@mnemonik/credentials 0.1.0

package/LICENSE

@@ -0,0 +1,38 @@
+MNEMONIK PROPRIETARY SOFTWARE LICENSE
+
+Copyright © 2026 JayDeeCo Limited. All rights reserved.
+
+This licence applies to the Mnemonik software distributed with this file
+(the "Software").
+
+Subject to the Mnemonik Terms of Service and while you are an authorised
+Mnemonik account holder, JayDeeCo Limited grants you a limited, revocable,
+non-exclusive, non-transferable, non-sublicensable licence to download,
+install, and run unmodified copies of the Software solely to access and use
+the Mnemonik service. This permission applies to authorised free, trial, and
+paid accounts.
+
+You may not:
+
+1. modify the Software or create derivative works from it;
+2. reverse engineer, decompile, or disassemble the Software, except to the
+   extent that applicable law does not permit this restriction;
+3. redistribute, publish, sell, rent, lease, sublicense, or resell the
+   Software or access to it;
+4. use the Software to build or operate a product or service that competes
+   with Mnemonik;
+5. remove or alter any copyright, trade mark, attribution, or proprietary
+   notice; or
+6. bypass authentication, service limits, or technical restrictions.
+
+JayDeeCo Limited and its licensors retain all right, title, and interest in
+the Software. No rights are granted except those expressly stated here.
+
+This licence ends automatically when your right to use Mnemonik ends or if
+you breach this licence or the Mnemonik Terms of Service. When it ends, you
+must stop using the Software and delete copies in your possession or control.
+
+Third-party components remain subject to their own licences. The warranty
+disclaimers, limitations of liability, termination terms, and governing law
+in the Mnemonik Terms of Service at https://mnemonik.ai/terms apply to this
+licence and the Software.

package/dist/contracts.d.ts

@@ -0,0 +1,104 @@
+export type OsStoreKind = 'keychain' | 'credential-manager' | 'secret-service';
+export type CredentialStoreKind = 'os' | 'file' | OsStoreKind;
+export declare class CredentialSessionUnavailableError extends Error {
+    readonly store: OsStoreKind | 'os';
+    readonly reason = "credential_session_unavailable";
+    constructor(store: OsStoreKind | 'os');
+}
+/** Public CLI entrypoints can bundle separate copies of this class. */
+export declare function isCredentialSessionUnavailableError(error: unknown): error is CredentialSessionUnavailableError;
+export type ComponentKind = 'hook' | 'scanner';
+export interface CliOAuthMetadata {
+    issuer: string;
+    clientId: string;
+    scopes: string[];
+    familyId: string;
+    lastRotationTime: string;
+}
+export interface CliOAuthTokens {
+    accessToken: string;
+    refreshToken: string;
+    accessExpiresAt: string;
+}
+export interface ComponentCredentialResponse {
+    id: string;
+    access_token: string;
+    refresh_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    refresh_expires_in: number;
+    scope: string;
+    display_prefix: string;
+}
+export interface FamilyCredential {
+    store: CredentialStoreKind;
+    familyId: string;
+    componentKind: ComponentKind;
+    scopes: string[];
+    accessToken: string;
+    refreshToken: string;
+    accessExpiresAt: string;
+    refreshExpiresAt: string;
+    lastRotationTime: string;
+}
+export interface CliOAuthCredential extends CliOAuthMetadata, CliOAuthTokens {
+    store: CredentialStoreKind;
+}
+export interface CliTokenResponse {
+    access_token: string;
+    refresh_token: string;
+    token_type: 'Bearer';
+    expires_in: number;
+    scope: string;
+}
+export type ErrorBody = {
+    error: string;
+};
+export type TransportResponse<T> = {
+    status: 200;
+    body: T;
+    retryAfterMs?: number;
+} | {
+    status: number;
+    body: ErrorBody;
+    retryAfterMs?: number;
+};
+export interface CredentialTransport {
+    rotateFamily(familyId: string, refreshToken: string): Promise<TransportResponse<ComponentCredentialResponse>>;
+    revokeFamily(familyId: string, refreshToken: string): Promise<TransportResponse<object>>;
+}
+export interface CliCredentialTransport {
+    rotateCli(credential: CliOAuthCredential): Promise<TransportResponse<CliTokenResponse>>;
+}
+export type ActionRequired = {
+    status: 'ACTION_REQUIRED';
+    reason: string;
+    familyId: string;
+};
+export type RetryLater = {
+    status: 'RETRY_LATER';
+    reason: 'rate_limited' | 'server_error';
+    familyId: string;
+};
+export type RotationResult = FamilyCredential | ActionRequired | RetryLater;
+export type WorkResponse<T> = {
+    status: number;
+    body: T;
+};
+export interface SecretStore {
+    readonly kind?: OsStoreKind;
+    isAvailable(): Promise<boolean>;
+    get(reference: string): Promise<string | null | undefined>;
+    set(reference: string, secret: string): Promise<void>;
+    delete(reference: string): Promise<void>;
+}
+export declare class SimulatedSecretStore implements SecretStore {
+    private readonly available;
+    readonly values: Map<string, string>;
+    constructor(available?: boolean);
+    isAvailable(): Promise<boolean>;
+    get(reference: string): Promise<string | null>;
+    set(reference: string, secret: string): Promise<void>;
+    delete(reference: string): Promise<void>;
+}
+//# sourceMappingURL=contracts.d.ts.map

package/dist/contracts.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.d.ts","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,WAAW,GAAG,UAAU,GAAG,oBAAoB,GAAG,gBAAgB,CAAC;AAC/E,MAAM,MAAM,mBAAmB,GAAG,IAAI,GAAG,MAAM,GAAG,WAAW,CAAC;AAC9D,qBAAa,iCAAkC,SAAQ,KAAK;aAE9B,KAAK,EAAE,WAAW,GAAG,IAAI;IADrD,QAAQ,CAAC,MAAM,oCAAoC;IACnD,YAA4B,KAAK,EAAE,WAAW,GAAG,IAAI,EAKpD;CACF;AACD,uEAAuE;AACvE,wBAAgB,mCAAmC,CACjD,KAAK,EAAE,OAAO,GACb,KAAK,IAAI,iCAAiC,CAa5C;AACD,MAAM,MAAM,aAAa,GAAG,MAAM,GAAG,SAAS,CAAC;AAE/C,MAAM,WAAW,gBAAgB;IAC/B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,cAAc;IAC7B,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;CACzB;AAED,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAC;IACX,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,kBAAkB,EAAE,MAAM,CAAC;IAC3B,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,MAAM,WAAW,gBAAgB;IAC/B,KAAK,EAAE,mBAAmB,CAAC;IAC3B,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,aAAa,CAAC;IAC7B,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,CAAC;IACrB,eAAe,EAAE,MAAM,CAAC;IACxB,gBAAgB,EAAE,MAAM,CAAC;IACzB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,kBAAmB,SAAQ,gBAAgB,EAAE,cAAc;IAC1E,KAAK,EAAE,mBAAmB,CAAC;CAC5B;AAED,MAAM,WAAW,gBAAgB;IAC/B,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,QAAQ,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,EAAE,MAAM,CAAC;CACf;AAED,MAAM,MAAM,SAAS,GAAG;IAAE,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC;AAC1C,MAAM,MAAM,iBAAiB,CAAC,CAAC,IAC3B;IAAE,MAAM,EAAE,GAAG,CAAC;IAAC,IAAI,EAAE,CAAC,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,GAC/C;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE/D,MAAM,WAAW,mBAAmB;IAClC,YAAY,CACV,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,GACnB,OAAO,CAAC,iBAAiB,CAAC,2BAA2B,CAAC,CAAC,CAAC;IAC3D,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,GAAG,OAAO,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,CAAC;CAC1F;AAED,MAAM,WAAW,sBAAsB;IACrC,SAAS,CAAC,UAAU,EAAE,kBAAkB,GAAG,OAAO,CAAC,iBAAiB,CAAC,gBAAgB,CAAC,CAAC,CAAC;CACzF;AAED,MAAM,MAAM,cAAc,GAAG;IAC3B,MAAM,EAAE,iBAAiB,CAAC;IAC1B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AACF,MAAM,MAAM,UAAU,GAAG;IACvB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,cAAc,GAAG,cAAc,CAAC;IACxC,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AACF,MAAM,MAAM,cAAc,GAAG,gBAAgB,GAAG,cAAc,GAAG,UAAU,CAAC;AAE5E,MAAM,MAAM,YAAY,CAAC,CAAC,IAAI;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,CAAC,CAAA;CAAE,CAAC;AAE1D,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,CAAC,EAAE,WAAW,CAAC;IAC5B,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAAC;IAChC,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC,CAAC;IAC3D,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;IACtD,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC;CAC1C;AAED,qBAAa,oBAAqB,YAAW,WAAW;IAG1C,OAAO,CAAC,QAAQ,CAAC,SAAS;IAFtC,QAAQ,CAAC,MAAM,sBAA6B;IAE5C,YAA6B,SAAS,UAAO,EAAI;IAE3C,WAAW,IAAI,OAAO,CAAC,OAAO,CAAC,CAEpC;IAEK,GAAG,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEnD;IAEK,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE1D;IAEK,MAAM,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAE7C;CACF"}

package/dist/contracts.js

@@ -0,0 +1,42 @@
+export class CredentialSessionUnavailableError extends Error {
+    store;
+    reason = 'credential_session_unavailable';
+    constructor(store) {
+        super(`Not signed in in this session. The sign-in is in ${store === 'keychain' ? 'the login keychain' : 'the OS credential store'}; run mnemonik auth login here or use Terminal.`);
+        this.store = store;
+        this.name = 'CredentialSessionUnavailableError';
+    }
+}
+/** Public CLI entrypoints can bundle separate copies of this class. */
+export function isCredentialSessionUnavailableError(error) {
+    return (!!error &&
+        typeof error === 'object' &&
+        'reason' in error &&
+        error.reason === 'credential_session_unavailable' &&
+        'name' in error &&
+        error.name === 'CredentialSessionUnavailableError' &&
+        'store' in error &&
+        ['keychain', 'credential-manager', 'secret-service', 'os'].includes(String(error.store)) &&
+        'message' in error &&
+        typeof error.message === 'string');
+}
+export class SimulatedSecretStore {
+    available;
+    values = new Map();
+    constructor(available = true) {
+        this.available = available;
+    }
+    async isAvailable() {
+        return this.available;
+    }
+    async get(reference) {
+        return this.values.get(reference) ?? null;
+    }
+    async set(reference, secret) {
+        this.values.set(reference, secret);
+    }
+    async delete(reference) {
+        this.values.delete(reference);
+    }
+}
+//# sourceMappingURL=contracts.js.map

package/dist/contracts.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"contracts.js","sourceRoot":"","sources":["../src/contracts.ts"],"names":[],"mappings":"AAEA,MAAM,OAAO,iCAAkC,SAAQ,KAAK;IAE9B,KAAK;IADxB,MAAM,GAAG,gCAAgC,CAAC;IACnD,YAA4B,KAAyB;QACnD,KAAK,CACH,oDAAoD,KAAK,KAAK,UAAU,CAAC,CAAC,CAAC,oBAAoB,CAAC,CAAC,CAAC,yBAAyB,iDAAiD,CAC7K,CAAC;qBAHwB,KAAK;QAI/B,IAAI,CAAC,IAAI,GAAG,mCAAmC,CAAC;IAClD,CAAC;CACF;AACD,uEAAuE;AACvE,MAAM,UAAU,mCAAmC,CACjD,KAAc;IAEd,OAAO,CACL,CAAC,CAAC,KAAK;QACP,OAAO,KAAK,KAAK,QAAQ;QACzB,QAAQ,IAAI,KAAK;QACjB,KAAK,CAAC,MAAM,KAAK,gCAAgC;QACjD,MAAM,IAAI,KAAK;QACf,KAAK,CAAC,IAAI,KAAK,mCAAmC;QAClD,OAAO,IAAI,KAAK;QAChB,CAAC,UAAU,EAAE,oBAAoB,EAAE,gBAAgB,EAAE,IAAI,CAAC,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;QACxF,SAAS,IAAI,KAAK;QAClB,OAAO,KAAK,CAAC,OAAO,KAAK,QAAQ,CAClC,CAAC;AACJ,CAAC;AA2FD,MAAM,OAAO,oBAAoB;IAGF,SAAS;IAF7B,MAAM,GAAG,IAAI,GAAG,EAAkB,CAAC;IAE5C,YAA6B,SAAS,GAAG,IAAI;yBAAhB,SAAS;IAAU,CAAC;IAEjD,KAAK,CAAC,WAAW;QACf,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB;QACzB,OAAO,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,IAAI,CAAC;IAC5C,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,SAAiB,EAAE,MAAc;QACzC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACrC,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,SAAiB;QAC5B,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;IAChC,CAAC;CACF"}

package/dist/index.d.ts

@@ -0,0 +1,87 @@
+import { windowsCurrentUserAcl } from '@mnemonik/local-setup';
+import { type ActionRequired, type CliOAuthCredential, type CliOAuthMetadata, type CliOAuthTokens, type CliCredentialTransport, type ComponentCredentialResponse, type ComponentKind, type CredentialTransport, type FamilyCredential, type RetryLater, type RotationResult, type SecretStore, SimulatedSecretStore, type WorkResponse } from './contracts.js';
+import { CredentialError, credentialPaths, stateDirectory, type SecureFileOptions } from './storage.js';
+export * from './contracts.js';
+import { osSecretStore } from './osSecretStore.js';
+export { osSecretStore };
+export { CredentialError, SimulatedSecretStore, credentialPaths, stateDirectory, windowsCurrentUserAcl, };
+export interface CredentialAdapterOptions extends SecureFileOptions {
+    secretStore?: SecretStore;
+    onDiagnostic?: (code: 'os_store_unavailable') => void;
+    now?: () => number;
+    sleep?: (milliseconds: number) => Promise<void>;
+    retryLimit?: number;
+    lockWaitMs?: number;
+}
+export declare function createCredentialAdapter(options?: CredentialAdapterOptions): {
+    putCliOAuth: (metadata: CliOAuthMetadata, tokens: CliOAuthTokens | string) => Promise<{
+        store: string;
+    }>;
+    readCliOAuth: () => Promise<CliOAuthCredential | null>;
+    rotateCli: (transport: CliCredentialTransport) => Promise<ActionRequired | RetryLater | CliOAuthCredential>;
+    withCliCredential: <T>(transport: CliCredentialTransport, work: (accessToken: string) => Promise<WorkResponse<T>>) => Promise<WorkResponse<T> | ActionRequired | RetryLater>;
+    removeCliOAuth: () => Promise<void>;
+    putFamily: (componentKind: ComponentKind, response: ComponentCredentialResponse) => Promise<FamilyCredential>;
+    readFamily: (familyId: string) => Promise<FamilyCredential | null>;
+    rotateFamily: (familyId: string, transport: CredentialTransport) => Promise<RotationResult>;
+    withCredential: <T>(familyId: string, transport: CredentialTransport, work: (accessToken: string) => Promise<WorkResponse<T>>) => Promise<WorkResponse<T> | ActionRequired | RetryLater>;
+    revokeFamily: (familyId: string, transport: CredentialTransport) => Promise<ActionRequired | RetryLater | {
+        status: 'revoked';
+        familyId: string;
+    }>;
+    forget: () => Promise<{
+        status: 'forgotten';
+        retainedServerSide: {
+            cliFamilyId?: string | undefined;
+            componentFamilyIds: string[];
+        };
+    }>;
+    hmacRootBinding: (version: 1, input: string) => Promise<{
+        version: 1;
+        hmac: string;
+    }>;
+};
+/** Shared CLI/hook backend selection; component records keep their recorded backend. */
+export declare function createLocalCredentialAdapter(options?: CredentialAdapterOptions): {
+    putCliOAuth: (metadata: CliOAuthMetadata, tokens: CliOAuthTokens | string) => Promise<{
+        store: string;
+    }>;
+    readCliOAuth: () => Promise<CliOAuthCredential | null>;
+    rotateCli: (transport: CliCredentialTransport) => Promise<ActionRequired | RetryLater | CliOAuthCredential>;
+    withCliCredential: <T>(transport: CliCredentialTransport, work: (accessToken: string) => Promise<WorkResponse<T>>) => Promise<WorkResponse<T> | ActionRequired | RetryLater>;
+    removeCliOAuth: () => Promise<void>;
+    putFamily: (componentKind: ComponentKind, response: ComponentCredentialResponse) => Promise<FamilyCredential>;
+    readFamily: (familyId: string) => Promise<FamilyCredential | null>;
+    rotateFamily: (familyId: string, transport: CredentialTransport) => Promise<RotationResult>;
+    withCredential: <T>(familyId: string, transport: CredentialTransport, work: (accessToken: string) => Promise<WorkResponse<T>>) => Promise<WorkResponse<T> | ActionRequired | RetryLater>;
+    revokeFamily: (familyId: string, transport: CredentialTransport) => Promise<ActionRequired | RetryLater | {
+        status: 'revoked';
+        familyId: string;
+    }>;
+    forget: () => Promise<{
+        status: 'forgotten';
+        retainedServerSide: {
+            cliFamilyId?: string | undefined;
+            componentFamilyIds: string[];
+        };
+    }>;
+    hmacRootBinding: (version: 1, input: string) => Promise<{
+        version: 1;
+        hmac: string;
+    }>;
+};
+type HookFamily = {
+    familyId: string;
+    server: string;
+    credentials: ReturnType<typeof createCredentialAdapter>;
+    unavailable: boolean;
+    diagnosed?: boolean;
+};
+export type HookCredential = string | HookFamily;
+/** Family handles contain no tokens. Legacy keys are considered only without a family. */
+export declare function resolveHookCredential(legacyKey: string | null, server: string, env?: NodeJS.ProcessEnv, argv?: string[]): HookCredential | null;
+/** Preserve each caller's wire body and budget; share rotation and failure state with bound context. */
+export declare function fetchWithHookCredential(credential: HookCredential | null, url: string, init: NonNullable<Parameters<typeof fetch>[1]> & {
+    headers?: Record<string, string>;
+}): Promise<Response>;
+//# sourceMappingURL=index.d.ts.map

package/dist/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,qBAAqB,EAAY,MAAM,uBAAuB,CAAC;AACxE,OAAO,EACL,KAAK,cAAc,EACnB,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAE3B,KAAK,2BAA2B,EAChC,KAAK,aAAa,EAElB,KAAK,mBAAmB,EACxB,KAAK,gBAAgB,EACrB,KAAK,UAAU,EACf,KAAK,cAAc,EACnB,KAAK,WAAW,EAChB,oBAAoB,EAGpB,KAAK,YAAY,EAClB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EACL,eAAe,EAEf,eAAe,EACf,cAAc,EACd,KAAK,iBAAiB,EACvB,MAAM,cAAc,CAAC;AAEtB,cAAc,gBAAgB,CAAC;AAC/B,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,EAAE,aAAa,EAAE,CAAC;AACzB,OAAO,EACL,eAAe,EACf,oBAAoB,EACpB,eAAe,EACf,cAAc,EACd,qBAAqB,GACtB,CAAC;AAgBF,MAAM,WAAW,wBAAyB,SAAQ,iBAAiB;IACjE,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B,YAAY,CAAC,EAAE,CAAC,IAAI,EAAE,sBAAsB,KAAK,IAAI,CAAC;IACtD,GAAG,CAAC,EAAE,MAAM,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,CAAC,YAAY,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IAChD,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAsCD,wBAAgB,uBAAuB,CAAC,OAAO,GAAE,wBAA6B;4BAwHvC,gBAAgB,UAAU,cAAc,GAAG,MAAM;;;wBAcvD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;2BA6PpD,sBAAsB,KAChC,OAAO,CAAC,cAAc,GAAG,UAAU,GAAG,kBAAkB,CAAC;wBAa3B,CAAC,aACrB,sBAAsB,QAC3B,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KACtD,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,UAAU,CAAC;0BAgBxB,OAAO,CAAC,IAAI,CAAC;+BAtNN,aAAa,YAAY,2BAA2B;2BAMxD,MAAM,KAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;6BA0H7C,MAAM,aAAa,mBAAmB,KAAG,OAAO,CAAC,cAAc,CAAC;qBA6FlE,CAAC,YACnB,MAAM,aACL,mBAAmB,QACxB,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KACtD,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,UAAU,CAAC;6BAwBnB,MAAM,aAAa,mBAAmB;gBASzD,SAAS;;;;gBAwDhB,WAAW;;;;;;+BAjCiB,CAAC,SAAS,MAAM;;;;EAuDzD;AAED,wFAAwF;AACxF,wBAAgB,4BAA4B,CAAC,OAAO,GAAE,wBAA6B;4BAza5C,gBAAgB,UAAU,cAAc,GAAG,MAAM;;;wBAcvD,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC;2BA6PpD,sBAAsB,KAChC,OAAO,CAAC,cAAc,GAAG,UAAU,GAAG,kBAAkB,CAAC;wBAa3B,CAAC,aACrB,sBAAsB,QAC3B,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KACtD,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,UAAU,CAAC;0BAgBxB,OAAO,CAAC,IAAI,CAAC;+BAtNN,aAAa,YAAY,2BAA2B;2BAMxD,MAAM,KAAG,OAAO,CAAC,gBAAgB,GAAG,IAAI,CAAC;6BA0H7C,MAAM,aAAa,mBAAmB,KAAG,OAAO,CAAC,cAAc,CAAC;qBA6FlE,CAAC,YACnB,MAAM,aACL,mBAAmB,QACxB,CAAC,WAAW,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,CAAC,KACtD,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,GAAG,cAAc,GAAG,UAAU,CAAC;6BAwBnB,MAAM,aAAa,mBAAmB;gBASzD,SAAS;;;;gBAwDhB,WAAW;;;;;;+BAjCiB,CAAC,SAAS,MAAM;;;;EA+DzD;AAED,KAAK,UAAU,GAAG;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,UAAU,CAAC,OAAO,uBAAuB,CAAC,CAAC;IACxD,WAAW,EAAE,OAAO,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB,CAAC;AACF,MAAM,MAAM,cAAc,GAAG,MAAM,GAAG,UAAU,CAAC;AAGjD,0FAA0F;AAC1F,wBAAgB,qBAAqB,CACnC,SAAS,EAAE,MAAM,GAAG,IAAI,EACxB,MAAM,EAAE,MAAM,EACd,GAAG,GAAE,MAAM,CAAC,UAAwB,EACpC,IAAI,WAAwB,GAC3B,cAAc,GAAG,IAAI,CAgBvB;AAED,wGAAwG;AACxG,wBAAsB,uBAAuB,CAC3C,UAAU,EAAE,cAAc,GAAG,IAAI,EACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,WAAW,CAAC,UAAU,CAAC,OAAO,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG;IAAE,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAAE,GACpF,OAAO,CAAC,QAAQ,CAAC,CAiDnB"}