@remnic/core 1.1.12 → 1.1.14

package/dist/chunk-326G7DJK.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/connectors/index.ts","../src/connectors/codex-marketplace.ts"],"sourcesContent":["/**\n * @remnic/core — Connector Manager\n *\n * Metadata-driven registry for host adapters (Codex CLI, Claude Code, Cursor, etc.).\n * Manages connector lifecycle: install, remove, configure, health.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\nimport os from \"node:os\";\nimport { createRequire } from \"node:module\";\nimport { fileURLToPath } from \"node:url\";\n\nimport { generateToken, revokeToken, buildTokenEntry, commitTokenEntry, loadTokenStore, saveTokenStore } from \"../tokens.js\";\nimport { launchProcessSync } from \"../runtime/child-process.js\";\nimport { mergeEnv, readEnvVar, resolveHomeDir } from \"../runtime/env.js\";\nimport { expandTildePath } from \"../utils/path.js\";\nimport { coerceInstallExtension } from \"./coerce.js\";\n\n// Native memory artifact materialization for Codex CLI (#378). Surfaced here\n// so downstream callers can `import { materializeForNamespace } from \"@remnic/core/connectors\"`.\nexport {\n  materializeForNamespace,\n  ensureSentinel,\n  describeMemoriesDir,\n  renderMemorySummary,\n  renderMemoryMd,\n  renderRawMemories,\n  renderRolloutSummary,\n  validateMemoryMd,\n  approximateTokenCount,\n  truncateToTokenBudget,\n  MATERIALIZE_VERSION,\n  SENTINEL_FILE,\n  TMP_DIR,\n  type MaterializeOptions,\n  type MaterializeResult,\n  type RolloutSummaryInput,\n  type MemoryMdValidation,\n} from \"./codex-materialize.js\";\nexport {\n  runCodexMaterialize,\n  type RunMaterializeOptions,\n} from \"./codex-materialize-runner.js\";\nexport {\n  generateMarketplaceManifest,\n  validateMarketplaceManifest,\n  checkMarketplaceManifest,\n  writeMarketplaceManifest,\n  installFromMarketplace,\n  MARKETPLACE_SCHEMA_VERSION,\n  MARKETPLACE_MANIFEST_FILENAME,\n  type MarketplaceManifest,\n  type MarketplaceEntry,\n  type MarketplaceConfig,\n  type MarketplaceInstallType,\n  type MarketplaceInstallResult,\n  type MarketplaceValidation,\n  type MarketplaceLogger,\n} from \"./codex-marketplace.js\";\n\n// ── Types ────────────────────────────────────────────────────────────────────\n\nexport interface ConnectorManifest {\n  /** Unique connector ID (e.g. \"claude-code\", \"codex-cli\") */\n  id: string;\n  /** Human-readable name */\n  name: string;\n  /** Version */\n  version: string;\n  /** Description */\n  description: string;\n  /** Capabilities */\n  capabilities: ConnectorCapability;\n  /** Required config fields */\n  configSchema?: Record<string, string>;\n  /** Whether currently installed */\n  installed?: boolean;\n  /** Homepage URL */\n  homepage?: string;\n  /** Author */\n  author?: string;\n  /** Repository URL */\n  repository?: string;\n  /** Tags */\n  tags?: string[];\n  /**\n   * Whether this connector requires a bearer token for daemon authentication.\n   * When false (the default), installConnector will NOT generate or persist a\n   * token entry in tokens.json — credentials are never materialized on disk for\n   * connectors that use MCP, embedded, CLI, or SDK transports that don't need\n   * token auth.  Set to true only for HTTP connectors that actually authenticate\n   * requests with a bearer token (e.g. hermes, replit, generic-mcp).\n   */\n  requiresToken?: boolean;\n}\n\nexport interface ConnectorCapability {\n  /** Can observe conversations */\n  observe: boolean;\n  /** Can recall/query memories */\n  recall: boolean;\n  /** Can store memories */\n  store: boolean;\n  /** Can search */\n  search: boolean;\n  /** Can manage entities */\n  entities: boolean;\n  /** Supports real-time sync */\n  realtimeSync: boolean;\n  /** Supports batch operations */\n  batch: boolean;\n  /** Max memory budget in chars */\n  maxBudgetChars?: number;\n  /** Connection type */\n  connectionType: \"mcp\" | \"http\" | \"cli\" | \"sdk\" | \"embedded\";\n}\n\nexport interface ConnectorInstance {\n  /** Connector ID */\n  connectorId: string;\n  /** Resolved config */\n  config: Record<string, unknown>;\n  /** Status */\n  status: \"installed\" | \"running\" | \"error\" | \"disabled\";\n  /** Installed at timestamp */\n  installedAt?: string;\n  /** Error message if erro */\n  error?: string;\n}\n\nexport interface ConnectorRegistry {\n  /** Known connectors */\n  connectors: ConnectorManifest[];\n  /** Registry file path */\n  registryPath: string;\n}\n\nexport interface InstallOptions {\n  /** Connector ID to install */\n  connectorId: string;\n  /** Config values */\n  config?: Record<string, unknown>;\n  /** Memory directory */\n  memoryDir?: string;\n  /** Whether to force reinstall */\n  force?: boolean;\n}\n\nexport interface InstallResult {\n  /** Connector ID */\n  connectorId: string;\n  /** Status */\n  status: \"installed\" | \"already_installed\" | \"config_required\" | \"error\";\n  /** Config path */\n  configPath?: string;\n  /** Message */\n  message: string;\n}\n\nexport interface RemoveResult {\n  /** Connector ID */\n  connectorId: string;\n  /** Removed config path */\n  configPath: string;\n  /** Message */\n  message: string;\n  /** Status: \"removed\" on success, \"error\" if the removal failed partway, \"not_found\" if the connector was not installed, \"skipped\" if removal was aborted (e.g. malformed config). */\n  status: \"removed\" | \"error\" | \"not_found\" | \"skipped\";\n  /** Machine-readable skip reason (present when status === \"skipped\"). */\n  reason?: string;\n}\n\nexport interface DoctorResult {\n  /** Connector ID */\n  connectorId: string;\n  /** Checks */\n  checks: DoctorCheck[];\n  /** All healthy */\n  healthy: boolean;\n}\n\nexport interface DoctorCheck {\n  /** Check name */\n  name: string;\n  /** Passed */\n  ok: boolean;\n  /** Detail */\n  detail: string;\n}\n\n// ── Helpers (Finding 4) ───────────────────────────────────────────────────\n\n// Re-export coerceInstallExtension so existing import sites\n// (`import { coerceInstallExtension } from \"./index.js\"`) keep working without\n// change. The binding comes from the top-level import above.\nexport { coerceInstallExtension };\n\n// ── Built-in connector definitions ─────────────────────────────────────────\n\nconst BUILTIN_CONNECTORS: ConnectorManifest[] = [\n  {\n    id: \"claude-code\",\n    name: \"Claude Code\",\n    version: \"1.0.0\",\n    description: \"Anthropic's Claude Code CLI — direct memory access via MCP\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: true,\n      search: true,\n      entities: true,\n      realtimeSync: true,\n      batch: false,\n      maxBudgetChars: 32000,\n      connectionType: \"mcp\",\n    },\n    configSchema: {\n      mcpServerUrl: \"URL of the MCP Remnic server\",\n      namespace: \"Optional namespace (default: 'default')\",\n    },\n    homepage: \"https://claude.ai/code\",\n    author: \"Anthropic\",\n    tags: [\"official\", \"ai\", \"claude\"],\n    requiresToken: true,\n  },\n  {\n    id: \"codex-cli\",\n    name: \"Codex CLI\",\n    version: \"1.0.0\",\n    description: \"OpenAI Codex CLI — memory via MCP tool\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: true,\n      search: false,\n      entities: false,\n      realtimeSync: false,\n      batch: true,\n      maxBudgetChars: 8000,\n      connectionType: \"mcp\",\n    },\n    configSchema: {\n      mcpServerUrl: \"URL of the MCP Remnic server\",\n      namespace: \"Optional namespace\",\n    },\n    homepage: \"https://openai.com/codex\",\n    author: \"OpenAI\",\n    tags: [\"official\", \"ai\", \"codex\"],\n    requiresToken: true,\n  },\n  {\n    id: \"cursor\",\n    name: \"Cursor IDE\",\n    version: \"1.0.0\",\n    description: \"Cursor IDE — memory via config file + tool calls\",\n    capabilities: {\n      observe: false,\n      recall: true,\n      store: false,\n      search: true,\n      entities: false,\n      realtimeSync: false,\n      batch: false,\n      maxBudgetChars: 32000,\n      connectionType: \"embedded\",\n    },\n    configSchema: {\n      memoryDir: \"Path to Remnic memory directory\",\n    },\n    homepage: \"https://cursor.com\",\n    author: \"Cursor Inc.\",\n    tags: [\"official\", \"ide\"],\n  },\n  {\n    id: \"cline\",\n    name: \"Cline\",\n    version: \"1.0.0\",\n    description: \"VS Code Cline extension — memory via MCP\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: true,\n      search: false,\n      entities: false,\n      realtimeSync: false,\n      batch: true,\n      maxBudgetChars: 8000,\n      connectionType: \"mcp\",\n    },\n    configSchema: {\n      mcpServerUrl: \"URL of the MCP Remnic server\",\n      namespace: \"Optional namespace\",\n    },\n    homepage: \"https://github.com/cline/cline\",\n    author: \"Cline\",\n    tags: [\"community\", \"vscode\"],\n  },\n  {\n    id: \"github-copilot\",\n    name: \"GitHub Copilot\",\n    version: \"1.0.0\",\n    description: \"GitHub Copilot — memory via MCP server\",\n    capabilities: {\n      observe: false,\n      recall: true,\n      store: false,\n      search: true,\n      entities: false,\n      realtimeSync: false,\n      batch: false,\n      maxBudgetChars: 16000,\n      connectionType: \"mcp\",\n    },\n    configSchema: {\n      mcpServerUrl: \"URL of the MCP Remnic server\",\n    },\n    homepage: \"https://github.com/features/copilot\",\n    author: \"GitHub\",\n    tags: [\"official\", \"ai\", \"github\"],\n  },\n  {\n    id: \"roo-code\",\n    name: \"Roo Code\",\n    version: \"1.0.0\",\n    description: \"Roo Code — memory via MCP\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: true,\n      search: false,\n      entities: false,\n      realtimeSync: false,\n      batch: true,\n      maxBudgetChars: 16000,\n      connectionType: \"mcp\",\n    },\n    configSchema: {\n      mcpServerUrl: \"URL of the MCP Remnic server\",\n      namespace: \"Optional namespace\",\n    },\n    homepage: \"https://roocode.com\",\n    author: \"Roo Code\",\n    tags: [\"community\", \"vscode\"],\n  },\n  {\n    id: \"windsurf\",\n    name: \"Windsurf\",\n    version: \"1.0.0\",\n    description: \"Windsurf IDE — memory via MCP\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: true,\n      search: true,\n      entities: false,\n      realtimeSync: false,\n      batch: false,\n      maxBudgetChars: 32000,\n      connectionType: \"mcp\",\n    },\n    configSchema: {\n      mcpServerUrl: \"URL of the MCP Remnic server\",\n    },\n    homepage: \"https://windsurf.com\",\n    author: \"Codeium\",\n    tags: [\"official\", \"ide\"],\n  },\n  {\n    id: \"amp\",\n    name: \"Amp\",\n    version: \"1.0.0\",\n    description: \"Amp coding agent — memory via MCP\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: true,\n      search: true,\n      entities: false,\n      realtimeSync: false,\n      batch: false,\n      maxBudgetChars: 32000,\n      connectionType: \"mcp\",\n    },\n    configSchema: {\n      mcpServerUrl: \"URL of the MCP Remnic server\",\n    },\n    homepage: \"https://ampcode.com\",\n    author: \"Sourcegraph\",\n    tags: [\"official\", \"ai\"],\n  },\n  {\n    id: \"pi\",\n    name: \"Pi Coding Agent\",\n    version: \"1.0.0\",\n    description: \"Pi Coding Agent — native extension for recall, observe, MCP tools, and compaction coordination\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: true,\n      search: true,\n      entities: true,\n      realtimeSync: true,\n      batch: true,\n      maxBudgetChars: 32000,\n      connectionType: \"http\",\n    },\n    configSchema: {\n      remnicDaemonUrl: \"URL of the Remnic daemon (default: http://127.0.0.1:4318)\",\n      namespace: \"Optional namespace\",\n      installExtension: \"Install the Pi extension into ~/.pi/agent/extensions/remnic (default: true)\",\n    },\n    homepage: \"https://pi.dev\",\n    author: \"Remnic\",\n    tags: [\"official\", \"ai\", \"pi\", \"coding-agent\"],\n    requiresToken: true,\n  },\n  {\n    id: \"replit\",\n    name: \"Replit Agent\",\n    version: \"1.0.0\",\n    description: \"Replit Agent — memory via HTTP API (reduced capabilities)\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: true,\n      search: false,\n      entities: false,\n      realtimeSync: false,\n      batch: false,\n      maxBudgetChars: 8000,\n      connectionType: \"http\",\n    },\n    configSchema: {\n      apiUrl: \"URL of the Remnic HTTP API\",\n      authToken: \"Bearer token for authentication\",\n    },\n    homepage: \"https://replit.com\",\n    author: \"Replit\",\n    tags: [\"official\", \"cloud\"],\n    requiresToken: true,\n  },\n  {\n    id: \"generic-mcp\",\n    name: \"Generic MCP Client\",\n    version: \"1.0.0\",\n    description: \"Any MCP-compatible client — connect via standard MCP protocol\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: true,\n      search: true,\n      entities: true,\n      realtimeSync: true,\n      batch: true,\n      maxBudgetChars: 64000,\n      connectionType: \"mcp\",\n    },\n    configSchema: {\n      mcpServerUrl: \"URL of the MCP Remnic server\",\n      namespace: \"Optional namespace\",\n      authToken: \"Bearer token for authentication\",\n    },\n    homepage: \"https://github.com/joshuaswarren/remnic\",\n    author: \"Remnic\",\n    tags: [\"generic\", \"mcp\"],\n    requiresToken: true,\n  },\n  {\n    id: \"weclone\",\n    name: \"WeClone Avatar\",\n    version: \"1.0.0\",\n    description:\n      \"Memory-aware OpenAI-compatible proxy for deployed WeClone avatars — \" +\n      \"injects Remnic recall into chat completions and buffers turns via observe\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: false,\n      search: false,\n      entities: false,\n      realtimeSync: false,\n      batch: false,\n      maxBudgetChars: 32000,\n      connectionType: \"http\",\n    },\n    configSchema: {\n      wecloneApiUrl:\n        \"Base URL of the WeClone OpenAI-compatible API (e.g. http://localhost:8000/v1)\",\n      proxyPort: \"Local port where the memory proxy will listen (default 8100)\",\n      remnicDaemonUrl:\n        \"URL of the Remnic daemon exposing /engram/v1/recall and /engram/v1/observe\",\n      sessionStrategy:\n        \"Per-caller session mapping strategy: 'caller-id' | 'single'\",\n      wecloneModelName: \"Optional fine-tuned model name passed through to WeClone\",\n    },\n    homepage: \"https://github.com/xming521/weclone\",\n    author: \"Remnic\",\n    tags: [\"official\", \"ai\", \"weclone\", \"proxy\"],\n    requiresToken: true,\n  },\n  {\n    id: \"hermes\",\n    name: \"Hermes Agent\",\n    version: \"1.0.0\",\n    description: \"Hermes Agent MemoryProvider — automatic recall/observe on every turn via Python plugin protocol\",\n    capabilities: {\n      observe: true,\n      recall: true,\n      store: true,\n      search: true,\n      entities: false,\n      realtimeSync: true,\n      batch: false,\n      maxBudgetChars: 32000,\n      connectionType: \"http\",\n    },\n    configSchema: {\n      host: \"Remnic daemon host (default: 127.0.0.1)\",\n      port: \"Remnic daemon port (default: 4318)\",\n      profile: \"Hermes profile name (default: default)\",\n    },\n    homepage: \"https://github.com/joshuaswarren/remnic/tree/main/packages/plugin-hermes\",\n    author: \"Remnic\",\n    tags: [\"official\", \"python\", \"hermes\"],\n    requiresToken: true,\n  },\n];\n\n// ── Registry management ───────────────────────────────────────────────────\n\nconst REGISTRY_DIR_NAME = \".engram-connectors\";\n\nexport function getRegistryPath(): string {\n  const xdgConfigHome = readEnvVar(\"XDG_CONFIG_HOME\");\n  const configDir = xdgConfigHome\n    ? path.join(xdgConfigHome, \"engram\")\n    : path.join(resolveHomeDir(), \".config\", \"engram\");\n  return path.join(configDir, REGISTRY_DIR_NAME, \"registry.json\");\n}\n\nexport function loadRegistry(): ConnectorRegistry {\n  const regPath = getRegistryPath();\n\n  if (!fs.existsSync(regPath)) {\n    // First time — bootstrap with built-in connectors\n    const registry: ConnectorRegistry = {\n      connectors: BUILTIN_CONNECTORS,\n      registryPath: regPath,\n    };\n    saveRegistry(registry);\n    return registry;\n  }\n\n  const raw = fs.readFileSync(regPath, \"utf8\");\n  try {\n    const parsed = JSON.parse(raw);\n    // Built-ins always take precedence over persisted entries with the same ID.\n    // This ensures that upgraded manifests (e.g. newly-added requiresToken: true)\n    // are never shadowed by stale registry.json entries from an older version.\n    // Only connectors whose IDs are NOT in BUILTIN_CONNECTORS are preserved from\n    // the persisted file — those are genuine user-added custom connectors.\n    const builtinIds = new Set(BUILTIN_CONNECTORS.map((b) => b.id));\n    const customOnly = (parsed.connectors ?? []).filter((c: ConnectorManifest) => !builtinIds.has(c.id));\n    const merged = [...BUILTIN_CONNECTORS, ...customOnly];\n    return {\n      connectors: merged,\n      registryPath: regPath,\n    };\n  } catch {\n    const registry: ConnectorRegistry = {\n      connectors: BUILTIN_CONNECTORS,\n      registryPath: regPath,\n    };\n    saveRegistry(registry);\n    return registry;\n  }\n}\n\nexport function saveRegistry(registry: ConnectorRegistry): void {\n  const regPath = registry.registryPath;\n  fs.mkdirSync(path.dirname(regPath), { recursive: true });\n  fs.writeFileSync(regPath, JSON.stringify({ connectors: registry.connectors }, null, 2));\n}\n\n// ── List connectors ────────────────────────────────────────────────────────\n\nexport function listConnectors(): {\n  installed: ConnectorInstance[];\n  available: ConnectorManifest[];\n} {\n  const registry = loadRegistry();\n  const connectorsDir = getConnectorsDir();\n  const installedIds = new Set<string>();\n\n  // Find installed connectors\n  if (fs.existsSync(connectorsDir)) {\n    for (const entry of fs.readdirSync(connectorsDir)) {\n      if (entry.endsWith(\".json\")) {\n        try {\n          const config = JSON.parse(\n            fs.readFileSync(path.join(connectorsDir, entry), \"utf8\"),\n          );\n          installedIds.add(config.connectorId as string);\n        } catch {\n          // ignore malformed configs\n        }\n      }\n    }\n  }\n\n  // Mark installed vs available\n  const available: ConnectorManifest[] = registry.connectors.map((manifest) => ({\n    ...manifest,\n    installed: installedIds.has(manifest.id),\n  }));\n\n  // Build installed list\n  const installed: ConnectorInstance[] = [];\n  for (const id of installedIds) {\n    const configPath = path.join(connectorsDir, `${id}.json`);\n    try {\n      const raw = JSON.parse(fs.readFileSync(configPath, \"utf8\")) as Record<string, unknown>;\n      // Codex P1 (PRRT_kwDORJXyws56U9U0): strip any legacy `token` field from\n      // the returned config so that `remnic connectors list --json` never prints\n      // a bearer token — tokens live only in tokens.json. This handles existing\n      // on-disk connector.json files written by older Remnic versions without\n      // rewriting user files.\n      const { token: _redacted, ...config } = raw;\n      installed.push({\n        connectorId: id,\n        config,\n        status: \"installed\",\n        installedAt: raw.installedAt as string | undefined,\n      });\n    } catch {\n      // ignore\n    }\n  }\n\n  return { installed, available };\n}\n\n// ── Get connector token ────────────────────────────────────────────────────\n// Codex P1 (PRRT_kwDORJXyws56U9U0): tokens are stored exclusively in\n// tokens.json. This helper is the canonical way to retrieve the bearer token\n// for a connector — connector.json never contains it.\n\nexport function getConnectorToken(connectorId: string): string | undefined {\n  try {\n    return loadTokenStore().tokens.find((t) => t.connector === connectorId)?.token;\n  } catch {\n    return undefined;\n  }\n}\n\nfunction readSavedConnectorConfig(configPath: string): Record<string, unknown> {\n  if (!fs.existsSync(configPath)) return {};\n  try {\n    const parsed = JSON.parse(fs.readFileSync(configPath, \"utf8\"));\n    if (!parsed || typeof parsed !== \"object\" || Array.isArray(parsed)) return {};\n    const {\n      connectorId: _connectorId,\n      installedAt: _installedAt,\n      token: _token,\n      ...config\n    } = parsed as Record<string, unknown>;\n    return config;\n  } catch {\n    return {};\n  }\n}\n\nfunction removeClearedSavedConnectorConfig(\n  savedConnectorConfig: Record<string, unknown>,\n  rawUserConfig: Record<string, unknown>,\n): Record<string, unknown> {\n  const merged: Record<string, unknown> = { ...savedConnectorConfig };\n  for (const [key, value] of Object.entries(rawUserConfig)) {\n    if (value === undefined || value === null || value === \"\") {\n      delete merged[key];\n    }\n  }\n  return merged;\n}\n\nfunction compactConnectorConfigOverrides(rawUserConfig: Record<string, unknown>): Record<string, unknown> {\n  const safeUserConfig: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(rawUserConfig)) {\n    if (value === undefined || value === null || value === \"\") continue;\n    safeUserConfig[key] = value;\n  }\n  return safeUserConfig;\n}\n\n// ── Install connector ───────────────────────────────────────────────────────\n\nexport function installConnector(options: InstallOptions): InstallResult {\n  const registry = loadRegistry();\n  const manifest = registry.connectors.find((c) => c.id === options.connectorId);\n\n  if (!manifest) {\n    return {\n      connectorId: options.connectorId,\n      status: \"error\",\n      message: `Unknown connector: ${options.connectorId}`,\n    };\n  }\n\n  // Check if already installed\n  const existing = listConnectors().installed.find(\n    (c) => c.connectorId === options.connectorId,\n  );\n\n  if (existing && !options.force) {\n    return {\n      connectorId: options.connectorId,\n      status: \"already_installed\",\n      message: \"Already installed. Use --force to reinstall.\",\n    };\n  }\n\n  // Write config\n  const configDir = getConnectorsDir();\n  fs.mkdirSync(configDir, { recursive: true });\n\n  const configPath = path.join(configDir, `${options.connectorId}.json`);\n  const savedConnectorConfig = existing ? readSavedConnectorConfig(configPath) : {};\n\n  // For the hermes connector, resolve profile/host/port with the following\n  // precedence: saved-connector-JSON → explicit options.config → defaults.\n  // Reading happens BEFORE we overwrite the connector JSON so that a\n  // force-reinstall without re-supplied --config options preserves the\n  // previously configured values and writes the new token to the correct\n  // Hermes profile rather than resetting to \"default\"/127.0.0.1/4318.\n  //\n  // Issue C fix: sanitizer calls during options resolution are wrapped in\n  // try-catch so that invalid user-supplied values (e.g. --config port=abc)\n  // return a clean failed InstallResult instead of throwing.\n  let hermesSavedProfile: string | undefined;\n  let hermesSavedHost: string | undefined;\n  let hermesSavedPort: number | undefined;\n  // Resolved values (used both in resolvedConfig and in the YAML update below)\n  let hermesResolvedProfile: string | undefined;\n  let hermesResolvedHost: string | undefined;\n  let hermesResolvedPort: number | undefined;\n  if (options.connectorId === \"hermes\") {\n    if (fs.existsSync(configPath)) {\n      try {\n        const prev = JSON.parse(fs.readFileSync(configPath, \"utf8\"));\n        // Fix 2: coerce saved values through sanitizers so that CLI-written\n        // string ports (\"5555\") are accepted just like number ports (5555).\n        // Pass each through its sanitizer and fall back to undefined on error\n        // so a corrupt saved value doesn't prevent install from defaulting.\n        if (prev?.profile != null) {\n          try {\n            hermesSavedProfile = sanitizeHermesProfile(String(prev.profile));\n          } catch {\n            // Invalid saved profile — fall through to default\n          }\n        }\n        if (prev?.host != null) {\n          try {\n            hermesSavedHost = sanitizeHermesHost(String(prev.host));\n          } catch {\n            // Invalid saved host — fall through to default\n          }\n        }\n        if (prev?.port != null) {\n          try {\n            const coercedPort = Number(String(prev.port));\n            hermesSavedPort = sanitizeHermesPort(coercedPort);\n          } catch {\n            // Invalid saved port — fall through to default\n          }\n        }\n      } catch {\n        // Could not read existing config — fall through to defaults\n      }\n    }\n    // Use saved/default values here; user-supplied profile/host are validated\n    // and applied in the sanitization block below (single point of validation).\n    hermesResolvedProfile = hermesSavedProfile ?? \"default\";\n    hermesResolvedHost = hermesSavedHost ?? \"127.0.0.1\";\n\n    // Issue C: wrap sanitizeHermesPort (and profile/host) in try-catch so\n    // that invalid user-supplied values return a clean error result.\n    if (options.config?.port !== undefined) {\n      try {\n        hermesResolvedPort = sanitizeHermesPort(Number(String(options.config.port)));\n      } catch (err) {\n        return {\n          connectorId: options.connectorId,\n          status: \"error\",\n          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`,\n        };\n      }\n    }\n    if (hermesResolvedPort === undefined) {\n      hermesResolvedPort = hermesSavedPort ?? 4318;\n    }\n\n    // Also validate user-supplied profile and host up-front (Issue C coverage).\n    if (options.config?.profile !== undefined) {\n      try {\n        hermesResolvedProfile = sanitizeHermesProfile(String(options.config.profile));\n      } catch (err) {\n        return {\n          connectorId: options.connectorId,\n          status: \"error\",\n          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`,\n        };\n      }\n    }\n    if (options.config?.host !== undefined) {\n      try {\n        hermesResolvedHost = sanitizeHermesHost(String(options.config.host));\n      } catch (err) {\n        return {\n          connectorId: options.connectorId,\n          status: \"error\",\n          message: `Invalid Hermes config: ${err instanceof Error ? err.message : String(err)}`,\n        };\n      }\n    }\n  }\n\n  // Generate a per-connector auth token so the daemon can authenticate\n  // requests from this connector.\n  //\n  // Security gate (PRRT_kwDORJXyws56U9U0 round 6): tokens are ONLY generated\n  // and persisted to tokens.json for connectors that actually require bearer-token\n  // auth (manifest.requiresToken === true). MCP, CLI, embedded, and SDK connectors\n  // never need a token entry on disk — generating one unconditionally materialized\n  // credentials for connectors that have no auth requirement, a security regression.\n  //\n  // For hermes (Issue B fix): use buildTokenEntry() to generate a candidate\n  // token WITHOUT immediately persisting it to tokens.json. We commit the\n  // candidate to the store only AFTER upsertHermesConfig succeeds, so that\n  // a failed or skipped config.yaml write never leaves the daemon with a\n  // revoked token and no valid replacement written.\n  //\n  // For other connectors that requiresToken: generateToken() is idempotent —\n  // it filters the old entry and writes a fresh one atomically, so force-reinstall\n  // produces a new token automatically.\n  //\n  // Token write errors (e.g. read-only HOME with writable XDG_CONFIG_HOME)\n  // are non-fatal: we degrade gracefully and proceed with the connector\n  // config write rather than aborting the whole install.\n  //\n  // For non-Hermes connectors that requiresToken: snapshot the FULL token store\n  // BEFORE generateToken() so that if the connector JSON write later fails, we\n  // can restore the store to its pre-install state (UXJG fix — non-Hermes atomic\n  // rollback). Using a full-store snapshot (not a single-entry snapshot) ensures\n  // that a partial write of tokens.json during generateToken can be unwound\n  // atomically, covering both fresh-install and force-reinstall cases uniformly.\n  const nonHermesPriorTokenStore = (options.connectorId !== \"hermes\" && manifest.requiresToken)\n    ? loadTokenStore()\n    : null;\n\n  let tokenEntry: ReturnType<typeof generateToken> | null = null;\n  if (options.connectorId === \"hermes\") {\n    // Build a candidate token; do NOT save yet (Issue B).\n    try {\n      tokenEntry = buildTokenEntry(options.connectorId);\n    } catch {\n      // Non-fatal: fall through with tokenEntry === null.\n    }\n  } else if (manifest.requiresToken) {\n    // Only generate and persist a token entry for connectors that need token auth.\n    try {\n      tokenEntry = generateToken(options.connectorId);\n    } catch {\n      // Non-fatal: token store unavailable. Connector config will still be\n      // written; user can run `remnic token generate <id>` to create the token.\n      //\n      // Roll back the snapshot so that a partial write of tokens.json during\n      // generateToken (e.g. ENOSPC/EIO mid-write) does not leave other\n      // connectors' auth state corrupted. Best-effort: if the restore itself\n      // fails there is nothing more we can do here, but the error is swallowed\n      // so install continues in the same degraded (tokenEntry === null) path\n      // as before (PRRT_kwDORJXyws56UleN fix).\n      if (nonHermesPriorTokenStore !== null) {\n        try {\n          saveTokenStore(nonHermesPriorTokenStore);\n        } catch {\n          // Best-effort: snapshot restore failed; caller sees degraded install.\n        }\n      }\n    }\n  }\n  // else: connector does not require token auth — tokenEntry stays null and\n  // tokens.json is never touched for this connector.\n\n  // Thread 2 (PRRT_kwDORJXyws56VYwM): if the connector requires token auth but\n  // generateToken threw (tokenEntry is still null), abort now instead of\n  // continuing with a broken install that returns \"success\" without a valid token.\n  if (options.connectorId !== \"hermes\" && manifest.requiresToken && tokenEntry === null) {\n    return {\n      connectorId: options.connectorId,\n      status: \"error\",\n      message:\n        `${manifest.name} install aborted: token generation failed. ` +\n        `Run \\`remnic token generate ${options.connectorId}\\` to create the token, then reinstall.`,\n    };\n  }\n\n  // Build config from saved values + user overrides.\n  // Codex P1 (PRRT_kwDORJXyws56U9U0): tokens MUST NOT be written into\n  // connector.json. The authoritative store is tokens.json (0o600). Writing the\n  // token here created a second, unredacted copy that `remnic connectors list\n  // --json` printed verbatim, leaking live bearer tokens into shell history, CI\n  // logs, and telemetry. Callers needing the token for a specific connector\n  // must use loadTokenStore() and find the entry by connectorId directly.\n  //\n  // For hermes, include the resolved profile/host/port so that future\n  // force-reinstalls can read them back even if options.config is not supplied.\n  //\n  // Strip any stray `token` key the caller may have supplied via options.config\n  // so it cannot be persisted to disk even on legacy call paths.\n  const { token: _callerToken, ...rawUserConfig } = (options.config ?? {}) as Record<string, unknown>;\n  const savedConnectorConfigForMerge = removeClearedSavedConnectorConfig(savedConnectorConfig, rawUserConfig);\n  const safeUserConfig = compactConnectorConfigOverrides(rawUserConfig);\n  const resolvedConfig: Record<string, unknown> = {\n    ...savedConnectorConfigForMerge,\n    ...safeUserConfig,\n    connectorId: options.connectorId,\n    installedAt: new Date().toISOString(),\n    // For hermes, always overlay the sanitized/coerced resolved values so that\n    // the connector JSON always has a numeric port and validated profile/host.\n    // This also ensures options.config string values (from --config=port=5555)\n    // are replaced with their sanitized numeric equivalents (Fix 2 root cause).\n    ...(hermesResolvedProfile !== undefined ? {\n      profile: hermesResolvedProfile,\n      host: hermesResolvedHost,\n      port: hermesResolvedPort,\n    } : {}),\n  };\n\n  // ── Hermes atomic install flow ─────────────────────────────────────────────\n  // The Hermes install sequence must be atomic: connector.json must only be\n  // written if and only if both the YAML write AND the token-store commit\n  // succeed. Partial failures must leave the prior state intact so the daemon\n  // keeps working with the old token.\n  //\n  // Step order (all-or-nothing):\n  //   a. Generate token candidate (buildTokenEntry, no store write yet).\n  //   b. Validate profile (fail-fast).\n  //   c. Write config.yaml via upsertHermesConfig — if skipped (missing dir)\n  //      or throws, abort with status \"error\". Old token is NOT revoked.\n  //   d. Commit new token to tokens.json — if this throws, rollback the YAML\n  //      write (restore prior content or delete new file) and abort.\n  //   e. Write connector.json only after both (c) and (d) succeed.\n  //   f. Health check — gated on committed === true && tokenEntry != null.\n  //\n  // Non-Hermes connectors: connector.json is written immediately (no YAML\n  // dependency) and the health check is not performed.\n\n  if (options.connectorId === \"hermes\") {\n    // hermesResolvedProfile/Host/Port were computed above using the correct\n    // precedence (saved JSON → explicit options.config → defaults).\n    const rawProfile = hermesResolvedProfile!;\n    const hermesHost = hermesResolvedHost!;\n    const hermesPort = hermesResolvedPort!;\n\n    // (b) Validate profile name — fail-fast before touching any files.\n    let hermesProfile: string;\n    try {\n      hermesProfile = sanitizeHermesProfile(rawProfile);\n    } catch (err) {\n      return {\n        connectorId: options.connectorId,\n        status: \"error\",\n        message: `Hermes install aborted: ${err instanceof Error ? err.message : String(err)}`,\n      };\n    }\n\n    // Token generation is required for an atomic Hermes install.\n    if (!tokenEntry) {\n      return {\n        connectorId: options.connectorId,\n        status: \"error\",\n        message:\n          \"Hermes install aborted: token store unavailable. \" +\n          \"Run `remnic token generate hermes` then reinstall to complete setup.\",\n      };\n    }\n\n    // (c) Write config.yaml. If the profile dir does not exist (skipped) or\n    // the write throws, abort WITHOUT committing the token or writing connector.json.\n    let yamlResult: HermesConfigResult;\n    try {\n      yamlResult = upsertHermesConfig({\n        profile: hermesProfile,\n        host: hermesHost,\n        port: hermesPort,\n        token: tokenEntry.token,\n      });\n    } catch (err) {\n      // upsertHermesConfig threw — old token preserved, connector.json unchanged.\n      return {\n        connectorId: options.connectorId,\n        status: \"error\",\n        message: `Hermes install aborted: config.yaml write failed — ${err instanceof Error ? err.message : String(err)}`,\n      };\n    }\n\n    if (!yamlResult.updated) {\n      // Skipped (profile dir missing) — abort so connector.json is NOT written\n      // with a token the daemon won't recognize (the profile doesn't exist).\n      // Preserves any prior Hermes profile/connector.json untouched.\n      return {\n        connectorId: options.connectorId,\n        status: \"error\",\n        message: `Hermes install aborted: ${yamlResult.reason ?? \"config.yaml not written\"}. ` +\n          `Create the Hermes profile directory first, then reinstall.`,\n      };\n    }\n\n    // (d) Commit token to tokens.json. If this fails, roll back the YAML write\n    // and abort — the old token must remain valid and connector.json must stay\n    // unchanged so the daemon keeps working.\n    //\n    // IMPORTANT (UXJI/UXJT): Snapshot the FULL token store BEFORE calling\n    // commitTokenEntry(). A single-entry approach (capturing the return value\n    // of commitTokenEntry) is insufficient: if commitTokenEntry throws mid-write\n    // (e.g. ENOSPC truncating tokens.json), the assignment never completes and\n    // the rollback becomes a no-op, leaving tokens.json potentially corrupt.\n    // The full-store snapshot, captured before the write attempt, is guaranteed\n    // clean and can be written back atomically by saveTokenStore.\n    const priorTokenStore = loadTokenStore();\n    let committed = false;\n    try {\n      commitTokenEntry(tokenEntry);\n      committed = true;\n    } catch (commitErr) {\n      // Roll back the token store: restore the full snapshot so a partial write\n      // (e.g. ENOSPC truncating tokens.json mid-write) cannot leave the store\n      // corrupt or missing the prior hermes entry.\n      let tokensRolledBack = true;\n      let tokensRollbackErrMsg = \"\";\n      try {\n        saveTokenStore(priorTokenStore);\n      } catch (tokenRestoreErr) {\n        tokensRolledBack = false;\n        tokensRollbackErrMsg = tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);\n      }\n      // Roll back the YAML write: restore prior content (or delete newly-created file).\n      let yamlRolledBack = true;\n      let yamlRollbackErrMsg = \"\";\n      try {\n        if (yamlResult.priorContent === null) {\n          // File was created new — remove it entirely.\n          fs.unlinkSync(yamlResult.configPath);\n        } else if (typeof yamlResult.priorContent === \"string\") {\n          // File existed before — restore original content.\n          writeSecretFileSync(yamlResult.configPath, yamlResult.priorContent);\n        }\n      } catch (yamlRestoreErr) {\n        yamlRolledBack = false;\n        yamlRollbackErrMsg = yamlRestoreErr instanceof Error ? yamlRestoreErr.message : String(yamlRestoreErr);\n      }\n      // Build an error message that accurately reflects which rollbacks succeeded.\n      const commitErrMsg = commitErr instanceof Error ? commitErr.message : String(commitErr);\n      let message: string;\n      if (tokensRolledBack && yamlRolledBack) {\n        message =\n          `Hermes install failed during token commit — ` +\n          `${commitErrMsg}. ` +\n          `config.yaml and tokens.json restored to prior state. ` +\n          `Resolve the tokens.json access issue, then reinstall.`;\n      } else if (!yamlRolledBack && tokensRolledBack) {\n        message =\n          `Hermes install failed during token commit — ` +\n          `${commitErrMsg}. ` +\n          `tokens.json restored but config.yaml rollback ALSO failed ` +\n          `(${yamlRollbackErrMsg}). ` +\n          `Hermes daemon may be in an inconsistent state: config references a stale token. ` +\n          `Manually inspect ${yamlResult.configPath} and reinstall.`;\n      } else if (yamlRolledBack && !tokensRolledBack) {\n        message =\n          `Hermes install failed during token commit — ` +\n          `${commitErrMsg}. ` +\n          `config.yaml restored but tokens.json rollback ALSO failed ` +\n          `(${tokensRollbackErrMsg}). ` +\n          `Hermes daemon may be in an inconsistent state: tokens.json is corrupt or incomplete. ` +\n          `Manually inspect ~/.remnic/tokens.json and reinstall.`;\n      } else {\n        message =\n          `Hermes install failed during token commit — ` +\n          `${commitErrMsg}. ` +\n          `BOTH rollbacks failed: config.yaml rollback failed (${yamlRollbackErrMsg}); ` +\n          `tokens.json rollback failed (${tokensRollbackErrMsg}). ` +\n          `Hermes daemon is likely in an inconsistent state. ` +\n          `Manually inspect ${yamlResult.configPath} ` +\n          `and ~/.remnic/tokens.json, then reinstall.`;\n      }\n      return {\n        connectorId: options.connectorId,\n        status: \"error\",\n        message,\n      };\n    }\n\n    // (e) Both YAML write and token commit succeeded — now attempt to write connector.json.\n    // If this write fails (e.g. connectors dir is not writable), roll back Phase D (token\n    // commit) and Phase C (YAML upsert) so no partial-install state is left behind.\n    // We restore the full token store snapshot captured before Phase D so that\n    // tokens.json is guaranteed consistent with the rolled-back config.yaml.\n    try {\n      writeSecretFileSync(configPath, JSON.stringify(resolvedConfig, null, 2));\n    } catch (writeErr) {\n      // Roll back Phase D: restore the full token store snapshot so tokens.json\n      // is consistent with the rolled-back config.yaml.\n      let tokenRollbackFailed = false;\n      let tokenRollbackMsg = \"token store restored to pre-install snapshot\";\n      try {\n        saveTokenStore(priorTokenStore);\n      } catch (tokenRestoreErr) {\n        tokenRollbackFailed = true;\n        tokenRollbackMsg = `token rollback failed: ${tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr)}`;\n      }\n      // Roll back Phase C: restore config.yaml to its prior content.\n      let yamlRollbackMsg = \"config.yaml restored\";\n      try {\n        if (yamlResult.priorContent === null) {\n          // File was created new — delete it.  Track whether the unlink actually\n          // succeeded so we report honestly rather than claiming removal when it\n          // silently failed inside the inner catch.\n          let unlinkSucceeded = false;\n          let unlinkErr: unknown;\n          try {\n            fs.unlinkSync(yamlResult.configPath);\n            unlinkSucceeded = true;\n          } catch (err) {\n            unlinkErr = err;\n          }\n          if (unlinkSucceeded) {\n            yamlRollbackMsg = \"config.yaml removed (was newly created)\";\n          } else {\n            const unlinkMsg = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);\n            yamlRollbackMsg = `config.yaml rollback failed: could not remove newly-created file — ${unlinkMsg}`;\n          }\n        } else if (typeof yamlResult.priorContent === \"string\") {\n          writeSecretFileSync(yamlResult.configPath, yamlResult.priorContent);\n          yamlRollbackMsg = \"config.yaml restored to prior content\";\n        }\n      } catch (yamlRollbackErr) {\n        yamlRollbackMsg = `config.yaml rollback failed: ${yamlRollbackErr instanceof Error ? yamlRollbackErr.message : String(yamlRollbackErr)}`;\n      }\n      const urgentSuffix = tokenRollbackFailed\n        ? ` tokens.json may be in an inconsistent state — manually restore hermes token with 'remnic token generate hermes'.`\n        : \"\";\n      return {\n        connectorId: options.connectorId,\n        status: \"error\",\n        message:\n          `Hermes install aborted: connector config write failed — ` +\n          `connector directory may not be writable. ` +\n          `Rollback: ${tokenRollbackMsg}; ${yamlRollbackMsg}.` +\n          `${urgentSuffix} Resolve the permission issue, then reinstall.`,\n      };\n    }\n\n    const notes: string[] = [];\n    notes.push(`Updated Hermes config: ${yamlResult.configPath}`);\n\n    // If a migrated default-profile install now writes to Hermes' root config,\n    // remove stale Remnic credentials from the legacy default profile file too.\n    if (hermesProfile === \"default\") {\n      const legacyDefaultConfigPath = hermesDefaultProfileConfigPath();\n      if (!sameHermesConfigTarget(yamlResult.configPath, legacyDefaultConfigPath)) {\n        try {\n          const legacyDefaultCleanResult = removeHermesConfigFile(legacyDefaultConfigPath);\n          if (legacyDefaultCleanResult.updated) {\n            notes.push(`Cleaned stale remnic: block from legacy default profile: ${legacyDefaultConfigPath}`);\n          }\n        } catch {\n          notes.push(\"Note: could not clean stale remnic: block from legacy default profile\");\n        }\n      }\n    }\n\n    // Clean up the old profile's remnic: block if the profile changed.\n    // Compare resolved config paths (not raw strings) so that case-insensitive\n    // filesystems (macOS default) don't treat \"Research\" and \"research\" as\n    // different profiles — resolving both would yield the same config.yaml,\n    // and removing it would strip the block we just wrote (PRRT_kwDORJXyws56VQ76).\n    let oldProfileResolvesToDifferentFile = false;\n    if (hermesSavedProfile !== undefined) {\n      try {\n        oldProfileResolvesToDifferentFile =\n          !sameHermesConfigTarget(hermesConfigPath(hermesSavedProfile), hermesConfigPath(hermesProfile));\n      } catch {\n        // If either profile fails sanitization the comparison is moot; skip cleanup.\n        oldProfileResolvesToDifferentFile = false;\n      }\n    }\n    if (oldProfileResolvesToDifferentFile) {\n      try {\n        const oldCleanResult = removeHermesConfig({ profile: hermesSavedProfile! });\n        if (oldCleanResult.updated) {\n          notes.push(`Cleaned stale remnic: block from previous profile: ${oldCleanResult.configPath}`);\n        }\n      } catch {\n        // Non-fatal: if we can't clean the old profile, log a note but don't fail.\n        notes.push(`Note: could not clean stale remnic: block from previous profile \"${hermesSavedProfile}\"`);\n      }\n    }\n\n    // (f) Health check — only when the token was actually committed to the store.\n    // Without commitment, the daemon won't recognise the token → 401 → 6s sleep\n    // → false-negative \"Daemon not reachable\". committed is always true here\n    // (we returned early on failure above) but the explicit guard is kept for\n    // clarity and future robustness.\n    if (committed && tokenEntry) {\n      const daemonOk = checkDaemonHealth(hermesHost, hermesPort, tokenEntry.token);\n      if (daemonOk) {\n        notes.push(\"Daemon health check: OK\");\n      } else {\n        notes.push(\n          `Daemon not reachable at ${hermesHost}:${hermesPort} — start with: remnic daemon start`,\n        );\n      }\n    }\n\n    const suffix = notes.length > 0 ? `\\n  ${notes.join(\"\\n  \")}` : \"\";\n    return {\n      connectorId: options.connectorId,\n      status: \"installed\",\n      configPath,\n      message: `Installed ${manifest.name} v${manifest.version}${suffix}`,\n    };\n  }\n\n  // ── Non-Hermes connectors: write connector.json ───────────────────────────\n  // Write with owner-only permissions because the JSON may embed the\n  // connector bearer token. Matches the 0o600 hardening on\n  // ~/.remnic/tokens.json so the token is never world-readable via this\n  // secondary location.\n\n  // Codex CLI: also drop the phase-2 memory extension unless the caller\n  // explicitly opted out via `config.installExtension: false`.\n  let extensionMessage = \"\";\n  // Explicit structured flag for the config-write rollback gate. This MUST\n  // stay decoupled from `extensionMessage` because that string embeds the\n  // install path — substring-matching on \"skipped\" would misfire whenever\n  // the codex home happens to contain the word \"skipped\".\n  let extensionInstalled = false;\n  // Holds the commit/rollback handle returned by installCodexMemoryExtension().\n  // The backup of any prior extension is kept alive until commit() is called.\n  let extensionHandle: { commit(): void; rollback(): void } | null = null;\n  if (options.connectorId === \"codex-cli\") {\n    // Finding 1: coerce string \"false\"/\"true\" from CLI config parsing to a real\n    // boolean before the gate check, then persist the coerced value so it is\n    // stored as a boolean in the config file.\n    const coerced = coerceInstallExtension(resolvedConfig.installExtension);\n    if (coerced !== undefined) {\n      resolvedConfig.installExtension = coerced;\n    }\n    const shouldInstall = resolvedConfig.installExtension !== false;\n    // Persist the effective installExtension boolean explicitly so that\n    // removeConnector's provenance check (Finding 3) can match. When the caller\n    // did not pass the key, the default is true — write it so later removal\n    // knows Remnic owned the install.\n    resolvedConfig.installExtension = shouldInstall;\n    // Resolve the Codex home path NOW so we can persist the absolute path\n    // into the saved config. This guarantees removeConnector can target the\n    // exact same directory later even if $CODEX_HOME is unset or changed.\n    const codexHomeOverride =\n      typeof resolvedConfig.codexHome === \"string\" && resolvedConfig.codexHome.length > 0\n        ? (resolvedConfig.codexHome as string)\n        : null;\n    const resolvedCodexHome = resolveCodexHome(codexHomeOverride);\n    resolvedConfig.codexHome = resolvedCodexHome;\n\n    if (shouldInstall) {\n      try {\n        const extensionSourceOverride =\n          typeof resolvedConfig.extensionSourceDir === \"string\" &&\n          resolvedConfig.extensionSourceDir.length > 0\n            ? (resolvedConfig.extensionSourceDir as string)\n            : null;\n        const extResult = installCodexMemoryExtension({\n          codexHome: resolvedCodexHome,\n          sourceDir: extensionSourceOverride,\n        });\n        extensionMessage = ` (memory extension: ${extResult.remnicExtensionDir})`;\n        extensionInstalled = true;\n        extensionHandle = extResult;\n      } catch (err) {\n        const errMsg = err instanceof Error ? err.message : \"unknown error\";\n        // Codex P2 (PRRT_kwDORJXyws56Ur_G): generateToken already rotated\n        // tokens.json before reaching this point. The extension threw, so no\n        // connector.json was written — roll back the token store to the\n        // pre-install snapshot so tokens.json and the absent connector.json\n        // stay consistent (no orphaned/active token without a matching config).\n        //\n        // Initialize to false: only set true once saveTokenStore() succeeds.\n        // For connectors without requiresToken the rollback block is skipped\n        // entirely, so the suffix must remain absent — not \"Token has been\n        // rolled back.\" (which would be factually incorrect).\n        let extensionErrTokenRolledBack = false;\n        let extensionErrTokenRollbackMsg = \"\";\n        if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {\n          try {\n            saveTokenStore(nonHermesPriorTokenStore);\n            extensionErrTokenRolledBack = true;\n          } catch (tokenRestoreErr) {\n            extensionErrTokenRolledBack = false;\n            extensionErrTokenRollbackMsg =\n              tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);\n          }\n        }\n        // Only include a token-rollback suffix for connectors that have a token\n        // to roll back. Non-token connectors (requiresToken !== true) never\n        // generated a token entry, so no rollback occurred and the message must\n        // not claim otherwise.\n        const tokenRollbackSuffix = manifest.requiresToken\n          ? extensionErrTokenRolledBack\n            ? \" Token has been rolled back.\"\n            : ` Token rollback FAILED (${extensionErrTokenRollbackMsg}) — tokens.json may contain an orphaned entry. ` +\n              `Manually inspect ~/.remnic/tokens.json and reinstall.`\n          : \"\";\n        return {\n          connectorId: options.connectorId,\n          status: \"error\",\n          message: `Memory extension install failed — ${errMsg}.${tokenRollbackSuffix} Resolve the issue, then reinstall.`,\n        };\n      }\n    } else {\n      extensionMessage = \" (memory extension: skipped via installExtension=false)\";\n    }\n  }\n\n  // ── WeClone: write proxy config to ~/.remnic/connectors/weclone.json ─────\n  //\n  // The standalone `remnic-weclone-proxy` CLI (see packages/connector-weclone)\n  // reads its config from ~/.remnic/connectors/weclone.json by default so the\n  // proxy can start without depending on Remnic's XDG-scoped registry layout.\n  // Compose and write that file here, BEFORE the registry connector.json is\n  // written, so that a failure in either file's write path rolls back cleanly.\n  //\n  // Precedence for each field: user-supplied via --config → saved prior proxy\n  // config (on --force) → manifest defaults. The generated bearer token (if\n  // any) is persisted into remnicAuthToken so the proxy can authenticate with\n  // the daemon without a second token lookup at runtime.\n  let weCloneProxyHandleRollback: (() => void) | null = null;\n  if (options.connectorId === \"weclone\") {\n    try {\n      // Force-reinstall (and any reinstall path) must keep using the exact\n      // proxy config path that was persisted on the previous install. If we\n      // re-derive from the current env each time, a user whose REMNIC_HOME /\n      // ENGRAM_HOME changed between installs would end up with two proxy\n      // config files — the old one stays with stale settings + a revoked\n      // token, the new one gets the live token, and any running proxy still\n      // reading the old file starts failing auth. Read the saved\n      // `proxyConfigPath` from the existing registry config first, and only\n      // fall back to env-derivation for genuine first-time installs.\n      let proxyConfigPath: string | null = null;\n      if (existing && fs.existsSync(configPath)) {\n        try {\n          const savedRegistryConfig = JSON.parse(fs.readFileSync(configPath, \"utf8\")) as Record<string, unknown>;\n          if (\n            typeof savedRegistryConfig.proxyConfigPath === \"string\" &&\n            savedRegistryConfig.proxyConfigPath.length > 0\n          ) {\n            proxyConfigPath = savedRegistryConfig.proxyConfigPath;\n          }\n        } catch {\n          // Saved registry config unreadable — fall through to env resolution.\n        }\n      }\n      if (proxyConfigPath === null) {\n        proxyConfigPath = resolveWeCloneProxyConfigPath();\n      }\n      const prior = readWeCloneProxyConfigIfExists(proxyConfigPath);\n      const proxyConfig = buildWeCloneProxyConfig({\n        userConfig: safeUserConfig,\n        priorConfig: prior ? safeParseJson(prior) : null,\n        authToken: tokenEntry?.token,\n      });\n      fs.mkdirSync(path.dirname(proxyConfigPath), { recursive: true });\n      // Install the rollback closure BEFORE the write starts. `writeSecretFileSync`\n      // opens the file in truncate mode, so a mid-write failure (ENOSPC, EPERM)\n      // could leave `weclone.json` empty. Creating the rollback now guarantees\n      // we can always restore prior content (or delete a newly-created file)\n      // even if the write itself throws.\n      weCloneProxyHandleRollback = () => {\n        try {\n          if (prior === null) {\n            // File was created (or would have been created) by this install —\n            // delete whatever is left behind, if anything.\n            if (fs.existsSync(proxyConfigPath)) {\n              fs.unlinkSync(proxyConfigPath);\n            }\n          } else {\n            writeSecretFileSync(proxyConfigPath, prior);\n          }\n        } catch {\n          // Best-effort rollback.\n        }\n      };\n      try {\n        writeSecretFileSync(\n          proxyConfigPath,\n          JSON.stringify(proxyConfig, null, 2),\n        );\n      } catch (writeErr) {\n        // Truncate-and-write failed partway through — restore the file (or\n        // remove the empty partial) and re-throw so the outer catch drives\n        // the structured error response + token rollback.\n        try {\n          weCloneProxyHandleRollback();\n        } catch {\n          // Best-effort.\n        }\n        weCloneProxyHandleRollback = null;\n        throw writeErr;\n      }\n      // Record the proxy-side config path on the registry JSON so operators\n      // and `remnic connectors doctor weclone` can locate it later. Persist the\n      // effective proxy port so `remnic connectors list` reflects the resolved\n      // value rather than whatever (possibly missing) the user supplied.\n      resolvedConfig.proxyConfigPath = proxyConfigPath;\n      resolvedConfig.proxyPort = proxyConfig.proxyPort;\n      resolvedConfig.wecloneApiUrl = proxyConfig.wecloneApiUrl;\n      resolvedConfig.remnicDaemonUrl = proxyConfig.remnicDaemonUrl;\n      resolvedConfig.sessionStrategy = proxyConfig.sessionStrategy;\n    } catch (weCloneErr) {\n      // Track token rollback success/failure explicitly so the error message\n      // can truthfully report whether tokens.json was restored or is in a\n      // potentially-inconsistent state. Mirrors the care taken in the\n      // registry-config-write failure handler below.\n      let tokenRolledBack = false;\n      let tokenRollbackMsg = \"\";\n      if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {\n        try {\n          saveTokenStore(nonHermesPriorTokenStore);\n          tokenRolledBack = true;\n        } catch (tokenRestoreErr) {\n          tokenRolledBack = false;\n          tokenRollbackMsg =\n            tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);\n        }\n      }\n      const tokenSuffix = manifest.requiresToken && tokenEntry !== null\n        ? tokenRolledBack\n          ? \" Token has been rolled back.\"\n          : ` Token rollback FAILED (${tokenRollbackMsg}) — tokens.json may contain an orphaned entry. ` +\n            `Manually inspect ~/.remnic/tokens.json and reinstall.`\n        : \"\";\n      return {\n        connectorId: options.connectorId,\n        status: \"error\",\n        message:\n          `WeClone install aborted: proxy config write failed — ` +\n          `${weCloneErr instanceof Error ? weCloneErr.message : String(weCloneErr)}.` +\n          `${tokenSuffix} Resolve the write permission issue on ~/.remnic/connectors/, then reinstall.`,\n      };\n    }\n  }\n\n  // Finding 5: strip internal/test-only keys that must never be persisted to\n  // the config file. These keys are used at install time only (e.g. to inject\n  // a synthetic extension source dir in tests) and have no meaning on disk.\n  // Denylist — add any future test-only keys here with a comment.\n  const INTERNAL_KEYS_DENYLIST = [\n    \"extensionSourceDir\", // test-only override for the plugin-codex source path\n  ];\n  for (const key of INTERNAL_KEYS_DENYLIST) {\n    delete resolvedConfig[key];\n  }\n\n  // Atomic rollback (UXJG / Codex P1): if the JSON write fails (e.g., permission\n  // denied on XDG_CONFIG_HOME), generateToken() above already rotated the token in\n  // tokens.json. Roll back via the full-store snapshot captured before generateToken\n  // so tokens.json and the absent connector.json stay consistent — no stale token\n  // lingers without a matching config file. Full-store restore (vs. single-entry\n  // restore/revoke) handles partial writes atomically for both fresh-install and\n  // force-reinstall paths uniformly.\n  //\n  // Also roll back any codex-cli memory extension if the config write fails so\n  // that no dangling memories_extensions/remnic directory is left with no config\n  // provenance for removeConnector to find and clean up later.\n  try {\n    writeSecretFileSync(configPath, JSON.stringify(resolvedConfig, null, 2));\n  } catch (writeErr) {\n    // Roll back non-hermes token store if needed. Track success so we can\n    // report accurately — unconditionally claiming rollback succeeded when it\n    // silently failed would leave operators unable to diagnose inconsistent state.\n    //\n    // Initialize to false: only set true once saveTokenStore() succeeds.\n    // Non-token connectors skip this block entirely, so we must not emit a\n    // \"Token has been rolled back.\" suffix for them.\n    let configWriteTokenRolledBack = false;\n    let configWriteTokenRollbackMsg = \"\";\n    if (tokenEntry !== null && nonHermesPriorTokenStore !== null) {\n      try {\n        saveTokenStore(nonHermesPriorTokenStore);\n        configWriteTokenRolledBack = true;\n      } catch (tokenRestoreErr) {\n        configWriteTokenRolledBack = false;\n        configWriteTokenRollbackMsg =\n          tokenRestoreErr instanceof Error ? tokenRestoreErr.message : String(tokenRestoreErr);\n      }\n    }\n    // Roll back the codex-cli extension if it was installed.\n    // Use extensionHandle.rollback() so that a pre-existing (possibly\n    // customised) extension is restored from the backup kept by\n    // installCodexMemoryExtension(), rather than unconditionally deleted.\n    if (extensionInstalled && extensionHandle !== null) {\n      try {\n        extensionHandle.rollback();\n      } catch {\n        // Best-effort rollback: log but don't mask the original write error.\n        console.warn(\n          \"[remnic/connectors] installConnector: config write failed and extension rollback also failed — \" +\n            \"manual cleanup of memories_extensions/remnic may be required.\",\n        );\n      }\n    }\n    // Roll back the WeClone proxy config if it was written.\n    if (weCloneProxyHandleRollback !== null) {\n      try {\n        weCloneProxyHandleRollback();\n      } catch {\n        // Best-effort rollback.\n      }\n    }\n    // Only include a token-rollback suffix for connectors that actually had a\n    // token to roll back. Non-token connectors (requiresToken !== true) never\n    // generated a token entry. For requiresToken connectors where generateToken\n    // threw (tokenEntry === null), no token was written to tokens.json so no\n    // rollback occurred — avoid a misleading \"Token rollback FAILED\" message\n    // (Thread 1, PRRT_kwDORJXyws56VVnB).\n    const configWriteTokenSuffix = manifest.requiresToken && tokenEntry !== null\n      ? configWriteTokenRolledBack\n        ? \" Token has been rolled back.\"\n        : ` Token rollback FAILED (${configWriteTokenRollbackMsg}) — tokens.json may contain an orphaned entry. ` +\n          `Manually inspect ~/.remnic/tokens.json and reinstall.`\n      : \"\";\n    return {\n      connectorId: options.connectorId,\n      status: \"error\",\n      message:\n        `${manifest.name} install aborted: connector config write failed — ` +\n        `${writeErr instanceof Error ? writeErr.message : String(writeErr)}.` +\n        `${configWriteTokenSuffix} Resolve the write permission issue, then reinstall.`,\n    };\n  }\n\n  // Config write succeeded — permanently drop the backup of the prior extension.\n  if (extensionInstalled && extensionHandle !== null) {\n    extensionHandle.commit();\n  }\n\n  return {\n    connectorId: options.connectorId,\n    status: \"installed\",\n    configPath,\n    message: `Installed ${manifest.name} v${manifest.version}${extensionMessage}`,\n  };\n}\n\n// ── Remove connector ───────────────────────────────────────────────────────\n\nexport function removeConnector(connectorId: string): RemoveResult {\n  const configDir = getConnectorsDir();\n  const configPath = path.join(configDir, `${connectorId}.json`);\n\n  // For codex-cli, read the saved config BEFORE touching anything so we have\n  // both the persisted codexHome and the installExtension flag available for\n  // later use in extension removal (Findings 1, 3, 4, 5).\n  let codexHomeOverride: string | null = null;\n  let savedInstallExtension: boolean | undefined = undefined;\n  // Finding 1: track whether config parsing succeeded. If parsing throws, we\n  // cannot trust any metadata and must fail closed (skip extension removal).\n  let configParsed = false;\n  if (connectorId === \"codex-cli\" && fs.existsSync(configPath)) {\n    try {\n      const parsed = JSON.parse(fs.readFileSync(configPath, \"utf8\")) as Record<string, unknown>;\n      configParsed = true;\n      if (typeof parsed.codexHome === \"string\" && parsed.codexHome.length > 0) {\n        codexHomeOverride = parsed.codexHome;\n      }\n      // Finding 4: coerce saved installExtension so string \"false\" still works.\n      const coerced = coerceInstallExtension(parsed.installExtension);\n      if (coerced !== undefined) {\n        savedInstallExtension = coerced;\n      }\n    } catch {\n      // Finding 1: config is malformed — log debug and fail closed.\n      // codexHomeOverride and savedInstallExtension remain unset; configParsed\n      // stays false so extension removal is skipped below.\n      console.debug(\n        \"[remnic/connectors] removeConnector: codex-cli.json parse failed — skipping extension removal to avoid touching unverified paths\",\n      );\n    }\n  }\n\n  if (!fs.existsSync(configPath)) {\n    // Best-effort: revoke any orphan token that may have survived a prior partial\n    // cleanup (e.g. connector JSON deleted manually or XDG_CONFIG_HOME change).\n    // This prevents a stale bearer token from remaining valid in tokens.json while\n    // the connector appears \"not installed\" to the caller.\n    // Config file is missing — we have no evidence that this installation ever\n    // managed the extension directory, so it is unsafe to remove it (the user\n    // may have self-managed it or installed with installExtension=false).\n    // Skip removeCodexMemoryExtension entirely in this recovery path.\n    let staleTokenRevoked = false;\n    try {\n      staleTokenRevoked = revokeToken(connectorId);\n    } catch {\n      // Best-effort: token store may be missing or read-only; do not mask the\n      // not_found signal to the caller.\n    }\n    const message = staleTokenRevoked\n      ? `${connectorId} is not installed. Removed stale token entry for ${connectorId}.`\n      : \"Not installed\";\n    return {\n      connectorId,\n      configPath,\n      status: \"not_found\",\n      message,\n    };\n  }\n\n  // Read connector config before deleting it (needed for hermes profile lookup)\n  let storedProfile = \"default\";\n  if (connectorId === \"hermes\") {\n    try {\n      const stored = JSON.parse(fs.readFileSync(configPath, \"utf8\"));\n      if (typeof stored?.profile === \"string\") storedProfile = stored.profile;\n    } catch {\n      // use default profile\n    }\n  }\n\n  // For weclone, read the persisted proxy config path from the saved registry\n  // config BEFORE deleting it. Using the persisted absolute path (rather than\n  // recomputing from current REMNIC_HOME / ENGRAM_HOME / $HOME) guarantees\n  // that a remove still targets the original file even if the environment\n  // has changed between install and remove.\n  //\n  // Parse failure handling: if the registry config exists but is malformed,\n  // we MUST abort the whole removal (mirror of the codex-cli provenance\n  // gate). Silently falling back to an env-derived path would delete the\n  // registry entry first and then miss the real proxy config if the\n  // environment had since changed, orphaning the file (which may still hold\n  // a live bearer token). Only install-time WRITES persist the path; if we\n  // lost it on read, the only safe action is to stop and let the operator\n  // fix the config or clean up manually.\n  let weCloneProxyConfigPath: string | null = null;\n  let weCloneRegistryParseFailed = false;\n  if (connectorId === \"weclone\") {\n    try {\n      const stored = JSON.parse(fs.readFileSync(configPath, \"utf8\")) as Record<string, unknown>;\n      if (typeof stored.proxyConfigPath === \"string\" && stored.proxyConfigPath.length > 0) {\n        weCloneProxyConfigPath = stored.proxyConfigPath;\n      }\n    } catch {\n      weCloneRegistryParseFailed = true;\n    }\n    // No persisted path AND parse succeeded means this is a legacy install\n    // pre-dating proxyConfigPath provenance. Fall back to env resolution\n    // only in that specific case so we still make a best-effort cleanup.\n    if (weCloneProxyConfigPath === null && !weCloneRegistryParseFailed) {\n      try {\n        weCloneProxyConfigPath = resolveWeCloneProxyConfigPath();\n      } catch {\n        // Resolution failed (e.g. no HOME) — leave null; cleanup block skips.\n      }\n    }\n  }\n  if (connectorId === \"weclone\" && weCloneRegistryParseFailed) {\n    console.warn(\n      \"[remnic/connectors] removeConnector: weclone.json is malformed — \" +\n        \"aborting removal to preserve provenance. Fix or delete \" +\n        configPath +\n        \" manually and retry.\",\n    );\n    return {\n      connectorId,\n      configPath,\n      message:\n        \"Removal aborted: weclone.json is malformed. Registry config left in place for inspection; \" +\n        \"proxy config NOT removed.\",\n      status: \"skipped\",\n      reason: \"config-parse-failed\",\n    };\n  }\n\n  // Finding 4: if the codex-cli config exists but failed to parse, abort the\n  // entire removal. Leave both the config file AND the extension directory\n  // untouched so the operator can inspect/fix the config file and retry.\n  // Unlinking the config here would destroy the only provenance record and make\n  // deterministic retry impossible.\n  if (connectorId === \"codex-cli\" && fs.existsSync(configPath) && !configParsed) {\n    console.warn(\n      \"[remnic/connectors] removeConnector: codex-cli.json is malformed — \" +\n        \"aborting removal to preserve provenance. Fix or delete \" +\n        configPath +\n        \" manually and retry.\",\n    );\n    return {\n      connectorId,\n      configPath,\n      message: \"Removal aborted: codex-cli.json is malformed. Config file left in place for inspection.\",\n      status: \"skipped\",\n      reason: \"config-parse-failed\",\n    };\n  }\n\n  // Finding 5: remove extension BEFORE deleting the config file. If extension\n  // removal throws (e.g. EPERM/EBUSY), we re-throw WITHOUT deleting the config\n  // so the user can retry — the config still has the persisted codexHome needed\n  // to locate the extension directory.\n  let extensionMessage = \"\";\n  if (connectorId === \"codex-cli\") {\n    // Finding 4: skip extension deletion when installExtension was explicitly disabled.\n    if (savedInstallExtension === false) {\n      extensionMessage = \" (memory extension: skipped — installExtension=false)\";\n    // Finding 3: require EXPLICIT provenance (installExtension===true AND a saved\n    // codexHome) before removing the extension. Legacy configs that pre-date this\n    // feature have no installExtension key, so savedInstallExtension is undefined;\n    // without provenance we cannot be sure Remnic ever owned the directory.\n    } else if (savedInstallExtension !== true || codexHomeOverride === null) {\n      extensionMessage = \" (memory extension: skipped — no install provenance in saved config)\";\n    } else {\n      const extResult = removeCodexMemoryExtension({ codexHome: codexHomeOverride });\n      extensionMessage = extResult.removed\n        ? ` (memory extension removed: ${extResult.remnicExtensionDir})`\n        : \" (no memory extension present)\";\n    }\n  }\n\n  // Delete the connector config file AFTER extension removal (Finding 5): if\n  // extension removal throws, we do not reach here and the config is preserved.\n  // Token revocation and YAML cleanup only happen after the file is gone so\n  // that a failed unlink (e.g., read-only directory) does not leave a\n  // token-less orphan install on disk.\n  try {\n    fs.unlinkSync(configPath);\n  } catch (unlinkErr) {\n    const sanitizedErr = unlinkErr instanceof Error ? unlinkErr.message : String(unlinkErr);\n    return {\n      connectorId,\n      configPath,\n      status: \"error\",\n      message:\n        `${connectorId} remove aborted: could not delete connector file (${sanitizedErr}). ` +\n        `Token and any connector-specific state were not modified.`,\n    };\n  }\n\n  // File removed — now safe to revoke the auth token.\n  // Non-fatal: if the token store is read-only or missing, connector removal\n  // should still succeed. Stale tokens will be rejected by the daemon when the\n  // token file is later accessible.\n  const notes: string[] = [];\n  // Track revocation success so downstream error branches (e.g. weclone\n  // proxy-delete failure) can accurately report whether the token was\n  // cleaned up rather than hardcoding \"Token has been rolled back\".\n  let tokenRevoked = true;\n  try {\n    revokeToken(connectorId);\n  } catch (revokeErr) {\n    // Surface the failure so callers know the token was not cleaned up.\n    // The connector config has already been removed at this point.\n    tokenRevoked = false;\n    const revokeMsg = revokeErr instanceof Error ? revokeErr.message : String(revokeErr);\n    notes.push(`Warning: token revocation failed — ${revokeMsg}. The token for ${connectorId} may still be present in tokens.json.`);\n  }\n\n  // WeClone-specific: remove the proxy config file at the path persisted in\n  // the registry config (read above before the registry file was deleted).\n  // Using the persisted absolute path — not a re-derivation from the current\n  // environment — is load-bearing: if REMNIC_HOME / ENGRAM_HOME changes (or\n  // is unset) between install and remove, recomputing here would leave the\n  // original proxy config (with a live bearer token) on disk while reporting\n  // success. If the file is present but unlink fails (e.g. EPERM), we MUST\n  // surface an error status rather than pretending success — a later retry\n  // via `remnic connectors remove weclone` would go down the `not_found`\n  // path because the registry config was already unlinked, leaving the\n  // proxy config orphaned (potentially with a still-valid token).\n  let weCloneProxyDeleteFailed: string | null = null;\n  if (connectorId === \"weclone\") {\n    if (weCloneProxyConfigPath === null) {\n      notes.push(\n        \"WeClone proxy config cleanup skipped: no persisted path found in saved config \" +\n          \"(likely a legacy install predating proxyConfigPath provenance).\",\n      );\n    } else {\n      // Safety gate: validate the persisted path before unlinking. Because\n      // `weCloneProxyConfigPath` is loaded from user-controlled JSON, a\n      // malformed or tampered weclone.json could make `removeConnector` delete\n      // an arbitrary file. Restrict deletion to paths that are:\n      //   1. Absolute (relative paths are CWD-dependent and were never written\n      //      by the installer).\n      //   2. End with the known suffix \"connectors/weclone.json\" — the only\n      //      filename the installer ever writes, regardless of base directory.\n      // If either check fails, skip the unlink and surface an error so the\n      // operator can clean up manually. Failing closed is safer than silently\n      // deleting an unexpected path.\n      const expectedSuffix = path.join(\"connectors\", \"weclone.json\");\n      const isSafePath =\n        path.isAbsolute(weCloneProxyConfigPath) &&\n        weCloneProxyConfigPath.endsWith(expectedSuffix);\n      if (!isSafePath) {\n        weCloneProxyDeleteFailed =\n          `Proxy config path ${JSON.stringify(weCloneProxyConfigPath)} failed safety validation ` +\n          `(must be absolute and end with \"${expectedSuffix}\"). ` +\n          `Refusing to delete — remove the file manually if it exists.`;\n      } else {\n        try {\n          if (fs.existsSync(weCloneProxyConfigPath)) {\n            fs.unlinkSync(weCloneProxyConfigPath);\n            notes.push(`Removed WeClone proxy config: ${weCloneProxyConfigPath}`);\n          }\n        } catch (err) {\n          // Hard failure: leaving the file behind with a live token is a\n          // security issue. Capture the error so we return status:\"error\".\n          weCloneProxyDeleteFailed = err instanceof Error ? err.message : String(err);\n        }\n      }\n    }\n  }\n  if (weCloneProxyDeleteFailed !== null && weCloneProxyConfigPath !== null) {\n    // Report the token-revocation status truthfully. If revocation already\n    // failed above, claiming the token was \"cleaned up\" here would mislead\n    // the operator into thinking the only action left is deleting the\n    // orphan file — when in reality the bearer token is also still live.\n    const tokenStatus = tokenRevoked\n      ? \"the registry config was deleted and the token was revoked\"\n      : \"the registry config was deleted but TOKEN REVOCATION ALSO FAILED — \" +\n        \"inspect ~/.remnic/tokens.json and revoke manually\";\n    return {\n      connectorId,\n      configPath,\n      status: \"error\",\n      message:\n        `WeClone remove partially succeeded: ${tokenStatus}, ` +\n        `but the proxy config at ${weCloneProxyConfigPath} could not be deleted ` +\n        `(${weCloneProxyDeleteFailed}). Manually remove that file — it may still contain ` +\n        `a Remnic daemon bearer token.`,\n    };\n  }\n\n  // Hermes-specific: strip the remnic: block from config.yaml.\n  // Only attempted after successful file removal so that config.yaml cleanup\n  // is consistent with the connector JSON state.\n  if (connectorId === \"hermes\") {\n    try {\n      const yamlResult = removeHermesConfig({ profile: storedProfile });\n      if (yamlResult.updated) {\n        notes.push(`Removed remnic: block from Hermes config: ${yamlResult.configPath}`);\n      } else if (yamlResult.reason?.startsWith(\"Hermes config cleanup partially failed:\")) {\n        const tokenStatus = tokenRevoked\n          ? \"the connector registry config was deleted and the token was revoked\"\n          : \"the connector registry config was deleted but TOKEN REVOCATION ALSO FAILED — \" +\n            \"inspect ~/.remnic/tokens.json and revoke manually\";\n        return {\n          connectorId,\n          configPath,\n          status: \"error\",\n          message:\n            `Hermes remove partially succeeded: ${tokenStatus}, but ${yamlResult.reason}. ` +\n            `Updated paths: ${yamlResult.configPath}. Manually remove any stale remnic: ` +\n            `block and token material from the failed Hermes config path.`,\n        };\n      } else if (yamlResult.skipped) {\n        notes.push(`Hermes config cleanup skipped: ${yamlResult.reason}`);\n      }\n    } catch (err) {\n      notes.push(\n        `Hermes config cleanup skipped: ${err instanceof Error ? err.message : String(err)}`,\n      );\n    }\n  }\n\n  const suffix = notes.length > 0 ? `\\n  ${notes.join(\"\\n  \")}` : \"\";\n  return {\n    connectorId,\n    configPath,\n    status: \"removed\",\n    message: `Removed${extensionMessage}${suffix}`,\n  };\n}\n\n// ── Hermes config.yaml helpers ─────────────────────────────────────────────────\n\ninterface HermesConfigResult {\n  updated: boolean;\n  skipped: boolean;\n  reason?: string;\n  configPath: string;\n  /**\n   * The exact byte-for-byte content of the config.yaml that existed BEFORE\n   * this upsert ran. `null` when the file did not exist (new file was created).\n   * `undefined` when the write was skipped (priorContent is irrelevant).\n   * Used by installConnector to roll back the YAML write if commitTokenEntry\n   * subsequently throws.\n   */\n  priorContent?: string | null;\n}\n\n/**\n * Validate and sanitize a Hermes profile name.\n *\n * Profile names appear as a path segment under `~/.hermes/profiles/`, so we\n * must reject any value that could traverse outside that directory. Hermes\n * itself restricts profile names to filesystem-safe identifiers; we mirror\n * that convention and additionally require the resolved config path to stay\n * under the profiles root.\n *\n * Throws on invalid input rather than silently normalizing — the caller\n * should surface the error so the user can supply a valid profile.\n */\nfunction sanitizeHermesProfile(profile: string): string {\n  if (typeof profile !== \"string\" || profile.length === 0) {\n    throw new Error(\"Hermes profile name must be a non-empty string\");\n  }\n  // Disallow anything that isn't a plain profile identifier. We accept\n  // letters, digits, hyphen, underscore, and dot — but reject leading dots\n  // (hidden dirs) and any path separator or parent-dir reference.\n  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(profile)) {\n    throw new Error(\n      `Invalid Hermes profile name: ${JSON.stringify(profile)} — must match [A-Za-z0-9][A-Za-z0-9._-]*`,\n    );\n  }\n  if (profile.includes(\"..\")) {\n    throw new Error(`Invalid Hermes profile name: ${JSON.stringify(profile)} — must not contain \"..\"`);\n  }\n  return profile;\n}\n\nfunction hermesConfigPath(profile: string): string {\n  const safeProfile = sanitizeHermesProfile(profile);\n  const hermesRoot = path.resolve(resolveHomeDir(), \".hermes\");\n  const rootConfigPath = path.join(hermesRoot, \"config.yaml\");\n  const profilesRoot = path.join(hermesRoot, \"profiles\");\n  if (safeProfile === \"default\") {\n    const defaultProfileDir = path.join(profilesRoot, safeProfile);\n    if (isFile(rootConfigPath) || (!fs.existsSync(rootConfigPath) && !isDirectory(defaultProfileDir))) {\n      return rootConfigPath;\n    }\n  }\n  const cfgPath = path.resolve(profilesRoot, safeProfile, \"config.yaml\");\n  // Defense in depth: ensure the resolved path is still under profilesRoot.\n  const rel = path.relative(profilesRoot, cfgPath);\n  if (rel.startsWith(\"..\") || path.isAbsolute(rel)) {\n    throw new Error(\n      `Invalid Hermes profile path: resolved outside ${profilesRoot}`,\n    );\n  }\n  return cfgPath;\n}\n\nfunction isDirectory(filePath: string): boolean {\n  try {\n    return fs.statSync(filePath).isDirectory();\n  } catch {\n    return false;\n  }\n}\n\nfunction isFile(filePath: string): boolean {\n  try {\n    return fs.statSync(filePath).isFile();\n  } catch {\n    return false;\n  }\n}\n\nfunction hermesConfigTarget(filePath: string): string {\n  try {\n    return fs.realpathSync.native(filePath);\n  } catch {\n    return path.resolve(filePath);\n  }\n}\n\nfunction sameHermesConfigTarget(leftPath: string, rightPath: string): boolean {\n  return hermesConfigTarget(leftPath) === hermesConfigTarget(rightPath);\n}\n\nfunction hermesDefaultProfileConfigPath(): string {\n  const hermesRoot = path.resolve(resolveHomeDir(), \".hermes\");\n  return path.join(hermesRoot, \"profiles\", \"default\", \"config.yaml\");\n}\n\nfunction hermesConfigCleanupPaths(profile: string): string[] {\n  const cfgPath = hermesConfigPath(profile);\n  const safeProfile = sanitizeHermesProfile(profile);\n  if (safeProfile !== \"default\") {\n    return [cfgPath];\n  }\n  return [...new Set([cfgPath, hermesDefaultProfileConfigPath()])];\n}\n\n/**\n * Validate a Hermes host string before interpolating it into YAML.\n *\n * YAML-injection guard: connector config values come from raw CLI input\n * (`--config host=...`) or config-file JSON, both of which are untrusted.\n * Without validation, a value like `127.0.0.1\"\\n  session_key: \"evil`\n * would emit additional YAML keys into the `remnic:` block and silently\n * override Hermes settings.\n *\n * Accepted forms:\n *   - Plain IPv4: 127.0.0.1, 10.0.0.5\n *   - Plain DNS hostname: localhost, foo.example.com\n *   - Bracketed IPv6 literal: [::1], [2001:db8::1]\n *\n * Rejected forms:\n *   - host:port combos: 127.0.0.1:4318 (colons not allowed outside brackets)\n *   - Unbalanced brackets: [::1\n *   - Any whitespace, quotes, or control characters\n *\n * Hermes builds its base URL as `http://{host}:{port}`, so supplying a\n * host that already embeds a port (e.g. \"127.0.0.1:4318\") would produce\n * the double-port URL \"http://127.0.0.1:4318:4318/...\" and fail at runtime\n * even though install reports success.  We reject that form here.\n */\nfunction sanitizeHermesHost(host: string): string {\n  if (typeof host !== \"string\" || host.length === 0) {\n    throw new Error(\"Hermes host must be a non-empty string\");\n  }\n  if (host.length > 253) {\n    throw new Error(`Hermes host too long (max 253 chars): ${JSON.stringify(host.slice(0, 32))}…`);\n  }\n\n  // Bracketed IPv6 literal: must start with \"[\", end with \"]\", and contain\n  // only hex digits and colons inside the brackets.\n  if (host.startsWith(\"[\")) {\n    if (!host.endsWith(\"]\")) {\n      throw new Error(\n        `Invalid Hermes host: ${JSON.stringify(host)} — unbalanced brackets in IPv6 literal`,\n      );\n    }\n    const inner = host.slice(1, -1);\n    if (inner.length === 0 || !/^[0-9A-Fa-f:]+$/.test(inner)) {\n      throw new Error(\n        `Invalid Hermes host: ${JSON.stringify(host)} — bracketed IPv6 literal must contain only hex digits and colons`,\n      );\n    }\n    return host;\n  }\n\n  // Unbracketed value: colons are not allowed (would indicate an embedded port\n  // or an unbracketed IPv6 address, both of which must be rejected here).\n  if (host.includes(\":\")) {\n    throw new Error(\n      `Invalid Hermes host: ${JSON.stringify(host)} — host must not include a port; supply the port separately with --config port=<n>`,\n    );\n  }\n\n  // Plain IPv4 or DNS hostname: allow letters, digits, dots, and hyphens only.\n  // No whitespace, quotes, or control characters.\n  if (!/^[A-Za-z0-9._\\-]+$/.test(host)) {\n    throw new Error(\n      `Invalid Hermes host: ${JSON.stringify(host)} — must be a plain hostname or IP literal`,\n    );\n  }\n  return host;\n}\n\n/**\n * Validate a Hermes port value. Accepts positive integers in [1, 65535].\n *\n * Rejects non-integer numeric strings (e.g. \"4318.9\") rather than silently\n * truncating them — a fractional port is almost certainly a typo and writing\n * the truncated value to config.yaml would be misleading.\n */\nfunction sanitizeHermesPort(port: number | string): number {\n  const numeric = Number(port);\n  // Reject NaN, Infinity, -Infinity, and any non-integer (e.g. 4318.9)\n  if (!Number.isInteger(numeric)) {\n    throw new Error(\n      `Invalid Hermes port \"${port}\": must be a positive integer`,\n    );\n  }\n  if (numeric < 1 || numeric > 65535) {\n    throw new Error(`Invalid Hermes port: ${JSON.stringify(port)} — must be an integer in [1, 65535]`);\n  }\n  return numeric;\n}\n\n/**\n * Write a file with owner-only (0o600) permissions.\n *\n * Used for any file that may contain a bearer token. writeFileSync's `mode`\n * option only applies when the file is newly created, so we also chmod\n * afterwards to tighten permissions on pre-existing files. The chmod is\n * best-effort on platforms that don't support POSIX modes.\n */\nfunction writeSecretFileSync(filePath: string, data: string): void {\n  fs.writeFileSync(filePath, data, { mode: 0o600 });\n  try {\n    fs.chmodSync(filePath, 0o600);\n  } catch {\n    /* best-effort on non-POSIX filesystems */\n  }\n}\n\n/**\n * Upsert the `remnic:` block in a Hermes profile config.yaml.\n *\n * Rules:\n * - If the profile directory does not exist, skip with a warning (we do not\n *   create arbitrary Hermes state).\n * - If config.yaml does not exist, create it with only the remnic: block.\n * - If config.yaml exists and already contains a `remnic:` block, update the\n *   host/port/token lines in-place (line-based, preserves comments elsewhere).\n * - If config.yaml exists with no `remnic:` block, append one.\n * - Idempotent on repeated calls.\n */\nexport function upsertHermesConfig(opts: {\n  profile: string;\n  host: string;\n  port: number;\n  token: string;\n}): HermesConfigResult {\n  const cfgPath = hermesConfigPath(opts.profile);\n  const profileDir = path.dirname(cfgPath);\n\n  // YAML-injection guard: validate scalar values before interpolating them\n  // into the `remnic:` block. sanitizeHermesHost/Port throw on anything\n  // that could break out of the scalar context.\n  const safeHost = sanitizeHermesHost(opts.host);\n  const safePort = sanitizeHermesPort(opts.port);\n  // Token is generated by randomBytes + a fixed alphabetic prefix, so it's\n  // already safe for YAML scalar interpolation. We still guard against an\n  // unexpectedly malformed token reaching this function.\n  if (!/^[A-Za-z0-9_]+$/.test(opts.token)) {\n    throw new Error(\"Invalid Hermes token: contains non-alphanumeric characters\");\n  }\n\n  if (!isDirectory(profileDir)) {\n    return {\n      updated: false,\n      skipped: true,\n      reason: `Hermes profile directory not found: ${profileDir}`,\n      configPath: cfgPath,\n    };\n  }\n\n  const block = [\n    \"remnic:\",\n    `  host: \"${safeHost}\"`,\n    `  port: ${safePort}`,\n    `  token: \"${opts.token}\"`,\n  ].join(\"\\n\");\n\n  if (!fs.existsSync(cfgPath)) {\n    // Create with just the remnic block. 0o600 because the file now holds\n    // a bearer token — matching the permissions on ~/.remnic/tokens.json.\n    writeSecretFileSync(cfgPath, block + \"\\n\");\n    // priorContent: null signals \"file was created new\" — rollback means delete.\n    return { updated: true, skipped: false, configPath: cfgPath, priorContent: null };\n  }\n\n  const raw = fs.readFileSync(cfgPath, \"utf8\");\n\n  // Check whether there's an existing remnic: block\n  const hasRemnicBlock = /^remnic:/m.test(raw);\n\n  if (!hasRemnicBlock) {\n    // Append the block (preserve existing content)\n    const separator = raw.endsWith(\"\\n\") ? \"\\n\" : \"\\n\\n\";\n    writeSecretFileSync(cfgPath, raw + separator + block + \"\\n\");\n    // priorContent: raw preserves the original file so it can be restored on rollback.\n    return { updated: true, skipped: false, configPath: cfgPath, priorContent: raw };\n  }\n\n  // Update the existing block. Strategy: replace the content of the remnic:\n  // section by matching from `^remnic:` to the next top-level key or end-of-file.\n  // We rewrite only the host/port/token sub-keys inside the block; other keys\n  // under remnic: (e.g. session_key, timeout) are preserved.\n  //\n  // Trailing-newline handling: split(\"\\n\") on a file that ends with \"\\n\" produces\n  // a final empty-string element. If that element is still inside the remnic block\n  // when we hit it, it gets pushed to newLines via the else branch — placing a\n  // blank line between existing sub-keys and any newly-appended missing sub-keys.\n  // We strip the trailing empty element before the loop and re-add a single \"\\n\"\n  // at write time, normalising the file to always end with exactly one newline.\n  const splitLines = raw.split(\"\\n\");\n  // Remove trailing empty element produced by a file that ends with \"\\n\"\n  if (splitLines.length > 0 && splitLines[splitLines.length - 1] === \"\") {\n    splitLines.pop();\n  }\n  const lines = splitLines;\n  const newLines: string[] = [];\n  let inRemnicBlock = false;\n  let blockWritten = false;\n\n  // Track which sub-keys we've emitted\n  const written = { host: false, port: false, token: false };\n\n  for (let i = 0; i < lines.length; i++) {\n    const line = lines[i];\n\n    if (/^remnic:/.test(line)) {\n      inRemnicBlock = true;\n      newLines.push(line);\n      continue;\n    }\n\n    if (inRemnicBlock) {\n      // A line that starts with a non-space character and is not empty signals\n      // the start of the next top-level YAML key — we've left the remnic block.\n      if (line.length > 0 && !/^\\s/.test(line)) {\n        // Emit any un-written keys before closing the block. Uses the\n        // already-validated safeHost/safePort values.\n        if (!written.host) newLines.push(`  host: \"${safeHost}\"`);\n        if (!written.port) newLines.push(`  port: ${safePort}`);\n        if (!written.token) newLines.push(`  token: \"${opts.token}\"`);\n        blockWritten = true;\n        inRemnicBlock = false;\n        newLines.push(line);\n        continue;\n      }\n\n      // Replace host/port/token lines; preserve other sub-keys\n      if (/^\\s+host:/.test(line)) {\n        newLines.push(`  host: \"${safeHost}\"`);\n        written.host = true;\n      } else if (/^\\s+port:/.test(line)) {\n        newLines.push(`  port: ${safePort}`);\n        written.port = true;\n      } else if (/^\\s+token:/.test(line)) {\n        newLines.push(`  token: \"${opts.token}\"`);\n        written.token = true;\n      } else {\n        newLines.push(line);\n      }\n      continue;\n    }\n\n    newLines.push(line);\n  }\n\n  if (inRemnicBlock && !blockWritten) {\n    // File ended while still inside the remnic block\n    if (!written.host) newLines.push(`  host: \"${safeHost}\"`);\n    if (!written.port) newLines.push(`  port: ${safePort}`);\n    if (!written.token) newLines.push(`  token: \"${opts.token}\"`);\n  }\n\n  // Always write exactly one trailing newline, matching the create and append paths.\n  writeSecretFileSync(cfgPath, newLines.join(\"\\n\") + \"\\n\");\n  // priorContent: raw is the original file content for rollback if needed.\n  return { updated: true, skipped: false, configPath: cfgPath, priorContent: raw };\n}\n\n/**\n * Remove the `remnic:` block from a Hermes profile config.yaml.\n * Idempotent — if the block is absent, returns skipped.\n */\nexport function removeHermesConfig(opts: { profile: string }): HermesConfigResult {\n  const cfgPaths = hermesConfigCleanupPaths(opts.profile);\n  const results = cfgPaths.map((cfgPath) => {\n    try {\n      return removeHermesConfigFile(cfgPath);\n    } catch (err) {\n      return {\n        updated: false,\n        skipped: true,\n        reason: `Hermes config cleanup failed: ${err instanceof Error ? err.message : String(err)}`,\n        configPath: cfgPath,\n      };\n    }\n  });\n  const updated = results.filter((result) => result.updated);\n  const cleanupFailures = results.filter((result) => result.reason?.startsWith(\"Hermes config cleanup failed:\"));\n\n  if (updated.length > 0) {\n    const updatedPaths = updated.map((result) => result.configPath).join(\", \");\n    if (cleanupFailures.length > 0) {\n      const failedPaths = cleanupFailures.map((result) => result.configPath).join(\", \");\n      return {\n        updated: false,\n        skipped: true,\n        reason: `Hermes config cleanup partially failed: updated ${updatedPaths}; failed ${failedPaths}`,\n        configPath: `${updatedPaths}; failed: ${failedPaths}`,\n      };\n    }\n    return {\n      updated: true,\n      skipped: false,\n      configPath: updatedPaths,\n    };\n  }\n\n  const cleanupFailure = cleanupFailures[0];\n  if (cleanupFailure) {\n    return cleanupFailure;\n  }\n\n  const existingWithoutBlock = results.find((result) => result.reason !== \"Hermes config.yaml not found\");\n  return existingWithoutBlock ?? results[0] ?? {\n    updated: false,\n    skipped: true,\n    reason: \"Hermes config.yaml not found\",\n    configPath: hermesConfigPath(opts.profile),\n  };\n}\n\nfunction removeHermesConfigFile(cfgPath: string): HermesConfigResult {\n  if (!fs.existsSync(cfgPath)) {\n    return {\n      updated: false,\n      skipped: true,\n      reason: \"Hermes config.yaml not found\",\n      configPath: cfgPath,\n    };\n  }\n\n  const raw = fs.readFileSync(cfgPath, \"utf8\");\n  if (!/^remnic:/m.test(raw)) {\n    return {\n      updated: false,\n      skipped: true,\n      reason: \"No remnic: block found in config.yaml\",\n      configPath: cfgPath,\n    };\n  }\n\n  // Strip the remnic: block and its indented children\n  const lines = raw.split(\"\\n\");\n  const newLines: string[] = [];\n  let inRemnicBlock = false;\n\n  for (const line of lines) {\n    if (/^remnic:/.test(line)) {\n      inRemnicBlock = true;\n      continue;\n    }\n    if (inRemnicBlock) {\n      if (line.length > 0 && !/^\\s/.test(line)) {\n        inRemnicBlock = false;\n        newLines.push(line);\n      }\n      // else: still in the block — skip the line\n      continue;\n    }\n    newLines.push(line);\n  }\n\n  // Trim trailing blank lines left behind after the block removal\n  while (newLines.length > 0 && newLines[newLines.length - 1]?.trim() === \"\") {\n    newLines.pop();\n  }\n\n  // Use writeSecretFileSync to keep the file at 0o600 even after the token\n  // has been removed. The file previously held a bearer token (so it was\n  // written with 0o600 originally); preserving that mode prevents a window\n  // where a rewrite with default umask temporarily widens permissions.\n  writeSecretFileSync(cfgPath, newLines.length > 0 ? newLines.join(\"\\n\") + \"\\n\" : \"\");\n  return { updated: true, skipped: false, configPath: cfgPath };\n}\n\n// ── Daemon health check (synchronous, non-fatal) ────────────────────────────\n\n/**\n * Probe exit-code contract (used by checkDaemonHealth):\n *   0 — HTTP 200 (healthy)\n *   2 — HTTP 401 (token cache miss: retry after TTL)\n *   1 — any other HTTP status or network error\n */\nconst HEALTH_EXIT_OK = 0;\nconst HEALTH_EXIT_UNAUTHORIZED = 2;\n\n/**\n * Ping /engram/v1/health synchronously.\n * Returns true if the daemon responds with HTTP 200, false otherwise.\n * Uses a synchronous helper to run a one-liner Node script so that the existing\n * installConnector() flow does not need to become async.\n *\n * Data (host, port, token) are passed via environment variables — NOT\n * interpolated into the script string — to prevent injection from\n * user-supplied config values.\n *\n * /engram/v1/health is protected by bearer auth in the access HTTP server,\n * so the caller must pass the connector token (or the configured server\n * token) or the probe will always return 401 and report the daemon as\n * unreachable even when it is running.\n *\n * 401 handling: the daemon caches valid tokens with a 5-second TTL\n * (getAllValidTokensCached). A freshly-rotated token may not appear in the\n * cache for up to 5 s after rotation. We tolerate a single 401 by sleeping\n * one cache TTL (6000 ms = 5 s TTL + 1 s buffer) and retrying exactly once.\n */\nfunction checkDaemonHealth(host: string, port: number, authToken?: string): boolean {\n  try {\n    // Validate port: must be an integer in [1, 65535].\n    // This guards against user config supplying a non-numeric string.\n    const safePort = Math.trunc(Number(port));\n    if (!Number.isFinite(safePort) || safePort < 1 || safePort > 65535) {\n      return false;\n    }\n    // Finding 7 fix: Node's http.get({ host }) expects an unbracketed IPv6\n    // literal (e.g. \"::1\"), but sanitizeHermesHost permits bracketed form\n    // \"[::1]\" (required for URL contexts). Strip the brackets here so that\n    // http.get receives the bare address and doesn't fail to connect.\n    // IPv4 and hostname strings are unaffected (no brackets to strip).\n    const bareHost = host.startsWith(\"[\") && host.endsWith(\"]\")\n      ? host.slice(1, -1)\n      : host;\n\n    // Data (host, port, token) are passed via env vars, never interpolated\n    // into the script string, preventing any code-injection from malformed\n    // config values.\n    // Exit codes: 0 = 200 OK, 2 = 401 Unauthorized, 1 = other error.\n    const script = [\n      \"const http = require('http');\",\n      \"const env = process['env'];\",\n      \"const headers = {};\",\n      \"if (env.REMNIC_HEALTH_TOKEN) {\",\n      \"  headers['authorization'] = 'Bearer ' + env.REMNIC_HEALTH_TOKEN;\",\n      \"}\",\n      \"const req = http.get({\",\n      \"  host: env.REMNIC_HEALTH_HOST,\",\n      \"  port: parseInt(env.REMNIC_HEALTH_PORT, 10),\",\n      \"  path: '/engram/v1/health',\",\n      \"  headers,\",\n      \"  timeout: 3000,\",\n      \"}, (res) => { process.exit(res.statusCode === 200 ? 0 : res.statusCode === 401 ? 2 : 1); });\",\n      \"req.on('error', () => process.exit(1));\",\n      \"req.on('timeout', () => { req.destroy(); process.exit(1); });\",\n    ].join(\"\\n\");\n    const env: NodeJS.ProcessEnv = mergeEnv({\n      REMNIC_HEALTH_HOST: bareHost,\n      REMNIC_HEALTH_PORT: String(safePort),\n    });\n    if (authToken) {\n      env.REMNIC_HEALTH_TOKEN = authToken;\n    }\n    const processPath = process.execPath;\n    const launchOptions = { timeout: 4000, env };\n    const result = launchProcessSync(processPath, [\"-e\", script], launchOptions);\n\n    if (result.status === HEALTH_EXIT_OK) {\n      return true;\n    }\n\n    if (result.status === HEALTH_EXIT_UNAUTHORIZED) {\n      // The daemon's token cache (5 s TTL) has not yet picked up the freshly\n      // rotated token. Sleep one TTL + buffer and retry exactly once.\n      console.error(\n        \"[remnic/connectors] health probe got 401 — retrying after token cache TTL...\",\n      );\n      // Synchronous sleep without making the caller async.\n      launchProcessSync(processPath, [\"-e\", \"setTimeout(() => {}, 6000)\"], {\n        timeout: 7000,\n        env: {},\n      });\n      const retry = launchProcessSync(processPath, [\"-e\", script], launchOptions);\n      return retry.status === HEALTH_EXIT_OK;\n    }\n\n    return false;\n  } catch {\n    return false;\n  }\n}\n\n// ── Doctor ────────────────────────────────────────────────────────────────────\n\nexport async function doctorConnector(connectorId: string): Promise<DoctorResult> {\n  const installed = listConnectors().installed;\n  const instance = installed.find((c) => c.connectorId === connectorId);\n\n  if (!instance) {\n    return {\n      connectorId,\n      checks: [{ name: \"Installed\", ok: false, detail: \"Not installed\" }],\n      healthy: false,\n    };\n  }\n\n  const configPath = path.join(getConnectorsDir(), `${connectorId}.json`);\n  const checks: DoctorCheck[] = [];\n\n  // Check config exists\n  checks.push({\n    name: \"Config file\",\n    ok: fs.existsSync(configPath),\n    detail: configPath,\n  });\n\n  // Check config is valid JSON\n  try {\n    const raw = fs.readFileSync(configPath, \"utf8\");\n    JSON.parse(raw);\n    checks.push({ name: \"Config valid\", ok: true, detail: \"OK\" });\n  } catch (e) {\n    checks.push({ name: \"Config valid\", ok: false, detail: String(e) });\n  }\n\n  // Check MCP server reachable (if applicable)\n  const mcpUrl = instance.config.mcpServerUrl as string | undefined;\n  if (mcpUrl) {\n    try {\n      const controller = new AbortController();\n      const timeoutId = setTimeout(() => controller.abort(), 3000);\n      const response = await fetch(mcpUrl, { signal: controller.signal });\n      clearTimeout(timeoutId);\n      checks.push({ name: \"MCP server\", ok: response.ok, detail: mcpUrl });\n    } catch (e) {\n      checks.push({\n        name: \"MCP server\",\n        ok: false,\n        detail: `Cannot reach ${mcpUrl}: ${e instanceof Error ? e.message : \"unknown\"}`,\n      });\n    }\n  }\n\n  // Check memory dir (if applicable)\n  const memoryDir = instance.config.memoryDir as string | undefined;\n  if (memoryDir) {\n    if (fs.existsSync(memoryDir)) {\n      checks.push({ name: \"Memory directory\", ok: true, detail: memoryDir });\n    } else {\n      checks.push({ name: \"Memory directory\", ok: false, detail: `Not found: ${memoryDir}` });\n    }\n  }\n\n  const healthy = checks.every((c) => c.ok);\n  return { connectorId, checks, healthy };\n}\n\n// ── Codex memory extension install ────────────────────────────────────────\n\n/**\n * Name of the Codex memories folder. Matches Codex's\n * `MEMORIES_SUBDIR = \"memories\"`.\n */\nconst CODEX_MEMORIES_SUBDIR = \"memories\";\n\n/**\n * Name of the Codex memory-extensions folder. Matches Codex's\n * `EXTENSIONS_SUBDIR = \"memories_extensions\"`.\n *\n * Codex computes the extensions root as a **sibling** of the memories dir via\n * Rust's `Path::with_file_name(\"memories_extensions\")` — so for the default\n * Codex home the layout is:\n *\n *     ~/.codex/memories/\n *     ~/.codex/memories_extensions/\n *\n * Extension files live **outside** of `memories/`, never inside it.\n */\nconst CODEX_EXTENSIONS_SUBDIR = \"memories_extensions\";\n\n/** Folder name Remnic installs its extension under. */\nconst REMNIC_EXTENSION_DIR_NAME = \"remnic\";\n\nexport interface CodexMemoryExtensionPaths {\n  /** Resolved Codex home directory (e.g. `~/.codex`). */\n  codexHome: string;\n  /** Resolved Codex memories directory (`<codex_home>/memories`). */\n  memoriesDir: string;\n  /** Sibling extensions root (`<codex_home>/memories_extensions`). */\n  extensionsRoot: string;\n  /** The specific Remnic extension directory inside the extensions root. */\n  remnicExtensionDir: string;\n}\n\nexport interface InstallCodexMemoryExtensionOptions {\n  /** Optional override for `$CODEX_HOME`. Highest priority. */\n  codexHome?: string | null;\n  /** Optional override for the plugin-codex extension source directory. */\n  sourceDir?: string | null;\n}\n\nexport interface InstallCodexMemoryExtensionResult extends CodexMemoryExtensionPaths {\n  /** Absolute path to the installed `instructions.md`. */\n  instructionsPath: string;\n  /** Number of files copied. */\n  filesCopied: number;\n  /**\n   * Commit the install: permanently remove the backup of the prior extension\n   * (if one existed). Call this once the config write has succeeded.\n   */\n  commit(): void;\n  /**\n   * Roll back the install: restore the prior extension if one existed, or\n   * remove the newly-installed directory for a fresh install. Call this when\n   * a subsequent step (e.g. config write) has failed.\n   */\n  rollback(): void;\n}\n\nexport interface RemoveCodexMemoryExtensionOptions {\n  codexHome?: string | null;\n}\n\nexport interface RemoveCodexMemoryExtensionResult extends CodexMemoryExtensionPaths {\n  /** True if an existing `remnic` extension directory was removed. */\n  removed: boolean;\n}\n\n/**\n * Resolve the Codex home directory. Precedence:\n *   1. explicit `override` argument (from config)\n *   2. `$CODEX_HOME` env var\n *   3. `$HOME/.codex`, `$USERPROFILE/.codex`, or the OS home directory\n */\nexport function resolveCodexHome(override?: string | null): string {\n  if (override && typeof override === \"string\" && override.trim().length > 0) {\n    return path.resolve(override.trim());\n  }\n  const envHome = readEnvVar(\"CODEX_HOME\");\n  if (envHome && envHome.trim().length > 0) {\n    return path.resolve(envHome.trim());\n  }\n  const home = readEnvVar(\"HOME\") || readEnvVar(\"USERPROFILE\") || resolveHomeDir();\n  return path.resolve(home, \".codex\");\n}\n\n/**\n * Compute the Codex memories + memory-extensions layout for a given Codex home.\n *\n * The extensions root is computed as a **sibling** of the memories dir by\n * taking `path.dirname(memoriesDir)` and joining `memories_extensions`. This\n * mirrors Rust's `with_file_name(\"memories_extensions\")` semantics used by\n * Codex's `memory_extensions_root()`. Do NOT place the extension inside\n * `<codex_home>/memories/`.\n */\nexport function resolveCodexMemoryExtensionPaths(\n  codexHomeOverride?: string | null,\n): CodexMemoryExtensionPaths {\n  const codexHome = resolveCodexHome(codexHomeOverride);\n  const memoriesDir = path.join(codexHome, CODEX_MEMORIES_SUBDIR);\n  // Sibling computation: with_file_name(EXTENSIONS_SUBDIR)\n  const extensionsRoot = path.join(path.dirname(memoriesDir), CODEX_EXTENSIONS_SUBDIR);\n  const remnicExtensionDir = path.join(extensionsRoot, REMNIC_EXTENSION_DIR_NAME);\n  return { codexHome, memoriesDir, extensionsRoot, remnicExtensionDir };\n}\n\n/**\n * Locate the plugin-codex `memories_extensions/remnic/` source directory on\n * disk. Search order:\n *   1. explicit `override`\n *   2. resolve via `@remnic/plugin-codex` package (handles global npm installs)\n *   3. sibling `node_modules/@remnic/plugin-codex` relative to this module\n *   4. walk upward from this file's location (monorepo development)\n *   5. walk upward from `process.cwd()` (monorepo fallback)\n *\n * Returns the absolute path or throws a descriptive error listing all paths\n * searched when none exist.\n */\nexport function locatePluginCodexExtensionSource(override?: string | null): string {\n  if (override && typeof override === \"string\" && override.trim().length > 0) {\n    const resolved = path.resolve(override.trim());\n    if (fs.existsSync(resolved) && fs.statSync(resolved).isDirectory()) {\n      return resolved;\n    }\n    throw new Error(`Codex extension source directory not found: ${resolved}`);\n  }\n\n  const EXTENSION_SUBPATH = path.join(\"memories_extensions\", \"remnic\");\n  const WORKSPACE_RELATIVE_PATH = path.join(\n    \"packages\",\n    \"plugin-codex\",\n    \"memories_extensions\",\n    \"remnic\",\n  );\n\n  const searched: string[] = [];\n\n  // Primary path: the bundled payload shipped with @remnic/core itself.\n  // tsup copies src/connectors/codex/ → dist/connectors/codex/ (see tsup.config.ts\n  // onSuccess hook). However, tsup bundles all source into dist/ as flat files\n  // (dist/index.js, dist/chunk-*.js), so at runtime import.meta.url points to\n  // dist/index.js or a dist/chunk-*.js — NOT dist/connectors/index.js.\n  // Therefore we probe two sibling-relative candidates:\n  //   1. moduleDir/codex          — matches tsx/ts-node on src/connectors/index.ts\n  //   2. moduleDir/connectors/codex — matches the tsup dist layout where this code\n  //                                   lands in dist/index.js or dist/chunk-*.js\n  try {\n    const moduleDir = path.dirname(fileURLToPath(import.meta.url));\n\n    // Candidate 1: adjacent codex/ (tsx/ts-node from src/connectors/)\n    const bundledCandidate = path.join(moduleDir, \"codex\");\n    searched.push(bundledCandidate);\n    if (fs.existsSync(bundledCandidate) && fs.statSync(bundledCandidate).isDirectory()) {\n      return bundledCandidate;\n    }\n\n    // Candidate 2: dist/connectors/codex/ — the tsup output path.\n    // When this module is bundled into dist/index.js or dist/chunk-*.js,\n    // moduleDir is dist/ and tsup copies the payload to dist/connectors/codex/.\n    const distConnectorsCandidate = path.join(moduleDir, \"connectors\", \"codex\");\n    searched.push(distConnectorsCandidate);\n    if (\n      fs.existsSync(distConnectorsCandidate) &&\n      fs.statSync(distConnectorsCandidate).isDirectory()\n    ) {\n      return distConnectorsCandidate;\n    }\n  } catch {\n    // import.meta.url unavailable — not running as ESM, skip bundled path.\n  }\n\n  // Finding 2 — path 1: resolve via `@remnic/plugin-codex` package.json.\n  // This covers global `npm install -g @remnic/remnic-core` or pnpm global installs\n  // where the package lives under the global node_modules tree.\n  try {\n    const requireFromHere = createRequire(import.meta.url);\n    const pluginPkgJsonPath = requireFromHere.resolve(\"@remnic/plugin-codex/package.json\");\n    const pluginPkgRoot = path.dirname(pluginPkgJsonPath);\n    const candidate = path.join(pluginPkgRoot, EXTENSION_SUBPATH);\n    searched.push(candidate);\n    if (fs.existsSync(candidate) && fs.statSync(candidate).isDirectory()) {\n      return candidate;\n    }\n  } catch {\n    // @remnic/plugin-codex not installed — fall through to next strategy.\n  }\n\n  // Finding 2 — path 2: sibling node_modules under the module's own directory.\n  // Handles cases like:\n  //   .../node_modules/@remnic/remnic-core/src/connectors/index.js\n  //   .../node_modules/@remnic/plugin-codex/memories_extensions/remnic\n  try {\n    const moduleDir = path.dirname(fileURLToPath(import.meta.url));\n    let dir = moduleDir;\n    for (let depth = 0; depth < 8; depth += 1) {\n      const candidate = path.join(\n        dir,\n        \"node_modules\",\n        \"@remnic\",\n        \"plugin-codex\",\n        EXTENSION_SUBPATH,\n      );\n      searched.push(candidate);\n      if (fs.existsSync(candidate) && fs.statSync(candidate).isDirectory()) {\n        return candidate;\n      }\n      const parent = path.dirname(dir);\n      if (parent === dir) break;\n      dir = parent;\n    }\n  } catch {\n    // import.meta.url unavailable — not running as ESM.\n  }\n\n  // Finding 2 — path 3 & 4: walk upward from this file's location and from\n  // process.cwd() looking for the monorepo layout (`packages/plugin-codex/…`).\n  const anchors: string[] = [];\n  try {\n    anchors.push(path.dirname(fileURLToPath(import.meta.url)));\n  } catch {\n    // Not running under ESM with import.meta — skip.\n  }\n  anchors.push(process.cwd());\n\n  for (const anchor of anchors) {\n    let dir = anchor;\n    for (let depth = 0; depth < 12; depth += 1) {\n      const candidate = path.join(dir, WORKSPACE_RELATIVE_PATH);\n      searched.push(candidate);\n      if (fs.existsSync(candidate) && fs.statSync(candidate).isDirectory()) {\n        return candidate;\n      }\n      const parent = path.dirname(dir);\n      if (parent === dir) break;\n      dir = parent;\n    }\n  }\n\n  throw new Error(\n    \"Could not locate the plugin-codex memories_extensions/remnic source directory.\\n\" +\n      \"Paths searched:\\n\" +\n      searched.map((p) => `  - ${p}`).join(\"\\n\") +\n      \"\\nInstall @remnic/plugin-codex or pass sourceDir explicitly.\",\n  );\n}\n\n/** Recursive synchronous directory copy. */\nfunction copyDirRecursiveSync(src: string, dest: string): number {\n  let count = 0;\n  fs.mkdirSync(dest, { recursive: true });\n  const entries = fs.readdirSync(src, { withFileTypes: true });\n  for (const entry of entries) {\n    const from = path.join(src, entry.name);\n    const to = path.join(dest, entry.name);\n    if (entry.isDirectory()) {\n      count += copyDirRecursiveSync(from, to);\n    } else if (entry.isFile()) {\n      fs.copyFileSync(from, to);\n      count += 1;\n    }\n    // Skip symlinks, sockets, etc. — extension content is plain files.\n  }\n  return count;\n}\n\n/**\n * Install the Remnic memory extension into `<codex_home>/memories_extensions/remnic/`\n * atomically. The copy is written to a sibling `.remnic.tmp-<pid>-<ts>` directory\n * and then renamed into place, so a concurrent Codex phase-2 run never sees a\n * half-written extension.\n *\n * This function is **idempotent and scoped**: it only touches the `remnic`\n * subfolder inside `memories_extensions/`. Adjacent extensions (other\n * vendors) are never read, written, or removed.\n */\nexport function installCodexMemoryExtension(\n  options: InstallCodexMemoryExtensionOptions = {},\n): InstallCodexMemoryExtensionResult {\n  const paths = resolveCodexMemoryExtensionPaths(options.codexHome ?? null);\n  const sourceDir = locatePluginCodexExtensionSource(options.sourceDir ?? null);\n\n  fs.mkdirSync(paths.extensionsRoot, { recursive: true });\n\n  // Clean any stale tmp from a previous crashed run by scanning the\n  // extensions root for any `.remnic.tmp-*` prefixed entry. We must do this\n  // BEFORE creating the new tmp directory. Per-entry errors are swallowed so\n  // one bad entry doesn't abort cleanup of the rest.\n  //\n  // Finding 2: only remove tmp dirs that are provably stale (older than\n  // STALE_TMP_THRESHOLD_MS). Dirs younger than the threshold belong to a\n  // concurrent install that is still in progress; deleting them would corrupt\n  // the other process's atomic rename.\n  const tmpPrefix = `.${REMNIC_EXTENSION_DIR_NAME}.tmp-`;\n  const STALE_TMP_THRESHOLD_MS = 10 * 60 * 1000; // 10 minutes\n  const now = Date.now();\n  try {\n    const existingEntries = fs.readdirSync(paths.extensionsRoot);\n    for (const entry of existingEntries) {\n      if (!entry.startsWith(tmpPrefix)) continue;\n      const stalePath = path.join(paths.extensionsRoot, entry);\n      try {\n        const stat = fs.statSync(stalePath);\n        const ageMs = now - stat.mtimeMs;\n        if (ageMs < STALE_TMP_THRESHOLD_MS) {\n          // Too recent — leave it alone; another install is likely still running.\n          continue;\n        }\n        fs.rmSync(stalePath, { recursive: true, force: true });\n      } catch {\n        // swallow — one bad entry should not abort the others\n      }\n    }\n  } catch {\n    // extensions root just-created / unreadable — nothing to clean\n  }\n\n  const tmpName = `${tmpPrefix}${process.pid}-${Date.now()}`;\n  const tmpDir = path.join(paths.extensionsRoot, tmpName);\n\n  let filesCopied = 0;\n  let commitFn: () => void = () => { /* no-op: set below on success */ };\n  let rollbackFn: () => void = () => { /* no-op: set below on success */ };\n  try {\n    filesCopied = copyDirRecursiveSync(sourceDir, tmpDir);\n\n    // Atomic replace: rename old remnic/ to a timestamped backup, then rename\n    // the tmp dir into place.  If the second rename fails, restore from backup\n    // so the old extension is never permanently lost.\n    const backupDir = `${paths.remnicExtensionDir}.bak-${Date.now()}`;\n    const hadExisting = fs.existsSync(paths.remnicExtensionDir);\n    if (hadExisting) {\n      fs.renameSync(paths.remnicExtensionDir, backupDir);\n    }\n    try {\n      fs.renameSync(tmpDir, paths.remnicExtensionDir);\n    } catch (renameErr) {\n      // New rename failed — restore backup so the old extension survives.\n      if (hadExisting) {\n        try {\n          fs.renameSync(backupDir, paths.remnicExtensionDir);\n        } catch {\n          // swallow — backup restore best-effort\n        }\n      }\n      throw renameErr;\n    }\n    // The new extension is in place. We intentionally keep the backup alive\n    // until the caller calls commit(). This gives the caller a chance to roll\n    // back to the prior state if a subsequent operation (e.g. config write) fails.\n    //\n    // commit() — remove the backup (called on success)\n    // rollback() — restore the prior extension from backup, or remove the newly\n    //              installed directory if this was a fresh install\n    commitFn = (): void => {\n      if (hadExisting) {\n        try {\n          fs.rmSync(backupDir, { recursive: true, force: true });\n        } catch {\n          // swallow — stale backup is harmless\n        }\n      }\n    };\n    rollbackFn = (): void => {\n      if (hadExisting) {\n        // Restore the prior extension from backup.\n        try {\n          // Remove the newly-installed dir first so rename can succeed.\n          if (fs.existsSync(paths.remnicExtensionDir)) {\n            fs.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });\n          }\n          fs.renameSync(backupDir, paths.remnicExtensionDir);\n        } catch {\n          // swallow — best-effort restore; backup remains on disk\n        }\n      } else {\n        // Fresh install — just remove the directory we created.\n        try {\n          if (fs.existsSync(paths.remnicExtensionDir)) {\n            fs.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });\n          }\n        } catch {\n          // swallow\n        }\n      }\n    };\n  } catch (err) {\n    // Best-effort cleanup so we never leave .tmp garbage behind.\n    if (fs.existsSync(tmpDir)) {\n      try {\n        fs.rmSync(tmpDir, { recursive: true, force: true });\n      } catch {\n        // swallow\n      }\n    }\n    throw err;\n  }\n\n  const instructionsPath = path.join(paths.remnicExtensionDir, \"instructions.md\");\n\n  return {\n    ...paths,\n    instructionsPath,\n    filesCopied,\n    commit: commitFn,\n    rollback: rollbackFn,\n  };\n}\n\n/**\n * Remove the Remnic memory extension. Only touches\n * `<codex_home>/memories_extensions/remnic/` — never adjacent extensions.\n */\nexport function removeCodexMemoryExtension(\n  options: RemoveCodexMemoryExtensionOptions = {},\n): RemoveCodexMemoryExtensionResult {\n  const paths = resolveCodexMemoryExtensionPaths(options.codexHome ?? null);\n  let removed = false;\n  if (fs.existsSync(paths.remnicExtensionDir)) {\n    fs.rmSync(paths.remnicExtensionDir, { recursive: true, force: true });\n    removed = true;\n  }\n  return { ...paths, removed };\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nfunction getConnectorsDir(): string {\n  const xdgConfigHome = readEnvVar(\"XDG_CONFIG_HOME\");\n  const configDir = xdgConfigHome\n    ? path.join(xdgConfigHome, \"engram\")\n    : path.join(resolveHomeDir(), \".config\", \"engram\");\n  return path.join(configDir, REGISTRY_DIR_NAME, \"connectors\");\n}\n\n// ── WeClone proxy config helpers ───────────────────────────────────────────\n//\n// The standalone `remnic-weclone-proxy` CLI reads its config from\n// ~/.remnic/connectors/weclone.json by default. `remnic connectors install\n// weclone` composes and persists that file so the proxy can start without\n// additional setup. The file is also tracked by the connector registry (at\n// getConnectorsDir()/weclone.json) so `remnic connectors list/remove/doctor`\n// work uniformly across all connectors.\n\nconst WECLONE_PROXY_CONFIG_DIRNAME = \".remnic\";\nconst WECLONE_PROXY_CONFIG_FILENAME = \"weclone.json\";\n\n/**\n * Resolve the path to ~/.remnic/connectors/weclone.json for the current user.\n * Honours REMNIC_HOME / ENGRAM_HOME env overrides so tests can point the\n * install at a temp dir without leaking into the real home directory.\n *\n * Always returns an absolute path via `path.resolve` so install-time and\n * run-time resolution agree even when the override is a relative path like\n * `tmp/remnic` (which would otherwise be interpreted against the caller's\n * current working directory). Must stay in lockstep with the proxy CLI's\n * `defaultConfigPath()` in @remnic/connector-weclone/src/cli.ts.\n *\n * `HOME=\"\"` edge case: a nullish fallback would keep the\n * empty string (empty is not nullish), which `path.resolve(\"\", ...)` then\n * interprets as CWD. `os.homedir()` by contrast falls back to the OS\n * password database when HOME is empty, so the two code paths would\n * disagree. We therefore treat empty HOME as absent and delegate to\n * `os.homedir()` in both places — the same rule the proxy CLI follows.\n */\nexport function resolveWeCloneProxyConfigPath(): string {\n  const remnicHome = readEnvVar(\"REMNIC_HOME\");\n  const override = remnicHome && remnicHome.length > 0 ? remnicHome : readEnvVar(\"ENGRAM_HOME\");\n  if (override && override.length > 0) {\n    return path.resolve(expandTildePath(override), \"connectors\", WECLONE_PROXY_CONFIG_FILENAME);\n  }\n  const envHome = readEnvVar(\"HOME\");\n  const home = envHome && envHome.length > 0 ? envHome : os.homedir();\n  return path.resolve(\n    home,\n    WECLONE_PROXY_CONFIG_DIRNAME,\n    \"connectors\",\n    WECLONE_PROXY_CONFIG_FILENAME,\n  );\n}\n\n/**\n * Read the existing proxy config file, if any. Returns raw contents so the\n * caller can both parse it (for value precedence) and restore it verbatim on\n * rollback without touching byte-level formatting.\n */\nfunction readWeCloneProxyConfigIfExists(configPath: string): string | null {\n  try {\n    if (!fs.existsSync(configPath)) return null;\n    return fs.readFileSync(configPath, \"utf8\");\n  } catch {\n    return null;\n  }\n}\n\n/** Safely parse a JSON string into a record; returns null on error. */\nfunction safeParseJson(raw: string): Record<string, unknown> | null {\n  try {\n    const parsed = JSON.parse(raw);\n    if (typeof parsed === \"object\" && parsed !== null && !Array.isArray(parsed)) {\n      return parsed as Record<string, unknown>;\n    }\n    return null;\n  } catch {\n    return null;\n  }\n}\n\ninterface WeCloneProxyConfig {\n  wecloneApiUrl: string;\n  wecloneModelName: string;\n  proxyPort: number;\n  remnicDaemonUrl: string;\n  remnicAuthToken?: string;\n  sessionStrategy: \"caller-id\" | \"single\";\n  memoryInjection: {\n    maxTokens: number;\n    position: \"system-append\" | \"system-prepend\";\n    template: string;\n  };\n}\n\nconst WECLONE_DEFAULTS = {\n  wecloneApiUrl: \"http://localhost:8000/v1\",\n  wecloneModelName: \"weclone-avatar\",\n  proxyPort: 8100,\n  remnicDaemonUrl: \"http://localhost:4318\",\n  sessionStrategy: \"single\" as const,\n  memoryInjection: {\n    maxTokens: 1500,\n    position: \"system-append\" as const,\n    template: \"[Memory Context]\\n{memories}\\n[End Memory Context]\",\n  },\n};\n\n/**\n * Resolve a string field with precedence: userConfig → priorConfig → default.\n * Only non-empty strings are accepted from either source; invalid values fall\n * through so the user gets a working default rather than a broken install.\n */\nfunction resolveStringField(\n  userConfig: Record<string, unknown>,\n  priorConfig: Record<string, unknown> | null,\n  key: string,\n  fallback: string,\n): string {\n  const fromUser = userConfig[key];\n  if (typeof fromUser === \"string\" && fromUser.length > 0) return fromUser;\n  if (priorConfig) {\n    const fromPrior = priorConfig[key];\n    if (typeof fromPrior === \"string\" && fromPrior.length > 0) return fromPrior;\n  }\n  return fallback;\n}\n\n/**\n * Coerce a config value to an integer port in [1, 65535]. Accepts number or\n * numeric string (parseConnectorConfig produces strings from `--config\n * proxyPort=8100`). Returns null if the value is missing or invalid so the\n * caller can fall through to the next precedence level.\n */\nfunction coercePort(value: unknown): number | null {\n  if (typeof value === \"number\" && Number.isInteger(value) && value >= 1 && value <= 65535) {\n    return value;\n  }\n  if (typeof value === \"string\" && value.length > 0) {\n    const n = Number(value);\n    if (Number.isInteger(n) && n >= 1 && n <= 65535) return n;\n  }\n  return null;\n}\n\nfunction resolvePort(\n  userConfig: Record<string, unknown>,\n  priorConfig: Record<string, unknown> | null,\n  fallback: number,\n): number {\n  const fromUser = coercePort(userConfig.proxyPort);\n  if (fromUser !== null) return fromUser;\n  if (priorConfig) {\n    const fromPrior = coercePort(priorConfig.proxyPort);\n    if (fromPrior !== null) return fromPrior;\n  }\n  return fallback;\n}\n\nfunction resolveSessionStrategy(\n  userConfig: Record<string, unknown>,\n  priorConfig: Record<string, unknown> | null,\n): \"caller-id\" | \"single\" {\n  const valid = new Set([\"caller-id\", \"single\"]);\n  const fromUser = userConfig.sessionStrategy;\n  if (typeof fromUser === \"string\" && valid.has(fromUser)) {\n    return fromUser as \"caller-id\" | \"single\";\n  }\n  if (priorConfig) {\n    const fromPrior = priorConfig.sessionStrategy;\n    if (typeof fromPrior === \"string\" && valid.has(fromPrior)) {\n      return fromPrior as \"caller-id\" | \"single\";\n    }\n  }\n  return WECLONE_DEFAULTS.sessionStrategy;\n}\n\n/**\n * Compose a WeCloneProxyConfig from user-supplied overrides and any prior\n * saved config, filling in defaults for every required field. The returned\n * shape is exactly what the proxy's parseConfig() expects.\n */\nexport function buildWeCloneProxyConfig(args: {\n  userConfig: Record<string, unknown>;\n  priorConfig: Record<string, unknown> | null;\n  authToken?: string;\n}): WeCloneProxyConfig {\n  const { userConfig, priorConfig, authToken } = args;\n\n  const wecloneApiUrl = resolveStringField(\n    userConfig,\n    priorConfig,\n    \"wecloneApiUrl\",\n    WECLONE_DEFAULTS.wecloneApiUrl,\n  );\n  const wecloneModelName = resolveStringField(\n    userConfig,\n    priorConfig,\n    \"wecloneModelName\",\n    WECLONE_DEFAULTS.wecloneModelName,\n  );\n  const remnicDaemonUrl = resolveStringField(\n    userConfig,\n    priorConfig,\n    \"remnicDaemonUrl\",\n    WECLONE_DEFAULTS.remnicDaemonUrl,\n  );\n  const proxyPort = resolvePort(\n    userConfig,\n    priorConfig,\n    WECLONE_DEFAULTS.proxyPort,\n  );\n  const sessionStrategy = resolveSessionStrategy(userConfig, priorConfig);\n\n  // Memory injection: always start from defaults, then shallow-merge any\n  // prior values, then user overrides. Individual field validation happens in\n  // the proxy's parseConfig() at proxy startup — here we only assemble a\n  // best-effort shape. A malformed user override would be rejected later with\n  // a clean error message.\n  //\n  // `typeof [] === \"object\"` so a bare `typeof ... === \"object\" && ... !==\n  // null` guard would let an array spread numeric-indexed properties into\n  // the merged object, silently corrupting it. Explicitly reject arrays.\n  const memoryInjection = {\n    ...WECLONE_DEFAULTS.memoryInjection,\n    ...(priorConfig &&\n    typeof priorConfig.memoryInjection === \"object\" &&\n    priorConfig.memoryInjection !== null &&\n    !Array.isArray(priorConfig.memoryInjection)\n      ? (priorConfig.memoryInjection as Record<string, unknown>)\n      : {}),\n    ...(typeof userConfig.memoryInjection === \"object\" &&\n    userConfig.memoryInjection !== null &&\n    !Array.isArray(userConfig.memoryInjection)\n      ? (userConfig.memoryInjection as Record<string, unknown>)\n      : {}),\n  } as WeCloneProxyConfig[\"memoryInjection\"];\n\n  const config: WeCloneProxyConfig = {\n    wecloneApiUrl,\n    wecloneModelName,\n    proxyPort,\n    remnicDaemonUrl,\n    sessionStrategy,\n    memoryInjection,\n  };\n\n  // Token precedence: freshly minted token → user-supplied → prior saved.\n  // Never write a token if none is available — the proxy tolerates missing\n  // tokens (it just won't send Authorization headers to the daemon).\n  if (authToken && authToken.length > 0) {\n    config.remnicAuthToken = authToken;\n  } else if (typeof userConfig.remnicAuthToken === \"string\" && userConfig.remnicAuthToken.length > 0) {\n    config.remnicAuthToken = userConfig.remnicAuthToken;\n  } else if (priorConfig && typeof priorConfig.remnicAuthToken === \"string\" && priorConfig.remnicAuthToken.length > 0) {\n    config.remnicAuthToken = priorConfig.remnicAuthToken;\n  }\n\n  return config;\n}\n","/**\n * codex-marketplace.ts — Codex marketplace installation support (#418)\n *\n * Provides types and functions for integrating Remnic with the Codex CLI\n * marketplace system (`codex marketplace add`). This module handles:\n *\n *  - Generating a `marketplace.json` manifest describing Remnic as an\n *    installable plugin in the Codex marketplace ecosystem.\n *  - Validating marketplace manifest files against the expected schema.\n *  - Writing manifests to disk atomically.\n *  - Installing plugins from marketplace sources (GitHub, git, local, URL).\n *\n * Privacy\n * -------\n * This module does not persist any user content. It only reads package\n * metadata (name, version, description) and writes public marketplace\n * manifest files.\n */\n\nimport fs from \"node:fs\";\nimport path from \"node:path\";\n\nimport { log } from \"../logger.js\";\nimport type { PluginConfig } from \"../types.js\";\n\n// ── Types ─────────────────────────────────────────────────────────────────\n\n/** Source type for marketplace installation. */\nexport type MarketplaceInstallType = \"github\" | \"git\" | \"local\" | \"url\";\n\n/** A single plugin entry within a marketplace manifest. */\nexport interface MarketplaceEntry {\n  /** Plugin name (e.g. \"remnic\"). */\n  name: string;\n  /** Semver version string. */\n  version: string;\n  /** Human-readable description. */\n  description: string;\n  /** Repository identifier (e.g. \"joshuaswarren/remnic\"). */\n  repository: string;\n  /** How this plugin should be installed. */\n  installType: MarketplaceInstallType;\n  /** Optional direct URL to the plugin manifest. */\n  manifestUrl?: string;\n  /** Optional entry point path within the repository. */\n  entry?: string;\n  /** Optional config schema reference. */\n  configSchema?: string;\n}\n\n/** Top-level marketplace manifest. */\nexport interface MarketplaceManifest {\n  /** Schema version. Must be 1. */\n  version: 1;\n  /** Marketplace name. */\n  name: string;\n  /** Human-readable description. */\n  description: string;\n  /** Available plugins. */\n  plugins: MarketplaceEntry[];\n}\n\n/** Configuration for the marketplace subsystem. */\nexport interface MarketplaceConfig {\n  /** Whether marketplace features are enabled. Default: true. */\n  enabled: boolean;\n  /** Local path where marketplace data is cached. */\n  registryPath: string;\n  /** Whether to auto-update marketplace data on install. Default: false. */\n  autoUpdate: boolean;\n}\n\n/** Result of a marketplace install operation. */\nexport interface MarketplaceInstallResult {\n  /** Whether the install succeeded. */\n  ok: boolean;\n  /** Human-readable message. */\n  message: string;\n  /** Source that was installed from. */\n  source: string;\n  /** Source type. */\n  sourceType: MarketplaceInstallType;\n  /** Plugins that were discovered. */\n  pluginsFound: string[];\n  /** Errors encountered (empty on success). */\n  errors: string[];\n}\n\n/** Logger interface accepted by marketplace functions. */\nexport interface MarketplaceLogger {\n  info: (msg: string) => void;\n  warn: (msg: string) => void;\n  debug?: (msg: string) => void;\n}\n\n// ── Constants ─────────────────────────────────────────────────────────────\n\n/** Current marketplace schema version. */\nexport const MARKETPLACE_SCHEMA_VERSION = 1 as const;\n\n/** Default marketplace manifest filename. */\nexport const MARKETPLACE_MANIFEST_FILENAME = \"marketplace.json\";\n\n/** Valid install types for validation. */\nconst VALID_INSTALL_TYPES = new Set<string>([\"github\", \"git\", \"local\", \"url\"]);\n\n// ── Generate ──────────────────────────────────────────────────────────────\n\n/**\n * Generate a marketplace manifest describing Remnic as an installable plugin.\n *\n * Reads version from the workspace root `package.json` at the resolved path,\n * or falls back to a default version string.\n */\nexport function generateMarketplaceManifest(\n  options?: { packageVersion?: string },\n): MarketplaceManifest {\n  const version = options?.packageVersion ?? readPackageVersion() ?? \"0.0.0\";\n\n  return {\n    version: MARKETPLACE_SCHEMA_VERSION,\n    name: \"remnic\",\n    description: \"Remnic: Local-first AI memory with semantic search and consolidation\",\n    plugins: [\n      {\n        name: \"remnic\",\n        version,\n        description: \"Persistent memory plugin for Codex CLI\",\n        repository: \"joshuaswarren/remnic\",\n        installType: \"github\",\n        entry: \"packages/plugin-codex\",\n        configSchema: \"openclaw.plugin.json\",\n      },\n    ],\n  };\n}\n\n// ── Validate ──────────────────────────────────────────────────────────────\n\n/** Validation result with structured errors. */\nexport interface MarketplaceValidation {\n  valid: boolean;\n  errors: string[];\n}\n\n/**\n * Validate that an unknown value conforms to the MarketplaceManifest schema.\n *\n * Returns a typed manifest on success. Throws on invalid input with a\n * descriptive error message listing all schema violations.\n */\nexport function validateMarketplaceManifest(manifest: unknown): MarketplaceManifest {\n  const validation = checkMarketplaceManifest(manifest);\n  if (!validation.valid) {\n    throw new Error(\n      `Invalid marketplace manifest: ${validation.errors.join(\"; \")}`,\n    );\n  }\n  return manifest as MarketplaceManifest;\n}\n\n/**\n * Non-throwing validation. Returns a structured result with error details.\n */\nexport function checkMarketplaceManifest(manifest: unknown): MarketplaceValidation {\n  const errors: string[] = [];\n\n  if (typeof manifest !== \"object\" || manifest === null) {\n    return { valid: false, errors: [\"manifest must be a non-null object\"] };\n  }\n\n  const obj = manifest as Record<string, unknown>;\n\n  // version\n  if (obj.version !== MARKETPLACE_SCHEMA_VERSION) {\n    errors.push(`version must be ${MARKETPLACE_SCHEMA_VERSION}, got ${JSON.stringify(obj.version)}`);\n  }\n\n  // name\n  if (typeof obj.name !== \"string\" || obj.name.trim().length === 0) {\n    errors.push(\"name must be a non-empty string\");\n  }\n\n  // description\n  if (typeof obj.description !== \"string\" || obj.description.trim().length === 0) {\n    errors.push(\"description must be a non-empty string\");\n  }\n\n  // plugins\n  if (!Array.isArray(obj.plugins)) {\n    errors.push(\"plugins must be an array\");\n  } else if (obj.plugins.length === 0) {\n    errors.push(\"plugins must contain at least one entry\");\n  } else {\n    for (let i = 0; i < obj.plugins.length; i++) {\n      const plugin = obj.plugins[i] as Record<string, unknown>;\n      const prefix = `plugins[${i}]`;\n\n      if (typeof plugin !== \"object\" || plugin === null) {\n        errors.push(`${prefix} must be a non-null object`);\n        continue;\n      }\n\n      if (typeof plugin.name !== \"string\" || plugin.name.trim().length === 0) {\n        errors.push(`${prefix}.name must be a non-empty string`);\n      }\n\n      if (typeof plugin.version !== \"string\" || plugin.version.trim().length === 0) {\n        errors.push(`${prefix}.version must be a non-empty string`);\n      }\n\n      if (typeof plugin.description !== \"string\" || plugin.description.trim().length === 0) {\n        errors.push(`${prefix}.description must be a non-empty string`);\n      }\n\n      if (typeof plugin.repository !== \"string\" || plugin.repository.trim().length === 0) {\n        errors.push(`${prefix}.repository must be a non-empty string`);\n      }\n\n      if (typeof plugin.installType !== \"string\" || !VALID_INSTALL_TYPES.has(plugin.installType)) {\n        errors.push(\n          `${prefix}.installType must be one of: ${[...VALID_INSTALL_TYPES].join(\", \")}; ` +\n          `got ${JSON.stringify(plugin.installType)}`,\n        );\n      }\n\n      // Optional fields — validate type when present (PR #427 post-merge fix).\n      if (\"manifestUrl\" in plugin && plugin.manifestUrl !== undefined) {\n        if (typeof plugin.manifestUrl !== \"string\" || (plugin.manifestUrl as string).trim().length === 0) {\n          errors.push(`${prefix}.manifestUrl must be a non-empty string when provided`);\n        }\n      }\n      if (\"entry\" in plugin && plugin.entry !== undefined) {\n        if (typeof plugin.entry !== \"string\" || (plugin.entry as string).trim().length === 0) {\n          errors.push(`${prefix}.entry must be a non-empty string when provided`);\n        }\n      }\n      if (\"configSchema\" in plugin && plugin.configSchema !== undefined) {\n        if (typeof plugin.configSchema !== \"string\" || (plugin.configSchema as string).trim().length === 0) {\n          errors.push(`${prefix}.configSchema must be a non-empty string when provided`);\n        }\n      }\n    }\n  }\n\n  return { valid: errors.length === 0, errors };\n}\n\n// ── Write ─────────────────────────────────────────────────────────────────\n\n/**\n * Write a marketplace manifest to disk atomically.\n *\n * Uses write-to-temp-then-rename to avoid partial writes (CLAUDE.md gotcha #54).\n */\nexport async function writeMarketplaceManifest(\n  outputDir: string,\n  manifest: MarketplaceManifest,\n): Promise<void> {\n  // Validate before writing — never write garbage to disk.\n  const validation = checkMarketplaceManifest(manifest);\n  if (!validation.valid) {\n    throw new Error(\n      `Refusing to write invalid manifest: ${validation.errors.join(\"; \")}`,\n    );\n  }\n\n  fs.mkdirSync(outputDir, { recursive: true });\n\n  const destPath = path.join(outputDir, MARKETPLACE_MANIFEST_FILENAME);\n  const tmpPath = `${destPath}.tmp.${process.pid}`;\n  const content = JSON.stringify(manifest, null, 2) + \"\\n\";\n\n  fs.writeFileSync(tmpPath, content);\n  fs.renameSync(tmpPath, destPath);\n}\n\n// ── Install ───────────────────────────────────────────────────────────────\n\n/**\n * Install from a marketplace source.\n *\n * Reads the marketplace.json from the given source, validates it, and\n * returns a result describing what was found.\n */\nexport async function installFromMarketplace(\n  source: string,\n  sourceType: MarketplaceInstallType,\n  config: PluginConfig,\n  logger?: MarketplaceLogger,\n): Promise<MarketplaceInstallResult> {\n  const _log: MarketplaceLogger = logger ?? {\n    info: (msg) => log.info(`[marketplace] ${msg}`),\n    warn: (msg) => log.warn(`[marketplace] ${msg}`),\n    debug: (msg) => log.debug(`[marketplace] ${msg}`),\n  };\n\n  if (!config.codexMarketplaceEnabled) {\n    return {\n      ok: false,\n      message: \"Codex marketplace is disabled in config (codexMarketplaceEnabled: false)\",\n      source,\n      sourceType,\n      pluginsFound: [],\n      errors: [\"marketplace_disabled\"],\n    };\n  }\n\n  try {\n    const manifest = await resolveManifest(source, sourceType, _log);\n    const pluginNames = manifest.plugins.map((p) => p.name);\n\n    _log.info(`marketplace install: found ${pluginNames.length} plugin(s) from ${sourceType}://${source}`);\n\n    return {\n      ok: true,\n      message: `Successfully resolved ${pluginNames.length} plugin(s) from marketplace: ${pluginNames.join(\", \")}`,\n      source,\n      sourceType,\n      pluginsFound: pluginNames,\n      errors: [],\n    };\n  } catch (err) {\n    const errMsg = err instanceof Error ? err.message : String(err);\n    _log.warn(`marketplace install failed: ${errMsg}`);\n    return {\n      ok: false,\n      message: `Failed to install from marketplace: ${errMsg}`,\n      source,\n      sourceType,\n      pluginsFound: [],\n      errors: [errMsg],\n    };\n  }\n}\n\n// ── Source resolution ─────────────────────────────────────────────────────\n\n/**\n * Resolve a marketplace manifest from the given source.\n */\nasync function resolveManifest(\n  source: string,\n  sourceType: MarketplaceInstallType,\n  logger: MarketplaceLogger,\n): Promise<MarketplaceManifest> {\n  switch (sourceType) {\n    case \"local\":\n      return resolveLocal(source, logger);\n    case \"url\":\n      return resolveUrl(source, logger);\n    case \"github\":\n      return resolveGithub(source, logger);\n    case \"git\":\n      return resolveGit(source, logger);\n    default: {\n      // Exhaustive check — CLAUDE.md gotcha #51: reject invalid input.\n      const _: never = sourceType;\n      throw new Error(`Invalid source type: ${String(_)}`);\n    }\n  }\n}\n\n/**\n * Read marketplace.json from a local directory.\n */\nfunction resolveLocal(\n  dirPath: string,\n  logger: MarketplaceLogger,\n): MarketplaceManifest {\n  const manifestPath = path.join(dirPath, MARKETPLACE_MANIFEST_FILENAME);\n\n  if (!fs.existsSync(manifestPath)) {\n    throw new Error(`marketplace.json not found at ${manifestPath}`);\n  }\n\n  logger.debug?.(`reading local marketplace manifest: ${manifestPath}`);\n\n  const raw = fs.readFileSync(manifestPath, \"utf-8\");\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(`Invalid JSON in ${manifestPath}`);\n  }\n\n  // CLAUDE.md gotcha #18: validate parse result type\n  if (typeof parsed !== \"object\" || parsed === null) {\n    throw new Error(`marketplace.json at ${manifestPath} is not a valid object`);\n  }\n\n  return validateMarketplaceManifest(parsed);\n}\n\n/**\n * Fetch marketplace.json from a URL.\n */\nasync function resolveUrl(\n  url: string,\n  logger: MarketplaceLogger,\n): Promise<MarketplaceManifest> {\n  logger.debug?.(`fetching marketplace manifest from URL: ${url}`);\n\n  let parsedUrl: URL;\n  try {\n    parsedUrl = new URL(url);\n  } catch {\n    throw new Error(`Invalid URL: ${url}`);\n  }\n\n  if (parsedUrl.protocol !== \"https:\" && parsedUrl.protocol !== \"http:\") {\n    throw new Error(`Unsupported URL protocol: ${parsedUrl.protocol} (use https or http)`);\n  }\n\n  const response = await fetch(url);\n  if (!response.ok) {\n    throw new Error(`HTTP ${response.status} fetching ${url}`);\n  }\n\n  const body = await response.json() as unknown;\n  return validateMarketplaceManifest(body);\n}\n\n/**\n * Resolve marketplace.json from a GitHub repository reference (owner/repo).\n *\n * Attempts to fetch the raw marketplace.json from the default branch.\n */\nasync function resolveGithub(\n  repo: string,\n  logger: MarketplaceLogger,\n): Promise<MarketplaceManifest> {\n  // Validate format: must be owner/repo\n  if (!/^[a-zA-Z0-9._-]+\\/[a-zA-Z0-9._-]+$/u.test(repo)) {\n    throw new Error(`Invalid GitHub repo format: \"${repo}\" (expected owner/repo)`);\n  }\n\n  const rawUrl = `https://raw.githubusercontent.com/${repo}/HEAD/${MARKETPLACE_MANIFEST_FILENAME}`;\n  logger.debug?.(`fetching marketplace manifest from GitHub: ${rawUrl}`);\n\n  return resolveUrl(rawUrl, logger);\n}\n\n/**\n * Resolve marketplace.json from a git URL.\n *\n * For now this delegates to URL-based resolution by constructing a raw URL.\n * Full git clone support can be added later.\n */\nasync function resolveGit(\n  gitUrl: string,\n  logger: MarketplaceLogger,\n): Promise<MarketplaceManifest> {\n  // For git URLs that look like GitHub HTTPS URLs, extract owner/repo and\n  // delegate to the GitHub resolver.\n  const ghMatch = gitUrl.match(\n    /^(?:https?:\\/\\/)?github\\.com\\/([a-zA-Z0-9._-]+\\/[a-zA-Z0-9._-]+?)(?:\\.git)?$/u,\n  );\n  if (ghMatch?.[1]) {\n    logger.debug?.(`git URL looks like GitHub — delegating to github resolver`);\n    return resolveGithub(ghMatch[1], logger);\n  }\n\n  throw new Error(\n    `Git URL resolution requires a GitHub-format URL for now. ` +\n    `Got: ${gitUrl}. Use --type github or --type url instead.`,\n  );\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────\n\n/**\n * Read the workspace root package.json version. Returns undefined if not found.\n */\nfunction readPackageVersion(): string | undefined {\n  // Walk up from this file to find the workspace root package.json\n  // This module lives at packages/remnic-core/src/connectors/codex-marketplace.ts\n  // so workspace root is 4 levels up.\n  const candidates = [\n    path.resolve(import.meta.dirname ?? \".\", \"../../../..\"),\n    path.resolve(import.meta.dirname ?? \".\", \"../../../../..\"),\n    path.resolve(import.meta.dirname ?? \".\", \"..\"),\n  ];\n\n  for (const candidate of candidates) {\n    const pkgPath = path.join(candidate, \"package.json\");\n    try {\n      if (!fs.existsSync(pkgPath)) continue;\n      const raw = fs.readFileSync(pkgPath, \"utf-8\");\n      const parsed = JSON.parse(raw);\n      if (typeof parsed === \"object\" && parsed !== null && typeof parsed.version === \"string\") {\n        return parsed.version;\n      }\n    } catch {\n      // ignore\n    }\n  }\n\n  return undefined;\n}\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAOA,OAAOA,SAAQ;AACf,OAAOC,WAAU;AACjB,OAAO,QAAQ;AACf,SAAS,qBAAqB;AAC9B,SAAS,qBAAqB;;;ACQ9B,OAAO,QAAQ;AACf,OAAO,UAAU;AA8EV,IAAM,6BAA6B;AAGnC,IAAM,gCAAgC;AAG7C,IAAM,sBAAsB,oBAAI,IAAY,CAAC,UAAU,OAAO,SAAS,KAAK,CAAC;AAUtE,SAAS,4BACd,SACqB;AACrB,QAAM,UAAU,SAAS,kBAAkB,mBAAmB,KAAK;AAEnE,SAAO;AAAA,IACL,SAAS;AAAA,IACT,MAAM;AAAA,IACN,aAAa;AAAA,IACb,SAAS;AAAA,MACP;AAAA,QACE,MAAM;AAAA,QACN;AAAA,QACA,aAAa;AAAA,QACb,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,OAAO;AAAA,QACP,cAAc;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACF;AAgBO,SAAS,4BAA4B,UAAwC;AAClF,QAAM,aAAa,yBAAyB,QAAQ;AACpD,MAAI,CAAC,WAAW,OAAO;AACrB,UAAM,IAAI;AAAA,MACR,iCAAiC,WAAW,OAAO,KAAK,IAAI,CAAC;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAKO,SAAS,yBAAyB,UAA0C;AACjF,QAAM,SAAmB,CAAC;AAE1B,MAAI,OAAO,aAAa,YAAY,aAAa,MAAM;AACrD,WAAO,EAAE,OAAO,OAAO,QAAQ,CAAC,oCAAoC,EAAE;AAAA,EACxE;AAEA,QAAM,MAAM;AAGZ,MAAI,IAAI,YAAY,4BAA4B;AAC9C,WAAO,KAAK,mBAAmB,0BAA0B,SAAS,KAAK,UAAU,IAAI,OAAO,CAAC,EAAE;AAAA,EACjG;AAGA,MAAI,OAAO,IAAI,SAAS,YAAY,IAAI,KAAK,KAAK,EAAE,WAAW,GAAG;AAChE,WAAO,KAAK,iCAAiC;AAAA,EAC/C;AAGA,MAAI,OAAO,IAAI,gBAAgB,YAAY,IAAI,YAAY,KAAK,EAAE,WAAW,GAAG;AAC9E,WAAO,KAAK,wCAAwC;AAAA,EACtD;AAGA,MAAI,CAAC,MAAM,QAAQ,IAAI,OAAO,GAAG;AAC/B,WAAO,KAAK,0BAA0B;AAAA,EACxC,WAAW,IAAI,QAAQ,WAAW,GAAG;AACnC,WAAO,KAAK,yCAAyC;AAAA,EACvD,OAAO;AACL,aAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,QAAQ,KAAK;AAC3C,YAAM,SAAS,IAAI,QAAQ,CAAC;AAC5B,YAAM,SAAS,WAAW,CAAC;AAE3B,UAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,eAAO,KAAK,GAAG,MAAM,4BAA4B;AACjD;AAAA,MACF;AAEA,UAAI,OAAO,OAAO,SAAS,YAAY,OAAO,KAAK,KAAK,EAAE,WAAW,GAAG;AACtE,eAAO,KAAK,GAAG,MAAM,kCAAkC;AAAA,MACzD;AAEA,UAAI,OAAO,OAAO,YAAY,YAAY,OAAO,QAAQ,KAAK,EAAE,WAAW,GAAG;AAC5E,eAAO,KAAK,GAAG,MAAM,qCAAqC;AAAA,MAC5D;AAEA,UAAI,OAAO,OAAO,gBAAgB,YAAY,OAAO,YAAY,KAAK,EAAE,WAAW,GAAG;AACpF,eAAO,KAAK,GAAG,MAAM,yCAAyC;AAAA,MAChE;AAEA,UAAI,OAAO,OAAO,eAAe,YAAY,OAAO,WAAW,KAAK,EAAE,WAAW,GAAG;AAClF,eAAO,KAAK,GAAG,MAAM,wCAAwC;AAAA,MAC/D;AAEA,UAAI,OAAO,OAAO,gBAAgB,YAAY,CAAC,oBAAoB,IAAI,OAAO,WAAW,GAAG;AAC1F,eAAO;AAAA,UACL,GAAG,MAAM,gCAAgC,CAAC,GAAG,mBAAmB,EAAE,KAAK,IAAI,CAAC,SACrE,KAAK,UAAU,OAAO,WAAW,CAAC;AAAA,QAC3C;AAAA,MACF;AAGA,UAAI,iBAAiB,UAAU,OAAO,gBAAgB,QAAW;AAC/D,YAAI,OAAO,OAAO,gBAAgB,YAAa,OAAO,YAAuB,KAAK,EAAE,WAAW,GAAG;AAChG,iBAAO,KAAK,GAAG,MAAM,uDAAuD;AAAA,QAC9E;AAAA,MACF;AACA,UAAI,WAAW,UAAU,OAAO,UAAU,QAAW;AACnD,YAAI,OAAO,OAAO,UAAU,YAAa,OAAO,MAAiB,KAAK,EAAE,WAAW,GAAG;AACpF,iBAAO,KAAK,GAAG,MAAM,iDAAiD;AAAA,QACxE;AAAA,MACF;AACA,UAAI,kBAAkB,UAAU,OAAO,iBAAiB,QAAW;AACjE,YAAI,OAAO,OAAO,iBAAiB,YAAa,OAAO,aAAwB,KAAK,EAAE,WAAW,GAAG;AAClG,iBAAO,KAAK,GAAG,MAAM,wDAAwD;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,OAAO,OAAO,WAAW,GAAG,OAAO;AAC9C;AASA,eAAsB,yBACpB,WACA,UACe;AAEf,QAAM,aAAa,yBAAyB,QAAQ;AACpD,MAAI,CAAC,WAAW,OAAO;AACrB,UAAM,IAAI;AAAA,MACR,uCAAuC,WAAW,OAAO,KAAK,IAAI,CAAC;AAAA,IACrE;AAAA,EACF;AAEA,KAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAE3C,QAAM,WAAW,KAAK,KAAK,WAAW,6BAA6B;AACnE,QAAM,UAAU,GAAG,QAAQ,QAAQ,QAAQ,GAAG;AAC9C,QAAM,UAAU,KAAK,UAAU,UAAU,MAAM,CAAC,IAAI;AAEpD,KAAG,cAAc,SAAS,OAAO;AACjC,KAAG,WAAW,SAAS,QAAQ;AACjC;AAUA,eAAsB,uBACpB,QACA,YACA,QACA,QACmC;AACnC,QAAM,OAA0B,UAAU;AAAA,IACxC,MAAM,CAAC,QAAQ,IAAI,KAAK,iBAAiB,GAAG,EAAE;AAAA,IAC9C,MAAM,CAAC,QAAQ,IAAI,KAAK,iBAAiB,GAAG,EAAE;AAAA,IAC9C,OAAO,CAAC,QAAQ,IAAI,MAAM,iBAAiB,GAAG,EAAE;AAAA,EAClD;AAEA,MAAI,CAAC,OAAO,yBAAyB;AACnC,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA,cAAc,CAAC;AAAA,MACf,QAAQ,CAAC,sBAAsB;AAAA,IACjC;AAAA,EACF;AAEA,MAAI;AACF,UAAM,WAAW,MAAM,gBAAgB,QAAQ,YAAY,IAAI;AAC/D,UAAM,cAAc,SAAS,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI;AAEtD,SAAK,KAAK,8BAA8B,YAAY,MAAM,mBAAmB,UAAU,MAAM,MAAM,EAAE;AAErG,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,yBAAyB,YAAY,MAAM,gCAAgC,YAAY,KAAK,IAAI,CAAC;AAAA,MAC1G;AAAA,MACA;AAAA,MACA,cAAc;AAAA,MACd,QAAQ,CAAC;AAAA,IACX;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAC9D,SAAK,KAAK,+BAA+B,MAAM,EAAE;AACjD,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,SAAS,uCAAuC,MAAM;AAAA,MACtD;AAAA,MACA;AAAA,MACA,cAAc,CAAC;AAAA,MACf,QAAQ,CAAC,MAAM;AAAA,IACjB;AAAA,EACF;AACF;AAOA,eAAe,gBACb,QACA,YACA,QAC8B;AAC9B,UAAQ,YAAY;AAAA,IAClB,KAAK;AACH,aAAO,aAAa,QAAQ,MAAM;AAAA,IACpC,KAAK;AACH,aAAO,WAAW,QAAQ,MAAM;AAAA,IAClC,KAAK;AACH,aAAO,cAAc,QAAQ,MAAM;AAAA,IACrC,KAAK;AACH,aAAO,WAAW,QAAQ,MAAM;AAAA,IAClC,SAAS;AAEP,YAAM,IAAW;AACjB,YAAM,IAAI,MAAM,wBAAwB,OAAO,CAAC,CAAC,EAAE;AAAA,IACrD;AAAA,EACF;AACF;AAKA,SAAS,aACP,SACA,QACqB;AACrB,QAAM,eAAe,KAAK,KAAK,SAAS,6BAA6B;AAErE,MAAI,CAAC,GAAG,WAAW,YAAY,GAAG;AAChC,UAAM,IAAI,MAAM,iCAAiC,YAAY,EAAE;AAAA,EACjE;AAEA,SAAO,QAAQ,uCAAuC,YAAY,EAAE;AAEpE,QAAM,MAAM,GAAG,aAAa,cAAc,OAAO;AACjD,MAAI;AACJ,MAAI;AACF,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,MAAM,mBAAmB,YAAY,EAAE;AAAA,EACnD;AAGA,MAAI,OAAO,WAAW,YAAY,WAAW,MAAM;AACjD,UAAM,IAAI,MAAM,uBAAuB,YAAY,wBAAwB;AAAA,EAC7E;AAEA,SAAO,4BAA4B,MAAM;AAC3C;AAKA,eAAe,WACb,KACA,QAC8B;AAC9B,SAAO,QAAQ,2CAA2C,GAAG,EAAE;AAE/D,MAAI;AACJ,MAAI;AACF,gBAAY,IAAI,IAAI,GAAG;AAAA,EACzB,QAAQ;AACN,UAAM,IAAI,MAAM,gBAAgB,GAAG,EAAE;AAAA,EACvC;AAEA,MAAI,UAAU,aAAa,YAAY,UAAU,aAAa,SAAS;AACrE,UAAM,IAAI,MAAM,6BAA6B,UAAU,QAAQ,sBAAsB;AAAA,EACvF;AAEA,QAAM,WAAW,MAAM,MAAM,GAAG;AAChC,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,MAAM,QAAQ,SAAS,MAAM,aAAa,GAAG,EAAE;AAAA,EAC3D;AAEA,QAAM,OAAO,MAAM,SAAS,KAAK;AACjC,SAAO,4BAA4B,IAAI;AACzC;AAOA,eAAe,cACb,MACA,QAC8B;AAE9B,MAAI,CAAC,sCAAsC,KAAK,IAAI,GAAG;AACrD,UAAM,IAAI,MAAM,gCAAgC,IAAI,yBAAyB;AAAA,EAC/E;AAEA,QAAM,SAAS,qCAAqC,IAAI,SAAS,6BAA6B;AAC9F,SAAO,QAAQ,8CAA8C,MAAM,EAAE;AAErE,SAAO,WAAW,QAAQ,MAAM;AAClC;AAQA,eAAe,WACb,QACA,QAC8B;AAG9B,QAAM,UAAU,OAAO;AAAA,IACrB;AAAA,EACF;AACA,MAAI,UAAU,CAAC,GAAG;AAChB,WAAO,QAAQ,gEAA2D;AAC1E,WAAO,cAAc,QAAQ,CAAC,GAAG,MAAM;AAAA,EACzC;AAEA,QAAM,IAAI;AAAA,IACR,iEACQ,MAAM;AAAA,EAChB;AACF;AAOA,SAAS,qBAAyC;AAIhD,QAAM,aAAa;AAAA,IACjB,KAAK,QAAQ,YAAY,WAAW,KAAK,aAAa;AAAA,IACtD,KAAK,QAAQ,YAAY,WAAW,KAAK,gBAAgB;AAAA,IACzD,KAAK,QAAQ,YAAY,WAAW,KAAK,IAAI;AAAA,EAC/C;AAEA,aAAW,aAAa,YAAY;AAClC,UAAM,UAAU,KAAK,KAAK,WAAW,cAAc;AACnD,QAAI;AACF,UAAI,CAAC,GAAG,WAAW,OAAO,EAAG;AAC7B,YAAM,MAAM,GAAG,aAAa,SAAS,OAAO;AAC5C,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,OAAO,OAAO,YAAY,UAAU;AACvF,eAAO,OAAO;AAAA,MAChB;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO;AACT;;;AD3SA,IAAM,qBAA0C;AAAA,EAC9C;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,YAAY,MAAM,QAAQ;AAAA,IACjC,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,YAAY,MAAM,OAAO;AAAA,IAChC,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,WAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,YAAY,KAAK;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,aAAa,QAAQ;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,cAAc;AAAA,IAChB;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,YAAY,MAAM,QAAQ;AAAA,EACnC;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,aAAa,QAAQ;AAAA,EAC9B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,cAAc;AAAA,IAChB;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,YAAY,KAAK;AAAA,EAC1B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,cAAc;AAAA,IAChB;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,YAAY,IAAI;AAAA,EACzB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,iBAAiB;AAAA,MACjB,WAAW;AAAA,MACX,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,YAAY,MAAM,MAAM,cAAc;AAAA,IAC7C,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,YAAY,OAAO;AAAA,IAC1B,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,cAAc;AAAA,MACd,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,WAAW,KAAK;AAAA,IACvB,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aACE;AAAA,IAEF,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,eACE;AAAA,MACF,WAAW;AAAA,MACX,iBACE;AAAA,MACF,iBACE;AAAA,MACF,kBAAkB;AAAA,IACpB;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,YAAY,MAAM,WAAW,OAAO;AAAA,IAC3C,eAAe;AAAA,EACjB;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,MAAM;AAAA,IACN,SAAS;AAAA,IACT,aAAa;AAAA,IACb,cAAc;AAAA,MACZ,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,UAAU;AAAA,MACV,cAAc;AAAA,MACd,OAAO;AAAA,MACP,gBAAgB;AAAA,MAChB,gBAAgB;AAAA,IAClB;AAAA,IACA,cAAc;AAAA,MACZ,MAAM;AAAA,MACN,MAAM;AAAA,MACN,SAAS;AAAA,IACX;AAAA,IACA,UAAU;AAAA,IACV,QAAQ;AAAA,IACR,MAAM,CAAC,YAAY,UAAU,QAAQ;AAAA,IACrC,eAAe;AAAA,EACjB;AACF;AAIA,IAAM,oBAAoB;AAEnB,SAAS,kBAA0B;AACxC,QAAM,gBAAgB,WAAW,iBAAiB;AAClD,QAAM,YAAY,gBACdC,MAAK,KAAK,eAAe,QAAQ,IACjCA,MAAK,KAAK,eAAe,GAAG,WAAW,QAAQ;AACnD,SAAOA,MAAK,KAAK,WAAW,mBAAmB,eAAe;AAChE;AAEO,SAAS,eAAkC;AAChD,QAAM,UAAU,gBAAgB;AAEhC,MAAI,CAACC,IAAG,WAAW,OAAO,GAAG;AAE3B,UAAM,WAA8B;AAAA,MAClC,YAAY;AAAA,MACZ,cAAc;AAAA,IAChB;AACA,iBAAa,QAAQ;AACrB,WAAO;AAAA,EACT;AAEA,QAAM,MAAMA,IAAG,aAAa,SAAS,MAAM;AAC3C,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAM7B,UAAM,aAAa,IAAI,IAAI,mBAAmB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC;AAC9D,UAAM,cAAc,OAAO,cAAc,CAAC,GAAG,OAAO,CAAC,MAAyB,CAAC,WAAW,IAAI,EAAE,EAAE,CAAC;AACnG,UAAM,SAAS,CAAC,GAAG,oBAAoB,GAAG,UAAU;AACpD,WAAO;AAAA,MACL,YAAY;AAAA,MACZ,cAAc;AAAA,IAChB;AAAA,EACF,QAAQ;AACN,UAAM,WAA8B;AAAA,MAClC,YAAY;AAAA,MACZ,cAAc;AAAA,IAChB;AACA,iBAAa,QAAQ;AACrB,WAAO;AAAA,EACT;AACF;AAEO,SAAS,aAAa,UAAmC;AAC9D,QAAM,UAAU,SAAS;AACzB,EAAAA,IAAG,UAAUD,MAAK,QAAQ,OAAO,GAAG,EAAE,WAAW,KAAK,CAAC;AACvD,EAAAC,IAAG,cAAc,SAAS,KAAK,UAAU,EAAE,YAAY,SAAS,WAAW,GAAG,MAAM,CAAC,CAAC;AACxF;AAIO,SAAS,iBAGd;AACA,QAAM,WAAW,aAAa;AAC9B,QAAM,gBAAgB,iBAAiB;AACvC,QAAM,eAAe,oBAAI,IAAY;AAGrC,MAAIA,IAAG,WAAW,aAAa,GAAG;AAChC,eAAW,SAASA,IAAG,YAAY,aAAa,GAAG;AACjD,UAAI,MAAM,SAAS,OAAO,GAAG;AAC3B,YAAI;AACF,gBAAM,SAAS,KAAK;AAAA,YAClBA,IAAG,aAAaD,MAAK,KAAK,eAAe,KAAK,GAAG,MAAM;AAAA,UACzD;AACA,uBAAa,IAAI,OAAO,WAAqB;AAAA,QAC/C,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAGA,QAAM,YAAiC,SAAS,WAAW,IAAI,CAAC,cAAc;AAAA,IAC5E,GAAG;AAAA,IACH,WAAW,aAAa,IAAI,SAAS,EAAE;AAAA,EACzC,EAAE;AAGF,QAAM,YAAiC,CAAC;AACxC,aAAW,MAAM,cAAc;AAC7B,UAAM,aAAaA,MAAK,KAAK,eAAe,GAAG,EAAE,OAAO;AACxD,QAAI;AACF,YAAM,MAAM,KAAK,MAAMC,IAAG,aAAa,YAAY,MAAM,CAAC;AAM1D,YAAM,EAAE,OAAO,WAAW,GAAG,OAAO,IAAI;AACxC,gBAAU,KAAK;AAAA,QACb,aAAa;AAAA,QACb;AAAA,QACA,QAAQ;AAAA,QACR,aAAa,IAAI;AAAA,MACnB,CAAC;AAAA,IACH,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,SAAO,EAAE,WAAW,UAAU;AAChC;AAOO,SAAS,kBAAkB,aAAyC;AACzE,MAAI;AACF,WAAO,eAAe,EAAE,OAAO,KAAK,CAAC,MAAM,EAAE,cAAc,WAAW,GAAG;AAAA,EAC3E,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,yBAAyB,YAA6C;AAC7E,MAAI,CAACA,IAAG,WAAW,UAAU,EAAG,QAAO,CAAC;AACxC,MAAI;AACF,UAAM,SAAS,KAAK,MAAMA,IAAG,aAAa,YAAY,MAAM,CAAC;AAC7D,QAAI,CAAC,UAAU,OAAO,WAAW,YAAY,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AAC5E,UAAM;AAAA,MACJ,aAAa;AAAA,MACb,aAAa;AAAA,MACb,OAAO;AAAA,MACP,GAAG;AAAA,IACL,IAAI;AACJ,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,SAAS,kCACP,sBACA,eACyB;AACzB,QAAM,SAAkC,EAAE,GAAG,qBAAqB;AAClE,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,aAAa,GAAG;AACxD,QAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,IAAI;AACzD,aAAO,OAAO,GAAG;AAAA,IACnB;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,gCAAgC,eAAiE;AACxG,QAAM,iBAA0C,CAAC;AACjD,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,aAAa,GAAG;AACxD,QAAI,UAAU,UAAa,UAAU,QAAQ,UAAU,GAAI;AAC3D,mBAAe,GAAG,IAAI;AAAA,EACxB;AACA,SAAO;AACT;AAIO,SAAS,iBAAiB,SAAwC;AACvE,QAAM,WAAW,aAAa;AAC9B,QAAM,WAAW,SAAS,WAAW,KAAK,CAAC,MAAM,EAAE,OAAO,QAAQ,WAAW;AAE7E,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,MACL,aAAa,QAAQ;AAAA,MACrB,QAAQ;AAAA,MACR,SAAS,sBAAsB,QAAQ,WAAW;AAAA,IACpD;AAAA,EACF;AAGA,QAAM,WAAW,eAAe,EAAE,UAAU;AAAA,IAC1C,CAAC,MAAM,EAAE,gBAAgB,QAAQ;AAAA,EACnC;AAEA,MAAI,YAAY,CAAC,QAAQ,OAAO;AAC9B,WAAO;AAAA,MACL,aAAa,QAAQ;AAAA,MACrB,QAAQ;AAAA,MACR,SAAS;AAAA,IACX;AAAA,EACF;AAGA,QAAM,YAAY,iBAAiB;AACnC,EAAAA,IAAG,UAAU,WAAW,EAAE,WAAW,KAAK,CAAC;AAE3C,QAAM,aAAaD,MAAK,KAAK,WAAW,GAAG,QAAQ,WAAW,OAAO;AACrE,QAAM,uBAAuB,WAAW,yBAAyB,UAAU,IAAI,CAAC;AAYhF,MAAI;AACJ,MAAI;AACJ,MAAI;AAEJ,MAAI;AACJ,MAAI;AACJ,MAAI;AACJ,MAAI,QAAQ,gBAAgB,UAAU;AACpC,QAAIC,IAAG,WAAW,UAAU,GAAG;AAC7B,UAAI;AACF,cAAM,OAAO,KAAK,MAAMA,IAAG,aAAa,YAAY,MAAM,CAAC;AAK3D,YAAI,MAAM,WAAW,MAAM;AACzB,cAAI;AACF,iCAAqB,sBAAsB,OAAO,KAAK,OAAO,CAAC;AAAA,UACjE,QAAQ;AAAA,UAER;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,MAAM;AACtB,cAAI;AACF,8BAAkB,mBAAmB,OAAO,KAAK,IAAI,CAAC;AAAA,UACxD,QAAQ;AAAA,UAER;AAAA,QACF;AACA,YAAI,MAAM,QAAQ,MAAM;AACtB,cAAI;AACF,kBAAM,cAAc,OAAO,OAAO,KAAK,IAAI,CAAC;AAC5C,8BAAkB,mBAAmB,WAAW;AAAA,UAClD,QAAQ;AAAA,UAER;AAAA,QACF;AAAA,MACF,QAAQ;AAAA,MAER;AAAA,IACF;AAGA,4BAAwB,sBAAsB;AAC9C,yBAAqB,mBAAmB;AAIxC,QAAI,QAAQ,QAAQ,SAAS,QAAW;AACtC,UAAI;AACF,6BAAqB,mBAAmB,OAAO,OAAO,QAAQ,OAAO,IAAI,CAAC,CAAC;AAAA,MAC7E,SAAS,KAAK;AACZ,eAAO;AAAA,UACL,aAAa,QAAQ;AAAA,UACrB,QAAQ;AAAA,UACR,SAAS,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACrF;AAAA,MACF;AAAA,IACF;AACA,QAAI,uBAAuB,QAAW;AACpC,2BAAqB,mBAAmB;AAAA,IAC1C;AAGA,QAAI,QAAQ,QAAQ,YAAY,QAAW;AACzC,UAAI;AACF,gCAAwB,sBAAsB,OAAO,QAAQ,OAAO,OAAO,CAAC;AAAA,MAC9E,SAAS,KAAK;AACZ,eAAO;AAAA,UACL,aAAa,QAAQ;AAAA,UACrB,QAAQ;AAAA,UACR,SAAS,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACrF;AAAA,MACF;AAAA,IACF;AACA,QAAI,QAAQ,QAAQ,SAAS,QAAW;AACtC,UAAI;AACF,6BAAqB,mBAAmB,OAAO,QAAQ,OAAO,IAAI,CAAC;AAAA,MACrE,SAAS,KAAK;AACZ,eAAO;AAAA,UACL,aAAa,QAAQ;AAAA,UACrB,QAAQ;AAAA,UACR,SAAS,0BAA0B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACrF;AAAA,MACF;AAAA,IACF;AAAA,EACF;AA+BA,QAAM,2BAA4B,QAAQ,gBAAgB,YAAY,SAAS,gBAC3E,eAAe,IACf;AAEJ,MAAI,aAAsD;AAC1D,MAAI,QAAQ,gBAAgB,UAAU;AAEpC,QAAI;AACF,mBAAa,gBAAgB,QAAQ,WAAW;AAAA,IAClD,QAAQ;AAAA,IAER;AAAA,EACF,WAAW,SAAS,eAAe;AAEjC,QAAI;AACF,mBAAa,cAAc,QAAQ,WAAW;AAAA,IAChD,QAAQ;AAUN,UAAI,6BAA6B,MAAM;AACrC,YAAI;AACF,yBAAe,wBAAwB;AAAA,QACzC,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAOA,MAAI,QAAQ,gBAAgB,YAAY,SAAS,iBAAiB,eAAe,MAAM;AACrF,WAAO;AAAA,MACL,aAAa,QAAQ;AAAA,MACrB,QAAQ;AAAA,MACR,SACE,GAAG,SAAS,IAAI,0EACe,QAAQ,WAAW;AAAA,IACtD;AAAA,EACF;AAeA,QAAM,EAAE,OAAO,cAAc,GAAG,cAAc,IAAK,QAAQ,UAAU,CAAC;AACtE,QAAM,+BAA+B,kCAAkC,sBAAsB,aAAa;AAC1G,QAAM,iBAAiB,gCAAgC,aAAa;AACpE,QAAM,iBAA0C;AAAA,IAC9C,GAAG;AAAA,IACH,GAAG;AAAA,IACH,aAAa,QAAQ;AAAA,IACrB,cAAa,oBAAI,KAAK,GAAE,YAAY;AAAA;AAAA;AAAA;AAAA;AAAA,IAKpC,GAAI,0BAA0B,SAAY;AAAA,MACxC,SAAS;AAAA,MACT,MAAM;AAAA,MACN,MAAM;AAAA,IACR,IAAI,CAAC;AAAA,EACP;AAqBA,MAAI,QAAQ,gBAAgB,UAAU;AAGpC,UAAM,aAAa;AACnB,UAAM,aAAa;AACnB,UAAM,aAAa;AAGnB,QAAI;AACJ,QAAI;AACF,sBAAgB,sBAAsB,UAAU;AAAA,IAClD,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,aAAa,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,SAAS,2BAA2B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACtF;AAAA,IACF;AAGA,QAAI,CAAC,YAAY;AACf,aAAO;AAAA,QACL,aAAa,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,SACE;AAAA,MAEJ;AAAA,IACF;AAIA,QAAI;AACJ,QAAI;AACF,mBAAa,mBAAmB;AAAA,QAC9B,SAAS;AAAA,QACT,MAAM;AAAA,QACN,MAAM;AAAA,QACN,OAAO,WAAW;AAAA,MACpB,CAAC;AAAA,IACH,SAAS,KAAK;AAEZ,aAAO;AAAA,QACL,aAAa,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,SAAS,2DAAsD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACjH;AAAA,IACF;AAEA,QAAI,CAAC,WAAW,SAAS;AAIvB,aAAO;AAAA,QACL,aAAa,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,SAAS,2BAA2B,WAAW,UAAU,yBAAyB;AAAA,MAEpF;AAAA,IACF;AAaA,UAAM,kBAAkB,eAAe;AACvC,QAAI,YAAY;AAChB,QAAI;AACF,uBAAiB,UAAU;AAC3B,kBAAY;AAAA,IACd,SAAS,WAAW;AAIlB,UAAI,mBAAmB;AACvB,UAAI,uBAAuB;AAC3B,UAAI;AACF,uBAAe,eAAe;AAAA,MAChC,SAAS,iBAAiB;AACxB,2BAAmB;AACnB,+BAAuB,2BAA2B,QAAQ,gBAAgB,UAAU,OAAO,eAAe;AAAA,MAC5G;AAEA,UAAI,iBAAiB;AACrB,UAAI,qBAAqB;AACzB,UAAI;AACF,YAAI,WAAW,iBAAiB,MAAM;AAEpC,UAAAA,IAAG,WAAW,WAAW,UAAU;AAAA,QACrC,WAAW,OAAO,WAAW,iBAAiB,UAAU;AAEtD,8BAAoB,WAAW,YAAY,WAAW,YAAY;AAAA,QACpE;AAAA,MACF,SAAS,gBAAgB;AACvB,yBAAiB;AACjB,6BAAqB,0BAA0B,QAAQ,eAAe,UAAU,OAAO,cAAc;AAAA,MACvG;AAEA,YAAM,eAAe,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS;AACtF,UAAI;AACJ,UAAI,oBAAoB,gBAAgB;AACtC,kBACE,oDACG,YAAY;AAAA,MAGnB,WAAW,CAAC,kBAAkB,kBAAkB;AAC9C,kBACE,oDACG,YAAY,gEAEX,kBAAkB,uGAEF,WAAW,UAAU;AAAA,MAC7C,WAAW,kBAAkB,CAAC,kBAAkB;AAC9C,kBACE,oDACG,YAAY,gEAEX,oBAAoB;AAAA,MAG5B,OAAO;AACL,kBACE,oDACG,YAAY,yDACwC,kBAAkB,mCACzC,oBAAoB,yEAEhC,WAAW,UAAU;AAAA,MAE7C;AACA,aAAO;AAAA,QACL,aAAa,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAOA,QAAI;AACF,0BAAoB,YAAY,KAAK,UAAU,gBAAgB,MAAM,CAAC,CAAC;AAAA,IACzE,SAAS,UAAU;AAGjB,UAAI,sBAAsB;AAC1B,UAAI,mBAAmB;AACvB,UAAI;AACF,uBAAe,eAAe;AAAA,MAChC,SAAS,iBAAiB;AACxB,8BAAsB;AACtB,2BAAmB,0BAA0B,2BAA2B,QAAQ,gBAAgB,UAAU,OAAO,eAAe,CAAC;AAAA,MACnI;AAEA,UAAI,kBAAkB;AACtB,UAAI;AACF,YAAI,WAAW,iBAAiB,MAAM;AAIpC,cAAI,kBAAkB;AACtB,cAAI;AACJ,cAAI;AACF,YAAAA,IAAG,WAAW,WAAW,UAAU;AACnC,8BAAkB;AAAA,UACpB,SAAS,KAAK;AACZ,wBAAY;AAAA,UACd;AACA,cAAI,iBAAiB;AACnB,8BAAkB;AAAA,UACpB,OAAO;AACL,kBAAM,YAAY,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS;AACnF,8BAAkB,2EAAsE,SAAS;AAAA,UACnG;AAAA,QACF,WAAW,OAAO,WAAW,iBAAiB,UAAU;AACtD,8BAAoB,WAAW,YAAY,WAAW,YAAY;AAClE,4BAAkB;AAAA,QACpB;AAAA,MACF,SAAS,iBAAiB;AACxB,0BAAkB,gCAAgC,2BAA2B,QAAQ,gBAAgB,UAAU,OAAO,eAAe,CAAC;AAAA,MACxI;AACA,YAAM,eAAe,sBACjB,2HACA;AACJ,aAAO;AAAA,QACL,aAAa,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,SACE,mHAEa,gBAAgB,KAAK,eAAe,IAC9C,YAAY;AAAA,MACnB;AAAA,IACF;AAEA,UAAM,QAAkB,CAAC;AACzB,UAAM,KAAK,0BAA0B,WAAW,UAAU,EAAE;AAI5D,QAAI,kBAAkB,WAAW;AAC/B,YAAM,0BAA0B,+BAA+B;AAC/D,UAAI,CAAC,uBAAuB,WAAW,YAAY,uBAAuB,GAAG;AAC3E,YAAI;AACF,gBAAM,2BAA2B,uBAAuB,uBAAuB;AAC/E,cAAI,yBAAyB,SAAS;AACpC,kBAAM,KAAK,4DAA4D,uBAAuB,EAAE;AAAA,UAClG;AAAA,QACF,QAAQ;AACN,gBAAM,KAAK,uEAAuE;AAAA,QACpF;AAAA,MACF;AAAA,IACF;AAOA,QAAI,oCAAoC;AACxC,QAAI,uBAAuB,QAAW;AACpC,UAAI;AACF,4CACE,CAAC,uBAAuB,iBAAiB,kBAAkB,GAAG,iBAAiB,aAAa,CAAC;AAAA,MACjG,QAAQ;AAEN,4CAAoC;AAAA,MACtC;AAAA,IACF;AACA,QAAI,mCAAmC;AACrC,UAAI;AACF,cAAM,iBAAiB,mBAAmB,EAAE,SAAS,mBAAoB,CAAC;AAC1E,YAAI,eAAe,SAAS;AAC1B,gBAAM,KAAK,sDAAsD,eAAe,UAAU,EAAE;AAAA,QAC9F;AAAA,MACF,QAAQ;AAEN,cAAM,KAAK,oEAAoE,kBAAkB,GAAG;AAAA,MACtG;AAAA,IACF;AAOA,QAAI,aAAa,YAAY;AAC3B,YAAM,WAAW,kBAAkB,YAAY,YAAY,WAAW,KAAK;AAC3E,UAAI,UAAU;AACZ,cAAM,KAAK,yBAAyB;AAAA,MACtC,OAAO;AACL,cAAM;AAAA,UACJ,2BAA2B,UAAU,IAAI,UAAU;AAAA,QACrD;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAAS,MAAM,SAAS,IAAI;AAAA,IAAO,MAAM,KAAK,MAAM,CAAC,KAAK;AAChE,WAAO;AAAA,MACL,aAAa,QAAQ;AAAA,MACrB,QAAQ;AAAA,MACR;AAAA,MACA,SAAS,aAAa,SAAS,IAAI,KAAK,SAAS,OAAO,GAAG,MAAM;AAAA,IACnE;AAAA,EACF;AAUA,MAAI,mBAAmB;AAKvB,MAAI,qBAAqB;AAGzB,MAAI,kBAA+D;AACnE,MAAI,QAAQ,gBAAgB,aAAa;AAIvC,UAAM,UAAU,uBAAuB,eAAe,gBAAgB;AACtE,QAAI,YAAY,QAAW;AACzB,qBAAe,mBAAmB;AAAA,IACpC;AACA,UAAM,gBAAgB,eAAe,qBAAqB;AAK1D,mBAAe,mBAAmB;AAIlC,UAAM,oBACJ,OAAO,eAAe,cAAc,YAAY,eAAe,UAAU,SAAS,IAC7E,eAAe,YAChB;AACN,UAAM,oBAAoB,iBAAiB,iBAAiB;AAC5D,mBAAe,YAAY;AAE3B,QAAI,eAAe;AACjB,UAAI;AACF,cAAM,0BACJ,OAAO,eAAe,uBAAuB,YAC7C,eAAe,mBAAmB,SAAS,IACtC,eAAe,qBAChB;AACN,cAAM,YAAY,4BAA4B;AAAA,UAC5C,WAAW;AAAA,UACX,WAAW;AAAA,QACb,CAAC;AACD,2BAAmB,uBAAuB,UAAU,kBAAkB;AACtE,6BAAqB;AACrB,0BAAkB;AAAA,MACpB,SAAS,KAAK;AACZ,cAAM,SAAS,eAAe,QAAQ,IAAI,UAAU;AAWpD,YAAI,8BAA8B;AAClC,YAAI,+BAA+B;AACnC,YAAI,eAAe,QAAQ,6BAA6B,MAAM;AAC5D,cAAI;AACF,2BAAe,wBAAwB;AACvC,0CAA8B;AAAA,UAChC,SAAS,iBAAiB;AACxB,0CAA8B;AAC9B,2CACE,2BAA2B,QAAQ,gBAAgB,UAAU,OAAO,eAAe;AAAA,UACvF;AAAA,QACF;AAKA,cAAM,sBAAsB,SAAS,gBACjC,8BACE,iCACA,2BAA2B,4BAA4B,8GAEzD;AACJ,eAAO;AAAA,UACL,aAAa,QAAQ;AAAA,UACrB,QAAQ;AAAA,UACR,SAAS,0CAAqC,MAAM,IAAI,mBAAmB;AAAA,QAC7E;AAAA,MACF;AAAA,IACF,OAAO;AACL,yBAAmB;AAAA,IACrB;AAAA,EACF;AAcA,MAAI,6BAAkD;AACtD,MAAI,QAAQ,gBAAgB,WAAW;AACrC,QAAI;AAUF,UAAI,kBAAiC;AACrC,UAAI,YAAYA,IAAG,WAAW,UAAU,GAAG;AACzC,YAAI;AACF,gBAAM,sBAAsB,KAAK,MAAMA,IAAG,aAAa,YAAY,MAAM,CAAC;AAC1E,cACE,OAAO,oBAAoB,oBAAoB,YAC/C,oBAAoB,gBAAgB,SAAS,GAC7C;AACA,8BAAkB,oBAAoB;AAAA,UACxC;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI,oBAAoB,MAAM;AAC5B,0BAAkB,8BAA8B;AAAA,MAClD;AACA,YAAM,QAAQ,+BAA+B,eAAe;AAC5D,YAAM,cAAc,wBAAwB;AAAA,QAC1C,YAAY;AAAA,QACZ,aAAa,QAAQ,cAAc,KAAK,IAAI;AAAA,QAC5C,WAAW,YAAY;AAAA,MACzB,CAAC;AACD,MAAAA,IAAG,UAAUD,MAAK,QAAQ,eAAe,GAAG,EAAE,WAAW,KAAK,CAAC;AAM/D,mCAA6B,MAAM;AACjC,YAAI;AACF,cAAI,UAAU,MAAM;AAGlB,gBAAIC,IAAG,WAAW,eAAe,GAAG;AAClC,cAAAA,IAAG,WAAW,eAAe;AAAA,YAC/B;AAAA,UACF,OAAO;AACL,gCAAoB,iBAAiB,KAAK;AAAA,UAC5C;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AACA,UAAI;AACF;AAAA,UACE;AAAA,UACA,KAAK,UAAU,aAAa,MAAM,CAAC;AAAA,QACrC;AAAA,MACF,SAAS,UAAU;AAIjB,YAAI;AACF,qCAA2B;AAAA,QAC7B,QAAQ;AAAA,QAER;AACA,qCAA6B;AAC7B,cAAM;AAAA,MACR;AAKA,qBAAe,kBAAkB;AACjC,qBAAe,YAAY,YAAY;AACvC,qBAAe,gBAAgB,YAAY;AAC3C,qBAAe,kBAAkB,YAAY;AAC7C,qBAAe,kBAAkB,YAAY;AAAA,IAC/C,SAAS,YAAY;AAKnB,UAAI,kBAAkB;AACtB,UAAI,mBAAmB;AACvB,UAAI,eAAe,QAAQ,6BAA6B,MAAM;AAC5D,YAAI;AACF,yBAAe,wBAAwB;AACvC,4BAAkB;AAAA,QACpB,SAAS,iBAAiB;AACxB,4BAAkB;AAClB,6BACE,2BAA2B,QAAQ,gBAAgB,UAAU,OAAO,eAAe;AAAA,QACvF;AAAA,MACF;AACA,YAAM,cAAc,SAAS,iBAAiB,eAAe,OACzD,kBACE,iCACA,2BAA2B,gBAAgB,8GAE7C;AACJ,aAAO;AAAA,QACL,aAAa,QAAQ;AAAA,QACrB,QAAQ;AAAA,QACR,SACE,6DACG,sBAAsB,QAAQ,WAAW,UAAU,OAAO,UAAU,CAAC,IACrE,WAAW;AAAA,MAClB;AAAA,IACF;AAAA,EACF;AAMA,QAAM,yBAAyB;AAAA,IAC7B;AAAA;AAAA,EACF;AACA,aAAW,OAAO,wBAAwB;AACxC,WAAO,eAAe,GAAG;AAAA,EAC3B;AAaA,MAAI;AACF,wBAAoB,YAAY,KAAK,UAAU,gBAAgB,MAAM,CAAC,CAAC;AAAA,EACzE,SAAS,UAAU;AAQjB,QAAI,6BAA6B;AACjC,QAAI,8BAA8B;AAClC,QAAI,eAAe,QAAQ,6BAA6B,MAAM;AAC5D,UAAI;AACF,uBAAe,wBAAwB;AACvC,qCAA6B;AAAA,MAC/B,SAAS,iBAAiB;AACxB,qCAA6B;AAC7B,sCACE,2BAA2B,QAAQ,gBAAgB,UAAU,OAAO,eAAe;AAAA,MACvF;AAAA,IACF;AAKA,QAAI,sBAAsB,oBAAoB,MAAM;AAClD,UAAI;AACF,wBAAgB,SAAS;AAAA,MAC3B,QAAQ;AAEN,gBAAQ;AAAA,UACN;AAAA,QAEF;AAAA,MACF;AAAA,IACF;AAEA,QAAI,+BAA+B,MAAM;AACvC,UAAI;AACF,mCAA2B;AAAA,MAC7B,QAAQ;AAAA,MAER;AAAA,IACF;AAOA,UAAM,yBAAyB,SAAS,iBAAiB,eAAe,OACpE,6BACE,iCACA,2BAA2B,2BAA2B,8GAExD;AACJ,WAAO;AAAA,MACL,aAAa,QAAQ;AAAA,MACrB,QAAQ;AAAA,MACR,SACE,GAAG,SAAS,IAAI,0DACb,oBAAoB,QAAQ,SAAS,UAAU,OAAO,QAAQ,CAAC,IAC/D,sBAAsB;AAAA,IAC7B;AAAA,EACF;AAGA,MAAI,sBAAsB,oBAAoB,MAAM;AAClD,oBAAgB,OAAO;AAAA,EACzB;AAEA,SAAO;AAAA,IACL,aAAa,QAAQ;AAAA,IACrB,QAAQ;AAAA,IACR;AAAA,IACA,SAAS,aAAa,SAAS,IAAI,KAAK,SAAS,OAAO,GAAG,gBAAgB;AAAA,EAC7E;AACF;AAIO,SAAS,gBAAgB,aAAmC;AACjE,QAAM,YAAY,iBAAiB;AACnC,QAAM,aAAaD,MAAK,KAAK,WAAW,GAAG,WAAW,OAAO;AAK7D,MAAI,oBAAmC;AACvC,MAAI,wBAA6C;AAGjD,MAAI,eAAe;AACnB,MAAI,gBAAgB,eAAeC,IAAG,WAAW,UAAU,GAAG;AAC5D,QAAI;AACF,YAAM,SAAS,KAAK,MAAMA,IAAG,aAAa,YAAY,MAAM,CAAC;AAC7D,qBAAe;AACf,UAAI,OAAO,OAAO,cAAc,YAAY,OAAO,UAAU,SAAS,GAAG;AACvE,4BAAoB,OAAO;AAAA,MAC7B;AAEA,YAAM,UAAU,uBAAuB,OAAO,gBAAgB;AAC9D,UAAI,YAAY,QAAW;AACzB,gCAAwB;AAAA,MAC1B;AAAA,IACF,QAAQ;AAIN,cAAQ;AAAA,QACN;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAACA,IAAG,WAAW,UAAU,GAAG;AAS9B,QAAI,oBAAoB;AACxB,QAAI;AACF,0BAAoB,YAAY,WAAW;AAAA,IAC7C,QAAQ;AAAA,IAGR;AACA,UAAM,UAAU,oBACZ,GAAG,WAAW,oDAAoD,WAAW,MAC7E;AACJ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,MAAI,gBAAgB;AACpB,MAAI,gBAAgB,UAAU;AAC5B,QAAI;AACF,YAAM,SAAS,KAAK,MAAMA,IAAG,aAAa,YAAY,MAAM,CAAC;AAC7D,UAAI,OAAO,QAAQ,YAAY,SAAU,iBAAgB,OAAO;AAAA,IAClE,QAAQ;AAAA,IAER;AAAA,EACF;AAgBA,MAAI,yBAAwC;AAC5C,MAAI,6BAA6B;AACjC,MAAI,gBAAgB,WAAW;AAC7B,QAAI;AACF,YAAM,SAAS,KAAK,MAAMA,IAAG,aAAa,YAAY,MAAM,CAAC;AAC7D,UAAI,OAAO,OAAO,oBAAoB,YAAY,OAAO,gBAAgB,SAAS,GAAG;AACnF,iCAAyB,OAAO;AAAA,MAClC;AAAA,IACF,QAAQ;AACN,mCAA6B;AAAA,IAC/B;AAIA,QAAI,2BAA2B,QAAQ,CAAC,4BAA4B;AAClE,UAAI;AACF,iCAAyB,8BAA8B;AAAA,MACzD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,MAAI,gBAAgB,aAAa,4BAA4B;AAC3D,YAAQ;AAAA,MACN,kIAEE,aACA;AAAA,IACJ;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,SACE;AAAA,MAEF,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AAOA,MAAI,gBAAgB,eAAeA,IAAG,WAAW,UAAU,KAAK,CAAC,cAAc;AAC7E,YAAQ;AAAA,MACN,oIAEE,aACA;AAAA,IACJ;AACA,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,QAAQ;AAAA,IACV;AAAA,EACF;AAMA,MAAI,mBAAmB;AACvB,MAAI,gBAAgB,aAAa;AAE/B,QAAI,0BAA0B,OAAO;AACnC,yBAAmB;AAAA,IAKrB,WAAW,0BAA0B,QAAQ,sBAAsB,MAAM;AACvE,yBAAmB;AAAA,IACrB,OAAO;AACL,YAAM,YAAY,2BAA2B,EAAE,WAAW,kBAAkB,CAAC;AAC7E,yBAAmB,UAAU,UACzB,+BAA+B,UAAU,kBAAkB,MAC3D;AAAA,IACN;AAAA,EACF;AAOA,MAAI;AACF,IAAAA,IAAG,WAAW,UAAU;AAAA,EAC1B,SAAS,WAAW;AAClB,UAAM,eAAe,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS;AACtF,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,SACE,GAAG,WAAW,qDAAqD,YAAY;AAAA,IAEnF;AAAA,EACF;AAMA,QAAM,QAAkB,CAAC;AAIzB,MAAI,eAAe;AACnB,MAAI;AACF,gBAAY,WAAW;AAAA,EACzB,SAAS,WAAW;AAGlB,mBAAe;AACf,UAAM,YAAY,qBAAqB,QAAQ,UAAU,UAAU,OAAO,SAAS;AACnF,UAAM,KAAK,2CAAsC,SAAS,mBAAmB,WAAW,uCAAuC;AAAA,EACjI;AAaA,MAAI,2BAA0C;AAC9C,MAAI,gBAAgB,WAAW;AAC7B,QAAI,2BAA2B,MAAM;AACnC,YAAM;AAAA,QACJ;AAAA,MAEF;AAAA,IACF,OAAO;AAYL,YAAM,iBAAiBD,MAAK,KAAK,cAAc,cAAc;AAC7D,YAAM,aACJA,MAAK,WAAW,sBAAsB,KACtC,uBAAuB,SAAS,cAAc;AAChD,UAAI,CAAC,YAAY;AACf,mCACE,qBAAqB,KAAK,UAAU,sBAAsB,CAAC,6DACxB,cAAc;AAAA,MAErD,OAAO;AACL,YAAI;AACF,cAAIC,IAAG,WAAW,sBAAsB,GAAG;AACzC,YAAAA,IAAG,WAAW,sBAAsB;AACpC,kBAAM,KAAK,iCAAiC,sBAAsB,EAAE;AAAA,UACtE;AAAA,QACF,SAAS,KAAK;AAGZ,qCAA2B,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG;AAAA,QAC5E;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,6BAA6B,QAAQ,2BAA2B,MAAM;AAKxE,UAAM,cAAc,eAChB,8DACA;AAEJ,WAAO;AAAA,MACL;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,MACR,SACE,uCAAuC,WAAW,6BACvB,sBAAsB,0BAC7C,wBAAwB;AAAA,IAEhC;AAAA,EACF;AAKA,MAAI,gBAAgB,UAAU;AAC5B,QAAI;AACF,YAAM,aAAa,mBAAmB,EAAE,SAAS,cAAc,CAAC;AAChE,UAAI,WAAW,SAAS;AACtB,cAAM,KAAK,6CAA6C,WAAW,UAAU,EAAE;AAAA,MACjF,WAAW,WAAW,QAAQ,WAAW,yCAAyC,GAAG;AACnF,cAAM,cAAc,eAChB,wEACA;AAEJ,eAAO;AAAA,UACL;AAAA,UACA;AAAA,UACA,QAAQ;AAAA,UACR,SACE,sCAAsC,WAAW,SAAS,WAAW,MAAM,oBACzD,WAAW,UAAU;AAAA,QAE3C;AAAA,MACF,WAAW,WAAW,SAAS;AAC7B,cAAM,KAAK,kCAAkC,WAAW,MAAM,EAAE;AAAA,MAClE;AAAA,IACF,SAAS,KAAK;AACZ,YAAM;AAAA,QACJ,kCAAkC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACpF;AAAA,IACF;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,SAAS,IAAI;AAAA,IAAO,MAAM,KAAK,MAAM,CAAC,KAAK;AAChE,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,SAAS,UAAU,gBAAgB,GAAG,MAAM;AAAA,EAC9C;AACF;AA+BA,SAAS,sBAAsB,SAAyB;AACtD,MAAI,OAAO,YAAY,YAAY,QAAQ,WAAW,GAAG;AACvD,UAAM,IAAI,MAAM,gDAAgD;AAAA,EAClE;AAIA,MAAI,CAAC,+BAA+B,KAAK,OAAO,GAAG;AACjD,UAAM,IAAI;AAAA,MACR,gCAAgC,KAAK,UAAU,OAAO,CAAC;AAAA,IACzD;AAAA,EACF;AACA,MAAI,QAAQ,SAAS,IAAI,GAAG;AAC1B,UAAM,IAAI,MAAM,gCAAgC,KAAK,UAAU,OAAO,CAAC,+BAA0B;AAAA,EACnG;AACA,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAyB;AACjD,QAAM,cAAc,sBAAsB,OAAO;AACjD,QAAM,aAAaD,MAAK,QAAQ,eAAe,GAAG,SAAS;AAC3D,QAAM,iBAAiBA,MAAK,KAAK,YAAY,aAAa;AAC1D,QAAM,eAAeA,MAAK,KAAK,YAAY,UAAU;AACrD,MAAI,gBAAgB,WAAW;AAC7B,UAAM,oBAAoBA,MAAK,KAAK,cAAc,WAAW;AAC7D,QAAI,OAAO,cAAc,KAAM,CAACC,IAAG,WAAW,cAAc,KAAK,CAAC,YAAY,iBAAiB,GAAI;AACjG,aAAO;AAAA,IACT;AAAA,EACF;AACA,QAAM,UAAUD,MAAK,QAAQ,cAAc,aAAa,aAAa;AAErE,QAAM,MAAMA,MAAK,SAAS,cAAc,OAAO;AAC/C,MAAI,IAAI,WAAW,IAAI,KAAKA,MAAK,WAAW,GAAG,GAAG;AAChD,UAAM,IAAI;AAAA,MACR,iDAAiD,YAAY;AAAA,IAC/D;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,UAA2B;AAC9C,MAAI;AACF,WAAOC,IAAG,SAAS,QAAQ,EAAE,YAAY;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,OAAO,UAA2B;AACzC,MAAI;AACF,WAAOA,IAAG,SAAS,QAAQ,EAAE,OAAO;AAAA,EACtC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,mBAAmB,UAA0B;AACpD,MAAI;AACF,WAAOA,IAAG,aAAa,OAAO,QAAQ;AAAA,EACxC,QAAQ;AACN,WAAOD,MAAK,QAAQ,QAAQ;AAAA,EAC9B;AACF;AAEA,SAAS,uBAAuB,UAAkB,WAA4B;AAC5E,SAAO,mBAAmB,QAAQ,MAAM,mBAAmB,SAAS;AACtE;AAEA,SAAS,iCAAyC;AAChD,QAAM,aAAaA,MAAK,QAAQ,eAAe,GAAG,SAAS;AAC3D,SAAOA,MAAK,KAAK,YAAY,YAAY,WAAW,aAAa;AACnE;AAEA,SAAS,yBAAyB,SAA2B;AAC3D,QAAM,UAAU,iBAAiB,OAAO;AACxC,QAAM,cAAc,sBAAsB,OAAO;AACjD,MAAI,gBAAgB,WAAW;AAC7B,WAAO,CAAC,OAAO;AAAA,EACjB;AACA,SAAO,CAAC,GAAG,oBAAI,IAAI,CAAC,SAAS,+BAA+B,CAAC,CAAC,CAAC;AACjE;AA0BA,SAAS,mBAAmB,MAAsB;AAChD,MAAI,OAAO,SAAS,YAAY,KAAK,WAAW,GAAG;AACjD,UAAM,IAAI,MAAM,wCAAwC;AAAA,EAC1D;AACA,MAAI,KAAK,SAAS,KAAK;AACrB,UAAM,IAAI,MAAM,yCAAyC,KAAK,UAAU,KAAK,MAAM,GAAG,EAAE,CAAC,CAAC,QAAG;AAAA,EAC/F;AAIA,MAAI,KAAK,WAAW,GAAG,GAAG;AACxB,QAAI,CAAC,KAAK,SAAS,GAAG,GAAG;AACvB,YAAM,IAAI;AAAA,QACR,wBAAwB,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AACA,UAAM,QAAQ,KAAK,MAAM,GAAG,EAAE;AAC9B,QAAI,MAAM,WAAW,KAAK,CAAC,kBAAkB,KAAK,KAAK,GAAG;AACxD,YAAM,IAAI;AAAA,QACR,wBAAwB,KAAK,UAAU,IAAI,CAAC;AAAA,MAC9C;AAAA,IACF;AACA,WAAO;AAAA,EACT;AAIA,MAAI,KAAK,SAAS,GAAG,GAAG;AACtB,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,IAAI,CAAC;AAAA,IAC9C;AAAA,EACF;AAIA,MAAI,CAAC,qBAAqB,KAAK,IAAI,GAAG;AACpC,UAAM,IAAI;AAAA,MACR,wBAAwB,KAAK,UAAU,IAAI,CAAC;AAAA,IAC9C;AAAA,EACF;AACA,SAAO;AACT;AASA,SAAS,mBAAmB,MAA+B;AACzD,QAAM,UAAU,OAAO,IAAI;AAE3B,MAAI,CAAC,OAAO,UAAU,OAAO,GAAG;AAC9B,UAAM,IAAI;AAAA,MACR,wBAAwB,IAAI;AAAA,IAC9B;AAAA,EACF;AACA,MAAI,UAAU,KAAK,UAAU,OAAO;AAClC,UAAM,IAAI,MAAM,wBAAwB,KAAK,UAAU,IAAI,CAAC,0CAAqC;AAAA,EACnG;AACA,SAAO;AACT;AAUA,SAAS,oBAAoB,UAAkB,MAAoB;AACjE,EAAAC,IAAG,cAAc,UAAU,MAAM,EAAE,MAAM,IAAM,CAAC;AAChD,MAAI;AACF,IAAAA,IAAG,UAAU,UAAU,GAAK;AAAA,EAC9B,QAAQ;AAAA,EAER;AACF;AAcO,SAAS,mBAAmB,MAKZ;AACrB,QAAM,UAAU,iBAAiB,KAAK,OAAO;AAC7C,QAAM,aAAaD,MAAK,QAAQ,OAAO;AAKvC,QAAM,WAAW,mBAAmB,KAAK,IAAI;AAC7C,QAAM,WAAW,mBAAmB,KAAK,IAAI;AAI7C,MAAI,CAAC,kBAAkB,KAAK,KAAK,KAAK,GAAG;AACvC,UAAM,IAAI,MAAM,4DAA4D;AAAA,EAC9E;AAEA,MAAI,CAAC,YAAY,UAAU,GAAG;AAC5B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,MACT,QAAQ,uCAAuC,UAAU;AAAA,MACzD,YAAY;AAAA,IACd;AAAA,EACF;AAEA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,YAAY,QAAQ;AAAA,IACpB,WAAW,QAAQ;AAAA,IACnB,aAAa,KAAK,KAAK;AAAA,EACzB,EAAE,KAAK,IAAI;AAEX,MAAI,CAACC,IAAG,WAAW,OAAO,GAAG;AAG3B,wBAAoB,SAAS,QAAQ,IAAI;AAEzC,WAAO,EAAE,SAAS,MAAM,SAAS,OAAO,YAAY,SAAS,cAAc,KAAK;AAAA,EAClF;AAEA,QAAM,MAAMA,IAAG,aAAa,SAAS,MAAM;AAG3C,QAAM,iBAAiB,YAAY,KAAK,GAAG;AAE3C,MAAI,CAAC,gBAAgB;AAEnB,UAAM,YAAY,IAAI,SAAS,IAAI,IAAI,OAAO;AAC9C,wBAAoB,SAAS,MAAM,YAAY,QAAQ,IAAI;AAE3D,WAAO,EAAE,SAAS,MAAM,SAAS,OAAO,YAAY,SAAS,cAAc,IAAI;AAAA,EACjF;AAaA,QAAM,aAAa,IAAI,MAAM,IAAI;AAEjC,MAAI,WAAW,SAAS,KAAK,WAAW,WAAW,SAAS,CAAC,MAAM,IAAI;AACrE,eAAW,IAAI;AAAA,EACjB;AACA,QAAM,QAAQ;AACd,QAAM,WAAqB,CAAC;AAC5B,MAAI,gBAAgB;AACpB,MAAI,eAAe;AAGnB,QAAM,UAAU,EAAE,MAAM,OAAO,MAAM,OAAO,OAAO,MAAM;AAEzD,WAAS,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;AACrC,UAAM,OAAO,MAAM,CAAC;AAEpB,QAAI,WAAW,KAAK,IAAI,GAAG;AACzB,sBAAgB;AAChB,eAAS,KAAK,IAAI;AAClB;AAAA,IACF;AAEA,QAAI,eAAe;AAGjB,UAAI,KAAK,SAAS,KAAK,CAAC,MAAM,KAAK,IAAI,GAAG;AAGxC,YAAI,CAAC,QAAQ,KAAM,UAAS,KAAK,YAAY,QAAQ,GAAG;AACxD,YAAI,CAAC,QAAQ,KAAM,UAAS,KAAK,WAAW,QAAQ,EAAE;AACtD,YAAI,CAAC,QAAQ,MAAO,UAAS,KAAK,aAAa,KAAK,KAAK,GAAG;AAC5D,uBAAe;AACf,wBAAgB;AAChB,iBAAS,KAAK,IAAI;AAClB;AAAA,MACF;AAGA,UAAI,YAAY,KAAK,IAAI,GAAG;AAC1B,iBAAS,KAAK,YAAY,QAAQ,GAAG;AACrC,gBAAQ,OAAO;AAAA,MACjB,WAAW,YAAY,KAAK,IAAI,GAAG;AACjC,iBAAS,KAAK,WAAW,QAAQ,EAAE;AACnC,gBAAQ,OAAO;AAAA,MACjB,WAAW,aAAa,KAAK,IAAI,GAAG;AAClC,iBAAS,KAAK,aAAa,KAAK,KAAK,GAAG;AACxC,gBAAQ,QAAQ;AAAA,MAClB,OAAO;AACL,iBAAS,KAAK,IAAI;AAAA,MACpB;AACA;AAAA,IACF;AAEA,aAAS,KAAK,IAAI;AAAA,EACpB;AAEA,MAAI,iBAAiB,CAAC,cAAc;AAElC,QAAI,CAAC,QAAQ,KAAM,UAAS,KAAK,YAAY,QAAQ,GAAG;AACxD,QAAI,CAAC,QAAQ,KAAM,UAAS,KAAK,WAAW,QAAQ,EAAE;AACtD,QAAI,CAAC,QAAQ,MAAO,UAAS,KAAK,aAAa,KAAK,KAAK,GAAG;AAAA,EAC9D;AAGA,sBAAoB,SAAS,SAAS,KAAK,IAAI,IAAI,IAAI;AAEvD,SAAO,EAAE,SAAS,MAAM,SAAS,OAAO,YAAY,SAAS,cAAc,IAAI;AACjF;AAMO,SAAS,mBAAmB,MAA+C;AAChF,QAAM,WAAW,yBAAyB,KAAK,OAAO;AACtD,QAAM,UAAU,SAAS,IAAI,CAAC,YAAY;AACxC,QAAI;AACF,aAAO,uBAAuB,OAAO;AAAA,IACvC,SAAS,KAAK;AACZ,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,QACT,QAAQ,iCAAiC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,QACzF,YAAY;AAAA,MACd;AAAA,IACF;AAAA,EACF,CAAC;AACD,QAAM,UAAU,QAAQ,OAAO,CAAC,WAAW,OAAO,OAAO;AACzD,QAAM,kBAAkB,QAAQ,OAAO,CAAC,WAAW,OAAO,QAAQ,WAAW,+BAA+B,CAAC;AAE7G,MAAI,QAAQ,SAAS,GAAG;AACtB,UAAM,eAAe,QAAQ,IAAI,CAAC,WAAW,OAAO,UAAU,EAAE,KAAK,IAAI;AACzE,QAAI,gBAAgB,SAAS,GAAG;AAC9B,YAAM,cAAc,gBAAgB,IAAI,CAAC,WAAW,OAAO,UAAU,EAAE,KAAK,IAAI;AAChF,aAAO;AAAA,QACL,SAAS;AAAA,QACT,SAAS;AAAA,QACT,QAAQ,mDAAmD,YAAY,YAAY,WAAW;AAAA,QAC9F,YAAY,GAAG,YAAY,aAAa,WAAW;AAAA,MACrD;AAAA,IACF;AACA,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,MACT,YAAY;AAAA,IACd;AAAA,EACF;AAEA,QAAM,iBAAiB,gBAAgB,CAAC;AACxC,MAAI,gBAAgB;AAClB,WAAO;AAAA,EACT;AAEA,QAAM,uBAAuB,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,8BAA8B;AACtG,SAAO,wBAAwB,QAAQ,CAAC,KAAK;AAAA,IAC3C,SAAS;AAAA,IACT,SAAS;AAAA,IACT,QAAQ;AAAA,IACR,YAAY,iBAAiB,KAAK,OAAO;AAAA,EAC3C;AACF;AAEA,SAAS,uBAAuB,SAAqC;AACnE,MAAI,CAACA,IAAG,WAAW,OAAO,GAAG;AAC3B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,YAAY;AAAA,IACd;AAAA,EACF;AAEA,QAAM,MAAMA,IAAG,aAAa,SAAS,MAAM;AAC3C,MAAI,CAAC,YAAY,KAAK,GAAG,GAAG;AAC1B,WAAO;AAAA,MACL,SAAS;AAAA,MACT,SAAS;AAAA,MACT,QAAQ;AAAA,MACR,YAAY;AAAA,IACd;AAAA,EACF;AAGA,QAAM,QAAQ,IAAI,MAAM,IAAI;AAC5B,QAAM,WAAqB,CAAC;AAC5B,MAAI,gBAAgB;AAEpB,aAAW,QAAQ,OAAO;AACxB,QAAI,WAAW,KAAK,IAAI,GAAG;AACzB,sBAAgB;AAChB;AAAA,IACF;AACA,QAAI,eAAe;AACjB,UAAI,KAAK,SAAS,KAAK,CAAC,MAAM,KAAK,IAAI,GAAG;AACxC,wBAAgB;AAChB,iBAAS,KAAK,IAAI;AAAA,MACpB;AAEA;AAAA,IACF;AACA,aAAS,KAAK,IAAI;AAAA,EACpB;AAGA,SAAO,SAAS,SAAS,KAAK,SAAS,SAAS,SAAS,CAAC,GAAG,KAAK,MAAM,IAAI;AAC1E,aAAS,IAAI;AAAA,EACf;AAMA,sBAAoB,SAAS,SAAS,SAAS,IAAI,SAAS,KAAK,IAAI,IAAI,OAAO,EAAE;AAClF,SAAO,EAAE,SAAS,MAAM,SAAS,OAAO,YAAY,QAAQ;AAC9D;AAUA,IAAM,iBAAiB;AACvB,IAAM,2BAA2B;AAsBjC,SAAS,kBAAkB,MAAc,MAAc,WAA6B;AAClF,MAAI;AAGF,UAAM,WAAW,KAAK,MAAM,OAAO,IAAI,CAAC;AACxC,QAAI,CAAC,OAAO,SAAS,QAAQ,KAAK,WAAW,KAAK,WAAW,OAAO;AAClE,aAAO;AAAA,IACT;AAMA,UAAM,WAAW,KAAK,WAAW,GAAG,KAAK,KAAK,SAAS,GAAG,IACtD,KAAK,MAAM,GAAG,EAAE,IAChB;AAMJ,UAAM,SAAS;AAAA,MACb;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,IACF,EAAE,KAAK,IAAI;AACX,UAAM,MAAyB,SAAS;AAAA,MACtC,oBAAoB;AAAA,MACpB,oBAAoB,OAAO,QAAQ;AAAA,IACrC,CAAC;AACD,QAAI,WAAW;AACb,UAAI,sBAAsB;AAAA,IAC5B;AACA,UAAM,cAAc,QAAQ;AAC5B,UAAM,gBAAgB,EAAE,SAAS,KAAM,IAAI;AAC3C,UAAM,SAAS,kBAAkB,aAAa,CAAC,MAAM,MAAM,GAAG,aAAa;AAE3E,QAAI,OAAO,WAAW,gBAAgB;AACpC,aAAO;AAAA,IACT;AAEA,QAAI,OAAO,WAAW,0BAA0B;AAG9C,cAAQ;AAAA,QACN;AAAA,MACF;AAEA,wBAAkB,aAAa,CAAC,MAAM,4BAA4B,GAAG;AAAA,QACnE,SAAS;AAAA,QACT,KAAK,CAAC;AAAA,MACR,CAAC;AACD,YAAM,QAAQ,kBAAkB,aAAa,CAAC,MAAM,MAAM,GAAG,aAAa;AAC1E,aAAO,MAAM,WAAW;AAAA,IAC1B;AAEA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,gBAAgB,aAA4C;AAChF,QAAM,YAAY,eAAe,EAAE;AACnC,QAAM,WAAW,UAAU,KAAK,CAAC,MAAM,EAAE,gBAAgB,WAAW;AAEpE,MAAI,CAAC,UAAU;AACb,WAAO;AAAA,MACL;AAAA,MACA,QAAQ,CAAC,EAAE,MAAM,aAAa,IAAI,OAAO,QAAQ,gBAAgB,CAAC;AAAA,MAClE,SAAS;AAAA,IACX;AAAA,EACF;AAEA,QAAM,aAAaD,MAAK,KAAK,iBAAiB,GAAG,GAAG,WAAW,OAAO;AACtE,QAAM,SAAwB,CAAC;AAG/B,SAAO,KAAK;AAAA,IACV,MAAM;AAAA,IACN,IAAIC,IAAG,WAAW,UAAU;AAAA,IAC5B,QAAQ;AAAA,EACV,CAAC;AAGD,MAAI;AACF,UAAM,MAAMA,IAAG,aAAa,YAAY,MAAM;AAC9C,SAAK,MAAM,GAAG;AACd,WAAO,KAAK,EAAE,MAAM,gBAAgB,IAAI,MAAM,QAAQ,KAAK,CAAC;AAAA,EAC9D,SAAS,GAAG;AACV,WAAO,KAAK,EAAE,MAAM,gBAAgB,IAAI,OAAO,QAAQ,OAAO,CAAC,EAAE,CAAC;AAAA,EACpE;AAGA,QAAM,SAAS,SAAS,OAAO;AAC/B,MAAI,QAAQ;AACV,QAAI;AACF,YAAM,aAAa,IAAI,gBAAgB;AACvC,YAAM,YAAY,WAAW,MAAM,WAAW,MAAM,GAAG,GAAI;AAC3D,YAAM,WAAW,MAAM,MAAM,QAAQ,EAAE,QAAQ,WAAW,OAAO,CAAC;AAClE,mBAAa,SAAS;AACtB,aAAO,KAAK,EAAE,MAAM,cAAc,IAAI,SAAS,IAAI,QAAQ,OAAO,CAAC;AAAA,IACrE,SAAS,GAAG;AACV,aAAO,KAAK;AAAA,QACV,MAAM;AAAA,QACN,IAAI;AAAA,QACJ,QAAQ,gBAAgB,MAAM,KAAK,aAAa,QAAQ,EAAE,UAAU,SAAS;AAAA,MAC/E,CAAC;AAAA,IACH;AAAA,EACF;AAGA,QAAM,YAAY,SAAS,OAAO;AAClC,MAAI,WAAW;AACb,QAAIA,IAAG,WAAW,SAAS,GAAG;AAC5B,aAAO,KAAK,EAAE,MAAM,oBAAoB,IAAI,MAAM,QAAQ,UAAU,CAAC;AAAA,IACvE,OAAO;AACL,aAAO,KAAK,EAAE,MAAM,oBAAoB,IAAI,OAAO,QAAQ,cAAc,SAAS,GAAG,CAAC;AAAA,IACxF;AAAA,EACF;AAEA,QAAM,UAAU,OAAO,MAAM,CAAC,MAAM,EAAE,EAAE;AACxC,SAAO,EAAE,aAAa,QAAQ,QAAQ;AACxC;AAQA,IAAM,wBAAwB;AAe9B,IAAM,0BAA0B;AAGhC,IAAM,4BAA4B;AAqD3B,SAAS,iBAAiB,UAAkC;AACjE,MAAI,YAAY,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,SAAS,GAAG;AAC1E,WAAOD,MAAK,QAAQ,SAAS,KAAK,CAAC;AAAA,EACrC;AACA,QAAM,UAAU,WAAW,YAAY;AACvC,MAAI,WAAW,QAAQ,KAAK,EAAE,SAAS,GAAG;AACxC,WAAOA,MAAK,QAAQ,QAAQ,KAAK,CAAC;AAAA,EACpC;AACA,QAAM,OAAO,WAAW,MAAM,KAAK,WAAW,aAAa,KAAK,eAAe;AAC/E,SAAOA,MAAK,QAAQ,MAAM,QAAQ;AACpC;AAWO,SAAS,iCACd,mBAC2B;AAC3B,QAAM,YAAY,iBAAiB,iBAAiB;AACpD,QAAM,cAAcA,MAAK,KAAK,WAAW,qBAAqB;AAE9D,QAAM,iBAAiBA,MAAK,KAAKA,MAAK,QAAQ,WAAW,GAAG,uBAAuB;AACnF,QAAM,qBAAqBA,MAAK,KAAK,gBAAgB,yBAAyB;AAC9E,SAAO,EAAE,WAAW,aAAa,gBAAgB,mBAAmB;AACtE;AAcO,SAAS,iCAAiC,UAAkC;AACjF,MAAI,YAAY,OAAO,aAAa,YAAY,SAAS,KAAK,EAAE,SAAS,GAAG;AAC1E,UAAM,WAAWA,MAAK,QAAQ,SAAS,KAAK,CAAC;AAC7C,QAAIC,IAAG,WAAW,QAAQ,KAAKA,IAAG,SAAS,QAAQ,EAAE,YAAY,GAAG;AAClE,aAAO;AAAA,IACT;AACA,UAAM,IAAI,MAAM,+CAA+C,QAAQ,EAAE;AAAA,EAC3E;AAEA,QAAM,oBAAoBD,MAAK,KAAK,uBAAuB,QAAQ;AACnE,QAAM,0BAA0BA,MAAK;AAAA,IACnC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAEA,QAAM,WAAqB,CAAC;AAW5B,MAAI;AACF,UAAM,YAAYA,MAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AAG7D,UAAM,mBAAmBA,MAAK,KAAK,WAAW,OAAO;AACrD,aAAS,KAAK,gBAAgB;AAC9B,QAAIC,IAAG,WAAW,gBAAgB,KAAKA,IAAG,SAAS,gBAAgB,EAAE,YAAY,GAAG;AAClF,aAAO;AAAA,IACT;AAKA,UAAM,0BAA0BD,MAAK,KAAK,WAAW,cAAc,OAAO;AAC1E,aAAS,KAAK,uBAAuB;AACrC,QACEC,IAAG,WAAW,uBAAuB,KACrCA,IAAG,SAAS,uBAAuB,EAAE,YAAY,GACjD;AACA,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAER;AAKA,MAAI;AACF,UAAM,kBAAkB,cAAc,YAAY,GAAG;AACrD,UAAM,oBAAoB,gBAAgB,QAAQ,mCAAmC;AACrF,UAAM,gBAAgBD,MAAK,QAAQ,iBAAiB;AACpD,UAAM,YAAYA,MAAK,KAAK,eAAe,iBAAiB;AAC5D,aAAS,KAAK,SAAS;AACvB,QAAIC,IAAG,WAAW,SAAS,KAAKA,IAAG,SAAS,SAAS,EAAE,YAAY,GAAG;AACpE,aAAO;AAAA,IACT;AAAA,EACF,QAAQ;AAAA,EAER;AAMA,MAAI;AACF,UAAM,YAAYD,MAAK,QAAQ,cAAc,YAAY,GAAG,CAAC;AAC7D,QAAI,MAAM;AACV,aAAS,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG;AACzC,YAAM,YAAYA,MAAK;AAAA,QACrB;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,QACA;AAAA,MACF;AACA,eAAS,KAAK,SAAS;AACvB,UAAIC,IAAG,WAAW,SAAS,KAAKA,IAAG,SAAS,SAAS,EAAE,YAAY,GAAG;AACpE,eAAO;AAAA,MACT;AACA,YAAM,SAASD,MAAK,QAAQ,GAAG;AAC/B,UAAI,WAAW,IAAK;AACpB,YAAM;AAAA,IACR;AAAA,EACF,QAAQ;AAAA,EAER;AAIA,QAAM,UAAoB,CAAC;AAC3B,MAAI;AACF,YAAQ,KAAKA,MAAK,QAAQ,cAAc,YAAY,GAAG,CAAC,CAAC;AAAA,EAC3D,QAAQ;AAAA,EAER;AACA,UAAQ,KAAK,QAAQ,IAAI,CAAC;AAE1B,aAAW,UAAU,SAAS;AAC5B,QAAI,MAAM;AACV,aAAS,QAAQ,GAAG,QAAQ,IAAI,SAAS,GAAG;AAC1C,YAAM,YAAYA,MAAK,KAAK,KAAK,uBAAuB;AACxD,eAAS,KAAK,SAAS;AACvB,UAAIC,IAAG,WAAW,SAAS,KAAKA,IAAG,SAAS,SAAS,EAAE,YAAY,GAAG;AACpE,eAAO;AAAA,MACT;AACA,YAAM,SAASD,MAAK,QAAQ,GAAG;AAC/B,UAAI,WAAW,IAAK;AACpB,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,IAAI;AAAA,IACR,sGAEE,SAAS,IAAI,CAAC,MAAM,OAAO,CAAC,EAAE,EAAE,KAAK,IAAI,IACzC;AAAA,EACJ;AACF;AAGA,SAAS,qBAAqB,KAAa,MAAsB;AAC/D,MAAI,QAAQ;AACZ,EAAAC,IAAG,UAAU,MAAM,EAAE,WAAW,KAAK,CAAC;AACtC,QAAM,UAAUA,IAAG,YAAY,KAAK,EAAE,eAAe,KAAK,CAAC;AAC3D,aAAW,SAAS,SAAS;AAC3B,UAAM,OAAOD,MAAK,KAAK,KAAK,MAAM,IAAI;AACtC,UAAM,KAAKA,MAAK,KAAK,MAAM,MAAM,IAAI;AACrC,QAAI,MAAM,YAAY,GAAG;AACvB,eAAS,qBAAqB,MAAM,EAAE;AAAA,IACxC,WAAW,MAAM,OAAO,GAAG;AACzB,MAAAC,IAAG,aAAa,MAAM,EAAE;AACxB,eAAS;AAAA,IACX;AAAA,EAEF;AACA,SAAO;AACT;AAYO,SAAS,4BACd,UAA8C,CAAC,GACZ;AACnC,QAAM,QAAQ,iCAAiC,QAAQ,aAAa,IAAI;AACxE,QAAM,YAAY,iCAAiC,QAAQ,aAAa,IAAI;AAE5E,EAAAA,IAAG,UAAU,MAAM,gBAAgB,EAAE,WAAW,KAAK,CAAC;AAWtD,QAAM,YAAY,IAAI,yBAAyB;AAC/C,QAAM,yBAAyB,KAAK,KAAK;AACzC,QAAM,MAAM,KAAK,IAAI;AACrB,MAAI;AACF,UAAM,kBAAkBA,IAAG,YAAY,MAAM,cAAc;AAC3D,eAAW,SAAS,iBAAiB;AACnC,UAAI,CAAC,MAAM,WAAW,SAAS,EAAG;AAClC,YAAM,YAAYD,MAAK,KAAK,MAAM,gBAAgB,KAAK;AACvD,UAAI;AACF,cAAM,OAAOC,IAAG,SAAS,SAAS;AAClC,cAAM,QAAQ,MAAM,KAAK;AACzB,YAAI,QAAQ,wBAAwB;AAElC;AAAA,QACF;AACA,QAAAA,IAAG,OAAO,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MACvD,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAER;AAEA,QAAM,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC;AACxD,QAAM,SAASD,MAAK,KAAK,MAAM,gBAAgB,OAAO;AAEtD,MAAI,cAAc;AAClB,MAAI,WAAuB,MAAM;AAAA,EAAoC;AACrE,MAAI,aAAyB,MAAM;AAAA,EAAoC;AACvE,MAAI;AACF,kBAAc,qBAAqB,WAAW,MAAM;AAKpD,UAAM,YAAY,GAAG,MAAM,kBAAkB,QAAQ,KAAK,IAAI,CAAC;AAC/D,UAAM,cAAcC,IAAG,WAAW,MAAM,kBAAkB;AAC1D,QAAI,aAAa;AACf,MAAAA,IAAG,WAAW,MAAM,oBAAoB,SAAS;AAAA,IACnD;AACA,QAAI;AACF,MAAAA,IAAG,WAAW,QAAQ,MAAM,kBAAkB;AAAA,IAChD,SAAS,WAAW;AAElB,UAAI,aAAa;AACf,YAAI;AACF,UAAAA,IAAG,WAAW,WAAW,MAAM,kBAAkB;AAAA,QACnD,QAAQ;AAAA,QAER;AAAA,MACF;AACA,YAAM;AAAA,IACR;AAQA,eAAW,MAAY;AACrB,UAAI,aAAa;AACf,YAAI;AACF,UAAAA,IAAG,OAAO,WAAW,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,QACvD,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AACA,iBAAa,MAAY;AACvB,UAAI,aAAa;AAEf,YAAI;AAEF,cAAIA,IAAG,WAAW,MAAM,kBAAkB,GAAG;AAC3C,YAAAA,IAAG,OAAO,MAAM,oBAAoB,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,UACtE;AACA,UAAAA,IAAG,WAAW,WAAW,MAAM,kBAAkB;AAAA,QACnD,QAAQ;AAAA,QAER;AAAA,MACF,OAAO;AAEL,YAAI;AACF,cAAIA,IAAG,WAAW,MAAM,kBAAkB,GAAG;AAC3C,YAAAA,IAAG,OAAO,MAAM,oBAAoB,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,UACtE;AAAA,QACF,QAAQ;AAAA,QAER;AAAA,MACF;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AAEZ,QAAIA,IAAG,WAAW,MAAM,GAAG;AACzB,UAAI;AACF,QAAAA,IAAG,OAAO,QAAQ,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AAAA,MACpD,QAAQ;AAAA,MAER;AAAA,IACF;AACA,UAAM;AAAA,EACR;AAEA,QAAM,mBAAmBD,MAAK,KAAK,MAAM,oBAAoB,iBAAiB;AAE9E,SAAO;AAAA,IACL,GAAG;AAAA,IACH;AAAA,IACA;AAAA,IACA,QAAQ;AAAA,IACR,UAAU;AAAA,EACZ;AACF;AAMO,SAAS,2BACd,UAA6C,CAAC,GACZ;AAClC,QAAM,QAAQ,iCAAiC,QAAQ,aAAa,IAAI;AACxE,MAAI,UAAU;AACd,MAAIC,IAAG,WAAW,MAAM,kBAAkB,GAAG;AAC3C,IAAAA,IAAG,OAAO,MAAM,oBAAoB,EAAE,WAAW,MAAM,OAAO,KAAK,CAAC;AACpE,cAAU;AAAA,EACZ;AACA,SAAO,EAAE,GAAG,OAAO,QAAQ;AAC7B;AAIA,SAAS,mBAA2B;AAClC,QAAM,gBAAgB,WAAW,iBAAiB;AAClD,QAAM,YAAY,gBACdD,MAAK,KAAK,eAAe,QAAQ,IACjCA,MAAK,KAAK,eAAe,GAAG,WAAW,QAAQ;AACnD,SAAOA,MAAK,KAAK,WAAW,mBAAmB,YAAY;AAC7D;AAWA,IAAM,+BAA+B;AACrC,IAAM,gCAAgC;AAoB/B,SAAS,gCAAwC;AACtD,QAAM,aAAa,WAAW,aAAa;AAC3C,QAAM,WAAW,cAAc,WAAW,SAAS,IAAI,aAAa,WAAW,aAAa;AAC5F,MAAI,YAAY,SAAS,SAAS,GAAG;AACnC,WAAOA,MAAK,QAAQ,gBAAgB,QAAQ,GAAG,cAAc,6BAA6B;AAAA,EAC5F;AACA,QAAM,UAAU,WAAW,MAAM;AACjC,QAAM,OAAO,WAAW,QAAQ,SAAS,IAAI,UAAU,GAAG,QAAQ;AAClE,SAAOA,MAAK;AAAA,IACV;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACF;AAOA,SAAS,+BAA+B,YAAmC;AACzE,MAAI;AACF,QAAI,CAACC,IAAG,WAAW,UAAU,EAAG,QAAO;AACvC,WAAOA,IAAG,aAAa,YAAY,MAAM;AAAA,EAC3C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,SAAS,cAAc,KAA6C;AAClE,MAAI;AACF,UAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,QAAI,OAAO,WAAW,YAAY,WAAW,QAAQ,CAAC,MAAM,QAAQ,MAAM,GAAG;AAC3E,aAAO;AAAA,IACT;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAgBA,IAAM,mBAAmB;AAAA,EACvB,eAAe;AAAA,EACf,kBAAkB;AAAA,EAClB,WAAW;AAAA,EACX,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,EACjB,iBAAiB;AAAA,IACf,WAAW;AAAA,IACX,UAAU;AAAA,IACV,UAAU;AAAA,EACZ;AACF;AAOA,SAAS,mBACP,YACA,aACA,KACA,UACQ;AACR,QAAM,WAAW,WAAW,GAAG;AAC/B,MAAI,OAAO,aAAa,YAAY,SAAS,SAAS,EAAG,QAAO;AAChE,MAAI,aAAa;AACf,UAAM,YAAY,YAAY,GAAG;AACjC,QAAI,OAAO,cAAc,YAAY,UAAU,SAAS,EAAG,QAAO;AAAA,EACpE;AACA,SAAO;AACT;AAQA,SAAS,WAAW,OAA+B;AACjD,MAAI,OAAO,UAAU,YAAY,OAAO,UAAU,KAAK,KAAK,SAAS,KAAK,SAAS,OAAO;AACxF,WAAO;AAAA,EACT;AACA,MAAI,OAAO,UAAU,YAAY,MAAM,SAAS,GAAG;AACjD,UAAM,IAAI,OAAO,KAAK;AACtB,QAAI,OAAO,UAAU,CAAC,KAAK,KAAK,KAAK,KAAK,MAAO,QAAO;AAAA,EAC1D;AACA,SAAO;AACT;AAEA,SAAS,YACP,YACA,aACA,UACQ;AACR,QAAM,WAAW,WAAW,WAAW,SAAS;AAChD,MAAI,aAAa,KAAM,QAAO;AAC9B,MAAI,aAAa;AACf,UAAM,YAAY,WAAW,YAAY,SAAS;AAClD,QAAI,cAAc,KAAM,QAAO;AAAA,EACjC;AACA,SAAO;AACT;AAEA,SAAS,uBACP,YACA,aACwB;AACxB,QAAM,QAAQ,oBAAI,IAAI,CAAC,aAAa,QAAQ,CAAC;AAC7C,QAAM,WAAW,WAAW;AAC5B,MAAI,OAAO,aAAa,YAAY,MAAM,IAAI,QAAQ,GAAG;AACvD,WAAO;AAAA,EACT;AACA,MAAI,aAAa;AACf,UAAM,YAAY,YAAY;AAC9B,QAAI,OAAO,cAAc,YAAY,MAAM,IAAI,SAAS,GAAG;AACzD,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO,iBAAiB;AAC1B;AAOO,SAAS,wBAAwB,MAIjB;AACrB,QAAM,EAAE,YAAY,aAAa,UAAU,IAAI;AAE/C,QAAM,gBAAgB;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB;AAAA,EACnB;AACA,QAAM,mBAAmB;AAAA,IACvB;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB;AAAA,EACnB;AACA,QAAM,kBAAkB;AAAA,IACtB;AAAA,IACA;AAAA,IACA;AAAA,IACA,iBAAiB;AAAA,EACnB;AACA,QAAM,YAAY;AAAA,IAChB;AAAA,IACA;AAAA,IACA,iBAAiB;AAAA,EACnB;AACA,QAAM,kBAAkB,uBAAuB,YAAY,WAAW;AAWtE,QAAM,kBAAkB;AAAA,IACtB,GAAG,iBAAiB;AAAA,IACpB,GAAI,eACJ,OAAO,YAAY,oBAAoB,YACvC,YAAY,oBAAoB,QAChC,CAAC,MAAM,QAAQ,YAAY,eAAe,IACrC,YAAY,kBACb,CAAC;AAAA,IACL,GAAI,OAAO,WAAW,oBAAoB,YAC1C,WAAW,oBAAoB,QAC/B,CAAC,MAAM,QAAQ,WAAW,eAAe,IACpC,WAAW,kBACZ,CAAC;AAAA,EACP;AAEA,QAAM,SAA6B;AAAA,IACjC;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AAKA,MAAI,aAAa,UAAU,SAAS,GAAG;AACrC,WAAO,kBAAkB;AAAA,EAC3B,WAAW,OAAO,WAAW,oBAAoB,YAAY,WAAW,gBAAgB,SAAS,GAAG;AAClG,WAAO,kBAAkB,WAAW;AAAA,EACtC,WAAW,eAAe,OAAO,YAAY,oBAAoB,YAAY,YAAY,gBAAgB,SAAS,GAAG;AACnH,WAAO,kBAAkB,YAAY;AAAA,EACvC;AAEA,SAAO;AACT;","names":["fs","path","path","fs"]}