@burdenoff/mcp-libs 2026.825.2 → 2026.825.3

package/dist/modules/atheletebridge/index.js

@@ -1,4 +1,4 @@
-import { mcpToolName, errorResult, jsonResult, mcpResourceUri, mcpPromptName } from '../../chunk-YOSQUY3M.js';
+import { mcpToolName, errorResult, jsonResult, mcpResourceUri, mcpPromptName } from '../../chunk-BSNL65PZ.js';
 import { z } from 'zod';
 
 // src/modules/atheletebridge/operations.ts

package/dist/modules/auth/index.cjs.map

@@ -1 +1 @@
-{"version":3,"sources":["../../../src/core/auth/device-code.ts","../../../src/modules/auth/legacy-auth.ts","../../../src/core/errors.ts","../../../src/core/tool-name.ts","../../../src/core/result.ts","../../../src/modules/auth/tools.ts","../../../src/modules/auth/operations.ts","../../../src/modules/auth/more-tools.ts","../../../src/modules/auth/index.ts"],"names":["fetch","z"],"mappings":";;;;;;;;;;;;;;;AAgIA,eAAsB,qBAAA,CACpB,cAAA,EACA,QAAA,EACA,YAAA,EACA,MAAA,EACkC;AAClC,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AAQd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,cAAA,EAAgB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACnB,KAAA;AAAA,MACA,WAAW,EAAE,KAAA,EAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO;AAAE,KACxD;AAAA,GACF,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAKlC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,2BAAA,EAA8B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EAC5F;AACA,EAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,eAAA,EAAiB,WAAA,EAAa;AAC5C,IAAA,MAAM,IAAI,MAAM,qDAAqD,CAAA;AAAA,EACvE;AAEA,EAAA,OAAO,KAAK,IAAA,CAAK,eAAA;AACnB;AAEA,eAAsB,mBAAA,CACpB,iBAAA,EACA,SAAA,EACA,WAAA,EACA,cAAA,EACiE;AACjE,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AASd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,iBAAA,EAAmB;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,SAAS,EAAE,cAAA,EAAgB,oBAAoB,aAAA,EAAe,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,EAAG;AAAA,IACpF,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAA,EAAW,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,cAAA,EAAe,IAAK;AAAA,GACtF,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAalC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EACzF;AAEA,EAAA,MAAM,MAAA,GAAS,KAAK,IAAA,EAAM,mBAAA;AAC1B,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAA,IAAW,CAAC,OAAO,KAAA,EAAO;AACrC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,QAAQ,KAAA,EAAO,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EACxF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW,MAAA,CAAO,SAAA,IAAa,EAAA,EAAI,MAAA,EAAQ,MAAA,CAAO,MAAA,IAAU,EAAC,EAAE;AAC/F;AAEA,eAAsB,eAAA,CACpB,gBACA,SAAA,EAGA;AACA,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AAQd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,cAAA,EAAgB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,SAAS,EAAE,cAAA,EAAgB,oBAAoB,aAAA,EAAe,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,EAAG;AAAA,IACpF,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,EAAE,KAAA,EAAO,EAAA,EAAG,EAAG;AAAA,GACzD,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAelC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,4BAAA,EAA+B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EAC7F;AAEA,EAAA,OAAO,IAAA,CAAK,IAAA,EAAM,YAAA,EAAc,KAAA,IAAS,EAAC;AAC5C;;;AC9LA,IAAM,OAAA,uBAAc,OAAA,EAAgC;AAE7C,SAAS,QAAQ,GAAA,EAA6B;AACnD,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC9B,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,MAAM,MAAA,GAAS,iBAAiB,GAAG,CAAA;AACnC,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,MAAM,CAAA;AACvB,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,iBAAiB,GAAA,EAA6B;AACrD,EAAA,IAAI,OAAA,GAAoC,IAAA;AACxC,EAAA,IAAI,eAAA,GAAuC,IAAA;AAC3C,EAAA,IAAI,iBAAA,GAA0C,IAAA;AAE9C,EAAA,SAAS,MAAA,GAAe;AACtB,IAAA,eAAA,IAAkB;AAAA,EACpB;AAEA,EAAA,eAAe,UAAA,GAAwC;AACrD,IAAA,MAAM,EAAE,UAAA,EAAY,QAAA,EAAS,GAAI,GAAA,CAAI,OAAO,WAAA,EAAY;AACxD,IAAA,MAAM,aAAA,GAAgB,GAAG,UAAU,CAAA,iBAAA,CAAA;AACnC,IAAA,MAAM,QAAA,GAAW,GAAG,UAAU,CAAA,mBAAA,CAAA;AAE9B,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MAC1C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACR,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,IAC5E;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,MAAM,UAAA,GAAa,KAAK,aAAa,CAAA;AACrC,IAAA,MAAM,QAAA,GAAW,KAAK,WAAW,CAAA;AACjC,IAAA,MAAM,eAAA,GAAkB,KAAK,kBAAkB,CAAA;AAC/C,IAAA,MAAM,uBAAA,GAA2B,IAAA,CAAK,2BAA2B,CAAA,IAAgB,IAAA;AACjF,IAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,GAAA;AACpD,IAAA,MAAM,QAAA,GAAY,IAAA,CAAK,UAAU,CAAA,IAAgB,CAAA;AAEjD,IAAA,OAAA,GAAU;AAAA,MACR,UAAA;AAAA,MACA,QAAA;AAAA,MACA,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,MACpC,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,oBAAA;AAAA,MACR,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,QAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAA,EAAS,QAAQ,uBAAA,IAA2B,eAAe,iCAAiC,QAAQ,CAAA,YAAA,EAAe,IAAI,WAAW,CAAA,wCAAA;AAAA,KACpI;AAAA,EACF;AAEA,EAAA,eAAe,aAAA,GAA8C;AAC3D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4BAAA,EAA+B,IAAI,WAAW,CAAA,gDAAA;AAAA,OAChD;AAAA,IACF;AAEA,IAAA,MAAM,CAAA,GAAI,OAAA;AACV,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,CAAA,CAAE,SAAA,EAAW;AAC7B,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,oCAAA;AAAA,OAC3D;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,CAAE,QAAA,EAAU;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,CAAA,CAAE,UAAA;AAAA,QACf,WAAW,CAAA,CAAE;AAAA,OACd,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAElC,IAAA,IAAI,QAAA,CAAS,EAAA,IAAM,IAAA,CAAK,cAAc,CAAA,EAAG;AACvC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,IAAA;AACpD,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACpE,MAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,QACb,GAAG,IAAA;AAAA,QACH,WAAA,EAAa,KAAK,cAAc,CAAA;AAAA,QAChC,YAAA,EAAe,IAAA,CAAK,eAAe,CAAA,IAAgB,EAAA;AAAA,QACnD,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QACpC,UAAA,EAAY;AAAA,OACb,CAAA;AACD,MAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,MAAA,OAAO,MAAM,eAAA,EAAgB;AAAA,IAC/B;AAEA,IAAA,MAAM,SAAA,GAAY,KAAK,OAAO,CAAA;AAC9B,IAAA,IAAI,cAAc,uBAAA,EAAyB;AACzC,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,0CAAA,EAA6C,CAAA,CAAE,uBAAA,IAA2B,CAAA,CAAE,eAAe,CAAA,iBAAA,EAAoB,CAAA,CAAE,QAAQ,CAAA,YAAA,EAAe,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAClK;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,WAAA,EAAa;AACpC,MAAA,CAAA,CAAE,QAAA,IAAY,CAAA;AACd,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,kEAAA,EAAqE,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAC/F;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,kBAAA;AAAA,OAC3D;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,mBAAA,EAAuB,IAAA,CAAK,mBAAmB,CAAA,IAAgB,aAAa,SAAS,CAAA;AAAA,OACvF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,eAAA,GAAgD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAa,MAAM,cAAA,EAAe;AACxC,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAA,EAAO;AACP,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,oDAAoD,CAAA;AACpE,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,0DAAA,EAAwD,GAAA,CAAI,WAAW,CAAA,6CAAA;AAAA,SAClF;AAAA,MACF;AACA,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAM,EAAA,GAAK,WAAW,CAAC,CAAA;AACvB,QAAA,IAAI,CAAC,EAAA;AACH,UAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AACtF,QAAA,MAAM,2BAAA,CAA4B,EAAA,CAAG,EAAA,EAAI,EAAA,CAAG,cAAc,CAAA;AAC1D,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,8BAAA,EAAgC;AAAA,UAC9C,aAAa,EAAA,CAAG,EAAA;AAAA,UAChB,eAAe,EAAA,CAAG;AAAA,SACnB,CAAA;AACD,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,sCAAA,EAAyC,EAAA,CAAG,IAAI,CAAA,yBAAA;AAAA,SAC3D;AAAA,MACF;AACA,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,0DAA0D,CAAA;AAC1E,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,8BAAA;AAAA,QACR,SAAS,CAAA,2BAAA,EAA8B,UAAA,CAAW,MAAM,CAAA,kCAAA,EAAgC,IAAI,WAAW,CAAA,qCAAA,CAAA;AAAA,QACvG;AAAA,OACF;AAAA,IACF,SAAS,OAAA,EAAS;AAChB,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,wCAAA,EAA0C;AAAA,QACxD,OAAO,OAAA,YAAmB,KAAA,GAAQ,OAAA,CAAQ,OAAA,GAAU,OAAO,OAAO;AAAA,OACnE,CAAA;AACD,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,eAAA;AAAA,QACR,OAAA,EAAS,0DAA0D,OAAA,YAAmB,KAAA,GAAQ,QAAQ,OAAA,GAAU,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,OACjI;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,cAAA,GAA2C;AACxD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,OAAO,gBAAgB,GAAA,CAAI,MAAA,CAAO,MAAK,CAAE,cAAA,EAAgB,KAAK,WAAW,CAAA;AAAA,EAC3E;AAEA,EAAA,eAAe,2BAAA,CACb,aACA,cAAA,EACe;AACf,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,oBAAoB,CAAA;AAC5D,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK,CAAE,iBAAA;AAAA,MAClB,IAAA,CAAK,WAAA;AAAA,MACL,WAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,MACb,GAAG,IAAA;AAAA,MACH,gBAAgB,MAAA,CAAO,KAAA;AAAA,MACvB,yBAAyB,IAAI,IAAA,CAAK,MAAA,CAAO,SAAS,EAAE,OAAA,EAAQ;AAAA,MAC5D,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AAAA,EACT;AAEA,EAAA,eAAe,eAAA,CAAgB,aAAqB,cAAA,EAAuC;AACzF,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,MAAM,2BAAA,CAA4B,aAAa,cAAc,CAAA;AAC7D,IAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,oBAAA,EAAsB,EAAE,aAAa,CAAA;AAAA,EACvD;AAEA,EAAA,eAAe,mBAAA,GAAqC;AAClD,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,MAAM,iBAAA;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,WAAW,YAA2B;AAC1C,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,MAAA,IAAI,MAAM,MAAA,EAAQ;AAClB,MAAA,IAAI,CAAC,MAAM,WAAA,EAAa;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,wBAAA,EAA2B,GAAA,CAAI,WAAW,CAAA,0CAAA,EAA6C,IAAI,WAAW,CAAA,gDAAA;AAAA,SACxG;AAAA,MACF;AAAA,IAKF,CAAA;AACA,IAAA,iBAAA,GAAoB,QAAA,EAAS,CAAE,OAAA,CAAQ,MAAM;AAC3C,MAAA,iBAAA,GAAoB,IAAA;AAAA,IACtB,CAAC,CAAA;AACD,IAAA,MAAM,iBAAA;AAAA,EACR;AAEA,EAAA,SAAS,SAAA,GASN;AACD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,MACrB,aAAA,EAAe,CAAC,EAAE,IAAA,EAAM,eAAe,IAAA,EAAM,MAAA,CAAA;AAAA,MAC7C,QAAQ,IAAA,EAAM,MAAA,GAAS,SAAA,GAAY,IAAA,EAAM,cAAc,aAAA,GAAgB,MAAA;AAAA,MACvE,SAAA,EAAW,MAAM,SAAA,GAAY,IAAI,KAAK,IAAA,CAAK,SAAS,CAAA,CAAE,WAAA,EAAY,GAAI,IAAA;AAAA,MACtE,WAAA,EAAa,MAAM,WAAA,IAAe,IAAA;AAAA,MAClC,cAAA,EAAgB,MAAM,cAAA,IAAkB,IAAA;AAAA,MACxC,uBAAA,EAAyB,MAAM,uBAAA,GAC3B,IAAI,KAAK,IAAA,CAAK,uBAAuB,CAAA,CAAE,WAAA,EAAY,GACnD,IAAA;AAAA,MACJ,iBAAA,EAAmB,CAAC,CAAC,IAAA,EAAM,cAAA;AAAA,MAC3B,eAAA,EAAiB,CAAC,CAAC;AAAA,KACpB,CAAA;AAAA,EACH;AAEA,EAAA,eAAe,MAAA,GAAwB;AACrC,IAAA,OAAA,GAAU,IAAA;AACV,IAAA,GAAA,CAAI,KAAK,KAAA,EAAM;AACf,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AACP,IAAA,GAAA,CAAI,MAAA,CAAO,KAAK,sCAAsC,CAAA;AAAA,EACxD;AAEA,EAAA,SAAS,UAAA,GAAqC;AAC5C,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,IAAI,IAAA,EAAM,MAAA,EAAQ,OAAA,CAAQ,WAAW,IAAI,IAAA,CAAK,MAAA;AAC9C,IAAA,IAAI,MAAM,WAAA,EAAa,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,WAAW,CAAA,CAAA;AAC5E,IAAA,IAAI,IAAA,EAAM,cAAA;AACR,MAAA,OAAA,CAAQ,2BAA2B,CAAA,GAAI,CAAA,OAAA,EAAU,IAAA,CAAK,cAAc,CAAA,CAAA;AACtE,IAAA,IAAI,IAAA,EAAM,cAAA,EAAgB,OAAA,CAAQ,UAAU,IAAI,IAAA,CAAK,cAAA;AACrD,IAAA,IAAI,IAAA,EAAM,WAAA,EAAa,OAAA,CAAQ,gBAAgB,IAAI,IAAA,CAAK,WAAA;AACxD,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,SAAS,UAAA,GAAsB;AAC7B,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,WAAA,IAAe,IAAA,EAAM,MAAA,CAAA;AAAA,EACvC;AAEA,EAAA,SAAS,mBAAmB,EAAA,EAAsB;AAChD,IAAA,eAAA,GAAkB,EAAA;AAAA,EACpB;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,mBAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACpWO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjB,KAAA;AAAA,EAEzB,WAAA,CAAY,SAAiB,KAAA,EAAiB;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF,CAAA;;;AC1BA,IAAM,oBAAA,GAAuB,EAAA;AAE7B,SAAS,cAAA,CAAe,MAAc,IAAA,EAA8C;AAClF,EAAA,IAAuB,IAAA,CAAK,MAAA,GAAS,oBAAA,EAAsB;AACzD,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,CAAA,WAAA,EAAc,IAAI,CAAA,UAAA,EAAa,oBAAoB,CAAA,8CAAA;AAAA,KACrD;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,WAAA,CAAY,gBAAwB,KAAA,EAAyB;AAC3E,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,iBAAiB,sCAAsC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,WAAA,EAAa,GAAG,KAAK,EAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC7D,EAAA,OAAO,cAAA,CAAe,IAAY,CAAA;AACpC;;;ACOO,SAAS,UAAA,CAAW,MAAe,UAAA,EAAkD;AAC1F,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG;AAAA,GACjE;AAIA,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,WAAA,CAAY,SAAiB,IAAA,EAA2B;AACtE,EAAA,MAAM,IAAA,GAAO,IAAA,GAAO,CAAA,EAAG,OAAO;;AAAA,MAAA,EAAa,IAAI,CAAA,CAAA,GAAK,OAAA;AACpD,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AAC5D;;;AC3DO,SAAS,iBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,YAAY,CAAC,CAAA;AAAA,IAChD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EACE,oNAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,UAAA,EAAW;AACrC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,OAAO,CAAA;AAC5D,QAAA,OAAO,WAAA;AAAA,UACL,iBAAiB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACzE;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,eAAe,CAAC,CAAA;AAAA,IACnD;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EACE,kQAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,EAAc;AACxC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,mCAAA,EAAqC,EAAE,OAAO,CAAA;AAC/D,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EACE,2GAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,WAAA,EAAaC,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wBAAwB,CAAA;AAAA,QACzD,cAAA,EAAgBA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mCAAmC;AAAA;AACzE,KACF;AAAA,IACA,OAAO,EAAE,WAAA,EAAa,cAAA,EAAe,KAAM;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,IAAA,CAAK,eAAA,CAAgB,WAAA,EAAa,cAAc,CAAA;AACtD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,oBAAA;AAAA,UACR,WAAA;AAAA,UACA,OAAA,EAAS,aAAa,WAAW,CAAA,2BAAA;AAAA,SAClC,CAAA;AAAA,MACH,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,2CAAA,EAA6C,EAAE,OAAO,CAAA;AACvE,QAAA,OAAO,WAAA;AAAA,UACL,+BAA+B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,iBAAA;AAAA,MACP,WAAA,EAAa,0DAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,cAAA,EAAe;AAC7C,QAAA,OAAO,WAAW,EAAE,UAAA,EAAY,KAAA,EAAO,UAAA,CAAW,QAAQ,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,qCAAA,EAAuC,EAAE,OAAO,CAAA;AACjE,QAAA,OAAO,WAAA;AAAA,UACL,8BAA8B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACtF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,aAAa,CAAC,CAAA;AAAA,IACjD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EACE,iHAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,SAAA,EAAU;AACpC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,EAAE,OAAO,CAAA;AAC7D,QAAA,OAAO,WAAA;AAAA,UACL,8BAA8B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACtF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,aAAa,CAAC,CAAA;AAAA,IACjD;AAAA,MACE,KAAA,EAAO,QAAA;AAAA,MACP,WAAA,EAAa,qDAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,KAAK,MAAA,EAAO;AAClB,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,YAAA;AAAA,UACR,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,EAAE,OAAO,CAAA;AAC7D,QAAA,OAAO,WAAA;AAAA,UACL,kBAAkB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC1E;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;;;ACxIO,IAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhB,IAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBzB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWzB,IAAM,EAAA,GAAK;AAAA;AAAA;AAAA;AAAA,CAAA;;;ACPlB,SAAS,GAAA,CACP,GAAA,EACA,IAAA,EACA,OAAA,EACA,KAAA,EACgC;AAChC,EAAA,GAAA,CAAI,OAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,OAAA,CAAA,EAAW,EAAE,OAAO,CAAA;AAC5C,EAAA,OAAO,WAAA,CAAY,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAC5F;AAEA,SAAS,kBAAA,CAAmB,KAAiB,OAAA,EAA4B;AACvE,EAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,EAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,IACb,GAAG,QAAA;AAAA,IACH,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,cAAc,OAAA,CAAQ,YAAA;AAAA,IACtB,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,QAAQ,SAAA,GAAY,GAAA;AAAA,IAC5C,UAAA,EAAY;AAAA,GACb,CAAA;AACD,EAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AAChB;AAEO,SAAS,qBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AAGN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAClD;AAAA,MACE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA,EACE,uKAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mCAAmC,CAAA;AAAA,QAC9D,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B,CAAA;AAAA,QACzD,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sDAAsD,CAAA;AAAA,QACpF,WAAWA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qBAAqB,CAAA;AAAA,QAC/D,UAAUA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oBAAoB;AAAA;AAC/D,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,UAAU,QAAA,EAAU,SAAA,EAAW,UAAS,KAAM;AAC5D,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAS;AACnE,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC/C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAAqC,OAAA,EAAS,EAAE,KAAA,EAAO,CAAA;AACtF,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,MAAM,CAAA;AAChC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,IAAA,EAAM,EAAE,MAAA,CAAO,IAAA;AAAA,UACf,WAAA,EAAa,EAAE,MAAA,CAAO,WAAA;AAAA,UACtB,YAAA,EAAc,EAAE,MAAA,CAAO,YAAA;AAAA,UACvB,SAAA,EAAW,EAAE,MAAA,CAAO;AAAA,SACrB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,cAAA,EAAgB,gBAAA,EAAkB,CAAC,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAClD;AAAA,MACE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA,EACE,uMAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mBAAmB,CAAA;AAAA,QACjD,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,UAAU;AAAA;AAC1C,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAS,KAAM;AAChC,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAAqC,OAAA,EAAS;AAAA,UAC3E,KAAA,EAAO,EAAE,QAAA,EAAU,QAAA;AAAS,SAC7B,CAAA;AACD,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,MAAM,CAAA;AAChC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,IAAA,EAAM,EAAE,MAAA,CAAO,IAAA;AAAA,UACf,WAAA,EAAa,EAAE,MAAA,CAAO,WAAA;AAAA,UACtB,YAAA,EAAc,EAAE,MAAA,CAAO,YAAA;AAAA,UACvB,SAAA,EAAW,EAAE,MAAA,CAAO;AAAA,SACrB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,cAAA,EAAgB,gBAAA,EAAkB,CAAC,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,eAAA;AAAA,MACP,WAAA,EACE,0PAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC/B,QAAA,IAAI,CAAC,UAAU,YAAA,EAAc;AAC3B,UAAA,OAAO,WAAA;AAAA,YACL;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,gBAAA;AAAA,UACJ;AAAA,YACE,OAAO,QAAA,CAAS;AAAA;AAClB,SACF;AACA,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,YAAY,CAAA;AACtC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,WAAA;AAAA,UACR,WAAA,EAAa,EAAE,YAAA,CAAa,WAAA;AAAA,UAC5B,SAAA,EAAW,EAAE,YAAA,CAAa;AAAA,SAC3B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,oBAAA,EAAsB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MACjE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EACE,kPAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAA4B,EAAE,CAAA;AAC7D,QAAA,OAAO,UAAA,CAAW,EAAE,EAAE,CAAA;AAAA,MACxB,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,uBAAA,EAAyB,8BAAA,EAAgC,CAAC,CAAA;AAAA,MAC5E;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EACE,+PAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,YAAA,EAAcA,KAAAA,CACX,MAAA,EAAO,CACP,SAAS,0DAA0D,CAAA;AAAA,QACtE,MAAA,EAAQA,KAAAA,CACL,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAChB,QAAA,EAAS,CACT,QAAA,CAAS,2CAA2C;AAAA;AACzD,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,QAAA,EAAU,YAAA,EAAa;AAChE,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,gBAAA;AAAA,UACJ,EAAE,KAAA;AAAM,SACV;AACA,QAAA,MAAM,SAAS,CAAA,CAAE,eAAA;AACjB,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,YAAA,EAAc,EAAA;AAAA,UACd,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,SAAA,GAAY,GAAA;AAAA,UAC3C,UAAA,EAAY,oBAAA;AAAA,UACZ,QAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,QAAQ,MAAA,CAAO;AAAA,SAChB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,uBAAA,EAAyB,2BAAA,EAA6B,CAAC,CAAA;AAAA,MACzE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,oBAAA;AAAA,MACP,WAAA,EACE,sQAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qDAAqD;AAAA;AACnF,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAO,KAAM;AACpB,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,MAAA;AAAA,UACA,UAAA,EAAY;AAAA,SACb,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,MAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,yBAAA,EAA2B,uBAAA,EAAyB,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oCAAoC,CAAC,CAAA;AAAA,IACxE;AAAA,MACE,KAAA,EAAO,+BAAA;AAAA,MACP,WAAA,EACE,iSAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,YAAA,EAAcA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC1D,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,gCAAgC;AAAA;AAClF,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,QAAA,MAAM,SAAS,MAAM,qBAAA;AAAA,UACnB,GAAA,CAAI,cAAA;AAAA,UACJ,QAAA;AAAA,UACA,YAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,YAAA,EAAc,EAAA;AAAA,UACd,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,SAAA,GAAY,GAAA;AAAA,UAC3C,UAAA,EAAY,oBAAA;AAAA,UACZ,QAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,QAAQ,MAAA,CAAO;AAAA,SAChB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,oCAAA,EAAsC,iCAAA,EAAmC,CAAC,CAAA;AAAA,MAC5F;AAAA,IACF;AAAA,GACF;AACF;;;ACnTA,IAAM,UAAA,GAAwB;AAAA,EAC5B,EAAA,EAAI,MAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,gBAAA;AAAA,EACb,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,iBAAA,CAAkB,MAAA,EAAQ,KAAK,KAAK,CAAA;AACpC,IAAA,qBAAA,CAAsB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAExC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,YAAA,GAAQ","file":"index.cjs","sourcesContent":["/**\n * OAuth2 Device Code flow + Client Credentials flow + workspace token issuance.\n * Pure functions — operate on injected endpoints + client ids, no global state.\n *\n * Mirrors cli-sdk/src/core/auth/device-code.ts so a future shared\n * @burdenoff/auth-core extraction is mechanical.\n */\n\nimport fetch from 'cross-fetch';\n\nexport interface DeviceCodeResponse {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  expiresIn: number;\n  interval: number;\n}\n\nexport interface DeviceCodeTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport interface ClientCredentialsResult {\n  accessToken: string;\n  expiresIn: number;\n  scopes: string[];\n}\n\nexport interface OIDCConfig {\n  oidcIssuer: string;\n  clientId: string;\n}\n\nexport async function startDeviceCodeFlow(config: OIDCConfig): Promise<DeviceCodeResponse> {\n  const url = `${config.oidcIssuer}/oidc/device/code`;\n  const body = new URLSearchParams({\n    client_id: config.clientId,\n    scope: 'openid profile email offline_access',\n  });\n\n  const response = await fetch(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: body.toString(),\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => 'Unknown error');\n    throw new Error(`Device code request failed (${response.status}): ${text}`);\n  }\n\n  const data = (await response.json()) as Record<string, unknown>;\n\n  return {\n    deviceCode: data['device_code'] as string,\n    userCode: data['user_code'] as string,\n    verificationUri: data['verification_uri'] as string,\n    verificationUriComplete: (data['verification_uri_complete'] as string) ?? null,\n    expiresIn: data['expires_in'] as number,\n    interval: (data['interval'] as number) ?? 5,\n  };\n}\n\nexport type DeviceTokenPollResult =\n  | { status: 'authenticated'; tokens: DeviceCodeTokenResult }\n  | { status: 'pending' }\n  | { status: 'slow_down'; newInterval: number }\n  | { status: 'expired' }\n  | { status: 'denied' };\n\n/**\n * Single-shot device-code token poll.\n *\n * Unlike cli-sdk's pollForToken which loops until done (suitable for blocking\n * CLI), MCP needs non-blocking semantics: the LLM calls auth_complete tool\n * repeatedly. This helper makes ONE poll attempt and returns a discriminated\n * union the caller can act on.\n */\nexport async function pollDeviceTokenOnce(\n  deviceCode: string,\n  interval: number,\n  config: OIDCConfig,\n): Promise<DeviceTokenPollResult> {\n  const url = `${config.oidcIssuer}/oauth/device/token`;\n\n  const response = await fetch(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n      device_code: deviceCode,\n      client_id: config.clientId,\n    }).toString(),\n  });\n\n  const data = (await response.json()) as Record<string, unknown>;\n\n  if (response.ok && data['access_token']) {\n    return {\n      status: 'authenticated',\n      tokens: {\n        accessToken: data['access_token'] as string,\n        refreshToken: (data['refresh_token'] as string) ?? '',\n        expiresIn: (data['expires_in'] as number) ?? 3600,\n      },\n    };\n  }\n\n  const errorCode = data['error'] as string | undefined;\n  switch (errorCode) {\n    case 'authorization_pending':\n      return { status: 'pending' };\n    case 'slow_down':\n      return { status: 'slow_down', newInterval: interval + 5 };\n    case 'expired_token':\n      return { status: 'expired' };\n    case 'access_denied':\n      return { status: 'denied' };\n    default:\n      throw new Error(\n        `Device code polling failed: ${(data['error_description'] as string) ?? errorCode ?? 'Unknown error'}`,\n      );\n  }\n}\n\nexport async function clientCredentialsFlow(\n  globalEndpoint: string,\n  clientId: string,\n  clientSecret: string,\n  scopes?: string[],\n): Promise<ClientCredentialsResult> {\n  const query = `\n    mutation AuthenticateApp($input: AuthenticateAppInput!) {\n      authenticateApp(input: $input) {\n        accessToken tokenType expiresIn scopes\n      }\n    }\n  `;\n\n  const response = await fetch(globalEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      query,\n      variables: { input: { clientId, clientSecret, scopes } },\n    }),\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => 'Unknown error');\n    throw new Error(`App authentication failed (${response.status}): ${text}`);\n  }\n\n  const data = (await response.json()) as {\n    data?: { authenticateApp: { accessToken: string; expiresIn: number; scopes: string[] } };\n    errors?: Array<{ message: string }>;\n  };\n\n  if (data.errors?.length) {\n    throw new Error(`App authentication failed: ${data.errors[0]?.message ?? 'unknown error'}`);\n  }\n  if (!data.data?.authenticateApp?.accessToken) {\n    throw new Error('App authentication failed: no access token returned');\n  }\n\n  return data.data.authenticateApp;\n}\n\nexport async function issueWorkspaceToken(\n  workspaceEndpoint: string,\n  authToken: string,\n  workspaceId: string,\n  organizationId: string,\n): Promise<{ token: string; expiresAt: string; scopes: string[] }> {\n  const query = `\n    mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n      issueWorkspaceToken(input: $input) {\n        success token expiresAt scopes\n        error { code message }\n      }\n    }\n  `;\n\n  const response = await fetch(workspaceEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${authToken}` },\n    body: JSON.stringify({ query, variables: { input: { workspaceId, organizationId } } }),\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => 'Unknown error');\n    throw new Error(`Workspace token request failed (${response.status}): ${text}`);\n  }\n\n  const data = (await response.json()) as {\n    data?: {\n      issueWorkspaceToken: {\n        success: boolean;\n        token: string | null;\n        expiresAt: string | null;\n        scopes: string[] | null;\n        error: { code: string; message: string } | null;\n      };\n    };\n    errors?: Array<{ message: string }>;\n  };\n\n  if (data.errors?.length) {\n    throw new Error(`Workspace token failed: ${data.errors[0]?.message ?? 'unknown error'}`);\n  }\n\n  const result = data.data?.issueWorkspaceToken;\n  if (!result?.success || !result.token) {\n    throw new Error(`Workspace token failed: ${result?.error?.message ?? 'Unknown error'}`);\n  }\n\n  return { token: result.token, expiresAt: result.expiresAt ?? '', scopes: result.scopes ?? [] };\n}\n\nexport async function fetchWorkspaces(\n  globalEndpoint: string,\n  authToken: string,\n): Promise<\n  Array<{ id: string; name: string; slug: string; tenantId: string; organizationId: string }>\n> {\n  const query = `\n    query MyWorkspaces($limit: Int) {\n      myWorkspaces(limit: $limit) {\n        items { id name slug tenantId organizationId }\n      }\n    }\n  `;\n\n  const response = await fetch(globalEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${authToken}` },\n    body: JSON.stringify({ query, variables: { limit: 50 } }),\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => 'Unknown error');\n    throw new Error(`Failed to fetch workspaces (${response.status}): ${text}`);\n  }\n\n  const data = (await response.json()) as {\n    data?: {\n      myWorkspaces: {\n        items: Array<{\n          id: string;\n          name: string;\n          slug: string;\n          tenantId: string;\n          organizationId: string;\n        }>;\n      };\n    };\n    errors?: Array<{ message: string }>;\n  };\n\n  if (data.errors?.length) {\n    throw new Error(`Failed to fetch workspaces: ${data.errors[0]?.message ?? 'unknown error'}`);\n  }\n\n  return data.data?.myWorkspaces?.items ?? [];\n}\n","/**\n * Auth helper for the auth module — ports VibeControlsMCPAuth from\n * vibecontrols-mcp/src/auth/index.ts to a ctx-aware factory.\n *\n * Differences from the legacy class:\n * - Per-ctx instance (no module-level singleton; each product MCP gets its own)\n * - Token persistence delegated to ctx.auth (StoredAuth file)\n * - Endpoints + clientId resolved via ctx.config.resolveOIDC + ctx.config.read\n * - pendingDeviceCode kept in closure scope (alive for the MCP server process,\n *   suitable for stdio's lifetime; HTTP's per-session servers each get their own\n *   pending state)\n *\n * Public surface mirrors the legacy class so the lifted auth/tools.ts works\n * without modification: startLogin / completeLogin / selectWorkspace /\n * listWorkspaces / getStatus / logout / ensureAuthenticated / getHeaders /\n * isLoggedIn / setOnTokensChanged.\n */\n\nimport type { McpContext } from '../../core/index.js';\nimport { fetchWorkspaces, issueWorkspaceToken } from '../../core/auth/device-code.js';\n\ninterface PendingDeviceCode {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  expiresAt: number;\n  interval: number;\n  clientId: string;\n  tokenUrl: string;\n}\n\nexport interface WorkspaceInfo {\n  id: string;\n  name: string;\n  slug: string;\n  tenantId: string;\n  organizationId: string;\n}\n\nexport interface LoginStartResult {\n  status: 'device_code_issued';\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  userCode: string;\n  expiresIn: number;\n  message: string;\n}\n\nexport interface LoginCompleteResult {\n  status: 'authenticated' | 'workspace_selection_required' | 'pending' | 'expired';\n  message: string;\n  workspaces?: WorkspaceInfo[];\n}\n\nexport interface AuthHelper {\n  startLogin(): Promise<LoginStartResult>;\n  completeLogin(): Promise<LoginCompleteResult>;\n  selectWorkspace(workspaceId: string, organizationId: string): Promise<void>;\n  listWorkspaces(): Promise<WorkspaceInfo[]>;\n  ensureAuthenticated(): Promise<void>;\n  getStatus(): Promise<{\n    authenticated: boolean;\n    method: string;\n    expiresAt: string | null;\n    workspaceId: string | null;\n    organizationId: string | null;\n    workspaceTokenExpiresAt: string | null;\n    hasWorkspaceToken: boolean;\n    hasPendingLogin: boolean;\n  }>;\n  logout(): Promise<void>;\n  getHeaders(): Record<string, string>;\n  isLoggedIn(): boolean;\n  setOnTokensChanged(cb: () => void): void;\n}\n\nconst helpers = new WeakMap<McpContext, AuthHelper>();\n\nexport function getAuth(ctx: McpContext): AuthHelper {\n  const cached = helpers.get(ctx);\n  if (cached) return cached;\n  const helper = createAuthHelper(ctx);\n  helpers.set(ctx, helper);\n  return helper;\n}\n\nfunction createAuthHelper(ctx: McpContext): AuthHelper {\n  let pending: PendingDeviceCode | null = null;\n  let onTokensChanged: (() => void) | null = null;\n  let refreshInProgress: Promise<void> | null = null;\n\n  function notify(): void {\n    onTokensChanged?.();\n  }\n\n  async function startLogin(): Promise<LoginStartResult> {\n    const { oidcIssuer, clientId } = ctx.config.resolveOIDC();\n    const deviceCodeUrl = `${oidcIssuer}/oidc/device/code`;\n    const tokenUrl = `${oidcIssuer}/oauth/device/token`;\n\n    const response = await fetch(deviceCodeUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        client_id: clientId,\n        scope: 'openid profile email offline_access',\n      }).toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text().catch(() => 'Unknown error');\n      throw new Error(`Device code request failed (${response.status}): ${text}`);\n    }\n\n    const data = (await response.json()) as Record<string, unknown>;\n    const deviceCode = data['device_code'] as string;\n    const userCode = data['user_code'] as string;\n    const verificationUri = data['verification_uri'] as string;\n    const verificationUriComplete = (data['verification_uri_complete'] as string) ?? null;\n    const expiresIn = (data['expires_in'] as number) ?? 900;\n    const interval = (data['interval'] as number) ?? 5;\n\n    pending = {\n      deviceCode,\n      userCode,\n      verificationUri,\n      verificationUriComplete,\n      expiresAt: Date.now() + expiresIn * 1000,\n      interval,\n      clientId,\n      tokenUrl,\n    };\n\n    return {\n      status: 'device_code_issued',\n      verificationUri,\n      verificationUriComplete,\n      userCode,\n      expiresIn,\n      message: `Open ${verificationUriComplete ?? verificationUri} in a browser and enter code: ${userCode}. Then call ${ctx.productName}_auth_complete to finish authentication.`,\n    };\n  }\n\n  async function completeLogin(): Promise<LoginCompleteResult> {\n    if (!pending) {\n      throw new Error(\n        `No pending login flow. Call ${ctx.productName}_auth_login first to start the device code flow.`,\n      );\n    }\n\n    const p = pending;\n    if (Date.now() >= p.expiresAt) {\n      pending = null;\n      return {\n        status: 'expired',\n        message: `Device code has expired. Call ${ctx.productName}_auth_login again to get a new code.`,\n      };\n    }\n\n    const response = await fetch(p.tokenUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n        device_code: p.deviceCode,\n        client_id: p.clientId,\n      }).toString(),\n    });\n\n    const data = (await response.json()) as Record<string, unknown>;\n\n    if (response.ok && data['access_token']) {\n      pending = null;\n      const expiresIn = (data['expires_in'] as number) ?? 3600;\n      const auth = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n      ctx.auth.write({\n        ...auth,\n        accessToken: data['access_token'] as string,\n        refreshToken: (data['refresh_token'] as string) ?? '',\n        expiresAt: Date.now() + expiresIn * 1000,\n        authMethod: 'device_code',\n      });\n      ctx.gql.reset();\n      return await handlePostLogin();\n    }\n\n    const errorCode = data['error'] as string | undefined;\n    if (errorCode === 'authorization_pending') {\n      return {\n        status: 'pending',\n        message: `Still waiting for user to authorize. Open ${p.verificationUriComplete ?? p.verificationUri} and enter code: ${p.userCode}. Then call ${ctx.productName}_auth_complete again.`,\n      };\n    } else if (errorCode === 'slow_down') {\n      p.interval += 5;\n      return {\n        status: 'pending',\n        message: `Authorization server asked to slow down. Wait a moment, then call ${ctx.productName}_auth_complete again.`,\n      };\n    } else if (errorCode === 'expired_token') {\n      pending = null;\n      return {\n        status: 'expired',\n        message: `Device code has expired. Call ${ctx.productName}_auth_login again.`,\n      };\n    } else if (errorCode === 'access_denied') {\n      pending = null;\n      throw new Error('Authorization was denied by the user.');\n    } else {\n      pending = null;\n      throw new Error(\n        `Device code error: ${(data['error_description'] as string) ?? errorCode ?? 'Unknown'}`,\n      );\n    }\n  }\n\n  async function handlePostLogin(): Promise<LoginCompleteResult> {\n    try {\n      const workspaces = await listWorkspaces();\n      if (workspaces.length === 0) {\n        notify();\n        ctx.logger.info('Device code login successful (no workspaces found)');\n        return {\n          status: 'authenticated',\n          message: `Authentication successful. No workspaces found — use ${ctx.productName}_auth_select_workspace when one is available.`,\n        };\n      }\n      if (workspaces.length === 1) {\n        const ws = workspaces[0];\n        if (!ws)\n          throw new Error('Unexpected: workspaces.length === 1 but workspaces[0] is undefined');\n        await issueAndStoreWorkspaceToken(ws.id, ws.organizationId);\n        ctx.logger.info('Device code login successful', {\n          workspaceId: ws.id,\n          workspaceName: ws.name,\n        });\n        return {\n          status: 'authenticated',\n          message: `Authentication successful. Workspace \"${ws.name}\" selected automatically.`,\n        };\n      }\n      notify();\n      ctx.logger.info('Device code login successful, workspace selection needed');\n      return {\n        status: 'workspace_selection_required',\n        message: `Authentication successful. ${workspaces.length} workspaces available — call ${ctx.productName}_auth_select_workspace to choose one.`,\n        workspaces,\n      };\n    } catch (wsError) {\n      notify();\n      ctx.logger.warn('Workspace discovery failed after login', {\n        error: wsError instanceof Error ? wsError.message : String(wsError),\n      });\n      return {\n        status: 'authenticated',\n        message: `Authentication successful. Workspace discovery failed: ${wsError instanceof Error ? wsError.message : String(wsError)}`,\n      };\n    }\n  }\n\n  async function listWorkspaces(): Promise<WorkspaceInfo[]> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n    return fetchWorkspaces(ctx.config.read().globalEndpoint, auth.accessToken);\n  }\n\n  async function issueAndStoreWorkspaceToken(\n    workspaceId: string,\n    organizationId: string,\n  ): Promise<void> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated.');\n    const result = await issueWorkspaceToken(\n      ctx.config.read().workspaceEndpoint,\n      auth.accessToken,\n      workspaceId,\n      organizationId,\n    );\n    ctx.auth.write({\n      ...auth,\n      workspaceToken: result.token,\n      workspaceTokenExpiresAt: new Date(result.expiresAt).getTime(),\n      workspaceId,\n      organizationId,\n    });\n    ctx.gql.reset();\n    notify();\n  }\n\n  async function selectWorkspace(workspaceId: string, organizationId: string): Promise<void> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n    await issueAndStoreWorkspaceToken(workspaceId, organizationId);\n    ctx.logger.info('Workspace selected', { workspaceId });\n  }\n\n  async function ensureAuthenticated(): Promise<void> {\n    if (refreshInProgress) {\n      await refreshInProgress;\n      return;\n    }\n    const doEnsure = async (): Promise<void> => {\n      const auth = ctx.auth.read();\n      if (auth?.apiKey) return;\n      if (!auth?.accessToken) {\n        throw new Error(\n          `Not authenticated. Call ${ctx.productName}_auth_login to start the login flow, then ${ctx.productName}_auth_complete after authorizing in the browser.`,\n        );\n      }\n      // The shared gql client handles refresh via isTokenExpiringSoon + isWorkspaceTokenExpiringSoon —\n      // trigger by issuing a no-op request that goes through the workspace client's refresh path.\n      // We simulate a no-op via a cheap query if needed; today the gql wrapper does it lazily,\n      // so we just delegate to it on the next request. Nothing to do here.\n    };\n    refreshInProgress = doEnsure().finally(() => {\n      refreshInProgress = null;\n    });\n    await refreshInProgress;\n  }\n\n  function getStatus(): Promise<{\n    authenticated: boolean;\n    method: string;\n    expiresAt: string | null;\n    workspaceId: string | null;\n    organizationId: string | null;\n    workspaceTokenExpiresAt: string | null;\n    hasWorkspaceToken: boolean;\n    hasPendingLogin: boolean;\n  }> {\n    const auth = ctx.auth.read();\n    return Promise.resolve({\n      authenticated: !!(auth?.accessToken || auth?.apiKey),\n      method: auth?.apiKey ? 'api_key' : auth?.accessToken ? 'oauth_token' : 'none',\n      expiresAt: auth?.expiresAt ? new Date(auth.expiresAt).toISOString() : null,\n      workspaceId: auth?.workspaceId ?? null,\n      organizationId: auth?.organizationId ?? null,\n      workspaceTokenExpiresAt: auth?.workspaceTokenExpiresAt\n        ? new Date(auth.workspaceTokenExpiresAt).toISOString()\n        : null,\n      hasWorkspaceToken: !!auth?.workspaceToken,\n      hasPendingLogin: !!pending,\n    });\n  }\n\n  async function logout(): Promise<void> {\n    pending = null;\n    ctx.auth.clear();\n    ctx.gql.reset();\n    notify();\n    ctx.logger.info('Logged out and cleared stored tokens');\n  }\n\n  function getHeaders(): Record<string, string> {\n    const auth = ctx.auth.read();\n    const headers: Record<string, string> = {};\n    if (auth?.apiKey) headers['X-API-Key'] = auth.apiKey;\n    if (auth?.accessToken) headers['Authorization'] = `Bearer ${auth.accessToken}`;\n    if (auth?.workspaceToken)\n      headers['X-Workspace-Authorization'] = `Bearer ${auth.workspaceToken}`;\n    if (auth?.organizationId) headers['x-org-id'] = auth.organizationId;\n    if (auth?.workspaceId) headers['x-workspace-id'] = auth.workspaceId;\n    return headers;\n  }\n\n  function isLoggedIn(): boolean {\n    const auth = ctx.auth.read();\n    return !!(auth?.accessToken || auth?.apiKey);\n  }\n\n  function setOnTokensChanged(cb: () => void): void {\n    onTokensChanged = cb;\n  }\n\n  return {\n    startLogin,\n    completeLogin,\n    selectWorkspace,\n    listWorkspaces,\n    ensureAuthenticated,\n    getStatus,\n    logout,\n    getHeaders,\n    isLoggedIn,\n    setOnTokensChanged,\n  };\n}\n","/**\n * Error classes for MCP SDK.\n *\n * Modules MUST throw these instead of throwing raw Errors. The registerTool\n * wrapper in result.ts catches and maps them to MCP-protocol-compliant\n * `{ isError: true, content: [...] }` responses.\n *\n * Throwing past the wrapper to the protocol surfaces as JSON-RPC -32603 to\n * the client and is a protocol bug.\n */\n\nexport class McpUserError extends Error {\n  public readonly hint: string | undefined;\n\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message);\n    this.name = 'McpUserError';\n    this.hint = opts?.hint;\n  }\n}\n\nexport class McpAuthError extends McpUserError {\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message, {\n      hint: opts?.hint ?? 'Run the auth_login tool to authenticate.',\n    });\n    this.name = 'McpAuthError';\n  }\n}\n\nexport class McpInternalError extends Error {\n  public override readonly cause: unknown;\n\n  constructor(message: string, cause?: unknown) {\n    super(message);\n    this.name = 'McpInternalError';\n    this.cause = cause;\n  }\n}\n","/**\n * Tool / resource / prompt naming helpers.\n *\n * Mandatory product prefix avoids collisions when Claude Desktop runs\n * multiple MCP servers concurrently (typical setup is ~6).\n *\n * Tool names are capped at 63 characters — Claude Desktop pre-1.x\n * truncated at 64 in some versions.\n */\n\nimport { McpInternalError } from './errors.js';\n\nconst MAX_TOOL_NAME_LENGTH = 63;\n\nfunction assertSafeName(name: string, kind: 'tool' | 'resource' | 'prompt'): string {\n  if (kind === 'tool' && name.length > MAX_TOOL_NAME_LENGTH) {\n    throw new McpInternalError(\n      `Tool name '${name}' exceeds ${MAX_TOOL_NAME_LENGTH} characters (some MCP clients truncate at 64).`,\n    );\n  }\n  return name;\n}\n\n/**\n * Build a tool name. Format: `<productName>_<...parts>` (snake_case).\n * Example: mcpToolName('vibecontrols', 'vibes', 'list') -> 'vibecontrols_vibes_list'\n */\nexport function mcpToolName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpToolName: productName is required');\n  }\n  const name = [productName, ...parts].filter(Boolean).join('_');\n  return assertSafeName(name, 'tool');\n}\n\n/**\n * Build a resource URI. Format: `<productName>://<...parts>`.\n * Example: mcpResourceUri('vibecontrols', 'schema') -> 'vibecontrols://schema'\n */\nexport function mcpResourceUri(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpResourceUri: productName is required');\n  }\n  return `${productName}://${parts.filter(Boolean).join('/')}`;\n}\n\n/**\n * Build a prompt name. Format: `<productName>-<...parts>` (kebab-case).\n * Example: mcpPromptName('vibecontrols', 'setup') -> 'vibecontrols-setup'\n */\nexport function mcpPromptName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpPromptName: productName is required');\n  }\n  return [productName, ...parts].filter(Boolean).join('-');\n}\n\nexport const TOOL_NAME_LIMIT = MAX_TOOL_NAME_LENGTH;\n\n/**\n * Name-based hint heuristics for MCP `annotations` (readOnlyHint /\n * destructiveHint). Used by tool-governance.ts to auto-fill annotations for\n * the fleet of product modules that call `server.registerTool` directly\n * (bypassing the `registerTool()` core helper) and so never set them\n * explicitly today (BOFF-3903). Deliberately conservative — matched against\n * whole `_`-delimited segments so e.g. `timeentries_delete` and\n * `pomodoro_delete_goal` match, but a hypothetical `undeletable_check`\n * would not.\n *\n * A module can always override the inference by passing an explicit\n * `annotations` object to `registerTool()` / `server.registerTool()`.\n */\nconst DESTRUCTIVE_NAME_SEGMENT = /(?:^|_)delete(?:_|$)/i;\nconst READ_ONLY_NAME_SEGMENT = /(?:^|_)(?:list|get|search|check|read|count|stats|by_date)(?:_|$)/i;\n\n/** True when a tool name looks destructive (irreversibly deletes data) by naming convention. */\nexport function inferDestructiveHint(toolName: string): boolean {\n  return DESTRUCTIVE_NAME_SEGMENT.test(toolName);\n}\n\n/**\n * True when a tool name looks read-only by naming convention. Never true for\n * a name that also looks destructive (a tool can't be both).\n */\nexport function inferReadOnlyHint(toolName: string): boolean {\n  return !inferDestructiveHint(toolName) && READ_ONLY_NAME_SEGMENT.test(toolName);\n}\n","/**\n * MCP tool result helpers + central handler.\n *\n * Modules NEVER call server.registerTool directly — they use registerTool()\n * from this module so the central try/catch wraps the handler and:\n *   - maps thrown McpUserError / McpAuthError / McpInternalError to\n *     MCP-protocol-compliant `{ isError: true, content: [...] }` shapes\n *   - threads `_meta.progressToken` into ctx.progress for long ops\n *   - emits a structured log line on every error\n *   - never leaks `cause` from McpInternalError to the client\n *\n * This is the analog of cli-sdk's createProgram() central error handler.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { ZodRawShape } from 'zod';\nimport type { McpContext } from './context.js';\nimport { McpAuthError, McpInternalError, McpUserError } from './errors.js';\nimport type { ToolAnnotations } from './tool-governance.js';\n\nexport interface ToolTextContent {\n  type: 'text';\n  text: string;\n  [k: string]: unknown;\n}\n\nexport interface ToolResult {\n  content: ToolTextContent[];\n  isError?: boolean;\n  structuredContent?: Record<string, unknown>;\n  [k: string]: unknown;\n}\n\nexport interface ToolMeta {\n  progressToken?: string | number;\n}\n\n/**\n * Build a successful tool result with JSON content (pretty-printed).\n */\nexport function jsonResult(data: unknown, structured?: Record<string, unknown>): ToolResult {\n  const result: ToolResult = {\n    content: [{ type: 'text', text: JSON.stringify(data, null, 2) }],\n  };\n  if (structured !== undefined) {\n    result.structuredContent = structured;\n  }\n  return result;\n}\n\n/**\n * Build a successful tool result with plain text content.\n */\nexport function textResult(text: string): ToolResult {\n  return { content: [{ type: 'text', text }] };\n}\n\n/**\n * Build an error tool result. Honors MCP's `{ isError: true, content }` shape.\n * Optional hint is appended on a new line so the LLM can react.\n */\nexport function errorResult(message: string, hint?: string): ToolResult {\n  const text = hint ? `${message}\\n\\nHint: ${hint}` : message;\n  return { content: [{ type: 'text', text }], isError: true };\n}\n\nexport interface ToolMetadata {\n  title: string;\n  description: string;\n  inputSchema?: ZodRawShape;\n  /**\n   * Explicit MCP annotations (readOnlyHint / destructiveHint / ...). Optional\n   * — when omitted, `wrapServerWithToolGovernance` (applied centrally in\n   * `createMcpServer`) infers them from the tool name. Set this to override\n   * the inference for a tool whose name doesn't match the naming convention.\n   */\n  annotations?: ToolAnnotations;\n}\n\nexport type ToolHandler<TArgs = Record<string, unknown>> = (\n  args: TArgs,\n  ctx: McpContext,\n  meta: ToolMeta,\n) => Promise<unknown>;\n\n/**\n * Register a tool with the central error wrapper.\n *\n * The handler returns a plain value or void. The wrapper:\n *   - wraps non-undefined returns in jsonResult()\n *   - if the value already looks like a ToolResult (has `content`), passes through\n *   - catches McpAuthError / McpUserError / McpInternalError / generic Error\n *   - logs every error via ctx.logger.error\n */\nexport function registerTool<TArgs extends Record<string, unknown>>(\n  server: McpServer,\n  ctx: McpContext,\n  name: string,\n  metadata: ToolMetadata,\n  handler: ToolHandler<TArgs>,\n): void {\n  const sdkConfig = {\n    title: metadata.title,\n    description: metadata.description,\n    ...(metadata.inputSchema ? { inputSchema: metadata.inputSchema } : {}),\n    ...(metadata.annotations ? { annotations: metadata.annotations } : {}),\n  };\n\n  // The MCP SDK's registerTool signature is `(name, config, handler)`. The\n  // handler arity depends on whether inputSchema is present (1-arg without,\n  // 2-arg with). We accept a unified handler shape and dispatch at runtime.\n  // The SDK's typing is strict and conditional on the inputSchema generic;\n  // bypass with a cast since runtime acceptance is unconditional.\n  const wrapped = async (...callbackArgs: unknown[]): Promise<ToolResult> => {\n    const hasArgs = callbackArgs.length === 2;\n    const args = (hasArgs ? callbackArgs[0] : {}) as TArgs;\n    const extra = (hasArgs ? callbackArgs[1] : callbackArgs[0]) as\n      | { _meta?: { progressToken?: string | number } }\n      | undefined;\n\n    const progressToken = extra?._meta?.progressToken;\n    const meta: ToolMeta = progressToken !== undefined ? { progressToken } : {};\n\n    try {\n      const result = await handler(args, ctx, meta);\n      if (isToolResult(result)) return result;\n      if (result === undefined) return textResult('OK');\n      return jsonResult(result);\n    } catch (error) {\n      return mapErrorToResult(error, ctx, name);\n    }\n  };\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  (server as any).registerTool(name, sdkConfig, wrapped);\n}\n\nfunction isToolResult(value: unknown): value is ToolResult {\n  return (\n    !!value &&\n    typeof value === 'object' &&\n    'content' in value &&\n    Array.isArray((value as ToolResult).content)\n  );\n}\n\nfunction mapErrorToResult(error: unknown, ctx: McpContext, toolName: string): ToolResult {\n  if (error instanceof McpAuthError) {\n    ctx.logger.warn(`${toolName}: auth required`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpUserError) {\n    ctx.logger.info(`${toolName}: user error`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpInternalError) {\n    ctx.logger.error(`${toolName}: internal error`, {\n      message: error.message,\n      cause: stringifyCause(error.cause),\n    });\n    return errorResult(`Internal error in ${toolName}.`);\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  ctx.logger.error(`${toolName}: unhandled error`, { message });\n  return errorResult(`${toolName}: ${message}`);\n}\n\nfunction stringifyCause(cause: unknown): string | undefined {\n  if (cause === undefined || cause === null) return undefined;\n  if (cause instanceof Error) return cause.message;\n  try {\n    return JSON.stringify(cause);\n  } catch {\n    return String(cause);\n  }\n}\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { getAuth } from '../auth/legacy-auth.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\n\nexport function registerAuthTools(\n  server: McpServer,\n  ctx: McpContext,\n  track: (n: string) => string,\n): void {\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_login')),\n    {\n      title: 'Start Login',\n      description:\n        'Start the device code login flow. Returns a verification URL and user code immediately (non-blocking). The user must open the URL in a browser and enter the code, then call vibecontrols_auth_complete to finish.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const auth = getAuth(ctx);\n        const result = await auth.startLogin();\n        return jsonResult(result);\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_login failed', { error });\n        return errorResult(\n          `Login failed: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_complete')),\n    {\n      title: 'Complete Login',\n      description:\n        'Check if the user has completed the device code authorization in their browser. Call this after the user has opened the verification URL and entered the code from vibecontrols_auth_login. Returns \"pending\" if not yet authorized, \"authenticated\" on success.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const auth = getAuth(ctx);\n        const result = await auth.completeLogin();\n        return jsonResult(result);\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_complete failed', { error });\n        return errorResult(\n          `Login completion failed: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_select_workspace')),\n    {\n      title: 'Select Workspace',\n      description:\n        'Select a workspace after login (when multiple workspaces are available). Issues a workspace-scoped token.',\n      inputSchema: {\n        workspaceId: z.string().describe('Workspace ID to select'),\n        organizationId: z.string().describe('Organization ID for the workspace'),\n      },\n    },\n    async ({ workspaceId, organizationId }) => {\n      try {\n        const auth = getAuth(ctx);\n        await auth.selectWorkspace(workspaceId, organizationId);\n        return jsonResult({\n          status: 'workspace_selected',\n          workspaceId,\n          message: `Workspace ${workspaceId} selected and token issued.`,\n        });\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_select_workspace failed', { error });\n        return errorResult(\n          `Failed to select workspace: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_workspaces')),\n    {\n      title: 'List Workspaces',\n      description: 'List all workspaces available to the authenticated user.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const auth = getAuth(ctx);\n        const workspaces = await auth.listWorkspaces();\n        return jsonResult({ workspaces, total: workspaces.length });\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_workspaces failed', { error });\n        return errorResult(\n          `Failed to list workspaces: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_status')),\n    {\n      title: 'Auth Status',\n      description:\n        'Show current authentication status including method, token expiration, workspace info, and pending login state.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const auth = getAuth(ctx);\n        const status = await auth.getStatus();\n        return jsonResult(status);\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_status failed', { error });\n        return errorResult(\n          `Failed to get auth status: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_logout')),\n    {\n      title: 'Logout',\n      description: 'Log out and clear all stored authentication tokens.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const auth = getAuth(ctx);\n        await auth.logout();\n        return jsonResult({\n          status: 'logged_out',\n          message: 'Tokens cleared successfully.',\n        });\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_logout failed', { error });\n        return errorResult(\n          `Logout failed: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n}\n","/**\n * Extended auth GraphQL operations (Phase 2 additions).\n *\n * Ported verbatim from cli-sdk/src/modules/auth/extra-operations.ts so the\n * field selections stay aligned across CLI and MCP. All operations live on\n * the global gateway; calling code uses ctx.gql.global.request().\n */\n\n// ── SDK-parity operations ────────────────────────────────────────────────\n// Mirror sdk-libs-node/src/modules/auth/operations.ts so MCP tools that close\n// the parity gap (auth_sign_up / auth_authenticate_app / auth_sign_in /\n// auth_refresh_token / etc.) hit the same backend mutations as the SDK.\n\nexport const SIGN_UP = `\n  mutation SignUp($input: SignUpInput!) {\n    signUp(input: $input) {\n      user { id email username }\n      accessToken\n      refreshToken\n      expiresIn\n    }\n  }\n`;\n\nexport const SIGN_IN = `\n  mutation SignIn($input: SignInInput!) {\n    signIn(input: $input) {\n      user { id email username }\n      accessToken\n      refreshToken\n      expiresIn\n    }\n  }\n`;\n\nexport const REFRESH_TOKEN_OP = `\n  mutation RefreshToken($token: String!) {\n    refreshToken(token: $token) {\n      user { id email username }\n      accessToken\n      refreshToken\n      expiresIn\n    }\n  }\n`;\n\nexport const SIGN_OUT = `\n  mutation SignOut {\n    signOut\n  }\n`;\n\nexport const AUTHENTICATE_APP = `\n  mutation AuthenticateApp($input: AuthenticateAppInput!) {\n    authenticateApp(input: $input) {\n      accessToken\n      tokenType\n      expiresIn\n      scopes\n    }\n  }\n`;\n\nexport const ME = `\n  query Me {\n    me { id email username isActive emailVerified }\n  }\n`;\n\nexport const CURRENT_USER = `\n  query currentUser {\n    currentUser {\n      id email firstName lastName username phoneNumber name\n      emailVerified mfaEnabled isAdmin role status createdAt lastLoginAt\n    }\n  }\n`;\n\nexport const UPDATE_CURRENT_USER_PROFILE = `\n  mutation updateCurrentUserProfile($input: UpdateUserInput!) {\n    updateCurrentUserProfile(input: $input) {\n      id name firstName lastName username phoneNumber timezone language\n    }\n  }\n`;\n\nexport const AUTH_AUDIT_LOGS = `\n  query authAuditLogs($pagination: PaginationInput) {\n    authAuditLogs(pagination: $pagination) {\n      id action resource resourceType resourceId description\n      ipAddress userAgent metadata createdAt\n    }\n  }\n`;\n\nexport const ACTIVE_SESSIONS = `\n  query activeSessions($pagination: PaginationInput) {\n    activeSessions(pagination: $pagination) {\n      id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent\n    }\n  }\n`;\n\nexport const REVOKE_SESSION = `\n  mutation revokeSession($id: ID!) {\n    revokeSession(id: $id)\n  }\n`;\n\nexport const CURRENT_USER_MFA_METHODS = `\n  query currentUserMFAMethods($pagination: PaginationInput) {\n    currentUserMFAMethods(pagination: $pagination) {\n      id method status createdAt updatedAt\n    }\n  }\n`;\n\nexport const SETUP_MFA = `\n  mutation setupMFA($method: MFAMethod!) {\n    setupMFA(method: $method) {\n      method backupCodes qrCode secret\n    }\n  }\n`;\n\nexport const VERIFY_MFA = `\n  mutation verifyMFA($input: MFAVerifyInput!) {\n    verifyMFA(input: $input) {\n      success token expiresIn user { id email }\n    }\n  }\n`;\n\nexport const ENABLE_MFA = `\n  mutation enableMFA($code: String!) {\n    enableMFA(code: $code)\n  }\n`;\n\nexport const DISABLE_MFA = `\n  mutation disableMFA {\n    disableMFA\n  }\n`;\n\nexport const MY_API_KEYS = `\n  query myApiKeys($pagination: PaginationInput) {\n    myApiKeys(pagination: $pagination) {\n      id name prefix appId appName scopes expiresAt lastUsedAt createdAt\n    }\n  }\n`;\n\nexport const APP_API_KEYS = `\n  query appApiKeys($appId: ID!, $pagination: PaginationInput) {\n    appApiKeys(appId: $appId, pagination: $pagination) {\n      id name prefix appId appName scopes expiresAt lastUsedAt createdAt\n    }\n  }\n`;\n\nexport const GENERATE_API_KEY = `\n  mutation generateAPIKey($input: GenerateAPIKeyInput!) {\n    generateAPIKey(input: $input) {\n      keyId apiKey apiSecret\n    }\n  }\n`;\n\nexport const UPDATE_API_KEY = `\n  mutation updateAPIKey($keyId: String!, $input: UpdateAPIKeyInput!) {\n    updateAPIKey(keyId: $keyId, input: $input) {\n      id name scope expiresAt\n    }\n  }\n`;\n\nexport const REVOKE_API_KEY = `\n  mutation revokeAPIKey($keyId: String!) {\n    revokeAPIKey(keyId: $keyId)\n  }\n`;\n\nexport const ROTATE_API_KEY = `\n  mutation rotateAPIKey($keyId: String!) {\n    rotateAPIKey(keyId: $keyId) {\n      apiSecret\n    }\n  }\n`;\n\nexport const CURRENT_USER_DELEGATIONS = `\n  query currentUserDelegations($pagination: PaginationInput) {\n    currentUserDelegations(pagination: $pagination) {\n      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds\n      status revokedAt revokedBy\n      app { id name }\n    }\n  }\n`;\n\nexport const GRANT_DELEGATION = `\n  mutation grantDelegation($input: GrantDelegationInput!) {\n    grantDelegation(input: $input) {\n      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds status\n    }\n  }\n`;\n\nexport const REVOKE_DELEGATION = `\n  mutation revokeDelegation($id: ID!, $reason: String) {\n    revokeDelegation(id: $id, reason: $reason)\n  }\n`;\n\nexport const CURRENT_USER_APPS = `\n  query currentUserApps($pagination: PaginationInput) {\n    currentUserApps(pagination: $pagination) {\n      id clientId name description type actorType status ownerUserId\n      redirectUris scopes createdAt updatedAt\n    }\n  }\n`;\n\nexport const GET_APP = `\n  query app($id: ID!) {\n    app(id: $id) {\n      id clientId name description type actorType status ownerUserId redirectUris scopes\n    }\n  }\n`;\n\nexport const CREATE_APP = `\n  mutation createApp($input: CreateAppInput!) {\n    createApp(input: $input) {\n      app { id clientId name type status }\n      clientSecret\n    }\n  }\n`;\n\nexport const UPDATE_APP = `\n  mutation updateApp($id: ID!, $input: UpdateAppInput!) {\n    updateApp(id: $id, input: $input) {\n      id name description redirectUris scopes status\n    }\n  }\n`;\n\nexport const DEACTIVATE_APP = `\n  mutation deactivateApp($id: ID!) {\n    deactivateApp(id: $id)\n  }\n`;\n\nexport const GET_SSO_CONFIG = `\n  query getSSOConfig($tenantId: String!) {\n    getSSOConfig(tenantId: $tenantId) {\n      id identifier tenantId entityId ssoUrl sloUrl certificate enabled metadata\n    }\n  }\n`;\n\nexport const SAVE_SSO_CONFIG = `\n  mutation saveSSOConfig($tenantId: String!, $input: SSOConfigInput!) {\n    saveSSOConfig(tenantId: $tenantId, input: $input) {\n      id identifier entityId ssoUrl sloUrl certificate enabled\n    }\n  }\n`;\n\nexport const DELETE_SSO_CONFIG = `\n  mutation deleteSSOConfig($tenantId: String!) {\n    deleteSSOConfig(tenantId: $tenantId)\n  }\n`;\n\nexport const LIST_USERS = `\n  query users($filter: UserFilterInput, $pagination: PaginationInput) {\n    users(filter: $filter, pagination: $pagination) {\n      users { id email firstName lastName username role status createdAt }\n      totalCount hasMore\n    }\n  }\n`;\n\nexport const GET_USER = `\n  query user($id: ID!) {\n    user(id: $id) {\n      id email firstName lastName username role status emailVerified lastLoginAt\n    }\n  }\n`;\n\nexport const UPDATE_USER = `\n  mutation updateUser($id: ID!, $input: AdminUpdateUserInput!) {\n    updateUser(id: $id, input: $input) {\n      id email firstName lastName username role status\n    }\n  }\n`;\n\nexport const INVITE_USER = `\n  mutation inviteUser($input: InviteUserInput!) {\n    inviteUser(input: $input) {\n      id email status invitedAt expiresAt\n    }\n  }\n`;\n","/**\n * SDK-parity auth tools (Phase 2.1) — closes the gap between\n * sdk-libs-node/src/modules/auth/api.ts and the MCP surface.\n *\n * Adds the 4 auth flows that have NO existing MCP equivalent and are\n * meaningful for an AI agent driving the SDK:\n *\n *   - auth_sign_up                      → email/password account registration\n *   - auth_sign_in                      → email/password sign-in (distinct from\n *                                          the device-code `auth_login`)\n *   - auth_refresh_token                → explicit token refresh (the gql client\n *                                          auto-refreshes; this exposes the\n *                                          mutation for headless/test callers)\n *   - auth_get_current_user             → SDK `me` query (newer, lighter shape\n *                                          than the `currentUser` query already\n *                                          backing auth_profile_get)\n *   - auth_authenticate_app             → M2M auth via GraphQL `authenticateApp`\n *                                          mutation; persists token.\n *   - auth_login_with_api_key           → stash an API key in the auth store so\n *                                          the gql client sends `X-API-Key`\n *   - auth_login_with_client_credentials → OAuth2 client_credentials grant\n *                                          (REST against oidcIssuer/token)\n *\n * All token-persisting tools write through `ctx.auth.write()` and\n * `ctx.gql.reset()` so subsequent module calls use the freshly-issued tokens\n * without restarting the MCP server.\n */\n\nimport { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport { clientCredentialsFlow } from '../../core/auth/device-code.js';\nimport * as ops from './operations.js';\n\ninterface AuthPayload {\n  user: { id: string; email: string; username: string };\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\ninterface AuthCodeExchangeResult {\n  accessToken: string;\n  tokenType: string;\n  expiresIn: number;\n  scopes: string[];\n}\n\ninterface MeUser {\n  id: string;\n  email: string;\n  username: string;\n  isActive?: boolean;\n  emailVerified?: boolean;\n}\n\nfunction err(\n  ctx: McpContext,\n  name: string,\n  message: string,\n  error: unknown,\n): ReturnType<typeof errorResult> {\n  ctx.logger.error(`${name} failed`, { error });\n  return errorResult(`${message}: ${error instanceof Error ? error.message : String(error)}`);\n}\n\nfunction persistOAuthTokens(ctx: McpContext, payload: AuthPayload): void {\n  const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n  ctx.auth.write({\n    ...existing,\n    accessToken: payload.accessToken,\n    refreshToken: payload.refreshToken,\n    expiresAt: Date.now() + payload.expiresIn * 1000,\n    authMethod: 'device_code',\n  });\n  ctx.gql.reset();\n}\n\nexport function registerAuthMoreTools(\n  server: McpServer,\n  ctx: McpContext,\n  track: (n: string) => string,\n): void {\n  // ── auth sign_up / sign_in / refresh / sign_out / get_current_user ──────\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_sign_up')),\n    {\n      title: 'Sign Up',\n      description:\n        'Register a new account via email/username/password and immediately sign in. Persists access + refresh tokens. Returns { user, accessToken, refreshToken, expiresIn }.',\n      inputSchema: {\n        email: z.string().describe('Email address for the new account'),\n        username: z.string().describe('Username (must be unique)'),\n        password: z.string().describe('Password (caller is responsible for strength policy)'),\n        firstName: z.string().optional().describe('Optional first name'),\n        lastName: z.string().optional().describe('Optional last name'),\n      },\n    },\n    async ({ email, username, password, firstName, lastName }) => {\n      try {\n        const input: Record<string, unknown> = { email, username, password };\n        if (firstName !== undefined) input.firstName = firstName;\n        if (lastName !== undefined) input.lastName = lastName;\n        const d = await ctx.gql.global.request<{ signUp: AuthPayload }>(ops.SIGN_UP, { input });\n        persistOAuthTokens(ctx, d.signUp);\n        return jsonResult({\n          status: 'authenticated',\n          user: d.signUp.user,\n          accessToken: d.signUp.accessToken,\n          refreshToken: d.signUp.refreshToken,\n          expiresIn: d.signUp.expiresIn,\n        });\n      } catch (e) {\n        return err(ctx, 'auth_sign_up', 'Sign up failed', e);\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_sign_in')),\n    {\n      title: 'Sign In',\n      description:\n        'Sign in with username + password (server-side credential flow, distinct from the device-code `auth_login`). Persists access + refresh tokens. Returns { user, accessToken, refreshToken, expiresIn }.',\n      inputSchema: {\n        username: z.string().describe('Username or email'),\n        password: z.string().describe('Password'),\n      },\n    },\n    async ({ username, password }) => {\n      try {\n        const d = await ctx.gql.global.request<{ signIn: AuthPayload }>(ops.SIGN_IN, {\n          input: { username, password },\n        });\n        persistOAuthTokens(ctx, d.signIn);\n        return jsonResult({\n          status: 'authenticated',\n          user: d.signIn.user,\n          accessToken: d.signIn.accessToken,\n          refreshToken: d.signIn.refreshToken,\n          expiresIn: d.signIn.expiresIn,\n        });\n      } catch (e) {\n        return err(ctx, 'auth_sign_in', 'Sign in failed', e);\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_refresh_token')),\n    {\n      title: 'Refresh Token',\n      description:\n        'Exchange the stored refreshToken for a fresh access + refresh pair. The gql client auto-refreshes when tokens are near expiry; use this tool only when you need to force a refresh now. Persists new tokens. Returns the new { accessToken, expiresIn }.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const existing = ctx.auth.read();\n        if (!existing?.refreshToken) {\n          return errorResult(\n            'No refresh token available. Sign in first via auth_sign_in / auth_sign_up / auth_login.',\n          );\n        }\n        const d = await ctx.gql.global.request<{ refreshToken: AuthPayload }>(\n          ops.REFRESH_TOKEN_OP,\n          {\n            token: existing.refreshToken,\n          },\n        );\n        persistOAuthTokens(ctx, d.refreshToken);\n        return jsonResult({\n          status: 'refreshed',\n          accessToken: d.refreshToken.accessToken,\n          expiresIn: d.refreshToken.expiresIn,\n        });\n      } catch (e) {\n        return err(ctx, 'auth_refresh_token', 'Token refresh failed', e);\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_get_current_user')),\n    {\n      title: 'Get Current User',\n      description:\n        'Fetch the authenticated user via the SDK `me` query (id, email, username, isActive, emailVerified). Lighter than auth_profile_get and matches the SDK shape. Use auth_status to check authentication state locally without a network round-trip.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const d = await ctx.gql.global.request<{ me: MeUser }>(ops.ME);\n        return jsonResult(d.me);\n      } catch (e) {\n        return err(ctx, 'auth_get_current_user', 'Failed to fetch current user', e);\n      }\n    },\n  );\n\n  // ── M2M / headless auth flows ───────────────────────────────────────────\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_authenticate_app')),\n    {\n      title: 'Authenticate App',\n      description:\n        'Machine-to-machine auth via the `authenticateApp` GraphQL mutation. Pass an OAuth app client_id + client_secret (and optional scopes) to receive an access token; persists token for subsequent calls. Returns { accessToken, tokenType, expiresIn, scopes }.',\n      inputSchema: {\n        clientId: z.string().describe('OAuth app clientId'),\n        clientSecret: z\n          .string()\n          .describe('OAuth app clientSecret (shown only once on app creation)'),\n        scopes: z\n          .array(z.string())\n          .optional()\n          .describe('Optional list of scope strings to request'),\n      },\n    },\n    async ({ clientId, clientSecret, scopes }) => {\n      try {\n        const input: Record<string, unknown> = { clientId, clientSecret };\n        if (scopes !== undefined) input.scopes = scopes;\n        const d = await ctx.gql.global.request<{ authenticateApp: AuthCodeExchangeResult }>(\n          ops.AUTHENTICATE_APP,\n          { input },\n        );\n        const result = d.authenticateApp;\n        const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n        ctx.auth.write({\n          ...existing,\n          accessToken: result.accessToken,\n          refreshToken: '',\n          expiresAt: Date.now() + result.expiresIn * 1000,\n          authMethod: 'client_credentials',\n          clientId,\n          clientSecret,\n        });\n        ctx.gql.reset();\n        return jsonResult({\n          status: 'authenticated',\n          accessToken: result.accessToken,\n          tokenType: result.tokenType,\n          expiresIn: result.expiresIn,\n          scopes: result.scopes,\n        });\n      } catch (e) {\n        return err(ctx, 'auth_authenticate_app', 'App authentication failed', e);\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_login_with_api_key')),\n    {\n      title: 'Login with API Key',\n      description:\n        'Authenticate with a pre-issued API key (headless service mode). The key is stored locally and sent as `X-API-Key` on every gateway request; no network call is made by this tool. Use auth_status to verify. Returns { status: \"authenticated\", method: \"api_key\" }.',\n      inputSchema: {\n        apiKey: z.string().describe('Pre-issued API key (e.g. from auth_api_keys_create)'),\n      },\n    },\n    async ({ apiKey }) => {\n      try {\n        const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n        ctx.auth.write({\n          ...existing,\n          apiKey,\n          authMethod: 'api_key',\n        });\n        ctx.gql.reset();\n        return jsonResult({\n          status: 'authenticated',\n          method: 'api_key',\n          message: 'API key stored. Subsequent calls will use X-API-Key.',\n        });\n      } catch (e) {\n        return err(ctx, 'auth_login_with_api_key', 'Failed to set API key', e);\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_login_with_client_credentials')),\n    {\n      title: 'Login with Client Credentials',\n      description:\n        'OAuth2 client_credentials grant (REST against oidcIssuer/token). Equivalent to auth_authenticate_app but uses the OIDC token endpoint instead of the GraphQL mutation; prefer auth_authenticate_app inside the platform. Persists the issued token. Returns { accessToken, expiresIn, scopes }.',\n      inputSchema: {\n        clientId: z.string().describe('OAuth app clientId'),\n        clientSecret: z.string().describe('OAuth app clientSecret'),\n        scopes: z.array(z.string()).optional().describe('Optional list of scope strings'),\n      },\n    },\n    async ({ clientId, clientSecret, scopes }) => {\n      try {\n        const cfg = ctx.config.read();\n        const result = await clientCredentialsFlow(\n          cfg.globalEndpoint,\n          clientId,\n          clientSecret,\n          scopes,\n        );\n        const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n        ctx.auth.write({\n          ...existing,\n          accessToken: result.accessToken,\n          refreshToken: '',\n          expiresAt: Date.now() + result.expiresIn * 1000,\n          authMethod: 'client_credentials',\n          clientId,\n          clientSecret,\n        });\n        ctx.gql.reset();\n        return jsonResult({\n          status: 'authenticated',\n          accessToken: result.accessToken,\n          expiresIn: result.expiresIn,\n          scopes: result.scopes,\n        });\n      } catch (e) {\n        return err(ctx, 'auth_login_with_client_credentials', 'Client credentials login failed', e);\n      }\n    },\n  );\n}\n","/**\n * Auth module — login flow + workspace selection + status + logout.\n *\n * Phase 1 ships the SUBSET that exists in vibecontrols-mcp@main:\n *   <product>_auth_{login,complete,select_workspace,workspaces,status,logout}\n *\n * Phase 2 finishes the full auth surface (mfa, api-keys, audit-log,\n * delegations, apps, sso, users, profile, sessions).\n *\n * Phase 2.1 closes the SDK-parity gap (more-tools.ts):\n *   sign_up, sign_in, refresh_token, get_current_user, authenticate_app,\n *   login_with_api_key, login_with_client_credentials.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerAuthTools } from './tools.js';\nimport { registerAuthMoreTools } from './more-tools.js';\n\nconst authModule: McpModule = {\n  id: 'auth',\n  version: '0.0.1',\n  displayName: 'Authentication',\n  capabilities: { tools: {} },\n\n  register(server: McpServer, ctx: McpContext): ModuleRegistration {\n    const tools: string[] = [];\n    const track = (n: string): string => {\n      tools.push(n);\n      return n;\n    };\n\n    registerAuthTools(server, ctx, track);\n    registerAuthMoreTools(server, ctx, track);\n\n    return { tools, resources: [], prompts: [] };\n  },\n};\n\nexport default authModule;\nexport { getAuth, type AuthHelper, type WorkspaceInfo } from './legacy-auth.js';\n"]}
+{"version":3,"sources":["../../../src/core/auth/device-code.ts","../../../src/modules/auth/legacy-auth.ts","../../../src/core/errors.ts","../../../src/core/tool-name.ts","../../../src/core/result.ts","../../../src/modules/auth/tools.ts","../../../src/modules/auth/operations.ts","../../../src/modules/auth/more-tools.ts","../../../src/modules/auth/index.ts"],"names":["fetch","z"],"mappings":";;;;;;;;;;;;;;;AAgIA,eAAsB,qBAAA,CACpB,cAAA,EACA,QAAA,EACA,YAAA,EACA,MAAA,EACkC;AAClC,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AAQd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,cAAA,EAAgB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,OAAA,EAAS,EAAE,cAAA,EAAgB,kBAAA,EAAmB;AAAA,IAC9C,IAAA,EAAM,KAAK,SAAA,CAAU;AAAA,MACnB,KAAA;AAAA,MACA,WAAW,EAAE,KAAA,EAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO;AAAE,KACxD;AAAA,GACF,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,2BAAA,EAA8B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAC3E;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAKlC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,2BAAA,EAA8B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EAC5F;AACA,EAAA,IAAI,CAAC,IAAA,CAAK,IAAA,EAAM,eAAA,EAAiB,WAAA,EAAa;AAC5C,IAAA,MAAM,IAAI,MAAM,qDAAqD,CAAA;AAAA,EACvE;AAEA,EAAA,OAAO,KAAK,IAAA,CAAK,eAAA;AACnB;AAEA,eAAsB,mBAAA,CACpB,iBAAA,EACA,SAAA,EACA,WAAA,EACA,cAAA,EACiE;AACjE,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AASd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,iBAAA,EAAmB;AAAA,IAC9C,MAAA,EAAQ,MAAA;AAAA,IACR,SAAS,EAAE,cAAA,EAAgB,oBAAoB,aAAA,EAAe,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,EAAG;AAAA,IACpF,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,SAAA,EAAW,EAAE,KAAA,EAAO,EAAE,WAAA,EAAa,cAAA,EAAe,IAAK;AAAA,GACtF,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,gCAAA,EAAmC,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAChF;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAalC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,wBAAA,EAA2B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EACzF;AAEA,EAAA,MAAM,MAAA,GAAS,KAAK,IAAA,EAAM,mBAAA;AAC1B,EAAA,IAAI,CAAC,MAAA,EAAQ,OAAA,IAAW,CAAC,OAAO,KAAA,EAAO;AACrC,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,wBAAA,EAA2B,QAAQ,KAAA,EAAO,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EACxF;AAEA,EAAA,OAAO,EAAE,KAAA,EAAO,MAAA,CAAO,KAAA,EAAO,SAAA,EAAW,MAAA,CAAO,SAAA,IAAa,EAAA,EAAI,MAAA,EAAQ,MAAA,CAAO,MAAA,IAAU,EAAC,EAAE;AAC/F;AAEA,eAAsB,eAAA,CACpB,gBACA,SAAA,EAGA;AACA,EAAA,MAAM,KAAA,GAAQ;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAAA,CAAA;AAQd,EAAA,MAAM,QAAA,GAAW,MAAMA,uBAAAA,CAAM,cAAA,EAAgB;AAAA,IAC3C,MAAA,EAAQ,MAAA;AAAA,IACR,SAAS,EAAE,cAAA,EAAgB,oBAAoB,aAAA,EAAe,CAAA,OAAA,EAAU,SAAS,CAAA,CAAA,EAAG;AAAA,IACpF,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,EAAE,KAAA,EAAO,WAAW,EAAE,KAAA,EAAO,EAAA,EAAG,EAAG;AAAA,GACzD,CAAA;AAED,EAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,IAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,IAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,EAC5E;AAEA,EAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAelC,EAAA,IAAI,IAAA,CAAK,QAAQ,MAAA,EAAQ;AACvB,IAAA,MAAM,IAAI,MAAM,CAAA,4BAAA,EAA+B,IAAA,CAAK,OAAO,CAAC,CAAA,EAAG,OAAA,IAAW,eAAe,CAAA,CAAE,CAAA;AAAA,EAC7F;AAEA,EAAA,OAAO,IAAA,CAAK,IAAA,EAAM,YAAA,EAAc,KAAA,IAAS,EAAC;AAC5C;;;AC9LA,IAAM,OAAA,uBAAc,OAAA,EAAgC;AAE7C,SAAS,QAAQ,GAAA,EAA6B;AACnD,EAAA,MAAM,MAAA,GAAS,OAAA,CAAQ,GAAA,CAAI,GAAG,CAAA;AAC9B,EAAA,IAAI,QAAQ,OAAO,MAAA;AACnB,EAAA,MAAM,MAAA,GAAS,iBAAiB,GAAG,CAAA;AACnC,EAAA,OAAA,CAAQ,GAAA,CAAI,KAAK,MAAM,CAAA;AACvB,EAAA,OAAO,MAAA;AACT;AAEA,SAAS,iBAAiB,GAAA,EAA6B;AACrD,EAAA,IAAI,OAAA,GAAoC,IAAA;AACxC,EAAA,IAAI,eAAA,GAAuC,IAAA;AAC3C,EAAA,IAAI,iBAAA,GAA0C,IAAA;AAE9C,EAAA,SAAS,MAAA,GAAe;AACtB,IAAA,eAAA,IAAkB;AAAA,EACpB;AAEA,EAAA,eAAe,UAAA,GAAwC;AACrD,IAAA,MAAM,EAAE,UAAA,EAAY,QAAA,EAAS,GAAI,GAAA,CAAI,OAAO,WAAA,EAAY;AACxD,IAAA,MAAM,aAAA,GAAgB,GAAG,UAAU,CAAA,iBAAA,CAAA;AACnC,IAAA,MAAM,QAAA,GAAW,GAAG,UAAU,CAAA,mBAAA,CAAA;AAE9B,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,aAAA,EAAe;AAAA,MAC1C,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,SAAA,EAAW,QAAA;AAAA,QACX,KAAA,EAAO;AAAA,OACR,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,IAAI,CAAC,SAAS,EAAA,EAAI;AAChB,MAAA,MAAM,OAAO,MAAM,QAAA,CAAS,MAAK,CAAE,KAAA,CAAM,MAAM,eAAe,CAAA;AAC9D,MAAA,MAAM,IAAI,KAAA,CAAM,CAAA,4BAAA,EAA+B,SAAS,MAAM,CAAA,GAAA,EAAM,IAAI,CAAA,CAAE,CAAA;AAAA,IAC5E;AAEA,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAClC,IAAA,MAAM,UAAA,GAAa,KAAK,aAAa,CAAA;AACrC,IAAA,MAAM,QAAA,GAAW,KAAK,WAAW,CAAA;AACjC,IAAA,MAAM,eAAA,GAAkB,KAAK,kBAAkB,CAAA;AAC/C,IAAA,MAAM,uBAAA,GAA2B,IAAA,CAAK,2BAA2B,CAAA,IAAgB,IAAA;AACjF,IAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,GAAA;AACpD,IAAA,MAAM,QAAA,GAAY,IAAA,CAAK,UAAU,CAAA,IAAgB,CAAA;AAEjD,IAAA,OAAA,GAAU;AAAA,MACR,UAAA;AAAA,MACA,QAAA;AAAA,MACA,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,MACpC,QAAA;AAAA,MACA,QAAA;AAAA,MACA;AAAA,KACF;AAEA,IAAA,OAAO;AAAA,MACL,MAAA,EAAQ,oBAAA;AAAA,MACR,eAAA;AAAA,MACA,uBAAA;AAAA,MACA,QAAA;AAAA,MACA,SAAA;AAAA,MACA,OAAA,EAAS,QAAQ,uBAAA,IAA2B,eAAe,iCAAiC,QAAQ,CAAA,YAAA,EAAe,IAAI,WAAW,CAAA,wCAAA;AAAA,KACpI;AAAA,EACF;AAEA,EAAA,eAAe,aAAA,GAA8C;AAC3D,IAAA,IAAI,CAAC,OAAA,EAAS;AACZ,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,4BAAA,EAA+B,IAAI,WAAW,CAAA,gDAAA;AAAA,OAChD;AAAA,IACF;AAEA,IAAA,MAAM,CAAA,GAAI,OAAA;AACV,IAAA,IAAI,IAAA,CAAK,GAAA,EAAI,IAAK,CAAA,CAAE,SAAA,EAAW;AAC7B,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,oCAAA;AAAA,OAC3D;AAAA,IACF;AAEA,IAAA,MAAM,QAAA,GAAW,MAAM,KAAA,CAAM,CAAA,CAAE,QAAA,EAAU;AAAA,MACvC,MAAA,EAAQ,MAAA;AAAA,MACR,OAAA,EAAS,EAAE,cAAA,EAAgB,mCAAA,EAAoC;AAAA,MAC/D,IAAA,EAAM,IAAI,eAAA,CAAgB;AAAA,QACxB,UAAA,EAAY,8CAAA;AAAA,QACZ,aAAa,CAAA,CAAE,UAAA;AAAA,QACf,WAAW,CAAA,CAAE;AAAA,OACd,EAAE,QAAA;AAAS,KACb,CAAA;AAED,IAAA,MAAM,IAAA,GAAQ,MAAM,QAAA,CAAS,IAAA,EAAK;AAElC,IAAA,IAAI,QAAA,CAAS,EAAA,IAAM,IAAA,CAAK,cAAc,CAAA,EAAG;AACvC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,SAAA,GAAa,IAAA,CAAK,YAAY,CAAA,IAAgB,IAAA;AACpD,MAAA,MAAM,IAAA,GAAO,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACpE,MAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,QACb,GAAG,IAAA;AAAA,QACH,WAAA,EAAa,KAAK,cAAc,CAAA;AAAA,QAChC,YAAA,EAAe,IAAA,CAAK,eAAe,CAAA,IAAgB,EAAA;AAAA,QACnD,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,SAAA,GAAY,GAAA;AAAA,QACpC,UAAA,EAAY;AAAA,OACb,CAAA;AACD,MAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,MAAA,OAAO,MAAM,eAAA,EAAgB;AAAA,IAC/B;AAEA,IAAA,MAAM,SAAA,GAAY,KAAK,OAAO,CAAA;AAC9B,IAAA,IAAI,cAAc,uBAAA,EAAyB;AACzC,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,0CAAA,EAA6C,CAAA,CAAE,uBAAA,IAA2B,CAAA,CAAE,eAAe,CAAA,iBAAA,EAAoB,CAAA,CAAE,QAAQ,CAAA,YAAA,EAAe,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAClK;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,WAAA,EAAa;AACpC,MAAA,CAAA,CAAE,QAAA,IAAY,CAAA;AACd,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,kEAAA,EAAqE,GAAA,CAAI,WAAW,CAAA,qBAAA;AAAA,OAC/F;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,SAAA;AAAA,QACR,OAAA,EAAS,CAAA,8BAAA,EAAiC,GAAA,CAAI,WAAW,CAAA,kBAAA;AAAA,OAC3D;AAAA,IACF,CAAA,MAAA,IAAW,cAAc,eAAA,EAAiB;AACxC,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,MAAM,uCAAuC,CAAA;AAAA,IACzD,CAAA,MAAO;AACL,MAAA,OAAA,GAAU,IAAA;AACV,MAAA,MAAM,IAAI,KAAA;AAAA,QACR,CAAA,mBAAA,EAAuB,IAAA,CAAK,mBAAmB,CAAA,IAAgB,aAAa,SAAS,CAAA;AAAA,OACvF;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,eAAA,GAAgD;AAC7D,IAAA,IAAI;AACF,MAAA,MAAM,UAAA,GAAa,MAAM,cAAA,EAAe;AACxC,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAA,EAAO;AACP,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,oDAAoD,CAAA;AACpE,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,0DAAA,EAAwD,GAAA,CAAI,WAAW,CAAA,6CAAA;AAAA,SAClF;AAAA,MACF;AACA,MAAA,IAAI,UAAA,CAAW,WAAW,CAAA,EAAG;AAC3B,QAAA,MAAM,EAAA,GAAK,WAAW,CAAC,CAAA;AACvB,QAAA,IAAI,CAAC,EAAA;AACH,UAAA,MAAM,IAAI,MAAM,oEAAoE,CAAA;AACtF,QAAA,MAAM,2BAAA,CAA4B,EAAA,CAAG,EAAA,EAAI,EAAA,CAAG,cAAc,CAAA;AAC1D,QAAA,GAAA,CAAI,MAAA,CAAO,KAAK,8BAAA,EAAgC;AAAA,UAC9C,aAAa,EAAA,CAAG,EAAA;AAAA,UAChB,eAAe,EAAA,CAAG;AAAA,SACnB,CAAA;AACD,QAAA,OAAO;AAAA,UACL,MAAA,EAAQ,eAAA;AAAA,UACR,OAAA,EAAS,CAAA,sCAAA,EAAyC,EAAA,CAAG,IAAI,CAAA,yBAAA;AAAA,SAC3D;AAAA,MACF;AACA,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,0DAA0D,CAAA;AAC1E,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,8BAAA;AAAA,QACR,SAAS,CAAA,2BAAA,EAA8B,UAAA,CAAW,MAAM,CAAA,kCAAA,EAAgC,IAAI,WAAW,CAAA,qCAAA,CAAA;AAAA,QACvG;AAAA,OACF;AAAA,IACF,SAAS,OAAA,EAAS;AAChB,MAAA,MAAA,EAAO;AACP,MAAA,GAAA,CAAI,MAAA,CAAO,KAAK,wCAAA,EAA0C;AAAA,QACxD,OAAO,OAAA,YAAmB,KAAA,GAAQ,OAAA,CAAQ,OAAA,GAAU,OAAO,OAAO;AAAA,OACnE,CAAA;AACD,MAAA,OAAO;AAAA,QACL,MAAA,EAAQ,eAAA;AAAA,QACR,OAAA,EAAS,0DAA0D,OAAA,YAAmB,KAAA,GAAQ,QAAQ,OAAA,GAAU,MAAA,CAAO,OAAO,CAAC,CAAA;AAAA,OACjI;AAAA,IACF;AAAA,EACF;AAEA,EAAA,eAAe,cAAA,GAA2C;AACxD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,OAAO,gBAAgB,GAAA,CAAI,MAAA,CAAO,MAAK,CAAE,cAAA,EAAgB,KAAK,WAAW,CAAA;AAAA,EAC3E;AAEA,EAAA,eAAe,2BAAA,CACb,aACA,cAAA,EACe;AACf,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,oBAAoB,CAAA;AAC5D,IAAA,MAAM,SAAS,MAAM,mBAAA;AAAA,MACnB,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK,CAAE,iBAAA;AAAA,MAClB,IAAA,CAAK,WAAA;AAAA,MACL,WAAA;AAAA,MACA;AAAA,KACF;AACA,IAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,MACb,GAAG,IAAA;AAAA,MACH,gBAAgB,MAAA,CAAO,KAAA;AAAA,MACvB,yBAAyB,IAAI,IAAA,CAAK,MAAA,CAAO,SAAS,EAAE,OAAA,EAAQ;AAAA,MAC5D,WAAA;AAAA,MACA;AAAA,KACD,CAAA;AACD,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AAAA,EACT;AAEA,EAAA,eAAe,eAAA,CAAgB,aAAqB,cAAA,EAAuC;AACzF,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,IAAI,CAAC,IAAA,EAAM,WAAA,EAAa,MAAM,IAAI,MAAM,wCAAwC,CAAA;AAChF,IAAA,MAAM,2BAAA,CAA4B,aAAa,cAAc,CAAA;AAC7D,IAAA,GAAA,CAAI,MAAA,CAAO,IAAA,CAAK,oBAAA,EAAsB,EAAE,aAAa,CAAA;AAAA,EACvD;AAEA,EAAA,eAAe,mBAAA,GAAqC;AAClD,IAAA,IAAI,iBAAA,EAAmB;AACrB,MAAA,MAAM,iBAAA;AACN,MAAA;AAAA,IACF;AACA,IAAA,MAAM,WAAW,YAA2B;AAC1C,MAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,MAAA,IAAI,MAAM,MAAA,EAAQ;AAClB,MAAA,IAAI,CAAC,MAAM,WAAA,EAAa;AACtB,QAAA,MAAM,IAAI,KAAA;AAAA,UACR,CAAA,wBAAA,EAA2B,GAAA,CAAI,WAAW,CAAA,0CAAA,EAA6C,IAAI,WAAW,CAAA,gDAAA;AAAA,SACxG;AAAA,MACF;AAAA,IAKF,CAAA;AACA,IAAA,iBAAA,GAAoB,QAAA,EAAS,CAAE,OAAA,CAAQ,MAAM;AAC3C,MAAA,iBAAA,GAAoB,IAAA;AAAA,IACtB,CAAC,CAAA;AACD,IAAA,MAAM,iBAAA;AAAA,EACR;AAEA,EAAA,SAAS,SAAA,GASN;AACD,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,QAAQ,OAAA,CAAQ;AAAA,MACrB,aAAA,EAAe,CAAC,EAAE,IAAA,EAAM,eAAe,IAAA,EAAM,MAAA,CAAA;AAAA,MAC7C,QAAQ,IAAA,EAAM,MAAA,GAAS,SAAA,GAAY,IAAA,EAAM,cAAc,aAAA,GAAgB,MAAA;AAAA,MACvE,SAAA,EAAW,MAAM,SAAA,GAAY,IAAI,KAAK,IAAA,CAAK,SAAS,CAAA,CAAE,WAAA,EAAY,GAAI,IAAA;AAAA,MACtE,WAAA,EAAa,MAAM,WAAA,IAAe,IAAA;AAAA,MAClC,cAAA,EAAgB,MAAM,cAAA,IAAkB,IAAA;AAAA,MACxC,uBAAA,EAAyB,MAAM,uBAAA,GAC3B,IAAI,KAAK,IAAA,CAAK,uBAAuB,CAAA,CAAE,WAAA,EAAY,GACnD,IAAA;AAAA,MACJ,iBAAA,EAAmB,CAAC,CAAC,IAAA,EAAM,cAAA;AAAA,MAC3B,eAAA,EAAiB,CAAC,CAAC;AAAA,KACpB,CAAA;AAAA,EACH;AAEA,EAAA,eAAe,MAAA,GAAwB;AACrC,IAAA,OAAA,GAAU,IAAA;AACV,IAAA,GAAA,CAAI,KAAK,KAAA,EAAM;AACf,IAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,IAAA,MAAA,EAAO;AACP,IAAA,GAAA,CAAI,MAAA,CAAO,KAAK,sCAAsC,CAAA;AAAA,EACxD;AAEA,EAAA,SAAS,UAAA,GAAqC;AAC5C,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,MAAM,UAAkC,EAAC;AACzC,IAAA,IAAI,IAAA,EAAM,MAAA,EAAQ,OAAA,CAAQ,WAAW,IAAI,IAAA,CAAK,MAAA;AAC9C,IAAA,IAAI,MAAM,WAAA,EAAa,OAAA,CAAQ,eAAe,CAAA,GAAI,CAAA,OAAA,EAAU,KAAK,WAAW,CAAA,CAAA;AAC5E,IAAA,IAAI,IAAA,EAAM,cAAA;AACR,MAAA,OAAA,CAAQ,2BAA2B,CAAA,GAAI,CAAA,OAAA,EAAU,IAAA,CAAK,cAAc,CAAA,CAAA;AACtE,IAAA,IAAI,IAAA,EAAM,cAAA,EAAgB,OAAA,CAAQ,UAAU,IAAI,IAAA,CAAK,cAAA;AACrD,IAAA,IAAI,IAAA,EAAM,WAAA,EAAa,OAAA,CAAQ,gBAAgB,IAAI,IAAA,CAAK,WAAA;AACxD,IAAA,OAAO,OAAA;AAAA,EACT;AAEA,EAAA,SAAS,UAAA,GAAsB;AAC7B,IAAA,MAAM,IAAA,GAAO,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC3B,IAAA,OAAO,CAAC,EAAE,IAAA,EAAM,WAAA,IAAe,IAAA,EAAM,MAAA,CAAA;AAAA,EACvC;AAEA,EAAA,SAAS,mBAAmB,EAAA,EAAsB;AAChD,IAAA,eAAA,GAAkB,EAAA;AAAA,EACpB;AAEA,EAAA,OAAO;AAAA,IACL,UAAA;AAAA,IACA,aAAA;AAAA,IACA,eAAA;AAAA,IACA,cAAA;AAAA,IACA,mBAAA;AAAA,IACA,SAAA;AAAA,IACA,MAAA;AAAA,IACA,UAAA;AAAA,IACA,UAAA;AAAA,IACA;AAAA,GACF;AACF;;;ACpWO,IAAM,gBAAA,GAAN,cAA+B,KAAA,CAAM;AAAA,EACjB,KAAA;AAAA,EAEzB,WAAA,CAAY,SAAiB,KAAA,EAAiB;AAC5C,IAAA,KAAA,CAAM,OAAO,CAAA;AACb,IAAA,IAAA,CAAK,IAAA,GAAO,kBAAA;AACZ,IAAA,IAAA,CAAK,KAAA,GAAQ,KAAA;AAAA,EACf;AACF,CAAA;;;AC1BA,IAAM,oBAAA,GAAuB,EAAA;AAE7B,SAAS,cAAA,CAAe,MAAc,IAAA,EAA8C;AAClF,EAAA,IAAuB,IAAA,CAAK,MAAA,GAAS,oBAAA,EAAsB;AACzD,IAAA,MAAM,IAAI,gBAAA;AAAA,MACR,CAAA,WAAA,EAAc,IAAI,CAAA,UAAA,EAAa,oBAAoB,CAAA,8CAAA;AAAA,KACrD;AAAA,EACF;AACA,EAAA,OAAO,IAAA;AACT;AAMO,SAAS,WAAA,CAAY,gBAAwB,KAAA,EAAyB;AAC3E,EAAA,IAAI,CAAC,WAAA,EAAa;AAChB,IAAA,MAAM,IAAI,iBAAiB,sCAAsC,CAAA;AAAA,EACnE;AACA,EAAA,MAAM,IAAA,GAAO,CAAC,WAAA,EAAa,GAAG,KAAK,EAAE,MAAA,CAAO,OAAO,CAAA,CAAE,IAAA,CAAK,GAAG,CAAA;AAC7D,EAAA,OAAO,cAAA,CAAe,IAAY,CAAA;AACpC;;;ACOO,SAAS,UAAA,CAAW,MAAe,UAAA,EAAkD;AAC1F,EAAA,MAAM,MAAA,GAAqB;AAAA,IACzB,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,MAAA,EAAQ,IAAA,EAAM,IAAA,CAAK,SAAA,CAAU,IAAA,EAAM,IAAA,EAAM,CAAC,CAAA,EAAG;AAAA,GACjE;AAIA,EAAA,OAAO,MAAA;AACT;AAaO,SAAS,WAAA,CAAY,SAAiB,IAAA,EAA2B;AACtE,EAAA,MAAM,IAAA,GAAO,IAAA,GAAO,CAAA,EAAG,OAAO;;AAAA,MAAA,EAAa,IAAI,CAAA,CAAA,GAAK,OAAA;AACpD,EAAA,OAAO,EAAE,OAAA,EAAS,CAAC,EAAE,IAAA,EAAM,QAAQ,IAAA,EAAM,CAAA,EAAG,OAAA,EAAS,IAAA,EAAK;AAC5D;;;AC3DO,SAAS,iBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AACN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,YAAY,CAAC,CAAA;AAAA,IAChD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EACE,oNAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,UAAA,EAAW;AACrC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,gCAAA,EAAkC,EAAE,OAAO,CAAA;AAC5D,QAAA,OAAO,WAAA;AAAA,UACL,iBAAiB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACzE;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,eAAe,CAAC,CAAA;AAAA,IACnD;AAAA,MACE,KAAA,EAAO,gBAAA;AAAA,MACP,WAAA,EACE,kQAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,aAAA,EAAc;AACxC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,mCAAA,EAAqC,EAAE,OAAO,CAAA;AAC/D,QAAA,OAAO,WAAA;AAAA,UACL,4BAA4B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACpF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EACE,2GAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,WAAA,EAAaC,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wBAAwB,CAAA;AAAA,QACzD,cAAA,EAAgBA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mCAAmC;AAAA;AACzE,KACF;AAAA,IACA,OAAO,EAAE,WAAA,EAAa,cAAA,EAAe,KAAM;AACzC,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,IAAA,CAAK,eAAA,CAAgB,WAAA,EAAa,cAAc,CAAA;AACtD,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,oBAAA;AAAA,UACR,WAAA;AAAA,UACA,OAAA,EAAS,aAAa,WAAW,CAAA,2BAAA;AAAA,SAClC,CAAA;AAAA,MACH,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,2CAAA,EAA6C,EAAE,OAAO,CAAA;AACvE,QAAA,OAAO,WAAA;AAAA,UACL,+BAA+B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACvF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,iBAAiB,CAAC,CAAA;AAAA,IACrD;AAAA,MACE,KAAA,EAAO,iBAAA;AAAA,MACP,WAAA,EAAa,0DAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,UAAA,GAAa,MAAM,IAAA,CAAK,cAAA,EAAe;AAC7C,QAAA,OAAO,WAAW,EAAE,UAAA,EAAY,KAAA,EAAO,UAAA,CAAW,QAAQ,CAAA;AAAA,MAC5D,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,qCAAA,EAAuC,EAAE,OAAO,CAAA;AACjE,QAAA,OAAO,WAAA;AAAA,UACL,8BAA8B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACtF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,aAAa,CAAC,CAAA;AAAA,IACjD;AAAA,MACE,KAAA,EAAO,aAAA;AAAA,MACP,WAAA,EACE,iHAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,MAAA,GAAS,MAAM,IAAA,CAAK,SAAA,EAAU;AACpC,QAAA,OAAO,WAAW,MAAM,CAAA;AAAA,MAC1B,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,EAAE,OAAO,CAAA;AAC7D,QAAA,OAAO,WAAA;AAAA,UACL,8BAA8B,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SACtF;AAAA,MACF;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,aAAa,CAAC,CAAA;AAAA,IACjD;AAAA,MACE,KAAA,EAAO,QAAA;AAAA,MACP,WAAA,EAAa,qDAAA;AAAA,MACb,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAA,GAAO,QAAQ,GAAG,CAAA;AACxB,QAAA,MAAM,KAAK,MAAA,EAAO;AAClB,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,YAAA;AAAA,UACR,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH,SAAS,KAAA,EAAO;AACd,QAAA,GAAA,CAAI,MAAA,CAAO,KAAA,CAAM,iCAAA,EAAmC,EAAE,OAAO,CAAA;AAC7D,QAAA,OAAO,WAAA;AAAA,UACL,kBAAkB,KAAA,YAAiB,KAAA,GAAQ,MAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA;AAAA,SAC1E;AAAA,MACF;AAAA,IACF;AAAA,GACF;AACF;;;ACxIO,IAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhB,IAAM,OAAA,GAAU;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWhB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAiBzB,IAAM,gBAAA,GAAmB;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,CAAA;AAWzB,IAAM,EAAA,GAAK;AAAA;AAAA;AAAA;AAAA,CAAA;;;ACPlB,SAAS,GAAA,CACP,GAAA,EACA,IAAA,EACA,OAAA,EACA,KAAA,EACgC;AAChC,EAAA,GAAA,CAAI,OAAO,KAAA,CAAM,CAAA,EAAG,IAAI,CAAA,OAAA,CAAA,EAAW,EAAE,OAAO,CAAA;AAC5C,EAAA,OAAO,WAAA,CAAY,CAAA,EAAG,OAAO,CAAA,EAAA,EAAK,KAAA,YAAiB,KAAA,GAAQ,KAAA,CAAM,OAAA,GAAU,MAAA,CAAO,KAAK,CAAC,CAAA,CAAE,CAAA;AAC5F;AAEA,SAAS,kBAAA,CAAmB,KAAiB,OAAA,EAA4B;AACvE,EAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,EAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,IACb,GAAG,QAAA;AAAA,IACH,aAAa,OAAA,CAAQ,WAAA;AAAA,IACrB,cAAc,OAAA,CAAQ,YAAA;AAAA,IACtB,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,QAAQ,SAAA,GAAY,GAAA;AAAA,IAC5C,UAAA,EAAY;AAAA,GACb,CAAA;AACD,EAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AAChB;AAEO,SAAS,qBAAA,CACd,MAAA,EACA,GAAA,EACA,KAAA,EACM;AAGN,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAClD;AAAA,MACE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA,EACE,uKAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,KAAA,EAAOA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mCAAmC,CAAA;AAAA,QAC9D,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,2BAA2B,CAAA;AAAA,QACzD,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,sDAAsD,CAAA;AAAA,QACpF,WAAWA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,qBAAqB,CAAA;AAAA,QAC/D,UAAUA,KAAAA,CAAE,MAAA,GAAS,QAAA,EAAS,CAAE,SAAS,oBAAoB;AAAA;AAC/D,KACF;AAAA,IACA,OAAO,EAAE,KAAA,EAAO,UAAU,QAAA,EAAU,SAAA,EAAW,UAAS,KAAM;AAC5D,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,KAAA,EAAO,QAAA,EAAU,QAAA,EAAS;AACnE,QAAA,IAAI,SAAA,KAAc,KAAA,CAAA,EAAW,KAAA,CAAM,SAAA,GAAY,SAAA;AAC/C,QAAA,IAAI,QAAA,KAAa,KAAA,CAAA,EAAW,KAAA,CAAM,QAAA,GAAW,QAAA;AAC7C,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,OAAO,OAAA,CAAqC,OAAA,EAAS,EAAE,KAAA,EAAO,CAAA;AACtF,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,MAAM,CAAA;AAChC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,IAAA,EAAM,EAAE,MAAA,CAAO,IAAA;AAAA,UACf,WAAA,EAAa,EAAE,MAAA,CAAO,WAAA;AAAA,UACtB,YAAA,EAAc,EAAE,MAAA,CAAO,YAAA;AAAA,UACvB,SAAA,EAAW,EAAE,MAAA,CAAO;AAAA,SACrB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,cAAA,EAAgB,gBAAA,EAAkB,CAAC,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,cAAc,CAAC,CAAA;AAAA,IAClD;AAAA,MACE,KAAA,EAAO,SAAA;AAAA,MACP,WAAA,EACE,uMAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,mBAAmB,CAAA;AAAA,QACjD,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,UAAU;AAAA;AAC1C,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,QAAA,EAAS,KAAM;AAChC,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAAqC,OAAA,EAAS;AAAA,UAC3E,KAAA,EAAO,EAAE,QAAA,EAAU,QAAA;AAAS,SAC7B,CAAA;AACD,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,MAAM,CAAA;AAChC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,IAAA,EAAM,EAAE,MAAA,CAAO,IAAA;AAAA,UACf,WAAA,EAAa,EAAE,MAAA,CAAO,WAAA;AAAA,UACtB,YAAA,EAAc,EAAE,MAAA,CAAO,YAAA;AAAA,UACvB,SAAA,EAAW,EAAE,MAAA,CAAO;AAAA,SACrB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,cAAA,EAAgB,gBAAA,EAAkB,CAAC,CAAA;AAAA,MACrD;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oBAAoB,CAAC,CAAA;AAAA,IACxD;AAAA,MACE,KAAA,EAAO,eAAA;AAAA,MACP,WAAA,EACE,0PAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,GAAA,CAAI,IAAA,CAAK,IAAA,EAAK;AAC/B,QAAA,IAAI,CAAC,UAAU,YAAA,EAAc;AAC3B,UAAA,OAAO,WAAA;AAAA,YACL;AAAA,WACF;AAAA,QACF;AACA,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,gBAAA;AAAA,UACJ;AAAA,YACE,OAAO,QAAA,CAAS;AAAA;AAClB,SACF;AACA,QAAA,kBAAA,CAAmB,GAAA,EAAK,EAAE,YAAY,CAAA;AACtC,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,WAAA;AAAA,UACR,WAAA,EAAa,EAAE,YAAA,CAAa,WAAA;AAAA,UAC5B,SAAA,EAAW,EAAE,YAAA,CAAa;AAAA,SAC3B,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,oBAAA,EAAsB,sBAAA,EAAwB,CAAC,CAAA;AAAA,MACjE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EACE,kPAAA;AAAA,MACF,aAAa;AAAC,KAChB;AAAA,IACA,YAAY;AACV,MAAA,IAAI;AACF,QAAA,MAAM,IAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,QAA4B,EAAE,CAAA;AAC7D,QAAA,OAAO,UAAA,CAAW,EAAE,EAAE,CAAA;AAAA,MACxB,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,uBAAA,EAAyB,8BAAA,EAAgC,CAAC,CAAA;AAAA,MAC5E;AAAA,IACF;AAAA,GACF;AAIA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,uBAAuB,CAAC,CAAA;AAAA,IAC3D;AAAA,MACE,KAAA,EAAO,kBAAA;AAAA,MACP,WAAA,EACE,+PAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,YAAA,EAAcA,KAAAA,CACX,MAAA,EAAO,CACP,SAAS,0DAA0D,CAAA;AAAA,QACtE,MAAA,EAAQA,KAAAA,CACL,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAChB,QAAA,EAAS,CACT,QAAA,CAAS,2CAA2C;AAAA;AACzD,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,MAAM,KAAA,GAAiC,EAAE,QAAA,EAAU,YAAA,EAAa;AAChE,QAAA,IAAI,MAAA,KAAW,KAAA,CAAA,EAAW,KAAA,CAAM,MAAA,GAAS,MAAA;AACzC,QAAA,MAAM,CAAA,GAAI,MAAM,GAAA,CAAI,GAAA,CAAI,MAAA,CAAO,OAAA;AAAA,UACzB,gBAAA;AAAA,UACJ,EAAE,KAAA;AAAM,SACV;AACA,QAAA,MAAM,SAAS,CAAA,CAAE,eAAA;AACjB,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,YAAA,EAAc,EAAA;AAAA,UACd,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,SAAA,GAAY,GAAA;AAAA,UAC3C,UAAA,EAAY,oBAAA;AAAA,UACZ,QAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,QAAQ,MAAA,CAAO;AAAA,SAChB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,uBAAA,EAAyB,2BAAA,EAA6B,CAAC,CAAA;AAAA,MACzE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,yBAAyB,CAAC,CAAA;AAAA,IAC7D;AAAA,MACE,KAAA,EAAO,oBAAA;AAAA,MACP,WAAA,EACE,sQAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,MAAA,EAAQA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,qDAAqD;AAAA;AACnF,KACF;AAAA,IACA,OAAO,EAAE,MAAA,EAAO,KAAM;AACpB,MAAA,IAAI;AACF,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,MAAA;AAAA,UACA,UAAA,EAAY;AAAA,SACb,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,MAAA,EAAQ,SAAA;AAAA,UACR,OAAA,EAAS;AAAA,SACV,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,yBAAA,EAA2B,uBAAA,EAAyB,CAAC,CAAA;AAAA,MACvE;AAAA,IACF;AAAA,GACF;AAEA,EAAA,MAAA,CAAO,YAAA;AAAA,IACL,KAAA,CAAM,WAAA,CAAY,GAAA,CAAI,WAAA,EAAa,oCAAoC,CAAC,CAAA;AAAA,IACxE;AAAA,MACE,KAAA,EAAO,+BAAA;AAAA,MACP,WAAA,EACE,iSAAA;AAAA,MACF,WAAA,EAAa;AAAA,QACX,QAAA,EAAUA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,oBAAoB,CAAA;AAAA,QAClD,YAAA,EAAcA,KAAAA,CAAE,MAAA,EAAO,CAAE,SAAS,wBAAwB,CAAA;AAAA,QAC1D,MAAA,EAAQA,KAAAA,CAAE,KAAA,CAAMA,KAAAA,CAAE,MAAA,EAAQ,CAAA,CAAE,QAAA,EAAS,CAAE,QAAA,CAAS,gCAAgC;AAAA;AAClF,KACF;AAAA,IACA,OAAO,EAAE,QAAA,EAAU,YAAA,EAAc,QAAO,KAAM;AAC5C,MAAA,IAAI;AACF,QAAA,MAAM,GAAA,GAAM,GAAA,CAAI,MAAA,CAAO,IAAA,EAAK;AAC5B,QAAA,MAAM,SAAS,MAAM,qBAAA;AAAA,UACnB,GAAA,CAAI,cAAA;AAAA,UACJ,QAAA;AAAA,UACA,YAAA;AAAA,UACA;AAAA,SACF;AACA,QAAA,MAAM,QAAA,GAAW,IAAI,IAAA,CAAK,IAAA,MAAU,EAAE,WAAA,EAAa,EAAA,EAAI,YAAA,EAAc,EAAA,EAAG;AACxE,QAAA,GAAA,CAAI,KAAK,KAAA,CAAM;AAAA,UACb,GAAG,QAAA;AAAA,UACH,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,YAAA,EAAc,EAAA;AAAA,UACd,SAAA,EAAW,IAAA,CAAK,GAAA,EAAI,GAAI,OAAO,SAAA,GAAY,GAAA;AAAA,UAC3C,UAAA,EAAY,oBAAA;AAAA,UACZ,QAAA;AAAA,UACA;AAAA,SACD,CAAA;AACD,QAAA,GAAA,CAAI,IAAI,KAAA,EAAM;AACd,QAAA,OAAO,UAAA,CAAW;AAAA,UAChB,MAAA,EAAQ,eAAA;AAAA,UACR,aAAa,MAAA,CAAO,WAAA;AAAA,UACpB,WAAW,MAAA,CAAO,SAAA;AAAA,UAClB,QAAQ,MAAA,CAAO;AAAA,SAChB,CAAA;AAAA,MACH,SAAS,CAAA,EAAG;AACV,QAAA,OAAO,GAAA,CAAI,GAAA,EAAK,oCAAA,EAAsC,iCAAA,EAAmC,CAAC,CAAA;AAAA,MAC5F;AAAA,IACF;AAAA,GACF;AACF;;;ACnTA,IAAM,UAAA,GAAwB;AAAA,EAC5B,EAAA,EAAI,MAAA;AAAA,EACJ,OAAA,EAAS,OAAA;AAAA,EACT,WAAA,EAAa,gBAAA;AAAA,EACb,YAAA,EAAc,EAAE,KAAA,EAAO,EAAC,EAAE;AAAA,EAE1B,QAAA,CAAS,QAAmB,GAAA,EAAqC;AAC/D,IAAA,MAAM,QAAkB,EAAC;AACzB,IAAA,MAAM,KAAA,GAAQ,CAAC,CAAA,KAAsB;AACnC,MAAA,KAAA,CAAM,KAAK,CAAC,CAAA;AACZ,MAAA,OAAO,CAAA;AAAA,IACT,CAAA;AAEA,IAAA,iBAAA,CAAkB,MAAA,EAAQ,KAAK,KAAK,CAAA;AACpC,IAAA,qBAAA,CAAsB,MAAA,EAAQ,KAAK,KAAK,CAAA;AAExC,IAAA,OAAO,EAAE,KAAA,EAAO,SAAA,EAAW,EAAC,EAAG,OAAA,EAAS,EAAC,EAAE;AAAA,EAC7C;AACF,CAAA;AAEA,IAAO,YAAA,GAAQ","file":"index.cjs","sourcesContent":["/**\n * OAuth2 Device Code flow + Client Credentials flow + workspace token issuance.\n * Pure functions — operate on injected endpoints + client ids, no global state.\n *\n * Mirrors cli-sdk/src/core/auth/device-code.ts so a future shared\n * @burdenoff/auth-core extraction is mechanical.\n */\n\nimport fetch from 'cross-fetch';\n\nexport interface DeviceCodeResponse {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  expiresIn: number;\n  interval: number;\n}\n\nexport interface DeviceCodeTokenResult {\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\nexport interface ClientCredentialsResult {\n  accessToken: string;\n  expiresIn: number;\n  scopes: string[];\n}\n\nexport interface OIDCConfig {\n  oidcIssuer: string;\n  clientId: string;\n}\n\nexport async function startDeviceCodeFlow(config: OIDCConfig): Promise<DeviceCodeResponse> {\n  const url = `${config.oidcIssuer}/oidc/device/code`;\n  const body = new URLSearchParams({\n    client_id: config.clientId,\n    scope: 'openid profile email offline_access',\n  });\n\n  const response = await fetch(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: body.toString(),\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => 'Unknown error');\n    throw new Error(`Device code request failed (${response.status}): ${text}`);\n  }\n\n  const data = (await response.json()) as Record<string, unknown>;\n\n  return {\n    deviceCode: data['device_code'] as string,\n    userCode: data['user_code'] as string,\n    verificationUri: data['verification_uri'] as string,\n    verificationUriComplete: (data['verification_uri_complete'] as string) ?? null,\n    expiresIn: data['expires_in'] as number,\n    interval: (data['interval'] as number) ?? 5,\n  };\n}\n\nexport type DeviceTokenPollResult =\n  | { status: 'authenticated'; tokens: DeviceCodeTokenResult }\n  | { status: 'pending' }\n  | { status: 'slow_down'; newInterval: number }\n  | { status: 'expired' }\n  | { status: 'denied' };\n\n/**\n * Single-shot device-code token poll.\n *\n * Unlike cli-sdk's pollForToken which loops until done (suitable for blocking\n * CLI), MCP needs non-blocking semantics: the LLM calls auth_complete tool\n * repeatedly. This helper makes ONE poll attempt and returns a discriminated\n * union the caller can act on.\n */\nexport async function pollDeviceTokenOnce(\n  deviceCode: string,\n  interval: number,\n  config: OIDCConfig,\n): Promise<DeviceTokenPollResult> {\n  const url = `${config.oidcIssuer}/oauth/device/token`;\n\n  const response = await fetch(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams({\n      grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n      device_code: deviceCode,\n      client_id: config.clientId,\n    }).toString(),\n  });\n\n  const data = (await response.json()) as Record<string, unknown>;\n\n  if (response.ok && data['access_token']) {\n    return {\n      status: 'authenticated',\n      tokens: {\n        accessToken: data['access_token'] as string,\n        refreshToken: (data['refresh_token'] as string) ?? '',\n        expiresIn: (data['expires_in'] as number) ?? 3600,\n      },\n    };\n  }\n\n  const errorCode = data['error'] as string | undefined;\n  switch (errorCode) {\n    case 'authorization_pending':\n      return { status: 'pending' };\n    case 'slow_down':\n      return { status: 'slow_down', newInterval: interval + 5 };\n    case 'expired_token':\n      return { status: 'expired' };\n    case 'access_denied':\n      return { status: 'denied' };\n    default:\n      throw new Error(\n        `Device code polling failed: ${(data['error_description'] as string) ?? errorCode ?? 'Unknown error'}`,\n      );\n  }\n}\n\nexport async function clientCredentialsFlow(\n  globalEndpoint: string,\n  clientId: string,\n  clientSecret: string,\n  scopes?: string[],\n): Promise<ClientCredentialsResult> {\n  const query = `\n    mutation AuthenticateApp($input: AuthenticateAppInput!) {\n      authenticateApp(input: $input) {\n        accessToken tokenType expiresIn scopes\n      }\n    }\n  `;\n\n  const response = await fetch(globalEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json' },\n    body: JSON.stringify({\n      query,\n      variables: { input: { clientId, clientSecret, scopes } },\n    }),\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => 'Unknown error');\n    throw new Error(`App authentication failed (${response.status}): ${text}`);\n  }\n\n  const data = (await response.json()) as {\n    data?: { authenticateApp: { accessToken: string; expiresIn: number; scopes: string[] } };\n    errors?: Array<{ message: string }>;\n  };\n\n  if (data.errors?.length) {\n    throw new Error(`App authentication failed: ${data.errors[0]?.message ?? 'unknown error'}`);\n  }\n  if (!data.data?.authenticateApp?.accessToken) {\n    throw new Error('App authentication failed: no access token returned');\n  }\n\n  return data.data.authenticateApp;\n}\n\nexport async function issueWorkspaceToken(\n  workspaceEndpoint: string,\n  authToken: string,\n  workspaceId: string,\n  organizationId: string,\n): Promise<{ token: string; expiresAt: string; scopes: string[] }> {\n  const query = `\n    mutation IssueWorkspaceToken($input: IssueWorkspaceTokenInput!) {\n      issueWorkspaceToken(input: $input) {\n        success token expiresAt scopes\n        error { code message }\n      }\n    }\n  `;\n\n  const response = await fetch(workspaceEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${authToken}` },\n    body: JSON.stringify({ query, variables: { input: { workspaceId, organizationId } } }),\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => 'Unknown error');\n    throw new Error(`Workspace token request failed (${response.status}): ${text}`);\n  }\n\n  const data = (await response.json()) as {\n    data?: {\n      issueWorkspaceToken: {\n        success: boolean;\n        token: string | null;\n        expiresAt: string | null;\n        scopes: string[] | null;\n        error: { code: string; message: string } | null;\n      };\n    };\n    errors?: Array<{ message: string }>;\n  };\n\n  if (data.errors?.length) {\n    throw new Error(`Workspace token failed: ${data.errors[0]?.message ?? 'unknown error'}`);\n  }\n\n  const result = data.data?.issueWorkspaceToken;\n  if (!result?.success || !result.token) {\n    throw new Error(`Workspace token failed: ${result?.error?.message ?? 'Unknown error'}`);\n  }\n\n  return { token: result.token, expiresAt: result.expiresAt ?? '', scopes: result.scopes ?? [] };\n}\n\nexport async function fetchWorkspaces(\n  globalEndpoint: string,\n  authToken: string,\n): Promise<\n  Array<{ id: string; name: string; slug: string; tenantId: string; organizationId: string }>\n> {\n  const query = `\n    query MyWorkspaces($limit: Int) {\n      myWorkspaces(limit: $limit) {\n        items { id name slug tenantId organizationId }\n      }\n    }\n  `;\n\n  const response = await fetch(globalEndpoint, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${authToken}` },\n    body: JSON.stringify({ query, variables: { limit: 50 } }),\n  });\n\n  if (!response.ok) {\n    const text = await response.text().catch(() => 'Unknown error');\n    throw new Error(`Failed to fetch workspaces (${response.status}): ${text}`);\n  }\n\n  const data = (await response.json()) as {\n    data?: {\n      myWorkspaces: {\n        items: Array<{\n          id: string;\n          name: string;\n          slug: string;\n          tenantId: string;\n          organizationId: string;\n        }>;\n      };\n    };\n    errors?: Array<{ message: string }>;\n  };\n\n  if (data.errors?.length) {\n    throw new Error(`Failed to fetch workspaces: ${data.errors[0]?.message ?? 'unknown error'}`);\n  }\n\n  return data.data?.myWorkspaces?.items ?? [];\n}\n","/**\n * Auth helper for the auth module — ports VibeControlsMCPAuth from\n * vibecontrols-mcp/src/auth/index.ts to a ctx-aware factory.\n *\n * Differences from the legacy class:\n * - Per-ctx instance (no module-level singleton; each product MCP gets its own)\n * - Token persistence delegated to ctx.auth (StoredAuth file)\n * - Endpoints + clientId resolved via ctx.config.resolveOIDC + ctx.config.read\n * - pendingDeviceCode kept in closure scope (alive for the MCP server process,\n *   suitable for stdio's lifetime; HTTP's per-session servers each get their own\n *   pending state)\n *\n * Public surface mirrors the legacy class so the lifted auth/tools.ts works\n * without modification: startLogin / completeLogin / selectWorkspace /\n * listWorkspaces / getStatus / logout / ensureAuthenticated / getHeaders /\n * isLoggedIn / setOnTokensChanged.\n */\n\nimport type { McpContext } from '../../core/index.js';\nimport { fetchWorkspaces, issueWorkspaceToken } from '../../core/auth/device-code.js';\n\ninterface PendingDeviceCode {\n  deviceCode: string;\n  userCode: string;\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  expiresAt: number;\n  interval: number;\n  clientId: string;\n  tokenUrl: string;\n}\n\nexport interface WorkspaceInfo {\n  id: string;\n  name: string;\n  slug: string;\n  tenantId: string;\n  organizationId: string;\n}\n\nexport interface LoginStartResult {\n  status: 'device_code_issued';\n  verificationUri: string;\n  verificationUriComplete: string | null;\n  userCode: string;\n  expiresIn: number;\n  message: string;\n}\n\nexport interface LoginCompleteResult {\n  status: 'authenticated' | 'workspace_selection_required' | 'pending' | 'expired';\n  message: string;\n  workspaces?: WorkspaceInfo[];\n}\n\nexport interface AuthHelper {\n  startLogin(): Promise<LoginStartResult>;\n  completeLogin(): Promise<LoginCompleteResult>;\n  selectWorkspace(workspaceId: string, organizationId: string): Promise<void>;\n  listWorkspaces(): Promise<WorkspaceInfo[]>;\n  ensureAuthenticated(): Promise<void>;\n  getStatus(): Promise<{\n    authenticated: boolean;\n    method: string;\n    expiresAt: string | null;\n    workspaceId: string | null;\n    organizationId: string | null;\n    workspaceTokenExpiresAt: string | null;\n    hasWorkspaceToken: boolean;\n    hasPendingLogin: boolean;\n  }>;\n  logout(): Promise<void>;\n  getHeaders(): Record<string, string>;\n  isLoggedIn(): boolean;\n  setOnTokensChanged(cb: () => void): void;\n}\n\nconst helpers = new WeakMap<McpContext, AuthHelper>();\n\nexport function getAuth(ctx: McpContext): AuthHelper {\n  const cached = helpers.get(ctx);\n  if (cached) return cached;\n  const helper = createAuthHelper(ctx);\n  helpers.set(ctx, helper);\n  return helper;\n}\n\nfunction createAuthHelper(ctx: McpContext): AuthHelper {\n  let pending: PendingDeviceCode | null = null;\n  let onTokensChanged: (() => void) | null = null;\n  let refreshInProgress: Promise<void> | null = null;\n\n  function notify(): void {\n    onTokensChanged?.();\n  }\n\n  async function startLogin(): Promise<LoginStartResult> {\n    const { oidcIssuer, clientId } = ctx.config.resolveOIDC();\n    const deviceCodeUrl = `${oidcIssuer}/oidc/device/code`;\n    const tokenUrl = `${oidcIssuer}/oauth/device/token`;\n\n    const response = await fetch(deviceCodeUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        client_id: clientId,\n        scope: 'openid profile email offline_access',\n      }).toString(),\n    });\n\n    if (!response.ok) {\n      const text = await response.text().catch(() => 'Unknown error');\n      throw new Error(`Device code request failed (${response.status}): ${text}`);\n    }\n\n    const data = (await response.json()) as Record<string, unknown>;\n    const deviceCode = data['device_code'] as string;\n    const userCode = data['user_code'] as string;\n    const verificationUri = data['verification_uri'] as string;\n    const verificationUriComplete = (data['verification_uri_complete'] as string) ?? null;\n    const expiresIn = (data['expires_in'] as number) ?? 900;\n    const interval = (data['interval'] as number) ?? 5;\n\n    pending = {\n      deviceCode,\n      userCode,\n      verificationUri,\n      verificationUriComplete,\n      expiresAt: Date.now() + expiresIn * 1000,\n      interval,\n      clientId,\n      tokenUrl,\n    };\n\n    return {\n      status: 'device_code_issued',\n      verificationUri,\n      verificationUriComplete,\n      userCode,\n      expiresIn,\n      message: `Open ${verificationUriComplete ?? verificationUri} in a browser and enter code: ${userCode}. Then call ${ctx.productName}_auth_complete to finish authentication.`,\n    };\n  }\n\n  async function completeLogin(): Promise<LoginCompleteResult> {\n    if (!pending) {\n      throw new Error(\n        `No pending login flow. Call ${ctx.productName}_auth_login first to start the device code flow.`,\n      );\n    }\n\n    const p = pending;\n    if (Date.now() >= p.expiresAt) {\n      pending = null;\n      return {\n        status: 'expired',\n        message: `Device code has expired. Call ${ctx.productName}_auth_login again to get a new code.`,\n      };\n    }\n\n    const response = await fetch(p.tokenUrl, {\n      method: 'POST',\n      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n      body: new URLSearchParams({\n        grant_type: 'urn:ietf:params:oauth:grant-type:device_code',\n        device_code: p.deviceCode,\n        client_id: p.clientId,\n      }).toString(),\n    });\n\n    const data = (await response.json()) as Record<string, unknown>;\n\n    if (response.ok && data['access_token']) {\n      pending = null;\n      const expiresIn = (data['expires_in'] as number) ?? 3600;\n      const auth = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n      ctx.auth.write({\n        ...auth,\n        accessToken: data['access_token'] as string,\n        refreshToken: (data['refresh_token'] as string) ?? '',\n        expiresAt: Date.now() + expiresIn * 1000,\n        authMethod: 'device_code',\n      });\n      ctx.gql.reset();\n      return await handlePostLogin();\n    }\n\n    const errorCode = data['error'] as string | undefined;\n    if (errorCode === 'authorization_pending') {\n      return {\n        status: 'pending',\n        message: `Still waiting for user to authorize. Open ${p.verificationUriComplete ?? p.verificationUri} and enter code: ${p.userCode}. Then call ${ctx.productName}_auth_complete again.`,\n      };\n    } else if (errorCode === 'slow_down') {\n      p.interval += 5;\n      return {\n        status: 'pending',\n        message: `Authorization server asked to slow down. Wait a moment, then call ${ctx.productName}_auth_complete again.`,\n      };\n    } else if (errorCode === 'expired_token') {\n      pending = null;\n      return {\n        status: 'expired',\n        message: `Device code has expired. Call ${ctx.productName}_auth_login again.`,\n      };\n    } else if (errorCode === 'access_denied') {\n      pending = null;\n      throw new Error('Authorization was denied by the user.');\n    } else {\n      pending = null;\n      throw new Error(\n        `Device code error: ${(data['error_description'] as string) ?? errorCode ?? 'Unknown'}`,\n      );\n    }\n  }\n\n  async function handlePostLogin(): Promise<LoginCompleteResult> {\n    try {\n      const workspaces = await listWorkspaces();\n      if (workspaces.length === 0) {\n        notify();\n        ctx.logger.info('Device code login successful (no workspaces found)');\n        return {\n          status: 'authenticated',\n          message: `Authentication successful. No workspaces found — use ${ctx.productName}_auth_select_workspace when one is available.`,\n        };\n      }\n      if (workspaces.length === 1) {\n        const ws = workspaces[0];\n        if (!ws)\n          throw new Error('Unexpected: workspaces.length === 1 but workspaces[0] is undefined');\n        await issueAndStoreWorkspaceToken(ws.id, ws.organizationId);\n        ctx.logger.info('Device code login successful', {\n          workspaceId: ws.id,\n          workspaceName: ws.name,\n        });\n        return {\n          status: 'authenticated',\n          message: `Authentication successful. Workspace \"${ws.name}\" selected automatically.`,\n        };\n      }\n      notify();\n      ctx.logger.info('Device code login successful, workspace selection needed');\n      return {\n        status: 'workspace_selection_required',\n        message: `Authentication successful. ${workspaces.length} workspaces available — call ${ctx.productName}_auth_select_workspace to choose one.`,\n        workspaces,\n      };\n    } catch (wsError) {\n      notify();\n      ctx.logger.warn('Workspace discovery failed after login', {\n        error: wsError instanceof Error ? wsError.message : String(wsError),\n      });\n      return {\n        status: 'authenticated',\n        message: `Authentication successful. Workspace discovery failed: ${wsError instanceof Error ? wsError.message : String(wsError)}`,\n      };\n    }\n  }\n\n  async function listWorkspaces(): Promise<WorkspaceInfo[]> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n    return fetchWorkspaces(ctx.config.read().globalEndpoint, auth.accessToken);\n  }\n\n  async function issueAndStoreWorkspaceToken(\n    workspaceId: string,\n    organizationId: string,\n  ): Promise<void> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated.');\n    const result = await issueWorkspaceToken(\n      ctx.config.read().workspaceEndpoint,\n      auth.accessToken,\n      workspaceId,\n      organizationId,\n    );\n    ctx.auth.write({\n      ...auth,\n      workspaceToken: result.token,\n      workspaceTokenExpiresAt: new Date(result.expiresAt).getTime(),\n      workspaceId,\n      organizationId,\n    });\n    ctx.gql.reset();\n    notify();\n  }\n\n  async function selectWorkspace(workspaceId: string, organizationId: string): Promise<void> {\n    const auth = ctx.auth.read();\n    if (!auth?.accessToken) throw new Error('Not authenticated. Please login first.');\n    await issueAndStoreWorkspaceToken(workspaceId, organizationId);\n    ctx.logger.info('Workspace selected', { workspaceId });\n  }\n\n  async function ensureAuthenticated(): Promise<void> {\n    if (refreshInProgress) {\n      await refreshInProgress;\n      return;\n    }\n    const doEnsure = async (): Promise<void> => {\n      const auth = ctx.auth.read();\n      if (auth?.apiKey) return;\n      if (!auth?.accessToken) {\n        throw new Error(\n          `Not authenticated. Call ${ctx.productName}_auth_login to start the login flow, then ${ctx.productName}_auth_complete after authorizing in the browser.`,\n        );\n      }\n      // The shared gql client handles refresh via isTokenExpiringSoon + isWorkspaceTokenExpiringSoon —\n      // trigger by issuing a no-op request that goes through the workspace client's refresh path.\n      // We simulate a no-op via a cheap query if needed; today the gql wrapper does it lazily,\n      // so we just delegate to it on the next request. Nothing to do here.\n    };\n    refreshInProgress = doEnsure().finally(() => {\n      refreshInProgress = null;\n    });\n    await refreshInProgress;\n  }\n\n  function getStatus(): Promise<{\n    authenticated: boolean;\n    method: string;\n    expiresAt: string | null;\n    workspaceId: string | null;\n    organizationId: string | null;\n    workspaceTokenExpiresAt: string | null;\n    hasWorkspaceToken: boolean;\n    hasPendingLogin: boolean;\n  }> {\n    const auth = ctx.auth.read();\n    return Promise.resolve({\n      authenticated: !!(auth?.accessToken || auth?.apiKey),\n      method: auth?.apiKey ? 'api_key' : auth?.accessToken ? 'oauth_token' : 'none',\n      expiresAt: auth?.expiresAt ? new Date(auth.expiresAt).toISOString() : null,\n      workspaceId: auth?.workspaceId ?? null,\n      organizationId: auth?.organizationId ?? null,\n      workspaceTokenExpiresAt: auth?.workspaceTokenExpiresAt\n        ? new Date(auth.workspaceTokenExpiresAt).toISOString()\n        : null,\n      hasWorkspaceToken: !!auth?.workspaceToken,\n      hasPendingLogin: !!pending,\n    });\n  }\n\n  async function logout(): Promise<void> {\n    pending = null;\n    ctx.auth.clear();\n    ctx.gql.reset();\n    notify();\n    ctx.logger.info('Logged out and cleared stored tokens');\n  }\n\n  function getHeaders(): Record<string, string> {\n    const auth = ctx.auth.read();\n    const headers: Record<string, string> = {};\n    if (auth?.apiKey) headers['X-API-Key'] = auth.apiKey;\n    if (auth?.accessToken) headers['Authorization'] = `Bearer ${auth.accessToken}`;\n    if (auth?.workspaceToken)\n      headers['X-Workspace-Authorization'] = `Bearer ${auth.workspaceToken}`;\n    if (auth?.organizationId) headers['x-org-id'] = auth.organizationId;\n    if (auth?.workspaceId) headers['x-workspace-id'] = auth.workspaceId;\n    return headers;\n  }\n\n  function isLoggedIn(): boolean {\n    const auth = ctx.auth.read();\n    return !!(auth?.accessToken || auth?.apiKey);\n  }\n\n  function setOnTokensChanged(cb: () => void): void {\n    onTokensChanged = cb;\n  }\n\n  return {\n    startLogin,\n    completeLogin,\n    selectWorkspace,\n    listWorkspaces,\n    ensureAuthenticated,\n    getStatus,\n    logout,\n    getHeaders,\n    isLoggedIn,\n    setOnTokensChanged,\n  };\n}\n","/**\n * Error classes for MCP SDK.\n *\n * Modules MUST throw these instead of throwing raw Errors. The registerTool\n * wrapper in result.ts catches and maps them to MCP-protocol-compliant\n * `{ isError: true, content: [...] }` responses.\n *\n * Throwing past the wrapper to the protocol surfaces as JSON-RPC -32603 to\n * the client and is a protocol bug.\n */\n\nexport class McpUserError extends Error {\n  public readonly hint: string | undefined;\n\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message);\n    this.name = 'McpUserError';\n    this.hint = opts?.hint;\n  }\n}\n\nexport class McpAuthError extends McpUserError {\n  constructor(message: string, opts?: { hint?: string }) {\n    super(message, {\n      hint: opts?.hint ?? 'Run the auth_login tool to authenticate.',\n    });\n    this.name = 'McpAuthError';\n  }\n}\n\nexport class McpInternalError extends Error {\n  public override readonly cause: unknown;\n\n  constructor(message: string, cause?: unknown) {\n    super(message);\n    this.name = 'McpInternalError';\n    this.cause = cause;\n  }\n}\n","/**\n * Tool / resource / prompt naming helpers.\n *\n * Mandatory product prefix avoids collisions when Claude Desktop runs\n * multiple MCP servers concurrently (typical setup is ~6).\n *\n * Tool names are capped at 63 characters — Claude Desktop pre-1.x\n * truncated at 64 in some versions.\n */\n\nimport { McpInternalError } from './errors.js';\n\nconst MAX_TOOL_NAME_LENGTH = 63;\n\nfunction assertSafeName(name: string, kind: 'tool' | 'resource' | 'prompt'): string {\n  if (kind === 'tool' && name.length > MAX_TOOL_NAME_LENGTH) {\n    throw new McpInternalError(\n      `Tool name '${name}' exceeds ${MAX_TOOL_NAME_LENGTH} characters (some MCP clients truncate at 64).`,\n    );\n  }\n  return name;\n}\n\n/**\n * Build a tool name. Format: `<productName>_<...parts>` (snake_case).\n * Example: mcpToolName('vibecontrols', 'vibes', 'list') -> 'vibecontrols_vibes_list'\n */\nexport function mcpToolName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpToolName: productName is required');\n  }\n  const name = [productName, ...parts].filter(Boolean).join('_');\n  return assertSafeName(name, 'tool');\n}\n\n/**\n * Build a resource URI. Format: `<productName>://<...parts>`.\n * Example: mcpResourceUri('vibecontrols', 'schema') -> 'vibecontrols://schema'\n */\nexport function mcpResourceUri(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpResourceUri: productName is required');\n  }\n  return `${productName}://${parts.filter(Boolean).join('/')}`;\n}\n\n/**\n * Build a prompt name. Format: `<productName>-<...parts>` (kebab-case).\n * Example: mcpPromptName('vibecontrols', 'setup') -> 'vibecontrols-setup'\n */\nexport function mcpPromptName(productName: string, ...parts: string[]): string {\n  if (!productName) {\n    throw new McpInternalError('mcpPromptName: productName is required');\n  }\n  return [productName, ...parts].filter(Boolean).join('-');\n}\n\nexport const TOOL_NAME_LIMIT = MAX_TOOL_NAME_LENGTH;\n\n/**\n * Name-based hint heuristics for MCP `annotations` (readOnlyHint /\n * destructiveHint). Used by tool-governance.ts to auto-fill annotations for\n * the fleet of product modules that call `server.registerTool` directly\n * (bypassing the `registerTool()` core helper) and so never set them\n * explicitly today (BOFF-3903). Deliberately conservative — matched against\n * whole `_`-delimited segments so e.g. `timeentries_delete` and\n * `pomodoro_delete_goal` match, but a hypothetical `undeletable_check`\n * would not.\n *\n * A module can always override the inference by passing an explicit\n * `annotations` object to `registerTool()` / `server.registerTool()`.\n */\nconst DESTRUCTIVE_NAME_SEGMENT = /(?:^|_)delete(?:_|$)/i;\nconst READ_ONLY_NAME_SEGMENT = /(?:^|_)(?:list|get|search|check|read|count|stats|by_date)(?:_|$)/i;\n\n/** True when a tool name looks destructive (irreversibly deletes data) by naming convention. */\nexport function inferDestructiveHint(toolName: string): boolean {\n  return DESTRUCTIVE_NAME_SEGMENT.test(toolName);\n}\n\n/**\n * True when a tool name looks read-only by naming convention. Never true for\n * a name that also looks destructive (a tool can't be both).\n */\nexport function inferReadOnlyHint(toolName: string): boolean {\n  return !inferDestructiveHint(toolName) && READ_ONLY_NAME_SEGMENT.test(toolName);\n}\n","/**\n * MCP tool result helpers + central handler.\n *\n * Modules NEVER call server.registerTool directly — they use registerTool()\n * from this module so the central try/catch wraps the handler and:\n *   - maps thrown McpUserError / McpAuthError / McpInternalError to\n *     MCP-protocol-compliant `{ isError: true, content: [...] }` shapes\n *   - threads `_meta.progressToken` into ctx.progress for long ops\n *   - emits a structured log line on every error\n *   - never leaks `cause` from McpInternalError to the client\n *\n * This is the analog of cli-sdk's createProgram() central error handler.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { ZodRawShape } from 'zod';\nimport type { McpContext } from './context.js';\nimport { McpAuthError, McpInternalError, McpUserError } from './errors.js';\nimport type { ToolAnnotations } from './tool-governance.js';\n\nexport interface ToolTextContent {\n  type: 'text';\n  text: string;\n  [k: string]: unknown;\n}\n\nexport interface ToolResult {\n  content: ToolTextContent[];\n  isError?: boolean;\n  structuredContent?: Record<string, unknown>;\n  [k: string]: unknown;\n}\n\nexport interface ToolMeta {\n  progressToken?: string | number;\n}\n\n/**\n * Build a successful tool result with JSON content (pretty-printed).\n */\nexport function jsonResult(data: unknown, structured?: Record<string, unknown>): ToolResult {\n  const result: ToolResult = {\n    content: [{ type: 'text', text: JSON.stringify(data, null, 2) }],\n  };\n  if (structured !== undefined) {\n    result.structuredContent = structured;\n  }\n  return result;\n}\n\n/**\n * Build a successful tool result with plain text content.\n */\nexport function textResult(text: string): ToolResult {\n  return { content: [{ type: 'text', text }] };\n}\n\n/**\n * Build an error tool result. Honors MCP's `{ isError: true, content }` shape.\n * Optional hint is appended on a new line so the LLM can react.\n */\nexport function errorResult(message: string, hint?: string): ToolResult {\n  const text = hint ? `${message}\\n\\nHint: ${hint}` : message;\n  return { content: [{ type: 'text', text }], isError: true };\n}\n\nexport interface ToolMetadata {\n  title: string;\n  description: string;\n  inputSchema?: ZodRawShape;\n  /**\n   * Explicit MCP annotations (readOnlyHint / destructiveHint / ...). Optional\n   * — when omitted, `wrapServerWithToolGovernance` (applied centrally in\n   * `createMcpServer`) infers them from the tool name. Set this to override\n   * the inference for a tool whose name doesn't match the naming convention.\n   */\n  annotations?: ToolAnnotations;\n}\n\nexport type ToolHandler<TArgs = Record<string, unknown>> = (\n  args: TArgs,\n  ctx: McpContext,\n  meta: ToolMeta,\n) => Promise<unknown>;\n\n/**\n * Register a tool with the central error wrapper.\n *\n * The handler returns a plain value or void. The wrapper:\n *   - wraps non-undefined returns in jsonResult()\n *   - if the value already looks like a ToolResult (has `content`), passes through\n *   - catches McpAuthError / McpUserError / McpInternalError / generic Error\n *   - logs every error via ctx.logger.error\n */\nexport function registerTool<TArgs extends Record<string, unknown>>(\n  server: McpServer,\n  ctx: McpContext,\n  name: string,\n  metadata: ToolMetadata,\n  handler: ToolHandler<TArgs>,\n): void {\n  const sdkConfig = {\n    title: metadata.title,\n    description: metadata.description,\n    ...(metadata.inputSchema ? { inputSchema: metadata.inputSchema } : {}),\n    ...(metadata.annotations ? { annotations: metadata.annotations } : {}),\n  };\n\n  // The MCP SDK's registerTool signature is `(name, config, handler)`. The\n  // handler arity depends on whether inputSchema is present (1-arg without,\n  // 2-arg with). We accept a unified handler shape and dispatch at runtime.\n  // The SDK's typing is strict and conditional on the inputSchema generic;\n  // bypass with a cast since runtime acceptance is unconditional.\n  const wrapped = async (...callbackArgs: unknown[]): Promise<ToolResult> => {\n    const hasArgs = callbackArgs.length === 2;\n    const args = (hasArgs ? callbackArgs[0] : {}) as TArgs;\n    const extra = (hasArgs ? callbackArgs[1] : callbackArgs[0]) as\n      { _meta?: { progressToken?: string | number } } | undefined;\n\n    const progressToken = extra?._meta?.progressToken;\n    const meta: ToolMeta = progressToken !== undefined ? { progressToken } : {};\n\n    try {\n      const result = await handler(args, ctx, meta);\n      if (isToolResult(result)) return result;\n      if (result === undefined) return textResult('OK');\n      return jsonResult(result);\n    } catch (error) {\n      return mapErrorToResult(error, ctx, name);\n    }\n  };\n\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  (server as any).registerTool(name, sdkConfig, wrapped);\n}\n\nfunction isToolResult(value: unknown): value is ToolResult {\n  return (\n    !!value &&\n    typeof value === 'object' &&\n    'content' in value &&\n    Array.isArray((value as ToolResult).content)\n  );\n}\n\nfunction mapErrorToResult(error: unknown, ctx: McpContext, toolName: string): ToolResult {\n  if (error instanceof McpAuthError) {\n    ctx.logger.warn(`${toolName}: auth required`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpUserError) {\n    ctx.logger.info(`${toolName}: user error`, { message: error.message });\n    return errorResult(error.message, error.hint);\n  }\n  if (error instanceof McpInternalError) {\n    ctx.logger.error(`${toolName}: internal error`, {\n      message: error.message,\n      cause: stringifyCause(error.cause),\n    });\n    return errorResult(`Internal error in ${toolName}.`);\n  }\n  const message = error instanceof Error ? error.message : String(error);\n  ctx.logger.error(`${toolName}: unhandled error`, { message });\n  return errorResult(`${toolName}: ${message}`);\n}\n\nfunction stringifyCause(cause: unknown): string | undefined {\n  if (cause === undefined || cause === null) return undefined;\n  if (cause instanceof Error) return cause.message;\n  try {\n    return JSON.stringify(cause);\n  } catch {\n    return String(cause);\n  }\n}\n","import { z } from 'zod';\nimport { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { getAuth } from '../auth/legacy-auth.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\n\nexport function registerAuthTools(\n  server: McpServer,\n  ctx: McpContext,\n  track: (n: string) => string,\n): void {\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_login')),\n    {\n      title: 'Start Login',\n      description:\n        'Start the device code login flow. Returns a verification URL and user code immediately (non-blocking). The user must open the URL in a browser and enter the code, then call vibecontrols_auth_complete to finish.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const auth = getAuth(ctx);\n        const result = await auth.startLogin();\n        return jsonResult(result);\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_login failed', { error });\n        return errorResult(\n          `Login failed: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_complete')),\n    {\n      title: 'Complete Login',\n      description:\n        'Check if the user has completed the device code authorization in their browser. Call this after the user has opened the verification URL and entered the code from vibecontrols_auth_login. Returns \"pending\" if not yet authorized, \"authenticated\" on success.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const auth = getAuth(ctx);\n        const result = await auth.completeLogin();\n        return jsonResult(result);\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_complete failed', { error });\n        return errorResult(\n          `Login completion failed: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_select_workspace')),\n    {\n      title: 'Select Workspace',\n      description:\n        'Select a workspace after login (when multiple workspaces are available). Issues a workspace-scoped token.',\n      inputSchema: {\n        workspaceId: z.string().describe('Workspace ID to select'),\n        organizationId: z.string().describe('Organization ID for the workspace'),\n      },\n    },\n    async ({ workspaceId, organizationId }) => {\n      try {\n        const auth = getAuth(ctx);\n        await auth.selectWorkspace(workspaceId, organizationId);\n        return jsonResult({\n          status: 'workspace_selected',\n          workspaceId,\n          message: `Workspace ${workspaceId} selected and token issued.`,\n        });\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_select_workspace failed', { error });\n        return errorResult(\n          `Failed to select workspace: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_workspaces')),\n    {\n      title: 'List Workspaces',\n      description: 'List all workspaces available to the authenticated user.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const auth = getAuth(ctx);\n        const workspaces = await auth.listWorkspaces();\n        return jsonResult({ workspaces, total: workspaces.length });\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_workspaces failed', { error });\n        return errorResult(\n          `Failed to list workspaces: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_status')),\n    {\n      title: 'Auth Status',\n      description:\n        'Show current authentication status including method, token expiration, workspace info, and pending login state.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const auth = getAuth(ctx);\n        const status = await auth.getStatus();\n        return jsonResult(status);\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_status failed', { error });\n        return errorResult(\n          `Failed to get auth status: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_logout')),\n    {\n      title: 'Logout',\n      description: 'Log out and clear all stored authentication tokens.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const auth = getAuth(ctx);\n        await auth.logout();\n        return jsonResult({\n          status: 'logged_out',\n          message: 'Tokens cleared successfully.',\n        });\n      } catch (error) {\n        ctx.logger.error('vibecontrols_auth_logout failed', { error });\n        return errorResult(\n          `Logout failed: ${error instanceof Error ? error.message : String(error)}`,\n        );\n      }\n    },\n  );\n}\n","/**\n * Extended auth GraphQL operations (Phase 2 additions).\n *\n * Ported verbatim from cli-sdk/src/modules/auth/extra-operations.ts so the\n * field selections stay aligned across CLI and MCP. All operations live on\n * the global gateway; calling code uses ctx.gql.global.request().\n */\n\n// ── SDK-parity operations ────────────────────────────────────────────────\n// Mirror sdk-libs-node/src/modules/auth/operations.ts so MCP tools that close\n// the parity gap (auth_sign_up / auth_authenticate_app / auth_sign_in /\n// auth_refresh_token / etc.) hit the same backend mutations as the SDK.\n\nexport const SIGN_UP = `\n  mutation SignUp($input: SignUpInput!) {\n    signUp(input: $input) {\n      user { id email username }\n      accessToken\n      refreshToken\n      expiresIn\n    }\n  }\n`;\n\nexport const SIGN_IN = `\n  mutation SignIn($input: SignInInput!) {\n    signIn(input: $input) {\n      user { id email username }\n      accessToken\n      refreshToken\n      expiresIn\n    }\n  }\n`;\n\nexport const REFRESH_TOKEN_OP = `\n  mutation RefreshToken($token: String!) {\n    refreshToken(token: $token) {\n      user { id email username }\n      accessToken\n      refreshToken\n      expiresIn\n    }\n  }\n`;\n\nexport const SIGN_OUT = `\n  mutation SignOut {\n    signOut\n  }\n`;\n\nexport const AUTHENTICATE_APP = `\n  mutation AuthenticateApp($input: AuthenticateAppInput!) {\n    authenticateApp(input: $input) {\n      accessToken\n      tokenType\n      expiresIn\n      scopes\n    }\n  }\n`;\n\nexport const ME = `\n  query Me {\n    me { id email username isActive emailVerified }\n  }\n`;\n\nexport const CURRENT_USER = `\n  query currentUser {\n    currentUser {\n      id email firstName lastName username phoneNumber name\n      emailVerified mfaEnabled isAdmin role status createdAt lastLoginAt\n    }\n  }\n`;\n\nexport const UPDATE_CURRENT_USER_PROFILE = `\n  mutation updateCurrentUserProfile($input: UpdateUserInput!) {\n    updateCurrentUserProfile(input: $input) {\n      id name firstName lastName username phoneNumber timezone language\n    }\n  }\n`;\n\nexport const AUTH_AUDIT_LOGS = `\n  query authAuditLogs($pagination: PaginationInput) {\n    authAuditLogs(pagination: $pagination) {\n      id action resource resourceType resourceId description\n      ipAddress userAgent metadata createdAt\n    }\n  }\n`;\n\nexport const ACTIVE_SESSIONS = `\n  query activeSessions($pagination: PaginationInput) {\n    activeSessions(pagination: $pagination) {\n      id status ipAddress userAgent location lastActivityAt expiresAt createdAt isCurrent\n    }\n  }\n`;\n\nexport const REVOKE_SESSION = `\n  mutation revokeSession($id: ID!) {\n    revokeSession(id: $id)\n  }\n`;\n\nexport const CURRENT_USER_MFA_METHODS = `\n  query currentUserMFAMethods($pagination: PaginationInput) {\n    currentUserMFAMethods(pagination: $pagination) {\n      id method status createdAt updatedAt\n    }\n  }\n`;\n\nexport const SETUP_MFA = `\n  mutation setupMFA($method: MFAMethod!) {\n    setupMFA(method: $method) {\n      method backupCodes qrCode secret\n    }\n  }\n`;\n\nexport const VERIFY_MFA = `\n  mutation verifyMFA($input: MFAVerifyInput!) {\n    verifyMFA(input: $input) {\n      success token expiresIn user { id email }\n    }\n  }\n`;\n\nexport const ENABLE_MFA = `\n  mutation enableMFA($code: String!) {\n    enableMFA(code: $code)\n  }\n`;\n\nexport const DISABLE_MFA = `\n  mutation disableMFA {\n    disableMFA\n  }\n`;\n\nexport const MY_API_KEYS = `\n  query myApiKeys($pagination: PaginationInput) {\n    myApiKeys(pagination: $pagination) {\n      id name prefix appId appName scopes expiresAt lastUsedAt createdAt\n    }\n  }\n`;\n\nexport const APP_API_KEYS = `\n  query appApiKeys($appId: ID!, $pagination: PaginationInput) {\n    appApiKeys(appId: $appId, pagination: $pagination) {\n      id name prefix appId appName scopes expiresAt lastUsedAt createdAt\n    }\n  }\n`;\n\nexport const GENERATE_API_KEY = `\n  mutation generateAPIKey($input: GenerateAPIKeyInput!) {\n    generateAPIKey(input: $input) {\n      keyId apiKey apiSecret\n    }\n  }\n`;\n\nexport const UPDATE_API_KEY = `\n  mutation updateAPIKey($keyId: String!, $input: UpdateAPIKeyInput!) {\n    updateAPIKey(keyId: $keyId, input: $input) {\n      id name scope expiresAt\n    }\n  }\n`;\n\nexport const REVOKE_API_KEY = `\n  mutation revokeAPIKey($keyId: String!) {\n    revokeAPIKey(keyId: $keyId)\n  }\n`;\n\nexport const ROTATE_API_KEY = `\n  mutation rotateAPIKey($keyId: String!) {\n    rotateAPIKey(keyId: $keyId) {\n      apiSecret\n    }\n  }\n`;\n\nexport const CURRENT_USER_DELEGATIONS = `\n  query currentUserDelegations($pagination: PaginationInput) {\n    currentUserDelegations(pagination: $pagination) {\n      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds\n      status revokedAt revokedBy\n      app { id name }\n    }\n  }\n`;\n\nexport const GRANT_DELEGATION = `\n  mutation grantDelegation($input: GrantDelegationInput!) {\n    grantDelegation(input: $input) {\n      id appId userId grantedBy grantedAt expiresAt scopes workspaceIds status\n    }\n  }\n`;\n\nexport const REVOKE_DELEGATION = `\n  mutation revokeDelegation($id: ID!, $reason: String) {\n    revokeDelegation(id: $id, reason: $reason)\n  }\n`;\n\nexport const CURRENT_USER_APPS = `\n  query currentUserApps($pagination: PaginationInput) {\n    currentUserApps(pagination: $pagination) {\n      id clientId name description type actorType status ownerUserId\n      redirectUris scopes createdAt updatedAt\n    }\n  }\n`;\n\nexport const GET_APP = `\n  query app($id: ID!) {\n    app(id: $id) {\n      id clientId name description type actorType status ownerUserId redirectUris scopes\n    }\n  }\n`;\n\nexport const CREATE_APP = `\n  mutation createApp($input: CreateAppInput!) {\n    createApp(input: $input) {\n      app { id clientId name type status }\n      clientSecret\n    }\n  }\n`;\n\nexport const UPDATE_APP = `\n  mutation updateApp($id: ID!, $input: UpdateAppInput!) {\n    updateApp(id: $id, input: $input) {\n      id name description redirectUris scopes status\n    }\n  }\n`;\n\nexport const DEACTIVATE_APP = `\n  mutation deactivateApp($id: ID!) {\n    deactivateApp(id: $id)\n  }\n`;\n\nexport const GET_SSO_CONFIG = `\n  query getSSOConfig($tenantId: String!) {\n    getSSOConfig(tenantId: $tenantId) {\n      id identifier tenantId entityId ssoUrl sloUrl certificate enabled metadata\n    }\n  }\n`;\n\nexport const SAVE_SSO_CONFIG = `\n  mutation saveSSOConfig($tenantId: String!, $input: SSOConfigInput!) {\n    saveSSOConfig(tenantId: $tenantId, input: $input) {\n      id identifier entityId ssoUrl sloUrl certificate enabled\n    }\n  }\n`;\n\nexport const DELETE_SSO_CONFIG = `\n  mutation deleteSSOConfig($tenantId: String!) {\n    deleteSSOConfig(tenantId: $tenantId)\n  }\n`;\n\nexport const LIST_USERS = `\n  query users($filter: UserFilterInput, $pagination: PaginationInput) {\n    users(filter: $filter, pagination: $pagination) {\n      users { id email firstName lastName username role status createdAt }\n      totalCount hasMore\n    }\n  }\n`;\n\nexport const GET_USER = `\n  query user($id: ID!) {\n    user(id: $id) {\n      id email firstName lastName username role status emailVerified lastLoginAt\n    }\n  }\n`;\n\nexport const UPDATE_USER = `\n  mutation updateUser($id: ID!, $input: AdminUpdateUserInput!) {\n    updateUser(id: $id, input: $input) {\n      id email firstName lastName username role status\n    }\n  }\n`;\n\nexport const INVITE_USER = `\n  mutation inviteUser($input: InviteUserInput!) {\n    inviteUser(input: $input) {\n      id email status invitedAt expiresAt\n    }\n  }\n`;\n","/**\n * SDK-parity auth tools (Phase 2.1) — closes the gap between\n * sdk-libs-node/src/modules/auth/api.ts and the MCP surface.\n *\n * Adds the 4 auth flows that have NO existing MCP equivalent and are\n * meaningful for an AI agent driving the SDK:\n *\n *   - auth_sign_up                      → email/password account registration\n *   - auth_sign_in                      → email/password sign-in (distinct from\n *                                          the device-code `auth_login`)\n *   - auth_refresh_token                → explicit token refresh (the gql client\n *                                          auto-refreshes; this exposes the\n *                                          mutation for headless/test callers)\n *   - auth_get_current_user             → SDK `me` query (newer, lighter shape\n *                                          than the `currentUser` query already\n *                                          backing auth_profile_get)\n *   - auth_authenticate_app             → M2M auth via GraphQL `authenticateApp`\n *                                          mutation; persists token.\n *   - auth_login_with_api_key           → stash an API key in the auth store so\n *                                          the gql client sends `X-API-Key`\n *   - auth_login_with_client_credentials → OAuth2 client_credentials grant\n *                                          (REST against oidcIssuer/token)\n *\n * All token-persisting tools write through `ctx.auth.write()` and\n * `ctx.gql.reset()` so subsequent module calls use the freshly-issued tokens\n * without restarting the MCP server.\n */\n\nimport { z } from 'zod';\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport { jsonResult, errorResult, mcpToolName, type McpContext } from '../../core/index.js';\nimport { clientCredentialsFlow } from '../../core/auth/device-code.js';\nimport * as ops from './operations.js';\n\ninterface AuthPayload {\n  user: { id: string; email: string; username: string };\n  accessToken: string;\n  refreshToken: string;\n  expiresIn: number;\n}\n\ninterface AuthCodeExchangeResult {\n  accessToken: string;\n  tokenType: string;\n  expiresIn: number;\n  scopes: string[];\n}\n\ninterface MeUser {\n  id: string;\n  email: string;\n  username: string;\n  isActive?: boolean;\n  emailVerified?: boolean;\n}\n\nfunction err(\n  ctx: McpContext,\n  name: string,\n  message: string,\n  error: unknown,\n): ReturnType<typeof errorResult> {\n  ctx.logger.error(`${name} failed`, { error });\n  return errorResult(`${message}: ${error instanceof Error ? error.message : String(error)}`);\n}\n\nfunction persistOAuthTokens(ctx: McpContext, payload: AuthPayload): void {\n  const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n  ctx.auth.write({\n    ...existing,\n    accessToken: payload.accessToken,\n    refreshToken: payload.refreshToken,\n    expiresAt: Date.now() + payload.expiresIn * 1000,\n    authMethod: 'device_code',\n  });\n  ctx.gql.reset();\n}\n\nexport function registerAuthMoreTools(\n  server: McpServer,\n  ctx: McpContext,\n  track: (n: string) => string,\n): void {\n  // ── auth sign_up / sign_in / refresh / sign_out / get_current_user ──────\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_sign_up')),\n    {\n      title: 'Sign Up',\n      description:\n        'Register a new account via email/username/password and immediately sign in. Persists access + refresh tokens. Returns { user, accessToken, refreshToken, expiresIn }.',\n      inputSchema: {\n        email: z.string().describe('Email address for the new account'),\n        username: z.string().describe('Username (must be unique)'),\n        password: z.string().describe('Password (caller is responsible for strength policy)'),\n        firstName: z.string().optional().describe('Optional first name'),\n        lastName: z.string().optional().describe('Optional last name'),\n      },\n    },\n    async ({ email, username, password, firstName, lastName }) => {\n      try {\n        const input: Record<string, unknown> = { email, username, password };\n        if (firstName !== undefined) input.firstName = firstName;\n        if (lastName !== undefined) input.lastName = lastName;\n        const d = await ctx.gql.global.request<{ signUp: AuthPayload }>(ops.SIGN_UP, { input });\n        persistOAuthTokens(ctx, d.signUp);\n        return jsonResult({\n          status: 'authenticated',\n          user: d.signUp.user,\n          accessToken: d.signUp.accessToken,\n          refreshToken: d.signUp.refreshToken,\n          expiresIn: d.signUp.expiresIn,\n        });\n      } catch (e) {\n        return err(ctx, 'auth_sign_up', 'Sign up failed', e);\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_sign_in')),\n    {\n      title: 'Sign In',\n      description:\n        'Sign in with username + password (server-side credential flow, distinct from the device-code `auth_login`). Persists access + refresh tokens. Returns { user, accessToken, refreshToken, expiresIn }.',\n      inputSchema: {\n        username: z.string().describe('Username or email'),\n        password: z.string().describe('Password'),\n      },\n    },\n    async ({ username, password }) => {\n      try {\n        const d = await ctx.gql.global.request<{ signIn: AuthPayload }>(ops.SIGN_IN, {\n          input: { username, password },\n        });\n        persistOAuthTokens(ctx, d.signIn);\n        return jsonResult({\n          status: 'authenticated',\n          user: d.signIn.user,\n          accessToken: d.signIn.accessToken,\n          refreshToken: d.signIn.refreshToken,\n          expiresIn: d.signIn.expiresIn,\n        });\n      } catch (e) {\n        return err(ctx, 'auth_sign_in', 'Sign in failed', e);\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_refresh_token')),\n    {\n      title: 'Refresh Token',\n      description:\n        'Exchange the stored refreshToken for a fresh access + refresh pair. The gql client auto-refreshes when tokens are near expiry; use this tool only when you need to force a refresh now. Persists new tokens. Returns the new { accessToken, expiresIn }.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const existing = ctx.auth.read();\n        if (!existing?.refreshToken) {\n          return errorResult(\n            'No refresh token available. Sign in first via auth_sign_in / auth_sign_up / auth_login.',\n          );\n        }\n        const d = await ctx.gql.global.request<{ refreshToken: AuthPayload }>(\n          ops.REFRESH_TOKEN_OP,\n          {\n            token: existing.refreshToken,\n          },\n        );\n        persistOAuthTokens(ctx, d.refreshToken);\n        return jsonResult({\n          status: 'refreshed',\n          accessToken: d.refreshToken.accessToken,\n          expiresIn: d.refreshToken.expiresIn,\n        });\n      } catch (e) {\n        return err(ctx, 'auth_refresh_token', 'Token refresh failed', e);\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_get_current_user')),\n    {\n      title: 'Get Current User',\n      description:\n        'Fetch the authenticated user via the SDK `me` query (id, email, username, isActive, emailVerified). Lighter than auth_profile_get and matches the SDK shape. Use auth_status to check authentication state locally without a network round-trip.',\n      inputSchema: {},\n    },\n    async () => {\n      try {\n        const d = await ctx.gql.global.request<{ me: MeUser }>(ops.ME);\n        return jsonResult(d.me);\n      } catch (e) {\n        return err(ctx, 'auth_get_current_user', 'Failed to fetch current user', e);\n      }\n    },\n  );\n\n  // ── M2M / headless auth flows ───────────────────────────────────────────\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_authenticate_app')),\n    {\n      title: 'Authenticate App',\n      description:\n        'Machine-to-machine auth via the `authenticateApp` GraphQL mutation. Pass an OAuth app client_id + client_secret (and optional scopes) to receive an access token; persists token for subsequent calls. Returns { accessToken, tokenType, expiresIn, scopes }.',\n      inputSchema: {\n        clientId: z.string().describe('OAuth app clientId'),\n        clientSecret: z\n          .string()\n          .describe('OAuth app clientSecret (shown only once on app creation)'),\n        scopes: z\n          .array(z.string())\n          .optional()\n          .describe('Optional list of scope strings to request'),\n      },\n    },\n    async ({ clientId, clientSecret, scopes }) => {\n      try {\n        const input: Record<string, unknown> = { clientId, clientSecret };\n        if (scopes !== undefined) input.scopes = scopes;\n        const d = await ctx.gql.global.request<{ authenticateApp: AuthCodeExchangeResult }>(\n          ops.AUTHENTICATE_APP,\n          { input },\n        );\n        const result = d.authenticateApp;\n        const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n        ctx.auth.write({\n          ...existing,\n          accessToken: result.accessToken,\n          refreshToken: '',\n          expiresAt: Date.now() + result.expiresIn * 1000,\n          authMethod: 'client_credentials',\n          clientId,\n          clientSecret,\n        });\n        ctx.gql.reset();\n        return jsonResult({\n          status: 'authenticated',\n          accessToken: result.accessToken,\n          tokenType: result.tokenType,\n          expiresIn: result.expiresIn,\n          scopes: result.scopes,\n        });\n      } catch (e) {\n        return err(ctx, 'auth_authenticate_app', 'App authentication failed', e);\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_login_with_api_key')),\n    {\n      title: 'Login with API Key',\n      description:\n        'Authenticate with a pre-issued API key (headless service mode). The key is stored locally and sent as `X-API-Key` on every gateway request; no network call is made by this tool. Use auth_status to verify. Returns { status: \"authenticated\", method: \"api_key\" }.',\n      inputSchema: {\n        apiKey: z.string().describe('Pre-issued API key (e.g. from auth_api_keys_create)'),\n      },\n    },\n    async ({ apiKey }) => {\n      try {\n        const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n        ctx.auth.write({\n          ...existing,\n          apiKey,\n          authMethod: 'api_key',\n        });\n        ctx.gql.reset();\n        return jsonResult({\n          status: 'authenticated',\n          method: 'api_key',\n          message: 'API key stored. Subsequent calls will use X-API-Key.',\n        });\n      } catch (e) {\n        return err(ctx, 'auth_login_with_api_key', 'Failed to set API key', e);\n      }\n    },\n  );\n\n  server.registerTool(\n    track(mcpToolName(ctx.productName, 'auth_login_with_client_credentials')),\n    {\n      title: 'Login with Client Credentials',\n      description:\n        'OAuth2 client_credentials grant (REST against oidcIssuer/token). Equivalent to auth_authenticate_app but uses the OIDC token endpoint instead of the GraphQL mutation; prefer auth_authenticate_app inside the platform. Persists the issued token. Returns { accessToken, expiresIn, scopes }.',\n      inputSchema: {\n        clientId: z.string().describe('OAuth app clientId'),\n        clientSecret: z.string().describe('OAuth app clientSecret'),\n        scopes: z.array(z.string()).optional().describe('Optional list of scope strings'),\n      },\n    },\n    async ({ clientId, clientSecret, scopes }) => {\n      try {\n        const cfg = ctx.config.read();\n        const result = await clientCredentialsFlow(\n          cfg.globalEndpoint,\n          clientId,\n          clientSecret,\n          scopes,\n        );\n        const existing = ctx.auth.read() ?? { accessToken: '', refreshToken: '' };\n        ctx.auth.write({\n          ...existing,\n          accessToken: result.accessToken,\n          refreshToken: '',\n          expiresAt: Date.now() + result.expiresIn * 1000,\n          authMethod: 'client_credentials',\n          clientId,\n          clientSecret,\n        });\n        ctx.gql.reset();\n        return jsonResult({\n          status: 'authenticated',\n          accessToken: result.accessToken,\n          expiresIn: result.expiresIn,\n          scopes: result.scopes,\n        });\n      } catch (e) {\n        return err(ctx, 'auth_login_with_client_credentials', 'Client credentials login failed', e);\n      }\n    },\n  );\n}\n","/**\n * Auth module — login flow + workspace selection + status + logout.\n *\n * Phase 1 ships the SUBSET that exists in vibecontrols-mcp@main:\n *   <product>_auth_{login,complete,select_workspace,workspaces,status,logout}\n *\n * Phase 2 finishes the full auth surface (mfa, api-keys, audit-log,\n * delegations, apps, sso, users, profile, sessions).\n *\n * Phase 2.1 closes the SDK-parity gap (more-tools.ts):\n *   sign_up, sign_in, refresh_token, get_current_user, authenticate_app,\n *   login_with_api_key, login_with_client_credentials.\n */\n\nimport type { McpServer } from '@modelcontextprotocol/sdk/server/mcp.js';\nimport type { McpContext, McpModule, ModuleRegistration } from '../../core/index.js';\nimport { registerAuthTools } from './tools.js';\nimport { registerAuthMoreTools } from './more-tools.js';\n\nconst authModule: McpModule = {\n  id: 'auth',\n  version: '0.0.1',\n  displayName: 'Authentication',\n  capabilities: { tools: {} },\n\n  register(server: McpServer, ctx: McpContext): ModuleRegistration {\n    const tools: string[] = [];\n    const track = (n: string): string => {\n      tools.push(n);\n      return n;\n    };\n\n    registerAuthTools(server, ctx, track);\n    registerAuthMoreTools(server, ctx, track);\n\n    return { tools, resources: [], prompts: [] };\n  },\n};\n\nexport default authModule;\nexport { getAuth, type AuthHelper, type WorkspaceInfo } from './legacy-auth.js';\n"]}

package/dist/modules/auth/index.js

@@ -1,6 +1,6 @@
-import { getAuth } from '../../chunk-RHWHUY5Y.js';
-export { getAuth } from '../../chunk-RHWHUY5Y.js';
-import { mcpToolName, jsonResult, errorResult, clientCredentialsFlow } from '../../chunk-YOSQUY3M.js';
+import { getAuth } from '../../chunk-QQYJVKJE.js';
+export { getAuth } from '../../chunk-QQYJVKJE.js';
+import { mcpToolName, jsonResult, errorResult, clientCredentialsFlow } from '../../chunk-BSNL65PZ.js';
 import { z } from 'zod';
 
 function registerAuthTools(server, ctx, track) {