@kalphq/cli 0.0.0-dev-20260512233019 → 0.0.0-dev-20260513001643

package/dist/runtime-template/worker-entry.js

@@ -1,7 +1,10 @@
 import { DurableObject } from "cloudflare:workers";
 import { Hono } from "hono";
 import { deleteCookie, getSignedCookie, setSignedCookie } from "hono/cookie";
+import { createRemoteJWKSet, jwtVerify } from "jose";
 import agentsSnapshot from "./agents.snapshot.json";
+import identityConfig from "./identity.config.json";
+import mapIdentity from "./identity.map.mjs";
 
 const SESSION_COOKIE_NAME = "kalp_studio_session";
 const SESSION_MAX_AGE_SECONDS = 60 * 60 * 8;
@@ -10,6 +13,71 @@ const CORS_HEADERS = {
   "Access-Control-Allow-Methods": "GET, POST, PUT, PATCH, DELETE, OPTIONS",
   "Access-Control-Allow-Headers": "Content-Type, Authorization",
 };
+const JWKS_RESOLVER_CACHE = new Map();
+
+function extractBearerToken(authorization) {
+  if (!authorization) return null;
+  const value = authorization.trim();
+  if (!value) return null;
+  const match = value.match(/^Bearer\s+(.+)$/i);
+  if (!match || !match[1]) return null;
+  const token = match[1].trim();
+  return token || null;
+}
+
+function normalizeHeaderRecord(request) {
+  const headers = {};
+  for (const [key, value] of request.headers.entries()) {
+    headers[key.toLowerCase()] = value;
+  }
+  return headers;
+}
+
+function toMappedIdentity(payload, request) {
+  const rawHeaders = normalizeHeaderRecord(request);
+  try {
+    const mapped = mapIdentity(payload, rawHeaders);
+    if (
+      mapped &&
+      typeof mapped === "object" &&
+      typeof mapped.userId === "string" &&
+      mapped.userId.length > 0
+    ) {
+      return {
+        userId: mapped.userId,
+        email: mapped.email,
+        name: mapped.name,
+        claims:
+          mapped.claims && typeof mapped.claims === "object" ? mapped.claims : {},
+      };
+    }
+  } catch {}
+
+  const sub =
+    payload && typeof payload === "object" && typeof payload.sub === "string"
+      ? payload.sub
+      : "anonymous";
+  return { userId: sub, claims: {} };
+}
+
+function resolveSymmetricSecret(env, secretEnvKey) {
+  const key = secretEnvKey && secretEnvKey.trim() ? secretEnvKey.trim() : "JWT_SIGNING_SECRET";
+  const selected = env[key];
+  if (typeof selected === "string" && selected.trim()) return selected.trim();
+  if (key !== "JWT_SIGNING_SECRET") {
+    const fallback = env.JWT_SIGNING_SECRET;
+    if (typeof fallback === "string" && fallback.trim()) return fallback.trim();
+  }
+  return null;
+}
+
+function getJwksResolver(jwksUrl) {
+  const cached = JWKS_RESOLVER_CACHE.get(jwksUrl);
+  if (cached) return cached;
+  const resolver = createRemoteJWKSet(new URL(jwksUrl));
+  JWKS_RESOLVER_CACHE.set(jwksUrl, resolver);
+  return resolver;
+}
 
 function withCors(response) {
   if (response.status === 101) return response;
@@ -92,6 +160,78 @@ async function requireSession(c, next) {
   return next();
 }
 
+async function verifyGatewayAuth(c) {
+  const enforce = identityConfig?.enforceGlobalAuth !== false;
+  if (!enforce) {
+    return { userId: "anonymous", claims: {}, providerId: "none" };
+  }
+
+  const token = extractBearerToken(c.req.header("Authorization"));
+
+  const serviceKey = c.env.KALP_SERVICE_KEY?.trim();
+  if (serviceKey && token && token === serviceKey) {
+    return {
+      userId: "service-admin",
+      providerId: "service-key",
+      claims: { role: "service_admin", service: true },
+    };
+  }
+
+  const strategy = identityConfig?.strategy;
+  if (!strategy) return null;
+
+  try {
+    if (strategy.type === "jwks") {
+      if (!token) return null;
+      if (!strategy.jwksUrl) return null;
+      const resolver = getJwksResolver(strategy.jwksUrl);
+      const options = {};
+      if (strategy.issuer) options.issuer = strategy.issuer;
+      if (strategy.audience) options.audience = strategy.audience;
+      const { payload } = await jwtVerify(token, resolver, options);
+      return {
+        ...toMappedIdentity(payload, c.req.raw),
+        providerId: identityConfig.identityId ?? "identity",
+      };
+    }
+
+    if (strategy.type === "symmetric") {
+      if (!token) return null;
+      const secret = resolveSymmetricSecret(c.env, strategy.secretEnvKey);
+      if (!secret) return null;
+      const encoded = new TextEncoder().encode(secret);
+      const { payload } = await jwtVerify(token, encoded, {
+        algorithms: ["HS256"],
+      });
+      return {
+        ...toMappedIdentity(payload, c.req.raw),
+        providerId: identityConfig.identityId ?? "identity",
+      };
+    }
+
+    if (strategy.type === "apiKey") {
+      const headerName = (strategy.headerName || "x-api-key").toLowerCase();
+      const envKey = strategy.envKey || "KALP_API_KEY";
+      const expected =
+        typeof c.env[envKey] === "string" ? c.env[envKey].trim() : "";
+      if (!expected) return null;
+      const provided =
+        c.req.header(headerName)?.trim() ??
+        (headerName === "authorization" ? token : null);
+      if (!provided || provided !== expected) return null;
+      return {
+        userId: "api-key-client",
+        providerId: identityConfig.identityId ?? "identity",
+        claims: { role: "api_key" },
+      };
+    }
+  } catch {
+    return null;
+  }
+
+  return null;
+}
+
 function mapIndexToStudioAgents(entries) {
   return entries.map((entry) => ({
     name: entry.name,
@@ -124,6 +264,16 @@ async function readLatestManifest(env, agentName) {
   }
 }
 
+async function resolveAgentAccess(env, agentName, routeKey) {
+  const manifest = await readLatestManifest(env, agentName);
+  const metadata = manifest?.metadata || {};
+  const routePublic = metadata.routesPublic
+    ? metadata.routesPublic[routeKey]
+    : undefined;
+  const agentPublic = metadata.public ?? false;
+  return { isPublic: routePublic !== undefined ? routePublic : agentPublic };
+}
+
 export class AgentDurableObject extends DurableObject {
   constructor(ctx, env) {
     super(ctx, env);
@@ -216,9 +366,19 @@ function getAgentRouting(url) {
   };
 }
 
-async function forwardToAgentDO(request, env) {
+async function forwardToAgentDO(c, request, env) {
   const url = new URL(request.url);
   const { agentName, passthroughPath } = getAgentRouting(url);
+  const routeKey = `${request.method.toUpperCase()}:${passthroughPath === "/" ? "/" : passthroughPath}`;
+  const access = await resolveAgentAccess(env, agentName, routeKey);
+  let identity = null;
+  if (!access.isPublic) {
+    identity = await verifyGatewayAuth(c);
+    if (!identity) {
+      return c.json({ ok: false, error: "Unauthorized" }, 401);
+    }
+  }
+
   const id = env.KALP_RUNTIME_CLOUDFLARE.idFromName(agentName);
   const stub = env.KALP_RUNTIME_CLOUDFLARE.get(id);
 
@@ -226,6 +386,12 @@ async function forwardToAgentDO(request, env) {
   proxiedUrl.pathname = passthroughPath === "/" ? "/" : passthroughPath;
   const headers = new Headers(request.headers);
   headers.set("x-kalp-agent-name", agentName);
+  headers.set("x-kalp-route-public", String(access.isPublic));
+  if (identity && identity.userId) {
+    headers.set("x-kalp-auth-user-id", identity.userId);
+    headers.set("x-kalp-auth-provider-id", identity.providerId ?? "identity");
+    headers.set("x-kalp-auth-claims", JSON.stringify(identity.claims ?? {}));
+  }
 
   const proxyRequest = new Request(proxiedUrl.toString(), {
     method: request.method,
@@ -376,11 +542,11 @@ app.get("/api/internal/events/:executionId", (c) => {
 });
 
 app.all("/a/:agentName/*", async (c) => {
-  return forwardToAgentDO(c.req.raw, c.env);
+  return forwardToAgentDO(c, c.req.raw, c.env);
 });
 
 app.all("/a/:agentName", async (c) => {
-  return forwardToAgentDO(c.req.raw, c.env);
+  return forwardToAgentDO(c, c.req.raw, c.env);
 });
 
 app.get("/studio", (c) => c.redirect("/studio/", 308));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@kalphq/cli",
-  "version": "0.0.0-dev-20260512233019",
+  "version": "0.0.0-dev-20260513001643",
   "description": "Zero-config CLI for deploying Kalp agents",
   "type": "module",
   "license": "MIT",
@@ -27,9 +27,9 @@
     "open": "^11.0.0",
     "picocolors": "1.1.1",
     "zod": "3.25.76",
-    "@kalphq/compiler": "0.0.0-dev-20260512233019",
-    "@kalphq/project": "0.0.0-dev-20260512233019",
-    "@kalphq/sdk": "0.0.0-dev-20260512233019"
+    "@kalphq/compiler": "0.0.0-dev-20260513001643",
+    "@kalphq/sdk": "0.0.0-dev-20260513001643",
+    "@kalphq/project": "0.0.0-dev-20260513001643"
   },
   "devDependencies": {
     "@types/json-stable-stringify": "1.2.0",

package/dist/chunk-6WQW3UVW.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/utils/deploy.ts","../src/utils/ai.ts"],"sourcesContent":["import { readFile, writeFile } from \"node:fs/promises\";\nimport { createHash } from \"node:crypto\";\nimport { execa } from \"execa\";\nimport { requireAuth } from \"@/utils/auth\";\nimport { ensureStudioSecrets } from \"@/utils/secret\";\nimport { readProjectState, writeProjectState } from \"@/utils/project-state\";\nimport { materializeRuntime } from \"@/utils/runtime\";\nimport {\n  getRequiredSecretForProvider,\n  readDotEnv,\n  resolveProviderFromConfig,\n} from \"@/utils/ai\";\nimport { resolveProvider } from \"@/utils/providers\";\n\nfunction findWorkersUrl(output: string): string | null {\n  const match = output.match(/https:\\/\\/[^\\s]+\\.workers\\.dev/);\n  return match?.[0] ?? null;\n}\n\ninterface RuntimeWranglerConfig {\n  name?: string;\n  kv_namespaces?: Array<{ binding: string; id?: string }>;\n}\n\ninterface KvNamespaceInfo {\n  id: string;\n  title: string;\n}\n\nasync function readWranglerConfig(\n  configPath: string,\n): Promise<RuntimeWranglerConfig> {\n  const text = await readFile(configPath, \"utf-8\");\n  return JSON.parse(text) as RuntimeWranglerConfig;\n}\n\nasync function writeWranglerConfig(\n  configPath: string,\n  config: RuntimeWranglerConfig,\n): Promise<void> {\n  await writeFile(configPath, `${JSON.stringify(config, null, 2)}\\n`, \"utf-8\");\n}\n\nfunction deriveKvNamespaceTitle(workerName: string, binding: string): string {\n  return `${workerName}-${binding.toLowerCase().replace(/_/g, \"-\")}`;\n}\n\nfunction parseKvListOutput(stdout: string): KvNamespaceInfo[] {\n  const trimmed = stdout.trim();\n  if (!trimmed) return [];\n\n  try {\n    const parsed = JSON.parse(trimmed);\n    if (Array.isArray(parsed)) {\n      return parsed\n        .map((item) => ({\n          id: String((item as { id?: string }).id ?? \"\"),\n          title: String((item as { title?: string }).title ?? \"\"),\n        }))\n        .filter((item) => !!item.id && !!item.title);\n    }\n  } catch {\n    // fallback to text parsing below\n  }\n\n  const matches = trimmed.match(/[a-f0-9]{32}\\s+[^\\r\\n]+/gi) ?? [];\n  return matches\n    .map((line) => {\n      const [id, ...rest] = line.trim().split(/\\s+/g);\n      return { id: id ?? \"\", title: rest.join(\" \") };\n    })\n    .filter((item) => !!item.id && !!item.title);\n}\n\nasync function listKvNamespaces(\n  cwd: string,\n  configPath: string,\n): Promise<KvNamespaceInfo[]> {\n  const provider = resolveProvider();\n  const namespaces = await provider.listNamespaces({ cwd, configPath });\n  return namespaces.map((item) => ({\n    id: item.id,\n    title: item.title,\n  }));\n}\n\nasync function ensureKvNamespaceBindingId(\n  cwd: string,\n  configPath: string,\n): Promise<string | null> {\n  const config = await readWranglerConfig(configPath);\n  const binding = config.kv_namespaces?.find(\n    (item) => item.binding === \"KALP_MANIFESTS\",\n  );\n\n  if (!binding || !config.name) return null;\n  if (binding.id) return binding.id;\n\n  const expectedTitle = deriveKvNamespaceTitle(config.name, binding.binding);\n  const namespaces = await listKvNamespaces(cwd, configPath);\n  const existing = namespaces.find((item) => item.title === expectedTitle);\n  if (!existing) return null;\n\n  binding.id = existing.id;\n  await writeWranglerConfig(configPath, config);\n  return existing.id;\n}\n\nfunction isNamespaceAlreadyExistsError(output: string): boolean {\n  return output.includes(\"[code: 10014]\") && output.includes(\"already exists\");\n}\n\nasync function resolveWorkerUrl(\n  configPath: string,\n  deployOutput: string,\n): Promise<string> {\n  const fromOutput = findWorkersUrl(deployOutput);\n  if (fromOutput) return fromOutput;\n\n  const configText = await readFile(configPath, \"utf-8\").catch(\n    () => null as string | null,\n  );\n  const workerName = configText?.match(/\"name\"\\s*:\\s*\"([^\"]+)\"/)?.[1];\n\n  if (workerName) {\n    return `https://${workerName}.workers.dev`;\n  }\n\n  throw new Error(\"Could not resolve worker URL from wrangler deploy output.\");\n}\n\nexport async function runInitialDeploy(cwd: string): Promise<{\n  workerUrl: string;\n  customDomains: string[];\n  accountId: string;\n  studioAdminUser: string;\n  studioPassword: string;\n  credentialsChanged: boolean;\n}> {\n  const auth = await requireAuth();\n  const aiProvider = await resolveProviderFromConfig(cwd);\n  const requiredProviderSecret = getRequiredSecretForProvider(aiProvider);\n  const envMap = await readDotEnv(cwd);\n  const providerSecretValue = envMap[requiredProviderSecret]?.trim();\n  if (!providerSecretValue) {\n    throw new Error(\n      `Missing required secret ${requiredProviderSecret} for provider \"${aiProvider}\". Add it to .env before deploy.`,\n    );\n  }\n\n  const secrets = await ensureStudioSecrets(cwd);\n  const runtimeProvider = resolveProvider();\n  const runtime = await materializeRuntime(cwd);\n  let secretSyncFailed = false;\n  const secretEntries = [\n    [\"KALP_SECRET_KEY\", secrets.key],\n    [\"KALP_STUDIO_PASSWORD\", secrets.studioPassword],\n    [\"KALP_STUDIO_ADMIN_USER\", secrets.studioAdminUser],\n    [requiredProviderSecret, providerSecretValue],\n  ] as const;\n\n  for (const [name, value] of secretEntries) {\n    try {\n      await runtimeProvider.putSecret({\n        cwd,\n        configPath: runtime.wranglerConfigPath,\n        name,\n        value,\n      });\n    } catch {\n      secretSyncFailed = true;\n      break;\n    }\n  }\n\n  await ensureKvNamespaceBindingId(cwd, runtime.wranglerConfigPath).catch(\n    () => null,\n  );\n\n  const deployArgs = secretSyncFailed\n    ? [\n        \"wrangler\",\n        \"deploy\",\n        \"--config\",\n        runtime.wranglerConfigPath,\n        \"--secrets-file\",\n        \".env\",\n      ]\n    : [\"wrangler\", \"deploy\", \"--config\", runtime.wranglerConfigPath];\n\n  let deploy = await runtimeProvider\n    .deployRuntime({\n      cwd,\n      configPath: runtime.wranglerConfigPath,\n      useSecretsFile: secretSyncFailed,\n    })\n    .catch((error) => error);\n  if (deploy instanceof Error) {\n    const combined = deploy.message;\n    if (isNamespaceAlreadyExistsError(combined)) {\n      await ensureKvNamespaceBindingId(cwd, runtime.wranglerConfigPath);\n      deploy = await runtimeProvider.deployRuntime({\n        cwd,\n        configPath: runtime.wranglerConfigPath,\n        useSecretsFile: secretSyncFailed,\n      });\n    } else {\n      throw deploy;\n    }\n  }\n\n  const workerUrl = deploy.workerUrl;\n  const customDomains = deploy.customDomains ?? [];\n\n  const existingState = await readProjectState(cwd);\n\n  const credentialsFingerprint = createHash(\"sha256\")\n    .update(`${secrets.studioAdminUser}:${secrets.studioPassword}`)\n    .digest(\"hex\");\n  const credentialsChanged =\n    existingState?.studioCredentialsFingerprint !== credentialsFingerprint;\n\n  await writeProjectState(cwd, {\n    workerUrl,\n    deployedAt: new Date().toISOString(),\n    accountId: auth.accountId,\n    studioCredentialsFingerprint: credentialsFingerprint,\n    agents: existingState?.agents ?? {},\n  });\n\n  return {\n    workerUrl,\n    customDomains,\n    accountId: auth.accountId,\n    studioAdminUser: secrets.studioAdminUser,\n    studioPassword: secrets.studioPassword,\n    credentialsChanged,\n  };\n}\n","import { access, readFile } from \"node:fs/promises\";\nimport { constants } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { createJiti } from \"jiti\";\n\nexport type AIProvider = \"openai\" | \"anthropic\" | \"openrouter\" | \"custom\";\n\nconst PROVIDER_SECRET_MAP: Record<AIProvider, string> = {\n  openai: \"OPENAI_API_KEY\",\n  anthropic: \"ANTHROPIC_API_KEY\",\n  openrouter: \"OPENROUTER_API_KEY\",\n  custom: \"CUSTOM_AI_API_KEY\",\n};\n\nfunction parseEnv(content: string): Record<string, string> {\n  const env: Record<string, string> = {};\n  for (const raw of content.split(/\\r?\\n/g)) {\n    const line = raw.trim();\n    if (!line || line.startsWith(\"#\")) continue;\n    const idx = line.indexOf(\"=\");\n    if (idx <= 0) continue;\n    env[line.slice(0, idx).trim()] = line.slice(idx + 1);\n  }\n  return env;\n}\n\nexport async function resolveProviderFromConfig(cwd: string): Promise<AIProvider> {\n  const configPath = join(cwd, \"kalp.config.ts\");\n  await access(configPath, constants.F_OK);\n  const jiti = createJiti(cwd, { interopDefault: true });\n  const config = (await jiti.import(configPath)) as\n    | { default?: { ai?: { provider?: AIProvider } }; ai?: { provider?: AIProvider } }\n    | undefined;\n  const provider = config?.default?.ai?.provider ?? config?.ai?.provider ?? \"openai\";\n  return provider;\n}\n\nexport async function readDotEnv(cwd: string): Promise<Record<string, string>> {\n  const envPath = join(cwd, \".env\");\n  const content = await readFile(envPath, \"utf-8\").catch(() => \"\");\n  return parseEnv(content);\n}\n\nexport function getRequiredSecretForProvider(provider: AIProvider): string {\n  return PROVIDER_SECRET_MAP[provider];\n}\n"],"mappings":";;;;;;;;;;;;;;;AAAA,SAAS,YAAAA,WAAU,iBAAiB;AACpC,SAAS,kBAAkB;;;ACD3B,SAAS,QAAQ,gBAAgB;AACjC,SAAS,iBAAiB;AAC1B,SAAS,YAAY;AACrB,SAAS,kBAAkB;AAI3B,IAAM,sBAAkD;AAAA,EACtD,QAAQ;AAAA,EACR,WAAW;AAAA,EACX,YAAY;AAAA,EACZ,QAAQ;AACV;AAEA,SAAS,SAAS,SAAyC;AACzD,QAAM,MAA8B,CAAC;AACrC,aAAW,OAAO,QAAQ,MAAM,QAAQ,GAAG;AACzC,UAAM,OAAO,IAAI,KAAK;AACtB,QAAI,CAAC,QAAQ,KAAK,WAAW,GAAG,EAAG;AACnC,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,OAAO,EAAG;AACd,QAAI,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK,CAAC,IAAI,KAAK,MAAM,MAAM,CAAC;AAAA,EACrD;AACA,SAAO;AACT;AAEA,eAAsB,0BAA0B,KAAkC;AAChF,QAAM,aAAa,KAAK,KAAK,gBAAgB;AAC7C,QAAM,OAAO,YAAY,UAAU,IAAI;AACvC,QAAM,OAAO,WAAW,KAAK,EAAE,gBAAgB,KAAK,CAAC;AACrD,QAAM,SAAU,MAAM,KAAK,OAAO,UAAU;AAG5C,QAAM,WAAW,QAAQ,SAAS,IAAI,YAAY,QAAQ,IAAI,YAAY;AAC1E,SAAO;AACT;AAEA,eAAsB,WAAW,KAA8C;AAC7E,QAAM,UAAU,KAAK,KAAK,MAAM;AAChC,QAAM,UAAU,MAAM,SAAS,SAAS,OAAO,EAAE,MAAM,MAAM,EAAE;AAC/D,SAAO,SAAS,OAAO;AACzB;AAEO,SAAS,6BAA6B,UAA8B;AACzE,SAAO,oBAAoB,QAAQ;AACrC;;;ADhBA,eAAe,mBACb,YACgC;AAChC,QAAM,OAAO,MAAMC,UAAS,YAAY,OAAO;AAC/C,SAAO,KAAK,MAAM,IAAI;AACxB;AAEA,eAAe,oBACb,YACA,QACe;AACf,QAAM,UAAU,YAAY,GAAG,KAAK,UAAU,QAAQ,MAAM,CAAC,CAAC;AAAA,GAAM,OAAO;AAC7E;AAEA,SAAS,uBAAuB,YAAoB,SAAyB;AAC3E,SAAO,GAAG,UAAU,IAAI,QAAQ,YAAY,EAAE,QAAQ,MAAM,GAAG,CAAC;AAClE;AA6BA,eAAe,iBACb,KACA,YAC4B;AAC5B,QAAM,WAAW,gBAAgB;AACjC,QAAM,aAAa,MAAM,SAAS,eAAe,EAAE,KAAK,WAAW,CAAC;AACpE,SAAO,WAAW,IAAI,CAAC,UAAU;AAAA,IAC/B,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,EACd,EAAE;AACJ;AAEA,eAAe,2BACb,KACA,YACwB;AACxB,QAAM,SAAS,MAAM,mBAAmB,UAAU;AAClD,QAAM,UAAU,OAAO,eAAe;AAAA,IACpC,CAAC,SAAS,KAAK,YAAY;AAAA,EAC7B;AAEA,MAAI,CAAC,WAAW,CAAC,OAAO,KAAM,QAAO;AACrC,MAAI,QAAQ,GAAI,QAAO,QAAQ;AAE/B,QAAM,gBAAgB,uBAAuB,OAAO,MAAM,QAAQ,OAAO;AACzE,QAAM,aAAa,MAAM,iBAAiB,KAAK,UAAU;AACzD,QAAM,WAAW,WAAW,KAAK,CAAC,SAAS,KAAK,UAAU,aAAa;AACvE,MAAI,CAAC,SAAU,QAAO;AAEtB,UAAQ,KAAK,SAAS;AACtB,QAAM,oBAAoB,YAAY,MAAM;AAC5C,SAAO,SAAS;AAClB;AAEA,SAAS,8BAA8B,QAAyB;AAC9D,SAAO,OAAO,SAAS,eAAe,KAAK,OAAO,SAAS,gBAAgB;AAC7E;AAqBA,eAAsB,iBAAiB,KAOpC;AACD,QAAM,OAAO,MAAM,YAAY;AAC/B,QAAM,aAAa,MAAM,0BAA0B,GAAG;AACtD,QAAM,yBAAyB,6BAA6B,UAAU;AACtE,QAAM,SAAS,MAAM,WAAW,GAAG;AACnC,QAAM,sBAAsB,OAAO,sBAAsB,GAAG,KAAK;AACjE,MAAI,CAAC,qBAAqB;AACxB,UAAM,IAAI;AAAA,MACR,2BAA2B,sBAAsB,kBAAkB,UAAU;AAAA,IAC/E;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,oBAAoB,GAAG;AAC7C,QAAM,kBAAkB,gBAAgB;AACxC,QAAM,UAAU,MAAM,mBAAmB,GAAG;AAC5C,MAAI,mBAAmB;AACvB,QAAM,gBAAgB;AAAA,IACpB,CAAC,mBAAmB,QAAQ,GAAG;AAAA,IAC/B,CAAC,wBAAwB,QAAQ,cAAc;AAAA,IAC/C,CAAC,0BAA0B,QAAQ,eAAe;AAAA,IAClD,CAAC,wBAAwB,mBAAmB;AAAA,EAC9C;AAEA,aAAW,CAAC,MAAM,KAAK,KAAK,eAAe;AACzC,QAAI;AACF,YAAM,gBAAgB,UAAU;AAAA,QAC9B;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,yBAAmB;AACnB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,2BAA2B,KAAK,QAAQ,kBAAkB,EAAE;AAAA,IAChE,MAAM;AAAA,EACR;AAEA,QAAM,aAAa,mBACf;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA;AAAA,EACF,IACA,CAAC,YAAY,UAAU,YAAY,QAAQ,kBAAkB;AAEjE,MAAI,SAAS,MAAM,gBAChB,cAAc;AAAA,IACb;AAAA,IACA,YAAY,QAAQ;AAAA,IACpB,gBAAgB;AAAA,EAClB,CAAC,EACA,MAAM,CAAC,UAAU,KAAK;AACzB,MAAI,kBAAkB,OAAO;AAC3B,UAAM,WAAW,OAAO;AACxB,QAAI,8BAA8B,QAAQ,GAAG;AAC3C,YAAM,2BAA2B,KAAK,QAAQ,kBAAkB;AAChE,eAAS,MAAM,gBAAgB,cAAc;AAAA,QAC3C;AAAA,QACA,YAAY,QAAQ;AAAA,QACpB,gBAAgB;AAAA,MAClB,CAAC;AAAA,IACH,OAAO;AACL,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,YAAY,OAAO;AACzB,QAAM,gBAAgB,OAAO,iBAAiB,CAAC;AAE/C,QAAM,gBAAgB,MAAM,iBAAiB,GAAG;AAEhD,QAAM,yBAAyB,WAAW,QAAQ,EAC/C,OAAO,GAAG,QAAQ,eAAe,IAAI,QAAQ,cAAc,EAAE,EAC7D,OAAO,KAAK;AACf,QAAM,qBACJ,eAAe,iCAAiC;AAElD,QAAM,kBAAkB,KAAK;AAAA,IAC3B;AAAA,IACA,aAAY,oBAAI,KAAK,GAAE,YAAY;AAAA,IACnC,WAAW,KAAK;AAAA,IAChB,8BAA8B;AAAA,IAC9B,QAAQ,eAAe,UAAU,CAAC;AAAA,EACpC,CAAC;AAED,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,WAAW,KAAK;AAAA,IAChB,iBAAiB,QAAQ;AAAA,IACzB,gBAAgB,QAAQ;AAAA,IACxB;AAAA,EACF;AACF;","names":["readFile","readFile"]}