAAc,QAAQ,IAAI,WAAW,IACnD;AAAA,MACJ,aAAa,IAAI;AAAA,MACjB,SAAS;AAAA,IACX,CAAC;AAED,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC,SAAS,EAAE,KAAK,MAAM,EAAE,CAAC,KAAK,IAAI;AAAA,IAC7E;AACA,QAAI,IAAI,IAAK,SAAQ,IAAI,EAAE,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;AACnD,QAAI,IAAI,WAAY,SAAQ,IAAI,EAAE,IAAI,cAAc,IAAI,UAAU,EAAE,CAAC;AACrE,QAAI,IAAI,IAAK,SAAQ,IAAI,EAAE,IAAI,UAAU,IAAI,GAAG,EAAE,CAAC;AAAA,EACrD,CAAC;AAEH,OACG,QAAQ,MAAM,EACd,MAAM,IAAI,EACV,YAAY,2BAA2B,EACvC,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,QAAQ,UAAa;AAC3B,QAAI,SAASA,UAAS,KAAK,EAAE,MAAM,CAAC,EAAG;AACvC,QAAI,MAAM,WAAW,GAAG;AACtB,cAAQ,IAAI,EAAE,IAAI,qBAAqB,CAAC;AACxC;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,sBAAsB,MAAM,MAAM;AAAA,CAAK;AAAA,IAClE;AAEA,eAAW,KAAK,OAAO;AACrB,YAAM,SAAS,EAAE,UAAU,EAAE,MAAM,IAAI,IAAI,EAAE,IAAI,KAAK;AACtD,YAAM,aAAuB,CAAC;AAC9B,UAAI,EAAE,MAAM,IAAK,YAAW,KAAK,OAAO,EAAE,MAAM,GAAG,EAAE;AACrD,UAAI,EAAE,MAAM,WAAY,YAAW,KAAK,WAAW,EAAE,MAAM,UAAU,EAAE;AACvE,UAAI,EAAE,MAAM,IAAK,YAAW,KAAK,OAAO,EAAE,MAAM,GAAG,EAAE;AACrD,UAAI,EAAE,MAAM,MAAO,YAAW,KAAK,SAAS,EAAE,MAAM,KAAK,EAAE;AAC3D,UAAI,EAAE,MAAM,QAAQ;AAClB,mBAAW,KAAK,WAAW,EAAE,MAAM,OAAO,KAAK,GAAG,CAAC,EAAE;AAEvD,YAAM,SACJ,EAAE,SAAS,UACP,EAAE,UACF,EAAE,SAAS,SACT,EAAE,MACF,EAAE,SACA,GAAG,EAAE,OAAO,MAAM,KAAK,EAAE,OAAO,UAAU,QAAQ,MAClD;AAEV,cAAQ;AAAA,QACN,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,MAAM,MAAM,MAAM,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,IAAI,WAAW,KAAK,GAAG,CAAC,CAAC;AAAA,MACnF;AACA,cAAQ;AAAA,QACN,OAAO,EAAE,IAAI,QAAG,CAAC,IAAI,MAAM,GAAG,EAAE,cAAc,KAAK,EAAE,IAAI,UAAK,EAAE,WAAW,EAAE,CAAC,KAAK,EAAE;AAAA,MACvF;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,OACG,QAAQ,aAAa,EACrB,MAAM,IAAI,EACV,YAAY,qBAAqB,EACjC,OAAO,CAAC,OAAe;AACtB,QAAI,WAAW,EAAE,GAAG;AAClB,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,IACzE,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,UAAU,EAAE,aAAa,CAAC;AAC9D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,OACG,QAAQ,aAAa,EACrB,YAAY,eAAe,EAC3B,OAAO,CAAC,OAAe;AACtB,QAAI,WAAW,EAAE,GAAG;AAClB,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,IACzE,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,UAAU,EAAE,aAAa,CAAC;AAC9D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,OACG,QAAQ,cAAc,EACtB,YAAY,gBAAgB,EAC5B,OAAO,CAAC,OAAe;AACtB,QAAI,YAAY,EAAE,GAAG;AACnB,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,UAAU,CAAC,SAAS,EAAE,KAAK,EAAE,CAAC;AAAA,MAC7D;AAAA,IACF,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,UAAU,EAAE,aAAa,CAAC;AAC9D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,OACG,QAAQ,WAAW,EACnB,YAAY,oCAAoC,EAChD,OAAO,OAAO,OAAe;AAC5B,UAAM,QAAQ,UAAa;AAC3B,UAAM,IAAI,MAAM,KAAK,CAACC,UAASA,MAAK,OAAO,EAAE;AAC7C,QAAI,CAAC,GAAG;AACN,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,UAAU,EAAE,aAAa,CAAC;AAC9D,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,YAAQ,IAAI,EAAE,IAAI,gBAAgB,EAAE,KAAK,EAAE,IAAI;AAAA,CAAQ,CAAC;AAExD,UAAM,UAAU;AAAA,MACd,QAAQ;AAAA,MACR,KAAK,EAAE,MAAM,OAAO;AAAA,MACpB,OAAO,EAAE,MAAM,SAAS;AAAA,MACxB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,MAClC,QAAQ;AAAA,IACV;AAEA,UAAM,UAAU,MAAM,UAAU,OAAO;AACvC,UAAM,SAAS,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,EAAE;AAElD,QAAI,QAAQ;AACV,YAAM,OAAO,OAAO,UAAU,EAAE,MAAM,QAAQ,KAAK,IAAI,EAAE,IAAI,QAAQ,KAAK;AAC1E,cAAQ,IAAI,KAAK,IAAI,IAAI,OAAO,OAAO,EAAE;AAAA,IAC3C,OAAO;AACL,cAAQ;AAAA,QACN,EAAE,OAAO,KAAK,QAAQ,OAAO,sCAAsC;AAAA,MACrE;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AACL;;;ACzNA,SAAS,gBAA6B;AACpC,SAAO;AAAA,IACL,iBAAiB;AAAA,IACjB,YAAY;AAAA,IACZ,cAAc,CAAC,QAAQ,IAAI,CAAC;AAAA,IAC5B,SAAS;AAAA,EACX;AACF;AAEO,SAAS,cAAc,SAA+B,CAAC,GAAgB;AAC5E,QAAM,MAAM,EAAE,GAAG,cAAc,GAAG,GAAG,OAAO;AAE5C,QAAM,SAAsB;AAAA,IAC1B,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC,cAAc;AAAA,IACd,SAAS;AAAA,IACT,OAAO;AAAA,IACP,SAAS;AAAA,IACT,WAAW;AAAA,IACX,SAAS,CAAC;AAAA,IACV,UAAU,CAAC;AAAA,EACb;AAGA,QAAM,gBAAgB,YAAY,EAAE,OAAO,UAAU,QAAQ,QAAQ,CAAC;AAGtE,QAAM,iBAAiB,IAAI,aAAa;AAAA,IAAQ,CAAC,OAC/C,YAAY,EAAE,OAAO,WAAW,aAAa,IAAI,QAAQ,QAAQ,CAAC;AAAA,EACpE;AAEA,QAAM,aAAa,CAAC,GAAG,eAAe,GAAG,cAAc;AACvD,SAAO,eAAe,WAAW;AAEjC,aAAW,SAAS,YAAY;AAC9B,QAAI,CAAC,MAAM,SAAU;AAErB,UAAM,QAAQ,WAAW,MAAM,QAAQ;AAEvC,QAAI,MAAM,WAAW;AACnB,aAAO;AACP,aAAO,SAAS;AAAA,QACd,YAAY,MAAM,GAAG,KAAK,MAAM,KAAK,oBAAe,MAAM,aAAa;AAAA,MACzE;AAEA,UAAI,IAAI,YAAY;AAClB,cAAM,MAAO,MAAM,UAAU,KAAK,kBAAkB;AACpD,cAAM,SAAS,MAAM,UAAU,KAAK;AACpC,cAAM,WAAW,eAAe,EAAE,QAAQ,KAAK,OAAO,CAAC;AACvD,kBAAU,MAAM,KAAK,UAAU;AAAA,UAC7B,OAAO,MAAM;AAAA,UACb,aAAa,IAAI,aAAa,CAAC;AAAA,UAC/B,QAAQ;AAAA,QACV,CAAC;AACD,eAAO,QAAQ,KAAK,MAAM,GAAG;AAC7B,iBAAS;AAAA,UACP,QAAQ;AAAA,UACR,KAAK,MAAM;AAAA,UACX,OAAO,MAAM;AAAA,UACb,QAAQ;AAAA,UACR,QAAQ;AAAA,QACV,CAAC;AACD,kBAAU;AAAA,UACR,QAAQ;AAAA,UACR,KAAK,MAAM;AAAA,UACX,OAAO,MAAM;AAAA,UACb,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,UAClC,QAAQ;AAAA,QACV,GAAG,MAAM,UAAU,KAAK,IAAI,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MAC9C;AAAA,IACF,WAAW,MAAM,SAAS;AACxB,aAAO;AACP,aAAO,SAAS;AAAA,QACd,UAAU,MAAM,GAAG,KAAK,MAAM,KAAK,YAAO,MAAM,eAAe,eAAe,MAAM,aAAa;AAAA,MACnG;AAAA,IACF,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAGA,QAAM,YAAY,gBAAgB;AAClC,SAAO,YAAY,UAAU;AAC7B,aAAW,KAAK,WAAW;AACzB,WAAO,SAAS,KAAK,YAAY,EAAE,IAAI,MAAM,EAAE,WAAW,EAAE;AAAA,EAC9D;AAEA,SAAO;AACT;AAEA,SAAS,aAAa,QAAqB,SAA0B;AACnE,QAAM,QAAkB,CAAC;AAEzB,QAAM;AAAA,IACJ,GAAG,EAAE,KAAK,GAAG,QAAQ,MAAM,oBAAoB,CAAC,IAAI,EAAE,IAAI,OAAO,SAAS,CAAC;AAAA,EAC7E;AACA,QAAM;AAAA,IACJ,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,OAAO,YAAY,KAAK,EAAE,MAAM,GAAG,QAAQ,KAAK,IAAI,OAAO,OAAO,EAAE,CAAC,KAAK,EAAE,OAAO,GAAG,QAAQ,OAAO,IAAI,OAAO,KAAK,EAAE,CAAC,KAAK,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,OAAO,OAAO,EAAE,CAAC,KAAK,EAAE,IAAI,cAAc,OAAO,SAAS,EAAE,CAAC;AAAA,EAChP;AAEA,MAAI,OAAO,QAAQ,SAAS,GAAG;AAC7B,UAAM;AAAA,MACJ,KAAK,EAAE,KAAK,GAAG,QAAQ,GAAG,gBAAgB,CAAC,IAAI,OAAO,QAAQ,KAAK,IAAI,CAAC;AAAA,IAC1E;AAAA,EACF;AAEA,MAAI,WAAW,OAAO,SAAS,SAAS,GAAG;AACzC,UAAM,KAAK,EAAE;AACb,eAAW,KAAK,OAAO,UAAU;AAC/B,UAAI,EAAE,WAAW,SAAS,EAAG,OAAM,KAAK,KAAK,EAAE,IAAI,CAAC,CAAC,EAAE;AAAA,eAC9C,EAAE,WAAW,OAAO,EAAG,OAAM,KAAK,KAAK,EAAE,OAAO,CAAC,CAAC,EAAE;AAAA,eACpD,EAAE,WAAW,SAAS,EAAG,OAAM,KAAK,KAAK,EAAE,QAAQ,CAAC,CAAC,EAAE;AAAA,UAC3D,OAAM,KAAK,KAAK,CAAC,EAAE;AAAA,IAC1B;AAAA,EACF;AAEA,SAAO,MAAM,KAAK,IAAI;AACxB;AAKA,eAAsB,WAAW,SAA+B,CAAC,GAAkB;AACjF,QAAM,MAAM,EAAE,GAAG,cAAc,GAAG,GAAG,OAAO;AAE5C,UAAQ;AAAA,IACN,GAAG,EAAE,KAAK,GAAG,QAAQ,GAAG,uBAAuB,CAAC,IAAI,EAAE,IAAI,cAAc,IAAI,eAAe,mBAAmB,IAAI,UAAU,GAAG,CAAC;AAAA,EAClI;AACA,UAAQ;AAAA,IACN,EAAE,IAAI,0BAA0B,IAAI,aAAa,MAAM,aAAa;AAAA,EACtE;AACA,UAAQ,IAAI;AAEZ,QAAM,OAAO,MAAM;AACjB,UAAM,SAAS,cAAc,GAAG;AAChC,YAAQ,IAAI,aAAa,QAAQ,IAAI,OAAO,CAAC;AAE7C,QAAI,OAAO,SAAS,SAAS,KAAK,IAAI,SAAS;AAC7C,cAAQ,IAAI;AAAA,IACd;AAAA,EACF;AAGA,OAAK;AAGL,QAAM,WAAW,YAAY,MAAM,IAAI,kBAAkB,GAAI;AAG7D,QAAM,WAAW,MAAM;AACrB,kBAAc,QAAQ;AACtB,YAAQ,IAAI;AAAA,EAAK,EAAE,IAAI,sBAAsB,CAAC,EAAE;AAChD,YAAQ,KAAK,CAAC;AAAA,EAChB;AAEA,UAAQ,GAAG,UAAU,QAAQ;AAC7B,UAAQ,GAAG,WAAW,QAAQ;AAG9B,QAAM,IAAI,QAAQ,MAAM;AAAA,EAAC,CAAC;AAC5B;;;ACzLO,SAAS,sBAAsBC,UAAwB;AAG5D,EAAAA,SACG,QAAQ,wBAAwB,EAChC;AAAA,IACC;AAAA,EACF,EACC,OAAO,CAAC,KAAa,UAAkB;AACtC,aAAS,KAAK,KAAK;AACnB,YAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,EACxE,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB,YAAY,sDAAsD,EAClE,OAAO,UAAU,iCAAiC,EAClD,OAAO,CAAC,KAAyB,QAAQ;AACxC,QAAI,CAAC,KAAK;AACR,YAAM,UAAU,WAAW;AAC3B,UACE;AAAA,QACEA;AAAA,QACA;AAAA,QACA,QAAQ,IAAI,CAAC,OAAO,EAAE,KAAK,EAAE,KAAK,WAAW,EAAE,UAAU,EAAE;AAAA,MAC7D,GACA;AACA;AAAA,MACF;AACA,UAAI,QAAQ,WAAW,GAAG;AACxB,gBAAQ,IAAI,EAAE,IAAI,wBAAwB,CAAC;AAC3C;AAAA,MACF;AACA,cAAQ;AAAA,QACN;AAAA,EAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,cAAc,CAAC,KAAK,QAAQ,MAAM;AAAA;AAAA,MAC/D;AACA,iBAAW,KAAK,SAAS;AACvB,gBAAQ;AAAA,UACN,KAAK,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAAA,QACtE;AAAA,MACF;AACA,cAAQ,IAAI;AACZ;AAAA,IACF;AAEA,UAAM,QAAQ,OAAO,GAAG;AACxB,QAAI,UAAU,MAAM;AAClB,cAAQ,IAAI,EAAE,IAAI,wBAAwB,GAAG,GAAG,CAAC;AAAA,IACnD,OAAO;AACL,cAAQ,IAAI,QAAQ,KAAK,CAAC;AAAA,IAC5B;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,cAAc,EACtB,YAAY,gCAAgC,EAC5C,OAAO,SAAS,wBAAwB,EACxC,OAAO,aAAa,8BAA8B,EAClD,OAAO,OAAO,KAAa,QAAQ;AAClC,QAAI,IAAI,KAAK;AACX,YAAM,QAAQ,WAAW,EAAE;AAC3B,UACE,CAAE,MAAM;AAAA,QACN,2BAA2B,KAAK,QAAQ,UAAU,IAAI,MAAM,KAAK;AAAA,QACjE,EAAE,WAAW,IAAI,IAAI;AAAA,MACvB,GACA;AACA,gBAAQ,MAAM,EAAE,IAAI,UAAU,CAAC;AAC/B,gBAAQ,WAAW;AACnB;AAAA,MACF;AACA,kBAAY;AACZ,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,SAAS,CAAC,mBAAmB;AACtE;AAAA,IACF;AACA,UAAM,UAAU,OAAO,GAAG;AAC1B,QAAI,SAAS;AACX,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,EAAE;AAAA,IACrE,OAAO;AACL,cAAQ,IAAI,EAAE,IAAI,wBAAwB,GAAG,GAAG,CAAC;AAAA,IACnD;AAAA,EACF,CAAC;AAIH,EAAAA,SACG,QAAQ,SAAS,EACjB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,UAAU,YAAY,EAAE,GAAG,MAAM,QAAQ,KAAK,CAAC;AACrD,UAAM,QAAQ,WAAW,EAAE,OAAO,IAAK,CAAC;AAExC,UAAM,YAAY,oBAAI,IAAoB;AAC1C,eAAW,KAAK,OAAO;AACrB,UAAI,EAAE,WAAW,UAAU,EAAE,KAAK;AAChC,kBAAU,IAAI,EAAE,MAAM,UAAU,IAAI,EAAE,GAAG,KAAK,KAAK,CAAC;AAAA,MACtD;AAAA,IACF;AAEA,UAAM,SAAS,CAAC,GAAG,UAAU,QAAQ,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AAClE,UAAM,gBAAgB,QAAQ,OAAO,CAAC,MAAM;AAC1C,YAAM,QAAQ,EAAE,UAAU,KAAK,eAAe;AAC9C,aAAO,UAAU;AAAA,IACnB,CAAC;AACD,UAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,SAAS;AAC5D,UAAM,YAAY,QAAQ;AAAA,MACxB,CAAC,MAAM,EAAE,OAAO,WAAW,CAAC,EAAE,OAAO;AAAA,IACvC;AACA,UAAM,iBAAiB,QAAQ;AAAA,MAC7B,CAAC,MAAM,CAAC,EAAE,UAAU,KAAK,kBAAkB,CAAC,EAAE,OAAO;AAAA,IACvD;AAEA,QACE,SAASA,UAAS,KAAK;AAAA,MACrB,cAAc,OACX,MAAM,GAAG,CAAC,EACV,IAAI,CAAC,CAAC,KAAK,KAAK,OAAO,EAAE,KAAK,MAAM,EAAE;AAAA,MACzC,eAAe,cAAc,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,MAC7C,SAAS,YAAY,IAAI,CAAC,MAAM,EAAE,GAAG;AAAA,MACrC,OAAO,UAAU,IAAI,CAAC,OAAO;AAAA,QAC3B,KAAK,EAAE;AAAA,QACP,eAAe,EAAE,OAAO,iBAAiB;AAAA,MAC3C,EAAE;AAAA,MACF,SAAS;AAAA,QACP,OAAO,QAAQ;AAAA,QACf,QAAQ,QAAQ,SAAS,YAAY;AAAA,QACrC,SAAS,YAAY;AAAA,QACrB,OAAO,UAAU;AAAA,QACjB,eAAe,cAAc;AAAA,QAC7B,oBAAoB,QAAQ,SAAS,eAAe;AAAA,MACtD;AAAA,IACF,CAAC,GACD;AACA;AAAA,IACF;AAEA,YAAQ,IAAI;AAAA,EAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,uBAAuB,CAAC;AAAA,CAAI;AAEnE,QAAI,OAAO,SAAS,GAAG;AACrB,cAAQ,IAAI,KAAK,EAAE,KAAK,gBAAgB,CAAC,EAAE;AAC3C,iBAAW,CAAC,KAAK,KAAK,KAAK,OAAO,MAAM,GAAG,CAAC,GAAG;AAC7C,gBAAQ,IAAI,OAAO,EAAE,KAAK,GAAG,CAAC,WAAM,EAAE,KAAK,MAAM,SAAS,CAAC,CAAC,QAAQ;AAAA,MACtE;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,QAAI,cAAc,SAAS,GAAG;AAC5B,cAAQ;AAAA,QACN,KAAK,EAAE,KAAK,iBAAiB,CAAC,IAAI,EAAE,OAAO,cAAc,OAAO,SAAS,CAAC,CAAC;AAAA,MAC7E;AACA,iBAAW,KAAK,cAAc,MAAM,GAAG,CAAC,GAAG;AACzC,cAAM,MAAM,EAAE,UAAU,KAAK,YACzB,EAAE;AAAA,UACA,YAAY,IAAI,KAAK,EAAE,SAAS,KAAK,SAAS,EAAE,mBAAmB,CAAC;AAAA,QACtE,IACA;AACJ,gBAAQ,IAAI,OAAO,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,GAAG,IAAI,GAAG,EAAE;AAAA,MAC3D;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,UAAU,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,SAAS;AACxD,UAAM,QAAQ,QAAQ;AAAA,MACpB,CAAC,MAAM,EAAE,OAAO,WAAW,CAAC,EAAE,OAAO;AAAA,IACvC;AACA,QAAI,QAAQ,SAAS,GAAG;AACtB,cAAQ;AAAA,QACN,KAAK,EAAE,IAAI,UAAU,CAAC,IAAI,QAAQ,MAAM;AAAA,MAC1C;AACA,iBAAW,KAAK,QAAQ,MAAM,GAAG,CAAC,GAAG;AACnC,gBAAQ,IAAI,OAAO,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,EAAE,GAAG,EAAE;AAAA,MACpD;AACA,cAAQ,IAAI;AAAA,IACd;AACA,QAAI,MAAM,SAAS,GAAG;AACpB,cAAQ;AAAA,QACN,KAAK,EAAE,OAAO,wBAAwB,CAAC,IAAI,MAAM,MAAM;AAAA,MACzD;AACA,iBAAW,KAAK,MAAM,MAAM,GAAG,CAAC,GAAG;AACjC,gBAAQ;AAAA,UACN,OAAO,EAAE,OAAO,QAAQ,OAAO,CAAC,IAAI,EAAE,GAAG,IAAI,EAAE,IAAI,IAAI,EAAE,OAAO,aAAa,aAAa,CAAC;AAAA,QAC7F;AAAA,MACF;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,aAAa,QAAQ,OAAO,CAAC,MAAM,EAAE,UAAU,QAAQ;AAC7D,UAAM,kBAAkB,WAAW;AAAA,MAAO,CAAC,MACzC,EAAE,UAAU,KAAK,MAAM;AAAA,QAAK,CAAC,MAC3B,CAAC,WAAW,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC;AAAA,MACjD;AAAA,IACF;AACA,QAAI,gBAAgB,SAAS,GAAG;AAC9B,cAAQ,IAAI,KAAK,EAAE,KAAK,oBAAoB,CAAC,EAAE;AAC/C,cAAQ;AAAA,QACN,OAAO,gBAAgB,MAAM;AAAA,MAC/B;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,UAAM,aAAa,QAAQ;AAAA,MACzB,CAAC,MAAM,CAAC,EAAE,UAAU,KAAK,kBAAkB,CAAC,EAAE,OAAO;AAAA,IACvD;AACA,QAAI,WAAW,SAAS,GAAG;AACzB,cAAQ,IAAI,KAAK,EAAE,KAAK,uBAAuB,CAAC,EAAE;AAClD,cAAQ;AAAA,QACN,OAAO,WAAW,MAAM;AAAA,MAC1B;AACA,cAAQ;AAAA,QACN,WAAW,EAAE,KAAK,mDAAmD,CAAC;AAAA,MACxE;AACA,cAAQ,IAAI;AAAA,IACd;AAEA,YAAQ,IAAI,KAAK,EAAE,KAAK,UAAU,CAAC,EAAE;AACrC,YAAQ,IAAI,sBAAsB,QAAQ,MAAM,EAAE;AAClD,YAAQ,IAAI,eAAe,QAAQ,SAAS,QAAQ,MAAM,EAAE;AAC5D,YAAQ,IAAI,gBAAgB,QAAQ,MAAM,EAAE;AAC5C,YAAQ,IAAI,cAAc,MAAM,MAAM,EAAE;AACxC,YAAQ,IAAI,uBAAuB,cAAc,MAAM,EAAE;AACzD,YAAQ;AAAA,MACN,6BAA6B,QAAQ,SAAS,WAAW,MAAM;AAAA,IACjE;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAIH,EAAAA,SACG,QAAQ,OAAO,EACf,YAAY,iDAAiD,EAC7D;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,EACC,OAAO,iBAAiB,6BAA6B,EACrD,OAAO,iBAAiB,kCAAkC,EAC1D;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,UAAU,wCAAwC,EACzD,OAAO,OAAO,QAAQ;AACrB,UAAM,eAAe,IAAI,cACrB,IAAI,YAAY,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC,IACtD,CAAC,QAAQ,IAAI,CAAC;AAElB,QAAI,IAAI,MAAM;AACZ,YAAM,SAAS,cAAc;AAAA,QAC3B,YAAY,IAAI;AAAA,QAChB;AAAA,QACA,SAAS,IAAI;AAAA,MACf,CAAC;AAED,cAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC3C;AAAA,IACF;AAEA,UAAM,WAAW;AAAA,MACf,iBAAiB,IAAI;AAAA,MACrB,YAAY,IAAI;AAAA,MAChB;AAAA,MACA,SAAS,IAAI;AAAA,IACf,CAAC;AAAA,EACH,CAAC;AACL;;;ACtRO,SAAS,yBAAyBC,UAAwB;AAC/D,EAAAA,SACG,QAAQ,eAAe,EACvB;AAAA,IACC;AAAA,EACF,EACC,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,eAAe,EACvC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,mCAAmC,UAAU,IAAI,EAC3E,OAAO,mBAAmB,8BAA8B,EACxD,OAAO,YAAY,6BAA6B,EAChD,OAAO,UAAU,oBAAoB,EACrC,OAAO,CAAC,KAAa,QAAQ;AAC5B,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,QAAQ,KAAK,SAAS;AAI5B,UAAM,UAAU,gBAAgB,OAAO,IAAI;AAE3C,QAAI,IAAI,MAAM;AACZ,YAAM,YAAY,cAAc;AAChC,UAAI,UAAU,WAAW,GAAG;AAC1B,gBAAQ,IAAI,EAAE,IAAI,uBAAuB,CAAC;AAC1C;AAAA,MACF;AACA,iBAAW,KAAK,WAAW;AACzB,cAAM,SAAS,EAAE,WACb,EAAE,IAAI,UAAU,IAChB,EAAE,QACA,EAAE,MAAM,QAAQ,IAChB,EAAE,IAAI,SAAS;AACrB,cAAM,MAAM,KAAK;AAAA,UACf;AAAA,UACA,KAAK;AAAA,aACF,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI,KAAK,IAAI,KAAK;AAAA,UACnD;AAAA,QACF;AACA,gBAAQ;AAAA,UACN,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,YAAY,EAAE,IAAI,EAAE,MAAM,CAAC,QAAQ,GAAG,gBAAgB,EAAE,SAAS;AAAA,QAC3G;AAAA,MACF;AACA;AAAA,IACF;AAEA,QAAI,IAAI,QAAQ;AACd,YAAM,UAAU,eAAe,KAAK,OAAO,OAAO;AAClD,UAAI,SAAS;AACX,gBAAQ;AAAA,UACN,GAAG,QAAQ,KAAK,IAAI,EAAE,OAAO,SAAS,CAAC,iBAAiB,EAAE,KAAK,GAAG,CAAC;AAAA,QACrE;AAAA,MACF,OAAO;AACL,gBAAQ,IAAI,EAAE,IAAI,kCAAkC,GAAG,EAAE,CAAC;AAAA,MAC5D;AACA;AAAA,IACF;AAEA,UAAM,QAAQ,cAAc,KAAK,OAAO,SAAS,IAAI,KAAK;AAAA,MACxD,QAAQ,IAAI,UAAU;AAAA,IACxB,CAAC;AACD,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,QAAQ,IAAI,GAAG;AAAA,IACvE;AACA,YAAQ;AAAA,MACN,EAAE;AAAA,QACA,QAAQ,MAAM,EAAE,YAAY,MAAM,MAAM,aAAa,MAAM,SAAS;AAAA,MACtE;AAAA,IACF;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,WAAW,EACnB,YAAY,mDAAmD,EAC/D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,YAAY,cAAc;AAChC,QAAI,SAASA,UAAS,KAAK,EAAE,UAAU,CAAC,EAAG;AAC3C,QAAI,UAAU,WAAW,GAAG;AAC1B,cAAQ,IAAI,EAAE,IAAI,sBAAsB,CAAC;AACzC;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,EAAK,QAAQ,IAAI;AAAA,CAAoB,CAAC;AACzD,eAAW,KAAK,WAAW;AACzB,YAAM,SAAS,EAAE,WACb,EAAE,IAAI,GAAG,QAAQ,KAAK,WAAW,IACjC,EAAE,QACA,EAAE,MAAM,GAAG,QAAQ,KAAK,SAAS,IACjC,EAAE,IAAI,GAAG,QAAQ,OAAO,UAAU;AACxC,YAAM,MAAM,KAAK;AAAA,QACf;AAAA,QACA,KAAK,OAAO,IAAI,KAAK,EAAE,SAAS,EAAE,QAAQ,IAAI,KAAK,IAAI,KAAK,GAAI;AAAA,MAClE;AACA,cAAQ,IAAI,KAAK,MAAM,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,EAAE,KAAK,GAAG;AACvD,cAAQ;AAAA,QACN,EAAE,IAAI,UAAU,EAAE,EAAE,YAAY,EAAE,MAAM,SAAS,GAAG,QAAQ,EAAE,SAAS,EAAE;AAAA,MAC3E;AACA,UAAI,EAAE,UAAW,SAAQ,IAAI,EAAE,IAAI,iBAAiB,EAAE,SAAS,EAAE,CAAC;AAAA,IACpE;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,EAAAA,SACG,QAAQ,QAAQ,EAChB,YAAY,wCAAwC,EACpD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,UAAU,iBAAiB;AACjC,QAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,cAAQ,IAAI,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAC5C;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK,+BAA0B,CAAC;AAE9C,QACE,CAAC,QAAQ,gBACT,CAAC,QAAQ,iBACT,CAAC,QAAQ,iBACT;AACA,cAAQ,IAAI,EAAE,IAAI,wCAAwC,CAAC;AAC3D,cAAQ;AAAA,QACN,EAAE,IAAI,2DAA2D;AAAA,MACnE;AACA;AAAA,IACF;AAEA,QAAI,QAAQ,cAAc;AACxB,cAAQ,IAAI,EAAE,KAAK,eAAe,CAAC;AACnC,YAAM,IAAI,QAAQ,QAAQ;AAC1B,UAAI,EAAE;AACJ,gBAAQ,IAAI,EAAE,MAAM,oBAAoB,EAAE,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC;AACpE,UAAI,EAAE;AACJ,gBAAQ,IAAI,EAAE,IAAI,oBAAoB,EAAE,UAAU,KAAK,IAAI,CAAC,EAAE,CAAC;AACjE,UAAI,EAAE;AACJ,gBAAQ;AAAA,UACN,EAAE,MAAM,sBAAsB,EAAE,aAAa,KAAK,IAAI,CAAC,EAAE;AAAA,QAC3D;AACF,UAAI,EAAE;AACJ,gBAAQ,IAAI,EAAE,IAAI,sBAAsB,EAAE,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC;AACpE,UAAI,EAAE;AACJ,gBAAQ,IAAI,EAAE,IAAI,sBAAsB,EAAE,WAAW,KAAK,IAAI,CAAC,EAAE,CAAC;AAAA,IACtE;AAEA,QAAI,QAAQ,eAAe;AACzB,cAAQ,IAAI,EAAE,KAAK,gBAAgB,CAAC;AACpC,YAAM,IAAI,QAAQ,QAAQ;AAC1B,UAAI,EAAE;AACJ,gBAAQ;AAAA,UACN,EAAE,MAAM,0BAA0B,EAAE,cAAc,KAAK,IAAI,CAAC,EAAE;AAAA,QAChE;AACF,UAAI,EAAE;AACJ,gBAAQ;AAAA,UACN,EAAE,IAAI,0BAA0B,EAAE,aAAa,KAAK,IAAI,CAAC,EAAE;AAAA,QAC7D;AACF,UAAI,EAAE;AACJ,gBAAQ,IAAI,0BAA0B,EAAE,iBAAiB,GAAG;AAC9D,UAAI,EAAE,iBAAiB;AACrB,gBAAQ,IAAI,0BAA0B,EAAE,YAAY,EAAE;AAAA,IAC1D;AAEA,QAAI,QAAQ,iBAAiB;AAC3B,cAAQ,IAAI,EAAE,KAAK,4BAA4B,CAAC;AAChD,YAAM,IAAI,QAAQ,QAAQ;AAC1B,UAAI,EAAE;AACJ,gBAAQ;AAAA,UACN,kCAAkC,EAAE,uBAAuB,KAAK,IAAI,CAAC;AAAA,QACvE;AACF,UAAI,EAAE,cAAe,SAAQ,IAAI,gBAAgB,EAAE,aAAa,GAAG;AAAA,IACrE;AAEA,YAAQ,IAAI;AAAA,EACd,CAAC;AACL;;;AC7KA,SAAS,cAAAC,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,QAAAC,OAAM,WAAW,mBAAmB;;;ACQtC,IAAM,aAAa;AAe1B,IAAM,cAAc;AACpB,IAAM,cAAc;AAGb,SAAS,MAAM,OAAwB;AAC5C,SAAO,MAAM,WAAW,UAAU;AACpC;AAOO,SAAS,SAAS,KAAwB;AAC/C,MAAI,CAAC,MAAM,GAAG,GAAG;AACf,UAAM,IAAI,MAAM,8BAA8B,GAAG,GAAG;AAAA,EACtD;AAEA,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,OAAO;AAGV,UAAM,WAAW,2BAA2B,KAAK,GAAG;AACpD,QAAI,YAAY,YAAY,KAAK,SAAS,CAAC,CAAC,KAAK,CAAC,CAAC,UAAU,SAAS,EAAE,SAAS,SAAS,CAAC,CAAC,GAAG;AAC7F,YAAM,IAAI;AAAA,QACR,gBAAgB,GAAG,qGAEA,SAAS,CAAC,CAAC,sCAAsC,SAAS,CAAC,CAAC;AAAA,MACjF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR,gBAAgB,GAAG;AAAA,IACrB;AAAA,EACF;AAEA,QAAM,CAAC,EAAE,UAAU,KAAK,KAAK,IAAI;AAEjC,MAAI,CAAC,YAAY,KAAK,GAAG,GAAG;AAC1B,UAAM,IAAI;AAAA,MACR,gBAAgB,GAAG,OAAO,GAAG;AAAA,IAC/B;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,OAAO;AACT,eAAW,QAAQ,MAAM,MAAM,GAAG,GAAG;AACnC,UAAI,CAAC,KAAM;AACX,YAAM,KAAK,KAAK,QAAQ,GAAG;AAC3B,YAAM,OAAO,OAAO,KAAK,OAAO,KAAK,MAAM,GAAG,EAAE;AAChD,YAAM,QAAQ,OAAO,KAAK,KAAK,mBAAmB,KAAK,MAAM,KAAK,CAAC,CAAC;AACpE,UAAI,SAAS,OAAO;AAClB,cAAM;AAAA,MACR,OAAO;AACL,cAAM,IAAI,MAAM,gBAAgB,GAAG,+BAA+B,IAAI,GAAG;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AAEA,SAAO;AAAA,IACL,OAAO,aAAa,KAAK,SAAa;AAAA,IACtC;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAUO,SAAS,WAAW,KAAgB,OAA0B,CAAC,GAAkB;AACtF,QAAM,SAAqB,IAAI,QAAQ,CAAC,IAAI,KAAK,IAAI,CAAC,WAAW,QAAQ;AAEzE,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,UAAU,IAAI,KAAK;AAAA,MAC/B,GAAG;AAAA,MACH;AAAA,MACA,KAAK,IAAI,OAAO,KAAK;AAAA,IACvB,CAAC;AACD,QAAI,UAAU,KAAM,QAAO;AAAA,EAC7B;AACA,SAAO;AACT;AAeO,SAAS,iBACd,KACA,OAA0B,CAAC,GACX;AAChB,QAAM,WAAmC,CAAC;AAC1C,QAAM,eAAyB,CAAC;AAChC,QAAM,UAA8C,CAAC;AAErD,aAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,GAAG,GAAG;AAC/C,QAAI,CAAC,MAAM,KAAK,GAAG;AACjB,eAAS,IAAI,IAAI;AACjB;AAAA,IACF;AACA,UAAM,MAAM,SAAS,KAAK;AAC1B,UAAM,SAAS,WAAW,KAAK,IAAI;AACnC,QAAI,WAAW,MAAM;AACnB,cAAQ,KAAK,EAAE,MAAM,IAAI,CAAC;AAC1B;AAAA,IACF;AACA,aAAS,IAAI,IAAI;AACjB,iBAAa,KAAK,MAAM;AAAA,EAC1B;AAEA,SAAO,EAAE,UAAU,cAAc,QAAQ;AAC3C;;;ADtGO,SAAS,aAAa,MAA2B;AACtD,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,QAAM,cAA8B;AAAA,IAClC;AAAA,IACA,KAAK,KAAK;AAAA,IACV,QAAQ,KAAK,UAAU;AAAA,IACvB,QAAQ,KAAK;AAAA,EACf;AAEA,QAAM,SAAiC,CAAC;AACxC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,QAAQ,GAAG,GAAG;AAChD,QAAI,MAAM,OAAW,QAAO,CAAC,IAAI;AAAA,EACnC;AAEA,QAAM,WAA0B,CAAC;AACjC,QAAM,kBAA4B,CAAC;AACnC,QAAM,kBAA4B,CAAC;AACnC,QAAM,kBAAkB,oBAAI,IAAY;AAGxC,MAAI,KAAK,gBAAgB,OAAO;AAC9B,UAAM,SAAS,kBAAkB,WAAW;AAC5C,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,QAAQ,WAAW,CAAC,CAAC,GAAG;AAChE,YAAM,QAAQ;AAAA,QACZ,EAAE,KAAK,KAAK,YAAY,GAAG,GAAG;AAAA,QAC9B;AAAA,MACF;AACA,UAAI,UAAU,MAAM;AAClB,YAAI,MAAM,aAAa,MAAO,iBAAgB,KAAK,GAAG;AAAA,iBAC7C,KAAK,OAAQ,iBAAgB,KAAK,GAAG;AAAA,YACzC,iBAAgB,KAAK,GAAG;AAC7B;AAAA,MACF;AACA,aAAO,GAAG,IAAI;AACd,eAAS,KAAK,EAAE,MAAM,KAAK,QAAQ,WAAW,CAAC;AAC/C,UAAI,MAAM,SAAS,EAAG,iBAAgB,IAAI,KAAK;AAAA,IACjD;AAAA,EACF;AAGA,QAAM,WACJ,KAAK,aACJC,YAAWC,MAAK,aAAa,MAAM,CAAC,IAAI,CAACA,MAAK,aAAa,MAAM,CAAC,IAAI,CAAC;AAE1E,aAAW,QAAQ,UAAU;AAC3B,UAAM,OAAO,YAAY,aAAa,IAAI;AAC1C,QAAI,CAACD,YAAW,IAAI,GAAG;AACrB,YAAM,IAAI,MAAM,uBAAuB,IAAI,EAAE;AAAA,IAC/C;AACA,UAAM,SAAS,OAAO,YAAY,YAAYE,cAAa,MAAM,MAAM,CAAC,CAAC;AACzE,UAAM,EAAE,UAAU,cAAc,QAAQ,IAAI,iBAAiB,QAAQ,WAAW;AAEhF,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,QAAQ,GAAG;AACpD,aAAO,IAAI,IAAI;AACf,eAAS,KAAK;AAAA,QACZ;AAAA,QACA,QAAQ,MAAM,OAAO,IAAI,CAAC,IAAI,iBAAiB;AAAA,MACjD,CAAC;AAAA,IACH;AACA,eAAW,SAAS,cAAc;AAChC,UAAI,MAAM,SAAS,EAAG,iBAAgB,IAAI,KAAK;AAAA,IACjD;AAEA,eAAW,KAAK,QAAS,iBAAgB,KAAK,EAAE,IAAI;AAAA,EACtD;AAEA,SAAO;AAAA,IACL,UAAU,SAAS,IAAI,CAAC,MAAM,YAAY,aAAa,CAAC,CAAC;AAAA,IACzD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB,CAAC,GAAG,eAAe;AAAA,EACtC;AACF;AAMA,eAAsB,WAAW,MAAsC;AACrE,QAAM,UAAU,WAAW,KAAK,OAAO;AACvC,oBAAkB,SAAS,KAAK,SAAS,KAAK,MAAM,KAAK,WAAW;AAEpE,QAAM,OAAO,aAAa,IAAI;AAE9B,MAAI,KAAK,gBAAgB,SAAS,GAAG;AACnC,UAAM,IAAI;AAAA,MACR,6BAA6B,KAAK,gBAAgB,KAAK,IAAI,CAAC;AAAA,IAE9D;AAAA,EACF;AAEA,MAAI,QAAQ,cAAc;AACxB,eAAW,OAAO,QAAQ,cAAc;AACtC,aAAO,KAAK,OAAO,GAAG;AAAA,IACxB;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,cAAc;AAAA,IACjC;AAAA,IACA,SAAS,KAAK;AAAA,IACd,MAAM,KAAK;AAAA,IACX,QAAQ,KAAK;AAAA,IACb,iBAAiB,KAAK;AAAA,IACtB,eAAe,KAAK;AAAA,IACpB,aAAa,KAAK;AAAA,EACpB,CAAC;AAED,SAAO,EAAE,GAAG,QAAQ,KAAK;AAC3B;;;AEhKA,SAAS,cAAAC,aAAY,WAAW,gBAAAC,eAAc,iBAAAC,sBAAqB;AACnE,SAAS,eAAe;AACxB,SAAS,SAAS,QAAAC,aAAY;AAIvB,IAAM,UAAoB,CAAC,UAAU,QAAQ,QAAQ;AAG5D,IAAM,kBAAkB;AAAA,EACtB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAqBA,IAAM,cAAc;AAEpB,SAAS,YAAY,QAAyC;AAC5D,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,EAAE,SAAS,aAAa,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE;AAAA,IACnD,KAAK;AACH,aAAO;AAAA,QACL,SAAS;AAAA,QACT,MAAM,CAAC;AAAA,QACP,KAAK,CAAC;AAAA,QACN,UAAU;AAAA,QACV,aAAa;AAAA,MACf;AAAA,IACF,KAAK;AACH,aAAO,EAAE,MAAM,SAAS,SAAS,aAAa,MAAM,CAAC,GAAG,KAAK,CAAC,EAAE;AAAA,EACpE;AACF;AAEO,SAAS,cACd,QACA,QACA,aACQ;AACR,QAAM,OAAO,QAAQ;AACrB,UAAQ,QAAQ;AAAA,IACd,KAAK;AACH,aAAO,SACHA,MAAK,MAAM,WAAW,UAAU,IAChCA,MAAK,aAAa,WAAW,UAAU;AAAA,IAC7C,KAAK;AACH,aAAO,SACHA,MAAK,MAAM,SAAS,YAAY,UAAU,IAC1CA,MAAK,aAAa,SAAS,YAAY,UAAU;AAAA,IACvD,KAAK;AACH,UAAI,QAAQ;AAGV,cAAM,IAAI;AAAA,UACR;AAAA,QAGF;AAAA,MACF;AACA,aAAOA,MAAK,aAAa,WAAW;AAAA,EACxC;AACF;AAEO,SAAS,YAAY,MAAiC;AAC3D,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AACpD,QAAM,aAAa,cAAc,KAAK,QAAQ,KAAK,UAAU,OAAO,WAAW;AAC/E,QAAM,WAAqB,CAAC;AAE5B,MAAI,SAAkC,CAAC;AACvC,MAAIH,YAAW,UAAU,GAAG;AAC1B,UAAM,MAAMC,cAAa,YAAY,MAAM;AAC3C,QAAI;AACF,eAAS,KAAK,MAAM,GAAG;AAAA,IACzB,QAAQ;AACN,YAAM,IAAI;AAAA,QACR,GAAG,UAAU;AAAA,MACf;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAW,OAAO,cAAc,CAAC;AACvC,QAAM,UAAU,YAAY,KAAK,MAAM;AACvC,QAAM,WAAW,QAAQ,WAAW;AAEpC,MAAI;AACJ,MAAI,aAAa,QAAW;AAC1B,aAASD,YAAW,UAAU,IAAI,YAAY;AAC9C,YAAQ,WAAW,IAAI;AAAA,EACzB,WAAW,KAAK,UAAU,QAAQ,MAAM,KAAK,UAAU,OAAO,GAAG;AAC/D,aAAS;AAAA,EACX,WAAW,KAAK,OAAO;AACrB,aAAS;AACT,YAAQ,WAAW,IAAI;AAAA,EACzB,OAAO;AACL,aAAS;AACT,aAAS;AAAA,MACP,gBAAgB,WAAW,6BAA6B,UAAU;AAAA,IACpE;AAAA,EACF;AAEA,SAAO,aAAa;AAEpB,MAAI,WAAW,eAAe,CAAC,KAAK,QAAQ;AAC1C,cAAU,QAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,IAAAE,eAAc,YAAY,KAAK,UAAU,QAAQ,MAAM,CAAC,IAAI,IAAI;AAAA,EAClE;AAEA,SAAO;AAAA,IACL,QAAQ,KAAK;AAAA,IACb;AAAA,IACA,YAAY;AAAA,IACZ;AAAA,IACA,QAAQ,KAAK,UAAU;AAAA,IACvB;AAAA,EACF;AACF;;;ACxIA,SAAS,iBAAiB;AAC1B,SAAS,aAAa,QAAQ,iBAAAE,sBAAqB;AACnD,SAAS,cAAc;AACvB,SAAS,QAAAC,aAAY;AAQd,IAAM,eAA6B;AAAA,EACxC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AA+DA,SAAS,cAAc,KAAa,OAAuB;AACzD,SAAO,GAAG,GAAG,OAAO,KAAK;AAAA;AAC3B;AASA,SAAS,WAAW,KAAa,OAAuB;AACtD,MAAI,CAAC,UAAU,KAAK,KAAK,EAAG,QAAO,GAAG,GAAG,KAAK,KAAK;AAAA;AACnD,MAAI,CAAC,UAAU,KAAK,KAAK,KAAK,CAAC,SAAS,KAAK,KAAK,EAAG,QAAO,GAAG,GAAG,KAAK,KAAK;AAAA;AAC5E,SAAO,GAAG,GAAG,IAAI,KAAK;AAAA;AACxB;AAEA,IAAM,UAA6C;AAAA,EACjD,QAAQ;AAAA,IACN,QAAQ;AAAA,IACR,MAAM,CAAC,KAAK,SAAS,CAAC,CAAC,UAAU,OAAO,KAAK,GAAI,KAAK,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAE,CAAC;AAAA,IACzF,aAAa;AAAA,EACf;AAAA,EACA,QAAQ;AAAA,IACN,QAAQ;AAAA;AAAA,IAER,MAAM,CAAC,KAAK,UACT,KAAK,cAAc,CAAC,YAAY,GAAG,IAAI,CAAC,QAAQ,CAAC,OAAO,OAAO,KAAK,KAAK,SAAS,CAAC;AAAA,IACtF,aAAa;AAAA,EACf;AAAA,EACA,YAAY;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,QAAQ,CAAC,CAAC,UAAU,OAAO,GAAG,CAAC;AAAA,IACtC,aAAa;AAAA,EACf;AAAA,EACA,KAAK;AAAA,IACH,QAAQ;AAAA;AAAA;AAAA,IAGR,MAAM,CAAC,MAAM,SAAS,CAAC,CAAC,WAAW,UAAU,GAAI,KAAK,MAAM,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,CAAE,CAAC;AAAA,IACtF,OAAO;AAAA,IACP,aAAa;AAAA,EACf;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA;AAAA;AAAA,IAGR,MAAM,CAAC,KAAK,SAAS;AAAA,MACnB;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA,GAAI,KAAK,UAAU,CAAC,aAAa,KAAK,OAAO,IAAI,CAAC;AAAA,QAClD,GAAI,KAAK,aAAa,CAAC,iBAAiB,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9D;AAAA,IACF;AAAA,IACA,aAAa;AAAA,EACf;AAAA,EACA,SAAS;AAAA,IACP,QAAQ;AAAA;AAAA;AAAA;AAAA;AAAA,IAKR,MAAM,CAAC,MAAM,MAAM,eAAe;AAAA,MAChC,CAAC,cAAc,cAAc,IAAI,GAAI,KAAK,OAAO,CAAC,UAAU,KAAK,IAAI,IAAI,CAAC,CAAE;AAAA,IAC9E;AAAA,IACA,MAAM;AAAA,IACN,aACE;AAAA,EACJ;AACF;AAEA,SAAS,gBAAgB,QAAyB;AAChD,QAAM,QAAQ,UAAU,QAAQ,CAAC,WAAW,GAAG,EAAE,OAAO,UAAU,OAAO,MAAM,CAAC;AAChF,SAAO,CAAC,MAAM;AAChB;AAMA,SAAS,eAAkB,SAAiB,IAA4B;AACtE,QAAM,MAAM,YAAYC,MAAK,OAAO,GAAG,aAAa,CAAC;AACrD,MAAI;AACF,UAAM,OAAOA,MAAK,KAAK,YAAY;AACnC,IAAAC,eAAc,MAAM,SAAS,EAAE,MAAM,KAAO,MAAM,KAAK,CAAC;AACxD,WAAO,GAAG,IAAI;AAAA,EAChB,UAAE;AACA,WAAO,KAAK,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,EAC9C;AACF;AAGA,SAAS,YAAY,MAA2B;AAC9C,QAAM,QAAQ,KAAK,QAAQ,KAAK,OAAO,KAAK,QAAQ,KAAK;AACzD,SAAO,QAAQ,KAAK,KAAK,MAAM;AACjC;AAGO,SAAS,gBAAgB,MAA6B;AAC3D,MAAI,KAAK,MAAM,OAAQ,QAAO,KAAK;AACnC,QAAM,SAAS,kBAAkB,KAAK,WAAW;AACjD,QAAM,eAAe,OAAO,KAAK,QAAQ,WAAW,CAAC,CAAC;AACtD,MAAI,aAAa,WAAW,GAAG;AAC7B,UAAM,IAAI;AAAA,MACR;AAAA,IAEF;AAAA,EACF;AACA,SAAO;AACT;AAEO,SAAS,YAAY,MAA+B;AACzD,QAAM,SAAS,QAAQ,KAAK,MAAM;AAClC,QAAM,OAAO,gBAAgB,IAAI;AAEjC,MAAI,CAAC,KAAK,UAAU,CAAC,gBAAgB,OAAO,MAAM,GAAG;AACnD,UAAM,IAAI,MAAM,IAAI,OAAO,MAAM,0BAAqB,OAAO,WAAW,EAAE;AAAA,EAC5E;AAEA,QAAM,SAAqB,EAAE,QAAQ,KAAK,QAAQ,QAAQ,CAAC,GAAG,QAAQ,CAAC,GAAG,SAAS,CAAC,EAAE;AAEtF,aAAW,OAAO,MAAM;AACtB,UAAM,SAAS,KAAK,eAAe,GAAG;AACtC,UAAM,QACJ,WAAW,SACP,SACA;AAAA,MACE,EAAE,KAAK,KAAK,QAAQ,GAAG,GAAG;AAAA,MAC1B;AAAA,QACE,aAAa,KAAK;AAAA,QAClB,KAAK,KAAK;AAAA,QACV,QAAQ,KAAK,UAAU;AAAA,QACvB,QAAQ,KAAK;AAAA,MACf;AAAA,IACF;AACN,QAAI,UAAU,MAAM;AAClB,aAAO,QAAQ,KAAK,GAAG;AACvB;AAAA,IACF;AAEA,QAAI,KAAK,QAAQ;AACf,aAAO,OAAO,KAAK,GAAG;AACtB;AAAA,IACF;AAGA,UAAM,QAAQ,OAAO,OAAO,KAAM,OAAO,QAAQ,KAAK,KAAK,KAAK;AAChE,UAAM,SAAS,CAAC,eAAuC;AACrD,iBAAW,QAAQ,OAAO,KAAK,KAAK,MAAM,UAAU,GAAG;AACrD,cAAM,QAAQ,UAAU,OAAO,QAAQ,MAAM;AAAA,UAC3C;AAAA,UACA,KAAK,KAAK;AAAA,UACV,UAAU;AAAA,UACV,OAAO;AAAA,QACT,CAAC;AACD,YAAI,MAAM,WAAW,GAAG;AACtB,iBAAO,MAAM,QAAQ,KAAK,KAAK,MAAM,OAAO,WAAW,QAAQ,MAAM,MAAM;AAAA,QAC7E;AAAA,MACF;AACA,aAAO;AAAA,IACT;AACA,UAAM,mBAAmB,OAAO,OAC5B,eAAe,OAAO,KAAK,KAAK,KAAK,GAAG,MAAM,IAC9C,OAAO;AAEX,QAAI,kBAAkB;AACpB,aAAO,OAAO,KAAK,EAAE,KAAK,OAAO,iBAAiB,CAAC;AACnD;AAAA,IACF;AAEA,WAAO,OAAO,KAAK,GAAG;AACtB,QAAI,CAAC,KAAK,QAAQ;AAChB,eAAS;AAAA,QACP,QAAQ;AAAA,QACR;AAAA,QACA,KAAK,KAAK;AAAA,QACV,QAAQ,KAAK,UAAU;AAAA,QACvB,QAAQ,GAAG,KAAK,YAAY,SAAS,GAAG,IAAI,uBAAuB,EAAE,aAAa,KAAK,MAAM,GAAG,YAAY,IAAI,CAAC;AAAA,MACnH,CAAC;AAAA,IACH;AAAA,EACF;AAEA,SAAO;AACT;;;ACrRO,SAAS,uBAAuBC,UAAwB;AAC7D,EAAAA,SACG,QAAQ,kBAAkB,EAC1B;AAAA,IACC;AAAA,EACF,EACC,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,qBAAqB,EAC/C,OAAO,yBAAyB,oDAAoD,EACpF,OAAO,iBAAiB,iCAAiC,EACzD,OAAO,oBAAoB,4CAA4C,EACvE,OAAO,YAAY,8CAA8C,EACjE,OAAO,aAAa,6CAA6C,EACjE,OAAO,OAAO,aAAuB,QAAQ;AAC5C,UAAM,OAAmB;AAAA,MACvB,SAAS,YAAY,CAAC;AAAA,MACtB,MAAM,YAAY,MAAM,CAAC;AAAA,MACzB,aAAa,IAAI,eAAe,QAAQ,IAAI;AAAA,MAC5C,KAAK,IAAI;AAAA,MACT,UAAU,IAAI;AAAA,MACd,aAAa,IAAI,aAAa;AAAA,MAC9B,SAAS,IAAI;AAAA,MACb,QAAQ,IAAI,WAAW;AAAA,MACvB,QAAQ;AAAA,IACV;AAEA,QAAI;AACF,UAAI,IAAI,QAAQ;AACd,cAAMC,QAAO,aAAa,EAAE,GAAG,MAAM,QAAQ,KAAK,CAAC;AACnD,gBAAQ,IAAI;AAAA,EAAK,QAAQ,GAAG,IAAI,EAAE,KAAK,WAAW,CAAC,IAAI,EAAE,IAAI,WAAW,CAAC,EAAE;AAC3E,YAAIA,MAAK,SAAS,SAAS,GAAG;AAC5B,kBAAQ,IAAI,gBAAgBA,MAAK,SAAS,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,QAC9E;AACA,mBAAW,KAAKA,MAAK,UAAU;AAC7B,kBAAQ,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,IAAI,EAAE,MAAM,GAAG,CAAC,EAAE;AAAA,QAC/E;AACA,mBAAW,QAAQA,MAAK,iBAAiB;AACvC,kBAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,qBAAqB,CAAC,EAAE;AAAA,QAC1E;AACA,mBAAW,QAAQA,MAAK,iBAAiB;AACvC,kBAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,IAAI,IAAI,EAAE,IAAI,qBAAqB,CAAC,EAAE;AAAA,QACjF;AACA,gBAAQ,KAAKA,MAAK,gBAAgB,SAAS,IAAI,IAAI,CAAC;AAAA,MACtD;AAEA,YAAM,EAAE,MAAM,KAAK,IAAI,MAAM,WAAW,IAAI;AAC5C,UAAI,KAAK,gBAAgB,SAAS,GAAG;AACnC,gBAAQ;AAAA,UACN,EAAE;AAAA,YACA,GAAG,QAAQ,OAAO,gCAAgC,KAAK,gBAAgB,KAAK,IAAI,CAAC;AAAA,UACnF;AAAA,QACF;AAAA,MACF;AACA,cAAQ,KAAK,IAAI;AAAA,IACnB,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,gBAAgB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QAClF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,EAAAD,SACG,QAAQ,eAAe,EACvB;AAAA,IACC,mEAAmE,aAAa,KAAK,IAAI,CAAC;AAAA,EAC5F,EACC,OAAO,qBAAqB,uDAAuD,EACnF,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,mBAAmB,gDAAgD,EAC1E,OAAO,uBAAuB,mCAAmC,EACjE;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,gBAAgB,uDAAuD,EAC9E,OAAO,oBAAoB,sEAAsE,EACjG;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,eAAe,gEAAgE,EACtF,OAAO,aAAa,2CAA2C,EAC/D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,WAAmB,QAAQ;AAClC,QAAI,CAAC,aAAa,SAAS,SAAuB,GAAG;AACnD,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,oBAAoB,SAAS,6BAAwB,aAAa,KAAK,IAAI,CAAC,EAAE;AAAA,MACtG;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI;AACF,YAAM,SAAS,YAAY;AAAA,QACzB,QAAQ;AAAA,QACR,MAAM,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,QACtD,aAAa,IAAI,eAAe,QAAQ,IAAI;AAAA,QAC5C,KAAK,IAAI;AAAA,QACT,MAAM,IAAI;AAAA,QACV,YAAY,IAAI,WAAW,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,QACjE,KAAK,IAAI;AAAA,QACT,SAAS,IAAI;AAAA,QACb,YAAY,IAAI;AAAA,QAChB,MAAM,IAAI;AAAA,QACV,QAAQ,IAAI,WAAW;AAAA,QACvB,QAAQ;AAAA,MACV,CAAC;AAED,UAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,gBAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC3C,gBAAQ,KAAK,OAAO,OAAO,SAAS,IAAI,IAAI,CAAC;AAAA,MAC/C;AAEA,YAAM,SAAS,IAAI,SAAS,EAAE,IAAI,YAAY,IAAI;AAClD,cAAQ,IAAI;AAAA,EAAK,QAAQ,IAAI,IAAI,MAAM,GAAG,EAAE,KAAK,cAAc,SAAS,EAAE,CAAC,EAAE;AAC7E,iBAAW,OAAO,OAAO,QAAQ;AAC/B,gBAAQ,IAAI,KAAK,EAAE,MAAM,QAAQ,KAAK,CAAC,IAAI,GAAG,EAAE;AAAA,MAClD;AACA,iBAAW,OAAO,OAAO,SAAS;AAChC,gBAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,iCAA4B,CAAC,EAAE;AAAA,MAChF;AACA,iBAAW,EAAE,KAAK,MAAM,KAAK,OAAO,QAAQ;AAC1C,gBAAQ,IAAI,KAAK,EAAE,IAAI,QAAQ,KAAK,CAAC,IAAI,GAAG,IAAI,EAAE,IAAI,UAAK,KAAK,EAAE,CAAC,EAAE;AAAA,MACvE;AACA,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,KAAK,OAAO,OAAO,MAAM,UAAU,IAAI,SAAS,eAAe,EAAE,KAAK,OAAO,QAAQ,MAAM,aAAa,OAAO,OAAO,MAAM;AAAA,QAC9H;AAAA,MACF;AACA,cAAQ,KAAK,OAAO,OAAO,SAAS,IAAI,IAAI,CAAC;AAAA,IAC/C,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACnF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,EAAAA,SACG,QAAQ,gBAAgB,EACxB;AAAA,IACC,2DAA2D,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC/E,EACC,OAAO,gBAAgB,sDAAsD,EAC7E,OAAO,yBAAyB,uBAAuB,EACvD,OAAO,WAAW,+CAA+C,EACjE,OAAO,aAAa,wCAAwC,EAC5D,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAgB,QAAQ;AAC/B,QAAI,CAAC,QAAQ,SAAS,MAAgB,GAAG;AACvC,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,oBAAoB,MAAM,6BAAwB,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,MAC9F;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,QAAI;AACF,YAAM,SAAS,YAAY;AAAA,QACzB;AAAA,QACA,QAAQ,IAAI,WAAW;AAAA,QACvB,aAAa,IAAI,eAAe,QAAQ,IAAI;AAAA,QAC5C,OAAO,IAAI,UAAU;AAAA,QACrB,QAAQ,IAAI,WAAW;AAAA,MACzB,CAAC;AAED,UAAI,gBAAgBA,UAAS,GAAG,GAAG;AACjC,gBAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAC3C;AAAA,MACF;AAEA,YAAM,OACJ,OAAO,WAAW,YAAY,YAC9B,OAAO,WAAW,YAAY,YAAY;AAC5C,YAAM,SAAS,OAAO,SAAS,EAAE,IAAI,YAAY,IAAI;AACrD,cAAQ;AAAA,QACN;AAAA,EAAK,QAAQ,KAAK,IAAI,MAAM,GAAG,EAAE,KAAK,IAAI,CAAC,KAAK,EAAE,KAAK,OAAO,UAAU,CAAC,IAAI,EAAE,IAAI,YAAY,OAAO,UAAU,IAAI,CAAC;AAAA,MACvH;AACA,iBAAW,WAAW,OAAO,UAAU;AACrC,gBAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,CAAC,IAAI,OAAO,EAAE;AAAA,MAC7C;AACA,UAAI,OAAO,WAAW,aAAa;AACjC,gBAAQ,IAAI,EAAE,IAAI,aAAa,MAAM,uDAAuD,CAAC;AAAA,MAC/F;AAAA,IACF,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,kBAAkB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACpF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AACL;;;AC7LA,SAAS,aAAAE,kBAAiB;AAmB1B,IAAM,QAAQ;AACd,IAAM,YAAY;AAClB,IAAM,SAAS,QAAQ;AACvB,IAAM,UAAU,QAAQ;AACxB,IAAM,SAAS;AAEf,SAAS,KAAK,SAAiB,QAAwB;AACrD,MAAI,MAAM;AACV,WAAS,IAAI,GAAG,IAAI,QAAQ,IAAK,QAAO,QAAQC,WAAU,QAAQ,MAAM,CAAC;AACzE,SAAO;AACT;AAQA,SAAS,oBAAoB,UAAsC;AACjE,SAAO,MAAM;AACX,aAAS,UAAU,GAAG,UAAU,IAAI,WAAW;AAC7C,YAAM,QAAQ,SAAS;AACvB,UAAI,CAAC,mBAAmB,KAAK,EAAG,QAAO;AAAA,IACzC;AACA,UAAM,IAAI,MAAM,yDAAyD;AAAA,EAC3E;AACF;AASO,IAAM,iBAA+C;AAAA,EAC1D,KAAK;AAAA,IACH,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,OAAO,KAAK,WAAW,EAAE,CAAC,EAAE;AAAA,EAClE;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,KAAK,QAAQ,EAAE,CAAC;AAAA,EACtD;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,OAAO,KAAK,OAAO,EAAE,CAAC,EAAE;AAAA,EAC9D;AAAA,EACA,cAAc;AAAA,IACZ,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,cAAc,KAAK,OAAO,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,EAAE;AAAA,EACxF;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,MAAM,KAAK,OAAO,EAAE,CAAC,EAAE;AAAA,EAC7D;AAAA,EACA,kBAAkB;AAAA,IAChB,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,WAAW,KAAK,SAAS,EAAE,CAAC,WAAW,KAAK,SAAS,EAAE,CAAC,EAAE;AAAA,EAChG;AAAA,EACA,WAAW;AAAA,IACT,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,gBAAgB,KAAK,SAAS,EAAE,CAAC,IAAI;AAAA,EAC3E;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,WAAW,KAAK,OAAO,EAAE,CAAC,EAAE;AAAA,EAClE;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,SAAS,KAAK,SAAS,EAAE,CAAC,EAAE;AAAA,EAClE;AAAA,EACA,OAAO;AAAA,IACL,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,QAAQ,KAAK,QAAQ,EAAE,CAAC,IAAI,KAAK,QAAQ,EAAE,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC,EAAE;AAAA,EACvG;AAAA,EACA,QAAQ;AAAA,IACN,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,OAAO,KAAK,SAAS,EAAE,CAAC,EAAE;AAAA,EAChE;AAAA,EACA,KAAK;AAAA,IACH,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,OAAO,KAAK,OAAO,EAAE,CAAC,EAAE;AAAA,EAC9D;AAAA,EACA,SAAS;AAAA,IACP,MAAM;AAAA,IACN,aAAa;AAAA,IACb,UAAU,oBAAoB,MAAM,eAAe,EAAE,QAAQ,WAAW,QAAQ,OAAO,QAAQ,GAAG,CAAC,CAAC;AAAA,EACtG;AACF;AAEO,IAAM,wBAAwB;AAgC9B,SAAS,YAAY,KAAa,OAAqB,CAAC,GAAgB;AAC7E,QAAM,aAAa,KAAK,UAAU;AAClC,QAAM,SAAS,eAAe,UAAU;AACxC,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR,0BAA0B,UAAU,iBAAiB,OAAO,KAAK,cAAc,EAAE,KAAK,IAAI,CAAC;AAAA,IAC7F;AAAA,EACF;AAEA,QAAM,QAAQ,KAAK,SAAS,OAAO,SAAS;AAC5C,QAAM,QAAQ,KAAK,SAAS;AAI5B,QAAM,WAAW,YAAY,KAAK,EAAE,GAAG,MAAM,MAAM,CAAC;AACpD,MAAI,YAAY,CAAC,SAAS,SAAS,KAAK,UAAU,CAAC,KAAK,OAAO;AAC7D,UAAM,IAAI;AAAA,MACR,IAAI,GAAG,oCAAoC,KAAK;AAAA,IAClD;AAAA,EACF;AACA,YAAU,KAAK,OAAO;AAAA,IACpB,GAAG;AAAA,IACH;AAAA,IACA,QAAQ;AAAA,IACR,cAAc;AAAA,IACd,aAAa,KAAK;AAAA,EACpB,CAAC;AAED,SAAO,EAAE,KAAK,OAAO,QAAQ,YAAY,MAAM;AACjD;AAiBO,SAASC,cAAa,KAAa,OAAuB,CAAC,GAAY;AAC5E,QAAM,QAAQ,YAAY,KAAK,IAAI;AACnC,MAAI,CAAC,OAAO;AACV,UAAM,IAAI,MAAM,IAAI,GAAG,qCAAqC;AAAA,EAC9D;AACA,SAAO,aAAgB,KAAK,EAAE,GAAG,MAAM,OAAO,MAAM,MAAM,CAAC;AAC7D;AAGO,SAAS,aAAa,OAAuB,CAAC,GAAmB;AACtE,QAAM,MAAsB,CAAC;AAC7B,aAAW,SAAS,YAAY,EAAE,GAAG,MAAM,QAAQ,KAAK,CAAC,GAAG;AAC1D,UAAM,OAAO,MAAM,UAAU;AAC7B,QAAI,CAAC,MAAM,OAAQ;AACnB,QAAI,KAAK;AAAA,MACP,KAAK,MAAM;AAAA,MACX,OAAO,MAAM;AAAA,MACb,QAAQ,KAAK;AAAA,MACb,WAAW,KAAK;AAAA,MAChB,WAAW,KAAK;AAAA,MAChB,eAAe,KAAK;AAAA,IACtB,CAAC;AAAA,EACH;AACA,SAAO;AACT;;;ACxNO,SAAS,uBAAuBC,UAAwB;AAC7D,QAAM,SAASA,SACZ,QAAQ,QAAQ,EAChB,YAAY,kEAA6D;AAE5E,SACG,QAAQ,aAAa,EACrB,YAAY,sDAAsD,EAClE;AAAA,IACC;AAAA,IACA,2BAA2B,OAAO,KAAK,cAAc,EAAE,KAAK,IAAI,CAAC;AAAA,IACjE;AAAA,EACF,EACC,OAAO,mBAAmB,kDAAkD,EAC5E,OAAO,wBAAwB,oDAA+C,EAC9E,OAAO,WAAW,qDAAqD,EACvE;AAAA,IACC;AAAA,IACA,yDAAyD,aAAa,KAAK,IAAI,CAAC;AAAA,EAClF,EACC,OAAO,uBAAuB,wCAAwC,EACtE,OAAO,uBAAuB,0DAA0D,EACxF,OAAO,UAAU,iCAAiC,EAClD,OAAO,gBAAgB,wBAAwB,EAC/C,OAAO,iBAAiB,eAAe,EACvC,OAAO,eAAe,YAAY,EAClC,OAAO,cAAc,WAAW,EAChC,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,CAAC,KAAa,QAAQ;AAC5B,UAAM,aAAa,IAAI;AACvB,QAAI,cAAc,CAAC,aAAa,SAAS,UAAwB,GAAG;AAClE,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,yBAAyB,UAAU,6BAAwB,aAAa,KAAK,IAAI,CAAC;AAAA,QACpG;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAEA,UAAM,OAAO,UAAU,GAAG;AAC1B,UAAM,SAAS,YAAY,KAAK;AAAA,MAC9B,GAAG;AAAA,MACH,QAAQ,IAAI;AAAA,MACZ,OAAO,IAAI;AAAA,MACX,aAAa,IAAI;AAAA,MACjB,OAAO,IAAI,UAAU;AAAA,IACvB,CAAC;AAGD,UAAM,OAAO,aACT,YAAY;AAAA,MACV,QAAQ;AAAA,MACR,MAAM,CAAC,GAAG;AAAA,MACV,cAAc,EAAE,CAAC,GAAG,GAAG,OAAO,MAAM;AAAA,MACpC,YAAY,CAAC,GAAG;AAAA,MAChB,aAAa,KAAK,eAAe,QAAQ,IAAI;AAAA,MAC7C,MAAM,IAAI;AAAA,MACV,YAAY,IAAI,WAAW,MAAM,GAAG,EAAE,IAAI,CAAC,MAAc,EAAE,KAAK,CAAC;AAAA,MACjE,QAAQ;AAAA,IACV,CAAC,IACD;AAEJ,QAAI,SAASA,UAAS,KAAK,EAAE,GAAG,QAAQ,KAAK,CAAC,GAAG;AAC/C,UAAI,QAAQ,KAAK,OAAO,SAAS,EAAG,SAAQ,KAAK,CAAC;AAClD;AAAA,IACF;AAEA,YAAQ;AAAA,MACN,GAAG,QAAQ,OAAO,IAAI,EAAE,OAAO,gBAAgB,CAAC,IAAI,EAAE,KAAK,OAAO,GAAG,CAAC,IAAI,EAAE,IAAI,IAAI,OAAO,MAAM,KAAK,OAAO,KAAK,SAAS,CAAC;AAAA,IAC9H;AACA,YAAQ,IAAI,EAAE,IAAI,YAAY,OAAO,KAAK,EAAE,CAAC;AAC7C,YAAQ;AAAA,MACN,EAAE,IAAI,mFAAmF;AAAA,IAC3F;AACA,YAAQ,IAAI,EAAE,IAAI,wEAAqE,CAAC;AACxF,QAAI,MAAM;AACR,UAAI,KAAK,OAAO,SAAS,GAAG;AAC1B,gBAAQ;AAAA,UACN,GAAG,QAAQ,IAAI,IAAI,EAAE,OAAO,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,MAAM,KAAK,MAAM,GAAG,IAAI,OAAO,KAAK,IAAI,IAAI,MAAM,EAAE,EAAE,CAAC;AAAA,QACvH;AACA,gBAAQ;AAAA,UACN,EAAE;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AACA,iBAAW,EAAE,MAAM,KAAK,KAAK,QAAQ;AACnC,gBAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,YAAY,KAAK,MAAM,kBAAa,KAAK,EAAE,CAAC;AAAA,MAClF;AACA,UAAI,KAAK,OAAO,SAAS,EAAG,SAAQ,KAAK,CAAC;AAAA,IAC5C;AAAA,EACF,CAAC;AAEH,SACG,QAAQ,cAAc,EACtB,YAAY,iEAAiE,EAC7E,OAAO,gBAAgB,cAAc,EACrC,OAAO,iBAAiB,eAAe,EACvC,OAAO,eAAe,YAAY,EAClC,OAAO,cAAc,WAAW,EAChC,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,CAAC,KAAa,QAAQ;AAC5B,QAAIC,cAAa,KAAK,UAAU,GAAG,CAAC,GAAG;AACrC,cAAQ;AAAA,QACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC,IAAI,EAAE,KAAK,GAAG,CAAC,IAAI,EAAE,IAAI,sFAAiF,CAAC;AAAA,MACpJ;AAAA,IACF,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,KAAK,GAAG,mBAAmB,CAAC;AAChE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,SACG,QAAQ,MAAM,EACd,MAAM,IAAI,EACV,YAAY,6CAA6C,EACzD,OAAO,UAAU,gBAAgB,EACjC,OAAO,gBAAgB,mBAAmB,EAC1C,OAAO,iBAAiB,oBAAoB,EAC5C,OAAO,eAAe,YAAY,EAClC,OAAO,cAAc,WAAW,EAChC,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,CAAC,QAAQ;AACf,UAAM,WAAW,aAAa,UAAU,GAAG,CAAC;AAC5C,QAAI,SAASD,UAAS,KAAK,EAAE,SAAS,CAAC,EAAG;AAE1C,QAAI,SAAS,WAAW,GAAG;AACzB,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,cAAc,SAAS,MAAM;AAAA,CAAK,CAAC;AACxE,eAAW,SAAS,UAAU;AAC5B,YAAM,QAAQ,CAAC,EAAE,KAAK,MAAM,GAAG,CAAC;AAChC,YAAM,KAAK,EAAE,IAAI,GAAG,MAAM,UAAU,SAAS,SAAM,MAAM,KAAK,EAAE,CAAC;AACjE,UAAI,MAAM,YAAY,GAAG;AACvB,cAAM,KAAK,EAAE,IAAI,UAAU,MAAM,SAAS,EAAE,CAAC;AAC7C,YAAI,MAAM,eAAe;AACvB,gBAAM,KAAK,EAAE,IAAI,SAAS,MAAM,aAAa,EAAE,CAAC;AAAA,QAClD;AAAA,MACF,OAAO;AACL,cAAM,KAAK,EAAE,MAAM,UAAU,CAAC;AAAA,MAChC;AACA,cAAQ,IAAI,KAAK,QAAQ,GAAG,IAAI,MAAM,KAAK,IAAI,CAAC,EAAE;AAAA,IACpD;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,QAAM,QAAQ,OACX,QAAQ,OAAO,EACf,YAAY,iFAAiF;AAEhG,QACG,QAAQ,KAAK,EACb,YAAY,6CAA6C,EACzD,OAAO,mBAAmB,qBAAqB,EAC/C,OAAO,iBAAiB,4BAA4B,EACpD,OAAO,gBAAgB,gDAAgD,EACvE,OAAO,eAAe,8CAAyC,EAC/D,OAAO,wBAAwB,sBAAsB,EACrD,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,SAAkD;AAAA,MACtD,CAAC,WAAW,IAAI,OAAO;AAAA,MACvB,CAAC,SAAS,IAAI,KAAK;AAAA,MACnB,CAAC,QAAQ,IAAI,IAAI;AAAA,MACjB,CAAC,WAAW,IAAI,GAAG;AAAA,IACrB;AACA,UAAM,SAAS,OAAO,OAAO,CAAC,CAAC,EAAEE,IAAG,MAAM,OAAOA,SAAQ,QAAQ;AACjE,QAAI,OAAO,WAAW,GAAG;AACvB,cAAQ;AAAA,QACN,EAAE,IAAI,GAAG,QAAQ,KAAK,8DAA8D;AAAA,MACtF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,UAAM,CAAC,MAAM,GAAG,IAAI,OAAO,CAAC;AAC5B,UAAM,UAAU,eAAe,EAAE,MAAM,KAAW,aAAa,IAAI,YAAY,CAAC;AAChF,QAAI,SAASF,UAAS,KAAK,OAAO,EAAG;AACrC,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,YAAY,CAAC,iBAAiB,EAAE,KAAK,QAAQ,EAAE,CAAC,KAAK,IAAI,KAAK,EAAE,IAAI,iBAAiB,QAAQ,GAAG,CAAC,CAAC;AAAA,IAChI;AACA,YAAQ,IAAI,EAAE,IAAI,2CAA2C,QAAQ,EAAE,EAAE,CAAC;AAAA,EAC5E,CAAC;AAEH,QACG,QAAQ,MAAM,EACd,MAAM,IAAI,EACV,YAAY,4BAA4B,EACxC,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,WAAW,iBAAiB;AAClC,QAAI,SAASA,UAAS,KAAK,EAAE,SAAS,CAAC,EAAG;AAC1C,QAAI,SAAS,WAAW,GAAG;AACzB,cAAQ;AAAA,QACN,EAAE,IAAI,4EAA4E;AAAA,MACpF;AACA;AAAA,IACF;AACA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,GAAG,2BAA2B,SAAS,MAAM;AAAA,CAAK,CAAC;AACrF,eAAW,MAAM,UAAU;AACzB,YAAM,QAAQ,GAAG,UAAU,EAAE,MAAM,SAAS,IAAI,EAAE,IAAI,UAAU;AAChE,YAAM,OAAO,GAAG,cAAc,EAAE,IAAI,WAAM,GAAG,WAAW,EAAE,IAAI;AAC9D,cAAQ;AAAA,QACN,KAAK,EAAE,KAAK,GAAG,EAAE,CAAC,KAAK,GAAG,KAAK,OAAO,CAAC,CAAC,IAAI,KAAK,KAAK,EAAE,IAAI,iBAAiB,GAAG,GAAG,CAAC,CAAC,GAAG,IAAI;AAAA,MAC9F;AAAA,IACF;AACA,YAAQ,IAAI;AAAA,EACd,CAAC;AAEH,QACG,QAAQ,aAAa,EACrB,MAAM,IAAI,EACV,YAAY,yBAAyB,EACrC,OAAO,CAAC,OAAe;AACtB,QAAI,kBAAkB,EAAE,GAAG;AACzB,cAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,IACjF,OAAO;AACL,cAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,8BAA8B,EAAE,GAAG,CAAC;AACxE,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,aAAW,CAAC,MAAMG,QAAO,KAAK;AAAA,IAC5B,CAAC,UAAU,IAAI;AAAA,IACf,CAAC,WAAW,KAAK;AAAA,EACnB,GAAY;AACV,UACG,QAAQ,GAAG,IAAI,OAAO,EACtB,YAAY,GAAG,SAAS,WAAW,WAAW,SAAS,mBAAmB,EAC1E,OAAO,CAAC,OAAe;AACtB,UAAI,sBAAsB,IAAIA,QAAO,GAAG;AACtC,gBAAQ,IAAI,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,CAAC,iBAAiB,EAAE,KAAK,EAAE,CAAC,EAAE;AAAA,MAClF,OAAO;AACL,gBAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,8BAA8B,EAAE,GAAG,CAAC;AACxE,gBAAQ,KAAK,CAAC;AAAA,MAChB;AAAA,IACF,CAAC;AAAA,EACL;AAEA,QACG,QAAQ,WAAW,EACnB,YAAY,2EAA2E,EACvF,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,IAAwB,QAAQ;AAC7C,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,QACE,KAAK;AAAA,QACL,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,OAAO;AAAA,QACP,QAAQ;AAAA,QACR,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,QAClC,MAAM;AAAA,MACR;AAAA,MACA;AAAA,IACF;AACA,QAAI,SAASH,UAAS,KAAK,EAAE,QAAQ,CAAC,EAAG;AACzC,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ,IAAI,EAAE,IAAI,KAAK,uBAAuB,EAAE,MAAM,2BAA2B,CAAC;AAClF,cAAQ,KAAK,CAAC;AAAA,IAChB;AACA,eAAW,KAAK,SAAS;AACvB,YAAM,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,KAAK,IAAI,EAAE,IAAI,QAAQ,KAAK;AACrE,cAAQ,IAAI,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,SAAS,CAAC,IAAI,EAAE,IAAI,IAAI,EAAE,IAAI,EAAE,OAAO,CAAC,EAAE;AAAA,IAC9E;AACA,QAAI,QAAQ,KAAK,CAAC,MAAM,CAAC,EAAE,OAAO,EAAG,SAAQ,KAAK,CAAC;AAAA,EACrD,CAAC;AACL;;;ACjQA,SAAS,kBAAkB;AAC3B,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,cAAc;AACvB,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAGK;;;ACvCA,IAAM,WAAW;AACxB,IAAM,aAAa,KAAK;AACxB,IAAM,aAAa;AAWZ,SAAS,oBAAoB,OAAuB,CAAC,GAAa;AACvE,QAAM,SAAS,oBAAI,IAAY;AAC/B,aAAW,SAAS,YAAY,EAAE,GAAG,MAAM,QAAQ,OAAO,QAAQ,KAAK,CAAC,GAAG;AACzE,QAAI,MAAM,YAAY,WAAW,MAAM,QAAQ,EAAE,UAAW;AAC5D,UAAM,QAAQ,UAAU,MAAM,KAAK;AAAA,MACjC,OAAO,MAAM;AAAA,MACb,aAAa,KAAK;AAAA,MAClB,KAAK,KAAK;AAAA,MACV,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV,CAAC;AACD,QAAI,SAAS,MAAM,UAAU,WAAY,QAAO,IAAI,KAAK;AAAA,EAC3D;AAEA,SAAO,CAAC,GAAG,MAAM,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,SAAS,EAAE,MAAM;AACvD;AAEA,SAAS,aAAa,MAAe,OAAuC;AAC1E,MAAI,OAAO,SAAS,SAAU,QAAO,MAAM,IAAI;AAC/C,MAAI,MAAM,QAAQ,IAAI,EAAG,QAAO,KAAK,IAAI,CAAC,MAAM,aAAa,GAAG,KAAK,CAAC;AACtE,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,UAAM,MAA+B,CAAC;AACtC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAEpE,UAAI,CAAC,IAAI,MAAM,UAAU,MAAM,SAAS,IAAI,aAAa,GAAG,KAAK;AAAA,IACnE;AACA,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAEO,SAAS,eAAe,OAAuB,CAAC,GAAa;AAClE,MAAI,SAAmB,CAAC;AACxB,MAAI,UAAU;AAEd,QAAM,SAAS,MAAM;AACnB,UAAM,MAAM,KAAK,IAAI;AACrB,QAAI,MAAM,UAAU,WAAY;AAChC,QAAI;AACF,eAAS,oBAAoB,IAAI;AAAA,IACnC,QAAQ;AAAA,IAER;AACA,cAAU;AAAA,EACZ;AAEA,QAAM,OAAO,CAAC,UAA0B;AACtC,WAAO;AACP,QAAI,MAAM;AACV,eAAW,KAAK,QAAQ;AACtB,UAAI,IAAI,SAAS,CAAC,EAAG,OAAM,IAAI,MAAM,CAAC,EAAE,KAAK,QAAQ;AAAA,IACvD;AACA,WAAO;AAAA,EACT;AAEA,SAAO;AAAA,IACL;AAAA,IACA,QAAQ,CAAI,YAAkB,aAAa,SAAS,IAAI;AAAA,IACxD,YAAY,MAAM;AAChB,gBAAU;AAAA,IACZ;AAAA,EACF;AACF;AAGO,IAAM,gBAA0B;AAAA,EACrC,MAAM,CAAC,MAAM;AAAA,EACb,QAAQ,CAAC,MAAM;AAAA,EACf,YAAY,MAAM;AAAA,EAAC;AACrB;;;ADpBA,IAAM,gCAAgC,KAAK,KAAK;AAEhD,SAAS,sBAA8B;AACrC,QAAM,MAAM,OAAO,QAAQ,IAAI,qBAAqB;AACpD,SAAO,OAAO,SAAS,GAAG,KAAK,MAAM,IAAI,MAAM;AACjD;AAGO,IAAM,sBAAsB;AAC5B,SAAS,oBAAoB,aAA6B;AAC/D,SAAO,eAAe,gBAAgB,WAAW,CAAC;AACpD;AAmCA,IAAM,cAAN,MAAkB;AAAA,EACC,QAAQ,oBAAI,IAAsB;AAAA;AAAA,EAGnD,KAAK,MAAc,OAAsB,MAAM,KAAK,IAAI,GAAY;AAClE,UAAM,cAAc,MAAM,MAAM,aAAa;AAC7C,UAAM,UAAU,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,IAAI,WAAW;AACzE,QAAI,OAAO,UAAU,MAAM,UAAU;AACnC,WAAK,MAAM,IAAI,MAAM,MAAM;AAC3B,aAAO;AAAA,IACT;AACA,WAAO,KAAK,GAAG;AACf,SAAK,MAAM,IAAI,MAAM,MAAM;AAC3B,WAAO;AAAA,EACT;AACF;AAEA,SAAS,SAAS,GAAW,MAAM,KAAa;AAC9C,SAAO,EAAE,SAAS,MAAM,GAAG,EAAE,MAAM,GAAG,GAAG,CAAC,WAAM;AAClD;AAOO,SAAS,oBACd,YACA,SACA,UAA0B,CAAC,GACnB;AACR,QAAM,cAAc,QAAQ,eAAe,QAAQ,IAAI;AACvD,QAAM,WAAW,QAAQ,YAAY;AACrC,QAAM,kBAAkB,oBAAoB,WAAW;AACvD,QAAM,UAAU,IAAI,YAAY;AAEhC,QAAM,iBAAiB,WAAW,iBAAiB;AACnD,QAAM,SAAS,WAAW,sBAAsB,KAAK,CAAC;AACtD,QAAM,OAAO,iBAAiB,GAAG,eAAe,IAAI,sBAAsB;AAI1E,QAAM,eAAmC,CAAC;AAC1C,MAAI,OAAO,MAAO,cAAa,QAAQ,EAAE,aAAa,KAAK;AAC3D,MAAI,OAAO,WAAW;AACpB,iBAAa,YAAY,EAAE,aAAa,MAAM,WAAW,CAAC,CAAC,OAAO,UAAU,UAAU;AAAA,EACxF;AACA,MAAI,OAAO,QAAS,cAAa,UAAU,EAAE,aAAa,KAAK;AAE/D,QAAM,QAAQ,IAAI;AAAA,IAChB,EAAE,MAAM,SAAS,gBAAgB;AAAA,IACjC;AAAA,MACE;AAAA;AAAA;AAAA,MAGA,cAAc,WAAW,gBAAgB;AAAA,IAC3C;AAAA,EACF;AAKA,QAAM,gBAAgB,MAAM;AAC1B,UAAM,OAAO,MAAM,iBAAiB;AACpC,QAAI,KAAM,oBAAmB,GAAG,KAAK,IAAI,IAAI,KAAK,OAAO,EAAE;AAAA,EAC7D;AAEA,QAAM,QAAQ,CAAC,QAAgB,SAAiC,WAC9D,SAAS,EAAE,QAAQ,QAAQ,OAAO,QAAQ,eAAe,QAAQ,cAAc,CAAC;AAElF,QAAM,SAAS,CAAC,UAAkB,WAAmC;AACnE,UAAM,oBAAoB,QAAQ,YAAO,QAAQ,KAAK,KAAK,MAAM,IAAI,aAAa;AAClF,WAAO;AAAA,MACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,2BAA2B,MAAM,GAAG,CAAC;AAAA,MACrE,SAAS;AAAA,IACX;AAAA,EACF;AAOA,QAAM,OAAO,CAAC,aAA4C;AACxD,QAAI;AACF,YAAM,WAAW,oBAAoB,UAAU,WAAW;AAC1D,UAAI,CAAC,SAAS,QAAS,QAAO,OAAO,UAAU,SAAS,UAAU,kBAAkB;AACpF,UACE,yBAAyB,UAAU,WAAW,KAC9C,CAAC,YAAY,UAAU,qBAAqB,eAAe,GAC3D;AACA,eAAO;AAAA,UACL;AAAA,UACA,iBAAiB,QAAQ,8DAAyD,QAAQ;AAAA,QAC5F;AAAA,MACF;AACA,YAAM,QAAQ,iBAAiB,UAAU,WAAW;AACpD,UAAI,SAAS,CAAC,QAAQ,KAAK,UAAU,KAAK,GAAG;AAC3C,eAAO;AAAA,UACL;AAAA,UACA,4BAA4B,QAAQ,MAAM,MAAM,QAAQ,cAAc,MAAM,UAAU;AAAA,QACxF;AAAA,MACF;AACA,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,aAAO,OAAO,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC1E;AAAA,EACF;AAEA,QAAM,cAAc,CAAC,aAA8B;AACjD,QAAI;AACF,aAAO,oBAAoB,UAAU,WAAW,EAAE;AAAA,IACpD,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AAQA,MAAI,OAAO,MAAO,sBAAqB;AACvC,MAAI,OAAO,UAAW,0BAAyB;AAC/C,MAAI,OAAO,QAAS,wBAAuB;AAE3C,SAAO;AAIP,WAAS,uBAA6B;AAGpC,eAAW,uBAAuB,mCAAmC,MAAM;AACzE,WAAK,MAAM,oBAAoB,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACjD,CAAC;AAED,UAAM,kBAAkB,wBAAwB,OAAO,YAAY;AACjE,YAAM,SAAS,MAAM,WAAW,UAAU,QAAQ,MAAM;AAGxD,aAAO,EAAE,GAAG,QAAQ,OAAO,OAAO,MAAM,OAAO,CAAC,MAAM,YAAY,EAAE,IAAI,CAAC,EAAE;AAAA,IAC7E,CAAC;AAED,UAAM,kBAAkB,uBAAuB,OAAO,SAAS,UAAU;AACvE,YAAM,WAAW,QAAQ,OAAO;AAChC,YAAM,UAAU,KAAK,QAAQ;AAC7B,UAAI,QAAS,QAAO;AAEpB,YAAM,cAAc,QAAQ,YAAO,QAAQ,KAAK,EAAE;AAKlD,YAAM,YAAY,QAAQ,OAAO,OAAO;AACxC,YAAM,aACJ,cAAc,SACV,CAAC,aAAqE;AACpE,aAAK,MACF,iBAAiB;AAAA,UAChB,QAAQ;AAAA,UACR,QAAQ,EAAE,GAAG,UAAU,eAAe,UAAU;AAAA,QAClD,CAAC,EACA,MAAM,MAAM;AAAA,QAAC,CAAC;AAAA,MACnB,IACA;AAEN,UAAI;AACF,cAAM,SAAU,MAAM,WAAW,SAAS,QAAQ,QAAQ,QAAW;AAAA,UACnE,QAAQ,MAAM;AAAA,UACd,SAAS,oBAAoB;AAAA,UAC7B,wBAAwB;AAAA,UACxB;AAAA,QACF,CAAC;AACD,eAAO,SAAS,OAAO,MAAM;AAAA,MAC/B,SAAS,KAAK;AAIZ,YAAI,eAAe,SAAU,OAAM;AACnC,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,cAAM,cAAc,QAAQ,aAAa,OAAO,EAAE;AAClD,eAAO;AAAA,UACL,SAAS,CAAC,EAAE,MAAM,QAAQ,MAAM,8BAA8B,OAAO,GAAG,CAAC;AAAA,UACzE,SAAS;AAAA,QACX;AAAA,MACF;AAAA,IACF,CAAC;AAAA,EACH;AAIA,WAAS,2BAAiC;AACxC,eAAW,uBAAuB,uCAAuC,MAAM;AAC7E,WAAK,MAAM,wBAAwB,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACrD,CAAC;AACD,eAAW,uBAAuB,mCAAmC,CAAC,MAAM;AAC1E,WAAK,MAAM,oBAAoB,EAAE,MAAM,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACzD,CAAC;AAED,UAAM;AAAA,MAAkB;AAAA,MAA4B,CAAC,YACnD,WAAW,cAAc,QAAQ,MAAM;AAAA,IACzC;AACA,UAAM;AAAA,MAAkB;AAAA,MAAoC,CAAC,YAC3D,WAAW,sBAAsB,QAAQ,MAAM;AAAA,IACjD;AACA,UAAM,kBAAkB,2BAA2B,OAAO,SAAS,UAAU;AAG3E,YAAM,iBAAiB,SAAS,QAAQ,OAAO,GAAG,CAAC,WAAM,QAAQ,KAAK,EAAE;AACxE,YAAM,SAAS,MAAM,WAAW,aAAa,QAAQ,QAAQ;AAAA,QAC3D,QAAQ,MAAM;AAAA,QACd,SAAS,oBAAoB;AAAA,MAC/B,CAAC;AACD,aAAO,SAAS,OAAO,MAAM;AAAA,IAC/B,CAAC;AACD,QAAI,OAAO,WAAW,WAAW;AAC/B,YAAM;AAAA,QAAkB;AAAA,QAAwB,CAAC,YAC/C,WAAW,kBAAkB,QAAQ,MAAM;AAAA,MAC7C;AACA,YAAM;AAAA,QAAkB;AAAA,QAA0B,CAAC,YACjD,WAAW,oBAAoB,QAAQ,MAAM;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AAIA,WAAS,yBAA+B;AACtC,eAAW,uBAAuB,qCAAqC,MAAM;AAC3E,WAAK,MAAM,sBAAsB,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACnD,CAAC;AACD,UAAM;AAAA,MAAkB;AAAA,MAA0B,CAAC,YACjD,WAAW,YAAY,QAAQ,MAAM;AAAA,IACvC;AACA,UAAM,kBAAkB,wBAAwB,OAAO,SAAS,UAAU;AAExE,YAAM,eAAe,QAAQ,OAAO,IAAI,YAAO,QAAQ,KAAK,EAAE;AAC9D,YAAM,SAAS,MAAM,WAAW,UAAU,QAAQ,QAAQ;AAAA,QACxD,QAAQ,MAAM;AAAA,QACd,SAAS,oBAAoB;AAAA,MAC/B,CAAC;AACD,aAAO,SAAS,OAAO,MAAM;AAAA,IAC/B,CAAC;AAAA,EACH;AACF;AAEA,SAAS,aAAa,KAAmD;AACvE,QAAM,UAAkC,CAAC;AACzC,aAAW,QAAQ,OAAO,CAAC,GAAG;AAC5B,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,OAAO,EAAG,OAAM,IAAI,MAAM,wCAAwC,IAAI,GAAG;AAC7E,YAAQ,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AAAA,EAChE;AACA,SAAO;AACT;AAGA,eAAsB,kBAAkB,MAAoC;AAC1E,QAAM,SAAS,IAAI,OAAO,EAAE,MAAM,kBAAkB,SAAS,gBAAgB,CAAC;AAE9E,MAAI,KAAK,KAAK;AACZ,UAAM,UAAU,aAAa,KAAK,OAAO;AACzC,QAAI,KAAK,YAAY;AAGnB,YAAM,QAAQ,UAAU,KAAK,YAAY,EAAE,aAAa,KAAK,aAAa,QAAQ,MAAM,CAAC;AACzF,UAAI,UAAU,MAAM;AAClB,cAAM,IAAI,MAAM,mBAAmB,KAAK,UAAU,4BAA4B;AAAA,MAChF;AACA,cAAQ,gBAAgB,UAAU,KAAK;AAAA,IACzC;AACA,UAAMI,aAAY,IAAI,8BAA8B,IAAI,IAAI,KAAK,GAAG,GAAG;AAAA,MACrE,aAAa,EAAE,QAAQ;AAAA,IACzB,CAAC;AACD,UAAM,OAAO,QAAQA,UAAS;AAC9B,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,QAAS,OAAM,IAAI,MAAM,sCAAsC;AAEzE,QAAM,MAAM,KAAK,aACZ,OAAO,YAAY,OAAO,QAAQ,QAAQ,GAAG,EAAE,OAAO,CAAC,CAAC,EAAE,CAAC,MAAM,MAAM,MAAS,CAAC,IAIlF;AAEJ,QAAM,YAAY,IAAI,qBAAqB;AAAA,IACzC,SAAS,KAAK;AAAA,IACd,MAAM,KAAK,QAAQ,CAAC;AAAA,IACpB;AAAA,IACA,QAAQ;AAAA,EACV,CAAC;AAED,QAAM,OAAO,QAAQ,SAAS;AAC9B,SAAO;AACT;AAUA,eAAsB,QAAQ,MAAoC;AAChE,QAAM,cAAc,KAAK,eAAe,QAAQ,IAAI;AAGpD,gBAAc,WAAW;AAEzB,QAAM,QAAQ,KAAK,SAAS,KAAK,OAAO,CAAC,KAAK,SAAS,GAAI,KAAK,QAAQ,CAAC,CAAE,EAAE,KAAK,GAAG;AACrF,QAAM,UAAuB,EAAE,OAAO,eAAe,WAAW,EAAE;AAElE,QAAM,aAAa,MAAM,kBAAkB,IAAI;AAC/C,QAAM,iBAAiB,WAAW,iBAAiB;AACnD,QAAM,OAAO,WAAW,sBAAsB,KAAK,CAAC;AACpD,QAAM,WAAY,CAAC,SAAS,aAAa,SAAS,EAAY,OAAO,CAACC,OAAM,KAAKA,EAAC,CAAC;AAEnF,MAAI,SAAS,WAAW,GAAG;AACzB,UAAM,WAAW,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACvC,UAAM,IAAI;AAAA,MACR,mBAAmB,gBAAgB,QAAQ,KAAK;AAAA,IAClD;AAAA,EACF;AAEA,QAAM,SAAS,KAAK,UAAU,mBAAmB,WAAW;AAC5D,QAAM,WAAW,SAAS,eAAe,EAAE,YAAY,CAAC,IAAI;AAC5D,QAAM,UAAU,KAAK,MAAM,kBAAkB,KAAK,aAAa,cAAc;AAE7E,WAAS;AAAA,IACP,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ,4BAA4B,KAAK,SAAS,OAAO,KAAK,SAAS,KAAK,GAAG,CAAC,aAAa,SAAS,aAAa,YAAY;AAAA,IAC/H,eAAe,QAAQ;AAAA,EACzB,CAAC;AACD,UAAQ;AAAA,IACN,4BAA4B,gBAAgB,QAAQ,KAAK,eAAU,OAAO,KAAK,SAAS,KAAK,GAAG,CAAC,qBAAqB,SAAS,aAAa,cAAc,aAAa,QAAQ,cAAc,MAAM,GAAG,CAAC,CAAC;AAAA,EAC1M;AAEA,QAAM,QAAQ,oBAAoB,YAAY,SAAS,EAAE,aAAa,SAAS,CAAC;AAChF,QAAM,YAAY,IAAI,qBAAqB;AAE3C,SAAO,IAAI,QAAgB,CAAC,YAAY;AACtC,QAAI,UAAU;AACd,UAAM,SAAS,CAAC,MAAc,WAAmB;AAC/C,UAAI,QAAS;AACb,gBAAU;AACV,eAAS;AAAA,QACP,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,QAAQ,0BAA0B,MAAM;AAAA,QACxC,eAAe,QAAQ;AAAA,MACzB,CAAC;AAGD,YAAM,SAAS,QAAQ,WAAW,CAAC,MAAM,MAAM,GAAG,WAAW,MAAM,CAAC,CAAC;AACrE,YAAM,WAAW,IAAI,QAAc,CAAC,MAAM,WAAW,GAAG,GAAI,EAAE,MAAM,CAAC;AACrE,WAAK,QAAQ,KAAK,CAAC,QAAQ,QAAQ,CAAC,EAAE,KAAK,MAAM,QAAQ,IAAI,CAAC;AAAA,IAChE;AAEA,eAAW,UAAU,MAAM,OAAO,GAAG,uBAAuB;AAI5D,UAAM,UAAU,MAAM,OAAO,GAAG,mBAAmB;AAGnD,UAAM,UAAU,CAAC,QAAQ;AACvB,cAAQ,MAAM,oCAAoC,IAAI,OAAO,EAAE;AAAA,IACjE;AAGA,YAAQ,MAAM,GAAG,OAAO,MAAM,OAAO,GAAG,mBAAmB,CAAC;AAG5D,YAAQ,OAAO,GAAG,SAAS,CAAC,QAA+B;AACzD,UAAI,IAAI,SAAS,QAAS,QAAO,GAAG,mBAAmB;AAAA,UAClD,QAAO,GAAG,iBAAiB,IAAI,OAAO,EAAE;AAAA,IAC/C,CAAC;AAGD,YAAQ,KAAK,WAAW,MAAM,OAAO,GAAG,YAAY,CAAC;AACrD,YAAQ,KAAK,UAAU,MAAM,OAAO,GAAG,aAAa,CAAC;AAErD,UAAM,QAAQ,SAAS,EAAE,MAAM,CAAC,QAAiB;AAC/C,cAAQ;AAAA,QACN,oCAAoC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACtF;AACA,aAAO,GAAG,iBAAiB;AAAA,IAC7B,CAAC;AAAA,EACH,CAAC;AACH;;;AEtgBA,IAAM,UAAU,CAAC,OAAe,WAAqB,CAAC,MAAM,CAAC,GAAG,UAAU,KAAK;AAExE,SAAS,oBAAoBC,UAAwB;AAC1D,QAAM,MAAMA,SACT,QAAQ,KAAK,EACb,YAAY,8DAAyD;AAExE,MACG,QAAQ,mBAAmB,EAC3B;AAAA,IACC;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,EACH,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,eAAe,+CAA+C,EACrE,OAAO,mBAAmB,kEAAkE,EAC5F;AAAA,IACC;AAAA,IACA;AAAA,EACF,EACC,OAAO,OAAO,aAAuB,QAAQ;AAC5C,QAAI;AACF,UAAI,CAAC,IAAI,OAAO,YAAY,WAAW,GAAG;AACxC,cAAM,IAAI,MAAM,8CAA8C;AAAA,MAChE;AACA,YAAM,OAAO,MAAM,QAAQ;AAAA,QACzB,SAAS,YAAY,CAAC;AAAA,QACtB,MAAM,YAAY,MAAM,CAAC;AAAA,QACzB,KAAK,IAAI;AAAA,QACT,SAAS,IAAI;AAAA,QACb,YAAY,IAAI;AAAA,QAChB,YAAY,IAAI,eAAe;AAAA;AAAA,QAE/B,QAAQ,IAAI,WAAW,QAAQ,QAAQ;AAAA,QACvC,OAAO,IAAI;AAAA,QACX,aAAa,IAAI;AAAA,MACnB,CAAC;AACD,cAAQ,KAAK,IAAI;AAAA,IACnB,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,EAAE;AAAA,UACA,GAAG,QAAQ,KAAK,oBAAoB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACtF;AAAA,MACF;AACA,cAAQ,KAAK,CAAC;AAAA,IAChB;AAAA,EACF,CAAC;AAEH,MACG,QAAQ,gBAAgB,EACxB;AAAA,IACC;AAAA,EACF,EACC,OAAO,mBAAmB,gCAAgC,CAAC,MAAM,SAAS,GAAG,EAAE,GAAG,IAAI,EACtF,OAAO,mBAAmB,iCAAiC,EAC3D,OAAO,YAAY,qCAAqC,EACxD,OAAO,yBAAyB,4CAA4C,EAC5E,OAAO,CAAC,MAAc,QAAQ;AAC7B,UAAM,cAAsB,IAAI,eAAe,QAAQ,IAAI;AAC3D,UAAM,UAAU,oBAAoB,WAAW;AAC/C,QAAI,IAAI,QAAQ;AACd,UAAI,eAAe,MAAM,qBAAqB,OAAO,GAAG;AACtD,gBAAQ;AAAA,UACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,SAAS,CAAC,yBAAyB,EAAE,KAAK,IAAI,CAAC;AAAA,QAC7E;AAAA,MACF,OAAO;AACL,gBAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,mCAAmC,IAAI,GAAG,CAAC;AAC/E,gBAAQ,KAAK,CAAC;AAAA,MAChB;AACA;AAAA,IACF;AACA,UAAM,QAAQ,cAAc,MAAM,qBAAqB,SAAS,IAAI,KAAK;AAAA,MACvE,QAAQ,IAAI,UAAU;AAAA,IACxB,CAAC;AACD,YAAQ;AAAA,MACN,GAAG,QAAQ,KAAK,IAAI,EAAE,MAAM,UAAU,CAAC,iBAAiB,EAAE,KAAK,IAAI,CAAC,QAAQ,IAAI,GAAG;AAAA,IACrF;AACA,YAAQ,IAAI,EAAE,IAAI,QAAQ,MAAM,EAAE,YAAY,MAAM,MAAM,aAAa,MAAM,SAAS,EAAE,CAAC;AACzF,YAAQ;AAAA,MACN,EAAE;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AAEH,MACG,QAAQ,WAAW,EACnB,YAAY,mDAAmD,EAC/D,OAAO,yBAAyB,4CAA4C,EAC5E,OAAO,UAAU,gBAAgB,EACjC,OAAO,CAAC,QAAQ;AACf,UAAM,UAAU,oBAAoB,IAAI,eAAe,QAAQ,IAAI,CAAC;AACpE,UAAM,UAAU,cAAc,EAAE;AAAA,MAC9B,CAAC,MAAM,EAAE,UAAU,uBAAuB,EAAE,YAAY;AAAA,IAC1D;AACA,QAAI,IAAI,MAAM;AACZ,cAAQ,IAAI,KAAK,UAAU,EAAE,WAAW,QAAQ,GAAG,MAAM,CAAC,CAAC;AAC3D;AAAA,IACF;AACA,QAAI,QAAQ,WAAW,GAAG;AACxB,cAAQ;AAAA,QACN,EAAE;AAAA,UACA;AAAA,QACF;AAAA,MACF;AACA;AAAA,IACF;AACA,eAAW,KAAK,SAAS;AACvB,YAAM,QAAQ,EAAE,WACZ,EAAE,IAAI,UAAU,IAChB,EAAE,QACA,EAAE,MAAM,OAAO,IACf,EAAE,OAAO,SAAS;AACxB,cAAQ;AAAA,QACN,KAAK,QAAQ,KAAK,IAAI,EAAE,KAAK,EAAE,GAAG,CAAC,KAAK,KAAK,KAAK,EAAE,IAAI,WAAW,EAAE,SAAS,SAAM,EAAE,MAAM,EAAE,CAAC;AAAA,MACjG;AAAA,IACF;AAAA,EACF,CAAC;AACL;;;AC1IA,SAAS,cAAAC,aAAY,gBAAAC,eAAc,iBAAAC,gBAAe,UAAAC,eAAc;AAChE,SAAS,QAAAC,OAAM,iBAAiB;AAiBhC,SAAS,WAAmB;AAC1B,SAAO,QAAQ,IAAI,mBAAmB,UAAU;AAClD;AAEA,SAAS,YAAyB;AAChC,QAAM,QAAQ,OAAO,QAAQ,SAAS,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC;AACxD,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ,SAAS,KAAK,OAAO;AAAA,IAC7B,QAAQ,IAAI,QAAQ,SAAS,IAAI,GAAG,SAAS,KAAK,KAAK,oCAA+B;AAAA,EACxF;AACF;AAEA,eAAe,sBAA4C;AAIzD,MAAI;AACF,UAAM,EAAE,OAAAC,OAAM,IAAI,MAAM,OAAO,kBAAkB;AACjD,UAAM,QAAQ,IAAIA,OAAM,uBAAuB,OAAO;AACtD,UAAM,YAAY,IAAI;AACtB,UAAM,OAAO,MAAM,YAAY;AAC/B,UAAM,eAAe;AACrB,QAAI,SAAS,MAAM;AACjB,aAAO;AAAA,QACL,MAAM;AAAA,QACN,QAAQ;AAAA,QACR,QAAQ;AAAA,MACV;AAAA,IACF;AACA,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,GAAG,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC7D;AAAA,EACF;AACF;AAEA,SAAS,gBAA6B;AACpC,QAAM,MAAM,SAAS;AACrB,MAAI;AACF,UAAM,YAAYC,MAAK,KAAK,eAAe;AAC3C,IAAAC,eAAc,WAAW,IAAI;AAC7B,IAAAC,QAAO,SAAS;AAAA,EAClB,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,GAAG,GAAG,kBAAkB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAClF;AAAA,EACF;AAEA,QAAM,QAAQ,iBAAiB;AAC/B,MAAI,MAAM,gBAAgB,GAAG;AAC3B,WAAO,EAAE,MAAM,aAAa,QAAQ,MAAM,QAAQ,GAAG,GAAG,2BAA2B;AAAA,EACrF;AACA,MAAI,CAAC,MAAM,QAAQ;AACjB,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,+BAA+B,MAAM,QAAQ,KAAK,MAAM,WAAW,IAAI,MAAM,WAAW;AAAA,IAClG;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,GAAG,GAAG,4BAA4B,MAAM,WAAW;AAAA,EAC7D;AACF;AAEA,SAAS,cAAc,aAAkC;AACvD,QAAM,eAAeF,MAAK,aAAa,cAAc;AACrD,MAAI,CAACG,YAAW,YAAY,GAAG;AAC7B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,sBAAsB,WAAW;AAAA,IAC3C;AAAA,EACF;AACA,MAAI;AACF,UAAM,SAAS,KAAK,MAAMC,cAAa,cAAc,MAAM,CAAC;AAC5D,UAAM,WAAW,OAAO,KAAK,OAAO,WAAW,CAAC,CAAC,EAAE;AACnD,UAAM,YAAY,CAAC,CAAC,OAAO;AAC3B,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,GAAG,QAAQ,sBAAsB,YAAY,qBAAqB,EAAE;AAAA,IAC9E;AAAA,EACF,SAAS,KAAK;AACZ,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ,mCAAmC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IAC7F;AAAA,EACF;AACF;AAEA,SAAS,cAA2B;AAClC,QAAM,UAAU,iBAAiB;AACjC,QAAM,SAAS;AAAA,IACb,QAAQ,gBAAgB;AAAA,IACxB,QAAQ,iBAAiB;AAAA,IACzB,QAAQ,mBAAmB;AAAA,EAC7B,EAAE,OAAO,OAAO;AAChB,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,OAAO,SACX,WAAW,OAAO,KAAK,IAAI,CAAC,KAC5B;AAAA,EACN;AACF;AAEA,SAAS,uBAAoC;AAC3C,QAAM,IAAI,qBAAqB;AAC/B,MAAI,MAAM,GAAG;AACX,WAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QAAQ,GAAG,CAAC;AAAA,EACd;AACF;AAEA,SAAS,iBAA8B;AACrC,QAAM,OAAO,QAAQ,aAAa,UAAU,CAAC,QAAQ,QAAQ,QAAQ,EAAE,IAAI,CAAC,EAAE;AAC9E,aAAW,QAAQ,QAAQ,IAAI,QAAQ,IAAI,MAAM,SAAS,GAAG;AAC3D,QAAI,CAAC,IAAK;AACV,eAAW,OAAO,MAAM;AACtB,UAAID,YAAWH,MAAK,KAAK,YAAY,GAAG,EAAE,CAAC,GAAG;AAC5C,eAAO;AAAA,UACL,MAAM;AAAA,UACN,QAAQ;AAAA,UACR,QAAQ,YAAYA,MAAK,KAAK,YAAY,GAAG,EAAE,CAAC;AAAA,QAClD;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,SAAO;AAAA,IACL,MAAM;AAAA,IACN,QAAQ;AAAA,IACR,QACE;AAAA,EACJ;AACF;AAEO,SAAS,sBAAsBK,UAAwB;AAC5D,EAAAA,SACG,QAAQ,QAAQ,EAChB,YAAY,kEAAkE,EAC9E,OAAO,yBAAyB,gCAAgC,EAChE,OAAO,UAAU,gBAAgB,EACjC,OAAO,OAAO,QAAQ;AACrB,UAAM,cAAc,IAAI,eAAe,QAAQ,IAAI;AAEnD,UAAM,SAAwB;AAAA,MAC5B,UAAU;AAAA,MACV,MAAM,oBAAoB;AAAA,MAC1B,cAAc;AAAA,MACd,cAAc,WAAW;AAAA,MACzB,YAAY;AAAA,MACZ,qBAAqB;AAAA,MACrB,eAAe;AAAA,IACjB;AAEA,UAAM,SAAS,OAAO,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AACzD,UAAM,SAAS,OAAO,OAAO,CAAC,MAAM,EAAE,WAAW,MAAM,EAAE;AAEzD,QACE,SAASA,UAAS,KAAK;AAAA,MACrB,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,SAAS,WAAW;AAAA,IACtB,CAAC,GACD;AACA,UAAI,SAAS,EAAG,SAAQ,WAAW;AACnC;AAAA,IACF;AAEA,YAAQ,IAAI,EAAE,KAAK;AAAA,IAAO,QAAQ,MAAM,yBAAoB,eAAe;AAAA,CAAI,CAAC;AAEhF,eAAW,KAAK,QAAQ;AACtB,YAAM,OACJ,EAAE,WAAW,OACT,EAAE,MAAM,QAAQ,KAAK,IACrB,EAAE,WAAW,SACX,EAAE,OAAO,QAAQ,OAAO,IACxB,EAAE,IAAI,QAAQ,KAAK;AAC3B,cAAQ,IAAI,KAAK,IAAI,IAAI,EAAE,KAAK,EAAE,KAAK,OAAO,EAAE,CAAC,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,EAAE;AAAA,IACzE;AAEA,YAAQ,IAAI;AACZ,QAAI,SAAS,GAAG;AACd,cAAQ,IAAI,KAAK,EAAE,IAAI,GAAG,MAAM,kBAAkB,CAAC,GAAG,SAAS,EAAE,IAAI,KAAK,MAAM,aAAa,IAAI,EAAE;AAAA,CAAI;AACvG,cAAQ,WAAW;AAAA,IACrB,WAAW,SAAS,GAAG;AACrB,cAAQ,IAAI,KAAK,EAAE,OAAO,GAAG,MAAM,aAAa,CAAC,IAAI,EAAE,IAAI,uCAAkC,CAAC;AAAA,CAAI;AAAA,IACpG,OAAO;AACL,cAAQ,IAAI,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAAA,CAAI;AAAA,IACpD;AAAA,EACF,CAAC;AACL;;;ACpNA,SAASC,SAAQ,KAAuB;AACtC,SAAO;AAAA,IACL,MAAM,IAAI,KAAK;AAAA,IACf,SAAS,IAAI,QAAQ;AAAA,IACrB,aAAa,IAAI,YAAY;AAAA,IAC7B,SAAS,IAAI,QACV,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,SAAS,IAAI,aAAa,EAAE,eAAe,GAAG,EAAE,EAChF,OAAO,CAAC,MAAM,EAAE,KAAK,WAAW,IAAI,CAAC;AAAA,IACxC,aAAa,IAAI,SACd,OAAO,CAAC,MAAM,EAAE,KAAK,MAAM,MAAM,EACjC,IAAI,CAAC,MAAMA,SAAQ,CAAY,CAAC;AAAA,EACrC;AACF;AAEA,IAAM,WAAW,CAAC,MAChB,EAAE,QAAQ,aAAa,EAAE,EAAE,QAAQ,WAAW,GAAG,EAAE,QAAQ,QAAQ,GAAG,EAAE,KAAK;AAE/E,SAAS,WAAW,MAAyB;AAC3C,QAAM,QAAQ,KAAK,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC,EAAE,KAAK,GAAG;AAClE,QAAM,QAAQ,KACX,IAAI,CAAC,MAAM;AACV,UAAM,QAAQ,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,GAAG;AAC7C,UAAM,OAAO,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,GAAG,QAAQ,EAAE,KAAK,GAAG;AACjE,UAAM,OAAO,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,GAAG;AACtD,UAAM,UAAU,OACZ;AAAA,mEAAsE,IAAI,+BAC1E;AACJ,WAAO,OAAO,KAAK,IAAI,OAAO;AAAA,cAAiB,IAAI;AAAA,EACrD,CAAC,EACA,KAAK,IAAI;AAEZ,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,gCAMuB,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA,EAKnC,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAQP;AAEA,SAAS,UAAU,MAAyB;AAC1C,QAAM,QAAQ,KACX,IAAI,CAAC,MAAM,QAAQ,EAAE,IAAI,IAAI,SAAS,EAAE,WAAW,CAAC,GAAG,EACvD,KAAK,IAAI;AACZ,QAAM,QAAQ,KACX,IAAI,CAAC,MAAM;AACV,UAAM,QAAQ,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,EAAE,KAAK,GAAG;AAC7C,UAAM,QAAQ;AAAA,MACZ,GAAG,EAAE,YAAY,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,MAClC,GAAG,EAAE,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,MAC9B;AAAA,IACF,EAAE,KAAK,GAAG;AACV,WAAO,OAAO,KAAK,gBAAgB,KAAK;AAAA,EAC1C,CAAC,EACA,KAAK,IAAI;AAEZ,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA,EAKP,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOL,KAAK;AAAA;AAAA;AAAA;AAAA;AAKP;AAEA,SAAS,WAAW,MAAyB;AAC3C,QAAM,QAAkB;AAAA,IACtB;AAAA,IACA;AAAA,EACF;AACA,QAAM,WAAW,KAAK,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,CAAC;AAC3D,aAAW,KAAK,MAAM;AACpB,eAAW,QAAQ,CAAC,EAAE,MAAM,GAAG,EAAE,OAAO,GAAG;AACzC,YAAM;AAAA,QACJ,yDAAyD,SAAS,KAAK,GAAG,CAAC,QAAQ,IAAI,QAAQ,SAAS,EAAE,WAAW,CAAC;AAAA,MACxH;AAAA,IACF;AACA,eAAW,KAAK,EAAE,aAAa;AAC7B,YAAM;AAAA,QACJ,qDAAqD,EAAE,IAAI,QAAQ,EAAE,IAAI,QAAQ,SAAS,EAAE,WAAW,CAAC;AAAA,MAC1G;AAAA,IACF;AACA,eAAW,KAAK,CAAC,GAAG,EAAE,SAAS,EAAE,MAAM,UAAU,aAAa,iBAAiB,CAAC,GAAG;AACjF,YAAM;AAAA,QACJ,qDAAqD,EAAE,IAAI,QAAQ,EAAE,KAAK,MAAM,CAAC,CAAC,QAAQ,SAAS,EAAE,WAAW,CAAC;AAAA,MACnH;AAAA,IACF;AAAA,EACF;AACA,SAAO,MAAM,KAAK,IAAI,IAAI;AAC5B;AAEO,SAAS,0BAA0BC,UAAwB;AAChE,EAAAA,SACG,QAAQ,oBAAoB,EAC5B,YAAY,mDAAmD,EAC/D,OAAO,CAAC,UAAkB;AACzB,UAAM,OAAOA,SAAQ,SAClB,OAAO,CAAC,MAAM,EAAE,KAAK,MAAM,UAAU,EAAE,KAAK,MAAM,YAAY,EAC9D,IAAI,CAAC,MAAMD,SAAQ,CAAY,CAAC;AAEnC,QAAI,UAAU,OAAQ,SAAQ,OAAO,MAAM,WAAW,IAAI,CAAC;AAAA,aAClD,UAAU,MAAO,SAAQ,OAAO,MAAM,UAAU,IAAI,CAAC;AAAA,aACrD,UAAU,OAAQ,SAAQ,OAAO,MAAM,WAAW,IAAI,CAAC;AAAA,SAC3D;AACH,cAAQ,MAAM,EAAE,IAAI,kBAAkB,KAAK,sCAAiC,CAAC;AAC7E,cAAQ,WAAW;AAAA,IACrB;AAAA,EACF,CAAC;AACL;;;AvC7HA,IAAM,iBAID;AAAA,EACH;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,WAAW,SAAS,OAAO,gBAAgB,WAAW,QAAQ,QAAQ;AAAA,EACnF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,YAAY,UAAU,cAAc,aAAa;AAAA,EAC9D;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,QAAQ,QAAQ,QAAQ,UAAU,UAAU,YAAY;AAAA,EACrE;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,OAAO,SAAS,MAAM;AAAA,EACnC;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,SAAS,gBAAgB,gBAAgB,QAAQ;AAAA,EAC9D;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU;AAAA,MACR;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,YAAY,UAAU,UAAU,WAAW,OAAO;AAAA,EAC/D;AAAA,EACA;AAAA,IACE,MAAM;AAAA,IACN,QAAQ,QAAQ;AAAA,IAChB,UAAU,CAAC,WAAW,aAAa,UAAU,UAAU,KAAK;AAAA,EAC9D;AACF;AAEA,IAAM,cAAN,cAA0B,KAAK;AAAA,EACpB,WAAW,KAAc,QAAsB;AAGtD,QAAI,IAAI,OAAQ,QAAO,MAAM,WAAW,KAAK,MAAM;AAEnD,UAAM,YAAY,OAAO,SAAS,KAAK,MAAM;AAC7C,UAAM,YAAY,OAAO,aAAa;AAEtC,UAAM,WAAqB,CAAC;AAC5B,aAAS;AAAA,MACP,GAAG,EAAE,KAAK,OAAO,CAAC,IAAI,EAAE,IAAI,IAAI,eAAe,EAAE,CAAC,IAAI,EAAE,IAAI,QAAG,CAAC,IAAI,EAAE;AAAA,QACpE;AAAA,MACF,CAAC;AAAA,IACH;AACA,aAAS,KAAK,EAAE;AAChB,aAAS,KAAK,GAAG,EAAE,KAAK,QAAQ,CAAC,6BAA6B;AAE9D,UAAM,UAAU,OAAO,eAAe,GAAG;AACzC,QAAI,QAAQ,SAAS,GAAG;AACtB,eAAS,KAAK,EAAE;AAChB,eAAS,KAAK,EAAE,KAAK,UAAU,CAAC;AAChC,iBAAW,OAAO,SAAS;AACzB,cAAM,OAAO,OAAO,WAAW,GAAG;AAClC,cAAM,OAAO,OAAO,kBAAkB,GAAG;AACzC,iBAAS,KAAK,UAAU,MAAM,MAAM,WAAW,SAAS,CAAC;AAAA,MAC3D;AAAA,IACF;AAEA,UAAM,WAAW,OAAO,gBAAgB,GAAG;AAC3C,QAAI,SAAS,WAAW,EAAG,QAAO,SAAS,KAAK,IAAI,IAAI;AAExD,UAAM,SAAS,oBAAI,IAAqB;AACxC,eAAW,OAAO,SAAU,QAAO,IAAI,IAAI,KAAK,GAAG,GAAG;AAEtD,UAAM,OAAO,oBAAI,IAAY;AAE7B,eAAW,SAAS,gBAAgB;AAClC,YAAM,UAAU,MAAM,SACnB,IAAI,CAAC,MAAM,OAAO,IAAI,CAAC,CAAC,EACxB,OAAO,CAAC,MAAoB,QAAQ,CAAC,CAAC;AACzC,UAAI,QAAQ,WAAW,EAAG;AAC1B,iBAAW,KAAK,QAAS,MAAK,IAAI,EAAE,KAAK,CAAC;AAE1C,eAAS,KAAK,EAAE;AAChB,eAAS,KAAK,GAAG,MAAM,MAAM,IAAI,EAAE,KAAK,MAAM,IAAI,CAAC,EAAE;AACrD,iBAAW,OAAO,SAAS;AACzB,iBAAS;AAAA,UACP;AAAA,YACE,OAAO,eAAe,GAAG;AAAA,YACzB,OAAO,sBAAsB,GAAG;AAAA,YAChC;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,QAAQ,SAAS,OAAO,CAAC,QAAQ,CAAC,KAAK,IAAI,IAAI,KAAK,CAAC,CAAC;AAC5D,QAAI,MAAM,SAAS,GAAG;AACpB,eAAS,KAAK,EAAE;AAChB,eAAS,KAAK,EAAE,KAAK,QAAQ,CAAC;AAC9B,iBAAW,OAAO,OAAO;AACvB,iBAAS;AAAA,UACP;AAAA,YACE,OAAO,eAAe,GAAG;AAAA,YACzB,OAAO,sBAAsB,GAAG;AAAA,YAChC;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,aAAS,KAAK,EAAE;AAChB,aAAS;AAAA,MACP,EAAE;AAAA,QACA,OAAO,EAAE,KAAK,wBAAwB,CAAC;AAAA,MACzC;AAAA,IACF;AACA,WAAO,SAAS,KAAK,IAAI,IAAI;AAAA,EAC/B;AACF;AAEA,SAAS,UACP,MACA,aACA,WACA,WACQ;AACR,QAAM,SAAS;AACf,QAAM,MAAM;AACZ,QAAM,SAAS,KAAK,OAAO,SAAS;AACpC,MAAI,CAAC,YAAa,QAAO,GAAG,MAAM,GAAG,MAAM;AAC3C,QAAM,YAAY,KAAK,IAAI,YAAY,OAAO,SAAS,YAAY,IAAI,QAAQ,EAAE;AACjF,QAAM,OAAO,SAAS,aAAa,SAAS,EAAE;AAAA,IAC5C;AAAA,IACA;AAAA,EAAK,MAAM,GAAG,IAAI,OAAO,SAAS,CAAC,GAAG,GAAG;AAAA,EAC3C;AACA,SAAO,GAAG,MAAM,GAAG,MAAM,GAAG,GAAG,GAAG,EAAE,IAAI,IAAI,CAAC;AAC/C;AAEA,SAAS,SAAS,MAAc,OAAuB;AACrD,MAAI,KAAK,UAAU,MAAO,QAAO;AACjC,QAAM,QAAkB,CAAC;AACzB,MAAI,UAAU;AACd,aAAW,QAAQ,KAAK,MAAM,KAAK,GAAG;AACpC,QAAI,QAAQ,SAAS,KAAK,SAAS,IAAI,OAAO;AAC5C,YAAM,KAAK,OAAO;AAClB,gBAAU;AAAA,IACZ,OAAO;AACL,gBAAU,UAAU,GAAG,OAAO,IAAI,IAAI,KAAK;AAAA,IAC7C;AAAA,EACF;AACA,MAAI,QAAS,OAAM,KAAK,OAAO;AAC/B,SAAO,MAAM,KAAK,IAAI;AACxB;AAEO,SAAS,gBAAyB;AACvC,QAAME,WAAU,IAAI,QAAQ,EACzB,KAAK,OAAO,EACZ;AAAA,IACC,GAAG,EAAE,KAAK,QAAQ,CAAC,IAAI,EAAE,IAAI,4CAAuC,CAAC;AAAA,EACvE,EACC,QAAQ,eAAe,EACvB,OAAO,UAAU,qDAAqD,EACtE,cAAc;AAAA,IACb,iBAAiB;AAAA,IACjB,aAAa;AAAA,EACf,CAAC,EACA,mBAAmB,EAAE,IAAI,gCAAgC,CAAC;AAE7D,EAACA,SAAoB,aAAa,MAAM,IAAI,YAAY;AAExD,0BAAwBA,QAAO;AAC/B,0BAAwBA,QAAO;AAC/B,8BAA4BA,QAAO;AACnC,0BAAwBA,QAAO;AAC/B,6BAA2BA,QAAO;AAClC,0BAAwBA,QAAO;AAC/B,wBAAsBA,QAAO;AAC7B,uBAAqBA,QAAO;AAC5B,wBAAsBA,QAAO;AAC7B,2BAAyBA,QAAO;AAChC,yBAAuBA,QAAO;AAC9B,yBAAuBA,QAAO;AAC9B,sBAAoBA,QAAO;AAC3B,wBAAsBA,QAAO;AAC7B,4BAA0BA,QAAO;AAEjC,SAAOA;AACT;;;AwC1PA,IAAM,UAAU,cAAc;AAK9B,IAAI;AACF,QAAM,QAAQ,WAAW;AAC3B,SAAS,KAAK;AACZ,QAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC/D,UAAQ,MAAM,EAAE,IAAI,GAAG,QAAQ,KAAK,IAAI,OAAO,EAAE,CAAC;AAClD,MAAI,QAAQ,IAAI,eAAe,eAAe,SAAS,IAAI,OAAO;AAChE,YAAQ,MAAM,EAAE,IAAI,IAAI,KAAK,CAAC;AAAA,EAChC;AACA,UAAQ,WAAW;AACrB;","names":["program","c","c","program","registry","registry","readFileSync","program","readFileSync","program","randomBytes","randomBytes","wrap","program","program","registry","value","provHint","result","icon","readFileSync","readFileSync","readFileSync","writeFileSync","existsSync","existsSync","readFileSync","writeFileSync","program","writeFileSync","program","writeFileSync","existsSync","writeFileSync","readFileSync","join","join","existsSync","readFileSync","writeFileSync","program","hook","program","program","existsSync","readFileSync","join","existsSync","join","readFileSync","existsSync","readFileSync","writeFileSync","join","writeFileSync","join","join","writeFileSync","program","plan","randomInt","randomInt","disarmCanary","program","disarmCanary","url","enabled","transport","c","program","existsSync","readFileSync","writeFileSync","rmSync","join","Entry","join","writeFileSync","rmSync","existsSync","readFileSync","program","collect","program","program"]}