cleargate 0.2.1 → 0.4.0

package/dist/chunk-OM4FAEA7.js

@@ -0,0 +1,184 @@
+#!/usr/bin/env node
+import {
+  createTokenStore
+} from "./chunk-4V4QABOJ.js";
+
+// src/config.ts
+import * as fs from "fs";
+import * as os from "os";
+import * as path from "path";
+import { z } from "zod";
+var ConfigSchema = z.object({
+  mcpUrl: z.string().url().optional(),
+  profile: z.string().min(1).default("default"),
+  logLevel: z.enum(["debug", "info", "warn", "error"]).default("info")
+}).strict();
+function loadConfig(opts = {}) {
+  const {
+    flags = {},
+    env = process.env,
+    configPath
+  } = opts;
+  const resolvedConfigPath = configPath ?? (() => {
+    const home = os.homedir();
+    if (!home) return null;
+    return path.join(home, ".cleargate", "config.json");
+  })();
+  let fileLayer = {};
+  if (resolvedConfigPath) {
+    try {
+      const raw = fs.readFileSync(resolvedConfigPath, "utf8");
+      let parsed;
+      try {
+        parsed = JSON.parse(raw);
+      } catch {
+        throw new Error(
+          `Failed to parse config file at ${resolvedConfigPath}: invalid JSON`
+        );
+      }
+      const fileResult = ConfigSchema.safeParse(parsed);
+      if (!fileResult.success) {
+        throw new Error(
+          `Invalid config file at ${resolvedConfigPath}: ${fileResult.error.message}`
+        );
+      }
+      fileLayer = fileResult.data;
+    } catch (err) {
+      if (err instanceof Error && "code" in err && err.code === "ENOENT") {
+      } else {
+        throw err;
+      }
+    }
+  }
+  const envLayer = {};
+  if (env["CLEARGATE_MCP_URL"]) {
+    envLayer.mcpUrl = env["CLEARGATE_MCP_URL"];
+  }
+  if (env["CLEARGATE_PROFILE"]) {
+    envLayer.profile = env["CLEARGATE_PROFILE"];
+  }
+  if (env["CLEARGATE_LOG_LEVEL"]) {
+    envLayer.logLevel = env["CLEARGATE_LOG_LEVEL"];
+  }
+  const merged = {
+    ...fileLayer,
+    ...envLayer,
+    ...flags.mcpUrl !== void 0 ? { mcpUrl: flags.mcpUrl } : {},
+    ...flags.profile !== void 0 ? { profile: flags.profile } : {},
+    ...flags.logLevel !== void 0 ? { logLevel: flags.logLevel } : {}
+  };
+  for (const key of Object.keys(merged)) {
+    if (merged[key] === void 0) {
+      delete merged[key];
+    }
+  }
+  const result = ConfigSchema.safeParse(merged);
+  if (!result.success) {
+    throw new Error(`Config validation failed: ${result.error.message}`);
+  }
+  return result.data;
+}
+function requireMcpUrl(cfg) {
+  if (cfg.mcpUrl === void 0) {
+    throw new Error(
+      "mcpUrl not configured. Run `cleargate join <invite-url>` first."
+    );
+  }
+  return cfg.mcpUrl;
+}
+
+// src/auth/acquire.ts
+var CACHE = /* @__PURE__ */ new Map();
+function decodeJwtPayload(token) {
+  try {
+    const parts = token.split(".");
+    if (parts.length !== 3) return null;
+    const padded = parts[1].replace(/-/g, "+").replace(/_/g, "/");
+    const json = Buffer.from(padded, "base64").toString("utf8");
+    return JSON.parse(json);
+  } catch {
+    return null;
+  }
+}
+var AcquireError = class extends Error {
+  constructor(message, code) {
+    super(message);
+    this.code = code;
+    this.name = "AcquireError";
+  }
+  code;
+};
+async function acquireAccessToken(opts) {
+  const env = opts.env ?? process.env;
+  const nowFn = opts.now ?? Date.now;
+  const envToken = env["CLEARGATE_MCP_TOKEN"];
+  if (envToken && envToken.length > 0) {
+    return envToken;
+  }
+  const cacheKey = `${opts.profile}::${opts.mcpUrl}`;
+  if (!opts.forceRefresh) {
+    const cached = CACHE.get(cacheKey);
+    if (cached && nowFn() < cached.expiresAtMs) {
+      return cached.accessToken;
+    }
+  }
+  const store = await (opts.createStore ?? createTokenStore)();
+  const stored = await store.load(opts.profile);
+  if (!stored) {
+    throw new AcquireError(
+      `No stored credentials for profile '${opts.profile}'. Run \`cleargate join <invite-url>\` first, or export CLEARGATE_MCP_TOKEN.`,
+      "no_stored_token"
+    );
+  }
+  const fetchFn = opts.fetch ?? globalThis.fetch;
+  let response;
+  try {
+    response = await fetchFn(`${opts.mcpUrl}/auth/refresh`, {
+      method: "POST",
+      headers: { "content-type": "application/json" },
+      body: JSON.stringify({ refresh_token: stored })
+    });
+  } catch (err) {
+    throw new AcquireError(
+      `cannot reach ${opts.mcpUrl} (${err instanceof Error ? err.message : String(err)})`,
+      "transport"
+    );
+  }
+  if (response.status === 401) {
+    const body2 = await response.json().catch(() => ({}));
+    if (body2.error === "token_revoked") {
+      throw new AcquireError(
+        "refresh token was revoked. Run `cleargate join <invite-url>` to re-authenticate.",
+        "token_revoked"
+      );
+    }
+    throw new AcquireError(
+      "refresh token is invalid or expired. Run `cleargate join <invite-url>` to re-authenticate.",
+      "invalid_token"
+    );
+  }
+  if (!response.ok) {
+    throw new AcquireError(`unexpected status ${response.status} from /auth/refresh`, "unexpected_status");
+  }
+  const body = await response.json().catch(() => null);
+  if (!body || typeof body.access_token !== "string" || typeof body.refresh_token !== "string" || body.access_token.length === 0 || body.refresh_token.length === 0) {
+    throw new AcquireError("server returned unexpected /auth/refresh response shape", "bad_response");
+  }
+  await store.save(opts.profile, body.refresh_token);
+  const accessToken = body.access_token;
+  const payload = decodeJwtPayload(accessToken);
+  const exp = payload?.exp;
+  if (typeof exp === "number" && Number.isFinite(exp)) {
+    const expiresAtMs = (exp - 60) * 1e3;
+    CACHE.set(cacheKey, { accessToken, expiresAtMs });
+  }
+  return accessToken;
+}
+
+export {
+  loadConfig,
+  requireMcpUrl,
+  AcquireError,
+  acquireAccessToken
+};
+//# sourceMappingURL=chunk-OM4FAEA7.js.map

package/dist/chunk-OM4FAEA7.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/config.ts","../src/auth/acquire.ts"],"sourcesContent":["import * as fs from 'node:fs';\nimport * as os from 'node:os';\nimport * as path from 'node:path';\nimport { z } from 'zod';\n\nexport const ConfigSchema = z\n  .object({\n    mcpUrl: z.string().url().optional(),\n    profile: z.string().min(1).default('default'),\n    logLevel: z.enum(['debug', 'info', 'warn', 'error']).default('info'),\n  })\n  .strict();\n\nexport type Config = z.infer<typeof ConfigSchema>;\n\n/** Partial raw config used for each layer before merge */\ntype RawConfig = Partial<{\n  mcpUrl: string | undefined;\n  profile: string | undefined;\n  logLevel: string | undefined;\n}>;\n\nexport interface LoadConfigOptions {\n  flags?: RawConfig;\n  env?: NodeJS.ProcessEnv;\n  configPath?: string;\n}\n\n/**\n * Synchronously loads and merges config from all layers:\n * flags > env > config file > zod defaults\n */\nexport function loadConfig(opts: LoadConfigOptions = {}): Config {\n  const {\n    flags = {},\n    env = process.env,\n    configPath,\n  } = opts;\n\n  // Resolve config file path\n  const resolvedConfigPath =\n    configPath ??\n    (() => {\n      const home = os.homedir();\n      if (!home) return null;\n      return path.join(home, '.cleargate', 'config.json');\n    })();\n\n  // Layer: file\n  let fileLayer: RawConfig = {};\n  if (resolvedConfigPath) {\n    try {\n      const raw = fs.readFileSync(resolvedConfigPath, 'utf8');\n      let parsed: unknown;\n      try {\n        parsed = JSON.parse(raw);\n      } catch {\n        throw new Error(\n          `Failed to parse config file at ${resolvedConfigPath}: invalid JSON`,\n        );\n      }\n      // Validate file contents strictly (unknown keys will throw here)\n      const fileResult = ConfigSchema.safeParse(parsed);\n      if (!fileResult.success) {\n        throw new Error(\n          `Invalid config file at ${resolvedConfigPath}: ${fileResult.error.message}`,\n        );\n      }\n      fileLayer = fileResult.data;\n    } catch (err) {\n      // Re-throw parse/validation errors; silently skip only ENOENT\n      if (\n        err instanceof Error &&\n        'code' in err &&\n        (err as NodeJS.ErrnoException).code === 'ENOENT'\n      ) {\n        // file doesn't exist — skip silently\n      } else {\n        throw err;\n      }\n    }\n  }\n\n  // Layer: env\n  const envLayer: RawConfig = {};\n  if (env['CLEARGATE_MCP_URL']) {\n    envLayer.mcpUrl = env['CLEARGATE_MCP_URL'];\n  }\n  if (env['CLEARGATE_PROFILE']) {\n    envLayer.profile = env['CLEARGATE_PROFILE'];\n  }\n  if (env['CLEARGATE_LOG_LEVEL']) {\n    envLayer.logLevel = env['CLEARGATE_LOG_LEVEL'];\n  }\n\n  // Merge: flags > env > file (start from {} so zod defaults fill in missing fields)\n  const merged: Record<string, unknown> = {\n    ...fileLayer,\n    ...envLayer,\n    ...(flags.mcpUrl !== undefined ? { mcpUrl: flags.mcpUrl } : {}),\n    ...(flags.profile !== undefined ? { profile: flags.profile } : {}),\n    ...(flags.logLevel !== undefined ? { logLevel: flags.logLevel } : {}),\n  };\n\n  // Remove undefined values so zod defaults apply properly\n  for (const key of Object.keys(merged)) {\n    if (merged[key] === undefined) {\n      delete merged[key];\n    }\n  }\n\n  const result = ConfigSchema.safeParse(merged);\n  if (!result.success) {\n    throw new Error(`Config validation failed: ${result.error.message}`);\n  }\n\n  return result.data;\n}\n\n/**\n * Asserts mcpUrl is present, throws a user-friendly error if not.\n */\nexport function requireMcpUrl(cfg: Config): string {\n  if (cfg.mcpUrl === undefined) {\n    throw new Error(\n      'mcpUrl not configured. Run `cleargate join <invite-url>` first.',\n    );\n  }\n  return cfg.mcpUrl;\n}\n","/**\n * acquireAccessToken — resolve a short-lived MCP access-token JWT.\n *\n * Resolution order (first success wins):\n *   1. CLEARGATE_MCP_TOKEN env var — CI / dev short-circuit (assumed JWT, not verified locally).\n *   2. In-memory single-flight cache (keyed by `${profile}::${mcpUrl}`) — returns cached token\n *      if still valid (expires 60s before access token's `exp` claim).\n *   3. Stored refresh token (keychain/file) + POST /auth/refresh → rotates refresh token, returns access token.\n *\n * Errors surface to caller with a clear message so command handlers can exit cleanly.\n *\n * Lives here (not in mcp-client.ts) because the refresh flow needs TokenStore + mcpUrl and\n * mcp-client.ts is kept thin (just: host, bearer, JSON-RPC).\n */\nimport { createTokenStore } from './factory.js';\nimport type { TokenStore } from './token-store.js';\n\n// ── Single-flight in-memory cache ─────────────────────────────────────────────\n// Process-local; naturally cleared when the Node CLI exits.\n// Key: `${profile}::${mcpUrl}` — R1 mitigation: two profiles in same process never collide.\n// Env-token path (CLEARGATE_MCP_TOKEN) bypasses this cache entirely.\n\nconst CACHE = new Map<string, { accessToken: string; expiresAtMs: number }>();\n\n/** Test seam: clear the acquire cache between tests. */\nexport function __resetAcquireCache(): void {\n  CACHE.clear();\n}\n\n/** Decode a JWT payload without verifying the signature (CLI-side only). */\nfunction decodeJwtPayload(token: string): Record<string, unknown> | null {\n  try {\n    const parts = token.split('.');\n    if (parts.length !== 3) return null;\n    const padded = parts[1].replace(/-/g, '+').replace(/_/g, '/');\n    const json = Buffer.from(padded, 'base64').toString('utf8');\n    return JSON.parse(json) as Record<string, unknown>;\n  } catch {\n    return null;\n  }\n}\n\nexport interface AcquireOptions {\n  mcpUrl: string;\n  profile: string;\n  /** Force a fresh /auth/refresh even if the cache has a valid entry. */\n  forceRefresh?: boolean;\n  /** Test seam: overrides globalThis.fetch */\n  fetch?: typeof globalThis.fetch;\n  /** Test seam: overrides createTokenStore */\n  createStore?: () => Promise<TokenStore>;\n  /** Test seam: overrides process.env lookup */\n  env?: NodeJS.ProcessEnv;\n  /** Test seam: overrides Date.now() for expiry calculations. */\n  now?: () => number;\n}\n\nexport class AcquireError extends Error {\n  constructor(\n    message: string,\n    public readonly code:\n      | 'env_token'\n      | 'no_stored_token'\n      | 'invalid_token'\n      | 'token_revoked'\n      | 'transport'\n      | 'unexpected_status'\n      | 'bad_response',\n  ) {\n    super(message);\n    this.name = 'AcquireError';\n  }\n}\n\n/**\n * Returns a bearer string suitable for Authorization headers against /mcp and\n * /admin-api. Rotates the stored refresh token on success.\n */\nexport async function acquireAccessToken(opts: AcquireOptions): Promise<string> {\n  const env = opts.env ?? process.env;\n  const nowFn = opts.now ?? Date.now;\n\n  // 1. Env short-circuit — CI / dev / manual paste. Assumed to be a valid JWT.\n  // Env tokens are NOT cached — they have no known exp without decoding + the\n  // env is set per-invocation in CI anyway.\n  const envToken = env['CLEARGATE_MCP_TOKEN'];\n  if (envToken && envToken.length > 0) {\n    return envToken;\n  }\n\n  // 2. Single-flight cache check (skip when forceRefresh is set).\n  const cacheKey = `${opts.profile}::${opts.mcpUrl}`;\n  if (!opts.forceRefresh) {\n    const cached = CACHE.get(cacheKey);\n    if (cached && nowFn() < cached.expiresAtMs) {\n      return cached.accessToken;\n    }\n  }\n\n  // 3. Stored refresh token → POST /auth/refresh.\n  const store = await (opts.createStore ?? createTokenStore)();\n  const stored = await store.load(opts.profile);\n  if (!stored) {\n    throw new AcquireError(\n      `No stored credentials for profile '${opts.profile}'. Run \\`cleargate join <invite-url>\\` first, or export CLEARGATE_MCP_TOKEN.`,\n      'no_stored_token',\n    );\n  }\n\n  const fetchFn = opts.fetch ?? globalThis.fetch;\n\n  let response: Response;\n  try {\n    response = await fetchFn(`${opts.mcpUrl}/auth/refresh`, {\n      method: 'POST',\n      headers: { 'content-type': 'application/json' },\n      body: JSON.stringify({ refresh_token: stored }),\n    });\n  } catch (err) {\n    throw new AcquireError(\n      `cannot reach ${opts.mcpUrl} (${err instanceof Error ? err.message : String(err)})`,\n      'transport',\n    );\n  }\n\n  if (response.status === 401) {\n    const body = (await response.json().catch(() => ({}))) as { error?: string };\n    if (body.error === 'token_revoked') {\n      throw new AcquireError(\n        'refresh token was revoked. Run `cleargate join <invite-url>` to re-authenticate.',\n        'token_revoked',\n      );\n    }\n    throw new AcquireError(\n      'refresh token is invalid or expired. Run `cleargate join <invite-url>` to re-authenticate.',\n      'invalid_token',\n    );\n  }\n\n  if (!response.ok) {\n    throw new AcquireError(`unexpected status ${response.status} from /auth/refresh`, 'unexpected_status');\n  }\n\n  const body = (await response.json().catch(() => null)) as\n    | { access_token?: unknown; refresh_token?: unknown }\n    | null;\n  if (\n    !body ||\n    typeof body.access_token !== 'string' ||\n    typeof body.refresh_token !== 'string' ||\n    body.access_token.length === 0 ||\n    body.refresh_token.length === 0\n  ) {\n    throw new AcquireError('server returned unexpected /auth/refresh response shape', 'bad_response');\n  }\n\n  // Rotate — store the new refresh token so the next call uses a fresh jti.\n  await store.save(opts.profile, body.refresh_token);\n\n  const accessToken = body.access_token;\n\n  // 4. Cache the new access token (expire 60s before the JWT exp claim).\n  const payload = decodeJwtPayload(accessToken);\n  const exp = payload?.exp;\n  if (typeof exp === 'number' && Number.isFinite(exp)) {\n    const expiresAtMs = (exp - 60) * 1000;\n    CACHE.set(cacheKey, { accessToken, expiresAtMs });\n  }\n  // If exp is missing or non-numeric, do NOT cache — next call will re-refresh.\n\n  return accessToken;\n}\n"],"mappings":";;;;;;AAAA,YAAY,QAAQ;AACpB,YAAY,QAAQ;AACpB,YAAY,UAAU;AACtB,SAAS,SAAS;AAEX,IAAM,eAAe,EACzB,OAAO;AAAA,EACN,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS;AAAA,EAClC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,SAAS;AAAA,EAC5C,UAAU,EAAE,KAAK,CAAC,SAAS,QAAQ,QAAQ,OAAO,CAAC,EAAE,QAAQ,MAAM;AACrE,CAAC,EACA,OAAO;AAqBH,SAAS,WAAW,OAA0B,CAAC,GAAW;AAC/D,QAAM;AAAA,IACJ,QAAQ,CAAC;AAAA,IACT,MAAM,QAAQ;AAAA,IACd;AAAA,EACF,IAAI;AAGJ,QAAM,qBACJ,eACC,MAAM;AACL,UAAM,OAAU,WAAQ;AACxB,QAAI,CAAC,KAAM,QAAO;AAClB,WAAY,UAAK,MAAM,cAAc,aAAa;AAAA,EACpD,GAAG;AAGL,MAAI,YAAuB,CAAC;AAC5B,MAAI,oBAAoB;AACtB,QAAI;AACF,YAAM,MAAS,gBAAa,oBAAoB,MAAM;AACtD,UAAI;AACJ,UAAI;AACF,iBAAS,KAAK,MAAM,GAAG;AAAA,MACzB,QAAQ;AACN,cAAM,IAAI;AAAA,UACR,kCAAkC,kBAAkB;AAAA,QACtD;AAAA,MACF;AAEA,YAAM,aAAa,aAAa,UAAU,MAAM;AAChD,UAAI,CAAC,WAAW,SAAS;AACvB,cAAM,IAAI;AAAA,UACR,0BAA0B,kBAAkB,KAAK,WAAW,MAAM,OAAO;AAAA,QAC3E;AAAA,MACF;AACA,kBAAY,WAAW;AAAA,IACzB,SAAS,KAAK;AAEZ,UACE,eAAe,SACf,UAAU,OACT,IAA8B,SAAS,UACxC;AAAA,MAEF,OAAO;AACL,cAAM;AAAA,MACR;AAAA,IACF;AAAA,EACF;AAGA,QAAM,WAAsB,CAAC;AAC7B,MAAI,IAAI,mBAAmB,GAAG;AAC5B,aAAS,SAAS,IAAI,mBAAmB;AAAA,EAC3C;AACA,MAAI,IAAI,mBAAmB,GAAG;AAC5B,aAAS,UAAU,IAAI,mBAAmB;AAAA,EAC5C;AACA,MAAI,IAAI,qBAAqB,GAAG;AAC9B,aAAS,WAAW,IAAI,qBAAqB;AAAA,EAC/C;AAGA,QAAM,SAAkC;AAAA,IACtC,GAAG;AAAA,IACH,GAAG;AAAA,IACH,GAAI,MAAM,WAAW,SAAY,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,IAC7D,GAAI,MAAM,YAAY,SAAY,EAAE,SAAS,MAAM,QAAQ,IAAI,CAAC;AAAA,IAChE,GAAI,MAAM,aAAa,SAAY,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;AAAA,EACrE;AAGA,aAAW,OAAO,OAAO,KAAK,MAAM,GAAG;AACrC,QAAI,OAAO,GAAG,MAAM,QAAW;AAC7B,aAAO,OAAO,GAAG;AAAA,IACnB;AAAA,EACF;AAEA,QAAM,SAAS,aAAa,UAAU,MAAM;AAC5C,MAAI,CAAC,OAAO,SAAS;AACnB,UAAM,IAAI,MAAM,6BAA6B,OAAO,MAAM,OAAO,EAAE;AAAA,EACrE;AAEA,SAAO,OAAO;AAChB;AAKO,SAAS,cAAc,KAAqB;AACjD,MAAI,IAAI,WAAW,QAAW;AAC5B,UAAM,IAAI;AAAA,MACR;AAAA,IACF;AAAA,EACF;AACA,SAAO,IAAI;AACb;;;AC3GA,IAAM,QAAQ,oBAAI,IAA0D;AAQ5E,SAAS,iBAAiB,OAA+C;AACvE,MAAI;AACF,UAAM,QAAQ,MAAM,MAAM,GAAG;AAC7B,QAAI,MAAM,WAAW,EAAG,QAAO;AAC/B,UAAM,SAAS,MAAM,CAAC,EAAE,QAAQ,MAAM,GAAG,EAAE,QAAQ,MAAM,GAAG;AAC5D,UAAM,OAAO,OAAO,KAAK,QAAQ,QAAQ,EAAE,SAAS,MAAM;AAC1D,WAAO,KAAK,MAAM,IAAI;AAAA,EACxB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBO,IAAM,eAAN,cAA2B,MAAM;AAAA,EACtC,YACE,SACgB,MAQhB;AACA,UAAM,OAAO;AATG;AAUhB,SAAK,OAAO;AAAA,EACd;AAAA,EAXkB;AAYpB;AAMA,eAAsB,mBAAmB,MAAuC;AAC9E,QAAM,MAAM,KAAK,OAAO,QAAQ;AAChC,QAAM,QAAQ,KAAK,OAAO,KAAK;AAK/B,QAAM,WAAW,IAAI,qBAAqB;AAC1C,MAAI,YAAY,SAAS,SAAS,GAAG;AACnC,WAAO;AAAA,EACT;AAGA,QAAM,WAAW,GAAG,KAAK,OAAO,KAAK,KAAK,MAAM;AAChD,MAAI,CAAC,KAAK,cAAc;AACtB,UAAM,SAAS,MAAM,IAAI,QAAQ;AACjC,QAAI,UAAU,MAAM,IAAI,OAAO,aAAa;AAC1C,aAAO,OAAO;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,QAAQ,OAAO,KAAK,eAAe,kBAAkB;AAC3D,QAAM,SAAS,MAAM,MAAM,KAAK,KAAK,OAAO;AAC5C,MAAI,CAAC,QAAQ;AACX,UAAM,IAAI;AAAA,MACR,sCAAsC,KAAK,OAAO;AAAA,MAClD;AAAA,IACF;AAAA,EACF;AAEA,QAAM,UAAU,KAAK,SAAS,WAAW;AAEzC,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,GAAG,KAAK,MAAM,iBAAiB;AAAA,MACtD,QAAQ;AAAA,MACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,MAC9C,MAAM,KAAK,UAAU,EAAE,eAAe,OAAO,CAAC;AAAA,IAChD,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,UAAM,IAAI;AAAA,MACR,gBAAgB,KAAK,MAAM,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MAChF;AAAA,IACF;AAAA,EACF;AAEA,MAAI,SAAS,WAAW,KAAK;AAC3B,UAAMA,QAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACpD,QAAIA,MAAK,UAAU,iBAAiB;AAClC,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,IAAI;AAAA,MACR;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,MAAI,CAAC,SAAS,IAAI;AAChB,UAAM,IAAI,aAAa,qBAAqB,SAAS,MAAM,uBAAuB,mBAAmB;AAAA,EACvG;AAEA,QAAM,OAAQ,MAAM,SAAS,KAAK,EAAE,MAAM,MAAM,IAAI;AAGpD,MACE,CAAC,QACD,OAAO,KAAK,iBAAiB,YAC7B,OAAO,KAAK,kBAAkB,YAC9B,KAAK,aAAa,WAAW,KAC7B,KAAK,cAAc,WAAW,GAC9B;AACA,UAAM,IAAI,aAAa,2DAA2D,cAAc;AAAA,EAClG;AAGA,QAAM,MAAM,KAAK,KAAK,SAAS,KAAK,aAAa;AAEjD,QAAM,cAAc,KAAK;AAGzB,QAAM,UAAU,iBAAiB,WAAW;AAC5C,QAAM,MAAM,SAAS;AACrB,MAAI,OAAO,QAAQ,YAAY,OAAO,SAAS,GAAG,GAAG;AACnD,UAAM,eAAe,MAAM,MAAM;AACjC,UAAM,IAAI,UAAU,EAAE,aAAa,YAAY,CAAC;AAAA,EAClD;AAGA,SAAO;AACT;","names":["body"]}