@doist/comms-cli 0.0.1 → 1.0.0

package/dist/lib/auth-pages.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-pages.js","sourceRoot":"","sources":["../../src/lib/auth-pages.ts"],"names":[],"mappings":"AAAA,MAAM,UAAU,aAAa;IACzB,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;QAicH,CAAA;AACR,CAAC;AAED,MAAM,UAAU,WAAW,CAAC,YAAoB;IAC5C,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;aAuPE,YAAY;;;;QAIjB,CAAA;AACR,CAAC"}

package/dist/lib/auth-provider.d.ts

@@ -0,0 +1,74 @@
+import { type AccountRef, type AuthAccount, type AuthProvider, type KeyringTokenStore } from '@doist/cli-core/auth';
+import { type AuthMode } from './config.js';
+export declare const AUTHORIZATION_URL = "https://comms.todoist.com/oauth/authorize";
+export declare const TOKEN_URL = "https://comms.todoist.com/oauth/access_token";
+export declare const REGISTRATION_URL = "https://comms.todoist.com/oauth/register";
+export declare const READ_WRITE_SCOPES: string[];
+export declare const READ_ONLY_SCOPES: string[];
+/**
+ * The scope set a login is granted, as a pure function of `--read-only`. Single
+ * source of truth shared by `attachCommsLoginCommand`'s `resolveScopes` (what we
+ * request at authorize) and the provider's `validate` (what we record on the
+ * account), so the two can't drift.
+ */
+export declare function getScopes(readOnly: boolean): string[];
+/**
+ * Narrow account shape: only fields that round-trip through the local token
+ * store. `id` is the stringified numeric Comms user id (so cli-core's
+ * `AuthAccount.id` string contract holds), `label` is the user's display
+ * name. Richer session-user details are fetched on demand via the API
+ * rather than threaded through the auth flow.
+ */
+export type CommsAccount = AuthAccount & {
+    id: string;
+    label: string;
+    authMode: AuthMode;
+    authScope: string;
+};
+export type CommsTokenStore = KeyringTokenStore<CommsAccount>;
+/**
+ * Sentinel for the `{ id: '', label: '' }` snapshot that `tdc auth token`
+ * persists when the user passes a raw token with no identity attached. The
+ * empty-id/empty-label pair is the contract between `loginWithToken` (writer)
+ * and `account current` / `account list` (readers); centralise it here so
+ * each call site agrees on the shape.
+ */
+export declare const MANUAL_TOKEN_ACCOUNT: CommsAccount;
+/** True when `account` is the identity-less snapshot produced by `tdc auth token`. */
+export declare function isManualTokenAccount(account: Pick<CommsAccount, 'id' | 'label'>): boolean;
+/**
+ * Comms's OAuth flow uses RFC 7591 Dynamic Client Registration: each login
+ * mints a fresh `client_id` / `client_secret`, then runs the standard PKCE
+ * authorize + token exchange. cli-core's `createDcrProvider` drives all of that
+ * via `oauth4webapi`; the only comms-specific piece is `validate`, which probes
+ * `getSessionUser` and records the auth mode/scope the login was granted.
+ *
+ * `authMode` / `authScope` are derived from `handshake.readOnly` (folded in by
+ * `runOAuthFlow`) rather than threaded through `authorize`, because the scope
+ * set is itself a pure function of `readOnly` (see `resolveScopes` in login.ts).
+ */
+export declare function createCommsAuthProvider(): AuthProvider<CommsAccount>;
+/**
+ * Accepts `42`, `id:42`, and case-insensitive labels — `parseRef` normalises
+ * the numeric forms. Broader than cli-core's default strict-equality matcher.
+ */
+export declare function matchCommsAccount(account: CommsAccount, ref: AccountRef): boolean;
+/**
+ * Resolve a `ref` against the local store, returning the canonical account.
+ * Throws `ACCOUNT_NOT_FOUND` on a miss. Shared between the `tdc account ...`
+ * commands and `withUserRefAware` so the same hint reaches every caller.
+ */
+export declare function findAccountInStore(store: CommsTokenStore, ref: AccountRef): Promise<CommsAccount>;
+/**
+ * `COMMS_API_TOKEN` short-circuits `active()` only when no explicit ref is
+ * supplied — cli-core's `KeyringTokenStore` doesn't know about the env var,
+ * and an explicit ref means the caller targets a specific stored account.
+ */
+export declare function createCommsTokenStore(): CommsTokenStore;
+/**
+ * Where the currently-active token lives. Returns `'config-file'` whenever
+ * a plaintext token is on disk so doctor/config-view reports the
+ * security-relevant state accurately.
+ */
+export declare function getActiveTokenSource(): Promise<'env' | 'secure-store' | 'config-file'>;
+//# sourceMappingURL=auth-provider.d.ts.map

package/dist/lib/auth-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EAGjB,KAAK,iBAAiB,EACzB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,KAAK,QAAQ,EAA4B,MAAM,aAAa,CAAA;AAKrE,eAAO,MAAM,iBAAiB,8CAA8C,CAAA;AAC5E,eAAO,MAAM,SAAS,iDAAiD,CAAA;AACvE,eAAO,MAAM,gBAAgB,6CAA6C,CAAA;AAK1E,eAAO,MAAM,iBAAiB,UAkB7B,CAAA;AAED,eAAO,MAAM,gBAAgB,UAW5B,CAAA;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAErD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,YAKlC,CAAA;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,OAAO,CAEzF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,IAAI,YAAY,CAAC,YAAY,CAAC,CAwCpE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAUjF;AAmBD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACpC,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,UAAU,GAChB,OAAO,CAAC,YAAY,CAAC,CAcvB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,CA4CvD;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,KAAK,GAAG,cAAc,GAAG,aAAa,CAAC,CAM5F"}

package/dist/lib/auth-provider.js

@@ -0,0 +1,238 @@
+import { createDcrProvider, createKeyringTokenStore, } from '@doist/cli-core/auth';
+import { createWrappedCommsClient } from './api.js';
+import { SECURE_STORE_SERVICE } from './auth-constants.js';
+import { toCommsAccount } from './comms-account.js';
+import { getConfig, getConfigPath } from './config.js';
+import { CliError } from './errors.js';
+import { parseRef } from './refs.js';
+import { createCommsUserRecordStore, getDefaultUserRecord } from './user-records.js';
+export const AUTHORIZATION_URL = 'https://comms.todoist.com/oauth/authorize';
+export const TOKEN_URL = 'https://comms.todoist.com/oauth/access_token';
+export const REGISTRATION_URL = 'https://comms.todoist.com/oauth/register';
+const LOGO_URI = 'https://raw.githubusercontent.com/Doist/comms-cli/d65c447ff453eb36af585044c2f5f2f602bcdb34/icons/comms-cli.png';
+export const READ_WRITE_SCOPES = [
+    'user:read',
+    'user:write',
+    'workspaces:read',
+    'channels:read',
+    'threads:read',
+    'threads:write',
+    'comments:read',
+    'comments:write',
+    'messages:read',
+    'messages:write',
+    'reactions:read',
+    'reactions:write',
+    'groups:read',
+    'groups:write',
+    'groups:remove',
+    'search:read',
+    'notifications:read',
+];
+export const READ_ONLY_SCOPES = [
+    'user:read',
+    'workspaces:read',
+    'channels:read',
+    'threads:read',
+    'comments:read',
+    'messages:read',
+    'reactions:read',
+    'groups:read',
+    'search:read',
+    'notifications:read',
+];
+const AUTH_HINTS = ['Try again: tdc auth login', 'Or set COMMS_API_TOKEN environment variable'];
+/**
+ * The scope set a login is granted, as a pure function of `--read-only`. Single
+ * source of truth shared by `attachCommsLoginCommand`'s `resolveScopes` (what we
+ * request at authorize) and the provider's `validate` (what we record on the
+ * account), so the two can't drift.
+ */
+export function getScopes(readOnly) {
+    return readOnly ? READ_ONLY_SCOPES : READ_WRITE_SCOPES;
+}
+/**
+ * Sentinel for the `{ id: '', label: '' }` snapshot that `tdc auth token`
+ * persists when the user passes a raw token with no identity attached. The
+ * empty-id/empty-label pair is the contract between `loginWithToken` (writer)
+ * and `account current` / `account list` (readers); centralise it here so
+ * each call site agrees on the shape.
+ */
+export const MANUAL_TOKEN_ACCOUNT = {
+    id: '',
+    label: '',
+    authMode: 'unknown',
+    authScope: '',
+};
+/** True when `account` is the identity-less snapshot produced by `tdc auth token`. */
+export function isManualTokenAccount(account) {
+    return !account.id || !account.label;
+}
+/**
+ * Comms's OAuth flow uses RFC 7591 Dynamic Client Registration: each login
+ * mints a fresh `client_id` / `client_secret`, then runs the standard PKCE
+ * authorize + token exchange. cli-core's `createDcrProvider` drives all of that
+ * via `oauth4webapi`; the only comms-specific piece is `validate`, which probes
+ * `getSessionUser` and records the auth mode/scope the login was granted.
+ *
+ * `authMode` / `authScope` are derived from `handshake.readOnly` (folded in by
+ * `runOAuthFlow`) rather than threaded through `authorize`, because the scope
+ * set is itself a pure function of `readOnly` (see `resolveScopes` in login.ts).
+ */
+export function createCommsAuthProvider() {
+    return createDcrProvider({
+        registrationUrl: REGISTRATION_URL,
+        authorizeUrl: AUTHORIZATION_URL,
+        tokenUrl: TOKEN_URL,
+        clientMetadata: {
+            clientName: 'Comms CLI',
+            clientUri: 'https://github.com/doist/comms-cli',
+            logoUri: LOGO_URI,
+            applicationType: 'native',
+            // Comms client_ids can contain `_`. oauth4webapi's
+            // `client_secret_basic` form-url-encodes the Basic credential per
+            // RFC 6749 §2.3.1 (`_` → `%5F`), and the token endpoint doesn't
+            // url-decode it, so the lookup fails with "client_id not found".
+            // `client_secret_post` sends the credential in the body via
+            // URLSearchParams, which preserves `_`, sidestepping the mismatch.
+            tokenEndpointAuthMethod: 'client_secret_post',
+        },
+        errorHints: AUTH_HINTS,
+        async validate({ token, handshake }) {
+            // `runOAuthFlow` folds a boolean `readOnly` into the handshake.
+            // Fail closed on a missing/malformed value rather than letting
+            // `Boolean(undefined)` silently grant read-write (which would relax
+            // the local write guard).
+            const readOnly = handshake.readOnly;
+            if (typeof readOnly !== 'boolean') {
+                throw new CliError('AUTH_FAILED', 'Internal: auth handshake missing the readOnly flag.', AUTH_HINTS);
+            }
+            const client = createWrappedCommsClient(token);
+            const user = await client.users.getSessionUser();
+            return toCommsAccount(user, {
+                authMode: readOnly ? 'read-only' : 'read-write',
+                authScope: getScopes(readOnly).join(' '),
+            });
+        },
+    });
+}
+/**
+ * Accepts `42`, `id:42`, and case-insensitive labels — `parseRef` normalises
+ * the numeric forms. Broader than cli-core's default strict-equality matcher.
+ */
+export function matchCommsAccount(account, ref) {
+    // Identity-less manual-token snapshots (empty id + label) are never a valid
+    // ref target — they're hidden from `account list` and can't be `use`d /
+    // `remove`d. Guard here so an empty-ish ref (`""`, `id:`) can't resolve to
+    // one through the keyring store's ref matching.
+    if (isManualTokenAccount(account))
+        return false;
+    const parsed = parseRef(ref);
+    if (parsed.type === 'id')
+        return account.id === parsed.id;
+    if (parsed.type === 'name')
+        return account.label.toLowerCase() === parsed.name.toLowerCase();
+    return false;
+}
+const TOKEN_ENV_VAR = 'COMMS_API_TOKEN';
+/**
+ * The `COMMS_API_TOKEN` env override that takes precedence over the keyring
+ * store, or `null` to defer to it. Only applies when no explicit ref is
+ * supplied — an explicit ref means the caller targets a specific stored
+ * account. Shared by the store's `active()` and `activeBundle()` so the two
+ * reads can't diverge.
+ */
+function resolveEnvOverride(ref) {
+    if (ref === undefined) {
+        const envToken = process.env[TOKEN_ENV_VAR];
+        if (envToken)
+            return { token: envToken, account: MANUAL_TOKEN_ACCOUNT };
+    }
+    return null;
+}
+/**
+ * Resolve a `ref` against the local store, returning the canonical account.
+ * Throws `ACCOUNT_NOT_FOUND` on a miss. Shared between the `tdc account ...`
+ * commands and `withUserRefAware` so the same hint reaches every caller.
+ */
+export async function findAccountInStore(store, ref) {
+    const records = await store.list();
+    // Manual-token snapshots have no id/label and can't be the target of a
+    // ref-based command. Excluding them here keeps `tdc account use|remove`
+    // honest with what `tdc account list` shows.
+    const match = records
+        .filter(({ account }) => !isManualTokenAccount(account))
+        .find(({ account }) => matchCommsAccount(account, ref));
+    if (!match) {
+        throw new CliError('ACCOUNT_NOT_FOUND', `No stored account matches "${ref}".`, [
+            'Run: tdc account list',
+        ]);
+    }
+    return match.account;
+}
+/**
+ * `COMMS_API_TOKEN` short-circuits `active()` only when no explicit ref is
+ * supplied — cli-core's `KeyringTokenStore` doesn't know about the env var,
+ * and an explicit ref means the caller targets a specific stored account.
+ */
+export function createCommsTokenStore() {
+    const inner = createKeyringTokenStore({
+        serviceName: SECURE_STORE_SERVICE,
+        userRecords: createCommsUserRecordStore(),
+        recordsLocation: getConfigPath(),
+        matchAccount: matchCommsAccount,
+    });
+    return Object.assign(Object.create(inner), {
+        async active(ref) {
+            return resolveEnvOverride(ref) ?? inner.active(ref);
+        },
+        // Mirror `active()`: cli-core's auth commands read the live credential
+        // through `activeBundle()` (it carries the refresh slot too), so the
+        // env-token fallback must apply here as well or `tdc auth status` would
+        // report no token for env-token sessions.
+        async activeBundle(ref) {
+            const override = resolveEnvOverride(ref);
+            if (override) {
+                return { account: override.account, bundle: { accessToken: override.token } };
+            }
+            return inner.activeBundle(ref);
+        },
+        // cli-core's `account current` resolves through `activeAccount()`. An
+        // env-token session isn't a v2 store account, so report `null` — the
+        // attacher then routes to its `onNotAuthenticated` hook, which renders
+        // the env notice. (A manual-token snapshot stays a real store account;
+        // `account current` special-cases it in its renderers.)
+        async activeAccount(ref) {
+            if (resolveEnvOverride(ref))
+                return null;
+            return inner.activeAccount(ref);
+        },
+        async set(account, token) {
+            return inner.set(account, token);
+        },
+        async clear(ref) {
+            return inner.clear(ref);
+        },
+        async list() {
+            return inner.list();
+        },
+        async setDefault(ref) {
+            return inner.setDefault(ref);
+        },
+    });
+}
+/**
+ * Where the currently-active token lives. Returns `'config-file'` whenever
+ * a plaintext token is on disk so doctor/config-view reports the
+ * security-relevant state accurately.
+ */
+export async function getActiveTokenSource() {
+    if (process.env[TOKEN_ENV_VAR])
+        return 'env';
+    const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record?.fallbackToken)
+        return 'config-file';
+    return 'secure-store';
+}
+//# sourceMappingURL=auth-provider.js.map

package/dist/lib/auth-provider.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAIH,iBAAiB,EACjB,uBAAuB,GAE1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAiB,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAEpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,2CAA2C,CAAA;AAC5E,MAAM,CAAC,MAAM,SAAS,GAAG,8CAA8C,CAAA;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,0CAA0C,CAAA;AAE1E,MAAM,QAAQ,GACV,gHAAgH,CAAA;AAEpH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC7B,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,aAAa;IACb,cAAc;IACd,eAAe;IACf,aAAa;IACb,oBAAoB;CACvB,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,oBAAoB;CACvB,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,2BAA2B,EAAE,6CAA6C,CAAC,CAAA;AAE/F;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,QAAiB;IACvC,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAA;AAC1D,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiB;IAC9C,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,EAAE;CAChB,CAAA;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,OAA2C;IAC5E,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACnC,OAAO,iBAAiB,CAAe;QACnC,eAAe,EAAE,gBAAgB;QACjC,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,SAAS;QACnB,cAAc,EAAE;YACZ,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,oCAAoC;YAC/C,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,mDAAmD;YACnD,kEAAkE;YAClE,gEAAgE;YAChE,iEAAiE;YACjE,4DAA4D;YAC5D,mEAAmE;YACnE,uBAAuB,EAAE,oBAAoB;SAChD;QACD,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YAC/B,gEAAgE;YAChE,+DAA+D;YAC/D,oEAAoE;YACpE,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAA;YACnC,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,QAAQ,CACd,aAAa,EACb,qDAAqD,EACrD,UAAU,CACb,CAAA;YACL,CAAC;YACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;YAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAA;YAChD,OAAO,cAAc,CAAC,IAAI,EAAE;gBACxB,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY;gBAC/C,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aAC3C,CAAC,CAAA;QACN,CAAC;KACJ,CAAC,CAAA;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAqB,EAAE,GAAe;IACpE,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,oBAAoB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAA;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC5F,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,MAAM,aAAa,GAAG,iBAAiB,CAAA;AAEvC;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAgB;IACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC3C,IAAI,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,KAAsB,EACtB,GAAe;IAEf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,uEAAuE;IACvE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,OAAO;SAChB,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;SACvD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,GAAG,IAAI,EAAE;YAC3E,uBAAuB;SAC1B,CAAC,CAAA;IACN,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACjC,MAAM,KAAK,GAAG,uBAAuB,CAAe;QAChD,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,0BAA0B,EAAE;QACzC,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,iBAAiB;KAClC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAoB,EAAE;QAC1D,KAAK,CAAC,MAAM,CAAC,GAAgB;YACzB,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACvD,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,0CAA0C;QAC1C,KAAK,CAAC,YAAY,CAAC,GAAgB;YAC/B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;YACxC,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAA;YACjF,CAAC;YACD,OAAO,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,KAAK,CAAC,aAAa,CAAC,GAAgB;YAChC,IAAI,kBAAkB,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACxC,OAAO,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAqB,EAAE,KAAa;YAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI;YACN,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;KACJ,CAAC,CAAA;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,aAAa;QAAE,OAAO,aAAa,CAAA;IAC/C,OAAO,cAAc,CAAA;AACzB,CAAC"}

package/dist/lib/auth.d.ts

@@ -0,0 +1,39 @@
+import { SecureStoreUnavailableError } from '@doist/cli-core/auth';
+import { type AuthMode } from './config.js';
+import { CliError } from './errors.js';
+export { SecureStoreUnavailableError };
+export declare const TOKEN_ENV_VAR = "COMMS_API_TOKEN";
+export declare const SECURE_STORE_DESCRIPTION = "system credential manager";
+export type TokenStorageLocation = 'secure-store' | 'config-file';
+export type TokenStorageResult = {
+    storage: TokenStorageLocation;
+    warning?: string;
+};
+export type AuthMetadata = {
+    authMode: AuthMode;
+    authScope?: string;
+    authUserId?: number;
+    authUserName?: string;
+    source: 'env' | 'config';
+};
+export type AuthProbeMetadata = {
+    authMode: AuthMode;
+    authScope?: string;
+    authUserId?: number;
+    authUserName?: string;
+    source: 'env' | 'config-file' | 'secure-store';
+};
+export type AuthProbeResult = {
+    token: string;
+    metadata: AuthProbeMetadata;
+};
+export declare class NoTokenError extends CliError {
+    constructor();
+}
+/** Read the active token. The store wraps env-var precedence internally. */
+export declare function getApiToken(): Promise<string>;
+/** Token + metadata in one round-trip for `tdc config view` / `tdc doctor`. */
+export declare function probeApiToken(): Promise<AuthProbeResult>;
+/** Auth metadata for `tdc auth status` and `ensureWriteAllowed`. */
+export declare function getAuthMetadata(): Promise<AuthMetadata>;
+//# sourceMappingURL=auth.d.ts.map

package/dist/lib/auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAGlE,OAAO,EAAE,KAAK,QAAQ,EAAa,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAGtC,OAAO,EAAE,2BAA2B,EAAE,CAAA;AAEtC,eAAO,MAAM,aAAa,oBAAoB,CAAA;AAE9C,eAAO,MAAM,wBAAwB,8BAA8B,CAAA;AAEnE,MAAM,MAAM,oBAAoB,GAAG,cAAc,GAAG,aAAa,CAAA;AAEjE,MAAM,MAAM,kBAAkB,GAAG;IAC7B,OAAO,EAAE,oBAAoB,CAAA;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAA;CACnB,CAAA;AAED,MAAM,MAAM,YAAY,GAAG;IACvB,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,KAAK,GAAG,QAAQ,CAAA;CAC3B,CAAA;AAED,MAAM,MAAM,iBAAiB,GAAG;IAC5B,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,YAAY,CAAC,EAAE,MAAM,CAAA;IACrB,MAAM,EAAE,KAAK,GAAG,aAAa,GAAG,cAAc,CAAA;CACjD,CAAA;AAED,MAAM,MAAM,eAAe,GAAG;IAC1B,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,iBAAiB,CAAA;CAC9B,CAAA;AAED,qBAAa,YAAa,SAAQ,QAAQ;;CAUzC;AAED,4EAA4E;AAC5E,wBAAsB,WAAW,IAAI,OAAO,CAAC,MAAM,CAAC,CAInD;AAED,+EAA+E;AAC/E,wBAAsB,aAAa,IAAI,OAAO,CAAC,eAAe,CAAC,CAW9D;AAED,oEAAoE;AACpE,wBAAsB,eAAe,IAAI,OAAO,CAAC,YAAY,CAAC,CAM7D"}

package/dist/lib/auth.js

@@ -0,0 +1,57 @@
+import { SecureStoreUnavailableError } from '@doist/cli-core/auth';
+import { createCommsTokenStore, getActiveTokenSource } from './auth-provider.js';
+import { getConfig } from './config.js';
+import { CliError } from './errors.js';
+import { getDefaultUserRecord } from './user-records.js';
+export { SecureStoreUnavailableError };
+export const TOKEN_ENV_VAR = 'COMMS_API_TOKEN';
+export const SECURE_STORE_DESCRIPTION = 'system credential manager';
+export class NoTokenError extends CliError {
+    constructor() {
+        super('NO_TOKEN', `No API token found. Set ${TOKEN_ENV_VAR} or run \`tdc auth login\` or \`tdc auth token <token>\`.`, ['Set COMMS_API_TOKEN or run: tdc auth login'], 'info');
+        this.name = 'NoTokenError';
+    }
+}
+/** Read the active token. The store wraps env-var precedence internally. */
+export async function getApiToken() {
+    const snapshot = await createCommsTokenStore().active();
+    if (!snapshot)
+        throw new NoTokenError();
+    return snapshot.token;
+}
+/** Token + metadata in one round-trip for `tdc config view` / `tdc doctor`. */
+export async function probeApiToken() {
+    const snapshot = await createCommsTokenStore().active();
+    if (!snapshot)
+        throw new NoTokenError();
+    const source = await getActiveTokenSource();
+    return {
+        token: snapshot.token,
+        metadata: source === 'env'
+            ? { authMode: 'unknown', source: 'env' }
+            : { ...toAccountFields(snapshot.account), source },
+    };
+}
+/** Auth metadata for `tdc auth status` and `ensureWriteAllowed`. */
+export async function getAuthMetadata() {
+    if (process.env[TOKEN_ENV_VAR])
+        return { authMode: 'unknown', source: 'env' };
+    const config = await getConfig();
+    const record = getDefaultUserRecord(config);
+    if (record)
+        return { ...toAccountFields(record.account), source: 'config' };
+    return { authMode: 'unknown', source: 'config' };
+}
+function toAccountFields(account) {
+    return {
+        authMode: account.authMode,
+        authScope: account.authScope || undefined,
+        authUserId: account.id ? toAuthUserId(account.id) : undefined,
+        authUserName: account.label || undefined,
+    };
+}
+function toAuthUserId(id) {
+    const num = Number(id);
+    return Number.isFinite(num) && num > 0 ? num : undefined;
+}
+//# sourceMappingURL=auth.js.map

package/dist/lib/auth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../../src/lib/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,2BAA2B,EAAE,MAAM,sBAAsB,CAAA;AAElE,OAAO,EAAE,qBAAqB,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAA;AAChF,OAAO,EAAiB,SAAS,EAAE,MAAM,aAAa,CAAA;AACtD,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAExD,OAAO,EAAE,2BAA2B,EAAE,CAAA;AAEtC,MAAM,CAAC,MAAM,aAAa,GAAG,iBAAiB,CAAA;AAE9C,MAAM,CAAC,MAAM,wBAAwB,GAAG,2BAA2B,CAAA;AA8BnE,MAAM,OAAO,YAAa,SAAQ,QAAQ;IACtC;QACI,KAAK,CACD,UAAU,EACV,2BAA2B,aAAa,2DAA2D,EACnG,CAAC,4CAA4C,CAAC,EAC9C,MAAM,CACT,CAAA;QACD,IAAI,CAAC,IAAI,GAAG,cAAc,CAAA;IAC9B,CAAC;CACJ;AAED,4EAA4E;AAC5E,MAAM,CAAC,KAAK,UAAU,WAAW;IAC7B,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC,MAAM,EAAE,CAAA;IACvD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,YAAY,EAAE,CAAA;IACvC,OAAO,QAAQ,CAAC,KAAK,CAAA;AACzB,CAAC;AAED,+EAA+E;AAC/E,MAAM,CAAC,KAAK,UAAU,aAAa;IAC/B,MAAM,QAAQ,GAAG,MAAM,qBAAqB,EAAE,CAAC,MAAM,EAAE,CAAA;IACvD,IAAI,CAAC,QAAQ;QAAE,MAAM,IAAI,YAAY,EAAE,CAAA;IACvC,MAAM,MAAM,GAAG,MAAM,oBAAoB,EAAE,CAAA;IAC3C,OAAO;QACH,KAAK,EAAE,QAAQ,CAAC,KAAK;QACrB,QAAQ,EACJ,MAAM,KAAK,KAAK;YACZ,CAAC,CAAC,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE;YACxC,CAAC,CAAC,EAAE,GAAG,eAAe,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE;KAC7D,CAAA;AACL,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,eAAe;IACjC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,KAAK,EAAE,CAAA;IAC7E,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM;QAAE,OAAO,EAAE,GAAG,eAAe,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;IAC3E,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAA;AACpD,CAAC;AAED,SAAS,eAAe,CAAC,OAAqB;IAM1C,OAAO;QACH,QAAQ,EAAE,OAAO,CAAC,QAAQ;QAC1B,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,SAAS;QACzC,UAAU,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,YAAY,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,SAAS;QAC7D,YAAY,EAAE,OAAO,CAAC,KAAK,IAAI,SAAS;KAC3C,CAAA;AACL,CAAC;AAED,SAAS,YAAY,CAAC,EAAU;IAC5B,MAAM,GAAG,GAAG,MAAM,CAAC,EAAE,CAAC,CAAA;IACtB,OAAO,MAAM,CAAC,QAAQ,CAAC,GAAG,CAAC,IAAI,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5D,CAAC"}

package/dist/lib/comms-account.d.ts

@@ -0,0 +1,22 @@
+import type { CommsAccount } from './auth-provider.js';
+import type { AuthMode } from './config.js';
+/** Canonical `CommsAccount` factory. Applies the `'unknown'` / `''` defaults. */
+export declare function makeCommsAccount(input: {
+    id: string;
+    label: string;
+    authMode?: AuthMode;
+    authScope?: string;
+}): CommsAccount;
+/**
+ * Adapt a Comms `getSessionUser` payload to a `CommsAccount`. Lives in its
+ * own module so `migrate-auth.ts` can import it without pulling in
+ * `auth-provider.ts`'s runtime graph.
+ */
+export declare function toCommsAccount(sessionUser: {
+    id: number;
+    fullName: string;
+}, metadata?: {
+    authMode?: AuthMode;
+    authScope?: string;
+}): CommsAccount;
+//# sourceMappingURL=comms-account.d.ts.map

package/dist/lib/comms-account.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"comms-account.d.ts","sourceRoot":"","sources":["../../src/lib/comms-account.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAA;AACtD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AAE3C,iFAAiF;AACjF,wBAAgB,gBAAgB,CAAC,KAAK,EAAE;IACpC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,CAAC,EAAE,QAAQ,CAAA;IACnB,SAAS,CAAC,EAAE,MAAM,CAAA;CACrB,GAAG,YAAY,CAOf;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAC1B,WAAW,EAAE;IAAE,EAAE,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EAC7C,QAAQ,GAAE;IAAE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,CAAA;CAAO,GAC3D,YAAY,CAOd"}

package/dist/lib/comms-account.js

@@ -0,0 +1,23 @@
+/** Canonical `CommsAccount` factory. Applies the `'unknown'` / `''` defaults. */
+export function makeCommsAccount(input) {
+    return {
+        id: input.id,
+        label: input.label,
+        authMode: input.authMode ?? 'unknown',
+        authScope: input.authScope ?? '',
+    };
+}
+/**
+ * Adapt a Comms `getSessionUser` payload to a `CommsAccount`. Lives in its
+ * own module so `migrate-auth.ts` can import it without pulling in
+ * `auth-provider.ts`'s runtime graph.
+ */
+export function toCommsAccount(sessionUser, metadata = {}) {
+    return makeCommsAccount({
+        id: String(sessionUser.id),
+        label: sessionUser.fullName,
+        authMode: metadata.authMode,
+        authScope: metadata.authScope,
+    });
+}
+//# sourceMappingURL=comms-account.js.map

package/dist/lib/comms-account.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"comms-account.js","sourceRoot":"","sources":["../../src/lib/comms-account.ts"],"names":[],"mappings":"AAGA,iFAAiF;AACjF,MAAM,UAAU,gBAAgB,CAAC,KAKhC;IACG,OAAO;QACH,EAAE,EAAE,KAAK,CAAC,EAAE;QACZ,KAAK,EAAE,KAAK,CAAC,KAAK;QAClB,QAAQ,EAAE,KAAK,CAAC,QAAQ,IAAI,SAAS;QACrC,SAAS,EAAE,KAAK,CAAC,SAAS,IAAI,EAAE;KACnC,CAAA;AACL,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAC1B,WAA6C,EAC7C,WAAwD,EAAE;IAE1D,OAAO,gBAAgB,CAAC;QACpB,EAAE,EAAE,MAAM,CAAC,WAAW,CAAC,EAAE,CAAC;QAC1B,KAAK,EAAE,WAAW,CAAC,QAAQ;QAC3B,QAAQ,EAAE,QAAQ,CAAC,QAAQ;QAC3B,SAAS,EAAE,QAAQ,CAAC,SAAS;KAChC,CAAC,CAAA;AACN,CAAC"}

package/dist/lib/completion.d.ts

@@ -0,0 +1,31 @@
+import type { Command, Option } from 'commander';
+/**
+ * Set argChoices on an option without enabling Commander's built-in
+ * validation. The choices are surfaced for shell completions but the
+ * option still accepts any value at parse time.
+ */
+export declare function withUnvalidatedChoices(opt: Option, values: string[]): Option;
+export declare function withCaseInsensitiveChoices(opt: Option, values: string[]): Option;
+/**
+ * Parse COMP_LINE into words, stripping the binary name and the
+ * 'completion-server' token that tabtab injects.
+ *
+ * FIXME: This splits on whitespace and does not handle quoted arguments.
+ * This is acceptable for command/flag traversal. It can be improved once
+ * tabtab exposes shell-provided tokenized words.
+ */
+export declare function parseCompLine(compLine: string): string[];
+export interface CompletionItem {
+    name: string;
+    description?: string;
+}
+/**
+ * Get completions for the current command line context.
+ *
+ * @param program - The root Commander program with all commands registered
+ * @param words - The words on the command line (excluding the binary name)
+ * @param current - The current word being typed (may be empty string)
+ * @returns Array of completion items
+ */
+export declare function getCompletions(program: Command, words: string[], current: string): CompletionItem[];
+//# sourceMappingURL=completion.d.ts.map

package/dist/lib/completion.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"completion.d.ts","sourceRoot":"","sources":["../../src/lib/completion.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,EAAE,MAAM,WAAW,CAAA;AAEhD;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAG5E;AAED,wBAAgB,0BAA0B,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,CAWhF;AAED;;;;;;;GAOG;AACH,wBAAgB,aAAa,CAAC,QAAQ,EAAE,MAAM,GAAG,MAAM,EAAE,CAIxD;AAED,MAAM,WAAW,cAAc;IAC3B,IAAI,EAAE,MAAM,CAAA;IACZ,WAAW,CAAC,EAAE,MAAM,CAAA;CACvB;AAoBD;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAC1B,OAAO,EAAE,OAAO,EAChB,KAAK,EAAE,MAAM,EAAE,EACf,OAAO,EAAE,MAAM,GAChB,cAAc,EAAE,CAsGlB"}