@synap-core/eve 0.1.0

package/dist/chunk-HVJEW7TU.js

@@ -0,0 +1,495 @@
+import { createRequire as __eveCreateRequire } from 'module'; const require = __eveCreateRequire(import.meta.url);
+import {
+  discoverAndBackfillPodConfig,
+  ensureSynapLoopbackOverride,
+  pruneOldImagesForRepo
+} from "./chunk-5TBV2VHZ.js";
+import {
+  readEveSecrets,
+  writeEveSecrets
+} from "./chunk-T7GCAJK5.js";
+
+// ../@eve/brain/dist/chunk-A3GOG2CO.js
+import { randomBytes } from "crypto";
+import { existsSync as existsSync4, mkdirSync, readdirSync, writeFileSync as writeFileSync3, readFileSync as readFileSync4 } from "fs";
+import { join as join3 } from "path";
+import { execSync, spawnSync as spawnSync2 } from "child_process";
+import { spawnSync } from "child_process";
+import { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from "fs";
+import { join as join2 } from "path";
+import { existsSync, readFileSync } from "fs";
+import { join, resolve } from "path";
+import { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from "fs";
+var CANDIDATE_PATHS = [
+  "/opt/synap",
+  "/opt/synap-backend",
+  "/srv/synap",
+  "/home/synap/synap-backend",
+  "/root/synap-backend"
+];
+function tryPath(root) {
+  if (!existsSync(root)) return null;
+  const script = join(root, "synap");
+  if (!existsSync(script)) return null;
+  const deployDir = join(root, "deploy");
+  if (!existsSync(join(deployDir, "docker-compose.yml"))) return null;
+  return { repoRoot: root, synapScript: script, deployDir };
+}
+function resolveSynapDelegate(cwd) {
+  const cliOverride = process.env.SYNAP_CLI?.trim();
+  if (cliOverride && existsSync(cliOverride)) {
+    const root = resolve(cliOverride, "..");
+    const d = tryPath(root);
+    if (d) return d;
+  }
+  const envRoot = process.env.SYNAP_REPO_ROOT?.trim();
+  if (envRoot) {
+    const d = tryPath(envRoot);
+    if (d) return d;
+  }
+  const statePath = join(cwd ?? process.cwd(), ".eve", "state.json");
+  if (existsSync(statePath)) {
+    try {
+      const state = JSON.parse(readFileSync(statePath, "utf-8"));
+      const savedRoot = state?.installed?.synap?.config?.repoRoot;
+      if (savedRoot) {
+        const d = tryPath(savedRoot);
+        if (d) return d;
+      }
+    } catch {
+    }
+  }
+  for (const candidate of CANDIDATE_PATHS) {
+    const d = tryPath(candidate);
+    if (d) return d;
+  }
+  return null;
+}
+function toPodFqdn(input) {
+  const trimmed = input.trim();
+  if (!trimmed || trimmed === "localhost") return trimmed;
+  if (/^\d{1,3}(\.\d{1,3}){3}$/.test(trimmed)) return trimmed;
+  if (trimmed.startsWith("pod.")) return trimmed;
+  return `pod.${trimmed}`;
+}
+function rewriteEnvDomain(envPath, fqdn) {
+  if (!existsSync2(envPath)) return false;
+  const current = readFileSync2(envPath, "utf-8");
+  const existing = current.match(/^DOMAIN=(.*)$/m)?.[1]?.trim();
+  if (existing === fqdn) return false;
+  const next = current.match(/^DOMAIN=.*$/m) ? current.replace(/^DOMAIN=.*$/m, `DOMAIN=${fqdn}`) : `${current}${current.endsWith("\n") ? "" : "\n"}DOMAIN=${fqdn}
+`;
+  writeFileSync(envPath, next, { encoding: "utf-8", mode: 384 });
+  return true;
+}
+var DEFAULT_TIMEOUT_MS = 30 * 60 * 1e3;
+function refreshGitCheckout(repoRoot) {
+  if (!existsSync2(`${repoRoot}/.git`)) return;
+  const git = (args) => spawnSync("git", ["-C", repoRoot, ...args], { stdio: ["ignore", "pipe", "pipe"], encoding: "utf-8" });
+  git(["fetch", "--quiet"]);
+  const ff = git(["pull", "--ff-only"]);
+  if (ff.status === 0) return;
+  const ref = (git(["rev-parse", "--abbrev-ref", "--symbolic-full-name", "@{u}"]).stdout ?? "").toString().trim();
+  const isShallow = (git(["rev-parse", "--is-shallow-repository"]).stdout ?? "").toString().trim() === "true";
+  let hasLocalCommits = false;
+  if (!isShallow) {
+    const aheadOut = ref ? git(["rev-list", "--count", `${ref}..HEAD`]) : null;
+    hasLocalCommits = !aheadOut || aheadOut.status !== 0 || parseInt((aheadOut.stdout ?? "").toString().trim(), 10) > 0;
+  }
+  if (ref && !hasLocalCommits) {
+    const reset = git(["reset", "--hard", ref]);
+    if (reset.status === 0) {
+      console.warn(
+        `  Note: synap-backend at ${repoRoot} had drifted from ${ref} (couldn't fast-forward); hard-reset to upstream to keep deploy logic + kratos.yml generation current. Gitignored .env/kratos.yml/overrides and docker volumes were untouched.`
+      );
+      return;
+    }
+  }
+  const detail = (ff.stderr ?? "").toString().trim() || "rejected (non-fast-forward).";
+  console.warn(
+    `  Warning: could not refresh synap-backend at ${repoRoot} \u2014 ${detail}
+` + (hasLocalCommits ? `  The checkout has local commits; refusing to discard them. To force it to upstream (safe \u2014 data lives in volumes + gitignored files):
+      git -C ${repoRoot} fetch && git -C ${repoRoot} reset --hard @{u}
+` : `  Continuing with the on-disk version (may regenerate stale config). Fix: git -C ${repoRoot} fetch && git -C ${repoRoot} reset --hard @{u}
+`)
+  );
+}
+function resolveExplicitRepo(repoRoot) {
+  const synapScript = `${repoRoot}/synap`;
+  const deployDir = `${repoRoot}/deploy`;
+  if (!existsSync2(synapScript)) return null;
+  if (!existsSync2(`${deployDir}/docker-compose.yml`)) return null;
+  return { repoRoot, synapScript, deployDir };
+}
+function runSynapCli(subcommand, args = [], options = {}) {
+  const paths = options.repoRoot ? resolveExplicitRepo(options.repoRoot) : resolveSynapDelegate();
+  if (!paths) {
+    return {
+      ok: false,
+      exitCode: -1,
+      paths: null,
+      stdout: "",
+      stderr: options.repoRoot ? `synap CLI not found at ${options.repoRoot} \u2014 expected ${options.repoRoot}/synap and ${options.repoRoot}/deploy/docker-compose.yml` : diagnoseMissingSynapCli()
+    };
+  }
+  if (options.refreshGit) {
+    refreshGitCheckout(paths.repoRoot);
+  }
+  if (options.domain) {
+    const fqdn = toPodFqdn(options.domain);
+    rewriteEnvDomain(join2(paths.deployDir, ".env"), fqdn);
+  }
+  const env = {
+    ...process.env,
+    SYNAP_DEPLOY_DIR: paths.deployDir,
+    SYNAP_ASSUME_YES: "1",
+    SYNAP_NON_INTERACTIVE: "1",
+    // Eve always provides the edge proxy (eve-legs-traefik on port 80/443).
+    // Tell the synap CLI to skip its built-in Caddy so it doesn't fight
+    // Traefik for port 80 and abort updates with "port already allocated".
+    SYNAP_SKIP_EDGE: "1",
+    // Belt-and-suspenders: pin the compose project name explicitly so eve
+    // never accidentally creates `deploy_*` volumes (the cwd-basename
+    // fallback). Pre-Phase-3 synap-backend installs don't have
+    // `_resolve_compose_project_name`, so without this override they'd
+    // silently use cwd basename → orphan volumes → postgres detonation.
+    // Exception: honour an existing pin (operator chose differently).
+    COMPOSE_PROJECT_NAME: process.env.COMPOSE_PROJECT_NAME ?? "synap-backend"
+  };
+  if (options.domain) {
+    env.DOMAIN = toPodFqdn(options.domain);
+  }
+  const inherit = options.inherit !== false;
+  const result = spawnSync("bash", [paths.synapScript, subcommand, ...args], {
+    cwd: paths.deployDir,
+    env,
+    stdio: inherit ? "inherit" : "pipe",
+    timeout: DEFAULT_TIMEOUT_MS
+  });
+  return {
+    ok: result.status === 0,
+    exitCode: result.status ?? -1,
+    paths,
+    stdout: inherit ? "" : result.stdout?.toString() ?? "",
+    stderr: inherit ? "" : result.stderr?.toString() ?? ""
+  };
+}
+function diagnoseMissingSynapCli() {
+  const candidate = process.env.SYNAP_REPO_ROOT?.trim() || "/opt/synap-backend";
+  const hasFlatCompose = existsSync2(`${candidate}/docker-compose.yml`);
+  const hasGit = existsSync2(`${candidate}/.git`);
+  const hasScript = existsSync2(`${candidate}/synap`);
+  if (hasFlatCompose && !hasGit && !hasScript) {
+    return [
+      "synap CLI not found \u2014 pre-cutover flat-layout install detected at " + candidate + ".",
+      "",
+      "Eve no longer bundles its own compose file; the canonical synap-backend git checkout is required.",
+      "Migrate (preserves docker volumes \u2014 your data is safe):",
+      "",
+      "  docker compose -f " + candidate + "/docker-compose.yml down",
+      "  sudo mv " + candidate + " " + candidate + ".legacy",
+      "  sudo git clone --depth 1 https://github.com/synap-core/backend.git " + candidate,
+      "  sudo mv " + candidate + ".legacy/.env " + candidate + "/deploy/.env",
+      "  sudo mv " + candidate + ".legacy/docker-compose.override.yml " + candidate + "/deploy/ 2>/dev/null || true",
+      "  eve update synap   # synap CLI now visible; runs canonical update + reconnects eve-network",
+      "",
+      "After verifying the pod is healthy, you can `sudo rm -rf " + candidate + ".legacy`."
+    ].join("\n");
+  }
+  return "synap CLI not found at " + candidate + "/synap \u2014 set SYNAP_REPO_ROOT, or run `eve install synap`.";
+}
+var POD_SECRET_KEYS = [
+  "POSTGRES_PASSWORD",
+  "JWT_SECRET",
+  "KRATOS_SECRETS_COOKIE",
+  "KRATOS_SECRETS_CIPHER",
+  "KRATOS_WEBHOOK_SECRET",
+  "MINIO_ACCESS_KEY",
+  "MINIO_SECRET_KEY",
+  "TYPESENSE_API_KEY",
+  "TYPESENSE_ADMIN_API_KEY",
+  "ORY_HYDRA_SECRETS_SYSTEM",
+  "SYNAP_SERVICE_ENCRYPTION_KEY",
+  "PROVISIONING_TOKEN"
+];
+function readEnvLine(content, key) {
+  const m = content.match(new RegExp(`^${key}=(.*)$`, "m"));
+  return m?.[1]?.trim() || void 0;
+}
+async function backupPodSecrets(envPath) {
+  if (!existsSync3(envPath)) return { captured: [] };
+  const content = readFileSync3(envPath, "utf-8");
+  const captured = [];
+  const podSecrets = {};
+  for (const key of POD_SECRET_KEYS) {
+    const value = readEnvLine(content, key);
+    if (value) {
+      podSecrets[key] = value;
+      captured.push(key);
+    }
+  }
+  if (captured.length === 0) return { captured: [] };
+  await writeEveSecrets({
+    synap: {
+      podSecrets: {
+        ...podSecrets,
+        backedUpAt: (/* @__PURE__ */ new Date()).toISOString()
+      }
+    }
+  });
+  return { captured };
+}
+async function restorePodSecrets(envPath) {
+  if (!existsSync3(envPath)) return { restored: [], reason: ".env does not exist" };
+  const secrets = await readEveSecrets();
+  const backup = secrets?.synap?.podSecrets;
+  if (!backup) return { restored: [], reason: "no eve backup available" };
+  let content = readFileSync3(envPath, "utf-8");
+  const restored = [];
+  for (const key of POD_SECRET_KEYS) {
+    const backupValue = backup[key];
+    if (!backupValue) continue;
+    const currentValue = readEnvLine(content, key);
+    if (currentValue) continue;
+    const lineExists = new RegExp(`^${key}=.*$`, "m").test(content);
+    if (lineExists) {
+      content = content.replace(new RegExp(`^${key}=.*$`, "m"), `${key}=${backupValue}`);
+    } else {
+      const sep = content.endsWith("\n") ? "" : "\n";
+      content = `${content}${sep}${key}=${backupValue}
+`;
+    }
+    restored.push(key);
+  }
+  if (restored.length > 0) {
+    writeFileSync2(envPath, content, { encoding: "utf-8", mode: 384 });
+  }
+  return { restored };
+}
+var SYNAP_BACKEND_REPO = "https://github.com/synap-core/backend.git";
+function ensureSynapBackendCheckout(repoRoot) {
+  if (existsSync4(join3(repoRoot, ".git"))) return;
+  mkdirSync(repoRoot, { recursive: true });
+  const isEmpty = readdirSafe(repoRoot).length === 0;
+  if (!isEmpty) {
+    throw new Error(
+      `Cannot clone synap-backend into non-empty non-git dir ${repoRoot}. Move existing files away or set SYNAP_REPO_ROOT to a different path.`
+    );
+  }
+  const result = spawnSync2("git", ["clone", "--depth", "1", SYNAP_BACKEND_REPO, repoRoot], {
+    stdio: "inherit"
+  });
+  if (result.status !== 0) {
+    throw new Error(`git clone ${SYNAP_BACKEND_REPO} failed (exit ${result.status})`);
+  }
+}
+function readdirSafe(dir) {
+  try {
+    return readdirSync(dir);
+  } catch {
+    return [];
+  }
+}
+function gen(bytes = 32) {
+  return randomBytes(bytes).toString("hex");
+}
+function getSynapBackendContainer() {
+  return findComposeContainer("backend");
+}
+function getSynapPodAdminContainer() {
+  return findComposeContainer("pod-admin");
+}
+function findComposeContainer(service) {
+  try {
+    const out = execSync(
+      `docker ps --filter "label=com.docker.compose.project=synap-backend" --filter "label=com.docker.compose.service=${service}" --format "{{.Names}}"`,
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim();
+    return out.split("\n")[0]?.trim() || null;
+  } catch {
+    return null;
+  }
+}
+function isBackendHealthy() {
+  const name = getSynapBackendContainer();
+  if (!name) return false;
+  try {
+    const out = execSync(
+      `docker inspect --format "{{.State.Health.Status}}" ${name}`,
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim();
+    return out === "healthy";
+  } catch {
+    return false;
+  }
+}
+function isCaddyOnlyFailure(stderr) {
+  if (/synap-backend-caddy.*Bind for [0-9.:]*:80\s+failed: port is already allocated/i.test(stderr)) {
+    return true;
+  }
+  const caddy = findComposeContainer("caddy");
+  if (!caddy) return false;
+  try {
+    const status = execSync(
+      `docker inspect --format "{{.State.Status}}" ${caddy}`,
+      { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+    ).trim();
+    return status === "created" || status === "exited";
+  } catch {
+    return false;
+  }
+}
+function connectToEveNetwork(containerName, alias) {
+  if (alias) {
+    try {
+      const inspect = execSync(
+        `docker inspect --format "{{json .NetworkSettings.Networks}}" ${containerName}`,
+        { encoding: "utf-8", stdio: ["pipe", "pipe", "ignore"] }
+      ).trim();
+      const networks = JSON.parse(inspect);
+      const eve = networks["eve-network"];
+      if (eve) {
+        if ((eve.Aliases ?? []).includes(alias)) return;
+        try {
+          execSync(`docker network disconnect eve-network ${containerName}`, {
+            stdio: ["pipe", "pipe", "ignore"]
+          });
+        } catch {
+        }
+      }
+    } catch {
+    }
+  }
+  const aliasArg = alias ? ` --alias ${alias}` : "";
+  try {
+    execSync(`docker network connect${aliasArg} eve-network ${containerName}`, {
+      stdio: ["pipe", "pipe", "ignore"]
+    });
+  } catch {
+  }
+}
+async function installSynapFromImage(opts = {}) {
+  const repoRoot = opts.deployDir ?? "/opt/synap-backend";
+  const composeDir = join3(repoRoot, "deploy");
+  let bareDomain = opts.domain ?? "localhost";
+  if (bareDomain === "localhost") {
+    const discovered = await discoverAndBackfillPodConfig(process.cwd());
+    if (discovered.domain) {
+      bareDomain = discovered.domain;
+    }
+  }
+  const podDomain = toPodFqdn(bareDomain);
+  const adminBootstrapMode = opts.adminBootstrapMode ?? "token";
+  ensureSynapBackendCheckout(repoRoot);
+  try {
+    const r = ensureSynapLoopbackOverride(composeDir);
+    if (r.outcome === "wrote") {
+      console.log(`  Wrote loopback compose override at ${r.path}`);
+    } else {
+      console.log(`  Kept existing ${r.path} (${r.reason ?? "user-owned"})`);
+    }
+  } catch (err) {
+    console.warn(`  Could not write loopback override: ${err instanceof Error ? err.message : String(err)} (continuing \u2014 CLI will use public URL)`);
+  }
+  const envPath = join3(composeDir, ".env");
+  const envExisted = existsSync4(envPath);
+  const existingEnv = envExisted ? readFileSync4(envPath, "utf-8") : "";
+  const existingToken = existingEnv.match(/^ADMIN_BOOTSTRAP_TOKEN=(.+)$/m)?.[1];
+  const existingEmail = existingEnv.match(/^LETSENCRYPT_EMAIL=(.+)$/m)?.[1]?.trim();
+  const email = opts.email?.trim() || existingEmail;
+  const bootstrapToken = existingToken?.trim() ?? gen(16);
+  if (envExisted) {
+    reconcileEveEnv(envPath);
+    const restored = await restorePodSecrets(envPath);
+    if (restored.restored.length > 0) {
+      console.log(`  Restored ${restored.restored.length} pod secret(s) from eve backup: ${restored.restored.join(", ")}`);
+    }
+  }
+  const cliArgs = [
+    "--non-interactive",
+    "--dir",
+    repoRoot,
+    "--domain",
+    podDomain,
+    "--admin-bootstrap-mode",
+    adminBootstrapMode
+  ];
+  if (opts.fromSource === true) cliArgs.push("--from-source");
+  else if (opts.fromSource === false) cliArgs.push("--from-image");
+  if (email) cliArgs.push("--email", email);
+  if (opts.adminEmail) cliArgs.push("--admin-email", opts.adminEmail);
+  if (opts.adminPassword) cliArgs.push("--admin-password", opts.adminPassword);
+  if (adminBootstrapMode === "token") cliArgs.push("--admin-bootstrap-token", bootstrapToken);
+  if (opts.withOpenclaw) cliArgs.push("--with-openclaw");
+  if (opts.withRsshub) cliArgs.push("--with-rsshub");
+  const cliResult = runSynapCli("install", cliArgs, { repoRoot, refreshGit: true });
+  if (!cliResult.ok) {
+    if (isBackendHealthy() && isCaddyOnlyFailure(cliResult.stderr)) {
+      console.warn(
+        `
+  \u26A0 Caddy could not bind port 80 (eve-legs-traefik already owns it).
+    Backend is healthy; the data plane is up. Synap install proceeding.
+    To stop the spurious Caddy container: docker rm -f synap-backend-caddy-1
+`
+      );
+    } else {
+      throw new Error(
+        `synap install exited ${cliResult.exitCode}` + (cliResult.stderr ? `: ${cliResult.stderr}` : "")
+      );
+    }
+  }
+  try {
+    const captured = await backupPodSecrets(envPath);
+    if (captured.captured.length > 0) {
+      console.log(`  Backed up ${captured.captured.length} pod secret(s) to secrets.json:synap.podSecrets`);
+    }
+  } catch (err) {
+    console.warn(`  Could not back up pod secrets: ${err instanceof Error ? err.message : String(err)} (continuing \u2014 recovery from .env loss won't be available until next install/update)`);
+  }
+  const containerName = getSynapBackendContainer();
+  if (containerName) {
+    connectToEveNetwork(containerName, "eve-brain-synap");
+    console.log(`  Connected ${containerName} \u2192 eve-network (alias: eve-brain-synap)`);
+  } else {
+    console.warn("  Backend container not found after synap install \u2014 skipping eve-network attach");
+  }
+  const podAdminContainer = getSynapPodAdminContainer();
+  if (podAdminContainer) {
+    connectToEveNetwork(podAdminContainer, "eve-brain-pod-admin");
+    console.log(`  Connected ${podAdminContainer} \u2192 eve-network (alias: eve-brain-pod-admin)`);
+  }
+  for (const repo of ["ghcr.io/synap-core/backend", "ghcr.io/synap-core/pod-agent"]) {
+    try {
+      const r = pruneOldImagesForRepo(repo, 3);
+      if (r.removed.length > 0) {
+        console.log(`  Pruned ${r.removed.length} old ${repo} image(s) (kept latest 3).`);
+      }
+    } catch {
+    }
+  }
+  const finalEnv = existsSync4(envPath) ? readFileSync4(envPath, "utf-8") : "";
+  const finalToken = finalEnv.match(/^ADMIN_BOOTSTRAP_TOKEN=(.+)$/m)?.[1]?.trim() ?? bootstrapToken;
+  return { bootstrapToken: finalToken, deployDir: repoRoot, containerName };
+}
+function reconcileEveEnv(envPath) {
+  if (!existsSync4(envPath)) return false;
+  let content = readFileSync4(envPath, "utf-8");
+  const legacy = content.match(/^KRATOS_CONFIG_DIR=\.\/config\/kratos\s*$/m);
+  if (!legacy) return false;
+  content = content.replace(/^KRATOS_CONFIG_DIR=\.\/config\/kratos\s*\n?/m, "");
+  writeFileSync3(envPath, content, { encoding: "utf-8", mode: 384 });
+  console.log("  reconcile-env: removed legacy KRATOS_CONFIG_DIR=./config/kratos (canonical layout uses ../kratos)");
+  return true;
+}
+
+export {
+  resolveSynapDelegate,
+  toPodFqdn,
+  runSynapCli,
+  POD_SECRET_KEYS,
+  backupPodSecrets,
+  restorePodSecrets,
+  installSynapFromImage,
+  reconcileEveEnv
+};
+//# sourceMappingURL=chunk-HVJEW7TU.js.map

package/dist/chunk-HVJEW7TU.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../@eve/brain/dist/chunk-A3GOG2CO.js"],"sourcesContent":["// src/lib/synap-image-install.ts\nimport { randomBytes } from \"crypto\";\nimport { existsSync as existsSync4, mkdirSync, readdirSync, writeFileSync as writeFileSync3, readFileSync as readFileSync4 } from \"fs\";\nimport { join as join3 } from \"path\";\nimport { execSync, spawnSync as spawnSync2 } from \"child_process\";\nimport {\n  ensureSynapLoopbackOverride,\n  pruneOldImagesForRepo,\n  discoverAndBackfillPodConfig\n} from \"@eve/dna\";\n\n// src/lib/synap-cli-delegate.ts\nimport { spawnSync } from \"child_process\";\nimport { existsSync as existsSync2, readFileSync as readFileSync2, writeFileSync } from \"fs\";\nimport { join as join2 } from \"path\";\n\n// src/lib/synap-delegate.ts\nimport { existsSync, readFileSync } from \"fs\";\nimport { join, resolve } from \"path\";\nvar CANDIDATE_PATHS = [\n  \"/opt/synap\",\n  \"/opt/synap-backend\",\n  \"/srv/synap\",\n  \"/home/synap/synap-backend\",\n  \"/root/synap-backend\"\n];\nfunction tryPath(root) {\n  if (!existsSync(root)) return null;\n  const script = join(root, \"synap\");\n  if (!existsSync(script)) return null;\n  const deployDir = join(root, \"deploy\");\n  if (!existsSync(join(deployDir, \"docker-compose.yml\"))) return null;\n  return { repoRoot: root, synapScript: script, deployDir };\n}\nfunction resolveSynapDelegate(cwd) {\n  const cliOverride = process.env.SYNAP_CLI?.trim();\n  if (cliOverride && existsSync(cliOverride)) {\n    const root = resolve(cliOverride, \"..\");\n    const d = tryPath(root);\n    if (d) return d;\n  }\n  const envRoot = process.env.SYNAP_REPO_ROOT?.trim();\n  if (envRoot) {\n    const d = tryPath(envRoot);\n    if (d) return d;\n  }\n  const statePath = join(cwd ?? process.cwd(), \".eve\", \"state.json\");\n  if (existsSync(statePath)) {\n    try {\n      const state = JSON.parse(readFileSync(statePath, \"utf-8\"));\n      const savedRoot = state?.installed?.synap?.config?.repoRoot;\n      if (savedRoot) {\n        const d = tryPath(savedRoot);\n        if (d) return d;\n      }\n    } catch {\n    }\n  }\n  for (const candidate of CANDIDATE_PATHS) {\n    const d = tryPath(candidate);\n    if (d) return d;\n  }\n  return null;\n}\n\n// src/lib/synap-cli-delegate.ts\nfunction toPodFqdn(input) {\n  const trimmed = input.trim();\n  if (!trimmed || trimmed === \"localhost\") return trimmed;\n  if (/^\\d{1,3}(\\.\\d{1,3}){3}$/.test(trimmed)) return trimmed;\n  if (trimmed.startsWith(\"pod.\")) return trimmed;\n  return `pod.${trimmed}`;\n}\nfunction rewriteEnvDomain(envPath, fqdn) {\n  if (!existsSync2(envPath)) return false;\n  const current = readFileSync2(envPath, \"utf-8\");\n  const existing = current.match(/^DOMAIN=(.*)$/m)?.[1]?.trim();\n  if (existing === fqdn) return false;\n  const next = current.match(/^DOMAIN=.*$/m) ? current.replace(/^DOMAIN=.*$/m, `DOMAIN=${fqdn}`) : `${current}${current.endsWith(\"\\n\") ? \"\" : \"\\n\"}DOMAIN=${fqdn}\n`;\n  writeFileSync(envPath, next, { encoding: \"utf-8\", mode: 384 });\n  return true;\n}\nvar DEFAULT_TIMEOUT_MS = 30 * 60 * 1e3;\nfunction refreshGitCheckout(repoRoot) {\n  if (!existsSync2(`${repoRoot}/.git`)) return;\n  const git = (args) => spawnSync(\"git\", [\"-C\", repoRoot, ...args], { stdio: [\"ignore\", \"pipe\", \"pipe\"], encoding: \"utf-8\" });\n  git([\"fetch\", \"--quiet\"]);\n  const ff = git([\"pull\", \"--ff-only\"]);\n  if (ff.status === 0) return;\n  const ref = (git([\"rev-parse\", \"--abbrev-ref\", \"--symbolic-full-name\", \"@{u}\"]).stdout ?? \"\").toString().trim();\n  const isShallow = (git([\"rev-parse\", \"--is-shallow-repository\"]).stdout ?? \"\").toString().trim() === \"true\";\n  let hasLocalCommits = false;\n  if (!isShallow) {\n    const aheadOut = ref ? git([\"rev-list\", \"--count\", `${ref}..HEAD`]) : null;\n    hasLocalCommits = !aheadOut || aheadOut.status !== 0 || parseInt((aheadOut.stdout ?? \"\").toString().trim(), 10) > 0;\n  }\n  if (ref && !hasLocalCommits) {\n    const reset = git([\"reset\", \"--hard\", ref]);\n    if (reset.status === 0) {\n      console.warn(\n        `  Note: synap-backend at ${repoRoot} had drifted from ${ref} (couldn't fast-forward); hard-reset to upstream to keep deploy logic + kratos.yml generation current. Gitignored .env/kratos.yml/overrides and docker volumes were untouched.`\n      );\n      return;\n    }\n  }\n  const detail = (ff.stderr ?? \"\").toString().trim() || \"rejected (non-fast-forward).\";\n  console.warn(\n    `  Warning: could not refresh synap-backend at ${repoRoot} \\u2014 ${detail}\n` + (hasLocalCommits ? `  The checkout has local commits; refusing to discard them. To force it to upstream (safe \\u2014 data lives in volumes + gitignored files):\n      git -C ${repoRoot} fetch && git -C ${repoRoot} reset --hard @{u}\n` : `  Continuing with the on-disk version (may regenerate stale config). Fix: git -C ${repoRoot} fetch && git -C ${repoRoot} reset --hard @{u}\n`)\n  );\n}\nfunction resolveExplicitRepo(repoRoot) {\n  const synapScript = `${repoRoot}/synap`;\n  const deployDir = `${repoRoot}/deploy`;\n  if (!existsSync2(synapScript)) return null;\n  if (!existsSync2(`${deployDir}/docker-compose.yml`)) return null;\n  return { repoRoot, synapScript, deployDir };\n}\nfunction runSynapCli(subcommand, args = [], options = {}) {\n  const paths = options.repoRoot ? resolveExplicitRepo(options.repoRoot) : resolveSynapDelegate();\n  if (!paths) {\n    return {\n      ok: false,\n      exitCode: -1,\n      paths: null,\n      stdout: \"\",\n      stderr: options.repoRoot ? `synap CLI not found at ${options.repoRoot} \\u2014 expected ${options.repoRoot}/synap and ${options.repoRoot}/deploy/docker-compose.yml` : diagnoseMissingSynapCli()\n    };\n  }\n  if (options.refreshGit) {\n    refreshGitCheckout(paths.repoRoot);\n  }\n  if (options.domain) {\n    const fqdn = toPodFqdn(options.domain);\n    rewriteEnvDomain(join2(paths.deployDir, \".env\"), fqdn);\n  }\n  const env = {\n    ...process.env,\n    SYNAP_DEPLOY_DIR: paths.deployDir,\n    SYNAP_ASSUME_YES: \"1\",\n    SYNAP_NON_INTERACTIVE: \"1\",\n    // Eve always provides the edge proxy (eve-legs-traefik on port 80/443).\n    // Tell the synap CLI to skip its built-in Caddy so it doesn't fight\n    // Traefik for port 80 and abort updates with \"port already allocated\".\n    SYNAP_SKIP_EDGE: \"1\",\n    // Belt-and-suspenders: pin the compose project name explicitly so eve\n    // never accidentally creates `deploy_*` volumes (the cwd-basename\n    // fallback). Pre-Phase-3 synap-backend installs don't have\n    // `_resolve_compose_project_name`, so without this override they'd\n    // silently use cwd basename → orphan volumes → postgres detonation.\n    // Exception: honour an existing pin (operator chose differently).\n    COMPOSE_PROJECT_NAME: process.env.COMPOSE_PROJECT_NAME ?? \"synap-backend\"\n  };\n  if (options.domain) {\n    env.DOMAIN = toPodFqdn(options.domain);\n  }\n  const inherit = options.inherit !== false;\n  const result = spawnSync(\"bash\", [paths.synapScript, subcommand, ...args], {\n    cwd: paths.deployDir,\n    env,\n    stdio: inherit ? \"inherit\" : \"pipe\",\n    timeout: DEFAULT_TIMEOUT_MS\n  });\n  return {\n    ok: result.status === 0,\n    exitCode: result.status ?? -1,\n    paths,\n    stdout: inherit ? \"\" : result.stdout?.toString() ?? \"\",\n    stderr: inherit ? \"\" : result.stderr?.toString() ?? \"\"\n  };\n}\nfunction diagnoseMissingSynapCli() {\n  const candidate = process.env.SYNAP_REPO_ROOT?.trim() || \"/opt/synap-backend\";\n  const hasFlatCompose = existsSync2(`${candidate}/docker-compose.yml`);\n  const hasGit = existsSync2(`${candidate}/.git`);\n  const hasScript = existsSync2(`${candidate}/synap`);\n  if (hasFlatCompose && !hasGit && !hasScript) {\n    return [\n      \"synap CLI not found \\u2014 pre-cutover flat-layout install detected at \" + candidate + \".\",\n      \"\",\n      \"Eve no longer bundles its own compose file; the canonical synap-backend git checkout is required.\",\n      \"Migrate (preserves docker volumes \\u2014 your data is safe):\",\n      \"\",\n      \"  docker compose -f \" + candidate + \"/docker-compose.yml down\",\n      \"  sudo mv \" + candidate + \" \" + candidate + \".legacy\",\n      \"  sudo git clone --depth 1 https://github.com/synap-core/backend.git \" + candidate,\n      \"  sudo mv \" + candidate + \".legacy/.env \" + candidate + \"/deploy/.env\",\n      \"  sudo mv \" + candidate + \".legacy/docker-compose.override.yml \" + candidate + \"/deploy/ 2>/dev/null || true\",\n      \"  eve update synap   # synap CLI now visible; runs canonical update + reconnects eve-network\",\n      \"\",\n      \"After verifying the pod is healthy, you can `sudo rm -rf \" + candidate + \".legacy`.\"\n    ].join(\"\\n\");\n  }\n  return \"synap CLI not found at \" + candidate + \"/synap \\u2014 set SYNAP_REPO_ROOT, or run `eve install synap`.\";\n}\n\n// src/lib/pod-secrets-backup.ts\nimport { existsSync as existsSync3, readFileSync as readFileSync3, writeFileSync as writeFileSync2 } from \"fs\";\nimport { readEveSecrets, writeEveSecrets } from \"@eve/dna\";\nvar POD_SECRET_KEYS = [\n  \"POSTGRES_PASSWORD\",\n  \"JWT_SECRET\",\n  \"KRATOS_SECRETS_COOKIE\",\n  \"KRATOS_SECRETS_CIPHER\",\n  \"KRATOS_WEBHOOK_SECRET\",\n  \"MINIO_ACCESS_KEY\",\n  \"MINIO_SECRET_KEY\",\n  \"TYPESENSE_API_KEY\",\n  \"TYPESENSE_ADMIN_API_KEY\",\n  \"ORY_HYDRA_SECRETS_SYSTEM\",\n  \"SYNAP_SERVICE_ENCRYPTION_KEY\",\n  \"PROVISIONING_TOKEN\"\n];\nfunction readEnvLine(content, key) {\n  const m = content.match(new RegExp(`^${key}=(.*)$`, \"m\"));\n  return m?.[1]?.trim() || void 0;\n}\nasync function backupPodSecrets(envPath) {\n  if (!existsSync3(envPath)) return { captured: [] };\n  const content = readFileSync3(envPath, \"utf-8\");\n  const captured = [];\n  const podSecrets = {};\n  for (const key of POD_SECRET_KEYS) {\n    const value = readEnvLine(content, key);\n    if (value) {\n      podSecrets[key] = value;\n      captured.push(key);\n    }\n  }\n  if (captured.length === 0) return { captured: [] };\n  await writeEveSecrets({\n    synap: {\n      podSecrets: {\n        ...podSecrets,\n        backedUpAt: (/* @__PURE__ */ new Date()).toISOString()\n      }\n    }\n  });\n  return { captured };\n}\nasync function restorePodSecrets(envPath) {\n  if (!existsSync3(envPath)) return { restored: [], reason: \".env does not exist\" };\n  const secrets = await readEveSecrets();\n  const backup = secrets?.synap?.podSecrets;\n  if (!backup) return { restored: [], reason: \"no eve backup available\" };\n  let content = readFileSync3(envPath, \"utf-8\");\n  const restored = [];\n  for (const key of POD_SECRET_KEYS) {\n    const backupValue = backup[key];\n    if (!backupValue) continue;\n    const currentValue = readEnvLine(content, key);\n    if (currentValue) continue;\n    const lineExists = new RegExp(`^${key}=.*$`, \"m\").test(content);\n    if (lineExists) {\n      content = content.replace(new RegExp(`^${key}=.*$`, \"m\"), `${key}=${backupValue}`);\n    } else {\n      const sep = content.endsWith(\"\\n\") ? \"\" : \"\\n\";\n      content = `${content}${sep}${key}=${backupValue}\n`;\n    }\n    restored.push(key);\n  }\n  if (restored.length > 0) {\n    writeFileSync2(envPath, content, { encoding: \"utf-8\", mode: 384 });\n  }\n  return { restored };\n}\n\n// src/lib/synap-image-install.ts\nvar SYNAP_BACKEND_REPO = \"https://github.com/synap-core/backend.git\";\nfunction ensureSynapBackendCheckout(repoRoot) {\n  if (existsSync4(join3(repoRoot, \".git\"))) return;\n  mkdirSync(repoRoot, { recursive: true });\n  const isEmpty = readdirSafe(repoRoot).length === 0;\n  if (!isEmpty) {\n    throw new Error(\n      `Cannot clone synap-backend into non-empty non-git dir ${repoRoot}. Move existing files away or set SYNAP_REPO_ROOT to a different path.`\n    );\n  }\n  const result = spawnSync2(\"git\", [\"clone\", \"--depth\", \"1\", SYNAP_BACKEND_REPO, repoRoot], {\n    stdio: \"inherit\"\n  });\n  if (result.status !== 0) {\n    throw new Error(`git clone ${SYNAP_BACKEND_REPO} failed (exit ${result.status})`);\n  }\n}\nfunction readdirSafe(dir) {\n  try {\n    return readdirSync(dir);\n  } catch {\n    return [];\n  }\n}\nfunction gen(bytes = 32) {\n  return randomBytes(bytes).toString(\"hex\");\n}\nfunction getSynapBackendContainer() {\n  return findComposeContainer(\"backend\");\n}\nfunction getSynapPodAdminContainer() {\n  return findComposeContainer(\"pod-admin\");\n}\nfunction findComposeContainer(service) {\n  try {\n    const out = execSync(\n      `docker ps --filter \"label=com.docker.compose.project=synap-backend\" --filter \"label=com.docker.compose.service=${service}\" --format \"{{.Names}}\"`,\n      { encoding: \"utf-8\", stdio: [\"pipe\", \"pipe\", \"ignore\"] }\n    ).trim();\n    return out.split(\"\\n\")[0]?.trim() || null;\n  } catch {\n    return null;\n  }\n}\nfunction isBackendHealthy() {\n  const name = getSynapBackendContainer();\n  if (!name) return false;\n  try {\n    const out = execSync(\n      `docker inspect --format \"{{.State.Health.Status}}\" ${name}`,\n      { encoding: \"utf-8\", stdio: [\"pipe\", \"pipe\", \"ignore\"] }\n    ).trim();\n    return out === \"healthy\";\n  } catch {\n    return false;\n  }\n}\nfunction isCaddyOnlyFailure(stderr) {\n  if (/synap-backend-caddy.*Bind for [0-9.:]*:80\\s+failed: port is already allocated/i.test(stderr)) {\n    return true;\n  }\n  const caddy = findComposeContainer(\"caddy\");\n  if (!caddy) return false;\n  try {\n    const status = execSync(\n      `docker inspect --format \"{{.State.Status}}\" ${caddy}`,\n      { encoding: \"utf-8\", stdio: [\"pipe\", \"pipe\", \"ignore\"] }\n    ).trim();\n    return status === \"created\" || status === \"exited\";\n  } catch {\n    return false;\n  }\n}\nfunction connectToEveNetwork(containerName, alias) {\n  if (alias) {\n    try {\n      const inspect = execSync(\n        `docker inspect --format \"{{json .NetworkSettings.Networks}}\" ${containerName}`,\n        { encoding: \"utf-8\", stdio: [\"pipe\", \"pipe\", \"ignore\"] }\n      ).trim();\n      const networks = JSON.parse(inspect);\n      const eve = networks[\"eve-network\"];\n      if (eve) {\n        if ((eve.Aliases ?? []).includes(alias)) return;\n        try {\n          execSync(`docker network disconnect eve-network ${containerName}`, {\n            stdio: [\"pipe\", \"pipe\", \"ignore\"]\n          });\n        } catch {\n        }\n      }\n    } catch {\n    }\n  }\n  const aliasArg = alias ? ` --alias ${alias}` : \"\";\n  try {\n    execSync(`docker network connect${aliasArg} eve-network ${containerName}`, {\n      stdio: [\"pipe\", \"pipe\", \"ignore\"]\n    });\n  } catch {\n  }\n}\nasync function installSynapFromImage(opts = {}) {\n  const repoRoot = opts.deployDir ?? \"/opt/synap-backend\";\n  const composeDir = join3(repoRoot, \"deploy\");\n  let bareDomain = opts.domain ?? \"localhost\";\n  if (bareDomain === \"localhost\") {\n    const discovered = await discoverAndBackfillPodConfig(process.cwd());\n    if (discovered.domain) {\n      bareDomain = discovered.domain;\n    }\n  }\n  const podDomain = toPodFqdn(bareDomain);\n  const adminBootstrapMode = opts.adminBootstrapMode ?? \"token\";\n  ensureSynapBackendCheckout(repoRoot);\n  try {\n    const r = ensureSynapLoopbackOverride(composeDir);\n    if (r.outcome === \"wrote\") {\n      console.log(`  Wrote loopback compose override at ${r.path}`);\n    } else {\n      console.log(`  Kept existing ${r.path} (${r.reason ?? \"user-owned\"})`);\n    }\n  } catch (err) {\n    console.warn(`  Could not write loopback override: ${err instanceof Error ? err.message : String(err)} (continuing \\u2014 CLI will use public URL)`);\n  }\n  const envPath = join3(composeDir, \".env\");\n  const envExisted = existsSync4(envPath);\n  const existingEnv = envExisted ? readFileSync4(envPath, \"utf-8\") : \"\";\n  const existingToken = existingEnv.match(/^ADMIN_BOOTSTRAP_TOKEN=(.+)$/m)?.[1];\n  const existingEmail = existingEnv.match(/^LETSENCRYPT_EMAIL=(.+)$/m)?.[1]?.trim();\n  const email = opts.email?.trim() || existingEmail;\n  const bootstrapToken = existingToken?.trim() ?? gen(16);\n  if (envExisted) {\n    reconcileEveEnv(envPath);\n    const restored = await restorePodSecrets(envPath);\n    if (restored.restored.length > 0) {\n      console.log(`  Restored ${restored.restored.length} pod secret(s) from eve backup: ${restored.restored.join(\", \")}`);\n    }\n  }\n  const cliArgs = [\n    \"--non-interactive\",\n    \"--dir\",\n    repoRoot,\n    \"--domain\",\n    podDomain,\n    \"--admin-bootstrap-mode\",\n    adminBootstrapMode\n  ];\n  if (opts.fromSource === true) cliArgs.push(\"--from-source\");\n  else if (opts.fromSource === false) cliArgs.push(\"--from-image\");\n  if (email) cliArgs.push(\"--email\", email);\n  if (opts.adminEmail) cliArgs.push(\"--admin-email\", opts.adminEmail);\n  if (opts.adminPassword) cliArgs.push(\"--admin-password\", opts.adminPassword);\n  if (adminBootstrapMode === \"token\") cliArgs.push(\"--admin-bootstrap-token\", bootstrapToken);\n  if (opts.withOpenclaw) cliArgs.push(\"--with-openclaw\");\n  if (opts.withRsshub) cliArgs.push(\"--with-rsshub\");\n  const cliResult = runSynapCli(\"install\", cliArgs, { repoRoot, refreshGit: true });\n  if (!cliResult.ok) {\n    if (isBackendHealthy() && isCaddyOnlyFailure(cliResult.stderr)) {\n      console.warn(\n        `\n  \\u26A0 Caddy could not bind port 80 (eve-legs-traefik already owns it).\n    Backend is healthy; the data plane is up. Synap install proceeding.\n    To stop the spurious Caddy container: docker rm -f synap-backend-caddy-1\n`\n      );\n    } else {\n      throw new Error(\n        `synap install exited ${cliResult.exitCode}` + (cliResult.stderr ? `: ${cliResult.stderr}` : \"\")\n      );\n    }\n  }\n  try {\n    const captured = await backupPodSecrets(envPath);\n    if (captured.captured.length > 0) {\n      console.log(`  Backed up ${captured.captured.length} pod secret(s) to secrets.json:synap.podSecrets`);\n    }\n  } catch (err) {\n    console.warn(`  Could not back up pod secrets: ${err instanceof Error ? err.message : String(err)} (continuing \\u2014 recovery from .env loss won't be available until next install/update)`);\n  }\n  const containerName = getSynapBackendContainer();\n  if (containerName) {\n    connectToEveNetwork(containerName, \"eve-brain-synap\");\n    console.log(`  Connected ${containerName} \\u2192 eve-network (alias: eve-brain-synap)`);\n  } else {\n    console.warn(\"  Backend container not found after synap install \\u2014 skipping eve-network attach\");\n  }\n  const podAdminContainer = getSynapPodAdminContainer();\n  if (podAdminContainer) {\n    connectToEveNetwork(podAdminContainer, \"eve-brain-pod-admin\");\n    console.log(`  Connected ${podAdminContainer} \\u2192 eve-network (alias: eve-brain-pod-admin)`);\n  }\n  for (const repo of [\"ghcr.io/synap-core/backend\", \"ghcr.io/synap-core/pod-agent\"]) {\n    try {\n      const r = pruneOldImagesForRepo(repo, 3);\n      if (r.removed.length > 0) {\n        console.log(`  Pruned ${r.removed.length} old ${repo} image(s) (kept latest 3).`);\n      }\n    } catch {\n    }\n  }\n  const finalEnv = existsSync4(envPath) ? readFileSync4(envPath, \"utf-8\") : \"\";\n  const finalToken = finalEnv.match(/^ADMIN_BOOTSTRAP_TOKEN=(.+)$/m)?.[1]?.trim() ?? bootstrapToken;\n  return { bootstrapToken: finalToken, deployDir: repoRoot, containerName };\n}\nfunction reconcileEveEnv(envPath) {\n  if (!existsSync4(envPath)) return false;\n  let content = readFileSync4(envPath, \"utf-8\");\n  const legacy = content.match(/^KRATOS_CONFIG_DIR=\\.\\/config\\/kratos\\s*$/m);\n  if (!legacy) return false;\n  content = content.replace(/^KRATOS_CONFIG_DIR=\\.\\/config\\/kratos\\s*\\n?/m, \"\");\n  writeFileSync3(envPath, content, { encoding: \"utf-8\", mode: 384 });\n  console.log(\"  reconcile-env: removed legacy KRATOS_CONFIG_DIR=./config/kratos (canonical layout uses ../kratos)\");\n  return true;\n}\n\nexport {\n  resolveSynapDelegate,\n  toPodFqdn,\n  runSynapCli,\n  POD_SECRET_KEYS,\n  backupPodSecrets,\n  restorePodSecrets,\n  installSynapFromImage,\n  reconcileEveEnv\n};\n"],"mappings":";;;;;;;;;;;;AACA,SAAS,mBAAmB;AAC5B,SAAS,cAAc,aAAa,WAAW,aAAa,iBAAiB,gBAAgB,gBAAgB,qBAAqB;AAClI,SAAS,QAAQ,aAAa;AAC9B,SAAS,UAAU,aAAa,kBAAkB;AAQlD,SAAS,iBAAiB;AAC1B,SAAS,cAAc,aAAa,gBAAgB,eAAe,qBAAqB;AACxF,SAAS,QAAQ,aAAa;AAG9B,SAAS,YAAY,oBAAoB;AACzC,SAAS,MAAM,eAAe;AAuL9B,SAAS,cAAc,aAAa,gBAAgB,eAAe,iBAAiB,sBAAsB;AAtL1G,IAAI,kBAAkB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,SAAS,QAAQ,MAAM;AACrB,MAAI,CAAC,WAAW,IAAI,EAAG,QAAO;AAC9B,QAAM,SAAS,KAAK,MAAM,OAAO;AACjC,MAAI,CAAC,WAAW,MAAM,EAAG,QAAO;AAChC,QAAM,YAAY,KAAK,MAAM,QAAQ;AACrC,MAAI,CAAC,WAAW,KAAK,WAAW,oBAAoB,CAAC,EAAG,QAAO;AAC/D,SAAO,EAAE,UAAU,MAAM,aAAa,QAAQ,UAAU;AAC1D;AACA,SAAS,qBAAqB,KAAK;AACjC,QAAM,cAAc,QAAQ,IAAI,WAAW,KAAK;AAChD,MAAI,eAAe,WAAW,WAAW,GAAG;AAC1C,UAAM,OAAO,QAAQ,aAAa,IAAI;AACtC,UAAM,IAAI,QAAQ,IAAI;AACtB,QAAI,EAAG,QAAO;AAAA,EAChB;AACA,QAAM,UAAU,QAAQ,IAAI,iBAAiB,KAAK;AAClD,MAAI,SAAS;AACX,UAAM,IAAI,QAAQ,OAAO;AACzB,QAAI,EAAG,QAAO;AAAA,EAChB;AACA,QAAM,YAAY,KAAK,OAAO,QAAQ,IAAI,GAAG,QAAQ,YAAY;AACjE,MAAI,WAAW,SAAS,GAAG;AACzB,QAAI;AACF,YAAM,QAAQ,KAAK,MAAM,aAAa,WAAW,OAAO,CAAC;AACzD,YAAM,YAAY,OAAO,WAAW,OAAO,QAAQ;AACnD,UAAI,WAAW;AACb,cAAM,IAAI,QAAQ,SAAS;AAC3B,YAAI,EAAG,QAAO;AAAA,MAChB;AAAA,IACF,QAAQ;AAAA,IACR;AAAA,EACF;AACA,aAAW,aAAa,iBAAiB;AACvC,UAAM,IAAI,QAAQ,SAAS;AAC3B,QAAI,EAAG,QAAO;AAAA,EAChB;AACA,SAAO;AACT;AAGA,SAAS,UAAU,OAAO;AACxB,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,WAAW,YAAY,YAAa,QAAO;AAChD,MAAI,0BAA0B,KAAK,OAAO,EAAG,QAAO;AACpD,MAAI,QAAQ,WAAW,MAAM,EAAG,QAAO;AACvC,SAAO,OAAO,OAAO;AACvB;AACA,SAAS,iBAAiB,SAAS,MAAM;AACvC,MAAI,CAAC,YAAY,OAAO,EAAG,QAAO;AAClC,QAAM,UAAU,cAAc,SAAS,OAAO;AAC9C,QAAM,WAAW,QAAQ,MAAM,gBAAgB,IAAI,CAAC,GAAG,KAAK;AAC5D,MAAI,aAAa,KAAM,QAAO;AAC9B,QAAM,OAAO,QAAQ,MAAM,cAAc,IAAI,QAAQ,QAAQ,gBAAgB,UAAU,IAAI,EAAE,IAAI,GAAG,OAAO,GAAG,QAAQ,SAAS,IAAI,IAAI,KAAK,IAAI,UAAU,IAAI;AAAA;AAE9J,gBAAc,SAAS,MAAM,EAAE,UAAU,SAAS,MAAM,IAAI,CAAC;AAC7D,SAAO;AACT;AACA,IAAI,qBAAqB,KAAK,KAAK;AACnC,SAAS,mBAAmB,UAAU;AACpC,MAAI,CAAC,YAAY,GAAG,QAAQ,OAAO,EAAG;AACtC,QAAM,MAAM,CAAC,SAAS,UAAU,OAAO,CAAC,MAAM,UAAU,GAAG,IAAI,GAAG,EAAE,OAAO,CAAC,UAAU,QAAQ,MAAM,GAAG,UAAU,QAAQ,CAAC;AAC1H,MAAI,CAAC,SAAS,SAAS,CAAC;AACxB,QAAM,KAAK,IAAI,CAAC,QAAQ,WAAW,CAAC;AACpC,MAAI,GAAG,WAAW,EAAG;AACrB,QAAM,OAAO,IAAI,CAAC,aAAa,gBAAgB,wBAAwB,MAAM,CAAC,EAAE,UAAU,IAAI,SAAS,EAAE,KAAK;AAC9G,QAAM,aAAa,IAAI,CAAC,aAAa,yBAAyB,CAAC,EAAE,UAAU,IAAI,SAAS,EAAE,KAAK,MAAM;AACrG,MAAI,kBAAkB;AACtB,MAAI,CAAC,WAAW;AACd,UAAM,WAAW,MAAM,IAAI,CAAC,YAAY,WAAW,GAAG,GAAG,QAAQ,CAAC,IAAI;AACtE,sBAAkB,CAAC,YAAY,SAAS,WAAW,KAAK,UAAU,SAAS,UAAU,IAAI,SAAS,EAAE,KAAK,GAAG,EAAE,IAAI;AAAA,EACpH;AACA,MAAI,OAAO,CAAC,iBAAiB;AAC3B,UAAM,QAAQ,IAAI,CAAC,SAAS,UAAU,GAAG,CAAC;AAC1C,QAAI,MAAM,WAAW,GAAG;AACtB,cAAQ;AAAA,QACN,4BAA4B,QAAQ,qBAAqB,GAAG;AAAA,MAC9D;AACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,UAAU,GAAG,UAAU,IAAI,SAAS,EAAE,KAAK,KAAK;AACtD,UAAQ;AAAA,IACN,iDAAiD,QAAQ,WAAW,MAAM;AAAA,KACzE,kBAAkB;AAAA,eACR,QAAQ,oBAAoB,QAAQ;AAAA,IAC/C,oFAAoF,QAAQ,oBAAoB,QAAQ;AAAA;AAAA,EAE1H;AACF;AACA,SAAS,oBAAoB,UAAU;AACrC,QAAM,cAAc,GAAG,QAAQ;AAC/B,QAAM,YAAY,GAAG,QAAQ;AAC7B,MAAI,CAAC,YAAY,WAAW,EAAG,QAAO;AACtC,MAAI,CAAC,YAAY,GAAG,SAAS,qBAAqB,EAAG,QAAO;AAC5D,SAAO,EAAE,UAAU,aAAa,UAAU;AAC5C;AACA,SAAS,YAAY,YAAY,OAAO,CAAC,GAAG,UAAU,CAAC,GAAG;AACxD,QAAM,QAAQ,QAAQ,WAAW,oBAAoB,QAAQ,QAAQ,IAAI,qBAAqB;AAC9F,MAAI,CAAC,OAAO;AACV,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,QAAQ,QAAQ,WAAW,0BAA0B,QAAQ,QAAQ,oBAAoB,QAAQ,QAAQ,cAAc,QAAQ,QAAQ,+BAA+B,wBAAwB;AAAA,IAChM;AAAA,EACF;AACA,MAAI,QAAQ,YAAY;AACtB,uBAAmB,MAAM,QAAQ;AAAA,EACnC;AACA,MAAI,QAAQ,QAAQ;AAClB,UAAM,OAAO,UAAU,QAAQ,MAAM;AACrC,qBAAiB,MAAM,MAAM,WAAW,MAAM,GAAG,IAAI;AAAA,EACvD;AACA,QAAM,MAAM;AAAA,IACV,GAAG,QAAQ;AAAA,IACX,kBAAkB,MAAM;AAAA,IACxB,kBAAkB;AAAA,IAClB,uBAAuB;AAAA;AAAA;AAAA;AAAA,IAIvB,iBAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IAOjB,sBAAsB,QAAQ,IAAI,wBAAwB;AAAA,EAC5D;AACA,MAAI,QAAQ,QAAQ;AAClB,QAAI,SAAS,UAAU,QAAQ,MAAM;AAAA,EACvC;AACA,QAAM,UAAU,QAAQ,YAAY;AACpC,QAAM,SAAS,UAAU,QAAQ,CAAC,MAAM,aAAa,YAAY,GAAG,IAAI,GAAG;AAAA,IACzE,KAAK,MAAM;AAAA,IACX;AAAA,IACA,OAAO,UAAU,YAAY;AAAA,IAC7B,SAAS;AAAA,EACX,CAAC;AACD,SAAO;AAAA,IACL,IAAI,OAAO,WAAW;AAAA,IACtB,UAAU,OAAO,UAAU;AAAA,IAC3B;AAAA,IACA,QAAQ,UAAU,KAAK,OAAO,QAAQ,SAAS,KAAK;AAAA,IACpD,QAAQ,UAAU,KAAK,OAAO,QAAQ,SAAS,KAAK;AAAA,EACtD;AACF;AACA,SAAS,0BAA0B;AACjC,QAAM,YAAY,QAAQ,IAAI,iBAAiB,KAAK,KAAK;AACzD,QAAM,iBAAiB,YAAY,GAAG,SAAS,qBAAqB;AACpE,QAAM,SAAS,YAAY,GAAG,SAAS,OAAO;AAC9C,QAAM,YAAY,YAAY,GAAG,SAAS,QAAQ;AAClD,MAAI,kBAAkB,CAAC,UAAU,CAAC,WAAW;AAC3C,WAAO;AAAA,MACL,4EAA4E,YAAY;AAAA,MACxF;AAAA,MACA;AAAA,MACA;AAAA,MACA;AAAA,MACA,yBAAyB,YAAY;AAAA,MACrC,eAAe,YAAY,MAAM,YAAY;AAAA,MAC7C,0EAA0E;AAAA,MAC1E,eAAe,YAAY,kBAAkB,YAAY;AAAA,MACzD,eAAe,YAAY,yCAAyC,YAAY;AAAA,MAChF;AAAA,MACA;AAAA,MACA,8DAA8D,YAAY;AAAA,IAC5E,EAAE,KAAK,IAAI;AAAA,EACb;AACA,SAAO,4BAA4B,YAAY;AACjD;AAKA,IAAI,kBAAkB;AAAA,EACpB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AACA,SAAS,YAAY,SAAS,KAAK;AACjC,QAAM,IAAI,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AACxD,SAAO,IAAI,CAAC,GAAG,KAAK,KAAK;AAC3B;AACA,eAAe,iBAAiB,SAAS;AACvC,MAAI,CAAC,YAAY,OAAO,EAAG,QAAO,EAAE,UAAU,CAAC,EAAE;AACjD,QAAM,UAAU,cAAc,SAAS,OAAO;AAC9C,QAAM,WAAW,CAAC;AAClB,QAAM,aAAa,CAAC;AACpB,aAAW,OAAO,iBAAiB;AACjC,UAAM,QAAQ,YAAY,SAAS,GAAG;AACtC,QAAI,OAAO;AACT,iBAAW,GAAG,IAAI;AAClB,eAAS,KAAK,GAAG;AAAA,IACnB;AAAA,EACF;AACA,MAAI,SAAS,WAAW,EAAG,QAAO,EAAE,UAAU,CAAC,EAAE;AACjD,QAAM,gBAAgB;AAAA,IACpB,OAAO;AAAA,MACL,YAAY;AAAA,QACV,GAAG;AAAA,QACH,aAA6B,oBAAI,KAAK,GAAG,YAAY;AAAA,MACvD;AAAA,IACF;AAAA,EACF,CAAC;AACD,SAAO,EAAE,SAAS;AACpB;AACA,eAAe,kBAAkB,SAAS;AACxC,MAAI,CAAC,YAAY,OAAO,EAAG,QAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,sBAAsB;AAChF,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,SAAS,SAAS,OAAO;AAC/B,MAAI,CAAC,OAAQ,QAAO,EAAE,UAAU,CAAC,GAAG,QAAQ,0BAA0B;AACtE,MAAI,UAAU,cAAc,SAAS,OAAO;AAC5C,QAAM,WAAW,CAAC;AAClB,aAAW,OAAO,iBAAiB;AACjC,UAAM,cAAc,OAAO,GAAG;AAC9B,QAAI,CAAC,YAAa;AAClB,UAAM,eAAe,YAAY,SAAS,GAAG;AAC7C,QAAI,aAAc;AAClB,UAAM,aAAa,IAAI,OAAO,IAAI,GAAG,QAAQ,GAAG,EAAE,KAAK,OAAO;AAC9D,QAAI,YAAY;AACd,gBAAU,QAAQ,QAAQ,IAAI,OAAO,IAAI,GAAG,QAAQ,GAAG,GAAG,GAAG,GAAG,IAAI,WAAW,EAAE;AAAA,IACnF,OAAO;AACL,YAAM,MAAM,QAAQ,SAAS,IAAI,IAAI,KAAK;AAC1C,gBAAU,GAAG,OAAO,GAAG,GAAG,GAAG,GAAG,IAAI,WAAW;AAAA;AAAA,IAEjD;AACA,aAAS,KAAK,GAAG;AAAA,EACnB;AACA,MAAI,SAAS,SAAS,GAAG;AACvB,mBAAe,SAAS,SAAS,EAAE,UAAU,SAAS,MAAM,IAAI,CAAC;AAAA,EACnE;AACA,SAAO,EAAE,SAAS;AACpB;AAGA,IAAI,qBAAqB;AACzB,SAAS,2BAA2B,UAAU;AAC5C,MAAI,YAAY,MAAM,UAAU,MAAM,CAAC,EAAG;AAC1C,YAAU,UAAU,EAAE,WAAW,KAAK,CAAC;AACvC,QAAM,UAAU,YAAY,QAAQ,EAAE,WAAW;AACjD,MAAI,CAAC,SAAS;AACZ,UAAM,IAAI;AAAA,MACR,yDAAyD,QAAQ;AAAA,IACnE;AAAA,EACF;AACA,QAAM,SAAS,WAAW,OAAO,CAAC,SAAS,WAAW,KAAK,oBAAoB,QAAQ,GAAG;AAAA,IACxF,OAAO;AAAA,EACT,CAAC;AACD,MAAI,OAAO,WAAW,GAAG;AACvB,UAAM,IAAI,MAAM,aAAa,kBAAkB,iBAAiB,OAAO,MAAM,GAAG;AAAA,EAClF;AACF;AACA,SAAS,YAAY,KAAK;AACxB,MAAI;AACF,WAAO,YAAY,GAAG;AAAA,EACxB,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AACA,SAAS,IAAI,QAAQ,IAAI;AACvB,SAAO,YAAY,KAAK,EAAE,SAAS,KAAK;AAC1C;AACA,SAAS,2BAA2B;AAClC,SAAO,qBAAqB,SAAS;AACvC;AACA,SAAS,4BAA4B;AACnC,SAAO,qBAAqB,WAAW;AACzC;AACA,SAAS,qBAAqB,SAAS;AACrC,MAAI;AACF,UAAM,MAAM;AAAA,MACV,kHAAkH,OAAO;AAAA,MACzH,EAAE,UAAU,SAAS,OAAO,CAAC,QAAQ,QAAQ,QAAQ,EAAE;AAAA,IACzD,EAAE,KAAK;AACP,WAAO,IAAI,MAAM,IAAI,EAAE,CAAC,GAAG,KAAK,KAAK;AAAA,EACvC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AACA,SAAS,mBAAmB;AAC1B,QAAM,OAAO,yBAAyB;AACtC,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACF,UAAM,MAAM;AAAA,MACV,sDAAsD,IAAI;AAAA,MAC1D,EAAE,UAAU,SAAS,OAAO,CAAC,QAAQ,QAAQ,QAAQ,EAAE;AAAA,IACzD,EAAE,KAAK;AACP,WAAO,QAAQ;AAAA,EACjB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AACA,SAAS,mBAAmB,QAAQ;AAClC,MAAI,iFAAiF,KAAK,MAAM,GAAG;AACjG,WAAO;AAAA,EACT;AACA,QAAM,QAAQ,qBAAqB,OAAO;AAC1C,MAAI,CAAC,MAAO,QAAO;AACnB,MAAI;AACF,UAAM,SAAS;AAAA,MACb,+CAA+C,KAAK;AAAA,MACpD,EAAE,UAAU,SAAS,OAAO,CAAC,QAAQ,QAAQ,QAAQ,EAAE;AAAA,IACzD,EAAE,KAAK;AACP,WAAO,WAAW,aAAa,WAAW;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AACA,SAAS,oBAAoB,eAAe,OAAO;AACjD,MAAI,OAAO;AACT,QAAI;AACF,YAAM,UAAU;AAAA,QACd,gEAAgE,aAAa;AAAA,QAC7E,EAAE,UAAU,SAAS,OAAO,CAAC,QAAQ,QAAQ,QAAQ,EAAE;AAAA,MACzD,EAAE,KAAK;AACP,YAAM,WAAW,KAAK,MAAM,OAAO;AACnC,YAAM,MAAM,SAAS,aAAa;AAClC,UAAI,KAAK;AACP,aAAK,IAAI,WAAW,CAAC,GAAG,SAAS,KAAK,EAAG;AACzC,YAAI;AACF,mBAAS,yCAAyC,aAAa,IAAI;AAAA,YACjE,OAAO,CAAC,QAAQ,QAAQ,QAAQ;AAAA,UAClC,CAAC;AAAA,QACH,QAAQ;AAAA,QACR;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IACR;AAAA,EACF;AACA,QAAM,WAAW,QAAQ,YAAY,KAAK,KAAK;AAC/C,MAAI;AACF,aAAS,yBAAyB,QAAQ,gBAAgB,aAAa,IAAI;AAAA,MACzE,OAAO,CAAC,QAAQ,QAAQ,QAAQ;AAAA,IAClC,CAAC;AAAA,EACH,QAAQ;AAAA,EACR;AACF;AACA,eAAe,sBAAsB,OAAO,CAAC,GAAG;AAC9C,QAAM,WAAW,KAAK,aAAa;AACnC,QAAM,aAAa,MAAM,UAAU,QAAQ;AAC3C,MAAI,aAAa,KAAK,UAAU;AAChC,MAAI,eAAe,aAAa;AAC9B,UAAM,aAAa,MAAM,6BAA6B,QAAQ,IAAI,CAAC;AACnE,QAAI,WAAW,QAAQ;AACrB,mBAAa,WAAW;AAAA,IAC1B;AAAA,EACF;AACA,QAAM,YAAY,UAAU,UAAU;AACtC,QAAM,qBAAqB,KAAK,sBAAsB;AACtD,6BAA2B,QAAQ;AACnC,MAAI;AACF,UAAM,IAAI,4BAA4B,UAAU;AAChD,QAAI,EAAE,YAAY,SAAS;AACzB,cAAQ,IAAI,wCAAwC,EAAE,IAAI,EAAE;AAAA,IAC9D,OAAO;AACL,cAAQ,IAAI,mBAAmB,EAAE,IAAI,KAAK,EAAE,UAAU,YAAY,GAAG;AAAA,IACvE;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,KAAK,wCAAwC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,8CAA8C;AAAA,EACrJ;AACA,QAAM,UAAU,MAAM,YAAY,MAAM;AACxC,QAAM,aAAa,YAAY,OAAO;AACtC,QAAM,cAAc,aAAa,cAAc,SAAS,OAAO,IAAI;AACnE,QAAM,gBAAgB,YAAY,MAAM,+BAA+B,IAAI,CAAC;AAC5E,QAAM,gBAAgB,YAAY,MAAM,2BAA2B,IAAI,CAAC,GAAG,KAAK;AAChF,QAAM,QAAQ,KAAK,OAAO,KAAK,KAAK;AACpC,QAAM,iBAAiB,eAAe,KAAK,KAAK,IAAI,EAAE;AACtD,MAAI,YAAY;AACd,oBAAgB,OAAO;AACvB,UAAM,WAAW,MAAM,kBAAkB,OAAO;AAChD,QAAI,SAAS,SAAS,SAAS,GAAG;AAChC,cAAQ,IAAI,cAAc,SAAS,SAAS,MAAM,mCAAmC,SAAS,SAAS,KAAK,IAAI,CAAC,EAAE;AAAA,IACrH;AAAA,EACF;AACA,QAAM,UAAU;AAAA,IACd;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF;AACA,MAAI,KAAK,eAAe,KAAM,SAAQ,KAAK,eAAe;AAAA,WACjD,KAAK,eAAe,MAAO,SAAQ,KAAK,cAAc;AAC/D,MAAI,MAAO,SAAQ,KAAK,WAAW,KAAK;AACxC,MAAI,KAAK,WAAY,SAAQ,KAAK,iBAAiB,KAAK,UAAU;AAClE,MAAI,KAAK,cAAe,SAAQ,KAAK,oBAAoB,KAAK,aAAa;AAC3E,MAAI,uBAAuB,QAAS,SAAQ,KAAK,2BAA2B,cAAc;AAC1F,MAAI,KAAK,aAAc,SAAQ,KAAK,iBAAiB;AACrD,MAAI,KAAK,WAAY,SAAQ,KAAK,eAAe;AACjD,QAAM,YAAY,YAAY,WAAW,SAAS,EAAE,UAAU,YAAY,KAAK,CAAC;AAChF,MAAI,CAAC,UAAU,IAAI;AACjB,QAAI,iBAAiB,KAAK,mBAAmB,UAAU,MAAM,GAAG;AAC9D,cAAQ;AAAA,QACN;AAAA;AAAA;AAAA;AAAA;AAAA,MAKF;AAAA,IACF,OAAO;AACL,YAAM,IAAI;AAAA,QACR,wBAAwB,UAAU,QAAQ,MAAM,UAAU,SAAS,KAAK,UAAU,MAAM,KAAK;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACA,MAAI;AACF,UAAM,WAAW,MAAM,iBAAiB,OAAO;AAC/C,QAAI,SAAS,SAAS,SAAS,GAAG;AAChC,cAAQ,IAAI,eAAe,SAAS,SAAS,MAAM,iDAAiD;AAAA,IACtG;AAAA,EACF,SAAS,KAAK;AACZ,YAAQ,KAAK,oCAAoC,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,2FAA2F;AAAA,EAC9L;AACA,QAAM,gBAAgB,yBAAyB;AAC/C,MAAI,eAAe;AACjB,wBAAoB,eAAe,iBAAiB;AACpD,YAAQ,IAAI,eAAe,aAAa,8CAA8C;AAAA,EACxF,OAAO;AACL,YAAQ,KAAK,sFAAsF;AAAA,EACrG;AACA,QAAM,oBAAoB,0BAA0B;AACpD,MAAI,mBAAmB;AACrB,wBAAoB,mBAAmB,qBAAqB;AAC5D,YAAQ,IAAI,eAAe,iBAAiB,kDAAkD;AAAA,EAChG;AACA,aAAW,QAAQ,CAAC,8BAA8B,8BAA8B,GAAG;AACjF,QAAI;AACF,YAAM,IAAI,sBAAsB,MAAM,CAAC;AACvC,UAAI,EAAE,QAAQ,SAAS,GAAG;AACxB,gBAAQ,IAAI,YAAY,EAAE,QAAQ,MAAM,QAAQ,IAAI,4BAA4B;AAAA,MAClF;AAAA,IACF,QAAQ;AAAA,IACR;AAAA,EACF;AACA,QAAM,WAAW,YAAY,OAAO,IAAI,cAAc,SAAS,OAAO,IAAI;AAC1E,QAAM,aAAa,SAAS,MAAM,+BAA+B,IAAI,CAAC,GAAG,KAAK,KAAK;AACnF,SAAO,EAAE,gBAAgB,YAAY,WAAW,UAAU,cAAc;AAC1E;AACA,SAAS,gBAAgB,SAAS;AAChC,MAAI,CAAC,YAAY,OAAO,EAAG,QAAO;AAClC,MAAI,UAAU,cAAc,SAAS,OAAO;AAC5C,QAAM,SAAS,QAAQ,MAAM,4CAA4C;AACzE,MAAI,CAAC,OAAQ,QAAO;AACpB,YAAU,QAAQ,QAAQ,gDAAgD,EAAE;AAC5E,iBAAe,SAAS,SAAS,EAAE,UAAU,SAAS,MAAM,IAAI,CAAC;AACjE,UAAQ,IAAI,qGAAqG;AACjH,SAAO;AACT;","names":[]}