@burdenoff/mcp-libs 2026.1014.2 → 2026.1014.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (9) hide show
  1. package/dist/modules/auth/index.cjs +22 -11
  2. package/dist/modules/auth/index.cjs.map +1 -1
  3. package/dist/modules/auth/index.js +22 -11
  4. package/dist/modules/auth/index.js.map +1 -1
  5. package/dist/modules/workspaces/index.cjs +4 -5
  6. package/dist/modules/workspaces/index.cjs.map +1 -1
  7. package/dist/modules/workspaces/index.js +4 -5
  8. package/dist/modules/workspaces/index.js.map +1 -1
  9. package/package.json +1 -1
package/dist/modules/auth/index.cjs.map CHANGED
@@ -1 +1 @@
1
- {"version":3,"sources":["../../../src/core/auth/device-code.ts","../../../src/modules/auth/legacy-auth.ts","../../../src/core/errors.ts","../../../src/core/tool-name.ts","../../../src/core/result.ts","../../../src/modules/auth/tools.ts","../../../src/modules/auth/operations.ts","../../../src/modules/auth/more-tools.ts","../../../src/modules/auth/extra-tools.ts","../../../src/modules/auth/index.ts"],"names":["fetch","z","err","d"],"mappings":";;;;;;;;;;;;;;;AAgIA,eAAsB,qBAAA,CACpB,cAAA,EACA,QAAA,EACA,YAAA,EACA,MAAA,EACkC;AAClC,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AAQd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,cAAA,EAAgB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACnB,KAAA;AAAA,MACA,WAAW,EAAE,KAAA,EAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO;AAAE,KACxD;AAAA,GACF,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAKlC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,2BAAA,EAA8B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EAC5F;AACA,EAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,eAAA,EAAiB,WAAA,EAAa;AAC5C,IAAA,MAAM,IAAI,MAAM,qDAAqD,CAAA;AAAA,EACvE;AAEA,EAAA,OAAO,KAAK,IAAA,CAAK,eAAA;AACnB;AAEA,eAAsB,mBAAA,CACpB,iBAAA,EACA,SAAA,EACA,WAAA,EACA,cAAA,EACiE;AACjE,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AASd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,iBAAA,EAAmB;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,SAAS,EAAE,cAAA,EAAgB,oBAAoB,aAAA,EAAe,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,EAAG;AAAA,IACpF,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAA,EAAW,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,cAAA,EAAe,IAAK;AAAA,GACtF,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAalC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EACzF;AAEA,EAAA,MAAM,MAAA,GAAS,KAAK,IAAA,EAAM,mBAAA;AAC1B,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAA,IAAW,CAAC,OAAO,KAAA,EAAO;AACrC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,QAAQ,KAAA,EAAO,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EACxF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW,MAAA,CAAO,SAAA,IAAa,EAAA,EAAI,MAAA,EAAQ,MAAA,CAAO,MAAA,IAAU,EAAC,EAAE;AAC/F;AAEA,eAAsB,eAAA,CACpB,gBACA,SAAA,EAGA;AACA,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AAQd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,cAAA,EAAgB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,SAAS,EAAE,cAAA,EAAgB,oBAAoB,aAAA,EAAe,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,EAAG;AAAA,IACpF,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,EAAE,KAAA,EAAO,EAAA,EAAG,EAAG;AAAA,GACzD,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAelC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,4BAAA,EAA+B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EAC7F;AAEA,EAAA,OAAO,IAAA,CAAK,IAAA,EAAM,YAAA,EAAc,KAAA,IAAS,EAAC;AAC5C;;;AC9LA,IAAM,OAAA,uBAAc,OAAA,EAAgC;AAE7C,SAAS,QAAQ,GAAA,EAA6B;AACnD,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC9B,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,MAAM,MAAA,GAAS,iBAAiB,GAAG,CAAA;AACnC,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,MAAM,CAAA;AACvB,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,iBAAiB,GAAA,EAA6B;AACrD,EAAA,IAAI,OAAA,GAAoC,IAAA;AACxC,EAAA,IAAI,eAAA,GAAuC,IAAA;AAC3C,EAAA,IAAI,iBAAA,GAA0C,IAAA;AAE9C,EAAA,SAAS,MAAA,GAAe;AACtB,IAAA,eAAA,IAAkB;AAAA,EACpB;AAEA,EAAA,eAAe,UAAA,GAAwC;AACrD,IAAA,MAAM,EAAE,UAAA,EAAY,QAAA,EAAS,GAAI,GAAA,CAAI,OAAO,WAAA,EAAY;AACxD,IAAA,MAAM,aAAA,GAAgB,GAAG,UAAU,CAAA,iBAAA,CAAA;AACnC,IAAA,MAAM,QAAA,GAAW,GAAG,UAAU,CAAA,mBAAA,CAAA;AAE9B,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MAC1C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACR,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,IAC5E;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,MAAM,UAAA,GAAa,KAAK,aAAa,CAAA;AACrC,IAAA,MAAM,QAAA,GAAW,KAAK,WAAW,CAAA;AACjC,IAAA,MAAM,eAAA,GAAkB,KAAK,kBAAkB,CAAA;AAC/C,IAAA,MAAM,uBAAA,GAA2B,IAAA,CAAK,2BAA2B,CAAA,IAAgB,IAAA;AACjF,IAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,GAAA;AACpD,IAAA,MAAM,QAAA,GAAY,IAAA,CAAK,UAAU,CAAA,IAAgB,CAAA;AAEjD,IAAA,OAAA,GAAU;AAAA,MACR,UAAA;AAAA,MACA,QAAA;AAAA,MACA,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,MACpC,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,oBAAA;AAAA,MACR,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,QAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAA,EAAS,QAAQ,uBAAA,IAA2B,eAAe,iCAAiC,QAAQ,CAAA,YAAA,EAAe,IAAI,WAAW,CAAA,wCAAA;AAAA,KACpI;AAAA,EACF;AAEA,EAAA,eAAe,aAAA,GAA8C;AAC3D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4BAAA,EAA+B,IAAI,WAAW,CAAA,gDAAA;AAAA,OAChD;AAAA,IACF;AAEA,IAAA,MAAM,CAAA,GAAI,OAAA;AACV,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,CAAA,CAAE,SAAA,EAAW;AAC7B,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,oCAAA;AAAA,OAC3D;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,CAAE,QAAA,EAAU;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,CAAA,CAAE,UAAA;AAAA,QACf,WAAW,CAAA,CAAE;AAAA,OACd,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAElC,IAAA,IAAI,QAAA,CAAS,EAAA,IAAM,IAAA,CAAK,cAAc,CAAA,EAAG;AACvC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,IAAA;AACpD,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACpE,MAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,QACb,GAAG,IAAA;AAAA,QACH,WAAA,EAAa,KAAK,cAAc,CAAA;AAAA,QAChC,YAAA,EAAe,IAAA,CAAK,eAAe,CAAA,IAAgB,EAAA;AAAA,QACnD,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QACpC,UAAA,EAAY;AAAA,OACb,CAAA;AACD,MAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,MAAA,OAAO,MAAM,eAAA,EAAgB;AAAA,IAC/B;AAEA,IAAA,MAAM,SAAA,GAAY,KAAK,OAAO,CAAA;AAC9B,IAAA,IAAI,cAAc,uBAAA,EAAyB;AACzC,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,0CAAA,EAA6C,CAAA,CAAE,uBAAA,IAA2B,CAAA,CAAE,eAAe,CAAA,iBAAA,EAAoB,CAAA,CAAE,QAAQ,CAAA,YAAA,EAAe,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAClK;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,WAAA,EAAa;AACpC,MAAA,CAAA,CAAE,QAAA,IAAY,CAAA;AACd,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,kEAAA,EAAqE,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAC/F;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,kBAAA;AAAA,OAC3D;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,mBAAA,EAAuB,IAAA,CAAK,mBAAmB,CAAA,IAAgB,aAAa,SAAS,CAAA;AAAA,OACvF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,eAAA,GAAgD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAa,MAAM,cAAA,EAAe;AACxC,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAA,EAAO;AACP,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,oDAAoD,CAAA;AACpE,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,0DAAA,EAAwD,GAAA,CAAI,WAAW,CAAA,6CAAA;AAAA,SAClF;AAAA,MACF;AACA,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAM,EAAA,GAAK,WAAW,CAAC,CAAA;AACvB,QAAA,IAAI,CAAC,EAAA;AACH,UAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AACtF,QAAA,MAAM,2BAAA,CAA4B,EAAA,CAAG,EAAA,EAAI,EAAA,CAAG,cAAc,CAAA;AAC1D,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,8BAAA,EAAgC;AAAA,UAC9C,aAAa,EAAA,CAAG,EAAA;AAAA,UAChB,eAAe,EAAA,CAAG;AAAA,SACnB,CAAA;AACD,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,sCAAA,EAAyC,EAAA,CAAG,IAAI,CAAA,yBAAA;AAAA,SAC3D;AAAA,MACF;AACA,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,0DAA0D,CAAA;AAC1E,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,8BAAA;AAAA,QACR,SAAS,CAAA,2BAAA,EAA8B,UAAA,CAAW,MAAM,CAAA,kCAAA,EAAgC,IAAI,WAAW,CAAA,qCAAA,CAAA;AAAA,QACvG;AAAA,OACF;AAAA,IACF,SAAS,OAAA,EAAS;AAChB,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,wCAAA,EAA0C;AAAA,QACxD,OAAO,OAAA,YAAmB,KAAA,GAAQ,OAAA,CAAQ,OAAA,GAAU,OAAO,OAAO;AAAA,OACnE,CAAA;AACD,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,eAAA;AAAA,QACR,OAAA,EAAS,0DAA0D,OAAA,YAAmB,KAAA,GAAQ,QAAQ,OAAA,GAAU,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,OACjI;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,cAAA,GAA2C;AACxD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,OAAO,gBAAgB,GAAA,CAAI,MAAA,CAAO,MAAK,CAAE,cAAA,EAAgB,KAAK,WAAW,CAAA;AAAA,EAC3E;AAEA,EAAA,eAAe,2BAAA,CACb,aACA,cAAA,EACe;AACf,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,oBAAoB,CAAA;AAC5D,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK,CAAE,iBAAA;AAAA,MAClB,IAAA,CAAK,WAAA;AAAA,MACL,WAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,MACb,GAAG,IAAA;AAAA,MACH,gBAAgB,MAAA,CAAO,KAAA;AAAA,MACvB,yBAAyB,IAAI,IAAA,CAAK,MAAA,CAAO,SAAS,EAAE,OAAA,EAAQ;AAAA,MAC5D,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AAAA,EACT;AAEA,EAAA,eAAe,eAAA,CAAgB,aAAqB,cAAA,EAAuC;AACzF,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,MAAM,2BAAA,CAA4B,aAAa,cAAc,CAAA;AAC7D,IAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,oBAAA,EAAsB,EAAE,aAAa,CAAA;AAAA,EACvD;AAEA,EAAA,eAAe,mBAAA,GAAqC;AAClD,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,MAAM,iBAAA;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,WAAW,YAA2B;AAC1C,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,MAAA,IAAI,MAAM,MAAA,EAAQ;AAClB,MAAA,IAAI,CAAC,MAAM,WAAA,EAAa;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,wBAAA,EAA2B,GAAA,CAAI,WAAW,CAAA,0CAAA,EAA6C,IAAI,WAAW,CAAA,gDAAA;AAAA,SACxG;AAAA,MACF;AAAA,IAKF,CAAA;AACA,IAAA,iBAAA,GAAoB,QAAA,EAAS,CAAE,OAAA,CAAQ,MAAM;AAC3C,MAAA,iBAAA,GAAoB,IAAA;AAAA,IACtB,CAAC,CAAA;AACD,IAAA,MAAM,iBAAA;AAAA,EACR;AAEA,EAAA,SAAS,SAAA,GASN;AACD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,MACrB,aAAA,EAAe,CAAC,EAAE,IAAA,EAAM,eAAe,IAAA,EAAM,MAAA,CAAA;AAAA,MAC7C,QAAQ,IAAA,EAAM,MAAA,GAAS,SAAA,GAAY,IAAA,EAAM,cAAc,aAAA,GAAgB,MAAA;AAAA,MACvE,SAAA,EAAW,MAAM,SAAA,GAAY,IAAI,KAAK,IAAA,CAAK,SAAS,CAAA,CAAE,WAAA,EAAY,GAAI,IAAA;AAAA,MACtE,WAAA,EAAa,MAAM,WAAA,IAAe,IAAA;AAAA,MAClC,cAAA,EAAgB,MAAM,cAAA,IAAkB,IAAA;AAAA,MACxC,uBAAA,EAAyB,MAAM,uBAAA,GAC3B,IAAI,KAAK,IAAA,CAAK,uBAAuB,CAAA,CAAE,WAAA,EAAY,GACnD,IAAA;AAAA,MACJ,iBAAA,EAAmB,CAAC,CAAC,IAAA,EAAM,cAAA;AAAA,MAC3B,eAAA,EAAiB,CAAC,CAAC;AAAA,KACpB,CAAA;AAAA,EACH;AAEA,EAAA,eAAe,MAAA,GAAwB;AACrC,IAAA,OAAA,GAAU,IAAA;AACV,IAAA,GAAA,CAAI,KAAK,KAAA,EAAM;AACf,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AACP,IAAA,GAAA,CAAI,MAAA,CAAO,KAAK,sCAAsC,CAAA;AAAA,EACxD;AAEA,EAAA,SAAS,UAAA,GAAqC;AAC5C,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,IAAI,IAAA,EAAM,MAAA,EAAQ,OAAA,CAAQ,WAAW,IAAI,IAAA,CAAK,MAAA;AAC9C,IAAA,IAAI,MAAM,WAAA,EAAa,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,WAAW,CAAA,CAAA;AAC5E,IAAA,IAAI,IAAA,EAAM,cAAA;AACR,MAAA,OAAA,CAAQ,2BAA2B,CAAA,GAAI,CAAA,OAAA,EAAU,IAAA,CAAK,cAAc,CAAA,CAAA;AACtE,IAAA,IAAI,IAAA,EAAM,cAAA,EAAgB,OAAA,CAAQ,UAAU,IAAI,IAAA,CAAK,cAAA;AACrD,IAAA,IAAI,IAAA,EAAM,WAAA,EAAa,OAAA,CAAQ,gBAAgB,IAAI,IAAA,CAAK,WAAA;AACxD,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,SAAS,UAAA,GAAsB;AAC7B,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,WAAA,IAAe,IAAA,EAAM,MAAA,CAAA;AAAA,EACvC;AAEA,EAAA,SAAS,mBAAmB,EAAA,EAAsB;AAChD,IAAA,eAAA,GAAkB,EAAA;AAAA,EACpB;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,mBAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACpWO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjB,KAAA;AAAA,EAEzB,WAAA,CAAY,SAAiB,KAAA,EAAiB;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF,CAAA;;;AC1BA,IAAM,oBAAA,GAAuB,EAAA;AAE7B,SAAS,cAAA,CAAe,MAAc,IAAA,EAA8C;AAClF,EAAA,IAAuB,IAAA,CAAK,MAAA,GAAS,oBAAA,EAAsB;AACzD,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,CAAA,WAAA,EAAc,IAAI,CAAA,UAAA,EAAa,oBAAoB,CAAA,8CAAA;AAAA,KACrD;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,WAAA,CAAY,gBAAwB,KAAA,EAAyB;AAC3E,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,iBAAiB,sCAAsC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,WAAA,EAAa,GAAG,KAAK,EAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC7D,EAAA,OAAO,cAAA,CAAe,IAAY,CAAA;AACpC;;;ACOO,SAAS,UAAA,CAAW,MAAe,UAAA,EAAkD;AAC1F,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG;AAAA,GACjE;AAIA,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,WAAA,CAAY,SAAiB,IAAA,EAA2B;AACtE,EAAA,MAAM,IAAA,GAAO,IAAA,GAAO,CAAA,EAAG,OAAO;;AAAA,MAAA,EAAa,IAAI,CAAA,CAAA,GAAK,OAAA;AACpD,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AAC5D;;;AC3DO,SAAS,iBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,YAAY,CAAC,CAAA;AAAA,IAChD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EACE,oNAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,UAAA,EAAW;AACrC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,OAAO,CAAA;AAC5D,QAAA,OAAO,WAAA;AAAA,UACL,iBAAiB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACzE;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,eAAe,CAAC,CAAA;AAAA,IACnD;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EACE,kQAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,EAAc;AACxC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,mCAAA,EAAqC,EAAE,OAAO,CAAA;AAC/D,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EACE,2GAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,WAAA,EAAaC,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wBAAwB,CAAA;AAAA,QACzD,cAAA,EAAgBA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mCAAmC;AAAA;AACzE,KACF;AAAA,IACA,OAAO,EAAE,WAAA,EAAa,cAAA,EAAe,KAAM;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,IAAA,CAAK,eAAA,CAAgB,WAAA,EAAa,cAAc,CAAA;AACtD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,oBAAA;AAAA,UACR,WAAA;AAAA,UACA,OAAA,EAAS,aAAa,WAAW,CAAA,2BAAA;AAAA,SAClC,CAAA;AAAA,MACH,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,2CAAA,EAA6C,EAAE,OAAO,CAAA;AACvE,QAAA,OAAO,WAAA;AAAA,UACL,+BAA+B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,iBAAA;AAAA,MACP,WAAA,EAAa,0DAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,cAAA,EAAe;AAC7C,QAAA,OAAO,WAAW,EAAE,UAAA,EAAY,KAAA,EAAO,UAAA,CAAW,QAAQ,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,qCAAA,EAAuC,EAAE,OAAO,CAAA;AACjE,QAAA,OAAO,WAAA;AAAA,UACL,8BAA8B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACtF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,aAAa,CAAC,CAAA;AAAA,IACjD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EACE,iHAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,SAAA,EAAU;AACpC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,EAAE,OAAO,CAAA;AAC7D,QAAA,OAAO,WAAA;AAAA,UACL,8BAA8B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACtF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,aAAa,CAAC,CAAA;AAAA,IACjD;AAAA,MACE,KAAA,EAAO,QAAA;AAAA,MACP,WAAA,EAAa,qDAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,KAAK,MAAA,EAAO;AAClB,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,YAAA;AAAA,UACR,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,EAAE,OAAO,CAAA;AAC7D,QAAA,OAAO,WAAA;AAAA,UACL,kBAAkB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC1E;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;;;ACxIO,IAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhB,IAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBzB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWzB,IAAM,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASrB,IAAM,2BAAA,GAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQpC,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASxB,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQxB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA,CAAA;AAMvB,IAAM,wBAAA,GAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASjC,IAAM,SAAA,GAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAgBlB,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA,CAAA;AAMnB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA,CAAA;AASpB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQpB,IAAM,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQrB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAgBzB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA,CAAA;AAMvB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQvB,IAAM,wBAAA,GAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAajC,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQzB,IAAM,iBAAA,GAAoB;AAAA;AAAA;AAAA;AAAA,CAAA;AAU1B,IAAM,iBAAA,GAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQ1B,IAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQhB,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASnB,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQnB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA,CAAA;AAMvB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQvB,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQxB,IAAM,iBAAA,GAAoB;AAAA;AAAA;AAAA;AAAA,CAAA;AAM1B,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASnB,IAAM,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQjB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;;;AC1P3B,SAAS,GAAA,CACP,GAAA,EACA,IAAA,EACA,OAAA,EACA,KAAA,EACgC;AAChC,EAAA,GAAA,CAAI,OAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,OAAA,CAAA,EAAW,EAAE,OAAO,CAAA;AAC5C,EAAA,OAAO,WAAA,CAAY,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAC5F;AAEA,SAAS,kBAAA,CAAmB,KAAiB,OAAA,EAA4B;AACvE,EAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,EAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,IACb,GAAG,QAAA;AAAA,IACH,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,cAAc,OAAA,CAAQ,YAAA;AAAA,IACtB,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,QAAQ,SAAA,GAAY,GAAA;AAAA,IAC5C,UAAA,EAAY;AAAA,GACb,CAAA;AACD,EAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AAChB;AAEO,SAAS,qBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AAGN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAClD;AAAA,MACE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA,EACE,uKAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mCAAmC,CAAA;AAAA,QAC9D,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B,CAAA;AAAA,QACzD,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sDAAsD,CAAA;AAAA,QACpF,WAAWA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qBAAqB,CAAA;AAAA,QAC/D,UAAUA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oBAAoB;AAAA;AAC/D,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,UAAU,QAAA,EAAU,SAAA,EAAW,UAAS,KAAM;AAC5D,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAS;AACnE,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC/C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAAqC,OAAA,EAAS,EAAE,KAAA,EAAO,CAAA;AACtF,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,MAAM,CAAA;AAChC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,IAAA,EAAM,EAAE,MAAA,CAAO,IAAA;AAAA,UACf,WAAA,EAAa,EAAE,MAAA,CAAO,WAAA;AAAA,UACtB,YAAA,EAAc,EAAE,MAAA,CAAO,YAAA;AAAA,UACvB,SAAA,EAAW,EAAE,MAAA,CAAO;AAAA,SACrB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,cAAA,EAAgB,gBAAA,EAAkB,CAAC,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAClD;AAAA,MACE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA,EACE,uMAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mBAAmB,CAAA;AAAA,QACjD,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,UAAU;AAAA;AAC1C,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAS,KAAM;AAChC,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAAqC,OAAA,EAAS;AAAA,UAC3E,KAAA,EAAO,EAAE,QAAA,EAAU,QAAA;AAAS,SAC7B,CAAA;AACD,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,MAAM,CAAA;AAChC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,IAAA,EAAM,EAAE,MAAA,CAAO,IAAA;AAAA,UACf,WAAA,EAAa,EAAE,MAAA,CAAO,WAAA;AAAA,UACtB,YAAA,EAAc,EAAE,MAAA,CAAO,YAAA;AAAA,UACvB,SAAA,EAAW,EAAE,MAAA,CAAO;AAAA,SACrB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,cAAA,EAAgB,gBAAA,EAAkB,CAAC,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,eAAA;AAAA,MACP,WAAA,EACE,0PAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC/B,QAAA,IAAI,CAAC,UAAU,YAAA,EAAc;AAC3B,UAAA,OAAO,WAAA;AAAA,YACL;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,gBAAA;AAAA,UACJ;AAAA,YACE,OAAO,QAAA,CAAS;AAAA;AAClB,SACF;AACA,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,YAAY,CAAA;AACtC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,WAAA;AAAA,UACR,WAAA,EAAa,EAAE,YAAA,CAAa,WAAA;AAAA,UAC5B,SAAA,EAAW,EAAE,YAAA,CAAa;AAAA,SAC3B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,oBAAA,EAAsB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MACjE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EACE,+PAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,YAAA,EAAcA,KAAAA,CACX,MAAA,EAAO,CACP,SAAS,0DAA0D,CAAA;AAAA,QACtE,MAAA,EAAQA,KAAAA,CACL,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAChB,QAAA,EAAS,CACT,QAAA,CAAS,2CAA2C;AAAA;AACzD,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,QAAA,EAAU,YAAA,EAAa;AAChE,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,gBAAA;AAAA,UACJ,EAAE,KAAA;AAAM,SACV;AACA,QAAA,MAAM,SAAS,CAAA,CAAE,eAAA;AACjB,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,YAAA,EAAc,EAAA;AAAA,UACd,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,SAAA,GAAY,GAAA;AAAA,UAC3C,UAAA,EAAY,oBAAA;AAAA,UACZ,QAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,QAAQ,MAAA,CAAO;AAAA,SAChB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,uBAAA,EAAyB,2BAAA,EAA6B,CAAC,CAAA;AAAA,MACzE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,oBAAA;AAAA,MACP,WAAA,EACE,sQAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qDAAqD;AAAA;AACnF,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAO,KAAM;AACpB,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,MAAA;AAAA,UACA,UAAA,EAAY;AAAA,SACb,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,MAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,yBAAA,EAA2B,uBAAA,EAAyB,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oCAAoC,CAAC,CAAA;AAAA,IACxE;AAAA,MACE,KAAA,EAAO,+BAAA;AAAA,MACP,WAAA,EACE,iSAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,YAAA,EAAcA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC1D,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,gCAAgC;AAAA;AAClF,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,QAAA,MAAM,SAAS,MAAM,qBAAA;AAAA,UACnB,GAAA,CAAI,cAAA;AAAA,UACJ,QAAA;AAAA,UACA,YAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,YAAA,EAAc,EAAA;AAAA,UACd,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,SAAA,GAAY,GAAA;AAAA,UAC3C,UAAA,EAAY,oBAAA;AAAA,UACZ,QAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,QAAQ,MAAA,CAAO;AAAA,SAChB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,oCAAA,EAAsC,iCAAA,EAAmC,CAAC,CAAA;AAAA,MAC5F;AAAA,IACF;AAAA,GACF;AACF;AClQA,SAASC,IAAAA,CACP,GAAA,EACA,IAAA,EACA,OAAA,EACA,KAAA,EACgC;AAChC,EAAA,GAAA,CAAI,OAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,OAAA,CAAA,EAAW,EAAE,OAAO,CAAA;AAC5C,EAAA,OAAO,WAAA,CAAY,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAC5F;AAEO,SAAS,sBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AAGN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,kBAAkB,CAAC,CAAA;AAAA,IACtD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,sEAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB;AAAA,SACN;AACA,QAAA,OAAO,UAAA,CAAW,EAAE,WAAW,CAAA;AAAA,MACjC,SAAS,CAAA,EAAG;AACV,QAAA,OAAOA,IAAAA,CAAI,GAAA,EAAK,kBAAA,EAAoB,yBAAA,EAA2B,CAAC,CAAA;AAAA,MAClE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,qBAAqB,CAAC,CAAA;AAAA,IACzD;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EAAa,yDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,SAAA,EAAWD,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC/B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC1B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QACjC,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAChC,KACF;AAAA,IACA,OAAO,IAAA,KAAS;AACd,MAAA,IAAI;AACF,QAAA,MAAM,QAAiC,EAAC;AACxC,QAAA,IAAI,IAAA,CAAK,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AACzD,QAAA,IAAI,IAAA,CAAK,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,WAAW,IAAA,CAAK,QAAA;AACvD,QAAA,IAAI,IAAA,CAAK,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,OAAO,IAAA,CAAK,IAAA;AAC/C,QAAA,IAAI,IAAA,CAAK,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,WAAW,IAAA,CAAK,QAAA;AACvD,QAAA,IAAI,IAAA,CAAK,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,cAAc,IAAA,CAAK,WAAA;AAC7D,QAAA,IAAI,IAAA,CAAK,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,WAAW,IAAA,CAAK,QAAA;AACvD,QAAA,IAAI,IAAA,CAAK,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,WAAW,IAAA,CAAK,QAAA;AACvD,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,WAAW,CAAA,EAAG;AACnC,UAAA,OAAO,YAAY,yDAAoD,CAAA;AAAA,QACzE;AACA,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAExB,2BAAA,EAA6B,EAAE,KAAA,EAAO,CAAA;AAC7C,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,WAAW,IAAA,EAAM,CAAA,CAAE,0BAA0B,CAAA;AAAA,MAC3E,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,qBAAA,EAAuB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACtE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,sBAAA;AAAA,MACP,WAAA,EAAa,sEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC9D,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAO,KAAM;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAExB,eAAA,EAAiB;AAAA,UACtB,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,EAAE,QAAA,EAAU,CAAA,CAAE,gBAAgB,KAAA,EAAO,CAAA,CAAE,cAAA,CAAe,MAAA,EAAQ,CAAA;AAAA,MAClF,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,oBAAA,EAAsB,yBAAA,EAA2B,CAAC,CAAA;AAAA,MACpE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EAAa,2CAAA;AAAA,MACb,WAAA,EAAa,EAAE,SAAA,EAAWD,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,sBAAsB,CAAA;AAAE,KACxE;AAAA,IACA,OAAO,EAAE,SAAA,EAAU,KAAM;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAY,cAAA,EAAgB,EAAE,WAAW,CAAA;AAC9D,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,QAAA,EAAW,SAAS,aAAa,CAAA;AAAA,MACnF,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,eAAe,CAAC,CAAA;AAAA,IACnD;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,iDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC9D,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAO,KAAM;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAMxB,wBAAA,EAA0B;AAAA,UAC/B,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,OAAA,EAAS,EAAE,qBAAA,CAAsB,OAAA;AAAA,UACjC,KAAA,EAAO,EAAE,qBAAA,CAAsB,UAAA;AAAA,UAC/B,OAAA,EAAS,EAAE,qBAAA,CAAsB;AAAA,SAClC,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,eAAA,EAAiB,4BAAA,EAA8B,CAAC,CAAA;AAAA,MAClE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,YAAA;AAAA,MACP,WAAA,EACE,gIAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQD,KAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,OAAO,OAAO,CAAC,CAAA,CAAE,QAAA,CAAS,sBAAsB;AAAA;AAC1E,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAO,KAAM;AACpB,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,SAAA;AAAA,UACJ,EAAE,MAAA;AAAO,SACX;AACA,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,oBAAA;AAAA,UACR,YAAY,CAAA,CAAE,QAAA;AAAA,UACd,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,iBAAA,EAAmB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,uBAAA;AAAA,MACP,WAAA,EAAa,sEAAA;AAAA,MACb,WAAA,EAAa,EAAE,IAAA,EAAMD,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,6BAA6B,CAAA;AAAE,KAC1E;AAAA,IACA,OAAO,EAAE,IAAA,EAAK,KAAM;AAClB,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAY,UAAA,EAAY,EAAE,MAAM,CAAA;AACrD,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,gBAAgB,CAAA;AAAA,MAClE,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,iBAAA,EAAmB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,kBAAkB,CAAC,CAAA;AAAA,IACtD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,mCAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA,CAAY,WAAW,CAAA;AAC5C,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,iBAAiB,CAAA;AAAA,MACnE,SAAS,CAAA,EAAG;AACV,QAAA,OAAOA,IAAAA,CAAI,GAAA,EAAK,kBAAA,EAAoB,uBAAA,EAAyB,CAAC,CAAA;AAAA,MAChE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,eAAA;AAAA,MACP,WAAA,EAAa,4EAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qCAAqC,CAAA;AAAA,QAC3E,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC3B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAO,KAAM;AAClC,MAAA,IAAI;AACF,QAAA,MAAM,aAAa,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA,EAAE;AAC7D,QAAA,IAAI,KAAA,EAAO;AAIT,UAAA,MAAME,EAAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAExB,YAAA,EAAc,EAAE,KAAA,EAAO,UAAA,EAAY,CAAA;AAC1C,UAAA,OAAO,UAAA,CAAW;AAAA,YAChB,IAAA,EAAMA,GAAE,UAAA,CAAW,OAAA;AAAA,YACnB,KAAA,EAAOA,EAAAA,CAAE,UAAA,CAAW,OAAA,CAAQ;AAAA,WAC7B,CAAA;AAAA,QACH;AACA,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAExB,WAAA,EAAa,EAAE,UAAA,EAAY,CAAA;AAClC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,IAAA,EAAM,EAAE,SAAA,CAAU,OAAA;AAAA,UAClB,KAAA,EAAO,CAAA,CAAE,SAAA,CAAU,OAAA,CAAQ;AAAA,SAC5B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOD,IAAAA,CAAI,GAAA,EAAK,oBAAA,EAAsB,yBAAA,EAA2B,CAAC,CAAA;AAAA,MACpE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EACE,qGAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,IAAA,EAAMD,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B,CAAA;AAAA,QACrD,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,eAAe,CAAA;AAAA,QAC1C,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,eAAe,CAAA;AAAA,QAC/D,WAAWA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,iBAAiB;AAAA;AAC7D,KACF;AAAA,IACA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,WAAU,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,IAAA,EAAM,KAAA,EAAM;AACrD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,KAAA,GAAQ,MAAA;AACxC,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC/C,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAExB,gBAAA,EAAkB,EAAE,KAAA,EAAO,CAAA;AAClC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAS,0EAAA;AAAA,UACT,KAAK,CAAA,CAAE;AAAA,SACR,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EAAa,iCAAA;AAAA,MACb,WAAA,EAAa,EAAE,KAAA,EAAOD,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,kBAAkB,CAAA;AAAE,KAChE;AAAA,IACA,OAAO,EAAE,KAAA,EAAM,KAAM;AACnB,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAY,cAAA,EAAgB,EAAE,OAAO,CAAA;AAC1D,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,QAAA,EAAW,KAAK,aAAa,CAAA;AAAA,MAC/E,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EACE,mGAAA;AAAA,MACF,WAAA,EAAa,EAAE,KAAA,EAAOD,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,kBAAkB,CAAA;AAAE,KAChE;AAAA,IACA,OAAO,EAAE,KAAA,EAAM,KAAM;AACnB,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,cAAA;AAAA,UACJ,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAS,oEAAA;AAAA,UACT,SAAA,EAAW,EAAE,YAAA,CAAa;AAAA,SAC3B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,sBAAA;AAAA,MACP,WAAA,EAAa,gDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC9D,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAO,KAAM;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAExB,eAAA,EAAiB;AAAA,UACtB,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,CAAA,CAAE,eAAe,KAAA,EAAO,CAAA,CAAE,aAAA,CAAc,MAAA,EAAQ,CAAA;AAAA,MAC9E,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,2BAAA,EAA6B,CAAC,CAAA;AAAA,MACxE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,6CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC9D,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAO,KAAM;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAMxB,wBAAA,EAA0B;AAAA,UAC/B,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,WAAA,EAAa,EAAE,sBAAA,CAAuB,WAAA;AAAA,UACtC,KAAA,EAAO,EAAE,sBAAA,CAAuB,UAAA;AAAA,UAChC,OAAA,EAAS,EAAE,sBAAA,CAAuB;AAAA,SACnC,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,uBAAA,EAAyB,4BAAA,EAA8B,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,wBAAwB,CAAC,CAAA;AAAA,IAC5D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,6DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAOD,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6BAA6B,CAAA;AAAA,QACxD,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qBAAqB,CAAA;AAAA,QACjD,QAAQA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACrC,cAAcA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QAC3C,WAAWA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,YAAY;AAAA;AACxD,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,QAAQ,MAAA,EAAQ,YAAA,EAAc,WAAU,KAAM;AAC5D,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,KAAA,EAAO,MAAA,EAAO;AACvD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,IAAI,YAAA,KAAiB,KAAA,CAAA,EAAW,KAAA,CAAM,YAAA,GAAe,YAAA;AACrD,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC/C,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,gBAAA;AAAA,UACJ,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,WAAW,UAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA;AAAA,MACxE,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,wBAAA,EAA0B,4BAAA,EAA8B,CAAC,CAAA;AAAA,MAC3E;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,mBAAA;AAAA,MACP,WAAA,EAAa,gCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAID,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,eAAe,CAAA;AAAA,QACvC,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,MAAA,EAAO,KAAM;AACxB,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA,CAAY,iBAAA,EAAmB;AAAA,UAClD,EAAA;AAAA,UACA,GAAI,MAAA,KAAW,KAAA,CAAA,GAAY,EAAE,MAAA,KAAW;AAAC,SAC1C,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,WAAA,EAAc,EAAE,aAAa,CAAA;AAAA,MAC/E,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,yBAAA,EAA2B,6BAAA,EAA+B,CAAC,CAAA;AAAA,MAC7E;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,gBAAgB,CAAC,CAAA;AAAA,IACpD;AAAA,MACE,KAAA,EAAO,WAAA;AAAA,MACP,WAAA,EAAa,mDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAOD,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC3B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAO,KAAM;AAC3B,MAAA,IAAI;AAIF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAExB,iBAAA,EAAmB;AAAA,UACxB,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,IAAA,EAAM,EAAE,eAAA,CAAgB,IAAA;AAAA,UACxB,KAAA,EAAO,CAAA,CAAE,eAAA,CAAgB,IAAA,CAAK;AAAA,SAC/B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,gBAAA,EAAkB,qBAAA,EAAuB,CAAC,CAAA;AAAA,MAC5D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,eAAe,CAAC,CAAA;AAAA,IACnD;AAAA,MACE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA,EAAa,6BAAA;AAAA,MACb,WAAA,EAAa,EAAE,EAAA,EAAID,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAE,KACnD;AAAA,IACA,OAAO,EAAE,EAAA,EAAG,KAAM;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,OAAA;AAAA,UACJ,EAAE,EAAA;AAAG,SACP;AACA,QAAA,IAAI,CAAC,EAAE,GAAA,EAAK;AACV,UAAA,OAAO,WAAA,CAAY,CAAA,IAAA,EAAO,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,QAC3C;AACA,QAAA,OAAO,UAAA,CAAW,EAAE,GAAG,CAAA;AAAA,MACzB,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,eAAA,EAAiB,mBAAA,EAAqB,CAAC,CAAA;AAAA,MACzD;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,kBAAkB,CAAC,CAAA;AAAA,IACtD;AAAA,MACE,KAAA,EAAO,YAAA;AAAA,MACP,WAAA,EACE,kFAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,IAAA,EAAMD,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,UAAU,CAAA;AAAA,QACpC,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QACjC,IAAA,EAAMA,KAAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAS,QAAQ,CAAC,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,0BAA0B,CAAA;AAAA,QAChF,SAAA,EAAWA,KAAAA,CACR,IAAA,CAAK,CAAC,MAAA,EAAQ,KAAA,EAAO,SAAS,CAAC,CAAA,CAC/B,QAAA,EAAS,CACT,QAAA,CAAS,0BAA0B,CAAA;AAAA,QACtC,YAAA,EAAcA,KAAAA,CAAE,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,qBAAqB,CAAA;AAAA,QAC3E,QAAQA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA;AAAS;AACvC,KACF;AAAA,IACA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,MAAM,SAAA,EAAW,YAAA,EAAc,QAAO,KAAM;AACtE,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC;AAAA,UACrC,IAAA;AAAA,UACA,MAAM,IAAA,IAAQ,OAAA;AAAA,UACd,WAAW,SAAA,IAAa;AAAA,SAC1B;AACA,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,YAAA,KAAiB,KAAA,CAAA,EAAW,KAAA,CAAM,YAAA,GAAe,YAAA;AACrD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAExB,UAAA,EAAY,EAAE,KAAA,EAAO,CAAA;AAC5B,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAS,gEAAA;AAAA,UACT,GAAA,EAAK,EAAE,SAAA,CAAU,GAAA;AAAA,UACjB,YAAA,EAAc,EAAE,SAAA,CAAU;AAAA,SAC3B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,kBAAA,EAAoB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MAC/D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,kBAAkB,CAAC,CAAA;AAAA,IACtD;AAAA,MACE,KAAA,EAAO,YAAA;AAAA,MACP,WAAA,EAAa,mEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAID,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,QAAQ,CAAA;AAAA,QAChC,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC1B,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QACjC,cAAcA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QAC3C,QAAQA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACrC,QAAQA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,gCAAgC;AAAA;AACzE,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,aAAa,YAAA,EAAc,MAAA,EAAQ,QAAO,KAAM;AACjE,MAAA,IAAI;AACF,QAAA,MAAM,QAAiC,EAAC;AACxC,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,IAAA,GAAO,IAAA;AACrC,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,YAAA,KAAiB,KAAA,CAAA,EAAW,KAAA,CAAM,YAAA,GAAe,YAAA;AACrD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,OAAO,WAAA,EAAY;AAC5D,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,WAAW,CAAA,EAAG;AACnC,UAAA,OAAO,YAAY,yDAAoD,CAAA;AAAA,QACzE;AACA,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,UAAA;AAAA,UACJ,EAAE,IAAI,KAAA;AAAM,SACd;AACA,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,WAAW,GAAA,EAAK,CAAA,CAAE,WAAW,CAAA;AAAA,MAC3D,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,kBAAA,EAAoB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MAC/D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EAAa,4EAAA;AAAA,MACb,WAAA,EAAa,EAAE,EAAA,EAAID,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAE,KACnD;AAAA,IACA,OAAO,EAAE,EAAA,EAAG,KAAM;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAY,cAAA,EAAgB,EAAE,IAAI,CAAA;AACvD,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,IAAA,EAAO,EAAE,iBAAiB,CAAA;AAAA,MAC5E,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,2BAAA;AAAA,MACP,WAAA,EACE,qJAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUD,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,iBAAiB,CAAA;AAAA,QAC/C,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mCAAmC,CAAA;AAAA,QACpE,QAAQA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACrC,OAAOA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAC1D,cAAcA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,gBAAgB;AAAA;AAC/D,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,aAAa,MAAA,EAAQ,KAAA,EAAO,cAAa,KAAM;AAChE,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,MAAA,MAAM,SACJ,GAAA,CAAI,GAAA,KAAQ,MAAA,GACP,GAAA,CAAI,SAAS,cAAA,IAAkB,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA,GACzE,IAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC/C,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,QACjC,SAAA,EAAW,QAAA;AAAA,QACX,YAAA,EAAc,WAAA;AAAA,QACd,eAAe,YAAA,IAAgB;AAAA,OAChC,CAAA;AACD,MAAA,IAAI,MAAA,IAAU,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,IAAI,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AACrE,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AACpC,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,iBAAA,EAAoB,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA;AAC7E,MAAA,OAAO,UAAA,CAAW,EAAE,GAAA,EAAK,CAAA;AAAA,IAC3B;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAClD;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EAAa,iDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,WAAW,CAAA;AAAE,KAC5D;AAAA,IACA,OAAO,EAAE,QAAA,EAAS,KAAM;AACtB,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,cAAA;AAAA,UACJ,EAAE,QAAA;AAAS,SACb;AACA,QAAA,OAAO,UAAA,CAAW,EAAE,YAAY,CAAA;AAAA,MAClC,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,cAAA,EAAgB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MAC/D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,eAAA;AAAA,MACP,WAAA,EAAa,+CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUD,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW,CAAA;AAAA,QACzC,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6BAA6B,CAAA;AAAA,QAC3D,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC9C,QAAQA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QACzD,aAAaA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,uBAAuB,CAAA;AAAA,QACnE,SAASA,KAAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,mCAAmC;AAAA;AAC9E,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAU,QAAQ,MAAA,EAAQ,WAAA,EAAa,SAAQ,KAAM;AACtE,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC;AAAA,UACrC,QAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAS,OAAA,IAAW;AAAA,SACtB;AACA,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,eAAA;AAAA,UACJ,EAAE,UAAU,KAAA;AAAM,SACpB;AACA,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,WAAW,MAAA,EAAQ,CAAA,CAAE,eAAe,CAAA;AAAA,MAClE,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,oBAAA,EAAsB,2BAAA,EAA6B,CAAC,CAAA;AAAA,MACtE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,eAAe,CAAC,CAAA;AAAA,IACnD;AAAA,MACE,KAAA,EAAO,UAAA;AAAA,MACP,WAAA,EACE,8HAAA;AAAA,MACF,WAAA,EAAa,EAAE,QAAA,EAAUD,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,WAAW,CAAA;AAAE,KAC5D;AAAA,IACA,OAAO,EAAE,QAAA,EAAS,KAAM;AACtB,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,MAAA,MAAM,SACJ,GAAA,CAAI,GAAA,KAAQ,MAAA,GACP,GAAA,CAAI,SAAS,cAAA,IAAkB,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA,GACzE,IAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC/C,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,KAAA,EAAQ,kBAAA,CAAmB,QAAQ,CAAC,CAAA,KAAA,CAAA;AAC5E,MAAA,OAAO,UAAA,CAAW,EAAE,GAAA,EAAK,OAAA,EAAS,2CAA2C,CAAA;AAAA,IAC/E;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,mBAAA;AAAA,MACP,WAAA,EAAa,wCAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,WAAW,CAAA;AAAE,KAC5D;AAAA,IACA,OAAO,EAAE,QAAA,EAAS,KAAM;AACtB,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAY,iBAAA,EAAmB,EAAE,UAAU,CAAA;AAChE,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,eAAA,EAAkB,QAAQ,aAAa,CAAA;AAAA,MACzF,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,iBAAA,EAAmB,6BAAA,EAA+B,CAAC,CAAA;AAAA,MACrE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,oBAAA;AAAA,MACP,WAAA,EAAa,8DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAOD,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC3B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC1B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC5B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC5B,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC3B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,QAAA,EAAU,MAAM,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAO,KAAM;AAClE,MAAA,IAAI;AACF,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,IAAI,KAAA,KAAU,KAAA,CAAA,EAAW,MAAA,CAAO,KAAA,GAAQ,KAAA;AACxC,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,MAAA,CAAO,QAAA,GAAW,QAAA;AAC9C,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,MAAA,CAAO,IAAA,GAAO,KAAK,WAAA,EAAY;AACvD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,OAAO,WAAA,EAAY;AAC7D,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,MAAA;AAC1C,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAExB,UAAA,EAAY;AAAA,UACjB,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,IAAI,MAAA,GAAS,KAAA,CAAA;AAAA,UAClD,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,UACf,UAAA,EAAY,EAAE,KAAA,CAAM,UAAA;AAAA,UACpB,OAAA,EAAS,EAAE,KAAA,CAAM;AAAA,SAClB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,iBAAA,EAAmB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,gBAAgB,CAAC,CAAA;AAAA,IACpD;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,8CAAA;AAAA,MACb,WAAA,EAAa,EAAE,EAAA,EAAID,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,SAAS,CAAA;AAAE,KACpD;AAAA,IACA,OAAO,EAAE,EAAA,EAAG,KAAM;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAAsC,QAAA,EAAU,EAAE,EAAA,EAAI,CAAA;AACrF,QAAA,IAAI,CAAC,EAAE,IAAA,EAAM;AACX,UAAA,OAAO,WAAA,CAAY,CAAA,KAAA,EAAQ,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,QAC5C;AACA,QAAA,OAAO,UAAA,CAAW,EAAE,IAAI,CAAA;AAAA,MAC1B,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,gBAAA,EAAkB,oBAAA,EAAsB,CAAC,CAAA;AAAA,MAC3D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EAAa,2DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAID,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,SAAA,EAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC/B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QACjC,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC1B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC5B,aAAA,EAAeA,KAAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS;AACtC,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,SAAA,EAAW,QAAA,EAAU,UAAU,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,aAAA,EAAc,KAAM;AACzF,MAAA,IAAI;AACF,QAAA,MAAM,QAAiC,EAAC;AACxC,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC/C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,IAAA,GAAO,KAAK,WAAA,EAAY;AACtD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,OAAO,WAAA,EAAY;AAC5D,QAAA,IAAI,aAAA,KAAkB,KAAA,CAAA,EAAW,KAAA,CAAM,aAAA,GAAgB,aAAA;AACvD,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,WAAW,CAAA,EAAG;AACnC,UAAA,OAAO,YAAY,yDAAoD,CAAA;AAAA,QACzE;AACA,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAAqC,WAAA,EAAa;AAAA,UAC/E,EAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,WAAW,IAAA,EAAM,CAAA,CAAE,YAAY,CAAA;AAAA,MAC7D,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,mBAAA,EAAqB,uBAAA,EAAyB,CAAC,CAAA;AAAA,MACjE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,0BAAA;AAAA,MACP,WAAA,EACE,qHAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,aAAaD,KAAAA,CACV,MAAA,GACA,QAAA,EAAS,CACT,SAAS,iEAAiE;AAAA;AAC/E,KACF;AAAA,IACA,OAAO,EAAE,WAAA,EAAY,KAAM;AACzB,MAAA,MAAM,QAAQ,WAAA,IAAe,EAAA;AAC7B,MAAA,MAAM,UAAA,GAAa,EAAE,KAAA,EAAO,MAAA,EAAQ,CAAA,EAAE;AACtC,MAAA,MAAM,UAAmC,EAAC;AAC1C,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,GAAA,CAAI,OAC3B,OAAA,CAAsD,YAAY,EAClE,KAAA,CAAM,CAAC,OAAO,EAAE,KAAA,EAAO,aAAa,KAAA,GAAQ,CAAA,CAAE,UAAU,MAAA,CAAO,CAAC,GAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,OAAA,GAAU,OAAA;AAElB,QAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,GAAA,CAAI,OACvB,OAAA,CAEM,wBAAA,EAA0B,EAAE,UAAA,EAAY,CAAA,CAC9C,MAAM,CAAC,CAAA,MAAO,EAAE,KAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAA,EAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,GAAA,GAAM,GAAA;AAEd,QAAA,MAAM,WAAW,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAC5B,QAAgE,eAAA,EAAiB;AAAA,UAChF;AAAA,SACD,CAAA,CACA,KAAA,CAAM,CAAC,OAAO,EAAE,KAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,GAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,QAAA,GAAW,QAAA;AAEnB,QAAA,MAAM,QAAQ,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CACzB,QAA+D,eAAA,EAAiB;AAAA,UAC/E;AAAA,SACD,CAAA,CACA,KAAA,CAAM,CAAC,OAAO,EAAE,KAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,GAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,QAAA,GAAW,KAAA;AAEnB,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CACxB,QAA2D,WAAA,EAAa;AAAA,UACvE;AAAA,SACD,CAAA,CACA,KAAA,CAAM,CAAC,OAAO,EAAE,KAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,GAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAElB,QAAA,MAAM,WAAA,GAAc,MAAM,GAAA,CAAI,GAAA,CAAI,OAC/B,OAAA,CAEM,wBAAA,EAA0B,EAAE,UAAA,EAAY,CAAA,CAC9C,MAAM,CAAC,CAAA,MAAO,EAAE,KAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAA,EAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,WAAA,GAAc,WAAA;AAEtB,QAAA,OAAO,WAAW,OAAO,CAAA;AAAA,MAC3B,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,uBAAA,EAAyB,kCAAA,EAAoC,CAAC,CAAA;AAAA,MAChF;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,wBAAA;AAAA,MACP,WAAA,EACE,mIAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,0BAA0B;AAAA;AAClE,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAM,KAAM;AACnB,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,MAAA,MAAM,SACJ,GAAA,CAAI,GAAA,KAAQ,MAAA,GACP,GAAA,CAAI,SAAS,cAAA,IAAkB,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA,GACzE,IAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC/C,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AACpC,MAAA,MAAM,EAAA,GAAK,OAAO,QAAA,EAAS;AAC3B,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,SAAA,EAAY,EAAA,GAAK,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AACtE,MAAA,OAAO,UAAA,CAAW,EAAE,GAAA,EAAK,CAAA;AAAA,IAC3B;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,6BAA6B,CAAC,CAAA;AAAA,IACjE;AAAA,MACE,KAAA,EAAO,0BAAA;AAAA,MACP,WAAA,EACE,qIAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,OAAOA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,0BAA0B;AAAA;AAClE,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAM,KAAM;AACnB,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,MAAA,MAAM,SACJ,GAAA,CAAI,GAAA,KAAQ,MAAA,GACP,GAAA,CAAI,SAAS,cAAA,IAAkB,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA,GACzE,IAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC/C,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AACpC,MAAA,MAAM,EAAA,GAAK,OAAO,QAAA,EAAS;AAC3B,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,eAAA,EAAkB,EAAA,GAAK,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAC5E,MAAA,OAAO,UAAA,CAAW,EAAE,GAAA,EAAK,CAAA;AAAA,IAC3B;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,sBAAA;AAAA,MACP,WAAA,EACE,uIAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,iCAAiC;AAAA;AAC9D,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAM,KAAM;AACnB,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,MAAA,MAAM,SACJ,GAAA,CAAI,GAAA,KAAQ,MAAA,GACP,GAAA,CAAI,SAAS,cAAA,IAAkB,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA,GACzE,IAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC/C,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,EAAE,OAAO,CAAA;AAC5C,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,YAAA,EAAe,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA;AACxE,MAAA,OAAO,UAAA,CAAW,EAAE,GAAA,EAAK,CAAA;AAAA,IAC3B;AAAA,GACF;AACF;;;ACj9BA,IAAM,UAAA,GAAwB;AAAA,EAC5B,EAAA,EAAI,MAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,gBAAA;AAAA,EACb,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,iBAAA,CAAkB,MAAA,EAAQ,KAAK,KAAK,CAAA;AACpC,IAAA,qBAAA,CAAsB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAMxC,IAAA,sBAAA,CAAuB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAEzC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,YAAA,GAAQ","file":"index.cjs","sourcesContent":["/**\n * OAuth2 Device Code flow + Client Credentials flow + workspace token issuance.\n * Pure functions — operate on injected endpoints + client ids, no global state.\n *\n * Mirrors cli-sdk/src/core/auth/device-code.ts so a future shared\n * @burdenoff/auth-core extraction is mechanical.\n */\n\nimport fetch from 'cross-fetch';\n\nexport interface DeviceCodeResponse {\n deviceCode: string;\n userCode: string;\n verificationUri: string;\n verificationUriComplete: string | null;\n expiresIn: number;\n interval: number;\n}\n\nexport interface DeviceCodeTokenResult {\n accessToken: string;\n refreshToken: string;\n expiresIn: number;\n}\n\nexport interface ClientCredentialsResult {\n accessToken: string;\n expiresIn: number;\n scopes: string[];\n}\n\nexport interface OIDCConfig {\n oidcIssuer: string;\n clientId: string;\n}\n\nexport async function startDeviceCodeFlow(config: OIDCConfig): Promise<DeviceCodeResponse> {\n const url = `${config.oidcIssuer}/oidc/device/code`;\n const body = new URLSearchParams({\n client_id: config.clientId,\n scope: 'openid profile email offline_access',\n });\n\n const response = await fetch(url, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: body.toString(),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => 'Unknown error');\n throw new Error(`Device code request failed (${response.status}): ${text}`);\n }\n\n const data = (await response.json()) as Record<string, unknown>;\n\n return {\n deviceCode: data['device_code'] as string,\n userCode: data['user_code'] as string,\n verificationUri: data['verification_uri'] as string,\n verificationUriComplete: (data['verification_uri_complete'] as string) ?? null,\n expiresIn: data['expires_in'] as number,\n interval: (data['interval'] as number) ?? 5,\n };\n}\n\nexport type DeviceTokenPollResult =\n | { status: 'authenticated'; tokens: DeviceCodeTokenResult }\n | { status: 'pending' }\n | { status: 'slow_down'; newInterval: number }\n | { status: 'expired' }\n | { status: 'denied' };\n\n/**\n * Single-shot device-code token poll.\n *\n * Unlike cli-sdk's pollForToken which loops until done (suitable for blocking\n * CLI), MCP needs non-blocking semantics: the LLM calls auth_complete tool\n * repeatedly. This helper makes ONE poll attempt and returns a discriminated\n * union the caller can act on.\n */\nexport async function pollDeviceTokenOnce(\n deviceCode: string,\n interval: number,\n config: OIDCConfig,\n): Promise<DeviceTokenPollResult> {\n const url = `${config.oidcIssuer}/oauth/device/token`;\n\n const response = await fetch(url, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n device_code: deviceCode,\n client_id: config.clientId,\n }).toString(),\n });\n\n const data = (await response.json()) as Record<string, unknown>;\n\n if (response.ok && data['access_token']) {\n return {\n status: 'authenticated',\n tokens: {\n accessToken: data['access_token'] as string,\n refreshToken: (data['refresh_token'] as string) ?? '',\n expiresIn: (data['expires_in'] as number) ?? 3600,\n },\n };\n }\n\n const errorCode = data['error'] as string | undefined;\n switch (errorCode) {\n case 'authorization_pending':\n return { status: 'pending' };\n case 'slow_down':\n return { status: 'slow_down', newInterval: interval + 5 };\n case 'expired_token':\n return { status: 'expired' };\n case 'access_denied':\n return { status: 'denied' };\n default:\n throw new Error(\n `Device code polling failed: ${(data['error_description'] as string) ?? errorCode ?? 'Unknown error'}`,\n );\n }\n}\n\nexport async function clientCredentialsFlow(\n globalEndpoint: string,\n clientId: string,\n clientSecret: string,\n scopes?: string[],\n): Promise<ClientCredentialsResult> {\n const query = `\n mutation AuthenticateApp($input: AuthenticateAppInput!) {\n authenticateApp(input: $input) {\n accessToken tokenType expiresIn scopes\n }\n }\n `;\n\n const response = await fetch(globalEndpoint, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n query,\n variables: { input: { clientId, clientSecret, scopes } },\n }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => 'Unknown error');\n throw new Error(`App authentication failed (${response.status}): ${text}`);\n }\n\n const data = (await response.json()) as {\n data?: { authenticateApp: { accessToken: string; expiresIn: number; scopes: string[] } };\n errors?: Array<{ message: string }>;\n };\n\n if (data.errors?.length) {\n throw new Error(`App authentication failed: ${data.errors[0]?.message ?? 'unknown error'}`);\n }\n if (!data.data?.authenticateApp?.accessToken) {\n throw new Error('App authentication failed: no access token returned');\n }\n\n return data.data.authenticateApp;\n}\n\nexport async function issueWorkspaceToken(\n workspaceEndpoint: string,\n authToken: string,\n workspaceId: string,\n organizationId: string,\n): Promise<{ token: string; expiresAt: string; scopes: string[] }> {\n const query = `\n mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n issueWorkspaceToken(input: $input) {\n success token expiresAt scopes\n error { code message }\n }\n }\n `;\n\n const response = await fetch(workspaceEndpoint, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${authToken}` },\n body: JSON.stringify({ query, variables: { input: { workspaceId, organizationId } } }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => 'Unknown error');\n throw new Error(`Workspace token request failed (${response.status}): ${text}`);\n }\n\n const data = (await response.json()) as {\n data?: {\n issueWorkspaceToken: {\n success: boolean;\n token: string | null;\n expiresAt: string | null;\n scopes: string[] | null;\n error: { code: string; message: string } | null;\n };\n };\n errors?: Array<{ message: string }>;\n };\n\n if (data.errors?.length) {\n throw new Error(`Workspace token failed: ${data.errors[0]?.message ?? 'unknown error'}`);\n }\n\n const result = data.data?.issueWorkspaceToken;\n if (!result?.success || !result.token) {\n throw new Error(`Workspace token failed: ${result?.error?.message ?? 'Unknown error'}`);\n }\n\n return { token: result.token, expiresAt: result.expiresAt ?? '', scopes: result.scopes ?? [] };\n}\n\nexport async function fetchWorkspaces(\n globalEndpoint: string,\n authToken: string,\n): Promise<\n Array<{ id: string; name: string; slug: string; tenantId: string; organizationId: string }>\n> {\n const query = `\n query MyWorkspaces($limit: Int) {\n myWorkspaces(limit: $limit) {\n items { id name slug tenantId organizationId }\n }\n }\n `;\n\n const response = await fetch(globalEndpoint, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${authToken}` },\n body: JSON.stringify({ query, variables: { limit: 50 } }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => 'Unknown error');\n throw new Error(`Failed to fetch workspaces (${response.status}): ${text}`);\n }\n\n const data = (await response.json()) as {\n data?: {\n myWorkspaces: {\n items: Array<{\n id: string;\n name: string;\n slug: string;\n tenantId: string;\n organizationId: string;\n }>;\n };\n };\n errors?: Array<{ message: string }>;\n };\n\n if (data.errors?.length) {\n throw new Error(`Failed to fetch workspaces: ${data.errors[0]?.message ?? 'unknown error'}`);\n }\n\n return data.data?.myWorkspaces?.items ?? [];\n}\n","/**\n * Auth helper for the auth module — ports VibeControlsMCPAuth from\n * vibecontrols-mcp/src/auth/index.ts to a ctx-aware factory.\n *\n * Differences from the legacy class:\n * - Per-ctx instance (no module-level singleton; each product MCP gets its own)\n * - Token persistence delegated to ctx.auth (StoredAuth file)\n * - Endpoints + clientId resolved via ctx.config.resolveOIDC + ctx.config.read\n * - pendingDeviceCode kept in closure scope (alive for the MCP server process,\n * suitable for stdio's lifetime; HTTP's per-session servers each get their own\n * pending state)\n *\n * Public surface mirrors the legacy class so the lifted auth/tools.ts works\n * without modification: startLogin / completeLogin / selectWorkspace /\n * listWorkspaces / getStatus / logout / ensureAuthenticated / getHeaders /\n * isLoggedIn / setOnTokensChanged.\n */\n\nimport type { McpContext } from '../../core/index.js';\nimport { fetchWorkspaces, issueWorkspaceToken } from '../../core/auth/device-code.js';\n\ninterface PendingDeviceCode {\n deviceCode: string;\n userCode: string;\n verificationUri: string;\n verificationUriComplete: string | null;\n expiresAt: number;\n interval: number;\n clientId: string;\n tokenUrl: string;\n}\n\nexport interface WorkspaceInfo {\n id: string;\n name: string;\n slug: string;\n tenantId: string;\n organizationId: string;\n}\n\nexport interface LoginStartResult {\n status: 'device_code_issued';\n verificationUri: string;\n verificationUriComplete: string | null;\n userCode: string;\n expiresIn: number;\n message: string;\n}\n\nexport interface LoginCompleteResult {\n status: 'authenticated' | 'workspace_selection_required' | 'pending' | 'expired';\n message: string;\n workspaces?: WorkspaceInfo[];\n}\n\nexport interface AuthHelper {\n startLogin(): Promise<LoginStartResult>;\n completeLogin(): Promise<LoginCompleteResult>;\n selectWorkspace(workspaceId: string, organizationId: string): Promise<void>;\n listWorkspaces(): Promise<WorkspaceInfo[]>;\n ensureAuthenticated(): Promise<void>;\n getStatus(): Promise<{\n authenticated: boolean;\n method: string;\n expiresAt: string | null;\n workspaceId: string | null;\n organizationId: string | null;\n workspaceTokenExpiresAt: string | null;\n hasWorkspaceToken: boolean;\n hasPendingLogin: boolean;\n }>;\n logout(): Promise<void>;\n getHeaders(): Record<string, string>;\n isLoggedIn(): boolean;\n setOnTokensChanged(cb: () => void): void;\n}\n\nconst helpers = new WeakMap<McpContext, AuthHelper>();\n\nexport function getAuth(ctx: McpContext): AuthHelper {\n const cached = helpers.get(ctx);\n if (cached) return cached;\n const helper = createAuthHelper(ctx);\n helpers.set(ctx, helper);\n return helper;\n}\n\nfunction createAuthHelper(ctx: McpContext): AuthHelper {\n let pending: PendingDeviceCode | null = null;\n let onTokensChanged: (() => void) | null = null;\n let refreshInProgress: Promise<void> | null = null;\n\n function notify(): void {\n onTokensChanged?.();\n }\n\n async function startLogin(): Promise<LoginStartResult> {\n const { oidcIssuer, clientId } = ctx.config.resolveOIDC();\n const deviceCodeUrl = `${oidcIssuer}/oidc/device/code`;\n const tokenUrl = `${oidcIssuer}/oauth/device/token`;\n\n const response = await fetch(deviceCodeUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n client_id: clientId,\n scope: 'openid profile email offline_access',\n }).toString(),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => 'Unknown error');\n throw new Error(`Device code request failed (${response.status}): ${text}`);\n }\n\n const data = (await response.json()) as Record<string, unknown>;\n const deviceCode = data['device_code'] as string;\n const userCode = data['user_code'] as string;\n const verificationUri = data['verification_uri'] as string;\n const verificationUriComplete = (data['verification_uri_complete'] as string) ?? null;\n const expiresIn = (data['expires_in'] as number) ?? 900;\n const interval = (data['interval'] as number) ?? 5;\n\n pending = {\n deviceCode,\n userCode,\n verificationUri,\n verificationUriComplete,\n expiresAt: Date.now() + expiresIn * 1000,\n interval,\n clientId,\n tokenUrl,\n };\n\n return {\n status: 'device_code_issued',\n verificationUri,\n verificationUriComplete,\n userCode,\n expiresIn,\n message: `Open ${verificationUriComplete ?? verificationUri} in a browser and enter code: ${userCode}. Then call ${ctx.productName}_auth_complete to finish authentication.`,\n };\n }\n\n async function completeLogin(): Promise<LoginCompleteResult> {\n if (!pending) {\n throw new Error(\n `No pending login flow. Call ${ctx.productName}_auth_login first to start the device code flow.`,\n );\n }\n\n const p = pending;\n if (Date.now() >= p.expiresAt) {\n pending = null;\n return {\n status: 'expired',\n message: `Device code has expired. Call ${ctx.productName}_auth_login again to get a new code.`,\n };\n }\n\n const response = await fetch(p.tokenUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n device_code: p.deviceCode,\n client_id: p.clientId,\n }).toString(),\n });\n\n const data = (await response.json()) as Record<string, unknown>;\n\n if (response.ok && data['access_token']) {\n pending = null;\n const expiresIn = (data['expires_in'] as number) ?? 3600;\n const auth = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n ctx.auth.write({\n ...auth,\n accessToken: data['access_token'] as string,\n refreshToken: (data['refresh_token'] as string) ?? '',\n expiresAt: Date.now() + expiresIn * 1000,\n authMethod: 'device_code',\n });\n ctx.gql.reset();\n return await handlePostLogin();\n }\n\n const errorCode = data['error'] as string | undefined;\n if (errorCode === 'authorization_pending') {\n return {\n status: 'pending',\n message: `Still waiting for user to authorize. Open ${p.verificationUriComplete ?? p.verificationUri} and enter code: ${p.userCode}. Then call ${ctx.productName}_auth_complete again.`,\n };\n } else if (errorCode === 'slow_down') {\n p.interval += 5;\n return {\n status: 'pending',\n message: `Authorization server asked to slow down. Wait a moment, then call ${ctx.productName}_auth_complete again.`,\n };\n } else if (errorCode === 'expired_token') {\n pending = null;\n return {\n status: 'expired',\n message: `Device code has expired. Call ${ctx.productName}_auth_login again.`,\n };\n } else if (errorCode === 'access_denied') {\n pending = null;\n throw new Error('Authorization was denied by the user.');\n } else {\n pending = null;\n throw new Error(\n `Device code error: ${(data['error_description'] as string) ?? errorCode ?? 'Unknown'}`,\n );\n }\n }\n\n async function handlePostLogin(): Promise<LoginCompleteResult> {\n try {\n const workspaces = await listWorkspaces();\n if (workspaces.length === 0) {\n notify();\n ctx.logger.info('Device code login successful (no workspaces found)');\n return {\n status: 'authenticated',\n message: `Authentication successful. No workspaces found — use ${ctx.productName}_auth_select_workspace when one is available.`,\n };\n }\n if (workspaces.length === 1) {\n const ws = workspaces[0];\n if (!ws)\n throw new Error('Unexpected: workspaces.length === 1 but workspaces[0] is undefined');\n await issueAndStoreWorkspaceToken(ws.id, ws.organizationId);\n ctx.logger.info('Device code login successful', {\n workspaceId: ws.id,\n workspaceName: ws.name,\n });\n return {\n status: 'authenticated',\n message: `Authentication successful. Workspace \"${ws.name}\" selected automatically.`,\n };\n }\n notify();\n ctx.logger.info('Device code login successful, workspace selection needed');\n return {\n status: 'workspace_selection_required',\n message: `Authentication successful. ${workspaces.length} workspaces available — call ${ctx.productName}_auth_select_workspace to choose one.`,\n workspaces,\n };\n } catch (wsError) {\n notify();\n ctx.logger.warn('Workspace discovery failed after login', {\n error: wsError instanceof Error ? wsError.message : String(wsError),\n });\n return {\n status: 'authenticated',\n message: `Authentication successful. Workspace discovery failed: ${wsError instanceof Error ? wsError.message : String(wsError)}`,\n };\n }\n }\n\n async function listWorkspaces(): Promise<WorkspaceInfo[]> {\n const auth = ctx.auth.read();\n if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n return fetchWorkspaces(ctx.config.read().globalEndpoint, auth.accessToken);\n }\n\n async function issueAndStoreWorkspaceToken(\n workspaceId: string,\n organizationId: string,\n ): Promise<void> {\n const auth = ctx.auth.read();\n if (!auth?.accessToken) throw new Error('Not authenticated.');\n const result = await issueWorkspaceToken(\n ctx.config.read().workspaceEndpoint,\n auth.accessToken,\n workspaceId,\n organizationId,\n );\n ctx.auth.write({\n ...auth,\n workspaceToken: result.token,\n workspaceTokenExpiresAt: new Date(result.expiresAt).getTime(),\n workspaceId,\n organizationId,\n });\n ctx.gql.reset();\n notify();\n }\n\n async function selectWorkspace(workspaceId: string, organizationId: string): Promise<void> {\n const auth = ctx.auth.read();\n if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n await issueAndStoreWorkspaceToken(workspaceId, organizationId);\n ctx.logger.info('Workspace selected', { workspaceId });\n }\n\n async function ensureAuthenticated(): Promise<void> {\n if (refreshInProgress) {\n await refreshInProgress;\n return;\n }\n const doEnsure = async (): Promise<void> => {\n const auth = ctx.auth.read();\n if (auth?.apiKey) return;\n if (!auth?.accessToken) {\n throw new Error(\n `Not authenticated. Call ${ctx.productName}_auth_login to start the login flow, then ${ctx.productName}_auth_complete after authorizing in the browser.`,\n );\n }\n // The shared gql client handles refresh via isTokenExpiringSoon + isWorkspaceTokenExpiringSoon —\n // trigger by issuing a no-op request that goes through the workspace client's refresh path.\n // We simulate a no-op via a cheap query if needed; today the gql wrapper does it lazily,\n // so we just delegate to it on the next request. Nothing to do here.\n };\n refreshInProgress = doEnsure().finally(() => {\n refreshInProgress = null;\n });\n await refreshInProgress;\n }\n\n function getStatus(): Promise<{\n authenticated: boolean;\n method: string;\n expiresAt: string | null;\n workspaceId: string | null;\n organizationId: string | null;\n workspaceTokenExpiresAt: string | null;\n hasWorkspaceToken: boolean;\n hasPendingLogin: boolean;\n }> {\n const auth = ctx.auth.read();\n return Promise.resolve({\n authenticated: !!(auth?.accessToken || auth?.apiKey),\n method: auth?.apiKey ? 'api_key' : auth?.accessToken ? 'oauth_token' : 'none',\n expiresAt: auth?.expiresAt ? new Date(auth.expiresAt).toISOString() : null,\n workspaceId: auth?.workspaceId ?? null,\n organizationId: auth?.organizationId ?? null,\n workspaceTokenExpiresAt: auth?.workspaceTokenExpiresAt\n ? new Date(auth.workspaceTokenExpiresAt).toISOString()\n : null,\n hasWorkspaceToken: !!auth?.workspaceToken,\n hasPendingLogin: !!pending,\n });\n }\n\n async function logout(): Promise<void> {\n pending = null;\n ctx.auth.clear();\n ctx.gql.reset();\n notify();\n ctx.logger.info('Logged out and cleared stored tokens');\n }\n\n function getHeaders(): Record<string, string> {\n const auth = ctx.auth.read();\n const headers: Record<string, string> = {};\n if (auth?.apiKey) headers['X-API-Key'] = auth.apiKey;\n if (auth?.accessToken) headers['Authorization'] = `Bearer ${auth.accessToken}`;\n if (auth?.workspaceToken)\n headers['X-Workspace-Authorization'] = `Bearer ${auth.workspaceToken}`;\n if (auth?.organizationId) headers['x-org-id'] = auth.organizationId;\n if (auth?.workspaceId) headers['x-workspace-id'] = auth.workspaceId;\n return headers;\n }\n\n function isLoggedIn(): boolean {\n const auth = ctx.auth.read();\n return !!(auth?.accessToken || auth?.apiKey);\n }\n\n function setOnTokensChanged(cb: () => void): void {\n onTokensChanged = cb;\n }\n\n return {\n startLogin,\n completeLogin,\n selectWorkspace,\n listWorkspaces,\n ensureAuthenticated,\n getStatus,\n logout,\n getHeaders,\n isLoggedIn,\n setOnTokensChanged,\n };\n}\n","/**\n * Error classes for MCP SDK.\n *\n * Modules MUST throw these instead of throwing raw Errors. The registerTool\n * wrapper in result.ts catches and maps them to MCP-protocol-compliant\n * `{ isError: true, content: [...] }` responses.\n *\n * Throwing past the wrapper to the protocol surfaces as JSON-RPC -32603 to\n * the client and is a protocol bug.\n */\n\nexport class McpUserError extends Error {\n public readonly hint: string | undefined;\n\n constructor(message: string, opts?: { hint?: string }) {\n super(message);\n this.name = 'McpUserError';\n this.hint = opts?.hint;\n }\n}\n\nexport class McpAuthError extends McpUserError {\n constructor(message: string, opts?: { hint?: string }) {\n super(message, {\n hint: opts?.hint ?? 'Run the auth_login tool to authenticate.',\n });\n this.name = 'McpAuthError';\n }\n}\n\nexport class McpInternalError extends Error {\n public override readonly cause: unknown;\n\n constructor(message: string, cause?: unknown) {\n super(message);\n this.name = 'McpInternalError';\n this.cause = cause;\n }\n}\n","/**\n * Tool / resource / prompt naming helpers.\n *\n * Mandatory product prefix avoids collisions when Claude Desktop runs\n * multiple MCP servers concurrently (typical setup is ~6).\n *\n * Tool names are capped at 63 characters — Claude Desktop pre-1.x\n * truncated at 64 in some versions.\n */\n\nimport { McpInternalError } from './errors.js';\n\nconst MAX_TOOL_NAME_LENGTH = 63;\n\nfunction assertSafeName(name: string, kind: 'tool' | 'resource' | 'prompt'): string {\n if (kind === 'tool' && name.length > MAX_TOOL_NAME_LENGTH) {\n throw new McpInternalError(\n `Tool name '${name}' exceeds ${MAX_TOOL_NAME_LENGTH} characters (some MCP clients truncate at 64).`,\n );\n }\n return name;\n}\n\n/**\n * Build a tool name. Format: `<productName>_<...parts>` (snake_case).\n * Example: mcpToolName('vibecontrols', 'vibes', 'list') -> 'vibecontrols_vibes_list'\n */\nexport function mcpToolName(productName: string, ...parts: string[]): string {\n if (!productName) {\n throw new McpInternalError('mcpToolName: productName is required');\n }\n const name = [productName, ...parts].filter(Boolean).join('_');\n return assertSafeName(name, 'tool');\n}\n\n/**\n * Build a resource URI. Format: `<productName>://<...parts>`.\n * Example: mcpResourceUri('vibecontrols', 'schema') -> 'vibecontrols://schema'\n */\nexport function mcpResourceUri(productName: string, ...parts: string[]): string {\n if (!productName) {\n throw new McpInternalError('mcpResourceUri: productName is required');\n }\n return `${productName}://${parts.filter(Boolean).join('/')}`;\n}\n\n/**\n * Build a prompt name. Format: `<productName>-<...parts>` (kebab-case).\n * Example: mcpPromptName('vibecontrols', 'setup') -> 'vibecontrols-setup'\n */\nexport function mcpPromptName(productName: string, ...parts: string[]): string {\n if (!productName) {\n throw new McpInternalError('mcpPromptName: productName is required');\n }\n return [productName, ...parts].filter(Boolean).join('-');\n}\n\nexport const TOOL_NAME_LIMIT = MAX_TOOL_NAME_LENGTH;\n\n/**\n * Name-based hint heuristics for MCP `annotations` (readOnlyHint /\n * destructiveHint). Used by tool-governance.ts to auto-fill annotations for\n * the fleet of product modules that call `server.registerTool` directly\n * (bypassing the `registerTool()` core helper) and so never set them\n * explicitly today (BOFF-3903). Deliberately conservative — matched against\n * whole `_`-delimited segments so e.g. `timeentries_delete` and\n * `pomodoro_delete_goal` match, but a hypothetical `undeletable_check`\n * would not.\n *\n * A module can always override the inference by passing an explicit\n * `annotations` object to `registerTool()` / `server.registerTool()`.\n */\nconst DESTRUCTIVE_NAME_SEGMENT = /(?:^|_)delete(?:_|$)/i;\nconst READ_ONLY_NAME_SEGMENT = /(?:^|_)(?:list|get|search|check|read|count|stats|by_date)(?:_|$)/i;\n\n/** True when a tool name looks destructive (irreversibly deletes data) by naming convention. */\nexport function inferDestructiveHint(toolName: string): boolean {\n return DESTRUCTIVE_NAME_SEGMENT.test(toolName);\n}\n\n/**\n * True when a tool name looks read-only by naming convention. Never true for\n * a name that also looks destructive (a tool can't be both).\n */\nexport function inferReadOnlyHint(toolName: string): boolean {\n return !inferDestructiveHint(toolName) && READ_ONLY_NAME_SEGMENT.test(toolName);\n}\n","/**\n * MCP tool result helpers + central handler.\n *\n * Modules NEVER call server.registerTool directly — they use registerTool()\n * from this module so the central try/catch wraps the handler and:\n * - maps thrown McpUserError / McpAuthError / McpInternalError to\n * MCP-protocol-compliant `{ isError: true, content: [...] }` shapes\n * - threads `_meta.progressToken` into ctx.progress for long ops\n * - emits a structured log line on every error\n * - never leaks `cause` from McpInternalError to the client\n *\n * This is the analog of cli-sdk's createProgram() central error handler.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { ZodRawShape } from 'zod';\nimport type { McpContext } from './context.js';\nimport { McpAuthError, McpInternalError, McpUserError } from './errors.js';\nimport type { ToolAnnotations } from './tool-governance.js';\n\nexport interface ToolTextContent {\n type: 'text';\n text: string;\n [k: string]: unknown;\n}\n\nexport interface ToolResult {\n content: ToolTextContent[];\n isError?: boolean;\n structuredContent?: Record<string, unknown>;\n [k: string]: unknown;\n}\n\nexport interface ToolMeta {\n progressToken?: string | number;\n}\n\n/**\n * Build a successful tool result with JSON content (pretty-printed).\n */\nexport function jsonResult(data: unknown, structured?: Record<string, unknown>): ToolResult {\n const result: ToolResult = {\n content: [{ type: 'text', text: JSON.stringify(data, null, 2) }],\n };\n if (structured !== undefined) {\n result.structuredContent = structured;\n }\n return result;\n}\n\n/**\n * Build a successful tool result with plain text content.\n */\nexport function textResult(text: string): ToolResult {\n return { content: [{ type: 'text', text }] };\n}\n\n/**\n * Build an error tool result. Honors MCP's `{ isError: true, content }` shape.\n * Optional hint is appended on a new line so the LLM can react.\n */\nexport function errorResult(message: string, hint?: string): ToolResult {\n const text = hint ? `${message}\\n\\nHint: ${hint}` : message;\n return { content: [{ type: 'text', text }], isError: true };\n}\n\nexport interface ToolMetadata {\n title: string;\n description: string;\n inputSchema?: ZodRawShape;\n /**\n * Explicit MCP annotations (readOnlyHint / destructiveHint / ...). Optional\n * — when omitted, `wrapServerWithToolGovernance` (applied centrally in\n * `createMcpServer`) infers them from the tool name. Set this to override\n * the inference for a tool whose name doesn't match the naming convention.\n */\n annotations?: ToolAnnotations;\n}\n\nexport type ToolHandler<TArgs = Record<string, unknown>> = (\n args: TArgs,\n ctx: McpContext,\n meta: ToolMeta,\n) => Promise<unknown>;\n\n/**\n * Register a tool with the central error wrapper.\n *\n * The handler returns a plain value or void. The wrapper:\n * - wraps non-undefined returns in jsonResult()\n * - if the value already looks like a ToolResult (has `content`), passes through\n * - catches McpAuthError / McpUserError / McpInternalError / generic Error\n * - logs every error via ctx.logger.error\n */\nexport function registerTool<TArgs extends Record<string, unknown>>(\n server: McpServer,\n ctx: McpContext,\n name: string,\n metadata: ToolMetadata,\n handler: ToolHandler<TArgs>,\n): void {\n const sdkConfig = {\n title: metadata.title,\n description: metadata.description,\n ...(metadata.inputSchema ? { inputSchema: metadata.inputSchema } : {}),\n ...(metadata.annotations ? { annotations: metadata.annotations } : {}),\n };\n\n // The MCP SDK's registerTool signature is `(name, config, handler)`. The\n // handler arity depends on whether inputSchema is present (1-arg without,\n // 2-arg with). We accept a unified handler shape and dispatch at runtime.\n // The SDK's typing is strict and conditional on the inputSchema generic;\n // bypass with a cast since runtime acceptance is unconditional.\n const wrapped = async (...callbackArgs: unknown[]): Promise<ToolResult> => {\n const hasArgs = callbackArgs.length === 2;\n const args = (hasArgs ? callbackArgs[0] : {}) as TArgs;\n const extra = (hasArgs ? callbackArgs[1] : callbackArgs[0]) as\n { _meta?: { progressToken?: string | number } } | undefined;\n\n const progressToken = extra?._meta?.progressToken;\n const meta: ToolMeta = progressToken !== undefined ? { progressToken } : {};\n\n try {\n const result = await handler(args, ctx, meta);\n if (isToolResult(result)) return result;\n if (result === undefined) return textResult('OK');\n return jsonResult(result);\n } catch (error) {\n return mapErrorToResult(error, ctx, name);\n }\n };\n\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n (server as any).registerTool(name, sdkConfig, wrapped);\n}\n\nfunction isToolResult(value: unknown): value is ToolResult {\n return (\n !!value &&\n typeof value === 'object' &&\n 'content' in value &&\n Array.isArray((value as ToolResult).content)\n );\n}\n\nfunction mapErrorToResult(error: unknown, ctx: McpContext, toolName: string): ToolResult {\n if (error instanceof McpAuthError) {\n ctx.logger.warn(`${toolName}: auth required`, { message: error.message });\n return errorResult(error.message, error.hint);\n }\n if (error instanceof McpUserError) {\n ctx.logger.info(`${toolName}: user error`, { message: error.message });\n return errorResult(error.message, error.hint);\n }\n if (error instanceof McpInternalError) {\n ctx.logger.error(`${toolName}: internal error`, {\n message: error.message,\n cause: stringifyCause(error.cause),\n });\n return errorResult(`Internal error in ${toolName}.`);\n }\n const message = error instanceof Error ? error.message : String(error);\n ctx.logger.error(`${toolName}: unhandled error`, { message });\n return errorResult(`${toolName}: ${message}`);\n}\n\nfunction stringifyCause(cause: unknown): string | undefined {\n if (cause === undefined || cause === null) return undefined;\n if (cause instanceof Error) return cause.message;\n try {\n return JSON.stringify(cause);\n } catch {\n return String(cause);\n }\n}\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { getAuth } from '../auth/legacy-auth.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\n\nexport function registerAuthTools(\n server: McpServer,\n ctx: McpContext,\n track: (n: string) => string,\n): void {\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_login')),\n {\n title: 'Start Login',\n description:\n 'Start the device code login flow. Returns a verification URL and user code immediately (non-blocking). The user must open the URL in a browser and enter the code, then call vibecontrols_auth_complete to finish.',\n inputSchema: {},\n },\n async () => {\n try {\n const auth = getAuth(ctx);\n const result = await auth.startLogin();\n return jsonResult(result);\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_login failed', { error });\n return errorResult(\n `Login failed: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_complete')),\n {\n title: 'Complete Login',\n description:\n 'Check if the user has completed the device code authorization in their browser. Call this after the user has opened the verification URL and entered the code from vibecontrols_auth_login. Returns \"pending\" if not yet authorized, \"authenticated\" on success.',\n inputSchema: {},\n },\n async () => {\n try {\n const auth = getAuth(ctx);\n const result = await auth.completeLogin();\n return jsonResult(result);\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_complete failed', { error });\n return errorResult(\n `Login completion failed: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_select_workspace')),\n {\n title: 'Select Workspace',\n description:\n 'Select a workspace after login (when multiple workspaces are available). Issues a workspace-scoped token.',\n inputSchema: {\n workspaceId: z.string().describe('Workspace ID to select'),\n organizationId: z.string().describe('Organization ID for the workspace'),\n },\n },\n async ({ workspaceId, organizationId }) => {\n try {\n const auth = getAuth(ctx);\n await auth.selectWorkspace(workspaceId, organizationId);\n return jsonResult({\n status: 'workspace_selected',\n workspaceId,\n message: `Workspace ${workspaceId} selected and token issued.`,\n });\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_select_workspace failed', { error });\n return errorResult(\n `Failed to select workspace: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_workspaces')),\n {\n title: 'List Workspaces',\n description: 'List all workspaces available to the authenticated user.',\n inputSchema: {},\n },\n async () => {\n try {\n const auth = getAuth(ctx);\n const workspaces = await auth.listWorkspaces();\n return jsonResult({ workspaces, total: workspaces.length });\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_workspaces failed', { error });\n return errorResult(\n `Failed to list workspaces: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_status')),\n {\n title: 'Auth Status',\n description:\n 'Show current authentication status including method, token expiration, workspace info, and pending login state.',\n inputSchema: {},\n },\n async () => {\n try {\n const auth = getAuth(ctx);\n const status = await auth.getStatus();\n return jsonResult(status);\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_status failed', { error });\n return errorResult(\n `Failed to get auth status: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_logout')),\n {\n title: 'Logout',\n description: 'Log out and clear all stored authentication tokens.',\n inputSchema: {},\n },\n async () => {\n try {\n const auth = getAuth(ctx);\n await auth.logout();\n return jsonResult({\n status: 'logged_out',\n message: 'Tokens cleared successfully.',\n });\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_logout failed', { error });\n return errorResult(\n `Logout failed: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n}\n","/**\n * Extended auth GraphQL operations (Phase 2 additions).\n *\n * Ported verbatim from cli-sdk/src/modules/auth/extra-operations.ts so the\n * field selections stay aligned across CLI and MCP. All operations live on\n * the global gateway; calling code uses ctx.gql.global.request().\n */\n\n// ── SDK-parity operations ────────────────────────────────────────────────\n// Mirror sdk-libs-node/src/modules/auth/operations.ts so MCP tools that close\n// the parity gap (auth_sign_up / auth_authenticate_app / auth_sign_in /\n// auth_refresh_token / etc.) hit the same backend mutations as the SDK.\n\nexport const SIGN_UP = `\n mutation SignUp($input: SignUpInput!) {\n signUp(input: $input) {\n user { id email username }\n accessToken\n refreshToken\n expiresIn\n }\n }\n`;\n\nexport const SIGN_IN = `\n mutation SignIn($input: SignInInput!) {\n signIn(input: $input) {\n user { id email username }\n accessToken\n refreshToken\n expiresIn\n }\n }\n`;\n\nexport const REFRESH_TOKEN_OP = `\n mutation RefreshToken($token: String!) {\n refreshToken(token: $token) {\n user { id email username }\n accessToken\n refreshToken\n expiresIn\n }\n }\n`;\n\nexport const SIGN_OUT = `\n mutation SignOut {\n signOut\n }\n`;\n\nexport const AUTHENTICATE_APP = `\n mutation AuthenticateApp($input: AuthenticateAppInput!) {\n authenticateApp(input: $input) {\n accessToken\n tokenType\n expiresIn\n scopes\n }\n }\n`;\n\nexport const CURRENT_USER = `\n query currentUser {\n currentUser {\n id email firstName lastName username phoneNumber name\n emailVerified mfaEnabled isAdmin role status createdAt lastLoginAt\n }\n }\n`;\n\nexport const UPDATE_CURRENT_USER_PROFILE = `\n mutation updateCurrentUserProfile($input: UpdateUserInput!) {\n updateCurrentUserProfile(input: $input) {\n id name firstName lastName username phoneNumber timezone language\n }\n }\n`;\n\nexport const AUTH_AUDIT_LOGS = `\n query authAuditLogs($pagination: PaginationInput) {\n authAuditLogs(pagination: $pagination) {\n id action resource resourceType resourceId description\n ipAddress userAgent metadata createdAt\n }\n }\n`;\n\nexport const ACTIVE_SESSIONS = `\n query activeSessions($pagination: PaginationInput) {\n activeSessions(pagination: $pagination) {\n id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent\n }\n }\n`;\n\nexport const REVOKE_SESSION = `\n mutation revokeSession($sessionId: ID!) {\n revokeSession(sessionId: $sessionId)\n }\n`;\n\nexport const CURRENT_USER_MFA_METHODS = `\n query currentUserMFAMethods($pagination: PaginationInput) {\n currentUserMFAMethods(pagination: $pagination) {\n methods { id method status createdAt updatedAt }\n hasMore totalCount\n }\n }\n`;\n\nexport const SETUP_MFA = `\n mutation setupMFA($method: MFAMethod!) {\n setupMFA(method: $method) {\n method backupCodes qrCode secret\n }\n }\n`;\n\nexport const VERIFY_MFA = `\n mutation verifyMFA($input: MFAVerifyInput!) {\n verifyMFA(input: $input) {\n success token expiresIn user { id email }\n }\n }\n`;\n\nexport const ENABLE_MFA = `\n mutation enableMFA($code: String!) {\n enableMFA(code: $code)\n }\n`;\n\nexport const DISABLE_MFA = `\n mutation disableMFA {\n disableMFA\n }\n`;\n\n// Live `APIKeyConnection` exposes the list under `apiKeys` (NOT a relay\n// connection — no `edges`/`total`/`hasMore`). The `isActive` field was\n// removed from `APIKey` along with the same field on the devportal side.\nexport const MY_API_KEYS = `\n query myApiKeys($pagination: PaginationInput) {\n myApiKeys(pagination: $pagination) {\n apiKeys { id name prefix appId appName scopes expiresAt lastUsedAt createdAt }\n }\n }\n`;\n\nexport const APP_API_KEYS = `\n query appApiKeys($appId: ID!, $pagination: PaginationInput) {\n appApiKeys(appId: $appId, pagination: $pagination) {\n apiKeys { id name prefix appId appName scopes expiresAt lastUsedAt createdAt }\n }\n }\n`;\n\nexport const GENERATE_API_KEY = `\n mutation generateAPIKey($input: GenerateAPIKeyInput!) {\n generateAPIKey(input: $input) {\n keyId apiKey apiSecret\n }\n }\n`;\n\nexport const UPDATE_API_KEY = `\n mutation updateAPIKey($keyId: String!, $input: UpdateAPIKeyInput!) {\n updateAPIKey(keyId: $keyId, input: $input) {\n id name scope expiresAt\n }\n }\n`;\n\nexport const REVOKE_API_KEY = `\n mutation revokeAPIKey($keyId: String!) {\n revokeAPIKey(keyId: $keyId)\n }\n`;\n\nexport const ROTATE_API_KEY = `\n mutation rotateAPIKey($keyId: String!) {\n rotateAPIKey(keyId: $keyId) {\n apiSecret\n }\n }\n`;\n\nexport const CURRENT_USER_DELEGATIONS = `\n query currentUserDelegations($pagination: PaginationInput) {\n currentUserDelegations(pagination: $pagination) {\n delegations {\n id appId userId grantedBy grantedAt expiresAt scopes workspaceIds\n status revokedAt revokedBy\n app { id name }\n }\n hasMore totalCount\n }\n }\n`;\n\nexport const GRANT_DELEGATION = `\n mutation grantDelegation($input: GrantDelegationInput!) {\n grantDelegation(input: $input) {\n id appId userId grantedBy grantedAt expiresAt scopes workspaceIds status\n }\n }\n`;\n\nexport const REVOKE_DELEGATION = `\n mutation revokeDelegation($id: ID!, $reason: String) {\n revokeDelegation(id: $id, reason: $reason)\n }\n`;\n\n// Live `AppConnection` exposes the list under `apps` (NOT a relay\n// connection — no `edges`/`total`/`hasMore`). The selection below is\n// unchanged from the previous mcp-libs shape, just nested one level\n// deeper.\nexport const CURRENT_USER_APPS = `\n query currentUserApps($pagination: PaginationInput) {\n currentUserApps(pagination: $pagination) {\n apps { id clientId name description type actorType status ownerUserId redirectUris scopes createdAt updatedAt }\n }\n }\n`;\n\nexport const GET_APP = `\n query app($id: ID!) {\n app(id: $id) {\n id clientId name description type actorType status ownerUserId redirectUris scopes\n }\n }\n`;\n\nexport const CREATE_APP = `\n mutation createApp($input: CreateAppInput!) {\n createApp(input: $input) {\n app { id clientId name type status }\n clientSecret\n }\n }\n`;\n\nexport const UPDATE_APP = `\n mutation updateApp($id: ID!, $input: UpdateAppInput!) {\n updateApp(id: $id, input: $input) {\n id name description redirectUris scopes status\n }\n }\n`;\n\nexport const DEACTIVATE_APP = `\n mutation deactivateApp($id: ID!) {\n deactivateApp(id: $id)\n }\n`;\n\nexport const GET_SSO_CONFIG = `\n query getSSOConfig($tenantId: String!) {\n getSSOConfig(tenantId: $tenantId) {\n id identifier tenantId entityId ssoUrl sloUrl certificate enabled metadata\n }\n }\n`;\n\nexport const SAVE_SSO_CONFIG = `\n mutation saveSSOConfig($tenantId: String!, $input: SSOConfigInput!) {\n saveSSOConfig(tenantId: $tenantId, input: $input) {\n id identifier entityId ssoUrl sloUrl certificate enabled\n }\n }\n`;\n\nexport const DELETE_SSO_CONFIG = `\n mutation deleteSSOConfig($tenantId: String!) {\n deleteSSOConfig(tenantId: $tenantId)\n }\n`;\n\nexport const LIST_USERS = `\n query users($filter: UserFilterInput, $pagination: PaginationInput) {\n users(filter: $filter, pagination: $pagination) {\n users { id email firstName lastName username role status createdAt }\n totalCount hasMore\n }\n }\n`;\n\nexport const GET_USER = `\n query user($id: ID!) {\n user(id: $id) {\n id email firstName lastName username role status emailVerified lastLoginAt\n }\n }\n`;\n\nexport const UPDATE_USER = `\n mutation updateUser($id: ID!, $input: AdminUpdateUserInput!) {\n updateUser(id: $id, input: $input) {\n id email firstName lastName username role status\n }\n }\n`;\n\n// inviteUser removed in BOFF-9212 — the underlying mutation is not defined\n// on any global/wspace subgraph. The `auth_users_invite` MCP tool was\n// deleted from extra-tools.ts.\n","/**\n * SDK-parity auth tools (Phase 2.1) — closes the gap between\n * sdk-libs-node/src/modules/auth/api.ts and the MCP surface.\n *\n * Adds the 4 auth flows that have NO existing MCP equivalent and are\n * meaningful for an AI agent driving the SDK:\n *\n * - auth_sign_up → email/password account registration\n * - auth_sign_in → email/password sign-in (distinct from\n * the device-code `auth_login`)\n * - auth_refresh_token → explicit token refresh (the gql client\n * auto-refreshes; this exposes the\n * mutation for headless/test callers)\n * - auth_get_current_user → SDK `me` query (newer, lighter shape\n * than the `currentUser` query already\n * backing auth_profile_get)\n * - auth_authenticate_app → M2M auth via GraphQL `authenticateApp`\n * mutation; persists token.\n * - auth_login_with_api_key → stash an API key in the auth store so\n * the gql client sends `X-API-Key`\n * - auth_login_with_client_credentials → OAuth2 client_credentials grant\n * (REST against oidcIssuer/token)\n *\n * All token-persisting tools write through `ctx.auth.write()` and\n * `ctx.gql.reset()` so subsequent module calls use the freshly-issued tokens\n * without restarting the MCP server.\n */\n\nimport { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport { clientCredentialsFlow } from '../../core/auth/device-code.js';\nimport * as ops from './operations.js';\n\ninterface AuthPayload {\n user: { id: string; email: string; username: string };\n accessToken: string;\n refreshToken: string;\n expiresIn: number;\n}\n\ninterface AuthCodeExchangeResult {\n accessToken: string;\n tokenType: string;\n expiresIn: number;\n scopes: string[];\n}\n\nfunction err(\n ctx: McpContext,\n name: string,\n message: string,\n error: unknown,\n): ReturnType<typeof errorResult> {\n ctx.logger.error(`${name} failed`, { error });\n return errorResult(`${message}: ${error instanceof Error ? error.message : String(error)}`);\n}\n\nfunction persistOAuthTokens(ctx: McpContext, payload: AuthPayload): void {\n const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n ctx.auth.write({\n ...existing,\n accessToken: payload.accessToken,\n refreshToken: payload.refreshToken,\n expiresAt: Date.now() + payload.expiresIn * 1000,\n authMethod: 'device_code',\n });\n ctx.gql.reset();\n}\n\nexport function registerAuthMoreTools(\n server: McpServer,\n ctx: McpContext,\n track: (n: string) => string,\n): void {\n // ── auth sign_up / sign_in / refresh / sign_out / get_current_user ──────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sign_up')),\n {\n title: 'Sign Up',\n description:\n 'Register a new account via email/username/password and immediately sign in. Persists access + refresh tokens. Returns { user, accessToken, refreshToken, expiresIn }.',\n inputSchema: {\n email: z.string().describe('Email address for the new account'),\n username: z.string().describe('Username (must be unique)'),\n password: z.string().describe('Password (caller is responsible for strength policy)'),\n firstName: z.string().optional().describe('Optional first name'),\n lastName: z.string().optional().describe('Optional last name'),\n },\n },\n async ({ email, username, password, firstName, lastName }) => {\n try {\n const input: Record<string, unknown> = { email, username, password };\n if (firstName !== undefined) input.firstName = firstName;\n if (lastName !== undefined) input.lastName = lastName;\n const d = await ctx.gql.global.request<{ signUp: AuthPayload }>(ops.SIGN_UP, { input });\n persistOAuthTokens(ctx, d.signUp);\n return jsonResult({\n status: 'authenticated',\n user: d.signUp.user,\n accessToken: d.signUp.accessToken,\n refreshToken: d.signUp.refreshToken,\n expiresIn: d.signUp.expiresIn,\n });\n } catch (e) {\n return err(ctx, 'auth_sign_up', 'Sign up failed', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sign_in')),\n {\n title: 'Sign In',\n description:\n 'Sign in with username + password (server-side credential flow, distinct from the device-code `auth_login`). Persists access + refresh tokens. Returns { user, accessToken, refreshToken, expiresIn }.',\n inputSchema: {\n username: z.string().describe('Username or email'),\n password: z.string().describe('Password'),\n },\n },\n async ({ username, password }) => {\n try {\n const d = await ctx.gql.global.request<{ signIn: AuthPayload }>(ops.SIGN_IN, {\n input: { username, password },\n });\n persistOAuthTokens(ctx, d.signIn);\n return jsonResult({\n status: 'authenticated',\n user: d.signIn.user,\n accessToken: d.signIn.accessToken,\n refreshToken: d.signIn.refreshToken,\n expiresIn: d.signIn.expiresIn,\n });\n } catch (e) {\n return err(ctx, 'auth_sign_in', 'Sign in failed', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_refresh_token')),\n {\n title: 'Refresh Token',\n description:\n 'Exchange the stored refreshToken for a fresh access + refresh pair. The gql client auto-refreshes when tokens are near expiry; use this tool only when you need to force a refresh now. Persists new tokens. Returns the new { accessToken, expiresIn }.',\n inputSchema: {},\n },\n async () => {\n try {\n const existing = ctx.auth.read();\n if (!existing?.refreshToken) {\n return errorResult(\n 'No refresh token available. Sign in first via auth_sign_in / auth_sign_up / auth_login.',\n );\n }\n const d = await ctx.gql.global.request<{ refreshToken: AuthPayload }>(\n ops.REFRESH_TOKEN_OP,\n {\n token: existing.refreshToken,\n },\n );\n persistOAuthTokens(ctx, d.refreshToken);\n return jsonResult({\n status: 'refreshed',\n accessToken: d.refreshToken.accessToken,\n expiresIn: d.refreshToken.expiresIn,\n });\n } catch (e) {\n return err(ctx, 'auth_refresh_token', 'Token refresh failed', e);\n }\n },\n );\n\n // ── M2M / headless auth flows ───────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_authenticate_app')),\n {\n title: 'Authenticate App',\n description:\n 'Machine-to-machine auth via the `authenticateApp` GraphQL mutation. Pass an OAuth app client_id + client_secret (and optional scopes) to receive an access token; persists token for subsequent calls. Returns { accessToken, tokenType, expiresIn, scopes }.',\n inputSchema: {\n clientId: z.string().describe('OAuth app clientId'),\n clientSecret: z\n .string()\n .describe('OAuth app clientSecret (shown only once on app creation)'),\n scopes: z\n .array(z.string())\n .optional()\n .describe('Optional list of scope strings to request'),\n },\n },\n async ({ clientId, clientSecret, scopes }) => {\n try {\n const input: Record<string, unknown> = { clientId, clientSecret };\n if (scopes !== undefined) input.scopes = scopes;\n const d = await ctx.gql.global.request<{ authenticateApp: AuthCodeExchangeResult }>(\n ops.AUTHENTICATE_APP,\n { input },\n );\n const result = d.authenticateApp;\n const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n ctx.auth.write({\n ...existing,\n accessToken: result.accessToken,\n refreshToken: '',\n expiresAt: Date.now() + result.expiresIn * 1000,\n authMethod: 'client_credentials',\n clientId,\n clientSecret,\n });\n ctx.gql.reset();\n return jsonResult({\n status: 'authenticated',\n accessToken: result.accessToken,\n tokenType: result.tokenType,\n expiresIn: result.expiresIn,\n scopes: result.scopes,\n });\n } catch (e) {\n return err(ctx, 'auth_authenticate_app', 'App authentication failed', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_login_with_api_key')),\n {\n title: 'Login with API Key',\n description:\n 'Authenticate with a pre-issued API key (headless service mode). The key is stored locally and sent as `X-API-Key` on every gateway request; no network call is made by this tool. Use auth_status to verify. Returns { status: \"authenticated\", method: \"api_key\" }.',\n inputSchema: {\n apiKey: z.string().describe('Pre-issued API key (e.g. from auth_api_keys_create)'),\n },\n },\n async ({ apiKey }) => {\n try {\n const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n ctx.auth.write({\n ...existing,\n apiKey,\n authMethod: 'api_key',\n });\n ctx.gql.reset();\n return jsonResult({\n status: 'authenticated',\n method: 'api_key',\n message: 'API key stored. Subsequent calls will use X-API-Key.',\n });\n } catch (e) {\n return err(ctx, 'auth_login_with_api_key', 'Failed to set API key', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_login_with_client_credentials')),\n {\n title: 'Login with Client Credentials',\n description:\n 'OAuth2 client_credentials grant (REST against oidcIssuer/token). Equivalent to auth_authenticate_app but uses the OIDC token endpoint instead of the GraphQL mutation; prefer auth_authenticate_app inside the platform. Persists the issued token. Returns { accessToken, expiresIn, scopes }.',\n inputSchema: {\n clientId: z.string().describe('OAuth app clientId'),\n clientSecret: z.string().describe('OAuth app clientSecret'),\n scopes: z.array(z.string()).optional().describe('Optional list of scope strings'),\n },\n },\n async ({ clientId, clientSecret, scopes }) => {\n try {\n const cfg = ctx.config.read();\n const result = await clientCredentialsFlow(\n cfg.globalEndpoint,\n clientId,\n clientSecret,\n scopes,\n );\n const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n ctx.auth.write({\n ...existing,\n accessToken: result.accessToken,\n refreshToken: '',\n expiresAt: Date.now() + result.expiresIn * 1000,\n authMethod: 'client_credentials',\n clientId,\n clientSecret,\n });\n ctx.gql.reset();\n return jsonResult({\n status: 'authenticated',\n accessToken: result.accessToken,\n expiresIn: result.expiresIn,\n scopes: result.scopes,\n });\n } catch (e) {\n return err(ctx, 'auth_login_with_client_credentials', 'Client credentials login failed', e);\n }\n },\n );\n}\n","/**\n * Extended auth surface (Phase 2) as MCP tools.\n *\n * Ported from cli-sdk/src/modules/auth/extra-commands.ts. Each `auth <sub>\n * <verb>` CLI command becomes one MCP tool named `<product>_auth_<sub>_<verb>`.\n *\n * Sub-groups (10):\n * profile — get / update\n * sessions — list / revoke\n * mfa — list / enroll / verify / disable\n * api_keys — list / create / revoke / rotate\n * audit_log — query\n * delegations — list / grant / revoke\n * apps — list / get / create / update / deactivate / authorize_url / revoke\n * sso — list / configure / test / delete\n * users — list / get / invite / update\n * security — summary\n *\n * Browser-only flows (register / reset-password / magic-link / oauth-callback)\n * are NOT exposed; for `apps_authorize` we provide `auth_apps_authorize_url`\n * which returns the URL only.\n *\n * All operations live on the global gateway; calling code uses\n * ctx.gql.global.request().\n */\n\nimport { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport * as ops from './operations.js';\n\ninterface UserRow {\n id: string;\n email: string;\n firstName?: string;\n lastName?: string;\n username?: string;\n role?: string;\n status?: string;\n createdAt?: string;\n}\n\nfunction err(\n ctx: McpContext,\n name: string,\n message: string,\n error: unknown,\n): ReturnType<typeof errorResult> {\n ctx.logger.error(`${name} failed`, { error });\n return errorResult(`${message}: ${error instanceof Error ? error.message : String(error)}`);\n}\n\nexport function registerAuthExtraTools(\n server: McpServer,\n ctx: McpContext,\n track: (n: string) => string,\n): void {\n // ── auth profile ────────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_profile_get')),\n {\n title: 'Get Profile',\n description: 'Show the current authenticated user (id, email, name, role, status).',\n inputSchema: {},\n },\n async () => {\n try {\n const d = await ctx.gql.global.request<{ currentUser: Record<string, unknown> }>(\n ops.CURRENT_USER,\n );\n return jsonResult(d.currentUser);\n } catch (e) {\n return err(ctx, 'auth_profile_get', 'Failed to fetch profile', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_profile_update')),\n {\n title: 'Update Profile',\n description: 'Update the current user profile (any subset of fields).',\n inputSchema: {\n firstName: z.string().optional(),\n lastName: z.string().optional(),\n name: z.string().optional(),\n username: z.string().optional(),\n phoneNumber: z.string().optional(),\n timezone: z.string().optional(),\n language: z.string().optional(),\n },\n },\n async (args) => {\n try {\n const input: Record<string, unknown> = {};\n if (args.firstName !== undefined) input.firstName = args.firstName;\n if (args.lastName !== undefined) input.lastName = args.lastName;\n if (args.name !== undefined) input.name = args.name;\n if (args.username !== undefined) input.username = args.username;\n if (args.phoneNumber !== undefined) input.phoneNumber = args.phoneNumber;\n if (args.timezone !== undefined) input.timezone = args.timezone;\n if (args.language !== undefined) input.language = args.language;\n if (Object.keys(input).length === 0) {\n return errorResult('No updates specified — provide at least one field.');\n }\n const d = await ctx.gql.global.request<{\n updateCurrentUserProfile: Record<string, unknown>;\n }>(ops.UPDATE_CURRENT_USER_PROFILE, { input });\n return jsonResult({ status: 'success', user: d.updateCurrentUserProfile });\n } catch (e) {\n return err(ctx, 'auth_profile_update', 'Failed to update profile', e);\n }\n },\n );\n\n // ── auth sessions ───────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sessions_list')),\n {\n title: 'List Active Sessions',\n description: 'List active sessions for the current user (browser/device sessions).',\n inputSchema: {\n limit: z.number().optional().describe('Page size (default 50)'),\n offset: z.number().optional(),\n },\n },\n async ({ limit, offset }) => {\n try {\n const d = await ctx.gql.global.request<{\n activeSessions: Array<Record<string, unknown>>;\n }>(ops.ACTIVE_SESSIONS, {\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({ sessions: d.activeSessions, total: d.activeSessions.length });\n } catch (e) {\n return err(ctx, 'auth_sessions_list', 'Failed to list sessions', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sessions_revoke')),\n {\n title: 'Revoke Session',\n description: 'Revoke (sign out) a single session by id.',\n inputSchema: { sessionId: z.string().describe('Session ID to revoke') },\n },\n async ({ sessionId }) => {\n try {\n await ctx.gql.global.request(ops.REVOKE_SESSION, { sessionId });\n return jsonResult({ status: 'success', message: `Session ${sessionId} revoked.` });\n } catch (e) {\n return err(ctx, 'auth_sessions_revoke', 'Failed to revoke session', e);\n }\n },\n );\n\n // ── auth mfa ────────────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_mfa_list')),\n {\n title: 'List MFA Methods',\n description: 'List MFA methods enrolled for the current user.',\n inputSchema: {\n limit: z.number().optional().describe('Page size (default 50)'),\n offset: z.number().optional(),\n },\n },\n async ({ limit, offset }) => {\n try {\n const d = await ctx.gql.global.request<{\n currentUserMFAMethods: {\n methods: Array<Record<string, unknown>>;\n hasMore: boolean;\n totalCount: number;\n };\n }>(ops.CURRENT_USER_MFA_METHODS, {\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({\n methods: d.currentUserMFAMethods.methods,\n total: d.currentUserMFAMethods.totalCount,\n hasMore: d.currentUserMFAMethods.hasMore,\n });\n } catch (e) {\n return err(ctx, 'auth_mfa_list', 'Failed to list MFA methods', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_mfa_enroll')),\n {\n title: 'Enroll MFA',\n description:\n 'Begin MFA enrollment. Returns the qrCode, secret, and one-time backup codes the user must save BEFORE calling auth_mfa_verify.',\n inputSchema: {\n method: z.enum(['TOTP', 'SMS', 'EMAIL']).describe('MFA method to enroll'),\n },\n },\n async ({ method }) => {\n try {\n const d = await ctx.gql.global.request<{ setupMFA: Record<string, unknown> }>(\n ops.SETUP_MFA,\n { method },\n );\n return jsonResult({\n status: 'enrollment_started',\n enrollment: d.setupMFA,\n message: 'Save your backup codes; verify with auth_mfa_verify.',\n });\n } catch (e) {\n return err(ctx, 'auth_mfa_enroll', 'Failed to enroll MFA', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_mfa_verify')),\n {\n title: 'Verify MFA Enrollment',\n description: 'Verify MFA enrollment by submitting the code from the authenticator.',\n inputSchema: { code: z.string().describe('OTP code from authenticator') },\n },\n async ({ code }) => {\n try {\n await ctx.gql.global.request(ops.ENABLE_MFA, { code });\n return jsonResult({ status: 'success', message: 'MFA enabled.' });\n } catch (e) {\n return err(ctx, 'auth_mfa_verify', 'Failed to verify MFA', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_mfa_disable')),\n {\n title: 'Disable MFA',\n description: 'Disable MFA for the current user.',\n inputSchema: {},\n },\n async () => {\n try {\n await ctx.gql.global.request(ops.DISABLE_MFA);\n return jsonResult({ status: 'success', message: 'MFA disabled.' });\n } catch (e) {\n return err(ctx, 'auth_mfa_disable', 'Failed to disable MFA', e);\n }\n },\n );\n\n // ── auth api keys ───────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_api_keys_list')),\n {\n title: 'List API Keys',\n description: 'List API keys for the current user; pass appId to scope to a specific app.',\n inputSchema: {\n appId: z.string().optional().describe('Restrict to keys owned by an app id'),\n limit: z.number().optional(),\n offset: z.number().optional(),\n },\n },\n async ({ appId, limit, offset }) => {\n try {\n const pagination = { limit: limit ?? 50, offset: offset ?? 0 };\n if (appId) {\n // BOFF-8203: live `AppConnection`/`APIKeyConnection` wrap the list\n // under `apiKeys`. Tool callers still see `{ keys: [...], total: N }`\n // for backwards compat.\n const d = await ctx.gql.global.request<{\n appApiKeys: { apiKeys: Array<Record<string, unknown>> };\n }>(ops.APP_API_KEYS, { appId, pagination });\n return jsonResult({\n keys: d.appApiKeys.apiKeys,\n total: d.appApiKeys.apiKeys.length,\n });\n }\n const d = await ctx.gql.global.request<{\n myApiKeys: { apiKeys: Array<Record<string, unknown>> };\n }>(ops.MY_API_KEYS, { pagination });\n return jsonResult({\n keys: d.myApiKeys.apiKeys,\n total: d.myApiKeys.apiKeys.length,\n });\n } catch (e) {\n return err(ctx, 'auth_api_keys_list', 'Failed to list API keys', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_api_keys_create')),\n {\n title: 'Create API Key',\n description:\n 'Generate a new API key for an app. Returns apiKey + apiSecret — the secret is only shown once.',\n inputSchema: {\n name: z.string().describe('Friendly name for the key'),\n appId: z.string().describe('Owning app id'),\n scopes: z.array(z.string()).optional().describe('Scope strings'),\n expiresAt: z.string().optional().describe('ISO expiry date'),\n },\n },\n async ({ name, appId, scopes, expiresAt }) => {\n try {\n const input: Record<string, unknown> = { name, appId };\n if (scopes !== undefined) input.scope = scopes;\n if (expiresAt !== undefined) input.expiresAt = expiresAt;\n const d = await ctx.gql.global.request<{\n generateAPIKey: { keyId: string; apiKey: string; apiSecret: string };\n }>(ops.GENERATE_API_KEY, { input });\n return jsonResult({\n status: 'success',\n message: 'API key generated. The apiSecret is only shown ONCE — store it now.',\n key: d.generateAPIKey,\n });\n } catch (e) {\n return err(ctx, 'auth_api_keys_create', 'Failed to create API key', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_api_keys_revoke')),\n {\n title: 'Revoke API Key',\n description: 'Revoke an API key by its keyId.',\n inputSchema: { keyId: z.string().describe('Key ID to revoke') },\n },\n async ({ keyId }) => {\n try {\n await ctx.gql.global.request(ops.REVOKE_API_KEY, { keyId });\n return jsonResult({ status: 'success', message: `API key ${keyId} revoked.` });\n } catch (e) {\n return err(ctx, 'auth_api_keys_revoke', 'Failed to revoke API key', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_api_keys_rotate')),\n {\n title: 'Rotate API Key',\n description:\n 'Rotate an API key — invalidates the previous secret and returns a new one (shown only once).',\n inputSchema: { keyId: z.string().describe('Key ID to rotate') },\n },\n async ({ keyId }) => {\n try {\n const d = await ctx.gql.global.request<{ rotateAPIKey: { apiSecret: string } }>(\n ops.ROTATE_API_KEY,\n { keyId },\n );\n return jsonResult({\n status: 'success',\n message: 'API key rotated. Save the new secret — it is only shown once.',\n apiSecret: d.rotateAPIKey.apiSecret,\n });\n } catch (e) {\n return err(ctx, 'auth_api_keys_rotate', 'Failed to rotate API key', e);\n }\n },\n );\n\n // ── auth audit log ──────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_audit_log_query')),\n {\n title: 'Query Auth Audit Log',\n description: 'Recent auth audit events for the current user.',\n inputSchema: {\n limit: z.number().optional().describe('Page size (default 50)'),\n offset: z.number().optional(),\n },\n },\n async ({ limit, offset }) => {\n try {\n const d = await ctx.gql.global.request<{\n authAuditLogs: Array<Record<string, unknown>>;\n }>(ops.AUTH_AUDIT_LOGS, {\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({ events: d.authAuditLogs, total: d.authAuditLogs.length });\n } catch (e) {\n return err(ctx, 'auth_audit_log_query', 'Failed to query audit log', e);\n }\n },\n );\n\n // ── auth delegations ────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_delegations_list')),\n {\n title: 'List Delegations',\n description: 'Delegations granted by/to the current user.',\n inputSchema: {\n limit: z.number().optional().describe('Page size (default 50)'),\n offset: z.number().optional(),\n },\n },\n async ({ limit, offset }) => {\n try {\n const d = await ctx.gql.global.request<{\n currentUserDelegations: {\n delegations: Array<Record<string, unknown>>;\n hasMore: boolean;\n totalCount: number;\n };\n }>(ops.CURRENT_USER_DELEGATIONS, {\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({\n delegations: d.currentUserDelegations.delegations,\n total: d.currentUserDelegations.totalCount,\n hasMore: d.currentUserDelegations.hasMore,\n });\n } catch (e) {\n return err(ctx, 'auth_delegations_list', 'Failed to list delegations', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_delegations_grant')),\n {\n title: 'Grant Delegation',\n description: 'Grant a delegation to an app (consent on behalf of a user).',\n inputSchema: {\n appId: z.string().describe('App id receiving delegation'),\n userId: z.string().describe('User to delegate as'),\n scopes: z.array(z.string()).optional(),\n workspaceIds: z.array(z.string()).optional(),\n expiresAt: z.string().optional().describe('ISO expiry'),\n },\n },\n async ({ appId, userId, scopes, workspaceIds, expiresAt }) => {\n try {\n const input: Record<string, unknown> = { appId, userId };\n if (scopes !== undefined) input.scopes = scopes;\n if (workspaceIds !== undefined) input.workspaceIds = workspaceIds;\n if (expiresAt !== undefined) input.expiresAt = expiresAt;\n const d = await ctx.gql.global.request<{ grantDelegation: Record<string, unknown> }>(\n ops.GRANT_DELEGATION,\n { input },\n );\n return jsonResult({ status: 'success', delegation: d.grantDelegation });\n } catch (e) {\n return err(ctx, 'auth_delegations_grant', 'Failed to grant delegation', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_delegations_revoke')),\n {\n title: 'Revoke Delegation',\n description: 'Revoke a delegation by its id.',\n inputSchema: {\n id: z.string().describe('Delegation ID'),\n reason: z.string().optional(),\n },\n },\n async ({ id, reason }) => {\n try {\n await ctx.gql.global.request(ops.REVOKE_DELEGATION, {\n id,\n ...(reason !== undefined ? { reason } : {}),\n });\n return jsonResult({ status: 'success', message: `Delegation ${id} revoked.` });\n } catch (e) {\n return err(ctx, 'auth_delegations_revoke', 'Failed to revoke delegation', e);\n }\n },\n );\n\n // ── auth apps (OAuth/system) ────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_list')),\n {\n title: 'List Apps',\n description: 'List OAuth/system apps owned by the current user.',\n inputSchema: {\n limit: z.number().optional(),\n offset: z.number().optional(),\n },\n },\n async ({ limit, offset }) => {\n try {\n // BOFF-8203: live `AppConnection` wraps the list under `apps`.\n // Tool callers still see `{ apps: [...], total: N }` for backwards\n // compat (matches the shape they got before the refactor).\n const d = await ctx.gql.global.request<{\n currentUserApps: { apps: Array<Record<string, unknown>> };\n }>(ops.CURRENT_USER_APPS, {\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({\n apps: d.currentUserApps.apps,\n total: d.currentUserApps.apps.length,\n });\n } catch (e) {\n return err(ctx, 'auth_apps_list', 'Failed to list apps', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_get')),\n {\n title: 'Get App',\n description: 'Get a single app by its id.',\n inputSchema: { id: z.string().describe('App ID') },\n },\n async ({ id }) => {\n try {\n const d = await ctx.gql.global.request<{ app: Record<string, unknown> | null }>(\n ops.GET_APP,\n { id },\n );\n if (!d.app) {\n return errorResult(`App ${id} not found.`);\n }\n return jsonResult(d.app);\n } catch (e) {\n return err(ctx, 'auth_apps_get', 'Failed to get app', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_create')),\n {\n title: 'Create App',\n description:\n 'Create an OAuth or system app. Returns the app + clientSecret (shown only once).',\n inputSchema: {\n name: z.string().describe('App name'),\n description: z.string().optional(),\n type: z.enum(['OAUTH', 'SYSTEM']).optional().describe('App type (default OAUTH)'),\n actorType: z\n .enum(['USER', 'APP', 'SERVICE'])\n .optional()\n .describe('Actor type (default APP)'),\n redirectUris: z.array(z.string()).optional().describe('OAuth redirect URIs'),\n scopes: z.array(z.string()).optional(),\n },\n },\n async ({ name, description, type, actorType, redirectUris, scopes }) => {\n try {\n const input: Record<string, unknown> = {\n name,\n type: type ?? 'OAUTH',\n actorType: actorType ?? 'APP',\n };\n if (description !== undefined) input.description = description;\n if (redirectUris !== undefined) input.redirectUris = redirectUris;\n if (scopes !== undefined) input.scopes = scopes;\n const d = await ctx.gql.global.request<{\n createApp: { app: Record<string, unknown>; clientSecret: string };\n }>(ops.CREATE_APP, { input });\n return jsonResult({\n status: 'success',\n message: 'App created. clientSecret only shown once — store it now.',\n app: d.createApp.app,\n clientSecret: d.createApp.clientSecret,\n });\n } catch (e) {\n return err(ctx, 'auth_apps_create', 'Failed to create app', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_update')),\n {\n title: 'Update App',\n description: 'Update an app (name, description, redirect URIs, scopes, status).',\n inputSchema: {\n id: z.string().describe('App ID'),\n name: z.string().optional(),\n description: z.string().optional(),\n redirectUris: z.array(z.string()).optional(),\n scopes: z.array(z.string()).optional(),\n status: z.string().optional().describe('Status (e.g. ACTIVE, INACTIVE)'),\n },\n },\n async ({ id, name, description, redirectUris, scopes, status }) => {\n try {\n const input: Record<string, unknown> = {};\n if (name !== undefined) input.name = name;\n if (description !== undefined) input.description = description;\n if (redirectUris !== undefined) input.redirectUris = redirectUris;\n if (scopes !== undefined) input.scopes = scopes;\n if (status !== undefined) input.status = status.toUpperCase();\n if (Object.keys(input).length === 0) {\n return errorResult('No updates specified — provide at least one field.');\n }\n const d = await ctx.gql.global.request<{ updateApp: Record<string, unknown> }>(\n ops.UPDATE_APP,\n { id, input },\n );\n return jsonResult({ status: 'success', app: d.updateApp });\n } catch (e) {\n return err(ctx, 'auth_apps_update', 'Failed to update app', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_deactivate')),\n {\n title: 'Deactivate App',\n description: 'Deactivate an app by its id (revoke is not currently a separate mutation).',\n inputSchema: { id: z.string().describe('App ID') },\n },\n async ({ id }) => {\n try {\n await ctx.gql.global.request(ops.DEACTIVATE_APP, { id });\n return jsonResult({ status: 'success', message: `App ${id} deactivated.` });\n } catch (e) {\n return err(ctx, 'auth_apps_deactivate', 'Failed to deactivate app', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_authorize_url')),\n {\n title: 'Build OAuth Authorize URL',\n description:\n 'Build the OAuth authorization URL for an app (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.',\n inputSchema: {\n clientId: z.string().describe('OAuth client id'),\n redirectUri: z.string().describe('Redirect URI (must be registered)'),\n scopes: z.array(z.string()).optional(),\n state: z.string().optional().describe('Opaque state value'),\n responseType: z.string().optional().describe('Default \"code\"'),\n },\n },\n async ({ clientId, redirectUri, scopes, state, responseType }) => {\n const cfg = ctx.config.read();\n const issuer =\n ctx.env === 'prod'\n ? (ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace('/graphql', ''))\n : cfg.globalEndpoint.replace('/graphql', '');\n const params = new URLSearchParams({\n client_id: clientId,\n redirect_uri: redirectUri,\n response_type: responseType ?? 'code',\n });\n if (scopes && scopes.length > 0) params.set('scope', scopes.join(' '));\n if (state) params.set('state', state);\n const url = `${issuer.replace(/\\/$/, '')}/oauth/authorize?${params.toString()}`;\n return jsonResult({ url });\n },\n );\n\n // ── auth sso ────────────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sso_get')),\n {\n title: 'Get SSO Config',\n description: 'Get SSO (SAML/OIDC) configuration for a tenant.',\n inputSchema: { tenantId: z.string().describe('Tenant ID') },\n },\n async ({ tenantId }) => {\n try {\n const d = await ctx.gql.global.request<{ getSSOConfig: Record<string, unknown> }>(\n ops.GET_SSO_CONFIG,\n { tenantId },\n );\n return jsonResult(d.getSSOConfig);\n } catch (e) {\n return err(ctx, 'auth_sso_get', 'Failed to get SSO config', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sso_configure')),\n {\n title: 'Configure SSO',\n description: 'Save (upsert) SSO configuration for a tenant.',\n inputSchema: {\n tenantId: z.string().describe('Tenant ID'),\n entityId: z.string().describe('SAML EntityID / OIDC issuer'),\n ssoUrl: z.string().describe('SSO endpoint URL'),\n sloUrl: z.string().optional().describe('SLO endpoint URL'),\n certificate: z.string().optional().describe('X.509 certificate PEM'),\n enabled: z.boolean().optional().describe('Enable after save (default false)'),\n },\n },\n async ({ tenantId, entityId, ssoUrl, sloUrl, certificate, enabled }) => {\n try {\n const input: Record<string, unknown> = {\n entityId,\n ssoUrl,\n enabled: enabled ?? false,\n };\n if (sloUrl !== undefined) input.sloUrl = sloUrl;\n if (certificate !== undefined) input.certificate = certificate;\n const d = await ctx.gql.global.request<{ saveSSOConfig: Record<string, unknown> }>(\n ops.SAVE_SSO_CONFIG,\n { tenantId, input },\n );\n return jsonResult({ status: 'success', config: d.saveSSOConfig });\n } catch (e) {\n return err(ctx, 'auth_sso_configure', 'Failed to save SSO config', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sso_test')),\n {\n title: 'Test SSO',\n description:\n 'Build the SSO test login URL for a tenant. Returns the URL to open in a browser; this tool does not perform any server call.',\n inputSchema: { tenantId: z.string().describe('Tenant ID') },\n },\n async ({ tenantId }) => {\n const cfg = ctx.config.read();\n const issuer =\n ctx.env === 'prod'\n ? (ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace('/graphql', ''))\n : cfg.globalEndpoint.replace('/graphql', '');\n const url = `${issuer.replace(/\\/$/, '')}/sso/${encodeURIComponent(tenantId)}/test`;\n return jsonResult({ url, message: 'Open this URL in a browser to test SSO.' });\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sso_delete')),\n {\n title: 'Delete SSO Config',\n description: 'Delete SSO configuration for a tenant.',\n inputSchema: { tenantId: z.string().describe('Tenant ID') },\n },\n async ({ tenantId }) => {\n try {\n await ctx.gql.global.request(ops.DELETE_SSO_CONFIG, { tenantId });\n return jsonResult({ status: 'success', message: `SSO config for ${tenantId} deleted.` });\n } catch (e) {\n return err(ctx, 'auth_sso_delete', 'Failed to delete SSO config', e);\n }\n },\n );\n\n // ── auth users (admin) ──────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_users_list')),\n {\n title: 'List Users (admin)',\n description: 'List users with optional filters. Requires admin permission.',\n inputSchema: {\n email: z.string().optional(),\n username: z.string().optional(),\n role: z.string().optional(),\n status: z.string().optional(),\n search: z.string().optional(),\n limit: z.number().optional(),\n offset: z.number().optional(),\n },\n },\n async ({ email, username, role, status, search, limit, offset }) => {\n try {\n const filter: Record<string, unknown> = {};\n if (email !== undefined) filter.email = email;\n if (username !== undefined) filter.username = username;\n if (role !== undefined) filter.role = role.toUpperCase();\n if (status !== undefined) filter.status = status.toUpperCase();\n if (search !== undefined) filter.search = search;\n const d = await ctx.gql.global.request<{\n users: { users: UserRow[]; totalCount: number; hasMore: boolean };\n }>(ops.LIST_USERS, {\n filter: Object.keys(filter).length > 0 ? filter : undefined,\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({\n users: d.users.users,\n totalCount: d.users.totalCount,\n hasMore: d.users.hasMore,\n });\n } catch (e) {\n return err(ctx, 'auth_users_list', 'Failed to list users', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_users_get')),\n {\n title: 'Get User (admin)',\n description: 'Get a user by id. Requires admin permission.',\n inputSchema: { id: z.string().describe('User ID') },\n },\n async ({ id }) => {\n try {\n const d = await ctx.gql.global.request<{ user: UserRow | null }>(ops.GET_USER, { id });\n if (!d.user) {\n return errorResult(`User ${id} not found.`);\n }\n return jsonResult(d.user);\n } catch (e) {\n return err(ctx, 'auth_users_get', 'Failed to get user', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_users_update')),\n {\n title: 'Update User (admin)',\n description: 'Update a user (admin). Pass any subset of mutable fields.',\n inputSchema: {\n id: z.string().describe('User ID'),\n firstName: z.string().optional(),\n lastName: z.string().optional(),\n username: z.string().optional(),\n phoneNumber: z.string().optional(),\n role: z.string().optional(),\n status: z.string().optional(),\n emailVerified: z.boolean().optional(),\n },\n },\n async ({ id, firstName, lastName, username, phoneNumber, role, status, emailVerified }) => {\n try {\n const input: Record<string, unknown> = {};\n if (firstName !== undefined) input.firstName = firstName;\n if (lastName !== undefined) input.lastName = lastName;\n if (username !== undefined) input.username = username;\n if (phoneNumber !== undefined) input.phoneNumber = phoneNumber;\n if (role !== undefined) input.role = role.toUpperCase();\n if (status !== undefined) input.status = status.toUpperCase();\n if (emailVerified !== undefined) input.emailVerified = emailVerified;\n if (Object.keys(input).length === 0) {\n return errorResult('No updates specified — provide at least one field.');\n }\n const d = await ctx.gql.global.request<{ updateUser: UserRow }>(ops.UPDATE_USER, {\n id,\n input,\n });\n return jsonResult({ status: 'success', user: d.updateUser });\n } catch (e) {\n return err(ctx, 'auth_users_update', 'Failed to update user', e);\n }\n },\n );\n\n // ── auth security ───────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_security_summary')),\n {\n title: 'Account Security Summary',\n description:\n 'One-shot account security overview: profile, MFA methods, active sessions, recent audit log, API keys, delegations.',\n inputSchema: {\n recentLimit: z\n .number()\n .optional()\n .describe('How many recent audit events / sessions to include (default 10)'),\n },\n },\n async ({ recentLimit }) => {\n const limit = recentLimit ?? 10;\n const pagination = { limit, offset: 0 };\n const summary: Record<string, unknown> = {};\n try {\n const profile = await ctx.gql.global\n .request<{ currentUser: Record<string, unknown> }>(ops.CURRENT_USER)\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.profile = profile;\n\n const mfa = await ctx.gql.global\n .request<{\n currentUserMFAMethods: Array<Record<string, unknown>>;\n }>(ops.CURRENT_USER_MFA_METHODS, { pagination })\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.mfa = mfa;\n\n const sessions = await ctx.gql.global\n .request<{ activeSessions: Array<Record<string, unknown>> }>(ops.ACTIVE_SESSIONS, {\n pagination,\n })\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.sessions = sessions;\n\n const audit = await ctx.gql.global\n .request<{ authAuditLogs: Array<Record<string, unknown>> }>(ops.AUTH_AUDIT_LOGS, {\n pagination,\n })\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.auditLog = audit;\n\n const keys = await ctx.gql.global\n .request<{ myApiKeys: Array<Record<string, unknown>> }>(ops.MY_API_KEYS, {\n pagination,\n })\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.apiKeys = keys;\n\n const delegations = await ctx.gql.global\n .request<{\n currentUserDelegations: Array<Record<string, unknown>>;\n }>(ops.CURRENT_USER_DELEGATIONS, { pagination })\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.delegations = delegations;\n\n return jsonResult(summary);\n } catch (e) {\n return err(ctx, 'auth_security_summary', 'Failed to build security summary', e);\n }\n },\n );\n\n // ── auth register / oauth (browser-only URL helpers) ────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_register_get_url')),\n {\n title: 'Build Registration URL',\n description:\n 'Build the registration URL (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.',\n inputSchema: {\n email: z.string().optional().describe('Pre-fill the email field'),\n },\n },\n async ({ email }) => {\n const cfg = ctx.config.read();\n const issuer =\n ctx.env === 'prod'\n ? (ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace('/graphql', ''))\n : cfg.globalEndpoint.replace('/graphql', '');\n const params = new URLSearchParams();\n if (email) params.set('email', email);\n const qs = params.toString();\n const url = `${issuer.replace(/\\/$/, '')}/register${qs ? `?${qs}` : ''}`;\n return jsonResult({ url });\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_reset_password_get_url')),\n {\n title: 'Build Password Reset URL',\n description:\n 'Build the password reset URL (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.',\n inputSchema: {\n email: z.string().optional().describe('Pre-fill the email field'),\n },\n },\n async ({ email }) => {\n const cfg = ctx.config.read();\n const issuer =\n ctx.env === 'prod'\n ? (ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace('/graphql', ''))\n : cfg.globalEndpoint.replace('/graphql', '');\n const params = new URLSearchParams();\n if (email) params.set('email', email);\n const qs = params.toString();\n const url = `${issuer.replace(/\\/$/, '')}/reset-password${qs ? `?${qs}` : ''}`;\n return jsonResult({ url });\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_magic_link_get_url')),\n {\n title: 'Build Magic-Link URL',\n description:\n 'Build the magic-link login URL (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.',\n inputSchema: {\n email: z.string().describe('Email to send the magic link to'),\n },\n },\n async ({ email }) => {\n const cfg = ctx.config.read();\n const issuer =\n ctx.env === 'prod'\n ? (ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace('/graphql', ''))\n : cfg.globalEndpoint.replace('/graphql', '');\n const params = new URLSearchParams({ email });\n const url = `${issuer.replace(/\\/$/, '')}/magic-link?${params.toString()}`;\n return jsonResult({ url });\n },\n );\n}\n","/**\n * Auth module — login flow + workspace selection + status + logout.\n *\n * Phase 1 ships the SUBSET that exists in vibecontrols-mcp@main:\n * <product>_auth_{login,complete,select_workspace,workspaces,status,logout}\n *\n * Phase 2 finishes the full auth surface (mfa, api-keys, audit-log,\n * delegations, apps, sso, users, profile, sessions).\n *\n * Phase 2.1 closes the SDK-parity gap (more-tools.ts):\n * sign_up, sign_in, refresh_token, get_current_user, authenticate_app,\n * login_with_api_key, login_with_client_credentials.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerAuthTools } from './tools.js';\nimport { registerAuthMoreTools } from './more-tools.js';\nimport { registerAuthExtraTools } from './extra-tools.js';\n\nconst authModule: McpModule = {\n id: 'auth',\n version: '0.0.1',\n displayName: 'Authentication',\n capabilities: { tools: {} },\n\n register(server: McpServer, ctx: McpContext): ModuleRegistration {\n const tools: string[] = [];\n const track = (n: string): string => {\n tools.push(n);\n return n;\n };\n\n registerAuthTools(server, ctx, track);\n registerAuthMoreTools(server, ctx, track);\n // BOFF-8203 follow-up: the Phase-2 auth extra surface (api-keys,\n // apps, delegations, MFA, audit-log) was deferred in this module's\n // Phase-1 wiring. Mounting it now so the connection-shape fixes\n // (`myApiKeys.apiKeys`, `appApiKeys.apiKeys`, `currentUserApps.apps`)\n // actually take effect on alpha.\n registerAuthExtraTools(server, ctx, track);\n\n return { tools, resources: [], prompts: [] };\n },\n};\n\nexport default authModule;\nexport { getAuth, type AuthHelper, type WorkspaceInfo } from './legacy-auth.js';\n"]}
1
+ {"version":3,"sources":["../../../src/core/auth/device-code.ts","../../../src/modules/auth/legacy-auth.ts","../../../src/core/errors.ts","../../../src/core/tool-name.ts","../../../src/core/result.ts","../../../src/modules/auth/tools.ts","../../../src/modules/auth/operations.ts","../../../src/modules/auth/more-tools.ts","../../../src/modules/auth/extra-tools.ts","../../../src/modules/auth/index.ts"],"names":["fetch","z","err","d"],"mappings":";;;;;;;;;;;;;;;AAgIA,eAAsB,qBAAA,CACpB,cAAA,EACA,QAAA,EACA,YAAA,EACA,MAAA,EACkC;AAClC,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AAQd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,cAAA,EAAgB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACnB,KAAA;AAAA,MACA,WAAW,EAAE,KAAA,EAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO;AAAE,KACxD;AAAA,GACF,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAKlC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,2BAAA,EAA8B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EAC5F;AACA,EAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,eAAA,EAAiB,WAAA,EAAa;AAC5C,IAAA,MAAM,IAAI,MAAM,qDAAqD,CAAA;AAAA,EACvE;AAEA,EAAA,OAAO,KAAK,IAAA,CAAK,eAAA;AACnB;AAEA,eAAsB,mBAAA,CACpB,iBAAA,EACA,SAAA,EACA,WAAA,EACA,cAAA,EACiE;AACjE,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AASd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,iBAAA,EAAmB;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,SAAS,EAAE,cAAA,EAAgB,oBAAoB,aAAA,EAAe,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,EAAG;AAAA,IACpF,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAA,EAAW,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,cAAA,EAAe,IAAK;AAAA,GACtF,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAalC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EACzF;AAEA,EAAA,MAAM,MAAA,GAAS,KAAK,IAAA,EAAM,mBAAA;AAC1B,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAA,IAAW,CAAC,OAAO,KAAA,EAAO;AACrC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,QAAQ,KAAA,EAAO,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EACxF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW,MAAA,CAAO,SAAA,IAAa,EAAA,EAAI,MAAA,EAAQ,MAAA,CAAO,MAAA,IAAU,EAAC,EAAE;AAC/F;AAEA,eAAsB,eAAA,CACpB,gBACA,SAAA,EAGA;AACA,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AAQd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,cAAA,EAAgB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,SAAS,EAAE,cAAA,EAAgB,oBAAoB,aAAA,EAAe,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,EAAG;AAAA,IACpF,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,EAAE,KAAA,EAAO,EAAA,EAAG,EAAG;AAAA,GACzD,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAelC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,4BAAA,EAA+B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EAC7F;AAEA,EAAA,OAAO,IAAA,CAAK,IAAA,EAAM,YAAA,EAAc,KAAA,IAAS,EAAC;AAC5C;;;AC9LA,IAAM,OAAA,uBAAc,OAAA,EAAgC;AAE7C,SAAS,QAAQ,GAAA,EAA6B;AACnD,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC9B,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,MAAM,MAAA,GAAS,iBAAiB,GAAG,CAAA;AACnC,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,MAAM,CAAA;AACvB,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,iBAAiB,GAAA,EAA6B;AACrD,EAAA,IAAI,OAAA,GAAoC,IAAA;AACxC,EAAA,IAAI,eAAA,GAAuC,IAAA;AAC3C,EAAA,IAAI,iBAAA,GAA0C,IAAA;AAE9C,EAAA,SAAS,MAAA,GAAe;AACtB,IAAA,eAAA,IAAkB;AAAA,EACpB;AAEA,EAAA,eAAe,UAAA,GAAwC;AACrD,IAAA,MAAM,EAAE,UAAA,EAAY,QAAA,EAAS,GAAI,GAAA,CAAI,OAAO,WAAA,EAAY;AACxD,IAAA,MAAM,aAAA,GAAgB,GAAG,UAAU,CAAA,iBAAA,CAAA;AACnC,IAAA,MAAM,QAAA,GAAW,GAAG,UAAU,CAAA,mBAAA,CAAA;AAE9B,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MAC1C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACR,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,IAC5E;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,MAAM,UAAA,GAAa,KAAK,aAAa,CAAA;AACrC,IAAA,MAAM,QAAA,GAAW,KAAK,WAAW,CAAA;AACjC,IAAA,MAAM,eAAA,GAAkB,KAAK,kBAAkB,CAAA;AAC/C,IAAA,MAAM,uBAAA,GAA2B,IAAA,CAAK,2BAA2B,CAAA,IAAgB,IAAA;AACjF,IAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,GAAA;AACpD,IAAA,MAAM,QAAA,GAAY,IAAA,CAAK,UAAU,CAAA,IAAgB,CAAA;AAEjD,IAAA,OAAA,GAAU;AAAA,MACR,UAAA;AAAA,MACA,QAAA;AAAA,MACA,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,MACpC,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,oBAAA;AAAA,MACR,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,QAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAA,EAAS,QAAQ,uBAAA,IAA2B,eAAe,iCAAiC,QAAQ,CAAA,YAAA,EAAe,IAAI,WAAW,CAAA,wCAAA;AAAA,KACpI;AAAA,EACF;AAEA,EAAA,eAAe,aAAA,GAA8C;AAC3D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4BAAA,EAA+B,IAAI,WAAW,CAAA,gDAAA;AAAA,OAChD;AAAA,IACF;AAEA,IAAA,MAAM,CAAA,GAAI,OAAA;AACV,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,CAAA,CAAE,SAAA,EAAW;AAC7B,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,oCAAA;AAAA,OAC3D;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,CAAE,QAAA,EAAU;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,CAAA,CAAE,UAAA;AAAA,QACf,WAAW,CAAA,CAAE;AAAA,OACd,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAElC,IAAA,IAAI,QAAA,CAAS,EAAA,IAAM,IAAA,CAAK,cAAc,CAAA,EAAG;AACvC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,IAAA;AACpD,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACpE,MAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,QACb,GAAG,IAAA;AAAA,QACH,WAAA,EAAa,KAAK,cAAc,CAAA;AAAA,QAChC,YAAA,EAAe,IAAA,CAAK,eAAe,CAAA,IAAgB,EAAA;AAAA,QACnD,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QACpC,UAAA,EAAY;AAAA,OACb,CAAA;AACD,MAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,MAAA,OAAO,MAAM,eAAA,EAAgB;AAAA,IAC/B;AAEA,IAAA,MAAM,SAAA,GAAY,KAAK,OAAO,CAAA;AAC9B,IAAA,IAAI,cAAc,uBAAA,EAAyB;AACzC,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,0CAAA,EAA6C,CAAA,CAAE,uBAAA,IAA2B,CAAA,CAAE,eAAe,CAAA,iBAAA,EAAoB,CAAA,CAAE,QAAQ,CAAA,YAAA,EAAe,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAClK;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,WAAA,EAAa;AACpC,MAAA,CAAA,CAAE,QAAA,IAAY,CAAA;AACd,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,kEAAA,EAAqE,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAC/F;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,kBAAA;AAAA,OAC3D;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,mBAAA,EAAuB,IAAA,CAAK,mBAAmB,CAAA,IAAgB,aAAa,SAAS,CAAA;AAAA,OACvF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,eAAA,GAAgD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAa,MAAM,cAAA,EAAe;AACxC,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAA,EAAO;AACP,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,oDAAoD,CAAA;AACpE,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,0DAAA,EAAwD,GAAA,CAAI,WAAW,CAAA,6CAAA;AAAA,SAClF;AAAA,MACF;AACA,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAM,EAAA,GAAK,WAAW,CAAC,CAAA;AACvB,QAAA,IAAI,CAAC,EAAA;AACH,UAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AACtF,QAAA,MAAM,2BAAA,CAA4B,EAAA,CAAG,EAAA,EAAI,EAAA,CAAG,cAAc,CAAA;AAC1D,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,8BAAA,EAAgC;AAAA,UAC9C,aAAa,EAAA,CAAG,EAAA;AAAA,UAChB,eAAe,EAAA,CAAG;AAAA,SACnB,CAAA;AACD,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,sCAAA,EAAyC,EAAA,CAAG,IAAI,CAAA,yBAAA;AAAA,SAC3D;AAAA,MACF;AACA,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,0DAA0D,CAAA;AAC1E,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,8BAAA;AAAA,QACR,SAAS,CAAA,2BAAA,EAA8B,UAAA,CAAW,MAAM,CAAA,kCAAA,EAAgC,IAAI,WAAW,CAAA,qCAAA,CAAA;AAAA,QACvG;AAAA,OACF;AAAA,IACF,SAAS,OAAA,EAAS;AAChB,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,wCAAA,EAA0C;AAAA,QACxD,OAAO,OAAA,YAAmB,KAAA,GAAQ,OAAA,CAAQ,OAAA,GAAU,OAAO,OAAO;AAAA,OACnE,CAAA;AACD,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,eAAA;AAAA,QACR,OAAA,EAAS,0DAA0D,OAAA,YAAmB,KAAA,GAAQ,QAAQ,OAAA,GAAU,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,OACjI;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,cAAA,GAA2C;AACxD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,OAAO,gBAAgB,GAAA,CAAI,MAAA,CAAO,MAAK,CAAE,cAAA,EAAgB,KAAK,WAAW,CAAA;AAAA,EAC3E;AAEA,EAAA,eAAe,2BAAA,CACb,aACA,cAAA,EACe;AACf,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,oBAAoB,CAAA;AAC5D,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK,CAAE,iBAAA;AAAA,MAClB,IAAA,CAAK,WAAA;AAAA,MACL,WAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,MACb,GAAG,IAAA;AAAA,MACH,gBAAgB,MAAA,CAAO,KAAA;AAAA,MACvB,yBAAyB,IAAI,IAAA,CAAK,MAAA,CAAO,SAAS,EAAE,OAAA,EAAQ;AAAA,MAC5D,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AAAA,EACT;AAEA,EAAA,eAAe,eAAA,CAAgB,aAAqB,cAAA,EAAuC;AACzF,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,MAAM,2BAAA,CAA4B,aAAa,cAAc,CAAA;AAC7D,IAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,oBAAA,EAAsB,EAAE,aAAa,CAAA;AAAA,EACvD;AAEA,EAAA,eAAe,mBAAA,GAAqC;AAClD,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,MAAM,iBAAA;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,WAAW,YAA2B;AAC1C,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,MAAA,IAAI,MAAM,MAAA,EAAQ;AAClB,MAAA,IAAI,CAAC,MAAM,WAAA,EAAa;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,wBAAA,EAA2B,GAAA,CAAI,WAAW,CAAA,0CAAA,EAA6C,IAAI,WAAW,CAAA,gDAAA;AAAA,SACxG;AAAA,MACF;AAAA,IAKF,CAAA;AACA,IAAA,iBAAA,GAAoB,QAAA,EAAS,CAAE,OAAA,CAAQ,MAAM;AAC3C,MAAA,iBAAA,GAAoB,IAAA;AAAA,IACtB,CAAC,CAAA;AACD,IAAA,MAAM,iBAAA;AAAA,EACR;AAEA,EAAA,SAAS,SAAA,GASN;AACD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,MACrB,aAAA,EAAe,CAAC,EAAE,IAAA,EAAM,eAAe,IAAA,EAAM,MAAA,CAAA;AAAA,MAC7C,QAAQ,IAAA,EAAM,MAAA,GAAS,SAAA,GAAY,IAAA,EAAM,cAAc,aAAA,GAAgB,MAAA;AAAA,MACvE,SAAA,EAAW,MAAM,SAAA,GAAY,IAAI,KAAK,IAAA,CAAK,SAAS,CAAA,CAAE,WAAA,EAAY,GAAI,IAAA;AAAA,MACtE,WAAA,EAAa,MAAM,WAAA,IAAe,IAAA;AAAA,MAClC,cAAA,EAAgB,MAAM,cAAA,IAAkB,IAAA;AAAA,MACxC,uBAAA,EAAyB,MAAM,uBAAA,GAC3B,IAAI,KAAK,IAAA,CAAK,uBAAuB,CAAA,CAAE,WAAA,EAAY,GACnD,IAAA;AAAA,MACJ,iBAAA,EAAmB,CAAC,CAAC,IAAA,EAAM,cAAA;AAAA,MAC3B,eAAA,EAAiB,CAAC,CAAC;AAAA,KACpB,CAAA;AAAA,EACH;AAEA,EAAA,eAAe,MAAA,GAAwB;AACrC,IAAA,OAAA,GAAU,IAAA;AACV,IAAA,GAAA,CAAI,KAAK,KAAA,EAAM;AACf,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AACP,IAAA,GAAA,CAAI,MAAA,CAAO,KAAK,sCAAsC,CAAA;AAAA,EACxD;AAEA,EAAA,SAAS,UAAA,GAAqC;AAC5C,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,IAAI,IAAA,EAAM,MAAA,EAAQ,OAAA,CAAQ,WAAW,IAAI,IAAA,CAAK,MAAA;AAC9C,IAAA,IAAI,MAAM,WAAA,EAAa,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,WAAW,CAAA,CAAA;AAC5E,IAAA,IAAI,IAAA,EAAM,cAAA;AACR,MAAA,OAAA,CAAQ,2BAA2B,CAAA,GAAI,CAAA,OAAA,EAAU,IAAA,CAAK,cAAc,CAAA,CAAA;AACtE,IAAA,IAAI,IAAA,EAAM,cAAA,EAAgB,OAAA,CAAQ,UAAU,IAAI,IAAA,CAAK,cAAA;AACrD,IAAA,IAAI,IAAA,EAAM,WAAA,EAAa,OAAA,CAAQ,gBAAgB,IAAI,IAAA,CAAK,WAAA;AACxD,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,SAAS,UAAA,GAAsB;AAC7B,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,WAAA,IAAe,IAAA,EAAM,MAAA,CAAA;AAAA,EACvC;AAEA,EAAA,SAAS,mBAAmB,EAAA,EAAsB;AAChD,IAAA,eAAA,GAAkB,EAAA;AAAA,EACpB;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,mBAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACpWO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjB,KAAA;AAAA,EAEzB,WAAA,CAAY,SAAiB,KAAA,EAAiB;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF,CAAA;;;AC1BA,IAAM,oBAAA,GAAuB,EAAA;AAE7B,SAAS,cAAA,CAAe,MAAc,IAAA,EAA8C;AAClF,EAAA,IAAuB,IAAA,CAAK,MAAA,GAAS,oBAAA,EAAsB;AACzD,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,CAAA,WAAA,EAAc,IAAI,CAAA,UAAA,EAAa,oBAAoB,CAAA,8CAAA;AAAA,KACrD;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,WAAA,CAAY,gBAAwB,KAAA,EAAyB;AAC3E,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,iBAAiB,sCAAsC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,WAAA,EAAa,GAAG,KAAK,EAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC7D,EAAA,OAAO,cAAA,CAAe,IAAY,CAAA;AACpC;;;ACOO,SAAS,UAAA,CAAW,MAAe,UAAA,EAAkD;AAC1F,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG;AAAA,GACjE;AAIA,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,WAAA,CAAY,SAAiB,IAAA,EAA2B;AACtE,EAAA,MAAM,IAAA,GAAO,IAAA,GAAO,CAAA,EAAG,OAAO;;AAAA,MAAA,EAAa,IAAI,CAAA,CAAA,GAAK,OAAA;AACpD,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AAC5D;;;AC3DO,SAAS,iBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,YAAY,CAAC,CAAA;AAAA,IAChD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EACE,oNAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,UAAA,EAAW;AACrC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,OAAO,CAAA;AAC5D,QAAA,OAAO,WAAA;AAAA,UACL,iBAAiB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACzE;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,eAAe,CAAC,CAAA;AAAA,IACnD;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EACE,kQAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,EAAc;AACxC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,mCAAA,EAAqC,EAAE,OAAO,CAAA;AAC/D,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EACE,2GAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,WAAA,EAAaC,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wBAAwB,CAAA;AAAA,QACzD,cAAA,EAAgBA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mCAAmC;AAAA;AACzE,KACF;AAAA,IACA,OAAO,EAAE,WAAA,EAAa,cAAA,EAAe,KAAM;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,IAAA,CAAK,eAAA,CAAgB,WAAA,EAAa,cAAc,CAAA;AACtD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,oBAAA;AAAA,UACR,WAAA;AAAA,UACA,OAAA,EAAS,aAAa,WAAW,CAAA,2BAAA;AAAA,SAClC,CAAA;AAAA,MACH,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,2CAAA,EAA6C,EAAE,OAAO,CAAA;AACvE,QAAA,OAAO,WAAA;AAAA,UACL,+BAA+B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,iBAAA;AAAA,MACP,WAAA,EAAa,0DAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,cAAA,EAAe;AAC7C,QAAA,OAAO,WAAW,EAAE,UAAA,EAAY,KAAA,EAAO,UAAA,CAAW,QAAQ,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,qCAAA,EAAuC,EAAE,OAAO,CAAA;AACjE,QAAA,OAAO,WAAA;AAAA,UACL,8BAA8B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACtF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,aAAa,CAAC,CAAA;AAAA,IACjD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EACE,iHAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,SAAA,EAAU;AACpC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,EAAE,OAAO,CAAA;AAC7D,QAAA,OAAO,WAAA;AAAA,UACL,8BAA8B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACtF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,aAAa,CAAC,CAAA;AAAA,IACjD;AAAA,MACE,KAAA,EAAO,QAAA;AAAA,MACP,WAAA,EAAa,qDAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,KAAK,MAAA,EAAO;AAClB,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,YAAA;AAAA,UACR,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,EAAE,OAAO,CAAA;AAC7D,QAAA,OAAO,WAAA;AAAA,UACL,kBAAkB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC1E;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;;;ACxIO,IAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhB,IAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBzB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWzB,IAAM,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASrB,IAAM,2BAAA,GAA8B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASpC,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAYxB,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASxB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA,CAAA;AAMvB,IAAM,wBAAA,GAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASjC,IAAM,SAAA,GAAY;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAgBlB,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA,CAAA;AAMnB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA,CAAA;AASpB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQpB,IAAM,YAAA,GAAe;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQrB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAgBzB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA,CAAA;AAMvB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQvB,IAAM,wBAAA,GAA2B;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAajC,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQzB,IAAM,iBAAA,GAAoB;AAAA;AAAA;AAAA;AAAA,CAAA;AAU1B,IAAM,iBAAA,GAAoB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQ1B,IAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQhB,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASnB,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQnB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA,CAAA;AAMvB,IAAM,cAAA,GAAiB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQvB,IAAM,eAAA,GAAkB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQxB,IAAM,iBAAA,GAAoB;AAAA;AAAA;AAAA;AAAA,CAAA;AAM1B,IAAM,UAAA,GAAa;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AASnB,IAAM,QAAA,GAAW;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAQjB,IAAM,WAAA,GAAc;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;;;AC/P3B,SAAS,GAAA,CACP,GAAA,EACA,IAAA,EACA,OAAA,EACA,KAAA,EACgC;AAChC,EAAA,GAAA,CAAI,OAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,OAAA,CAAA,EAAW,EAAE,OAAO,CAAA;AAC5C,EAAA,OAAO,WAAA,CAAY,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAC5F;AAEA,SAAS,kBAAA,CAAmB,KAAiB,OAAA,EAA4B;AACvE,EAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,EAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,IACb,GAAG,QAAA;AAAA,IACH,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,cAAc,OAAA,CAAQ,YAAA;AAAA,IACtB,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,QAAQ,SAAA,GAAY,GAAA;AAAA,IAC5C,UAAA,EAAY;AAAA,GACb,CAAA;AACD,EAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AAChB;AAEO,SAAS,qBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AAGN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAClD;AAAA,MACE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA,EACE,uKAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mCAAmC,CAAA;AAAA,QAC9D,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B,CAAA;AAAA,QACzD,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sDAAsD,CAAA;AAAA,QACpF,WAAWA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qBAAqB,CAAA;AAAA,QAC/D,UAAUA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oBAAoB;AAAA;AAC/D,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,UAAU,QAAA,EAAU,SAAA,EAAW,UAAS,KAAM;AAC5D,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAS;AACnE,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC/C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAAqC,OAAA,EAAS,EAAE,KAAA,EAAO,CAAA;AACtF,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,MAAM,CAAA;AAChC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,IAAA,EAAM,EAAE,MAAA,CAAO,IAAA;AAAA,UACf,WAAA,EAAa,EAAE,MAAA,CAAO,WAAA;AAAA,UACtB,YAAA,EAAc,EAAE,MAAA,CAAO,YAAA;AAAA,UACvB,SAAA,EAAW,EAAE,MAAA,CAAO;AAAA,SACrB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,cAAA,EAAgB,gBAAA,EAAkB,CAAC,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAClD;AAAA,MACE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA,EACE,uMAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mBAAmB,CAAA;AAAA,QACjD,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,UAAU;AAAA;AAC1C,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAS,KAAM;AAChC,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAAqC,OAAA,EAAS;AAAA,UAC3E,KAAA,EAAO,EAAE,QAAA,EAAU,QAAA;AAAS,SAC7B,CAAA;AACD,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,MAAM,CAAA;AAChC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,IAAA,EAAM,EAAE,MAAA,CAAO,IAAA;AAAA,UACf,WAAA,EAAa,EAAE,MAAA,CAAO,WAAA;AAAA,UACtB,YAAA,EAAc,EAAE,MAAA,CAAO,YAAA;AAAA,UACvB,SAAA,EAAW,EAAE,MAAA,CAAO;AAAA,SACrB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,cAAA,EAAgB,gBAAA,EAAkB,CAAC,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,eAAA;AAAA,MACP,WAAA,EACE,0PAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC/B,QAAA,IAAI,CAAC,UAAU,YAAA,EAAc;AAC3B,UAAA,OAAO,WAAA;AAAA,YACL;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,gBAAA;AAAA,UACJ;AAAA,YACE,OAAO,QAAA,CAAS;AAAA;AAClB,SACF;AACA,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,YAAY,CAAA;AACtC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,WAAA;AAAA,UACR,WAAA,EAAa,EAAE,YAAA,CAAa,WAAA;AAAA,UAC5B,SAAA,EAAW,EAAE,YAAA,CAAa;AAAA,SAC3B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,oBAAA,EAAsB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MACjE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EACE,+PAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,YAAA,EAAcA,KAAAA,CACX,MAAA,EAAO,CACP,SAAS,0DAA0D,CAAA;AAAA,QACtE,MAAA,EAAQA,KAAAA,CACL,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAChB,QAAA,EAAS,CACT,QAAA,CAAS,2CAA2C;AAAA;AACzD,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,QAAA,EAAU,YAAA,EAAa;AAChE,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,gBAAA;AAAA,UACJ,EAAE,KAAA;AAAM,SACV;AACA,QAAA,MAAM,SAAS,CAAA,CAAE,eAAA;AACjB,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,YAAA,EAAc,EAAA;AAAA,UACd,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,SAAA,GAAY,GAAA;AAAA,UAC3C,UAAA,EAAY,oBAAA;AAAA,UACZ,QAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,QAAQ,MAAA,CAAO;AAAA,SAChB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,uBAAA,EAAyB,2BAAA,EAA6B,CAAC,CAAA;AAAA,MACzE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,oBAAA;AAAA,MACP,WAAA,EACE,sQAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qDAAqD;AAAA;AACnF,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAO,KAAM;AACpB,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,MAAA;AAAA,UACA,UAAA,EAAY;AAAA,SACb,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,MAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,yBAAA,EAA2B,uBAAA,EAAyB,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oCAAoC,CAAC,CAAA;AAAA,IACxE;AAAA,MACE,KAAA,EAAO,+BAAA;AAAA,MACP,WAAA,EACE,iSAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,YAAA,EAAcA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC1D,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,gCAAgC;AAAA;AAClF,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,QAAA,MAAM,SAAS,MAAM,qBAAA;AAAA,UACnB,GAAA,CAAI,cAAA;AAAA,UACJ,QAAA;AAAA,UACA,YAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,YAAA,EAAc,EAAA;AAAA,UACd,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,SAAA,GAAY,GAAA;AAAA,UAC3C,UAAA,EAAY,oBAAA;AAAA,UACZ,QAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,QAAQ,MAAA,CAAO;AAAA,SAChB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,oCAAA,EAAsC,iCAAA,EAAmC,CAAC,CAAA;AAAA,MAC5F;AAAA,IACF;AAAA,GACF;AACF;AClQA,SAASC,IAAAA,CACP,GAAA,EACA,IAAA,EACA,OAAA,EACA,KAAA,EACgC;AAChC,EAAA,GAAA,CAAI,OAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,OAAA,CAAA,EAAW,EAAE,OAAO,CAAA;AAC5C,EAAA,OAAO,WAAA,CAAY,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAC5F;AAEO,SAAS,sBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AAGN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,kBAAkB,CAAC,CAAA;AAAA,IACtD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,sEAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB;AAAA,SACN;AACA,QAAA,OAAO,UAAA,CAAW,EAAE,WAAW,CAAA;AAAA,MACjC,SAAS,CAAA,EAAG;AACV,QAAA,OAAOA,IAAAA,CAAI,GAAA,EAAK,kBAAA,EAAoB,yBAAA,EAA2B,CAAC,CAAA;AAAA,MAClE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,qBAAqB,CAAC,CAAA;AAAA,IACzD;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EAAa,yDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,SAAA,EAAWD,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC/B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC1B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QACjC,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAChC,KACF;AAAA,IACA,OAAO,IAAA,KAAS;AACd,MAAA,IAAI;AACF,QAAA,MAAM,QAAiC,EAAC;AACxC,QAAA,IAAI,IAAA,CAAK,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,YAAY,IAAA,CAAK,SAAA;AACzD,QAAA,IAAI,IAAA,CAAK,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,WAAW,IAAA,CAAK,QAAA;AACvD,QAAA,IAAI,IAAA,CAAK,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,OAAO,IAAA,CAAK,IAAA;AAC/C,QAAA,IAAI,IAAA,CAAK,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,WAAW,IAAA,CAAK,QAAA;AACvD,QAAA,IAAI,IAAA,CAAK,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,cAAc,IAAA,CAAK,WAAA;AAC7D,QAAA,IAAI,IAAA,CAAK,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,WAAW,IAAA,CAAK,QAAA;AACvD,QAAA,IAAI,IAAA,CAAK,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,WAAW,IAAA,CAAK,QAAA;AACvD,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,WAAW,CAAA,EAAG;AACnC,UAAA,OAAO,YAAY,yDAAoD,CAAA;AAAA,QACzE;AACA,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAExB,2BAAA,EAA6B,EAAE,KAAA,EAAO,CAAA;AAC7C,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,WAAW,IAAA,EAAM,CAAA,CAAE,0BAA0B,CAAA;AAAA,MAC3E,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,qBAAA,EAAuB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACtE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,sBAAA;AAAA,MACP,WAAA,EAAa,sEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC9D,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAO,KAAM;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAMxB,eAAA,EAAiB;AAAA,UACtB,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,QAAA,EAAU,EAAE,cAAA,CAAe,QAAA;AAAA,UAC3B,KAAA,EAAO,EAAE,cAAA,CAAe,UAAA;AAAA,UACxB,OAAA,EAAS,EAAE,cAAA,CAAe;AAAA,SAC3B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,oBAAA,EAAsB,yBAAA,EAA2B,CAAC,CAAA;AAAA,MACpE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EAAa,2CAAA;AAAA,MACb,WAAA,EAAa,EAAE,SAAA,EAAWD,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,sBAAsB,CAAA;AAAE,KACxE;AAAA,IACA,OAAO,EAAE,SAAA,EAAU,KAAM;AACvB,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAY,cAAA,EAAgB,EAAE,WAAW,CAAA;AAC9D,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,QAAA,EAAW,SAAS,aAAa,CAAA;AAAA,MACnF,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,eAAe,CAAC,CAAA;AAAA,IACnD;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,iDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC9D,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAO,KAAM;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAMxB,wBAAA,EAA0B;AAAA,UAC/B,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,OAAA,EAAS,EAAE,qBAAA,CAAsB,OAAA;AAAA,UACjC,KAAA,EAAO,EAAE,qBAAA,CAAsB,UAAA;AAAA,UAC/B,OAAA,EAAS,EAAE,qBAAA,CAAsB;AAAA,SAClC,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,eAAA,EAAiB,4BAAA,EAA8B,CAAC,CAAA;AAAA,MAClE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,YAAA;AAAA,MACP,WAAA,EACE,gIAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQD,KAAAA,CAAE,IAAA,CAAK,CAAC,MAAA,EAAQ,OAAO,OAAO,CAAC,CAAA,CAAE,QAAA,CAAS,sBAAsB;AAAA;AAC1E,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAO,KAAM;AACpB,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,SAAA;AAAA,UACJ,EAAE,MAAA;AAAO,SACX;AACA,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,oBAAA;AAAA,UACR,YAAY,CAAA,CAAE,QAAA;AAAA,UACd,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,iBAAA,EAAmB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,uBAAA;AAAA,MACP,WAAA,EAAa,sEAAA;AAAA,MACb,WAAA,EAAa,EAAE,IAAA,EAAMD,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,6BAA6B,CAAA;AAAE,KAC1E;AAAA,IACA,OAAO,EAAE,IAAA,EAAK,KAAM;AAClB,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAY,UAAA,EAAY,EAAE,MAAM,CAAA;AACrD,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,gBAAgB,CAAA;AAAA,MAClE,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,iBAAA,EAAmB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,kBAAkB,CAAC,CAAA;AAAA,IACtD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EAAa,mCAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA,CAAY,WAAW,CAAA;AAC5C,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,OAAA,EAAS,iBAAiB,CAAA;AAAA,MACnE,SAAS,CAAA,EAAG;AACV,QAAA,OAAOA,IAAAA,CAAI,GAAA,EAAK,kBAAA,EAAoB,uBAAA,EAAyB,CAAC,CAAA;AAAA,MAChE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,eAAA;AAAA,MACP,WAAA,EAAa,4EAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qCAAqC,CAAA;AAAA,QAC3E,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC3B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,KAAA,EAAO,QAAO,KAAM;AAClC,MAAA,IAAI;AACF,QAAA,MAAM,aAAa,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA,EAAE;AAC7D,QAAA,IAAI,KAAA,EAAO;AAIT,UAAA,MAAME,EAAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAExB,YAAA,EAAc,EAAE,KAAA,EAAO,UAAA,EAAY,CAAA;AAC1C,UAAA,OAAO,UAAA,CAAW;AAAA,YAChB,IAAA,EAAMA,GAAE,UAAA,CAAW,OAAA;AAAA,YACnB,KAAA,EAAOA,EAAAA,CAAE,UAAA,CAAW,OAAA,CAAQ;AAAA,WAC7B,CAAA;AAAA,QACH;AACA,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAExB,WAAA,EAAa,EAAE,UAAA,EAAY,CAAA;AAClC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,IAAA,EAAM,EAAE,SAAA,CAAU,OAAA;AAAA,UAClB,KAAA,EAAO,CAAA,CAAE,SAAA,CAAU,OAAA,CAAQ;AAAA,SAC5B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOD,IAAAA,CAAI,GAAA,EAAK,oBAAA,EAAsB,yBAAA,EAA2B,CAAC,CAAA;AAAA,MACpE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EACE,qGAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,IAAA,EAAMD,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B,CAAA;AAAA,QACrD,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,eAAe,CAAA;AAAA,QAC1C,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,CAAS,0BAA0B,CAAA;AAAA,QACtE,WAAWA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,iBAAiB;AAAA;AAC7D,KACF;AAAA,IACA,OAAO,EAAE,IAAA,EAAM,KAAA,EAAO,MAAA,EAAQ,WAAU,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,IAAA,EAAM,KAAA,EAAM;AACrD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,KAAA,GAAQ,MAAA;AACxC,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC/C,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAExB,gBAAA,EAAkB,EAAE,KAAA,EAAO,CAAA;AAClC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAS,0EAAA;AAAA,UACT,KAAK,CAAA,CAAE;AAAA,SACR,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EAAa,iCAAA;AAAA,MACb,WAAA,EAAa,EAAE,KAAA,EAAOD,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,kBAAkB,CAAA;AAAE,KAChE;AAAA,IACA,OAAO,EAAE,KAAA,EAAM,KAAM;AACnB,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAY,cAAA,EAAgB,EAAE,OAAO,CAAA;AAC1D,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,QAAA,EAAW,KAAK,aAAa,CAAA;AAAA,MAC/E,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EACE,mGAAA;AAAA,MACF,WAAA,EAAa,EAAE,KAAA,EAAOD,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,kBAAkB,CAAA;AAAE,KAChE;AAAA,IACA,OAAO,EAAE,KAAA,EAAM,KAAM;AACnB,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,cAAA;AAAA,UACJ,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAS,oEAAA;AAAA,UACT,SAAA,EAAW,EAAE,YAAA,CAAa;AAAA,SAC3B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,sBAAA;AAAA,MACP,WAAA,EAAa,gDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC9D,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAO,KAAM;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAMxB,eAAA,EAAiB;AAAA,UACtB,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,EAAE,aAAA,CAAc,SAAA;AAAA,UACxB,KAAA,EAAO,EAAE,aAAA,CAAc,UAAA;AAAA,UACvB,OAAA,EAAS,EAAE,aAAA,CAAc;AAAA,SAC1B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,2BAAA,EAA6B,CAAC,CAAA;AAAA,MACxE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,6CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC9D,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAO,KAAM;AAC3B,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAMxB,wBAAA,EAA0B;AAAA,UAC/B,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,WAAA,EAAa,EAAE,sBAAA,CAAuB,WAAA;AAAA,UACtC,KAAA,EAAO,EAAE,sBAAA,CAAuB,UAAA;AAAA,UAChC,OAAA,EAAS,EAAE,sBAAA,CAAuB;AAAA,SACnC,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,uBAAA,EAAyB,4BAAA,EAA8B,CAAC,CAAA;AAAA,MAC1E;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,wBAAwB,CAAC,CAAA;AAAA,IAC5D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,uEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAOD,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6BAA6B,CAAA;AAAA,QACxD,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,GAAA,CAAI,CAAC,CAAA,CAAE,QAAA,CAAS,6BAA6B,CAAA;AAAA,QACzE,cAAcA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QAC3C,WAAWA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,YAAY;AAAA;AACxD,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAQ,YAAA,EAAc,WAAU,KAAM;AACpD,MAAA,IAAI;AAGF,QAAA,MAAM,KAAA,GAAiC,EAAE,KAAA,EAAO,MAAA,EAAO;AACvD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,IAAI,YAAA,KAAiB,KAAA,CAAA,EAAW,KAAA,CAAM,YAAA,GAAe,YAAA;AACrD,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC/C,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,gBAAA;AAAA,UACJ,EAAE,KAAA;AAAM,SACV;AACA,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,WAAW,UAAA,EAAY,CAAA,CAAE,iBAAiB,CAAA;AAAA,MACxE,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,wBAAA,EAA0B,4BAAA,EAA8B,CAAC,CAAA;AAAA,MAC3E;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,mBAAA;AAAA,MACP,WAAA,EAAa,gCAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAID,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,eAAe,CAAA;AAAA,QACvC,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,MAAA,EAAO,KAAM;AACxB,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA,CAAY,iBAAA,EAAmB;AAAA,UAClD,EAAA;AAAA,UACA,GAAI,MAAA,KAAW,KAAA,CAAA,GAAY,EAAE,MAAA,KAAW;AAAC,SAC1C,CAAA;AACD,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,WAAA,EAAc,EAAE,aAAa,CAAA;AAAA,MAC/E,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,yBAAA,EAA2B,6BAAA,EAA+B,CAAC,CAAA;AAAA,MAC7E;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,gBAAgB,CAAC,CAAA;AAAA,IACpD;AAAA,MACE,KAAA,EAAO,WAAA;AAAA,MACP,WAAA,EAAa,mDAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAOD,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC3B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,MAAA,EAAO,KAAM;AAC3B,MAAA,IAAI;AAIF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAExB,iBAAA,EAAmB;AAAA,UACxB,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,IAAA,EAAM,EAAE,eAAA,CAAgB,IAAA;AAAA,UACxB,KAAA,EAAO,CAAA,CAAE,eAAA,CAAgB,IAAA,CAAK;AAAA,SAC/B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,gBAAA,EAAkB,qBAAA,EAAuB,CAAC,CAAA;AAAA,MAC5D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,eAAe,CAAC,CAAA;AAAA,IACnD;AAAA,MACE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA,EAAa,6BAAA;AAAA,MACb,WAAA,EAAa,EAAE,EAAA,EAAID,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAE,KACnD;AAAA,IACA,OAAO,EAAE,EAAA,EAAG,KAAM;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,OAAA;AAAA,UACJ,EAAE,EAAA;AAAG,SACP;AACA,QAAA,IAAI,CAAC,EAAE,GAAA,EAAK;AACV,UAAA,OAAO,WAAA,CAAY,CAAA,IAAA,EAAO,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,QAC3C;AACA,QAAA,OAAO,UAAA,CAAW,EAAE,GAAG,CAAA;AAAA,MACzB,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,eAAA,EAAiB,mBAAA,EAAqB,CAAC,CAAA;AAAA,MACzD;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,kBAAkB,CAAC,CAAA;AAAA,IACtD;AAAA,MACE,KAAA,EAAO,YAAA;AAAA,MACP,WAAA,EACE,kFAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,IAAA,EAAMD,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,UAAU,CAAA;AAAA,QACpC,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QACjC,IAAA,EAAMA,KAAAA,CAAE,IAAA,CAAK,CAAC,OAAA,EAAS,QAAQ,CAAC,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,0BAA0B,CAAA;AAAA,QAChF,SAAA,EAAWA,KAAAA,CACR,IAAA,CAAK,CAAC,MAAA,EAAQ,KAAA,EAAO,SAAS,CAAC,CAAA,CAC/B,QAAA,EAAS,CACT,QAAA,CAAS,0BAA0B,CAAA;AAAA,QACtC,YAAA,EAAcA,KAAAA,CAAE,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,qBAAqB,CAAA;AAAA,QAC3E,QAAQA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA;AAAS;AACvC,KACF;AAAA,IACA,OAAO,EAAE,IAAA,EAAM,WAAA,EAAa,MAAM,SAAA,EAAW,YAAA,EAAc,QAAO,KAAM;AACtE,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC;AAAA,UACrC,IAAA;AAAA,UACA,MAAM,IAAA,IAAQ,OAAA;AAAA,UACd,WAAW,SAAA,IAAa;AAAA,SAC1B;AACA,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,YAAA,KAAiB,KAAA,CAAA,EAAW,KAAA,CAAM,YAAA,GAAe,YAAA;AACrD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAExB,UAAA,EAAY,EAAE,KAAA,EAAO,CAAA;AAC5B,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAS,gEAAA;AAAA,UACT,GAAA,EAAK,EAAE,SAAA,CAAU,GAAA;AAAA,UACjB,YAAA,EAAc,EAAE,SAAA,CAAU;AAAA,SAC3B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,kBAAA,EAAoB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MAC/D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,kBAAkB,CAAC,CAAA;AAAA,IACtD;AAAA,MACE,KAAA,EAAO,YAAA;AAAA,MACP,WAAA,EAAa,mEAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAID,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,QAAQ,CAAA;AAAA,QAChC,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC1B,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QACjC,cAAcA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QAC3C,QAAQA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACrC,QAAQA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,gCAAgC;AAAA;AACzE,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,IAAA,EAAM,aAAa,YAAA,EAAc,MAAA,EAAQ,QAAO,KAAM;AACjE,MAAA,IAAI;AACF,QAAA,MAAM,QAAiC,EAAC;AACxC,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,IAAA,GAAO,IAAA;AACrC,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,YAAA,KAAiB,KAAA,CAAA,EAAW,KAAA,CAAM,YAAA,GAAe,YAAA;AACrD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,OAAO,WAAA,EAAY;AAC5D,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,WAAW,CAAA,EAAG;AACnC,UAAA,OAAO,YAAY,yDAAoD,CAAA;AAAA,QACzE;AACA,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,UAAA;AAAA,UACJ,EAAE,IAAI,KAAA;AAAM,SACd;AACA,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,WAAW,GAAA,EAAK,CAAA,CAAE,WAAW,CAAA;AAAA,MAC3D,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,kBAAA,EAAoB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MAC/D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,sBAAsB,CAAC,CAAA;AAAA,IAC1D;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EAAa,4EAAA;AAAA,MACb,WAAA,EAAa,EAAE,EAAA,EAAID,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,QAAQ,CAAA;AAAE,KACnD;AAAA,IACA,OAAO,EAAE,EAAA,EAAG,KAAM;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAY,cAAA,EAAgB,EAAE,IAAI,CAAA;AACvD,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,IAAA,EAAO,EAAE,iBAAiB,CAAA;AAAA,MAC5E,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,sBAAA,EAAwB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,2BAAA;AAAA,MACP,WAAA,EACE,qJAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUD,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,iBAAiB,CAAA;AAAA,QAC/C,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mCAAmC,CAAA;AAAA,QACpE,QAAQA,KAAAA,CAAE,KAAA,CAAMA,MAAE,MAAA,EAAQ,EAAE,QAAA,EAAS;AAAA,QACrC,OAAOA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAC1D,cAAcA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,gBAAgB;AAAA;AAC/D,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,aAAa,MAAA,EAAQ,KAAA,EAAO,cAAa,KAAM;AAChE,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,MAAA,MAAM,SACJ,GAAA,CAAI,GAAA,KAAQ,MAAA,GACP,GAAA,CAAI,SAAS,cAAA,IAAkB,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA,GACzE,IAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC/C,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB;AAAA,QACjC,SAAA,EAAW,QAAA;AAAA,QACX,YAAA,EAAc,WAAA;AAAA,QACd,eAAe,YAAA,IAAgB;AAAA,OAChC,CAAA;AACD,MAAA,IAAI,MAAA,IAAU,MAAA,CAAO,MAAA,GAAS,CAAA,EAAG,MAAA,CAAO,IAAI,OAAA,EAAS,MAAA,CAAO,IAAA,CAAK,GAAG,CAAC,CAAA;AACrE,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AACpC,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,iBAAA,EAAoB,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA;AAC7E,MAAA,OAAO,UAAA,CAAW,EAAE,GAAA,EAAK,CAAA;AAAA,IAC3B;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAClD;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EAAa,iDAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,WAAW,CAAA;AAAE,KAC5D;AAAA,IACA,OAAO,EAAE,QAAA,EAAS,KAAM;AACtB,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,cAAA;AAAA,UACJ,EAAE,QAAA;AAAS,SACb;AACA,QAAA,OAAO,UAAA,CAAW,EAAE,YAAY,CAAA;AAAA,MAClC,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,cAAA,EAAgB,0BAAA,EAA4B,CAAC,CAAA;AAAA,MAC/D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,eAAA;AAAA,MACP,WAAA,EAAa,+CAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,QAAA,EAAUD,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,WAAW,CAAA;AAAA,QACzC,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,6BAA6B,CAAA;AAAA,QAC3D,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,kBAAkB,CAAA;AAAA,QAC9C,QAAQA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,kBAAkB,CAAA;AAAA,QACzD,aAAaA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,uBAAuB,CAAA;AAAA,QACnE,SAASA,KAAAA,CAAE,OAAA,GAAU,QAAA,EAAS,CAAE,SAAS,mCAAmC;AAAA;AAC9E,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAU,QAAQ,MAAA,EAAQ,WAAA,EAAa,SAAQ,KAAM;AACtE,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC;AAAA,UACrC,QAAA;AAAA,UACA,MAAA;AAAA,UACA,SAAS,OAAA,IAAW;AAAA,SACtB;AACA,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,eAAA;AAAA,UACJ,EAAE,UAAU,KAAA;AAAM,SACpB;AACA,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,WAAW,MAAA,EAAQ,CAAA,CAAE,eAAe,CAAA;AAAA,MAClE,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,oBAAA,EAAsB,2BAAA,EAA6B,CAAC,CAAA;AAAA,MACtE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,eAAe,CAAC,CAAA;AAAA,IACnD;AAAA,MACE,KAAA,EAAO,UAAA;AAAA,MACP,WAAA,EACE,8HAAA;AAAA,MACF,WAAA,EAAa,EAAE,QAAA,EAAUD,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,WAAW,CAAA;AAAE,KAC5D;AAAA,IACA,OAAO,EAAE,QAAA,EAAS,KAAM;AACtB,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,MAAA,MAAM,SACJ,GAAA,CAAI,GAAA,KAAQ,MAAA,GACP,GAAA,CAAI,SAAS,cAAA,IAAkB,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA,GACzE,IAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC/C,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,KAAA,EAAQ,kBAAA,CAAmB,QAAQ,CAAC,CAAA,KAAA,CAAA;AAC5E,MAAA,OAAO,UAAA,CAAW,EAAE,GAAA,EAAK,OAAA,EAAS,2CAA2C,CAAA;AAAA,IAC/E;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,mBAAA;AAAA,MACP,WAAA,EAAa,wCAAA;AAAA,MACb,WAAA,EAAa,EAAE,QAAA,EAAUA,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,WAAW,CAAA;AAAE,KAC5D;AAAA,IACA,OAAO,EAAE,QAAA,EAAS,KAAM;AACtB,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,GAAA,CAAI,MAAA,CAAO,QAAY,iBAAA,EAAmB,EAAE,UAAU,CAAA;AAChE,QAAA,OAAO,UAAA,CAAW,EAAE,MAAA,EAAQ,SAAA,EAAW,SAAS,CAAA,eAAA,EAAkB,QAAQ,aAAa,CAAA;AAAA,MACzF,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,iBAAA,EAAmB,6BAAA,EAA+B,CAAC,CAAA;AAAA,MACrE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,oBAAA;AAAA,MACP,WAAA,EAAa,8DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,KAAA,EAAOD,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC3B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC1B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC5B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC5B,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC3B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA;AAAS;AAC9B,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,QAAA,EAAU,MAAM,MAAA,EAAQ,MAAA,EAAQ,KAAA,EAAO,MAAA,EAAO,KAAM;AAClE,MAAA,IAAI;AACF,QAAA,MAAM,SAAkC,EAAC;AACzC,QAAA,IAAI,KAAA,KAAU,KAAA,CAAA,EAAW,MAAA,CAAO,KAAA,GAAQ,KAAA;AACxC,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,MAAA,CAAO,QAAA,GAAW,QAAA;AAC9C,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,MAAA,CAAO,IAAA,GAAO,KAAK,WAAA,EAAY;AACvD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,OAAO,WAAA,EAAY;AAC7D,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,MAAA,CAAO,MAAA,GAAS,MAAA;AAC1C,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAExB,UAAA,EAAY;AAAA,UACjB,QAAQ,MAAA,CAAO,IAAA,CAAK,MAAM,CAAA,CAAE,MAAA,GAAS,IAAI,MAAA,GAAS,KAAA,CAAA;AAAA,UAClD,YAAY,EAAE,KAAA,EAAO,SAAS,EAAA,EAAI,MAAA,EAAQ,UAAU,CAAA;AAAE,SACvD,CAAA;AACD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,KAAA,EAAO,EAAE,KAAA,CAAM,KAAA;AAAA,UACf,UAAA,EAAY,EAAE,KAAA,CAAM,UAAA;AAAA,UACpB,OAAA,EAAS,EAAE,KAAA,CAAM;AAAA,SAClB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,iBAAA,EAAmB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MAC9D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,gBAAgB,CAAC,CAAA;AAAA,IACpD;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EAAa,8CAAA;AAAA,MACb,WAAA,EAAa,EAAE,EAAA,EAAID,KAAAA,CAAE,QAAO,CAAE,QAAA,CAAS,SAAS,CAAA;AAAE,KACpD;AAAA,IACA,OAAO,EAAE,EAAA,EAAG,KAAM;AAChB,MAAA,IAAI;AACF,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAAsC,QAAA,EAAU,EAAE,EAAA,EAAI,CAAA;AACrF,QAAA,IAAI,CAAC,EAAE,IAAA,EAAM;AACX,UAAA,OAAO,WAAA,CAAY,CAAA,KAAA,EAAQ,EAAE,CAAA,WAAA,CAAa,CAAA;AAAA,QAC5C;AACA,QAAA,OAAO,UAAA,CAAW,EAAE,IAAI,CAAA;AAAA,MAC1B,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,gBAAA,EAAkB,oBAAA,EAAsB,CAAC,CAAA;AAAA,MAC3D;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,mBAAmB,CAAC,CAAA;AAAA,IACvD;AAAA,MACE,KAAA,EAAO,qBAAA;AAAA,MACP,WAAA,EAAa,2DAAA;AAAA,MACb,WAAA,EAAa;AAAA,QACX,EAAA,EAAID,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,SAAS,CAAA;AAAA,QACjC,SAAA,EAAWA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC/B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC9B,WAAA,EAAaA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QACjC,IAAA,EAAMA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC1B,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,QAAA,EAAS;AAAA,QAC5B,aAAA,EAAeA,KAAAA,CAAE,OAAA,EAAQ,CAAE,QAAA;AAAS;AACtC,KACF;AAAA,IACA,OAAO,EAAE,EAAA,EAAI,SAAA,EAAW,QAAA,EAAU,UAAU,WAAA,EAAa,IAAA,EAAM,MAAA,EAAQ,aAAA,EAAc,KAAM;AACzF,MAAA,IAAI;AACF,QAAA,MAAM,QAAiC,EAAC;AACxC,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC/C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,IAAI,WAAA,KAAgB,KAAA,CAAA,EAAW,KAAA,CAAM,WAAA,GAAc,WAAA;AACnD,QAAA,IAAI,IAAA,KAAS,KAAA,CAAA,EAAW,KAAA,CAAM,IAAA,GAAO,KAAK,WAAA,EAAY;AACtD,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,OAAO,WAAA,EAAY;AAC5D,QAAA,IAAI,aAAA,KAAkB,KAAA,CAAA,EAAW,KAAA,CAAM,aAAA,GAAgB,aAAA;AACvD,QAAA,IAAI,MAAA,CAAO,IAAA,CAAK,KAAK,CAAA,CAAE,WAAW,CAAA,EAAG;AACnC,UAAA,OAAO,YAAY,yDAAoD,CAAA;AAAA,QACzE;AACA,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAAqC,WAAA,EAAa;AAAA,UAC/E,EAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,OAAO,WAAW,EAAE,MAAA,EAAQ,WAAW,IAAA,EAAM,CAAA,CAAE,YAAY,CAAA;AAAA,MAC7D,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,mBAAA,EAAqB,uBAAA,EAAyB,CAAC,CAAA;AAAA,MACjE;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,0BAAA;AAAA,MACP,WAAA,EACE,qHAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,aAAaD,KAAAA,CACV,MAAA,GACA,QAAA,EAAS,CACT,SAAS,iEAAiE;AAAA;AAC/E,KACF;AAAA,IACA,OAAO,EAAE,WAAA,EAAY,KAAM;AACzB,MAAA,MAAM,QAAQ,WAAA,IAAe,EAAA;AAC7B,MAAA,MAAM,UAAA,GAAa,EAAE,KAAA,EAAO,MAAA,EAAQ,CAAA,EAAE;AACtC,MAAA,MAAM,UAAmC,EAAC;AAC1C,MAAA,IAAI;AACF,QAAA,MAAM,OAAA,GAAU,MAAM,GAAA,CAAI,GAAA,CAAI,OAC3B,OAAA,CAAsD,YAAY,EAClE,KAAA,CAAM,CAAC,OAAO,EAAE,KAAA,EAAO,aAAa,KAAA,GAAQ,CAAA,CAAE,UAAU,MAAA,CAAO,CAAC,GAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,OAAA,GAAU,OAAA;AAElB,QAAA,MAAM,GAAA,GAAM,MAAM,GAAA,CAAI,GAAA,CAAI,OACvB,OAAA,CAEM,wBAAA,EAA0B,EAAE,UAAA,EAAY,CAAA,CAC9C,MAAM,CAAC,CAAA,MAAO,EAAE,KAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAA,EAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,GAAA,GAAM,GAAA;AAEd,QAAA,MAAM,WAAW,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAC5B,QAAgE,eAAA,EAAiB;AAAA,UAChF;AAAA,SACD,CAAA,CACA,KAAA,CAAM,CAAC,OAAO,EAAE,KAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,GAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,QAAA,GAAW,QAAA;AAEnB,QAAA,MAAM,QAAQ,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CACzB,QAA+D,eAAA,EAAiB;AAAA,UAC/E;AAAA,SACD,CAAA,CACA,KAAA,CAAM,CAAC,OAAO,EAAE,KAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,GAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,QAAA,GAAW,KAAA;AAEnB,QAAA,MAAM,OAAO,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CACxB,QAA2D,WAAA,EAAa;AAAA,UACvE;AAAA,SACD,CAAA,CACA,KAAA,CAAM,CAAC,OAAO,EAAE,KAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,CAAA,CAAE,OAAA,GAAU,MAAA,CAAO,CAAC,GAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,OAAA,GAAU,IAAA;AAElB,QAAA,MAAM,WAAA,GAAc,MAAM,GAAA,CAAI,GAAA,CAAI,OAC/B,OAAA,CAEM,wBAAA,EAA0B,EAAE,UAAA,EAAY,CAAA,CAC9C,MAAM,CAAC,CAAA,MAAO,EAAE,KAAA,EAAO,CAAA,YAAa,KAAA,GAAQ,EAAE,OAAA,GAAU,MAAA,CAAO,CAAC,CAAA,EAAE,CAAE,CAAA;AACvE,QAAA,OAAA,CAAQ,WAAA,GAAc,WAAA;AAEtB,QAAA,OAAO,WAAW,OAAO,CAAA;AAAA,MAC3B,SAAS,CAAA,EAAG;AACV,QAAA,OAAOC,IAAAA,CAAI,GAAA,EAAK,uBAAA,EAAyB,kCAAA,EAAoC,CAAC,CAAA;AAAA,MAChF;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,wBAAA;AAAA,MACP,WAAA,EACE,mIAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,OAAOD,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,0BAA0B;AAAA;AAClE,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAM,KAAM;AACnB,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,MAAA,MAAM,SACJ,GAAA,CAAI,GAAA,KAAQ,MAAA,GACP,GAAA,CAAI,SAAS,cAAA,IAAkB,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA,GACzE,IAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC/C,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AACpC,MAAA,MAAM,EAAA,GAAK,OAAO,QAAA,EAAS;AAC3B,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,SAAA,EAAY,EAAA,GAAK,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AACtE,MAAA,OAAO,UAAA,CAAW,EAAE,GAAA,EAAK,CAAA;AAAA,IAC3B;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,6BAA6B,CAAC,CAAA;AAAA,IACjE;AAAA,MACE,KAAA,EAAO,0BAAA;AAAA,MACP,WAAA,EACE,qIAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,OAAOA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,0BAA0B;AAAA;AAClE,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAM,KAAM;AACnB,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,MAAA,MAAM,SACJ,GAAA,CAAI,GAAA,KAAQ,MAAA,GACP,GAAA,CAAI,SAAS,cAAA,IAAkB,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA,GACzE,IAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC/C,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,EAAgB;AACnC,MAAA,IAAI,KAAA,EAAO,MAAA,CAAO,GAAA,CAAI,OAAA,EAAS,KAAK,CAAA;AACpC,MAAA,MAAM,EAAA,GAAK,OAAO,QAAA,EAAS;AAC3B,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,eAAA,EAAkB,EAAA,GAAK,CAAA,CAAA,EAAI,EAAE,CAAA,CAAA,GAAK,EAAE,CAAA,CAAA;AAC5E,MAAA,OAAO,UAAA,CAAW,EAAE,GAAA,EAAK,CAAA;AAAA,IAC3B;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,sBAAA;AAAA,MACP,WAAA,EACE,uIAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,iCAAiC;AAAA;AAC9D,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAM,KAAM;AACnB,MAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,MAAA,MAAM,SACJ,GAAA,CAAI,GAAA,KAAQ,MAAA,GACP,GAAA,CAAI,SAAS,cAAA,IAAkB,GAAA,CAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA,GACzE,IAAI,cAAA,CAAe,OAAA,CAAQ,YAAY,EAAE,CAAA;AAC/C,MAAA,MAAM,MAAA,GAAS,IAAI,eAAA,CAAgB,EAAE,OAAO,CAAA;AAC5C,MAAA,MAAM,GAAA,GAAM,CAAA,EAAG,MAAA,CAAO,OAAA,CAAQ,KAAA,EAAO,EAAE,CAAC,CAAA,YAAA,EAAe,MAAA,CAAO,QAAA,EAAU,CAAA,CAAA;AACxE,MAAA,OAAO,UAAA,CAAW,EAAE,GAAA,EAAK,CAAA;AAAA,IAC3B;AAAA,GACF;AACF;;;ACl+BA,IAAM,UAAA,GAAwB;AAAA,EAC5B,EAAA,EAAI,MAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,gBAAA;AAAA,EACb,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,iBAAA,CAAkB,MAAA,EAAQ,KAAK,KAAK,CAAA;AACpC,IAAA,qBAAA,CAAsB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAMxC,IAAA,sBAAA,CAAuB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAEzC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,YAAA,GAAQ","file":"index.cjs","sourcesContent":["/**\n * OAuth2 Device Code flow + Client Credentials flow + workspace token issuance.\n * Pure functions — operate on injected endpoints + client ids, no global state.\n *\n * Mirrors cli-sdk/src/core/auth/device-code.ts so a future shared\n * @burdenoff/auth-core extraction is mechanical.\n */\n\nimport fetch from 'cross-fetch';\n\nexport interface DeviceCodeResponse {\n deviceCode: string;\n userCode: string;\n verificationUri: string;\n verificationUriComplete: string | null;\n expiresIn: number;\n interval: number;\n}\n\nexport interface DeviceCodeTokenResult {\n accessToken: string;\n refreshToken: string;\n expiresIn: number;\n}\n\nexport interface ClientCredentialsResult {\n accessToken: string;\n expiresIn: number;\n scopes: string[];\n}\n\nexport interface OIDCConfig {\n oidcIssuer: string;\n clientId: string;\n}\n\nexport async function startDeviceCodeFlow(config: OIDCConfig): Promise<DeviceCodeResponse> {\n const url = `${config.oidcIssuer}/oidc/device/code`;\n const body = new URLSearchParams({\n client_id: config.clientId,\n scope: 'openid profile email offline_access',\n });\n\n const response = await fetch(url, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: body.toString(),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => 'Unknown error');\n throw new Error(`Device code request failed (${response.status}): ${text}`);\n }\n\n const data = (await response.json()) as Record<string, unknown>;\n\n return {\n deviceCode: data['device_code'] as string,\n userCode: data['user_code'] as string,\n verificationUri: data['verification_uri'] as string,\n verificationUriComplete: (data['verification_uri_complete'] as string) ?? null,\n expiresIn: data['expires_in'] as number,\n interval: (data['interval'] as number) ?? 5,\n };\n}\n\nexport type DeviceTokenPollResult =\n | { status: 'authenticated'; tokens: DeviceCodeTokenResult }\n | { status: 'pending' }\n | { status: 'slow_down'; newInterval: number }\n | { status: 'expired' }\n | { status: 'denied' };\n\n/**\n * Single-shot device-code token poll.\n *\n * Unlike cli-sdk's pollForToken which loops until done (suitable for blocking\n * CLI), MCP needs non-blocking semantics: the LLM calls auth_complete tool\n * repeatedly. This helper makes ONE poll attempt and returns a discriminated\n * union the caller can act on.\n */\nexport async function pollDeviceTokenOnce(\n deviceCode: string,\n interval: number,\n config: OIDCConfig,\n): Promise<DeviceTokenPollResult> {\n const url = `${config.oidcIssuer}/oauth/device/token`;\n\n const response = await fetch(url, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n device_code: deviceCode,\n client_id: config.clientId,\n }).toString(),\n });\n\n const data = (await response.json()) as Record<string, unknown>;\n\n if (response.ok && data['access_token']) {\n return {\n status: 'authenticated',\n tokens: {\n accessToken: data['access_token'] as string,\n refreshToken: (data['refresh_token'] as string) ?? '',\n expiresIn: (data['expires_in'] as number) ?? 3600,\n },\n };\n }\n\n const errorCode = data['error'] as string | undefined;\n switch (errorCode) {\n case 'authorization_pending':\n return { status: 'pending' };\n case 'slow_down':\n return { status: 'slow_down', newInterval: interval + 5 };\n case 'expired_token':\n return { status: 'expired' };\n case 'access_denied':\n return { status: 'denied' };\n default:\n throw new Error(\n `Device code polling failed: ${(data['error_description'] as string) ?? errorCode ?? 'Unknown error'}`,\n );\n }\n}\n\nexport async function clientCredentialsFlow(\n globalEndpoint: string,\n clientId: string,\n clientSecret: string,\n scopes?: string[],\n): Promise<ClientCredentialsResult> {\n const query = `\n mutation AuthenticateApp($input: AuthenticateAppInput!) {\n authenticateApp(input: $input) {\n accessToken tokenType expiresIn scopes\n }\n }\n `;\n\n const response = await fetch(globalEndpoint, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json' },\n body: JSON.stringify({\n query,\n variables: { input: { clientId, clientSecret, scopes } },\n }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => 'Unknown error');\n throw new Error(`App authentication failed (${response.status}): ${text}`);\n }\n\n const data = (await response.json()) as {\n data?: { authenticateApp: { accessToken: string; expiresIn: number; scopes: string[] } };\n errors?: Array<{ message: string }>;\n };\n\n if (data.errors?.length) {\n throw new Error(`App authentication failed: ${data.errors[0]?.message ?? 'unknown error'}`);\n }\n if (!data.data?.authenticateApp?.accessToken) {\n throw new Error('App authentication failed: no access token returned');\n }\n\n return data.data.authenticateApp;\n}\n\nexport async function issueWorkspaceToken(\n workspaceEndpoint: string,\n authToken: string,\n workspaceId: string,\n organizationId: string,\n): Promise<{ token: string; expiresAt: string; scopes: string[] }> {\n const query = `\n mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n issueWorkspaceToken(input: $input) {\n success token expiresAt scopes\n error { code message }\n }\n }\n `;\n\n const response = await fetch(workspaceEndpoint, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${authToken}` },\n body: JSON.stringify({ query, variables: { input: { workspaceId, organizationId } } }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => 'Unknown error');\n throw new Error(`Workspace token request failed (${response.status}): ${text}`);\n }\n\n const data = (await response.json()) as {\n data?: {\n issueWorkspaceToken: {\n success: boolean;\n token: string | null;\n expiresAt: string | null;\n scopes: string[] | null;\n error: { code: string; message: string } | null;\n };\n };\n errors?: Array<{ message: string }>;\n };\n\n if (data.errors?.length) {\n throw new Error(`Workspace token failed: ${data.errors[0]?.message ?? 'unknown error'}`);\n }\n\n const result = data.data?.issueWorkspaceToken;\n if (!result?.success || !result.token) {\n throw new Error(`Workspace token failed: ${result?.error?.message ?? 'Unknown error'}`);\n }\n\n return { token: result.token, expiresAt: result.expiresAt ?? '', scopes: result.scopes ?? [] };\n}\n\nexport async function fetchWorkspaces(\n globalEndpoint: string,\n authToken: string,\n): Promise<\n Array<{ id: string; name: string; slug: string; tenantId: string; organizationId: string }>\n> {\n const query = `\n query MyWorkspaces($limit: Int) {\n myWorkspaces(limit: $limit) {\n items { id name slug tenantId organizationId }\n }\n }\n `;\n\n const response = await fetch(globalEndpoint, {\n method: 'POST',\n headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${authToken}` },\n body: JSON.stringify({ query, variables: { limit: 50 } }),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => 'Unknown error');\n throw new Error(`Failed to fetch workspaces (${response.status}): ${text}`);\n }\n\n const data = (await response.json()) as {\n data?: {\n myWorkspaces: {\n items: Array<{\n id: string;\n name: string;\n slug: string;\n tenantId: string;\n organizationId: string;\n }>;\n };\n };\n errors?: Array<{ message: string }>;\n };\n\n if (data.errors?.length) {\n throw new Error(`Failed to fetch workspaces: ${data.errors[0]?.message ?? 'unknown error'}`);\n }\n\n return data.data?.myWorkspaces?.items ?? [];\n}\n","/**\n * Auth helper for the auth module — ports VibeControlsMCPAuth from\n * vibecontrols-mcp/src/auth/index.ts to a ctx-aware factory.\n *\n * Differences from the legacy class:\n * - Per-ctx instance (no module-level singleton; each product MCP gets its own)\n * - Token persistence delegated to ctx.auth (StoredAuth file)\n * - Endpoints + clientId resolved via ctx.config.resolveOIDC + ctx.config.read\n * - pendingDeviceCode kept in closure scope (alive for the MCP server process,\n * suitable for stdio's lifetime; HTTP's per-session servers each get their own\n * pending state)\n *\n * Public surface mirrors the legacy class so the lifted auth/tools.ts works\n * without modification: startLogin / completeLogin / selectWorkspace /\n * listWorkspaces / getStatus / logout / ensureAuthenticated / getHeaders /\n * isLoggedIn / setOnTokensChanged.\n */\n\nimport type { McpContext } from '../../core/index.js';\nimport { fetchWorkspaces, issueWorkspaceToken } from '../../core/auth/device-code.js';\n\ninterface PendingDeviceCode {\n deviceCode: string;\n userCode: string;\n verificationUri: string;\n verificationUriComplete: string | null;\n expiresAt: number;\n interval: number;\n clientId: string;\n tokenUrl: string;\n}\n\nexport interface WorkspaceInfo {\n id: string;\n name: string;\n slug: string;\n tenantId: string;\n organizationId: string;\n}\n\nexport interface LoginStartResult {\n status: 'device_code_issued';\n verificationUri: string;\n verificationUriComplete: string | null;\n userCode: string;\n expiresIn: number;\n message: string;\n}\n\nexport interface LoginCompleteResult {\n status: 'authenticated' | 'workspace_selection_required' | 'pending' | 'expired';\n message: string;\n workspaces?: WorkspaceInfo[];\n}\n\nexport interface AuthHelper {\n startLogin(): Promise<LoginStartResult>;\n completeLogin(): Promise<LoginCompleteResult>;\n selectWorkspace(workspaceId: string, organizationId: string): Promise<void>;\n listWorkspaces(): Promise<WorkspaceInfo[]>;\n ensureAuthenticated(): Promise<void>;\n getStatus(): Promise<{\n authenticated: boolean;\n method: string;\n expiresAt: string | null;\n workspaceId: string | null;\n organizationId: string | null;\n workspaceTokenExpiresAt: string | null;\n hasWorkspaceToken: boolean;\n hasPendingLogin: boolean;\n }>;\n logout(): Promise<void>;\n getHeaders(): Record<string, string>;\n isLoggedIn(): boolean;\n setOnTokensChanged(cb: () => void): void;\n}\n\nconst helpers = new WeakMap<McpContext, AuthHelper>();\n\nexport function getAuth(ctx: McpContext): AuthHelper {\n const cached = helpers.get(ctx);\n if (cached) return cached;\n const helper = createAuthHelper(ctx);\n helpers.set(ctx, helper);\n return helper;\n}\n\nfunction createAuthHelper(ctx: McpContext): AuthHelper {\n let pending: PendingDeviceCode | null = null;\n let onTokensChanged: (() => void) | null = null;\n let refreshInProgress: Promise<void> | null = null;\n\n function notify(): void {\n onTokensChanged?.();\n }\n\n async function startLogin(): Promise<LoginStartResult> {\n const { oidcIssuer, clientId } = ctx.config.resolveOIDC();\n const deviceCodeUrl = `${oidcIssuer}/oidc/device/code`;\n const tokenUrl = `${oidcIssuer}/oauth/device/token`;\n\n const response = await fetch(deviceCodeUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n client_id: clientId,\n scope: 'openid profile email offline_access',\n }).toString(),\n });\n\n if (!response.ok) {\n const text = await response.text().catch(() => 'Unknown error');\n throw new Error(`Device code request failed (${response.status}): ${text}`);\n }\n\n const data = (await response.json()) as Record<string, unknown>;\n const deviceCode = data['device_code'] as string;\n const userCode = data['user_code'] as string;\n const verificationUri = data['verification_uri'] as string;\n const verificationUriComplete = (data['verification_uri_complete'] as string) ?? null;\n const expiresIn = (data['expires_in'] as number) ?? 900;\n const interval = (data['interval'] as number) ?? 5;\n\n pending = {\n deviceCode,\n userCode,\n verificationUri,\n verificationUriComplete,\n expiresAt: Date.now() + expiresIn * 1000,\n interval,\n clientId,\n tokenUrl,\n };\n\n return {\n status: 'device_code_issued',\n verificationUri,\n verificationUriComplete,\n userCode,\n expiresIn,\n message: `Open ${verificationUriComplete ?? verificationUri} in a browser and enter code: ${userCode}. Then call ${ctx.productName}_auth_complete to finish authentication.`,\n };\n }\n\n async function completeLogin(): Promise<LoginCompleteResult> {\n if (!pending) {\n throw new Error(\n `No pending login flow. Call ${ctx.productName}_auth_login first to start the device code flow.`,\n );\n }\n\n const p = pending;\n if (Date.now() >= p.expiresAt) {\n pending = null;\n return {\n status: 'expired',\n message: `Device code has expired. Call ${ctx.productName}_auth_login again to get a new code.`,\n };\n }\n\n const response = await fetch(p.tokenUrl, {\n method: 'POST',\n headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n body: new URLSearchParams({\n grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n device_code: p.deviceCode,\n client_id: p.clientId,\n }).toString(),\n });\n\n const data = (await response.json()) as Record<string, unknown>;\n\n if (response.ok && data['access_token']) {\n pending = null;\n const expiresIn = (data['expires_in'] as number) ?? 3600;\n const auth = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n ctx.auth.write({\n ...auth,\n accessToken: data['access_token'] as string,\n refreshToken: (data['refresh_token'] as string) ?? '',\n expiresAt: Date.now() + expiresIn * 1000,\n authMethod: 'device_code',\n });\n ctx.gql.reset();\n return await handlePostLogin();\n }\n\n const errorCode = data['error'] as string | undefined;\n if (errorCode === 'authorization_pending') {\n return {\n status: 'pending',\n message: `Still waiting for user to authorize. Open ${p.verificationUriComplete ?? p.verificationUri} and enter code: ${p.userCode}. Then call ${ctx.productName}_auth_complete again.`,\n };\n } else if (errorCode === 'slow_down') {\n p.interval += 5;\n return {\n status: 'pending',\n message: `Authorization server asked to slow down. Wait a moment, then call ${ctx.productName}_auth_complete again.`,\n };\n } else if (errorCode === 'expired_token') {\n pending = null;\n return {\n status: 'expired',\n message: `Device code has expired. Call ${ctx.productName}_auth_login again.`,\n };\n } else if (errorCode === 'access_denied') {\n pending = null;\n throw new Error('Authorization was denied by the user.');\n } else {\n pending = null;\n throw new Error(\n `Device code error: ${(data['error_description'] as string) ?? errorCode ?? 'Unknown'}`,\n );\n }\n }\n\n async function handlePostLogin(): Promise<LoginCompleteResult> {\n try {\n const workspaces = await listWorkspaces();\n if (workspaces.length === 0) {\n notify();\n ctx.logger.info('Device code login successful (no workspaces found)');\n return {\n status: 'authenticated',\n message: `Authentication successful. No workspaces found — use ${ctx.productName}_auth_select_workspace when one is available.`,\n };\n }\n if (workspaces.length === 1) {\n const ws = workspaces[0];\n if (!ws)\n throw new Error('Unexpected: workspaces.length === 1 but workspaces[0] is undefined');\n await issueAndStoreWorkspaceToken(ws.id, ws.organizationId);\n ctx.logger.info('Device code login successful', {\n workspaceId: ws.id,\n workspaceName: ws.name,\n });\n return {\n status: 'authenticated',\n message: `Authentication successful. Workspace \"${ws.name}\" selected automatically.`,\n };\n }\n notify();\n ctx.logger.info('Device code login successful, workspace selection needed');\n return {\n status: 'workspace_selection_required',\n message: `Authentication successful. ${workspaces.length} workspaces available — call ${ctx.productName}_auth_select_workspace to choose one.`,\n workspaces,\n };\n } catch (wsError) {\n notify();\n ctx.logger.warn('Workspace discovery failed after login', {\n error: wsError instanceof Error ? wsError.message : String(wsError),\n });\n return {\n status: 'authenticated',\n message: `Authentication successful. Workspace discovery failed: ${wsError instanceof Error ? wsError.message : String(wsError)}`,\n };\n }\n }\n\n async function listWorkspaces(): Promise<WorkspaceInfo[]> {\n const auth = ctx.auth.read();\n if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n return fetchWorkspaces(ctx.config.read().globalEndpoint, auth.accessToken);\n }\n\n async function issueAndStoreWorkspaceToken(\n workspaceId: string,\n organizationId: string,\n ): Promise<void> {\n const auth = ctx.auth.read();\n if (!auth?.accessToken) throw new Error('Not authenticated.');\n const result = await issueWorkspaceToken(\n ctx.config.read().workspaceEndpoint,\n auth.accessToken,\n workspaceId,\n organizationId,\n );\n ctx.auth.write({\n ...auth,\n workspaceToken: result.token,\n workspaceTokenExpiresAt: new Date(result.expiresAt).getTime(),\n workspaceId,\n organizationId,\n });\n ctx.gql.reset();\n notify();\n }\n\n async function selectWorkspace(workspaceId: string, organizationId: string): Promise<void> {\n const auth = ctx.auth.read();\n if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n await issueAndStoreWorkspaceToken(workspaceId, organizationId);\n ctx.logger.info('Workspace selected', { workspaceId });\n }\n\n async function ensureAuthenticated(): Promise<void> {\n if (refreshInProgress) {\n await refreshInProgress;\n return;\n }\n const doEnsure = async (): Promise<void> => {\n const auth = ctx.auth.read();\n if (auth?.apiKey) return;\n if (!auth?.accessToken) {\n throw new Error(\n `Not authenticated. Call ${ctx.productName}_auth_login to start the login flow, then ${ctx.productName}_auth_complete after authorizing in the browser.`,\n );\n }\n // The shared gql client handles refresh via isTokenExpiringSoon + isWorkspaceTokenExpiringSoon —\n // trigger by issuing a no-op request that goes through the workspace client's refresh path.\n // We simulate a no-op via a cheap query if needed; today the gql wrapper does it lazily,\n // so we just delegate to it on the next request. Nothing to do here.\n };\n refreshInProgress = doEnsure().finally(() => {\n refreshInProgress = null;\n });\n await refreshInProgress;\n }\n\n function getStatus(): Promise<{\n authenticated: boolean;\n method: string;\n expiresAt: string | null;\n workspaceId: string | null;\n organizationId: string | null;\n workspaceTokenExpiresAt: string | null;\n hasWorkspaceToken: boolean;\n hasPendingLogin: boolean;\n }> {\n const auth = ctx.auth.read();\n return Promise.resolve({\n authenticated: !!(auth?.accessToken || auth?.apiKey),\n method: auth?.apiKey ? 'api_key' : auth?.accessToken ? 'oauth_token' : 'none',\n expiresAt: auth?.expiresAt ? new Date(auth.expiresAt).toISOString() : null,\n workspaceId: auth?.workspaceId ?? null,\n organizationId: auth?.organizationId ?? null,\n workspaceTokenExpiresAt: auth?.workspaceTokenExpiresAt\n ? new Date(auth.workspaceTokenExpiresAt).toISOString()\n : null,\n hasWorkspaceToken: !!auth?.workspaceToken,\n hasPendingLogin: !!pending,\n });\n }\n\n async function logout(): Promise<void> {\n pending = null;\n ctx.auth.clear();\n ctx.gql.reset();\n notify();\n ctx.logger.info('Logged out and cleared stored tokens');\n }\n\n function getHeaders(): Record<string, string> {\n const auth = ctx.auth.read();\n const headers: Record<string, string> = {};\n if (auth?.apiKey) headers['X-API-Key'] = auth.apiKey;\n if (auth?.accessToken) headers['Authorization'] = `Bearer ${auth.accessToken}`;\n if (auth?.workspaceToken)\n headers['X-Workspace-Authorization'] = `Bearer ${auth.workspaceToken}`;\n if (auth?.organizationId) headers['x-org-id'] = auth.organizationId;\n if (auth?.workspaceId) headers['x-workspace-id'] = auth.workspaceId;\n return headers;\n }\n\n function isLoggedIn(): boolean {\n const auth = ctx.auth.read();\n return !!(auth?.accessToken || auth?.apiKey);\n }\n\n function setOnTokensChanged(cb: () => void): void {\n onTokensChanged = cb;\n }\n\n return {\n startLogin,\n completeLogin,\n selectWorkspace,\n listWorkspaces,\n ensureAuthenticated,\n getStatus,\n logout,\n getHeaders,\n isLoggedIn,\n setOnTokensChanged,\n };\n}\n","/**\n * Error classes for MCP SDK.\n *\n * Modules MUST throw these instead of throwing raw Errors. The registerTool\n * wrapper in result.ts catches and maps them to MCP-protocol-compliant\n * `{ isError: true, content: [...] }` responses.\n *\n * Throwing past the wrapper to the protocol surfaces as JSON-RPC -32603 to\n * the client and is a protocol bug.\n */\n\nexport class McpUserError extends Error {\n public readonly hint: string | undefined;\n\n constructor(message: string, opts?: { hint?: string }) {\n super(message);\n this.name = 'McpUserError';\n this.hint = opts?.hint;\n }\n}\n\nexport class McpAuthError extends McpUserError {\n constructor(message: string, opts?: { hint?: string }) {\n super(message, {\n hint: opts?.hint ?? 'Run the auth_login tool to authenticate.',\n });\n this.name = 'McpAuthError';\n }\n}\n\nexport class McpInternalError extends Error {\n public override readonly cause: unknown;\n\n constructor(message: string, cause?: unknown) {\n super(message);\n this.name = 'McpInternalError';\n this.cause = cause;\n }\n}\n","/**\n * Tool / resource / prompt naming helpers.\n *\n * Mandatory product prefix avoids collisions when Claude Desktop runs\n * multiple MCP servers concurrently (typical setup is ~6).\n *\n * Tool names are capped at 63 characters — Claude Desktop pre-1.x\n * truncated at 64 in some versions.\n */\n\nimport { McpInternalError } from './errors.js';\n\nconst MAX_TOOL_NAME_LENGTH = 63;\n\nfunction assertSafeName(name: string, kind: 'tool' | 'resource' | 'prompt'): string {\n if (kind === 'tool' && name.length > MAX_TOOL_NAME_LENGTH) {\n throw new McpInternalError(\n `Tool name '${name}' exceeds ${MAX_TOOL_NAME_LENGTH} characters (some MCP clients truncate at 64).`,\n );\n }\n return name;\n}\n\n/**\n * Build a tool name. Format: `<productName>_<...parts>` (snake_case).\n * Example: mcpToolName('vibecontrols', 'vibes', 'list') -> 'vibecontrols_vibes_list'\n */\nexport function mcpToolName(productName: string, ...parts: string[]): string {\n if (!productName) {\n throw new McpInternalError('mcpToolName: productName is required');\n }\n const name = [productName, ...parts].filter(Boolean).join('_');\n return assertSafeName(name, 'tool');\n}\n\n/**\n * Build a resource URI. Format: `<productName>://<...parts>`.\n * Example: mcpResourceUri('vibecontrols', 'schema') -> 'vibecontrols://schema'\n */\nexport function mcpResourceUri(productName: string, ...parts: string[]): string {\n if (!productName) {\n throw new McpInternalError('mcpResourceUri: productName is required');\n }\n return `${productName}://${parts.filter(Boolean).join('/')}`;\n}\n\n/**\n * Build a prompt name. Format: `<productName>-<...parts>` (kebab-case).\n * Example: mcpPromptName('vibecontrols', 'setup') -> 'vibecontrols-setup'\n */\nexport function mcpPromptName(productName: string, ...parts: string[]): string {\n if (!productName) {\n throw new McpInternalError('mcpPromptName: productName is required');\n }\n return [productName, ...parts].filter(Boolean).join('-');\n}\n\nexport const TOOL_NAME_LIMIT = MAX_TOOL_NAME_LENGTH;\n\n/**\n * Name-based hint heuristics for MCP `annotations` (readOnlyHint /\n * destructiveHint). Used by tool-governance.ts to auto-fill annotations for\n * the fleet of product modules that call `server.registerTool` directly\n * (bypassing the `registerTool()` core helper) and so never set them\n * explicitly today (BOFF-3903). Deliberately conservative — matched against\n * whole `_`-delimited segments so e.g. `timeentries_delete` and\n * `pomodoro_delete_goal` match, but a hypothetical `undeletable_check`\n * would not.\n *\n * A module can always override the inference by passing an explicit\n * `annotations` object to `registerTool()` / `server.registerTool()`.\n */\nconst DESTRUCTIVE_NAME_SEGMENT = /(?:^|_)delete(?:_|$)/i;\nconst READ_ONLY_NAME_SEGMENT = /(?:^|_)(?:list|get|search|check|read|count|stats|by_date)(?:_|$)/i;\n\n/** True when a tool name looks destructive (irreversibly deletes data) by naming convention. */\nexport function inferDestructiveHint(toolName: string): boolean {\n return DESTRUCTIVE_NAME_SEGMENT.test(toolName);\n}\n\n/**\n * True when a tool name looks read-only by naming convention. Never true for\n * a name that also looks destructive (a tool can't be both).\n */\nexport function inferReadOnlyHint(toolName: string): boolean {\n return !inferDestructiveHint(toolName) && READ_ONLY_NAME_SEGMENT.test(toolName);\n}\n","/**\n * MCP tool result helpers + central handler.\n *\n * Modules NEVER call server.registerTool directly — they use registerTool()\n * from this module so the central try/catch wraps the handler and:\n * - maps thrown McpUserError / McpAuthError / McpInternalError to\n * MCP-protocol-compliant `{ isError: true, content: [...] }` shapes\n * - threads `_meta.progressToken` into ctx.progress for long ops\n * - emits a structured log line on every error\n * - never leaks `cause` from McpInternalError to the client\n *\n * This is the analog of cli-sdk's createProgram() central error handler.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { ZodRawShape } from 'zod';\nimport type { McpContext } from './context.js';\nimport { McpAuthError, McpInternalError, McpUserError } from './errors.js';\nimport type { ToolAnnotations } from './tool-governance.js';\n\nexport interface ToolTextContent {\n type: 'text';\n text: string;\n [k: string]: unknown;\n}\n\nexport interface ToolResult {\n content: ToolTextContent[];\n isError?: boolean;\n structuredContent?: Record<string, unknown>;\n [k: string]: unknown;\n}\n\nexport interface ToolMeta {\n progressToken?: string | number;\n}\n\n/**\n * Build a successful tool result with JSON content (pretty-printed).\n */\nexport function jsonResult(data: unknown, structured?: Record<string, unknown>): ToolResult {\n const result: ToolResult = {\n content: [{ type: 'text', text: JSON.stringify(data, null, 2) }],\n };\n if (structured !== undefined) {\n result.structuredContent = structured;\n }\n return result;\n}\n\n/**\n * Build a successful tool result with plain text content.\n */\nexport function textResult(text: string): ToolResult {\n return { content: [{ type: 'text', text }] };\n}\n\n/**\n * Build an error tool result. Honors MCP's `{ isError: true, content }` shape.\n * Optional hint is appended on a new line so the LLM can react.\n */\nexport function errorResult(message: string, hint?: string): ToolResult {\n const text = hint ? `${message}\\n\\nHint: ${hint}` : message;\n return { content: [{ type: 'text', text }], isError: true };\n}\n\nexport interface ToolMetadata {\n title: string;\n description: string;\n inputSchema?: ZodRawShape;\n /**\n * Explicit MCP annotations (readOnlyHint / destructiveHint / ...). Optional\n * — when omitted, `wrapServerWithToolGovernance` (applied centrally in\n * `createMcpServer`) infers them from the tool name. Set this to override\n * the inference for a tool whose name doesn't match the naming convention.\n */\n annotations?: ToolAnnotations;\n}\n\nexport type ToolHandler<TArgs = Record<string, unknown>> = (\n args: TArgs,\n ctx: McpContext,\n meta: ToolMeta,\n) => Promise<unknown>;\n\n/**\n * Register a tool with the central error wrapper.\n *\n * The handler returns a plain value or void. The wrapper:\n * - wraps non-undefined returns in jsonResult()\n * - if the value already looks like a ToolResult (has `content`), passes through\n * - catches McpAuthError / McpUserError / McpInternalError / generic Error\n * - logs every error via ctx.logger.error\n */\nexport function registerTool<TArgs extends Record<string, unknown>>(\n server: McpServer,\n ctx: McpContext,\n name: string,\n metadata: ToolMetadata,\n handler: ToolHandler<TArgs>,\n): void {\n const sdkConfig = {\n title: metadata.title,\n description: metadata.description,\n ...(metadata.inputSchema ? { inputSchema: metadata.inputSchema } : {}),\n ...(metadata.annotations ? { annotations: metadata.annotations } : {}),\n };\n\n // The MCP SDK's registerTool signature is `(name, config, handler)`. The\n // handler arity depends on whether inputSchema is present (1-arg without,\n // 2-arg with). We accept a unified handler shape and dispatch at runtime.\n // The SDK's typing is strict and conditional on the inputSchema generic;\n // bypass with a cast since runtime acceptance is unconditional.\n const wrapped = async (...callbackArgs: unknown[]): Promise<ToolResult> => {\n const hasArgs = callbackArgs.length === 2;\n const args = (hasArgs ? callbackArgs[0] : {}) as TArgs;\n const extra = (hasArgs ? callbackArgs[1] : callbackArgs[0]) as\n { _meta?: { progressToken?: string | number } } | undefined;\n\n const progressToken = extra?._meta?.progressToken;\n const meta: ToolMeta = progressToken !== undefined ? { progressToken } : {};\n\n try {\n const result = await handler(args, ctx, meta);\n if (isToolResult(result)) return result;\n if (result === undefined) return textResult('OK');\n return jsonResult(result);\n } catch (error) {\n return mapErrorToResult(error, ctx, name);\n }\n };\n\n // eslint-disable-next-line @typescript-eslint/no-explicit-any\n (server as any).registerTool(name, sdkConfig, wrapped);\n}\n\nfunction isToolResult(value: unknown): value is ToolResult {\n return (\n !!value &&\n typeof value === 'object' &&\n 'content' in value &&\n Array.isArray((value as ToolResult).content)\n );\n}\n\nfunction mapErrorToResult(error: unknown, ctx: McpContext, toolName: string): ToolResult {\n if (error instanceof McpAuthError) {\n ctx.logger.warn(`${toolName}: auth required`, { message: error.message });\n return errorResult(error.message, error.hint);\n }\n if (error instanceof McpUserError) {\n ctx.logger.info(`${toolName}: user error`, { message: error.message });\n return errorResult(error.message, error.hint);\n }\n if (error instanceof McpInternalError) {\n ctx.logger.error(`${toolName}: internal error`, {\n message: error.message,\n cause: stringifyCause(error.cause),\n });\n return errorResult(`Internal error in ${toolName}.`);\n }\n const message = error instanceof Error ? error.message : String(error);\n ctx.logger.error(`${toolName}: unhandled error`, { message });\n return errorResult(`${toolName}: ${message}`);\n}\n\nfunction stringifyCause(cause: unknown): string | undefined {\n if (cause === undefined || cause === null) return undefined;\n if (cause instanceof Error) return cause.message;\n try {\n return JSON.stringify(cause);\n } catch {\n return String(cause);\n }\n}\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { getAuth } from '../auth/legacy-auth.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\n\nexport function registerAuthTools(\n server: McpServer,\n ctx: McpContext,\n track: (n: string) => string,\n): void {\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_login')),\n {\n title: 'Start Login',\n description:\n 'Start the device code login flow. Returns a verification URL and user code immediately (non-blocking). The user must open the URL in a browser and enter the code, then call vibecontrols_auth_complete to finish.',\n inputSchema: {},\n },\n async () => {\n try {\n const auth = getAuth(ctx);\n const result = await auth.startLogin();\n return jsonResult(result);\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_login failed', { error });\n return errorResult(\n `Login failed: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_complete')),\n {\n title: 'Complete Login',\n description:\n 'Check if the user has completed the device code authorization in their browser. Call this after the user has opened the verification URL and entered the code from vibecontrols_auth_login. Returns \"pending\" if not yet authorized, \"authenticated\" on success.',\n inputSchema: {},\n },\n async () => {\n try {\n const auth = getAuth(ctx);\n const result = await auth.completeLogin();\n return jsonResult(result);\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_complete failed', { error });\n return errorResult(\n `Login completion failed: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_select_workspace')),\n {\n title: 'Select Workspace',\n description:\n 'Select a workspace after login (when multiple workspaces are available). Issues a workspace-scoped token.',\n inputSchema: {\n workspaceId: z.string().describe('Workspace ID to select'),\n organizationId: z.string().describe('Organization ID for the workspace'),\n },\n },\n async ({ workspaceId, organizationId }) => {\n try {\n const auth = getAuth(ctx);\n await auth.selectWorkspace(workspaceId, organizationId);\n return jsonResult({\n status: 'workspace_selected',\n workspaceId,\n message: `Workspace ${workspaceId} selected and token issued.`,\n });\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_select_workspace failed', { error });\n return errorResult(\n `Failed to select workspace: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_workspaces')),\n {\n title: 'List Workspaces',\n description: 'List all workspaces available to the authenticated user.',\n inputSchema: {},\n },\n async () => {\n try {\n const auth = getAuth(ctx);\n const workspaces = await auth.listWorkspaces();\n return jsonResult({ workspaces, total: workspaces.length });\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_workspaces failed', { error });\n return errorResult(\n `Failed to list workspaces: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_status')),\n {\n title: 'Auth Status',\n description:\n 'Show current authentication status including method, token expiration, workspace info, and pending login state.',\n inputSchema: {},\n },\n async () => {\n try {\n const auth = getAuth(ctx);\n const status = await auth.getStatus();\n return jsonResult(status);\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_status failed', { error });\n return errorResult(\n `Failed to get auth status: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_logout')),\n {\n title: 'Logout',\n description: 'Log out and clear all stored authentication tokens.',\n inputSchema: {},\n },\n async () => {\n try {\n const auth = getAuth(ctx);\n await auth.logout();\n return jsonResult({\n status: 'logged_out',\n message: 'Tokens cleared successfully.',\n });\n } catch (error) {\n ctx.logger.error('vibecontrols_auth_logout failed', { error });\n return errorResult(\n `Logout failed: ${error instanceof Error ? error.message : String(error)}`,\n );\n }\n },\n );\n}\n","/**\n * Extended auth GraphQL operations (Phase 2 additions).\n *\n * Ported verbatim from cli-sdk/src/modules/auth/extra-operations.ts so the\n * field selections stay aligned across CLI and MCP. All operations live on\n * the global gateway; calling code uses ctx.gql.global.request().\n */\n\n// ── SDK-parity operations ────────────────────────────────────────────────\n// Mirror sdk-libs-node/src/modules/auth/operations.ts so MCP tools that close\n// the parity gap (auth_sign_up / auth_authenticate_app / auth_sign_in /\n// auth_refresh_token / etc.) hit the same backend mutations as the SDK.\n\nexport const SIGN_UP = `\n mutation SignUp($input: SignUpInput!) {\n signUp(input: $input) {\n user { id email username }\n accessToken\n refreshToken\n expiresIn\n }\n }\n`;\n\nexport const SIGN_IN = `\n mutation SignIn($input: SignInInput!) {\n signIn(input: $input) {\n user { id email username }\n accessToken\n refreshToken\n expiresIn\n }\n }\n`;\n\nexport const REFRESH_TOKEN_OP = `\n mutation RefreshToken($token: String!) {\n refreshToken(token: $token) {\n user { id email username }\n accessToken\n refreshToken\n expiresIn\n }\n }\n`;\n\nexport const SIGN_OUT = `\n mutation SignOut {\n signOut\n }\n`;\n\nexport const AUTHENTICATE_APP = `\n mutation AuthenticateApp($input: AuthenticateAppInput!) {\n authenticateApp(input: $input) {\n accessToken\n tokenType\n expiresIn\n scopes\n }\n }\n`;\n\nexport const CURRENT_USER = `\n query currentUser {\n currentUser {\n id email firstName lastName username phoneNumber name\n emailVerified mfaEnabled isAdmin role status createdAt lastLoginAt\n }\n }\n`;\n\nexport const UPDATE_CURRENT_USER_PROFILE = `\n mutation updateCurrentUserProfile($input: UpdateUserInput!) {\n updateCurrentUserProfile(input: $input) {\n id name firstName lastName username phoneNumber timezone language\n }\n }\n`;\n\n// Connection shapes pinned to global-auth-svc origin/main (BOFF-9283/9285).\nexport const AUTH_AUDIT_LOGS = `\n query authAuditLogs($pagination: PaginationInput) {\n authAuditLogs(pagination: $pagination) {\n auditLogs {\n id action resource resourceType resourceId description\n ipAddress userAgent metadata createdAt\n }\n hasMore totalCount\n }\n }\n`;\n\nexport const ACTIVE_SESSIONS = `\n query activeSessions($pagination: PaginationInput) {\n activeSessions(pagination: $pagination) {\n sessions { id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent }\n hasMore totalCount\n }\n }\n`;\n\nexport const REVOKE_SESSION = `\n mutation revokeSession($sessionId: ID!) {\n revokeSession(sessionId: $sessionId)\n }\n`;\n\nexport const CURRENT_USER_MFA_METHODS = `\n query currentUserMFAMethods($pagination: PaginationInput) {\n currentUserMFAMethods(pagination: $pagination) {\n methods { id method status createdAt updatedAt }\n hasMore totalCount\n }\n }\n`;\n\nexport const SETUP_MFA = `\n mutation setupMFA($method: MFAMethod!) {\n setupMFA(method: $method) {\n method backupCodes qrCode secret\n }\n }\n`;\n\nexport const VERIFY_MFA = `\n mutation verifyMFA($input: MFAVerifyInput!) {\n verifyMFA(input: $input) {\n success token expiresIn user { id email }\n }\n }\n`;\n\nexport const ENABLE_MFA = `\n mutation enableMFA($code: String!) {\n enableMFA(code: $code)\n }\n`;\n\nexport const DISABLE_MFA = `\n mutation disableMFA {\n disableMFA\n }\n`;\n\n// Live `APIKeyConnection` exposes the list under `apiKeys` (NOT a relay\n// connection — no `edges`/`total`/`hasMore`). The `isActive` field was\n// removed from `APIKey` along with the same field on the devportal side.\nexport const MY_API_KEYS = `\n query myApiKeys($pagination: PaginationInput) {\n myApiKeys(pagination: $pagination) {\n apiKeys { id name prefix appId appName scopes expiresAt lastUsedAt createdAt }\n }\n }\n`;\n\nexport const APP_API_KEYS = `\n query appApiKeys($appId: ID!, $pagination: PaginationInput) {\n appApiKeys(appId: $appId, pagination: $pagination) {\n apiKeys { id name prefix appId appName scopes expiresAt lastUsedAt createdAt }\n }\n }\n`;\n\nexport const GENERATE_API_KEY = `\n mutation generateAPIKey($input: GenerateAPIKeyInput!) {\n generateAPIKey(input: $input) {\n keyId apiKey apiSecret\n }\n }\n`;\n\nexport const UPDATE_API_KEY = `\n mutation updateAPIKey($keyId: String!, $input: UpdateAPIKeyInput!) {\n updateAPIKey(keyId: $keyId, input: $input) {\n id name scope expiresAt\n }\n }\n`;\n\nexport const REVOKE_API_KEY = `\n mutation revokeAPIKey($keyId: String!) {\n revokeAPIKey(keyId: $keyId)\n }\n`;\n\nexport const ROTATE_API_KEY = `\n mutation rotateAPIKey($keyId: String!) {\n rotateAPIKey(keyId: $keyId) {\n apiSecret\n }\n }\n`;\n\nexport const CURRENT_USER_DELEGATIONS = `\n query currentUserDelegations($pagination: PaginationInput) {\n currentUserDelegations(pagination: $pagination) {\n delegations {\n id appId userId grantedBy grantedAt expiresAt scopes workspaceIds\n status revokedAt revokedBy\n app { id name }\n }\n hasMore totalCount\n }\n }\n`;\n\nexport const GRANT_DELEGATION = `\n mutation grantDelegation($input: GrantDelegationInput!) {\n grantDelegation(input: $input) {\n id appId userId grantedBy grantedAt expiresAt scopes workspaceIds status\n }\n }\n`;\n\nexport const REVOKE_DELEGATION = `\n mutation revokeDelegation($id: ID!, $reason: String) {\n revokeDelegation(id: $id, reason: $reason)\n }\n`;\n\n// Live `AppConnection` exposes the list under `apps` (NOT a relay\n// connection — no `edges`/`total`/`hasMore`). The selection below is\n// unchanged from the previous mcp-libs shape, just nested one level\n// deeper.\nexport const CURRENT_USER_APPS = `\n query currentUserApps($pagination: PaginationInput) {\n currentUserApps(pagination: $pagination) {\n apps { id clientId name description type actorType status ownerUserId redirectUris scopes createdAt updatedAt }\n }\n }\n`;\n\nexport const GET_APP = `\n query app($id: ID!) {\n app(id: $id) {\n id clientId name description type actorType status ownerUserId redirectUris scopes\n }\n }\n`;\n\nexport const CREATE_APP = `\n mutation createApp($input: CreateAppInput!) {\n createApp(input: $input) {\n app { id clientId name type status }\n clientSecret\n }\n }\n`;\n\nexport const UPDATE_APP = `\n mutation updateApp($id: ID!, $input: UpdateAppInput!) {\n updateApp(id: $id, input: $input) {\n id name description redirectUris scopes status\n }\n }\n`;\n\nexport const DEACTIVATE_APP = `\n mutation deactivateApp($id: ID!) {\n deactivateApp(id: $id)\n }\n`;\n\nexport const GET_SSO_CONFIG = `\n query getSSOConfig($tenantId: String!) {\n getSSOConfig(tenantId: $tenantId) {\n id identifier tenantId entityId ssoUrl sloUrl certificate enabled metadata\n }\n }\n`;\n\nexport const SAVE_SSO_CONFIG = `\n mutation saveSSOConfig($tenantId: String!, $input: SSOConfigInput!) {\n saveSSOConfig(tenantId: $tenantId, input: $input) {\n id identifier entityId ssoUrl sloUrl certificate enabled\n }\n }\n`;\n\nexport const DELETE_SSO_CONFIG = `\n mutation deleteSSOConfig($tenantId: String!) {\n deleteSSOConfig(tenantId: $tenantId)\n }\n`;\n\nexport const LIST_USERS = `\n query users($filter: UserFilterInput, $pagination: PaginationInput) {\n users(filter: $filter, pagination: $pagination) {\n users { id email firstName lastName username role status createdAt }\n totalCount hasMore\n }\n }\n`;\n\nexport const GET_USER = `\n query user($id: ID!) {\n user(id: $id) {\n id email firstName lastName username role status emailVerified lastLoginAt\n }\n }\n`;\n\nexport const UPDATE_USER = `\n mutation updateUser($id: ID!, $input: AdminUpdateUserInput!) {\n updateUser(id: $id, input: $input) {\n id email firstName lastName username role status\n }\n }\n`;\n\n// inviteUser removed in BOFF-9212 — the underlying mutation is not defined\n// on any global/wspace subgraph. The `auth_users_invite` MCP tool was\n// deleted from extra-tools.ts.\n","/**\n * SDK-parity auth tools (Phase 2.1) — closes the gap between\n * sdk-libs-node/src/modules/auth/api.ts and the MCP surface.\n *\n * Adds the 4 auth flows that have NO existing MCP equivalent and are\n * meaningful for an AI agent driving the SDK:\n *\n * - auth_sign_up → email/password account registration\n * - auth_sign_in → email/password sign-in (distinct from\n * the device-code `auth_login`)\n * - auth_refresh_token → explicit token refresh (the gql client\n * auto-refreshes; this exposes the\n * mutation for headless/test callers)\n * - auth_get_current_user → SDK `me` query (newer, lighter shape\n * than the `currentUser` query already\n * backing auth_profile_get)\n * - auth_authenticate_app → M2M auth via GraphQL `authenticateApp`\n * mutation; persists token.\n * - auth_login_with_api_key → stash an API key in the auth store so\n * the gql client sends `X-API-Key`\n * - auth_login_with_client_credentials → OAuth2 client_credentials grant\n * (REST against oidcIssuer/token)\n *\n * All token-persisting tools write through `ctx.auth.write()` and\n * `ctx.gql.reset()` so subsequent module calls use the freshly-issued tokens\n * without restarting the MCP server.\n */\n\nimport { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport { clientCredentialsFlow } from '../../core/auth/device-code.js';\nimport * as ops from './operations.js';\n\ninterface AuthPayload {\n user: { id: string; email: string; username: string };\n accessToken: string;\n refreshToken: string;\n expiresIn: number;\n}\n\ninterface AuthCodeExchangeResult {\n accessToken: string;\n tokenType: string;\n expiresIn: number;\n scopes: string[];\n}\n\nfunction err(\n ctx: McpContext,\n name: string,\n message: string,\n error: unknown,\n): ReturnType<typeof errorResult> {\n ctx.logger.error(`${name} failed`, { error });\n return errorResult(`${message}: ${error instanceof Error ? error.message : String(error)}`);\n}\n\nfunction persistOAuthTokens(ctx: McpContext, payload: AuthPayload): void {\n const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n ctx.auth.write({\n ...existing,\n accessToken: payload.accessToken,\n refreshToken: payload.refreshToken,\n expiresAt: Date.now() + payload.expiresIn * 1000,\n authMethod: 'device_code',\n });\n ctx.gql.reset();\n}\n\nexport function registerAuthMoreTools(\n server: McpServer,\n ctx: McpContext,\n track: (n: string) => string,\n): void {\n // ── auth sign_up / sign_in / refresh / sign_out / get_current_user ──────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sign_up')),\n {\n title: 'Sign Up',\n description:\n 'Register a new account via email/username/password and immediately sign in. Persists access + refresh tokens. Returns { user, accessToken, refreshToken, expiresIn }.',\n inputSchema: {\n email: z.string().describe('Email address for the new account'),\n username: z.string().describe('Username (must be unique)'),\n password: z.string().describe('Password (caller is responsible for strength policy)'),\n firstName: z.string().optional().describe('Optional first name'),\n lastName: z.string().optional().describe('Optional last name'),\n },\n },\n async ({ email, username, password, firstName, lastName }) => {\n try {\n const input: Record<string, unknown> = { email, username, password };\n if (firstName !== undefined) input.firstName = firstName;\n if (lastName !== undefined) input.lastName = lastName;\n const d = await ctx.gql.global.request<{ signUp: AuthPayload }>(ops.SIGN_UP, { input });\n persistOAuthTokens(ctx, d.signUp);\n return jsonResult({\n status: 'authenticated',\n user: d.signUp.user,\n accessToken: d.signUp.accessToken,\n refreshToken: d.signUp.refreshToken,\n expiresIn: d.signUp.expiresIn,\n });\n } catch (e) {\n return err(ctx, 'auth_sign_up', 'Sign up failed', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sign_in')),\n {\n title: 'Sign In',\n description:\n 'Sign in with username + password (server-side credential flow, distinct from the device-code `auth_login`). Persists access + refresh tokens. Returns { user, accessToken, refreshToken, expiresIn }.',\n inputSchema: {\n username: z.string().describe('Username or email'),\n password: z.string().describe('Password'),\n },\n },\n async ({ username, password }) => {\n try {\n const d = await ctx.gql.global.request<{ signIn: AuthPayload }>(ops.SIGN_IN, {\n input: { username, password },\n });\n persistOAuthTokens(ctx, d.signIn);\n return jsonResult({\n status: 'authenticated',\n user: d.signIn.user,\n accessToken: d.signIn.accessToken,\n refreshToken: d.signIn.refreshToken,\n expiresIn: d.signIn.expiresIn,\n });\n } catch (e) {\n return err(ctx, 'auth_sign_in', 'Sign in failed', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_refresh_token')),\n {\n title: 'Refresh Token',\n description:\n 'Exchange the stored refreshToken for a fresh access + refresh pair. The gql client auto-refreshes when tokens are near expiry; use this tool only when you need to force a refresh now. Persists new tokens. Returns the new { accessToken, expiresIn }.',\n inputSchema: {},\n },\n async () => {\n try {\n const existing = ctx.auth.read();\n if (!existing?.refreshToken) {\n return errorResult(\n 'No refresh token available. Sign in first via auth_sign_in / auth_sign_up / auth_login.',\n );\n }\n const d = await ctx.gql.global.request<{ refreshToken: AuthPayload }>(\n ops.REFRESH_TOKEN_OP,\n {\n token: existing.refreshToken,\n },\n );\n persistOAuthTokens(ctx, d.refreshToken);\n return jsonResult({\n status: 'refreshed',\n accessToken: d.refreshToken.accessToken,\n expiresIn: d.refreshToken.expiresIn,\n });\n } catch (e) {\n return err(ctx, 'auth_refresh_token', 'Token refresh failed', e);\n }\n },\n );\n\n // ── M2M / headless auth flows ───────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_authenticate_app')),\n {\n title: 'Authenticate App',\n description:\n 'Machine-to-machine auth via the `authenticateApp` GraphQL mutation. Pass an OAuth app client_id + client_secret (and optional scopes) to receive an access token; persists token for subsequent calls. Returns { accessToken, tokenType, expiresIn, scopes }.',\n inputSchema: {\n clientId: z.string().describe('OAuth app clientId'),\n clientSecret: z\n .string()\n .describe('OAuth app clientSecret (shown only once on app creation)'),\n scopes: z\n .array(z.string())\n .optional()\n .describe('Optional list of scope strings to request'),\n },\n },\n async ({ clientId, clientSecret, scopes }) => {\n try {\n const input: Record<string, unknown> = { clientId, clientSecret };\n if (scopes !== undefined) input.scopes = scopes;\n const d = await ctx.gql.global.request<{ authenticateApp: AuthCodeExchangeResult }>(\n ops.AUTHENTICATE_APP,\n { input },\n );\n const result = d.authenticateApp;\n const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n ctx.auth.write({\n ...existing,\n accessToken: result.accessToken,\n refreshToken: '',\n expiresAt: Date.now() + result.expiresIn * 1000,\n authMethod: 'client_credentials',\n clientId,\n clientSecret,\n });\n ctx.gql.reset();\n return jsonResult({\n status: 'authenticated',\n accessToken: result.accessToken,\n tokenType: result.tokenType,\n expiresIn: result.expiresIn,\n scopes: result.scopes,\n });\n } catch (e) {\n return err(ctx, 'auth_authenticate_app', 'App authentication failed', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_login_with_api_key')),\n {\n title: 'Login with API Key',\n description:\n 'Authenticate with a pre-issued API key (headless service mode). The key is stored locally and sent as `X-API-Key` on every gateway request; no network call is made by this tool. Use auth_status to verify. Returns { status: \"authenticated\", method: \"api_key\" }.',\n inputSchema: {\n apiKey: z.string().describe('Pre-issued API key (e.g. from auth_api_keys_create)'),\n },\n },\n async ({ apiKey }) => {\n try {\n const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n ctx.auth.write({\n ...existing,\n apiKey,\n authMethod: 'api_key',\n });\n ctx.gql.reset();\n return jsonResult({\n status: 'authenticated',\n method: 'api_key',\n message: 'API key stored. Subsequent calls will use X-API-Key.',\n });\n } catch (e) {\n return err(ctx, 'auth_login_with_api_key', 'Failed to set API key', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_login_with_client_credentials')),\n {\n title: 'Login with Client Credentials',\n description:\n 'OAuth2 client_credentials grant (REST against oidcIssuer/token). Equivalent to auth_authenticate_app but uses the OIDC token endpoint instead of the GraphQL mutation; prefer auth_authenticate_app inside the platform. Persists the issued token. Returns { accessToken, expiresIn, scopes }.',\n inputSchema: {\n clientId: z.string().describe('OAuth app clientId'),\n clientSecret: z.string().describe('OAuth app clientSecret'),\n scopes: z.array(z.string()).optional().describe('Optional list of scope strings'),\n },\n },\n async ({ clientId, clientSecret, scopes }) => {\n try {\n const cfg = ctx.config.read();\n const result = await clientCredentialsFlow(\n cfg.globalEndpoint,\n clientId,\n clientSecret,\n scopes,\n );\n const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n ctx.auth.write({\n ...existing,\n accessToken: result.accessToken,\n refreshToken: '',\n expiresAt: Date.now() + result.expiresIn * 1000,\n authMethod: 'client_credentials',\n clientId,\n clientSecret,\n });\n ctx.gql.reset();\n return jsonResult({\n status: 'authenticated',\n accessToken: result.accessToken,\n expiresIn: result.expiresIn,\n scopes: result.scopes,\n });\n } catch (e) {\n return err(ctx, 'auth_login_with_client_credentials', 'Client credentials login failed', e);\n }\n },\n );\n}\n","/**\n * Extended auth surface (Phase 2) as MCP tools.\n *\n * Ported from cli-sdk/src/modules/auth/extra-commands.ts. Each `auth <sub>\n * <verb>` CLI command becomes one MCP tool named `<product>_auth_<sub>_<verb>`.\n *\n * Sub-groups (10):\n * profile — get / update\n * sessions — list / revoke\n * mfa — list / enroll / verify / disable\n * api_keys — list / create / revoke / rotate\n * audit_log — query\n * delegations — list / grant / revoke\n * apps — list / get / create / update / deactivate / authorize_url / revoke\n * sso — list / configure / test / delete\n * users — list / get / invite / update\n * security — summary\n *\n * Browser-only flows (register / reset-password / magic-link / oauth-callback)\n * are NOT exposed; for `apps_authorize` we provide `auth_apps_authorize_url`\n * which returns the URL only.\n *\n * All operations live on the global gateway; calling code uses\n * ctx.gql.global.request().\n */\n\nimport { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport * as ops from './operations.js';\n\ninterface UserRow {\n id: string;\n email: string;\n firstName?: string;\n lastName?: string;\n username?: string;\n role?: string;\n status?: string;\n createdAt?: string;\n}\n\nfunction err(\n ctx: McpContext,\n name: string,\n message: string,\n error: unknown,\n): ReturnType<typeof errorResult> {\n ctx.logger.error(`${name} failed`, { error });\n return errorResult(`${message}: ${error instanceof Error ? error.message : String(error)}`);\n}\n\nexport function registerAuthExtraTools(\n server: McpServer,\n ctx: McpContext,\n track: (n: string) => string,\n): void {\n // ── auth profile ────────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_profile_get')),\n {\n title: 'Get Profile',\n description: 'Show the current authenticated user (id, email, name, role, status).',\n inputSchema: {},\n },\n async () => {\n try {\n const d = await ctx.gql.global.request<{ currentUser: Record<string, unknown> }>(\n ops.CURRENT_USER,\n );\n return jsonResult(d.currentUser);\n } catch (e) {\n return err(ctx, 'auth_profile_get', 'Failed to fetch profile', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_profile_update')),\n {\n title: 'Update Profile',\n description: 'Update the current user profile (any subset of fields).',\n inputSchema: {\n firstName: z.string().optional(),\n lastName: z.string().optional(),\n name: z.string().optional(),\n username: z.string().optional(),\n phoneNumber: z.string().optional(),\n timezone: z.string().optional(),\n language: z.string().optional(),\n },\n },\n async (args) => {\n try {\n const input: Record<string, unknown> = {};\n if (args.firstName !== undefined) input.firstName = args.firstName;\n if (args.lastName !== undefined) input.lastName = args.lastName;\n if (args.name !== undefined) input.name = args.name;\n if (args.username !== undefined) input.username = args.username;\n if (args.phoneNumber !== undefined) input.phoneNumber = args.phoneNumber;\n if (args.timezone !== undefined) input.timezone = args.timezone;\n if (args.language !== undefined) input.language = args.language;\n if (Object.keys(input).length === 0) {\n return errorResult('No updates specified — provide at least one field.');\n }\n const d = await ctx.gql.global.request<{\n updateCurrentUserProfile: Record<string, unknown>;\n }>(ops.UPDATE_CURRENT_USER_PROFILE, { input });\n return jsonResult({ status: 'success', user: d.updateCurrentUserProfile });\n } catch (e) {\n return err(ctx, 'auth_profile_update', 'Failed to update profile', e);\n }\n },\n );\n\n // ── auth sessions ───────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sessions_list')),\n {\n title: 'List Active Sessions',\n description: 'List active sessions for the current user (browser/device sessions).',\n inputSchema: {\n limit: z.number().optional().describe('Page size (default 50)'),\n offset: z.number().optional(),\n },\n },\n async ({ limit, offset }) => {\n try {\n const d = await ctx.gql.global.request<{\n activeSessions: {\n sessions: Array<Record<string, unknown>>;\n hasMore: boolean;\n totalCount: number;\n };\n }>(ops.ACTIVE_SESSIONS, {\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({\n sessions: d.activeSessions.sessions,\n total: d.activeSessions.totalCount,\n hasMore: d.activeSessions.hasMore,\n });\n } catch (e) {\n return err(ctx, 'auth_sessions_list', 'Failed to list sessions', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sessions_revoke')),\n {\n title: 'Revoke Session',\n description: 'Revoke (sign out) a single session by id.',\n inputSchema: { sessionId: z.string().describe('Session ID to revoke') },\n },\n async ({ sessionId }) => {\n try {\n await ctx.gql.global.request(ops.REVOKE_SESSION, { sessionId });\n return jsonResult({ status: 'success', message: `Session ${sessionId} revoked.` });\n } catch (e) {\n return err(ctx, 'auth_sessions_revoke', 'Failed to revoke session', e);\n }\n },\n );\n\n // ── auth mfa ────────────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_mfa_list')),\n {\n title: 'List MFA Methods',\n description: 'List MFA methods enrolled for the current user.',\n inputSchema: {\n limit: z.number().optional().describe('Page size (default 50)'),\n offset: z.number().optional(),\n },\n },\n async ({ limit, offset }) => {\n try {\n const d = await ctx.gql.global.request<{\n currentUserMFAMethods: {\n methods: Array<Record<string, unknown>>;\n hasMore: boolean;\n totalCount: number;\n };\n }>(ops.CURRENT_USER_MFA_METHODS, {\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({\n methods: d.currentUserMFAMethods.methods,\n total: d.currentUserMFAMethods.totalCount,\n hasMore: d.currentUserMFAMethods.hasMore,\n });\n } catch (e) {\n return err(ctx, 'auth_mfa_list', 'Failed to list MFA methods', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_mfa_enroll')),\n {\n title: 'Enroll MFA',\n description:\n 'Begin MFA enrollment. Returns the qrCode, secret, and one-time backup codes the user must save BEFORE calling auth_mfa_verify.',\n inputSchema: {\n method: z.enum(['TOTP', 'SMS', 'EMAIL']).describe('MFA method to enroll'),\n },\n },\n async ({ method }) => {\n try {\n const d = await ctx.gql.global.request<{ setupMFA: Record<string, unknown> }>(\n ops.SETUP_MFA,\n { method },\n );\n return jsonResult({\n status: 'enrollment_started',\n enrollment: d.setupMFA,\n message: 'Save your backup codes; verify with auth_mfa_verify.',\n });\n } catch (e) {\n return err(ctx, 'auth_mfa_enroll', 'Failed to enroll MFA', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_mfa_verify')),\n {\n title: 'Verify MFA Enrollment',\n description: 'Verify MFA enrollment by submitting the code from the authenticator.',\n inputSchema: { code: z.string().describe('OTP code from authenticator') },\n },\n async ({ code }) => {\n try {\n await ctx.gql.global.request(ops.ENABLE_MFA, { code });\n return jsonResult({ status: 'success', message: 'MFA enabled.' });\n } catch (e) {\n return err(ctx, 'auth_mfa_verify', 'Failed to verify MFA', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_mfa_disable')),\n {\n title: 'Disable MFA',\n description: 'Disable MFA for the current user.',\n inputSchema: {},\n },\n async () => {\n try {\n await ctx.gql.global.request(ops.DISABLE_MFA);\n return jsonResult({ status: 'success', message: 'MFA disabled.' });\n } catch (e) {\n return err(ctx, 'auth_mfa_disable', 'Failed to disable MFA', e);\n }\n },\n );\n\n // ── auth api keys ───────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_api_keys_list')),\n {\n title: 'List API Keys',\n description: 'List API keys for the current user; pass appId to scope to a specific app.',\n inputSchema: {\n appId: z.string().optional().describe('Restrict to keys owned by an app id'),\n limit: z.number().optional(),\n offset: z.number().optional(),\n },\n },\n async ({ appId, limit, offset }) => {\n try {\n const pagination = { limit: limit ?? 50, offset: offset ?? 0 };\n if (appId) {\n // BOFF-8203: live `AppConnection`/`APIKeyConnection` wrap the list\n // under `apiKeys`. Tool callers still see `{ keys: [...], total: N }`\n // for backwards compat.\n const d = await ctx.gql.global.request<{\n appApiKeys: { apiKeys: Array<Record<string, unknown>> };\n }>(ops.APP_API_KEYS, { appId, pagination });\n return jsonResult({\n keys: d.appApiKeys.apiKeys,\n total: d.appApiKeys.apiKeys.length,\n });\n }\n const d = await ctx.gql.global.request<{\n myApiKeys: { apiKeys: Array<Record<string, unknown>> };\n }>(ops.MY_API_KEYS, { pagination });\n return jsonResult({\n keys: d.myApiKeys.apiKeys,\n total: d.myApiKeys.apiKeys.length,\n });\n } catch (e) {\n return err(ctx, 'auth_api_keys_list', 'Failed to list API keys', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_api_keys_create')),\n {\n title: 'Create API Key',\n description:\n 'Generate a new API key for an app. Returns apiKey + apiSecret — the secret is only shown once.',\n inputSchema: {\n name: z.string().describe('Friendly name for the key'),\n appId: z.string().describe('Owning app id'),\n scopes: z.array(z.string()).min(1).describe('Scope strings (required)'),\n expiresAt: z.string().optional().describe('ISO expiry date'),\n },\n },\n async ({ name, appId, scopes, expiresAt }) => {\n try {\n const input: Record<string, unknown> = { name, appId };\n if (scopes !== undefined) input.scope = scopes;\n if (expiresAt !== undefined) input.expiresAt = expiresAt;\n const d = await ctx.gql.global.request<{\n generateAPIKey: { keyId: string; apiKey: string; apiSecret: string };\n }>(ops.GENERATE_API_KEY, { input });\n return jsonResult({\n status: 'success',\n message: 'API key generated. The apiSecret is only shown ONCE — store it now.',\n key: d.generateAPIKey,\n });\n } catch (e) {\n return err(ctx, 'auth_api_keys_create', 'Failed to create API key', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_api_keys_revoke')),\n {\n title: 'Revoke API Key',\n description: 'Revoke an API key by its keyId.',\n inputSchema: { keyId: z.string().describe('Key ID to revoke') },\n },\n async ({ keyId }) => {\n try {\n await ctx.gql.global.request(ops.REVOKE_API_KEY, { keyId });\n return jsonResult({ status: 'success', message: `API key ${keyId} revoked.` });\n } catch (e) {\n return err(ctx, 'auth_api_keys_revoke', 'Failed to revoke API key', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_api_keys_rotate')),\n {\n title: 'Rotate API Key',\n description:\n 'Rotate an API key — invalidates the previous secret and returns a new one (shown only once).',\n inputSchema: { keyId: z.string().describe('Key ID to rotate') },\n },\n async ({ keyId }) => {\n try {\n const d = await ctx.gql.global.request<{ rotateAPIKey: { apiSecret: string } }>(\n ops.ROTATE_API_KEY,\n { keyId },\n );\n return jsonResult({\n status: 'success',\n message: 'API key rotated. Save the new secret — it is only shown once.',\n apiSecret: d.rotateAPIKey.apiSecret,\n });\n } catch (e) {\n return err(ctx, 'auth_api_keys_rotate', 'Failed to rotate API key', e);\n }\n },\n );\n\n // ── auth audit log ──────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_audit_log_query')),\n {\n title: 'Query Auth Audit Log',\n description: 'Recent auth audit events for the current user.',\n inputSchema: {\n limit: z.number().optional().describe('Page size (default 50)'),\n offset: z.number().optional(),\n },\n },\n async ({ limit, offset }) => {\n try {\n const d = await ctx.gql.global.request<{\n authAuditLogs: {\n auditLogs: Array<Record<string, unknown>>;\n hasMore: boolean;\n totalCount: number;\n };\n }>(ops.AUTH_AUDIT_LOGS, {\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({\n events: d.authAuditLogs.auditLogs,\n total: d.authAuditLogs.totalCount,\n hasMore: d.authAuditLogs.hasMore,\n });\n } catch (e) {\n return err(ctx, 'auth_audit_log_query', 'Failed to query audit log', e);\n }\n },\n );\n\n // ── auth delegations ────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_delegations_list')),\n {\n title: 'List Delegations',\n description: 'Delegations granted by/to the current user.',\n inputSchema: {\n limit: z.number().optional().describe('Page size (default 50)'),\n offset: z.number().optional(),\n },\n },\n async ({ limit, offset }) => {\n try {\n const d = await ctx.gql.global.request<{\n currentUserDelegations: {\n delegations: Array<Record<string, unknown>>;\n hasMore: boolean;\n totalCount: number;\n };\n }>(ops.CURRENT_USER_DELEGATIONS, {\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({\n delegations: d.currentUserDelegations.delegations,\n total: d.currentUserDelegations.totalCount,\n hasMore: d.currentUserDelegations.hasMore,\n });\n } catch (e) {\n return err(ctx, 'auth_delegations_list', 'Failed to list delegations', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_delegations_grant')),\n {\n title: 'Grant Delegation',\n description: 'Grant a delegation to an app (consent on behalf of the calling user).',\n inputSchema: {\n appId: z.string().describe('App id receiving delegation'),\n scopes: z.array(z.string()).min(1).describe('Delegated scopes (required)'),\n workspaceIds: z.array(z.string()).optional(),\n expiresAt: z.string().optional().describe('ISO expiry'),\n },\n },\n async ({ appId, scopes, workspaceIds, expiresAt }) => {\n try {\n // GrantDelegationInput has no userId — the delegation is always granted\n // by the calling user on their own behalf (BOFF-9286).\n const input: Record<string, unknown> = { appId, scopes };\n if (scopes !== undefined) input.scopes = scopes;\n if (workspaceIds !== undefined) input.workspaceIds = workspaceIds;\n if (expiresAt !== undefined) input.expiresAt = expiresAt;\n const d = await ctx.gql.global.request<{ grantDelegation: Record<string, unknown> }>(\n ops.GRANT_DELEGATION,\n { input },\n );\n return jsonResult({ status: 'success', delegation: d.grantDelegation });\n } catch (e) {\n return err(ctx, 'auth_delegations_grant', 'Failed to grant delegation', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_delegations_revoke')),\n {\n title: 'Revoke Delegation',\n description: 'Revoke a delegation by its id.',\n inputSchema: {\n id: z.string().describe('Delegation ID'),\n reason: z.string().optional(),\n },\n },\n async ({ id, reason }) => {\n try {\n await ctx.gql.global.request(ops.REVOKE_DELEGATION, {\n id,\n ...(reason !== undefined ? { reason } : {}),\n });\n return jsonResult({ status: 'success', message: `Delegation ${id} revoked.` });\n } catch (e) {\n return err(ctx, 'auth_delegations_revoke', 'Failed to revoke delegation', e);\n }\n },\n );\n\n // ── auth apps (OAuth/system) ────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_list')),\n {\n title: 'List Apps',\n description: 'List OAuth/system apps owned by the current user.',\n inputSchema: {\n limit: z.number().optional(),\n offset: z.number().optional(),\n },\n },\n async ({ limit, offset }) => {\n try {\n // BOFF-8203: live `AppConnection` wraps the list under `apps`.\n // Tool callers still see `{ apps: [...], total: N }` for backwards\n // compat (matches the shape they got before the refactor).\n const d = await ctx.gql.global.request<{\n currentUserApps: { apps: Array<Record<string, unknown>> };\n }>(ops.CURRENT_USER_APPS, {\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({\n apps: d.currentUserApps.apps,\n total: d.currentUserApps.apps.length,\n });\n } catch (e) {\n return err(ctx, 'auth_apps_list', 'Failed to list apps', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_get')),\n {\n title: 'Get App',\n description: 'Get a single app by its id.',\n inputSchema: { id: z.string().describe('App ID') },\n },\n async ({ id }) => {\n try {\n const d = await ctx.gql.global.request<{ app: Record<string, unknown> | null }>(\n ops.GET_APP,\n { id },\n );\n if (!d.app) {\n return errorResult(`App ${id} not found.`);\n }\n return jsonResult(d.app);\n } catch (e) {\n return err(ctx, 'auth_apps_get', 'Failed to get app', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_create')),\n {\n title: 'Create App',\n description:\n 'Create an OAuth or system app. Returns the app + clientSecret (shown only once).',\n inputSchema: {\n name: z.string().describe('App name'),\n description: z.string().optional(),\n type: z.enum(['OAUTH', 'SYSTEM']).optional().describe('App type (default OAUTH)'),\n actorType: z\n .enum(['USER', 'APP', 'SERVICE'])\n .optional()\n .describe('Actor type (default APP)'),\n redirectUris: z.array(z.string()).optional().describe('OAuth redirect URIs'),\n scopes: z.array(z.string()).optional(),\n },\n },\n async ({ name, description, type, actorType, redirectUris, scopes }) => {\n try {\n const input: Record<string, unknown> = {\n name,\n type: type ?? 'OAUTH',\n actorType: actorType ?? 'APP',\n };\n if (description !== undefined) input.description = description;\n if (redirectUris !== undefined) input.redirectUris = redirectUris;\n if (scopes !== undefined) input.scopes = scopes;\n const d = await ctx.gql.global.request<{\n createApp: { app: Record<string, unknown>; clientSecret: string };\n }>(ops.CREATE_APP, { input });\n return jsonResult({\n status: 'success',\n message: 'App created. clientSecret only shown once — store it now.',\n app: d.createApp.app,\n clientSecret: d.createApp.clientSecret,\n });\n } catch (e) {\n return err(ctx, 'auth_apps_create', 'Failed to create app', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_update')),\n {\n title: 'Update App',\n description: 'Update an app (name, description, redirect URIs, scopes, status).',\n inputSchema: {\n id: z.string().describe('App ID'),\n name: z.string().optional(),\n description: z.string().optional(),\n redirectUris: z.array(z.string()).optional(),\n scopes: z.array(z.string()).optional(),\n status: z.string().optional().describe('Status (e.g. ACTIVE, INACTIVE)'),\n },\n },\n async ({ id, name, description, redirectUris, scopes, status }) => {\n try {\n const input: Record<string, unknown> = {};\n if (name !== undefined) input.name = name;\n if (description !== undefined) input.description = description;\n if (redirectUris !== undefined) input.redirectUris = redirectUris;\n if (scopes !== undefined) input.scopes = scopes;\n if (status !== undefined) input.status = status.toUpperCase();\n if (Object.keys(input).length === 0) {\n return errorResult('No updates specified — provide at least one field.');\n }\n const d = await ctx.gql.global.request<{ updateApp: Record<string, unknown> }>(\n ops.UPDATE_APP,\n { id, input },\n );\n return jsonResult({ status: 'success', app: d.updateApp });\n } catch (e) {\n return err(ctx, 'auth_apps_update', 'Failed to update app', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_deactivate')),\n {\n title: 'Deactivate App',\n description: 'Deactivate an app by its id (revoke is not currently a separate mutation).',\n inputSchema: { id: z.string().describe('App ID') },\n },\n async ({ id }) => {\n try {\n await ctx.gql.global.request(ops.DEACTIVATE_APP, { id });\n return jsonResult({ status: 'success', message: `App ${id} deactivated.` });\n } catch (e) {\n return err(ctx, 'auth_apps_deactivate', 'Failed to deactivate app', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_apps_authorize_url')),\n {\n title: 'Build OAuth Authorize URL',\n description:\n 'Build the OAuth authorization URL for an app (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.',\n inputSchema: {\n clientId: z.string().describe('OAuth client id'),\n redirectUri: z.string().describe('Redirect URI (must be registered)'),\n scopes: z.array(z.string()).optional(),\n state: z.string().optional().describe('Opaque state value'),\n responseType: z.string().optional().describe('Default \"code\"'),\n },\n },\n async ({ clientId, redirectUri, scopes, state, responseType }) => {\n const cfg = ctx.config.read();\n const issuer =\n ctx.env === 'prod'\n ? (ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace('/graphql', ''))\n : cfg.globalEndpoint.replace('/graphql', '');\n const params = new URLSearchParams({\n client_id: clientId,\n redirect_uri: redirectUri,\n response_type: responseType ?? 'code',\n });\n if (scopes && scopes.length > 0) params.set('scope', scopes.join(' '));\n if (state) params.set('state', state);\n const url = `${issuer.replace(/\\/$/, '')}/oauth/authorize?${params.toString()}`;\n return jsonResult({ url });\n },\n );\n\n // ── auth sso ────────────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sso_get')),\n {\n title: 'Get SSO Config',\n description: 'Get SSO (SAML/OIDC) configuration for a tenant.',\n inputSchema: { tenantId: z.string().describe('Tenant ID') },\n },\n async ({ tenantId }) => {\n try {\n const d = await ctx.gql.global.request<{ getSSOConfig: Record<string, unknown> }>(\n ops.GET_SSO_CONFIG,\n { tenantId },\n );\n return jsonResult(d.getSSOConfig);\n } catch (e) {\n return err(ctx, 'auth_sso_get', 'Failed to get SSO config', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sso_configure')),\n {\n title: 'Configure SSO',\n description: 'Save (upsert) SSO configuration for a tenant.',\n inputSchema: {\n tenantId: z.string().describe('Tenant ID'),\n entityId: z.string().describe('SAML EntityID / OIDC issuer'),\n ssoUrl: z.string().describe('SSO endpoint URL'),\n sloUrl: z.string().optional().describe('SLO endpoint URL'),\n certificate: z.string().optional().describe('X.509 certificate PEM'),\n enabled: z.boolean().optional().describe('Enable after save (default false)'),\n },\n },\n async ({ tenantId, entityId, ssoUrl, sloUrl, certificate, enabled }) => {\n try {\n const input: Record<string, unknown> = {\n entityId,\n ssoUrl,\n enabled: enabled ?? false,\n };\n if (sloUrl !== undefined) input.sloUrl = sloUrl;\n if (certificate !== undefined) input.certificate = certificate;\n const d = await ctx.gql.global.request<{ saveSSOConfig: Record<string, unknown> }>(\n ops.SAVE_SSO_CONFIG,\n { tenantId, input },\n );\n return jsonResult({ status: 'success', config: d.saveSSOConfig });\n } catch (e) {\n return err(ctx, 'auth_sso_configure', 'Failed to save SSO config', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sso_test')),\n {\n title: 'Test SSO',\n description:\n 'Build the SSO test login URL for a tenant. Returns the URL to open in a browser; this tool does not perform any server call.',\n inputSchema: { tenantId: z.string().describe('Tenant ID') },\n },\n async ({ tenantId }) => {\n const cfg = ctx.config.read();\n const issuer =\n ctx.env === 'prod'\n ? (ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace('/graphql', ''))\n : cfg.globalEndpoint.replace('/graphql', '');\n const url = `${issuer.replace(/\\/$/, '')}/sso/${encodeURIComponent(tenantId)}/test`;\n return jsonResult({ url, message: 'Open this URL in a browser to test SSO.' });\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_sso_delete')),\n {\n title: 'Delete SSO Config',\n description: 'Delete SSO configuration for a tenant.',\n inputSchema: { tenantId: z.string().describe('Tenant ID') },\n },\n async ({ tenantId }) => {\n try {\n await ctx.gql.global.request(ops.DELETE_SSO_CONFIG, { tenantId });\n return jsonResult({ status: 'success', message: `SSO config for ${tenantId} deleted.` });\n } catch (e) {\n return err(ctx, 'auth_sso_delete', 'Failed to delete SSO config', e);\n }\n },\n );\n\n // ── auth users (admin) ──────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_users_list')),\n {\n title: 'List Users (admin)',\n description: 'List users with optional filters. Requires admin permission.',\n inputSchema: {\n email: z.string().optional(),\n username: z.string().optional(),\n role: z.string().optional(),\n status: z.string().optional(),\n search: z.string().optional(),\n limit: z.number().optional(),\n offset: z.number().optional(),\n },\n },\n async ({ email, username, role, status, search, limit, offset }) => {\n try {\n const filter: Record<string, unknown> = {};\n if (email !== undefined) filter.email = email;\n if (username !== undefined) filter.username = username;\n if (role !== undefined) filter.role = role.toUpperCase();\n if (status !== undefined) filter.status = status.toUpperCase();\n if (search !== undefined) filter.search = search;\n const d = await ctx.gql.global.request<{\n users: { users: UserRow[]; totalCount: number; hasMore: boolean };\n }>(ops.LIST_USERS, {\n filter: Object.keys(filter).length > 0 ? filter : undefined,\n pagination: { limit: limit ?? 50, offset: offset ?? 0 },\n });\n return jsonResult({\n users: d.users.users,\n totalCount: d.users.totalCount,\n hasMore: d.users.hasMore,\n });\n } catch (e) {\n return err(ctx, 'auth_users_list', 'Failed to list users', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_users_get')),\n {\n title: 'Get User (admin)',\n description: 'Get a user by id. Requires admin permission.',\n inputSchema: { id: z.string().describe('User ID') },\n },\n async ({ id }) => {\n try {\n const d = await ctx.gql.global.request<{ user: UserRow | null }>(ops.GET_USER, { id });\n if (!d.user) {\n return errorResult(`User ${id} not found.`);\n }\n return jsonResult(d.user);\n } catch (e) {\n return err(ctx, 'auth_users_get', 'Failed to get user', e);\n }\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_users_update')),\n {\n title: 'Update User (admin)',\n description: 'Update a user (admin). Pass any subset of mutable fields.',\n inputSchema: {\n id: z.string().describe('User ID'),\n firstName: z.string().optional(),\n lastName: z.string().optional(),\n username: z.string().optional(),\n phoneNumber: z.string().optional(),\n role: z.string().optional(),\n status: z.string().optional(),\n emailVerified: z.boolean().optional(),\n },\n },\n async ({ id, firstName, lastName, username, phoneNumber, role, status, emailVerified }) => {\n try {\n const input: Record<string, unknown> = {};\n if (firstName !== undefined) input.firstName = firstName;\n if (lastName !== undefined) input.lastName = lastName;\n if (username !== undefined) input.username = username;\n if (phoneNumber !== undefined) input.phoneNumber = phoneNumber;\n if (role !== undefined) input.role = role.toUpperCase();\n if (status !== undefined) input.status = status.toUpperCase();\n if (emailVerified !== undefined) input.emailVerified = emailVerified;\n if (Object.keys(input).length === 0) {\n return errorResult('No updates specified — provide at least one field.');\n }\n const d = await ctx.gql.global.request<{ updateUser: UserRow }>(ops.UPDATE_USER, {\n id,\n input,\n });\n return jsonResult({ status: 'success', user: d.updateUser });\n } catch (e) {\n return err(ctx, 'auth_users_update', 'Failed to update user', e);\n }\n },\n );\n\n // ── auth security ───────────────────────────────────────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_security_summary')),\n {\n title: 'Account Security Summary',\n description:\n 'One-shot account security overview: profile, MFA methods, active sessions, recent audit log, API keys, delegations.',\n inputSchema: {\n recentLimit: z\n .number()\n .optional()\n .describe('How many recent audit events / sessions to include (default 10)'),\n },\n },\n async ({ recentLimit }) => {\n const limit = recentLimit ?? 10;\n const pagination = { limit, offset: 0 };\n const summary: Record<string, unknown> = {};\n try {\n const profile = await ctx.gql.global\n .request<{ currentUser: Record<string, unknown> }>(ops.CURRENT_USER)\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.profile = profile;\n\n const mfa = await ctx.gql.global\n .request<{\n currentUserMFAMethods: Array<Record<string, unknown>>;\n }>(ops.CURRENT_USER_MFA_METHODS, { pagination })\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.mfa = mfa;\n\n const sessions = await ctx.gql.global\n .request<{ activeSessions: Array<Record<string, unknown>> }>(ops.ACTIVE_SESSIONS, {\n pagination,\n })\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.sessions = sessions;\n\n const audit = await ctx.gql.global\n .request<{ authAuditLogs: Array<Record<string, unknown>> }>(ops.AUTH_AUDIT_LOGS, {\n pagination,\n })\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.auditLog = audit;\n\n const keys = await ctx.gql.global\n .request<{ myApiKeys: Array<Record<string, unknown>> }>(ops.MY_API_KEYS, {\n pagination,\n })\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.apiKeys = keys;\n\n const delegations = await ctx.gql.global\n .request<{\n currentUserDelegations: Array<Record<string, unknown>>;\n }>(ops.CURRENT_USER_DELEGATIONS, { pagination })\n .catch((e) => ({ error: e instanceof Error ? e.message : String(e) }));\n summary.delegations = delegations;\n\n return jsonResult(summary);\n } catch (e) {\n return err(ctx, 'auth_security_summary', 'Failed to build security summary', e);\n }\n },\n );\n\n // ── auth register / oauth (browser-only URL helpers) ────────────────────\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_register_get_url')),\n {\n title: 'Build Registration URL',\n description:\n 'Build the registration URL (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.',\n inputSchema: {\n email: z.string().optional().describe('Pre-fill the email field'),\n },\n },\n async ({ email }) => {\n const cfg = ctx.config.read();\n const issuer =\n ctx.env === 'prod'\n ? (ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace('/graphql', ''))\n : cfg.globalEndpoint.replace('/graphql', '');\n const params = new URLSearchParams();\n if (email) params.set('email', email);\n const qs = params.toString();\n const url = `${issuer.replace(/\\/$/, '')}/register${qs ? `?${qs}` : ''}`;\n return jsonResult({ url });\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_reset_password_get_url')),\n {\n title: 'Build Password Reset URL',\n description:\n 'Build the password reset URL (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.',\n inputSchema: {\n email: z.string().optional().describe('Pre-fill the email field'),\n },\n },\n async ({ email }) => {\n const cfg = ctx.config.read();\n const issuer =\n ctx.env === 'prod'\n ? (ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace('/graphql', ''))\n : cfg.globalEndpoint.replace('/graphql', '');\n const params = new URLSearchParams();\n if (email) params.set('email', email);\n const qs = params.toString();\n const url = `${issuer.replace(/\\/$/, '')}/reset-password${qs ? `?${qs}` : ''}`;\n return jsonResult({ url });\n },\n );\n\n server.registerTool(\n track(mcpToolName(ctx.productName, 'auth_magic_link_get_url')),\n {\n title: 'Build Magic-Link URL',\n description:\n 'Build the magic-link login URL (browser-only flow). Returns the URL to open in a browser; this tool does not perform any server call.',\n inputSchema: {\n email: z.string().describe('Email to send the magic link to'),\n },\n },\n async ({ email }) => {\n const cfg = ctx.config.read();\n const issuer =\n ctx.env === 'prod'\n ? (ctx.defaults.oidcIssuerProd ?? cfg.globalEndpoint.replace('/graphql', ''))\n : cfg.globalEndpoint.replace('/graphql', '');\n const params = new URLSearchParams({ email });\n const url = `${issuer.replace(/\\/$/, '')}/magic-link?${params.toString()}`;\n return jsonResult({ url });\n },\n );\n}\n","/**\n * Auth module — login flow + workspace selection + status + logout.\n *\n * Phase 1 ships the SUBSET that exists in vibecontrols-mcp@main:\n * <product>_auth_{login,complete,select_workspace,workspaces,status,logout}\n *\n * Phase 2 finishes the full auth surface (mfa, api-keys, audit-log,\n * delegations, apps, sso, users, profile, sessions).\n *\n * Phase 2.1 closes the SDK-parity gap (more-tools.ts):\n * sign_up, sign_in, refresh_token, get_current_user, authenticate_app,\n * login_with_api_key, login_with_client_credentials.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerAuthTools } from './tools.js';\nimport { registerAuthMoreTools } from './more-tools.js';\nimport { registerAuthExtraTools } from './extra-tools.js';\n\nconst authModule: McpModule = {\n id: 'auth',\n version: '0.0.1',\n displayName: 'Authentication',\n capabilities: { tools: {} },\n\n register(server: McpServer, ctx: McpContext): ModuleRegistration {\n const tools: string[] = [];\n const track = (n: string): string => {\n tools.push(n);\n return n;\n };\n\n registerAuthTools(server, ctx, track);\n registerAuthMoreTools(server, ctx, track);\n // BOFF-8203 follow-up: the Phase-2 auth extra surface (api-keys,\n // apps, delegations, MFA, audit-log) was deferred in this module's\n // Phase-1 wiring. Mounting it now so the connection-shape fixes\n // (`myApiKeys.apiKeys`, `appApiKeys.apiKeys`, `currentUserApps.apps`)\n // actually take effect on alpha.\n registerAuthExtraTools(server, ctx, track);\n\n return { tools, resources: [], prompts: [] };\n },\n};\n\nexport default authModule;\nexport { getAuth, type AuthHelper, type WorkspaceInfo } from './legacy-auth.js';\n"]}