@agentproto/auth 1.0.3 → 1.1.0

package/dist/index.d.ts

@@ -914,6 +914,31 @@ declare function setAuthProfileEnabled(id: string, enabled: boolean, deps: Profi
  * Returns the updated (non-secret) profile.
  */
 declare function setAuthProfileModels(id: string, curation: ModelCuration, deps: ProfileProvisionDeps): Promise<AuthProfile>;
+/** Patch input for {@link updateAuthProfile}. Each field is tri-state:
+ *  ABSENT leaves the current value untouched, `null` clears it, and a
+ *  concrete value replaces it. At least one of `label` / `costBudget` must
+ *  be present (absent from both is a no-op input, rejected rather than
+ *  silently doing nothing). */
+interface UpdateAuthProfileInput {
+    /** New display label, or `null` to clear it. */
+    label?: string | null;
+    /** New windowed spend cap, or `null` to clear it. */
+    costBudget?: CostBudget | null;
+}
+/**
+ * Update a profile's `label` and/or `costBudget` (WS-G5) — the two fields
+ * `profile-store.ts`'s schema already carries but never had a setter for.
+ * Metadata-only, mirroring {@link setAuthProfileEnabled} / {@link
+ * setAuthProfileModels}: NEVER touches `credentialRef`, `source`, or the
+ * credential store. `null` clears a field entirely (byte-identical to a
+ * profile that never had it); ABSENT leaves the current value untouched. A
+ * given `label` is trimmed and rejected if it becomes empty or exceeds
+ * {@link MAX_LABEL_LENGTH}; a given `costBudget` is validated against the
+ * same `costBudgetSchema` the on-disk file itself is parsed with. Throws
+ * {@link AuthProfileValidationError} for an unknown id, an empty patch, or a
+ * field that fails validation. Returns the updated (non-secret) profile.
+ */
+declare function updateAuthProfile(id: string, patch: UpdateAuthProfileInput, deps: ProfileProvisionDeps): Promise<AuthProfile>;
 /** The result of {@link refreshAuthProfileModels} — the updated profile plus
  *  the diff against the previous allowlist, so a caller (CLI, MCP tool) can
  *  report exactly what changed without re-diffing itself. */
@@ -1067,4 +1092,4 @@ declare const BUILTIN_AUTH_PROVIDERS: readonly AuthProviderHandle[];
 declare const SPEC_NAME = "agentauth";
 declare const SPEC_VERSION = "v1";
 
-export { type AdapterAuthManifest, type AuthConfig, type AuthMethod, type AuthProfile, AuthProfileValidationError, type AuthProfilesFile, type AuthProviderDefinition, type AuthProviderFrontmatter, type AuthProviderHandle, type AuthProviderManifest, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, type CostBudget, type CostBudgetScope, type CreateAuthProfileInput, type CreatedAuthProfile, CredentialBroker, type CredentialBrokerOptions, type CredentialIdentity, type CredentialStore, type DeletedAuthProfile, type DeviceCodeAuthConfig, type DiscoveredEndpoints, DiscoveryError, FLOW_ENGINES, FileStore, type FlowEngine, type FlowId, type FlowResult, type FlowRunOptions, type InstallConfig, KeychainStore, MemoryStore, type ModelCuration, type PATAuthConfig, type ProfileProvisionDeps, type RefreshAuthProfileModelsResult, type RunFlowOptions, SPEC_NAME, SPEC_VERSION, type ServiceAuthConfig, type StoreRef, type StoredCredential, type TokenStoreSpec, type ValidatedCreateInput, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, fingerprintCredential, getAuthProfile, getAuthProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, loadAuthProfiles, methodsPresentable, parseAuthProviderManifest, parseAuthProviderManifestRaw, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, validateCreateInput, writeKeychainToken };
+export { type AdapterAuthManifest, type AuthConfig, type AuthMethod, type AuthProfile, AuthProfileValidationError, type AuthProfilesFile, type AuthProviderDefinition, type AuthProviderFrontmatter, type AuthProviderHandle, type AuthProviderManifest, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, type CostBudget, type CostBudgetScope, type CreateAuthProfileInput, type CreatedAuthProfile, CredentialBroker, type CredentialBrokerOptions, type CredentialIdentity, type CredentialStore, type DeletedAuthProfile, type DeviceCodeAuthConfig, type DiscoveredEndpoints, DiscoveryError, FLOW_ENGINES, FileStore, type FlowEngine, type FlowId, type FlowResult, type FlowRunOptions, type InstallConfig, KeychainStore, MemoryStore, type ModelCuration, type PATAuthConfig, type ProfileProvisionDeps, type RefreshAuthProfileModelsResult, type RunFlowOptions, SPEC_NAME, SPEC_VERSION, type ServiceAuthConfig, type StoreRef, type StoredCredential, type TokenStoreSpec, type UpdateAuthProfileInput, type ValidatedCreateInput, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, fingerprintCredential, getAuthProfile, getAuthProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, loadAuthProfiles, methodsPresentable, parseAuthProviderManifest, parseAuthProviderManifestRaw, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, updateAuthProfile, validateCreateInput, writeKeychainToken };

package/dist/index.mjs

@@ -1458,6 +1458,61 @@ async function setAuthProfileModels(id, curation, deps) {
   await deps.addProfile(updated);
   return updated;
 }
+var MAX_LABEL_LENGTH = 200;
+async function updateAuthProfile(id, patch, deps) {
+  const trimmed = (id ?? "").trim();
+  if (!trimmed) throw new AuthProfileValidationError("id is required");
+  const hasLabel = Object.prototype.hasOwnProperty.call(patch, "label");
+  const hasCostBudget = Object.prototype.hasOwnProperty.call(patch, "costBudget");
+  if (!hasLabel && !hasCostBudget) {
+    throw new AuthProfileValidationError(
+      "at least one of label or costBudget is required"
+    );
+  }
+  let nextLabel;
+  if (hasLabel && patch.label !== null) {
+    if (typeof patch.label !== "string") {
+      throw new AuthProfileValidationError("label must be a string or null");
+    }
+    nextLabel = patch.label.trim();
+    if (!nextLabel) {
+      throw new AuthProfileValidationError("label must not be blank; pass null to clear it");
+    }
+    if (nextLabel.length > MAX_LABEL_LENGTH) {
+      throw new AuthProfileValidationError(
+        `label must be at most ${MAX_LABEL_LENGTH} characters`
+      );
+    }
+  }
+  let nextCostBudget;
+  if (hasCostBudget && patch.costBudget !== null) {
+    const parsed = costBudgetSchema.safeParse(patch.costBudget);
+    if (!parsed.success) {
+      throw new AuthProfileValidationError(
+        `costBudget is invalid: ${parsed.error.issues.map((i) => i.message).join(", ")}`
+      );
+    }
+    nextCostBudget = parsed.data;
+  }
+  const profile = await deps.getProfile(trimmed);
+  if (!profile) {
+    throw new AuthProfileValidationError(`no profile with id "${trimmed}"`);
+  }
+  const { label: _dropLabel, costBudget: _dropCostBudget, ...rest } = profile;
+  const updated = { ...rest };
+  if (hasLabel) {
+    if (nextLabel !== void 0) updated.label = nextLabel;
+  } else if (profile.label !== void 0) {
+    updated.label = profile.label;
+  }
+  if (hasCostBudget) {
+    if (nextCostBudget !== void 0) updated.costBudget = nextCostBudget;
+  } else if (profile.costBudget !== void 0) {
+    updated.costBudget = profile.costBudget;
+  }
+  await deps.addProfile(updated);
+  return updated;
+}
 async function refreshAuthProfileModels(id, currentIds, deps) {
   const trimmed = (id ?? "").trim();
   if (!trimmed) throw new AuthProfileValidationError("id is required");
@@ -1506,6 +1561,6 @@ function eligibleProfiles(profiles, manifest, route) {
 var SPEC_NAME = "agentauth";
 var SPEC_VERSION = "v1";
 
-export { AuthProfileValidationError, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, CredentialBroker, DiscoveryError, FLOW_ENGINES, FileStore, KeychainStore, MemoryStore, SPEC_NAME, SPEC_VERSION, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, fingerprintCredential, getAuthProfile, getAuthProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, loadAuthProfiles, methodsPresentable, parseAuthProviderManifest, parseAuthProviderManifestRaw, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, validateCreateInput, writeKeychainToken };
+export { AuthProfileValidationError, BUILTIN_AUTH_PROVIDERS, CeremonyRequiredError, CredentialBroker, DiscoveryError, FLOW_ENGINES, FileStore, KeychainStore, MemoryStore, SPEC_NAME, SPEC_VERSION, addAuthProfile, authConfigSchema, authProfilesPath, authProviderFrontmatterSchema, createAuthProfile, credentialIdentity, defineAuthProvider, deleteAuthProfile, deleteKeychainToken, deriveCredentialRef, discoverEndpoints, eligibleProfiles, fingerprintCredential, getAuthProfile, getAuthProvider, guildeAuthProvider, installConfigSchema, listAuthProfiles, listAuthProviderIds, listAuthProviders, loadAuthProfiles, methodsPresentable, parseAuthProviderManifest, parseAuthProviderManifestRaw, readKeychainToken, refreshAuthProfileModels, registerAuthProvider, removeAuthProfile, resolveAccount, resolveEndpoint, resolveStoreRef, runAuthFlow, setAuthProfileEnabled, setAuthProfileModels, tokenStoreSpecSchema, updateAuthProfile, validateCreateInput, writeKeychainToken };
 //# sourceMappingURL=index.mjs.map
 //# sourceMappingURL=index.mjs.map

package/dist/index.mjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/schema.ts","../src/define-auth-provider.ts","../src/manifest.ts","../src/builtins.ts","../src/registry.ts","../src/http.ts","../src/discover.ts","../src/token-store.ts","../src/store/keychain-store.ts","../src/store/resolve-ref.ts","../src/flow-engines/pat.ts","../src/flow-engines/device-grant.ts","../src/flow-engines/service-auth.ts","../src/flow-engines/device-code.ts","../src/flow-engines/index.ts","../src/run-flow.ts","../src/store/memory-store.ts","../src/store/file-store.ts","../src/broker.ts","../src/profile-store.ts","../src/profile-provision.ts","../src/eligibility.ts","../src/index.ts"],"names":["z","resolve","promisify","execFile","DEFAULT_POLL_INTERVAL_S","keyOf","headers","readFile","mkdir","writeFile","profile","updated"],"mappings":";;;;;;;;;;;;;;;;AAUO,IAAM,oBAAA,GAAuB,EACjC,MAAA,CAAO;AAAA,EACN,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,MAAM,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACjC,SAAS,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA;AAC7B,CAAC,EACA,MAAA;AAEI,IAAM,mBAAA,GAAsB,EAChC,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,KAAK,CAAA;AAAA,EACrB,UAAA,EAAY;AACd,CAAC,EACA,MAAA,EAAO;AAEH,IAAM,uBAAA,GAA0B,EACpC,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,cAAc,CAAA;AAAA,EAC9B,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACrC,WAAW,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACtC,UAAA,EAAY;AACd,CAAC,EACA,MAAA,EAAO;AAEH,IAAM,0BAAA,GAA6B,EACvC,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7B,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACrC,OAAO,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAClC,aAAa,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACxC,UAAA,EAAY;AACd,CAAC,EACA,MAAA,EAAO;AAEH,IAAM,gBAAA,GAAmB,CAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAC3D,mBAAA;AAAA,EACA,uBAAA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,mBAAA,GAAsB,EAChC,MAAA,CAAO;AAAA,EACN,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACzB,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC;AAChC,CAAC,EACA,MAAA;AAEI,IAAM,6BAAA,GAAgC,EAC1C,MAAA,CAAO;AAAA,EACN,EAAA,EAAI,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EAC5B,WAAA,EAAa,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAI,CAAA;AAAA,EACvC,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI;AAAA,EACxB,IAAA,EAAM,gBAAA;AAAA,EACN,OAAA,EAAS,oBAAoB,QAAA,EAAS;AAAA;AAAA,EAEtC,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA;AAC9B,CAAC,CAAA,CACA,QAAO,CACP,QAAA;AAAA,EACC;AACF;;;ACzDK,IAAM,qBAAqB,aAAA,CAGhC;AAAA,EACA,GAAA,EAAK,EAAA;AAAA,EACL,IAAA,EAAM,cAAA;AAAA,EACN,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAA,GAAS,6BAAA,CAA8B,SAAA,CAAU,GAAG,CAAA;AAC1D,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,6BAAA,EAAgC,OAAO,KAAA,CAAM,MAAA,CAC1C,IAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,KAAK,CAAA,CAAE,OAAO,EAAE,CAAA,CAC9C,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OACf;AAAA,IACF;AAAA,EACF,CAAA;AAAA,EACA,MAAM,GAAA,EAAK;AACT,IAAA,OAAO;AAAA,MACL,GAAG,GAAA;AAAA,MACH,MAAM,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,GAAA,CAAI,MAAM,CAAA;AAAA,MACnC,OAAA,EAAS,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,GAAA,CAAI,OAAA,EAAS,CAAA,GAAI;AAAA,KAC7D;AAAA,EACF;AACF,CAAC;ACZM,SAAS,6BACd,MAAA,EACsB;AACtB,EAAA,MAAM,MAAA,GAAS,OAAO,MAAM,CAAA;AAC5B,EAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA,CAAE,WAAW,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,MAAA,GAAS,6BAAA,CAA8B,SAAA,CAAU,MAAA,CAAO,IAAI,CAAA;AAClE,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,sDAAA,EAAoD,OAAO,KAAA,CAAM,MAAA,CAC9D,IAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,KAAK,CAAA,CAAE,OAAO,EAAE,CAAA,CAC9C,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KACf;AAAA,EACF;AACA,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,OAAO,OAAA,EAAQ;AAC1D;AAGO,SAAS,0BAA0B,MAAA,EAAoC;AAC5E,EAAA,MAAM,EAAE,WAAA,EAAY,GAAI,4BAAA,CAA6B,MAAM,CAAA;AAC3D,EAAA,OAAO,mBAAmB,WAAW,CAAA;AACvC;;;AC9BO,IAAM,qBAAqB,kBAAA,CAAmB;AAAA,EACnD,EAAA,EAAI,QAAA;AAAA,EACJ,WAAA,EACE,6FAAA;AAAA,EACF,OAAA,EAAS,yBAAA;AAAA,EACT,QAAA,EAAU,KAAA;AAAA,EACV,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,cAAA;AAAA,IACN,QAAA,EAAU,gBAAA;AAAA,IACV,UAAA,EAAY;AAAA,MACV,QAAA,EAAU,eAAA;AAAA,MACV,OAAA,EAAS;AAAA;AACX,GACF;AAAA,EACA,OAAA,EAAS;AAAA,IACP,OAAA,EAAS,oCAAA;AAAA,IACT,YAAA,EAAc;AAAA;AAElB,CAAC;AAEM,IAAM,sBAAA,GAAwD;AAAA,EACnE;AACF;;;AC5BA,IAAM,SAAA,uBAAgB,GAAA,EAAgC;AACtD,KAAA,MAAW,KAAK,sBAAA,EAAwB,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AAEtD,SAAS,qBAAqB,QAAA,EAAoC;AACvE,EAAA,SAAA,CAAU,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AACrC;AAEO,SAAS,gBAAgB,EAAA,EAA4C;AAC1E,EAAA,OAAO,SAAA,CAAU,IAAI,EAAE,CAAA;AACzB;AAEO,SAAS,iBAAA,GAA0C;AACxD,EAAA,OAAO,CAAC,GAAG,SAAA,CAAU,MAAA,EAAQ,CAAA;AAC/B;AAEO,SAAS,mBAAA,GAAgC;AAC9C,EAAA,OAAO,CAAC,GAAG,SAAA,CAAU,IAAA,EAAM,CAAA;AAC7B;;;ACZO,IAAM,uBAAA,GAA0B,GAAA;AAQhC,SAAS,gBAAgB,GAAA,EAAmB;AACjD,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,IAAI,IAAI,GAAG,CAAA;AAAA,EACjB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,GAAG,CAAA,CAAE,CAAA;AAAA,EACvC;AACA,EAAA,IAAI,CAAA,CAAE,aAAa,QAAA,EAAU;AAC7B,EAAA,MAAM,OAAO,CAAA,CAAE,QAAA;AACf,EAAA,MAAM,UAAA,GACJ,IAAA,KAAS,WAAA,IACT,IAAA,KAAS,WAAA,IACT,IAAA,KAAS,KAAA,IACT,IAAA,KAAS,OAAA,IACT,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA;AAC5B,EAAA,IAAI,CAAA,CAAE,QAAA,KAAa,OAAA,IAAW,UAAA,EAAY;AAC1C,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,iBAAiB,GAAG,CAAA,mGAAA;AAAA,GAEtB;AACF;AAcO,SAAS,cAAA,CACd,WACA,KAAA,EACgB;AAChB,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,OAAO,MAAM,CAAA;AAE9C,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,KAAA,CAAM,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,MAAM,MAAM,CAAA;AAAA,eAC/B,gBAAA,CAAiB,OAAA,EAAS,SAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC9D;AAEA,EAAA,MAAM,KAAA,GAAQ,UAAA;AAAA,IACZ,MAAM,KAAK,KAAA,CAAM,IAAI,MAAM,CAAA,wBAAA,EAA2B,SAAS,IAAI,CAAC,CAAA;AAAA,IACpE;AAAA,GACF;AAEA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,KAAA,CAAM,KAAA,EAAM;AAE3C,EAAA,OAAO;AAAA,IACL,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,OAAO,MAAM;AACX,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,KAAA,EAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC7C;AAAA,GACF;AACF;AAIA,eAAsB,kBACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,YAAoB,uBAAA,EACD;AACnB,EAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,eAAe,SAAA,EAAW,IAAA,CAAK,UAAU,MAAS,CAAA;AAC5E,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC7C,CAAA,SAAE;AACA,IAAA,KAAA,EAAM;AAAA,EACR;AACF;;;AC3EO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAC/B,SAAA;AAAA,EACT,WAAA,CAAY,SAAiB,SAAA,EAAmB;AAC9C,IAAA,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,GAAA,EAAM,OAAO,CAAA,CAAE,CAAA;AACjD,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAKA,IAAM,SAAA,GAAYA,EACf,MAAA,CAAO;AAAA,EACN,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,uBAAuBA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACpD,kBAAkBA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAC/C,0BAA0BA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA;AAChD,CAAC,EACA,KAAA,EAAM;AAET,IAAM,YAAA,GAAeA,EAClB,MAAA,CAAO;AAAA,EACN,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACpC,mBAAA,EAAqBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzC,6BAAA,EAA+BA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnD,uBAAuBA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACpD,UAAA,EAAYA,EACT,MAAA,CAAO;AAAA,IACN,KAAA,EAAOA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC3B,iBAAA,EAAmBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACvC,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACpC,eAAA,EAAiBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACrC,0BAA0BA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACvD,oBAAoBA,CAAAA,CACjB,MAAA,CAAO,EAAE,yBAAA,EAA2BA,EAAE,KAAA,CAAMA,CAAAA,CAAE,MAAA,EAAQ,EAAE,QAAA,EAAS,EAAG,CAAA,CACpE,KAAA,GACA,QAAA;AAAS,GACb,CAAA,CACA,KAAA,EAAM,CACN,QAAA;AACL,CAAC,EACA,KAAA,EAAM;AAET,IAAM,cAAA,GAAiBA,EACpB,MAAA,CAAO;AAAA,EACN,6BAAA,EAA+BA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnD,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACpC,mBAAA,EAAqBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAClC,CAAC,EACA,KAAA,EAAM;AAaT,eAAe,cAAA,CACb,IAAA,EACA,SAAA,EACA,IAAA,EAC8B;AAE9B,EAAA,MAAM,MAAA,GAAS,GAAG,IAAI,CAAA,qCAAA,CAAA;AACtB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,eAAA,CAAgB,MAAM,CAAA;AACtB,IAAA,MAAM,MAAM,MAAM,iBAAA,CAAkB,MAAA,EAAQ,SAAA,EAAW,KAAK,SAAS,CAAA;AACrE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,CAAA,aAAA,EAAgB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA,CAAA;AAAA,QAC5C;AAAA,OACF;AAAA,IACF;AACA,IAAA,GAAA,GAAM,SAAA,CAAU,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,EACxC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,gBAAgB,MAAM,GAAA;AACzC,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,kBAAA,EAAqB,GAAG,IAAI,IAAI,CAAA;AAAA,EAC3D;AAEA,EAAA,MAAM,iBAAiB,GAAA,CAAI,qBAAA,GAAwB,CAAC,CAAA,EAAG,OAAA,CAAQ,OAAO,EAAE,CAAA;AACxE,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,sCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAGA,EAAA,MAAM,KAAA,GAAQ,GAAG,cAAc,CAAA,uCAAA,CAAA;AAC/B,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,eAAA,CAAgB,KAAK,CAAA;AACrB,IAAA,MAAM,MAAM,MAAM,iBAAA,CAAkB,KAAA,EAAO,SAAA,EAAW,KAAK,SAAS,CAAA;AACpE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,CAAA,qBAAA,EAAwB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA,CAAA;AAAA,QACpD;AAAA,OACF;AAAA,IACF;AACA,IAAA,EAAA,GAAK,YAAA,CAAa,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,EAC1C,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,gBAAgB,MAAM,GAAA;AACzC,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,0BAAA,EAA6B,GAAG,IAAI,IAAI,CAAA;AAAA,EACnE;AAEA,EAAA,MAAM,gBAAgB,EAAA,CAAG,cAAA;AACzB,EAAA,MAAM,gBAAA,GAAmB,GAAG,UAAA,EAAY,iBAAA;AACxC,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,cAAA,CAAe,oCAAA,EAAsC,IAAI,CAAA;AAAA,EACrE;AACA,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,kDAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAI,QAAA,IAAY,IAAA;AAAA,IAC1B,cAAc,GAAA,CAAI,aAAA;AAAA,IAClB,cAAA;AAAA,IACA,aAAA;AAAA,IACA,oBAAoB,EAAA,CAAG,mBAAA;AAAA,IACvB,gBAAA;AAAA,IACA,aAAA,EAAe,GAAG,UAAA,EAAY,cAAA;AAAA,IAC9B,6BAA6B,EAAA,CAAG,6BAAA;AAAA,IAChC,sBAAA,EAAwB,EAAA,CAAG,UAAA,EAAY,wBAAA,IAA4B,EAAC;AAAA,IACpE,mBAAA,EAAqB,EAAA,CAAG,qBAAA,IAAyB;AAAC,GACpD;AACF;AAEA,eAAe,mBAAA,CACb,IAAA,EACA,SAAA,EACA,IAAA,EAC8B;AAC9B,EAAA,MAAM,GAAA,GAAM,GAAG,IAAI,CAAA,iCAAA,CAAA;AACnB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,eAAA,CAAgB,GAAG,CAAA;AACnB,IAAA,MAAM,MAAM,MAAM,iBAAA,CAAkB,GAAA,EAAK,SAAA,EAAW,KAAK,SAAS,CAAA;AAClE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA,CAAA;AAAA,QAC7D;AAAA,OACF;AAAA,IACF;AACA,IAAA,GAAA,GAAM,cAAA,CAAe,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,EAC7C,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,gBAAgB,MAAM,GAAA;AACzC,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,mCAAA,EAAsC,GAAG,IAAI,IAAI,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,CAAC,IAAI,cAAA,EAAgB;AACvB,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,6CAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,6BAAA,EAA+B;AACtC,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4DAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAA;AAAA,IACV,cAAA,EAAgB,IAAA;AAAA,IAChB,eAAe,GAAA,CAAI,cAAA;AAAA,IACnB,oBAAoB,GAAA,CAAI,mBAAA;AAAA,IACxB,6BAA6B,GAAA,CAAI,6BAAA;AAAA,IACjC,wBAAwB,EAAC;AAAA,IACzB,qBAAqB;AAAC,GACxB;AACF;AAEA,eAAsB,iBAAA,CACpB,OAAA,EACA,IAAA,GAAwB,EAAC,EACK;AAC9B,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAItC,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,QAAA,EAAU;AAAA,GACZ;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,cAAA,CAAe,IAAA,EAAM,SAAA,EAAW,IAAI,CAAA;AAAA,EACnD,SAAS,MAAA,EAAQ;AAKf,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAA,EAAS,MAAM,MAAA;AAKhC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,mBAAA,CAAoB,IAAA,EAAM,SAAA,EAAW,IAAI,CAAA;AAAA,IACxD,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,MAAA;AAAA,IACR;AAAA,EACF;AACF;ACrOA,IAAM,IAAA,GAAO,UAAU,QAAQ,CAAA;AAS/B,SAAS,uBAAA,GAAgC;AACvC,EAAA,IAAI,OAAA,CAAQ,aAAa,QAAA,EAAU;AACjC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,sFAAA,EACoB,QAAQ,QAAQ,CAAA,2FAAA;AAAA,KAEtC;AAAA,EACF;AACF;AAGO,SAAS,cAAA,CACd,SACA,MAAA,EACQ;AACR,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,UAAA,EAAY,MAAM,CAAA;AAC3C;AAGA,eAAsB,iBAAA,CACpB,SACA,OAAA,EAC6B;AAC7B,EAAA,uBAAA,EAAwB;AACxB,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,KAAK,UAAA,EAAY;AAAA,MACxC,uBAAA;AAAA,MACA,IAAA;AAAA,MACA,OAAA;AAAA,MACA,IAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,CAAA,GAAI,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAClC,IAAA,OAAO,CAAA,IAAK,KAAA,CAAA;AAAA,EACd,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGA,eAAsB,kBAAA,CACpB,OAAA,EACA,OAAA,EACA,KAAA,EACe;AACf,EAAA,uBAAA,EAAwB;AACxB,EAAA,MAAM,KAAK,UAAA,EAAY;AAAA,IACrB,sBAAA;AAAA,IACA,IAAA;AAAA,IACA,IAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA,KAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAKA,eAAsB,mBAAA,CACpB,SACA,OAAA,EACkB;AAClB,EAAA,uBAAA,EAAwB;AACxB,EAAA,IAAI;AACF,IAAA,MAAM,KAAK,UAAA,EAAY;AAAA,MACrB,yBAAA;AAAA,MACA,IAAA;AAAA,MACA,OAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;AClFA,IAAM,cAAA,GAAiBA,EAAE,MAAA,CAAO;AAAA,EAC9B,CAAA,EAAGA,EAAE,MAAA,EAAO;AAAA,EACZ,CAAA,EAAGA,EAAE,IAAA,CAAK,CAAC,OAAO,WAAA,EAAa,KAAA,EAAO,QAAQ,CAAC,CAAA;AAAA,EAC/C,CAAA,EAAGA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACvB,CAAA,EAAGA,CAAAA,CAAE,MAAA,CAAOA,CAAAA,CAAE,MAAA,IAAUA,CAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA;AACvC,CAAC,CAAA;AAEM,IAAM,gBAAN,MAA+C;AAAA,EACpD,MAAM,KAAK,GAAA,EAAsD;AAC/D,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,IAAA;AACnC,IAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,CAAkB,GAAA,CAAI,MAAM,OAAO,CAAA;AACrD,IAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,MAAA;AAE9B,IAAA,IAAI;AACF,MAAA,MAAM,WAAW,cAAA,CAAe,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,GAAG,CAAC,CAAA;AACrD,MAAA,OAAO;AAAA,QACL,OAAO,QAAA,CAAS,CAAA;AAAA,QAChB,MAAM,QAAA,CAAS,CAAA;AAAA,QACf,GAAI,SAAS,CAAA,KAAM,KAAA,CAAA,GAAY,EAAE,SAAA,EAAW,QAAA,CAAS,CAAA,EAAE,GAAI,EAAC;AAAA,QAC5D,GAAI,SAAS,CAAA,KAAM,KAAA,CAAA,GAAY,EAAE,QAAA,EAAU,QAAA,CAAS,CAAA,EAAE,GAAI;AAAC,OAC7D;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM,KAAA,EAAM;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,CAAM,GAAA,EAAe,IAAA,EAAuC;AAChE,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,IAAA;AACnC,IAAA,MAAM,QAAA,GAA2C;AAAA,MAC/C,GAAG,IAAA,CAAK,KAAA;AAAA,MACR,GAAG,IAAA,CAAK,IAAA;AAAA,MACR,GAAI,KAAK,SAAA,KAAc,MAAA,GAAY,EAAE,CAAA,EAAG,IAAA,CAAK,SAAA,EAAU,GAAI,EAAC;AAAA,MAC5D,GAAI,KAAK,QAAA,KAAa,MAAA,GAAY,EAAE,CAAA,EAAG,IAAA,CAAK,QAAA,EAAS,GAAI;AAAC,KAC5D;AACA,IAAA,MAAM,mBAAmB,GAAA,CAAI,IAAA,EAAM,SAAS,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,EACtE;AAAA,EAEA,MAAM,OAAO,GAAA,EAA8B;AACzC,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,IAAA;AACnC,IAAA,MAAM,mBAAA,CAAoB,GAAA,CAAI,IAAA,EAAM,OAAO,CAAA;AAAA,EAC7C;AACF;;;AC/CO,SAAS,eAAA,CACd,IAAA,EACA,MAAA,EACA,QAAA,EACU;AACV,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,QAAA;AAC/B,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,GAAW,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,IAAA;AAAA,IACzC,OAAA,EAAS,cAAA,CAAe,IAAA,CAAK,OAAA,EAAS,MAAM;AAAA,GAC9C;AACF;AAOO,SAAS,gBAAA,CACd,IAAA,EACA,MAAA,EACA,QAAA,EACwC;AACxC,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,IAAA,EAAM,MAAA,EAAQ,QAAQ,CAAA;AAClD,EAAA,MAAM,SAAA,GAAY,QAAA,GAAW,eAAA,CAAgB,IAAA,EAAM,MAAM,CAAA,GAAI,GAAA;AAC7D,EAAA,OAAO,EAAE,KAAK,SAAA,EAAU;AAC1B;AAcA,eAAsB,wBAAA,CACpB,KAAA,EACA,GAAA,EACA,SAAA,EACuC;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AACnC,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,IAAI,IAAI,IAAA,KAAS,SAAA,CAAU,QAAQ,GAAA,CAAI,OAAA,KAAY,UAAU,OAAA,EAAS;AACpE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,SAAS,CAAA;AAC7B;;;ACxCA,eAAe,YAAY,KAAA,EAAgC;AACzD,EAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA;AACtB,EAAA,MAAM,MAAM,OAAA,CAAQ,MAAA;AAEpB,EAAA,IAAI,CAAC,MAAM,KAAA,EAAO;AAChB,IAAA,OAAO,IAAI,OAAA,CAAQ,CAACC,QAAAA,KAAY;AAC9B,MAAA,MAAM,KAAK,eAAA,CAAgB,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAK,CAAA;AACjD,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,EAAA,CAAI,CAAA;AACtB,MAAA,EAAA,CAAG,QAAA,CAAS,EAAA,EAAI,CAAC,MAAA,KAAW;AAC1B,QAAA,EAAA,CAAG,KAAA,EAAM;AACT,QAAAA,QAAAA,CAAQ,MAAA,CAAO,IAAA,EAAM,CAAA;AAAA,MACvB,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACA,QAAAA,EAAS,MAAA,KAAW;AACtC,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,EAAA,CAAI,CAAA;AACtB,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,CAAM,WAAW,IAAI,CAAA;AACrB,IAAA,KAAA,CAAM,MAAA,EAAO;AACb,IAAA,KAAA,CAAM,YAAY,MAAM,CAAA;AAExB,IAAA,MAAM,UAAU,MAAM;AACpB,MAAA,KAAA,CAAM,WAAW,KAAK,CAAA;AACtB,MAAA,KAAA,CAAM,KAAA,EAAM;AACZ,MAAA,KAAA,CAAM,cAAA,CAAe,QAAQ,MAAM,CAAA;AAAA,IACrC,CAAA;AAEA,IAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAkB;AAChC,MAAA,KAAA,MAAW,MAAM,KAAA,EAAO;AACtB,QAAA,QAAQ,EAAA;AAAI,UACV,KAAK,IAAA;AAAA,UACL,KAAK,IAAA;AACH,YAAA,GAAA,CAAI,MAAM,IAAI,CAAA;AACd,YAAA,OAAA,EAAQ;AACR,YAAAA,SAAQ,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA,CAAE,MAAM,CAAA;AAC7B,YAAA;AAAA,UACF,KAAK,GAAA;AACH,YAAA,GAAA,CAAI,MAAM,IAAI,CAAA;AACd,YAAA,OAAA,EAAQ;AACR,YAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gBAAgB,CAAC,CAAA;AAClC,YAAA;AAAA,UACF,KAAK,GAAA;AACH,YAAA,GAAA,CAAI,MAAM,IAAI,CAAA;AACd,YAAA,OAAA,EAAQ;AACR,YAAAA,SAAQ,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA,CAAE,MAAM,CAAA;AAC7B,YAAA;AAAA,UACF,KAAK,MAAA;AAAA;AAAA,UACL,KAAK,IAAA;AACH,YAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,cAAA,KAAA,CAAM,GAAA,EAAI;AACV,cAAA,GAAA,CAAI,MAAM,OAAO,CAAA;AAAA,YACnB;AACA,YAAA;AAAA,UACF;AAEE,YAAA,IAAI,MAAM,GAAA,EAAK;AACb,cAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,cAAA,GAAA,CAAI,MAAM,GAAG,CAAA;AAAA,YACf;AAAA;AACJ,MACF;AAAA,IACF,CAAA;AAEA,IAAA,KAAA,CAAM,EAAA,CAAG,QAAQ,MAAM,CAAA;AAAA,EACzB,CAAC,CAAA;AACH;AAEO,IAAM,aAAA,GAA4B;AAAA,EACvC,EAAA,EAAI,KAAA;AAAA,EAEJ,MAAM,GAAA,CACJ,QAAA,EACA,WAAA,EACA,IAAA,EACqB;AACrB,IAAA,MAAM,EAAE,MAAK,GAAI,QAAA;AACjB,IAAA,IAAI,IAAA,CAAK,SAAS,KAAA,EAAO;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,IAAA,CAAK,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IACnE;AAEA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,IAAI,aAAA,EAAc;AAC9C,IAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,gBAAA;AAAA,MACzB,IAAA,CAAK,UAAA;AAAA,MACL,IAAA,CAAK,MAAA;AAAA,MACL,QAAA,CAAS;AAAA,KACX;AAEA,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,wBAAA,CAAyB,KAAA,EAAO,KAAK,SAAS,CAAA;AACrE,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAO,EAAE,WAAA,EAAa,QAAA,CAAS,KAAA,EAAO,WAAW,KAAA,EAAM;AAAA,MACzD;AAAA,IACF;AAEA,IAAA,MAAM,QAAQ,MAAM,WAAA,CAAY,CAAA,EAAG,QAAA,CAAS,EAAE,CAAA,sBAAA,CAAwB,CAAA;AACtE,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAE/C,IAAA,MAAM,KAAA,CAAM,MAAM,GAAA,EAAK,EAAE,OAAO,KAAA,EAAO,IAAA,EAAM,OAAO,CAAA;AAEpD,IAAA,OAAO,EAAE,WAAA,EAAa,KAAA,EAAO,SAAA,EAAW,KAAA,EAAM;AAAA,EAChD;AACF,CAAA;AC/GA,IAAM,SAAA,GAAYC,UAAUC,QAAQ,CAAA;AAS7B,IAAM,kBAAA,GAAqBH,EAC/B,MAAA,CAAO;AAAA,EACN,YAAA,EAAcA,EAAE,MAAA,EAAO;AAAA,EACvB,UAAA,EAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAChC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,kBAAA,EAAoBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACxC,oBAAA,EAAsBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1C,iBAAA,EAAmBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAEvC,UAAA,EAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAChC,KAAA,EAAOA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAC5B,CAAC,EACA,KAAA,EAAM;AAGF,IAAM,gBAAA,GAAmBA,EAC7B,MAAA,CAAO;AAAA,EACN,KAAA,EAAOA,EAAE,MAAA,EAAO;AAAA,EAChB,iBAAA,EAAmBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAChC,CAAC,EACA,KAAA,EAAM;AAKF,IAAM,sBAAsBA,CAAAA,CAAE,KAAA,CAAM,CAAC,kBAAA,EAAoB,gBAAgB,CAAC,CAAA;AAMjF,eAAsB,YAAY,GAAA,EAA4B;AAC5D,EAAA,MAAM,CAAC,GAAA,EAAK,IAAI,CAAA,GACd,OAAA,CAAQ,QAAA,KAAa,QAAA,GACjB,CAAC,MAAA,EAAQ,CAAC,GAAG,CAAC,CAAA,GACd,OAAA,CAAQ,QAAA,KAAa,OAAA,GACnB,CAAC,KAAA,EAAO,CAAC,IAAA,EAAM,OAAA,EAAS,GAAG,CAAC,CAAA,GAC5B,CAAC,UAAA,EAAY,CAAC,GAAG,CAAC,CAAA;AAC1B,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,EAC3B,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAKA,eAAsB,aAAA,CACpB,GAAA,EACA,MAAA,EACA,MAAA,EACA,MAAA,EACY;AACZ,EAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,CAAkB,GAAA,EAAK;AAAA,IACvC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAAA,IAC3C;AAAA,GACD,CAAA;AACD,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AACtC;AAmBA,eAAsB,gBACpB,CAAA,EACuB;AACvB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,EAAE,SAAA,GAAY,GAAA;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAE,SAAA,GAAY,GAAA;AAE3B,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,IAAI,MAAM,gBAAgB,CAAA;AACvD,IAAA,MAAM,IAAI,OAAA,CAAc,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,MAAM,CAAC,CAAA;AAEpD,IAAA,MAAM,OAAO,MAAM,aAAA;AAAA,MACjB,CAAA,CAAE,aAAA;AAAA,MACF,EAAE,UAAA,EAAY,CAAA,CAAE,SAAA,EAAW,GAAG,EAAE,MAAA,EAAO;AAAA,MACvC,mBAAA;AAAA,MACA,CAAA,CAAE;AAAA,KACJ;AAEA,IAAA,IAAI,EAAE,OAAA,IAAW,IAAA,CAAA,EAAO,OAAO,IAAA;AAE/B,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA;AACrB,IAAA,IAAI,YAAY,uBAAA,EAAyB;AACzC,IAAA,IAAI,YAAY,WAAA,EAAa;AAC3B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,IAAI,YAAY,eAAA,EAAiB;AAC/B,MAAA,MAAM,IAAI,MAAM,wDAAmD,CAAA;AAAA,IACrE;AACA,IAAA,IAAI,YAAY,eAAA,EAAiB;AAC/B,MAAA,MAAM,IAAI,MAAM,8DAAyD,CAAA;AAAA,IAC3E;AAEA,IAAA,MAAM,OAAO,IAAA,CAAK,iBAAA;AAClB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,OAAO,CAAA,EAAG,OAAO,CAAA,QAAA,EAAM,IAAI,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EAC/E;AAEA,EAAA,MAAM,IAAI,MAAM,4CAAuC,CAAA;AACzD;;;ACxGA,IAAM,gBAAA,GAAmB,wCAAA;AACzB,IAAM,qBAAA,GAAwB,6CAAA;AAC9B,IAAM,uBAAA,GAA0B,CAAA;AAUhC,IAAM,sBAAA,GAAyBA,EAC5B,MAAA,CAAO;AAAA,EACN,eAAA,EAAiBA,EAAE,MAAA,EAAO;AAAA,EAC1B,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,EACtB,KAAA,EAAOA,EACJ,MAAA,CAAO;AAAA,IACN,SAAA,EAAWA,EAAE,MAAA,EAAO;AAAA,IACpB,gBAAA,EAAkBA,EAAE,MAAA,EAAO;AAAA,IAC3B,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,IACrB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,GAC/B,EACA,KAAA;AACL,CAAC,EACA,KAAA,EAAM;AAIT,eAAe,QAAA,CACb,GAAA,EACA,IAAA,EACA,MAAA,EACA,MAAA,EACY;AACZ,EAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,CAAkB,GAAA,EAAK;AAAA,IACvC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,IACzB;AAAA,GACD,CAAA;AACD,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,MAAM,IAAI,MAAM,CAAA,KAAA,EAAQ,GAAG,WAAM,GAAA,CAAI,MAAM,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AACtC;AAQA,eAAe,iBAAA,CACb,aAAA,EACA,SAAA,EACA,QAAA,EACA,MAAA,EAC8B;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,aAAA;AAAA,MACjB,aAAA;AAAA,MACA;AAAA,QACE,UAAA,EAAY,qBAAA;AAAA,QACZ,SAAA;AAAA,QACA,SAAA,EAAW;AAAA,OACb;AAAA,MACA,mBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,OAAA,IAAW,MAAM,OAAO,IAAA;AAC5B,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAIO,IAAM,qBAAA,GAAoC;AAAA,EAC/C,EAAA,EAAI,cAAA;AAAA,EAEJ,MAAM,GAAA,CACJ,QAAA,EACA,UAAA,EACA,IAAA,EACqB;AACrB,IAAA,MAAM,EAAE,MAAK,GAAI,QAAA;AACjB,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0CAAA,EAA6C,IAAA,CAAK,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AAGA,IAAA,MAAM,MAAA,GAAS,IAAA;AACf,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,IAAY,gBAAA;AACpC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAA;AAG5C,IAAA,MAAM,gBAAA,GACJ,UAAA,EAAY,gBAAA,IAAoB,CAAA,EAAG,MAAM,CAAA,eAAA,CAAA;AAC3C,IAAA,MAAM,aAAA,GACJ,UAAA,EAAY,aAAA,IAAiB,CAAA,EAAG,MAAM,CAAA,YAAA,CAAA;AAGxC,IAAA,eAAA,CAAgB,gBAAgB,CAAA;AAChC,IAAA,eAAA,CAAgB,aAAa,CAAA;AAE7B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,IAAI,aAAA,EAAc;AAC9C,IAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,gBAAA;AAAA,MACzB,MAAA,CAAO,UAAA;AAAA,MACP,MAAA;AAAA,MACA,QAAA,CAAS;AAAA,KACX;AAMA,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA,MAAM,MAAA,GAAS,MAAM,wBAAA,CAAyB,KAAA,EAAO,KAAK,SAAS,CAAA;AACnE,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAM,YAAY,MAAM,iBAAA;AAAA,UACtB,aAAA;AAAA,UACA,MAAA,CAAO,KAAA;AAAA,UACP,QAAA;AAAA,UACA,IAAA,CAAK;AAAA,SACP;AACA,QAAA,IAAI,SAAA,EAAW;AAGb,UAAA,IAAI,UAAU,kBAAA,EAAoB;AAChC,YAAA,MAAM,KAAA,CAAM,MAAM,GAAA,EAAK;AAAA,cACrB,OAAO,SAAA,CAAU,kBAAA;AAAA,cACjB,IAAA,EAAM;AAAA,aACP,CAAA;AAAA,UACH;AACA,UAAA,OAAO;AAAA,YACL,aAAa,SAAA,CAAU,YAAA;AAAA,YACvB,GAAI,UAAU,kBAAA,GACV,EAAE,mBAAmB,SAAA,CAAU,kBAAA,KAC/B,EAAC;AAAA,YACL,SAAA,EAAW;AAAA,WACb;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,MAAM,QAAA;AAAA,MACrB,gBAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,SAAA,EAAW,QAAA;AAAA,QACX,GAAI,OAAO,SAAA,GAAY,EAAE,YAAY,MAAA,CAAO,SAAA,KAAc;AAAC,OAC7D;AAAA,MACA,sBAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,EAAE,WAAA,EAAa,KAAA,EAAM,GAAI,QAAA;AAC/B,IAAA,MAAM,SAAA,GAAY,MAAM,QAAA,IAAY,uBAAA;AACpC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,aAAa,EAAE,CAAA;AAGlD,IAAA,OAAA,CAAQ,OAAO,KAAA,CAAM;AAAA,CAAI,CAAA;AACzB,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,UAAA,EAAa,QAAA,CAAS,EAAE,CAAA;;AAAA,CAA6B,CAAA;AAC1E,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,SAAS;AAAA,CAAI,CAAA;AACpD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,gBAAgB;;AAAA,CAAM,CAAA;AAC7D,IAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,EAAO;AAC9B,MAAA,MAAM,WAAA,CAAY,MAAM,gBAAgB,CAAA;AAAA,IAC1C;AACA,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,wBAAA,EAA2B,SAAS,CAAA;;AAAA,CAAY,CAAA;AAGrE,IAAA,MAAM,WAAA,GAAc,MAAM,eAAA,CAAgB;AAAA,MACxC,aAAA;AAAA,MACA,SAAA,EAAW,gBAAA;AAAA,MACX,MAAA,EAAQ,EAAE,WAAA,EAAa,SAAA,EAAW,QAAA,EAAS;AAAA,MAC3C,SAAA;AAAA,MACA,WAAW,KAAA,CAAM,UAAA;AAAA,MACjB,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAMD,IAAA,MAAM,cAAc,WAAA,CAAY,YAAA;AAChC,IAAA,MAAM,YAAY,WAAA,CAAY,kBAAA;AAG9B,IAAA,IAAI,gBAAA;AACJ,IAAA,IAAI,YAAY,iBAAA,EAAmB;AACjC,MAAA,gBAAA,GAAmB,WAAA,CAAY,iBAAA;AAAA,IACjC,CAAA,MAAA,IAAW,YAAY,oBAAA,EAAsB;AAC3C,MAAA,gBAAA,GAAmB,IAAI,IAAA;AAAA,QACrB,IAAA,CAAK,GAAA,EAAI,GAAI,WAAA,CAAY,oBAAA,GAAuB;AAAA,QAChD,WAAA,EAAY;AAAA,IAChB;AAEA,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,KAAA,CAAM,MAAM,GAAA,EAAK;AAAA,QACrB,KAAA,EAAO,SAAA;AAAA,QACP,IAAA,EAAM,WAAA;AAAA,QACN,GAAI,gBAAA,GAAmB,EAAE,SAAA,EAAW,gBAAA,KAAqB;AAAC,OAC3D,CAAA;AAAA,IACH;AAEA,IAAA,OAAO;AAAA,MACL,WAAA;AAAA,MACA,iBAAA,EAAmB,SAAA;AAAA,MACnB,gBAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AACF,CAAA;ACzNA,IAAM,sBAAA,GAAyB,8CAAA;AAC/B,IAAM,kBAAA,GAAqB,eAAA;AAC3B,IAAMI,wBAAAA,GAA0B,CAAA;AAOzB,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAQA,IAAM,iCAAA,GAAoCJ,EACvC,MAAA,CAAO;AAAA,EACN,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,EACtB,SAAA,EAAWA,EAAE,MAAA,EAAO;AAAA,EACpB,gBAAA,EAAkBA,EAAE,MAAA,EAAO;AAAA,EAC3B,yBAAA,EAA2BA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/C,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACvB,CAAC,EACA,KAAA,EAAM;AAIT,eAAe,uBAAA,CACb,GAAA,EACA,MAAA,EACA,MAAA,EACA;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,CAAkB,GAAA,EAAK;AAAA,IACvC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAAA,IAC3C;AAAA,GACD,CAAA;AACD,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,MAAM,IAAI,MAAM,CAAA,KAAA,EAAQ,GAAG,WAAM,GAAA,CAAI,MAAM,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,iCAAA,CAAkC,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AACjE;AAIA,SAAS,UAAA,CACP,UACA,GAAA,EACoB;AACpB,EAAA,MAAM,CAAA,GAAI,WAAW,GAAG,CAAA;AACxB,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AACrC;AAEA,SAAS,UAAU,IAAA,EAAiC;AAClD,EAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,KAAA;AAC5B,EAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA;AACnC,EAAA,IAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,OAAO,CAAA,IAAK,KAAK,GAAA,EAAI;AACvB;AAEA,SAAS,iBAAiB,IAAA,EAAoC;AAC5D,EAAA,MAAM,YAAA,GAAe,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU,cAAc,CAAA;AAC7D,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU,OAAO,CAAA;AAC/C,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU,SAAS,CAAA;AACnD,EAAA,MAAM,YAAA,GAAe,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU,cAAc,CAAA;AAC7D,EAAA,OAAO;AAAA,IACL,aAAa,IAAA,CAAK,KAAA;AAAA,IAClB,SAAA,EAAW,QAAA;AAAA,IACX,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB,EAAC;AAAA,IACvC,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU,EAAC;AAAA,IACzB,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY,EAAC;AAAA,IAC7B,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB;AAAC,GACzC;AACF;AAKA,eAAe,kBAAA,CACb,aAAA,EACA,YAAA,EACA,QAAA,EACA,MAAA,EAC8B;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,aAAA;AAAA,MACjB,aAAA;AAAA,MACA;AAAA,QACE,UAAA,EAAY,kBAAA;AAAA,QACZ,aAAA,EAAe,YAAA;AAAA,QACf,SAAA,EAAW;AAAA,OACb;AAAA,MACA,mBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,OAAA,IAAW,MAAM,OAAO,IAAA;AAC5B,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,eAAe,gBAAA,CACb,KAAA,EACA,GAAA,EACA,CAAA,EASqB;AACrB,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,SAAA,GAChB,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,EAAI,GAAI,CAAA,CAAE,SAAA,GAAY,GAAK,CAAA,CAAE,aAAY,GACvD,MAAA;AAEJ,EAAA,MAAM,QAAA,GAAoC;AAAA,IACxC,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,IACnC,GAAI,EAAE,YAAA,GAAe,EAAE,cAAc,CAAA,CAAE,YAAA,KAAiB,EAAC;AAAA,IACzD,GAAI,EAAE,KAAA,GAAQ,EAAE,OAAO,CAAA,CAAE,KAAA,KAAU,EAAC;AAAA,IACpC,GAAI,EAAE,OAAA,GAAU,EAAE,SAAS,CAAA,CAAE,OAAA,KAAY,EAAC;AAAA,IAC1C,GAAI,EAAE,WAAA,GAAc,EAAE,aAAa,CAAA,CAAE,WAAA,KAAgB,EAAC;AAAA,IACtD,GAAI,EAAE,YAAA,GAAe,EAAE,cAAc,CAAA,CAAE,YAAA,KAAiB;AAAC,GAC3D;AAEA,EAAA,MAAM,KAAA,CAAM,MAAM,GAAA,EAAK;AAAA,IACrB,OAAO,CAAA,CAAE,WAAA;AAAA,IACT,IAAA,EAAM,QAAA;AAAA,IACN,GAAI,SAAA,GAAY,EAAE,SAAA,KAAc,EAAC;AAAA,IACjC;AAAA,GACD,CAAA;AAED,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,CAAE,WAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,GAAI,EAAE,YAAA,GAAe,EAAE,cAAc,CAAA,CAAE,YAAA,KAAiB,EAAC;AAAA,IACzD,GAAI,EAAE,KAAA,GAAQ,EAAE,OAAO,CAAA,CAAE,KAAA,KAAU,EAAC;AAAA,IACpC,GAAI,EAAE,OAAA,GAAU,EAAE,SAAS,CAAA,CAAE,OAAA,KAAY,EAAC;AAAA,IAC1C,GAAI,EAAE,YAAA,GAAe,EAAE,cAAc,CAAA,CAAE,YAAA,KAAiB;AAAC,GAC3D;AACF;AAIO,IAAM,oBAAA,GAAmC;AAAA,EAC9C,EAAA,EAAI,aAAA;AAAA,EAEJ,MAAM,GAAA,CACJ,QAAA,EACA,UAAA,EACA,IAAA,EACqB;AACrB,IAAA,MAAM,EAAE,MAAK,GAAI,QAAA;AACjB,IAAA,IAAI,IAAA,CAAK,SAAS,aAAA,EAAe;AAC/B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,IAAA,CAAK,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC1E;AAGA,IAAA,MAAM,MAAA,GAAS,IAAA;AACf,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,IAAY,gBAAA;AACpC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAA;AAG5C,IAAA,MAAM,2BAAA,GACJ,UAAA,EAAY,2BAAA,IAA+B,CAAA,EAAG,MAAM,CAAA,aAAA,CAAA;AACtD,IAAA,MAAM,aAAA,GAAgB,UAAA,EAAY,aAAA,IAAiB,CAAA,EAAG,MAAM,CAAA,YAAA,CAAA;AAG5D,IAAA,eAAA,CAAgB,2BAA2B,CAAA;AAC3C,IAAA,eAAA,CAAgB,aAAa,CAAA;AAE7B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,IAAI,aAAA,EAAc;AAC9C,IAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,gBAAA;AAAA,MACzB,MAAA,CAAO,UAAA;AAAA,MACP,MAAA;AAAA,MACA,QAAA,CAAS;AAAA,KACX;AAMA,IAAA,eAAe,WAAW,MAAA,EAAsD;AAC9E,MAAA,MAAM,YAAA,GAAe,UAAA,CAAW,MAAA,CAAO,QAAA,EAAU,cAAc,CAAA;AAC/D,MAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAC1B,MAAA,MAAM,YAAY,MAAM,kBAAA;AAAA,QACtB,aAAA;AAAA,QACA,YAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AACA,MAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,MAAA,OAAO,gBAAA,CAAiB,OAAO,GAAA,EAAK;AAAA,QAClC,aAAa,SAAA,CAAU,YAAA;AAAA,QACvB,WAAW,SAAA,CAAU,UAAA;AAAA,QACrB,YAAA,EAAc,UAAU,aAAA,IAAiB,YAAA;AAAA,QACzC,OAAO,SAAA,CAAU,KAAA,IAAS,UAAA,CAAW,MAAA,CAAO,UAAU,OAAO,CAAA;AAAA,QAC7D,SAAS,SAAA,CAAU,OAAA,IAAW,UAAA,CAAW,MAAA,CAAO,UAAU,SAAS,CAAA;AAAA,QACnE,aACE,MAAA,CAAO,WAAA,IAAe,UAAA,CAAW,MAAA,CAAO,UAAU,aAAa,CAAA;AAAA,QACjE,cACE,SAAA,CAAU,aAAA,IAAiB,UAAA,CAAW,MAAA,CAAO,UAAU,cAAc;AAAA,OACxE,CAAA;AAAA,IACH;AAKA,IAAA,IAAI,KAAK,WAAA,EAAa;AACpB,MAAA,MAAM,MAAA,GAAS,MAAM,wBAAA,CAAyB,KAAA,EAAO,KAAK,SAAS,CAAA;AACnE,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,IAAI,CAAC,SAAA,CAAU,MAAM,CAAA,EAAG;AACtB,UAAA,OAAO,iBAAiB,MAAM,CAAA;AAAA,QAChC;AACA,QAAA,MAAM,SAAA,GAAY,MAAM,UAAA,CAAW,MAAM,CAAA;AACzC,QAAA,IAAI,WAAW,OAAO,SAAA;AAAA,MACxB;AACA,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,CAAA,EAAG,SAAS,EAAE,CAAA,0HAAA;AAAA,OAChB;AAAA,IACF;AAMA,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA,MAAM,MAAA,GAAS,MAAM,wBAAA,CAAyB,KAAA,EAAO,KAAK,SAAS,CAAA;AACnE,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,IAAI,CAAC,SAAA,CAAU,MAAM,CAAA,EAAG;AACtB,UAAA,OAAO,iBAAiB,MAAM,CAAA;AAAA,QAChC;AACA,QAAA,MAAM,SAAA,GAAY,MAAM,UAAA,CAAW,MAAM,CAAA;AACzC,QAAA,IAAI,WAAW,OAAO,SAAA;AAAA,MAExB;AAAA,IACF;AAGA,IAAA,MAAM,MAAA,GAAiC,EAAE,SAAA,EAAW,QAAA,EAAS;AAC7D,IAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,KAAA,GAAQ,MAAA,CAAO,KAAA;AACxC,IAAA,IAAI,MAAA,CAAO,WAAA,EAAa,MAAA,CAAO,YAAA,GAAe,MAAA,CAAO,WAAA;AAErD,IAAA,MAAM,QAAQ,MAAM,uBAAA;AAAA,MAClB,2BAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,SAAA,GAAY,MAAM,QAAA,IAAYI,wBAAAA;AACpC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,aAAa,EAAE,CAAA;AAGlD,IAAA,OAAA,CAAQ,OAAO,KAAA,CAAM;AAAA,CAAI,CAAA;AACzB,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,UAAA,EAAa,QAAA,CAAS,EAAE,CAAA;;AAAA,CAA6B,CAAA;AAC1E,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,SAAS;AAAA,CAAI,CAAA;AACpD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,gBAAgB;;AAAA,CAAM,CAAA;AAC7D,IAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,EAAO;AAC9B,MAAA,MAAM,WAAA,CAAY,KAAA,CAAM,yBAAA,IAA6B,KAAA,CAAM,gBAAgB,CAAA;AAAA,IAC7E;AACA,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,wBAAA,EAA2B,SAAS,CAAA;;AAAA,CAAY,CAAA;AAGrE,IAAA,MAAM,WAAA,GAAc,MAAM,eAAA,CAAgB;AAAA,MACxC,aAAA;AAAA,MACA,SAAA,EAAW,sBAAA;AAAA,MACX,QAAQ,EAAE,WAAA,EAAa,KAAA,CAAM,WAAA,EAAa,WAAW,QAAA,EAAS;AAAA,MAC9D,SAAA;AAAA,MACA,WAAW,KAAA,CAAM,UAAA;AAAA,MACjB,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAGD,IAAA,OAAO,gBAAA,CAAiB,OAAO,GAAA,EAAK;AAAA,MAClC,aAAa,WAAA,CAAY,YAAA;AAAA,MACzB,WAAW,WAAA,CAAY,UAAA;AAAA,MACvB,cAAc,WAAA,CAAY,aAAA;AAAA,MAC1B,OAAO,WAAA,CAAY,KAAA;AAAA,MACnB,SAAS,WAAA,CAAY,OAAA;AAAA,MACrB,aAAa,MAAA,CAAO,WAAA;AAAA,MACpB,cAAc,WAAA,CAAY;AAAA,KAC3B,CAAA;AAAA,EACH;AACF,CAAA;;;AClUO,IAAM,YAAA,GAAqD;AAAA,EAChE,CAAC,aAAA,CAAc,EAAE,GAAG,aAAA;AAAA,EACpB,CAAC,qBAAA,CAAsB,EAAE,GAAG,qBAAA;AAAA,EAC5B,CAAC,oBAAA,CAAqB,EAAE,GAAG;AAC7B;;;ACOA,eAAsB,WAAA,CACpB,UACA,IAAA,EACqB;AACrB,EAAA,MAAM,MAAA,GAAS,SAAS,IAAA,CAAK,IAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,aAAa,MAAM,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,2BAAA,EAA8B,MAAM,CAAA,qBAAA,EAAmB,MAAA,CAAO,KAAK,YAAY,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KAC7F;AAAA,EACF;AAGA,EAAA,IAAI,UAAA,GACF,IAAA,CAAK,UAAA,KAAe,MAAA,GAAY,KAAK,UAAA,GAAa,IAAA;AAEpD,EAAA,IACE,UAAA,KAAe,IAAA,KACd,MAAA,KAAW,cAAA,IAAkB,WAAW,aAAA,CAAA,EACzC;AACA,IAAA,IAAI;AACF,MAAA,UAAA,GAAa,MAAM,kBAAkB,IAAA,CAAK,MAAA,EAAQ,EAAE,MAAA,EAAQ,IAAA,CAAK,QAAQ,CAAA;AAAA,IAC3E,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,QAAA,MAAM,MACJ,GAAA,YAAe,cAAA,GACX,GAAA,CAAI,OAAA,GACJ,qBAAqB,GAAG,CAAA,CAAA;AAC9B,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,OAAA,EAAU,GAAG,CAAA;AAAA,CAA0B,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,UAAA,EAAY,IAAI,CAAA;AAC9C;;;ACjDA,SAAS,MAAM,GAAA,EAAuB;AACpC,EAAA,OAAO,GAAG,GAAA,CAAI,IAAI,KAAI,GAAA,CAAI,OAAA,IAAW,IAAI,IAAI,CAAA,CAAA;AAC/C;AAEO,IAAM,cAAN,MAA6C;AAAA,EACjC,OAAA,uBAAc,GAAA,EAA8B;AAAA,EAE7D,MAAM,KAAK,GAAA,EAAsD;AAC/D,IAAA,MAAM,QAAQ,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAC,CAAA;AACzC,IAAA,OAAO,KAAA,GAAQ,EAAE,GAAG,KAAA,EAAM,GAAI,MAAA;AAAA,EAChC;AAAA,EAEA,MAAM,KAAA,CAAM,GAAA,EAAe,IAAA,EAAuC;AAChE,IAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,KAAA,CAAM,GAAG,GAAG,EAAE,GAAG,MAAM,CAAA;AAAA,EAC1C;AAAA,EAEA,MAAM,OAAO,GAAA,EAA8B;AACzC,IAAA,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,EAChC;AACF;ACTA,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,WAAA,GAAc,sBAAA;AACpB,IAAM,QAAA,GAAW,EAAA;AAEjB,IAAM,iBAAA,GAAoBJ,EAAE,MAAA,CAAO;AAAA,EACjC,EAAA,EAAIA,EAAE,MAAA,EAAO;AAAA,EACb,GAAA,EAAKA,EAAE,MAAA,EAAO;AAAA,EACd,UAAA,EAAYA,EAAE,MAAA;AAChB,CAAC,CAAA;AAGD,IAAM,mBAAmBA,CAAAA,CAAE,MAAA,CAAOA,CAAAA,CAAE,MAAA,IAAU,iBAAiB,CAAA;AAE/D,IAAM,sBAAA,GAAyBA,EAAE,MAAA,CAAO;AAAA,EACtC,KAAA,EAAOA,EAAE,MAAA,EAAO;AAAA,EAChB,IAAA,EAAMA,EAAE,IAAA,CAAK,CAAC,OAAO,WAAA,EAAa,KAAA,EAAO,QAAQ,CAAC,CAAA;AAAA,EAClD,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,QAAA,EAAUA,CAAAA,CAAE,MAAA,CAAOA,CAAAA,CAAE,MAAA,IAAUA,CAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA;AAC9C,CAAC,CAAA;AAED,SAASK,OAAM,GAAA,EAAuB;AACpC,EAAA,OAAO,GAAG,GAAA,CAAI,IAAI,IAAI,GAAA,CAAI,OAAA,IAAW,IAAI,IAAI,CAAA,CAAA;AAC/C;AAEA,SAAS,SAAS,GAAA,EAAuB;AACvC,EAAA,OACE,OAAO,QAAQ,QAAA,IACf,GAAA,KAAQ,QACR,MAAA,IAAU,GAAA,IACV,IAAI,IAAA,KAAS,QAAA;AAEjB;AAGA,SAAS,OAAA,GAAkB;AACzB,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AACnC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,sBAAsB,WAAW,CAAA,gIAAA;AAAA,KAGnC;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,IAAA,CAAK,GAAG,CAAA,GACpC,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA,GACtB,MAAA,CAAO,IAAA,CAAK,KAAK,QAAQ,CAAA;AAC7B,EAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,WAAA,EAAc,WAAW,CAAA,sCAAA,EACpB,GAAA,CAAI,MAAM,CAAA,4DAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,IAAA,CAAK,KAAa,SAAA,EAAgC;AACzD,EAAA,MAAM,EAAA,GAAK,YAAY,QAAQ,CAAA;AAC/B,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,SAAA,EAAW,GAAA,EAAK,EAAE,CAAA;AAChD,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA;AAAA,IAC/B,OAAO,KAAA;AAAM,GACd,CAAA;AACD,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,EAAA,CAAG,QAAA,CAAS,QAAQ,CAAA;AAAA,IACxB,GAAA,EAAK,MAAA,CAAO,UAAA,EAAW,CAAE,SAAS,QAAQ,CAAA;AAAA,IAC1C,UAAA,EAAY,UAAA,CAAW,QAAA,CAAS,QAAQ;AAAA,GAC1C;AACF;AAEA,SAAS,MAAA,CAAO,KAAa,KAAA,EAA4B;AACvD,EAAA,MAAM,QAAA,GAAW,gBAAA;AAAA,IACf,SAAA;AAAA,IACA,GAAA;AAAA,IACA,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,EAAA,EAAI,QAAQ;AAAA,GAChC;AACA,EAAA,QAAA,CAAS,WAAW,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK,QAAQ,CAAC,CAAA;AACpD,EAAA,MAAM,SAAA,GAAY,OAAO,MAAA,CAAO;AAAA,IAC9B,SAAS,MAAA,CAAO,MAAA,CAAO,KAAK,KAAA,CAAM,UAAA,EAAY,QAAQ,CAAC,CAAA;AAAA,IACvD,SAAS,KAAA;AAAM,GAChB,CAAA;AACD,EAAA,OAAO,SAAA,CAAU,SAAS,MAAM,CAAA;AAClC;AAEO,IAAM,YAAN,MAA2C;AAAA,EAChD,YAA6B,QAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAAmB;AAAA,EAAnB,QAAA;AAAA,EAE7B,MAAM,KAAK,GAAA,EAAsD;AAC/D,IAAA,MAAM,MAAM,OAAA,EAAQ;AACpB,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,QAAA,EAAS;AACjC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAKA,MAAAA,CAAM,GAAG,CAAC,CAAA;AAC9B,IAAA,IAAI,CAAC,QAAQ,OAAO,MAAA;AACpB,IAAA,OAAO,sBAAA,CAAuB,MAAM,IAAA,CAAK,KAAA,CAAM,OAAO,GAAA,EAAK,MAAM,CAAC,CAAC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,KAAA,CAAM,GAAA,EAAe,IAAA,EAAuC;AAChE,IAAA,MAAM,MAAM,OAAA,EAAQ;AACpB,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,QAAA,EAAS;AACjC,IAAA,IAAA,CAAKA,MAAAA,CAAM,GAAG,CAAC,CAAA,GAAI,KAAK,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACjD,IAAA,MAAM,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,EAC3B;AAAA,EAEA,MAAM,OAAO,GAAA,EAA8B;AACzC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,QAAA,EAAS;AACjC,IAAA,OAAO,IAAA,CAAKA,MAAAA,CAAM,GAAG,CAAC,CAAA;AACtB,IAAA,MAAM,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,EAC3B;AAAA,EAEA,MAAc,QAAA,GAAiD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,IAAA,CAAK,UAAU,MAAM,CAAA;AAChD,MAAA,OAAO,gBAAA,CAAiB,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,IAC/C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,EAAC;AAC3B,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,UAAU,IAAA,EAAkD;AACxE,IAAA,MAAM,KAAA,CAAM,QAAQ,IAAA,CAAK,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,IAAA,MAAM,SAAA,CAAU,KAAK,QAAA,EAAU,IAAA,CAAK,UAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,MAAM,CAAA;AAAA,EACtE;AACF;;;AC5HA,IAAM,cAAA,GAAiB,GAAA;AAgBvB,SAAS,UAAU,IAAA,EAA0B;AAC3C,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC9B,EAAA,IAAI,KAAA,KAAU,EAAA,EAAI,OAAO,EAAE,YAAY,IAAA,EAAK;AAC5C,EAAA,OAAO,EAAE,UAAA,EAAY,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,EAAG,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,EAAE;AAC5E;AAKA,SAAS,QAAQ,IAAA,EAAiC;AAChD,EAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAC5B,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA;AAC7C,EAAA,IAAI,MAAA,CAAO,KAAA,CAAM,WAAW,CAAA,EAAG,OAAO,KAAA;AACtC,EAAA,OAAO,WAAA,GAAc,cAAA,GAAiB,IAAA,CAAK,GAAA,EAAI;AACjD;AAMA,SAAS,aAAA,CACP,OACA,IAAA,EACoC;AACpC,EAAA,IAAI,IAAA,KAAS,KAAA,IAAS,IAAA,KAAS,KAAA,IAAS,SAAS,QAAA,EAAU;AACzD,IAAA,OAAO,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA;AACT;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACX,KAAA;AAAA,EACA,WAAA;AAAA,EAEjB,YAAY,IAAA,EAA+B;AACzC,IAAA,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AAClB,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AAAA,EAC1B;AAAA,EAEA,MAAM,eAAe,CAAA,EASe;AAClC,IAAA,MAAM,EAAE,UAAA,EAAY,OAAA,EAAQ,GAAI,SAAA,CAAU,EAAE,IAAI,CAAA;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,UAAU,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AAEA,IAAA,IACE,CAAA,CAAE,aAAa,MAAA,IACf,QAAA,CAAS,aAAa,MAAA,IACtB,CAAA,CAAE,QAAA,KAAa,QAAA,CAAS,QAAA,EACxB;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,+BAA+B,UAAU,CAAA,yBAAA,EAA4B,SAAS,QAAQ,CAAA,cAAA,EAAiB,EAAE,QAAQ,CAAA,CAAA;AAAA,OACnH;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,MAAA,IAAU,QAAA,CAAS,OAAA;AACpC,IAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,gBAAA;AAAA,MACzB,SAAS,IAAA,CAAK,UAAA;AAAA,MACd,MAAA;AAAA,MACA,QAAA,CAAS;AAAA,KACX;AACA,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,GAAA,CAAI,OAAA,GAAU,OAAA;AACd,MAAA,SAAA,CAAU,OAAA,GAAU,OAAA;AAAA,IACtB;AAEA,IAAA,MAAM,SAAS,MAAM,wBAAA,CAAyB,IAAA,CAAK,KAAA,EAAO,KAAK,SAAS,CAAA;AACxE,IAAA,IAAI,MAAA,IAAU,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC7B,MAAA,MAAMC,QAAAA,GAAU,aAAA,CAAc,MAAA,CAAO,KAAA,EAAO,OAAO,IAAI,CAAA;AACvD,MAAA,IAAIA,UAAS,OAAOA,QAAAA;AAAA,IACtB;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,QAAA,EAAU;AAAA,MACzC,MAAA;AAAA,MACA,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,QAAQ,CAAA,CAAE;AAAA,KACX,CAAA;AACD,IAAA,MAAM,OAAA,GACJ,OAAO,WAAA,KAAgB,MAAA,GACnB,cAAc,MAAA,CAAO,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA,GAClD,MAAA;AACN,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,oCAAoC,UAAU,CAAA,iCAAA;AAAA,OAChD;AAAA,IACF;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;AC5GA,IAAM,mBAAmBN,CAAAA,CAAE,IAAA,CAAK,CAAC,cAAA,EAAgB,SAAS,CAAC,CAAA;AAI3D,IAAM,mBAAA,GAAsBA,EAAE,MAAA,CAAO;AAAA,EACnC,MAAMA,CAAAA,CAAE,IAAA,CAAK,CAAC,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC7B,GAAA,EAAKA,CAAAA,CAAE,KAAA,CAAMA,CAAAA,CAAE,QAAQ;AACzB,CAAC,CAAA;AAED,IAAM,gBAAA,GAAmBA,EAAE,MAAA,CAAO;AAAA,EAChC,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,MAAA,EAAQA,EAAE,MAAA,EAAO;AAAA,EACjB,OAAOA,CAAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;AACtC,CAAC,CAAA;AAED,IAAM,iBAAA,GAAoBA,EAAE,MAAA,CAAO;AAAA,EACjC,EAAA,EAAIA,EAAE,MAAA,EAAO;AAAA,EACb,MAAA,EAAQA,EAAE,MAAA,EAAO;AAAA,EACjB,MAAA,EAAQ,gBAAA;AAAA,EACR,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,KAAA,EAAOA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAI3B,QAAA,EAAUA,CAAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,MAAA,EAAQ,oBAAoB,QAAA,EAAS;AAAA,EACrC,UAAA,EAAY,iBAAiB,QAAA,EAAS;AAAA,EACtC,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACrB,CAAC,CAAA,CAAE,SAAA,CAAU,CAAC,EAAE,MAAA,EAAQ,GAAG,OAAA,EAAQ,MAAoB,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,QAAO,CAAE,CAAA;AAExF,IAAM,sBAAA,GAAyBA,EAAE,MAAA,CAAO;AAAA,EACtC,OAAA,EAASA,CAAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA,EACpB,UAAUA,CAAAA,CAAE,MAAA,CAAOA,CAAAA,CAAE,MAAA,IAAU,iBAAiB;AAClD,CAAC,CAAA;AAOD,SAAS,SAAA,GAA8B;AACrC,EAAA,OAAO,EAAE,OAAA,EAAS,CAAA,EAAG,QAAA,EAAU,EAAC,EAAE;AACpC;AAEO,SAAS,gBAAA,GAA2B;AACzC,EAAA,OAAO,OAAA,CAAQ,OAAA,EAAQ,EAAG,aAAA,EAAe,oBAAoB,CAAA;AAC/D;AAEA,eAAsB,gBAAA,GAA8C;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAMO,QAAAA,CAAS,gBAAA,IAAoB,MAAM,CAAA;AACrD,IAAA,OAAO,sBAAA,CAAuB,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,EACrD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,SAAA,EAAU;AAAA,EACnB;AACF;AAEA,eAAe,kBAAkB,IAAA,EAAuC;AACtE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,EAAQ,EAAG,aAAa,CAAA;AACzC,EAAA,MAAMC,KAAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AAEpC,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,UAAU,MAAA,CAAO,WAAA;AAAA,MACf,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,QAAQ,EAAE,GAAA,CAAI,CAAC,CAAC,EAAA,EAAI,EAAE,QAAA,EAAU,GAAG,OAAA,EAAS,CAAA,KAAM;AAAA,QACpE,EAAA;AAAA,QACA,EAAE,GAAG,OAAA,EAAS,MAAA,EAAQ,QAAA;AAAS,OAChC;AAAA;AACH,GACF;AACA,EAAA,MAAMC,SAAAA,CAAU,kBAAiB,EAAG,IAAA,CAAK,UAAU,QAAA,EAAU,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IAC5E,QAAA,EAAU,MAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAGA,eAAsB,iBAAiB,QAAA,EAA2C;AAChF,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,EAAiB;AACpC,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AACvC,EAAA,OAAO,QAAA,KAAa,SAAY,GAAA,GAAM,GAAA,CAAI,OAAO,CAAA,CAAA,KAAK,CAAA,CAAE,aAAa,QAAQ,CAAA;AAC/E;AAGA,eAAsB,eAAe,EAAA,EAA8C;AACjF,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,EAAiB;AACpC,EAAA,OAAO,IAAA,CAAK,SAAS,EAAE,CAAA;AACzB;AAGA,eAAsB,eAAe,OAAA,EAAqC;AACxE,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,EAAiB;AACpC,EAAA,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,EAAE,CAAA,GAAI,OAAA;AAC5B,EAAA,MAAM,kBAAkB,IAAI,CAAA;AAC9B;AAGA,eAAsB,kBAAkB,EAAA,EAA8B;AACpE,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,EAAiB;AACpC,EAAA,IAAI,EAAE,EAAA,IAAM,IAAA,CAAK,QAAA,CAAA,EAAW,OAAO,KAAA;AACnC,EAAA,OAAO,IAAA,CAAK,SAAS,EAAE,CAAA;AACvB,EAAA,MAAM,kBAAkB,IAAI,CAAA;AAC5B,EAAA,OAAO,IAAA;AACT;AC1BO,IAAM,0BAAA,GAAN,cAAyC,KAAA,CAAM;AAAA,EACpD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,4BAAA;AAAA,EACd;AACF;AAEA,IAAM,YAAA,GAAsC,CAAC,cAAA,EAAgB,SAAS,CAAA;AAItE,IAAM,OAAA,GAAU,8BAAA;AAoBT,SAAS,oBAAoB,KAAA,EAAqD;AACvF,EAAA,MAAM,EAAA,GAAA,CAAM,KAAA,CAAM,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AACjC,EAAA,IAAI,CAAC,EAAA,EAAI,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AAC9D,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,OAAO,EAAE,CAAA,yFAAA;AAAA,KAEX;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAA,CAAY,KAAA,CAAM,QAAA,IAAY,EAAA,EAAI,IAAA,EAAK;AAC7C,EAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,2BAA2B,sBAAsB,CAAA;AAC1E,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,aAAa,QAAQ,CAAA,wDAAA;AAAA,KACvB;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AACrB,EAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,CAAA,sBAAA,EAAyB,aAAa,IAAA,CAAK,KAAK,CAAC,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAC,CAAA,EAAA;AAAA,KAC3E;AAAA,EACF;AAIA,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA,KAAe,SAAY,KAAA,CAAM,UAAA,CAAW,MAAK,GAAI,MAAA;AAC9E,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAK;AAElC,EAAA,IAAI,WAAW,SAAA,EAAW;AACxB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,IAAI,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,2BAA2B,wBAAwB,CAAA;AAAA,EAChF,CAAA,MAAO;AACL,IAAA,IAAI,cAAc,MAAA,EAAQ;AACxB,MAAA,MAAM,IAAI,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,UAAA,IAAc,CAAC,MAAA,EAAQ;AAC1B,MAAA,MAAM,IAAI,2BAA2B,kCAAkC,CAAA;AAAA,IACzE;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,EAAO,IAAA,EAAK;AAChC,EAAA,MAAM,aAAA,GAAgB,KAAA,CAAM,aAAA,EAAe,IAAA,EAAK;AAChD,EAAA,IAAI,aAAA,KAAkB,UAAa,aAAA,KAAkB,EAAA,IAAM,CAAC,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA,EAAG;AACvF,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,kBAAkB,aAAa,CAAA,wDAAA;AAAA,KACjC;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAK;AAElC,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,GAAI,UAAA,GAAa,EAAE,UAAA,KAAe,EAAC;AAAA,IACnC,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW,EAAC;AAAA,IAC3B,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU,EAAC;AAAA,IACzB,GAAI,aAAA,GAAgB,EAAE,aAAA,KAAkB,EAAC;AAAA,IACzC,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,GAC7B;AACF;AASO,SAAS,oBAAoB,KAAA,EAIzB;AACT,EAAA,MAAM,KAAA,GAAQ,CAAC,YAAA,EAAc,MAAA,EAAQ,MAAM,QAAQ,CAAA;AACnD,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,cAAA,EAAgB,KAAA,CAAM,KAAK,KAAK,CAAA;AACrD,EAAA,IAAI,KAAA,CAAM,SAAA,EAAW,KAAA,CAAM,IAAA,CAAK,MAAM,SAAS,CAAA;AAC/C,EAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA;AACvB;AAIO,SAAS,sBAAsB,MAAA,EAAwB;AAC5D,EAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC9E;AAMA,IAAM,iBAAA,GAAoB,CAAA;AAiBnB,SAAS,mBAAmB,MAAA,EAAoC;AACrE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,sBAAsB,MAAM,CAAA;AAAA,IACzC,GAAI,MAAA,CAAO,MAAA,IAAU,iBAAA,GAAoB,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA,EAAE,GAAI;AAAC,GAC1E;AACF;AAIA,SAAS,eAAe,MAAA,EAAmC;AACzD,EAAA,OAAO,MAAA,KAAW,iBAAiB,KAAA,GAAQ,KAAA;AAC7C;AASA,eAAsB,iBAAA,CACpB,OACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,CAAA,GAAI,oBAAoB,KAAK,CAAA;AAEnC,EAAA,IAAI,MAAM,IAAA,CAAK,UAAA,CAAW,CAAA,CAAE,EAAE,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,EAAE,EAAE,CAAA,0DAAA;AAAA,KAC5B;AAAA,EACF;AAGA,EAAA,IAAI,CAAA,CAAE,WAAW,MAAA,EAAW;AAC1B,IAAA,MAAMC,QAAAA,GAAuB;AAAA,MAC3B,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,UAAU,CAAA,CAAE,QAAA;AAAA,MACZ,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,GAAI,EAAE,KAAA,GAAQ,EAAE,OAAO,CAAA,CAAE,KAAA,KAAU,EAAC;AAAA,MACpC,GAAI,EAAE,MAAA,GAAS,EAAE,QAAQ,CAAA,CAAE,MAAA,KAAW;AAAC,KACzC;AACA,IAAA,MAAM,IAAA,CAAK,WAAWA,QAAO,CAAA;AAC7B,IAAA,OAAO;AAAA,MACL,IAAIA,QAAAA,CAAQ,EAAA;AAAA,MACZ,UAAUA,QAAAA,CAAQ,QAAA;AAAA,MAClB,QAAQA,QAAAA,CAAQ,MAAA;AAAA,MAChB,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,GAAIA,SAAQ,KAAA,GAAQ,EAAE,OAAOA,QAAAA,CAAQ,KAAA,KAAU,EAAC;AAAA,MAChD,GAAIA,SAAQ,MAAA,GAAS,EAAE,QAAQA,QAAAA,CAAQ,MAAA,KAAW;AAAC,KACrD;AAAA,EACF;AAEA,EAAA,MAAM,aAAa,CAAA,CAAE,UAAA;AAErB,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,EAAa;AACzC,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,aAAa,CAAC,CAAA;AAE5D,EAAA,IAAI,aAAA,GAAgB,CAAA,CAAE,aAAA,IAAiB,mBAAA,CAAoB,CAAC,CAAA;AAI5D,EAAA,IAAI,CAAC,CAAA,CAAE,aAAA,IAAiB,SAAA,CAAU,GAAA,CAAI,aAAa,CAAA,EAAG;AACpD,IAAA,aAAA,GAAgB,oBAAoB,EAAE,GAAG,GAAG,SAAA,EAAW,CAAA,CAAE,IAAI,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,KAAK,KAAA,CAAM,KAAA;AAAA,IACf,EAAE,MAAM,aAAA,EAAc;AAAA,IACtB,EAAE,KAAA,EAAO,UAAA,EAAY,MAAM,cAAA,CAAe,CAAA,CAAE,MAAM,CAAA;AAAE,GACtD;AAEA,EAAA,MAAM,OAAA,GAAuB;AAAA,IAC3B,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,UAAU,CAAA,CAAE,QAAA;AAAA,IACZ,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,aAAA;AAAA,IACA,GAAI,EAAE,KAAA,GAAQ,EAAE,OAAO,CAAA,CAAE,KAAA,KAAU,EAAC;AAAA,IACpC,GAAI,EAAE,MAAA,GAAS,EAAE,QAAQ,CAAA,CAAE,MAAA,KAAW;AAAC,GACzC;AACA,EAAA,MAAM,IAAA,CAAK,WAAW,OAAO,CAAA;AAE7B,EAAA,OAAO;AAAA,IACL,IAAI,OAAA,CAAQ,EAAA;AAAA,IACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,aAAA;AAAA,IACA,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,OAAA,CAAQ,KAAA,KAAU,EAAC;AAAA,IAChD,GAAI,QAAQ,MAAA,GAAS,EAAE,QAAQ,OAAA,CAAQ,MAAA,KAAW,EAAC;AAAA,IACnD,WAAA,EAAa,sBAAsB,UAAU;AAAA,GAC/C;AACF;AASA,eAAsB,iBAAA,CACpB,IACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,OAAA,GAAA,CAAW,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AAEnE,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,IAAI,OAAA,EAAQ;AAEnD,EAAA,MAAM,IAAA,CAAK,cAAc,OAAO,CAAA;AAGhC,EAAA,IAAI,OAAA,CAAQ,kBAAkB,MAAA,EAAW;AACvC,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,EAAA,EAAI,OAAA,EAAQ;AAAA,EACtC;AAEA,EAAA,MAAM,eAAA,GAAA,CAAmB,MAAM,IAAA,CAAK,YAAA,EAAa,EAAG,IAAA;AAAA,IAClD,CAAA,CAAA,KAAK,CAAA,CAAE,aAAA,KAAkB,OAAA,CAAQ;AAAA,GACnC;AACA,EAAA,IAAI,CAAC,eAAA,IAAmB,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ;AACzC,IAAA,MAAM,KAAK,KAAA,CAAM,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,CAAQ,eAAe,CAAA;AAAA,EACzD;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,IAAI,OAAA,EAAS,aAAA,EAAe,QAAQ,aAAA,EAAc;AAC5E;AAUA,eAAsB,qBAAA,CACpB,EAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAA,CAAW,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AAEnE,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,0BAAA,CAA2B,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AAIA,EAAA,MAAM,EAAE,QAAA,EAAU,KAAA,EAAO,GAAG,MAAK,GAAI,OAAA;AACrC,EAAA,MAAM,OAAA,GAAuB,OAAA,GAAU,EAAE,GAAG,IAAA,KAAS,EAAE,GAAG,IAAA,EAAM,QAAA,EAAU,IAAA,EAAK;AAC/E,EAAA,MAAM,IAAA,CAAK,WAAW,OAAO,CAAA;AAC7B,EAAA,OAAO,OAAA;AACT;AAUA,eAAsB,oBAAA,CACpB,EAAA,EACA,QAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAA,CAAW,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AACnE,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,KAAA,IAAS,QAAA,CAAS,SAAS,OAAA,EAAS;AACxD,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,CAAA,2CAAA,EAA8C,MAAA,CAAO,QAAA,CAAS,IAAI,CAAC,CAAA,EAAA;AAAA,KACrE;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,0BAAA,CAA2B,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,KAAA,EAAO,GAAG,MAAK,GAAI,OAAA;AACnC,EAAA,IAAI,QAAA,CAAS,SAAS,KAAA,EAAO;AAG3B,IAAA,MAAMC,QAAAA,GAAuB,EAAE,GAAG,IAAA,EAAK;AACvC,IAAA,MAAM,IAAA,CAAK,WAAWA,QAAO,CAAA;AAC7B,IAAA,OAAOA,QAAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAM,CAAC,GAAG,IAAI,GAAA,CAAA,CAAK,QAAA,CAAS,OAAO,EAAC,EAAG,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAA,EAAM,EAAE,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AAChF,EAAA,MAAM,OAAA,GAAuB,EAAE,GAAG,IAAA,EAAM,QAAQ,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAI,EAAE;AACvE,EAAA,MAAM,IAAA,CAAK,WAAW,OAAO,CAAA;AAC7B,EAAA,OAAO,OAAA;AACT;AA4CA,eAAsB,wBAAA,CACpB,EAAA,EACA,UAAA,EACA,IAAA,EACyC;AACzC,EAAA,MAAM,OAAA,GAAA,CAAW,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AAEnE,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,0BAAA,CAA2B,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACA,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,SAAS,OAAA,EAAS;AACtD,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,YAAY,OAAO,CAAA,4HAAA;AAAA,KAErB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,IAAI,IAAI,UAAA,CAAW,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AAC1E,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,CAAO,GAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,OAAO,CAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,OAAO,CAAA;AAC/B,EAAA,MAAM,KAAA,GAAQ,QAAQ,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAA;AACjD,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAA;AAEnD,EAAA,MAAM,OAAA,GAAuB,EAAE,GAAG,OAAA,EAAS,MAAA,EAAQ,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,OAAA,EAAQ,EAAE;AACnF,EAAA,MAAM,IAAA,CAAK,WAAW,OAAO,CAAA;AAC7B,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,OAAA,EAAQ;AAC5C;;;AC5cO,SAAS,eAAA,CACd,UACA,KAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,eAAA,CAAgB,KAAK,CAAA;AAC/C,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,0BAAA,EAA6B,QAAA,CAAS,EAAE,CAAA,kCAAA,EAAqC,KAAK,CAAA,CAAA;AAAA,KACpF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAA,EAAS;AACpB;AAMO,SAAS,kBAAA,CACd,UACA,KAAA,EACc;AACd,EAAA,OAAO,CAAC,GAAI,QAAA,CAAS,eAAe,KAAK,CAAA,IAAK,EAAG,CAAA;AACnD;AAQO,SAAS,gBAAA,CACd,QAAA,EACA,QAAA,EACA,KAAA,EACe;AACf,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,eAAA,CAAgB,UAAU,KAAK,CAAA;AACpD,EAAA,MAAM,OAAA,GAAU,kBAAA,CAAmB,QAAA,EAAU,KAAK,CAAA;AAClD,EAAA,OAAO,QAAA,CAAS,MAAA;AAAA,IACd,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,aAAa,QAAA,IAAY,OAAA,CAAQ,QAAA,CAAS,CAAA,CAAE,MAAM;AAAA,GAC1E;AACF;;;ACuCO,IAAM,SAAA,GAAY;AAClB,IAAM,YAAA,GAAe","file":"index.mjs","sourcesContent":["/**\n * AIP-50 auth-provider frontmatter / literal Zod schema.\n *\n * Single source of truth for both authoring paths: `defineAuthProvider`\n * (TS literal) and `parseAuthProviderManifest` (.md) run this same schema,\n * so a malformed literal and a malformed manifest fail identically.\n */\n\nimport { z } from \"zod\"\n\nexport const tokenStoreSpecSchema = z\n  .object({\n    keychain: z.string().min(1),\n    path: z.string().min(1).optional(),\n    account: z.string().min(1).optional(),\n  })\n  .strict()\n\nexport const patAuthConfigSchema = z\n  .object({\n    flow: z.literal(\"pat\"),\n    tokenStore: tokenStoreSpecSchema,\n  })\n  .strict()\n\nexport const serviceAuthConfigSchema = z\n  .object({\n    flow: z.literal(\"service-auth\"),\n    clientId: z.string().min(1).optional(),\n    loginHint: z.string().min(1).optional(),\n    tokenStore: tokenStoreSpecSchema,\n  })\n  .strict()\n\nexport const deviceCodeAuthConfigSchema = z\n  .object({\n    flow: z.literal(\"device-code\"),\n    clientId: z.string().min(1).optional(),\n    scope: z.string().min(1).optional(),\n    deviceLabel: z.string().min(1).optional(),\n    tokenStore: tokenStoreSpecSchema,\n  })\n  .strict()\n\nexport const authConfigSchema = z.discriminatedUnion(\"flow\", [\n  patAuthConfigSchema,\n  serviceAuthConfigSchema,\n  deviceCodeAuthConfigSchema,\n])\n\nexport const installConfigSchema = z\n  .object({\n    sealKey: z.string().min(1),\n    secretBacked: z.string().min(1),\n  })\n  .strict()\n\nexport const authProviderFrontmatterSchema = z\n  .object({\n    id: z.string().min(2).max(80),\n    description: z.string().min(1).max(2000),\n    apiBase: z.string().url(),\n    auth: authConfigSchema,\n    install: installConfigSchema.optional(),\n    // Recommended values \"tunnel\" | \"api\" | \"mcp\" — free-form allowed, not an enum.\n    audience: z.string().min(1).optional(),\n  })\n  .strict()\n  .describe(\n    \"AIP-50 auth-provider manifest: how a CLI tool authenticates to an API server and (optionally) where to call the AIP-19 provision endpoints.\",\n  )\n\nexport type AuthProviderFrontmatter = z.infer<typeof authProviderFrontmatterSchema>\n","/**\n * `defineAuthProvider` — TS-literal authoring path for an auth-provider.\n *\n * Built on `createDoctype` so it gets the cross-AIP invariants: id-pattern,\n * ≤2000-char description, frozen handle, canonical error prefix. Field-level\n * validation uses the shared Zod from `./schema.ts`, so a malformed literal\n * fails with the same diagnostic as a malformed `.md`.\n */\n\nimport { createDoctype } from \"@agentproto/define-doctype\"\nimport { authProviderFrontmatterSchema } from \"./schema.js\"\nimport type { AuthProviderDefinition, AuthProviderHandle } from \"./types.js\"\n\nexport const defineAuthProvider = createDoctype<\n  AuthProviderDefinition,\n  AuthProviderHandle\n>({\n  aip: 50,\n  name: \"authProvider\",\n  validate(def) {\n    const result = authProviderFrontmatterSchema.safeParse(def)\n    if (!result.success) {\n      throw new Error(\n        `defineAuthProvider (AIP-50): ${result.error.issues\n          .map((i) => `${i.path.join(\".\")}: ${i.message}`)\n          .join(\"; \")}`,\n      )\n    }\n  },\n  build(def) {\n    return {\n      ...def,\n      auth: Object.freeze({ ...def.auth }),\n      install: def.install ? Object.freeze({ ...def.install }) : undefined,\n    }\n  },\n})\n","/**\n * `.md` authoring path for an auth-provider — parse a frontmatter manifest\n * into a frozen handle. Mirrors `parseRecipeManifest` from AIP-19: gray-matter\n * splits the frontmatter, the shared Zod validates it, `defineAuthProvider`\n * builds the handle so both authoring paths converge on one validated shape.\n *\n * This parser is the extension seam: a host reads its own external `.md`\n * manifests (e.g. vendor-shipped `guilde.auth.md`) and registers them without\n * editing this package.\n */\n\nimport matter from \"gray-matter\"\nimport {\n  authProviderFrontmatterSchema,\n  type AuthProviderFrontmatter,\n} from \"./schema.js\"\nimport { defineAuthProvider } from \"./define-auth-provider.js\"\nimport type { AuthProviderHandle } from \"./types.js\"\n\nexport interface AuthProviderManifest {\n  frontmatter: AuthProviderFrontmatter\n  body: string\n}\n\nexport function parseAuthProviderManifestRaw(\n  source: string,\n): AuthProviderManifest {\n  const parsed = matter(source)\n  if (Object.keys(parsed.data).length === 0) {\n    throw new Error(\"parseAuthProviderManifest: missing or empty frontmatter\")\n  }\n  const result = authProviderFrontmatterSchema.safeParse(parsed.data)\n  if (!result.success) {\n    throw new Error(\n      `parseAuthProviderManifest: invalid frontmatter — ${result.error.issues\n        .map((i) => `${i.path.join(\".\")}: ${i.message}`)\n        .join(\"; \")}`,\n    )\n  }\n  return { frontmatter: result.data, body: parsed.content }\n}\n\n/** Parse an auth-provider `.md` straight to a frozen handle. */\nexport function parseAuthProviderManifest(source: string): AuthProviderHandle {\n  const { frontmatter } = parseAuthProviderManifestRaw(source)\n  return defineAuthProvider(frontmatter)\n}\n","/**\n * Builtin auth-provider manifests — shipped as TS literals so they bundle\n * into the tsup output with zero filesystem reads at runtime. A host adds more\n * by parsing its own `.md` with `parseAuthProviderManifest` and registering\n * the result via `registerAuthProvider`.\n */\n\nimport { defineAuthProvider } from \"./define-auth-provider.js\"\nimport type { AuthProviderHandle } from \"./types.js\"\n\n/** Guilde AI company platform.\n *\n *  Authenticates via the AIP-50 service-auth claim ceremony: browser opens,\n *  user clicks Approve, bureau stores the oat_* access token.\n *  Discovery from /.well-known/oauth-protected-resource supplies live endpoints;\n *  the static fields below are the offline fallback. */\nexport const guildeAuthProvider = defineAuthProvider({\n  id: \"guilde\",\n  description:\n    \"Guilde AI company platform. Authenticate via a browser-approve flow — no key to paste.\",\n  apiBase: \"https://api.guilde.work\",\n  audience: \"api\",\n  auth: {\n    flow: \"service-auth\",\n    clientId: \"agentproto-cli\",\n    tokenStore: {\n      keychain: \"bureau-guilde\",\n      account: \"{server}\",\n    },\n  },\n  install: {\n    sealKey: \"/guilde/api/v1/connectors/seal-key\",\n    secretBacked: \"/guilde/api/v1/guilds/{guildId}/connectors/secret-backed\",\n  },\n})\n\nexport const BUILTIN_AUTH_PROVIDERS: readonly AuthProviderHandle[] = [\n  guildeAuthProvider,\n]\n","/**\n * Auth-provider registry — id → handle lookup, pre-seeded with builtins.\n *\n * Mirrors the provision-recipe registry shape (AIP-19). Re-registering an id\n * overrides it (last write wins), so a host can shadow a builtin.\n */\n\nimport { BUILTIN_AUTH_PROVIDERS } from \"./builtins.js\"\nimport type { AuthProviderHandle } from \"./types.js\"\n\nconst _registry = new Map<string, AuthProviderHandle>()\nfor (const p of BUILTIN_AUTH_PROVIDERS) _registry.set(p.id, p)\n\nexport function registerAuthProvider(provider: AuthProviderHandle): void {\n  _registry.set(provider.id, provider)\n}\n\nexport function getAuthProvider(id: string): AuthProviderHandle | undefined {\n  return _registry.get(id)\n}\n\nexport function listAuthProviders(): AuthProviderHandle[] {\n  return [..._registry.values()]\n}\n\nexport function listAuthProviderIds(): string[] {\n  return [..._registry.keys()]\n}\n","/**\n * Internal HTTP helpers — not part of the public API.\n *\n * Every network call in this package (discovery, the claim ceremony, token\n * refresh) must be bounded: a hung or slow server MUST NOT stall the CLI\n * indefinitely. `deadlineSignal` combines an optional caller `AbortSignal`\n * with a timeout into one signal to hand to `fetch`.\n *\n * Implemented with a plain `AbortController` + `setTimeout` rather than\n * `AbortSignal.any`/`AbortSignal.timeout` so it works on every runtime that\n * ships `fetch`, without assuming a specific Node minor.\n */\n\n/** Default per-request timeout. Discovery and token calls are small JSON\n *  round-trips; 10s is generous without hanging an interactive CLI. */\nexport const DEFAULT_HTTP_TIMEOUT_MS = 10_000\n\n/**\n * AIP-50 §Security: discovery and auth requests MUST use HTTPS, to defeat\n * MITM/TOCTOU on the `.well-known` and token endpoints. Loopback http is\n * allowed — it isn't network-exposed — so local development against a dev\n * server keeps working. Throws on any other insecure URL.\n */\nexport function assertSecureUrl(url: string): void {\n  let u: URL\n  try {\n    u = new URL(url)\n  } catch {\n    throw new Error(`invalid URL: ${url}`)\n  }\n  if (u.protocol === \"https:\") return\n  const host = u.hostname\n  const isLoopback =\n    host === \"localhost\" ||\n    host === \"127.0.0.1\" ||\n    host === \"::1\" ||\n    host === \"[::1]\" ||\n    host.endsWith(\".localhost\")\n  if (u.protocol === \"http:\" && isLoopback) return\n  throw new Error(\n    `insecure URL '${url}' — AIP-50 requires HTTPS for discovery/auth ` +\n      `(loopback http is allowed for local development).`,\n  )\n}\n\nexport interface DeadlineHandle {\n  /** Signal to pass to `fetch(url, { signal })`. */\n  signal: AbortSignal\n  /** Cancel the timer + detach the outer listener once the request settles.\n   *  ALWAYS call this in a `finally` to avoid a dangling timer/listener. */\n  clear: () => void\n}\n\n/**\n * Build an `AbortSignal` that fires when EITHER the timeout elapses or the\n * caller's `outer` signal aborts.\n */\nexport function deadlineSignal(\n  timeoutMs: number,\n  outer?: AbortSignal,\n): DeadlineHandle {\n  const ctrl = new AbortController()\n  const onAbort = () => ctrl.abort(outer?.reason)\n\n  if (outer) {\n    if (outer.aborted) ctrl.abort(outer.reason)\n    else outer.addEventListener(\"abort\", onAbort, { once: true })\n  }\n\n  const timer = setTimeout(\n    () => ctrl.abort(new Error(`request timed out after ${timeoutMs}ms`)),\n    timeoutMs,\n  )\n  // Don't let a pending timeout keep the process alive on its own.\n  if (typeof timer !== \"number\") timer.unref()\n\n  return {\n    signal: ctrl.signal,\n    clear: () => {\n      clearTimeout(timer)\n      outer?.removeEventListener(\"abort\", onAbort)\n    },\n  }\n}\n\n/** `fetch` bounded by `deadlineSignal`. Merges any caller-supplied\n *  `init.signal` with the timeout. */\nexport async function fetchWithDeadline(\n  url: string,\n  init: RequestInit = {},\n  timeoutMs: number = DEFAULT_HTTP_TIMEOUT_MS,\n): Promise<Response> {\n  const { signal, clear } = deadlineSignal(timeoutMs, init.signal ?? undefined)\n  try {\n    return await fetch(url, { ...init, signal })\n  } finally {\n    clear()\n  }\n}\n","/**\n * Two-hop discovery per the auth.md standard (AIP-50 §Discovery algorithm),\n * with a second strategy for hosts that don't speak auth.md.\n *\n * Strategy 1 (OAuth PRM chain):\n *   Hop 1: GET {apiBase}/.well-known/oauth-protected-resource (PRM, RFC 8414)\n *     → extract authorization_servers[0] as authServerBase\n *   Hop 2: GET {authServerBase}/.well-known/oauth-authorization-server (AS metadata)\n *     → extract token_endpoint + agent_auth block\n *\n * Strategy 2 (agentproto-host.json), tried when strategy 1 fails:\n *   GET {apiBase}/.well-known/agentproto-host.json\n *     → extract device_authorization_endpoint + token_endpoint\n *\n * Callers MUST catch DiscoveryError and fall back to static manifest config —\n * discovery failures are common (server predates auth.md) and MUST NOT prevent\n * the PAT or other static flows from working.\n */\n\nimport { z } from \"zod\"\nimport type { DiscoveredEndpoints } from \"./types.js\"\nimport { fetchWithDeadline, assertSecureUrl } from \"./http.js\"\n\nexport class DiscoveryError extends Error {\n  readonly serverUrl: string\n  constructor(message: string, serverUrl: string) {\n    super(`DiscoveryError (${serverUrl}): ${message}`)\n    this.name = \"DiscoveryError\"\n    this.serverUrl = serverUrl\n  }\n}\n\n// Discovery JSON is server-controlled, so it's validated rather than asserted.\n// Everything is optional + `.loose()`: the document evolves, and the required\n// fields are enforced explicitly below with precise DiscoveryError messages.\nconst prmSchema = z\n  .object({\n    resource: z.string().optional(),\n    resource_name: z.string().optional(),\n    authorization_servers: z.array(z.string()).optional(),\n    scopes_supported: z.array(z.string()).optional(),\n    bearer_methods_supported: z.array(z.string()).optional(),\n  })\n  .loose()\n\nconst asMetaSchema = z\n  .object({\n    issuer: z.string().optional(),\n    token_endpoint: z.string().optional(),\n    revocation_endpoint: z.string().optional(),\n    device_authorization_endpoint: z.string().optional(),\n    grant_types_supported: z.array(z.string()).optional(),\n    agent_auth: z\n      .object({\n        skill: z.string().optional(),\n        identity_endpoint: z.string().optional(),\n        claim_endpoint: z.string().optional(),\n        events_endpoint: z.string().optional(),\n        identity_types_supported: z.array(z.string()).optional(),\n        identity_assertion: z\n          .object({ assertion_types_supported: z.array(z.string()).optional() })\n          .loose()\n          .optional(),\n      })\n      .loose()\n      .optional(),\n  })\n  .loose()\n\nconst hostJsonSchema = z\n  .object({\n    device_authorization_endpoint: z.string().optional(),\n    token_endpoint: z.string().optional(),\n    revocation_endpoint: z.string().optional(),\n  })\n  .loose()\n\ntype PRMShape = z.infer<typeof prmSchema>\ntype ASMetaShape = z.infer<typeof asMetaSchema>\ntype HostJsonShape = z.infer<typeof hostJsonSchema>\n\nexport interface DiscoverOptions {\n  /** Abort the discovery fetches (e.g. on user Ctrl-C). */\n  signal?: AbortSignal\n  /** Per-hop timeout. Defaults to DEFAULT_HTTP_TIMEOUT_MS. */\n  timeoutMs?: number\n}\n\nasync function discoverViaPRM(\n  base: string,\n  fetchOpts: RequestInit,\n  opts: DiscoverOptions,\n): Promise<DiscoveredEndpoints> {\n  // Hop 1 — PRM\n  const prmUrl = `${base}/.well-known/oauth-protected-resource`\n  let prm: PRMShape\n  try {\n    assertSecureUrl(prmUrl)\n    const res = await fetchWithDeadline(prmUrl, fetchOpts, opts.timeoutMs)\n    if (!res.ok) {\n      throw new DiscoveryError(\n        `PRM returned ${res.status} ${res.statusText}`,\n        base,\n      )\n    }\n    prm = prmSchema.parse(await res.json())\n  } catch (err) {\n    if (err instanceof DiscoveryError) throw err\n    throw new DiscoveryError(`PRM fetch failed: ${err}`, base)\n  }\n\n  const authServerBase = prm.authorization_servers?.[0]?.replace(/\\/$/, \"\")\n  if (!authServerBase) {\n    throw new DiscoveryError(\n      \"PRM missing authorization_servers[0]\",\n      base,\n    )\n  }\n\n  // Hop 2 — AS metadata\n  const asUrl = `${authServerBase}/.well-known/oauth-authorization-server`\n  let as: ASMetaShape\n  try {\n    assertSecureUrl(asUrl)\n    const res = await fetchWithDeadline(asUrl, fetchOpts, opts.timeoutMs)\n    if (!res.ok) {\n      throw new DiscoveryError(\n        `AS metadata returned ${res.status} ${res.statusText}`,\n        base,\n      )\n    }\n    as = asMetaSchema.parse(await res.json())\n  } catch (err) {\n    if (err instanceof DiscoveryError) throw err\n    throw new DiscoveryError(`AS metadata fetch failed: ${err}`, base)\n  }\n\n  const tokenEndpoint = as.token_endpoint\n  const identityEndpoint = as.agent_auth?.identity_endpoint\n  if (!tokenEndpoint) {\n    throw new DiscoveryError(\"AS metadata missing token_endpoint\", base)\n  }\n  if (!identityEndpoint) {\n    throw new DiscoveryError(\n      \"AS metadata missing agent_auth.identity_endpoint\",\n      base,\n    )\n  }\n\n  return {\n    resource: prm.resource ?? base,\n    resourceName: prm.resource_name,\n    authServerBase,\n    tokenEndpoint,\n    revocationEndpoint: as.revocation_endpoint,\n    identityEndpoint,\n    claimEndpoint: as.agent_auth?.claim_endpoint,\n    deviceAuthorizationEndpoint: as.device_authorization_endpoint,\n    identityTypesSupported: as.agent_auth?.identity_types_supported ?? [],\n    grantTypesSupported: as.grant_types_supported ?? [],\n  }\n}\n\nasync function discoverViaHostJson(\n  base: string,\n  fetchOpts: RequestInit,\n  opts: DiscoverOptions,\n): Promise<DiscoveredEndpoints> {\n  const url = `${base}/.well-known/agentproto-host.json`\n  let doc: HostJsonShape\n  try {\n    assertSecureUrl(url)\n    const res = await fetchWithDeadline(url, fetchOpts, opts.timeoutMs)\n    if (!res.ok) {\n      throw new DiscoveryError(\n        `agentproto-host.json returned ${res.status} ${res.statusText}`,\n        base,\n      )\n    }\n    doc = hostJsonSchema.parse(await res.json())\n  } catch (err) {\n    if (err instanceof DiscoveryError) throw err\n    throw new DiscoveryError(`agentproto-host.json fetch failed: ${err}`, base)\n  }\n\n  if (!doc.token_endpoint) {\n    throw new DiscoveryError(\n      \"agentproto-host.json missing token_endpoint\",\n      base,\n    )\n  }\n  if (!doc.device_authorization_endpoint) {\n    throw new DiscoveryError(\n      \"agentproto-host.json missing device_authorization_endpoint\",\n      base,\n    )\n  }\n\n  return {\n    resource: base,\n    authServerBase: base,\n    tokenEndpoint: doc.token_endpoint,\n    revocationEndpoint: doc.revocation_endpoint,\n    deviceAuthorizationEndpoint: doc.device_authorization_endpoint,\n    identityTypesSupported: [],\n    grantTypesSupported: [],\n  }\n}\n\nexport async function discoverEndpoints(\n  apiBase: string,\n  opts: DiscoverOptions = {},\n): Promise<DiscoveredEndpoints> {\n  const base = apiBase.replace(/\\/$/, \"\")\n  // AIP-50 §Security: HTTPS only (loopback exempt for dev), and never follow\n  // redirects on discovery — a 3xx is treated as a failure, not chased to a\n  // potentially-rogue endpoint.\n  const fetchOpts: RequestInit = {\n    signal: opts.signal,\n    redirect: \"manual\",\n  }\n\n  try {\n    return await discoverViaPRM(base, fetchOpts, opts)\n  } catch (prmErr) {\n    // A caller-initiated abort is terminal — don't fire a second round of\n    // requests on a signal that has already aborted (its \"abort\" event has\n    // already fired once and a fresh listener on it will never see it again,\n    // hanging the fallback forever).\n    if (opts.signal?.aborted) throw prmErr\n    // Second strategy: a host that doesn't speak the auth.md PRM chain may\n    // still expose device-code endpoints via agentproto-host.json. If that\n    // also fails, surface the ORIGINAL PRM error — it's almost always the\n    // more informative one (host.json 404s are the common case).\n    try {\n      return await discoverViaHostJson(base, fetchOpts, opts)\n    } catch {\n      throw prmErr\n    }\n  }\n}\n","/**\n * Keychain helpers — read/write a token in the platform Keychain.\n *\n * Uses the macOS `security` CLI. On non-macOS hosts, callers should swap this\n * module for a platform-appropriate equivalent (libsecret on Linux, Credential\n * Manager on Windows).\n */\n\nimport { execFile } from \"node:child_process\"\nimport { promisify } from \"node:util\"\n\nconst exec = promisify(execFile)\n\n/**\n * Guard the macOS-only backend. Without this, `readKeychainToken` would swallow\n * the missing-`security` error and return undefined on Linux/Windows — making a\n * stored credential look absent and re-prompting on every run — while\n * `writeKeychainToken` would throw an opaque ENOENT. Fail loudly and clearly\n * instead, until a libsecret / Credential Manager backend exists.\n */\nfunction assertKeychainSupported(): void {\n  if (process.platform !== \"darwin\") {\n    throw new Error(\n      `@agentproto/auth token-store: the Keychain backend only supports macOS ` +\n        `(got platform \"${process.platform}\"). Provide a libsecret (Linux) or ` +\n        `Credential Manager (Windows) implementation to run here.`,\n    )\n  }\n}\n\n/** Substitute `{server}` template in a tokenStore account spec. */\nexport function resolveAccount(\n  account: string | undefined,\n  server: string,\n): string {\n  if (!account) return server\n  return account.replace(\"{server}\", server)\n}\n\n/** Read a token from the Keychain. Returns undefined if not found. */\nexport async function readKeychainToken(\n  service: string,\n  account: string,\n): Promise<string | undefined> {\n  assertKeychainSupported()\n  try {\n    const { stdout } = await exec(\"security\", [\n      \"find-generic-password\",\n      \"-s\",\n      service,\n      \"-a\",\n      account,\n      \"-w\",\n    ])\n    const t = stdout.replace(/\\n$/, \"\")\n    return t || undefined\n  } catch {\n    return undefined\n  }\n}\n\n/** Write a token to the Keychain (-U updates in place). */\nexport async function writeKeychainToken(\n  service: string,\n  account: string,\n  token: string,\n): Promise<void> {\n  assertKeychainSupported()\n  await exec(\"security\", [\n    \"add-generic-password\",\n    \"-U\",\n    \"-s\",\n    service,\n    \"-a\",\n    account,\n    \"-w\",\n    token,\n    \"-D\",\n    \"agentproto auth token\",\n  ])\n}\n\n/** Remove a token from the Keychain. Returns true if an entry was deleted,\n *  false when none existed (a delete of an absent entry is not an error —\n *  the desired end state, \"no credential at this slot\", already holds). */\nexport async function deleteKeychainToken(\n  service: string,\n  account: string,\n): Promise<boolean> {\n  assertKeychainSupported()\n  try {\n    await exec(\"security\", [\n      \"delete-generic-password\",\n      \"-s\",\n      service,\n      \"-a\",\n      account,\n    ])\n    return true\n  } catch {\n    // `security` exits non-zero when the item isn't found — treat as a no-op.\n    return false\n  }\n}\n","/**\n * KeychainStore — `CredentialStore` backed by the platform Keychain.\n *\n * Wraps the low-level `token-store.ts` helpers (macOS `security` CLI today).\n * The Keychain only holds one opaque string per entry, so `kind`/`expiresAt`/\n * `metadata` are packed into a small JSON envelope that IS that string.\n *\n * Back-compat: an entry written before this store existed (or by any other\n * tool) is a bare token string, not an envelope. `read` falls back to\n * treating the whole string as the value with kind `\"pat\"` — the only flow\n * that pre-dates this store — rather than failing on non-JSON content.\n */\n\nimport { z } from \"zod\"\nimport {\n  deleteKeychainToken,\n  readKeychainToken,\n  writeKeychainToken,\n} from \"../token-store.js\"\nimport type { CredentialStore, StoreRef, StoredCredential } from \"./types.js\"\n\nconst envelopeSchema = z.object({\n  v: z.string(),\n  k: z.enum([\"pat\", \"assertion\", \"oat\", \"daemon\"]),\n  e: z.string().optional(),\n  m: z.record(z.string(), z.unknown()).optional(),\n})\n\nexport class KeychainStore implements CredentialStore {\n  async read(ref: StoreRef): Promise<StoredCredential | undefined> {\n    const account = ref.account ?? ref.path\n    const raw = await readKeychainToken(ref.path, account)\n    if (raw === undefined) return undefined\n\n    try {\n      const envelope = envelopeSchema.parse(JSON.parse(raw))\n      return {\n        value: envelope.v,\n        kind: envelope.k,\n        ...(envelope.e !== undefined ? { expiresAt: envelope.e } : {}),\n        ...(envelope.m !== undefined ? { metadata: envelope.m } : {}),\n      }\n    } catch {\n      return { value: raw, kind: \"pat\" }\n    }\n  }\n\n  async write(ref: StoreRef, cred: StoredCredential): Promise<void> {\n    const account = ref.account ?? ref.path\n    const envelope: z.infer<typeof envelopeSchema> = {\n      v: cred.value,\n      k: cred.kind,\n      ...(cred.expiresAt !== undefined ? { e: cred.expiresAt } : {}),\n      ...(cred.metadata !== undefined ? { m: cred.metadata } : {}),\n    }\n    await writeKeychainToken(ref.path, account, JSON.stringify(envelope))\n  }\n\n  async delete(ref: StoreRef): Promise<void> {\n    const account = ref.account ?? ref.path\n    await deleteKeychainToken(ref.path, account)\n  }\n}\n","/**\n * Map a provider's `TokenStoreSpec` to a backend-agnostic `StoreRef`.\n *\n * Shared by every flow engine so the `path`/`keychain` back-compat alias and\n * the `{server}` account template are resolved identically everywhere.\n */\n\nimport { resolveAccount } from \"../token-store.js\"\nimport type { TokenStoreSpec } from \"../types.js\"\nimport type { CredentialStore, StoreRef, StoredCredential } from \"./types.js\"\n\n/** When `audience` is declared, it's folded into the physical store key —\n *  `${audience}:${path}` — so credentials scoped to different audiences\n *  (e.g. \"tunnel\" vs \"api\") never collide under the same slot. Absent\n *  `audience` = today's unprefixed path, unchanged. */\nexport function resolveStoreRef(\n  spec: TokenStoreSpec,\n  server: string,\n  audience?: string,\n): StoreRef {\n  const path = spec.path ?? spec.keychain\n  return {\n    path: audience ? `${audience}:${path}` : path,\n    account: resolveAccount(spec.account, server),\n  }\n}\n\n/** Derive both the audience-prefixed `ref` and the unprefixed `legacyRef` in\n *  one call — the pair every flow engine and the broker need for the\n *  audience back-compat read (`readStoreRefWithFallback`). When no audience\n *  is declared, `legacyRef === ref` (same object), matching `resolveStoreRef`\n *  called with `audience` undefined. */\nexport function resolveStoreRefs(\n  spec: TokenStoreSpec,\n  server: string,\n  audience?: string,\n): { ref: StoreRef; legacyRef: StoreRef } {\n  const ref = resolveStoreRef(spec, server, audience)\n  const legacyRef = audience ? resolveStoreRef(spec, server) : ref\n  return { ref, legacyRef }\n}\n\n/**\n * Read through `ref`, falling back once to `legacyRef` on a miss.\n *\n * This is the read half of the audience back-compat rule: a write always\n * targets the audience-prefixed ref, but a credential written before the\n * provider adopted an audience still lives at the unprefixed (legacy) path.\n * Rather than duplicate that fallback at every flow-engine/broker read site,\n * it lives here, next to `resolveStoreRef` — the one place that already\n * knows how prefixed vs. legacy refs are derived. Callers that don't declare\n * an audience pass `ref === legacyRef` (or just call `store.read` directly);\n * this only does extra work when the two refs actually differ.\n */\nexport async function readStoreRefWithFallback(\n  store: CredentialStore,\n  ref: StoreRef,\n  legacyRef: StoreRef,\n): Promise<StoredCredential | undefined> {\n  const stored = await store.read(ref)\n  if (stored) return stored\n  if (ref.path === legacyRef.path && ref.account === legacyRef.account) {\n    return undefined\n  }\n  return store.read(legacyRef)\n}\n","/**\n * PAT flow engine — reads an existing token from the Keychain or prompts for one.\n *\n * This is the \"legacy-compatible\" flow: the user has a personal API key\n * (`gld_*`, `sk-*`, …) and the CLI needs to store/retrieve it. No browser\n * open, no ceremony. Use `service-auth` for the seamless browser-approve path.\n */\n\nimport { createInterface } from \"node:readline\"\nimport type {\n  FlowEngine,\n  FlowRunOptions,\n  FlowResult,\n  AuthProviderHandle,\n  DiscoveredEndpoints,\n} from \"../types.js\"\nimport { KeychainStore } from \"../store/keychain-store.js\"\nimport { resolveStoreRefs, readStoreRefWithFallback } from \"../store/resolve-ref.js\"\n\n/**\n * Read a secret from the terminal WITHOUT echoing it — the typed key must not\n * land on screen or in scrollback. On a TTY we drop to raw mode and render a `*`\n * mask per character. When stdin isn't a TTY (piped input, CI, tests) there's no\n * echo to suppress and no raw mode to enter, so we read a line normally.\n */\nasync function promptToken(label: string): Promise<string> {\n  const input = process.stdin\n  const out = process.stderr\n\n  if (!input.isTTY) {\n    return new Promise((resolve) => {\n      const rl = createInterface({ input, output: out })\n      out.write(`${label}: `)\n      rl.question(\"\", (answer) => {\n        rl.close()\n        resolve(answer.trim())\n      })\n    })\n  }\n\n  return new Promise((resolve, reject) => {\n    out.write(`${label}: `)\n    const chars: string[] = []\n    input.setRawMode(true)\n    input.resume()\n    input.setEncoding(\"utf8\")\n\n    const cleanup = () => {\n      input.setRawMode(false)\n      input.pause()\n      input.removeListener(\"data\", onData)\n    }\n\n    const onData = (chunk: string) => {\n      for (const ch of chunk) {\n        switch (ch) {\n          case \"\\r\":\n          case \"\\n\":\n            out.write(\"\\n\")\n            cleanup()\n            resolve(chars.join(\"\").trim())\n            return\n          case \"\\u0003\": // Ctrl-C\n            out.write(\"\\n\")\n            cleanup()\n            reject(new Error(\"auth cancelled\"))\n            return\n          case \"\\u0004\": // Ctrl-D — treat as end-of-input\n            out.write(\"\\n\")\n            cleanup()\n            resolve(chars.join(\"\").trim())\n            return\n          case \"\\u007f\": // Backspace / Delete\n          case \"\\b\":\n            if (chars.length > 0) {\n              chars.pop()\n              out.write(\"\\b \\b\")\n            }\n            break\n          default:\n            // Mask printable input; ignore stray control characters.\n            if (ch >= \" \") {\n              chars.push(ch)\n              out.write(\"*\")\n            }\n        }\n      }\n    }\n\n    input.on(\"data\", onData)\n  })\n}\n\nexport const patFlowEngine: FlowEngine = {\n  id: \"pat\",\n\n  async run(\n    provider: AuthProviderHandle,\n    _discovered: DiscoveredEndpoints | null,\n    opts: FlowRunOptions,\n  ): Promise<FlowResult> {\n    const { auth } = provider\n    if (auth.flow !== \"pat\") {\n      throw new Error(`patFlowEngine: invoked with flow=\"${auth.flow}\"`)\n    }\n\n    const store = opts.store ?? new KeychainStore()\n    const { ref, legacyRef } = resolveStoreRefs(\n      auth.tokenStore,\n      opts.server,\n      provider.audience,\n    )\n\n    if (!opts.force) {\n      const existing = await readStoreRefWithFallback(store, ref, legacyRef)\n      if (existing) {\n        return { accessToken: existing.value, tokenKind: \"pat\" }\n      }\n    }\n\n    const token = await promptToken(`${provider.id} personal access token`)\n    if (!token) throw new Error(\"no token provided\")\n\n    await store.write(ref, { value: token, kind: \"pat\" })\n\n    return { accessToken: token, tokenKind: \"pat\" }\n  },\n}\n","/**\n * Shared RFC 8628 device-grant polling primitive (internal, not exported from\n * the package root).\n *\n * Both the auth.md claim ceremony (`service-auth.ts`) and the device-code flow\n * poll an OAuth token endpoint with a grant-specific URN until the AS reports\n * success or a terminal error. This module holds that shared poll loop plus\n * the small HTTP/browser helpers both flows need — lifted verbatim from\n * `service-auth.ts` so new flow engines have somewhere to reuse them from.\n */\n\nimport { execFile } from \"node:child_process\"\nimport { promisify } from \"node:util\"\nimport { z } from \"zod\"\nimport { fetchWithDeadline } from \"../http.js\"\n\nconst execAsync = promisify(execFile)\n\n// ── response schemas ──────────────────────────────────────────────────────────\n//\n// JSON crosses a trust boundary here (the AS controls the bytes), so every\n// response is validated with Zod rather than asserted. `.loose()` keeps unknown\n// fields the spec may add. The inferred types feed the rest of the engine.\n\n/** Successful token/refresh/exchange response — the AS minted a credential. */\nexport const tokenSuccessSchema = z\n  .object({\n    access_token: z.string(),\n    token_type: z.string().optional(),\n    refresh_token: z.string().optional(),\n    identity_assertion: z.string().optional(),\n    assertion_expires_in: z.number().optional(),\n    assertion_expires: z.string().optional(),\n    // device-code flow fields (ignored by service-auth today; see WP-2).\n    expires_in: z.number().optional(),\n    scope: z.string().optional(),\n    subject: z.string().optional(),\n    revocation_id: z.string().optional(),\n  })\n  .loose()\n\n/** OAuth error response (`authorization_pending`, `slow_down`, `access_denied`…). */\nexport const tokenErrorSchema = z\n  .object({\n    error: z.string(),\n    error_description: z.string().optional(),\n  })\n  .loose()\n\n/** A token endpoint reply is either a minted credential or an OAuth error.\n *  Success is tried first so a body carrying an access_token never matches the\n *  error arm. */\nexport const tokenResponseSchema = z.union([tokenSuccessSchema, tokenErrorSchema])\n\nexport type TokenSuccess = z.infer<typeof tokenSuccessSchema>\n\n// ── helpers ──────────────────────────────────────────────────────────────────\n\nexport async function openBrowser(url: string): Promise<void> {\n  const [cmd, args]: [string, string[]] =\n    process.platform === \"darwin\"\n      ? [\"open\", [url]]\n      : process.platform === \"win32\"\n        ? [\"cmd\", [\"/c\", \"start\", url]]\n        : [\"xdg-open\", [url]]\n  try {\n    await execAsync(cmd, args)\n  } catch {\n    // best-effort — URL already printed to stderr\n  }\n}\n\n// NOTE: deliberately does NOT check res.ok — the OAuth device/claim flow returns\n// HTTP 400 with a JSON `{ error }` body for authorization_pending / slow_down,\n// which the poll loop reads as data. Throwing on non-2xx would break polling.\nexport async function postFormOAuth<T>(\n  url: string,\n  params: Record<string, string>,\n  schema: z.ZodType<T>,\n  signal?: AbortSignal,\n): Promise<T> {\n  const res = await fetchWithDeadline(url, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams(params).toString(),\n    signal,\n  })\n  return schema.parse(await res.json())\n}\n\nexport interface DeviceGrantPollOptions {\n  /** Token endpoint URL to poll. */\n  tokenEndpoint: string\n  /** Grant-type URN sent on every poll (e.g. the claim or device_code grant). */\n  grantType: string\n  /** Token-carrying form params — e.g. `claim_token`/`device_code` plus\n   *  `client_id`. `grant_type` is added automatically; do not include it here. */\n  params: Record<string, string>\n  /** Poll interval in seconds; grows by 5s on each `slow_down`. */\n  intervalS: number\n  /** Approval window in seconds, measured from when polling starts. */\n  expiresIn: number\n  signal?: AbortSignal\n}\n\n/** RFC 8628 poll loop shared by every grant that polls a token endpoint for\n *  user approval (auth.md claim ceremony, device-code). */\nexport async function pollDeviceGrant(\n  o: DeviceGrantPollOptions,\n): Promise<TokenSuccess> {\n  const deadline = Date.now() + o.expiresIn * 1_000\n  let pollMs = o.intervalS * 1_000\n\n  while (Date.now() < deadline) {\n    if (o.signal?.aborted) throw new Error(\"auth cancelled\")\n    await new Promise<void>((r) => setTimeout(r, pollMs))\n\n    const data = await postFormOAuth(\n      o.tokenEndpoint,\n      { grant_type: o.grantType, ...o.params },\n      tokenResponseSchema,\n      o.signal,\n    )\n\n    if (!(\"error\" in data)) return data\n\n    const pollErr = data.error\n    if (pollErr === \"authorization_pending\") continue\n    if (pollErr === \"slow_down\") {\n      pollMs += 5_000\n      continue\n    }\n    if (pollErr === \"expired_token\") {\n      throw new Error(\"auth timeout — claim expired before user approved\")\n    }\n    if (pollErr === \"access_denied\") {\n      throw new Error(\"access denied — user rejected the authorisation request\")\n    }\n\n    const desc = data.error_description\n    throw new Error(`token endpoint error: ${pollErr}${desc ? ` — ${desc}` : \"\"}`)\n  }\n\n  throw new Error(\"auth timeout — approval window closed\")\n}\n","/**\n * service-auth flow engine — auth.md claim ceremony.\n *\n * Protocol:\n *   POST /agent/identity { type:\"service_auth\" }\n *     → registration_id + claim_token + user_code + verification_uri\n *   User approves at verification_uri in browser.\n *   Poll POST {token_endpoint} with grant_type=urn:workos:agent-auth:grant-type:claim\n *     until approved / denied / expired.\n *   On success: store the identity_assertion JWT (AIP-50 §Token storage —\n *     the assertion is the durable credential; the access_token MUST NOT be\n *     persisted, and the claim_token stays in memory only).\n *\n * Subsequent runs skip the ceremony: the stored assertion is exchanged via the\n * jwt-bearer grant for a fresh access_token (\"this IS the refresh path\" — no\n * refresh_token). Only when the assertion is expired/rejected does a new\n * ceremony start.\n *\n * See: https://github.com/workos/auth.md  /  AIP-50\n */\n\nimport { z } from \"zod\"\nimport type {\n  FlowEngine,\n  FlowRunOptions,\n  FlowResult,\n  AuthProviderHandle,\n  DiscoveredEndpoints,\n} from \"../types.js\"\nimport { KeychainStore } from \"../store/keychain-store.js\"\nimport { resolveStoreRefs, readStoreRefWithFallback } from \"../store/resolve-ref.js\"\nimport { fetchWithDeadline, assertSecureUrl } from \"../http.js\"\nimport {\n  openBrowser,\n  postFormOAuth,\n  pollDeviceGrant,\n  tokenResponseSchema,\n  type TokenSuccess,\n} from \"./device-grant.js\"\n\nconst CLAIM_GRANT_TYPE = \"urn:workos:agent-auth:grant-type:claim\"\nconst JWT_BEARER_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:jwt-bearer\"\nconst DEFAULT_POLL_INTERVAL_S = 5\n\n// ── response schemas ──────────────────────────────────────────────────────────\n//\n// JSON crosses a trust boundary here (the AS controls the bytes), so every\n// response is validated with Zod rather than asserted. `.loose()` keeps unknown\n// fields the spec may add. The inferred types feed the rest of the engine.\n// (Token success/error schemas live in device-grant.ts, shared with every flow\n// that polls a token endpoint.)\n\nconst identityResponseSchema = z\n  .object({\n    registration_id: z.string(),\n    claim_token: z.string(),\n    claim: z\n      .object({\n        user_code: z.string(),\n        verification_uri: z.string(),\n        expires_in: z.number(),\n        interval: z.number().optional(),\n      })\n      .loose(),\n  })\n  .loose()\n\n// ── helpers ──────────────────────────────────────────────────────────────────\n\nasync function postJson<T>(\n  url: string,\n  body: unknown,\n  schema: z.ZodType<T>,\n  signal?: AbortSignal,\n): Promise<T> {\n  const res = await fetchWithDeadline(url, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/json\" },\n    body: JSON.stringify(body),\n    signal,\n  })\n  if (!res.ok) {\n    const text = await res.text()\n    throw new Error(`POST ${url} → ${res.status}: ${text}`)\n  }\n  return schema.parse(await res.json())\n}\n\n// ── Identity-assertion exchange (jwt-bearer, RFC 7523) ────────────────────────\n//\n// The stored credential IS the identity_assertion JWT. Exchange it at the token\n// endpoint for a fresh, short-lived access token — the AIP-50 refresh path, with\n// no refresh_token involved. Returns null on any error (expired / invalid_grant\n// / server doesn't support the grant) so the caller falls back to a ceremony.\nasync function exchangeAssertion(\n  tokenEndpoint: string,\n  assertion: string,\n  clientId: string,\n  signal?: AbortSignal,\n): Promise<TokenSuccess | null> {\n  try {\n    const data = await postFormOAuth(\n      tokenEndpoint,\n      {\n        grant_type: JWT_BEARER_GRANT_TYPE,\n        assertion,\n        client_id: clientId,\n      },\n      tokenResponseSchema,\n      signal,\n    )\n    if (\"error\" in data) return null\n    return data\n  } catch {\n    return null\n  }\n}\n\n// ── engine ───────────────────────────────────────────────────────────────────\n\nexport const serviceAuthFlowEngine: FlowEngine = {\n  id: \"service-auth\",\n\n  async run(\n    provider: AuthProviderHandle,\n    discovered: DiscoveredEndpoints | null,\n    opts: FlowRunOptions,\n  ): Promise<FlowResult> {\n    const { auth } = provider\n    if (auth.flow !== \"service-auth\") {\n      throw new Error(`serviceAuthFlowEngine: invoked with flow=\"${auth.flow}\"`)\n    }\n    // `auth.flow === \"service-auth\"` is guaranteed by the guard above, so the\n    // discriminated union has already narrowed `auth` to ServiceAuthConfig.\n    const config = auth\n    const clientId = config.clientId ?? \"agentproto-cli\"\n    const server = opts.server.replace(/\\/$/, \"\")\n\n    // Endpoint resolution — prefer live discovery, fall back to conventions\n    const identityEndpoint =\n      discovered?.identityEndpoint ?? `${server}/agent/identity`\n    const tokenEndpoint =\n      discovered?.tokenEndpoint ?? `${server}/oauth/token`\n\n    // AIP-50 §Security: auth requests MUST use HTTPS (loopback exempt for dev).\n    assertSecureUrl(identityEndpoint)\n    assertSecureUrl(tokenEndpoint)\n\n    const store = opts.store ?? new KeychainStore()\n    const { ref, legacyRef } = resolveStoreRefs(\n      config.tokenStore,\n      server,\n      provider.audience,\n    )\n\n    // Cached path — the stored credential IS the identity_assertion JWT (AIP-50:\n    // never the access token, never a refresh token). Exchange it via jwt-bearer\n    // for a fresh access token; on failure (expired / invalid_grant) fall through\n    // to a full browser ceremony.\n    if (!opts.force) {\n      const stored = await readStoreRefWithFallback(store, ref, legacyRef)\n      if (stored) {\n        const exchanged = await exchangeAssertion(\n          tokenEndpoint,\n          stored.value,\n          clientId,\n          opts.signal,\n        )\n        if (exchanged) {\n          // If the server rotated the assertion, persist the new one; otherwise\n          // the existing assertion stays valid for the next exchange.\n          if (exchanged.identity_assertion) {\n            await store.write(ref, {\n              value: exchanged.identity_assertion,\n              kind: \"assertion\",\n            })\n          }\n          return {\n            accessToken: exchanged.access_token,\n            ...(exchanged.identity_assertion\n              ? { identityAssertion: exchanged.identity_assertion }\n              : {}),\n            tokenKind: \"oat\",\n          }\n        }\n      }\n    }\n\n    // 1 — POST /agent/identity to start the claim ceremony\n    const identity = await postJson(\n      identityEndpoint,\n      {\n        type: \"service_auth\",\n        client_id: clientId,\n        ...(config.loginHint ? { login_hint: config.loginHint } : {}),\n      },\n      identityResponseSchema,\n      opts.signal,\n    )\n\n    const { claim_token, claim } = identity\n    const intervalS = claim.interval ?? DEFAULT_POLL_INTERVAL_S\n    const windowMin = Math.round(claim.expires_in / 60)\n\n    // 2 — Print code + open browser\n    process.stderr.write(`\\n`)\n    process.stderr.write(`  Approve ${provider.id} access in your browser\\n\\n`)\n    process.stderr.write(`  Code:  ${claim.user_code}\\n`)\n    process.stderr.write(`  URL:   ${claim.verification_uri}\\n\\n`)\n    if (opts.openBrowser !== false) {\n      await openBrowser(claim.verification_uri)\n    }\n    process.stderr.write(`  Waiting for approval (${windowMin} min)…\\n\\n`)\n\n    // 3 — Poll until approved / denied / expired\n    const tokenResult = await pollDeviceGrant({\n      tokenEndpoint,\n      grantType: CLAIM_GRANT_TYPE,\n      params: { claim_token, client_id: clientId },\n      intervalS,\n      expiresIn: claim.expires_in,\n      signal: opts.signal,\n    })\n\n    // 4 — Store the identity_assertion as the durable credential (AIP-50: the\n    //     access_token is ephemeral and MUST NOT be persisted; the claim_token\n    //     was held in memory only). The assertion is re-exchanged via jwt-bearer\n    //     on the next run.\n    const accessToken = tokenResult.access_token\n    const assertion = tokenResult.identity_assertion\n\n    // Resolve assertion expiry as ISO 8601\n    let assertionExpires: string | undefined\n    if (tokenResult.assertion_expires) {\n      assertionExpires = tokenResult.assertion_expires\n    } else if (tokenResult.assertion_expires_in) {\n      assertionExpires = new Date(\n        Date.now() + tokenResult.assertion_expires_in * 1_000,\n      ).toISOString()\n    }\n\n    if (assertion) {\n      await store.write(ref, {\n        value: assertion,\n        kind: \"assertion\",\n        ...(assertionExpires ? { expiresAt: assertionExpires } : {}),\n      })\n    }\n\n    return {\n      accessToken,\n      identityAssertion: assertion,\n      assertionExpires,\n      tokenKind: \"oat\",\n    }\n  },\n}\n","/**\n * device-code flow engine — plain RFC 8628 device-authorization ceremony.\n *\n * Protocol:\n *   POST {device_authorization_endpoint} { client_id, scope?, device_label? }\n *     → device_code + user_code + verification_uri(_complete) + expires_in\n *   User approves at verification_uri in browser.\n *   Poll POST {token_endpoint} with grant_type=urn:ietf:params:oauth:grant-type:device_code\n *     until approved / denied / expired.\n *   On success: store the access_token as the durable credential (kind:\"daemon\")\n *     — unlike service-auth, the access token IS the thing that's persisted;\n *     refresh_token/scope/subject/revocation_id ride in `metadata`.\n *\n * Subsequent runs: a fresh stored credential (or one with no expiry) short-\n * circuits the ceremony. An expired credential with a stored refresh_token is\n * exchanged via `grant_type=refresh_token`; on failure (or when no\n * refresh_token was stored) a new ceremony starts.\n */\n\nimport { z } from \"zod\"\nimport type {\n  FlowEngine,\n  FlowRunOptions,\n  FlowResult,\n  AuthProviderHandle,\n  DiscoveredEndpoints,\n} from \"../types.js\"\nimport { KeychainStore } from \"../store/keychain-store.js\"\nimport { resolveStoreRefs, readStoreRefWithFallback } from \"../store/resolve-ref.js\"\nimport type { CredentialStore, StoreRef, StoredCredential } from \"../store/types.js\"\nimport { fetchWithDeadline, assertSecureUrl } from \"../http.js\"\nimport {\n  openBrowser,\n  postFormOAuth,\n  pollDeviceGrant,\n  tokenResponseSchema,\n  type TokenSuccess,\n} from \"./device-grant.js\"\n\nconst DEVICE_CODE_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:device_code\"\nconst REFRESH_GRANT_TYPE = \"refresh_token\"\nconst DEFAULT_POLL_INTERVAL_S = 5\n\n/** Thrown by the device-code engine when `opts.refreshOnly` is set and no\n *  fresh or refreshable credential is available — the only remaining path\n *  would be an interactive ceremony, which `refreshOnly` callers explicitly\n *  opt out of. Callers (e.g. `serve` boot on a headless host) catch this to\n *  fall back to their own non-interactive behavior instead of hanging. */\nexport class CeremonyRequiredError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = \"CeremonyRequiredError\"\n  }\n}\n\n// ── response schema ───────────────────────────────────────────────────────────\n//\n// JSON crosses a trust boundary here (the AS controls the bytes), so the\n// response is validated with Zod rather than asserted. `.loose()` keeps\n// unknown fields the spec may add.\n\nconst deviceAuthorizationResponseSchema = z\n  .object({\n    device_code: z.string(),\n    user_code: z.string(),\n    verification_uri: z.string(),\n    verification_uri_complete: z.string().optional(),\n    expires_in: z.number(),\n    interval: z.number().optional(),\n  })\n  .loose()\n\n// ── helpers ──────────────────────────────────────────────────────────────────\n\nasync function postDeviceAuthorization(\n  url: string,\n  params: Record<string, string>,\n  signal?: AbortSignal,\n) {\n  const res = await fetchWithDeadline(url, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams(params).toString(),\n    signal,\n  })\n  if (!res.ok) {\n    const text = await res.text()\n    throw new Error(`POST ${url} → ${res.status}: ${text}`)\n  }\n  return deviceAuthorizationResponseSchema.parse(await res.json())\n}\n\n/** Read a string metadata field without an `as` cast — `metadata` is\n *  `Record<string, unknown>`, so every read is a runtime type check. */\nfunction metaString(\n  metadata: Record<string, unknown> | undefined,\n  key: string,\n): string | undefined {\n  const v = metadata?.[key]\n  return typeof v === \"string\" ? v : undefined\n}\n\nfunction isExpired(cred: StoredCredential): boolean {\n  if (!cred.expiresAt) return false\n  const t = Date.parse(cred.expiresAt)\n  if (Number.isNaN(t)) return true\n  return t <= Date.now()\n}\n\nfunction resultFromStored(cred: StoredCredential): FlowResult {\n  const refreshToken = metaString(cred.metadata, \"refreshToken\")\n  const scope = metaString(cred.metadata, \"scope\")\n  const subject = metaString(cred.metadata, \"subject\")\n  const revocationId = metaString(cred.metadata, \"revocationId\")\n  return {\n    accessToken: cred.value,\n    tokenKind: \"daemon\",\n    ...(refreshToken ? { refreshToken } : {}),\n    ...(scope ? { scope } : {}),\n    ...(subject ? { subject } : {}),\n    ...(revocationId ? { revocationId } : {}),\n  }\n}\n\n/** Refresh via `grant_type=refresh_token`. Returns null on any error\n *  (expired / invalid_grant / server doesn't support the grant) so the\n *  caller falls back to a full ceremony. */\nasync function refreshAccessToken(\n  tokenEndpoint: string,\n  refreshToken: string,\n  clientId: string,\n  signal?: AbortSignal,\n): Promise<TokenSuccess | null> {\n  try {\n    const data = await postFormOAuth(\n      tokenEndpoint,\n      {\n        grant_type: REFRESH_GRANT_TYPE,\n        refresh_token: refreshToken,\n        client_id: clientId,\n      },\n      tokenResponseSchema,\n      signal,\n    )\n    if (\"error\" in data) return null\n    return data\n  } catch {\n    return null\n  }\n}\n\nasync function persistAndResult(\n  store: CredentialStore,\n  ref: StoreRef,\n  o: {\n    accessToken: string\n    expiresIn?: number\n    refreshToken?: string\n    scope?: string\n    subject?: string\n    deviceLabel?: string\n    revocationId?: string\n  },\n): Promise<FlowResult> {\n  const expiresAt = o.expiresIn\n    ? new Date(Date.now() + o.expiresIn * 1_000).toISOString()\n    : undefined\n\n  const metadata: Record<string, unknown> = {\n    obtainedAt: new Date().toISOString(),\n    ...(o.refreshToken ? { refreshToken: o.refreshToken } : {}),\n    ...(o.scope ? { scope: o.scope } : {}),\n    ...(o.subject ? { subject: o.subject } : {}),\n    ...(o.deviceLabel ? { deviceLabel: o.deviceLabel } : {}),\n    ...(o.revocationId ? { revocationId: o.revocationId } : {}),\n  }\n\n  await store.write(ref, {\n    value: o.accessToken,\n    kind: \"daemon\",\n    ...(expiresAt ? { expiresAt } : {}),\n    metadata,\n  })\n\n  return {\n    accessToken: o.accessToken,\n    tokenKind: \"daemon\",\n    ...(o.refreshToken ? { refreshToken: o.refreshToken } : {}),\n    ...(o.scope ? { scope: o.scope } : {}),\n    ...(o.subject ? { subject: o.subject } : {}),\n    ...(o.revocationId ? { revocationId: o.revocationId } : {}),\n  }\n}\n\n// ── engine ───────────────────────────────────────────────────────────────────\n\nexport const deviceCodeFlowEngine: FlowEngine = {\n  id: \"device-code\",\n\n  async run(\n    provider: AuthProviderHandle,\n    discovered: DiscoveredEndpoints | null,\n    opts: FlowRunOptions,\n  ): Promise<FlowResult> {\n    const { auth } = provider\n    if (auth.flow !== \"device-code\") {\n      throw new Error(`deviceCodeFlowEngine: invoked with flow=\"${auth.flow}\"`)\n    }\n    // `auth.flow === \"device-code\"` is guaranteed by the guard above, so the\n    // discriminated union has already narrowed `auth` to DeviceCodeAuthConfig.\n    const config = auth\n    const clientId = config.clientId ?? \"agentproto-cli\"\n    const server = opts.server.replace(/\\/$/, \"\")\n\n    // Endpoint resolution — prefer live discovery, fall back to conventions.\n    const deviceAuthorizationEndpoint =\n      discovered?.deviceAuthorizationEndpoint ?? `${server}/oauth/device`\n    const tokenEndpoint = discovered?.tokenEndpoint ?? `${server}/oauth/token`\n\n    // AIP-50 §Security: auth requests MUST use HTTPS (loopback exempt for dev).\n    assertSecureUrl(deviceAuthorizationEndpoint)\n    assertSecureUrl(tokenEndpoint)\n\n    const store = opts.store ?? new KeychainStore()\n    const { ref, legacyRef } = resolveStoreRefs(\n      config.tokenStore,\n      server,\n      provider.audience,\n    )\n\n    // Shared by both the ordinary cached path and `refreshOnly`: exchange a\n    // stored refresh_token for a fresh access token, persisting the result.\n    // Returns null (never throws) on a missing refresh_token or any grant\n    // failure, so both callers can decide what to do next.\n    async function tryRefresh(stored: StoredCredential): Promise<FlowResult | null> {\n      const refreshToken = metaString(stored.metadata, \"refreshToken\")\n      if (!refreshToken) return null\n      const refreshed = await refreshAccessToken(\n        tokenEndpoint,\n        refreshToken,\n        clientId,\n        opts.signal,\n      )\n      if (!refreshed) return null\n      return persistAndResult(store, ref, {\n        accessToken: refreshed.access_token,\n        expiresIn: refreshed.expires_in,\n        refreshToken: refreshed.refresh_token ?? refreshToken,\n        scope: refreshed.scope ?? metaString(stored.metadata, \"scope\"),\n        subject: refreshed.subject ?? metaString(stored.metadata, \"subject\"),\n        deviceLabel:\n          config.deviceLabel ?? metaString(stored.metadata, \"deviceLabel\"),\n        revocationId:\n          refreshed.revocation_id ?? metaString(stored.metadata, \"revocationId\"),\n      })\n    }\n\n    // `refreshOnly` — attempt only the cached/refresh path, never the\n    // interactive ceremony. Distinct from the ordinary cached path below so\n    // a refresh failure here throws instead of falling through.\n    if (opts.refreshOnly) {\n      const stored = await readStoreRefWithFallback(store, ref, legacyRef)\n      if (stored) {\n        if (!isExpired(stored)) {\n          return resultFromStored(stored)\n        }\n        const refreshed = await tryRefresh(stored)\n        if (refreshed) return refreshed\n      }\n      throw new CeremonyRequiredError(\n        `${provider.id}: no fresh or refreshable device-code credential — an interactive ceremony would be required, but refreshOnly was set`,\n      )\n    }\n\n    // Cached path — the stored credential IS the access token (pat-class\n    // persistence). A fresh (or expiry-less) credential short-circuits the\n    // ceremony entirely; an expired one with a refresh_token is renewed via\n    // grant_type=refresh_token before falling back to a ceremony.\n    if (!opts.force) {\n      const stored = await readStoreRefWithFallback(store, ref, legacyRef)\n      if (stored) {\n        if (!isExpired(stored)) {\n          return resultFromStored(stored)\n        }\n        const refreshed = await tryRefresh(stored)\n        if (refreshed) return refreshed\n        // refresh failed (expired / invalid_grant) — fall through to a ceremony\n      }\n    }\n\n    // 1 — POST the device-authorization endpoint to start the ceremony\n    const params: Record<string, string> = { client_id: clientId }\n    if (config.scope) params.scope = config.scope\n    if (config.deviceLabel) params.device_label = config.deviceLabel\n\n    const authz = await postDeviceAuthorization(\n      deviceAuthorizationEndpoint,\n      params,\n      opts.signal,\n    )\n\n    const intervalS = authz.interval ?? DEFAULT_POLL_INTERVAL_S\n    const windowMin = Math.round(authz.expires_in / 60)\n\n    // 2 — Print code + open browser\n    process.stderr.write(`\\n`)\n    process.stderr.write(`  Approve ${provider.id} access in your browser\\n\\n`)\n    process.stderr.write(`  Code:  ${authz.user_code}\\n`)\n    process.stderr.write(`  URL:   ${authz.verification_uri}\\n\\n`)\n    if (opts.openBrowser !== false) {\n      await openBrowser(authz.verification_uri_complete ?? authz.verification_uri)\n    }\n    process.stderr.write(`  Waiting for approval (${windowMin} min)…\\n\\n`)\n\n    // 3 — Poll until approved / denied / expired\n    const tokenResult = await pollDeviceGrant({\n      tokenEndpoint,\n      grantType: DEVICE_CODE_GRANT_TYPE,\n      params: { device_code: authz.device_code, client_id: clientId },\n      intervalS,\n      expiresIn: authz.expires_in,\n      signal: opts.signal,\n    })\n\n    // 4 — Persist the access token as the durable credential (pat-class).\n    return persistAndResult(store, ref, {\n      accessToken: tokenResult.access_token,\n      expiresIn: tokenResult.expires_in,\n      refreshToken: tokenResult.refresh_token,\n      scope: tokenResult.scope,\n      subject: tokenResult.subject,\n      deviceLabel: config.deviceLabel,\n      revocationId: tokenResult.revocation_id,\n    })\n  },\n}\n","/**\n * Flow engine registry — dispatch by `provider.auth.flow`.\n *\n * Add a new engine:\n *   1. Implement `FlowEngine` in a sibling file\n *   2. Add it here — no if/switch chains at call sites\n */\n\nimport type { FlowEngine } from \"../types.js\"\nimport { patFlowEngine } from \"./pat.js\"\nimport { serviceAuthFlowEngine } from \"./service-auth.js\"\nimport { deviceCodeFlowEngine } from \"./device-code.js\"\n\nexport const FLOW_ENGINES: Readonly<Record<string, FlowEngine>> = {\n  [patFlowEngine.id]: patFlowEngine,\n  [serviceAuthFlowEngine.id]: serviceAuthFlowEngine,\n  [deviceCodeFlowEngine.id]: deviceCodeFlowEngine,\n}\n","/**\n * `runAuthFlow` — resolve provider → discover endpoints → dispatch to engine.\n *\n * Discovery is attempted silently; callers receive the result without knowing\n * whether live or static endpoint config was used. The flow engine receives\n * `null` for `discovered` if discovery failed or was not attempted.\n */\n\nimport { FLOW_ENGINES } from \"./flow-engines/index.js\"\nimport { discoverEndpoints, DiscoveryError } from \"./discover.js\"\nimport type {\n  AuthProviderHandle,\n  DiscoveredEndpoints,\n  FlowResult,\n  FlowRunOptions,\n} from \"./types.js\"\n\nexport interface RunFlowOptions extends FlowRunOptions {\n  /** Pre-resolved endpoints (skip discovery). Pass null to force re-discovery. */\n  discovered?: DiscoveredEndpoints | null\n  /** Suppress debug output. Default: false. */\n  quiet?: boolean\n}\n\nexport async function runAuthFlow(\n  provider: AuthProviderHandle,\n  opts: RunFlowOptions,\n): Promise<FlowResult> {\n  const flowId = provider.auth.flow\n  const engine = FLOW_ENGINES[flowId]\n  if (!engine) {\n    throw new Error(\n      `runAuthFlow: unknown flow \"${flowId}\" — registered: ${Object.keys(FLOW_ENGINES).join(\", \")}`,\n    )\n  }\n\n  // Discovery: try unless caller already provided endpoints\n  let discovered: DiscoveredEndpoints | null =\n    opts.discovered !== undefined ? opts.discovered : null\n\n  if (\n    discovered === null &&\n    (flowId === \"service-auth\" || flowId === \"device-code\")\n  ) {\n    try {\n      discovered = await discoverEndpoints(opts.server, { signal: opts.signal })\n    } catch (err) {\n      if (!opts.quiet) {\n        const msg =\n          err instanceof DiscoveryError\n            ? err.message\n            : `discovery failed: ${err}`\n        process.stderr.write(`[auth] ${msg} — using static config\\n`)\n      }\n    }\n  }\n\n  return engine.run(provider, discovered, opts)\n}\n","/**\n * MemoryStore — in-process `CredentialStore` backed by a `Map`.\n *\n * Ephemeral: gone when the process exits. Used for tests and short-lived\n * tooling that shouldn't touch a real backend.\n */\n\nimport type { CredentialStore, StoreRef, StoredCredential } from \"./types.js\"\n\nfunction keyOf(ref: StoreRef): string {\n  return `${ref.path}\u0000${ref.account ?? ref.path}`\n}\n\nexport class MemoryStore implements CredentialStore {\n  private readonly entries = new Map<string, StoredCredential>()\n\n  async read(ref: StoreRef): Promise<StoredCredential | undefined> {\n    const entry = this.entries.get(keyOf(ref))\n    return entry ? { ...entry } : undefined\n  }\n\n  async write(ref: StoreRef, cred: StoredCredential): Promise<void> {\n    this.entries.set(keyOf(ref), { ...cred })\n  }\n\n  async delete(ref: StoreRef): Promise<void> {\n    this.entries.delete(keyOf(ref))\n  }\n}\n","/**\n * FileStore — encrypted-JSON-file `CredentialStore`.\n *\n * Every entry is sealed independently with AES-256-GCM under a key read from\n * `AGENTPROTO_STORE_KEY` (hex or base64, 32 raw bytes). There is no plaintext\n * fallback: a missing or malformed key throws rather than writing credentials\n * to disk in the clear.\n */\n\nimport {\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from \"node:crypto\"\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\"\nimport { dirname } from \"node:path\"\nimport { z } from \"zod\"\nimport type { CredentialStore, StoreRef, StoredCredential } from \"./types.js\"\n\nconst ALGORITHM = \"aes-256-gcm\"\nconst KEY_ENV_VAR = \"AGENTPROTO_STORE_KEY\"\nconst IV_BYTES = 12\n\nconst sealedEntrySchema = z.object({\n  iv: z.string(),\n  tag: z.string(),\n  ciphertext: z.string(),\n})\ntype SealedEntry = z.infer<typeof sealedEntrySchema>\n\nconst sealedFileSchema = z.record(z.string(), sealedEntrySchema)\n\nconst storedCredentialSchema = z.object({\n  value: z.string(),\n  kind: z.enum([\"pat\", \"assertion\", \"oat\", \"daemon\"]),\n  expiresAt: z.string().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n})\n\nfunction keyOf(ref: StoreRef): string {\n  return `${ref.path} ${ref.account ?? ref.path}`\n}\n\nfunction isEnoent(err: unknown): boolean {\n  return (\n    typeof err === \"object\" &&\n    err !== null &&\n    \"code\" in err &&\n    err.code === \"ENOENT\"\n  )\n}\n\n/** Decode `AGENTPROTO_STORE_KEY` (hex or base64) into exactly 32 raw bytes. */\nfunction loadKey(): Buffer {\n  const raw = process.env[KEY_ENV_VAR]\n  if (!raw) {\n    throw new Error(\n      `FileStore: missing ${KEY_ENV_VAR} — set a 32-byte key (64 hex chars, ` +\n        `or base64) to use the encrypted file store. Refusing to store ` +\n        `credentials in plaintext.`,\n    )\n  }\n  const key = /^[0-9a-fA-F]{64}$/.test(raw)\n    ? Buffer.from(raw, \"hex\")\n    : Buffer.from(raw, \"base64\")\n  if (key.length !== 32) {\n    throw new Error(\n      `FileStore: ${KEY_ENV_VAR} must decode to exactly 32 bytes (got ` +\n        `${key.length}). Provide a 64-char hex string or base64 encoding 32 bytes.`,\n    )\n  }\n  return key\n}\n\nfunction seal(key: Buffer, plaintext: string): SealedEntry {\n  const iv = randomBytes(IV_BYTES)\n  const cipher = createCipheriv(ALGORITHM, key, iv)\n  const ciphertext = Buffer.concat([\n    cipher.update(plaintext, \"utf8\"),\n    cipher.final(),\n  ])\n  return {\n    iv: iv.toString(\"base64\"),\n    tag: cipher.getAuthTag().toString(\"base64\"),\n    ciphertext: ciphertext.toString(\"base64\"),\n  }\n}\n\nfunction unseal(key: Buffer, entry: SealedEntry): string {\n  const decipher = createDecipheriv(\n    ALGORITHM,\n    key,\n    Buffer.from(entry.iv, \"base64\"),\n  )\n  decipher.setAuthTag(Buffer.from(entry.tag, \"base64\"))\n  const plaintext = Buffer.concat([\n    decipher.update(Buffer.from(entry.ciphertext, \"base64\")),\n    decipher.final(),\n  ])\n  return plaintext.toString(\"utf8\")\n}\n\nexport class FileStore implements CredentialStore {\n  constructor(private readonly filePath: string) {}\n\n  async read(ref: StoreRef): Promise<StoredCredential | undefined> {\n    const key = loadKey()\n    const file = await this.readFile()\n    const sealed = file[keyOf(ref)]\n    if (!sealed) return undefined\n    return storedCredentialSchema.parse(JSON.parse(unseal(key, sealed)))\n  }\n\n  async write(ref: StoreRef, cred: StoredCredential): Promise<void> {\n    const key = loadKey()\n    const file = await this.readFile()\n    file[keyOf(ref)] = seal(key, JSON.stringify(cred))\n    await this.writeFile(file)\n  }\n\n  async delete(ref: StoreRef): Promise<void> {\n    const file = await this.readFile()\n    delete file[keyOf(ref)]\n    await this.writeFile(file)\n  }\n\n  private async readFile(): Promise<Record<string, SealedEntry>> {\n    try {\n      const raw = await readFile(this.filePath, \"utf8\")\n      return sealedFileSchema.parse(JSON.parse(raw))\n    } catch (err) {\n      if (isEnoent(err)) return {}\n      throw err\n    }\n  }\n\n  private async writeFile(file: Record<string, SealedEntry>): Promise<void> {\n    await mkdir(dirname(this.filePath), { recursive: true })\n    await writeFile(this.filePath, JSON.stringify(file, null, 2), \"utf8\")\n  }\n}\n","/**\n * CredentialBroker — resolve ready-to-use auth headers for a `<providerId>`\n * or `<providerId>/<account>` path, auto-refreshing via the flow engine when\n * the stored credential is missing, expired, or not directly usable.\n *\n * Agent.pw-parity API: callers ask for headers by path and never touch\n * tokens, flows, or the underlying store directly.\n */\n\nimport { runAuthFlow } from \"./run-flow.js\"\nimport { resolveStoreRefs, readStoreRefWithFallback } from \"./store/resolve-ref.js\"\nimport type { CredentialStore, StoredCredential } from \"./store/types.js\"\nimport type { AuthProviderHandle } from \"./types.js\"\n\n/** Refresh this long before the actual expiry, so a credential that's about\n *  to expire mid-request gets renewed proactively instead of failing. */\nconst EXPIRY_SKEW_MS = 60_000\n\nexport interface CredentialBrokerOptions {\n  /** Backend to read cached credentials from and persist refreshed ones to. */\n  store: CredentialStore\n  /** Provider lookup — pass `getAuthProvider` from the registry, or a custom\n   *  resolver (e.g. scoped to a single host's providers). */\n  getProvider: (id: string) => AuthProviderHandle | undefined\n}\n\ninterface ParsedPath {\n  providerId: string\n  account?: string\n}\n\n/** Split `\"<providerId>\"` or `\"<providerId>/<account>\"` on the first `/`. */\nfunction parsePath(path: string): ParsedPath {\n  const slash = path.indexOf(\"/\")\n  if (slash === -1) return { providerId: path }\n  return { providerId: path.slice(0, slash), account: path.slice(slash + 1) }\n}\n\n/** `expiresAt` in the future (past the refresh skew), or absent entirely. A\n *  malformed `expiresAt` is treated as expired — refresh rather than risk\n *  serving a header that a downstream API will reject. */\nfunction isFresh(cred: StoredCredential): boolean {\n  if (!cred.expiresAt) return true\n  const expiresAtMs = Date.parse(cred.expiresAt)\n  if (Number.isNaN(expiresAtMs)) return false\n  return expiresAtMs - EXPIRY_SKEW_MS > Date.now()\n}\n\n/** Header map for a credential usable as a bearer token directly, or\n *  `undefined` when it isn't. `assertion` is never bearer-usable — it must be\n *  exchanged by a flow engine first — so it always falls through to\n *  `runAuthFlow`. */\nfunction bearerHeaders(\n  value: string,\n  kind: StoredCredential[\"kind\"],\n): Record<string, string> | undefined {\n  if (kind === \"pat\" || kind === \"oat\" || kind === \"daemon\") {\n    return { Authorization: `Bearer ${value}` }\n  }\n  return undefined\n}\n\nexport class CredentialBroker {\n  private readonly store: CredentialStore\n  private readonly getProvider: (id: string) => AuthProviderHandle | undefined\n\n  constructor(opts: CredentialBrokerOptions) {\n    this.store = opts.store\n    this.getProvider = opts.getProvider\n  }\n\n  async resolveHeaders(o: {\n    path: string\n    server?: string\n    signal?: AbortSignal\n    /** Audience the caller expects this credential to be scoped to. Checked\n     *  only when the resolved provider also declares one — see the mismatch\n     *  error below. Does not itself change which store key is read; the\n     *  provider's own `audience` (not the caller's) determines that. */\n    audience?: string\n  }): Promise<Record<string, string>> {\n    const { providerId, account } = parsePath(o.path)\n    const provider = this.getProvider(providerId)\n    if (!provider) {\n      throw new Error(`CredentialBroker: unknown auth provider \"${providerId}\"`)\n    }\n\n    if (\n      o.audience !== undefined &&\n      provider.audience !== undefined &&\n      o.audience !== provider.audience\n    ) {\n      throw new Error(\n        `CredentialBroker: provider \"${providerId}\" is scoped to audience \"${provider.audience}\", requested \"${o.audience}\"`,\n      )\n    }\n\n    const server = o.server ?? provider.apiBase\n    const { ref, legacyRef } = resolveStoreRefs(\n      provider.auth.tokenStore,\n      server,\n      provider.audience,\n    )\n    if (account !== undefined) {\n      ref.account = account\n      legacyRef.account = account\n    }\n\n    const stored = await readStoreRefWithFallback(this.store, ref, legacyRef)\n    if (stored && isFresh(stored)) {\n      const headers = bearerHeaders(stored.value, stored.kind)\n      if (headers) return headers\n    }\n\n    const result = await runAuthFlow(provider, {\n      server,\n      store: this.store,\n      signal: o.signal,\n    })\n    const headers =\n      result.accessToken !== undefined\n        ? bearerHeaders(result.accessToken, result.tokenKind)\n        : undefined\n    if (!headers) {\n      throw new Error(\n        `CredentialBroker: auth flow for \"${providerId}\" produced no usable access token`,\n      )\n    }\n    return headers\n  }\n}\n","/**\n * Named auth-profile store — CRUD over `~/.agentproto/auth-profiles.json`\n * (mode 0600), generalizing `providers-store`'s single-key-per-provider file\n * (`packages/providers-store/src/index.ts:68-90`, `ProviderEntry`/\n * `ProvidersFile`) to N named `AuthProfile`s per billing endpoint, keyed by `id`.\n *\n * This is the profile-metadata store, not the credential store: entries hold\n * `credentialRef` (a pointer), never a secret, so — unlike `FileStore`\n * (`store/file-store.ts`) — this file needs no encryption. Reuses the exact\n * persistence primitives `providers-store` already established (a versioned\n * JSON file under `~/.agentproto/`, `node:fs/promises`, mode 0600) rather\n * than inventing a new format, just relocated to `@agentproto/auth` — the\n * correct home for named profiles per SPEC §1c (`providers.json` is the\n * degenerate one-key-per-provider case this generalizes).\n */\n\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\"\nimport { homedir } from \"node:os\"\nimport { join, resolve } from \"node:path\"\nimport { z } from \"zod\"\nimport type { AuthMethod, AuthProfile } from \"./profile-types.js\"\n\nconst authMethodSchema = z.enum([\"oauth-bearer\", \"api-key\"]) satisfies z.ZodType<AuthMethod>\n\n/** Version-1 on-disk shape. Keep `vendor` here permanently for compatibility:\n * callers only ever see the unambiguous in-memory `endpoint` field. */\nconst modelCurationSchema = z.object({\n  mode: z.enum([\"all\", \"allow\"]),\n  ids: z.array(z.string()),\n})\n\nconst costBudgetSchema = z.object({\n  maxCostUsd: z.number(),\n  window: z.string(),\n  scope: z.enum([\"session\", \"profile\"]),\n})\n\nconst authProfileSchema = z.object({\n  id: z.string(),\n  vendor: z.string(),\n  method: authMethodSchema,\n  credentialRef: z.string().optional(),\n  source: z.string().optional(),\n  label: z.string().optional(),\n  // Additive, back-compat fields — an entry that predates them parses\n  // unchanged (both optional), and `endpoint` still shadows the on-disk\n  // `vendor` alias below.\n  disabled: z.boolean().optional(),\n  models: modelCurationSchema.optional(),\n  costBudget: costBudgetSchema.optional(),\n  origin: z.string().optional(),\n}).transform(({ vendor, ...profile }): AuthProfile => ({ ...profile, endpoint: vendor }))\n\nconst authProfilesFileSchema = z.object({\n  version: z.literal(1),\n  profiles: z.record(z.string(), authProfileSchema),\n})\n\nexport type AuthProfilesFile = z.infer<typeof authProfilesFileSchema>\n\n/** Fresh empty file each call — never share the `profiles` object, or a\n *  later mutation leaks into every other load in-process (same defense\n *  `providers-store`'s `emptyFile()` establishes). */\nfunction emptyFile(): AuthProfilesFile {\n  return { version: 1, profiles: {} }\n}\n\nexport function authProfilesPath(): string {\n  return resolve(homedir(), \".agentproto\", \"auth-profiles.json\")\n}\n\nexport async function loadAuthProfiles(): Promise<AuthProfilesFile> {\n  try {\n    const raw = await readFile(authProfilesPath(), \"utf8\")\n    return authProfilesFileSchema.parse(JSON.parse(raw))\n  } catch {\n    return emptyFile() // ENOENT / malformed → empty\n  }\n}\n\nasync function writeAuthProfiles(file: AuthProfilesFile): Promise<void> {\n  const dir = join(homedir(), \".agentproto\")\n  await mkdir(dir, { recursive: true })\n  // mode 0600 so other local users can't read the profile metadata.\n  const diskFile = {\n    version: file.version,\n    profiles: Object.fromEntries(\n      Object.entries(file.profiles).map(([id, { endpoint, ...profile }]) => [\n        id,\n        { ...profile, vendor: endpoint },\n      ]),\n    ),\n  }\n  await writeFile(authProfilesPath(), JSON.stringify(diskFile, null, 2) + \"\\n\", {\n    encoding: \"utf8\",\n    mode: 0o600,\n  })\n}\n\n/** List all profiles, optionally filtered to one billing endpoint. */\nexport async function listAuthProfiles(endpoint?: string): Promise<AuthProfile[]> {\n  const file = await loadAuthProfiles()\n  const all = Object.values(file.profiles)\n  return endpoint === undefined ? all : all.filter(p => p.endpoint === endpoint)\n}\n\n/** Look up a single profile by id, or undefined if none exists. */\nexport async function getAuthProfile(id: string): Promise<AuthProfile | undefined> {\n  const file = await loadAuthProfiles()\n  return file.profiles[id]\n}\n\n/** Add (or replace) a profile, keyed by its `id`. */\nexport async function addAuthProfile(profile: AuthProfile): Promise<void> {\n  const file = await loadAuthProfiles()\n  file.profiles[profile.id] = profile\n  await writeAuthProfiles(file)\n}\n\n/** Remove a profile by id. Returns true if it existed. */\nexport async function removeAuthProfile(id: string): Promise<boolean> {\n  const file = await loadAuthProfiles()\n  if (!(id in file.profiles)) return false\n  delete file.profiles[id]\n  await writeAuthProfiles(file)\n  return true\n}\n","/**\n * Auth-profile provisioning — the create/delete flow the store CRUD\n * (`profile-store.ts`) deliberately leaves out.\n *\n * `profile-store.ts` writes only profile *metadata* (`credentialRef`, a\n * pointer). Provisioning is the two-sided operation nobody else owned: write\n * the *secret* to the credential store at a derived slot, THEN record the\n * metadata pointing at it — and, on delete, tear both down together. This is\n * the single place that knows the `agentproto.auth.<vendor>[.<qualifier>]`\n * keychain-slot convention (matching the entries seeded by hand in\n * `~/.agentproto/auth-profiles.json`).\n *\n * The secret is INPUT-only. It is written to the `CredentialStore` and never\n * echoed back: `createAuthProfile` returns non-secret metadata plus a\n * one-way `fingerprint` (same \"fingerprint, don't echo\" discipline as\n * `broker.ts` / `KeychainStore`), so a caller can confirm *which* credential\n * landed without ever seeing it.\n *\n * Dependency-injected (`ProfileProvisionDeps`) so it's unit-testable against\n * a `MemoryStore` + an in-memory profile map, with no keychain or filesystem.\n */\n\nimport { createHash } from \"node:crypto\"\nimport type { AuthMethod, AuthProfile, ModelCuration } from \"./profile-types.js\"\nimport type { CredentialStore } from \"./store/types.js\"\n\n/** Input to {@link createAuthProfile}. `credential` is the raw secret — it is\n *  written to the store and NEVER returned. Exactly one of `credential` /\n *  `source` must be given for an `oauth-bearer` profile; `api-key` always\n *  requires `credential` (a source-backed profile only makes sense for a\n *  self-refreshing subscription bearer). */\nexport interface CreateAuthProfileInput {\n  /** Stable id, unique across all profiles. */\n  id: string\n  /** Billing endpoint / vendor this credential authenticates against\n   *  (`anthropic`, `openrouter`, `moonshot`, …). */\n  endpoint: string\n  /** How this profile authenticates. */\n  method: AuthMethod\n  /** The raw secret (a subscription OAuth bearer, an API key). INPUT-ONLY.\n   *  Mutually exclusive with `source`. */\n  credential?: string\n  /** Self-refreshing credential source (`oauth-bearer` only, e.g.\n   *  `\"claude-code-oauth\"`) — the profile stores no secret; the credential is\n   *  resolved fresh at spawn time instead. Mutually exclusive with\n   *  `credential`. */\n  source?: string\n  /** Optional human-readable name. */\n  label?: string\n  /** Optional explicit credential-store slot. Omitted ⇒ derived from\n   *  `endpoint` + `method` (see {@link deriveCredentialRef}). Ignored for a\n   *  source-backed profile (nothing is written to the credential store). */\n  credentialRef?: string\n  /** Optional provenance — where the credential was imported from (a WS6\n   *  discovery origin). Stamped verbatim on the created profile; purely\n   *  informational. */\n  origin?: string\n}\n\n/** The non-secret result of a create — safe to log, return over the wire, or\n *  render in a UI. Carries a fingerprint, never the credential. */\nexport interface CreatedAuthProfile {\n  id: string\n  endpoint: string\n  method: AuthMethod\n  /** Set for a credential-backed profile; absent for a source-backed one. */\n  credentialRef?: string\n  /** Set for a source-backed profile; absent for a credential-backed one. */\n  source?: string\n  label?: string\n  /** Provenance stamped at import time, when given. */\n  origin?: string\n  /** One-way fingerprint of the stored credential (sha256, truncated) — lets\n   *  a caller confirm *which* secret was stored without exposing it. Absent\n   *  for a source-backed profile — there is no stored secret to fingerprint. */\n  fingerprint?: string\n}\n\n/** The result of a delete. `deleted` is false when no profile had that id\n *  (idempotent — the desired end state already held). */\nexport interface DeletedAuthProfile {\n  deleted: boolean\n  id: string\n  /** The slot the credential lived at, when a profile was actually removed. */\n  credentialRef?: string\n}\n\n/** Injectable persistence surface — production wires these to\n *  `profile-store.ts` + a `KeychainStore`; tests pass in-memory doubles. */\nexport interface ProfileProvisionDeps {\n  /** Where secrets live (a `KeychainStore` in production). */\n  store: CredentialStore\n  getProfile: (id: string) => Promise<AuthProfile | undefined>\n  listProfiles: () => Promise<AuthProfile[]>\n  addProfile: (profile: AuthProfile) => Promise<void>\n  removeProfile: (id: string) => Promise<boolean>\n}\n\n/** Raised when create/delete input fails validation. Distinct type so a host\n *  (HTTP route, MCP tool) can map it to a 400 rather than a 500. */\nexport class AuthProfileValidationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = \"AuthProfileValidationError\"\n  }\n}\n\nconst AUTH_METHODS: readonly AuthMethod[] = [\"oauth-bearer\", \"api-key\"]\n\n/** ids and endpoints become keychain-slot / filename fragments, so keep them\n *  to a conservative, injection-safe charset. */\nconst SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/\n\n/** Normalized, validated create input — every field trimmed and checked.\n *  Exactly one of `credential` / `source` is present. */\nexport interface ValidatedCreateInput {\n  id: string\n  endpoint: string\n  method: AuthMethod\n  credential?: string\n  source?: string\n  label?: string\n  credentialRef?: string\n  origin?: string\n}\n\n/**\n * Validate + normalize raw create input. Pure — no I/O. Throws\n * {@link AuthProfileValidationError} with a specific message on the first\n * problem it finds, so the surface layer can surface a clear 400.\n */\nexport function validateCreateInput(input: CreateAuthProfileInput): ValidatedCreateInput {\n  const id = (input.id ?? \"\").trim()\n  if (!id) throw new AuthProfileValidationError(\"id is required\")\n  if (!SLUG_RE.test(id)) {\n    throw new AuthProfileValidationError(\n      `id \"${id}\" is invalid — use letters, digits, \".\", \"_\" or \"-\", ` +\n        `starting with a letter or digit`,\n    )\n  }\n\n  const endpoint = (input.endpoint ?? \"\").trim()\n  if (!endpoint) throw new AuthProfileValidationError(\"endpoint is required\")\n  if (!SLUG_RE.test(endpoint)) {\n    throw new AuthProfileValidationError(\n      `endpoint \"${endpoint}\" is invalid — use letters, digits, \".\", \"_\" or \"-\"`,\n    )\n  }\n\n  const method = input.method\n  if (!AUTH_METHODS.includes(method)) {\n    throw new AuthProfileValidationError(\n      `method must be one of ${AUTH_METHODS.join(\" | \")} (got \"${String(method)}\")`,\n    )\n  }\n\n  // Trim surrounding whitespace only — a pasted token can carry a stray\n  // trailing newline, but must not be blank once trimmed.\n  const credential = input.credential !== undefined ? input.credential.trim() : undefined\n  const source = input.source?.trim()\n\n  if (method === \"api-key\") {\n    if (source) {\n      throw new AuthProfileValidationError(\n        \"source is only supported for oauth-bearer profiles — api-key profiles require a credential\",\n      )\n    }\n    if (!credential) throw new AuthProfileValidationError(\"credential is required\")\n  } else {\n    if (credential && source) {\n      throw new AuthProfileValidationError(\n        \"give either credential or source, not both — a source-backed profile stores no secret\",\n      )\n    }\n    if (!credential && !source) {\n      throw new AuthProfileValidationError(\"credential or source is required\")\n    }\n  }\n\n  const label = input.label?.trim()\n  const credentialRef = input.credentialRef?.trim()\n  if (credentialRef !== undefined && credentialRef !== \"\" && !SLUG_RE.test(credentialRef)) {\n    throw new AuthProfileValidationError(\n      `credentialRef \"${credentialRef}\" is invalid — use letters, digits, \".\", \"_\" or \"-\"`,\n    )\n  }\n\n  const origin = input.origin?.trim()\n\n  return {\n    id,\n    endpoint,\n    method,\n    ...(credential ? { credential } : {}),\n    ...(source ? { source } : {}),\n    ...(label ? { label } : {}),\n    ...(credentialRef ? { credentialRef } : {}),\n    ...(origin ? { origin } : {}),\n  }\n}\n\n/**\n * Derive the credential-store slot for a profile. Matches the convention of\n * the hand-seeded entries: `agentproto.auth.<endpoint>` for an api-key,\n * `agentproto.auth.<endpoint>.sub` for a subscription (oauth-bearer), plus an\n * optional `<qualifier>` to disambiguate a second profile on the same\n * endpoint+method. Pure.\n */\nexport function deriveCredentialRef(input: {\n  endpoint: string\n  method: AuthMethod\n  qualifier?: string\n}): string {\n  const parts = [\"agentproto\", \"auth\", input.endpoint]\n  if (input.method === \"oauth-bearer\") parts.push(\"sub\")\n  if (input.qualifier) parts.push(input.qualifier)\n  return parts.join(\".\")\n}\n\n/** One-way fingerprint of a secret — sha256, first 12 hex chars. Enough to\n *  distinguish credentials by eye; not reversible. */\nexport function fingerprintCredential(secret: string): string {\n  return createHash(\"sha256\").update(secret, \"utf8\").digest(\"hex\").slice(0, 12)\n}\n\n/** Below this length, `slice(-4)` would expose too large a fraction of the\n *  secret to be a safe \"last 4\" — so `last4` is withheld (never the secret).\n *  Real API keys / bearer tokens are far longer; this only guards a degenerate\n *  short value. */\nconst MIN_LEN_FOR_LAST4 = 8\n\n/** Non-secret identity of a STORED credential — a one-way {@link\n *  fingerprintCredential} plus the trailing 4 characters (the standard\n *  \"which key is this\" affordance, like a card's last four). Neither is\n *  reversible to the secret. `last4` is omitted for a secret too short to\n *  reveal a tail safely (see {@link MIN_LEN_FOR_LAST4}) — fail closed rather\n *  than expose. */\nexport interface CredentialIdentity {\n  fingerprint: string\n  last4?: string\n}\n\n/** Compute the non-secret {@link CredentialIdentity} of a stored secret.\n *  Money-safety: returns ONLY the one-way fingerprint + a trailing tail —\n *  never the secret, and never the tail when the secret is too short to\n *  reveal one safely. */\nexport function credentialIdentity(secret: string): CredentialIdentity {\n  return {\n    fingerprint: fingerprintCredential(secret),\n    ...(secret.length >= MIN_LEN_FOR_LAST4 ? { last4: secret.slice(-4) } : {}),\n  }\n}\n\n/** The `StoredCredential.kind` a method maps to (mirrors `profile-types.ts`:\n *  `pat` → `api-key`, `oat` → `oauth-bearer`). */\nfunction credentialKind(method: AuthMethod): \"pat\" | \"oat\" {\n  return method === \"oauth-bearer\" ? \"oat\" : \"pat\"\n}\n\n/**\n * Create a profile end-to-end: validate, derive the credential slot (avoiding\n * collision with an existing profile's slot), write the secret to the store,\n * then record the metadata. Rejects a duplicate id rather than silently\n * overwriting. Returns non-secret metadata + a fingerprint; the credential is\n * never echoed back.\n */\nexport async function createAuthProfile(\n  input: CreateAuthProfileInput,\n  deps: ProfileProvisionDeps,\n): Promise<CreatedAuthProfile> {\n  const v = validateCreateInput(input)\n\n  if (await deps.getProfile(v.id)) {\n    throw new AuthProfileValidationError(\n      `a profile with id \"${v.id}\" already exists — delete it first or pick another id`,\n    )\n  }\n\n  // Source-backed: no secret, nothing written to the credential store.\n  if (v.source !== undefined) {\n    const profile: AuthProfile = {\n      id: v.id,\n      endpoint: v.endpoint,\n      method: v.method,\n      source: v.source,\n      ...(v.label ? { label: v.label } : {}),\n      ...(v.origin ? { origin: v.origin } : {}),\n    }\n    await deps.addProfile(profile)\n    return {\n      id: profile.id,\n      endpoint: profile.endpoint,\n      method: profile.method,\n      source: v.source,\n      ...(profile.label ? { label: profile.label } : {}),\n      ...(profile.origin ? { origin: profile.origin } : {}),\n    }\n  }\n\n  const credential = v.credential!\n\n  const existing = await deps.listProfiles()\n  const takenRefs = new Set(existing.map(p => p.credentialRef))\n\n  let credentialRef = v.credentialRef ?? deriveCredentialRef(v)\n  // If the derived slot already holds another profile's secret, qualify it\n  // with the id so two profiles on the same endpoint+method don't clobber\n  // each other's keychain entry.\n  if (!v.credentialRef && takenRefs.has(credentialRef)) {\n    credentialRef = deriveCredentialRef({ ...v, qualifier: v.id })\n  }\n\n  await deps.store.write(\n    { path: credentialRef },\n    { value: credential, kind: credentialKind(v.method) },\n  )\n\n  const profile: AuthProfile = {\n    id: v.id,\n    endpoint: v.endpoint,\n    method: v.method,\n    credentialRef,\n    ...(v.label ? { label: v.label } : {}),\n    ...(v.origin ? { origin: v.origin } : {}),\n  }\n  await deps.addProfile(profile)\n\n  return {\n    id: profile.id,\n    endpoint: profile.endpoint,\n    method: profile.method,\n    credentialRef,\n    ...(profile.label ? { label: profile.label } : {}),\n    ...(profile.origin ? { origin: profile.origin } : {}),\n    fingerprint: fingerprintCredential(credential),\n  }\n}\n\n/**\n * Delete a profile and its credential. Idempotent: a missing id returns\n * `{ deleted: false }` rather than throwing. The keychain entry is removed\n * only when no OTHER profile still references the same slot — two profiles\n * can legitimately share a `credentialRef`, and dropping one must not strand\n * the other.\n */\nexport async function deleteAuthProfile(\n  id: string,\n  deps: ProfileProvisionDeps,\n): Promise<DeletedAuthProfile> {\n  const trimmed = (id ?? \"\").trim()\n  if (!trimmed) throw new AuthProfileValidationError(\"id is required\")\n\n  const profile = await deps.getProfile(trimmed)\n  if (!profile) return { deleted: false, id: trimmed }\n\n  await deps.removeProfile(trimmed)\n\n  // Source-backed profiles store no secret — nothing to tear down.\n  if (profile.credentialRef === undefined) {\n    return { deleted: true, id: trimmed }\n  }\n\n  const stillReferenced = (await deps.listProfiles()).some(\n    p => p.credentialRef === profile.credentialRef,\n  )\n  if (!stillReferenced && deps.store.delete) {\n    await deps.store.delete({ path: profile.credentialRef })\n  }\n\n  return { deleted: true, id: trimmed, credentialRef: profile.credentialRef }\n}\n\n/**\n * Enable or disable a whole profile (WS2). Metadata-only — never touches the\n * credential store. Enabling CLEARS the `disabled` field entirely rather than\n * writing `disabled: false`, so a re-enabled profile is byte-identical on\n * disk to one that was never disabled (the ABSENT-means-enabled invariant).\n * Throws {@link AuthProfileValidationError} for an unknown id so a host can map\n * it to a 404/400. Returns the updated (non-secret) profile.\n */\nexport async function setAuthProfileEnabled(\n  id: string,\n  enabled: boolean,\n  deps: ProfileProvisionDeps,\n): Promise<AuthProfile> {\n  const trimmed = (id ?? \"\").trim()\n  if (!trimmed) throw new AuthProfileValidationError(\"id is required\")\n\n  const profile = await deps.getProfile(trimmed)\n  if (!profile) {\n    throw new AuthProfileValidationError(`no profile with id \"${trimmed}\"`)\n  }\n\n  // Rebuild WITHOUT `disabled`, then re-add it only when disabling — keeps the\n  // enabled state absent-by-default.\n  const { disabled: _drop, ...rest } = profile\n  const updated: AuthProfile = enabled ? { ...rest } : { ...rest, disabled: true }\n  await deps.addProfile(updated)\n  return updated\n}\n\n/**\n * Set a profile's per-model curation allowlist (WS3). Metadata-only. `mode:\n * \"all\"` CLEARS the `models` field entirely (curation off ⇒ absent, the\n * byte-identical \"services everything\" default), so only a genuine `mode:\n * \"allow\"` persists a `models` object. `ids` are trimmed, de-duped, and\n * blanks dropped. Throws {@link AuthProfileValidationError} for an unknown id.\n * Returns the updated (non-secret) profile.\n */\nexport async function setAuthProfileModels(\n  id: string,\n  curation: ModelCuration,\n  deps: ProfileProvisionDeps,\n): Promise<AuthProfile> {\n  const trimmed = (id ?? \"\").trim()\n  if (!trimmed) throw new AuthProfileValidationError(\"id is required\")\n  if (curation.mode !== \"all\" && curation.mode !== \"allow\") {\n    throw new AuthProfileValidationError(\n      `models.mode must be \"all\" or \"allow\" (got \"${String(curation.mode)}\")`,\n    )\n  }\n\n  const profile = await deps.getProfile(trimmed)\n  if (!profile) {\n    throw new AuthProfileValidationError(`no profile with id \"${trimmed}\"`)\n  }\n\n  const { models: _drop, ...rest } = profile\n  if (curation.mode === \"all\") {\n    // \"all\" == absent — drop the field so the on-disk shape stays byte-\n    // identical to a never-curated profile.\n    const updated: AuthProfile = { ...rest }\n    await deps.addProfile(updated)\n    return updated\n  }\n\n  const ids = [...new Set((curation.ids ?? []).map(s => s.trim()).filter(Boolean))]\n  const updated: AuthProfile = { ...rest, models: { mode: \"allow\", ids } }\n  await deps.addProfile(updated)\n  return updated\n}\n\n/** The result of {@link refreshAuthProfileModels} — the updated profile plus\n *  the diff against the previous allowlist, so a caller (CLI, MCP tool) can\n *  report exactly what changed without re-diffing itself. */\nexport interface RefreshAuthProfileModelsResult {\n  profile: AuthProfile\n  /** Ids newly present in the refreshed allowlist that weren't in the old one. */\n  added: string[]\n  /** Ids that were in the old allowlist but have dropped out of the current\n   *  catalog snapshot (e.g. a retired model). */\n  removed: string[]\n}\n\n/**\n * Re-sync a `mode: \"allow\"` profile's `ids` against a CURRENT catalog\n * snapshot for its endpoint (WS3 follow-up — fixes curation drift). A\n * profile's allowlist is otherwise a frozen snapshot taken once at\n * create/import time: the catalog moves (new models ship, old ones retire)\n * but `ids` never does, so a profile silently stops seeing new models and\n * keeps offering retired ones. This re-runs the SAME enumeration a caller\n * would have used to build the list in the first place — \"every model\n * currently known for this profile's endpoint\" — against `currentIds`, so\n * `ids` tracks the live catalog instead of the day it was written.\n *\n * `currentIds` is caller-supplied (typically every id `getModelsByProvider`\n * /`buildCatalogProviderModels` reports for `profile.endpoint`) rather than\n * looked up here, keeping this package decoupled from `@agentproto/model-catalog`\n * (see {@link AuthProfile.endpoint}'s doc) and the diffing logic unit-testable\n * against a fake snapshot with no catalog wiring at all.\n *\n * Deliberately EXPLICIT and OPT-IN — a caller (CLI verb, MCP tool) invokes\n * this on one named profile; nothing calls it automatically. A profile a\n * human deliberately narrowed is therefore never touched unless that human\n * (or an operator with the same intent) explicitly asks this profile to be\n * refreshed.\n *\n * Throws {@link AuthProfileValidationError} for an unknown id, and — by\n * design — for a profile with no `mode: \"allow\"` curation to refresh: an\n * absent `models` field (or `mode: \"all\"`) already tracks the live catalog\n * on every read (see `profileAllowsModel` in `catalog-models.ts`), so\n * \"refreshing\" it would be a silent no-op that could mask the caller asking\n * for the wrong profile. Rejecting loudly instead surfaces that mismatch.\n */\nexport async function refreshAuthProfileModels(\n  id: string,\n  currentIds: readonly string[],\n  deps: ProfileProvisionDeps,\n): Promise<RefreshAuthProfileModelsResult> {\n  const trimmed = (id ?? \"\").trim()\n  if (!trimmed) throw new AuthProfileValidationError(\"id is required\")\n\n  const profile = await deps.getProfile(trimmed)\n  if (!profile) {\n    throw new AuthProfileValidationError(`no profile with id \"${trimmed}\"`)\n  }\n  if (!profile.models || profile.models.mode !== \"allow\") {\n    throw new AuthProfileValidationError(\n      `profile \"${trimmed}\" has no mode:\"allow\" curation to refresh — ` +\n        `mode:\"all\" (or absent models) already tracks the live catalog on every read`,\n    )\n  }\n\n  const nextIds = [...new Set(currentIds.map(s => s.trim()).filter(Boolean))]\n  const prevIds = profile.models.ids\n  const prevSet = new Set(prevIds)\n  const nextSet = new Set(nextIds)\n  const added = nextIds.filter(i => !prevSet.has(i))\n  const removed = prevIds.filter(i => !nextSet.has(i))\n\n  const updated: AuthProfile = { ...profile, models: { mode: \"allow\", ids: nextIds } }\n  await deps.addProfile(updated)\n  return { profile: updated, added, removed }\n}\n","/**\n * (adapter × route) → billing-endpoint resolution + the profile eligibility predicate\n * (SPEC §1c, `agentproto-session-config-axes/SPEC.md:102-125`).\n *\n *   profile eligible for (adapter, route) iff\n *        profile.endpoint == resolveEndpoint(adapter, route).endpoint\n *    AND profile.method  ∈ methodsPresentable(adapter, route)\n *\n * `route` is the endpoint selector (SPEC axis #4 — direct vs a gateway mode\n * like `moonshot`/`openrouter`), so access is deliberately downstream of it:\n * which endpoint (and thus which profiles) are eligible changes when route\n * changes. `AdapterAuthManifest` is a narrow, package-local projection of\n * exactly what this predicate needs from an adapter's real AIP-45 manifest\n * (`packages/driver/agent-cli/src/types.ts`'s `AgentCliDefinition`) — this\n * package intentionally does not depend on `@agentproto/driver-agent-cli`\n * (wrong dependency direction; drivers consume auth, not vice versa), so the\n * runtime is the one that will later project a real manifest into this\n * shape (out of scope here — foundation only, no live spawn-path wiring).\n *\n * `methodsByRoute` is the static per-endpoint method table ADR'd in SPEC §3.4:\n * \"which auth methods this adapter can present for a resolved route.\" It is\n * the derivable replacement for two hand-maintained artifacts SPEC §1c calls\n * out for eventual removal — the per-adapter `authSubscription` boolean\n * (`adapters/claude-code/src/index.ts:90-95`) and curatorial vendor deny\n * lists (`adapters/hermes/HERMES.md:40-42`) — neither of which this PR\n * touches; `authSubscription` stays exactly as-is (see the comment on it in\n * `spawn-defaults.ts:345` — this module is additive, not a replacement).\n *\n * ACP `authenticate` is NOT a live discovery source for this table (the\n * server handler is a stub, `packages/acp/src/server/index.ts:69`) — method\n * discovery is this static table, not runtime negotiation (SPEC §3.7).\n */\n\nimport type { AuthMethod, AuthProfile } from \"./profile-types.js\"\n\n/** A narrow, package-local projection of an adapter's declared auth\n *  capability — enough to resolve (adapter, route) → endpoint and the auth\n *  methods presentable on that route. Not the real AIP-45 manifest type. */\nexport interface AdapterAuthManifest {\n  /** Adapter id (e.g. \"claude-code\", \"hermes\"), for error messages only. */\n  id: string\n  /** route id (e.g. \"direct\", or a gateway mode id like \"moonshot\") →\n   *  the billing endpoint used when spawned on that route. */\n  endpointByRoute: Readonly<Record<string, string>>\n  /** route id → the auth methods this adapter can present when spawned on\n   *  that route — the method-side of the eligibility predicate. */\n  methodsByRoute: Readonly<Record<string, readonly AuthMethod[]>>\n}\n\n/** Resolve which billing endpoint a given (adapter, route) pair uses. Throws\n *  when the manifest declares no endpoint for `route` — an unresolvable route\n *  is a caller bug (a bad/unknown route id), not a \"no profiles eligible\"\n *  case, so this fails loud rather than returning an empty endpoint. */\nexport function resolveEndpoint(\n  manifest: AdapterAuthManifest,\n  route: string,\n): { endpoint: string } {\n  const endpoint = manifest.endpointByRoute[route]\n  if (endpoint === undefined) {\n    throw new Error(\n      `resolveEndpoint: adapter \"${manifest.id}\" declares no endpoint for route \"${route}\"`,\n    )\n  }\n  return { endpoint }\n}\n\n/** Which auth methods `manifest`'s adapter can present on `route`. Empty\n *  (never throws) when the route is declared for vendor resolution but has\n *  no methods table entry — that's \"no eligible profiles\", a legitimate\n *  eligibility outcome, not an error. */\nexport function methodsPresentable(\n  manifest: AdapterAuthManifest,\n  route: string,\n): AuthMethod[] {\n  return [...(manifest.methodsByRoute[route] ?? [])]\n}\n\n/** The eligibility predicate: profiles whose endpoint matches the route's\n *  resolved endpoint AND whose method the adapter can present on that route.\n *  A whole-profile-disabled profile (`disabled: true`) is skipped outright —\n *  every model it would otherwise service drops to non-runnable (WS2). This is\n *  the profile-level gate; per-model curation (`models`) is intersected\n *  downstream in the catalog join, not here (SPEC §1c / catalog-models.ts). */\nexport function eligibleProfiles(\n  profiles: readonly AuthProfile[],\n  manifest: AdapterAuthManifest,\n  route: string,\n): AuthProfile[] {\n  const { endpoint } = resolveEndpoint(manifest, route)\n  const methods = methodsPresentable(manifest, route)\n  return profiles.filter(\n    p => !p.disabled && p.endpoint === endpoint && methods.includes(p.method),\n  )\n}\n","/**\n * @agentproto/auth — AIP-50 AUTH.md reference implementation.\n *\n * Public API:\n *   defineAuthProvider(def)           — TS-literal authoring (frozen handle)\n *   parseAuthProviderManifest(source) — .md authoring (gray-matter + Zod)\n *   registerAuthProvider(handle)      — extend the module-level registry\n *   getAuthProvider(id)               — lookup by vendor id\n *   listAuthProviderIds()             — enumerate known providers\n *   discoverEndpoints(apiBase)        — two-hop PRM → AS metadata discovery\n *   runAuthFlow(provider, opts)       — resolve + discover + dispatch to engine\n *   FLOW_ENGINES                      — registered flow engines (pat, …)\n *   CeremonyRequiredError             — thrown by device-code's refreshOnly\n *                                        mode when only an interactive\n *                                        ceremony would satisfy the request\n *   writeKeychainToken(svc, acct, t)  — persist a credential to Keychain\n *   readKeychainToken(svc, acct)      — read a credential from Keychain\n *   resolveAccount(acct, server)      — expand {server} template\n *   KeychainStore / MemoryStore / FileStore — built-in CredentialStore backends\n *   resolveStoreRef(spec, server)     — map a TokenStoreSpec to a StoreRef\n *   CredentialBroker                  — path → ready-to-use auth headers\n *   AuthProfile / AuthMethod          — named, endpoint-scoped credential ref\n *   listAuthProfiles/getAuthProfile/\n *   addAuthProfile/removeAuthProfile  — named-profile store CRUD\n *   resolveEndpoint/methodsPresentable/\n *   eligibleProfiles                  — (adapter × route) → endpoint + the\n *                                        profile eligibility predicate\n *   refreshAuthProfileModels(id, ids) — re-sync a mode:\"allow\" profile's\n *                                        `ids` against a current catalog\n *                                        snapshot (fixes curation drift)\n */\n\nexport { defineAuthProvider } from \"./define-auth-provider.js\"\nexport {\n  parseAuthProviderManifest,\n  parseAuthProviderManifestRaw,\n  type AuthProviderManifest,\n} from \"./manifest.js\"\nexport {\n  registerAuthProvider,\n  getAuthProvider,\n  listAuthProviders,\n  listAuthProviderIds,\n} from \"./registry.js\"\nexport {\n  discoverEndpoints,\n  DiscoveryError,\n} from \"./discover.js\"\nexport { runAuthFlow, type RunFlowOptions } from \"./run-flow.js\"\nexport { FLOW_ENGINES } from \"./flow-engines/index.js\"\nexport { CeremonyRequiredError } from \"./flow-engines/device-code.js\"\nexport {\n  readKeychainToken,\n  writeKeychainToken,\n  deleteKeychainToken,\n  resolveAccount,\n} from \"./token-store.js\"\nexport { KeychainStore } from \"./store/keychain-store.js\"\nexport { MemoryStore } from \"./store/memory-store.js\"\nexport { FileStore } from \"./store/file-store.js\"\nexport { resolveStoreRef } from \"./store/resolve-ref.js\"\nexport type {\n  CredentialStore,\n  StoreRef,\n  StoredCredential,\n} from \"./store/types.js\"\nexport { CredentialBroker, type CredentialBrokerOptions } from \"./broker.js\"\nexport type {\n  AuthMethod,\n  AuthProfile,\n  ModelCuration,\n  CostBudget,\n  CostBudgetScope,\n} from \"./profile-types.js\"\nexport {\n  authProfilesPath,\n  loadAuthProfiles,\n  listAuthProfiles,\n  getAuthProfile,\n  addAuthProfile,\n  removeAuthProfile,\n  type AuthProfilesFile,\n} from \"./profile-store.js\"\nexport {\n  createAuthProfile,\n  deleteAuthProfile,\n  setAuthProfileEnabled,\n  setAuthProfileModels,\n  refreshAuthProfileModels,\n  validateCreateInput,\n  deriveCredentialRef,\n  fingerprintCredential,\n  credentialIdentity,\n  AuthProfileValidationError,\n  type CreateAuthProfileInput,\n  type CreatedAuthProfile,\n  type DeletedAuthProfile,\n  type CredentialIdentity,\n  type ProfileProvisionDeps,\n  type ValidatedCreateInput,\n  type RefreshAuthProfileModelsResult,\n} from \"./profile-provision.js\"\nexport {\n  resolveEndpoint,\n  methodsPresentable,\n  eligibleProfiles,\n  type AdapterAuthManifest,\n} from \"./eligibility.js\"\nexport { guildeAuthProvider, BUILTIN_AUTH_PROVIDERS } from \"./builtins.js\"\nexport {\n  authProviderFrontmatterSchema,\n  authConfigSchema,\n  tokenStoreSpecSchema,\n  installConfigSchema,\n  type AuthProviderFrontmatter,\n} from \"./schema.js\"\nexport type {\n  AuthProviderDefinition,\n  AuthProviderHandle,\n  AuthConfig,\n  PATAuthConfig,\n  ServiceAuthConfig,\n  DeviceCodeAuthConfig,\n  InstallConfig,\n  TokenStoreSpec,\n  FlowEngine,\n  FlowId,\n  FlowResult,\n  FlowRunOptions,\n  DiscoveredEndpoints,\n} from \"./types.js\"\n\nexport const SPEC_NAME = \"agentauth\"\nexport const SPEC_VERSION = \"v1\"\n"]}
+{"version":3,"sources":["../src/schema.ts","../src/define-auth-provider.ts","../src/manifest.ts","../src/builtins.ts","../src/registry.ts","../src/http.ts","../src/discover.ts","../src/token-store.ts","../src/store/keychain-store.ts","../src/store/resolve-ref.ts","../src/flow-engines/pat.ts","../src/flow-engines/device-grant.ts","../src/flow-engines/service-auth.ts","../src/flow-engines/device-code.ts","../src/flow-engines/index.ts","../src/run-flow.ts","../src/store/memory-store.ts","../src/store/file-store.ts","../src/broker.ts","../src/profile-store.ts","../src/profile-provision.ts","../src/eligibility.ts","../src/index.ts"],"names":["z","resolve","promisify","execFile","DEFAULT_POLL_INTERVAL_S","keyOf","headers","readFile","mkdir","writeFile","profile","updated"],"mappings":";;;;;;;;;;;;;;;;AAUO,IAAM,oBAAA,GAAuB,EACjC,MAAA,CAAO;AAAA,EACN,QAAA,EAAU,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EAC1B,MAAM,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACjC,SAAS,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA;AAC7B,CAAC,EACA,MAAA;AAEI,IAAM,mBAAA,GAAsB,EAChC,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,KAAK,CAAA;AAAA,EACrB,UAAA,EAAY;AACd,CAAC,EACA,MAAA,EAAO;AAEH,IAAM,uBAAA,GAA0B,EACpC,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,cAAc,CAAA;AAAA,EAC9B,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACrC,WAAW,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACtC,UAAA,EAAY;AACd,CAAC,EACA,MAAA,EAAO;AAEH,IAAM,0BAAA,GAA6B,EACvC,MAAA,CAAO;AAAA,EACN,IAAA,EAAM,CAAA,CAAE,OAAA,CAAQ,aAAa,CAAA;AAAA,EAC7B,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACrC,OAAO,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EAClC,aAAa,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA,EAAS;AAAA,EACxC,UAAA,EAAY;AACd,CAAC,EACA,MAAA,EAAO;AAEH,IAAM,gBAAA,GAAmB,CAAA,CAAE,kBAAA,CAAmB,MAAA,EAAQ;AAAA,EAC3D,mBAAA;AAAA,EACA,uBAAA;AAAA,EACA;AACF,CAAC;AAEM,IAAM,mBAAA,GAAsB,EAChC,MAAA,CAAO;AAAA,EACN,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA;AAAA,EACzB,YAAA,EAAc,CAAA,CAAE,MAAA,EAAO,CAAE,IAAI,CAAC;AAChC,CAAC,EACA,MAAA;AAEI,IAAM,6BAAA,GAAgC,EAC1C,MAAA,CAAO;AAAA,EACN,EAAA,EAAI,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,EAAE,CAAA;AAAA,EAC5B,WAAA,EAAa,EAAE,MAAA,EAAO,CAAE,IAAI,CAAC,CAAA,CAAE,IAAI,GAAI,CAAA;AAAA,EACvC,OAAA,EAAS,CAAA,CAAE,MAAA,EAAO,CAAE,GAAA,EAAI;AAAA,EACxB,IAAA,EAAM,gBAAA;AAAA,EACN,OAAA,EAAS,oBAAoB,QAAA,EAAS;AAAA;AAAA,EAEtC,UAAU,CAAA,CAAE,MAAA,GAAS,GAAA,CAAI,CAAC,EAAE,QAAA;AAC9B,CAAC,CAAA,CACA,QAAO,CACP,QAAA;AAAA,EACC;AACF;;;ACzDK,IAAM,qBAAqB,aAAA,CAGhC;AAAA,EACA,GAAA,EAAK,EAAA;AAAA,EACL,IAAA,EAAM,cAAA;AAAA,EACN,SAAS,GAAA,EAAK;AACZ,IAAA,MAAM,MAAA,GAAS,6BAAA,CAA8B,SAAA,CAAU,GAAG,CAAA;AAC1D,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,6BAAA,EAAgC,OAAO,KAAA,CAAM,MAAA,CAC1C,IAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,KAAK,CAAA,CAAE,OAAO,EAAE,CAAA,CAC9C,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OACf;AAAA,IACF;AAAA,EACF,CAAA;AAAA,EACA,MAAM,GAAA,EAAK;AACT,IAAA,OAAO;AAAA,MACL,GAAG,GAAA;AAAA,MACH,MAAM,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,GAAA,CAAI,MAAM,CAAA;AAAA,MACnC,OAAA,EAAS,GAAA,CAAI,OAAA,GAAU,MAAA,CAAO,MAAA,CAAO,EAAE,GAAG,GAAA,CAAI,OAAA,EAAS,CAAA,GAAI;AAAA,KAC7D;AAAA,EACF;AACF,CAAC;ACZM,SAAS,6BACd,MAAA,EACsB;AACtB,EAAA,MAAM,MAAA,GAAS,OAAO,MAAM,CAAA;AAC5B,EAAA,IAAI,OAAO,IAAA,CAAK,MAAA,CAAO,IAAI,CAAA,CAAE,WAAW,CAAA,EAAG;AACzC,IAAA,MAAM,IAAI,MAAM,yDAAyD,CAAA;AAAA,EAC3E;AACA,EAAA,MAAM,MAAA,GAAS,6BAAA,CAA8B,SAAA,CAAU,MAAA,CAAO,IAAI,CAAA;AAClE,EAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,sDAAA,EAAoD,OAAO,KAAA,CAAM,MAAA,CAC9D,IAAI,CAAC,CAAA,KAAM,GAAG,CAAA,CAAE,IAAA,CAAK,KAAK,GAAG,CAAC,KAAK,CAAA,CAAE,OAAO,EAAE,CAAA,CAC9C,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KACf;AAAA,EACF;AACA,EAAA,OAAO,EAAE,WAAA,EAAa,MAAA,CAAO,IAAA,EAAM,IAAA,EAAM,OAAO,OAAA,EAAQ;AAC1D;AAGO,SAAS,0BAA0B,MAAA,EAAoC;AAC5E,EAAA,MAAM,EAAE,WAAA,EAAY,GAAI,4BAAA,CAA6B,MAAM,CAAA;AAC3D,EAAA,OAAO,mBAAmB,WAAW,CAAA;AACvC;;;AC9BO,IAAM,qBAAqB,kBAAA,CAAmB;AAAA,EACnD,EAAA,EAAI,QAAA;AAAA,EACJ,WAAA,EACE,6FAAA;AAAA,EACF,OAAA,EAAS,yBAAA;AAAA,EACT,QAAA,EAAU,KAAA;AAAA,EACV,IAAA,EAAM;AAAA,IACJ,IAAA,EAAM,cAAA;AAAA,IACN,QAAA,EAAU,gBAAA;AAAA,IACV,UAAA,EAAY;AAAA,MACV,QAAA,EAAU,eAAA;AAAA,MACV,OAAA,EAAS;AAAA;AACX,GACF;AAAA,EACA,OAAA,EAAS;AAAA,IACP,OAAA,EAAS,oCAAA;AAAA,IACT,YAAA,EAAc;AAAA;AAElB,CAAC;AAEM,IAAM,sBAAA,GAAwD;AAAA,EACnE;AACF;;;AC5BA,IAAM,SAAA,uBAAgB,GAAA,EAAgC;AACtD,KAAA,MAAW,KAAK,sBAAA,EAAwB,SAAA,CAAU,GAAA,CAAI,CAAA,CAAE,IAAI,CAAC,CAAA;AAEtD,SAAS,qBAAqB,QAAA,EAAoC;AACvE,EAAA,SAAA,CAAU,GAAA,CAAI,QAAA,CAAS,EAAA,EAAI,QAAQ,CAAA;AACrC;AAEO,SAAS,gBAAgB,EAAA,EAA4C;AAC1E,EAAA,OAAO,SAAA,CAAU,IAAI,EAAE,CAAA;AACzB;AAEO,SAAS,iBAAA,GAA0C;AACxD,EAAA,OAAO,CAAC,GAAG,SAAA,CAAU,MAAA,EAAQ,CAAA;AAC/B;AAEO,SAAS,mBAAA,GAAgC;AAC9C,EAAA,OAAO,CAAC,GAAG,SAAA,CAAU,IAAA,EAAM,CAAA;AAC7B;;;ACZO,IAAM,uBAAA,GAA0B,GAAA;AAQhC,SAAS,gBAAgB,GAAA,EAAmB;AACjD,EAAA,IAAI,CAAA;AACJ,EAAA,IAAI;AACF,IAAA,CAAA,GAAI,IAAI,IAAI,GAAG,CAAA;AAAA,EACjB,CAAA,CAAA,MAAQ;AACN,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,aAAA,EAAgB,GAAG,CAAA,CAAE,CAAA;AAAA,EACvC;AACA,EAAA,IAAI,CAAA,CAAE,aAAa,QAAA,EAAU;AAC7B,EAAA,MAAM,OAAO,CAAA,CAAE,QAAA;AACf,EAAA,MAAM,UAAA,GACJ,IAAA,KAAS,WAAA,IACT,IAAA,KAAS,WAAA,IACT,IAAA,KAAS,KAAA,IACT,IAAA,KAAS,OAAA,IACT,IAAA,CAAK,QAAA,CAAS,YAAY,CAAA;AAC5B,EAAA,IAAI,CAAA,CAAE,QAAA,KAAa,OAAA,IAAW,UAAA,EAAY;AAC1C,EAAA,MAAM,IAAI,KAAA;AAAA,IACR,iBAAiB,GAAG,CAAA,mGAAA;AAAA,GAEtB;AACF;AAcO,SAAS,cAAA,CACd,WACA,KAAA,EACgB;AAChB,EAAA,MAAM,IAAA,GAAO,IAAI,eAAA,EAAgB;AACjC,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,KAAA,CAAM,OAAO,MAAM,CAAA;AAE9C,EAAA,IAAI,KAAA,EAAO;AACT,IAAA,IAAI,KAAA,CAAM,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,MAAM,MAAM,CAAA;AAAA,eAC/B,gBAAA,CAAiB,OAAA,EAAS,SAAS,EAAE,IAAA,EAAM,MAAM,CAAA;AAAA,EAC9D;AAEA,EAAA,MAAM,KAAA,GAAQ,UAAA;AAAA,IACZ,MAAM,KAAK,KAAA,CAAM,IAAI,MAAM,CAAA,wBAAA,EAA2B,SAAS,IAAI,CAAC,CAAA;AAAA,IACpE;AAAA,GACF;AAEA,EAAA,IAAI,OAAO,KAAA,KAAU,QAAA,EAAU,KAAA,CAAM,KAAA,EAAM;AAE3C,EAAA,OAAO;AAAA,IACL,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,OAAO,MAAM;AACX,MAAA,YAAA,CAAa,KAAK,CAAA;AAClB,MAAA,KAAA,EAAO,mBAAA,CAAoB,SAAS,OAAO,CAAA;AAAA,IAC7C;AAAA,GACF;AACF;AAIA,eAAsB,kBACpB,GAAA,EACA,IAAA,GAAoB,EAAC,EACrB,YAAoB,uBAAA,EACD;AACnB,EAAA,MAAM,EAAE,QAAQ,KAAA,EAAM,GAAI,eAAe,SAAA,EAAW,IAAA,CAAK,UAAU,MAAS,CAAA;AAC5E,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,KAAA,CAAM,GAAA,EAAK,EAAE,GAAG,IAAA,EAAM,QAAQ,CAAA;AAAA,EAC7C,CAAA,SAAE;AACA,IAAA,KAAA,EAAM;AAAA,EACR;AACF;;;AC3EO,IAAM,cAAA,GAAN,cAA6B,KAAA,CAAM;AAAA,EAC/B,SAAA;AAAA,EACT,WAAA,CAAY,SAAiB,SAAA,EAAmB;AAC9C,IAAA,KAAA,CAAM,CAAA,gBAAA,EAAmB,SAAS,CAAA,GAAA,EAAM,OAAO,CAAA,CAAE,CAAA;AACjD,IAAA,IAAA,CAAK,IAAA,GAAO,gBAAA;AACZ,IAAA,IAAA,CAAK,SAAA,GAAY,SAAA;AAAA,EACnB;AACF;AAKA,IAAM,SAAA,GAAYA,EACf,MAAA,CAAO;AAAA,EACN,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC9B,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,uBAAuBA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACpD,kBAAkBA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EAC/C,0BAA0BA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA;AAChD,CAAC,EACA,KAAA,EAAM;AAET,IAAM,YAAA,GAAeA,EAClB,MAAA,CAAO;AAAA,EACN,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACpC,mBAAA,EAAqBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACzC,6BAAA,EAA+BA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnD,uBAAuBA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,EACpD,UAAA,EAAYA,EACT,MAAA,CAAO;AAAA,IACN,KAAA,EAAOA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IAC3B,iBAAA,EAAmBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACvC,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACpC,eAAA,EAAiBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,IACrC,0BAA0BA,CAAAA,CAAE,KAAA,CAAMA,EAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,IACvD,oBAAoBA,CAAAA,CACjB,MAAA,CAAO,EAAE,yBAAA,EAA2BA,EAAE,KAAA,CAAMA,CAAAA,CAAE,MAAA,EAAQ,EAAE,QAAA,EAAS,EAAG,CAAA,CACpE,KAAA,GACA,QAAA;AAAS,GACb,CAAA,CACA,KAAA,EAAM,CACN,QAAA;AACL,CAAC,EACA,KAAA,EAAM;AAET,IAAM,cAAA,GAAiBA,EACpB,MAAA,CAAO;AAAA,EACN,6BAAA,EAA+BA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnD,cAAA,EAAgBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACpC,mBAAA,EAAqBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAClC,CAAC,EACA,KAAA,EAAM;AAaT,eAAe,cAAA,CACb,IAAA,EACA,SAAA,EACA,IAAA,EAC8B;AAE9B,EAAA,MAAM,MAAA,GAAS,GAAG,IAAI,CAAA,qCAAA,CAAA;AACtB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,eAAA,CAAgB,MAAM,CAAA;AACtB,IAAA,MAAM,MAAM,MAAM,iBAAA,CAAkB,MAAA,EAAQ,SAAA,EAAW,KAAK,SAAS,CAAA;AACrE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,CAAA,aAAA,EAAgB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA,CAAA;AAAA,QAC5C;AAAA,OACF;AAAA,IACF;AACA,IAAA,GAAA,GAAM,SAAA,CAAU,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,EACxC,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,gBAAgB,MAAM,GAAA;AACzC,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,kBAAA,EAAqB,GAAG,IAAI,IAAI,CAAA;AAAA,EAC3D;AAEA,EAAA,MAAM,iBAAiB,GAAA,CAAI,qBAAA,GAAwB,CAAC,CAAA,EAAG,OAAA,CAAQ,OAAO,EAAE,CAAA;AACxE,EAAA,IAAI,CAAC,cAAA,EAAgB;AACnB,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,sCAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAGA,EAAA,MAAM,KAAA,GAAQ,GAAG,cAAc,CAAA,uCAAA,CAAA;AAC/B,EAAA,IAAI,EAAA;AACJ,EAAA,IAAI;AACF,IAAA,eAAA,CAAgB,KAAK,CAAA;AACrB,IAAA,MAAM,MAAM,MAAM,iBAAA,CAAkB,KAAA,EAAO,SAAA,EAAW,KAAK,SAAS,CAAA;AACpE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,CAAA,qBAAA,EAAwB,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA,CAAA;AAAA,QACpD;AAAA,OACF;AAAA,IACF;AACA,IAAA,EAAA,GAAK,YAAA,CAAa,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,EAC1C,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,gBAAgB,MAAM,GAAA;AACzC,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,0BAAA,EAA6B,GAAG,IAAI,IAAI,CAAA;AAAA,EACnE;AAEA,EAAA,MAAM,gBAAgB,EAAA,CAAG,cAAA;AACzB,EAAA,MAAM,gBAAA,GAAmB,GAAG,UAAA,EAAY,iBAAA;AACxC,EAAA,IAAI,CAAC,aAAA,EAAe;AAClB,IAAA,MAAM,IAAI,cAAA,CAAe,oCAAA,EAAsC,IAAI,CAAA;AAAA,EACrE;AACA,EAAA,IAAI,CAAC,gBAAA,EAAkB;AACrB,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,kDAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAI,QAAA,IAAY,IAAA;AAAA,IAC1B,cAAc,GAAA,CAAI,aAAA;AAAA,IAClB,cAAA;AAAA,IACA,aAAA;AAAA,IACA,oBAAoB,EAAA,CAAG,mBAAA;AAAA,IACvB,gBAAA;AAAA,IACA,aAAA,EAAe,GAAG,UAAA,EAAY,cAAA;AAAA,IAC9B,6BAA6B,EAAA,CAAG,6BAAA;AAAA,IAChC,sBAAA,EAAwB,EAAA,CAAG,UAAA,EAAY,wBAAA,IAA4B,EAAC;AAAA,IACpE,mBAAA,EAAqB,EAAA,CAAG,qBAAA,IAAyB;AAAC,GACpD;AACF;AAEA,eAAe,mBAAA,CACb,IAAA,EACA,SAAA,EACA,IAAA,EAC8B;AAC9B,EAAA,MAAM,GAAA,GAAM,GAAG,IAAI,CAAA,iCAAA,CAAA;AACnB,EAAA,IAAI,GAAA;AACJ,EAAA,IAAI;AACF,IAAA,eAAA,CAAgB,GAAG,CAAA;AACnB,IAAA,MAAM,MAAM,MAAM,iBAAA,CAAkB,GAAA,EAAK,SAAA,EAAW,KAAK,SAAS,CAAA;AAClE,IAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,MAAA,MAAM,IAAI,cAAA;AAAA,QACR,CAAA,8BAAA,EAAiC,GAAA,CAAI,MAAM,CAAA,CAAA,EAAI,IAAI,UAAU,CAAA,CAAA;AAAA,QAC7D;AAAA,OACF;AAAA,IACF;AACA,IAAA,GAAA,GAAM,cAAA,CAAe,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AAAA,EAC7C,SAAS,GAAA,EAAK;AACZ,IAAA,IAAI,GAAA,YAAe,gBAAgB,MAAM,GAAA;AACzC,IAAA,MAAM,IAAI,cAAA,CAAe,CAAA,mCAAA,EAAsC,GAAG,IAAI,IAAI,CAAA;AAAA,EAC5E;AAEA,EAAA,IAAI,CAAC,IAAI,cAAA,EAAgB;AACvB,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,6CAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AACA,EAAA,IAAI,CAAC,IAAI,6BAAA,EAA+B;AACtC,IAAA,MAAM,IAAI,cAAA;AAAA,MACR,4DAAA;AAAA,MACA;AAAA,KACF;AAAA,EACF;AAEA,EAAA,OAAO;AAAA,IACL,QAAA,EAAU,IAAA;AAAA,IACV,cAAA,EAAgB,IAAA;AAAA,IAChB,eAAe,GAAA,CAAI,cAAA;AAAA,IACnB,oBAAoB,GAAA,CAAI,mBAAA;AAAA,IACxB,6BAA6B,GAAA,CAAI,6BAAA;AAAA,IACjC,wBAAwB,EAAC;AAAA,IACzB,qBAAqB;AAAC,GACxB;AACF;AAEA,eAAsB,iBAAA,CACpB,OAAA,EACA,IAAA,GAAwB,EAAC,EACK;AAC9B,EAAA,MAAM,IAAA,GAAO,OAAA,CAAQ,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAItC,EAAA,MAAM,SAAA,GAAyB;AAAA,IAC7B,QAAQ,IAAA,CAAK,MAAA;AAAA,IACb,QAAA,EAAU;AAAA,GACZ;AAEA,EAAA,IAAI;AACF,IAAA,OAAO,MAAM,cAAA,CAAe,IAAA,EAAM,SAAA,EAAW,IAAI,CAAA;AAAA,EACnD,SAAS,MAAA,EAAQ;AAKf,IAAA,IAAI,IAAA,CAAK,MAAA,EAAQ,OAAA,EAAS,MAAM,MAAA;AAKhC,IAAA,IAAI;AACF,MAAA,OAAO,MAAM,mBAAA,CAAoB,IAAA,EAAM,SAAA,EAAW,IAAI,CAAA;AAAA,IACxD,CAAA,CAAA,MAAQ;AACN,MAAA,MAAM,MAAA;AAAA,IACR;AAAA,EACF;AACF;ACrOA,IAAM,IAAA,GAAO,UAAU,QAAQ,CAAA;AAS/B,SAAS,uBAAA,GAAgC;AACvC,EAAA,IAAI,OAAA,CAAQ,aAAa,QAAA,EAAU;AACjC,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,sFAAA,EACoB,QAAQ,QAAQ,CAAA,2FAAA;AAAA,KAEtC;AAAA,EACF;AACF;AAGO,SAAS,cAAA,CACd,SACA,MAAA,EACQ;AACR,EAAA,IAAI,CAAC,SAAS,OAAO,MAAA;AACrB,EAAA,OAAO,OAAA,CAAQ,OAAA,CAAQ,UAAA,EAAY,MAAM,CAAA;AAC3C;AAGA,eAAsB,iBAAA,CACpB,SACA,OAAA,EAC6B;AAC7B,EAAA,uBAAA,EAAwB;AACxB,EAAA,IAAI;AACF,IAAA,MAAM,EAAE,MAAA,EAAO,GAAI,MAAM,KAAK,UAAA,EAAY;AAAA,MACxC,uBAAA;AAAA,MACA,IAAA;AAAA,MACA,OAAA;AAAA,MACA,IAAA;AAAA,MACA,OAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,MAAM,CAAA,GAAI,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAA;AAClC,IAAA,OAAO,CAAA,IAAK,KAAA,CAAA;AAAA,EACd,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,MAAA;AAAA,EACT;AACF;AAGA,eAAsB,kBAAA,CACpB,OAAA,EACA,OAAA,EACA,KAAA,EACe;AACf,EAAA,uBAAA,EAAwB;AACxB,EAAA,MAAM,KAAK,UAAA,EAAY;AAAA,IACrB,sBAAA;AAAA,IACA,IAAA;AAAA,IACA,IAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA,OAAA;AAAA,IACA,IAAA;AAAA,IACA,KAAA;AAAA,IACA,IAAA;AAAA,IACA;AAAA,GACD,CAAA;AACH;AAKA,eAAsB,mBAAA,CACpB,SACA,OAAA,EACkB;AAClB,EAAA,uBAAA,EAAwB;AACxB,EAAA,IAAI;AACF,IAAA,MAAM,KAAK,UAAA,EAAY;AAAA,MACrB,yBAAA;AAAA,MACA,IAAA;AAAA,MACA,OAAA;AAAA,MACA,IAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AAEN,IAAA,OAAO,KAAA;AAAA,EACT;AACF;;;AClFA,IAAM,cAAA,GAAiBA,EAAE,MAAA,CAAO;AAAA,EAC9B,CAAA,EAAGA,EAAE,MAAA,EAAO;AAAA,EACZ,CAAA,EAAGA,EAAE,IAAA,CAAK,CAAC,OAAO,WAAA,EAAa,KAAA,EAAO,QAAQ,CAAC,CAAA;AAAA,EAC/C,CAAA,EAAGA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACvB,CAAA,EAAGA,CAAAA,CAAE,MAAA,CAAOA,CAAAA,CAAE,MAAA,IAAUA,CAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA;AACvC,CAAC,CAAA;AAEM,IAAM,gBAAN,MAA+C;AAAA,EACpD,MAAM,KAAK,GAAA,EAAsD;AAC/D,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,IAAA;AACnC,IAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,CAAkB,GAAA,CAAI,MAAM,OAAO,CAAA;AACrD,IAAA,IAAI,GAAA,KAAQ,QAAW,OAAO,MAAA;AAE9B,IAAA,IAAI;AACF,MAAA,MAAM,WAAW,cAAA,CAAe,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,GAAG,CAAC,CAAA;AACrD,MAAA,OAAO;AAAA,QACL,OAAO,QAAA,CAAS,CAAA;AAAA,QAChB,MAAM,QAAA,CAAS,CAAA;AAAA,QACf,GAAI,SAAS,CAAA,KAAM,KAAA,CAAA,GAAY,EAAE,SAAA,EAAW,QAAA,CAAS,CAAA,EAAE,GAAI,EAAC;AAAA,QAC5D,GAAI,SAAS,CAAA,KAAM,KAAA,CAAA,GAAY,EAAE,QAAA,EAAU,QAAA,CAAS,CAAA,EAAE,GAAI;AAAC,OAC7D;AAAA,IACF,CAAA,CAAA,MAAQ;AACN,MAAA,OAAO,EAAE,KAAA,EAAO,GAAA,EAAK,IAAA,EAAM,KAAA,EAAM;AAAA,IACnC;AAAA,EACF;AAAA,EAEA,MAAM,KAAA,CAAM,GAAA,EAAe,IAAA,EAAuC;AAChE,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,IAAA;AACnC,IAAA,MAAM,QAAA,GAA2C;AAAA,MAC/C,GAAG,IAAA,CAAK,KAAA;AAAA,MACR,GAAG,IAAA,CAAK,IAAA;AAAA,MACR,GAAI,KAAK,SAAA,KAAc,MAAA,GAAY,EAAE,CAAA,EAAG,IAAA,CAAK,SAAA,EAAU,GAAI,EAAC;AAAA,MAC5D,GAAI,KAAK,QAAA,KAAa,MAAA,GAAY,EAAE,CAAA,EAAG,IAAA,CAAK,QAAA,EAAS,GAAI;AAAC,KAC5D;AACA,IAAA,MAAM,mBAAmB,GAAA,CAAI,IAAA,EAAM,SAAS,IAAA,CAAK,SAAA,CAAU,QAAQ,CAAC,CAAA;AAAA,EACtE;AAAA,EAEA,MAAM,OAAO,GAAA,EAA8B;AACzC,IAAA,MAAM,OAAA,GAAU,GAAA,CAAI,OAAA,IAAW,GAAA,CAAI,IAAA;AACnC,IAAA,MAAM,mBAAA,CAAoB,GAAA,CAAI,IAAA,EAAM,OAAO,CAAA;AAAA,EAC7C;AACF;;;AC/CO,SAAS,eAAA,CACd,IAAA,EACA,MAAA,EACA,QAAA,EACU;AACV,EAAA,MAAM,IAAA,GAAO,IAAA,CAAK,IAAA,IAAQ,IAAA,CAAK,QAAA;AAC/B,EAAA,OAAO;AAAA,IACL,MAAM,QAAA,GAAW,CAAA,EAAG,QAAQ,CAAA,CAAA,EAAI,IAAI,CAAA,CAAA,GAAK,IAAA;AAAA,IACzC,OAAA,EAAS,cAAA,CAAe,IAAA,CAAK,OAAA,EAAS,MAAM;AAAA,GAC9C;AACF;AAOO,SAAS,gBAAA,CACd,IAAA,EACA,MAAA,EACA,QAAA,EACwC;AACxC,EAAA,MAAM,GAAA,GAAM,eAAA,CAAgB,IAAA,EAAM,MAAA,EAAQ,QAAQ,CAAA;AAClD,EAAA,MAAM,SAAA,GAAY,QAAA,GAAW,eAAA,CAAgB,IAAA,EAAM,MAAM,CAAA,GAAI,GAAA;AAC7D,EAAA,OAAO,EAAE,KAAK,SAAA,EAAU;AAC1B;AAcA,eAAsB,wBAAA,CACpB,KAAA,EACA,GAAA,EACA,SAAA,EACuC;AACvC,EAAA,MAAM,MAAA,GAAS,MAAM,KAAA,CAAM,IAAA,CAAK,GAAG,CAAA;AACnC,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,IAAI,IAAI,IAAA,KAAS,SAAA,CAAU,QAAQ,GAAA,CAAI,OAAA,KAAY,UAAU,OAAA,EAAS;AACpE,IAAA,OAAO,MAAA;AAAA,EACT;AACA,EAAA,OAAO,KAAA,CAAM,KAAK,SAAS,CAAA;AAC7B;;;ACxCA,eAAe,YAAY,KAAA,EAAgC;AACzD,EAAA,MAAM,QAAQ,OAAA,CAAQ,KAAA;AACtB,EAAA,MAAM,MAAM,OAAA,CAAQ,MAAA;AAEpB,EAAA,IAAI,CAAC,MAAM,KAAA,EAAO;AAChB,IAAA,OAAO,IAAI,OAAA,CAAQ,CAACC,QAAAA,KAAY;AAC9B,MAAA,MAAM,KAAK,eAAA,CAAgB,EAAE,KAAA,EAAO,MAAA,EAAQ,KAAK,CAAA;AACjD,MAAA,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,EAAA,CAAI,CAAA;AACtB,MAAA,EAAA,CAAG,QAAA,CAAS,EAAA,EAAI,CAAC,MAAA,KAAW;AAC1B,QAAA,EAAA,CAAG,KAAA,EAAM;AACT,QAAAA,QAAAA,CAAQ,MAAA,CAAO,IAAA,EAAM,CAAA;AAAA,MACvB,CAAC,CAAA;AAAA,IACH,CAAC,CAAA;AAAA,EACH;AAEA,EAAA,OAAO,IAAI,OAAA,CAAQ,CAACA,QAAAA,EAAS,MAAA,KAAW;AACtC,IAAA,GAAA,CAAI,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,EAAA,CAAI,CAAA;AACtB,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,KAAA,CAAM,WAAW,IAAI,CAAA;AACrB,IAAA,KAAA,CAAM,MAAA,EAAO;AACb,IAAA,KAAA,CAAM,YAAY,MAAM,CAAA;AAExB,IAAA,MAAM,UAAU,MAAM;AACpB,MAAA,KAAA,CAAM,WAAW,KAAK,CAAA;AACtB,MAAA,KAAA,CAAM,KAAA,EAAM;AACZ,MAAA,KAAA,CAAM,cAAA,CAAe,QAAQ,MAAM,CAAA;AAAA,IACrC,CAAA;AAEA,IAAA,MAAM,MAAA,GAAS,CAAC,KAAA,KAAkB;AAChC,MAAA,KAAA,MAAW,MAAM,KAAA,EAAO;AACtB,QAAA,QAAQ,EAAA;AAAI,UACV,KAAK,IAAA;AAAA,UACL,KAAK,IAAA;AACH,YAAA,GAAA,CAAI,MAAM,IAAI,CAAA;AACd,YAAA,OAAA,EAAQ;AACR,YAAAA,SAAQ,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA,CAAE,MAAM,CAAA;AAC7B,YAAA;AAAA,UACF,KAAK,GAAA;AACH,YAAA,GAAA,CAAI,MAAM,IAAI,CAAA;AACd,YAAA,OAAA,EAAQ;AACR,YAAA,MAAA,CAAO,IAAI,KAAA,CAAM,gBAAgB,CAAC,CAAA;AAClC,YAAA;AAAA,UACF,KAAK,GAAA;AACH,YAAA,GAAA,CAAI,MAAM,IAAI,CAAA;AACd,YAAA,OAAA,EAAQ;AACR,YAAAA,SAAQ,KAAA,CAAM,IAAA,CAAK,EAAE,CAAA,CAAE,MAAM,CAAA;AAC7B,YAAA;AAAA,UACF,KAAK,MAAA;AAAA;AAAA,UACL,KAAK,IAAA;AACH,YAAA,IAAI,KAAA,CAAM,SAAS,CAAA,EAAG;AACpB,cAAA,KAAA,CAAM,GAAA,EAAI;AACV,cAAA,GAAA,CAAI,MAAM,OAAO,CAAA;AAAA,YACnB;AACA,YAAA;AAAA,UACF;AAEE,YAAA,IAAI,MAAM,GAAA,EAAK;AACb,cAAA,KAAA,CAAM,KAAK,EAAE,CAAA;AACb,cAAA,GAAA,CAAI,MAAM,GAAG,CAAA;AAAA,YACf;AAAA;AACJ,MACF;AAAA,IACF,CAAA;AAEA,IAAA,KAAA,CAAM,EAAA,CAAG,QAAQ,MAAM,CAAA;AAAA,EACzB,CAAC,CAAA;AACH;AAEO,IAAM,aAAA,GAA4B;AAAA,EACvC,EAAA,EAAI,KAAA;AAAA,EAEJ,MAAM,GAAA,CACJ,QAAA,EACA,WAAA,EACA,IAAA,EACqB;AACrB,IAAA,MAAM,EAAE,MAAK,GAAI,QAAA;AACjB,IAAA,IAAI,IAAA,CAAK,SAAS,KAAA,EAAO;AACvB,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,kCAAA,EAAqC,IAAA,CAAK,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IACnE;AAEA,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,IAAI,aAAA,EAAc;AAC9C,IAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,gBAAA;AAAA,MACzB,IAAA,CAAK,UAAA;AAAA,MACL,IAAA,CAAK,MAAA;AAAA,MACL,QAAA,CAAS;AAAA,KACX;AAEA,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA,MAAM,QAAA,GAAW,MAAM,wBAAA,CAAyB,KAAA,EAAO,KAAK,SAAS,CAAA;AACrE,MAAA,IAAI,QAAA,EAAU;AACZ,QAAA,OAAO,EAAE,WAAA,EAAa,QAAA,CAAS,KAAA,EAAO,WAAW,KAAA,EAAM;AAAA,MACzD;AAAA,IACF;AAEA,IAAA,MAAM,QAAQ,MAAM,WAAA,CAAY,CAAA,EAAG,QAAA,CAAS,EAAE,CAAA,sBAAA,CAAwB,CAAA;AACtE,IAAA,IAAI,CAAC,KAAA,EAAO,MAAM,IAAI,MAAM,mBAAmB,CAAA;AAE/C,IAAA,MAAM,KAAA,CAAM,MAAM,GAAA,EAAK,EAAE,OAAO,KAAA,EAAO,IAAA,EAAM,OAAO,CAAA;AAEpD,IAAA,OAAO,EAAE,WAAA,EAAa,KAAA,EAAO,SAAA,EAAW,KAAA,EAAM;AAAA,EAChD;AACF,CAAA;AC/GA,IAAM,SAAA,GAAYC,UAAUC,QAAQ,CAAA;AAS7B,IAAM,kBAAA,GAAqBH,EAC/B,MAAA,CAAO;AAAA,EACN,YAAA,EAAcA,EAAE,MAAA,EAAO;AAAA,EACvB,UAAA,EAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAChC,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,kBAAA,EAAoBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACxC,oBAAA,EAAsBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC1C,iBAAA,EAAmBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA,EAEvC,UAAA,EAAYA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAChC,KAAA,EAAOA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC3B,OAAA,EAASA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC7B,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAC5B,CAAC,EACA,KAAA,EAAM;AAGF,IAAM,gBAAA,GAAmBA,EAC7B,MAAA,CAAO;AAAA,EACN,KAAA,EAAOA,EAAE,MAAA,EAAO;AAAA,EAChB,iBAAA,EAAmBA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAChC,CAAC,EACA,KAAA,EAAM;AAKF,IAAM,sBAAsBA,CAAAA,CAAE,KAAA,CAAM,CAAC,kBAAA,EAAoB,gBAAgB,CAAC,CAAA;AAMjF,eAAsB,YAAY,GAAA,EAA4B;AAC5D,EAAA,MAAM,CAAC,GAAA,EAAK,IAAI,CAAA,GACd,OAAA,CAAQ,QAAA,KAAa,QAAA,GACjB,CAAC,MAAA,EAAQ,CAAC,GAAG,CAAC,CAAA,GACd,OAAA,CAAQ,QAAA,KAAa,OAAA,GACnB,CAAC,KAAA,EAAO,CAAC,IAAA,EAAM,OAAA,EAAS,GAAG,CAAC,CAAA,GAC5B,CAAC,UAAA,EAAY,CAAC,GAAG,CAAC,CAAA;AAC1B,EAAA,IAAI;AACF,IAAA,MAAM,SAAA,CAAU,KAAK,IAAI,CAAA;AAAA,EAC3B,CAAA,CAAA,MAAQ;AAAA,EAER;AACF;AAKA,eAAsB,aAAA,CACpB,GAAA,EACA,MAAA,EACA,MAAA,EACA,MAAA,EACY;AACZ,EAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,CAAkB,GAAA,EAAK;AAAA,IACvC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAAA,IAC3C;AAAA,GACD,CAAA;AACD,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AACtC;AAmBA,eAAsB,gBACpB,CAAA,EACuB;AACvB,EAAA,MAAM,QAAA,GAAW,IAAA,CAAK,GAAA,EAAI,GAAI,EAAE,SAAA,GAAY,GAAA;AAC5C,EAAA,IAAI,MAAA,GAAS,EAAE,SAAA,GAAY,GAAA;AAE3B,EAAA,OAAO,IAAA,CAAK,GAAA,EAAI,GAAI,QAAA,EAAU;AAC5B,IAAA,IAAI,EAAE,MAAA,EAAQ,OAAA,EAAS,MAAM,IAAI,MAAM,gBAAgB,CAAA;AACvD,IAAA,MAAM,IAAI,OAAA,CAAc,CAAC,MAAM,UAAA,CAAW,CAAA,EAAG,MAAM,CAAC,CAAA;AAEpD,IAAA,MAAM,OAAO,MAAM,aAAA;AAAA,MACjB,CAAA,CAAE,aAAA;AAAA,MACF,EAAE,UAAA,EAAY,CAAA,CAAE,SAAA,EAAW,GAAG,EAAE,MAAA,EAAO;AAAA,MACvC,mBAAA;AAAA,MACA,CAAA,CAAE;AAAA,KACJ;AAEA,IAAA,IAAI,EAAE,OAAA,IAAW,IAAA,CAAA,EAAO,OAAO,IAAA;AAE/B,IAAA,MAAM,UAAU,IAAA,CAAK,KAAA;AACrB,IAAA,IAAI,YAAY,uBAAA,EAAyB;AACzC,IAAA,IAAI,YAAY,WAAA,EAAa;AAC3B,MAAA,MAAA,IAAU,GAAA;AACV,MAAA;AAAA,IACF;AACA,IAAA,IAAI,YAAY,eAAA,EAAiB;AAC/B,MAAA,MAAM,IAAI,MAAM,wDAAmD,CAAA;AAAA,IACrE;AACA,IAAA,IAAI,YAAY,eAAA,EAAiB;AAC/B,MAAA,MAAM,IAAI,MAAM,8DAAyD,CAAA;AAAA,IAC3E;AAEA,IAAA,MAAM,OAAO,IAAA,CAAK,iBAAA;AAClB,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,sBAAA,EAAyB,OAAO,CAAA,EAAG,OAAO,CAAA,QAAA,EAAM,IAAI,CAAA,CAAA,GAAK,EAAE,CAAA,CAAE,CAAA;AAAA,EAC/E;AAEA,EAAA,MAAM,IAAI,MAAM,4CAAuC,CAAA;AACzD;;;ACxGA,IAAM,gBAAA,GAAmB,wCAAA;AACzB,IAAM,qBAAA,GAAwB,6CAAA;AAC9B,IAAM,uBAAA,GAA0B,CAAA;AAUhC,IAAM,sBAAA,GAAyBA,EAC5B,MAAA,CAAO;AAAA,EACN,eAAA,EAAiBA,EAAE,MAAA,EAAO;AAAA,EAC1B,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,EACtB,KAAA,EAAOA,EACJ,MAAA,CAAO;AAAA,IACN,SAAA,EAAWA,EAAE,MAAA,EAAO;AAAA,IACpB,gBAAA,EAAkBA,EAAE,MAAA,EAAO;AAAA,IAC3B,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,IACrB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS,GAC/B,EACA,KAAA;AACL,CAAC,EACA,KAAA,EAAM;AAIT,eAAe,QAAA,CACb,GAAA,EACA,IAAA,EACA,MAAA,EACA,MAAA,EACY;AACZ,EAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,CAAkB,GAAA,EAAK;AAAA,IACvC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAI,CAAA;AAAA,IACzB;AAAA,GACD,CAAA;AACD,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,MAAM,IAAI,MAAM,CAAA,KAAA,EAAQ,GAAG,WAAM,GAAA,CAAI,MAAM,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,MAAA,CAAO,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AACtC;AAQA,eAAe,iBAAA,CACb,aAAA,EACA,SAAA,EACA,QAAA,EACA,MAAA,EAC8B;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,aAAA;AAAA,MACjB,aAAA;AAAA,MACA;AAAA,QACE,UAAA,EAAY,qBAAA;AAAA,QACZ,SAAA;AAAA,QACA,SAAA,EAAW;AAAA,OACb;AAAA,MACA,mBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,OAAA,IAAW,MAAM,OAAO,IAAA;AAC5B,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAIO,IAAM,qBAAA,GAAoC;AAAA,EAC/C,EAAA,EAAI,cAAA;AAAA,EAEJ,MAAM,GAAA,CACJ,QAAA,EACA,UAAA,EACA,IAAA,EACqB;AACrB,IAAA,MAAM,EAAE,MAAK,GAAI,QAAA;AACjB,IAAA,IAAI,IAAA,CAAK,SAAS,cAAA,EAAgB;AAChC,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,0CAAA,EAA6C,IAAA,CAAK,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AAGA,IAAA,MAAM,MAAA,GAAS,IAAA;AACf,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,IAAY,gBAAA;AACpC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAA;AAG5C,IAAA,MAAM,gBAAA,GACJ,UAAA,EAAY,gBAAA,IAAoB,CAAA,EAAG,MAAM,CAAA,eAAA,CAAA;AAC3C,IAAA,MAAM,aAAA,GACJ,UAAA,EAAY,aAAA,IAAiB,CAAA,EAAG,MAAM,CAAA,YAAA,CAAA;AAGxC,IAAA,eAAA,CAAgB,gBAAgB,CAAA;AAChC,IAAA,eAAA,CAAgB,aAAa,CAAA;AAE7B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,IAAI,aAAA,EAAc;AAC9C,IAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,gBAAA;AAAA,MACzB,MAAA,CAAO,UAAA;AAAA,MACP,MAAA;AAAA,MACA,QAAA,CAAS;AAAA,KACX;AAMA,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA,MAAM,MAAA,GAAS,MAAM,wBAAA,CAAyB,KAAA,EAAO,KAAK,SAAS,CAAA;AACnE,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,MAAM,YAAY,MAAM,iBAAA;AAAA,UACtB,aAAA;AAAA,UACA,MAAA,CAAO,KAAA;AAAA,UACP,QAAA;AAAA,UACA,IAAA,CAAK;AAAA,SACP;AACA,QAAA,IAAI,SAAA,EAAW;AAGb,UAAA,IAAI,UAAU,kBAAA,EAAoB;AAChC,YAAA,MAAM,KAAA,CAAM,MAAM,GAAA,EAAK;AAAA,cACrB,OAAO,SAAA,CAAU,kBAAA;AAAA,cACjB,IAAA,EAAM;AAAA,aACP,CAAA;AAAA,UACH;AACA,UAAA,OAAO;AAAA,YACL,aAAa,SAAA,CAAU,YAAA;AAAA,YACvB,GAAI,UAAU,kBAAA,GACV,EAAE,mBAAmB,SAAA,CAAU,kBAAA,KAC/B,EAAC;AAAA,YACL,SAAA,EAAW;AAAA,WACb;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAGA,IAAA,MAAM,WAAW,MAAM,QAAA;AAAA,MACrB,gBAAA;AAAA,MACA;AAAA,QACE,IAAA,EAAM,cAAA;AAAA,QACN,SAAA,EAAW,QAAA;AAAA,QACX,GAAI,OAAO,SAAA,GAAY,EAAE,YAAY,MAAA,CAAO,SAAA,KAAc;AAAC,OAC7D;AAAA,MACA,sBAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,EAAE,WAAA,EAAa,KAAA,EAAM,GAAI,QAAA;AAC/B,IAAA,MAAM,SAAA,GAAY,MAAM,QAAA,IAAY,uBAAA;AACpC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,aAAa,EAAE,CAAA;AAGlD,IAAA,OAAA,CAAQ,OAAO,KAAA,CAAM;AAAA,CAAI,CAAA;AACzB,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,UAAA,EAAa,QAAA,CAAS,EAAE,CAAA;;AAAA,CAA6B,CAAA;AAC1E,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,SAAS;AAAA,CAAI,CAAA;AACpD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,gBAAgB;;AAAA,CAAM,CAAA;AAC7D,IAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,EAAO;AAC9B,MAAA,MAAM,WAAA,CAAY,MAAM,gBAAgB,CAAA;AAAA,IAC1C;AACA,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,wBAAA,EAA2B,SAAS,CAAA;;AAAA,CAAY,CAAA;AAGrE,IAAA,MAAM,WAAA,GAAc,MAAM,eAAA,CAAgB;AAAA,MACxC,aAAA;AAAA,MACA,SAAA,EAAW,gBAAA;AAAA,MACX,MAAA,EAAQ,EAAE,WAAA,EAAa,SAAA,EAAW,QAAA,EAAS;AAAA,MAC3C,SAAA;AAAA,MACA,WAAW,KAAA,CAAM,UAAA;AAAA,MACjB,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAMD,IAAA,MAAM,cAAc,WAAA,CAAY,YAAA;AAChC,IAAA,MAAM,YAAY,WAAA,CAAY,kBAAA;AAG9B,IAAA,IAAI,gBAAA;AACJ,IAAA,IAAI,YAAY,iBAAA,EAAmB;AACjC,MAAA,gBAAA,GAAmB,WAAA,CAAY,iBAAA;AAAA,IACjC,CAAA,MAAA,IAAW,YAAY,oBAAA,EAAsB;AAC3C,MAAA,gBAAA,GAAmB,IAAI,IAAA;AAAA,QACrB,IAAA,CAAK,GAAA,EAAI,GAAI,WAAA,CAAY,oBAAA,GAAuB;AAAA,QAChD,WAAA,EAAY;AAAA,IAChB;AAEA,IAAA,IAAI,SAAA,EAAW;AACb,MAAA,MAAM,KAAA,CAAM,MAAM,GAAA,EAAK;AAAA,QACrB,KAAA,EAAO,SAAA;AAAA,QACP,IAAA,EAAM,WAAA;AAAA,QACN,GAAI,gBAAA,GAAmB,EAAE,SAAA,EAAW,gBAAA,KAAqB;AAAC,OAC3D,CAAA;AAAA,IACH;AAEA,IAAA,OAAO;AAAA,MACL,WAAA;AAAA,MACA,iBAAA,EAAmB,SAAA;AAAA,MACnB,gBAAA;AAAA,MACA,SAAA,EAAW;AAAA,KACb;AAAA,EACF;AACF,CAAA;ACzNA,IAAM,sBAAA,GAAyB,8CAAA;AAC/B,IAAM,kBAAA,GAAqB,eAAA;AAC3B,IAAMI,wBAAAA,GAA0B,CAAA;AAOzB,IAAM,qBAAA,GAAN,cAAoC,KAAA,CAAM;AAAA,EAC/C,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,uBAAA;AAAA,EACd;AACF;AAQA,IAAM,iCAAA,GAAoCJ,EACvC,MAAA,CAAO;AAAA,EACN,WAAA,EAAaA,EAAE,MAAA,EAAO;AAAA,EACtB,SAAA,EAAWA,EAAE,MAAA,EAAO;AAAA,EACpB,gBAAA,EAAkBA,EAAE,MAAA,EAAO;AAAA,EAC3B,yBAAA,EAA2BA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/C,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,QAAA,EAAUA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACvB,CAAC,EACA,KAAA,EAAM;AAIT,eAAe,uBAAA,CACb,GAAA,EACA,MAAA,EACA,MAAA,EACA;AACA,EAAA,MAAM,GAAA,GAAM,MAAM,iBAAA,CAAkB,GAAA,EAAK;AAAA,IACvC,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,IAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB,MAAM,EAAE,QAAA,EAAS;AAAA,IAC3C;AAAA,GACD,CAAA;AACD,EAAA,IAAI,CAAC,IAAI,EAAA,EAAI;AACX,IAAA,MAAM,IAAA,GAAO,MAAM,GAAA,CAAI,IAAA,EAAK;AAC5B,IAAA,MAAM,IAAI,MAAM,CAAA,KAAA,EAAQ,GAAG,WAAM,GAAA,CAAI,MAAM,CAAA,EAAA,EAAK,IAAI,CAAA,CAAE,CAAA;AAAA,EACxD;AACA,EAAA,OAAO,iCAAA,CAAkC,KAAA,CAAM,MAAM,GAAA,CAAI,MAAM,CAAA;AACjE;AAIA,SAAS,UAAA,CACP,UACA,GAAA,EACoB;AACpB,EAAA,MAAM,CAAA,GAAI,WAAW,GAAG,CAAA;AACxB,EAAA,OAAO,OAAO,CAAA,KAAM,QAAA,GAAW,CAAA,GAAI,MAAA;AACrC;AAEA,SAAS,UAAU,IAAA,EAAiC;AAClD,EAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,KAAA;AAC5B,EAAA,MAAM,CAAA,GAAI,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA;AACnC,EAAA,IAAI,MAAA,CAAO,KAAA,CAAM,CAAC,CAAA,EAAG,OAAO,IAAA;AAC5B,EAAA,OAAO,CAAA,IAAK,KAAK,GAAA,EAAI;AACvB;AAEA,SAAS,iBAAiB,IAAA,EAAoC;AAC5D,EAAA,MAAM,YAAA,GAAe,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU,cAAc,CAAA;AAC7D,EAAA,MAAM,KAAA,GAAQ,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU,OAAO,CAAA;AAC/C,EAAA,MAAM,OAAA,GAAU,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU,SAAS,CAAA;AACnD,EAAA,MAAM,YAAA,GAAe,UAAA,CAAW,IAAA,CAAK,QAAA,EAAU,cAAc,CAAA;AAC7D,EAAA,OAAO;AAAA,IACL,aAAa,IAAA,CAAK,KAAA;AAAA,IAClB,SAAA,EAAW,QAAA;AAAA,IACX,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB,EAAC;AAAA,IACvC,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU,EAAC;AAAA,IACzB,GAAI,OAAA,GAAU,EAAE,OAAA,KAAY,EAAC;AAAA,IAC7B,GAAI,YAAA,GAAe,EAAE,YAAA,KAAiB;AAAC,GACzC;AACF;AAKA,eAAe,kBAAA,CACb,aAAA,EACA,YAAA,EACA,QAAA,EACA,MAAA,EAC8B;AAC9B,EAAA,IAAI;AACF,IAAA,MAAM,OAAO,MAAM,aAAA;AAAA,MACjB,aAAA;AAAA,MACA;AAAA,QACE,UAAA,EAAY,kBAAA;AAAA,QACZ,aAAA,EAAe,YAAA;AAAA,QACf,SAAA,EAAW;AAAA,OACb;AAAA,MACA,mBAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,IAAI,OAAA,IAAW,MAAM,OAAO,IAAA;AAC5B,IAAA,OAAO,IAAA;AAAA,EACT,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,IAAA;AAAA,EACT;AACF;AAEA,eAAe,gBAAA,CACb,KAAA,EACA,GAAA,EACA,CAAA,EASqB;AACrB,EAAA,MAAM,SAAA,GAAY,CAAA,CAAE,SAAA,GAChB,IAAI,IAAA,CAAK,IAAA,CAAK,GAAA,EAAI,GAAI,CAAA,CAAE,SAAA,GAAY,GAAK,CAAA,CAAE,aAAY,GACvD,MAAA;AAEJ,EAAA,MAAM,QAAA,GAAoC;AAAA,IACxC,UAAA,EAAA,iBAAY,IAAI,IAAA,EAAK,EAAE,WAAA,EAAY;AAAA,IACnC,GAAI,EAAE,YAAA,GAAe,EAAE,cAAc,CAAA,CAAE,YAAA,KAAiB,EAAC;AAAA,IACzD,GAAI,EAAE,KAAA,GAAQ,EAAE,OAAO,CAAA,CAAE,KAAA,KAAU,EAAC;AAAA,IACpC,GAAI,EAAE,OAAA,GAAU,EAAE,SAAS,CAAA,CAAE,OAAA,KAAY,EAAC;AAAA,IAC1C,GAAI,EAAE,WAAA,GAAc,EAAE,aAAa,CAAA,CAAE,WAAA,KAAgB,EAAC;AAAA,IACtD,GAAI,EAAE,YAAA,GAAe,EAAE,cAAc,CAAA,CAAE,YAAA,KAAiB;AAAC,GAC3D;AAEA,EAAA,MAAM,KAAA,CAAM,MAAM,GAAA,EAAK;AAAA,IACrB,OAAO,CAAA,CAAE,WAAA;AAAA,IACT,IAAA,EAAM,QAAA;AAAA,IACN,GAAI,SAAA,GAAY,EAAE,SAAA,KAAc,EAAC;AAAA,IACjC;AAAA,GACD,CAAA;AAED,EAAA,OAAO;AAAA,IACL,aAAa,CAAA,CAAE,WAAA;AAAA,IACf,SAAA,EAAW,QAAA;AAAA,IACX,GAAI,EAAE,YAAA,GAAe,EAAE,cAAc,CAAA,CAAE,YAAA,KAAiB,EAAC;AAAA,IACzD,GAAI,EAAE,KAAA,GAAQ,EAAE,OAAO,CAAA,CAAE,KAAA,KAAU,EAAC;AAAA,IACpC,GAAI,EAAE,OAAA,GAAU,EAAE,SAAS,CAAA,CAAE,OAAA,KAAY,EAAC;AAAA,IAC1C,GAAI,EAAE,YAAA,GAAe,EAAE,cAAc,CAAA,CAAE,YAAA,KAAiB;AAAC,GAC3D;AACF;AAIO,IAAM,oBAAA,GAAmC;AAAA,EAC9C,EAAA,EAAI,aAAA;AAAA,EAEJ,MAAM,GAAA,CACJ,QAAA,EACA,UAAA,EACA,IAAA,EACqB;AACrB,IAAA,MAAM,EAAE,MAAK,GAAI,QAAA;AACjB,IAAA,IAAI,IAAA,CAAK,SAAS,aAAA,EAAe;AAC/B,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,IAAA,CAAK,IAAI,CAAA,CAAA,CAAG,CAAA;AAAA,IAC1E;AAGA,IAAA,MAAM,MAAA,GAAS,IAAA;AACf,IAAA,MAAM,QAAA,GAAW,OAAO,QAAA,IAAY,gBAAA;AACpC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAK,MAAA,CAAO,OAAA,CAAQ,OAAO,EAAE,CAAA;AAG5C,IAAA,MAAM,2BAAA,GACJ,UAAA,EAAY,2BAAA,IAA+B,CAAA,EAAG,MAAM,CAAA,aAAA,CAAA;AACtD,IAAA,MAAM,aAAA,GAAgB,UAAA,EAAY,aAAA,IAAiB,CAAA,EAAG,MAAM,CAAA,YAAA,CAAA;AAG5D,IAAA,eAAA,CAAgB,2BAA2B,CAAA;AAC3C,IAAA,eAAA,CAAgB,aAAa,CAAA;AAE7B,IAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,KAAA,IAAS,IAAI,aAAA,EAAc;AAC9C,IAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,gBAAA;AAAA,MACzB,MAAA,CAAO,UAAA;AAAA,MACP,MAAA;AAAA,MACA,QAAA,CAAS;AAAA,KACX;AAMA,IAAA,eAAe,WAAW,MAAA,EAAsD;AAC9E,MAAA,MAAM,YAAA,GAAe,UAAA,CAAW,MAAA,CAAO,QAAA,EAAU,cAAc,CAAA;AAC/D,MAAA,IAAI,CAAC,cAAc,OAAO,IAAA;AAC1B,MAAA,MAAM,YAAY,MAAM,kBAAA;AAAA,QACtB,aAAA;AAAA,QACA,YAAA;AAAA,QACA,QAAA;AAAA,QACA,IAAA,CAAK;AAAA,OACP;AACA,MAAA,IAAI,CAAC,WAAW,OAAO,IAAA;AACvB,MAAA,OAAO,gBAAA,CAAiB,OAAO,GAAA,EAAK;AAAA,QAClC,aAAa,SAAA,CAAU,YAAA;AAAA,QACvB,WAAW,SAAA,CAAU,UAAA;AAAA,QACrB,YAAA,EAAc,UAAU,aAAA,IAAiB,YAAA;AAAA,QACzC,OAAO,SAAA,CAAU,KAAA,IAAS,UAAA,CAAW,MAAA,CAAO,UAAU,OAAO,CAAA;AAAA,QAC7D,SAAS,SAAA,CAAU,OAAA,IAAW,UAAA,CAAW,MAAA,CAAO,UAAU,SAAS,CAAA;AAAA,QACnE,aACE,MAAA,CAAO,WAAA,IAAe,UAAA,CAAW,MAAA,CAAO,UAAU,aAAa,CAAA;AAAA,QACjE,cACE,SAAA,CAAU,aAAA,IAAiB,UAAA,CAAW,MAAA,CAAO,UAAU,cAAc;AAAA,OACxE,CAAA;AAAA,IACH;AAKA,IAAA,IAAI,KAAK,WAAA,EAAa;AACpB,MAAA,MAAM,MAAA,GAAS,MAAM,wBAAA,CAAyB,KAAA,EAAO,KAAK,SAAS,CAAA;AACnE,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,IAAI,CAAC,SAAA,CAAU,MAAM,CAAA,EAAG;AACtB,UAAA,OAAO,iBAAiB,MAAM,CAAA;AAAA,QAChC;AACA,QAAA,MAAM,SAAA,GAAY,MAAM,UAAA,CAAW,MAAM,CAAA;AACzC,QAAA,IAAI,WAAW,OAAO,SAAA;AAAA,MACxB;AACA,MAAA,MAAM,IAAI,qBAAA;AAAA,QACR,CAAA,EAAG,SAAS,EAAE,CAAA,0HAAA;AAAA,OAChB;AAAA,IACF;AAMA,IAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,MAAA,MAAM,MAAA,GAAS,MAAM,wBAAA,CAAyB,KAAA,EAAO,KAAK,SAAS,CAAA;AACnE,MAAA,IAAI,MAAA,EAAQ;AACV,QAAA,IAAI,CAAC,SAAA,CAAU,MAAM,CAAA,EAAG;AACtB,UAAA,OAAO,iBAAiB,MAAM,CAAA;AAAA,QAChC;AACA,QAAA,MAAM,SAAA,GAAY,MAAM,UAAA,CAAW,MAAM,CAAA;AACzC,QAAA,IAAI,WAAW,OAAO,SAAA;AAAA,MAExB;AAAA,IACF;AAGA,IAAA,MAAM,MAAA,GAAiC,EAAE,SAAA,EAAW,QAAA,EAAS;AAC7D,IAAA,IAAI,MAAA,CAAO,KAAA,EAAO,MAAA,CAAO,KAAA,GAAQ,MAAA,CAAO,KAAA;AACxC,IAAA,IAAI,MAAA,CAAO,WAAA,EAAa,MAAA,CAAO,YAAA,GAAe,MAAA,CAAO,WAAA;AAErD,IAAA,MAAM,QAAQ,MAAM,uBAAA;AAAA,MAClB,2BAAA;AAAA,MACA,MAAA;AAAA,MACA,IAAA,CAAK;AAAA,KACP;AAEA,IAAA,MAAM,SAAA,GAAY,MAAM,QAAA,IAAYI,wBAAAA;AACpC,IAAA,MAAM,SAAA,GAAY,IAAA,CAAK,KAAA,CAAM,KAAA,CAAM,aAAa,EAAE,CAAA;AAGlD,IAAA,OAAA,CAAQ,OAAO,KAAA,CAAM;AAAA,CAAI,CAAA;AACzB,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,UAAA,EAAa,QAAA,CAAS,EAAE,CAAA;;AAAA,CAA6B,CAAA;AAC1E,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,SAAS;AAAA,CAAI,CAAA;AACpD,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,SAAA,EAAY,KAAA,CAAM,gBAAgB;;AAAA,CAAM,CAAA;AAC7D,IAAA,IAAI,IAAA,CAAK,gBAAgB,KAAA,EAAO;AAC9B,MAAA,MAAM,WAAA,CAAY,KAAA,CAAM,yBAAA,IAA6B,KAAA,CAAM,gBAAgB,CAAA;AAAA,IAC7E;AACA,IAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,wBAAA,EAA2B,SAAS,CAAA;;AAAA,CAAY,CAAA;AAGrE,IAAA,MAAM,WAAA,GAAc,MAAM,eAAA,CAAgB;AAAA,MACxC,aAAA;AAAA,MACA,SAAA,EAAW,sBAAA;AAAA,MACX,QAAQ,EAAE,WAAA,EAAa,KAAA,CAAM,WAAA,EAAa,WAAW,QAAA,EAAS;AAAA,MAC9D,SAAA;AAAA,MACA,WAAW,KAAA,CAAM,UAAA;AAAA,MACjB,QAAQ,IAAA,CAAK;AAAA,KACd,CAAA;AAGD,IAAA,OAAO,gBAAA,CAAiB,OAAO,GAAA,EAAK;AAAA,MAClC,aAAa,WAAA,CAAY,YAAA;AAAA,MACzB,WAAW,WAAA,CAAY,UAAA;AAAA,MACvB,cAAc,WAAA,CAAY,aAAA;AAAA,MAC1B,OAAO,WAAA,CAAY,KAAA;AAAA,MACnB,SAAS,WAAA,CAAY,OAAA;AAAA,MACrB,aAAa,MAAA,CAAO,WAAA;AAAA,MACpB,cAAc,WAAA,CAAY;AAAA,KAC3B,CAAA;AAAA,EACH;AACF,CAAA;;;AClUO,IAAM,YAAA,GAAqD;AAAA,EAChE,CAAC,aAAA,CAAc,EAAE,GAAG,aAAA;AAAA,EACpB,CAAC,qBAAA,CAAsB,EAAE,GAAG,qBAAA;AAAA,EAC5B,CAAC,oBAAA,CAAqB,EAAE,GAAG;AAC7B;;;ACOA,eAAsB,WAAA,CACpB,UACA,IAAA,EACqB;AACrB,EAAA,MAAM,MAAA,GAAS,SAAS,IAAA,CAAK,IAAA;AAC7B,EAAA,MAAM,MAAA,GAAS,aAAa,MAAM,CAAA;AAClC,EAAA,IAAI,CAAC,MAAA,EAAQ;AACX,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,2BAAA,EAA8B,MAAM,CAAA,qBAAA,EAAmB,MAAA,CAAO,KAAK,YAAY,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,KAC7F;AAAA,EACF;AAGA,EAAA,IAAI,UAAA,GACF,IAAA,CAAK,UAAA,KAAe,MAAA,GAAY,KAAK,UAAA,GAAa,IAAA;AAEpD,EAAA,IACE,UAAA,KAAe,IAAA,KACd,MAAA,KAAW,cAAA,IAAkB,WAAW,aAAA,CAAA,EACzC;AACA,IAAA,IAAI;AACF,MAAA,UAAA,GAAa,MAAM,kBAAkB,IAAA,CAAK,MAAA,EAAQ,EAAE,MAAA,EAAQ,IAAA,CAAK,QAAQ,CAAA;AAAA,IAC3E,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,CAAC,KAAK,KAAA,EAAO;AACf,QAAA,MAAM,MACJ,GAAA,YAAe,cAAA,GACX,GAAA,CAAI,OAAA,GACJ,qBAAqB,GAAG,CAAA,CAAA;AAC9B,QAAA,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,CAAA,OAAA,EAAU,GAAG,CAAA;AAAA,CAA0B,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,EACF;AAEA,EAAA,OAAO,MAAA,CAAO,GAAA,CAAI,QAAA,EAAU,UAAA,EAAY,IAAI,CAAA;AAC9C;;;ACjDA,SAAS,MAAM,GAAA,EAAuB;AACpC,EAAA,OAAO,GAAG,GAAA,CAAI,IAAI,KAAI,GAAA,CAAI,OAAA,IAAW,IAAI,IAAI,CAAA,CAAA;AAC/C;AAEO,IAAM,cAAN,MAA6C;AAAA,EACjC,OAAA,uBAAc,GAAA,EAA8B;AAAA,EAE7D,MAAM,KAAK,GAAA,EAAsD;AAC/D,IAAA,MAAM,QAAQ,IAAA,CAAK,OAAA,CAAQ,GAAA,CAAI,KAAA,CAAM,GAAG,CAAC,CAAA;AACzC,IAAA,OAAO,KAAA,GAAQ,EAAE,GAAG,KAAA,EAAM,GAAI,MAAA;AAAA,EAChC;AAAA,EAEA,MAAM,KAAA,CAAM,GAAA,EAAe,IAAA,EAAuC;AAChE,IAAA,IAAA,CAAK,OAAA,CAAQ,IAAI,KAAA,CAAM,GAAG,GAAG,EAAE,GAAG,MAAM,CAAA;AAAA,EAC1C;AAAA,EAEA,MAAM,OAAO,GAAA,EAA8B;AACzC,IAAA,IAAA,CAAK,OAAA,CAAQ,MAAA,CAAO,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,EAChC;AACF;ACTA,IAAM,SAAA,GAAY,aAAA;AAClB,IAAM,WAAA,GAAc,sBAAA;AACpB,IAAM,QAAA,GAAW,EAAA;AAEjB,IAAM,iBAAA,GAAoBJ,EAAE,MAAA,CAAO;AAAA,EACjC,EAAA,EAAIA,EAAE,MAAA,EAAO;AAAA,EACb,GAAA,EAAKA,EAAE,MAAA,EAAO;AAAA,EACd,UAAA,EAAYA,EAAE,MAAA;AAChB,CAAC,CAAA;AAGD,IAAM,mBAAmBA,CAAAA,CAAE,MAAA,CAAOA,CAAAA,CAAE,MAAA,IAAU,iBAAiB,CAAA;AAE/D,IAAM,sBAAA,GAAyBA,EAAE,MAAA,CAAO;AAAA,EACtC,KAAA,EAAOA,EAAE,MAAA,EAAO;AAAA,EAChB,IAAA,EAAMA,EAAE,IAAA,CAAK,CAAC,OAAO,WAAA,EAAa,KAAA,EAAO,QAAQ,CAAC,CAAA;AAAA,EAClD,SAAA,EAAWA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC/B,QAAA,EAAUA,CAAAA,CAAE,MAAA,CAAOA,CAAAA,CAAE,MAAA,IAAUA,CAAAA,CAAE,OAAA,EAAS,CAAA,CAAE,QAAA;AAC9C,CAAC,CAAA;AAED,SAASK,OAAM,GAAA,EAAuB;AACpC,EAAA,OAAO,GAAG,GAAA,CAAI,IAAI,IAAI,GAAA,CAAI,OAAA,IAAW,IAAI,IAAI,CAAA,CAAA;AAC/C;AAEA,SAAS,SAAS,GAAA,EAAuB;AACvC,EAAA,OACE,OAAO,QAAQ,QAAA,IACf,GAAA,KAAQ,QACR,MAAA,IAAU,GAAA,IACV,IAAI,IAAA,KAAS,QAAA;AAEjB;AAGA,SAAS,OAAA,GAAkB;AACzB,EAAA,MAAM,GAAA,GAAM,OAAA,CAAQ,GAAA,CAAI,WAAW,CAAA;AACnC,EAAA,IAAI,CAAC,GAAA,EAAK;AACR,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,sBAAsB,WAAW,CAAA,gIAAA;AAAA,KAGnC;AAAA,EACF;AACA,EAAA,MAAM,GAAA,GAAM,mBAAA,CAAoB,IAAA,CAAK,GAAG,CAAA,GACpC,MAAA,CAAO,IAAA,CAAK,GAAA,EAAK,KAAK,CAAA,GACtB,MAAA,CAAO,IAAA,CAAK,KAAK,QAAQ,CAAA;AAC7B,EAAA,IAAI,GAAA,CAAI,WAAW,EAAA,EAAI;AACrB,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,WAAA,EAAc,WAAW,CAAA,sCAAA,EACpB,GAAA,CAAI,MAAM,CAAA,4DAAA;AAAA,KACjB;AAAA,EACF;AACA,EAAA,OAAO,GAAA;AACT;AAEA,SAAS,IAAA,CAAK,KAAa,SAAA,EAAgC;AACzD,EAAA,MAAM,EAAA,GAAK,YAAY,QAAQ,CAAA;AAC/B,EAAA,MAAM,MAAA,GAAS,cAAA,CAAe,SAAA,EAAW,GAAA,EAAK,EAAE,CAAA;AAChD,EAAA,MAAM,UAAA,GAAa,OAAO,MAAA,CAAO;AAAA,IAC/B,MAAA,CAAO,MAAA,CAAO,SAAA,EAAW,MAAM,CAAA;AAAA,IAC/B,OAAO,KAAA;AAAM,GACd,CAAA;AACD,EAAA,OAAO;AAAA,IACL,EAAA,EAAI,EAAA,CAAG,QAAA,CAAS,QAAQ,CAAA;AAAA,IACxB,GAAA,EAAK,MAAA,CAAO,UAAA,EAAW,CAAE,SAAS,QAAQ,CAAA;AAAA,IAC1C,UAAA,EAAY,UAAA,CAAW,QAAA,CAAS,QAAQ;AAAA,GAC1C;AACF;AAEA,SAAS,MAAA,CAAO,KAAa,KAAA,EAA4B;AACvD,EAAA,MAAM,QAAA,GAAW,gBAAA;AAAA,IACf,SAAA;AAAA,IACA,GAAA;AAAA,IACA,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,EAAA,EAAI,QAAQ;AAAA,GAChC;AACA,EAAA,QAAA,CAAS,WAAW,MAAA,CAAO,IAAA,CAAK,KAAA,CAAM,GAAA,EAAK,QAAQ,CAAC,CAAA;AACpD,EAAA,MAAM,SAAA,GAAY,OAAO,MAAA,CAAO;AAAA,IAC9B,SAAS,MAAA,CAAO,MAAA,CAAO,KAAK,KAAA,CAAM,UAAA,EAAY,QAAQ,CAAC,CAAA;AAAA,IACvD,SAAS,KAAA;AAAM,GAChB,CAAA;AACD,EAAA,OAAO,SAAA,CAAU,SAAS,MAAM,CAAA;AAClC;AAEO,IAAM,YAAN,MAA2C;AAAA,EAChD,YAA6B,QAAA,EAAkB;AAAlB,IAAA,IAAA,CAAA,QAAA,GAAA,QAAA;AAAA,EAAmB;AAAA,EAAnB,QAAA;AAAA,EAE7B,MAAM,KAAK,GAAA,EAAsD;AAC/D,IAAA,MAAM,MAAM,OAAA,EAAQ;AACpB,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,QAAA,EAAS;AACjC,IAAA,MAAM,MAAA,GAAS,IAAA,CAAKA,MAAAA,CAAM,GAAG,CAAC,CAAA;AAC9B,IAAA,IAAI,CAAC,QAAQ,OAAO,MAAA;AACpB,IAAA,OAAO,sBAAA,CAAuB,MAAM,IAAA,CAAK,KAAA,CAAM,OAAO,GAAA,EAAK,MAAM,CAAC,CAAC,CAAA;AAAA,EACrE;AAAA,EAEA,MAAM,KAAA,CAAM,GAAA,EAAe,IAAA,EAAuC;AAChE,IAAA,MAAM,MAAM,OAAA,EAAQ;AACpB,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,QAAA,EAAS;AACjC,IAAA,IAAA,CAAKA,MAAAA,CAAM,GAAG,CAAC,CAAA,GAAI,KAAK,GAAA,EAAK,IAAA,CAAK,SAAA,CAAU,IAAI,CAAC,CAAA;AACjD,IAAA,MAAM,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,EAC3B;AAAA,EAEA,MAAM,OAAO,GAAA,EAA8B;AACzC,IAAA,MAAM,IAAA,GAAO,MAAM,IAAA,CAAK,QAAA,EAAS;AACjC,IAAA,OAAO,IAAA,CAAKA,MAAAA,CAAM,GAAG,CAAC,CAAA;AACtB,IAAA,MAAM,IAAA,CAAK,UAAU,IAAI,CAAA;AAAA,EAC3B;AAAA,EAEA,MAAc,QAAA,GAAiD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,GAAA,GAAM,MAAM,QAAA,CAAS,IAAA,CAAK,UAAU,MAAM,CAAA;AAChD,MAAA,OAAO,gBAAA,CAAiB,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,IAC/C,SAAS,GAAA,EAAK;AACZ,MAAA,IAAI,QAAA,CAAS,GAAG,CAAA,EAAG,OAAO,EAAC;AAC3B,MAAA,MAAM,GAAA;AAAA,IACR;AAAA,EACF;AAAA,EAEA,MAAc,UAAU,IAAA,EAAkD;AACxE,IAAA,MAAM,KAAA,CAAM,QAAQ,IAAA,CAAK,QAAQ,GAAG,EAAE,SAAA,EAAW,MAAM,CAAA;AACvD,IAAA,MAAM,SAAA,CAAU,KAAK,QAAA,EAAU,IAAA,CAAK,UAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG,MAAM,CAAA;AAAA,EACtE;AACF;;;AC5HA,IAAM,cAAA,GAAiB,GAAA;AAgBvB,SAAS,UAAU,IAAA,EAA0B;AAC3C,EAAA,MAAM,KAAA,GAAQ,IAAA,CAAK,OAAA,CAAQ,GAAG,CAAA;AAC9B,EAAA,IAAI,KAAA,KAAU,EAAA,EAAI,OAAO,EAAE,YAAY,IAAA,EAAK;AAC5C,EAAA,OAAO,EAAE,UAAA,EAAY,IAAA,CAAK,KAAA,CAAM,CAAA,EAAG,KAAK,CAAA,EAAG,OAAA,EAAS,IAAA,CAAK,KAAA,CAAM,KAAA,GAAQ,CAAC,CAAA,EAAE;AAC5E;AAKA,SAAS,QAAQ,IAAA,EAAiC;AAChD,EAAA,IAAI,CAAC,IAAA,CAAK,SAAA,EAAW,OAAO,IAAA;AAC5B,EAAA,MAAM,WAAA,GAAc,IAAA,CAAK,KAAA,CAAM,IAAA,CAAK,SAAS,CAAA;AAC7C,EAAA,IAAI,MAAA,CAAO,KAAA,CAAM,WAAW,CAAA,EAAG,OAAO,KAAA;AACtC,EAAA,OAAO,WAAA,GAAc,cAAA,GAAiB,IAAA,CAAK,GAAA,EAAI;AACjD;AAMA,SAAS,aAAA,CACP,OACA,IAAA,EACoC;AACpC,EAAA,IAAI,IAAA,KAAS,KAAA,IAAS,IAAA,KAAS,KAAA,IAAS,SAAS,QAAA,EAAU;AACzD,IAAA,OAAO,EAAE,aAAA,EAAe,CAAA,OAAA,EAAU,KAAK,CAAA,CAAA,EAAG;AAAA,EAC5C;AACA,EAAA,OAAO,MAAA;AACT;AAEO,IAAM,mBAAN,MAAuB;AAAA,EACX,KAAA;AAAA,EACA,WAAA;AAAA,EAEjB,YAAY,IAAA,EAA+B;AACzC,IAAA,IAAA,CAAK,QAAQ,IAAA,CAAK,KAAA;AAClB,IAAA,IAAA,CAAK,cAAc,IAAA,CAAK,WAAA;AAAA,EAC1B;AAAA,EAEA,MAAM,eAAe,CAAA,EASe;AAClC,IAAA,MAAM,EAAE,UAAA,EAAY,OAAA,EAAQ,GAAI,SAAA,CAAU,EAAE,IAAI,CAAA;AAChD,IAAA,MAAM,QAAA,GAAW,IAAA,CAAK,WAAA,CAAY,UAAU,CAAA;AAC5C,IAAA,IAAI,CAAC,QAAA,EAAU;AACb,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,yCAAA,EAA4C,UAAU,CAAA,CAAA,CAAG,CAAA;AAAA,IAC3E;AAEA,IAAA,IACE,CAAA,CAAE,aAAa,MAAA,IACf,QAAA,CAAS,aAAa,MAAA,IACtB,CAAA,CAAE,QAAA,KAAa,QAAA,CAAS,QAAA,EACxB;AACA,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,+BAA+B,UAAU,CAAA,yBAAA,EAA4B,SAAS,QAAQ,CAAA,cAAA,EAAiB,EAAE,QAAQ,CAAA,CAAA;AAAA,OACnH;AAAA,IACF;AAEA,IAAA,MAAM,MAAA,GAAS,CAAA,CAAE,MAAA,IAAU,QAAA,CAAS,OAAA;AACpC,IAAA,MAAM,EAAE,GAAA,EAAK,SAAA,EAAU,GAAI,gBAAA;AAAA,MACzB,SAAS,IAAA,CAAK,UAAA;AAAA,MACd,MAAA;AAAA,MACA,QAAA,CAAS;AAAA,KACX;AACA,IAAA,IAAI,YAAY,MAAA,EAAW;AACzB,MAAA,GAAA,CAAI,OAAA,GAAU,OAAA;AACd,MAAA,SAAA,CAAU,OAAA,GAAU,OAAA;AAAA,IACtB;AAEA,IAAA,MAAM,SAAS,MAAM,wBAAA,CAAyB,IAAA,CAAK,KAAA,EAAO,KAAK,SAAS,CAAA;AACxE,IAAA,IAAI,MAAA,IAAU,OAAA,CAAQ,MAAM,CAAA,EAAG;AAC7B,MAAA,MAAMC,QAAAA,GAAU,aAAA,CAAc,MAAA,CAAO,KAAA,EAAO,OAAO,IAAI,CAAA;AACvD,MAAA,IAAIA,UAAS,OAAOA,QAAAA;AAAA,IACtB;AAEA,IAAA,MAAM,MAAA,GAAS,MAAM,WAAA,CAAY,QAAA,EAAU;AAAA,MACzC,MAAA;AAAA,MACA,OAAO,IAAA,CAAK,KAAA;AAAA,MACZ,QAAQ,CAAA,CAAE;AAAA,KACX,CAAA;AACD,IAAA,MAAM,OAAA,GACJ,OAAO,WAAA,KAAgB,MAAA,GACnB,cAAc,MAAA,CAAO,WAAA,EAAa,MAAA,CAAO,SAAS,CAAA,GAClD,MAAA;AACN,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,oCAAoC,UAAU,CAAA,iCAAA;AAAA,OAChD;AAAA,IACF;AACA,IAAA,OAAO,OAAA;AAAA,EACT;AACF;AC5GA,IAAM,mBAAmBN,CAAAA,CAAE,IAAA,CAAK,CAAC,cAAA,EAAgB,SAAS,CAAC,CAAA;AAI3D,IAAM,mBAAA,GAAsBA,EAAE,MAAA,CAAO;AAAA,EACnC,MAAMA,CAAAA,CAAE,IAAA,CAAK,CAAC,KAAA,EAAO,OAAO,CAAC,CAAA;AAAA,EAC7B,GAAA,EAAKA,CAAAA,CAAE,KAAA,CAAMA,CAAAA,CAAE,QAAQ;AACzB,CAAC,CAAA;AAEM,IAAM,gBAAA,GAAmBA,EAAE,MAAA,CAAO;AAAA,EACvC,UAAA,EAAYA,EAAE,MAAA,EAAO;AAAA,EACrB,MAAA,EAAQA,EAAE,MAAA,EAAO;AAAA,EACjB,OAAOA,CAAAA,CAAE,IAAA,CAAK,CAAC,SAAA,EAAW,SAAS,CAAC;AACtC,CAAC,CAAA;AAED,IAAM,iBAAA,GAAoBA,EAAE,MAAA,CAAO;AAAA,EACjC,EAAA,EAAIA,EAAE,MAAA,EAAO;AAAA,EACb,MAAA,EAAQA,EAAE,MAAA,EAAO;AAAA,EACjB,MAAA,EAAQ,gBAAA;AAAA,EACR,aAAA,EAAeA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EACnC,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,EAC5B,KAAA,EAAOA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA;AAAA;AAAA;AAAA,EAI3B,QAAA,EAAUA,CAAAA,CAAE,OAAA,EAAQ,CAAE,QAAA,EAAS;AAAA,EAC/B,MAAA,EAAQ,oBAAoB,QAAA,EAAS;AAAA,EACrC,UAAA,EAAY,iBAAiB,QAAA,EAAS;AAAA,EACtC,MAAA,EAAQA,CAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AACrB,CAAC,CAAA,CAAE,SAAA,CAAU,CAAC,EAAE,MAAA,EAAQ,GAAG,OAAA,EAAQ,MAAoB,EAAE,GAAG,OAAA,EAAS,QAAA,EAAU,QAAO,CAAE,CAAA;AAExF,IAAM,sBAAA,GAAyBA,EAAE,MAAA,CAAO;AAAA,EACtC,OAAA,EAASA,CAAAA,CAAE,OAAA,CAAQ,CAAC,CAAA;AAAA,EACpB,UAAUA,CAAAA,CAAE,MAAA,CAAOA,CAAAA,CAAE,MAAA,IAAU,iBAAiB;AAClD,CAAC,CAAA;AAOD,SAAS,SAAA,GAA8B;AACrC,EAAA,OAAO,EAAE,OAAA,EAAS,CAAA,EAAG,QAAA,EAAU,EAAC,EAAE;AACpC;AAEO,SAAS,gBAAA,GAA2B;AACzC,EAAA,OAAO,OAAA,CAAQ,OAAA,EAAQ,EAAG,aAAA,EAAe,oBAAoB,CAAA;AAC/D;AAEA,eAAsB,gBAAA,GAA8C;AAClE,EAAA,IAAI;AACF,IAAA,MAAM,GAAA,GAAM,MAAMO,QAAAA,CAAS,gBAAA,IAAoB,MAAM,CAAA;AACrD,IAAA,OAAO,sBAAA,CAAuB,KAAA,CAAM,IAAA,CAAK,KAAA,CAAM,GAAG,CAAC,CAAA;AAAA,EACrD,CAAA,CAAA,MAAQ;AACN,IAAA,OAAO,SAAA,EAAU;AAAA,EACnB;AACF;AAEA,eAAe,kBAAkB,IAAA,EAAuC;AACtE,EAAA,MAAM,GAAA,GAAM,IAAA,CAAK,OAAA,EAAQ,EAAG,aAAa,CAAA;AACzC,EAAA,MAAMC,KAAAA,CAAM,GAAA,EAAK,EAAE,SAAA,EAAW,MAAM,CAAA;AAEpC,EAAA,MAAM,QAAA,GAAW;AAAA,IACf,SAAS,IAAA,CAAK,OAAA;AAAA,IACd,UAAU,MAAA,CAAO,WAAA;AAAA,MACf,MAAA,CAAO,OAAA,CAAQ,IAAA,CAAK,QAAQ,EAAE,GAAA,CAAI,CAAC,CAAC,EAAA,EAAI,EAAE,QAAA,EAAU,GAAG,OAAA,EAAS,CAAA,KAAM;AAAA,QACpE,EAAA;AAAA,QACA,EAAE,GAAG,OAAA,EAAS,MAAA,EAAQ,QAAA;AAAS,OAChC;AAAA;AACH,GACF;AACA,EAAA,MAAMC,SAAAA,CAAU,kBAAiB,EAAG,IAAA,CAAK,UAAU,QAAA,EAAU,IAAA,EAAM,CAAC,CAAA,GAAI,IAAA,EAAM;AAAA,IAC5E,QAAA,EAAU,MAAA;AAAA,IACV,IAAA,EAAM;AAAA,GACP,CAAA;AACH;AAGA,eAAsB,iBAAiB,QAAA,EAA2C;AAChF,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,EAAiB;AACpC,EAAA,MAAM,GAAA,GAAM,MAAA,CAAO,MAAA,CAAO,IAAA,CAAK,QAAQ,CAAA;AACvC,EAAA,OAAO,QAAA,KAAa,SAAY,GAAA,GAAM,GAAA,CAAI,OAAO,CAAA,CAAA,KAAK,CAAA,CAAE,aAAa,QAAQ,CAAA;AAC/E;AAGA,eAAsB,eAAe,EAAA,EAA8C;AACjF,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,EAAiB;AACpC,EAAA,OAAO,IAAA,CAAK,SAAS,EAAE,CAAA;AACzB;AAGA,eAAsB,eAAe,OAAA,EAAqC;AACxE,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,EAAiB;AACpC,EAAA,IAAA,CAAK,QAAA,CAAS,OAAA,CAAQ,EAAE,CAAA,GAAI,OAAA;AAC5B,EAAA,MAAM,kBAAkB,IAAI,CAAA;AAC9B;AAGA,eAAsB,kBAAkB,EAAA,EAA8B;AACpE,EAAA,MAAM,IAAA,GAAO,MAAM,gBAAA,EAAiB;AACpC,EAAA,IAAI,EAAE,EAAA,IAAM,IAAA,CAAK,QAAA,CAAA,EAAW,OAAO,KAAA;AACnC,EAAA,OAAO,IAAA,CAAK,SAAS,EAAE,CAAA;AACvB,EAAA,MAAM,kBAAkB,IAAI,CAAA;AAC5B,EAAA,OAAO,IAAA;AACT;ACzBO,IAAM,0BAAA,GAAN,cAAyC,KAAA,CAAM;AAAA,EACpD,YAAY,OAAA,EAAiB;AAC3B,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,4BAAA;AAAA,EACd;AACF;AAEA,IAAM,YAAA,GAAsC,CAAC,cAAA,EAAgB,SAAS,CAAA;AAItE,IAAM,OAAA,GAAU,8BAAA;AAoBT,SAAS,oBAAoB,KAAA,EAAqD;AACvF,EAAA,MAAM,EAAA,GAAA,CAAM,KAAA,CAAM,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AACjC,EAAA,IAAI,CAAC,EAAA,EAAI,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AAC9D,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,EAAE,CAAA,EAAG;AACrB,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,OAAO,EAAE,CAAA,yFAAA;AAAA,KAEX;AAAA,EACF;AAEA,EAAA,MAAM,QAAA,GAAA,CAAY,KAAA,CAAM,QAAA,IAAY,EAAA,EAAI,IAAA,EAAK;AAC7C,EAAA,IAAI,CAAC,QAAA,EAAU,MAAM,IAAI,2BAA2B,sBAAsB,CAAA;AAC1E,EAAA,IAAI,CAAC,OAAA,CAAQ,IAAA,CAAK,QAAQ,CAAA,EAAG;AAC3B,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,aAAa,QAAQ,CAAA,wDAAA;AAAA,KACvB;AAAA,EACF;AAEA,EAAA,MAAM,SAAS,KAAA,CAAM,MAAA;AACrB,EAAA,IAAI,CAAC,YAAA,CAAa,QAAA,CAAS,MAAM,CAAA,EAAG;AAClC,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,CAAA,sBAAA,EAAyB,aAAa,IAAA,CAAK,KAAK,CAAC,CAAA,OAAA,EAAU,MAAA,CAAO,MAAM,CAAC,CAAA,EAAA;AAAA,KAC3E;AAAA,EACF;AAIA,EAAA,MAAM,aAAa,KAAA,CAAM,UAAA,KAAe,SAAY,KAAA,CAAM,UAAA,CAAW,MAAK,GAAI,MAAA;AAC9E,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAK;AAElC,EAAA,IAAI,WAAW,SAAA,EAAW;AACxB,IAAA,IAAI,MAAA,EAAQ;AACV,MAAA,MAAM,IAAI,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,UAAA,EAAY,MAAM,IAAI,2BAA2B,wBAAwB,CAAA;AAAA,EAChF,CAAA,MAAO;AACL,IAAA,IAAI,cAAc,MAAA,EAAQ;AACxB,MAAA,MAAM,IAAI,0BAAA;AAAA,QACR;AAAA,OACF;AAAA,IACF;AACA,IAAA,IAAI,CAAC,UAAA,IAAc,CAAC,MAAA,EAAQ;AAC1B,MAAA,MAAM,IAAI,2BAA2B,kCAAkC,CAAA;AAAA,IACzE;AAAA,EACF;AAEA,EAAA,MAAM,KAAA,GAAQ,KAAA,CAAM,KAAA,EAAO,IAAA,EAAK;AAChC,EAAA,MAAM,aAAA,GAAgB,KAAA,CAAM,aAAA,EAAe,IAAA,EAAK;AAChD,EAAA,IAAI,aAAA,KAAkB,UAAa,aAAA,KAAkB,EAAA,IAAM,CAAC,OAAA,CAAQ,IAAA,CAAK,aAAa,CAAA,EAAG;AACvF,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,kBAAkB,aAAa,CAAA,wDAAA;AAAA,KACjC;AAAA,EACF;AAEA,EAAA,MAAM,MAAA,GAAS,KAAA,CAAM,MAAA,EAAQ,IAAA,EAAK;AAElC,EAAA,OAAO;AAAA,IACL,EAAA;AAAA,IACA,QAAA;AAAA,IACA,MAAA;AAAA,IACA,GAAI,UAAA,GAAa,EAAE,UAAA,KAAe,EAAC;AAAA,IACnC,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW,EAAC;AAAA,IAC3B,GAAI,KAAA,GAAQ,EAAE,KAAA,KAAU,EAAC;AAAA,IACzB,GAAI,aAAA,GAAgB,EAAE,aAAA,KAAkB,EAAC;AAAA,IACzC,GAAI,MAAA,GAAS,EAAE,MAAA,KAAW;AAAC,GAC7B;AACF;AASO,SAAS,oBAAoB,KAAA,EAIzB;AACT,EAAA,MAAM,KAAA,GAAQ,CAAC,YAAA,EAAc,MAAA,EAAQ,MAAM,QAAQ,CAAA;AACnD,EAAA,IAAI,KAAA,CAAM,MAAA,KAAW,cAAA,EAAgB,KAAA,CAAM,KAAK,KAAK,CAAA;AACrD,EAAA,IAAI,KAAA,CAAM,SAAA,EAAW,KAAA,CAAM,IAAA,CAAK,MAAM,SAAS,CAAA;AAC/C,EAAA,OAAO,KAAA,CAAM,KAAK,GAAG,CAAA;AACvB;AAIO,SAAS,sBAAsB,MAAA,EAAwB;AAC5D,EAAA,OAAO,UAAA,CAAW,QAAQ,CAAA,CAAE,MAAA,CAAO,MAAA,EAAQ,MAAM,CAAA,CAAE,MAAA,CAAO,KAAK,CAAA,CAAE,KAAA,CAAM,CAAA,EAAG,EAAE,CAAA;AAC9E;AAMA,IAAM,iBAAA,GAAoB,CAAA;AAiBnB,SAAS,mBAAmB,MAAA,EAAoC;AACrE,EAAA,OAAO;AAAA,IACL,WAAA,EAAa,sBAAsB,MAAM,CAAA;AAAA,IACzC,GAAI,MAAA,CAAO,MAAA,IAAU,iBAAA,GAAoB,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,CAAM,EAAE,CAAA,EAAE,GAAI;AAAC,GAC1E;AACF;AAIA,SAAS,eAAe,MAAA,EAAmC;AACzD,EAAA,OAAO,MAAA,KAAW,iBAAiB,KAAA,GAAQ,KAAA;AAC7C;AASA,eAAsB,iBAAA,CACpB,OACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,CAAA,GAAI,oBAAoB,KAAK,CAAA;AAEnC,EAAA,IAAI,MAAM,IAAA,CAAK,UAAA,CAAW,CAAA,CAAE,EAAE,CAAA,EAAG;AAC/B,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,CAAA,mBAAA,EAAsB,EAAE,EAAE,CAAA,0DAAA;AAAA,KAC5B;AAAA,EACF;AAGA,EAAA,IAAI,CAAA,CAAE,WAAW,MAAA,EAAW;AAC1B,IAAA,MAAMC,QAAAA,GAAuB;AAAA,MAC3B,IAAI,CAAA,CAAE,EAAA;AAAA,MACN,UAAU,CAAA,CAAE,QAAA;AAAA,MACZ,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,GAAI,EAAE,KAAA,GAAQ,EAAE,OAAO,CAAA,CAAE,KAAA,KAAU,EAAC;AAAA,MACpC,GAAI,EAAE,MAAA,GAAS,EAAE,QAAQ,CAAA,CAAE,MAAA,KAAW;AAAC,KACzC;AACA,IAAA,MAAM,IAAA,CAAK,WAAWA,QAAO,CAAA;AAC7B,IAAA,OAAO;AAAA,MACL,IAAIA,QAAAA,CAAQ,EAAA;AAAA,MACZ,UAAUA,QAAAA,CAAQ,QAAA;AAAA,MAClB,QAAQA,QAAAA,CAAQ,MAAA;AAAA,MAChB,QAAQ,CAAA,CAAE,MAAA;AAAA,MACV,GAAIA,SAAQ,KAAA,GAAQ,EAAE,OAAOA,QAAAA,CAAQ,KAAA,KAAU,EAAC;AAAA,MAChD,GAAIA,SAAQ,MAAA,GAAS,EAAE,QAAQA,QAAAA,CAAQ,MAAA,KAAW;AAAC,KACrD;AAAA,EACF;AAEA,EAAA,MAAM,aAAa,CAAA,CAAE,UAAA;AAErB,EAAA,MAAM,QAAA,GAAW,MAAM,IAAA,CAAK,YAAA,EAAa;AACzC,EAAA,MAAM,SAAA,GAAY,IAAI,GAAA,CAAI,QAAA,CAAS,IAAI,CAAA,CAAA,KAAK,CAAA,CAAE,aAAa,CAAC,CAAA;AAE5D,EAAA,IAAI,aAAA,GAAgB,CAAA,CAAE,aAAA,IAAiB,mBAAA,CAAoB,CAAC,CAAA;AAI5D,EAAA,IAAI,CAAC,CAAA,CAAE,aAAA,IAAiB,SAAA,CAAU,GAAA,CAAI,aAAa,CAAA,EAAG;AACpD,IAAA,aAAA,GAAgB,oBAAoB,EAAE,GAAG,GAAG,SAAA,EAAW,CAAA,CAAE,IAAI,CAAA;AAAA,EAC/D;AAEA,EAAA,MAAM,KAAK,KAAA,CAAM,KAAA;AAAA,IACf,EAAE,MAAM,aAAA,EAAc;AAAA,IACtB,EAAE,KAAA,EAAO,UAAA,EAAY,MAAM,cAAA,CAAe,CAAA,CAAE,MAAM,CAAA;AAAE,GACtD;AAEA,EAAA,MAAM,OAAA,GAAuB;AAAA,IAC3B,IAAI,CAAA,CAAE,EAAA;AAAA,IACN,UAAU,CAAA,CAAE,QAAA;AAAA,IACZ,QAAQ,CAAA,CAAE,MAAA;AAAA,IACV,aAAA;AAAA,IACA,GAAI,EAAE,KAAA,GAAQ,EAAE,OAAO,CAAA,CAAE,KAAA,KAAU,EAAC;AAAA,IACpC,GAAI,EAAE,MAAA,GAAS,EAAE,QAAQ,CAAA,CAAE,MAAA,KAAW;AAAC,GACzC;AACA,EAAA,MAAM,IAAA,CAAK,WAAW,OAAO,CAAA;AAE7B,EAAA,OAAO;AAAA,IACL,IAAI,OAAA,CAAQ,EAAA;AAAA,IACZ,UAAU,OAAA,CAAQ,QAAA;AAAA,IAClB,QAAQ,OAAA,CAAQ,MAAA;AAAA,IAChB,aAAA;AAAA,IACA,GAAI,QAAQ,KAAA,GAAQ,EAAE,OAAO,OAAA,CAAQ,KAAA,KAAU,EAAC;AAAA,IAChD,GAAI,QAAQ,MAAA,GAAS,EAAE,QAAQ,OAAA,CAAQ,MAAA,KAAW,EAAC;AAAA,IACnD,WAAA,EAAa,sBAAsB,UAAU;AAAA,GAC/C;AACF;AASA,eAAsB,iBAAA,CACpB,IACA,IAAA,EAC6B;AAC7B,EAAA,MAAM,OAAA,GAAA,CAAW,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AAEnE,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,EAAS,OAAO,EAAE,OAAA,EAAS,KAAA,EAAO,IAAI,OAAA,EAAQ;AAEnD,EAAA,MAAM,IAAA,CAAK,cAAc,OAAO,CAAA;AAGhC,EAAA,IAAI,OAAA,CAAQ,kBAAkB,MAAA,EAAW;AACvC,IAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,EAAA,EAAI,OAAA,EAAQ;AAAA,EACtC;AAEA,EAAA,MAAM,eAAA,GAAA,CAAmB,MAAM,IAAA,CAAK,YAAA,EAAa,EAAG,IAAA;AAAA,IAClD,CAAA,CAAA,KAAK,CAAA,CAAE,aAAA,KAAkB,OAAA,CAAQ;AAAA,GACnC;AACA,EAAA,IAAI,CAAC,eAAA,IAAmB,IAAA,CAAK,KAAA,CAAM,MAAA,EAAQ;AACzC,IAAA,MAAM,KAAK,KAAA,CAAM,MAAA,CAAO,EAAE,IAAA,EAAM,OAAA,CAAQ,eAAe,CAAA;AAAA,EACzD;AAEA,EAAA,OAAO,EAAE,OAAA,EAAS,IAAA,EAAM,IAAI,OAAA,EAAS,aAAA,EAAe,QAAQ,aAAA,EAAc;AAC5E;AAUA,eAAsB,qBAAA,CACpB,EAAA,EACA,OAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAA,CAAW,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AAEnE,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,0BAAA,CAA2B,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AAIA,EAAA,MAAM,EAAE,QAAA,EAAU,KAAA,EAAO,GAAG,MAAK,GAAI,OAAA;AACrC,EAAA,MAAM,OAAA,GAAuB,OAAA,GAAU,EAAE,GAAG,IAAA,KAAS,EAAE,GAAG,IAAA,EAAM,QAAA,EAAU,IAAA,EAAK;AAC/E,EAAA,MAAM,IAAA,CAAK,WAAW,OAAO,CAAA;AAC7B,EAAA,OAAO,OAAA;AACT;AAUA,eAAsB,oBAAA,CACpB,EAAA,EACA,QAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAA,CAAW,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AACnE,EAAA,IAAI,QAAA,CAAS,IAAA,KAAS,KAAA,IAAS,QAAA,CAAS,SAAS,OAAA,EAAS;AACxD,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,CAAA,2CAAA,EAA8C,MAAA,CAAO,QAAA,CAAS,IAAI,CAAC,CAAA,EAAA;AAAA,KACrE;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,0BAAA,CAA2B,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AAEA,EAAA,MAAM,EAAE,MAAA,EAAQ,KAAA,EAAO,GAAG,MAAK,GAAI,OAAA;AACnC,EAAA,IAAI,QAAA,CAAS,SAAS,KAAA,EAAO;AAG3B,IAAA,MAAMC,QAAAA,GAAuB,EAAE,GAAG,IAAA,EAAK;AACvC,IAAA,MAAM,IAAA,CAAK,WAAWA,QAAO,CAAA;AAC7B,IAAA,OAAOA,QAAAA;AAAA,EACT;AAEA,EAAA,MAAM,MAAM,CAAC,GAAG,IAAI,GAAA,CAAA,CAAK,QAAA,CAAS,OAAO,EAAC,EAAG,GAAA,CAAI,CAAA,CAAA,KAAK,EAAE,IAAA,EAAM,EAAE,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AAChF,EAAA,MAAM,OAAA,GAAuB,EAAE,GAAG,IAAA,EAAM,QAAQ,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAI,EAAE;AACvE,EAAA,MAAM,IAAA,CAAK,WAAW,OAAO,CAAA;AAC7B,EAAA,OAAO,OAAA;AACT;AAIA,IAAM,gBAAA,GAAmB,GAAA;AA2BzB,eAAsB,iBAAA,CACpB,EAAA,EACA,KAAA,EACA,IAAA,EACsB;AACtB,EAAA,MAAM,OAAA,GAAA,CAAW,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AAEnE,EAAA,MAAM,WAAW,MAAA,CAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAK,OAAO,OAAO,CAAA;AACpE,EAAA,MAAM,gBAAgB,MAAA,CAAO,SAAA,CAAU,cAAA,CAAe,IAAA,CAAK,OAAO,YAAY,CAAA;AAC9E,EAAA,IAAI,CAAC,QAAA,IAAY,CAAC,aAAA,EAAe;AAC/B,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR;AAAA,KACF;AAAA,EACF;AAEA,EAAA,IAAI,SAAA;AACJ,EAAA,IAAI,QAAA,IAAY,KAAA,CAAM,KAAA,KAAU,IAAA,EAAM;AAIpC,IAAA,IAAI,OAAO,KAAA,CAAM,KAAA,KAAU,QAAA,EAAU;AACnC,MAAA,MAAM,IAAI,2BAA2B,gCAAgC,CAAA;AAAA,IACvE;AACA,IAAA,SAAA,GAAY,KAAA,CAAM,MAAM,IAAA,EAAK;AAC7B,IAAA,IAAI,CAAC,SAAA,EAAW;AACd,MAAA,MAAM,IAAI,2BAA2B,gDAAgD,CAAA;AAAA,IACvF;AACA,IAAA,IAAI,SAAA,CAAU,SAAS,gBAAA,EAAkB;AACvC,MAAA,MAAM,IAAI,0BAAA;AAAA,QACR,yBAAyB,gBAAgB,CAAA,WAAA;AAAA,OAC3C;AAAA,IACF;AAAA,EACF;AAEA,EAAA,IAAI,cAAA;AACJ,EAAA,IAAI,aAAA,IAAiB,KAAA,CAAM,UAAA,KAAe,IAAA,EAAM;AAC9C,IAAA,MAAM,MAAA,GAAS,gBAAA,CAAiB,SAAA,CAAU,KAAA,CAAM,UAAU,CAAA;AAC1D,IAAA,IAAI,CAAC,OAAO,OAAA,EAAS;AACnB,MAAA,MAAM,IAAI,0BAAA;AAAA,QACR,CAAA,uBAAA,EAA0B,MAAA,CAAO,KAAA,CAAM,MAAA,CAAO,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,OAAO,CAAA,CAAE,IAAA,CAAK,IAAI,CAAC,CAAA;AAAA,OAC9E;AAAA,IACF;AACA,IAAA,cAAA,GAAiB,MAAA,CAAO,IAAA;AAAA,EAC1B;AAEA,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,0BAAA,CAA2B,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AAEA,EAAA,MAAM,EAAE,KAAA,EAAO,UAAA,EAAY,YAAY,eAAA,EAAiB,GAAG,MAAK,GAAI,OAAA;AACpE,EAAA,MAAM,OAAA,GAAuB,EAAE,GAAG,IAAA,EAAK;AACvC,EAAA,IAAI,QAAA,EAAU;AACZ,IAAA,IAAI,SAAA,KAAc,MAAA,EAAW,OAAA,CAAQ,KAAA,GAAQ,SAAA;AAAA,EAC/C,CAAA,MAAA,IAAW,OAAA,CAAQ,KAAA,KAAU,MAAA,EAAW;AACtC,IAAA,OAAA,CAAQ,QAAQ,OAAA,CAAQ,KAAA;AAAA,EAC1B;AACA,EAAA,IAAI,aAAA,EAAe;AACjB,IAAA,IAAI,cAAA,KAAmB,MAAA,EAAW,OAAA,CAAQ,UAAA,GAAa,cAAA;AAAA,EACzD,CAAA,MAAA,IAAW,OAAA,CAAQ,UAAA,KAAe,MAAA,EAAW;AAC3C,IAAA,OAAA,CAAQ,aAAa,OAAA,CAAQ,UAAA;AAAA,EAC/B;AAEA,EAAA,MAAM,IAAA,CAAK,WAAW,OAAO,CAAA;AAC7B,EAAA,OAAO,OAAA;AACT;AA4CA,eAAsB,wBAAA,CACpB,EAAA,EACA,UAAA,EACA,IAAA,EACyC;AACzC,EAAA,MAAM,OAAA,GAAA,CAAW,EAAA,IAAM,EAAA,EAAI,IAAA,EAAK;AAChC,EAAA,IAAI,CAAC,OAAA,EAAS,MAAM,IAAI,2BAA2B,gBAAgB,CAAA;AAEnE,EAAA,MAAM,OAAA,GAAU,MAAM,IAAA,CAAK,UAAA,CAAW,OAAO,CAAA;AAC7C,EAAA,IAAI,CAAC,OAAA,EAAS;AACZ,IAAA,MAAM,IAAI,0BAAA,CAA2B,CAAA,oBAAA,EAAuB,OAAO,CAAA,CAAA,CAAG,CAAA;AAAA,EACxE;AACA,EAAA,IAAI,CAAC,OAAA,CAAQ,MAAA,IAAU,OAAA,CAAQ,MAAA,CAAO,SAAS,OAAA,EAAS;AACtD,IAAA,MAAM,IAAI,0BAAA;AAAA,MACR,YAAY,OAAO,CAAA,4HAAA;AAAA,KAErB;AAAA,EACF;AAEA,EAAA,MAAM,OAAA,GAAU,CAAC,GAAG,IAAI,IAAI,UAAA,CAAW,GAAA,CAAI,CAAA,CAAA,KAAK,CAAA,CAAE,MAAM,CAAA,CAAE,MAAA,CAAO,OAAO,CAAC,CAAC,CAAA;AAC1E,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,CAAO,GAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,OAAO,CAAA;AAC/B,EAAA,MAAM,OAAA,GAAU,IAAI,GAAA,CAAI,OAAO,CAAA;AAC/B,EAAA,MAAM,KAAA,GAAQ,QAAQ,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAA;AACjD,EAAA,MAAM,OAAA,GAAU,QAAQ,MAAA,CAAO,CAAA,CAAA,KAAK,CAAC,OAAA,CAAQ,GAAA,CAAI,CAAC,CAAC,CAAA;AAEnD,EAAA,MAAM,OAAA,GAAuB,EAAE,GAAG,OAAA,EAAS,MAAA,EAAQ,EAAE,IAAA,EAAM,OAAA,EAAS,GAAA,EAAK,OAAA,EAAQ,EAAE;AACnF,EAAA,MAAM,IAAA,CAAK,WAAW,OAAO,CAAA;AAC7B,EAAA,OAAO,EAAE,OAAA,EAAS,OAAA,EAAS,KAAA,EAAO,OAAA,EAAQ;AAC5C;;;AC9iBO,SAAS,eAAA,CACd,UACA,KAAA,EACsB;AACtB,EAAA,MAAM,QAAA,GAAW,QAAA,CAAS,eAAA,CAAgB,KAAK,CAAA;AAC/C,EAAA,IAAI,aAAa,MAAA,EAAW;AAC1B,IAAA,MAAM,IAAI,KAAA;AAAA,MACR,CAAA,0BAAA,EAA6B,QAAA,CAAS,EAAE,CAAA,kCAAA,EAAqC,KAAK,CAAA,CAAA;AAAA,KACpF;AAAA,EACF;AACA,EAAA,OAAO,EAAE,QAAA,EAAS;AACpB;AAMO,SAAS,kBAAA,CACd,UACA,KAAA,EACc;AACd,EAAA,OAAO,CAAC,GAAI,QAAA,CAAS,eAAe,KAAK,CAAA,IAAK,EAAG,CAAA;AACnD;AAQO,SAAS,gBAAA,CACd,QAAA,EACA,QAAA,EACA,KAAA,EACe;AACf,EAAA,MAAM,EAAE,QAAA,EAAS,GAAI,eAAA,CAAgB,UAAU,KAAK,CAAA;AACpD,EAAA,MAAM,OAAA,GAAU,kBAAA,CAAmB,QAAA,EAAU,KAAK,CAAA;AAClD,EAAA,OAAO,QAAA,CAAS,MAAA;AAAA,IACd,CAAA,CAAA,KAAK,CAAC,CAAA,CAAE,QAAA,IAAY,CAAA,CAAE,aAAa,QAAA,IAAY,OAAA,CAAQ,QAAA,CAAS,CAAA,CAAE,MAAM;AAAA,GAC1E;AACF;;;ACyCO,IAAM,SAAA,GAAY;AAClB,IAAM,YAAA,GAAe","file":"index.mjs","sourcesContent":["/**\n * AIP-50 auth-provider frontmatter / literal Zod schema.\n *\n * Single source of truth for both authoring paths: `defineAuthProvider`\n * (TS literal) and `parseAuthProviderManifest` (.md) run this same schema,\n * so a malformed literal and a malformed manifest fail identically.\n */\n\nimport { z } from \"zod\"\n\nexport const tokenStoreSpecSchema = z\n  .object({\n    keychain: z.string().min(1),\n    path: z.string().min(1).optional(),\n    account: z.string().min(1).optional(),\n  })\n  .strict()\n\nexport const patAuthConfigSchema = z\n  .object({\n    flow: z.literal(\"pat\"),\n    tokenStore: tokenStoreSpecSchema,\n  })\n  .strict()\n\nexport const serviceAuthConfigSchema = z\n  .object({\n    flow: z.literal(\"service-auth\"),\n    clientId: z.string().min(1).optional(),\n    loginHint: z.string().min(1).optional(),\n    tokenStore: tokenStoreSpecSchema,\n  })\n  .strict()\n\nexport const deviceCodeAuthConfigSchema = z\n  .object({\n    flow: z.literal(\"device-code\"),\n    clientId: z.string().min(1).optional(),\n    scope: z.string().min(1).optional(),\n    deviceLabel: z.string().min(1).optional(),\n    tokenStore: tokenStoreSpecSchema,\n  })\n  .strict()\n\nexport const authConfigSchema = z.discriminatedUnion(\"flow\", [\n  patAuthConfigSchema,\n  serviceAuthConfigSchema,\n  deviceCodeAuthConfigSchema,\n])\n\nexport const installConfigSchema = z\n  .object({\n    sealKey: z.string().min(1),\n    secretBacked: z.string().min(1),\n  })\n  .strict()\n\nexport const authProviderFrontmatterSchema = z\n  .object({\n    id: z.string().min(2).max(80),\n    description: z.string().min(1).max(2000),\n    apiBase: z.string().url(),\n    auth: authConfigSchema,\n    install: installConfigSchema.optional(),\n    // Recommended values \"tunnel\" | \"api\" | \"mcp\" — free-form allowed, not an enum.\n    audience: z.string().min(1).optional(),\n  })\n  .strict()\n  .describe(\n    \"AIP-50 auth-provider manifest: how a CLI tool authenticates to an API server and (optionally) where to call the AIP-19 provision endpoints.\",\n  )\n\nexport type AuthProviderFrontmatter = z.infer<typeof authProviderFrontmatterSchema>\n","/**\n * `defineAuthProvider` — TS-literal authoring path for an auth-provider.\n *\n * Built on `createDoctype` so it gets the cross-AIP invariants: id-pattern,\n * ≤2000-char description, frozen handle, canonical error prefix. Field-level\n * validation uses the shared Zod from `./schema.ts`, so a malformed literal\n * fails with the same diagnostic as a malformed `.md`.\n */\n\nimport { createDoctype } from \"@agentproto/define-doctype\"\nimport { authProviderFrontmatterSchema } from \"./schema.js\"\nimport type { AuthProviderDefinition, AuthProviderHandle } from \"./types.js\"\n\nexport const defineAuthProvider = createDoctype<\n  AuthProviderDefinition,\n  AuthProviderHandle\n>({\n  aip: 50,\n  name: \"authProvider\",\n  validate(def) {\n    const result = authProviderFrontmatterSchema.safeParse(def)\n    if (!result.success) {\n      throw new Error(\n        `defineAuthProvider (AIP-50): ${result.error.issues\n          .map((i) => `${i.path.join(\".\")}: ${i.message}`)\n          .join(\"; \")}`,\n      )\n    }\n  },\n  build(def) {\n    return {\n      ...def,\n      auth: Object.freeze({ ...def.auth }),\n      install: def.install ? Object.freeze({ ...def.install }) : undefined,\n    }\n  },\n})\n","/**\n * `.md` authoring path for an auth-provider — parse a frontmatter manifest\n * into a frozen handle. Mirrors `parseRecipeManifest` from AIP-19: gray-matter\n * splits the frontmatter, the shared Zod validates it, `defineAuthProvider`\n * builds the handle so both authoring paths converge on one validated shape.\n *\n * This parser is the extension seam: a host reads its own external `.md`\n * manifests (e.g. vendor-shipped `guilde.auth.md`) and registers them without\n * editing this package.\n */\n\nimport matter from \"gray-matter\"\nimport {\n  authProviderFrontmatterSchema,\n  type AuthProviderFrontmatter,\n} from \"./schema.js\"\nimport { defineAuthProvider } from \"./define-auth-provider.js\"\nimport type { AuthProviderHandle } from \"./types.js\"\n\nexport interface AuthProviderManifest {\n  frontmatter: AuthProviderFrontmatter\n  body: string\n}\n\nexport function parseAuthProviderManifestRaw(\n  source: string,\n): AuthProviderManifest {\n  const parsed = matter(source)\n  if (Object.keys(parsed.data).length === 0) {\n    throw new Error(\"parseAuthProviderManifest: missing or empty frontmatter\")\n  }\n  const result = authProviderFrontmatterSchema.safeParse(parsed.data)\n  if (!result.success) {\n    throw new Error(\n      `parseAuthProviderManifest: invalid frontmatter — ${result.error.issues\n        .map((i) => `${i.path.join(\".\")}: ${i.message}`)\n        .join(\"; \")}`,\n    )\n  }\n  return { frontmatter: result.data, body: parsed.content }\n}\n\n/** Parse an auth-provider `.md` straight to a frozen handle. */\nexport function parseAuthProviderManifest(source: string): AuthProviderHandle {\n  const { frontmatter } = parseAuthProviderManifestRaw(source)\n  return defineAuthProvider(frontmatter)\n}\n","/**\n * Builtin auth-provider manifests — shipped as TS literals so they bundle\n * into the tsup output with zero filesystem reads at runtime. A host adds more\n * by parsing its own `.md` with `parseAuthProviderManifest` and registering\n * the result via `registerAuthProvider`.\n */\n\nimport { defineAuthProvider } from \"./define-auth-provider.js\"\nimport type { AuthProviderHandle } from \"./types.js\"\n\n/** Guilde AI company platform.\n *\n *  Authenticates via the AIP-50 service-auth claim ceremony: browser opens,\n *  user clicks Approve, bureau stores the oat_* access token.\n *  Discovery from /.well-known/oauth-protected-resource supplies live endpoints;\n *  the static fields below are the offline fallback. */\nexport const guildeAuthProvider = defineAuthProvider({\n  id: \"guilde\",\n  description:\n    \"Guilde AI company platform. Authenticate via a browser-approve flow — no key to paste.\",\n  apiBase: \"https://api.guilde.work\",\n  audience: \"api\",\n  auth: {\n    flow: \"service-auth\",\n    clientId: \"agentproto-cli\",\n    tokenStore: {\n      keychain: \"bureau-guilde\",\n      account: \"{server}\",\n    },\n  },\n  install: {\n    sealKey: \"/guilde/api/v1/connectors/seal-key\",\n    secretBacked: \"/guilde/api/v1/guilds/{guildId}/connectors/secret-backed\",\n  },\n})\n\nexport const BUILTIN_AUTH_PROVIDERS: readonly AuthProviderHandle[] = [\n  guildeAuthProvider,\n]\n","/**\n * Auth-provider registry — id → handle lookup, pre-seeded with builtins.\n *\n * Mirrors the provision-recipe registry shape (AIP-19). Re-registering an id\n * overrides it (last write wins), so a host can shadow a builtin.\n */\n\nimport { BUILTIN_AUTH_PROVIDERS } from \"./builtins.js\"\nimport type { AuthProviderHandle } from \"./types.js\"\n\nconst _registry = new Map<string, AuthProviderHandle>()\nfor (const p of BUILTIN_AUTH_PROVIDERS) _registry.set(p.id, p)\n\nexport function registerAuthProvider(provider: AuthProviderHandle): void {\n  _registry.set(provider.id, provider)\n}\n\nexport function getAuthProvider(id: string): AuthProviderHandle | undefined {\n  return _registry.get(id)\n}\n\nexport function listAuthProviders(): AuthProviderHandle[] {\n  return [..._registry.values()]\n}\n\nexport function listAuthProviderIds(): string[] {\n  return [..._registry.keys()]\n}\n","/**\n * Internal HTTP helpers — not part of the public API.\n *\n * Every network call in this package (discovery, the claim ceremony, token\n * refresh) must be bounded: a hung or slow server MUST NOT stall the CLI\n * indefinitely. `deadlineSignal` combines an optional caller `AbortSignal`\n * with a timeout into one signal to hand to `fetch`.\n *\n * Implemented with a plain `AbortController` + `setTimeout` rather than\n * `AbortSignal.any`/`AbortSignal.timeout` so it works on every runtime that\n * ships `fetch`, without assuming a specific Node minor.\n */\n\n/** Default per-request timeout. Discovery and token calls are small JSON\n *  round-trips; 10s is generous without hanging an interactive CLI. */\nexport const DEFAULT_HTTP_TIMEOUT_MS = 10_000\n\n/**\n * AIP-50 §Security: discovery and auth requests MUST use HTTPS, to defeat\n * MITM/TOCTOU on the `.well-known` and token endpoints. Loopback http is\n * allowed — it isn't network-exposed — so local development against a dev\n * server keeps working. Throws on any other insecure URL.\n */\nexport function assertSecureUrl(url: string): void {\n  let u: URL\n  try {\n    u = new URL(url)\n  } catch {\n    throw new Error(`invalid URL: ${url}`)\n  }\n  if (u.protocol === \"https:\") return\n  const host = u.hostname\n  const isLoopback =\n    host === \"localhost\" ||\n    host === \"127.0.0.1\" ||\n    host === \"::1\" ||\n    host === \"[::1]\" ||\n    host.endsWith(\".localhost\")\n  if (u.protocol === \"http:\" && isLoopback) return\n  throw new Error(\n    `insecure URL '${url}' — AIP-50 requires HTTPS for discovery/auth ` +\n      `(loopback http is allowed for local development).`,\n  )\n}\n\nexport interface DeadlineHandle {\n  /** Signal to pass to `fetch(url, { signal })`. */\n  signal: AbortSignal\n  /** Cancel the timer + detach the outer listener once the request settles.\n   *  ALWAYS call this in a `finally` to avoid a dangling timer/listener. */\n  clear: () => void\n}\n\n/**\n * Build an `AbortSignal` that fires when EITHER the timeout elapses or the\n * caller's `outer` signal aborts.\n */\nexport function deadlineSignal(\n  timeoutMs: number,\n  outer?: AbortSignal,\n): DeadlineHandle {\n  const ctrl = new AbortController()\n  const onAbort = () => ctrl.abort(outer?.reason)\n\n  if (outer) {\n    if (outer.aborted) ctrl.abort(outer.reason)\n    else outer.addEventListener(\"abort\", onAbort, { once: true })\n  }\n\n  const timer = setTimeout(\n    () => ctrl.abort(new Error(`request timed out after ${timeoutMs}ms`)),\n    timeoutMs,\n  )\n  // Don't let a pending timeout keep the process alive on its own.\n  if (typeof timer !== \"number\") timer.unref()\n\n  return {\n    signal: ctrl.signal,\n    clear: () => {\n      clearTimeout(timer)\n      outer?.removeEventListener(\"abort\", onAbort)\n    },\n  }\n}\n\n/** `fetch` bounded by `deadlineSignal`. Merges any caller-supplied\n *  `init.signal` with the timeout. */\nexport async function fetchWithDeadline(\n  url: string,\n  init: RequestInit = {},\n  timeoutMs: number = DEFAULT_HTTP_TIMEOUT_MS,\n): Promise<Response> {\n  const { signal, clear } = deadlineSignal(timeoutMs, init.signal ?? undefined)\n  try {\n    return await fetch(url, { ...init, signal })\n  } finally {\n    clear()\n  }\n}\n","/**\n * Two-hop discovery per the auth.md standard (AIP-50 §Discovery algorithm),\n * with a second strategy for hosts that don't speak auth.md.\n *\n * Strategy 1 (OAuth PRM chain):\n *   Hop 1: GET {apiBase}/.well-known/oauth-protected-resource (PRM, RFC 8414)\n *     → extract authorization_servers[0] as authServerBase\n *   Hop 2: GET {authServerBase}/.well-known/oauth-authorization-server (AS metadata)\n *     → extract token_endpoint + agent_auth block\n *\n * Strategy 2 (agentproto-host.json), tried when strategy 1 fails:\n *   GET {apiBase}/.well-known/agentproto-host.json\n *     → extract device_authorization_endpoint + token_endpoint\n *\n * Callers MUST catch DiscoveryError and fall back to static manifest config —\n * discovery failures are common (server predates auth.md) and MUST NOT prevent\n * the PAT or other static flows from working.\n */\n\nimport { z } from \"zod\"\nimport type { DiscoveredEndpoints } from \"./types.js\"\nimport { fetchWithDeadline, assertSecureUrl } from \"./http.js\"\n\nexport class DiscoveryError extends Error {\n  readonly serverUrl: string\n  constructor(message: string, serverUrl: string) {\n    super(`DiscoveryError (${serverUrl}): ${message}`)\n    this.name = \"DiscoveryError\"\n    this.serverUrl = serverUrl\n  }\n}\n\n// Discovery JSON is server-controlled, so it's validated rather than asserted.\n// Everything is optional + `.loose()`: the document evolves, and the required\n// fields are enforced explicitly below with precise DiscoveryError messages.\nconst prmSchema = z\n  .object({\n    resource: z.string().optional(),\n    resource_name: z.string().optional(),\n    authorization_servers: z.array(z.string()).optional(),\n    scopes_supported: z.array(z.string()).optional(),\n    bearer_methods_supported: z.array(z.string()).optional(),\n  })\n  .loose()\n\nconst asMetaSchema = z\n  .object({\n    issuer: z.string().optional(),\n    token_endpoint: z.string().optional(),\n    revocation_endpoint: z.string().optional(),\n    device_authorization_endpoint: z.string().optional(),\n    grant_types_supported: z.array(z.string()).optional(),\n    agent_auth: z\n      .object({\n        skill: z.string().optional(),\n        identity_endpoint: z.string().optional(),\n        claim_endpoint: z.string().optional(),\n        events_endpoint: z.string().optional(),\n        identity_types_supported: z.array(z.string()).optional(),\n        identity_assertion: z\n          .object({ assertion_types_supported: z.array(z.string()).optional() })\n          .loose()\n          .optional(),\n      })\n      .loose()\n      .optional(),\n  })\n  .loose()\n\nconst hostJsonSchema = z\n  .object({\n    device_authorization_endpoint: z.string().optional(),\n    token_endpoint: z.string().optional(),\n    revocation_endpoint: z.string().optional(),\n  })\n  .loose()\n\ntype PRMShape = z.infer<typeof prmSchema>\ntype ASMetaShape = z.infer<typeof asMetaSchema>\ntype HostJsonShape = z.infer<typeof hostJsonSchema>\n\nexport interface DiscoverOptions {\n  /** Abort the discovery fetches (e.g. on user Ctrl-C). */\n  signal?: AbortSignal\n  /** Per-hop timeout. Defaults to DEFAULT_HTTP_TIMEOUT_MS. */\n  timeoutMs?: number\n}\n\nasync function discoverViaPRM(\n  base: string,\n  fetchOpts: RequestInit,\n  opts: DiscoverOptions,\n): Promise<DiscoveredEndpoints> {\n  // Hop 1 — PRM\n  const prmUrl = `${base}/.well-known/oauth-protected-resource`\n  let prm: PRMShape\n  try {\n    assertSecureUrl(prmUrl)\n    const res = await fetchWithDeadline(prmUrl, fetchOpts, opts.timeoutMs)\n    if (!res.ok) {\n      throw new DiscoveryError(\n        `PRM returned ${res.status} ${res.statusText}`,\n        base,\n      )\n    }\n    prm = prmSchema.parse(await res.json())\n  } catch (err) {\n    if (err instanceof DiscoveryError) throw err\n    throw new DiscoveryError(`PRM fetch failed: ${err}`, base)\n  }\n\n  const authServerBase = prm.authorization_servers?.[0]?.replace(/\\/$/, \"\")\n  if (!authServerBase) {\n    throw new DiscoveryError(\n      \"PRM missing authorization_servers[0]\",\n      base,\n    )\n  }\n\n  // Hop 2 — AS metadata\n  const asUrl = `${authServerBase}/.well-known/oauth-authorization-server`\n  let as: ASMetaShape\n  try {\n    assertSecureUrl(asUrl)\n    const res = await fetchWithDeadline(asUrl, fetchOpts, opts.timeoutMs)\n    if (!res.ok) {\n      throw new DiscoveryError(\n        `AS metadata returned ${res.status} ${res.statusText}`,\n        base,\n      )\n    }\n    as = asMetaSchema.parse(await res.json())\n  } catch (err) {\n    if (err instanceof DiscoveryError) throw err\n    throw new DiscoveryError(`AS metadata fetch failed: ${err}`, base)\n  }\n\n  const tokenEndpoint = as.token_endpoint\n  const identityEndpoint = as.agent_auth?.identity_endpoint\n  if (!tokenEndpoint) {\n    throw new DiscoveryError(\"AS metadata missing token_endpoint\", base)\n  }\n  if (!identityEndpoint) {\n    throw new DiscoveryError(\n      \"AS metadata missing agent_auth.identity_endpoint\",\n      base,\n    )\n  }\n\n  return {\n    resource: prm.resource ?? base,\n    resourceName: prm.resource_name,\n    authServerBase,\n    tokenEndpoint,\n    revocationEndpoint: as.revocation_endpoint,\n    identityEndpoint,\n    claimEndpoint: as.agent_auth?.claim_endpoint,\n    deviceAuthorizationEndpoint: as.device_authorization_endpoint,\n    identityTypesSupported: as.agent_auth?.identity_types_supported ?? [],\n    grantTypesSupported: as.grant_types_supported ?? [],\n  }\n}\n\nasync function discoverViaHostJson(\n  base: string,\n  fetchOpts: RequestInit,\n  opts: DiscoverOptions,\n): Promise<DiscoveredEndpoints> {\n  const url = `${base}/.well-known/agentproto-host.json`\n  let doc: HostJsonShape\n  try {\n    assertSecureUrl(url)\n    const res = await fetchWithDeadline(url, fetchOpts, opts.timeoutMs)\n    if (!res.ok) {\n      throw new DiscoveryError(\n        `agentproto-host.json returned ${res.status} ${res.statusText}`,\n        base,\n      )\n    }\n    doc = hostJsonSchema.parse(await res.json())\n  } catch (err) {\n    if (err instanceof DiscoveryError) throw err\n    throw new DiscoveryError(`agentproto-host.json fetch failed: ${err}`, base)\n  }\n\n  if (!doc.token_endpoint) {\n    throw new DiscoveryError(\n      \"agentproto-host.json missing token_endpoint\",\n      base,\n    )\n  }\n  if (!doc.device_authorization_endpoint) {\n    throw new DiscoveryError(\n      \"agentproto-host.json missing device_authorization_endpoint\",\n      base,\n    )\n  }\n\n  return {\n    resource: base,\n    authServerBase: base,\n    tokenEndpoint: doc.token_endpoint,\n    revocationEndpoint: doc.revocation_endpoint,\n    deviceAuthorizationEndpoint: doc.device_authorization_endpoint,\n    identityTypesSupported: [],\n    grantTypesSupported: [],\n  }\n}\n\nexport async function discoverEndpoints(\n  apiBase: string,\n  opts: DiscoverOptions = {},\n): Promise<DiscoveredEndpoints> {\n  const base = apiBase.replace(/\\/$/, \"\")\n  // AIP-50 §Security: HTTPS only (loopback exempt for dev), and never follow\n  // redirects on discovery — a 3xx is treated as a failure, not chased to a\n  // potentially-rogue endpoint.\n  const fetchOpts: RequestInit = {\n    signal: opts.signal,\n    redirect: \"manual\",\n  }\n\n  try {\n    return await discoverViaPRM(base, fetchOpts, opts)\n  } catch (prmErr) {\n    // A caller-initiated abort is terminal — don't fire a second round of\n    // requests on a signal that has already aborted (its \"abort\" event has\n    // already fired once and a fresh listener on it will never see it again,\n    // hanging the fallback forever).\n    if (opts.signal?.aborted) throw prmErr\n    // Second strategy: a host that doesn't speak the auth.md PRM chain may\n    // still expose device-code endpoints via agentproto-host.json. If that\n    // also fails, surface the ORIGINAL PRM error — it's almost always the\n    // more informative one (host.json 404s are the common case).\n    try {\n      return await discoverViaHostJson(base, fetchOpts, opts)\n    } catch {\n      throw prmErr\n    }\n  }\n}\n","/**\n * Keychain helpers — read/write a token in the platform Keychain.\n *\n * Uses the macOS `security` CLI. On non-macOS hosts, callers should swap this\n * module for a platform-appropriate equivalent (libsecret on Linux, Credential\n * Manager on Windows).\n */\n\nimport { execFile } from \"node:child_process\"\nimport { promisify } from \"node:util\"\n\nconst exec = promisify(execFile)\n\n/**\n * Guard the macOS-only backend. Without this, `readKeychainToken` would swallow\n * the missing-`security` error and return undefined on Linux/Windows — making a\n * stored credential look absent and re-prompting on every run — while\n * `writeKeychainToken` would throw an opaque ENOENT. Fail loudly and clearly\n * instead, until a libsecret / Credential Manager backend exists.\n */\nfunction assertKeychainSupported(): void {\n  if (process.platform !== \"darwin\") {\n    throw new Error(\n      `@agentproto/auth token-store: the Keychain backend only supports macOS ` +\n        `(got platform \"${process.platform}\"). Provide a libsecret (Linux) or ` +\n        `Credential Manager (Windows) implementation to run here.`,\n    )\n  }\n}\n\n/** Substitute `{server}` template in a tokenStore account spec. */\nexport function resolveAccount(\n  account: string | undefined,\n  server: string,\n): string {\n  if (!account) return server\n  return account.replace(\"{server}\", server)\n}\n\n/** Read a token from the Keychain. Returns undefined if not found. */\nexport async function readKeychainToken(\n  service: string,\n  account: string,\n): Promise<string | undefined> {\n  assertKeychainSupported()\n  try {\n    const { stdout } = await exec(\"security\", [\n      \"find-generic-password\",\n      \"-s\",\n      service,\n      \"-a\",\n      account,\n      \"-w\",\n    ])\n    const t = stdout.replace(/\\n$/, \"\")\n    return t || undefined\n  } catch {\n    return undefined\n  }\n}\n\n/** Write a token to the Keychain (-U updates in place). */\nexport async function writeKeychainToken(\n  service: string,\n  account: string,\n  token: string,\n): Promise<void> {\n  assertKeychainSupported()\n  await exec(\"security\", [\n    \"add-generic-password\",\n    \"-U\",\n    \"-s\",\n    service,\n    \"-a\",\n    account,\n    \"-w\",\n    token,\n    \"-D\",\n    \"agentproto auth token\",\n  ])\n}\n\n/** Remove a token from the Keychain. Returns true if an entry was deleted,\n *  false when none existed (a delete of an absent entry is not an error —\n *  the desired end state, \"no credential at this slot\", already holds). */\nexport async function deleteKeychainToken(\n  service: string,\n  account: string,\n): Promise<boolean> {\n  assertKeychainSupported()\n  try {\n    await exec(\"security\", [\n      \"delete-generic-password\",\n      \"-s\",\n      service,\n      \"-a\",\n      account,\n    ])\n    return true\n  } catch {\n    // `security` exits non-zero when the item isn't found — treat as a no-op.\n    return false\n  }\n}\n","/**\n * KeychainStore — `CredentialStore` backed by the platform Keychain.\n *\n * Wraps the low-level `token-store.ts` helpers (macOS `security` CLI today).\n * The Keychain only holds one opaque string per entry, so `kind`/`expiresAt`/\n * `metadata` are packed into a small JSON envelope that IS that string.\n *\n * Back-compat: an entry written before this store existed (or by any other\n * tool) is a bare token string, not an envelope. `read` falls back to\n * treating the whole string as the value with kind `\"pat\"` — the only flow\n * that pre-dates this store — rather than failing on non-JSON content.\n */\n\nimport { z } from \"zod\"\nimport {\n  deleteKeychainToken,\n  readKeychainToken,\n  writeKeychainToken,\n} from \"../token-store.js\"\nimport type { CredentialStore, StoreRef, StoredCredential } from \"./types.js\"\n\nconst envelopeSchema = z.object({\n  v: z.string(),\n  k: z.enum([\"pat\", \"assertion\", \"oat\", \"daemon\"]),\n  e: z.string().optional(),\n  m: z.record(z.string(), z.unknown()).optional(),\n})\n\nexport class KeychainStore implements CredentialStore {\n  async read(ref: StoreRef): Promise<StoredCredential | undefined> {\n    const account = ref.account ?? ref.path\n    const raw = await readKeychainToken(ref.path, account)\n    if (raw === undefined) return undefined\n\n    try {\n      const envelope = envelopeSchema.parse(JSON.parse(raw))\n      return {\n        value: envelope.v,\n        kind: envelope.k,\n        ...(envelope.e !== undefined ? { expiresAt: envelope.e } : {}),\n        ...(envelope.m !== undefined ? { metadata: envelope.m } : {}),\n      }\n    } catch {\n      return { value: raw, kind: \"pat\" }\n    }\n  }\n\n  async write(ref: StoreRef, cred: StoredCredential): Promise<void> {\n    const account = ref.account ?? ref.path\n    const envelope: z.infer<typeof envelopeSchema> = {\n      v: cred.value,\n      k: cred.kind,\n      ...(cred.expiresAt !== undefined ? { e: cred.expiresAt } : {}),\n      ...(cred.metadata !== undefined ? { m: cred.metadata } : {}),\n    }\n    await writeKeychainToken(ref.path, account, JSON.stringify(envelope))\n  }\n\n  async delete(ref: StoreRef): Promise<void> {\n    const account = ref.account ?? ref.path\n    await deleteKeychainToken(ref.path, account)\n  }\n}\n","/**\n * Map a provider's `TokenStoreSpec` to a backend-agnostic `StoreRef`.\n *\n * Shared by every flow engine so the `path`/`keychain` back-compat alias and\n * the `{server}` account template are resolved identically everywhere.\n */\n\nimport { resolveAccount } from \"../token-store.js\"\nimport type { TokenStoreSpec } from \"../types.js\"\nimport type { CredentialStore, StoreRef, StoredCredential } from \"./types.js\"\n\n/** When `audience` is declared, it's folded into the physical store key —\n *  `${audience}:${path}` — so credentials scoped to different audiences\n *  (e.g. \"tunnel\" vs \"api\") never collide under the same slot. Absent\n *  `audience` = today's unprefixed path, unchanged. */\nexport function resolveStoreRef(\n  spec: TokenStoreSpec,\n  server: string,\n  audience?: string,\n): StoreRef {\n  const path = spec.path ?? spec.keychain\n  return {\n    path: audience ? `${audience}:${path}` : path,\n    account: resolveAccount(spec.account, server),\n  }\n}\n\n/** Derive both the audience-prefixed `ref` and the unprefixed `legacyRef` in\n *  one call — the pair every flow engine and the broker need for the\n *  audience back-compat read (`readStoreRefWithFallback`). When no audience\n *  is declared, `legacyRef === ref` (same object), matching `resolveStoreRef`\n *  called with `audience` undefined. */\nexport function resolveStoreRefs(\n  spec: TokenStoreSpec,\n  server: string,\n  audience?: string,\n): { ref: StoreRef; legacyRef: StoreRef } {\n  const ref = resolveStoreRef(spec, server, audience)\n  const legacyRef = audience ? resolveStoreRef(spec, server) : ref\n  return { ref, legacyRef }\n}\n\n/**\n * Read through `ref`, falling back once to `legacyRef` on a miss.\n *\n * This is the read half of the audience back-compat rule: a write always\n * targets the audience-prefixed ref, but a credential written before the\n * provider adopted an audience still lives at the unprefixed (legacy) path.\n * Rather than duplicate that fallback at every flow-engine/broker read site,\n * it lives here, next to `resolveStoreRef` — the one place that already\n * knows how prefixed vs. legacy refs are derived. Callers that don't declare\n * an audience pass `ref === legacyRef` (or just call `store.read` directly);\n * this only does extra work when the two refs actually differ.\n */\nexport async function readStoreRefWithFallback(\n  store: CredentialStore,\n  ref: StoreRef,\n  legacyRef: StoreRef,\n): Promise<StoredCredential | undefined> {\n  const stored = await store.read(ref)\n  if (stored) return stored\n  if (ref.path === legacyRef.path && ref.account === legacyRef.account) {\n    return undefined\n  }\n  return store.read(legacyRef)\n}\n","/**\n * PAT flow engine — reads an existing token from the Keychain or prompts for one.\n *\n * This is the \"legacy-compatible\" flow: the user has a personal API key\n * (`gld_*`, `sk-*`, …) and the CLI needs to store/retrieve it. No browser\n * open, no ceremony. Use `service-auth` for the seamless browser-approve path.\n */\n\nimport { createInterface } from \"node:readline\"\nimport type {\n  FlowEngine,\n  FlowRunOptions,\n  FlowResult,\n  AuthProviderHandle,\n  DiscoveredEndpoints,\n} from \"../types.js\"\nimport { KeychainStore } from \"../store/keychain-store.js\"\nimport { resolveStoreRefs, readStoreRefWithFallback } from \"../store/resolve-ref.js\"\n\n/**\n * Read a secret from the terminal WITHOUT echoing it — the typed key must not\n * land on screen or in scrollback. On a TTY we drop to raw mode and render a `*`\n * mask per character. When stdin isn't a TTY (piped input, CI, tests) there's no\n * echo to suppress and no raw mode to enter, so we read a line normally.\n */\nasync function promptToken(label: string): Promise<string> {\n  const input = process.stdin\n  const out = process.stderr\n\n  if (!input.isTTY) {\n    return new Promise((resolve) => {\n      const rl = createInterface({ input, output: out })\n      out.write(`${label}: `)\n      rl.question(\"\", (answer) => {\n        rl.close()\n        resolve(answer.trim())\n      })\n    })\n  }\n\n  return new Promise((resolve, reject) => {\n    out.write(`${label}: `)\n    const chars: string[] = []\n    input.setRawMode(true)\n    input.resume()\n    input.setEncoding(\"utf8\")\n\n    const cleanup = () => {\n      input.setRawMode(false)\n      input.pause()\n      input.removeListener(\"data\", onData)\n    }\n\n    const onData = (chunk: string) => {\n      for (const ch of chunk) {\n        switch (ch) {\n          case \"\\r\":\n          case \"\\n\":\n            out.write(\"\\n\")\n            cleanup()\n            resolve(chars.join(\"\").trim())\n            return\n          case \"\\u0003\": // Ctrl-C\n            out.write(\"\\n\")\n            cleanup()\n            reject(new Error(\"auth cancelled\"))\n            return\n          case \"\\u0004\": // Ctrl-D — treat as end-of-input\n            out.write(\"\\n\")\n            cleanup()\n            resolve(chars.join(\"\").trim())\n            return\n          case \"\\u007f\": // Backspace / Delete\n          case \"\\b\":\n            if (chars.length > 0) {\n              chars.pop()\n              out.write(\"\\b \\b\")\n            }\n            break\n          default:\n            // Mask printable input; ignore stray control characters.\n            if (ch >= \" \") {\n              chars.push(ch)\n              out.write(\"*\")\n            }\n        }\n      }\n    }\n\n    input.on(\"data\", onData)\n  })\n}\n\nexport const patFlowEngine: FlowEngine = {\n  id: \"pat\",\n\n  async run(\n    provider: AuthProviderHandle,\n    _discovered: DiscoveredEndpoints | null,\n    opts: FlowRunOptions,\n  ): Promise<FlowResult> {\n    const { auth } = provider\n    if (auth.flow !== \"pat\") {\n      throw new Error(`patFlowEngine: invoked with flow=\"${auth.flow}\"`)\n    }\n\n    const store = opts.store ?? new KeychainStore()\n    const { ref, legacyRef } = resolveStoreRefs(\n      auth.tokenStore,\n      opts.server,\n      provider.audience,\n    )\n\n    if (!opts.force) {\n      const existing = await readStoreRefWithFallback(store, ref, legacyRef)\n      if (existing) {\n        return { accessToken: existing.value, tokenKind: \"pat\" }\n      }\n    }\n\n    const token = await promptToken(`${provider.id} personal access token`)\n    if (!token) throw new Error(\"no token provided\")\n\n    await store.write(ref, { value: token, kind: \"pat\" })\n\n    return { accessToken: token, tokenKind: \"pat\" }\n  },\n}\n","/**\n * Shared RFC 8628 device-grant polling primitive (internal, not exported from\n * the package root).\n *\n * Both the auth.md claim ceremony (`service-auth.ts`) and the device-code flow\n * poll an OAuth token endpoint with a grant-specific URN until the AS reports\n * success or a terminal error. This module holds that shared poll loop plus\n * the small HTTP/browser helpers both flows need — lifted verbatim from\n * `service-auth.ts` so new flow engines have somewhere to reuse them from.\n */\n\nimport { execFile } from \"node:child_process\"\nimport { promisify } from \"node:util\"\nimport { z } from \"zod\"\nimport { fetchWithDeadline } from \"../http.js\"\n\nconst execAsync = promisify(execFile)\n\n// ── response schemas ──────────────────────────────────────────────────────────\n//\n// JSON crosses a trust boundary here (the AS controls the bytes), so every\n// response is validated with Zod rather than asserted. `.loose()` keeps unknown\n// fields the spec may add. The inferred types feed the rest of the engine.\n\n/** Successful token/refresh/exchange response — the AS minted a credential. */\nexport const tokenSuccessSchema = z\n  .object({\n    access_token: z.string(),\n    token_type: z.string().optional(),\n    refresh_token: z.string().optional(),\n    identity_assertion: z.string().optional(),\n    assertion_expires_in: z.number().optional(),\n    assertion_expires: z.string().optional(),\n    // device-code flow fields (ignored by service-auth today; see WP-2).\n    expires_in: z.number().optional(),\n    scope: z.string().optional(),\n    subject: z.string().optional(),\n    revocation_id: z.string().optional(),\n  })\n  .loose()\n\n/** OAuth error response (`authorization_pending`, `slow_down`, `access_denied`…). */\nexport const tokenErrorSchema = z\n  .object({\n    error: z.string(),\n    error_description: z.string().optional(),\n  })\n  .loose()\n\n/** A token endpoint reply is either a minted credential or an OAuth error.\n *  Success is tried first so a body carrying an access_token never matches the\n *  error arm. */\nexport const tokenResponseSchema = z.union([tokenSuccessSchema, tokenErrorSchema])\n\nexport type TokenSuccess = z.infer<typeof tokenSuccessSchema>\n\n// ── helpers ──────────────────────────────────────────────────────────────────\n\nexport async function openBrowser(url: string): Promise<void> {\n  const [cmd, args]: [string, string[]] =\n    process.platform === \"darwin\"\n      ? [\"open\", [url]]\n      : process.platform === \"win32\"\n        ? [\"cmd\", [\"/c\", \"start\", url]]\n        : [\"xdg-open\", [url]]\n  try {\n    await execAsync(cmd, args)\n  } catch {\n    // best-effort — URL already printed to stderr\n  }\n}\n\n// NOTE: deliberately does NOT check res.ok — the OAuth device/claim flow returns\n// HTTP 400 with a JSON `{ error }` body for authorization_pending / slow_down,\n// which the poll loop reads as data. Throwing on non-2xx would break polling.\nexport async function postFormOAuth<T>(\n  url: string,\n  params: Record<string, string>,\n  schema: z.ZodType<T>,\n  signal?: AbortSignal,\n): Promise<T> {\n  const res = await fetchWithDeadline(url, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams(params).toString(),\n    signal,\n  })\n  return schema.parse(await res.json())\n}\n\nexport interface DeviceGrantPollOptions {\n  /** Token endpoint URL to poll. */\n  tokenEndpoint: string\n  /** Grant-type URN sent on every poll (e.g. the claim or device_code grant). */\n  grantType: string\n  /** Token-carrying form params — e.g. `claim_token`/`device_code` plus\n   *  `client_id`. `grant_type` is added automatically; do not include it here. */\n  params: Record<string, string>\n  /** Poll interval in seconds; grows by 5s on each `slow_down`. */\n  intervalS: number\n  /** Approval window in seconds, measured from when polling starts. */\n  expiresIn: number\n  signal?: AbortSignal\n}\n\n/** RFC 8628 poll loop shared by every grant that polls a token endpoint for\n *  user approval (auth.md claim ceremony, device-code). */\nexport async function pollDeviceGrant(\n  o: DeviceGrantPollOptions,\n): Promise<TokenSuccess> {\n  const deadline = Date.now() + o.expiresIn * 1_000\n  let pollMs = o.intervalS * 1_000\n\n  while (Date.now() < deadline) {\n    if (o.signal?.aborted) throw new Error(\"auth cancelled\")\n    await new Promise<void>((r) => setTimeout(r, pollMs))\n\n    const data = await postFormOAuth(\n      o.tokenEndpoint,\n      { grant_type: o.grantType, ...o.params },\n      tokenResponseSchema,\n      o.signal,\n    )\n\n    if (!(\"error\" in data)) return data\n\n    const pollErr = data.error\n    if (pollErr === \"authorization_pending\") continue\n    if (pollErr === \"slow_down\") {\n      pollMs += 5_000\n      continue\n    }\n    if (pollErr === \"expired_token\") {\n      throw new Error(\"auth timeout — claim expired before user approved\")\n    }\n    if (pollErr === \"access_denied\") {\n      throw new Error(\"access denied — user rejected the authorisation request\")\n    }\n\n    const desc = data.error_description\n    throw new Error(`token endpoint error: ${pollErr}${desc ? ` — ${desc}` : \"\"}`)\n  }\n\n  throw new Error(\"auth timeout — approval window closed\")\n}\n","/**\n * service-auth flow engine — auth.md claim ceremony.\n *\n * Protocol:\n *   POST /agent/identity { type:\"service_auth\" }\n *     → registration_id + claim_token + user_code + verification_uri\n *   User approves at verification_uri in browser.\n *   Poll POST {token_endpoint} with grant_type=urn:workos:agent-auth:grant-type:claim\n *     until approved / denied / expired.\n *   On success: store the identity_assertion JWT (AIP-50 §Token storage —\n *     the assertion is the durable credential; the access_token MUST NOT be\n *     persisted, and the claim_token stays in memory only).\n *\n * Subsequent runs skip the ceremony: the stored assertion is exchanged via the\n * jwt-bearer grant for a fresh access_token (\"this IS the refresh path\" — no\n * refresh_token). Only when the assertion is expired/rejected does a new\n * ceremony start.\n *\n * See: https://github.com/workos/auth.md  /  AIP-50\n */\n\nimport { z } from \"zod\"\nimport type {\n  FlowEngine,\n  FlowRunOptions,\n  FlowResult,\n  AuthProviderHandle,\n  DiscoveredEndpoints,\n} from \"../types.js\"\nimport { KeychainStore } from \"../store/keychain-store.js\"\nimport { resolveStoreRefs, readStoreRefWithFallback } from \"../store/resolve-ref.js\"\nimport { fetchWithDeadline, assertSecureUrl } from \"../http.js\"\nimport {\n  openBrowser,\n  postFormOAuth,\n  pollDeviceGrant,\n  tokenResponseSchema,\n  type TokenSuccess,\n} from \"./device-grant.js\"\n\nconst CLAIM_GRANT_TYPE = \"urn:workos:agent-auth:grant-type:claim\"\nconst JWT_BEARER_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:jwt-bearer\"\nconst DEFAULT_POLL_INTERVAL_S = 5\n\n// ── response schemas ──────────────────────────────────────────────────────────\n//\n// JSON crosses a trust boundary here (the AS controls the bytes), so every\n// response is validated with Zod rather than asserted. `.loose()` keeps unknown\n// fields the spec may add. The inferred types feed the rest of the engine.\n// (Token success/error schemas live in device-grant.ts, shared with every flow\n// that polls a token endpoint.)\n\nconst identityResponseSchema = z\n  .object({\n    registration_id: z.string(),\n    claim_token: z.string(),\n    claim: z\n      .object({\n        user_code: z.string(),\n        verification_uri: z.string(),\n        expires_in: z.number(),\n        interval: z.number().optional(),\n      })\n      .loose(),\n  })\n  .loose()\n\n// ── helpers ──────────────────────────────────────────────────────────────────\n\nasync function postJson<T>(\n  url: string,\n  body: unknown,\n  schema: z.ZodType<T>,\n  signal?: AbortSignal,\n): Promise<T> {\n  const res = await fetchWithDeadline(url, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/json\" },\n    body: JSON.stringify(body),\n    signal,\n  })\n  if (!res.ok) {\n    const text = await res.text()\n    throw new Error(`POST ${url} → ${res.status}: ${text}`)\n  }\n  return schema.parse(await res.json())\n}\n\n// ── Identity-assertion exchange (jwt-bearer, RFC 7523) ────────────────────────\n//\n// The stored credential IS the identity_assertion JWT. Exchange it at the token\n// endpoint for a fresh, short-lived access token — the AIP-50 refresh path, with\n// no refresh_token involved. Returns null on any error (expired / invalid_grant\n// / server doesn't support the grant) so the caller falls back to a ceremony.\nasync function exchangeAssertion(\n  tokenEndpoint: string,\n  assertion: string,\n  clientId: string,\n  signal?: AbortSignal,\n): Promise<TokenSuccess | null> {\n  try {\n    const data = await postFormOAuth(\n      tokenEndpoint,\n      {\n        grant_type: JWT_BEARER_GRANT_TYPE,\n        assertion,\n        client_id: clientId,\n      },\n      tokenResponseSchema,\n      signal,\n    )\n    if (\"error\" in data) return null\n    return data\n  } catch {\n    return null\n  }\n}\n\n// ── engine ───────────────────────────────────────────────────────────────────\n\nexport const serviceAuthFlowEngine: FlowEngine = {\n  id: \"service-auth\",\n\n  async run(\n    provider: AuthProviderHandle,\n    discovered: DiscoveredEndpoints | null,\n    opts: FlowRunOptions,\n  ): Promise<FlowResult> {\n    const { auth } = provider\n    if (auth.flow !== \"service-auth\") {\n      throw new Error(`serviceAuthFlowEngine: invoked with flow=\"${auth.flow}\"`)\n    }\n    // `auth.flow === \"service-auth\"` is guaranteed by the guard above, so the\n    // discriminated union has already narrowed `auth` to ServiceAuthConfig.\n    const config = auth\n    const clientId = config.clientId ?? \"agentproto-cli\"\n    const server = opts.server.replace(/\\/$/, \"\")\n\n    // Endpoint resolution — prefer live discovery, fall back to conventions\n    const identityEndpoint =\n      discovered?.identityEndpoint ?? `${server}/agent/identity`\n    const tokenEndpoint =\n      discovered?.tokenEndpoint ?? `${server}/oauth/token`\n\n    // AIP-50 §Security: auth requests MUST use HTTPS (loopback exempt for dev).\n    assertSecureUrl(identityEndpoint)\n    assertSecureUrl(tokenEndpoint)\n\n    const store = opts.store ?? new KeychainStore()\n    const { ref, legacyRef } = resolveStoreRefs(\n      config.tokenStore,\n      server,\n      provider.audience,\n    )\n\n    // Cached path — the stored credential IS the identity_assertion JWT (AIP-50:\n    // never the access token, never a refresh token). Exchange it via jwt-bearer\n    // for a fresh access token; on failure (expired / invalid_grant) fall through\n    // to a full browser ceremony.\n    if (!opts.force) {\n      const stored = await readStoreRefWithFallback(store, ref, legacyRef)\n      if (stored) {\n        const exchanged = await exchangeAssertion(\n          tokenEndpoint,\n          stored.value,\n          clientId,\n          opts.signal,\n        )\n        if (exchanged) {\n          // If the server rotated the assertion, persist the new one; otherwise\n          // the existing assertion stays valid for the next exchange.\n          if (exchanged.identity_assertion) {\n            await store.write(ref, {\n              value: exchanged.identity_assertion,\n              kind: \"assertion\",\n            })\n          }\n          return {\n            accessToken: exchanged.access_token,\n            ...(exchanged.identity_assertion\n              ? { identityAssertion: exchanged.identity_assertion }\n              : {}),\n            tokenKind: \"oat\",\n          }\n        }\n      }\n    }\n\n    // 1 — POST /agent/identity to start the claim ceremony\n    const identity = await postJson(\n      identityEndpoint,\n      {\n        type: \"service_auth\",\n        client_id: clientId,\n        ...(config.loginHint ? { login_hint: config.loginHint } : {}),\n      },\n      identityResponseSchema,\n      opts.signal,\n    )\n\n    const { claim_token, claim } = identity\n    const intervalS = claim.interval ?? DEFAULT_POLL_INTERVAL_S\n    const windowMin = Math.round(claim.expires_in / 60)\n\n    // 2 — Print code + open browser\n    process.stderr.write(`\\n`)\n    process.stderr.write(`  Approve ${provider.id} access in your browser\\n\\n`)\n    process.stderr.write(`  Code:  ${claim.user_code}\\n`)\n    process.stderr.write(`  URL:   ${claim.verification_uri}\\n\\n`)\n    if (opts.openBrowser !== false) {\n      await openBrowser(claim.verification_uri)\n    }\n    process.stderr.write(`  Waiting for approval (${windowMin} min)…\\n\\n`)\n\n    // 3 — Poll until approved / denied / expired\n    const tokenResult = await pollDeviceGrant({\n      tokenEndpoint,\n      grantType: CLAIM_GRANT_TYPE,\n      params: { claim_token, client_id: clientId },\n      intervalS,\n      expiresIn: claim.expires_in,\n      signal: opts.signal,\n    })\n\n    // 4 — Store the identity_assertion as the durable credential (AIP-50: the\n    //     access_token is ephemeral and MUST NOT be persisted; the claim_token\n    //     was held in memory only). The assertion is re-exchanged via jwt-bearer\n    //     on the next run.\n    const accessToken = tokenResult.access_token\n    const assertion = tokenResult.identity_assertion\n\n    // Resolve assertion expiry as ISO 8601\n    let assertionExpires: string | undefined\n    if (tokenResult.assertion_expires) {\n      assertionExpires = tokenResult.assertion_expires\n    } else if (tokenResult.assertion_expires_in) {\n      assertionExpires = new Date(\n        Date.now() + tokenResult.assertion_expires_in * 1_000,\n      ).toISOString()\n    }\n\n    if (assertion) {\n      await store.write(ref, {\n        value: assertion,\n        kind: \"assertion\",\n        ...(assertionExpires ? { expiresAt: assertionExpires } : {}),\n      })\n    }\n\n    return {\n      accessToken,\n      identityAssertion: assertion,\n      assertionExpires,\n      tokenKind: \"oat\",\n    }\n  },\n}\n","/**\n * device-code flow engine — plain RFC 8628 device-authorization ceremony.\n *\n * Protocol:\n *   POST {device_authorization_endpoint} { client_id, scope?, device_label? }\n *     → device_code + user_code + verification_uri(_complete) + expires_in\n *   User approves at verification_uri in browser.\n *   Poll POST {token_endpoint} with grant_type=urn:ietf:params:oauth:grant-type:device_code\n *     until approved / denied / expired.\n *   On success: store the access_token as the durable credential (kind:\"daemon\")\n *     — unlike service-auth, the access token IS the thing that's persisted;\n *     refresh_token/scope/subject/revocation_id ride in `metadata`.\n *\n * Subsequent runs: a fresh stored credential (or one with no expiry) short-\n * circuits the ceremony. An expired credential with a stored refresh_token is\n * exchanged via `grant_type=refresh_token`; on failure (or when no\n * refresh_token was stored) a new ceremony starts.\n */\n\nimport { z } from \"zod\"\nimport type {\n  FlowEngine,\n  FlowRunOptions,\n  FlowResult,\n  AuthProviderHandle,\n  DiscoveredEndpoints,\n} from \"../types.js\"\nimport { KeychainStore } from \"../store/keychain-store.js\"\nimport { resolveStoreRefs, readStoreRefWithFallback } from \"../store/resolve-ref.js\"\nimport type { CredentialStore, StoreRef, StoredCredential } from \"../store/types.js\"\nimport { fetchWithDeadline, assertSecureUrl } from \"../http.js\"\nimport {\n  openBrowser,\n  postFormOAuth,\n  pollDeviceGrant,\n  tokenResponseSchema,\n  type TokenSuccess,\n} from \"./device-grant.js\"\n\nconst DEVICE_CODE_GRANT_TYPE = \"urn:ietf:params:oauth:grant-type:device_code\"\nconst REFRESH_GRANT_TYPE = \"refresh_token\"\nconst DEFAULT_POLL_INTERVAL_S = 5\n\n/** Thrown by the device-code engine when `opts.refreshOnly` is set and no\n *  fresh or refreshable credential is available — the only remaining path\n *  would be an interactive ceremony, which `refreshOnly` callers explicitly\n *  opt out of. Callers (e.g. `serve` boot on a headless host) catch this to\n *  fall back to their own non-interactive behavior instead of hanging. */\nexport class CeremonyRequiredError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = \"CeremonyRequiredError\"\n  }\n}\n\n// ── response schema ───────────────────────────────────────────────────────────\n//\n// JSON crosses a trust boundary here (the AS controls the bytes), so the\n// response is validated with Zod rather than asserted. `.loose()` keeps\n// unknown fields the spec may add.\n\nconst deviceAuthorizationResponseSchema = z\n  .object({\n    device_code: z.string(),\n    user_code: z.string(),\n    verification_uri: z.string(),\n    verification_uri_complete: z.string().optional(),\n    expires_in: z.number(),\n    interval: z.number().optional(),\n  })\n  .loose()\n\n// ── helpers ──────────────────────────────────────────────────────────────────\n\nasync function postDeviceAuthorization(\n  url: string,\n  params: Record<string, string>,\n  signal?: AbortSignal,\n) {\n  const res = await fetchWithDeadline(url, {\n    method: \"POST\",\n    headers: { \"Content-Type\": \"application/x-www-form-urlencoded\" },\n    body: new URLSearchParams(params).toString(),\n    signal,\n  })\n  if (!res.ok) {\n    const text = await res.text()\n    throw new Error(`POST ${url} → ${res.status}: ${text}`)\n  }\n  return deviceAuthorizationResponseSchema.parse(await res.json())\n}\n\n/** Read a string metadata field without an `as` cast — `metadata` is\n *  `Record<string, unknown>`, so every read is a runtime type check. */\nfunction metaString(\n  metadata: Record<string, unknown> | undefined,\n  key: string,\n): string | undefined {\n  const v = metadata?.[key]\n  return typeof v === \"string\" ? v : undefined\n}\n\nfunction isExpired(cred: StoredCredential): boolean {\n  if (!cred.expiresAt) return false\n  const t = Date.parse(cred.expiresAt)\n  if (Number.isNaN(t)) return true\n  return t <= Date.now()\n}\n\nfunction resultFromStored(cred: StoredCredential): FlowResult {\n  const refreshToken = metaString(cred.metadata, \"refreshToken\")\n  const scope = metaString(cred.metadata, \"scope\")\n  const subject = metaString(cred.metadata, \"subject\")\n  const revocationId = metaString(cred.metadata, \"revocationId\")\n  return {\n    accessToken: cred.value,\n    tokenKind: \"daemon\",\n    ...(refreshToken ? { refreshToken } : {}),\n    ...(scope ? { scope } : {}),\n    ...(subject ? { subject } : {}),\n    ...(revocationId ? { revocationId } : {}),\n  }\n}\n\n/** Refresh via `grant_type=refresh_token`. Returns null on any error\n *  (expired / invalid_grant / server doesn't support the grant) so the\n *  caller falls back to a full ceremony. */\nasync function refreshAccessToken(\n  tokenEndpoint: string,\n  refreshToken: string,\n  clientId: string,\n  signal?: AbortSignal,\n): Promise<TokenSuccess | null> {\n  try {\n    const data = await postFormOAuth(\n      tokenEndpoint,\n      {\n        grant_type: REFRESH_GRANT_TYPE,\n        refresh_token: refreshToken,\n        client_id: clientId,\n      },\n      tokenResponseSchema,\n      signal,\n    )\n    if (\"error\" in data) return null\n    return data\n  } catch {\n    return null\n  }\n}\n\nasync function persistAndResult(\n  store: CredentialStore,\n  ref: StoreRef,\n  o: {\n    accessToken: string\n    expiresIn?: number\n    refreshToken?: string\n    scope?: string\n    subject?: string\n    deviceLabel?: string\n    revocationId?: string\n  },\n): Promise<FlowResult> {\n  const expiresAt = o.expiresIn\n    ? new Date(Date.now() + o.expiresIn * 1_000).toISOString()\n    : undefined\n\n  const metadata: Record<string, unknown> = {\n    obtainedAt: new Date().toISOString(),\n    ...(o.refreshToken ? { refreshToken: o.refreshToken } : {}),\n    ...(o.scope ? { scope: o.scope } : {}),\n    ...(o.subject ? { subject: o.subject } : {}),\n    ...(o.deviceLabel ? { deviceLabel: o.deviceLabel } : {}),\n    ...(o.revocationId ? { revocationId: o.revocationId } : {}),\n  }\n\n  await store.write(ref, {\n    value: o.accessToken,\n    kind: \"daemon\",\n    ...(expiresAt ? { expiresAt } : {}),\n    metadata,\n  })\n\n  return {\n    accessToken: o.accessToken,\n    tokenKind: \"daemon\",\n    ...(o.refreshToken ? { refreshToken: o.refreshToken } : {}),\n    ...(o.scope ? { scope: o.scope } : {}),\n    ...(o.subject ? { subject: o.subject } : {}),\n    ...(o.revocationId ? { revocationId: o.revocationId } : {}),\n  }\n}\n\n// ── engine ───────────────────────────────────────────────────────────────────\n\nexport const deviceCodeFlowEngine: FlowEngine = {\n  id: \"device-code\",\n\n  async run(\n    provider: AuthProviderHandle,\n    discovered: DiscoveredEndpoints | null,\n    opts: FlowRunOptions,\n  ): Promise<FlowResult> {\n    const { auth } = provider\n    if (auth.flow !== \"device-code\") {\n      throw new Error(`deviceCodeFlowEngine: invoked with flow=\"${auth.flow}\"`)\n    }\n    // `auth.flow === \"device-code\"` is guaranteed by the guard above, so the\n    // discriminated union has already narrowed `auth` to DeviceCodeAuthConfig.\n    const config = auth\n    const clientId = config.clientId ?? \"agentproto-cli\"\n    const server = opts.server.replace(/\\/$/, \"\")\n\n    // Endpoint resolution — prefer live discovery, fall back to conventions.\n    const deviceAuthorizationEndpoint =\n      discovered?.deviceAuthorizationEndpoint ?? `${server}/oauth/device`\n    const tokenEndpoint = discovered?.tokenEndpoint ?? `${server}/oauth/token`\n\n    // AIP-50 §Security: auth requests MUST use HTTPS (loopback exempt for dev).\n    assertSecureUrl(deviceAuthorizationEndpoint)\n    assertSecureUrl(tokenEndpoint)\n\n    const store = opts.store ?? new KeychainStore()\n    const { ref, legacyRef } = resolveStoreRefs(\n      config.tokenStore,\n      server,\n      provider.audience,\n    )\n\n    // Shared by both the ordinary cached path and `refreshOnly`: exchange a\n    // stored refresh_token for a fresh access token, persisting the result.\n    // Returns null (never throws) on a missing refresh_token or any grant\n    // failure, so both callers can decide what to do next.\n    async function tryRefresh(stored: StoredCredential): Promise<FlowResult | null> {\n      const refreshToken = metaString(stored.metadata, \"refreshToken\")\n      if (!refreshToken) return null\n      const refreshed = await refreshAccessToken(\n        tokenEndpoint,\n        refreshToken,\n        clientId,\n        opts.signal,\n      )\n      if (!refreshed) return null\n      return persistAndResult(store, ref, {\n        accessToken: refreshed.access_token,\n        expiresIn: refreshed.expires_in,\n        refreshToken: refreshed.refresh_token ?? refreshToken,\n        scope: refreshed.scope ?? metaString(stored.metadata, \"scope\"),\n        subject: refreshed.subject ?? metaString(stored.metadata, \"subject\"),\n        deviceLabel:\n          config.deviceLabel ?? metaString(stored.metadata, \"deviceLabel\"),\n        revocationId:\n          refreshed.revocation_id ?? metaString(stored.metadata, \"revocationId\"),\n      })\n    }\n\n    // `refreshOnly` — attempt only the cached/refresh path, never the\n    // interactive ceremony. Distinct from the ordinary cached path below so\n    // a refresh failure here throws instead of falling through.\n    if (opts.refreshOnly) {\n      const stored = await readStoreRefWithFallback(store, ref, legacyRef)\n      if (stored) {\n        if (!isExpired(stored)) {\n          return resultFromStored(stored)\n        }\n        const refreshed = await tryRefresh(stored)\n        if (refreshed) return refreshed\n      }\n      throw new CeremonyRequiredError(\n        `${provider.id}: no fresh or refreshable device-code credential — an interactive ceremony would be required, but refreshOnly was set`,\n      )\n    }\n\n    // Cached path — the stored credential IS the access token (pat-class\n    // persistence). A fresh (or expiry-less) credential short-circuits the\n    // ceremony entirely; an expired one with a refresh_token is renewed via\n    // grant_type=refresh_token before falling back to a ceremony.\n    if (!opts.force) {\n      const stored = await readStoreRefWithFallback(store, ref, legacyRef)\n      if (stored) {\n        if (!isExpired(stored)) {\n          return resultFromStored(stored)\n        }\n        const refreshed = await tryRefresh(stored)\n        if (refreshed) return refreshed\n        // refresh failed (expired / invalid_grant) — fall through to a ceremony\n      }\n    }\n\n    // 1 — POST the device-authorization endpoint to start the ceremony\n    const params: Record<string, string> = { client_id: clientId }\n    if (config.scope) params.scope = config.scope\n    if (config.deviceLabel) params.device_label = config.deviceLabel\n\n    const authz = await postDeviceAuthorization(\n      deviceAuthorizationEndpoint,\n      params,\n      opts.signal,\n    )\n\n    const intervalS = authz.interval ?? DEFAULT_POLL_INTERVAL_S\n    const windowMin = Math.round(authz.expires_in / 60)\n\n    // 2 — Print code + open browser\n    process.stderr.write(`\\n`)\n    process.stderr.write(`  Approve ${provider.id} access in your browser\\n\\n`)\n    process.stderr.write(`  Code:  ${authz.user_code}\\n`)\n    process.stderr.write(`  URL:   ${authz.verification_uri}\\n\\n`)\n    if (opts.openBrowser !== false) {\n      await openBrowser(authz.verification_uri_complete ?? authz.verification_uri)\n    }\n    process.stderr.write(`  Waiting for approval (${windowMin} min)…\\n\\n`)\n\n    // 3 — Poll until approved / denied / expired\n    const tokenResult = await pollDeviceGrant({\n      tokenEndpoint,\n      grantType: DEVICE_CODE_GRANT_TYPE,\n      params: { device_code: authz.device_code, client_id: clientId },\n      intervalS,\n      expiresIn: authz.expires_in,\n      signal: opts.signal,\n    })\n\n    // 4 — Persist the access token as the durable credential (pat-class).\n    return persistAndResult(store, ref, {\n      accessToken: tokenResult.access_token,\n      expiresIn: tokenResult.expires_in,\n      refreshToken: tokenResult.refresh_token,\n      scope: tokenResult.scope,\n      subject: tokenResult.subject,\n      deviceLabel: config.deviceLabel,\n      revocationId: tokenResult.revocation_id,\n    })\n  },\n}\n","/**\n * Flow engine registry — dispatch by `provider.auth.flow`.\n *\n * Add a new engine:\n *   1. Implement `FlowEngine` in a sibling file\n *   2. Add it here — no if/switch chains at call sites\n */\n\nimport type { FlowEngine } from \"../types.js\"\nimport { patFlowEngine } from \"./pat.js\"\nimport { serviceAuthFlowEngine } from \"./service-auth.js\"\nimport { deviceCodeFlowEngine } from \"./device-code.js\"\n\nexport const FLOW_ENGINES: Readonly<Record<string, FlowEngine>> = {\n  [patFlowEngine.id]: patFlowEngine,\n  [serviceAuthFlowEngine.id]: serviceAuthFlowEngine,\n  [deviceCodeFlowEngine.id]: deviceCodeFlowEngine,\n}\n","/**\n * `runAuthFlow` — resolve provider → discover endpoints → dispatch to engine.\n *\n * Discovery is attempted silently; callers receive the result without knowing\n * whether live or static endpoint config was used. The flow engine receives\n * `null` for `discovered` if discovery failed or was not attempted.\n */\n\nimport { FLOW_ENGINES } from \"./flow-engines/index.js\"\nimport { discoverEndpoints, DiscoveryError } from \"./discover.js\"\nimport type {\n  AuthProviderHandle,\n  DiscoveredEndpoints,\n  FlowResult,\n  FlowRunOptions,\n} from \"./types.js\"\n\nexport interface RunFlowOptions extends FlowRunOptions {\n  /** Pre-resolved endpoints (skip discovery). Pass null to force re-discovery. */\n  discovered?: DiscoveredEndpoints | null\n  /** Suppress debug output. Default: false. */\n  quiet?: boolean\n}\n\nexport async function runAuthFlow(\n  provider: AuthProviderHandle,\n  opts: RunFlowOptions,\n): Promise<FlowResult> {\n  const flowId = provider.auth.flow\n  const engine = FLOW_ENGINES[flowId]\n  if (!engine) {\n    throw new Error(\n      `runAuthFlow: unknown flow \"${flowId}\" — registered: ${Object.keys(FLOW_ENGINES).join(\", \")}`,\n    )\n  }\n\n  // Discovery: try unless caller already provided endpoints\n  let discovered: DiscoveredEndpoints | null =\n    opts.discovered !== undefined ? opts.discovered : null\n\n  if (\n    discovered === null &&\n    (flowId === \"service-auth\" || flowId === \"device-code\")\n  ) {\n    try {\n      discovered = await discoverEndpoints(opts.server, { signal: opts.signal })\n    } catch (err) {\n      if (!opts.quiet) {\n        const msg =\n          err instanceof DiscoveryError\n            ? err.message\n            : `discovery failed: ${err}`\n        process.stderr.write(`[auth] ${msg} — using static config\\n`)\n      }\n    }\n  }\n\n  return engine.run(provider, discovered, opts)\n}\n","/**\n * MemoryStore — in-process `CredentialStore` backed by a `Map`.\n *\n * Ephemeral: gone when the process exits. Used for tests and short-lived\n * tooling that shouldn't touch a real backend.\n */\n\nimport type { CredentialStore, StoreRef, StoredCredential } from \"./types.js\"\n\nfunction keyOf(ref: StoreRef): string {\n  return `${ref.path}\u0000${ref.account ?? ref.path}`\n}\n\nexport class MemoryStore implements CredentialStore {\n  private readonly entries = new Map<string, StoredCredential>()\n\n  async read(ref: StoreRef): Promise<StoredCredential | undefined> {\n    const entry = this.entries.get(keyOf(ref))\n    return entry ? { ...entry } : undefined\n  }\n\n  async write(ref: StoreRef, cred: StoredCredential): Promise<void> {\n    this.entries.set(keyOf(ref), { ...cred })\n  }\n\n  async delete(ref: StoreRef): Promise<void> {\n    this.entries.delete(keyOf(ref))\n  }\n}\n","/**\n * FileStore — encrypted-JSON-file `CredentialStore`.\n *\n * Every entry is sealed independently with AES-256-GCM under a key read from\n * `AGENTPROTO_STORE_KEY` (hex or base64, 32 raw bytes). There is no plaintext\n * fallback: a missing or malformed key throws rather than writing credentials\n * to disk in the clear.\n */\n\nimport {\n  createCipheriv,\n  createDecipheriv,\n  randomBytes,\n} from \"node:crypto\"\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\"\nimport { dirname } from \"node:path\"\nimport { z } from \"zod\"\nimport type { CredentialStore, StoreRef, StoredCredential } from \"./types.js\"\n\nconst ALGORITHM = \"aes-256-gcm\"\nconst KEY_ENV_VAR = \"AGENTPROTO_STORE_KEY\"\nconst IV_BYTES = 12\n\nconst sealedEntrySchema = z.object({\n  iv: z.string(),\n  tag: z.string(),\n  ciphertext: z.string(),\n})\ntype SealedEntry = z.infer<typeof sealedEntrySchema>\n\nconst sealedFileSchema = z.record(z.string(), sealedEntrySchema)\n\nconst storedCredentialSchema = z.object({\n  value: z.string(),\n  kind: z.enum([\"pat\", \"assertion\", \"oat\", \"daemon\"]),\n  expiresAt: z.string().optional(),\n  metadata: z.record(z.string(), z.unknown()).optional(),\n})\n\nfunction keyOf(ref: StoreRef): string {\n  return `${ref.path} ${ref.account ?? ref.path}`\n}\n\nfunction isEnoent(err: unknown): boolean {\n  return (\n    typeof err === \"object\" &&\n    err !== null &&\n    \"code\" in err &&\n    err.code === \"ENOENT\"\n  )\n}\n\n/** Decode `AGENTPROTO_STORE_KEY` (hex or base64) into exactly 32 raw bytes. */\nfunction loadKey(): Buffer {\n  const raw = process.env[KEY_ENV_VAR]\n  if (!raw) {\n    throw new Error(\n      `FileStore: missing ${KEY_ENV_VAR} — set a 32-byte key (64 hex chars, ` +\n        `or base64) to use the encrypted file store. Refusing to store ` +\n        `credentials in plaintext.`,\n    )\n  }\n  const key = /^[0-9a-fA-F]{64}$/.test(raw)\n    ? Buffer.from(raw, \"hex\")\n    : Buffer.from(raw, \"base64\")\n  if (key.length !== 32) {\n    throw new Error(\n      `FileStore: ${KEY_ENV_VAR} must decode to exactly 32 bytes (got ` +\n        `${key.length}). Provide a 64-char hex string or base64 encoding 32 bytes.`,\n    )\n  }\n  return key\n}\n\nfunction seal(key: Buffer, plaintext: string): SealedEntry {\n  const iv = randomBytes(IV_BYTES)\n  const cipher = createCipheriv(ALGORITHM, key, iv)\n  const ciphertext = Buffer.concat([\n    cipher.update(plaintext, \"utf8\"),\n    cipher.final(),\n  ])\n  return {\n    iv: iv.toString(\"base64\"),\n    tag: cipher.getAuthTag().toString(\"base64\"),\n    ciphertext: ciphertext.toString(\"base64\"),\n  }\n}\n\nfunction unseal(key: Buffer, entry: SealedEntry): string {\n  const decipher = createDecipheriv(\n    ALGORITHM,\n    key,\n    Buffer.from(entry.iv, \"base64\"),\n  )\n  decipher.setAuthTag(Buffer.from(entry.tag, \"base64\"))\n  const plaintext = Buffer.concat([\n    decipher.update(Buffer.from(entry.ciphertext, \"base64\")),\n    decipher.final(),\n  ])\n  return plaintext.toString(\"utf8\")\n}\n\nexport class FileStore implements CredentialStore {\n  constructor(private readonly filePath: string) {}\n\n  async read(ref: StoreRef): Promise<StoredCredential | undefined> {\n    const key = loadKey()\n    const file = await this.readFile()\n    const sealed = file[keyOf(ref)]\n    if (!sealed) return undefined\n    return storedCredentialSchema.parse(JSON.parse(unseal(key, sealed)))\n  }\n\n  async write(ref: StoreRef, cred: StoredCredential): Promise<void> {\n    const key = loadKey()\n    const file = await this.readFile()\n    file[keyOf(ref)] = seal(key, JSON.stringify(cred))\n    await this.writeFile(file)\n  }\n\n  async delete(ref: StoreRef): Promise<void> {\n    const file = await this.readFile()\n    delete file[keyOf(ref)]\n    await this.writeFile(file)\n  }\n\n  private async readFile(): Promise<Record<string, SealedEntry>> {\n    try {\n      const raw = await readFile(this.filePath, \"utf8\")\n      return sealedFileSchema.parse(JSON.parse(raw))\n    } catch (err) {\n      if (isEnoent(err)) return {}\n      throw err\n    }\n  }\n\n  private async writeFile(file: Record<string, SealedEntry>): Promise<void> {\n    await mkdir(dirname(this.filePath), { recursive: true })\n    await writeFile(this.filePath, JSON.stringify(file, null, 2), \"utf8\")\n  }\n}\n","/**\n * CredentialBroker — resolve ready-to-use auth headers for a `<providerId>`\n * or `<providerId>/<account>` path, auto-refreshing via the flow engine when\n * the stored credential is missing, expired, or not directly usable.\n *\n * Agent.pw-parity API: callers ask for headers by path and never touch\n * tokens, flows, or the underlying store directly.\n */\n\nimport { runAuthFlow } from \"./run-flow.js\"\nimport { resolveStoreRefs, readStoreRefWithFallback } from \"./store/resolve-ref.js\"\nimport type { CredentialStore, StoredCredential } from \"./store/types.js\"\nimport type { AuthProviderHandle } from \"./types.js\"\n\n/** Refresh this long before the actual expiry, so a credential that's about\n *  to expire mid-request gets renewed proactively instead of failing. */\nconst EXPIRY_SKEW_MS = 60_000\n\nexport interface CredentialBrokerOptions {\n  /** Backend to read cached credentials from and persist refreshed ones to. */\n  store: CredentialStore\n  /** Provider lookup — pass `getAuthProvider` from the registry, or a custom\n   *  resolver (e.g. scoped to a single host's providers). */\n  getProvider: (id: string) => AuthProviderHandle | undefined\n}\n\ninterface ParsedPath {\n  providerId: string\n  account?: string\n}\n\n/** Split `\"<providerId>\"` or `\"<providerId>/<account>\"` on the first `/`. */\nfunction parsePath(path: string): ParsedPath {\n  const slash = path.indexOf(\"/\")\n  if (slash === -1) return { providerId: path }\n  return { providerId: path.slice(0, slash), account: path.slice(slash + 1) }\n}\n\n/** `expiresAt` in the future (past the refresh skew), or absent entirely. A\n *  malformed `expiresAt` is treated as expired — refresh rather than risk\n *  serving a header that a downstream API will reject. */\nfunction isFresh(cred: StoredCredential): boolean {\n  if (!cred.expiresAt) return true\n  const expiresAtMs = Date.parse(cred.expiresAt)\n  if (Number.isNaN(expiresAtMs)) return false\n  return expiresAtMs - EXPIRY_SKEW_MS > Date.now()\n}\n\n/** Header map for a credential usable as a bearer token directly, or\n *  `undefined` when it isn't. `assertion` is never bearer-usable — it must be\n *  exchanged by a flow engine first — so it always falls through to\n *  `runAuthFlow`. */\nfunction bearerHeaders(\n  value: string,\n  kind: StoredCredential[\"kind\"],\n): Record<string, string> | undefined {\n  if (kind === \"pat\" || kind === \"oat\" || kind === \"daemon\") {\n    return { Authorization: `Bearer ${value}` }\n  }\n  return undefined\n}\n\nexport class CredentialBroker {\n  private readonly store: CredentialStore\n  private readonly getProvider: (id: string) => AuthProviderHandle | undefined\n\n  constructor(opts: CredentialBrokerOptions) {\n    this.store = opts.store\n    this.getProvider = opts.getProvider\n  }\n\n  async resolveHeaders(o: {\n    path: string\n    server?: string\n    signal?: AbortSignal\n    /** Audience the caller expects this credential to be scoped to. Checked\n     *  only when the resolved provider also declares one — see the mismatch\n     *  error below. Does not itself change which store key is read; the\n     *  provider's own `audience` (not the caller's) determines that. */\n    audience?: string\n  }): Promise<Record<string, string>> {\n    const { providerId, account } = parsePath(o.path)\n    const provider = this.getProvider(providerId)\n    if (!provider) {\n      throw new Error(`CredentialBroker: unknown auth provider \"${providerId}\"`)\n    }\n\n    if (\n      o.audience !== undefined &&\n      provider.audience !== undefined &&\n      o.audience !== provider.audience\n    ) {\n      throw new Error(\n        `CredentialBroker: provider \"${providerId}\" is scoped to audience \"${provider.audience}\", requested \"${o.audience}\"`,\n      )\n    }\n\n    const server = o.server ?? provider.apiBase\n    const { ref, legacyRef } = resolveStoreRefs(\n      provider.auth.tokenStore,\n      server,\n      provider.audience,\n    )\n    if (account !== undefined) {\n      ref.account = account\n      legacyRef.account = account\n    }\n\n    const stored = await readStoreRefWithFallback(this.store, ref, legacyRef)\n    if (stored && isFresh(stored)) {\n      const headers = bearerHeaders(stored.value, stored.kind)\n      if (headers) return headers\n    }\n\n    const result = await runAuthFlow(provider, {\n      server,\n      store: this.store,\n      signal: o.signal,\n    })\n    const headers =\n      result.accessToken !== undefined\n        ? bearerHeaders(result.accessToken, result.tokenKind)\n        : undefined\n    if (!headers) {\n      throw new Error(\n        `CredentialBroker: auth flow for \"${providerId}\" produced no usable access token`,\n      )\n    }\n    return headers\n  }\n}\n","/**\n * Named auth-profile store — CRUD over `~/.agentproto/auth-profiles.json`\n * (mode 0600), generalizing `providers-store`'s single-key-per-provider file\n * (`packages/providers-store/src/index.ts:68-90`, `ProviderEntry`/\n * `ProvidersFile`) to N named `AuthProfile`s per billing endpoint, keyed by `id`.\n *\n * This is the profile-metadata store, not the credential store: entries hold\n * `credentialRef` (a pointer), never a secret, so — unlike `FileStore`\n * (`store/file-store.ts`) — this file needs no encryption. Reuses the exact\n * persistence primitives `providers-store` already established (a versioned\n * JSON file under `~/.agentproto/`, `node:fs/promises`, mode 0600) rather\n * than inventing a new format, just relocated to `@agentproto/auth` — the\n * correct home for named profiles per SPEC §1c (`providers.json` is the\n * degenerate one-key-per-provider case this generalizes).\n */\n\nimport { mkdir, readFile, writeFile } from \"node:fs/promises\"\nimport { homedir } from \"node:os\"\nimport { join, resolve } from \"node:path\"\nimport { z } from \"zod\"\nimport type { AuthMethod, AuthProfile } from \"./profile-types.js\"\n\nconst authMethodSchema = z.enum([\"oauth-bearer\", \"api-key\"]) satisfies z.ZodType<AuthMethod>\n\n/** Version-1 on-disk shape. Keep `vendor` here permanently for compatibility:\n * callers only ever see the unambiguous in-memory `endpoint` field. */\nconst modelCurationSchema = z.object({\n  mode: z.enum([\"all\", \"allow\"]),\n  ids: z.array(z.string()),\n})\n\nexport const costBudgetSchema = z.object({\n  maxCostUsd: z.number(),\n  window: z.string(),\n  scope: z.enum([\"session\", \"profile\"]),\n})\n\nconst authProfileSchema = z.object({\n  id: z.string(),\n  vendor: z.string(),\n  method: authMethodSchema,\n  credentialRef: z.string().optional(),\n  source: z.string().optional(),\n  label: z.string().optional(),\n  // Additive, back-compat fields — an entry that predates them parses\n  // unchanged (both optional), and `endpoint` still shadows the on-disk\n  // `vendor` alias below.\n  disabled: z.boolean().optional(),\n  models: modelCurationSchema.optional(),\n  costBudget: costBudgetSchema.optional(),\n  origin: z.string().optional(),\n}).transform(({ vendor, ...profile }): AuthProfile => ({ ...profile, endpoint: vendor }))\n\nconst authProfilesFileSchema = z.object({\n  version: z.literal(1),\n  profiles: z.record(z.string(), authProfileSchema),\n})\n\nexport type AuthProfilesFile = z.infer<typeof authProfilesFileSchema>\n\n/** Fresh empty file each call — never share the `profiles` object, or a\n *  later mutation leaks into every other load in-process (same defense\n *  `providers-store`'s `emptyFile()` establishes). */\nfunction emptyFile(): AuthProfilesFile {\n  return { version: 1, profiles: {} }\n}\n\nexport function authProfilesPath(): string {\n  return resolve(homedir(), \".agentproto\", \"auth-profiles.json\")\n}\n\nexport async function loadAuthProfiles(): Promise<AuthProfilesFile> {\n  try {\n    const raw = await readFile(authProfilesPath(), \"utf8\")\n    return authProfilesFileSchema.parse(JSON.parse(raw))\n  } catch {\n    return emptyFile() // ENOENT / malformed → empty\n  }\n}\n\nasync function writeAuthProfiles(file: AuthProfilesFile): Promise<void> {\n  const dir = join(homedir(), \".agentproto\")\n  await mkdir(dir, { recursive: true })\n  // mode 0600 so other local users can't read the profile metadata.\n  const diskFile = {\n    version: file.version,\n    profiles: Object.fromEntries(\n      Object.entries(file.profiles).map(([id, { endpoint, ...profile }]) => [\n        id,\n        { ...profile, vendor: endpoint },\n      ]),\n    ),\n  }\n  await writeFile(authProfilesPath(), JSON.stringify(diskFile, null, 2) + \"\\n\", {\n    encoding: \"utf8\",\n    mode: 0o600,\n  })\n}\n\n/** List all profiles, optionally filtered to one billing endpoint. */\nexport async function listAuthProfiles(endpoint?: string): Promise<AuthProfile[]> {\n  const file = await loadAuthProfiles()\n  const all = Object.values(file.profiles)\n  return endpoint === undefined ? all : all.filter(p => p.endpoint === endpoint)\n}\n\n/** Look up a single profile by id, or undefined if none exists. */\nexport async function getAuthProfile(id: string): Promise<AuthProfile | undefined> {\n  const file = await loadAuthProfiles()\n  return file.profiles[id]\n}\n\n/** Add (or replace) a profile, keyed by its `id`. */\nexport async function addAuthProfile(profile: AuthProfile): Promise<void> {\n  const file = await loadAuthProfiles()\n  file.profiles[profile.id] = profile\n  await writeAuthProfiles(file)\n}\n\n/** Remove a profile by id. Returns true if it existed. */\nexport async function removeAuthProfile(id: string): Promise<boolean> {\n  const file = await loadAuthProfiles()\n  if (!(id in file.profiles)) return false\n  delete file.profiles[id]\n  await writeAuthProfiles(file)\n  return true\n}\n","/**\n * Auth-profile provisioning — the create/delete flow the store CRUD\n * (`profile-store.ts`) deliberately leaves out.\n *\n * `profile-store.ts` writes only profile *metadata* (`credentialRef`, a\n * pointer). Provisioning is the two-sided operation nobody else owned: write\n * the *secret* to the credential store at a derived slot, THEN record the\n * metadata pointing at it — and, on delete, tear both down together. This is\n * the single place that knows the `agentproto.auth.<vendor>[.<qualifier>]`\n * keychain-slot convention (matching the entries seeded by hand in\n * `~/.agentproto/auth-profiles.json`).\n *\n * The secret is INPUT-only. It is written to the `CredentialStore` and never\n * echoed back: `createAuthProfile` returns non-secret metadata plus a\n * one-way `fingerprint` (same \"fingerprint, don't echo\" discipline as\n * `broker.ts` / `KeychainStore`), so a caller can confirm *which* credential\n * landed without ever seeing it.\n *\n * Dependency-injected (`ProfileProvisionDeps`) so it's unit-testable against\n * a `MemoryStore` + an in-memory profile map, with no keychain or filesystem.\n */\n\nimport { createHash } from \"node:crypto\"\nimport type { AuthMethod, AuthProfile, CostBudget, ModelCuration } from \"./profile-types.js\"\nimport { costBudgetSchema } from \"./profile-store.js\"\nimport type { CredentialStore } from \"./store/types.js\"\n\n/** Input to {@link createAuthProfile}. `credential` is the raw secret — it is\n *  written to the store and NEVER returned. Exactly one of `credential` /\n *  `source` must be given for an `oauth-bearer` profile; `api-key` always\n *  requires `credential` (a source-backed profile only makes sense for a\n *  self-refreshing subscription bearer). */\nexport interface CreateAuthProfileInput {\n  /** Stable id, unique across all profiles. */\n  id: string\n  /** Billing endpoint / vendor this credential authenticates against\n   *  (`anthropic`, `openrouter`, `moonshot`, …). */\n  endpoint: string\n  /** How this profile authenticates. */\n  method: AuthMethod\n  /** The raw secret (a subscription OAuth bearer, an API key). INPUT-ONLY.\n   *  Mutually exclusive with `source`. */\n  credential?: string\n  /** Self-refreshing credential source (`oauth-bearer` only, e.g.\n   *  `\"claude-code-oauth\"`) — the profile stores no secret; the credential is\n   *  resolved fresh at spawn time instead. Mutually exclusive with\n   *  `credential`. */\n  source?: string\n  /** Optional human-readable name. */\n  label?: string\n  /** Optional explicit credential-store slot. Omitted ⇒ derived from\n   *  `endpoint` + `method` (see {@link deriveCredentialRef}). Ignored for a\n   *  source-backed profile (nothing is written to the credential store). */\n  credentialRef?: string\n  /** Optional provenance — where the credential was imported from (a WS6\n   *  discovery origin). Stamped verbatim on the created profile; purely\n   *  informational. */\n  origin?: string\n}\n\n/** The non-secret result of a create — safe to log, return over the wire, or\n *  render in a UI. Carries a fingerprint, never the credential. */\nexport interface CreatedAuthProfile {\n  id: string\n  endpoint: string\n  method: AuthMethod\n  /** Set for a credential-backed profile; absent for a source-backed one. */\n  credentialRef?: string\n  /** Set for a source-backed profile; absent for a credential-backed one. */\n  source?: string\n  label?: string\n  /** Provenance stamped at import time, when given. */\n  origin?: string\n  /** One-way fingerprint of the stored credential (sha256, truncated) — lets\n   *  a caller confirm *which* secret was stored without exposing it. Absent\n   *  for a source-backed profile — there is no stored secret to fingerprint. */\n  fingerprint?: string\n}\n\n/** The result of a delete. `deleted` is false when no profile had that id\n *  (idempotent — the desired end state already held). */\nexport interface DeletedAuthProfile {\n  deleted: boolean\n  id: string\n  /** The slot the credential lived at, when a profile was actually removed. */\n  credentialRef?: string\n}\n\n/** Injectable persistence surface — production wires these to\n *  `profile-store.ts` + a `KeychainStore`; tests pass in-memory doubles. */\nexport interface ProfileProvisionDeps {\n  /** Where secrets live (a `KeychainStore` in production). */\n  store: CredentialStore\n  getProfile: (id: string) => Promise<AuthProfile | undefined>\n  listProfiles: () => Promise<AuthProfile[]>\n  addProfile: (profile: AuthProfile) => Promise<void>\n  removeProfile: (id: string) => Promise<boolean>\n}\n\n/** Raised when create/delete input fails validation. Distinct type so a host\n *  (HTTP route, MCP tool) can map it to a 400 rather than a 500. */\nexport class AuthProfileValidationError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = \"AuthProfileValidationError\"\n  }\n}\n\nconst AUTH_METHODS: readonly AuthMethod[] = [\"oauth-bearer\", \"api-key\"]\n\n/** ids and endpoints become keychain-slot / filename fragments, so keep them\n *  to a conservative, injection-safe charset. */\nconst SLUG_RE = /^[A-Za-z0-9][A-Za-z0-9._-]*$/\n\n/** Normalized, validated create input — every field trimmed and checked.\n *  Exactly one of `credential` / `source` is present. */\nexport interface ValidatedCreateInput {\n  id: string\n  endpoint: string\n  method: AuthMethod\n  credential?: string\n  source?: string\n  label?: string\n  credentialRef?: string\n  origin?: string\n}\n\n/**\n * Validate + normalize raw create input. Pure — no I/O. Throws\n * {@link AuthProfileValidationError} with a specific message on the first\n * problem it finds, so the surface layer can surface a clear 400.\n */\nexport function validateCreateInput(input: CreateAuthProfileInput): ValidatedCreateInput {\n  const id = (input.id ?? \"\").trim()\n  if (!id) throw new AuthProfileValidationError(\"id is required\")\n  if (!SLUG_RE.test(id)) {\n    throw new AuthProfileValidationError(\n      `id \"${id}\" is invalid — use letters, digits, \".\", \"_\" or \"-\", ` +\n        `starting with a letter or digit`,\n    )\n  }\n\n  const endpoint = (input.endpoint ?? \"\").trim()\n  if (!endpoint) throw new AuthProfileValidationError(\"endpoint is required\")\n  if (!SLUG_RE.test(endpoint)) {\n    throw new AuthProfileValidationError(\n      `endpoint \"${endpoint}\" is invalid — use letters, digits, \".\", \"_\" or \"-\"`,\n    )\n  }\n\n  const method = input.method\n  if (!AUTH_METHODS.includes(method)) {\n    throw new AuthProfileValidationError(\n      `method must be one of ${AUTH_METHODS.join(\" | \")} (got \"${String(method)}\")`,\n    )\n  }\n\n  // Trim surrounding whitespace only — a pasted token can carry a stray\n  // trailing newline, but must not be blank once trimmed.\n  const credential = input.credential !== undefined ? input.credential.trim() : undefined\n  const source = input.source?.trim()\n\n  if (method === \"api-key\") {\n    if (source) {\n      throw new AuthProfileValidationError(\n        \"source is only supported for oauth-bearer profiles — api-key profiles require a credential\",\n      )\n    }\n    if (!credential) throw new AuthProfileValidationError(\"credential is required\")\n  } else {\n    if (credential && source) {\n      throw new AuthProfileValidationError(\n        \"give either credential or source, not both — a source-backed profile stores no secret\",\n      )\n    }\n    if (!credential && !source) {\n      throw new AuthProfileValidationError(\"credential or source is required\")\n    }\n  }\n\n  const label = input.label?.trim()\n  const credentialRef = input.credentialRef?.trim()\n  if (credentialRef !== undefined && credentialRef !== \"\" && !SLUG_RE.test(credentialRef)) {\n    throw new AuthProfileValidationError(\n      `credentialRef \"${credentialRef}\" is invalid — use letters, digits, \".\", \"_\" or \"-\"`,\n    )\n  }\n\n  const origin = input.origin?.trim()\n\n  return {\n    id,\n    endpoint,\n    method,\n    ...(credential ? { credential } : {}),\n    ...(source ? { source } : {}),\n    ...(label ? { label } : {}),\n    ...(credentialRef ? { credentialRef } : {}),\n    ...(origin ? { origin } : {}),\n  }\n}\n\n/**\n * Derive the credential-store slot for a profile. Matches the convention of\n * the hand-seeded entries: `agentproto.auth.<endpoint>` for an api-key,\n * `agentproto.auth.<endpoint>.sub` for a subscription (oauth-bearer), plus an\n * optional `<qualifier>` to disambiguate a second profile on the same\n * endpoint+method. Pure.\n */\nexport function deriveCredentialRef(input: {\n  endpoint: string\n  method: AuthMethod\n  qualifier?: string\n}): string {\n  const parts = [\"agentproto\", \"auth\", input.endpoint]\n  if (input.method === \"oauth-bearer\") parts.push(\"sub\")\n  if (input.qualifier) parts.push(input.qualifier)\n  return parts.join(\".\")\n}\n\n/** One-way fingerprint of a secret — sha256, first 12 hex chars. Enough to\n *  distinguish credentials by eye; not reversible. */\nexport function fingerprintCredential(secret: string): string {\n  return createHash(\"sha256\").update(secret, \"utf8\").digest(\"hex\").slice(0, 12)\n}\n\n/** Below this length, `slice(-4)` would expose too large a fraction of the\n *  secret to be a safe \"last 4\" — so `last4` is withheld (never the secret).\n *  Real API keys / bearer tokens are far longer; this only guards a degenerate\n *  short value. */\nconst MIN_LEN_FOR_LAST4 = 8\n\n/** Non-secret identity of a STORED credential — a one-way {@link\n *  fingerprintCredential} plus the trailing 4 characters (the standard\n *  \"which key is this\" affordance, like a card's last four). Neither is\n *  reversible to the secret. `last4` is omitted for a secret too short to\n *  reveal a tail safely (see {@link MIN_LEN_FOR_LAST4}) — fail closed rather\n *  than expose. */\nexport interface CredentialIdentity {\n  fingerprint: string\n  last4?: string\n}\n\n/** Compute the non-secret {@link CredentialIdentity} of a stored secret.\n *  Money-safety: returns ONLY the one-way fingerprint + a trailing tail —\n *  never the secret, and never the tail when the secret is too short to\n *  reveal one safely. */\nexport function credentialIdentity(secret: string): CredentialIdentity {\n  return {\n    fingerprint: fingerprintCredential(secret),\n    ...(secret.length >= MIN_LEN_FOR_LAST4 ? { last4: secret.slice(-4) } : {}),\n  }\n}\n\n/** The `StoredCredential.kind` a method maps to (mirrors `profile-types.ts`:\n *  `pat` → `api-key`, `oat` → `oauth-bearer`). */\nfunction credentialKind(method: AuthMethod): \"pat\" | \"oat\" {\n  return method === \"oauth-bearer\" ? \"oat\" : \"pat\"\n}\n\n/**\n * Create a profile end-to-end: validate, derive the credential slot (avoiding\n * collision with an existing profile's slot), write the secret to the store,\n * then record the metadata. Rejects a duplicate id rather than silently\n * overwriting. Returns non-secret metadata + a fingerprint; the credential is\n * never echoed back.\n */\nexport async function createAuthProfile(\n  input: CreateAuthProfileInput,\n  deps: ProfileProvisionDeps,\n): Promise<CreatedAuthProfile> {\n  const v = validateCreateInput(input)\n\n  if (await deps.getProfile(v.id)) {\n    throw new AuthProfileValidationError(\n      `a profile with id \"${v.id}\" already exists — delete it first or pick another id`,\n    )\n  }\n\n  // Source-backed: no secret, nothing written to the credential store.\n  if (v.source !== undefined) {\n    const profile: AuthProfile = {\n      id: v.id,\n      endpoint: v.endpoint,\n      method: v.method,\n      source: v.source,\n      ...(v.label ? { label: v.label } : {}),\n      ...(v.origin ? { origin: v.origin } : {}),\n    }\n    await deps.addProfile(profile)\n    return {\n      id: profile.id,\n      endpoint: profile.endpoint,\n      method: profile.method,\n      source: v.source,\n      ...(profile.label ? { label: profile.label } : {}),\n      ...(profile.origin ? { origin: profile.origin } : {}),\n    }\n  }\n\n  const credential = v.credential!\n\n  const existing = await deps.listProfiles()\n  const takenRefs = new Set(existing.map(p => p.credentialRef))\n\n  let credentialRef = v.credentialRef ?? deriveCredentialRef(v)\n  // If the derived slot already holds another profile's secret, qualify it\n  // with the id so two profiles on the same endpoint+method don't clobber\n  // each other's keychain entry.\n  if (!v.credentialRef && takenRefs.has(credentialRef)) {\n    credentialRef = deriveCredentialRef({ ...v, qualifier: v.id })\n  }\n\n  await deps.store.write(\n    { path: credentialRef },\n    { value: credential, kind: credentialKind(v.method) },\n  )\n\n  const profile: AuthProfile = {\n    id: v.id,\n    endpoint: v.endpoint,\n    method: v.method,\n    credentialRef,\n    ...(v.label ? { label: v.label } : {}),\n    ...(v.origin ? { origin: v.origin } : {}),\n  }\n  await deps.addProfile(profile)\n\n  return {\n    id: profile.id,\n    endpoint: profile.endpoint,\n    method: profile.method,\n    credentialRef,\n    ...(profile.label ? { label: profile.label } : {}),\n    ...(profile.origin ? { origin: profile.origin } : {}),\n    fingerprint: fingerprintCredential(credential),\n  }\n}\n\n/**\n * Delete a profile and its credential. Idempotent: a missing id returns\n * `{ deleted: false }` rather than throwing. The keychain entry is removed\n * only when no OTHER profile still references the same slot — two profiles\n * can legitimately share a `credentialRef`, and dropping one must not strand\n * the other.\n */\nexport async function deleteAuthProfile(\n  id: string,\n  deps: ProfileProvisionDeps,\n): Promise<DeletedAuthProfile> {\n  const trimmed = (id ?? \"\").trim()\n  if (!trimmed) throw new AuthProfileValidationError(\"id is required\")\n\n  const profile = await deps.getProfile(trimmed)\n  if (!profile) return { deleted: false, id: trimmed }\n\n  await deps.removeProfile(trimmed)\n\n  // Source-backed profiles store no secret — nothing to tear down.\n  if (profile.credentialRef === undefined) {\n    return { deleted: true, id: trimmed }\n  }\n\n  const stillReferenced = (await deps.listProfiles()).some(\n    p => p.credentialRef === profile.credentialRef,\n  )\n  if (!stillReferenced && deps.store.delete) {\n    await deps.store.delete({ path: profile.credentialRef })\n  }\n\n  return { deleted: true, id: trimmed, credentialRef: profile.credentialRef }\n}\n\n/**\n * Enable or disable a whole profile (WS2). Metadata-only — never touches the\n * credential store. Enabling CLEARS the `disabled` field entirely rather than\n * writing `disabled: false`, so a re-enabled profile is byte-identical on\n * disk to one that was never disabled (the ABSENT-means-enabled invariant).\n * Throws {@link AuthProfileValidationError} for an unknown id so a host can map\n * it to a 404/400. Returns the updated (non-secret) profile.\n */\nexport async function setAuthProfileEnabled(\n  id: string,\n  enabled: boolean,\n  deps: ProfileProvisionDeps,\n): Promise<AuthProfile> {\n  const trimmed = (id ?? \"\").trim()\n  if (!trimmed) throw new AuthProfileValidationError(\"id is required\")\n\n  const profile = await deps.getProfile(trimmed)\n  if (!profile) {\n    throw new AuthProfileValidationError(`no profile with id \"${trimmed}\"`)\n  }\n\n  // Rebuild WITHOUT `disabled`, then re-add it only when disabling — keeps the\n  // enabled state absent-by-default.\n  const { disabled: _drop, ...rest } = profile\n  const updated: AuthProfile = enabled ? { ...rest } : { ...rest, disabled: true }\n  await deps.addProfile(updated)\n  return updated\n}\n\n/**\n * Set a profile's per-model curation allowlist (WS3). Metadata-only. `mode:\n * \"all\"` CLEARS the `models` field entirely (curation off ⇒ absent, the\n * byte-identical \"services everything\" default), so only a genuine `mode:\n * \"allow\"` persists a `models` object. `ids` are trimmed, de-duped, and\n * blanks dropped. Throws {@link AuthProfileValidationError} for an unknown id.\n * Returns the updated (non-secret) profile.\n */\nexport async function setAuthProfileModels(\n  id: string,\n  curation: ModelCuration,\n  deps: ProfileProvisionDeps,\n): Promise<AuthProfile> {\n  const trimmed = (id ?? \"\").trim()\n  if (!trimmed) throw new AuthProfileValidationError(\"id is required\")\n  if (curation.mode !== \"all\" && curation.mode !== \"allow\") {\n    throw new AuthProfileValidationError(\n      `models.mode must be \"all\" or \"allow\" (got \"${String(curation.mode)}\")`,\n    )\n  }\n\n  const profile = await deps.getProfile(trimmed)\n  if (!profile) {\n    throw new AuthProfileValidationError(`no profile with id \"${trimmed}\"`)\n  }\n\n  const { models: _drop, ...rest } = profile\n  if (curation.mode === \"all\") {\n    // \"all\" == absent — drop the field so the on-disk shape stays byte-\n    // identical to a never-curated profile.\n    const updated: AuthProfile = { ...rest }\n    await deps.addProfile(updated)\n    return updated\n  }\n\n  const ids = [...new Set((curation.ids ?? []).map(s => s.trim()).filter(Boolean))]\n  const updated: AuthProfile = { ...rest, models: { mode: \"allow\", ids } }\n  await deps.addProfile(updated)\n  return updated\n}\n\n/** Above this length a label is almost certainly a paste gone wrong rather\n *  than a deliberate name — reject rather than silently truncate. */\nconst MAX_LABEL_LENGTH = 200\n\n/** Patch input for {@link updateAuthProfile}. Each field is tri-state:\n *  ABSENT leaves the current value untouched, `null` clears it, and a\n *  concrete value replaces it. At least one of `label` / `costBudget` must\n *  be present (absent from both is a no-op input, rejected rather than\n *  silently doing nothing). */\nexport interface UpdateAuthProfileInput {\n  /** New display label, or `null` to clear it. */\n  label?: string | null\n  /** New windowed spend cap, or `null` to clear it. */\n  costBudget?: CostBudget | null\n}\n\n/**\n * Update a profile's `label` and/or `costBudget` (WS-G5) — the two fields\n * `profile-store.ts`'s schema already carries but never had a setter for.\n * Metadata-only, mirroring {@link setAuthProfileEnabled} / {@link\n * setAuthProfileModels}: NEVER touches `credentialRef`, `source`, or the\n * credential store. `null` clears a field entirely (byte-identical to a\n * profile that never had it); ABSENT leaves the current value untouched. A\n * given `label` is trimmed and rejected if it becomes empty or exceeds\n * {@link MAX_LABEL_LENGTH}; a given `costBudget` is validated against the\n * same `costBudgetSchema` the on-disk file itself is parsed with. Throws\n * {@link AuthProfileValidationError} for an unknown id, an empty patch, or a\n * field that fails validation. Returns the updated (non-secret) profile.\n */\nexport async function updateAuthProfile(\n  id: string,\n  patch: UpdateAuthProfileInput,\n  deps: ProfileProvisionDeps,\n): Promise<AuthProfile> {\n  const trimmed = (id ?? \"\").trim()\n  if (!trimmed) throw new AuthProfileValidationError(\"id is required\")\n\n  const hasLabel = Object.prototype.hasOwnProperty.call(patch, \"label\")\n  const hasCostBudget = Object.prototype.hasOwnProperty.call(patch, \"costBudget\")\n  if (!hasLabel && !hasCostBudget) {\n    throw new AuthProfileValidationError(\n      \"at least one of label or costBudget is required\",\n    )\n  }\n\n  let nextLabel: string | undefined\n  if (hasLabel && patch.label !== null) {\n    // patch is caller-declared as UpdateAuthProfileInput, but an HTTP body\n    // reaches here with no such guarantee — validate the runtime type\n    // before .trim() rather than let a non-string throw a raw TypeError.\n    if (typeof patch.label !== \"string\") {\n      throw new AuthProfileValidationError(\"label must be a string or null\")\n    }\n    nextLabel = patch.label.trim()\n    if (!nextLabel) {\n      throw new AuthProfileValidationError(\"label must not be blank; pass null to clear it\")\n    }\n    if (nextLabel.length > MAX_LABEL_LENGTH) {\n      throw new AuthProfileValidationError(\n        `label must be at most ${MAX_LABEL_LENGTH} characters`,\n      )\n    }\n  }\n\n  let nextCostBudget: CostBudget | undefined\n  if (hasCostBudget && patch.costBudget !== null) {\n    const parsed = costBudgetSchema.safeParse(patch.costBudget)\n    if (!parsed.success) {\n      throw new AuthProfileValidationError(\n        `costBudget is invalid: ${parsed.error.issues.map(i => i.message).join(\", \")}`,\n      )\n    }\n    nextCostBudget = parsed.data\n  }\n\n  const profile = await deps.getProfile(trimmed)\n  if (!profile) {\n    throw new AuthProfileValidationError(`no profile with id \"${trimmed}\"`)\n  }\n\n  const { label: _dropLabel, costBudget: _dropCostBudget, ...rest } = profile\n  const updated: AuthProfile = { ...rest }\n  if (hasLabel) {\n    if (nextLabel !== undefined) updated.label = nextLabel\n  } else if (profile.label !== undefined) {\n    updated.label = profile.label\n  }\n  if (hasCostBudget) {\n    if (nextCostBudget !== undefined) updated.costBudget = nextCostBudget\n  } else if (profile.costBudget !== undefined) {\n    updated.costBudget = profile.costBudget\n  }\n\n  await deps.addProfile(updated)\n  return updated\n}\n\n/** The result of {@link refreshAuthProfileModels} — the updated profile plus\n *  the diff against the previous allowlist, so a caller (CLI, MCP tool) can\n *  report exactly what changed without re-diffing itself. */\nexport interface RefreshAuthProfileModelsResult {\n  profile: AuthProfile\n  /** Ids newly present in the refreshed allowlist that weren't in the old one. */\n  added: string[]\n  /** Ids that were in the old allowlist but have dropped out of the current\n   *  catalog snapshot (e.g. a retired model). */\n  removed: string[]\n}\n\n/**\n * Re-sync a `mode: \"allow\"` profile's `ids` against a CURRENT catalog\n * snapshot for its endpoint (WS3 follow-up — fixes curation drift). A\n * profile's allowlist is otherwise a frozen snapshot taken once at\n * create/import time: the catalog moves (new models ship, old ones retire)\n * but `ids` never does, so a profile silently stops seeing new models and\n * keeps offering retired ones. This re-runs the SAME enumeration a caller\n * would have used to build the list in the first place — \"every model\n * currently known for this profile's endpoint\" — against `currentIds`, so\n * `ids` tracks the live catalog instead of the day it was written.\n *\n * `currentIds` is caller-supplied (typically every id `getModelsByProvider`\n * /`buildCatalogProviderModels` reports for `profile.endpoint`) rather than\n * looked up here, keeping this package decoupled from `@agentproto/model-catalog`\n * (see {@link AuthProfile.endpoint}'s doc) and the diffing logic unit-testable\n * against a fake snapshot with no catalog wiring at all.\n *\n * Deliberately EXPLICIT and OPT-IN — a caller (CLI verb, MCP tool) invokes\n * this on one named profile; nothing calls it automatically. A profile a\n * human deliberately narrowed is therefore never touched unless that human\n * (or an operator with the same intent) explicitly asks this profile to be\n * refreshed.\n *\n * Throws {@link AuthProfileValidationError} for an unknown id, and — by\n * design — for a profile with no `mode: \"allow\"` curation to refresh: an\n * absent `models` field (or `mode: \"all\"`) already tracks the live catalog\n * on every read (see `profileAllowsModel` in `catalog-models.ts`), so\n * \"refreshing\" it would be a silent no-op that could mask the caller asking\n * for the wrong profile. Rejecting loudly instead surfaces that mismatch.\n */\nexport async function refreshAuthProfileModels(\n  id: string,\n  currentIds: readonly string[],\n  deps: ProfileProvisionDeps,\n): Promise<RefreshAuthProfileModelsResult> {\n  const trimmed = (id ?? \"\").trim()\n  if (!trimmed) throw new AuthProfileValidationError(\"id is required\")\n\n  const profile = await deps.getProfile(trimmed)\n  if (!profile) {\n    throw new AuthProfileValidationError(`no profile with id \"${trimmed}\"`)\n  }\n  if (!profile.models || profile.models.mode !== \"allow\") {\n    throw new AuthProfileValidationError(\n      `profile \"${trimmed}\" has no mode:\"allow\" curation to refresh — ` +\n        `mode:\"all\" (or absent models) already tracks the live catalog on every read`,\n    )\n  }\n\n  const nextIds = [...new Set(currentIds.map(s => s.trim()).filter(Boolean))]\n  const prevIds = profile.models.ids\n  const prevSet = new Set(prevIds)\n  const nextSet = new Set(nextIds)\n  const added = nextIds.filter(i => !prevSet.has(i))\n  const removed = prevIds.filter(i => !nextSet.has(i))\n\n  const updated: AuthProfile = { ...profile, models: { mode: \"allow\", ids: nextIds } }\n  await deps.addProfile(updated)\n  return { profile: updated, added, removed }\n}\n","/**\n * (adapter × route) → billing-endpoint resolution + the profile eligibility predicate\n * (SPEC §1c, `agentproto-session-config-axes/SPEC.md:102-125`).\n *\n *   profile eligible for (adapter, route) iff\n *        profile.endpoint == resolveEndpoint(adapter, route).endpoint\n *    AND profile.method  ∈ methodsPresentable(adapter, route)\n *\n * `route` is the endpoint selector (SPEC axis #4 — direct vs a gateway mode\n * like `moonshot`/`openrouter`), so access is deliberately downstream of it:\n * which endpoint (and thus which profiles) are eligible changes when route\n * changes. `AdapterAuthManifest` is a narrow, package-local projection of\n * exactly what this predicate needs from an adapter's real AIP-45 manifest\n * (`packages/driver/agent-cli/src/types.ts`'s `AgentCliDefinition`) — this\n * package intentionally does not depend on `@agentproto/driver-agent-cli`\n * (wrong dependency direction; drivers consume auth, not vice versa), so the\n * runtime is the one that will later project a real manifest into this\n * shape (out of scope here — foundation only, no live spawn-path wiring).\n *\n * `methodsByRoute` is the static per-endpoint method table ADR'd in SPEC §3.4:\n * \"which auth methods this adapter can present for a resolved route.\" It is\n * the derivable replacement for two hand-maintained artifacts SPEC §1c calls\n * out for eventual removal — the per-adapter `authSubscription` boolean\n * (`adapters/claude-code/src/index.ts:90-95`) and curatorial vendor deny\n * lists (`adapters/hermes/HERMES.md:40-42`) — neither of which this PR\n * touches; `authSubscription` stays exactly as-is (see the comment on it in\n * `spawn-defaults.ts:345` — this module is additive, not a replacement).\n *\n * ACP `authenticate` is NOT a live discovery source for this table (the\n * server handler is a stub, `packages/acp/src/server/index.ts:69`) — method\n * discovery is this static table, not runtime negotiation (SPEC §3.7).\n */\n\nimport type { AuthMethod, AuthProfile } from \"./profile-types.js\"\n\n/** A narrow, package-local projection of an adapter's declared auth\n *  capability — enough to resolve (adapter, route) → endpoint and the auth\n *  methods presentable on that route. Not the real AIP-45 manifest type. */\nexport interface AdapterAuthManifest {\n  /** Adapter id (e.g. \"claude-code\", \"hermes\"), for error messages only. */\n  id: string\n  /** route id (e.g. \"direct\", or a gateway mode id like \"moonshot\") →\n   *  the billing endpoint used when spawned on that route. */\n  endpointByRoute: Readonly<Record<string, string>>\n  /** route id → the auth methods this adapter can present when spawned on\n   *  that route — the method-side of the eligibility predicate. */\n  methodsByRoute: Readonly<Record<string, readonly AuthMethod[]>>\n}\n\n/** Resolve which billing endpoint a given (adapter, route) pair uses. Throws\n *  when the manifest declares no endpoint for `route` — an unresolvable route\n *  is a caller bug (a bad/unknown route id), not a \"no profiles eligible\"\n *  case, so this fails loud rather than returning an empty endpoint. */\nexport function resolveEndpoint(\n  manifest: AdapterAuthManifest,\n  route: string,\n): { endpoint: string } {\n  const endpoint = manifest.endpointByRoute[route]\n  if (endpoint === undefined) {\n    throw new Error(\n      `resolveEndpoint: adapter \"${manifest.id}\" declares no endpoint for route \"${route}\"`,\n    )\n  }\n  return { endpoint }\n}\n\n/** Which auth methods `manifest`'s adapter can present on `route`. Empty\n *  (never throws) when the route is declared for vendor resolution but has\n *  no methods table entry — that's \"no eligible profiles\", a legitimate\n *  eligibility outcome, not an error. */\nexport function methodsPresentable(\n  manifest: AdapterAuthManifest,\n  route: string,\n): AuthMethod[] {\n  return [...(manifest.methodsByRoute[route] ?? [])]\n}\n\n/** The eligibility predicate: profiles whose endpoint matches the route's\n *  resolved endpoint AND whose method the adapter can present on that route.\n *  A whole-profile-disabled profile (`disabled: true`) is skipped outright —\n *  every model it would otherwise service drops to non-runnable (WS2). This is\n *  the profile-level gate; per-model curation (`models`) is intersected\n *  downstream in the catalog join, not here (SPEC §1c / catalog-models.ts). */\nexport function eligibleProfiles(\n  profiles: readonly AuthProfile[],\n  manifest: AdapterAuthManifest,\n  route: string,\n): AuthProfile[] {\n  const { endpoint } = resolveEndpoint(manifest, route)\n  const methods = methodsPresentable(manifest, route)\n  return profiles.filter(\n    p => !p.disabled && p.endpoint === endpoint && methods.includes(p.method),\n  )\n}\n","/**\n * @agentproto/auth — AIP-50 AUTH.md reference implementation.\n *\n * Public API:\n *   defineAuthProvider(def)           — TS-literal authoring (frozen handle)\n *   parseAuthProviderManifest(source) — .md authoring (gray-matter + Zod)\n *   registerAuthProvider(handle)      — extend the module-level registry\n *   getAuthProvider(id)               — lookup by vendor id\n *   listAuthProviderIds()             — enumerate known providers\n *   discoverEndpoints(apiBase)        — two-hop PRM → AS metadata discovery\n *   runAuthFlow(provider, opts)       — resolve + discover + dispatch to engine\n *   FLOW_ENGINES                      — registered flow engines (pat, …)\n *   CeremonyRequiredError             — thrown by device-code's refreshOnly\n *                                        mode when only an interactive\n *                                        ceremony would satisfy the request\n *   writeKeychainToken(svc, acct, t)  — persist a credential to Keychain\n *   readKeychainToken(svc, acct)      — read a credential from Keychain\n *   resolveAccount(acct, server)      — expand {server} template\n *   KeychainStore / MemoryStore / FileStore — built-in CredentialStore backends\n *   resolveStoreRef(spec, server)     — map a TokenStoreSpec to a StoreRef\n *   CredentialBroker                  — path → ready-to-use auth headers\n *   AuthProfile / AuthMethod          — named, endpoint-scoped credential ref\n *   listAuthProfiles/getAuthProfile/\n *   addAuthProfile/removeAuthProfile  — named-profile store CRUD\n *   resolveEndpoint/methodsPresentable/\n *   eligibleProfiles                  — (adapter × route) → endpoint + the\n *                                        profile eligibility predicate\n *   refreshAuthProfileModels(id, ids) — re-sync a mode:\"allow\" profile's\n *                                        `ids` against a current catalog\n *                                        snapshot (fixes curation drift)\n */\n\nexport { defineAuthProvider } from \"./define-auth-provider.js\"\nexport {\n  parseAuthProviderManifest,\n  parseAuthProviderManifestRaw,\n  type AuthProviderManifest,\n} from \"./manifest.js\"\nexport {\n  registerAuthProvider,\n  getAuthProvider,\n  listAuthProviders,\n  listAuthProviderIds,\n} from \"./registry.js\"\nexport {\n  discoverEndpoints,\n  DiscoveryError,\n} from \"./discover.js\"\nexport { runAuthFlow, type RunFlowOptions } from \"./run-flow.js\"\nexport { FLOW_ENGINES } from \"./flow-engines/index.js\"\nexport { CeremonyRequiredError } from \"./flow-engines/device-code.js\"\nexport {\n  readKeychainToken,\n  writeKeychainToken,\n  deleteKeychainToken,\n  resolveAccount,\n} from \"./token-store.js\"\nexport { KeychainStore } from \"./store/keychain-store.js\"\nexport { MemoryStore } from \"./store/memory-store.js\"\nexport { FileStore } from \"./store/file-store.js\"\nexport { resolveStoreRef } from \"./store/resolve-ref.js\"\nexport type {\n  CredentialStore,\n  StoreRef,\n  StoredCredential,\n} from \"./store/types.js\"\nexport { CredentialBroker, type CredentialBrokerOptions } from \"./broker.js\"\nexport type {\n  AuthMethod,\n  AuthProfile,\n  ModelCuration,\n  CostBudget,\n  CostBudgetScope,\n} from \"./profile-types.js\"\nexport {\n  authProfilesPath,\n  loadAuthProfiles,\n  listAuthProfiles,\n  getAuthProfile,\n  addAuthProfile,\n  removeAuthProfile,\n  type AuthProfilesFile,\n} from \"./profile-store.js\"\nexport {\n  createAuthProfile,\n  deleteAuthProfile,\n  setAuthProfileEnabled,\n  setAuthProfileModels,\n  updateAuthProfile,\n  refreshAuthProfileModels,\n  validateCreateInput,\n  deriveCredentialRef,\n  fingerprintCredential,\n  credentialIdentity,\n  AuthProfileValidationError,\n  type CreateAuthProfileInput,\n  type CreatedAuthProfile,\n  type DeletedAuthProfile,\n  type CredentialIdentity,\n  type ProfileProvisionDeps,\n  type ValidatedCreateInput,\n  type UpdateAuthProfileInput,\n  type RefreshAuthProfileModelsResult,\n} from \"./profile-provision.js\"\nexport {\n  resolveEndpoint,\n  methodsPresentable,\n  eligibleProfiles,\n  type AdapterAuthManifest,\n} from \"./eligibility.js\"\nexport { guildeAuthProvider, BUILTIN_AUTH_PROVIDERS } from \"./builtins.js\"\nexport {\n  authProviderFrontmatterSchema,\n  authConfigSchema,\n  tokenStoreSpecSchema,\n  installConfigSchema,\n  type AuthProviderFrontmatter,\n} from \"./schema.js\"\nexport type {\n  AuthProviderDefinition,\n  AuthProviderHandle,\n  AuthConfig,\n  PATAuthConfig,\n  ServiceAuthConfig,\n  DeviceCodeAuthConfig,\n  InstallConfig,\n  TokenStoreSpec,\n  FlowEngine,\n  FlowId,\n  FlowResult,\n  FlowRunOptions,\n  DiscoveredEndpoints,\n} from \"./types.js\"\n\nexport const SPEC_NAME = \"agentauth\"\nexport const SPEC_VERSION = \"v1\"\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentproto/auth",
-  "version": "1.0.3",
+  "version": "1.1.0",
   "description": "@agentproto/auth — AIP-50 AUTH.md reference implementation. Auth-provider doctype: how CLI tools and agents authenticate to API servers via a standardized discovery chain and pluggable flow engines, aligned to the WorkOS auth.md open standard.",
   "keywords": [
     "agentproto",