@namzu/cli 35.0.0 → 36.0.0

package/dist/chunks/chunk-M3IAMIBJ.js

@@ -0,0 +1,661 @@
+import { createRequire as __namzuCreateRequire } from 'node:module';
+const require = __namzuCreateRequire(import.meta.url);
+import {
+  namzuHomePath
+} from "./chunk-FOFGMP7O.js";
+import {
+  __name
+} from "./chunk-76FLAFCG.js";
+
+// src/integrations/providers/credential-store.ts
+import { execFileSync } from "node:child_process";
+import { randomBytes } from "node:crypto";
+import {
+  closeSync,
+  fsyncSync,
+  linkSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  readdirSync,
+  renameSync,
+  rmSync,
+  statSync,
+  writeFileSync,
+  writeSync
+} from "node:fs";
+import { platform, tmpdir } from "node:os";
+import { basename, dirname, join, toNamespacedPath } from "node:path";
+var FILE_MODE = 384;
+var DIR_MODE = 448;
+var CREDENTIALS_FILE_VERSION = 1;
+var CredentialStoreError = class extends Error {
+  static {
+    __name(this, "CredentialStoreError");
+  }
+  name = "CredentialStoreError";
+};
+function credentialsPath(home) {
+  return join(namzuHomePath(home), "credentials.json");
+}
+__name(credentialsPath, "credentialsPath");
+function googleApiKeyPath(home) {
+  return join(namzuHomePath(home), "gemini-api-key.json");
+}
+__name(googleApiKeyPath, "googleApiKeyPath");
+function readStoredGeminiApiKey(home) {
+  const path = googleApiKeyPath(home);
+  try {
+    protectCredentialParentOnWindows(path);
+    const entry = lstatSync(path);
+    if (!entry.isFile() || entry.isSymbolicLink()) return null;
+    restrictToOwner(path);
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null) return null;
+    const record = parsed;
+    return record.version === 1 && typeof record.apiKey === "string" && record.apiKey.trim() ? record.apiKey : null;
+  } catch {
+    return null;
+  }
+}
+__name(readStoredGeminiApiKey, "readStoredGeminiApiKey");
+function writeStoredGeminiApiKey(apiKey, home) {
+  if (!apiKey.trim()) throw new CredentialStoreError("Cannot store an empty Gemini API key.");
+  const path = googleApiKeyPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  return withCredentialStoreLock(
+    path,
+    () => writeCredentialBodyUnlocked(`${JSON.stringify({ version: 1, apiKey })}
+`, path)
+  );
+}
+__name(writeStoredGeminiApiKey, "writeStoredGeminiApiKey");
+function clearStoredGeminiApiKey(home) {
+  const path = googleApiKeyPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  withCredentialStoreLock(path, () => rmSync(path, { force: true }));
+}
+__name(clearStoredGeminiApiKey, "clearStoredGeminiApiKey");
+function apiKeysPath(home) {
+  return join(namzuHomePath(home), "api-keys.json");
+}
+__name(apiKeysPath, "apiKeysPath");
+function readApiKeyDocument(home) {
+  const path = apiKeysPath(home);
+  try {
+    protectCredentialParentOnWindows(path);
+    const entry = lstatSync(path);
+    if (!entry.isFile() || entry.isSymbolicLink()) return {};
+    restrictToOwner(path);
+    const parsed = JSON.parse(readFileSync(path, "utf8"));
+    if (typeof parsed !== "object" || parsed === null) return {};
+    const record = parsed;
+    if (record.version !== 1 || typeof record.keys !== "object" || record.keys === null) return {};
+    const keys = /* @__PURE__ */ Object.create(null);
+    for (const [id, value] of Object.entries(record.keys))
+      if (typeof value === "string" && value.trim()) keys[id] = value;
+    return keys;
+  } catch {
+    return {};
+  }
+}
+__name(readApiKeyDocument, "readApiKeyDocument");
+function readStoredApiKey(providerId, home) {
+  return readApiKeyDocument(home)[providerId] ?? null;
+}
+__name(readStoredApiKey, "readStoredApiKey");
+function listStoredApiKeyProviders(home) {
+  return Object.keys(readApiKeyDocument(home));
+}
+__name(listStoredApiKeyProviders, "listStoredApiKeyProviders");
+function writeStoredApiKey(providerId, apiKey, home) {
+  if (!apiKey.trim()) throw new CredentialStoreError("Cannot store an empty API key.");
+  const path = apiKeysPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  return withCredentialStoreLock(
+    path,
+    () => writeCredentialBodyUnlocked(
+      `${JSON.stringify({ version: 1, keys: { ...readApiKeyDocument(home), [providerId]: apiKey } })}
+`,
+      path
+    )
+  );
+}
+__name(writeStoredApiKey, "writeStoredApiKey");
+function clearStoredApiKey(providerId, home) {
+  const path = apiKeysPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  withCredentialStoreLock(path, () => {
+    const { [providerId]: _removed, ...rest } = readApiKeyDocument(home);
+    if (Object.keys(rest).length === 0) rmSync(path, { force: true });
+    else writeCredentialBodyUnlocked(`${JSON.stringify({ version: 1, keys: rest })}
+`, path);
+  });
+}
+__name(clearStoredApiKey, "clearStoredApiKey");
+function readStoredSubscriptionCredential(home) {
+  return readCredentialDocument(home)?.subscription ?? null;
+}
+__name(readStoredSubscriptionCredential, "readStoredSubscriptionCredential");
+function readStoredCodexCredential(home) {
+  return readCredentialDocument(home)?.codexSubscription ?? null;
+}
+__name(readStoredCodexCredential, "readStoredCodexCredential");
+function readCredentialDocument(home) {
+  let raw;
+  try {
+    raw = readFileSync(credentialsPath(home), "utf8");
+  } catch {
+    return null;
+  }
+  let parsed;
+  try {
+    parsed = JSON.parse(raw);
+  } catch {
+    return null;
+  }
+  if (typeof parsed !== "object" || parsed === null) return null;
+  const root = parsed;
+  const subscription = parseCredential(root.subscription);
+  const codexBase = parseCredential(root.codexSubscription);
+  const codexRecord = typeof root.codexSubscription === "object" && root.codexSubscription !== null ? root.codexSubscription : null;
+  const accountId = codexRecord?.accountId;
+  const codexSubscription = codexBase && typeof accountId === "string" && accountId.length > 0 ? { ...codexBase, accountId } : void 0;
+  if (!subscription && !codexSubscription) return null;
+  return {
+    version: CREDENTIALS_FILE_VERSION,
+    ...subscription ? { subscription } : {},
+    ...codexSubscription ? { codexSubscription } : {}
+  };
+}
+__name(readCredentialDocument, "readCredentialDocument");
+function parseCredential(value) {
+  if (typeof value !== "object" || value === null) return null;
+  const rec = value;
+  const accessToken = rec.accessToken;
+  if (typeof accessToken !== "string" || accessToken.length === 0) return null;
+  return {
+    accessToken,
+    refreshToken: typeof rec.refreshToken === "string" ? rec.refreshToken : void 0,
+    expiresAt: typeof rec.expiresAt === "number" ? rec.expiresAt : void 0,
+    scopes: Array.isArray(rec.scopes) ? rec.scopes.filter((s) => typeof s === "string") : void 0
+  };
+}
+__name(parseCredential, "parseCredential");
+function writeStoredSubscriptionCredential(cred, home) {
+  const path = credentialsPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  return withCredentialStoreLock(path, () => {
+    const current = readCredentialDocument(home);
+    return writeCredentialDocumentUnlocked(
+      { version: CREDENTIALS_FILE_VERSION, ...current, subscription: cred },
+      path
+    );
+  });
+}
+__name(writeStoredSubscriptionCredential, "writeStoredSubscriptionCredential");
+function writeStoredCodexCredential(cred, home) {
+  const path = credentialsPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  return withCredentialStoreLock(path, () => {
+    const current = readCredentialDocument(home);
+    return writeCredentialDocumentUnlocked(
+      {
+        version: CREDENTIALS_FILE_VERSION,
+        ...current,
+        codexSubscription: cred
+      },
+      path
+    );
+  });
+}
+__name(writeStoredCodexCredential, "writeStoredCodexCredential");
+function replaceStoredCodexCredential(expected, replacement, home) {
+  const path = credentialsPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  return withCredentialStoreLock(path, () => {
+    const current = readStoredCodexCredential(home);
+    if (!sameCodexCredential(current, expected)) return { replaced: false, current };
+    const document = readCredentialDocument(home);
+    writeCredentialDocumentUnlocked(
+      {
+        version: CREDENTIALS_FILE_VERSION,
+        ...document,
+        codexSubscription: replacement
+      },
+      path
+    );
+    return { replaced: true, current: replacement };
+  });
+}
+__name(replaceStoredCodexCredential, "replaceStoredCodexCredential");
+function replaceStoredSubscriptionCredential(expected, replacement, home) {
+  const path = credentialsPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  return withCredentialStoreLock(path, () => {
+    const current = readStoredSubscriptionCredential(home);
+    if (!sameCredential(current, expected)) return { replaced: false, current };
+    const document = readCredentialDocument(home);
+    writeCredentialDocumentUnlocked(
+      {
+        version: CREDENTIALS_FILE_VERSION,
+        ...document,
+        subscription: replacement
+      },
+      path
+    );
+    return { replaced: true, current: replacement };
+  });
+}
+__name(replaceStoredSubscriptionCredential, "replaceStoredSubscriptionCredential");
+function writeCredentialDocumentUnlocked(document, path) {
+  const body = `${JSON.stringify(serializeDocument(document), null, 2)}
+`;
+  return writeCredentialBodyUnlocked(body, path);
+}
+__name(writeCredentialDocumentUnlocked, "writeCredentialDocumentUnlocked");
+function writeCredentialBodyUnlocked(body, path) {
+  const tmp = `${path}.tmp.${process.pid}.${randomBytes(6).toString("hex")}`;
+  let fd;
+  let placing = false;
+  try {
+    fd = openSync(tmp, "wx", FILE_MODE);
+    restrictToOwner(tmp);
+    const bytes = Buffer.from(body, "utf8");
+    for (let offset = 0; offset < bytes.length; ) {
+      const written = writeSync(fd, bytes, offset, bytes.length - offset);
+      if (written <= 0 || written > bytes.length - offset) {
+        throw new Error("credential write did not make progress");
+      }
+      offset += written;
+    }
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = void 0;
+    restrictToOwner(tmp);
+    placing = true;
+    renameSync(tmp, path);
+    return path;
+  } catch (err) {
+    if (fd !== void 0) {
+      try {
+        closeSync(fd);
+      } catch {
+      }
+    }
+    let cleanupError;
+    try {
+      rmSync(tmp, { force: true });
+    } catch (error) {
+      cleanupError = error;
+    }
+    throw new CredentialStoreError(
+      `could not ${placing ? "place" : "write"} ${path}: ${err instanceof Error ? err.message : String(err)}${cleanupError ? `; temporary file ${tmp} could not be removed: ${cleanupError instanceof Error ? cleanupError.message : String(cleanupError)}` : ""}`
+    );
+  }
+}
+__name(writeCredentialBodyUnlocked, "writeCredentialBodyUnlocked");
+function serializeDocument(document) {
+  const credential = /* @__PURE__ */ __name((value) => ({
+    accessToken: value.accessToken,
+    ...value.refreshToken ? { refreshToken: value.refreshToken } : {},
+    ...value.expiresAt ? { expiresAt: value.expiresAt } : {},
+    ...value.scopes ? { scopes: value.scopes } : {}
+  }), "credential");
+  return {
+    version: CREDENTIALS_FILE_VERSION,
+    ...document.subscription ? { subscription: credential(document.subscription) } : {},
+    ...document.codexSubscription ? {
+      codexSubscription: {
+        ...credential(document.codexSubscription),
+        accountId: document.codexSubscription.accountId
+      }
+    } : {}
+  };
+}
+__name(serializeDocument, "serializeDocument");
+function clearStoredSubscriptionCredential(home) {
+  const path = credentialsPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  withCredentialStoreLock(path, () => {
+    const current = readCredentialDocument(home);
+    if (!current?.codexSubscription) {
+      rmSync(path, { force: true });
+      return;
+    }
+    writeCredentialDocumentUnlocked(
+      {
+        version: CREDENTIALS_FILE_VERSION,
+        codexSubscription: current.codexSubscription
+      },
+      path
+    );
+  });
+}
+__name(clearStoredSubscriptionCredential, "clearStoredSubscriptionCredential");
+function clearStoredCodexCredential(home) {
+  const path = credentialsPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  withCredentialStoreLock(path, () => {
+    const current = readCredentialDocument(home);
+    if (!current?.subscription) {
+      rmSync(path, { force: true });
+      return;
+    }
+    writeCredentialDocumentUnlocked(
+      { version: CREDENTIALS_FILE_VERSION, subscription: current.subscription },
+      path
+    );
+  });
+}
+__name(clearStoredCodexCredential, "clearStoredCodexCredential");
+function clearAllStoredCredentials(home) {
+  const path = credentialsPath(home);
+  mkdirSync(dirname(path), { recursive: true, mode: DIR_MODE });
+  withCredentialStoreLock(path, () => rmSync(path, { force: true }));
+}
+__name(clearAllStoredCredentials, "clearAllStoredCredentials");
+function sameCredential(left, right) {
+  if (!left) return false;
+  if (left.accessToken !== right.accessToken || left.refreshToken !== right.refreshToken || left.expiresAt !== right.expiresAt) {
+    return false;
+  }
+  const leftScopes = left.scopes ?? [];
+  const rightScopes = right.scopes ?? [];
+  return leftScopes.length === rightScopes.length && leftScopes.every((scope, index) => scope === rightScopes[index]);
+}
+__name(sameCredential, "sameCredential");
+function sameCodexCredential(left, right) {
+  return left?.accountId === right.accountId && sameCredential(left, right);
+}
+__name(sameCodexCredential, "sameCodexCredential");
+function withCredentialStoreLock(path, operation) {
+  protectCredentialParentOnWindows(path);
+  const lockPath = `${path}.lock`;
+  const token = `${process.pid}:${Date.now()}:${randomBytes(12).toString("hex")}`;
+  const published = publishLockAtomically(lockPath, token);
+  if (!published.acquired) {
+    throw new CredentialStoreError(
+      `could not acquire the credential-store lock for ${path}: another owner or an unrecovered process lock is present (${published.error instanceof Error ? published.error.message : String(published.error)}). Refusing concurrent mutation; after proving no Namzu process is using this credential store, remove ${lockPath} and retry.`
+    );
+  }
+  try {
+    removeCredentialTempsUnlocked(path);
+    return operation();
+  } finally {
+    try {
+      if (readFileSync(lockPath, "utf8") === token) rmSync(lockPath, { force: true });
+    } catch {
+    }
+  }
+}
+__name(withCredentialStoreLock, "withCredentialStoreLock");
+function protectCredentialParentOnWindows(path) {
+  if (platform() !== "win32") return;
+  const parent = dirname(path);
+  const entry = lstatSync(parent);
+  if (entry.isSymbolicLink() || !entry.isDirectory()) {
+    throw new CredentialStoreError(`credential directory must be a real directory: ${parent}`);
+  }
+  restrictToOwner(parent);
+}
+__name(protectCredentialParentOnWindows, "protectCredentialParentOnWindows");
+function removeCredentialTempsUnlocked(path) {
+  const prefix = `${basename(path)}.tmp.`;
+  try {
+    for (const entry of readdirSync(dirname(path))) {
+      if (!entry.startsWith(prefix) || !/^\d+\.[0-9a-f]{12}$/u.test(entry.slice(prefix.length))) {
+        continue;
+      }
+      rmSync(join(dirname(path), entry), { force: true });
+    }
+  } catch (error) {
+    throw new CredentialStoreError(
+      `could not remove temporary credential files for ${path}: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+}
+__name(removeCredentialTempsUnlocked, "removeCredentialTempsUnlocked");
+function publishLockAtomically(lockPath, token) {
+  const candidatePath = `${lockPath}.candidate.${process.pid}.${randomBytes(12).toString("hex")}`;
+  let fd;
+  try {
+    fd = openSync(candidatePath, "wx", FILE_MODE);
+    writeFileSync(fd, token, "utf8");
+    fsyncSync(fd);
+    closeSync(fd);
+    fd = void 0;
+  } catch (error) {
+    if (fd !== void 0) closeSync(fd);
+    rmSync(candidatePath, { force: true });
+    throw new CredentialStoreError(
+      `could not prepare the credential-store lock: ${error instanceof Error ? error.message : String(error)}`
+    );
+  }
+  try {
+    linkSync(candidatePath, lockPath);
+    return { acquired: true };
+  } catch (error) {
+    return { acquired: false, error };
+  } finally {
+    try {
+      rmSync(candidatePath, { force: true });
+    } catch {
+    }
+  }
+}
+__name(publishLockAtomically, "publishLockAtomically");
+function restrictToOwner(path) {
+  restrictToOwnerWith(path, false);
+}
+__name(restrictToOwner, "restrictToOwner");
+function restrictToOwnerOnce(path) {
+  restrictToOwnerWith(path, true);
+}
+__name(restrictToOwnerOnce, "restrictToOwnerOnce");
+function restrictToOwnerWith(path, once) {
+  if (platform() === "win32") {
+    restrictToOwnerWindows(path, once);
+    return;
+  }
+  let mode;
+  try {
+    mode = statSync(path).mode;
+  } catch (err) {
+    throw new CredentialStoreError(
+      `could not read back the permissions of ${path}: ${err instanceof Error ? err.message : String(err)}`
+    );
+  }
+  assertOwnerOnlyMode(mode, path);
+}
+__name(restrictToOwnerWith, "restrictToOwnerWith");
+function assertOwnerOnlyMode(mode, path) {
+  if ((mode & 63) !== 0) {
+    throw new CredentialStoreError(
+      `${path} is readable beyond its owner (mode ${(mode & 511).toString(8)}) and the filesystem would not tighten it \u2014 refusing to keep a credential there.`
+    );
+  }
+}
+__name(assertOwnerOnlyMode, "assertOwnerOnlyMode");
+function restrictToOwnerWindows(path, once) {
+  const system32 = join(process.env.SystemRoot ?? "C:\\Windows", "System32");
+  const run = /* @__PURE__ */ __name((exe, args) => {
+    try {
+      return execFileSync(join(system32, exe), [...args], {
+        encoding: "utf8",
+        timeout: 1e4,
+        stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true
+      });
+    } catch (err) {
+      throw new CredentialStoreError(
+        `${exe} could not secure ${path} (${err instanceof Error ? err.message : String(err)}). namzu will not keep a credential in a file it cannot prove is private.`
+      );
+    }
+  }, "run");
+  const sid = currentUserSid();
+  if (!sid) {
+    throw new CredentialStoreError(
+      `could not determine the current account\u2019s security identifier, so the protection of ${path} cannot be established.`
+    );
+  }
+  const stat = statSync(path, { bigint: true });
+  const directory = stat.isDirectory();
+  const identity = `${stat.dev}:${stat.ino}:${stat.birthtimeNs}`;
+  if (once && directory && provenPrivateDirectories.has(path, identity)) return;
+  run("icacls.exe", [
+    toNamespacedPath(path),
+    "/inheritance:r",
+    "/grant:r",
+    `*${sid}:${directory ? "(OI)(CI)F" : "F"}`,
+    // Tighten the named private directory, including older generated state
+    // whose non-inheritable parent caused Windows to add this default grant.
+    // Never reset the ACL through a potentially wider parent descriptor.
+    ...directory ? ["/remove:g", "*S-1-5-32-544"] : []
+  ]);
+  const saved = readAclSddl(path);
+  if (saved === null) {
+    throw new CredentialStoreError(
+      `could not read back the access-control list of ${path}, so its privacy is unestablished.`
+    );
+  }
+  assertSoleOwnerSddl(saved, sid, path);
+  if (once && directory) provenPrivateDirectories.remember(path, identity);
+}
+__name(restrictToOwnerWindows, "restrictToOwnerWindows");
+function createDirectoryProofCache(limit = 256) {
+  const proven = /* @__PURE__ */ new Map();
+  return {
+    has: /* @__PURE__ */ __name((path, identity) => proven.get(path) === identity, "has"),
+    remember(path, identity) {
+      if (!proven.has(path) && proven.size >= limit) proven.clear();
+      proven.set(path, identity);
+    },
+    forget: /* @__PURE__ */ __name((path) => {
+      proven.delete(path);
+    }, "forget"),
+    get size() {
+      return proven.size;
+    }
+  };
+}
+__name(createDirectoryProofCache, "createDirectoryProofCache");
+var provenPrivateDirectories = createDirectoryProofCache();
+function readAclSddl(path) {
+  if (platform() !== "win32") return null;
+  const system32 = join(process.env.SystemRoot ?? "C:\\Windows", "System32");
+  const aclPath = join(tmpdir(), `namzu-acl-${randomBytes(6).toString("hex")}`);
+  try {
+    execFileSync(
+      join(system32, "icacls.exe"),
+      [toNamespacedPath(path), "/save", toNamespacedPath(aclPath)],
+      {
+        encoding: "utf8",
+        timeout: 1e4,
+        stdio: ["ignore", "pipe", "ignore"],
+        windowsHide: true
+      }
+    );
+    return readFileSync(aclPath, "utf16le");
+  } catch {
+    return null;
+  } finally {
+    rmSync(aclPath, { force: true });
+  }
+}
+__name(readAclSddl, "readAclSddl");
+function currentUserSid() {
+  if (platform() !== "win32") return null;
+  if (knownUserSid) return knownUserSid;
+  const system32 = join(process.env.SystemRoot ?? "C:\\Windows", "System32");
+  try {
+    const out = execFileSync(join(system32, "whoami.exe"), ["/user", "/fo", "csv", "/nh"], {
+      encoding: "utf8",
+      timeout: 1e4,
+      stdio: ["ignore", "pipe", "ignore"],
+      windowsHide: true
+    });
+    knownUserSid = out.match(/"(S-1-[0-9-]+)"/)?.[1];
+    return knownUserSid ?? null;
+  } catch {
+    return null;
+  }
+}
+__name(currentUserSid, "currentUserSid");
+var knownUserSid;
+function assertSoleOwnerSddl(sddl, sid, path) {
+  const dacl = sddl.match(/D:([A-Z]*)(.*?)(?=[OGS]:|[\r\n]|$)/u);
+  const flags = dacl?.[1] ?? "";
+  const body = dacl?.[2] ?? "";
+  if (!dacl || !/^(?:\([^()]*\))+$/u.test(body)) {
+    throw new CredentialStoreError(
+      `the access-control list of ${path} could not be read back, so its privacy is unestablished.`
+    );
+  }
+  if (!flags.includes("P")) {
+    throw new CredentialStoreError(
+      `${path} still inherits permissions from its parent folder, so accounts other than yours may read it.`
+    );
+  }
+  const aces = [...body.matchAll(/\(([^)]*)\)/g)].map((m) => (m[1] ?? "").split(";"));
+  if (aces.length === 0) {
+    throw new CredentialStoreError(
+      `the access-control list of ${path} could not be read back, so its privacy is unestablished.`
+    );
+  }
+  let grantsCurrentAccount = false;
+  const normalizeSid = /* @__PURE__ */ __name((value) => value.toUpperCase() === "SY" ? "S-1-5-18" : value.toUpperCase(), "normalizeSid");
+  for (const ace of aces) {
+    const type = ace[0] ?? "";
+    const trustee = ace[5] ?? "";
+    if (ace.length !== 6 || type !== "A" && type !== "D" || ace[3] || ace[4]) {
+      throw new CredentialStoreError(
+        `the access-control list of ${path} contains an unsupported entry, so its privacy is unestablished.`
+      );
+    }
+    if (type === "D") continue;
+    const currentAccount = normalizeSid(trustee) === normalizeSid(sid);
+    if (!currentAccount && normalizeSid(trustee) !== "S-1-5-18") {
+      throw new CredentialStoreError(
+        `${path} grants access to an account other than yours (${trustee}) \u2014 refusing to keep a credential there.`
+      );
+    }
+    if (currentAccount && !(ace[1] ?? "").includes("IO") && ace[2]) {
+      grantsCurrentAccount = true;
+    }
+  }
+  if (!grantsCurrentAccount) {
+    throw new CredentialStoreError(
+      `${path} ended with no access granted to your account, which is not a credential store \u2014 refusing.`
+    );
+  }
+}
+__name(assertSoleOwnerSddl, "assertSoleOwnerSddl");
+
+export {
+  CREDENTIALS_FILE_VERSION,
+  CredentialStoreError,
+  credentialsPath,
+  googleApiKeyPath,
+  readStoredGeminiApiKey,
+  writeStoredGeminiApiKey,
+  clearStoredGeminiApiKey,
+  apiKeysPath,
+  readStoredApiKey,
+  listStoredApiKeyProviders,
+  writeStoredApiKey,
+  clearStoredApiKey,
+  readStoredSubscriptionCredential,
+  readStoredCodexCredential,
+  writeStoredSubscriptionCredential,
+  writeStoredCodexCredential,
+  replaceStoredCodexCredential,
+  replaceStoredSubscriptionCredential,
+  clearStoredSubscriptionCredential,
+  clearStoredCodexCredential,
+  clearAllStoredCredentials,
+  restrictToOwner,
+  restrictToOwnerOnce
+};
+//# sourceMappingURL=chunk-M3IAMIBJ.js.map

package/dist/chunks/chunk-M3IAMIBJ.js.map

@@ -0,0 +1,6 @@
+{
+  "version": 3,
+  "sources": ["../../src/integrations/providers/credential-store.ts"],
+  "mappings": ";;;;;;;;;;AA6CA,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB;AAC5B;AAAA,EACC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACM;AACP,SAAS,UAAU,cAAc;AACjC,SAAS,UAAU,SAAS,MAAM,wBAAwB;AAK1D,IAAM,YAAY;AAClB,IAAM,WAAW;AAEV,IAAM,2BAA2B;AAGjC,IAAM,uBAAN,cAAmC,MAAM;AAAA,EA1EhD,OA0EgD;AAAA;AAAA;AAAA,EAC7B,OAAO;AAC1B;AAuBO,SAAS,gBAAgB,MAAuB;AACtD,SAAO,KAAK,cAAc,IAAI,GAAG,kBAAkB;AACpD;AAFgB;AAKT,SAAS,iBAAiB,MAAuB;AACvD,SAAO,KAAK,cAAc,IAAI,GAAG,qBAAqB;AACvD;AAFgB;AAKT,SAAS,uBAAuB,MAA8B;AACpE,QAAM,OAAO,iBAAiB,IAAI;AAClC,MAAI;AACH,qCAAiC,IAAI;AACrC,UAAM,QAAQ,UAAU,IAAI;AAC5B,QAAI,CAAC,MAAM,OAAO,KAAK,MAAM,eAAe,EAAG,QAAO;AACtD,oBAAgB,IAAI;AACpB,UAAM,SAAkB,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAC7D,QAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;AAC1D,UAAM,SAAS;AACf,WAAO,OAAO,YAAY,KAAK,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,IACpF,OAAO,SACP;AAAA,EACJ,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AAhBgB;AAmBT,SAAS,wBAAwB,QAAgB,MAAuB;AAC9E,MAAI,CAAC,OAAO,KAAK,EAAG,OAAM,IAAI,qBAAqB,uCAAuC;AAC1F,QAAM,OAAO,iBAAiB,IAAI;AAClC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,SAAO;AAAA,IAAwB;AAAA,IAAM,MACpC,4BAA4B,GAAG,KAAK,UAAU,EAAE,SAAS,GAAG,OAAO,CAAC,CAAC;AAAA,GAAM,IAAI;AAAA,EAChF;AACD;AAPgB;AAUT,SAAS,wBAAwB,MAAqB;AAC5D,QAAM,OAAO,iBAAiB,IAAI;AAClC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,0BAAwB,MAAM,MAAM,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC,CAAC;AAClE;AAJgB;AAYT,SAAS,YAAY,MAAuB;AAClD,SAAO,KAAK,cAAc,IAAI,GAAG,eAAe;AACjD;AAFgB;AAIhB,SAAS,mBAAmB,MAAuC;AAClE,QAAM,OAAO,YAAY,IAAI;AAC7B,MAAI;AACH,qCAAiC,IAAI;AACrC,UAAM,QAAQ,UAAU,IAAI;AAC5B,QAAI,CAAC,MAAM,OAAO,KAAK,MAAM,eAAe,EAAG,QAAO,CAAC;AACvD,oBAAgB,IAAI;AACpB,UAAM,SAAkB,KAAK,MAAM,aAAa,MAAM,MAAM,CAAC;AAC7D,QAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO,CAAC;AAC3D,UAAM,SAAS;AACf,QAAI,OAAO,YAAY,KAAK,OAAO,OAAO,SAAS,YAAY,OAAO,SAAS,KAAM,QAAO,CAAC;AAC7F,UAAM,OAA+B,uBAAO,OAAO,IAAI;AACvD,eAAW,CAAC,IAAI,KAAK,KAAK,OAAO,QAAQ,OAAO,IAA+B;AAC9E,UAAI,OAAO,UAAU,YAAY,MAAM,KAAK,EAAG,MAAK,EAAE,IAAI;AAC3D,WAAO;AAAA,EACR,QAAQ;AACP,WAAO,CAAC;AAAA,EACT;AACD;AAlBS;AAqBF,SAAS,iBAAiB,YAAoB,MAA8B;AAClF,SAAO,mBAAmB,IAAI,EAAE,UAAU,KAAK;AAChD;AAFgB;AAKT,SAAS,0BAA0B,MAAyB;AAClE,SAAO,OAAO,KAAK,mBAAmB,IAAI,CAAC;AAC5C;AAFgB;AAKT,SAAS,kBAAkB,YAAoB,QAAgB,MAAuB;AAC5F,MAAI,CAAC,OAAO,KAAK,EAAG,OAAM,IAAI,qBAAqB,gCAAgC;AACnF,QAAM,OAAO,YAAY,IAAI;AAC7B,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,SAAO;AAAA,IAAwB;AAAA,IAAM,MACpC;AAAA,MACC,GAAG,KAAK,UAAU,EAAE,SAAS,GAAG,MAAM,EAAE,GAAG,mBAAmB,IAAI,GAAG,CAAC,UAAU,GAAG,OAAO,EAAE,CAAC,CAAC;AAAA;AAAA,MAC9F;AAAA,IACD;AAAA,EACD;AACD;AAVgB;AAaT,SAAS,kBAAkB,YAAoB,MAAqB;AAC1E,QAAM,OAAO,YAAY,IAAI;AAC7B,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,0BAAwB,MAAM,MAAM;AACnC,UAAM,EAAE,CAAC,UAAU,GAAG,UAAU,GAAG,KAAK,IAAI,mBAAmB,IAAI;AACnE,QAAI,OAAO,KAAK,IAAI,EAAE,WAAW,EAAG,QAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAAA,QAC3D,6BAA4B,GAAG,KAAK,UAAU,EAAE,SAAS,GAAG,MAAM,KAAK,CAAC,CAAC;AAAA,GAAM,IAAI;AAAA,EACzF,CAAC;AACF;AARgB;AAmBT,SAAS,iCAAiC,MAA4C;AAC5F,SAAO,uBAAuB,IAAI,GAAG,gBAAgB;AACtD;AAFgB;AAKT,SAAS,0BAA0B,MAA6C;AACtF,SAAO,uBAAuB,IAAI,GAAG,qBAAqB;AAC3D;AAFgB;AAIhB,SAAS,uBAAuB,MAA0C;AACzE,MAAI;AACJ,MAAI;AACH,UAAM,aAAa,gBAAgB,IAAI,GAAG,MAAM;AAAA,EACjD,QAAQ;AACP,WAAO;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AACH,aAAS,KAAK,MAAM,GAAG;AAAA,EACxB,QAAQ;AACP,WAAO;AAAA,EACR;AACA,MAAI,OAAO,WAAW,YAAY,WAAW,KAAM,QAAO;AAC1D,QAAM,OAAO;AAIb,QAAM,eAAe,gBAAgB,KAAK,YAAY;AACtD,QAAM,YAAY,gBAAgB,KAAK,iBAAiB;AACxD,QAAM,cACL,OAAO,KAAK,sBAAsB,YAAY,KAAK,sBAAsB,OACrE,KAAK,oBACN;AACJ,QAAM,YAAY,aAAa;AAC/B,QAAM,oBACL,aAAa,OAAO,cAAc,YAAY,UAAU,SAAS,IAC9D,EAAE,GAAG,WAAW,UAAU,IAC1B;AACJ,MAAI,CAAC,gBAAgB,CAAC,kBAAmB,QAAO;AAChD,SAAO;AAAA,IACN,SAAS;AAAA,IACT,GAAI,eAAe,EAAE,aAAa,IAAI,CAAC;AAAA,IACvC,GAAI,oBAAoB,EAAE,kBAAkB,IAAI,CAAC;AAAA,EAClD;AACD;AAnCS;AAqCT,SAAS,gBAAgB,OAA6C;AACrE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,MAAM;AACZ,QAAM,cAAc,IAAI;AACxB,MAAI,OAAO,gBAAgB,YAAY,YAAY,WAAW,EAAG,QAAO;AACxE,SAAO;AAAA,IACN;AAAA,IACA,cAAc,OAAO,IAAI,iBAAiB,WAAW,IAAI,eAAe;AAAA,IACxE,WAAW,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY;AAAA,IAC/D,QAAQ,MAAM,QAAQ,IAAI,MAAM,IAC5B,IAAI,OAAO,OAAO,CAAC,MAAM,OAAO,MAAM,QAAQ,IAC/C;AAAA,EACJ;AACD;AAbS;AAwBF,SAAS,kCACf,MACA,MACS;AACT,QAAM,OAAO,gBAAgB,IAAI;AACjC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,SAAO,wBAAwB,MAAM,MAAM;AAC1C,UAAM,UAAU,uBAAuB,IAAI;AAC3C,WAAO;AAAA,MACN,EAAE,SAAS,0BAA0B,GAAG,SAAS,cAAc,KAAK;AAAA,MACpE;AAAA,IACD;AAAA,EACD,CAAC;AACF;AAbgB;AAeT,SAAS,2BAA2B,MAA6B,MAAuB;AAC9F,QAAM,OAAO,gBAAgB,IAAI;AACjC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,SAAO,wBAAwB,MAAM,MAAM;AAC1C,UAAM,UAAU,uBAAuB,IAAI;AAC3C,WAAO;AAAA,MACN;AAAA,QACC,SAAS;AAAA,QACT,GAAG;AAAA,QACH,mBAAmB;AAAA,MACpB;AAAA,MACA;AAAA,IACD;AAAA,EACD,CAAC;AACF;AAdgB;AAgBT,SAAS,6BACf,UACA,aACA,MACkC;AAClC,QAAM,OAAO,gBAAgB,IAAI;AACjC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,SAAO,wBAAwB,MAAM,MAAM;AAC1C,UAAM,UAAU,0BAA0B,IAAI;AAC9C,QAAI,CAAC,oBAAoB,SAAS,QAAQ,EAAG,QAAO,EAAE,UAAU,OAAO,QAAQ;AAC/E,UAAM,WAAW,uBAAuB,IAAI;AAC5C;AAAA,MACC;AAAA,QACC,SAAS;AAAA,QACT,GAAG;AAAA,QACH,mBAAmB;AAAA,MACpB;AAAA,MACA;AAAA,IACD;AACA,WAAO,EAAE,UAAU,MAAM,SAAS,YAAY;AAAA,EAC/C,CAAC;AACF;AArBgB;AAgCT,SAAS,oCACf,UACA,aACA,MAC6B;AAC7B,QAAM,OAAO,gBAAgB,IAAI;AACjC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,SAAO,wBAAwB,MAAM,MAAM;AAC1C,UAAM,UAAU,iCAAiC,IAAI;AACrD,QAAI,CAAC,eAAe,SAAS,QAAQ,EAAG,QAAO,EAAE,UAAU,OAAO,QAAQ;AAC1E,UAAM,WAAW,uBAAuB,IAAI;AAC5C;AAAA,MACC;AAAA,QACC,SAAS;AAAA,QACT,GAAG;AAAA,QACH,cAAc;AAAA,MACf;AAAA,MACA;AAAA,IACD;AACA,WAAO,EAAE,UAAU,MAAM,SAAS,YAAY;AAAA,EAC/C,CAAC;AACF;AArBgB;AAuBhB,SAAS,gCAAgC,UAA8B,MAAsB;AAC5F,QAAM,OAAO,GAAG,KAAK,UAAU,kBAAkB,QAAQ,GAAG,MAAM,CAAC,CAAC;AAAA;AACpE,SAAO,4BAA4B,MAAM,IAAI;AAC9C;AAHS;AAKT,SAAS,4BAA4B,MAAc,MAAsB;AACxE,QAAM,MAAM,GAAG,IAAI,QAAQ,QAAQ,GAAG,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAExE,MAAI;AACJ,MAAI,UAAU;AACd,MAAI;AAGH,SAAK,SAAS,KAAK,MAAM,SAAS;AAGlC,oBAAgB,GAAG;AACnB,UAAM,QAAQ,OAAO,KAAK,MAAM,MAAM;AACtC,aAAS,SAAS,GAAG,SAAS,MAAM,UAAU;AAC7C,YAAM,UAAU,UAAU,IAAI,OAAO,QAAQ,MAAM,SAAS,MAAM;AAClE,UAAI,WAAW,KAAK,UAAU,MAAM,SAAS,QAAQ;AACpD,cAAM,IAAI,MAAM,wCAAwC;AAAA,MACzD;AACA,gBAAU;AAAA,IACX;AACA,cAAU,EAAE;AACZ,cAAU,EAAE;AACZ,SAAK;AAEL,oBAAgB,GAAG;AACnB,cAAU;AACV,eAAW,KAAK,IAAI;AACpB,WAAO;AAAA,EACR,SAAS,KAAK;AACb,QAAI,OAAO,QAAW;AACrB,UAAI;AACH,kBAAU,EAAE;AAAA,MACb,QAAQ;AAAA,MAGR;AAAA,IACD;AACA,QAAI;AACJ,QAAI;AACH,aAAO,KAAK,EAAE,OAAO,KAAK,CAAC;AAAA,IAC5B,SAAS,OAAO;AACf,qBAAe;AAAA,IAChB;AACA,UAAM,IAAI;AAAA,MACT,aAAa,UAAU,UAAU,OAAO,IAAI,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,GAAG,eAAe,oBAAoB,GAAG,0BAA0B,wBAAwB,QAAQ,aAAa,UAAU,OAAO,YAAY,CAAC,KAAK,EAAE;AAAA,IAC3P;AAAA,EACD;AACD;AA/CS;AAiDT,SAAS,kBAAkB,UAAuD;AACjF,QAAM,aAAa,wBAAC,WAAiC;AAAA,IACpD,aAAa,MAAM;AAAA,IACnB,GAAI,MAAM,eAAe,EAAE,cAAc,MAAM,aAAa,IAAI,CAAC;AAAA,IACjE,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;AAAA,IACxD,GAAI,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,IAAI,CAAC;AAAA,EAChD,IALmB;AAMnB,SAAO;AAAA,IACN,SAAS;AAAA,IACT,GAAI,SAAS,eAAe,EAAE,cAAc,WAAW,SAAS,YAAY,EAAE,IAAI,CAAC;AAAA,IACnF,GAAI,SAAS,oBACV;AAAA,MACA,mBAAmB;AAAA,QAClB,GAAG,WAAW,SAAS,iBAAiB;AAAA,QACxC,WAAW,SAAS,kBAAkB;AAAA,MACvC;AAAA,IACD,IACC,CAAC;AAAA,EACL;AACD;AAnBS;AAsBF,SAAS,kCAAkC,MAAqB;AACtE,QAAM,OAAO,gBAAgB,IAAI;AACjC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,0BAAwB,MAAM,MAAM;AACnC,UAAM,UAAU,uBAAuB,IAAI;AAC3C,QAAI,CAAC,SAAS,mBAAmB;AAChC,aAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAC5B;AAAA,IACD;AACA;AAAA,MACC;AAAA,QACC,SAAS;AAAA,QACT,mBAAmB,QAAQ;AAAA,MAC5B;AAAA,MACA;AAAA,IACD;AAAA,EACD,CAAC;AACF;AAjBgB;AAoBT,SAAS,2BAA2B,MAAqB;AAC/D,QAAM,OAAO,gBAAgB,IAAI;AACjC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,0BAAwB,MAAM,MAAM;AACnC,UAAM,UAAU,uBAAuB,IAAI;AAC3C,QAAI,CAAC,SAAS,cAAc;AAC3B,aAAO,MAAM,EAAE,OAAO,KAAK,CAAC;AAC5B;AAAA,IACD;AACA;AAAA,MACC,EAAE,SAAS,0BAA0B,cAAc,QAAQ,aAAa;AAAA,MACxE;AAAA,IACD;AAAA,EACD,CAAC;AACF;AAdgB;AAiBT,SAAS,0BAA0B,MAAqB;AAC9D,QAAM,OAAO,gBAAgB,IAAI;AACjC,YAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,MAAM,MAAM,SAAS,CAAC;AAC5D,0BAAwB,MAAM,MAAM,OAAO,MAAM,EAAE,OAAO,KAAK,CAAC,CAAC;AAClE;AAJgB;AAMhB,SAAS,eAAe,MAAmC,OAAsC;AAChG,MAAI,CAAC,KAAM,QAAO;AAClB,MACC,KAAK,gBAAgB,MAAM,eAC3B,KAAK,iBAAiB,MAAM,gBAC5B,KAAK,cAAc,MAAM,WACxB;AACD,WAAO;AAAA,EACR;AACA,QAAM,aAAa,KAAK,UAAU,CAAC;AACnC,QAAM,cAAc,MAAM,UAAU,CAAC;AACrC,SACC,WAAW,WAAW,YAAY,UAClC,WAAW,MAAM,CAAC,OAAO,UAAU,UAAU,YAAY,KAAK,CAAC;AAEjE;AAfS;AAiBT,SAAS,oBACR,MACA,OACU;AACV,SAAO,MAAM,cAAc,MAAM,aAAa,eAAe,MAAM,KAAK;AACzE;AALS;AAiBT,SAAS,wBAA2B,MAAc,WAAuB;AACxE,mCAAiC,IAAI;AACrC,QAAM,WAAW,GAAG,IAAI;AACxB,QAAM,QAAQ,GAAG,QAAQ,GAAG,IAAI,KAAK,IAAI,CAAC,IAAI,YAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AAC7E,QAAM,YAAY,sBAAsB,UAAU,KAAK;AACvD,MAAI,CAAC,UAAU,UAAU;AACxB,UAAM,IAAI;AAAA,MACT,mDAAmD,IAAI,8DAA8D,UAAU,iBAAiB,QAAQ,UAAU,MAAM,UAAU,OAAO,UAAU,KAAK,CAAC,0GAA0G,QAAQ;AAAA,IAC5T;AAAA,EACD;AAEA,MAAI;AACH,kCAA8B,IAAI;AAClC,WAAO,UAAU;AAAA,EAClB,UAAE;AAED,QAAI;AACH,UAAI,aAAa,UAAU,MAAM,MAAM,MAAO,QAAO,UAAU,EAAE,OAAO,KAAK,CAAC;AAAA,IAC/E,QAAQ;AAAA,IAGR;AAAA,EACD;AACD;AAvBS;AA0BT,SAAS,iCAAiC,MAAoB;AAC7D,MAAI,SAAS,MAAM,QAAS;AAI5B,QAAM,SAAS,QAAQ,IAAI;AAC3B,QAAM,QAAQ,UAAU,MAAM;AAC9B,MAAI,MAAM,eAAe,KAAK,CAAC,MAAM,YAAY,GAAG;AACnD,UAAM,IAAI,qBAAqB,kDAAkD,MAAM,EAAE;AAAA,EAC1F;AACA,kBAAgB,MAAM;AACvB;AAXS;AAcT,SAAS,8BAA8B,MAAoB;AAC1D,QAAM,SAAS,GAAG,SAAS,IAAI,CAAC;AAChC,MAAI;AACH,eAAW,SAAS,YAAY,QAAQ,IAAI,CAAC,GAAG;AAC/C,UAAI,CAAC,MAAM,WAAW,MAAM,KAAK,CAAC,uBAAuB,KAAK,MAAM,MAAM,OAAO,MAAM,CAAC,GAAG;AAC1F;AAAA,MACD;AACA,aAAO,KAAK,QAAQ,IAAI,GAAG,KAAK,GAAG,EAAE,OAAO,KAAK,CAAC;AAAA,IACnD;AAAA,EACD,SAAS,OAAO;AACf,UAAM,IAAI;AAAA,MACT,mDAAmD,IAAI,KAAK,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACnH;AAAA,EACD;AACD;AAdS;AAwBT,SAAS,sBACR,UACA,OACsF;AACtF,QAAM,gBAAgB,GAAG,QAAQ,cAAc,QAAQ,GAAG,IAAI,YAAY,EAAE,EAAE,SAAS,KAAK,CAAC;AAC7F,MAAI;AACJ,MAAI;AACH,SAAK,SAAS,eAAe,MAAM,SAAS;AAC5C,kBAAc,IAAI,OAAO,MAAM;AAC/B,cAAU,EAAE;AACZ,cAAU,EAAE;AACZ,SAAK;AAAA,EACN,SAAS,OAAO;AACf,QAAI,OAAO,OAAW,WAAU,EAAE;AAClC,WAAO,eAAe,EAAE,OAAO,KAAK,CAAC;AACrC,UAAM,IAAI;AAAA,MACT,gDAAgD,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;AAAA,IACvG;AAAA,EACD;AAEA,MAAI;AACH,aAAS,eAAe,QAAQ;AAChC,WAAO,EAAE,UAAU,KAAK;AAAA,EACzB,SAAS,OAAO;AACf,WAAO,EAAE,UAAU,OAAO,MAAM;AAAA,EACjC,UAAE;AACD,QAAI;AACH,aAAO,eAAe,EAAE,OAAO,KAAK,CAAC;AAAA,IACtC,QAAQ;AAAA,IAIR;AAAA,EACD;AACD;AAlCS;AA2CF,SAAS,gBAAgB,MAAoB;AACnD,sBAAoB,MAAM,KAAK;AAChC;AAFgB;AAWT,SAAS,oBAAoB,MAAoB;AACvD,sBAAoB,MAAM,IAAI;AAC/B;AAFgB;AAIhB,SAAS,oBAAoB,MAAc,MAAqB;AAC/D,MAAI,SAAS,MAAM,SAAS;AAC3B,2BAAuB,MAAM,IAAI;AACjC;AAAA,EACD;AAIA,MAAI;AACJ,MAAI;AACH,WAAO,SAAS,IAAI,EAAE;AAAA,EACvB,SAAS,KAAK;AACb,UAAM,IAAI;AAAA,MACT,0CAA0C,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,IACpG;AAAA,EACD;AACA,sBAAoB,MAAM,IAAI;AAC/B;AAjBS;AA4BF,SAAS,oBAAoB,MAAc,MAAoB;AACrE,OAAK,OAAO,QAAW,GAAG;AACzB,UAAM,IAAI;AAAA,MACT,GAAG,IAAI,wCAAwC,OAAO,KAAO,SAAS,CAAC,CAAC;AAAA,IACzE;AAAA,EACD;AACD;AANgB;AAsBhB,SAAS,uBAAuB,MAAc,MAAqB;AAClE,QAAM,WAAW,KAAK,QAAQ,IAAI,cAAc,eAAe,UAAU;AACzE,QAAM,MAAM,wBAAC,KAAa,SAAoC;AAC7D,QAAI;AACH,aAAO,aAAa,KAAK,UAAU,GAAG,GAAG,CAAC,GAAG,IAAI,GAAG;AAAA,QACnD,UAAU;AAAA,QACV,SAAS;AAAA,QACT,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,QAClC,aAAa;AAAA,MACd,CAAC;AAAA,IACF,SAAS,KAAK;AACb,YAAM,IAAI;AAAA,QACT,GAAG,GAAG,qBAAqB,IAAI,KAAK,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAAA,MACrF;AAAA,IACD;AAAA,EACD,GAbY;AAgBZ,QAAM,MAAM,eAAe;AAC3B,MAAI,CAAC,KAAK;AACT,UAAM,IAAI;AAAA,MACT,4FAAuF,IAAI;AAAA,IAC5F;AAAA,EACD;AAEA,QAAM,OAAO,SAAS,MAAM,EAAE,QAAQ,KAAK,CAAC;AAC5C,QAAM,YAAY,KAAK,YAAY;AAKnC,QAAM,WAAW,GAAG,KAAK,GAAG,IAAI,KAAK,GAAG,IAAI,KAAK,WAAW;AAC5D,MAAI,QAAQ,aAAa,yBAAyB,IAAI,MAAM,QAAQ,EAAG;AACvE,MAAI,cAAc;AAAA,IACjB,iBAAiB,IAAI;AAAA,IACrB;AAAA,IACA;AAAA,IACA,IAAI,GAAG,IAAI,YAAY,cAAc,GAAG;AAAA;AAAA;AAAA;AAAA,IAIxC,GAAI,YAAY,CAAC,aAAa,eAAe,IAAI,CAAC;AAAA,EACnD,CAAC;AAED,QAAM,QAAQ,YAAY,IAAI;AAC9B,MAAI,UAAU,MAAM;AACnB,UAAM,IAAI;AAAA,MACT,kDAAkD,IAAI;AAAA,IACvD;AAAA,EACD;AACA,sBAAoB,OAAO,KAAK,IAAI;AACpC,MAAI,QAAQ,UAAW,0BAAyB,SAAS,MAAM,QAAQ;AACxE;AApDS;AA4DF,SAAS,0BAA0B,QAAQ,KAAK;AACtD,QAAM,SAAS,oBAAI,IAAoB;AACvC,SAAO;AAAA,IACN,KAAK,wBAAC,MAAc,aAA8B,OAAO,IAAI,IAAI,MAAM,UAAlE;AAAA,IACL,SAAS,MAAc,UAAwB;AAC9C,UAAI,CAAC,OAAO,IAAI,IAAI,KAAK,OAAO,QAAQ,MAAO,QAAO,MAAM;AAC5D,aAAO,IAAI,MAAM,QAAQ;AAAA,IAC1B;AAAA,IACA,QAAQ,wBAAC,SAAuB;AAC/B,aAAO,OAAO,IAAI;AAAA,IACnB,GAFQ;AAAA,IAGR,IAAI,OAAe;AAClB,aAAO,OAAO;AAAA,IACf;AAAA,EACD;AACD;AAfgB;AAgBhB,IAAM,2BAA2B,0BAA0B;AAepD,SAAS,YAAY,MAA6B;AACxD,MAAI,SAAS,MAAM,QAAS,QAAO;AACnC,QAAM,WAAW,KAAK,QAAQ,IAAI,cAAc,eAAe,UAAU;AACzE,QAAM,UAAU,KAAK,OAAO,GAAG,aAAa,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC,EAAE;AAC5E,MAAI;AACH;AAAA,MACC,KAAK,UAAU,YAAY;AAAA,MAC3B,CAAC,iBAAiB,IAAI,GAAG,SAAS,iBAAiB,OAAO,CAAC;AAAA,MAC3D;AAAA,QACC,UAAU;AAAA,QACV,SAAS;AAAA,QACT,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,QAClC,aAAa;AAAA,MACd;AAAA,IACD;AACA,WAAO,aAAa,SAAS,SAAS;AAAA,EACvC,QAAQ;AACP,WAAO;AAAA,EACR,UAAE;AACD,WAAO,SAAS,EAAE,OAAO,KAAK,CAAC;AAAA,EAChC;AACD;AArBgB;AAwBT,SAAS,iBAAgC;AAC/C,MAAI,SAAS,MAAM,QAAS,QAAO;AAGnC,MAAI,aAAc,QAAO;AACzB,QAAM,WAAW,KAAK,QAAQ,IAAI,cAAc,eAAe,UAAU;AACzE,MAAI;AACH,UAAM,MAAM,aAAa,KAAK,UAAU,YAAY,GAAG,CAAC,SAAS,OAAO,OAAO,KAAK,GAAG;AAAA,MACtF,UAAU;AAAA,MACV,SAAS;AAAA,MACT,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,MAClC,aAAa;AAAA,IACd,CAAC;AACD,mBAAe,IAAI,MAAM,iBAAiB,IAAI,CAAC;AAC/C,WAAO,gBAAgB;AAAA,EACxB,QAAQ;AACP,WAAO;AAAA,EACR;AACD;AAlBgB;AAmBhB,IAAI;AAYG,SAAS,oBAAoB,MAAc,KAAa,MAAoB;AAClF,QAAM,OAAO,KAAK,MAAM,qCAAqC;AAC7D,QAAM,QAAQ,OAAO,CAAC,KAAK;AAC3B,QAAM,OAAO,OAAO,CAAC,KAAK;AAC1B,MAAI,CAAC,QAAQ,CAAC,qBAAqB,KAAK,IAAI,GAAG;AAC9C,UAAM,IAAI;AAAA,MACT,8BAA8B,IAAI;AAAA,IACnC;AAAA,EACD;AACA,MAAI,CAAC,MAAM,SAAS,GAAG,GAAG;AACzB,UAAM,IAAI;AAAA,MACT,GAAG,IAAI;AAAA,IACR;AAAA,EACD;AACA,QAAM,OAAO,CAAC,GAAG,KAAK,SAAS,cAAc,CAAC,EAAE,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,MAAM,GAAG,CAAC;AAClF,MAAI,KAAK,WAAW,GAAG;AACtB,UAAM,IAAI;AAAA,MACT,8BAA8B,IAAI;AAAA,IACnC;AAAA,EACD;AACA,MAAI,uBAAuB;AAC3B,QAAM,eAAe,wBAAC,UACrB,MAAM,YAAY,MAAM,OAAO,aAAa,MAAM,YAAY,GAD1C;AAErB,aAAW,OAAO,MAAM;AACvB,UAAM,OAAO,IAAI,CAAC,KAAK;AACvB,UAAM,UAAU,IAAI,CAAC,KAAK;AAG1B,QAAI,IAAI,WAAW,KAAM,SAAS,OAAO,SAAS,OAAQ,IAAI,CAAC,KAAK,IAAI,CAAC,GAAG;AAC3E,YAAM,IAAI;AAAA,QACT,8BAA8B,IAAI;AAAA,MACnC;AAAA,IACD;AACA,QAAI,SAAS,IAAK;AAClB,UAAM,iBAAiB,aAAa,OAAO,MAAM,aAAa,GAAG;AACjE,QAAI,CAAC,kBAAkB,aAAa,OAAO,MAAM,YAAY;AAC5D,YAAM,IAAI;AAAA,QACT,GAAG,IAAI,kDAAkD,OAAO;AAAA,MACjE;AAAA,IACD;AAGA,QAAI,kBAAkB,EAAE,IAAI,CAAC,KAAK,IAAI,SAAS,IAAI,KAAK,IAAI,CAAC,GAAG;AAC/D,6BAAuB;AAAA,IACxB;AAAA,EACD;AACA,MAAI,CAAC,sBAAsB;AAC1B,UAAM,IAAI;AAAA,MACT,GAAG,IAAI;AAAA,IACR;AAAA,EACD;AACD;AAnDgB;",
+  "names": []
+}