@odla-ai/cli 0.6.0 → 0.7.1

package/dist/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/index.ts","../../../node_modules/tsup/assets/cjs_shims.js","../src/cli.ts","../src/admin-ai.ts","../src/open.ts","../src/token.ts","../src/local.ts","../src/argv.ts","../src/capabilities.ts","../src/config.ts","../src/doctor-checks.ts","../src/redact.ts","../src/wrangler.ts","../src/doctor.ts","../src/init.ts","../src/provision.ts","../src/provision-credentials.ts","../src/secrets.ts","../src/security.ts","../src/help.ts","../src/skill.ts","../src/skill-adapters.ts","../src/smoke.ts"],"sourcesContent":["export { runCli } from \"./cli\";\nexport { adminAi, getScopedPlatformToken, SYSTEM_AI_PURPOSES } from \"./admin-ai\";\nexport type { AdminAiOptions, ScopedPlatformTokenOptions, SystemAiPurpose } from \"./admin-ai\";\nexport { CAPABILITIES, printCapabilities } from \"./capabilities\";\nexport { doctor } from \"./doctor\";\nexport { initProject } from \"./init\";\nexport { provision } from \"./provision\";\nexport { redactSecrets } from \"./redact\";\nexport { secretsPush } from \"./secrets\";\nexport type { SecretsPushOptions } from \"./secrets\";\nexport { runHostedSecurity } from \"./security\";\nexport type { HostedSecurityProfile, HostedSecurityResult, HostedSecurityTokenRequest, RunHostedSecurityOptions } from \"./security\";\nexport { AGENT_HARNESSES, installSkill } from \"./skill\";\nexport type { AgentHarness, AgentHarnessSelector, HarnessInstallResult, SkillInstallOptions, SkillInstallResult } from \"./skill\";\nexport { smoke } from \"./smoke\";\nexport type { OdlaProjectConfig, LoadedProjectConfig, LocalCredentials, ProvisionOptions, ProvisionPlan, SmokeOptions } from \"./types\";\n","// Shim globals in cjs bundle\n// There's a weird bug that esbuild will always inject importMetaUrl\n// if we export it as `const importMetaUrl = ... __filename ...`\n// But using a function will not cause this issue\n\nconst getImportMetaUrl = () => \n  typeof document === \"undefined\" \n    ? new URL(`file:${__filename}`).href \n    : (document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT') \n      ? document.currentScript.src \n      : new URL(\"main.js\", document.baseURI).href;\n\nexport const importMetaUrl = /* @__PURE__ */ getImportMetaUrl()\n","import { findingsAtOrAbove, type Severity } from \"@odla-ai/security\";\nimport { adminAi, getScopedPlatformToken } from \"./admin-ai\";\nimport { assertArgs, boolOpt, listOpt, numberOpt, parseArgv, requiredString, stringOpt, type ParsedArgv } from \"./argv\";\nimport { printCapabilities } from \"./capabilities\";\nimport { loadProjectConfig } from \"./config\";\nimport { doctor } from \"./doctor\";\nimport { initProject } from \"./init\";\nimport { provision } from \"./provision\";\nimport { secretsPush } from \"./secrets\";\nimport { runHostedSecurity, type HostedSecurityProfile } from \"./security\";\nimport { cliVersion, printHelp } from \"./help\";\nimport { installSkill } from \"./skill\";\nimport type { AgentHarnessSelector } from \"./skill\";\nimport { smoke } from \"./smoke\";\nimport { getDeveloperToken } from \"./token\";\nimport type { ProvisionOptions } from \"./types\";\n\n/**\n * Parse CLI arguments and dispatch to the matching command — the entry point\n * `bin.ts` invokes. `argv` defaults to `process.argv.slice(2)`; the first\n * positional selects the command and the rest are parsed into flags (supporting\n * `--flag value`, `--flag=value`, boolean `--flag`, `--no-flag`, and repeated\n * flags collected into arrays).\n *\n * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print\n * and return; `init` scaffolds a project (requires `--app-id` and `--name`);\n * `doctor` validates config offline; `capabilities` prints the responsibility\n * boundary; `admin ai` reads/updates purpose-specific platform AI policies and\n * write-only credentials through a short-lived exact-scope device grant;\n * `security run` performs an explicitly acknowledged, app-attributed hosted\n * reasoning pass; `provision` runs the full provision (including optional secret\n * rotation, local vars, and deployed secret push); `smoke` checks a live env;\n * `setup` and `skill install` install the bundled offline runbooks for Claude\n * Code, Codex, Cursor, Copilot, Gemini, and `AGENTS.md`-aware agents; and\n * `secrets push` pipes the env's configured db/o11y secrets into the Worker via\n * Wrangler (requires `--env`). Throws on an unknown command/subcommand, unsupported option, extra\n * positional argument, missing required value, or a dispatched command error.\n *\n * @param argv Argument vector without the node/script prefix (default\n *   `process.argv.slice(2)`).\n */\nexport async function runCli(argv = process.argv.slice(2)): Promise<void> {\n  const parsed = parseArgv(argv);\n  const command = parsed.positionals[0] ?? \"help\";\n  if (command === \"version\" || command === \"-v\" || parsed.options.version === true) {\n    assertArgs(parsed, [\"version\"], 1);\n    console.log(cliVersion());\n    return;\n  }\n\n  if (command === \"help\" || command === \"--help\" || command === \"-h\") {\n    assertArgs(parsed, [\"help\"], 1);\n    printHelp();\n    return;\n  }\n\n  if (command === \"init\") {\n    assertArgs(parsed, [\"app-id\", \"name\", \"config\", \"env\", \"services\", \"ai-provider\", \"force\"], 1);\n    initProject({\n      appId: requiredString(parsed.options[\"app-id\"], \"--app-id\"),\n      name: requiredString(parsed.options.name, \"--name\"),\n      configPath: stringOpt(parsed.options.config),\n      envs: listOpt(parsed.options.env),\n      services: listOpt(parsed.options.services),\n      aiProvider: stringOpt(parsed.options[\"ai-provider\"]),\n      force: parsed.options.force === true,\n    });\n    return;\n  }\n\n  if (command === \"doctor\") {\n    assertArgs(parsed, [\"config\"], 1);\n    await doctor({ configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\" });\n    return;\n  }\n\n  if (command === \"capabilities\") {\n    assertArgs(parsed, [\"json\"], 1);\n    printCapabilities(parsed.options.json === true);\n    return;\n  }\n\n  if (command === \"admin\") {\n    const area = parsed.positionals[1];\n    const action = parsed.positionals[2];\n    const credentialSet = action === \"credential\" && parsed.positionals[3] === \"set\";\n    const credentials = action === \"credentials\";\n    if (area !== \"ai\" || (action !== \"show\" && action !== \"set\" && !credentialSet && !credentials)) {\n      throw new Error('unknown admin command. Try \"odla-ai admin ai show\".');\n    }\n    assertArgs(parsed, [\n      \"platform\", \"token\", \"json\", \"open\", \"provider\", \"model\", \"enabled\",\n      \"max-input-bytes\", \"max-output-tokens\", \"max-calls-per-run\", \"from-env\", \"stdin\",\n    ], credentialSet ? 5 : action === \"set\" ? 4 : 3);\n    await adminAi({\n      action: credentialSet ? \"credential-set\" : credentials ? \"credentials\" : action as \"show\" | \"set\",\n      purpose: action === \"set\" ? parsed.positionals[3] : undefined,\n      provider: stringOpt(parsed.options.provider),\n      model: stringOpt(parsed.options.model),\n      enabled: boolOpt(parsed.options.enabled),\n      maxInputBytes: numberOpt(parsed.options[\"max-input-bytes\"], \"--max-input-bytes\"),\n      maxOutputTokens: numberOpt(parsed.options[\"max-output-tokens\"], \"--max-output-tokens\"),\n      maxCallsPerRun: numberOpt(parsed.options[\"max-calls-per-run\"], \"--max-calls-per-run\"),\n      platform: stringOpt(parsed.options.platform),\n      token: stringOpt(parsed.options.token),\n      json: parsed.options.json === true,\n      open: parsed.options.open === false ? false : parsed.options.open === true ? true : undefined,\n      credentialProvider: credentialSet ? parsed.positionals[4] : undefined,\n      fromEnv: stringOpt(parsed.options[\"from-env\"]),\n      stdin: parsed.options.stdin === true,\n    });\n    return;\n  }\n\n  if (command === \"security\") {\n    const sub = parsed.positionals[1];\n    if (sub !== \"run\") throw new Error('unknown security command. Try \"odla-ai security run\".');\n    assertArgs(parsed, [\n      \"config\", \"env\", \"out\", \"profile\", \"max-hunt-tasks\", \"run-id\", \"platform\",\n      \"self\", \"ack-redacted-source\", \"open\", \"fail-on\", \"fail-on-candidates\", \"allow-incomplete\",\n    ], 3);\n    const configPath = stringOpt(parsed.options.config) ?? \"odla.config.mjs\";\n    const selfAudit = parsed.options.self === true;\n    const open = parsed.options.open === false ? false : parsed.options.open === true ? true : undefined;\n    const platform = stringOpt(parsed.options.platform);\n    const result = await runHostedSecurity({\n      configPath,\n      selfAudit,\n      target: parsed.positionals[2],\n      out: stringOpt(parsed.options.out),\n      env: stringOpt(parsed.options.env),\n      profile: securityProfile(stringOpt(parsed.options.profile)),\n      maxHuntTasks: numberOpt(parsed.options[\"max-hunt-tasks\"], \"--max-hunt-tasks\"),\n      runId: stringOpt(parsed.options[\"run-id\"]),\n      platform,\n      sourceDisclosureAck: parsed.options[\"ack-redacted-source\"] === true ? \"redacted\" : undefined,\n      getToken: async (request) => {\n        if (request.scope === \"platform:security:self\") {\n          return getScopedPlatformToken({ platform: request.platform, scope: request.scope, open });\n        }\n        const cfg = await loadProjectConfig(configPath);\n        return getDeveloperToken(cfg, { configPath, open }, fetch, console);\n      },\n    });\n    const failOn = severityOpt(stringOpt(parsed.options[\"fail-on\"]) ?? \"high\", \"--fail-on\");\n    const candidateValue = parsed.options[\"fail-on-candidates\"];\n    const failOnCandidates = candidateValue === false ? undefined : severityOpt(stringOpt(candidateValue) ?? \"critical\", \"--fail-on-candidates\");\n    const confirmed = findingsAtOrAbove(result.report, failOn);\n    const leads = failOnCandidates\n      ? findingsAtOrAbove(result.report, failOnCandidates, true).filter((finding) => finding.disposition !== \"confirmed\")\n      : [];\n    const incomplete = result.report.coverageStatus === \"incomplete\" && parsed.options[\"allow-incomplete\"] !== true;\n    if (confirmed.length || leads.length || incomplete) {\n      throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? \"disabled\"}${incomplete ? \"; coverage incomplete\" : \"\"}`);\n    }\n    return;\n  }\n\n  if (command === \"provision\") {\n    assertArgs(\n      parsed,\n      [\n        \"config\", \"dry-run\", \"rotate-keys\", \"rotate-o11y-token\", \"push-secrets\", \"write-credentials\",\n        \"write-dev-vars\", \"token\", \"open\", \"yes\",\n      ],\n      1,\n    );\n    const writeDevVars = parsed.options[\"write-dev-vars\"];\n    const opts: ProvisionOptions = {\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      dryRun: parsed.options[\"dry-run\"] === true,\n      rotateKeys: parsed.options[\"rotate-keys\"] === true,\n      rotateO11yToken: parsed.options[\"rotate-o11y-token\"] === true,\n      pushSecrets: parsed.options[\"push-secrets\"] === true,\n      writeCredentials: parsed.options[\"write-credentials\"] !== false,\n      writeDevVars: typeof writeDevVars === \"string\" ? writeDevVars : writeDevVars === true,\n      token: stringOpt(parsed.options.token),\n      open: parsed.options.open === false ? false : parsed.options.open === true ? true : undefined,\n      yes: parsed.options.yes === true,\n    };\n    await provision(opts);\n    return;\n  }\n\n  if (command === \"smoke\") {\n    assertArgs(parsed, [\"config\", \"env\"], 1);\n    await smoke({\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      env: stringOpt(parsed.options.env),\n    });\n    return;\n  }\n\n  if (command === \"setup\") {\n    assertArgs(parsed, [\"dir\", \"global\", \"force\", \"agent\", \"harness\"], 1);\n    // The agent front door: install the bundled skills so a coding agent picks\n    // up the `odla` skill and drives init/provision/build from here.\n    installSkill({\n      dir: stringOpt(parsed.options.dir),\n      global: parsed.options.global === true,\n      harnesses: harnessList(parsed),\n      force: parsed.options.force === true,\n    });\n    console.log(\n      \"\\nOffline runbooks installed. Open this repo in your coding agent and ask it to set up odla.\\n\" +\n        \"Its native adapter finds the local `odla` skill, chooses build or migration, and drives the CLI.\",\n    );\n    return;\n  }\n\n  if (command === \"skill\") {\n    const sub = parsed.positionals[1];\n    if (sub !== \"install\") throw new Error(`unknown skill subcommand \"${sub ?? \"\"}\". Try \"odla-ai skill install\".`);\n    assertArgs(parsed, [\"dir\", \"global\", \"force\", \"agent\", \"harness\"], 2);\n    installSkill({\n      dir: stringOpt(parsed.options.dir),\n      global: parsed.options.global === true,\n      harnesses: harnessList(parsed),\n      force: parsed.options.force === true,\n    });\n    return;\n  }\n\n  if (command === \"secrets\") {\n    const sub = parsed.positionals[1];\n    if (sub !== \"push\") throw new Error(`unknown secrets subcommand \"${sub ?? \"\"}\". Try \"odla-ai secrets push --env dev\".`);\n    assertArgs(parsed, [\"config\", \"env\", \"dry-run\", \"yes\"], 2);\n    await secretsPush({\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      env: requiredString(parsed.options.env, \"--env\"),\n      dryRun: parsed.options[\"dry-run\"] === true,\n      yes: parsed.options.yes === true,\n    });\n    return;\n  }\n\n  throw new Error(`unknown command \"${command}\". Run \"odla-ai help\".`);\n}\n\nfunction securityProfile(value: string | undefined): HostedSecurityProfile | undefined {\n  if (value === undefined) return undefined;\n  if (value === \"odla\" || value === \"cloudflare-app\" || value === \"generic\") return value;\n  throw new Error(\"--profile must be odla, cloudflare-app, or generic\");\n}\n\nfunction severityOpt(value: string, flag: string): Severity {\n  if ([\"informational\", \"low\", \"medium\", \"high\", \"critical\"].includes(value)) return value as Severity;\n  throw new Error(`${flag} must be informational, low, medium, high, or critical`);\n}\n\nfunction harnessList(parsed: ParsedArgv): AgentHarnessSelector[] {\n  const selected = [\n    ...harnessOption(parsed.options.agent, \"--agent\"),\n    ...harnessOption(parsed.options.harness, \"--harness\"),\n  ];\n  return (selected.length ? selected : [\"all\"]) as AgentHarnessSelector[];\n}\n\nfunction harnessOption(value: string | boolean | string[] | undefined, flag: string): string[] {\n  if (value === undefined) return [];\n  if (typeof value === \"boolean\") throw new Error(`${flag} requires a harness name`);\n  const raw = Array.isArray(value) ? value : [value];\n  const parts = raw.flatMap((item) => item.split(\",\"));\n  if (parts.some((item) => !item.trim())) throw new Error(`${flag} requires a harness name`);\n  return parts.map((item) => item.trim());\n}\n","import process from \"node:process\";\nimport { existsSync } from \"node:fs\";\nimport { requestToken } from \"@odla-ai/db\";\nimport { openUrl } from \"./open\";\nimport { handshakeUrl } from \"./token\";\nimport { ensureGitignore, readJsonFile, writePrivateJson } from \"./local\";\n\n/** Hosted platform purposes whose provider, model, and budgets an admin may route. */\nexport const SYSTEM_AI_PURPOSES = [\"o11y.triage\", \"security.discovery\", \"security.validation\"] as const;\n/** One catalog-validated, platform-funded System AI purpose. */\nexport type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];\n\n/** Inputs for one System AI read, policy update, credential-status read, or\n * write-only credential transfer. Provider values may come only from a named\n * environment variable or stdin. */\nexport interface AdminAiOptions {\n  action: \"show\" | \"set\" | \"credentials\" | \"credential-set\";\n  purpose?: string;\n  provider?: string;\n  model?: string;\n  enabled?: boolean;\n  maxInputBytes?: number;\n  maxOutputTokens?: number;\n  maxCallsPerRun?: number;\n  platform?: string;\n  token?: string;\n  json?: boolean;\n  open?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\">;\n  openApprovalUrl?: (url: string) => Promise<void>;\n  credentialProvider?: string;\n  fromEnv?: string;\n  stdin?: boolean;\n  readStdin?: () => Promise<string>;\n  /** Separate short-lived admin-token cache; never reuses the app developer-token file. */\n  tokenFile?: string;\n}\n\n/** Inputs for obtaining one short-lived, exact-scope platform device grant. */\nexport interface ScopedPlatformTokenOptions {\n  platform: string;\n  scope: \"platform:ai:read\" | \"platform:ai:write\" | \"platform:security:self\";\n  open?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\">;\n  openApprovalUrl?: (url: string) => Promise<void>;\n  tokenFile?: string;\n}\n\n/** Obtain/cache one exact platform scope without granting ambient admin. */\nexport async function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string> {\n  const fromEnv = process.env.ODLA_ADMIN_TOKEN;\n  if (fromEnv) return fromEnv;\n  return scopedToken(\n    options.platform.replace(/\\/$/, \"\"),\n    options.scope,\n    { action: \"show\", ...options },\n    options.fetch ?? fetch,\n    options.stdout ?? console,\n  );\n}\n\n/** Read or update platform-funded AI routing. Authentication is a short-lived,\n * explicitly scoped device grant; ordinary app developer tokens never become\n * platform admins. Credential writes accept values only from a named env var\n * or stdin, transfer them once, and never place them in argv, output, or the\n * scoped-token cache. */\nexport async function adminAi(options: AdminAiOptions): Promise<void> {\n  const platform = (options.platform ?? process.env.ODLA_PLATFORM ?? \"https://odla.ai\").replace(/\\/$/, \"\");\n  const doFetch = options.fetch ?? fetch;\n  const out = options.stdout ?? console;\n  const scope = options.action === \"set\" || options.action === \"credential-set\" ? \"platform:ai:write\" : \"platform:ai:read\";\n  const token = options.token ?? process.env.ODLA_ADMIN_TOKEN ?? (await scopedToken(platform, scope, options, doFetch, out));\n  const headers = { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" };\n\n  if (options.action === \"credentials\") {\n    const res = await doFetch(`${platform}/registry/platform/ai-credentials`, { headers });\n    const body = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(\"read platform AI credential status\", res.status, body));\n    const credentials = isRecord(body) && isRecord(body.credentials) ? body.credentials : body;\n    if (options.json) out.log(JSON.stringify({ credentials }, null, 2));\n    else for (const [provider, status] of Object.entries(isRecord(credentials) ? credentials : {})) {\n      out.log(`${provider}\\t${isRecord(status) && status.set === true ? \"set\" : \"not set\"}`);\n    }\n    return;\n  }\n\n  if (options.action === \"credential-set\") {\n    const provider = requireProvider(options.credentialProvider);\n    const value = await credentialValue(options);\n    const res = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {\n      method: \"PUT\",\n      headers,\n      body: JSON.stringify({ value }),\n    });\n    const body = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(`store ${provider} platform credential`, res.status, body));\n    out.log(`stored ${provider} platform credential (write-only; value was not returned)`);\n    return;\n  }\n\n  if (options.action === \"show\") {\n    const res = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });\n    const body = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(\"read platform AI policies\", res.status, body));\n    const policies = policyArray(body);\n    if (options.json) {\n      out.log(JSON.stringify({ policies }, null, 2));\n      return;\n    }\n    out.log(\"purpose\\tenabled\\tprovider\\tmodel\\tmax calls\\tmax input bytes\\tmax output tokens\");\n    for (const policy of policies) {\n      out.log([\n        policy.purpose,\n        String(policy.enabled),\n        policy.provider,\n        policy.model,\n        String(policy.maxCallsPerRun ?? \"\"),\n        String(policy.maxInputBytes ?? \"\"),\n        String(policy.maxOutputTokens ?? \"\"),\n      ].join(\"\\t\"));\n    }\n    return;\n  }\n\n  const purpose = requirePurpose(options.purpose);\n  if (!options.provider?.trim()) throw new Error(\"--provider is required\");\n  if (!options.model?.trim()) throw new Error(\"--model is required\");\n  const body = {\n    provider: options.provider.trim(),\n    model: options.model.trim(),\n    ...(options.enabled === undefined ? {} : { enabled: options.enabled }),\n    ...(options.maxInputBytes === undefined ? {} : { maxInputBytes: options.maxInputBytes }),\n    ...(options.maxOutputTokens === undefined ? {} : { maxOutputTokens: options.maxOutputTokens }),\n    ...(options.maxCallsPerRun === undefined ? {} : { maxCallsPerRun: options.maxCallsPerRun }),\n  };\n  const res = await doFetch(`${platform}/registry/platform/ai-policies/${encodeURIComponent(purpose)}`, {\n    method: \"PUT\",\n    headers,\n    body: JSON.stringify(body),\n  });\n  const response = await responseBody(res);\n  if (!res.ok) throw new Error(apiError(`update ${purpose}`, res.status, response));\n  const policy: Record<string, unknown> = isRecord(response) && isRecord(response.policy)\n    ? response.policy\n    : isRecord(response) ? response : {};\n  out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? body.provider)}/${String(policy.model ?? body.model)}`);\n}\n\nasync function scopedToken(\n  platform: string,\n  scope: string,\n  options: AdminAiOptions,\n  doFetch: typeof fetch,\n  out: Pick<typeof console, \"log\">,\n): Promise<string> {\n  const tokenFile = options.tokenFile ?? `${process.cwd()}/.odla/admin-token.local.json`;\n  const cache = readJsonFile<{ platform?: string; tokens?: Record<string, { token?: string; expiresAt?: number }> }>(tokenFile);\n  const cached = cache?.platform === platform ? cache.tokens?.[scope] : undefined;\n  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 60_000) {\n    out.log(`auth: using cached ${scope} grant (${tokenFile})`);\n    return cached.token;\n  }\n  const { token, expiresAt } = await requestToken({\n    endpoint: platform,\n    label: `odla CLI admin AI (${scope})`,\n    scopes: [scope],\n    fetch: doFetch,\n    onCode: async ({ userCode, expiresIn }) => {\n      const approvalUrl = handshakeUrl(platform, userCode);\n      out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);\n      const shouldOpen = options.open === true || (options.open !== false && !process.env.CI && Boolean(process.stdin.isTTY && process.stdout.isTTY));\n      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => undefined);\n    },\n  });\n  const tokens = cache?.platform === platform ? { ...(cache.tokens ?? {}) } : {};\n  tokens[scope] = { token, expiresAt };\n  if (existsSync(`${process.cwd()}/.git`)) ensureGitignore(process.cwd(), [tokenFile]);\n  writePrivateJson(tokenFile, { platform, tokens });\n  out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);\n  return token;\n}\n\nfunction requirePurpose(value: string | undefined): SystemAiPurpose {\n  if (!SYSTEM_AI_PURPOSES.includes(value as SystemAiPurpose)) {\n    throw new Error(`purpose must be one of: ${SYSTEM_AI_PURPOSES.join(\", \")}`);\n  }\n  return value as SystemAiPurpose;\n}\n\nfunction requireProvider(value: string | undefined): \"anthropic\" | \"openai\" | \"google\" {\n  if (value !== \"anthropic\" && value !== \"openai\" && value !== \"google\") {\n    throw new Error(\"provider must be one of: anthropic, openai, google\");\n  }\n  return value;\n}\n\nasync function credentialValue(options: AdminAiOptions): Promise<string> {\n  if (options.fromEnv && options.stdin) throw new Error(\"choose exactly one of --from-env or --stdin\");\n  let value: string | undefined;\n  if (options.fromEnv) value = process.env[options.fromEnv];\n  else if (options.stdin) value = await (options.readStdin ?? readStdin)();\n  else throw new Error(\"credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments\");\n  value = value?.replace(/[\\r\\n]+$/, \"\");\n  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : \"stdin credential is empty\");\n  if (new TextEncoder().encode(value).byteLength > 64 * 1024) throw new Error(\"credential exceeds 64 KiB\");\n  return value;\n}\n\nasync function readStdin(): Promise<string> {\n  let value = \"\";\n  for await (const chunk of process.stdin) {\n    value += String(chunk);\n    if (value.length > 64 * 1024) throw new Error(\"credential exceeds 64 KiB\");\n  }\n  return value;\n}\n\nfunction policyArray(body: unknown): Array<Record<string, unknown>> {\n  if (isRecord(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord);\n  if (isRecord(body) && isRecord(body.policies)) return Object.values(body.policies).filter(isRecord);\n  throw new Error(\"platform returned an invalid AI policy response\");\n}\n\nasync function responseBody(res: Response): Promise<unknown> {\n  const text = await res.text();\n  if (!text) return {};\n  try { return JSON.parse(text) as unknown; } catch { return { message: text.slice(0, 300) }; }\n}\n\nfunction apiError(action: string, status: number, body: unknown): string {\n  const error = isRecord(body) && isRecord(body.error) ? body.error : undefined;\n  const message = error && typeof error.message === \"string\" ? error.message : isRecord(body) && typeof body.message === \"string\" ? body.message : \"request failed\";\n  return `${action} failed (${status}): ${message}`;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n","import { spawn } from \"node:child_process\";\nimport process from \"node:process\";\n\nexport interface OpenUrlOptions {\n  platform?: NodeJS.Platform;\n  spawnImpl?: typeof spawn;\n}\n\nexport async function openUrl(url: string, options: OpenUrlOptions = {}): Promise<void> {\n  const command = openerFor(options.platform ?? process.platform);\n  const doSpawn = options.spawnImpl ?? spawn;\n  await new Promise<void>((resolve, reject) => {\n    const child = doSpawn(command.cmd, [...command.args, url], {\n      stdio: \"ignore\",\n      detached: true,\n    });\n    child.once(\"error\", reject);\n    child.once(\"spawn\", () => {\n      child.unref();\n      resolve();\n    });\n  });\n}\n\nexport function openerFor(platform: NodeJS.Platform): { cmd: string; args: string[] } {\n  if (platform === \"darwin\") return { cmd: \"open\", args: [] };\n  if (platform === \"win32\") return { cmd: \"cmd\", args: [\"/c\", \"start\", \"\"] };\n  return { cmd: \"xdg-open\", args: [] };\n}\n","import { requestToken } from \"@odla-ai/db\";\nimport process from \"node:process\";\nimport type { LoadedProjectConfig, ProvisionOptions } from \"./types\";\nimport { openUrl } from \"./open\";\nimport { displayPath, readJsonFile, writePrivateJson } from \"./local\";\n\ntype FetchLike = typeof fetch;\n\nexport async function getDeveloperToken(\n  cfg: LoadedProjectConfig,\n  options: ProvisionOptions,\n  doFetch: FetchLike,\n  out: Pick<typeof console, \"log\" | \"error\">,\n): Promise<string> {\n  if (options.token) return options.token;\n  if (process.env.ODLA_DEV_TOKEN) return process.env.ODLA_DEV_TOKEN;\n\n  const cached = readJsonFile<{ token?: string; expiresAt?: number }>(cfg.local.tokenFile);\n  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 60_000) {\n    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);\n    return cached.token;\n  }\n\n  const browser = approvalBrowser(options);\n  const { token, expiresAt } = await requestToken({\n    endpoint: cfg.platformUrl,\n    label: `${cfg.app.id} provisioner`,\n    fetch: doFetch,\n    onCode: async ({ userCode, expiresIn }) => {\n      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);\n      out.log(\"\");\n      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);\n      if (browser.open) {\n        try {\n          await (options.openApprovalUrl ?? openUrl)(approvalUrl);\n          out.log(`auth: opened browser for approval${browser.mode === \"auto\" ? \" (auto)\" : \"\"}`);\n        } catch (err) {\n          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);\n        }\n      } else if (browser.reason) {\n        out.log(`auth: browser launch skipped (${browser.reason})`);\n      }\n      out.log(\"\");\n    },\n  });\n  writePrivateJson(cfg.local.tokenFile, { token, expiresAt });\n  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);\n  return token;\n}\n\nexport function approvalBrowser(options: ProvisionOptions): { open: boolean; mode?: \"auto\" | \"forced\"; reason?: string } {\n  if (options.open === true) return { open: true, mode: \"forced\" };\n  if (options.open === false) return { open: false, reason: \"disabled by --no-open\" };\n  if (process.env.CI) return { open: false, reason: \"CI environment\" };\n\n  const interactive = options.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);\n  if (!interactive) return { open: false, reason: \"non-interactive shell; pass --open to force\" };\n  return { open: true, mode: \"auto\" };\n}\n\nexport function handshakeUrl(platformUrl: string, userCode: string): string {\n  const url = new URL(\"/studio\", platformUrl);\n  url.searchParams.set(\"code\", userCode);\n  return url.toString();\n}\n","import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport type { LoadedProjectConfig, LocalCredentials } from \"./types\";\n\nconst GITIGNORE_LINES = [\".odla/*.local.json\", \".odla/dev-token.json\", \".dev.vars\"];\n\nexport function readJsonFile<T>(path: string): T | null {\n  try {\n    return JSON.parse(readFileSync(path, \"utf8\")) as T;\n  } catch {\n    return null;\n  }\n}\n\nexport function writePrivateJson(path: string, value: unknown): void {\n  writePrivateText(path, `${JSON.stringify(value, null, 2)}\\n`);\n}\n\nexport function readCredentials(path: string): LocalCredentials | null {\n  if (!existsSync(path)) return null;\n  let value: unknown;\n  try {\n    value = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);\n  }\n  if (!value || typeof value !== \"object\" || typeof (value as LocalCredentials).appId !== \"string\" ||\n      !(value as LocalCredentials).envs || typeof (value as LocalCredentials).envs !== \"object\") {\n    throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);\n  }\n  return value as LocalCredentials;\n}\n\nexport function mergeCredential(\n  current: LocalCredentials | null,\n  update: { appId: string; platformUrl: string; dbEndpoint: string; env: string; tenantId: string; dbKey?: string; o11yToken?: string },\n): LocalCredentials {\n  const next: LocalCredentials = current ?? {\n    appId: update.appId,\n    platformUrl: update.platformUrl,\n    dbEndpoint: update.dbEndpoint,\n    updatedAt: new Date(0).toISOString(),\n    envs: {},\n  };\n  next.appId = update.appId;\n  next.platformUrl = update.platformUrl;\n  next.dbEndpoint = update.dbEndpoint;\n  next.updatedAt = new Date().toISOString();\n  next.envs[update.env] = {\n    ...(next.envs[update.env] ?? {}),\n    tenantId: update.tenantId,\n    ...(update.dbKey ? { dbKey: update.dbKey } : {}),\n    ...(update.o11yToken ? { o11yToken: update.o11yToken } : {}),\n  };\n  return next;\n}\n\nexport function ensureGitignore(rootDir: string, localPaths: string[] = []): void {\n  const path = resolve(rootDir, \".gitignore\");\n  const existing = existsSync(path) ? readFileSync(path, \"utf8\") : \"\";\n  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line): line is string => !!line);\n  const wanted = [...new Set([...GITIGNORE_LINES, ...configured])];\n  const missing = wanted.filter((line) => !existing.split(/\\r?\\n/).includes(line));\n  if (missing.length === 0) return;\n  const prefix = existing && !existing.endsWith(\"\\n\") ? \"\\n\" : \"\";\n  writeFileSync(path, `${existing}${prefix}${missing.join(\"\\n\")}\\n`);\n}\n\nexport interface O11yDevVars {\n  endpoint: string;\n  service: string;\n  version?: string;\n}\n\nexport function o11yDevVars(cfg: LoadedProjectConfig): O11yDevVars | undefined {\n  if (!cfg.services.includes(\"o11y\")) return undefined;\n  return {\n    endpoint: cfg.o11y?.endpoint ?? \"https://o11y.odla.ai\",\n    service: cfg.o11y?.service ?? cfg.app.id,\n    ...(cfg.o11y?.version ? { version: cfg.o11y.version } : {}),\n  };\n}\n\nexport function resolveWriteDevVarsTarget(cfg: LoadedProjectConfig, requested: string | boolean | undefined): string | null {\n  if (!requested) return null;\n  if (requested === true) return cfg.local.devVarsFile;\n  return resolve(dirname(cfg.configPath), requested);\n}\n\nexport function writeDevVars(path: string, credentials: LocalCredentials, env: string, o11y?: O11yDevVars): void {\n  const entry = credentials.envs[env];\n  if (!entry) throw new Error(`no credentials for env \"${env}\" in ${path}`);\n  const lines = [`ODLA_PLATFORM=\"${credentials.platformUrl}\"`];\n  if (entry.dbKey) lines.push(`ODLA_ENDPOINT=\"${credentials.dbEndpoint}\"`);\n  lines.push(`ODLA_APP_ID=\"${credentials.appId}\"`, `ODLA_ENV=\"${env}\"`, `ODLA_TENANT=\"${entry.tenantId}\"`);\n  if (entry.dbKey) lines.push(`ODLA_API_KEY=\"${entry.dbKey}\"`);\n  if (o11y) {\n    lines.push(`ODLA_O11Y_ENDPOINT=\"${o11y.endpoint}\"`, `ODLA_O11Y_SERVICE=\"${o11y.service}\"`);\n    if (o11y.version) lines.push(`ODLA_O11Y_VERSION=\"${o11y.version}\"`);\n    // The ingest token is a secret; .dev.vars is gitignored (holds ODLA_API_KEY too).\n    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN=\"${entry.o11yToken}\"`);\n  }\n  const existing = existsSync(path) ? readFileSync(path, \"utf8\") : \"\";\n  const retained = existing.split(/\\r?\\n/).filter((line) => !isManagedDevVar(line));\n  while (retained.at(-1) === \"\") retained.pop();\n  const prefix = retained.length ? `${retained.join(\"\\n\")}\\n\\n` : \"\";\n  writePrivateText(path, `${prefix}${lines.join(\"\\n\")}\\n`);\n}\n\nconst MANAGED_DEV_VARS = new Set([\n  \"ODLA_PLATFORM\", \"ODLA_ENDPOINT\", \"ODLA_APP_ID\", \"ODLA_ENV\", \"ODLA_TENANT\", \"ODLA_API_KEY\",\n  \"ODLA_O11Y_ENDPOINT\", \"ODLA_O11Y_SERVICE\", \"ODLA_O11Y_VERSION\", \"ODLA_O11Y_TOKEN\",\n]);\n\nfunction isManagedDevVar(line: string): boolean {\n  const match = line.match(/^\\s*(?:export\\s+)?([A-Z][A-Z0-9_]*)\\s*=/);\n  return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);\n}\n\nfunction writePrivateText(path: string, text: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;\n  writeFileSync(temporary, text, { mode: 0o600 });\n  chmodSync(temporary, 0o600);\n  renameSync(temporary, path);\n}\n\nexport function gitignoreEntry(rootDir: string, path: string): string | null {\n  const rel = relative(resolve(rootDir), resolve(path));\n  if (!rel || rel === \"..\" || rel.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) || isAbsolute(rel)) return null;\n  return rel.replaceAll(\"\\\\\", \"/\");\n}\n\nexport function displayPath(path: string, rootDir = process.cwd()): string {\n  const rel = relative(rootDir, path);\n  return rel && !rel.startsWith(\"..\") ? rel : path;\n}\n","export type OptionValue = string | boolean | string[];\n\nexport interface ParsedArgv {\n  positionals: string[];\n  options: Record<string, OptionValue>;\n}\n\n/** Parse the small, dependency-free option grammar shared by every CLI command. */\nexport function parseArgv(argv: string[]): ParsedArgv {\n  const positionals: string[] = [];\n  const options: Record<string, OptionValue> = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i]!;\n    if (!arg.startsWith(\"--\")) {\n      positionals.push(arg);\n      continue;\n    }\n    const eq = arg.indexOf(\"=\");\n    const rawName = arg.slice(2, eq === -1 ? undefined : eq);\n    if (!rawName) continue;\n    if (rawName.startsWith(\"no-\")) {\n      options[rawName.slice(3)] = false;\n      continue;\n    }\n    if (eq !== -1) {\n      addOption(options, rawName, arg.slice(eq + 1));\n      continue;\n    }\n    const value = argv[i + 1];\n    if (value !== undefined && !value.startsWith(\"--\")) {\n      i++;\n      addOption(options, rawName, value);\n    } else {\n      addOption(options, rawName, true);\n    }\n  }\n  return { positionals, options };\n}\n\nexport function assertArgs(parsed: ParsedArgv, allowedOptions: string[], maxPositionals: number): void {\n  const allowed = new Set(allowedOptions);\n  for (const name of Object.keys(parsed.options)) {\n    if (!allowed.has(name)) throw new Error(`unknown option \"--${name}\"; run \"odla-ai help\" for supported options`);\n  }\n  if (parsed.positionals.length > maxPositionals) {\n    throw new Error(`unexpected argument \"${parsed.positionals[maxPositionals]}\"; run \"odla-ai help\"`);\n  }\n}\n\nexport function requiredString(value: OptionValue | undefined, name: string): string {\n  const result = stringOpt(value);\n  if (!result) throw new Error(`${name} is required`);\n  return result;\n}\n\nexport function stringOpt(value: OptionValue | undefined): string | undefined {\n  if (typeof value === \"string\") return value;\n  if (Array.isArray(value)) return value[value.length - 1];\n  return undefined;\n}\n\nexport function listOpt(value: OptionValue | undefined): string[] | undefined {\n  if (value === undefined || typeof value === \"boolean\") return undefined;\n  const values = Array.isArray(value) ? value : [value];\n  return values.flatMap((item) => item.split(\",\")).map((item) => item.trim()).filter(Boolean);\n}\n\nexport function boolOpt(value: OptionValue | undefined): boolean | undefined {\n  if (typeof value === \"boolean\") return value;\n  if (typeof value === \"string\" && (value === \"true\" || value === \"false\")) return value === \"true\";\n  if (value === undefined) return undefined;\n  throw new Error(\"boolean option must be true or false\");\n}\n\nexport function numberOpt(value: OptionValue | undefined, flag: string): number | undefined {\n  if (value === undefined) return undefined;\n  const raw = stringOpt(value);\n  const parsed = raw === undefined ? Number.NaN : Number(raw);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${flag} requires a positive integer`);\n  return parsed;\n}\n\nfunction addOption(options: Record<string, OptionValue>, name: string, value: string | boolean): void {\n  const current = options[name];\n  if (current === undefined) options[name] = value;\n  else if (Array.isArray(current)) current.push(String(value));\n  else options[name] = [String(current), String(value)];\n}\n","/** Stable, machine-readable division of work between the CLI, coding agent,\n * human operator, and Studio. Printed by `odla-ai capabilities --json`. */\nexport const CAPABILITIES = {\n  cli: [\n    \"register the app and enable configured services per environment\",\n    \"issue, persist, and explicitly rotate configured service credentials\",\n    \"write local Worker values and push deployed Worker secrets through Wrangler stdin\",\n    \"push db schema/rules and configure platform AI, auth, and deployment links\",\n    \"validate config offline and smoke-test a provisioned db environment\",\n    \"run app-attributed hosted security discovery and independent validation without provider keys\",\n    \"let admins manage system AI routes/credentials through short-lived exact-scope approval\",\n  ],\n  agent: [\n    \"install and import the selected odla SDKs\",\n    \"wrap the Worker with withObservability and choose useful telemetry\",\n    \"make application-specific schema, rules, auth, UI, and migration decisions\",\n  ],\n  human: [\n    \"approve the odla device code and one-off third-party logins\",\n    \"consent to production changes with --yes\",\n    \"request destructive credential rotation explicitly\",\n    \"review application semantics, security findings, releases, and merges\",\n    \"approve redacted-source disclosure before hosted security reasoning\",\n  ],\n  studio: [\n    \"view telemetry and environment state\",\n    \"perform manual credential recovery when the CLI's local shown-once copy is unavailable\",\n    \"configure system AI purposes and view app/environment/run-attributed usage\",\n  ],\n} as const;\n\ntype Output = Pick<typeof console, \"log\">;\n\n/** Print the stable responsibility boundary for humans or agent tooling. */\nexport function printCapabilities(json = false, out: Output = console): void {\n  if (json) {\n    out.log(JSON.stringify(CAPABILITIES, null, 2));\n    return;\n  }\n  out.log(\"odla-ai responsibility boundary\\n\");\n  printGroup(out, \"CLI automates\", CAPABILITIES.cli);\n  printGroup(out, \"Coding agent changes source\", CAPABILITIES.agent);\n  printGroup(out, \"Human checkpoints\", CAPABILITIES.human);\n  printGroup(out, \"Studio\", CAPABILITIES.studio);\n}\n\nfunction printGroup(out: Output, heading: string, items: readonly string[]): void {\n  out.log(`${heading}:`);\n  for (const item of items) out.log(`  - ${item}`);\n  out.log(\"\");\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport type { AppRules, LoadedProjectConfig, OdlaProjectConfig, ProvisionPlan } from \"./types\";\n\nconst DEFAULT_PLATFORM = \"https://odla.ai\";\n// Safe-by-default: production must be opted into explicitly in odla.config.\nconst DEFAULT_ENVS = [\"dev\"];\nconst DEFAULT_SERVICES = [\"db\", \"ai\"];\n\nexport async function loadProjectConfig(configPath = \"odla.config.mjs\"): Promise<LoadedProjectConfig> {\n  const resolved = resolve(configPath);\n  if (!existsSync(resolved)) {\n    throw new Error(`config not found: ${configPath}. Run \"odla-ai init\" first or pass --config.`);\n  }\n\n  const raw = await loadConfigModule(resolved);\n  const rootDir = dirname(resolved);\n  validateRawConfig(raw, resolved);\n\n  const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);\n  const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);\n  const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);\n  const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);\n  const local = {\n    tokenFile: resolve(rootDir, raw.local?.tokenFile ?? \".odla/dev-token.json\"),\n    credentialsFile: resolve(rootDir, raw.local?.credentialsFile ?? \".odla/credentials.local.json\"),\n    devVarsFile: resolve(rootDir, raw.local?.devVarsFile ?? \".dev.vars\"),\n    gitignore: raw.local?.gitignore ?? true,\n  };\n\n  return {\n    ...raw,\n    configPath: resolved,\n    rootDir,\n    platformUrl,\n    dbEndpoint,\n    envs,\n    services,\n    local,\n  };\n}\n\nexport async function resolveDataExport<T>(\n  cfg: LoadedProjectConfig,\n  value: unknown,\n  names: string[],\n): Promise<T | undefined> {\n  if (value === undefined || value === null || value === false) return undefined;\n  if (typeof value !== \"string\") return value as T;\n\n  const target = isAbsolute(value) ? value : resolve(cfg.rootDir, value);\n  if (target.endsWith(\".json\")) {\n    return JSON.parse(readFileSync(target, \"utf8\")) as T;\n  }\n  const mod = (await import(pathToFileURL(target).href)) as Record<string, unknown>;\n  for (const name of names) {\n    if (mod[name] !== undefined) return mod[name] as T;\n  }\n  if (mod.default !== undefined) return mod.default as T;\n  throw new Error(`${value} did not export ${names.join(\", \")} or default`);\n}\n\nexport function buildPlan(cfg: LoadedProjectConfig): ProvisionPlan {\n  return {\n    appId: cfg.app.id,\n    appName: cfg.app.name,\n    platformUrl: cfg.platformUrl,\n    dbEndpoint: cfg.dbEndpoint,\n    envs: cfg.envs,\n    services: cfg.services,\n    hasSchema: !!cfg.db?.schema,\n    hasRules: !!cfg.db?.rules || (!!cfg.db?.schema && cfg.db.defaultRules !== false),\n    aiProvider: cfg.ai?.provider,\n  };\n}\n\nexport function rulesFromSchema(schema: unknown): AppRules {\n  const entities = serializedEntities(schema);\n  return Object.fromEntries(\n    entities.map((name) => [name, { view: \"false\", create: \"false\", update: \"false\", delete: \"false\" }]),\n  );\n}\n\nexport function serializedEntities(schema: unknown): string[] {\n  if (!schema || typeof schema !== \"object\") return [];\n  const entities = (schema as { entities?: unknown }).entities;\n  if (!entities || typeof entities !== \"object\" || Array.isArray(entities)) return [];\n  return Object.keys(entities);\n}\n\nexport function envValue(value: string | undefined): string | undefined {\n  if (!value) return undefined;\n  if (value.startsWith(\"$\")) return process.env[value.slice(1)];\n  return value;\n}\n\nfunction validateRawConfig(raw: unknown, path: string): asserts raw is OdlaProjectConfig {\n  if (!raw || typeof raw !== \"object\") throw new Error(`${path} must export an object`);\n  const cfg = raw as OdlaProjectConfig;\n  if (!cfg.app || typeof cfg.app !== \"object\") throw new Error(`${path}: missing app object`);\n  if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);\n  if (!cfg.app.name || typeof cfg.app.name !== \"string\") throw new Error(`${path}: app.name is required`);\n  if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);\n}\n\nfunction validId(value: unknown): value is string {\n  return typeof value === \"string\" && /^[a-z0-9][a-z0-9-]*$/.test(value);\n}\n\nasync function loadConfigModule(path: string): Promise<OdlaProjectConfig> {\n  if (path.endsWith(\".json\")) return JSON.parse(readFileSync(path, \"utf8\")) as OdlaProjectConfig;\n  const mod = (await import(`${pathToFileURL(path).href}?t=${Date.now()}`)) as {\n    default?: OdlaProjectConfig | (() => OdlaProjectConfig | Promise<OdlaProjectConfig>);\n    config?: OdlaProjectConfig;\n  };\n  const value = mod.default ?? mod.config;\n  if (typeof value === \"function\") return await value();\n  return value as OdlaProjectConfig;\n}\n\nfunction trimSlash(value: string): string {\n  return value.replace(/\\/+$/, \"\");\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values.filter(Boolean))];\n}\n","import { execFileSync } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { looksSecret } from \"./redact\";\nimport { gitignoreEntry } from \"./local\";\nimport { findWranglerConfig, readWranglerConfig } from \"./wrangler\";\nimport type { AppRules } from \"./types\";\n\n/**\n * Rules lint: a literal \"true\" grants the action to every client. `view` may\n * be deliberate for public content — allowlist those namespaces via\n * `db.publicRead`; writes are never safely \"true\".\n */\nexport function lintRules(rules: AppRules | undefined, entities: string[], publicRead: string[]): string[] {\n  const warnings: string[] = [];\n  if (!rules) return warnings;\n  for (const [ns, actions] of Object.entries(rules)) {\n    for (const [action, expr] of Object.entries(actions)) {\n      if (typeof expr !== \"string\" || expr.trim() !== \"true\") continue;\n      if (action === \"view\" && publicRead.includes(ns)) continue;\n      warnings.push(\n        action === \"view\"\n          ? `rules.${ns}.view is \"true\" — public read; add \"${ns}\" to db.publicRead if intended`\n          : `rules.${ns}.${action} is \"true\" — any client can ${action} ${ns} rows`,\n      );\n    }\n  }\n  for (const entity of entities) {\n    if (!(entity in rules)) warnings.push(`schema entity \"${entity}\" has no rules entry (all client access denied)`);\n  }\n  return warnings;\n}\n\nexport type ExecLike = (cmd: string, args: string[], cwd: string) => string;\n\nconst defaultExec: ExecLike = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"ignore\"] });\n\n/** Credential files that must never be committed. Silent when git is absent. */\nexport function trackedSecretFiles(rootDir: string, exec: ExecLike = defaultExec, localPaths: string[] = []): string[] {\n  let output: string;\n  try {\n    const custom = localPaths\n      .map((path) => gitignoreEntry(rootDir, path))\n      .filter((path): path is string => !!path);\n    output = exec(\"git\", [\"ls-files\", \"--\", \".dev.vars\", \".odla\", ...custom], rootDir);\n  } catch {\n    return [];\n  }\n  return output\n    .split(/\\r?\\n/)\n    .filter(Boolean)\n    .map((path) => `${path} is tracked by git — run \"git rm --cached ${path}\" and commit; it belongs in .gitignore`);\n}\n\n/** Wrangler config sanity: the assets-dir footgun, secret-looking vars. */\nexport function wranglerWarnings(rootDir: string): string[] {\n  const configPath = findWranglerConfig(rootDir);\n  if (!configPath) return [];\n  const config = readWranglerConfig(configPath);\n  if (!config) return [];\n\n  const warnings: string[] = [];\n  const blocks: Array<{ label: string; block: Record<string, unknown> }> = [{ label: \"\", block: config }];\n  const envs = config.env;\n  if (envs && typeof envs === \"object\") {\n    for (const [name, block] of Object.entries(envs as Record<string, unknown>)) {\n      if (block && typeof block === \"object\") blocks.push({ label: `env.${name}.`, block: block as Record<string, unknown> });\n    }\n  }\n\n  for (const { label, block } of blocks) {\n    const assets = block.assets as { directory?: string } | undefined;\n    if (assets?.directory) {\n      const dir = resolve(rootDir, assets.directory);\n      if (dir === resolve(rootDir)) {\n        warnings.push(`${label}assets.directory is the project root — point it at a dedicated build dir (wrangler dev fails with \"spawn EBADF\")`);\n      } else if (existsSync(join(dir, \"node_modules\"))) {\n        warnings.push(`${label}assets.directory contains node_modules — wrangler dev's watcher will exhaust file descriptors`);\n      }\n    }\n    const vars = block.vars;\n    if (vars && typeof vars === \"object\") {\n      for (const [name, value] of Object.entries(vars as Record<string, unknown>)) {\n        if (name === \"ODLA_API_KEY\" || name === \"ODLA_O11Y_TOKEN\" || (typeof value === \"string\" && looksSecret(value))) {\n          warnings.push(`wrangler ${label}vars.${name} looks like a secret — use \"odla-ai secrets push\" / wrangler secret put, never vars`);\n        }\n      }\n    }\n  }\n\n  const pkg = readPackageJson(rootDir);\n  if (pkg && typeof pkg.scripts === \"object\" && pkg.scripts && \"deploy\" in (pkg.scripts as Record<string, unknown>)) {\n    warnings.push(`package.json has a script named \"deploy\" — CI may auto-deploy it; rename to deploy:app`);\n  }\n  return warnings;\n}\n\n/** Offline checks for the source/config work that provisioning cannot infer\n * safely. The CLI owns control-plane enablement and secret delivery; these\n * warnings keep the remaining application edits visible instead of letting a\n * successfully provisioned but uninstrumented Worker look complete. */\nexport function o11yProjectWarnings(rootDir: string): string[] {\n  const warnings: string[] = [];\n  const pkg = readPackageJson(rootDir);\n  const dependencies = pkg?.dependencies as Record<string, unknown> | undefined;\n  const devDependencies = pkg?.devDependencies as Record<string, unknown> | undefined;\n  if (!dependencies?.[\"@odla-ai/o11y\"]) {\n    warnings.push(\n      devDependencies?.[\"@odla-ai/o11y\"]\n        ? \"@odla-ai/o11y is a devDependency — move it to dependencies so the Worker can import it\"\n        : 'Worker instrumentation is missing @odla-ai/o11y — install it and wrap the handler with \"withObservability\"',\n    );\n  }\n\n  const configPath = findWranglerConfig(rootDir);\n  const config = configPath ? readWranglerConfig(configPath) : null;\n  if (!configPath || !config) {\n    warnings.push(\"cannot verify o11y Worker instrumentation — add a parseable wrangler.jsonc/json config\");\n    return warnings;\n  }\n\n  const main = typeof config.main === \"string\" ? resolve(rootDir, config.main) : null;\n  if (!main || !existsSync(main)) {\n    warnings.push(\"cannot verify o11y Worker instrumentation — wrangler main is missing or unreadable\");\n  } else {\n    let source = \"\";\n    try {\n      source = readFileSync(main, \"utf8\");\n    } catch {\n      // The warning below is intentionally the same for an unreadable source.\n    }\n    if (!/\\bwithObservability\\b/.test(source)) {\n      warnings.push(`wrangler entrypoint ${config.main as string} does not reference withObservability`);\n    }\n  }\n\n  const flags = Array.isArray(config.compatibility_flags) ? config.compatibility_flags : [];\n  if (!flags.includes(\"nodejs_compat\")) {\n    warnings.push('wrangler compatibility_flags is missing \"nodejs_compat\" required by @odla-ai/o11y');\n  }\n  return warnings;\n}\n\nfunction readPackageJson(rootDir: string): Record<string, unknown> | null {\n  try {\n    return JSON.parse(readFileSync(join(rootDir, \"package.json\"), \"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n","/**\n * Secret redaction shared by every command's output path and by doctor's\n * \"does this value look like a secret\" checks. Clerk publishable keys\n * (pk_test_/pk_live_) are public by design and are deliberately not matched.\n */\nconst REPLACEMENTS: Array<[RegExp, string]> = [\n  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, \"odla_$1_[redacted]\"],\n  [/\\bsk_(live|test)_[A-Za-z0-9]+/g, \"sk_$1_[redacted]\"],\n  [/\\bsk-[A-Za-z0-9._-]+/g, \"sk-[redacted]\"],\n  [/\\bwhsec_[A-Za-z0-9+/=]+/g, \"whsec_[redacted]\"],\n  [/\\bo11y_[A-Za-z0-9]+/g, \"o11y_[redacted]\"],\n  [/\\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, \"$1_[redacted]\"],\n  [/\\bAKIA[A-Z0-9]{12,}/g, \"AKIA[redacted]\"],\n];\n\n/**\n * Return `value` with every secret-shaped substring replaced by a `[redacted]`\n * placeholder that keeps the identifying prefix (e.g. `sk_live_[redacted]`).\n * Matches odla db keys (`odla_sk_`/`odla_dev_`), Clerk secret keys\n * (`sk_live_`/`sk_test_`), OpenAI keys (`sk-`), webhook signing secrets\n * (`whsec_`), o11y tokens (`o11y_`), GitHub tokens (`ghp_`/`gho_`/`github_pat_`),\n * and AWS access-key ids (`AKIA…`). Clerk publishable keys (`pk_test_`/\n * `pk_live_`) are public by design and intentionally left untouched. Used to\n * sanitize anything the CLI echoes (notably network error bodies) before it\n * reaches stdout/stderr. Non-matching input is returned unchanged.\n */\nexport function redactSecrets(value: string): string {\n  let result = value;\n  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);\n  return result;\n}\n\n/** True when a value matches any known secret shape (used for detection, never display). */\nexport function looksSecret(value: string): boolean {\n  return redactSecrets(value) !== value || value.includes(\"-----BEGIN\");\n}\n","import { spawn } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nexport interface RunResult {\n  code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/** Subprocess seam: injectable in tests, `defaultRunner` in production. */\nexport type CommandRunner = (cmd: string, args: string[], opts?: { input?: string; cwd?: string }) => Promise<RunResult>;\n\nexport const defaultRunner: CommandRunner = (cmd, args, opts) =>\n  new Promise((resolvePromise, reject) => {\n    const child = spawn(cmd, args, { cwd: opts?.cwd, stdio: [\"pipe\", \"pipe\", \"pipe\"] });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout.on(\"data\", (chunk: Buffer) => (stdout += chunk.toString()));\n    child.stderr.on(\"data\", (chunk: Buffer) => (stderr += chunk.toString()));\n    child.on(\"error\", reject);\n    child.on(\"close\", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));\n    child.stdin.end(opts?.input ?? \"\");\n  });\n\nconst WRANGLER_CONFIG_FILES = [\"wrangler.jsonc\", \"wrangler.json\", \"wrangler.toml\"];\n\nexport function findWranglerConfig(rootDir: string): string | null {\n  for (const name of WRANGLER_CONFIG_FILES) {\n    const path = join(rootDir, name);\n    if (existsSync(path)) return path;\n  }\n  return null;\n}\n\n/** Parses wrangler.json/jsonc. Returns null for .toml (unparsed) or invalid JSON. */\nexport function readWranglerConfig(path: string): Record<string, unknown> | null {\n  if (path.endsWith(\".toml\")) return null;\n  try {\n    return JSON.parse(stripJsonComments(readFileSync(path, \"utf8\"))) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n/** Removes // and both-slash block comments without touching string contents. */\nexport function stripJsonComments(text: string): string {\n  let result = \"\";\n  let inString = false;\n  for (let i = 0; i < text.length; i++) {\n    const ch = text[i]!;\n    if (inString) {\n      result += ch;\n      if (ch === \"\\\\\") {\n        result += text[i + 1] ?? \"\";\n        i++;\n      } else if (ch === '\"') {\n        inString = false;\n      }\n      continue;\n    }\n    if (ch === '\"') {\n      inString = true;\n      result += ch;\n      continue;\n    }\n    if (ch === \"/\" && text[i + 1] === \"/\") {\n      while (i < text.length && text[i] !== \"\\n\") i++;\n      result += \"\\n\";\n      continue;\n    }\n    if (ch === \"/\" && text[i + 1] === \"*\") {\n      i += 2;\n      while (i < text.length && !(text[i] === \"*\" && text[i + 1] === \"/\")) i++;\n      i++;\n      continue;\n    }\n    result += ch;\n  }\n  return result;\n}\n\nexport async function wranglerLoggedIn(run: CommandRunner, cwd: string): Promise<boolean> {\n  try {\n    const result = await run(\"npx\", [\"wrangler\", \"whoami\"], { cwd });\n    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);\n  } catch {\n    return false;\n  }\n}\n\n/** Pipes the value via stdin — it never appears on argv or in process listings. */\nexport function wranglerPutSecret(\n  run: CommandRunner,\n  opts: { name: string; value: string; env?: string; cwd: string },\n): Promise<RunResult> {\n  const args = [\"wrangler\", \"secret\", \"put\", opts.name, ...(opts.env ? [\"--env\", opts.env] : [])];\n  return run(\"npx\", args, { input: opts.value, cwd: opts.cwd });\n}\n","import { buildPlan, loadProjectConfig, resolveDataExport, rulesFromSchema, serializedEntities } from \"./config\";\nimport { lintRules, o11yProjectWarnings, trackedSecretFiles, wranglerWarnings } from \"./doctor-checks\";\nimport { readCredentials } from \"./local\";\nimport type { AppRules } from \"./types\";\n\nexport interface DoctorOptions {\n  configPath: string;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/**\n * Validate and summarize an odla project config entirely offline — no network\n * calls and no file writes. Loads `configPath`, builds the provision plan, and\n * resolves the schema and rules (synthesizing deny-all rules from the schema\n * when `db.rules` is omitted and `db.defaultRules` isn't `false`), then prints a\n * summary line for the app, envs, services, schema entity count, rules namespace\n * count, and AI provider.\n *\n * It then collects warnings for the mistakes provision can't fix silently: a\n * schema with no entities, a rules namespace with no matching entity, the `ai`\n * service enabled without an `ai.provider`, `auth.clerk` entries that reference\n * an unset env var (`$FOO`), an `ai.keyEnv` that isn't set (provider key upload\n * will be skipped), and — when `o11y` is enabled — any env whose local\n * credentials lack an ingest token. It also folds in the shared rule linter,\n * git-tracked secret-shaped files, and wrangler config warnings. Prints `ok`\n * when clean, otherwise the warning list. Purely advisory: never throws on\n * warnings and never mutates anything.\n *\n * @param options.configPath Path to the `odla.config.mjs` to inspect.\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport async function doctor(options: DoctorOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const plan = buildPlan(cfg);\n  const hasDb = cfg.services.includes(\"db\");\n  const schema = hasDb ? await resolveDataExport<unknown>(cfg, cfg.db?.schema, [\"schema\", \"SCHEMA\"]) : undefined;\n  const configuredRules = hasDb\n    ? await resolveDataExport<AppRules>(cfg, cfg.db?.rules, [\"rules\", \"RULES\"])\n    : undefined;\n  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : undefined);\n  const entities = serializedEntities(schema);\n\n  out.log(`config: ${cfg.configPath}`);\n  out.log(`app:    ${plan.appName} (${plan.appId})`);\n  out.log(`envs:   ${plan.envs.join(\", \")}`);\n  out.log(`svc:    ${plan.services.join(\", \")}`);\n  out.log(`schema: ${schema ? `${entities.length} entities` : \"none\"}`);\n  out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : \"none\"}`);\n  out.log(`ai:     ${cfg.services.includes(\"ai\") ? (cfg.ai?.provider ?? \"not configured\") : \"not enabled\"}`);\n\n  const warnings: string[] = [];\n  if (schema && entities.length === 0) warnings.push(\"schema has no entities\");\n  if (rules) {\n    for (const ns of Object.keys(rules)) {\n      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include \"${ns}\" but schema has no matching entity`);\n    }\n  }\n  if (cfg.services.includes(\"ai\") && !cfg.ai?.provider) warnings.push(\"ai service is enabled but ai.provider is not set\");\n  if (cfg.auth?.clerk) {\n    for (const [env, value] of Object.entries(cfg.auth.clerk)) {\n      if (typeof value === \"string\" && value.startsWith(\"$\") && !process.env[value.slice(1)]) {\n        warnings.push(`auth.clerk.${env} references unset env var ${value}`);\n      }\n    }\n  }\n  if (cfg.services.includes(\"ai\") && cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) {\n    warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);\n  }\n  if (cfg.services.includes(\"o11y\")) {\n    // o11y enabled but no ingest token = telemetry silently rejected. Provision mints one.\n    const credentials = readCredentials(cfg.local.credentialsFile);\n    for (const env of cfg.envs) {\n      if (!credentials?.envs[env]?.o11yToken) {\n        warnings.push(`o11y is enabled but env \"${env}\" has no ingest token — run \"odla-ai provision\" to mint one`);\n      }\n    }\n    warnings.push(...o11yProjectWarnings(cfg.rootDir));\n  }\n  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));\n  warnings.push(...trackedSecretFiles(cfg.rootDir, undefined, [\n    cfg.local.tokenFile,\n    cfg.local.credentialsFile,\n    cfg.local.devVarsFile,\n  ]));\n  warnings.push(...wranglerWarnings(cfg.rootDir));\n\n  if (warnings.length) {\n    out.log(\"\");\n    out.log(\"warnings:\");\n    for (const warning of warnings) out.log(`  - ${warning}`);\n  } else {\n    out.log(\"ok\");\n  }\n}\n","import { existsSync, mkdirSync, writeFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { ensureGitignore } from \"./local\";\n\nexport interface InitOptions {\n  rootDir?: string;\n  configPath?: string;\n  appId: string;\n  name: string;\n  envs?: string[];\n  services?: string[];\n  aiProvider?: string;\n  force?: boolean;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/**\n * Scaffold a new odla project into `rootDir` (default: cwd). Writes an\n * `odla.config.mjs` (default name, overridable via `configPath`) plus starter\n * `src/odla/schema.mjs` (a single `notes` entity) and `src/odla/rules.mjs`\n * (deny-all), and creates the `src/odla` and `.odla` directories. Also runs\n * `ensureGitignore` so the local token/credentials paths are ignored.\n *\n * Fully local and synchronous — no network calls. The config file is only\n * written when it doesn't already exist unless `force` is set (otherwise it\n * throws); the schema/rules files are written only when missing (never\n * overwritten, even with `force`). `appId` must match `^[a-z0-9][a-z0-9-]*$` or\n * it throws. Defaults: `envs` → `[\"dev\"]`, `services` → `[\"db\",\"ai\"]`,\n * `aiProvider` → `\"anthropic\"` (which also picks the `keyEnv`, e.g.\n * `ANTHROPIC_API_KEY`/`OPENAI_API_KEY`/`GOOGLE_API_KEY`).\n *\n * @param options.appId Slug for the app (lowercase alphanumerics and hyphens).\n * @param options.name Human-readable app name embedded in the config.\n * @param options.rootDir Project root (defaults to `process.cwd()`).\n * @param options.configPath Config filename relative to root (default `odla.config.mjs`).\n * @param options.envs Environment names (default `[\"dev\"]`; production is an explicit opt-in).\n * @param options.services Enabled services (default `[\"db\",\"ai\"]`).\n * @param options.aiProvider AI provider slug (default `\"anthropic\"`).\n * @param options.force Overwrite an existing config file instead of throwing.\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport function initProject(options: InitOptions): void {\n  const out = options.stdout ?? console;\n  const rootDir = resolve(options.rootDir ?? process.cwd());\n  const configPath = resolve(rootDir, options.configPath ?? \"odla.config.mjs\");\n  if (existsSync(configPath) && !options.force) {\n    throw new Error(`${configPath} already exists. Pass --force to overwrite.`);\n  }\n  if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {\n    throw new Error(\"--app-id must be lowercase letters, numbers, and hyphens\");\n  }\n  // Production is an explicit opt-in. This prevents an unattended `init` +\n  // `provision` flow from mutating the live environment by default.\n  const envs = options.envs?.length ? options.envs : [\"dev\"];\n  const services = options.services?.length ? options.services : [\"db\", \"ai\"];\n  const aiProvider = options.aiProvider ?? \"anthropic\";\n\n  mkdirSync(dirname(configPath), { recursive: true });\n  mkdirSync(resolve(rootDir, \"src/odla\"), { recursive: true });\n  mkdirSync(resolve(rootDir, \".odla\"), { recursive: true });\n\n  writeFileSync(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));\n  writeIfMissing(resolve(rootDir, \"src/odla/schema.mjs\"), schemaTemplate());\n  writeIfMissing(resolve(rootDir, \"src/odla/rules.mjs\"), rulesTemplate());\n  ensureGitignore(rootDir);\n\n  out.log(`created ${relativeDisplay(configPath, rootDir)}`);\n  out.log(\"created src/odla/schema.mjs and src/odla/rules.mjs\");\n  out.log(\"updated .gitignore for local odla credentials\");\n}\n\nfunction writeIfMissing(path: string, text: string): void {\n  if (existsSync(path)) return;\n  writeFileSync(path, text);\n}\n\nfunction configTemplate(input: { appId: string; name: string; envs: string[]; services: string[]; aiProvider: string }): string {\n  return `export default {\n  platformUrl: process.env.ODLA_PLATFORM_URL ?? \"https://odla.ai\",\n  dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? \"https://db.odla.ai\",\n  app: {\n    id: \"${input.appId}\",\n    name: \"${input.name.replace(/\"/g, '\\\\\"')}\",\n  },\n  envs: ${JSON.stringify(input.envs)},\n  services: ${JSON.stringify(input.services)},\n  db: {\n    schema: \"./src/odla/schema.mjs\",\n    rules: \"./src/odla/rules.mjs\",\n    // When rules is omitted, the CLI generates deny-all rules from schema.\n    defaultRules: \"deny\",\n  },\n  ai: {\n    provider: process.env.ODLA_AI_PROVIDER ?? \"${input.aiProvider}\",\n    // Optional: set this env var while running provision to store the provider\n    // key in the platform vault for each tenant.\n    keyEnv: \"${defaultKeyEnv(input.aiProvider)}\",\n  },\n  auth: {\n    clerk: {\n      // dev: \"$CLERK_PUBLISHABLE_KEY\",\n      // prod: \"$CLERK_PUBLISHABLE_KEY\",\n    },\n  },\n  // Add \"o11y\" to services to enable observability; provision then mints the\n  // ingest token and scaffolds the ODLA_O11Y_* vars into .dev.vars.\n  // o11y: {\n  //   service: \"${input.appId}\",   // defaults to the app id\n  //   // endpoint: \"https://o11y.odla.ai\",\n  // },\n  links: {\n    // dev: \"https://dev.example.com\",\n    // prod: \"https://example.com\",\n  },\n  local: {\n    tokenFile: \".odla/dev-token.json\",\n    credentialsFile: \".odla/credentials.local.json\",\n    devVarsFile: \".dev.vars\",\n  },\n};\n`;\n}\n\nfunction schemaTemplate(): string {\n  return `// Replace this starter schema with your app's odla-db schema.\n// Knowledge-graph projects can export @odla-ai/kg's toSerializedSchema(ontology).\nexport const schema = {\n  entities: {\n    notes: {\n      attrs: {\n        id: { type: \"string\", unique: true, indexed: true, optional: false },\n        text: { type: \"string\", unique: false, indexed: false, optional: false },\n        createdAt: { type: \"number\", unique: false, indexed: true, optional: false },\n      },\n    },\n  },\n  links: {},\n};\n`;\n}\n\nfunction rulesTemplate(): string {\n  return `// odla-db is default-deny. The starter keeps runtime data backend-only.\nexport const rules = {\n  notes: {\n    view: \"false\",\n    create: \"false\",\n    update: \"false\",\n    delete: \"false\",\n  },\n};\n`;\n}\n\nfunction defaultKeyEnv(provider: string): string {\n  if (provider === \"openai\") return \"OPENAI_API_KEY\";\n  if (provider === \"google\") return \"GOOGLE_API_KEY\";\n  return \"ANTHROPIC_API_KEY\";\n}\n\nfunction relativeDisplay(path: string, rootDir: string): string {\n  return path.startsWith(rootDir) ? path.slice(rootDir.length + 1) : path;\n}\n","import { createAppsClient, tenantIdFor } from \"@odla-ai/apps\";\nimport { DEFAULT_SECRET_NAMES, putSecret } from \"@odla-ai/ai\";\nimport process from \"node:process\";\nimport type { AppRules, LoadedProjectConfig, ProvisionOptions } from \"./types\";\nimport { buildPlan, envValue, loadProjectConfig, resolveDataExport, rulesFromSchema } from \"./config\";\nimport { getDeveloperToken } from \"./token\";\nimport {\n  displayPath, ensureGitignore, gitignoreEntry, o11yDevVars, readCredentials, resolveWriteDevVarsTarget, writeDevVars,\n} from \"./local\";\nimport { provisionEnvCredentials } from \"./provision-credentials\";\nimport { redactSecrets } from \"./redact\";\nimport { preflightSecretsPush, secretsPushAfterPreflight } from \"./secrets\";\n\ntype FetchLike = typeof fetch;\n\n/**\n * Provision an app end-to-end from its config — the primary deploy path, and\n * (apart from key rotation) idempotent, so re-running is safe. Obtains a\n * developer token, creates the registry app when absent, enables each service\n * per env (AI also gets `setAi` with the configured provider/model), configures\n * Clerk auth and links, then per env mints or reuses credentials only for the\n * configured services, pushes the schema with the db key and the\n * rules with the developer token, and stores the provider key in the tenant\n * vault when `ai.keyEnv` is set and present. Finally writes the credentials file\n * (mode 0600, gitignored) and, when requested, `.dev.vars`.\n *\n * The developer token comes from (in order) `options.token`, `$ODLA_DEV_TOKEN`,\n * the cached `.odla` token, or a fresh device handshake — which prints a user\n * code + approval URL and, in interactive terminals, auto-opens the browser\n * (`open: true`/`false` forces/suppresses it). Network error bodies pass through\n * `redactSecrets` before display.\n *\n * @param options.dryRun Print the resolved plan and return before any network call/write.\n * @param options.rotateKeys Rotate db keys and o11y tokens.\n * @param options.rotateO11yToken Rotate only the o11y token.\n * @param options.pushSecrets Preflight Wrangler, then push each env's configured\n *   Worker secrets immediately after credential provisioning.\n * @param options.writeDevVars `true`/a path writes `.dev.vars`; `writeCredentials: false` skips the creds file.\n * @param options.yes Required for a non-dry-run plan containing `prod` or\n *   `production`; callers must show and review `dryRun` output first.\n * @throws When a production plan is executed without `yes`, configuration is\n *   invalid, authorization fails, or a provisioning operation fails.\n */\nexport async function provision(options: ProvisionOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const plan = buildPlan(cfg);\n  const hasDb = cfg.services.includes(\"db\");\n  const hasO11y = cfg.services.includes(\"o11y\");\n\n  if (options.rotateO11yToken && !hasO11y) {\n    throw new Error(\"--rotate-o11y-token requires the o11y service in odla.config.mjs\");\n  }\n  if (options.pushSecrets && options.writeCredentials === false) {\n    throw new Error(\"--push-secrets cannot be combined with --no-write-credentials\");\n  }\n\n  out.log(`odla-ai: ${plan.appName} (${plan.appId})`);\n  out.log(`  platform: ${plan.platformUrl}`);\n  out.log(`  db:       ${plan.dbEndpoint}`);\n  out.log(`  envs:     ${plan.envs.join(\", \")}`);\n  out.log(`  services: ${plan.services.join(\", \")}`);\n\n  const productionEnvs = plan.envs.filter((env) => env === \"prod\" || env === \"production\");\n  if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {\n    throw new Error(\n      `refusing to provision production env ${productionEnvs.join(\", \")} without --yes; run --dry-run first`,\n    );\n  }\n\n  const schema = hasDb ? await resolveDataExport<unknown>(cfg, cfg.db?.schema, [\"schema\", \"SCHEMA\"]) : undefined;\n  const configuredRules = hasDb ? await resolveDataExport<AppRules>(cfg, cfg.db?.rules, [\"rules\", \"RULES\"]) : undefined;\n  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : undefined);\n\n  if (options.dryRun) {\n    out.log(\"dry run: no network calls or file writes\");\n    out.log(`  schema: ${schema ? \"yes\" : \"no\"}`);\n    out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);\n    out.log(`  ai:     ${cfg.services.includes(\"ai\") ? (cfg.ai?.provider ?? \"not configured\") : \"not enabled\"}`);\n    out.log(`  secrets: ${options.pushSecrets ? \"push configured Worker secrets\" : \"local only\"}`);\n    return;\n  }\n\n  let credentials = readCredentials(cfg.local.credentialsFile);\n  if (credentials && credentials.appId !== cfg.app.id) {\n    throw new Error(\n      `credentials at ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} are for \"${credentials.appId}\", not \"${cfg.app.id}\"`,\n    );\n  }\n  const rotatesO11y = !!(options.rotateKeys || options.rotateO11yToken);\n  const missingO11y = cfg.envs.some((env) => !credentials?.envs[env]?.o11yToken);\n  const missingDb = cfg.envs.some((env) => !credentials?.envs[env]?.dbKey);\n  const losesShownOnceCredential = (hasDb && (!!options.rotateKeys || missingDb)) || (hasO11y && (rotatesO11y || missingO11y));\n  if (options.writeCredentials === false && losesShownOnceCredential) {\n    throw new Error(\"credential issuance/rotation requires the private credentials file; remove --no-write-credentials\");\n  }\n  const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);\n  if (cfg.local.gitignore) {\n    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, cfg.local.credentialsFile, ...(devVarsTarget ? [devVarsTarget] : [])]);\n  }\n  if (options.pushSecrets) {\n    await preflightSecretsPush({ configPath: cfg.configPath, runner: options.secretRunner });\n    out.log(\"secrets: Wrangler config and login preflight passed\");\n  }\n\n  const doFetch = options.fetch ?? fetch;\n  const token = await getDeveloperToken(cfg, options, doFetch, out);\n  const apps = createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });\n\n  const existing = await readRegistryApp(cfg, token, doFetch);\n  if (existing) {\n    out.log(`app: ${cfg.app.id} already exists`);\n  } else {\n    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });\n    out.log(`app: created ${cfg.app.id}`);\n  }\n\n  for (const env of cfg.envs) {\n    for (const service of cfg.services) {\n      if (service === \"ai\") {\n        if (cfg.ai?.provider) {\n          await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...(cfg.ai.model ? { model: cfg.ai.model } : {}) });\n          out.log(`${env}: ai configured (${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : \"\"})`);\n        } else {\n          await apps.setService(cfg.app.id, \"ai\", true, { env });\n          out.log(`${env}: ai enabled`);\n        }\n      } else {\n        await apps.setService(cfg.app.id, service, true, { env });\n        out.log(`${env}: ${service} enabled`);\n      }\n    }\n\n    const authConfig = normalizeClerkConfig(cfg.auth?.clerk?.[env]);\n    if (authConfig?.publishableKey) {\n      await apps.setAuth(cfg.app.id, env, authConfig);\n      out.log(`${env}: auth configured (clerk ${authConfig.mode ?? \"client\"})`);\n    }\n\n    const link = cfg.links?.[env];\n    if (link !== undefined) {\n      await apps.setLink(cfg.app.id, env, link ?? null);\n      out.log(`${env}: link ${link ? \"set\" : \"cleared\"}`);\n    }\n  }\n\n  for (const env of cfg.envs) {\n    const tenantId = tenantIdFor(cfg.app.id, env);\n    credentials = await provisionEnvCredentials({\n      cfg,\n      env,\n      developerToken: token,\n      credentials,\n      rotateDb: !!options.rotateKeys,\n      rotateO11y: rotatesO11y,\n      write: options.writeCredentials !== false,\n      fetch: doFetch,\n      stdout: out,\n    });\n    const dbKey = credentials.envs[env]?.dbKey;\n\n    if (options.pushSecrets) {\n      try {\n        await secretsPushAfterPreflight({\n          configPath: cfg.configPath,\n          env,\n          yes: options.yes,\n          runner: options.secretRunner,\n          stdout: out,\n        });\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        const consent = env === \"prod\" || env === \"production\" ? \" --yes\" : \"\";\n        throw new Error(\n          `${message}\\n${env}: credentials are already saved; retry ` +\n          `\"odla-ai secrets push --env ${env}${consent}\" without issuing or rotating again`,\n          { cause: error },\n        );\n      }\n    }\n\n    if (schema && dbKey) {\n      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });\n      out.log(`${env}: schema pushed`);\n    }\n    if (rules) {\n      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);\n      out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);\n    }\n\n    if (cfg.services.includes(\"ai\") && cfg.ai?.provider && cfg.ai.keyEnv) {\n      const key = process.env[cfg.ai.keyEnv];\n      if (key) {\n        const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);\n        await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);\n        out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);\n      } else {\n        out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);\n      }\n    }\n\n  }\n\n  if (options.writeCredentials !== false && credentials) {\n    const ignored = cfg.local.gitignore && gitignoreEntry(cfg.rootDir, cfg.local.credentialsFile);\n    out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600${ignored ? \", gitignored\" : \"\"})`);\n  }\n\n  if (devVarsTarget && credentials) {\n    const env = cfg.envs.includes(\"dev\") ? \"dev\" : (cfg.envs[0] ?? \"prod\");\n    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));\n    out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);\n  }\n}\n\nasync function readRegistryApp(cfg: LoadedProjectConfig, token: string, doFetch: FetchLike): Promise<unknown | null> {\n  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {\n    headers: { authorization: `Bearer ${token}` },\n  });\n  if (res.status === 404) return null;\n  if (!res.ok) return null;\n  const json = (await res.json()) as { app?: unknown };\n  return json.app ?? null;\n}\n\nasync function postJson(doFetch: FetchLike, url: string, bearer: string, body: unknown): Promise<void> {\n  const res = await doFetch(url, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${bearer}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify(body),\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText(res)}`);\n}\n\nfunction normalizeClerkConfig(value: unknown): { publishableKey: string; audience?: string; mode?: \"client\" | \"full\" } | null {\n  if (!value) return null;\n  if (typeof value === \"string\") {\n    const publishableKey = envValue(value);\n    return publishableKey ? { publishableKey } : null;\n  }\n  if (typeof value !== \"object\") return null;\n  const cfg = value as { publishableKey?: string; audience?: string; mode?: \"client\" | \"full\" };\n  const publishableKey = envValue(cfg.publishableKey);\n  return publishableKey ? { publishableKey, ...(cfg.audience ? { audience: cfg.audience } : {}), ...(cfg.mode ? { mode: cfg.mode } : {}) } : null;\n}\n\nfunction defaultSecretName(provider: string): string {\n  const names = DEFAULT_SECRET_NAMES as Record<string, string>;\n  return names[provider] ?? `${provider}_api_key`;\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return redactSecrets((await res.text()).slice(0, 500));\n  } catch {\n    return \"\";\n  }\n}\n","import { tenantIdFor } from \"@odla-ai/apps\";\nimport type { LoadedProjectConfig, LocalCredentials } from \"./types\";\nimport { mergeCredential, writePrivateJson } from \"./local\";\nimport { redactSecrets } from \"./redact\";\n\ntype FetchLike = typeof fetch;\n\ninterface ProvisionEnvCredentialsOptions {\n  cfg: LoadedProjectConfig;\n  env: string;\n  developerToken: string;\n  credentials: LocalCredentials | null;\n  rotateDb: boolean;\n  rotateO11y: boolean;\n  write: boolean;\n  fetch: FetchLike;\n  stdout: Pick<typeof console, \"log\">;\n}\n\n/** Mint/reuse only the credentials required by configured services. */\nexport async function provisionEnvCredentials(opts: ProvisionEnvCredentialsOptions): Promise<LocalCredentials> {\n  const tenantId = tenantIdFor(opts.cfg.app.id, opts.env);\n  const prior = opts.credentials?.envs[opts.env];\n  let credentials = opts.credentials;\n  let dbKey = opts.cfg.services.includes(\"db\") && !opts.rotateDb ? prior?.dbKey : undefined;\n  let o11yToken = opts.cfg.services.includes(\"o11y\") && !opts.rotateO11y ? prior?.o11yToken : undefined;\n\n  if (opts.cfg.services.includes(\"db\")) {\n    if (dbKey) {\n      opts.stdout.log(`${opts.env}: reusing local db key for ${tenantId}`);\n    } else {\n      dbKey = await mintDbKey(opts, tenantId);\n      credentials = save(opts, credentials, tenantId, { dbKey });\n      opts.stdout.log(`${opts.env}: minted db key for ${tenantId}`);\n    }\n  }\n\n  if (opts.cfg.services.includes(\"o11y\")) {\n    if (o11yToken) {\n      opts.stdout.log(`${opts.env}: reusing local o11y ingest token`);\n    } else {\n      o11yToken = await issueO11yToken(opts);\n      credentials = save(opts, credentials, tenantId, { ...(dbKey ? { dbKey } : {}), o11yToken });\n      opts.stdout.log(`${opts.env}: ${opts.rotateO11y ? \"rotated\" : \"issued\"} o11y ingest token`);\n    }\n  }\n\n  return save(opts, credentials, tenantId, {\n    ...(dbKey ? { dbKey } : {}),\n    ...(o11yToken ? { o11yToken } : {}),\n  });\n}\n\nfunction save(\n  opts: ProvisionEnvCredentialsOptions,\n  current: LocalCredentials | null,\n  tenantId: string,\n  values: { dbKey?: string; o11yToken?: string },\n): LocalCredentials {\n  const next = mergeCredential(current, {\n    appId: opts.cfg.app.id,\n    platformUrl: opts.cfg.platformUrl,\n    dbEndpoint: opts.cfg.dbEndpoint,\n    env: opts.env,\n    tenantId,\n    ...values,\n  });\n  if (opts.write) writePrivateJson(opts.cfg.local.credentialsFile, next);\n  return next;\n}\n\nasync function mintDbKey(opts: ProvisionEnvCredentialsOptions, tenantId: string): Promise<string> {\n  const headers = { authorization: `Bearer ${opts.developerToken}`, \"content-type\": \"application/json\" };\n  let res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {\n    method: \"POST\",\n    headers,\n    body: \"{}\",\n  });\n  if (res.status === 404) {\n    const created = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({\n        name: opts.env === \"prod\" ? opts.cfg.app.name : `${opts.cfg.app.name} (${opts.env})`,\n        appId: tenantId,\n      }),\n    });\n    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText(created)}`);\n    res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {\n      method: \"POST\",\n      headers,\n      body: \"{}\",\n    });\n  }\n  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText(res)}`);\n  const body = (await res.json()) as { key?: string };\n  if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);\n  return body.key;\n}\n\nasync function issueO11yToken(opts: ProvisionEnvCredentialsOptions): Promise<string> {\n  const suffix = opts.rotateO11y ? \"/rotate\" : \"\";\n  const res = await opts.fetch(\n    `${opts.cfg.platformUrl}/o11y/${encodeURIComponent(opts.cfg.app.id)}/token${suffix}?env=${encodeURIComponent(opts.env)}`,\n    { method: \"POST\", headers: { authorization: `Bearer ${opts.developerToken}` } },\n  );\n  if (res.status === 409 && !opts.rotateO11y) {\n    throw new Error(\n      `o11y token already exists for env \"${opts.env}\", but its shown-once value is not in the local credentials file; ` +\n      `run \"odla-ai provision --rotate-o11y-token --push-secrets\" to replace it explicitly`,\n    );\n  }\n  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? \"rotation\" : \"issue\"} (${opts.env}) failed: ${res.status} ${await safeText(res)}`);\n  const body = (await res.json()) as { token?: string };\n  if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? \"rotation\" : \"issue\"} (${opts.env}) returned no token`);\n  return body.token;\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return redactSecrets((await res.text()).slice(0, 500));\n  } catch {\n    return \"\";\n  }\n}\n","import { loadProjectConfig } from \"./config\";\nimport { displayPath, readCredentials } from \"./local\";\nimport { redactSecrets } from \"./redact\";\nimport type { LoadedProjectConfig } from \"./types\";\nimport { defaultRunner, findWranglerConfig, wranglerLoggedIn, wranglerPutSecret } from \"./wrangler\";\nimport type { CommandRunner } from \"./wrangler\";\n\n/** Moves locally stored configured service credentials to one Wrangler environment over stdin. */\nexport interface SecretsPushOptions {\n  configPath: string;\n  env: string;\n  dryRun?: boolean;\n  /** Required to push to a prod-named env; the visible consent token in agent transcripts. */\n  yes?: boolean;\n  runner?: CommandRunner;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\nexport interface SecretsPreflightOptions {\n  configPath: string;\n  runner?: CommandRunner;\n}\n\nconst PROD_ENV_NAMES = new Set([\"prod\", \"production\"]);\n\n/**\n * Moves the env's configured db and/or o11y credentials from the private local\n * credentials file into the Worker, piping values over stdin so they never\n * appear on argv, in output, or in the conversation transcript.\n */\nexport async function secretsPush(options: SecretsPushOptions): Promise<void> {\n  await secretsPushImpl(options, true);\n}\n\n/** @internal Push after the caller has completed `preflightSecretsPush`. */\nexport async function secretsPushAfterPreflight(options: SecretsPushOptions): Promise<void> {\n  await secretsPushImpl(options, false);\n}\n\nasync function secretsPushImpl(options: SecretsPushOptions, preflight: boolean): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const env = options.env;\n\n  if (!cfg.envs.includes(env)) {\n    throw new Error(`env \"${env}\" is not in config envs (${cfg.envs.join(\", \")})`);\n  }\n  if (PROD_ENV_NAMES.has(env) && !options.yes) {\n    throw new Error(`refusing to push a secret to \"${env}\" without --yes`);\n  }\n\n  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);\n  const credentials = readCredentials(cfg.local.credentialsFile);\n  if (!credentials) throw new Error(`no credentials at ${credentialsPath} — run \"odla-ai provision\" first`);\n  if (credentials.appId !== cfg.app.id) {\n    throw new Error(`credentials at ${credentialsPath} are for \"${credentials.appId}\", not \"${cfg.app.id}\"`);\n  }\n  const entry = credentials.envs[env];\n  if (!entry) throw new Error(`no credentials for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n\n  const secrets: Array<{ name: string; value: string }> = [];\n  if (cfg.services.includes(\"o11y\")) {\n    if (!entry.o11yToken) throw new Error(`no o11y token for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n    secrets.push({ name: \"ODLA_O11Y_TOKEN\", value: entry.o11yToken });\n  }\n  if (cfg.services.includes(\"db\")) {\n    if (!entry.dbKey) throw new Error(`no db key for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n    secrets.push({ name: \"ODLA_API_KEY\", value: entry.dbKey });\n  }\n  if (secrets.length === 0) {\n    out.log(`${env}: no configured Worker secrets to push`);\n    return;\n  }\n\n  // Convention from the reference apps: the top-level wrangler config is prod;\n  // every other env is a named `env.<name>` block.\n  const wranglerEnv = PROD_ENV_NAMES.has(env) ? undefined : env;\n  const target = wranglerEnv ? `wrangler env \"${wranglerEnv}\"` : \"the top-level (prod) wrangler env\";\n\n  if (options.dryRun) {\n    assertWranglerConfig(cfg);\n    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);\n    return;\n  }\n\n  const run = options.runner ?? defaultRunner;\n  if (preflight) await preflightLoadedConfig(cfg, run);\n\n  for (const s of secrets) {\n    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });\n    if (result.code !== 0) {\n      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);\n    }\n    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);\n  }\n}\n\n/** Check Wrangler config and login before provisioning issues or rotates secrets. */\nexport async function preflightSecretsPush(options: SecretsPreflightOptions): Promise<void> {\n  const cfg = await loadProjectConfig(options.configPath);\n  if (!cfg.services.some((service) => service === \"db\" || service === \"o11y\")) return;\n  await preflightLoadedConfig(cfg, options.runner ?? defaultRunner);\n}\n\nasync function preflightLoadedConfig(cfg: LoadedProjectConfig, run: CommandRunner): Promise<void> {\n  assertWranglerConfig(cfg);\n  if (!(await wranglerLoggedIn(run, cfg.rootDir))) {\n    throw new Error(`wrangler is not logged in — run \"wrangler login\" (a browser step for the human)`);\n  }\n}\n\nfunction assertWranglerConfig(cfg: LoadedProjectConfig): void {\n  if (!findWranglerConfig(cfg.rootDir)) {\n    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);\n  }\n}\n","import { isAbsolute, relative, resolve, sep } from \"node:path\";\nimport {\n  cloudflareAppProfile,\n  createPlatformSecurityReasoners,\n  createSecurityHarness,\n  genericProfile,\n  odlaProfile,\n  securityFingerprint,\n  type PlatformSecurityRun,\n  type SecurityProfile,\n  type SecurityReport,\n} from \"@odla-ai/security\";\nimport { FileRunStore, snapshotDirectory, writeSecurityArtifacts } from \"@odla-ai/security/node\";\nimport { loadProjectConfig } from \"./config\";\n\n/** Built-in security coverage profile selected for a hosted reasoning run. */\nexport type HostedSecurityProfile = \"odla\" | \"cloudflare-app\" | \"generic\";\n\n/** Exact attribution and authorization need supplied to a lazy token callback. */\nexport interface HostedSecurityTokenRequest {\n  platform: string;\n  appId: string;\n  env: string;\n  selfAudit: boolean;\n  /** Self-audit asks the caller for an explicitly scoped platform credential. */\n  /** Ordinary app runs use owner authority and therefore request no platform scope. */\n  scope: \"platform:security:self\" | null;\n}\n\n/** Local snapshot/orchestration controls for an app-attributed hosted security\n * run. The platform supplies model routes and provider credentials. */\nexport interface RunHostedSecurityOptions {\n  /** Project config; loaded for customer-app runs and ignored for self-audit. */\n  configPath?: string;\n  /** Scan odla itself under the protected odla-ai/prod identity. */\n  selfAudit?: boolean;\n  /** Repository directory to snapshot. Defaults to the config root or cwd for self-audit. */\n  target?: string;\n  /** Private artifact directory. Defaults to `<target>/.odla/security/hosted`. */\n  out?: string;\n  /** Customer environment. Must be declared in config. Self-audit always uses prod. */\n  env?: string;\n  profile?: HostedSecurityProfile;\n  maxHuntTasks?: number;\n  /** Exact acknowledgement required before any source capture or network call. */\n  sourceDisclosureAck?: \"redacted\";\n  /** Optional client correlation id; the platform returns the authoritative run id. */\n  runId?: string;\n  /** Platform override. Customer runs otherwise use config.platformUrl. */\n  platform?: string;\n  /** Injected app credential; for self-audit this must be explicitly scoped by the caller. */\n  token?: string;\n  /** Lazy token acquisition. Receives the exact app/env and required scope. */\n  getToken?: (request: HostedSecurityTokenRequest) => string | Promise<string>;\n  fetch?: typeof fetch;\n  signal?: AbortSignal;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** Completed local report, public platform run metadata, and private artifact path. */\nexport interface HostedSecurityResult {\n  report: SecurityReport;\n  run: Readonly<PlatformSecurityRun>;\n  output: string;\n}\n\n/**\n * Run the hosted, redacted-source security harness for an odla app or odla's\n * protected self-audit identity. Provider/model selection and provider secrets\n * remain platform-owned; this function accepts only an app/scoped bearer and\n * the opaque role grants remain inside @odla-ai/security's reasoner closures.\n */\nexport async function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult> {\n  if (options.sourceDisclosureAck !== \"redacted\") {\n    throw new Error(\"Hosted security requires sourceDisclosureAck=redacted before repository source may leave this process\");\n  }\n\n  const selfAudit = options.selfAudit === true;\n  const cfg = selfAudit ? undefined : await loadProjectConfig(options.configPath ?? \"odla.config.mjs\");\n  const appId = selfAudit ? \"odla-ai\" : cfg!.app.id;\n  const env = selfAudit ? \"prod\" : selectEnv(options.env, cfg!.envs, cfg!.configPath, cfg!.rootDir);\n  const platform = options.platform ?? cfg?.platformUrl ?? \"https://odla.ai\";\n  const target = resolve(options.target ?? cfg?.rootDir ?? \".\");\n  const output = resolve(options.out ?? resolve(target, \".odla/security/hosted\"));\n  const outputRelative = relative(target, output).split(sep).join(\"/\");\n  if (!outputRelative) throw new Error(\"Hosted security output cannot be the repository root\");\n  // Keep room under the default 24-call discovery grant for recon and shallow\n  // retries. Admins may raise both policy and this explicit task bound.\n  const profile = profileFor(options.profile ?? \"odla\", options.maxHuntTasks ?? 12);\n\n  const tokenRequest: HostedSecurityTokenRequest = {\n    platform,\n    appId,\n    env,\n    selfAudit,\n    scope: selfAudit ? \"platform:security:self\" : null,\n  };\n  const token = await injectedToken(options, tokenRequest);\n  const snapshot = await snapshotDirectory(target, {\n    exclude: !outputRelative.startsWith(\"../\") && !isAbsolute(outputRelative) ? [outputRelative] : [],\n  });\n  const hosted = await createPlatformSecurityReasoners({\n    platform,\n    token,\n    appId,\n    env,\n    repository: snapshot.repository,\n    revision: snapshot.revision,\n    snapshotDigest: snapshot.digest,\n    sourceDisclosure: \"redacted\",\n    clientRunId: options.runId ?? crypto.randomUUID(),\n    ...(selfAudit ? { selfAudit: { enabled: true as const, subject: \"service:odla-security-self-audit\" } } : {}),\n    fetch: options.fetch,\n    signal: options.signal,\n  });\n  const harness = createSecurityHarness({\n    profile,\n    store: new FileRunStore(resolve(output, \"state\")),\n    discoveryReasoner: hosted.discoveryReasoner,\n    validationReasoner: hosted.validationReasoner,\n    policy: {\n      modelSourceDisclosure: \"redacted\",\n      active: false,\n      allowNetwork: false,\n    },\n  });\n  const report = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });\n  await writeSecurityArtifacts(output, report);\n  const reportDigest = await securityFingerprint(report);\n  await hosted.complete({\n    reportDigest,\n    coverageStatus: report.coverageStatus,\n    confirmed: report.metrics.confirmed,\n    candidates: report.metrics.candidates,\n  }, { signal: options.signal });\n  printSummary(options.stdout ?? console, appId, env, hosted.run, report, output);\n  return Object.freeze({ report, run: hosted.run, output });\n}\n\nfunction selectEnv(requested: string | undefined, declared: string[], configPath: string, rootDir: string): string {\n  const env = requested ?? (declared.includes(\"dev\") ? \"dev\" : declared[0]);\n  if (!env || !declared.includes(env)) {\n    const shown = relative(rootDir, configPath) || configPath;\n    throw new Error(`env \"${env ?? \"\"}\" is not declared in ${shown}`);\n  }\n  return env;\n}\n\nasync function injectedToken(options: RunHostedSecurityOptions, request: HostedSecurityTokenRequest): Promise<string> {\n  const value = options.token ?? await options.getToken?.(Object.freeze({ ...request }));\n  if (typeof value !== \"string\" || value.length < 8 || value.length > 8_192 || /\\s|[\\u0000-\\u001f\\u007f]/.test(value)) {\n    throw new Error(\n      request.selfAudit\n        ? \"Self-audit requires an injected, scoped platform security token\"\n        : \"Hosted security requires an injected app developer token or getToken callback\",\n    );\n  }\n  return value;\n}\n\nfunction profileFor(name: HostedSecurityProfile, maxHuntTasks: number | undefined): SecurityProfile {\n  const profile = name === \"odla\"\n    ? odlaProfile()\n    : name === \"cloudflare-app\"\n      ? cloudflareAppProfile()\n      : name === \"generic\"\n        ? genericProfile()\n        : undefined;\n  if (!profile) throw new Error(`unknown security profile \"${String(name)}\"`);\n  if (maxHuntTasks === undefined) return profile;\n  if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error(\"maxHuntTasks must be a positive integer\");\n  return { ...profile, maxHuntTasks };\n}\n\nfunction printSummary(\n  out: Pick<typeof console, \"log\" | \"error\">,\n  appId: string,\n  env: string,\n  run: Readonly<PlatformSecurityRun>,\n  report: SecurityReport,\n  output: string,\n): void {\n  const complete = report.coverage.filter((cell) => cell.state === \"complete\").length;\n  out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);\n  out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);\n  out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);\n  out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells}`);\n  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);\n  out.log(`  report: ${resolve(output, \"REPORT.md\")}`);\n}\n","import { readFileSync } from \"node:fs\";\n\nexport function cliVersion(): string {\n  const pkg = JSON.parse(readFileSync(new URL(\"../package.json\", import.meta.url), \"utf8\")) as { version?: string };\n  return pkg.version ?? \"unknown\";\n}\n\nexport function printHelp(): void {\n  console.log(`odla-ai\n\nUsage:\n  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]\n  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]\n  odla-ai doctor [--config odla.config.mjs]\n  odla-ai capabilities [--json]\n  odla-ai admin ai show [--platform https://odla.ai] [--json]\n  odla-ai admin ai set <purpose> --provider <id> --model <id> [--enabled|--no-enabled]\n  odla-ai admin ai credentials [--json]\n  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)\n  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]\n  odla-ai security run [target] --self --ack-redacted-source\n  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]\n  odla-ai smoke [--config odla.config.mjs] [--env dev]\n  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]\n  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]\n  odla-ai version\n\nCommands:\n  setup        Install offline odla runbooks for common coding-agent harnesses.\n  init         Create a generic odla.config.mjs plus starter schema/rules files.\n  doctor       Validate and summarize the project config without network calls.\n  capabilities Show what the CLI automates vs agent edits and human checkpoints.\n  admin        Manage platform-funded AI routing with a narrow admin-approved device grant.\n  security     Run hosted discovery + independent validation with app/run attribution.\n  provision    Register services, configure them, persist credentials, optionally push secrets.\n  smoke        Verify local credentials, public-config, live schema, and db aggregate.\n  skill        Same installer; --agent accepts all, claude, codex, cursor,\n               copilot, gemini, or agents (repeatable or comma-separated).\n  secrets      Push configured db/o11y secrets into the Worker via wrangler stdin.\n  version      Print the CLI version.\n\nSafety:\n  New projects target dev only. Add prod explicitly to odla.config.mjs and pass\n  --yes to provision it; use --dry-run first to inspect the resolved plan.\n  Provision caches the approved developer token and service credentials under\n  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push\n  preflights Wrangler before any shown-once issuance or destructive rotation.\n  Provision opens the approval page automatically in interactive terminals;\n  use --open to force browser launch or --no-open to suppress it.\n`);\n}\n","import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { claudeAdapter, CURSOR_RULE, PROJECT_INSTRUCTIONS } from \"./skill-adapters\";\n\n/** Agent harnesses with a first-class local adapter. */\nexport const AGENT_HARNESSES = [\"claude\", \"codex\", \"cursor\", \"copilot\", \"gemini\", \"agents\"] as const;\n\n/** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */\nexport type AgentHarness = (typeof AGENT_HARNESSES)[number];\n\n/** A harness name accepted by setup; `all` expands to every project-local adapter. */\nexport type AgentHarnessSelector = AgentHarness | \"all\";\n\n/** Controls project-local or global installation of the bundled agent runbooks. */\nexport interface SkillInstallOptions {\n  /** Project directory receiving the shared runbooks and harness adapters. Defaults to cwd. */\n  dir?: string;\n  /** Install user-wide Claude and/or Codex skills instead of project adapters. */\n  global?: boolean;\n  /** Harnesses to install. The programmatic compatibility default is `claude`; the CLI passes `all`. */\n  harnesses?: AgentHarnessSelector[];\n  /** Overwrite locally modified odla-managed files or managed instruction sections. */\n  force?: boolean;\n  /** Test/embedding override for the home directory. */\n  homeDir?: string;\n  /** Test/embedding override for `$CODEX_HOME`. */\n  codexHomeDir?: string;\n  /** Test/embedding override for the bundled skills directory. */\n  sourceDir?: string;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** One harness adapter and the directories or files through which it discovers odla. */\nexport interface HarnessInstallResult {\n  harness: AgentHarness;\n  targets: string[];\n}\n\n/** Files written or left unchanged by an idempotent agent-runbook installation. */\nexport interface SkillInstallResult {\n  /** Primary native skill directory, retained for compatibility with earlier callers. */\n  targetDir: string;\n  /** Files changed directly under `targetDir`, relative to that directory. */\n  written: string[];\n  /** Files already current directly under `targetDir`, relative to that directory. */\n  unchanged: string[];\n  /** Absolute paths of every changed shared-runbook or adapter file. */\n  writtenPaths: string[];\n  /** Absolute paths of every already-current shared-runbook or adapter file. */\n  unchangedPaths: string[];\n  harnesses: HarnessInstallResult[];\n}\n\ninterface PlannedFile {\n  target: string;\n  content: string;\n  boundary: string;\n  managedMerge?: boolean;\n}\n\n/**\n * Installs one shared offline runbook tree plus thin native adapters for the\n * selected coding-agent harnesses. Project installs use `.agents/skills/` as\n * the canonical bundle; Claude Code, Cursor, Copilot, Gemini, and generic\n * `AGENTS.md` adapters point to it. Global installs support the native Claude\n * and Codex skill roots only.\n *\n * Installation is idempotent and planned before any write: an odla-managed\n * file changed by the user aborts the whole operation unless `force` is set.\n * Existing `AGENTS.md`, `GEMINI.md`, and Copilot instructions are preserved;\n * only the bounded odla-managed section is appended or replaced.\n */\nexport function installSkill(options: SkillInstallOptions = {}): SkillInstallResult {\n  const out = options.stdout ?? console;\n  const sourceDir = options.sourceDir ?? fileURLToPath(new URL(\"../skills\", import.meta.url));\n  const files = listFiles(sourceDir);\n  if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);\n\n  const harnesses = normalizeHarnesses(options.harnesses, options.global === true);\n  const root = resolve(options.dir ?? process.cwd());\n  const home = resolve(options.homeDir ?? homedir());\n  const plans = new Map<string, PlannedFile>();\n  const targets = new Map<AgentHarness, Set<string>>();\n\n  const rememberTarget = (harness: AgentHarness, target: string): void => {\n    const current = targets.get(harness) ?? new Set<string>();\n    current.add(target);\n    targets.set(harness, current);\n  };\n  const plan = (target: string, content: string, managedMerge = false, boundary = root): void => {\n    const existing = plans.get(target);\n    if (existing && existing.content !== content) throw new Error(`internal agent setup conflict for ${target}`);\n    plans.set(target, { target, content, boundary, managedMerge });\n  };\n  const planSkillTree = (targetDir: string, boundary = root): void => {\n    for (const rel of files) plan(join(targetDir, rel), readFileSync(join(sourceDir, rel), \"utf8\"), false, boundary);\n  };\n\n  let targetDir: string;\n  if (options.global) {\n    const claudeRoot = join(home, \".claude\", \"skills\");\n    const codexRoot = resolve(options.codexHomeDir ?? process.env.CODEX_HOME ?? join(home, \".codex\"), \"skills\");\n    targetDir = harnesses[0] === \"codex\" ? codexRoot : claudeRoot;\n    for (const harness of harnesses) {\n      const skillRoot = harness === \"claude\" ? claudeRoot : codexRoot;\n      planSkillTree(skillRoot, harness === \"claude\" ? home : dirname(dirname(codexRoot)));\n      rememberTarget(harness, skillRoot);\n    }\n  } else {\n    const sharedRoot = join(root, \".agents\", \"skills\");\n    planSkillTree(sharedRoot);\n\n    const claudeRoot = join(root, \".claude\", \"skills\");\n    targetDir = harnesses.includes(\"claude\") ? claudeRoot : sharedRoot;\n    for (const harness of harnesses) rememberTarget(harness, sharedRoot);\n\n    if (harnesses.includes(\"claude\")) {\n      for (const skill of skillNames(files)) {\n        const canonical = readFileSync(join(sourceDir, skill, \"SKILL.md\"), \"utf8\");\n        plan(join(claudeRoot, skill, \"SKILL.md\"), claudeAdapter(skill, canonical));\n      }\n      rememberTarget(\"claude\", claudeRoot);\n    }\n    if (harnesses.includes(\"cursor\")) {\n      const cursorRule = join(root, \".cursor\", \"rules\", \"odla.mdc\");\n      plan(cursorRule, CURSOR_RULE);\n      rememberTarget(\"cursor\", cursorRule);\n    }\n    if (harnesses.includes(\"agents\")) {\n      const agentsFile = join(root, \"AGENTS.md\");\n      plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"agents\", agentsFile);\n    }\n    if (harnesses.includes(\"copilot\")) {\n      const copilotFile = join(root, \".github\", \"copilot-instructions.md\");\n      plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"copilot\", copilotFile);\n    }\n    if (harnesses.includes(\"gemini\")) {\n      const geminiFile = join(root, \"GEMINI.md\");\n      plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"gemini\", geminiFile);\n    }\n  }\n\n  const writtenPaths = new Set<string>();\n  const unchangedPaths = new Set<string>();\n  const conflicts: string[] = [];\n  for (const file of plans.values()) {\n    const symlink = symlinkedComponent(file.boundary, file.target);\n    if (symlink) {\n      conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);\n      continue;\n    }\n    if (!existsSync(file.target)) {\n      writtenPaths.add(file.target);\n      continue;\n    }\n    const current = readFileSync(file.target, \"utf8\");\n    if (current === file.content) {\n      unchangedPaths.add(file.target);\n    } else if (file.managedMerge || options.force) {\n      writtenPaths.add(file.target);\n      unchangedPaths.delete(file.target);\n    } else {\n      conflicts.push(file.target);\n    }\n  }\n\n  if (conflicts.length > 0) {\n    throw new Error(\n      `agent setup files modified locally (re-run with --force to replace only odla-managed content):\\n${conflicts.map((f) => `  - ${f}`).join(\"\\n\")}`,\n    );\n  }\n\n  for (const file of plans.values()) {\n    if (!existsSync(file.target) || readFileSync(file.target, \"utf8\") !== file.content) {\n      mkdirSync(dirname(file.target), { recursive: true });\n      writeFileSync(file.target, file.content);\n    }\n  }\n\n  const skills = skillNames(files);\n  const installations = harnesses.map((harness) => ({ harness, targets: [...(targets.get(harness) ?? [])] }));\n  out.log(`agent harnesses: ${harnesses.join(\", \")}`);\n  out.log(`offline skills: ${skills.join(\", \")}`);\n  for (const installation of installations) out.log(`${installation.harness}: ${installation.targets.join(\", \")}`);\n  out.log(`installed ${writtenPaths.size} managed file(s)${unchangedPaths.size ? ` (${unchangedPaths.size} unchanged)` : \"\"}`);\n  return {\n    targetDir,\n    written: pathsUnder(targetDir, writtenPaths),\n    unchanged: pathsUnder(targetDir, unchangedPaths),\n    writtenPaths: [...writtenPaths].sort(),\n    unchangedPaths: [...unchangedPaths].sort(),\n    harnesses: installations,\n  };\n}\n\nfunction pathsUnder(root: string, paths: Set<string>): string[] {\n  return [...paths]\n    .map((path) => relative(root, path))\n    .filter((path) => path !== \"..\" && !path.startsWith(`..${sep}`) && !isAbsolute(path))\n    .sort();\n}\n\nfunction normalizeHarnesses(values: AgentHarnessSelector[] | undefined, global: boolean): AgentHarness[] {\n  const requested: string[] = values?.length ? values : [\"claude\"];\n  const allowed = new Set<string>([...AGENT_HARNESSES, \"all\"]);\n  for (const harness of requested) {\n    if (!allowed.has(harness)) {\n      throw new Error(`unknown agent harness \"${harness}\"; choose all, ${AGENT_HARNESSES.join(\", \")}`);\n    }\n  }\n  const expanded: AgentHarness[] = requested.includes(\"all\")\n    ? global ? [\"claude\", \"codex\"] : [...AGENT_HARNESSES]\n    : [...new Set(requested)] as AgentHarness[];\n  if (global) {\n    const unsupported = expanded.filter((harness) => harness !== \"claude\" && harness !== \"codex\");\n    if (unsupported.length) {\n      throw new Error(`--global supports claude and codex only; ${unsupported.join(\", \")} require a project-local adapter`);\n    }\n  }\n  return expanded;\n}\n\nfunction managedFileContent(path: string, block: string, force: boolean, boundary: string): string {\n  const symlink = symlinkedComponent(boundary, path);\n  if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);\n  if (!existsSync(path)) return `${block}\\n`;\n  const current = readFileSync(path, \"utf8\");\n  const start = \"<!-- odla-ai agent setup:start -->\";\n  const end = \"<!-- odla-ai agent setup:end -->\";\n  const startAt = current.indexOf(start);\n  const endAt = current.indexOf(end);\n  if ((startAt === -1) !== (endAt === -1) || (startAt !== -1 && endAt < startAt)) {\n    throw new Error(`malformed odla-managed section in ${path}`);\n  }\n  if (startAt === -1) {\n    const separator = current.length === 0 || current.endsWith(\"\\n\\n\") ? \"\" : current.endsWith(\"\\n\") ? \"\\n\" : \"\\n\\n\";\n    return `${current}${separator}${block}\\n`;\n  }\n  const afterEnd = endAt + end.length;\n  const existing = current.slice(startAt, afterEnd);\n  if (existing !== block && !force) {\n    throw new Error(`odla-managed section modified locally in ${path}; re-run with --force to replace that section`);\n  }\n  return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;\n}\n\nfunction symlinkedComponent(boundary: string, target: string): string | undefined {\n  const rel = relative(boundary, target);\n  if (rel === \"..\" || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {\n    throw new Error(`agent setup target escapes its install root: ${target}`);\n  }\n  let current = boundary;\n  for (const part of rel.split(sep).filter(Boolean)) {\n    current = join(current, part);\n    try {\n      if (lstatSync(current).isSymbolicLink()) return current;\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") throw error;\n    }\n  }\n  return undefined;\n}\n\nfunction skillNames(files: string[]): string[] {\n  return [...new Set(files.filter((file) => /(^|[\\\\/])SKILL\\.md$/.test(file)).map((file) => file.split(/[\\\\/]/)[0]!))].sort();\n}\n\nfunction listFiles(dir: string): string[] {\n  if (!existsSync(dir)) return [];\n  const results: string[] = [];\n  const walk = (current: string): void => {\n    for (const entry of readdirSync(current, { withFileTypes: true })) {\n      const path = join(current, entry.name);\n      if (entry.isDirectory()) walk(path);\n      else results.push(relative(dir, path));\n    }\n  };\n  walk(dir);\n  return results.sort();\n}\n","/** Shared instruction block inserted into harness-native project files. */\nexport const PROJECT_INSTRUCTIONS = `<!-- odla-ai agent setup:start -->\n## odla agent workflow\n\nFor work that creates an odla app or adds odla services, read and follow\n\\`.agents/skills/odla/SKILL.md\\`. It dispatches an existing static site to\n\\`.agents/skills/odla-migrate/SKILL.md\\`. For production telemetry triage, use\n\\`.agents/skills/odla-o11y-debug/SKILL.md\\`.\n\nThe complete runbooks and their references are installed in this repository.\nDo not fetch online odla documentation as setup context. Network access is only\nneeded when a runbook deliberately calls the odla service, npm, Cloudflare, or\nanother configured provider.\n<!-- odla-ai agent setup:end -->`;\n\n/** Cursor's native rule wrapper around the shared project instructions. */\nexport const CURSOR_RULE = `---\ndescription: Build, migrate, provision, secure, or debug an odla app using the locally installed odla runbooks\nglobs:\nalwaysApply: false\n---\n\n${PROJECT_INSTRUCTIONS}\n`;\n\n/** Build a thin Claude skill that delegates to the canonical offline bundle. */\nexport function claudeAdapter(skill: string, canonical: string): string {\n  const match = canonical.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---/);\n  if (!match) throw new Error(`bundled skill ${skill} has no YAML frontmatter`);\n  const lines = match[1]!.split(/\\r?\\n/);\n  const frontmatter: string[] = [];\n  let keepIndented = false;\n  for (const line of lines) {\n    if (line.startsWith(\"name:\") || line.startsWith(\"description:\")) {\n      frontmatter.push(line);\n      keepIndented = line.startsWith(\"description:\");\n    } else if (keepIndented && /^\\s+/.test(line)) {\n      frontmatter.push(line);\n    } else {\n      keepIndented = false;\n    }\n  }\n  return `---\n${frontmatter.join(\"\\n\")}\n---\n\n# ${skill} (odla adapter)\n\nRead \\`../../../.agents/skills/${skill}/SKILL.md\\` completely and follow it. That\ncanonical local skill owns every reference path and contains the full offline\nrunbook. Do not substitute a remote documentation page for the installed copy.\n`;\n}\n","import { loadProjectConfig, resolveDataExport, serializedEntities } from \"./config\";\nimport { displayPath, readCredentials } from \"./local\";\nimport type { SmokeOptions } from \"./types\";\n\ntype FetchLike = typeof fetch;\n\n/**\n * Verify a live, already-provisioned environment end-to-end. Resolves the target\n * env (`options.env`, else `dev`, else the first declared env) and requires it to\n * be declared in the config. Reads the local credentials file and checks that it\n * belongs to this app and holds a `tenantId` + `dbKey` for the env — otherwise it\n * throws pointing the user at `odla-ai provision --write-dev-vars`.\n *\n * It then makes real network calls: fetches the registry public-config (and, when\n * `ai.provider` is configured, asserts the live provider matches), fetches the\n * live db schema with the db key and asserts every entity from the local schema\n * is present, and runs a `count` aggregate against the first entity to confirm\n * the db answers queries. Progress lines are printed and it ends with `ok`.\n * Read-only — it writes nothing and throws on the first mismatch or failed\n * request.\n *\n * @param options.configPath Path to the `odla.config.mjs`.\n * @param options.env Env to check (default `dev`, else the first declared env).\n * @param options.fetch Injectable `fetch` (for tests/embedding).\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport async function smoke(options: SmokeOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const env = options.env ?? (cfg.envs.includes(\"dev\") ? \"dev\" : (cfg.envs[0] ?? \"prod\"));\n  if (!cfg.envs.includes(env)) throw new Error(`env \"${env}\" is not declared in ${displayPath(cfg.configPath, cfg.rootDir)}`);\n\n  const credentials = readCredentials(cfg.local.credentialsFile);\n  if (!credentials) {\n    throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run \"odla-ai provision --write-dev-vars\".`);\n  }\n  if (credentials.appId !== cfg.app.id) {\n    throw new Error(`local credentials are for app \"${credentials.appId}\", but config app is \"${cfg.app.id}\"`);\n  }\n\n  const entry = credentials.envs[env];\n  if (!entry?.tenantId || !entry.dbKey) {\n    throw new Error(`local credentials have no db key for env \"${env}\". Run \"odla-ai provision --write-dev-vars\".`);\n  }\n\n  const doFetch = options.fetch ?? fetch;\n  out.log(`smoke: ${cfg.app.id}/${env}`);\n  out.log(`  tenant: ${entry.tenantId}`);\n\n  const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), undefined);\n  out.log(`  public-config: ok`);\n\n  if (cfg.ai?.provider) {\n    const provider = ((publicConfig as { ai?: { provider?: unknown } | null }).ai?.provider ?? null) as string | null;\n    if (provider !== cfg.ai.provider) {\n      throw new Error(`ai provider mismatch: expected \"${cfg.ai.provider}\", public-config has \"${provider ?? \"none\"}\"`);\n    }\n    out.log(`  ai: ${provider}`);\n  }\n\n  const expectedSchema = await resolveDataExport<unknown>(cfg, cfg.db?.schema, [\"schema\", \"SCHEMA\"]);\n  const expectedEntities = serializedEntities(expectedSchema);\n  const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);\n  const liveSchema = (liveSchemaPayload as { schema?: unknown }).schema ?? liveSchemaPayload;\n  const liveEntities = serializedEntities(liveSchema);\n  if (expectedEntities.length) {\n    const missing = expectedEntities.filter((entity) => !liveEntities.includes(entity));\n    if (missing.length) throw new Error(`live schema is missing expected entities: ${missing.join(\", \")}`);\n  }\n  out.log(`  schema: ${liveEntities.length} entities`);\n\n  const aggregateEntity = expectedEntities[0] ?? liveEntities[0];\n  if (aggregateEntity) {\n    const aggregate = await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {\n      ns: aggregateEntity,\n      aggregate: { count: true },\n    });\n    const count = (aggregate as { aggregate?: { count?: unknown } }).aggregate?.count;\n    out.log(`  aggregate: ${aggregateEntity}.count=${String(count ?? \"ok\")}`);\n  } else {\n    out.log(`  aggregate: skipped (schema has no entities)`);\n  }\n  out.log(\"ok\");\n}\n\nasync function getJson(doFetch: FetchLike, url: string, bearer: string | undefined): Promise<unknown> {\n  const res = await doFetch(url, {\n    headers: bearer ? { authorization: `Bearer ${bearer}` } : undefined,\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText(res)}`);\n  return res.json();\n}\n\nasync function postJson(doFetch: FetchLike, url: string, bearer: string, body: unknown): Promise<unknown> {\n  const res = await doFetch(url, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${bearer}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify(body),\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText(res)}`);\n  return res.json();\n}\n\nfunction publicConfigUrl(platformUrl: string, appId: string, env: string): string {\n  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/public-config`, platformUrl);\n  url.searchParams.set(\"env\", env);\n  return url.toString();\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return (await res.text()).slice(0, 500);\n  } catch {\n    return \"\";\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,IAAM,mBAAmB,MACvB,OAAO,aAAa,cAChB,IAAI,IAAI,QAAQ,UAAU,EAAE,EAAE,OAC7B,SAAS,iBAAiB,SAAS,cAAc,QAAQ,YAAY,MAAM,WAC1E,SAAS,cAAc,MACvB,IAAI,IAAI,WAAW,SAAS,OAAO,EAAE;AAEtC,IAAM,gBAAgC,iCAAiB;;;ACZ9D,IAAAA,mBAAiD;;;ACAjD,IAAAC,uBAAoB;AACpB,IAAAC,kBAA2B;AAC3B,IAAAC,aAA6B;;;ACF7B,gCAAsB;AACtB,0BAAoB;AAOpB,eAAsB,QAAQ,KAAa,UAA0B,CAAC,GAAkB;AACtF,QAAM,UAAU,UAAU,QAAQ,YAAY,oBAAAC,QAAQ,QAAQ;AAC9D,QAAM,UAAU,QAAQ,aAAa;AACrC,QAAM,IAAI,QAAc,CAACC,UAAS,WAAW;AAC3C,UAAM,QAAQ,QAAQ,QAAQ,KAAK,CAAC,GAAG,QAAQ,MAAM,GAAG,GAAG;AAAA,MACzD,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,SAAS,MAAM;AACxB,YAAM,MAAM;AACZ,MAAAA,SAAQ;AAAA,IACV,CAAC;AAAA,EACH,CAAC;AACH;AAEO,SAAS,UAAU,UAA4D;AACpF,MAAI,aAAa,SAAU,QAAO,EAAE,KAAK,QAAQ,MAAM,CAAC,EAAE;AAC1D,MAAI,aAAa,QAAS,QAAO,EAAE,KAAK,OAAO,MAAM,CAAC,MAAM,SAAS,EAAE,EAAE;AACzE,SAAO,EAAE,KAAK,YAAY,MAAM,CAAC,EAAE;AACrC;;;AC5BA,gBAA6B;AAC7B,IAAAC,uBAAoB;;;ACDpB,qBAA0F;AAC1F,uBAAuD;AAGvD,IAAM,kBAAkB,CAAC,sBAAsB,wBAAwB,WAAW;AAE3E,SAAS,aAAgB,MAAwB;AACtD,MAAI;AACF,WAAO,KAAK,UAAM,6BAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iBAAiB,MAAc,OAAsB;AACnE,mBAAiB,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,CAAI;AAC9D;AAEO,SAAS,gBAAgB,MAAuC;AACrE,MAAI,KAAC,2BAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,UAAM,6BAAa,MAAM,MAAM,CAAC;AAAA,EAC/C,QAAQ;AACN,UAAM,IAAI,MAAM,oBAAoB,IAAI,0DAA0D;AAAA,EACpG;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,OAAQ,MAA2B,UAAU,YACpF,CAAE,MAA2B,QAAQ,OAAQ,MAA2B,SAAS,UAAU;AAC7F,UAAM,IAAI,MAAM,oBAAoB,IAAI,6DAA6D;AAAA,EACvG;AACA,SAAO;AACT;AAEO,SAAS,gBACd,SACA,QACkB;AAClB,QAAM,OAAyB,WAAW;AAAA,IACxC,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB,YAAY,OAAO;AAAA,IACnB,YAAW,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,IACnC,MAAM,CAAC;AAAA,EACT;AACA,OAAK,QAAQ,OAAO;AACpB,OAAK,cAAc,OAAO;AAC1B,OAAK,aAAa,OAAO;AACzB,OAAK,aAAY,oBAAI,KAAK,GAAE,YAAY;AACxC,OAAK,KAAK,OAAO,GAAG,IAAI;AAAA,IACtB,GAAI,KAAK,KAAK,OAAO,GAAG,KAAK,CAAC;AAAA,IAC9B,UAAU,OAAO;AAAA,IACjB,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IAC9C,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,EAC5D;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,SAAiB,aAAuB,CAAC,GAAS;AAChF,QAAM,WAAO,0BAAQ,SAAS,YAAY;AAC1C,QAAM,eAAW,2BAAW,IAAI,QAAI,6BAAa,MAAM,MAAM,IAAI;AACjE,QAAM,aAAa,WAAW,IAAI,CAAC,cAAc,eAAe,SAAS,SAAS,CAAC,EAAE,OAAO,CAAC,SAAyB,CAAC,CAAC,IAAI;AAC5H,QAAM,SAAS,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,UAAU,CAAC,CAAC;AAC/D,QAAM,UAAU,OAAO,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,OAAO,EAAE,SAAS,IAAI,CAAC;AAC/E,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,SAAS,YAAY,CAAC,SAAS,SAAS,IAAI,IAAI,OAAO;AAC7D,oCAAc,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC;AAAA,CAAI;AACnE;AAQO,SAAS,YAAY,KAAmD;AAC7E,MAAI,CAAC,IAAI,SAAS,SAAS,MAAM,EAAG,QAAO;AAC3C,SAAO;AAAA,IACL,UAAU,IAAI,MAAM,YAAY;AAAA,IAChC,SAAS,IAAI,MAAM,WAAW,IAAI,IAAI;AAAA,IACtC,GAAI,IAAI,MAAM,UAAU,EAAE,SAAS,IAAI,KAAK,QAAQ,IAAI,CAAC;AAAA,EAC3D;AACF;AAEO,SAAS,0BAA0B,KAA0B,WAAwD;AAC1H,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI,cAAc,KAAM,QAAO,IAAI,MAAM;AACzC,aAAO,8BAAQ,0BAAQ,IAAI,UAAU,GAAG,SAAS;AACnD;AAEO,SAAS,aAAa,MAAc,aAA+B,KAAa,MAA0B;AAC/G,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2BAA2B,GAAG,QAAQ,IAAI,EAAE;AACxE,QAAM,QAAQ,CAAC,kBAAkB,YAAY,WAAW,GAAG;AAC3D,MAAI,MAAM,MAAO,OAAM,KAAK,kBAAkB,YAAY,UAAU,GAAG;AACvE,QAAM,KAAK,gBAAgB,YAAY,KAAK,KAAK,aAAa,GAAG,KAAK,gBAAgB,MAAM,QAAQ,GAAG;AACvG,MAAI,MAAM,MAAO,OAAM,KAAK,iBAAiB,MAAM,KAAK,GAAG;AAC3D,MAAI,MAAM;AACR,UAAM,KAAK,uBAAuB,KAAK,QAAQ,KAAK,sBAAsB,KAAK,OAAO,GAAG;AACzF,QAAI,KAAK,QAAS,OAAM,KAAK,sBAAsB,KAAK,OAAO,GAAG;AAElE,QAAI,MAAM,UAAW,OAAM,KAAK,oBAAoB,MAAM,SAAS,GAAG;AAAA,EACxE;AACA,QAAM,eAAW,2BAAW,IAAI,QAAI,6BAAa,MAAM,MAAM,IAAI;AACjE,QAAM,WAAW,SAAS,MAAM,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC;AAChF,SAAO,SAAS,GAAG,EAAE,MAAM,GAAI,UAAS,IAAI;AAC5C,QAAM,SAAS,SAAS,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC;AAAA;AAAA,IAAS;AAChE,mBAAiB,MAAM,GAAG,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA,CAAI;AACzD;AAEA,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EAAiB;AAAA,EAAiB;AAAA,EAAe;AAAA,EAAY;AAAA,EAAe;AAAA,EAC5E;AAAA,EAAsB;AAAA,EAAqB;AAAA,EAAqB;AAClE,CAAC;AAED,SAAS,gBAAgB,MAAuB;AAC9C,QAAM,QAAQ,KAAK,MAAM,yCAAyC;AAClE,SAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,IAAI,MAAM,CAAC,CAAC;AACtD;AAEA,SAAS,iBAAiB,MAAc,MAAoB;AAC1D,oCAAU,0BAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,YAAY,GAAG,IAAI,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAC1D,oCAAc,WAAW,MAAM,EAAE,MAAM,IAAM,CAAC;AAC9C,gCAAU,WAAW,GAAK;AAC1B,iCAAW,WAAW,IAAI;AAC5B;AAEO,SAAS,eAAe,SAAiB,MAA6B;AAC3E,QAAM,UAAM,+BAAS,0BAAQ,OAAO,OAAG,0BAAQ,IAAI,CAAC;AACpD,MAAI,CAAC,OAAO,QAAQ,QAAQ,IAAI,WAAW,KAAK,QAAQ,aAAa,UAAU,OAAO,GAAG,EAAE,SAAK,6BAAW,GAAG,EAAG,QAAO;AACxH,SAAO,IAAI,WAAW,MAAM,GAAG;AACjC;AAEO,SAAS,YAAY,MAAc,UAAU,QAAQ,IAAI,GAAW;AACzE,QAAM,UAAM,2BAAS,SAAS,IAAI;AAClC,SAAO,OAAO,CAAC,IAAI,WAAW,IAAI,IAAI,MAAM;AAC9C;;;ADhIA,eAAsB,kBACpB,KACA,SACA,SACA,KACiB;AACjB,MAAI,QAAQ,MAAO,QAAO,QAAQ;AAClC,MAAI,qBAAAC,QAAQ,IAAI,eAAgB,QAAO,qBAAAA,QAAQ,IAAI;AAEnD,QAAM,SAAS,aAAqD,IAAI,MAAM,SAAS;AACvF,MAAI,QAAQ,UAAU,OAAO,aAAa,KAAK,KAAK,IAAI,IAAI,KAAQ;AAClE,QAAI,IAAI,uCAAuC,YAAY,IAAI,MAAM,WAAW,IAAI,OAAO,CAAC,GAAG;AAC/F,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,UAAU,gBAAgB,OAAO;AACvC,QAAM,EAAE,OAAO,UAAU,IAAI,UAAM,wBAAa;AAAA,IAC9C,UAAU,IAAI;AAAA,IACd,OAAO,GAAG,IAAI,IAAI,EAAE;AAAA,IACpB,OAAO;AAAA,IACP,QAAQ,OAAO,EAAE,UAAU,UAAU,MAAM;AACzC,YAAM,cAAc,aAAa,IAAI,aAAa,QAAQ;AAC1D,UAAI,IAAI,EAAE;AACV,UAAI,IAAI,gBAAgB,QAAQ,OAAO,WAAW,WAAW,KAAK,MAAM,YAAY,EAAE,CAAC,IAAI;AAC3F,UAAI,QAAQ,MAAM;AAChB,YAAI;AACF,iBAAO,QAAQ,mBAAmB,SAAS,WAAW;AACtD,cAAI,IAAI,oCAAoC,QAAQ,SAAS,SAAS,YAAY,EAAE,EAAE;AAAA,QACxF,SAAS,KAAK;AACZ,cAAI,IAAI,iCAAiC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QAC9F;AAAA,MACF,WAAW,QAAQ,QAAQ;AACzB,YAAI,IAAI,iCAAiC,QAAQ,MAAM,GAAG;AAAA,MAC5D;AACA,UAAI,IAAI,EAAE;AAAA,IACZ;AAAA,EACF,CAAC;AACD,mBAAiB,IAAI,MAAM,WAAW,EAAE,OAAO,UAAU,CAAC;AAC1D,MAAI,IAAI,iCAAiC,YAAY,IAAI,MAAM,WAAW,IAAI,OAAO,CAAC,GAAG;AACzF,SAAO;AACT;AAEO,SAAS,gBAAgB,SAAyF;AACvH,MAAI,QAAQ,SAAS,KAAM,QAAO,EAAE,MAAM,MAAM,MAAM,SAAS;AAC/D,MAAI,QAAQ,SAAS,MAAO,QAAO,EAAE,MAAM,OAAO,QAAQ,wBAAwB;AAClF,MAAI,qBAAAA,QAAQ,IAAI,GAAI,QAAO,EAAE,MAAM,OAAO,QAAQ,iBAAiB;AAEnE,QAAM,cAAc,QAAQ,eAAe,QAAQ,qBAAAA,QAAQ,MAAM,SAAS,qBAAAA,QAAQ,OAAO,KAAK;AAC9F,MAAI,CAAC,YAAa,QAAO,EAAE,MAAM,OAAO,QAAQ,8CAA8C;AAC9F,SAAO,EAAE,MAAM,MAAM,MAAM,OAAO;AACpC;AAEO,SAAS,aAAa,aAAqB,UAA0B;AAC1E,QAAM,MAAM,IAAI,IAAI,WAAW,WAAW;AAC1C,MAAI,aAAa,IAAI,QAAQ,QAAQ;AACrC,SAAO,IAAI,SAAS;AACtB;;;AFxDO,IAAM,qBAAqB,CAAC,eAAe,sBAAsB,qBAAqB;AA2C7F,eAAsB,uBAAuB,SAAsD;AACjG,QAAM,UAAU,qBAAAC,QAAQ,IAAI;AAC5B,MAAI,QAAS,QAAO;AACpB,SAAO;AAAA,IACL,QAAQ,SAAS,QAAQ,OAAO,EAAE;AAAA,IAClC,QAAQ;AAAA,IACR,EAAE,QAAQ,QAAQ,GAAG,QAAQ;AAAA,IAC7B,QAAQ,SAAS;AAAA,IACjB,QAAQ,UAAU;AAAA,EACpB;AACF;AAOA,eAAsB,QAAQ,SAAwC;AACpE,QAAM,YAAY,QAAQ,YAAY,qBAAAA,QAAQ,IAAI,iBAAiB,mBAAmB,QAAQ,OAAO,EAAE;AACvG,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,QAAQ,QAAQ,WAAW,SAAS,QAAQ,WAAW,mBAAmB,sBAAsB;AACtG,QAAM,QAAQ,QAAQ,SAAS,qBAAAA,QAAQ,IAAI,oBAAqB,MAAM,YAAY,UAAU,OAAO,SAAS,SAAS,GAAG;AACxH,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,mBAAmB;AAEvF,MAAI,QAAQ,WAAW,eAAe;AACpC,UAAMC,OAAM,MAAM,QAAQ,GAAG,QAAQ,qCAAqC,EAAE,QAAQ,CAAC;AACrF,UAAMC,QAAO,MAAM,aAAaD,IAAG;AACnC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAM,SAAS,sCAAsCA,KAAI,QAAQC,KAAI,CAAC;AAC7F,UAAM,cAAc,SAASA,KAAI,KAAK,SAASA,MAAK,WAAW,IAAIA,MAAK,cAAcA;AACtF,QAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,EAAE,YAAY,GAAG,MAAM,CAAC,CAAC;AAAA,QAC7D,YAAW,CAAC,UAAU,MAAM,KAAK,OAAO,QAAQ,SAAS,WAAW,IAAI,cAAc,CAAC,CAAC,GAAG;AAC9F,UAAI,IAAI,GAAG,QAAQ,IAAK,SAAS,MAAM,KAAK,OAAO,QAAQ,OAAO,QAAQ,SAAS,EAAE;AAAA,IACvF;AACA;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,kBAAkB;AACvC,UAAM,WAAW,gBAAgB,QAAQ,kBAAkB;AAC3D,UAAM,QAAQ,MAAM,gBAAgB,OAAO;AAC3C,UAAMD,OAAM,MAAM,QAAQ,GAAG,QAAQ,qCAAqC,mBAAmB,QAAQ,CAAC,IAAI;AAAA,MACxG,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;AAAA,IAChC,CAAC;AACD,UAAMC,QAAO,MAAM,aAAaD,IAAG;AACnC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAM,SAAS,SAAS,QAAQ,wBAAwBA,KAAI,QAAQC,KAAI,CAAC;AAChG,QAAI,IAAI,UAAU,QAAQ,2DAA2D;AACrF;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,QAAQ;AAC7B,UAAMD,OAAM,MAAM,QAAQ,GAAG,QAAQ,kCAAkC,EAAE,QAAQ,CAAC;AAClF,UAAMC,QAAO,MAAM,aAAaD,IAAG;AACnC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAM,SAAS,6BAA6BA,KAAI,QAAQC,KAAI,CAAC;AACpF,UAAM,WAAW,YAAYA,KAAI;AACjC,QAAI,QAAQ,MAAM;AAChB,UAAI,IAAI,KAAK,UAAU,EAAE,SAAS,GAAG,MAAM,CAAC,CAAC;AAC7C;AAAA,IACF;AACA,QAAI,IAAI,4EAAkF;AAC1F,eAAWC,WAAU,UAAU;AAC7B,UAAI,IAAI;AAAA,QACNA,QAAO;AAAA,QACP,OAAOA,QAAO,OAAO;AAAA,QACrBA,QAAO;AAAA,QACPA,QAAO;AAAA,QACP,OAAOA,QAAO,kBAAkB,EAAE;AAAA,QAClC,OAAOA,QAAO,iBAAiB,EAAE;AAAA,QACjC,OAAOA,QAAO,mBAAmB,EAAE;AAAA,MACrC,EAAE,KAAK,GAAI,CAAC;AAAA,IACd;AACA;AAAA,EACF;AAEA,QAAM,UAAU,eAAe,QAAQ,OAAO;AAC9C,MAAI,CAAC,QAAQ,UAAU,KAAK,EAAG,OAAM,IAAI,MAAM,wBAAwB;AACvE,MAAI,CAAC,QAAQ,OAAO,KAAK,EAAG,OAAM,IAAI,MAAM,qBAAqB;AACjE,QAAM,OAAO;AAAA,IACX,UAAU,QAAQ,SAAS,KAAK;AAAA,IAChC,OAAO,QAAQ,MAAM,KAAK;AAAA,IAC1B,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,IACpE,GAAI,QAAQ,kBAAkB,SAAY,CAAC,IAAI,EAAE,eAAe,QAAQ,cAAc;AAAA,IACtF,GAAI,QAAQ,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,QAAQ,gBAAgB;AAAA,IAC5F,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,eAAe;AAAA,EAC3F;AACA,QAAM,MAAM,MAAM,QAAQ,GAAG,QAAQ,kCAAkC,mBAAmB,OAAO,CAAC,IAAI;AAAA,IACpG,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,QAAM,WAAW,MAAM,aAAa,GAAG;AACvC,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,SAAS,UAAU,OAAO,IAAI,IAAI,QAAQ,QAAQ,CAAC;AAChF,QAAM,SAAkC,SAAS,QAAQ,KAAK,SAAS,SAAS,MAAM,IAClF,SAAS,SACT,SAAS,QAAQ,IAAI,WAAW,CAAC;AACrC,MAAI,IAAI,QAAQ,OAAO,KAAK,UAAU,EAAE,OAAO,GAAG,MAAM,CAAC,IAAI,WAAW,OAAO,KAAK,OAAO,OAAO,YAAY,KAAK,QAAQ,CAAC,IAAI,OAAO,OAAO,SAAS,KAAK,KAAK,CAAC,EAAE;AACtK;AAEA,eAAe,YACb,UACA,OACA,SACA,SACA,KACiB;AACjB,QAAM,YAAY,QAAQ,aAAa,GAAG,qBAAAH,QAAQ,IAAI,CAAC;AACvD,QAAM,QAAQ,aAAqG,SAAS;AAC5H,QAAM,SAAS,OAAO,aAAa,WAAW,MAAM,SAAS,KAAK,IAAI;AACtE,MAAI,QAAQ,UAAU,OAAO,aAAa,KAAK,KAAK,IAAI,IAAI,KAAQ;AAClE,QAAI,IAAI,sBAAsB,KAAK,WAAW,SAAS,GAAG;AAC1D,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,EAAE,OAAO,UAAU,IAAI,UAAM,yBAAa;AAAA,IAC9C,UAAU;AAAA,IACV,OAAO,sBAAsB,KAAK;AAAA,IAClC,QAAQ,CAAC,KAAK;AAAA,IACd,OAAO;AAAA,IACP,QAAQ,OAAO,EAAE,UAAU,UAAU,MAAM;AACzC,YAAM,cAAc,aAAa,UAAU,QAAQ;AACnD,UAAI,IAAI,0BAA0B,QAAQ,OAAO,WAAW,WAAW,KAAK,MAAM,YAAY,EAAE,CAAC,IAAI;AACrG,YAAM,aAAa,QAAQ,SAAS,QAAS,QAAQ,SAAS,SAAS,CAAC,qBAAAA,QAAQ,IAAI,MAAM,QAAQ,qBAAAA,QAAQ,MAAM,SAAS,qBAAAA,QAAQ,OAAO,KAAK;AAC7I,UAAI,WAAY,QAAO,QAAQ,mBAAmB,SAAS,WAAW,EAAE,MAAM,MAAM,MAAS;AAAA,IAC/F;AAAA,EACF,CAAC;AACD,QAAM,SAAS,OAAO,aAAa,WAAW,EAAE,GAAI,MAAM,UAAU,CAAC,EAAG,IAAI,CAAC;AAC7E,SAAO,KAAK,IAAI,EAAE,OAAO,UAAU;AACnC,UAAI,4BAAW,GAAG,qBAAAA,QAAQ,IAAI,CAAC,OAAO,EAAG,iBAAgB,qBAAAA,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC;AACnF,mBAAiB,WAAW,EAAE,UAAU,OAAO,CAAC;AAChD,MAAI,IAAI,gBAAgB,KAAK,WAAW,SAAS,cAAc;AAC/D,SAAO;AACT;AAEA,SAAS,eAAe,OAA4C;AAClE,MAAI,CAAC,mBAAmB,SAAS,KAAwB,GAAG;AAC1D,UAAM,IAAI,MAAM,2BAA2B,mBAAmB,KAAK,IAAI,CAAC,EAAE;AAAA,EAC5E;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,OAA8D;AACrF,MAAI,UAAU,eAAe,UAAU,YAAY,UAAU,UAAU;AACrE,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,SAAO;AACT;AAEA,eAAe,gBAAgB,SAA0C;AACvE,MAAI,QAAQ,WAAW,QAAQ,MAAO,OAAM,IAAI,MAAM,6CAA6C;AACnG,MAAI;AACJ,MAAI,QAAQ,QAAS,SAAQ,qBAAAA,QAAQ,IAAI,QAAQ,OAAO;AAAA,WAC/C,QAAQ,MAAO,SAAQ,OAAO,QAAQ,aAAa,WAAW;AAAA,MAClE,OAAM,IAAI,MAAM,qGAAqG;AAC1H,UAAQ,OAAO,QAAQ,YAAY,EAAE;AACrC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,QAAQ,UAAU,wBAAwB,QAAQ,OAAO,uBAAuB,2BAA2B;AACvI,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,KAAK,KAAM,OAAM,IAAI,MAAM,2BAA2B;AACvG,SAAO;AACT;AAEA,eAAe,YAA6B;AAC1C,MAAI,QAAQ;AACZ,mBAAiB,SAAS,qBAAAA,QAAQ,OAAO;AACvC,aAAS,OAAO,KAAK;AACrB,QAAI,MAAM,SAAS,KAAK,KAAM,OAAM,IAAI,MAAM,2BAA2B;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA+C;AAClE,MAAI,SAAS,IAAI,KAAK,MAAM,QAAQ,KAAK,QAAQ,EAAG,QAAO,KAAK,SAAS,OAAO,QAAQ;AACxF,MAAI,SAAS,IAAI,KAAK,SAAS,KAAK,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,QAAQ,EAAE,OAAO,QAAQ;AAClG,QAAM,IAAI,MAAM,iDAAiD;AACnE;AAEA,eAAe,aAAa,KAAiC;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,MAAI;AAAE,WAAO,KAAK,MAAM,IAAI;AAAA,EAAc,QAAQ;AAAE,WAAO,EAAE,SAAS,KAAK,MAAM,GAAG,GAAG,EAAE;AAAA,EAAG;AAC9F;AAEA,SAAS,SAAS,QAAgB,QAAgB,MAAuB;AACvE,QAAM,QAAQ,SAAS,IAAI,KAAK,SAAS,KAAK,KAAK,IAAI,KAAK,QAAQ;AACpE,QAAM,UAAU,SAAS,OAAO,MAAM,YAAY,WAAW,MAAM,UAAU,SAAS,IAAI,KAAK,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AACjJ,SAAO,GAAG,MAAM,YAAY,MAAM,MAAM,OAAO;AACjD;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AIvOO,SAAS,UAAU,MAA4B;AACpD,QAAM,cAAwB,CAAC;AAC/B,QAAM,UAAuC,CAAC;AAC9C,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,CAAC,IAAI,WAAW,IAAI,GAAG;AACzB,kBAAY,KAAK,GAAG;AACpB;AAAA,IACF;AACA,UAAM,KAAK,IAAI,QAAQ,GAAG;AAC1B,UAAM,UAAU,IAAI,MAAM,GAAG,OAAO,KAAK,SAAY,EAAE;AACvD,QAAI,CAAC,QAAS;AACd,QAAI,QAAQ,WAAW,KAAK,GAAG;AAC7B,cAAQ,QAAQ,MAAM,CAAC,CAAC,IAAI;AAC5B;AAAA,IACF;AACA,QAAI,OAAO,IAAI;AACb,gBAAU,SAAS,SAAS,IAAI,MAAM,KAAK,CAAC,CAAC;AAC7C;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,IAAI,CAAC;AACxB,QAAI,UAAU,UAAa,CAAC,MAAM,WAAW,IAAI,GAAG;AAClD;AACA,gBAAU,SAAS,SAAS,KAAK;AAAA,IACnC,OAAO;AACL,gBAAU,SAAS,SAAS,IAAI;AAAA,IAClC;AAAA,EACF;AACA,SAAO,EAAE,aAAa,QAAQ;AAChC;AAEO,SAAS,WAAW,QAAoB,gBAA0B,gBAA8B;AACrG,QAAM,UAAU,IAAI,IAAI,cAAc;AACtC,aAAW,QAAQ,OAAO,KAAK,OAAO,OAAO,GAAG;AAC9C,QAAI,CAAC,QAAQ,IAAI,IAAI,EAAG,OAAM,IAAI,MAAM,qBAAqB,IAAI,6CAA6C;AAAA,EAChH;AACA,MAAI,OAAO,YAAY,SAAS,gBAAgB;AAC9C,UAAM,IAAI,MAAM,wBAAwB,OAAO,YAAY,cAAc,CAAC,uBAAuB;AAAA,EACnG;AACF;AAEO,SAAS,eAAe,OAAgC,MAAsB;AACnF,QAAM,SAAS,UAAU,KAAK;AAC9B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,GAAG,IAAI,cAAc;AAClD,SAAO;AACT;AAEO,SAAS,UAAU,OAAoD;AAC5E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,MAAM,SAAS,CAAC;AACvD,SAAO;AACT;AAEO,SAAS,QAAQ,OAAsD;AAC5E,MAAI,UAAU,UAAa,OAAO,UAAU,UAAW,QAAO;AAC9D,QAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACpD,SAAO,OAAO,QAAQ,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,OAAO;AAC5F;AAEO,SAAS,QAAQ,OAAqD;AAC3E,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,MAAI,OAAO,UAAU,aAAa,UAAU,UAAU,UAAU,SAAU,QAAO,UAAU;AAC3F,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,MAAM,sCAAsC;AACxD;AAEO,SAAS,UAAU,OAAgC,MAAkC;AAC1F,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,MAAM,UAAU,KAAK;AAC3B,QAAM,SAAS,QAAQ,SAAY,OAAO,MAAM,OAAO,GAAG;AAC1D,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,8BAA8B;AACtG,SAAO;AACT;AAEA,SAAS,UAAU,SAAsC,MAAc,OAA+B;AACpG,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,YAAY,OAAW,SAAQ,IAAI,IAAI;AAAA,WAClC,MAAM,QAAQ,OAAO,EAAG,SAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,MACtD,SAAQ,IAAI,IAAI,CAAC,OAAO,OAAO,GAAG,OAAO,KAAK,CAAC;AACtD;;;ACrFO,IAAM,eAAe;AAAA,EAC1B,KAAK;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAKO,SAAS,kBAAkB,OAAO,OAAO,MAAc,SAAe;AAC3E,MAAI,MAAM;AACR,QAAI,IAAI,KAAK,UAAU,cAAc,MAAM,CAAC,CAAC;AAC7C;AAAA,EACF;AACA,MAAI,IAAI,mCAAmC;AAC3C,aAAW,KAAK,iBAAiB,aAAa,GAAG;AACjD,aAAW,KAAK,+BAA+B,aAAa,KAAK;AACjE,aAAW,KAAK,qBAAqB,aAAa,KAAK;AACvD,aAAW,KAAK,UAAU,aAAa,MAAM;AAC/C;AAEA,SAAS,WAAW,KAAa,SAAiB,OAAgC;AAChF,MAAI,IAAI,GAAG,OAAO,GAAG;AACrB,aAAW,QAAQ,MAAO,KAAI,IAAI,OAAO,IAAI,EAAE;AAC/C,MAAI,IAAI,EAAE;AACZ;;;AClDA,IAAAI,kBAAyC;AACzC,IAAAC,oBAA6C;AAC7C,sBAA8B;AAG9B,IAAM,mBAAmB;AAEzB,IAAM,eAAe,CAAC,KAAK;AAC3B,IAAM,mBAAmB,CAAC,MAAM,IAAI;AAEpC,eAAsB,kBAAkB,aAAa,mBAAiD;AACpG,QAAM,eAAW,2BAAQ,UAAU;AACnC,MAAI,KAAC,4BAAW,QAAQ,GAAG;AACzB,UAAM,IAAI,MAAM,qBAAqB,UAAU,8CAA8C;AAAA,EAC/F;AAEA,QAAM,MAAM,MAAM,iBAAiB,QAAQ;AAC3C,QAAM,cAAU,2BAAQ,QAAQ;AAChC,oBAAkB,KAAK,QAAQ;AAE/B,QAAM,cAAc,UAAU,QAAQ,IAAI,qBAAqB,IAAI,eAAe,gBAAgB;AAClG,QAAM,aAAa,UAAU,QAAQ,IAAI,oBAAoB,IAAI,cAAc,WAAW;AAC1F,QAAM,OAAO,OAAO,IAAI,MAAM,SAAS,IAAI,OAAO,YAAY;AAC9D,QAAM,WAAW,OAAO,IAAI,UAAU,SAAS,IAAI,WAAW,gBAAgB;AAC9E,QAAM,QAAQ;AAAA,IACZ,eAAW,2BAAQ,SAAS,IAAI,OAAO,aAAa,sBAAsB;AAAA,IAC1E,qBAAiB,2BAAQ,SAAS,IAAI,OAAO,mBAAmB,8BAA8B;AAAA,IAC9F,iBAAa,2BAAQ,SAAS,IAAI,OAAO,eAAe,WAAW;AAAA,IACnE,WAAW,IAAI,OAAO,aAAa;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,KACA,OACA,OACwB;AACxB,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,MAAO,QAAO;AACrE,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,aAAS,8BAAW,KAAK,IAAI,YAAQ,2BAAQ,IAAI,SAAS,KAAK;AACrE,MAAI,OAAO,SAAS,OAAO,GAAG;AAC5B,WAAO,KAAK,UAAM,8BAAa,QAAQ,MAAM,CAAC;AAAA,EAChD;AACA,QAAM,MAAO,MAAM,WAAO,+BAAc,MAAM,EAAE;AAChD,aAAW,QAAQ,OAAO;AACxB,QAAI,IAAI,IAAI,MAAM,OAAW,QAAO,IAAI,IAAI;AAAA,EAC9C;AACA,MAAI,IAAI,YAAY,OAAW,QAAO,IAAI;AAC1C,QAAM,IAAI,MAAM,GAAG,KAAK,mBAAmB,MAAM,KAAK,IAAI,CAAC,aAAa;AAC1E;AAEO,SAAS,UAAU,KAAyC;AACjE,SAAO;AAAA,IACL,OAAO,IAAI,IAAI;AAAA,IACf,SAAS,IAAI,IAAI;AAAA,IACjB,aAAa,IAAI;AAAA,IACjB,YAAY,IAAI;AAAA,IAChB,MAAM,IAAI;AAAA,IACV,UAAU,IAAI;AAAA,IACd,WAAW,CAAC,CAAC,IAAI,IAAI;AAAA,IACrB,UAAU,CAAC,CAAC,IAAI,IAAI,SAAU,CAAC,CAAC,IAAI,IAAI,UAAU,IAAI,GAAG,iBAAiB;AAAA,IAC1E,YAAY,IAAI,IAAI;AAAA,EACtB;AACF;AAEO,SAAS,gBAAgB,QAA2B;AACzD,QAAM,WAAW,mBAAmB,MAAM;AAC1C,SAAO,OAAO;AAAA,IACZ,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,SAAS,QAAQ,SAAS,QAAQ,SAAS,QAAQ,QAAQ,CAAC,CAAC;AAAA,EACrG;AACF;AAEO,SAAS,mBAAmB,QAA2B;AAC5D,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO,CAAC;AACnD,QAAM,WAAY,OAAkC;AACpD,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AAClF,SAAO,OAAO,KAAK,QAAQ;AAC7B;AAEO,SAAS,SAAS,OAA+C;AACtE,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO,QAAQ,IAAI,MAAM,MAAM,CAAC,CAAC;AAC5D,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAc,MAAgD;AACvF,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,wBAAwB;AACpF,QAAM,MAAM;AACZ,MAAI,CAAC,IAAI,OAAO,OAAO,IAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,sBAAsB;AAC1F,MAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,0DAA0D;AAC3G,MAAI,CAAC,IAAI,IAAI,QAAQ,OAAO,IAAI,IAAI,SAAS,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,wBAAwB;AACtG,MAAI,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6DAA6D;AAClI;AAEA,SAAS,QAAQ,OAAiC;AAChD,SAAO,OAAO,UAAU,YAAY,uBAAuB,KAAK,KAAK;AACvE;AAEA,eAAe,iBAAiB,MAA0C;AACxE,MAAI,KAAK,SAAS,OAAO,EAAG,QAAO,KAAK,UAAM,8BAAa,MAAM,MAAM,CAAC;AACxE,QAAM,MAAO,MAAM,OAAO,OAAG,+BAAc,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI,CAAC;AAIrE,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,OAAO,UAAU,WAAY,QAAO,MAAM,MAAM;AACpD,SAAO;AACT;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,MAAM,QAAQ,QAAQ,EAAE;AACjC;AAEA,SAAS,OAAO,QAA4B;AAC1C,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,CAAC,CAAC;AAC5C;;;AC/HA,IAAAC,6BAA6B;AAC7B,IAAAC,kBAAyC;AACzC,IAAAC,oBAA8B;;;ACG9B,IAAM,eAAwC;AAAA,EAC5C,CAAC,kCAAkC,oBAAoB;AAAA,EACvD,CAAC,kCAAkC,kBAAkB;AAAA,EACrD,CAAC,yBAAyB,eAAe;AAAA,EACzC,CAAC,4BAA4B,kBAAkB;AAAA,EAC/C,CAAC,wBAAwB,iBAAiB;AAAA,EAC1C,CAAC,yCAAyC,eAAe;AAAA,EACzD,CAAC,wBAAwB,gBAAgB;AAC3C;AAaO,SAAS,cAAc,OAAuB;AACnD,MAAI,SAAS;AACb,aAAW,CAAC,SAAS,WAAW,KAAK,aAAc,UAAS,OAAO,QAAQ,SAAS,WAAW;AAC/F,SAAO;AACT;AAGO,SAAS,YAAY,OAAwB;AAClD,SAAO,cAAc,KAAK,MAAM,SAAS,MAAM,SAAS,YAAY;AACtE;;;ACnCA,IAAAC,6BAAsB;AACtB,IAAAC,kBAAyC;AACzC,IAAAC,oBAAqB;AAWd,IAAM,gBAA+B,CAAC,KAAK,MAAM,SACtD,IAAI,QAAQ,CAAC,gBAAgB,WAAW;AACtC,QAAM,YAAQ,kCAAM,KAAK,MAAM,EAAE,KAAK,MAAM,KAAK,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAClF,MAAI,SAAS;AACb,MAAI,SAAS;AACb,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,UAAU,MAAM,SAAS,CAAE;AACvE,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,UAAU,MAAM,SAAS,CAAE;AACvE,QAAM,GAAG,SAAS,MAAM;AACxB,QAAM,GAAG,SAAS,CAAC,SAAS,eAAe,EAAE,MAAM,QAAQ,GAAG,QAAQ,OAAO,CAAC,CAAC;AAC/E,QAAM,MAAM,IAAI,MAAM,SAAS,EAAE;AACnC,CAAC;AAEH,IAAM,wBAAwB,CAAC,kBAAkB,iBAAiB,eAAe;AAE1E,SAAS,mBAAmB,SAAgC;AACjE,aAAW,QAAQ,uBAAuB;AACxC,UAAM,WAAO,wBAAK,SAAS,IAAI;AAC/B,YAAI,4BAAW,IAAI,EAAG,QAAO;AAAA,EAC/B;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,MAA8C;AAC/E,MAAI,KAAK,SAAS,OAAO,EAAG,QAAO;AACnC,MAAI;AACF,WAAO,KAAK,MAAM,sBAAkB,8BAAa,MAAM,MAAM,CAAC,CAAC;AAAA,EACjE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,kBAAkB,MAAsB;AACtD,MAAI,SAAS;AACb,MAAI,WAAW;AACf,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,KAAK,KAAK,CAAC;AACjB,QAAI,UAAU;AACZ,gBAAU;AACV,UAAI,OAAO,MAAM;AACf,kBAAU,KAAK,IAAI,CAAC,KAAK;AACzB;AAAA,MACF,WAAW,OAAO,KAAK;AACrB,mBAAW;AAAA,MACb;AACA;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,iBAAW;AACX,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACrC,aAAO,IAAI,KAAK,UAAU,KAAK,CAAC,MAAM,KAAM;AAC5C,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACrC,WAAK;AACL,aAAO,IAAI,KAAK,UAAU,EAAE,KAAK,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAM;AACrE;AACA;AAAA,IACF;AACA,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAEA,eAAsB,iBAAiB,KAAoB,KAA+B;AACxF,MAAI;AACF,UAAM,SAAS,MAAM,IAAI,OAAO,CAAC,YAAY,QAAQ,GAAG,EAAE,IAAI,CAAC;AAC/D,WAAO,OAAO,SAAS,KAAK,CAAC,qBAAqB,KAAK,GAAG,OAAO,MAAM,GAAG,OAAO,MAAM,EAAE;AAAA,EAC3F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,kBACd,KACA,MACoB;AACpB,QAAM,OAAO,CAAC,YAAY,UAAU,OAAO,KAAK,MAAM,GAAI,KAAK,MAAM,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,CAAE;AAC9F,SAAO,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,OAAO,KAAK,KAAK,IAAI,CAAC;AAC9D;;;AFrFO,SAAS,UAAU,OAA6B,UAAoB,YAAgC;AACzG,QAAM,WAAqB,CAAC;AAC5B,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,CAAC,IAAI,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,UAAI,OAAO,SAAS,YAAY,KAAK,KAAK,MAAM,OAAQ;AACxD,UAAI,WAAW,UAAU,WAAW,SAAS,EAAE,EAAG;AAClD,eAAS;AAAA,QACP,WAAW,SACP,SAAS,EAAE,4CAAuC,EAAE,mCACpD,SAAS,EAAE,IAAI,MAAM,oCAA+B,MAAM,IAAI,EAAE;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,aAAW,UAAU,UAAU;AAC7B,QAAI,EAAE,UAAU,OAAQ,UAAS,KAAK,kBAAkB,MAAM,iDAAiD;AAAA,EACjH;AACA,SAAO;AACT;AAIA,IAAM,cAAwB,CAAC,KAAK,MAAM,YAAQ,yCAAa,KAAK,MAAM,EAAE,KAAK,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAGjI,SAAS,mBAAmB,SAAiB,OAAiB,aAAa,aAAuB,CAAC,GAAa;AACrH,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,WACZ,IAAI,CAAC,SAAS,eAAe,SAAS,IAAI,CAAC,EAC3C,OAAO,CAAC,SAAyB,CAAC,CAAC,IAAI;AAC1C,aAAS,KAAK,OAAO,CAAC,YAAY,MAAM,aAAa,SAAS,GAAG,MAAM,GAAG,OAAO;AAAA,EACnF,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,SAAO,OACJ,MAAM,OAAO,EACb,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,GAAG,IAAI,kDAA6C,IAAI,wCAAwC;AACnH;AAGO,SAAS,iBAAiB,SAA2B;AAC1D,QAAM,aAAa,mBAAmB,OAAO;AAC7C,MAAI,CAAC,WAAY,QAAO,CAAC;AACzB,QAAM,SAAS,mBAAmB,UAAU;AAC5C,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,WAAqB,CAAC;AAC5B,QAAM,SAAmE,CAAC,EAAE,OAAO,IAAI,OAAO,OAAO,CAAC;AACtG,QAAM,OAAO,OAAO;AACpB,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,UAAI,SAAS,OAAO,UAAU,SAAU,QAAO,KAAK,EAAE,OAAO,OAAO,IAAI,KAAK,MAAwC,CAAC;AAAA,IACxH;AAAA,EACF;AAEA,aAAW,EAAE,OAAO,MAAM,KAAK,QAAQ;AACrC,UAAM,SAAS,MAAM;AACrB,QAAI,QAAQ,WAAW;AACrB,YAAM,UAAM,2BAAQ,SAAS,OAAO,SAAS;AAC7C,UAAI,YAAQ,2BAAQ,OAAO,GAAG;AAC5B,iBAAS,KAAK,GAAG,KAAK,uHAAkH;AAAA,MAC1I,eAAW,gCAAW,wBAAK,KAAK,cAAc,CAAC,GAAG;AAChD,iBAAS,KAAK,GAAG,KAAK,oGAA+F;AAAA,MACvH;AAAA,IACF;AACA,UAAM,OAAO,MAAM;AACnB,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,YAAI,SAAS,kBAAkB,SAAS,qBAAsB,OAAO,UAAU,YAAY,YAAY,KAAK,GAAI;AAC9G,mBAAS,KAAK,YAAY,KAAK,QAAQ,IAAI,0FAAqF;AAAA,QAClI;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,gBAAgB,OAAO;AACnC,MAAI,OAAO,OAAO,IAAI,YAAY,YAAY,IAAI,WAAW,YAAa,IAAI,SAAqC;AACjH,aAAS,KAAK,6FAAwF;AAAA,EACxG;AACA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAA2B;AAC7D,QAAM,WAAqB,CAAC;AAC5B,QAAM,MAAM,gBAAgB,OAAO;AACnC,QAAM,eAAe,KAAK;AAC1B,QAAM,kBAAkB,KAAK;AAC7B,MAAI,CAAC,eAAe,eAAe,GAAG;AACpC,aAAS;AAAA,MACP,kBAAkB,eAAe,IAC7B,gGACA;AAAA,IACN;AAAA,EACF;AAEA,QAAM,aAAa,mBAAmB,OAAO;AAC7C,QAAM,SAAS,aAAa,mBAAmB,UAAU,IAAI;AAC7D,MAAI,CAAC,cAAc,CAAC,QAAQ;AAC1B,aAAS,KAAK,6FAAwF;AACtG,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OAAO,OAAO,SAAS,eAAW,2BAAQ,SAAS,OAAO,IAAI,IAAI;AAC/E,MAAI,CAAC,QAAQ,KAAC,4BAAW,IAAI,GAAG;AAC9B,aAAS,KAAK,yFAAoF;AAAA,EACpG,OAAO;AACL,QAAI,SAAS;AACb,QAAI;AACF,mBAAS,8BAAa,MAAM,MAAM;AAAA,IACpC,QAAQ;AAAA,IAER;AACA,QAAI,CAAC,wBAAwB,KAAK,MAAM,GAAG;AACzC,eAAS,KAAK,uBAAuB,OAAO,IAAc,uCAAuC;AAAA,IACnG;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,QAAQ,OAAO,mBAAmB,IAAI,OAAO,sBAAsB,CAAC;AACxF,MAAI,CAAC,MAAM,SAAS,eAAe,GAAG;AACpC,aAAS,KAAK,mFAAmF;AAAA,EACnG;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAiD;AACxE,MAAI;AACF,WAAO,KAAK,UAAM,kCAAa,wBAAK,SAAS,cAAc,GAAG,MAAM,CAAC;AAAA,EACvE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AGtHA,eAAsB,OAAO,SAAuC;AAClE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,OAAO,UAAU,GAAG;AAC1B,QAAM,QAAQ,IAAI,SAAS,SAAS,IAAI;AACxC,QAAM,SAAS,QAAQ,MAAM,kBAA2B,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,QAAQ,CAAC,IAAI;AACrG,QAAM,kBAAkB,QACpB,MAAM,kBAA4B,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,OAAO,CAAC,IACxE;AACJ,QAAM,QAAQ,oBAAoB,UAAU,IAAI,IAAI,iBAAiB,QAAQ,gBAAgB,MAAM,IAAI;AACvG,QAAM,WAAW,mBAAmB,MAAM;AAE1C,MAAI,IAAI,WAAW,IAAI,UAAU,EAAE;AACnC,MAAI,IAAI,WAAW,KAAK,OAAO,KAAK,KAAK,KAAK,GAAG;AACjD,MAAI,IAAI,WAAW,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE;AACzC,MAAI,IAAI,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE;AAC7C,MAAI,IAAI,WAAW,SAAS,GAAG,SAAS,MAAM,cAAc,MAAM,EAAE;AACpE,MAAI,IAAI,WAAW,QAAQ,GAAG,OAAO,KAAK,KAAK,EAAE,MAAM,gBAAgB,MAAM,EAAE;AAC/E,MAAI,IAAI,WAAW,IAAI,SAAS,SAAS,IAAI,IAAK,IAAI,IAAI,YAAY,mBAAoB,aAAa,EAAE;AAEzG,QAAM,WAAqB,CAAC;AAC5B,MAAI,UAAU,SAAS,WAAW,EAAG,UAAS,KAAK,wBAAwB;AAC3E,MAAI,OAAO;AACT,eAAW,MAAM,OAAO,KAAK,KAAK,GAAG;AACnC,UAAI,SAAS,SAAS,KAAK,CAAC,SAAS,SAAS,EAAE,EAAG,UAAS,KAAK,kBAAkB,EAAE,qCAAqC;AAAA,IAC5H;AAAA,EACF;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,KAAK,CAAC,IAAI,IAAI,SAAU,UAAS,KAAK,kDAAkD;AACtH,MAAI,IAAI,MAAM,OAAO;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,KAAK,KAAK,GAAG;AACzD,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,MAAM,CAAC,CAAC,GAAG;AACtF,iBAAS,KAAK,cAAc,GAAG,6BAA6B,KAAK,EAAE;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,IAAI,IAAI,GAAG,MAAM,GAAG;AAChF,aAAS,KAAK,GAAG,IAAI,GAAG,MAAM,uDAAuD;AAAA,EACvF;AACA,MAAI,IAAI,SAAS,SAAS,MAAM,GAAG;AAEjC,UAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,eAAW,OAAO,IAAI,MAAM;AAC1B,UAAI,CAAC,aAAa,KAAK,GAAG,GAAG,WAAW;AACtC,iBAAS,KAAK,4BAA4B,GAAG,kEAA6D;AAAA,MAC5G;AAAA,IACF;AACA,aAAS,KAAK,GAAG,oBAAoB,IAAI,OAAO,CAAC;AAAA,EACnD;AACA,WAAS,KAAK,GAAG,UAAU,OAAO,UAAU,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC;AACrE,WAAS,KAAK,GAAG,mBAAmB,IAAI,SAAS,QAAW;AAAA,IAC1D,IAAI,MAAM;AAAA,IACV,IAAI,MAAM;AAAA,IACV,IAAI,MAAM;AAAA,EACZ,CAAC,CAAC;AACF,WAAS,KAAK,GAAG,iBAAiB,IAAI,OAAO,CAAC;AAE9C,MAAI,SAAS,QAAQ;AACnB,QAAI,IAAI,EAAE;AACV,QAAI,IAAI,WAAW;AACnB,eAAW,WAAW,SAAU,KAAI,IAAI,OAAO,OAAO,EAAE;AAAA,EAC1D,OAAO;AACL,QAAI,IAAI,IAAI;AAAA,EACd;AACF;;;AC9FA,IAAAC,kBAAqD;AACrD,IAAAC,oBAAiC;AAwC1B,SAAS,YAAY,SAA4B;AACtD,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,cAAU,2BAAQ,QAAQ,WAAW,QAAQ,IAAI,CAAC;AACxD,QAAM,iBAAa,2BAAQ,SAAS,QAAQ,cAAc,iBAAiB;AAC3E,UAAI,4BAAW,UAAU,KAAK,CAAC,QAAQ,OAAO;AAC5C,UAAM,IAAI,MAAM,GAAG,UAAU,6CAA6C;AAAA,EAC5E;AACA,MAAI,CAAC,uBAAuB,KAAK,QAAQ,KAAK,GAAG;AAC/C,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAGA,QAAM,OAAO,QAAQ,MAAM,SAAS,QAAQ,OAAO,CAAC,KAAK;AACzD,QAAM,WAAW,QAAQ,UAAU,SAAS,QAAQ,WAAW,CAAC,MAAM,IAAI;AAC1E,QAAM,aAAa,QAAQ,cAAc;AAEzC,qCAAU,2BAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,qCAAU,2BAAQ,SAAS,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3D,qCAAU,2BAAQ,SAAS,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAExD,qCAAc,YAAY,eAAe,EAAE,OAAO,QAAQ,OAAO,MAAM,QAAQ,MAAM,MAAM,UAAU,WAAW,CAAC,CAAC;AAClH,qBAAe,2BAAQ,SAAS,qBAAqB,GAAG,eAAe,CAAC;AACxE,qBAAe,2BAAQ,SAAS,oBAAoB,GAAG,cAAc,CAAC;AACtE,kBAAgB,OAAO;AAEvB,MAAI,IAAI,WAAW,gBAAgB,YAAY,OAAO,CAAC,EAAE;AACzD,MAAI,IAAI,oDAAoD;AAC5D,MAAI,IAAI,+CAA+C;AACzD;AAEA,SAAS,eAAe,MAAc,MAAoB;AACxD,UAAI,4BAAW,IAAI,EAAG;AACtB,qCAAc,MAAM,IAAI;AAC1B;AAEA,SAAS,eAAe,OAAwG;AAC9H,SAAO;AAAA;AAAA;AAAA;AAAA,WAIE,MAAM,KAAK;AAAA,aACT,MAAM,KAAK,QAAQ,MAAM,KAAK,CAAC;AAAA;AAAA,UAElC,KAAK,UAAU,MAAM,IAAI,CAAC;AAAA,cACtB,KAAK,UAAU,MAAM,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iDAQK,MAAM,UAAU;AAAA;AAAA;AAAA,eAGlD,cAAc,MAAM,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAW3B,MAAM,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAc9B;AAEA,SAAS,iBAAyB;AAChC,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeT;AAEA,SAAS,gBAAwB;AAC/B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUT;AAEA,SAAS,cAAc,UAA0B;AAC/C,MAAI,aAAa,SAAU,QAAO;AAClC,MAAI,aAAa,SAAU,QAAO;AAClC,SAAO;AACT;AAEA,SAAS,gBAAgB,MAAc,SAAyB;AAC9D,SAAO,KAAK,WAAW,OAAO,IAAI,KAAK,MAAM,QAAQ,SAAS,CAAC,IAAI;AACrE;;;AClKA,IAAAC,eAA8C;AAC9C,gBAAgD;AAChD,IAAAC,uBAAoB;;;ACFpB,kBAA4B;AAoB5B,eAAsB,wBAAwB,MAAiE;AAC7G,QAAM,eAAW,yBAAY,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG;AACtD,QAAM,QAAQ,KAAK,aAAa,KAAK,KAAK,GAAG;AAC7C,MAAI,cAAc,KAAK;AACvB,MAAI,QAAQ,KAAK,IAAI,SAAS,SAAS,IAAI,KAAK,CAAC,KAAK,WAAW,OAAO,QAAQ;AAChF,MAAI,YAAY,KAAK,IAAI,SAAS,SAAS,MAAM,KAAK,CAAC,KAAK,aAAa,OAAO,YAAY;AAE5F,MAAI,KAAK,IAAI,SAAS,SAAS,IAAI,GAAG;AACpC,QAAI,OAAO;AACT,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,8BAA8B,QAAQ,EAAE;AAAA,IACrE,OAAO;AACL,cAAQ,MAAM,UAAU,MAAM,QAAQ;AACtC,oBAAc,KAAK,MAAM,aAAa,UAAU,EAAE,MAAM,CAAC;AACzD,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,uBAAuB,QAAQ,EAAE;AAAA,IAC9D;AAAA,EACF;AAEA,MAAI,KAAK,IAAI,SAAS,SAAS,MAAM,GAAG;AACtC,QAAI,WAAW;AACb,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,mCAAmC;AAAA,IAChE,OAAO;AACL,kBAAY,MAAM,eAAe,IAAI;AACrC,oBAAc,KAAK,MAAM,aAAa,UAAU,EAAE,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAI,UAAU,CAAC;AAC1F,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,KAAK,KAAK,aAAa,YAAY,QAAQ,oBAAoB;AAAA,IAC5F;AAAA,EACF;AAEA,SAAO,KAAK,MAAM,aAAa,UAAU;AAAA,IACvC,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,EACnC,CAAC;AACH;AAEA,SAAS,KACP,MACA,SACA,UACA,QACkB;AAClB,QAAM,OAAO,gBAAgB,SAAS;AAAA,IACpC,OAAO,KAAK,IAAI,IAAI;AAAA,IACpB,aAAa,KAAK,IAAI;AAAA,IACtB,YAAY,KAAK,IAAI;AAAA,IACrB,KAAK,KAAK;AAAA,IACV;AAAA,IACA,GAAG;AAAA,EACL,CAAC;AACD,MAAI,KAAK,MAAO,kBAAiB,KAAK,IAAI,MAAM,iBAAiB,IAAI;AACrE,SAAO;AACT;AAEA,eAAe,UAAU,MAAsC,UAAmC;AAChG,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,cAAc,IAAI,gBAAgB,mBAAmB;AACrG,MAAI,MAAM,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe,mBAAmB,QAAQ,CAAC,SAAS;AAAA,IACnG,QAAQ;AAAA,IACR;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,UAAU,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB,MAAM,KAAK,QAAQ,SAAS,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,GAAG;AAAA,QACjF,OAAO;AAAA,MACT,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,OAAM,IAAI,MAAM,kBAAkB,QAAQ,aAAa,QAAQ,MAAM,IAAI,MAAM,SAAS,OAAO,CAAC,EAAE;AACnH,UAAM,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe,mBAAmB,QAAQ,CAAC,SAAS;AAAA,MAC/F,QAAQ;AAAA,MACR;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,gBAAgB,QAAQ,aAAa,IAAI,MAAM,IAAI,MAAM,SAAS,GAAG,CAAC,EAAE;AACrG,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,IAAK,OAAM,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB;AAC1E,SAAO,KAAK;AACd;AAEA,eAAe,eAAe,MAAuD;AACnF,QAAM,SAAS,KAAK,aAAa,YAAY;AAC7C,QAAM,MAAM,MAAM,KAAK;AAAA,IACrB,GAAG,KAAK,IAAI,WAAW,SAAS,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC,SAAS,MAAM,QAAQ,mBAAmB,KAAK,GAAG,CAAC;AAAA,IACtH,EAAE,QAAQ,QAAQ,SAAS,EAAE,eAAe,UAAU,KAAK,cAAc,GAAG,EAAE;AAAA,EAChF;AACA,MAAI,IAAI,WAAW,OAAO,CAAC,KAAK,YAAY;AAC1C,UAAM,IAAI;AAAA,MACR,sCAAsC,KAAK,GAAG;AAAA,IAEhD;AAAA,EACF;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,cAAc,KAAK,aAAa,aAAa,OAAO,KAAK,KAAK,GAAG,aAAa,IAAI,MAAM,IAAI,MAAM,SAAS,GAAG,CAAC,EAAE;AAC9I,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,MAAO,OAAM,IAAI,MAAM,cAAc,KAAK,aAAa,aAAa,OAAO,KAAK,KAAK,GAAG,qBAAqB;AACvH,SAAO,KAAK;AACd;AAEA,eAAe,SAAS,KAAgC;AACtD,MAAI;AACF,WAAO,eAAe,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACrGA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,QAAQ,YAAY,CAAC;AAOrD,eAAsB,YAAY,SAA4C;AAC5E,QAAM,gBAAgB,SAAS,IAAI;AACrC;AAGA,eAAsB,0BAA0B,SAA4C;AAC1F,QAAM,gBAAgB,SAAS,KAAK;AACtC;AAEA,eAAe,gBAAgB,SAA6B,WAAmC;AAC7F,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ;AAEpB,MAAI,CAAC,IAAI,KAAK,SAAS,GAAG,GAAG;AAC3B,UAAM,IAAI,MAAM,QAAQ,GAAG,4BAA4B,IAAI,KAAK,KAAK,IAAI,CAAC,GAAG;AAAA,EAC/E;AACA,MAAI,eAAe,IAAI,GAAG,KAAK,CAAC,QAAQ,KAAK;AAC3C,UAAM,IAAI,MAAM,iCAAiC,GAAG,iBAAiB;AAAA,EACvE;AAEA,QAAM,kBAAkB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO;AAC1E,QAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,qBAAqB,eAAe,uCAAkC;AACxG,MAAI,YAAY,UAAU,IAAI,IAAI,IAAI;AACpC,UAAM,IAAI,MAAM,kBAAkB,eAAe,aAAa,YAAY,KAAK,WAAW,IAAI,IAAI,EAAE,GAAG;AAAA,EACzG;AACA,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2BAA2B,GAAG,QAAQ,eAAe,uCAAkC;AAEnH,QAAM,UAAkD,CAAC;AACzD,MAAI,IAAI,SAAS,SAAS,MAAM,GAAG;AACjC,QAAI,CAAC,MAAM,UAAW,OAAM,IAAI,MAAM,0BAA0B,GAAG,QAAQ,eAAe,uCAAkC;AAC5H,YAAQ,KAAK,EAAE,MAAM,mBAAmB,OAAO,MAAM,UAAU,CAAC;AAAA,EAClE;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,GAAG;AAC/B,QAAI,CAAC,MAAM,MAAO,OAAM,IAAI,MAAM,sBAAsB,GAAG,QAAQ,eAAe,uCAAkC;AACpH,YAAQ,KAAK,EAAE,MAAM,gBAAgB,OAAO,MAAM,MAAM,CAAC;AAAA,EAC3D;AACA,MAAI,QAAQ,WAAW,GAAG;AACxB,QAAI,IAAI,GAAG,GAAG,wCAAwC;AACtD;AAAA,EACF;AAIA,QAAM,cAAc,eAAe,IAAI,GAAG,IAAI,SAAY;AAC1D,QAAM,SAAS,cAAc,iBAAiB,WAAW,MAAM;AAE/D,MAAI,QAAQ,QAAQ;AAClB,yBAAqB,GAAG;AACxB,eAAW,KAAK,QAAS,KAAI,IAAI,uBAAuB,EAAE,IAAI,KAAK,cAAc,EAAE,KAAK,CAAC,QAAQ,MAAM,EAAE;AACzG;AAAA,EACF;AAEA,QAAM,MAAM,QAAQ,UAAU;AAC9B,MAAI,UAAW,OAAM,sBAAsB,KAAK,GAAG;AAEnD,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,MAAM,kBAAkB,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,KAAK,aAAa,KAAK,IAAI,QAAQ,CAAC;AAChH,QAAI,OAAO,SAAS,GAAG;AACrB,YAAM,IAAI,MAAM,uBAAuB,EAAE,IAAI,iBAAiB,OAAO,IAAI,MAAM,cAAc,GAAG,OAAO,UAAU,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE;AAAA,IAC5I;AACA,QAAI,IAAI,GAAG,EAAE,IAAI,cAAc,MAAM,qBAAqB,eAAe,iBAAiB;AAAA,EAC5F;AACF;AAGA,eAAsB,qBAAqB,SAAiD;AAC1F,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,MAAI,CAAC,IAAI,SAAS,KAAK,CAAC,YAAY,YAAY,QAAQ,YAAY,MAAM,EAAG;AAC7E,QAAM,sBAAsB,KAAK,QAAQ,UAAU,aAAa;AAClE;AAEA,eAAe,sBAAsB,KAA0B,KAAmC;AAChG,uBAAqB,GAAG;AACxB,MAAI,CAAE,MAAM,iBAAiB,KAAK,IAAI,OAAO,GAAI;AAC/C,UAAM,IAAI,MAAM,sFAAiF;AAAA,EACnG;AACF;AAEA,SAAS,qBAAqB,KAAgC;AAC5D,MAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG;AACpC,UAAM,IAAI,MAAM,+BAA+B,IAAI,OAAO,oDAAoD;AAAA,EAChH;AACF;;;AFxEA,eAAsB,UAAU,SAA0C;AACxE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,OAAO,UAAU,GAAG;AAC1B,QAAM,QAAQ,IAAI,SAAS,SAAS,IAAI;AACxC,QAAM,UAAU,IAAI,SAAS,SAAS,MAAM;AAE5C,MAAI,QAAQ,mBAAmB,CAAC,SAAS;AACvC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,QAAQ,eAAe,QAAQ,qBAAqB,OAAO;AAC7D,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,MAAI,IAAI,YAAY,KAAK,OAAO,KAAK,KAAK,KAAK,GAAG;AAClD,MAAI,IAAI,eAAe,KAAK,WAAW,EAAE;AACzC,MAAI,IAAI,eAAe,KAAK,UAAU,EAAE;AACxC,MAAI,IAAI,eAAe,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE;AAC7C,MAAI,IAAI,eAAe,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE;AAEjD,QAAM,iBAAiB,KAAK,KAAK,OAAO,CAAC,QAAQ,QAAQ,UAAU,QAAQ,YAAY;AACvF,MAAI,CAAC,QAAQ,UAAU,eAAe,SAAS,KAAK,CAAC,QAAQ,KAAK;AAChE,UAAM,IAAI;AAAA,MACR,wCAAwC,eAAe,KAAK,IAAI,CAAC;AAAA,IACnE;AAAA,EACF;AAEA,QAAM,SAAS,QAAQ,MAAM,kBAA2B,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,QAAQ,CAAC,IAAI;AACrG,QAAM,kBAAkB,QAAQ,MAAM,kBAA4B,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,OAAO,CAAC,IAAI;AAC5G,QAAM,QAAQ,oBAAoB,UAAU,IAAI,IAAI,iBAAiB,QAAQ,gBAAgB,MAAM,IAAI;AAEvG,MAAI,QAAQ,QAAQ;AAClB,QAAI,IAAI,0CAA0C;AAClD,QAAI,IAAI,aAAa,SAAS,QAAQ,IAAI,EAAE;AAC5C,QAAI,IAAI,aAAa,QAAQ,OAAO,KAAK,KAAK,EAAE,SAAS,CAAC,aAAa;AACvE,QAAI,IAAI,aAAa,IAAI,SAAS,SAAS,IAAI,IAAK,IAAI,IAAI,YAAY,mBAAoB,aAAa,EAAE;AAC3G,QAAI,IAAI,cAAc,QAAQ,cAAc,mCAAmC,YAAY,EAAE;AAC7F;AAAA,EACF;AAEA,MAAI,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC3D,MAAI,eAAe,YAAY,UAAU,IAAI,IAAI,IAAI;AACnD,UAAM,IAAI;AAAA,MACR,kBAAkB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,aAAa,YAAY,KAAK,WAAW,IAAI,IAAI,EAAE;AAAA,IAC1H;AAAA,EACF;AACA,QAAM,cAAc,CAAC,EAAE,QAAQ,cAAc,QAAQ;AACrD,QAAM,cAAc,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,GAAG,GAAG,SAAS;AAC7E,QAAM,YAAY,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,GAAG,GAAG,KAAK;AACvE,QAAM,2BAA4B,UAAU,CAAC,CAAC,QAAQ,cAAc,cAAgB,YAAY,eAAe;AAC/G,MAAI,QAAQ,qBAAqB,SAAS,0BAA0B;AAClE,UAAM,IAAI,MAAM,mGAAmG;AAAA,EACrH;AACA,QAAM,gBAAgB,0BAA0B,KAAK,QAAQ,YAAY;AACzE,MAAI,IAAI,MAAM,WAAW;AACvB,oBAAgB,IAAI,SAAS,CAAC,IAAI,MAAM,WAAW,IAAI,MAAM,iBAAiB,GAAI,gBAAgB,CAAC,aAAa,IAAI,CAAC,CAAE,CAAC;AAAA,EAC1H;AACA,MAAI,QAAQ,aAAa;AACvB,UAAM,qBAAqB,EAAE,YAAY,IAAI,YAAY,QAAQ,QAAQ,aAAa,CAAC;AACvF,QAAI,IAAI,qDAAqD;AAAA,EAC/D;AAEA,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,QAAQ,MAAM,kBAAkB,KAAK,SAAS,SAAS,GAAG;AAChE,QAAM,WAAO,+BAAiB,EAAE,UAAU,IAAI,aAAa,OAAO,SAAS,EAAE,OAAO,QAAQ,EAAE,CAAC;AAE/F,QAAM,WAAW,MAAM,gBAAgB,KAAK,OAAO,OAAO;AAC1D,MAAI,UAAU;AACZ,QAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,iBAAiB;AAAA,EAC7C,OAAO;AACL,UAAM,KAAK,UAAU,EAAE,MAAM,IAAI,IAAI,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC;AAC9D,QAAI,IAAI,gBAAgB,IAAI,IAAI,EAAE,EAAE;AAAA,EACtC;AAEA,aAAW,OAAO,IAAI,MAAM;AAC1B,eAAW,WAAW,IAAI,UAAU;AAClC,UAAI,YAAY,MAAM;AACpB,YAAI,IAAI,IAAI,UAAU;AACpB,gBAAM,KAAK,MAAM,IAAI,IAAI,IAAI,KAAK,EAAE,UAAU,IAAI,GAAG,UAAU,GAAI,IAAI,GAAG,QAAQ,EAAE,OAAO,IAAI,GAAG,MAAM,IAAI,CAAC,EAAG,CAAC;AACjH,cAAI,IAAI,GAAG,GAAG,oBAAoB,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,IAAI,IAAI,GAAG,KAAK,KAAK,EAAE,GAAG;AAAA,QAC/F,OAAO;AACL,gBAAM,KAAK,WAAW,IAAI,IAAI,IAAI,MAAM,MAAM,EAAE,IAAI,CAAC;AACrD,cAAI,IAAI,GAAG,GAAG,cAAc;AAAA,QAC9B;AAAA,MACF,OAAO;AACL,cAAM,KAAK,WAAW,IAAI,IAAI,IAAI,SAAS,MAAM,EAAE,IAAI,CAAC;AACxD,YAAI,IAAI,GAAG,GAAG,KAAK,OAAO,UAAU;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,aAAa,qBAAqB,IAAI,MAAM,QAAQ,GAAG,CAAC;AAC9D,QAAI,YAAY,gBAAgB;AAC9B,YAAM,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,UAAU;AAC9C,UAAI,IAAI,GAAG,GAAG,4BAA4B,WAAW,QAAQ,QAAQ,GAAG;AAAA,IAC1E;AAEA,UAAM,OAAO,IAAI,QAAQ,GAAG;AAC5B,QAAI,SAAS,QAAW;AACtB,YAAM,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,QAAQ,IAAI;AAChD,UAAI,IAAI,GAAG,GAAG,UAAU,OAAO,QAAQ,SAAS,EAAE;AAAA,IACpD;AAAA,EACF;AAEA,aAAW,OAAO,IAAI,MAAM;AAC1B,UAAM,eAAW,0BAAY,IAAI,IAAI,IAAI,GAAG;AAC5C,kBAAc,MAAM,wBAAwB;AAAA,MAC1C;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB;AAAA,MACA,UAAU,CAAC,CAAC,QAAQ;AAAA,MACpB,YAAY;AAAA,MACZ,OAAO,QAAQ,qBAAqB;AAAA,MACpC,OAAO;AAAA,MACP,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,QAAQ,YAAY,KAAK,GAAG,GAAG;AAErC,QAAI,QAAQ,aAAa;AACvB,UAAI;AACF,cAAM,0BAA0B;AAAA,UAC9B,YAAY,IAAI;AAAA,UAChB;AAAA,UACA,KAAK,QAAQ;AAAA,UACb,QAAQ,QAAQ;AAAA,UAChB,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,SAAS,OAAO;AACd,cAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,cAAM,UAAU,QAAQ,UAAU,QAAQ,eAAe,WAAW;AACpE,cAAM,IAAI;AAAA,UACR,GAAG,OAAO;AAAA,EAAK,GAAG,sEACa,GAAG,GAAG,OAAO;AAAA,UAC5C,EAAE,OAAO,MAAM;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,OAAO;AACnB,YAAM,SAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,QAAQ,CAAC,WAAW,OAAO,EAAE,OAAO,CAAC;AACzG,UAAI,IAAI,GAAG,GAAG,iBAAiB;AAAA,IACjC;AACA,QAAI,OAAO;AACT,YAAM,SAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,QAAQ,CAAC,gBAAgB,OAAO,KAAK;AACzG,UAAI,IAAI,GAAG,GAAG,mBAAmB,OAAO,KAAK,KAAK,EAAE,MAAM,cAAc;AAAA,IAC1E;AAEA,QAAI,IAAI,SAAS,SAAS,IAAI,KAAK,IAAI,IAAI,YAAY,IAAI,GAAG,QAAQ;AACpE,YAAM,MAAM,qBAAAC,QAAQ,IAAI,IAAI,GAAG,MAAM;AACrC,UAAI,KAAK;AACP,cAAM,aAAa,IAAI,GAAG,cAAc,kBAAkB,IAAI,GAAG,QAAQ;AACzE,kBAAM,qBAAU,EAAE,UAAU,IAAI,YAAY,OAAO,OAAO,QAAQ,GAAG,UAAU,YAAY,GAAG;AAC9F,YAAI,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,QAAQ,yBAAyB,UAAU,GAAG;AAAA,MAC1E,OAAO;AACL,YAAI,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,MAAM,wCAAwC;AAAA,MAC1E;AAAA,IACF;AAAA,EAEF;AAEA,MAAI,QAAQ,qBAAqB,SAAS,aAAa;AACrD,UAAM,UAAU,IAAI,MAAM,aAAa,eAAe,IAAI,SAAS,IAAI,MAAM,eAAe;AAC5F,QAAI,IAAI,sBAAsB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,SAAS,UAAU,iBAAiB,EAAE,GAAG;AAAA,EAC5H;AAEA,MAAI,iBAAiB,aAAa;AAChC,UAAM,MAAM,IAAI,KAAK,SAAS,KAAK,IAAI,QAAS,IAAI,KAAK,CAAC,KAAK;AAC/D,iBAAa,eAAe,aAAa,KAAK,YAAY,GAAG,CAAC;AAC9D,QAAI,IAAI,mBAAmB,YAAY,eAAe,IAAI,OAAO,CAAC,QAAQ,GAAG,EAAE;AAAA,EACjF;AACF;AAEA,eAAe,gBAAgB,KAA0B,OAAe,SAA6C;AACnH,QAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,WAAW,kBAAkB,mBAAmB,IAAI,IAAI,EAAE,CAAC,IAAI;AAAA,IAC9F,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,EAC9C,CAAC;AACD,MAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,MAAI,CAAC,IAAI,GAAI,QAAO;AACpB,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,KAAK,OAAO;AACrB;AAEA,eAAe,SAAS,SAAoB,KAAa,QAAgB,MAA8B;AACrG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,YAAY,IAAI,MAAM,IAAI,MAAMC,UAAS,GAAG,CAAC,EAAE;AACtG;AAEA,SAAS,qBAAqB,OAAgG;AAC5H,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAMC,kBAAiB,SAAS,KAAK;AACrC,WAAOA,kBAAiB,EAAE,gBAAAA,gBAAe,IAAI;AAAA,EAC/C;AACA,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,MAAM;AACZ,QAAM,iBAAiB,SAAS,IAAI,cAAc;AAClD,SAAO,iBAAiB,EAAE,gBAAgB,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC,GAAI,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC,EAAG,IAAI;AAC7I;AAEA,SAAS,kBAAkB,UAA0B;AACnD,QAAM,QAAQ;AACd,SAAO,MAAM,QAAQ,KAAK,GAAG,QAAQ;AACvC;AAEA,eAAeD,UAAS,KAAgC;AACtD,MAAI;AACF,WAAO,eAAe,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AGjQA,IAAAE,oBAAmD;AACnD,sBAUO;AACP,kBAAwE;AA4DxE,eAAsB,kBAAkB,SAAkE;AACxG,MAAI,QAAQ,wBAAwB,YAAY;AAC9C,UAAM,IAAI,MAAM,uGAAuG;AAAA,EACzH;AAEA,QAAM,YAAY,QAAQ,cAAc;AACxC,QAAM,MAAM,YAAY,SAAY,MAAM,kBAAkB,QAAQ,cAAc,iBAAiB;AACnG,QAAM,QAAQ,YAAY,YAAY,IAAK,IAAI;AAC/C,QAAM,MAAM,YAAY,SAAS,UAAU,QAAQ,KAAK,IAAK,MAAM,IAAK,YAAY,IAAK,OAAO;AAChG,QAAM,WAAW,QAAQ,YAAY,KAAK,eAAe;AACzD,QAAM,aAAS,2BAAQ,QAAQ,UAAU,KAAK,WAAW,GAAG;AAC5D,QAAM,aAAS,2BAAQ,QAAQ,WAAO,2BAAQ,QAAQ,uBAAuB,CAAC;AAC9E,QAAM,qBAAiB,4BAAS,QAAQ,MAAM,EAAE,MAAM,qBAAG,EAAE,KAAK,GAAG;AACnE,MAAI,CAAC,eAAgB,OAAM,IAAI,MAAM,sDAAsD;AAG3F,QAAM,UAAU,WAAW,QAAQ,WAAW,QAAQ,QAAQ,gBAAgB,EAAE;AAEhF,QAAM,eAA2C;AAAA,IAC/C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,YAAY,2BAA2B;AAAA,EAChD;AACA,QAAM,QAAQ,MAAM,cAAc,SAAS,YAAY;AACvD,QAAM,WAAW,UAAM,+BAAkB,QAAQ;AAAA,IAC/C,SAAS,CAAC,eAAe,WAAW,KAAK,KAAK,KAAC,8BAAW,cAAc,IAAI,CAAC,cAAc,IAAI,CAAC;AAAA,EAClG,CAAC;AACD,QAAM,SAAS,UAAM,iDAAgC;AAAA,IACnD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,SAAS;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,kBAAkB;AAAA,IAClB,aAAa,QAAQ,SAAS,OAAO,WAAW;AAAA,IAChD,GAAI,YAAY,EAAE,WAAW,EAAE,SAAS,MAAe,SAAS,mCAAmC,EAAE,IAAI,CAAC;AAAA,IAC1G,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACD,QAAM,cAAU,uCAAsB;AAAA,IACpC;AAAA,IACA,OAAO,IAAI,6BAAa,2BAAQ,QAAQ,OAAO,CAAC;AAAA,IAChD,mBAAmB,OAAO;AAAA,IAC1B,oBAAoB,OAAO;AAAA,IAC3B,QAAQ;AAAA,MACN,uBAAuB;AAAA,MACvB,QAAQ;AAAA,MACR,cAAc;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAM,SAAS,MAAM,QAAQ,IAAI,UAAU,EAAE,OAAO,OAAO,IAAI,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC9F,YAAM,oCAAuB,QAAQ,MAAM;AAC3C,QAAM,eAAe,UAAM,qCAAoB,MAAM;AACrD,QAAM,OAAO,SAAS;AAAA,IACpB;AAAA,IACA,gBAAgB,OAAO;AAAA,IACvB,WAAW,OAAO,QAAQ;AAAA,IAC1B,YAAY,OAAO,QAAQ;AAAA,EAC7B,GAAG,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAC7B,eAAa,QAAQ,UAAU,SAAS,OAAO,KAAK,OAAO,KAAK,QAAQ,MAAM;AAC9E,SAAO,OAAO,OAAO,EAAE,QAAQ,KAAK,OAAO,KAAK,OAAO,CAAC;AAC1D;AAEA,SAAS,UAAU,WAA+B,UAAoB,YAAoB,SAAyB;AACjH,QAAM,MAAM,cAAc,SAAS,SAAS,KAAK,IAAI,QAAQ,SAAS,CAAC;AACvE,MAAI,CAAC,OAAO,CAAC,SAAS,SAAS,GAAG,GAAG;AACnC,UAAM,YAAQ,4BAAS,SAAS,UAAU,KAAK;AAC/C,UAAM,IAAI,MAAM,QAAQ,OAAO,EAAE,wBAAwB,KAAK,EAAE;AAAA,EAClE;AACA,SAAO;AACT;AAEA,eAAe,cAAc,SAAmC,SAAsD;AACpH,QAAM,QAAQ,QAAQ,SAAS,MAAM,QAAQ,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;AACrF,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,QAAS,2BAA2B,KAAK,KAAK,GAAG;AACnH,UAAM,IAAI;AAAA,MACR,QAAQ,YACJ,oEACA;AAAA,IACN;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,MAA6B,cAAmD;AAClG,QAAM,UAAU,SAAS,aACrB,6BAAY,IACZ,SAAS,uBACP,sCAAqB,IACrB,SAAS,gBACP,gCAAe,IACf;AACR,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B,OAAO,IAAI,CAAC,GAAG;AAC1E,MAAI,iBAAiB,OAAW,QAAO;AACvC,MAAI,CAAC,OAAO,cAAc,YAAY,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,yCAAyC;AACtH,SAAO,EAAE,GAAG,SAAS,aAAa;AACpC;AAEA,SAAS,aACP,KACA,OACA,KACA,KACA,QACA,QACM;AACN,QAAM,WAAW,OAAO,SAAS,OAAO,CAAC,SAAS,KAAK,UAAU,UAAU,EAAE;AAC7E,MAAI,IAAI,aAAa,KAAK,IAAI,GAAG,QAAQ,IAAI,KAAK,YAAY,IAAI,cAAc,EAAE;AAClF,MAAI,IAAI,gBAAgB,IAAI,UAAU,SAAS,QAAQ,IAAI,IAAI,UAAU,SAAS,KAAK,EAAE;AACzF,MAAI,IAAI,iBAAiB,IAAI,WAAW,SAAS,QAAQ,IAAI,IAAI,WAAW,SAAS,KAAK,EAAE;AAC5F,MAAI,IAAI,eAAe,OAAO,cAAc,IAAI,QAAQ,IAAI,OAAO,SAAS,MAAM,YAAY,OAAO,QAAQ,YAAY,YAAY,OAAO,QAAQ,YAAY,gBAAgB,OAAO,QAAQ,gBAAgB,EAAE;AACjN,MAAI,IAAI,yBAAyB,OAAO,QAAQ,SAAS,uBAAuB,OAAO,QAAQ,iBAAiB,eAAe,OAAO,QAAQ,UAAU,EAAE;AAC1J,MAAI,IAAI,iBAAa,2BAAQ,QAAQ,WAAW,CAAC,EAAE;AACrD;;;AC7LA,IAAAC,kBAA6B;AAEtB,SAAS,aAAqB;AACnC,QAAM,MAAM,KAAK,UAAM,8BAAa,IAAI,IAAI,mBAAmB,aAAe,GAAG,MAAM,CAAC;AACxF,SAAO,IAAI,WAAW;AACxB;AAEO,SAAS,YAAkB;AAChC,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAyCb;AACD;;;AClDA,IAAAC,kBAA2F;AAC3F,qBAAwB;AACxB,IAAAC,oBAAkE;AAClE,IAAAC,mBAA8B;;;ACFvB,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAe7B,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzB,oBAAoB;AAAA;AAIf,SAAS,cAAc,OAAe,WAA2B;AACtE,QAAM,QAAQ,UAAU,MAAM,6BAA6B;AAC3D,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,iBAAiB,KAAK,0BAA0B;AAC5E,QAAM,QAAQ,MAAM,CAAC,EAAG,MAAM,OAAO;AACrC,QAAM,cAAwB,CAAC;AAC/B,MAAI,eAAe;AACnB,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,OAAO,KAAK,KAAK,WAAW,cAAc,GAAG;AAC/D,kBAAY,KAAK,IAAI;AACrB,qBAAe,KAAK,WAAW,cAAc;AAAA,IAC/C,WAAW,gBAAgB,OAAO,KAAK,IAAI,GAAG;AAC5C,kBAAY,KAAK,IAAI;AAAA,IACvB,OAAO;AACL,qBAAe;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AAAA,EACP,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,IAGpB,KAAK;AAAA;AAAA,iCAEwB,KAAK;AAAA;AAAA;AAAA;AAItC;;;AD7CO,IAAM,kBAAkB,CAAC,UAAU,SAAS,UAAU,WAAW,UAAU,QAAQ;AAmEnF,SAAS,aAAa,UAA+B,CAAC,GAAuB;AAClF,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,YAAY,QAAQ,iBAAa,gCAAc,IAAI,IAAI,aAAa,aAAe,CAAC;AAC1F,QAAM,QAAQ,UAAU,SAAS;AACjC,MAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,8BAA8B,SAAS,EAAE;AAEjF,QAAM,YAAY,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI;AAC/E,QAAM,WAAO,2BAAQ,QAAQ,OAAO,QAAQ,IAAI,CAAC;AACjD,QAAM,WAAO,2BAAQ,QAAQ,eAAW,wBAAQ,CAAC;AACjD,QAAM,QAAQ,oBAAI,IAAyB;AAC3C,QAAM,UAAU,oBAAI,IAA+B;AAEnD,QAAM,iBAAiB,CAAC,SAAuB,WAAyB;AACtE,UAAM,UAAU,QAAQ,IAAI,OAAO,KAAK,oBAAI,IAAY;AACxD,YAAQ,IAAI,MAAM;AAClB,YAAQ,IAAI,SAAS,OAAO;AAAA,EAC9B;AACA,QAAM,OAAO,CAAC,QAAgB,SAAiB,eAAe,OAAO,WAAW,SAAe;AAC7F,UAAM,WAAW,MAAM,IAAI,MAAM;AACjC,QAAI,YAAY,SAAS,YAAY,QAAS,OAAM,IAAI,MAAM,qCAAqC,MAAM,EAAE;AAC3G,UAAM,IAAI,QAAQ,EAAE,QAAQ,SAAS,UAAU,aAAa,CAAC;AAAA,EAC/D;AACA,QAAM,gBAAgB,CAACC,YAAmB,WAAW,SAAe;AAClE,eAAW,OAAO,MAAO,UAAK,wBAAKA,YAAW,GAAG,OAAG,kCAAa,wBAAK,WAAW,GAAG,GAAG,MAAM,GAAG,OAAO,QAAQ;AAAA,EACjH;AAEA,MAAI;AACJ,MAAI,QAAQ,QAAQ;AAClB,UAAM,iBAAa,wBAAK,MAAM,WAAW,QAAQ;AACjD,UAAM,gBAAY,2BAAQ,QAAQ,gBAAgB,QAAQ,IAAI,kBAAc,wBAAK,MAAM,QAAQ,GAAG,QAAQ;AAC1G,gBAAY,UAAU,CAAC,MAAM,UAAU,YAAY;AACnD,eAAW,WAAW,WAAW;AAC/B,YAAM,YAAY,YAAY,WAAW,aAAa;AACtD,oBAAc,WAAW,YAAY,WAAW,WAAO,+BAAQ,2BAAQ,SAAS,CAAC,CAAC;AAClF,qBAAe,SAAS,SAAS;AAAA,IACnC;AAAA,EACF,OAAO;AACL,UAAM,iBAAa,wBAAK,MAAM,WAAW,QAAQ;AACjD,kBAAc,UAAU;AAExB,UAAM,iBAAa,wBAAK,MAAM,WAAW,QAAQ;AACjD,gBAAY,UAAU,SAAS,QAAQ,IAAI,aAAa;AACxD,eAAW,WAAW,UAAW,gBAAe,SAAS,UAAU;AAEnE,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,iBAAW,SAAS,WAAW,KAAK,GAAG;AACrC,cAAM,gBAAY,kCAAa,wBAAK,WAAW,OAAO,UAAU,GAAG,MAAM;AACzE,iBAAK,wBAAK,YAAY,OAAO,UAAU,GAAG,cAAc,OAAO,SAAS,CAAC;AAAA,MAC3E;AACA,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,iBAAa,wBAAK,MAAM,WAAW,SAAS,UAAU;AAC5D,WAAK,YAAY,WAAW;AAC5B,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,iBAAa,wBAAK,MAAM,WAAW;AACzC,WAAK,YAAY,mBAAmB,YAAY,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AACzG,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,SAAS,GAAG;AACjC,YAAM,kBAAc,wBAAK,MAAM,WAAW,yBAAyB;AACnE,WAAK,aAAa,mBAAmB,aAAa,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AAC3G,qBAAe,WAAW,WAAW;AAAA,IACvC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,iBAAa,wBAAK,MAAM,WAAW;AACzC,WAAK,YAAY,mBAAmB,YAAY,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AACzG,qBAAe,UAAU,UAAU;AAAA,IACrC;AAAA,EACF;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,iBAAiB,oBAAI,IAAY;AACvC,QAAM,YAAsB,CAAC;AAC7B,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,UAAM,UAAU,mBAAmB,KAAK,UAAU,KAAK,MAAM;AAC7D,QAAI,SAAS;AACX,gBAAU,KAAK,GAAG,KAAK,MAAM,iCAAiC,OAAO,GAAG;AACxE;AAAA,IACF;AACA,QAAI,KAAC,4BAAW,KAAK,MAAM,GAAG;AAC5B,mBAAa,IAAI,KAAK,MAAM;AAC5B;AAAA,IACF;AACA,UAAM,cAAU,8BAAa,KAAK,QAAQ,MAAM;AAChD,QAAI,YAAY,KAAK,SAAS;AAC5B,qBAAe,IAAI,KAAK,MAAM;AAAA,IAChC,WAAW,KAAK,gBAAgB,QAAQ,OAAO;AAC7C,mBAAa,IAAI,KAAK,MAAM;AAC5B,qBAAe,OAAO,KAAK,MAAM;AAAA,IACnC,OAAO;AACL,gBAAU,KAAK,KAAK,MAAM;AAAA,IAC5B;AAAA,EACF;AAEA,MAAI,UAAU,SAAS,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,EAAmG,UAAU,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IAChJ;AAAA,EACF;AAEA,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,QAAI,KAAC,4BAAW,KAAK,MAAM,SAAK,8BAAa,KAAK,QAAQ,MAAM,MAAM,KAAK,SAAS;AAClF,yCAAU,2BAAQ,KAAK,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AACnD,yCAAc,KAAK,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,SAAS,WAAW,KAAK;AAC/B,QAAM,gBAAgB,UAAU,IAAI,CAAC,aAAa,EAAE,SAAS,SAAS,CAAC,GAAI,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAE,EAAE,EAAE;AAC1G,MAAI,IAAI,oBAAoB,UAAU,KAAK,IAAI,CAAC,EAAE;AAClD,MAAI,IAAI,mBAAmB,OAAO,KAAK,IAAI,CAAC,EAAE;AAC9C,aAAW,gBAAgB,cAAe,KAAI,IAAI,GAAG,aAAa,OAAO,KAAK,aAAa,QAAQ,KAAK,IAAI,CAAC,EAAE;AAC/G,MAAI,IAAI,aAAa,aAAa,IAAI,mBAAmB,eAAe,OAAO,KAAK,eAAe,IAAI,gBAAgB,EAAE,EAAE;AAC3H,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW,WAAW,YAAY;AAAA,IAC3C,WAAW,WAAW,WAAW,cAAc;AAAA,IAC/C,cAAc,CAAC,GAAG,YAAY,EAAE,KAAK;AAAA,IACrC,gBAAgB,CAAC,GAAG,cAAc,EAAE,KAAK;AAAA,IACzC,WAAW;AAAA,EACb;AACF;AAEA,SAAS,WAAW,MAAc,OAA8B;AAC9D,SAAO,CAAC,GAAG,KAAK,EACb,IAAI,CAAC,aAAS,4BAAS,MAAM,IAAI,CAAC,EAClC,OAAO,CAAC,SAAS,SAAS,QAAQ,CAAC,KAAK,WAAW,KAAK,qBAAG,EAAE,KAAK,KAAC,8BAAW,IAAI,CAAC,EACnF,KAAK;AACV;AAEA,SAAS,mBAAmB,QAA4C,QAAiC;AACvG,QAAM,YAAsB,QAAQ,SAAS,SAAS,CAAC,QAAQ;AAC/D,QAAM,UAAU,oBAAI,IAAY,CAAC,GAAG,iBAAiB,KAAK,CAAC;AAC3D,aAAW,WAAW,WAAW;AAC/B,QAAI,CAAC,QAAQ,IAAI,OAAO,GAAG;AACzB,YAAM,IAAI,MAAM,0BAA0B,OAAO,kBAAkB,gBAAgB,KAAK,IAAI,CAAC,EAAE;AAAA,IACjG;AAAA,EACF;AACA,QAAM,WAA2B,UAAU,SAAS,KAAK,IACrD,SAAS,CAAC,UAAU,OAAO,IAAI,CAAC,GAAG,eAAe,IAClD,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AAC1B,MAAI,QAAQ;AACV,UAAM,cAAc,SAAS,OAAO,CAAC,YAAY,YAAY,YAAY,YAAY,OAAO;AAC5F,QAAI,YAAY,QAAQ;AACtB,YAAM,IAAI,MAAM,4CAA4C,YAAY,KAAK,IAAI,CAAC,kCAAkC;AAAA,IACtH;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,MAAc,OAAe,OAAgB,UAA0B;AACjG,QAAM,UAAU,mBAAmB,UAAU,IAAI;AACjD,MAAI,QAAS,OAAM,IAAI,MAAM,sBAAsB,IAAI,6BAA6B,OAAO,EAAE;AAC7F,MAAI,KAAC,4BAAW,IAAI,EAAG,QAAO,GAAG,KAAK;AAAA;AACtC,QAAM,cAAU,8BAAa,MAAM,MAAM;AACzC,QAAM,QAAQ;AACd,QAAM,MAAM;AACZ,QAAM,UAAU,QAAQ,QAAQ,KAAK;AACrC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAK,YAAY,QAAS,UAAU,OAAQ,YAAY,MAAM,QAAQ,SAAU;AAC9E,UAAM,IAAI,MAAM,qCAAqC,IAAI,EAAE;AAAA,EAC7D;AACA,MAAI,YAAY,IAAI;AAClB,UAAM,YAAY,QAAQ,WAAW,KAAK,QAAQ,SAAS,MAAM,IAAI,KAAK,QAAQ,SAAS,IAAI,IAAI,OAAO;AAC1G,WAAO,GAAG,OAAO,GAAG,SAAS,GAAG,KAAK;AAAA;AAAA,EACvC;AACA,QAAM,WAAW,QAAQ,IAAI;AAC7B,QAAM,WAAW,QAAQ,MAAM,SAAS,QAAQ;AAChD,MAAI,aAAa,SAAS,CAAC,OAAO;AAChC,UAAM,IAAI,MAAM,4CAA4C,IAAI,+CAA+C;AAAA,EACjH;AACA,SAAO,GAAG,QAAQ,MAAM,GAAG,OAAO,CAAC,GAAG,KAAK,GAAG,QAAQ,MAAM,QAAQ,CAAC;AACvE;AAEA,SAAS,mBAAmB,UAAkB,QAAoC;AAChF,QAAM,UAAM,4BAAS,UAAU,MAAM;AACrC,MAAI,QAAQ,QAAQ,IAAI,WAAW,KAAK,qBAAG,EAAE,SAAK,8BAAW,GAAG,GAAG;AACjE,UAAM,IAAI,MAAM,gDAAgD,MAAM,EAAE;AAAA,EAC1E;AACA,MAAI,UAAU;AACd,aAAW,QAAQ,IAAI,MAAM,qBAAG,EAAE,OAAO,OAAO,GAAG;AACjD,kBAAU,wBAAK,SAAS,IAAI;AAC5B,QAAI;AACF,cAAI,2BAAU,OAAO,EAAE,eAAe,EAAG,QAAO;AAAA,IAClD,SAAS,OAAO;AACd,UAAK,MAAgC,SAAS,SAAU,OAAM;AAAA,IAChE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA2B;AAC7C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,CAAC,SAAS,sBAAsB,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,MAAM,OAAO,EAAE,CAAC,CAAE,CAAC,CAAC,EAAE,KAAK;AAC5H;AAEA,SAAS,UAAU,KAAuB;AACxC,MAAI,KAAC,4BAAW,GAAG,EAAG,QAAO,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,CAAC,YAA0B;AACtC,eAAW,aAAS,6BAAY,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;AACjE,YAAM,WAAO,wBAAK,SAAS,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,EAAG,MAAK,IAAI;AAAA,UAC7B,SAAQ,SAAK,4BAAS,KAAK,IAAI,CAAC;AAAA,IACvC;AAAA,EACF;AACA,OAAK,GAAG;AACR,SAAO,QAAQ,KAAK;AACtB;;;AElQA,eAAsB,MAAM,SAAsC;AAChE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ,QAAQ,IAAI,KAAK,SAAS,KAAK,IAAI,QAAS,IAAI,KAAK,CAAC,KAAK;AAC/E,MAAI,CAAC,IAAI,KAAK,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,QAAQ,GAAG,wBAAwB,YAAY,IAAI,YAAY,IAAI,OAAO,CAAC,EAAE;AAE1H,QAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,8BAA8B,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,6CAA6C;AAAA,EAChJ;AACA,MAAI,YAAY,UAAU,IAAI,IAAI,IAAI;AACpC,UAAM,IAAI,MAAM,kCAAkC,YAAY,KAAK,yBAAyB,IAAI,IAAI,EAAE,GAAG;AAAA,EAC3G;AAEA,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,OAAO,YAAY,CAAC,MAAM,OAAO;AACpC,UAAM,IAAI,MAAM,6CAA6C,GAAG,8CAA8C;AAAA,EAChH;AAEA,QAAM,UAAU,QAAQ,SAAS;AACjC,MAAI,IAAI,UAAU,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AACrC,MAAI,IAAI,aAAa,MAAM,QAAQ,EAAE;AAErC,QAAM,eAAe,MAAM,QAAQ,SAAS,gBAAgB,IAAI,aAAa,IAAI,IAAI,IAAI,GAAG,GAAG,MAAS;AACxG,MAAI,IAAI,qBAAqB;AAE7B,MAAI,IAAI,IAAI,UAAU;AACpB,UAAM,WAAa,aAAwD,IAAI,YAAY;AAC3F,QAAI,aAAa,IAAI,GAAG,UAAU;AAChC,YAAM,IAAI,MAAM,mCAAmC,IAAI,GAAG,QAAQ,yBAAyB,YAAY,MAAM,GAAG;AAAA,IAClH;AACA,QAAI,IAAI,SAAS,QAAQ,EAAE;AAAA,EAC7B;AAEA,QAAM,iBAAiB,MAAM,kBAA2B,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,QAAQ,CAAC;AACjG,QAAM,mBAAmB,mBAAmB,cAAc;AAC1D,QAAM,oBAAoB,MAAM,QAAQ,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,MAAM,QAAQ,CAAC,WAAW,MAAM,KAAK;AAClI,QAAM,aAAc,kBAA2C,UAAU;AACzE,QAAM,eAAe,mBAAmB,UAAU;AAClD,MAAI,iBAAiB,QAAQ;AAC3B,UAAM,UAAU,iBAAiB,OAAO,CAAC,WAAW,CAAC,aAAa,SAAS,MAAM,CAAC;AAClF,QAAI,QAAQ,OAAQ,OAAM,IAAI,MAAM,6CAA6C,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EACvG;AACA,MAAI,IAAI,aAAa,aAAa,MAAM,WAAW;AAEnD,QAAM,kBAAkB,iBAAiB,CAAC,KAAK,aAAa,CAAC;AAC7D,MAAI,iBAAiB;AACnB,UAAM,YAAY,MAAMC,UAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,MAAM,QAAQ,CAAC,cAAc,MAAM,OAAO;AAAA,MAC9H,IAAI;AAAA,MACJ,WAAW,EAAE,OAAO,KAAK;AAAA,IAC3B,CAAC;AACD,UAAM,QAAS,UAAkD,WAAW;AAC5E,QAAI,IAAI,gBAAgB,eAAe,UAAU,OAAO,SAAS,IAAI,CAAC,EAAE;AAAA,EAC1E,OAAO;AACL,QAAI,IAAI,+CAA+C;AAAA,EACzD;AACA,MAAI,IAAI,IAAI;AACd;AAEA,eAAe,QAAQ,SAAoB,KAAa,QAA8C;AACpG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,SAAS,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG,IAAI;AAAA,EAC5D,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,aAAa,IAAI,MAAM,KAAK,MAAMC,UAAS,GAAG,CAAC,EAAE;AACtG,SAAO,IAAI,KAAK;AAClB;AAEA,eAAeD,UAAS,SAAoB,KAAa,QAAgB,MAAiC;AACxG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,aAAa,IAAI,MAAM,KAAK,MAAMC,UAAS,GAAG,CAAC,EAAE;AACtG,SAAO,IAAI,KAAK;AAClB;AAEA,SAAS,gBAAgB,aAAqB,OAAe,KAAqB;AAChF,QAAM,MAAM,IAAI,IAAI,kBAAkB,mBAAmB,KAAK,CAAC,kBAAkB,WAAW;AAC5F,MAAI,aAAa,IAAI,OAAO,GAAG;AAC/B,SAAO,IAAI,SAAS;AACtB;AAEA,eAAeA,UAAS,KAAgC;AACtD,MAAI;AACF,YAAQ,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG;AAAA,EACxC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ApB1EA,eAAsB,OAAO,OAAO,QAAQ,KAAK,MAAM,CAAC,GAAkB;AACxE,QAAM,SAAS,UAAU,IAAI;AAC7B,QAAM,UAAU,OAAO,YAAY,CAAC,KAAK;AACzC,MAAI,YAAY,aAAa,YAAY,QAAQ,OAAO,QAAQ,YAAY,MAAM;AAChF,eAAW,QAAQ,CAAC,SAAS,GAAG,CAAC;AACjC,YAAQ,IAAI,WAAW,CAAC;AACxB;AAAA,EACF;AAEA,MAAI,YAAY,UAAU,YAAY,YAAY,YAAY,MAAM;AAClE,eAAW,QAAQ,CAAC,MAAM,GAAG,CAAC;AAC9B,cAAU;AACV;AAAA,EACF;AAEA,MAAI,YAAY,QAAQ;AACtB,eAAW,QAAQ,CAAC,UAAU,QAAQ,UAAU,OAAO,YAAY,eAAe,OAAO,GAAG,CAAC;AAC7F,gBAAY;AAAA,MACV,OAAO,eAAe,OAAO,QAAQ,QAAQ,GAAG,UAAU;AAAA,MAC1D,MAAM,eAAe,OAAO,QAAQ,MAAM,QAAQ;AAAA,MAClD,YAAY,UAAU,OAAO,QAAQ,MAAM;AAAA,MAC3C,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAAA,MAChC,UAAU,QAAQ,OAAO,QAAQ,QAAQ;AAAA,MACzC,YAAY,UAAU,OAAO,QAAQ,aAAa,CAAC;AAAA,MACnD,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,UAAU;AACxB,eAAW,QAAQ,CAAC,QAAQ,GAAG,CAAC;AAChC,UAAM,OAAO,EAAE,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK,kBAAkB,CAAC;AAClF;AAAA,EACF;AAEA,MAAI,YAAY,gBAAgB;AAC9B,eAAW,QAAQ,CAAC,MAAM,GAAG,CAAC;AAC9B,sBAAkB,OAAO,QAAQ,SAAS,IAAI;AAC9C;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,UAAM,OAAO,OAAO,YAAY,CAAC;AACjC,UAAM,SAAS,OAAO,YAAY,CAAC;AACnC,UAAM,gBAAgB,WAAW,gBAAgB,OAAO,YAAY,CAAC,MAAM;AAC3E,UAAM,cAAc,WAAW;AAC/B,QAAI,SAAS,QAAS,WAAW,UAAU,WAAW,SAAS,CAAC,iBAAiB,CAAC,aAAc;AAC9F,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,eAAW,QAAQ;AAAA,MACjB;AAAA,MAAY;AAAA,MAAS;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAY;AAAA,MAAS;AAAA,MAC1D;AAAA,MAAmB;AAAA,MAAqB;AAAA,MAAqB;AAAA,MAAY;AAAA,IAC3E,GAAG,gBAAgB,IAAI,WAAW,QAAQ,IAAI,CAAC;AAC/C,UAAM,QAAQ;AAAA,MACZ,QAAQ,gBAAgB,mBAAmB,cAAc,gBAAgB;AAAA,MACzE,SAAS,WAAW,QAAQ,OAAO,YAAY,CAAC,IAAI;AAAA,MACpD,UAAU,UAAU,OAAO,QAAQ,QAAQ;AAAA,MAC3C,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,SAAS,QAAQ,OAAO,QAAQ,OAAO;AAAA,MACvC,eAAe,UAAU,OAAO,QAAQ,iBAAiB,GAAG,mBAAmB;AAAA,MAC/E,iBAAiB,UAAU,OAAO,QAAQ,mBAAmB,GAAG,qBAAqB;AAAA,MACrF,gBAAgB,UAAU,OAAO,QAAQ,mBAAmB,GAAG,qBAAqB;AAAA,MACpF,UAAU,UAAU,OAAO,QAAQ,QAAQ;AAAA,MAC3C,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,MAAM,OAAO,QAAQ,SAAS;AAAA,MAC9B,MAAM,OAAO,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO;AAAA,MACpF,oBAAoB,gBAAgB,OAAO,YAAY,CAAC,IAAI;AAAA,MAC5D,SAAS,UAAU,OAAO,QAAQ,UAAU,CAAC;AAAA,MAC7C,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,YAAY;AAC1B,UAAM,MAAM,OAAO,YAAY,CAAC;AAChC,QAAI,QAAQ,MAAO,OAAM,IAAI,MAAM,uDAAuD;AAC1F,eAAW,QAAQ;AAAA,MACjB;AAAA,MAAU;AAAA,MAAO;AAAA,MAAO;AAAA,MAAW;AAAA,MAAkB;AAAA,MAAU;AAAA,MAC/D;AAAA,MAAQ;AAAA,MAAuB;AAAA,MAAQ;AAAA,MAAW;AAAA,MAAsB;AAAA,IAC1E,GAAG,CAAC;AACJ,UAAM,aAAa,UAAU,OAAO,QAAQ,MAAM,KAAK;AACvD,UAAM,YAAY,OAAO,QAAQ,SAAS;AAC1C,UAAM,OAAO,OAAO,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO;AAC3F,UAAM,WAAW,UAAU,OAAO,QAAQ,QAAQ;AAClD,UAAM,SAAS,MAAM,kBAAkB;AAAA,MACrC;AAAA,MACA;AAAA,MACA,QAAQ,OAAO,YAAY,CAAC;AAAA,MAC5B,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,SAAS,gBAAgB,UAAU,OAAO,QAAQ,OAAO,CAAC;AAAA,MAC1D,cAAc,UAAU,OAAO,QAAQ,gBAAgB,GAAG,kBAAkB;AAAA,MAC5E,OAAO,UAAU,OAAO,QAAQ,QAAQ,CAAC;AAAA,MACzC;AAAA,MACA,qBAAqB,OAAO,QAAQ,qBAAqB,MAAM,OAAO,aAAa;AAAA,MACnF,UAAU,OAAO,YAAY;AAC3B,YAAI,QAAQ,UAAU,0BAA0B;AAC9C,iBAAO,uBAAuB,EAAE,UAAU,QAAQ,UAAU,OAAO,QAAQ,OAAO,KAAK,CAAC;AAAA,QAC1F;AACA,cAAM,MAAM,MAAM,kBAAkB,UAAU;AAC9C,eAAO,kBAAkB,KAAK,EAAE,YAAY,KAAK,GAAG,OAAO,OAAO;AAAA,MACpE;AAAA,IACF,CAAC;AACD,UAAM,SAAS,YAAY,UAAU,OAAO,QAAQ,SAAS,CAAC,KAAK,QAAQ,WAAW;AACtF,UAAM,iBAAiB,OAAO,QAAQ,oBAAoB;AAC1D,UAAM,mBAAmB,mBAAmB,QAAQ,SAAY,YAAY,UAAU,cAAc,KAAK,YAAY,sBAAsB;AAC3I,UAAM,gBAAY,oCAAkB,OAAO,QAAQ,MAAM;AACzD,UAAM,QAAQ,uBACV,oCAAkB,OAAO,QAAQ,kBAAkB,IAAI,EAAE,OAAO,CAAC,YAAY,QAAQ,gBAAgB,WAAW,IAChH,CAAC;AACL,UAAM,aAAa,OAAO,OAAO,mBAAmB,gBAAgB,OAAO,QAAQ,kBAAkB,MAAM;AAC3G,QAAI,UAAU,UAAU,MAAM,UAAU,YAAY;AAClD,YAAM,IAAI,MAAM,gCAAgC,UAAU,MAAM,iBAAiB,MAAM,KAAK,MAAM,MAAM,aAAa,oBAAoB,UAAU,GAAG,aAAa,0BAA0B,EAAE,EAAE;AAAA,IACnM;AACA;AAAA,EACF;AAEA,MAAI,YAAY,aAAa;AAC3B;AAAA,MACE;AAAA,MACA;AAAA,QACE;AAAA,QAAU;AAAA,QAAW;AAAA,QAAe;AAAA,QAAqB;AAAA,QAAgB;AAAA,QACzE;AAAA,QAAkB;AAAA,QAAS;AAAA,QAAQ;AAAA,MACrC;AAAA,MACA;AAAA,IACF;AACA,UAAMC,gBAAe,OAAO,QAAQ,gBAAgB;AACpD,UAAM,OAAyB;AAAA,MAC7B,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,MACtC,YAAY,OAAO,QAAQ,aAAa,MAAM;AAAA,MAC9C,iBAAiB,OAAO,QAAQ,mBAAmB,MAAM;AAAA,MACzD,aAAa,OAAO,QAAQ,cAAc,MAAM;AAAA,MAChD,kBAAkB,OAAO,QAAQ,mBAAmB,MAAM;AAAA,MAC1D,cAAc,OAAOA,kBAAiB,WAAWA,gBAAeA,kBAAiB;AAAA,MACjF,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,MAAM,OAAO,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO;AAAA,MACpF,KAAK,OAAO,QAAQ,QAAQ;AAAA,IAC9B;AACA,UAAM,UAAU,IAAI;AACpB;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,eAAW,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC;AACvC,UAAM,MAAM;AAAA,MACV,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,IACnC,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,eAAW,QAAQ,CAAC,OAAO,UAAU,SAAS,SAAS,SAAS,GAAG,CAAC;AAGpE,iBAAa;AAAA,MACX,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,QAAQ,OAAO,QAAQ,WAAW;AAAA,MAClC,WAAW,YAAY,MAAM;AAAA,MAC7B,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD,YAAQ;AAAA,MACN;AAAA,IAEF;AACA;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,UAAM,MAAM,OAAO,YAAY,CAAC;AAChC,QAAI,QAAQ,UAAW,OAAM,IAAI,MAAM,6BAA6B,OAAO,EAAE,iCAAiC;AAC9G,eAAW,QAAQ,CAAC,OAAO,UAAU,SAAS,SAAS,SAAS,GAAG,CAAC;AACpE,iBAAa;AAAA,MACX,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,QAAQ,OAAO,QAAQ,WAAW;AAAA,MAClC,WAAW,YAAY,MAAM;AAAA,MAC7B,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,WAAW;AACzB,UAAM,MAAM,OAAO,YAAY,CAAC;AAChC,QAAI,QAAQ,OAAQ,OAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE,0CAA0C;AACtH,eAAW,QAAQ,CAAC,UAAU,OAAO,WAAW,KAAK,GAAG,CAAC;AACzD,UAAM,YAAY;AAAA,MAChB,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,KAAK,eAAe,OAAO,QAAQ,KAAK,OAAO;AAAA,MAC/C,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,MACtC,KAAK,OAAO,QAAQ,QAAQ;AAAA,IAC9B,CAAC;AACD;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,oBAAoB,OAAO,wBAAwB;AACrE;AAEA,SAAS,gBAAgB,OAA8D;AACrF,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,UAAU,UAAU,UAAU,oBAAoB,UAAU,UAAW,QAAO;AAClF,QAAM,IAAI,MAAM,oDAAoD;AACtE;AAEA,SAAS,YAAY,OAAe,MAAwB;AAC1D,MAAI,CAAC,iBAAiB,OAAO,UAAU,QAAQ,UAAU,EAAE,SAAS,KAAK,EAAG,QAAO;AACnF,QAAM,IAAI,MAAM,GAAG,IAAI,wDAAwD;AACjF;AAEA,SAAS,YAAY,QAA4C;AAC/D,QAAM,WAAW;AAAA,IACf,GAAG,cAAc,OAAO,QAAQ,OAAO,SAAS;AAAA,IAChD,GAAG,cAAc,OAAO,QAAQ,SAAS,WAAW;AAAA,EACtD;AACA,SAAQ,SAAS,SAAS,WAAW,CAAC,KAAK;AAC7C;AAEA,SAAS,cAAc,OAAgD,MAAwB;AAC7F,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,MAAI,OAAO,UAAU,UAAW,OAAM,IAAI,MAAM,GAAG,IAAI,0BAA0B;AACjF,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACjD,QAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC;AACnD,MAAI,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,0BAA0B;AACzF,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AACxC;","names":["import_security","import_node_process","import_node_fs","import_db","process","resolve","import_node_process","process","process","res","body","policy","import_node_fs","import_node_path","import_node_child_process","import_node_fs","import_node_path","import_node_child_process","import_node_fs","import_node_path","import_node_fs","import_node_path","import_apps","import_node_process","process","safeText","publishableKey","import_node_path","import_node_fs","import_node_fs","import_node_path","import_node_url","targetDir","postJson","safeText","writeDevVars"]}
+{"version":3,"sources":["../src/index.ts","../../../node_modules/tsup/assets/cjs_shims.js","../src/cli.ts","../src/admin-ai.ts","../src/token.ts","../src/open.ts","../src/local.ts","../src/admin-ai-auth.ts","../src/admin-ai-audit.ts","../src/admin-ai-policy.ts","../src/admin-ai-usage.ts","../src/argv.ts","../src/capabilities.ts","../src/config.ts","../src/doctor-checks.ts","../src/redact.ts","../src/wrangler.ts","../src/doctor.ts","../src/init.ts","../src/provision.ts","../src/provision-credentials.ts","../src/secrets.ts","../src/security.ts","../src/help.ts","../src/skill.ts","../src/skill-adapters.ts","../src/smoke.ts"],"sourcesContent":["export { runCli } from \"./cli\";\nexport { adminAi, getScopedPlatformToken, SYSTEM_AI_PURPOSES } from \"./admin-ai\";\nexport type { AdminAiOptions, ScopedPlatformTokenOptions, SystemAiPurpose } from \"./admin-ai\";\nexport { CAPABILITIES, printCapabilities } from \"./capabilities\";\nexport { doctor } from \"./doctor\";\nexport { initProject } from \"./init\";\nexport { provision } from \"./provision\";\nexport { redactSecrets } from \"./redact\";\nexport { secretsPush } from \"./secrets\";\nexport type { SecretsPushOptions } from \"./secrets\";\nexport { runHostedSecurity } from \"./security\";\nexport type { HostedSecurityProfile, HostedSecurityResult, HostedSecurityTokenRequest, RunHostedSecurityOptions } from \"./security\";\nexport { AGENT_HARNESSES, installSkill } from \"./skill\";\nexport type { AgentHarness, AgentHarnessSelector, HarnessInstallResult, SkillInstallOptions, SkillInstallResult } from \"./skill\";\nexport { smoke } from \"./smoke\";\nexport type { OdlaProjectConfig, LoadedProjectConfig, LocalCredentials, ProvisionOptions, ProvisionPlan, SmokeOptions } from \"./types\";\n","// Shim globals in cjs bundle\n// There's a weird bug that esbuild will always inject importMetaUrl\n// if we export it as `const importMetaUrl = ... __filename ...`\n// But using a function will not cause this issue\n\nconst getImportMetaUrl = () => \n  typeof document === \"undefined\" \n    ? new URL(`file:${__filename}`).href \n    : (document.currentScript && document.currentScript.tagName.toUpperCase() === 'SCRIPT') \n      ? document.currentScript.src \n      : new URL(\"main.js\", document.baseURI).href;\n\nexport const importMetaUrl = /* @__PURE__ */ getImportMetaUrl()\n","import { findingsAtOrAbove, type Severity } from \"@odla-ai/security\";\nimport { adminAi, getScopedPlatformToken } from \"./admin-ai\";\nimport { assertArgs, boolOpt, listOpt, numberOpt, parseArgv, requiredString, stringOpt, type ParsedArgv } from \"./argv\";\nimport { printCapabilities } from \"./capabilities\";\nimport { loadProjectConfig } from \"./config\";\nimport { doctor } from \"./doctor\";\nimport { initProject } from \"./init\";\nimport { provision } from \"./provision\";\nimport { secretsPush } from \"./secrets\";\nimport { runHostedSecurity, type HostedSecurityProfile } from \"./security\";\nimport { cliVersion, printHelp } from \"./help\";\nimport { installSkill } from \"./skill\";\nimport type { AgentHarnessSelector } from \"./skill\";\nimport { smoke } from \"./smoke\";\nimport { getDeveloperToken, platformAudience } from \"./token\";\nimport type { ProvisionOptions } from \"./types\";\n\n/**\n * Parse CLI arguments and dispatch to the matching command — the entry point\n * `bin.ts` invokes. `argv` defaults to `process.argv.slice(2)`; the first\n * positional selects the command and the rest are parsed into flags (supporting\n * `--flag value`, `--flag=value`, boolean `--flag`, `--no-flag`, and repeated\n * flags collected into arrays).\n *\n * Recognized commands: `version`/`-v`/`--version` and `help`/`-h`/`--help` print\n * and return; `init` scaffolds a project (requires `--app-id` and `--name`);\n * `doctor` validates config offline; `capabilities` prints the responsibility\n * boundary; `admin ai` reads/updates purpose-specific platform AI policies,\n * transfers write-only credentials, and reads metadata-only attributed usage\n * through separate short-lived exact-scope device grants;\n * `security run` performs an explicitly acknowledged, app-attributed hosted\n * reasoning pass; `provision` runs the full provision (including optional secret\n * rotation, local vars, and deployed secret push); `smoke` checks a live env;\n * `setup` and `skill install` install the bundled offline runbooks for Claude\n * Code, Codex, Cursor, Copilot, Gemini, and `AGENTS.md`-aware agents; and\n * `secrets push` pipes the env's configured db/o11y secrets into the Worker via\n * Wrangler (requires `--env`). Throws on an unknown command/subcommand, unsupported option, extra\n * positional argument, missing required value, or a dispatched command error.\n *\n * @param argv Argument vector without the node/script prefix (default\n *   `process.argv.slice(2)`).\n */\nexport async function runCli(argv = process.argv.slice(2)): Promise<void> {\n  const parsed = parseArgv(argv);\n  const command = parsed.positionals[0] ?? \"help\";\n  if (command === \"version\" || command === \"-v\" || parsed.options.version === true) {\n    assertArgs(parsed, [\"version\"], 1);\n    console.log(cliVersion());\n    return;\n  }\n\n  if (command === \"help\" || command === \"--help\" || command === \"-h\") {\n    assertArgs(parsed, [\"help\"], 1);\n    printHelp();\n    return;\n  }\n\n  if (command === \"init\") {\n    assertArgs(parsed, [\"app-id\", \"name\", \"config\", \"env\", \"services\", \"ai-provider\", \"force\"], 1);\n    initProject({\n      appId: requiredString(parsed.options[\"app-id\"], \"--app-id\"),\n      name: requiredString(parsed.options.name, \"--name\"),\n      configPath: stringOpt(parsed.options.config),\n      envs: listOpt(parsed.options.env),\n      services: listOpt(parsed.options.services),\n      aiProvider: stringOpt(parsed.options[\"ai-provider\"]),\n      force: parsed.options.force === true,\n    });\n    return;\n  }\n\n  if (command === \"doctor\") {\n    assertArgs(parsed, [\"config\"], 1);\n    await doctor({ configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\" });\n    return;\n  }\n\n  if (command === \"capabilities\") {\n    assertArgs(parsed, [\"json\"], 1);\n    printCapabilities(parsed.options.json === true);\n    return;\n  }\n\n  if (command === \"admin\") {\n    const area = parsed.positionals[1];\n    const action = parsed.positionals[2];\n    const credentialSet = action === \"credential\" && parsed.positionals[3] === \"set\";\n    const credentials = action === \"credentials\";\n    const models = action === \"models\";\n    const usage = action === \"usage\";\n    const audit = action === \"audit\";\n    if (area !== \"ai\" || (action !== \"show\" && action !== \"set\" && !credentialSet && !credentials && !models && !usage && !audit)) {\n      throw new Error('unknown admin command. Try \"odla-ai admin ai show\".');\n    }\n    assertArgs(parsed, [\n      \"platform\", \"json\", \"open\", \"provider\", \"model\", \"enabled\",\n      \"max-input-bytes\", \"max-output-tokens\", \"max-calls-per-run\", \"from-env\", \"stdin\",\n      \"discovery-provider\", \"discovery-model\", \"validation-provider\", \"validation-model\",\n      \"app-id\", \"env\", \"run-id\", \"limit\",\n    ], credentialSet ? 5 : action === \"set\" ? 4 : 3);\n    await adminAi({\n      action: credentialSet ? \"credential-set\" : credentials ? \"credentials\" : models ? \"models\" : usage ? \"usage\" : audit ? \"audit\" : action as \"show\" | \"set\",\n      purpose: action === \"set\" ? parsed.positionals[3] : undefined,\n      provider: stringOpt(parsed.options.provider),\n      model: stringOpt(parsed.options.model),\n      enabled: boolOpt(parsed.options.enabled),\n      maxInputBytes: numberOpt(parsed.options[\"max-input-bytes\"], \"--max-input-bytes\"),\n      maxOutputTokens: numberOpt(parsed.options[\"max-output-tokens\"], \"--max-output-tokens\"),\n      maxCallsPerRun: numberOpt(parsed.options[\"max-calls-per-run\"], \"--max-calls-per-run\"),\n      platform: stringOpt(parsed.options.platform),\n      json: parsed.options.json === true,\n      open: parsed.options.open === false ? false : parsed.options.open === true ? true : undefined,\n      credentialProvider: credentialSet ? parsed.positionals[4] : undefined,\n      fromEnv: stringOpt(parsed.options[\"from-env\"]),\n      stdin: parsed.options.stdin === true,\n      discoveryProvider: stringOpt(parsed.options[\"discovery-provider\"]),\n      discoveryModel: stringOpt(parsed.options[\"discovery-model\"]),\n      validationProvider: stringOpt(parsed.options[\"validation-provider\"]),\n      validationModel: stringOpt(parsed.options[\"validation-model\"]),\n      appId: stringOpt(parsed.options[\"app-id\"]),\n      env: stringOpt(parsed.options.env),\n      runId: stringOpt(parsed.options[\"run-id\"]),\n      limit: numberOpt(parsed.options.limit, \"--limit\"),\n    });\n    return;\n  }\n\n  if (command === \"security\") {\n    const sub = parsed.positionals[1];\n    if (sub !== \"run\") throw new Error('unknown security command. Try \"odla-ai security run\".');\n    assertArgs(parsed, [\n      \"config\", \"env\", \"out\", \"profile\", \"max-hunt-tasks\", \"run-id\", \"platform\",\n      \"self\", \"ack-redacted-source\", \"open\", \"fail-on\", \"fail-on-candidates\", \"allow-incomplete\",\n    ], 3);\n    const configPath = stringOpt(parsed.options.config) ?? \"odla.config.mjs\";\n    const selfAudit = parsed.options.self === true;\n    const open = parsed.options.open === false ? false : parsed.options.open === true ? true : undefined;\n    const platform = stringOpt(parsed.options.platform);\n    const result = await runHostedSecurity({\n      configPath,\n      selfAudit,\n      target: parsed.positionals[2],\n      out: stringOpt(parsed.options.out),\n      env: stringOpt(parsed.options.env),\n      profile: securityProfile(stringOpt(parsed.options.profile)),\n      maxHuntTasks: numberOpt(parsed.options[\"max-hunt-tasks\"], \"--max-hunt-tasks\"),\n      runId: stringOpt(parsed.options[\"run-id\"]),\n      platform,\n      sourceDisclosureAck: parsed.options[\"ack-redacted-source\"] === true ? \"redacted\" : undefined,\n      getToken: async (request) => {\n        if (request.scope === \"platform:security:self\") {\n          return getScopedPlatformToken({ platform: request.platform, scope: request.scope, open });\n        }\n        const cfg = await loadProjectConfig(configPath);\n        if (platformAudience(cfg.platformUrl) !== platformAudience(request.platform)) {\n          throw new Error(\"--platform cannot reuse a project developer token from another platform; update odla.config.mjs and authenticate there\");\n        }\n        return getDeveloperToken(cfg, { configPath, open }, fetch, console);\n      },\n    });\n    const failOn = severityOpt(stringOpt(parsed.options[\"fail-on\"]) ?? \"high\", \"--fail-on\");\n    const candidateValue = parsed.options[\"fail-on-candidates\"];\n    const failOnCandidates = candidateValue === false ? undefined : severityOpt(stringOpt(candidateValue) ?? \"critical\", \"--fail-on-candidates\");\n    const confirmed = findingsAtOrAbove(result.report, failOn);\n    const leads = failOnCandidates\n      ? findingsAtOrAbove(result.report, failOnCandidates, true).filter((finding) => finding.disposition !== \"confirmed\")\n      : [];\n    const incomplete = result.report.coverageStatus === \"incomplete\" && parsed.options[\"allow-incomplete\"] !== true;\n    if (confirmed.length || leads.length || incomplete) {\n      throw new Error(`hosted security gate failed: ${confirmed.length} confirmed >= ${failOn}; ${leads.length} leads >= ${failOnCandidates ?? \"disabled\"}${incomplete ? \"; coverage incomplete\" : \"\"}`);\n    }\n    return;\n  }\n\n  if (command === \"provision\") {\n    assertArgs(\n      parsed,\n      [\n        \"config\", \"dry-run\", \"rotate-keys\", \"rotate-o11y-token\", \"push-secrets\", \"write-credentials\",\n        \"write-dev-vars\", \"token\", \"open\", \"yes\",\n      ],\n      1,\n    );\n    const writeDevVars = parsed.options[\"write-dev-vars\"];\n    const opts: ProvisionOptions = {\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      dryRun: parsed.options[\"dry-run\"] === true,\n      rotateKeys: parsed.options[\"rotate-keys\"] === true,\n      rotateO11yToken: parsed.options[\"rotate-o11y-token\"] === true,\n      pushSecrets: parsed.options[\"push-secrets\"] === true,\n      writeCredentials: parsed.options[\"write-credentials\"] !== false,\n      writeDevVars: typeof writeDevVars === \"string\" ? writeDevVars : writeDevVars === true,\n      token: stringOpt(parsed.options.token),\n      open: parsed.options.open === false ? false : parsed.options.open === true ? true : undefined,\n      yes: parsed.options.yes === true,\n    };\n    await provision(opts);\n    return;\n  }\n\n  if (command === \"smoke\") {\n    assertArgs(parsed, [\"config\", \"env\"], 1);\n    await smoke({\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      env: stringOpt(parsed.options.env),\n    });\n    return;\n  }\n\n  if (command === \"setup\") {\n    assertArgs(parsed, [\"dir\", \"global\", \"force\", \"agent\", \"harness\"], 1);\n    // The agent front door: install the bundled skills so a coding agent picks\n    // up the `odla` skill and drives init/provision/build from here.\n    installSkill({\n      dir: stringOpt(parsed.options.dir),\n      global: parsed.options.global === true,\n      harnesses: harnessList(parsed),\n      force: parsed.options.force === true,\n    });\n    console.log(\n      \"\\nOffline runbooks installed. Open this repo in your coding agent and ask it to set up odla.\\n\" +\n        \"Its native adapter finds the local `odla` skill, chooses build or migration, and drives the CLI.\",\n    );\n    return;\n  }\n\n  if (command === \"skill\") {\n    const sub = parsed.positionals[1];\n    if (sub !== \"install\") throw new Error(`unknown skill subcommand \"${sub ?? \"\"}\". Try \"odla-ai skill install\".`);\n    assertArgs(parsed, [\"dir\", \"global\", \"force\", \"agent\", \"harness\"], 2);\n    installSkill({\n      dir: stringOpt(parsed.options.dir),\n      global: parsed.options.global === true,\n      harnesses: harnessList(parsed),\n      force: parsed.options.force === true,\n    });\n    return;\n  }\n\n  if (command === \"secrets\") {\n    const sub = parsed.positionals[1];\n    if (sub !== \"push\") throw new Error(`unknown secrets subcommand \"${sub ?? \"\"}\". Try \"odla-ai secrets push --env dev\".`);\n    assertArgs(parsed, [\"config\", \"env\", \"dry-run\", \"yes\"], 2);\n    await secretsPush({\n      configPath: stringOpt(parsed.options.config) ?? \"odla.config.mjs\",\n      env: requiredString(parsed.options.env, \"--env\"),\n      dryRun: parsed.options[\"dry-run\"] === true,\n      yes: parsed.options.yes === true,\n    });\n    return;\n  }\n\n  throw new Error(`unknown command \"${command}\". Run \"odla-ai help\".`);\n}\n\nfunction securityProfile(value: string | undefined): HostedSecurityProfile | undefined {\n  if (value === undefined) return undefined;\n  if (value === \"odla\" || value === \"cloudflare-app\" || value === \"generic\") return value;\n  throw new Error(\"--profile must be odla, cloudflare-app, or generic\");\n}\n\nfunction severityOpt(value: string, flag: string): Severity {\n  if ([\"informational\", \"low\", \"medium\", \"high\", \"critical\"].includes(value)) return value as Severity;\n  throw new Error(`${flag} must be informational, low, medium, high, or critical`);\n}\n\nfunction harnessList(parsed: ParsedArgv): AgentHarnessSelector[] {\n  const selected = [\n    ...harnessOption(parsed.options.agent, \"--agent\"),\n    ...harnessOption(parsed.options.harness, \"--harness\"),\n  ];\n  return (selected.length ? selected : [\"all\"]) as AgentHarnessSelector[];\n}\n\nfunction harnessOption(value: string | boolean | string[] | undefined, flag: string): string[] {\n  if (value === undefined) return [];\n  if (typeof value === \"boolean\") throw new Error(`${flag} requires a harness name`);\n  const raw = Array.isArray(value) ? value : [value];\n  const parts = raw.flatMap((item) => item.split(\",\"));\n  if (parts.some((item) => !item.trim())) throw new Error(`${flag} requires a harness name`);\n  return parts.map((item) => item.trim());\n}\n","import process from \"node:process\";\nimport { platformAudience } from \"./token\";\nimport { resolveAdminPlatformToken, type ScopedPlatformScope } from \"./admin-ai-auth\";\nimport { adminAiAuditQuery, readAdminAiAudit } from \"./admin-ai-audit\";\nimport { requireSystemAiPurpose } from \"./admin-ai-policy\";\nimport { adminAiUsageQuery, readAdminAiUsage } from \"./admin-ai-usage\";\nexport { getScopedPlatformToken } from \"./admin-ai-auth\";\nexport type { ScopedPlatformTokenOptions } from \"./admin-ai-auth\";\nexport { SYSTEM_AI_PURPOSES } from \"./admin-ai-policy\";\nexport type { SystemAiPurpose } from \"./admin-ai-policy\";\n\n/** Inputs for one System AI policy/catalog read, policy update,\n * credential-status read, write-only credential transfer, or metadata-only\n * usage or admin-audit read. Provider values may come only from a named environment variable\n * or stdin. */\nexport interface AdminAiOptions {\n  action: \"show\" | \"models\" | \"set\" | \"credentials\" | \"credential-set\" | \"usage\" | \"audit\";\n  purpose?: string;\n  provider?: string;\n  model?: string;\n  enabled?: boolean;\n  maxInputBytes?: number;\n  maxOutputTokens?: number;\n  maxCallsPerRun?: number;\n  platform?: string;\n  token?: string;\n  json?: boolean;\n  open?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\">;\n  openApprovalUrl?: (url: string) => Promise<void>;\n  credentialProvider?: string;\n  fromEnv?: string;\n  stdin?: boolean;\n  readStdin?: () => Promise<string>;\n  discoveryProvider?: string;\n  discoveryModel?: string;\n  validationProvider?: string;\n  validationModel?: string;\n  /** Optional metadata-only usage filters. */\n  appId?: string;\n  env?: string;\n  runId?: string;\n  limit?: number;\n  /** Separate short-lived admin-token cache; never reuses the app developer-token file. */\n  tokenFile?: string;\n}\n\n/** Read or update platform-funded AI routing and inspect attributed usage.\n * Authentication is a short-lived,\n * explicitly scoped device grant; ordinary app developer tokens never become\n * platform admins. Credential writes accept values only from a named env var\n * or stdin, transfer them once, and never place them in argv, output, or the\n * scoped-token cache. */\nexport async function adminAi(options: AdminAiOptions): Promise<void> {\n  const platform = platformAudience(options.platform ?? process.env.ODLA_PLATFORM ?? \"https://odla.ai\");\n  const doFetch = options.fetch ?? fetch;\n  const out = options.stdout ?? console;\n  const usageQuery = options.action === \"usage\" ? adminAiUsageQuery(options) : undefined;\n  const auditQuery = options.action === \"audit\" ? adminAiAuditQuery(options) : undefined;\n  const scope: ScopedPlatformScope = options.action === \"set\"\n    ? \"platform:ai:policy:write\"\n    : options.action === \"credential-set\"\n      ? \"platform:ai:credential:write\"\n      : options.action === \"credentials\"\n        ? \"platform:ai:credential:read\"\n        : options.action === \"usage\"\n          ? \"platform:ai:usage:read\"\n          : options.action === \"audit\"\n            ? \"platform:ai:audit:read\"\n          : \"platform:ai:policy:read\";\n  const token = await resolveAdminPlatformToken({\n    platform,\n    scope,\n    token: options.token,\n    open: options.open,\n    fetch: doFetch,\n    stdout: out,\n    openApprovalUrl: options.openApprovalUrl,\n    tokenFile: options.tokenFile,\n  });\n  const headers = { authorization: `Bearer ${token}`, \"content-type\": \"application/json\" };\n\n  if (options.action === \"usage\") {\n    await readAdminAiUsage({ platform, query: usageQuery ?? \"\", headers, json: options.json, fetch: doFetch, stdout: out });\n    return;\n  }\n\n  if (options.action === \"audit\") {\n    await readAdminAiAudit({ platform, query: auditQuery ?? \"\", headers, json: options.json, fetch: doFetch, stdout: out });\n    return;\n  }\n\n  if (options.action === \"credentials\") {\n    const res = await doFetch(`${platform}/registry/platform/ai-credentials`, { headers });\n    const body = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(\"read platform AI credential status\", res.status, body));\n    const credentials = isRecord(body) && isRecord(body.credentials) ? body.credentials : body;\n    if (options.json) out.log(JSON.stringify({ credentials }, null, 2));\n    else for (const [provider, status] of Object.entries(isRecord(credentials) ? credentials : {})) {\n      const label = isRecord(status) && status.set === true\n        ? status.readable === true ? \"vault readable\" : \"stored; vault unreadable\"\n        : \"not set\";\n      out.log(`${provider}\\t${label}`);\n    }\n    return;\n  }\n\n  if (options.action === \"credential-set\") {\n    const provider = requireProvider(options.credentialProvider);\n    const value = await credentialValue(options);\n    const res = await doFetch(`${platform}/registry/platform/ai-credentials/${encodeURIComponent(provider)}`, {\n      method: \"PUT\",\n      headers,\n      body: JSON.stringify({ value }),\n    });\n    const body = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(`store ${provider} platform credential`, res.status, body));\n    out.log(`stored ${provider} platform credential (write-only; value was not returned)`);\n    return;\n  }\n\n  if (options.action === \"show\" || options.action === \"models\") {\n    const res = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });\n    const body = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(\"read platform AI policies\", res.status, body));\n    if (options.action === \"models\") {\n      const models = catalogModels(body).filter((model) => !options.provider || model.provider === options.provider);\n      if (!models.length) throw new Error(options.provider ? `no System AI models found for provider ${options.provider}` : \"platform returned no System AI models\");\n      if (options.json) out.log(JSON.stringify({ models }, null, 2));\n      else for (const model of models) out.log(`${model.provider}\\t${model.id}`);\n      return;\n    }\n    const policies = policyArray(body);\n    if (options.json) {\n      out.log(JSON.stringify({ policies, models: catalogModels(body) }, null, 2));\n      return;\n    }\n    out.log(\"purpose\\tenabled\\tprovider\\tmodel\\tmax calls\\tmax input bytes\\tmax output tokens\");\n    for (const policy of policies) {\n      out.log([\n        policy.purpose,\n        String(policy.enabled),\n        policy.provider,\n        policy.model,\n        String(policy.maxCallsPerRun ?? \"\"),\n        String(policy.maxInputBytes ?? \"\"),\n        String(policy.maxOutputTokens ?? \"\"),\n      ].join(\"\\t\"));\n    }\n    return;\n  }\n\n  if (options.purpose === \"security\") {\n    const currentResponse = await doFetch(`${platform}/registry/platform/ai-policies`, { headers });\n    const currentBody = await responseBody(currentResponse);\n    if (!currentResponse.ok) throw new Error(apiError(\"read current security AI policies\", currentResponse.status, currentBody));\n    const policies = policyArray(currentBody);\n    const discovery = policies.find((policy) => policy.purpose === \"security.discovery\");\n    const validation = policies.find((policy) => policy.purpose === \"security.validation\");\n    if (!discovery || !validation || !Number.isSafeInteger(discovery.version) || !Number.isSafeInteger(validation.version)) {\n      throw new Error(\"platform returned invalid security AI policy revisions\");\n    }\n    const shared = {\n      ...(options.enabled === undefined ? {} : { enabled: options.enabled }),\n      ...(options.maxInputBytes === undefined ? {} : { maxInputBytes: options.maxInputBytes }),\n      ...(options.maxOutputTokens === undefined ? {} : { maxOutputTokens: options.maxOutputTokens }),\n      ...(options.maxCallsPerRun === undefined ? {} : { maxCallsPerRun: options.maxCallsPerRun }),\n    };\n    const discoveryUpdate = {\n      ...shared,\n      ...(options.discoveryProvider?.trim() ? { provider: options.discoveryProvider.trim() } : {}),\n      ...(options.discoveryModel?.trim() ? { model: options.discoveryModel.trim() } : {}),\n    };\n    const validationUpdate = {\n      ...shared,\n      ...(options.validationProvider?.trim() ? { provider: options.validationProvider.trim() } : {}),\n      ...(options.validationModel?.trim() ? { model: options.validationModel.trim() } : {}),\n    };\n    if (!Object.keys(discoveryUpdate).length && !Object.keys(validationUpdate).length) {\n      throw new Error(\"security set requires a route, enabled state, or budget change\");\n    }\n    const res = await doFetch(`${platform}/registry/platform/ai-policies/security`, {\n      method: \"PUT\",\n      headers,\n      body: JSON.stringify({\n        expectedVersions: { discovery: discovery.version, validation: validation.version },\n        discovery: discoveryUpdate,\n        validation: validationUpdate,\n      }),\n    });\n    const response = await responseBody(res);\n    if (!res.ok) throw new Error(apiError(\"update security review routes\", res.status, response));\n    out.log(options.json ? JSON.stringify(response, null, 2) : \"updated security review discovery and independent validation routes atomically\");\n    return;\n  }\n\n  const purpose = requireSystemAiPurpose(options.purpose);\n  const body = {\n    ...(options.provider?.trim() ? { provider: options.provider.trim() } : {}),\n    ...(options.model?.trim() ? { model: options.model.trim() } : {}),\n    ...(options.enabled === undefined ? {} : { enabled: options.enabled }),\n    ...(options.maxInputBytes === undefined ? {} : { maxInputBytes: options.maxInputBytes }),\n    ...(options.maxOutputTokens === undefined ? {} : { maxOutputTokens: options.maxOutputTokens }),\n    ...(options.maxCallsPerRun === undefined ? {} : { maxCallsPerRun: options.maxCallsPerRun }),\n  };\n  if (!Object.keys(body).length) throw new Error(\"set requires a provider, model, enabled state, or budget change\");\n  const res = await doFetch(`${platform}/registry/platform/ai-policies/${encodeURIComponent(purpose)}`, {\n    method: \"PUT\",\n    headers,\n    body: JSON.stringify(body),\n  });\n  const response = await responseBody(res);\n  if (!res.ok) throw new Error(apiError(`update ${purpose}`, res.status, response));\n  const policy: Record<string, unknown> = isRecord(response) && isRecord(response.policy)\n    ? response.policy\n    : isRecord(response) ? response : {};\n  out.log(options.json ? JSON.stringify({ policy }, null, 2) : `updated ${purpose}: ${String(policy.provider ?? \"unchanged\")}/${String(policy.model ?? \"unchanged\")}`);\n}\n\nfunction requireProvider(value: string | undefined): \"anthropic\" | \"openai\" | \"google\" {\n  if (value !== \"anthropic\" && value !== \"openai\" && value !== \"google\") {\n    throw new Error(\"provider must be one of: anthropic, openai, google\");\n  }\n  return value;\n}\n\nasync function credentialValue(options: AdminAiOptions): Promise<string> {\n  if (options.fromEnv && options.stdin) throw new Error(\"choose exactly one of --from-env or --stdin\");\n  let value: string | undefined;\n  if (options.fromEnv) value = process.env[options.fromEnv];\n  else if (options.stdin) value = await (options.readStdin ?? readStdin)();\n  else throw new Error(\"credential input required: use --from-env <NAME> or --stdin; values are never accepted as arguments\");\n  value = value?.replace(/[\\r\\n]+$/, \"\");\n  if (!value) throw new Error(options.fromEnv ? `environment variable ${options.fromEnv} is empty or unset` : \"stdin credential is empty\");\n  if (new TextEncoder().encode(value).byteLength > 64 * 1024) throw new Error(\"credential exceeds 64 KiB\");\n  return value;\n}\n\nasync function readStdin(): Promise<string> {\n  let value = \"\";\n  for await (const chunk of process.stdin) {\n    value += String(chunk);\n    if (value.length > 64 * 1024) throw new Error(\"credential exceeds 64 KiB\");\n  }\n  return value;\n}\n\nfunction policyArray(body: unknown): Array<Record<string, unknown>> {\n  if (isRecord(body) && Array.isArray(body.policies)) return body.policies.filter(isRecord);\n  if (isRecord(body) && isRecord(body.policies)) return Object.values(body.policies).filter(isRecord);\n  throw new Error(\"platform returned an invalid AI policy response\");\n}\n\nfunction catalogModels(body: unknown): Array<{ id: string; provider: string }> {\n  if (!isRecord(body) || !isRecord(body.catalog) || !Array.isArray(body.catalog.models)) {\n    throw new Error(\"platform returned an invalid System AI model catalog\");\n  }\n  return body.catalog.models.filter((value): value is { id: string; provider: string } =>\n    isRecord(value) && typeof value.id === \"string\" && typeof value.provider === \"string\");\n}\n\nasync function responseBody(res: Response): Promise<unknown> {\n  const text = await res.text();\n  if (!text) return {};\n  try { return JSON.parse(text) as unknown; } catch { return { message: text.slice(0, 300) }; }\n}\n\nfunction apiError(action: string, status: number, body: unknown): string {\n  const error = isRecord(body) && isRecord(body.error) ? body.error : undefined;\n  const message = error && typeof error.message === \"string\" ? error.message : isRecord(body) && typeof body.message === \"string\" ? body.message : \"request failed\";\n  return `${action} failed (${status}): ${message}`;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n","import { requestToken } from \"@odla-ai/db\";\nimport process from \"node:process\";\nimport type { LoadedProjectConfig, ProvisionOptions } from \"./types\";\nimport { openUrl } from \"./open\";\nimport { displayPath, readJsonFile, writePrivateJson } from \"./local\";\n\ntype FetchLike = typeof fetch;\n\nexport async function getDeveloperToken(\n  cfg: LoadedProjectConfig,\n  options: ProvisionOptions,\n  doFetch: FetchLike,\n  out: Pick<typeof console, \"log\" | \"error\">,\n): Promise<string> {\n  if (options.token) return options.token;\n  const audience = platformAudience(cfg.platformUrl);\n  if (process.env.ODLA_DEV_TOKEN) {\n    const declared = process.env.ODLA_DEV_TOKEN_AUDIENCE;\n    if (declared) {\n      if (platformAudience(declared) !== audience) throw new Error(\"ODLA_DEV_TOKEN_AUDIENCE does not match the configured platform\");\n    } else if (audience !== \"https://odla.ai\") {\n      throw new Error(\"ODLA_DEV_TOKEN_AUDIENCE is required for a non-default platform\");\n    }\n    return process.env.ODLA_DEV_TOKEN;\n  }\n\n  const cached = readJsonFile<{ token?: string; expiresAt?: number; platform?: string }>(cfg.local.tokenFile);\n  if (cached?.token && cached.platform === audience && (cached.expiresAt ?? 0) > Date.now() + 60_000) {\n    out.log(`auth: using cached developer token (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);\n    return cached.token;\n  }\n\n  const browser = approvalBrowser(options);\n  const { token, expiresAt } = await requestToken({\n    endpoint: cfg.platformUrl,\n    label: `${cfg.app.id} provisioner`,\n    fetch: doFetch,\n    onCode: async ({ userCode, expiresIn }) => {\n      const approvalUrl = handshakeUrl(cfg.platformUrl, userCode);\n      out.log(\"\");\n      out.log(`Approve code ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);\n      if (browser.open) {\n        try {\n          await (options.openApprovalUrl ?? openUrl)(approvalUrl);\n          out.log(`auth: opened browser for approval${browser.mode === \"auto\" ? \" (auto)\" : \"\"}`);\n        } catch (err) {\n          out.log(`auth: could not open browser (${err instanceof Error ? err.message : String(err)})`);\n        }\n      } else if (browser.reason) {\n        out.log(`auth: browser launch skipped (${browser.reason})`);\n      }\n      out.log(\"\");\n    },\n  });\n  writePrivateJson(cfg.local.tokenFile, { platform: audience, token, expiresAt });\n  out.log(`auth: developer token cached (${displayPath(cfg.local.tokenFile, cfg.rootDir)})`);\n  return token;\n}\n\nexport function approvalBrowser(options: ProvisionOptions): { open: boolean; mode?: \"auto\" | \"forced\"; reason?: string } {\n  if (options.open === true) return { open: true, mode: \"forced\" };\n  if (options.open === false) return { open: false, reason: \"disabled by --no-open\" };\n  if (process.env.CI) return { open: false, reason: \"CI environment\" };\n\n  const interactive = options.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);\n  if (!interactive) return { open: false, reason: \"non-interactive shell; pass --open to force\" };\n  return { open: true, mode: \"auto\" };\n}\n\nexport function handshakeUrl(platformUrl: string, userCode: string): string {\n  const url = new URL(\"/studio\", platformUrl);\n  url.searchParams.set(\"code\", userCode);\n  return url.toString();\n}\n\n/** Canonical credential audience: one HTTPS origin (HTTP only on loopback). */\nexport function platformAudience(value: string): string {\n  let url: URL;\n  try { url = new URL(value); } catch { throw new Error(\"platform must be an absolute URL\"); }\n  const local = url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\" || url.hostname === \"[::1]\";\n  if (url.protocol !== \"https:\" && !(local && url.protocol === \"http:\")) {\n    throw new Error(\"platform credentials require HTTPS except for loopback development\");\n  }\n  if (url.username || url.password || url.search || url.hash) {\n    throw new Error(\"platform URL must not contain credentials, query, or fragment\");\n  }\n  return url.origin;\n}\n","import { spawn } from \"node:child_process\";\nimport process from \"node:process\";\n\nexport interface OpenUrlOptions {\n  platform?: NodeJS.Platform;\n  spawnImpl?: typeof spawn;\n}\n\nexport async function openUrl(url: string, options: OpenUrlOptions = {}): Promise<void> {\n  const command = openerFor(options.platform ?? process.platform);\n  const doSpawn = options.spawnImpl ?? spawn;\n  await new Promise<void>((resolve, reject) => {\n    const child = doSpawn(command.cmd, [...command.args, url], {\n      stdio: \"ignore\",\n      detached: true,\n    });\n    child.once(\"error\", reject);\n    child.once(\"spawn\", () => {\n      child.unref();\n      resolve();\n    });\n  });\n}\n\nexport function openerFor(platform: NodeJS.Platform): { cmd: string; args: string[] } {\n  if (platform === \"darwin\") return { cmd: \"open\", args: [] };\n  if (platform === \"win32\") return { cmd: \"cmd\", args: [\"/c\", \"start\", \"\"] };\n  return { cmd: \"xdg-open\", args: [] };\n}\n","import { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, relative, resolve } from \"node:path\";\nimport type { LoadedProjectConfig, LocalCredentials } from \"./types\";\n\nconst GITIGNORE_LINES = [\".odla/*.local.json\", \".odla/dev-token.json\", \".dev.vars\"];\n\nexport function readJsonFile<T>(path: string): T | null {\n  try {\n    return JSON.parse(readFileSync(path, \"utf8\")) as T;\n  } catch {\n    return null;\n  }\n}\n\nexport function writePrivateJson(path: string, value: unknown): void {\n  writePrivateText(path, `${JSON.stringify(value, null, 2)}\\n`);\n}\n\nexport function readCredentials(path: string): LocalCredentials | null {\n  if (!existsSync(path)) return null;\n  let value: unknown;\n  try {\n    value = JSON.parse(readFileSync(path, \"utf8\"));\n  } catch {\n    throw new Error(`credentials file ${path} is not valid JSON; fix or remove it before provisioning`);\n  }\n  if (!value || typeof value !== \"object\" || typeof (value as LocalCredentials).appId !== \"string\" ||\n      !(value as LocalCredentials).envs || typeof (value as LocalCredentials).envs !== \"object\") {\n    throw new Error(`credentials file ${path} has an invalid shape; fix or remove it before provisioning`);\n  }\n  return value as LocalCredentials;\n}\n\nexport function mergeCredential(\n  current: LocalCredentials | null,\n  update: { appId: string; platformUrl: string; dbEndpoint: string; env: string; tenantId: string; dbKey?: string; o11yToken?: string },\n): LocalCredentials {\n  const next: LocalCredentials = current ?? {\n    appId: update.appId,\n    platformUrl: update.platformUrl,\n    dbEndpoint: update.dbEndpoint,\n    updatedAt: new Date(0).toISOString(),\n    envs: {},\n  };\n  next.appId = update.appId;\n  next.platformUrl = update.platformUrl;\n  next.dbEndpoint = update.dbEndpoint;\n  next.updatedAt = new Date().toISOString();\n  next.envs[update.env] = {\n    ...(next.envs[update.env] ?? {}),\n    tenantId: update.tenantId,\n    ...(update.dbKey ? { dbKey: update.dbKey } : {}),\n    ...(update.o11yToken ? { o11yToken: update.o11yToken } : {}),\n  };\n  return next;\n}\n\nexport function ensureGitignore(rootDir: string, localPaths: string[] = []): void {\n  const path = resolve(rootDir, \".gitignore\");\n  const existing = existsSync(path) ? readFileSync(path, \"utf8\") : \"\";\n  const configured = localPaths.map((localPath) => gitignoreEntry(rootDir, localPath)).filter((line): line is string => !!line);\n  const wanted = [...new Set([...GITIGNORE_LINES, ...configured])];\n  const missing = wanted.filter((line) => !existing.split(/\\r?\\n/).includes(line));\n  if (missing.length === 0) return;\n  const prefix = existing && !existing.endsWith(\"\\n\") ? \"\\n\" : \"\";\n  writeFileSync(path, `${existing}${prefix}${missing.join(\"\\n\")}\\n`);\n}\n\nexport interface O11yDevVars {\n  endpoint: string;\n  service: string;\n  version?: string;\n}\n\nexport function o11yDevVars(cfg: LoadedProjectConfig): O11yDevVars | undefined {\n  if (!cfg.services.includes(\"o11y\")) return undefined;\n  return {\n    endpoint: cfg.o11y?.endpoint ?? \"https://o11y.odla.ai\",\n    service: cfg.o11y?.service ?? cfg.app.id,\n    ...(cfg.o11y?.version ? { version: cfg.o11y.version } : {}),\n  };\n}\n\nexport function resolveWriteDevVarsTarget(cfg: LoadedProjectConfig, requested: string | boolean | undefined): string | null {\n  if (!requested) return null;\n  if (requested === true) return cfg.local.devVarsFile;\n  return resolve(dirname(cfg.configPath), requested);\n}\n\nexport function writeDevVars(path: string, credentials: LocalCredentials, env: string, o11y?: O11yDevVars): void {\n  const entry = credentials.envs[env];\n  if (!entry) throw new Error(`no credentials for env \"${env}\" in ${path}`);\n  const lines = [`ODLA_PLATFORM=\"${credentials.platformUrl}\"`];\n  if (entry.dbKey) lines.push(`ODLA_ENDPOINT=\"${credentials.dbEndpoint}\"`);\n  lines.push(`ODLA_APP_ID=\"${credentials.appId}\"`, `ODLA_ENV=\"${env}\"`, `ODLA_TENANT=\"${entry.tenantId}\"`);\n  if (entry.dbKey) lines.push(`ODLA_API_KEY=\"${entry.dbKey}\"`);\n  if (o11y) {\n    lines.push(`ODLA_O11Y_ENDPOINT=\"${o11y.endpoint}\"`, `ODLA_O11Y_SERVICE=\"${o11y.service}\"`);\n    if (o11y.version) lines.push(`ODLA_O11Y_VERSION=\"${o11y.version}\"`);\n    // The ingest token is a secret; .dev.vars is gitignored (holds ODLA_API_KEY too).\n    if (entry.o11yToken) lines.push(`ODLA_O11Y_TOKEN=\"${entry.o11yToken}\"`);\n  }\n  const existing = existsSync(path) ? readFileSync(path, \"utf8\") : \"\";\n  const retained = existing.split(/\\r?\\n/).filter((line) => !isManagedDevVar(line));\n  while (retained.at(-1) === \"\") retained.pop();\n  const prefix = retained.length ? `${retained.join(\"\\n\")}\\n\\n` : \"\";\n  writePrivateText(path, `${prefix}${lines.join(\"\\n\")}\\n`);\n}\n\nconst MANAGED_DEV_VARS = new Set([\n  \"ODLA_PLATFORM\", \"ODLA_ENDPOINT\", \"ODLA_APP_ID\", \"ODLA_ENV\", \"ODLA_TENANT\", \"ODLA_API_KEY\",\n  \"ODLA_O11Y_ENDPOINT\", \"ODLA_O11Y_SERVICE\", \"ODLA_O11Y_VERSION\", \"ODLA_O11Y_TOKEN\",\n]);\n\nfunction isManagedDevVar(line: string): boolean {\n  const match = line.match(/^\\s*(?:export\\s+)?([A-Z][A-Z0-9_]*)\\s*=/);\n  return !!match?.[1] && MANAGED_DEV_VARS.has(match[1]);\n}\n\nfunction writePrivateText(path: string, text: string): void {\n  mkdirSync(dirname(path), { recursive: true });\n  const temporary = `${path}.tmp-${process.pid}-${Date.now()}`;\n  writeFileSync(temporary, text, { mode: 0o600 });\n  chmodSync(temporary, 0o600);\n  renameSync(temporary, path);\n}\n\nexport function gitignoreEntry(rootDir: string, path: string): string | null {\n  const rel = relative(resolve(rootDir), resolve(path));\n  if (!rel || rel === \"..\" || rel.startsWith(`..${process.platform === \"win32\" ? \"\\\\\" : \"/\"}`) || isAbsolute(rel)) return null;\n  return rel.replaceAll(\"\\\\\", \"/\");\n}\n\nexport function displayPath(path: string, rootDir = process.cwd()): string {\n  const rel = relative(rootDir, path);\n  return rel && !rel.startsWith(\"..\") ? rel : path;\n}\n","import { existsSync } from \"node:fs\";\nimport process from \"node:process\";\nimport { requestToken } from \"@odla-ai/db\";\nimport { ensureGitignore, readJsonFile, writePrivateJson } from \"./local\";\nimport { openUrl } from \"./open\";\nimport { handshakeUrl, platformAudience } from \"./token\";\n\n/** One exact platform scope obtainable through the admin device flow. */\nexport type ScopedPlatformScope =\n  | \"platform:ai:policy:read\"\n  | \"platform:ai:policy:write\"\n  | \"platform:ai:credential:read\"\n  | \"platform:ai:credential:write\"\n  | \"platform:ai:usage:read\"\n  | \"platform:ai:audit:read\"\n  | \"platform:security:self\";\n\n/** Inputs for obtaining one short-lived, exact-scope platform device grant. */\nexport interface ScopedPlatformTokenOptions {\n  platform: string;\n  scope: ScopedPlatformScope;\n  open?: boolean;\n  fetch?: typeof fetch;\n  stdout?: Pick<typeof console, \"log\">;\n  openApprovalUrl?: (url: string) => Promise<void>;\n  tokenFile?: string;\n}\n\ninterface AdminPlatformTokenOptions extends ScopedPlatformTokenOptions {\n  token?: string;\n}\n\n/** Obtain/cache one exact platform scope without granting ambient admin. */\nexport async function getScopedPlatformToken(options: ScopedPlatformTokenOptions): Promise<string> {\n  return resolveAdminPlatformToken(options);\n}\n\n/** Resolve an explicit, audience-bound env, cached, or newly approved token. */\nexport async function resolveAdminPlatformToken(options: AdminPlatformTokenOptions): Promise<string> {\n  const audience = platformAudience(options.platform);\n  if (options.token) return options.token;\n  const fromEnv = process.env.ODLA_ADMIN_TOKEN;\n  if (fromEnv) return audienceBoundEnvToken(fromEnv, audience);\n  return scopedToken(\n    audience,\n    options.scope,\n    options,\n    options.fetch ?? fetch,\n    options.stdout ?? console,\n  );\n}\n\nfunction audienceBoundEnvToken(token: string, platform: string): string {\n  const audience = platformAudience(platform);\n  const declared = process.env.ODLA_ADMIN_TOKEN_AUDIENCE;\n  if (declared) {\n    if (platformAudience(declared) !== audience) throw new Error(\"ODLA_ADMIN_TOKEN_AUDIENCE does not match the configured platform\");\n  } else if (audience !== \"https://odla.ai\") {\n    throw new Error(\"ODLA_ADMIN_TOKEN_AUDIENCE is required for a non-default platform\");\n  }\n  return token;\n}\n\nasync function scopedToken(\n  platform: string,\n  scope: string,\n  options: ScopedPlatformTokenOptions,\n  doFetch: typeof fetch,\n  out: Pick<typeof console, \"log\">,\n): Promise<string> {\n  const audience = platformAudience(platform);\n  const tokenFile = options.tokenFile ?? `${process.cwd()}/.odla/admin-token.local.json`;\n  const cache = readJsonFile<{ platform?: string; tokens?: Record<string, { token?: string; expiresAt?: number }> }>(tokenFile);\n  const cached = cache?.platform === audience ? cache.tokens?.[scope] : undefined;\n  if (cached?.token && (cached.expiresAt ?? 0) > Date.now() + 60_000) {\n    out.log(`auth: using cached ${scope} grant (${tokenFile})`);\n    return cached.token;\n  }\n  const { token, expiresAt } = await requestToken({\n    endpoint: audience,\n    label: `odla CLI admin AI (${scope})`,\n    scopes: [scope],\n    fetch: doFetch,\n    onCode: async ({ userCode, expiresIn }) => {\n      const approvalUrl = handshakeUrl(audience, userCode);\n      out.log(`Approve scoped request ${userCode} at ${approvalUrl} within ${Math.floor(expiresIn / 60)}m.`);\n      const shouldOpen = options.open === true || (options.open !== false && !process.env.CI && Boolean(process.stdin.isTTY && process.stdout.isTTY));\n      if (shouldOpen) await (options.openApprovalUrl ?? openUrl)(approvalUrl).catch(() => undefined);\n    },\n  });\n  const tokens = cache?.platform === audience ? { ...(cache.tokens ?? {}) } : {};\n  tokens[scope] = { token, expiresAt };\n  if (existsSync(`${process.cwd()}/.git`)) ensureGitignore(process.cwd(), [tokenFile]);\n  writePrivateJson(tokenFile, { platform: audience, tokens });\n  out.log(`auth: cached ${scope} grant (${tokenFile}; mode 0600)`);\n  return token;\n}\n","/** Optional limit for the metadata-only System AI administration trail. */\nexport interface AdminAiAuditFilters {\n  limit?: number;\n}\n\ninterface AdminAiAuditRequest {\n  platform: string;\n  query: string;\n  headers: Record<string, string>;\n  json?: boolean;\n  fetch: typeof fetch;\n  stdout: Pick<typeof console, \"log\">;\n}\n\n/** Validate the audit limit and build its query before authentication. */\nexport function adminAiAuditQuery(filters: AdminAiAuditFilters): string {\n  if (filters.limit === undefined) return \"\";\n  if (!Number.isSafeInteger(filters.limit) || filters.limit < 1 || filters.limit > 200) {\n    throw new Error(\"audit limit must be an integer from 1 to 200\");\n  }\n  return `?limit=${filters.limit}`;\n}\n\n/** Read and render immutable, metadata-only System AI admin changes. */\nexport async function readAdminAiAudit(request: AdminAiAuditRequest): Promise<void> {\n  const response = await request.fetch(`${request.platform}/registry/platform/ai-audit${request.query}`, {\n    headers: request.headers,\n  });\n  const body = await responseBody(response);\n  if (!response.ok) throw new Error(apiError(response.status, body));\n  if (request.json) {\n    request.stdout.log(JSON.stringify(body, null, 2));\n    return;\n  }\n  const events = isRecord(body) && Array.isArray(body.events) ? body.events.filter(isRecord) : [];\n  request.stdout.log(\"when\\tchange\\ttarget\\tbefore -> after\\tactor\");\n  for (const event of events) {\n    const before = isRecord(event.oldPolicy) ? event.oldPolicy : undefined;\n    const after = isRecord(event.newPolicy) ? event.newPolicy : undefined;\n    const route = before && after\n      ? `${String(before.provider)}/${String(before.model)}@v${String(before.version)} -> ${String(after.provider)}/${String(after.model)}@v${String(after.version)}`\n      : \"value not retained\";\n    request.stdout.log([\n      timestamp(event.createdAt), String(event.changeKind ?? \"\"),\n      String(event.purpose ?? event.provider ?? \"\"), route,\n      `${String(event.actorType ?? \"\")}:${String(event.actorId ?? \"\")}`,\n    ].join(\"\\t\"));\n  }\n}\n\nasync function responseBody(response: Response): Promise<unknown> {\n  const text = await response.text();\n  if (!text) return {};\n  try { return JSON.parse(text) as unknown; } catch { return { message: text.slice(0, 300) }; }\n}\n\nfunction apiError(status: number, body: unknown): string {\n  const error = isRecord(body) && isRecord(body.error) ? body.error : undefined;\n  const message = error && typeof error.message === \"string\"\n    ? error.message\n    : isRecord(body) && typeof body.message === \"string\" ? body.message : \"request failed\";\n  return `read System AI admin changes failed (${status}): ${message}`;\n}\n\nfunction timestamp(value: unknown): string {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) return String(value ?? \"\");\n  const date = new Date(value);\n  return Number.isFinite(date.valueOf()) ? date.toISOString() : \"\";\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n","/** Hosted platform purposes whose provider, model, and budgets an admin may route. */\nexport const SYSTEM_AI_PURPOSES = [\"o11y.triage\", \"security.discovery\", \"security.validation\"] as const;\n\n/** One catalog-validated, platform-funded System AI purpose. */\nexport type SystemAiPurpose = (typeof SYSTEM_AI_PURPOSES)[number];\n\n/** Validate a CLI purpose before any network mutation. */\nexport function requireSystemAiPurpose(value: string | undefined): SystemAiPurpose {\n  if (!SYSTEM_AI_PURPOSES.includes(value as SystemAiPurpose)) {\n    throw new Error(`purpose must be one of: ${SYSTEM_AI_PURPOSES.join(\", \")}`);\n  }\n  return value as SystemAiPurpose;\n}\n","/** Optional metadata-only filters for attributed platform AI usage. */\nexport interface AdminAiUsageFilters {\n  appId?: string;\n  env?: string;\n  runId?: string;\n  limit?: number;\n}\n\ninterface AdminAiUsageRequest {\n  platform: string;\n  query: string;\n  headers: Record<string, string>;\n  json?: boolean;\n  fetch: typeof fetch;\n  stdout: Pick<typeof console, \"log\">;\n}\n\n/** Validate usage filters and build the platform query before authentication. */\nexport function adminAiUsageQuery(filters: AdminAiUsageFilters): string {\n  const params = new URLSearchParams();\n  if (filters.appId?.trim()) params.set(\"appId\", filters.appId.trim());\n  if (filters.env?.trim()) params.set(\"env\", filters.env.trim());\n  if (filters.runId?.trim()) params.set(\"runId\", filters.runId.trim());\n  if (filters.limit !== undefined) params.set(\"limit\", String(usageLimit(filters.limit)));\n  const query = params.toString();\n  return query ? `?${query}` : \"\";\n}\n\n/** Read and render metadata-only, app-attributed platform AI usage. */\nexport async function readAdminAiUsage(request: AdminAiUsageRequest): Promise<void> {\n  const res = await request.fetch(`${request.platform}/registry/platform/ai-usage${request.query}`, {\n    headers: request.headers,\n  });\n  const body = await responseBody(res);\n  if (!res.ok) throw new Error(apiError(\"read platform AI usage\", res.status, body));\n  if (request.json) request.stdout.log(JSON.stringify(body, null, 2));\n  else printUsage(body, request.stdout);\n}\n\nfunction usageLimit(value: number): number {\n  if (!Number.isSafeInteger(value) || value < 1 || value > 500) {\n    throw new Error(\"usage limit must be an integer from 1 to 500\");\n  }\n  return value;\n}\n\nfunction printUsage(body: unknown, out: Pick<typeof console, \"log\">): void {\n  const aggregates = isRecord(body) && isRecord(body.aggregates) && Array.isArray(body.aggregates.byStatus)\n    ? body.aggregates.byStatus.filter(isRecord)\n    : [];\n  out.log(`All retained hosted-security status totals (up to ${String(isRecord(body) ? body.retentionDays ?? 90 : 90)} days; o11y triage excluded)\\nstatus\\tcalls\\tinput tokens\\toutput tokens\\tcost\\tunpriced calls`);\n  for (const row of aggregates) {\n    out.log([\n      String(row.status ?? \"\"), String(row.calls ?? \"\"), String(row.input_tokens ?? \"\"),\n      String(row.output_tokens ?? \"\"), formatMicrousd(row.cost_microusd), String(row.unpriced_calls ?? \"\"),\n    ].join(\"\\t\"));\n  }\n  const events = isRecord(body) && Array.isArray(body.events) ? body.events.filter(isRecord) : [];\n  out.log(`Latest ${String(isRecord(body) ? body.eventLimit ?? events.length : events.length)} hosted-security events\\nwhen\\tapp/env\\trun\\tactor\\tpurpose/role\\troute / policy\\ttokens\\tcost\\tstatus`);\n  for (const event of events) {\n    const input = numeric(event.input_tokens);\n    const output = numeric(event.output_tokens);\n    const priced = event.priced === true || event.priced === 1;\n    out.log([\n      timestamp(event.created_at), `${String(event.app_id ?? \"\")}/${String(event.env ?? \"\")}`,\n      String(event.run_id ?? \"\"), `${String(event.actor_type ?? \"\")}:${String(event.actor_id ?? \"\")}`,\n      `${String(event.purpose ?? \"\")}/${String(event.role ?? \"\")}`,\n      `${String(event.provider ?? \"\")}/${String(event.model ?? \"\")}@v${String(event.policy_version ?? \"unknown\")}`, String(input + output),\n      priced ? formatMicrousd(event.cost_microusd) : \"unpriced\",\n      `${String(event.status ?? \"\")}${event.error_code ? `:${String(event.error_code)}` : \"\"}`,\n    ].join(\"\\t\"));\n  }\n}\n\nfunction numeric(value: unknown): number {\n  return typeof value === \"number\" && Number.isFinite(value) ? value : 0;\n}\n\nfunction formatMicrousd(value: unknown): string {\n  return typeof value === \"number\" && Number.isFinite(value) ? `$${(value / 1_000_000).toFixed(6)}` : \"unpriced\";\n}\n\nfunction timestamp(value: unknown): string {\n  if (typeof value !== \"number\" || !Number.isFinite(value)) return String(value ?? \"\");\n  const date = new Date(value);\n  return Number.isFinite(date.valueOf()) ? date.toISOString() : \"\";\n}\n\nasync function responseBody(res: Response): Promise<unknown> {\n  const text = await res.text();\n  if (!text) return {};\n  try { return JSON.parse(text) as unknown; } catch { return { message: text.slice(0, 300) }; }\n}\n\nfunction apiError(action: string, status: number, body: unknown): string {\n  const error = isRecord(body) && isRecord(body.error) ? body.error : undefined;\n  const message = error && typeof error.message === \"string\" ? error.message : isRecord(body) && typeof body.message === \"string\" ? body.message : \"request failed\";\n  return `${action} failed (${status}): ${message}`;\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value) && typeof value === \"object\" && !Array.isArray(value);\n}\n","export type OptionValue = string | boolean | string[];\n\nexport interface ParsedArgv {\n  positionals: string[];\n  options: Record<string, OptionValue>;\n}\n\n/** Parse the small, dependency-free option grammar shared by every CLI command. */\nexport function parseArgv(argv: string[]): ParsedArgv {\n  const positionals: string[] = [];\n  const options: Record<string, OptionValue> = {};\n  for (let i = 0; i < argv.length; i++) {\n    const arg = argv[i]!;\n    if (!arg.startsWith(\"--\")) {\n      positionals.push(arg);\n      continue;\n    }\n    const eq = arg.indexOf(\"=\");\n    const rawName = arg.slice(2, eq === -1 ? undefined : eq);\n    if (!rawName) continue;\n    if (rawName.startsWith(\"no-\")) {\n      options[rawName.slice(3)] = false;\n      continue;\n    }\n    if (eq !== -1) {\n      addOption(options, rawName, arg.slice(eq + 1));\n      continue;\n    }\n    const value = argv[i + 1];\n    if (value !== undefined && !value.startsWith(\"--\")) {\n      i++;\n      addOption(options, rawName, value);\n    } else {\n      addOption(options, rawName, true);\n    }\n  }\n  return { positionals, options };\n}\n\nexport function assertArgs(parsed: ParsedArgv, allowedOptions: string[], maxPositionals: number): void {\n  const allowed = new Set(allowedOptions);\n  for (const name of Object.keys(parsed.options)) {\n    if (!allowed.has(name)) throw new Error(`unknown option \"--${name}\"; run \"odla-ai help\" for supported options`);\n  }\n  if (parsed.positionals.length > maxPositionals) {\n    throw new Error(`unexpected argument \"${parsed.positionals[maxPositionals]}\"; run \"odla-ai help\"`);\n  }\n}\n\nexport function requiredString(value: OptionValue | undefined, name: string): string {\n  const result = stringOpt(value);\n  if (!result) throw new Error(`${name} is required`);\n  return result;\n}\n\nexport function stringOpt(value: OptionValue | undefined): string | undefined {\n  if (typeof value === \"string\") return value;\n  if (Array.isArray(value)) return value[value.length - 1];\n  return undefined;\n}\n\nexport function listOpt(value: OptionValue | undefined): string[] | undefined {\n  if (value === undefined || typeof value === \"boolean\") return undefined;\n  const values = Array.isArray(value) ? value : [value];\n  return values.flatMap((item) => item.split(\",\")).map((item) => item.trim()).filter(Boolean);\n}\n\nexport function boolOpt(value: OptionValue | undefined): boolean | undefined {\n  if (typeof value === \"boolean\") return value;\n  if (typeof value === \"string\" && (value === \"true\" || value === \"false\")) return value === \"true\";\n  if (value === undefined) return undefined;\n  throw new Error(\"boolean option must be true or false\");\n}\n\nexport function numberOpt(value: OptionValue | undefined, flag: string): number | undefined {\n  if (value === undefined) return undefined;\n  const raw = stringOpt(value);\n  const parsed = raw === undefined ? Number.NaN : Number(raw);\n  if (!Number.isSafeInteger(parsed) || parsed < 1) throw new Error(`${flag} requires a positive integer`);\n  return parsed;\n}\n\nfunction addOption(options: Record<string, OptionValue>, name: string, value: string | boolean): void {\n  const current = options[name];\n  if (current === undefined) options[name] = value;\n  else if (Array.isArray(current)) current.push(String(value));\n  else options[name] = [String(current), String(value)];\n}\n","/** Stable, machine-readable division of work between the CLI, coding agent,\n * human operator, and Studio. Printed by `odla-ai capabilities --json`. */\nexport const CAPABILITIES = {\n  cli: [\n    \"register the app and enable configured services per environment\",\n    \"issue, persist, and explicitly rotate configured service credentials\",\n    \"write local Worker values and push deployed Worker secrets through Wrangler stdin\",\n    \"push db schema/rules and configure platform AI, auth, and deployment links\",\n    \"validate config offline and smoke-test a provisioned db environment\",\n    \"run app-attributed hosted security discovery and independent validation without provider keys\",\n    \"let admins manage system AI policy and credentials, inspect attributed usage, and read immutable admin changes through separate short-lived capability-only approvals\",\n  ],\n  agent: [\n    \"install and import the selected odla SDKs\",\n    \"wrap the Worker with withObservability and choose useful telemetry\",\n    \"make application-specific schema, rules, auth, UI, and migration decisions\",\n  ],\n  human: [\n    \"approve the odla device code and one-off third-party logins\",\n    \"consent to production changes with --yes\",\n    \"request destructive credential rotation explicitly\",\n    \"review application semantics, security findings, releases, and merges\",\n    \"approve redacted-source disclosure before hosted security reasoning\",\n  ],\n  studio: [\n    \"view telemetry and environment state\",\n    \"perform manual credential recovery when the CLI's local shown-once copy is unavailable\",\n    \"configure system AI purposes and view app/environment/run-attributed usage\",\n  ],\n} as const;\n\ntype Output = Pick<typeof console, \"log\">;\n\n/** Print the stable responsibility boundary for humans or agent tooling. */\nexport function printCapabilities(json = false, out: Output = console): void {\n  if (json) {\n    out.log(JSON.stringify(CAPABILITIES, null, 2));\n    return;\n  }\n  out.log(\"odla-ai responsibility boundary\\n\");\n  printGroup(out, \"CLI automates\", CAPABILITIES.cli);\n  printGroup(out, \"Coding agent changes source\", CAPABILITIES.agent);\n  printGroup(out, \"Human checkpoints\", CAPABILITIES.human);\n  printGroup(out, \"Studio\", CAPABILITIES.studio);\n}\n\nfunction printGroup(out: Output, heading: string, items: readonly string[]): void {\n  out.log(`${heading}:`);\n  for (const item of items) out.log(`  - ${item}`);\n  out.log(\"\");\n}\n","import { existsSync, readFileSync } from \"node:fs\";\nimport { dirname, isAbsolute, resolve } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\nimport type { AppRules, LoadedProjectConfig, OdlaProjectConfig, ProvisionPlan } from \"./types\";\n\nconst DEFAULT_PLATFORM = \"https://odla.ai\";\n// Safe-by-default: production must be opted into explicitly in odla.config.\nconst DEFAULT_ENVS = [\"dev\"];\nconst DEFAULT_SERVICES = [\"db\", \"ai\"];\n\nexport async function loadProjectConfig(configPath = \"odla.config.mjs\"): Promise<LoadedProjectConfig> {\n  const resolved = resolve(configPath);\n  if (!existsSync(resolved)) {\n    throw new Error(`config not found: ${configPath}. Run \"odla-ai init\" first or pass --config.`);\n  }\n\n  const raw = await loadConfigModule(resolved);\n  const rootDir = dirname(resolved);\n  validateRawConfig(raw, resolved);\n\n  const platformUrl = trimSlash(process.env.ODLA_PLATFORM_URL || raw.platformUrl || DEFAULT_PLATFORM);\n  const dbEndpoint = trimSlash(process.env.ODLA_DB_ENDPOINT || raw.dbEndpoint || platformUrl);\n  const envs = unique(raw.envs?.length ? raw.envs : DEFAULT_ENVS);\n  const services = unique(raw.services?.length ? raw.services : DEFAULT_SERVICES);\n  const local = {\n    tokenFile: resolve(rootDir, raw.local?.tokenFile ?? \".odla/dev-token.json\"),\n    credentialsFile: resolve(rootDir, raw.local?.credentialsFile ?? \".odla/credentials.local.json\"),\n    devVarsFile: resolve(rootDir, raw.local?.devVarsFile ?? \".dev.vars\"),\n    gitignore: raw.local?.gitignore ?? true,\n  };\n\n  return {\n    ...raw,\n    configPath: resolved,\n    rootDir,\n    platformUrl,\n    dbEndpoint,\n    envs,\n    services,\n    local,\n  };\n}\n\nexport async function resolveDataExport<T>(\n  cfg: LoadedProjectConfig,\n  value: unknown,\n  names: string[],\n): Promise<T | undefined> {\n  if (value === undefined || value === null || value === false) return undefined;\n  if (typeof value !== \"string\") return value as T;\n\n  const target = isAbsolute(value) ? value : resolve(cfg.rootDir, value);\n  if (target.endsWith(\".json\")) {\n    return JSON.parse(readFileSync(target, \"utf8\")) as T;\n  }\n  const mod = (await import(pathToFileURL(target).href)) as Record<string, unknown>;\n  for (const name of names) {\n    if (mod[name] !== undefined) return mod[name] as T;\n  }\n  if (mod.default !== undefined) return mod.default as T;\n  throw new Error(`${value} did not export ${names.join(\", \")} or default`);\n}\n\nexport function buildPlan(cfg: LoadedProjectConfig): ProvisionPlan {\n  return {\n    appId: cfg.app.id,\n    appName: cfg.app.name,\n    platformUrl: cfg.platformUrl,\n    dbEndpoint: cfg.dbEndpoint,\n    envs: cfg.envs,\n    services: cfg.services,\n    hasSchema: !!cfg.db?.schema,\n    hasRules: !!cfg.db?.rules || (!!cfg.db?.schema && cfg.db.defaultRules !== false),\n    aiProvider: cfg.ai?.provider,\n  };\n}\n\nexport function rulesFromSchema(schema: unknown): AppRules {\n  const entities = serializedEntities(schema);\n  return Object.fromEntries(\n    entities.map((name) => [name, { view: \"false\", create: \"false\", update: \"false\", delete: \"false\" }]),\n  );\n}\n\nexport function serializedEntities(schema: unknown): string[] {\n  if (!schema || typeof schema !== \"object\") return [];\n  const entities = (schema as { entities?: unknown }).entities;\n  if (!entities || typeof entities !== \"object\" || Array.isArray(entities)) return [];\n  return Object.keys(entities);\n}\n\nexport function envValue(value: string | undefined): string | undefined {\n  if (!value) return undefined;\n  if (value.startsWith(\"$\")) return process.env[value.slice(1)];\n  return value;\n}\n\nfunction validateRawConfig(raw: unknown, path: string): asserts raw is OdlaProjectConfig {\n  if (!raw || typeof raw !== \"object\") throw new Error(`${path} must export an object`);\n  const cfg = raw as OdlaProjectConfig;\n  if (!cfg.app || typeof cfg.app !== \"object\") throw new Error(`${path}: missing app object`);\n  if (!validId(cfg.app.id)) throw new Error(`${path}: app.id must be lowercase letters, numbers, and hyphens`);\n  if (!cfg.app.name || typeof cfg.app.name !== \"string\") throw new Error(`${path}: app.name is required`);\n  if (cfg.envs?.some((env) => !validId(env))) throw new Error(`${path}: env names must be lowercase letters, numbers, and hyphens`);\n}\n\nfunction validId(value: unknown): value is string {\n  return typeof value === \"string\" && /^[a-z0-9][a-z0-9-]*$/.test(value);\n}\n\nasync function loadConfigModule(path: string): Promise<OdlaProjectConfig> {\n  if (path.endsWith(\".json\")) return JSON.parse(readFileSync(path, \"utf8\")) as OdlaProjectConfig;\n  const mod = (await import(`${pathToFileURL(path).href}?t=${Date.now()}`)) as {\n    default?: OdlaProjectConfig | (() => OdlaProjectConfig | Promise<OdlaProjectConfig>);\n    config?: OdlaProjectConfig;\n  };\n  const value = mod.default ?? mod.config;\n  if (typeof value === \"function\") return await value();\n  return value as OdlaProjectConfig;\n}\n\nfunction trimSlash(value: string): string {\n  return value.replace(/\\/+$/, \"\");\n}\n\nfunction unique(values: string[]): string[] {\n  return [...new Set(values.filter(Boolean))];\n}\n","import { execFileSync } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join, resolve } from \"node:path\";\nimport { looksSecret } from \"./redact\";\nimport { gitignoreEntry } from \"./local\";\nimport { findWranglerConfig, readWranglerConfig } from \"./wrangler\";\nimport type { AppRules } from \"./types\";\n\n/**\n * Rules lint: a literal \"true\" grants the action to every client. `view` may\n * be deliberate for public content — allowlist those namespaces via\n * `db.publicRead`; writes are never safely \"true\".\n */\nexport function lintRules(rules: AppRules | undefined, entities: string[], publicRead: string[]): string[] {\n  const warnings: string[] = [];\n  if (!rules) return warnings;\n  for (const [ns, actions] of Object.entries(rules)) {\n    for (const [action, expr] of Object.entries(actions)) {\n      if (typeof expr !== \"string\" || expr.trim() !== \"true\") continue;\n      if (action === \"view\" && publicRead.includes(ns)) continue;\n      warnings.push(\n        action === \"view\"\n          ? `rules.${ns}.view is \"true\" — public read; add \"${ns}\" to db.publicRead if intended`\n          : `rules.${ns}.${action} is \"true\" — any client can ${action} ${ns} rows`,\n      );\n    }\n  }\n  for (const entity of entities) {\n    if (!(entity in rules)) warnings.push(`schema entity \"${entity}\" has no rules entry (all client access denied)`);\n  }\n  return warnings;\n}\n\nexport type ExecLike = (cmd: string, args: string[], cwd: string) => string;\n\nconst defaultExec: ExecLike = (cmd, args, cwd) => execFileSync(cmd, args, { cwd, encoding: \"utf8\", stdio: [\"ignore\", \"pipe\", \"ignore\"] });\n\n/** Credential files that must never be committed. Silent when git is absent. */\nexport function trackedSecretFiles(rootDir: string, exec: ExecLike = defaultExec, localPaths: string[] = []): string[] {\n  let output: string;\n  try {\n    const custom = localPaths\n      .map((path) => gitignoreEntry(rootDir, path))\n      .filter((path): path is string => !!path);\n    output = exec(\"git\", [\"ls-files\", \"--\", \".dev.vars\", \".odla\", ...custom], rootDir);\n  } catch {\n    return [];\n  }\n  return output\n    .split(/\\r?\\n/)\n    .filter(Boolean)\n    .map((path) => `${path} is tracked by git — run \"git rm --cached ${path}\" and commit; it belongs in .gitignore`);\n}\n\n/** Wrangler config sanity: the assets-dir footgun, secret-looking vars. */\nexport function wranglerWarnings(rootDir: string): string[] {\n  const configPath = findWranglerConfig(rootDir);\n  if (!configPath) return [];\n  const config = readWranglerConfig(configPath);\n  if (!config) return [];\n\n  const warnings: string[] = [];\n  const blocks: Array<{ label: string; block: Record<string, unknown> }> = [{ label: \"\", block: config }];\n  const envs = config.env;\n  if (envs && typeof envs === \"object\") {\n    for (const [name, block] of Object.entries(envs as Record<string, unknown>)) {\n      if (block && typeof block === \"object\") blocks.push({ label: `env.${name}.`, block: block as Record<string, unknown> });\n    }\n  }\n\n  for (const { label, block } of blocks) {\n    const assets = block.assets as { directory?: string } | undefined;\n    if (assets?.directory) {\n      const dir = resolve(rootDir, assets.directory);\n      if (dir === resolve(rootDir)) {\n        warnings.push(`${label}assets.directory is the project root — point it at a dedicated build dir (wrangler dev fails with \"spawn EBADF\")`);\n      } else if (existsSync(join(dir, \"node_modules\"))) {\n        warnings.push(`${label}assets.directory contains node_modules — wrangler dev's watcher will exhaust file descriptors`);\n      }\n    }\n    const vars = block.vars;\n    if (vars && typeof vars === \"object\") {\n      for (const [name, value] of Object.entries(vars as Record<string, unknown>)) {\n        if (name === \"ODLA_API_KEY\" || name === \"ODLA_O11Y_TOKEN\" || (typeof value === \"string\" && looksSecret(value))) {\n          warnings.push(`wrangler ${label}vars.${name} looks like a secret — use \"odla-ai secrets push\" / wrangler secret put, never vars`);\n        }\n      }\n    }\n  }\n\n  const pkg = readPackageJson(rootDir);\n  if (pkg && typeof pkg.scripts === \"object\" && pkg.scripts && \"deploy\" in (pkg.scripts as Record<string, unknown>)) {\n    warnings.push(`package.json has a script named \"deploy\" — CI may auto-deploy it; rename to deploy:app`);\n  }\n  return warnings;\n}\n\n/** Offline checks for the source/config work that provisioning cannot infer\n * safely. The CLI owns control-plane enablement and secret delivery; these\n * warnings keep the remaining application edits visible instead of letting a\n * successfully provisioned but uninstrumented Worker look complete. */\nexport function o11yProjectWarnings(rootDir: string): string[] {\n  const warnings: string[] = [];\n  const pkg = readPackageJson(rootDir);\n  const dependencies = pkg?.dependencies as Record<string, unknown> | undefined;\n  const devDependencies = pkg?.devDependencies as Record<string, unknown> | undefined;\n  if (!dependencies?.[\"@odla-ai/o11y\"]) {\n    warnings.push(\n      devDependencies?.[\"@odla-ai/o11y\"]\n        ? \"@odla-ai/o11y is a devDependency — move it to dependencies so the Worker can import it\"\n        : 'Worker instrumentation is missing @odla-ai/o11y — install it and wrap the handler with \"withObservability\"',\n    );\n  }\n\n  const configPath = findWranglerConfig(rootDir);\n  const config = configPath ? readWranglerConfig(configPath) : null;\n  if (!configPath || !config) {\n    warnings.push(\"cannot verify o11y Worker instrumentation — add a parseable wrangler.jsonc/json config\");\n    return warnings;\n  }\n\n  const main = typeof config.main === \"string\" ? resolve(rootDir, config.main) : null;\n  if (!main || !existsSync(main)) {\n    warnings.push(\"cannot verify o11y Worker instrumentation — wrangler main is missing or unreadable\");\n  } else {\n    let source = \"\";\n    try {\n      source = readFileSync(main, \"utf8\");\n    } catch {\n      // The warning below is intentionally the same for an unreadable source.\n    }\n    if (!/\\bwithObservability\\b/.test(source)) {\n      warnings.push(`wrangler entrypoint ${config.main as string} does not reference withObservability`);\n    }\n  }\n\n  const flags = Array.isArray(config.compatibility_flags) ? config.compatibility_flags : [];\n  if (!flags.includes(\"nodejs_compat\")) {\n    warnings.push('wrangler compatibility_flags is missing \"nodejs_compat\" required by @odla-ai/o11y');\n  }\n  return warnings;\n}\n\nfunction readPackageJson(rootDir: string): Record<string, unknown> | null {\n  try {\n    return JSON.parse(readFileSync(join(rootDir, \"package.json\"), \"utf8\")) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n","/**\n * Secret redaction shared by every command's output path and by doctor's\n * \"does this value look like a secret\" checks. Clerk publishable keys\n * (pk_test_/pk_live_) are public by design and are deliberately not matched.\n */\nconst REPLACEMENTS: Array<[RegExp, string]> = [\n  [/odla_(sk|dev)_[A-Za-z0-9._-]+/g, \"odla_$1_[redacted]\"],\n  [/\\bsk_(live|test)_[A-Za-z0-9]+/g, \"sk_$1_[redacted]\"],\n  [/\\bsk-[A-Za-z0-9._-]+/g, \"sk-[redacted]\"],\n  [/\\bwhsec_[A-Za-z0-9+/=]+/g, \"whsec_[redacted]\"],\n  [/\\bo11y_[A-Za-z0-9]+/g, \"o11y_[redacted]\"],\n  [/\\b(ghp|gho|github_pat)_[A-Za-z0-9_]+/g, \"$1_[redacted]\"],\n  [/\\bAKIA[A-Z0-9]{12,}/g, \"AKIA[redacted]\"],\n];\n\n/**\n * Return `value` with every secret-shaped substring replaced by a `[redacted]`\n * placeholder that keeps the identifying prefix (e.g. `sk_live_[redacted]`).\n * Matches odla db keys (`odla_sk_`/`odla_dev_`), Clerk secret keys\n * (`sk_live_`/`sk_test_`), OpenAI keys (`sk-`), webhook signing secrets\n * (`whsec_`), o11y tokens (`o11y_`), GitHub tokens (`ghp_`/`gho_`/`github_pat_`),\n * and AWS access-key ids (`AKIA…`). Clerk publishable keys (`pk_test_`/\n * `pk_live_`) are public by design and intentionally left untouched. Used to\n * sanitize anything the CLI echoes (notably network error bodies) before it\n * reaches stdout/stderr. Non-matching input is returned unchanged.\n */\nexport function redactSecrets(value: string): string {\n  let result = value;\n  for (const [pattern, replacement] of REPLACEMENTS) result = result.replace(pattern, replacement);\n  return result;\n}\n\n/** True when a value matches any known secret shape (used for detection, never display). */\nexport function looksSecret(value: string): boolean {\n  return redactSecrets(value) !== value || value.includes(\"-----BEGIN\");\n}\n","import { spawn } from \"node:child_process\";\nimport { existsSync, readFileSync } from \"node:fs\";\nimport { join } from \"node:path\";\n\nexport interface RunResult {\n  code: number;\n  stdout: string;\n  stderr: string;\n}\n\n/** Subprocess seam: injectable in tests, `defaultRunner` in production. */\nexport type CommandRunner = (cmd: string, args: string[], opts?: { input?: string; cwd?: string }) => Promise<RunResult>;\n\nexport const defaultRunner: CommandRunner = (cmd, args, opts) =>\n  new Promise((resolvePromise, reject) => {\n    const child = spawn(cmd, args, { cwd: opts?.cwd, stdio: [\"pipe\", \"pipe\", \"pipe\"] });\n    let stdout = \"\";\n    let stderr = \"\";\n    child.stdout.on(\"data\", (chunk: Buffer) => (stdout += chunk.toString()));\n    child.stderr.on(\"data\", (chunk: Buffer) => (stderr += chunk.toString()));\n    child.on(\"error\", reject);\n    child.on(\"close\", (code) => resolvePromise({ code: code ?? 1, stdout, stderr }));\n    child.stdin.end(opts?.input ?? \"\");\n  });\n\nconst WRANGLER_CONFIG_FILES = [\"wrangler.jsonc\", \"wrangler.json\", \"wrangler.toml\"];\n\nexport function findWranglerConfig(rootDir: string): string | null {\n  for (const name of WRANGLER_CONFIG_FILES) {\n    const path = join(rootDir, name);\n    if (existsSync(path)) return path;\n  }\n  return null;\n}\n\n/** Parses wrangler.json/jsonc. Returns null for .toml (unparsed) or invalid JSON. */\nexport function readWranglerConfig(path: string): Record<string, unknown> | null {\n  if (path.endsWith(\".toml\")) return null;\n  try {\n    return JSON.parse(stripJsonComments(readFileSync(path, \"utf8\"))) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\n/** Removes // and both-slash block comments without touching string contents. */\nexport function stripJsonComments(text: string): string {\n  let result = \"\";\n  let inString = false;\n  for (let i = 0; i < text.length; i++) {\n    const ch = text[i]!;\n    if (inString) {\n      result += ch;\n      if (ch === \"\\\\\") {\n        result += text[i + 1] ?? \"\";\n        i++;\n      } else if (ch === '\"') {\n        inString = false;\n      }\n      continue;\n    }\n    if (ch === '\"') {\n      inString = true;\n      result += ch;\n      continue;\n    }\n    if (ch === \"/\" && text[i + 1] === \"/\") {\n      while (i < text.length && text[i] !== \"\\n\") i++;\n      result += \"\\n\";\n      continue;\n    }\n    if (ch === \"/\" && text[i + 1] === \"*\") {\n      i += 2;\n      while (i < text.length && !(text[i] === \"*\" && text[i + 1] === \"/\")) i++;\n      i++;\n      continue;\n    }\n    result += ch;\n  }\n  return result;\n}\n\nexport async function wranglerLoggedIn(run: CommandRunner, cwd: string): Promise<boolean> {\n  try {\n    const result = await run(\"npx\", [\"wrangler\", \"whoami\"], { cwd });\n    return result.code === 0 && !/not authenticated/i.test(`${result.stdout}${result.stderr}`);\n  } catch {\n    return false;\n  }\n}\n\n/** Pipes the value via stdin — it never appears on argv or in process listings. */\nexport function wranglerPutSecret(\n  run: CommandRunner,\n  opts: { name: string; value: string; env?: string; cwd: string },\n): Promise<RunResult> {\n  const args = [\"wrangler\", \"secret\", \"put\", opts.name, ...(opts.env ? [\"--env\", opts.env] : [])];\n  return run(\"npx\", args, { input: opts.value, cwd: opts.cwd });\n}\n","import { buildPlan, loadProjectConfig, resolveDataExport, rulesFromSchema, serializedEntities } from \"./config\";\nimport { lintRules, o11yProjectWarnings, trackedSecretFiles, wranglerWarnings } from \"./doctor-checks\";\nimport { readCredentials } from \"./local\";\nimport type { AppRules } from \"./types\";\n\nexport interface DoctorOptions {\n  configPath: string;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/**\n * Validate and summarize an odla project config entirely offline — no network\n * calls and no file writes. Loads `configPath`, builds the provision plan, and\n * resolves the schema and rules (synthesizing deny-all rules from the schema\n * when `db.rules` is omitted and `db.defaultRules` isn't `false`), then prints a\n * summary line for the app, envs, services, schema entity count, rules namespace\n * count, and AI provider.\n *\n * It then collects warnings for the mistakes provision can't fix silently: a\n * schema with no entities, a rules namespace with no matching entity, the `ai`\n * service enabled without an `ai.provider`, `auth.clerk` entries that reference\n * an unset env var (`$FOO`), an `ai.keyEnv` that isn't set (provider key upload\n * will be skipped), and — when `o11y` is enabled — any env whose local\n * credentials lack an ingest token. It also folds in the shared rule linter,\n * git-tracked secret-shaped files, and wrangler config warnings. Prints `ok`\n * when clean, otherwise the warning list. Purely advisory: never throws on\n * warnings and never mutates anything.\n *\n * @param options.configPath Path to the `odla.config.mjs` to inspect.\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport async function doctor(options: DoctorOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const plan = buildPlan(cfg);\n  const hasDb = cfg.services.includes(\"db\");\n  const schema = hasDb ? await resolveDataExport<unknown>(cfg, cfg.db?.schema, [\"schema\", \"SCHEMA\"]) : undefined;\n  const configuredRules = hasDb\n    ? await resolveDataExport<AppRules>(cfg, cfg.db?.rules, [\"rules\", \"RULES\"])\n    : undefined;\n  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : undefined);\n  const entities = serializedEntities(schema);\n\n  out.log(`config: ${cfg.configPath}`);\n  out.log(`app:    ${plan.appName} (${plan.appId})`);\n  out.log(`envs:   ${plan.envs.join(\", \")}`);\n  out.log(`svc:    ${plan.services.join(\", \")}`);\n  out.log(`schema: ${schema ? `${entities.length} entities` : \"none\"}`);\n  out.log(`rules:  ${rules ? `${Object.keys(rules).length} namespaces` : \"none\"}`);\n  out.log(`ai:     ${cfg.services.includes(\"ai\") ? (cfg.ai?.provider ?? \"not configured\") : \"not enabled\"}`);\n\n  const warnings: string[] = [];\n  if (schema && entities.length === 0) warnings.push(\"schema has no entities\");\n  if (rules) {\n    for (const ns of Object.keys(rules)) {\n      if (entities.length > 0 && !entities.includes(ns)) warnings.push(`rules include \"${ns}\" but schema has no matching entity`);\n    }\n  }\n  if (cfg.services.includes(\"ai\") && !cfg.ai?.provider) warnings.push(\"ai service is enabled but ai.provider is not set\");\n  if (cfg.auth?.clerk) {\n    for (const [env, value] of Object.entries(cfg.auth.clerk)) {\n      if (typeof value === \"string\" && value.startsWith(\"$\") && !process.env[value.slice(1)]) {\n        warnings.push(`auth.clerk.${env} references unset env var ${value}`);\n      }\n    }\n  }\n  if (cfg.services.includes(\"ai\") && cfg.ai?.keyEnv && !process.env[cfg.ai.keyEnv]) {\n    warnings.push(`${cfg.ai.keyEnv} is not set; provision will skip provider key storage`);\n  }\n  if (cfg.services.includes(\"o11y\")) {\n    // o11y enabled but no ingest token = telemetry silently rejected. Provision mints one.\n    const credentials = readCredentials(cfg.local.credentialsFile);\n    for (const env of cfg.envs) {\n      if (!credentials?.envs[env]?.o11yToken) {\n        warnings.push(`o11y is enabled but env \"${env}\" has no ingest token — run \"odla-ai provision\" to mint one`);\n      }\n    }\n    warnings.push(...o11yProjectWarnings(cfg.rootDir));\n  }\n  warnings.push(...lintRules(rules, entities, cfg.db?.publicRead ?? []));\n  warnings.push(...trackedSecretFiles(cfg.rootDir, undefined, [\n    cfg.local.tokenFile,\n    cfg.local.credentialsFile,\n    cfg.local.devVarsFile,\n  ]));\n  warnings.push(...wranglerWarnings(cfg.rootDir));\n\n  if (warnings.length) {\n    out.log(\"\");\n    out.log(\"warnings:\");\n    for (const warning of warnings) out.log(`  - ${warning}`);\n  } else {\n    out.log(\"ok\");\n  }\n}\n","import { existsSync, mkdirSync, writeFileSync } from \"node:fs\";\nimport { dirname, resolve } from \"node:path\";\nimport { ensureGitignore } from \"./local\";\n\nexport interface InitOptions {\n  rootDir?: string;\n  configPath?: string;\n  appId: string;\n  name: string;\n  envs?: string[];\n  services?: string[];\n  aiProvider?: string;\n  force?: boolean;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/**\n * Scaffold a new odla project into `rootDir` (default: cwd). Writes an\n * `odla.config.mjs` (default name, overridable via `configPath`) plus starter\n * `src/odla/schema.mjs` (a single `notes` entity) and `src/odla/rules.mjs`\n * (deny-all), and creates the `src/odla` and `.odla` directories. Also runs\n * `ensureGitignore` so the local token/credentials paths are ignored.\n *\n * Fully local and synchronous — no network calls. The config file is only\n * written when it doesn't already exist unless `force` is set (otherwise it\n * throws); the schema/rules files are written only when missing (never\n * overwritten, even with `force`). `appId` must match `^[a-z0-9][a-z0-9-]*$` or\n * it throws. Defaults: `envs` → `[\"dev\"]`, `services` → `[\"db\",\"ai\"]`,\n * `aiProvider` → `\"anthropic\"` (which also picks the `keyEnv`, e.g.\n * `ANTHROPIC_API_KEY`/`OPENAI_API_KEY`/`GOOGLE_API_KEY`).\n *\n * @param options.appId Slug for the app (lowercase alphanumerics and hyphens).\n * @param options.name Human-readable app name embedded in the config.\n * @param options.rootDir Project root (defaults to `process.cwd()`).\n * @param options.configPath Config filename relative to root (default `odla.config.mjs`).\n * @param options.envs Environment names (default `[\"dev\"]`; production is an explicit opt-in).\n * @param options.services Enabled services (default `[\"db\",\"ai\"]`).\n * @param options.aiProvider AI provider slug (default `\"anthropic\"`).\n * @param options.force Overwrite an existing config file instead of throwing.\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport function initProject(options: InitOptions): void {\n  const out = options.stdout ?? console;\n  const rootDir = resolve(options.rootDir ?? process.cwd());\n  const configPath = resolve(rootDir, options.configPath ?? \"odla.config.mjs\");\n  if (existsSync(configPath) && !options.force) {\n    throw new Error(`${configPath} already exists. Pass --force to overwrite.`);\n  }\n  if (!/^[a-z0-9][a-z0-9-]*$/.test(options.appId)) {\n    throw new Error(\"--app-id must be lowercase letters, numbers, and hyphens\");\n  }\n  // Production is an explicit opt-in. This prevents an unattended `init` +\n  // `provision` flow from mutating the live environment by default.\n  const envs = options.envs?.length ? options.envs : [\"dev\"];\n  const services = options.services?.length ? options.services : [\"db\", \"ai\"];\n  const aiProvider = options.aiProvider ?? \"anthropic\";\n\n  mkdirSync(dirname(configPath), { recursive: true });\n  mkdirSync(resolve(rootDir, \"src/odla\"), { recursive: true });\n  mkdirSync(resolve(rootDir, \".odla\"), { recursive: true });\n\n  writeFileSync(configPath, configTemplate({ appId: options.appId, name: options.name, envs, services, aiProvider }));\n  writeIfMissing(resolve(rootDir, \"src/odla/schema.mjs\"), schemaTemplate());\n  writeIfMissing(resolve(rootDir, \"src/odla/rules.mjs\"), rulesTemplate());\n  ensureGitignore(rootDir);\n\n  out.log(`created ${relativeDisplay(configPath, rootDir)}`);\n  out.log(\"created src/odla/schema.mjs and src/odla/rules.mjs\");\n  out.log(\"updated .gitignore for local odla credentials\");\n}\n\nfunction writeIfMissing(path: string, text: string): void {\n  if (existsSync(path)) return;\n  writeFileSync(path, text);\n}\n\nfunction configTemplate(input: { appId: string; name: string; envs: string[]; services: string[]; aiProvider: string }): string {\n  return `export default {\n  platformUrl: process.env.ODLA_PLATFORM_URL ?? \"https://odla.ai\",\n  dbEndpoint: process.env.ODLA_ENDPOINT ?? process.env.ODLA_DB_ENDPOINT ?? \"https://db.odla.ai\",\n  app: {\n    id: \"${input.appId}\",\n    name: \"${input.name.replace(/\"/g, '\\\\\"')}\",\n  },\n  envs: ${JSON.stringify(input.envs)},\n  services: ${JSON.stringify(input.services)},\n  db: {\n    schema: \"./src/odla/schema.mjs\",\n    rules: \"./src/odla/rules.mjs\",\n    // When rules is omitted, the CLI generates deny-all rules from schema.\n    defaultRules: \"deny\",\n  },\n  ai: {\n    provider: process.env.ODLA_AI_PROVIDER ?? \"${input.aiProvider}\",\n    // Optional: set this env var while running provision to store the provider\n    // key in the platform vault for each tenant.\n    keyEnv: \"${defaultKeyEnv(input.aiProvider)}\",\n  },\n  auth: {\n    clerk: {\n      // dev: \"$CLERK_PUBLISHABLE_KEY\",\n      // prod: \"$CLERK_PUBLISHABLE_KEY\",\n    },\n  },\n  // Add \"o11y\" to services to enable observability; provision then mints the\n  // ingest token and scaffolds the ODLA_O11Y_* vars into .dev.vars.\n  // o11y: {\n  //   service: \"${input.appId}\",   // defaults to the app id\n  //   // endpoint: \"https://o11y.odla.ai\",\n  // },\n  links: {\n    // dev: \"https://dev.example.com\",\n    // prod: \"https://example.com\",\n  },\n  local: {\n    tokenFile: \".odla/dev-token.json\",\n    credentialsFile: \".odla/credentials.local.json\",\n    devVarsFile: \".dev.vars\",\n  },\n};\n`;\n}\n\nfunction schemaTemplate(): string {\n  return `// Replace this starter schema with your app's odla-db schema.\n// Knowledge-graph projects can export @odla-ai/kg's toSerializedSchema(ontology).\nexport const schema = {\n  entities: {\n    notes: {\n      attrs: {\n        id: { type: \"string\", unique: true, indexed: true, optional: false },\n        text: { type: \"string\", unique: false, indexed: false, optional: false },\n        createdAt: { type: \"number\", unique: false, indexed: true, optional: false },\n      },\n    },\n  },\n  links: {},\n};\n`;\n}\n\nfunction rulesTemplate(): string {\n  return `// odla-db is default-deny. The starter keeps runtime data backend-only.\nexport const rules = {\n  notes: {\n    view: \"false\",\n    create: \"false\",\n    update: \"false\",\n    delete: \"false\",\n  },\n};\n`;\n}\n\nfunction defaultKeyEnv(provider: string): string {\n  if (provider === \"openai\") return \"OPENAI_API_KEY\";\n  if (provider === \"google\") return \"GOOGLE_API_KEY\";\n  return \"ANTHROPIC_API_KEY\";\n}\n\nfunction relativeDisplay(path: string, rootDir: string): string {\n  return path.startsWith(rootDir) ? path.slice(rootDir.length + 1) : path;\n}\n","import { createAppsClient, tenantIdFor } from \"@odla-ai/apps\";\nimport { DEFAULT_SECRET_NAMES, putSecret } from \"@odla-ai/ai\";\nimport process from \"node:process\";\nimport type { AppRules, LoadedProjectConfig, ProvisionOptions } from \"./types\";\nimport { buildPlan, envValue, loadProjectConfig, resolveDataExport, rulesFromSchema } from \"./config\";\nimport { getDeveloperToken } from \"./token\";\nimport {\n  displayPath, ensureGitignore, gitignoreEntry, o11yDevVars, readCredentials, resolveWriteDevVarsTarget, writeDevVars,\n} from \"./local\";\nimport { provisionEnvCredentials } from \"./provision-credentials\";\nimport { redactSecrets } from \"./redact\";\nimport { preflightSecretsPush, secretsPushAfterPreflight } from \"./secrets\";\n\ntype FetchLike = typeof fetch;\n\n/**\n * Provision an app end-to-end from its config — the primary deploy path, and\n * (apart from key rotation) idempotent, so re-running is safe. Obtains a\n * developer token, creates the registry app when absent, enables each service\n * per env (AI also gets `setAi` with the configured provider/model), configures\n * Clerk auth and links, then per env mints or reuses credentials only for the\n * configured services, pushes the schema with the db key and the\n * rules with the developer token, and stores the provider key in the tenant\n * vault when `ai.keyEnv` is set and present. Finally writes the credentials file\n * (mode 0600, gitignored) and, when requested, `.dev.vars`.\n *\n * The developer token comes from (in order) `options.token`, `$ODLA_DEV_TOKEN`,\n * the cached `.odla` token, or a fresh device handshake — which prints a user\n * code + approval URL and, in interactive terminals, auto-opens the browser\n * (`open: true`/`false` forces/suppresses it). Network error bodies pass through\n * `redactSecrets` before display.\n *\n * @param options.dryRun Print the resolved plan and return before any network call/write.\n * @param options.rotateKeys Rotate db keys and o11y tokens.\n * @param options.rotateO11yToken Rotate only the o11y token.\n * @param options.pushSecrets Preflight Wrangler, then push each env's configured\n *   Worker secrets immediately after credential provisioning.\n * @param options.writeDevVars `true`/a path writes `.dev.vars`; `writeCredentials: false` skips the creds file.\n * @param options.yes Required for a non-dry-run plan containing `prod` or\n *   `production`; callers must show and review `dryRun` output first.\n * @throws When a production plan is executed without `yes`, configuration is\n *   invalid, authorization fails, or a provisioning operation fails.\n */\nexport async function provision(options: ProvisionOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const plan = buildPlan(cfg);\n  const hasDb = cfg.services.includes(\"db\");\n  const hasO11y = cfg.services.includes(\"o11y\");\n\n  if (options.rotateO11yToken && !hasO11y) {\n    throw new Error(\"--rotate-o11y-token requires the o11y service in odla.config.mjs\");\n  }\n  if (options.pushSecrets && options.writeCredentials === false) {\n    throw new Error(\"--push-secrets cannot be combined with --no-write-credentials\");\n  }\n\n  out.log(`odla-ai: ${plan.appName} (${plan.appId})`);\n  out.log(`  platform: ${plan.platformUrl}`);\n  out.log(`  db:       ${plan.dbEndpoint}`);\n  out.log(`  envs:     ${plan.envs.join(\", \")}`);\n  out.log(`  services: ${plan.services.join(\", \")}`);\n\n  const productionEnvs = plan.envs.filter((env) => env === \"prod\" || env === \"production\");\n  if (!options.dryRun && productionEnvs.length > 0 && !options.yes) {\n    throw new Error(\n      `refusing to provision production env ${productionEnvs.join(\", \")} without --yes; run --dry-run first`,\n    );\n  }\n\n  const schema = hasDb ? await resolveDataExport<unknown>(cfg, cfg.db?.schema, [\"schema\", \"SCHEMA\"]) : undefined;\n  const configuredRules = hasDb ? await resolveDataExport<AppRules>(cfg, cfg.db?.rules, [\"rules\", \"RULES\"]) : undefined;\n  const rules = configuredRules ?? (schema && cfg.db?.defaultRules !== false ? rulesFromSchema(schema) : undefined);\n\n  if (options.dryRun) {\n    out.log(\"dry run: no network calls or file writes\");\n    out.log(`  schema: ${schema ? \"yes\" : \"no\"}`);\n    out.log(`  rules:  ${rules ? Object.keys(rules).length : 0} namespaces`);\n    out.log(`  ai:     ${cfg.services.includes(\"ai\") ? (cfg.ai?.provider ?? \"not configured\") : \"not enabled\"}`);\n    out.log(`  secrets: ${options.pushSecrets ? \"push configured Worker secrets\" : \"local only\"}`);\n    return;\n  }\n\n  let credentials = readCredentials(cfg.local.credentialsFile);\n  if (credentials && credentials.appId !== cfg.app.id) {\n    throw new Error(\n      `credentials at ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} are for \"${credentials.appId}\", not \"${cfg.app.id}\"`,\n    );\n  }\n  const rotatesO11y = !!(options.rotateKeys || options.rotateO11yToken);\n  const missingO11y = cfg.envs.some((env) => !credentials?.envs[env]?.o11yToken);\n  const missingDb = cfg.envs.some((env) => !credentials?.envs[env]?.dbKey);\n  const losesShownOnceCredential = (hasDb && (!!options.rotateKeys || missingDb)) || (hasO11y && (rotatesO11y || missingO11y));\n  if (options.writeCredentials === false && losesShownOnceCredential) {\n    throw new Error(\"credential issuance/rotation requires the private credentials file; remove --no-write-credentials\");\n  }\n  const devVarsTarget = resolveWriteDevVarsTarget(cfg, options.writeDevVars);\n  if (cfg.local.gitignore) {\n    ensureGitignore(cfg.rootDir, [cfg.local.tokenFile, cfg.local.credentialsFile, ...(devVarsTarget ? [devVarsTarget] : [])]);\n  }\n  if (options.pushSecrets) {\n    await preflightSecretsPush({ configPath: cfg.configPath, runner: options.secretRunner });\n    out.log(\"secrets: Wrangler config and login preflight passed\");\n  }\n\n  const doFetch = options.fetch ?? fetch;\n  const token = await getDeveloperToken(cfg, options, doFetch, out);\n  const apps = createAppsClient({ endpoint: cfg.platformUrl, token, fetcher: { fetch: doFetch } });\n\n  const existing = await readRegistryApp(cfg, token, doFetch);\n  if (existing) {\n    out.log(`app: ${cfg.app.id} already exists`);\n  } else {\n    await apps.createApp({ name: cfg.app.name, appId: cfg.app.id });\n    out.log(`app: created ${cfg.app.id}`);\n  }\n\n  for (const env of cfg.envs) {\n    for (const service of cfg.services) {\n      if (service === \"ai\") {\n        if (cfg.ai?.provider) {\n          await apps.setAi(cfg.app.id, env, { provider: cfg.ai.provider, ...(cfg.ai.model ? { model: cfg.ai.model } : {}) });\n          out.log(`${env}: ai configured (${cfg.ai.provider}${cfg.ai.model ? `/${cfg.ai.model}` : \"\"})`);\n        } else {\n          await apps.setService(cfg.app.id, \"ai\", true, { env });\n          out.log(`${env}: ai enabled`);\n        }\n      } else {\n        await apps.setService(cfg.app.id, service, true, { env });\n        out.log(`${env}: ${service} enabled`);\n      }\n    }\n\n    const authConfig = normalizeClerkConfig(cfg.auth?.clerk?.[env]);\n    if (authConfig?.publishableKey) {\n      await apps.setAuth(cfg.app.id, env, authConfig);\n      out.log(`${env}: auth configured (clerk ${authConfig.mode ?? \"client\"})`);\n    }\n\n    const link = cfg.links?.[env];\n    if (link !== undefined) {\n      await apps.setLink(cfg.app.id, env, link ?? null);\n      out.log(`${env}: link ${link ? \"set\" : \"cleared\"}`);\n    }\n  }\n\n  for (const env of cfg.envs) {\n    const tenantId = tenantIdFor(cfg.app.id, env);\n    credentials = await provisionEnvCredentials({\n      cfg,\n      env,\n      developerToken: token,\n      credentials,\n      rotateDb: !!options.rotateKeys,\n      rotateO11y: rotatesO11y,\n      write: options.writeCredentials !== false,\n      fetch: doFetch,\n      stdout: out,\n    });\n    const dbKey = credentials.envs[env]?.dbKey;\n\n    if (options.pushSecrets) {\n      try {\n        await secretsPushAfterPreflight({\n          configPath: cfg.configPath,\n          env,\n          yes: options.yes,\n          runner: options.secretRunner,\n          stdout: out,\n        });\n      } catch (error) {\n        const message = error instanceof Error ? error.message : String(error);\n        const consent = env === \"prod\" || env === \"production\" ? \" --yes\" : \"\";\n        throw new Error(\n          `${message}\\n${env}: credentials are already saved; retry ` +\n          `\"odla-ai secrets push --env ${env}${consent}\" without issuing or rotating again`,\n          { cause: error },\n        );\n      }\n    }\n\n    if (schema && dbKey) {\n      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/schema`, dbKey, { schema });\n      out.log(`${env}: schema pushed`);\n    }\n    if (rules) {\n      await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(tenantId)}/admin/rules`, token, rules);\n      out.log(`${env}: rules pushed (${Object.keys(rules).length} namespaces)`);\n    }\n\n    if (cfg.services.includes(\"ai\") && cfg.ai?.provider && cfg.ai.keyEnv) {\n      const key = process.env[cfg.ai.keyEnv];\n      if (key) {\n        const secretName = cfg.ai.secretName ?? defaultSecretName(cfg.ai.provider);\n        await putSecret({ endpoint: cfg.dbEndpoint, token, fetch: doFetch }, tenantId, secretName, key);\n        out.log(`${env}: ${cfg.ai.provider} key stored in vault (${secretName})`);\n      } else {\n        out.log(`${env}: ${cfg.ai.keyEnv} not set; skipped provider key storage`);\n      }\n    }\n\n  }\n\n  if (options.writeCredentials !== false && credentials) {\n    const ignored = cfg.local.gitignore && gitignoreEntry(cfg.rootDir, cfg.local.credentialsFile);\n    out.log(`credentials: wrote ${displayPath(cfg.local.credentialsFile, cfg.rootDir)} (0600${ignored ? \", gitignored\" : \"\"})`);\n  }\n\n  if (devVarsTarget && credentials) {\n    const env = cfg.envs.includes(\"dev\") ? \"dev\" : (cfg.envs[0] ?? \"prod\");\n    writeDevVars(devVarsTarget, credentials, env, o11yDevVars(cfg));\n    out.log(`dev vars: wrote ${displayPath(devVarsTarget, cfg.rootDir)} for ${env}`);\n  }\n}\n\nasync function readRegistryApp(cfg: LoadedProjectConfig, token: string, doFetch: FetchLike): Promise<unknown | null> {\n  const res = await doFetch(`${cfg.platformUrl}/registry/apps/${encodeURIComponent(cfg.app.id)}`, {\n    headers: { authorization: `Bearer ${token}` },\n  });\n  if (res.status === 404) return null;\n  if (!res.ok) return null;\n  const json = (await res.json()) as { app?: unknown };\n  return json.app ?? null;\n}\n\nasync function postJson(doFetch: FetchLike, url: string, bearer: string, body: unknown): Promise<void> {\n  const res = await doFetch(url, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${bearer}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify(body),\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} failed: ${res.status} ${await safeText(res)}`);\n}\n\nfunction normalizeClerkConfig(value: unknown): { publishableKey: string; audience?: string; mode?: \"client\" | \"full\" } | null {\n  if (!value) return null;\n  if (typeof value === \"string\") {\n    const publishableKey = envValue(value);\n    return publishableKey ? { publishableKey } : null;\n  }\n  if (typeof value !== \"object\") return null;\n  const cfg = value as { publishableKey?: string; audience?: string; mode?: \"client\" | \"full\" };\n  const publishableKey = envValue(cfg.publishableKey);\n  return publishableKey ? { publishableKey, ...(cfg.audience ? { audience: cfg.audience } : {}), ...(cfg.mode ? { mode: cfg.mode } : {}) } : null;\n}\n\nfunction defaultSecretName(provider: string): string {\n  const names = DEFAULT_SECRET_NAMES as Record<string, string>;\n  return names[provider] ?? `${provider}_api_key`;\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return redactSecrets((await res.text()).slice(0, 500));\n  } catch {\n    return \"\";\n  }\n}\n","import { tenantIdFor } from \"@odla-ai/apps\";\nimport type { LoadedProjectConfig, LocalCredentials } from \"./types\";\nimport { mergeCredential, writePrivateJson } from \"./local\";\nimport { redactSecrets } from \"./redact\";\n\ntype FetchLike = typeof fetch;\n\ninterface ProvisionEnvCredentialsOptions {\n  cfg: LoadedProjectConfig;\n  env: string;\n  developerToken: string;\n  credentials: LocalCredentials | null;\n  rotateDb: boolean;\n  rotateO11y: boolean;\n  write: boolean;\n  fetch: FetchLike;\n  stdout: Pick<typeof console, \"log\">;\n}\n\n/** Mint/reuse only the credentials required by configured services. */\nexport async function provisionEnvCredentials(opts: ProvisionEnvCredentialsOptions): Promise<LocalCredentials> {\n  const tenantId = tenantIdFor(opts.cfg.app.id, opts.env);\n  const prior = opts.credentials?.envs[opts.env];\n  let credentials = opts.credentials;\n  let dbKey = opts.cfg.services.includes(\"db\") && !opts.rotateDb ? prior?.dbKey : undefined;\n  let o11yToken = opts.cfg.services.includes(\"o11y\") && !opts.rotateO11y ? prior?.o11yToken : undefined;\n\n  if (opts.cfg.services.includes(\"db\")) {\n    if (dbKey) {\n      opts.stdout.log(`${opts.env}: reusing local db key for ${tenantId}`);\n    } else {\n      dbKey = await mintDbKey(opts, tenantId);\n      credentials = save(opts, credentials, tenantId, { dbKey });\n      opts.stdout.log(`${opts.env}: minted db key for ${tenantId}`);\n    }\n  }\n\n  if (opts.cfg.services.includes(\"o11y\")) {\n    if (o11yToken) {\n      opts.stdout.log(`${opts.env}: reusing local o11y ingest token`);\n    } else {\n      o11yToken = await issueO11yToken(opts);\n      credentials = save(opts, credentials, tenantId, { ...(dbKey ? { dbKey } : {}), o11yToken });\n      opts.stdout.log(`${opts.env}: ${opts.rotateO11y ? \"rotated\" : \"issued\"} o11y ingest token`);\n    }\n  }\n\n  return save(opts, credentials, tenantId, {\n    ...(dbKey ? { dbKey } : {}),\n    ...(o11yToken ? { o11yToken } : {}),\n  });\n}\n\nfunction save(\n  opts: ProvisionEnvCredentialsOptions,\n  current: LocalCredentials | null,\n  tenantId: string,\n  values: { dbKey?: string; o11yToken?: string },\n): LocalCredentials {\n  const next = mergeCredential(current, {\n    appId: opts.cfg.app.id,\n    platformUrl: opts.cfg.platformUrl,\n    dbEndpoint: opts.cfg.dbEndpoint,\n    env: opts.env,\n    tenantId,\n    ...values,\n  });\n  if (opts.write) writePrivateJson(opts.cfg.local.credentialsFile, next);\n  return next;\n}\n\nasync function mintDbKey(opts: ProvisionEnvCredentialsOptions, tenantId: string): Promise<string> {\n  const headers = { authorization: `Bearer ${opts.developerToken}`, \"content-type\": \"application/json\" };\n  let res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {\n    method: \"POST\",\n    headers,\n    body: \"{}\",\n  });\n  if (res.status === 404) {\n    const created = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps`, {\n      method: \"POST\",\n      headers,\n      body: JSON.stringify({\n        name: opts.env === \"prod\" ? opts.cfg.app.name : `${opts.cfg.app.name} (${opts.env})`,\n        appId: tenantId,\n      }),\n    });\n    if (!created.ok) throw new Error(`db app create (${tenantId}) failed: ${created.status} ${await safeText(created)}`);\n    res = await opts.fetch(`${opts.cfg.dbEndpoint}/admin/apps/${encodeURIComponent(tenantId)}/keys`, {\n      method: \"POST\",\n      headers,\n      body: \"{}\",\n    });\n  }\n  if (!res.ok) throw new Error(`db key mint (${tenantId}) failed: ${res.status} ${await safeText(res)}`);\n  const body = (await res.json()) as { key?: string };\n  if (!body.key) throw new Error(`db key mint (${tenantId}) returned no key`);\n  return body.key;\n}\n\nasync function issueO11yToken(opts: ProvisionEnvCredentialsOptions): Promise<string> {\n  const suffix = opts.rotateO11y ? \"/rotate\" : \"\";\n  const res = await opts.fetch(\n    `${opts.cfg.platformUrl}/o11y/${encodeURIComponent(opts.cfg.app.id)}/token${suffix}?env=${encodeURIComponent(opts.env)}`,\n    { method: \"POST\", headers: { authorization: `Bearer ${opts.developerToken}` } },\n  );\n  if (res.status === 409 && !opts.rotateO11y) {\n    throw new Error(\n      `o11y token already exists for env \"${opts.env}\", but its shown-once value is not in the local credentials file; ` +\n      `run \"odla-ai provision --rotate-o11y-token --push-secrets\" to replace it explicitly`,\n    );\n  }\n  if (!res.ok) throw new Error(`o11y token ${opts.rotateO11y ? \"rotation\" : \"issue\"} (${opts.env}) failed: ${res.status} ${await safeText(res)}`);\n  const body = (await res.json()) as { token?: string };\n  if (!body.token) throw new Error(`o11y token ${opts.rotateO11y ? \"rotation\" : \"issue\"} (${opts.env}) returned no token`);\n  return body.token;\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return redactSecrets((await res.text()).slice(0, 500));\n  } catch {\n    return \"\";\n  }\n}\n","import { loadProjectConfig } from \"./config\";\nimport { displayPath, readCredentials } from \"./local\";\nimport { redactSecrets } from \"./redact\";\nimport type { LoadedProjectConfig } from \"./types\";\nimport { defaultRunner, findWranglerConfig, wranglerLoggedIn, wranglerPutSecret } from \"./wrangler\";\nimport type { CommandRunner } from \"./wrangler\";\n\n/** Moves locally stored configured service credentials to one Wrangler environment over stdin. */\nexport interface SecretsPushOptions {\n  configPath: string;\n  env: string;\n  dryRun?: boolean;\n  /** Required to push to a prod-named env; the visible consent token in agent transcripts. */\n  yes?: boolean;\n  runner?: CommandRunner;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\nexport interface SecretsPreflightOptions {\n  configPath: string;\n  runner?: CommandRunner;\n}\n\nconst PROD_ENV_NAMES = new Set([\"prod\", \"production\"]);\n\n/**\n * Moves the env's configured db and/or o11y credentials from the private local\n * credentials file into the Worker, piping values over stdin so they never\n * appear on argv, in output, or in the conversation transcript.\n */\nexport async function secretsPush(options: SecretsPushOptions): Promise<void> {\n  await secretsPushImpl(options, true);\n}\n\n/** @internal Push after the caller has completed `preflightSecretsPush`. */\nexport async function secretsPushAfterPreflight(options: SecretsPushOptions): Promise<void> {\n  await secretsPushImpl(options, false);\n}\n\nasync function secretsPushImpl(options: SecretsPushOptions, preflight: boolean): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const env = options.env;\n\n  if (!cfg.envs.includes(env)) {\n    throw new Error(`env \"${env}\" is not in config envs (${cfg.envs.join(\", \")})`);\n  }\n  if (PROD_ENV_NAMES.has(env) && !options.yes) {\n    throw new Error(`refusing to push a secret to \"${env}\" without --yes`);\n  }\n\n  const credentialsPath = displayPath(cfg.local.credentialsFile, cfg.rootDir);\n  const credentials = readCredentials(cfg.local.credentialsFile);\n  if (!credentials) throw new Error(`no credentials at ${credentialsPath} — run \"odla-ai provision\" first`);\n  if (credentials.appId !== cfg.app.id) {\n    throw new Error(`credentials at ${credentialsPath} are for \"${credentials.appId}\", not \"${cfg.app.id}\"`);\n  }\n  const entry = credentials.envs[env];\n  if (!entry) throw new Error(`no credentials for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n\n  const secrets: Array<{ name: string; value: string }> = [];\n  if (cfg.services.includes(\"o11y\")) {\n    if (!entry.o11yToken) throw new Error(`no o11y token for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n    secrets.push({ name: \"ODLA_O11Y_TOKEN\", value: entry.o11yToken });\n  }\n  if (cfg.services.includes(\"db\")) {\n    if (!entry.dbKey) throw new Error(`no db key for env \"${env}\" in ${credentialsPath} — run \"odla-ai provision\" first`);\n    secrets.push({ name: \"ODLA_API_KEY\", value: entry.dbKey });\n  }\n  if (secrets.length === 0) {\n    out.log(`${env}: no configured Worker secrets to push`);\n    return;\n  }\n\n  // Convention from the reference apps: the top-level wrangler config is prod;\n  // every other env is a named `env.<name>` block.\n  const wranglerEnv = PROD_ENV_NAMES.has(env) ? undefined : env;\n  const target = wranglerEnv ? `wrangler env \"${wranglerEnv}\"` : \"the top-level (prod) wrangler env\";\n\n  if (options.dryRun) {\n    assertWranglerConfig(cfg);\n    for (const s of secrets) out.log(`dry run: would push ${s.name} (${redactSecrets(s.value)}) to ${target}`);\n    return;\n  }\n\n  const run = options.runner ?? defaultRunner;\n  if (preflight) await preflightLoadedConfig(cfg, run);\n\n  for (const s of secrets) {\n    const result = await wranglerPutSecret(run, { name: s.name, value: s.value, env: wranglerEnv, cwd: cfg.rootDir });\n    if (result.code !== 0) {\n      throw new Error(`wrangler secret put ${s.name} failed (exit ${result.code}): ${redactSecrets(`${result.stderr || result.stdout}`.trim())}`);\n    }\n    out.log(`${s.name} pushed to ${target} (value read from ${credentialsPath}, never echoed)`);\n  }\n}\n\n/** Check Wrangler config and login before provisioning issues or rotates secrets. */\nexport async function preflightSecretsPush(options: SecretsPreflightOptions): Promise<void> {\n  const cfg = await loadProjectConfig(options.configPath);\n  if (!cfg.services.some((service) => service === \"db\" || service === \"o11y\")) return;\n  await preflightLoadedConfig(cfg, options.runner ?? defaultRunner);\n}\n\nasync function preflightLoadedConfig(cfg: LoadedProjectConfig, run: CommandRunner): Promise<void> {\n  assertWranglerConfig(cfg);\n  if (!(await wranglerLoggedIn(run, cfg.rootDir))) {\n    throw new Error(`wrangler is not logged in — run \"wrangler login\" (a browser step for the human)`);\n  }\n}\n\nfunction assertWranglerConfig(cfg: LoadedProjectConfig): void {\n  if (!findWranglerConfig(cfg.rootDir)) {\n    throw new Error(`no wrangler config found in ${cfg.rootDir} (wrangler.jsonc, wrangler.json, or wrangler.toml)`);\n  }\n}\n","import { isAbsolute, relative, resolve, sep } from \"node:path\";\nimport {\n  cloudflareAppProfile,\n  createPlatformSecurityReasoners,\n  createSecurityHarness,\n  genericProfile,\n  odlaProfile,\n  securityFingerprint,\n  type PlatformSecurityRun,\n  type SecurityProfile,\n  type SecurityReport,\n  type SecurityRoleCallBudgetUsage,\n} from \"@odla-ai/security\";\nimport { FileRunStore, snapshotDirectory, writeSecurityArtifacts } from \"@odla-ai/security/node\";\nimport { loadProjectConfig } from \"./config\";\n\n/** Built-in security coverage profile selected for a hosted reasoning run. */\nexport type HostedSecurityProfile = \"odla\" | \"cloudflare-app\" | \"generic\";\n\n/** Exact attribution and authorization need supplied to a lazy token callback. */\nexport interface HostedSecurityTokenRequest {\n  platform: string;\n  appId: string;\n  env: string;\n  selfAudit: boolean;\n  /** Self-audit asks the caller for an explicitly scoped platform credential. */\n  /** Ordinary app runs use owner authority and therefore request no platform scope. */\n  scope: \"platform:security:self\" | null;\n}\n\n/** Local snapshot/orchestration controls for an app-attributed hosted security\n * run. The platform supplies model routes and provider credentials. */\nexport interface RunHostedSecurityOptions {\n  /** Project config; loaded for customer-app runs and ignored for self-audit. */\n  configPath?: string;\n  /** Scan odla itself under the protected odla-ai/prod identity. */\n  selfAudit?: boolean;\n  /** Repository directory to snapshot. Defaults to the config root or cwd for self-audit. */\n  target?: string;\n  /** Private artifact directory. Defaults to `<target>/.odla/security/hosted`. */\n  out?: string;\n  /** Customer environment. Must be declared in config. Self-audit always uses prod. */\n  env?: string;\n  profile?: HostedSecurityProfile;\n  maxHuntTasks?: number;\n  /** Exact acknowledgement required before any source capture or network call. */\n  sourceDisclosureAck?: \"redacted\";\n  /** Optional client correlation id; the platform returns the authoritative run id. */\n  runId?: string;\n  /** Platform override. Customer runs otherwise use config.platformUrl. */\n  platform?: string;\n  /** Injected app credential; for self-audit this must be explicitly scoped by the caller. */\n  token?: string;\n  /** Lazy token acquisition. Receives the exact app/env and required scope. */\n  getToken?: (request: HostedSecurityTokenRequest) => string | Promise<string>;\n  fetch?: typeof fetch;\n  signal?: AbortSignal;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** Completed local report, public platform run metadata, and private artifact path. */\nexport interface HostedSecurityResult {\n  report: SecurityReport;\n  run: Readonly<PlatformSecurityRun>;\n  output: string;\n}\n\n/**\n * Run the hosted, redacted-source security harness for an odla app or odla's\n * protected self-audit identity. Provider/model selection and provider secrets\n * remain platform-owned; this function accepts only an app/scoped bearer and\n * the opaque role grants remain inside @odla-ai/security's reasoner closures.\n */\nexport async function runHostedSecurity(options: RunHostedSecurityOptions): Promise<HostedSecurityResult> {\n  if (options.sourceDisclosureAck !== \"redacted\") {\n    throw new Error(\"Hosted security requires sourceDisclosureAck=redacted before repository source may leave this process\");\n  }\n\n  const selfAudit = options.selfAudit === true;\n  const cfg = selfAudit ? undefined : await loadProjectConfig(options.configPath ?? \"odla.config.mjs\");\n  const appId = selfAudit ? \"odla-ai\" : cfg!.app.id;\n  const env = selfAudit ? \"prod\" : selectEnv(options.env, cfg!.envs, cfg!.configPath, cfg!.rootDir);\n  const platform = options.platform ?? cfg?.platformUrl ?? \"https://odla.ai\";\n  const target = resolve(options.target ?? cfg?.rootDir ?? \".\");\n  const output = resolve(options.out ?? resolve(target, \".odla/security/hosted\"));\n  const outputRelative = relative(target, output).split(sep).join(\"/\");\n  if (!outputRelative) throw new Error(\"Hosted security output cannot be the repository root\");\n  // This is the desired first-pass ceiling. The hosted reasoner's immutable\n  // call budget automatically reserves recon, caps hunts, then funds retries.\n  const profile = profileFor(options.profile ?? \"odla\", options.maxHuntTasks ?? 12);\n\n  const tokenRequest: HostedSecurityTokenRequest = {\n    platform,\n    appId,\n    env,\n    selfAudit,\n    scope: selfAudit ? \"platform:security:self\" : null,\n  };\n  const token = await injectedToken(options, tokenRequest);\n  const snapshot = await snapshotDirectory(target, {\n    exclude: !outputRelative.startsWith(\"../\") && !isAbsolute(outputRelative) ? [outputRelative] : [],\n  });\n  const hosted = await createPlatformSecurityReasoners({\n    platform,\n    token,\n    appId,\n    env,\n    repository: snapshot.repository,\n    revision: snapshot.revision,\n    snapshotDigest: snapshot.digest,\n    sourceDisclosure: \"redacted\",\n    clientRunId: options.runId ?? crypto.randomUUID(),\n    ...(selfAudit ? { selfAudit: { enabled: true as const, subject: \"service:odla-security-self-audit\" } } : {}),\n    fetch: options.fetch,\n    signal: options.signal,\n  });\n  const harness = createSecurityHarness({\n    profile,\n    store: new FileRunStore(resolve(output, \"state\")),\n    discoveryReasoner: hosted.discoveryReasoner,\n    validationReasoner: hosted.validationReasoner,\n    policy: {\n      modelSourceDisclosure: \"redacted\",\n      active: false,\n      allowNetwork: false,\n    },\n  });\n  const report = await harness.run(snapshot, { runId: hosted.run.runId, signal: options.signal });\n  await writeSecurityArtifacts(output, report);\n  const reportDigest = await securityFingerprint(report);\n  await hosted.complete({\n    reportDigest,\n    coverageStatus: report.coverageStatus,\n    confirmed: report.metrics.confirmed,\n    candidates: report.metrics.candidates,\n  }, { signal: options.signal });\n  printSummary(options.stdout ?? console, appId, env, hosted.run, report, output);\n  return Object.freeze({ report, run: hosted.run, output });\n}\n\nfunction selectEnv(requested: string | undefined, declared: string[], configPath: string, rootDir: string): string {\n  const env = requested ?? (declared.includes(\"dev\") ? \"dev\" : declared[0]);\n  if (!env || !declared.includes(env)) {\n    const shown = relative(rootDir, configPath) || configPath;\n    throw new Error(`env \"${env ?? \"\"}\" is not declared in ${shown}`);\n  }\n  return env;\n}\n\nasync function injectedToken(options: RunHostedSecurityOptions, request: HostedSecurityTokenRequest): Promise<string> {\n  const value = options.token ?? await options.getToken?.(Object.freeze({ ...request }));\n  if (typeof value !== \"string\" || value.length < 8 || value.length > 8_192 || /\\s|[\\u0000-\\u001f\\u007f]/.test(value)) {\n    throw new Error(\n      request.selfAudit\n        ? \"Self-audit requires an injected, scoped platform security token\"\n        : \"Hosted security requires an injected app developer token or getToken callback\",\n    );\n  }\n  return value;\n}\n\nfunction profileFor(name: HostedSecurityProfile, maxHuntTasks: number | undefined): SecurityProfile {\n  const profile = name === \"odla\"\n    ? odlaProfile()\n    : name === \"cloudflare-app\"\n      ? cloudflareAppProfile()\n      : name === \"generic\"\n        ? genericProfile()\n        : undefined;\n  if (!profile) throw new Error(`unknown security profile \"${String(name)}\"`);\n  if (maxHuntTasks === undefined) return profile;\n  if (!Number.isSafeInteger(maxHuntTasks) || maxHuntTasks < 1) throw new Error(\"maxHuntTasks must be a positive integer\");\n  return { ...profile, maxHuntTasks };\n}\n\nfunction printSummary(\n  out: Pick<typeof console, \"log\" | \"error\">,\n  appId: string,\n  env: string,\n  run: Readonly<PlatformSecurityRun>,\n  report: SecurityReport,\n  output: string,\n): void {\n  const complete = report.coverage.filter((cell) => cell.state === \"complete\").length;\n  out.log(`security: ${appId}/${env} run=${run.runId} profile=${run.profileVersion}`);\n  out.log(`  discovery: ${run.discovery.identity.provider}/${run.discovery.identity.model}`);\n  out.log(`  validation: ${run.validation.identity.provider}/${run.validation.identity.model}`);\n  out.log(`  coverage: ${report.coverageStatus} ${complete}/${report.coverage.length} blocked=${report.metrics.blockedCells} shallow=${report.metrics.shallowCells} unscheduled=${report.metrics.unscheduledCells} budget_exhausted=${report.metrics.budgetExhaustedCells}`);\n  if (report.callBudget) out.log(`  calls: discovery=${formatBudget(report.callBudget.discovery)} validation=${formatBudget(report.callBudget.validation)}`);\n  out.log(`  findings: confirmed=${report.metrics.confirmed} needs_reproduction=${report.metrics.needsReproduction} candidates=${report.metrics.candidates}`);\n  out.log(`  report: ${resolve(output, \"REPORT.md\")}`);\n}\n\nfunction formatBudget(usage: SecurityRoleCallBudgetUsage | undefined): string {\n  return usage ? `${usage.usedCalls}/${usage.maxCalls} skipped=${usage.skippedCalls}` : \"caller-managed\";\n}\n","import { readFileSync } from \"node:fs\";\n\nexport function cliVersion(): string {\n  const pkg = JSON.parse(readFileSync(new URL(\"../package.json\", import.meta.url), \"utf8\")) as { version?: string };\n  return pkg.version ?? \"unknown\";\n}\n\nexport function printHelp(): void {\n  console.log(`odla-ai\n\nUsage:\n  odla-ai setup [--dir <project>] [--agent <name>] [--global] [--force]\n  odla-ai init --app-id <id> --name <name> [--services db,ai,o11y] [--env dev --env prod]\n  odla-ai doctor [--config odla.config.mjs]\n  odla-ai capabilities [--json]\n  odla-ai admin ai show [--platform https://odla.ai] [--json]\n  odla-ai admin ai models [--provider <id>] [--json]\n  odla-ai admin ai set <purpose> [--provider <id>] [--model <id>] [--enabled|--no-enabled]\n  odla-ai admin ai set security --discovery-provider <id> --discovery-model <id>\n    --validation-provider <id> --validation-model <id> [--enabled|--no-enabled]\n  odla-ai admin ai credentials [--json]\n  odla-ai admin ai credential set <provider> (--from-env <NAME>|--stdin)\n  odla-ai admin ai usage [--app-id <id>] [--env <env>] [--run-id <id>] [--limit <1-500>] [--json]\n  odla-ai admin ai audit [--limit <1-200>] [--json]\n  odla-ai security run [target] --ack-redacted-source [--env dev] [--profile odla] [--fail-on high]\n  odla-ai security run [target] --self --ack-redacted-source\n  odla-ai provision [--config odla.config.mjs] [--dry-run] [--push-secrets] [--rotate-o11y-token] [--write-dev-vars[=path]] [--yes]\n  odla-ai smoke [--config odla.config.mjs] [--env dev]\n  odla-ai skill install [--dir <project>] [--agent <name>] [--global] [--force]\n  odla-ai secrets push --env <env> [--config odla.config.mjs] [--dry-run] [--yes]\n  odla-ai version\n\nCommands:\n  setup        Install offline odla runbooks for common coding-agent harnesses.\n  init         Create a generic odla.config.mjs plus starter schema/rules files.\n  doctor       Validate and summarize the project config without network calls.\n  capabilities Show what the CLI automates vs agent edits and human checkpoints.\n  admin        Manage platform-funded AI routing/credentials/usage with narrow device grants.\n  security     Run hosted discovery + independent validation with app/run attribution.\n  provision    Register services, configure them, persist credentials, optionally push secrets.\n  smoke        Verify local credentials, public-config, live schema, and db aggregate.\n  skill        Same installer; --agent accepts all, claude, codex, cursor,\n               copilot, gemini, or agents (repeatable or comma-separated).\n  secrets      Push configured db/o11y secrets into the Worker via wrangler stdin.\n  version      Print the CLI version.\n\nSafety:\n  New projects target dev only. Add prod explicitly to odla.config.mjs and pass\n  --yes to provision it; use --dry-run first to inspect the resolved plan.\n  Provision caches the approved developer token and service credentials under\n  .odla/ with mode 0600, and init adds those paths to .gitignore. Secret push\n  preflights Wrangler before any shown-once issuance or destructive rotation.\n  Provision opens the approval page automatically in interactive terminals;\n  use --open to force browser launch or --no-open to suppress it.\n`);\n}\n","import { existsSync, lstatSync, mkdirSync, readFileSync, readdirSync, writeFileSync } from \"node:fs\";\nimport { homedir } from \"node:os\";\nimport { dirname, isAbsolute, join, relative, resolve, sep } from \"node:path\";\nimport { fileURLToPath } from \"node:url\";\nimport { claudeAdapter, CURSOR_RULE, PROJECT_INSTRUCTIONS } from \"./skill-adapters\";\n\n/** Agent harnesses with a first-class local adapter. */\nexport const AGENT_HARNESSES = [\"claude\", \"codex\", \"cursor\", \"copilot\", \"gemini\", \"agents\"] as const;\n\n/** A supported coding-agent harness. `agents` is the portable `AGENTS.md` adapter. */\nexport type AgentHarness = (typeof AGENT_HARNESSES)[number];\n\n/** A harness name accepted by setup; `all` expands to every project-local adapter. */\nexport type AgentHarnessSelector = AgentHarness | \"all\";\n\n/** Controls project-local or global installation of the bundled agent runbooks. */\nexport interface SkillInstallOptions {\n  /** Project directory receiving the shared runbooks and harness adapters. Defaults to cwd. */\n  dir?: string;\n  /** Install user-wide Claude and/or Codex skills instead of project adapters. */\n  global?: boolean;\n  /** Harnesses to install. The programmatic compatibility default is `claude`; the CLI passes `all`. */\n  harnesses?: AgentHarnessSelector[];\n  /** Overwrite locally modified odla-managed files or managed instruction sections. */\n  force?: boolean;\n  /** Test/embedding override for the home directory. */\n  homeDir?: string;\n  /** Test/embedding override for `$CODEX_HOME`. */\n  codexHomeDir?: string;\n  /** Test/embedding override for the bundled skills directory. */\n  sourceDir?: string;\n  stdout?: Pick<typeof console, \"log\" | \"error\">;\n}\n\n/** One harness adapter and the directories or files through which it discovers odla. */\nexport interface HarnessInstallResult {\n  harness: AgentHarness;\n  targets: string[];\n}\n\n/** Files written or left unchanged by an idempotent agent-runbook installation. */\nexport interface SkillInstallResult {\n  /** Primary native skill directory, retained for compatibility with earlier callers. */\n  targetDir: string;\n  /** Files changed directly under `targetDir`, relative to that directory. */\n  written: string[];\n  /** Files already current directly under `targetDir`, relative to that directory. */\n  unchanged: string[];\n  /** Absolute paths of every changed shared-runbook or adapter file. */\n  writtenPaths: string[];\n  /** Absolute paths of every already-current shared-runbook or adapter file. */\n  unchangedPaths: string[];\n  harnesses: HarnessInstallResult[];\n}\n\ninterface PlannedFile {\n  target: string;\n  content: string;\n  boundary: string;\n  managedMerge?: boolean;\n}\n\n/**\n * Installs one shared offline runbook tree plus thin native adapters for the\n * selected coding-agent harnesses. Project installs use `.agents/skills/` as\n * the canonical bundle; Claude Code, Cursor, Copilot, Gemini, and generic\n * `AGENTS.md` adapters point to it. Global installs support the native Claude\n * and Codex skill roots only.\n *\n * Installation is idempotent and planned before any write: an odla-managed\n * file changed by the user aborts the whole operation unless `force` is set.\n * Existing `AGENTS.md`, `GEMINI.md`, and Copilot instructions are preserved;\n * only the bounded odla-managed section is appended or replaced.\n */\nexport function installSkill(options: SkillInstallOptions = {}): SkillInstallResult {\n  const out = options.stdout ?? console;\n  const sourceDir = options.sourceDir ?? fileURLToPath(new URL(\"../skills\", import.meta.url));\n  const files = listFiles(sourceDir);\n  if (files.length === 0) throw new Error(`no bundled skills found at ${sourceDir}`);\n\n  const harnesses = normalizeHarnesses(options.harnesses, options.global === true);\n  const root = resolve(options.dir ?? process.cwd());\n  const home = resolve(options.homeDir ?? homedir());\n  const plans = new Map<string, PlannedFile>();\n  const targets = new Map<AgentHarness, Set<string>>();\n\n  const rememberTarget = (harness: AgentHarness, target: string): void => {\n    const current = targets.get(harness) ?? new Set<string>();\n    current.add(target);\n    targets.set(harness, current);\n  };\n  const plan = (target: string, content: string, managedMerge = false, boundary = root): void => {\n    const existing = plans.get(target);\n    if (existing && existing.content !== content) throw new Error(`internal agent setup conflict for ${target}`);\n    plans.set(target, { target, content, boundary, managedMerge });\n  };\n  const planSkillTree = (targetDir: string, boundary = root): void => {\n    for (const rel of files) plan(join(targetDir, rel), readFileSync(join(sourceDir, rel), \"utf8\"), false, boundary);\n  };\n\n  let targetDir: string;\n  if (options.global) {\n    const claudeRoot = join(home, \".claude\", \"skills\");\n    const codexRoot = resolve(options.codexHomeDir ?? process.env.CODEX_HOME ?? join(home, \".codex\"), \"skills\");\n    targetDir = harnesses[0] === \"codex\" ? codexRoot : claudeRoot;\n    for (const harness of harnesses) {\n      const skillRoot = harness === \"claude\" ? claudeRoot : codexRoot;\n      planSkillTree(skillRoot, harness === \"claude\" ? home : dirname(dirname(codexRoot)));\n      rememberTarget(harness, skillRoot);\n    }\n  } else {\n    const sharedRoot = join(root, \".agents\", \"skills\");\n    planSkillTree(sharedRoot);\n\n    const claudeRoot = join(root, \".claude\", \"skills\");\n    targetDir = harnesses.includes(\"claude\") ? claudeRoot : sharedRoot;\n    for (const harness of harnesses) rememberTarget(harness, sharedRoot);\n\n    if (harnesses.includes(\"claude\")) {\n      for (const skill of skillNames(files)) {\n        const canonical = readFileSync(join(sourceDir, skill, \"SKILL.md\"), \"utf8\");\n        plan(join(claudeRoot, skill, \"SKILL.md\"), claudeAdapter(skill, canonical));\n      }\n      rememberTarget(\"claude\", claudeRoot);\n    }\n    if (harnesses.includes(\"cursor\")) {\n      const cursorRule = join(root, \".cursor\", \"rules\", \"odla.mdc\");\n      plan(cursorRule, CURSOR_RULE);\n      rememberTarget(\"cursor\", cursorRule);\n    }\n    if (harnesses.includes(\"agents\")) {\n      const agentsFile = join(root, \"AGENTS.md\");\n      plan(agentsFile, managedFileContent(agentsFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"agents\", agentsFile);\n    }\n    if (harnesses.includes(\"copilot\")) {\n      const copilotFile = join(root, \".github\", \"copilot-instructions.md\");\n      plan(copilotFile, managedFileContent(copilotFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"copilot\", copilotFile);\n    }\n    if (harnesses.includes(\"gemini\")) {\n      const geminiFile = join(root, \"GEMINI.md\");\n      plan(geminiFile, managedFileContent(geminiFile, PROJECT_INSTRUCTIONS, options.force === true, root), true);\n      rememberTarget(\"gemini\", geminiFile);\n    }\n  }\n\n  const writtenPaths = new Set<string>();\n  const unchangedPaths = new Set<string>();\n  const conflicts: string[] = [];\n  for (const file of plans.values()) {\n    const symlink = symlinkedComponent(file.boundary, file.target);\n    if (symlink) {\n      conflicts.push(`${file.target} (redirected by symbolic link ${symlink})`);\n      continue;\n    }\n    if (!existsSync(file.target)) {\n      writtenPaths.add(file.target);\n      continue;\n    }\n    const current = readFileSync(file.target, \"utf8\");\n    if (current === file.content) {\n      unchangedPaths.add(file.target);\n    } else if (file.managedMerge || options.force) {\n      writtenPaths.add(file.target);\n      unchangedPaths.delete(file.target);\n    } else {\n      conflicts.push(file.target);\n    }\n  }\n\n  if (conflicts.length > 0) {\n    throw new Error(\n      `agent setup files modified locally (re-run with --force to replace only odla-managed content):\\n${conflicts.map((f) => `  - ${f}`).join(\"\\n\")}`,\n    );\n  }\n\n  for (const file of plans.values()) {\n    if (!existsSync(file.target) || readFileSync(file.target, \"utf8\") !== file.content) {\n      mkdirSync(dirname(file.target), { recursive: true });\n      writeFileSync(file.target, file.content);\n    }\n  }\n\n  const skills = skillNames(files);\n  const installations = harnesses.map((harness) => ({ harness, targets: [...(targets.get(harness) ?? [])] }));\n  out.log(`agent harnesses: ${harnesses.join(\", \")}`);\n  out.log(`offline skills: ${skills.join(\", \")}`);\n  for (const installation of installations) out.log(`${installation.harness}: ${installation.targets.join(\", \")}`);\n  out.log(`installed ${writtenPaths.size} managed file(s)${unchangedPaths.size ? ` (${unchangedPaths.size} unchanged)` : \"\"}`);\n  return {\n    targetDir,\n    written: pathsUnder(targetDir, writtenPaths),\n    unchanged: pathsUnder(targetDir, unchangedPaths),\n    writtenPaths: [...writtenPaths].sort(),\n    unchangedPaths: [...unchangedPaths].sort(),\n    harnesses: installations,\n  };\n}\n\nfunction pathsUnder(root: string, paths: Set<string>): string[] {\n  return [...paths]\n    .map((path) => relative(root, path))\n    .filter((path) => path !== \"..\" && !path.startsWith(`..${sep}`) && !isAbsolute(path))\n    .sort();\n}\n\nfunction normalizeHarnesses(values: AgentHarnessSelector[] | undefined, global: boolean): AgentHarness[] {\n  const requested: string[] = values?.length ? values : [\"claude\"];\n  const allowed = new Set<string>([...AGENT_HARNESSES, \"all\"]);\n  for (const harness of requested) {\n    if (!allowed.has(harness)) {\n      throw new Error(`unknown agent harness \"${harness}\"; choose all, ${AGENT_HARNESSES.join(\", \")}`);\n    }\n  }\n  const expanded: AgentHarness[] = requested.includes(\"all\")\n    ? global ? [\"claude\", \"codex\"] : [...AGENT_HARNESSES]\n    : [...new Set(requested)] as AgentHarness[];\n  if (global) {\n    const unsupported = expanded.filter((harness) => harness !== \"claude\" && harness !== \"codex\");\n    if (unsupported.length) {\n      throw new Error(`--global supports claude and codex only; ${unsupported.join(\", \")} require a project-local adapter`);\n    }\n  }\n  return expanded;\n}\n\nfunction managedFileContent(path: string, block: string, force: boolean, boundary: string): string {\n  const symlink = symlinkedComponent(boundary, path);\n  if (symlink) throw new Error(`refusing to manage ${path}: symbolic link component ${symlink}`);\n  if (!existsSync(path)) return `${block}\\n`;\n  const current = readFileSync(path, \"utf8\");\n  const start = \"<!-- odla-ai agent setup:start -->\";\n  const end = \"<!-- odla-ai agent setup:end -->\";\n  const startAt = current.indexOf(start);\n  const endAt = current.indexOf(end);\n  if ((startAt === -1) !== (endAt === -1) || (startAt !== -1 && endAt < startAt)) {\n    throw new Error(`malformed odla-managed section in ${path}`);\n  }\n  if (startAt === -1) {\n    const separator = current.length === 0 || current.endsWith(\"\\n\\n\") ? \"\" : current.endsWith(\"\\n\") ? \"\\n\" : \"\\n\\n\";\n    return `${current}${separator}${block}\\n`;\n  }\n  const afterEnd = endAt + end.length;\n  const existing = current.slice(startAt, afterEnd);\n  if (existing !== block && !force) {\n    throw new Error(`odla-managed section modified locally in ${path}; re-run with --force to replace that section`);\n  }\n  return `${current.slice(0, startAt)}${block}${current.slice(afterEnd)}`;\n}\n\nfunction symlinkedComponent(boundary: string, target: string): string | undefined {\n  const rel = relative(boundary, target);\n  if (rel === \"..\" || rel.startsWith(`..${sep}`) || isAbsolute(rel)) {\n    throw new Error(`agent setup target escapes its install root: ${target}`);\n  }\n  let current = boundary;\n  for (const part of rel.split(sep).filter(Boolean)) {\n    current = join(current, part);\n    try {\n      if (lstatSync(current).isSymbolicLink()) return current;\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code !== \"ENOENT\") throw error;\n    }\n  }\n  return undefined;\n}\n\nfunction skillNames(files: string[]): string[] {\n  return [...new Set(files.filter((file) => /(^|[\\\\/])SKILL\\.md$/.test(file)).map((file) => file.split(/[\\\\/]/)[0]!))].sort();\n}\n\nfunction listFiles(dir: string): string[] {\n  if (!existsSync(dir)) return [];\n  const results: string[] = [];\n  const walk = (current: string): void => {\n    for (const entry of readdirSync(current, { withFileTypes: true })) {\n      const path = join(current, entry.name);\n      if (entry.isDirectory()) walk(path);\n      else results.push(relative(dir, path));\n    }\n  };\n  walk(dir);\n  return results.sort();\n}\n","/** Shared instruction block inserted into harness-native project files. */\nexport const PROJECT_INSTRUCTIONS = `<!-- odla-ai agent setup:start -->\n## odla agent workflow\n\nFor work that creates an odla app or adds odla services, read and follow\n\\`.agents/skills/odla/SKILL.md\\`. It dispatches an existing static site to\n\\`.agents/skills/odla-migrate/SKILL.md\\`. For production telemetry triage, use\n\\`.agents/skills/odla-o11y-debug/SKILL.md\\`.\n\nThe complete runbooks and their references are installed in this repository.\nDo not fetch online odla documentation as setup context. Network access is only\nneeded when a runbook deliberately calls the odla service, npm, Cloudflare, or\nanother configured provider.\n<!-- odla-ai agent setup:end -->`;\n\n/** Cursor's native rule wrapper around the shared project instructions. */\nexport const CURSOR_RULE = `---\ndescription: Build, migrate, provision, secure, or debug an odla app using the locally installed odla runbooks\nglobs:\nalwaysApply: false\n---\n\n${PROJECT_INSTRUCTIONS}\n`;\n\n/** Build a thin Claude skill that delegates to the canonical offline bundle. */\nexport function claudeAdapter(skill: string, canonical: string): string {\n  const match = canonical.match(/^---\\r?\\n([\\s\\S]*?)\\r?\\n---/);\n  if (!match) throw new Error(`bundled skill ${skill} has no YAML frontmatter`);\n  const lines = match[1]!.split(/\\r?\\n/);\n  const frontmatter: string[] = [];\n  let keepIndented = false;\n  for (const line of lines) {\n    if (line.startsWith(\"name:\") || line.startsWith(\"description:\")) {\n      frontmatter.push(line);\n      keepIndented = line.startsWith(\"description:\");\n    } else if (keepIndented && /^\\s+/.test(line)) {\n      frontmatter.push(line);\n    } else {\n      keepIndented = false;\n    }\n  }\n  return `---\n${frontmatter.join(\"\\n\")}\n---\n\n# ${skill} (odla adapter)\n\nRead \\`../../../.agents/skills/${skill}/SKILL.md\\` completely and follow it. That\ncanonical local skill owns every reference path and contains the full offline\nrunbook. Do not substitute a remote documentation page for the installed copy.\n`;\n}\n","import { loadProjectConfig, resolveDataExport, serializedEntities } from \"./config\";\nimport { displayPath, readCredentials } from \"./local\";\nimport type { SmokeOptions } from \"./types\";\n\ntype FetchLike = typeof fetch;\n\n/**\n * Verify a live, already-provisioned environment end-to-end. Resolves the target\n * env (`options.env`, else `dev`, else the first declared env) and requires it to\n * be declared in the config. Reads the local credentials file and checks that it\n * belongs to this app and holds a `tenantId` + `dbKey` for the env — otherwise it\n * throws pointing the user at `odla-ai provision --write-dev-vars`.\n *\n * It then makes real network calls: fetches the registry public-config (and, when\n * `ai.provider` is configured, asserts the live provider matches), fetches the\n * live db schema with the db key and asserts every entity from the local schema\n * is present, and runs a `count` aggregate against the first entity to confirm\n * the db answers queries. Progress lines are printed and it ends with `ok`.\n * Read-only — it writes nothing and throws on the first mismatch or failed\n * request.\n *\n * @param options.configPath Path to the `odla.config.mjs`.\n * @param options.env Env to check (default `dev`, else the first declared env).\n * @param options.fetch Injectable `fetch` (for tests/embedding).\n * @param options.stdout Optional console-like sink (defaults to `console`).\n */\nexport async function smoke(options: SmokeOptions): Promise<void> {\n  const out = options.stdout ?? console;\n  const cfg = await loadProjectConfig(options.configPath);\n  const env = options.env ?? (cfg.envs.includes(\"dev\") ? \"dev\" : (cfg.envs[0] ?? \"prod\"));\n  if (!cfg.envs.includes(env)) throw new Error(`env \"${env}\" is not declared in ${displayPath(cfg.configPath, cfg.rootDir)}`);\n\n  const credentials = readCredentials(cfg.local.credentialsFile);\n  if (!credentials) {\n    throw new Error(`local credentials missing: ${displayPath(cfg.local.credentialsFile, cfg.rootDir)}. Run \"odla-ai provision --write-dev-vars\".`);\n  }\n  if (credentials.appId !== cfg.app.id) {\n    throw new Error(`local credentials are for app \"${credentials.appId}\", but config app is \"${cfg.app.id}\"`);\n  }\n\n  const entry = credentials.envs[env];\n  if (!entry?.tenantId || !entry.dbKey) {\n    throw new Error(`local credentials have no db key for env \"${env}\". Run \"odla-ai provision --write-dev-vars\".`);\n  }\n\n  const doFetch = options.fetch ?? fetch;\n  out.log(`smoke: ${cfg.app.id}/${env}`);\n  out.log(`  tenant: ${entry.tenantId}`);\n\n  const publicConfig = await getJson(doFetch, publicConfigUrl(cfg.platformUrl, cfg.app.id, env), undefined);\n  out.log(`  public-config: ok`);\n\n  if (cfg.ai?.provider) {\n    const provider = ((publicConfig as { ai?: { provider?: unknown } | null }).ai?.provider ?? null) as string | null;\n    if (provider !== cfg.ai.provider) {\n      throw new Error(`ai provider mismatch: expected \"${cfg.ai.provider}\", public-config has \"${provider ?? \"none\"}\"`);\n    }\n    out.log(`  ai: ${provider}`);\n  }\n\n  const expectedSchema = await resolveDataExport<unknown>(cfg, cfg.db?.schema, [\"schema\", \"SCHEMA\"]);\n  const expectedEntities = serializedEntities(expectedSchema);\n  const liveSchemaPayload = await getJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/schema`, entry.dbKey);\n  const liveSchema = (liveSchemaPayload as { schema?: unknown }).schema ?? liveSchemaPayload;\n  const liveEntities = serializedEntities(liveSchema);\n  if (expectedEntities.length) {\n    const missing = expectedEntities.filter((entity) => !liveEntities.includes(entity));\n    if (missing.length) throw new Error(`live schema is missing expected entities: ${missing.join(\", \")}`);\n  }\n  out.log(`  schema: ${liveEntities.length} entities`);\n\n  const aggregateEntity = expectedEntities[0] ?? liveEntities[0];\n  if (aggregateEntity) {\n    const aggregate = await postJson(doFetch, `${cfg.dbEndpoint}/app/${encodeURIComponent(entry.tenantId)}/aggregate`, entry.dbKey, {\n      ns: aggregateEntity,\n      aggregate: { count: true },\n    });\n    const count = (aggregate as { aggregate?: { count?: unknown } }).aggregate?.count;\n    out.log(`  aggregate: ${aggregateEntity}.count=${String(count ?? \"ok\")}`);\n  } else {\n    out.log(`  aggregate: skipped (schema has no entities)`);\n  }\n  out.log(\"ok\");\n}\n\nasync function getJson(doFetch: FetchLike, url: string, bearer: string | undefined): Promise<unknown> {\n  const res = await doFetch(url, {\n    headers: bearer ? { authorization: `Bearer ${bearer}` } : undefined,\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText(res)}`);\n  return res.json();\n}\n\nasync function postJson(doFetch: FetchLike, url: string, bearer: string, body: unknown): Promise<unknown> {\n  const res = await doFetch(url, {\n    method: \"POST\",\n    headers: { authorization: `Bearer ${bearer}`, \"content-type\": \"application/json\" },\n    body: JSON.stringify(body),\n  });\n  if (!res.ok) throw new Error(`${new URL(url).pathname} returned ${res.status}: ${await safeText(res)}`);\n  return res.json();\n}\n\nfunction publicConfigUrl(platformUrl: string, appId: string, env: string): string {\n  const url = new URL(`/registry/apps/${encodeURIComponent(appId)}/public-config`, platformUrl);\n  url.searchParams.set(\"env\", env);\n  return url.toString();\n}\n\nasync function safeText(res: Response): Promise<string> {\n  try {\n    return (await res.text()).slice(0, 500);\n  } catch {\n    return \"\";\n  }\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;;;ACKA,IAAM,mBAAmB,MACvB,OAAO,aAAa,cAChB,IAAI,IAAI,QAAQ,UAAU,EAAE,EAAE,OAC7B,SAAS,iBAAiB,SAAS,cAAc,QAAQ,YAAY,MAAM,WAC1E,SAAS,cAAc,MACvB,IAAI,IAAI,WAAW,SAAS,OAAO,EAAE;AAEtC,IAAM,gBAAgC,iCAAiB;;;ACZ9D,IAAAA,mBAAiD;;;ACAjD,IAAAC,uBAAoB;;;ACApB,gBAA6B;AAC7B,IAAAC,uBAAoB;;;ACDpB,gCAAsB;AACtB,0BAAoB;AAOpB,eAAsB,QAAQ,KAAa,UAA0B,CAAC,GAAkB;AACtF,QAAM,UAAU,UAAU,QAAQ,YAAY,oBAAAC,QAAQ,QAAQ;AAC9D,QAAM,UAAU,QAAQ,aAAa;AACrC,QAAM,IAAI,QAAc,CAACC,UAAS,WAAW;AAC3C,UAAM,QAAQ,QAAQ,QAAQ,KAAK,CAAC,GAAG,QAAQ,MAAM,GAAG,GAAG;AAAA,MACzD,OAAO;AAAA,MACP,UAAU;AAAA,IACZ,CAAC;AACD,UAAM,KAAK,SAAS,MAAM;AAC1B,UAAM,KAAK,SAAS,MAAM;AACxB,YAAM,MAAM;AACZ,MAAAA,SAAQ;AAAA,IACV,CAAC;AAAA,EACH,CAAC;AACH;AAEO,SAAS,UAAU,UAA4D;AACpF,MAAI,aAAa,SAAU,QAAO,EAAE,KAAK,QAAQ,MAAM,CAAC,EAAE;AAC1D,MAAI,aAAa,QAAS,QAAO,EAAE,KAAK,OAAO,MAAM,CAAC,MAAM,SAAS,EAAE,EAAE;AACzE,SAAO,EAAE,KAAK,YAAY,MAAM,CAAC,EAAE;AACrC;;;AC5BA,qBAA0F;AAC1F,uBAAuD;AAGvD,IAAM,kBAAkB,CAAC,sBAAsB,wBAAwB,WAAW;AAE3E,SAAS,aAAgB,MAAwB;AACtD,MAAI;AACF,WAAO,KAAK,UAAM,6BAAa,MAAM,MAAM,CAAC;AAAA,EAC9C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,iBAAiB,MAAc,OAAsB;AACnE,mBAAiB,MAAM,GAAG,KAAK,UAAU,OAAO,MAAM,CAAC,CAAC;AAAA,CAAI;AAC9D;AAEO,SAAS,gBAAgB,MAAuC;AACrE,MAAI,KAAC,2BAAW,IAAI,EAAG,QAAO;AAC9B,MAAI;AACJ,MAAI;AACF,YAAQ,KAAK,UAAM,6BAAa,MAAM,MAAM,CAAC;AAAA,EAC/C,QAAQ;AACN,UAAM,IAAI,MAAM,oBAAoB,IAAI,0DAA0D;AAAA,EACpG;AACA,MAAI,CAAC,SAAS,OAAO,UAAU,YAAY,OAAQ,MAA2B,UAAU,YACpF,CAAE,MAA2B,QAAQ,OAAQ,MAA2B,SAAS,UAAU;AAC7F,UAAM,IAAI,MAAM,oBAAoB,IAAI,6DAA6D;AAAA,EACvG;AACA,SAAO;AACT;AAEO,SAAS,gBACd,SACA,QACkB;AAClB,QAAM,OAAyB,WAAW;AAAA,IACxC,OAAO,OAAO;AAAA,IACd,aAAa,OAAO;AAAA,IACpB,YAAY,OAAO;AAAA,IACnB,YAAW,oBAAI,KAAK,CAAC,GAAE,YAAY;AAAA,IACnC,MAAM,CAAC;AAAA,EACT;AACA,OAAK,QAAQ,OAAO;AACpB,OAAK,cAAc,OAAO;AAC1B,OAAK,aAAa,OAAO;AACzB,OAAK,aAAY,oBAAI,KAAK,GAAE,YAAY;AACxC,OAAK,KAAK,OAAO,GAAG,IAAI;AAAA,IACtB,GAAI,KAAK,KAAK,OAAO,GAAG,KAAK,CAAC;AAAA,IAC9B,UAAU,OAAO;AAAA,IACjB,GAAI,OAAO,QAAQ,EAAE,OAAO,OAAO,MAAM,IAAI,CAAC;AAAA,IAC9C,GAAI,OAAO,YAAY,EAAE,WAAW,OAAO,UAAU,IAAI,CAAC;AAAA,EAC5D;AACA,SAAO;AACT;AAEO,SAAS,gBAAgB,SAAiB,aAAuB,CAAC,GAAS;AAChF,QAAM,WAAO,0BAAQ,SAAS,YAAY;AAC1C,QAAM,eAAW,2BAAW,IAAI,QAAI,6BAAa,MAAM,MAAM,IAAI;AACjE,QAAM,aAAa,WAAW,IAAI,CAAC,cAAc,eAAe,SAAS,SAAS,CAAC,EAAE,OAAO,CAAC,SAAyB,CAAC,CAAC,IAAI;AAC5H,QAAM,SAAS,CAAC,GAAG,oBAAI,IAAI,CAAC,GAAG,iBAAiB,GAAG,UAAU,CAAC,CAAC;AAC/D,QAAM,UAAU,OAAO,OAAO,CAAC,SAAS,CAAC,SAAS,MAAM,OAAO,EAAE,SAAS,IAAI,CAAC;AAC/E,MAAI,QAAQ,WAAW,EAAG;AAC1B,QAAM,SAAS,YAAY,CAAC,SAAS,SAAS,IAAI,IAAI,OAAO;AAC7D,oCAAc,MAAM,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,KAAK,IAAI,CAAC;AAAA,CAAI;AACnE;AAQO,SAAS,YAAY,KAAmD;AAC7E,MAAI,CAAC,IAAI,SAAS,SAAS,MAAM,EAAG,QAAO;AAC3C,SAAO;AAAA,IACL,UAAU,IAAI,MAAM,YAAY;AAAA,IAChC,SAAS,IAAI,MAAM,WAAW,IAAI,IAAI;AAAA,IACtC,GAAI,IAAI,MAAM,UAAU,EAAE,SAAS,IAAI,KAAK,QAAQ,IAAI,CAAC;AAAA,EAC3D;AACF;AAEO,SAAS,0BAA0B,KAA0B,WAAwD;AAC1H,MAAI,CAAC,UAAW,QAAO;AACvB,MAAI,cAAc,KAAM,QAAO,IAAI,MAAM;AACzC,aAAO,8BAAQ,0BAAQ,IAAI,UAAU,GAAG,SAAS;AACnD;AAEO,SAAS,aAAa,MAAc,aAA+B,KAAa,MAA0B;AAC/G,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2BAA2B,GAAG,QAAQ,IAAI,EAAE;AACxE,QAAM,QAAQ,CAAC,kBAAkB,YAAY,WAAW,GAAG;AAC3D,MAAI,MAAM,MAAO,OAAM,KAAK,kBAAkB,YAAY,UAAU,GAAG;AACvE,QAAM,KAAK,gBAAgB,YAAY,KAAK,KAAK,aAAa,GAAG,KAAK,gBAAgB,MAAM,QAAQ,GAAG;AACvG,MAAI,MAAM,MAAO,OAAM,KAAK,iBAAiB,MAAM,KAAK,GAAG;AAC3D,MAAI,MAAM;AACR,UAAM,KAAK,uBAAuB,KAAK,QAAQ,KAAK,sBAAsB,KAAK,OAAO,GAAG;AACzF,QAAI,KAAK,QAAS,OAAM,KAAK,sBAAsB,KAAK,OAAO,GAAG;AAElE,QAAI,MAAM,UAAW,OAAM,KAAK,oBAAoB,MAAM,SAAS,GAAG;AAAA,EACxE;AACA,QAAM,eAAW,2BAAW,IAAI,QAAI,6BAAa,MAAM,MAAM,IAAI;AACjE,QAAM,WAAW,SAAS,MAAM,OAAO,EAAE,OAAO,CAAC,SAAS,CAAC,gBAAgB,IAAI,CAAC;AAChF,SAAO,SAAS,GAAG,EAAE,MAAM,GAAI,UAAS,IAAI;AAC5C,QAAM,SAAS,SAAS,SAAS,GAAG,SAAS,KAAK,IAAI,CAAC;AAAA;AAAA,IAAS;AAChE,mBAAiB,MAAM,GAAG,MAAM,GAAG,MAAM,KAAK,IAAI,CAAC;AAAA,CAAI;AACzD;AAEA,IAAM,mBAAmB,oBAAI,IAAI;AAAA,EAC/B;AAAA,EAAiB;AAAA,EAAiB;AAAA,EAAe;AAAA,EAAY;AAAA,EAAe;AAAA,EAC5E;AAAA,EAAsB;AAAA,EAAqB;AAAA,EAAqB;AAClE,CAAC;AAED,SAAS,gBAAgB,MAAuB;AAC9C,QAAM,QAAQ,KAAK,MAAM,yCAAyC;AAClE,SAAO,CAAC,CAAC,QAAQ,CAAC,KAAK,iBAAiB,IAAI,MAAM,CAAC,CAAC;AACtD;AAEA,SAAS,iBAAiB,MAAc,MAAoB;AAC1D,oCAAU,0BAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;AAC5C,QAAM,YAAY,GAAG,IAAI,QAAQ,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AAC1D,oCAAc,WAAW,MAAM,EAAE,MAAM,IAAM,CAAC;AAC9C,gCAAU,WAAW,GAAK;AAC1B,iCAAW,WAAW,IAAI;AAC5B;AAEO,SAAS,eAAe,SAAiB,MAA6B;AAC3E,QAAM,UAAM,+BAAS,0BAAQ,OAAO,OAAG,0BAAQ,IAAI,CAAC;AACpD,MAAI,CAAC,OAAO,QAAQ,QAAQ,IAAI,WAAW,KAAK,QAAQ,aAAa,UAAU,OAAO,GAAG,EAAE,SAAK,6BAAW,GAAG,EAAG,QAAO;AACxH,SAAO,IAAI,WAAW,MAAM,GAAG;AACjC;AAEO,SAAS,YAAY,MAAc,UAAU,QAAQ,IAAI,GAAW;AACzE,QAAM,UAAM,2BAAS,SAAS,IAAI;AAClC,SAAO,OAAO,CAAC,IAAI,WAAW,IAAI,IAAI,MAAM;AAC9C;;;AFhIA,eAAsB,kBACpB,KACA,SACA,SACA,KACiB;AACjB,MAAI,QAAQ,MAAO,QAAO,QAAQ;AAClC,QAAM,WAAW,iBAAiB,IAAI,WAAW;AACjD,MAAI,qBAAAC,QAAQ,IAAI,gBAAgB;AAC9B,UAAM,WAAW,qBAAAA,QAAQ,IAAI;AAC7B,QAAI,UAAU;AACZ,UAAI,iBAAiB,QAAQ,MAAM,SAAU,OAAM,IAAI,MAAM,gEAAgE;AAAA,IAC/H,WAAW,aAAa,mBAAmB;AACzC,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,WAAO,qBAAAA,QAAQ,IAAI;AAAA,EACrB;AAEA,QAAM,SAAS,aAAwE,IAAI,MAAM,SAAS;AAC1G,MAAI,QAAQ,SAAS,OAAO,aAAa,aAAa,OAAO,aAAa,KAAK,KAAK,IAAI,IAAI,KAAQ;AAClG,QAAI,IAAI,uCAAuC,YAAY,IAAI,MAAM,WAAW,IAAI,OAAO,CAAC,GAAG;AAC/F,WAAO,OAAO;AAAA,EAChB;AAEA,QAAM,UAAU,gBAAgB,OAAO;AACvC,QAAM,EAAE,OAAO,UAAU,IAAI,UAAM,wBAAa;AAAA,IAC9C,UAAU,IAAI;AAAA,IACd,OAAO,GAAG,IAAI,IAAI,EAAE;AAAA,IACpB,OAAO;AAAA,IACP,QAAQ,OAAO,EAAE,UAAU,UAAU,MAAM;AACzC,YAAM,cAAc,aAAa,IAAI,aAAa,QAAQ;AAC1D,UAAI,IAAI,EAAE;AACV,UAAI,IAAI,gBAAgB,QAAQ,OAAO,WAAW,WAAW,KAAK,MAAM,YAAY,EAAE,CAAC,IAAI;AAC3F,UAAI,QAAQ,MAAM;AAChB,YAAI;AACF,iBAAO,QAAQ,mBAAmB,SAAS,WAAW;AACtD,cAAI,IAAI,oCAAoC,QAAQ,SAAS,SAAS,YAAY,EAAE,EAAE;AAAA,QACxF,SAAS,KAAK;AACZ,cAAI,IAAI,iCAAiC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG;AAAA,QAC9F;AAAA,MACF,WAAW,QAAQ,QAAQ;AACzB,YAAI,IAAI,iCAAiC,QAAQ,MAAM,GAAG;AAAA,MAC5D;AACA,UAAI,IAAI,EAAE;AAAA,IACZ;AAAA,EACF,CAAC;AACD,mBAAiB,IAAI,MAAM,WAAW,EAAE,UAAU,UAAU,OAAO,UAAU,CAAC;AAC9E,MAAI,IAAI,iCAAiC,YAAY,IAAI,MAAM,WAAW,IAAI,OAAO,CAAC,GAAG;AACzF,SAAO;AACT;AAEO,SAAS,gBAAgB,SAAyF;AACvH,MAAI,QAAQ,SAAS,KAAM,QAAO,EAAE,MAAM,MAAM,MAAM,SAAS;AAC/D,MAAI,QAAQ,SAAS,MAAO,QAAO,EAAE,MAAM,OAAO,QAAQ,wBAAwB;AAClF,MAAI,qBAAAA,QAAQ,IAAI,GAAI,QAAO,EAAE,MAAM,OAAO,QAAQ,iBAAiB;AAEnE,QAAM,cAAc,QAAQ,eAAe,QAAQ,qBAAAA,QAAQ,MAAM,SAAS,qBAAAA,QAAQ,OAAO,KAAK;AAC9F,MAAI,CAAC,YAAa,QAAO,EAAE,MAAM,OAAO,QAAQ,8CAA8C;AAC9F,SAAO,EAAE,MAAM,MAAM,MAAM,OAAO;AACpC;AAEO,SAAS,aAAa,aAAqB,UAA0B;AAC1E,QAAM,MAAM,IAAI,IAAI,WAAW,WAAW;AAC1C,MAAI,aAAa,IAAI,QAAQ,QAAQ;AACrC,SAAO,IAAI,SAAS;AACtB;AAGO,SAAS,iBAAiB,OAAuB;AACtD,MAAI;AACJ,MAAI;AAAE,UAAM,IAAI,IAAI,KAAK;AAAA,EAAG,QAAQ;AAAE,UAAM,IAAI,MAAM,kCAAkC;AAAA,EAAG;AAC3F,QAAM,QAAQ,IAAI,aAAa,eAAe,IAAI,aAAa,eAAe,IAAI,aAAa;AAC/F,MAAI,IAAI,aAAa,YAAY,EAAE,SAAS,IAAI,aAAa,UAAU;AACrE,UAAM,IAAI,MAAM,oEAAoE;AAAA,EACtF;AACA,MAAI,IAAI,YAAY,IAAI,YAAY,IAAI,UAAU,IAAI,MAAM;AAC1D,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AACA,SAAO,IAAI;AACb;;;AGvFA,IAAAC,kBAA2B;AAC3B,IAAAC,uBAAoB;AACpB,IAAAC,aAA6B;AA+B7B,eAAsB,uBAAuB,SAAsD;AACjG,SAAO,0BAA0B,OAAO;AAC1C;AAGA,eAAsB,0BAA0B,SAAqD;AACnG,QAAM,WAAW,iBAAiB,QAAQ,QAAQ;AAClD,MAAI,QAAQ,MAAO,QAAO,QAAQ;AAClC,QAAM,UAAU,qBAAAC,QAAQ,IAAI;AAC5B,MAAI,QAAS,QAAO,sBAAsB,SAAS,QAAQ;AAC3D,SAAO;AAAA,IACL;AAAA,IACA,QAAQ;AAAA,IACR;AAAA,IACA,QAAQ,SAAS;AAAA,IACjB,QAAQ,UAAU;AAAA,EACpB;AACF;AAEA,SAAS,sBAAsB,OAAe,UAA0B;AACtE,QAAM,WAAW,iBAAiB,QAAQ;AAC1C,QAAM,WAAW,qBAAAA,QAAQ,IAAI;AAC7B,MAAI,UAAU;AACZ,QAAI,iBAAiB,QAAQ,MAAM,SAAU,OAAM,IAAI,MAAM,kEAAkE;AAAA,EACjI,WAAW,aAAa,mBAAmB;AACzC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,SAAO;AACT;AAEA,eAAe,YACb,UACA,OACA,SACA,SACA,KACiB;AACjB,QAAM,WAAW,iBAAiB,QAAQ;AAC1C,QAAM,YAAY,QAAQ,aAAa,GAAG,qBAAAA,QAAQ,IAAI,CAAC;AACvD,QAAM,QAAQ,aAAqG,SAAS;AAC5H,QAAM,SAAS,OAAO,aAAa,WAAW,MAAM,SAAS,KAAK,IAAI;AACtE,MAAI,QAAQ,UAAU,OAAO,aAAa,KAAK,KAAK,IAAI,IAAI,KAAQ;AAClE,QAAI,IAAI,sBAAsB,KAAK,WAAW,SAAS,GAAG;AAC1D,WAAO,OAAO;AAAA,EAChB;AACA,QAAM,EAAE,OAAO,UAAU,IAAI,UAAM,yBAAa;AAAA,IAC9C,UAAU;AAAA,IACV,OAAO,sBAAsB,KAAK;AAAA,IAClC,QAAQ,CAAC,KAAK;AAAA,IACd,OAAO;AAAA,IACP,QAAQ,OAAO,EAAE,UAAU,UAAU,MAAM;AACzC,YAAM,cAAc,aAAa,UAAU,QAAQ;AACnD,UAAI,IAAI,0BAA0B,QAAQ,OAAO,WAAW,WAAW,KAAK,MAAM,YAAY,EAAE,CAAC,IAAI;AACrG,YAAM,aAAa,QAAQ,SAAS,QAAS,QAAQ,SAAS,SAAS,CAAC,qBAAAA,QAAQ,IAAI,MAAM,QAAQ,qBAAAA,QAAQ,MAAM,SAAS,qBAAAA,QAAQ,OAAO,KAAK;AAC7I,UAAI,WAAY,QAAO,QAAQ,mBAAmB,SAAS,WAAW,EAAE,MAAM,MAAM,MAAS;AAAA,IAC/F;AAAA,EACF,CAAC;AACD,QAAM,SAAS,OAAO,aAAa,WAAW,EAAE,GAAI,MAAM,UAAU,CAAC,EAAG,IAAI,CAAC;AAC7E,SAAO,KAAK,IAAI,EAAE,OAAO,UAAU;AACnC,UAAI,4BAAW,GAAG,qBAAAA,QAAQ,IAAI,CAAC,OAAO,EAAG,iBAAgB,qBAAAA,QAAQ,IAAI,GAAG,CAAC,SAAS,CAAC;AACnF,mBAAiB,WAAW,EAAE,UAAU,UAAU,OAAO,CAAC;AAC1D,MAAI,IAAI,gBAAgB,KAAK,WAAW,SAAS,cAAc;AAC/D,SAAO;AACT;;;ACjFO,SAAS,kBAAkB,SAAsC;AACtE,MAAI,QAAQ,UAAU,OAAW,QAAO;AACxC,MAAI,CAAC,OAAO,cAAc,QAAQ,KAAK,KAAK,QAAQ,QAAQ,KAAK,QAAQ,QAAQ,KAAK;AACpF,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,SAAO,UAAU,QAAQ,KAAK;AAChC;AAGA,eAAsB,iBAAiB,SAA6C;AAClF,QAAM,WAAW,MAAM,QAAQ,MAAM,GAAG,QAAQ,QAAQ,8BAA8B,QAAQ,KAAK,IAAI;AAAA,IACrG,SAAS,QAAQ;AAAA,EACnB,CAAC;AACD,QAAM,OAAO,MAAM,aAAa,QAAQ;AACxC,MAAI,CAAC,SAAS,GAAI,OAAM,IAAI,MAAM,SAAS,SAAS,QAAQ,IAAI,CAAC;AACjE,MAAI,QAAQ,MAAM;AAChB,YAAQ,OAAO,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAChD;AAAA,EACF;AACA,QAAM,SAAS,SAAS,IAAI,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,OAAO,OAAO,QAAQ,IAAI,CAAC;AAC9F,UAAQ,OAAO,IAAI,0CAA8C;AACjE,aAAW,SAAS,QAAQ;AAC1B,UAAM,SAAS,SAAS,MAAM,SAAS,IAAI,MAAM,YAAY;AAC7D,UAAM,QAAQ,SAAS,MAAM,SAAS,IAAI,MAAM,YAAY;AAC5D,UAAM,QAAQ,UAAU,QACpB,GAAG,OAAO,OAAO,QAAQ,CAAC,IAAI,OAAO,OAAO,KAAK,CAAC,KAAK,OAAO,OAAO,OAAO,CAAC,OAAO,OAAO,MAAM,QAAQ,CAAC,IAAI,OAAO,MAAM,KAAK,CAAC,KAAK,OAAO,MAAM,OAAO,CAAC,KAC3J;AACJ,YAAQ,OAAO,IAAI;AAAA,MACjB,UAAU,MAAM,SAAS;AAAA,MAAG,OAAO,MAAM,cAAc,EAAE;AAAA,MACzD,OAAO,MAAM,WAAW,MAAM,YAAY,EAAE;AAAA,MAAG;AAAA,MAC/C,GAAG,OAAO,MAAM,aAAa,EAAE,CAAC,IAAI,OAAO,MAAM,WAAW,EAAE,CAAC;AAAA,IACjE,EAAE,KAAK,GAAI,CAAC;AAAA,EACd;AACF;AAEA,eAAe,aAAa,UAAsC;AAChE,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,MAAI;AAAE,WAAO,KAAK,MAAM,IAAI;AAAA,EAAc,QAAQ;AAAE,WAAO,EAAE,SAAS,KAAK,MAAM,GAAG,GAAG,EAAE;AAAA,EAAG;AAC9F;AAEA,SAAS,SAAS,QAAgB,MAAuB;AACvD,QAAM,QAAQ,SAAS,IAAI,KAAK,SAAS,KAAK,KAAK,IAAI,KAAK,QAAQ;AACpE,QAAM,UAAU,SAAS,OAAO,MAAM,YAAY,WAC9C,MAAM,UACN,SAAS,IAAI,KAAK,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AACxE,SAAO,wCAAwC,MAAM,MAAM,OAAO;AACpE;AAEA,SAAS,UAAU,OAAwB;AACzC,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO,OAAO,SAAS,EAAE;AACnF,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,SAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI;AAChE;AAEA,SAAS,SAAS,OAAkD;AAClE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;ACvEO,IAAM,qBAAqB,CAAC,eAAe,sBAAsB,qBAAqB;AAMtF,SAAS,uBAAuB,OAA4C;AACjF,MAAI,CAAC,mBAAmB,SAAS,KAAwB,GAAG;AAC1D,UAAM,IAAI,MAAM,2BAA2B,mBAAmB,KAAK,IAAI,CAAC,EAAE;AAAA,EAC5E;AACA,SAAO;AACT;;;ACMO,SAAS,kBAAkB,SAAsC;AACtE,QAAM,SAAS,IAAI,gBAAgB;AACnC,MAAI,QAAQ,OAAO,KAAK,EAAG,QAAO,IAAI,SAAS,QAAQ,MAAM,KAAK,CAAC;AACnE,MAAI,QAAQ,KAAK,KAAK,EAAG,QAAO,IAAI,OAAO,QAAQ,IAAI,KAAK,CAAC;AAC7D,MAAI,QAAQ,OAAO,KAAK,EAAG,QAAO,IAAI,SAAS,QAAQ,MAAM,KAAK,CAAC;AACnE,MAAI,QAAQ,UAAU,OAAW,QAAO,IAAI,SAAS,OAAO,WAAW,QAAQ,KAAK,CAAC,CAAC;AACtF,QAAM,QAAQ,OAAO,SAAS;AAC9B,SAAO,QAAQ,IAAI,KAAK,KAAK;AAC/B;AAGA,eAAsB,iBAAiB,SAA6C;AAClF,QAAM,MAAM,MAAM,QAAQ,MAAM,GAAG,QAAQ,QAAQ,8BAA8B,QAAQ,KAAK,IAAI;AAAA,IAChG,SAAS,QAAQ;AAAA,EACnB,CAAC;AACD,QAAM,OAAO,MAAMC,cAAa,GAAG;AACnC,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAMC,UAAS,0BAA0B,IAAI,QAAQ,IAAI,CAAC;AACjF,MAAI,QAAQ,KAAM,SAAQ,OAAO,IAAI,KAAK,UAAU,MAAM,MAAM,CAAC,CAAC;AAAA,MAC7D,YAAW,MAAM,QAAQ,MAAM;AACtC;AAEA,SAAS,WAAW,OAAuB;AACzC,MAAI,CAAC,OAAO,cAAc,KAAK,KAAK,QAAQ,KAAK,QAAQ,KAAK;AAC5D,UAAM,IAAI,MAAM,8CAA8C;AAAA,EAChE;AACA,SAAO;AACT;AAEA,SAAS,WAAW,MAAe,KAAwC;AACzE,QAAM,aAAaC,UAAS,IAAI,KAAKA,UAAS,KAAK,UAAU,KAAK,MAAM,QAAQ,KAAK,WAAW,QAAQ,IACpG,KAAK,WAAW,SAAS,OAAOA,SAAQ,IACxC,CAAC;AACL,MAAI,IAAI,qDAAqD,OAAOA,UAAS,IAAI,IAAI,KAAK,iBAAiB,KAAK,EAAE,CAAC;AAAA,4DAAgG;AACnN,aAAW,OAAO,YAAY;AAC5B,QAAI,IAAI;AAAA,MACN,OAAO,IAAI,UAAU,EAAE;AAAA,MAAG,OAAO,IAAI,SAAS,EAAE;AAAA,MAAG,OAAO,IAAI,gBAAgB,EAAE;AAAA,MAChF,OAAO,IAAI,iBAAiB,EAAE;AAAA,MAAG,eAAe,IAAI,aAAa;AAAA,MAAG,OAAO,IAAI,kBAAkB,EAAE;AAAA,IACrG,EAAE,KAAK,GAAI,CAAC;AAAA,EACd;AACA,QAAM,SAASA,UAAS,IAAI,KAAK,MAAM,QAAQ,KAAK,MAAM,IAAI,KAAK,OAAO,OAAOA,SAAQ,IAAI,CAAC;AAC9F,MAAI,IAAI,UAAU,OAAOA,UAAS,IAAI,IAAI,KAAK,cAAc,OAAO,SAAS,OAAO,MAAM,CAAC;AAAA,sEAAwG;AACnM,aAAW,SAAS,QAAQ;AAC1B,UAAM,QAAQ,QAAQ,MAAM,YAAY;AACxC,UAAM,SAAS,QAAQ,MAAM,aAAa;AAC1C,UAAM,SAAS,MAAM,WAAW,QAAQ,MAAM,WAAW;AACzD,QAAI,IAAI;AAAA,MACNC,WAAU,MAAM,UAAU;AAAA,MAAG,GAAG,OAAO,MAAM,UAAU,EAAE,CAAC,IAAI,OAAO,MAAM,OAAO,EAAE,CAAC;AAAA,MACrF,OAAO,MAAM,UAAU,EAAE;AAAA,MAAG,GAAG,OAAO,MAAM,cAAc,EAAE,CAAC,IAAI,OAAO,MAAM,YAAY,EAAE,CAAC;AAAA,MAC7F,GAAG,OAAO,MAAM,WAAW,EAAE,CAAC,IAAI,OAAO,MAAM,QAAQ,EAAE,CAAC;AAAA,MAC1D,GAAG,OAAO,MAAM,YAAY,EAAE,CAAC,IAAI,OAAO,MAAM,SAAS,EAAE,CAAC,KAAK,OAAO,MAAM,kBAAkB,SAAS,CAAC;AAAA,MAAI,OAAO,QAAQ,MAAM;AAAA,MACnI,SAAS,eAAe,MAAM,aAAa,IAAI;AAAA,MAC/C,GAAG,OAAO,MAAM,UAAU,EAAE,CAAC,GAAG,MAAM,aAAa,IAAI,OAAO,MAAM,UAAU,CAAC,KAAK,EAAE;AAAA,IACxF,EAAE,KAAK,GAAI,CAAC;AAAA,EACd;AACF;AAEA,SAAS,QAAQ,OAAwB;AACvC,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,QAAQ;AACvE;AAEA,SAAS,eAAe,OAAwB;AAC9C,SAAO,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,KAAK,QAAQ,KAAW,QAAQ,CAAC,CAAC,KAAK;AACtG;AAEA,SAASA,WAAU,OAAwB;AACzC,MAAI,OAAO,UAAU,YAAY,CAAC,OAAO,SAAS,KAAK,EAAG,QAAO,OAAO,SAAS,EAAE;AACnF,QAAM,OAAO,IAAI,KAAK,KAAK;AAC3B,SAAO,OAAO,SAAS,KAAK,QAAQ,CAAC,IAAI,KAAK,YAAY,IAAI;AAChE;AAEA,eAAeH,cAAa,KAAiC;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,MAAI;AAAE,WAAO,KAAK,MAAM,IAAI;AAAA,EAAc,QAAQ;AAAE,WAAO,EAAE,SAAS,KAAK,MAAM,GAAG,GAAG,EAAE;AAAA,EAAG;AAC9F;AAEA,SAASC,UAAS,QAAgB,QAAgB,MAAuB;AACvE,QAAM,QAAQC,UAAS,IAAI,KAAKA,UAAS,KAAK,KAAK,IAAI,KAAK,QAAQ;AACpE,QAAM,UAAU,SAAS,OAAO,MAAM,YAAY,WAAW,MAAM,UAAUA,UAAS,IAAI,KAAK,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AACjJ,SAAO,GAAG,MAAM,YAAY,MAAM,MAAM,OAAO;AACjD;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;APhDA,eAAsB,QAAQ,SAAwC;AACpE,QAAM,WAAW,iBAAiB,QAAQ,YAAY,qBAAAE,QAAQ,IAAI,iBAAiB,iBAAiB;AACpG,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,aAAa,QAAQ,WAAW,UAAU,kBAAkB,OAAO,IAAI;AAC7E,QAAM,aAAa,QAAQ,WAAW,UAAU,kBAAkB,OAAO,IAAI;AAC7E,QAAM,QAA6B,QAAQ,WAAW,QAClD,6BACA,QAAQ,WAAW,mBACjB,iCACA,QAAQ,WAAW,gBACjB,gCACA,QAAQ,WAAW,UACjB,2BACA,QAAQ,WAAW,UACjB,2BACF;AACV,QAAM,QAAQ,MAAM,0BAA0B;AAAA,IAC5C;AAAA,IACA;AAAA,IACA,OAAO,QAAQ;AAAA,IACf,MAAM,QAAQ;AAAA,IACd,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,iBAAiB,QAAQ;AAAA,IACzB,WAAW,QAAQ;AAAA,EACrB,CAAC;AACD,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,IAAI,gBAAgB,mBAAmB;AAEvF,MAAI,QAAQ,WAAW,SAAS;AAC9B,UAAM,iBAAiB,EAAE,UAAU,OAAO,cAAc,IAAI,SAAS,MAAM,QAAQ,MAAM,OAAO,SAAS,QAAQ,IAAI,CAAC;AACtH;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,SAAS;AAC9B,UAAM,iBAAiB,EAAE,UAAU,OAAO,cAAc,IAAI,SAAS,MAAM,QAAQ,MAAM,OAAO,SAAS,QAAQ,IAAI,CAAC;AACtH;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,eAAe;AACpC,UAAMC,OAAM,MAAM,QAAQ,GAAG,QAAQ,qCAAqC,EAAE,QAAQ,CAAC;AACrF,UAAMC,QAAO,MAAMC,cAAaF,IAAG;AACnC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAMG,UAAS,sCAAsCH,KAAI,QAAQC,KAAI,CAAC;AAC7F,UAAM,cAAcG,UAASH,KAAI,KAAKG,UAASH,MAAK,WAAW,IAAIA,MAAK,cAAcA;AACtF,QAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,EAAE,YAAY,GAAG,MAAM,CAAC,CAAC;AAAA,QAC7D,YAAW,CAAC,UAAU,MAAM,KAAK,OAAO,QAAQG,UAAS,WAAW,IAAI,cAAc,CAAC,CAAC,GAAG;AAC9F,YAAM,QAAQA,UAAS,MAAM,KAAK,OAAO,QAAQ,OAC7C,OAAO,aAAa,OAAO,mBAAmB,6BAC9C;AACJ,UAAI,IAAI,GAAG,QAAQ,IAAK,KAAK,EAAE;AAAA,IACjC;AACA;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,kBAAkB;AACvC,UAAM,WAAW,gBAAgB,QAAQ,kBAAkB;AAC3D,UAAM,QAAQ,MAAM,gBAAgB,OAAO;AAC3C,UAAMJ,OAAM,MAAM,QAAQ,GAAG,QAAQ,qCAAqC,mBAAmB,QAAQ,CAAC,IAAI;AAAA,MACxG,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU,EAAE,MAAM,CAAC;AAAA,IAChC,CAAC;AACD,UAAMC,QAAO,MAAMC,cAAaF,IAAG;AACnC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAMG,UAAS,SAAS,QAAQ,wBAAwBH,KAAI,QAAQC,KAAI,CAAC;AAChG,QAAI,IAAI,UAAU,QAAQ,2DAA2D;AACrF;AAAA,EACF;AAEA,MAAI,QAAQ,WAAW,UAAU,QAAQ,WAAW,UAAU;AAC5D,UAAMD,OAAM,MAAM,QAAQ,GAAG,QAAQ,kCAAkC,EAAE,QAAQ,CAAC;AAClF,UAAMC,QAAO,MAAMC,cAAaF,IAAG;AACnC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAMG,UAAS,6BAA6BH,KAAI,QAAQC,KAAI,CAAC;AACpF,QAAI,QAAQ,WAAW,UAAU;AAC/B,YAAM,SAAS,cAAcA,KAAI,EAAE,OAAO,CAAC,UAAU,CAAC,QAAQ,YAAY,MAAM,aAAa,QAAQ,QAAQ;AAC7G,UAAI,CAAC,OAAO,OAAQ,OAAM,IAAI,MAAM,QAAQ,WAAW,0CAA0C,QAAQ,QAAQ,KAAK,uCAAuC;AAC7J,UAAI,QAAQ,KAAM,KAAI,IAAI,KAAK,UAAU,EAAE,OAAO,GAAG,MAAM,CAAC,CAAC;AAAA,UACxD,YAAW,SAAS,OAAQ,KAAI,IAAI,GAAG,MAAM,QAAQ,IAAK,MAAM,EAAE,EAAE;AACzE;AAAA,IACF;AACA,UAAM,WAAW,YAAYA,KAAI;AACjC,QAAI,QAAQ,MAAM;AAChB,UAAI,IAAI,KAAK,UAAU,EAAE,UAAU,QAAQ,cAAcA,KAAI,EAAE,GAAG,MAAM,CAAC,CAAC;AAC1E;AAAA,IACF;AACA,QAAI,IAAI,4EAAkF;AAC1F,eAAWI,WAAU,UAAU;AAC7B,UAAI,IAAI;AAAA,QACNA,QAAO;AAAA,QACP,OAAOA,QAAO,OAAO;AAAA,QACrBA,QAAO;AAAA,QACPA,QAAO;AAAA,QACP,OAAOA,QAAO,kBAAkB,EAAE;AAAA,QAClC,OAAOA,QAAO,iBAAiB,EAAE;AAAA,QACjC,OAAOA,QAAO,mBAAmB,EAAE;AAAA,MACrC,EAAE,KAAK,GAAI,CAAC;AAAA,IACd;AACA;AAAA,EACF;AAEA,MAAI,QAAQ,YAAY,YAAY;AAClC,UAAM,kBAAkB,MAAM,QAAQ,GAAG,QAAQ,kCAAkC,EAAE,QAAQ,CAAC;AAC9F,UAAM,cAAc,MAAMH,cAAa,eAAe;AACtD,QAAI,CAAC,gBAAgB,GAAI,OAAM,IAAI,MAAMC,UAAS,qCAAqC,gBAAgB,QAAQ,WAAW,CAAC;AAC3H,UAAM,WAAW,YAAY,WAAW;AACxC,UAAM,YAAY,SAAS,KAAK,CAACE,YAAWA,QAAO,YAAY,oBAAoB;AACnF,UAAM,aAAa,SAAS,KAAK,CAACA,YAAWA,QAAO,YAAY,qBAAqB;AACrF,QAAI,CAAC,aAAa,CAAC,cAAc,CAAC,OAAO,cAAc,UAAU,OAAO,KAAK,CAAC,OAAO,cAAc,WAAW,OAAO,GAAG;AACtH,YAAM,IAAI,MAAM,wDAAwD;AAAA,IAC1E;AACA,UAAM,SAAS;AAAA,MACb,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,MACpE,GAAI,QAAQ,kBAAkB,SAAY,CAAC,IAAI,EAAE,eAAe,QAAQ,cAAc;AAAA,MACtF,GAAI,QAAQ,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,QAAQ,gBAAgB;AAAA,MAC5F,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,eAAe;AAAA,IAC3F;AACA,UAAM,kBAAkB;AAAA,MACtB,GAAG;AAAA,MACH,GAAI,QAAQ,mBAAmB,KAAK,IAAI,EAAE,UAAU,QAAQ,kBAAkB,KAAK,EAAE,IAAI,CAAC;AAAA,MAC1F,GAAI,QAAQ,gBAAgB,KAAK,IAAI,EAAE,OAAO,QAAQ,eAAe,KAAK,EAAE,IAAI,CAAC;AAAA,IACnF;AACA,UAAM,mBAAmB;AAAA,MACvB,GAAG;AAAA,MACH,GAAI,QAAQ,oBAAoB,KAAK,IAAI,EAAE,UAAU,QAAQ,mBAAmB,KAAK,EAAE,IAAI,CAAC;AAAA,MAC5F,GAAI,QAAQ,iBAAiB,KAAK,IAAI,EAAE,OAAO,QAAQ,gBAAgB,KAAK,EAAE,IAAI,CAAC;AAAA,IACrF;AACA,QAAI,CAAC,OAAO,KAAK,eAAe,EAAE,UAAU,CAAC,OAAO,KAAK,gBAAgB,EAAE,QAAQ;AACjF,YAAM,IAAI,MAAM,gEAAgE;AAAA,IAClF;AACA,UAAML,OAAM,MAAM,QAAQ,GAAG,QAAQ,2CAA2C;AAAA,MAC9E,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB,kBAAkB,EAAE,WAAW,UAAU,SAAS,YAAY,WAAW,QAAQ;AAAA,QACjF,WAAW;AAAA,QACX,YAAY;AAAA,MACd,CAAC;AAAA,IACH,CAAC;AACD,UAAMM,YAAW,MAAMJ,cAAaF,IAAG;AACvC,QAAI,CAACA,KAAI,GAAI,OAAM,IAAI,MAAMG,UAAS,iCAAiCH,KAAI,QAAQM,SAAQ,CAAC;AAC5F,QAAI,IAAI,QAAQ,OAAO,KAAK,UAAUA,WAAU,MAAM,CAAC,IAAI,gFAAgF;AAC3I;AAAA,EACF;AAEA,QAAM,UAAU,uBAAuB,QAAQ,OAAO;AACtD,QAAM,OAAO;AAAA,IACX,GAAI,QAAQ,UAAU,KAAK,IAAI,EAAE,UAAU,QAAQ,SAAS,KAAK,EAAE,IAAI,CAAC;AAAA,IACxE,GAAI,QAAQ,OAAO,KAAK,IAAI,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAAI,CAAC;AAAA,IAC/D,GAAI,QAAQ,YAAY,SAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;AAAA,IACpE,GAAI,QAAQ,kBAAkB,SAAY,CAAC,IAAI,EAAE,eAAe,QAAQ,cAAc;AAAA,IACtF,GAAI,QAAQ,oBAAoB,SAAY,CAAC,IAAI,EAAE,iBAAiB,QAAQ,gBAAgB;AAAA,IAC5F,GAAI,QAAQ,mBAAmB,SAAY,CAAC,IAAI,EAAE,gBAAgB,QAAQ,eAAe;AAAA,EAC3F;AACA,MAAI,CAAC,OAAO,KAAK,IAAI,EAAE,OAAQ,OAAM,IAAI,MAAM,iEAAiE;AAChH,QAAM,MAAM,MAAM,QAAQ,GAAG,QAAQ,kCAAkC,mBAAmB,OAAO,CAAC,IAAI;AAAA,IACpG,QAAQ;AAAA,IACR;AAAA,IACA,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,QAAM,WAAW,MAAMJ,cAAa,GAAG;AACvC,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAMC,UAAS,UAAU,OAAO,IAAI,IAAI,QAAQ,QAAQ,CAAC;AAChF,QAAM,SAAkCC,UAAS,QAAQ,KAAKA,UAAS,SAAS,MAAM,IAClF,SAAS,SACTA,UAAS,QAAQ,IAAI,WAAW,CAAC;AACrC,MAAI,IAAI,QAAQ,OAAO,KAAK,UAAU,EAAE,OAAO,GAAG,MAAM,CAAC,IAAI,WAAW,OAAO,KAAK,OAAO,OAAO,YAAY,WAAW,CAAC,IAAI,OAAO,OAAO,SAAS,WAAW,CAAC,EAAE;AACrK;AAEA,SAAS,gBAAgB,OAA8D;AACrF,MAAI,UAAU,eAAe,UAAU,YAAY,UAAU,UAAU;AACrE,UAAM,IAAI,MAAM,oDAAoD;AAAA,EACtE;AACA,SAAO;AACT;AAEA,eAAe,gBAAgB,SAA0C;AACvE,MAAI,QAAQ,WAAW,QAAQ,MAAO,OAAM,IAAI,MAAM,6CAA6C;AACnG,MAAI;AACJ,MAAI,QAAQ,QAAS,SAAQ,qBAAAL,QAAQ,IAAI,QAAQ,OAAO;AAAA,WAC/C,QAAQ,MAAO,SAAQ,OAAO,QAAQ,aAAa,WAAW;AAAA,MAClE,OAAM,IAAI,MAAM,qGAAqG;AAC1H,UAAQ,OAAO,QAAQ,YAAY,EAAE;AACrC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,QAAQ,UAAU,wBAAwB,QAAQ,OAAO,uBAAuB,2BAA2B;AACvI,MAAI,IAAI,YAAY,EAAE,OAAO,KAAK,EAAE,aAAa,KAAK,KAAM,OAAM,IAAI,MAAM,2BAA2B;AACvG,SAAO;AACT;AAEA,eAAe,YAA6B;AAC1C,MAAI,QAAQ;AACZ,mBAAiB,SAAS,qBAAAA,QAAQ,OAAO;AACvC,aAAS,OAAO,KAAK;AACrB,QAAI,MAAM,SAAS,KAAK,KAAM,OAAM,IAAI,MAAM,2BAA2B;AAAA,EAC3E;AACA,SAAO;AACT;AAEA,SAAS,YAAY,MAA+C;AAClE,MAAIK,UAAS,IAAI,KAAK,MAAM,QAAQ,KAAK,QAAQ,EAAG,QAAO,KAAK,SAAS,OAAOA,SAAQ;AACxF,MAAIA,UAAS,IAAI,KAAKA,UAAS,KAAK,QAAQ,EAAG,QAAO,OAAO,OAAO,KAAK,QAAQ,EAAE,OAAOA,SAAQ;AAClG,QAAM,IAAI,MAAM,iDAAiD;AACnE;AAEA,SAAS,cAAc,MAAwD;AAC7E,MAAI,CAACA,UAAS,IAAI,KAAK,CAACA,UAAS,KAAK,OAAO,KAAK,CAAC,MAAM,QAAQ,KAAK,QAAQ,MAAM,GAAG;AACrF,UAAM,IAAI,MAAM,sDAAsD;AAAA,EACxE;AACA,SAAO,KAAK,QAAQ,OAAO,OAAO,CAAC,UACjCA,UAAS,KAAK,KAAK,OAAO,MAAM,OAAO,YAAY,OAAO,MAAM,aAAa,QAAQ;AACzF;AAEA,eAAeF,cAAa,KAAiC;AAC3D,QAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,MAAI,CAAC,KAAM,QAAO,CAAC;AACnB,MAAI;AAAE,WAAO,KAAK,MAAM,IAAI;AAAA,EAAc,QAAQ;AAAE,WAAO,EAAE,SAAS,KAAK,MAAM,GAAG,GAAG,EAAE;AAAA,EAAG;AAC9F;AAEA,SAASC,UAAS,QAAgB,QAAgB,MAAuB;AACvE,QAAM,QAAQC,UAAS,IAAI,KAAKA,UAAS,KAAK,KAAK,IAAI,KAAK,QAAQ;AACpE,QAAM,UAAU,SAAS,OAAO,MAAM,YAAY,WAAW,MAAM,UAAUA,UAAS,IAAI,KAAK,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU;AACjJ,SAAO,GAAG,MAAM,YAAY,MAAM,MAAM,OAAO;AACjD;AAEA,SAASA,UAAS,OAAkD;AAClE,SAAO,QAAQ,KAAK,KAAK,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK;AAC5E;;;AQ5QO,SAAS,UAAU,MAA4B;AACpD,QAAM,cAAwB,CAAC;AAC/B,QAAM,UAAuC,CAAC;AAC9C,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,MAAM,KAAK,CAAC;AAClB,QAAI,CAAC,IAAI,WAAW,IAAI,GAAG;AACzB,kBAAY,KAAK,GAAG;AACpB;AAAA,IACF;AACA,UAAM,KAAK,IAAI,QAAQ,GAAG;AAC1B,UAAM,UAAU,IAAI,MAAM,GAAG,OAAO,KAAK,SAAY,EAAE;AACvD,QAAI,CAAC,QAAS;AACd,QAAI,QAAQ,WAAW,KAAK,GAAG;AAC7B,cAAQ,QAAQ,MAAM,CAAC,CAAC,IAAI;AAC5B;AAAA,IACF;AACA,QAAI,OAAO,IAAI;AACb,gBAAU,SAAS,SAAS,IAAI,MAAM,KAAK,CAAC,CAAC;AAC7C;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,IAAI,CAAC;AACxB,QAAI,UAAU,UAAa,CAAC,MAAM,WAAW,IAAI,GAAG;AAClD;AACA,gBAAU,SAAS,SAAS,KAAK;AAAA,IACnC,OAAO;AACL,gBAAU,SAAS,SAAS,IAAI;AAAA,IAClC;AAAA,EACF;AACA,SAAO,EAAE,aAAa,QAAQ;AAChC;AAEO,SAAS,WAAW,QAAoB,gBAA0B,gBAA8B;AACrG,QAAM,UAAU,IAAI,IAAI,cAAc;AACtC,aAAW,QAAQ,OAAO,KAAK,OAAO,OAAO,GAAG;AAC9C,QAAI,CAAC,QAAQ,IAAI,IAAI,EAAG,OAAM,IAAI,MAAM,qBAAqB,IAAI,6CAA6C;AAAA,EAChH;AACA,MAAI,OAAO,YAAY,SAAS,gBAAgB;AAC9C,UAAM,IAAI,MAAM,wBAAwB,OAAO,YAAY,cAAc,CAAC,uBAAuB;AAAA,EACnG;AACF;AAEO,SAAS,eAAe,OAAgC,MAAsB;AACnF,QAAM,SAAS,UAAU,KAAK;AAC9B,MAAI,CAAC,OAAQ,OAAM,IAAI,MAAM,GAAG,IAAI,cAAc;AAClD,SAAO;AACT;AAEO,SAAS,UAAU,OAAoD;AAC5E,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,MAAM,SAAS,CAAC;AACvD,SAAO;AACT;AAEO,SAAS,QAAQ,OAAsD;AAC5E,MAAI,UAAU,UAAa,OAAO,UAAU,UAAW,QAAO;AAC9D,QAAM,SAAS,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACpD,SAAO,OAAO,QAAQ,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC,EAAE,OAAO,OAAO;AAC5F;AAEO,SAAS,QAAQ,OAAqD;AAC3E,MAAI,OAAO,UAAU,UAAW,QAAO;AACvC,MAAI,OAAO,UAAU,aAAa,UAAU,UAAU,UAAU,SAAU,QAAO,UAAU;AAC3F,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,IAAI,MAAM,sCAAsC;AACxD;AAEO,SAAS,UAAU,OAAgC,MAAkC;AAC1F,MAAI,UAAU,OAAW,QAAO;AAChC,QAAM,MAAM,UAAU,KAAK;AAC3B,QAAM,SAAS,QAAQ,SAAY,OAAO,MAAM,OAAO,GAAG;AAC1D,MAAI,CAAC,OAAO,cAAc,MAAM,KAAK,SAAS,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,8BAA8B;AACtG,SAAO;AACT;AAEA,SAAS,UAAU,SAAsC,MAAc,OAA+B;AACpG,QAAM,UAAU,QAAQ,IAAI;AAC5B,MAAI,YAAY,OAAW,SAAQ,IAAI,IAAI;AAAA,WAClC,MAAM,QAAQ,OAAO,EAAG,SAAQ,KAAK,OAAO,KAAK,CAAC;AAAA,MACtD,SAAQ,IAAI,IAAI,CAAC,OAAO,OAAO,GAAG,OAAO,KAAK,CAAC;AACtD;;;ACrFO,IAAM,eAAe;AAAA,EAC1B,KAAK;AAAA,IACH;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,OAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAKO,SAAS,kBAAkB,OAAO,OAAO,MAAc,SAAe;AAC3E,MAAI,MAAM;AACR,QAAI,IAAI,KAAK,UAAU,cAAc,MAAM,CAAC,CAAC;AAC7C;AAAA,EACF;AACA,MAAI,IAAI,mCAAmC;AAC3C,aAAW,KAAK,iBAAiB,aAAa,GAAG;AACjD,aAAW,KAAK,+BAA+B,aAAa,KAAK;AACjE,aAAW,KAAK,qBAAqB,aAAa,KAAK;AACvD,aAAW,KAAK,UAAU,aAAa,MAAM;AAC/C;AAEA,SAAS,WAAW,KAAa,SAAiB,OAAgC;AAChF,MAAI,IAAI,GAAG,OAAO,GAAG;AACrB,aAAW,QAAQ,MAAO,KAAI,IAAI,OAAO,IAAI,EAAE;AAC/C,MAAI,IAAI,EAAE;AACZ;;;AClDA,IAAAG,kBAAyC;AACzC,IAAAC,oBAA6C;AAC7C,sBAA8B;AAG9B,IAAM,mBAAmB;AAEzB,IAAM,eAAe,CAAC,KAAK;AAC3B,IAAM,mBAAmB,CAAC,MAAM,IAAI;AAEpC,eAAsB,kBAAkB,aAAa,mBAAiD;AACpG,QAAM,eAAW,2BAAQ,UAAU;AACnC,MAAI,KAAC,4BAAW,QAAQ,GAAG;AACzB,UAAM,IAAI,MAAM,qBAAqB,UAAU,8CAA8C;AAAA,EAC/F;AAEA,QAAM,MAAM,MAAM,iBAAiB,QAAQ;AAC3C,QAAM,cAAU,2BAAQ,QAAQ;AAChC,oBAAkB,KAAK,QAAQ;AAE/B,QAAM,cAAc,UAAU,QAAQ,IAAI,qBAAqB,IAAI,eAAe,gBAAgB;AAClG,QAAM,aAAa,UAAU,QAAQ,IAAI,oBAAoB,IAAI,cAAc,WAAW;AAC1F,QAAM,OAAO,OAAO,IAAI,MAAM,SAAS,IAAI,OAAO,YAAY;AAC9D,QAAM,WAAW,OAAO,IAAI,UAAU,SAAS,IAAI,WAAW,gBAAgB;AAC9E,QAAM,QAAQ;AAAA,IACZ,eAAW,2BAAQ,SAAS,IAAI,OAAO,aAAa,sBAAsB;AAAA,IAC1E,qBAAiB,2BAAQ,SAAS,IAAI,OAAO,mBAAmB,8BAA8B;AAAA,IAC9F,iBAAa,2BAAQ,SAAS,IAAI,OAAO,eAAe,WAAW;AAAA,IACnE,WAAW,IAAI,OAAO,aAAa;AAAA,EACrC;AAEA,SAAO;AAAA,IACL,GAAG;AAAA,IACH,YAAY;AAAA,IACZ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAEA,eAAsB,kBACpB,KACA,OACA,OACwB;AACxB,MAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,MAAO,QAAO;AACrE,MAAI,OAAO,UAAU,SAAU,QAAO;AAEtC,QAAM,aAAS,8BAAW,KAAK,IAAI,YAAQ,2BAAQ,IAAI,SAAS,KAAK;AACrE,MAAI,OAAO,SAAS,OAAO,GAAG;AAC5B,WAAO,KAAK,UAAM,8BAAa,QAAQ,MAAM,CAAC;AAAA,EAChD;AACA,QAAM,MAAO,MAAM,WAAO,+BAAc,MAAM,EAAE;AAChD,aAAW,QAAQ,OAAO;AACxB,QAAI,IAAI,IAAI,MAAM,OAAW,QAAO,IAAI,IAAI;AAAA,EAC9C;AACA,MAAI,IAAI,YAAY,OAAW,QAAO,IAAI;AAC1C,QAAM,IAAI,MAAM,GAAG,KAAK,mBAAmB,MAAM,KAAK,IAAI,CAAC,aAAa;AAC1E;AAEO,SAAS,UAAU,KAAyC;AACjE,SAAO;AAAA,IACL,OAAO,IAAI,IAAI;AAAA,IACf,SAAS,IAAI,IAAI;AAAA,IACjB,aAAa,IAAI;AAAA,IACjB,YAAY,IAAI;AAAA,IAChB,MAAM,IAAI;AAAA,IACV,UAAU,IAAI;AAAA,IACd,WAAW,CAAC,CAAC,IAAI,IAAI;AAAA,IACrB,UAAU,CAAC,CAAC,IAAI,IAAI,SAAU,CAAC,CAAC,IAAI,IAAI,UAAU,IAAI,GAAG,iBAAiB;AAAA,IAC1E,YAAY,IAAI,IAAI;AAAA,EACtB;AACF;AAEO,SAAS,gBAAgB,QAA2B;AACzD,QAAM,WAAW,mBAAmB,MAAM;AAC1C,SAAO,OAAO;AAAA,IACZ,SAAS,IAAI,CAAC,SAAS,CAAC,MAAM,EAAE,MAAM,SAAS,QAAQ,SAAS,QAAQ,SAAS,QAAQ,QAAQ,CAAC,CAAC;AAAA,EACrG;AACF;AAEO,SAAS,mBAAmB,QAA2B;AAC5D,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO,CAAC;AACnD,QAAM,WAAY,OAAkC;AACpD,MAAI,CAAC,YAAY,OAAO,aAAa,YAAY,MAAM,QAAQ,QAAQ,EAAG,QAAO,CAAC;AAClF,SAAO,OAAO,KAAK,QAAQ;AAC7B;AAEO,SAAS,SAAS,OAA+C;AACtE,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,MAAM,WAAW,GAAG,EAAG,QAAO,QAAQ,IAAI,MAAM,MAAM,CAAC,CAAC;AAC5D,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAc,MAAgD;AACvF,MAAI,CAAC,OAAO,OAAO,QAAQ,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,wBAAwB;AACpF,QAAM,MAAM;AACZ,MAAI,CAAC,IAAI,OAAO,OAAO,IAAI,QAAQ,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,sBAAsB;AAC1F,MAAI,CAAC,QAAQ,IAAI,IAAI,EAAE,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,0DAA0D;AAC3G,MAAI,CAAC,IAAI,IAAI,QAAQ,OAAO,IAAI,IAAI,SAAS,SAAU,OAAM,IAAI,MAAM,GAAG,IAAI,wBAAwB;AACtG,MAAI,IAAI,MAAM,KAAK,CAAC,QAAQ,CAAC,QAAQ,GAAG,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,6DAA6D;AAClI;AAEA,SAAS,QAAQ,OAAiC;AAChD,SAAO,OAAO,UAAU,YAAY,uBAAuB,KAAK,KAAK;AACvE;AAEA,eAAe,iBAAiB,MAA0C;AACxE,MAAI,KAAK,SAAS,OAAO,EAAG,QAAO,KAAK,UAAM,8BAAa,MAAM,MAAM,CAAC;AACxE,QAAM,MAAO,MAAM,OAAO,OAAG,+BAAc,IAAI,EAAE,IAAI,MAAM,KAAK,IAAI,CAAC;AAIrE,QAAM,QAAQ,IAAI,WAAW,IAAI;AACjC,MAAI,OAAO,UAAU,WAAY,QAAO,MAAM,MAAM;AACpD,SAAO;AACT;AAEA,SAAS,UAAU,OAAuB;AACxC,SAAO,MAAM,QAAQ,QAAQ,EAAE;AACjC;AAEA,SAAS,OAAO,QAA4B;AAC1C,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,OAAO,OAAO,CAAC,CAAC;AAC5C;;;AC/HA,IAAAC,6BAA6B;AAC7B,IAAAC,kBAAyC;AACzC,IAAAC,oBAA8B;;;ACG9B,IAAM,eAAwC;AAAA,EAC5C,CAAC,kCAAkC,oBAAoB;AAAA,EACvD,CAAC,kCAAkC,kBAAkB;AAAA,EACrD,CAAC,yBAAyB,eAAe;AAAA,EACzC,CAAC,4BAA4B,kBAAkB;AAAA,EAC/C,CAAC,wBAAwB,iBAAiB;AAAA,EAC1C,CAAC,yCAAyC,eAAe;AAAA,EACzD,CAAC,wBAAwB,gBAAgB;AAC3C;AAaO,SAAS,cAAc,OAAuB;AACnD,MAAI,SAAS;AACb,aAAW,CAAC,SAAS,WAAW,KAAK,aAAc,UAAS,OAAO,QAAQ,SAAS,WAAW;AAC/F,SAAO;AACT;AAGO,SAAS,YAAY,OAAwB;AAClD,SAAO,cAAc,KAAK,MAAM,SAAS,MAAM,SAAS,YAAY;AACtE;;;ACnCA,IAAAC,6BAAsB;AACtB,IAAAC,kBAAyC;AACzC,IAAAC,oBAAqB;AAWd,IAAM,gBAA+B,CAAC,KAAK,MAAM,SACtD,IAAI,QAAQ,CAAC,gBAAgB,WAAW;AACtC,QAAM,YAAQ,kCAAM,KAAK,MAAM,EAAE,KAAK,MAAM,KAAK,OAAO,CAAC,QAAQ,QAAQ,MAAM,EAAE,CAAC;AAClF,MAAI,SAAS;AACb,MAAI,SAAS;AACb,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,UAAU,MAAM,SAAS,CAAE;AACvE,QAAM,OAAO,GAAG,QAAQ,CAAC,UAAmB,UAAU,MAAM,SAAS,CAAE;AACvE,QAAM,GAAG,SAAS,MAAM;AACxB,QAAM,GAAG,SAAS,CAAC,SAAS,eAAe,EAAE,MAAM,QAAQ,GAAG,QAAQ,OAAO,CAAC,CAAC;AAC/E,QAAM,MAAM,IAAI,MAAM,SAAS,EAAE;AACnC,CAAC;AAEH,IAAM,wBAAwB,CAAC,kBAAkB,iBAAiB,eAAe;AAE1E,SAAS,mBAAmB,SAAgC;AACjE,aAAW,QAAQ,uBAAuB;AACxC,UAAM,WAAO,wBAAK,SAAS,IAAI;AAC/B,YAAI,4BAAW,IAAI,EAAG,QAAO;AAAA,EAC/B;AACA,SAAO;AACT;AAGO,SAAS,mBAAmB,MAA8C;AAC/E,MAAI,KAAK,SAAS,OAAO,EAAG,QAAO;AACnC,MAAI;AACF,WAAO,KAAK,MAAM,sBAAkB,8BAAa,MAAM,MAAM,CAAC,CAAC;AAAA,EACjE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,kBAAkB,MAAsB;AACtD,MAAI,SAAS;AACb,MAAI,WAAW;AACf,WAAS,IAAI,GAAG,IAAI,KAAK,QAAQ,KAAK;AACpC,UAAM,KAAK,KAAK,CAAC;AACjB,QAAI,UAAU;AACZ,gBAAU;AACV,UAAI,OAAO,MAAM;AACf,kBAAU,KAAK,IAAI,CAAC,KAAK;AACzB;AAAA,MACF,WAAW,OAAO,KAAK;AACrB,mBAAW;AAAA,MACb;AACA;AAAA,IACF;AACA,QAAI,OAAO,KAAK;AACd,iBAAW;AACX,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACrC,aAAO,IAAI,KAAK,UAAU,KAAK,CAAC,MAAM,KAAM;AAC5C,gBAAU;AACV;AAAA,IACF;AACA,QAAI,OAAO,OAAO,KAAK,IAAI,CAAC,MAAM,KAAK;AACrC,WAAK;AACL,aAAO,IAAI,KAAK,UAAU,EAAE,KAAK,CAAC,MAAM,OAAO,KAAK,IAAI,CAAC,MAAM,KAAM;AACrE;AACA;AAAA,IACF;AACA,cAAU;AAAA,EACZ;AACA,SAAO;AACT;AAEA,eAAsB,iBAAiB,KAAoB,KAA+B;AACxF,MAAI;AACF,UAAM,SAAS,MAAM,IAAI,OAAO,CAAC,YAAY,QAAQ,GAAG,EAAE,IAAI,CAAC;AAC/D,WAAO,OAAO,SAAS,KAAK,CAAC,qBAAqB,KAAK,GAAG,OAAO,MAAM,GAAG,OAAO,MAAM,EAAE;AAAA,EAC3F,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,kBACd,KACA,MACoB;AACpB,QAAM,OAAO,CAAC,YAAY,UAAU,OAAO,KAAK,MAAM,GAAI,KAAK,MAAM,CAAC,SAAS,KAAK,GAAG,IAAI,CAAC,CAAE;AAC9F,SAAO,IAAI,OAAO,MAAM,EAAE,OAAO,KAAK,OAAO,KAAK,KAAK,IAAI,CAAC;AAC9D;;;AFrFO,SAAS,UAAU,OAA6B,UAAoB,YAAgC;AACzG,QAAM,WAAqB,CAAC;AAC5B,MAAI,CAAC,MAAO,QAAO;AACnB,aAAW,CAAC,IAAI,OAAO,KAAK,OAAO,QAAQ,KAAK,GAAG;AACjD,eAAW,CAAC,QAAQ,IAAI,KAAK,OAAO,QAAQ,OAAO,GAAG;AACpD,UAAI,OAAO,SAAS,YAAY,KAAK,KAAK,MAAM,OAAQ;AACxD,UAAI,WAAW,UAAU,WAAW,SAAS,EAAE,EAAG;AAClD,eAAS;AAAA,QACP,WAAW,SACP,SAAS,EAAE,4CAAuC,EAAE,mCACpD,SAAS,EAAE,IAAI,MAAM,oCAA+B,MAAM,IAAI,EAAE;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACA,aAAW,UAAU,UAAU;AAC7B,QAAI,EAAE,UAAU,OAAQ,UAAS,KAAK,kBAAkB,MAAM,iDAAiD;AAAA,EACjH;AACA,SAAO;AACT;AAIA,IAAM,cAAwB,CAAC,KAAK,MAAM,YAAQ,yCAAa,KAAK,MAAM,EAAE,KAAK,UAAU,QAAQ,OAAO,CAAC,UAAU,QAAQ,QAAQ,EAAE,CAAC;AAGjI,SAAS,mBAAmB,SAAiB,OAAiB,aAAa,aAAuB,CAAC,GAAa;AACrH,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,WACZ,IAAI,CAAC,SAAS,eAAe,SAAS,IAAI,CAAC,EAC3C,OAAO,CAAC,SAAyB,CAAC,CAAC,IAAI;AAC1C,aAAS,KAAK,OAAO,CAAC,YAAY,MAAM,aAAa,SAAS,GAAG,MAAM,GAAG,OAAO;AAAA,EACnF,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,SAAO,OACJ,MAAM,OAAO,EACb,OAAO,OAAO,EACd,IAAI,CAAC,SAAS,GAAG,IAAI,kDAA6C,IAAI,wCAAwC;AACnH;AAGO,SAAS,iBAAiB,SAA2B;AAC1D,QAAM,aAAa,mBAAmB,OAAO;AAC7C,MAAI,CAAC,WAAY,QAAO,CAAC;AACzB,QAAM,SAAS,mBAAmB,UAAU;AAC5C,MAAI,CAAC,OAAQ,QAAO,CAAC;AAErB,QAAM,WAAqB,CAAC;AAC5B,QAAM,SAAmE,CAAC,EAAE,OAAO,IAAI,OAAO,OAAO,CAAC;AACtG,QAAM,OAAO,OAAO;AACpB,MAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,eAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,UAAI,SAAS,OAAO,UAAU,SAAU,QAAO,KAAK,EAAE,OAAO,OAAO,IAAI,KAAK,MAAwC,CAAC;AAAA,IACxH;AAAA,EACF;AAEA,aAAW,EAAE,OAAO,MAAM,KAAK,QAAQ;AACrC,UAAM,SAAS,MAAM;AACrB,QAAI,QAAQ,WAAW;AACrB,YAAM,UAAM,2BAAQ,SAAS,OAAO,SAAS;AAC7C,UAAI,YAAQ,2BAAQ,OAAO,GAAG;AAC5B,iBAAS,KAAK,GAAG,KAAK,uHAAkH;AAAA,MAC1I,eAAW,gCAAW,wBAAK,KAAK,cAAc,CAAC,GAAG;AAChD,iBAAS,KAAK,GAAG,KAAK,oGAA+F;AAAA,MACvH;AAAA,IACF;AACA,UAAM,OAAO,MAAM;AACnB,QAAI,QAAQ,OAAO,SAAS,UAAU;AACpC,iBAAW,CAAC,MAAM,KAAK,KAAK,OAAO,QAAQ,IAA+B,GAAG;AAC3E,YAAI,SAAS,kBAAkB,SAAS,qBAAsB,OAAO,UAAU,YAAY,YAAY,KAAK,GAAI;AAC9G,mBAAS,KAAK,YAAY,KAAK,QAAQ,IAAI,0FAAqF;AAAA,QAClI;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,MAAM,gBAAgB,OAAO;AACnC,MAAI,OAAO,OAAO,IAAI,YAAY,YAAY,IAAI,WAAW,YAAa,IAAI,SAAqC;AACjH,aAAS,KAAK,6FAAwF;AAAA,EACxG;AACA,SAAO;AACT;AAMO,SAAS,oBAAoB,SAA2B;AAC7D,QAAM,WAAqB,CAAC;AAC5B,QAAM,MAAM,gBAAgB,OAAO;AACnC,QAAM,eAAe,KAAK;AAC1B,QAAM,kBAAkB,KAAK;AAC7B,MAAI,CAAC,eAAe,eAAe,GAAG;AACpC,aAAS;AAAA,MACP,kBAAkB,eAAe,IAC7B,gGACA;AAAA,IACN;AAAA,EACF;AAEA,QAAM,aAAa,mBAAmB,OAAO;AAC7C,QAAM,SAAS,aAAa,mBAAmB,UAAU,IAAI;AAC7D,MAAI,CAAC,cAAc,CAAC,QAAQ;AAC1B,aAAS,KAAK,6FAAwF;AACtG,WAAO;AAAA,EACT;AAEA,QAAM,OAAO,OAAO,OAAO,SAAS,eAAW,2BAAQ,SAAS,OAAO,IAAI,IAAI;AAC/E,MAAI,CAAC,QAAQ,KAAC,4BAAW,IAAI,GAAG;AAC9B,aAAS,KAAK,yFAAoF;AAAA,EACpG,OAAO;AACL,QAAI,SAAS;AACb,QAAI;AACF,mBAAS,8BAAa,MAAM,MAAM;AAAA,IACpC,QAAQ;AAAA,IAER;AACA,QAAI,CAAC,wBAAwB,KAAK,MAAM,GAAG;AACzC,eAAS,KAAK,uBAAuB,OAAO,IAAc,uCAAuC;AAAA,IACnG;AAAA,EACF;AAEA,QAAM,QAAQ,MAAM,QAAQ,OAAO,mBAAmB,IAAI,OAAO,sBAAsB,CAAC;AACxF,MAAI,CAAC,MAAM,SAAS,eAAe,GAAG;AACpC,aAAS,KAAK,mFAAmF;AAAA,EACnG;AACA,SAAO;AACT;AAEA,SAAS,gBAAgB,SAAiD;AACxE,MAAI;AACF,WAAO,KAAK,UAAM,kCAAa,wBAAK,SAAS,cAAc,GAAG,MAAM,CAAC;AAAA,EACvE,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AGtHA,eAAsB,OAAO,SAAuC;AAClE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,OAAO,UAAU,GAAG;AAC1B,QAAM,QAAQ,IAAI,SAAS,SAAS,IAAI;AACxC,QAAM,SAAS,QAAQ,MAAM,kBAA2B,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,QAAQ,CAAC,IAAI;AACrG,QAAM,kBAAkB,QACpB,MAAM,kBAA4B,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,OAAO,CAAC,IACxE;AACJ,QAAM,QAAQ,oBAAoB,UAAU,IAAI,IAAI,iBAAiB,QAAQ,gBAAgB,MAAM,IAAI;AACvG,QAAM,WAAW,mBAAmB,MAAM;AAE1C,MAAI,IAAI,WAAW,IAAI,UAAU,EAAE;AACnC,MAAI,IAAI,WAAW,KAAK,OAAO,KAAK,KAAK,KAAK,GAAG;AACjD,MAAI,IAAI,WAAW,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE;AACzC,MAAI,IAAI,WAAW,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE;AAC7C,MAAI,IAAI,WAAW,SAAS,GAAG,SAAS,MAAM,cAAc,MAAM,EAAE;AACpE,MAAI,IAAI,WAAW,QAAQ,GAAG,OAAO,KAAK,KAAK,EAAE,MAAM,gBAAgB,MAAM,EAAE;AAC/E,MAAI,IAAI,WAAW,IAAI,SAAS,SAAS,IAAI,IAAK,IAAI,IAAI,YAAY,mBAAoB,aAAa,EAAE;AAEzG,QAAM,WAAqB,CAAC;AAC5B,MAAI,UAAU,SAAS,WAAW,EAAG,UAAS,KAAK,wBAAwB;AAC3E,MAAI,OAAO;AACT,eAAW,MAAM,OAAO,KAAK,KAAK,GAAG;AACnC,UAAI,SAAS,SAAS,KAAK,CAAC,SAAS,SAAS,EAAE,EAAG,UAAS,KAAK,kBAAkB,EAAE,qCAAqC;AAAA,IAC5H;AAAA,EACF;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,KAAK,CAAC,IAAI,IAAI,SAAU,UAAS,KAAK,kDAAkD;AACtH,MAAI,IAAI,MAAM,OAAO;AACnB,eAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,IAAI,KAAK,KAAK,GAAG;AACzD,UAAI,OAAO,UAAU,YAAY,MAAM,WAAW,GAAG,KAAK,CAAC,QAAQ,IAAI,MAAM,MAAM,CAAC,CAAC,GAAG;AACtF,iBAAS,KAAK,cAAc,GAAG,6BAA6B,KAAK,EAAE;AAAA,MACrE;AAAA,IACF;AAAA,EACF;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,KAAK,IAAI,IAAI,UAAU,CAAC,QAAQ,IAAI,IAAI,GAAG,MAAM,GAAG;AAChF,aAAS,KAAK,GAAG,IAAI,GAAG,MAAM,uDAAuD;AAAA,EACvF;AACA,MAAI,IAAI,SAAS,SAAS,MAAM,GAAG;AAEjC,UAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,eAAW,OAAO,IAAI,MAAM;AAC1B,UAAI,CAAC,aAAa,KAAK,GAAG,GAAG,WAAW;AACtC,iBAAS,KAAK,4BAA4B,GAAG,kEAA6D;AAAA,MAC5G;AAAA,IACF;AACA,aAAS,KAAK,GAAG,oBAAoB,IAAI,OAAO,CAAC;AAAA,EACnD;AACA,WAAS,KAAK,GAAG,UAAU,OAAO,UAAU,IAAI,IAAI,cAAc,CAAC,CAAC,CAAC;AACrE,WAAS,KAAK,GAAG,mBAAmB,IAAI,SAAS,QAAW;AAAA,IAC1D,IAAI,MAAM;AAAA,IACV,IAAI,MAAM;AAAA,IACV,IAAI,MAAM;AAAA,EACZ,CAAC,CAAC;AACF,WAAS,KAAK,GAAG,iBAAiB,IAAI,OAAO,CAAC;AAE9C,MAAI,SAAS,QAAQ;AACnB,QAAI,IAAI,EAAE;AACV,QAAI,IAAI,WAAW;AACnB,eAAW,WAAW,SAAU,KAAI,IAAI,OAAO,OAAO,EAAE;AAAA,EAC1D,OAAO;AACL,QAAI,IAAI,IAAI;AAAA,EACd;AACF;;;AC9FA,IAAAC,kBAAqD;AACrD,IAAAC,oBAAiC;AAwC1B,SAAS,YAAY,SAA4B;AACtD,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,cAAU,2BAAQ,QAAQ,WAAW,QAAQ,IAAI,CAAC;AACxD,QAAM,iBAAa,2BAAQ,SAAS,QAAQ,cAAc,iBAAiB;AAC3E,UAAI,4BAAW,UAAU,KAAK,CAAC,QAAQ,OAAO;AAC5C,UAAM,IAAI,MAAM,GAAG,UAAU,6CAA6C;AAAA,EAC5E;AACA,MAAI,CAAC,uBAAuB,KAAK,QAAQ,KAAK,GAAG;AAC/C,UAAM,IAAI,MAAM,0DAA0D;AAAA,EAC5E;AAGA,QAAM,OAAO,QAAQ,MAAM,SAAS,QAAQ,OAAO,CAAC,KAAK;AACzD,QAAM,WAAW,QAAQ,UAAU,SAAS,QAAQ,WAAW,CAAC,MAAM,IAAI;AAC1E,QAAM,aAAa,QAAQ,cAAc;AAEzC,qCAAU,2BAAQ,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAClD,qCAAU,2BAAQ,SAAS,UAAU,GAAG,EAAE,WAAW,KAAK,CAAC;AAC3D,qCAAU,2BAAQ,SAAS,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AAExD,qCAAc,YAAY,eAAe,EAAE,OAAO,QAAQ,OAAO,MAAM,QAAQ,MAAM,MAAM,UAAU,WAAW,CAAC,CAAC;AAClH,qBAAe,2BAAQ,SAAS,qBAAqB,GAAG,eAAe,CAAC;AACxE,qBAAe,2BAAQ,SAAS,oBAAoB,GAAG,cAAc,CAAC;AACtE,kBAAgB,OAAO;AAEvB,MAAI,IAAI,WAAW,gBAAgB,YAAY,OAAO,CAAC,EAAE;AACzD,MAAI,IAAI,oDAAoD;AAC5D,MAAI,IAAI,+CAA+C;AACzD;AAEA,SAAS,eAAe,MAAc,MAAoB;AACxD,UAAI,4BAAW,IAAI,EAAG;AACtB,qCAAc,MAAM,IAAI;AAC1B;AAEA,SAAS,eAAe,OAAwG;AAC9H,SAAO;AAAA;AAAA;AAAA;AAAA,WAIE,MAAM,KAAK;AAAA,aACT,MAAM,KAAK,QAAQ,MAAM,KAAK,CAAC;AAAA;AAAA,UAElC,KAAK,UAAU,MAAM,IAAI,CAAC;AAAA,cACtB,KAAK,UAAU,MAAM,QAAQ,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,iDAQK,MAAM,UAAU;AAAA;AAAA;AAAA,eAGlD,cAAc,MAAM,UAAU,CAAC;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,mBAW3B,MAAM,KAAK;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAc9B;AAEA,SAAS,iBAAyB;AAChC,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAeT;AAEA,SAAS,gBAAwB;AAC/B,SAAO;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAUT;AAEA,SAAS,cAAc,UAA0B;AAC/C,MAAI,aAAa,SAAU,QAAO;AAClC,MAAI,aAAa,SAAU,QAAO;AAClC,SAAO;AACT;AAEA,SAAS,gBAAgB,MAAc,SAAyB;AAC9D,SAAO,KAAK,WAAW,OAAO,IAAI,KAAK,MAAM,QAAQ,SAAS,CAAC,IAAI;AACrE;;;AClKA,IAAAC,eAA8C;AAC9C,gBAAgD;AAChD,IAAAC,uBAAoB;;;ACFpB,kBAA4B;AAoB5B,eAAsB,wBAAwB,MAAiE;AAC7G,QAAM,eAAW,yBAAY,KAAK,IAAI,IAAI,IAAI,KAAK,GAAG;AACtD,QAAM,QAAQ,KAAK,aAAa,KAAK,KAAK,GAAG;AAC7C,MAAI,cAAc,KAAK;AACvB,MAAI,QAAQ,KAAK,IAAI,SAAS,SAAS,IAAI,KAAK,CAAC,KAAK,WAAW,OAAO,QAAQ;AAChF,MAAI,YAAY,KAAK,IAAI,SAAS,SAAS,MAAM,KAAK,CAAC,KAAK,aAAa,OAAO,YAAY;AAE5F,MAAI,KAAK,IAAI,SAAS,SAAS,IAAI,GAAG;AACpC,QAAI,OAAO;AACT,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,8BAA8B,QAAQ,EAAE;AAAA,IACrE,OAAO;AACL,cAAQ,MAAM,UAAU,MAAM,QAAQ;AACtC,oBAAc,KAAK,MAAM,aAAa,UAAU,EAAE,MAAM,CAAC;AACzD,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,uBAAuB,QAAQ,EAAE;AAAA,IAC9D;AAAA,EACF;AAEA,MAAI,KAAK,IAAI,SAAS,SAAS,MAAM,GAAG;AACtC,QAAI,WAAW;AACb,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,mCAAmC;AAAA,IAChE,OAAO;AACL,kBAAY,MAAM,eAAe,IAAI;AACrC,oBAAc,KAAK,MAAM,aAAa,UAAU,EAAE,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC,GAAI,UAAU,CAAC;AAC1F,WAAK,OAAO,IAAI,GAAG,KAAK,GAAG,KAAK,KAAK,aAAa,YAAY,QAAQ,oBAAoB;AAAA,IAC5F;AAAA,EACF;AAEA,SAAO,KAAK,MAAM,aAAa,UAAU;AAAA,IACvC,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;AAAA,IACzB,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;AAAA,EACnC,CAAC;AACH;AAEA,SAAS,KACP,MACA,SACA,UACA,QACkB;AAClB,QAAM,OAAO,gBAAgB,SAAS;AAAA,IACpC,OAAO,KAAK,IAAI,IAAI;AAAA,IACpB,aAAa,KAAK,IAAI;AAAA,IACtB,YAAY,KAAK,IAAI;AAAA,IACrB,KAAK,KAAK;AAAA,IACV;AAAA,IACA,GAAG;AAAA,EACL,CAAC;AACD,MAAI,KAAK,MAAO,kBAAiB,KAAK,IAAI,MAAM,iBAAiB,IAAI;AACrE,SAAO;AACT;AAEA,eAAe,UAAU,MAAsC,UAAmC;AAChG,QAAM,UAAU,EAAE,eAAe,UAAU,KAAK,cAAc,IAAI,gBAAgB,mBAAmB;AACrG,MAAI,MAAM,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe,mBAAmB,QAAQ,CAAC,SAAS;AAAA,IACnG,QAAQ;AAAA,IACR;AAAA,IACA,MAAM;AAAA,EACR,CAAC;AACD,MAAI,IAAI,WAAW,KAAK;AACtB,UAAM,UAAU,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe;AAAA,MACpE,QAAQ;AAAA,MACR;AAAA,MACA,MAAM,KAAK,UAAU;AAAA,QACnB,MAAM,KAAK,QAAQ,SAAS,KAAK,IAAI,IAAI,OAAO,GAAG,KAAK,IAAI,IAAI,IAAI,KAAK,KAAK,GAAG;AAAA,QACjF,OAAO;AAAA,MACT,CAAC;AAAA,IACH,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,OAAM,IAAI,MAAM,kBAAkB,QAAQ,aAAa,QAAQ,MAAM,IAAI,MAAM,SAAS,OAAO,CAAC,EAAE;AACnH,UAAM,MAAM,KAAK,MAAM,GAAG,KAAK,IAAI,UAAU,eAAe,mBAAmB,QAAQ,CAAC,SAAS;AAAA,MAC/F,QAAQ;AAAA,MACR;AAAA,MACA,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,gBAAgB,QAAQ,aAAa,IAAI,MAAM,IAAI,MAAM,SAAS,GAAG,CAAC,EAAE;AACrG,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,IAAK,OAAM,IAAI,MAAM,gBAAgB,QAAQ,mBAAmB;AAC1E,SAAO,KAAK;AACd;AAEA,eAAe,eAAe,MAAuD;AACnF,QAAM,SAAS,KAAK,aAAa,YAAY;AAC7C,QAAM,MAAM,MAAM,KAAK;AAAA,IACrB,GAAG,KAAK,IAAI,WAAW,SAAS,mBAAmB,KAAK,IAAI,IAAI,EAAE,CAAC,SAAS,MAAM,QAAQ,mBAAmB,KAAK,GAAG,CAAC;AAAA,IACtH,EAAE,QAAQ,QAAQ,SAAS,EAAE,eAAe,UAAU,KAAK,cAAc,GAAG,EAAE;AAAA,EAChF;AACA,MAAI,IAAI,WAAW,OAAO,CAAC,KAAK,YAAY;AAC1C,UAAM,IAAI;AAAA,MACR,sCAAsC,KAAK,GAAG;AAAA,IAEhD;AAAA,EACF;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,cAAc,KAAK,aAAa,aAAa,OAAO,KAAK,KAAK,GAAG,aAAa,IAAI,MAAM,IAAI,MAAM,SAAS,GAAG,CAAC,EAAE;AAC9I,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,MAAI,CAAC,KAAK,MAAO,OAAM,IAAI,MAAM,cAAc,KAAK,aAAa,aAAa,OAAO,KAAK,KAAK,GAAG,qBAAqB;AACvH,SAAO,KAAK;AACd;AAEA,eAAe,SAAS,KAAgC;AACtD,MAAI;AACF,WAAO,eAAe,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;ACrGA,IAAM,iBAAiB,oBAAI,IAAI,CAAC,QAAQ,YAAY,CAAC;AAOrD,eAAsB,YAAY,SAA4C;AAC5E,QAAM,gBAAgB,SAAS,IAAI;AACrC;AAGA,eAAsB,0BAA0B,SAA4C;AAC1F,QAAM,gBAAgB,SAAS,KAAK;AACtC;AAEA,eAAe,gBAAgB,SAA6B,WAAmC;AAC7F,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ;AAEpB,MAAI,CAAC,IAAI,KAAK,SAAS,GAAG,GAAG;AAC3B,UAAM,IAAI,MAAM,QAAQ,GAAG,4BAA4B,IAAI,KAAK,KAAK,IAAI,CAAC,GAAG;AAAA,EAC/E;AACA,MAAI,eAAe,IAAI,GAAG,KAAK,CAAC,QAAQ,KAAK;AAC3C,UAAM,IAAI,MAAM,iCAAiC,GAAG,iBAAiB;AAAA,EACvE;AAEA,QAAM,kBAAkB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO;AAC1E,QAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,MAAI,CAAC,YAAa,OAAM,IAAI,MAAM,qBAAqB,eAAe,uCAAkC;AACxG,MAAI,YAAY,UAAU,IAAI,IAAI,IAAI;AACpC,UAAM,IAAI,MAAM,kBAAkB,eAAe,aAAa,YAAY,KAAK,WAAW,IAAI,IAAI,EAAE,GAAG;AAAA,EACzG;AACA,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,2BAA2B,GAAG,QAAQ,eAAe,uCAAkC;AAEnH,QAAM,UAAkD,CAAC;AACzD,MAAI,IAAI,SAAS,SAAS,MAAM,GAAG;AACjC,QAAI,CAAC,MAAM,UAAW,OAAM,IAAI,MAAM,0BAA0B,GAAG,QAAQ,eAAe,uCAAkC;AAC5H,YAAQ,KAAK,EAAE,MAAM,mBAAmB,OAAO,MAAM,UAAU,CAAC;AAAA,EAClE;AACA,MAAI,IAAI,SAAS,SAAS,IAAI,GAAG;AAC/B,QAAI,CAAC,MAAM,MAAO,OAAM,IAAI,MAAM,sBAAsB,GAAG,QAAQ,eAAe,uCAAkC;AACpH,YAAQ,KAAK,EAAE,MAAM,gBAAgB,OAAO,MAAM,MAAM,CAAC;AAAA,EAC3D;AACA,MAAI,QAAQ,WAAW,GAAG;AACxB,QAAI,IAAI,GAAG,GAAG,wCAAwC;AACtD;AAAA,EACF;AAIA,QAAM,cAAc,eAAe,IAAI,GAAG,IAAI,SAAY;AAC1D,QAAM,SAAS,cAAc,iBAAiB,WAAW,MAAM;AAE/D,MAAI,QAAQ,QAAQ;AAClB,yBAAqB,GAAG;AACxB,eAAW,KAAK,QAAS,KAAI,IAAI,uBAAuB,EAAE,IAAI,KAAK,cAAc,EAAE,KAAK,CAAC,QAAQ,MAAM,EAAE;AACzG;AAAA,EACF;AAEA,QAAM,MAAM,QAAQ,UAAU;AAC9B,MAAI,UAAW,OAAM,sBAAsB,KAAK,GAAG;AAEnD,aAAW,KAAK,SAAS;AACvB,UAAM,SAAS,MAAM,kBAAkB,KAAK,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,OAAO,KAAK,aAAa,KAAK,IAAI,QAAQ,CAAC;AAChH,QAAI,OAAO,SAAS,GAAG;AACrB,YAAM,IAAI,MAAM,uBAAuB,EAAE,IAAI,iBAAiB,OAAO,IAAI,MAAM,cAAc,GAAG,OAAO,UAAU,OAAO,MAAM,GAAG,KAAK,CAAC,CAAC,EAAE;AAAA,IAC5I;AACA,QAAI,IAAI,GAAG,EAAE,IAAI,cAAc,MAAM,qBAAqB,eAAe,iBAAiB;AAAA,EAC5F;AACF;AAGA,eAAsB,qBAAqB,SAAiD;AAC1F,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,MAAI,CAAC,IAAI,SAAS,KAAK,CAAC,YAAY,YAAY,QAAQ,YAAY,MAAM,EAAG;AAC7E,QAAM,sBAAsB,KAAK,QAAQ,UAAU,aAAa;AAClE;AAEA,eAAe,sBAAsB,KAA0B,KAAmC;AAChG,uBAAqB,GAAG;AACxB,MAAI,CAAE,MAAM,iBAAiB,KAAK,IAAI,OAAO,GAAI;AAC/C,UAAM,IAAI,MAAM,sFAAiF;AAAA,EACnG;AACF;AAEA,SAAS,qBAAqB,KAAgC;AAC5D,MAAI,CAAC,mBAAmB,IAAI,OAAO,GAAG;AACpC,UAAM,IAAI,MAAM,+BAA+B,IAAI,OAAO,oDAAoD;AAAA,EAChH;AACF;;;AFxEA,eAAsB,UAAU,SAA0C;AACxE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,OAAO,UAAU,GAAG;AAC1B,QAAM,QAAQ,IAAI,SAAS,SAAS,IAAI;AACxC,QAAM,UAAU,IAAI,SAAS,SAAS,MAAM;AAE5C,MAAI,QAAQ,mBAAmB,CAAC,SAAS;AACvC,UAAM,IAAI,MAAM,kEAAkE;AAAA,EACpF;AACA,MAAI,QAAQ,eAAe,QAAQ,qBAAqB,OAAO;AAC7D,UAAM,IAAI,MAAM,+DAA+D;AAAA,EACjF;AAEA,MAAI,IAAI,YAAY,KAAK,OAAO,KAAK,KAAK,KAAK,GAAG;AAClD,MAAI,IAAI,eAAe,KAAK,WAAW,EAAE;AACzC,MAAI,IAAI,eAAe,KAAK,UAAU,EAAE;AACxC,MAAI,IAAI,eAAe,KAAK,KAAK,KAAK,IAAI,CAAC,EAAE;AAC7C,MAAI,IAAI,eAAe,KAAK,SAAS,KAAK,IAAI,CAAC,EAAE;AAEjD,QAAM,iBAAiB,KAAK,KAAK,OAAO,CAAC,QAAQ,QAAQ,UAAU,QAAQ,YAAY;AACvF,MAAI,CAAC,QAAQ,UAAU,eAAe,SAAS,KAAK,CAAC,QAAQ,KAAK;AAChE,UAAM,IAAI;AAAA,MACR,wCAAwC,eAAe,KAAK,IAAI,CAAC;AAAA,IACnE;AAAA,EACF;AAEA,QAAM,SAAS,QAAQ,MAAM,kBAA2B,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,QAAQ,CAAC,IAAI;AACrG,QAAM,kBAAkB,QAAQ,MAAM,kBAA4B,KAAK,IAAI,IAAI,OAAO,CAAC,SAAS,OAAO,CAAC,IAAI;AAC5G,QAAM,QAAQ,oBAAoB,UAAU,IAAI,IAAI,iBAAiB,QAAQ,gBAAgB,MAAM,IAAI;AAEvG,MAAI,QAAQ,QAAQ;AAClB,QAAI,IAAI,0CAA0C;AAClD,QAAI,IAAI,aAAa,SAAS,QAAQ,IAAI,EAAE;AAC5C,QAAI,IAAI,aAAa,QAAQ,OAAO,KAAK,KAAK,EAAE,SAAS,CAAC,aAAa;AACvE,QAAI,IAAI,aAAa,IAAI,SAAS,SAAS,IAAI,IAAK,IAAI,IAAI,YAAY,mBAAoB,aAAa,EAAE;AAC3G,QAAI,IAAI,cAAc,QAAQ,cAAc,mCAAmC,YAAY,EAAE;AAC7F;AAAA,EACF;AAEA,MAAI,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC3D,MAAI,eAAe,YAAY,UAAU,IAAI,IAAI,IAAI;AACnD,UAAM,IAAI;AAAA,MACR,kBAAkB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,aAAa,YAAY,KAAK,WAAW,IAAI,IAAI,EAAE;AAAA,IAC1H;AAAA,EACF;AACA,QAAM,cAAc,CAAC,EAAE,QAAQ,cAAc,QAAQ;AACrD,QAAM,cAAc,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,GAAG,GAAG,SAAS;AAC7E,QAAM,YAAY,IAAI,KAAK,KAAK,CAAC,QAAQ,CAAC,aAAa,KAAK,GAAG,GAAG,KAAK;AACvE,QAAM,2BAA4B,UAAU,CAAC,CAAC,QAAQ,cAAc,cAAgB,YAAY,eAAe;AAC/G,MAAI,QAAQ,qBAAqB,SAAS,0BAA0B;AAClE,UAAM,IAAI,MAAM,mGAAmG;AAAA,EACrH;AACA,QAAM,gBAAgB,0BAA0B,KAAK,QAAQ,YAAY;AACzE,MAAI,IAAI,MAAM,WAAW;AACvB,oBAAgB,IAAI,SAAS,CAAC,IAAI,MAAM,WAAW,IAAI,MAAM,iBAAiB,GAAI,gBAAgB,CAAC,aAAa,IAAI,CAAC,CAAE,CAAC;AAAA,EAC1H;AACA,MAAI,QAAQ,aAAa;AACvB,UAAM,qBAAqB,EAAE,YAAY,IAAI,YAAY,QAAQ,QAAQ,aAAa,CAAC;AACvF,QAAI,IAAI,qDAAqD;AAAA,EAC/D;AAEA,QAAM,UAAU,QAAQ,SAAS;AACjC,QAAM,QAAQ,MAAM,kBAAkB,KAAK,SAAS,SAAS,GAAG;AAChE,QAAM,WAAO,+BAAiB,EAAE,UAAU,IAAI,aAAa,OAAO,SAAS,EAAE,OAAO,QAAQ,EAAE,CAAC;AAE/F,QAAM,WAAW,MAAM,gBAAgB,KAAK,OAAO,OAAO;AAC1D,MAAI,UAAU;AACZ,QAAI,IAAI,QAAQ,IAAI,IAAI,EAAE,iBAAiB;AAAA,EAC7C,OAAO;AACL,UAAM,KAAK,UAAU,EAAE,MAAM,IAAI,IAAI,MAAM,OAAO,IAAI,IAAI,GAAG,CAAC;AAC9D,QAAI,IAAI,gBAAgB,IAAI,IAAI,EAAE,EAAE;AAAA,EACtC;AAEA,aAAW,OAAO,IAAI,MAAM;AAC1B,eAAW,WAAW,IAAI,UAAU;AAClC,UAAI,YAAY,MAAM;AACpB,YAAI,IAAI,IAAI,UAAU;AACpB,gBAAM,KAAK,MAAM,IAAI,IAAI,IAAI,KAAK,EAAE,UAAU,IAAI,GAAG,UAAU,GAAI,IAAI,GAAG,QAAQ,EAAE,OAAO,IAAI,GAAG,MAAM,IAAI,CAAC,EAAG,CAAC;AACjH,cAAI,IAAI,GAAG,GAAG,oBAAoB,IAAI,GAAG,QAAQ,GAAG,IAAI,GAAG,QAAQ,IAAI,IAAI,GAAG,KAAK,KAAK,EAAE,GAAG;AAAA,QAC/F,OAAO;AACL,gBAAM,KAAK,WAAW,IAAI,IAAI,IAAI,MAAM,MAAM,EAAE,IAAI,CAAC;AACrD,cAAI,IAAI,GAAG,GAAG,cAAc;AAAA,QAC9B;AAAA,MACF,OAAO;AACL,cAAM,KAAK,WAAW,IAAI,IAAI,IAAI,SAAS,MAAM,EAAE,IAAI,CAAC;AACxD,YAAI,IAAI,GAAG,GAAG,KAAK,OAAO,UAAU;AAAA,MACtC;AAAA,IACF;AAEA,UAAM,aAAa,qBAAqB,IAAI,MAAM,QAAQ,GAAG,CAAC;AAC9D,QAAI,YAAY,gBAAgB;AAC9B,YAAM,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,UAAU;AAC9C,UAAI,IAAI,GAAG,GAAG,4BAA4B,WAAW,QAAQ,QAAQ,GAAG;AAAA,IAC1E;AAEA,UAAM,OAAO,IAAI,QAAQ,GAAG;AAC5B,QAAI,SAAS,QAAW;AACtB,YAAM,KAAK,QAAQ,IAAI,IAAI,IAAI,KAAK,QAAQ,IAAI;AAChD,UAAI,IAAI,GAAG,GAAG,UAAU,OAAO,QAAQ,SAAS,EAAE;AAAA,IACpD;AAAA,EACF;AAEA,aAAW,OAAO,IAAI,MAAM;AAC1B,UAAM,eAAW,0BAAY,IAAI,IAAI,IAAI,GAAG;AAC5C,kBAAc,MAAM,wBAAwB;AAAA,MAC1C;AAAA,MACA;AAAA,MACA,gBAAgB;AAAA,MAChB;AAAA,MACA,UAAU,CAAC,CAAC,QAAQ;AAAA,MACpB,YAAY;AAAA,MACZ,OAAO,QAAQ,qBAAqB;AAAA,MACpC,OAAO;AAAA,MACP,QAAQ;AAAA,IACV,CAAC;AACD,UAAM,QAAQ,YAAY,KAAK,GAAG,GAAG;AAErC,QAAI,QAAQ,aAAa;AACvB,UAAI;AACF,cAAM,0BAA0B;AAAA,UAC9B,YAAY,IAAI;AAAA,UAChB;AAAA,UACA,KAAK,QAAQ;AAAA,UACb,QAAQ,QAAQ;AAAA,UAChB,QAAQ;AAAA,QACV,CAAC;AAAA,MACH,SAAS,OAAO;AACd,cAAM,UAAU,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AACrE,cAAM,UAAU,QAAQ,UAAU,QAAQ,eAAe,WAAW;AACpE,cAAM,IAAI;AAAA,UACR,GAAG,OAAO;AAAA,EAAK,GAAG,sEACa,GAAG,GAAG,OAAO;AAAA,UAC5C,EAAE,OAAO,MAAM;AAAA,QACjB;AAAA,MACF;AAAA,IACF;AAEA,QAAI,UAAU,OAAO;AACnB,YAAM,SAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,QAAQ,CAAC,WAAW,OAAO,EAAE,OAAO,CAAC;AACzG,UAAI,IAAI,GAAG,GAAG,iBAAiB;AAAA,IACjC;AACA,QAAI,OAAO;AACT,YAAM,SAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,QAAQ,CAAC,gBAAgB,OAAO,KAAK;AACzG,UAAI,IAAI,GAAG,GAAG,mBAAmB,OAAO,KAAK,KAAK,EAAE,MAAM,cAAc;AAAA,IAC1E;AAEA,QAAI,IAAI,SAAS,SAAS,IAAI,KAAK,IAAI,IAAI,YAAY,IAAI,GAAG,QAAQ;AACpE,YAAM,MAAM,qBAAAC,QAAQ,IAAI,IAAI,GAAG,MAAM;AACrC,UAAI,KAAK;AACP,cAAM,aAAa,IAAI,GAAG,cAAc,kBAAkB,IAAI,GAAG,QAAQ;AACzE,kBAAM,qBAAU,EAAE,UAAU,IAAI,YAAY,OAAO,OAAO,QAAQ,GAAG,UAAU,YAAY,GAAG;AAC9F,YAAI,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,QAAQ,yBAAyB,UAAU,GAAG;AAAA,MAC1E,OAAO;AACL,YAAI,IAAI,GAAG,GAAG,KAAK,IAAI,GAAG,MAAM,wCAAwC;AAAA,MAC1E;AAAA,IACF;AAAA,EAEF;AAEA,MAAI,QAAQ,qBAAqB,SAAS,aAAa;AACrD,UAAM,UAAU,IAAI,MAAM,aAAa,eAAe,IAAI,SAAS,IAAI,MAAM,eAAe;AAC5F,QAAI,IAAI,sBAAsB,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,SAAS,UAAU,iBAAiB,EAAE,GAAG;AAAA,EAC5H;AAEA,MAAI,iBAAiB,aAAa;AAChC,UAAM,MAAM,IAAI,KAAK,SAAS,KAAK,IAAI,QAAS,IAAI,KAAK,CAAC,KAAK;AAC/D,iBAAa,eAAe,aAAa,KAAK,YAAY,GAAG,CAAC;AAC9D,QAAI,IAAI,mBAAmB,YAAY,eAAe,IAAI,OAAO,CAAC,QAAQ,GAAG,EAAE;AAAA,EACjF;AACF;AAEA,eAAe,gBAAgB,KAA0B,OAAe,SAA6C;AACnH,QAAM,MAAM,MAAM,QAAQ,GAAG,IAAI,WAAW,kBAAkB,mBAAmB,IAAI,IAAI,EAAE,CAAC,IAAI;AAAA,IAC9F,SAAS,EAAE,eAAe,UAAU,KAAK,GAAG;AAAA,EAC9C,CAAC;AACD,MAAI,IAAI,WAAW,IAAK,QAAO;AAC/B,MAAI,CAAC,IAAI,GAAI,QAAO;AACpB,QAAM,OAAQ,MAAM,IAAI,KAAK;AAC7B,SAAO,KAAK,OAAO;AACrB;AAEA,eAAe,SAAS,SAAoB,KAAa,QAAgB,MAA8B;AACrG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,YAAY,IAAI,MAAM,IAAI,MAAMC,UAAS,GAAG,CAAC,EAAE;AACtG;AAEA,SAAS,qBAAqB,OAAgG;AAC5H,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI,OAAO,UAAU,UAAU;AAC7B,UAAMC,kBAAiB,SAAS,KAAK;AACrC,WAAOA,kBAAiB,EAAE,gBAAAA,gBAAe,IAAI;AAAA,EAC/C;AACA,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,MAAM;AACZ,QAAM,iBAAiB,SAAS,IAAI,cAAc;AAClD,SAAO,iBAAiB,EAAE,gBAAgB,GAAI,IAAI,WAAW,EAAE,UAAU,IAAI,SAAS,IAAI,CAAC,GAAI,GAAI,IAAI,OAAO,EAAE,MAAM,IAAI,KAAK,IAAI,CAAC,EAAG,IAAI;AAC7I;AAEA,SAAS,kBAAkB,UAA0B;AACnD,QAAM,QAAQ;AACd,SAAO,MAAM,QAAQ,KAAK,GAAG,QAAQ;AACvC;AAEA,eAAeD,UAAS,KAAgC;AACtD,MAAI;AACF,WAAO,eAAe,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG,CAAC;AAAA,EACvD,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AGjQA,IAAAE,oBAAmD;AACnD,sBAWO;AACP,kBAAwE;AA4DxE,eAAsB,kBAAkB,SAAkE;AACxG,MAAI,QAAQ,wBAAwB,YAAY;AAC9C,UAAM,IAAI,MAAM,uGAAuG;AAAA,EACzH;AAEA,QAAM,YAAY,QAAQ,cAAc;AACxC,QAAM,MAAM,YAAY,SAAY,MAAM,kBAAkB,QAAQ,cAAc,iBAAiB;AACnG,QAAM,QAAQ,YAAY,YAAY,IAAK,IAAI;AAC/C,QAAM,MAAM,YAAY,SAAS,UAAU,QAAQ,KAAK,IAAK,MAAM,IAAK,YAAY,IAAK,OAAO;AAChG,QAAM,WAAW,QAAQ,YAAY,KAAK,eAAe;AACzD,QAAM,aAAS,2BAAQ,QAAQ,UAAU,KAAK,WAAW,GAAG;AAC5D,QAAM,aAAS,2BAAQ,QAAQ,WAAO,2BAAQ,QAAQ,uBAAuB,CAAC;AAC9E,QAAM,qBAAiB,4BAAS,QAAQ,MAAM,EAAE,MAAM,qBAAG,EAAE,KAAK,GAAG;AACnE,MAAI,CAAC,eAAgB,OAAM,IAAI,MAAM,sDAAsD;AAG3F,QAAM,UAAU,WAAW,QAAQ,WAAW,QAAQ,QAAQ,gBAAgB,EAAE;AAEhF,QAAM,eAA2C;AAAA,IAC/C;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,OAAO,YAAY,2BAA2B;AAAA,EAChD;AACA,QAAM,QAAQ,MAAM,cAAc,SAAS,YAAY;AACvD,QAAM,WAAW,UAAM,+BAAkB,QAAQ;AAAA,IAC/C,SAAS,CAAC,eAAe,WAAW,KAAK,KAAK,KAAC,8BAAW,cAAc,IAAI,CAAC,cAAc,IAAI,CAAC;AAAA,EAClG,CAAC;AACD,QAAM,SAAS,UAAM,iDAAgC;AAAA,IACnD;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,SAAS;AAAA,IACrB,UAAU,SAAS;AAAA,IACnB,gBAAgB,SAAS;AAAA,IACzB,kBAAkB;AAAA,IAClB,aAAa,QAAQ,SAAS,OAAO,WAAW;AAAA,IAChD,GAAI,YAAY,EAAE,WAAW,EAAE,SAAS,MAAe,SAAS,mCAAmC,EAAE,IAAI,CAAC;AAAA,IAC1G,OAAO,QAAQ;AAAA,IACf,QAAQ,QAAQ;AAAA,EAClB,CAAC;AACD,QAAM,cAAU,uCAAsB;AAAA,IACpC;AAAA,IACA,OAAO,IAAI,6BAAa,2BAAQ,QAAQ,OAAO,CAAC;AAAA,IAChD,mBAAmB,OAAO;AAAA,IAC1B,oBAAoB,OAAO;AAAA,IAC3B,QAAQ;AAAA,MACN,uBAAuB;AAAA,MACvB,QAAQ;AAAA,MACR,cAAc;AAAA,IAChB;AAAA,EACF,CAAC;AACD,QAAM,SAAS,MAAM,QAAQ,IAAI,UAAU,EAAE,OAAO,OAAO,IAAI,OAAO,QAAQ,QAAQ,OAAO,CAAC;AAC9F,YAAM,oCAAuB,QAAQ,MAAM;AAC3C,QAAM,eAAe,UAAM,qCAAoB,MAAM;AACrD,QAAM,OAAO,SAAS;AAAA,IACpB;AAAA,IACA,gBAAgB,OAAO;AAAA,IACvB,WAAW,OAAO,QAAQ;AAAA,IAC1B,YAAY,OAAO,QAAQ;AAAA,EAC7B,GAAG,EAAE,QAAQ,QAAQ,OAAO,CAAC;AAC7B,eAAa,QAAQ,UAAU,SAAS,OAAO,KAAK,OAAO,KAAK,QAAQ,MAAM;AAC9E,SAAO,OAAO,OAAO,EAAE,QAAQ,KAAK,OAAO,KAAK,OAAO,CAAC;AAC1D;AAEA,SAAS,UAAU,WAA+B,UAAoB,YAAoB,SAAyB;AACjH,QAAM,MAAM,cAAc,SAAS,SAAS,KAAK,IAAI,QAAQ,SAAS,CAAC;AACvE,MAAI,CAAC,OAAO,CAAC,SAAS,SAAS,GAAG,GAAG;AACnC,UAAM,YAAQ,4BAAS,SAAS,UAAU,KAAK;AAC/C,UAAM,IAAI,MAAM,QAAQ,OAAO,EAAE,wBAAwB,KAAK,EAAE;AAAA,EAClE;AACA,SAAO;AACT;AAEA,eAAe,cAAc,SAAmC,SAAsD;AACpH,QAAM,QAAQ,QAAQ,SAAS,MAAM,QAAQ,WAAW,OAAO,OAAO,EAAE,GAAG,QAAQ,CAAC,CAAC;AACrF,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,KAAK,MAAM,SAAS,QAAS,2BAA2B,KAAK,KAAK,GAAG;AACnH,UAAM,IAAI;AAAA,MACR,QAAQ,YACJ,oEACA;AAAA,IACN;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,MAA6B,cAAmD;AAClG,QAAM,UAAU,SAAS,aACrB,6BAAY,IACZ,SAAS,uBACP,sCAAqB,IACrB,SAAS,gBACP,gCAAe,IACf;AACR,MAAI,CAAC,QAAS,OAAM,IAAI,MAAM,6BAA6B,OAAO,IAAI,CAAC,GAAG;AAC1E,MAAI,iBAAiB,OAAW,QAAO;AACvC,MAAI,CAAC,OAAO,cAAc,YAAY,KAAK,eAAe,EAAG,OAAM,IAAI,MAAM,yCAAyC;AACtH,SAAO,EAAE,GAAG,SAAS,aAAa;AACpC;AAEA,SAAS,aACP,KACA,OACA,KACA,KACA,QACA,QACM;AACN,QAAM,WAAW,OAAO,SAAS,OAAO,CAAC,SAAS,KAAK,UAAU,UAAU,EAAE;AAC7E,MAAI,IAAI,aAAa,KAAK,IAAI,GAAG,QAAQ,IAAI,KAAK,YAAY,IAAI,cAAc,EAAE;AAClF,MAAI,IAAI,gBAAgB,IAAI,UAAU,SAAS,QAAQ,IAAI,IAAI,UAAU,SAAS,KAAK,EAAE;AACzF,MAAI,IAAI,iBAAiB,IAAI,WAAW,SAAS,QAAQ,IAAI,IAAI,WAAW,SAAS,KAAK,EAAE;AAC5F,MAAI,IAAI,eAAe,OAAO,cAAc,IAAI,QAAQ,IAAI,OAAO,SAAS,MAAM,YAAY,OAAO,QAAQ,YAAY,YAAY,OAAO,QAAQ,YAAY,gBAAgB,OAAO,QAAQ,gBAAgB,qBAAqB,OAAO,QAAQ,oBAAoB,EAAE;AACzQ,MAAI,OAAO,WAAY,KAAI,IAAI,sBAAsB,aAAa,OAAO,WAAW,SAAS,CAAC,eAAe,aAAa,OAAO,WAAW,UAAU,CAAC,EAAE;AACzJ,MAAI,IAAI,yBAAyB,OAAO,QAAQ,SAAS,uBAAuB,OAAO,QAAQ,iBAAiB,eAAe,OAAO,QAAQ,UAAU,EAAE;AAC1J,MAAI,IAAI,iBAAa,2BAAQ,QAAQ,WAAW,CAAC,EAAE;AACrD;AAEA,SAAS,aAAa,OAAwD;AAC5E,SAAO,QAAQ,GAAG,MAAM,SAAS,IAAI,MAAM,QAAQ,YAAY,MAAM,YAAY,KAAK;AACxF;;;ACnMA,IAAAC,kBAA6B;AAEtB,SAAS,aAAqB;AACnC,QAAM,MAAM,KAAK,UAAM,8BAAa,IAAI,IAAI,mBAAmB,aAAe,GAAG,MAAM,CAAC;AACxF,SAAO,IAAI,WAAW;AACxB;AAEO,SAAS,YAAkB;AAChC,UAAQ,IAAI;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CA8Cb;AACD;;;ACvDA,IAAAC,kBAA2F;AAC3F,qBAAwB;AACxB,IAAAC,oBAAkE;AAClE,IAAAC,mBAA8B;;;ACFvB,IAAM,uBAAuB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAe7B,IAAM,cAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAMzB,oBAAoB;AAAA;AAIf,SAAS,cAAc,OAAe,WAA2B;AACtE,QAAM,QAAQ,UAAU,MAAM,6BAA6B;AAC3D,MAAI,CAAC,MAAO,OAAM,IAAI,MAAM,iBAAiB,KAAK,0BAA0B;AAC5E,QAAM,QAAQ,MAAM,CAAC,EAAG,MAAM,OAAO;AACrC,QAAM,cAAwB,CAAC;AAC/B,MAAI,eAAe;AACnB,aAAW,QAAQ,OAAO;AACxB,QAAI,KAAK,WAAW,OAAO,KAAK,KAAK,WAAW,cAAc,GAAG;AAC/D,kBAAY,KAAK,IAAI;AACrB,qBAAe,KAAK,WAAW,cAAc;AAAA,IAC/C,WAAW,gBAAgB,OAAO,KAAK,IAAI,GAAG;AAC5C,kBAAY,KAAK,IAAI;AAAA,IACvB,OAAO;AACL,qBAAe;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AAAA,EACP,YAAY,KAAK,IAAI,CAAC;AAAA;AAAA;AAAA,IAGpB,KAAK;AAAA;AAAA,iCAEwB,KAAK;AAAA;AAAA;AAAA;AAItC;;;AD7CO,IAAM,kBAAkB,CAAC,UAAU,SAAS,UAAU,WAAW,UAAU,QAAQ;AAmEnF,SAAS,aAAa,UAA+B,CAAC,GAAuB;AAClF,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,YAAY,QAAQ,iBAAa,gCAAc,IAAI,IAAI,aAAa,aAAe,CAAC;AAC1F,QAAM,QAAQ,UAAU,SAAS;AACjC,MAAI,MAAM,WAAW,EAAG,OAAM,IAAI,MAAM,8BAA8B,SAAS,EAAE;AAEjF,QAAM,YAAY,mBAAmB,QAAQ,WAAW,QAAQ,WAAW,IAAI;AAC/E,QAAM,WAAO,2BAAQ,QAAQ,OAAO,QAAQ,IAAI,CAAC;AACjD,QAAM,WAAO,2BAAQ,QAAQ,eAAW,wBAAQ,CAAC;AACjD,QAAM,QAAQ,oBAAI,IAAyB;AAC3C,QAAM,UAAU,oBAAI,IAA+B;AAEnD,QAAM,iBAAiB,CAAC,SAAuB,WAAyB;AACtE,UAAM,UAAU,QAAQ,IAAI,OAAO,KAAK,oBAAI,IAAY;AACxD,YAAQ,IAAI,MAAM;AAClB,YAAQ,IAAI,SAAS,OAAO;AAAA,EAC9B;AACA,QAAM,OAAO,CAAC,QAAgB,SAAiB,eAAe,OAAO,WAAW,SAAe;AAC7F,UAAM,WAAW,MAAM,IAAI,MAAM;AACjC,QAAI,YAAY,SAAS,YAAY,QAAS,OAAM,IAAI,MAAM,qCAAqC,MAAM,EAAE;AAC3G,UAAM,IAAI,QAAQ,EAAE,QAAQ,SAAS,UAAU,aAAa,CAAC;AAAA,EAC/D;AACA,QAAM,gBAAgB,CAACC,YAAmB,WAAW,SAAe;AAClE,eAAW,OAAO,MAAO,UAAK,wBAAKA,YAAW,GAAG,OAAG,kCAAa,wBAAK,WAAW,GAAG,GAAG,MAAM,GAAG,OAAO,QAAQ;AAAA,EACjH;AAEA,MAAI;AACJ,MAAI,QAAQ,QAAQ;AAClB,UAAM,iBAAa,wBAAK,MAAM,WAAW,QAAQ;AACjD,UAAM,gBAAY,2BAAQ,QAAQ,gBAAgB,QAAQ,IAAI,kBAAc,wBAAK,MAAM,QAAQ,GAAG,QAAQ;AAC1G,gBAAY,UAAU,CAAC,MAAM,UAAU,YAAY;AACnD,eAAW,WAAW,WAAW;AAC/B,YAAM,YAAY,YAAY,WAAW,aAAa;AACtD,oBAAc,WAAW,YAAY,WAAW,WAAO,+BAAQ,2BAAQ,SAAS,CAAC,CAAC;AAClF,qBAAe,SAAS,SAAS;AAAA,IACnC;AAAA,EACF,OAAO;AACL,UAAM,iBAAa,wBAAK,MAAM,WAAW,QAAQ;AACjD,kBAAc,UAAU;AAExB,UAAM,iBAAa,wBAAK,MAAM,WAAW,QAAQ;AACjD,gBAAY,UAAU,SAAS,QAAQ,IAAI,aAAa;AACxD,eAAW,WAAW,UAAW,gBAAe,SAAS,UAAU;AAEnE,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,iBAAW,SAAS,WAAW,KAAK,GAAG;AACrC,cAAM,gBAAY,kCAAa,wBAAK,WAAW,OAAO,UAAU,GAAG,MAAM;AACzE,iBAAK,wBAAK,YAAY,OAAO,UAAU,GAAG,cAAc,OAAO,SAAS,CAAC;AAAA,MAC3E;AACA,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,iBAAa,wBAAK,MAAM,WAAW,SAAS,UAAU;AAC5D,WAAK,YAAY,WAAW;AAC5B,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,iBAAa,wBAAK,MAAM,WAAW;AACzC,WAAK,YAAY,mBAAmB,YAAY,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AACzG,qBAAe,UAAU,UAAU;AAAA,IACrC;AACA,QAAI,UAAU,SAAS,SAAS,GAAG;AACjC,YAAM,kBAAc,wBAAK,MAAM,WAAW,yBAAyB;AACnE,WAAK,aAAa,mBAAmB,aAAa,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AAC3G,qBAAe,WAAW,WAAW;AAAA,IACvC;AACA,QAAI,UAAU,SAAS,QAAQ,GAAG;AAChC,YAAM,iBAAa,wBAAK,MAAM,WAAW;AACzC,WAAK,YAAY,mBAAmB,YAAY,sBAAsB,QAAQ,UAAU,MAAM,IAAI,GAAG,IAAI;AACzG,qBAAe,UAAU,UAAU;AAAA,IACrC;AAAA,EACF;AAEA,QAAM,eAAe,oBAAI,IAAY;AACrC,QAAM,iBAAiB,oBAAI,IAAY;AACvC,QAAM,YAAsB,CAAC;AAC7B,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,UAAM,UAAU,mBAAmB,KAAK,UAAU,KAAK,MAAM;AAC7D,QAAI,SAAS;AACX,gBAAU,KAAK,GAAG,KAAK,MAAM,iCAAiC,OAAO,GAAG;AACxE;AAAA,IACF;AACA,QAAI,KAAC,4BAAW,KAAK,MAAM,GAAG;AAC5B,mBAAa,IAAI,KAAK,MAAM;AAC5B;AAAA,IACF;AACA,UAAM,cAAU,8BAAa,KAAK,QAAQ,MAAM;AAChD,QAAI,YAAY,KAAK,SAAS;AAC5B,qBAAe,IAAI,KAAK,MAAM;AAAA,IAChC,WAAW,KAAK,gBAAgB,QAAQ,OAAO;AAC7C,mBAAa,IAAI,KAAK,MAAM;AAC5B,qBAAe,OAAO,KAAK,MAAM;AAAA,IACnC,OAAO;AACL,gBAAU,KAAK,KAAK,MAAM;AAAA,IAC5B;AAAA,EACF;AAEA,MAAI,UAAU,SAAS,GAAG;AACxB,UAAM,IAAI;AAAA,MACR;AAAA,EAAmG,UAAU,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,CAAC;AAAA,IAChJ;AAAA,EACF;AAEA,aAAW,QAAQ,MAAM,OAAO,GAAG;AACjC,QAAI,KAAC,4BAAW,KAAK,MAAM,SAAK,8BAAa,KAAK,QAAQ,MAAM,MAAM,KAAK,SAAS;AAClF,yCAAU,2BAAQ,KAAK,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AACnD,yCAAc,KAAK,QAAQ,KAAK,OAAO;AAAA,IACzC;AAAA,EACF;AAEA,QAAM,SAAS,WAAW,KAAK;AAC/B,QAAM,gBAAgB,UAAU,IAAI,CAAC,aAAa,EAAE,SAAS,SAAS,CAAC,GAAI,QAAQ,IAAI,OAAO,KAAK,CAAC,CAAE,EAAE,EAAE;AAC1G,MAAI,IAAI,oBAAoB,UAAU,KAAK,IAAI,CAAC,EAAE;AAClD,MAAI,IAAI,mBAAmB,OAAO,KAAK,IAAI,CAAC,EAAE;AAC9C,aAAW,gBAAgB,cAAe,KAAI,IAAI,GAAG,aAAa,OAAO,KAAK,aAAa,QAAQ,KAAK,IAAI,CAAC,EAAE;AAC/G,MAAI,IAAI,aAAa,aAAa,IAAI,mBAAmB,eAAe,OAAO,KAAK,eAAe,IAAI,gBAAgB,EAAE,EAAE;AAC3H,SAAO;AAAA,IACL;AAAA,IACA,SAAS,WAAW,WAAW,YAAY;AAAA,IAC3C,WAAW,WAAW,WAAW,cAAc;AAAA,IAC/C,cAAc,CAAC,GAAG,YAAY,EAAE,KAAK;AAAA,IACrC,gBAAgB,CAAC,GAAG,cAAc,EAAE,KAAK;AAAA,IACzC,WAAW;AAAA,EACb;AACF;AAEA,SAAS,WAAW,MAAc,OAA8B;AAC9D,SAAO,CAAC,GAAG,KAAK,EACb,IAAI,CAAC,aAAS,4BAAS,MAAM,IAAI,CAAC,EAClC,OAAO,CAAC,SAAS,SAAS,QAAQ,CAAC,KAAK,WAAW,KAAK,qBAAG,EAAE,KAAK,KAAC,8BAAW,IAAI,CAAC,EACnF,KAAK;AACV;AAEA,SAAS,mBAAmB,QAA4C,QAAiC;AACvG,QAAM,YAAsB,QAAQ,SAAS,SAAS,CAAC,QAAQ;AAC/D,QAAM,UAAU,oBAAI,IAAY,CAAC,GAAG,iBAAiB,KAAK,CAAC;AAC3D,aAAW,WAAW,WAAW;AAC/B,QAAI,CAAC,QAAQ,IAAI,OAAO,GAAG;AACzB,YAAM,IAAI,MAAM,0BAA0B,OAAO,kBAAkB,gBAAgB,KAAK,IAAI,CAAC,EAAE;AAAA,IACjG;AAAA,EACF;AACA,QAAM,WAA2B,UAAU,SAAS,KAAK,IACrD,SAAS,CAAC,UAAU,OAAO,IAAI,CAAC,GAAG,eAAe,IAClD,CAAC,GAAG,IAAI,IAAI,SAAS,CAAC;AAC1B,MAAI,QAAQ;AACV,UAAM,cAAc,SAAS,OAAO,CAAC,YAAY,YAAY,YAAY,YAAY,OAAO;AAC5F,QAAI,YAAY,QAAQ;AACtB,YAAM,IAAI,MAAM,4CAA4C,YAAY,KAAK,IAAI,CAAC,kCAAkC;AAAA,IACtH;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,mBAAmB,MAAc,OAAe,OAAgB,UAA0B;AACjG,QAAM,UAAU,mBAAmB,UAAU,IAAI;AACjD,MAAI,QAAS,OAAM,IAAI,MAAM,sBAAsB,IAAI,6BAA6B,OAAO,EAAE;AAC7F,MAAI,KAAC,4BAAW,IAAI,EAAG,QAAO,GAAG,KAAK;AAAA;AACtC,QAAM,cAAU,8BAAa,MAAM,MAAM;AACzC,QAAM,QAAQ;AACd,QAAM,MAAM;AACZ,QAAM,UAAU,QAAQ,QAAQ,KAAK;AACrC,QAAM,QAAQ,QAAQ,QAAQ,GAAG;AACjC,MAAK,YAAY,QAAS,UAAU,OAAQ,YAAY,MAAM,QAAQ,SAAU;AAC9E,UAAM,IAAI,MAAM,qCAAqC,IAAI,EAAE;AAAA,EAC7D;AACA,MAAI,YAAY,IAAI;AAClB,UAAM,YAAY,QAAQ,WAAW,KAAK,QAAQ,SAAS,MAAM,IAAI,KAAK,QAAQ,SAAS,IAAI,IAAI,OAAO;AAC1G,WAAO,GAAG,OAAO,GAAG,SAAS,GAAG,KAAK;AAAA;AAAA,EACvC;AACA,QAAM,WAAW,QAAQ,IAAI;AAC7B,QAAM,WAAW,QAAQ,MAAM,SAAS,QAAQ;AAChD,MAAI,aAAa,SAAS,CAAC,OAAO;AAChC,UAAM,IAAI,MAAM,4CAA4C,IAAI,+CAA+C;AAAA,EACjH;AACA,SAAO,GAAG,QAAQ,MAAM,GAAG,OAAO,CAAC,GAAG,KAAK,GAAG,QAAQ,MAAM,QAAQ,CAAC;AACvE;AAEA,SAAS,mBAAmB,UAAkB,QAAoC;AAChF,QAAM,UAAM,4BAAS,UAAU,MAAM;AACrC,MAAI,QAAQ,QAAQ,IAAI,WAAW,KAAK,qBAAG,EAAE,SAAK,8BAAW,GAAG,GAAG;AACjE,UAAM,IAAI,MAAM,gDAAgD,MAAM,EAAE;AAAA,EAC1E;AACA,MAAI,UAAU;AACd,aAAW,QAAQ,IAAI,MAAM,qBAAG,EAAE,OAAO,OAAO,GAAG;AACjD,kBAAU,wBAAK,SAAS,IAAI;AAC5B,QAAI;AACF,cAAI,2BAAU,OAAO,EAAE,eAAe,EAAG,QAAO;AAAA,IAClD,SAAS,OAAO;AACd,UAAK,MAAgC,SAAS,SAAU,OAAM;AAAA,IAChE;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,WAAW,OAA2B;AAC7C,SAAO,CAAC,GAAG,IAAI,IAAI,MAAM,OAAO,CAAC,SAAS,sBAAsB,KAAK,IAAI,CAAC,EAAE,IAAI,CAAC,SAAS,KAAK,MAAM,OAAO,EAAE,CAAC,CAAE,CAAC,CAAC,EAAE,KAAK;AAC5H;AAEA,SAAS,UAAU,KAAuB;AACxC,MAAI,KAAC,4BAAW,GAAG,EAAG,QAAO,CAAC;AAC9B,QAAM,UAAoB,CAAC;AAC3B,QAAM,OAAO,CAAC,YAA0B;AACtC,eAAW,aAAS,6BAAY,SAAS,EAAE,eAAe,KAAK,CAAC,GAAG;AACjE,YAAM,WAAO,wBAAK,SAAS,MAAM,IAAI;AACrC,UAAI,MAAM,YAAY,EAAG,MAAK,IAAI;AAAA,UAC7B,SAAQ,SAAK,4BAAS,KAAK,IAAI,CAAC;AAAA,IACvC;AAAA,EACF;AACA,OAAK,GAAG;AACR,SAAO,QAAQ,KAAK;AACtB;;;AElQA,eAAsB,MAAM,SAAsC;AAChE,QAAM,MAAM,QAAQ,UAAU;AAC9B,QAAM,MAAM,MAAM,kBAAkB,QAAQ,UAAU;AACtD,QAAM,MAAM,QAAQ,QAAQ,IAAI,KAAK,SAAS,KAAK,IAAI,QAAS,IAAI,KAAK,CAAC,KAAK;AAC/E,MAAI,CAAC,IAAI,KAAK,SAAS,GAAG,EAAG,OAAM,IAAI,MAAM,QAAQ,GAAG,wBAAwB,YAAY,IAAI,YAAY,IAAI,OAAO,CAAC,EAAE;AAE1H,QAAM,cAAc,gBAAgB,IAAI,MAAM,eAAe;AAC7D,MAAI,CAAC,aAAa;AAChB,UAAM,IAAI,MAAM,8BAA8B,YAAY,IAAI,MAAM,iBAAiB,IAAI,OAAO,CAAC,6CAA6C;AAAA,EAChJ;AACA,MAAI,YAAY,UAAU,IAAI,IAAI,IAAI;AACpC,UAAM,IAAI,MAAM,kCAAkC,YAAY,KAAK,yBAAyB,IAAI,IAAI,EAAE,GAAG;AAAA,EAC3G;AAEA,QAAM,QAAQ,YAAY,KAAK,GAAG;AAClC,MAAI,CAAC,OAAO,YAAY,CAAC,MAAM,OAAO;AACpC,UAAM,IAAI,MAAM,6CAA6C,GAAG,8CAA8C;AAAA,EAChH;AAEA,QAAM,UAAU,QAAQ,SAAS;AACjC,MAAI,IAAI,UAAU,IAAI,IAAI,EAAE,IAAI,GAAG,EAAE;AACrC,MAAI,IAAI,aAAa,MAAM,QAAQ,EAAE;AAErC,QAAM,eAAe,MAAM,QAAQ,SAAS,gBAAgB,IAAI,aAAa,IAAI,IAAI,IAAI,GAAG,GAAG,MAAS;AACxG,MAAI,IAAI,qBAAqB;AAE7B,MAAI,IAAI,IAAI,UAAU;AACpB,UAAM,WAAa,aAAwD,IAAI,YAAY;AAC3F,QAAI,aAAa,IAAI,GAAG,UAAU;AAChC,YAAM,IAAI,MAAM,mCAAmC,IAAI,GAAG,QAAQ,yBAAyB,YAAY,MAAM,GAAG;AAAA,IAClH;AACA,QAAI,IAAI,SAAS,QAAQ,EAAE;AAAA,EAC7B;AAEA,QAAM,iBAAiB,MAAM,kBAA2B,KAAK,IAAI,IAAI,QAAQ,CAAC,UAAU,QAAQ,CAAC;AACjG,QAAM,mBAAmB,mBAAmB,cAAc;AAC1D,QAAM,oBAAoB,MAAM,QAAQ,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,MAAM,QAAQ,CAAC,WAAW,MAAM,KAAK;AAClI,QAAM,aAAc,kBAA2C,UAAU;AACzE,QAAM,eAAe,mBAAmB,UAAU;AAClD,MAAI,iBAAiB,QAAQ;AAC3B,UAAM,UAAU,iBAAiB,OAAO,CAAC,WAAW,CAAC,aAAa,SAAS,MAAM,CAAC;AAClF,QAAI,QAAQ,OAAQ,OAAM,IAAI,MAAM,6CAA6C,QAAQ,KAAK,IAAI,CAAC,EAAE;AAAA,EACvG;AACA,MAAI,IAAI,aAAa,aAAa,MAAM,WAAW;AAEnD,QAAM,kBAAkB,iBAAiB,CAAC,KAAK,aAAa,CAAC;AAC7D,MAAI,iBAAiB;AACnB,UAAM,YAAY,MAAMC,UAAS,SAAS,GAAG,IAAI,UAAU,QAAQ,mBAAmB,MAAM,QAAQ,CAAC,cAAc,MAAM,OAAO;AAAA,MAC9H,IAAI;AAAA,MACJ,WAAW,EAAE,OAAO,KAAK;AAAA,IAC3B,CAAC;AACD,UAAM,QAAS,UAAkD,WAAW;AAC5E,QAAI,IAAI,gBAAgB,eAAe,UAAU,OAAO,SAAS,IAAI,CAAC,EAAE;AAAA,EAC1E,OAAO;AACL,QAAI,IAAI,+CAA+C;AAAA,EACzD;AACA,MAAI,IAAI,IAAI;AACd;AAEA,eAAe,QAAQ,SAAoB,KAAa,QAA8C;AACpG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,SAAS,SAAS,EAAE,eAAe,UAAU,MAAM,GAAG,IAAI;AAAA,EAC5D,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,aAAa,IAAI,MAAM,KAAK,MAAMC,UAAS,GAAG,CAAC,EAAE;AACtG,SAAO,IAAI,KAAK;AAClB;AAEA,eAAeD,UAAS,SAAoB,KAAa,QAAgB,MAAiC;AACxG,QAAM,MAAM,MAAM,QAAQ,KAAK;AAAA,IAC7B,QAAQ;AAAA,IACR,SAAS,EAAE,eAAe,UAAU,MAAM,IAAI,gBAAgB,mBAAmB;AAAA,IACjF,MAAM,KAAK,UAAU,IAAI;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,IAAI,GAAI,OAAM,IAAI,MAAM,GAAG,IAAI,IAAI,GAAG,EAAE,QAAQ,aAAa,IAAI,MAAM,KAAK,MAAMC,UAAS,GAAG,CAAC,EAAE;AACtG,SAAO,IAAI,KAAK;AAClB;AAEA,SAAS,gBAAgB,aAAqB,OAAe,KAAqB;AAChF,QAAM,MAAM,IAAI,IAAI,kBAAkB,mBAAmB,KAAK,CAAC,kBAAkB,WAAW;AAC5F,MAAI,aAAa,IAAI,OAAO,GAAG;AAC/B,SAAO,IAAI,SAAS;AACtB;AAEA,eAAeA,UAAS,KAAgC;AACtD,MAAI;AACF,YAAQ,MAAM,IAAI,KAAK,GAAG,MAAM,GAAG,GAAG;AAAA,EACxC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;;;AxBzEA,eAAsB,OAAO,OAAO,QAAQ,KAAK,MAAM,CAAC,GAAkB;AACxE,QAAM,SAAS,UAAU,IAAI;AAC7B,QAAM,UAAU,OAAO,YAAY,CAAC,KAAK;AACzC,MAAI,YAAY,aAAa,YAAY,QAAQ,OAAO,QAAQ,YAAY,MAAM;AAChF,eAAW,QAAQ,CAAC,SAAS,GAAG,CAAC;AACjC,YAAQ,IAAI,WAAW,CAAC;AACxB;AAAA,EACF;AAEA,MAAI,YAAY,UAAU,YAAY,YAAY,YAAY,MAAM;AAClE,eAAW,QAAQ,CAAC,MAAM,GAAG,CAAC;AAC9B,cAAU;AACV;AAAA,EACF;AAEA,MAAI,YAAY,QAAQ;AACtB,eAAW,QAAQ,CAAC,UAAU,QAAQ,UAAU,OAAO,YAAY,eAAe,OAAO,GAAG,CAAC;AAC7F,gBAAY;AAAA,MACV,OAAO,eAAe,OAAO,QAAQ,QAAQ,GAAG,UAAU;AAAA,MAC1D,MAAM,eAAe,OAAO,QAAQ,MAAM,QAAQ;AAAA,MAClD,YAAY,UAAU,OAAO,QAAQ,MAAM;AAAA,MAC3C,MAAM,QAAQ,OAAO,QAAQ,GAAG;AAAA,MAChC,UAAU,QAAQ,OAAO,QAAQ,QAAQ;AAAA,MACzC,YAAY,UAAU,OAAO,QAAQ,aAAa,CAAC;AAAA,MACnD,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,UAAU;AACxB,eAAW,QAAQ,CAAC,QAAQ,GAAG,CAAC;AAChC,UAAM,OAAO,EAAE,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK,kBAAkB,CAAC;AAClF;AAAA,EACF;AAEA,MAAI,YAAY,gBAAgB;AAC9B,eAAW,QAAQ,CAAC,MAAM,GAAG,CAAC;AAC9B,sBAAkB,OAAO,QAAQ,SAAS,IAAI;AAC9C;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,UAAM,OAAO,OAAO,YAAY,CAAC;AACjC,UAAM,SAAS,OAAO,YAAY,CAAC;AACnC,UAAM,gBAAgB,WAAW,gBAAgB,OAAO,YAAY,CAAC,MAAM;AAC3E,UAAM,cAAc,WAAW;AAC/B,UAAM,SAAS,WAAW;AAC1B,UAAM,QAAQ,WAAW;AACzB,UAAM,QAAQ,WAAW;AACzB,QAAI,SAAS,QAAS,WAAW,UAAU,WAAW,SAAS,CAAC,iBAAiB,CAAC,eAAe,CAAC,UAAU,CAAC,SAAS,CAAC,OAAQ;AAC7H,YAAM,IAAI,MAAM,qDAAqD;AAAA,IACvE;AACA,eAAW,QAAQ;AAAA,MACjB;AAAA,MAAY;AAAA,MAAQ;AAAA,MAAQ;AAAA,MAAY;AAAA,MAAS;AAAA,MACjD;AAAA,MAAmB;AAAA,MAAqB;AAAA,MAAqB;AAAA,MAAY;AAAA,MACzE;AAAA,MAAsB;AAAA,MAAmB;AAAA,MAAuB;AAAA,MAChE;AAAA,MAAU;AAAA,MAAO;AAAA,MAAU;AAAA,IAC7B,GAAG,gBAAgB,IAAI,WAAW,QAAQ,IAAI,CAAC;AAC/C,UAAM,QAAQ;AAAA,MACZ,QAAQ,gBAAgB,mBAAmB,cAAc,gBAAgB,SAAS,WAAW,QAAQ,UAAU,QAAQ,UAAU;AAAA,MACjI,SAAS,WAAW,QAAQ,OAAO,YAAY,CAAC,IAAI;AAAA,MACpD,UAAU,UAAU,OAAO,QAAQ,QAAQ;AAAA,MAC3C,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,SAAS,QAAQ,OAAO,QAAQ,OAAO;AAAA,MACvC,eAAe,UAAU,OAAO,QAAQ,iBAAiB,GAAG,mBAAmB;AAAA,MAC/E,iBAAiB,UAAU,OAAO,QAAQ,mBAAmB,GAAG,qBAAqB;AAAA,MACrF,gBAAgB,UAAU,OAAO,QAAQ,mBAAmB,GAAG,qBAAqB;AAAA,MACpF,UAAU,UAAU,OAAO,QAAQ,QAAQ;AAAA,MAC3C,MAAM,OAAO,QAAQ,SAAS;AAAA,MAC9B,MAAM,OAAO,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO;AAAA,MACpF,oBAAoB,gBAAgB,OAAO,YAAY,CAAC,IAAI;AAAA,MAC5D,SAAS,UAAU,OAAO,QAAQ,UAAU,CAAC;AAAA,MAC7C,OAAO,OAAO,QAAQ,UAAU;AAAA,MAChC,mBAAmB,UAAU,OAAO,QAAQ,oBAAoB,CAAC;AAAA,MACjE,gBAAgB,UAAU,OAAO,QAAQ,iBAAiB,CAAC;AAAA,MAC3D,oBAAoB,UAAU,OAAO,QAAQ,qBAAqB,CAAC;AAAA,MACnE,iBAAiB,UAAU,OAAO,QAAQ,kBAAkB,CAAC;AAAA,MAC7D,OAAO,UAAU,OAAO,QAAQ,QAAQ,CAAC;AAAA,MACzC,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,OAAO,UAAU,OAAO,QAAQ,QAAQ,CAAC;AAAA,MACzC,OAAO,UAAU,OAAO,QAAQ,OAAO,SAAS;AAAA,IAClD,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,YAAY;AAC1B,UAAM,MAAM,OAAO,YAAY,CAAC;AAChC,QAAI,QAAQ,MAAO,OAAM,IAAI,MAAM,uDAAuD;AAC1F,eAAW,QAAQ;AAAA,MACjB;AAAA,MAAU;AAAA,MAAO;AAAA,MAAO;AAAA,MAAW;AAAA,MAAkB;AAAA,MAAU;AAAA,MAC/D;AAAA,MAAQ;AAAA,MAAuB;AAAA,MAAQ;AAAA,MAAW;AAAA,MAAsB;AAAA,IAC1E,GAAG,CAAC;AACJ,UAAM,aAAa,UAAU,OAAO,QAAQ,MAAM,KAAK;AACvD,UAAM,YAAY,OAAO,QAAQ,SAAS;AAC1C,UAAM,OAAO,OAAO,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO;AAC3F,UAAM,WAAW,UAAU,OAAO,QAAQ,QAAQ;AAClD,UAAM,SAAS,MAAM,kBAAkB;AAAA,MACrC;AAAA,MACA;AAAA,MACA,QAAQ,OAAO,YAAY,CAAC;AAAA,MAC5B,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,SAAS,gBAAgB,UAAU,OAAO,QAAQ,OAAO,CAAC;AAAA,MAC1D,cAAc,UAAU,OAAO,QAAQ,gBAAgB,GAAG,kBAAkB;AAAA,MAC5E,OAAO,UAAU,OAAO,QAAQ,QAAQ,CAAC;AAAA,MACzC;AAAA,MACA,qBAAqB,OAAO,QAAQ,qBAAqB,MAAM,OAAO,aAAa;AAAA,MACnF,UAAU,OAAO,YAAY;AAC3B,YAAI,QAAQ,UAAU,0BAA0B;AAC9C,iBAAO,uBAAuB,EAAE,UAAU,QAAQ,UAAU,OAAO,QAAQ,OAAO,KAAK,CAAC;AAAA,QAC1F;AACA,cAAM,MAAM,MAAM,kBAAkB,UAAU;AAC9C,YAAI,iBAAiB,IAAI,WAAW,MAAM,iBAAiB,QAAQ,QAAQ,GAAG;AAC5E,gBAAM,IAAI,MAAM,wHAAwH;AAAA,QAC1I;AACA,eAAO,kBAAkB,KAAK,EAAE,YAAY,KAAK,GAAG,OAAO,OAAO;AAAA,MACpE;AAAA,IACF,CAAC;AACD,UAAM,SAAS,YAAY,UAAU,OAAO,QAAQ,SAAS,CAAC,KAAK,QAAQ,WAAW;AACtF,UAAM,iBAAiB,OAAO,QAAQ,oBAAoB;AAC1D,UAAM,mBAAmB,mBAAmB,QAAQ,SAAY,YAAY,UAAU,cAAc,KAAK,YAAY,sBAAsB;AAC3I,UAAM,gBAAY,oCAAkB,OAAO,QAAQ,MAAM;AACzD,UAAM,QAAQ,uBACV,oCAAkB,OAAO,QAAQ,kBAAkB,IAAI,EAAE,OAAO,CAAC,YAAY,QAAQ,gBAAgB,WAAW,IAChH,CAAC;AACL,UAAM,aAAa,OAAO,OAAO,mBAAmB,gBAAgB,OAAO,QAAQ,kBAAkB,MAAM;AAC3G,QAAI,UAAU,UAAU,MAAM,UAAU,YAAY;AAClD,YAAM,IAAI,MAAM,gCAAgC,UAAU,MAAM,iBAAiB,MAAM,KAAK,MAAM,MAAM,aAAa,oBAAoB,UAAU,GAAG,aAAa,0BAA0B,EAAE,EAAE;AAAA,IACnM;AACA;AAAA,EACF;AAEA,MAAI,YAAY,aAAa;AAC3B;AAAA,MACE;AAAA,MACA;AAAA,QACE;AAAA,QAAU;AAAA,QAAW;AAAA,QAAe;AAAA,QAAqB;AAAA,QAAgB;AAAA,QACzE;AAAA,QAAkB;AAAA,QAAS;AAAA,QAAQ;AAAA,MACrC;AAAA,MACA;AAAA,IACF;AACA,UAAMC,gBAAe,OAAO,QAAQ,gBAAgB;AACpD,UAAM,OAAyB;AAAA,MAC7B,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,MACtC,YAAY,OAAO,QAAQ,aAAa,MAAM;AAAA,MAC9C,iBAAiB,OAAO,QAAQ,mBAAmB,MAAM;AAAA,MACzD,aAAa,OAAO,QAAQ,cAAc,MAAM;AAAA,MAChD,kBAAkB,OAAO,QAAQ,mBAAmB,MAAM;AAAA,MAC1D,cAAc,OAAOA,kBAAiB,WAAWA,gBAAeA,kBAAiB;AAAA,MACjF,OAAO,UAAU,OAAO,QAAQ,KAAK;AAAA,MACrC,MAAM,OAAO,QAAQ,SAAS,QAAQ,QAAQ,OAAO,QAAQ,SAAS,OAAO,OAAO;AAAA,MACpF,KAAK,OAAO,QAAQ,QAAQ;AAAA,IAC9B;AACA,UAAM,UAAU,IAAI;AACpB;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,eAAW,QAAQ,CAAC,UAAU,KAAK,GAAG,CAAC;AACvC,UAAM,MAAM;AAAA,MACV,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,IACnC,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,eAAW,QAAQ,CAAC,OAAO,UAAU,SAAS,SAAS,SAAS,GAAG,CAAC;AAGpE,iBAAa;AAAA,MACX,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,QAAQ,OAAO,QAAQ,WAAW;AAAA,MAClC,WAAW,YAAY,MAAM;AAAA,MAC7B,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD,YAAQ;AAAA,MACN;AAAA,IAEF;AACA;AAAA,EACF;AAEA,MAAI,YAAY,SAAS;AACvB,UAAM,MAAM,OAAO,YAAY,CAAC;AAChC,QAAI,QAAQ,UAAW,OAAM,IAAI,MAAM,6BAA6B,OAAO,EAAE,iCAAiC;AAC9G,eAAW,QAAQ,CAAC,OAAO,UAAU,SAAS,SAAS,SAAS,GAAG,CAAC;AACpE,iBAAa;AAAA,MACX,KAAK,UAAU,OAAO,QAAQ,GAAG;AAAA,MACjC,QAAQ,OAAO,QAAQ,WAAW;AAAA,MAClC,WAAW,YAAY,MAAM;AAAA,MAC7B,OAAO,OAAO,QAAQ,UAAU;AAAA,IAClC,CAAC;AACD;AAAA,EACF;AAEA,MAAI,YAAY,WAAW;AACzB,UAAM,MAAM,OAAO,YAAY,CAAC;AAChC,QAAI,QAAQ,OAAQ,OAAM,IAAI,MAAM,+BAA+B,OAAO,EAAE,0CAA0C;AACtH,eAAW,QAAQ,CAAC,UAAU,OAAO,WAAW,KAAK,GAAG,CAAC;AACzD,UAAM,YAAY;AAAA,MAChB,YAAY,UAAU,OAAO,QAAQ,MAAM,KAAK;AAAA,MAChD,KAAK,eAAe,OAAO,QAAQ,KAAK,OAAO;AAAA,MAC/C,QAAQ,OAAO,QAAQ,SAAS,MAAM;AAAA,MACtC,KAAK,OAAO,QAAQ,QAAQ;AAAA,IAC9B,CAAC;AACD;AAAA,EACF;AAEA,QAAM,IAAI,MAAM,oBAAoB,OAAO,wBAAwB;AACrE;AAEA,SAAS,gBAAgB,OAA8D;AACrF,MAAI,UAAU,OAAW,QAAO;AAChC,MAAI,UAAU,UAAU,UAAU,oBAAoB,UAAU,UAAW,QAAO;AAClF,QAAM,IAAI,MAAM,oDAAoD;AACtE;AAEA,SAAS,YAAY,OAAe,MAAwB;AAC1D,MAAI,CAAC,iBAAiB,OAAO,UAAU,QAAQ,UAAU,EAAE,SAAS,KAAK,EAAG,QAAO;AACnF,QAAM,IAAI,MAAM,GAAG,IAAI,wDAAwD;AACjF;AAEA,SAAS,YAAY,QAA4C;AAC/D,QAAM,WAAW;AAAA,IACf,GAAG,cAAc,OAAO,QAAQ,OAAO,SAAS;AAAA,IAChD,GAAG,cAAc,OAAO,QAAQ,SAAS,WAAW;AAAA,EACtD;AACA,SAAQ,SAAS,SAAS,WAAW,CAAC,KAAK;AAC7C;AAEA,SAAS,cAAc,OAAgD,MAAwB;AAC7F,MAAI,UAAU,OAAW,QAAO,CAAC;AACjC,MAAI,OAAO,UAAU,UAAW,OAAM,IAAI,MAAM,GAAG,IAAI,0BAA0B;AACjF,QAAM,MAAM,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,KAAK;AACjD,QAAM,QAAQ,IAAI,QAAQ,CAAC,SAAS,KAAK,MAAM,GAAG,CAAC;AACnD,MAAI,MAAM,KAAK,CAAC,SAAS,CAAC,KAAK,KAAK,CAAC,EAAG,OAAM,IAAI,MAAM,GAAG,IAAI,0BAA0B;AACzF,SAAO,MAAM,IAAI,CAAC,SAAS,KAAK,KAAK,CAAC;AACxC;","names":["import_security","import_node_process","import_node_process","process","resolve","process","import_node_fs","import_node_process","import_db","process","responseBody","apiError","isRecord","timestamp","process","res","body","responseBody","apiError","isRecord","policy","response","import_node_fs","import_node_path","import_node_child_process","import_node_fs","import_node_path","import_node_child_process","import_node_fs","import_node_path","import_node_fs","import_node_path","import_apps","import_node_process","process","safeText","publishableKey","import_node_path","import_node_fs","import_node_fs","import_node_path","import_node_url","targetDir","postJson","safeText","writeDevVars"]}