@odla-ai/cli 0.5.0 → 0.7.0

package/dist/chunk-7WZIZCGA.js.map

@@ -1 +0,0 @@
-{"version":3,"sources":["../src/capabilities.ts","../src/redact.ts","../src/config.ts","../src/doctor-checks.ts","../src/local.ts","../src/wrangler.ts","../src/doctor.ts","../src/init.ts","../src/secrets.ts","../src/provision.ts","../src/token.ts","../src/open.ts","../src/provision-credentials.ts","../src/skill.ts","../src/skill-adapters.ts","../src/smoke.ts","../src/cli.ts"],"sourcesContent":["/** Stable, machine-readable division of work between the CLI, coding agent,\n * human operator, and Studio. Printed by `odla-ai capabilities --json`. */\nexport const CAPABILITIES = {\n  cli: [\n    \"register the app and enable configured services per environment\",\n    \"issue, persist, and explicitly rotate configured service credentials\",\n    \"write local Worker values and push deployed Worker secrets through Wrangler stdin\",\n    \"push db schema/rules and configure platform AI, auth, and deployment links\",\n    \"validate config offline and smoke-test a provisioned db environment\",\n  ],\n  agent: [\n    \"install and import the selected odla SDKs\",\n    \"wrap the Worker with withObservability and choose useful telemetry\",\n    \"make application-specific schema, rules, auth, UI, and migration decisions\",\n  ],\n  human: [\n    \"approve the odla device code and one-off third-party logins\",\n    \"consent to production changes with --yes\",\n    \"request destructive credential rotation explicitly\",\n    \"review application semantics, security findings, releases, and merges\",\n  ],\n  studio: [\n    \"view telemetry and environment state\",\n    \"perform manual credential recovery when the CLI's local shown-once copy is unavailable\",\n  ],\n} as const;\n\ntype Output = Pick<typeof console, \"log\">;\n\n/** Print the stable responsibility boundary for humans or agent tooling. */\nexport function printCapabilities(json = false, out: Output = console): void {\n  if (json) {\n    out.log(JSON.stringify(CAPABILITIES, null, 2));\n    return;\n  }\n  out.log(\"odla-ai responsibility boundary\\n\");\n  printGroup(out, \"CLI automates\", CAPABILITIES.cli);\n  printGroup(out, \"Coding agent changes source\", CAPABILITIES.agent);\n  printGroup(out, \"Human checkpoints\", CAPABILITIES.human);\n  printGroup(out, \"Studio\", CAPABILITIES.studio);\n}\n\nfunction printGroup(out: Output, heading: string, items: readonly string[]): void {\n  out.log(`${heading}:`);\n  for (const item of items) out.log(`  - ${item}`);\n  out.log(\"\");\n}\n","/**\n * Secret redaction shared by every command's output path and by doctor's\n * \"does this value look like a secret\" checks. Clerk publishable keys\n * (pk_test_/pk_live_) are public by design and are deliberately not matched.\n */\nconst REPLACEMENTS: Array<[RegExp, string]> = [\n  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, \"odla_$1_[redacted]\"],\n  [/\\bsk_(live|test)_[A-Za-z0-9]+/g, \"sk_$1_[redacted]\"],\n  [/\\bsk-[A-Za-z0-9._-]+/g, \"sk-[redacted]\"],\n  [/\\bwhsec_[A-Za-z0-9+/=]+/g, \"whsec_[redacted]\"],\n  [/\\bo11y_[A-Za-z0-9]+/g, \"o11y_[redacted]\"],\n  [/\\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, \"$1_[redacted]\"],\n  [/\\bAKIA[A-Z0-9]{12,}/g, \"AKIA[redacted]\"],\n];\n\n/**\n * Return `value` with every secret-shaped substring replaced by a `[redacted]`\n * placeholder that keeps the identifying prefix (e.g. `sk_live_[redacted]`).\n * Matches odla db keys (`odla_sk_`/`odla_dev_`), Clerk secret keys\n * (`sk_live_`/`sk_test_`), OpenAI keys (`sk-`), webhook signing secrets\n * (`whsec_`), o11y tokens (`o11y_`), GitHub tokens (`ghp_`/`gho_`/`github_pat_`),\n * and AWS access-key ids (`AKIA…`). Clerk publishable keys (`pk_test_`/\n * `pk_live_`) are public by design and intentionally left untouched. Used to\n * sanitize anything the CLI echoes (notably network error bodies) before it\n * reaches stdout/stderr. Non-matching input is returned unchanged.\n */\nexport function redactSecrets(value: string): string {\n  let result = value;\n  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);\n  return result;\n}\n\n/** True when a value matches any known secret shape (used for detection, never display). */\nexport function looksSecret(value: string): boolean {\n  return redactSecrets(value) !== value || value.includes(\"-----BEGIN\");\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport type { AppRules, LoadedProjectConfig, OdlaProjectConfig, ProvisionPlan } from \"./types\";\n\nconst DEFAULT_PLATFORM = \"https://odla.ai\";\n// Safe-by-default: production must be opted into explicitly in odla.config.\nconst DEFAULT_ENVS = [\"dev\"];\nconst DEFAULT_SERVICES = [\"db\", \"ai\"];\n\nexport async function loadProjectConfig(configPath = \"odla.config.mjs\"): Promise<LoadedProjectConfig> {\n  const resolved = resolve(configPath);\n  if (!existsSync(resolved)) {\n    throw new Error(`config not found: ${configPath}. Run \"odla-ai init\" first or pass --config.`);\n  }\n\n  const raw = await loadConfigModule(resolved);\n  const rootDir = dirname(resolved);\n  validateRawConfig(raw, resolved);\n\n  const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);\n  const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);\n  const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);\n  const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);\n  const local = {\n    tokenFile: resolve(rootDir, raw.local?.tokenFile ?? \".odla/dev-token.json\"),\n    credentialsFile: resolve(rootDir, raw.local?.credentialsFile ?? \".odla/credentials.local.json\"),\n    devVarsFile: resolve(rootDir, raw.local?.devVarsFile ?? \".dev.vars\"),\n    gitignore: raw.local?.gitignore ?? true,\n  };\n\n  return {\n    ...raw,\n    configPath: resolved,\n    rootDir,\n    platformUrl,\n    dbEndpoint,\n    envs,\n    services,\n    local,\n  };\n}\n\nexport async function resolveDataExport<T>(\n  cfg: LoadedProjectConfig,\n  value: unknown,\n  names: string[],\n): Promise<T | undefined> {\n  if (value === undefined || value === null || value === false) return undefined;\n  if (typeof value !== \"string\") return value as T;\n\n  const target = isAbsolute(value) ? value : resolve(cfg.rootDir, value);\n  if (target.endsWith(\".json\")) {\n    return JSON.parse(readFileSync(target, \"utf8\")) as T;\n  }\n  const mod = (await import(pathToFileURL(target).href)) as Record<string, unknown>;\n  for (const name of names) {\n    if (mod[name] !== undefined) return mod[name] as T;\n  }\n  if (mod.default !== undefined) return mod.default as T;\n  throw new Error(`${value} did not export ${names.join(\", \")} or default`);\n}\n\nexport function buildPlan(cfg: LoadedProjectConfig): ProvisionPlan {\n  return {\n    appId: cfg.app.id,\n    appName: cfg.app.name,\n    platformUrl: cfg.platformUrl,\n    dbEndpoint: cfg.dbEndpoint,\n    envs: cfg.envs,\n    services: cfg.services,\n    hasSchema: !!cfg.db?.schema,\n    hasRules: !!cfg.db?.rules || (!!cfg.db?.schema && cfg.db.defaultRules !== false),\n    aiProvider: cfg.ai?.provider,\n  };\n}\n\nexport function rulesFromSchema(schema: unknown): AppRules {\n  const entities = serializedEntities(schema);\n  return Object.fromEntries(\n    entities.map((name) => [name, { view: \"false\", create: \"false\", update: \"false\", delete: \"false\" }]),\n  );\n}\n\nexport function serializedEntities(schema: unknown): string[] {\n  if (!schema || typeof schema !== \"object\") return [];\n  const entities = (schema as { entities?: unknown }).entities;\n  if (!entities || typeof entities !== \"object\" || Array.isArray(entities)) return [];\n  return Object.keys(entities);\n}\n\nexport function envValue(value: string | undefined): string | undefined {\n  if (!value) return undefined;\n  if (value.startsWith(\"$\")) return process.env[value.slice(1)];\n  return value;\n}\n\nfunction validateRawConfig(raw: unknown, path: string): asserts raw is OdlaProjectConfig {\n  if (!raw || typeof raw !== \"object\") throw new Error(`${path} must export an object`);\n  const cfg = raw as OdlaProjectConfig;\n  if (!cfg.app || typeof cfg.app !== \"object\") throw new Error(`${path}: missing app object`);\n  if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);\n  if (!cfg.app.name || typeof cfg.app.name !== \"string\") throw new Error(`${path}: app.name is required`);\n  if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);\n}\n\nfunction validId(value: unknown): value is string {\n  return typeof value === \"string\" && /^[a-z0-9][a-z0-9-]*$/.test(value);\n}\n\nasync function loadConfigModule(path: string): Promise<OdlaProjectConfig> {\n  if (path.endsWith(\".json\")) return JSON.parse(readFileSync(path, \"utf8\")) as OdlaProjectConfig;\n  const mod = (await import(`${pathToFileURL(path).href}?t=${Date.now()}`)) as {\n    default?: OdlaProjectConfig | (() => OdlaProjectConfig | Promise<OdlaProjectConfig>);\n    config?: OdlaProjectConfig;\n  };\n  const value = mod.default ?? mod.config;\n  if (typeof value === \"function\") return await value();\n  return value as OdlaProjectConfig;\n}\n\nfunction trimSlash(value: string): string {\n  return value.replace(/\\/+$/, \"\");\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values.filter(Boolean))];\n}\n","import { execFileSync } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { looksSecret } from \"./redact\";\nimport { gitignoreEntry } from \"./local\";\nimport { findWranglerConfig, readWranglerConfig } from \"./wrangler\";\nimport type { AppRules } from \"./types\";\n\n/**\n * Rules lint: a literal \"true\" grants the action to every client. `view` may\n * be deliberate for public content — allowlist those namespaces via\n * `db.publicRead`; writes are never safely \"true\".\n */\nexport function lintRules(rules: AppRules | undefined, entities: string[], publicRead: string[]): string[] {\n  const warnings: string[] = [];\n  if (!rules) return warnings;\n  for (const [ns, actions] of Object.entries(rules)) {\n    for (const [action, expr] of Object.entries(actions)) {\n      if (typeof expr !== \"string\" || expr.trim() !== \"true\") continue;\n      if (action === \"view\" && publicRead.includes(ns)) continue;\n      warnings.push(\n        action === \"view\"\n          ? `rules.${ns}.view is \"true\" — public read; add \"${ns}\" to db.publicRead if intended`\n          : `rules.${ns}.${action} is \"true\" — any client can ${action} ${ns} rows`,\n      );\n    }\n  }\n  for (const entity of entities) {\n    if (!(entity in rules)) warnings.push(`schema entity \"${entity}\" has no rules entry (all client access denied)`);\n  }\n  return warnings;\n}\n\nexport type ExecLike = (cmd: string, args: string[], cwd: string) => string;\n\nconst defaultExec: ExecLike = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"ignore\"] });\n\n/** Credential files that must never be committed. Silent when git is absent. */\nexport function trackedSecretFiles(rootDir: string, exec: ExecLike = defaultExec, localPaths: string[] = []): string[] {\n  let output: string;\n  try {\n    const custom = localPaths\n      .map((path) => gitignoreEntry(rootDir, path))\n      .filter((path): path is string => !!path);\n    output = exec(\"git\", [\"ls-files\", \"--\", \".dev.vars\", \".odla\", ...custom], rootDir);\n  } catch {\n    return [];\n  }\n  return output\n    .split(/\\r?\\n/)\n    .filter(Boolean)\n    .map((path) => `${path} is tracked by git — run \"git rm --cached ${path}\" and commit; it belongs in .gitignore`);\n}\n\n/** Wrangler config sanity: the assets-dir footgun, secret-looking vars. */\nexport function wranglerWarnings(rootDir: string): string[] {\n  const configPath = findWranglerConfig(rootDir);\n  if (!configPath) return [];\n  const config = readWranglerConfig(configPath);\n  if (!config) return [];\n\n  const warnings: string[] = [];\n  const blocks: Array<{ label: string; block: Record<string, unknown> }> = [{ label: \"\", block: config }];\n  const envs = config.env;\n  if (envs && typeof envs === \"object\") {\n    for (const [name, block] of Object.entries(envs as Record<string, unknown>)) {\n      if (block && typeof block === \"object\") blocks.push({ label: `env.${name}.`, block: block as Record<string, unknown> });\n    }\n  }\n\n  for (const { label, block } of blocks) {\n    const assets = block.assets as { directory?: string } | undefined;\n    if (assets?.directory) {\n      const dir = resolve(rootDir, assets.directory);\n      if (dir === resolve(rootDir)) {\n        warnings.push(`${label}assets.directory is the project root — point it at a dedicated build dir (wrangler dev fails with \"spawn EBADF\")`);\n      } else if (existsSync(join(dir, \"node_modules\"))) {\n        warnings.push(`${label}assets.directory contains node_modules — wrangler dev's watcher will exhaust file descriptors`);\n      }\n    }\n    const vars = block.vars;\n    if (vars && typeof vars === \"object\") {\n      for (const [name, value] of Object.entries(vars as Record<string, unknown>)) {\n        if (name === \"ODLA_API_KEY\" || name === \"ODLA_O11Y_TOKEN\" || (typeof value === \"string\" && looksSecret(value))) {\n          warnings.push(`wrangler ${label}vars.${name} looks like a secret — use \"odla-ai secrets push\" / wrangler secret put, never vars`);\n        }\n      }\n    }\n  }\n\n  const pkg = readPackageJson(rootDir);\n  if (pkg && typeof pkg.scripts === \"object\" && pkg.scripts && \"deploy\" in (pkg.scripts as Record<string, unknown>)) {\n    warnings.push(`package.json has a script named \"deploy\" — CI may auto-deploy it; rename to deploy:app`);\n  }\n  return warnings;\n}\n\n/** Offline checks for the source/config work that provisioning cannot infer\n * safely. The CLI owns control-plane enablement and secret delivery; these\n * warnings keep the remaining application edits visible instead of letting a\n * successfully provisioned but uninstrumented Worker look complete. */\nexport function o11yProjectWarnings(rootDir: string): string[] {\n  const warnings: string[] = [];\n  const pkg = readPackageJson(rootDir);\n  const dependencies = pkg?.dependencies as Record<string, unknown> | undefined;\n  const devDependencies = pkg?.devDependencies as Record<string, unknown> | undefined;\n  if (!dependencies?.[\"@odla-ai/o11y\"]) {\n    warnings.push(\n      devDependencies?.[\"@odla-ai/o11y\"]\n        ? \"@odla-ai/o11y is a devDependency — move it to dependencies so the Worker can import it\"\n        : 'Worker instrumentation is missing @odla-ai/o11y — install it and wrap the handler with \"withObservability\"',\n    );\n  }\n\n  const configPath = findWranglerConfig(rootDir);\n  const config = configPath ? readWranglerConfig(configPath) : null;\n  if (!configPath || !config) {\n    warnings.push(\"cannot verify o11y Worker instrumentation — add a parseable wrangler.jsonc/json config\");\n    return warnings;\n  }\n\n  const main = typeof config.main === \"string\" ? resolve(rootDir, config.main) : null;\n  if (!main || !existsSync(main)) {\n    warnings.push(\"cannot verify o11y Worker instrumentation — wrangler main is missing or unreadable\");\n  } else {\n    let source = \"\";\n    try {\n      source = readFileSync(main, \"utf8\");\n    } catch {\n      // The warning below is intentionally the same for an unreadable source.\n    }\n    if (!/\\bwithObservability\\b/.test(source)) {\n      warnings.push(`wrangler entrypoint ${config.main as string} does not reference withObservability`);\n    }\n  }\n\n  const flags = Array.isArray(config.compatibility_flags) ? config.compatibility_flags : [];\n  if (!flags.includes(\"nodejs_compat\")) {\n    warnings.push('wrangler compatibility_flags is missing \"nodejs_compat\" required by @odla-ai/o11y');\n  }\n  return warnings;\n}\n\nfunction readPackageJson(rootDir: string): Record<string, unknown> | null {\n  try {\n    return JSON.parse(readFileSync(join(rootDir, \"package.json\"), \"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n","import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport type { LoadedProjectConfig, LocalCredentials } from \"./types\";\n\nconst GITIGNORE_LINES = [\".odla/*.local.json\", \".odla/dev-token.json\", \".dev.vars\"];\n\nexport function readJsonFile<T>(path: string): T | null {\n  try {\n    return JSON.parse(readFileSync(path, \"utf8\")) as T;\n  } catch {\n    return null;\n  }\n}\n\nexport function writePrivateJson(path: string, value: unknown): void {\n  writePrivateText(path, `${JSON.stringify(value, null, 2)}\\n`);\n}\n\nexport function readCredentials(path: string): LocalCredentials | null {\n  if (!existsSync(path)) return null;\n  let value: unknown;\n  try {\n    value = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);\n  }\n  if (!value || typeof value !== \"object\" || typeof (value as LocalCredentials).appId !== \"string\" ||\n      !(value as LocalCredentials).envs || typeof (value as LocalCredentials).envs !== \"object\") {\n    throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);\n  }\n  return value as LocalCredentials;\n}\n\nexport function mergeCredential(\n  current: LocalCredentials | null,\n  update: { appId: string; platformUrl: string; dbEndpoint: string; env: string; tenantId: string; dbKey?: string; o11yToken?: string },\n): LocalCredentials {\n  const next: LocalCredentials = current ?? {\n    appId: update.appId,\n    platformUrl: update.platformUrl,\n    dbEndpoint: update.dbEndpoint,\n    updatedAt: new Date(0).toISOString(),\n    envs: {},\n  };\n  next.appId = update.appId;\n  next.platformUrl = update.platformUrl;\n  next.dbEndpoint = update.dbEndpoint;\n  next.updatedAt = new Date().toISOString();\n  next.envs[update.env] = {\n    ...(next.envs[update.env] ?? {}),\n    tenantId: update.tenantId,\n    ...(update.dbKey ? { dbKey: update.dbKey } : {}),\n    ...(update.o11yToken ? { o11yToken: update.o11yToken } : {}),\n  };\n  return next;\n}\n\nexport function ensureGitignore(rootDir: string, localPaths: string[] = []): void {\n  const path = resolve(rootDir, \".gitignore\");\n  const existing = existsSync(path) ? readFileSync(path, \"utf8\") : \"\";\n  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line): line is string => !!line);\n  const wanted = [...new Set([...GITIGNORE_LINES, ...configured])];\n  const missing = wanted.filter((line) => !existing.split(/\\r?\\n/).includes(line));\n  if (missing.length === 0) return;\n  const prefix = existing && !existing.endsWith(\"\\n\") ? \"\\n\" : \"\";\n  writeFileSync(path, `${existing}${prefix}${missing.join(\"\\n\")}\\n`);\n}\n\nexport interface O11yDevVars {\n  endpoint: string;\n  service: string;\n  version?: string;\n}\n\nexport function o11yDevVars(cfg: LoadedProjectConfig): O11yDevVars | undefined {\n  if (!cfg.services.includes(\"o11y\")) return undefined;\n  return {\n    endpoint: cfg.o11y?.endpoint ?? \"https://o11y.odla.ai\",\n    service: cfg.o11y?.service ?? cfg.app.id,\n    ...(cfg.o11y?.version ? { version: cfg.o11y.version } : {}),\n  };\n}\n\nexport function resolveWriteDevVarsTarget(cfg: LoadedProjectConfig, requested: string | boolean | undefined): string | null {\n  if (!requested) return null;\n  if (requested === true) return cfg.local.devVarsFile;\n  return resolve(dirname(cfg.configPath), requested);\n}\n\nexport function writeDevVars(path: string, credentials: LocalCredentials, env: string, o11y?: O11yDevVars): void {\n  const entry = credentials.envs[env];\n  if (!entry) throw new Error(`no credentials for env \"${env}\" in ${path}`);\n  const lines = [`ODLA_PLATFORM=\"${credentials.platformUrl}\"`];\n  if (entry.dbKey) lines.push(`ODLA_ENDPOINT=\"${credentials.dbEndpoint}\"`);\n  lines.push(`ODLA_APP_ID=\"${credentials.appId}\"`, `ODLA_ENV=\"${env}\"`, `ODLA_TENANT=\"${entry.tenantId}\"`);\n  if (entry.dbKey) lines.push(`ODLA_API_KEY=\"${entry.dbKey}\"`);\n  if (o11y) {\n    lines.push(`ODLA_O11Y_ENDPOINT=\"${o11y.endpoint}\"`, `ODLA_O11Y_SERVICE=\"${o11y.service}\"`);\n    if (o11y.version) lines.push(`ODLA_O11Y_VERSION=\"${o11y.version}\"`);\n    // The ingest token is a secret; .dev.vars is gitignored (holds ODLA_API_KEY too).\n    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN=\"${entry.o11yToken}\"`);\n  }\n  const existing = existsSync(path) ? readFileSync(path, \"utf8\") : \"\";\n  const retained = existing.split(/\\r?\\n/).filter((line) => !isManagedDevVar(line));\n  while (retained.at(-1) === \"\") retained.pop();\n  const prefix = retained.length ? `${retained.join(\"\\n\")}\\n\\n` : \"\";\n  writePrivateText(path, `${prefix}${lines.join(\"\\n\")}\\n`);\n}\n\nconst MANAGED_DEV_VARS = new Set([\n  \"ODLA_PLATFORM\", \"ODLA_ENDPOINT\", \"ODLA_APP_ID\", \"ODLA_ENV\", \"ODLA_TENANT\", \"ODLA_API_KEY\",\n  \"ODLA_O11Y_ENDPOINT\", \"ODLA_O11Y_SERVICE\", \"ODLA_O11Y_VERSION\", \"ODLA_O11Y_TOKEN\",\n]);\n\nfunction isManagedDevVar(line: string): boolean {\n  const match = line.match(/^\\s*(?:export\\s+)?([A-Z][A-Z0-9_]*)\\s*=/);\n  return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);\n}\n\nfunction writePrivateText(path: string, text: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;\n  writeFileSync(temporary, text, { mode: 0o600 });\n  chmodSync(temporary, 0o600);\n  renameSync(temporary, path);\n}\n\nexport function gitignoreEntry(rootDir: string, path: string): string | null {\n  const rel = relative(resolve(rootDir), resolve(path));\n  if (!rel || rel === \"..\" || rel.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) || isAbsolute(rel)) return null;\n  return rel.replaceAll(\"\\\\\", \"/\");\n}\n\nexport function displayPath(path: string, rootDir = process.cwd()): string {\n  const rel = relative(rootDir, path);\n  return rel && !rel.startsWith(\"..\") ? rel : path;\n}\n","import { spawn } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nexport interface RunResult {\n  code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/** Subprocess seam: injectable in tests, `defaultRunner` in production. */\nexport type CommandRunner = (cmd: string, args: string[], opts?: { input?: string; cwd?: string }) => Promise<RunResult>;\n\nexport const defaultRunner: CommandRunner = (cmd, args, opts) =>\n  new Promise((resolvePromise, reject) => {\n    const child = spawn(cmd, args, { cwd: opts?.cwd, stdio: [\"pipe\", \"pipe\", \"pipe\"] });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout.on(\"data\", (chunk: Buffer) => (stdout += chunk.toString()));\n    child.stderr.on(\"data\", (chunk: Buffer) => (stderr += chunk.toString()));\n    child.on(\"error\", reject);\n    child.on(\"close\", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));\n    child.stdin.end(opts?.input ?? \"\");\n  });\n\nconst WRANGLER_CONFIG_FILES = [\"wrangler.jsonc\", \"wrangler.json\", \"wrangler.toml\"];\n\nexport function findWranglerConfig(rootDir: string): string | null {\n  for (const name of WRANGLER_CONFIG_FILES) {\n    const path = join(rootDir, name);\n    if (existsSync(path)) return path;\n  }\n  return null;\n}\n\n/** Parses wrangler.json/jsonc. Returns null for .toml (unparsed) or invalid JSON. */\nexport function readWranglerConfig(path: string): Record<string, unknown> | null {\n  if (path.endsWith(\".toml\")) return null;\n  try {\n    return JSON.parse(stripJsonComments(readFileSync(path, \"utf8\"))) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n/** Removes // and both-slash block comments without touching string contents. */\nexport function stripJsonComments(text: string): string {\n  let result = \"\";\n  let inString = false;\n  for (let i = 0; i < text.length; i++) {\n    const ch = text[i]!;\n    if (inString) {\n      result += ch;\n      if (ch === \"\\\\\") {\n        result += text[i + 1] ?? \"\";\n        i++;\n      } else if (ch === '\"') {\n        inString = false;\n      }\n      continue;\n    }\n    if (ch === '\"') {\n      inString = true;\n      result += ch;\n      continue;\n    }\n    if (ch === \"/\" && text[i + 1] === \"/\") {\n      while (i < text.length && text[i] !== \"\\n\") i++;\n      result += \"\\n\";\n      continue;\n    }\n    if (ch === \"/\" && text[i + 1] === \"*\") {\n      i += 2;\n      while (i < text.length && !(text[i] === \"*\" && text[i + 1] === \"/\")) i++;\n      i++;\n      continue;\n    }\n    result += ch;\n  }\n  return result;\n}\n\nexport async function wranglerLoggedIn(run: CommandRunner, cwd: string): Promise<boolean> {\n  try {\n    const result = await run(\"npx\", [\"wrangler\", \"whoami\"], { cwd });\n    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);\n  } catch {\n    return false;\n  }\n}\n\n/** Pipes the value via stdin — it never appears on argv or in process listings. */\nexport function wranglerPutSecret(\n  run: CommandRunner,\n  opts: { name: string; value: string; env?: string; cwd: string },\n): Promise<RunResult> {\n  const args = [\"wrangler\", \"secret\", \"put\", opts.name, ...(opts.env ? [\"--env\", opts.env] : [])];\n  return run(\"npx\", args, { input: opts.value, cwd: opts.cwd });\n}\n","import { buildPlan, loadProjectConfig, resolveDataExport, rulesFromSchema, serializedEntities } from \"./config\";\nimport { lintRules, o11yProjectWarnings, trackedSecretFiles, wranglerWarnings } from \"./doctor-checks\";\nimport { readCredentials } from \"./local\";\nimport type { AppRules } from \"./types\";\n\nexport interface DoctorOptions {\n  configPath: string;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/**\n * Validate and summarize an odla project config entirely offline — no network\n * calls and no file writes. Loads `configPath`, builds the provision plan, and\n * resolves the schema and rules (synthesizing deny-all rules from the schema\n * when `db.rules` is omitted and `db.defaultRules` isn't `false`), then prints a\n * summary line for the app, envs, services, schema entity count, rules namespace\n * count, and AI provider.\n *\n * It then collects warnings for the mistakes provision can't fix silently: a\n * schema with no entities, a rules namespace with no matching entity, the `ai`\n * service enabled without an `ai.provider`, `auth.clerk` entries that reference\n * an unset env var (`$FOO`), an `ai.keyEnv` that isn't set (provider key upload\n * will be skipped), and — when `o11y` is enabled — any env whose local\n * credentials lack an ingest token. It also folds in the shared rule linter,\n * git-tracked secret-shaped files, and wrangler config warnings. Prints `ok`\n * when clean, otherwise the warning list. Purely advisory: never throws on\n * warnings and never mutates anything.\n *\n * @param options.configPath Path to the `odla.config.mjs` to inspect.\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport async function doctor(options: DoctorOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const plan = buildPlan(cfg);\n  const hasDb = cfg.services.includes(\"db\");\n  const schema = hasDb ? await resolveDataExport<unknown>(cfg, cfg.db?.schema, [\"schema\", \"SCHEMA\"]) : undefined;\n  const configuredRules = hasDb\n    ? await resolveDataExport<AppRules>(cfg, cfg.db?.rules, [\"rules\", \"RULES\"])\n    : undefined;\n  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : undefined);\n  const entities = serializedEntities(schema);\n\n  out.log(`config: ${cfg.configPath}`);\n  out.log(`app:    ${plan.appName} (${plan.appId})`);\n  out.log(`envs:   ${plan.envs.join(\", \")}`);\n  out.log(`svc:    ${plan.services.join(\", \")}`);\n  out.log(`schema: ${schema ? `${entities.length} entities` : \"none\"}`);\n  out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : \"none\"}`);\n  out.log(`ai:     ${cfg.services.includes(\"ai\") ? (cfg.ai?.provider ?? \"not configured\") : \"not enabled\"}`);\n\n  const warnings: string[] = [];\n  if (schema && entities.length === 0) warnings.push(\"schema has no entities\");\n  if (rules) {\n    for (const ns of Object.keys(rules)) {\n      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include \"${ns}\" but schema has no matching entity`);\n    }\n  }\n  if (cfg.services.includes(\"ai\") && !cfg.ai?.provider) warnings.push(\"ai service is enabled but ai.provider is not set\");\n  if (cfg.auth?.clerk) {\n    for (const [env, value] of Object.entries(cfg.auth.clerk)) {\n      if (typeof value === \"string\" && value.startsWith(\"$\") && !process.env[value.slice(1)]) {\n        warnings.push(`auth.clerk.${env} references unset env var ${value}`);\n      }\n    }\n  }\n  if (cfg.services.includes(\"ai\") && cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) {\n    warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);\n  }\n  if (cfg.services.includes(\"o11y\")) {\n    // o11y enabled but no ingest token = telemetry silently rejected. Provision mints one.\n    const credentials = readCredentials(cfg.local.credentialsFile);\n    for (const env of cfg.envs) {\n      if (!credentials?.envs[env]?.o11yToken) {\n        warnings.push(`o11y is enabled but env \"${env}\" has no ingest token — run \"odla-ai provision\" to mint one`);\n      }\n    }\n    warnings.push(...o11yProjectWarnings(cfg.rootDir));\n  }\n  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));\n  warnings.push(...trackedSecretFiles(cfg.rootDir, undefined, [\n    cfg.local.tokenFile,\n    cfg.local.credentialsFile,\n    cfg.local.devVarsFile,\n  ]));\n  warnings.push(...wranglerWarnings(cfg.rootDir));\n\n  if (warnings.length) {\n    out.log(\"\");\n    out.log(\"warnings:\");\n    for (const warning of warnings) out.log(`  - ${warning}`);\n  } else {\n    out.log(\"ok\");\n  }\n}\n","import { existsSync, mkdirSync, writeFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { ensureGitignore } from \"./local\";\n\nexport interface InitOptions {\n  rootDir?: string;\n  configPath?: string;\n  appId: string;\n  name: string;\n  envs?: string[];\n  services?: string[];\n  aiProvider?: string;\n  force?: boolean;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/**\n * Scaffold a new odla project into `rootDir` (default: cwd). Writes an\n * `odla.config.mjs` (default name, overridable via `configPath`) plus starter\n * `src/odla/schema.mjs` (a single `notes` entity) and `src/odla/rules.mjs`\n * (deny-all), and creates the `src/odla` and `.odla` directories. Also runs\n * `ensureGitignore` so the local token/credentials paths are ignored.\n *\n * Fully local and synchronous — no network calls. The config file is only\n * written when it doesn't already exist unless `force` is set (otherwise it\n * throws); the schema/rules files are written only when missing (never\n * overwritten, even with `force`). `appId` must match `^[a-z0-9][a-z0-9-]*$` or\n * it throws. Defaults: `envs` → `[\"dev\"]`, `services` → `[\"db\",\"ai\"]`,\n * `aiProvider` → `\"anthropic\"` (which also picks the `keyEnv`, e.g.\n * `ANTHROPIC_API_KEY`/`OPENAI_API_KEY`/`GOOGLE_API_KEY`).\n *\n * @param options.appId Slug for the app (lowercase alphanumerics and hyphens).\n * @param options.name Human-readable app name embedded in the config.\n * @param options.rootDir Project root (defaults to `process.cwd()`).\n * @param options.configPath Config filename relative to root (default `odla.config.mjs`).\n * @param options.envs Environment names (default `[\"dev\"]`; production is an explicit opt-in).\n * @param options.services Enabled services (default `[\"db\",\"ai\"]`).\n * @param options.aiProvider AI provider slug (default `\"anthropic\"`).\n * @param options.force Overwrite an existing config file instead of throwing.\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport function initProject(options: InitOptions): void {\n  const out = options.stdout ?? console;\n  const rootDir = resolve(options.rootDir ?? process.cwd());\n  const configPath = resolve(rootDir, options.configPath ?? \"odla.config.mjs\");\n  if (existsSync(configPath) && !options.force) {\n    throw new Error(`${configPath} already exists. Pass --force to overwrite.`);\n  }\n  if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {\n    throw new Error(\"--app-id must be lowercase letters, numbers, and hyphens\");\n  }\n  // Production is an explicit opt-in. This prevents an unattended `init` +\n  // `provision` flow from mutating the live environment by default.\n  const envs = options.envs?.length ? options.envs : [\"dev\"];\n  const services = options.services?.length ? options.services : [\"db\", \"ai\"];\n  const aiProvider = options.aiProvider ?? \"anthropic\";\n\n  mkdirSync(dirname(configPath), { recursive: true });\n  mkdirSync(resolve(rootDir, \"src/odla\"), { recursive: true });\n  mkdirSync(resolve(rootDir, \".odla\"), { recursive: true });\n\n  writeFileSync(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));\n  writeIfMissing(resolve(rootDir, \"src/odla/schema.mjs\"), schemaTemplate());\n  writeIfMissing(resolve(rootDir, \"src/odla/rules.mjs\"), rulesTemplate());\n  ensureGitignore(rootDir);\n\n  out.log(`created ${relativeDisplay(configPath, rootDir)}`);\n  out.log(\"created src/odla/schema.mjs and src/odla/rules.mjs\");\n  out.log(\"updated .gitignore for local odla credentials\");\n}\n\nfunction writeIfMissing(path: string, text: string): void {\n  if (existsSync(path)) return;\n  writeFileSync(path, text);\n}\n\nfunction configTemplate(input: { appId: string; name: string; envs: string[]; services: string[]; aiProvider: string }): string {\n  return `export default {\n  platformUrl: process.env.ODLA_PLATFORM_URL ?? \"https://odla.ai\",\n  dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? \"https://db.odla.ai\",\n  app: {\n    id: \"${input.appId}\",\n    name: \"${input.name.replace(/\"/g, '\\\\\"')}\",\n  },\n  envs: ${JSON.stringify(input.envs)},\n  services: ${JSON.stringify(input.services)},\n  db: {\n    schema: \"./src/odla/schema.mjs\",\n    rules: \"./src/odla/rules.mjs\",\n    // When rules is omitted, the CLI generates deny-all rules from schema.\n    defaultRules: \"deny\",\n  },\n  ai: {\n    provider: process.env.ODLA_AI_PROVIDER ?? \"${input.aiProvider}\",\n    // Optional: set this env var while running provision to store the provider\n    // key in the platform vault for each tenant.\n    keyEnv: \"${defaultKeyEnv(input.aiProvider)}\",\n  },\n  auth: {\n    clerk: {\n      // dev: \"$CLERK_PUBLISHABLE_KEY\",\n      // prod: \"$CLERK_PUBLISHABLE_KEY\",\n    },\n  },\n  // Add \"o11y\" to services to enable observability; provision then mints the\n  // ingest token and scaffolds the ODLA_O11Y_* vars into .dev.vars.\n  // o11y: {\n  //   service: \"${input.appId}\",   // defaults to the app id\n  //   // endpoint: \"https://o11y.odla.ai\",\n  // },\n  links: {\n    // dev: \"https://dev.example.com\",\n    // prod: \"https://example.com\",\n  },\n  local: {\n    tokenFile: \".odla/dev-token.json\",\n    credentialsFile: \".odla/credentials.local.json\",\n    devVarsFile: \".dev.vars\",\n  },\n};\n`;\n}\n\nfunction schemaTemplate(): string {\n  return `// Replace this starter schema with your app's odla-db schema.\n// Knowledge-graph projects can export @odla-ai/kg's toSerializedSchema(ontology).\nexport const schema = {\n  entities: {\n    notes: {\n      attrs: {\n        id: { type: \"string\", unique: true, indexed: true, optional: false },\n        text: { type: \"string\", unique: false, indexed: false, optional: false },\n        createdAt: { type: \"number\", unique: false, indexed: true, optional: false },\n      },\n    },\n  },\n  links: {},\n};\n`;\n}\n\nfunction rulesTemplate(): string {\n  return `// odla-db is default-deny. The starter keeps runtime data backend-only.\nexport const rules = {\n  notes: {\n    view: \"false\",\n    create: \"false\",\n    update: \"false\",\n    delete: \"false\",\n  },\n};\n`;\n}\n\nfunction defaultKeyEnv(provider: string): string {\n  if (provider === \"openai\") return \"OPENAI_API_KEY\";\n  if (provider === \"google\") return \"GOOGLE_API_KEY\";\n  return \"ANTHROPIC_API_KEY\";\n}\n\nfunction relativeDisplay(path: string, rootDir: string): string {\n  return path.startsWith(rootDir) ? path.slice(rootDir.length + 1) : path;\n}\n","import { loadProjectConfig } from \"./config\";\nimport { displayPath, readCredentials } from \"./local\";\nimport { redactSecrets } from \"./redact\";\nimport type { LoadedProjectConfig } from \"./types\";\nimport { defaultRunner, findWranglerConfig, wranglerLoggedIn, wranglerPutSecret } from \"./wrangler\";\nimport type { CommandRunner } from \"./wrangler\";\n\n/** Moves locally stored configured service credentials to one Wrangler environment over stdin. */\nexport interface SecretsPushOptions {\n  configPath: string;\n  env: string;\n  dryRun?: boolean;\n  /** Required to push to a prod-named env; the visible consent token in agent transcripts. */\n  yes?: boolean;\n  runner?: CommandRunner;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\nexport interface SecretsPreflightOptions {\n  configPath: string;\n  runner?: CommandRunner;\n}\n\nconst PROD_ENV_NAMES = new Set([\"prod\", \"production\"]);\n\n/**\n * Moves the env's configured db and/or o11y credentials from the private local\n * credentials file into the Worker, piping values over stdin so they never\n * appear on argv, in output, or in the conversation transcript.\n */\nexport async function secretsPush(options: SecretsPushOptions): Promise<void> {\n  await secretsPushImpl(options, true);\n}\n\n/** @internal Push after the caller has completed `preflightSecretsPush`. */\nexport async function secretsPushAfterPreflight(options: SecretsPushOptions): Promise<void> {\n  await secretsPushImpl(options, false);\n}\n\nasync function secretsPushImpl(options: SecretsPushOptions, preflight: boolean): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const env = options.env;\n\n  if (!cfg.envs.includes(env)) {\n    throw new Error(`env \"${env}\" is not in config envs (${cfg.envs.join(\", \")})`);\n  }\n  if (PROD_ENV_NAMES.has(env) && !options.yes) {\n    throw new Error(`refusing to push a secret to \"${env}\" without --yes`);\n  }\n\n  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);\n  const credentials = readCredentials(cfg.local.credentialsFile);\n  if (!credentials) throw new Error(`no credentials at ${credentialsPath} — run \"odla-ai provision\" first`);\n  if (credentials.appId !== cfg.app.id) {\n    throw new Error(`credentials at ${credentialsPath} are for \"${credentials.appId}\", not \"${cfg.app.id}\"`);\n  }\n  const entry = credentials.envs[env];\n  if (!entry) throw new Error(`no credentials for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n\n  const secrets: Array<{ name: string; value: string }> = [];\n  if (cfg.services.includes(\"o11y\")) {\n    if (!entry.o11yToken) throw new Error(`no o11y token for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n    secrets.push({ name: \"ODLA_O11Y_TOKEN\", value: entry.o11yToken });\n  }\n  if (cfg.services.includes(\"db\")) {\n    if (!entry.dbKey) throw new Error(`no db key for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n    secrets.push({ name: \"ODLA_API_KEY\", value: entry.dbKey });\n  }\n  if (secrets.length === 0) {\n    out.log(`${env}: no configured Worker secrets to push`);\n    return;\n  }\n\n  // Convention from the reference apps: the top-level wrangler config is prod;\n  // every other env is a named `env.<name>` block.\n  const wranglerEnv = PROD_ENV_NAMES.has(env) ? undefined : env;\n  const target = wranglerEnv ? `wrangler env \"${wranglerEnv}\"` : \"the top-level (prod) wrangler env\";\n\n  if (options.dryRun) {\n    assertWranglerConfig(cfg);\n    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);\n    return;\n  }\n\n  const run = options.runner ?? defaultRunner;\n  if (preflight) await preflightLoadedConfig(cfg, run);\n\n  for (const s of secrets) {\n    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });\n    if (result.code !== 0) {\n      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);\n    }\n    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);\n  }\n}\n\n/** Check Wrangler config and login before provisioning issues or rotates secrets. */\nexport async function preflightSecretsPush(options: SecretsPreflightOptions): Promise<void> {\n  const cfg = await loadProjectConfig(options.configPath);\n  if (!cfg.services.some((service) => service === \"db\" || service === \"o11y\")) return;\n  await preflightLoadedConfig(cfg, options.runner ?? defaultRunner);\n}\n\nasync function preflightLoadedConfig(cfg: LoadedProjectConfig, run: CommandRunner): Promise<void> {\n  assertWranglerConfig(cfg);\n  if (!(await wranglerLoggedIn(run, cfg.rootDir))) {\n    throw new Error(`wrangler is not logged in — run \"wrangler login\" (a browser step for the human)`);\n  }\n}\n\nfunction assertWranglerConfig(cfg: LoadedProjectConfig): void {\n  if (!findWranglerConfig(cfg.rootDir)) {\n    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);\n  }\n}\n","import { createAppsClient, tenantIdFor } from \"@odla-ai/apps\";\nimport { DEFAULT_SECRET_NAMES, putSecret } from \"@odla-ai/ai\";\nimport process from \"node:process\";\nimport type { AppRules, LoadedProjectConfig, ProvisionOptions } from \"./types\";\nimport { buildPlan, envValue, loadProjectConfig, resolveDataExport, rulesFromSchema } from \"./config\";\nimport { getDeveloperToken } from \"./token\";\nimport {\n  displayPath, ensureGitignore, gitignoreEntry, o11yDevVars, readCredentials, resolveWriteDevVarsTarget, writeDevVars,\n} from \"./local\";\nimport { provisionEnvCredentials } from \"./provision-credentials\";\nimport { redactSecrets } from \"./redact\";\nimport { preflightSecretsPush, secretsPushAfterPreflight } from \"./secrets\";\n\ntype FetchLike = typeof fetch;\n\n/**\n * Provision an app end-to-end from its config — the primary deploy path, and\n * (apart from key rotation) idempotent, so re-running is safe. Obtains a\n * developer token, creates the registry app when absent, enables each service\n * per env (AI also gets `setAi` with the configured provider/model), configures\n * Clerk auth and links, then per env mints or reuses credentials only for the\n * configured services, pushes the schema with the db key and the\n * rules with the developer token, and stores the provider key in the tenant\n * vault when `ai.keyEnv` is set and present. Finally writes the credentials file\n * (mode 0600, gitignored) and, when requested, `.dev.vars`.\n *\n * The developer token comes from (in order) `options.token`, `$ODLA_DEV_TOKEN`,\n * the cached `.odla` token, or a fresh device handshake — which prints a user\n * code + approval URL and, in interactive terminals, auto-opens the browser\n * (`open: true`/`false` forces/suppresses it). Network error bodies pass through\n * `redactSecrets` before display.\n *\n * @param options.dryRun Print the resolved plan and return before any network call/write.\n * @param options.rotateKeys Rotate db keys and o11y tokens.\n * @param options.rotateO11yToken Rotate only the o11y token.\n * @param options.pushSecrets Preflight Wrangler, then push each env's configured\n *   Worker secrets immediately after credential provisioning.\n * @param options.writeDevVars `true`/a path writes `.dev.vars`; `writeCredentials: false` skips the creds file.\n * @param options.yes Required for a non-dry-run plan containing `prod` or\n *   `production`; callers must show and review `dryRun` output first.\n * @throws When a production plan is executed without `yes`, configuration is\n *   invalid, authorization fails, or a provisioning operation fails.\n */\nexport async function provision(options: ProvisionOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const plan = buildPlan(cfg);\n  const hasDb = cfg.services.includes(\"db\");\n  const hasO11y = cfg.services.includes(\"o11y\");\n\n  if (options.rotateO11yToken && !hasO11y) {\n    throw new Error(\"--rotate-o11y-token requires the o11y service in odla.config.mjs\");\n  }\n  if (options.pushSecrets && options.writeCredentials === false) {\n    throw new Error(\"--push-secrets cannot be combined with --no-write-credentials\");\n  }\n\n  out.log(`odla-ai: ${plan.appName} (${plan.appId})`);\n  out.log(`  platform: ${plan.platformUrl}`);\n  out.log(`  db:       ${plan.dbEndpoint}`);\n  out.log(`  envs:     ${plan.envs.join(\", \")}`);\n  out.log(`  services: ${plan.services.join(\", \")}`);\n\n  const productionEnvs = plan.envs.filter((env) => env === \"prod\" || env === \"production\");\n  if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {\n    throw new Error(\n      `refusing to provision production env ${productionEnvs.join(\", \")} without --yes; run --dry-run first`,\n    );\n  }\n\n  const schema = hasDb ? await resolveDataExport<unknown>(cfg, cfg.db?.schema, [\"schema\", \"SCHEMA\"]) : undefined;\n  const configuredRules = hasDb ? await resolveDataExport<AppRules>(cfg, cfg.db?.rules, [\"rules\", \"RULES\"]) : undefined;\n  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : undefined);\n\n  if (options.dryRun) {\n    out.log(\"dry run: no network calls or file writes\");\n    out.log(`  schema: ${schema ? \"yes\" : \"no\"}`);\n    out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);\n    out.log(`  ai:     ${cfg.services.includes(\"ai\") ? (cfg.ai?.provider ?? \"not configured\") : \"not enabled\"}`);\n    out.log(`  secrets: ${options.pushSecrets ? \"push configured Worker secrets\" : \"local only\"}`);\n    return;\n  }\n\n  let credentials = readCredentials(cfg.local.credentialsFile);\n  if (credentials && credentials.appId !== cfg.app.id) {\n    throw new Error(\n      `credentials at ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} are for \"${credentials.appId}\", not \"${cfg.app.id}\"`,\n    );\n  }\n  const rotatesO11y = !!(options.rotateKeys || options.rotateO11yToken);\n  const missingO11y = cfg.envs.some((env) => !credentials?.envs[env]?.o11yToken);\n  const missingDb = cfg.envs.some((env) => !credentials?.envs[env]?.dbKey);\n  const losesShownOnceCredential = (hasDb && (!!options.rotateKeys || missingDb)) || (hasO11y && (rotatesO11y || missingO11y));\n  if (options.writeCredentials === false && losesShownOnceCredential) {\n    throw new Error(\"credential issuance/rotation requires the private credentials file; remove --no-write-credentials\");\n  }\n  const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);\n  if (cfg.local.gitignore) {\n    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, cfg.local.credentialsFile, ...(devVarsTarget ? [devVarsTarget] : [])]);\n  }\n  if (options.pushSecrets) {\n    await preflightSecretsPush({ configPath: cfg.configPath, runner: options.secretRunner });\n    out.log(\"secrets: Wrangler config and login preflight passed\");\n  }\n\n  const doFetch = options.fetch ?? fetch;\n  const token = await getDeveloperToken(cfg, options, doFetch, out);\n  const apps = createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });\n\n  const existing = await readRegistryApp(cfg, token, doFetch);\n  if (existing) {\n    out.log(`app: ${cfg.app.id} already exists`);\n  } else {\n    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });\n    out.log(`app: created ${cfg.app.id}`);\n  }\n\n  for (const env of cfg.envs) {\n    for (const service of cfg.services) {\n      if (service === \"ai\") {\n        if (cfg.ai?.provider) {\n          await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...(cfg.ai.model ? { model: cfg.ai.model } : {}) });\n          out.log(`${env}: ai configured (${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : \"\"})`);\n        } else {\n          await apps.setService(cfg.app.id, \"ai\", true, { env });\n          out.log(`${env}: ai enabled`);\n        }\n      } else {\n        await apps.setService(cfg.app.id, service, true, { env });\n        out.log(`${env}: ${service} enabled`);\n      }\n    }\n\n    const authConfig = normalizeClerkConfig(cfg.auth?.clerk?.[env]);\n    if (authConfig?.publishableKey) {\n      await apps.setAuth(cfg.app.id, env, authConfig);\n      out.log(`${env}: auth configured (clerk ${authConfig.mode ?? \"client\"})`);\n    }\n\n    const link = cfg.links?.[env];\n    if (link !== undefined) {\n      await apps.setLink(cfg.app.id, env, link ?? null);\n      out.log(`${env}: link ${link ? \"set\" : \"cleared\"}`);\n    }\n  }\n\n  for (const env of cfg.envs) {\n    const tenantId = tenantIdFor(cfg.app.id, env);\n    credentials = await provisionEnvCredentials({\n      cfg,\n      env,\n      developerToken: token,\n      credentials,\n      rotateDb: !!options.rotateKeys,\n      rotateO11y: rotatesO11y,\n      write: options.writeCredentials !== false,\n      fetch: doFetch,\n      stdout: out,\n    });\n    const dbKey = credentials.envs[env]?.dbKey;\n\n    if (options.pushSecrets) {\n      try {\n        await secretsPushAfterPreflight({\n          configPath: cfg.configPath,\n          env,\n          yes: options.yes,\n          runner: options.secretRunner,\n          stdout: out,\n        });\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        const consent = env === \"prod\" || env === \"production\" ? \" --yes\" : \"\";\n        throw new Error(\n          `${message}\\n${env}: credentials are already saved; retry ` +\n          `\"odla-ai secrets push --env ${env}${consent}\" without issuing or rotating again`,\n          { cause: error },\n        );\n      }\n    }\n\n    if (schema && dbKey) {\n      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });\n      out.log(`${env}: schema pushed`);\n    }\n    if (rules) {\n      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);\n      out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);\n    }\n\n    if (cfg.services.includes(\"ai\") && cfg.ai?.provider && cfg.ai.keyEnv) {\n      const key = process.env[cfg.ai.keyEnv];\n      if (key) {\n        const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);\n        await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);\n        out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);\n      } else {\n        out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);\n      }\n    }\n\n  }\n\n  if (options.writeCredentials !== false && credentials) {\n    const ignored = cfg.local.gitignore && gitignoreEntry(cfg.rootDir, cfg.local.credentialsFile);\n    out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600${ignored ? \", gitignored\" : \"\"})`);\n  }\n\n  if (devVarsTarget && credentials) {\n    const env = cfg.envs.includes(\"dev\") ? \"dev\" : (cfg.envs[0] ?? \"prod\");\n    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));\n    out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);\n  }\n}\n\nasync function readRegistryApp(cfg: LoadedProjectConfig, token: string, doFetch: FetchLike): Promise<unknown | null> {\n  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {\n    headers: { authorization: `Bearer ${token}` },\n  });\n  if (res.status === 404) return null;\n  if (!res.ok) return null;\n  const json = (await res.json()) as { app?: unknown };\n  return json.app ?? null;\n}\n\nasync function postJson(doFetch: FetchLike, url: string, bearer: string, body: unknown): Promise<void> {\n  const res = await doFetch(url, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${bearer}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify(body),\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText(res)}`);\n}\n\nfunction normalizeClerkConfig(value: unknown): { publishableKey: string; audience?: string; mode?: \"client\" | \"full\" } | null {\n  if (!value) return null;\n  if (typeof value === \"string\") {\n    const publishableKey = envValue(value);\n    return publishableKey ? { publishableKey } : null;\n  }\n  if (typeof value !== \"object\") return null;\n  const cfg = value as { publishableKey?: string; audience?: string; mode?: \"client\" | \"full\" };\n  const publishableKey = envValue(cfg.publishableKey);\n  return publishableKey ? { publishableKey, ...(cfg.audience ? { audience: cfg.audience } : {}), ...(cfg.mode ? { mode: cfg.mode } : {}) } : null;\n}\n\nfunction defaultSecretName(provider: string): string {\n  const names = DEFAULT_SECRET_NAMES as Record<string, string>;\n  return names[provider] ?? `${provider}_api_key`;\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return redactSecrets((await res.text()).slice(0, 500));\n  } catch {\n    return \"\";\n  }\n}\n","import { requestToken } from \"@odla-ai/db\";\nimport process from \"node:process\";\nimport type { LoadedProjectConfig, ProvisionOptions } from \"./types\";\nimport { openUrl } from \"./open\";\nimport { displayPath, readJsonFile, writePrivateJson } from \"./local\";\n\ntype FetchLike = typeof fetch;\n\nexport async function getDeveloperToken(\n  cfg: LoadedProjectConfig,\n  options: ProvisionOptions,\n  doFetch: FetchLike,\n  out: Pick<typeof console, \"log\" | \"error\">,\n): Promise<string> {\n  if (options.token) return options.token;\n  if (process.env.ODLA_DEV_TOKEN) return process.env.ODLA_DEV_TOKEN;\n\n  const cached = readJsonFile<{ token?: string; expiresAt?: number }>(cfg.local.tokenFile);\n  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 60_000) {\n    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);\n    return cached.token;\n  }\n\n  const browser = approvalBrowser(options);\n  const { token, expiresAt } = await requestToken({\n    endpoint: cfg.platformUrl,\n    label: `${cfg.app.id} provisioner`,\n    fetch: doFetch,\n    onCode: async ({ userCode, expiresIn }) => {\n      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);\n      out.log(\"\");\n      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);\n      if (browser.open) {\n        try {\n          await (options.openApprovalUrl ?? openUrl)(approvalUrl);\n          out.log(`auth: opened browser for approval${browser.mode === \"auto\" ? \" (auto)\" : \"\"}`);\n        } catch (err) {\n          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);\n        }\n      } else if (browser.reason) {\n        out.log(`auth: browser launch skipped (${browser.reason})`);\n      }\n      out.log(\"\");\n    },\n  });\n  writePrivateJson(cfg.local.tokenFile, { token, expiresAt });\n  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);\n  return token;\n}\n\nexport function approvalBrowser(options: ProvisionOptions): { open: boolean; mode?: \"auto\" | \"forced\"; reason?: string } {\n  if (options.open === true) return { open: true, mode: \"forced\" };\n  if (options.open === false) return { open: false, reason: \"disabled by --no-open\" };\n  if (process.env.CI) return { open: false, reason: \"CI environment\" };\n\n  const interactive = options.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);\n  if (!interactive) return { open: false, reason: \"non-interactive shell; pass --open to force\" };\n  return { open: true, mode: \"auto\" };\n}\n\nexport function handshakeUrl(platformUrl: string, userCode: string): string {\n  const url = new URL(\"/studio\", platformUrl);\n  url.searchParams.set(\"code\", userCode);\n  return url.toString();\n}\n","import { spawn } from \"node:child_process\";\nimport process from \"node:process\";\n\nexport interface OpenUrlOptions {\n  platform?: NodeJS.Platform;\n  spawnImpl?: typeof spawn;\n}\n\nexport async function openUrl(url: string, options: OpenUrlOptions = {}): Promise<void> {\n  const command = openerFor(options.platform ?? process.platform);\n  const doSpawn = options.spawnImpl ?? spawn;\n  await new Promise<void>((resolve, reject) => {\n    const child = doSpawn(command.cmd, [...command.args, url], {\n      stdio: \"ignore\",\n      detached: true,\n    });\n    child.once(\"error\", reject);\n    child.once(\"spawn\", () => {\n      child.unref();\n      resolve();\n    });\n  });\n}\n\nexport function openerFor(platform: NodeJS.Platform): { cmd: string; args: string[] } {\n  if (platform === \"darwin\") return { cmd: \"open\", args: [] };\n  if (platform === \"win32\") return { cmd: \"cmd\", args: [\"/c\", \"start\", \"\"] };\n  return { cmd: \"xdg-open\", args: [] };\n}\n","import { tenantIdFor } from \"@odla-ai/apps\";\nimport type { LoadedProjectConfig, LocalCredentials } from \"./types\";\nimport { mergeCredential, writePrivateJson } from \"./local\";\nimport { redactSecrets } from \"./redact\";\n\ntype FetchLike = typeof fetch;\n\ninterface ProvisionEnvCredentialsOptions {\n  cfg: LoadedProjectConfig;\n  env: string;\n  developerToken: string;\n  credentials: LocalCredentials | null;\n  rotateDb: boolean;\n  rotateO11y: boolean;\n  write: boolean;\n  fetch: FetchLike;\n  stdout: Pick<typeof console, \"log\">;\n}\n\n/** Mint/reuse only the credentials required by configured services. */\nexport async function provisionEnvCredentials(opts: ProvisionEnvCredentialsOptions): Promise<LocalCredentials> {\n  const tenantId = tenantIdFor(opts.cfg.app.id, opts.env);\n  const prior = opts.credentials?.envs[opts.env];\n  let credentials = opts.credentials;\n  let dbKey = opts.cfg.services.includes(\"db\") && !opts.rotateDb ? prior?.dbKey : undefined;\n  let o11yToken = opts.cfg.services.includes(\"o11y\") && !opts.rotateO11y ? prior?.o11yToken : undefined;\n\n  if (opts.cfg.services.includes(\"db\")) {\n    if (dbKey) {\n      opts.stdout.log(`${opts.env}: reusing local db key for ${tenantId}`);\n    } else {\n      dbKey = await mintDbKey(opts, tenantId);\n      credentials = save(opts, credentials, tenantId, { dbKey });\n      opts.stdout.log(`${opts.env}: minted db key for ${tenantId}`);\n    }\n  }\n\n  if (opts.cfg.services.includes(\"o11y\")) {\n    if (o11yToken) {\n      opts.stdout.log(`${opts.env}: reusing local o11y ingest token`);\n    } else {\n      o11yToken = await issueO11yToken(opts);\n      credentials = save(opts, credentials, tenantId, { ...(dbKey ? { dbKey } : {}), o11yToken });\n      opts.stdout.log(`${opts.env}: ${opts.rotateO11y ? \"rotated\" : \"issued\"} o11y ingest token`);\n    }\n  }\n\n  return save(opts, credentials, tenantId, {\n    ...(dbKey ? { dbKey } : {}),\n    ...(o11yToken ? { o11yToken } : {}),\n  });\n}\n\nfunction save(\n  opts: ProvisionEnvCredentialsOptions,\n  current: LocalCredentials | null,\n  tenantId: string,\n  values: { dbKey?: string; o11yToken?: string },\n): LocalCredentials {\n  const next = mergeCredential(current, {\n    appId: opts.cfg.app.id,\n    platformUrl: opts.cfg.platformUrl,\n    dbEndpoint: opts.cfg.dbEndpoint,\n    env: opts.env,\n    tenantId,\n    ...values,\n  });\n  if (opts.write) writePrivateJson(opts.cfg.local.credentialsFile, next);\n  return next;\n}\n\nasync function mintDbKey(opts: ProvisionEnvCredentialsOptions, tenantId: string): Promise<string> {\n  const headers = { authorization: `Bearer ${opts.developerToken}`, \"content-type\": \"application/json\" };\n  let res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {\n    method: \"POST\",\n    headers,\n    body: \"{}\",\n  });\n  if (res.status === 404) {\n    const created = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({\n        name: opts.env === \"prod\" ? opts.cfg.app.name : `${opts.cfg.app.name} (${opts.env})`,\n        appId: tenantId,\n      }),\n    });\n    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText(created)}`);\n    res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {\n      method: \"POST\",\n      headers,\n      body: \"{}\",\n    });\n  }\n  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText(res)}`);\n  const body = (await res.json()) as { key?: string };\n  if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);\n  return body.key;\n}\n\nasync function issueO11yToken(opts: ProvisionEnvCredentialsOptions): Promise<string> {\n  const suffix = opts.rotateO11y ? \"/rotate\" : \"\";\n  const res = await opts.fetch(\n    `${opts.cfg.platformUrl}/o11y/${encodeURIComponent(opts.cfg.app.id)}/token${suffix}?env=${encodeURIComponent(opts.env)}`,\n    { method: \"POST\", headers: { authorization: `Bearer ${opts.developerToken}` } },\n  );\n  if (res.status === 409 && !opts.rotateO11y) {\n    throw new Error(\n      `o11y token already exists for env \"${opts.env}\", but its shown-once value is not in the local credentials file; ` +\n      `run \"odla-ai provision --rotate-o11y-token --push-secrets\" to replace it explicitly`,\n    );\n  }\n  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? \"rotation\" : \"issue\"} (${opts.env}) failed: ${res.status} ${await safeText(res)}`);\n  const body = (await res.json()) as { token?: string };\n  if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? \"rotation\" : \"issue\"} (${opts.env}) returned no token`);\n  return body.token;\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return redactSecrets((await res.text()).slice(0, 500));\n  } catch {\n    return \"\";\n  }\n}\n","import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { claudeAdapter, CURSOR_RULE, PROJECT_INSTRUCTIONS } from \"./skill-adapters\";\n\n/** Agent harnesses with a first-class local adapter. */\nexport const AGENT_HARNESSES = [\"claude\", \"codex\", \"cursor\", \"copilot\", \"gemini\", \"agents\"] as const;\n\n/** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */\nexport type AgentHarness = (typeof AGENT_HARNESSES)[number];\n\n/** A harness name accepted by setup; `all` expands to every project-local adapter. */\nexport type AgentHarnessSelector = AgentHarness | \"all\";\n\n/** Controls project-local or global installation of the bundled agent runbooks. */\nexport interface SkillInstallOptions {\n  /** Project directory receiving the shared runbooks and harness adapters. Defaults to cwd. */\n  dir?: string;\n  /** Install user-wide Claude and/or Codex skills instead of project adapters. */\n  global?: boolean;\n  /** Harnesses to install. The programmatic compatibility default is `claude`; the CLI passes `all`. */\n  harnesses?: AgentHarnessSelector[];\n  /** Overwrite locally modified odla-managed files or managed instruction sections. */\n  force?: boolean;\n  /** Test/embedding override for the home directory. */\n  homeDir?: string;\n  /** Test/embedding override for `$CODEX_HOME`. */\n  codexHomeDir?: string;\n  /** Test/embedding override for the bundled skills directory. */\n  sourceDir?: string;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** One harness adapter and the directories or files through which it discovers odla. */\nexport interface HarnessInstallResult {\n  harness: AgentHarness;\n  targets: string[];\n}\n\n/** Files written or left unchanged by an idempotent agent-runbook installation. */\nexport interface SkillInstallResult {\n  /** Primary native skill directory, retained for compatibility with earlier callers. */\n  targetDir: string;\n  /** Files changed directly under `targetDir`, relative to that directory. */\n  written: string[];\n  /** Files already current directly under `targetDir`, relative to that directory. */\n  unchanged: string[];\n  /** Absolute paths of every changed shared-runbook or adapter file. */\n  writtenPaths: string[];\n  /** Absolute paths of every already-current shared-runbook or adapter file. */\n  unchangedPaths: string[];\n  harnesses: HarnessInstallResult[];\n}\n\ninterface PlannedFile {\n  target: string;\n  content: string;\n  boundary: string;\n  managedMerge?: boolean;\n}\n\n/**\n * Installs one shared offline runbook tree plus thin native adapters for the\n * selected coding-agent harnesses. Project installs use `.agents/skills/` as\n * the canonical bundle; Claude Code, Cursor, Copilot, Gemini, and generic\n * `AGENTS.md` adapters point to it. Global installs support the native Claude\n * and Codex skill roots only.\n *\n * Installation is idempotent and planned before any write: an odla-managed\n * file changed by the user aborts the whole operation unless `force` is set.\n * Existing `AGENTS.md`, `GEMINI.md`, and Copilot instructions are preserved;\n * only the bounded odla-managed section is appended or replaced.\n */\nexport function installSkill(options: SkillInstallOptions = {}): SkillInstallResult {\n  const out = options.stdout ?? console;\n  const sourceDir = options.sourceDir ?? fileURLToPath(new URL(\"../skills\", import.meta.url));\n  const files = listFiles(sourceDir);\n  if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);\n\n  const harnesses = normalizeHarnesses(options.harnesses, options.global === true);\n  const root = resolve(options.dir ?? process.cwd());\n  const home = resolve(options.homeDir ?? homedir());\n  const plans = new Map<string, PlannedFile>();\n  const targets = new Map<AgentHarness, Set<string>>();\n\n  const rememberTarget = (harness: AgentHarness, target: string): void => {\n    const current = targets.get(harness) ?? new Set<string>();\n    current.add(target);\n    targets.set(harness, current);\n  };\n  const plan = (target: string, content: string, managedMerge = false, boundary = root): void => {\n    const existing = plans.get(target);\n    if (existing && existing.content !== content) throw new Error(`internal agent setup conflict for ${target}`);\n    plans.set(target, { target, content, boundary, managedMerge });\n  };\n  const planSkillTree = (targetDir: string, boundary = root): void => {\n    for (const rel of files) plan(join(targetDir, rel), readFileSync(join(sourceDir, rel), \"utf8\"), false, boundary);\n  };\n\n  let targetDir: string;\n  if (options.global) {\n    const claudeRoot = join(home, \".claude\", \"skills\");\n    const codexRoot = resolve(options.codexHomeDir ?? process.env.CODEX_HOME ?? join(home, \".codex\"), \"skills\");\n    targetDir = harnesses[0] === \"codex\" ? codexRoot : claudeRoot;\n    for (const harness of harnesses) {\n      const skillRoot = harness === \"claude\" ? claudeRoot : codexRoot;\n      planSkillTree(skillRoot, harness === \"claude\" ? home : dirname(dirname(codexRoot)));\n      rememberTarget(harness, skillRoot);\n    }\n  } else {\n    const sharedRoot = join(root, \".agents\", \"skills\");\n    planSkillTree(sharedRoot);\n\n    const claudeRoot = join(root, \".claude\", \"skills\");\n    targetDir = harnesses.includes(\"claude\") ? claudeRoot : sharedRoot;\n    for (const harness of harnesses) rememberTarget(harness, sharedRoot);\n\n    if (harnesses.includes(\"claude\")) {\n      for (const skill of skillNames(files)) {\n        const canonical = readFileSync(join(sourceDir, skill, \"SKILL.md\"), \"utf8\");\n        plan(join(claudeRoot, skill, \"SKILL.md\"), claudeAdapter(skill, canonical));\n      }\n      rememberTarget(\"claude\", claudeRoot);\n    }\n    if (harnesses.includes(\"cursor\")) {\n      const cursorRule = join(root, \".cursor\", \"rules\", \"odla.mdc\");\n      plan(cursorRule, CURSOR_RULE);\n      rememberTarget(\"cursor\", cursorRule);\n    }\n    if (harnesses.includes(\"agents\")) {\n      const agentsFile = join(root, \"AGENTS.md\");\n      plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"agents\", agentsFile);\n    }\n    if (harnesses.includes(\"copilot\")) {\n      const copilotFile = join(root, \".github\", \"copilot-instructions.md\");\n      plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"copilot\", copilotFile);\n    }\n    if (harnesses.includes(\"gemini\")) {\n      const geminiFile = join(root, \"GEMINI.md\");\n      plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"gemini\", geminiFile);\n    }\n  }\n\n  const writtenPaths = new Set<string>();\n  const unchangedPaths = new Set<string>();\n  const conflicts: string[] = [];\n  for (const file of plans.values()) {\n    const symlink = symlinkedComponent(file.boundary, file.target);\n    if (symlink) {\n      conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);\n      continue;\n    }\n    if (!existsSync(file.target)) {\n      writtenPaths.add(file.target);\n      continue;\n    }\n    const current = readFileSync(file.target, \"utf8\");\n    if (current === file.content) {\n      unchangedPaths.add(file.target);\n    } else if (file.managedMerge || options.force) {\n      writtenPaths.add(file.target);\n      unchangedPaths.delete(file.target);\n    } else {\n      conflicts.push(file.target);\n    }\n  }\n\n  if (conflicts.length > 0) {\n    throw new Error(\n      `agent setup files modified locally (re-run with --force to replace only odla-managed content):\\n${conflicts.map((f) => `  - ${f}`).join(\"\\n\")}`,\n    );\n  }\n\n  for (const file of plans.values()) {\n    if (!existsSync(file.target) || readFileSync(file.target, \"utf8\") !== file.content) {\n      mkdirSync(dirname(file.target), { recursive: true });\n      writeFileSync(file.target, file.content);\n    }\n  }\n\n  const skills = skillNames(files);\n  const installations = harnesses.map((harness) => ({ harness, targets: [...(targets.get(harness) ?? [])] }));\n  out.log(`agent harnesses: ${harnesses.join(\", \")}`);\n  out.log(`offline skills: ${skills.join(\", \")}`);\n  for (const installation of installations) out.log(`${installation.harness}: ${installation.targets.join(\", \")}`);\n  out.log(`installed ${writtenPaths.size} managed file(s)${unchangedPaths.size ? ` (${unchangedPaths.size} unchanged)` : \"\"}`);\n  return {\n    targetDir,\n    written: pathsUnder(targetDir, writtenPaths),\n    unchanged: pathsUnder(targetDir, unchangedPaths),\n    writtenPaths: [...writtenPaths].sort(),\n    unchangedPaths: [...unchangedPaths].sort(),\n    harnesses: installations,\n  };\n}\n\nfunction pathsUnder(root: string, paths: Set<string>): string[] {\n  return [...paths]\n    .map((path) => relative(root, path))\n    .filter((path) => path !== \"..\" && !path.startsWith(`..${sep}`) && !isAbsolute(path))\n    .sort();\n}\n\nfunction normalizeHarnesses(values: AgentHarnessSelector[] | undefined, global: boolean): AgentHarness[] {\n  const requested: string[] = values?.length ? values : [\"claude\"];\n  const allowed = new Set<string>([...AGENT_HARNESSES, \"all\"]);\n  for (const harness of requested) {\n    if (!allowed.has(harness)) {\n      throw new Error(`unknown agent harness \"${harness}\"; choose all, ${AGENT_HARNESSES.join(\", \")}`);\n    }\n  }\n  const expanded: AgentHarness[] = requested.includes(\"all\")\n    ? global ? [\"claude\", \"codex\"] : [...AGENT_HARNESSES]\n    : [...new Set(requested)] as AgentHarness[];\n  if (global) {\n    const unsupported = expanded.filter((harness) => harness !== \"claude\" && harness !== \"codex\");\n    if (unsupported.length) {\n      throw new Error(`--global supports claude and codex only; ${unsupported.join(\", \")} require a project-local adapter`);\n    }\n  }\n  return expanded;\n}\n\nfunction managedFileContent(path: string, block: string, force: boolean, boundary: string): string {\n  const symlink = symlinkedComponent(boundary, path);\n  if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);\n  if (!existsSync(path)) return `${block}\\n`;\n  const current = readFileSync(path, \"utf8\");\n  const start = \"<!-- odla-ai agent setup:start -->\";\n  const end = \"<!-- odla-ai agent setup:end -->\";\n  const startAt = current.indexOf(start);\n  const endAt = current.indexOf(end);\n  if ((startAt === -1) !== (endAt === -1) || (startAt !== -1 && endAt < startAt)) {\n    throw new Error(`malformed odla-managed section in ${path}`);\n  }\n  if (startAt === -1) {\n    const separator = current.length === 0 || current.endsWith(\"\\n\\n\") ? \"\" : current.endsWith(\"\\n\") ? \"\\n\" : \"\\n\\n\";\n    return `${current}${separator}${block}\\n`;\n  }\n  const afterEnd = endAt + end.length;\n  const existing = current.slice(startAt, afterEnd);\n  if (existing !== block && !force) {\n    throw new Error(`odla-managed section modified locally in ${path}; re-run with --force to replace that section`);\n  }\n  return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;\n}\n\nfunction symlinkedComponent(boundary: string, target: string): string | undefined {\n  const rel = relative(boundary, target);\n  if (rel === \"..\" || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {\n    throw new Error(`agent setup target escapes its install root: ${target}`);\n  }\n  let current = boundary;\n  for (const part of rel.split(sep).filter(Boolean)) {\n    current = join(current, part);\n    try {\n      if (lstatSync(current).isSymbolicLink()) return current;\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") throw error;\n    }\n  }\n  return undefined;\n}\n\nfunction skillNames(files: string[]): string[] {\n  return [...new Set(files.filter((file) => /(^|[\\\\/])SKILL\\.md$/.test(file)).map((file) => file.split(/[\\\\/]/)[0]!))].sort();\n}\n\nfunction listFiles(dir: string): string[] {\n  if (!existsSync(dir)) return [];\n  const results: string[] = [];\n  const walk = (current: string): void => {\n    for (const entry of readdirSync(current, { withFileTypes: true })) {\n      const path = join(current, entry.name);\n      if (entry.isDirectory()) walk(path);\n      else results.push(relative(dir, path));\n    }\n  };\n  walk(dir);\n  return results.sort();\n}\n","/** Shared instruction block inserted into harness-native project files. */\nexport const PROJECT_INSTRUCTIONS = `<!-- odla-ai agent setup:start -->\n## odla agent workflow\n\nFor work that creates an odla app or adds odla services, read and follow\n\\`.agents/skills/odla/SKILL.md\\`. It dispatches an existing static site to\n\\`.agents/skills/odla-migrate/SKILL.md\\`. For production telemetry triage, use\n\\`.agents/skills/odla-o11y-debug/SKILL.md\\`.\n\nThe complete runbooks and their references are installed in this repository.\nDo not fetch online odla documentation as setup context. Network access is only\nneeded when a runbook deliberately calls the odla service, npm, Cloudflare, or\nanother configured provider.\n<!-- odla-ai agent setup:end -->`;\n\n/** Cursor's native rule wrapper around the shared project instructions. */\nexport const CURSOR_RULE = `---\ndescription: Build, migrate, provision, secure, or debug an odla app using the locally installed odla runbooks\nglobs:\nalwaysApply: false\n---\n\n${PROJECT_INSTRUCTIONS}\n`;\n\n/** Build a thin Claude skill that delegates to the canonical offline bundle. */\nexport function claudeAdapter(skill: string, canonical: string): string {\n  const match = canonical.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---/);\n  if (!match) throw new Error(`bundled skill ${skill} has no YAML frontmatter`);\n  const lines = match[1]!.split(/\\r?\\n/);\n  const frontmatter: string[] = [];\n  let keepIndented = false;\n  for (const line of lines) {\n    if (line.startsWith(\"name:\") || line.startsWith(\"description:\")) {\n      frontmatter.push(line);\n      keepIndented = line.startsWith(\"description:\");\n    } else if (keepIndented && /^\\s+/.test(line)) {\n      frontmatter.push(line);\n    } else {\n      keepIndented = false;\n    }\n  }\n  return `---\n${frontmatter.join(\"\\n\")}\n---\n\n# ${skill} (odla adapter)\n\nRead \\`../../../.agents/skills/${skill}/SKILL.md\\` completely and follow it. That\ncanonical local skill owns every reference path and contains the full offline\nrunbook. Do not substitute a remote documentation page for the installed copy.\n`;\n}\n","import { loadProjectConfig, resolveDataExport, serializedEntities } from \"./config\";\nimport { displayPath, readCredentials } from \"./local\";\nimport type { SmokeOptions } from \"./types\";\n\ntype FetchLike = typeof fetch;\n\n/**\n * Verify a live, already-provisioned environment end-to-end. Resolves the target\n * env (`options.env`, else `dev`, else the first declared env) and requires it to\n * be declared in the config. Reads the local credentials file and checks that it\n * belongs to this app and holds a `tenantId` + `dbKey` for the env — otherwise it\n * throws pointing the user at `odla-ai provision --write-dev-vars`.\n *\n * It then makes real network calls: fetches the registry public-config (and, when\n * `ai.provider` is configured, asserts the live provider matches), fetches the\n * live db schema with the db key and asserts every entity from the local schema\n * is present, and runs a `count` aggregate against the first entity to confirm\n * the db answers queries. Progress lines are printed and it ends with `ok`.\n * Read-only — it writes nothing and throws on the first mismatch or failed\n * request.\n *\n * @param options.configPath Path to the `odla.config.mjs`.\n * @param options.env Env to check (default `dev`, else the first declared env).\n * @param options.fetch Injectable `fetch` (for tests/embedding).\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport async function smoke(options: SmokeOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const env = options.env ?? (cfg.envs.includes(\"dev\") ? \"dev\" : (cfg.envs[0] ?? \"prod\"));\n  if (!cfg.envs.includes(env)) throw new Error(`env \"${env}\" is not declared in ${displayPath(cfg.configPath, cfg.rootDir)}`);\n\n  const credentials = readCredentials(cfg.local.credentialsFile);\n  if (!credentials) {\n    throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run \"odla-ai provision --write-dev-vars\".`);\n  }\n  if (credentials.appId !== cfg.app.id) {\n    throw new Error(`local credentials are for app \"${credentials.appId}\", but config app is \"${cfg.app.id}\"`);\n  }\n\n  const entry = credentials.envs[env];\n  if (!entry?.tenantId || !entry.dbKey) {\n    throw new Error(`local credentials have no db key for env \"${env}\". Run \"odla-ai provision --write-dev-vars\".`);\n  }\n\n  const doFetch = options.fetch ?? fetch;\n  out.log(`smoke: ${cfg.app.id}/${env}`);\n  out.log(`  tenant: ${entry.tenantId}`);\n\n  const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), undefined);\n  out.log(`  public-config: ok`);\n\n  if (cfg.ai?.provider) {\n    const provider = ((publicConfig as { ai?: { provider?: unknown } | null }).ai?.provider ?? null) as string | null;\n    if (provider !== cfg.ai.provider) {\n      throw new Error(`ai provider mismatch: expected \"${cfg.ai.provider}\", public-config has \"${provider ?? \"none\"}\"`);\n    }\n    out.log(`  ai: ${provider}`);\n  }\n\n  const expectedSchema = await resolveDataExport<unknown>(cfg, cfg.db?.schema, [\"schema\", \"SCHEMA\"]);\n  const expectedEntities = serializedEntities(expectedSchema);\n  const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);\n  const liveSchema = (liveSchemaPayload as { schema?: unknown }).schema ?? liveSchemaPayload;\n  const liveEntities = serializedEntities(liveSchema);\n  if (expectedEntities.length) {\n    const missing = expectedEntities.filter((entity) => !liveEntities.includes(entity));\n    if (missing.length) throw new Error(`live schema is missing expected entities: ${missing.join(\", \")}`);\n  }\n  out.log(`  schema: ${liveEntities.length} entities`);\n\n  const aggregateEntity = expectedEntities[0] ?? liveEntities[0];\n  if (aggregateEntity) {\n    const aggregate = await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {\n      ns: aggregateEntity,\n      aggregate: { count: true },\n    });\n    const count = (aggregate as { aggregate?: { count?: unknown } }).aggregate?.count;\n    out.log(`  aggregate: ${aggregateEntity}.count=${String(count ?? \"ok\")}`);\n  } else {\n    out.log(`  aggregate: skipped (schema has no entities)`);\n  }\n  out.log(\"ok\");\n}\n\nasync function getJson(doFetch: FetchLike, url: string, bearer: string | undefined): Promise<unknown> {\n  const res = await doFetch(url, {\n    headers: bearer ? { authorization: `Bearer ${bearer}` } : undefined,\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText(res)}`);\n  return res.json();\n}\n\nasync function postJson(doFetch: FetchLike, url: string, bearer: string, body: unknown): Promise<unknown> {\n  const res = await doFetch(url, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${bearer}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify(body),\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText(res)}`);\n  return res.json();\n}\n\nfunction publicConfigUrl(platformUrl: string, appId: string, env: string): string {\n  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/public-config`, platformUrl);\n  url.searchParams.set(\"env\", env);\n  return url.toString();\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return (await res.text()).slice(0, 500);\n  } catch {\n    return \"\";\n  }\n}\n","import { readFileSync } from \"node:fs\";\nimport { printCapabilities } from \"./capabilities\";\nimport { doctor } from \"./doctor\";\nimport { initProject } from \"./init\";\nimport { provision } from \"./provision\";\nimport { secretsPush } from \"./secrets\";\nimport { installSkill } from \"./skill\";\nimport type { AgentHarnessSelector } from \"./skill\";\nimport { smoke } from \"./smoke\";\nimport type { ProvisionOptions } from \"./types\";\n\n/**\n * Parse CLI arguments and dispatch to the matching command — the entry point\n * `bin.ts` invokes. `argv` defaults to `process.argv.slice(2)`; the first\n * positional selects the command and the rest are parsed into flags (supporting\n * `--flag value`, `--flag=value`, boolean `--flag`, `--no-flag`, and repeated\n * flags collected into arrays).\n *\n * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print\n * and return; `init` scaffolds a project (requires `--app-id` and `--name`);\n * `doctor` validates config offline; `capabilities` prints the responsibility\n * boundary; `provision` runs the full provision (including optional secret\n * rotation, local vars, and deployed secret push); `smoke` checks a live env;\n * `setup` and `skill install` install the bundled offline runbooks for Claude\n * Code, Codex, Cursor, Copilot, Gemini, and `AGENTS.md`-aware agents; and\n * `secrets push` pipes the env's configured db/o11y secrets into the Worker via\n * Wrangler (requires `--env`). Throws on an unknown command/subcommand, unsupported option, extra\n * positional argument, missing required value, or a dispatched command error.\n *\n * @param argv Argument vector without the node/script prefix (default\n *   `process.argv.slice(2)`).\n */\nexport async function runCli(argv = process.argv.slice(2)): Promise<void> {\n  const parsed = parseArgv(argv);\n  const command = parsed.positionals[0] ?? \"help\";\n  if (command === \"version\" || command === \"-v\" || parsed.options.version === true) {\n    assertArgs(parsed, [\"version\"], 1);\n    console.log(cliVersion());\n    return;\n  }\n\n  if (command === \"help\" || command === \"--help\" || command === \"-h\") {\n    assertArgs(parsed, [\"help\"], 1);\n    printHelp();\n    return;\n  }\n\n  if (command === \"init\") {\n    assertArgs(parsed, [\"app-id\", \"name\", \"config\", \"env\", \"services\", \"ai-provider\", \"force\"], 1);\n    initProject({\n      appId: requiredString(parsed.options[\"app-id\"], \"--app-id\"),\n      name: requiredString(parsed.options.name, \"--name\"),\n      configPath: stringOpt(parsed.options.config),\n      envs: listOpt(parsed.options.env),\n      services: listOpt(parsed.options.services),\n      aiProvider: stringOpt(parsed.options[\"ai-provider\"]),\n      force: parsed.options.force === true,\n    });\n    return;\n  }\n\n  if (command === \"doctor\") {\n    assertArgs(parsed, [\"config\"], 1);\n    await doctor({ configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\" });\n    return;\n  }\n\n  if (command === \"capabilities\") {\n    assertArgs(parsed, [\"json\"], 1);\n    printCapabilities(parsed.options.json === true);\n    return;\n  }\n\n  if (command === \"provision\") {\n    assertArgs(\n      parsed,\n      [\n        \"config\", \"dry-run\", \"rotate-keys\", \"rotate-o11y-token\", \"push-secrets\", \"write-credentials\",\n        \"write-dev-vars\", \"token\", \"open\", \"yes\",\n      ],\n      1,\n    );\n    const writeDevVars = parsed.options[\"write-dev-vars\"];\n    const opts: ProvisionOptions = {\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      dryRun: parsed.options[\"dry-run\"] === true,\n      rotateKeys: parsed.options[\"rotate-keys\"] === true,\n      rotateO11yToken: parsed.options[\"rotate-o11y-token\"] === true,\n      pushSecrets: parsed.options[\"push-secrets\"] === true,\n      writeCredentials: parsed.options[\"write-credentials\"] !== false,\n      writeDevVars: typeof writeDevVars === \"string\" ? writeDevVars : writeDevVars === true,\n      token: stringOpt(parsed.options.token),\n      open: parsed.options.open === false ? false : parsed.options.open === true ? true : undefined,\n      yes: parsed.options.yes === true,\n    };\n    await provision(opts);\n    return;\n  }\n\n  if (command === \"smoke\") {\n    assertArgs(parsed, [\"config\", \"env\"], 1);\n    await smoke({\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      env: stringOpt(parsed.options.env),\n    });\n    return;\n  }\n\n  if (command === \"setup\") {\n    assertArgs(parsed, [\"dir\", \"global\", \"force\", \"agent\", \"harness\"], 1);\n    // The agent front door: install the bundled skills so a coding agent picks\n    // up the `odla` skill and drives init/provision/build from here.\n    installSkill({\n      dir: stringOpt(parsed.options.dir),\n      global: parsed.options.global === true,\n      harnesses: harnessList(parsed),\n      force: parsed.options.force === true,\n    });\n    console.log(\n      \"\\nOffline runbooks installed. Open this repo in your coding agent and ask it to set up odla.\\n\" +\n        \"Its native adapter finds the local `odla` skill, chooses build or migration, and drives the CLI.\",\n    );\n    return;\n  }\n\n  if (command === \"skill\") {\n    const sub = parsed.positionals[1];\n    if (sub !== \"install\") throw new Error(`unknown skill subcommand \"${sub ?? \"\"}\". Try \"odla-ai skill install\".`);\n    assertArgs(parsed, [\"dir\", \"global\", \"force\", \"agent\", \"harness\"], 2);\n    installSkill({\n      dir: stringOpt(parsed.options.dir),\n      global: parsed.options.global === true,\n      harnesses: harnessList(parsed),\n      force: parsed.options.force === true,\n    });\n    return;\n  }\n\n  if (command === \"secrets\") {\n    const sub = parsed.positionals[1];\n    if (sub !== \"push\") throw new Error(`unknown secrets subcommand \"${sub ?? \"\"}\". Try \"odla-ai secrets push --env dev\".`);\n    assertArgs(parsed, [\"config\", \"env\", \"dry-run\", \"yes\"], 2);\n    await secretsPush({\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      env: requiredString(parsed.options.env, \"--env\"),\n      dryRun: parsed.options[\"dry-run\"] === true,\n      yes: parsed.options.yes === true,\n    });\n    return;\n  }\n\n  throw new Error(`unknown command \"${command}\". Run \"odla-ai help\".`);\n}\n\ninterface ParsedArgv {\n  positionals: string[];\n  options: Record<string, string | boolean | string[]>;\n}\n\nfunction assertArgs(parsed: ParsedArgv, allowedOptions: string[], maxPositionals: number): void {\n  const allowed = new Set(allowedOptions);\n  for (const name of Object.keys(parsed.options)) {\n    if (!allowed.has(name)) {\n      throw new Error(`unknown option \"--${name}\"; run \"odla-ai help\" for supported options`);\n    }\n  }\n  if (parsed.positionals.length > maxPositionals) {\n    throw new Error(`unexpected argument \"${parsed.positionals[maxPositionals]}\"; run \"odla-ai help\"`);\n  }\n}\n\nfunction parseArgv(argv: string[]): ParsedArgv {\n  const positionals: string[] = [];\n  const options: Record<string, string | boolean | string[]> = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i]!;\n    if (!arg.startsWith(\"--\")) {\n      positionals.push(arg);\n      continue;\n    }\n    const eq = arg.indexOf(\"=\");\n    const rawName = arg.slice(2, eq === -1 ? undefined : eq);\n    if (!rawName) continue;\n    if (rawName.startsWith(\"no-\")) {\n      options[rawName.slice(3)] = false;\n      continue;\n    }\n    if (eq !== -1) {\n      addOption(options, rawName, arg.slice(eq + 1));\n      continue;\n    }\n    const value = argv[i + 1];\n    if (value !== undefined && !value.startsWith(\"--\")) {\n      i++;\n      addOption(options, rawName, value);\n    } else {\n      addOption(options, rawName, true);\n    }\n  }\n  return { positionals, options };\n}\n\nfunction addOption(options: Record<string, string | boolean | string[]>, name: string, value: string | boolean): void {\n  const cur = options[name];\n  if (cur === undefined) {\n    options[name] = value;\n  } else if (Array.isArray(cur)) {\n    cur.push(String(value));\n  } else {\n    options[name] = [String(cur), String(value)];\n  }\n}\n\nfunction requiredString(value: string | boolean | string[] | undefined, name: string): string {\n  const s = stringOpt(value);\n  if (!s) throw new Error(`${name} is required`);\n  return s;\n}\n\nfunction stringOpt(value: string | boolean | string[] | undefined): string | undefined {\n  if (typeof value === \"string\") return value;\n  if (Array.isArray(value)) return value[value.length - 1];\n  return undefined;\n}\n\nfunction listOpt(value: string | boolean | string[] | undefined): string[] | undefined {\n  if (value === undefined || value === false || value === true) return undefined;\n  const values = Array.isArray(value) ? value : [value];\n  return values.flatMap((item) => item.split(\",\")).map((item) => item.trim()).filter(Boolean);\n}\n\nfunction harnessList(parsed: ParsedArgv): AgentHarnessSelector[] {\n  const selected = [\n    ...harnessOption(parsed.options.agent, \"--agent\"),\n    ...harnessOption(parsed.options.harness, \"--harness\"),\n  ];\n  return (selected.length ? selected : [\"all\"]) as AgentHarnessSelector[];\n}\n\nfunction harnessOption(value: string | boolean | string[] | undefined, flag: string): string[] {\n  if (value === undefined) return [];\n  if (typeof value === \"boolean\") throw new Error(`${flag} requires a harness name`);\n  const raw = Array.isArray(value) ? value : [value];\n  const parts = raw.flatMap((item) => item.split(\",\"));\n  if (parts.some((item) => !item.trim())) throw new Error(`${flag} requires a harness name`);\n  return parts.map((item) => item.trim());\n}\n\nexport function cliVersion(): string {\n  const pkg = JSON.parse(readFileSync(new URL(\"../package.json\", import.meta.url), \"utf8\")) as { version?: string };\n  return pkg.version ?? \"unknown\";\n}\n\nfunction printHelp(): void {\n  console.log(`odla-ai\n\nUsage:\n  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]\n  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]\n  odla-ai doctor [--config odla.config.mjs]\n  odla-ai capabilities [--json]\n  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]\n  odla-ai smoke [--config odla.config.mjs] [--env dev]\n  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]\n  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]\n  odla-ai version\n\nCommands:\n  setup       Install offline odla runbooks for common coding-agent harnesses.\n  init        Create a generic odla.config.mjs plus starter schema/rules files.\n  doctor      Validate and summarize the project config without network calls.\n  capabilities Show what the CLI automates vs agent edits and human checkpoints.\n  provision   Register services, configure them, persist credentials, optionally push secrets.\n  smoke       Verify local credentials, public-config, live schema, and db aggregate.\n  skill       Same installer; --agent accepts all, claude, codex, cursor,\n              copilot, gemini, or agents (repeatable or comma-separated).\n  secrets     Push configured db/o11y secrets into the Worker via wrangler stdin.\n  version     Print the CLI version.\n\nSafety:\n  New projects target dev only. Add prod explicitly to odla.config.mjs and pass\n  --yes to provision it; use --dry-run first to inspect the resolved plan.\n  Provision caches the approved developer token and service credentials under\n  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push\n  preflights Wrangler before any shown-once issuance or destructive rotation.\n  Provision opens the approval page automatically in interactive terminals;\n  use --open to force browser launch or --no-open to suppress it.\n`);\n}\n"],"mappings":";;;AAEO,IAAM,eAAe;AAAA,EAC1B,KAAK;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,EACF;AACF;AAKO,SAAS,kBAAkB,OAAO,OAAO,MAAc,SAAe;AAC3E,MAAI,MAAM;AACR,QAAI,IAAI,KAAK,UAAU,cAAc,MAAM,CAAC,CAAC;AAC7C;AAAA,EACF;AACA,MAAI,IAAI,mCAAmC;AAC3C,aAAW,KAAK,iBAAiB,aAAa,GAAG;AACjD,aAAW,KAAK,+BAA+B,aAAa,KAAK;AACjE,aAAW,KAAK,qBAAqB,aAAa,KAAK;AACvD,aAAW,KAAK,UAAU,aAAa,MAAM;AAC/C;AAEA,SAAS,WAAW,KAAa,SAAiB,OAAgC;AAChF,MAAI,IAAI,GAAG,OAAO,GAAG;AACrB,aAAW,QAAQ,MAAO,KAAI,IAAI,OAAO,IAAI,EAAE;AAC/C,MAAI,IAAI,EAAE;AACZ;;;ACzCA,IAAM,eAAwC;AAAA,EAC5C,CAAC,kCAAkC,oBAAoB;AAAA,EACvD,CAAC,kCAAkC,kBAAkB;AAAA,EACrD,CAAC,yBAAyB,eAAe;AAAA,EACzC,CAAC,4BAA4B,kBAAkB;AAAA,EAC/C,CAAC,wBAAwB,iBAAiB;AAAA,EAC1C,CAAC,yCAAyC,eAAe;AAAA,EACzD,CAAC,wBAAwB,gBAAgB;AAC3C;AAaO,SAAS,cAAc,OAAuB;AACnD,MAAI,SAAS;AACb,aAAW,CAAC,SAAS,WAAW,KAAK,aAAc,UAAS,OAAO,QAAQ,SAAS,WAAW;AAC/F,SAAO;AACT;AAGO,SAAS,YAAY,OAAwB;AAClD,SAAO,cAAc,KAAK,MAAM,SAAS,MAAM,SAAS,YAAY;AACtE;;;ACnCA,SAAS,YAAY,oBAAoB;AACzC,SAAS,SAAS,YAAY,eAAe;AAC7C,SAAS,qBAAqB;AAG9B,IAAM,mBAAmB;AAEzB,IAAM,eAAe,CAAC,KAAK;AAC3B,IAAM,mBAAmB,CAAC,MAAM,IAAI;AAEpC,eAAsB,kBAAkB,aAAa,mBAAiD;AACpG,QAAM,WAAW,QAAQ,UAAU;AACnC,MAAI,CAAC,WAAW,QAAQ,GAAG;AACzB,UAAM,IAAI,MAAM,qBAAqB,UAAU,8CAA8C;AAAA,EAC/F;AAEA,QAAM,MAAM,MAAM,iBAAiB,QAAQ;AAC3C,QAAM,UAAU,QAAQ,QAAQ;AAChC,oBAAkB,KAAK,QAAQ;AAE/B,QAAM,cAAc,UAAU,QAAQ,IAAI,qBAAqB,IAAI,eAAe,gBAAgB;AAClG,QAAM,aAAa,UAAU,QAAQ,IAAI,oBAAoB,IAAI,cAAc,WAAW;AAC1F,QAAM,OAAO,OAAO,IAAI,MAAM,SAAS,IAAI,OAAO,YAAY;AAC9D,QAAM,WAAW,OAAO,IAAI,UAAU,SAAS,IAAI,WAAW,gBAAgB;AAC9E,QAAM,QAAQ;AAAA,IACZ,WAAW,QAAQ,SAAS,IAAI,OAAO,aAAa,sBAAsB;AAAA,IAC1E,iBAAiB,QAAQ,SAAS,IAAI,OAAO,mBAAmB,8BAA8B;AAAA,IAC9F,aAAa,QAAQ,SAAS,IAAI,OAAO,eAAe,WAAW;AAAA,IACnE,WAAW,IAAI,OAAO,aAAa;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,KACA,OACA,OACwB;AACxB,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,MAAO,QAAO;AACrE,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,SAAS,WAAW,KAAK,IAAI,QAAQ,QAAQ,IAAI,SAAS,KAAK;AACrE,MAAI,OAAO,SAAS,OAAO,GAAG;AAC5B,WAAO,KAAK,MAAM,aAAa,QAAQ,MAAM,CAAC;AAAA,EAChD;AACA,QAAM,MAAO,MAAM,OAAO,cAAc,MAAM,EAAE;AAChD,aAAW,QAAQ,OAAO;AACxB,QAAI,IAAI,IAAI,MAAM,OAAW,QAAO,IAAI,IAAI;AAAA,EAC9C;AACA,MAAI,IAAI,YAAY,OAAW,QAAO,IAAI;AAC1C,QAAM,IAAI,MAAM,GAAG,KAAK,mBAAmB,MAAM,KAAK,IAAI,CAAC,aAAa;AAC1E;AAEO,SAAS,UAAU,KAAyC;AACjE,SAAO;AAAA,IACL,OAAO,IAAI,IAAI;AAAA,IACf,SAAS,IAAI,IAAI;AAAA,IACjB,aAAa,IAAI;AAAA,IACjB,YAAY,IAAI;AAAA,IAChB,MAAM,IAAI;AAAA,IACV,UAAU,IAAI;AAAA,IACd,WAAW,CAAC,CAAC,IAAI,IAAI;AAAA,IACrB,UAAU,CAAC,CAAC,IAAI,IAAI,SAAU,CAAC,CAAC,IAAI,IAAI,UAAU,IAAI,GAAG,iBAAiB;AAAA,IAC1E,YAAY,IAAI,IAAI;AAAA,EACtB;AACF;AAEO,SAAS,gBAAgB,QAA2B;AACzD,QAAM,WAAW,mBAAmB,MAAM;AAC1C,SAAO,OAAO;AAAA,IACZ,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,SAAS,QAAQ,SAAS,QAAQ,SAAS,QAAQ,QAAQ,CAAC,CAAC;AAAA,EACrG;AACF;AAEO,SAAS,mBAAmB,QAA2B;AAC5D,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO,CAAC;AACnD,QAAM,WAAY,OAAkC;AACpD,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AAClF,SAAO,OAAO,KAAK,QAAQ;AAC7B;AAEO,SAAS,SAAS,OAA+C;AACtE,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO,QAAQ,IAAI,MAAM,MAAM,CAAC,CAAC;AAC5D,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAc,MAAgD;AACvF,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,wBAAwB;AACpF,QAAM,MAAM;AACZ,MAAI,CAAC,IAAI,OAAO,OAAO,IAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,sBAAsB;AAC1F,MAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,0DAA0D;AAC3G,MAAI,CAAC,IAAI,IAAI,QAAQ,OAAO,IAAI,IAAI,SAAS,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,wBAAwB;AACtG,MAAI,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6DAA6D;AAClI;AAEA,SAAS,QAAQ,OAAiC;AAChD,SAAO,OAAO,UAAU,YAAY,uBAAuB,KAAK,KAAK;AACvE;AAEA,eAAe,iBAAiB,MAA0C;AACxE,MAAI,KAAK,SAAS,OAAO,EAAG,QAAO,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AACxE,QAAM,MAAO,MAAM,OAAO,GAAG,cAAc,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI,CAAC;AAIrE,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,OAAO,UAAU,WAAY,QAAO,MAAM,MAAM;AACpD,SAAO;AACT;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,MAAM,QAAQ,QAAQ,EAAE;AACjC;AAEA,SAAS,OAAO,QAA4B;AAC1C,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,CAAC,CAAC;AAC5C;;;AC/HA,SAAS,oBAAoB;AAC7B,SAAS,cAAAA,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,QAAAC,OAAM,WAAAC,gBAAe;;;ACF9B,SAAS,WAAW,cAAAC,aAAY,WAAW,gBAAAC,eAAc,YAAY,qBAAqB;AAC1F,SAAS,WAAAC,UAAS,cAAAC,aAAY,UAAU,WAAAC,gBAAe;AAGvD,IAAM,kBAAkB,CAAC,sBAAsB,wBAAwB,WAAW;AAE3E,SAAS,aAAgB,MAAwB;AACtD,MAAI;AACF,WAAO,KAAK,MAAMH,cAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iBAAiB,MAAc,OAAsB;AACnE,mBAAiB,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,CAAI;AAC9D;AAEO,SAAS,gBAAgB,MAAuC;AACrE,MAAI,CAACD,YAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,MAAMC,cAAa,MAAM,MAAM,CAAC;AAAA,EAC/C,QAAQ;AACN,UAAM,IAAI,MAAM,oBAAoB,IAAI,0DAA0D;AAAA,EACpG;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,OAAQ,MAA2B,UAAU,YACpF,CAAE,MAA2B,QAAQ,OAAQ,MAA2B,SAAS,UAAU;AAC7F,UAAM,IAAI,MAAM,oBAAoB,IAAI,6DAA6D;AAAA,EACvG;AACA,SAAO;AACT;AAEO,SAAS,gBACd,SACA,QACkB;AAClB,QAAM,OAAyB,WAAW;AAAA,IACxC,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB,YAAY,OAAO;AAAA,IACnB,YAAW,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,IACnC,MAAM,CAAC;AAAA,EACT;AACA,OAAK,QAAQ,OAAO;AACpB,OAAK,cAAc,OAAO;AAC1B,OAAK,aAAa,OAAO;AACzB,OAAK,aAAY,oBAAI,KAAK,GAAE,YAAY;AACxC,OAAK,KAAK,OAAO,GAAG,IAAI;AAAA,IACtB,GAAI,KAAK,KAAK,OAAO,GAAG,KAAK,CAAC;AAAA,IAC9B,UAAU,OAAO;AAAA,IACjB,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IAC9C,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,EAC5D;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,SAAiB,aAAuB,CAAC,GAAS;AAChF,QAAM,OAAOG,SAAQ,SAAS,YAAY;AAC1C,QAAM,WAAWJ,YAAW,IAAI,IAAIC,cAAa,MAAM,MAAM,IAAI;AACjE,QAAM,aAAa,WAAW,IAAI,CAAC,cAAc,eAAe,SAAS,SAAS,CAAC,EAAE,OAAO,CAAC,SAAyB,CAAC,CAAC,IAAI;AAC5H,QAAM,SAAS,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,UAAU,CAAC,CAAC;AAC/D,QAAM,UAAU,OAAO,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,OAAO,EAAE,SAAS,IAAI,CAAC;AAC/E,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,SAAS,YAAY,CAAC,SAAS,SAAS,IAAI,IAAI,OAAO;AAC7D,gBAAc,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC;AAAA,CAAI;AACnE;AAQO,SAAS,YAAY,KAAmD;AAC7E,MAAI,CAAC,IAAI,SAAS,SAAS,MAAM,EAAG,QAAO;AAC3C,SAAO;AAAA,IACL,UAAU,IAAI,MAAM,YAAY;AAAA,IAChC,SAAS,IAAI,MAAM,WAAW,IAAI,IAAI;AAAA,IACtC,GAAI,IAAI,MAAM,UAAU,EAAE,SAAS,IAAI,KAAK,QAAQ,IAAI,CAAC;AAAA,EAC3D;AACF;AAEO,SAAS,0BAA0B,KAA0B,WAAwD;AAC1H,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI,cAAc,KAAM,QAAO,IAAI,MAAM;AACzC,SAAOG,SAAQF,SAAQ,IAAI,UAAU,GAAG,SAAS;AACnD;AAEO,SAAS,aAAa,MAAc,aAA+B,KAAa,MAA0B;AAC/G,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2BAA2B,GAAG,QAAQ,IAAI,EAAE;AACxE,QAAM,QAAQ,CAAC,kBAAkB,YAAY,WAAW,GAAG;AAC3D,MAAI,MAAM,MAAO,OAAM,KAAK,kBAAkB,YAAY,UAAU,GAAG;AACvE,QAAM,KAAK,gBAAgB,YAAY,KAAK,KAAK,aAAa,GAAG,KAAK,gBAAgB,MAAM,QAAQ,GAAG;AACvG,MAAI,MAAM,MAAO,OAAM,KAAK,iBAAiB,MAAM,KAAK,GAAG;AAC3D,MAAI,MAAM;AACR,UAAM,KAAK,uBAAuB,KAAK,QAAQ,KAAK,sBAAsB,KAAK,OAAO,GAAG;AACzF,QAAI,KAAK,QAAS,OAAM,KAAK,sBAAsB,KAAK,OAAO,GAAG;AAElE,QAAI,MAAM,UAAW,OAAM,KAAK,oBAAoB,MAAM,SAAS,GAAG;AAAA,EACxE;AACA,QAAM,WAAWF,YAAW,IAAI,IAAIC,cAAa,MAAM,MAAM,IAAI;AACjE,QAAM,WAAW,SAAS,MAAM,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC;AAChF,SAAO,SAAS,GAAG,EAAE,MAAM,GAAI,UAAS,IAAI;AAC5C,QAAM,SAAS,SAAS,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC;AAAA;AAAA,IAAS;AAChE,mBAAiB,MAAM,GAAG,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA,CAAI;AACzD;AAEA,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EAAiB;AAAA,EAAiB;AAAA,EAAe;AAAA,EAAY;AAAA,EAAe;AAAA,EAC5E;AAAA,EAAsB;AAAA,EAAqB;AAAA,EAAqB;AAClE,CAAC;AAED,SAAS,gBAAgB,MAAuB;AAC9C,QAAM,QAAQ,KAAK,MAAM,yCAAyC;AAClE,SAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,IAAI,MAAM,CAAC,CAAC;AACtD;AAEA,SAAS,iBAAiB,MAAc,MAAoB;AAC1D,YAAUC,SAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,YAAY,GAAG,IAAI,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAC1D,gBAAc,WAAW,MAAM,EAAE,MAAM,IAAM,CAAC;AAC9C,YAAU,WAAW,GAAK;AAC1B,aAAW,WAAW,IAAI;AAC5B;AAEO,SAAS,eAAe,SAAiB,MAA6B;AAC3E,QAAM,MAAM,SAASE,SAAQ,OAAO,GAAGA,SAAQ,IAAI,CAAC;AACpD,MAAI,CAAC,OAAO,QAAQ,QAAQ,IAAI,WAAW,KAAK,QAAQ,aAAa,UAAU,OAAO,GAAG,EAAE,KAAKD,YAAW,GAAG,EAAG,QAAO;AACxH,SAAO,IAAI,WAAW,MAAM,GAAG;AACjC;AAEO,SAAS,YAAY,MAAc,UAAU,QAAQ,IAAI,GAAW;AACzE,QAAM,MAAM,SAAS,SAAS,IAAI;AAClC,SAAO,OAAO,CAAC,IAAI,WAAW,IAAI,IAAI,MAAM;AAC9C;;;ACxIA,SAAS,aAAa;AACtB,SAAS,cAAAE,aAAY,gBAAAC,qBAAoB;AACzC,SAAS,YAAY;AAWd,IAAM,gBAA+B,CAAC,KAAK,MAAM,SACtD,IAAI,QAAQ,CAAC,gBAAgB,WAAW;AACtC,QAAM,QAAQ,MAAM,KAAK,MAAM,EAAE,KAAK,MAAM,KAAK,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAClF,MAAI,SAAS;AACb,MAAI,SAAS;AACb,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,UAAU,MAAM,SAAS,CAAE;AACvE,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,UAAU,MAAM,SAAS,CAAE;AACvE,QAAM,GAAG,SAAS,MAAM;AACxB,QAAM,GAAG,SAAS,CAAC,SAAS,eAAe,EAAE,MAAM,QAAQ,GAAG,QAAQ,OAAO,CAAC,CAAC;AAC/E,QAAM,MAAM,IAAI,MAAM,SAAS,EAAE;AACnC,CAAC;AAEH,IAAM,wBAAwB,CAAC,kBAAkB,iBAAiB,eAAe;AAE1E,SAAS,mBAAmB,SAAgC;AACjE,aAAW,QAAQ,uBAAuB;AACxC,UAAM,OAAO,KAAK,SAAS,IAAI;AAC/B,QAAID,YAAW,IAAI,EAAG,QAAO;AAAA,EAC/B;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,MAA8C;AAC/E,MAAI,KAAK,SAAS,OAAO,EAAG,QAAO;AACnC,MAAI;AACF,WAAO,KAAK,MAAM,kBAAkBC,cAAa,MAAM,MAAM,CAAC,CAAC;AAAA,EACjE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,kBAAkB,MAAsB;AACtD,MAAI,SAAS;AACb,MAAI,WAAW;AACf,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,KAAK,KAAK,CAAC;AACjB,QAAI,UAAU;AACZ,gBAAU;AACV,UAAI,OAAO,MAAM;AACf,kBAAU,KAAK,IAAI,CAAC,KAAK;AACzB;AAAA,MACF,WAAW,OAAO,KAAK;AACrB,mBAAW;AAAA,MACb;AACA;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,iBAAW;AACX,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACrC,aAAO,IAAI,KAAK,UAAU,KAAK,CAAC,MAAM,KAAM;AAC5C,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACrC,WAAK;AACL,aAAO,IAAI,KAAK,UAAU,EAAE,KAAK,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAM;AACrE;AACA;AAAA,IACF;AACA,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAEA,eAAsB,iBAAiB,KAAoB,KAA+B;AACxF,MAAI;AACF,UAAM,SAAS,MAAM,IAAI,OAAO,CAAC,YAAY,QAAQ,GAAG,EAAE,IAAI,CAAC;AAC/D,WAAO,OAAO,SAAS,KAAK,CAAC,qBAAqB,KAAK,GAAG,OAAO,MAAM,GAAG,OAAO,MAAM,EAAE;AAAA,EAC3F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,kBACd,KACA,MACoB;AACpB,QAAM,OAAO,CAAC,YAAY,UAAU,OAAO,KAAK,MAAM,GAAI,KAAK,MAAM,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,CAAE;AAC9F,SAAO,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,OAAO,KAAK,KAAK,IAAI,CAAC;AAC9D;;;AFrFO,SAAS,UAAU,OAA6B,UAAoB,YAAgC;AACzG,QAAM,WAAqB,CAAC;AAC5B,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,CAAC,IAAI,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,UAAI,OAAO,SAAS,YAAY,KAAK,KAAK,MAAM,OAAQ;AACxD,UAAI,WAAW,UAAU,WAAW,SAAS,EAAE,EAAG;AAClD,eAAS;AAAA,QACP,WAAW,SACP,SAAS,EAAE,4CAAuC,EAAE,mCACpD,SAAS,EAAE,IAAI,MAAM,oCAA+B,MAAM,IAAI,EAAE;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,aAAW,UAAU,UAAU;AAC7B,QAAI,EAAE,UAAU,OAAQ,UAAS,KAAK,kBAAkB,MAAM,iDAAiD;AAAA,EACjH;AACA,SAAO;AACT;AAIA,IAAM,cAAwB,CAAC,KAAK,MAAM,QAAQ,aAAa,KAAK,MAAM,EAAE,KAAK,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAGjI,SAAS,mBAAmB,SAAiB,OAAiB,aAAa,aAAuB,CAAC,GAAa;AACrH,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,WACZ,IAAI,CAAC,SAAS,eAAe,SAAS,IAAI,CAAC,EAC3C,OAAO,CAAC,SAAyB,CAAC,CAAC,IAAI;AAC1C,aAAS,KAAK,OAAO,CAAC,YAAY,MAAM,aAAa,SAAS,GAAG,MAAM,GAAG,OAAO;AAAA,EACnF,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,SAAO,OACJ,MAAM,OAAO,EACb,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,GAAG,IAAI,kDAA6C,IAAI,wCAAwC;AACnH;AAGO,SAAS,iBAAiB,SAA2B;AAC1D,QAAM,aAAa,mBAAmB,OAAO;AAC7C,MAAI,CAAC,WAAY,QAAO,CAAC;AACzB,QAAM,SAAS,mBAAmB,UAAU;AAC5C,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,WAAqB,CAAC;AAC5B,QAAM,SAAmE,CAAC,EAAE,OAAO,IAAI,OAAO,OAAO,CAAC;AACtG,QAAM,OAAO,OAAO;AACpB,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,UAAI,SAAS,OAAO,UAAU,SAAU,QAAO,KAAK,EAAE,OAAO,OAAO,IAAI,KAAK,MAAwC,CAAC;AAAA,IACxH;AAAA,EACF;AAEA,aAAW,EAAE,OAAO,MAAM,KAAK,QAAQ;AACrC,UAAM,SAAS,MAAM;AACrB,QAAI,QAAQ,WAAW;AACrB,YAAM,MAAMC,SAAQ,SAAS,OAAO,SAAS;AAC7C,UAAI,QAAQA,SAAQ,OAAO,GAAG;AAC5B,iBAAS,KAAK,GAAG,KAAK,uHAAkH;AAAA,MAC1I,WAAWC,YAAWC,MAAK,KAAK,cAAc,CAAC,GAAG;AAChD,iBAAS,KAAK,GAAG,KAAK,oGAA+F;AAAA,MACvH;AAAA,IACF;AACA,UAAM,OAAO,MAAM;AACnB,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,YAAI,SAAS,kBAAkB,SAAS,qBAAsB,OAAO,UAAU,YAAY,YAAY,KAAK,GAAI;AAC9G,mBAAS,KAAK,YAAY,KAAK,QAAQ,IAAI,0FAAqF;AAAA,QAClI;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,gBAAgB,OAAO;AACnC,MAAI,OAAO,OAAO,IAAI,YAAY,YAAY,IAAI,WAAW,YAAa,IAAI,SAAqC;AACjH,aAAS,KAAK,6FAAwF;AAAA,EACxG;AACA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAA2B;AAC7D,QAAM,WAAqB,CAAC;AAC5B,QAAM,MAAM,gBAAgB,OAAO;AACnC,QAAM,eAAe,KAAK;AAC1B,QAAM,kBAAkB,KAAK;AAC7B,MAAI,CAAC,eAAe,eAAe,GAAG;AACpC,aAAS;AAAA,MACP,kBAAkB,eAAe,IAC7B,gGACA;AAAA,IACN;AAAA,EACF;AAEA,QAAM,aAAa,mBAAmB,OAAO;AAC7C,QAAM,SAAS,aAAa,mBAAmB,UAAU,IAAI;AAC7D,MAAI,CAAC,cAAc,CAAC,QAAQ;AAC1B,aAAS,KAAK,6FAAwF;AACtG,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OAAO,OAAO,SAAS,WAAWF,SAAQ,SAAS,OAAO,IAAI,IAAI;AAC/E,MAAI,CAAC,QAAQ,CAACC,YAAW,IAAI,GAAG;AAC9B,aAAS,KAAK,yFAAoF;AAAA,EACpG,OAAO;AACL,QAAI,SAAS;AACb,QAAI;AACF,eAASE,cAAa,MAAM,MAAM;AAAA,IACpC,QAAQ;AAAA,IAER;AACA,QAAI,CAAC,wBAAwB,KAAK,MAAM,GAAG;AACzC,eAAS,KAAK,uBAAuB,OAAO,IAAc,uCAAuC;AAAA,IACnG;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,QAAQ,OAAO,mBAAmB,IAAI,OAAO,sBAAsB,CAAC;AACxF,MAAI,CAAC,MAAM,SAAS,eAAe,GAAG;AACpC,aAAS,KAAK,mFAAmF;AAAA,EACnG;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAiD;AACxE,MAAI;AACF,WAAO,KAAK,MAAMA,cAAaD,MAAK,SAAS,cAAc,GAAG,MAAM,CAAC;AAAA,EACvE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AGtHA,eAAsB,OAAO,SAAuC;AAClE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,OAAO,UAAU,GAAG;AAC1B,QAAM,QAAQ,IAAI,SAAS,SAAS,IAAI;AACxC,QAAM,SAAS,QAAQ,MAAM,kBAA2B,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,QAAQ,CAAC,IAAI;AACrG,QAAM,kBAAkB,QACpB,MAAM,kBAA4B,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,OAAO,CAAC,IACxE;AACJ,QAAM,QAAQ,oBAAoB,UAAU,IAAI,IAAI,iBAAiB,QAAQ,gBAAgB,MAAM,IAAI;AACvG,QAAM,WAAW,mBAAmB,MAAM;AAE1C,MAAI,IAAI,WAAW,IAAI,UAAU,EAAE;AACnC,MAAI,IAAI,WAAW,KAAK,OAAO,KAAK,KAAK,KAAK,GAAG;AACjD,MAAI,IAAI,WAAW,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE;AACzC,MAAI,IAAI,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE;AAC7C,MAAI,IAAI,WAAW,SAAS,GAAG,SAAS,MAAM,cAAc,MAAM,EAAE;AACpE,MAAI,IAAI,WAAW,QAAQ,GAAG,OAAO,KAAK,KAAK,EAAE,MAAM,gBAAgB,MAAM,EAAE;AAC/E,MAAI,IAAI,WAAW,IAAI,SAAS,SAAS,IAAI,IAAK,IAAI,IAAI,YAAY,mBAAoB,aAAa,EAAE;AAEzG,QAAM,WAAqB,CAAC;AAC5B,MAAI,UAAU,SAAS,WAAW,EAAG,UAAS,KAAK,wBAAwB;AAC3E,MAAI,OAAO;AACT,eAAW,MAAM,OAAO,KAAK,KAAK,GAAG;AACnC,UAAI,SAAS,SAAS,KAAK,CAAC,SAAS,SAAS,EAAE,EAAG,UAAS,KAAK,kBAAkB,EAAE,qCAAqC;AAAA,IAC5H;AAAA,EACF;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,KAAK,CAAC,IAAI,IAAI,SAAU,UAAS,KAAK,kDAAkD;AACtH,MAAI,IAAI,MAAM,OAAO;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,KAAK,KAAK,GAAG;AACzD,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,MAAM,CAAC,CAAC,GAAG;AACtF,iBAAS,KAAK,cAAc,GAAG,6BAA6B,KAAK,EAAE;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,IAAI,IAAI,GAAG,MAAM,GAAG;AAChF,aAAS,KAAK,GAAG,IAAI,GAAG,MAAM,uDAAuD;AAAA,EACvF;AACA,MAAI,IAAI,SAAS,SAAS,MAAM,GAAG;AAEjC,UAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,eAAW,OAAO,IAAI,MAAM;AAC1B,UAAI,CAAC,aAAa,KAAK,GAAG,GAAG,WAAW;AACtC,iBAAS,KAAK,4BAA4B,GAAG,kEAA6D;AAAA,MAC5G;AAAA,IACF;AACA,aAAS,KAAK,GAAG,oBAAoB,IAAI,OAAO,CAAC;AAAA,EACnD;AACA,WAAS,KAAK,GAAG,UAAU,OAAO,UAAU,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC;AACrE,WAAS,KAAK,GAAG,mBAAmB,IAAI,SAAS,QAAW;AAAA,IAC1D,IAAI,MAAM;AAAA,IACV,IAAI,MAAM;AAAA,IACV,IAAI,MAAM;AAAA,EACZ,CAAC,CAAC;AACF,WAAS,KAAK,GAAG,iBAAiB,IAAI,OAAO,CAAC;AAE9C,MAAI,SAAS,QAAQ;AACnB,QAAI,IAAI,EAAE;AACV,QAAI,IAAI,WAAW;AACnB,eAAW,WAAW,SAAU,KAAI,IAAI,OAAO,OAAO,EAAE;AAAA,EAC1D,OAAO;AACL,QAAI,IAAI,IAAI;AAAA,EACd;AACF;;;AC9FA,SAAS,cAAAE,aAAY,aAAAC,YAAW,iBAAAC,sBAAqB;AACrD,SAAS,WAAAC,UAAS,WAAAC,gBAAe;AAwC1B,SAAS,YAAY,SAA4B;AACtD,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,UAAUC,SAAQ,QAAQ,WAAW,QAAQ,IAAI,CAAC;AACxD,QAAM,aAAaA,SAAQ,SAAS,QAAQ,cAAc,iBAAiB;AAC3E,MAAIC,YAAW,UAAU,KAAK,CAAC,QAAQ,OAAO;AAC5C,UAAM,IAAI,MAAM,GAAG,UAAU,6CAA6C;AAAA,EAC5E;AACA,MAAI,CAAC,uBAAuB,KAAK,QAAQ,KAAK,GAAG;AAC/C,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAGA,QAAM,OAAO,QAAQ,MAAM,SAAS,QAAQ,OAAO,CAAC,KAAK;AACzD,QAAM,WAAW,QAAQ,UAAU,SAAS,QAAQ,WAAW,CAAC,MAAM,IAAI;AAC1E,QAAM,aAAa,QAAQ,cAAc;AAEzC,EAAAC,WAAUC,SAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,EAAAD,WAAUF,SAAQ,SAAS,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3D,EAAAE,WAAUF,SAAQ,SAAS,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAExD,EAAAI,eAAc,YAAY,eAAe,EAAE,OAAO,QAAQ,OAAO,MAAM,QAAQ,MAAM,MAAM,UAAU,WAAW,CAAC,CAAC;AAClH,iBAAeJ,SAAQ,SAAS,qBAAqB,GAAG,eAAe,CAAC;AACxE,iBAAeA,SAAQ,SAAS,oBAAoB,GAAG,cAAc,CAAC;AACtE,kBAAgB,OAAO;AAEvB,MAAI,IAAI,WAAW,gBAAgB,YAAY,OAAO,CAAC,EAAE;AACzD,MAAI,IAAI,oDAAoD;AAC5D,MAAI,IAAI,+CAA+C;AACzD;AAEA,SAAS,eAAe,MAAc,MAAoB;AACxD,MAAIC,YAAW,IAAI,EAAG;AACtB,EAAAG,eAAc,MAAM,IAAI;AAC1B;AAEA,SAAS,eAAe,OAAwG;AAC9H,SAAO;AAAA;AAAA;AAAA;AAAA,WAIE,MAAM,KAAK;AAAA,aACT,MAAM,KAAK,QAAQ,MAAM,KAAK,CAAC;AAAA;AAAA,UAElC,KAAK,UAAU,MAAM,IAAI,CAAC;AAAA,cACtB,KAAK,UAAU,MAAM,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iDAQK,MAAM,UAAU;AAAA;AAAA;AAAA,eAGlD,cAAc,MAAM,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAW3B,MAAM,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAc9B;AAEA,SAAS,iBAAyB;AAChC,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeT;AAEA,SAAS,gBAAwB;AAC/B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUT;AAEA,SAAS,cAAc,UAA0B;AAC/C,MAAI,aAAa,SAAU,QAAO;AAClC,MAAI,aAAa,SAAU,QAAO;AAClC,SAAO;AACT;AAEA,SAAS,gBAAgB,MAAc,SAAyB;AAC9D,SAAO,KAAK,WAAW,OAAO,IAAI,KAAK,MAAM,QAAQ,SAAS,CAAC,IAAI;AACrE;;;AC3IA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,QAAQ,YAAY,CAAC;AAOrD,eAAsB,YAAY,SAA4C;AAC5E,QAAM,gBAAgB,SAAS,IAAI;AACrC;AAGA,eAAsB,0BAA0B,SAA4C;AAC1F,QAAM,gBAAgB,SAAS,KAAK;AACtC;AAEA,eAAe,gBAAgB,SAA6B,WAAmC;AAC7F,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ;AAEpB,MAAI,CAAC,IAAI,KAAK,SAAS,GAAG,GAAG;AAC3B,UAAM,IAAI,MAAM,QAAQ,GAAG,4BAA4B,IAAI,KAAK,KAAK,IAAI,CAAC,GAAG;AAAA,EAC/E;AACA,MAAI,eAAe,IAAI,GAAG,KAAK,CAAC,QAAQ,KAAK;AAC3C,UAAM,IAAI,MAAM,iCAAiC,GAAG,iBAAiB;AAAA,EACvE;AAEA,QAAM,kBAAkB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO;AAC1E,QAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,qBAAqB,eAAe,uCAAkC;AACxG,MAAI,YAAY,UAAU,IAAI,IAAI,IAAI;AACpC,UAAM,IAAI,MAAM,kBAAkB,eAAe,aAAa,YAAY,KAAK,WAAW,IAAI,IAAI,EAAE,GAAG;AAAA,EACzG;AACA,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2BAA2B,GAAG,QAAQ,eAAe,uCAAkC;AAEnH,QAAM,UAAkD,CAAC;AACzD,MAAI,IAAI,SAAS,SAAS,MAAM,GAAG;AACjC,QAAI,CAAC,MAAM,UAAW,OAAM,IAAI,MAAM,0BAA0B,GAAG,QAAQ,eAAe,uCAAkC;AAC5H,YAAQ,KAAK,EAAE,MAAM,mBAAmB,OAAO,MAAM,UAAU,CAAC;AAAA,EAClE;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,GAAG;AAC/B,QAAI,CAAC,MAAM,MAAO,OAAM,IAAI,MAAM,sBAAsB,GAAG,QAAQ,eAAe,uCAAkC;AACpH,YAAQ,KAAK,EAAE,MAAM,gBAAgB,OAAO,MAAM,MAAM,CAAC;AAAA,EAC3D;AACA,MAAI,QAAQ,WAAW,GAAG;AACxB,QAAI,IAAI,GAAG,GAAG,wCAAwC;AACtD;AAAA,EACF;AAIA,QAAM,cAAc,eAAe,IAAI,GAAG,IAAI,SAAY;AAC1D,QAAM,SAAS,cAAc,iBAAiB,WAAW,MAAM;AAE/D,MAAI,QAAQ,QAAQ;AAClB,yBAAqB,GAAG;AACxB,eAAW,KAAK,QAAS,KAAI,IAAI,uBAAuB,EAAE,IAAI,KAAK,cAAc,EAAE,KAAK,CAAC,QAAQ,MAAM,EAAE;AACzG;AAAA,EACF;AAEA,QAAM,MAAM,QAAQ,UAAU;AAC9B,MAAI,UAAW,OAAM,sBAAsB,KAAK,GAAG;AAEnD,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,MAAM,kBAAkB,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,KAAK,aAAa,KAAK,IAAI,QAAQ,CAAC;AAChH,QAAI,OAAO,SAAS,GAAG;AACrB,YAAM,IAAI,MAAM,uBAAuB,EAAE,IAAI,iBAAiB,OAAO,IAAI,MAAM,cAAc,GAAG,OAAO,UAAU,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE;AAAA,IAC5I;AACA,QAAI,IAAI,GAAG,EAAE,IAAI,cAAc,MAAM,qBAAqB,eAAe,iBAAiB;AAAA,EAC5F;AACF;AAGA,eAAsB,qBAAqB,SAAiD;AAC1F,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,MAAI,CAAC,IAAI,SAAS,KAAK,CAAC,YAAY,YAAY,QAAQ,YAAY,MAAM,EAAG;AAC7E,QAAM,sBAAsB,KAAK,QAAQ,UAAU,aAAa;AAClE;AAEA,eAAe,sBAAsB,KAA0B,KAAmC;AAChG,uBAAqB,GAAG;AACxB,MAAI,CAAE,MAAM,iBAAiB,KAAK,IAAI,OAAO,GAAI;AAC/C,UAAM,IAAI,MAAM,sFAAiF;AAAA,EACnG;AACF;AAEA,SAAS,qBAAqB,KAAgC;AAC5D,MAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG;AACpC,UAAM,IAAI,MAAM,+BAA+B,IAAI,OAAO,oDAAoD;AAAA,EAChH;AACF;;;ACnHA,SAAS,kBAAkB,eAAAC,oBAAmB;AAC9C,SAAS,sBAAsB,iBAAiB;AAChD,OAAOC,cAAa;;;ACFpB,SAAS,oBAAoB;AAC7B,OAAOC,cAAa;;;ACDpB,SAAS,SAAAC,cAAa;AACtB,OAAOC,cAAa;AAOpB,eAAsB,QAAQ,KAAa,UAA0B,CAAC,GAAkB;AACtF,QAAM,UAAU,UAAU,QAAQ,YAAYA,SAAQ,QAAQ;AAC9D,QAAM,UAAU,QAAQ,aAAaD;AACrC,QAAM,IAAI,QAAc,CAACE,UAAS,WAAW;AAC3C,UAAM,QAAQ,QAAQ,QAAQ,KAAK,CAAC,GAAG,QAAQ,MAAM,GAAG,GAAG;AAAA,MACzD,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,SAAS,MAAM;AACxB,YAAM,MAAM;AACZ,MAAAA,SAAQ;AAAA,IACV,CAAC;AAAA,EACH,CAAC;AACH;AAEO,SAAS,UAAU,UAA4D;AACpF,MAAI,aAAa,SAAU,QAAO,EAAE,KAAK,QAAQ,MAAM,CAAC,EAAE;AAC1D,MAAI,aAAa,QAAS,QAAO,EAAE,KAAK,OAAO,MAAM,CAAC,MAAM,SAAS,EAAE,EAAE;AACzE,SAAO,EAAE,KAAK,YAAY,MAAM,CAAC,EAAE;AACrC;;;ADpBA,eAAsB,kBACpB,KACA,SACA,SACA,KACiB;AACjB,MAAI,QAAQ,MAAO,QAAO,QAAQ;AAClC,MAAIC,SAAQ,IAAI,eAAgB,QAAOA,SAAQ,IAAI;AAEnD,QAAM,SAAS,aAAqD,IAAI,MAAM,SAAS;AACvF,MAAI,QAAQ,UAAU,OAAO,aAAa,KAAK,KAAK,IAAI,IAAI,KAAQ;AAClE,QAAI,IAAI,uCAAuC,YAAY,IAAI,MAAM,WAAW,IAAI,OAAO,CAAC,GAAG;AAC/F,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,UAAU,gBAAgB,OAAO;AACvC,QAAM,EAAE,OAAO,UAAU,IAAI,MAAM,aAAa;AAAA,IAC9C,UAAU,IAAI;AAAA,IACd,OAAO,GAAG,IAAI,IAAI,EAAE;AAAA,IACpB,OAAO;AAAA,IACP,QAAQ,OAAO,EAAE,UAAU,UAAU,MAAM;AACzC,YAAM,cAAc,aAAa,IAAI,aAAa,QAAQ;AAC1D,UAAI,IAAI,EAAE;AACV,UAAI,IAAI,gBAAgB,QAAQ,OAAO,WAAW,WAAW,KAAK,MAAM,YAAY,EAAE,CAAC,IAAI;AAC3F,UAAI,QAAQ,MAAM;AAChB,YAAI;AACF,iBAAO,QAAQ,mBAAmB,SAAS,WAAW;AACtD,cAAI,IAAI,oCAAoC,QAAQ,SAAS,SAAS,YAAY,EAAE,EAAE;AAAA,QACxF,SAAS,KAAK;AACZ,cAAI,IAAI,iCAAiC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QAC9F;AAAA,MACF,WAAW,QAAQ,QAAQ;AACzB,YAAI,IAAI,iCAAiC,QAAQ,MAAM,GAAG;AAAA,MAC5D;AACA,UAAI,IAAI,EAAE;AAAA,IACZ;AAAA,EACF,CAAC;AACD,mBAAiB,IAAI,MAAM,WAAW,EAAE,OAAO,UAAU,CAAC;AAC1D,MAAI,IAAI,iCAAiC,YAAY,IAAI,MAAM,WAAW,IAAI,OAAO,CAAC,GAAG;AACzF,SAAO;AACT;AAEO,SAAS,gBAAgB,SAAyF;AACvH,MAAI,QAAQ,SAAS,KAAM,QAAO,EAAE,MAAM,MAAM,MAAM,SAAS;AAC/D,MAAI,QAAQ,SAAS,MAAO,QAAO,EAAE,MAAM,OAAO,QAAQ,wBAAwB;AAClF,MAAIA,SAAQ,IAAI,GAAI,QAAO,EAAE,MAAM,OAAO,QAAQ,iBAAiB;AAEnE,QAAM,cAAc,QAAQ,eAAe,QAAQA,SAAQ,MAAM,SAASA,SAAQ,OAAO,KAAK;AAC9F,MAAI,CAAC,YAAa,QAAO,EAAE,MAAM,OAAO,QAAQ,8CAA8C;AAC9F,SAAO,EAAE,MAAM,MAAM,MAAM,OAAO;AACpC;AAEO,SAAS,aAAa,aAAqB,UAA0B;AAC1E,QAAM,MAAM,IAAI,IAAI,WAAW,WAAW;AAC1C,MAAI,aAAa,IAAI,QAAQ,QAAQ;AACrC,SAAO,IAAI,SAAS;AACtB;;;AEhEA,SAAS,mBAAmB;AAoB5B,eAAsB,wBAAwB,MAAiE;AAC7G,QAAM,WAAW,YAAY,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG;AACtD,QAAM,QAAQ,KAAK,aAAa,KAAK,KAAK,GAAG;AAC7C,MAAI,cAAc,KAAK;AACvB,MAAI,QAAQ,KAAK,IAAI,SAAS,SAAS,IAAI,KAAK,CAAC,KAAK,WAAW,OAAO,QAAQ;AAChF,MAAI,YAAY,KAAK,IAAI,SAAS,SAAS,MAAM,KAAK,CAAC,KAAK,aAAa,OAAO,YAAY;AAE5F,MAAI,KAAK,IAAI,SAAS,SAAS,IAAI,GAAG;AACpC,QAAI,OAAO;AACT,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,8BAA8B,QAAQ,EAAE;AAAA,IACrE,OAAO;AACL,cAAQ,MAAM,UAAU,MAAM,QAAQ;AACtC,oBAAc,KAAK,MAAM,aAAa,UAAU,EAAE,MAAM,CAAC;AACzD,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,uBAAuB,QAAQ,EAAE;AAAA,IAC9D;AAAA,EACF;AAEA,MAAI,KAAK,IAAI,SAAS,SAAS,MAAM,GAAG;AACtC,QAAI,WAAW;AACb,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,mCAAmC;AAAA,IAChE,OAAO;AACL,kBAAY,MAAM,eAAe,IAAI;AACrC,oBAAc,KAAK,MAAM,aAAa,UAAU,EAAE,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAI,UAAU,CAAC;AAC1F,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,KAAK,KAAK,aAAa,YAAY,QAAQ,oBAAoB;AAAA,IAC5F;AAAA,EACF;AAEA,SAAO,KAAK,MAAM,aAAa,UAAU;AAAA,IACvC,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,EACnC,CAAC;AACH;AAEA,SAAS,KACP,MACA,SACA,UACA,QACkB;AAClB,QAAM,OAAO,gBAAgB,SAAS;AAAA,IACpC,OAAO,KAAK,IAAI,IAAI;AAAA,IACpB,aAAa,KAAK,IAAI;AAAA,IACtB,YAAY,KAAK,IAAI;AAAA,IACrB,KAAK,KAAK;AAAA,IACV;AAAA,IACA,GAAG;AAAA,EACL,CAAC;AACD,MAAI,KAAK,MAAO,kBAAiB,KAAK,IAAI,MAAM,iBAAiB,IAAI;AACrE,SAAO;AACT;AAEA,eAAe,UAAU,MAAsC,UAAmC;AAChG,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,cAAc,IAAI,gBAAgB,mBAAmB;AACrG,MAAI,MAAM,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe,mBAAmB,QAAQ,CAAC,SAAS;AAAA,IACnG,QAAQ;AAAA,IACR;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,UAAU,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB,MAAM,KAAK,QAAQ,SAAS,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,GAAG;AAAA,QACjF,OAAO;AAAA,MACT,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,OAAM,IAAI,MAAM,kBAAkB,QAAQ,aAAa,QAAQ,MAAM,IAAI,MAAM,SAAS,OAAO,CAAC,EAAE;AACnH,UAAM,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe,mBAAmB,QAAQ,CAAC,SAAS;AAAA,MAC/F,QAAQ;AAAA,MACR;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,gBAAgB,QAAQ,aAAa,IAAI,MAAM,IAAI,MAAM,SAAS,GAAG,CAAC,EAAE;AACrG,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,IAAK,OAAM,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB;AAC1E,SAAO,KAAK;AACd;AAEA,eAAe,eAAe,MAAuD;AACnF,QAAM,SAAS,KAAK,aAAa,YAAY;AAC7C,QAAM,MAAM,MAAM,KAAK;AAAA,IACrB,GAAG,KAAK,IAAI,WAAW,SAAS,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC,SAAS,MAAM,QAAQ,mBAAmB,KAAK,GAAG,CAAC;AAAA,IACtH,EAAE,QAAQ,QAAQ,SAAS,EAAE,eAAe,UAAU,KAAK,cAAc,GAAG,EAAE;AAAA,EAChF;AACA,MAAI,IAAI,WAAW,OAAO,CAAC,KAAK,YAAY;AAC1C,UAAM,IAAI;AAAA,MACR,sCAAsC,KAAK,GAAG;AAAA,IAEhD;AAAA,EACF;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,cAAc,KAAK,aAAa,aAAa,OAAO,KAAK,KAAK,GAAG,aAAa,IAAI,MAAM,IAAI,MAAM,SAAS,GAAG,CAAC,EAAE;AAC9I,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,MAAO,OAAM,IAAI,MAAM,cAAc,KAAK,aAAa,aAAa,OAAO,KAAK,KAAK,GAAG,qBAAqB;AACvH,SAAO,KAAK;AACd;AAEA,eAAe,SAAS,KAAgC;AACtD,MAAI;AACF,WAAO,eAAe,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AHjFA,eAAsB,UAAU,SAA0C;AACxE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,OAAO,UAAU,GAAG;AAC1B,QAAM,QAAQ,IAAI,SAAS,SAAS,IAAI;AACxC,QAAM,UAAU,IAAI,SAAS,SAAS,MAAM;AAE5C,MAAI,QAAQ,mBAAmB,CAAC,SAAS;AACvC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,QAAQ,eAAe,QAAQ,qBAAqB,OAAO;AAC7D,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,MAAI,IAAI,YAAY,KAAK,OAAO,KAAK,KAAK,KAAK,GAAG;AAClD,MAAI,IAAI,eAAe,KAAK,WAAW,EAAE;AACzC,MAAI,IAAI,eAAe,KAAK,UAAU,EAAE;AACxC,MAAI,IAAI,eAAe,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE;AAC7C,MAAI,IAAI,eAAe,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE;AAEjD,QAAM,iBAAiB,KAAK,KAAK,OAAO,CAAC,QAAQ,QAAQ,UAAU,QAAQ,YAAY;AACvF,MAAI,CAAC,QAAQ,UAAU,eAAe,SAAS,KAAK,CAAC,QAAQ,KAAK;AAChE,UAAM,IAAI;AAAA,MACR,wCAAwC,eAAe,KAAK,IAAI,CAAC;AAAA,IACnE;AAAA,EACF;AAEA,QAAM,SAAS,QAAQ,MAAM,kBAA2B,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,QAAQ,CAAC,IAAI;AACrG,QAAM,kBAAkB,QAAQ,MAAM,kBAA4B,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,OAAO,CAAC,IAAI;AAC5G,QAAM,QAAQ,oBAAoB,UAAU,IAAI,IAAI,iBAAiB,QAAQ,gBAAgB,MAAM,IAAI;AAEvG,MAAI,QAAQ,QAAQ;AAClB,QAAI,IAAI,0CAA0C;AAClD,QAAI,IAAI,aAAa,SAAS,QAAQ,IAAI,EAAE;AAC5C,QAAI,IAAI,aAAa,QAAQ,OAAO,KAAK,KAAK,EAAE,SAAS,CAAC,aAAa;AACvE,QAAI,IAAI,aAAa,IAAI,SAAS,SAAS,IAAI,IAAK,IAAI,IAAI,YAAY,mBAAoB,aAAa,EAAE;AAC3G,QAAI,IAAI,cAAc,QAAQ,cAAc,mCAAmC,YAAY,EAAE;AAC7F;AAAA,EACF;AAEA,MAAI,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC3D,MAAI,eAAe,YAAY,UAAU,IAAI,IAAI,IAAI;AACnD,UAAM,IAAI;AAAA,MACR,kBAAkB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,aAAa,YAAY,KAAK,WAAW,IAAI,IAAI,EAAE;AAAA,IAC1H;AAAA,EACF;AACA,QAAM,cAAc,CAAC,EAAE,QAAQ,cAAc,QAAQ;AACrD,QAAM,cAAc,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,GAAG,GAAG,SAAS;AAC7E,QAAM,YAAY,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,GAAG,GAAG,KAAK;AACvE,QAAM,2BAA4B,UAAU,CAAC,CAAC,QAAQ,cAAc,cAAgB,YAAY,eAAe;AAC/G,MAAI,QAAQ,qBAAqB,SAAS,0BAA0B;AAClE,UAAM,IAAI,MAAM,mGAAmG;AAAA,EACrH;AACA,QAAM,gBAAgB,0BAA0B,KAAK,QAAQ,YAAY;AACzE,MAAI,IAAI,MAAM,WAAW;AACvB,oBAAgB,IAAI,SAAS,CAAC,IAAI,MAAM,WAAW,IAAI,MAAM,iBAAiB,GAAI,gBAAgB,CAAC,aAAa,IAAI,CAAC,CAAE,CAAC;AAAA,EAC1H;AACA,MAAI,QAAQ,aAAa;AACvB,UAAM,qBAAqB,EAAE,YAAY,IAAI,YAAY,QAAQ,QAAQ,aAAa,CAAC;AACvF,QAAI,IAAI,qDAAqD;AAAA,EAC/D;AAEA,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,QAAQ,MAAM,kBAAkB,KAAK,SAAS,SAAS,GAAG;AAChE,QAAM,OAAO,iBAAiB,EAAE,UAAU,IAAI,aAAa,OAAO,SAAS,EAAE,OAAO,QAAQ,EAAE,CAAC;AAE/F,QAAM,WAAW,MAAM,gBAAgB,KAAK,OAAO,OAAO;AAC1D,MAAI,UAAU;AACZ,QAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,iBAAiB;AAAA,EAC7C,OAAO;AACL,UAAM,KAAK,UAAU,EAAE,MAAM,IAAI,IAAI,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC;AAC9D,QAAI,IAAI,gBAAgB,IAAI,IAAI,EAAE,EAAE;AAAA,EACtC;AAEA,aAAW,OAAO,IAAI,MAAM;AAC1B,eAAW,WAAW,IAAI,UAAU;AAClC,UAAI,YAAY,MAAM;AACpB,YAAI,IAAI,IAAI,UAAU;AACpB,gBAAM,KAAK,MAAM,IAAI,IAAI,IAAI,KAAK,EAAE,UAAU,IAAI,GAAG,UAAU,GAAI,IAAI,GAAG,QAAQ,EAAE,OAAO,IAAI,GAAG,MAAM,IAAI,CAAC,EAAG,CAAC;AACjH,cAAI,IAAI,GAAG,GAAG,oBAAoB,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,IAAI,IAAI,GAAG,KAAK,KAAK,EAAE,GAAG;AAAA,QAC/F,OAAO;AACL,gBAAM,KAAK,WAAW,IAAI,IAAI,IAAI,MAAM,MAAM,EAAE,IAAI,CAAC;AACrD,cAAI,IAAI,GAAG,GAAG,cAAc;AAAA,QAC9B;AAAA,MACF,OAAO;AACL,cAAM,KAAK,WAAW,IAAI,IAAI,IAAI,SAAS,MAAM,EAAE,IAAI,CAAC;AACxD,YAAI,IAAI,GAAG,GAAG,KAAK,OAAO,UAAU;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,aAAa,qBAAqB,IAAI,MAAM,QAAQ,GAAG,CAAC;AAC9D,QAAI,YAAY,gBAAgB;AAC9B,YAAM,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,UAAU;AAC9C,UAAI,IAAI,GAAG,GAAG,4BAA4B,WAAW,QAAQ,QAAQ,GAAG;AAAA,IAC1E;AAEA,UAAM,OAAO,IAAI,QAAQ,GAAG;AAC5B,QAAI,SAAS,QAAW;AACtB,YAAM,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,QAAQ,IAAI;AAChD,UAAI,IAAI,GAAG,GAAG,UAAU,OAAO,QAAQ,SAAS,EAAE;AAAA,IACpD;AAAA,EACF;AAEA,aAAW,OAAO,IAAI,MAAM;AAC1B,UAAM,WAAWC,aAAY,IAAI,IAAI,IAAI,GAAG;AAC5C,kBAAc,MAAM,wBAAwB;AAAA,MAC1C;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB;AAAA,MACA,UAAU,CAAC,CAAC,QAAQ;AAAA,MACpB,YAAY;AAAA,MACZ,OAAO,QAAQ,qBAAqB;AAAA,MACpC,OAAO;AAAA,MACP,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,QAAQ,YAAY,KAAK,GAAG,GAAG;AAErC,QAAI,QAAQ,aAAa;AACvB,UAAI;AACF,cAAM,0BAA0B;AAAA,UAC9B,YAAY,IAAI;AAAA,UAChB;AAAA,UACA,KAAK,QAAQ;AAAA,UACb,QAAQ,QAAQ;AAAA,UAChB,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,SAAS,OAAO;AACd,cAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,cAAM,UAAU,QAAQ,UAAU,QAAQ,eAAe,WAAW;AACpE,cAAM,IAAI;AAAA,UACR,GAAG,OAAO;AAAA,EAAK,GAAG,sEACa,GAAG,GAAG,OAAO;AAAA,UAC5C,EAAE,OAAO,MAAM;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,OAAO;AACnB,YAAM,SAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,QAAQ,CAAC,WAAW,OAAO,EAAE,OAAO,CAAC;AACzG,UAAI,IAAI,GAAG,GAAG,iBAAiB;AAAA,IACjC;AACA,QAAI,OAAO;AACT,YAAM,SAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,QAAQ,CAAC,gBAAgB,OAAO,KAAK;AACzG,UAAI,IAAI,GAAG,GAAG,mBAAmB,OAAO,KAAK,KAAK,EAAE,MAAM,cAAc;AAAA,IAC1E;AAEA,QAAI,IAAI,SAAS,SAAS,IAAI,KAAK,IAAI,IAAI,YAAY,IAAI,GAAG,QAAQ;AACpE,YAAM,MAAMC,SAAQ,IAAI,IAAI,GAAG,MAAM;AACrC,UAAI,KAAK;AACP,cAAM,aAAa,IAAI,GAAG,cAAc,kBAAkB,IAAI,GAAG,QAAQ;AACzE,cAAM,UAAU,EAAE,UAAU,IAAI,YAAY,OAAO,OAAO,QAAQ,GAAG,UAAU,YAAY,GAAG;AAC9F,YAAI,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,QAAQ,yBAAyB,UAAU,GAAG;AAAA,MAC1E,OAAO;AACL,YAAI,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,MAAM,wCAAwC;AAAA,MAC1E;AAAA,IACF;AAAA,EAEF;AAEA,MAAI,QAAQ,qBAAqB,SAAS,aAAa;AACrD,UAAM,UAAU,IAAI,MAAM,aAAa,eAAe,IAAI,SAAS,IAAI,MAAM,eAAe;AAC5F,QAAI,IAAI,sBAAsB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,SAAS,UAAU,iBAAiB,EAAE,GAAG;AAAA,EAC5H;AAEA,MAAI,iBAAiB,aAAa;AAChC,UAAM,MAAM,IAAI,KAAK,SAAS,KAAK,IAAI,QAAS,IAAI,KAAK,CAAC,KAAK;AAC/D,iBAAa,eAAe,aAAa,KAAK,YAAY,GAAG,CAAC;AAC9D,QAAI,IAAI,mBAAmB,YAAY,eAAe,IAAI,OAAO,CAAC,QAAQ,GAAG,EAAE;AAAA,EACjF;AACF;AAEA,eAAe,gBAAgB,KAA0B,OAAe,SAA6C;AACnH,QAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,WAAW,kBAAkB,mBAAmB,IAAI,IAAI,EAAE,CAAC,IAAI;AAAA,IAC9F,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,EAC9C,CAAC;AACD,MAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,MAAI,CAAC,IAAI,GAAI,QAAO;AACpB,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,KAAK,OAAO;AACrB;AAEA,eAAe,SAAS,SAAoB,KAAa,QAAgB,MAA8B;AACrG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,YAAY,IAAI,MAAM,IAAI,MAAMC,UAAS,GAAG,CAAC,EAAE;AACtG;AAEA,SAAS,qBAAqB,OAAgG;AAC5H,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAMC,kBAAiB,SAAS,KAAK;AACrC,WAAOA,kBAAiB,EAAE,gBAAAA,gBAAe,IAAI;AAAA,EAC/C;AACA,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,MAAM;AACZ,QAAM,iBAAiB,SAAS,IAAI,cAAc;AAClD,SAAO,iBAAiB,EAAE,gBAAgB,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC,GAAI,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC,EAAG,IAAI;AAC7I;AAEA,SAAS,kBAAkB,UAA0B;AACnD,QAAM,QAAQ;AACd,SAAO,MAAM,QAAQ,KAAK,GAAG,QAAQ;AACvC;AAEA,eAAeD,UAAS,KAAgC;AACtD,MAAI;AACF,WAAO,eAAe,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AIjQA,SAAS,cAAAE,aAAY,WAAW,aAAAC,YAAW,gBAAAC,eAAc,aAAa,iBAAAC,sBAAqB;AAC3F,SAAS,eAAe;AACxB,SAAS,WAAAC,UAAS,cAAAC,aAAY,QAAAC,OAAM,YAAAC,WAAU,WAAAC,UAAS,WAAW;AAClE,SAAS,qBAAqB;;;ACFvB,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAe7B,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzB,oBAAoB;AAAA;AAIf,SAAS,cAAc,OAAe,WAA2B;AACtE,QAAM,QAAQ,UAAU,MAAM,6BAA6B;AAC3D,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,iBAAiB,KAAK,0BAA0B;AAC5E,QAAM,QAAQ,MAAM,CAAC,EAAG,MAAM,OAAO;AACrC,QAAM,cAAwB,CAAC;AAC/B,MAAI,eAAe;AACnB,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,OAAO,KAAK,KAAK,WAAW,cAAc,GAAG;AAC/D,kBAAY,KAAK,IAAI;AACrB,qBAAe,KAAK,WAAW,cAAc;AAAA,IAC/C,WAAW,gBAAgB,OAAO,KAAK,IAAI,GAAG;AAC5C,kBAAY,KAAK,IAAI;AAAA,IACvB,OAAO;AACL,qBAAe;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AAAA,EACP,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,IAGpB,KAAK;AAAA;AAAA,iCAEwB,KAAK;AAAA;AAAA;AAAA;AAItC;;;AD7CO,IAAM,kBAAkB,CAAC,UAAU,SAAS,UAAU,WAAW,UAAU,QAAQ;AAmEnF,SAAS,aAAa,UAA+B,CAAC,GAAuB;AAClF,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,YAAY,QAAQ,aAAa,cAAc,IAAI,IAAI,aAAa,YAAY,GAAG,CAAC;AAC1F,QAAM,QAAQ,UAAU,SAAS;AACjC,MAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,8BAA8B,SAAS,EAAE;AAEjF,QAAM,YAAY,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI;AAC/E,QAAM,OAAOC,SAAQ,QAAQ,OAAO,QAAQ,IAAI,CAAC;AACjD,QAAM,OAAOA,SAAQ,QAAQ,WAAW,QAAQ,CAAC;AACjD,QAAM,QAAQ,oBAAI,IAAyB;AAC3C,QAAM,UAAU,oBAAI,IAA+B;AAEnD,QAAM,iBAAiB,CAAC,SAAuB,WAAyB;AACtE,UAAM,UAAU,QAAQ,IAAI,OAAO,KAAK,oBAAI,IAAY;AACxD,YAAQ,IAAI,MAAM;AAClB,YAAQ,IAAI,SAAS,OAAO;AAAA,EAC9B;AACA,QAAM,OAAO,CAAC,QAAgB,SAAiB,eAAe,OAAO,WAAW,SAAe;AAC7F,UAAM,WAAW,MAAM,IAAI,MAAM;AACjC,QAAI,YAAY,SAAS,YAAY,QAAS,OAAM,IAAI,MAAM,qCAAqC,MAAM,EAAE;AAC3G,UAAM,IAAI,QAAQ,EAAE,QAAQ,SAAS,UAAU,aAAa,CAAC;AAAA,EAC/D;AACA,QAAM,gBAAgB,CAACC,YAAmB,WAAW,SAAe;AAClE,eAAW,OAAO,MAAO,MAAKC,MAAKD,YAAW,GAAG,GAAGE,cAAaD,MAAK,WAAW,GAAG,GAAG,MAAM,GAAG,OAAO,QAAQ;AAAA,EACjH;AAEA,MAAI;AACJ,MAAI,QAAQ,QAAQ;AAClB,UAAM,aAAaA,MAAK,MAAM,WAAW,QAAQ;AACjD,UAAM,YAAYF,SAAQ,QAAQ,gBAAgB,QAAQ,IAAI,cAAcE,MAAK,MAAM,QAAQ,GAAG,QAAQ;AAC1G,gBAAY,UAAU,CAAC,MAAM,UAAU,YAAY;AACnD,eAAW,WAAW,WAAW;AAC/B,YAAM,YAAY,YAAY,WAAW,aAAa;AACtD,oBAAc,WAAW,YAAY,WAAW,OAAOE,SAAQA,SAAQ,SAAS,CAAC,CAAC;AAClF,qBAAe,SAAS,SAAS;AAAA,IACnC;AAAA,EACF,OAAO;AACL,UAAM,aAAaF,MAAK,MAAM,WAAW,QAAQ;AACjD,kBAAc,UAAU;AAExB,UAAM,aAAaA,MAAK,MAAM,WAAW,QAAQ;AACjD,gBAAY,UAAU,SAAS,QAAQ,IAAI,aAAa;AACxD,eAAW,WAAW,UAAW,gBAAe,SAAS,UAAU;AAEnE,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,iBAAW,SAAS,WAAW,KAAK,GAAG;AACrC,cAAM,YAAYC,cAAaD,MAAK,WAAW,OAAO,UAAU,GAAG,MAAM;AACzE,aAAKA,MAAK,YAAY,OAAO,UAAU,GAAG,cAAc,OAAO,SAAS,CAAC;AAAA,MAC3E;AACA,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,aAAaA,MAAK,MAAM,WAAW,SAAS,UAAU;AAC5D,WAAK,YAAY,WAAW;AAC5B,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,aAAaA,MAAK,MAAM,WAAW;AACzC,WAAK,YAAY,mBAAmB,YAAY,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AACzG,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,SAAS,GAAG;AACjC,YAAM,cAAcA,MAAK,MAAM,WAAW,yBAAyB;AACnE,WAAK,aAAa,mBAAmB,aAAa,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AAC3G,qBAAe,WAAW,WAAW;AAAA,IACvC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,aAAaA,MAAK,MAAM,WAAW;AACzC,WAAK,YAAY,mBAAmB,YAAY,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AACzG,qBAAe,UAAU,UAAU;AAAA,IACrC;AAAA,EACF;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,iBAAiB,oBAAI,IAAY;AACvC,QAAM,YAAsB,CAAC;AAC7B,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,UAAM,UAAU,mBAAmB,KAAK,UAAU,KAAK,MAAM;AAC7D,QAAI,SAAS;AACX,gBAAU,KAAK,GAAG,KAAK,MAAM,iCAAiC,OAAO,GAAG;AACxE;AAAA,IACF;AACA,QAAI,CAACG,YAAW,KAAK,MAAM,GAAG;AAC5B,mBAAa,IAAI,KAAK,MAAM;AAC5B;AAAA,IACF;AACA,UAAM,UAAUF,cAAa,KAAK,QAAQ,MAAM;AAChD,QAAI,YAAY,KAAK,SAAS;AAC5B,qBAAe,IAAI,KAAK,MAAM;AAAA,IAChC,WAAW,KAAK,gBAAgB,QAAQ,OAAO;AAC7C,mBAAa,IAAI,KAAK,MAAM;AAC5B,qBAAe,OAAO,KAAK,MAAM;AAAA,IACnC,OAAO;AACL,gBAAU,KAAK,KAAK,MAAM;AAAA,IAC5B;AAAA,EACF;AAEA,MAAI,UAAU,SAAS,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,EAAmG,UAAU,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IAChJ;AAAA,EACF;AAEA,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,QAAI,CAACE,YAAW,KAAK,MAAM,KAAKF,cAAa,KAAK,QAAQ,MAAM,MAAM,KAAK,SAAS;AAClF,MAAAG,WAAUF,SAAQ,KAAK,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AACnD,MAAAG,eAAc,KAAK,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,SAAS,WAAW,KAAK;AAC/B,QAAM,gBAAgB,UAAU,IAAI,CAAC,aAAa,EAAE,SAAS,SAAS,CAAC,GAAI,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAE,EAAE,EAAE;AAC1G,MAAI,IAAI,oBAAoB,UAAU,KAAK,IAAI,CAAC,EAAE;AAClD,MAAI,IAAI,mBAAmB,OAAO,KAAK,IAAI,CAAC,EAAE;AAC9C,aAAW,gBAAgB,cAAe,KAAI,IAAI,GAAG,aAAa,OAAO,KAAK,aAAa,QAAQ,KAAK,IAAI,CAAC,EAAE;AAC/G,MAAI,IAAI,aAAa,aAAa,IAAI,mBAAmB,eAAe,OAAO,KAAK,eAAe,IAAI,gBAAgB,EAAE,EAAE;AAC3H,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW,WAAW,YAAY;AAAA,IAC3C,WAAW,WAAW,WAAW,cAAc;AAAA,IAC/C,cAAc,CAAC,GAAG,YAAY,EAAE,KAAK;AAAA,IACrC,gBAAgB,CAAC,GAAG,cAAc,EAAE,KAAK;AAAA,IACzC,WAAW;AAAA,EACb;AACF;AAEA,SAAS,WAAW,MAAc,OAA8B;AAC9D,SAAO,CAAC,GAAG,KAAK,EACb,IAAI,CAAC,SAASC,UAAS,MAAM,IAAI,CAAC,EAClC,OAAO,CAAC,SAAS,SAAS,QAAQ,CAAC,KAAK,WAAW,KAAK,GAAG,EAAE,KAAK,CAACC,YAAW,IAAI,CAAC,EACnF,KAAK;AACV;AAEA,SAAS,mBAAmB,QAA4C,QAAiC;AACvG,QAAM,YAAsB,QAAQ,SAAS,SAAS,CAAC,QAAQ;AAC/D,QAAM,UAAU,oBAAI,IAAY,CAAC,GAAG,iBAAiB,KAAK,CAAC;AAC3D,aAAW,WAAW,WAAW;AAC/B,QAAI,CAAC,QAAQ,IAAI,OAAO,GAAG;AACzB,YAAM,IAAI,MAAM,0BAA0B,OAAO,kBAAkB,gBAAgB,KAAK,IAAI,CAAC,EAAE;AAAA,IACjG;AAAA,EACF;AACA,QAAM,WAA2B,UAAU,SAAS,KAAK,IACrD,SAAS,CAAC,UAAU,OAAO,IAAI,CAAC,GAAG,eAAe,IAClD,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AAC1B,MAAI,QAAQ;AACV,UAAM,cAAc,SAAS,OAAO,CAAC,YAAY,YAAY,YAAY,YAAY,OAAO;AAC5F,QAAI,YAAY,QAAQ;AACtB,YAAM,IAAI,MAAM,4CAA4C,YAAY,KAAK,IAAI,CAAC,kCAAkC;AAAA,IACtH;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,MAAc,OAAe,OAAgB,UAA0B;AACjG,QAAM,UAAU,mBAAmB,UAAU,IAAI;AACjD,MAAI,QAAS,OAAM,IAAI,MAAM,sBAAsB,IAAI,6BAA6B,OAAO,EAAE;AAC7F,MAAI,CAACJ,YAAW,IAAI,EAAG,QAAO,GAAG,KAAK;AAAA;AACtC,QAAM,UAAUF,cAAa,MAAM,MAAM;AACzC,QAAM,QAAQ;AACd,QAAM,MAAM;AACZ,QAAM,UAAU,QAAQ,QAAQ,KAAK;AACrC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAK,YAAY,QAAS,UAAU,OAAQ,YAAY,MAAM,QAAQ,SAAU;AAC9E,UAAM,IAAI,MAAM,qCAAqC,IAAI,EAAE;AAAA,EAC7D;AACA,MAAI,YAAY,IAAI;AAClB,UAAM,YAAY,QAAQ,WAAW,KAAK,QAAQ,SAAS,MAAM,IAAI,KAAK,QAAQ,SAAS,IAAI,IAAI,OAAO;AAC1G,WAAO,GAAG,OAAO,GAAG,SAAS,GAAG,KAAK;AAAA;AAAA,EACvC;AACA,QAAM,WAAW,QAAQ,IAAI;AAC7B,QAAM,WAAW,QAAQ,MAAM,SAAS,QAAQ;AAChD,MAAI,aAAa,SAAS,CAAC,OAAO;AAChC,UAAM,IAAI,MAAM,4CAA4C,IAAI,+CAA+C;AAAA,EACjH;AACA,SAAO,GAAG,QAAQ,MAAM,GAAG,OAAO,CAAC,GAAG,KAAK,GAAG,QAAQ,MAAM,QAAQ,CAAC;AACvE;AAEA,SAAS,mBAAmB,UAAkB,QAAoC;AAChF,QAAM,MAAMK,UAAS,UAAU,MAAM;AACrC,MAAI,QAAQ,QAAQ,IAAI,WAAW,KAAK,GAAG,EAAE,KAAKC,YAAW,GAAG,GAAG;AACjE,UAAM,IAAI,MAAM,gDAAgD,MAAM,EAAE;AAAA,EAC1E;AACA,MAAI,UAAU;AACd,aAAW,QAAQ,IAAI,MAAM,GAAG,EAAE,OAAO,OAAO,GAAG;AACjD,cAAUP,MAAK,SAAS,IAAI;AAC5B,QAAI;AACF,UAAI,UAAU,OAAO,EAAE,eAAe,EAAG,QAAO;AAAA,IAClD,SAAS,OAAO;AACd,UAAK,MAAgC,SAAS,SAAU,OAAM;AAAA,IAChE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA2B;AAC7C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,CAAC,SAAS,sBAAsB,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,MAAM,OAAO,EAAE,CAAC,CAAE,CAAC,CAAC,EAAE,KAAK;AAC5H;AAEA,SAAS,UAAU,KAAuB;AACxC,MAAI,CAACG,YAAW,GAAG,EAAG,QAAO,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,CAAC,YAA0B;AACtC,eAAW,SAAS,YAAY,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;AACjE,YAAM,OAAOH,MAAK,SAAS,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,EAAG,MAAK,IAAI;AAAA,UAC7B,SAAQ,KAAKM,UAAS,KAAK,IAAI,CAAC;AAAA,IACvC;AAAA,EACF;AACA,OAAK,GAAG;AACR,SAAO,QAAQ,KAAK;AACtB;;;AElQA,eAAsB,MAAM,SAAsC;AAChE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ,QAAQ,IAAI,KAAK,SAAS,KAAK,IAAI,QAAS,IAAI,KAAK,CAAC,KAAK;AAC/E,MAAI,CAAC,IAAI,KAAK,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,QAAQ,GAAG,wBAAwB,YAAY,IAAI,YAAY,IAAI,OAAO,CAAC,EAAE;AAE1H,QAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,8BAA8B,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,6CAA6C;AAAA,EAChJ;AACA,MAAI,YAAY,UAAU,IAAI,IAAI,IAAI;AACpC,UAAM,IAAI,MAAM,kCAAkC,YAAY,KAAK,yBAAyB,IAAI,IAAI,EAAE,GAAG;AAAA,EAC3G;AAEA,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,OAAO,YAAY,CAAC,MAAM,OAAO;AACpC,UAAM,IAAI,MAAM,6CAA6C,GAAG,8CAA8C;AAAA,EAChH;AAEA,QAAM,UAAU,QAAQ,SAAS;AACjC,MAAI,IAAI,UAAU,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AACrC,MAAI,IAAI,aAAa,MAAM,QAAQ,EAAE;AAErC,QAAM,eAAe,MAAM,QAAQ,SAAS,gBAAgB,IAAI,aAAa,IAAI,IAAI,IAAI,GAAG,GAAG,MAAS;AACxG,MAAI,IAAI,qBAAqB;AAE7B,MAAI,IAAI,IAAI,UAAU;AACpB,UAAM,WAAa,aAAwD,IAAI,YAAY;AAC3F,QAAI,aAAa,IAAI,GAAG,UAAU;AAChC,YAAM,IAAI,MAAM,mCAAmC,IAAI,GAAG,QAAQ,yBAAyB,YAAY,MAAM,GAAG;AAAA,IAClH;AACA,QAAI,IAAI,SAAS,QAAQ,EAAE;AAAA,EAC7B;AAEA,QAAM,iBAAiB,MAAM,kBAA2B,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,QAAQ,CAAC;AACjG,QAAM,mBAAmB,mBAAmB,cAAc;AAC1D,QAAM,oBAAoB,MAAM,QAAQ,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,MAAM,QAAQ,CAAC,WAAW,MAAM,KAAK;AAClI,QAAM,aAAc,kBAA2C,UAAU;AACzE,QAAM,eAAe,mBAAmB,UAAU;AAClD,MAAI,iBAAiB,QAAQ;AAC3B,UAAM,UAAU,iBAAiB,OAAO,CAAC,WAAW,CAAC,aAAa,SAAS,MAAM,CAAC;AAClF,QAAI,QAAQ,OAAQ,OAAM,IAAI,MAAM,6CAA6C,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EACvG;AACA,MAAI,IAAI,aAAa,aAAa,MAAM,WAAW;AAEnD,QAAM,kBAAkB,iBAAiB,CAAC,KAAK,aAAa,CAAC;AAC7D,MAAI,iBAAiB;AACnB,UAAM,YAAY,MAAME,UAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,MAAM,QAAQ,CAAC,cAAc,MAAM,OAAO;AAAA,MAC9H,IAAI;AAAA,MACJ,WAAW,EAAE,OAAO,KAAK;AAAA,IAC3B,CAAC;AACD,UAAM,QAAS,UAAkD,WAAW;AAC5E,QAAI,IAAI,gBAAgB,eAAe,UAAU,OAAO,SAAS,IAAI,CAAC,EAAE;AAAA,EAC1E,OAAO;AACL,QAAI,IAAI,+CAA+C;AAAA,EACzD;AACA,MAAI,IAAI,IAAI;AACd;AAEA,eAAe,QAAQ,SAAoB,KAAa,QAA8C;AACpG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,SAAS,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG,IAAI;AAAA,EAC5D,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,aAAa,IAAI,MAAM,KAAK,MAAMC,UAAS,GAAG,CAAC,EAAE;AACtG,SAAO,IAAI,KAAK;AAClB;AAEA,eAAeD,UAAS,SAAoB,KAAa,QAAgB,MAAiC;AACxG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,aAAa,IAAI,MAAM,KAAK,MAAMC,UAAS,GAAG,CAAC,EAAE;AACtG,SAAO,IAAI,KAAK;AAClB;AAEA,SAAS,gBAAgB,aAAqB,OAAe,KAAqB;AAChF,QAAM,MAAM,IAAI,IAAI,kBAAkB,mBAAmB,KAAK,CAAC,kBAAkB,WAAW;AAC5F,MAAI,aAAa,IAAI,OAAO,GAAG;AAC/B,SAAO,IAAI,SAAS;AACtB;AAEA,eAAeA,UAAS,KAAgC;AACtD,MAAI;AACF,YAAQ,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG;AAAA,EACxC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACnHA,SAAS,gBAAAC,qBAAoB;AAgC7B,eAAsB,OAAO,OAAO,QAAQ,KAAK,MAAM,CAAC,GAAkB;AACxE,QAAM,SAAS,UAAU,IAAI;AAC7B,QAAM,UAAU,OAAO,YAAY,CAAC,KAAK;AACzC,MAAI,YAAY,aAAa,YAAY,QAAQ,OAAO,QAAQ,YAAY,MAAM;AAChF,eAAW,QAAQ,CAAC,SAAS,GAAG,CAAC;AACjC,YAAQ,IAAI,WAAW,CAAC;AACxB;AAAA,EACF;AAEA,MAAI,YAAY,UAAU,YAAY,YAAY,YAAY,MAAM;AAClE,eAAW,QAAQ,CAAC,MAAM,GAAG,CAAC;AAC9B,cAAU;AACV;AAAA,EACF;AAEA,MAAI,YAAY,QAAQ;AACtB,eAAW,QAAQ,CAAC,UAAU,QAAQ,UAAU,OAAO,YAAY,eAAe,OAAO,GAAG,CAAC;AAC7F,gBAAY;AAAA,MACV,OAAO,eAAe,OAAO,QAAQ,QAAQ,GAAG,UAAU;AAAA,MAC1D,MAAM,eAAe,OAAO,QAAQ,MAAM,QAAQ;AAAA,MAClD,YAAY,UAAU,OAAO,QAAQ,MAAM;AAAA,MAC3C,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAAA,MAChC,UAAU,QAAQ,OAAO,QAAQ,QAAQ;AAAA,MACzC,YAAY,UAAU,OAAO,QAAQ,aAAa,CAAC;AAAA,MACnD,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,UAAU;AACxB,eAAW,QAAQ,CAAC,QAAQ,GAAG,CAAC;AAChC,UAAM,OAAO,EAAE,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK,kBAAkB,CAAC;AAClF;AAAA,EACF;AAEA,MAAI,YAAY,gBAAgB;AAC9B,eAAW,QAAQ,CAAC,MAAM,GAAG,CAAC;AAC9B,sBAAkB,OAAO,QAAQ,SAAS,IAAI;AAC9C;AAAA,EACF;AAEA,MAAI,YAAY,aAAa;AAC3B;AAAA,MACE;AAAA,MACA;AAAA,QACE;AAAA,QAAU;AAAA,QAAW;AAAA,QAAe;AAAA,QAAqB;AAAA,QAAgB;AAAA,QACzE;AAAA,QAAkB;AAAA,QAAS;AAAA,QAAQ;AAAA,MACrC;AAAA,MACA;AAAA,IACF;AACA,UAAMC,gBAAe,OAAO,QAAQ,gBAAgB;AACpD,UAAM,OAAyB;AAAA,MAC7B,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,MACtC,YAAY,OAAO,QAAQ,aAAa,MAAM;AAAA,MAC9C,iBAAiB,OAAO,QAAQ,mBAAmB,MAAM;AAAA,MACzD,aAAa,OAAO,QAAQ,cAAc,MAAM;AAAA,MAChD,kBAAkB,OAAO,QAAQ,mBAAmB,MAAM;AAAA,MAC1D,cAAc,OAAOA,kBAAiB,WAAWA,gBAAeA,kBAAiB;AAAA,MACjF,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,MAAM,OAAO,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO;AAAA,MACpF,KAAK,OAAO,QAAQ,QAAQ;AAAA,IAC9B;AACA,UAAM,UAAU,IAAI;AACpB;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,eAAW,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC;AACvC,UAAM,MAAM;AAAA,MACV,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,IACnC,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,eAAW,QAAQ,CAAC,OAAO,UAAU,SAAS,SAAS,SAAS,GAAG,CAAC;AAGpE,iBAAa;AAAA,MACX,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,QAAQ,OAAO,QAAQ,WAAW;AAAA,MAClC,WAAW,YAAY,MAAM;AAAA,MAC7B,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD,YAAQ;AAAA,MACN;AAAA,IAEF;AACA;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,UAAM,MAAM,OAAO,YAAY,CAAC;AAChC,QAAI,QAAQ,UAAW,OAAM,IAAI,MAAM,6BAA6B,OAAO,EAAE,iCAAiC;AAC9G,eAAW,QAAQ,CAAC,OAAO,UAAU,SAAS,SAAS,SAAS,GAAG,CAAC;AACpE,iBAAa;AAAA,MACX,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,QAAQ,OAAO,QAAQ,WAAW;AAAA,MAClC,WAAW,YAAY,MAAM;AAAA,MAC7B,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,WAAW;AACzB,UAAM,MAAM,OAAO,YAAY,CAAC;AAChC,QAAI,QAAQ,OAAQ,OAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE,0CAA0C;AACtH,eAAW,QAAQ,CAAC,UAAU,OAAO,WAAW,KAAK,GAAG,CAAC;AACzD,UAAM,YAAY;AAAA,MAChB,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,KAAK,eAAe,OAAO,QAAQ,KAAK,OAAO;AAAA,MAC/C,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,MACtC,KAAK,OAAO,QAAQ,QAAQ;AAAA,IAC9B,CAAC;AACD;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,oBAAoB,OAAO,wBAAwB;AACrE;AAOA,SAAS,WAAW,QAAoB,gBAA0B,gBAA8B;AAC9F,QAAM,UAAU,IAAI,IAAI,cAAc;AACtC,aAAW,QAAQ,OAAO,KAAK,OAAO,OAAO,GAAG;AAC9C,QAAI,CAAC,QAAQ,IAAI,IAAI,GAAG;AACtB,YAAM,IAAI,MAAM,qBAAqB,IAAI,6CAA6C;AAAA,IACxF;AAAA,EACF;AACA,MAAI,OAAO,YAAY,SAAS,gBAAgB;AAC9C,UAAM,IAAI,MAAM,wBAAwB,OAAO,YAAY,cAAc,CAAC,uBAAuB;AAAA,EACnG;AACF;AAEA,SAAS,UAAU,MAA4B;AAC7C,QAAM,cAAwB,CAAC;AAC/B,QAAM,UAAuD,CAAC;AAC9D,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,CAAC,IAAI,WAAW,IAAI,GAAG;AACzB,kBAAY,KAAK,GAAG;AACpB;AAAA,IACF;AACA,UAAM,KAAK,IAAI,QAAQ,GAAG;AAC1B,UAAM,UAAU,IAAI,MAAM,GAAG,OAAO,KAAK,SAAY,EAAE;AACvD,QAAI,CAAC,QAAS;AACd,QAAI,QAAQ,WAAW,KAAK,GAAG;AAC7B,cAAQ,QAAQ,MAAM,CAAC,CAAC,IAAI;AAC5B;AAAA,IACF;AACA,QAAI,OAAO,IAAI;AACb,gBAAU,SAAS,SAAS,IAAI,MAAM,KAAK,CAAC,CAAC;AAC7C;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,IAAI,CAAC;AACxB,QAAI,UAAU,UAAa,CAAC,MAAM,WAAW,IAAI,GAAG;AAClD;AACA,gBAAU,SAAS,SAAS,KAAK;AAAA,IACnC,OAAO;AACL,gBAAU,SAAS,SAAS,IAAI;AAAA,IAClC;AAAA,EACF;AACA,SAAO,EAAE,aAAa,QAAQ;AAChC;AAEA,SAAS,UAAU,SAAsD,MAAc,OAA+B;AACpH,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,QAAQ,QAAW;AACrB,YAAQ,IAAI,IAAI;AAAA,EAClB,WAAW,MAAM,QAAQ,GAAG,GAAG;AAC7B,QAAI,KAAK,OAAO,KAAK,CAAC;AAAA,EACxB,OAAO;AACL,YAAQ,IAAI,IAAI,CAAC,OAAO,GAAG,GAAG,OAAO,KAAK,CAAC;AAAA,EAC7C;AACF;AAEA,SAAS,eAAe,OAAgD,MAAsB;AAC5F,QAAM,IAAI,UAAU,KAAK;AACzB,MAAI,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,cAAc;AAC7C,SAAO;AACT;AAEA,SAAS,UAAU,OAAoE;AACrF,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,MAAM,SAAS,CAAC;AACvD,SAAO;AACT;AAEA,SAAS,QAAQ,OAAsE;AACrF,MAAI,UAAU,UAAa,UAAU,SAAS,UAAU,KAAM,QAAO;AACrE,QAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACpD,SAAO,OAAO,QAAQ,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,OAAO;AAC5F;AAEA,SAAS,YAAY,QAA4C;AAC/D,QAAM,WAAW;AAAA,IACf,GAAG,cAAc,OAAO,QAAQ,OAAO,SAAS;AAAA,IAChD,GAAG,cAAc,OAAO,QAAQ,SAAS,WAAW;AAAA,EACtD;AACA,SAAQ,SAAS,SAAS,WAAW,CAAC,KAAK;AAC7C;AAEA,SAAS,cAAc,OAAgD,MAAwB;AAC7F,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,MAAI,OAAO,UAAU,UAAW,OAAM,IAAI,MAAM,GAAG,IAAI,0BAA0B;AACjF,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACjD,QAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC;AACnD,MAAI,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,0BAA0B;AACzF,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AACxC;AAEO,SAAS,aAAqB;AACnC,QAAM,MAAM,KAAK,MAAMC,cAAa,IAAI,IAAI,mBAAmB,YAAY,GAAG,GAAG,MAAM,CAAC;AACxF,SAAO,IAAI,WAAW;AACxB;AAEA,SAAS,YAAkB;AACzB,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAiCb;AACD;","names":["existsSync","readFileSync","join","resolve","existsSync","readFileSync","dirname","isAbsolute","resolve","existsSync","readFileSync","resolve","existsSync","join","readFileSync","existsSync","mkdirSync","writeFileSync","dirname","resolve","resolve","existsSync","mkdirSync","dirname","writeFileSync","tenantIdFor","process","process","spawn","process","resolve","process","tenantIdFor","process","safeText","publishableKey","existsSync","mkdirSync","readFileSync","writeFileSync","dirname","isAbsolute","join","relative","resolve","resolve","targetDir","join","readFileSync","dirname","existsSync","mkdirSync","writeFileSync","relative","isAbsolute","postJson","safeText","readFileSync","writeDevVars","readFileSync"]}