@elizaos/ui 2.0.0-alpha.411 → 2.0.0-alpha.414

package/packages/agent/src/auth/credentials.js

@@ -1,120 +1,147 @@
 /**
  * Credential storage and token refresh for subscription providers.
  *
- * Stores OAuth credentials in ~/.eliza/auth/ as JSON files.
+ * Credentials live under `~/.eliza/auth/{providerId}/{accountId}.json`
+ * (see `account-storage.ts` for the on-disk format and atomic-write
+ * details). The `loadCredentials` / `saveCredentials` /
+ * `deleteCredentials` / `hasValidCredentials` / `getAccessToken`
+ * helpers all default to `accountId="default"` so callers that pre-date
+ * multi-account support keep working without changes.
  */
 import { execSync } from "node:child_process";
 import fs from "node:fs";
 import os from "node:os";
 import path from "node:path";
 import { logger } from "@elizaos/core";
+import { deleteAccount, listAccounts, loadAccount, migrateLegacySingleAccount, saveAccount, } from "./account-storage.js";
 import { refreshAnthropicToken } from "./anthropic.js";
 import { refreshCodexToken } from "./openai-codex.js";
+import { accountRefreshMutex } from "./refresh-mutex.js";
 import { SUBSCRIPTION_PROVIDER_MAP, } from "./types.js";
-const AUTH_DIR = path.join(process.env.ELIZA_HOME || path.join(os.homedir(), ".eliza"), "auth");
+const DEFAULT_ACCOUNT_ID = "default";
 /** Buffer before expiry to trigger refresh (5 minutes) */
 const REFRESH_BUFFER_MS = 5 * 60 * 1000;
 const invalidClaudeCodeRefreshTokens = new Set();
-function ensureAuthDir() {
-    if (!fs.existsSync(AUTH_DIR)) {
-        fs.mkdirSync(AUTH_DIR, { recursive: true, mode: 0o700 });
-    }
-}
-function credentialPath(provider) {
-    return path.join(AUTH_DIR, `${provider}.json`);
+// Run the legacy → per-account migration eagerly at module load. This
+// is cheap when there's nothing to migrate (one `existsSync` per
+// provider) and ensures every code path sees the per-account layout.
+migrateLegacySingleAccount();
+function recordToStored(record) {
+    return {
+        provider: record.providerId,
+        credentials: record.credentials,
+        createdAt: record.createdAt,
+        updatedAt: record.updatedAt,
+    };
 }
 /**
- * Save credentials for a provider.
+ * Save credentials for a provider account.
+ *
+ * The `accountId` defaults to `"default"`. New accounts are persisted
+ * with `source: "oauth"` and `label: "Default"` (or the existing
+ * record's label when overwriting).
  */
-export function saveCredentials(provider, credentials) {
-    ensureAuthDir();
-    const stored = {
-        provider,
+export function saveCredentials(provider, credentials, accountId = DEFAULT_ACCOUNT_ID) {
+    const existing = loadAccount(provider, accountId);
+    const now = Date.now();
+    const record = {
+        id: accountId,
+        providerId: provider,
+        label: existing?.label ??
+            (accountId === DEFAULT_ACCOUNT_ID ? "Default" : accountId),
+        source: existing?.source ?? "oauth",
         credentials,
-        createdAt: Date.now(),
-        updatedAt: Date.now(),
+        createdAt: existing?.createdAt ?? now,
+        updatedAt: now,
+        ...(existing?.lastUsedAt !== undefined
+            ? { lastUsedAt: existing.lastUsedAt }
+            : {}),
+        ...(existing?.organizationId !== undefined
+            ? { organizationId: existing.organizationId }
+            : {}),
+        ...(existing?.userId !== undefined ? { userId: existing.userId } : {}),
+        ...(existing?.email !== undefined ? { email: existing.email } : {}),
     };
-    fs.writeFileSync(credentialPath(provider), JSON.stringify(stored, null, 2), {
-        encoding: "utf-8",
-        mode: 0o600,
-    });
-    logger.info(`[auth] Saved ${provider} credentials`);
+    saveAccount(record);
 }
 /**
- * Load stored credentials for a provider.
+ * Load stored credentials for a provider account.
+ * Returns `null` when no account is configured for the given id.
  */
-export function loadCredentials(provider) {
-    const filePath = credentialPath(provider);
-    try {
-        const data = fs.readFileSync(filePath, "utf-8");
-        return JSON.parse(data);
-    }
-    catch (err) {
-        if (err.code === "ENOENT") {
-            return null;
-        }
-        throw err;
-    }
+export function loadCredentials(provider, accountId = DEFAULT_ACCOUNT_ID) {
+    const record = loadAccount(provider, accountId);
+    if (!record)
+        return null;
+    return recordToStored(record);
 }
 /**
- * Delete stored credentials for a provider.
+ * Delete stored credentials for a provider account.
  */
-export function deleteCredentials(provider) {
-    const filePath = credentialPath(provider);
-    try {
-        fs.unlinkSync(filePath);
-        logger.info(`[auth] Deleted ${provider} credentials`);
-    }
-    catch (err) {
-        if (err.code !== "ENOENT") {
-            throw err;
-        }
-    }
+export function deleteCredentials(provider, accountId = DEFAULT_ACCOUNT_ID) {
+    deleteAccount(provider, accountId);
 }
 /**
  * Check if credentials exist and are not expired.
  */
-export function hasValidCredentials(provider) {
-    const stored = loadCredentials(provider);
+export function hasValidCredentials(provider, accountId = DEFAULT_ACCOUNT_ID) {
+    const stored = loadCredentials(provider, accountId);
     if (!stored)
         return false;
     return stored.credentials.expires > Date.now();
 }
+/**
+ * List all accounts configured for a provider.
+ */
+export function listProviderAccounts(provider) {
+    return listAccounts(provider);
+}
 /**
  * Get a valid access token, refreshing if needed.
- * Returns null if no credentials stored or refresh fails.
+ *
+ * Refreshes are serialized per `{provider}:{accountId}` via
+ * `accountRefreshMutex` so concurrent callers don't race on the
+ * refresh-token grant or the credential file write.
+ *
+ * Returns `null` when no credentials are stored or the refresh fails.
  */
-export async function getAccessToken(provider) {
-    const stored = loadCredentials(provider);
-    if (!stored)
+export async function getAccessToken(provider, accountId = DEFAULT_ACCOUNT_ID) {
+    const initial = loadCredentials(provider, accountId);
+    if (!initial)
         return null;
-    const { credentials } = stored;
-    // Token still valid
-    if (credentials.expires > Date.now() + REFRESH_BUFFER_MS) {
-        return credentials.access;
+    if (initial.credentials.expires > Date.now() + REFRESH_BUFFER_MS) {
+        return initial.credentials.access;
     }
-    // Need to refresh
-    logger.info(`[auth] Refreshing ${provider} token...`);
-    try {
-        let refreshed;
-        if (provider === "anthropic-subscription") {
-            refreshed = await refreshAnthropicToken(credentials.refresh);
+    return accountRefreshMutex.acquire(`${provider}:${accountId}`, async () => {
+        // Re-read after acquiring the lock — a concurrent caller may have
+        // already refreshed the token, in which case we want the new one.
+        const stored = loadCredentials(provider, accountId);
+        if (!stored)
+            return null;
+        const { credentials } = stored;
+        if (credentials.expires > Date.now() + REFRESH_BUFFER_MS) {
+            return credentials.access;
         }
-        else if (provider === "openai-codex") {
-            refreshed = await refreshCodexToken(credentials.refresh);
+        logger.info(`[auth] Refreshing ${provider} token for account "${accountId}"...`);
+        let refreshed;
+        try {
+            if (provider === "anthropic-subscription") {
+                refreshed = await refreshAnthropicToken(credentials.refresh);
+            }
+            else if (provider === "openai-codex") {
+                refreshed = await refreshCodexToken(credentials.refresh);
+            }
+            else {
+                logger.error(`[auth] Unknown provider: ${provider}`);
+                return null;
+            }
         }
-        else {
-            logger.error(`[auth] Unknown provider: ${provider}`);
+        catch (err) {
+            logger.error(`[auth] Failed to refresh ${provider} token for "${accountId}": ${err}`);
             return null;
         }
-        // Save refreshed credentials
-        saveCredentials(provider, refreshed);
+        saveCredentials(provider, refreshed, accountId);
         return refreshed.access;
-    }
-    catch (err) {
-        logger.error(`[auth] Failed to refresh ${provider} token: ${err}`);
-        return null;
-    }
+    });
 }
 function readConfiguredAnthropicSetupToken() {
     const namespace = process.env.ELIZA_NAMESPACE?.trim() || "milady";
@@ -147,20 +174,28 @@ export function getSubscriptionStatus() {
         "anthropic-subscription",
         "openai-codex",
     ];
-    return providers.map((provider) => {
-        const stored = loadCredentials(provider);
-        // Read the Claude Code OAuth blob exactly once per provider row.
-        // On macOS this helper shells out to `security` to query the
-        // keychain — calling it twice per poll used to double the cost
-        // of every `GET /api/subscription/status` request.
+    const rows = [];
+    for (const provider of providers) {
+        const accounts = listProviderAccounts(provider);
+        for (const account of accounts) {
+            rows.push({
+                provider,
+                accountId: account.id,
+                label: account.label,
+                configured: true,
+                valid: account.credentials.expires > Date.now(),
+                expiresAt: account.credentials.expires,
+                source: "app",
+            });
+        }
+        // Read the Claude Code OAuth blob exactly once per provider —
+        // `readClaudeCodeOAuthBlob()` shells out to `security` on macOS
+        // and calling it twice doubled the cost of every status poll.
         const claudeBlob = provider === "anthropic-subscription" ? readClaudeCodeOAuthBlob() : null;
-        let importedClaudeAuth = null;
-        let claudeSource = null;
         if (provider === "anthropic-subscription") {
+            let importedClaudeAuth = null;
+            let claudeSource = null;
             if (claudeBlob?.accessToken) {
-                // Blob exists with a parsed accessToken — the user has Claude
-                // Code installed and authenticated. Expiry is validated
-                // below via the `valid` field.
                 importedClaudeAuth = claudeBlob.accessToken;
                 claudeSource = "claude-code-cli";
             }
@@ -169,44 +204,37 @@ export function getSubscriptionStatus() {
                 if (importedClaudeAuth)
                     claudeSource = "setup-token";
             }
+            if (importedClaudeAuth) {
+                const blobExpiresAt = claudeBlob?.expiresAt ?? null;
+                const blobValid = claudeBlob
+                    ? blobExpiresAt === null || blobExpiresAt > Date.now()
+                    : true;
+                const accountId = claudeSource === "claude-code-cli" ? "claude-code-cli" : "setup-token";
+                const label = claudeSource === "claude-code-cli" ? "Claude Code CLI" : "Setup Token";
+                rows.push({
+                    provider,
+                    accountId,
+                    label,
+                    configured: true,
+                    valid: blobValid,
+                    expiresAt: blobExpiresAt,
+                    source: claudeSource,
+                });
+            }
         }
-        const importedCodexAuth = provider === "openai-codex" && hasCodexCliSubscriptionAuth();
-        // For the Claude blob path, derive expiry from the blob itself
-        // so the UI can surface an accurate "valid" state even before a
-        // refresh runs. Older Claude Code credential files omit
-        // `expiresAt` entirely — treat a null expiry on an otherwise
-        // parseable blob as "valid" (the presence of an accessToken is
-        // itself evidence the user is authenticated; the runtime will
-        // refresh via the refresh token on first use if needed).
-        const blobExpiresAt = claudeBlob?.expiresAt ?? null;
-        const blobValid = claudeBlob
-            ? blobExpiresAt === null || blobExpiresAt > Date.now()
-            : false;
-        // App-owned credentials take priority over system/CLI sources —
-        // they represent an explicit in-app OAuth, and they're the only
-        // source the DELETE /api/subscription/{provider} route can clear.
-        let source = null;
-        if (stored !== null) {
-            source = "app";
-        }
-        else if (provider === "anthropic-subscription" && claudeSource) {
-            source = claudeSource;
-        }
-        else if (importedCodexAuth) {
-            source = "codex-cli";
+        if (provider === "openai-codex" && hasCodexCliSubscriptionAuth()) {
+            rows.push({
+                provider,
+                accountId: "codex-cli",
+                label: "Codex CLI",
+                configured: true,
+                valid: true,
+                expiresAt: null,
+                source: "codex-cli",
+            });
         }
-        return {
-            provider,
-            configured: stored !== null || Boolean(importedClaudeAuth || importedCodexAuth),
-            valid: stored
-                ? stored.credentials.expires > Date.now()
-                : provider === "anthropic-subscription" && importedClaudeAuth
-                    ? blobValid
-                    : Boolean(importedCodexAuth),
-            expiresAt: stored?.credentials.expires ?? blobExpiresAt,
-            source,
-        };
-    });
+    }
+    return rows;
 }
 function isClaudeCodeInvalidGrantError(err) {
     const message = err instanceof Error ? err.message : String(err);
@@ -300,9 +328,6 @@ async function importClaudeCodeOAuthToken() {
     if (invalidClaudeCodeRefreshTokens.has(refreshTokenCacheKey)) {
         return null;
     }
-    // Try to refresh. Claude Code's persisted access token is often stale even
-    // when the user is actively using Claude Code, because Claude Code keeps the
-    // live token in memory and only persists the original OAuth grant.
     try {
         const refreshed = await refreshAnthropicToken(blob.refreshToken);
         logger.info(`[auth] Refreshed Claude Code OAuth token from ${blob.source}`);
@@ -332,10 +357,9 @@ async function importClaudeCodeOAuthToken() {
  * Codex / ChatGPT subscription tokens *are* applied to the environment
  * because OpenAI permits direct API usage with those tokens.
  *
- * When a `config` is provided and the active subscription provider has
- * credentials, `model.primary` is auto-set so the user doesn't need to
- * configure it manually — but only for providers whose tokens are applied
- * to the runtime (currently Codex only).
+ * For multi-account installs the FIRST configured Codex account is the one
+ * applied to `process.env.OPENAI_API_KEY`. Real account selection lands in
+ * WS2 (AccountPool).
  */
 export async function applySubscriptionCredentials(config) {
     const subscriptionCredentialsDisabled = process.env.ELIZA_DISABLE_SUBSCRIPTION_CREDENTIALS?.trim().toLowerCase();
@@ -355,19 +379,33 @@ export async function applySubscriptionCredentials(config) {
     // (which ARE Claude Code). If the user has only a subscription and no
     // API key, the runtime simply won't have an Anthropic provider — they
     // need an API key or Eliza Cloud for the main agent.
-    let anthropicToken = await getAccessToken("anthropic-subscription");
-    if (!anthropicToken) {
-        anthropicToken = await importClaudeCodeOAuthToken();
-    }
-    if (anthropicToken) {
-        logger.info("[auth] Anthropic subscription detected — available for coding agents (Claude Code CLI). " +
+    const anthropicAccounts = listProviderAccounts("anthropic-subscription");
+    if (anthropicAccounts.length > 0) {
+        const labels = anthropicAccounts
+            .map((a) => `"${a.label}" (${a.id})`)
+            .join(", ");
+        logger.info(`[auth] Anthropic subscription accounts configured: ${labels} — available for coding agents (Claude Code CLI). ` +
             "Not applied to runtime env. Add an API key or connect Eliza Cloud for the main agent.");
     }
+    else {
+        const claudeImported = await importClaudeCodeOAuthToken();
+        if (claudeImported) {
+            logger.info("[auth] Anthropic subscription detected via Claude Code CLI — available for coding agents. " +
+                "Not applied to runtime env. Add an API key or connect Eliza Cloud for the main agent.");
+        }
+    }
     // ── OpenAI Codex subscription → set OPENAI_API_KEY ────────────────────
-    const codexToken = await getAccessToken("openai-codex");
-    if (codexToken) {
-        process.env.OPENAI_API_KEY = codexToken;
-        logger.info("[auth] Applied OpenAI Codex subscription credentials to environment");
+    //
+    // For now, the FIRST configured Codex account wins. WS2's AccountPool
+    // will replace this with priority/health-aware selection.
+    const codexAccounts = listProviderAccounts("openai-codex");
+    if (codexAccounts.length > 0) {
+        const primary = codexAccounts[0];
+        const codexToken = await getAccessToken("openai-codex", primary.id);
+        if (codexToken) {
+            process.env.OPENAI_API_KEY = codexToken;
+            logger.info(`[auth] Applied OpenAI Codex subscription credentials to environment from account "${primary.label}" (${primary.id})`);
+        }
     }
     // Auto-set model.primary from subscription provider (Codex only —
     // anthropic subscription tokens don't power the runtime directly).

package/packages/agent/src/auth/index.d.ts

@@ -1,6 +1,8 @@
+export * from "./account-storage.js";
 export * from "./anthropic.js";
 export * from "./claude-code-stealth.js";
 export * from "./credentials.js";
+export * from "./oauth-flow.js";
 export * from "./openai-codex.js";
 export * from "./types.js";
 //# sourceMappingURL=index.d.ts.map

package/packages/agent/src/auth/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/auth/index.ts"],"names":[],"mappings":"AAAA,cAAc,sBAAsB,CAAC;AACrC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,0BAA0B,CAAC;AACzC,cAAc,kBAAkB,CAAC;AACjC,cAAc,iBAAiB,CAAC;AAChC,cAAc,mBAAmB,CAAC;AAClC,cAAc,YAAY,CAAC"}

package/packages/agent/src/auth/index.js

@@ -1,5 +1,7 @@
+export * from "./account-storage.js";
 export * from "./anthropic.js";
 export * from "./claude-code-stealth.js";
 export * from "./credentials.js";
+export * from "./oauth-flow.js";
 export * from "./openai-codex.js";
 export * from "./types.js";

package/packages/agent/src/auth/oauth-flow.d.ts

@@ -0,0 +1,106 @@
+/**
+ * OAuth flow orchestration registry.
+ *
+ * Wraps the provider-specific programmatic OAuth helpers
+ * (`startAnthropicOAuthFlowRaw` from
+ * `vendor/pi-oauth/anthropic-login.ts` and the loopback-listener flow
+ * in `openai-codex.ts`) with:
+ *
+ *   - a 5-minute timeout per flow,
+ *   - automatic `saveAccount(...)` after token exchange,
+ *   - an in-memory registry keyed by `sessionId` so the HTTP API can
+ *     stream progress over SSE and the CLI can `await` completion,
+ *   - garbage collection 10 minutes after a flow reaches a terminal
+ *     state.
+ *
+ * Both the CLI and the new accounts-routes HTTP endpoints drive flows
+ * through this module — there is no direct caller of the vendor-level
+ * OAuth helpers anymore.
+ */
+import { type AccountCredentialRecord } from "./account-storage.js";
+import type { SubscriptionProvider } from "./types.js";
+/** Server-tracked status of an in-flight OAuth flow. */
+export type FlowStatus = "pending" | "success" | "error" | "cancelled" | "timeout";
+export interface FlowState {
+    sessionId: string;
+    providerId: SubscriptionProvider;
+    status: FlowStatus;
+    /** Set on `pending` (so the UI can re-open the browser) and on `success`. */
+    authUrl?: string;
+    /** Anthropic only — the user must paste `code#state`; Codex uses the loopback callback. */
+    needsCodeSubmission: boolean;
+    account?: AccountCredentialRecord;
+    error?: string;
+    startedAt: number;
+    endedAt?: number;
+}
+export interface OAuthFlowHandle {
+    sessionId: string;
+    authUrl: string;
+    /** Codex flows resolve via the loopback listener; Anthropic requires `submitCode`. */
+    needsCodeSubmission: boolean;
+    /** Resolves with the saved AccountCredentialRecord; rejects on cancel/timeout/error. */
+    completion: Promise<{
+        account: AccountCredentialRecord;
+    }>;
+    /** Anthropic only — submit `code#state` from the redirect page. No-op for Codex. */
+    submitCode: (code: string) => void;
+    cancel: (reason?: string) => void;
+}
+interface StartOptions {
+    label: string;
+    accountId?: string;
+    /**
+     * Called after the account is saved on disk. Used by the HTTP
+     * route layer to also write a `LinkedAccountConfig` row into
+     * `milady.json`. Failures here propagate as flow `error`.
+     */
+    onAccountSaved?: (account: AccountCredentialRecord) => void | Promise<void>;
+}
+/**
+ * Start a programmatic Anthropic OAuth flow. Anthropic's redirect URI
+ * is hardcoded to `console.anthropic.com/oauth/code/callback` — the
+ * UI must surface the auth URL, prompt the user to copy the
+ * `code#state` blob, and call `submitCode()` with it. Once the code is
+ * submitted, the token exchange runs and the account is persisted.
+ */
+export declare function startAnthropicOAuthFlow(opts: StartOptions): Promise<OAuthFlowHandle>;
+/**
+ * Start a programmatic Codex OAuth flow. Codex has a loopback listener
+ * on :1455, so the user just signs in in the browser and the listener
+ * picks up the redirect — `submitCode()` is a no-op. The accountId
+ * baked into the JWT is preserved on `LinkedAccountConfig.organizationId`
+ * (used by the Codex usage probe via the `ChatGPT-Account-Id` header).
+ */
+export declare function startCodexOAuthFlow(opts: StartOptions): Promise<OAuthFlowHandle>;
+export declare function getFlowState(sessionId: string): FlowState | null;
+export declare function getFlowHandle(sessionId: string): OAuthFlowHandle | null;
+/**
+ * Subscribe to status updates for a flow. Replays the current state
+ * synchronously so SSE consumers always receive an immediate frame.
+ * Returns an unsubscribe function.
+ */
+export declare function subscribeFlow(sessionId: string, listener: (state: FlowState) => void): () => void;
+export declare function cancelFlow(sessionId: string, reason?: string): boolean;
+export declare function submitFlowCode(sessionId: string, code: string): boolean;
+/**
+ * Remove every flow from the registry. Tests use this to reset
+ * between cases without resetting the whole module.
+ */
+export declare function _resetFlowRegistry(): void;
+/**
+ * Test-only helper to seed a synthetic flow without going through the
+ * vendor layer. Used by `accounts-routes.test.ts` to assert the SSE
+ * surface streams `success` / `error` payloads correctly.
+ */
+export declare function _registerSyntheticFlow(args: {
+    sessionId?: string;
+    providerId: SubscriptionProvider;
+    authUrl: string;
+    needsCodeSubmission?: boolean;
+}): {
+    sessionId: string;
+    complete: (state: FlowState) => void;
+};
+export {};
+//# sourceMappingURL=oauth-flow.d.ts.map

package/packages/agent/src/auth/oauth-flow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"oauth-flow.d.ts","sourceRoot":"","sources":["../../../../../../agent/src/auth/oauth-flow.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAIH,OAAO,EACL,KAAK,uBAAuB,EAE7B,MAAM,sBAAsB,CAAC;AAG9B,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAMvD,wDAAwD;AACxD,MAAM,MAAM,UAAU,GAClB,SAAS,GACT,SAAS,GACT,OAAO,GACP,WAAW,GACX,SAAS,CAAC;AAEd,MAAM,WAAW,SAAS;IACxB,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,oBAAoB,CAAC;IACjC,MAAM,EAAE,UAAU,CAAC;IACnB,6EAA6E;IAC7E,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,2FAA2F;IAC3F,mBAAmB,EAAE,OAAO,CAAC;IAC7B,OAAO,CAAC,EAAE,uBAAuB,CAAC;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,eAAe;IAC9B,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;IAChB,sFAAsF;IACtF,mBAAmB,EAAE,OAAO,CAAC;IAC7B,wFAAwF;IACxF,UAAU,EAAE,OAAO,CAAC;QAAE,OAAO,EAAE,uBAAuB,CAAA;KAAE,CAAC,CAAC;IAC1D,oFAAoF;IACpF,UAAU,EAAE,CAAC,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;IACnC,MAAM,EAAE,CAAC,MAAM,CAAC,EAAE,MAAM,KAAK,IAAI,CAAC;CACnC;AAuED,UAAU,YAAY;IACpB,KAAK,EAAE,MAAM,CAAC;IACd,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;OAIG;IACH,cAAc,CAAC,EAAE,CAAC,OAAO,EAAE,uBAAuB,KAAK,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC7E;AAID;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CACrC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,eAAe,CAAC,CAqB1B;AAID;;;;;;GAMG;AACH,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,YAAY,GACjB,OAAO,CAAC,eAAe,CAAC,CAmB1B;AA2ID,wBAAgB,YAAY,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,CAGhE;AAED,wBAAgB,aAAa,CAAC,SAAS,EAAE,MAAM,GAAG,eAAe,GAAG,IAAI,CAGvE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAC3B,SAAS,EAAE,MAAM,EACjB,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,GACnC,MAAM,IAAI,CASZ;AAED,wBAAgB,UAAU,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,MAAM,GAAG,OAAO,CAMtE;AAED,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,OAAO,CAOvE;AAED;;;GAGG;AACH,wBAAgB,kBAAkB,IAAI,IAAI,CAKzC;AAED;;;;GAIG;AACH,wBAAgB,sBAAsB,CAAC,IAAI,EAAE;IAC3C,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,EAAE,oBAAoB,CAAC;IACjC,OAAO,EAAE,MAAM,CAAC;IAChB,mBAAmB,CAAC,EAAE,OAAO,CAAC;CAC/B,GAAG;IAAE,SAAS,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,SAAS,KAAK,IAAI,CAAA;CAAE,CA+B9D"}