@memnexus-ai/mx-agent-cli 0.1.209 → 0.1.210

package/dist/lib/security-posture.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"security-posture.js","sourceRoot":"","sources":["../../src/lib/security-posture.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH;;;;;;;;;GASG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAG;IAClC,uBAAuB;IACvB,kBAAkB;IAClB,sBAAsB;IACtB,mBAAmB;CACX,CAAC;AAEX;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAsB;IACxD,uBAAuB;IACvB,kBAAkB;CACnB,CAAC;AAEF,kFAAkF;AAClF,MAAM,CAAC,MAAM,sBAAsB,GACjC,oBAAoB,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAEhD,wFAAwF;AACxF,MAAM,4BAA4B,GAAG,CAAC,OAAO,EAAE,cAAc,EAAE,MAAM,CAAU,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,UAAU,uBAAuB,CAAC,QAA2B;IACjE,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAC3B,4BAA4B,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC,CAChE,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,oBAAoB,CAAC,QAA2B,EAAE,IAAY;IAC5E,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC;IAC/B,OAAO,IAAI,CAAC,GAAG,CAAC,QAAQ,IAAI,GAAG,CAAC,IAAI,IAAI,CAAC,GAAG,CAAC,SAAS,IAAI,GAAG,CAAC,CAAC;AACjE,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,qBAAqB,CAAC,GAAW;IAC/C,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,iCAAiC,CAAC;IAC3C,CAAC;IACD,MAAM,IAAI,GAAI,MAAsD,EAAE,WAAW,EAAE,IAAI,CAAC;IACxF,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC9C,OAAO,sCAAsC,CAAC;IAChD,CAAC;IACD,MAAM,QAAQ,GAAG,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,EAAe,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,CAAC,CAAC;IACxE,MAAM,OAAO,GAAG,uBAAuB,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,CAAC;IAC1F,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,OAAO,qCAAqC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;IACnE,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@memnexus-ai/mx-agent-cli",
-  "version": "0.1.209",
+  "version": "0.1.210",
   "description": "CLI for creating and managing AI agent teams",
   "type": "module",
   "bin": {

package/scripts/generate-claude.mjs

@@ -68,7 +68,7 @@ import {
   renameSync, rmSync, unlinkSync, writeFileSync,
 } from 'fs';
 import { homedir, tmpdir } from 'os';
-import { dirname, join, relative, resolve, sep } from 'path';
+import { basename, dirname, join, relative, resolve, sep } from 'path';
 import { pathToFileURL } from 'url';
 import { spawnSync } from 'child_process';
 import { createHash } from 'crypto';
@@ -189,6 +189,46 @@ function pruneExtras(destDir, expected) {
   }
 }
 
+// ── ORPHAN-SIBLING SWEEP (KI-GENERATOR-SWAP-SIBLINGS-UNGUARDED) ───────────────
+//
+// A crash mid-generation can only ever leave a `.claude.staging-*` sibling
+// behind, and a failed prev-cleanup can leave a `.claude.prev-*` sibling — stale
+// settings.json + hooks copies at an unguarded path (same-UID residual, not an
+// escalation). Sweep any such orphan siblings of destRoot at generation ENTRY,
+// before a new staging dir is created, so debris never accumulates across runs.
+//
+// Single-writer assumption: generation is serialized per worktree by the leader
+// lock, so any staging/prev sibling present at entry is orphaned from a prior
+// crashed run, never an in-flight concurrent generation. Best-effort per entry
+// (an un-removable orphan never blocks generation). FAILS SAFE on a symlink
+// sibling: unlink the LINK itself, never rmSync THROUGH it (a crafted link could
+// otherwise delete outside the parent).
+
+/**
+ * Remove stale `.claude.staging-*` / `.claude.prev-*` siblings of `destRoot`.
+ * @param destRoot absolute path to the `.claude/` dir about to be generated
+ * @returns names of the siblings that were swept (for observability/tests)
+ */
+export function sweepOrphanSiblings(destRoot) {
+  const dest = resolve(destRoot);
+  const parent = dirname(dest);
+  const base = basename(dest);
+  const stagingPrefix = `${base}.staging-`;
+  const prevPrefix = `${base}.prev-`;
+  const swept = [];
+  for (const ent of listDir(parent)) {
+    if (!ent.name.startsWith(stagingPrefix) && !ent.name.startsWith(prevPrefix)) continue;
+    const p = join(parent, ent.name);
+    if (ent.isSymbolicLink()) {
+      // Never follow/delete THROUGH a link — remove only the link entry itself.
+      try { unlinkSync(p); swept.push(ent.name); } catch { /* best-effort */ }
+      continue;
+    }
+    try { rmSync(p, { recursive: true, force: true }); swept.push(ent.name); } catch { /* best-effort */ }
+  }
+  return swept;
+}
+
 // ── GENERATE-TO-STAGING + ATOMIC SWAP (Phase 4 prereq; Red Team finding 1) ────
 //
 // Generation writes the WHOLE tree into a staging dir (a sibling of destRoot so
@@ -488,6 +528,10 @@ export function generateClaudeConfig(opts) {
   // reach the write phase); the existing dest is guarded separately at swap time.
   const parent = dirname(destRoot);
   mkdirSync(parent, { recursive: true });
+  // Sweep stale staging/prev siblings from a prior crashed run BEFORE creating a
+  // fresh staging dir (KI-GENERATOR-SWAP-SIBLINGS-UNGUARDED). The just-created
+  // staging dir below cannot be a sweep target: it does not exist yet.
+  sweepOrphanSiblings(destRoot);
   const staging = mkdtempSync(join(parent, '.claude.staging-'));
 
   try {

package/dist/__tests__/config-mirror-integrity.test.d.ts

@@ -1,32 +0,0 @@
-/**
- * Mirror-drift guard for the agent-config → .claude config bundle.
- *
- * The repo keeps two copies of certain hook/skill/agent files:
- *   - mx-agent-system/agent-config/*  — the source of truth that ships in the
- *     CLI's synced bundle (what `mx-agent` writes into new worktrees).
- *   - .claude/*                        — the copy that actually runs in this
- *     repo's own worktrees.
- *
- * These were hand-synced three separate times on 2026-07-02 (issue #3728,
- * known-issues v68 / KI-HOOK-MIRROR-DRIFT-CHECK). When they drift, a worktree
- * silently runs stale hook or skill logic. This test asserts byte-identity of
- * the known mirror pairs so drift fails locally before it ships.
- *
- * ── PHASE 4 RETIREMENT (config-single-source migration #4304) ────────────────
- * This entire file — both the MIRROR_PAIRS byte-identity suite and the
- * `settings.json permissions parity` suite — is a TWO-COPY drift gate. It exists
- * only because `.claude/` is still COMMITTED alongside `agent-config/`. Phase 4
- * gitignores `.claude/`, deleting the second committed copy; at that point there
- * is nothing to compare and these assertions become vacuous (every pair SKIPs on
- * the `existsSync(claudeAbs)` guard once `.claude/` is untracked, and the parity
- * suite short-circuits on `bothPresent`).
- *
- * DELETE this file in the Phase 4 PR. Its guarantee is replaced by the
- * generation-correctness gate in `config-generation-gate.test.ts` (Phase 3),
- * which proves the single remaining source generates correct, stable output —
- * see that file's header for the kept-vs-added rationale. Until Phase 4 lands,
- * KEEP these assertions: they are the live guard against a PR editing one side of
- * the mirror while `.claude/` is still tracked.
- */
-export {};
-//# sourceMappingURL=config-mirror-integrity.test.d.ts.map

package/dist/__tests__/config-mirror-integrity.test.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-mirror-integrity.test.d.ts","sourceRoot":"","sources":["../../src/__tests__/config-mirror-integrity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG"}

package/dist/__tests__/config-mirror-integrity.test.js

@@ -1,248 +0,0 @@
-/**
- * Mirror-drift guard for the agent-config → .claude config bundle.
- *
- * The repo keeps two copies of certain hook/skill/agent files:
- *   - mx-agent-system/agent-config/*  — the source of truth that ships in the
- *     CLI's synced bundle (what `mx-agent` writes into new worktrees).
- *   - .claude/*                        — the copy that actually runs in this
- *     repo's own worktrees.
- *
- * These were hand-synced three separate times on 2026-07-02 (issue #3728,
- * known-issues v68 / KI-HOOK-MIRROR-DRIFT-CHECK). When they drift, a worktree
- * silently runs stale hook or skill logic. This test asserts byte-identity of
- * the known mirror pairs so drift fails locally before it ships.
- *
- * ── PHASE 4 RETIREMENT (config-single-source migration #4304) ────────────────
- * This entire file — both the MIRROR_PAIRS byte-identity suite and the
- * `settings.json permissions parity` suite — is a TWO-COPY drift gate. It exists
- * only because `.claude/` is still COMMITTED alongside `agent-config/`. Phase 4
- * gitignores `.claude/`, deleting the second committed copy; at that point there
- * is nothing to compare and these assertions become vacuous (every pair SKIPs on
- * the `existsSync(claudeAbs)` guard once `.claude/` is untracked, and the parity
- * suite short-circuits on `bothPresent`).
- *
- * DELETE this file in the Phase 4 PR. Its guarantee is replaced by the
- * generation-correctness gate in `config-generation-gate.test.ts` (Phase 3),
- * which proves the single remaining source generates correct, stable output —
- * see that file's header for the kept-vs-added rationale. Until Phase 4 lands,
- * KEEP these assertions: they are the live guard against a PR editing one side of
- * the mirror while `.claude/` is still tracked.
- */
-import { describe, it, expect } from 'vitest';
-import { readFileSync, existsSync } from 'fs';
-import { dirname, join } from 'path';
-import { fileURLToPath } from 'url';
-const __dirname = dirname(fileURLToPath(import.meta.url));
-/**
- * Ascend from this test file to the repo root — identified by the presence of
- * the mx-agent-system/agent-config tree — instead of hard-coding a fixed number
- * of `..` segments. Keeps the test correct if the file is ever relocated.
- */
-function findRepoRoot(start) {
-    let dir = start;
-    for (let i = 0; i < 20; i++) {
-        if (existsSync(join(dir, 'mx-agent-system', 'agent-config')))
-            return dir;
-        const parent = dirname(dir);
-        if (parent === dir)
-            break;
-        dir = parent;
-    }
-    throw new Error(`config-mirror-integrity: could not locate repo root from ${start}`);
-}
-const REPO_ROOT = findRepoRoot(__dirname);
-// [ .claude runtime copy, agent-config source of truth ] — repo-root-relative.
-const MIRROR_PAIRS = [
-    [
-        '.claude/hooks/deploy-verification-reminder.sh',
-        'mx-agent-system/agent-config/hooks/deploy-verification-reminder.sh',
-    ],
-    [
-        '.claude/hooks/deploy-verification-reminder.test.sh',
-        'mx-agent-system/agent-config/hooks/deploy-verification-reminder.test.sh',
-    ],
-    // Shared git guards + push validators (#3912). These were mirror-drifting
-    // silently (git-mutation-guard.sh wasn't even present in the source-of-truth
-    // copy). Enforce byte-identity so a hook fix lands in both places.
-    [
-        '.claude/hooks/git-mutation-guard.sh',
-        'mx-agent-system/agent-config/hooks/git-mutation-guard.sh',
-    ],
-    [
-        '.claude/hooks/git-mutation-guard.test.sh',
-        'mx-agent-system/agent-config/hooks/git-mutation-guard.test.sh',
-    ],
-    [
-        '.claude/hooks/push-matcher.test.sh',
-        'mx-agent-system/agent-config/hooks/push-matcher.test.sh',
-    ],
-    [
-        '.claude/hooks/mx-guard-hook.sh',
-        'mx-agent-system/agent-config/hooks/mx-guard-hook.sh',
-    ],
-    [
-        '.claude/hooks/ci-validate-hook.sh',
-        'mx-agent-system/agent-config/hooks/ci-validate-hook.sh',
-    ],
-    // Package→validate-script routing table extracted from ci-validate-hook.sh
-    // (Platform v2.35, #4017). Shipped default = the MemNexus map; the hook reads
-    // it at push time and fails open if absent. Guard it against mirror drift.
-    [
-        '.claude/hooks/ci-validate-routes.conf',
-        'mx-agent-system/agent-config/hooks/ci-validate-routes.conf',
-    ],
-    [
-        '.claude/hooks/worktree-guard.sh',
-        'mx-agent-system/agent-config/hooks/worktree-guard.sh',
-    ],
-    [
-        '.claude/hooks/worktree-guard.test.sh',
-        'mx-agent-system/agent-config/hooks/worktree-guard.test.sh',
-    ],
-    [
-        '.claude/hooks/workflow-dispatch-guard.sh',
-        'mx-agent-system/agent-config/hooks/workflow-dispatch-guard.sh',
-    ],
-    // Named-memory truncating-write guard (Platform v2.33, #3996). Blocks
-    // full-content `mx memories update|create --name X --content <NEW>` writes
-    // that shrink a shared named memory past a threshold — two real clobber
-    // incidents (2026-07-07 known-issues, 2026-07-09 escalations).
-    [
-        '.claude/hooks/named-memory-write-guard.sh',
-        'mx-agent-system/agent-config/hooks/named-memory-write-guard.sh',
-    ],
-    [
-        '.claude/hooks/named-memory-write-guard.test.sh',
-        'mx-agent-system/agent-config/hooks/named-memory-write-guard.test.sh',
-    ],
-    [
-        '.claude/skills/mx-post-merge-sync/SKILL.md',
-        'mx-agent-system/agent-config/skills/mx-post-merge-sync/SKILL.md',
-    ],
-    [
-        '.claude/agents/git-expert.md',
-        'mx-agent-system/agent-config/agents/git-expert.md',
-    ],
-    // Stop hook that warns when a merged session left its iteration log stale
-    // (Platform v2.35, #4017 — product-slug parameterization). Guard the pair.
-    [
-        '.claude/hooks/iteration-log-check.sh',
-        'mx-agent-system/agent-config/hooks/iteration-log-check.sh',
-    ],
-    [
-        '.claude/hooks/iteration-log-check.test.sh',
-        'mx-agent-system/agent-config/hooks/iteration-log-check.test.sh',
-    ],
-    // Agent/skill instruction files carrying the product-slug named-memory
-    // convention (Platform v2.35, #4017). These had been mirror-unguarded; the
-    // KI-HOOK-MIRROR-DRIFT-CHECK history (three hand-syncs, #3728) justifies
-    // enforcing byte-identity now that they are edited in lockstep.
-    [
-        '.claude/agents/memory-creator.md',
-        'mx-agent-system/agent-config/agents/memory-creator.md',
-    ],
-    [
-        '.claude/agents/status-reporter.md',
-        'mx-agent-system/agent-config/agents/status-reporter.md',
-    ],
-    [
-        '.claude/agents/prior-art-researcher.md',
-        'mx-agent-system/agent-config/agents/prior-art-researcher.md',
-    ],
-    [
-        '.claude/agents/dogfood-auditor.md',
-        'mx-agent-system/agent-config/agents/dogfood-auditor.md',
-    ],
-    [
-        '.claude/skills/mx-session-start/SKILL.md',
-        'mx-agent-system/agent-config/skills/mx-session-start/SKILL.md',
-    ],
-    [
-        '.claude/skills/mx-iteration-close/SKILL.md',
-        'mx-agent-system/agent-config/skills/mx-iteration-close/SKILL.md',
-    ],
-    // Session-start coordination brief hook (PR-D). The .claude runtime copy is
-    // synced by the normal distribution mechanism; until Gate 3 cutover it may be
-    // absent, in which case this pair SKIPS (the loop's existsSync guard). Once
-    // synced it is asserted byte-identical.
-    [
-        '.claude/hooks/coordination-brief.sh',
-        'mx-agent-system/agent-config/hooks/coordination-brief.sh',
-    ],
-    // The co-located hook test suite. Not part of the shipped config surface
-    // (bundled-config excludes *.test.sh), but both dev copies are edited in
-    // lockstep — enforce byte-identity so the slug-validation tests can't drift
-    // (v2.40 QA finding, KI-COORDMT-HOOK-EXPORT-ROBUSTNESS).
-    [
-        '.claude/hooks/coordination-brief.test.sh',
-        'mx-agent-system/agent-config/hooks/coordination-brief.test.sh',
-    ],
-    // NOTE: agent-config/settings.json is intentionally NOT a byte-identity mirror
-    // pair — the worktree .claude/settings.json has its SessionStart/hook wiring
-    // COMPOSED/merged from the source at deploy time (see claude.ts), so the two
-    // are not byte-identical by design. But the SECURITY-SENSITIVE part — the
-    // `permissions` allow/deny/ask lists and the experimental-teams flag — must
-    // never drift, because config-sync/`mx-agent new` ship agent-config's copy
-    // into worktrees verbatim. A prior drift (agent-config/settings.json lagged
-    // active by the "Monitor" allow entry from #4275, and the git-mutation-guard
-    // #4289 hardening) shipped a weakened config to consumer worktrees (#4294).
-    // The `settings.json permissions parity` describe below guards that surface
-    // semantically rather than by byte-identity.
-];
-describe('config mirror integrity', () => {
-    for (const [claudeRel, agentConfigRel] of MIRROR_PAIRS) {
-        const claudeAbs = join(REPO_ROOT, claudeRel);
-        const agentConfigAbs = join(REPO_ROOT, agentConfigRel);
-        // The .claude copy is not present in every checkout (e.g. a package-only
-        // export of the CLI). Skip rather than fail spuriously when it's absent.
-        if (!existsSync(claudeAbs)) {
-            it.skip(`${claudeRel} ↔ ${agentConfigRel} (SKIPPED: ${claudeRel} absent in this checkout)`, () => { });
-            continue;
-        }
-        it(`${claudeRel} is byte-identical to ${agentConfigRel}`, () => {
-            const claudeBytes = readFileSync(claudeAbs);
-            const agentConfigBytes = readFileSync(agentConfigAbs);
-            expect(claudeBytes.equals(agentConfigBytes)).toBe(true);
-        });
-    }
-});
-/**
- * settings.json is composed (SessionStart/hook wiring is merged into the worktree
- * copy at deploy time), so it is not a byte-identity mirror pair above. But its
- * `permissions` block and the experimental-teams flag are shipped verbatim into
- * consumer worktrees by config-sync/`mx-agent new`; drift there ships a weakened
- * security posture. This suite asserts semantic parity of exactly those fields
- * between the active runtime copy and the agent-config source of truth so a
- * regression like #4294 (agent-config lagging the active allow-list) fails
- * locally before it ships.
- */
-describe('settings.json permissions parity', () => {
-    const claudeSettingsAbs = join(REPO_ROOT, '.claude/settings.json');
-    const agentConfigSettingsAbs = join(REPO_ROOT, 'mx-agent-system/agent-config/settings.json');
-    const bothPresent = existsSync(claudeSettingsAbs) && existsSync(agentConfigSettingsAbs);
-    const loadPerms = (abs) => {
-        const parsed = JSON.parse(readFileSync(abs, 'utf-8'));
-        return parsed;
-    };
-    (bothPresent ? it : it.skip)('permissions.allow is identical between active and agent-config', () => {
-        const active = loadPerms(claudeSettingsAbs);
-        const template = loadPerms(agentConfigSettingsAbs);
-        expect(template.permissions?.allow).toEqual(active.permissions?.allow);
-    });
-    (bothPresent ? it : it.skip)('permissions.deny is identical between active and agent-config', () => {
-        const active = loadPerms(claudeSettingsAbs);
-        const template = loadPerms(agentConfigSettingsAbs);
-        expect(template.permissions?.deny).toEqual(active.permissions?.deny);
-    });
-    (bothPresent ? it : it.skip)('permissions.ask is identical between active and agent-config', () => {
-        const active = loadPerms(claudeSettingsAbs);
-        const template = loadPerms(agentConfigSettingsAbs);
-        expect(template.permissions?.ask).toEqual(active.permissions?.ask);
-    });
-    (bothPresent ? it : it.skip)('CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS flag is identical between active and agent-config', () => {
-        const active = loadPerms(claudeSettingsAbs);
-        const template = loadPerms(agentConfigSettingsAbs);
-        expect(template.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS).toEqual(active.CLAUDE_CODE_EXPERIMENTAL_AGENT_TEAMS);
-    });
-});
-//# sourceMappingURL=config-mirror-integrity.test.js.map

package/dist/__tests__/config-mirror-integrity.test.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"config-mirror-integrity.test.js","sourceRoot":"","sources":["../../src/__tests__/config-mirror-integrity.test.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAAE,QAAQ,EAAE,EAAE,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAC9C,OAAO,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,IAAI,CAAC;AAC9C,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,MAAM,MAAM,CAAC;AACrC,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AAEpC,MAAM,SAAS,GAAG,OAAO,CAAC,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,CAAC;AAE1D;;;;GAIG;AACH,SAAS,YAAY,CAAC,KAAa;IACjC,IAAI,GAAG,GAAG,KAAK,CAAC;IAChB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,EAAE,CAAC,EAAE,EAAE,CAAC;QAC5B,IAAI,UAAU,CAAC,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;YAAE,OAAO,GAAG,CAAC;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC;QAC5B,IAAI,MAAM,KAAK,GAAG;YAAE,MAAM;QAC1B,GAAG,GAAG,MAAM,CAAC;IACf,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,4DAA4D,KAAK,EAAE,CAAC,CAAC;AACvF,CAAC;AAED,MAAM,SAAS,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;AAE1C,+EAA+E;AAC/E,MAAM,YAAY,GAA6C;IAC7D;QACE,+CAA+C;QAC/C,oEAAoE;KACrE;IACD;QACE,oDAAoD;QACpD,yEAAyE;KAC1E;IACD,0EAA0E;IAC1E,6EAA6E;IAC7E,mEAAmE;IACnE;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,oCAAoC;QACpC,yDAAyD;KAC1D;IACD;QACE,gCAAgC;QAChC,qDAAqD;KACtD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD,2EAA2E;IAC3E,8EAA8E;IAC9E,2EAA2E;IAC3E;QACE,uCAAuC;QACvC,4DAA4D;KAC7D;IACD;QACE,iCAAiC;QACjC,sDAAsD;KACvD;IACD;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,sEAAsE;IACtE,2EAA2E;IAC3E,wEAAwE;IACxE,+DAA+D;IAC/D;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD;QACE,gDAAgD;QAChD,qEAAqE;KACtE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD;QACE,8BAA8B;QAC9B,mDAAmD;KACpD;IACD,0EAA0E;IAC1E,2EAA2E;IAC3E;QACE,sCAAsC;QACtC,2DAA2D;KAC5D;IACD;QACE,2CAA2C;QAC3C,gEAAgE;KACjE;IACD,uEAAuE;IACvE,2EAA2E;IAC3E,yEAAyE;IACzE,gEAAgE;IAChE;QACE,kCAAkC;QAClC,uDAAuD;KACxD;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,wCAAwC;QACxC,6DAA6D;KAC9D;IACD;QACE,mCAAmC;QACnC,wDAAwD;KACzD;IACD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD;QACE,4CAA4C;QAC5C,iEAAiE;KAClE;IACD,4EAA4E;IAC5E,8EAA8E;IAC9E,4EAA4E;IAC5E,wCAAwC;IACxC;QACE,qCAAqC;QACrC,0DAA0D;KAC3D;IACD,yEAAyE;IACzE,yEAAyE;IACzE,4EAA4E;IAC5E,yDAAyD;IACzD;QACE,0CAA0C;QAC1C,+DAA+D;KAChE;IACD,+EAA+E;IAC/E,6EAA6E;IAC7E,6EAA6E;IAC7E,0EAA0E;IAC1E,4EAA4E;IAC5E,2EAA2E;IAC3E,4EAA4E;IAC5E,6EAA6E;IAC7E,4EAA4E;IAC5E,4EAA4E;IAC5E,6CAA6C;CAC9C,CAAC;AAEF,QAAQ,CAAC,yBAAyB,EAAE,GAAG,EAAE;IACvC,KAAK,MAAM,CAAC,SAAS,EAAE,cAAc,CAAC,IAAI,YAAY,EAAE,CAAC;QACvD,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,EAAE,SAAS,CAAC,CAAC;QAC7C,MAAM,cAAc,GAAG,IAAI,CAAC,SAAS,EAAE,cAAc,CAAC,CAAC;QAEvD,yEAAyE;QACzE,yEAAyE;QACzE,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,CAAC;YAC3B,EAAE,CAAC,IAAI,CAAC,GAAG,SAAS,MAAM,cAAc,cAAc,SAAS,2BAA2B,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtG,SAAS;QACX,CAAC;QAED,EAAE,CAAC,GAAG,SAAS,yBAAyB,cAAc,EAAE,EAAE,GAAG,EAAE;YAC7D,MAAM,WAAW,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;YAC5C,MAAM,gBAAgB,GAAG,YAAY,CAAC,cAAc,CAAC,CAAC;YACtD,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,gBAAgB,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAC1D,CAAC,CAAC,CAAC;IACL,CAAC;AACH,CAAC,CAAC,CAAC;AAEH;;;;;;;;;GASG;AACH,QAAQ,CAAC,kCAAkC,EAAE,GAAG,EAAE;IAChD,MAAM,iBAAiB,GAAG,IAAI,CAAC,SAAS,EAAE,uBAAuB,CAAC,CAAC;IACnE,MAAM,sBAAsB,GAAG,IAAI,CACjC,SAAS,EACT,4CAA4C,CAC7C,CAAC;IAEF,MAAM,WAAW,GACf,UAAU,CAAC,iBAAiB,CAAC,IAAI,UAAU,CAAC,sBAAsB,CAAC,CAAC;IAEtE,MAAM,SAAS,GAAG,CAAC,GAAW,EAAE,EAAE;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAGnD,CAAC;QACF,OAAO,MAAM,CAAC;IAChB,CAAC,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,gEAAgE,EAChE,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,CAAC,CAAC;IACzE,CAAC,CACF,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,+DAA+D,EAC/D,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,IAAI,CAAC,CAAC;IACvE,CAAC,CACF,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,8DAA8D,EAC9D,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,EAAE,GAAG,CAAC,CAAC;IACrE,CAAC,CACF,CAAC;IAEF,CAAC,WAAW,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,IAAI,CAAC,CAC1B,wFAAwF,EACxF,GAAG,EAAE;QACH,MAAM,MAAM,GAAG,SAAS,CAAC,iBAAiB,CAAC,CAAC;QAC5C,MAAM,QAAQ,GAAG,SAAS,CAAC,sBAAsB,CAAC,CAAC;QACnD,MAAM,CAAC,QAAQ,CAAC,oCAAoC,CAAC,CAAC,OAAO,CAC3D,MAAM,CAAC,oCAAoC,CAC5C,CAAC;IACJ,CAAC,CACF,CAAC;AACJ,CAAC,CAAC,CAAC"}