@integrity-labs/agt-cli 0.28.1174 → 0.28.1176

package/dist/chunk-EL5MWGGH.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../../../packages/core/src/provisioning/frameworks/claudecode/config-location.ts","../src/lib/claude-config-location.ts"],"sourcesContent":["/**\n * ENG-10869 — where `.claude.json` lives. The lower half of the locator.\n *\n * Path resolution lives HERE, in core, rather than only in the CLI, because\n * `ensureWorkspaceTrusted` in this same directory WRITES that file — atomically,\n * temp-then-rename, on the manager's tick. A second hand-kept copy of the rule\n * would have drifted the moment the CLI's copy moved, and the symptom would be\n * the trust flag written to a file no agent reads: every new agent back on the\n * trust prompt, with the write succeeding. The CLI's `claude-config-location`\n * re-exports these and adds the seeding and readiness checks on top, so there is\n * one implementation of the path and one of the migration.\n *\n * Worth recording while it is fresh: `claude-json-health.ts` states that \"an\n * exhaustive search of apps/cli, packages/core and packages/api finds no write\n * and no unlink of `.claude.json`\". That is not correct — `ensureWorkspaceTrusted`\n * is a writer, and it is in the set that search covered. The conclusion drawn\n * from it (that there is no call site to make atomic) happens to hold anyway,\n * because that writer was already atomic; but the premise should not be relied\n * on again.\n */\n\nimport { lstatSync, readFileSync } from 'node:fs';\nimport { homedir } from 'node:os';\nimport { join } from 'node:path';\n\n/** The env var Claude Code reads for its config root. Not ours; do not rename. */\nexport const CLAUDE_CONFIG_DIR_ENV = 'CLAUDE_CONFIG_DIR';\n\n/**\n * The config root Claude Code will use.\n *\n * A blank value is treated as unset rather than as the empty path: `''` would\n * make `join` produce a path relative to the process cwd, which is the same\n * class of trap ENG-5070 hit with `HOME=''` — broken, but better hidden than an\n * outright failure.\n */\nexport function claudeConfigDirFor(\n  homeDir?: string,\n  env: NodeJS.ProcessEnv = process.env,\n): string {\n  const explicit = env[CLAUDE_CONFIG_DIR_ENV]?.trim();\n  if (explicit) return explicit;\n  return join(homeDir || env.HOME?.trim() || homedir(), '.claude');\n}\n\n/** The `.claude.json` a Claude Code process will actually read and write. */\nexport function claudeJsonPathFor(homeDir?: string, env: NodeJS.ProcessEnv = process.env): string {\n  return join(claudeConfigDirFor(homeDir, env), '.claude.json');\n}\n\n/**\n * Where `.claude.json` lived before ENG-10869: beside the config dir rather\n * than inside it, which is why it needed a single-file bind mount and why that\n * bind pinned each container's inode.\n */\nexport function legacyClaudeJsonPathFor(\n  homeDir?: string,\n  env: NodeJS.ProcessEnv = process.env,\n): string {\n  return join(homeDir || env.HOME?.trim() || homedir(), '.claude.json');\n}\n\n/**\n * ENG-10869 — what state the config at `path` is in.\n *\n * ## Why \"parses\" was the wrong test\n *\n * The first version of this change gated the whole migration on \"the file\n * exists and `JSON.parse` succeeds\". Two reviewers found the same hole from\n * opposite ends, and they were both right:\n *\n *  - `ensureWorkspaceTrusted` (this very directory) CREATES the file when a\n *    project needs its trust flag. That file is `{\"projects\":{…}}` — it parses\n *    perfectly, and it contains no account at all. So the manager could\n *    manufacture a config that looked ready, the spawn would drop the legacy\n *    bind on the strength of it, and every agent on the host would come up on\n *    the login picker. The fix's own writer could cause the outage the fix\n *    exists to prevent.\n *  - The same weakness made the documented recovery useless: an operator\n *    running `claude /login` writes the LEGACY path, the seed saw a parseable\n *    target and declared `already-present`, and the fresh account never\n *    reached an agent.\n *\n * So readiness means **an agent can actually start from this file**, which\n * requires account-bearing state, not merely valid JSON.\n *\n * ## The rule is `hasCompletedOnboarding`, and PRODUCTION chose it\n *\n * The first version accepted `oauthAccount` **or** `hasCompletedOnboarding`, on\n * the reasoning that either proves an account. agt-aws-1 disproved it on\n * 2026-09-22 while this change was still in review:\n *\n *     host /root/.claude.json   27 keys, PARSES, oauthAccount present,\n *                               hasCompletedOnboarding ABSENT\n *     -> all 8 agents sitting on the Claude Code login picker\n *\n * Under the OR that config reads as `usable`, the spawn drops the legacy bind\n * on the strength of it, and every agent on the host is left on the picker with\n * no fallback — the exact outage this file exists to prevent, caused by it.\n *\n * **What the evidence does and does not establish.** The successful re-pair that\n * recovered the host wrote BOTH a new `hasCompletedOnboarding: true` and fresh\n * credentials, so this is a correlation, not a proof that the flag alone is\n * what Claude Code gates on. The rule is chosen on the ASYMMETRY rather than on\n * the causal claim:\n *\n *   - Requiring too MUCH costs a migration that does not happen. The host stays\n *     on the legacy bind, which is exactly today's behaviour.\n *   - Requiring too LITTLE costs every agent on the host, with the legacy file\n *     already archived out from under them.\n *\n * So it requires the onboarding flag, and `oauthAccount` is no longer\n * sufficient on its own. This also lands close to where a reviewer's instinct\n * pointed on #6368; the counter-argument made there was weaker than it read.\n *\n * ## Symlinks are refused, not followed\n *\n * `.claude.json` now lives inside a directory the agent can write. A compromised\n * agent could replace it with a symlink to a file outside its own mounts — say\n * another agent's `.mcp.json` — and this function runs as the host manager. A\n * read that follows it, followed by a write-back, copies private content into a\n * shared mount. The single-file bind made that impossible before, so the\n * relocation is what introduces the exposure and the refusal belongs here, at\n * the one place both the reader and the writer consult.\n */\nexport type ClaudeConfigState =\n  /** Nothing at the path. */\n  | 'missing'\n  /** A symlink. Deliberately not followed — see the docblock. */\n  | 'symlink'\n  /** Present but not a readable, parseable regular file (includes a DIRECTORY). */\n  | 'unreadable'\n  /** Parses, but carries no account — an agent would land on the login picker. */\n  | 'no-account'\n  /** An agent can start from this. */\n  | 'usable';\n\nexport function inspectClaudeConfig(path: string): ClaudeConfigState {\n  let stat: ReturnType<typeof lstatSync>;\n  try {\n    stat = lstatSync(path);\n  } catch {\n    return 'missing';\n  }\n  // lstat, never stat: the point is to SEE the symlink rather than resolve it.\n  if (stat.isSymbolicLink()) return 'symlink';\n  if (!stat.isFile()) return 'unreadable';\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(readFileSync(path, 'utf-8'));\n  } catch {\n    return 'unreadable';\n  }\n  if (typeof parsed !== 'object' || parsed === null) return 'unreadable';\n  const config = parsed as Record<string, unknown>;\n  // `=== true`, not truthiness: a config carrying `hasCompletedOnboarding: 1`\n  // or `\"false\"` is a shape nobody writes, and guessing at it is how a rule\n  // that must fail safe starts admitting things.\n  return config['hasCompletedOnboarding'] === true ? 'usable' : 'no-account';\n}\n\n/** mtime in ms, or 0 when the path cannot be stat'ed. Never follows a symlink. */\nexport function claudeConfigMtimeMs(path: string): number {\n  try {\n    const stat = lstatSync(path);\n    return stat.isFile() ? stat.mtimeMs : 0;\n  } catch {\n    return 0;\n  }\n}\n\n/**\n * ENG-10869 — the `.claude.json` an agent on this host will ACTUALLY read.\n *\n * The migration is per-host and conditional: the spawn path hands a container\n * `CLAUDE_CONFIG_DIR` only once the config dir holds a usable file, and\n * otherwise falls back to binding the legacy path. So there are hosts, for as\n * long as the seed has not landed, where the legacy file is still the live one.\n *\n * Anything that WRITES this file has to resolve it the same way, or it writes\n * somewhere nothing reads. That is not hypothetical: `ensureWorkspaceTrusted`\n * was moved to the config dir unconditionally while the reader stayed\n * conditional, which on any host the seed missed put the trust flag in a file no\n * agent opens — the write succeeding, and every new agent going back to dying on\n * the trust prompt (the ENG-9573 incident, restored behind green monitoring).\n *\n * One function, consulted by both sides, is what keeps them from disagreeing.\n */\nexport function effectiveClaudeJsonPath(\n  homeDir?: string,\n  env: NodeJS.ProcessEnv = process.env,\n): string {\n  const inConfigDir = claudeJsonPathFor(homeDir, env);\n  if (inspectClaudeConfig(inConfigDir) === 'usable') return inConfigDir;\n  return legacyClaudeJsonPathFor(homeDir, env);\n}\n","/**\n * ENG-10869 — where `.claude.json` lives, in ONE place.\n *\n * ## The bug this exists to close\n *\n * `~/.claude.json` sits OUTSIDE `~/.claude`, so the container spawn path had to\n * give it its own mount — and the only available shape was a **single-file**\n * bind. A file bind pins the inode at container start, and Claude Code replaces\n * that file by **atomic rename**. So every host-side write orphaned the view of\n * every already-running container, permanently, until it respawned.\n *\n * Measured on `agt-aws-1` 2026-09-22 00:37Z: SIX live versions of one config\n * across eight agents, the oldest 12+ hours stale. Containers that booted\n * together shared an inode; containers that booted apart did not.\n *\n * Two consequences, both observed in prod:\n *\n *  - **Stale identity.** `.credentials.json` is inside the `~/.claude`\n *    DIRECTORY mount and propagates correctly, so a refreshed token reaches the\n *    container while `oauthAccount` in `.claude.json` does not. Current\n *    credentials, stale account, and Claude Code shows the login picker\n *    (alyve-host-1, 2026-09-21, ~9h50m across four agents).\n *  - **Corruption.** A container CANNOT rename onto its own file bind — it\n *    fails EBUSY (verified on agt-runtime; the same finding ENG-8854 recorded\n *    for `history.jsonl` on 2026-09-11) — so a container write falls back to\n *    truncate-in-place. Agents that booted together share one inode and tear\n *    each other's writes: \"Unexpected EOF\", and the 0-byte case at its limit\n *    (ENG-10140).\n *\n * Fleet evidence that the mount and not the concurrency is the cause: 39\n * corruptions across 18 containerised hosts / 61 agents, and ZERO across 5\n * non-containerised hosts / 17 agents — one of which runs seven agents against\n * that same path.\n *\n * ## The fix, and why it is this one\n *\n * `CLAUDE_CONFIG_DIR` relocates the whole config root, `.claude.json` included.\n * Verified on the `agt-runtime` image: with it set, Claude Code wrote\n * `.claude.json`, `backups/`, `projects/` and `sessions/` inside that directory,\n * and authenticated from a `.credentials.json` placed there.\n *\n * Pointing it at `~/.claude` moves `.claude.json` INSIDE the directory mount\n * that already works, and moves nothing else — `settings.json`, `plugins`,\n * `backups/` and `projects/` are already there. Both directions were then\n * verified from a production host with no code changed:\n *\n *     container renames a file inside a DIR mount  -> SUCCEEDED (213400 -> 213401)\n *     host renames it; running container re-reads  -> sees the new content, no respawn\n *\n * ## Why this module exists rather than a constant\n *\n * FIVE call sites computed this path independently — the spawn mount, the pair\n * flow, the device-state probe, the account fingerprint and the config-health\n * check. That is the same drift hazard {@link CLAUDE_MANAGED_SETTINGS_DIR} was\n * made a single source of truth for, and it is worse here: if the host writes\n * one path while containers read another, pairing silently stops reaching\n * agents. Every consumer resolves through here so they cannot disagree.\n */\n\nimport { constants, copyFileSync, existsSync, mkdirSync, renameSync, unlinkSync } from 'node:fs';\n/**\n * Path resolution is DELEGATED to core, not reimplemented here.\n *\n * `ensureWorkspaceTrusted` in core writes this file on the manager's tick, so\n * core needs the rule too. Two copies of it would drift, and the symptom would\n * be a write that succeeds into a file nothing reads. This module owns the\n * MIGRATION (seeding, readiness); core owns the PATH.\n */\nexport {\n  CLAUDE_CONFIG_DIR_ENV,\n  claudeConfigDirFor as claudeConfigDir,\n  claudeJsonPathFor as claudeJsonPath,\n  legacyClaudeJsonPathFor as legacyClaudeJsonPath,\n  effectiveClaudeJsonPath,\n  inspectClaudeConfig,\n  type ClaudeConfigState,\n} from '@augmented/core/provisioning/frameworks/claudecode/config-location.js';\nimport {\n  claudeConfigDirFor as claudeConfigDir,\n  claudeJsonPathFor as claudeJsonPath,\n  legacyClaudeJsonPathFor as legacyClaudeJsonPath,\n  claudeConfigMtimeMs,\n  inspectClaudeConfig,\n} from '@augmented/core/provisioning/frameworks/claudecode/config-location.js';\n\nexport type SeedOutcome =\n  /** The config dir already holds a usable `.claude.json`; nothing to do. */\n  | 'already-present'\n  /** Copied from the legacy path. */\n  | 'seeded'\n  /**\n   * The legacy file was NEWER and usable, so it was copied forward over an\n   * existing target. This is the `claude /login` recovery path — see the\n   * docblock on {@link seedClaudeConfigFromLegacy}.\n   */\n  | 'reseeded-from-newer-legacy'\n  /** Neither location has one — a never-paired host. Claude Code will create it. */\n  | 'absent'\n  /** The legacy file exists but is not usable; deliberately NOT copied. */\n  | 'legacy-unusable'\n  /** The copy itself failed. */\n  | 'failed';\n\n/**\n * Move the host onto the new location, once.\n *\n * **Ordering is the whole risk of this change.** If a container is handed\n * `CLAUDE_CONFIG_DIR` before the file exists there, Claude Code creates a fresh\n * one: credentials still resolve (they are already in the config dir) but\n * `oauthAccount` and `hasCompletedOnboarding` are gone, which is the login\n * picker — the exact outage this change exists to prevent, caused by the fix.\n * So this MUST run before the first spawn that uses the new path, and the\n * caller must treat a non-seed as a reason not to proceed.\n *\n * The copy is atomic by temp-then-rename INSIDE the destination directory, so a\n * crash mid-write cannot leave a truncated config where agents will read one —\n * the same property `.mcp.json` got in ENG-4787 and `.claude.json` never had.\n *\n * A legacy file that does not parse is NOT copied. Propagating a corrupt config\n * to the new location would migrate the incident along with the data, and the\n * corrupt original is exactly what the old mount was producing.\n */\nexport function seedClaudeConfigFromLegacy(opts: {\n  homeDir?: string;\n  env?: NodeJS.ProcessEnv;\n  log?: (msg: string) => void;\n} = {}): SeedOutcome {\n  const env = opts.env ?? process.env;\n  const log = opts.log ?? (() => {});\n  const target = claudeJsonPath(opts.homeDir, env);\n  const legacy = legacyClaudeJsonPath(opts.homeDir, env);\n\n  if (target === legacy) return 'already-present';\n\n  try {\n    const targetState = inspectClaudeConfig(target);\n    const legacyState = inspectClaudeConfig(legacy);\n\n    // ENG-10869: NOT `existsSync(target)`.\n    //\n    // The one-shot existence test was wrong in both directions. A file that\n    // merely exists can be account-less — `ensureWorkspaceTrusted` creates\n    // exactly such a file — so the seed would skip, the spawn would drop the\n    // legacy bind on a config no agent can start from, and every agent on the\n    // host would sit on the login picker. And once the target existed, a LATER\n    // write to the legacy path could never be picked up, which silently broke\n    // the documented recovery: `agt host pair` and the manager's own\n    // blocked-agent message both tell an operator to run `claude /login`, and a\n    // plain shell has no CLAUDE_CONFIG_DIR, so that writes the LEGACY file. The\n    // seed said `already-present`, the fresh account never reached an agent,\n    // and the archive step then renamed the operator's new config aside — once\n    // per re-login, with Claude Code reporting a successful login each time.\n    if (targetState === 'symlink') {\n      log(\n        `[claude-config] ${target} is a SYMLINK — refusing to seed through it. ` +\n          `Remove it on the host; a config that an agent can replace with a link is not one we write to.`,\n      );\n      return 'failed';\n    }\n\n    const legacyUsable = legacyState === 'usable';\n    const targetUsable = targetState === 'usable';\n    // A legacy file written AFTER the target is the recovery case above.\n    const legacyIsNewer = claudeConfigMtimeMs(legacy) > claudeConfigMtimeMs(target);\n\n    if (targetUsable && !(legacyUsable && legacyIsNewer)) return 'already-present';\n\n    if (legacyState === 'missing') {\n      log(`[claude-config] no legacy ${legacy} to seed from — Claude Code will create ${target}`);\n      return 'absent';\n    }\n    if (!legacyUsable) {\n      log(\n        `[claude-config] legacy ${legacy} is ${legacyState} — NOT seeding. ` +\n          `Re-pair the host, then the next spawn seeds a good file.`,\n      );\n      return 'legacy-unusable';\n    }\n    const reseeding = targetUsable;\n    if (reseeding) {\n      log(\n        `[claude-config] legacy ${legacy} is NEWER than ${target} and carries an account — ` +\n          `copying it forward (an operator ran 'claude /login' outside the config dir)`,\n      );\n    }\n\n    mkdirSync(claudeConfigDir(opts.homeDir, env), { recursive: true });\n    const tmp = `${target}.seed-${process.pid}`;\n    try {\n      // ENG-10869 security: COPYFILE_EXCL, for the same reason the trust\n      // writer uses `wx`. This destination sits in a directory the agent can\n      // write, and the manager runs outside the container — a pre-planted\n      // symlink here would have the manager copy the config through it onto an\n      // arbitrary host file. EXCL fails with EEXIST rather than following.\n      copyFileSync(legacy, tmp, constants.COPYFILE_EXCL);\n      renameSync(tmp, target);\n    } catch (err) {\n      try {\n        if (existsSync(tmp)) unlinkSync(tmp);\n      } catch {\n        // Best effort; a stray .seed-<pid> is inert.\n      }\n      throw err;\n    }\n    log(`[claude-config] seeded ${target} from ${legacy}`);\n    return reseeding ? 'reseeded-from-newer-legacy' : 'seeded';\n  } catch (err) {\n    log(`[claude-config] seeding ${target} failed: ${(err as Error).message}`);\n    return 'failed';\n  }\n}\n\n/**\n * True when the config dir holds a usable `.claude.json` — i.e. it is safe to\n * spawn against the new location.\n *\n * Deliberately more than a stat, and more than a parse. The failures this gates\n * are an agent starting against a config that is truncated (indistinguishable\n * from a healthy one by size or mtime) AND one that parses but carries no\n * account — the shape `ensureWorkspaceTrusted` creates, which would otherwise\n * let this fix's own writer manufacture a config that looks ready and sends\n * every agent on the host to the login picker. See {@link inspectClaudeConfig}.\n */\nexport function claudeConfigDirIsReady(\n  homeDir?: string,\n  env: NodeJS.ProcessEnv = process.env,\n): boolean {\n  return inspectClaudeConfig(claudeJsonPath(homeDir, env)) === 'usable';\n}\n\nexport type ArchiveOutcome =\n  /** Legacy file moved aside; a rolled-back manager will now fail LOUDLY. */\n  | 'archived'\n  /** Nothing at the legacy path — already migrated, or never paired. */\n  | 'nothing-to-archive'\n  /** Refused: the new location is not proven good, so the legacy file is the only copy. */\n  | 'refused-target-not-ready'\n  /**\n   * Refused: the legacy file is NEWER than the target, so it is somebody's\n   * fresh `claude /login` and archiving it would throw away the recovery.\n   */\n  | 'refused-legacy-newer'\n  | 'failed';\n\n/**\n * ENG-10869 — make a CLI rollback fail loudly instead of quietly serving a\n * stale account.\n *\n * ## The hazard this closes\n *\n * After the migration, every write goes to `<configDir>/.claude.json` and the\n * legacy `<home>/.claude.json` is frozen at whatever it held on migration day.\n * Nothing syncs it. So a manager rolled back to a build without\n * `CLAUDE_CONFIG_DIR` would bind that stale file into every container and the\n * fleet would come up on a *plausible* config — the right shape, the right\n * keys, and an `oauthAccount` that may be several re-pairings out of date.\n *\n * That is a false-green: agents start, health reads fine, and they are\n * authenticated as the wrong account or not at all. Moving the file aside\n * converts it into `CLAUDE LOGIN REQUIRED`, which the manager already detects,\n * logs by name and surfaces — an outage that says what it is, and is one `mv`\n * from being undone.\n *\n * ## Why it refuses unless the target is ready\n *\n * Until the seed has landed and parsed, the legacy file is the ONLY copy of the\n * host's identity. Archiving first and seeding second would be a window in\n * which a crash loses the account outright.\n *\n * ## Why it renames rather than deletes\n *\n * The archived name is dated and predictable, so recovery is a rename and the\n * log line says so. Deleting would make the rollback path unrecoverable, which\n * is a worse trade than the one being fixed.\n */\nexport function archiveLegacyClaudeJson(opts: {\n  homeDir?: string;\n  env?: NodeJS.ProcessEnv;\n  log?: (msg: string) => void;\n  now?: () => Date;\n} = {}): ArchiveOutcome {\n  const env = opts.env ?? process.env;\n  const log = opts.log ?? (() => {});\n  const legacy = legacyClaudeJsonPath(opts.homeDir, env);\n  const target = claudeJsonPath(opts.homeDir, env);\n\n  if (target === legacy) return 'nothing-to-archive';\n\n  try {\n    if (!existsSync(legacy)) return 'nothing-to-archive';\n    if (!claudeConfigDirIsReady(opts.homeDir, env)) {\n      // The legacy file is the only usable copy. Leave it exactly where a\n      // rolled-back manager, and the current one, can still find it.\n      log(\n        `[claude-config] NOT archiving ${legacy} — ${target} is absent or does not parse, ` +\n          `so the legacy file is still the only usable config`,\n      );\n      return 'refused-target-not-ready';\n    }\n    // ENG-10869: a legacy file NEWER than the target is an operator's fresh\n    // `claude /login`, not a stale leftover. The seed above copies it forward;\n    // if that has not happened yet, archiving here would rename the only copy\n    // of a just-created account aside — repeatedly, once per re-login, while\n    // Claude Code reported each login as successful.\n    if (claudeConfigMtimeMs(legacy) > claudeConfigMtimeMs(target)) {\n      log(\n        `[claude-config] NOT archiving ${legacy} — it is NEWER than ${target}, so it is a fresh login ` +\n          `that has not been copied forward yet`,\n      );\n      return 'refused-legacy-newer';\n    }\n\n    const stamp = (opts.now?.() ?? new Date()).toISOString().replace(/[:.]/g, '-');\n    const archived = `${legacy}.pre-eng10869-${stamp}`;\n    renameSync(legacy, archived);\n    log(\n      `[claude-config] archived ${legacy} -> ${archived}. ` +\n        `Config now lives at ${target}. To undo a CLI rollback: mv '${archived}' '${legacy}'`,\n    );\n    return 'archived';\n  } catch (err) {\n    log(`[claude-config] archiving ${legacy} failed: ${(err as Error).message}`);\n    return 'failed';\n  }\n}\n\n"],"mappings":";AAqBA,SAAS,WAAW,oBAAoB;AACxC,SAAS,eAAe;AACxB,SAAS,YAAY;AAGd,IAAM,wBAAwB;AAU/B,SAAU,mBACd,SACA,MAAyB,QAAQ,KAAG;AAEpC,QAAM,WAAW,IAAI,qBAAqB,GAAG,KAAI;AACjD,MAAI;AAAU,WAAO;AACrB,SAAO,KAAK,WAAW,IAAI,MAAM,KAAI,KAAM,QAAO,GAAI,SAAS;AACjE;AAGM,SAAU,kBAAkB,SAAkB,MAAyB,QAAQ,KAAG;AACtF,SAAO,KAAK,mBAAmB,SAAS,GAAG,GAAG,cAAc;AAC9D;AAOM,SAAU,wBACd,SACA,MAAyB,QAAQ,KAAG;AAEpC,SAAO,KAAK,WAAW,IAAI,MAAM,KAAI,KAAM,QAAO,GAAI,cAAc;AACtE;AA6EM,SAAU,oBAAoB,MAAY;AAC9C,MAAI;AACJ,MAAI;AACF,WAAO,UAAU,IAAI;EACvB,QAAQ;AACN,WAAO;EACT;AAEA,MAAI,KAAK,eAAc;AAAI,WAAO;AAClC,MAAI,CAAC,KAAK,OAAM;AAAI,WAAO;AAC3B,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,aAAa,MAAM,OAAO,CAAC;EACjD,QAAQ;AACN,WAAO;EACT;AACA,MAAI,OAAO,WAAW,YAAY,WAAW;AAAM,WAAO;AAC1D,QAAM,SAAS;AAIf,SAAO,OAAO,wBAAwB,MAAM,OAAO,WAAW;AAChE;AAGM,SAAU,oBAAoB,MAAY;AAC9C,MAAI;AACF,UAAM,OAAO,UAAU,IAAI;AAC3B,WAAO,KAAK,OAAM,IAAK,KAAK,UAAU;EACxC,QAAQ;AACN,WAAO;EACT;AACF;AAmBM,SAAU,wBACd,SACA,MAAyB,QAAQ,KAAG;AAEpC,QAAM,cAAc,kBAAkB,SAAS,GAAG;AAClD,MAAI,oBAAoB,WAAW,MAAM;AAAU,WAAO;AAC1D,SAAO,wBAAwB,SAAS,GAAG;AAC7C;;;ACxIA,SAAS,WAAW,cAAc,YAAY,WAAW,YAAY,kBAAkB;AA+DhF,SAAS,2BAA2B,OAIvC,CAAC,GAAgB;AACnB,QAAM,MAAM,KAAK,OAAO,QAAQ;AAChC,QAAM,MAAM,KAAK,QAAQ,MAAM;AAAA,EAAC;AAChC,QAAM,SAAS,kBAAe,KAAK,SAAS,GAAG;AAC/C,QAAM,SAAS,wBAAqB,KAAK,SAAS,GAAG;AAErD,MAAI,WAAW,OAAQ,QAAO;AAE9B,MAAI;AACF,UAAM,cAAc,oBAAoB,MAAM;AAC9C,UAAM,cAAc,oBAAoB,MAAM;AAgB9C,QAAI,gBAAgB,WAAW;AAC7B;AAAA,QACE,mBAAmB,MAAM;AAAA,MAE3B;AACA,aAAO;AAAA,IACT;AAEA,UAAM,eAAe,gBAAgB;AACrC,UAAM,eAAe,gBAAgB;AAErC,UAAM,gBAAgB,oBAAoB,MAAM,IAAI,oBAAoB,MAAM;AAE9E,QAAI,gBAAgB,EAAE,gBAAgB,eAAgB,QAAO;AAE7D,QAAI,gBAAgB,WAAW;AAC7B,UAAI,6BAA6B,MAAM,gDAA2C,MAAM,EAAE;AAC1F,aAAO;AAAA,IACT;AACA,QAAI,CAAC,cAAc;AACjB;AAAA,QACE,0BAA0B,MAAM,OAAO,WAAW;AAAA,MAEpD;AACA,aAAO;AAAA,IACT;AACA,UAAM,YAAY;AAClB,QAAI,WAAW;AACb;AAAA,QACE,0BAA0B,MAAM,kBAAkB,MAAM;AAAA,MAE1D;AAAA,IACF;AAEA,cAAU,mBAAgB,KAAK,SAAS,GAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AACjE,UAAM,MAAM,GAAG,MAAM,SAAS,QAAQ,GAAG;AACzC,QAAI;AAMF,mBAAa,QAAQ,KAAK,UAAU,aAAa;AACjD,iBAAW,KAAK,MAAM;AAAA,IACxB,SAAS,KAAK;AACZ,UAAI;AACF,YAAI,WAAW,GAAG,EAAG,YAAW,GAAG;AAAA,MACrC,QAAQ;AAAA,MAER;AACA,YAAM;AAAA,IACR;AACA,QAAI,0BAA0B,MAAM,SAAS,MAAM,EAAE;AACrD,WAAO,YAAY,+BAA+B;AAAA,EACpD,SAAS,KAAK;AACZ,QAAI,2BAA2B,MAAM,YAAa,IAAc,OAAO,EAAE;AACzE,WAAO;AAAA,EACT;AACF;AAaO,SAAS,uBACd,SACA,MAAyB,QAAQ,KACxB;AACT,SAAO,oBAAoB,kBAAe,SAAS,GAAG,CAAC,MAAM;AAC/D;AA+CO,SAAS,wBAAwB,OAKpC,CAAC,GAAmB;AACtB,QAAM,MAAM,KAAK,OAAO,QAAQ;AAChC,QAAM,MAAM,KAAK,QAAQ,MAAM;AAAA,EAAC;AAChC,QAAM,SAAS,wBAAqB,KAAK,SAAS,GAAG;AACrD,QAAM,SAAS,kBAAe,KAAK,SAAS,GAAG;AAE/C,MAAI,WAAW,OAAQ,QAAO;AAE9B,MAAI;AACF,QAAI,CAAC,WAAW,MAAM,EAAG,QAAO;AAChC,QAAI,CAAC,uBAAuB,KAAK,SAAS,GAAG,GAAG;AAG9C;AAAA,QACE,iCAAiC,MAAM,WAAM,MAAM;AAAA,MAErD;AACA,aAAO;AAAA,IACT;AAMA,QAAI,oBAAoB,MAAM,IAAI,oBAAoB,MAAM,GAAG;AAC7D;AAAA,QACE,iCAAiC,MAAM,4BAAuB,MAAM;AAAA,MAEtE;AACA,aAAO;AAAA,IACT;AAEA,UAAM,SAAS,KAAK,MAAM,KAAK,oBAAI,KAAK,GAAG,YAAY,EAAE,QAAQ,SAAS,GAAG;AAC7E,UAAM,WAAW,GAAG,MAAM,iBAAiB,KAAK;AAChD,eAAW,QAAQ,QAAQ;AAC3B;AAAA,MACE,4BAA4B,MAAM,OAAO,QAAQ,yBACxB,MAAM,iCAAiC,QAAQ,MAAM,MAAM;AAAA,IACtF;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,6BAA6B,MAAM,YAAa,IAAc,OAAO,EAAE;AAC3E,WAAO;AAAA,EACT;AACF;","names":[]}