@agentxm/client-core 0.1.6

package/dist/src/unstable/auth/auth-client.js

@@ -0,0 +1,284 @@
+/**
+ * AuthClient Effect service — device flow login, token refresh, revocation, identity queries.
+ *
+ * Provides methods for the OAuth 2.0 Device Authorization Grant (RFC 8628)
+ * and related auth operations against the AgentXM registry API.
+ *
+ * Uses the generated registry client for HTTP transport and maps all errors
+ * to AppError with per-operation error codes.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import * as Data from "effect/Data";
+import * as ServiceMap from "effect/ServiceMap";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Schedule from "effect/Schedule";
+import { makeAppError } from "../app-error/index.js";
+import { normalizeHandle } from "../extensions/handle.js";
+import {} from "./oauth-contract.js";
+import { RegistryUrl } from "./registry-url.js";
+import * as GeneratedRegistryClient from "../registry/__generated__/registry-client.js";
+import { isRegistryClientError, isAnyRegistryClientError, hasTagSuffix, getString, isTransientHttpClientError, } from "../registry/error-mapping.js";
+// -----------------------------------------------------------------------------
+// Constants
+// -----------------------------------------------------------------------------
+const CLIENT_ID = "axm-cli";
+const DEVICE_CODE_SCOPES = "extensions:read extensions:publish:new extensions:publish:version extensions:yank extensions:admin account:read account:write";
+const DEVICE_CODE_GRANT_TYPE = "urn:ietf:params:oauth:grant-type:device_code";
+const SLOW_DOWN_INCREMENT_MS = 5000;
+const TRANSIENT_DEVICE_POLL_RETRY_COUNT = 2;
+const TRANSIENT_DEVICE_POLL_RETRY_BASE_DELAY = "250 millis";
+export class AuthClient extends ServiceMap.Service()("@agentxm/client-core/AuthClient") {
+}
+// -----------------------------------------------------------------------------
+// Internal helpers
+// -----------------------------------------------------------------------------
+class RetryableDevicePollError extends Data.TaggedError("RetryableDevicePollError") {
+}
+/** Normalize a generated token response to our domain NormalizedTokenResponse. */
+const normalizeTokenResponse = (token) => ({
+    access_token: token.access_token,
+    refresh_token: token.refresh_token,
+    expires_at: token.expires_at,
+});
+/**
+ * Extract the semantic OAuth error from an AuthExchangeDeviceCode400 RegistryClientError.
+ *
+ * The generated 400 union can carry either a problem-style `{ code }` payload or
+ * the RFC 8628 device-flow payload `{ error, error_description }`.
+ */
+const getOAuthErrorCode = (error) => getString(error.cause, "error") ?? getString(error.cause, "code");
+const isRetryableDevicePollError = (error) => error._tag === "RetryableDevicePollError";
+const makeTransientDevicePollAppError = (cause) => makeAppError({
+    code: "AUTH_LOGIN_FAILED",
+    what: "Lost connection to the registry during login",
+    howToFix: "Verify the registry is running and reachable, then try `axm login` again.",
+    cause,
+});
+/**
+ * Retry transient device-poll failures with exponential backoff, capped at
+ * TRANSIENT_DEVICE_POLL_RETRY_COUNT attempts. Non-retryable AppErrors bypass
+ * the retry via the `while` predicate, and any RetryableDevicePollError that
+ * survives retry exhaustion is translated to a user-facing AppError.
+ */
+const retryTransientDevicePollFailure = (effect) => effect.pipe(Effect.retry({
+    times: TRANSIENT_DEVICE_POLL_RETRY_COUNT,
+    schedule: Schedule.exponential(TRANSIENT_DEVICE_POLL_RETRY_BASE_DELAY),
+    while: isRetryableDevicePollError,
+}), Effect.catchTag("RetryableDevicePollError", (e) => Effect.fail(makeTransientDevicePollAppError(e.cause))));
+// -----------------------------------------------------------------------------
+// Single poll step
+// -----------------------------------------------------------------------------
+/**
+ * Internal: execute a single device token poll against the generated client.
+ *
+ * Surfaces transient HTTP failures as RetryableDevicePollError so callers can
+ * decide whether to retry; other failures are mapped to AppError directly.
+ *
+ * @param client - Generated registry client instance
+ * @param deviceCode - Device verification code from the initial authorization
+ */
+const pollOnceInternal = (client, deviceCode) => client
+    .AuthExchangeDeviceCode({
+    payload: {
+        client_id: CLIENT_ID,
+        device_code: deviceCode,
+        grant_type: DEVICE_CODE_GRANT_TYPE,
+    },
+})
+    .pipe(Effect.map((token) => ({
+    _tag: "Success",
+    token: normalizeTokenResponse(token),
+})), Effect.catch((error) => {
+    if (isRegistryClientError("AuthExchangeDeviceCode400")(error)) {
+        const code = getOAuthErrorCode(error);
+        switch (code) {
+            case "authorization_pending":
+                return Effect.succeed({ _tag: "Pending" });
+            case "slow_down":
+                return Effect.succeed({ _tag: "SlowDown" });
+            case "access_denied":
+                return Effect.succeed({ _tag: "AccessDenied" });
+            case "expired_token":
+                return Effect.succeed({ _tag: "ExpiredToken" });
+            default:
+                return Effect.fail(makeAppError({
+                    code: "AUTH_LOGIN_FAILED",
+                    what: "Device token exchange failed with an unexpected error",
+                    details: code !== undefined ? [`Error code: ${code}`] : [],
+                    howToFix: "Try running `axm login` again.",
+                    cause: error,
+                }));
+        }
+    }
+    if (isTransientHttpClientError(error)) {
+        return Effect.fail(new RetryableDevicePollError({ cause: error }));
+    }
+    return Effect.fail(makeAppError({
+        code: "AUTH_LOGIN_FAILED",
+        what: "Device token exchange failed with an unexpected error",
+        howToFix: "Try running `axm login` again.",
+        cause: error,
+    }));
+}));
+/**
+ * Execute a single device token poll (exported for testing).
+ *
+ * Transient HTTP failures are collapsed into AUTH_LOGIN_FAILED; this seam does
+ * not retry on its own. For the retrying variant, use `pollDeviceToken`.
+ */
+export const pollOnce = (client, deviceCode) => pollOnceInternal(client, deviceCode).pipe(Effect.catchTag("RetryableDevicePollError", (e) => Effect.fail(makeTransientDevicePollAppError(e.cause))));
+// -----------------------------------------------------------------------------
+// Live layer
+// -----------------------------------------------------------------------------
+export const AuthClientLive = Layer.effect(AuthClient, Effect.gen(function* () {
+    const httpClient = yield* HttpClient.HttpClient;
+    const registryUrl = yield* RegistryUrl;
+    const client = GeneratedRegistryClient.make(httpClient.pipe(HttpClient.mapRequest(HttpClientRequest.prependUrl(registryUrl))));
+    const initiateDeviceFlow = Effect.fn("AuthClient.initiateDeviceFlow")(function* () {
+        const response = yield* client
+            .AuthIssueDeviceCode({
+            payload: { client_id: CLIENT_ID, scope: DEVICE_CODE_SCOPES },
+        })
+            .pipe(Effect.mapError((error) => makeAppError({
+            code: "AUTH_LOGIN_FAILED",
+            what: "Could not connect to the registry",
+            details: [`Registry: ${registryUrl}`],
+            howToFix: "Verify the registry is running and reachable, then try again.",
+            cause: error,
+        })));
+        return {
+            device_code: response.device_code,
+            user_code: response.user_code,
+            verification_uri: response.verification_uri,
+            verification_uri_complete: response.verification_uri_complete,
+            interval: response.interval,
+            expires_in: response.expires_in,
+        };
+    });
+    const pollDeviceToken = Effect.fn("AuthClient.pollDeviceToken")(function* (deviceCode, interval) {
+        let currentInterval = interval * 1000;
+        while (true) {
+            yield* Effect.sleep(currentInterval);
+            const result = yield* retryTransientDevicePollFailure(pollOnceInternal(client, deviceCode));
+            switch (result._tag) {
+                case "Success":
+                    return result.token;
+                case "Pending":
+                    continue;
+                case "SlowDown":
+                    currentInterval += SLOW_DOWN_INCREMENT_MS;
+                    continue;
+                case "AccessDenied":
+                    return yield* makeAppError({
+                        code: "AUTH_LOGIN_CANCELLED",
+                        what: "Login was denied or cancelled",
+                        howToFix: "Run `axm login` to try again.",
+                    });
+                case "ExpiredToken":
+                    return yield* makeAppError({
+                        code: "AUTH_LOGIN_FAILED",
+                        what: "Login code expired",
+                        howToFix: "Run `axm login` to try again.",
+                    });
+            }
+        }
+    });
+    const refreshToken = Effect.fn("AuthClient.refreshToken")(function* (refreshTokenValue) {
+        const token = yield* client
+            .AuthRefreshToken({
+            payload: {
+                grant_type: "refresh_token",
+                refresh_token: refreshTokenValue,
+                client_id: CLIENT_ID,
+            },
+        })
+            .pipe(Effect.mapError((error) => makeAppError({
+            code: "AUTH_REFRESH_FAILED",
+            what: "Token refresh request failed",
+            howToFix: "Run `axm login` to re-authenticate.",
+            cause: error,
+        })));
+        return normalizeTokenResponse(token);
+    });
+    const revokeToken = Effect.fn("AuthClient.revokeToken")(function* (accessToken) {
+        yield* client
+            .AuthRevokeToken({
+            payload: { token: accessToken },
+        })
+            .pipe(Effect.catch((error) => Effect.logWarning(`Token revocation failed: ${String(error)}. Local credentials will still be cleared.`)));
+    });
+    const getMe = Effect.fn("AuthClient.getMe")(function* (accessToken) {
+        // Inject bearer token via a per-request HttpClient wrapper for getMe.
+        // The generated AuthGetMe operation uses GET /v1/auth/me with no payload,
+        // so we need to add the Authorization header via the httpClient.
+        const authedClient = GeneratedRegistryClient.make(httpClient.pipe(HttpClient.mapRequest(HttpClientRequest.prependUrl(registryUrl)), HttpClient.mapRequest(HttpClientRequest.bearerToken(accessToken))));
+        const decoded = yield* authedClient.AuthGetMe(undefined).pipe(Effect.mapError((error) => {
+            if (isRegistryClientError("AuthGetMe401")(error)) {
+                return makeAppError({
+                    code: "AUTH_UNAUTHENTICATED",
+                    what: "Not authenticated or token is invalid",
+                    howToFix: "Run `axm login` to re-authenticate.",
+                    cause: error,
+                });
+            }
+            if (isRegistryClientError("AuthGetMe400")(error)) {
+                return makeAppError({
+                    code: "AUTH_UNAUTHENTICATED",
+                    what: "Not authenticated or token is invalid",
+                    howToFix: "Run `axm login` to re-authenticate.",
+                    cause: error,
+                });
+            }
+            // Defense-in-depth: currently unreachable because AuthGetMe doesn't produce
+            // 5xx RegistryClientError tags (500+ responses arrive as HttpClientError), but
+            // kept to safely handle future generated-client changes that add 5xx variants.
+            if (isAnyRegistryClientError(error) && hasTagSuffix(error, "5xx")) {
+                return makeAppError({
+                    code: "AUTH_SERVER_ERROR",
+                    what: "Registry returned server error",
+                    details: [`Registry: ${registryUrl}`],
+                    howToFix: "The registry may be temporarily unavailable. Try again later.",
+                    cause: error,
+                });
+            }
+            return makeAppError({
+                code: "AUTH_UNAUTHENTICATED",
+                what: "Could not connect to the registry",
+                details: [`Registry: ${registryUrl}`],
+                howToFix: "Verify the registry is running and reachable, then try again.",
+                cause: error,
+            });
+        }));
+        return {
+            userId: decoded.user.id,
+            userHandle: normalizeHandle(decoded.user.handle),
+            email: decoded.user.email ?? "",
+            tokenType: decoded.token.type,
+            scopes: decoded.token.scopes,
+            orgs: [],
+        };
+    });
+    return {
+        initiateDeviceFlow,
+        pollDeviceToken,
+        refreshToken,
+        revokeToken,
+        getMe,
+    };
+}));
+// -----------------------------------------------------------------------------
+// Test layer factory
+// -----------------------------------------------------------------------------
+export const AuthClientTest = (overrides) => Layer.succeed(AuthClient, {
+    initiateDeviceFlow: () => Effect.fail(makeAppError({ code: "AUTH_LOGIN_FAILED", what: "Not implemented in test" })),
+    pollDeviceToken: () => Effect.fail(makeAppError({ code: "AUTH_LOGIN_FAILED", what: "Not implemented in test" })),
+    refreshToken: () => Effect.fail(makeAppError({ code: "AUTH_REFRESH_FAILED", what: "Not implemented in test" })),
+    revokeToken: () => Effect.void,
+    getMe: () => Effect.fail(makeAppError({ code: "AUTH_UNAUTHENTICATED", what: "Not implemented in test" })),
+    ...overrides,
+});
+//# sourceMappingURL=auth-client.js.map

package/dist/src/unstable/auth/auth-client.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-client.js","sourceRoot":"","sources":["../../../../src/unstable/auth/auth-client.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAC;AAC5E,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAiB,YAAY,EAAE,MAAM,uBAAuB,CAAC;AACpE,OAAO,EAAE,eAAe,EAAe,MAAM,yBAAyB,CAAC;AACvE,OAAO,EAAgC,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,uBAAuB,MAAM,8CAA8C,CAAC;AACxF,OAAO,EACL,qBAAqB,EACrB,wBAAwB,EACxB,YAAY,EACZ,SAAS,EACT,0BAA0B,GAC3B,MAAM,8BAA8B,CAAC;AAEtC,gFAAgF;AAChF,YAAY;AACZ,gFAAgF;AAEhF,MAAM,SAAS,GAAG,SAAS,CAAC;AAC5B,MAAM,kBAAkB,GACtB,+HAA+H,CAAC;AAClI,MAAM,sBAAsB,GAAG,8CAA8C,CAAC;AAC9E,MAAM,sBAAsB,GAAG,IAAI,CAAC;AACpC,MAAM,iCAAiC,GAAG,CAAC,CAAC;AAC5C,MAAM,sCAAsC,GAAG,YAAY,CAAC;AAqD5D,MAAM,OAAO,UAAW,SAAQ,UAAU,CAAC,OAAO,EAAiC,CACjF,iCAAiC,CAClC;CAAG;AAEJ,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF,MAAM,wBAAyB,SAAQ,IAAI,CAAC,WAAW,CAAC,0BAA0B,CAEhF;CAAG;AAEL,kFAAkF;AAClF,MAAM,sBAAsB,GAAG,CAAC,KAI/B,EAA2B,EAAE,CAAC,CAAC;IAC9B,YAAY,EAAE,KAAK,CAAC,YAAY;IAChC,aAAa,EAAE,KAAK,CAAC,aAAa;IAClC,UAAU,EAAE,KAAK,CAAC,UAAU;CAC7B,CAAC,CAAC;AAEH;;;;;GAKG;AACH,MAAM,iBAAiB,GAAG,CACxB,KAAwF,EACpE,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,OAAO,CAAC,IAAI,SAAS,CAAC,KAAK,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;AAE3F,MAAM,0BAA0B,GAAG,CACjC,KAA0C,EACP,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,0BAA0B,CAAC;AAElF,MAAM,+BAA+B,GAAG,CAAC,KAAc,EAAE,EAAE,CACzD,YAAY,CAAC;IACX,IAAI,EAAE,mBAAmB;IACzB,IAAI,EAAE,8CAA8C;IACpD,QAAQ,EAAE,2EAA2E;IACrF,KAAK;CACN,CAAC,CAAC;AAEL;;;;;GAKG;AACH,MAAM,+BAA+B,GAAG,CACtC,MAA6D,EACjC,EAAE,CAC9B,MAAM,CAAC,IAAI,CACT,MAAM,CAAC,KAAK,CAAC;IACX,KAAK,EAAE,iCAAiC;IACxC,QAAQ,EAAE,QAAQ,CAAC,WAAW,CAAC,sCAAsC,CAAC;IACtE,KAAK,EAAE,0BAA0B;CAClC,CAAC,EACF,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CAChD,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC;AAEJ,gFAAgF;AAChF,mBAAmB;AACnB,gFAAgF;AAEhF;;;;;;;;GAQG;AACH,MAAM,gBAAgB,GAAG,CACvB,MAA8C,EAC9C,UAAkB,EAC8C,EAAE,CAClE,MAAM;KACH,sBAAsB,CAAC;IACtB,OAAO,EAAE;QACP,SAAS,EAAE,SAAS;QACpB,WAAW,EAAE,UAAU;QACvB,UAAU,EAAE,sBAAsB;KACnC;CACF,CAAC;KACD,IAAI,CACH,MAAM,CAAC,GAAG,CACR,CAAC,KAAK,EAAc,EAAE,CAAC,CAAC;IACtB,IAAI,EAAE,SAAS;IACf,KAAK,EAAE,sBAAsB,CAAC,KAAK,CAAC;CACrC,CAAC,CACH,EACD,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAkE,EAAE;IACrF,IAAI,qBAAqB,CAAC,2BAA2B,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;QAC9D,MAAM,IAAI,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;QACtC,QAAQ,IAAI,EAAE,CAAC;YACb,KAAK,uBAAuB;gBAC1B,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC,CAAC;YACzD,KAAK,WAAW;gBACd,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;YAC1D,KAAK,eAAe;gBAClB,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9D,KAAK,eAAe;gBAClB,OAAO,MAAM,CAAC,OAAO,CAAa,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC,CAAC;YAC9D;gBACE,OAAO,MAAM,CAAC,IAAI,CAChB,YAAY,CAAC;oBACX,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,uDAAuD;oBAC7D,OAAO,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE;oBAC1D,QAAQ,EAAE,gCAAgC;oBAC1C,KAAK,EAAE,KAAK;iBACb,CAAC,CACH,CAAC;QACN,CAAC;IACH,CAAC;IAED,IAAI,0BAA0B,CAAC,KAAK,CAAC,EAAE,CAAC;QACtC,OAAO,MAAM,CAAC,IAAI,CAAC,IAAI,wBAAwB,CAAC,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,OAAO,MAAM,CAAC,IAAI,CAChB,YAAY,CAAC;QACX,IAAI,EAAE,mBAAmB;QACzB,IAAI,EAAE,uDAAuD;QAC7D,QAAQ,EAAE,gCAAgC;QAC1C,KAAK,EAAE,KAAK;KACb,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEN;;;;;GAKG;AACH,MAAM,CAAC,MAAM,QAAQ,GAAG,CACtB,MAA8C,EAC9C,UAAkB,EACmB,EAAE,CACvC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,IAAI,CACvC,MAAM,CAAC,QAAQ,CAAC,0BAA0B,EAAE,CAAC,CAAC,EAAE,EAAE,CAChD,MAAM,CAAC,IAAI,CAAC,+BAA+B,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CACtD,CACF,CAAC;AAEJ,gFAAgF;AAChF,aAAa;AACb,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,KAAK,CAAC,MAAM,CACxC,UAAU,EACV,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChD,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IACvC,MAAM,MAAM,GAAG,uBAAuB,CAAC,IAAI,CACzC,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,CAAC,CAClF,CAAC;IAEF,MAAM,kBAAkB,GAA4C,MAAM,CAAC,EAAE,CAC3E,+BAA+B,CAChC,CAAC,QAAQ,CAAC;QACT,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,MAAM;aAC3B,mBAAmB,CAAC;YACnB,OAAO,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,KAAK,EAAE,kBAAkB,EAAE;SAC7D,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;YACX,IAAI,EAAE,mBAAmB;YACzB,IAAI,EAAE,mCAAmC;YACzC,OAAO,EAAE,CAAC,aAAa,WAAW,EAAE,CAAC;YACrC,QAAQ,EAAE,+DAA+D;YACzE,KAAK,EAAE,KAAK;SACb,CAAC,CACH,CACF,CAAC;QAEJ,OAAO;YACL,WAAW,EAAE,QAAQ,CAAC,WAAW;YACjC,SAAS,EAAE,QAAQ,CAAC,SAAS;YAC7B,gBAAgB,EAAE,QAAQ,CAAC,gBAAgB;YAC3C,yBAAyB,EAAE,QAAQ,CAAC,yBAAyB;YAC7D,QAAQ,EAAE,QAAQ,CAAC,QAAQ;YAC3B,UAAU,EAAE,QAAQ,CAAC,UAAU;SACH,CAAC;IACjC,CAAC,CAAC,CAAC;IAEH,MAAM,eAAe,GAAyC,MAAM,CAAC,EAAE,CACrE,4BAA4B,CAC7B,CAAC,QAAQ,CAAC,EAAE,UAAU,EAAE,QAAQ;QAC/B,IAAI,eAAe,GAAG,QAAQ,GAAG,IAAI,CAAC;QAEtC,OAAO,IAAI,EAAE,CAAC;YACZ,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,eAAe,CAAC,CAAC;YACrC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,+BAA+B,CAAC,gBAAgB,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAAC;YAE5F,QAAQ,MAAM,CAAC,IAAI,EAAE,CAAC;gBACpB,KAAK,SAAS;oBACZ,OAAO,MAAM,CAAC,KAAK,CAAC;gBACtB,KAAK,SAAS;oBACZ,SAAS;gBACX,KAAK,UAAU;oBACb,eAAe,IAAI,sBAAsB,CAAC;oBAC1C,SAAS;gBACX,KAAK,cAAc;oBACjB,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC;wBACzB,IAAI,EAAE,sBAAsB;wBAC5B,IAAI,EAAE,+BAA+B;wBACrC,QAAQ,EAAE,+BAA+B;qBAC1C,CAAC,CAAC;gBACL,KAAK,cAAc;oBACjB,OAAO,KAAK,CAAC,CAAC,YAAY,CAAC;wBACzB,IAAI,EAAE,mBAAmB;wBACzB,IAAI,EAAE,oBAAoB;wBAC1B,QAAQ,EAAE,+BAA+B;qBAC1C,CAAC,CAAC;YACP,CAAC;QACH,CAAC;IACH,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAsC,MAAM,CAAC,EAAE,CAAC,yBAAyB,CAAC,CAC1F,QAAQ,CAAC,EAAE,iBAAiB;QAC1B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,MAAM;aACxB,gBAAgB,CAAC;YAChB,OAAO,EAAE;gBACP,UAAU,EAAE,eAAe;gBAC3B,aAAa,EAAE,iBAAiB;gBAChC,SAAS,EAAE,SAAS;aACrB;SACF,CAAC;aACD,IAAI,CACH,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACxB,YAAY,CAAC;YACX,IAAI,EAAE,qBAAqB;YAC3B,IAAI,EAAE,8BAA8B;YACpC,QAAQ,EAAE,qCAAqC;YAC/C,KAAK,EAAE,KAAK;SACb,CAAC,CACH,CACF,CAAC;QAEJ,OAAO,sBAAsB,CAAC,KAAK,CAAC,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,MAAM,WAAW,GAAqC,MAAM,CAAC,EAAE,CAAC,wBAAwB,CAAC,CACvF,QAAQ,CAAC,EAAE,WAAW;QACpB,KAAK,CAAC,CAAC,MAAM;aACV,eAAe,CAAC;YACf,OAAO,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE;SAChC,CAAC;aACD,IAAI,CACH,MAAM,CAAC,KAAK,CAAC,CAAC,KAAK,EAAE,EAAE,CACrB,MAAM,CAAC,UAAU,CACf,4BAA4B,MAAM,CAAC,KAAK,CAAC,4CAA4C,CACtF,CACF,CACF,CAAC;IACN,CAAC,CACF,CAAC;IAEF,MAAM,KAAK,GAA+B,MAAM,CAAC,EAAE,CAAC,kBAAkB,CAAC,CACrE,QAAQ,CAAC,EAAE,WAAW;QACpB,sEAAsE;QACtE,0EAA0E;QAC1E,iEAAiE;QACjE,MAAM,YAAY,GAAG,uBAAuB,CAAC,IAAI,CAC/C,UAAU,CAAC,IAAI,CACb,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,UAAU,CAAC,WAAW,CAAC,CAAC,EAChE,UAAU,CAAC,UAAU,CAAC,iBAAiB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAClE,CACF,CAAC;QAEF,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,SAAS,CAAC,SAAS,CAAC,CAAC,IAAI,CAC3D,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAY,EAAE;YAClC,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,OAAO,YAAY,CAAC;oBAClB,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,uCAAuC;oBAC7C,QAAQ,EAAE,qCAAqC;oBAC/C,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,IAAI,qBAAqB,CAAC,cAAc,CAAC,CAAC,KAAK,CAAC,EAAE,CAAC;gBACjD,OAAO,YAAY,CAAC;oBAClB,IAAI,EAAE,sBAAsB;oBAC5B,IAAI,EAAE,uCAAuC;oBAC7C,QAAQ,EAAE,qCAAqC;oBAC/C,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,4EAA4E;YAC5E,+EAA+E;YAC/E,+EAA+E;YAC/E,IAAI,wBAAwB,CAAC,KAAK,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC;gBAClE,OAAO,YAAY,CAAC;oBAClB,IAAI,EAAE,mBAAmB;oBACzB,IAAI,EAAE,gCAAgC;oBACtC,OAAO,EAAE,CAAC,aAAa,WAAW,EAAE,CAAC;oBACrC,QAAQ,EAAE,+DAA+D;oBACzE,KAAK,EAAE,KAAK;iBACb,CAAC,CAAC;YACL,CAAC;YACD,OAAO,YAAY,CAAC;gBAClB,IAAI,EAAE,sBAAsB;gBAC5B,IAAI,EAAE,mCAAmC;gBACzC,OAAO,EAAE,CAAC,aAAa,WAAW,EAAE,CAAC;gBACrC,QAAQ,EAAE,+DAA+D;gBACzE,KAAK,EAAE,KAAK;aACb,CAAC,CAAC;QACL,CAAC,CAAC,CACH,CAAC;QAEF,OAAO;YACL,MAAM,EAAE,OAAO,CAAC,IAAI,CAAC,EAAE;YACvB,UAAU,EAAE,eAAe,CAAC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC;YAChD,KAAK,EAAE,OAAO,CAAC,IAAI,CAAC,KAAK,IAAI,EAAE;YAC/B,SAAS,EAAE,OAAO,CAAC,KAAK,CAAC,IAAI;YAC7B,MAAM,EAAE,OAAO,CAAC,KAAK,CAAC,MAAM;YAC5B,IAAI,EAAE,EAAE;SACY,CAAC;IACzB,CAAC,CACF,CAAC;IAEF,OAAO;QACL,kBAAkB;QAClB,eAAe;QACf,YAAY;QACZ,WAAW;QACX,KAAK;KACsB,CAAC;AAChC,CAAC,CAAC,CACH,CAAC;AAEF,gFAAgF;AAChF,qBAAqB;AACrB,gFAAgF;AAEhF,MAAM,CAAC,MAAM,cAAc,GAAG,CAAC,SAAsC,EAAE,EAAE,CACvE,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE;IACxB,kBAAkB,EAAE,GAAG,EAAE,CACvB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC3F,eAAe,EAAE,GAAG,EAAE,CACpB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,mBAAmB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC3F,YAAY,EAAE,GAAG,EAAE,CACjB,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,qBAAqB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC7F,WAAW,EAAE,GAAG,EAAE,CAAC,MAAM,CAAC,IAAI;IAC9B,KAAK,EAAE,GAAG,EAAE,CACV,MAAM,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,IAAI,EAAE,sBAAsB,EAAE,IAAI,EAAE,yBAAyB,EAAE,CAAC,CAAC;IAC9F,GAAG,SAAS;CACe,CAAC,CAAC"}

package/dist/src/unstable/auth/auth-middleware.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Auth middleware — HttpClient wrapping layer.
+ *
+ * Intercepts outgoing HTTP requests to inject Bearer tokens and handle
+ * automatic refresh on 401.
+ *
+ * Layer composition: wraps the base HttpClient so all downstream consumers
+ * get auth headers automatically for registry URLs.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as Layer from "effect/Layer";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { RegistryUrl } from "./registry-url.js";
+/**
+ * Creates an auth middleware layer that wraps HttpClient with token injection
+ * and automatic refresh on 401.
+ *
+ * The `flagToken` parameter allows per-command --token flag injection.
+ */
+export declare const makeAuthMiddlewareLive: (flagToken?: string) => Layer.Layer<HttpClient.HttpClient, never, RegistryUrl | HttpClient.HttpClient | AuthClient | CredentialStore>;
+/**
+ * Default auth middleware layer (no --token flag).
+ */
+export declare const AuthMiddlewareLive: Layer.Layer<HttpClient.HttpClient, never, RegistryUrl | HttpClient.HttpClient | AuthClient | CredentialStore>;
+//# sourceMappingURL=auth-middleware.d.ts.map

package/dist/src/unstable/auth/auth-middleware.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAE9D,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAKtC,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAQhD;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,GAAI,YAAY,MAAM,kHA0DtD,CAAC;AAEJ;;GAEG;AACH,eAAO,MAAM,kBAAkB,+GAA2B,CAAC"}

package/dist/src/unstable/auth/auth-middleware.js

@@ -0,0 +1,62 @@
+/**
+ * Auth middleware — HttpClient wrapping layer.
+ *
+ * Intercepts outgoing HTTP requests to inject Bearer tokens and handle
+ * automatic refresh on 401.
+ *
+ * Layer composition: wraps the base HttpClient so all downstream consumers
+ * get auth headers automatically for registry URLs.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import * as HttpClientRequest from "effect/unstable/http/HttpClientRequest";
+import { AuthClient } from "./auth-client.js";
+import { CredentialStore } from "./credential-store.js";
+import { RegistryUrl } from "./registry-url.js";
+import { refreshStoredToken, resolveRequestToken } from "./token-resolution.js";
+// -----------------------------------------------------------------------------
+// AuthMiddleware layer
+// -----------------------------------------------------------------------------
+/**
+ * Creates an auth middleware layer that wraps HttpClient with token injection
+ * and automatic refresh on 401.
+ *
+ * The `flagToken` parameter allows per-command --token flag injection.
+ */
+export const makeAuthMiddlewareLive = (flagToken) => Layer.effect(HttpClient.HttpClient, Effect.gen(function* () {
+    const baseClient = yield* HttpClient.HttpClient;
+    const store = yield* CredentialStore;
+    const authClient = yield* AuthClient;
+    const defaultRegistryUrl = yield* RegistryUrl;
+    const authLayer = Layer.mergeAll(Layer.succeed(CredentialStore, store), Layer.succeed(AuthClient, authClient));
+    return HttpClient.make((request) => Effect.gen(function* () {
+        const maybeToken = yield* resolveRequestToken(request.url, defaultRegistryUrl, flagToken).pipe(Effect.provide(authLayer), Effect.tapError((e) => Effect.logDebug("Token resolution failed", { error: e })), Effect.catch(() => Effect.succeed(Option.none())));
+        if (Option.isNone(maybeToken)) {
+            return yield* baseClient.execute(request);
+        }
+        const tokenSource = maybeToken.value;
+        const currentToken = tokenSource.token;
+        // Inject Bearer header
+        const authedRequest = HttpClientRequest.bearerToken(request, currentToken);
+        const response = yield* baseClient.execute(authedRequest);
+        // Automatic refresh on 401 (credential store tokens only)
+        if (response.status === 401 && tokenSource._tag === "CredentialStore") {
+            const refreshResult = yield* refreshStoredToken(tokenSource).pipe(Effect.provide(authLayer), Effect.option);
+            if (Option.isSome(refreshResult)) {
+                const retryRequest = HttpClientRequest.bearerToken(request, refreshResult.value.token);
+                return yield* baseClient.execute(retryRequest);
+            }
+            return response;
+        }
+        return response;
+    }));
+}));
+/**
+ * Default auth middleware layer (no --token flag).
+ */
+export const AuthMiddlewareLive = makeAuthMiddlewareLive();
+//# sourceMappingURL=auth-middleware.js.map

package/dist/src/unstable/auth/auth-middleware.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-middleware.js","sourceRoot":"","sources":["../../../../src/unstable/auth/auth-middleware.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAC9D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,iBAAiB,MAAM,wCAAwC,CAAC;AAE5E,OAAO,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAC9C,OAAO,EAAE,eAAe,EAAE,MAAM,uBAAuB,CAAC;AACxD,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAEhF,gFAAgF;AAChF,uBAAuB;AACvB,gFAAgF;AAEhF;;;;;GAKG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,CAAC,SAAkB,EAAE,EAAE,CAC3D,KAAK,CAAC,MAAM,CACV,UAAU,CAAC,UAAU,EACrB,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;IAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC;IAChD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,eAAe,CAAC;IACrC,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC;IACrC,MAAM,kBAAkB,GAAG,KAAK,CAAC,CAAC,WAAW,CAAC;IAC9C,MAAM,SAAS,GAAG,KAAK,CAAC,QAAQ,CAC9B,KAAK,CAAC,OAAO,CAAC,eAAe,EAAE,KAAK,CAAC,EACrC,KAAK,CAAC,OAAO,CAAC,UAAU,EAAE,UAAU,CAAC,CACtC,CAAC;IAEF,OAAO,UAAU,CAAC,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CACjC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAClB,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAC3C,OAAO,CAAC,GAAG,EACX,kBAAkB,EAClB,SAAS,CACV,CAAC,IAAI,CACJ,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EACzB,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,QAAQ,CAAC,yBAAyB,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC,EAChF,MAAM,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAe,CAAC,CAAC,CAC/D,CAAC;QAEF,IAAI,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,EAAE,CAAC;YAC9B,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC;QAC5C,CAAC;QAED,MAAM,WAAW,GAAG,UAAU,CAAC,KAAK,CAAC;QACrC,MAAM,YAAY,GAAG,WAAW,CAAC,KAAK,CAAC;QAEvC,uBAAuB;QACvB,MAAM,aAAa,GAAG,iBAAiB,CAAC,WAAW,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QAC3E,MAAM,QAAQ,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,aAAa,CAAC,CAAC;QAE1D,0DAA0D;QAC1D,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,WAAW,CAAC,IAAI,KAAK,iBAAiB,EAAE,CAAC;YACtE,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,WAAW,CAAC,CAAC,IAAI,CAC/D,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EACzB,MAAM,CAAC,MAAM,CACd,CAAC;YAEF,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBACjC,MAAM,YAAY,GAAG,iBAAiB,CAAC,WAAW,CAChD,OAAO,EACP,aAAa,CAAC,KAAK,CAAC,KAAK,CAC1B,CAAC;gBACF,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC;YACjD,CAAC;YAED,OAAO,QAAQ,CAAC;QAClB,CAAC;QAED,OAAO,QAAQ,CAAC;IAClB,CAAC,CAAC,CACH,CAAC;AACJ,CAAC,CAAC,CACH,CAAC;AAEJ;;GAEG;AACH,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,EAAE,CAAC"}

package/dist/src/unstable/auth/credential-store.d.ts

@@ -0,0 +1,61 @@
+/**
+ * CredentialStore Effect service — credential storage and auth policy.
+ *
+ * Tier 1: OS keychain (TODO: @napi-rs/keyring not yet added)
+ * Tier 2: Restricted-permission file (~/.config/axm/credentials.json)
+ *
+ * CI and container environments are token-only by policy. They do not persist
+ * credentials and should use AXM_TOKEN instead.
+ *
+ * @experimental This API is unstable and may change without notice.
+ */
+import * as FileSystem from "effect/FileSystem";
+import * as Path from "effect/Path";
+import * as ServiceMap from "effect/ServiceMap";
+import * as Effect from "effect/Effect";
+import * as Layer from "effect/Layer";
+import * as Option from "effect/Option";
+import { type AppError } from "../app-error/index.js";
+import { type Handle } from "../extensions/handle.js";
+import type { CredentialFile, StorageTier, StoredCredentials } from "./schema.js";
+export interface CredentialStoreService {
+    readonly save: (registryUrl: string, handle: Handle, credentials: {
+        readonly access_token: string;
+        readonly refresh_token: string;
+        readonly expires_at: string;
+    }) => Effect.Effect<void, AppError>;
+    readonly load: (registryUrl: string) => Effect.Effect<Option.Option<StoredCredentials>, AppError>;
+    readonly clear: (registryUrl: string) => Effect.Effect<void, AppError>;
+    readonly tier: StorageTier;
+    readonly allowsPersistedCredentials: boolean;
+}
+declare const CredentialStore_base: ServiceMap.ServiceClass<CredentialStore, "@agentxm/client-core/CredentialStore", CredentialStoreService>;
+export declare class CredentialStore extends CredentialStore_base {
+}
+export interface EnvironmentInfo {
+    readonly isSSH: boolean;
+    readonly isContainer: boolean;
+    readonly isWSL: boolean;
+    readonly isCI: boolean;
+    readonly isRoot: boolean;
+}
+export declare const detectEnvironment: Effect.Effect<{
+    isSSH: boolean;
+    isContainer: boolean;
+    isWSL: boolean;
+    isCI: boolean;
+    isRoot: boolean;
+}, never, FileSystem.FileSystem>;
+/**
+ * Select storage tier based on detected environment.
+ *
+ * Until keychain support lands, all persisted credentials use the restricted
+ * file backend. Whether persistence is allowed is a separate policy decision.
+ */
+export declare const selectTier: (_env: EnvironmentInfo) => StorageTier;
+export declare const canUsePersistedCredentials: (env: EnvironmentInfo) => boolean;
+export declare const makePersistedCredentialsUnsupportedError: () => AppError;
+export declare const CredentialStoreLive: Layer.Layer<CredentialStore, never, FileSystem.FileSystem | Path.Path>;
+export declare const CredentialStoreTest: (tier?: StorageTier, initialData?: CredentialFile, allowsPersistedCredentials?: boolean) => Layer.Layer<CredentialStore, never, never>;
+export {};
+//# sourceMappingURL=credential-store.d.ts.map

package/dist/src/unstable/auth/credential-store.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"credential-store.d.ts","sourceRoot":"","sources":["../../../../src/unstable/auth/credential-store.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AAEH,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,IAAI,MAAM,aAAa,CAAC;AACpC,OAAO,KAAK,UAAU,MAAM,mBAAmB,CAAC;AAChD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,EAAE,KAAK,QAAQ,EAAgB,MAAM,uBAAuB,CAAC;AAEpE,OAAO,EAAoB,KAAK,MAAM,EAAE,MAAM,yBAAyB,CAAC;AAExE,OAAO,KAAK,EAAE,cAAc,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAWlF,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,CACb,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,MAAM,EACd,WAAW,EAAE;QACX,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;QAC9B,QAAQ,CAAC,aAAa,EAAE,MAAM,CAAC;QAC/B,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;KAC7B,KACE,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACnC,QAAQ,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,EAAE,QAAQ,CAAC,CAAC;IAClG,QAAQ,CAAC,KAAK,EAAE,CAAC,WAAW,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;IACvE,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;IAC3B,QAAQ,CAAC,0BAA0B,EAAE,OAAO,CAAC;CAC9C;;AAED,qBAAa,eAAgB,SAAQ,oBAEpC;CAAG;AAwJJ,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAED,eAAO,MAAM,iBAAiB;;;;;;gCAQ5B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,UAAU,GAAI,MAAM,eAAe,KAAG,WAAgC,CAAC;AAEpF,eAAO,MAAM,0BAA0B,GAAI,KAAK,eAAe,KAAG,OACnC,CAAC;AAEhC,eAAO,MAAM,wCAAwC,gBAKjD,CAAC;AAML,eAAO,MAAM,mBAAmB,wEAkG/B,CAAC;AAMF,eAAO,MAAM,mBAAmB,GAC9B,OAAM,WAA+B,EACrC,cAAc,cAAc,EAC5B,6BAA6B,OAAO,+CA6DrC,CAAC"}