xaq-cli 0.0.0 → 0.1.0-nightly.71

package/dist/connect-TtJ9n0Rw.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"connect-TtJ9n0Rw.js","names":[],"sources":["../server/listen/connect.ts"],"sourcesContent":["import { closeSync, constants, fchmodSync, lstatSync, openSync, writeSync } from \"node:fs\";\nimport { hostname } from \"node:os\";\nimport pc from \"picocolors\";\nimport type { AgentSelf, AgentTool, PairingPoll, PairingStart, PairingStartInput } from \"../../shared/agent-api.ts\";\nimport { CAPABILITIES, type Capability } from \"../../shared/types.ts\";\nimport { ApiError, clientInfo, getSelf, pollPairing, startPairing } from \"./api.ts\";\nimport { describeGrants, hasAccess } from \"./grants.ts\";\nimport { writeClaudeMcpConfig } from \"./mcpheader.ts\";\nimport { isServiceInstalled } from \"./service.ts\";\nimport { setupMcp, mcpTarget, type McpSetupResult } from \"./mcpsetup.ts\";\nimport { defaultConsumer, validConsumer } from \"./options.ts\";\nimport { DEFAULT_PROFILE, profilePath, validProfileName } from \"./paths.ts\";\nimport { listProfiles, loadProfile, type Profile, profileExists, saveProfile } from \"./profile.ts\";\nimport { recipe, shellQuote, TOOL_LABELS, TOOLS } from \"./recipes.ts\";\nimport { checkTransport, insecureBanner, normalizeDaemonUrl } from \"./transport.ts\";\nimport { box, formatDuration, safeText, StatusLine } from \"./ui.ts\";\nimport { NPX } from \"./version.ts\";\n\nexport interface ConnectFlags {\n  name?: string;\n  tool?: string;\n  account?: string[];\n  capabilities?: string;\n  reason?: string;\n  profile?: string;\n  consumer?: string;\n  insecure?: boolean;\n  force?: boolean;\n  setupMcp?: boolean;\n  /** Also write the output (plain text) to this file: created 0600, never through a symlink or someone else's file. */\n  log?: string;\n}\n\n/** Exit codes, so scripts (and agents setting themselves up) can tell outcomes apart. */\nexport const CONNECT_EXIT = { approved: 0, error: 1, denied: 2, expired: 3, consumed: 4, cancelled: 130 } as const;\n\nexport interface ConnectOptions {\n  /** Tests: poll faster than the server's interval. */\n  pollIntervalMs?: number;\n  signal?: AbortSignal;\n  handleSignals?: boolean;\n}\n\nexport function parseTool(value: string | undefined): AgentTool {\n  if (value === undefined) return \"other\";\n  const v = value.trim().toLowerCase().replace(/^claude$/, \"claude-code\");\n  if (!(TOOLS as readonly string[]).includes(v)) throw new Error(`Unknown --tool \"${value}\". Choose one of: ${TOOLS.join(\", \")}.`);\n  return v as AgentTool;\n}\n\nexport function parseCapabilities(value: string | undefined): Capability[] | undefined {\n  if (value === undefined) return undefined;\n  const list = value\n    .split(\",\")\n    .map((s) => s.trim().toLowerCase())\n    .filter(Boolean);\n  const bad = list.filter((c) => !(CAPABILITIES as readonly string[]).includes(c));\n  if (bad.length) throw new Error(`Unknown capabilit${bad.length > 1 ? \"ies\" : \"y\"} ${bad.join(\", \")}. Choose from: ${CAPABILITIES.join(\", \")}.`);\n  return [...new Set(list)] as Capability[];\n}\n\nconst shortHost = () => hostname().replace(/\\.(local|lan|home)$/i, \"\");\n\nconst sleep = (ms: number, signal?: AbortSignal) =>\n  new Promise<void>((resolve) => {\n    const t = setTimeout(resolve, ms);\n    signal?.addEventListener(\n      \"abort\",\n      () => {\n        clearTimeout(t);\n        resolve();\n      },\n      { once: true },\n    );\n  });\n\n// eslint-disable-next-line no-control-regex\nconst stripAnsi = (s: string) => s.replace(/\\x1b\\[[0-9;]*m/g, \"\");\n/** --log target (fd), written in parallel with the console. */\nlet logFd: number | null = null;\nconst toLog = (s: string) => {\n  if (logFd !== null) writeSync(logFd, stripAnsi(s) + \"\\n\");\n};\nconst out = (s = \"\") => {\n  process.stdout.write(`${s}\\n`);\n  toLog(s);\n};\nconst err = (s = \"\") => {\n  process.stderr.write(`${s}\\n`);\n  toLog(s);\n};\n\n/**\n * Opens --log safely: a new file is created 0600 with O_EXCL; an existing one (e.g. from `mktemp`) is\n * only reused if it is a regular file owned by us, opened without following symlinks. This is what\n * keeps another local user from pre-creating the log and reading the pairing as it happens.\n */\nexport function openConnectLog(path: string): number {\n  try {\n    return openSync(path, constants.O_WRONLY | constants.O_CREAT | constants.O_EXCL | constants.O_NOFOLLOW, 0o600);\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code !== \"EEXIST\") throw e;\n  }\n  const st = lstatSync(path);\n  const uid = process.getuid?.();\n  if (!st.isFile() || (uid !== undefined && st.uid !== uid)) throw new Error(`Refusing --log ${path}: it exists and is not a regular file owned by you.`);\n  const fd = openSync(path, constants.O_WRONLY | constants.O_TRUNC | constants.O_NOFOLLOW);\n  fchmodSync(fd, 0o600);\n  return fd;\n}\n\nexport async function runConnect(rawUrl: string, flags: ConnectFlags, opts: ConnectOptions = {}): Promise<number> {\n  if (flags.log) logFd = openConnectLog(flags.log);\n  try {\n    return await connect(rawUrl, flags, opts);\n  } finally {\n    if (logFd !== null) closeSync(logFd);\n    logFd = null;\n  }\n}\n\nasync function connect(rawUrl: string, flags: ConnectFlags, opts: ConnectOptions): Promise<number> {\n  const url = normalizeDaemonUrl(rawUrl);\n  const verdict = await checkTransport(url, { insecure: flags.insecure });\n  if (verdict.warning) err(insecureBanner(verdict.warning));\n\n  const profileName = validProfileName(flags.profile ?? DEFAULT_PROFILE);\n  let replacing: Profile | null = null;\n  if (profileExists(profileName) && flags.force) {\n    try {\n      replacing = loadProfile(profileName);\n    } catch {\n      // Unreadable: it's being replaced anyway.\n    }\n  }\n  if (profileExists(profileName) && !flags.force) {\n    let who = \"\";\n    try {\n      const p = loadProfile(profileName);\n      who = ` (agent \"${safeText(p.agentName)}\" on ${p.url})`;\n    } catch {\n      // Unreadable: still don't overwrite silently.\n    }\n    const others = listProfiles();\n    throw new Error(\n      `Profile \"${profileName}\" already exists${who}.\\n` +\n        `  Pair a second agent with --profile <name>${others.length > 1 ? ` (existing: ${others.join(\", \")})` : \"\"}, or replace this one with --force.`,\n    );\n  }\n  const tool = parseTool(flags.tool);\n  const capabilities = parseCapabilities(flags.capabilities);\n  // --force keeps the listener's consumer, so the server-side cursor carries on (no replay, no gap).\n  const consumer = validConsumer(flags.consumer ?? replacing?.consumer ?? defaultConsumer(profileName));\n  const name = (flags.name?.trim() || `${tool === \"other\" ? \"Agent\" : TOOL_LABELS[tool]} on ${shortHost()}`).slice(0, 80);\n\n  const input: PairingStartInput = {\n    name,\n    requested: {\n      ...(flags.account?.length ? { accounts: flags.account } : {}),\n      ...(capabilities ? { capabilities } : {}),\n      ...(flags.reason ? { reason: flags.reason } : {}),\n    },\n    client: { ...clientInfo(), tool },\n  };\n\n  let start: PairingStart;\n  try {\n    start = await startPairing(url, input);\n  } catch (e) {\n    if (e instanceof ApiError && e.status === 404) {\n      throw new Error(`${url} doesn't support pairing (no /agent/v1/pairings). Is this a xaq daemon, and is it up to date?`);\n    }\n    if (e instanceof ApiError) throw new Error(`${e.message}${e.hint ? `\\n  ${e.hint}` : \"\"}`);\n    throw e;\n  }\n\n  const links = approveLinks(url, start);\n  out();\n  out(\n    box([\n      pc.bold(\"Approve this agent in the xaq console\"),\n      \"\",\n      `Code:   ${pc.bold(pc.yellow(safeText(start.userCode, 40)))}`,\n      `Open:   ${pc.cyan(safeText(links.primary, 300))}`,\n      ...(links.publicUrl\n        ? [`  or:   ${pc.cyan(safeText(links.publicUrl, 300))}`, pc.gray(`        (first: the address this CLI used; second: the console's public URL setting)`)]\n        : []),\n      `Agent:  ${safeText(name)}`,\n      \"\",\n      pc.gray(\"Only approve if the console shows this exact code.\"),\n    ]),\n  );\n  out();\n\n  // Ctrl-C: stop cleanly. Nothing was approved; the request just expires.\n  const ac = new AbortController();\n  const onAbort = () => ac.abort();\n  opts.signal?.addEventListener(\"abort\", onAbort, { once: true });\n  const onSigint = () => ac.abort();\n  if (opts.handleSignals) process.on(\"SIGINT\", onSigint);\n\n  const started = Date.now();\n  const expiresAt = Date.parse(start.expiresAt) || started + 10 * 60_000;\n  let interval = Math.max(1, start.interval || 5) * 1000;\n  let note = \"\";\n  const status = new StatusLine(process.stderr);\n  status.start(\n    () =>\n      `Waiting for approval · ${formatDuration(Date.now() - started)} elapsed · code expires in ${formatDuration(expiresAt - Date.now())}${note ? pc.yellow(` · ${note}`) : \"\"}`,\n  );\n\n  let result: PairingPoll | null = null;\n  try {\n    while (!ac.signal.aborted) {\n      await sleep(opts.pollIntervalMs ?? interval, ac.signal);\n      if (ac.signal.aborted) break;\n      try {\n        const r = await pollPairing(url, start.deviceCode);\n        note = \"\";\n        if (r.status === \"pending\") continue;\n        if (r.status === \"slow_down\") {\n          // The server asks for more room between polls.\n          interval = Math.max(interval + 1000, (r.interval || 0) * 1000);\n          continue;\n        }\n        result = r;\n        break;\n      } catch (e) {\n        if (e instanceof ApiError && e.status === 429) {\n          interval += 5000;\n          note = \"rate limited, slowing down\";\n          continue;\n        }\n        if (e instanceof ApiError && e.status >= 400 && e.status < 500 && e.status !== 408) {\n          throw new Error(`${e.message}${e.hint ? `\\n  ${e.hint}` : \"\"}`);\n        }\n        // Network trouble or a 5xx: keep trying until the code expires.\n        note = \"can't reach the daemon, retrying\";\n        if (Date.now() > expiresAt + 30_000) {\n          result = { status: \"expired\" };\n          break;\n        }\n      }\n    }\n  } finally {\n    status.stop();\n    if (opts.handleSignals) process.off(\"SIGINT\", onSigint);\n    opts.signal?.removeEventListener(\"abort\", onAbort);\n  }\n\n  if (!result) {\n    err(pc.yellow(\"Cancelled. Nothing was approved; the code expires on its own.\"));\n    return CONNECT_EXIT.cancelled;\n  }\n\n  switch (result.status) {\n    case \"denied\":\n      err(pc.red(`✖ The request was denied in the console${result.note ? `: ${safeText(result.note, 300)}` : \".\"}`));\n      return CONNECT_EXIT.denied;\n    case \"expired\":\n      err(pc.red(\"✖ The code expired before it was approved.\"));\n      err(`  Run the same command again for a fresh code, and approve it within ${formatDuration(Date.parse(start.expiresAt) - started)}.`);\n      return CONNECT_EXIT.expired;\n    case \"consumed\":\n      err(pc.red(\"✖ This pairing was already completed and its key handed out once (perhaps by an earlier run of this command).\"));\n      err(`  For safety the key is never delivered twice. Start over with \\`${NPX} connect\\`, or rotate the agent's key in the console.`);\n      return CONNECT_EXIT.consumed;\n    case \"approved\":\n      break;\n    default:\n      throw new Error(`Unexpected pairing status ${JSON.stringify((result as { status: unknown }).status)}`);\n  }\n\n  // --force keeps everything about the listener (targets, filters, limits, forward secret, cwd); only\n  // the pairing (daemon, key, agent) is replaced.\n  const kept: Partial<Profile> = replacing\n    ? {\n        types: replacing.types,\n        filter: replacing.filter,\n        includeBody: replacing.includeBody,\n        exec: replacing.exec,\n        forward: replacing.forward,\n        forwardSecret: replacing.forwardSecret,\n        concurrency: replacing.concurrency,\n        timeoutSeconds: replacing.timeoutSeconds,\n        maxAttempts: replacing.maxAttempts,\n        cwd: replacing.cwd,\n      }\n    : {};\n  const profile: Profile = {\n    ...kept,\n    url,\n    apiKey: result.apiKey,\n    agentId: result.agent.id,\n    agentName: result.agent.name,\n    consumer,\n    ...(verdict.kind === \"insecure\" ? { insecure: true } : {}),\n    tool,\n    // Derived from the URL the user chose and transport-checked; the daemon's advertised URLs come\n    // from its publicUrl setting and are never trusted with the key.\n    mcpUrl: `${url}/mcp`,\n    skillUrl: `${url}/skill.md`,\n    createdAt: new Date().toISOString(),\n  };\n  const path = saveProfile(profileName, profile);\n  writeClaudeMcpConfig(profileName, profile.mcpUrl!);\n  if (typeof result.mcpUrl === \"string\" && result.mcpUrl !== profile.mcpUrl) {\n    err(\n      pc.yellow(\n        `! The daemon advertises its MCP endpoint as ${safeText(result.mcpUrl, 200)} (its \"public URL\" setting); using ${profile.mcpUrl}, the address you connected to. Set the public URL in the console if agents should use another address.`,\n      ),\n    );\n  }\n\n  out(`${pc.green(\"✔\")} Approved. Agent ${pc.bold(safeText(result.agent.name))} ${pc.gray(`(${result.agent.id})`)} is connected.`);\n  out(`  Key saved to ${pc.cyan(path)} ${pc.gray(\"(mode 0600; never displayed. Rotate it in the console if it leaks.)\")}`);\n  if (replacing && (replacing.exec || replacing.forward)) {\n    out(`  Kept this profile's listener settings. Restart the listener to use the new key${isServiceInstalled(profileName) ? `: ${NPX} listen service install${profileName === DEFAULT_PROFILE ? \"\" : ` --profile ${profileName}`}` : \".\"}`);\n  }\n  if (replacing && replacing.agentId !== profile.agentId) {\n    err(\n      pc.yellow(\n        `! Replaced profile \"${profileName}\" (agent \"${safeText(replacing.agentName)}\", ${replacing.agentId}). Its key still works until you rotate it or delete that agent in the console; config backups made by setup-mcp (*.xaq-backup-*, or *.agentinbox-backup-* from before the rename) may contain it.`, // rename-xaq: keep\n      ),\n    );\n  }\n\n  const access = await printGrants(url, profile.apiKey, profileName);\n\n  let mcp: McpSetupResult | null = null;\n  if (flags.setupMcp) {\n    mcp = setupMcp(tool, mcpTarget(profileName, profile), path);\n    printMcpResult(mcp);\n  }\n  // Mail-only steps (the listener's mail wording, the test email) only when it has a mailbox; unknown = as before.\n  printNextSteps(profileName, profile, tool, mcp, { mail: access ? access.grants.length > 0 : true });\n  return CONNECT_EXIT.approved;\n}\n\n/**\n * The approve link. The daemon builds it from its public URL setting (default http://localhost:<port>),\n * which may not be the address this CLI reached it at (127.0.0.1, a LAN IP, an SSH tunnel's port): then\n * the link on the address we used comes first, and the public-URL one is shown as well.\n */\nexport function approveLinks(url: string, start: Pick<PairingStart, \"verificationUrl\" | \"userCode\">): { primary: string; publicUrl: string | null } {\n  let advertised: URL;\n  try {\n    advertised = new URL(start.verificationUrl);\n  } catch {\n    return { primary: start.verificationUrl, publicUrl: null };\n  }\n  const ours = new URL(url);\n  if (advertised.origin === ours.origin) return { primary: start.verificationUrl, publicUrl: null };\n  // Same page on our address: keep a path prefix we connected through (reverse proxy), else swap the origin.\n  const rest = `${advertised.search}${advertised.hash}`;\n  const primary = advertised.pathname.endsWith(\"/approvals\") ? `${url}/approvals${rest}` : `${ours.origin}${advertised.pathname}${rest}`;\n  return { primary, publicUrl: start.verificationUrl };\n}\n\n/** What the approver actually granted, in plain words (the console's choice decides, not the request). Null when unreadable. */\nasync function printGrants(url: string, key: string, profileName: string): Promise<AgentSelf | null> {\n  const p = profileName === DEFAULT_PROFILE ? \"\" : ` --profile ${profileName}`;\n  try {\n    const self = await getSelf(url, key, 8000);\n    out(`  ${pc.bold(\"Access granted\")} ${pc.gray(\"(chosen by whoever approved it; change it in the console under Agents):\")}`);\n    for (const line of describeGrants(self.grants, self.connections)) out(`    ${hasAccess(self) ? line : pc.yellow(line)}`);\n    return self;\n  } catch (e) {\n    err(pc.yellow(`! Couldn't read this agent's access yet (${e instanceof Error ? e.message.split(\"\\n\")[0] : String(e)}). Check it with: ${NPX} listen status${p}`));\n    return null;\n  }\n}\n\nexport function printMcpResult(r: McpSetupResult): void {\n  if (r.ok) out(`${r.dryRun ? pc.cyan(\"○\") : pc.green(\"✔\")} ${r.message}`);\n  else err(`${pc.yellow(\"!\")} ${r.message}`);\n  if (r.ok && r.changes?.length) {\n    // Indented lines are file contents; the rest are steps.\n    for (const l of r.changes) out(l.startsWith(\" \") ? pc.gray(`  ${l}`) : `  - ${l}`);\n  }\n  if (r.backup) out(pc.gray(`  Backup: ${r.backup}`));\n  if (!r.ok && r.manual?.length) {\n    out(\"  Do it by hand:\");\n    for (const l of r.manual) out(`    ${l}`);\n  }\n  if (r.ok && r.verify?.length) out(`  ${r.dryRun ? \"Afterwards, check it with\" : \"Check it with\"}: ${r.verify.map((v) => pc.cyan(v)).join(\"; \")}`);\n  if (r.ok) for (const n of r.notes ?? []) out(`  ${n}`);\n}\n\nfunction skillCommand(tool: AgentTool, url: string): string {\n  switch (tool) {\n    case \"claude-code\":\n      return `${NPX} skill install --target claude --url ${url}`;\n    case \"codex\":\n      return `${NPX} skill install --target codex --url ${url}`;\n    case \"hermes\":\n      return `${NPX} skill install --target ~/.hermes/skills/email --url ${url}`;\n    case \"cursor\":\n      return `${NPX} skill install --target agents --url ${url}`;\n    default:\n      // install, not `skill print > SKILL.md`: a redirect would capture npx's \"Ok to proceed?\" prompt into the file.\n      return `${NPX} skill install --target ./skills --url ${url}`;\n  }\n}\n\n/** `listen hermes … --run`: creates the Hermes route (the console shows the same command). */\nexport const hermesRouteCommand = (profileName: string) => `${NPX} listen hermes${profileName === DEFAULT_PROFILE ? \"\" : ` --profile ${profileName}`} --deliver telegram --run`;\n\nexport function printNextSteps(profileName: string, profile: Profile, tool: AgentTool, mcp: McpSetupResult | null, o: { mail?: boolean } = {}): void {\n  const mail = o.mail !== false;\n  const p = profileName === DEFAULT_PROFILE ? \"\" : ` --profile ${profileName}`;\n  const label = tool === \"other\" ? \"your agent\" : TOOL_LABELS[tool];\n  const r = recipe(tool, profileName);\n  // Known tools use --recipe: no `$(…)` for npx's install prompt to hide in, and the command stays the CLI's own.\n  const target = tool === \"other\" ? `--exec ${shellQuote(r.exec!)}` : `--recipe ${tool}`;\n  out();\n  out(pc.bold(\"Next steps\"));\n  let n = 1;\n  if (mcp?.ok) {\n    out(`  ${n++}. ${label} has the xaq MCP tools ${pc.gray(`(restart it if it's running)`)}.`);\n  } else if (tool === \"other\") {\n    out(`  ${n++}. Point your agent's MCP client at ${pc.cyan(profile.mcpUrl ?? `${profile.url}/mcp`)} with header Authorization: Bearer <key>`);\n    out(pc.gray(`     The key is the \"apiKey\" field in ${profilePath(profileName)}.`));\n  } else {\n    out(`  ${n++}. Give ${label} the xaq MCP tools without ever seeing the key:`);\n    out(`       ${pc.cyan(`${NPX} setup-mcp --tool ${tool}${p}`)}  ${pc.gray(\"(add --dry-run to see exactly what it changes first)\")}`);\n  }\n  out(`  ${n++}. Install the xaq skill so ${label} knows the rules:`);\n  out(`       ${pc.cyan(skillCommand(tool, profile.url))}`);\n  if (tool === \"hermes\") {\n    out(`  ${n++}. Create the Hermes gateway route the listener forwards to, saying where Hermes should tell you (once; needs the gateway's webhook platform on):`);\n    out(`       ${pc.cyan(hermesRouteCommand(profileName))}`);\n    out(pc.gray(`     Or --deliver discord|slack|…, or --deliver-chat-id <id>. It sets the listener's secret without showing it and limits the route to the xaq tools.`));\n  }\n  if (mail) {\n    out(`  ${n++}. Wake ${label} when mail arrives. First try it in the foreground (Ctrl-C stops it; --save keeps the command in the profile):`);\n    out(`       ${pc.cyan(`${NPX} listen${p} --save ${target}`)}`);\n    out(pc.gray(`     Only new mail wakes it (message.received), not mail you send. Change it with --types, e.g. --types thread.reply_received (only replies to threads you sent) or --types all.`));\n    out(pc.gray(`     Gmail's Promotions, Social and Forums tabs are skipped (--all-categories to include them); skip more with --not-from '*@github.com'. --batch 60s runs a burst of mail once.`));\n  } else {\n    // No mailbox: its connections' events (an approval waiting, a connection that needs reconnecting).\n    out(`  ${n++}. Wake ${label} when one of its connections needs it. First try it in the foreground (Ctrl-C stops it; --save keeps the command in the profile):`);\n    out(`       ${pc.cyan(`${NPX} listen${p} --save ${target} --types approval.requested,connection.auth_failed,connection.expiring`)}`);\n    out(pc.gray(`     Add an integration's own events too, e.g. whoop.recovery_updated.`));\n  }\n  out(pc.gray(`     What the woken agent can use: ${r.confinement}.`));\n  out(pc.gray(`     Where its output goes: ${r.output}`));\n  for (const note of r.notes.filter((x) => tool !== \"hermes\" || !x.startsWith(\"Create the Hermes route\"))) out(pc.gray(`     ${note}`));\n  if (tool !== \"other\") {\n    out(pc.gray(`     It runs: ${r.runs}`));\n    if (r.exec) out(pc.gray(`     To change it: ${NPX} listen${p} --print-recipe ${tool} prints it; pass your edit with --exec '…' instead of --recipe.`));\n  }\n  if (mail) {\n    out(`  ${n++}. Check that it works: in the console's setup, the \"Check that it works\" step sends a test email.`);\n    out(\n      `     Watch it arrive in the foreground listener as ${pc.cyan(\"→ #… message.received\")} followed by one ${pc.green(\"✓\")} line once ${\n        tool === \"hermes\" ? \"Hermes accepted it (Hermes then triages it and tells you if it matters)\" : `${label} handled it`\n      }.`,\n    );\n  }\n  out(`  ${n++}. Then keep it running in the background (systemd / launchd, starts at login; stop the foreground one first):`);\n  out(`       ${pc.cyan(`${NPX} listen service install${p}`)}`);\n  out(`       ${pc.cyan(`${NPX} listen status${p}`)}  ${pc.gray(\"(connection, cursor, recent events and the access granted)\")}`);\n  out();\n}\n"],"mappings":";;;;;;;;;;;;;;;;;AAkCA,MAAa,eAAe;CAAE,UAAU;CAAG,OAAO;CAAG,QAAQ;CAAG,SAAS;CAAG,UAAU;CAAG,WAAW;AAAI;AASxG,SAAgB,UAAU,OAAsC;CAC9D,IAAI,UAAU,KAAA,GAAW,OAAO;CAChC,MAAM,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,QAAQ,YAAY,aAAa;CACtE,IAAI,CAAE,MAA4B,SAAS,CAAC,GAAG,MAAM,IAAI,MAAM,mBAAmB,MAAM,oBAAoB,MAAM,KAAK,IAAI,EAAE,EAAE;CAC/H,OAAO;AACT;AAEA,SAAgB,kBAAkB,OAAqD;CACrF,IAAI,UAAU,KAAA,GAAW,OAAO,KAAA;CAChC,MAAM,OAAO,MACV,MAAM,GAAG,CAAC,CACV,KAAK,MAAM,EAAE,KAAK,CAAC,CAAC,YAAY,CAAC,CAAC,CAClC,OAAO,OAAO;CACjB,MAAM,MAAM,KAAK,QAAQ,MAAM,CAAE,aAAmC,SAAS,CAAC,CAAC;CAC/E,IAAI,IAAI,QAAQ,MAAM,IAAI,MAAM,oBAAoB,IAAI,SAAS,IAAI,QAAQ,IAAI,GAAG,IAAI,KAAK,IAAI,EAAE,iBAAiB,aAAa,KAAK,IAAI,EAAE,EAAE;CAC9I,OAAO,CAAC,GAAG,IAAI,IAAI,IAAI,CAAC;AAC1B;AAEA,MAAM,kBAAkB,SAAS,CAAC,CAAC,QAAQ,wBAAwB,EAAE;AAErE,MAAM,SAAS,IAAY,WACzB,IAAI,SAAe,YAAY;CAC7B,MAAM,IAAI,WAAW,SAAS,EAAE;CAChC,QAAQ,iBACN,eACM;EACJ,aAAa,CAAC;EACd,QAAQ;CACV,GACA,EAAE,MAAM,KAAK,CACf;AACF,CAAC;AAGH,MAAM,aAAa,MAAc,EAAE,QAAQ,mBAAmB,EAAE;;AAEhE,IAAI,QAAuB;AAC3B,MAAM,SAAS,MAAc;CAC3B,IAAI,UAAU,MAAM,UAAU,OAAO,UAAU,CAAC,IAAI,IAAI;AAC1D;AACA,MAAM,OAAO,IAAI,OAAO;CACtB,QAAQ,OAAO,MAAM,GAAG,EAAE,GAAG;CAC7B,MAAM,CAAC;AACT;AACA,MAAM,OAAO,IAAI,OAAO;CACtB,QAAQ,OAAO,MAAM,GAAG,EAAE,GAAG;CAC7B,MAAM,CAAC;AACT;;;;;;AAOA,SAAgB,eAAe,MAAsB;CACnD,IAAI;EACF,OAAO,SAAS,MAAM,UAAU,WAAW,UAAU,UAAU,UAAU,SAAS,UAAU,YAAY,GAAK;CAC/G,SAAS,GAAG;EACV,IAAK,EAA4B,SAAS,UAAU,MAAM;CAC5D;CACA,MAAM,KAAK,UAAU,IAAI;CACzB,MAAM,MAAM,QAAQ,SAAS;CAC7B,IAAI,CAAC,GAAG,OAAO,KAAM,QAAQ,KAAA,KAAa,GAAG,QAAQ,KAAM,MAAM,IAAI,MAAM,kBAAkB,KAAK,oDAAoD;CACtJ,MAAM,KAAK,SAAS,MAAM,UAAU,WAAW,UAAU,UAAU,UAAU,UAAU;CACvF,WAAW,IAAI,GAAK;CACpB,OAAO;AACT;AAEA,eAAsB,WAAW,QAAgB,OAAqB,OAAuB,CAAC,GAAoB;CAChH,IAAI,MAAM,KAAK,QAAQ,eAAe,MAAM,GAAG;CAC/C,IAAI;EACF,OAAO,MAAM,QAAQ,QAAQ,OAAO,IAAI;CAC1C,UAAU;EACR,IAAI,UAAU,MAAM,UAAU,KAAK;EACnC,QAAQ;CACV;AACF;AAEA,eAAe,QAAQ,QAAgB,OAAqB,MAAuC;CACjG,MAAM,MAAM,mBAAmB,MAAM;CACrC,MAAM,UAAU,MAAM,eAAe,KAAK,EAAE,UAAU,MAAM,SAAS,CAAC;CACtE,IAAI,QAAQ,SAAS,IAAI,eAAe,QAAQ,OAAO,CAAC;CAExD,MAAM,cAAc,iBAAiB,MAAM,WAAA,SAA0B;CACrE,IAAI,YAA4B;CAChC,IAAI,cAAc,WAAW,KAAK,MAAM,OACtC,IAAI;EACF,YAAY,YAAY,WAAW;CACrC,QAAQ,CAER;CAEF,IAAI,cAAc,WAAW,KAAK,CAAC,MAAM,OAAO;EAC9C,IAAI,MAAM;EACV,IAAI;GACF,MAAM,IAAI,YAAY,WAAW;GACjC,MAAM,YAAY,SAAS,EAAE,SAAS,EAAE,OAAO,EAAE,IAAI;EACvD,QAAQ,CAER;EACA,MAAM,SAAS,aAAa;EAC5B,MAAM,IAAI,MACR,YAAY,YAAY,kBAAkB,IAAI,gDACE,OAAO,SAAS,IAAI,eAAe,OAAO,KAAK,IAAI,EAAE,KAAK,GAAG,oCAC/G;CACF;CACA,MAAM,OAAO,UAAU,MAAM,IAAI;CACjC,MAAM,eAAe,kBAAkB,MAAM,YAAY;CAEzD,MAAM,WAAW,cAAc,MAAM,YAAY,WAAW,YAAY,gBAAgB,WAAW,CAAC;CACpG,MAAM,QAAQ,MAAM,MAAM,KAAK,KAAK,GAAG,SAAS,UAAU,UAAU,YAAY,MAAM,MAAM,UAAU,IAAA,CAAK,MAAM,GAAG,EAAE;CAEtH,MAAM,QAA2B;EAC/B;EACA,WAAW;GACT,GAAI,MAAM,SAAS,SAAS,EAAE,UAAU,MAAM,QAAQ,IAAI,CAAC;GAC3D,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;GACvC,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;EACjD;EACA,QAAQ;GAAE,GAAG,WAAW;GAAG;EAAK;CAClC;CAEA,IAAI;CACJ,IAAI;EACF,QAAQ,MAAM,aAAa,KAAK,KAAK;CACvC,SAAS,GAAG;EACV,IAAI,aAAa,YAAY,EAAE,WAAW,KACxC,MAAM,IAAI,MAAM,GAAG,IAAI,8FAA8F;EAEvH,IAAI,aAAa,UAAU,MAAM,IAAI,MAAM,GAAG,EAAE,UAAU,EAAE,OAAO,OAAO,EAAE,SAAS,IAAI;EACzF,MAAM;CACR;CAEA,MAAM,QAAQ,aAAa,KAAK,KAAK;CACrC,IAAI;CACJ,IACE,IAAI;EACF,GAAG,KAAK,uCAAuC;EAC/C;EACA,WAAW,GAAG,KAAK,GAAG,OAAO,SAAS,MAAM,UAAU,EAAE,CAAC,CAAC;EAC1D,WAAW,GAAG,KAAK,SAAS,MAAM,SAAS,GAAG,CAAC;EAC/C,GAAI,MAAM,YACN,CAAC,WAAW,GAAG,KAAK,SAAS,MAAM,WAAW,GAAG,CAAC,KAAK,GAAG,KAAK,sFAAsF,CAAC,IACtJ,CAAC;EACL,WAAW,SAAS,IAAI;EACxB;EACA,GAAG,KAAK,oDAAoD;CAC9D,CAAC,CACH;CACA,IAAI;CAGJ,MAAM,KAAK,IAAI,gBAAgB;CAC/B,MAAM,gBAAgB,GAAG,MAAM;CAC/B,KAAK,QAAQ,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;CAC9D,MAAM,iBAAiB,GAAG,MAAM;CAChC,IAAI,KAAK,eAAe,QAAQ,GAAG,UAAU,QAAQ;CAErD,MAAM,UAAU,KAAK,IAAI;CACzB,MAAM,YAAY,KAAK,MAAM,MAAM,SAAS,KAAK,UAAU;CAC3D,IAAI,WAAW,KAAK,IAAI,GAAG,MAAM,YAAY,CAAC,IAAI;CAClD,IAAI,OAAO;CACX,MAAM,SAAS,IAAI,WAAW,QAAQ,MAAM;CAC5C,OAAO,YAEH,0BAA0B,eAAe,KAAK,IAAI,IAAI,OAAO,EAAE,6BAA6B,eAAe,YAAY,KAAK,IAAI,CAAC,IAAI,OAAO,GAAG,OAAO,MAAM,MAAM,IAAI,IAC1K;CAEA,IAAI,SAA6B;CACjC,IAAI;EACF,OAAO,CAAC,GAAG,OAAO,SAAS;GACzB,MAAM,MAAM,KAAK,kBAAkB,UAAU,GAAG,MAAM;GACtD,IAAI,GAAG,OAAO,SAAS;GACvB,IAAI;IACF,MAAM,IAAI,MAAM,YAAY,KAAK,MAAM,UAAU;IACjD,OAAO;IACP,IAAI,EAAE,WAAW,WAAW;IAC5B,IAAI,EAAE,WAAW,aAAa;KAE5B,WAAW,KAAK,IAAI,WAAW,MAAO,EAAE,YAAY,KAAK,GAAI;KAC7D;IACF;IACA,SAAS;IACT;GACF,SAAS,GAAG;IACV,IAAI,aAAa,YAAY,EAAE,WAAW,KAAK;KAC7C,YAAY;KACZ,OAAO;KACP;IACF;IACA,IAAI,aAAa,YAAY,EAAE,UAAU,OAAO,EAAE,SAAS,OAAO,EAAE,WAAW,KAC7E,MAAM,IAAI,MAAM,GAAG,EAAE,UAAU,EAAE,OAAO,OAAO,EAAE,SAAS,IAAI;IAGhE,OAAO;IACP,IAAI,KAAK,IAAI,IAAI,YAAY,KAAQ;KACnC,SAAS,EAAE,QAAQ,UAAU;KAC7B;IACF;GACF;EACF;CACF,UAAU;EACR,OAAO,KAAK;EACZ,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,QAAQ;EACtD,KAAK,QAAQ,oBAAoB,SAAS,OAAO;CACnD;CAEA,IAAI,CAAC,QAAQ;EACX,IAAI,GAAG,OAAO,+DAA+D,CAAC;EAC9E,OAAO,aAAa;CACtB;CAEA,QAAQ,OAAO,QAAf;EACE,KAAK;GACH,IAAI,GAAG,IAAI,0CAA0C,OAAO,OAAO,KAAK,SAAS,OAAO,MAAM,GAAG,MAAM,KAAK,CAAC;GAC7G,OAAO,aAAa;EACtB,KAAK;GACH,IAAI,GAAG,IAAI,4CAA4C,CAAC;GACxD,IAAI,wEAAwE,eAAe,KAAK,MAAM,MAAM,SAAS,IAAI,OAAO,EAAE,EAAE;GACpI,OAAO,aAAa;EACtB,KAAK;GACH,IAAI,GAAG,IAAI,+GAA+G,CAAC;GAC3H,IAAI,oEAAoE,IAAI,sDAAsD;GAClI,OAAO,aAAa;EACtB,KAAK,YACH;EACF,SACE,MAAM,IAAI,MAAM,6BAA6B,KAAK,UAAW,OAA+B,MAAM,GAAG;CACzG;CAkBA,MAAM,UAAmB;EACvB,GAf6B,YAC3B;GACE,OAAO,UAAU;GACjB,QAAQ,UAAU;GAClB,aAAa,UAAU;GACvB,MAAM,UAAU;GAChB,SAAS,UAAU;GACnB,eAAe,UAAU;GACzB,aAAa,UAAU;GACvB,gBAAgB,UAAU;GAC1B,aAAa,UAAU;GACvB,KAAK,UAAU;EACjB,IACA,CAAC;EAGH;EACA,QAAQ,OAAO;EACf,SAAS,OAAO,MAAM;EACtB,WAAW,OAAO,MAAM;EACxB;EACA,GAAI,QAAQ,SAAS,aAAa,EAAE,UAAU,KAAK,IAAI,CAAC;EACxD;EAGA,QAAQ,GAAG,IAAI;EACf,UAAU,GAAG,IAAI;EACjB,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;CACpC;CACA,MAAM,OAAO,YAAY,aAAa,OAAO;CAC7C,qBAAqB,aAAa,QAAQ,MAAO;CACjD,IAAI,OAAO,OAAO,WAAW,YAAY,OAAO,WAAW,QAAQ,QACjE,IACE,GAAG,OACD,+CAA+C,SAAS,OAAO,QAAQ,GAAG,EAAE,qCAAqC,QAAQ,OAAO,wGAClI,CACF;CAGF,IAAI,GAAG,GAAG,MAAM,GAAG,EAAE,mBAAmB,GAAG,KAAK,SAAS,OAAO,MAAM,IAAI,CAAC,EAAE,GAAG,GAAG,KAAK,IAAI,OAAO,MAAM,GAAG,EAAE,EAAE,eAAe;CAC/H,IAAI,kBAAkB,GAAG,KAAK,IAAI,EAAE,GAAG,GAAG,KAAK,qEAAqE,GAAG;CACvH,IAAI,cAAc,UAAU,QAAQ,UAAU,UAC5C,IAAI,mFAAmF,mBAAmB,WAAW,IAAI,KAAK,IAAI,yBAAyB,gBAAA,YAAkC,KAAK,cAAc,kBAAkB,KAAK;CAEzO,IAAI,aAAa,UAAU,YAAY,QAAQ,SAC7C,IACE,GAAG,OACD,uBAAuB,YAAY,YAAY,SAAS,UAAU,SAAS,EAAE,KAAK,UAAU,QAAQ,mMACtG,CACF;CAGF,MAAM,SAAS,MAAM,YAAY,KAAK,QAAQ,QAAQ,WAAW;CAEjE,IAAI,MAA6B;CACjC,IAAI,MAAM,UAAU;EAClB,MAAM,SAAS,MAAM,UAAU,aAAa,OAAO,GAAG,IAAI;EAC1D,eAAe,GAAG;CACpB;CAEA,eAAe,aAAa,SAAS,MAAM,KAAK,EAAE,MAAM,SAAS,OAAO,OAAO,SAAS,IAAI,KAAK,CAAC;CAClG,OAAO,aAAa;AACtB;;;;;;AAOA,SAAgB,aAAa,KAAa,OAA0G;CAClJ,IAAI;CACJ,IAAI;EACF,aAAa,IAAI,IAAI,MAAM,eAAe;CAC5C,QAAQ;EACN,OAAO;GAAE,SAAS,MAAM;GAAiB,WAAW;EAAK;CAC3D;CACA,MAAM,OAAO,IAAI,IAAI,GAAG;CACxB,IAAI,WAAW,WAAW,KAAK,QAAQ,OAAO;EAAE,SAAS,MAAM;EAAiB,WAAW;CAAK;CAEhG,MAAM,OAAO,GAAG,WAAW,SAAS,WAAW;CAE/C,OAAO;EAAE,SADO,WAAW,SAAS,SAAS,YAAY,IAAI,GAAG,IAAI,YAAY,SAAS,GAAG,KAAK,SAAS,WAAW,WAAW;EAC9G,WAAW,MAAM;CAAgB;AACrD;;AAGA,eAAe,YAAY,KAAa,KAAa,aAAgD;CACnG,MAAM,IAAI,gBAAA,YAAkC,KAAK,cAAc;CAC/D,IAAI;EACF,MAAM,OAAO,MAAM,QAAQ,KAAK,KAAK,GAAI;EACzC,IAAI,KAAK,GAAG,KAAK,gBAAgB,EAAE,GAAG,GAAG,KAAK,yEAAyE,GAAG;EAC1H,KAAK,MAAM,QAAQ,eAAe,KAAK,QAAQ,KAAK,WAAW,GAAG,IAAI,OAAO,UAAU,IAAI,IAAI,OAAO,GAAG,OAAO,IAAI,GAAG;EACvH,OAAO;CACT,SAAS,GAAG;EACV,IAAI,GAAG,OAAO,4CAA4C,aAAa,QAAQ,EAAE,QAAQ,MAAM,IAAI,CAAC,CAAC,KAAK,OAAO,CAAC,EAAE,oBAAoB,IAAI,gBAAgB,GAAG,CAAC;EAChK,OAAO;CACT;AACF;AAEA,SAAgB,eAAe,GAAyB;CACtD,IAAI,EAAE,IAAI,IAAI,GAAG,EAAE,SAAS,GAAG,KAAK,GAAG,IAAI,GAAG,MAAM,GAAG,EAAE,GAAG,EAAE,SAAS;MAClE,IAAI,GAAG,GAAG,OAAO,GAAG,EAAE,GAAG,EAAE,SAAS;CACzC,IAAI,EAAE,MAAM,EAAE,SAAS,QAErB,KAAK,MAAM,KAAK,EAAE,SAAS,IAAI,EAAE,WAAW,GAAG,IAAI,GAAG,KAAK,KAAK,GAAG,IAAI,OAAO,GAAG;CAEnF,IAAI,EAAE,QAAQ,IAAI,GAAG,KAAK,aAAa,EAAE,QAAQ,CAAC;CAClD,IAAI,CAAC,EAAE,MAAM,EAAE,QAAQ,QAAQ;EAC7B,IAAI,kBAAkB;EACtB,KAAK,MAAM,KAAK,EAAE,QAAQ,IAAI,OAAO,GAAG;CAC1C;CACA,IAAI,EAAE,MAAM,EAAE,QAAQ,QAAQ,IAAI,KAAK,EAAE,SAAS,8BAA8B,gBAAgB,IAAI,EAAE,OAAO,KAAK,MAAM,GAAG,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,IAAI,GAAG;CAChJ,IAAI,EAAE,IAAI,KAAK,MAAM,KAAK,EAAE,SAAS,CAAC,GAAG,IAAI,KAAK,GAAG;AACvD;AAEA,SAAS,aAAa,MAAiB,KAAqB;CAC1D,QAAQ,MAAR;EACE,KAAK,eACH,OAAO,GAAG,IAAI,uCAAuC;EACvD,KAAK,SACH,OAAO,GAAG,IAAI,sCAAsC;EACtD,KAAK,UACH,OAAO,GAAG,IAAI,uDAAuD;EACvE,KAAK,UACH,OAAO,GAAG,IAAI,uCAAuC;EACvD,SAEE,OAAO,GAAG,IAAI,yCAAyC;CAC3D;AACF;;AAGA,MAAa,sBAAsB,gBAAwB,GAAG,IAAI,gBAAgB,gBAAA,YAAkC,KAAK,cAAc,cAAc;AAErJ,SAAgB,eAAe,aAAqB,SAAkB,MAAiB,KAA4B,IAAwB,CAAC,GAAS;CACnJ,MAAM,OAAO,EAAE,SAAS;CACxB,MAAM,IAAI,gBAAA,YAAkC,KAAK,cAAc;CAC/D,MAAM,QAAQ,SAAS,UAAU,eAAe,YAAY;CAC5D,MAAM,IAAI,OAAO,MAAM,WAAW;CAElC,MAAM,SAAS,SAAS,UAAU,UAAU,WAAW,EAAE,IAAK,MAAM,YAAY;CAChF,IAAI;CACJ,IAAI,GAAG,KAAK,YAAY,CAAC;CACzB,IAAI,IAAI;CACR,IAAI,KAAK,IACP,IAAI,KAAK,IAAI,IAAI,MAAM,yBAAyB,GAAG,KAAK,8BAA8B,EAAE,EAAE;MACrF,IAAI,SAAS,SAAS;EAC3B,IAAI,KAAK,IAAI,qCAAqC,GAAG,KAAK,QAAQ,UAAU,GAAG,QAAQ,IAAI,KAAK,EAAE,yCAAyC;EAC3I,IAAI,GAAG,KAAK,yCAAyC,YAAY,WAAW,EAAE,EAAE,CAAC;CACnF,OAAO;EACL,IAAI,KAAK,IAAI,SAAS,MAAM,gDAAgD;EAC5E,IAAI,UAAU,GAAG,KAAK,GAAG,IAAI,oBAAoB,OAAO,GAAG,EAAE,IAAI,GAAG,KAAK,sDAAsD,GAAG;CACpI;CACA,IAAI,KAAK,IAAI,6BAA6B,MAAM,kBAAkB;CAClE,IAAI,UAAU,GAAG,KAAK,aAAa,MAAM,QAAQ,GAAG,CAAC,GAAG;CACxD,IAAI,SAAS,UAAU;EACrB,IAAI,KAAK,IAAI,iJAAiJ;EAC9J,IAAI,UAAU,GAAG,KAAK,mBAAmB,WAAW,CAAC,GAAG;EACxD,IAAI,GAAG,KAAK,uJAAuJ,CAAC;CACtK;CACA,IAAI,MAAM;EACR,IAAI,KAAK,IAAI,SAAS,MAAM,+GAA+G;EAC3I,IAAI,UAAU,GAAG,KAAK,GAAG,IAAI,SAAS,EAAE,UAAU,QAAQ,GAAG;EAC7D,IAAI,GAAG,KAAK,kLAAkL,CAAC;EAC/L,IAAI,GAAG,KAAK,kLAAkL,CAAC;CACjM,OAAO;EAEL,IAAI,KAAK,IAAI,SAAS,MAAM,kIAAkI;EAC9J,IAAI,UAAU,GAAG,KAAK,GAAG,IAAI,SAAS,EAAE,UAAU,OAAO,uEAAuE,GAAG;EACnI,IAAI,GAAG,KAAK,wEAAwE,CAAC;CACvF;CACA,IAAI,GAAG,KAAK,sCAAsC,EAAE,YAAY,EAAE,CAAC;CACnE,IAAI,GAAG,KAAK,+BAA+B,EAAE,QAAQ,CAAC;CACtD,KAAK,MAAM,QAAQ,EAAE,MAAM,QAAQ,MAAM,SAAS,YAAY,CAAC,EAAE,WAAW,yBAAyB,CAAC,GAAG,IAAI,GAAG,KAAK,QAAQ,MAAM,CAAC;CACpI,IAAI,SAAS,SAAS;EACpB,IAAI,GAAG,KAAK,iBAAiB,EAAE,MAAM,CAAC;EACtC,IAAI,EAAE,MAAM,IAAI,GAAG,KAAK,sBAAsB,IAAI,SAAS,EAAE,kBAAkB,KAAK,gEAAgE,CAAC;CACvJ;CACA,IAAI,MAAM;EACR,IAAI,KAAK,IAAI,kGAAkG;EAC/G,IACE,sDAAsD,GAAG,KAAK,uBAAuB,EAAE,mBAAmB,GAAG,MAAM,GAAG,EAAE,aACtH,SAAS,WAAW,4EAA4E,GAAG,MAAM,aAC1G,EACH;CACF;CACA,IAAI,KAAK,IAAI,8GAA8G;CAC3H,IAAI,UAAU,GAAG,KAAK,GAAG,IAAI,yBAAyB,GAAG,GAAG;CAC5D,IAAI,UAAU,GAAG,KAAK,GAAG,IAAI,gBAAgB,GAAG,EAAE,IAAI,GAAG,KAAK,4DAA4D,GAAG;CAC7H,IAAI;AACN"}