reeval 0.0.1

package/dist/environment-Mz7wvrtD.js

@@ -0,0 +1,552 @@
+import { t as UsageError } from "./errors-CSxfJ4qu.js";
+import { n as SECRET_NAME } from "./redact-C4fL_bZP.js";
+import { i as PACKAGE_DIR, n as COMPILED } from "./root-CFDjpWuc.js";
+import { dirname, isAbsolute, join, normalize, resolve, sep } from "node:path";
+import { isIP } from "node:net";
+import { fileURLToPath } from "node:url";
+//#region src/duration.ts
+const UNITS = {
+	ms: 1,
+	s: 1e3,
+	m: 6e4,
+	h: 36e5
+};
+/** A duration in milliseconds, more than zero: `90s`, `15m` or a number of milliseconds. */
+function parseDuration(value) {
+	let ms = value;
+	if (typeof value === "string") {
+		const match = /^(\d+(?:\.\d+)?)(ms|s|m|h)$/.exec(value);
+		if (!match) throw new UsageError(`Invalid duration "${value}". Use e.g. "90s" or "15m".`);
+		ms = Number(match[1]) * UNITS[match[2]];
+	}
+	if (!(ms > 0 && Number.isFinite(ms))) {
+		const shown = typeof value === "string" ? `"${value}"` : String(value);
+		throw new UsageError(`Invalid duration ${shown}. A duration is more than zero: use e.g. "90s" or "15m".`);
+	}
+	return ms;
+}
+//#endregion
+//#region src/environment.ts
+var DefinitionError = class extends Error {
+	name = "DefinitionError";
+};
+const NAME = /^[A-Za-z0-9][A-Za-z0-9._@+-]*$/;
+const VAR = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const SPEC_KEYS = [
+	"workspace",
+	"env",
+	"egress",
+	"files",
+	"rules",
+	"setup",
+	"skills",
+	"mcp"
+];
+/** Image fields that belong on the sandbox, not the environment. */
+const SANDBOX_KEYS = [
+	"image",
+	"install",
+	"dockerfile",
+	"from"
+];
+const SPEC_HINTS = {
+	exec: "setup",
+	steps: "setup",
+	run: "setup",
+	vars: "env",
+	secrets: "env",
+	network: "egress",
+	networkPolicy: "egress",
+	skill: "skills",
+	file: "files",
+	agents: "rules",
+	use: "extend",
+	repo: "workspace",
+	git: "workspace",
+	template: "workspace"
+};
+const isSecret = (value) => typeof value === "object" && value !== null && value.kind === "secret";
+const isSecretTemplate = (value) => typeof value === "object" && value !== null && value.kind === "secret-template";
+const isHostFile = (value) => typeof value === "object" && value !== null && value.kind === "file";
+const isEnvironment = (value) => typeof value === "object" && value !== null && value.kind === "environment" && Array.isArray(value.layers);
+const OWN_DIRS = COMPILED ? [join(PACKAGE_DIR, sep)] : ["src", "dist"].map((dir) => join(PACKAGE_DIR, dir, sep));
+/** The directory of the file that called into reeval, from the stack; relative paths resolve here. */
+function callerDir() {
+	const limit = Error.stackTraceLimit;
+	Error.stackTraceLimit = 30;
+	const stack = (/* @__PURE__ */ new Error()).stack ?? "";
+	Error.stackTraceLimit = limit;
+	for (const line of stack.split("\n").slice(1)) {
+		const match = /(?:\(|at )((?:file:\/\/)?\/[^()]*?|[A-Za-z]:[\\/][^()]*?):\d+:\d+\)?\s*$/.exec(line);
+		if (!match?.[1]) continue;
+		const file = normalize(match[1].startsWith("file://") ? fileURLToPath(match[1]) : match[1]);
+		if (OWN_DIRS.some((d) => file.startsWith(d)) || file.includes(`${sep}node_modules${sep}`)) continue;
+		return dirname(file);
+	}
+}
+const toPath = (value, base) => {
+	const path = value instanceof URL ? fileURLToPath(value) : value;
+	return isAbsolute(path) ? path : resolve(base, path);
+};
+/**
+* A tarball or folder spec (`./x.tgz`, `../pkg`, `/abs`, `file:…`) as an absolute path, resolved
+* like `file()`; npm resolves relative ones against its working directory, reeval's cache.
+*/
+const localNpmSpec = (spec, base) => {
+	const path = spec.startsWith("file:") ? spec.slice(5) : spec;
+	return /^\.{1,2}(?:\/|$)/.test(path) || isAbsolute(path) ? toPath(path, base) : spec;
+};
+/** A host name, or `*.` and a domain for its subdomains. */
+const HOST = /^(?:\*\.)?[a-z0-9](?:[a-z0-9-]*[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]*[a-z0-9])?)*$/i;
+const SUBSTITUTE_IN = [
+	"header",
+	"query",
+	"body"
+];
+/** Why `host` isn't a host name or `*.` pattern, or undefined when it is one. */
+function badHost(host) {
+	if (typeof host === "string" && HOST.test(host)) {
+		const name = host.replace(/^\*\./, "");
+		if (/(?:^|\.)\d+$/.test(name) && (name !== host || isIP(name) !== 4)) return `'${host}' isn't a host name or an IPv4 address, and a *. pattern never matches an address.`;
+		if (name !== host && !name.includes(".")) return `'${host}' would allow every host under .${name}; name the domain, e.g. '*.example.${name}'.`;
+		return;
+	}
+	if (typeof host === "string" && /^[a-z]+:\/\//i.test(host)) return `hosts are host names, not URLs: use '${new URL(host).hostname}' (got '${host}')`;
+	if (typeof host === "string" && /^[^:/]+:\d+$/.test(host)) return `hosts are host names without a port: use '${host.split(":")[0]}' (got '${host}')`;
+	return `${JSON.stringify(host)} isn't a host. Use a name like 'api.example.com', or '*.example.com' for its subdomains.`;
+}
+/** Throws unless `value` is `'allow-all'`, `'deny-all'` or `{ allow: [hosts] }`. */
+function checkEgress(value, where, Err = DefinitionError) {
+	if (value === "allow-all" || value === "deny-all") return;
+	const shape = `egress is 'allow-all' (the default), 'deny-all', or { allow: ['api.example.com', '*.example.org'] }`;
+	if (typeof value !== "object" || value === null || Array.isArray(value)) {
+		const list = Array.isArray(value) ? ` For a list of hosts, use { allow: ${JSON.stringify(value)} }.` : "";
+		throw new Err(`${shape} (got ${JSON.stringify(value)}) in ${where}.${list}`);
+	}
+	for (const key of Object.keys(value)) {
+		if (key === "allow") continue;
+		throw new Err(`Unknown egress key "${key}" in ${where}.${key === "deny" ? " A policy lists what's allowed; everything else is refused." : key === "hosts" || key === "allowedHosts" ? " Did you mean \"allow\"?" : ""}`);
+	}
+	const allow = value.allow;
+	if (!Array.isArray(allow)) throw new Err(`${shape} (got ${JSON.stringify(value)}) in ${where}`);
+	for (const host of allow) {
+		const bad = badHost(host);
+		if (bad) throw new Err(`egress.allow in ${where}: ${bad}`);
+	}
+}
+const SECRET_HOSTS = Object.freeze({
+	gemini: Object.freeze(["generativelanguage.googleapis.com"]),
+	openai: Object.freeze(["api.openai.com"]),
+	anthropic: Object.freeze(["api.anthropic.com"]),
+	github: Object.freeze(["api.github.com", "uploads.github.com"])
+});
+function secretOptions(options, what) {
+	const to = options.to ?? "agent";
+	if (to !== "agent" && to !== "checks") throw new DefinitionError(`${what}: to must be 'agent' or 'checks'`);
+	const { hosts } = options;
+	if (hosts !== void 0) {
+		if (!Array.isArray(hosts) || hosts.length === 0) throw new DefinitionError(`${what}: hosts must list the hosts the secret is sent to, e.g. hosts: ['api.example.com'] or secret.hosts.gemini (got ${JSON.stringify(hosts)})`);
+		for (const host of hosts) {
+			const bad = badHost(host);
+			if (bad) throw new DefinitionError(`${what}: ${bad}`);
+		}
+	}
+	if (options.in !== void 0) {
+		if (hosts === void 0) throw new DefinitionError(`${what}: in only applies to a brokered secret; add hosts, e.g. { hosts: ['api.example.com'], in: ${JSON.stringify(options.in)} }`);
+		if ((Array.isArray(options.in) ? options.in.filter((i) => !SUBSTITUTE_IN.includes(i)) : [options.in]).length || options.in.length === 0) throw new DefinitionError(`${what}: in lists where the gateway substitutes: 'header', 'query' and/or 'body' (got ${JSON.stringify(options.in)})`);
+	}
+	return {
+		...options.optional ? { optional: true } : {},
+		...to === "checks" ? { to } : {},
+		...hosts ? { hosts: [...hosts] } : {},
+		...options.in ? { in: [...new Set(options.in)] } : {}
+	};
+}
+/** Where an MCP server's header secrets are brokered to by default: its own host, over HTTPS. */
+function mcpHosts(url) {
+	try {
+		const u = new URL(url);
+		return u.protocol === "https:" ? [u.hostname] : void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* Every secret among `env` and the layers' env and MCP servers, layered as the attempt resolves
+* them: a later layer's variable or MCP server replaces an earlier one of the same name.
+*/
+function plannedSecrets(env, layers) {
+	const vars = { ...env };
+	const servers = /* @__PURE__ */ new Map();
+	for (const { spec } of layers) {
+		Object.assign(vars, spec.env);
+		for (const [name, server] of Object.entries(spec.mcp ?? {})) servers.set(name, server);
+	}
+	const out = /* @__PURE__ */ new Map();
+	const add = (label, from, hosts, checksOnly = false, optional = false) => out.set(`${label}\0${from}`, {
+		label,
+		from,
+		...hosts ? { hosts } : {},
+		...checksOnly ? { checksOnly } : {},
+		...optional ? { optional } : {}
+	});
+	const fromVars = (values, prefix) => {
+		for (const [name, value] of Object.entries(values)) if (isSecret(value)) add(`${prefix}${name}`, value.from ?? name, value.hosts, value.to === "checks", value.optional === true);
+	};
+	fromVars(vars, "");
+	for (const [server, s] of servers) {
+		if (s.transport === "stdio") {
+			fromVars(s.env, `mcp.${server}.env.`);
+			continue;
+		}
+		const own = mcpHosts(s.url);
+		for (const [header, value] of Object.entries(s.headers)) {
+			const label = `mcp.${server}.headers.${header}`;
+			if (isSecret(value)) add(label, value.from ?? header, value.hosts ?? own);
+			if (isSecretTemplate(value)) for (const [, name] of value.template.matchAll(/\$\{([A-Za-z_][A-Za-z0-9_]*)\}/g)) add(label, name, own);
+		}
+	}
+	return [...out.values()];
+}
+/** The secrets the sandbox gets as real values: no `hosts`, and none implied by an MCP URL. */
+const unbrokeredSecrets = (env, layers) => plannedSecrets(env, layers).flatMap(({ hosts, ...s }) => hosts ? [] : [s]);
+function secretHelper() {
+	const secret = ((options = {}) => ({
+		kind: "secret",
+		...secretOptions(options, "secret()")
+	}));
+	secret.fromEnv = (host, options = {}) => {
+		if (typeof host !== "string" || !VAR.test(host)) throw new DefinitionError(`secret.fromEnv(${JSON.stringify(host)}) needs a host variable name`);
+		return {
+			kind: "secret",
+			from: host,
+			...secretOptions(options, `secret.fromEnv("${host}")`)
+		};
+	};
+	secret.template = (template) => ({
+		kind: "secret-template",
+		template
+	});
+	secret.hosts = SECRET_HOSTS;
+	return secret;
+}
+const MOVING = /^(?:main|master|HEAD|trunk|develop|dev|latest)$/;
+/** A git ref that isn't a commit SHA or a version-like tag. */
+const isMovingRef = (ref) => ref === void 0 || MOVING.test(ref) || !/^(?:[0-9a-f]{7,40}|v?\d+(?:\.\d+)*(?:[-+].*)?)$/.test(ref);
+/** `github:owner/repo` and GitHub `/tree/<ref>/<path>` URLs, as a clone URL plus ref and path. */
+function parseGitRepo(repo) {
+	const short = /^github:([\w.-]+\/[\w.-]+?)(?:\.git)?$/.exec(repo);
+	if (short) return { url: `https://github.com/${short[1]}.git` };
+	const tree = /^https:\/\/github\.com\/([\w.-]+\/[\w.-]+)\/tree\/([^/]+)(?:\/(.+))?$/.exec(repo);
+	if (tree) return {
+		url: `https://github.com/${tree[1]}.git`,
+		ref: tree[2],
+		path: tree[3]
+	};
+	return { url: repo };
+}
+/** `repo#ref:path`, as the plan and the record name a git workspace. */
+const workspaceLabel = (w) => `${w.repo}${w.ref ? `#${w.ref}` : ""}${w.path ? `:${w.path}` : ""}`;
+/** The workspace an attempt starts as: the last layer that sets one. */
+const workspaceOf = (layers) => layers.findLast((l) => l.spec.workspace)?.spec.workspace;
+/** A URL with its password (or an https username, which is where tokens go) masked. */
+function credentialsIn(repo) {
+	if (!URL.canParse(repo)) return void 0;
+	const u = new URL(repo);
+	if (!u.password && !(u.username && /^https?:$/.test(u.protocol))) return void 0;
+	u.username = u.username && "***";
+	u.password = u.password && "***";
+	return u.href;
+}
+const GIT_OPTIONS = [
+	"ref",
+	"path",
+	"init",
+	"token"
+];
+const isLocalPath = (repo) => /^\.{1,2}(?:\/|$)/.test(repo) || isAbsolute(repo);
+function gitHelper(base) {
+	return (repo, options = {}) => {
+		const written = repo instanceof URL ? repo.href : repo;
+		if (typeof written !== "string" || !written.trim()) throw new DefinitionError(`git() needs a repository: a URL, github:owner/repo or a local path (got ${JSON.stringify(repo)})`);
+		const what = `git(${JSON.stringify(written)})`;
+		const masked = credentialsIn(written);
+		if (masked) throw new DefinitionError(`git(${JSON.stringify(masked)}): the URL has a password or token in it. reeval fetches the repository on the host with your own git credentials (a credential helper, gh auth setup-git or an SSH key), and the sandbox never gets them; remove it from the URL.`);
+		if (typeof options !== "object" || options === null || Array.isArray(options)) throw new DefinitionError(`${what}: options are { ref?, path? }`);
+		const extra = Object.keys(options).filter((k) => !GIT_OPTIONS.includes(k));
+		if (extra.length) {
+			const hint = extra.includes("branch") || extra.includes("tag") ? " Use ref for a branch, tag or commit." : "";
+			throw new DefinitionError(`${what}: unknown option "${extra.join("\", \"")}"; it takes ${GIT_OPTIONS.slice(0, -1).join(", ")} and ${GIT_OPTIONS.at(-1)}.${hint}`);
+		}
+		const local = repo instanceof URL ? repo.protocol === "file:" : isLocalPath(written);
+		const parsed = local ? { url: toPath(repo, base) } : parseGitRepo(written);
+		const ref = options.ref ?? parsed.ref;
+		if (ref !== void 0 && (typeof ref !== "string" || !ref.trim() || ref.startsWith("-"))) throw new DefinitionError(`${what}: ref is a branch, tag or commit SHA (got ${JSON.stringify(ref)})`);
+		const path = options.path ?? parsed.path;
+		if (path !== void 0) {
+			const clean = typeof path === "string" ? path.replace(/\/+$/, "") : path;
+			if (typeof clean !== "string" || !clean || clean.includes("\\") || clean.startsWith("/") || clean.split("/").some((p) => p === ".." || p === "." || p === "")) throw new DefinitionError(`${what}: path is a directory in the repository, relative, with forward slashes and no . or .. (got ${JSON.stringify(path)})`);
+		}
+		const cleanPath = path?.replace(/\/+$/, "");
+		const { init, token } = options;
+		if (init !== void 0 && typeof init !== "boolean") throw new DefinitionError(`${what}: init is true or false (got ${JSON.stringify(init)})`);
+		if (token !== void 0) {
+			if (typeof token !== "string" || !VAR.test(token) || /^(?:gh[opsur]_|github_pat_)/.test(token)) throw new DefinitionError(`${what}: token names the host variable that holds the token, e.g. token: 'GITHUB_TOKEN'. Don't put the token itself in the eval.`);
+			if (local || !/^https?:\/\//.test(parsed.url)) throw new DefinitionError(`${what}: token only works with an https:// URL; for SSH or a local repository, git uses this machine's own credentials`);
+		}
+		return {
+			kind: "git",
+			repo: "ref" in parsed || "path" in parsed ? parsed.url.replace(/\.git$/, "") : written,
+			url: parsed.url,
+			...ref ? { ref } : {},
+			...cleanPath ? { path: cleanPath } : {},
+			...init ? { init } : {},
+			...token ? { token } : {}
+		};
+	};
+}
+/**
+* What a skill directory leaves out of the sandbox unless `exclude` says otherwise: eval material
+* (skill-creator keeps `evals/` in the skill), run history and reeval eval files. `.git` is always left out.
+*/
+const DEFAULT_SKILL_EXCLUDE = [
+	"/evals/",
+	".history/",
+	"*.eval.ts"
+];
+function skillHelper(base) {
+	const placement = (p) => {
+		if (p === void 0 || p === "harness" || p === "workspace") return p ?? "harness";
+		throw new DefinitionError(`skill placement must be 'harness' or 'workspace' (got ${p})`);
+	};
+	const exclude = (e) => {
+		if (e === void 0) return {};
+		if (!Array.isArray(e) || e.some((p) => typeof p !== "string" || !p.replace(/\//g, ""))) throw new DefinitionError(`skill exclude must be an array of paths or globs, e.g. ['/evals/', '*.eval.ts'] (got ${JSON.stringify(e)})`);
+		return { exclude: [...e] };
+	};
+	return {
+		local: (path, o = {}) => ({
+			kind: "skill",
+			source: "local",
+			path: toPath(path, base),
+			...o.only ? { only: [...o.only] } : {},
+			...exclude(o.exclude),
+			placement: placement(o.placement)
+		}),
+		git: (repo, o = {}) => {
+			if (typeof repo !== "string" || !repo) throw new DefinitionError("skill.git() needs a repository URL");
+			const parsed = parseGitRepo(repo);
+			const ref = o.ref ?? parsed.ref;
+			const path = o.path ?? parsed.path;
+			return {
+				kind: "skill",
+				source: "git",
+				repo,
+				...ref ? { ref } : {},
+				...path ? { path } : {},
+				...o.only ? { only: [...o.only] } : {},
+				...exclude(o.exclude),
+				placement: placement(o.placement)
+			};
+		},
+		registry: (id, o = {}) => {
+			if (!/^[\w.-]+\/[\w.-]+@[a-z0-9-]+$/.test(id)) throw new DefinitionError(`skill.registry("${id}") needs an id like owner/repo@skill`);
+			return {
+				kind: "skill",
+				source: "registry",
+				id,
+				...o.version ? { version: o.version } : {},
+				placement: placement(o.placement)
+			};
+		},
+		npm: (spec, o = {}) => ({
+			kind: "skill",
+			source: "npm",
+			spec: localNpmSpec(spec, base),
+			path: o.path ?? "skills",
+			...o.only ? { only: [...o.only] } : {},
+			...exclude(o.exclude),
+			placement: placement(o.placement)
+		}),
+		inline: (skill, o = {}) => ({
+			kind: "skill",
+			source: "inline",
+			name: skill.name,
+			description: skill.description,
+			content: skill.content,
+			files: { ...skill.files },
+			placement: placement(o.placement)
+		})
+	};
+}
+const mcpHelper = {
+	stdio: (command, args = [], o = {}) => {
+		if (typeof command !== "string" || !command) throw new DefinitionError("mcp.stdio() needs a command");
+		return {
+			kind: "mcp",
+			transport: "stdio",
+			command,
+			args: [...args],
+			env: { ...o.env }
+		};
+	},
+	http: (url, o = {}) => ({
+		kind: "mcp",
+		transport: "http",
+		url,
+		headers: { ...o.headers }
+	}),
+	sse: (url, o = {}) => ({
+		kind: "mcp",
+		transport: "sse",
+		url,
+		headers: { ...o.headers }
+	})
+};
+/** The helpers a callback gets, with relative paths resolving against `base`. */
+function helpersFor(base) {
+	return {
+		secret: secretHelper(),
+		skill: skillHelper(base),
+		mcp: mcpHelper,
+		file: (path) => ({
+			kind: "file",
+			path: toPath(path, base)
+		}),
+		git: gitHelper(base)
+	};
+}
+/** Throws on env variables that aren't strings or secrets, or look like literal secrets. */
+function checkEnv(env, where, Err = DefinitionError) {
+	if (typeof env !== "object" || env === null || Array.isArray(env)) throw new Err(`env must be an object of variables in ${where}`);
+	for (const [name, value] of Object.entries(env)) {
+		if (!VAR.test(name)) throw new Err(`env.${name} in ${where} isn't a valid variable name`);
+		if (isSecret(value)) continue;
+		if (typeof value !== "string") throw new Err(`env.${name} in ${where} must be a string or secret.fromEnv()`);
+		if (SECRET_NAME.test(name)) throw new Err(`env.${name} in ${where} is a literal string. Pass secrets with secret.fromEnv() so they're redacted and never recorded.`);
+	}
+}
+const stepCommand = (step) => typeof step === "string" ? step : step.run;
+function checkSpec(spec, where) {
+	if (typeof spec !== "object" || spec === null || Array.isArray(spec)) throw new DefinitionError(`${where} must be an object or a callback that returns one`);
+	for (const key of Object.keys(spec)) {
+		if (SPEC_KEYS.includes(key)) continue;
+		if (SANDBOX_KEYS.includes(key)) {
+			const value = spec[key];
+			throw new DefinitionError(`"${key}" isn't an environment field (${where}). What's baked into the image is the sandbox's: docker({ ${key === "image" ? typeof value === "string" ? "from" : "install" : key}: … }). An environment only runs setup steps, in every attempt, with its secrets.`);
+		}
+		throw new DefinitionError(`Unknown field "${key}" in ${where}.${SPEC_HINTS[key] ? ` Did you mean "${SPEC_HINTS[key]}"?` : ""}`);
+	}
+	const s = spec;
+	if (s.workspace !== void 0 && s.workspace?.kind !== "git") throw new DefinitionError(`workspace in ${where} must come from the git helper, e.g. workspace: git('https://github.com/acme/app', { ref: 'v1.0.0' }) (got ${JSON.stringify(s.workspace)})`);
+	if (s.env !== void 0) checkEnv(s.env, where);
+	if (s.egress !== void 0) checkEgress(s.egress, where);
+	const list = (key) => {
+		const value = s[key];
+		if (value !== void 0 && !Array.isArray(value)) throw new DefinitionError(`${key} in ${where} must be a list`);
+		return value ?? [];
+	};
+	for (const step of list("setup")) {
+		const shape = `Steps in ${where} are strings or { run, timeout?, cwd? } objects`;
+		const run = typeof step === "string" ? step : step?.run;
+		if (typeof run !== "string" || !run.trim()) throw new DefinitionError(shape);
+		if (typeof step === "string") continue;
+		const extra = Object.keys(step).filter((k) => ![
+			"run",
+			"timeout",
+			"cwd"
+		].includes(k));
+		if (extra.length) throw new DefinitionError(`${shape} (got "${extra.join("\", \"")}")`);
+		const { cwd, timeout } = step;
+		if (timeout !== void 0) try {
+			parseDuration(timeout);
+		} catch (error) {
+			throw new DefinitionError(`setup step "${run}" in ${where}: ${error.message}`);
+		}
+		if (cwd !== void 0 && (typeof cwd !== "string" || !cwd.trim())) throw new DefinitionError(`setup step "${run}" in ${where}: cwd must be a directory path, relative to the workspace or absolute (got ${JSON.stringify(cwd)})`);
+	}
+	for (const skill of list("skills")) if (skill?.kind !== "skill") throw new DefinitionError(`skills in ${where} must come from the skill helper, e.g. skills: [skill.local('./skills')] (got ${JSON.stringify(skill)})`);
+	for (const [name, server] of Object.entries(s.mcp ?? {})) if (server?.kind !== "mcp") throw new DefinitionError(`mcp.${name} in ${where} must come from the mcp helper, e.g. mcp.stdio('npx', ['-y', 'server'])`);
+	for (const [path, value] of Object.entries(s.files ?? {})) {
+		const key = `files[${JSON.stringify(path)}] in ${where}`;
+		if (path.includes("\\")) throw new DefinitionError(`${key}: use forward slashes (${path.replaceAll("\\", "/")})`);
+		const rest = path.startsWith("~/") ? path.slice(2) : path;
+		if (!rest || isAbsolute(rest) || rest.split("/").includes("..")) throw new DefinitionError(`${key}: paths are relative to the workspace, or start with ~/ for the home directory, and never use ..`);
+		if (typeof value !== "string" && !isHostFile(value)) throw new DefinitionError(`${key} must be a string or file(path)`);
+	}
+	if (s.rules !== void 0 && typeof s.rules !== "string" && !isHostFile(s.rules)) throw new DefinitionError(`rules in ${where} must be markdown or file(path)`);
+	return structuredClone(s);
+}
+function buildSpec(input, where, base) {
+	const spec = typeof input === "function" ? input(helpersFor(base)) : input;
+	if (spec instanceof Promise || typeof spec?.then === "function") throw new DefinitionError(`${where} returned a Promise. The callback runs once at definition time and must return the environment synchronously; fetch remote content in a setup step instead.`);
+	return checkSpec(spec, where);
+}
+function makeEnvironment(name, layers) {
+	const env = {
+		kind: "environment",
+		name,
+		layers: Object.freeze(layers)
+	};
+	Object.defineProperty(env, "extend", {
+		enumerable: false,
+		value(child, input) {
+			checkName(child, `${name}.extend`);
+			const where = `${name}.extend("${child}")`;
+			const base = callerDir() ?? process.cwd();
+			return makeEnvironment(child, [...layers, {
+				name: child,
+				spec: buildSpec(input, where, base)
+			}]);
+		}
+	});
+	return Object.freeze(env);
+}
+function checkName(name, what) {
+	if (typeof name !== "string" || !NAME.test(name)) throw new DefinitionError(`${what} needs a name of letters, digits, ".", "_", "@", "+" or "-" (got ${JSON.stringify(name)})`);
+}
+/**
+* What an eval runs in: skills, MCP servers, files, rules, variables, secrets and setup steps.
+* Pass a spec, or a callback that destructures the typed helpers it needs:
+*
+*     defineEnvironment('genkit', ({ secret, skill }) => ({
+*       env: { GOOGLE_GENAI_API_KEY: secret.fromEnv('GOOGLE_GENERATIVE_AI_API_KEY') },
+*       skills: [skill.local('../skills/genkit')],
+*     }))
+*
+* The callback runs once, synchronously. Relative paths resolve against the calling file.
+*/
+function defineEnvironment(name, input) {
+	checkName(name, "defineEnvironment");
+	const base = callerDir() ?? process.cwd();
+	return makeEnvironment(name, [{
+		name,
+		spec: buildSpec(input, `defineEnvironment("${name}")`, base)
+	}]);
+}
+function applied(env) {
+	if (!env) return {
+		name: "-",
+		parent: null,
+		layers: []
+	};
+	return {
+		name: env.name,
+		parent: env.layers.at(-2)?.name ?? null,
+		layers: [...env.layers]
+	};
+}
+/** `control.extend(variant)`: the variant's own layers on the control's, skipping shared ones. */
+function layered(control, variant) {
+	const base = control?.layers ?? [];
+	const seen = new Set(base.map((l) => JSON.stringify(l)));
+	return {
+		name: variant.name,
+		parent: control?.name ?? null,
+		layers: [...base, ...variant.layers.filter((l) => !seen.has(JSON.stringify(l)))]
+	};
+}
+//#endregion
+export { stepCommand as _, checkEnv as a, workspaceOf as b, isEnvironment as c, isSecret as d, isSecretTemplate as f, plannedSecrets as g, parseGitRepo as h, checkEgress as i, isHostFile as l, mcpHosts as m, applied as n, defineEnvironment as o, layered as p, callerDir as r, helpersFor as s, DEFAULT_SKILL_EXCLUDE as t, isMovingRef as u, unbrokeredSecrets as v, parseDuration as x, workspaceLabel as y };
+
+//# sourceMappingURL=environment-Mz7wvrtD.js.map

package/dist/environment-Mz7wvrtD.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"environment-Mz7wvrtD.js","names":[],"sources":["../src/duration.ts","../src/environment.ts"],"mappings":";;;;;;;AAGA,MAAM,QAAQ;CAAE,IAAI;CAAG,GAAG;CAAO,GAAG;CAAQ,GAAG;AAAU;;AAGzD,SAAgB,cAAc,OAAyB;CACrD,IAAI,KAAK;CACT,IAAI,OAAO,UAAU,UAAU;EAC7B,MAAM,QAAQ,8BAA8B,KAAK,KAAK;EACtD,IAAI,CAAC,OAAO,MAAM,IAAI,WAAW,qBAAqB,MAAM,4BAA4B;EACxF,KAAK,OAAO,MAAM,EAAE,IAAI,MAAM,MAAM;CACtC;CACA,IAAI,EAAE,KAAK,KAAK,OAAO,SAAS,EAAE,IAAI;EACpC,MAAM,QAAQ,OAAO,UAAU,WAAW,IAAI,MAAM,KAAK,OAAO,KAAK;EACrE,MAAM,IAAI,WACR,oBAAoB,MAAM,yDAC5B;CACF;CACA,OAAO;AACT;;;ACUA,IAAa,kBAAb,cAAqC,MAAM;CACzC,OAAgB;AAClB;AAEA,MAAM,OAAO;AACb,MAAM,MAAM;AACZ,MAAM,YAAY;CAAC;CAAa;CAAO;CAAU;CAAS;CAAS;CAAS;CAAU;AAAK;;AAE3F,MAAM,eAAe;CAAC;CAAS;CAAW;CAAc;AAAM;AAC9D,MAAM,aAAqC;CACzC,MAAM;CACN,OAAO;CACP,KAAK;CACL,MAAM;CACN,SAAS;CACT,SAAS;CACT,eAAe;CACf,OAAO;CACP,MAAM;CACN,QAAQ;CACR,KAAK;CACL,MAAM;CACN,KAAK;CACL,UAAU;AACZ;AAEA,MAAa,YAAY,UACvB,OAAO,UAAU,YAAY,UAAU,QAAS,MAAiB,SAAS;AAE5E,MAAa,oBAAoB,UAC/B,OAAO,UAAU,YACjB,UAAU,QACT,MAAyB,SAAS;AAErC,MAAa,cAAc,UACzB,OAAO,UAAU,YAAY,UAAU,QAAS,MAAmB,SAAS;AAE9E,MAAa,iBAAiB,UAC5B,OAAO,UAAU,YACjB,UAAU,QACT,MAAsB,SAAS,iBAChC,MAAM,QAAS,MAAsB,MAAM;AAI7C,MAAM,WAAW,WACb,CAAC,KAAK,aAAa,GAAG,CAAC,IACvB,CAAC,OAAO,MAAM,CAAC,CAAC,KAAK,QAAQ,KAAK,aAAa,KAAK,GAAG,CAAC;;AAG5D,SAAgB,YAAgC;CAC9C,MAAM,QAAQ,MAAM;CACpB,MAAM,kBAAkB;CACxB,MAAM,yBAAQ,IAAI,MAAM,EAAA,CAAE,SAAS;CACnC,MAAM,kBAAkB;CACxB,KAAK,MAAM,QAAQ,MAAM,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC,GAAG;EAC7C,MAAM,QAAQ,2EAA2E,KACvF,IACF;EACA,IAAI,CAAC,QAAQ,IAAI;EAEjB,MAAM,OAAO,UAAU,MAAM,EAAE,CAAC,WAAW,SAAS,IAAI,cAAc,MAAM,EAAE,IAAI,MAAM,EAAE;EAC1F,IAAI,SAAS,MAAM,MAAM,KAAK,WAAW,CAAC,CAAC,KAAK,KAAK,SAAS,GAAG,IAAI,cAAc,KAAK,GACtF;EACF,OAAO,QAAQ,IAAI;CACrB;AAEF;AAEA,MAAM,UAAU,OAAqB,SAAiB;CACpD,MAAM,OAAO,iBAAiB,MAAM,cAAc,KAAK,IAAI;CAC3D,OAAO,WAAW,IAAI,IAAI,OAAO,QAAQ,MAAM,IAAI;AACrD;;;;;AAMA,MAAM,gBAAgB,MAAc,SAAiB;CACnD,MAAM,OAAO,KAAK,WAAW,OAAO,IAAI,KAAK,MAAM,CAAc,IAAI;CACrE,OAAO,mBAAmB,KAAK,IAAI,KAAK,WAAW,IAAI,IAAI,OAAO,MAAM,IAAI,IAAI;AAClF;;AAGA,MAAM,OAAO;AACb,MAAM,gBAAyC;CAAC;CAAU;CAAS;AAAM;;AAGzE,SAAS,QAAQ,MAAmC;CAClD,IAAI,OAAO,SAAS,YAAY,KAAK,KAAK,IAAI,GAAG;EAC/C,MAAM,OAAO,KAAK,QAAQ,SAAS,EAAE;EACrC,IAAI,eAAe,KAAK,IAAI,MAAM,SAAS,QAAQ,KAAK,IAAI,MAAM,IAChE,OAAO,IAAI,KAAK;EAElB,IAAI,SAAS,QAAQ,CAAC,KAAK,SAAS,GAAG,GACrC,OAAO,IAAI,KAAK,kCAAkC,KAAK,qCAAqC,KAAK;EAEnG;CACF;CACA,IAAI,OAAO,SAAS,YAAY,gBAAgB,KAAK,IAAI,GACvD,OAAO,wCAAwC,IAAI,IAAI,IAAI,CAAC,CAAC,SAAS,UAAU,KAAK;CAEvF,IAAI,OAAO,SAAS,YAAY,eAAe,KAAK,IAAI,GACtD,OAAO,6CAA6C,KAAK,MAAM,GAAG,CAAC,CAAC,GAAG,UAAU,KAAK;CAExF,OAAO,GAAG,KAAK,UAAU,IAAI,EAAE;AACjC;;AAGA,SAAgB,YACd,OACA,OACA,MAAsC,iBACP;CAC/B,IAAI,UAAU,eAAe,UAAU,YAAY;CACnD,MAAM,QAAQ;CACd,IAAI,OAAO,UAAU,YAAY,UAAU,QAAQ,MAAM,QAAQ,KAAK,GAAG;EACvE,MAAM,OAAO,MAAM,QAAQ,KAAK,IAC5B,sCAAsC,KAAK,UAAU,KAAK,EAAE,OAC5D;EACJ,MAAM,IAAI,IAAI,GAAG,MAAM,QAAQ,KAAK,UAAU,KAAK,EAAE,OAAO,MAAM,GAAG,MAAM;CAC7E;CACA,KAAK,MAAM,OAAO,OAAO,KAAK,KAAK,GAAG;EACpC,IAAI,QAAQ,SAAS;EAOrB,MAAM,IAAI,IAAI,uBAAuB,IAAI,OAAO,MAAM,GALpD,QAAQ,SACJ,gEACA,QAAQ,WAAW,QAAQ,iBACzB,6BACA,IACuD;CACjE;CACA,MAAM,QAAS,MAA8B;CAC7C,IAAI,CAAC,MAAM,QAAQ,KAAK,GACtB,MAAM,IAAI,IAAI,GAAG,MAAM,QAAQ,KAAK,UAAU,KAAK,EAAE,OAAO,OAAO;CAErE,KAAK,MAAM,QAAQ,OAAO;EACxB,MAAM,MAAM,QAAQ,IAAI;EACxB,IAAI,KAAK,MAAM,IAAI,IAAI,mBAAmB,MAAM,IAAI,KAAK;CAC3D;AACF;AAEA,MAAa,eAAsC,OAAO,OAAO;CAC/D,QAAQ,OAAO,OAAO,CAAC,mCAAmC,CAAC;CAC3D,QAAQ,OAAO,OAAO,CAAC,gBAAgB,CAAC;CACxC,WAAW,OAAO,OAAO,CAAC,mBAAmB,CAAC;CAC9C,QAAQ,OAAO,OAAO,CAAC,kBAAkB,oBAAoB,CAAC;AAChE,CAAC;AAED,SAAS,cAAc,SAAwB,MAA6C;CAC1F,MAAM,KAAK,QAAQ,MAAM;CACzB,IAAI,OAAO,WAAW,OAAO,UAC3B,MAAM,IAAI,gBAAgB,GAAG,KAAK,iCAAiC;CAErE,MAAM,EAAE,UAAU;CAClB,IAAI,UAAU,KAAA,GAAW;EACvB,IAAI,CAAC,MAAM,QAAQ,KAAK,KAAK,MAAM,WAAW,GAC5C,MAAM,IAAI,gBACR,GAAG,KAAK,iHAAiH,KAAK,UAAU,KAAK,EAAE,EACjJ;EAEF,KAAK,MAAM,QAAQ,OAAO;GACxB,MAAM,MAAM,QAAQ,IAAI;GACxB,IAAI,KAAK,MAAM,IAAI,gBAAgB,GAAG,KAAK,IAAI,KAAK;EACtD;CACF;CACA,IAAI,QAAQ,OAAO,KAAA,GAAW;EAC5B,IAAI,UAAU,KAAA,GACZ,MAAM,IAAI,gBACR,GAAG,KAAK,4FAA4F,KAAK,UAAU,QAAQ,EAAE,EAAE,GACjI;EAKF,KAHY,MAAM,QAAQ,QAAQ,EAAE,IAChC,QAAQ,GAAG,QAAQ,MAAM,CAAC,cAAc,SAAS,CAAC,CAAC,IACnD,CAAC,QAAQ,EAAE,EAAA,CACP,UAAU,QAAQ,GAAG,WAAW,GACtC,MAAM,IAAI,gBACR,GAAG,KAAK,iFAAiF,KAAK,UAAU,QAAQ,EAAE,EAAE,EACtH;CAEJ;CACA,OAAO;EACL,GAAI,QAAQ,WAAW,EAAE,UAAU,KAAK,IAAI,CAAC;EAC7C,GAAI,OAAO,WAAW,EAAE,GAAG,IAAI,CAAC;EAChC,GAAI,QAAQ,EAAE,OAAO,CAAC,GAAG,KAAK,EAAE,IAAI,CAAC;EACrC,GAAI,QAAQ,KAAK,EAAE,IAAI,CAAC,GAAG,IAAI,IAAI,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC;CACvD;AACF;;AAGA,SAAgB,SAAS,KAAmC;CAC1D,IAAI;EACF,MAAM,IAAI,IAAI,IAAI,GAAG;EACrB,OAAO,EAAE,aAAa,WAAW,CAAC,EAAE,QAAQ,IAAI,KAAA;CAClD,QAAQ;EACN;CACF;AACF;;;;;AAqBA,SAAgB,eAAe,KAAc,QAAsD;CACjG,MAAM,OAAgB,EAAE,GAAG,IAAI;CAC/B,MAAM,0BAAU,IAAI,IAAuB;CAC3C,KAAK,MAAM,EAAE,UAAU,QAAQ;EAC7B,OAAO,OAAO,MAAM,KAAK,GAAG;EAC5B,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,GAAG,QAAQ,IAAI,MAAM,MAAM;CACvF;CACA,MAAM,sBAAM,IAAI,IAA2B;CAC3C,MAAM,OACJ,OACA,MACA,OACA,aAAa,OACb,WAAW,UAGX,IAAI,IAAI,GAAG,MAAM,IAAI,QAAQ;EAC3B;EACA;EACA,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EACzB,GAAI,aAAa,EAAE,WAAW,IAAI,CAAC;EACnC,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC,CAAC;CACH,MAAM,YAAY,QAAiB,WAAmB;EACpD,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,MAAM,GAC/C,IAAI,SAAS,KAAK,GAChB,IACE,GAAG,SAAS,QACZ,MAAM,QAAQ,MACd,MAAM,OACN,MAAM,OAAO,UACb,MAAM,aAAa,IACrB;CAEN;CACA,SAAS,MAAM,EAAE;CACjB,KAAK,MAAM,CAAC,QAAQ,MAAM,SAAS;EACjC,IAAI,EAAE,cAAc,SAAS;GAC3B,SAAS,EAAE,KAAK,OAAO,OAAO,MAAM;GACpC;EACF;EACA,MAAM,MAAM,SAAS,EAAE,GAAG;EAC1B,KAAK,MAAM,CAAC,QAAQ,UAAU,OAAO,QAAQ,EAAE,OAAO,GAAG;GACvD,MAAM,QAAQ,OAAO,OAAO,WAAW;GACvC,IAAI,SAAS,KAAK,GAAG,IAAI,OAAO,MAAM,QAAQ,QAAQ,MAAM,SAAS,GAAG;GACxE,IAAI,iBAAiB,KAAK,GACxB,KAAK,MAAM,GAAG,SAAS,MAAM,SAAS,SAAS,iCAAiC,GAC9E,IAAI,OAAO,MAAgB,GAAG;EAGpC;CACF;CACA,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC;AACzB;;AAGA,MAAa,qBACX,KACA,WAEA,eAAe,KAAK,MAAM,CAAC,CAAC,SAAS,EAAE,OAAO,GAAG,QAAS,QAAQ,CAAC,IAAI,CAAC,CAAC,CAAE;AAE7E,SAAS,eAA6B;CACpC,MAAM,WAAW,UAAyB,CAAC,OAAO;EAChD,MAAM;EACN,GAAG,cAAc,SAAS,UAAU;CACtC;CACA,OAAO,WAAW,MAAM,UAAU,CAAC,MAAM;EACvC,IAAI,OAAO,SAAS,YAAY,CAAC,IAAI,KAAK,IAAI,GAC5C,MAAM,IAAI,gBACR,kBAAkB,KAAK,UAAU,IAAI,EAAE,6BACzC;EAEF,OAAO;GAAE,MAAM;GAAU,MAAM;GAAM,GAAG,cAAc,SAAS,mBAAmB,KAAK,GAAG;EAAE;CAC9F;CACA,OAAO,YAAY,cAAc;EAAE,MAAM;EAAmB;CAAS;CACrE,OAAO,QAAQ;CACf,OAAO;AACT;AAEA,MAAM,SAAS;;AAGf,MAAa,eAAe,QAC1B,QAAQ,KAAA,KACR,OAAO,KAAK,GAAG,KACf,CAAC,kDAAkD,KAAK,GAAG;;AAG7D,SAAgB,aAAa,MAA4D;CACvF,MAAM,QAAQ,yCAAyC,KAAK,IAAI;CAChE,IAAI,OAAO,OAAO,EAAE,KAAK,sBAAsB,MAAM,GAAG,MAAM;CAC9D,MAAM,OAAO,wEAAwE,KAAK,IAAI;CAC9F,IAAI,MAAM,OAAO;EAAE,KAAK,sBAAsB,KAAK,GAAG;EAAO,KAAK,KAAK;EAAI,MAAM,KAAK;CAAG;CACzF,OAAO,EAAE,KAAK,KAAK;AACrB;;AAGA,MAAa,kBAAkB,MAC7B,GAAG,EAAE,OAAO,EAAE,MAAM,IAAI,EAAE,QAAQ,KAAK,EAAE,OAAO,IAAI,EAAE,SAAS;;AAGjE,MAAa,eAAe,WAC1B,OAAO,UAAU,MAAM,EAAE,KAAK,SAAS,CAAC,EAAE,KAAK;;AAGjD,SAAS,cAAc,MAAkC;CACvD,IAAI,CAAC,IAAI,SAAS,IAAI,GAAG,OAAO,KAAA;CAChC,MAAM,IAAI,IAAI,IAAI,IAAI;CACtB,IAAI,CAAC,EAAE,YAAY,EAAE,EAAE,YAAY,YAAY,KAAK,EAAE,QAAQ,IAAI,OAAO,KAAA;CACzE,EAAE,WAAW,EAAE,YAAY;CAC3B,EAAE,WAAW,EAAE,YAAY;CAC3B,OAAO,EAAE;AACX;AAEA,MAAM,cAAc;CAAC;CAAO;CAAQ;CAAQ;AAAO;AAEnD,MAAM,eAAe,SAAiB,mBAAmB,KAAK,IAAI,KAAK,WAAW,IAAI;AAEtF,SAAS,UAAU,MAAyB;CAC1C,QAAQ,MAAM,UAAU,CAAC,MAAM;EAC7B,MAAM,UAAU,gBAAgB,MAAM,KAAK,OAAO;EAClD,IAAI,OAAO,YAAY,YAAY,CAAC,QAAQ,KAAK,GAC/C,MAAM,IAAI,gBACR,2EAA2E,KAAK,UAAU,IAAI,EAAE,EAClG;EAEF,MAAM,OAAO,OAAO,KAAK,UAAU,OAAO,EAAE;EAC5C,MAAM,SAAS,cAAc,OAAO;EACpC,IAAI,QACF,MAAM,IAAI,gBACR,OAAO,KAAK,UAAU,MAAM,EAAE,mOAChC;EAEF,IAAI,OAAO,YAAY,YAAY,YAAY,QAAQ,MAAM,QAAQ,OAAO,GAC1E,MAAM,IAAI,gBAAgB,GAAG,KAAK,8BAA8B;EAElE,MAAM,QAAQ,OAAO,KAAK,OAAO,CAAC,CAAC,QAAQ,MAAM,CAAC,YAAY,SAAS,CAAC,CAAC;EACzE,IAAI,MAAM,QAAQ;GAChB,MAAM,OACJ,MAAM,SAAS,QAAQ,KAAK,MAAM,SAAS,KAAK,IAC5C,0CACA;GACN,MAAM,IAAI,gBACR,GAAG,KAAK,oBAAoB,MAAM,KAAK,QAAM,EAAE,cAAc,YAAY,MAAM,GAAG,EAAE,CAAC,CAAC,KAAK,IAAI,EAAE,OAAO,YAAY,GAAG,EAAE,EAAE,GAAG,MAChI;EACF;EACA,MAAM,QAAQ,gBAAgB,MAAM,KAAK,aAAa,UAAU,YAAY,OAAO;EACnF,MAAM,SAAS,QAAQ,EAAE,KAAK,OAAO,MAAM,IAAI,EAAE,IAAI,aAAa,OAAO;EACzE,MAAM,MAAM,QAAQ,OAAO,OAAO;EAClC,IAAI,QAAQ,KAAA,MAAc,OAAO,QAAQ,YAAY,CAAC,IAAI,KAAK,KAAK,IAAI,WAAW,GAAG,IACpF,MAAM,IAAI,gBACR,GAAG,KAAK,4CAA4C,KAAK,UAAU,GAAG,EAAE,EAC1E;EAEF,MAAM,OAAO,QAAQ,QAAQ,OAAO;EACpC,IAAI,SAAS,KAAA,GAAW;GACtB,MAAM,QAAQ,OAAO,SAAS,WAAW,KAAK,QAAQ,QAAQ,EAAE,IAAI;GACpE,IACE,OAAO,UAAU,YACjB,CAAC,SACD,MAAM,SAAS,IAAI,KACnB,MAAM,WAAW,GAAG,KACpB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,MAAM,MAAM,QAAQ,MAAM,OAAO,MAAM,EAAE,GAEhE,MAAM,IAAI,gBACR,GAAG,KAAK,8FAA8F,KAAK,UAAU,IAAI,EAAE,EAC7H;EAEJ;EACA,MAAM,YAAY,MAAM,QAAQ,QAAQ,EAAE;EAC1C,MAAM,EAAE,MAAM,UAAU;EACxB,IAAI,SAAS,KAAA,KAAa,OAAO,SAAS,WACxC,MAAM,IAAI,gBAAgB,GAAG,KAAK,+BAA+B,KAAK,UAAU,IAAI,EAAE,EAAE;EAE1F,IAAI,UAAU,KAAA,GAAW;GAEvB,IACE,OAAO,UAAU,YACjB,CAAC,IAAI,KAAK,KAAK,KACf,8BAA8B,KAAK,KAAK,GAExC,MAAM,IAAI,gBACR,GAAG,KAAK,0HACV;GAEF,IAAI,SAAS,CAAC,eAAe,KAAK,OAAO,GAAG,GAC1C,MAAM,IAAI,gBACR,GAAG,KAAK,gHACV;EAEJ;EACA,OAAO;GACL,MAAM;GAEN,MAAM,SAAS,UAAU,UAAU,SAAS,OAAO,IAAI,QAAQ,UAAU,EAAE,IAAI;GAC/E,KAAK,OAAO;GACZ,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;GACrB,GAAI,YAAY,EAAE,MAAM,UAAU,IAAI,CAAC;GACvC,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;GACvB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EAC3B;CACF;AACF;;;;;AAMA,MAAa,wBAA2C;CAAC;CAAW;CAAa;AAAW;AAE5F,SAAS,YAAY,MAA2B;CAC9C,MAAM,aAAa,MAA0B;EAC3C,IAAI,MAAM,KAAA,KAAa,MAAM,aAAa,MAAM,aAAa,OAAO,KAAK;EACzE,MAAM,IAAI,gBAAgB,yDAAyD,EAAE,EAAE;CACzF;CACA,MAAM,WAAW,MAAqC;EACpD,IAAI,MAAM,KAAA,GAAW,OAAO,CAAC;EAC7B,IAAI,CAAC,MAAM,QAAQ,CAAC,KAAK,EAAE,MAAM,MAAM,OAAO,MAAM,YAAY,CAAC,EAAE,QAAQ,OAAO,EAAE,CAAC,GACnF,MAAM,IAAI,gBACR,wFAAwF,KAAK,UAAU,CAAC,EAAE,EAC5G;EAEF,OAAO,EAAE,SAAS,CAAC,GAAG,CAAC,EAAE;CAC3B;CACA,OAAO;EACL,QAAQ,MAAM,IAAI,CAAC,OAAO;GACxB,MAAM;GACN,QAAQ;GACR,MAAM,OAAO,MAAM,IAAI;GACvB,GAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;GACtC,GAAG,QAAQ,EAAE,OAAO;GACpB,WAAW,UAAU,EAAE,SAAS;EAClC;EACA,MAAM,MAAM,IAAI,CAAC,MAAM;GACrB,IAAI,OAAO,SAAS,YAAY,CAAC,MAC/B,MAAM,IAAI,gBAAgB,oCAAoC;GAEhE,MAAM,SAAS,aAAa,IAAI;GAChC,MAAM,MAAM,EAAE,OAAO,OAAO;GAC5B,MAAM,OAAO,EAAE,QAAQ,OAAO;GAC9B,OAAO;IACL,MAAM;IACN,QAAQ;IACR;IACA,GAAI,MAAM,EAAE,IAAI,IAAI,CAAC;IACrB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;IACvB,GAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;IACtC,GAAG,QAAQ,EAAE,OAAO;IACpB,WAAW,UAAU,EAAE,SAAS;GAClC;EACF;EACA,WAAW,IAAI,IAAI,CAAC,MAAM;GACxB,IAAI,CAAC,gCAAgC,KAAK,EAAE,GAC1C,MAAM,IAAI,gBAAgB,mBAAmB,GAAG,qCAAqC;GAEvF,OAAO;IACL,MAAM;IACN,QAAQ;IACR;IACA,GAAI,EAAE,UAAU,EAAE,SAAS,EAAE,QAAQ,IAAI,CAAC;IAC1C,WAAW,UAAU,EAAE,SAAS;GAClC;EACF;EACA,MAAM,MAAM,IAAI,CAAC,OAAO;GACtB,MAAM;GACN,QAAQ;GACR,MAAM,aAAa,MAAM,IAAI;GAC7B,MAAM,EAAE,QAAQ;GAChB,GAAI,EAAE,OAAO,EAAE,MAAM,CAAC,GAAG,EAAE,IAAI,EAAE,IAAI,CAAC;GACtC,GAAG,QAAQ,EAAE,OAAO;GACpB,WAAW,UAAU,EAAE,SAAS;EAClC;EACA,SAAS,OAAO,IAAI,CAAC,OAAO;GAC1B,MAAM;GACN,QAAQ;GACR,MAAM,MAAM;GACZ,aAAa,MAAM;GACnB,SAAS,MAAM;GACf,OAAO,EAAE,GAAG,MAAM,MAAM;GACxB,WAAW,UAAU,EAAE,SAAS;EAClC;CACF;AACF;AAEA,MAAM,YAAuB;CAC3B,QAAQ,SAAS,OAAO,CAAC,GAAG,IAAI,CAAC,MAAM;EACrC,IAAI,OAAO,YAAY,YAAY,CAAC,SAClC,MAAM,IAAI,gBAAgB,6BAA6B;EAEzD,OAAO;GAAE,MAAM;GAAO,WAAW;GAAS;GAAS,MAAM,CAAC,GAAG,IAAI;GAAG,KAAK,EAAE,GAAG,EAAE,IAAI;EAAE;CACxF;CACA,OAAO,KAAK,IAAI,CAAC,OAAO;EAAE,MAAM;EAAO,WAAW;EAAQ;EAAK,SAAS,EAAE,GAAG,EAAE,QAAQ;CAAE;CACzF,MAAM,KAAK,IAAI,CAAC,OAAO;EAAE,MAAM;EAAO,WAAW;EAAO;EAAK,SAAS,EAAE,GAAG,EAAE,QAAQ;CAAE;AACzF;;AAGA,SAAgB,WAAW,MAAkC;CAC3D,OAAO;EACL,QAAQ,aAAa;EACrB,OAAO,YAAY,IAAI;EACvB,KAAK;EACL,OAAO,UAAU;GAAE,MAAM;GAAQ,MAAM,OAAO,MAAM,IAAI;EAAE;EAC1D,KAAK,UAAU,IAAI;CACrB;AACF;;AAGA,SAAgB,SAAS,KAAc,OAAe,MAAM,iBAAuB;CACjF,IAAI,OAAO,QAAQ,YAAY,QAAQ,QAAQ,MAAM,QAAQ,GAAG,GAC9D,MAAM,IAAI,IAAI,yCAAyC,OAAO;CAEhE,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,GAAG,GAAG;EAC/C,IAAI,CAAC,IAAI,KAAK,IAAI,GAAG,MAAM,IAAI,IAAI,OAAO,KAAK,MAAM,MAAM,6BAA6B;EACxF,IAAI,SAAS,KAAK,GAAG;EACrB,IAAI,OAAO,UAAU,UACnB,MAAM,IAAI,IAAI,OAAO,KAAK,MAAM,MAAM,sCAAsC;EAE9E,IAAI,YAAY,KAAK,IAAI,GACvB,MAAM,IAAI,IACR,OAAO,KAAK,MAAM,MAAM,iGAC1B;CAEJ;AACF;AAEA,MAAa,eAAe,SAC1B,OAAO,SAAS,WAAW,OAAO,KAAK;AAEzC,SAAS,UAAU,MAAe,OAAgC;CAChE,IAAI,OAAO,SAAS,YAAY,SAAS,QAAQ,MAAM,QAAQ,IAAI,GACjE,MAAM,IAAI,gBAAgB,GAAG,MAAM,kDAAkD;CAEvF,KAAK,MAAM,OAAO,OAAO,KAAK,IAAI,GAAG;EACnC,IAAI,UAAU,SAAS,GAAG,GAAG;EAC7B,IAAI,aAAa,SAAS,GAAG,GAAG;GAE9B,MAAM,QAAS,KAAiC;GAEhD,MAAM,IAAI,gBACR,IAAI,IAAI,gCAAgC,MAAM,4DAFrC,QAAQ,UAAW,OAAO,UAAU,WAAW,SAAS,YAAa,IAE+B,kFAC/G;EACF;EAEA,MAAM,IAAI,gBAAgB,kBAAkB,IAAI,OAAO,MAAM,GADhD,WAAW,OAAO,kBAAkB,WAAW,KAAK,MAAM,IACD;CACxE;CACA,MAAM,IAAI;CACV,IAAI,EAAE,cAAc,KAAA,KAAc,EAAE,WAAmC,SAAS,OAC9E,MAAM,IAAI,gBACR,gBAAgB,MAAM,6GAA6G,KAAK,UAAU,EAAE,SAAS,EAAE,EACjK;CAEF,IAAI,EAAE,QAAQ,KAAA,GAAW,SAAS,EAAE,KAAK,KAAK;CAC9C,IAAI,EAAE,WAAW,KAAA,GAAW,YAAY,EAAE,QAAQ,KAAK;CACvD,MAAM,QAAQ,QAA4B;EACxC,MAAM,QAAQ,EAAE;EAChB,IAAI,UAAU,KAAA,KAAa,CAAC,MAAM,QAAQ,KAAK,GAC7C,MAAM,IAAI,gBAAgB,GAAG,IAAI,MAAM,MAAM,gBAAgB;EAE/D,OAAO,SAAS,CAAC;CACnB;CACA,KAAK,MAAM,QAAQ,KAAK,OAAO,GAAG;EAChC,MAAM,QAAQ,YAAY,MAAM;EAChC,MAAM,MAAM,OAAO,SAAS,WAAW,OAAQ,MAA4B;EAC3E,IAAI,OAAO,QAAQ,YAAY,CAAC,IAAI,KAAK,GAAG,MAAM,IAAI,gBAAgB,KAAK;EAC3E,IAAI,OAAO,SAAS,UAAU;EAC9B,MAAM,QAAQ,OAAO,KAAK,IAAI,CAAC,CAAC,QAAQ,MAAM,CAAC;GAAC;GAAO;GAAW;EAAK,CAAC,CAAC,SAAS,CAAC,CAAC;EACpF,IAAI,MAAM,QAAQ,MAAM,IAAI,gBAAgB,GAAG,MAAM,SAAS,MAAM,KAAK,QAAM,EAAE,GAAG;EACpF,MAAM,EAAE,KAAK,YAAY;EACzB,IAAI,YAAY,KAAA,GACd,IAAI;GACF,cAAc,OAAO;EACvB,SAAS,OAAO;GACd,MAAM,IAAI,gBAAgB,eAAe,IAAI,OAAO,MAAM,IAAK,MAAgB,SAAS;EAC1F;EAEF,IAAI,QAAQ,KAAA,MAAc,OAAO,QAAQ,YAAY,CAAC,IAAI,KAAK,IAC7D,MAAM,IAAI,gBACR,eAAe,IAAI,OAAO,MAAM,6EAA6E,KAAK,UAAU,GAAG,EAAE,EACnI;CAEJ;CACA,KAAK,MAAM,SAAS,KAAK,QAAQ,GAC/B,IAAK,OAAuB,SAAS,SACnC,MAAM,IAAI,gBACR,aAAa,MAAM,gFAAgF,KAAK,UAAU,KAAK,EAAE,EAC3H;CAGJ,KAAK,MAAM,CAAC,MAAM,WAAW,OAAO,QAAQ,EAAE,OAAO,CAAC,CAAC,GACrD,IAAK,QAAsB,SAAS,OAClC,MAAM,IAAI,gBACR,OAAO,KAAK,MAAM,MAAM,wEAC1B;CAGJ,KAAK,MAAM,CAAC,MAAM,UAAU,OAAO,QAAQ,EAAE,SAAS,CAAC,CAAC,GAAG;EACzD,MAAM,MAAM,SAAS,KAAK,UAAU,IAAI,EAAE,OAAO;EACjD,IAAI,KAAK,SAAS,IAAI,GACpB,MAAM,IAAI,gBAAgB,GAAG,IAAI,yBAAyB,KAAK,WAAW,MAAM,GAAG,EAAE,EAAE;EAEzF,MAAM,OAAO,KAAK,WAAW,IAAI,IAAI,KAAK,MAAM,CAAC,IAAI;EAErD,IAAI,CAAC,QAAQ,WAAW,IAAI,KAAK,KAAK,MAAM,GAAG,CAAC,CAAC,SAAS,IAAI,GAC5D,MAAM,IAAI,gBACR,GAAG,IAAI,iGACT;EAEF,IAAI,OAAO,UAAU,YAAY,CAAC,WAAW,KAAK,GAChD,MAAM,IAAI,gBAAgB,GAAG,IAAI,gCAAgC;CAErE;CACA,IAAI,EAAE,UAAU,KAAA,KAAa,OAAO,EAAE,UAAU,YAAY,CAAC,WAAW,EAAE,KAAK,GAC7E,MAAM,IAAI,gBAAgB,YAAY,MAAM,gCAAgC;CAE9E,OAAO,gBAAgB,CAAC;AAC1B;AAEA,SAAS,UAAU,OAAyB,OAAe,MAA+B;CACxF,MAAM,OAAO,OAAO,UAAU,aAAa,MAAM,WAAW,IAAI,CAAC,IAAI;CACrE,IAAI,gBAAgB,WAAW,OAAQ,MAA6B,SAAS,YAC3E,MAAM,IAAI,gBACR,GAAG,MAAM,4JACX;CAEF,OAAO,UAAU,MAAM,KAAK;AAC9B;AAMA,SAAS,gBAAgB,MAAc,QAAyC;CAC9E,MAAM,MAAM;EAAE,MAAM;EAAwB;EAAM,QAAQ,OAAO,OAAO,MAAM;CAAE;CAChF,OAAO,eAAe,KAAK,UAAU;EACnC,YAAY;EACZ,MAAM,OAAe,OAAyB;GAC5C,UAAU,OAAO,GAAG,KAAK,QAAQ;GACjC,MAAM,QAAQ,GAAG,KAAK,WAAW,MAAM;GACvC,MAAM,OAAO,UAAU,KAAK,QAAQ,IAAI;GACxC,OAAO,gBAAgB,OAAO,CAC5B,GAAG,QACH;IAAE,MAAM;IAAO,MAAM,UAAU,OAAO,OAAO,IAAI;GAAE,CACrD,CAAC;EACH;CACF,CAAC;CACD,OAAO,OAAO,OAAO,GAAG;AAC1B;AAEA,SAAS,UAAU,MAAe,MAAsC;CACtE,IAAI,OAAO,SAAS,YAAY,CAAC,KAAK,KAAK,IAAI,GAC7C,MAAM,IAAI,gBACR,GAAG,KAAK,mEAAmE,KAAK,UAAU,IAAI,EAAE,EAClG;AAEJ;;;;;;;;;;;;AAaA,SAAgB,kBAAkB,MAAc,OAAsC;CACpF,UAAU,MAAM,mBAAmB;CACnC,MAAM,OAAO,UAAU,KAAK,QAAQ,IAAI;CACxC,OAAO,gBAAgB,MAAM,CAC3B;EAAE;EAAM,MAAM,UAAU,OAAO,sBAAsB,KAAK,KAAK,IAAI;CAAE,CACvE,CAAC;AACH;AAWA,SAAgB,QAAQ,KAA2E;CACjG,IAAI,CAAC,KAAK,OAAO;EAAE,MAAA;EAAsB,QAAQ;EAAM,QAAQ,CAAC;CAAE;CAClE,OAAO;EACL,MAAM,IAAI;EACV,QAAQ,IAAI,OAAO,GAAG,EAAE,CAAC,EAAE,QAAQ;EACnC,QAAQ,CAAC,GAAG,IAAI,MAAM;CACxB;AACF;;AAGA,SAAgB,QACd,SACA,SACoB;CACpB,MAAM,OAAO,SAAS,UAAU,CAAC;CACjC,MAAM,OAAO,IAAI,IAAI,KAAK,KAAK,MAAM,KAAK,UAAU,CAAC,CAAC,CAAC;CACvD,OAAO;EACL,MAAM,QAAQ;EACd,QAAQ,SAAS,QAAQ;EACzB,QAAQ,CAAC,GAAG,MAAM,GAAG,QAAQ,OAAO,QAAQ,MAAM,CAAC,KAAK,IAAI,KAAK,UAAU,CAAC,CAAC,CAAC,CAAC;CACjF;AACF"}