debuganything 0.0.0-stage → 1.0.0

package/dist/chunk-STFC7C5C.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/safety.ts"],"sourcesContent":["/**\n * Safety guards. Build this before adapters, use it from every adapter.\n *\n * - Read-only by default. v0 tools only observe.\n * - Hard caps: wall clock ≤ 60 s per tool (tcpdump ≤ 30 s), raw output ≤ 50 MB\n *   on disk then the child is killed, payload returned to the agent ≤ 16 KB.\n * - Never auto-sudo. Report the exact command the user could run instead.\n * - Scoping: adapters only touch the attached pid tree / container.\n * - Secrets: redact obvious tokens in excerpts; raw artifacts stay untouched.\n */\nimport { execa, type Options as ExecaOptions, type ResultPromise } from \"execa\";\nimport { createWriteStream, type WriteStream } from \"node:fs\";\nimport { stat } from \"node:fs/promises\";\n\nexport const LIMITS = {\n  MAX_TOOL_WALL_MS: 60_000,\n  MAX_CAPTURE_WALL_MS: 30_000,\n  MAX_RAW_BYTES: 50 * 1024 * 1024,\n  MAX_PAYLOAD_BYTES: 16 * 1024,\n  MAX_EXCERPT_LINES: 40,\n  /** Grace between SIGTERM and SIGKILL. */\n  KILL_GRACE_MS: 2_000,\n  /** Extra slack on top of the requested duration before we SIGTERM the child. */\n  DURATION_SLACK_MS: 5_000,\n} as const;\n\n/** Tools that MUST have consent: true to run. The SKILL tells agents to ask the user. */\nexport const CONSENT_REQUIRED: ReadonlySet<string> = new Set([\"capture_traffic\"]);\n\n/** Tools that are side-effect-free observation. Everything in v0. */\nexport const READ_ONLY_TOOLS: ReadonlySet<string> = new Set([\n  \"readiness\",\n  \"attach\",\n  \"detach\",\n  \"list_processes\",\n  \"trace_syscalls\",\n  \"profile_cpu\",\n  \"dump_stacks\",\n  \"inspect_sockets\",\n  \"inspect_files\",\n  \"capture_traffic\",\n  \"snapshot_memory\",\n  \"diff_runs\",\n  \"container_info\",\n  \"report\",\n]);\n\nexport class ConsentRequiredError extends Error {\n  constructor(tool: string) {\n    super(`${tool} requires consent: true. Ask the user before passing it — the output may contain secrets or affect the target.`);\n    this.name = \"ConsentRequiredError\";\n  }\n}\n\nexport function requireConsent(tool: string, args: { consent?: boolean }): void {\n  if (CONSENT_REQUIRED.has(tool) && args.consent !== true) throw new ConsentRequiredError(tool);\n}\n\n/** Clamp a requested duration to the per-tool cap. Returns seconds. */\nexport function clampDuration(seconds: number | undefined, fallback: number, maxMs: number = LIMITS.MAX_TOOL_WALL_MS): number {\n  const max = Math.floor(maxMs / 1000);\n  const v = seconds ?? fallback;\n  if (!Number.isFinite(v) || v < 1) return 1;\n  return Math.min(Math.floor(v), max);\n}\n\n/** Validate a pid argument strictly so it can never become shell text. */\nexport function assertPid(pid: unknown): number {\n  if (typeof pid !== \"number\" || !Number.isInteger(pid) || pid <= 0 || pid > 4_194_304) {\n    throw new Error(`invalid pid: ${String(pid)}`);\n  }\n  return pid;\n}\n\n/** Container names / ids / pod names: conservative charset. */\nexport function assertSafeIdentifier(s: string, what = \"identifier\"): string {\n  if (!/^[A-Za-z0-9][A-Za-z0-9_.:/-]{0,253}$/.test(s)) throw new Error(`unsafe ${what}: ${JSON.stringify(s)}`);\n  return s;\n}\n\n/** BPF filter fragments the user may add. Refuse shell-ish or capture-widening content. */\nexport function assertSafeBpfFragment(s: string): string {\n  if (s.length > 200) throw new Error(\"filter too long\");\n  if (!/^[A-Za-z0-9 .:_\\-()&|!=<>[\\]]+$/.test(s)) throw new Error(`unsafe filter: ${JSON.stringify(s)}`);\n  return s;\n}\n\n// ---------------------------------------------------------------------------\n// Running subprocesses with caps\n// ---------------------------------------------------------------------------\n\nexport interface CappedRunOptions {\n  /** Kill after this many ms (SIGTERM, then SIGKILL after KILL_GRACE_MS). */\n  timeoutMs: number;\n  /** If set, stream stdout to this file and cap it at MAX_RAW_BYTES. */\n  stdoutFile?: string;\n  /** If set, stream stderr to this file too (same cap pool). */\n  stderrFile?: string;\n  /** Capture stdout/stderr into memory (capped at MAX_RAW_BYTES). Default true unless *File is set. */\n  captureInMemory?: boolean;\n  cwd?: string;\n  env?: NodeJS.ProcessEnv;\n  /** Children are tracked for cleanup on exit/detach. */\n  track?: (child: ResultPromise) => void;\n  input?: string;\n}\n\nexport interface CappedRunResult {\n  exitCode: number | null;\n  signal: string | null;\n  stdout: string;\n  stderr: string;\n  /** True if we killed it because of the time cap. */\n  timedOut: boolean;\n  /** True if we killed it because the output cap was hit. */\n  outputCapped: boolean;\n  bytesWritten: number;\n  durationMs: number;\n  command: string;\n}\n\nconst children = new Set<ResultPromise>();\nlet exitHooked = false;\n\nfunction hookExit(): void {\n  if (exitHooked) return;\n  exitHooked = true;\n  const killAll = () => {\n    for (const c of children) {\n      try {\n        c.kill(\"SIGTERM\");\n      } catch {\n        /* ignore */\n      }\n    }\n  };\n  process.once(\"exit\", killAll);\n  for (const sig of [\"SIGINT\", \"SIGTERM\", \"SIGHUP\"] as const) {\n    process.once(sig, () => {\n      killAll();\n      process.exit(130);\n    });\n  }\n}\n\n/** Kill every tracked child (used by detach and on server shutdown). */\nexport function killTrackedChildren(): number {\n  let n = 0;\n  for (const c of children) {\n    try {\n      c.kill(\"SIGTERM\");\n      n++;\n    } catch {\n      /* ignore */\n    }\n  }\n  children.clear();\n  return n;\n}\n\n/**\n * Run a command with time and output caps. Never goes through a shell —\n * `file` and `args` are passed verbatim to execa.\n */\nexport async function runCapped(file: string, args: readonly string[], opts: CappedRunOptions): Promise<CappedRunResult> {\n  hookExit();\n  const started = Date.now();\n  const timeoutMs = Math.min(opts.timeoutMs, LIMITS.MAX_TOOL_WALL_MS + LIMITS.DURATION_SLACK_MS);\n  const useFiles = Boolean(opts.stdoutFile || opts.stderrFile);\n  const captureInMemory = opts.captureInMemory ?? !useFiles;\n\n  const execaOpts: ExecaOptions = {\n    reject: false,\n    timeout: timeoutMs,\n    killSignal: \"SIGTERM\",\n    forceKillAfterDelay: LIMITS.KILL_GRACE_MS,\n    cwd: opts.cwd,\n    env: opts.env,\n    input: opts.input,\n    stdin: opts.input === undefined ? \"ignore\" : \"pipe\",\n    buffer: false,\n    stdout: \"pipe\",\n    stderr: \"pipe\",\n    all: false,\n    stripFinalNewline: false,\n  };\n\n  const child = execa(file, args as string[], execaOpts);\n  children.add(child);\n  opts.track?.(child);\n\n  let bytes = 0;\n  let outputCapped = false;\n  const outChunks: Buffer[] = [];\n  const errChunks: Buffer[] = [];\n  const streams: WriteStream[] = [];\n  const outFile = opts.stdoutFile ? createWriteStream(opts.stdoutFile) : null;\n  const errFile = opts.stderrFile ? createWriteStream(opts.stderrFile) : null;\n  if (outFile) streams.push(outFile);\n  if (errFile) streams.push(errFile);\n\n  const onChunk = (chunk: Buffer, memory: Buffer[], sink: WriteStream | null) => {\n    bytes += chunk.length;\n    if (bytes > LIMITS.MAX_RAW_BYTES) {\n      if (!outputCapped) {\n        outputCapped = true;\n        try {\n          child.kill(\"SIGTERM\");\n        } catch {\n          /* ignore */\n        }\n      }\n      return;\n    }\n    if (sink) sink.write(chunk);\n    if (captureInMemory) memory.push(chunk);\n  };\n\n  child.stdout?.on(\"data\", (c: Buffer) => onChunk(c, outChunks, outFile));\n  child.stderr?.on(\"data\", (c: Buffer) => onChunk(c, errChunks, errFile));\n\n  const result = await child;\n  children.delete(child);\n  await Promise.all(\n    streams.map(\n      (s) =>\n        new Promise<void>((res) => {\n          s.end(() => res());\n        }),\n    ),\n  );\n\n  return {\n    exitCode: typeof result.exitCode === \"number\" ? result.exitCode : null,\n    signal: result.signal ?? null,\n    stdout: Buffer.concat(outChunks).toString(\"utf8\"),\n    stderr: Buffer.concat(errChunks).toString(\"utf8\"),\n    timedOut: Boolean(result.timedOut),\n    outputCapped,\n    bytesWritten: bytes,\n    durationMs: Date.now() - started,\n    command: [file, ...args].join(\" \"),\n  };\n}\n\nexport async function fileSize(path: string): Promise<number> {\n  try {\n    return (await stat(path)).size;\n  } catch {\n    return 0;\n  }\n}\n\n// ---------------------------------------------------------------------------\n// Privilege helpers\n// ---------------------------------------------------------------------------\n\nexport function isRoot(): boolean {\n  return typeof process.getuid === \"function\" && process.getuid() === 0;\n}\n\n/** Message for a tool that needs root we do not have. Never runs sudo itself. */\nexport function rootRequiredLimitation(tool: string, command: string): string {\n  return `${tool} needs elevated privileges and Debug Anything never escalates on its own. Run it yourself (sudo ${command}), save the output to a file, then: debuganything import <tool> <file> --session <id>`;\n}\n\n/** Detect \"permission denied\"-class failures from tool stderr. */\nexport function looksLikePermissionError(stderr: string): boolean {\n  return /operation not permitted|permission denied|ptrace.*(denied|not permitted)|EPERM|must be (run as )?root|you don't have permission|not permitted to attach|lacks permission|requires? (super ?user|root)/i.test(\n    stderr,\n  );\n}\n\n// ---------------------------------------------------------------------------\n// Redaction — applied to everything returned to the agent, never to raw artifacts\n// ---------------------------------------------------------------------------\n\nconst REDACTIONS: Array<[RegExp, string]> = [\n  [/(authorization\\s*[:=]\\s*)?bearer\\s+[A-Za-z0-9\\-._~+/]+=*/gi, \"Bearer [REDACTED]\"],\n  [/AKIA[0-9A-Z]{16}/g, \"AKIA[REDACTED]\"],\n  [/(aws_secret_access_key|aws_session_token)\\s*[=:]\\s*\\S+/gi, \"$1=[REDACTED]\"],\n  [/(password|passwd|pwd|secret|token|api[_-]?key|apikey|access[_-]?key|private[_-]?key)(\\s*[=:]\\s*)([\"']?)[^\\s\"'&;,]{4,}\\3/gi, \"$1$2$3[REDACTED]$3\"],\n  [/eyJ[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}\\.[A-Za-z0-9_-]{10,}/g, \"[REDACTED_JWT]\"],\n  [/(sk|pk|rk)_(live|test)_[A-Za-z0-9]{10,}/g, \"$1_$2_[REDACTED]\"],\n  [/gh[pousr]_[A-Za-z0-9]{20,}/g, \"gh*_[REDACTED]\"],\n  [/xox[baprs]-[A-Za-z0-9-]{10,}/g, \"xox*-[REDACTED]\"],\n  [/-----BEGIN [A-Z ]*PRIVATE KEY-----[\\s\\S]*?-----END [A-Z ]*PRIVATE KEY-----/g, \"[REDACTED_PRIVATE_KEY]\"],\n  [/(https?:\\/\\/)([^\\s:@/]+):([^\\s@/]+)@/gi, \"$1$2:[REDACTED]@\"],\n];\n\nexport function redact(text: string): string {\n  let out = text;\n  for (const [re, rep] of REDACTIONS) out = out.replace(re, rep);\n  return out;\n}\n\n/** Deep-redact strings inside an arbitrary JSON-like value. */\nexport function redactDeep<T>(value: T): T {\n  if (typeof value === \"string\") return redact(value) as unknown as T;\n  if (Array.isArray(value)) return value.map((v) => redactDeep(v)) as unknown as T;\n  if (value && typeof value === \"object\") {\n    const out: Record<string, unknown> = {};\n    for (const [k, v] of Object.entries(value as Record<string, unknown>)) out[k] = redactDeep(v);\n    return out as T;\n  }\n  return value;\n}\n\n// ---------------------------------------------------------------------------\n// Payload cap\n// ---------------------------------------------------------------------------\n\n/**\n * Enforce the 16 KB payload cap on a ToolResult-like object by progressively\n * trimming evidence data (largest first: halve arrays, then collapse objects\n * and strings to pointers), then dropping uncited evidence. Evidence cited by\n * a finding is never dropped. Adds a limitation noting the trim. Pure.\n */\nexport function capPayload<T extends { evidence: Array<{ id?: string; data: unknown; summary: string }>; findings?: Array<{ evidence_ids: string[] }>; limitations: string[] }>(result: T, max = LIMITS.MAX_PAYLOAD_BYTES): T {\n  const size = (o: unknown) => Buffer.byteLength(JSON.stringify(o), \"utf8\");\n  if (size(result) <= max) return result;\n\n  const r = structuredClone(result);\n  let trimmed = false;\n  const cited = new Set((r.findings ?? []).flatMap((f) => f.evidence_ids));\n  for (let pass = 0; pass < 40 && size(r) > max; pass++) {\n    const byLen = r.evidence.map((e, i) => ({ i, n: size(e.data) })).sort((a, b) => b.n - a.n);\n    const top = byLen[0];\n    if (!top || top.n < 64) break;\n    const e = r.evidence[top.i]!;\n    if (Array.isArray(e.data) && e.data.length > 5) e.data = e.data.slice(0, Math.max(5, Math.floor(e.data.length / 2)));\n    else if (Array.isArray(e.data)) e.data = { _trimmed: true, kept: e.data.length, note: \"see artifact\" };\n    else if (typeof e.data === \"string\") e.data = e.data.slice(0, Math.max(64, Math.floor(e.data.length / 2))) + \"…\";\n    else if (e.data && typeof e.data === \"object\") e.data = { _trimmed: true, keys: Object.keys(e.data as object).slice(0, 20) };\n    else break;\n    trimmed = true;\n  }\n  if (size(r) > max) {\n    const keep = r.evidence.filter((e, i) => i < 10 || (e.id && cited.has(e.id)));\n    if (keep.length < r.evidence.length) {\n      r.evidence = keep;\n      trimmed = true;\n    }\n  }\n  if (trimmed) r.limitations.push(`payload trimmed to fit the ${Math.floor(max / 1024)} KB cap; full data is in the artifacts`);\n  return r;\n}\n"],"mappings":";;;AAUA,SAAS,aAA+D;AACxE,SAAS,yBAA2C;AACpD,SAAS,YAAY;AAEd,IAAM,SAAS;AAAA,EACpB,kBAAkB;AAAA,EAClB,qBAAqB;AAAA,EACrB,eAAe,KAAK,OAAO;AAAA,EAC3B,mBAAmB,KAAK;AAAA,EACxB,mBAAmB;AAAA;AAAA,EAEnB,eAAe;AAAA;AAAA,EAEf,mBAAmB;AACrB;AAGO,IAAM,mBAAwC,oBAAI,IAAI,CAAC,iBAAiB,CAAC;AAoBzE,IAAM,uBAAN,cAAmC,MAAM;AAAA,EAC9C,YAAY,MAAc;AACxB,UAAM,GAAG,IAAI,qHAAgH;AAC7H,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,eAAe,MAAc,MAAmC;AAC9E,MAAI,iBAAiB,IAAI,IAAI,KAAK,KAAK,YAAY,KAAM,OAAM,IAAI,qBAAqB,IAAI;AAC9F;AAGO,SAAS,cAAc,SAA6B,UAAkB,QAAgB,OAAO,kBAA0B;AAC5H,QAAM,MAAM,KAAK,MAAM,QAAQ,GAAI;AACnC,QAAM,IAAI,WAAW;AACrB,MAAI,CAAC,OAAO,SAAS,CAAC,KAAK,IAAI,EAAG,QAAO;AACzC,SAAO,KAAK,IAAI,KAAK,MAAM,CAAC,GAAG,GAAG;AACpC;AAGO,SAAS,UAAU,KAAsB;AAC9C,MAAI,OAAO,QAAQ,YAAY,CAAC,OAAO,UAAU,GAAG,KAAK,OAAO,KAAK,MAAM,SAAW;AACpF,UAAM,IAAI,MAAM,gBAAgB,OAAO,GAAG,CAAC,EAAE;AAAA,EAC/C;AACA,SAAO;AACT;AAGO,SAAS,qBAAqB,GAAW,OAAO,cAAsB;AAC3E,MAAI,CAAC,uCAAuC,KAAK,CAAC,EAAG,OAAM,IAAI,MAAM,UAAU,IAAI,KAAK,KAAK,UAAU,CAAC,CAAC,EAAE;AAC3G,SAAO;AACT;AAGO,SAAS,sBAAsB,GAAmB;AACvD,MAAI,EAAE,SAAS,IAAK,OAAM,IAAI,MAAM,iBAAiB;AACrD,MAAI,CAAC,kCAAkC,KAAK,CAAC,EAAG,OAAM,IAAI,MAAM,kBAAkB,KAAK,UAAU,CAAC,CAAC,EAAE;AACrG,SAAO;AACT;AAoCA,IAAM,WAAW,oBAAI,IAAmB;AACxC,IAAI,aAAa;AAEjB,SAAS,WAAiB;AACxB,MAAI,WAAY;AAChB,eAAa;AACb,QAAM,UAAU,MAAM;AACpB,eAAW,KAAK,UAAU;AACxB,UAAI;AACF,UAAE,KAAK,SAAS;AAAA,MAClB,QAAQ;AAAA,MAER;AAAA,IACF;AAAA,EACF;AACA,UAAQ,KAAK,QAAQ,OAAO;AAC5B,aAAW,OAAO,CAAC,UAAU,WAAW,QAAQ,GAAY;AAC1D,YAAQ,KAAK,KAAK,MAAM;AACtB,cAAQ;AACR,cAAQ,KAAK,GAAG;AAAA,IAClB,CAAC;AAAA,EACH;AACF;AAGO,SAAS,sBAA8B;AAC5C,MAAI,IAAI;AACR,aAAW,KAAK,UAAU;AACxB,QAAI;AACF,QAAE,KAAK,SAAS;AAChB;AAAA,IACF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,WAAS,MAAM;AACf,SAAO;AACT;AAMA,eAAsB,UAAU,MAAc,MAAyB,MAAkD;AACvH,WAAS;AACT,QAAM,UAAU,KAAK,IAAI;AACzB,QAAM,YAAY,KAAK,IAAI,KAAK,WAAW,OAAO,mBAAmB,OAAO,iBAAiB;AAC7F,QAAM,WAAW,QAAQ,KAAK,cAAc,KAAK,UAAU;AAC3D,QAAM,kBAAkB,KAAK,mBAAmB,CAAC;AAEjD,QAAM,YAA0B;AAAA,IAC9B,QAAQ;AAAA,IACR,SAAS;AAAA,IACT,YAAY;AAAA,IACZ,qBAAqB,OAAO;AAAA,IAC5B,KAAK,KAAK;AAAA,IACV,KAAK,KAAK;AAAA,IACV,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK,UAAU,SAAY,WAAW;AAAA,IAC7C,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,QAAQ;AAAA,IACR,KAAK;AAAA,IACL,mBAAmB;AAAA,EACrB;AAEA,QAAM,QAAQ,MAAM,MAAM,MAAkB,SAAS;AACrD,WAAS,IAAI,KAAK;AAClB,OAAK,QAAQ,KAAK;AAElB,MAAI,QAAQ;AACZ,MAAI,eAAe;AACnB,QAAM,YAAsB,CAAC;AAC7B,QAAM,YAAsB,CAAC;AAC7B,QAAM,UAAyB,CAAC;AAChC,QAAM,UAAU,KAAK,aAAa,kBAAkB,KAAK,UAAU,IAAI;AACvE,QAAM,UAAU,KAAK,aAAa,kBAAkB,KAAK,UAAU,IAAI;AACvE,MAAI,QAAS,SAAQ,KAAK,OAAO;AACjC,MAAI,QAAS,SAAQ,KAAK,OAAO;AAEjC,QAAM,UAAU,CAAC,OAAe,QAAkB,SAA6B;AAC7E,aAAS,MAAM;AACf,QAAI,QAAQ,OAAO,eAAe;AAChC,UAAI,CAAC,cAAc;AACjB,uBAAe;AACf,YAAI;AACF,gBAAM,KAAK,SAAS;AAAA,QACtB,QAAQ;AAAA,QAER;AAAA,MACF;AACA;AAAA,IACF;AACA,QAAI,KAAM,MAAK,MAAM,KAAK;AAC1B,QAAI,gBAAiB,QAAO,KAAK,KAAK;AAAA,EACxC;AAEA,QAAM,QAAQ,GAAG,QAAQ,CAAC,MAAc,QAAQ,GAAG,WAAW,OAAO,CAAC;AACtE,QAAM,QAAQ,GAAG,QAAQ,CAAC,MAAc,QAAQ,GAAG,WAAW,OAAO,CAAC;AAEtE,QAAM,SAAS,MAAM;AACrB,WAAS,OAAO,KAAK;AACrB,QAAM,QAAQ;AAAA,IACZ,QAAQ;AAAA,MACN,CAAC,MACC,IAAI,QAAc,CAAC,QAAQ;AACzB,UAAE,IAAI,MAAM,IAAI,CAAC;AAAA,MACnB,CAAC;AAAA,IACL;AAAA,EACF;AAEA,SAAO;AAAA,IACL,UAAU,OAAO,OAAO,aAAa,WAAW,OAAO,WAAW;AAAA,IAClE,QAAQ,OAAO,UAAU;AAAA,IACzB,QAAQ,OAAO,OAAO,SAAS,EAAE,SAAS,MAAM;AAAA,IAChD,QAAQ,OAAO,OAAO,SAAS,EAAE,SAAS,MAAM;AAAA,IAChD,UAAU,QAAQ,OAAO,QAAQ;AAAA,IACjC;AAAA,IACA,cAAc;AAAA,IACd,YAAY,KAAK,IAAI,IAAI;AAAA,IACzB,SAAS,CAAC,MAAM,GAAG,IAAI,EAAE,KAAK,GAAG;AAAA,EACnC;AACF;AAEA,eAAsB,SAAS,MAA+B;AAC5D,MAAI;AACF,YAAQ,MAAM,KAAK,IAAI,GAAG;AAAA,EAC5B,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAMO,SAAS,SAAkB;AAChC,SAAO,OAAO,QAAQ,WAAW,cAAc,QAAQ,OAAO,MAAM;AACtE;AAGO,SAAS,uBAAuB,MAAc,SAAyB;AAC5E,SAAO,GAAG,IAAI,mGAAmG,OAAO;AAC1H;AAGO,SAAS,yBAAyB,QAAyB;AAChE,SAAO,yMAAyM;AAAA,IAC9M;AAAA,EACF;AACF;AAMA,IAAM,aAAsC;AAAA,EAC1C,CAAC,8DAA8D,mBAAmB;AAAA,EAClF,CAAC,qBAAqB,gBAAgB;AAAA,EACtC,CAAC,4DAA4D,eAAe;AAAA,EAC5E,CAAC,6HAA6H,oBAAoB;AAAA,EAClJ,CAAC,kEAAkE,gBAAgB;AAAA,EACnF,CAAC,4CAA4C,kBAAkB;AAAA,EAC/D,CAAC,+BAA+B,gBAAgB;AAAA,EAChD,CAAC,iCAAiC,iBAAiB;AAAA,EACnD,CAAC,+EAA+E,wBAAwB;AAAA,EACxG,CAAC,0CAA0C,kBAAkB;AAC/D;AAEO,SAAS,OAAO,MAAsB;AAC3C,MAAI,MAAM;AACV,aAAW,CAAC,IAAI,GAAG,KAAK,WAAY,OAAM,IAAI,QAAQ,IAAI,GAAG;AAC7D,SAAO;AACT;AAGO,SAAS,WAAc,OAAa;AACzC,MAAI,OAAO,UAAU,SAAU,QAAO,OAAO,KAAK;AAClD,MAAI,MAAM,QAAQ,KAAK,EAAG,QAAO,MAAM,IAAI,CAAC,MAAM,WAAW,CAAC,CAAC;AAC/D,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,MAA+B,CAAC;AACtC,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,KAAgC,EAAG,KAAI,CAAC,IAAI,WAAW,CAAC;AAC5F,WAAO;AAAA,EACT;AACA,SAAO;AACT;AAYO,SAAS,WAAgK,QAAW,MAAM,OAAO,mBAAsB;AAC5N,QAAM,OAAO,CAAC,MAAe,OAAO,WAAW,KAAK,UAAU,CAAC,GAAG,MAAM;AACxE,MAAI,KAAK,MAAM,KAAK,IAAK,QAAO;AAEhC,QAAM,IAAI,gBAAgB,MAAM;AAChC,MAAI,UAAU;AACd,QAAM,QAAQ,IAAI,KAAK,EAAE,YAAY,CAAC,GAAG,QAAQ,CAAC,MAAM,EAAE,YAAY,CAAC;AACvE,WAAS,OAAO,GAAG,OAAO,MAAM,KAAK,CAAC,IAAI,KAAK,QAAQ;AACrD,UAAM,QAAQ,EAAE,SAAS,IAAI,CAACA,IAAG,OAAO,EAAE,GAAG,GAAG,KAAKA,GAAE,IAAI,EAAE,EAAE,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,IAAI,EAAE,CAAC;AACzF,UAAM,MAAM,MAAM,CAAC;AACnB,QAAI,CAAC,OAAO,IAAI,IAAI,GAAI;AACxB,UAAM,IAAI,EAAE,SAAS,IAAI,CAAC;AAC1B,QAAI,MAAM,QAAQ,EAAE,IAAI,KAAK,EAAE,KAAK,SAAS,EAAG,GAAE,OAAO,EAAE,KAAK,MAAM,GAAG,KAAK,IAAI,GAAG,KAAK,MAAM,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC;AAAA,aAC1G,MAAM,QAAQ,EAAE,IAAI,EAAG,GAAE,OAAO,EAAE,UAAU,MAAM,MAAM,EAAE,KAAK,QAAQ,MAAM,eAAe;AAAA,aAC5F,OAAO,EAAE,SAAS,SAAU,GAAE,OAAO,EAAE,KAAK,MAAM,GAAG,KAAK,IAAI,IAAI,KAAK,MAAM,EAAE,KAAK,SAAS,CAAC,CAAC,CAAC,IAAI;AAAA,aACpG,EAAE,QAAQ,OAAO,EAAE,SAAS,SAAU,GAAE,OAAO,EAAE,UAAU,MAAM,MAAM,OAAO,KAAK,EAAE,IAAc,EAAE,MAAM,GAAG,EAAE,EAAE;AAAA,QACtH;AACL,cAAU;AAAA,EACZ;AACA,MAAI,KAAK,CAAC,IAAI,KAAK;AACjB,UAAM,OAAO,EAAE,SAAS,OAAO,CAAC,GAAG,MAAM,IAAI,MAAO,EAAE,MAAM,MAAM,IAAI,EAAE,EAAE,CAAE;AAC5E,QAAI,KAAK,SAAS,EAAE,SAAS,QAAQ;AACnC,QAAE,WAAW;AACb,gBAAU;AAAA,IACZ;AAAA,EACF;AACA,MAAI,QAAS,GAAE,YAAY,KAAK,8BAA8B,KAAK,MAAM,MAAM,IAAI,CAAC,wCAAwC;AAC5H,SAAO;AACT;","names":["e"]}