@doist/comms-cli 1.4.0 → 1.6.0

package/dist/lib/auth-provider.d.ts

@@ -1,17 +1,17 @@
 import { type AccountRef, type AuthAccount, type AuthProvider, type KeyringTokenStore } from '@doist/cli-core/auth';
 import { type AuthMode } from './config.js';
-export declare const AUTHORIZATION_URL = "https://comms.todoist.com/oauth/authorize";
-export declare const TOKEN_URL = "https://comms.todoist.com/oauth/access_token";
-export declare const REGISTRATION_URL = "https://comms.todoist.com/oauth/register";
-export declare const READ_WRITE_SCOPES: string[];
 export declare const READ_ONLY_SCOPES: string[];
+export declare const READ_WRITE_SCOPES: string[];
+export declare const FULL_ACCESS_SCOPES: string[];
 /**
- * The scope set a login is granted, as a pure function of `--read-only`. Single
- * source of truth shared by `attachCommsLoginCommand`'s `resolveScopes` (what we
- * request at authorize) and the provider's `validate` (what we record on the
- * account), so the two can't drift.
+ * Single source of truth shared by `attachCommsLoginCommand`'s `resolveScopes`
+ * (what we request at authorize) and the provider's token-response fallback
+ * (what we record on the account), so the two can't drift.
  */
-export declare function getScopes(readOnly: boolean): string[];
+export declare function getScopes({ readOnly, fullAccess, }: {
+    readOnly: boolean;
+    fullAccess?: boolean;
+}): string[];
 /**
  * Narrow account shape: only fields that round-trip through the local token
  * store. `id` is the stringified numeric Comms user id (so cli-core's
@@ -24,6 +24,9 @@ export type CommsAccount = AuthAccount & {
     label: string;
     authMode: AuthMode;
     authScope: string;
+    oauthClientId?: string;
+    authBaseUrl?: string;
+    authResource?: string;
 };
 export type CommsTokenStore = KeyringTokenStore<CommsAccount>;
 /**
@@ -36,18 +39,38 @@ export type CommsTokenStore = KeyringTokenStore<CommsAccount>;
 export declare const MANUAL_TOKEN_ACCOUNT: CommsAccount;
 /** True when `account` is the identity-less snapshot produced by `tdc auth token`. */
 export declare function isManualTokenAccount(account: Pick<CommsAccount, 'id' | 'label'>): boolean;
+export type CommsOAuthConfig = {
+    authBaseUrl: string;
+    authorizationUrl: string;
+    tokenUrl: string;
+    registrationUrl: string;
+    resource: string;
+};
 /**
- * Comms's OAuth flow uses RFC 7591 Dynamic Client Registration: each login
- * mints a fresh `client_id` / `client_secret`, then runs the standard PKCE
- * authorize + token exchange. cli-core's `createDcrProvider` drives all of that
- * via `oauth4webapi`; the only comms-specific piece is `validate`, which probes
- * `getSessionUser` and records the auth mode/scope the login was granted.
+ * Todoist is the OAuth authorization server; Comms is the protected resource.
+ * The CLI registers as a public DCR client (PKCE, no client secret) and pins
+ * tokens to the Comms resource via the RFC 8707 `resource` indicator. The
+ * registration / authorize / token-exchange / refresh mechanics all live in
+ * cli-core's `createDcrProvider`; the Comms-specific behaviour is:
  *
- * `authMode` / `authScope` are derived from `handshake.readOnly` (folded in by
- * `runOAuthFlow`) rather than threaded through `authorize`, because the scope
- * set is itself a pure function of `readOnly` (see `resolveScopes` in login.ts).
+ *  - endpoint + resource resolution from `COMMS_BASE_URL` / `COMMS_AS_URL`
+ *    (see `getCommsOAuthResource` / `getTodoistAuthBaseUrl`),
+ *  - caching the registered `client_id` in config (`loadClient` / `saveClient`),
+ *  - recording the server-granted scope on the account (the `exchangeCode`
+ *    wrapper stashes it on the handshake for `validate`; `refreshToken`
+ *    refreshes it), and
+ *  - `validate`: probe `getSessionUser`, derive `authMode` from the granted
+ *    scope, and build the `CommsAccount`.
+ */
+export declare function createCommsAuthProvider(fetchImpl?: typeof fetch): AuthProvider<CommsAccount>;
+/**
+ * The handshake `refreshAccessToken` forwards to the provider's
+ * `refreshToken`. cli-core doesn't persist the DCR handshake, so we
+ * reconstruct it from the stored account: `clientId` (read by cli-core's
+ * refresh grant), the resource / auth base URL (read by the endpoint
+ * resolvers), and the identity fields (read by `buildRefreshAccount`).
  */
-export declare function createCommsAuthProvider(): AuthProvider<CommsAccount>;
+export declare function getCommsOAuthRefreshHandshake(account: CommsAccount): Record<string, unknown>;
 /**
  * Accepts `42`, `id:42`, and case-insensitive labels — `parseRef` normalises
  * the numeric forms. Broader than cli-core's default strict-equality matcher.

package/dist/lib/auth-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EAGjB,KAAK,iBAAiB,EACzB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EAAE,KAAK,QAAQ,EAA4B,MAAM,aAAa,CAAA;AAKrE,eAAO,MAAM,iBAAiB,8CAA8C,CAAA;AAC5E,eAAO,MAAM,SAAS,iDAAiD,CAAA;AACvE,eAAO,MAAM,gBAAgB,6CAA6C,CAAA;AAK1E,eAAO,MAAM,iBAAiB,UAsB7B,CAAA;AAED,eAAO,MAAM,gBAAgB,UAY5B,CAAA;AAID;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,QAAQ,EAAE,OAAO,GAAG,MAAM,EAAE,CAErD;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;CACpB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,YAKlC,CAAA;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,OAAO,CAEzF;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,uBAAuB,IAAI,YAAY,CAAC,YAAY,CAAC,CAwCpE;AAED;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAUjF;AAmBD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACpC,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,UAAU,GAChB,OAAO,CAAC,YAAY,CAAC,CAcvB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,CA4CvD;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,KAAK,GAAG,cAAc,GAAG,aAAa,CAAC,CAM5F"}
+{"version":3,"file":"auth-provider.d.ts","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EACH,KAAK,UAAU,EACf,KAAK,WAAW,EAChB,KAAK,YAAY,EAMjB,KAAK,iBAAiB,EAKzB,MAAM,sBAAsB,CAAA;AAI7B,OAAO,EACH,KAAK,QAAQ,EAKhB,MAAM,aAAa,CAAA;AAUpB,eAAO,MAAM,gBAAgB,UAM5B,CAAA;AAaD,eAAO,MAAM,iBAAiB,UAAiD,CAAA;AAE/E,eAAO,MAAM,kBAAkB,UAAsD,CAAA;AAOrF;;;;GAIG;AACH,wBAAgB,SAAS,CAAC,EACtB,QAAQ,EACR,UAAkB,GACrB,EAAE;IACC,QAAQ,EAAE,OAAO,CAAA;IACjB,UAAU,CAAC,EAAE,OAAO,CAAA;CACvB,GAAG,MAAM,EAAE,CAGX;AAED;;;;;;GAMG;AACH,MAAM,MAAM,YAAY,GAAG,WAAW,GAAG;IACrC,EAAE,EAAE,MAAM,CAAA;IACV,KAAK,EAAE,MAAM,CAAA;IACb,QAAQ,EAAE,QAAQ,CAAA;IAClB,SAAS,EAAE,MAAM,CAAA;IACjB,aAAa,CAAC,EAAE,MAAM,CAAA;IACtB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,YAAY,CAAC,EAAE,MAAM,CAAA;CACxB,CAAA;AAED,MAAM,MAAM,eAAe,GAAG,iBAAiB,CAAC,YAAY,CAAC,CAAA;AAE7D;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,EAAE,YAKlC,CAAA;AAED,sFAAsF;AACtF,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG,OAAO,CAEzF;AAED,MAAM,MAAM,gBAAgB,GAAG;IAC3B,WAAW,EAAE,MAAM,CAAA;IACnB,gBAAgB,EAAE,MAAM,CAAA;IACxB,QAAQ,EAAE,MAAM,CAAA;IAChB,eAAe,EAAE,MAAM,CAAA;IACvB,QAAQ,EAAE,MAAM,CAAA;CACnB,CAAA;AAED;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,uBAAuB,CACnC,SAAS,GAAE,OAAO,KAAa,GAChC,YAAY,CAAC,YAAY,CAAC,CAgD5B;AAmED;;;;;;GAMG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAgB5F;AAuPD;;;GAGG;AACH,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,YAAY,EAAE,GAAG,EAAE,UAAU,GAAG,OAAO,CAUjF;AAmBD;;;;GAIG;AACH,wBAAsB,kBAAkB,CACpC,KAAK,EAAE,eAAe,EACtB,GAAG,EAAE,UAAU,GAChB,OAAO,CAAC,YAAY,CAAC,CAcvB;AAED;;;;GAIG;AACH,wBAAgB,qBAAqB,IAAI,eAAe,CAmDvD;AAED;;;;GAIG;AACH,wBAAsB,oBAAoB,IAAI,OAAO,CAAC,KAAK,GAAG,cAAc,GAAG,aAAa,CAAC,CAM5F"}

package/dist/lib/auth-provider.js

@@ -1,60 +1,44 @@
 import { createDcrProvider, createKeyringTokenStore, } from '@doist/cli-core/auth';
 import { createWrappedCommsClient } from './api.js';
 import { SECURE_STORE_SERVICE } from './auth-constants.js';
-import { toCommsAccount } from './comms-account.js';
-import { getConfig, getConfigPath } from './config.js';
+import { makeCommsAccount, toCommsAccount } from './comms-account.js';
+import { getConfig, getConfigPath, updateConfig, } from './config.js';
 import { CliError } from './errors.js';
 import { parseRef } from './refs.js';
 import { createCommsUserRecordStore, getDefaultUserRecord } from './user-records.js';
-export const AUTHORIZATION_URL = 'https://comms.todoist.com/oauth/authorize';
-export const TOKEN_URL = 'https://comms.todoist.com/oauth/access_token';
-export const REGISTRATION_URL = 'https://comms.todoist.com/oauth/register';
-const LOGO_URI = 'https://raw.githubusercontent.com/Doist/comms-cli/d65c447ff453eb36af585044c2f5f2f602bcdb34/icons/comms-cli.png';
-export const READ_WRITE_SCOPES = [
-    'user:read',
-    'user:write',
-    'workspaces:read',
-    'channels:read',
-    'channels:write',
-    'channels:remove',
-    'threads:read',
-    'threads:write',
-    'comments:read',
-    'comments:write',
-    'messages:read',
-    'messages:write',
-    'reactions:read',
-    'reactions:write',
-    'groups:read',
-    'groups:write',
-    'groups:remove',
-    'search:read',
-    'notifications:read',
-    'attachments:read',
-    'attachments:write',
-];
+const DEFAULT_TODOIST_AUTH_BASE_URL = 'https://todoist.com';
+const DEFAULT_COMMS_OAUTH_RESOURCE = 'https://comms.todoist.com';
+const LOGO_URI = 'https://raw.githubusercontent.com/doist/comms-cli/main/icons/comms-cli.png';
 export const READ_ONLY_SCOPES = [
     'user:read',
     'workspaces:read',
-    'channels:read',
-    'threads:read',
-    'comments:read',
-    'messages:read',
-    'reactions:read',
-    'groups:read',
-    'search:read',
-    'notifications:read',
-    'attachments:read',
+    'comms:channels:read',
+    'comms:content:read',
+    'comms:messages:read',
 ];
+const DEFAULT_WRITE_SCOPES = ['comms:content:write', 'comms:messages:write'];
+const FULL_ACCESS_EXTRA_SCOPES = [
+    'user:write',
+    'workspaces:write',
+    'comms:channels:write',
+    'comms:channels:delete',
+    'comms:content:delete',
+    'comms:messages:delete',
+];
+export const READ_WRITE_SCOPES = [...READ_ONLY_SCOPES, ...DEFAULT_WRITE_SCOPES];
+export const FULL_ACCESS_SCOPES = [...READ_WRITE_SCOPES, ...FULL_ACCESS_EXTRA_SCOPES];
 const AUTH_HINTS = ['Try again: tdc auth login', 'Or set COMMS_API_TOKEN environment variable'];
+const WRITE_SCOPES = new Set([...DEFAULT_WRITE_SCOPES, ...FULL_ACCESS_EXTRA_SCOPES]);
+const MAX_CACHED_OAUTH_CLIENTS = 25;
 /**
- * The scope set a login is granted, as a pure function of `--read-only`. Single
- * source of truth shared by `attachCommsLoginCommand`'s `resolveScopes` (what we
- * request at authorize) and the provider's `validate` (what we record on the
- * account), so the two can't drift.
+ * Single source of truth shared by `attachCommsLoginCommand`'s `resolveScopes`
+ * (what we request at authorize) and the provider's token-response fallback
+ * (what we record on the account), so the two can't drift.
  */
-export function getScopes(readOnly) {
-    return readOnly ? READ_ONLY_SCOPES : READ_WRITE_SCOPES;
+export function getScopes({ readOnly, fullAccess = false, }) {
+    if (readOnly)
+        return READ_ONLY_SCOPES;
+    return fullAccess ? FULL_ACCESS_SCOPES : READ_WRITE_SCOPES;
 }
 /**
  * Sentinel for the `{ id: '', label: '' }` snapshot that `tdc auth token`
@@ -74,53 +58,353 @@ export function isManualTokenAccount(account) {
     return !account.id || !account.label;
 }
 /**
- * Comms's OAuth flow uses RFC 7591 Dynamic Client Registration: each login
- * mints a fresh `client_id` / `client_secret`, then runs the standard PKCE
- * authorize + token exchange. cli-core's `createDcrProvider` drives all of that
- * via `oauth4webapi`; the only comms-specific piece is `validate`, which probes
- * `getSessionUser` and records the auth mode/scope the login was granted.
+ * Todoist is the OAuth authorization server; Comms is the protected resource.
+ * The CLI registers as a public DCR client (PKCE, no client secret) and pins
+ * tokens to the Comms resource via the RFC 8707 `resource` indicator. The
+ * registration / authorize / token-exchange / refresh mechanics all live in
+ * cli-core's `createDcrProvider`; the Comms-specific behaviour is:
  *
- * `authMode` / `authScope` are derived from `handshake.readOnly` (folded in by
- * `runOAuthFlow`) rather than threaded through `authorize`, because the scope
- * set is itself a pure function of `readOnly` (see `resolveScopes` in login.ts).
+ *  - endpoint + resource resolution from `COMMS_BASE_URL` / `COMMS_AS_URL`
+ *    (see `getCommsOAuthResource` / `getTodoistAuthBaseUrl`),
+ *  - caching the registered `client_id` in config (`loadClient` / `saveClient`),
+ *  - recording the server-granted scope on the account (the `exchangeCode`
+ *    wrapper stashes it on the handshake for `validate`; `refreshToken`
+ *    refreshes it), and
+ *  - `validate`: probe `getSessionUser`, derive `authMode` from the granted
+ *    scope, and build the `CommsAccount`.
  */
-export function createCommsAuthProvider() {
-    return createDcrProvider({
-        registrationUrl: REGISTRATION_URL,
-        authorizeUrl: AUTHORIZATION_URL,
-        tokenUrl: TOKEN_URL,
+export function createCommsAuthProvider(fetchImpl = fetch) {
+    const base = createDcrProvider({
+        registrationUrl: ({ handshake }) => getOAuthConfigForHandshake(handshake).registrationUrl,
+        authorizeUrl: ({ handshake }) => getOAuthConfigForHandshake(handshake).authorizationUrl,
+        tokenUrl: ({ handshake }) => getOAuthConfigForHandshake(handshake).tokenUrl,
+        resource: ({ handshake }) => getOAuthConfigForHandshake(handshake).resource,
         clientMetadata: {
             clientName: 'Comms CLI',
             clientUri: 'https://github.com/doist/comms-cli',
             logoUri: LOGO_URI,
-            applicationType: 'native',
-            // Comms client_ids can contain `_`. oauth4webapi's
-            // `client_secret_basic` form-url-encodes the Basic credential per
-            // RFC 6749 §2.3.1 (`_` → `%5F`), and the token endpoint doesn't
-            // url-decode it, so the lookup fails with "client_id not found".
-            // `client_secret_post` sends the credential in the body via
-            // URLSearchParams, which preserves `_`, sidestepping the mismatch.
-            tokenEndpointAuthMethod: 'client_secret_post',
+            tokenEndpointAuthMethod: 'none',
+            grantTypes: ['authorization_code', 'refresh_token'],
+            responseTypes: ['code'],
+            // DCR scope is the upper bound this public client may request.
+            // Per-login authorize scopes are still narrowed by `resolveScopes`;
+            // keeping registration broad lets one cached client serve read-only,
+            // default, and full-access logins.
+            extra: { scope: FULL_ACCESS_SCOPES.join(' ') },
         },
+        loadClient: loadCachedClient,
+        saveClient: saveCachedClient,
+        validate: validateCommsToken,
         errorHints: AUTH_HINTS,
-        async validate({ token, handshake }) {
-            // `runOAuthFlow` folds a boolean `readOnly` into the handshake.
-            // Fail closed on a missing/malformed value rather than letting
-            // `Boolean(undefined)` silently grant read-write (which would relax
-            // the local write guard).
-            const readOnly = handshake.readOnly;
-            if (typeof readOnly !== 'boolean') {
-                throw new CliError('AUTH_FAILED', 'Internal: auth handshake missing the readOnly flag.', AUTH_HINTS);
-            }
-            const client = createWrappedCommsClient(token);
-            const user = await client.users.getSessionUser();
-            return toCommsAccount(user, {
-                authMode: readOnly ? 'read-only' : 'read-write',
-                authScope: getScopes(readOnly).join(' '),
-            });
+        fetchImpl,
+    });
+    return {
+        ...base,
+        async exchangeCode(input) {
+            const exchange = await base.exchangeCode(input);
+            // cli-core threads this same handshake object into `validateToken`
+            // next, so stash the server-granted scope (so `validate` records the
+            // authoritative scope) and the token-response diagnostics (so a
+            // Comms rejection can explain what Todoist actually issued).
+            if (exchange.scope)
+                input.handshake.grantedScope = exchange.scope;
+            input.handshake.tokenDiagnostics = describeTokenResponse(exchange);
+            return exchange;
+        },
+        async refreshToken(input) {
+            const exchange = await base.refreshToken(input);
+            const grantedScope = exchange.scope ?? optionalHandshakeString(input.handshake, 'authScope');
+            const account = grantedScope
+                ? buildRefreshAccount(input.handshake, grantedScope)
+                : undefined;
+            return account ? { ...exchange, account } : exchange;
         },
+    };
+}
+/**
+ * Probe `getSessionUser` to confirm the token works, then build a
+ * `CommsAccount`. Granted scope comes from the server (stashed on the
+ * handshake by `exchangeCode`); it falls back to the requested scope set when
+ * the token endpoint didn't echo one.
+ */
+async function validateCommsToken({ token, handshake }) {
+    const readOnly = requireHandshakeReadOnly(handshake);
+    const grantedScope = optionalHandshakeString(handshake, 'grantedScope') ??
+        getScopes({ readOnly, fullAccess: isFullAccessHandshake(handshake) }).join(' ');
+    const authMode = getAuthModeForGrantedScope(grantedScope);
+    const config = getOAuthConfigForHandshake(handshake);
+    const client = createWrappedCommsClient(token, { baseUrl: config.resource });
+    let user;
+    try {
+        user = await client.users.getSessionUser();
+    }
+    catch (error) {
+        if (hasErrorCode(error, 'FORBIDDEN')) {
+            const diagnostics = Array.isArray(handshake.tokenDiagnostics)
+                ? handshake.tokenDiagnostics
+                : [];
+            throw new CliError('AUTH_FAILED', 'Comms rejected the OAuth token during validation.', [
+                ...diagnostics,
+                'Check Comms logs for Todoist OAuth introspection: active, aud, exp, scope, user_id/sub',
+            ]);
+        }
+        throw error;
+    }
+    return toCommsAccount(user, {
+        authMode,
+        authScope: normalizeScopeString(grantedScope),
+        oauthClientId: requireHandshakeString(handshake, 'clientId', 'AUTH_FAILED'),
+        authBaseUrl: config.authBaseUrl,
+        authResource: config.resource,
+    });
+}
+/**
+ * Rebuild the rotated `CommsAccount` after a refresh so the stored
+ * `authScope` / `authMode` track the (possibly changed) granted scope. Returns
+ * `undefined` when the refresh handshake lacks the identity fields, leaving the
+ * previously-stored account in place.
+ */
+function buildRefreshAccount(handshake, grantedScope) {
+    const id = optionalHandshakeString(handshake, 'accountId');
+    const label = optionalHandshakeString(handshake, 'accountLabel');
+    const clientId = optionalHandshakeString(handshake, 'clientId');
+    if (!id || !label || !clientId)
+        return undefined;
+    const config = getOAuthConfigForHandshake(handshake);
+    return makeCommsAccount({
+        id,
+        label,
+        authMode: getAuthModeForGrantedScope(grantedScope),
+        authScope: normalizeScopeString(grantedScope),
+        oauthClientId: clientId,
+        authBaseUrl: config.authBaseUrl,
+        authResource: config.resource,
     });
 }
+/**
+ * The handshake `refreshAccessToken` forwards to the provider's
+ * `refreshToken`. cli-core doesn't persist the DCR handshake, so we
+ * reconstruct it from the stored account: `clientId` (read by cli-core's
+ * refresh grant), the resource / auth base URL (read by the endpoint
+ * resolvers), and the identity fields (read by `buildRefreshAccount`).
+ */
+export function getCommsOAuthRefreshHandshake(account) {
+    if (!account.oauthClientId || !account.authBaseUrl || !account.authResource) {
+        throw new CliError('NO_TOKEN', 'Stored OAuth token cannot be refreshed because its client metadata is missing.', ['Run: tdc auth login']);
+    }
+    return {
+        clientId: account.oauthClientId,
+        accountId: account.id,
+        accountLabel: account.label,
+        authScope: account.authScope,
+        authBaseUrl: account.authBaseUrl,
+        resource: account.authResource,
+    };
+}
+/** Endpoint + resource config derived from the environment (login path). */
+function getCommsOAuthConfig() {
+    const resource = getCommsOAuthResource();
+    return buildCommsOAuthConfig(getTodoistAuthBaseUrl(resource), resource);
+}
+/**
+ * Endpoint + resource config for a provider hook. Prefers values carried on
+ * the handshake (the refresh path reconstructs them from the stored account)
+ * and falls back to the environment (the login path, where the handshake
+ * doesn't carry them).
+ */
+function getOAuthConfigForHandshake(handshake) {
+    const resource = optionalHandshakeString(handshake, 'resource') ?? getCommsOAuthResource();
+    const authBaseUrl = optionalHandshakeString(handshake, 'authBaseUrl') ?? getTodoistAuthBaseUrl(resource);
+    return buildCommsOAuthConfig(authBaseUrl, resource);
+}
+function buildCommsOAuthConfig(authBaseUrl, resource) {
+    return {
+        authBaseUrl,
+        authorizationUrl: `${authBaseUrl}/oauth/authorize`,
+        tokenUrl: `${authBaseUrl}/oauth/access_token`,
+        registrationUrl: `${authBaseUrl}/oauth/register`,
+        resource,
+    };
+}
+/**
+ * `loadClient` hook: reuse a registered `client_id` cached in config for the
+ * current auth server + resource + redirect URI. Keying on `redirectUri` is
+ * required — the registration is bound to its `redirect_uris` and the callback
+ * port can change between logins.
+ */
+async function loadCachedClient(input) {
+    const config = getCommsOAuthConfig();
+    const { oauthClients } = await getConfig();
+    const cached = (Array.isArray(oauthClients) ? oauthClients : [])
+        .filter(isStoredOAuthClient)
+        .find((client) => client.authBaseUrl === config.authBaseUrl &&
+        client.authResource === config.resource &&
+        client.redirectUri === input.redirectUri);
+    return cached ? { clientId: cached.clientId } : undefined;
+}
+/** `saveClient` hook: persist a freshly registered public client for reuse. */
+async function saveCachedClient(client, input) {
+    const config = getCommsOAuthConfig();
+    const entry = {
+        clientId: client.clientId,
+        authBaseUrl: config.authBaseUrl,
+        authResource: config.resource,
+        redirectUri: input.redirectUri,
+    };
+    const stored = await getConfig();
+    const existing = (Array.isArray(stored.oauthClients) ? stored.oauthClients : [])
+        .filter(isStoredOAuthClient)
+        .filter((other) => other.authBaseUrl !== entry.authBaseUrl ||
+        other.authResource !== entry.authResource ||
+        other.redirectUri !== entry.redirectUri);
+    await updateConfig({
+        oauthClients: [...existing, entry].slice(-MAX_CACHED_OAUTH_CLIENTS),
+    });
+}
+function isStoredOAuthClient(value) {
+    if (!value || typeof value !== 'object' || Array.isArray(value))
+        return false;
+    const record = value;
+    return (typeof record.clientId === 'string' &&
+        typeof record.authBaseUrl === 'string' &&
+        typeof record.authResource === 'string' &&
+        typeof record.redirectUri === 'string');
+}
+function getCommsOAuthResource() {
+    const override = process.env.COMMS_BASE_URL;
+    if (!override)
+        return DEFAULT_COMMS_OAUTH_RESOURCE;
+    let url;
+    try {
+        url = new URL(override);
+    }
+    catch {
+        throw new CliError('INVALID_URL', `COMMS_BASE_URL is not a valid URL: ${override}`, [
+            'Use a URL like https://comms.todoist.com',
+            'Or unset COMMS_BASE_URL before running OAuth login',
+        ]);
+    }
+    if (url.protocol !== 'https:') {
+        throw new CliError('INVALID_URL', 'Todoist OAuth requires an HTTPS Comms resource.', [
+            'Use https://comms.todoist.com, https://comms.staging.todoist.com, or https://comms.local.todoist.com',
+        ]);
+    }
+    const origin = url.origin;
+    const host = url.hostname.toLowerCase();
+    if (host === 'comms.todoist.com' ||
+        host === 'comms.staging.todoist.com' ||
+        host === 'comms.local.todoist.com') {
+        return origin;
+    }
+    throw new CliError('INVALID_URL', `Unsupported Comms OAuth resource: ${origin}`, [
+        'Use COMMS_API_TOKEN for custom Comms hosts',
+        'Supported OAuth hosts: comms.todoist.com, comms.staging.todoist.com, comms.local.todoist.com',
+    ]);
+}
+function getTodoistAuthBaseUrl(resource) {
+    const override = process.env.COMMS_AS_URL;
+    if (override)
+        return normalizeAuthBaseUrlOverride(override);
+    const host = new URL(resource).hostname.toLowerCase();
+    if (host === 'comms.staging.todoist.com')
+        return 'https://staging.todoist.com';
+    if (host === 'comms.local.todoist.com')
+        return 'https://local.todoist.com';
+    return DEFAULT_TODOIST_AUTH_BASE_URL;
+}
+function normalizeAuthBaseUrlOverride(raw) {
+    let url;
+    try {
+        url = new URL(raw);
+    }
+    catch {
+        throw new CliError('INVALID_URL', `COMMS_AS_URL is not a valid URL: ${raw}`, [
+            'Use a URL like https://todoist.com',
+        ]);
+    }
+    if (url.protocol !== 'https:') {
+        throw new CliError('INVALID_URL', 'COMMS_AS_URL must use HTTPS.', [
+            'Use a URL like https://todoist.com',
+        ]);
+    }
+    const host = url.hostname.toLowerCase();
+    if (host !== 'todoist.com' && !host.endsWith('.todoist.com')) {
+        throw new CliError('INVALID_URL', 'COMMS_AS_URL must point to a Todoist host.', [
+            'Use a URL like https://todoist.com or https://staging.todoist.com',
+        ]);
+    }
+    return url.origin;
+}
+function requireHandshakeString(handshake, key, code = 'AUTH_TOKEN_EXCHANGE_FAILED') {
+    const value = handshake[key];
+    if (typeof value !== 'string' || value.length === 0) {
+        throw new CliError(code, `Internal: OAuth handshake missing ${key}.`, [
+            'Try again: tdc auth login',
+        ]);
+    }
+    return value;
+}
+function optionalHandshakeString(handshake, key) {
+    const value = handshake[key];
+    return typeof value === 'string' && value.length > 0 ? value : undefined;
+}
+function requireHandshakeReadOnly(handshake) {
+    if (typeof handshake.readOnly !== 'boolean') {
+        throw new CliError('AUTH_FAILED', 'Internal: auth handshake missing the readOnly flag.', AUTH_HINTS);
+    }
+    return handshake.readOnly;
+}
+/** Read the `--full-access` flag from the runtime flags folded onto the handshake. */
+function isFullAccessHandshake(handshake) {
+    const flags = handshake.flags;
+    return (typeof flags === 'object' &&
+        flags !== null &&
+        flags.fullAccess === true);
+}
+function hasErrorCode(error, code) {
+    return (typeof error === 'object' &&
+        error !== null &&
+        'code' in error &&
+        typeof error.code === 'string' &&
+        error.code === code);
+}
+/**
+ * Operator-facing hints describing what Todoist's token endpoint actually
+ * issued — surfaced only when Comms later rejects the token during `validate`.
+ * Reconstructed from the `ExchangeResult` (cli-core's DCR exchange surfaces the
+ * access token, refresh-token presence, and granted scope).
+ */
+function describeTokenResponse(exchange) {
+    const hints = [
+        `Todoist token response: refresh_token=${exchange.refreshToken ? 'yes' : 'no'}`,
+        `Todoist token response access_token: ${describeAccessTokenShape(exchange.accessToken)}`,
+    ];
+    if (exchange.scope)
+        hints.push(`Todoist token response scope: ${exchange.scope}`);
+    if (!exchange.refreshToken) {
+        hints.push('Todoist issued a non-refresh access token; Comms intentionally rejects tokens without expiring introspection.');
+    }
+    return hints;
+}
+function describeAccessTokenShape(accessToken) {
+    const shape = /^[0-9a-f]{40}$/.test(accessToken) ? 'raw-hex-40' : 'other';
+    return `shape=${shape}, length=${accessToken.length}`;
+}
+function getAuthModeForGrantedScope(scope) {
+    return splitScopeString(scope).some((scopeCode) => WRITE_SCOPES.has(scopeCode))
+        ? 'read-write'
+        : 'read-only';
+}
+function normalizeScopeString(scope) {
+    return splitScopeString(scope).join(' ');
+}
+function splitScopeString(scope) {
+    return scope
+        .replaceAll(',', ' ')
+        .split(/\s+/)
+        .map((part) => part.trim())
+        .filter(Boolean);
+}
 /**
  * Accepts `42`, `id:42`, and case-insensitive labels — `parseRef` normalises
  * the numeric forms. Broader than cli-core's default strict-equality matcher.
@@ -215,6 +499,9 @@ export function createCommsTokenStore() {
         async set(account, token) {
             return inner.set(account, token);
         },
+        async setBundle(account, bundle, options) {
+            return inner.setBundle(account, bundle, options);
+        },
         async clear(ref) {
             return inner.clear(ref);
         },
@@ -236,7 +523,7 @@ export async function getActiveTokenSource() {
         return 'env';
     const config = await getConfig();
     const record = getDefaultUserRecord(config);
-    if (record?.fallbackToken)
+    if (record?.fallbackToken || record?.fallbackRefreshToken)
         return 'config-file';
     return 'secure-store';
 }

package/dist/lib/auth-provider.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAIH,iBAAiB,EACjB,uBAAuB,GAE1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACnD,OAAO,EAAiB,SAAS,EAAE,aAAa,EAAE,MAAM,aAAa,CAAA;AACrE,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAEpF,MAAM,CAAC,MAAM,iBAAiB,GAAG,2CAA2C,CAAA;AAC5E,MAAM,CAAC,MAAM,SAAS,GAAG,8CAA8C,CAAA;AACvE,MAAM,CAAC,MAAM,gBAAgB,GAAG,0CAA0C,CAAA;AAE1E,MAAM,QAAQ,GACV,gHAAgH,CAAA;AAEpH,MAAM,CAAC,MAAM,iBAAiB,GAAG;IAC7B,WAAW;IACX,YAAY;IACZ,iBAAiB;IACjB,eAAe;IACf,gBAAgB;IAChB,iBAAiB;IACjB,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,eAAe;IACf,gBAAgB;IAChB,gBAAgB;IAChB,iBAAiB;IACjB,aAAa;IACb,cAAc;IACd,eAAe;IACf,aAAa;IACb,oBAAoB;IACpB,kBAAkB;IAClB,mBAAmB;CACtB,CAAA;AAED,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B,WAAW;IACX,iBAAiB;IACjB,eAAe;IACf,cAAc;IACd,eAAe;IACf,eAAe;IACf,gBAAgB;IAChB,aAAa;IACb,aAAa;IACb,oBAAoB;IACpB,kBAAkB;CACrB,CAAA;AAED,MAAM,UAAU,GAAG,CAAC,2BAA2B,EAAE,6CAA6C,CAAC,CAAA;AAE/F;;;;;GAKG;AACH,MAAM,UAAU,SAAS,CAAC,QAAiB;IACvC,OAAO,QAAQ,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,iBAAiB,CAAA;AAC1D,CAAC;AAkBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiB;IAC9C,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,EAAE;CAChB,CAAA;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,OAA2C;IAC5E,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;AACxC,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,uBAAuB;IACnC,OAAO,iBAAiB,CAAe;QACnC,eAAe,EAAE,gBAAgB;QACjC,YAAY,EAAE,iBAAiB;QAC/B,QAAQ,EAAE,SAAS;QACnB,cAAc,EAAE;YACZ,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,oCAAoC;YAC/C,OAAO,EAAE,QAAQ;YACjB,eAAe,EAAE,QAAQ;YACzB,mDAAmD;YACnD,kEAAkE;YAClE,gEAAgE;YAChE,iEAAiE;YACjE,4DAA4D;YAC5D,mEAAmE;YACnE,uBAAuB,EAAE,oBAAoB;SAChD;QACD,UAAU,EAAE,UAAU;QACtB,KAAK,CAAC,QAAQ,CAAC,EAAE,KAAK,EAAE,SAAS,EAAE;YAC/B,gEAAgE;YAChE,+DAA+D;YAC/D,oEAAoE;YACpE,0BAA0B;YAC1B,MAAM,QAAQ,GAAG,SAAS,CAAC,QAAQ,CAAA;YACnC,IAAI,OAAO,QAAQ,KAAK,SAAS,EAAE,CAAC;gBAChC,MAAM,IAAI,QAAQ,CACd,aAAa,EACb,qDAAqD,EACrD,UAAU,CACb,CAAA;YACL,CAAC;YACD,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,CAAC,CAAA;YAC9C,MAAM,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAA;YAChD,OAAO,cAAc,CAAC,IAAI,EAAE;gBACxB,QAAQ,EAAE,QAAQ,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY;gBAC/C,SAAS,EAAE,SAAS,CAAC,QAAQ,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC;aAC3C,CAAC,CAAA;QACN,CAAC;KACJ,CAAC,CAAA;AACN,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAqB,EAAE,GAAe;IACpE,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,oBAAoB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAA;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC5F,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,MAAM,aAAa,GAAG,iBAAiB,CAAA;AAEvC;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAgB;IACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC3C,IAAI,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,KAAsB,EACtB,GAAe;IAEf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,uEAAuE;IACvE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,OAAO;SAChB,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;SACvD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,GAAG,IAAI,EAAE;YAC3E,uBAAuB;SAC1B,CAAC,CAAA;IACN,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACjC,MAAM,KAAK,GAAG,uBAAuB,CAAe;QAChD,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,0BAA0B,EAAE;QACzC,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,iBAAiB;KAClC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAoB,EAAE;QAC1D,KAAK,CAAC,MAAM,CAAC,GAAgB;YACzB,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACvD,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,0CAA0C;QAC1C,KAAK,CAAC,YAAY,CAAC,GAAgB;YAC/B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;YACxC,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAA;YACjF,CAAC;YACD,OAAO,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,KAAK,CAAC,aAAa,CAAC,GAAgB;YAChC,IAAI,kBAAkB,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACxC,OAAO,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAqB,EAAE,KAAa;YAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI;YACN,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;KACJ,CAAC,CAAA;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,aAAa;QAAE,OAAO,aAAa,CAAA;IAC/C,OAAO,cAAc,CAAA;AACzB,CAAC"}
+{"version":3,"file":"auth-provider.js","sourceRoot":"","sources":["../../src/lib/auth-provider.ts"],"names":[],"mappings":"AAAA,OAAO,EAIH,iBAAiB,EACjB,uBAAuB,GAS1B,MAAM,sBAAsB,CAAA;AAC7B,OAAO,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAA;AACnD,OAAO,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAA;AAC1D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAA;AACrE,OAAO,EAEH,SAAS,EACT,aAAa,EAEb,YAAY,GACf,MAAM,aAAa,CAAA;AACpB,OAAO,EAAE,QAAQ,EAAE,MAAM,aAAa,CAAA;AACtC,OAAO,EAAE,QAAQ,EAAE,MAAM,WAAW,CAAA;AACpC,OAAO,EAAE,0BAA0B,EAAE,oBAAoB,EAAE,MAAM,mBAAmB,CAAA;AAEpF,MAAM,6BAA6B,GAAG,qBAAqB,CAAA;AAC3D,MAAM,4BAA4B,GAAG,2BAA2B,CAAA;AAEhE,MAAM,QAAQ,GAAG,4EAA4E,CAAA;AAE7F,MAAM,CAAC,MAAM,gBAAgB,GAAG;IAC5B,WAAW;IACX,iBAAiB;IACjB,qBAAqB;IACrB,oBAAoB;IACpB,qBAAqB;CACxB,CAAA;AAED,MAAM,oBAAoB,GAAG,CAAC,qBAAqB,EAAE,sBAAsB,CAAC,CAAA;AAE5E,MAAM,wBAAwB,GAAG;IAC7B,YAAY;IACZ,kBAAkB;IAClB,sBAAsB;IACtB,uBAAuB;IACvB,sBAAsB;IACtB,uBAAuB;CAC1B,CAAA;AAED,MAAM,CAAC,MAAM,iBAAiB,GAAG,CAAC,GAAG,gBAAgB,EAAE,GAAG,oBAAoB,CAAC,CAAA;AAE/E,MAAM,CAAC,MAAM,kBAAkB,GAAG,CAAC,GAAG,iBAAiB,EAAE,GAAG,wBAAwB,CAAC,CAAA;AAErF,MAAM,UAAU,GAAG,CAAC,2BAA2B,EAAE,6CAA6C,CAAC,CAAA;AAE/F,MAAM,YAAY,GAAG,IAAI,GAAG,CAAC,CAAC,GAAG,oBAAoB,EAAE,GAAG,wBAAwB,CAAC,CAAC,CAAA;AACpF,MAAM,wBAAwB,GAAG,EAAE,CAAA;AAEnC;;;;GAIG;AACH,MAAM,UAAU,SAAS,CAAC,EACtB,QAAQ,EACR,UAAU,GAAG,KAAK,GAIrB;IACG,IAAI,QAAQ;QAAE,OAAO,gBAAgB,CAAA;IACrC,OAAO,UAAU,CAAC,CAAC,CAAC,kBAAkB,CAAC,CAAC,CAAC,iBAAiB,CAAA;AAC9D,CAAC;AAqBD;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,oBAAoB,GAAiB;IAC9C,EAAE,EAAE,EAAE;IACN,KAAK,EAAE,EAAE;IACT,QAAQ,EAAE,SAAS;IACnB,SAAS,EAAE,EAAE;CAChB,CAAA;AAED,sFAAsF;AACtF,MAAM,UAAU,oBAAoB,CAAC,OAA2C;IAC5E,OAAO,CAAC,OAAO,CAAC,EAAE,IAAI,CAAC,OAAO,CAAC,KAAK,CAAA;AACxC,CAAC;AAUD;;;;;;;;;;;;;;;GAeG;AACH,MAAM,UAAU,uBAAuB,CACnC,YAA0B,KAAK;IAE/B,MAAM,IAAI,GAAG,iBAAiB,CAAe;QACzC,eAAe,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,eAAe;QACzF,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,gBAAgB;QACvF,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,QAAQ;QAC3E,QAAQ,EAAE,CAAC,EAAE,SAAS,EAAE,EAAE,EAAE,CAAC,0BAA0B,CAAC,SAAS,CAAC,CAAC,QAAQ;QAC3E,cAAc,EAAE;YACZ,UAAU,EAAE,WAAW;YACvB,SAAS,EAAE,oCAAoC;YAC/C,OAAO,EAAE,QAAQ;YACjB,uBAAuB,EAAE,MAAM;YAC/B,UAAU,EAAE,CAAC,oBAAoB,EAAE,eAAe,CAAC;YACnD,aAAa,EAAE,CAAC,MAAM,CAAC;YACvB,+DAA+D;YAC/D,oEAAoE;YACpE,qEAAqE;YACrE,mCAAmC;YACnC,KAAK,EAAE,EAAE,KAAK,EAAE,kBAAkB,CAAC,IAAI,CAAC,GAAG,CAAC,EAAE;SACjD;QACD,UAAU,EAAE,gBAAgB;QAC5B,UAAU,EAAE,gBAAgB;QAC5B,QAAQ,EAAE,kBAAkB;QAC5B,UAAU,EAAE,UAAU;QACtB,SAAS;KACZ,CAAC,CAAA;IAEF,OAAO;QACH,GAAG,IAAI;QACP,KAAK,CAAC,YAAY,CAAC,KAAoB;YACnC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAY,CAAC,KAAK,CAAC,CAAA;YAC/C,mEAAmE;YACnE,qEAAqE;YACrE,gEAAgE;YAChE,6DAA6D;YAC7D,IAAI,QAAQ,CAAC,KAAK;gBAAE,KAAK,CAAC,SAAS,CAAC,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAA;YACjE,KAAK,CAAC,SAAS,CAAC,gBAAgB,GAAG,qBAAqB,CAAC,QAAQ,CAAC,CAAA;YAClE,OAAO,QAAQ,CAAA;QACnB,CAAC;QACD,KAAK,CAAC,YAAY,CAAC,KAAmB;YAClC,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,YAAa,CAAC,KAAK,CAAC,CAAA;YAChD,MAAM,YAAY,GACd,QAAQ,CAAC,KAAK,IAAI,uBAAuB,CAAC,KAAK,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;YAC3E,MAAM,OAAO,GAAG,YAAY;gBACxB,CAAC,CAAC,mBAAmB,CAAC,KAAK,CAAC,SAAS,EAAE,YAAY,CAAC;gBACpD,CAAC,CAAC,SAAS,CAAA;YACf,OAAO,OAAO,CAAC,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,QAAQ,CAAA;QACxD,CAAC;KACJ,CAAA;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,kBAAkB,CAAC,EAAE,KAAK,EAAE,SAAS,EAAiB;IACjE,MAAM,QAAQ,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,YAAY,GACd,uBAAuB,CAAC,SAAS,EAAE,cAAc,CAAC;QAClD,SAAS,CAAC,EAAE,QAAQ,EAAE,UAAU,EAAE,qBAAqB,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IACnF,MAAM,QAAQ,GAAG,0BAA0B,CAAC,YAAY,CAAC,CAAA;IACzD,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAA;IACpD,MAAM,MAAM,GAAG,wBAAwB,CAAC,KAAK,EAAE,EAAE,OAAO,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAA;IAC5E,IAAI,IAAI,CAAA;IACR,IAAI,CAAC;QACD,IAAI,GAAG,MAAM,MAAM,CAAC,KAAK,CAAC,cAAc,EAAE,CAAA;IAC9C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QACb,IAAI,YAAY,CAAC,KAAK,EAAE,WAAW,CAAC,EAAE,CAAC;YACnC,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC,SAAS,CAAC,gBAAgB,CAAC;gBACzD,CAAC,CAAE,SAAS,CAAC,gBAA6B;gBAC1C,CAAC,CAAC,EAAE,CAAA;YACR,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,mDAAmD,EAAE;gBACnF,GAAG,WAAW;gBACd,wFAAwF;aAC3F,CAAC,CAAA;QACN,CAAC;QACD,MAAM,KAAK,CAAA;IACf,CAAC;IACD,OAAO,cAAc,CAAC,IAAI,EAAE;QACxB,QAAQ;QACR,SAAS,EAAE,oBAAoB,CAAC,YAAY,CAAC;QAC7C,aAAa,EAAE,sBAAsB,CAAC,SAAS,EAAE,UAAU,EAAE,aAAa,CAAC;QAC3E,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,QAAQ;KAChC,CAAC,CAAA;AACN,CAAC;AAED;;;;;GAKG;AACH,SAAS,mBAAmB,CACxB,SAAkC,EAClC,YAAoB;IAEpB,MAAM,EAAE,GAAG,uBAAuB,CAAC,SAAS,EAAE,WAAW,CAAC,CAAA;IAC1D,MAAM,KAAK,GAAG,uBAAuB,CAAC,SAAS,EAAE,cAAc,CAAC,CAAA;IAChE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,CAAA;IAC/D,IAAI,CAAC,EAAE,IAAI,CAAC,KAAK,IAAI,CAAC,QAAQ;QAAE,OAAO,SAAS,CAAA;IAEhD,MAAM,MAAM,GAAG,0BAA0B,CAAC,SAAS,CAAC,CAAA;IACpD,OAAO,gBAAgB,CAAC;QACpB,EAAE;QACF,KAAK;QACL,QAAQ,EAAE,0BAA0B,CAAC,YAAY,CAAC;QAClD,SAAS,EAAE,oBAAoB,CAAC,YAAY,CAAC;QAC7C,aAAa,EAAE,QAAQ;QACvB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,QAAQ;KAChC,CAAC,CAAA;AACN,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAqB;IAC/D,IAAI,CAAC,OAAO,CAAC,aAAa,IAAI,CAAC,OAAO,CAAC,WAAW,IAAI,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC;QAC1E,MAAM,IAAI,QAAQ,CACd,UAAU,EACV,gFAAgF,EAChF,CAAC,qBAAqB,CAAC,CAC1B,CAAA;IACL,CAAC;IACD,OAAO;QACH,QAAQ,EAAE,OAAO,CAAC,aAAa;QAC/B,SAAS,EAAE,OAAO,CAAC,EAAE;QACrB,YAAY,EAAE,OAAO,CAAC,KAAK;QAC3B,SAAS,EAAE,OAAO,CAAC,SAAS;QAC5B,WAAW,EAAE,OAAO,CAAC,WAAW;QAChC,QAAQ,EAAE,OAAO,CAAC,YAAY;KACjC,CAAA;AACL,CAAC;AAED,4EAA4E;AAC5E,SAAS,mBAAmB;IACxB,MAAM,QAAQ,GAAG,qBAAqB,EAAE,CAAA;IACxC,OAAO,qBAAqB,CAAC,qBAAqB,CAAC,QAAQ,CAAC,EAAE,QAAQ,CAAC,CAAA;AAC3E,CAAC;AAED;;;;;GAKG;AACH,SAAS,0BAA0B,CAAC,SAAkC;IAClE,MAAM,QAAQ,GAAG,uBAAuB,CAAC,SAAS,EAAE,UAAU,CAAC,IAAI,qBAAqB,EAAE,CAAA;IAC1F,MAAM,WAAW,GACb,uBAAuB,CAAC,SAAS,EAAE,aAAa,CAAC,IAAI,qBAAqB,CAAC,QAAQ,CAAC,CAAA;IACxF,OAAO,qBAAqB,CAAC,WAAW,EAAE,QAAQ,CAAC,CAAA;AACvD,CAAC;AAED,SAAS,qBAAqB,CAAC,WAAmB,EAAE,QAAgB;IAChE,OAAO;QACH,WAAW;QACX,gBAAgB,EAAE,GAAG,WAAW,kBAAkB;QAClD,QAAQ,EAAE,GAAG,WAAW,qBAAqB;QAC7C,eAAe,EAAE,GAAG,WAAW,iBAAiB;QAChD,QAAQ;KACX,CAAA;AACL,CAAC;AAED;;;;;GAKG;AACH,KAAK,UAAU,gBAAgB,CAAC,KAAmB;IAC/C,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAA;IACpC,MAAM,EAAE,YAAY,EAAE,GAAG,MAAM,SAAS,EAAE,CAAA;IAC1C,MAAM,MAAM,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,MAAM,CAAC,mBAAmB,CAAC;SAC3B,IAAI,CACD,CAAC,MAAM,EAAE,EAAE,CACP,MAAM,CAAC,WAAW,KAAK,MAAM,CAAC,WAAW;QACzC,MAAM,CAAC,YAAY,KAAK,MAAM,CAAC,QAAQ;QACvC,MAAM,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC/C,CAAA;IACL,OAAO,MAAM,CAAC,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,CAAC,QAAQ,EAAE,CAAC,CAAC,CAAC,SAAS,CAAA;AAC7D,CAAC;AAED,+EAA+E;AAC/E,KAAK,UAAU,gBAAgB,CAAC,MAA2B,EAAE,KAAmB;IAC5E,MAAM,MAAM,GAAG,mBAAmB,EAAE,CAAA;IACpC,MAAM,KAAK,GAAsB;QAC7B,QAAQ,EAAE,MAAM,CAAC,QAAQ;QACzB,WAAW,EAAE,MAAM,CAAC,WAAW;QAC/B,YAAY,EAAE,MAAM,CAAC,QAAQ;QAC7B,WAAW,EAAE,KAAK,CAAC,WAAW;KACjC,CAAA;IACD,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,QAAQ,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3E,MAAM,CAAC,mBAAmB,CAAC;SAC3B,MAAM,CACH,CAAC,KAAK,EAAE,EAAE,CACN,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW;QACvC,KAAK,CAAC,YAAY,KAAK,KAAK,CAAC,YAAY;QACzC,KAAK,CAAC,WAAW,KAAK,KAAK,CAAC,WAAW,CAC9C,CAAA;IACL,MAAM,YAAY,CAAC;QACf,YAAY,EAAE,CAAC,GAAG,QAAQ,EAAE,KAAK,CAAC,CAAC,KAAK,CAAC,CAAC,wBAAwB,CAAC;KACtE,CAAC,CAAA;AACN,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAc;IACvC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAA;IAC7E,MAAM,MAAM,GAAG,KAAgC,CAAA;IAC/C,OAAO,CACH,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;QACnC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ;QACtC,OAAO,MAAM,CAAC,YAAY,KAAK,QAAQ;QACvC,OAAO,MAAM,CAAC,WAAW,KAAK,QAAQ,CACzC,CAAA;AACL,CAAC;AAED,SAAS,qBAAqB;IAC1B,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,CAAA;IAC3C,IAAI,CAAC,QAAQ;QAAE,OAAO,4BAA4B,CAAA;IAElD,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAA;IAC3B,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,sCAAsC,QAAQ,EAAE,EAAE;YAChF,0CAA0C;YAC1C,oDAAoD;SACvD,CAAC,CAAA;IACN,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,iDAAiD,EAAE;YACjF,sGAAsG;SACzG,CAAC,CAAA;IACN,CAAC;IACD,MAAM,MAAM,GAAG,GAAG,CAAC,MAAM,CAAA;IACzB,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACvC,IACI,IAAI,KAAK,mBAAmB;QAC5B,IAAI,KAAK,2BAA2B;QACpC,IAAI,KAAK,yBAAyB,EACpC,CAAC;QACC,OAAO,MAAM,CAAA;IACjB,CAAC;IACD,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,qCAAqC,MAAM,EAAE,EAAE;QAC7E,4CAA4C;QAC5C,8FAA8F;KACjG,CAAC,CAAA;AACN,CAAC;AAED,SAAS,qBAAqB,CAAC,QAAgB;IAC3C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAA;IACzC,IAAI,QAAQ;QAAE,OAAO,4BAA4B,CAAC,QAAQ,CAAC,CAAA;IAE3D,MAAM,IAAI,GAAG,IAAI,GAAG,CAAC,QAAQ,CAAC,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACrD,IAAI,IAAI,KAAK,2BAA2B;QAAE,OAAO,6BAA6B,CAAA;IAC9E,IAAI,IAAI,KAAK,yBAAyB;QAAE,OAAO,2BAA2B,CAAA;IAC1E,OAAO,6BAA6B,CAAA;AACxC,CAAC;AAED,SAAS,4BAA4B,CAAC,GAAW;IAC7C,IAAI,GAAQ,CAAA;IACZ,IAAI,CAAC;QACD,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAA;IACtB,CAAC;IAAC,MAAM,CAAC;QACL,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,oCAAoC,GAAG,EAAE,EAAE;YACzE,oCAAoC;SACvC,CAAC,CAAA;IACN,CAAC;IACD,IAAI,GAAG,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC5B,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,8BAA8B,EAAE;YAC9D,oCAAoC;SACvC,CAAC,CAAA;IACN,CAAC;IACD,MAAM,IAAI,GAAG,GAAG,CAAC,QAAQ,CAAC,WAAW,EAAE,CAAA;IACvC,IAAI,IAAI,KAAK,aAAa,IAAI,CAAC,IAAI,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;QAC3D,MAAM,IAAI,QAAQ,CAAC,aAAa,EAAE,4CAA4C,EAAE;YAC5E,mEAAmE;SACtE,CAAC,CAAA;IACN,CAAC;IACD,OAAO,GAAG,CAAC,MAAM,CAAA;AACrB,CAAC;AAED,SAAS,sBAAsB,CAC3B,SAAkC,EAClC,GAAW,EACX,IAAI,GAAG,4BAA4B;IAEnC,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAClD,MAAM,IAAI,QAAQ,CAAC,IAAI,EAAE,qCAAqC,GAAG,GAAG,EAAE;YAClE,2BAA2B;SAC9B,CAAC,CAAA;IACN,CAAC;IACD,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,SAAS,uBAAuB,CAC5B,SAAkC,EAClC,GAAW;IAEX,MAAM,KAAK,GAAG,SAAS,CAAC,GAAG,CAAC,CAAA;IAC5B,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AAC5E,CAAC;AAED,SAAS,wBAAwB,CAAC,SAAkC;IAChE,IAAI,OAAO,SAAS,CAAC,QAAQ,KAAK,SAAS,EAAE,CAAC;QAC1C,MAAM,IAAI,QAAQ,CACd,aAAa,EACb,qDAAqD,EACrD,UAAU,CACb,CAAA;IACL,CAAC;IACD,OAAO,SAAS,CAAC,QAAQ,CAAA;AAC7B,CAAC;AAED,sFAAsF;AACtF,SAAS,qBAAqB,CAAC,SAAkC;IAC7D,MAAM,KAAK,GAAG,SAAS,CAAC,KAAK,CAAA;IAC7B,OAAO,CACH,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAiC,CAAC,UAAU,KAAK,IAAI,CACzD,CAAA;AACL,CAAC;AAED,SAAS,YAAY,CAAC,KAAc,EAAE,IAAY;IAC9C,OAAO,CACH,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACd,MAAM,IAAI,KAAK;QACf,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ;QAC9B,KAAK,CAAC,IAAI,KAAK,IAAI,CACtB,CAAA;AACL,CAAC;AAED;;;;;GAKG;AACH,SAAS,qBAAqB,CAAC,QAAsC;IACjE,MAAM,KAAK,GAAG;QACV,yCAAyC,QAAQ,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE;QAC/E,wCAAwC,wBAAwB,CAAC,QAAQ,CAAC,WAAW,CAAC,EAAE;KAC3F,CAAA;IACD,IAAI,QAAQ,CAAC,KAAK;QAAE,KAAK,CAAC,IAAI,CAAC,iCAAiC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;IACjF,IAAI,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;QACzB,KAAK,CAAC,IAAI,CACN,+GAA+G,CAClH,CAAA;IACL,CAAC;IACD,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,SAAS,wBAAwB,CAAC,WAAmB;IACjD,MAAM,KAAK,GAAG,gBAAgB,CAAC,IAAI,CAAC,WAAW,CAAC,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,CAAA;IACzE,OAAO,SAAS,KAAK,YAAY,WAAW,CAAC,MAAM,EAAE,CAAA;AACzD,CAAC;AAED,SAAS,0BAA0B,CAAC,KAAa;IAC7C,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,YAAY,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;QAC3E,CAAC,CAAC,YAAY;QACd,CAAC,CAAC,WAAW,CAAA;AACrB,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAa;IACvC,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;AAC5C,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa;IACnC,OAAO,KAAK;SACP,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC;SACpB,KAAK,CAAC,KAAK,CAAC;SACZ,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAA;AACxB,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAqB,EAAE,GAAe;IACpE,4EAA4E;IAC5E,wEAAwE;IACxE,2EAA2E;IAC3E,gDAAgD;IAChD,IAAI,oBAAoB,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAA;IAC/C,MAAM,MAAM,GAAG,QAAQ,CAAC,GAAG,CAAC,CAAA;IAC5B,IAAI,MAAM,CAAC,IAAI,KAAK,IAAI;QAAE,OAAO,OAAO,CAAC,EAAE,KAAK,MAAM,CAAC,EAAE,CAAA;IACzD,IAAI,MAAM,CAAC,IAAI,KAAK,MAAM;QAAE,OAAO,OAAO,CAAC,KAAK,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,IAAI,CAAC,WAAW,EAAE,CAAA;IAC5F,OAAO,KAAK,CAAA;AAChB,CAAC;AAED,MAAM,aAAa,GAAG,iBAAiB,CAAA;AAEvC;;;;;;GAMG;AACH,SAAS,kBAAkB,CAAC,GAAgB;IACxC,IAAI,GAAG,KAAK,SAAS,EAAE,CAAC;QACpB,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,CAAA;QAC3C,IAAI,QAAQ;YAAE,OAAO,EAAE,KAAK,EAAE,QAAQ,EAAE,OAAO,EAAE,oBAAoB,EAAE,CAAA;IAC3E,CAAC;IACD,OAAO,IAAI,CAAA;AACf,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACpC,KAAsB,EACtB,GAAe;IAEf,MAAM,OAAO,GAAG,MAAM,KAAK,CAAC,IAAI,EAAE,CAAA;IAClC,uEAAuE;IACvE,wEAAwE;IACxE,6CAA6C;IAC7C,MAAM,KAAK,GAAG,OAAO;SAChB,MAAM,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,OAAO,CAAC,CAAC;SACvD,IAAI,CAAC,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC,CAAA;IAC3D,IAAI,CAAC,KAAK,EAAE,CAAC;QACT,MAAM,IAAI,QAAQ,CAAC,mBAAmB,EAAE,8BAA8B,GAAG,IAAI,EAAE;YAC3E,uBAAuB;SAC1B,CAAC,CAAA;IACN,CAAC;IACD,OAAO,KAAK,CAAC,OAAO,CAAA;AACxB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,qBAAqB;IACjC,MAAM,KAAK,GAAG,uBAAuB,CAAe;QAChD,WAAW,EAAE,oBAAoB;QACjC,WAAW,EAAE,0BAA0B,EAAE;QACzC,eAAe,EAAE,aAAa,EAAE;QAChC,YAAY,EAAE,iBAAiB;KAClC,CAAC,CAAA;IACF,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,KAAK,CAAoB,EAAE;QAC1D,KAAK,CAAC,MAAM,CAAC,GAAgB;YACzB,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAA;QACvD,CAAC;QACD,uEAAuE;QACvE,qEAAqE;QACrE,wEAAwE;QACxE,0CAA0C;QAC1C,KAAK,CAAC,YAAY,CAAC,GAAgB;YAC/B,MAAM,QAAQ,GAAG,kBAAkB,CAAC,GAAG,CAAC,CAAA;YACxC,IAAI,QAAQ,EAAE,CAAC;gBACX,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,WAAW,EAAE,QAAQ,CAAC,KAAK,EAAE,EAAE,CAAA;YACjF,CAAC;YACD,OAAO,KAAK,CAAC,YAAY,CAAC,GAAG,CAAC,CAAA;QAClC,CAAC;QACD,sEAAsE;QACtE,qEAAqE;QACrE,uEAAuE;QACvE,uEAAuE;QACvE,wDAAwD;QACxD,KAAK,CAAC,aAAa,CAAC,GAAgB;YAChC,IAAI,kBAAkB,CAAC,GAAG,CAAC;gBAAE,OAAO,IAAI,CAAA;YACxC,OAAO,KAAK,CAAC,aAAa,CAAC,GAAG,CAAC,CAAA;QACnC,CAAC;QACD,KAAK,CAAC,GAAG,CAAC,OAAqB,EAAE,KAAa;YAC1C,OAAO,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,KAAK,CAAC,CAAA;QACpC,CAAC;QACD,KAAK,CAAC,SAAS,CACX,OAAqB,EACrB,MAAmB,EACnB,OAAsC;YAEtC,OAAO,KAAK,CAAC,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC,CAAA;QACpD,CAAC;QACD,KAAK,CAAC,KAAK,CAAC,GAAgB;YACxB,OAAO,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAA;QAC3B,CAAC;QACD,KAAK,CAAC,IAAI;YACN,OAAO,KAAK,CAAC,IAAI,EAAE,CAAA;QACvB,CAAC;QACD,KAAK,CAAC,UAAU,CAAC,GAAe;YAC5B,OAAO,KAAK,CAAC,UAAU,CAAC,GAAG,CAAC,CAAA;QAChC,CAAC;KACJ,CAAC,CAAA;AACN,CAAC;AAED;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,oBAAoB;IACtC,IAAI,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC;QAAE,OAAO,KAAK,CAAA;IAC5C,MAAM,MAAM,GAAG,MAAM,SAAS,EAAE,CAAA;IAChC,MAAM,MAAM,GAAG,oBAAoB,CAAC,MAAM,CAAC,CAAA;IAC3C,IAAI,MAAM,EAAE,aAAa,IAAI,MAAM,EAAE,oBAAoB;QAAE,OAAO,aAAa,CAAA;IAC/E,OAAO,cAAc,CAAA;AACzB,CAAC"}