@remnic/core 9.7.15 → 9.9.0

package/dist/chunk-PJSK6OJM.js

@@ -0,0 +1,201 @@
+import {
+  encodeStoragePathSegment,
+  resolveSafeStoragePath
+} from "./chunk-FF4KLI5W.js";
+
+// src/write-quarantine.ts
+import { randomUUID } from "crypto";
+import { lstat, mkdir, readFile, readdir, rename, rm, stat, writeFile } from "fs/promises";
+import path from "path";
+var DEFAULT_QUARANTINE_CAPS = {
+  maxEntriesPerPrincipal: 500,
+  maxAgeMs: 14 * 24 * 60 * 60 * 1e3
+};
+var QUARANTINE_DIRNAME = "quarantine";
+function validateCaps(caps) {
+  if (!Number.isInteger(caps.maxEntriesPerPrincipal) || caps.maxEntriesPerPrincipal < 1) {
+    throw new Error(
+      `WriteQuarantineStore: maxEntriesPerPrincipal must be a positive integer (got ${caps.maxEntriesPerPrincipal})`
+    );
+  }
+  if (!Number.isFinite(caps.maxAgeMs) || caps.maxAgeMs <= 0) {
+    throw new Error(
+      `WriteQuarantineStore: maxAgeMs must be a positive finite number of milliseconds (got ${caps.maxAgeMs})`
+    );
+  }
+}
+function isQuarantinedRecord(value) {
+  if (!value || typeof value !== "object") return false;
+  const record = value;
+  return (record.operation === "observe" || record.operation === "memory_store" || record.operation === "suggestion_submit") && (record.principal === null || typeof record.principal === "string") && typeof record.attemptedNamespace === "string" && typeof record.timestamp === "string" && "payload" in record;
+}
+var WriteQuarantineStore = class {
+  constructor(memoryDir, caps = DEFAULT_QUARANTINE_CAPS) {
+    this.caps = caps;
+    validateCaps(caps);
+    this.memoryDir = path.resolve(memoryDir);
+  }
+  caps;
+  memoryDir;
+  /** Absolute quarantine root (`<memoryDir>/state/quarantine`). */
+  get root() {
+    return path.join(this.memoryDir, "state", QUARANTINE_DIRNAME);
+  }
+  /**
+   * Resolve a path under the quarantine root, checked for containment and
+   * symlink traversal from `memoryDir` down — so a symlinked `state` or
+   * `quarantine` component that escapes the memory directory is rejected.
+   */
+  safeDir(...segments) {
+    return resolveSafeStoragePath(this.memoryDir, "state", QUARANTINE_DIRNAME, ...segments);
+  }
+  /**
+   * Park a rejected write. Returns the absolute path of the record written.
+   * Prunes the principal's bucket to the configured caps afterward.
+   */
+  async quarantine(input) {
+    const timestamp = input.timestamp ?? (/* @__PURE__ */ new Date()).toISOString();
+    const record = {
+      operation: input.operation,
+      principal: input.principal ?? null,
+      attemptedNamespace: input.attemptedNamespace,
+      timestamp,
+      payload: input.payload
+    };
+    const principalSegment = encodeStoragePathSegment(input.principal ?? "unknown");
+    const fileName = `${timestamp.replace(/[:.]/g, "-")}-${randomUUID().slice(0, 8)}.json`;
+    const dir = await this.safeDir(principalSegment);
+    await mkdir(dir, { recursive: true });
+    const finalPath = await this.safeDir(principalSegment, fileName);
+    const tmpPath = await this.safeDir(principalSegment, `${fileName}.tmp`);
+    await writeFile(tmpPath, JSON.stringify(record, null, 2), { encoding: "utf8", flag: "wx" });
+    await rename(tmpPath, finalPath);
+    await this.pruneDir(dir);
+    return finalPath;
+  }
+  /**
+   * All valid, non-expired quarantined records across every principal, oldest
+   * first, each paired with its absolute on-disk path. Expired records are
+   * deleted on read (lazy GC), so an inactive principal bucket with no
+   * follow-up write is still bounded by age.
+   */
+  async entries() {
+    const now = Date.now();
+    const entries = [];
+    for (const dir of await this.principalDirs()) {
+      for (const file of await this.entryFiles(dir)) {
+        const info = await stat(file).catch(() => null);
+        if (!info) continue;
+        if (now - info.mtimeMs > this.caps.maxAgeMs) {
+          await rm(file, { force: true }).catch(() => {
+          });
+          continue;
+        }
+        let parsed;
+        try {
+          parsed = JSON.parse(await readFile(file, "utf8"));
+        } catch {
+          continue;
+        }
+        if (isQuarantinedRecord(parsed)) entries.push({ record: parsed, path: file });
+      }
+    }
+    entries.sort((a, b) => {
+      const at = a.record.timestamp;
+      const bt = b.record.timestamp;
+      return at < bt ? -1 : at > bt ? 1 : 0;
+    });
+    return entries;
+  }
+  /** As {@link entries} but projected to records only (backward-compatible view). */
+  async list() {
+    return (await this.entries()).map((entry) => entry.record);
+  }
+  /**
+   * Delete one quarantined entry by its absolute on-disk path (as returned by
+   * {@link entries}). The path MUST resolve inside the quarantine root, mirroring
+   * the store's containment posture; a path outside the root — or one already
+   * absent — removes nothing. Returns true only when a file was actually deleted.
+   */
+  async removeEntry(entryPath) {
+    const rootAbs = path.resolve(this.root);
+    const rel = path.relative(rootAbs, path.resolve(entryPath));
+    if (rel === "" || rel === ".." || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {
+      return false;
+    }
+    let safe;
+    try {
+      safe = await resolveSafeStoragePath(rootAbs, rel);
+    } catch {
+      return false;
+    }
+    try {
+      await rm(safe, { force: false });
+      return true;
+    } catch (err) {
+      const errno = err;
+      if (errno?.code === "ENOENT") return false;
+      throw err;
+    }
+  }
+  /** Total valid, non-expired quarantined record count across every principal. */
+  async count() {
+    return (await this.list()).length;
+  }
+  /** lstat (no symlink follow): true only for a real directory. */
+  async isRealDir(dir) {
+    const info = await lstat(dir).catch(() => null);
+    return info?.isDirectory() === true;
+  }
+  async principalDirs() {
+    const root = await this.safeDir();
+    if (!await this.isRealDir(root)) return [];
+    let entries;
+    try {
+      entries = await readdir(root, { withFileTypes: true });
+    } catch (err) {
+      if (err?.code === "ENOENT") return [];
+      throw err;
+    }
+    return entries.filter((entry) => entry.isDirectory()).map((entry) => path.join(root, entry.name)).sort();
+  }
+  async entryFiles(dir) {
+    if (!await this.isRealDir(dir)) return [];
+    let entries;
+    try {
+      entries = await readdir(dir, { withFileTypes: true });
+    } catch (err) {
+      if (err?.code === "ENOENT") return [];
+      throw err;
+    }
+    return entries.filter((entry) => entry.isFile() && entry.name.endsWith(".json")).map((entry) => path.join(dir, entry.name)).sort();
+  }
+  async pruneDir(dir) {
+    const files = await this.entryFiles(dir);
+    const now = Date.now();
+    const survivors = [];
+    for (const file of files) {
+      const info = await stat(file).catch(() => null);
+      if (!info) continue;
+      if (now - info.mtimeMs > this.caps.maxAgeMs) {
+        await rm(file, { force: true }).catch(() => {
+        });
+        continue;
+      }
+      survivors.push({ path: file, mtimeMs: info.mtimeMs });
+    }
+    const surplus = survivors.length - this.caps.maxEntriesPerPrincipal;
+    if (surplus <= 0) return;
+    survivors.sort((a, b) => a.mtimeMs - b.mtimeMs || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));
+    for (const victim of survivors.slice(0, surplus)) {
+      await rm(victim.path, { force: true }).catch(() => {
+      });
+    }
+  }
+};
+
+export {
+  DEFAULT_QUARANTINE_CAPS,
+  WriteQuarantineStore
+};
+//# sourceMappingURL=chunk-PJSK6OJM.js.map

package/dist/chunk-PJSK6OJM.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/write-quarantine.ts"],"sourcesContent":["/**\n * Dead-letter quarantine for writes rejected by the namespace write-ACL\n * (issue #1888).\n *\n * When `observe` / `memory_store` / `suggestion_submit` fail namespace\n * authorization, the payload used to be dropped with no recoverable copy: a\n * client configured with a namespace that matches no policy (and is not the\n * default/shared namespace) had every write in the window silently destroyed.\n * The ACL rejection is CORRECT and stays fail-closed; this store only\n * preserves the payload so it can be replayed after the config is fixed,\n * following the AGENTS.md \"reject loudly but never destroy state\" posture\n * (patterns 14/42).\n *\n * Records live OUTSIDE any memory namespace at\n * `<memoryDir>/state/quarantine/<principalSafe>/<timestamp>-<id>.json`, keyed\n * by the encoded principal, and are bounded per principal by count and age.\n * Every path is resolved from `memoryDir` through `resolveSafeStoragePath`, so\n * a symlinked `state`/`quarantine` cannot redirect writes outside the memory\n * directory. The store never re-routes a payload into a writable namespace.\n */\n\nimport { randomUUID } from \"node:crypto\";\nimport type { Dirent } from \"node:fs\";\nimport { lstat, mkdir, readFile, readdir, rename, rm, stat, writeFile } from \"node:fs/promises\";\nimport path from \"node:path\";\n\nimport { encodeStoragePathSegment, resolveSafeStoragePath } from \"./storage-paths.js\";\n\nexport type QuarantineOperation = \"observe\" | \"memory_store\" | \"suggestion_submit\";\n\nexport interface QuarantineEntryInput {\n  operation: QuarantineOperation;\n  /** Authenticated principal the write was attributed to, if any. */\n  principal: string | undefined;\n  /** Namespace the caller attempted to write and was denied. */\n  attemptedNamespace: string;\n  /** The original request payload, preserved verbatim for replay. */\n  payload: unknown;\n  /** ISO timestamp; defaults to now. Injectable for deterministic tests. */\n  timestamp?: string;\n}\n\nexport interface QuarantinedRecord {\n  operation: QuarantineOperation;\n  principal: string | null;\n  attemptedNamespace: string;\n  timestamp: string;\n  payload: unknown;\n}\n\n/** A quarantined record paired with the absolute on-disk path it was read from. */\nexport interface QuarantineEntry {\n  record: QuarantinedRecord;\n  path: string;\n}\n\nexport interface QuarantineCaps {\n  /** Keep at most this many records per principal (newest win). */\n  maxEntriesPerPrincipal: number;\n  /** Drop records older than this many milliseconds. */\n  maxAgeMs: number;\n}\n\nexport const DEFAULT_QUARANTINE_CAPS: QuarantineCaps = {\n  maxEntriesPerPrincipal: 500,\n  maxAgeMs: 14 * 24 * 60 * 60 * 1000,\n};\n\nconst QUARANTINE_DIRNAME = \"quarantine\";\n\nfunction validateCaps(caps: QuarantineCaps): void {\n  if (!Number.isInteger(caps.maxEntriesPerPrincipal) || caps.maxEntriesPerPrincipal < 1) {\n    throw new Error(\n      `WriteQuarantineStore: maxEntriesPerPrincipal must be a positive integer (got ${caps.maxEntriesPerPrincipal})`\n    );\n  }\n  if (!Number.isFinite(caps.maxAgeMs) || caps.maxAgeMs <= 0) {\n    throw new Error(\n      `WriteQuarantineStore: maxAgeMs must be a positive finite number of milliseconds (got ${caps.maxAgeMs})`\n    );\n  }\n}\n\nfunction isQuarantinedRecord(value: unknown): value is QuarantinedRecord {\n  if (!value || typeof value !== \"object\") return false;\n  const record = value as Record<string, unknown>;\n  return (\n    (record.operation === \"observe\" ||\n      record.operation === \"memory_store\" ||\n      record.operation === \"suggestion_submit\") &&\n    (record.principal === null || typeof record.principal === \"string\") &&\n    typeof record.attemptedNamespace === \"string\" &&\n    typeof record.timestamp === \"string\" &&\n    \"payload\" in record\n  );\n}\n\nexport class WriteQuarantineStore {\n  private readonly memoryDir: string;\n\n  constructor(\n    memoryDir: string,\n    private readonly caps: QuarantineCaps = DEFAULT_QUARANTINE_CAPS\n  ) {\n    validateCaps(caps);\n    this.memoryDir = path.resolve(memoryDir);\n  }\n\n  /** Absolute quarantine root (`<memoryDir>/state/quarantine`). */\n  get root(): string {\n    return path.join(this.memoryDir, \"state\", QUARANTINE_DIRNAME);\n  }\n\n  /**\n   * Resolve a path under the quarantine root, checked for containment and\n   * symlink traversal from `memoryDir` down — so a symlinked `state` or\n   * `quarantine` component that escapes the memory directory is rejected.\n   */\n  private safeDir(...segments: string[]): Promise<string> {\n    return resolveSafeStoragePath(this.memoryDir, \"state\", QUARANTINE_DIRNAME, ...segments);\n  }\n\n  /**\n   * Park a rejected write. Returns the absolute path of the record written.\n   * Prunes the principal's bucket to the configured caps afterward.\n   */\n  async quarantine(input: QuarantineEntryInput): Promise<string> {\n    const timestamp = input.timestamp ?? new Date().toISOString();\n    const record: QuarantinedRecord = {\n      operation: input.operation,\n      principal: input.principal ?? null,\n      attemptedNamespace: input.attemptedNamespace,\n      timestamp,\n      payload: input.payload,\n    };\n    const principalSegment = encodeStoragePathSegment(input.principal ?? \"unknown\");\n    const fileName = `${timestamp.replace(/[:.]/g, \"-\")}-${randomUUID().slice(0, 8)}.json`;\n\n    const dir = await this.safeDir(principalSegment);\n    await mkdir(dir, { recursive: true });\n    // The temp write uses the exclusive `wx` flag so a pre-planted symlink at\n    // the temp name can never be followed (O_EXCL); rename is atomic (rule 42).\n    const finalPath = await this.safeDir(principalSegment, fileName);\n    const tmpPath = await this.safeDir(principalSegment, `${fileName}.tmp`);\n    await writeFile(tmpPath, JSON.stringify(record, null, 2), { encoding: \"utf8\", flag: \"wx\" });\n    await rename(tmpPath, finalPath);\n\n    await this.pruneDir(dir);\n    return finalPath;\n  }\n\n  /**\n   * All valid, non-expired quarantined records across every principal, oldest\n   * first, each paired with its absolute on-disk path. Expired records are\n   * deleted on read (lazy GC), so an inactive principal bucket with no\n   * follow-up write is still bounded by age.\n   */\n  async entries(): Promise<QuarantineEntry[]> {\n    const now = Date.now();\n    const entries: QuarantineEntry[] = [];\n    for (const dir of await this.principalDirs()) {\n      for (const file of await this.entryFiles(dir)) {\n        const info = await stat(file).catch(() => null);\n        if (!info) continue;\n        if (now - info.mtimeMs > this.caps.maxAgeMs) {\n          await rm(file, { force: true }).catch(() => {});\n          continue;\n        }\n        let parsed: unknown;\n        try {\n          parsed = JSON.parse(await readFile(file, \"utf8\"));\n        } catch {\n          continue;\n        }\n        if (isQuarantinedRecord(parsed)) entries.push({ record: parsed, path: file });\n      }\n    }\n    entries.sort((a, b) => {\n      const at = a.record.timestamp;\n      const bt = b.record.timestamp;\n      return at < bt ? -1 : at > bt ? 1 : 0;\n    });\n    return entries;\n  }\n\n  /** As {@link entries} but projected to records only (backward-compatible view). */\n  async list(): Promise<QuarantinedRecord[]> {\n    return (await this.entries()).map((entry) => entry.record);\n  }\n\n  /**\n   * Delete one quarantined entry by its absolute on-disk path (as returned by\n   * {@link entries}). The path MUST resolve inside the quarantine root, mirroring\n   * the store's containment posture; a path outside the root — or one already\n   * absent — removes nothing. Returns true only when a file was actually deleted.\n   */\n  async removeEntry(entryPath: string): Promise<boolean> {\n    const rootAbs = path.resolve(this.root);\n    const rel = path.relative(rootAbs, path.resolve(entryPath));\n    if (rel === \"\" || rel === \"..\" || rel.startsWith(`..${path.sep}`) || path.isAbsolute(rel)) {\n      return false;\n    }\n    // Symlink-race-safe resolution (issue #1888): resolveSafeStoragePath rejects\n    // any symlinked path component and verifies the REAL path stays inside the\n    // real quarantine root before we touch it, so a swapped component cannot\n    // redirect the deletion outside the store — lexical containment alone is not\n    // sufficient against a TOCTOU symlink swap.\n    let safe: string;\n    try {\n      safe = await resolveSafeStoragePath(rootAbs, rel);\n    } catch {\n      return false;\n    }\n    try {\n      await rm(safe, { force: false });\n      return true;\n    } catch (err) {\n      const errno = err as NodeJS.ErrnoException;\n      if (errno?.code === \"ENOENT\") return false;\n      throw err;\n    }\n  }\n\n  /** Total valid, non-expired quarantined record count across every principal. */\n  async count(): Promise<number> {\n    return (await this.list()).length;\n  }\n\n  /** lstat (no symlink follow): true only for a real directory. */\n  private async isRealDir(dir: string): Promise<boolean> {\n    const info = await lstat(dir).catch(() => null);\n    return info?.isDirectory() === true;\n  }\n\n  private async principalDirs(): Promise<string[]> {\n    // safeDir() rejects a symlinked/containment-escaping root — let that\n    // propagate instead of masquerading as an empty store.\n    const root = await this.safeDir();\n    if (!(await this.isRealDir(root))) return [];\n    let entries: Dirent[];\n    try {\n      entries = await readdir(root, { withFileTypes: true });\n    } catch (err) {\n      // Root vanished mid-scan → legitimately empty. Any other failure\n      // (permissions, IO) is a genuine inspection failure and must surface.\n      if ((err as NodeJS.ErrnoException)?.code === \"ENOENT\") return [];\n      throw err;\n    }\n    return entries\n      .filter((entry) => entry.isDirectory())\n      .map((entry) => path.join(root, entry.name))\n      .sort();\n  }\n\n  private async entryFiles(dir: string): Promise<string[]> {\n    if (!(await this.isRealDir(dir))) return [];\n    let entries: Dirent[];\n    try {\n      entries = await readdir(dir, { withFileTypes: true });\n    } catch (err) {\n      if ((err as NodeJS.ErrnoException)?.code === \"ENOENT\") return [];\n      throw err;\n    }\n    return entries\n      .filter((entry) => entry.isFile() && entry.name.endsWith(\".json\"))\n      .map((entry) => path.join(dir, entry.name))\n      .sort();\n  }\n\n  private async pruneDir(dir: string): Promise<void> {\n    const files = await this.entryFiles(dir);\n    const now = Date.now();\n    const survivors: Array<{ path: string; mtimeMs: number }> = [];\n    for (const file of files) {\n      const info = await stat(file).catch(() => null);\n      if (!info) continue;\n      if (now - info.mtimeMs > this.caps.maxAgeMs) {\n        await rm(file, { force: true }).catch(() => {});\n        continue;\n      }\n      survivors.push({ path: file, mtimeMs: info.mtimeMs });\n    }\n    const surplus = survivors.length - this.caps.maxEntriesPerPrincipal;\n    if (surplus <= 0) return;\n    survivors.sort((a, b) => a.mtimeMs - b.mtimeMs || (a.path < b.path ? -1 : a.path > b.path ? 1 : 0));\n    for (const victim of survivors.slice(0, surplus)) {\n      await rm(victim.path, { force: true }).catch(() => {});\n    }\n  }\n}\n"],"mappings":";;;;;;AAqBA,SAAS,kBAAkB;AAE3B,SAAS,OAAO,OAAO,UAAU,SAAS,QAAQ,IAAI,MAAM,iBAAiB;AAC7E,OAAO,UAAU;AAuCV,IAAM,0BAA0C;AAAA,EACrD,wBAAwB;AAAA,EACxB,UAAU,KAAK,KAAK,KAAK,KAAK;AAChC;AAEA,IAAM,qBAAqB;AAE3B,SAAS,aAAa,MAA4B;AAChD,MAAI,CAAC,OAAO,UAAU,KAAK,sBAAsB,KAAK,KAAK,yBAAyB,GAAG;AACrF,UAAM,IAAI;AAAA,MACR,gFAAgF,KAAK,sBAAsB;AAAA,IAC7G;AAAA,EACF;AACA,MAAI,CAAC,OAAO,SAAS,KAAK,QAAQ,KAAK,KAAK,YAAY,GAAG;AACzD,UAAM,IAAI;AAAA,MACR,wFAAwF,KAAK,QAAQ;AAAA,IACvG;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,OAA4C;AACvE,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,QAAM,SAAS;AACf,UACG,OAAO,cAAc,aACpB,OAAO,cAAc,kBACrB,OAAO,cAAc,yBACtB,OAAO,cAAc,QAAQ,OAAO,OAAO,cAAc,aAC1D,OAAO,OAAO,uBAAuB,YACrC,OAAO,OAAO,cAAc,YAC5B,aAAa;AAEjB;AAEO,IAAM,uBAAN,MAA2B;AAAA,EAGhC,YACE,WACiB,OAAuB,yBACxC;AADiB;AAEjB,iBAAa,IAAI;AACjB,SAAK,YAAY,KAAK,QAAQ,SAAS;AAAA,EACzC;AAAA,EAJmB;AAAA,EAJF;AAAA;AAAA,EAWjB,IAAI,OAAe;AACjB,WAAO,KAAK,KAAK,KAAK,WAAW,SAAS,kBAAkB;AAAA,EAC9D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAOQ,WAAW,UAAqC;AACtD,WAAO,uBAAuB,KAAK,WAAW,SAAS,oBAAoB,GAAG,QAAQ;AAAA,EACxF;AAAA;AAAA;AAAA;AAAA;AAAA,EAMA,MAAM,WAAW,OAA8C;AAC7D,UAAM,YAAY,MAAM,cAAa,oBAAI,KAAK,GAAE,YAAY;AAC5D,UAAM,SAA4B;AAAA,MAChC,WAAW,MAAM;AAAA,MACjB,WAAW,MAAM,aAAa;AAAA,MAC9B,oBAAoB,MAAM;AAAA,MAC1B;AAAA,MACA,SAAS,MAAM;AAAA,IACjB;AACA,UAAM,mBAAmB,yBAAyB,MAAM,aAAa,SAAS;AAC9E,UAAM,WAAW,GAAG,UAAU,QAAQ,SAAS,GAAG,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC;AAE/E,UAAM,MAAM,MAAM,KAAK,QAAQ,gBAAgB;AAC/C,UAAM,MAAM,KAAK,EAAE,WAAW,KAAK,CAAC;AAGpC,UAAM,YAAY,MAAM,KAAK,QAAQ,kBAAkB,QAAQ;AAC/D,UAAM,UAAU,MAAM,KAAK,QAAQ,kBAAkB,GAAG,QAAQ,MAAM;AACtE,UAAM,UAAU,SAAS,KAAK,UAAU,QAAQ,MAAM,CAAC,GAAG,EAAE,UAAU,QAAQ,MAAM,KAAK,CAAC;AAC1F,UAAM,OAAO,SAAS,SAAS;AAE/B,UAAM,KAAK,SAAS,GAAG;AACvB,WAAO;AAAA,EACT;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,UAAsC;AAC1C,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,UAA6B,CAAC;AACpC,eAAW,OAAO,MAAM,KAAK,cAAc,GAAG;AAC5C,iBAAW,QAAQ,MAAM,KAAK,WAAW,GAAG,GAAG;AAC7C,cAAM,OAAO,MAAM,KAAK,IAAI,EAAE,MAAM,MAAM,IAAI;AAC9C,YAAI,CAAC,KAAM;AACX,YAAI,MAAM,KAAK,UAAU,KAAK,KAAK,UAAU;AAC3C,gBAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,UAAC,CAAC;AAC9C;AAAA,QACF;AACA,YAAI;AACJ,YAAI;AACF,mBAAS,KAAK,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC;AAAA,QAClD,QAAQ;AACN;AAAA,QACF;AACA,YAAI,oBAAoB,MAAM,EAAG,SAAQ,KAAK,EAAE,QAAQ,QAAQ,MAAM,KAAK,CAAC;AAAA,MAC9E;AAAA,IACF;AACA,YAAQ,KAAK,CAAC,GAAG,MAAM;AACrB,YAAM,KAAK,EAAE,OAAO;AACpB,YAAM,KAAK,EAAE,OAAO;AACpB,aAAO,KAAK,KAAK,KAAK,KAAK,KAAK,IAAI;AAAA,IACtC,CAAC;AACD,WAAO;AAAA,EACT;AAAA;AAAA,EAGA,MAAM,OAAqC;AACzC,YAAQ,MAAM,KAAK,QAAQ,GAAG,IAAI,CAAC,UAAU,MAAM,MAAM;AAAA,EAC3D;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQA,MAAM,YAAY,WAAqC;AACrD,UAAM,UAAU,KAAK,QAAQ,KAAK,IAAI;AACtC,UAAM,MAAM,KAAK,SAAS,SAAS,KAAK,QAAQ,SAAS,CAAC;AAC1D,QAAI,QAAQ,MAAM,QAAQ,QAAQ,IAAI,WAAW,KAAK,KAAK,GAAG,EAAE,KAAK,KAAK,WAAW,GAAG,GAAG;AACzF,aAAO;AAAA,IACT;AAMA,QAAI;AACJ,QAAI;AACF,aAAO,MAAM,uBAAuB,SAAS,GAAG;AAAA,IAClD,QAAQ;AACN,aAAO;AAAA,IACT;AACA,QAAI;AACF,YAAM,GAAG,MAAM,EAAE,OAAO,MAAM,CAAC;AAC/B,aAAO;AAAA,IACT,SAAS,KAAK;AACZ,YAAM,QAAQ;AACd,UAAI,OAAO,SAAS,SAAU,QAAO;AACrC,YAAM;AAAA,IACR;AAAA,EACF;AAAA;AAAA,EAGA,MAAM,QAAyB;AAC7B,YAAQ,MAAM,KAAK,KAAK,GAAG;AAAA,EAC7B;AAAA;AAAA,EAGA,MAAc,UAAU,KAA+B;AACrD,UAAM,OAAO,MAAM,MAAM,GAAG,EAAE,MAAM,MAAM,IAAI;AAC9C,WAAO,MAAM,YAAY,MAAM;AAAA,EACjC;AAAA,EAEA,MAAc,gBAAmC;AAG/C,UAAM,OAAO,MAAM,KAAK,QAAQ;AAChC,QAAI,CAAE,MAAM,KAAK,UAAU,IAAI,EAAI,QAAO,CAAC;AAC3C,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,QAAQ,MAAM,EAAE,eAAe,KAAK,CAAC;AAAA,IACvD,SAAS,KAAK;AAGZ,UAAK,KAA+B,SAAS,SAAU,QAAO,CAAC;AAC/D,YAAM;AAAA,IACR;AACA,WAAO,QACJ,OAAO,CAAC,UAAU,MAAM,YAAY,CAAC,EACrC,IAAI,CAAC,UAAU,KAAK,KAAK,MAAM,MAAM,IAAI,CAAC,EAC1C,KAAK;AAAA,EACV;AAAA,EAEA,MAAc,WAAW,KAAgC;AACvD,QAAI,CAAE,MAAM,KAAK,UAAU,GAAG,EAAI,QAAO,CAAC;AAC1C,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,QAAQ,KAAK,EAAE,eAAe,KAAK,CAAC;AAAA,IACtD,SAAS,KAAK;AACZ,UAAK,KAA+B,SAAS,SAAU,QAAO,CAAC;AAC/D,YAAM;AAAA,IACR;AACA,WAAO,QACJ,OAAO,CAAC,UAAU,MAAM,OAAO,KAAK,MAAM,KAAK,SAAS,OAAO,CAAC,EAChE,IAAI,CAAC,UAAU,KAAK,KAAK,KAAK,MAAM,IAAI,CAAC,EACzC,KAAK;AAAA,EACV;AAAA,EAEA,MAAc,SAAS,KAA4B;AACjD,UAAM,QAAQ,MAAM,KAAK,WAAW,GAAG;AACvC,UAAM,MAAM,KAAK,IAAI;AACrB,UAAM,YAAsD,CAAC;AAC7D,eAAW,QAAQ,OAAO;AACxB,YAAM,OAAO,MAAM,KAAK,IAAI,EAAE,MAAM,MAAM,IAAI;AAC9C,UAAI,CAAC,KAAM;AACX,UAAI,MAAM,KAAK,UAAU,KAAK,KAAK,UAAU;AAC3C,cAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,QAAC,CAAC;AAC9C;AAAA,MACF;AACA,gBAAU,KAAK,EAAE,MAAM,MAAM,SAAS,KAAK,QAAQ,CAAC;AAAA,IACtD;AACA,UAAM,UAAU,UAAU,SAAS,KAAK,KAAK;AAC7C,QAAI,WAAW,EAAG;AAClB,cAAU,KAAK,CAAC,GAAG,MAAM,EAAE,UAAU,EAAE,YAAY,EAAE,OAAO,EAAE,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,IAAI,EAAE;AAClG,eAAW,UAAU,UAAU,MAAM,GAAG,OAAO,GAAG;AAChD,YAAM,GAAG,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,MAAC,CAAC;AAAA,IACvD;AAAA,EACF;AACF;","names":[]}