@wrongstack/cli 0.295.1 → 0.296.3

package/dist/chunk-YWUPHRGB.js

@@ -0,0 +1,346 @@
+
+// src/config-history.ts
+import { randomUUID } from "node:crypto";
+import * as fs from "node:fs/promises";
+import os from "node:os";
+import * as path from "node:path";
+import { atomicWrite, resolveWstackPaths, writeErr } from "@wrongstack/core/utils";
+import { ERROR_CODES, FsError } from "@wrongstack/core/types";
+import { isSecretField } from "@wrongstack/core/security";
+import { toErrorMessage } from "@wrongstack/core/utils";
+var defaultUidFn = () => os.userInfo().uid;
+async function getFileUid(filePath) {
+  try {
+    const stat2 = await fs.stat(filePath);
+    return stat2.uid;
+  } catch {
+    return void 0;
+  }
+}
+async function checkConfigOwnership(homeFn, uidFn = defaultUidFn, targetConfigPath) {
+  if (os.platform() === "win32") return true;
+  const cfg = configPath(homeFn, targetConfigPath);
+  const fileUid = await getFileUid(cfg);
+  if (fileUid === void 0) return true;
+  const callerUid = uidFn();
+  if (callerUid === void 0) return true;
+  return fileUid === callerUid;
+}
+var PROTECTED_BASENAMES = /* @__PURE__ */ new Set(["config.json", ".key", "index.json"]);
+var MAX_CONFIG_BACKUPS = 10;
+var MAX_CONFIG_HISTORY_ENTRIES = 50;
+function assertSafeToDelete(filename, parentDir) {
+  if (PROTECTED_BASENAMES.has(filename)) {
+    throw new FsError({
+      message: `Refusing to delete protected file: ${filename}`,
+      code: ERROR_CODES.FS_DELETE_FAILED,
+      path: path.join(parentDir, filename),
+      context: { reason: "protected_basename" }
+    });
+  }
+  if (filename !== path.basename(filename)) {
+    throw new FsError({
+      message: `Refusing to delete path with traversal: ${filename}`,
+      code: ERROR_CODES.FS_DELETE_FAILED,
+      path: filename,
+      context: { reason: "path_traversal" }
+    });
+  }
+  if (!filename.startsWith("config.json.") || !filename.endsWith(".bak")) {
+    throw new FsError({
+      message: `Refusing to delete unknown file: ${filename}`,
+      code: ERROR_CODES.FS_DELETE_FAILED,
+      path: path.join(parentDir, filename),
+      context: { reason: "unknown_file_pattern" }
+    });
+  }
+  const resolvedParent = path.resolve(parentDir);
+  const parentOfProfile = path.dirname(resolvedParent);
+  const isGlobalRoot = path.basename(resolvedParent) === ".wrongstack";
+  const isProfileDir = path.basename(parentOfProfile) === "profiles" && path.basename(path.dirname(parentOfProfile)) === ".wrongstack";
+  if (!isGlobalRoot && !isProfileDir) {
+    throw new FsError({
+      message: `Unexpected parent directory for bak prune: ${resolvedParent}`,
+      code: ERROR_CODES.FS_DELETE_FAILED,
+      path: resolvedParent,
+      context: { reason: "invalid_parent" }
+    });
+  }
+}
+async function safeDelete(filePath) {
+  const dir = path.dirname(filePath);
+  const filename = path.basename(filePath);
+  try {
+    assertSafeToDelete(filename, dir);
+    await fs.unlink(filePath);
+  } catch (err) {
+    if (err instanceof Error && err.message.startsWith("Refusing")) {
+      writeErr(`[config-history] SAFETY: ${err.message}
+`);
+    }
+  }
+}
+function maskConfigSecrets(cfg) {
+  if (typeof cfg !== "object" || cfg === null) return {};
+  const out = {};
+  for (const [k, v] of Object.entries(cfg)) {
+    if (isSecretField(k)) {
+      out[k] = "[REDACTED]";
+    } else if (typeof v === "object" && v !== null && !Array.isArray(v)) {
+      out[k] = maskConfigSecrets(v);
+    } else {
+      out[k] = v;
+    }
+  }
+  return out;
+}
+function diffSummary(oldCfg, newCfg) {
+  const changes = [];
+  const allKeys = /* @__PURE__ */ new Set([...Object.keys(oldCfg), ...Object.keys(newCfg)]);
+  for (const k of allKeys) {
+    const o = JSON.stringify(oldCfg[k]);
+    const n = JSON.stringify(newCfg[k]);
+    if (o !== n) {
+      if (isSecretField(k)) {
+        changes.push(`${k}: [CHANGED]`);
+      } else if (typeof newCfg[k] !== "object") {
+        changes.push(`${k}: ${oldCfg[k] ?? "(unset)"} \u2192 ${newCfg[k]}`);
+      } else {
+        changes.push(`${k}: [CHANGED]`);
+      }
+    }
+  }
+  return changes.length > 0 ? changes.slice(0, 5).join(", ") : "no changes";
+}
+var defaultHomeDir = () => os.homedir();
+function activeProfileConfigPath(homeFn) {
+  const paths = homeFn === defaultHomeDir ? resolveWstackPaths({ projectRoot: process.cwd() }) : resolveWstackPaths({ projectRoot: process.cwd(), userHome: homeFn() });
+  return paths.profileConfig(paths.profileName);
+}
+function historyDir(homeFn = defaultHomeDir, targetConfigPath) {
+  return path.join(path.dirname(configPath(homeFn, targetConfigPath)), "config.history", "entries");
+}
+function historyIndexPath(homeFn = defaultHomeDir, targetConfigPath) {
+  return path.join(path.dirname(configPath(homeFn, targetConfigPath)), "config.history", "index.json");
+}
+function configPath(homeFn = defaultHomeDir, targetConfigPath) {
+  return targetConfigPath ?? activeProfileConfigPath(homeFn);
+}
+function backupLastPath(homeFn = defaultHomeDir, targetConfigPath) {
+  return `${configPath(homeFn, targetConfigPath)}.last`;
+}
+function entryId(ts) {
+  return `${ts.replace(/[:.]/g, "-")}-${randomUUID().slice(0, 8)}`;
+}
+async function ensureHistoryDir(homeFn = defaultHomeDir, targetConfigPath) {
+  try {
+    await fs.mkdir(historyDir(homeFn, targetConfigPath), { recursive: true });
+  } catch (err) {
+    throw new FsError({
+      message: toErrorMessage(err),
+      code: ERROR_CODES.FS_MKDIR_FAILED,
+      path: historyDir(homeFn, targetConfigPath),
+      cause: err
+    });
+  }
+}
+async function readIndex(homeFn = defaultHomeDir, targetConfigPath) {
+  try {
+    const raw = await fs.readFile(historyIndexPath(homeFn, targetConfigPath), "utf8");
+    return JSON.parse(raw);
+  } catch {
+    return { version: 1, entries: [] };
+  }
+}
+async function writeIndex(idx, homeFn = defaultHomeDir, targetConfigPath) {
+  await ensureHistoryDir(homeFn, targetConfigPath);
+  try {
+    await atomicWrite(historyIndexPath(homeFn, targetConfigPath), JSON.stringify(idx, null, 2));
+  } catch (err) {
+    throw new FsError({
+      message: toErrorMessage(err),
+      code: ERROR_CODES.FS_ATOMIC_WRITE_FAILED,
+      path: historyIndexPath(homeFn, targetConfigPath),
+      cause: err
+    });
+  }
+}
+async function pruneHistoryEntries(idx, homeFn = defaultHomeDir, targetConfigPath) {
+  const removed = idx.entries.splice(MAX_CONFIG_HISTORY_ENTRIES);
+  const keep = new Set(idx.entries.map((entry) => `${entry.id}.json`));
+  const dir = historyDir(homeFn, targetConfigPath);
+  for (const entry of removed) {
+    try {
+      await fs.unlink(path.join(dir, `${entry.id}.json`));
+    } catch {
+    }
+  }
+  try {
+    const files = await fs.readdir(dir);
+    await Promise.all(
+      files.filter((file) => file.endsWith(".json") && !keep.has(file)).map(async (file) => {
+        try {
+          await fs.unlink(path.join(dir, file));
+        } catch {
+        }
+      })
+    );
+  } catch {
+  }
+}
+async function backupCurrent(homeFn = defaultHomeDir, targetConfigPath) {
+  const cfg = configPath(homeFn, targetConfigPath);
+  const last = backupLastPath(homeFn, targetConfigPath);
+  const ts = Date.now();
+  let content;
+  try {
+    content = await fs.readFile(cfg, "utf8");
+  } catch {
+  }
+  if (content !== void 0) {
+    try {
+      await atomicWrite(last, content);
+    } catch (err) {
+      writeErr(
+        `[config-history] .last backup failed: ${toErrorMessage(err)}`
+      );
+    }
+  }
+  if (content !== void 0) {
+    try {
+      const bakPath = `${cfg}.${ts}.bak`;
+      await atomicWrite(bakPath, content);
+    } catch (err) {
+      writeErr(
+        `[config-history] timestamped backup failed: ${toErrorMessage(err)}`
+      );
+    }
+  }
+  try {
+    const dir = path.dirname(cfg);
+    const files = await fs.readdir(dir);
+    const baks = files.filter((f) => f.startsWith("config.json.") && f.endsWith(".bak")).sort().reverse();
+    for (const f of baks.slice(MAX_CONFIG_BACKUPS)) {
+      await safeDelete(path.join(dir, f));
+    }
+  } catch (err) {
+    writeErr(
+      `[config-history] backup prune failed: ${toErrorMessage(err)}`
+    );
+  }
+}
+async function appendHistory(oldCfg, newCfg, description, homeFn = defaultHomeDir, targetConfigPath) {
+  const timestamp = (/* @__PURE__ */ new Date()).toISOString();
+  const id = entryId(timestamp);
+  await ensureHistoryDir(homeFn, targetConfigPath);
+  const entry = {
+    id,
+    timestamp,
+    description,
+    snapshotMasked: maskConfigSecrets(newCfg),
+    diffSummary: diffSummary(oldCfg, newCfg)
+  };
+  try {
+    await fs.writeFile(
+      path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
+      JSON.stringify(entry, null, 2),
+      "utf8"
+    );
+  } catch (err) {
+    throw new FsError({
+      message: toErrorMessage(err),
+      code: ERROR_CODES.FS_WRITE_FAILED,
+      path: path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
+      cause: err
+    });
+  }
+  const idx = await readIndex(homeFn, targetConfigPath);
+  idx.entries.unshift({ id, timestamp, description });
+  await pruneHistoryEntries(idx, homeFn, targetConfigPath);
+  await writeIndex(idx, homeFn, targetConfigPath);
+  return id;
+}
+async function listHistory(homeFn = defaultHomeDir, targetConfigPath) {
+  const idx = await readIndex(homeFn, targetConfigPath);
+  return idx.entries;
+}
+async function getHistoryEntry(id, homeFn = defaultHomeDir, targetConfigPath) {
+  try {
+    const raw = await fs.readFile(
+      path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),
+      "utf8"
+    );
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+async function restoreFromHistory(id, homeFn = defaultHomeDir, targetConfigPath) {
+  const entry = await getHistoryEntry(id, homeFn, targetConfigPath);
+  if (!entry) return { ok: false, backupId: null, error: "History entry not found" };
+  if (!await checkConfigOwnership(homeFn, defaultUidFn, targetConfigPath)) {
+    return {
+      ok: false,
+      backupId: null,
+      error: "Operation denied: config file is not owned by current user"
+    };
+  }
+  await backupCurrent(homeFn, targetConfigPath);
+  let oldCfg = {};
+  try {
+    const raw = await fs.readFile(configPath(homeFn, targetConfigPath), "utf8");
+    oldCfg = JSON.parse(raw);
+  } catch {
+  }
+  try {
+    await atomicWrite(configPath(homeFn, targetConfigPath), JSON.stringify(entry.snapshotMasked, null, 2));
+  } catch (err) {
+    return { ok: false, backupId: null, error: String(err) };
+  }
+  const backupId = await appendHistory(
+    oldCfg,
+    entry.snapshotMasked,
+    `Restored from history ${id}`,
+    homeFn,
+    targetConfigPath
+  );
+  return { ok: true, backupId };
+}
+async function restoreLast(homeFn = defaultHomeDir, targetConfigPath) {
+  const last = backupLastPath(homeFn, targetConfigPath);
+  const cfg = configPath(homeFn, targetConfigPath);
+  let oldCfg = {};
+  try {
+    const raw = await fs.readFile(cfg, "utf8");
+    oldCfg = JSON.parse(raw);
+  } catch {
+  }
+  let lastCfg = {};
+  try {
+    const raw = await fs.readFile(last, "utf8");
+    lastCfg = JSON.parse(raw);
+  } catch {
+    return { ok: false, error: "No prior backup found" };
+  }
+  if (!await checkConfigOwnership(homeFn, defaultUidFn, targetConfigPath)) {
+    return { ok: false, error: "Operation denied: config file is not owned by current user" };
+  }
+  await backupCurrent(homeFn, targetConfigPath);
+  try {
+    await atomicWrite(cfg, JSON.stringify(lastCfg, null, 2));
+  } catch (err) {
+    return { ok: false, error: String(err) };
+  }
+  await appendHistory(oldCfg, lastCfg, "Restored from config.json.last", homeFn, targetConfigPath);
+  return { ok: true };
+}
+
+export {
+  backupCurrent,
+  appendHistory,
+  listHistory,
+  getHistoryEntry,
+  restoreFromHistory,
+  restoreLast
+};
+//# sourceMappingURL=chunk-YWUPHRGB.js.map

package/dist/chunk-YWUPHRGB.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../src/config-history.ts"],
+  "sourcesContent": ["import { randomUUID } from 'node:crypto';\nimport * as fs from 'node:fs/promises';\nimport os from 'node:os';\nimport * as path from 'node:path';\nimport { atomicWrite, resolveWstackPaths, writeErr } from '@wrongstack/core/utils';\nimport { ERROR_CODES, FsError } from '@wrongstack/core/types';\nimport { isSecretField } from '@wrongstack/core/security';\nimport { toErrorMessage } from '@wrongstack/core/utils';\n\n// \u2500\u2500 UID ownership \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\ntype UidFn = () => string | number | undefined;\nconst defaultUidFn: UidFn = () => os.userInfo().uid;\n\nasync function getFileUid(filePath: string): Promise<string | number | undefined> {\n  try {\n    const stat = await fs.stat(filePath);\n    return stat.uid;\n  } catch {\n    return undefined;\n  }\n}\n\n/**\n * Verify the calling process owns config.json before allowing a write operation.\n * Guards against one user on a shared multi-user system overwriting another's config.\n *\n * On Windows, .uid is always undefined on the UserInfo object, and the NT ACL\n * model already restricts writes \u2014 so we skip the check on win32.\n * On Unix, we compare the process euid against the file's uid.\n * If config.json doesn't exist yet, we allow the write (first-time setup).\n */\nasync function checkConfigOwnership(\n  homeFn: HomeDirFn,\n  uidFn: UidFn = defaultUidFn,\n  targetConfigPath?: string,\n): Promise<boolean> {\n  if (os.platform() === 'win32') return true; // ACLs handle this on Windows\n\n  const cfg = configPath(homeFn, targetConfigPath);\n  const fileUid = await getFileUid(cfg);\n  if (fileUid === undefined) return true; // file doesn't exist yet \u2014 allow\n\n  const callerUid = uidFn();\n  if (callerUid === undefined) return true; // can't determine \u2014 allow, don't block\n\n  return fileUid === callerUid;\n}\n\n// \u2500\u2500 Protected files/directories \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n// These are NEVER touched by any operation in this module.\n// Guards against bugs (glob patterns, typos, race conditions)\n// accidentally deleting critical user data.\nconst PROTECTED_BASENAMES = new Set(['config.json', '.key', 'index.json']);\nconst MAX_CONFIG_BACKUPS = 10;\nexport const MAX_CONFIG_HISTORY_ENTRIES = 50;\n\n// Top-level directories that should never be deleted even if a prune\n// pattern accidentally widens. These are absolute directory names\n// relative to the .wrongstack root.\n\n/**\n * Guard: throw if `filename` is a protected file or lives inside a protected\n * directory. Used before any unlink / rm call to make accidentally deleting\n * critical files impossible.\n */\nfunction assertSafeToDelete(filename: string, parentDir: string): void {\n  // 1. Exact-match protected files\n  if (PROTECTED_BASENAMES.has(filename)) {\n    throw new FsError({\n      message: `Refusing to delete protected file: ${filename}`,\n      code: ERROR_CODES.FS_DELETE_FAILED,\n      path: path.join(parentDir, filename),\n      context: { reason: 'protected_basename' },\n    });\n  }\n  // 2. No path traversal\n  if (filename !== path.basename(filename)) {\n    throw new FsError({\n      message: `Refusing to delete path with traversal: ${filename}`,\n      code: ERROR_CODES.FS_DELETE_FAILED,\n      path: filename,\n      context: { reason: 'path_traversal' },\n    });\n  }\n  // 3. Validate it's a timestamped config backup (config.json.{ts}.bak)\n  //    before we ever consider deleting it.\n  if (!filename.startsWith('config.json.') || !filename.endsWith('.bak')) {\n    // Unknown files \u2014 be conservative, refuse\n    throw new FsError({\n      message: `Refusing to delete unknown file: ${filename}`,\n      code: ERROR_CODES.FS_DELETE_FAILED,\n      path: path.join(parentDir, filename),\n      context: { reason: 'unknown_file_pattern' },\n    });\n  }\n  // 4. Check parent is the .wrongstack root and the target is not a dir\n  const resolvedParent = path.resolve(parentDir);\n  const parentOfProfile = path.dirname(resolvedParent);\n  const isGlobalRoot = path.basename(resolvedParent) === '.wrongstack';\n  const isProfileDir =\n    path.basename(parentOfProfile) === 'profiles' &&\n    path.basename(path.dirname(parentOfProfile)) === '.wrongstack';\n  if (!isGlobalRoot && !isProfileDir) {\n    throw new FsError({\n      message: `Unexpected parent directory for bak prune: ${resolvedParent}`,\n      code: ERROR_CODES.FS_DELETE_FAILED,\n      path: resolvedParent,\n      context: { reason: 'invalid_parent' },\n    });\n  }\n}\n\n/**\n * Safely delete a file only if it passes safety checks.\n * Never throws \u2014 errors are swallowed (best-effort).\n */\nasync function safeDelete(filePath: string): Promise<void> {\n  const dir = path.dirname(filePath);\n  const filename = path.basename(filePath);\n  try {\n    assertSafeToDelete(filename, dir);\n    await fs.unlink(filePath);\n  } catch (err) {\n    // Log but don't crash \u2014 safety check violations are logged for debugging\n    if (err instanceof Error && err.message.startsWith('Refusing')) {\n      writeErr(`[config-history] SAFETY: ${err.message}\\n`);\n    }\n    // Best-effort \u2014 ignore other errors (file doesn't exist, etc.)\n  }\n}\n\nexport interface HistoryEntry {\n  id: string;\n  timestamp: string;\n  description: string;\n  snapshotMasked: Record<string, unknown>;\n  diffSummary: string;\n}\n\ninterface HistoryIndex {\n  version: 1;\n  entries: Array<{ id: string; timestamp: string; description: string }>;\n}\n\nfunction maskConfigSecrets(cfg: Record<string, unknown>): Record<string, unknown> {\n  if (typeof cfg !== 'object' || cfg === null) return {};\n  const out: Record<string, unknown> = {};\n  for (const [k, v] of Object.entries(cfg)) {\n    if (isSecretField(k)) {\n      out[k] = '[REDACTED]';\n    } else if (typeof v === 'object' && v !== null && !Array.isArray(v)) {\n      out[k] = maskConfigSecrets(v as Record<string, unknown>);\n    } else {\n      out[k] = v;\n    }\n  }\n  return out;\n}\n\nfunction diffSummary(oldCfg: Record<string, unknown>, newCfg: Record<string, unknown>): string {\n  const changes: string[] = [];\n  const allKeys = new Set([...Object.keys(oldCfg), ...Object.keys(newCfg)]);\n  for (const k of allKeys) {\n    const o = JSON.stringify(oldCfg[k]);\n    const n = JSON.stringify(newCfg[k]);\n    if (o !== n) {\n      if (isSecretField(k)) {\n        changes.push(`${k}: [CHANGED]`);\n      } else if (typeof newCfg[k] !== 'object') {\n        changes.push(`${k}: ${oldCfg[k] ?? '(unset)'} \u2192 ${newCfg[k]}`);\n      } else {\n        changes.push(`${k}: [CHANGED]`);\n      }\n    }\n  }\n  return changes.length > 0 ? changes.slice(0, 5).join(', ') : 'no changes';\n}\n\ntype HomeDirFn = () => string;\nconst defaultHomeDir: HomeDirFn = () => os.homedir();\n\nfunction activeProfileConfigPath(homeFn: HomeDirFn): string {\n  const paths =\n    homeFn === defaultHomeDir\n      ? resolveWstackPaths({ projectRoot: process.cwd() })\n      : resolveWstackPaths({ projectRoot: process.cwd(), userHome: homeFn() });\n  return paths.profileConfig(paths.profileName);\n}\n\nfunction historyDir(homeFn: HomeDirFn = defaultHomeDir, targetConfigPath?: string): string {\n  return path.join(path.dirname(configPath(homeFn, targetConfigPath)), 'config.history', 'entries');\n}\n\nfunction historyIndexPath(homeFn: HomeDirFn = defaultHomeDir, targetConfigPath?: string): string {\n  return path.join(path.dirname(configPath(homeFn, targetConfigPath)), 'config.history', 'index.json');\n}\n\nfunction configPath(homeFn: HomeDirFn = defaultHomeDir, targetConfigPath?: string): string {\n  return targetConfigPath ?? activeProfileConfigPath(homeFn);\n}\n\nfunction backupLastPath(homeFn: HomeDirFn = defaultHomeDir, targetConfigPath?: string): string {\n  return `${configPath(homeFn, targetConfigPath)}.last`;\n}\n\nfunction entryId(ts: string): string {\n  return `${ts.replace(/[:.]/g, '-')}-${randomUUID().slice(0, 8)}`;\n}\n\nasync function ensureHistoryDir(\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<void> {\n  try {\n    await fs.mkdir(historyDir(homeFn, targetConfigPath), { recursive: true });\n  } catch (err) {\n    throw new FsError({\n      message: toErrorMessage(err),\n      code: ERROR_CODES.FS_MKDIR_FAILED,\n      path: historyDir(homeFn, targetConfigPath),\n      cause: err,\n    });\n  }\n}\n\nasync function readIndex(\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<HistoryIndex> {\n  try {\n    const raw = await fs.readFile(historyIndexPath(homeFn, targetConfigPath), 'utf8');\n    return JSON.parse(raw) as HistoryIndex;\n  } catch {\n    return { version: 1, entries: [] };\n  }\n}\n\nasync function writeIndex(\n  idx: HistoryIndex,\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<void> {\n  await ensureHistoryDir(homeFn, targetConfigPath);\n  // atomicWrite: torn write here would wipe the entire config-history\n  // index, hiding the user's prior backups behind a \"no history\" UI.\n  try {\n    await atomicWrite(historyIndexPath(homeFn, targetConfigPath), JSON.stringify(idx, null, 2));\n  } catch (err) {\n    throw new FsError({\n      message: toErrorMessage(err),\n      code: ERROR_CODES.FS_ATOMIC_WRITE_FAILED,\n      path: historyIndexPath(homeFn, targetConfigPath),\n      cause: err,\n    });\n  }\n}\n\nasync function pruneHistoryEntries(\n  idx: HistoryIndex,\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<void> {\n  const removed = idx.entries.splice(MAX_CONFIG_HISTORY_ENTRIES);\n  const keep = new Set(idx.entries.map((entry) => `${entry.id}.json`));\n  const dir = historyDir(homeFn, targetConfigPath);\n\n  for (const entry of removed) {\n    try {\n      await fs.unlink(path.join(dir, `${entry.id}.json`));\n    } catch {\n      // best-effort: stale index entries should not block config writes\n    }\n  }\n\n  try {\n    const files = await fs.readdir(dir);\n    await Promise.all(\n      files\n        .filter((file) => file.endsWith('.json') && !keep.has(file))\n        .map(async (file) => {\n          try {\n            await fs.unlink(path.join(dir, file));\n          } catch {\n            // best-effort: orphan cleanup should not block config writes\n          }\n        }),\n    );\n  } catch {\n    // best-effort: missing history dir or readdir failure should not block writes\n  }\n}\n\n/**\n * Backup current config.json \u2192 config.json.last and timestamped .bak files.\n * Safe to call even if config.json doesn't exist. Never throws.\n *\n * IMPORTANT: config.json and .key are never deleted by this function.\n * Only config.json.*.bak timestamped snapshots are pruned.\n */\nexport async function backupCurrent(\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<void> {\n  const cfg = configPath(homeFn, targetConfigPath);\n  const last = backupLastPath(homeFn, targetConfigPath);\n  const ts = Date.now();\n\n  // Read existing config content for .last backup\n  let content: string | undefined;\n  try {\n    content = await fs.readFile(cfg, 'utf8');\n  } catch {\n    // May not exist yet \u2014 that's fine, we just skip the backup\n  }\n\n  if (content !== undefined) {\n    try {\n      await atomicWrite(last, content);\n    } catch (err) {\n      writeErr(\n        `[config-history] .last backup failed: ${toErrorMessage(err)}`,\n      );\n    }\n  }\n\n  // Create timestamped snapshot\n  if (content !== undefined) {\n    try {\n      const bakPath = `${cfg}.${ts}.bak`;\n      await atomicWrite(bakPath, content);\n    } catch (err) {\n      writeErr(\n        `[config-history] timestamped backup failed: ${toErrorMessage(err)}`,\n      );\n    }\n  }\n\n  // Prune old .bak files \u2014 keep last 10\n  try {\n    const dir = path.dirname(cfg);\n    const files = await fs.readdir(dir);\n    const baks = files\n      .filter((f) => f.startsWith('config.json.') && f.endsWith('.bak'))\n      .sort()\n      .reverse();\n    for (const f of baks.slice(MAX_CONFIG_BACKUPS)) {\n      await safeDelete(path.join(dir, f));\n    }\n  } catch (err) {\n    writeErr(\n      `[config-history] backup prune failed: ${toErrorMessage(err)}`,\n    );\n  }\n}\n\n/**\n * Append a history entry for a config change.\n */\nexport async function appendHistory(\n  oldCfg: Record<string, unknown>,\n  newCfg: Record<string, unknown>,\n  description: string,\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<string> {\n  const timestamp = new Date().toISOString();\n  const id = entryId(timestamp);\n\n  await ensureHistoryDir(homeFn, targetConfigPath);\n\n  const entry: HistoryEntry = {\n    id,\n    timestamp,\n    description,\n    snapshotMasked: maskConfigSecrets(newCfg) as Record<string, unknown>,\n    diffSummary: diffSummary(oldCfg, newCfg),\n  };\n\n  try {\n    await fs.writeFile(\n      path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),\n      JSON.stringify(entry, null, 2),\n      'utf8',\n    );\n  } catch (err) {\n    throw new FsError({\n      message: toErrorMessage(err),\n      code: ERROR_CODES.FS_WRITE_FAILED,\n      path: path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),\n      cause: err,\n    });\n  }\n\n  const idx = await readIndex(homeFn, targetConfigPath);\n  idx.entries.unshift({ id, timestamp, description });\n  await pruneHistoryEntries(idx, homeFn, targetConfigPath);\n  await writeIndex(idx, homeFn, targetConfigPath);\n\n  return id;\n}\n\n/**\n * List all history entries (newest first).\n */\nexport async function listHistory(\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<HistoryIndex['entries']> {\n  const idx = await readIndex(homeFn, targetConfigPath);\n  return idx.entries;\n}\n\n/**\n * Get a specific history entry by ID.\n */\nexport async function getHistoryEntry(\n  id: string,\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<HistoryEntry | null> {\n  try {\n    const raw = await fs.readFile(\n      path.join(historyDir(homeFn, targetConfigPath), `${id}.json`),\n      'utf8',\n    );\n    return JSON.parse(raw) as HistoryEntry;\n  } catch {\n    return null;\n  }\n}\n\n/**\n * Restore config.json to a given history entry's snapshot.\n */\nexport async function restoreFromHistory(\n  id: string,\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<{ ok: boolean; backupId: string | null; error?: string | undefined }> {\n  const entry = await getHistoryEntry(id, homeFn, targetConfigPath);\n  if (!entry) return { ok: false, backupId: null, error: 'History entry not found' };\n\n  // Ownership guard \u2014 refuse to write config.json if the calling process\n  // does not own the file. Prevents one user on a multi-user system from\n  // overwriting another user's config via a shared wrongstack install.\n  if (!(await checkConfigOwnership(homeFn, defaultUidFn, targetConfigPath))) {\n    return {\n      ok: false,\n      backupId: null,\n      error: 'Operation denied: config file is not owned by current user',\n    };\n  }\n\n  await backupCurrent(homeFn, targetConfigPath);\n\n  let oldCfg: Record<string, unknown> = {};\n  try {\n    const raw = await fs.readFile(configPath(homeFn, targetConfigPath), 'utf8');\n    oldCfg = JSON.parse(raw);\n  } catch {\n    // No config to restore from\n  }\n\n  try {\n    await atomicWrite(configPath(homeFn, targetConfigPath), JSON.stringify(entry.snapshotMasked, null, 2));\n  } catch (err) {\n    return { ok: false, backupId: null, error: String(err) };\n  }\n\n  const backupId = await appendHistory(\n    oldCfg,\n    entry.snapshotMasked as Record<string, unknown>,\n    `Restored from history ${id}`,\n    homeFn,\n    targetConfigPath,\n  );\n\n  return { ok: true, backupId };\n}\n\n/**\n * Restore config.json to the .last backup.\n */\nexport async function restoreLast(\n  homeFn: HomeDirFn = defaultHomeDir,\n  targetConfigPath?: string,\n): Promise<{ ok: boolean; error?: string | undefined }> {\n  const last = backupLastPath(homeFn, targetConfigPath);\n  const cfg = configPath(homeFn, targetConfigPath);\n\n  let oldCfg: Record<string, unknown> = {};\n  try {\n    const raw = await fs.readFile(cfg, 'utf8');\n    oldCfg = JSON.parse(raw);\n  } catch {\n    // Ignore\n  }\n\n  let lastCfg: Record<string, unknown> = {};\n  try {\n    const raw = await fs.readFile(last, 'utf8');\n    lastCfg = JSON.parse(raw);\n  } catch {\n    return { ok: false, error: 'No prior backup found' };\n  }\n\n  // Ownership guard \u2014 refuse to write config.json if the calling process\n  // does not own the file. Prevents one user on a multi-user system from\n  // overwriting another user's config via a shared wrongstack install.\n  if (!(await checkConfigOwnership(homeFn, defaultUidFn, targetConfigPath))) {\n    return { ok: false, error: 'Operation denied: config file is not owned by current user' };\n  }\n\n  await backupCurrent(homeFn, targetConfigPath);\n\n  try {\n    await atomicWrite(cfg, JSON.stringify(lastCfg, null, 2));\n  } catch (err) {\n    return { ok: false, error: String(err) };\n  }\n\n  await appendHistory(oldCfg, lastCfg, 'Restored from config.json.last', homeFn, targetConfigPath);\n\n  return { ok: true };\n}\n"],
+  "mappings": ";;;AAAA,SAAS,kBAAkB;AAC3B,YAAY,QAAQ;AACpB,OAAO,QAAQ;AACf,YAAY,UAAU;AACtB,SAAS,aAAa,oBAAoB,gBAAgB;AAC1D,SAAS,aAAa,eAAe;AACrC,SAAS,qBAAqB;AAC9B,SAAS,sBAAsB;AAK/B,IAAM,eAAsB,MAAM,GAAG,SAAS,EAAE;AAEhD,eAAe,WAAW,UAAwD;AAChF,MAAI;AACF,UAAMA,QAAO,MAAS,QAAK,QAAQ;AACnC,WAAOA,MAAK;AAAA,EACd,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAWA,eAAe,qBACb,QACA,QAAe,cACf,kBACkB;AAClB,MAAI,GAAG,SAAS,MAAM,QAAS,QAAO;AAEtC,QAAM,MAAM,WAAW,QAAQ,gBAAgB;AAC/C,QAAM,UAAU,MAAM,WAAW,GAAG;AACpC,MAAI,YAAY,OAAW,QAAO;AAElC,QAAM,YAAY,MAAM;AACxB,MAAI,cAAc,OAAW,QAAO;AAEpC,SAAO,YAAY;AACrB;AAMA,IAAM,sBAAsB,oBAAI,IAAI,CAAC,eAAe,QAAQ,YAAY,CAAC;AACzE,IAAM,qBAAqB;AACpB,IAAM,6BAA6B;AAW1C,SAAS,mBAAmB,UAAkB,WAAyB;AAErE,MAAI,oBAAoB,IAAI,QAAQ,GAAG;AACrC,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,sCAAsC,QAAQ;AAAA,MACvD,MAAM,YAAY;AAAA,MAClB,MAAW,UAAK,WAAW,QAAQ;AAAA,MACnC,SAAS,EAAE,QAAQ,qBAAqB;AAAA,IAC1C,CAAC;AAAA,EACH;AAEA,MAAI,aAAkB,cAAS,QAAQ,GAAG;AACxC,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,2CAA2C,QAAQ;AAAA,MAC5D,MAAM,YAAY;AAAA,MAClB,MAAM;AAAA,MACN,SAAS,EAAE,QAAQ,iBAAiB;AAAA,IACtC,CAAC;AAAA,EACH;AAGA,MAAI,CAAC,SAAS,WAAW,cAAc,KAAK,CAAC,SAAS,SAAS,MAAM,GAAG;AAEtE,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,oCAAoC,QAAQ;AAAA,MACrD,MAAM,YAAY;AAAA,MAClB,MAAW,UAAK,WAAW,QAAQ;AAAA,MACnC,SAAS,EAAE,QAAQ,uBAAuB;AAAA,IAC5C,CAAC;AAAA,EACH;AAEA,QAAM,iBAAsB,aAAQ,SAAS;AAC7C,QAAM,kBAAuB,aAAQ,cAAc;AACnD,QAAM,eAAoB,cAAS,cAAc,MAAM;AACvD,QAAM,eACC,cAAS,eAAe,MAAM,cAC9B,cAAc,aAAQ,eAAe,CAAC,MAAM;AACnD,MAAI,CAAC,gBAAgB,CAAC,cAAc;AAClC,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,8CAA8C,cAAc;AAAA,MACrE,MAAM,YAAY;AAAA,MAClB,MAAM;AAAA,MACN,SAAS,EAAE,QAAQ,iBAAiB;AAAA,IACtC,CAAC;AAAA,EACH;AACF;AAMA,eAAe,WAAW,UAAiC;AACzD,QAAM,MAAW,aAAQ,QAAQ;AACjC,QAAM,WAAgB,cAAS,QAAQ;AACvC,MAAI;AACF,uBAAmB,UAAU,GAAG;AAChC,UAAS,UAAO,QAAQ;AAAA,EAC1B,SAAS,KAAK;AAEZ,QAAI,eAAe,SAAS,IAAI,QAAQ,WAAW,UAAU,GAAG;AAC9D,eAAS,4BAA4B,IAAI,OAAO;AAAA,CAAI;AAAA,IACtD;AAAA,EAEF;AACF;AAeA,SAAS,kBAAkB,KAAuD;AAChF,MAAI,OAAO,QAAQ,YAAY,QAAQ,KAAM,QAAO,CAAC;AACrD,QAAM,MAA+B,CAAC;AACtC,aAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,GAAG,GAAG;AACxC,QAAI,cAAc,CAAC,GAAG;AACpB,UAAI,CAAC,IAAI;AAAA,IACX,WAAW,OAAO,MAAM,YAAY,MAAM,QAAQ,CAAC,MAAM,QAAQ,CAAC,GAAG;AACnE,UAAI,CAAC,IAAI,kBAAkB,CAA4B;AAAA,IACzD,OAAO;AACL,UAAI,CAAC,IAAI;AAAA,IACX;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,YAAY,QAAiC,QAAyC;AAC7F,QAAM,UAAoB,CAAC;AAC3B,QAAM,UAAU,oBAAI,IAAI,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,OAAO,KAAK,MAAM,CAAC,CAAC;AACxE,aAAW,KAAK,SAAS;AACvB,UAAM,IAAI,KAAK,UAAU,OAAO,CAAC,CAAC;AAClC,UAAM,IAAI,KAAK,UAAU,OAAO,CAAC,CAAC;AAClC,QAAI,MAAM,GAAG;AACX,UAAI,cAAc,CAAC,GAAG;AACpB,gBAAQ,KAAK,GAAG,CAAC,aAAa;AAAA,MAChC,WAAW,OAAO,OAAO,CAAC,MAAM,UAAU;AACxC,gBAAQ,KAAK,GAAG,CAAC,KAAK,OAAO,CAAC,KAAK,SAAS,WAAM,OAAO,CAAC,CAAC,EAAE;AAAA,MAC/D,OAAO;AACL,gBAAQ,KAAK,GAAG,CAAC,aAAa;AAAA,MAChC;AAAA,IACF;AAAA,EACF;AACA,SAAO,QAAQ,SAAS,IAAI,QAAQ,MAAM,GAAG,CAAC,EAAE,KAAK,IAAI,IAAI;AAC/D;AAGA,IAAM,iBAA4B,MAAM,GAAG,QAAQ;AAEnD,SAAS,wBAAwB,QAA2B;AAC1D,QAAM,QACJ,WAAW,iBACP,mBAAmB,EAAE,aAAa,QAAQ,IAAI,EAAE,CAAC,IACjD,mBAAmB,EAAE,aAAa,QAAQ,IAAI,GAAG,UAAU,OAAO,EAAE,CAAC;AAC3E,SAAO,MAAM,cAAc,MAAM,WAAW;AAC9C;AAEA,SAAS,WAAW,SAAoB,gBAAgB,kBAAmC;AACzF,SAAY,UAAU,aAAQ,WAAW,QAAQ,gBAAgB,CAAC,GAAG,kBAAkB,SAAS;AAClG;AAEA,SAAS,iBAAiB,SAAoB,gBAAgB,kBAAmC;AAC/F,SAAY,UAAU,aAAQ,WAAW,QAAQ,gBAAgB,CAAC,GAAG,kBAAkB,YAAY;AACrG;AAEA,SAAS,WAAW,SAAoB,gBAAgB,kBAAmC;AACzF,SAAO,oBAAoB,wBAAwB,MAAM;AAC3D;AAEA,SAAS,eAAe,SAAoB,gBAAgB,kBAAmC;AAC7F,SAAO,GAAG,WAAW,QAAQ,gBAAgB,CAAC;AAChD;AAEA,SAAS,QAAQ,IAAoB;AACnC,SAAO,GAAG,GAAG,QAAQ,SAAS,GAAG,CAAC,IAAI,WAAW,EAAE,MAAM,GAAG,CAAC,CAAC;AAChE;AAEA,eAAe,iBACb,SAAoB,gBACpB,kBACe;AACf,MAAI;AACF,UAAS,SAAM,WAAW,QAAQ,gBAAgB,GAAG,EAAE,WAAW,KAAK,CAAC;AAAA,EAC1E,SAAS,KAAK;AACZ,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,eAAe,GAAG;AAAA,MAC3B,MAAM,YAAY;AAAA,MAClB,MAAM,WAAW,QAAQ,gBAAgB;AAAA,MACzC,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAe,UACb,SAAoB,gBACpB,kBACuB;AACvB,MAAI;AACF,UAAM,MAAM,MAAS,YAAS,iBAAiB,QAAQ,gBAAgB,GAAG,MAAM;AAChF,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO,EAAE,SAAS,GAAG,SAAS,CAAC,EAAE;AAAA,EACnC;AACF;AAEA,eAAe,WACb,KACA,SAAoB,gBACpB,kBACe;AACf,QAAM,iBAAiB,QAAQ,gBAAgB;AAG/C,MAAI;AACF,UAAM,YAAY,iBAAiB,QAAQ,gBAAgB,GAAG,KAAK,UAAU,KAAK,MAAM,CAAC,CAAC;AAAA,EAC5F,SAAS,KAAK;AACZ,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,eAAe,GAAG;AAAA,MAC3B,MAAM,YAAY;AAAA,MAClB,MAAM,iBAAiB,QAAQ,gBAAgB;AAAA,MAC/C,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACF;AAEA,eAAe,oBACb,KACA,SAAoB,gBACpB,kBACe;AACf,QAAM,UAAU,IAAI,QAAQ,OAAO,0BAA0B;AAC7D,QAAM,OAAO,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,UAAU,GAAG,MAAM,EAAE,OAAO,CAAC;AACnE,QAAM,MAAM,WAAW,QAAQ,gBAAgB;AAE/C,aAAW,SAAS,SAAS;AAC3B,QAAI;AACF,YAAS,UAAY,UAAK,KAAK,GAAG,MAAM,EAAE,OAAO,CAAC;AAAA,IACpD,QAAQ;AAAA,IAER;AAAA,EACF;AAEA,MAAI;AACF,UAAM,QAAQ,MAAS,WAAQ,GAAG;AAClC,UAAM,QAAQ;AAAA,MACZ,MACG,OAAO,CAAC,SAAS,KAAK,SAAS,OAAO,KAAK,CAAC,KAAK,IAAI,IAAI,CAAC,EAC1D,IAAI,OAAO,SAAS;AACnB,YAAI;AACF,gBAAS,UAAY,UAAK,KAAK,IAAI,CAAC;AAAA,QACtC,QAAQ;AAAA,QAER;AAAA,MACF,CAAC;AAAA,IACL;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AASA,eAAsB,cACpB,SAAoB,gBACpB,kBACe;AACf,QAAM,MAAM,WAAW,QAAQ,gBAAgB;AAC/C,QAAM,OAAO,eAAe,QAAQ,gBAAgB;AACpD,QAAM,KAAK,KAAK,IAAI;AAGpB,MAAI;AACJ,MAAI;AACF,cAAU,MAAS,YAAS,KAAK,MAAM;AAAA,EACzC,QAAQ;AAAA,EAER;AAEA,MAAI,YAAY,QAAW;AACzB,QAAI;AACF,YAAM,YAAY,MAAM,OAAO;AAAA,IACjC,SAAS,KAAK;AACZ;AAAA,QACE,yCAAyC,eAAe,GAAG,CAAC;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAGA,MAAI,YAAY,QAAW;AACzB,QAAI;AACF,YAAM,UAAU,GAAG,GAAG,IAAI,EAAE;AAC5B,YAAM,YAAY,SAAS,OAAO;AAAA,IACpC,SAAS,KAAK;AACZ;AAAA,QACE,+CAA+C,eAAe,GAAG,CAAC;AAAA,MACpE;AAAA,IACF;AAAA,EACF;AAGA,MAAI;AACF,UAAM,MAAW,aAAQ,GAAG;AAC5B,UAAM,QAAQ,MAAS,WAAQ,GAAG;AAClC,UAAM,OAAO,MACV,OAAO,CAAC,MAAM,EAAE,WAAW,cAAc,KAAK,EAAE,SAAS,MAAM,CAAC,EAChE,KAAK,EACL,QAAQ;AACX,eAAW,KAAK,KAAK,MAAM,kBAAkB,GAAG;AAC9C,YAAM,WAAgB,UAAK,KAAK,CAAC,CAAC;AAAA,IACpC;AAAA,EACF,SAAS,KAAK;AACZ;AAAA,MACE,yCAAyC,eAAe,GAAG,CAAC;AAAA,IAC9D;AAAA,EACF;AACF;AAKA,eAAsB,cACpB,QACA,QACA,aACA,SAAoB,gBACpB,kBACiB;AACjB,QAAM,aAAY,oBAAI,KAAK,GAAE,YAAY;AACzC,QAAM,KAAK,QAAQ,SAAS;AAE5B,QAAM,iBAAiB,QAAQ,gBAAgB;AAE/C,QAAM,QAAsB;AAAA,IAC1B;AAAA,IACA;AAAA,IACA;AAAA,IACA,gBAAgB,kBAAkB,MAAM;AAAA,IACxC,aAAa,YAAY,QAAQ,MAAM;AAAA,EACzC;AAEA,MAAI;AACF,UAAS;AAAA,MACF,UAAK,WAAW,QAAQ,gBAAgB,GAAG,GAAG,EAAE,OAAO;AAAA,MAC5D,KAAK,UAAU,OAAO,MAAM,CAAC;AAAA,MAC7B;AAAA,IACF;AAAA,EACF,SAAS,KAAK;AACZ,UAAM,IAAI,QAAQ;AAAA,MAChB,SAAS,eAAe,GAAG;AAAA,MAC3B,MAAM,YAAY;AAAA,MAClB,MAAW,UAAK,WAAW,QAAQ,gBAAgB,GAAG,GAAG,EAAE,OAAO;AAAA,MAClE,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AAEA,QAAM,MAAM,MAAM,UAAU,QAAQ,gBAAgB;AACpD,MAAI,QAAQ,QAAQ,EAAE,IAAI,WAAW,YAAY,CAAC;AAClD,QAAM,oBAAoB,KAAK,QAAQ,gBAAgB;AACvD,QAAM,WAAW,KAAK,QAAQ,gBAAgB;AAE9C,SAAO;AACT;AAKA,eAAsB,YACpB,SAAoB,gBACpB,kBACkC;AAClC,QAAM,MAAM,MAAM,UAAU,QAAQ,gBAAgB;AACpD,SAAO,IAAI;AACb;AAKA,eAAsB,gBACpB,IACA,SAAoB,gBACpB,kBAC8B;AAC9B,MAAI;AACF,UAAM,MAAM,MAAS;AAAA,MACd,UAAK,WAAW,QAAQ,gBAAgB,GAAG,GAAG,EAAE,OAAO;AAAA,MAC5D;AAAA,IACF;AACA,WAAO,KAAK,MAAM,GAAG;AAAA,EACvB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAKA,eAAsB,mBACpB,IACA,SAAoB,gBACpB,kBAC+E;AAC/E,QAAM,QAAQ,MAAM,gBAAgB,IAAI,QAAQ,gBAAgB;AAChE,MAAI,CAAC,MAAO,QAAO,EAAE,IAAI,OAAO,UAAU,MAAM,OAAO,0BAA0B;AAKjF,MAAI,CAAE,MAAM,qBAAqB,QAAQ,cAAc,gBAAgB,GAAI;AACzE,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,OAAO;AAAA,IACT;AAAA,EACF;AAEA,QAAM,cAAc,QAAQ,gBAAgB;AAE5C,MAAI,SAAkC,CAAC;AACvC,MAAI;AACF,UAAM,MAAM,MAAS,YAAS,WAAW,QAAQ,gBAAgB,GAAG,MAAM;AAC1E,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AAAA,EAER;AAEA,MAAI;AACF,UAAM,YAAY,WAAW,QAAQ,gBAAgB,GAAG,KAAK,UAAU,MAAM,gBAAgB,MAAM,CAAC,CAAC;AAAA,EACvG,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,UAAU,MAAM,OAAO,OAAO,GAAG,EAAE;AAAA,EACzD;AAEA,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA,MAAM;AAAA,IACN,yBAAyB,EAAE;AAAA,IAC3B;AAAA,IACA;AAAA,EACF;AAEA,SAAO,EAAE,IAAI,MAAM,SAAS;AAC9B;AAKA,eAAsB,YACpB,SAAoB,gBACpB,kBACsD;AACtD,QAAM,OAAO,eAAe,QAAQ,gBAAgB;AACpD,QAAM,MAAM,WAAW,QAAQ,gBAAgB;AAE/C,MAAI,SAAkC,CAAC;AACvC,MAAI;AACF,UAAM,MAAM,MAAS,YAAS,KAAK,MAAM;AACzC,aAAS,KAAK,MAAM,GAAG;AAAA,EACzB,QAAQ;AAAA,EAER;AAEA,MAAI,UAAmC,CAAC;AACxC,MAAI;AACF,UAAM,MAAM,MAAS,YAAS,MAAM,MAAM;AAC1C,cAAU,KAAK,MAAM,GAAG;AAAA,EAC1B,QAAQ;AACN,WAAO,EAAE,IAAI,OAAO,OAAO,wBAAwB;AAAA,EACrD;AAKA,MAAI,CAAE,MAAM,qBAAqB,QAAQ,cAAc,gBAAgB,GAAI;AACzE,WAAO,EAAE,IAAI,OAAO,OAAO,6DAA6D;AAAA,EAC1F;AAEA,QAAM,cAAc,QAAQ,gBAAgB;AAE5C,MAAI;AACF,UAAM,YAAY,KAAK,KAAK,UAAU,SAAS,MAAM,CAAC,CAAC;AAAA,EACzD,SAAS,KAAK;AACZ,WAAO,EAAE,IAAI,OAAO,OAAO,OAAO,GAAG,EAAE;AAAA,EACzC;AAEA,QAAM,cAAc,QAAQ,SAAS,kCAAkC,QAAQ,gBAAgB;AAE/F,SAAO,EAAE,IAAI,KAAK;AACpB;",
+  "names": ["stat"]
+}