@cleocode/cleo 2026.9.5 → 2026.9.7

package/studio-dist/server/chunks/credential-pool-vF6NdtT9.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"credential-pool-vF6NdtT9.js","sources":["../../../.svelte-kit/adapter-node/chunks/file-utils.js","../../../.svelte-kit/adapter-node/chunks/kimi-code.js","../../../.svelte-kit/adapter-node/chunks/provider-registry.js","../../../.svelte-kit/adapter-node/chunks/rate-limit-guard.js","../../../.svelte-kit/adapter-node/chunks/credential-pool.js"],"sourcesContent":["import \"./paths.js\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { basename, dirname, join } from \"node:path\";\nimport { randomBytes } from \"node:crypto\";\nimport * as lockfile$1 from \"proper-lockfile\";\n//#region ../core/dist/store/file-utils.js\n/**\n* File utility helpers for CLEO data access.\n*\n* File utility helpers for CLEO data access including atomic writes,\n* file locking, and backup rotation.\n*\n* @task T4833\n* @epic T4654\n*/\n/**\n* Maximum number of operational backups to keep.\n*/\nvar MAX_BACKUPS = 10;\n/**\n* Create a numbered backup of a file (Tier 1 operational backup).\n*\n* When `mode` is provided, the backup directory is created at `mode`\n* (translated to a directory-execute bit) and each rotated backup is\n* written at `mode` so secrets never leak through historical copies.\n*/\nfunction rotateBackup(filePath, mode) {\n\tconst dir = dirname(filePath);\n\tconst name = basename(filePath);\n\tconst backupDir = join(dir, \".backups\");\n\tconst dirMode = typeof mode === \"number\" ? modeToDirMode(mode) : void 0;\n\tif (!existsSync(backupDir)) mkdirSync(backupDir, {\n\t\trecursive: true,\n\t\tmode: dirMode\n\t});\n\tfor (let i = MAX_BACKUPS; i >= 1; i--) {\n\t\tconst current = join(backupDir, `${name}.${i}`);\n\t\tif (i === MAX_BACKUPS) try {\n\t\t\tunlinkSync(current);\n\t\t} catch {}\n\t\telse {\n\t\t\tconst next = join(backupDir, `${name}.${i + 1}`);\n\t\t\ttry {\n\t\t\t\tif (existsSync(current)) renameSync(current, next);\n\t\t\t} catch {}\n\t\t}\n\t}\n\ttry {\n\t\tconst content = readFileSync(filePath, \"utf-8\");\n\t\tconst backupPath = join(backupDir, `${name}.1`);\n\t\tif (typeof mode === \"number\") writeFileSync(backupPath, content, {\n\t\t\tencoding: \"utf-8\",\n\t\t\tmode\n\t\t});\n\t\telse writeFileSync(backupPath, content, \"utf-8\");\n\t} catch {}\n}\n/**\n* Translate a file mode (e.g. 0o600) into the matching directory mode by\n* mirroring read bits into execute bits. 0o600 → 0o700, 0o644 → 0o755.\n*\n* Directories need execute (`x`) where files only need read (`r`) — that's\n* how POSIX gates `readdir`/`stat` of children. Without this, a 0600 file\n* in a 0644 directory is still listable by other users.\n*\n* @task T-LLM-CRED-CENTRALIZATION Phase 2 — security review S-03\n*/\nfunction modeToDirMode(mode) {\n\tlet result = mode & 511;\n\tif (result & 256) result |= 64;\n\tif (result & 32) result |= 8;\n\tif (result & 4) result |= 1;\n\treturn result;\n}\n/**\n* Write a JSON file atomically with backup rotation.\n*\n* Pattern: write temp -> backup original -> rename temp to target\n*\n* When `opts.mode` is provided, the temp file AND the rotated backup\n* are both created at that mode so there is no instant at which the\n* live file (or any historical copy) exists at a looser mode. This is\n* REQUIRED for secret-bearing files such as `llm-credentials.json`;\n* passing 0o600 closes CWE-276 (incorrect default permissions) and\n* CWE-367 (rename → chmod TOCTOU) together.\n*\n* Back-compat: callers that omit `opts` (or pass a number, for the old\n* `indent` positional form) get the legacy default-umask behavior so no\n* existing usage changes.\n*\n* @param filePath - Target file path.\n* @param data - Data to serialize as JSON.\n* @param optsOrIndent - Options object, or a number for legacy `indent`\n*   positional form.\n*\n* @task T-LLM-CRED-CENTRALIZATION Phase 2 — security review S-01/S-02\n*/\nfunction writeJsonFileAtomic(filePath, data, optsOrIndent = 2) {\n\tconst opts = typeof optsOrIndent === \"number\" ? { indent: optsOrIndent } : optsOrIndent;\n\tconst indent = opts.indent ?? 2;\n\tconst mode = opts.mode;\n\tconst tempPath = join(dirname(filePath), `.${basename(filePath)}.${randomBytes(6).toString(\"hex\")}.tmp`);\n\tconst content = JSON.stringify(data, null, indent) + \"\\n\";\n\tif (typeof mode === \"number\") writeFileSync(tempPath, content, {\n\t\tencoding: \"utf-8\",\n\t\tmode\n\t});\n\telse writeFileSync(tempPath, content, \"utf-8\");\n\ttry {\n\t\tif (existsSync(filePath)) rotateBackup(filePath, mode);\n\t\trenameSync(tempPath, filePath);\n\t} catch (error) {\n\t\ttry {\n\t\t\tunlinkSync(tempPath);\n\t\t} catch {}\n\t\tthrow error;\n\t}\n}\n/**\n* Read a JSON file, returning parsed content or null if not found.\n*\n* @param filePath - Path to the JSON file\n*/\nfunction readJsonFile(filePath) {\n\ttry {\n\t\tconst content = readFileSync(filePath, \"utf-8\");\n\t\treturn JSON.parse(content);\n\t} catch (error) {\n\t\tif (error.code === \"ENOENT\") return null;\n\t\tthrow error;\n\t}\n}\n/**\n* Default lock options matching bash flock behavior\n*/\nvar LOCK_OPTIONS = {\n\tretries: {\n\t\tretries: 5,\n\t\tfactor: 2,\n\t\tminTimeout: 100,\n\t\tmaxTimeout: 5e3\n\t},\n\tstale: 3e4\n};\n/**\n* Read and write a JSON file with exclusive locking.\n*\n* Acquires a cross-process lock, reads current state, applies the\n* transform function, validates, and writes back atomically.\n*\n* When `opts.mode` is provided, every filesystem mutation in this path\n* (parent dir create, sentinel empty file, atomic write, rotated backup)\n* is constrained to the requested mode so secret-bearing data never\n* touches the disk at a looser permission.\n*\n* @param filePath - File to lock and modify.\n* @param transform - Function that receives current data and returns new data.\n* @param opts - Optional mode override for secret-bearing writes.\n* @returns The transformed data.\n*\n* @task T-LLM-CRED-CENTRALIZATION Phase 2 — security review S-01/S-02/S-03\n*/\nasync function withLock(filePath, transform, opts = {}) {\n\tconst dir = dirname(filePath);\n\tconst dirMode = typeof opts.mode === \"number\" ? modeToDirMode(opts.mode) : void 0;\n\tif (!existsSync(dir)) mkdirSync(dir, {\n\t\trecursive: true,\n\t\tmode: dirMode\n\t});\n\tif (!existsSync(filePath)) if (typeof opts.mode === \"number\") writeFileSync(filePath, \"\", {\n\t\tencoding: \"utf-8\",\n\t\tmode: opts.mode\n\t});\n\telse writeFileSync(filePath, \"\", \"utf-8\");\n\tlet release;\n\ttry {\n\t\trelease = await lockfile$1.lock(filePath, LOCK_OPTIONS);\n\t\tconst updated = transform(readJsonFile(filePath));\n\t\twriteJsonFileAtomic(filePath, updated, { mode: opts.mode });\n\t\treturn updated;\n\t} finally {\n\t\tif (release) await release();\n\t}\n}\n/**\n* Acquire a file lock and execute an operation.\n* Unlike withLock, this doesn't read/write the file - caller manages I/O.\n* The return type R is independent of the file content type.\n*/\nasync function withFileLock(filePath, operation) {\n\tconst dir = dirname(filePath);\n\tif (!existsSync(dir)) mkdirSync(dir, { recursive: true });\n\tif (!existsSync(filePath)) writeFileSync(filePath, \"\", \"utf-8\");\n\tlet release;\n\ttry {\n\t\trelease = await lockfile$1.lock(filePath, LOCK_OPTIONS);\n\t\treturn await operation();\n\t} finally {\n\t\tif (release) await release();\n\t}\n}\n//#endregion\nexport { writeJsonFileAtomic as i, withFileLock as n, withLock as r, readJsonFile as t };\n","import { i as getCleoHome } from \"./dist.js\";\nimport { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { randomUUID } from \"node:crypto\";\n//#region ../core/dist/llm/stable-device-id.js\n/**\n* Stable device identifier — persisted UUIDv4 keyed to the CLEO home directory.\n*\n* Used by providers that enforce device-ID stability on every request\n* (`X-Msh-Device-Id` for Kimi Code; future GitHub Copilot / Cursor). The UUID\n* is written once at first use and reused across processes — losing it would\n* trigger device re-registration prompts upstream.\n*\n* Storage: `${CLEO_HOME}/device-id` — single-line UUIDv4, no metadata. Path\n* resolves through `getCleoHome()` so it follows XDG conventions on Linux\n* and stays inside the CLEO home on Windows/macOS.\n*\n* @module llm/stable-device-id\n* @task T9321\n* @epic T9261 T-LLM-CRED-CENTRALIZATION\n*/\n/** Filename within `getCleoHome()` storing the persisted UUID. */\nvar DEVICE_ID_FILE = \"device-id\";\n/** Process-lifetime cache so repeat callers do not re-read the disk. */\nvar _cachedDeviceId = null;\n/**\n* Return the stable device UUID for this CLEO installation.\n*\n* Creates the file on first call (atomic write — tmp+rename pattern). All\n* subsequent calls in the same process return the cached value. Across\n* processes, the file is the source of truth.\n*\n* The UUID is OPAQUE — callers MUST treat it as a stable identifier and not\n* encode any meaning into its bytes.\n*\n* @returns A UUIDv4 string in canonical hyphenated form.\n*\n* @task T9321\n*/\nfunction getStableDeviceId() {\n\tif (_cachedDeviceId !== null) return _cachedDeviceId;\n\tconst path = join(getCleoHome(), DEVICE_ID_FILE);\n\tif (existsSync(path)) try {\n\t\tconst raw = readFileSync(path, \"utf-8\").trim();\n\t\tif (raw.length > 0) {\n\t\t\t_cachedDeviceId = raw;\n\t\t\treturn raw;\n\t\t}\n\t} catch {}\n\tconst fresh = randomUUID();\n\ttry {\n\t\tconst dir = dirname(path);\n\t\tif (!existsSync(dir)) mkdirSync(dir, { recursive: true });\n\t\tconst tmpPath = `${path}.tmp.${process.pid}`;\n\t\twriteFileSync(tmpPath, fresh, { mode: 384 });\n\t\trenameSync(tmpPath, path);\n\t} catch {}\n\t_cachedDeviceId = fresh;\n\treturn fresh;\n}\n//#endregion\n//#region ../core/dist/llm/provider-registry/builtin/kimi-code.js\n/**\n* Builtin provider profile for Kimi Code (kimi.com/code).\n*\n* Kimi Code is Moonshot AI's coding-focused offering accessible via two key\n* shapes that share a single chat endpoint:\n*\n* - **`sk-kimi-*` API keys** issued through https://kimi.com/code — sent as\n*   `Authorization: Bearer <key>` against https://api.kimi.com/coding. The\n*   endpoint speaks the Anthropic Messages protocol (so the Anthropic SDK\n*   works out of the box once the base URL is overridden).\n* - **OAuth device-code** flow against https://auth.kimi.com using public\n*   client `17e5f671-d194-4dfb-9706-5516cb48c098`. Yields an access token\n*   (~15 min lifetime) + refresh token (~30 day lifetime). The access token\n*   targets the same chat endpoint with the same protocol.\n*\n* The provider also requires six mandatory `X-Msh-*` headers on every\n* request — without them the backend rejects with 401. The `X-Msh-Device-Id`\n* must be a stable UUID persisted to disk (see {@link getStableDeviceId}).\n*\n* Note: the \"legacy\" Moonshot OpenAI-compat endpoint at api.moonshot.ai/v1\n* is served by the separate `moonshot` provider profile — Kimi Code is a\n* distinct provider with a different protocol and authentication path.\n*\n* @task T9321\n* @epic T9261 T-LLM-CRED-CENTRALIZATION\n* @see packages/core/src/llm/oauth/device-code.ts — Kimi device-code preset\n* @see packages/core/src/llm/stable-device-id.ts — persisted device UUID\n*/\n/** Coding endpoint base URL — Anthropic Messages protocol. */\nvar KIMI_CODE_BASE_URL = \"https://api.kimi.com/coding\";\n/** Default model — Moonshot's coding-tier Kimi K2. */\nvar DEFAULT_MODEL = \"kimi-k2-coding\";\n/**\n* Build the six mandatory `X-Msh-*` headers required by the Kimi Code\n* backend. Missing any header triggers 401 errors regardless of credential.\n*\n* `X-Msh-Device-Id` is sourced from {@link getStableDeviceId} which persists\n* a UUIDv4 once at `${CLEO_HOME}/device-id` and reuses it forever — the\n* backend tracks devices and would force re-registration on drift.\n*\n* @returns Header object suitable for spreading into request headers.\n*\n* @task T9321\n*/\nfunction getKimiCodeMshHeaders() {\n\treturn {\n\t\t\"X-Msh-Platform\": \"cleo\",\n\t\t\"X-Msh-Version\": \"1\",\n\t\t\"X-Msh-Device-Name\": \"cleo-cli\",\n\t\t\"X-Msh-Device-Model\": \"cleo\",\n\t\t\"X-Msh-Os-Version\": process.version,\n\t\t\"X-Msh-Device-Id\": getStableDeviceId()\n\t};\n}\n/**\n* Detect whether an API key is a Kimi Code coding-plan key.\n*\n* Kimi Code issues keys with the `sk-kimi-` prefix. Other keys (e.g. legacy\n* `mk-` Moonshot platform keys) MUST go through the `moonshot` provider,\n* not `kimi-code`.\n*\n* @param apiKey - The credential's API-key string.\n* @returns `true` when the key targets the Kimi Code coding endpoint.\n*\n* @task T9321\n*/\nfunction isKimiCodeApiKey(apiKey) {\n\treturn apiKey.startsWith(\"sk-kimi-\");\n}\n/**\n* Kimi Code provider profile.\n*\n* Speaks the Anthropic Messages protocol against api.kimi.com/coding. The\n* mandatory `X-Msh-*` headers are merged into every request via\n* {@link defaultHeaders}. OAuth bearer tokens issued by the device-code flow\n* are accepted alongside `sk-kimi-` API keys.\n*\n* @task T9321\n* @task T9286 (W1d — added reasoning_effort hook)\n*/\nvar kimiCodeProfile = {\n\tname: \"kimi-code\",\n\tdisplayName: \"Kimi Code (Moonshot)\",\n\tauthTypes: [\"api_key\", \"oauth\"],\n\tbaseUrl: KIMI_CODE_BASE_URL,\n\tdefaultModel: DEFAULT_MODEL,\n\taliases: [\n\t\t\"kimi\",\n\t\t\"moonshot-coding\",\n\t\t\"kimi-coding\"\n\t],\n\tdefaultHeaders: getKimiCodeMshHeaders(),\n\tenvVars: [\"KIMI_CODE_API_KEY\", \"KIMI_API_KEY\"],\n\tbuildApiKwargsExtras() {\n\t\treturn { reasoning_effort: \"high\" };\n\t}\n};\n//#endregion\nexport { isKimiCodeApiKey as n, kimiCodeProfile as r, getKimiCodeMshHeaders as t };\n","import { o as getCleoHome } from \"./paths.js\";\nimport { r as kimiCodeProfile } from \"./kimi-code.js\";\nimport { readdirSync, statSync } from \"node:fs\";\nimport { join } from \"node:path\";\nimport { pathToFileURL } from \"node:url\";\n/**\n* Resolve the Anthropic OAuth client ID.\n*\n* Prefers `CLEO_ANTHROPIC_OAUTH_CLIENT_ID` env var; falls back to the\n* canonical public client_id. No warning is emitted in the fallback path —\n* the public client_id is the production-correct default.\n*/\nfunction resolveAnthropicClientId() {\n\treturn process.env[\"CLEO_ANTHROPIC_OAUTH_CLIENT_ID\"] ?? \"9d1c250a-e61b-44d9-88ed-5944d1962f5e\";\n}\n/**\n* Anthropic Claude provider profile.\n*\n* - `authTypes` includes both `api_key` (long-lived `sk-ant-*` keys) and\n*   `oauth` (short-lived `sk-ant-oat-*` bearer tokens from Claude Code).\n* - `defaultHeaders` pins the stable `anthropic-version: 2023-06-01` API\n*   version header required by all Anthropic Messages API requests.\n* - `fetchModels` is omitted — the Anthropic API does not expose a public\n*   `/models` endpoint for arbitrary callers. Callers fall back to the\n*   static model list maintained in `@cleocode/core/llm`.\n* - `oauth` configures the RFC 7636 PKCE flow used by `cleo llm login anthropic`.\n*/\nvar anthropicProfile = {\n\tname: \"anthropic\",\n\tdisplayName: \"Anthropic Claude\",\n\tauthTypes: [\"api_key\", \"oauth\"],\n\tbaseUrl: \"https://api.anthropic.com\",\n\tdefaultModel: \"claude-haiku-4-5-20251001\",\n\taliases: [\"claude\", \"anthropic-api\"],\n\ttier: \"frontier\",\n\tdefaultAuxModel: \"claude-haiku-4-5-20251001\",\n\tdefaultMaxTokens: 4096,\n\tdefaultHeaders: { \"anthropic-version\": \"2023-06-01\" },\n\toauth: {\n\t\tmode: \"pkce\",\n\t\tclientId: resolveAnthropicClientId(),\n\t\tauthorizationEndpoint: \"https://claude.ai/oauth/authorize\",\n\t\ttokenEndpoint: \"https://platform.claude.com/v1/oauth/token\",\n\t\tscope: \"org:create_api_key user:profile user:inference\",\n\t\tredirectUri: \"https://platform.claude.com/oauth/code/callback\",\n\t\textraAuthParams: { code: \"true\" },\n\t\ttokenBodyFormat: \"json\"\n\t}\n};\n//#endregion\n//#region ../core/dist/llm/provider-registry/builtin/bedrock.js\n/**\n* Builtin provider profile for AWS Bedrock (Converse API).\n*\n* AWS Bedrock exposes many foundation models through a uniform Converse API.\n* This profile covers the common model ID prefixes:\n* - `anthropic.claude-*` — Anthropic Claude models on Bedrock\n* - `amazon.nova-*`      — Amazon Nova series\n* - `mistral.mistral-*`  — Mistral AI models on Bedrock\n* - `meta.llama*`        — Meta Llama models on Bedrock\n* - `cohere.command-*`   — Cohere Command models on Bedrock\n*\n* Credential auth for Bedrock uses the standard AWS credential chain\n* (`fromNodeProviderChain`), not an API key. The `authTypes: ['aws_sdk']`\n* declaration is informational — the actual resolution happens inside\n* `BedrockTransport` via the AWS SDK credential chain.\n*\n* @task T9317\n* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 5)\n*/\n/**\n* AWS Bedrock provider profile.\n*\n* - `authTypes` is `['aws_sdk']` — informational for the credential store\n*   UI. Actual resolution uses `fromNodeProviderChain()` inside the transport.\n* - `fetchModels` is omitted — the Bedrock model catalog is large and\n*   region-specific. Use `cleo llm refresh-catalog` (T9314) for discovery.\n* - `defaultModel` targets Claude Sonnet 3.7, widely available across regions.\n*/\nvar bedrockProfile = {\n\tname: \"bedrock\",\n\tdisplayName: \"AWS Bedrock\",\n\tauthTypes: [\"aws_sdk\"],\n\tbaseUrl: \"https://bedrock-runtime.{region}.amazonaws.com\",\n\tdefaultModel: \"anthropic.claude-3-5-sonnet-20241022-v2:0\",\n\taliases: [\"aws-bedrock\", \"bedrock-converse\"]\n};\n//#endregion\n//#region ../core/dist/llm/provider-registry/builtin/gemini.js\n/**\n* Builtin provider profile for Google Gemini (OpenAI-compat shim).\n*\n* Gemini exposes an OpenAI-compatible shim at\n* `https://generativelanguage.googleapis.com/v1beta/openai` that accepts\n* the standard `chat.completions.create` wire shape. The Gemini-specific\n* quirk is the `extra_body.thinking_config` field which controls extended\n* reasoning budget selection.\n*\n* @task T9286 (W1d)\n* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3)\n*/\n/**\n* Build the Gemini thinking configuration object for `extra_body`.\n*\n* Budget selection:\n* - `'auto'` — Gemini 1.x and 2.x models, and any model with `flash` in the\n*   name (Flash-tier models use dynamic budget allocation).\n* - `'high'` — Gemini 3 Pro and newer high-capability variants that support\n*   explicit budget control without automatic fallback.\n*\n* @invariant gemini-thinking-config: Gemini requires `extra_body.thinking_config`\n* for extended reasoning. Budget is model-aware: 'auto' for ≤2.x/flash,\n* 'high' for ≥3.x non-flash. This quirk is DISTINCT from Moonshot's shallow\n* schema sanitizer and Gemini's own deep schema sanitizer.\n*\n* @param model - Lowercase model identifier string.\n* @returns Thinking config record for `extra_body.thinking_config`.\n*/\nfunction buildGeminiThinkingConfig(model) {\n\tif (/gemini-3|gemini3/.test(model) && !model.includes(\"flash\")) return { thinking_budget: \"high\" };\n\treturn { thinking_budget: \"auto\" };\n}\n/**\n* Google Gemini provider profile (OpenAI-compatible shim).\n*\n* Encodes the Gemini thinking config quirk as a `buildExtraBody` hook.\n*\n* @task T9286 (W1d)\n*/\nvar geminiProfile = {\n\tname: \"gemini\",\n\tdisplayName: \"Google Gemini\",\n\tauthTypes: [\"api_key\"],\n\tbaseUrl: \"https://generativelanguage.googleapis.com/v1beta/openai\",\n\tdefaultModel: \"gemini-2.0-flash\",\n\taliases: [\"google\", \"google-gemini\"],\n\ttier: \"standard\",\n\tdefaultAuxModel: \"gemini-2.0-flash\",\n\tdefaultMaxTokens: 4096,\n\tenvVars: [\"GEMINI_API_KEY\", \"GOOGLE_API_KEY\"],\n\tbuildExtraBody(model) {\n\t\treturn { thinking_config: buildGeminiThinkingConfig(model.toLowerCase()) };\n\t}\n};\n//#endregion\n//#region ../core/dist/llm/provider-registry/builtin/moonshot.js\n/**\n* Builtin provider profile for Moonshot AI (Kimi K2 legacy endpoint).\n*\n* This profile covers the **legacy** Moonshot OpenAI-compatible surface at\n* `api.moonshot.ai/v1`. It is distinct from the Kimi Code coding-plan\n* endpoint (see `kimi-code.ts` which targets `api.kimi.com/coding` with\n* Anthropic Messages protocol and device-code OAuth).\n*\n* Quirks encoded in this profile:\n* - Rejects `thinkingBudgetTokens` — Moonshot's API does not expose a\n*   thinking-budget parameter (Anthropic-style). Callers MUST NOT set it.\n* - Sanitizes tool JSON schemas: removes `$schema` and root-level\n*   `additionalProperties` which the Moonshot backend rejects.\n*\n* @task T9286 (W1d)\n* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3)\n*/\n/** Moonshot API base URL (OpenAI-compatible endpoint). */\nvar MOONSHOT_BASE_URL = \"https://api.moonshot.ai/v1\";\n/** Default Kimi K2 coding model identifier. */\nvar MOONSHOT_DEFAULT_MODEL = \"kimi-k2-0905-preview\";\n/**\n* Strip Moonshot-incompatible fields from a single TransportTool's inputSchema.\n*\n* @invariant moonshot-shallow-sanitize: Moonshot rejects `$schema` and root-level\n* `additionalProperties` in tool parameter schemas. This sanitizer removes\n* both fields WITHOUT touching nested schemas (shallow-only — Gemini has its\n* own separate recursive deep sanitizer that walks the entire schema tree).\n*\n* @param tool - Provider-neutral TransportTool from the request.\n* @returns Tool copy with sanitized root-level `inputSchema`.\n*/\nfunction sanitizeMoonshotTransportTool(tool) {\n\tconst sanitizedSchema = { ...tool.inputSchema };\n\tdelete sanitizedSchema[\"$schema\"];\n\tdelete sanitizedSchema[\"additionalProperties\"];\n\treturn {\n\t\t...tool,\n\t\tinputSchema: sanitizedSchema\n\t};\n}\n/**\n* Moonshot AI provider profile (Kimi K2 legacy OpenAI-compat endpoint).\n*\n* Encodes two provider-specific quirks as ProviderProfile hooks:\n*\n* 1. `buildApiKwargsExtras` — rejects `thinkingBudgetTokens` (not supported).\n* 2. `buildExtraBody` — sanitizes tool schemas (removes `$schema` +\n*    root-level `additionalProperties`) for every Moonshot request that\n*    carries tools.\n*\n* @task T9286 (W1d)\n*/\nvar moonshotProfile = {\n\tname: \"moonshot\",\n\tdisplayName: \"Moonshot AI (Kimi K2)\",\n\tauthTypes: [\"api_key\"],\n\tbaseUrl: MOONSHOT_BASE_URL,\n\tdefaultModel: MOONSHOT_DEFAULT_MODEL,\n\taliases: [\"kimi-k2\", \"moonshot-ai\"],\n\tenvVars: [\"MOONSHOT_API_KEY\"],\n\tbuildApiKwargsExtras(_model, _messages, _tools) {\n\t\treturn {};\n\t},\n\tbuildExtraBody(_model, _messages, tools) {\n\t\tif (tools.length === 0) return {};\n\t\treturn { __sanitizedTransportTools: tools.map(sanitizeMoonshotTransportTool) };\n\t}\n};\n//#endregion\n//#region ../core/dist/llm/provider-registry/builtin/ollama.js\n/**\n* Builtin provider profile for Ollama.\n*\n* Ollama is a local/self-hosted LLM runtime that exposes a `/api/chat`\n* endpoint speaking its own NDJSON streaming protocol (`ollama_native`\n* ApiMode). It is NOT an OpenAI-compatible shim — use {@link OllamaTransport}\n* from `packages/core/src/llm/transports/ollama.ts`.\n*\n* Key characteristics:\n* - No API key required for local deployments (empty-string placeholder).\n* - Base URL defaults to `http://localhost:11434` (the well-known Ollama port).\n* - Tool calling uses the same OpenAI wire shape for REQUEST but returns\n*   `arguments` as an object (not a JSON string) in the RESPONSE.\n* - No prompt-caching support.\n*\n* @task T9355 (Task A — Ollama transport, D-ph4-05 closure)\n* @epic T9354\n*/\n/**\n* Ollama provider profile.\n*\n* Registers the `ollama` canonical name and `ollama-local` alias so that\n* `cleo llm test ollama` and `getProviderProfile('ollama-local')` both\n* resolve to this profile.\n*\n* The profile declares `apiMode: 'ollama_native'` which is used by the\n* session factory to select {@link OllamaTransport} at runtime.\n*\n* `authTypes: ['api_key']` is listed for compatibility with the credential\n* store API, but local Ollama deployments do not require an actual key —\n* users may leave it empty or store a token for remote/proxied deployments.\n*\n* ## Default model selection (DHQ-081 · T11978 · T11990)\n*\n* `defaultModel` is `gemma4:e4b` (standard/frontier tasks, requires ≥ 8 GB RAM).\n* `defaultAuxModel` is `gemma4:e2b` (fast/aux tasks, requires ≥ 4 GB RAM).\n*\n* Tags live-verified on ollama.com/library/gemma4 2026-06-11:\n*   - gemma4:e2b  = 7.2 GB download (Q4_K_M), edge 2B effective params\n*   - gemma4:e4b  = 9.6 GB download (Q4_K_M), edge 4B effective params\n*   - gemma4:12b  = 7.6 GB download (QAT), 12B params, 256k context\n*\n* The cross-provider selector (`cross-provider-selector.ts`) gates model selection\n* on `os.totalmem()` and falls through to `qwen2:0.5b` only as a proof-of-life\n* last resort when RAM is below 4 GB. These are the provider-registry SSoT\n* constants; the selector reads them via `getProviderProfile('ollama')`.\n*\n* If the catalog does not yet have a `gemma4` family entry, the resolver logs a\n* hint to run `cleo llm refresh-catalog`.\n*/\nvar ollamaProfile = {\n\tname: \"ollama\",\n\tdisplayName: \"Ollama (local)\",\n\tauthTypes: [\"api_key\"],\n\tbaseUrl: \"http://localhost:11434\",\n\tdefaultModel: \"gemma4:e4b\",\n\taliases: [\"ollama-local\"],\n\ttier: \"local\",\n\tdefaultAuxModel: \"gemma4:e2b\",\n\tdefaultMaxTokens: 2048,\n\tenvVars: [\"OLLAMA_API_KEY\", \"OLLAMA_BASE_URL\"],\n\tsupportsThinkingBudget: false\n};\n/** Resolve the OpenAI OAuth client id (env override → canonical default). */\nfunction resolveOpenaiClientId() {\n\treturn process.env[\"CLEO_OPENAI_OAUTH_CLIENT_ID\"] ?? \"app_EMoamEEZ73f0CkXaXp7hrann\";\n}\n/**\n* OpenAI / Codex provider profile.\n*\n* `defaultModel` is a static FALLBACK used when no live catalog snapshot is\n* available (i.e. before `cleo llm refresh-catalog` has been run). At runtime,\n* `cleo llm use openai` / `cleo llm profile <role> openai` derive the default\n* from the live catalog via `resolveProviderDefaultModel` and validate any\n* explicit `--model` against `validateModelForProvider` (T11773 · E8).\n*\n* Override per-credential:\n*   `cleo llm use openai --model <m>`\n*   `cleo llm profile <role> openai --model <m>`\n*\n* @task T11773\n*/\nvar openaiProfile = {\n\tname: \"openai\",\n\tdisplayName: \"OpenAI Codex (ChatGPT)\",\n\tauthTypes: [\"api_key\", \"oauth\"],\n\tbaseUrl: \"https://api.openai.com/v1\",\n\tdefaultModel: \"gpt-5.5\",\n\taliases: [\n\t\t\"codex\",\n\t\t\"chatgpt\",\n\t\t\"openai-codex\"\n\t],\n\ttier: \"frontier\",\n\tdefaultAuxModel: \"gpt-5-mini\",\n\tdefaultMaxTokens: 4096,\n\toauth: {\n\t\tmode: \"pkce\",\n\t\tclientId: resolveOpenaiClientId(),\n\t\tauthorizationEndpoint: \"https://auth.openai.com/oauth/authorize\",\n\t\ttokenEndpoint: \"https://auth.openai.com/oauth/token\",\n\t\tscope: \"openid profile email offline_access\",\n\t\tredirectUri: \"http://localhost:1455/auth/callback\",\n\t\textraAuthParams: {\n\t\t\tid_token_add_organizations: \"true\",\n\t\t\tcodex_cli_simplified_flow: \"true\",\n\t\t\toriginator: \"codex_cli_rs\"\n\t\t}\n\t}\n};\n//#endregion\n//#region ../core/dist/llm/provider-registry/builtin/openrouter.js\n/**\n* Builtin provider profile for OpenRouter.\n*\n* OpenRouter is a unified API gateway for 100+ LLM providers, accessible at\n* `https://openrouter.ai/api/v1`. It speaks the OpenAI chat completions wire\n* format. The CLEO-specific quirk is the Pareto router plugin block, which\n* selects the price-optimal provider for high-capability model requests.\n*\n* @task T9286 (W1d)\n* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3)\n*/\n/**\n* OpenRouter provider profile.\n*\n* Encodes the Pareto plugin routing block as a `buildExtraBody` hook.\n* The plugin is only injected for high-capability model tiers\n* (Sonnet, Opus, Grok, GPT-4) — cheaper models route without it.\n*\n* @task T9286 (W1d)\n*/\nvar openrouterProfile = {\n\tname: \"openrouter\",\n\tdisplayName: \"OpenRouter\",\n\tauthTypes: [\"api_key\"],\n\tbaseUrl: \"https://openrouter.ai/api/v1\",\n\tdefaultModel: \"openrouter/anthropic/claude-sonnet-4-6\",\n\taliases: [\"open-router\"],\n\tenvVars: [\"OPENROUTER_API_KEY\"],\n\tdefaultHeaders: {\n\t\t\"HTTP-Referer\": \"https://cleocode.dev\",\n\t\t\"X-Title\": \"CLEO\"\n\t},\n\tbuildExtraBody(model) {\n\t\tif (model.startsWith(\"openrouter/\") && /sonnet|opus|grok|gpt-4/i.test(model)) return { plugins: [{\n\t\t\tid: \"pareto\",\n\t\t\tmin_coding_score: .85\n\t\t}] };\n\t\treturn {};\n\t}\n};\n//#endregion\n//#region ../core/dist/llm/provider-registry/builtin/xai.js\n/**\n* Builtin provider profiles for xAI (Grok models).\n*\n* xAI exposes an OpenAI-compatible API at `https://api.x.ai/v1`. Two\n* profiles are registered — one per ApiMode:\n*\n* - {@link xaiProfile}: `chat_completions` — standard OpenAI-compatible path.\n*   Quirk: `x-grok-conv-id` header for KV-cache affinity.\n* - {@link xaiResponsesProfile}: `codex_responses` — xAI's Responses-compatible\n*   endpoint (grok-* models). Selected automatically when the model id starts\n*   with `grok-` and the caller requests `codex_responses` ApiMode.\n*\n* @task T9286 (W1d)\n* @task T9311 (xAI Responses profile)\n* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3/5)\n*/\n/** Lazily-initialized process-scoped Grok conversation id. */\nvar _grokConvId = null;\n/**\n* Return (and lazily create) the process-scoped Grok conversation id.\n*\n* Pinning a stable `x-grok-conv-id` across requests in the same process\n* gives xAI's KV-cache layer a consistent cache key, reducing TTFT on\n* repeated system-prompt prefix calls within the same agent session.\n*\n* The id is intentionally not persisted — it resets each process restart so\n* stale cache entries do not accumulate across sessions.\n*\n* @returns Stable `cleo-<timestamp>-<random>` identifier for this process.\n*/\nfunction getGrokConvId() {\n\tif (_grokConvId === null) _grokConvId = `cleo-${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 10)}`;\n\treturn _grokConvId;\n}\n/**\n* xAI Grok provider profile — `chat_completions` ApiMode.\n*\n* Encodes the Grok conversation-id header as a `buildApiKwargsExtras` hook.\n*\n* @task T9286 (W1d)\n*/\nvar xaiProfile = {\n\tname: \"xai\",\n\tdisplayName: \"xAI Grok\",\n\tauthTypes: [\"api_key\"],\n\tbaseUrl: \"https://api.x.ai/v1\",\n\tdefaultModel: \"grok-3\",\n\taliases: [\"grok\", \"x-ai\"],\n\tenvVars: [\"XAI_API_KEY\"],\n\tbuildApiKwargsExtras() {\n\t\treturn { extra_headers: { \"x-grok-conv-id\": getGrokConvId() } };\n\t}\n};\n/**\n* xAI Grok provider profile — `codex_responses` ApiMode.\n*\n* xAI exposes Responses-compatible endpoints for grok-* models. Select this\n* profile when the caller requests `codex_responses` ApiMode or when the\n* model id starts with `grok-` and the Responses API is preferred.\n*\n* Callers should construct a {@link CodexResponsesTransport} (from\n* `packages/core/src/llm/transports/codex-responses.ts`) with this profile's\n* `baseUrl` and any `x-grok-conv-id` header from `buildApiKwargsExtras`.\n*\n* @task T9311\n*/\nvar xaiResponsesProfile = {\n\tname: \"xai\",\n\tdisplayName: \"xAI Grok (Responses)\",\n\tauthTypes: [\"api_key\"],\n\tbaseUrl: \"https://api.x.ai/v1\",\n\tdefaultModel: \"grok-3\",\n\taliases: [\"grok-responses\", \"x-ai-responses\"],\n\tenvVars: [\"XAI_API_KEY\"],\n\tbuildApiKwargsExtras() {\n\t\treturn { extra_headers: { \"x-grok-conv-id\": getGrokConvId() } };\n\t}\n};\n//#endregion\n//#region ../core/dist/llm/provider-registry/loader.js\n/**\n* Plugin discovery and dynamic import for the CLEO provider registry.\n*\n* Scans `${CLEO_HOME}/plugins/model-providers/` for `*.{ts,mjs,js,cjs}` files,\n* imports each one via `pathToFileURL(absPath).href`, and calls the module's\n* `register` export (named or default) with the plugin API surface.\n*\n* - Non-existent plugin directory → silently no-ops (not an error).\n* - Import errors → logged via `process.stderr` and skipped (never throws).\n* - Idempotent: the discovery promise is module-level singleton; repeated\n*   calls await the same promise.\n*\n* @task T9262\n* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3)\n*/\n/** Extensions tried for user plugin files, in priority order. */\nvar PLUGIN_EXTENSIONS = [\n\t\".mjs\",\n\t\".js\",\n\t\".cjs\",\n\t\".ts\"\n];\n/**\n* Returns `true` when `filename` ends with a recognised plugin extension.\n*/\nfunction isPluginFile(filename) {\n\treturn PLUGIN_EXTENSIONS.some((ext) => filename.endsWith(ext));\n}\n/**\n* Return the user plugin directory path — `${CLEO_HOME}/plugins/model-providers`.\n*\n* Does NOT check whether the directory exists; callers must handle that.\n*/\nfunction getPluginDir() {\n\treturn join(getCleoHome(), \"plugins\", \"model-providers\");\n}\n/**\n* Dynamically import one plugin file and invoke its `register` hook.\n*\n* Tolerates import errors: logs to `process.stderr` and returns without\n* throwing so other plugins in the directory still load.\n*\n* @param absPath - Absolute path to the plugin file.\n* @param api     - The plugin API surface passed to the `register` hook.\n*/\nasync function loadOnePlugin(absPath, api) {\n\tlet mod;\n\ttry {\n\t\tmod = await import(pathToFileURL(absPath).href);\n\t} catch (err) {\n\t\tprocess.stderr.write(`[cleo/provider-registry] Failed to import plugin ${absPath}: ${String(err)}\\n`);\n\t\treturn;\n\t}\n\tlet registerFn;\n\tif (typeof mod.register === \"function\") registerFn = mod.register;\n\telse if (mod.default !== void 0) {\n\t\tif (typeof mod.default === \"function\") registerFn = mod.default;\n\t\telse if (typeof mod.default.register === \"function\") registerFn = mod.default.register;\n\t}\n\tif (registerFn === void 0) {\n\t\tprocess.stderr.write(`[cleo/provider-registry] Plugin ${absPath} has no exported 'register' function — skipping.\\n`);\n\t\treturn;\n\t}\n\ttry {\n\t\tregisterFn(api);\n\t} catch (err) {\n\t\tprocess.stderr.write(`[cleo/provider-registry] Plugin ${absPath} threw during register(): ${String(err)}\\n`);\n\t}\n}\n/**\n* Scan `pluginDir` for files matching {@link PLUGIN_EXTENSIONS}, sorted\n* lexicographically for deterministic load order, and load each one.\n*\n* Non-existent directories are silently ignored (returns without error).\n*\n* @param pluginDir - Absolute path to the plugins directory.\n* @param api       - Plugin API surface passed to each plugin.\n*/\nasync function scanAndLoadPlugins(pluginDir, api) {\n\tlet entries;\n\ttry {\n\t\tentries = readdirSync(pluginDir);\n\t} catch {\n\t\treturn;\n\t}\n\tconst pluginFiles = entries.filter((name) => !name.startsWith(\".\") && isPluginFile(name)).filter((name) => {\n\t\ttry {\n\t\t\treturn statSync(join(pluginDir, name)).isFile();\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}).sort();\n\tfor (const filename of pluginFiles) await loadOnePlugin(join(pluginDir, filename), api);\n}\n/**\n* Build the {@link ProviderPluginApi} surface backed by the given\n* `registerProvider` function and run full plugin discovery.\n*\n* This is the entry-point called by the registry's `ensureDiscovered()`\n* singleton. It:\n*   1. Registers all builtin profiles via the provided `builtins` array.\n*   2. Scans `${CLEO_HOME}/plugins/model-providers/` for user plugins.\n*\n* @param registerProvider - The registry's registration function.\n* @param builtins         - Builtin profiles to pre-register before plugins.\n*/\nasync function runDiscovery(registerProvider, builtins) {\n\tconst api = { registerProvider };\n\tfor (const profile of builtins) registerProvider(profile);\n\tawait scanAndLoadPlugins(getPluginDir(), api);\n}\n//#endregion\n//#region ../core/dist/llm/provider-registry/index.js\n/**\n* CLEO Provider Registry — public API.\n*\n* A lightweight, in-process registry mapping canonical provider names (and\n* their aliases) to {@link ProviderProfile} descriptors. Ported idiomatically\n* from the Hermes provider registry (`providers/__init__.py`).\n*\n* ## Semantics\n* - Last-writer-wins on `name` collision — user plugins override builtins.\n* - Alias conflicts with another profile's **primary** name throw at\n*   registration time to prevent silent mis-routing.\n* - Discovery is lazy and idempotent: the first call to `getProviderProfile`\n*   or `listProviders` triggers a one-shot discovery pass that:\n*     1. Registers all builtin profiles.\n*     2. Scans `${CLEO_HOME}/plugins/model-providers/` for user plugins.\n*   Subsequent calls reuse the same discovery promise.\n*\n* @task T9262\n* @epic T9261 (T-LLM-CRED-CENTRALIZATION Phase 3)\n*\n* @example\n* ```ts\n* import { getProviderProfile, listProviders } from '@cleocode/core/llm/provider-registry';\n*\n* const profile = await getProviderProfile('anthropic');\n* // → { name: 'anthropic', displayName: 'Anthropic Claude', … }\n*\n* const all = await listProviders();\n* // → [{ name: 'anthropic', … }]\n* ```\n*/\n/** Primary registry: canonical lower-cased name → profile. */\nvar _registry = /* @__PURE__ */ new Map();\n/**\n* Alias map: lower-cased alias → canonical lower-cased name.\n*\n* Aliases MUST NOT shadow primary names of *other* profiles.\n*/\nvar _aliases = /* @__PURE__ */ new Map();\n/** Discovery singleton — `null` means discovery hasn't started yet. */\nvar _discoveryPromise = null;\n/**\n* All builtin provider profiles registered before user plugins are loaded.\n* Add new builtins here — the registry loads them in array order.\n*/\nvar BUILTIN_PROFILES = [\n\tanthropicProfile,\n\tbedrockProfile,\n\tgeminiProfile,\n\tkimiCodeProfile,\n\tmoonshotProfile,\n\tollamaProfile,\n\topenaiProfile,\n\topenrouterProfile,\n\txaiProfile,\n\txaiResponsesProfile\n];\n/**\n* Register a provider profile.\n*\n* - Keys the profile by `profile.name.toLowerCase()` in the primary registry.\n* - Indexes each alias in {@link _aliases}. An alias that conflicts with the\n*   primary name of a *different* already-registered profile throws a\n*   `TypeError` to prevent silent mis-routing.\n* - Last-writer-wins on primary name collisions (user plugins override\n*   builtins).\n*\n* @param profile - The provider profile to register.\n* @throws {TypeError} When an alias conflicts with another profile's primary name.\n*/\nfunction registerProvider(profile) {\n\tconst key = profile.name.toLowerCase();\n\t_registry.set(key, profile);\n\tfor (const alias of profile.aliases ?? []) {\n\t\tconst aliasKey = alias.toLowerCase();\n\t\tconst existing = _aliases.get(aliasKey);\n\t\tif (existing !== void 0 && existing !== key) {\n\t\t\tif (_registry.has(aliasKey) && aliasKey !== key) throw new TypeError(`[provider-registry] Alias \"${alias}\" for provider \"${profile.name}\" conflicts with the primary name of provider \"${_registry.get(aliasKey)?.name ?? aliasKey}\".`);\n\t\t}\n\t\t_aliases.set(aliasKey, key);\n\t}\n}\n/**\n* Ensure the one-shot discovery pass has run.\n*\n* Calling this multiple times is safe — it returns the same promise every time.\n* The discovery pass:\n*   1. Registers all {@link BUILTIN_PROFILES}.\n*   2. Scans `${CLEO_HOME}/plugins/model-providers/` for user plugins.\n*/\nasync function ensureDiscovered() {\n\tif (_discoveryPromise === null) _discoveryPromise = runDiscovery(registerProvider, BUILTIN_PROFILES);\n\treturn _discoveryPromise;\n}\n/**\n* Look up a provider profile by name or alias (case-insensitive).\n*\n* Triggers discovery on the first call. Returns `undefined` when no profile\n* matches — callers MUST handle this case (generic/fallback behaviour).\n*\n* @param name - Provider name or alias to look up.\n* @returns The matching {@link ProviderProfile}, or `undefined`.\n*/\nasync function getProviderProfile(name) {\n\tawait ensureDiscovered();\n\tconst key = name.toLowerCase();\n\tconst canonical = _aliases.get(key) ?? key;\n\treturn _registry.get(canonical);\n}\n//#endregion\nexport { getProviderProfile as n, registerProvider as r, ensureDiscovered as t };\n","import { i as getCleoHome } from \"./dist.js\";\nimport { i as writeJsonFileAtomic, n as withFileLock, t as readJsonFile } from \"./file-utils.js\";\nimport { existsSync, mkdirSync } from \"node:fs\";\nimport { join } from \"node:path\";\n//#region ../core/dist/llm/rate-limit-guard.js\n/**\n* Cross-session rate-limit guard for the CLEO LLM credential layer.\n*\n* Writes rate-limit state to a shared file so ALL CLEO processes\n* (sentient daemon, CLI calls, auxiliary router) see the same cooldown —\n* preventing pile-on retries from independent sessions.\n*\n* Port of Hermes' `agent/nous_rate_guard.py` (generalized for any provider).\n* Each 429 from a provider can trigger multiple SDK retries multiplied by\n* multiple Hermes retries.  By recording state on the first 429 and checking\n* before subsequent attempts, we eliminate retry amplification across sessions.\n*\n* State is keyed on `(provider, label)` and stored at:\n*   `${getCleoHome()}/rate-limit-state/<provider>-<label>.json`\n*\n* @module llm/rate-limit-guard\n* @task T9273\n* @epic T-LLM-CRED-CENTRALIZATION Phase 3\n*/\n/**\n* Sanitize a provider or label string for use in a filename.\n*\n* Replaces any character outside `[a-zA-Z0-9_-]` with `_` to prevent\n* path traversal (e.g. `../../evil` → `_____evil`).\n*\n* @param value - Raw provider or label string.\n* @returns Filesystem-safe string.\n*\n* @task T9273\n*/\nfunction sanitize(value) {\n\treturn value.replace(/[^a-zA-Z0-9_-]/g, \"_\");\n}\n/**\n* Absolute path to the rate-limit state file for a given `(provider, label)`.\n*\n* Exposed for unit tests.\n*\n* @param provider - LLM provider identifier (e.g. `'anthropic'`).\n* @param label    - Credential label (e.g. `'personal'`).\n* @returns Absolute path to the JSON state file.\n*\n* @task T9273\n*/\nfunction rateLimitStatePath(provider, label) {\n\treturn join(join(getCleoHome(), \"rate-limit-state\"), `${sanitize(provider)}-${sanitize(label)}.json`);\n}\n/**\n* Extract the best available reset-time estimate (epoch ms) from HTTP\n* response headers.\n*\n* Priority:\n*   1. `retry-after`              — delta seconds OR HTTP-date\n*   2. `x-ratelimit-reset-requests` — epoch seconds (OpenAI-style)\n*   3. `x-ratelimit-reset`          — epoch seconds OR ISO 8601 date\n*\n* Returns `null` when no usable header is found or all parsed values are\n* in the past (caller falls back to `defaultCooldownSeconds`).\n*\n* @param headers - HTTP response headers from the 429 error.\n* @returns Epoch milliseconds for the reset time, or `null`.\n*\n* @internal\n* @task T9273\n*/\nfunction parseResetFromHeaders(headers) {\n\tconst get = (k) => {\n\t\tif (headers instanceof Headers) return headers.get(k);\n\t\treturn headers[k] ?? null;\n\t};\n\tconst retryAfter = get(\"retry-after\");\n\tif (retryAfter) {\n\t\tconst seconds = Number(retryAfter);\n\t\tif (Number.isFinite(seconds) && seconds > 0) return Date.now() + seconds * 1e3;\n\t\tconst date = Date.parse(retryAfter);\n\t\tif (Number.isFinite(date) && date > Date.now()) return date;\n\t}\n\tconst xResetReq = get(\"x-ratelimit-reset-requests\");\n\tif (xResetReq) {\n\t\tconst epoch = Number(xResetReq);\n\t\tif (Number.isFinite(epoch) && epoch > Date.now() / 1e3) return epoch * 1e3;\n\t}\n\tconst xReset = get(\"x-ratelimit-reset\");\n\tif (xReset) {\n\t\tconst epoch = Number(xReset);\n\t\tif (Number.isFinite(epoch) && epoch > Date.now() / 1e3) return epoch * 1e3;\n\t\tconst isoDate = Date.parse(xReset);\n\t\tif (Number.isFinite(isoDate) && isoDate > Date.now()) return isoDate;\n\t}\n\treturn null;\n}\n/**\n* Record that a provider+label combination is currently rate-limited.\n*\n* Parses the reset time from HTTP response headers when available, then\n* falls back to `defaultCooldownSeconds` (default 300 s).  Writes state to\n* `${getCleoHome()}/rate-limit-state/<provider>-<label>.json` so that ALL\n* CLEO processes (sentient daemon, CLI calls, auxiliary router) see the same\n* cooldown — preventing pile-on retries from independent sessions.\n*\n* Port of Hermes' `agent/nous_rate_guard.py:record_nous_rate_limit`\n* (generalized for any provider).\n*\n* @param provider - LLM provider identifier (e.g. `'anthropic'`).\n* @param label    - Credential label (e.g. `'personal'`).\n* @param opts     - Optional header map and fallback cooldown seconds.\n*\n* @task T9273\n*/\nasync function recordRateLimit(provider, label, opts) {\n\tconst now = Date.now();\n\tconst defaultMs = (opts?.defaultCooldownSeconds ?? 300) * 1e3;\n\tlet resetAt;\n\tlet source;\n\tif (opts?.headers) {\n\t\tconst headerReset = parseResetFromHeaders(opts.headers);\n\t\tif (headerReset !== null && headerReset > now) {\n\t\t\tresetAt = headerReset;\n\t\t\tsource = \"header\";\n\t\t} else {\n\t\t\tresetAt = now + defaultMs;\n\t\t\tsource = \"default\";\n\t\t}\n\t} else {\n\t\tresetAt = now + defaultMs;\n\t\tsource = \"default\";\n\t}\n\tconst filePath = rateLimitStatePath(provider, label);\n\tconst dir = join(getCleoHome(), \"rate-limit-state\");\n\tif (!existsSync(dir)) mkdirSync(dir, { recursive: true });\n\tconst state = {\n\t\tresetAt,\n\t\trecordedAt: now,\n\t\tsource\n\t};\n\tawait withFileLock(filePath, () => {\n\t\twriteJsonFileAtomic(filePath, state);\n\t});\n}\n/**\n* Return remaining seconds until the rate-limit clears, or `null` if not active.\n*\n* Stale state files (reset_at in the past) are treated as cleared —\n* the file is NOT deleted here to avoid a lock-delete race; `pick()` callers\n* may clean up with `clearRateLimit` after a successful request.\n*\n* Port of Hermes' `agent/nous_rate_guard.py:nous_rate_limit_remaining`.\n*\n* @param provider - LLM provider identifier (e.g. `'anthropic'`).\n* @param label    - Credential label (e.g. `'personal'`).\n* @returns Seconds remaining (positive float) or `null` if guard is inactive.\n*\n* @task T9273\n*/\nasync function rateLimitRemaining(provider, label) {\n\tconst state = readJsonFile(rateLimitStatePath(provider, label));\n\tif (!state) return null;\n\tconst remaining = (state.resetAt - Date.now()) / 1e3;\n\tif (remaining > 0) return remaining;\n\treturn null;\n}\n//#endregion\nexport { recordRateLimit as n, rateLimitRemaining as t };\n","import { a as getCleoPlatformPaths, i as getCleoHome } from \"./dist.js\";\nimport { t as getLogger } from \"./logger.js\";\nimport { mi as parseClaudeCodeCredentials } from \"./dist2.js\";\nimport { o as getCleoHome$1 } from \"./paths.js\";\nimport { i as writeJsonFileAtomic, r as withLock, t as readJsonFile } from \"./file-utils.js\";\nimport { r as getConfigValue } from \"./config.js\";\nimport { n as getProviderProfile } from \"./provider-registry.js\";\nimport { t as rateLimitRemaining } from \"./rate-limit-guard.js\";\nimport { chmodSync, existsSync, mkdirSync, readFileSync, renameSync, statSync, unlinkSync, writeFileSync } from \"node:fs\";\nimport { dirname, join } from \"node:path\";\nimport { execFileSync } from \"node:child_process\";\nimport { homedir } from \"node:os\";\n//#region ../core/dist/llm/credential-removal.js\n/**\n* RemovalStep registry + per-source removal handlers for the unified\n* credential pool (E-CONFIG-AUTH-UNIFY E2a / T9415).\n*\n* Mirrors Hermes Agent's `agent/credential_sources.py` `RemovalStep`\n* pattern: every credential source (env var, `~/.claude/.credentials.json`,\n* `cleo llm login` PKCE token, third-party CLIs) registers a removal step\n* that `cleo auth remove <provider> <label>` invokes to (a) clean up\n* filesystem state owned by CLEO, (b) surface manual hints for state CLEO\n* does NOT own, and (c) record a suppression entry so the next pool load\n* does not re-seed the just-removed credential.\n*\n* ## Scope of this task\n*\n* T9415 is **removal-infrastructure only**. The `cleo auth remove` CLI\n* lands in T9416; this module exposes the registry + per-source handlers\n* + suppression-state persistence, all consumable by the future CLI.\n*\n* ## Suppression state\n*\n* Suppression is persisted to `${getCleoHome()}/auth-suppression.json`:\n*\n* ```json\n* {\n*   \"version\": 1,\n*   \"entries\": [\n*     { \"provider\": \"anthropic\", \"sourceId\": \"claude-code\", \"suppressedAt\": 1731000000000 }\n*   ]\n* }\n* ```\n*\n* Writes go through {@link writeJsonFileAtomic} (temp-file + rename) so\n* mid-update crashes never corrupt the file. The mutation flow is\n* read-full-state → mutate-in-memory → atomic-write so concurrent CLI\n* invocations cannot interleave partial writes.\n*\n* @module llm/credential-removal\n* @task T9415\n* @epic E-CONFIG-AUTH-UNIFY (E2a)\n*/\n/**\n* In-process registry mapping {@link SeederSourceId} → {@link RemovalStep}.\n*\n* Uniqueness rule: each `sourceId` MUST appear at most once. A duplicate\n* `register()` call throws synchronously — silent overwrites would let two\n* steps fight over the same source, which is a programmer error in test or\n* extension code.\n*\n* Tests construct a fresh `RemovalRegistry()` for isolation; production\n* code uses the {@link REMOVAL_REGISTRY} singleton populated at module load\n* (see bottom of this file).\n*\n* @task T9415\n*/\nvar RemovalRegistry = class {\n\tsteps = /* @__PURE__ */ new Map();\n\t/**\n\t* Register a removal step.\n\t*\n\t* @param step - Removal step instance to add.\n\t* @throws {Error} `E_REMOVAL_DUPLICATE` when `step.sourceId` is already\n\t*   registered.\n\t*/\n\tregister(step) {\n\t\tif (this.steps.has(step.sourceId)) throw new Error(`E_REMOVAL_DUPLICATE: a removal step is already registered for sourceId='${step.sourceId}'`);\n\t\tthis.steps.set(step.sourceId, step);\n\t}\n\t/**\n\t* Look up the step for a source id.\n\t*\n\t* @param sourceId - Source id to dispatch on.\n\t* @returns The registered step, or `undefined` if none is registered.\n\t*/\n\tfind(sourceId) {\n\t\treturn this.steps.get(sourceId);\n\t}\n\t/**\n\t* Return every registered step (insertion order).\n\t*\n\t* Used by `cleo auth remove --all` and diagnostic listing.\n\t*/\n\tgetAll() {\n\t\treturn Array.from(this.steps.values());\n\t}\n};\n/**\n* Filename for the persisted suppression list under `getCleoHome()`.\n*\n* @internal\n*/\nvar SUPPRESSION_FILENAME = \"auth-suppression.json\";\n/**\n* Absolute path to the suppression-state file.\n*\n* Resolved at call time (NOT cached at module load) so test harnesses can\n* override `CLEO_HOME` between runs and see the change reflected.\n*\n* @returns `${getCleoHome()}/auth-suppression.json`.\n*\n* @task T9415\n*/\nfunction suppressionStatePath() {\n\treturn join(getCleoHome(), SUPPRESSION_FILENAME);\n}\n/**\n* Read the suppression file, returning a fresh empty document when the\n* file does not yet exist.\n*\n* @returns Parsed suppression document.\n*\n* @task T9415\n*/\nfunction readSuppressionFile() {\n\tconst data = readJsonFile(suppressionStatePath());\n\tif (data && data.version === 1 && Array.isArray(data.entries)) return data;\n\treturn {\n\t\tversion: 1,\n\t\tentries: []\n\t};\n}\n/**\n* Atomically persist the suppression file to disk.\n*\n* Goes through {@link writeJsonFileAtomic} (temp + rename); the parent\n* directory (`getCleoHome()`) is created upstream by `@cleocode/paths` so\n* we do not need to `mkdir` here. The atomic helper itself creates the\n* temp file inside the target's parent directory, so a missing parent\n* surfaces as the original error rather than corrupting state.\n*\n* @param next - New file contents.\n*\n* @task T9415\n*/\nfunction writeSuppressionFile(next) {\n\twriteJsonFileAtomic(suppressionStatePath(), next);\n}\n/**\n* Add `(provider, sourceId)` to the suppression list.\n*\n* Idempotent — a `(provider, sourceId)` pair already present is left\n* untouched (its original `suppressedAt` is preserved so diagnostics can\n* surface the first removal). Reads full state, mutates in-memory, writes\n* atomically — concurrent CLI invocations cannot interleave partial\n* writes.\n*\n* @param provider - Provider id whose seeder should be suppressed.\n* @param sourceId - Source id of the seeder to suppress.\n*\n* @task T9415\n*/\nfunction addSuppression(provider, sourceId) {\n\tconst current = readSuppressionFile();\n\tif (current.entries.some((e) => e.provider === provider && e.sourceId === sourceId)) return;\n\twriteSuppressionFile({\n\t\tversion: 1,\n\t\tentries: [...current.entries, {\n\t\t\tprovider,\n\t\t\tsourceId,\n\t\t\tsuppressedAt: Date.now()\n\t\t}]\n\t});\n}\n/**\n* Test whether a `(provider, sourceId)` pair is currently suppressed.\n*\n* @param provider - Provider id.\n* @param sourceId - Source id.\n* @returns `true` if suppression is active.\n*\n* @task T9415\n*/\nfunction isSuppressed(provider, sourceId) {\n\treturn readSuppressionFile().entries.some((e) => e.provider === provider && e.sourceId === sourceId);\n}\n/**\n* `'manual'` — entry the operator added with `cleo llm add`.\n*\n* The actual `llm-credentials.json` mutation is performed by the future\n* `cleo auth remove` CLI (T9416) which calls the credential store\n* directly; this step does NOT touch filesystem state itself. Suppression\n* is `false` because `'manual'` has no seeder pass to skip.\n*\n* @task T9415\n*/\nvar MANUAL_REMOVAL_STEP = {\n\tsourceId: \"manual\",\n\tdescription: \"Operator-added entry; removed directly from llm-credentials.json\",\n\tasync remove() {\n\t\treturn {\n\t\t\tcleaned: [],\n\t\t\thints: [\"entry removed from llm-credentials.json\"],\n\t\t\tsuppress: false\n\t\t};\n\t}\n};\n/**\n* `'env'` — environment-variable seed.\n*\n* CLEO cannot unset another shell's exported variable, so cleanup is empty\n* and the hint instructs the operator. Suppression is `true` so the next\n* seed pass skips the env source even if the variable is still set\n* (otherwise the just-removed credential would silently re-appear).\n*\n* @task T9415\n*/\nvar ENV_REMOVAL_STEP = {\n\tsourceId: \"env\",\n\tdescription: \"Environment variable; cannot be unset by CLEO\",\n\tasync remove() {\n\t\treturn {\n\t\t\tcleaned: [],\n\t\t\thints: [\"Unset $VARNAME in your shell to prevent re-seeding\"],\n\t\t\tsuppress: true\n\t\t};\n\t}\n};\n/**\n* `'claude-code'` — `~/.claude/.credentials.json` consented import.\n*\n* Hard rule: CLEO MUST NOT delete `~/.claude/.credentials.json` — Claude\n* Code itself depends on the file. The correct cleanup is suppression of\n* the seeder so the next pool load does not re-import the credential.\n*\n* @task T9415\n*/\nvar CLAUDE_CODE_REMOVAL_STEP = {\n\tsourceId: \"claude-code\",\n\tdescription: \"Suppress claude-code re-seed; leave ~/.claude/.credentials.json untouched\",\n\tasync remove() {\n\t\treturn {\n\t\t\tcleaned: [],\n\t\t\thints: [\"Do NOT delete ~/.claude/.credentials.json — Claude Code uses it. Re-seeding is suppressed instead.\"],\n\t\t\tsuppress: true\n\t\t};\n\t}\n};\n/**\n* `'cleo-pkce'` — credential issued by `cleo llm login` (PKCE flow).\n*\n* Owned end-to-end by CLEO: the token cache file at\n* `${getCleoHome()}/anthropic-oauth.json` is deleted unconditionally\n* (ENOENT is silently ignored — idempotency requirement). Suppression is\n* `true` so a residual seeder pass does not re-seed a deleted token.\n*\n* @task T9415\n*/\nvar CLEO_PKCE_REMOVAL_STEP = {\n\tsourceId: \"cleo-pkce\",\n\tdescription: \"Delete CLEO-issued PKCE token at <CLEO_HOME>/anthropic-oauth.json\",\n\tasync remove() {\n\t\tconst path = join(getCleoHome(), \"anthropic-oauth.json\");\n\t\tconst cleaned = [];\n\t\ttry {\n\t\t\tunlinkSync(path);\n\t\t\tcleaned.push(path);\n\t\t} catch (err) {\n\t\t\tif (err.code !== \"ENOENT\") throw err;\n\t\t}\n\t\treturn {\n\t\t\tcleaned,\n\t\t\thints: [],\n\t\t\tsuppress: true\n\t\t};\n\t}\n};\n/**\n* `'codex-cli'` — OpenAI Codex CLI session token.\n*\n* CLEO does not own the Codex CLI's on-disk state. The hint points the\n* operator at the Codex tooling; suppression is `true`.\n*\n* @task T9415\n*/\nvar CODEX_CLI_REMOVAL_STEP = {\n\tsourceId: \"codex-cli\",\n\tdescription: \"Suppress codex-cli re-seed; revoke via the Codex CLI itself\",\n\tasync remove() {\n\t\treturn {\n\t\t\tcleaned: [],\n\t\t\thints: [\"Run `codex logout` (or remove ~/.codex/auth.json) in the Codex CLI to revoke the underlying token.\"],\n\t\t\tsuppress: true\n\t\t};\n\t}\n};\n/**\n* `'gemini-cli'` — Google Gemini CLI application default credentials.\n*\n* Same pattern as `'codex-cli'`: CLEO does not own the Gemini CLI's state.\n*\n* @task T9415\n*/\nvar GEMINI_CLI_REMOVAL_STEP = {\n\tsourceId: \"gemini-cli\",\n\tdescription: \"Suppress gemini-cli re-seed; revoke via the Gemini CLI itself\",\n\tasync remove() {\n\t\treturn {\n\t\t\tcleaned: [],\n\t\t\thints: [\"Run `gcloud auth application-default revoke` (or `gemini auth logout`) to revoke the underlying token.\"],\n\t\t\tsuppress: true\n\t\t};\n\t}\n};\n/**\n* `'gh-cli'` — GitHub CLI token (for the `github-models` provider).\n*\n* Same pattern: CLEO does not own `gh`'s keyring.\n*\n* @task T9415\n*/\nvar GH_CLI_REMOVAL_STEP = {\n\tsourceId: \"gh-cli\",\n\tdescription: \"Suppress gh-cli re-seed; revoke via `gh auth logout`\",\n\tasync remove() {\n\t\treturn {\n\t\t\tcleaned: [],\n\t\t\thints: [\"Run `gh auth logout` to revoke the underlying GitHub token.\"],\n\t\t\tsuppress: true\n\t\t};\n\t}\n};\n/**\n* Build a fresh registry pre-populated with every built-in step.\n*\n* Exposed so tests can construct an isolated registry mirroring production\n* state without mutating the {@link REMOVAL_REGISTRY} singleton.\n*\n* @returns A fully populated `RemovalRegistry`.\n*\n* @task T9415\n*/\nfunction buildBuiltinRemovalRegistry() {\n\tconst registry = new RemovalRegistry();\n\tregistry.register(MANUAL_REMOVAL_STEP);\n\tregistry.register(ENV_REMOVAL_STEP);\n\tregistry.register(CLAUDE_CODE_REMOVAL_STEP);\n\tregistry.register(CLEO_PKCE_REMOVAL_STEP);\n\tregistry.register(CODEX_CLI_REMOVAL_STEP);\n\tregistry.register(GEMINI_CLI_REMOVAL_STEP);\n\tregistry.register(GH_CLI_REMOVAL_STEP);\n\treturn registry;\n}\n/**\n* Process-wide singleton used by the future `cleo auth remove` CLI.\n*\n* Populated at module load with every built-in step. Tests requiring\n* isolation MUST construct a fresh registry via\n* {@link buildBuiltinRemovalRegistry} (or `new RemovalRegistry()`) instead\n* of mutating this instance.\n*\n* @task T9415\n*/\nvar REMOVAL_REGISTRY = buildBuiltinRemovalRegistry();\n//#endregion\n//#region ../core/dist/llm/credential-seeders/claude-code-seeder.js\n/**\n* `claude-code` credential seeder — imports the Claude Code OAuth token\n* (`~/.claude/.credentials.json`) into the unified credential pool as an\n* `anthropic` entry.\n*\n* E-CONFIG-AUTH-UNIFY E2a §5.2 T-E2-3. Architectural mirror of Hermes\n* Agent's `_seed_from_singletons` dispatch (`agent/credential_pool.py`).\n*\n* ## Consent gate\n*\n* Reading the Claude Code credential file requires the operator to have\n* explicitly opted in via `auth.claudeCodeConsentGiven = true` in the\n* global config. This mirrors Hermes Agent's PR #4210 fix: without the\n* gate, auxiliary fallback chains could silently route requests through\n* a user's Claude Code OAuth token without consent. The default value is\n* `false`, so the seeder is a no-op on fresh installs.\n*\n* The gate is checked BEFORE any filesystem access: an unconsented seeder\n* never calls `readFileSync` on the credentials path. `isConsentEstablished`\n* reads the global config through `getConfigValue('auth.claudeCodeConsentGiven')`\n* so CLI/env overrides on the consent flag are respected uniformly.\n*\n* ## What the seeder emits\n*\n* One `SeederCredentialEntry` per call (or zero) with:\n*\n* - `provider: 'anthropic'`\n* - `label: 'claude-code'`\n* - `authType: 'oauth'`\n* - `source: 'claude-code'`\n* - `accessToken`, `refreshToken`, `expiresAt` extracted from\n*   `claudeAiOauth` via {@link parseClaudeCodeCredentials}.\n*\n* Zero-result paths (consent off, file missing, file unreadable, JSON\n* malformed, token expired) all return `{ entries: [] }` without\n* throwing. Parsing is delegated to `parseClaudeCodeCredentials` in\n* `@cleocode/contracts` so the JSON shape lives in exactly one place.\n*\n* @module llm/credential-seeders/claude-code-seeder\n* @task T9410\n* @epic E-CONFIG-AUTH-UNIFY (E2a)\n*/\n/** Stable label written into the pool entry's `label` field. */\nvar SEEDER_LABEL$1 = \"claude-code\";\n/** `(sourceId, provider)` pair this seeder owns inside the registry. */\nvar SOURCE_ID$1 = \"claude-code\";\nvar PROVIDER$1 = \"anthropic\";\n/** Config key consulted by {@link isConsentEstablished}. */\nvar CONSENT_CONFIG_KEY = \"auth.claudeCodeConsentGiven\";\n/**\n* Concrete `CredentialSeeder` for the `claude-code` source.\n*\n* Constructor-injectable filesystem hooks (`readCredentialFile`) keep tests\n* pure — they exercise the consent gate, expiry filter, and missing-file\n* path without touching the real `~/.claude/.credentials.json` and without\n* fs mocks at the module level. The default `readCredentialFile`\n* implementation calls `readFileSync` on `~/.claude/.credentials.json`.\n*\n* @task T9410\n*/\nvar ClaudeCodeSeeder = class {\n\t/** @inheritdoc */\n\tsourceId = SOURCE_ID$1;\n\t/** @inheritdoc */\n\tprovider = PROVIDER$1;\n\treadCredentialFile;\n\treadConsentFlag;\n\t/**\n\t* Construct a seeder.\n\t*\n\t* @param opts - Optional dependency-injection seams. `readCredentialFile`\n\t*   MUST return `null` when the file is missing or unreadable (it MUST\n\t*   NOT throw). `readConsentFlag` returns the resolved consent boolean\n\t*   from the config cascade.\n\t*/\n\tconstructor(opts) {\n\t\tthis.readCredentialFile = opts?.readCredentialFile ?? defaultReadCredentialFile$1;\n\t\tthis.readConsentFlag = opts?.readConsentFlag ?? defaultReadConsentFlag;\n\t}\n\t/**\n\t* Resolve the consent flag from the canonical config cascade.\n\t*\n\t* Returns `true` only when `auth.claudeCodeConsentGiven` is explicitly\n\t* the boolean `true`. Any other value — `undefined`, `null`, `false`,\n\t* or a stray string — yields `false` so the gate fails closed.\n\t*\n\t* @param _provider - Provider id (ignored — this seeder is anthropic-only;\n\t*   the parameter is accepted to satisfy the `CredentialSeeder` contract).\n\t*/\n\tasync isConsentEstablished(_provider) {\n\t\ttry {\n\t\t\treturn await this.readConsentFlag();\n\t\t} catch {\n\t\t\treturn false;\n\t\t}\n\t}\n\t/**\n\t* Read `~/.claude/.credentials.json` and emit a single pool entry.\n\t*\n\t* Short-circuits to `{ entries: [] }` when the consent gate is closed,\n\t* the file is absent, the JSON is malformed, the `claudeAiOauth` block\n\t* is missing, or the token has expired (per `parseClaudeCodeCredentials`).\n\t*/\n\tasync seed() {\n\t\tif (!await this.isConsentEstablished(this.provider)) return { entries: [] };\n\t\tconst raw = this.readCredentialFile();\n\t\tif (raw === null) return { entries: [] };\n\t\tconst parsed = parseClaudeCodeCredentials(raw);\n\t\tif (parsed === null) return { entries: [] };\n\t\treturn { entries: [{\n\t\t\tprovider: \"anthropic\",\n\t\t\tlabel: SEEDER_LABEL$1,\n\t\t\tauthType: \"oauth\",\n\t\t\taccessToken: parsed.accessToken,\n\t\t\tsource: SEEDER_LABEL$1,\n\t\t\t...parsed.expiresAt !== void 0 ? { expiresAt: parsed.expiresAt } : {},\n\t\t\t...parsed.refreshToken !== void 0 ? { refreshToken: parsed.refreshToken } : {}\n\t\t}] };\n\t}\n};\n/**\n* Default `readCredentialFile` implementation.\n*\n* Returns the UTF-8 contents of `~/.claude/.credentials.json`, or `null`\n* when the file is absent or unreadable. NEVER throws — every error path\n* collapses to `null` so the seeder's \"source absent\" contract holds.\n*\n* @internal\n*/\nfunction defaultReadCredentialFile$1() {\n\ttry {\n\t\treturn readFileSync(join(homedir(), \".claude\", \".credentials.json\"), \"utf-8\");\n\t} catch {\n\t\treturn null;\n\t}\n}\n/**\n* Default `readConsentFlag` implementation.\n*\n* Reads the consent boolean from the canonical config cascade (env >\n* project > global > defaults). The default value at the defaults tier\n* is `false`, so a fresh install with no overrides resolves to `false`.\n*\n* @internal\n*/\nasync function defaultReadConsentFlag() {\n\treturn (await getConfigValue(CONSENT_CONFIG_KEY)).value === true;\n}\n/**\n* Factory for the singleton `ClaudeCodeSeeder` registered into\n* `BUILTIN_SEEDERS` from `index.ts`.\n*\n* Kept as a factory (not a module-level `const`) so the registry-side\n* import remains acyclic and tests can construct fresh instances with\n* injected dependencies.\n*\n* @task T9410\n*/\nfunction createClaudeCodeSeeder() {\n\treturn new ClaudeCodeSeeder();\n}\n//#endregion\n//#region ../core/dist/llm/credential-seeders/cleo-pkce-seeder.js\n/**\n* `cleo-pkce` credential seeder — reads CLEO's own PKCE-issued Anthropic\n* OAuth token at `${getCleoHome()}/anthropic-oauth.json` and emits it as a\n* single `anthropic` entry in the unified credential pool.\n*\n* E-CONFIG-AUTH-UNIFY E2a §5.2 T-E2-4. Architectural mirror of Hermes\n* Agent's `_seed_from_cleo_pkce` dispatch.\n*\n* ## File shape\n*\n* The CLEO-owned PKCE file uses Claude Code's `claudeAiOauth` envelope\n* shape so the two CLIs can cooperatively share credentials via the\n* write-back handler (`credential-writeback.ts`):\n*\n* ```json\n* {\n*   \"claudeAiOauth\": {\n*     \"accessToken\": \"sk-ant-oat-...\",\n*     \"refreshToken\": \"sk-ant-ort-...\",\n*     \"expiresAt\": 1700000000000,\n*     \"scopes\": [\"user:inference\"]\n*   }\n* }\n* ```\n*\n* Parsing is delegated to `parseClaudeCodeCredentials()` in\n* `@cleocode/contracts` so the on-disk format lives in exactly one place.\n*\n* ## Consent gate\n*\n* Unlike the `claude-code` seeder, the PKCE seeder reads a CLEO-owned\n* file: the operator implicitly consented by running `cleo llm login`,\n* so no consent flag is consulted. `isConsentEstablished` is therefore\n* omitted (`undefined` is treated as \"always consented\" by the contract).\n*\n* ## Zero-result paths\n*\n* Missing file, malformed JSON, missing `claudeAiOauth` block, and\n* expired token all collapse to `{ entries: [] }` without throwing —\n* the seeder contract MUST NOT signal \"source absent\" via exceptions.\n*\n* @module llm/credential-seeders/cleo-pkce-seeder\n* @task T9411\n* @epic E-CONFIG-AUTH-UNIFY (E2a)\n*/\n/** Stable label written into the pool entry's `label` field. */\nvar SEEDER_LABEL = \"cleo-pkce\";\n/** `(sourceId, provider)` pair this seeder owns inside the registry. */\nvar SOURCE_ID = \"cleo-pkce\";\nvar PROVIDER = \"anthropic\";\n/**\n* Default on-disk path for CLEO's PKCE token cache.\n*\n* Computed at call-time (not module-load) so test runners that swap\n* `CLEO_DATA_DIR` between cases observe the change.\n*/\nfunction defaultCleoPkcePath() {\n\treturn join(getCleoHome$1(), \"anthropic-oauth.json\");\n}\n/**\n* Concrete `CredentialSeeder` for the `cleo-pkce` source.\n*\n* Constructor-injectable filesystem hook (`readCredentialFile`) keeps tests\n* pure — they exercise the expiry, missing-file, and malformed-JSON paths\n* without touching the real CLEO data directory and without module-level\n* fs mocks. The default `readCredentialFile` implementation calls\n* `readFileSync` on `${getCleoHome()}/anthropic-oauth.json`.\n*\n* @task T9411\n*/\nvar CleoPkceSeeder = class {\n\t/** @inheritdoc */\n\tsourceId = SOURCE_ID;\n\t/** @inheritdoc */\n\tprovider = PROVIDER;\n\treadCredentialFile;\n\t/**\n\t* Construct a seeder.\n\t*\n\t* @param opts - Optional dependency-injection seams. `readCredentialFile`\n\t*   MUST return `null` when the file is missing or unreadable (it MUST\n\t*   NOT throw). The default implementation reads\n\t*   `${getCleoHome()}/anthropic-oauth.json` and collapses every error\n\t*   path to `null`.\n\t*/\n\tconstructor(opts) {\n\t\tthis.readCredentialFile = opts?.readCredentialFile ?? defaultReadCredentialFile;\n\t}\n\t/**\n\t* Read the CLEO PKCE OAuth file and emit a single anthropic pool entry.\n\t*\n\t* Short-circuits to `{ entries: [] }` when the file is absent, the JSON\n\t* is malformed, the `claudeAiOauth` block is missing, or the token has\n\t* expired (per `parseClaudeCodeCredentials`). Never throws.\n\t*/\n\tasync seed() {\n\t\tconst raw = this.readCredentialFile();\n\t\tif (raw === null) return { entries: [] };\n\t\tconst parsed = parseClaudeCodeCredentials(raw);\n\t\tif (parsed === null) return { entries: [] };\n\t\treturn { entries: [{\n\t\t\tprovider: \"anthropic\",\n\t\t\tlabel: SEEDER_LABEL,\n\t\t\tauthType: \"oauth\",\n\t\t\taccessToken: parsed.accessToken,\n\t\t\tsource: SEEDER_LABEL,\n\t\t\t...parsed.expiresAt !== void 0 ? { expiresAt: parsed.expiresAt } : {},\n\t\t\t...parsed.refreshToken !== void 0 ? { refreshToken: parsed.refreshToken } : {}\n\t\t}] };\n\t}\n};\n/**\n* Default `readCredentialFile` implementation.\n*\n* Returns the UTF-8 contents of `${getCleoHome()}/anthropic-oauth.json`,\n* or `null` when the file is absent or unreadable. NEVER throws — every\n* error path collapses to `null` so the seeder's \"source absent\" contract\n* holds.\n*\n* @internal\n*/\nfunction defaultReadCredentialFile() {\n\ttry {\n\t\treturn readFileSync(defaultCleoPkcePath(), \"utf-8\");\n\t} catch {\n\t\treturn null;\n\t}\n}\n/**\n* Factory for the singleton `CleoPkceSeeder` registered into\n* `BUILTIN_SEEDERS` from `index.ts`.\n*\n* Kept as a factory (not a module-level `const`) so the registry-side\n* import remains acyclic and tests can construct fresh instances with\n* injected dependencies.\n*\n* @task T9411\n*/\nfunction createCleoPkceSeeder() {\n\treturn new CleoPkceSeeder();\n}\n//#endregion\n//#region ../core/dist/llm/credential-seeders/codex-cli-seeder.js\n/**\n* Credential seeder for the OpenAI Codex CLI\n* (E-CONFIG-AUTH-UNIFY E2a / T9418).\n*\n* Implements the \"delegate-to-partner-CLI\" pattern: instead of CLEO running\n* its own OAuth flow against OpenAI, this seeder reads the token file the\n* Codex CLI already writes when the user runs `codex login`. The seeder is\n* read-only — it never writes back to Codex's auth.json, so the two CLIs\n* remain decoupled.\n*\n* ## File path\n*\n* `${CODEX_HOME:-~/.codex}/auth.json` per Hermes Agent's\n* `hermes_cli/codex_models.py:175`. The `CODEX_HOME` env var is honoured\n* exactly as Codex itself does (empty/whitespace falls back to `~/.codex`).\n*\n* ## File shape\n*\n* Codex `auth.json` carries either an API key, OAuth tokens, or both:\n*\n* ```json\n* {\n*   \"OPENAI_API_KEY\": \"sk-...\",          // optional — when user logged in via API key\n*   \"tokens\": {\n*     \"access_token\": \"...\",             // optional — when user logged in via OAuth\n*     \"refresh_token\": \"...\",\n*     \"id_token\": \"...\",\n*     \"account_id\": \"...\"\n*   }\n* }\n* ```\n*\n* This seeder reports both forms when present (one entry per source). Empty\n* tokens are skipped so a partially-written file does not seed a broken\n* credential into the pool.\n*\n* @module llm/credential-seeders/codex-cli-seeder\n* @task T9418\n* @epic E-CONFIG-AUTH-UNIFY (E2a)\n*/\n/**\n* Resolve the Codex CLI auth file path.\n*\n* Mirrors Codex's own logic: `CODEX_HOME` env var when set (trimmed),\n* falling back to `~/.codex/auth.json`. Exposed for tests so they can pin\n* the path to a temp dir without touching the real `~/.codex` directory.\n*\n* @internal\n* @task T9418\n*/\nfunction getCodexAuthPath() {\n\treturn join((process.env[\"CODEX_HOME\"] ?? \"\").trim() || join(homedir(), \".codex\"), \"auth.json\");\n}\n/**\n* Credential seeder for OpenAI Codex CLI.\n*\n* Returns one entry per credential present in `auth.json` (the API key and\n* the OAuth access token are reported separately so the resolver can rank\n* them via priority). Missing file or unreadable JSON → `{ entries: [] }`\n* with no error surfaced; the caller treats absence as \"not on this\n* machine\".\n*\n* @task T9418\n*/\nvar CodexCliSeeder = class {\n\tsourceId = \"codex-cli\";\n\tprovider = \"openai\";\n\t/**\n\t* Read and parse Codex's `auth.json`, returning the discovered entries.\n\t*\n\t* Never throws — every failure path resolves to `{ entries: [], warnings? }`.\n\t*\n\t* @returns Discovered credential entries plus optional diagnostics.\n\t* @task T9418\n\t*/\n\tasync seed() {\n\t\tconst authPath = getCodexAuthPath();\n\t\tif (!existsSync(authPath)) return { entries: [] };\n\t\tlet raw;\n\t\ttry {\n\t\t\traw = readFileSync(authPath, \"utf-8\");\n\t\t} catch (err) {\n\t\t\treturn {\n\t\t\t\tentries: [],\n\t\t\t\twarnings: [`codex-cli: failed to read ${authPath}: ${err.message}`]\n\t\t\t};\n\t\t}\n\t\tlet parsed;\n\t\ttry {\n\t\t\tconst json = JSON.parse(raw);\n\t\t\tif (!json || typeof json !== \"object\" || Array.isArray(json)) return {\n\t\t\t\tentries: [],\n\t\t\t\twarnings: [`codex-cli: ${authPath} is not a JSON object`]\n\t\t\t};\n\t\t\tparsed = json;\n\t\t} catch (err) {\n\t\t\treturn {\n\t\t\t\tentries: [],\n\t\t\t\twarnings: [`codex-cli: ${authPath} is not valid JSON: ${err.message}`]\n\t\t\t};\n\t\t}\n\t\tconst result = { entries: [] };\n\t\tconst tokens = parsed[\"tokens\"];\n\t\tif (tokens && typeof tokens === \"object\" && !Array.isArray(tokens)) {\n\t\t\tconst accessToken = tokens[\"access_token\"];\n\t\t\tconst refreshToken = tokens[\"refresh_token\"];\n\t\t\tif (typeof accessToken === \"string\" && accessToken.trim()) result.entries.push({\n\t\t\t\tprovider: \"openai\",\n\t\t\t\tlabel: \"codex-cli\",\n\t\t\t\tauthType: \"oauth\",\n\t\t\t\taccessToken: accessToken.trim(),\n\t\t\t\tsource: \"codex-cli\",\n\t\t\t\t...typeof refreshToken === \"string\" && refreshToken.trim() ? { refreshToken: refreshToken.trim() } : {}\n\t\t\t});\n\t\t}\n\t\tconst apiKey = parsed[\"OPENAI_API_KEY\"];\n\t\tif (typeof apiKey === \"string\" && apiKey.trim()) result.entries.push({\n\t\t\tprovider: \"openai\",\n\t\t\tlabel: \"codex-cli-api-key\",\n\t\t\tauthType: \"api_key\",\n\t\t\taccessToken: apiKey.trim(),\n\t\t\tsource: \"codex-cli\"\n\t\t});\n\t\treturn result;\n\t}\n};\n/**\n* Module-level singleton. Registered into `BUILTIN_SEEDERS` from\n* `credential-seeders/index.ts` to keep the registration site DRY.\n*\n* @task T9418\n*/\nvar codexCliSeeder = new CodexCliSeeder();\n//#endregion\n//#region ../core/dist/llm/oauth/pkce.js\n/**\n* Refresh an access token using the `refresh_token` grant (RFC 6749 §6).\n*\n* Uses the same token endpoint as code exchange. On success, a new access\n* token (and optionally a new refresh token) is returned. The caller is\n* responsible for persisting the updated tokens.\n*\n* @param params - Refresh parameters.\n* @returns Normalized token response with fresh `accessToken`.\n* @throws {Error} On HTTP errors or missing `access_token` in the response.\n* @task T9302\n*/\nasync function refreshPkceToken(params) {\n\tconst fields = {\n\t\tgrant_type: \"refresh_token\",\n\t\tclient_id: params.clientId,\n\t\trefresh_token: params.refreshToken\n\t};\n\tconst resp = await postTokenRequest(params.tokenEndpoint, fields, params);\n\tif (!resp.ok) {\n\t\tconst detail = await extractOAuthErrorDetail(resp);\n\t\tthrow new Error(`PKCE token refresh failed for provider '${params.provider}': HTTP ${resp.status}${detail}`);\n\t}\n\treturn parseTokenResponse(params.provider, await resp.json());\n}\n/**\n* POST a token-endpoint request (code exchange or refresh grant).\n*\n* Single home for the body-encoding split shared by {@link exchangePkceCode}\n* and {@link refreshPkceToken}: `'form'` (RFC 6749 default,\n* `application/x-www-form-urlencoded`) vs `'json'` (Anthropic's non-RFC\n* `application/json` token endpoint). See\n* `ProviderOAuthConfig.tokenBodyFormat`.\n*\n* @internal\n*/\nfunction postTokenRequest(tokenEndpoint, fields, opts) {\n\treturn globalThis.fetch(tokenEndpoint, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": opts.bodyFormat === \"json\" ? \"application/json\" : \"application/x-www-form-urlencoded\",\n\t\t\tAccept: \"application/json\",\n\t\t\t...opts.extraHeaders\n\t\t},\n\t\tbody: opts.bodyFormat === \"json\" ? JSON.stringify(fields) : new URLSearchParams(fields).toString()\n\t});\n}\n/**\n* Parse a raw token endpoint JSON body into a normalized {@link OAuthTokens}.\n*\n* @throws {Error} When `access_token` is absent or not a string.\n* @internal\n*/\nfunction parseTokenResponse(provider, data) {\n\tif (typeof data !== \"object\" || data === null) throw new Error(`Token endpoint for '${provider}' returned non-object response`);\n\tconst d = data;\n\tconst accessToken = d[\"access_token\"];\n\tif (typeof accessToken !== \"string\" || !accessToken) throw new Error(`Token endpoint for '${provider}' returned response without access_token`);\n\treturn {\n\t\taccessToken,\n\t\trefreshToken: typeof d[\"refresh_token\"] === \"string\" ? d[\"refresh_token\"] : void 0,\n\t\texpiresIn: typeof d[\"expires_in\"] === \"number\" ? d[\"expires_in\"] : void 0,\n\t\ttokenType: typeof d[\"token_type\"] === \"string\" ? d[\"token_type\"] : \"bearer\"\n\t};\n}\n/**\n* Extract a human-readable error detail string from a non-OK OAuth HTTP\n* response.\n*\n* The single shared extractor for every OAuth surface in the LLM layer\n* (`pkce.ts`, `google-pkce.ts`, `device-code.ts`) — local copies drifted and\n* re-introduced the `[object Object]` masking of DHQ-075 (T11958).\n*\n* Strategy:\n* 1. Clone the response so the body stream is not consumed by the primary\n*    error path (callers may need the body for further inspection).\n* 2. Parse as JSON; use `error_description` or `error` fields (RFC 6749 §5.2).\n*    When the field is an object (Anthropic nests\n*    `{\"error\": {\"type\", \"message\"}}`), extract `message`/`type` — never\n*    `String(object)`.\n* 3. Fall back to the raw text body when JSON parsing fails (e.g. HTML pages\n*    returned by a WAF or a misconfigured reverse proxy). Truncate at 512 chars\n*    so a multi-kilobyte HTML page does not flood the error message.\n* 4. Return `''` only when all fallbacks are exhausted.\n*\n* This ensures the caller never sees `[object Object]` in the thrown message\n* and always surfaces the actual HTTP response body for debugging.\n*\n* @task T11958\n*/\nasync function extractOAuthErrorDetail(resp) {\n\tconst clone = resp.clone();\n\ttry {\n\t\tconst body = await clone.json();\n\t\tconst desc = body[\"error_description\"] ?? body[\"error\"];\n\t\tif (typeof desc === \"string\" && desc) return ` — ${desc}`;\n\t\tif (desc !== null && typeof desc === \"object\") {\n\t\t\tconst d = desc;\n\t\t\tconst message = typeof d[\"message\"] === \"string\" ? d[\"message\"] : void 0;\n\t\t\tconst type = typeof d[\"type\"] === \"string\" ? d[\"type\"] : void 0;\n\t\t\tif (message) return ` — ${type ? `${type}: ` : \"\"}${message}`;\n\t\t\treturn ` — ${JSON.stringify(desc).slice(0, 512)}`;\n\t\t}\n\t\treturn ` — ${JSON.stringify(body).slice(0, 512)}`;\n\t} catch {\n\t\ttry {\n\t\t\tconst text = (await resp.text()).trim();\n\t\t\treturn text ? ` — ${text.slice(0, 512)}` : \"\";\n\t\t} catch {\n\t\t\treturn \"\";\n\t\t}\n\t}\n}\n//#endregion\n//#region ../core/dist/llm/oauth/google-pkce.js\n/**\n* Google OAuth PKCE refresh helper for the `gemini-cli` credential seeder\n* (E-CONFIG-AUTH-UNIFY E2a / T9418).\n*\n* CLEO owns its own Google OAuth flow rather than reading the gemini-cli npm\n* package's token file directly — this avoids the single-use refresh-token\n* race the Hermes design notes call out (see `agent/google_oauth.py` in\n* Hermes Agent). The interactive login flow (browser callback server, PKCE\n* pair generation, code exchange) is **deferred to E3** when the\n* `cleo llm login gemini` CLI command lands; this module ships only the\n* refresh-from-expired path that the seeder needs at pool-load time.\n*\n* ## Public Google OAuth client\n*\n* The `client_id` / `client_secret` literals below are Google's PUBLIC\n* desktop OAuth client for their own open-source `@google/gemini-cli` npm\n* package. They are baked into every copy of that package and are NOT\n* confidential — desktop OAuth clients have no secret-keeping requirement\n* (PKCE provides the security). Shipping them here matches the pattern\n* `opencode-gemini-auth` and Hermes Agent already use.\n*\n* Source: https://github.com/google-gemini/gemini-cli/blob/main/packages/core/src/code_assist/oauth2.ts\n*\n* Both literals are overridable via env vars (`CLEO_GEMINI_CLIENT_ID` /\n* `CLEO_GEMINI_CLIENT_SECRET`) so power users can substitute their own\n* Google Cloud Console-issued desktop client.\n*\n* ## Why a dedicated fetch instead of `refreshPkceToken`\n*\n* The generic {@link refreshPkceToken} helper only POSTs\n* `grant_type=refresh_token`, `client_id`, and `refresh_token` — Google\n* additionally requires `client_secret` in the form body for refreshes that\n* use the public desktop client. Rather than overload the generic helper\n* with a Google-specific param, this module ships its own thin POST that\n* mirrors gemini-cli's exact request shape.\n*\n* @module llm/oauth/google-pkce\n* @task T9418\n* @epic E-CONFIG-AUTH-UNIFY (E2a)\n*/\n/**\n* Google's OAuth 2.0 token endpoint.\n*\n* Same endpoint used for both `authorization_code` and `refresh_token`\n* grants. Constants live in this module (not a shared registry) so the\n* Google flow can evolve independently of the generic PKCE helpers.\n*\n* @task T9418\n*/\nvar GOOGLE_OAUTH_TOKEN_ENDPOINT = \"https://oauth2.googleapis.com/token\";\nvar _PUBLIC_CLIENT_ID_PROJECT_NUM = \"681255809395\";\nvar _PUBLIC_CLIENT_ID_HASH = \"oo8ft2oprdrnp9e3aqf6av3hmdib135j\";\nvar _PUBLIC_CLIENT_SECRET_SUFFIX = \"4uHgMPm-1o7Sk-geV6Cu5clXFsxl\";\n/**\n* Public Google OAuth desktop client ID baked into `@google/gemini-cli`.\n*\n* NOT confidential — desktop OAuth clients have no secret-keeping\n* requirement. Override via `CLEO_GEMINI_CLIENT_ID` for power users who\n* want to substitute their own Google Cloud Console-issued client.\n*\n* @task T9418\n*/\nvar DEFAULT_GOOGLE_CLIENT_ID = `${_PUBLIC_CLIENT_ID_PROJECT_NUM}-${_PUBLIC_CLIENT_ID_HASH}.apps.googleusercontent.com`;\n/**\n* Public Google OAuth desktop client secret baked into `@google/gemini-cli`.\n*\n* NOT confidential — see {@link DEFAULT_GOOGLE_CLIENT_ID}. Google's token\n* endpoint accepts the refresh-token grant with `client_secret` present even\n* for desktop clients.\n*\n* @task T9418\n*/\nvar DEFAULT_GOOGLE_CLIENT_SECRET = `GOCSPX-${_PUBLIC_CLIENT_SECRET_SUFFIX}`;\n/**\n* Default expiry buffer applied when Google omits `expires_in` from the\n* refresh response. One hour matches gemini-cli's own default and gives the\n* pool plenty of headroom before the next refresh.\n*\n* @task T9418\n*/\nvar DEFAULT_EXPIRES_IN_SECONDS = 3600;\n/**\n* Refresh a Google OAuth access token using a stored refresh token.\n*\n* POSTs `grant_type=refresh_token` plus the public gemini-cli client\n* credentials to Google's token endpoint and converts the resulting\n* `expires_in` (seconds) into an absolute `expiresAt` (epoch milliseconds).\n*\n* Env-var overrides (`CLEO_GEMINI_CLIENT_ID` / `CLEO_GEMINI_CLIENT_SECRET`)\n* are honoured when present; otherwise the shipped public defaults apply.\n*\n* All HTTP calls use `globalThis.fetch` so tests can intercept them via\n* `vi.spyOn(globalThis, 'fetch')` — no real network traffic.\n*\n* @param refreshToken - Long-lived refresh token from a prior login flow.\n*   MUST be non-empty; an empty value throws synchronously without making\n*   a network call.\n* @returns Fresh access token + computed absolute expiry.\n* @throws {Error} When `refreshToken` is empty, the token endpoint returns\n*   a non-2xx response, or the payload lacks an `access_token`.\n*\n* @task T9418\n*/\nasync function refreshGoogleAccessToken(refreshToken) {\n\tif (!refreshToken) throw new Error(\"Google OAuth refresh failed: refresh_token is empty\");\n\tconst clientId = (process.env[\"CLEO_GEMINI_CLIENT_ID\"] ?? \"\").trim() || DEFAULT_GOOGLE_CLIENT_ID;\n\tconst clientSecret = (process.env[\"CLEO_GEMINI_CLIENT_SECRET\"] ?? \"\").trim() || DEFAULT_GOOGLE_CLIENT_SECRET;\n\tconst body = new URLSearchParams({\n\t\tgrant_type: \"refresh_token\",\n\t\tclient_id: clientId,\n\t\trefresh_token: refreshToken\n\t});\n\tif (clientSecret) body.set(\"client_secret\", clientSecret);\n\tconst resp = await globalThis.fetch(GOOGLE_OAUTH_TOKEN_ENDPOINT, {\n\t\tmethod: \"POST\",\n\t\theaders: {\n\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\tAccept: \"application/json\"\n\t\t},\n\t\tbody: body.toString()\n\t});\n\tif (!resp.ok) {\n\t\tconst detail = await extractOAuthErrorDetail(resp);\n\t\tthrow new Error(`Google OAuth refresh failed: HTTP ${resp.status}${detail}`);\n\t}\n\tconst parsed = await resp.json();\n\tconst accessToken = parsed[\"access_token\"];\n\tif (typeof accessToken !== \"string\" || !accessToken) throw new Error(\"Google OAuth refresh response missing access_token\");\n\tconst expiresInRaw = parsed[\"expires_in\"];\n\tconst expiresInSeconds = typeof expiresInRaw === \"number\" && Number.isFinite(expiresInRaw) && expiresInRaw > 0 ? expiresInRaw : DEFAULT_EXPIRES_IN_SECONDS;\n\tconst expiresAt = Date.now() + expiresInSeconds * 1e3;\n\tconst rotated = parsed[\"refresh_token\"];\n\treturn {\n\t\taccessToken,\n\t\texpiresAt,\n\t\trefreshToken: typeof rotated === \"string\" && rotated ? rotated : void 0\n\t};\n}\n//#endregion\n//#region ../core/dist/llm/credential-seeders/gemini-cli-seeder.js\n/**\n* Credential seeder for the CLEO-owned Google PKCE token\n* (E-CONFIG-AUTH-UNIFY E2a / T9418).\n*\n* Per spec OQ-4 (resolved in the T9418 task brief): CLEO does NOT read\n* gemini-cli's npm package token file directly — sharing a refresh token\n* across two clients causes single-use `refresh_token_reused` race\n* failures. Instead CLEO runs its own Google OAuth PKCE flow against the\n* public gemini-cli desktop client and stores tokens at\n* `${getCleoHome()}/google_oauth.json`.\n*\n* The interactive login flow (browser callback server, code exchange) is\n* deferred to E3's `cleo llm login gemini` command. This seeder ships only\n* the **read + refresh** path the pool needs at load time.\n*\n* ## File path & shape\n*\n* `${getCleoHome()}/google_oauth.json`, chmod 0o600 (writer is the\n* interactive login flow — out of scope here):\n*\n* ```json\n* {\n*   \"access_token\": \"ya29...\",\n*   \"refresh_token\": \"1//...\",\n*   \"expires_at\": 1744848000000,   // unix MILLIseconds\n*   \"email\": \"user@example.com\"\n* }\n* ```\n*\n* The shape is intentionally flatter than Hermes' \"packed refresh\" format\n* because CLEO does not need to carry GCP project IDs through the token\n* file — the Gemini transport reads project context from\n* `~/.cleo/config.json` instead. Extra keys (e.g. a stale `project_id`)\n* are tolerated and ignored.\n*\n* ## Refresh-on-expiry\n*\n* When `expires_at` is in the past (or within the 60-second clock-skew\n* buffer), the seeder calls {@link refreshGoogleAccessToken} to mint a\n* fresh access token. **The refreshed token file is NOT written back to\n* disk by this seeder** — the credential store keeps the canonical copy\n* and the interactive login flow (E3) owns disk writes. The seeder simply\n* emits the freshly-refreshed entry so the pool starts the session with a\n* live token.\n*\n* When refresh fails (revoked token, network out, etc.) the seeder emits\n* the stored entry as-is with a warning; the credential pool's mark-bad\n* machinery will quarantine it on the first 401 response.\n*\n* @module llm/credential-seeders/gemini-cli-seeder\n* @task T9418\n* @epic E-CONFIG-AUTH-UNIFY (E2a)\n*/\n/**\n* Clock-skew buffer (ms) before `expires_at` at which we proactively\n* refresh. 60 seconds matches Hermes' default and gives the first\n* downstream LLM call enough headroom to complete.\n*\n* @internal\n* @task T9418\n*/\nvar REFRESH_SKEW_MS = 6e4;\n/**\n* Resolve the CLEO-owned Google OAuth token path.\n*\n* Routed through `getCleoHome()` so the `CLEO_HOME` env override and\n* platform-aware XDG resolution apply uniformly (T9403 / T9405). Exposed\n* for tests.\n*\n* @internal\n* @task T9418\n*/\nfunction getGoogleOauthPath() {\n\treturn join(getCleoHome(), \"google_oauth.json\");\n}\n/**\n* Parse the on-disk JSON into a narrowed shape. Returns `null` when the\n* file is malformed (extras tolerated, missing required fields rejected).\n*\n* @internal\n* @task T9418\n*/\nfunction parseGoogleOauthFile(raw) {\n\tlet json;\n\ttry {\n\t\tjson = JSON.parse(raw);\n\t} catch {\n\t\treturn null;\n\t}\n\tif (!json || typeof json !== \"object\" || Array.isArray(json)) return null;\n\tconst obj = json;\n\tconst out = {};\n\tif (typeof obj[\"access_token\"] === \"string\") out.access_token = obj[\"access_token\"];\n\tif (typeof obj[\"refresh_token\"] === \"string\") out.refresh_token = obj[\"refresh_token\"];\n\tif (typeof obj[\"expires_at\"] === \"number\" && Number.isFinite(obj[\"expires_at\"])) out.expires_at = obj[\"expires_at\"];\n\tif (typeof obj[\"email\"] === \"string\") out.email = obj[\"email\"];\n\treturn out;\n}\n/**\n* Credential seeder for the CLEO-owned Google PKCE token store.\n*\n* @task T9418\n*/\nvar GeminiCliSeeder = class {\n\tsourceId = \"gemini-cli\";\n\tprovider = \"gemini\";\n\t/**\n\t* Read `google_oauth.json` and emit a seeded credential entry,\n\t* refreshing the access token first when it is expired or near expiry.\n\t*\n\t* Never throws — every failure path resolves to `{ entries: [], warnings? }`.\n\t*\n\t* @returns Zero or one entry plus optional warnings.\n\t* @task T9418\n\t*/\n\tasync seed() {\n\t\tconst path = getGoogleOauthPath();\n\t\tif (!existsSync(path)) return { entries: [] };\n\t\tlet raw;\n\t\ttry {\n\t\t\traw = readFileSync(path, \"utf-8\");\n\t\t} catch (err) {\n\t\t\treturn {\n\t\t\t\tentries: [],\n\t\t\t\twarnings: [`gemini-cli: failed to read ${path}: ${err.message}`]\n\t\t\t};\n\t\t}\n\t\tconst parsed = parseGoogleOauthFile(raw);\n\t\tif (!parsed) return {\n\t\t\tentries: [],\n\t\t\twarnings: [`gemini-cli: ${path} is not valid JSON / not an object`]\n\t\t};\n\t\tif (!parsed.access_token) return {\n\t\t\tentries: [],\n\t\t\twarnings: [`gemini-cli: ${path} is missing access_token`]\n\t\t};\n\t\tconst now = Date.now();\n\t\tif (typeof parsed.expires_at === \"number\" && parsed.expires_at - REFRESH_SKEW_MS <= now && parsed.refresh_token) try {\n\t\t\tconst refreshed = await refreshGoogleAccessToken(parsed.refresh_token);\n\t\t\treturn { entries: [{\n\t\t\t\tprovider: \"gemini\",\n\t\t\t\tlabel: \"gemini-pkce\",\n\t\t\t\tauthType: \"oauth\",\n\t\t\t\taccessToken: refreshed.accessToken,\n\t\t\t\texpiresAt: refreshed.expiresAt,\n\t\t\t\tsource: \"gemini-cli\",\n\t\t\t\trefreshToken: refreshed.refreshToken ?? parsed.refresh_token,\n\t\t\t\t...parsed.email ? { metadata: { email: parsed.email } } : {}\n\t\t\t}] };\n\t\t} catch (err) {\n\t\t\treturn {\n\t\t\t\tentries: [{\n\t\t\t\t\tprovider: \"gemini\",\n\t\t\t\t\tlabel: \"gemini-pkce\",\n\t\t\t\t\tauthType: \"oauth\",\n\t\t\t\t\taccessToken: parsed.access_token,\n\t\t\t\t\texpiresAt: parsed.expires_at ?? null,\n\t\t\t\t\tsource: \"gemini-cli\",\n\t\t\t\t\t...parsed.refresh_token ? { refreshToken: parsed.refresh_token } : {},\n\t\t\t\t\t...parsed.email ? { metadata: { email: parsed.email } } : {}\n\t\t\t\t}],\n\t\t\t\twarnings: [`gemini-cli: refresh failed, using stored access_token (${err.message})`]\n\t\t\t};\n\t\t}\n\t\treturn { entries: [{\n\t\t\tprovider: \"gemini\",\n\t\t\tlabel: \"gemini-pkce\",\n\t\t\tauthType: \"oauth\",\n\t\t\taccessToken: parsed.access_token,\n\t\t\texpiresAt: parsed.expires_at ?? null,\n\t\t\tsource: \"gemini-cli\",\n\t\t\t...parsed.refresh_token ? { refreshToken: parsed.refresh_token } : {},\n\t\t\t...parsed.email ? { metadata: { email: parsed.email } } : {}\n\t\t}] };\n\t}\n};\n/**\n* Module-level singleton registered into `BUILTIN_SEEDERS`.\n*\n* @task T9418\n*/\nvar geminiCliSeeder = new GeminiCliSeeder();\n//#endregion\n//#region ../core/dist/llm/credential-seeders/gh-cli-seeder.js\n/**\n* Credential seeder for the GitHub CLI (`gh`)\n* (E-CONFIG-AUTH-UNIFY E2a / T9418).\n*\n* ## DISABLED — T9594\n*\n* This seeder is intentionally NOT registered in `BUILTIN_SEEDERS` until a\n* real `github-models` provider exists in CLEO.  The token returned by\n* `gh auth token` is a GitHub Personal Access Token (`ghp_*` / `gho_*`) that\n* **cannot authenticate against `api.openai.com`**.  Tagging the entry as\n* `provider:'openai'` created unusable pool entries.\n*\n* Re-enable by:\n*   1. Implementing a `github-models` transport in `packages/core/src/llm/`.\n*   2. Changing `readonly provider = 'openai'` below to `'github-models'` (or\n*      whichever id the transport registers under).\n*   3. Adding `BUILTIN_SEEDERS.register(ghCliSeeder)` back to `./index.ts`.\n*\n* The file is kept in tree so the `readGhAuthToken` helper and the\n* `GhCliSeeder` class are available for the future provider without a\n* `git revert`.\n*\n* ## Security note\n*\n* MUST use `execFileSync` (not `execSync`) so the `gh` invocation cannot\n* be hijacked by shell metacharacters in the working directory or\n* environment. No arguments are interpolated from user input.\n*\n* ## Failure model\n*\n* Every failure path resolves to `{ entries: [] }`:\n*   - `gh` not installed (`ENOENT` on spawn) → silent skip\n*   - `gh auth token` exits non-zero (no logged-in account, scope mismatch,\n*     etc.) → silent skip\n*   - `gh` hangs → 2-second timeout terminates the child and skips\n*   - any other unexpected error → captured warning, still skipped\n*\n* This matches the rest of the seeder cohort: absence of the upstream tool\n* MUST never crash the resolver.\n*\n* @module llm/credential-seeders/gh-cli-seeder\n* @task T9418\n* @task T9594 (disabled — see note above)\n* @epic E-CONFIG-AUTH-UNIFY (E2a)\n*/\n/**\n* Max time (ms) we let `gh auth token` run before terminating it.\n*\n* Two seconds is well above `gh`'s typical sub-100ms response time but\n* short enough that a hung child cannot stall pool resolution.\n*\n* @internal\n* @task T9418\n*/\nvar GH_AUTH_TOKEN_TIMEOUT_MS = 2e3;\n/**\n* Run `gh auth token` and return its trimmed stdout, or `null` on any\n* failure (tool absent, non-zero exit, timeout, etc.).\n*\n* Factored out so tests can stub `execFileSync` via `vi.mock('node:child_process')`\n* without needing to instantiate the seeder class.\n*\n* @internal\n* @task T9418\n*/\nfunction readGhAuthToken() {\n\ttry {\n\t\treturn { token: execFileSync(\"gh\", [\"auth\", \"token\"], {\n\t\t\tencoding: \"utf-8\",\n\t\t\ttimeout: GH_AUTH_TOKEN_TIMEOUT_MS,\n\t\t\tstdio: [\n\t\t\t\t\"ignore\",\n\t\t\t\t\"pipe\",\n\t\t\t\t\"ignore\"\n\t\t\t]\n\t\t}).trim() || null };\n\t} catch (err) {\n\t\tif (err.code === \"ENOENT\") return { token: null };\n\t\treturn {\n\t\t\ttoken: null,\n\t\t\twarning: `gh-cli: \\`gh auth token\\` failed (${err.message})`\n\t\t};\n\t}\n}\n/**\n* Credential seeder for the GitHub CLI (`gh`).\n*\n* Returns at most one entry: the token captured from `gh auth token`. The\n* entry is labelled `'gh-cli'` so the resolver and removal flows can\n* round-trip the source identity through the credential store.\n*\n* @task T9418\n*/\nvar GhCliSeeder = class {\n\tsourceId = \"gh-cli\";\n\tprovider = \"openai\";\n\t/**\n\t* Invoke `gh auth token` and shape the result for the resolver.\n\t*\n\t* Never throws — see the module docstring for the failure-mode table.\n\t*\n\t* @returns Zero or one entry plus optional warning.\n\t* @task T9418\n\t*/\n\tasync seed() {\n\t\tconst { token, warning } = readGhAuthToken();\n\t\tif (!token) return warning ? {\n\t\t\tentries: [],\n\t\t\twarnings: [warning]\n\t\t} : { entries: [] };\n\t\treturn { entries: [{\n\t\t\tprovider: \"openai\",\n\t\t\tlabel: \"gh-cli\",\n\t\t\tauthType: \"oauth\",\n\t\t\taccessToken: token,\n\t\t\tsource: \"gh-cli\"\n\t\t}] };\n\t}\n};\nnew GhCliSeeder();\n/**\n* Process-wide singleton registry used by the resolver.\n*\n* Concrete seeder instances are auto-registered into this registry at\n* module load via the registration block below + the `./register.ts`\n* barrel which aggregates side-effect imports (T9409+). As of this merge\n* the registry contains:\n*\n* - env seeders for every provider in ENV_VARS (T9409)\n* - `claude-code` × `anthropic` (T9410)\n* - `cleo-pkce` × `anthropic` (T9411)\n* - `codex-cli`, `gemini-cli` external seeders (T9418)\n* - `gh-cli` seeder is present but NOT registered (T9594 — GitHub PAT cannot auth OpenAI)\n*\n* The singleton is a module-scoped constant (`export const`) rather than a\n* class static so re-importing this module from different entry points\n* yields the same instance under Node ESM's module cache. Tests that need\n* isolation MUST construct a fresh `new SeederRegistry()` instead of\n* mutating `BUILTIN_SEEDERS`.\n*\n* @task T9408 (foundation)\n* @task T9410 (claude-code seeder)\n* @task T9411 (cleo-pkce seeder)\n* @task T9418 (codex-cli, gemini-cli, gh-cli)\n*/\nvar BUILTIN_SEEDERS = new class SeederRegistry {\n\t/**\n\t* Map keyed on `${sourceId}::${provider}` for O(1) duplicate detection.\n\t* Values are the registered seeder instances; iteration order is\n\t* insertion order (`Map` semantics) so `getAll()` is stable.\n\t*/\n\tentries = /* @__PURE__ */ new Map();\n\t/**\n\t* Register a seeder.\n\t*\n\t* @param seeder - Seeder instance to add.\n\t* @throws {Error} `E_SEEDER_DUPLICATE` when the `(sourceId, provider)`\n\t*   pair is already registered.\n\t*\n\t* @task T9408\n\t*/\n\tregister(seeder) {\n\t\tconst key = SeederRegistry.makeKey(seeder.sourceId, seeder.provider);\n\t\tif (this.entries.has(key)) throw new Error(`E_SEEDER_DUPLICATE: a seeder is already registered for sourceId='${seeder.sourceId}' provider='${seeder.provider}'`);\n\t\tthis.entries.set(key, seeder);\n\t}\n\t/**\n\t* Return every registered seeder in insertion order.\n\t*\n\t* @returns Read-only view of the registry's seeders.\n\t*\n\t* @task T9408\n\t*/\n\tgetAll() {\n\t\treturn Array.from(this.entries.values());\n\t}\n\t/**\n\t* Return every seeder whose `provider` matches the argument.\n\t*\n\t* Order matches `getAll()` (insertion order). Returns an empty array when\n\t* no seeder is registered for the provider.\n\t*\n\t* @param provider - Provider id to filter by (e.g. `'anthropic'`).\n\t* @returns Read-only filtered array.\n\t*\n\t* @task T9408\n\t*/\n\tgetByProvider(provider) {\n\t\treturn this.getAll().filter((s) => s.provider === provider);\n\t}\n\t/**\n\t* Compose the internal uniqueness key for a `(sourceId, provider)` pair.\n\t*\n\t* Exposed as `static` so tests and (future) resolver code can assert\n\t* collision behaviour without coupling to the literal separator.\n\t*\n\t* @internal\n\t*/\n\tstatic makeKey(sourceId, provider) {\n\t\treturn `${sourceId}::${provider}`;\n\t}\n}();\nBUILTIN_SEEDERS.register(createClaudeCodeSeeder());\nBUILTIN_SEEDERS.register(createCleoPkceSeeder());\nBUILTIN_SEEDERS.register(codexCliSeeder);\nBUILTIN_SEEDERS.register(geminiCliSeeder);\n//#endregion\n//#region ../core/dist/llm/global-config-migration.js\n/**\n* XDG drift migration for the global CLEO config file (T9405).\n*\n* Pre-T9405 history: `globalConfigPath()` resolved to the CLEO **data** dir\n* (`getCleoHome()`), so existing installs have `config.json` at\n* `~/.local/share/cleo/config.json`. XDG says user config belongs in\n* `XDG_CONFIG_HOME` (`~/.config/cleo/config.json`).\n*\n* This migration runs on first credentials read after upgrade:\n*\n* 1. Skip if the data-dir source is absent.\n* 2. Skip if the data-dir migration marker exists (idempotent).\n* 3. Skip if the config-dir target already exists (manual migration / fresh install).\n* 4. Otherwise:\n*    a. `mkdir -p` the config dir.\n*    b. Read the data-dir config.\n*    c. Validate the JSON parses.\n*    d. Write to a temp file in the config dir, then atomically rename to the\n*       final `config.json` (temp-then-rename — never any partial state).\n*    e. Drop the marker file at `<data-dir>/.migrations/config-dir-v1.done`.\n*    f. Rename the data-dir original to `config.json.pre-e1-bak` so users can\n*       recover if something goes wrong.\n*\n* Migration is best-effort: every error is swallowed and logged to stderr. A\n* failed migration must never crash a CLI invocation — credentials resolution\n* just falls back to the data-dir location via the transition-window logic\n* baked into `globalConfigPath()`.\n*\n* @module llm/global-config-migration\n* @task T9405\n* @epic T9398\n*/\n/**\n* Filename used by `legacyGlobalConfigPath()` / `configDirGlobalConfigPath()`.\n*\n* Kept in one place so the migration helper and the credentials resolver agree\n* without anyone hard-coding the string in two places.\n*\n* @internal\n*/\nvar GLOBAL_CONFIG_FILENAME = \"config.json\";\n/**\n* Subdirectory in the data dir where migration markers are stamped.\n*\n* @internal\n*/\nvar MIGRATIONS_SUBDIR = \".migrations\";\n/**\n* Marker filename written when the config-dir migration completes.\n*\n* @internal\n*/\nvar MIGRATION_MARKER = \"config-dir-v1.done\";\n/**\n* Backup suffix appended to the data-dir source after a successful migration.\n*\n* Per the E-CONFIG-AUTH-UNIFY spec the original is renamed (not deleted) so\n* users have a recovery path.\n*\n* @internal\n*/\nvar BACKUP_SUFFIX = \".pre-e1-bak\";\n/**\n* Resolve the canonical config-dir path for the global config file.\n*\n* Linux:   `~/.config/cleo/config.json`\n* macOS:   `~/Library/Preferences/cleo/config.json`\n* Windows: `%APPDATA%\\cleo\\Config\\config.json`\n*\n* @public\n*/\nfunction configDirGlobalConfigPath() {\n\treturn join(getCleoPlatformPaths().config, GLOBAL_CONFIG_FILENAME);\n}\n/**\n* Resolve the legacy data-dir path for the global config file.\n*\n* Pre-T9405 location. Read-only fallback during the transition window — the\n* migration moves the contents to {@link configDirGlobalConfigPath} and\n* renames the data-dir original to `config.json.pre-e1-bak`.\n*\n* @public\n*/\nfunction legacyGlobalConfigPath() {\n\treturn join(getCleoHome(), GLOBAL_CONFIG_FILENAME);\n}\n/**\n* Path to the migration marker file. Stamped in the data dir (NOT the config\n* dir) because the marker is tied to \"did we already process the legacy\n* data-dir install?\" — co-locating it with the source makes the relationship\n* obvious and prevents `CLEO_HOME` overrides in tests from clobbering the\n* config-dir state.\n*\n* @internal\n*/\nfunction migrationMarkerPath() {\n\treturn join(getCleoHome(), MIGRATIONS_SUBDIR, MIGRATION_MARKER);\n}\n/**\n* Path used during atomic write inside the config dir.\n*\n* @internal\n*/\nfunction tempTargetPath() {\n\treturn `${configDirGlobalConfigPath()}.tmp`;\n}\n/**\n* Run the data-dir → config-dir migration if applicable.\n*\n* Idempotent: safe to call on every CLEO invocation. Performs at most three\n* filesystem stat calls in the steady state (marker present OR source absent).\n*\n* Never throws. Errors are logged to stderr and swallowed — the credentials\n* resolver's transition-window logic will still find the legacy data-dir copy.\n*\n* @returns `true` when a migration was actually performed, `false` when it was\n*   a no-op (already migrated, no source, or target already present).\n*\n* @task T9405\n*/\nfunction migrateGlobalConfigToConfigDir() {\n\ttry {\n\t\tconst source = legacyGlobalConfigPath();\n\t\tconst target = configDirGlobalConfigPath();\n\t\tconst marker = migrationMarkerPath();\n\t\tif (existsSync(marker)) return false;\n\t\tif (!existsSync(source)) {\n\t\t\tstampMarker(marker);\n\t\t\treturn false;\n\t\t}\n\t\tif (existsSync(target)) {\n\t\t\tbackupSourceQuiet(source);\n\t\t\tstampMarker(marker);\n\t\t\treturn false;\n\t\t}\n\t\tconst raw = readFileSync(source, \"utf-8\");\n\t\ttry {\n\t\t\tJSON.parse(raw);\n\t\t} catch (err) {\n\t\t\tconsole.error(`[cleo] global config migration skipped: ${source} is not valid JSON (${err.message})`);\n\t\t\treturn false;\n\t\t}\n\t\tmkdirSync(getCleoPlatformPaths().config, { recursive: true });\n\t\tconst temp = tempTargetPath();\n\t\twriteFileSync(temp, raw, { mode: 420 });\n\t\trenameSync(temp, target);\n\t\tstampMarker(marker);\n\t\ttry {\n\t\t\trenameSync(source, `${source}${BACKUP_SUFFIX}`);\n\t\t} catch (err) {\n\t\t\tconsole.error(`[cleo] global config migrated, but backup rename failed: ${err.message}. The legacy file at ${source} can be removed manually.`);\n\t\t}\n\t\tconsole.error(`[cleo] migrated global config: ${source} → ${target} (backup at ${source}${BACKUP_SUFFIX})`);\n\t\treturn true;\n\t} catch (err) {\n\t\ttry {\n\t\t\tconst temp = tempTargetPath();\n\t\t\tif (existsSync(temp)) unlinkSync(temp);\n\t\t} catch {}\n\t\tconsole.error(`[cleo] global config migration failed: ${err.message}. Credentials will continue to resolve from the legacy data-dir location.`);\n\t\treturn false;\n\t}\n}\n/**\n* Stamp the migration marker file. Best-effort — errors are swallowed.\n*\n* @internal\n*/\nfunction stampMarker(markerPath) {\n\ttry {\n\t\tmkdirSync(join(getCleoHome(), MIGRATIONS_SUBDIR), { recursive: true });\n\t\twriteFileSync(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}\\n`, { mode: 420 });\n\t} catch {}\n}\n/**\n* Best-effort rename of the legacy source to the backup name. Silent failure.\n*\n* @internal\n*/\nfunction backupSourceQuiet(source) {\n\ttry {\n\t\tconst backup = `${source}${BACKUP_SUFFIX}`;\n\t\tif (existsSync(backup)) return;\n\t\trenameSync(source, backup);\n\t} catch {}\n}\nvar hasRunInProcess$1 = false;\n/**\n* Run the migration at most once per Node process.\n*\n* Called from the credentials resolver before reading `globalConfigPath()` so\n* a stale install is upgraded in-place on first credentials read. The latch\n* keeps the steady-state cost at one boolean check after the first call —\n* essential because `resolveCredentials()` is on the hot path of every LLM\n* call.\n*\n* Use {@link _resetGlobalConfigMigrationLatch} in tests to re-arm the latch.\n*\n* @public\n*/\nfunction ensureGlobalConfigMigrated() {\n\tif (hasRunInProcess$1) return;\n\thasRunInProcess$1 = true;\n\tmigrateGlobalConfigToConfigDir();\n}\n//#endregion\n//#region ../core/dist/llm/legacy-flat-key-import.js\n/**\n* One-shot migration: import the legacy `${CLEO_HOME}/anthropic-key` flat file\n* into the unified credential pool as a `legacy-flat-key` entry.\n*\n* Part of `E-CONFIG-AUTH-UNIFY` Epic E1 (T9406 / T-E1-4). The legacy flat key\n* file is the \"tier 4b\" entry in the current 6-tier resolver in\n* `credentials.ts`. Once imported into the pool, the resolver's tier-3\n* (`cred-file`) lookup will pick it up — so post-E2 we can collapse the\n* tier-4b branch entirely without losing any operator's previously-stored\n* key.\n*\n* ## Behavior\n*\n* On `importLegacyFlatAnthropicKey()` (idempotent):\n*\n* 1. If the migration marker `${CLEO_HOME}/.imported-legacy-flat-key` exists,\n*    return immediately (`status: 'marker-present'`).\n* 2. If the pool already contains an `anthropic` entry with\n*    `label === 'legacy-flat-key'`, write the marker and return\n*    (`status: 'already-imported'`).\n* 3. If `${CLEO_HOME}/anthropic-key` does not exist, write the marker and\n*    return (`status: 'no-flat-file'`). Avoids re-stating the file on\n*    every CLI invocation.\n* 4. If the flat file exists but its trimmed content is empty, write the\n*    marker and return (`status: 'empty-flat-file'`). We do NOT rename an\n*    empty file — leave it for the operator to inspect / delete.\n* 5. Otherwise: call `addCredential()` with the trimmed key, then rename\n*    the flat file to `anthropic-key.pre-e1-bak`, then write the marker.\n*    Returns `status: 'imported'`.\n*\n* ## Atomicity contract\n*\n* The two side-effects we care about — (a) the pool entry insert and\n* (b) the flat-file rename — are sequenced so a failure at (b) leaves the\n* pool entry in place AND no marker is written. The next run will then\n* skip the insert (via the `getCredentialByLabel` check in step 2 above)\n* but still attempt the rename. This avoids a half-done state where the\n* marker exists but the original flat file is still discoverable by the\n* tier-4b resolver branch (which would re-import it on the next pool\n* rebuild).\n*\n* If `addCredential()` itself throws, nothing is renamed and no marker\n* is written — the next invocation retries cleanly.\n*\n* @module llm/legacy-flat-key-import\n* @task T9406\n* @epic E-CONFIG-AUTH-UNIFY\n*/\nvar logger$1 = getLogger(\"llm-legacy-flat-key-import\");\n/**\n* Canonical label assigned to the imported entry.\n*\n* Constant rather than parameterized — the resolver collapse in E2 keys\n* its behavior off this exact label, so it MUST remain stable.\n*/\nvar LEGACY_FLAT_KEY_LABEL = \"legacy-flat-key\";\n/**\n* Filename suffix used when renaming the original flat file post-import.\n*\n* Kept identical to the convention used by the T310 conduit migration\n* (`.pre-t310.bak`) for cross-codebase greppability.\n*/\nvar LEGACY_FLAT_KEY_BAK_SUFFIX = \".pre-e1-bak\";\n/**\n* Filename of the migration marker inside `getCleoHome()`. Existence of\n* this file (any content) is sufficient to short-circuit the migration.\n*/\nvar LEGACY_FLAT_KEY_MARKER = \".imported-legacy-flat-key\";\n/**\n* Compute all paths used by the migration. Pure — no filesystem touch.\n*/\nfunction migrationPaths() {\n\tconst home = getCleoHome();\n\treturn {\n\t\tflatPath: join(home, \"anthropic-key\"),\n\t\tbakPath: join(home, `anthropic-key${LEGACY_FLAT_KEY_BAK_SUFFIX}`),\n\t\tmarkerPath: join(home, LEGACY_FLAT_KEY_MARKER)\n\t};\n}\n/**\n* Write the migration marker. Uses `flag: 'wx'` so concurrent first-run\n* callers race-tolerantly — exactly one writes, the rest get `EEXIST`\n* which we treat as success.\n*\n* Best-effort 0o600 (matches the surrounding cred-store hardening).\n*/\nfunction writeMarker(markerPath) {\n\ttry {\n\t\twriteFileSync(markerPath, `${(/* @__PURE__ */ new Date()).toISOString()}\\n`, {\n\t\t\tencoding: \"utf-8\",\n\t\t\tflag: \"wx\",\n\t\t\tmode: 384\n\t\t});\n\t} catch (err) {\n\t\tif (err.code === \"EEXIST\") return;\n\t\tlogger$1.debug({\n\t\t\tmarkerPath,\n\t\t\terr: err instanceof Error ? err.message : String(err)\n\t\t}, \"legacy-flat-key migration: marker write failed\");\n\t}\n}\n/**\n* Read and trim the flat file. Returns null on any I/O error or when the\n* trimmed content is empty. Never throws.\n*/\nfunction readFlatKey(flatPath) {\n\ttry {\n\t\tif (!existsSync(flatPath)) return null;\n\t\treturn readFileSync(flatPath, \"utf-8\").trim() || null;\n\t} catch (err) {\n\t\tlogger$1.warn({\n\t\t\tflatPath,\n\t\t\terr: err instanceof Error ? err.message : String(err)\n\t\t}, \"legacy-flat-key migration: read failed — skipping\");\n\t\treturn null;\n\t}\n}\n/**\n* Import the legacy `${CLEO_HOME}/anthropic-key` flat file into the\n* credential pool, exactly once per CLEO home directory.\n*\n* Idempotent — safe to call from any bootstrap path on every CLI\n* invocation. The marker file guarantees O(1) cost on warm runs.\n*\n* Never throws. All errors are caught and surfaced through the structured\n* logger; the resolver fallback chain still works.\n*\n* @returns A `LegacyFlatKeyImportResult` describing the outcome.\n*\n* @task T9406\n*/\nasync function importLegacyFlatAnthropicKey() {\n\tconst { flatPath, bakPath, markerPath } = migrationPaths();\n\tif (existsSync(markerPath)) return {\n\t\tstatus: \"marker-present\",\n\t\tflatPath,\n\t\tbakPath: null,\n\t\tmarkerPath\n\t};\n\tlet existing = null;\n\ttry {\n\t\texisting = await getCredentialByLabel(\"anthropic\", LEGACY_FLAT_KEY_LABEL);\n\t} catch (err) {\n\t\tlogger$1.warn({ err: err instanceof Error ? err.message : String(err) }, \"legacy-flat-key migration: pool lookup failed — skipping this run\");\n\t\treturn {\n\t\t\tstatus: \"no-flat-file\",\n\t\t\tflatPath,\n\t\t\tbakPath: null,\n\t\t\tmarkerPath\n\t\t};\n\t}\n\tif (existing) {\n\t\twriteMarker(markerPath);\n\t\treturn {\n\t\t\tstatus: \"already-imported\",\n\t\t\tflatPath,\n\t\t\tbakPath: null,\n\t\t\tmarkerPath\n\t\t};\n\t}\n\tif (!existsSync(flatPath)) {\n\t\twriteMarker(markerPath);\n\t\treturn {\n\t\t\tstatus: \"no-flat-file\",\n\t\t\tflatPath,\n\t\t\tbakPath: null,\n\t\t\tmarkerPath\n\t\t};\n\t}\n\tconst token = readFlatKey(flatPath);\n\tif (!token) {\n\t\twriteMarker(markerPath);\n\t\treturn {\n\t\t\tstatus: \"empty-flat-file\",\n\t\t\tflatPath,\n\t\t\tbakPath: null,\n\t\t\tmarkerPath\n\t\t};\n\t}\n\ttry {\n\t\tawait addCredential({\n\t\t\tprovider: \"anthropic\",\n\t\t\tlabel: LEGACY_FLAT_KEY_LABEL,\n\t\t\tauthType: \"api_key\",\n\t\t\taccessToken: token,\n\t\t\tsource: \"manual\",\n\t\t\tpriority: 100\n\t\t});\n\t} catch (err) {\n\t\tlogger$1.error({\n\t\t\terr: err instanceof Error ? err.message : String(err),\n\t\t\tflatPath\n\t\t}, \"legacy-flat-key migration: addCredential failed — leaving flat file in place for retry\");\n\t\treturn {\n\t\t\tstatus: \"no-flat-file\",\n\t\t\tflatPath,\n\t\t\tbakPath: null,\n\t\t\tmarkerPath\n\t\t};\n\t}\n\ttry {\n\t\trenameSync(flatPath, bakPath);\n\t} catch (err) {\n\t\tlogger$1.warn({\n\t\t\terr: err instanceof Error ? err.message : String(err),\n\t\t\tflatPath,\n\t\t\tbakPath\n\t\t}, \"legacy-flat-key migration: rename to .pre-e1-bak failed — entry imported, will retry rename\");\n\t\treturn {\n\t\t\tstatus: \"imported\",\n\t\t\tflatPath,\n\t\t\tbakPath: null,\n\t\t\tmarkerPath\n\t\t};\n\t}\n\twriteMarker(markerPath);\n\tlogger$1.info({\n\t\tflatPath,\n\t\tbakPath,\n\t\tmarkerPath,\n\t\tlabel: LEGACY_FLAT_KEY_LABEL\n\t}, \"legacy-flat-key migration: imported anthropic flat key into pool\");\n\treturn {\n\t\tstatus: \"imported\",\n\t\tflatPath,\n\t\tbakPath,\n\t\tmarkerPath\n\t};\n}\nvar hasRunInProcess = false;\n/**\n* Run {@link importLegacyFlatAnthropicKey} at most once per Node process.\n*\n* Fire-and-forget: the credentials resolver is synchronous, but the import\n* is async (the credential-store API is async). Callers MUST NOT await\n* this — the helper is fully idempotent and the marker / pool-entry checks\n* ensure later invocations observe the imported entry without re-running.\n*\n* Errors are caught and dropped on the floor (the underlying helper already\n* logs through the structured logger). Returning a no-op promise keeps the\n* call site uniform with {@link ensureGlobalConfigMigrated} from\n* `global-config-migration.ts`.\n*\n* Wired into `resolveCredentials()` so a stale install gets its legacy flat\n* key promoted into the credential pool on first credentials read.\n*\n* Use {@link _resetLegacyFlatKeyImportLatch} in tests to re-arm the latch.\n*\n* @public\n* @task T9407\n*/\nfunction ensureLegacyFlatAnthropicKeyImported() {\n\tif (hasRunInProcess) return;\n\thasRunInProcess = true;\n\timportLegacyFlatAnthropicKey().catch(() => {});\n}\n//#endregion\n//#region ../core/dist/llm/credentials.js\n/**\n* Centralised credential resolution for the CLEO LLM layer (T1677).\n*\n* ONE canonical entry point: `resolveCredentials(provider, options)`.\n* Every LLM consumer — extraction, dream-cycle, hygiene-scan, dup-detect,\n* observer-reflector, deriver, adapters — MUST use this function.\n*\n* ## 6-tier resolution chain (first match wins)\n*\n* 1. **explicit**       — `options.apiKey` passed by the caller\n* 2. **env**            — provider-specific environment variable\n*                         (`ANTHROPIC_API_KEY` | `OPENAI_API_KEY` |\n*                          `GEMINI_API_KEY` | `MOONSHOT_API_KEY`)\n* 3. **cred-file**      — `~/.cleo/llm-credentials.json` (multi-credential\n*                         pool, file-locked, 0600). T-LLM-CRED Phase 2.\n* 4. **claude-creds**   — `~/.claude/.credentials.json` OAuth token\n*                         (only for `anthropic` provider; Claude Code zero-config)\n* 5. **global-config**  — `~/.config/cleo/config.json` (XDG config dir, post-T9405)\n*                         → `llm.providers.<provider>.apiKey`. The legacy\n*                         `~/.local/share/cleo/config.json` location is still\n*                         read as a fallback during the transition window.\n* 6. **project-config** — `.cleo/config.json`  → `llm.providers.<provider>.apiKey`\n*\n* Returns `null` when no key is found in any tier.\n*\n* @module llm/credentials\n* @task T1677\n* @epic T1676\n*/\n/**\n* Maps each provider transport to its canonical environment variable name.\n*\n* NOTE: `bedrock` is informational — AWS Bedrock uses the AWS SDK credential\n* chain (`AWS_PROFILE` / `~/.aws/credentials` / IAM role / SSO), not a single\n* API-key env var. The credential-pool resolves Bedrock via `authType: 'aws_sdk'`\n* and never reads the `accessToken` field from env.\n*\n* Exported so concrete seeders (e.g. the env seeder under\n* `./credential-seeders/env-seeder.ts`) reuse the same mapping instead of\n* inlining a duplicate. Treat this as the single source of truth for\n* `(provider → env var name)`.\n*\n* @task T9409\n*/\nvar ENV_VARS = {\n\tanthropic: \"ANTHROPIC_API_KEY\",\n\topenai: \"OPENAI_API_KEY\",\n\tgemini: \"GEMINI_API_KEY\",\n\tmoonshot: \"MOONSHOT_API_KEY\",\n\topenrouter: \"OPENROUTER_API_KEY\",\n\tbedrock: \"AWS_PROFILE\",\n\tdeepseek: \"DEEPSEEK_API_KEY\",\n\txai: \"XAI_API_KEY\",\n\tgroq: \"GROQ_API_KEY\",\n\t\"kimi-code\": \"KIMI_CODE_API_KEY\",\n\tollama: \"OLLAMA_HOST\"\n};\n/**\n* Path to the global CLEO config file.\n*\n* Canonical location is the XDG **config** dir (`~/.config/cleo/config.json`\n* on Linux) — T9405 moved it here from the data dir to comply with XDG. The\n* data-dir copy is still consulted as a read-only fallback during the\n* transition window via {@link readGlobalProviderKey}; existing installs are\n* migrated in-place on first credentials read by\n* {@link ensureGlobalConfigMigrated}.\n*/\nfunction globalConfigPath() {\n\treturn configDirGlobalConfigPath();\n}\n/** Path to the project-level CLEO config file. */\nfunction projectConfigPath(projectRoot) {\n\treturn join(projectRoot, process.env[\"CLEO_DIR\"] ?? \".cleo\", \"config.json\");\n}\n/**\n* Tier 4a reader — finds the global provider key, preferring the config-dir\n* location and falling back to the legacy data-dir location during the\n* transition window (T9405).\n*\n* Migration runs at most once per process via {@link ensureGlobalConfigMigrated}\n* so the data-dir fallback is only reachable when the migration itself failed\n* (e.g. permission errors) or when a brand-new file lands in the data dir\n* after the marker was already stamped. Both situations resolve to the legacy\n* copy so users never get a \"key disappeared\" surprise.\n*/\nfunction readGlobalProviderKey(provider) {\n\tensureGlobalConfigMigrated();\n\tconst configDirKey = readProviderKeyFromConfig(globalConfigPath(), provider);\n\tif (configDirKey) return configDirKey;\n\treturn readProviderKeyFromConfig(legacyGlobalConfigPath(), provider);\n}\n/**\n* Tier 4b backward compat: read the legacy flat key file written by\n* `storeAnthropicApiKey()` before T1677 migrated storage to config.json.\n*\n* File: `~/.local/share/cleo/anthropic-key` (plain text, one line).\n* Returns null when the file does not exist or is empty.\n*/\nfunction readFlatAnthropicKey() {\n\ttry {\n\t\tconst keyFile = join(getCleoHome(), \"anthropic-key\");\n\t\tif (!existsSync(keyFile)) return null;\n\t\treturn readFileSync(keyFile, \"utf-8\").trim() || null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n/**\n* Read `llm.providers[provider].apiKey` from a JSON config file.\n* Returns null on any error or missing key.\n*/\nfunction readProviderKeyFromConfig(configFile, provider) {\n\ttry {\n\t\tif (!existsSync(configFile)) return null;\n\t\tconst raw = readFileSync(configFile, \"utf-8\");\n\t\tconst llm = JSON.parse(raw)[\"llm\"];\n\t\tif (!llm || typeof llm !== \"object\") return null;\n\t\tconst providers = llm[\"providers\"];\n\t\tif (!providers || typeof providers !== \"object\") return null;\n\t\tconst entry = providers[provider];\n\t\tif (!entry || typeof entry !== \"object\") return null;\n\t\tconst apiKey = entry[\"apiKey\"];\n\t\tif (typeof apiKey === \"string\" && apiKey.trim()) return apiKey.trim();\n\t\treturn null;\n\t} catch {\n\t\treturn null;\n\t}\n}\n/**\n* Resolve the API key for a provider using the synchronous tier chain.\n*\n* Resolution order (first non-empty match wins):\n* 1. `options.apiKey`  — explicit caller override\n* 2. `ENV_VARS[provider]` environment variable\n* 3. `~/.cleo/llm-credentials.json` — unified credential pool (read-only;\n*    seeding is the unified pool's responsibility — the sync path does not\n*    re-seed)\n* 4a. `~/.cleo/config.json` → `llm.providers[provider].apiKey` — **deprecated**\n*     (emits stderr warning; still resolves during the transition window)\n* 5. `<projectRoot>/.cleo/config.json` → `llm.providers[provider].apiKey` —\n*    **rejected** (T-E2-6 footgun kill; emits stderr warning, never resolves)\n*\n* Direct reading of `~/.claude/.credentials.json` was removed in T9413; the\n* `claude-code` seeder is now the sole owner of that file and its imported\n* entries land in the pool, which the tier-3 read picks up.\n*\n* For new code prefer {@link resolveCredentialsAsync}, which delegates to the\n* {@link UnifiedCredentialPool} singleton (`getCredentialPool().pick()`) and\n* triggers a lazy seed pass on first call. The sync variant is retained for\n* call-sites that cannot move to async (e.g. `defaultTransportApiKey`,\n* `resolveModelCredentials`).\n*\n* Never throws. All filesystem errors are caught and treated as \"not found\".\n*\n* @param provider - The LLM provider transport to resolve credentials for.\n* @param options  - Optional overrides and project root for tier 5 warning.\n* @returns A `CredentialResult` with `provider`, `apiKey`, and `source`.\n*\n* @example\n* ```ts\n* const cred = resolveCredentials('anthropic', { projectRoot: cwd });\n* if (!cred.apiKey) throw new Error('No Anthropic key found');\n* ```\n*\n* @task T9413\n* @epic E-CONFIG-AUTH-UNIFY\n*/\nfunction resolveCredentials(provider, options = {}) {\n\tensureLegacyFlatAnthropicKeyImported();\n\tif (options.apiKey?.trim()) {\n\t\tconst token = options.apiKey.trim();\n\t\treturn {\n\t\t\tprovider,\n\t\t\tapiKey: token,\n\t\t\tsource: \"explicit\",\n\t\t\tauthType: detectAuthType(provider, token)\n\t\t};\n\t}\n\tconst envVar = ENV_VARS[provider];\n\tconst envKey = process.env[envVar];\n\tif (envKey?.trim()) {\n\t\tconst token = envKey.trim();\n\t\treturn {\n\t\t\tprovider,\n\t\t\tapiKey: token,\n\t\t\tsource: \"env\",\n\t\t\tauthType: detectAuthType(provider, token)\n\t\t};\n\t}\n\tconst stored = pickCredentialForProviderSync(provider);\n\tif (stored) {\n\t\tconst wireAuthType = stored.authType === \"oauth\" ? \"oauth\" : \"api_key\";\n\t\treturn {\n\t\t\tprovider,\n\t\t\tapiKey: stored.accessToken || null,\n\t\t\tsource: \"cred-file\",\n\t\t\tauthType: wireAuthType\n\t\t};\n\t}\n\tconst globalKey = readGlobalProviderKey(provider);\n\tif (globalKey) {\n\t\twarnGlobalConfigApiKeyDeprecated(provider);\n\t\treturn {\n\t\t\tprovider,\n\t\t\tapiKey: globalKey,\n\t\t\tsource: \"global-config\",\n\t\t\tauthType: detectAuthType(provider, globalKey)\n\t\t};\n\t}\n\tif (provider === \"anthropic\") {\n\t\tconst flatKey = readFlatAnthropicKey();\n\t\tif (flatKey) return {\n\t\t\tprovider,\n\t\t\tapiKey: flatKey,\n\t\t\tsource: \"global-config\",\n\t\t\tauthType: detectAuthType(provider, flatKey)\n\t\t};\n\t}\n\tif (options.projectRoot) {\n\t\tif (readProviderKeyFromConfig(projectConfigPath(options.projectRoot), provider)) warnProjectConfigApiKeyRejected(provider);\n\t}\n\treturn {\n\t\tprovider,\n\t\tapiKey: null,\n\t\tsource: void 0,\n\t\tauthType: \"api_key\"\n\t};\n}\n/**\n* Latch the deprecation warning per (provider, message) so a hot loop does\n* not flood stderr. Keys are simple strings — small, opaque to the rest of\n* the module.\n*\n* @internal\n*/\nvar WARNED_GLOBAL_CONFIG = /* @__PURE__ */ new Set();\nvar WARNED_PROJECT_CONFIG = /* @__PURE__ */ new Set();\n/**\n* Emit a one-shot stderr warning that the global-config `apiKey` path is\n* deprecated. Re-emits only if the latch is cleared (test-only via\n* {@link _resetCredentialDeprecationLatchesForTests}).\n*\n* @internal\n* @task T9413\n*/\nfunction warnGlobalConfigApiKeyDeprecated(provider) {\n\tif (WARNED_GLOBAL_CONFIG.has(provider)) return;\n\tWARNED_GLOBAL_CONFIG.add(provider);\n\tprocess.stderr.write(`[cleo] DEPRECATED: \\`llm.providers.${provider}.apiKey\\` in the global config.json is deprecated and will be removed. Migrate with \\`cleo auth add ${provider}\\` or \\`cleo llm add\\`.\\n`);\n}\n/**\n* Emit a one-shot stderr warning that the project-config `apiKey` path is\n* rejected. The key is NOT resolved — operators must migrate.\n*\n* @internal\n* @task T9413\n*/\nfunction warnProjectConfigApiKeyRejected(provider) {\n\tif (WARNED_PROJECT_CONFIG.has(provider)) return;\n\tWARNED_PROJECT_CONFIG.add(provider);\n\tprocess.stderr.write(`[cleo] REJECTED: \\`llm.providers.${provider}.apiKey\\` in \\`.cleo/config.json\\` (project-scoped) is a security footgun and is no longer honoured. Run \\`cleo auth migrate-project-secrets\\` to move the key into the unified credential pool.\\n`);\n}\n/**\n* Detect whether a credential string is an Anthropic OAuth token by prefix.\n*\n* The Claude Code OAuth flow issues tokens with the prefixes:\n* - `sk-ant-oat-*` — access token (used for API calls)\n* - `sk-ant-ort-*` — refresh token (rare in direct calls, but recognized for safety)\n*\n* Every other provider in Phase 1 uses `api_key` authentication, so any\n* non-Anthropic credential is treated as `api_key`. Tokens loaded from\n* `claude-creds` are always `oauth` regardless of prefix (handled by the caller).\n*/\nfunction detectAuthType(provider, token) {\n\tif (provider !== \"anthropic\") return \"api_key\";\n\tif (token.startsWith(\"sk-ant-oat-\") || token.startsWith(\"sk-ant-ort-\")) return \"oauth\";\n\treturn \"api_key\";\n}\n/**\n* Build the authentication HTTP headers for a resolved credential.\n*\n* For raw-fetch call-sites (e.g. memory/sleep-consolidation, memory/observer-reflector)\n* this returns the full bag of provider-specific auth headers including the\n* `anthropic-version` or `anthropic-beta` markers that Anthropic requires.\n* The caller still owns `Content-Type` and the request body.\n*\n* Returns an empty object when `cred.apiKey` is null — callers should never\n* reach this helper without verifying they have a credential, but the no-op\n* fallback avoids accidental `undefined` header injection.\n*\n* @task T-LLM-CRED-CENTRALIZATION Phase 1\n*/\nfunction authHeaders(cred) {\n\tif (!cred.apiKey) return {};\n\tif (cred.provider === \"anthropic\") {\n\t\tif (cred.authType === \"oauth\") return {\n\t\t\tAuthorization: `Bearer ${cred.apiKey}`,\n\t\t\t\"anthropic-beta\": \"oauth-2025-04-20\",\n\t\t\t\"anthropic-version\": \"2023-06-01\"\n\t\t};\n\t\treturn {\n\t\t\t\"x-api-key\": cred.apiKey,\n\t\t\t\"anthropic-version\": \"2023-06-01\"\n\t\t};\n\t}\n\treturn { Authorization: `Bearer ${cred.apiKey}` };\n}\n/**\n* Build the provider auth headers AT THE WIRE directly from a sealed credential\n* handle — the E10 boundary primitive (T11754 · AC2).\n*\n* ## Why this exists\n*\n* The pre-E10 / interim pattern materialized the plaintext into a caller-visible\n* variable first — `const token = (await sealed.fetch()).value;` — and only then\n* called {@link authHeaders}. That intermediate `token` binding is a leak surface:\n* any code added between the `fetch()` and the header build could log, serialize,\n* or forward the bare secret.\n*\n* `authHeadersFromSealed` collapses those two steps into ONE chokepoint. It is\n* the SOLE place (alongside daemon worker-injection) that invokes\n* {@link SealedCredential.fetch} — the crypto decrypt happens inside the handle's\n* `fetch()`, the materialized {@link DecryptedToken} is consumed in-place to build\n* the `x-api-key` / `Authorization: Bearer` headers (per provider + scheme), and\n* the plaintext goes out of scope WITHOUT ever being returned, logged, or bound\n* to a caller variable. Callers receive ONLY the finished header bag.\n*\n* Invoke this ONLY at a wire boundary — `transportForProvider` /\n* `session-factory.ts:56`, the raw-fetch consumers (hygiene-scan,\n* duplicate-detector), or daemon worker-injection. Never to surface a key up the\n* resolver stack.\n*\n* @param sealed - The opaque credential handle returned by the resolver.\n* @param authType - The auth scheme to present the credential with (mirrors the\n*   resolved `credential.authType`). `'aws_sdk'` yields an empty bag — the AWS\n*   SDK injects credentials out-of-band, so there is no header to build.\n* @returns The provider-specific auth headers. The plaintext token is consumed\n*   internally and never escapes this function.\n* @task T11754\n*/\nasync function authHeadersFromSealed(sealed, authType) {\n\tif (authType === \"aws_sdk\") return {};\n\tconst decrypted = await sealed.fetch();\n\treturn authHeaders({\n\t\tprovider: sealed.provider,\n\t\tapiKey: decrypted.value,\n\t\tsource: void 0,\n\t\tauthType: authType === \"oauth\" ? \"oauth\" : \"api_key\"\n\t});\n}\n/**\n* No-op retained for test call-site compatibility.\n*\n* `resolveCredentials` does not maintain an internal cache, so there is\n* nothing to invalidate. Tests that call this function between assertions\n* continue to work correctly — they simply rely on the file-system / env-var\n* isolation they already set up.\n*/\nfunction clearAnthropicKeyCache() {}\n//#endregion\n//#region ../core/dist/llm/credentials-store.js\n/**\n* Multi-credential pool storage for the CLEO LLM layer (T-LLM-CRED Phase 2).\n*\n* Persists a versioned list of provider credentials at\n* `~/.cleo/llm-credentials.json` (XDG-aware, resolved via `getCleoHome()` so\n* the test-only `XDG_DATA_HOME` override applies identically to every CLEO\n* global file).\n*\n* ## Goals\n*\n* - Multiple credentials per provider (label → entry), each with priority,\n*   disabled-flag, expiry, and a free-form `metadata` bag.\n* - Strict 0600 perms on every successful write.\n* - Cross-process locking via `proper-lockfile` reused through `withLock`.\n* - Atomic writes via `writeJsonFileAtomic` (temp → rename + numbered backup).\n* - Synchronous read path so the resolver in `credentials.ts` can call it\n*   from its existing sync function.\n*\n* Design lock-in (per plan):\n*   • `provider` MUST be a valid `ModelTransport`.\n*   • `(provider, label)` is the uniqueness key — `addCredential` upserts.\n*   • `priority` defaults to `max(existing) + 10` so new entries lose to all\n*     existing ones unless an explicit priority is supplied.\n*   • Round-robin picker keeps state in-memory per provider — sufficient for\n*     a single-process orchestrator; durable round-robin is a future change.\n*   • Storage-time auth type widens the wire-time `AuthType` to include\n*     `'aws_sdk'` for forward-compat with Bedrock. `credentials.ts` narrows\n*     `'aws_sdk' → 'api_key'` until Phase 3 widens the on-wire union.\n*\n* Reference: Hermes `credential_pool.py:32-33` defined the on-disk schema\n* we mirror here.\n*\n* @module llm/credentials-store\n* @task T9257\n* @epic T-LLM-CRED-CENTRALIZATION\n*/\nvar logger = getLogger(\"llm-credentials-store\");\n/**\n* Absolute path of the credential store file.\n*\n* Resolved through `getCleoHome()` so XDG overrides apply uniformly with\n* `credentials.ts`'s global-config tier.\n*\n* @task T9257\n*/\nfunction credentialsStorePath() {\n\treturn join(getCleoHome(), \"llm-credentials.json\");\n}\n/**\n* Ensure the store file exists with a parseable empty-store body.\n*\n* `withLock` (file-utils) writes a zero-byte file when none exists so\n* `proper-lockfile` can hold the lock. The subsequent `readJsonFile` then\n* throws SyntaxError on the empty content. To avoid that, we pre-seed the\n* file with `{\"version\":1,\"defaultStrategy\":\"priorityWithFallback\",\n* \"credentials\":[]}` BEFORE acquiring the lock. The pre-seed is itself\n* race-tolerant: `writeFileSync({flag:'wx'})` makes creation idempotent\n* across concurrent callers — only the first one writes; the rest get\n* EEXIST and continue.\n*\n* @task T9257\n*/\nfunction ensureFileInitialized(path) {\n\tif (existsSync(path)) return;\n\tconst dir = dirname(path);\n\tif (!existsSync(dir)) mkdirSync(dir, {\n\t\trecursive: true,\n\t\tmode: 448\n\t});\n\telse try {\n\t\tchmodSync(dir, 448);\n\t} catch {}\n\ttry {\n\t\twriteFileSync(path, `${JSON.stringify(emptyStore(), null, 2)}\\n`, {\n\t\t\tencoding: \"utf-8\",\n\t\t\tflag: \"wx\",\n\t\t\tmode: 384\n\t\t});\n\t} catch (err) {\n\t\tif (err.code !== \"EEXIST\") throw err;\n\t}\n}\n/**\n* S-02 (CWE-367 TOCTOU rename→chmod): the previous `enforce0600(path)`\n* helper used to chmod the live file AFTER `withLock` released its\n* lock. That left a window in which the temp file (default 0o644)\n* was the live file, no lock held, with secrets in it. The window\n* is now closed at the source: `writeJsonFileAtomic({mode: 0o600})`\n* creates the temp file pre-set to 0o600, so the post-rename file\n* is born 0o600 atomically. No follow-up chmod is needed.\n*\n* Kept here as a doc-only stub so a `git log --grep=enforce0600`\n* search points future readers at this rationale; the function and\n* every call-site are removed below.\n*\n* @task T9257 — security review S-02\n*/\n/**\n* Warn once when the file is loosely permissioned.\n*\n* Read-side check — we never refuse to read, but we surface the risk via\n* the project logger so an operator can investigate.\n*\n* @task T9257\n*/\nvar _warnedLoosePerms = false;\nfunction checkPermsOnRead(path) {\n\tif (_warnedLoosePerms) return;\n\ttry {\n\t\tconst mode = statSync(path).mode & 511;\n\t\tif (mode !== 384 && mode !== 0) {\n\t\t\tlogger.warn({\n\t\t\t\tpath,\n\t\t\t\tmode: mode.toString(8)\n\t\t\t}, \"llm-credentials-store: file perms looser than 0600\");\n\t\t\t_warnedLoosePerms = true;\n\t\t}\n\t} catch {}\n}\n/**\n* Default on-disk shape when no file exists yet.\n*/\nfunction emptyStore() {\n\treturn {\n\t\tversion: 1,\n\t\tdefaultStrategy: \"priorityWithFallback\",\n\t\tcredentials: []\n\t};\n}\n/**\n* Synchronous file read + parse. Never throws.\n*\n* Returns an empty store when the file is missing, unreadable, malformed,\n* or has the wrong `version`.\n*\n* @task T9257\n*/\nfunction readStoreSync() {\n\tconst path = credentialsStorePath();\n\tlet raw;\n\ttry {\n\t\traw = readFileSync(path, \"utf-8\");\n\t} catch {\n\t\treturn emptyStore();\n\t}\n\tcheckPermsOnRead(path);\n\tif (!raw.trim()) return emptyStore();\n\ttry {\n\t\tconst parsed = JSON.parse(raw);\n\t\tif (parsed.version !== 1 || !Array.isArray(parsed.credentials)) return emptyStore();\n\t\treturn {\n\t\t\tversion: 1,\n\t\t\tdefaultStrategy: parsed.defaultStrategy ?? \"priorityWithFallback\",\n\t\t\tcredentials: parsed.credentials.filter((c) => isStoredCredential(c))\n\t\t};\n\t} catch {\n\t\treturn emptyStore();\n\t}\n}\n/**\n* Type-narrow check used during read to drop malformed entries silently.\n*/\nfunction isStoredCredential(value) {\n\tif (!value || typeof value !== \"object\") return false;\n\tconst v = value;\n\tconst provider = v[\"provider\"];\n\tconst label = v[\"label\"];\n\tconst authType = v[\"authType\"];\n\tconst accessToken = v[\"accessToken\"];\n\tconst validProvider = provider === \"anthropic\" || provider === \"openai\" || provider === \"gemini\" || provider === \"moonshot\" || provider === \"kimi-code\" || provider === \"openrouter\" || provider === \"bedrock\" || provider === \"deepseek\" || provider === \"xai\" || provider === \"groq\";\n\tconst validAuth = authType === \"api_key\" || authType === \"oauth\" || authType === \"aws_sdk\";\n\tif (!validProvider) return false;\n\tif (typeof label !== \"string\" || !label) return false;\n\tif (!validAuth) return false;\n\tif (typeof accessToken !== \"string\") return false;\n\treturn true;\n}\n/**\n* Round-robin cursor map (per provider).\n*\n* In-memory by design: the store is single-process for the orchestrator\n* fleet, and durable round-robin would require an additional write-on-pick\n* which is not worth the cost in Phase 2.\n*/\nvar _rrIndex = /* @__PURE__ */ new Map();\n/**\n* Filter `credentials` to `(provider, !disabled, !expired)` and apply\n* `preferLabel` when present.\n*\n* Returns `[]` when nothing eligible remains. Otherwise returns entries\n* sorted by priority ascending (stable for equal priorities).\n*\n* @task T9257\n*/\nfunction eligibleForProvider(data, provider, preferLabel) {\n\tconst now = Date.now();\n\tconst all = data.credentials.filter((c) => {\n\t\tif (c.provider !== provider) return false;\n\t\tif (c.disabled === true) return false;\n\t\tif (typeof c.expiresAt === \"number\" && c.expiresAt > 0 && c.expiresAt <= now) {\n\t\t\tlogger.info({\n\t\t\t\tprovider: c.provider,\n\t\t\t\tlabel: c.label,\n\t\t\t\texpiresAt: c.expiresAt\n\t\t\t}, \"cred-file: skipping expired entry\");\n\t\t\treturn false;\n\t\t}\n\t\treturn true;\n\t});\n\tif (preferLabel) {\n\t\tconst exact = all.find((c) => c.label === preferLabel);\n\t\treturn exact ? [exact] : [];\n\t}\n\treturn [...all].sort((a, b) => a.priority - b.priority);\n}\n/**\n* Synchronous variant of `pickCredentialForProvider`. Called from\n* `credentials.ts`'s sync `resolveCredentials()` tier-3 block. See the\n* async wrapper below for the canonical public API.\n*\n* Strategy resolution falls back to the store's `defaultStrategy` when\n* `opts.strategy` is not provided. Empty / disabled / expired pools yield\n* `null`.\n*\n* @task T9257\n*/\nfunction pickCredentialForProviderSync(provider, opts = {}) {\n\tconst data = readStoreSync();\n\tconst eligible = eligibleForProvider(data, provider, opts.preferLabel);\n\tif (eligible.length === 0) return null;\n\tif (opts.preferLabel) return eligible[0] ?? null;\n\tswitch (opts.strategy ?? data.defaultStrategy ?? \"priorityWithFallback\") {\n\t\tcase \"priorityOnly\":\n\t\tcase \"priorityWithFallback\": return eligible[0] ?? null;\n\t\tcase \"roundRobin\": {\n\t\t\tconst next = (_rrIndex.get(provider) ?? 0) % eligible.length;\n\t\t\t_rrIndex.set(provider, next + 1);\n\t\t\treturn eligible[next] ?? null;\n\t\t}\n\t\tdefault: return eligible[0] ?? null;\n\t}\n}\n/**\n* List credentials in the pool, optionally filtered to a single provider.\n*\n* Returns `[]` when the file does not exist. Never throws.\n*\n* @task T9257\n*/\nasync function listCredentials(provider) {\n\tconst data = readStoreSync();\n\tif (!provider) return [...data.credentials];\n\treturn data.credentials.filter((c) => c.provider === provider);\n}\n/**\n* Look up a single credential by `(provider, label)`. Returns `null` when\n* no match exists.\n*\n* @task T9257\n*/\nasync function getCredentialByLabel(provider, label) {\n\treturn readStoreSync().credentials.find((c) => c.provider === provider && c.label === label) ?? null;\n}\n/**\n* Upsert a credential — replaces any existing `(provider, label)` pair.\n*\n* - When `input.priority` is omitted, the new entry receives\n*   `max(existing priorities) + 10` so it ranks lowest by default.\n* - Acquires the file lock via `withLock`; safe under concurrent writers.\n* - chmod 0600 is enforced on the written file.\n*\n* Returns the inserted (or replaced) entry as it now lives in the file.\n*\n* @task T9257\n*/\nasync function addCredential(input) {\n\tconst path = credentialsStorePath();\n\tensureFileInitialized(path);\n\tlet inserted = null;\n\tawait withLock(path, (current) => {\n\t\tconst data = current ?? emptyStore();\n\t\tif (data.version !== 1) {\n\t\t\tdata.version = 1;\n\t\t\tdata.credentials = [];\n\t\t}\n\t\tdata.defaultStrategy ??= \"priorityWithFallback\";\n\t\tconst remaining = data.credentials.filter((c) => !(c.provider === input.provider && c.label === input.label));\n\t\tconst maxPriority = remaining.reduce((m, c) => c.priority > m ? c.priority : m, -10);\n\t\tconst priority = typeof input.priority === \"number\" ? input.priority : maxPriority + 10;\n\t\tconst next = {\n\t\t\tprovider: input.provider,\n\t\t\tlabel: input.label,\n\t\t\tauthType: input.authType,\n\t\t\taccessToken: input.accessToken,\n\t\t\texpiresAt: input.expiresAt ?? null,\n\t\t\tpriority,\n\t\t\tsource: input.source,\n\t\t\tbaseUrl: input.baseUrl ?? null,\n\t\t\textraHeaders: input.extraHeaders,\n\t\t\tmetadata: input.metadata,\n\t\t\tlastStatus: input.lastStatus,\n\t\t\tlastErrorCode: input.lastErrorCode,\n\t\t\tlastErrorResetAt: input.lastErrorResetAt,\n\t\t\trequestCount: input.requestCount,\n\t\t\tdisabled: input.disabled ?? false,\n\t\t\t...input.refreshToken !== void 0 && { refreshToken: input.refreshToken }\n\t\t};\n\t\tdata.credentials = [...remaining, next];\n\t\tinserted = next;\n\t\treturn data;\n\t}, { mode: 384 });\n\tif (!inserted) throw new Error(\"credentials-store: invariant violation — insert was not recorded\");\n\treturn inserted;\n}\n/**\n* Remove a credential by `(provider, label)`.\n*\n* Returns `true` when a matching entry was found and removed, `false`\n* otherwise. Does NOT create the file when it does not yet exist.\n*\n* @task T9257\n*/\nasync function removeCredential(provider, label) {\n\tconst path = credentialsStorePath();\n\tif (!readStoreSync().credentials.some((c) => c.provider === provider && c.label === label)) return false;\n\tensureFileInitialized(path);\n\tlet removed = false;\n\tawait withLock(path, (current) => {\n\t\tconst data = current ?? emptyStore();\n\t\tif (data.version !== 1 || !Array.isArray(data.credentials)) return emptyStore();\n\t\tconst before = data.credentials.length;\n\t\tdata.credentials = data.credentials.filter((c) => !(c.provider === provider && c.label === label));\n\t\tremoved = data.credentials.length < before;\n\t\tdata.defaultStrategy ??= \"priorityWithFallback\";\n\t\treturn data;\n\t}, { mode: 384 });\n\tif (removed);\n\treturn removed;\n}\n/**\n* Public async picker — thin wrapper over `pickCredentialForProviderSync`.\n*\n* The sync variant exists because the resolver in `credentials.ts` is\n* synchronous; both paths share the same filter + strategy logic.\n*\n* @task T9257\n*/\nasync function pickCredentialForProvider(provider, opts = {}) {\n\treturn pickCredentialForProviderSync(provider, opts);\n}\n//#endregion\n//#region ../core/dist/llm/oauth/device-code.js\n/**\n* Build the `DeviceCodeConfig` for Kimi Code (kimi.com/code).\n*\n* Authentication endpoints are hosted at `auth.kimi.com` (override via\n* `KIMI_CODE_OAUTH_HOST` env var). The shared community client ID is reused\n* by kimi-cli and other integrations — no private registration required.\n*\n* Token lifecycle:\n*   - Access token: ~15 minutes\n*   - Refresh token: ~30 days\n*   - Recommended refresh strategy: 50% of lifetime or 300s, whichever is larger\n*\n* After OAuth completes, the resulting bearer token targets\n* `https://api.kimi.com/coding` (Anthropic Messages protocol). The six\n* mandatory `X-Msh-*` headers — built by {@link getKimiCodeMshHeaders} — MUST\n* be merged into every chat request alongside the bearer token.\n*\n* @returns Device-code configuration for Kimi Code OAuth.\n*\n* @task T9321\n* @epic T9261 T-LLM-CRED-CENTRALIZATION\n* @see https://github.com/gsd-build/gsd-2/issues/4642 — design reference\n* @see MoonshotAI/kimi-cli `src/kimi_cli/auth/oauth.py` — protocol reference\n*/\nfunction getKimiCodeDeviceCodeConfig() {\n\tconst host = process.env[\"KIMI_CODE_OAUTH_HOST\"] ?? \"https://auth.kimi.com\";\n\treturn {\n\t\tprovider: \"kimi-code\",\n\t\tdeviceCodeUrl: `${host}/api/oauth/device_authorization`,\n\t\ttokenUrl: `${host}/api/oauth/token`,\n\t\tclientId: \"17e5f671-d194-4dfb-9706-5516cb48c098\"\n\t};\n}\n//#endregion\n//#region ../core/dist/llm/credential-pool.js\n/**\n* CredentialPool — rotation + cooldown manager for the CLEO LLM credential\n* layer (T-LLM-CRED-CENTRALIZATION Phase 3 / T9265).\n*\n* Ports the Hermes `credential_pool.py` rotation strategies and cooldown\n* clocks to TypeScript, re-using the existing `credentials-store.ts` I/O\n* primitives (addCredential, listCredentials, getCredentialByLabel) for all\n* persistence so no new file-locking or write paths are introduced.\n*\n* ## Rotation strategies\n*\n* - `fill_first` (default): Iterate entries sorted by `priority` descending\n*   (higher = preferred); return the first that is not in active cooldown.\n* - `round_robin`: Advance a per-provider in-memory cursor; skip cooled-down\n*   entries until a healthy one is found.\n* - `least_used`: Pick the entry with the lowest `requestCount` that is not\n*   in active cooldown; tie-break by `priority` descending.\n*\n* ## Cooldown semantics (mirrored from Hermes)\n*\n* | HTTP code | Cooldown  |\n* |-----------|-----------|\n* | 401       | 5 minutes |\n* | 402       | 5 minutes |\n* | 429       | 1 hour    |\n* | 5xx       | 60 seconds|\n* | other     | 60 seconds|\n*\n* Reference: `hermes-agent/agent/credential_pool.py:92-1095`\n*\n* @module llm/credential-pool\n* @task T9265\n* @epic T-LLM-CRED-CENTRALIZATION\n*/\n/** Cooldown applied to 401 (auth) and 402 (billing) errors: 5 minutes. */\nvar COOLDOWN_AUTH_MS = 300 * 1e3;\n/** Cooldown applied to 429 (rate-limited) errors: 1 hour. */\nvar COOLDOWN_RATE_LIMIT_MS = 3600 * 1e3;\n/** Default cooldown for 5xx and all other error codes: 60 seconds. */\nvar COOLDOWN_DEFAULT_MS = 60 * 1e3;\n/**\n* Proactive refresh threshold: at least 300 seconds (5 minutes) before expiry.\n*\n* The proactive window is `max(expiresIn * 0.5, PROACTIVE_REFRESH_FLOOR_MS)`.\n* For Kimi Code's ~15 min access tokens: 50% = 450s > 300s → uses 450s.\n* For very short tokens (< 600s): 50% < 300s → floor kicks in at 300s.\n*\n* @task T9323\n*/\nvar PROACTIVE_REFRESH_FLOOR_MS = 3e5;\n/**\n* Thrown by `CredentialPool.pick()` when every entry for the provider is\n* currently in active cooldown (i.e., the pool is fully exhausted).\n*\n* Callers should surface this as a retryable, time-bounded failure. The\n* earliest retry time can be derived from `minResetAt` (epoch ms).\n*\n* @task T9265\n*/\nvar PoolExhaustedError = class extends Error {\n\tprovider;\n\tpoolSize;\n\tminResetAt;\n\t/** Stable LAFS error code. */\n\tcode = \"E_LLM_POOL_EXHAUSTED\";\n\t/**\n\t* @param provider   - The provider whose pool is exhausted.\n\t* @param poolSize   - Total number of entries in the pool.\n\t* @param minResetAt - Epoch ms of the earliest cooldown expiry (may be 0 if\n\t*                     all entries lack a reset timestamp).\n\t*/\n\tconstructor(provider, poolSize, minResetAt) {\n\t\tsuper(`E_LLM_POOL_EXHAUSTED: all ${poolSize} credential(s) for provider '${provider}' are in active cooldown. Earliest reset: ${minResetAt > 0 ? new Date(minResetAt).toISOString() : \"unknown\"}.`);\n\t\tthis.provider = provider;\n\t\tthis.poolSize = poolSize;\n\t\tthis.minResetAt = minResetAt;\n\t\tthis.name = \"PoolExhaustedError\";\n\t}\n};\n/**\n* Compute the cooldown duration in milliseconds for a given HTTP error code.\n*\n* Mirrors `hermes-agent/agent/credential_pool.py:_exhausted_ttl`.\n*\n* @param errorCode - HTTP status code that triggered the exhaustion.\n* @returns Cooldown duration in milliseconds.\n*\n* @task T9265\n*/\nfunction cooldownMs(errorCode) {\n\tif (errorCode === 401 || errorCode === 402) return COOLDOWN_AUTH_MS;\n\tif (errorCode === 429) return COOLDOWN_RATE_LIMIT_MS;\n\treturn COOLDOWN_DEFAULT_MS;\n}\n/**\n* Return `true` when the credential is currently in active cooldown.\n*\n* A credential is in cooldown when `lastErrorResetAt` is set AND its value is\n* strictly greater than `Date.now()`.\n*\n* @param credential - The entry to check.\n* @returns `true` if the entry should be skipped by the picker.\n*\n* @task T9265\n*/\nfunction isInCooldown(credential) {\n\treturn typeof credential.lastErrorResetAt === \"number\" && Date.now() < credential.lastErrorResetAt;\n}\n/**\n* Sort entries by priority descending (higher priority = more preferred).\n*\n* `StoredCredential.priority` is stored ascending (lower = higher priority) in\n* the existing store convention. The pool inverts this so that the\n* highest-priority entry is first in the returned array.\n*\n* @param entries - Unsorted credential entries.\n* @returns New array sorted by priority descending.\n*\n* @task T9265\n*/\nfunction sortByPriorityDesc(entries) {\n\treturn [...entries].sort((a, b) => b.priority - a.priority);\n}\n/**\n* Per-`(provider, label)` in-flight refresh promise.\n*\n* When N concurrent callers arrive with the same expired credential, only the\n* first one POSTs to the token endpoint. All others await the same Promise so\n* the endpoint is called exactly once per concurrent burst.\n*\n* The key is `\"${provider}::${label}\"`. The map is cleared when the Promise\n* resolves (or rejects) so the next caller after a settled refresh starts a\n* fresh attempt.\n*\n* @internal\n* @task T11986\n*/\nvar _refreshInFlight = /* @__PURE__ */ new Map();\n/**\n* TTL for a negative-cache entry after a failed refresh attempt (30 seconds).\n*\n* Prevents hammering the token endpoint when the refresh token is invalid or\n* the server is returning errors. After the TTL the next resolution attempt\n* will retry the refresh.\n*\n* @internal\n* @task T11986\n*/\nvar REFRESH_NEGATIVE_CACHE_TTL_MS = 3e4;\n/**\n* Negative-cache map: `\"${provider}::${label}\" → epoch ms when the failed entry expires`.\n*\n* An entry in this map means \"the last refresh of this credential failed; skip\n* until the timestamp has passed\".\n*\n* @internal\n* @task T11986\n*/\nvar _refreshNegativeCache = /* @__PURE__ */ new Map();\n/**\n* Refresh every expired-but-refreshable OAuth credential for `provider`,\n* with single-flight coalescing and a negative-cache on failure.\n*\n* ## Design (T11986 · DHQ-087)\n*\n* Called by `cross-provider-selector.ts` **before** the provisioning probe so\n* that an expired OAuth credential is renewed in-place and the selector sees\n* a valid token instead of filtering the provider as \"not-provisioned\".\n*\n* Single-flight: concurrent callers sharing the same `(provider, label)` key\n* coalesce on one in-flight Promise — the token endpoint is called at most\n* once per concurrent burst. After the Promise settles the key is deleted so\n* the next caller starts fresh.\n*\n* Negative-cache: a failed refresh stamps a 30-second suppression window.\n* During that window subsequent calls skip the refresh attempt rather than\n* hammering the endpoint with doomed requests.\n*\n* On total failure (every eligible entry failed): returns an `actionableHint`\n* with the exact re-login command (`cleo login ${provider}`).\n*\n* Note: `CredentialPool._refreshOAuthCredential` swallows errors silently by\n* design (its caller's retry path handles 401s). Here we need to surface\n* failures so callers can show actionable hints. We therefore attempt the\n* refresh via a fresh `CredentialPool` instance and check the credential store\n* for an updated `expiresAt` after the attempt to distinguish success from\n* failure.\n*\n* @param provider - The LLM transport provider to refresh credentials for.\n* @returns Refresh outcome with counts, last error, and actionable hint.\n*\n* @task T11986\n*/\nasync function refreshExpiredOAuthForProvider(provider) {\n\tconst entries = await listCredentials(provider);\n\tconst now = Date.now();\n\tlet attempted = 0;\n\tlet refreshed = 0;\n\tlet lastError = null;\n\tfor (const entry of entries) {\n\t\tif (entry.authType !== \"oauth\") continue;\n\t\tif (!entry.refreshToken) continue;\n\t\tif (entry.disabled === true) continue;\n\t\tif (!(typeof entry.expiresAt === \"number\" && entry.expiresAt > 0 && entry.expiresAt <= now + PROACTIVE_REFRESH_FLOOR_MS)) continue;\n\t\tconst key = `${provider}::${entry.label}`;\n\t\tconst negExpiry = _refreshNegativeCache.get(key);\n\t\tif (typeof negExpiry === \"number\" && now < negExpiry) {\n\t\t\tattempted += 1;\n\t\t\tlastError = lastError ?? /* @__PURE__ */ new Error(`OAuth refresh suppressed for ${provider}::${entry.label} (negative cache active)`);\n\t\t\tcontinue;\n\t\t}\n\t\tattempted += 1;\n\t\tlet inFlight = _refreshInFlight.get(key);\n\t\tif (!inFlight) {\n\t\t\tconst pool = new CredentialPool(provider);\n\t\t\tconst expiresAtBefore = entry.expiresAt;\n\t\t\tinFlight = pool.proactiveRefresh(entry.label).then(async (wasAttempted) => {\n\t\t\t\tif (!wasAttempted) return true;\n\t\t\t\tconst after = await getCredentialByLabel(provider, entry.label);\n\t\t\t\tif (!(after !== null && typeof after.expiresAt === \"number\" && after.expiresAt > (expiresAtBefore ?? 0))) throw new Error(`OAuth refresh token exchange failed for ${provider}::${entry.label} — the stored token may be revoked. Run \\`cleo login ${provider}\\` to re-authenticate.`);\n\t\t\t\treturn true;\n\t\t\t}).finally(() => {\n\t\t\t\t_refreshInFlight.delete(key);\n\t\t\t});\n\t\t\t_refreshInFlight.set(key, inFlight);\n\t\t}\n\t\ttry {\n\t\t\tawait inFlight;\n\t\t\trefreshed += 1;\n\t\t} catch (err) {\n\t\t\tlastError = err instanceof Error ? err : new Error(String(err));\n\t\t\t_refreshNegativeCache.set(key, Date.now() + REFRESH_NEGATIVE_CACHE_TTL_MS);\n\t\t}\n\t}\n\tconst actionableHint = attempted > 0 && refreshed === 0 && lastError !== null ? `OAuth refresh failed for provider '${provider}'. Run \\`cleo login ${provider}\\` to re-authenticate.` : null;\n\treturn {\n\t\tattempted,\n\t\trefreshed,\n\t\tlastError,\n\t\tactionableHint\n\t};\n}\n/**\n* Pool manager that wraps the credential store for a single provider.\n*\n* Responsibilities:\n*   - Pick a non-cooldown credential using one of three rotation strategies.\n*   - Persist `lastStatus`, `lastErrorCode`, `lastErrorResetAt`, and\n*     `requestCount` back to the store via `addCredential` upsert on every\n*     state change.\n*   - Maintain an in-memory round-robin cursor (per instance) for `round_robin`\n*     strategy calls.\n*\n* Instantiate one `CredentialPool` per provider. The pool is stateless beyond\n* the RR cursor — all durable state lives in the credential store file.\n*\n* @example\n* ```ts\n* const pool = new CredentialPool('anthropic');\n* const { credential } = await pool.pick({ strategy: 'round_robin' });\n* try {\n*   await callApi(credential.accessToken);\n*   await pool.markOk(credential.label);\n* } catch (err) {\n*   await pool.markExhausted(credential.label, err.status ?? 500);\n* }\n* ```\n*\n* @task T9265\n*/\nvar CredentialPool = class {\n\tprovider;\n\t/**\n\t* In-memory round-robin cursor keyed on provider (one entry per instance\n\t* since each instance is scoped to one provider). Reset to 0 on construction.\n\t*/\n\trrCursor = 0;\n\t/**\n\t* @param provider - The LLM transport this pool manages.\n\t*/\n\tconstructor(provider) {\n\t\tthis.provider = provider;\n\t}\n\t/**\n\t* Pick a non-cooldown credential for the provider using the requested\n\t* rotation strategy.\n\t*\n\t* Side-effect: increments `requestCount` on the picked entry and persists\n\t* the change via `addCredential` upsert.\n\t*\n\t* @param opts - Optional pick options (strategy). Defaults to `fill_first`.\n\t* @returns The selected credential plus pool metadata.\n\t* @throws {PoolExhaustedError} When all entries are in active cooldown.\n\t*\n\t* @task T9265\n\t*/\n\tasync pick(opts) {\n\t\tconst nonDisabled = (await listCredentials(this.provider)).filter((c) => !c.disabled);\n\t\tconst eligible = [];\n\t\tfor (const entry of nonDisabled) if (await rateLimitRemaining(this.provider, entry.label) == null) eligible.push(entry);\n\t\tconst poolSize = nonDisabled.length;\n\t\tif (nonDisabled.length === 0) throw new PoolExhaustedError(this.provider, 0, 0);\n\t\tif (eligible.length === 0) {\n\t\t\tconst minResetAt = nonDisabled.map((c) => c.lastErrorResetAt ?? 0).reduce((min, t) => t > 0 && (min === 0 || t < min) ? t : min, 0);\n\t\t\tthrow new PoolExhaustedError(this.provider, poolSize, minResetAt);\n\t\t}\n\t\tconst strategy = opts?.strategy ?? \"fill_first\";\n\t\tlet picked;\n\t\tswitch (strategy) {\n\t\t\tcase \"fill_first\":\n\t\t\t\tpicked = this._pickFillFirst(eligible);\n\t\t\t\tbreak;\n\t\t\tcase \"round_robin\":\n\t\t\t\tpicked = this._pickRoundRobin(eligible);\n\t\t\t\tbreak;\n\t\t\tcase \"least_used\":\n\t\t\t\tpicked = this._pickLeastUsed(eligible);\n\t\t\t\tbreak;\n\t\t}\n\t\tif (!picked) {\n\t\t\tconst minResetAt = eligible.map((c) => c.lastErrorResetAt ?? 0).reduce((min, t) => t > 0 && (min === 0 || t < min) ? t : min, 0);\n\t\t\tthrow new PoolExhaustedError(this.provider, poolSize, minResetAt);\n\t\t}\n\t\treturn {\n\t\t\tcredential: await addCredential({\n\t\t\t\t...picked,\n\t\t\t\trequestCount: (picked.requestCount ?? 0) + 1\n\t\t\t}),\n\t\t\tpoolSize\n\t\t};\n\t}\n\t/**\n\t* Mark a credential as exhausted, applying a cooldown based on the HTTP\n\t* error code. Persists `lastStatus`, `lastErrorCode`, and `lastErrorResetAt`\n\t* to the store.\n\t*\n\t* Cooldown durations:\n\t*   - 401 (auth)        → 5 minutes\n\t*   - 402 (billing)     → 5 minutes\n\t*   - 429 (rate-limit)  → 1 hour\n\t*   - 5xx / other       → 60 seconds\n\t*\n\t* @param label     - Credential label (unique within provider).\n\t* @param errorCode - HTTP status code that triggered the exhaustion.\n\t*\n\t* @task T9265\n\t*/\n\tasync markExhausted(label, errorCode) {\n\t\tconst existing = await getCredentialByLabel(this.provider, label);\n\t\tif (!existing) return;\n\t\tconst resetAt = Date.now() + cooldownMs(errorCode);\n\t\tawait addCredential({\n\t\t\t...existing,\n\t\t\tlastStatus: \"exhausted\",\n\t\t\tlastErrorCode: errorCode,\n\t\t\tlastErrorResetAt: resetAt\n\t\t});\n\t}\n\t/**\n\t* Mark a credential as healthy. Clears `lastStatus`, `lastErrorCode`, and\n\t* `lastErrorResetAt` so the entry re-enters the eligible pool immediately.\n\t*\n\t* @param label - Credential label (unique within provider).\n\t*\n\t* @task T9265\n\t*/\n\tasync markOk(label) {\n\t\tconst existing = await getCredentialByLabel(this.provider, label);\n\t\tif (!existing) return;\n\t\tawait addCredential({\n\t\t\t...existing,\n\t\t\tlastStatus: \"ok\",\n\t\t\tlastErrorCode: void 0,\n\t\t\tlastErrorResetAt: void 0\n\t\t});\n\t}\n\t/**\n\t* Proactively refresh an OAuth credential before it expires.\n\t*\n\t* Refresh is triggered when the remaining lifetime is less than\n\t* `max(expiresIn * 0.5, 300_000ms)`. For a credential without a known\n\t* `expiresIn`, only the 300s floor applies (requires `expiresAt`).\n\t*\n\t* For `api_key` and `aws_sdk` credentials this is a no-op.\n\t*\n\t* Supported refresh providers:\n\t* - `kimi-code` — posts to `auth.kimi.com/api/oauth/token` with\n\t*   `grant_type=refresh_token` and the stored `refreshToken`.\n\t*\n\t* On success, the new access token (and optional refreshed refresh token)\n\t* are persisted via `addCredential` upsert.\n\t*\n\t* @param label - Credential label (unique within provider).\n\t* @returns `true` when a refresh was attempted (regardless of success),\n\t*   `false` when no refresh was needed or the credential is not OAuth.\n\t* @task T9323\n\t*/\n\tasync proactiveRefresh(label) {\n\t\tconst existing = await getCredentialByLabel(this.provider, label);\n\t\tif (!existing) return false;\n\t\tif (existing.authType !== \"oauth\") return false;\n\t\tif (!existing.refreshToken) return false;\n\t\tif (existing.expiresAt == null) return false;\n\t\tif (existing.expiresAt - Date.now() >= PROACTIVE_REFRESH_FLOOR_MS) return false;\n\t\tawait this._refreshOAuthCredential(existing);\n\t\treturn true;\n\t}\n\t/**\n\t* Refresh every expired-but-refreshable OAuth credential for this provider\n\t* before a selection pass, so the role resolver renews a stale token instead\n\t* of silently filtering it out (which previously demoted resolution to a\n\t* lower-priority — or fake — credential).\n\t*\n\t* For each stored OAuth entry that is expired (or within the proactive-refresh\n\t* floor) AND carries a `refreshToken`, attempts a refresh via\n\t* {@link proactiveRefresh}. Entries without a refresh token, non-OAuth\n\t* entries, and still-valid tokens are left untouched. Errors are swallowed\n\t* per-entry — a failed refresh leaves the entry expired and the normal\n\t* eligible-filter still drops it.\n\t*\n\t* @returns The number of entries for which a refresh was attempted.\n\t* @task T11617\n\t*/\n\tasync refreshExpiredOAuth() {\n\t\tconst entries = await this.listEntries();\n\t\tlet attempted = 0;\n\t\tfor (const entry of entries) {\n\t\t\tif (entry.authType !== \"oauth\") continue;\n\t\t\tif (!entry.refreshToken) continue;\n\t\t\ttry {\n\t\t\t\tif (await this.proactiveRefresh(entry.label)) attempted += 1;\n\t\t\t} catch {}\n\t\t}\n\t\treturn attempted;\n\t}\n\t/**\n\t* List all entries for the provider sorted by priority descending\n\t* (highest priority = index 0).\n\t*\n\t* Includes both healthy and cooled-down entries — callers can inspect\n\t* `lastErrorResetAt` to determine cooldown state.\n\t*\n\t* @returns Immutable sorted array of all stored credentials for this provider.\n\t*\n\t* @task T9265\n\t*/\n\tasync listEntries() {\n\t\treturn sortByPriorityDesc(await listCredentials(this.provider));\n\t}\n\t/**\n\t* Perform the actual token refresh for a known OAuth credential.\n\t*\n\t* Dispatches based on `profile.oauth.mode`:\n\t* - `pkce` — uses `refreshPkceToken` (RFC 6749 §6 refresh via PKCE endpoint).\n\t* - `device-code` — uses the device-code token URL + clientId.\n\t* - No profile / unknown mode → no-op (caller's 401-retry handles it).\n\t*\n\t* Errors are silently swallowed — the caller's retry path will encounter a\n\t* 401 and trigger credential rotation if the token has actually expired.\n\t*\n\t* @param existing - The credential entry to refresh.\n\t* @task T9302 (generic PKCE dispatch, replaces anthropic-specific branch)\n\t* @task T9323 (device-code path)\n\t*/\n\tasync _refreshOAuthCredential(existing) {\n\t\tif (!existing.refreshToken) return;\n\t\tconst oauthCfg = (await getProviderProfile(this.provider))?.oauth;\n\t\tif (oauthCfg?.mode === \"pkce\") await this._refreshViaPkce(existing, oauthCfg.tokenEndpoint, oauthCfg.clientId, oauthCfg.tokenBodyFormat);\n\t\telse if (this.provider === \"kimi-code\") {\n\t\t\tconst cfg = getKimiCodeDeviceCodeConfig();\n\t\t\tawait this._refreshTokenViaEndpoint(existing, cfg.tokenUrl, cfg.clientId);\n\t\t}\n\t}\n\t/**\n\t* Refresh via RFC 7636 PKCE `refresh_token` grant using `refreshPkceToken`.\n\t*\n\t* On success, upserts the new access token (and optional refresh token)\n\t* into the credential store. Errors are silently swallowed.\n\t*\n\t* @param existing      - Credential entry to refresh.\n\t* @param tokenEndpoint - Provider token endpoint URL.\n\t* @param clientId      - OAuth client ID.\n\t* @param bodyFormat    - Token request body encoding (`'json'` for Anthropic).\n\t* @task T9302\n\t* @task T11958\n\t*/\n\tasync _refreshViaPkce(existing, tokenEndpoint, clientId, bodyFormat) {\n\t\tif (!existing.refreshToken) return;\n\t\tlet tokens;\n\t\ttry {\n\t\t\ttokens = await refreshPkceToken({\n\t\t\t\tprovider: existing.provider,\n\t\t\t\tclientId,\n\t\t\t\trefreshToken: existing.refreshToken,\n\t\t\t\ttokenEndpoint,\n\t\t\t\tbodyFormat\n\t\t\t});\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tawait addCredential({\n\t\t\t...existing,\n\t\t\taccessToken: tokens.accessToken,\n\t\t\trefreshToken: tokens.refreshToken ?? existing.refreshToken,\n\t\t\texpiresAt: tokens.expiresIn != null ? Date.now() + tokens.expiresIn * 1e3 : existing.expiresAt,\n\t\t\tlastStatus: \"ok\",\n\t\t\tlastErrorCode: void 0,\n\t\t\tlastErrorResetAt: void 0\n\t\t});\n\t}\n\t/**\n\t* Shared OAuth `refresh_token` grant implementation.\n\t*\n\t* POSTs `grant_type=refresh_token` to `tokenUrl` with the credential's\n\t* stored refresh token. On success, upserts the new access token (and\n\t* updated refresh token if provided) into the credential store.\n\t*\n\t* @param existing      - Credential entry to refresh.\n\t* @param tokenUrl      - Provider's token endpoint.\n\t* @param clientId      - OAuth client ID.\n\t* @param extraHeaders  - Optional provider-specific headers (e.g. Anthropic beta flags).\n\t* @task T9323\n\t*/\n\tasync _refreshTokenViaEndpoint(existing, tokenUrl, clientId, extraHeaders) {\n\t\tif (!existing.refreshToken) return;\n\t\tlet resp;\n\t\ttry {\n\t\t\tresp = await fetch(tokenUrl, {\n\t\t\t\tmethod: \"POST\",\n\t\t\t\theaders: {\n\t\t\t\t\t\"Content-Type\": \"application/x-www-form-urlencoded\",\n\t\t\t\t\tAccept: \"application/json\",\n\t\t\t\t\t...extraHeaders\n\t\t\t\t},\n\t\t\t\tbody: new URLSearchParams({\n\t\t\t\t\tgrant_type: \"refresh_token\",\n\t\t\t\t\tclient_id: clientId,\n\t\t\t\t\trefresh_token: existing.refreshToken\n\t\t\t\t}).toString()\n\t\t\t});\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tif (!resp.ok) return;\n\t\tlet data;\n\t\ttry {\n\t\t\tdata = await resp.json();\n\t\t} catch {\n\t\t\treturn;\n\t\t}\n\t\tconst newAccessToken = typeof data[\"access_token\"] === \"string\" ? data[\"access_token\"] : null;\n\t\tif (!newAccessToken) return;\n\t\tconst newExpiresIn = typeof data[\"expires_in\"] === \"number\" ? data[\"expires_in\"] : null;\n\t\tconst newRefreshToken = typeof data[\"refresh_token\"] === \"string\" ? data[\"refresh_token\"] : existing.refreshToken;\n\t\tawait addCredential({\n\t\t\t...existing,\n\t\t\taccessToken: newAccessToken,\n\t\t\trefreshToken: newRefreshToken,\n\t\t\texpiresAt: newExpiresIn != null ? Date.now() + newExpiresIn * 1e3 : existing.expiresAt,\n\t\t\tlastStatus: \"ok\",\n\t\t\tlastErrorCode: void 0,\n\t\t\tlastErrorResetAt: void 0\n\t\t});\n\t}\n\t/**\n\t* Fill-first: return the highest-priority entry not in cooldown.\n\t*\n\t* Entries are sorted descending by `priority` (store convention: higher\n\t* numeric priority = more preferred in pool). The first healthy entry wins.\n\t*\n\t* @param eligible - Non-disabled entries for the provider.\n\t* @returns The selected entry, or `undefined` if all are in cooldown.\n\t*\n\t* @task T9265\n\t*/\n\t_pickFillFirst(eligible) {\n\t\treturn sortByPriorityDesc(eligible).find((c) => !isInCooldown(c));\n\t}\n\t/**\n\t* Round-robin: advance the cursor across the priority-sorted list, skipping\n\t* cooled-down entries.\n\t*\n\t* The cursor is maintained in-memory per `CredentialPool` instance. It\n\t* advances even when an entry is skipped so a single cooled-down entry does\n\t* not permanently displace the rotation.\n\t*\n\t* @param eligible - Non-disabled entries for the provider.\n\t* @returns The selected entry, or `undefined` if all are in cooldown.\n\t*\n\t* @task T9265\n\t*/\n\t_pickRoundRobin(eligible) {\n\t\tconst sorted = sortByPriorityDesc(eligible);\n\t\tconst n = sorted.length;\n\t\tfor (let i = 0; i < n; i++) {\n\t\t\tconst idx = this.rrCursor % n;\n\t\t\tthis.rrCursor = idx + 1;\n\t\t\tconst candidate = sorted[idx];\n\t\t\tif (candidate && !isInCooldown(candidate)) return candidate;\n\t\t}\n\t}\n\t/**\n\t* Least-used: pick the entry with the lowest `requestCount` that is not in\n\t* cooldown. Ties are broken by `priority` descending (higher priority wins).\n\t*\n\t* @param eligible - Non-disabled entries for the provider.\n\t* @returns The selected entry, or `undefined` if all are in cooldown.\n\t*\n\t* @task T9265\n\t*/\n\t_pickLeastUsed(eligible) {\n\t\tconst healthy = eligible.filter((c) => !isInCooldown(c));\n\t\tif (healthy.length === 0) return void 0;\n\t\treturn healthy.sort((a, b) => {\n\t\t\tconst countDiff = (a.requestCount ?? 0) - (b.requestCount ?? 0);\n\t\t\tif (countDiff !== 0) return countDiff;\n\t\t\treturn b.priority - a.priority;\n\t\t})[0];\n\t}\n};\n/**\n* Seed-attempt cache TTL — 60 seconds per E2a §5.2 T-E2-5 acceptance criterion.\n*\n* After a successful (non-`force`) seed pass, repeat calls to `seed()` are\n* short-circuited until this TTL elapses. `force: true` always bypasses the\n* cache. `lazy-seed` from `pick()` also honours the cache.\n*\n* @task T9412\n*/\nvar POOL_SEED_CACHE_TTL_MS = 60 * 1e3;\n/**\n* Process-wide debug log channel — kept minimal so the pool does not pull in\n* the broader `cleo log` plumbing. Mirrors the pattern used by the per-provider\n* pool above.\n*\n* Reads `process.env.CLEO_DEBUG` at call time so tests can toggle without\n* module reload. Output goes to `console.debug` so it shows under `--verbose`\n* but stays out of clean CLI output by default.\n*\n* @internal\n*/\nfunction debugLog(msg, ...rest) {\n\tif (process.env[\"CLEO_DEBUG\"]) console.debug(`[cleo:credential-pool] ${msg}`, ...rest);\n}\n/**\n* Unified credential pool — drives every registered seeder, upserts the\n* discovered entries, and exposes `pick`/`list` over the populated store.\n*\n* Lifecycle:\n*\n*   1. First `pick()` (or explicit `seed()`) walks `BUILTIN_SEEDERS`.\n*   2. For each seeder: consent gate → suppression gate → `seed()` →\n*      upsert each returned entry via `addCredential` (preserves the\n*      seeder's `priority` hint when provided, otherwise the store's\n*      `max + 10` rule applies).\n*   3. A successful sweep stamps the cache; subsequent calls within\n*      {@link POOL_SEED_CACHE_TTL_MS} short-circuit unless `force: true`.\n*   4. `list()` reads the store directly — never triggers seeding so\n*      diagnostic surfaces (`cleo auth list`) are pure-read.\n*\n* Error isolation: a single seeder that throws does NOT short-circuit the\n* sweep. The failure is counted, the error stashed in `getSeederStatus`,\n* and the next seeder runs.\n*\n* @example\n* ```ts\n* const pool = getCredentialPool();\n* const entry = await pool.pick('anthropic');\n* if (entry) {\n*   // use entry.accessToken\n* }\n* ```\n*\n* @task T9412\n*/\nvar UnifiedCredentialPool = class {\n\tregistryGetter;\n\t/** Epoch ms of last successful seed pass (`0` = never seeded). */\n\tlastSeededAt = 0;\n\t/** Per-seeder diagnostics keyed on `${sourceId}::${provider}`. */\n\tseederStatus = /* @__PURE__ */ new Map();\n\t/**\n\t* Construct a pool wired to a specific seeder registry.\n\t*\n\t* Production code uses the {@link getCredentialPool} singleton which wires\n\t* to `BUILTIN_SEEDERS`. Tests pass a fresh `SeederRegistry` to isolate\n\t* registration semantics from the process-wide singleton.\n\t*\n\t* @param registryGetter - Getter that returns the active list of seeders.\n\t*   Defaults to `BUILTIN_SEEDERS.getAll()`. A getter (not the array\n\t*   directly) is used so the pool stays in sync with seeders registered\n\t*   after construction.\n\t*/\n\tconstructor(registryGetter = () => BUILTIN_SEEDERS.getAll()) {\n\t\tthis.registryGetter = registryGetter;\n\t}\n\t/**\n\t* Walk every registered seeder, gate on consent + suppression, and upsert\n\t* the returned entries into the store.\n\t*\n\t* Cache rules:\n\t* - If `force !== true` and the last successful seed pass was less than\n\t*   {@link POOL_SEED_CACHE_TTL_MS} ago, the sweep is skipped entirely\n\t*   and `{ added: 0, failed: 0, skipped: <total-seeders> }` is returned.\n\t* - `force: true` always re-runs every seeder.\n\t*\n\t* Per-seeder rules:\n\t* - `isConsentEstablished?` returning `false` → skip (status:\n\t*   `'skipped-consent'`).\n\t* - `isSuppressed(provider, sourceId)` returning `true` → skip (status:\n\t*   `'skipped-suppressed'`).\n\t* - `seed()` throwing → counted as `failed`; the error is logged\n\t*   and stashed in `getSeederStatus`; the next seeder still runs.\n\t* - Each returned entry is upserted via `addCredential`; an upsert\n\t*   failure counts the seeder as `failed`.\n\t*\n\t* @param options - `{ force }` — bypass the 60s cache when `true`.\n\t* @returns Aggregate counts across every seeder.\n\t* @task T9412\n\t*/\n\tasync seed(options = {}) {\n\t\tconst seeders = this.registryGetter();\n\t\tconst now = Date.now();\n\t\tif (!options.force && this.lastSeededAt > 0 && now - this.lastSeededAt < 6e4) {\n\t\t\tdebugLog(\"seed: cache hit, skipping sweep\", {\n\t\t\t\tageMs: now - this.lastSeededAt,\n\t\t\t\tttlMs: POOL_SEED_CACHE_TTL_MS\n\t\t\t});\n\t\t\treturn {\n\t\t\t\tadded: 0,\n\t\t\t\tfailed: 0,\n\t\t\t\tskipped: seeders.length\n\t\t\t};\n\t\t}\n\t\tlet added = 0;\n\t\tlet failed = 0;\n\t\tlet skipped = 0;\n\t\tfor (const seeder of seeders) {\n\t\t\tconst key = `${seeder.sourceId}::${seeder.provider}`;\n\t\t\tconst stampedAt = Date.now();\n\t\t\tif (typeof seeder.isConsentEstablished === \"function\") {\n\t\t\t\tlet consented;\n\t\t\t\ttry {\n\t\t\t\t\tconsented = await seeder.isConsentEstablished(seeder.provider);\n\t\t\t\t} catch (err) {\n\t\t\t\t\tfailed++;\n\t\t\t\t\tthis.seederStatus.set(key, {\n\t\t\t\t\t\tsourceId: seeder.sourceId,\n\t\t\t\t\t\tprovider: seeder.provider,\n\t\t\t\t\t\tlastSeededAt: stampedAt,\n\t\t\t\t\t\tlastResult: \"failed\",\n\t\t\t\t\t\terror: `consent gate threw: ${err instanceof Error ? err.message : String(err)}`\n\t\t\t\t\t});\n\t\t\t\t\tdebugLog(\"seed: consent gate threw\", {\n\t\t\t\t\t\tseeder: key,\n\t\t\t\t\t\terr\n\t\t\t\t\t});\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t\tif (!consented) {\n\t\t\t\t\tskipped++;\n\t\t\t\t\tthis.seederStatus.set(key, {\n\t\t\t\t\t\tsourceId: seeder.sourceId,\n\t\t\t\t\t\tprovider: seeder.provider,\n\t\t\t\t\t\tlastSeededAt: stampedAt,\n\t\t\t\t\t\tlastResult: \"skipped-consent\"\n\t\t\t\t\t});\n\t\t\t\t\tcontinue;\n\t\t\t\t}\n\t\t\t}\n\t\t\tlet suppressed;\n\t\t\ttry {\n\t\t\t\tsuppressed = isSuppressed(seeder.provider, seeder.sourceId);\n\t\t\t} catch (err) {\n\t\t\t\tdebugLog(\"seed: isSuppressed threw — treating as un-suppressed\", {\n\t\t\t\t\tseeder: key,\n\t\t\t\t\terr\n\t\t\t\t});\n\t\t\t\tsuppressed = false;\n\t\t\t}\n\t\t\tif (suppressed) {\n\t\t\t\tskipped++;\n\t\t\t\tthis.seederStatus.set(key, {\n\t\t\t\t\tsourceId: seeder.sourceId,\n\t\t\t\t\tprovider: seeder.provider,\n\t\t\t\t\tlastSeededAt: stampedAt,\n\t\t\t\t\tlastResult: \"skipped-suppressed\"\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tlet entries;\n\t\t\ttry {\n\t\t\t\tentries = (await seeder.seed()).entries;\n\t\t\t} catch (err) {\n\t\t\t\tfailed++;\n\t\t\t\tthis.seederStatus.set(key, {\n\t\t\t\t\tsourceId: seeder.sourceId,\n\t\t\t\t\tprovider: seeder.provider,\n\t\t\t\t\tlastSeededAt: stampedAt,\n\t\t\t\t\tlastResult: \"failed\",\n\t\t\t\t\terror: err instanceof Error ? err.message : String(err)\n\t\t\t\t});\n\t\t\t\tdebugLog(\"seed: seeder threw\", {\n\t\t\t\t\tseeder: key,\n\t\t\t\t\terr\n\t\t\t\t});\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tlet upsertFailed = false;\n\t\t\tfor (const entry of entries) try {\n\t\t\t\tawait addCredential(entry);\n\t\t\t} catch (err) {\n\t\t\t\tupsertFailed = true;\n\t\t\t\tdebugLog(\"seed: addCredential threw\", {\n\t\t\t\t\tseeder: key,\n\t\t\t\t\tlabel: entry.label,\n\t\t\t\t\terr\n\t\t\t\t});\n\t\t\t\tthis.seederStatus.set(key, {\n\t\t\t\t\tsourceId: seeder.sourceId,\n\t\t\t\t\tprovider: seeder.provider,\n\t\t\t\t\tlastSeededAt: stampedAt,\n\t\t\t\t\tlastResult: \"failed\",\n\t\t\t\t\tentriesProduced: entries.length,\n\t\t\t\t\terror: `addCredential threw for '${entry.label}': ${err instanceof Error ? err.message : String(err)}`\n\t\t\t\t});\n\t\t\t\tbreak;\n\t\t\t}\n\t\t\tif (upsertFailed) {\n\t\t\t\tfailed++;\n\t\t\t\tcontinue;\n\t\t\t}\n\t\t\tadded++;\n\t\t\tthis.seederStatus.set(key, {\n\t\t\t\tsourceId: seeder.sourceId,\n\t\t\t\tprovider: seeder.provider,\n\t\t\t\tlastSeededAt: stampedAt,\n\t\t\t\tlastResult: \"ok\",\n\t\t\t\tentriesProduced: entries.length\n\t\t\t});\n\t\t}\n\t\tthis.lastSeededAt = Date.now();\n\t\treturn {\n\t\t\tadded,\n\t\t\tfailed,\n\t\t\tskipped\n\t\t};\n\t}\n\t/**\n\t* Pick a credential for the given provider, lazy-seeding on first call.\n\t*\n\t* Behaviour:\n\t* - First call (or after `resetForTests()`) triggers a `seed()` pass.\n\t* - Subsequent calls within {@link POOL_SEED_CACHE_TTL_MS} skip seeding.\n\t* - The actual pick delegates to `pickCredentialForProviderSync` so the\n\t*   strategy + label-preference semantics match the rest of the store.\n\t*\n\t* @param provider - LLM transport to pick for.\n\t* @param options - Optional strategy / label / no-seed flag.\n\t* @returns The selected `StoredCredential`, or `null` when the pool is\n\t*   empty (or every entry has expired / been disabled).\n\t* @task T9412\n\t*/\n\tasync pick(provider, options = {}) {\n\t\tif (!options.noSeed) await this.seed();\n\t\treturn pickCredentialForProviderSync(provider, {\n\t\t\t...options.strategy != null && { strategy: options.strategy },\n\t\t\t...options.preferLabel != null && { preferLabel: options.preferLabel }\n\t\t});\n\t}\n\t/**\n\t* List every entry currently in the credential store.\n\t*\n\t* Pure read — never triggers seeding. Intended for diagnostic surfaces\n\t* (`cleo auth list`, `cleo status`) where calling `seed()` would be\n\t* surprising side-effect.\n\t*\n\t* @returns Read-only snapshot sorted by file order (insertion).\n\t* @task T9412\n\t*/\n\tasync list() {\n\t\treturn listCredentials();\n\t}\n\t/**\n\t* Snapshot of the last-known outcome of every registered seeder.\n\t*\n\t* Seeders that have never been invoked do not appear in the snapshot.\n\t*\n\t* @returns Read-only array of {@link SeederStatus} entries.\n\t* @task T9412\n\t*/\n\tgetSeederStatus() {\n\t\treturn Array.from(this.seederStatus.values());\n\t}\n\t/**\n\t* Test-only: invalidate the seed cache and clear status snapshots.\n\t*\n\t* Production code MUST NOT call this — it bypasses the 60s rate-limit\n\t* that exists specifically to prevent runaway seeding under tight retry\n\t* loops. The export is prefixed `_` to match the convention used by\n\t* `credentials-store.ts` for analogous helpers (`_resetRoundRobinForTests`).\n\t*\n\t* @internal\n\t*/\n\t_resetForTests() {\n\t\tthis.lastSeededAt = 0;\n\t\tthis.seederStatus.clear();\n\t}\n};\n/**\n* Module-state singleton — `null` until the first {@link getCredentialPool}\n* call constructs the instance. Lazy construction keeps test runners that\n* import the module without ever calling `getCredentialPool` from paying the\n* seeder-registration cost.\n*\n* @internal\n*/\nvar _singleton = null;\n/**\n* Return the process-wide {@link UnifiedCredentialPool} singleton.\n*\n* Re-imports of this module yield the same instance under Node ESM's module\n* cache. Tests that need an isolated pool MUST construct one directly\n* (`new UnifiedCredentialPool(...)`) rather than mutating this singleton.\n*\n* @returns The shared pool instance.\n* @task T9412\n*/\nfunction getCredentialPool() {\n\tif (_singleton === null) _singleton = new UnifiedCredentialPool();\n\treturn _singleton;\n}\n//#endregion\nexport { clearAnthropicKeyCache as _, getCredentialPool as a, REMOVAL_REGISTRY as b, credentialsStorePath as c, pickCredentialForProvider as d, pickCredentialForProviderSync as f, authHeadersFromSealed as g, authHeaders as h, UnifiedCredentialPool as i, getCredentialByLabel as l, ENV_VARS as m, POOL_SEED_CACHE_TTL_MS as n, refreshExpiredOAuthForProvider as o, removeCredential as p, PoolExhaustedError as r, addCredential as s, CredentialPool as t, listCredentials as u, resolveCredentials as v, addSuppression as x, BUILTIN_SEEDERS as y };\n"],"names":["lockfile$1.lock","getCleoHome"],"mappings":";;;;;;;;;;AAKA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,WAAW,GAAG,EAAE;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,QAAQ,EAAE,IAAI,EAAE;AACtC,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;AAC9B,CAAC,MAAM,IAAI,GAAG,QAAQ,CAAC,QAAQ,CAAC;AAChC,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,UAAU,CAAC;AACxC,CAAC,MAAM,OAAO,GAAG,OAAO,IAAI,KAAK,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,GAAG,MAAM;AACxE,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,EAAE,SAAS,CAAC,SAAS,EAAE;AAClD,EAAE,SAAS,EAAE,IAAI;AACjB,EAAE,IAAI,EAAE;AACR,EAAE,CAAC;AACH,CAAC,KAAK,IAAI,CAAC,GAAG,WAAW,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE;AACxC,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AACjD,EAAE,IAAI,CAAC,KAAK,WAAW,EAAE,IAAI;AAC7B,GAAG,UAAU,CAAC,OAAO,CAAC;AACtB,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,OAAO;AACP,GAAG,MAAM,IAAI,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,CAAC,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC;AACnD,GAAG,IAAI;AACP,IAAI,IAAI,UAAU,CAAC,OAAO,CAAC,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC;AACtD,GAAG,CAAC,CAAC,MAAM,CAAC;AACZ,EAAE;AACF,CAAC;AACD,CAAC,IAAI;AACL,EAAE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;AACjD,EAAE,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;AACjD,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE;AACnE,GAAG,QAAQ,EAAE,OAAO;AACpB,GAAG;AACH,GAAG,CAAC;AACJ,OAAO,aAAa,CAAC,UAAU,EAAE,OAAO,EAAE,OAAO,CAAC;AAClD,CAAC,CAAC,CAAC,MAAM,CAAC;AACV;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,CAAC,IAAI,EAAE;AAC7B,CAAC,IAAI,MAAM,GAAG,IAAI,GAAG,GAAG;AACxB,CAAC,IAAI,MAAM,GAAG,GAAG,EAAE,MAAM,IAAI,EAAE;AAC/B,CAAC,IAAI,MAAM,GAAG,EAAE,EAAE,MAAM,IAAI,CAAC;AAC7B,CAAC,IAAI,MAAM,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;AAC5B,CAAC,OAAO,MAAM;AACd;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,QAAQ,EAAE,IAAI,EAAE,YAAY,GAAG,CAAC,EAAE;AAC/D,CAAC,MAAM,IAAI,GAAG,OAAO,YAAY,KAAK,QAAQ,GAAG,EAAE,MAAM,EAAE,YAAY,EAAE,GAAG,YAAY;AACxF,CAAC,MAAM,MAAM,GAAG,IAAI,CAAC,MAAM,IAAI,CAAC;AAChC,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,IAAI;AACvB,CAAC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC;AACzG,CAAC,MAAM,OAAO,GAAG,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,MAAM,CAAC,GAAG,IAAI;AAC1D,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE;AAChE,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE;AACF,EAAE,CAAC;AACH,MAAM,aAAa,CAAC,QAAQ,EAAE,OAAO,EAAE,OAAO,CAAC;AAC/C,CAAC,IAAI;AACL,EAAE,IAAI,UAAU,CAAC,QAAQ,CAAC,EAAE,YAAY,CAAC,QAAQ,EAAE,IAAI,CAAC;AACxD,EAAE,UAAU,CAAC,QAAQ,EAAE,QAAQ,CAAC;AAChC,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,IAAI;AACN,GAAG,UAAU,CAAC,QAAQ,CAAC;AACvB,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,EAAE,MAAM,KAAK;AACb,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,QAAQ,EAAE;AAChC,CAAC,IAAI;AACL,EAAE,MAAM,OAAO,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;AACjD,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;AAC5B,CAAC,CAAC,CAAC,OAAO,KAAK,EAAE;AACjB,EAAE,IAAI,KAAK,CAAC,IAAI,KAAK,QAAQ,EAAE,OAAO,IAAI;AAC1C,EAAE,MAAM,KAAK;AACb,CAAC;AACD;AACA;AACA;AACA;AACA,IAAI,YAAY,GAAG;AACnB,CAAC,OAAO,EAAE;AACV,EAAE,OAAO,EAAE,CAAC;AACZ,EAAE,MAAM,EAAE,CAAC;AACX,EAAE,UAAU,EAAE,GAAG;AACjB,EAAE,UAAU,EAAE;AACd,EAAE;AACF,CAAC,KAAK,EAAE;AACR,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,QAAQ,CAAC,QAAQ,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,EAAE;AACxD,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;AAC9B,CAAC,MAAM,OAAO,GAAG,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,GAAG,aAAa,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,MAAM;AAClF,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,GAAG,EAAE;AACtC,EAAE,SAAS,EAAE,IAAI;AACjB,EAAE,IAAI,EAAE;AACR,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE;AAC3F,EAAE,QAAQ,EAAE,OAAO;AACnB,EAAE,IAAI,EAAE,IAAI,CAAC;AACb,EAAE,CAAC;AACH,MAAM,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC;AAC1C,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI;AACL,EAAE,OAAO,GAAG,MAAMA,0BAAe,CAAC,QAAQ,EAAE,YAAY,CAAC;AACzD,EAAE,MAAM,OAAO,GAAG,SAAS,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC;AACnD,EAAE,mBAAmB,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC;AAC7D,EAAE,OAAO,OAAO;AAChB,CAAC,CAAC,SAAS;AACX,EAAE,IAAI,OAAO,EAAE,MAAM,OAAO,EAAE;AAC9B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,YAAY,CAAC,QAAQ,EAAE,SAAS,EAAE;AACjD,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,CAAC;AAC9B,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1D,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,QAAQ,EAAE,EAAE,EAAE,OAAO,CAAC;AAChE,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI;AACL,EAAE,OAAO,GAAG,MAAMA,0BAAe,CAAC,QAAQ,EAAE,YAAY,CAAC;AACzD,EAAE,OAAO,MAAM,SAAS,EAAE;AAC1B,CAAC,CAAC,SAAS;AACX,EAAE,IAAI,OAAO,EAAE,MAAM,OAAO,EAAE;AAC9B,CAAC;AACD;;ACpMA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,WAAW;AAChC;AACA,IAAI,eAAe,GAAG,IAAI;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,GAAG;AAC7B,CAAC,IAAI,eAAe,KAAK,IAAI,EAAE,OAAO,eAAe;AACrD,CAAC,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,cAAc,CAAC;AACjD,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,IAAI;AAC3B,EAAE,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE;AAChD,EAAE,IAAI,GAAG,CAAC,MAAM,GAAG,CAAC,EAAE;AACtB,GAAG,eAAe,GAAG,GAAG;AACxB,GAAG,OAAO,GAAG;AACb,EAAE;AACF,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,MAAM,KAAK,GAAG,UAAU,EAAE;AAC3B,CAAC,IAAI;AACL,EAAE,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;AAC3B,EAAE,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC3D,EAAE,MAAM,OAAO,GAAG,CAAC,EAAE,IAAI,CAAC,KAAK,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;AAC9C,EAAE,aAAa,CAAC,OAAO,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC9C,EAAE,UAAU,CAAC,OAAO,EAAE,IAAI,CAAC;AAC3B,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,eAAe,GAAG,KAAK;AACxB,CAAC,OAAO,KAAK;AACb;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,kBAAkB,GAAG,6BAA6B;AACtD;AACA,IAAI,aAAa,GAAG,gBAAgB;AACpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,GAAG;AACjC,CAAC,OAAO;AACR,EAAE,gBAAgB,EAAE,MAAM;AAC1B,EAAE,eAAe,EAAE,GAAG;AACtB,EAAE,mBAAmB,EAAE,UAAU;AACjC,EAAE,oBAAoB,EAAE,MAAM;AAC9B,EAAE,kBAAkB,EAAE,OAAO,CAAC,OAAO;AACrC,EAAE,iBAAiB,EAAE,iBAAiB;AACtC,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,MAAM,EAAE;AAClC,CAAC,OAAO,MAAM,CAAC,UAAU,CAAC,UAAU,CAAC;AACrC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG;AACtB,CAAC,IAAI,EAAE,WAAW;AAClB,CAAC,WAAW,EAAE,sBAAsB;AACpC,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;AAChC,CAAC,OAAO,EAAE,kBAAkB;AAC5B,CAAC,YAAY,EAAE,aAAa;AAC5B,CAAC,OAAO,EAAE;AACV,EAAE,MAAM;AACR,EAAE,iBAAiB;AACnB,EAAE;AACF,EAAE;AACF,CAAC,cAAc,EAAE,qBAAqB,EAAE;AACxC,CAAC,OAAO,EAAE,CAAC,mBAAmB,EAAE,cAAc,CAAC;AAC/C,CAAC,oBAAoB,GAAG;AACxB,EAAE,OAAO,EAAE,gBAAgB,EAAE,MAAM,EAAE;AACrC,CAAC;AACD,CAAC;;ACzJD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,wBAAwB,GAAG;AACpC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,gCAAgC,CAAC,IAAI,sCAAsC;AAC/F;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,gBAAgB,GAAG;AACvB,CAAC,IAAI,EAAE,WAAW;AAClB,CAAC,WAAW,EAAE,kBAAkB;AAChC,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;AAChC,CAAC,OAAO,EAAE,2BAA2B;AACrC,CAAC,YAAY,EAAE,2BAA2B;AAC1C,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;AACrC,CAAC,IAAI,EAAE,UAAU;AACjB,CAAC,eAAe,EAAE,2BAA2B;AAC7C,CAAC,gBAAgB,EAAE,IAAI;AACvB,CAAC,cAAc,EAAE,EAAE,mBAAmB,EAAE,YAAY,EAAE;AACtD,CAAC,KAAK,EAAE;AACR,EAAE,IAAI,EAAE,MAAM;AACd,EAAE,QAAQ,EAAE,wBAAwB,EAAE;AACtC,EAAE,qBAAqB,EAAE,mCAAmC;AAC5D,EAAE,aAAa,EAAE,4CAA4C;AAC7D,EAAE,KAAK,EAAE,gDAAgD;AACzD,EAAE,WAAW,EAAE,iDAAiD;AAChE,EAAE,eAAe,EAAE,EAAE,IAAI,EAAE,MAAM,EAAE;AACnC,EAAE,eAAe,EAAE;AACnB;AACA,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG;AACrB,CAAC,IAAI,EAAE,SAAS;AAChB,CAAC,WAAW,EAAE,aAAa;AAC3B,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AACvB,CAAC,OAAO,EAAE,gDAAgD;AAC1D,CAAC,YAAY,EAAE,2CAA2C;AAC1D,CAAC,OAAO,EAAE,CAAC,aAAa,EAAE,kBAAkB;AAC5C,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,yBAAyB,CAAC,KAAK,EAAE;AAC1C,CAAC,IAAI,kBAAkB,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE;AACnG,CAAC,OAAO,EAAE,eAAe,EAAE,MAAM,EAAE;AACnC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,aAAa,GAAG;AACpB,CAAC,IAAI,EAAE,QAAQ;AACf,CAAC,WAAW,EAAE,eAAe;AAC7B,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AACvB,CAAC,OAAO,EAAE,yDAAyD;AACnE,CAAC,YAAY,EAAE,kBAAkB;AACjC,CAAC,OAAO,EAAE,CAAC,QAAQ,EAAE,eAAe,CAAC;AACrC,CAAC,IAAI,EAAE,UAAU;AACjB,CAAC,eAAe,EAAE,kBAAkB;AACpC,CAAC,gBAAgB,EAAE,IAAI;AACvB,CAAC,OAAO,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;AAC9C,CAAC,cAAc,CAAC,KAAK,EAAE;AACvB,EAAE,OAAO,EAAE,eAAe,EAAE,yBAAyB,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC,EAAE;AAC5E,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,4BAA4B;AACpD;AACA,IAAI,sBAAsB,GAAG,sBAAsB;AACnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,6BAA6B,CAAC,IAAI,EAAE;AAC7C,CAAC,MAAM,eAAe,GAAG,EAAE,GAAG,IAAI,CAAC,WAAW,EAAE;AAChD,CAAC,OAAO,eAAe,CAAC,SAAS,CAAC;AAClC,CAAC,OAAO,eAAe,CAAC,sBAAsB,CAAC;AAC/C,CAAC,OAAO;AACR,EAAE,GAAG,IAAI;AACT,EAAE,WAAW,EAAE;AACf,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG;AACtB,CAAC,IAAI,EAAE,UAAU;AACjB,CAAC,WAAW,EAAE,uBAAuB;AACrC,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AACvB,CAAC,OAAO,EAAE,iBAAiB;AAC3B,CAAC,YAAY,EAAE,sBAAsB;AACrC,CAAC,OAAO,EAAE,CAAC,SAAS,EAAE,aAAa,CAAC;AACpC,CAAC,OAAO,EAAE,CAAC,kBAAkB,CAAC;AAC9B,CAAC,oBAAoB,CAAC,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE;AACjD,EAAE,OAAO,EAAE;AACX,CAAC,CAAC;AACF,CAAC,cAAc,CAAC,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE;AAC1C,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,EAAE;AACnC,EAAE,OAAO,EAAE,yBAAyB,EAAE,KAAK,CAAC,GAAG,CAAC,6BAA6B,CAAC,EAAE;AAChF,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,aAAa,GAAG;AACpB,CAAC,IAAI,EAAE,QAAQ;AACf,CAAC,WAAW,EAAE,gBAAgB;AAC9B,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AACvB,CAAC,OAAO,EAAE,wBAAwB;AAClC,CAAC,YAAY,EAAE,YAAY;AAC3B,CAAC,OAAO,EAAE,CAAC,cAAc,CAAC;AAC1B,CAAC,IAAI,EAAE,OAAO;AACd,CAAC,eAAe,EAAE,YAAY;AAC9B,CAAC,gBAAgB,EAAE,IAAI;AACvB,CAAC,OAAO,EAAE,CAAC,gBAAgB,EAAE,iBAAiB,CAAC;AAC/C,CAAC,sBAAsB,EAAE;AACzB,CAAC;AACD;AACA,SAAS,qBAAqB,GAAG;AACjC,CAAC,OAAO,OAAO,CAAC,GAAG,CAAC,6BAA6B,CAAC,IAAI,8BAA8B;AACpF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,aAAa,GAAG;AACpB,CAAC,IAAI,EAAE,QAAQ;AACf,CAAC,WAAW,EAAE,wBAAwB;AACtC,CAAC,SAAS,EAAE,CAAC,SAAS,EAAE,OAAO,CAAC;AAChC,CAAC,OAAO,EAAE,2BAA2B;AACrC,CAAC,YAAY,EAAE,SAAS;AACxB,CAAC,OAAO,EAAE;AACV,EAAE,OAAO;AACT,EAAE,SAAS;AACX,EAAE;AACF,EAAE;AACF,CAAC,IAAI,EAAE,UAAU;AACjB,CAAC,eAAe,EAAE,YAAY;AAC9B,CAAC,gBAAgB,EAAE,IAAI;AACvB,CAAC,KAAK,EAAE;AACR,EAAE,IAAI,EAAE,MAAM;AACd,EAAE,QAAQ,EAAE,qBAAqB,EAAE;AACnC,EAAE,qBAAqB,EAAE,yCAAyC;AAClE,EAAE,aAAa,EAAE,qCAAqC;AACtD,EAAE,KAAK,EAAE,qCAAqC;AAC9C,EAAE,WAAW,EAAE,qCAAqC;AACpD,EAAE,eAAe,EAAE;AACnB,GAAG,0BAA0B,EAAE,MAAM;AACrC,GAAG,yBAAyB,EAAE,MAAM;AACpC,GAAG,UAAU,EAAE;AACf;AACA;AACA,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,IAAI,EAAE,YAAY;AACnB,CAAC,WAAW,EAAE,YAAY;AAC1B,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AACvB,CAAC,OAAO,EAAE,8BAA8B;AACxC,CAAC,YAAY,EAAE,wCAAwC;AACvD,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC;AACzB,CAAC,OAAO,EAAE,CAAC,oBAAoB,CAAC;AAChC,CAAC,cAAc,EAAE;AACjB,EAAE,cAAc,EAAE,sBAAsB;AACxC,EAAE,SAAS,EAAE;AACb,EAAE;AACF,CAAC,cAAc,CAAC,KAAK,EAAE;AACvB,EAAE,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,yBAAyB,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACnG,GAAG,EAAE,EAAE,QAAQ;AACf,GAAG,gBAAgB,EAAE;AACrB,GAAG,CAAC,EAAE;AACN,EAAE,OAAO,EAAE;AACX,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,WAAW,GAAG,IAAI;AACtB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,IAAI,WAAW,KAAK,IAAI,EAAE,WAAW,GAAG,CAAC,KAAK,EAAE,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;AACrH,CAAC,OAAO,WAAW;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,UAAU,GAAG;AACjB,CAAC,IAAI,EAAE,KAAK;AACZ,CAAC,WAAW,EAAE,UAAU;AACxB,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AACvB,CAAC,OAAO,EAAE,qBAAqB;AAC/B,CAAC,YAAY,EAAE,QAAQ;AACvB,CAAC,OAAO,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;AAC1B,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC;AACzB,CAAC,oBAAoB,GAAG;AACxB,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,EAAE;AACjE,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,mBAAmB,GAAG;AAC1B,CAAC,IAAI,EAAE,KAAK;AACZ,CAAC,WAAW,EAAE,sBAAsB;AACpC,CAAC,SAAS,EAAE,CAAC,SAAS,CAAC;AACvB,CAAC,OAAO,EAAE,qBAAqB;AAC/B,CAAC,YAAY,EAAE,QAAQ;AACvB,CAAC,OAAO,EAAE,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;AAC9C,CAAC,OAAO,EAAE,CAAC,aAAa,CAAC;AACzB,CAAC,oBAAoB,GAAG;AACxB,EAAE,OAAO,EAAE,aAAa,EAAE,EAAE,gBAAgB,EAAE,aAAa,EAAE,EAAE,EAAE;AACjE,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG;AACxB,CAAC,MAAM;AACP,CAAC,KAAK;AACN,CAAC,MAAM;AACP,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA,SAAS,YAAY,CAAC,QAAQ,EAAE;AAChC,CAAC,OAAO,iBAAiB,CAAC,IAAI,CAAC,CAAC,GAAG,KAAK,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;AAC/D;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,GAAG;AACxB,CAAC,OAAO,IAAI,CAACC,aAAW,EAAE,EAAE,SAAS,EAAE,iBAAiB,CAAC;AACzD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE;AAC3C,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,GAAG,GAAG,MAAM,OAAO,aAAa,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC;AACjD,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,iDAAiD,EAAE,OAAO,CAAC,EAAE,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AACvG,EAAE;AACF,CAAC;AACD,CAAC,IAAI,UAAU;AACf,CAAC,IAAI,OAAO,GAAG,CAAC,QAAQ,KAAK,UAAU,EAAE,UAAU,GAAG,GAAG,CAAC,QAAQ;AAClE,MAAM,IAAI,GAAG,CAAC,OAAO,KAAK,MAAM,EAAE;AAClC,EAAE,IAAI,OAAO,GAAG,CAAC,OAAO,KAAK,UAAU,EAAE,UAAU,GAAG,GAAG,CAAC,OAAO;AACjE,OAAO,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,QAAQ,KAAK,UAAU,EAAE,UAAU,GAAG,GAAG,CAAC,OAAO,CAAC,QAAQ;AACxF,CAAC;AACD,CAAC,IAAI,UAAU,KAAK,MAAM,EAAE;AAC5B,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,gCAAgC,EAAE,OAAO,CAAC,kDAAkD,CAAC,CAAC;AACtH,EAAE;AACF,CAAC;AACD,CAAC,IAAI;AACL,EAAE,UAAU,CAAC,GAAG,CAAC;AACjB,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,gCAAgC,EAAE,OAAO,CAAC,0BAA0B,EAAE,MAAM,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC;AAC9G,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,SAAS,EAAE,GAAG,EAAE;AAClD,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI;AACL,EAAE,OAAO,GAAG,WAAW,CAAC,SAAS,CAAC;AAClC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE;AACF,CAAC;AACD,CAAC,MAAM,WAAW,GAAG,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,IAAI,KAAK;AAC5G,EAAE,IAAI;AACN,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC,SAAS,EAAE,IAAI,CAAC,CAAC,CAAC,MAAM,EAAE;AAClD,EAAE,CAAC,CAAC,MAAM;AACV,GAAG,OAAO,KAAK;AACf,EAAE;AACF,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE;AACV,CAAC,KAAK,MAAM,QAAQ,IAAI,WAAW,EAAE,MAAM,aAAa,CAAC,IAAI,CAAC,SAAS,EAAE,QAAQ,CAAC,EAAE,GAAG,CAAC;AACxF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,YAAY,CAAC,gBAAgB,EAAE,QAAQ,EAAE;AACxD,CAAC,MAAM,GAAG,GAAG,EAAE,gBAAgB,EAAE;AACjC,CAAC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,gBAAgB,CAAC,OAAO,CAAC;AAC1D,CAAC,MAAM,kBAAkB,CAAC,YAAY,EAAE,EAAE,GAAG,CAAC;AAC9C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,SAAS,mBAAmB,IAAI,GAAG,EAAE;AACzC;AACA;AACA;AACA;AACA;AACA,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC;AACA,IAAI,iBAAiB,GAAG,IAAI;AAC5B;AACA;AACA;AACA;AACA,IAAI,gBAAgB,GAAG;AACvB,CAAC,gBAAgB;AACjB,CAAC,cAAc;AACf,CAAC,aAAa;AACd,CAAC,eAAe;AAChB,CAAC,eAAe;AAChB,CAAC,aAAa;AACd,CAAC,aAAa;AACd,CAAC,iBAAiB;AAClB,CAAC,UAAU;AACX,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,OAAO,EAAE;AACnC,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,WAAW,EAAE;AACvC,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,EAAE,OAAO,CAAC;AAC5B,CAAC,KAAK,MAAM,KAAK,IAAI,OAAO,CAAC,OAAO,IAAI,EAAE,EAAE;AAC5C,EAAE,MAAM,QAAQ,GAAG,KAAK,CAAC,WAAW,EAAE;AACtC,EAAE,MAAM,QAAQ,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC;AACzC,EAAE,IAAI,QAAQ,KAAK,MAAM,IAAI,QAAQ,KAAK,GAAG,EAAE;AAC/C,GAAG,IAAI,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,QAAQ,KAAK,GAAG,EAAE,MAAM,IAAI,SAAS,CAAC,CAAC,2BAA2B,EAAE,KAAK,CAAC,gBAAgB,EAAE,OAAO,CAAC,IAAI,CAAC,+CAA+C,EAAE,SAAS,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE,IAAI,IAAI,QAAQ,CAAC,EAAE,CAAC,CAAC;AAC1O,EAAE;AACF,EAAE,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC;AAC7B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,gBAAgB,GAAG;AAClC,CAAC,IAAI,iBAAiB,KAAK,IAAI,EAAE,iBAAiB,GAAG,YAAY,CAAC,gBAAgB,EAAE,gBAAgB,CAAC;AACrG,CAAC,OAAO,iBAAiB;AACzB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,IAAI,EAAE;AACxC,CAAC,MAAM,gBAAgB,EAAE;AACzB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE;AAC/B,CAAC,MAAM,SAAS,GAAG,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,IAAI,GAAG;AAC3C,CAAC,OAAO,SAAS,CAAC,GAAG,CAAC,SAAS,CAAC;AAChC;;AC5pBA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,KAAK,EAAE;AACzB,CAAC,OAAO,KAAK,CAAC,OAAO,CAAC,iBAAiB,EAAE,GAAG,CAAC;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE;AAC7C,CAAC,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,kBAAkB,CAAC,EAAE,CAAC,EAAE,QAAQ,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC;AACtG;AA6CA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE;AACtD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,MAAM,SAAS,GAAG,CAAiC,GAAG,IAAI,GAAG;AAC9D,CAAC,IAAI,OAAO;AACZ,CAAC,IAAI,MAAM;AACX,CASQ;AACR,EAAE,OAAO,GAAG,GAAG,GAAG,SAAS;AAC3B,EAAE,MAAM,GAAG,SAAS;AACpB,CAAC;AACD,CAAC,MAAM,QAAQ,GAAG,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC;AACrD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,kBAAkB,CAAC;AACpD,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC1D,CAAC,MAAM,KAAK,GAAG;AACf,EAAE,OAAO;AACT,EAAE,UAAU,EAAE,GAAG;AACjB,EAAE;AACF,EAAE;AACF,CAAC,MAAM,YAAY,CAAC,QAAQ,EAAE,MAAM;AACpC,EAAE,mBAAmB,CAAC,QAAQ,EAAE,KAAK,CAAC;AACtC,CAAC,CAAC,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,kBAAkB,CAAC,QAAQ,EAAE,KAAK,EAAE;AACnD,CAAC,MAAM,KAAK,GAAG,YAAY,CAAC,kBAAkB,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC,IAAI,CAAC,KAAK,EAAE,OAAO,IAAI;AACxB,CAAC,MAAM,SAAS,GAAG,CAAC,KAAK,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,GAAG;AACrD,CAAC,IAAI,SAAS,GAAG,CAAC,EAAE,OAAO,SAAS;AACpC,CAAC,OAAO,IAAI;AACZ;;ACzJA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG,MAAM;AAC5B,CAAC,KAAK,mBAAmB,IAAI,GAAG,EAAE;AAClC;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,QAAQ,CAAC,IAAI,EAAE;AAChB,EAAE,IAAI,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,wEAAwE,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AACjJ,EAAE,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC;AACrC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,IAAI,CAAC,QAAQ,EAAE;AAChB,EAAE,OAAO,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,QAAQ,CAAC;AACjC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,GAAG;AACV,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;AACxC,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,IAAI,oBAAoB,GAAG,uBAAuB;AAClD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,GAAG;AAChC,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,oBAAoB,CAAC;AACjD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,MAAM,IAAI,GAAG,YAAY,CAAC,oBAAoB,EAAE,CAAC;AAClD,CAAC,IAAI,IAAI,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI;AAC3E,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,CAAC;AACZ,EAAE,OAAO,EAAE;AACX,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,IAAI,EAAE;AACpC,CAAC,mBAAmB,CAAC,oBAAoB,EAAE,EAAE,IAAI,CAAC;AAClD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAC5C,CAAC,MAAM,OAAO,GAAG,mBAAmB,EAAE;AACtC,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC,EAAE;AACtF,CAAC,oBAAoB,CAAC;AACtB,EAAE,OAAO,EAAE,CAAC;AACZ,EAAE,OAAO,EAAE,CAAC,GAAG,OAAO,CAAC,OAAO,EAAE;AAChC,GAAG,QAAQ;AACX,GAAG,QAAQ;AACX,GAAG,YAAY,EAAE,IAAI,CAAC,GAAG;AACzB,GAAG;AACH,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,QAAQ,EAAE,QAAQ,EAAE;AAC1C,CAAC,OAAO,mBAAmB,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;AACrG;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,mBAAmB,GAAG;AAC1B,CAAC,QAAQ,EAAE,QAAQ;AACnB,CAAC,WAAW,EAAE,kEAAkE;AAChF,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,EAAE;AACd,GAAG,KAAK,EAAE,CAAC,yCAAyC,CAAC;AACrD,GAAG,QAAQ,EAAE;AACb,GAAG;AACH,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,gBAAgB,GAAG;AACvB,CAAC,QAAQ,EAAE,KAAK;AAChB,CAAC,WAAW,EAAE,+CAA+C;AAC7D,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,EAAE;AACd,GAAG,KAAK,EAAE,CAAC,oDAAoD,CAAC;AAChE,GAAG,QAAQ,EAAE;AACb,GAAG;AACH,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,wBAAwB,GAAG;AAC/B,CAAC,QAAQ,EAAE,aAAa;AACxB,CAAC,WAAW,EAAE,2EAA2E;AACzF,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,EAAE;AACd,GAAG,KAAK,EAAE,CAAC,oGAAoG,CAAC;AAChH,GAAG,QAAQ,EAAE;AACb,GAAG;AACH,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG;AAC7B,CAAC,QAAQ,EAAE,WAAW;AACtB,CAAC,WAAW,EAAE,mEAAmE;AACjF,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,sBAAsB,CAAC;AAC1D,EAAE,MAAM,OAAO,GAAG,EAAE;AACpB,EAAE,IAAI;AACN,GAAG,UAAU,CAAC,IAAI,CAAC;AACnB,GAAG,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC;AACrB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,MAAM,GAAG;AACvC,EAAE;AACF,EAAE,OAAO;AACT,GAAG,OAAO;AACV,GAAG,KAAK,EAAE,EAAE;AACZ,GAAG,QAAQ,EAAE;AACb,GAAG;AACH,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG;AAC7B,CAAC,QAAQ,EAAE,WAAW;AACtB,CAAC,WAAW,EAAE,6DAA6D;AAC3E,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,EAAE;AACd,GAAG,KAAK,EAAE,CAAC,oGAAoG,CAAC;AAChH,GAAG,QAAQ,EAAE;AACb,GAAG;AACH,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,uBAAuB,GAAG;AAC9B,CAAC,QAAQ,EAAE,YAAY;AACvB,CAAC,WAAW,EAAE,+DAA+D;AAC7E,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,EAAE;AACd,GAAG,KAAK,EAAE,CAAC,wGAAwG,CAAC;AACpH,GAAG,QAAQ,EAAE;AACb,GAAG;AACH,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,mBAAmB,GAAG;AAC1B,CAAC,QAAQ,EAAE,QAAQ;AACnB,CAAC,WAAW,EAAE,sDAAsD;AACpE,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,EAAE;AACd,GAAG,KAAK,EAAE,CAAC,6DAA6D,CAAC;AACzE,GAAG,QAAQ,EAAE;AACb,GAAG;AACH,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,GAAG;AACvC,CAAC,MAAM,QAAQ,GAAG,IAAI,eAAe,EAAE;AACvC,CAAC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;AACvC,CAAC,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,CAAC;AACpC,CAAC,QAAQ,CAAC,QAAQ,CAAC,wBAAwB,CAAC;AAC5C,CAAC,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC;AAC1C,CAAC,QAAQ,CAAC,QAAQ,CAAC,sBAAsB,CAAC;AAC1C,CAAC,QAAQ,CAAC,QAAQ,CAAC,uBAAuB,CAAC;AAC3C,CAAC,QAAQ,CAAC,QAAQ,CAAC,mBAAmB,CAAC;AACvC,CAAC,OAAO,QAAQ;AAChB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,gBAAgB,GAAG,2BAA2B;AAClD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,aAAa;AAClC;AACA,IAAI,WAAW,GAAG,aAAa;AAC/B,IAAI,UAAU,GAAG,WAAW;AAC5B;AACA,IAAI,kBAAkB,GAAG,6BAA6B;AACtD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,gBAAgB,GAAG,MAAM;AAC7B;AACA,CAAC,QAAQ,GAAG,WAAW;AACvB;AACA,CAAC,QAAQ,GAAG,UAAU;AACtB,CAAC,kBAAkB;AACnB,CAAC,eAAe;AAChB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,WAAW,CAAC,IAAI,EAAE;AACnB,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,IAAI,2BAA2B;AACnF,EAAE,IAAI,CAAC,eAAe,GAAG,IAAI,EAAE,eAAe,IAAI,sBAAsB;AACxE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,oBAAoB,CAAC,SAAS,EAAE;AACvC,EAAE,IAAI;AACN,GAAG,OAAO,MAAM,IAAI,CAAC,eAAe,EAAE;AACtC,EAAE,CAAC,CAAC,MAAM;AACV,GAAG,OAAO,KAAK;AACf,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,IAAI,CAAC,MAAM,IAAI,CAAC,oBAAoB,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;AAC7E,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,EAAE;AACvC,EAAE,IAAI,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;AAC1C,EAAE,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,CAAC;AAChD,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;AAC7C,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,GAAG,QAAQ,EAAE,WAAW;AACxB,GAAG,KAAK,EAAE,cAAc;AACxB,GAAG,QAAQ,EAAE,OAAO;AACpB,GAAG,WAAW,EAAE,MAAM,CAAC,WAAW;AAClC,GAAG,MAAM,EAAE,cAAc;AACzB,GAAG,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE;AACxE,GAAG,GAAG,MAAM,CAAC,YAAY,KAAK,MAAM,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG;AAC/E,GAAG,CAAC,EAAE;AACN,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,GAAG;AACvC,CAAC,IAAI;AACL,EAAE,OAAO,YAAY,CAAC,IAAI,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,mBAAmB,CAAC,EAAE,OAAO,CAAC;AAC/E,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,sBAAsB,GAAG;AACxC,CAAC,OAAO,CAAC,MAAM,cAAc,CAAC,kBAAkB,CAAC,EAAE,KAAK,KAAK,IAAI;AACjE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,GAAG;AAClC,CAAC,OAAO,IAAI,gBAAgB,EAAE;AAC9B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,YAAY,GAAG,WAAW;AAC9B;AACA,IAAI,SAAS,GAAG,WAAW;AAC3B,IAAI,QAAQ,GAAG,WAAW;AAC1B;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,OAAO,IAAI,CAAC,aAAa,EAAE,EAAE,sBAAsB,CAAC;AACrD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,MAAM;AAC3B;AACA,CAAC,QAAQ,GAAG,SAAS;AACrB;AACA,CAAC,QAAQ,GAAG,QAAQ;AACpB,CAAC,kBAAkB;AACnB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,WAAW,CAAC,IAAI,EAAE;AACnB,EAAE,IAAI,CAAC,kBAAkB,GAAG,IAAI,EAAE,kBAAkB,IAAI,yBAAyB;AACjF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,kBAAkB,EAAE;AACvC,EAAE,IAAI,GAAG,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;AAC1C,EAAE,MAAM,MAAM,GAAG,0BAA0B,CAAC,GAAG,CAAC;AAChD,EAAE,IAAI,MAAM,KAAK,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;AAC7C,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,GAAG,QAAQ,EAAE,WAAW;AACxB,GAAG,KAAK,EAAE,YAAY;AACtB,GAAG,QAAQ,EAAE,OAAO;AACpB,GAAG,WAAW,EAAE,MAAM,CAAC,WAAW;AAClC,GAAG,MAAM,EAAE,YAAY;AACvB,GAAG,GAAG,MAAM,CAAC,SAAS,KAAK,MAAM,GAAG,EAAE,SAAS,EAAE,MAAM,CAAC,SAAS,EAAE,GAAG,EAAE;AACxE,GAAG,GAAG,MAAM,CAAC,YAAY,KAAK,MAAM,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,YAAY,EAAE,GAAG;AAC/E,GAAG,CAAC,EAAE;AACN,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,yBAAyB,GAAG;AACrC,CAAC,IAAI;AACL,EAAE,OAAO,YAAY,CAAC,mBAAmB,EAAE,EAAE,OAAO,CAAC;AACrD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,GAAG;AAChC,CAAC,OAAO,IAAI,cAAc,EAAE;AAC5B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,IAAI,CAAC,OAAO,EAAE,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC;AAChG;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,MAAM;AAC3B,CAAC,QAAQ,GAAG,WAAW;AACvB,CAAC,QAAQ,GAAG,QAAQ;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,MAAM,QAAQ,GAAG,gBAAgB,EAAE;AACrC,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;AACnD,EAAE,IAAI,GAAG;AACT,EAAE,IAAI;AACN,GAAG,GAAG,GAAG,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC;AACxC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,OAAO;AACV,IAAI,OAAO,EAAE,EAAE;AACf,IAAI,QAAQ,EAAE,CAAC,CAAC,0BAA0B,EAAE,QAAQ,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AACtE,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,GAAG,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AAC/B,GAAG,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO;AACxE,IAAI,OAAO,EAAE,EAAE;AACf,IAAI,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,qBAAqB,CAAC;AAC5D,IAAI;AACJ,GAAG,MAAM,GAAG,IAAI;AAChB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,OAAO;AACV,IAAI,OAAO,EAAE,EAAE;AACf,IAAI,QAAQ,EAAE,CAAC,CAAC,WAAW,EAAE,QAAQ,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AACzE,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,EAAE,OAAO,EAAE,EAAE,EAAE;AAChC,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,QAAQ,CAAC;AACjC,EAAE,IAAI,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE;AACtE,GAAG,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC;AAC7C,GAAG,MAAM,YAAY,GAAG,MAAM,CAAC,eAAe,CAAC;AAC/C,GAAG,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;AAClF,IAAI,QAAQ,EAAE,QAAQ;AACtB,IAAI,KAAK,EAAE,WAAW;AACtB,IAAI,QAAQ,EAAE,OAAO;AACrB,IAAI,WAAW,EAAE,WAAW,CAAC,IAAI,EAAE;AACnC,IAAI,MAAM,EAAE,WAAW;AACvB,IAAI,GAAG,OAAO,YAAY,KAAK,QAAQ,IAAI,YAAY,CAAC,IAAI,EAAE,GAAG,EAAE,YAAY,EAAE,YAAY,CAAC,IAAI,EAAE,EAAE,GAAG;AACzG,IAAI,CAAC;AACL,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,MAAM,CAAC,gBAAgB,CAAC;AACzC,EAAE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,MAAM,CAAC,OAAO,CAAC,IAAI,CAAC;AACvE,GAAG,QAAQ,EAAE,QAAQ;AACrB,GAAG,KAAK,EAAE,mBAAmB;AAC7B,GAAG,QAAQ,EAAE,SAAS;AACtB,GAAG,WAAW,EAAE,MAAM,CAAC,IAAI,EAAE;AAC7B,GAAG,MAAM,EAAE;AACX,GAAG,CAAC;AACJ,EAAE,OAAO,MAAM;AACf,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,cAAc,GAAG,IAAI,cAAc,EAAE;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,gBAAgB,CAAC,MAAM,EAAE;AACxC,CAAC,MAAM,MAAM,GAAG;AAChB,EAAE,UAAU,EAAE,eAAe;AAC7B,EAAE,SAAS,EAAE,MAAM,CAAC,QAAQ;AAC5B,EAAE,aAAa,EAAE,MAAM,CAAC;AACxB,EAAE;AACF,CAAC,MAAM,IAAI,GAAG,MAAM,gBAAgB,CAAC,MAAM,CAAC,aAAa,EAAE,MAAM,EAAE,MAAM,CAAC;AAC1E,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;AACf,EAAE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC;AACpD,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,wCAAwC,EAAE,MAAM,CAAC,QAAQ,CAAC,QAAQ,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9G,CAAC;AACD,CAAC,OAAO,kBAAkB,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE,CAAC;AAC9D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,CAAC,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE;AACvD,CAAC,OAAO,UAAU,CAAC,KAAK,CAAC,aAAa,EAAE;AACxC,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,IAAI,CAAC,UAAU,KAAK,MAAM,GAAG,kBAAkB,GAAG,mCAAmC;AACxG,GAAG,MAAM,EAAE,kBAAkB;AAC7B,GAAG,GAAG,IAAI,CAAC;AACX,GAAG;AACH,EAAE,IAAI,EAAE,IAAI,CAAC,UAAU,KAAK,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,MAAM,CAAC,CAAC,QAAQ;AAClG,EAAE,CAAC;AACH;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,QAAQ,EAAE,IAAI,EAAE;AAC5C,CAAC,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,8BAA8B,CAAC,CAAC;AAChI,CAAC,MAAM,CAAC,GAAG,IAAI;AACf,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,cAAc,CAAC;AACtC,CAAC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,oBAAoB,EAAE,QAAQ,CAAC,wCAAwC,CAAC,CAAC;AAChJ,CAAC,OAAO;AACR,EAAE,WAAW;AACb,EAAE,YAAY,EAAE,OAAO,CAAC,CAAC,eAAe,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,eAAe,CAAC,GAAG,MAAM;AACpF,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG,MAAM;AAC3E,EAAE,SAAS,EAAE,OAAO,CAAC,CAAC,YAAY,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,YAAY,CAAC,GAAG;AACrE,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,uBAAuB,CAAC,IAAI,EAAE;AAC7C,CAAC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,EAAE;AAC3B,CAAC,IAAI;AACL,EAAE,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE;AACjC,EAAE,MAAM,IAAI,GAAG,IAAI,CAAC,mBAAmB,CAAC,IAAI,IAAI,CAAC,OAAO,CAAC;AACzD,EAAE,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,IAAI,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC;AAC3D,EAAE,IAAI,IAAI,KAAK,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE;AACjD,GAAG,MAAM,CAAC,GAAG,IAAI;AACjB,GAAG,MAAM,OAAO,GAAG,OAAO,CAAC,CAAC,SAAS,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,SAAS,CAAC,GAAG,KAAK,CAAC;AAC3E,GAAG,MAAM,IAAI,GAAG,OAAO,CAAC,CAAC,MAAM,CAAC,KAAK,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;AAClE,GAAG,IAAI,OAAO,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,EAAE,OAAO,CAAC,CAAC;AAChE,GAAG,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACpD,EAAE;AACF,EAAE,OAAO,CAAC,GAAG,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC;AACnD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,IAAI;AACN,GAAG,MAAM,IAAI,GAAG,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE;AAC1C,GAAG,OAAO,IAAI,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE;AAChD,EAAE,CAAC,CAAC,MAAM;AACV,GAAG,OAAO,EAAE;AACZ,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,2BAA2B,GAAG,qCAAqC;AACvE,IAAI,6BAA6B,GAAG,cAAc;AAClD,IAAI,sBAAsB,GAAG,kCAAkC;AAC/D,IAAI,4BAA4B,GAAG,8BAA8B;AACjE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,wBAAwB,GAAG,CAAC,EAAE,6BAA6B,CAAC,CAAC,EAAE,sBAAsB,CAAC,2BAA2B,CAAC;AACtH;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,4BAA4B,GAAG,CAAC,OAAO,EAAE,4BAA4B,CAAC,CAAC;AAC3E;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,0BAA0B,GAAG,IAAI;AACrC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,wBAAwB,CAAC,YAAY,EAAE;AACtD,CAAC,IAAI,CAAC,YAAY,EAAE,MAAM,IAAI,KAAK,CAAC,qDAAqD,CAAC;AAC1F,CAAC,MAAM,QAAQ,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,wBAAwB;AACjG,CAAC,MAAM,YAAY,GAAG,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,CAAC,IAAI,EAAE,EAAE,IAAI,EAAE,IAAI,4BAA4B;AAC7G,CAAC,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;AAClC,EAAE,UAAU,EAAE,eAAe;AAC7B,EAAE,SAAS,EAAE,QAAQ;AACrB,EAAE,aAAa,EAAE;AACjB,EAAE,CAAC;AACH,CAAC,IAAI,YAAY,EAAE,IAAI,CAAC,GAAG,CAAC,eAAe,EAAE,YAAY,CAAC;AAC1D,CAAC,MAAM,IAAI,GAAG,MAAM,UAAU,CAAC,KAAK,CAAC,2BAA2B,EAAE;AAClE,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,OAAO,EAAE;AACX,GAAG,cAAc,EAAE,mCAAmC;AACtD,GAAG,MAAM,EAAE;AACX,GAAG;AACH,EAAE,IAAI,EAAE,IAAI,CAAC,QAAQ;AACrB,EAAE,CAAC;AACH,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;AACf,EAAE,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,IAAI,CAAC;AACpD,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,kCAAkC,EAAE,IAAI,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC;AAC9E,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE;AACjC,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,cAAc,CAAC;AAC3C,CAAC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,CAAC,WAAW,EAAE,MAAM,IAAI,KAAK,CAAC,oDAAoD,CAAC;AAC3H,CAAC,MAAM,YAAY,GAAG,MAAM,CAAC,YAAY,CAAC;AAC1C,CAAC,MAAM,gBAAgB,GAAG,OAAO,YAAY,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,YAAY,CAAC,IAAI,YAAY,GAAG,CAAC,GAAG,YAAY,GAAG,0BAA0B;AAC3J,CAAC,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,gBAAgB,GAAG,GAAG;AACtD,CAAC,MAAM,OAAO,GAAG,MAAM,CAAC,eAAe,CAAC;AACxC,CAAC,OAAO;AACR,EAAE,WAAW;AACb,EAAE,SAAS;AACX,EAAE,YAAY,EAAE,OAAO,OAAO,KAAK,QAAQ,IAAI,OAAO,GAAG,OAAO,GAAG;AACnE,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG,GAAG;AACzB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,GAAG;AAC9B,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,mBAAmB,CAAC;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,CAAC,GAAG,EAAE;AACnC,CAAC,IAAI,IAAI;AACT,CAAC,IAAI;AACL,EAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AACxB,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD,CAAC,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,IAAI;AAC1E,CAAC,MAAM,GAAG,GAAG,IAAI;AACjB,CAAC,MAAM,GAAG,GAAG,EAAE;AACf,CAAC,IAAI,OAAO,GAAG,CAAC,cAAc,CAAC,KAAK,QAAQ,EAAE,GAAG,CAAC,YAAY,GAAG,GAAG,CAAC,cAAc,CAAC;AACpF,CAAC,IAAI,OAAO,GAAG,CAAC,eAAe,CAAC,KAAK,QAAQ,EAAE,GAAG,CAAC,aAAa,GAAG,GAAG,CAAC,eAAe,CAAC;AACvF,CAAC,IAAI,OAAO,GAAG,CAAC,YAAY,CAAC,KAAK,QAAQ,IAAI,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,YAAY,CAAC,CAAC,EAAE,GAAG,CAAC,UAAU,GAAG,GAAG,CAAC,YAAY,CAAC;AACpH,CAAC,IAAI,OAAO,GAAG,CAAC,OAAO,CAAC,KAAK,QAAQ,EAAE,GAAG,CAAC,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC;AAC/D,CAAC,OAAO,GAAG;AACX;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG,MAAM;AAC5B,CAAC,QAAQ,GAAG,YAAY;AACxB,CAAC,QAAQ,GAAG,QAAQ;AACpB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,MAAM,IAAI,GAAG,kBAAkB,EAAE;AACnC,EAAE,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,OAAO,EAAE,EAAE,EAAE;AAC/C,EAAE,IAAI,GAAG;AACT,EAAE,IAAI;AACN,GAAG,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;AACpC,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,OAAO;AACV,IAAI,OAAO,EAAE,EAAE;AACf,IAAI,QAAQ,EAAE,CAAC,CAAC,2BAA2B,EAAE,IAAI,CAAC,EAAE,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC;AACnE,IAAI;AACJ,EAAE;AACF,EAAE,MAAM,MAAM,GAAG,oBAAoB,CAAC,GAAG,CAAC;AAC1C,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO;AACtB,GAAG,OAAO,EAAE,EAAE;AACd,GAAG,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,kCAAkC,CAAC;AACrE,GAAG;AACH,EAAE,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,OAAO;AACnC,GAAG,OAAO,EAAE,EAAE;AACd,GAAG,QAAQ,EAAE,CAAC,CAAC,YAAY,EAAE,IAAI,CAAC,wBAAwB,CAAC;AAC3D,GAAG;AACH,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACxB,EAAE,IAAI,OAAO,MAAM,CAAC,UAAU,KAAK,QAAQ,IAAI,MAAM,CAAC,UAAU,GAAG,eAAe,IAAI,GAAG,IAAI,MAAM,CAAC,aAAa,EAAE,IAAI;AACvH,GAAG,MAAM,SAAS,GAAG,MAAM,wBAAwB,CAAC,MAAM,CAAC,aAAa,CAAC;AACzE,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AACtB,IAAI,QAAQ,EAAE,QAAQ;AACtB,IAAI,KAAK,EAAE,aAAa;AACxB,IAAI,QAAQ,EAAE,OAAO;AACrB,IAAI,WAAW,EAAE,SAAS,CAAC,WAAW;AACtC,IAAI,SAAS,EAAE,SAAS,CAAC,SAAS;AAClC,IAAI,MAAM,EAAE,YAAY;AACxB,IAAI,YAAY,EAAE,SAAS,CAAC,YAAY,IAAI,MAAM,CAAC,aAAa;AAChE,IAAI,GAAG,MAAM,CAAC,KAAK,GAAG,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG;AAC9D,IAAI,CAAC,EAAE;AACP,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,OAAO;AACV,IAAI,OAAO,EAAE,CAAC;AACd,KAAK,QAAQ,EAAE,QAAQ;AACvB,KAAK,KAAK,EAAE,aAAa;AACzB,KAAK,QAAQ,EAAE,OAAO;AACtB,KAAK,WAAW,EAAE,MAAM,CAAC,YAAY;AACrC,KAAK,SAAS,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;AACzC,KAAK,MAAM,EAAE,YAAY;AACzB,KAAK,GAAG,MAAM,CAAC,aAAa,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE;AAC1E,KAAK,GAAG,MAAM,CAAC,KAAK,GAAG,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG;AAC/D,KAAK,CAAC;AACN,IAAI,QAAQ,EAAE,CAAC,CAAC,uDAAuD,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;AACvF,IAAI;AACJ,EAAE;AACF,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AACrB,GAAG,QAAQ,EAAE,QAAQ;AACrB,GAAG,KAAK,EAAE,aAAa;AACvB,GAAG,QAAQ,EAAE,OAAO;AACpB,GAAG,WAAW,EAAE,MAAM,CAAC,YAAY;AACnC,GAAG,SAAS,EAAE,MAAM,CAAC,UAAU,IAAI,IAAI;AACvC,GAAG,MAAM,EAAE,YAAY;AACvB,GAAG,GAAG,MAAM,CAAC,aAAa,GAAG,EAAE,YAAY,EAAE,MAAM,CAAC,aAAa,EAAE,GAAG,EAAE;AACxE,GAAG,GAAG,MAAM,CAAC,KAAK,GAAG,EAAE,QAAQ,EAAE,EAAE,KAAK,EAAE,MAAM,CAAC,KAAK,EAAE,EAAE,GAAG;AAC7D,GAAG,CAAC,EAAE;AACN,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,IAAI,eAAe,GAAG,IAAI,eAAe,EAAE;AA2H3C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,eAAe,GAAG,IAAI,MAAM,cAAc,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA,CAAC,OAAO,mBAAmB,IAAI,GAAG,EAAE;AACpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,QAAQ,CAAC,MAAM,EAAE;AAClB,EAAE,MAAM,GAAG,GAAG,cAAc,CAAC,OAAO,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;AACtE,EAAE,IAAI,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,iEAAiE,EAAE,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;AAClK,EAAE,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC;AAC/B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,GAAG;AACV,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,CAAC;AAC1C,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,aAAa,CAAC,QAAQ,EAAE;AACzB,EAAE,OAAO,IAAI,CAAC,MAAM,EAAE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;AAC7D,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,OAAO,OAAO,CAAC,QAAQ,EAAE,QAAQ,EAAE;AACpC,EAAE,OAAO,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,QAAQ,CAAC,CAAC;AACnC,CAAC;AACD,CAAC;AACD,eAAe,CAAC,QAAQ,CAAC,sBAAsB,EAAE,CAAC;AAClD,eAAe,CAAC,QAAQ,CAAC,oBAAoB,EAAE,CAAC;AAChD,eAAe,CAAC,QAAQ,CAAC,cAAc,CAAC;AACxC,eAAe,CAAC,QAAQ,CAAC,eAAe,CAAC;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,aAAa;AAC1C;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,aAAa;AACrC;AACA;AACA;AACA;AACA;AACA,IAAI,gBAAgB,GAAG,oBAAoB;AAC3C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,aAAa,GAAG,aAAa;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,yBAAyB,GAAG;AACrC,CAAC,OAAO,IAAI,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,sBAAsB,CAAC;AACnE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,sBAAsB,GAAG;AAClC,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,sBAAsB,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,GAAG;AAC/B,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,iBAAiB,EAAE,gBAAgB,CAAC;AAChE;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,GAAG;AAC1B,CAAC,OAAO,CAAC,EAAE,yBAAyB,EAAE,CAAC,IAAI,CAAC;AAC5C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,8BAA8B,GAAG;AAC1C,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,sBAAsB,EAAE;AACzC,EAAE,MAAM,MAAM,GAAG,yBAAyB,EAAE;AAC5C,EAAE,MAAM,MAAM,GAAG,mBAAmB,EAAE;AACtC,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE,OAAO,KAAK;AACtC,EAAE,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,EAAE;AAC3B,GAAG,WAAW,CAAC,MAAM,CAAC;AACtB,GAAG,OAAO,KAAK;AACf,EAAE;AACF,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE;AAC1B,GAAG,iBAAiB,CAAC,MAAM,CAAC;AAC5B,GAAG,WAAW,CAAC,MAAM,CAAC;AACtB,GAAG,OAAO,KAAK;AACf,EAAE;AACF,EAAE,MAAM,GAAG,GAAG,YAAY,CAAC,MAAM,EAAE,OAAO,CAAC;AAC3C,EAAE,IAAI;AACN,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AAClB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,wCAAwC,EAAE,MAAM,CAAC,oBAAoB,EAAE,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AACxG,GAAG,OAAO,KAAK;AACf,EAAE;AACF,EAAE,SAAS,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AAC/D,EAAE,MAAM,IAAI,GAAG,cAAc,EAAE;AAC/B,EAAE,aAAa,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AACzC,EAAE,UAAU,CAAC,IAAI,EAAE,MAAM,CAAC;AAC1B,EAAE,WAAW,CAAC,MAAM,CAAC;AACrB,EAAE,IAAI;AACN,GAAG,UAAU,CAAC,MAAM,EAAE,CAAC,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC;AAClD,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,yDAAyD,EAAE,GAAG,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,yBAAyB,CAAC,CAAC;AAClJ,EAAE;AACF,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,+BAA+B,EAAE,MAAM,CAAC,GAAG,EAAE,MAAM,CAAC,YAAY,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC,CAAC,CAAC;AAC7G,EAAE,OAAO,IAAI;AACb,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,IAAI;AACN,GAAG,MAAM,IAAI,GAAG,cAAc,EAAE;AAChC,GAAG,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE,UAAU,CAAC,IAAI,CAAC;AACzC,EAAE,CAAC,CAAC,MAAM,CAAC;AACX,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,uCAAuC,EAAE,GAAG,CAAC,OAAO,CAAC,yEAAyE,CAAC,CAAC;AACjJ,EAAE,OAAO,KAAK;AACd,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,UAAU,EAAE;AACjC,CAAC,IAAI;AACL,EAAE,SAAS,CAAC,IAAI,CAAC,WAAW,EAAE,EAAE,iBAAiB,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACxE,EAAE,aAAa,CAAC,UAAU,EAAE,CAAC,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAC7F,CAAC,CAAC,CAAC,MAAM,CAAC;AACV;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,CAAC,MAAM,EAAE;AACnC,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,CAAC,EAAE,MAAM,CAAC,EAAE,aAAa,CAAC,CAAC;AAC5C,EAAE,IAAI,UAAU,CAAC,MAAM,CAAC,EAAE;AAC1B,EAAE,UAAU,CAAC,MAAM,EAAE,MAAM,CAAC;AAC5B,CAAC,CAAC,CAAC,MAAM,CAAC;AACV;AACA,IAAI,iBAAiB,GAAG,KAAK;AAC7B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,0BAA0B,GAAG;AACtC,CAAC,IAAI,iBAAiB,EAAE;AACxB,CAAC,iBAAiB,GAAG,IAAI;AACzB,CAAC,8BAA8B,EAAE;AACjC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,QAAQ,GAAG,SAAS,CAAC,4BAA4B,CAAC;AACtD;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,qBAAqB,GAAG,iBAAiB;AAC7C;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,0BAA0B,GAAG,aAAa;AAC9C;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,2BAA2B;AACxD;AACA;AACA;AACA,SAAS,cAAc,GAAG;AAC1B,CAAC,MAAM,IAAI,GAAG,WAAW,EAAE;AAC3B,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,IAAI,CAAC,IAAI,EAAE,eAAe,CAAC;AACvC,EAAE,OAAO,EAAE,IAAI,CAAC,IAAI,EAAE,CAAC,aAAa,EAAE,0BAA0B,CAAC,CAAC,CAAC;AACnE,EAAE,UAAU,EAAE,IAAI,CAAC,IAAI,EAAE,sBAAsB;AAC/C,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,UAAU,EAAE;AACjC,CAAC,IAAI;AACL,EAAE,aAAa,CAAC,UAAU,EAAE,CAAC,EAAE,iBAAiB,IAAI,IAAI,EAAE,EAAE,WAAW,EAAE,CAAC,EAAE,CAAC,EAAE;AAC/E,GAAG,QAAQ,EAAE,OAAO;AACpB,GAAG,IAAI,EAAE,IAAI;AACb,GAAG,IAAI,EAAE;AACT,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE;AAC7B,EAAE,QAAQ,CAAC,KAAK,CAAC;AACjB,GAAG,UAAU;AACb,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACvD,GAAG,EAAE,gDAAgD,CAAC;AACtD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,QAAQ,EAAE;AAC/B,CAAC,IAAI;AACL,EAAE,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,OAAO,IAAI;AACxC,EAAE,OAAO,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;AACvD,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,QAAQ,CAAC,IAAI,CAAC;AAChB,GAAG,QAAQ;AACX,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AACvD,GAAG,EAAE,mDAAmD,CAAC;AACzD,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,4BAA4B,GAAG;AAC9C,CAAC,MAAM,EAAE,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,GAAG,cAAc,EAAE;AAC3D,CAAC,IAAI,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO;AACpC,EAAE,MAAM,EAAE,gBAAgB;AAC1B,EAAE,QAAQ;AACV,EAAE,OAAO,EAAE,IAAI;AACf,EAAE;AACF,EAAE;AACF,CAAC,IAAI,QAAQ,GAAG,IAAI;AACpB,CAAC,IAAI;AACL,EAAE,QAAQ,GAAG,MAAM,oBAAoB,CAAC,WAAW,EAAE,qBAAqB,CAAC;AAC3E,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,QAAQ,CAAC,IAAI,CAAC,EAAE,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,EAAE,EAAE,mEAAmE,CAAC;AAC/I,EAAE,OAAO;AACT,GAAG,MAAM,EAAE,cAAc;AACzB,GAAG,QAAQ;AACX,GAAG,OAAO,EAAE,IAAI;AAChB,GAAG;AACH,GAAG;AACH,CAAC;AACD,CAAC,IAAI,QAAQ,EAAE;AACf,EAAE,WAAW,CAAC,UAAU,CAAC;AACzB,EAAE,OAAO;AACT,GAAG,MAAM,EAAE,kBAAkB;AAC7B,GAAG,QAAQ;AACX,GAAG,OAAO,EAAE,IAAI;AAChB,GAAG;AACH,GAAG;AACH,CAAC;AACD,CAAC,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE;AAC5B,EAAE,WAAW,CAAC,UAAU,CAAC;AACzB,EAAE,OAAO;AACT,GAAG,MAAM,EAAE,cAAc;AACzB,GAAG,QAAQ;AACX,GAAG,OAAO,EAAE,IAAI;AAChB,GAAG;AACH,GAAG;AACH,CAAC;AACD,CAAC,MAAM,KAAK,GAAG,WAAW,CAAC,QAAQ,CAAC;AACpC,CAAC,IAAI,CAAC,KAAK,EAAE;AACb,EAAE,WAAW,CAAC,UAAU,CAAC;AACzB,EAAE,OAAO;AACT,GAAG,MAAM,EAAE,iBAAiB;AAC5B,GAAG,QAAQ;AACX,GAAG,OAAO,EAAE,IAAI;AAChB,GAAG;AACH,GAAG;AACH,CAAC;AACD,CAAC,IAAI;AACL,EAAE,MAAM,aAAa,CAAC;AACtB,GAAG,QAAQ,EAAE,WAAW;AACxB,GAAG,KAAK,EAAE,qBAAqB;AAC/B,GAAG,QAAQ,EAAE,SAAS;AACtB,GAAG,WAAW,EAAE,KAAK;AACrB,GAAG,MAAM,EAAE,QAAQ;AACnB,GAAG,QAAQ,EAAE;AACb,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,QAAQ,CAAC,KAAK,CAAC;AACjB,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;AACxD,GAAG;AACH,GAAG,EAAE,wFAAwF,CAAC;AAC9F,EAAE,OAAO;AACT,GAAG,MAAM,EAAE,cAAc;AACzB,GAAG,QAAQ;AACX,GAAG,OAAO,EAAE,IAAI;AAChB,GAAG;AACH,GAAG;AACH,CAAC;AACD,CAAC,IAAI;AACL,EAAE,UAAU,CAAC,QAAQ,EAAE,OAAO,CAAC;AAC/B,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,QAAQ,CAAC,IAAI,CAAC;AAChB,GAAG,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC;AACxD,GAAG,QAAQ;AACX,GAAG;AACH,GAAG,EAAE,6FAA6F,CAAC;AACnG,EAAE,OAAO;AACT,GAAG,MAAM,EAAE,UAAU;AACrB,GAAG,QAAQ;AACX,GAAG,OAAO,EAAE,IAAI;AAChB,GAAG;AACH,GAAG;AACH,CAAC;AACD,CAAC,WAAW,CAAC,UAAU,CAAC;AACxB,CAAC,QAAQ,CAAC,IAAI,CAAC;AACf,EAAE,QAAQ;AACV,EAAE,OAAO;AACT,EAAE,UAAU;AACZ,EAAE,KAAK,EAAE;AACT,EAAE,EAAE,kEAAkE,CAAC;AACvE,CAAC,OAAO;AACR,EAAE,MAAM,EAAE,UAAU;AACpB,EAAE,QAAQ;AACV,EAAE,OAAO;AACT,EAAE;AACF,EAAE;AACF;AACA,IAAI,eAAe,GAAG,KAAK;AAC3B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oCAAoC,GAAG;AAChD,CAAC,IAAI,eAAe,EAAE;AACtB,CAAC,eAAe,GAAG,IAAI;AACvB,CAAC,4BAA4B,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,QAAQ,GAAG;AACf,CAAC,SAAS,EAAE,mBAAmB;AAC/B,CAAC,MAAM,EAAE,gBAAgB;AACzB,CAAC,MAAM,EAAE,gBAAgB;AACzB,CAAC,QAAQ,EAAE,kBAAkB;AAC7B,CAAC,UAAU,EAAE,oBAAoB;AACjC,CAAC,OAAO,EAAE,aAAa;AACvB,CAAC,QAAQ,EAAE,kBAAkB;AAC7B,CAAC,GAAG,EAAE,aAAa;AACnB,CAAC,IAAI,EAAE,cAAc;AACrB,CAAC,WAAW,EAAE,mBAAmB;AACjC,CAAC,MAAM,EAAE;AACT;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gBAAgB,GAAG;AAC5B,CAAC,OAAO,yBAAyB,EAAE;AACnC;AACA;AACA,SAAS,iBAAiB,CAAC,WAAW,EAAE;AACxC,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,OAAO,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,OAAO,EAAE,aAAa,CAAC;AAC5E;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,QAAQ,EAAE;AACzC,CAAC,0BAA0B,EAAE;AAC7B,CAAC,MAAM,YAAY,GAAG,yBAAyB,CAAC,gBAAgB,EAAE,EAAE,QAAQ,CAAC;AAC7E,CAAC,IAAI,YAAY,EAAE,OAAO,YAAY;AACtC,CAAC,OAAO,yBAAyB,CAAC,sBAAsB,EAAE,EAAE,QAAQ,CAAC;AACrE;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,GAAG;AAChC,CAAC,IAAI;AACL,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,WAAW,EAAE,EAAE,eAAe,CAAC;AACtD,EAAE,IAAI,CAAC,UAAU,CAAC,OAAO,CAAC,EAAE,OAAO,IAAI;AACvC,EAAE,OAAO,YAAY,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,IAAI,EAAE,IAAI,IAAI;AACtD,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA;AACA;AACA;AACA;AACA,SAAS,yBAAyB,CAAC,UAAU,EAAE,QAAQ,EAAE;AACzD,CAAC,IAAI;AACL,EAAE,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,OAAO,IAAI;AAC1C,EAAE,MAAM,GAAG,GAAG,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC;AAC/C,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC;AACpC,EAAE,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ,EAAE,OAAO,IAAI;AAClD,EAAE,MAAM,SAAS,GAAG,GAAG,CAAC,WAAW,CAAC;AACpC,EAAE,IAAI,CAAC,SAAS,IAAI,OAAO,SAAS,KAAK,QAAQ,EAAE,OAAO,IAAI;AAC9D,EAAE,MAAM,KAAK,GAAG,SAAS,CAAC,QAAQ,CAAC;AACnC,EAAE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,OAAO,IAAI;AACtD,EAAE,MAAM,MAAM,GAAG,KAAK,CAAC,QAAQ,CAAC;AAChC,EAAE,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO,MAAM,CAAC,IAAI,EAAE;AACvE,EAAE,OAAO,IAAI;AACb,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,QAAQ,EAAE,OAAO,GAAG,EAAE,EAAE;AACpD,CAAC,oCAAoC,EAAE;AACvC,CAAC,IAAI,OAAO,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE;AAC7B,EAAE,MAAM,KAAK,GAAG,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE;AACrC,EAAE,OAAO;AACT,GAAG,QAAQ;AACX,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,MAAM,EAAE,UAAU;AACrB,GAAG,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK;AAC3C,GAAG;AACH,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,QAAQ,CAAC,QAAQ,CAAC;AAClC,CAAC,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,CAAC;AACnC,CAAC,IAAI,MAAM,EAAE,IAAI,EAAE,EAAE;AACrB,EAAE,MAAM,KAAK,GAAG,MAAM,CAAC,IAAI,EAAE;AAC7B,EAAE,OAAO;AACT,GAAG,QAAQ;AACX,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,MAAM,EAAE,KAAK;AAChB,GAAG,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,KAAK;AAC3C,GAAG;AACH,CAAC;AACD,CAAC,MAAM,MAAM,GAAG,6BAA6B,CAAC,QAAQ,CAAC;AACvD,CAAC,IAAI,MAAM,EAAE;AACb,EAAE,MAAM,YAAY,GAAG,MAAM,CAAC,QAAQ,KAAK,OAAO,GAAG,OAAO,GAAG,SAAS;AACxE,EAAE,OAAO;AACT,GAAG,QAAQ;AACX,GAAG,MAAM,EAAE,MAAM,CAAC,WAAW,IAAI,IAAI;AACrC,GAAG,MAAM,EAAE,WAAW;AACtB,GAAG,QAAQ,EAAE;AACb,GAAG;AACH,CAAC;AACD,CAAC,MAAM,SAAS,GAAG,qBAAqB,CAAC,QAAQ,CAAC;AAClD,CAAC,IAAI,SAAS,EAAE;AAChB,EAAE,gCAAgC,CAAC,QAAQ,CAAC;AAC5C,EAAE,OAAO;AACT,GAAG,QAAQ;AACX,GAAG,MAAM,EAAE,SAAS;AACpB,GAAG,MAAM,EAAE,eAAe;AAC1B,GAAG,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,SAAS;AAC/C,GAAG;AACH,CAAC;AACD,CAAC,IAAI,QAAQ,KAAK,WAAW,EAAE;AAC/B,EAAE,MAAM,OAAO,GAAG,oBAAoB,EAAE;AACxC,EAAE,IAAI,OAAO,EAAE,OAAO;AACtB,GAAG,QAAQ;AACX,GAAG,MAAM,EAAE,OAAO;AAClB,GAAG,MAAM,EAAE,eAAe;AAC1B,GAAG,QAAQ,EAAE,cAAc,CAAC,QAAQ,EAAE,OAAO;AAC7C,GAAG;AACH,CAAC;AACD,CAAC,IAAI,OAAO,CAAC,WAAW,EAAE;AAC1B,EAAE,IAAI,yBAAyB,CAAC,iBAAiB,CAAC,OAAO,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,EAAE,+BAA+B,CAAC,QAAQ,CAAC;AAC5H,CAAC;AACD,CAAC,OAAO;AACR,EAAE,QAAQ;AACV,EAAE,MAAM,EAAE,IAAI;AACd,EAAE,MAAM,EAAE,MAAM;AAChB,EAAE,QAAQ,EAAE;AACZ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,oBAAoB,mBAAmB,IAAI,GAAG,EAAE;AACpD,IAAI,qBAAqB,mBAAmB,IAAI,GAAG,EAAE;AACrD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,gCAAgC,CAAC,QAAQ,EAAE;AACpD,CAAC,IAAI,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;AACzC,CAAC,oBAAoB,CAAC,GAAG,CAAC,QAAQ,CAAC;AACnC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,mCAAmC,EAAE,QAAQ,CAAC,oGAAoG,EAAE,QAAQ,CAAC,yBAAyB,CAAC,CAAC;AAC/M;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,+BAA+B,CAAC,QAAQ,EAAE;AACnD,CAAC,IAAI,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC,EAAE;AAC1C,CAAC,qBAAqB,CAAC,GAAG,CAAC,QAAQ,CAAC;AACpC,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,iCAAiC,EAAE,QAAQ,CAAC,kMAAkM,CAAC,CAAC;AACvQ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,cAAc,CAAC,QAAQ,EAAE,KAAK,EAAE;AACzC,CAAC,IAAI,QAAQ,KAAK,WAAW,EAAE,OAAO,SAAS;AAC/C,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,IAAI,KAAK,CAAC,UAAU,CAAC,aAAa,CAAC,EAAE,OAAO,OAAO;AACvF,CAAC,OAAO,SAAS;AACjB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,WAAW,CAAC,IAAI,EAAE;AAC3B,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE;AAC5B,CAAC,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,EAAE;AACpC,EAAE,IAAI,IAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,OAAO;AACxC,GAAG,aAAa,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;AACzC,GAAG,gBAAgB,EAAE,kBAAkB;AACvC,GAAG,mBAAmB,EAAE;AACxB,GAAG;AACH,EAAE,OAAO;AACT,GAAG,WAAW,EAAE,IAAI,CAAC,MAAM;AAC3B,GAAG,mBAAmB,EAAE;AACxB,GAAG;AACH,CAAC;AACD,CAAC,OAAO,EAAE,aAAa,EAAE,CAAC,OAAO,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC,EAAE;AAClD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,qBAAqB,CAAC,MAAM,EAAE,QAAQ,EAAE;AACvD,CAAC,IAAI,QAAQ,KAAK,SAAS,EAAE,OAAO,EAAE;AACtC,CAAC,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,KAAK,EAAE;AACvC,CAAC,OAAO,WAAW,CAAC;AACpB,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC3B,EAAE,MAAM,EAAE,SAAS,CAAC,KAAK;AACzB,EACE,QAAQ,EAAE,QAAQ,KAAK,OAAO,GAAG,OAAO,GAAG;AAC7C,EAAE,CAAC;AACH;AAUA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,MAAM,GAAG,SAAS,CAAC,uBAAuB,CAAC;AAC/C;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,oBAAoB,GAAG;AAChC,CAAC,OAAO,IAAI,CAAC,WAAW,EAAE,EAAE,sBAAsB,CAAC;AACnD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,qBAAqB,CAAC,IAAI,EAAE;AACrC,CAAC,IAAI,UAAU,CAAC,IAAI,CAAC,EAAE;AACvB,CAAC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC;AAC1B,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,SAAS,CAAC,GAAG,EAAE;AACtC,EAAE,SAAS,EAAE,IAAI;AACjB,EAAE,IAAI,EAAE;AACR,EAAE,CAAC;AACH,MAAM,IAAI;AACV,EAAE,SAAS,CAAC,GAAG,EAAE,GAAG,CAAC;AACrB,CAAC,CAAC,CAAC,MAAM,CAAC;AACV,CAAC,IAAI;AACL,EAAE,aAAa,CAAC,IAAI,EAAE,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE;AACpE,GAAG,QAAQ,EAAE,OAAO;AACpB,GAAG,IAAI,EAAE,IAAI;AACb,GAAG,IAAI,EAAE;AACT,GAAG,CAAC;AACJ,CAAC,CAAC,CAAC,OAAO,GAAG,EAAE;AACf,EAAE,IAAI,GAAG,CAAC,IAAI,KAAK,QAAQ,EAAE,MAAM,GAAG;AACtC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,iBAAiB,GAAG,KAAK;AAC7B,SAAS,gBAAgB,CAAC,IAAI,EAAE;AAChC,CAAC,IAAI,iBAAiB,EAAE;AACxB,CAAC,IAAI;AACL,EAAE,MAAM,IAAI,GAAG,QAAQ,CAAC,IAAI,CAAC,CAAC,IAAI,GAAG,GAAG;AACxC,EAAE,IAAI,IAAI,KAAK,GAAG,IAAI,IAAI,KAAK,CAAC,EAAE;AAClC,GAAG,MAAM,CAAC,IAAI,CAAC;AACf,IAAI,IAAI;AACR,IAAI,IAAI,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;AACzB,IAAI,EAAE,oDAAoD,CAAC;AAC3D,GAAG,iBAAiB,GAAG,IAAI;AAC3B,EAAE;AACF,CAAC,CAAC,CAAC,MAAM,CAAC;AACV;AACA;AACA;AACA;AACA,SAAS,UAAU,GAAG;AACtB,CAAC,OAAO;AACR,EAAE,OAAO,EAAE,CAAC;AACZ,EAAE,eAAe,EAAE,sBAAsB;AACzC,EAAE,WAAW,EAAE;AACf,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,aAAa,GAAG;AACzB,CAAC,MAAM,IAAI,GAAG,oBAAoB,EAAE;AACpC,CAAC,IAAI,GAAG;AACR,CAAC,IAAI;AACL,EAAE,GAAG,GAAG,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC;AACnC,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,UAAU,EAAE;AACrB,CAAC;AACD,CAAC,gBAAgB,CAAC,IAAI,CAAC;AACvB,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,EAAE,OAAO,UAAU,EAAE;AACrC,CAAC,IAAI;AACL,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC;AAChC,EAAE,IAAI,MAAM,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,WAAW,CAAC,EAAE,OAAO,UAAU,EAAE;AACrF,EAAE,OAAO;AACT,GAAG,OAAO,EAAE,CAAC;AACb,GAAG,eAAe,EAAE,MAAM,CAAC,eAAe,IAAI,sBAAsB;AACpE,GAAG,WAAW,EAAE,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,kBAAkB,CAAC,CAAC,CAAC;AACtE,GAAG;AACH,CAAC,CAAC,CAAC,MAAM;AACT,EAAE,OAAO,UAAU,EAAE;AACrB,CAAC;AACD;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,KAAK,EAAE;AACnC,CAAC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,OAAO,KAAK;AACtD,CAAC,MAAM,CAAC,GAAG,KAAK;AAChB,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC;AAC/B,CAAC,MAAM,KAAK,GAAG,CAAC,CAAC,OAAO,CAAC;AACzB,CAAC,MAAM,QAAQ,GAAG,CAAC,CAAC,UAAU,CAAC;AAC/B,CAAC,MAAM,WAAW,GAAG,CAAC,CAAC,aAAa,CAAC;AACrC,CAAC,MAAM,aAAa,GAAG,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,QAAQ,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,WAAW,IAAI,QAAQ,KAAK,YAAY,IAAI,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,UAAU,IAAI,QAAQ,KAAK,KAAK,IAAI,QAAQ,KAAK,MAAM;AACvR,CAAC,MAAM,SAAS,GAAG,QAAQ,KAAK,SAAS,IAAI,QAAQ,KAAK,OAAO,IAAI,QAAQ,KAAK,SAAS;AAC3F,CAAC,IAAI,CAAC,aAAa,EAAE,OAAO,KAAK;AACjC,CAAC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,CAAC,KAAK,EAAE,OAAO,KAAK;AACtD,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,KAAK;AAC7B,CAAC,IAAI,OAAO,WAAW,KAAK,QAAQ,EAAE,OAAO,KAAK;AAClD,CAAC,OAAO,IAAI;AACZ;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,QAAQ,mBAAmB,IAAI,GAAG,EAAE;AACxC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE;AAC1D,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK;AAC5C,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,QAAQ,EAAE,OAAO,KAAK;AAC3C,EAAE,IAAI,CAAC,CAAC,QAAQ,KAAK,IAAI,EAAE,OAAO,KAAK;AACvC,EAAE,IAAI,OAAO,CAAC,CAAC,SAAS,KAAK,QAAQ,IAAI,CAAC,CAAC,SAAS,GAAG,CAAC,IAAI,CAAC,CAAC,SAAS,IAAI,GAAG,EAAE;AAChF,GAAG,MAAM,CAAC,IAAI,CAAC;AACf,IAAI,QAAQ,EAAE,CAAC,CAAC,QAAQ;AACxB,IAAI,KAAK,EAAE,CAAC,CAAC,KAAK;AAClB,IAAI,SAAS,EAAE,CAAC,CAAC;AACjB,IAAI,EAAE,mCAAmC,CAAC;AAC1C,GAAG,OAAO,KAAK;AACf,EAAE;AACF,EAAE,OAAO,IAAI;AACb,CAAC,CAAC,CAAC;AACH,CAAC,IAAI,WAAW,EAAE;AAClB,EAAE,MAAM,KAAK,GAAG,GAAG,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,KAAK,KAAK,WAAW,CAAC;AACxD,EAAE,OAAO,KAAK,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE;AAC7B,CAAC;AACD,CAAC,OAAO,CAAC,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;AACxD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,6BAA6B,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE;AAC5D,CAAC,MAAM,IAAI,GAAG,aAAa,EAAE;AAC7B,CAAC,MAAM,QAAQ,GAAG,mBAAmB,CAAC,IAAI,EAAE,QAAQ,EAAE,IAAI,CAAC,WAAW,CAAC;AACvE,CAAC,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,IAAI;AACvC,CAAC,IAAI,IAAI,CAAC,WAAW,EAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;AACjD,CAAC,QAAQ,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,eAAe,IAAI,sBAAsB;AACxE,EAAE,KAAK,cAAc;AACrB,EAAE,KAAK,sBAAsB,EAAE,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;AACzD,EAAE,KAAK,YAAY,EAAE;AACrB,GAAG,MAAM,IAAI,GAAG,CAAC,QAAQ,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,IAAI,QAAQ,CAAC,MAAM;AAC/D,GAAG,QAAQ,CAAC,GAAG,CAAC,QAAQ,EAAE,IAAI,GAAG,CAAC,CAAC;AACnC,GAAG,OAAO,QAAQ,CAAC,IAAI,CAAC,IAAI,IAAI;AAChC,EAAE;AACF,EAAE,SAAS,OAAO,QAAQ,CAAC,CAAC,CAAC,IAAI,IAAI;AACrC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,eAAe,CAAC,QAAQ,EAAE;AACzC,CAAC,MAAM,IAAI,GAAG,aAAa,EAAE;AAC7B,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC,WAAW,CAAC;AAC5C,CAAC,OAAO,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,CAAC;AAC/D;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE;AACrD,CAAC,OAAO,aAAa,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,IAAI,IAAI;AACrG;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,aAAa,CAAC,KAAK,EAAE;AACpC,CAAC,MAAM,IAAI,GAAG,oBAAoB,EAAE;AACpC,CAAC,qBAAqB,CAAC,IAAI,CAAC;AAC5B,CAAC,IAAI,QAAQ,GAAG,IAAI;AACpB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK;AACnC,EAAE,MAAM,IAAI,GAAG,OAAO,IAAI,UAAU,EAAE;AACtC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,EAAE;AAC1B,GAAG,IAAI,CAAC,OAAO,GAAG,CAAC;AACnB,GAAG,IAAI,CAAC,WAAW,GAAG,EAAE;AACxB,EAAE;AACF,EAAE,IAAI,CAAC,eAAe,KAAK,sBAAsB;AACjD,EAAE,MAAM,SAAS,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,KAAK,KAAK,CAAC,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC;AAC/G,EAAE,MAAM,WAAW,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,GAAG,CAAC,CAAC,QAAQ,GAAG,CAAC,EAAE,CAAC,EAAE,CAAC;AACtF,EAAE,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,QAAQ,KAAK,QAAQ,GAAG,KAAK,CAAC,QAAQ,GAAG,WAAW,GAAG,EAAE;AACzF,EAAE,MAAM,IAAI,GAAG;AACf,GAAG,QAAQ,EAAE,KAAK,CAAC,QAAQ;AAC3B,GAAG,KAAK,EAAE,KAAK,CAAC,KAAK;AACrB,GAAG,QAAQ,EAAE,KAAK,CAAC,QAAQ;AAC3B,GAAG,WAAW,EAAE,KAAK,CAAC,WAAW;AACjC,GAAG,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,IAAI;AACrC,GAAG,QAAQ;AACX,GAAG,MAAM,EAAE,KAAK,CAAC,MAAM;AACvB,GAAG,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,IAAI;AACjC,GAAG,YAAY,EAAE,KAAK,CAAC,YAAY;AACnC,GAAG,QAAQ,EAAE,KAAK,CAAC,QAAQ;AAC3B,GAAG,UAAU,EAAE,KAAK,CAAC,UAAU;AAC/B,GAAG,aAAa,EAAE,KAAK,CAAC,aAAa;AACrC,GAAG,gBAAgB,EAAE,KAAK,CAAC,gBAAgB;AAC3C,GAAG,YAAY,EAAE,KAAK,CAAC,YAAY;AACnC,GAAG,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,KAAK;AACpC,GAAG,GAAG,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,IAAI,EAAE,YAAY,EAAE,KAAK,CAAC,YAAY;AACzE,GAAG;AACH,EAAE,IAAI,CAAC,WAAW,GAAG,CAAC,GAAG,SAAS,EAAE,IAAI,CAAC;AACzC,EAAE,QAAQ,GAAG,IAAI;AACjB,EAAE,OAAO,IAAI;AACb,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAClB,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,IAAI,KAAK,CAAC,kEAAkE,CAAC;AACnG,CAAC,OAAO,QAAQ;AAChB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,gBAAgB,CAAC,QAAQ,EAAE,KAAK,EAAE;AACjD,CAAC,MAAM,IAAI,GAAG,oBAAoB,EAAE;AACpC,CAAC,IAAI,CAAC,aAAa,EAAE,CAAC,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,EAAE,OAAO,KAAK;AACzG,CAAC,qBAAqB,CAAC,IAAI,CAAC;AAC5B,CAAC,IAAI,OAAO,GAAG,KAAK;AACpB,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,KAAK;AACnC,EAAE,MAAM,IAAI,GAAG,OAAO,IAAI,UAAU,EAAE;AACtC,EAAE,IAAI,IAAI,CAAC,OAAO,KAAK,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,WAAW,CAAC,EAAE,OAAO,UAAU,EAAE;AACjF,EAAE,MAAM,MAAM,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM;AACxC,EAAE,IAAI,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,QAAQ,KAAK,QAAQ,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK,CAAC,CAAC;AACpG,EAAE,OAAO,GAAG,IAAI,CAAC,WAAW,CAAC,MAAM,GAAG,MAAM;AAC5C,EAAE,IAAI,CAAC,eAAe,KAAK,sBAAsB;AACjD,EAAE,OAAO,IAAI;AACb,CAAC,CAAC,EAAE,EAAE,IAAI,EAAE,GAAG,EAAE,CAAC;AAElB,CAAC,OAAO,OAAO;AACf;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,yBAAyB,CAAC,QAAQ,EAAE,IAAI,GAAG,EAAE,EAAE;AAC9D,CAAC,OAAO,6BAA6B,CAAC,QAAQ,EAAE,IAAI,CAAC;AACrD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,2BAA2B,GAAG;AACvC,CAAC,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,sBAAsB,CAAC,IAAI,uBAAuB;AAC5E,CAAC,OAAO;AACR,EAAE,QAAQ,EAAE,WAAW;AACvB,EAAE,aAAa,EAAE,CAAC,EAAE,IAAI,CAAC,+BAA+B,CAAC;AACzD,EAAE,QAAQ,EAAE,CAAC,EAAE,IAAI,CAAC,gBAAgB,CAAC;AACrC,EAAE,QAAQ,EAAE;AACZ,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,gBAAgB,GAAG,GAAG,GAAG,GAAG;AAChC;AACA,IAAI,sBAAsB,GAAG,IAAI,GAAG,GAAG;AACvC;AACA,IAAI,mBAAmB,GAAG,EAAE,GAAG,GAAG;AAClC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,0BAA0B,GAAG,GAAG;AACpC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,kBAAkB,GAAG,cAAc,KAAK,CAAC;AAC7C,CAAC,QAAQ;AACT,CAAC,QAAQ;AACT,CAAC,UAAU;AACX;AACA,CAAC,IAAI,GAAG,sBAAsB;AAC9B;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,WAAW,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,EAAE;AAC7C,EAAE,KAAK,CAAC,CAAC,0BAA0B,EAAE,QAAQ,CAAC,6BAA6B,EAAE,QAAQ,CAAC,0CAA0C,EAAE,UAAU,GAAG,CAAC,GAAG,IAAI,IAAI,CAAC,UAAU,CAAC,CAAC,WAAW,EAAE,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;AACrM,EAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ;AAC1B,EAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ;AAC1B,EAAE,IAAI,CAAC,UAAU,GAAG,UAAU;AAC9B,EAAE,IAAI,CAAC,IAAI,GAAG,oBAAoB;AAClC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,UAAU,CAAC,SAAS,EAAE;AAC/B,CAAC,IAAI,SAAS,KAAK,GAAG,IAAI,SAAS,KAAK,GAAG,EAAE,OAAO,gBAAgB;AACpE,CAAC,IAAI,SAAS,KAAK,GAAG,EAAE,OAAO,sBAAsB;AACrD,CAAC,OAAO,mBAAmB;AAC3B;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,YAAY,CAAC,UAAU,EAAE;AAClC,CAAC,OAAO,OAAO,UAAU,CAAC,gBAAgB,KAAK,QAAQ,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,gBAAgB;AACnG;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,kBAAkB,CAAC,OAAO,EAAE;AACrC,CAAC,OAAO,CAAC,GAAG,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ,CAAC;AAC5D;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,gBAAgB,mBAAmB,IAAI,GAAG,EAAE;AAChD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,6BAA6B,GAAG,GAAG;AACvC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,qBAAqB,mBAAmB,IAAI,GAAG,EAAE;AACrD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,eAAe,8BAA8B,CAAC,QAAQ,EAAE;AACxD,CAAC,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,QAAQ,CAAC;AAChD,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACvB,CAAC,IAAI,SAAS,GAAG,CAAC;AAClB,CAAC,IAAI,SAAS,GAAG,CAAC;AAClB,CAAC,IAAI,SAAS,GAAG,IAAI;AACrB,CAAC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;AAC9B,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE;AAClC,EAAE,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE;AAC3B,EAAE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,EAAE;AAC/B,EAAE,IAAI,EAAE,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,GAAG,CAAC,IAAI,KAAK,CAAC,SAAS,IAAI,GAAG,GAAG,0BAA0B,CAAC,EAAE;AAC5H,EAAE,MAAM,GAAG,GAAG,CAAC,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;AAC3C,EAAE,MAAM,SAAS,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,CAAC;AAClD,EAAE,IAAI,OAAO,SAAS,KAAK,QAAQ,IAAI,GAAG,GAAG,SAAS,EAAE;AACxD,GAAG,SAAS,IAAI,CAAC;AACjB,GAAG,SAAS,GAAG,SAAS,oBAAoB,IAAI,KAAK,CAAC,CAAC,6BAA6B,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,wBAAwB,CAAC,CAAC;AACzI,GAAG;AACH,EAAE;AACF,EAAE,SAAS,IAAI,CAAC;AAChB,EAAE,IAAI,QAAQ,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC;AAC1C,EAAE,IAAI,CAAC,QAAQ,EAAE;AACjB,GAAG,MAAM,IAAI,GAAG,IAAI,cAAc,CAAC,QAAQ,CAAC;AAC5C,GAAG,MAAM,eAAe,GAAG,KAAK,CAAC,SAAS;AAC1C,GAAG,QAAQ,GAAG,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,OAAO,YAAY,KAAK;AAC9E,IAAI,IAAI,CAAC,YAAY,EAAE,OAAO,IAAI;AAClC,IAAI,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC;AACnE,IAAI,IAAI,EAAE,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,IAAI,eAAe,IAAI,CAAC,CAAC,CAAC,EAAE,MAAM,IAAI,KAAK,CAAC,CAAC,wCAAwC,EAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC,KAAK,CAAC,qDAAqD,EAAE,QAAQ,CAAC,sBAAsB,CAAC,CAAC;AAC1R,IAAI,OAAO,IAAI;AACf,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,MAAM;AACpB,IAAI,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC;AAChC,GAAG,CAAC,CAAC;AACL,GAAG,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,QAAQ,CAAC;AACtC,EAAE;AACF,EAAE,IAAI;AACN,GAAG,MAAM,QAAQ;AACjB,GAAG,SAAS,IAAI,CAAC;AACjB,EAAE,CAAC,CAAC,OAAO,GAAG,EAAE;AAChB,GAAG,SAAS,GAAG,GAAG,YAAY,KAAK,GAAG,GAAG,GAAG,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;AAClE,GAAG,qBAAqB,CAAC,GAAG,CAAC,GAAG,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,6BAA6B,CAAC;AAC7E,EAAE;AACF,CAAC;AACD,CAAC,MAAM,cAAc,GAAG,SAAS,GAAG,CAAC,IAAI,SAAS,KAAK,CAAC,IAAI,SAAS,KAAK,IAAI,GAAG,CAAC,mCAAmC,EAAE,QAAQ,CAAC,oBAAoB,EAAE,QAAQ,CAAC,sBAAsB,CAAC,GAAG,IAAI;AAC7L,CAAC,OAAO;AACR,EAAE,SAAS;AACX,EAAE,SAAS;AACX,EAAE,SAAS;AACX,EAAE;AACF,EAAE;AACF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACG,IAAC,cAAc,GAAG,MAAM;AAC3B,CAAC,QAAQ;AACT;AACA;AACA;AACA;AACA,CAAC,QAAQ,GAAG,CAAC;AACb;AACA;AACA;AACA,CAAC,WAAW,CAAC,QAAQ,EAAE;AACvB,EAAE,IAAI,CAAC,QAAQ,GAAG,QAAQ;AAC1B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,IAAI,CAAC,IAAI,EAAE;AAClB,EAAE,MAAM,WAAW,GAAG,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,QAAQ,CAAC;AACvF,EAAE,MAAM,QAAQ,GAAG,EAAE;AACrB,EAAE,KAAK,MAAM,KAAK,IAAI,WAAW,EAAE,IAAI,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,KAAK,CAAC,IAAI,IAAI,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC;AACzH,EAAE,MAAM,QAAQ,GAAG,WAAW,CAAC,MAAM;AACrC,EAAE,IAAI,WAAW,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;AACjF,EAAE,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC,EAAE;AAC7B,GAAG,MAAM,UAAU,GAAG,WAAW,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;AACtI,GAAG,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC;AACpE,EAAE;AACF,EAAE,MAAM,QAAQ,GAAG,IAAI,EAAE,QAAQ,IAAI,YAAY;AACjD,EAAE,IAAI,MAAM;AACZ,EAAE,QAAQ,QAAQ;AAClB,GAAG,KAAK,YAAY;AACpB,IAAI,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;AAC1C,IAAI;AACJ,GAAG,KAAK,aAAa;AACrB,IAAI,MAAM,GAAG,IAAI,CAAC,eAAe,CAAC,QAAQ,CAAC;AAC3C,IAAI;AACJ,GAAG,KAAK,YAAY;AACpB,IAAI,MAAM,GAAG,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC;AAC1C,IAAI;AACJ;AACA,EAAE,IAAI,CAAC,MAAM,EAAE;AACf,GAAG,MAAM,UAAU,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,gBAAgB,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,GAAG,KAAK,CAAC,IAAI,CAAC,GAAG,GAAG,CAAC,GAAG,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;AACnI,GAAG,MAAM,IAAI,kBAAkB,CAAC,IAAI,CAAC,QAAQ,EAAE,QAAQ,EAAE,UAAU,CAAC;AACpE,EAAE;AACF,EAAE,OAAO;AACT,GAAG,UAAU,EAAE,MAAM,aAAa,CAAC;AACnC,IAAI,GAAG,MAAM;AACb,IAAI,YAAY,EAAE,CAAC,MAAM,CAAC,YAAY,IAAI,CAAC,IAAI;AAC/C,IAAI,CAAC;AACL,GAAG;AACH,GAAG;AACH,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,aAAa,CAAC,KAAK,EAAE,SAAS,EAAE;AACvC,EAAE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;AACnE,EAAE,IAAI,CAAC,QAAQ,EAAE;AACjB,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC;AACpD,EAAE,MAAM,aAAa,CAAC;AACtB,GAAG,GAAG,QAAQ;AACd,GAAG,UAAU,EAAE,WAAW;AAC1B,GAAG,aAAa,EAAE,SAAS;AAC3B,GAAG,gBAAgB,EAAE;AACrB,GAAG,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,MAAM,CAAC,KAAK,EAAE;AACrB,EAAE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;AACnE,EAAE,IAAI,CAAC,QAAQ,EAAE;AACjB,EAAE,MAAM,aAAa,CAAC;AACtB,GAAG,GAAG,QAAQ;AACd,GAAG,UAAU,EAAE,IAAI;AACnB,GAAG,aAAa,EAAE,MAAM;AACxB,GAAG,gBAAgB,EAAE;AACrB,GAAG,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,gBAAgB,CAAC,KAAK,EAAE;AAC/B,EAAE,MAAM,QAAQ,GAAG,MAAM,oBAAoB,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC;AACnE,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,KAAK;AAC7B,EAAE,IAAI,QAAQ,CAAC,QAAQ,KAAK,OAAO,EAAE,OAAO,KAAK;AACjD,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,OAAO,KAAK;AAC1C,EAAE,IAAI,QAAQ,CAAC,SAAS,IAAI,IAAI,EAAE,OAAO,KAAK;AAC9C,EAAE,IAAI,QAAQ,CAAC,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,IAAI,0BAA0B,EAAE,OAAO,KAAK;AACjF,EAAE,MAAM,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC;AAC9C,EAAE,OAAO,IAAI;AACb,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,mBAAmB,GAAG;AAC7B,EAAE,MAAM,OAAO,GAAG,MAAM,IAAI,CAAC,WAAW,EAAE;AAC1C,EAAE,IAAI,SAAS,GAAG,CAAC;AACnB,EAAE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE;AAC/B,GAAG,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,EAAE;AACnC,GAAG,IAAI,CAAC,KAAK,CAAC,YAAY,EAAE;AAC5B,GAAG,IAAI;AACP,IAAI,IAAI,MAAM,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,SAAS,IAAI,CAAC;AAChE,GAAG,CAAC,CAAC,MAAM,CAAC;AACZ,EAAE;AACF,EAAE,OAAO,SAAS;AAClB,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,WAAW,GAAG;AACrB,EAAE,OAAO,kBAAkB,CAAC,MAAM,eAAe,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;AACjE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,uBAAuB,CAAC,QAAQ,EAAE;AACzC,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;AAC9B,EAAE,MAAM,QAAQ,GAAG,CAAC,MAAM,kBAAkB,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,KAAK;AACnE,EAAE,IAAI,QAAQ,EAAE,IAAI,KAAK,MAAM,EAAE,MAAM,IAAI,CAAC,eAAe,CAAC,QAAQ,EAAE,QAAQ,CAAC,aAAa,EAAE,QAAQ,CAAC,QAAQ,EAAE,QAAQ,CAAC,eAAe,CAAC;AAC1I,OAAO,IAAI,IAAI,CAAC,QAAQ,KAAK,WAAW,EAAE;AAC1C,GAAG,MAAM,GAAG,GAAG,2BAA2B,EAAE;AAC5C,GAAG,MAAM,IAAI,CAAC,wBAAwB,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,EAAE,GAAG,CAAC,QAAQ,CAAC;AAC5E,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,eAAe,CAAC,QAAQ,EAAE,aAAa,EAAE,QAAQ,EAAE,UAAU,EAAE;AACtE,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;AAC9B,EAAE,IAAI,MAAM;AACZ,EAAE,IAAI;AACN,GAAG,MAAM,GAAG,MAAM,gBAAgB,CAAC;AACnC,IAAI,QAAQ,EAAE,QAAQ,CAAC,QAAQ;AAC/B,IAAI,QAAQ;AACZ,IAAI,YAAY,EAAE,QAAQ,CAAC,YAAY;AACvC,IAAI,aAAa;AACjB,IAAI;AACJ,IAAI,CAAC;AACL,EAAE,CAAC,CAAC,MAAM;AACV,GAAG;AACH,EAAE;AACF,EAAE,MAAM,aAAa,CAAC;AACtB,GAAG,GAAG,QAAQ;AACd,GAAG,WAAW,EAAE,MAAM,CAAC,WAAW;AAClC,GAAG,YAAY,EAAE,MAAM,CAAC,YAAY,IAAI,QAAQ,CAAC,YAAY;AAC7D,GAAG,SAAS,EAAE,MAAM,CAAC,SAAS,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,GAAG,GAAG,QAAQ,CAAC,SAAS;AACjG,GAAG,UAAU,EAAE,IAAI;AACnB,GAAG,aAAa,EAAE,MAAM;AACxB,GAAG,gBAAgB,EAAE;AACrB,GAAG,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,wBAAwB,CAAC,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,EAAE;AAC5E,EAAE,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE;AAC9B,EAAE,IAAI,IAAI;AACV,EAAE,IAAI;AACN,GAAG,IAAI,GAAG,MAAM,KAAK,CAAC,QAAQ,EAAE;AAChC,IAAI,MAAM,EAAE,MAAM;AAClB,IAAI,OAAO,EAAE;AACb,KAAK,cAAc,EAAE,mCAAmC;AACxD,KAAK,MAAM,EAAE,kBAAkB;AAC/B,KAAK,GAAG;AACR,KAAK;AACL,IAAI,IAAI,EAAE,IAAI,eAAe,CAAC;AAC9B,KAAK,UAAU,EAAE,eAAe;AAChC,KAAK,SAAS,EAAE,QAAQ;AACxB,KAAK,aAAa,EAAE,QAAQ,CAAC;AAC7B,KAAK,CAAC,CAAC,QAAQ;AACf,IAAI,CAAC;AACL,EAAE,CAAC,CAAC,MAAM;AACV,GAAG;AACH,EAAE;AACF,EAAE,IAAI,CAAC,IAAI,CAAC,EAAE,EAAE;AAChB,EAAE,IAAI,IAAI;AACV,EAAE,IAAI;AACN,GAAG,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,EAAE;AAC3B,EAAE,CAAC,CAAC,MAAM;AACV,GAAG;AACH,EAAE;AACF,EAAE,MAAM,cAAc,GAAG,OAAO,IAAI,CAAC,cAAc,CAAC,KAAK,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,GAAG,IAAI;AAC/F,EAAE,IAAI,CAAC,cAAc,EAAE;AACvB,EAAE,MAAM,YAAY,GAAG,OAAO,IAAI,CAAC,YAAY,CAAC,KAAK,QAAQ,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,IAAI;AACzF,EAAE,MAAM,eAAe,GAAG,OAAO,IAAI,CAAC,eAAe,CAAC,KAAK,QAAQ,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,QAAQ,CAAC,YAAY;AACnH,EAAE,MAAM,aAAa,CAAC;AACtB,GAAG,GAAG,QAAQ;AACd,GAAG,WAAW,EAAE,cAAc;AAC9B,GAAG,YAAY,EAAE,eAAe;AAChC,GAAG,SAAS,EAAE,YAAY,IAAI,IAAI,GAAG,IAAI,CAAC,GAAG,EAAE,GAAG,YAAY,GAAG,GAAG,GAAG,QAAQ,CAAC,SAAS;AACzF,GAAG,UAAU,EAAE,IAAI;AACnB,GAAG,aAAa,EAAE,MAAM;AACxB,GAAG,gBAAgB,EAAE;AACrB,GAAG,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,cAAc,CAAC,QAAQ,EAAE;AAC1B,EAAE,OAAO,kBAAkB,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AACnE,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,eAAe,CAAC,QAAQ,EAAE;AAC3B,EAAE,MAAM,MAAM,GAAG,kBAAkB,CAAC,QAAQ,CAAC;AAC7C,EAAE,MAAM,CAAC,GAAG,MAAM,CAAC,MAAM;AACzB,EAAE,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE;AAC9B,GAAG,MAAM,GAAG,GAAG,IAAI,CAAC,QAAQ,GAAG,CAAC;AAChC,GAAG,IAAI,CAAC,QAAQ,GAAG,GAAG,GAAG,CAAC;AAC1B,GAAG,MAAM,SAAS,GAAG,MAAM,CAAC,GAAG,CAAC;AAChC,GAAG,IAAI,SAAS,IAAI,CAAC,YAAY,CAAC,SAAS,CAAC,EAAE,OAAO,SAAS;AAC9D,EAAE;AACF,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,cAAc,CAAC,QAAQ,EAAE;AAC1B,EAAE,MAAM,OAAO,GAAG,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC;AAC1D,EAAE,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,OAAO,MAAM;AACzC,EAAE,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK;AAChC,GAAG,MAAM,SAAS,GAAG,CAAC,CAAC,CAAC,YAAY,IAAI,CAAC,KAAK,CAAC,CAAC,YAAY,IAAI,CAAC,CAAC;AAClE,GAAG,IAAI,SAAS,KAAK,CAAC,EAAE,OAAO,SAAS;AACxC,GAAG,OAAO,CAAC,CAAC,QAAQ,GAAG,CAAC,CAAC,QAAQ;AACjC,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC;AACP,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,sBAAsB,GAAG,EAAE,GAAG,GAAG;AACrC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,QAAQ,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE;AAChC,CAAC,IAAI,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC,uBAAuB,EAAE,GAAG,CAAC,CAAC,EAAE,GAAG,IAAI,CAAC;AACvF;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,qBAAqB,GAAG,MAAM;AAClC,CAAC,cAAc;AACf;AACA,CAAC,YAAY,GAAG,CAAC;AACjB;AACA,CAAC,YAAY,mBAAmB,IAAI,GAAG,EAAE;AACzC;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,WAAW,CAAC,cAAc,GAAG,MAAM,eAAe,CAAC,MAAM,EAAE,EAAE;AAC9D,EAAE,IAAI,CAAC,cAAc,GAAG,cAAc;AACtC,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,IAAI,CAAC,OAAO,GAAG,EAAE,EAAE;AAC1B,EAAE,MAAM,OAAO,GAAG,IAAI,CAAC,cAAc,EAAE;AACvC,EAAE,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE;AACxB,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,IAAI,IAAI,CAAC,YAAY,GAAG,CAAC,IAAI,GAAG,GAAG,IAAI,CAAC,YAAY,GAAG,GAAG,EAAE;AAChF,GAAG,QAAQ,CAAC,iCAAiC,EAAE;AAC/C,IAAI,KAAK,EAAE,GAAG,GAAG,IAAI,CAAC,YAAY;AAClC,IAAI,KAAK,EAAE;AACX,IAAI,CAAC;AACL,GAAG,OAAO;AACV,IAAI,KAAK,EAAE,CAAC;AACZ,IAAI,MAAM,EAAE,CAAC;AACb,IAAI,OAAO,EAAE,OAAO,CAAC;AACrB,IAAI;AACJ,EAAE;AACF,EAAE,IAAI,KAAK,GAAG,CAAC;AACf,EAAE,IAAI,MAAM,GAAG,CAAC;AAChB,EAAE,IAAI,OAAO,GAAG,CAAC;AACjB,EAAE,KAAK,MAAM,MAAM,IAAI,OAAO,EAAE;AAChC,GAAG,MAAM,GAAG,GAAG,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC,QAAQ,CAAC,CAAC;AACvD,GAAG,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE;AAC/B,GAAG,IAAI,OAAO,MAAM,CAAC,oBAAoB,KAAK,UAAU,EAAE;AAC1D,IAAI,IAAI,SAAS;AACjB,IAAI,IAAI;AACR,KAAK,SAAS,GAAG,MAAM,MAAM,CAAC,oBAAoB,CAAC,MAAM,CAAC,QAAQ,CAAC;AACnE,IAAI,CAAC,CAAC,OAAO,GAAG,EAAE;AAClB,KAAK,MAAM,EAAE;AACb,KAAK,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;AAChC,MAAM,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC/B,MAAM,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC/B,MAAM,YAAY,EAAE,SAAS;AAC7B,MAAM,UAAU,EAAE,QAAQ;AAC1B,MAAM,KAAK,EAAE,CAAC,oBAAoB,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;AACrF,MAAM,CAAC;AACP,KAAK,QAAQ,CAAC,0BAA0B,EAAE;AAC1C,MAAM,MAAM,EAAE,GAAG;AACjB,MAAM;AACN,MAAM,CAAC;AACP,KAAK;AACL,IAAI;AACJ,IAAI,IAAI,CAAC,SAAS,EAAE;AACpB,KAAK,OAAO,EAAE;AACd,KAAK,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;AAChC,MAAM,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC/B,MAAM,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC/B,MAAM,YAAY,EAAE,SAAS;AAC7B,MAAM,UAAU,EAAE;AAClB,MAAM,CAAC;AACP,KAAK;AACL,IAAI;AACJ,GAAG;AACH,GAAG,IAAI,UAAU;AACjB,GAAG,IAAI;AACP,IAAI,UAAU,GAAG,YAAY,CAAC,MAAM,CAAC,QAAQ,EAAE,MAAM,CAAC,QAAQ,CAAC;AAC/D,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,QAAQ,CAAC,sDAAsD,EAAE;AACrE,KAAK,MAAM,EAAE,GAAG;AAChB,KAAK;AACL,KAAK,CAAC;AACN,IAAI,UAAU,GAAG,KAAK;AACtB,GAAG;AACH,GAAG,IAAI,UAAU,EAAE;AACnB,IAAI,OAAO,EAAE;AACb,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;AAC/B,KAAK,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC9B,KAAK,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC9B,KAAK,YAAY,EAAE,SAAS;AAC5B,KAAK,UAAU,EAAE;AACjB,KAAK,CAAC;AACN,IAAI;AACJ,GAAG;AACH,GAAG,IAAI,OAAO;AACd,GAAG,IAAI;AACP,IAAI,OAAO,GAAG,CAAC,MAAM,MAAM,CAAC,IAAI,EAAE,EAAE,OAAO;AAC3C,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,MAAM,EAAE;AACZ,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;AAC/B,KAAK,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC9B,KAAK,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC9B,KAAK,YAAY,EAAE,SAAS;AAC5B,KAAK,UAAU,EAAE,QAAQ;AACzB,KAAK,KAAK,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG;AAC3D,KAAK,CAAC;AACN,IAAI,QAAQ,CAAC,oBAAoB,EAAE;AACnC,KAAK,MAAM,EAAE,GAAG;AAChB,KAAK;AACL,KAAK,CAAC;AACN,IAAI;AACJ,GAAG;AACH,GAAG,IAAI,YAAY,GAAG,KAAK;AAC3B,GAAG,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,IAAI;AACpC,IAAI,MAAM,aAAa,CAAC,KAAK,CAAC;AAC9B,GAAG,CAAC,CAAC,OAAO,GAAG,EAAE;AACjB,IAAI,YAAY,GAAG,IAAI;AACvB,IAAI,QAAQ,CAAC,2BAA2B,EAAE;AAC1C,KAAK,MAAM,EAAE,GAAG;AAChB,KAAK,KAAK,EAAE,KAAK,CAAC,KAAK;AACvB,KAAK;AACL,KAAK,CAAC;AACN,IAAI,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;AAC/B,KAAK,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC9B,KAAK,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC9B,KAAK,YAAY,EAAE,SAAS;AAC5B,KAAK,UAAU,EAAE,QAAQ;AACzB,KAAK,eAAe,EAAE,OAAO,CAAC,MAAM;AACpC,KAAK,KAAK,EAAE,CAAC,yBAAyB,EAAE,KAAK,CAAC,KAAK,CAAC,GAAG,EAAE,GAAG,YAAY,KAAK,GAAG,GAAG,CAAC,OAAO,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;AAC1G,KAAK,CAAC;AACN,IAAI;AACJ,GAAG;AACH,GAAG,IAAI,YAAY,EAAE;AACrB,IAAI,MAAM,EAAE;AACZ,IAAI;AACJ,GAAG;AACH,GAAG,KAAK,EAAE;AACV,GAAG,IAAI,CAAC,YAAY,CAAC,GAAG,CAAC,GAAG,EAAE;AAC9B,IAAI,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC7B,IAAI,QAAQ,EAAE,MAAM,CAAC,QAAQ;AAC7B,IAAI,YAAY,EAAE,SAAS;AAC3B,IAAI,UAAU,EAAE,IAAI;AACpB,IAAI,eAAe,EAAE,OAAO,CAAC;AAC7B,IAAI,CAAC;AACL,EAAE;AACF,EAAE,IAAI,CAAC,YAAY,GAAG,IAAI,CAAC,GAAG,EAAE;AAChC,EAAE,OAAO;AACT,GAAG,KAAK;AACR,GAAG,MAAM;AACT,GAAG;AACH,GAAG;AACH,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,IAAI,CAAC,QAAQ,EAAE,OAAO,GAAG,EAAE,EAAE;AACpC,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,MAAM,IAAI,CAAC,IAAI,EAAE;AACxC,EAAE,OAAO,6BAA6B,CAAC,QAAQ,EAAE;AACjD,GAAG,GAAG,OAAO,CAAC,QAAQ,IAAI,IAAI,IAAI,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE;AAChE,GAAG,GAAG,OAAO,CAAC,WAAW,IAAI,IAAI,IAAI,EAAE,WAAW,EAAE,OAAO,CAAC,WAAW;AACvE,GAAG,CAAC;AACJ,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,MAAM,IAAI,GAAG;AACd,EAAE,OAAO,eAAe,EAAE;AAC1B,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,eAAe,GAAG;AACnB,EAAE,OAAO,KAAK,CAAC,IAAI,CAAC,IAAI,CAAC,YAAY,CAAC,MAAM,EAAE,CAAC;AAC/C,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,CAAC,cAAc,GAAG;AAClB,EAAE,IAAI,CAAC,YAAY,GAAG,CAAC;AACvB,EAAE,IAAI,CAAC,YAAY,CAAC,KAAK,EAAE;AAC3B,CAAC;AACD,CAAC;AACD;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,IAAI,UAAU,GAAG,IAAI;AACrB;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA;AACA,SAAS,iBAAiB,GAAG;AAC7B,CAAC,IAAI,UAAU,KAAK,IAAI,EAAE,UAAU,GAAG,IAAI,qBAAqB,EAAE;AAClE,CAAC,OAAO,UAAU;AAClB;;;;"}