@artblocks/abx-cli 0.1.0-alpha.4 → 0.1.0-alpha.40

package/dist/commands/auth.d.ts

@@ -0,0 +1,54 @@
+import { type Flags } from '../flags.js';
+export interface DeviceLoginDeps {
+    fetchImpl?: typeof fetch;
+    sleep?: (ms: number) => Promise<void>;
+    now?: () => number;
+    openBrowser?: (url: string) => boolean;
+    line?: (message: string) => void;
+    warning?: (message: string) => void;
+}
+export interface DeviceLoginOptions {
+    baseUrl: string;
+    envVar: string;
+    envPath: string;
+    force?: boolean;
+    noOpen?: boolean;
+}
+export interface OAuthLogoutOptions {
+    baseUrl: string;
+    envVar: string;
+    envPath: string;
+    token?: string;
+}
+export interface OAuthLogoutDeps {
+    fetchImpl?: typeof fetch;
+}
+export type OAuthLogoutResult = {
+    status: 'absent';
+} | {
+    status: 'revoked';
+    local: 'removed' | 'external' | 'different';
+};
+/** Refuse the two silent secret-exposure modes: replacing a tracked file, or creating an unignored
+ * .env inside a Git worktree. A non-Git directory is fine. */
+export declare function assertPrivateEnvPath(envPath: string): void;
+/** Bearer-token grammar (RFC 6750) — the default value shape {@link saveEnvSecret} accepts. Exported
+ *  so a caller writing something differently-shaped (a URL, say) can pass its own `valuePattern`
+ *  instead of fighting this one. */
+export declare const BEARER_TOKEN_PATTERN: RegExp;
+export declare function saveEnvSecret(envPath: string, key: string, value: string, valuePattern?: RegExp): void;
+/** Validate and replace several env values with one atomic rename. A credential pair must never
+ * land half-updated because the process stopped between two individually-atomic writes. */
+export declare function saveEnvSecrets(envPath: string, entries: Array<{
+    key: string;
+    value: string;
+    valuePattern?: RegExp;
+}>): void;
+/** Standards-only core, dependency-injected for a no-secret-output regression test. */
+export declare function deviceLogin(options: DeviceLoginOptions, deps?: DeviceLoginDeps): Promise<void>;
+/** RFC 7009 logout: revoke remotely first, then remove the matching local assignment. Keeping the
+ * credential when discovery or revocation fails preserves the user's ability to retry safely. */
+export declare function oauthLogout(options: OAuthLogoutOptions, deps?: OAuthLogoutDeps): Promise<OAuthLogoutResult>;
+export declare function cmdAuth(args: string[], flags: Flags): Promise<void>;
+export declare const AUTH_HELP: string;
+//# sourceMappingURL=auth.d.ts.map

package/dist/commands/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAYA,OAAO,EAAE,KAAK,KAAK,EAAkB,MAAM,aAAa,CAAA;AA4BxD,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;IACxB,KAAK,CAAC,EAAE,CAAC,EAAE,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAA;IACrC,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;IAClB,WAAW,CAAC,EAAE,CAAC,GAAG,EAAE,MAAM,KAAK,OAAO,CAAA;IACtC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;IAChC,OAAO,CAAC,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,IAAI,CAAA;CACpC;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,OAAO,CAAA;IACf,MAAM,CAAC,EAAE,OAAO,CAAA;CACjB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,MAAM,CAAA;IACf,MAAM,EAAE,MAAM,CAAA;IACd,OAAO,EAAE,MAAM,CAAA;IACf,KAAK,CAAC,EAAE,MAAM,CAAA;CACf;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,CAAC,EAAE,OAAO,KAAK,CAAA;CACzB;AAED,MAAM,MAAM,iBAAiB,GACzB;IAAE,MAAM,EAAE,QAAQ,CAAA;CAAE,GACpB;IAAE,MAAM,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,SAAS,GAAG,UAAU,GAAG,WAAW,CAAA;CAAE,CAAA;AAqGtE;8DAC8D;AAC9D,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAc1D;AAED;;oCAEoC;AACpC,eAAO,MAAM,oBAAoB,QAA8B,CAAA;AAE/D,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,YAAY,GAAE,MAA6B,GAAG,IAAI,CAE5H;AAED;2FAC2F;AAC3F,wBAAgB,cAAc,CAC5B,OAAO,EAAE,MAAM,EACf,OAAO,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAC,CAAC,GAClE,IAAI,CA+CN;AA4DD,uFAAuF;AACvF,wBAAsB,WAAW,CAAC,OAAO,EAAE,kBAAkB,EAAE,IAAI,GAAE,eAAoB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuGxG;AAED;iGACiG;AACjG,wBAAsB,WAAW,CAC/B,OAAO,EAAE,kBAAkB,EAC3B,IAAI,GAAE,eAAoB,GACzB,OAAO,CAAC,iBAAiB,CAAC,CAgC5B;AAaD,wBAAsB,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,KAAK,EAAE,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAkDzE;AAED,eAAO,MAAM,SAAS,QAegH,CAAA"}

package/dist/commands/auth.js

@@ -0,0 +1,447 @@
+import { execFileSync, spawn } from 'node:child_process';
+import { existsSync, lstatSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs';
+import { basename, dirname, resolve as resolvePath } from 'node:path';
+import { randomBytes } from 'node:crypto';
+import { parseEnvContent } from '@artblocks/abx-sdk/node';
+import { positionalArgs } from '../flags.js';
+import { ABX_SERVICES_API_KEY_VAR, resolveRemote } from '../remote.js';
+import { bold, dim, g, info, ok } from '../output.js';
+const DEVICE_GRANT_TYPE = 'urn:ietf:params:oauth:grant-type:device_code';
+const DEVICE_CLIENT_ID = 'abx-cli';
+function cleanBaseUrl(value) {
+    return value.replace(/\/+$/, '');
+}
+function safeDescription(value) {
+    return typeof value === 'string' ? value.replace(/[\r\n\t]+/g, ' ').slice(0, 240) : '';
+}
+async function jsonObject(response) {
+    const body = (await response.json().catch(() => null));
+    return body && typeof body === 'object' && !Array.isArray(body) ? body : {};
+}
+function oauthFailure(prefix, response, body, sensitiveValues = []) {
+    const code = safeDescription(body.error) || `HTTP ${response.status}`;
+    let detail = safeDescription(body.error_description);
+    for (const value of sensitiveValues)
+        if (value)
+            detail = detail.replaceAll(value, '[redacted]');
+    return new Error(`${prefix}: ${code}${detail ? ` — ${detail}` : ''}`);
+}
+function assertUrl(value, field) {
+    if (typeof value !== 'string')
+        throw new Error(`OAuth discovery omitted ${field}`);
+    const parsed = new URL(value);
+    if (parsed.username || parsed.password)
+        throw new Error(`OAuth discovery returned credentials in ${field}`);
+    if (parsed.protocol !== 'https:' && !(parsed.protocol === 'http:' && ['127.0.0.1', 'localhost'].includes(parsed.hostname))) {
+        throw new Error(`OAuth discovery returned an insecure ${field}; HTTPS is required outside localhost`);
+    }
+    return parsed.toString();
+}
+function discoverUrl(baseUrl) {
+    const parsed = new URL(cleanBaseUrl(baseUrl));
+    const issuerPath = parsed.pathname.replace(/\/+$/, '');
+    parsed.pathname = `/.well-known/oauth-authorization-server${issuerPath}`;
+    parsed.search = '';
+    parsed.hash = '';
+    return parsed.toString();
+}
+async function discoverOAuthMetadata(baseUrl, fetchImpl) {
+    const expectedIssuer = cleanBaseUrl(assertUrl(baseUrl, 'provider base URL'));
+    const response = await fetchImpl(discoverUrl(expectedIssuer), {
+        headers: { accept: 'application/json' },
+        signal: AbortSignal.timeout(15_000)
+    });
+    const body = await jsonObject(response);
+    if (!response.ok)
+        throw oauthFailure('OAuth discovery failed', response, body);
+    const metadata = body;
+    assertUrl(metadata.issuer, 'issuer');
+    if (metadata.issuer !== expectedIssuer) {
+        throw new Error(`OAuth issuer mismatch: expected ${expectedIssuer}, received ${safeDescription(metadata.issuer)}`);
+    }
+    return metadata;
+}
+function defaultSleep(ms) {
+    return new Promise((resolve) => setTimeout(resolve, ms));
+}
+/** Best-effort only: the complete verification link is always printed, so headless and sandboxed
+ * agents still have a correct handoff when the OS refuses to launch a browser. */
+function defaultOpenBrowser(url) {
+    if (process.env.CI)
+        return false;
+    try {
+        const command = process.platform === 'darwin'
+            ? { file: 'open', args: [url] }
+            : process.platform === 'win32'
+                ? { file: 'rundll32', args: ['url.dll,FileProtocolHandler', url] }
+                : { file: 'xdg-open', args: [url] };
+        const child = spawn(command.file, command.args, { detached: true, stdio: 'ignore' });
+        child.on('error', () => { });
+        child.unref();
+        return true;
+    }
+    catch {
+        return false;
+    }
+}
+function activeEnvLine(source, key) {
+    const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+    return new RegExp(`^\\s*(?:export\\s+)?${escaped}\\s*=`, 'm').test(source);
+}
+function gitCheck(cwd, args) {
+    try {
+        execFileSync('git', args, { cwd, stdio: 'ignore' });
+        return true;
+    }
+    catch (error) {
+        const status = error.status;
+        return status === 1 || status === 128 ? false : null;
+    }
+}
+/** Refuse the two silent secret-exposure modes: replacing a tracked file, or creating an unignored
+ * .env inside a Git worktree. A non-Git directory is fine. */
+export function assertPrivateEnvPath(envPath) {
+    const cwd = dirname(envPath);
+    if (existsSync(envPath) && lstatSync(envPath).isSymbolicLink()) {
+        throw new Error(`refusing to store an API key through symbolic-link ${basename(envPath)}`);
+    }
+    if (!gitCheck(cwd, ['rev-parse', '--is-inside-work-tree']))
+        return;
+    if (gitCheck(cwd, ['ls-files', '--error-unmatch', '--', basename(envPath)])) {
+        throw new Error(`refusing to store an API key in tracked ${basename(envPath)} — remove it from Git history first`);
+    }
+    if (!gitCheck(cwd, ['check-ignore', '--quiet', '--', basename(envPath)])) {
+        throw new Error(`${basename(envPath)} is not Git-ignored. Add '${basename(envPath)}' to .gitignore, then run login again.`);
+    }
+}
+/** Bearer-token grammar (RFC 6750) — the default value shape {@link saveEnvSecret} accepts. Exported
+ *  so a caller writing something differently-shaped (a URL, say) can pass its own `valuePattern`
+ *  instead of fighting this one. */
+export const BEARER_TOKEN_PATTERN = /^[A-Za-z0-9._~+/-]+={0,}$/;
+export function saveEnvSecret(envPath, key, value, valuePattern = BEARER_TOKEN_PATTERN) {
+    saveEnvSecrets(envPath, [{ key, value, valuePattern }]);
+}
+/** Validate and replace several env values with one atomic rename. A credential pair must never
+ * land half-updated because the process stopped between two individually-atomic writes. */
+export function saveEnvSecrets(envPath, entries) {
+    if (!entries.length)
+        return;
+    const values = new Map();
+    for (const { key, value, valuePattern = BEARER_TOKEN_PATTERN } of entries) {
+        // Safe to round-trip through the CLI's minimal .env parser. Reject anything broader instead of
+        // quoting a provider-controlled value incorrectly — this is a plain `KEY=value` writer, no shell
+        // quoting, so a value that could ever contain a newline (or otherwise break the line grammar) is
+        // the actual risk `valuePattern` guards against, not "this specific value doesn't look like X".
+        if (!/^[A-Z][A-Z0-9_]*$/.test(key) || !valuePattern.test(value) || values.has(key)) {
+            throw new Error('the provided values cannot be stored safely in an environment file');
+        }
+        values.set(key, value);
+    }
+    const source = existsSync(envPath) ? readFileSync(envPath, 'utf8') : '';
+    const eol = source.includes('\r\n') ? '\r\n' : '\n';
+    const lines = source ? source.split(/\r?\n/) : [];
+    const next = [];
+    const replaced = new Set();
+    for (const line of lines) {
+        const found = [...values.keys()].find((key) => {
+            const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+            return new RegExp(`^\\s*(?:export\\s+)?${escaped}\\s*=`).test(line);
+        });
+        if (!found) {
+            next.push(line);
+            continue;
+        }
+        if (!replaced.has(found))
+            next.push(`${found}=${values.get(found)}`);
+        replaced.add(found);
+    }
+    let appended = false;
+    for (const [key, value] of values) {
+        if (replaced.has(key))
+            continue;
+        if (!appended && next.length && next[next.length - 1] !== '')
+            next.push('');
+        next.push(`${key}=${value}`);
+        appended = true;
+    }
+    while (next[next.length - 1] === '')
+        next.pop();
+    const output = `${next.join(eol)}${eol}`;
+    const temp = resolvePath(dirname(envPath), `.${basename(envPath)}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`);
+    try {
+        writeFileSync(temp, output, { encoding: 'utf8', mode: 0o600 });
+        renameSync(temp, envPath);
+    }
+    catch (error) {
+        if (existsSync(temp))
+            unlinkSync(temp);
+        throw error;
+    }
+}
+function envFileValue(envPath, key) {
+    if (!existsSync(envPath))
+        return undefined;
+    return parseEnvContent(readFileSync(envPath, 'utf8')).entries.find(([entryKey]) => entryKey === key)?.[1];
+}
+function envAssignmentKey(line) {
+    let candidate = line.trim();
+    if (!candidate || candidate.startsWith('#'))
+        return undefined;
+    candidate = candidate.replace(/^export\s+/, '');
+    const equals = candidate.indexOf('=');
+    return equals === -1 ? undefined : candidate.slice(0, equals).trim();
+}
+/** Remove every active assignment for one key. If conflicting duplicates existed, leaving a hidden
+ * assignment behind would silently log the next process back in, so logout removes the whole set. */
+function removeEnvSecret(envPath, key, expectedValue) {
+    if (!existsSync(envPath))
+        return false;
+    if (lstatSync(envPath).isSymbolicLink()) {
+        throw new Error(`API key was revoked at the provider, but refusing to modify symbolic-link ${basename(envPath)}`);
+    }
+    const source = readFileSync(envPath, 'utf8');
+    if (!activeEnvLine(source, key) || envFileValue(envPath, key) !== expectedValue)
+        return false;
+    const eol = source.includes('\r\n') ? '\r\n' : '\n';
+    const output = source
+        .split(/\r?\n/)
+        .filter((line) => envAssignmentKey(line) !== key)
+        .join(eol);
+    const temp = resolvePath(dirname(envPath), `.${basename(envPath)}.${process.pid}.${randomBytes(6).toString('hex')}.tmp`);
+    try {
+        writeFileSync(temp, output, { encoding: 'utf8', mode: 0o600 });
+        renameSync(temp, envPath);
+    }
+    catch (error) {
+        if (existsSync(temp))
+            unlinkSync(temp);
+        const detail = error instanceof Error ? safeDescription(error.message) : '';
+        throw new Error(`API key was revoked at the provider, but ${key} could not be removed from ${basename(envPath)}: ${detail || 'filesystem error'}`);
+    }
+    return true;
+}
+function assertLoginDestination(options) {
+    assertPrivateEnvPath(options.envPath);
+    const source = existsSync(options.envPath) ? readFileSync(options.envPath, 'utf8') : '';
+    const fileValue = parseEnvContent(source).entries.find(([key]) => key === options.envVar)?.[1];
+    if (activeEnvLine(source, options.envVar) && !options.force) {
+        throw new Error(`${options.envVar} already exists in ${basename(options.envPath)}; run \`abx auth logout\` before login to revoke it, ` +
+            'or pass --force to replace only the local value without revoking the old key');
+    }
+    if (process.env[options.envVar] !== undefined && process.env[options.envVar] !== fileValue) {
+        throw new Error(`${options.envVar} is already set outside ${basename(options.envPath)}. Unset it before login so it cannot shadow the newly issued key.`);
+    }
+}
+/** Standards-only core, dependency-injected for a no-secret-output regression test. */
+export async function deviceLogin(options, deps = {}) {
+    assertLoginDestination(options);
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const sleep = deps.sleep ?? defaultSleep;
+    const now = deps.now ?? Date.now;
+    const openBrowser = deps.openBrowser ?? defaultOpenBrowser;
+    const line = deps.line ?? console.log;
+    const warning = deps.warning ?? console.warn;
+    const metadata = await discoverOAuthMetadata(options.baseUrl, fetchImpl);
+    if (!metadata.grant_types_supported?.includes(DEVICE_GRANT_TYPE)) {
+        throw new Error('the provider does not advertise the OAuth device authorization grant');
+    }
+    const deviceEndpoint = assertUrl(metadata.device_authorization_endpoint, 'device_authorization_endpoint');
+    const tokenEndpoint = assertUrl(metadata.token_endpoint, 'token_endpoint');
+    const startResponse = await fetchImpl(deviceEndpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+        body: new URLSearchParams({ client_id: DEVICE_CLIENT_ID }),
+        signal: AbortSignal.timeout(15_000)
+    });
+    const startBody = await jsonObject(startResponse);
+    if (!startResponse.ok)
+        throw oauthFailure('device authorization failed', startResponse, startBody);
+    const grant = startBody;
+    if (typeof grant.device_code !== 'string' ||
+        typeof grant.user_code !== 'string' ||
+        typeof grant.expires_in !== 'number' ||
+        !Number.isFinite(grant.expires_in) ||
+        grant.expires_in <= 0) {
+        throw new Error('the provider returned an invalid device authorization response');
+    }
+    const verificationUrl = assertUrl(grant.verification_uri_complete ?? grant.verification_uri, 'verification_uri');
+    let pollSeconds = typeof grant.interval === 'number' && Number.isFinite(grant.interval) && grant.interval >= 1
+        ? grant.interval
+        : 5;
+    const deadline = now() + grant.expires_in * 1000;
+    line(`Browser approval: ${verificationUrl}`);
+    line(`Confirm code: ${grant.user_code}`);
+    if (!options.noOpen && !openBrowser(verificationUrl)) {
+        warning('Could not open a browser automatically; open the approval URL above.');
+    }
+    line('Waiting for human approval…');
+    while (now() < deadline) {
+        await sleep(pollSeconds * 1000);
+        // Re-check before polling so a destination changed during the human approval wait normally
+        // aborts before the provider consumes a one-time grant and issues an orphaned credential.
+        assertLoginDestination(options);
+        let response;
+        try {
+            response = await fetchImpl(tokenEndpoint, {
+                method: 'POST',
+                headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+                body: new URLSearchParams({
+                    grant_type: DEVICE_GRANT_TYPE,
+                    client_id: DEVICE_CLIENT_ID,
+                    device_code: grant.device_code
+                }),
+                signal: AbortSignal.timeout(15_000)
+            });
+        }
+        catch {
+            pollSeconds = Math.min(Math.max(pollSeconds * 2, 5), 30);
+            warning(`The provider is temporarily unreachable; retrying in ${pollSeconds}s.`);
+            continue;
+        }
+        const body = await jsonObject(response);
+        if (response.ok) {
+            const accessToken = body.access_token;
+            if (typeof accessToken !== 'string' || !accessToken || /[\r\n]/.test(accessToken)) {
+                throw new Error('the provider returned an invalid OAuth access token');
+            }
+            if (typeof body.token_type !== 'string' || body.token_type.toLowerCase() !== 'bearer') {
+                throw new Error('the provider returned an unsupported OAuth token type');
+            }
+            // Re-check after the human wait: another process must not have tracked, unignored, symlinked,
+            // or newly populated the destination while this command was polling.
+            assertLoginDestination(options);
+            saveEnvSecret(options.envPath, options.envVar, accessToken);
+            return;
+        }
+        const code = safeDescription(body.error);
+        if (code === 'authorization_pending')
+            continue;
+        if (code === 'slow_down') {
+            pollSeconds += 5;
+            continue;
+        }
+        if (response.status === 429 || response.status >= 500) {
+            const retryAfter = Number(response.headers.get('retry-after'));
+            pollSeconds = Number.isFinite(retryAfter) && retryAfter > 0 ? retryAfter : Math.min(pollSeconds * 2, 30);
+            warning(`The provider asked the CLI to wait; retrying in ${pollSeconds}s.`);
+            continue;
+        }
+        if (code === 'access_denied')
+            throw new Error('device authorization was denied');
+        if (code === 'expired_token')
+            throw new Error('device authorization expired; run login again');
+        throw oauthFailure('OAuth token exchange failed', response, body, [grant.device_code]);
+    }
+    throw new Error('device authorization expired; run login again');
+}
+/** RFC 7009 logout: revoke remotely first, then remove the matching local assignment. Keeping the
+ * credential when discovery or revocation fails preserves the user's ability to retry safely. */
+export async function oauthLogout(options, deps = {}) {
+    const fileValue = envFileValue(options.envPath, options.envVar);
+    const token = options.token || fileValue;
+    if (!token)
+        return { status: 'absent' };
+    const fetchImpl = deps.fetchImpl ?? fetch;
+    const metadata = await discoverOAuthMetadata(options.baseUrl, fetchImpl);
+    const revocationEndpoint = assertUrl(metadata.revocation_endpoint, 'revocation_endpoint');
+    const response = await fetchImpl(revocationEndpoint, {
+        method: 'POST',
+        headers: { 'content-type': 'application/x-www-form-urlencoded', accept: 'application/json' },
+        body: new URLSearchParams({
+            client_id: DEVICE_CLIENT_ID,
+            token,
+            token_type_hint: 'access_token'
+        }),
+        signal: AbortSignal.timeout(15_000)
+    });
+    if (!response.ok) {
+        const body = await jsonObject(response);
+        throw oauthFailure('OAuth token revocation failed', response, body, [token]);
+    }
+    const currentFileValue = envFileValue(options.envPath, options.envVar);
+    const local = currentFileValue === token && removeEnvSecret(options.envPath, options.envVar, token)
+        ? 'removed'
+        : currentFileValue === undefined
+            ? 'external'
+            : 'different';
+    if (process.env[options.envVar] === token)
+        delete process.env[options.envVar];
+    return { status: 'revoked', local };
+}
+function targetForAuth(spec, action) {
+    const target = resolveRemote(spec);
+    if (!target)
+        throw new Error(`auth ${action} needs a remote`);
+    if (target.source === 'url' || target.source === 'default') {
+        throw new Error(`auth ${action} needs a named remote so the credential has an unambiguous env var. Configure ABX_REMOTE_<NAME>_URL, then run \`abx auth ${action} <name>\`.`);
+    }
+    return target;
+}
+export async function cmdAuth(args, flags) {
+    const positions = positionalArgs(args);
+    const subcommand = positions[0];
+    if ((subcommand !== 'login' && subcommand !== 'logout') || positions.length > 2) {
+        throw new Error('usage: abx auth <login|logout> [<remote-name>]');
+    }
+    if (flags.remote === 'true')
+        throw new Error('--remote needs a named remote, for example `--remote abx`');
+    const positionalTarget = positions[1];
+    const flagTarget = typeof flags.remote === 'string' && flags.remote !== 'true' ? flags.remote : undefined;
+    if (positionalTarget && flagTarget)
+        throw new Error('choose a positional remote name or --remote, not both');
+    const spec = positionalTarget ?? flagTarget ?? 'abx';
+    const target = targetForAuth(spec, subcommand);
+    const envPath = resolvePath(process.cwd(), '.env');
+    if (subcommand === 'logout') {
+        console.log(`\n  ${bold('ABX logout')} ${dim(`→ ${target.url}`)}`);
+        const result = await oauthLogout({
+            baseUrl: target.url,
+            envVar: target.tokenVar,
+            envPath,
+            token: target.token
+        });
+        if (result.status === 'absent') {
+            info(`no ${target.tokenVar} credential is active; already logged out locally`);
+            return;
+        }
+        ok('revoked the current API key at the provider');
+        if (result.local === 'removed')
+            ok(`removed ${target.tokenVar} from ${basename(envPath)}`);
+        else if (result.local === 'external') {
+            info(`${target.tokenVar} came from your shell or another environment source; unset it there (the value is now revoked).`);
+        }
+        else {
+            info(`${basename(envPath)} contains a different ${target.tokenVar}; it is still active and was left unchanged. ` +
+                `Unset the shadowing environment value, then run logout again to revoke the file credential too.`);
+        }
+        return;
+    }
+    console.log(`\n  ${bold('ABX device login')} ${dim(`→ ${target.url}`)}`);
+    info('Email and the one-time code stay in your browser. The CLI receives the API key after approval and never prints it.');
+    await deviceLogin({
+        baseUrl: target.url,
+        envVar: target.tokenVar,
+        envPath,
+        force: flags.force !== undefined,
+        noOpen: flags['no-open'] !== undefined
+    });
+    ok(`authorized and saved ${target.tokenVar} in your private .env (the key was not printed)`);
+    info(`verify it with ${g(`abx remote ${target.name?.toLowerCase() ?? spec}`)}`);
+}
+export const AUTH_HELP = `
+  ${bold('abx auth login')} [<remote-name>] ${dim('— authorize this CLI with OAuth 2.0 Device Authorization Grant')}
+    ${g('abx auth login')}             first-party ABX Services (default)
+    ${g('abx auth login <name>')}      another named remote configured by ABX_REMOTE_<NAME>_URL
+    ${g('--remote <name>')}            equivalent target spelling for agent workflows
+    ${g('--no-open')}                  print the browser URL and code without trying to open it
+    ${g('--force')}                    recovery only: replace the local value without revoking the displaced key
+    ${dim(`The browser owns email + OTP approval. Only the waiting CLI receives the key, stores it as ${ABX_SERVICES_API_KEY_VAR}`)}
+    ${dim('(or the named remote\'s token variable), and never prints it. .env must be Git-ignored and must not be tracked.')}
+    ${dim('The stored key remains valid until revoked; reuse it across normal tasks and agent sessions.')}
+
+  ${bold('abx auth logout')} [<remote-name>] ${dim('— revoke the current API key, then remove its matching .env entry')}
+    ${g('abx auth logout')}            first-party ABX Services (default)
+    ${g('abx auth logout <name>')}     another named remote with OAuth revocation discovery
+    ${g('--remote <name>')}            equivalent target spelling for agent workflows
+    ${dim('Use for teardown, compromise, rotation, or cleanup—not after each task. Remote revocation happens before local removal.')}`;
+//# sourceMappingURL=auth.js.map

package/dist/commands/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/commands/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAAE,KAAK,EAAE,MAAM,oBAAoB,CAAA;AACxD,OAAO,EACL,UAAU,EACV,SAAS,EACT,YAAY,EACZ,UAAU,EACV,UAAU,EACV,aAAa,EACd,MAAM,SAAS,CAAA;AAChB,OAAO,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,IAAI,WAAW,EAAE,MAAM,WAAW,CAAA;AACrE,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAA;AACzC,OAAO,EAAE,eAAe,EAAE,MAAM,yBAAyB,CAAA;AACzD,OAAO,EAAc,cAAc,EAAE,MAAM,aAAa,CAAA;AACxD,OAAO,EACL,wBAAwB,EACxB,aAAa,EAEd,MAAM,cAAc,CAAA;AACrB,OAAO,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC,EAAE,IAAI,EAAE,EAAE,EAAE,MAAM,cAAc,CAAA;AAErD,MAAM,iBAAiB,GAAG,8CAA8C,CAAA;AACxE,MAAM,gBAAgB,GAAG,SAAS,CAAA;AAmDlC,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;AAClC,CAAC;AAED,SAAS,eAAe,CAAC,KAAc;IACrC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,EAAE,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AACxF,CAAC;AAED,KAAK,UAAU,UAAU,CAAC,QAAkB;IAC1C,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,CAAY,CAAA;IACjE,OAAO,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAE,IAAgC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC1G,CAAC;AAED,SAAS,YAAY,CACnB,MAAc,EACd,QAAkB,EAClB,IAA6B,EAC7B,kBAA4B,EAAE;IAE9B,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,QAAQ,QAAQ,CAAC,MAAM,EAAE,CAAA;IACrE,IAAI,MAAM,GAAG,eAAe,CAAC,IAAI,CAAC,iBAAiB,CAAC,CAAA;IACpD,KAAK,MAAM,KAAK,IAAI,eAAe;QAAE,IAAI,KAAK;YAAE,MAAM,GAAG,MAAM,CAAC,UAAU,CAAC,KAAK,EAAE,YAAY,CAAC,CAAA;IAC/F,OAAO,IAAI,KAAK,CAAC,GAAG,MAAM,KAAK,IAAI,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;AACvE,CAAC;AAED,SAAS,SAAS,CAAC,KAAc,EAAE,KAAa;IAC9C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,KAAK,EAAE,CAAC,CAAA;IAClF,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,CAAA;IAC7B,IAAI,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,2CAA2C,KAAK,EAAE,CAAC,CAAA;IAC3G,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,CAAC,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW,EAAE,WAAW,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,EAAE,CAAC;QAC3H,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,uCAAuC,CAAC,CAAA;IACvG,CAAC;IACD,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAA;AAC1B,CAAC;AAED,SAAS,WAAW,CAAC,OAAe;IAClC,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC,CAAA;IAC7C,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,CAAA;IACtD,MAAM,CAAC,QAAQ,GAAG,0CAA0C,UAAU,EAAE,CAAA;IACxE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAA;IAClB,MAAM,CAAC,IAAI,GAAG,EAAE,CAAA;IAChB,OAAO,MAAM,CAAC,QAAQ,EAAE,CAAA;AAC1B,CAAC;AAED,KAAK,UAAU,qBAAqB,CAAC,OAAe,EAAE,SAAuB;IAC3E,MAAM,cAAc,GAAG,YAAY,CAAC,SAAS,CAAC,OAAO,EAAE,mBAAmB,CAAC,CAAC,CAAA;IAC5E,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,WAAW,CAAC,cAAc,CAAC,EAAE;QAC5D,OAAO,EAAE,EAAE,MAAM,EAAE,kBAAkB,EAAE;QACvC,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAA;IACF,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;IACvC,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,MAAM,YAAY,CAAC,wBAAwB,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAA;IAC9E,MAAM,QAAQ,GAAG,IAAgC,CAAA;IACjD,SAAS,CAAC,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAA;IACpC,IAAI,QAAQ,CAAC,MAAM,KAAK,cAAc,EAAE,CAAC;QACvC,MAAM,IAAI,KAAK,CAAC,mCAAmC,cAAc,cAAc,eAAe,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC,CAAA;IACpH,CAAC;IACD,OAAO,QAAQ,CAAA;AACjB,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC9B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,CAAA;AAC1D,CAAC;AAED;kFACkF;AAClF,SAAS,kBAAkB,CAAC,GAAW;IACrC,IAAI,OAAO,CAAC,GAAG,CAAC,EAAE;QAAE,OAAO,KAAK,CAAA;IAChC,IAAI,CAAC;QACH,MAAM,OAAO,GACX,OAAO,CAAC,QAAQ,KAAK,QAAQ;YAC3B,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE;YAC/B,CAAC,CAAC,OAAO,CAAC,QAAQ,KAAK,OAAO;gBAC5B,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,6BAA6B,EAAE,GAAG,CAAC,EAAE;gBAClE,CAAC,CAAC,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAA;QACzC,MAAM,KAAK,GAAG,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,IAAI,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACpF,KAAK,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE,GAAE,CAAC,CAAC,CAAA;QAC3B,KAAK,CAAC,KAAK,EAAE,CAAA;QACb,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAA;IACd,CAAC;AACH,CAAC;AAED,SAAS,aAAa,CAAC,MAAc,EAAE,GAAW;IAChD,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;IAC1D,OAAO,IAAI,MAAM,CAAC,uBAAuB,OAAO,OAAO,EAAE,GAAG,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAA;AAC5E,CAAC;AAED,SAAS,QAAQ,CAAC,GAAW,EAAE,IAAc;IAC3C,IAAI,CAAC;QACH,YAAY,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAA;QACnD,OAAO,IAAI,CAAA;IACb,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,MAAM,MAAM,GAAI,KAA6B,CAAC,MAAM,CAAA;QACpD,OAAO,MAAM,KAAK,CAAC,IAAI,MAAM,KAAK,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAA;IACtD,CAAC;AACH,CAAC;AAED;8DAC8D;AAC9D,MAAM,UAAU,oBAAoB,CAAC,OAAe;IAClD,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,CAAA;IAC5B,IAAI,UAAU,CAAC,OAAO,CAAC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,KAAK,CAAC,sDAAsD,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IAC5F,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,WAAW,EAAE,uBAAuB,CAAC,CAAC;QAAE,OAAM;IAClE,IAAI,QAAQ,CAAC,GAAG,EAAE,CAAC,UAAU,EAAE,iBAAiB,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QAC5E,MAAM,IAAI,KAAK,CAAC,2CAA2C,QAAQ,CAAC,OAAO,CAAC,qCAAqC,CAAC,CAAA;IACpH,CAAC;IACD,IAAI,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,cAAc,EAAE,SAAS,EAAE,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,CAAC;QACzE,MAAM,IAAI,KAAK,CACb,GAAG,QAAQ,CAAC,OAAO,CAAC,6BAA6B,QAAQ,CAAC,OAAO,CAAC,wCAAwC,CAC3G,CAAA;IACH,CAAC;AACH,CAAC;AAED;;oCAEoC;AACpC,MAAM,CAAC,MAAM,oBAAoB,GAAG,2BAA2B,CAAA;AAE/D,MAAM,UAAU,aAAa,CAAC,OAAe,EAAE,GAAW,EAAE,KAAa,EAAE,eAAuB,oBAAoB;IACpH,cAAc,CAAC,OAAO,EAAE,CAAC,EAAC,GAAG,EAAE,KAAK,EAAE,YAAY,EAAC,CAAC,CAAC,CAAA;AACvD,CAAC;AAED;2FAC2F;AAC3F,MAAM,UAAU,cAAc,CAC5B,OAAe,EACf,OAAmE;IAEnE,IAAI,CAAC,OAAO,CAAC,MAAM;QAAE,OAAM;IAC3B,MAAM,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAA;IACxC,KAAK,MAAM,EAAC,GAAG,EAAE,KAAK,EAAE,YAAY,GAAG,oBAAoB,EAAC,IAAI,OAAO,EAAE,CAAC;QAC1E,+FAA+F;QAC/F,iGAAiG;QACjG,iGAAiG;QACjG,gGAAgG;QAC9F,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,MAAM,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;YACnF,MAAM,IAAI,KAAK,CAAC,oEAAoE,CAAC,CAAA;QACvF,CAAC;QACD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAA;IACxB,CAAC;IACD,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvE,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACnD,MAAM,KAAK,GAAG,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACjD,MAAM,IAAI,GAAa,EAAE,CAAA;IACzB,MAAM,QAAQ,GAAG,IAAI,GAAG,EAAU,CAAA;IAClC,KAAK,MAAM,IAAI,IAAI,KAAK,EAAE,CAAC;QACzB,MAAM,KAAK,GAAG,CAAC,GAAG,MAAM,CAAC,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,GAAG,EAAE,EAAE;YAC5C,MAAM,OAAO,GAAG,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAA;YAC1D,OAAO,IAAI,MAAM,CAAC,uBAAuB,OAAO,OAAO,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACrE,CAAC,CAAC,CAAA;QACF,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;YACf,SAAQ;QACV,CAAC;QACD,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC;YAAE,IAAI,CAAC,IAAI,CAAC,GAAG,KAAK,IAAI,MAAM,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC,CAAA;QACpE,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAA;IACrB,CAAC;IACD,IAAI,QAAQ,GAAG,KAAK,CAAA;IACpB,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QAClC,IAAI,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC;YAAE,SAAQ;QAC/B,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;YAAE,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,CAAA;QAC3E,IAAI,CAAC,IAAI,CAAC,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC,CAAA;QAC5B,QAAQ,GAAG,IAAI,CAAA;IACjB,CAAC;IACD,OAAO,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,KAAK,EAAE;QAAE,IAAI,CAAC,GAAG,EAAE,CAAA;IAC/C,MAAM,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAA;IACxC,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACxH,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9D,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,KAAK,CAAA;IACb,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,GAAW;IAChD,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,SAAS,CAAA;IAC1C,OAAO,eAAe,CAAC,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC,QAAQ,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAC3G,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,IAAI,SAAS,GAAG,IAAI,CAAC,IAAI,EAAE,CAAA;IAC3B,IAAI,CAAC,SAAS,IAAI,SAAS,CAAC,UAAU,CAAC,GAAG,CAAC;QAAE,OAAO,SAAS,CAAA;IAC7D,SAAS,GAAG,SAAS,CAAC,OAAO,CAAC,YAAY,EAAE,EAAE,CAAC,CAAA;IAC/C,MAAM,MAAM,GAAG,SAAS,CAAC,OAAO,CAAC,GAAG,CAAC,CAAA;IACrC,OAAO,MAAM,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,CAAA;AACtE,CAAC;AAED;qGACqG;AACrG,SAAS,eAAe,CAAC,OAAe,EAAE,GAAW,EAAE,aAAqB;IAC1E,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IACtC,IAAI,SAAS,CAAC,OAAO,CAAC,CAAC,cAAc,EAAE,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6EAA6E,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;IACnH,CAAC;IACD,MAAM,MAAM,GAAG,YAAY,CAAC,OAAO,EAAE,MAAM,CAAC,CAAA;IAC5C,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,CAAC,IAAI,YAAY,CAAC,OAAO,EAAE,GAAG,CAAC,KAAK,aAAa;QAAE,OAAO,KAAK,CAAA;IAC7F,MAAM,GAAG,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAA;IACnD,MAAM,MAAM,GAAG,MAAM;SAClB,KAAK,CAAC,OAAO,CAAC;SACd,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,gBAAgB,CAAC,IAAI,CAAC,KAAK,GAAG,CAAC;SAChD,IAAI,CAAC,GAAG,CAAC,CAAA;IACZ,MAAM,IAAI,GAAG,WAAW,CAAC,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,QAAQ,CAAC,OAAO,CAAC,IAAI,OAAO,CAAC,GAAG,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAA;IACxH,IAAI,CAAC;QACH,aAAa,CAAC,IAAI,EAAE,MAAM,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAA;QAC9D,UAAU,CAAC,IAAI,EAAE,OAAO,CAAC,CAAA;IAC3B,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACf,IAAI,UAAU,CAAC,IAAI,CAAC;YAAE,UAAU,CAAC,IAAI,CAAC,CAAA;QACtC,MAAM,MAAM,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;QAC3E,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,8BAA8B,QAAQ,CAAC,OAAO,CAAC,KAAK,MAAM,IAAI,kBAAkB,EAAE,CAClI,CAAA;IACH,CAAC;IACD,OAAO,IAAI,CAAA;AACb,CAAC;AAED,SAAS,sBAAsB,CAAC,OAA2B;IACzD,oBAAoB,CAAC,OAAO,CAAC,OAAO,CAAC,CAAA;IACrC,MAAM,MAAM,GAAG,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;IACvF,MAAM,SAAS,GAAG,eAAe,CAAC,MAAM,CAAC,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,CAAC,EAAE,EAAE,CAAC,GAAG,KAAK,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;IAC9F,IAAI,aAAa,CAAC,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,MAAM,sBAAsB,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,uDAAuD;YACrH,8EAA8E,CACjF,CAAA;IACH,CAAC;IACD,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,SAAS,EAAE,CAAC;QAC3F,MAAM,IAAI,KAAK,CACb,GAAG,OAAO,CAAC,MAAM,2BAA2B,QAAQ,CAAC,OAAO,CAAC,OAAO,CAAC,mEAAmE,CACzI,CAAA;IACH,CAAC;AACH,CAAC;AAED,uFAAuF;AACvF,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,OAA2B,EAAE,OAAwB,EAAE;IACvF,sBAAsB,CAAC,OAAO,CAAC,CAAA;IAC/B,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,IAAI,YAAY,CAAA;IACxC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,CAAA;IAChC,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,kBAAkB,CAAA;IAC1D,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,CAAC,GAAG,CAAA;IACrC,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,IAAI,CAAA;IAE5C,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxE,IAAI,CAAC,QAAQ,CAAC,qBAAqB,EAAE,QAAQ,CAAC,iBAAiB,CAAC,EAAE,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,sEAAsE,CAAC,CAAA;IACzF,CAAC;IACD,MAAM,cAAc,GAAG,SAAS,CAAC,QAAQ,CAAC,6BAA6B,EAAE,+BAA+B,CAAC,CAAA;IACzG,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,cAAc,EAAE,gBAAgB,CAAC,CAAA;IAE1E,MAAM,aAAa,GAAG,MAAM,SAAS,CAAC,cAAc,EAAE;QACpD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,gBAAgB,EAAE,CAAC;QAC1D,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAA;IACF,MAAM,SAAS,GAAG,MAAM,UAAU,CAAC,aAAa,CAAC,CAAA;IACjD,IAAI,CAAC,aAAa,CAAC,EAAE;QAAE,MAAM,YAAY,CAAC,6BAA6B,EAAE,aAAa,EAAE,SAAS,CAAC,CAAA;IAClG,MAAM,KAAK,GAAG,SAAmD,CAAA;IACjE,IACE,OAAO,KAAK,CAAC,WAAW,KAAK,QAAQ;QACrC,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ;QACnC,OAAO,KAAK,CAAC,UAAU,KAAK,QAAQ;QACpC,CAAC,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;QAClC,KAAK,CAAC,UAAU,IAAI,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,gEAAgE,CAAC,CAAA;IACnF,CAAC;IACD,MAAM,eAAe,GAAG,SAAS,CAAC,KAAK,CAAC,yBAAyB,IAAI,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,CAAA;IAChH,IAAI,WAAW,GACb,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,KAAK,CAAC,QAAQ,IAAI,CAAC;QAC1F,CAAC,CAAC,KAAK,CAAC,QAAQ;QAChB,CAAC,CAAC,CAAC,CAAA;IACP,MAAM,QAAQ,GAAG,GAAG,EAAE,GAAG,KAAK,CAAC,UAAU,GAAG,IAAI,CAAA;IAEhD,IAAI,CAAC,qBAAqB,eAAe,EAAE,CAAC,CAAA;IAC5C,IAAI,CAAC,iBAAiB,KAAK,CAAC,SAAS,EAAE,CAAC,CAAA;IACxC,IAAI,CAAC,OAAO,CAAC,MAAM,IAAI,CAAC,WAAW,CAAC,eAAe,CAAC,EAAE,CAAC;QACrD,OAAO,CAAC,sEAAsE,CAAC,CAAA;IACjF,CAAC;IACD,IAAI,CAAC,6BAA6B,CAAC,CAAA;IAEnC,OAAO,GAAG,EAAE,GAAG,QAAQ,EAAE,CAAC;QACxB,MAAM,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,CAAA;QAC/B,2FAA2F;QAC3F,0FAA0F;QAC1F,sBAAsB,CAAC,OAAO,CAAC,CAAA;QAC/B,IAAI,QAAkB,CAAA;QACtB,IAAI,CAAC;YACH,QAAQ,GAAG,MAAM,SAAS,CAAC,aAAa,EAAE;gBACxC,MAAM,EAAE,MAAM;gBACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;gBAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;oBACxB,UAAU,EAAE,iBAAiB;oBAC7B,SAAS,EAAE,gBAAgB;oBAC3B,WAAW,EAAE,KAAK,CAAC,WAAW;iBAC/B,CAAC;gBACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;aACpC,CAAC,CAAA;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,WAAW,GAAG,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAA;YACxD,OAAO,CAAC,wDAAwD,WAAW,IAAI,CAAC,CAAA;YAChF,SAAQ;QACV,CAAC;QACD,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;QACvC,IAAI,QAAQ,CAAC,EAAE,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,IAAI,CAAC,YAAY,CAAA;YACrC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,IAAI,QAAQ,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,CAAC;gBAClF,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC,CAAA;YACxE,CAAC;YACD,IAAI,OAAO,IAAI,CAAC,UAAU,KAAK,QAAQ,IAAI,IAAI,CAAC,UAAU,CAAC,WAAW,EAAE,KAAK,QAAQ,EAAE,CAAC;gBACtF,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;YAC1E,CAAC;YACD,8FAA8F;YAC9F,qEAAqE;YACrE,sBAAsB,CAAC,OAAO,CAAC,CAAA;YAC/B,aAAa,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,WAAW,CAAC,CAAA;YAC3D,OAAM;QACR,CAAC;QAED,MAAM,IAAI,GAAG,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAA;QACxC,IAAI,IAAI,KAAK,uBAAuB;YAAE,SAAQ;QAC9C,IAAI,IAAI,KAAK,WAAW,EAAE,CAAC;YACzB,WAAW,IAAI,CAAC,CAAA;YAChB,SAAQ;QACV,CAAC;QACD,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,EAAE,CAAC;YACtD,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC,CAAA;YAC9D,WAAW,GAAG,MAAM,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,UAAU,GAAG,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,WAAW,GAAG,CAAC,EAAE,EAAE,CAAC,CAAA;YACxG,OAAO,CAAC,mDAAmD,WAAW,IAAI,CAAC,CAAA;YAC3E,SAAQ;QACV,CAAC;QACD,IAAI,IAAI,KAAK,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAA;QAChF,IAAI,IAAI,KAAK,eAAe;YAAE,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;QAC9F,MAAM,YAAY,CAAC,6BAA6B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;IACxF,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,+CAA+C,CAAC,CAAA;AAClE,CAAC;AAED;iGACiG;AACjG,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,OAA2B,EAC3B,OAAwB,EAAE;IAE1B,MAAM,SAAS,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IAC/D,MAAM,KAAK,GAAG,OAAO,CAAC,KAAK,IAAI,SAAS,CAAA;IACxC,IAAI,CAAC,KAAK;QAAE,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,KAAK,CAAA;IACzC,MAAM,QAAQ,GAAG,MAAM,qBAAqB,CAAC,OAAO,CAAC,OAAO,EAAE,SAAS,CAAC,CAAA;IACxE,MAAM,kBAAkB,GAAG,SAAS,CAAC,QAAQ,CAAC,mBAAmB,EAAE,qBAAqB,CAAC,CAAA;IACzF,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,kBAAkB,EAAE;QACnD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE,MAAM,EAAE,kBAAkB,EAAE;QAC5F,IAAI,EAAE,IAAI,eAAe,CAAC;YACxB,SAAS,EAAE,gBAAgB;YAC3B,KAAK;YACL,eAAe,EAAE,cAAc;SAChC,CAAC;QACF,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC;KACpC,CAAC,CAAA;IACF,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,QAAQ,CAAC,CAAA;QACvC,MAAM,YAAY,CAAC,+BAA+B,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,KAAK,CAAC,CAAC,CAAA;IAC9E,CAAC;IAED,MAAM,gBAAgB,GAAG,YAAY,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,CAAA;IACtE,MAAM,KAAK,GACT,gBAAgB,KAAK,KAAK,IAAI,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,OAAO,CAAC,MAAM,EAAE,KAAK,CAAC;QACnF,CAAC,CAAC,SAAS;QACX,CAAC,CAAC,gBAAgB,KAAK,SAAS;YAC9B,CAAC,CAAC,UAAU;YACZ,CAAC,CAAC,WAAW,CAAA;IACnB,IAAI,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,KAAK;QAAE,OAAO,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,MAAM,CAAC,CAAA;IAC7E,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,CAAA;AACrC,CAAC;AAED,SAAS,aAAa,CAAC,IAAY,EAAE,MAA0B;IAC7D,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,CAAC,CAAA;IAClC,IAAI,CAAC,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,QAAQ,MAAM,iBAAiB,CAAC,CAAA;IAC7D,IAAI,MAAM,CAAC,MAAM,KAAK,KAAK,IAAI,MAAM,CAAC,MAAM,KAAK,SAAS,EAAE,CAAC;QAC3D,MAAM,IAAI,KAAK,CACb,QAAQ,MAAM,4HAA4H,MAAM,YAAY,CAC7J,CAAA;IACH,CAAC;IACD,OAAO,MAAM,CAAA;AACf,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,OAAO,CAAC,IAAc,EAAE,KAAY;IACxD,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,CAAA;IACtC,MAAM,UAAU,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;IAC/B,IAAI,CAAC,UAAU,KAAK,OAAO,IAAI,UAAU,KAAK,QAAQ,CAAC,IAAI,SAAS,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAChF,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAA;IACnE,CAAC;IACD,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM;QAAE,MAAM,IAAI,KAAK,CAAC,2DAA2D,CAAC,CAAA;IACzG,MAAM,gBAAgB,GAAG,SAAS,CAAC,CAAC,CAAC,CAAA;IACrC,MAAM,UAAU,GAAG,OAAO,KAAK,CAAC,MAAM,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,SAAS,CAAA;IACzG,IAAI,gBAAgB,IAAI,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAA;IAC5G,MAAM,IAAI,GAAG,gBAAgB,IAAI,UAAU,IAAI,KAAK,CAAA;IACpD,MAAM,MAAM,GAAG,aAAa,CAAC,IAAI,EAAE,UAAU,CAAC,CAAA;IAC9C,MAAM,OAAO,GAAG,WAAW,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,MAAM,CAAC,CAAA;IAElD,IAAI,UAAU,KAAK,QAAQ,EAAE,CAAC;QAC5B,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,YAAY,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;QAClE,MAAM,MAAM,GAAG,MAAM,WAAW,CAAC;YAC/B,OAAO,EAAE,MAAM,CAAC,GAAG;YACnB,MAAM,EAAE,MAAM,CAAC,QAAQ;YACvB,OAAO;YACP,KAAK,EAAE,MAAM,CAAC,KAAK;SACpB,CAAC,CAAA;QACF,IAAI,MAAM,CAAC,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC/B,IAAI,CAAC,MAAM,MAAM,CAAC,QAAQ,mDAAmD,CAAC,CAAA;YAC9E,OAAM;QACR,CAAC;QACD,EAAE,CAAC,6CAA6C,CAAC,CAAA;QACjD,IAAI,MAAM,CAAC,KAAK,KAAK,SAAS;YAAE,EAAE,CAAC,WAAW,MAAM,CAAC,QAAQ,SAAS,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC,CAAA;aACrF,IAAI,MAAM,CAAC,KAAK,KAAK,UAAU,EAAE,CAAC;YACrC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,iGAAiG,CAAC,CAAA;QAC3H,CAAC;aAAM,CAAC;YACN,IAAI,CACF,GAAG,QAAQ,CAAC,OAAO,CAAC,yBAAyB,MAAM,CAAC,QAAQ,+CAA+C;gBACzG,iGAAiG,CACpG,CAAA;QACH,CAAC;QACD,OAAM;IACR,CAAC;IAED,OAAO,CAAC,GAAG,CAAC,OAAO,IAAI,CAAC,kBAAkB,CAAC,IAAI,GAAG,CAAC,KAAK,MAAM,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAA;IACxE,IAAI,CAAC,oHAAoH,CAAC,CAAA;IAC1H,MAAM,WAAW,CAAC;QAChB,OAAO,EAAE,MAAM,CAAC,GAAG;QACnB,MAAM,EAAE,MAAM,CAAC,QAAQ;QACvB,OAAO;QACP,KAAK,EAAE,KAAK,CAAC,KAAK,KAAK,SAAS;QAChC,MAAM,EAAE,KAAK,CAAC,SAAS,CAAC,KAAK,SAAS;KACvC,CAAC,CAAA;IACF,EAAE,CAAC,wBAAwB,MAAM,CAAC,QAAQ,iDAAiD,CAAC,CAAA;IAC5F,IAAI,CAAC,kBAAkB,CAAC,CAAC,cAAc,MAAM,CAAC,IAAI,EAAE,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,EAAE,CAAC,CAAA;AACjF,CAAC;AAED,MAAM,CAAC,MAAM,SAAS,GAAG;IACrB,IAAI,CAAC,gBAAgB,CAAC,oBAAoB,GAAG,CAAC,gEAAgE,CAAC;MAC7G,CAAC,CAAC,gBAAgB,CAAC;MACnB,CAAC,CAAC,uBAAuB,CAAC;MAC1B,CAAC,CAAC,iBAAiB,CAAC;MACpB,CAAC,CAAC,WAAW,CAAC;MACd,CAAC,CAAC,SAAS,CAAC;MACZ,GAAG,CAAC,8FAA8F,wBAAwB,EAAE,CAAC;MAC7H,GAAG,CAAC,iHAAiH,CAAC;MACtH,GAAG,CAAC,8FAA8F,CAAC;;IAErG,IAAI,CAAC,iBAAiB,CAAC,oBAAoB,GAAG,CAAC,mEAAmE,CAAC;MACjH,CAAC,CAAC,iBAAiB,CAAC;MACpB,CAAC,CAAC,wBAAwB,CAAC;MAC3B,CAAC,CAAC,iBAAiB,CAAC;MACpB,GAAG,CAAC,yHAAyH,CAAC,EAAE,CAAA"}