@open-mercato/cezar 0.9.3 → 0.10.0-pr892.1298

package/dist/core/provider-auth.js

@@ -1,8 +1,62 @@
 import { execFile } from 'node:child_process';
 import { randomUUID } from 'node:crypto';
-export const PROVIDER_IDS = ['claude', 'codex', 'opencode'];
+import { AGENT_MODELS_LOCKED_ENV } from './agent-model-policy.js';
+import { profileEnv } from './agent-profiles.js';
+import { withEnvPrefix } from './shell-env.js';
+export const PROVIDER_IDS = ['claude', 'codex', 'opencode', 'pi'];
+/**
+ * The explicit environment lock delegates model and credential configuration
+ * to each native coding agent. In that mode Cezar must not second-guess the
+ * agent's own credentials through the provider checks introduced by #652.
+ *
+ * Config-file model locks intentionally do not disable the checks: this bypass
+ * is an operator-level process policy and only the exact documented `1` opts in.
+ */
+export function providerAuthChecksDisabled(env = process.env) {
+    return env[AGENT_MODELS_LOCKED_ENV] === '1';
+}
 const COMMAND_TIMEOUT_MS = 10_000;
-const CACHE_TTL_MS = 5_000;
+/**
+ * How long a probe result stands before it is re-checked — deliberately ASYMMETRIC.
+ *
+ * Which login an agent is signed into is operating knowledge: it matters for every run, and it
+ * changes only when someone runs `claude auth login`. Re-probing it every few seconds cost a CLI
+ * shell-out per provider and per account on every page load, for an answer that had almost
+ * certainly not changed. So a CONNECTED answer is kept for minutes.
+ *
+ * A NOT-CONNECTED answer is re-checked sooner, for ONE reason: display self-healing. If you log in
+ * from a terminal, cezar cannot see it happen, so a card that says "disconnected" must eventually
+ * find out on its own. The window is a minute rather than seconds because reading is now
+ * stale-while-revalidate (see `status`): every expiry costs a background probe, and a cockpit
+ * polling this endpoint would turn a five-second window into a spawn every five seconds, forever,
+ * on any machine where one provider is logged out — which is most of them.
+ *
+ * What this window is NOT is a correctness mechanism for starting runs. `provider-action-gate.ts`
+ * refuses to start a run against a provider it believes disconnected, and it re-verifies before it
+ * refuses (`providerActionError` in `server.ts`) rather than trusting an aging negative. That
+ * inversion is what makes a long window safe here: the only reader that must not be wrong pays for
+ * its own certainty, on the rare path where it is about to say no.
+ *
+ * A stale CONNECTED answer needs no window at all: the run starts, and a credential that really has
+ * gone bad surfaces as a runtime auth failure, which is latched and overrides this cache on the spot
+ * (`withRuntimeFailures`).
+ *
+ * Anything cezar CAN observe invalidates explicitly instead of waiting for either window: opening a
+ * login (`POST /providers/connect`), repointing or removing an account (`forgetProfileStatus`), and
+ * a runtime rejection.
+ */
+const CONNECTED_TTL_MS = 10 * 60_000;
+const UNSETTLED_TTL_MS = 60_000;
+/** The lifetime for a set of rows: minutes only when EVERY row is connected. A mixed answer takes
+ *  the short window, because the not-connected row in it is the one that might self-heal.
+ *
+ *  KNOWN COARSENESS: the window applies to the whole three-provider response, so one logged-out
+ *  provider drags the two connected ones into re-probing with it. That is wasted work rather than a
+ *  wrong answer, and it is now paid in the background; fixing it properly means per-provider
+ *  timestamps and merging partial probe results. */
+function cacheTtlFor(rows) {
+    return rows.every((row) => row.status === 'connected') ? CONNECTED_TTL_MS : UNSETTLED_TTL_MS;
+}
 const UNKNOWN_HINT = 'Authentication could not be verified. Try again.';
 const TIMEOUT_HINT = 'Authentication check timed out. Try again.';
 const RUNTIME_AUTH_HINT = 'Authentication was rejected during a run. Reconnect, then try again.';
@@ -103,6 +157,19 @@ function parseOpenCodeStatus(result) {
         return null;
     return storedCount > 0 || environmentCount > 0 ? 'connected' : 'disconnected';
 }
+function parsePiStatus(result) {
+    if (result.exitCode !== 0)
+        return null;
+    const lines = normalizedLines(result.stdout);
+    if (lines.some((line) => /^provider\s+model\s+context\s+max-out\s+thinking\s+images$/.test(line))) {
+        return 'connected';
+    }
+    if (lines.some((line) => line.includes('no models available'))
+        && lines.some((line) => line.includes('/login'))) {
+        return 'disconnected';
+    }
+    return null;
+}
 const DESCRIPTORS = [
     {
         id: 'claude',
@@ -128,10 +195,26 @@ const DESCRIPTORS = [
         installHint: 'Install OpenCode, then run `opencode auth login`.',
         parse: parseOpenCodeStatus,
     },
+    {
+        id: 'pi',
+        executable: () => process.env.CEZ_PI_BIN ?? 'pi',
+        statusArgs: ['--list-models'],
+        loginArgs: ['/login'],
+        installHint: 'Install pi, then run `pi /login`.',
+        parse: parsePiStatus,
+    },
 ];
-function defaultRunProviderCommand(executable, args, timeoutMs) {
+function defaultRunProviderCommand(executable, args, timeoutMs, env) {
     return new Promise((resolve) => {
-        execFile(executable, args, { timeout: timeoutMs, windowsHide: true, maxBuffer: 256 * 1024 }, (error, stdout, stderr) => {
+        execFile(executable, args, {
+            timeout: timeoutMs,
+            windowsHide: true,
+            maxBuffer: 256 * 1024,
+            // Inherit, then override: an auth probe is a short read-only CLI call, not a spawned
+            // agent, so it does not go through `buildChildEnv`'s allowlist — the CLI still needs the
+            // host's PATH and HOME to run at all. `env` is only ever a profile's config-dir variable.
+            ...(env && Object.keys(env).length > 0 ? { env: { ...process.env, ...env } } : {}),
+        }, (error, stdout, stderr) => {
             const commandError = error;
             const code = commandError?.code;
             resolve({
@@ -151,6 +234,11 @@ function quoteExecutable(executable, platform) {
     }
     return `'${executable.replaceAll("'", "'\\''")}'`;
 }
+/** The per-account cache key. ONE definition: a probe that wrote under a different spelling than
+ *  a peek reads would silently make every peek a miss, and every page load pay for a CLI spawn. */
+function profileCacheKey(provider, profileId) {
+    return `${provider}\u0000${profileId}`;
+}
 function descriptorFor(provider) {
     const descriptor = DESCRIPTORS.find(({ id }) => id === provider);
     if (!descriptor)
@@ -167,29 +255,57 @@ export class ProviderAuthService {
     nextProbeGeneration = 0;
     completed;
     inFlight;
+    /** Per-account probe results, keyed by `profileCacheKey` (spec 2026-07-29-agent-profiles).
+     *  Separate from `completed` because a second Claude login is a different answer to the same
+     *  question, and sharing one slot would let whichever probe ran last speak for both. */
+    completedProfiles = new Map();
+    inFlightProfiles = new Map();
     constructor(options) {
         this.runCommand = options?.runCommand ?? defaultRunProviderCommand;
         this.now = options?.now ?? Date.now;
         this.platform = options?.platform ?? process.platform;
         this.createAuthFailureId = options?.createAuthFailureId ?? randomUUID;
     }
+    /**
+     * Every provider's authentication state — STALE-WHILE-REVALIDATE, the same policy the health
+     * snapshot uses.
+     *
+     * Once anything is known, a reader gets it immediately and an expired cache is refreshed BEHIND
+     * the answer instead of in front of it. Awaiting the refresh is what made `GET
+     * /providers/status` cost ~0.8s here (and ~3s on a slower box) every time the window lapsed:
+     * the endpoint is read by the cockpit on a poll, so "occasionally slow" means "slow in the UI,
+     * unpredictably". Only a genuinely cold cache waits, and after the boot warm there isn't one.
+     *
+     * `refresh: true` still blocks — it is what "Check again", `POST /providers/connect` and the
+     * action gate's verify-before-refuse use, and they are asking precisely because they need an
+     * answer that is true NOW.
+     */
     status(options) {
-        if (process.env.CEZ_DRY_RUN === '1') {
+        if (process.env.CEZ_DRY_RUN === '1' || providerAuthChecksDisabled()) {
             return Promise.resolve({
                 providers: PROVIDER_IDS.map((provider) => ({ provider, status: 'connected' })),
             });
         }
-        if (this.inFlight) {
-            return this.inFlight.visible;
+        if (options?.refresh) {
+            // Joining a probe already running satisfies "true now" and preserves the in-flight identity
+            // contract (one shared promise for concurrent callers).
+            return this.inFlight ? this.inFlight.visible : this.startFreshProbe().visible;
         }
-        if (!options?.refresh && this.completed && this.now() - this.completed.timestamp < CACHE_TTL_MS) {
-            return Promise.resolve(this.completed.response)
-                .then((response) => this.withRuntimeFailures(response));
+        if (this.completed) {
+            // Checked BEFORE `inFlight` on purpose: a reader arriving during a background revalidation
+            // must be served from cache, not attached to the probe it was meant to avoid.
+            if (this.now() - this.completed.timestamp >= cacheTtlFor(this.completed.response.providers)) {
+                if (!this.inFlight)
+                    void this.startFreshProbe().raw.catch(() => { });
+            }
+            return Promise.resolve(this.withRuntimeFailures(this.completed.response));
         }
+        if (this.inFlight)
+            return this.inFlight.visible;
         return this.startFreshProbe().visible;
     }
     reportRuntimeAuthFailure(provider) {
-        if (process.env.CEZ_DRY_RUN === '1')
+        if (process.env.CEZ_DRY_RUN === '1' || providerAuthChecksDisabled())
             return null;
         const current = this.runtimeFailures.get(provider);
         const failure = {
@@ -216,9 +332,20 @@ export class ProviderAuthService {
         this.runtimeFailures.delete(provider);
         return true;
     }
-    loginCommand(provider) {
+    /**
+     * The command that logs `provider` in, as a copyable one-liner.
+     *
+     * `configDir` points the login at a specific agent account (spec 2026-07-29-agent-profiles) —
+     * without it, "Connect" on a second Claude account would sign the user into the FIRST one and
+     * report success. Returns `null` when the dir cannot be embedded safely on this platform, and
+     * the caller must then refuse rather than fall back to the bare command: a login aimed at the
+     * wrong account is the failure this whole path exists to prevent.
+     */
+    loginCommand(provider, configDir) {
         const descriptor = descriptorFor(provider);
-        return [quoteExecutable(descriptor.executable(), this.platform), ...descriptor.loginArgs].join(' ');
+        const command = [quoteExecutable(descriptor.executable(), this.platform), ...descriptor.loginArgs].join(' ');
+        const env = configDir ? profileEnv(provider, configDir) : {};
+        return withEnvPrefix(command, env, this.platform);
     }
     installHint(provider) {
         return descriptorFor(provider).installHint;
@@ -264,10 +391,102 @@ export class ProviderAuthService {
         });
         return probe;
     }
-    async probe(descriptor) {
+    /**
+     * One NON-default agent account's authentication state (spec 2026-07-29-agent-profiles).
+     *
+     * Deliberately a separate entry point from `status()`, which keeps answering exactly one row
+     * per provider — the discovered default — so `GET /api/v1/providers/status` is byte-identical
+     * for anyone with no extra accounts. Per-account rows are carried by the agent-profiles route.
+     *
+     * Cached on the same asymmetric lifetime as `status()` (`cacheTtlFor`: minutes for a connected
+     * answer, a minute for anything else), keyed by `(provider, profileId)` so two Claude accounts never read
+     * each other's answer. The runtime-auth latch is deliberately NOT applied: it is a coarse
+     * per-provider signal and stamping it onto every account of that provider would mark an
+     * untouched account as broken.
+     */
+    async profileStatus(provider, profile) {
+        if (process.env.CEZ_DRY_RUN === '1') {
+            return { provider, status: 'connected', profileId: profile.id };
+        }
+        const key = profileCacheKey(provider, profile.id);
+        const cached = this.completedProfiles.get(key);
+        if (cached && this.now() - cached.timestamp < cacheTtlFor([cached.status]))
+            return cached.status;
+        const pending = this.inFlightProfiles.get(key);
+        if (pending)
+            return pending;
+        const probe = this.probe(descriptorFor(provider), profile.configDir)
+            .then((status) => {
+            const stamped = { ...status, profileId: profile.id };
+            this.completedProfiles.set(key, { status: stamped, timestamp: this.now() });
+            return stamped;
+        })
+            .finally(() => {
+            if (this.inFlightProfiles.get(key) === probe)
+                this.inFlightProfiles.delete(key);
+        });
+        this.inFlightProfiles.set(key, probe);
+        return probe;
+    }
+    /**
+     * Drop a cached per-account answer — used when an account's dir changes under us.
+     *
+     * TARGETED by default, because this cache is warmed at boot and is meant to survive: clearing
+     * every account because ONE was repointed would throw away knowledge that is still true and make
+     * the other accounts re-probe. Called with no argument it clears everything, which is what a
+     * shutdown or a whole-store reload wants.
+     */
+    forgetProfileStatus(provider, profileId) {
+        if (provider === undefined || profileId === undefined) {
+            this.completedProfiles.clear();
+            return;
+        }
+        this.completedProfiles.delete(profileCacheKey(provider, profileId));
+    }
+    /**
+     * The cached answer for one account, or `undefined` when nothing is known yet — WITHOUT
+     * spawning anything.
+     *
+     * Every probe shells out to an agent CLI, which costs hundreds of milliseconds per provider and
+     * per account. A route whose real job is "what exists" must not pay that: `GET /api/v1/health`
+     * already established this posture (it serves whatever the cache holds and never pays a `gh`
+     * shell-out), and this is the same rule for auth.
+     *
+     * The peeks deliberately ignore the TTLs below — they answer with the last thing known, however
+     * old. The short window exists to stop a stale NEGATIVE from blocking a run, and a peek blocks
+     * nothing: it fills in a dot on a settings page that offers Connect and a re-check right beside
+     * it. Applying the window here instead made the whole cache expire in five seconds on any machine
+     * where a single provider is logged out — which is most of them, since few people are signed into
+     * all three — and put the shell-out straight back on the page load this exists to protect.
+     * Callers that need a guaranteed-fresh answer call {@link status} or pass `refresh`.
+     */
+    peekProfileStatus(provider, profileId) {
+        if (process.env.CEZ_DRY_RUN === '1') {
+            return { provider, status: 'connected', profileId };
+        }
+        return this.completedProfiles.get(profileCacheKey(provider, profileId))?.status;
+    }
+    /** The cached default-profile rows, or `undefined` when the probe has never completed. Same
+     *  no-spawn contract as {@link peekProfileStatus}. */
+    peekStatus() {
+        if (process.env.CEZ_DRY_RUN === '1') {
+            return { providers: PROVIDER_IDS.map((provider) => ({ provider, status: 'connected' })) };
+        }
+        if (!this.completed)
+            return undefined;
+        return this.withRuntimeFailures(this.completed.response);
+    }
+    async probe(descriptor, configDir) {
         let result;
+        // The default profile is probed with the SAME three-argument call it always was — no
+        // trailing `undefined`. `runCommand` is an injected seam, and handing every existing
+        // implementation an extra argument it never asked for would be a change in the zero-config
+        // path for no gain.
+        const env = configDir ? profileEnv(descriptor.id, configDir) : undefined;
         try {
-            result = await this.runCommand(descriptor.executable(), descriptor.statusArgs, COMMAND_TIMEOUT_MS);
+            result = await (env === undefined
+                ? this.runCommand(descriptor.executable(), descriptor.statusArgs, COMMAND_TIMEOUT_MS)
+                : this.runCommand(descriptor.executable(), descriptor.statusArgs, COMMAND_TIMEOUT_MS, env));
         }
         catch {
             return { provider: descriptor.id, status: 'unknown', hint: UNKNOWN_HINT };

package/dist/core/provider-auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-auth.js","sourceRoot":"","sources":["../../src/core/provider-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AAEzC,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,CAAU,CAAC;AA2CrE,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC,MAAM,YAAY,GAAG,KAAK,CAAC;AAC3B,MAAM,YAAY,GAAG,kDAAkD,CAAC;AACxE,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAClE,MAAM,iBAAiB,GACrB,sEAAsE,CAAC;AACzE,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,MAAM,6BAA6B,GAAG;IACpC,oFAAoF;IACpF,wBAAwB;IACxB,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;CACpE,CAAC;AACX,MAAM,gCAAgC,GAAG;IACvC,oEAAoE;IACpE,gEAAgE;IAChE,8OAA8O;IAC9O,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,kDAAkD;IAClD,kOAAkO;CAC1N,CAAC;AAEX,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,OAAO,CAAC,GAAG,6BAA6B,EAAE,GAAG,gCAAgC,CAAC;SAC3E,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,GAAG,OAAiB;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;SACxE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA6B;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA2B,CAAC;QAClE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,WAAW,CAAC;QACzE,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,cAAc,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA6B;IACrD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAkC,EAAE;QAC5C,IACE,IAAI,KAAK,yBAAyB;eAC/B,IAAI,KAAK,4BAA4B;eACrC,IAAI,KAAK,gCAAgC;eACzC,IAAI,KAAK,8BAA8B;eACvC,IAAI,KAAK,uCAAuC;eAChD,IAAI,KAAK,wCAAwC;eACjD,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,EACxE,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;YAC3E,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,MAAM,EAAqC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5E,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA6B;IACxD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,KAAK;SAC1B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3D,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,oBAAoB,GAAG,KAAK;SAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC9E,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3D,MAAM,mBAAmB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,mBAAmB,KAAK,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,KAAK,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC,CAAC;IACN,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,OAAO,WAAW,GAAG,CAAC,IAAI,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;AAChF,CAAC;AAED,MAAM,WAAW,GAAkC;IACjD;QACE,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,QAAQ;QACxD,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACxC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,oDAAoD;QACjE,KAAK,EAAE,iBAAiB;KACzB;IACD;QACE,EAAE,EAAE,OAAO;QACX,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO;QACtD,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,SAAS,EAAE,CAAC,OAAO,CAAC;QACpB,WAAW,EAAE,gDAAgD;QAC7D,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,EAAE,EAAE,UAAU;QACd,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,UAAU;QAC5D,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,mDAAmD;QAChE,KAAK,EAAE,mBAAmB;KAC3B;CACF,CAAC;AAEF,SAAS,yBAAyB,CAChC,UAAkB,EAClB,IAAuB,EACvB,SAAiB;IAEjB,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CACN,UAAU,EACV,IAAI,EACJ,EAAE,OAAO,EAAE,SAAS,EAAE,WAAW,EAAE,IAAI,EAAE,SAAS,EAAE,GAAG,GAAG,IAAI,EAAE,EAChE,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,YAAY,GAAG,KAGZ,CAAC;YACV,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,CAAC;YAChC,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,QAAQ,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5D,SAAS,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACtD,QAAQ,EAAE,YAAY,EAAE,IAAI,KAAK,WAAW;uBACvC,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC;aAC1E,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,QAAyB;IACpE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AACpD,CAAC;AAED,SAAS,aAAa,CAAC,QAAoB;IACzC,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IAClE,OAAO,UAAU,CAAC;AACpB,CAAC;AAmBD,MAAM,OAAO,mBAAmB;IACb,UAAU,CAAqB;IAC/B,GAAG,CAAe;IAClB,QAAQ,CAAkB;IAC1B,mBAAmB,CAAe;IAClC,eAAe,GAAG,IAAI,GAAG,EAAkC,CAAC;IACrE,4BAA4B,GAAG,CAAC,CAAC;IACjC,mBAAmB,GAAG,CAAC,CAAC;IACxB,SAAS,CAIf;IACM,QAAQ,CAGd;IAEF,YAAY,OAKX;QACC,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,yBAAyB,CAAC;QACnE,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACtD,IAAI,CAAC,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,IAAI,UAAU,CAAC;IACxE,CAAC;IAED,MAAM,CAAC,OAA+B;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAClB,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAC/B,CAAC;QACD,IAAI,CAAC,OAAO,EAAE,OAAO,IAAI,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,GAAG,YAAY,EAAE,CAAC;YAChG,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC;iBAC5C,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5D,CAAC;QACD,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC;IACxC,CAAC;IAED,wBAAwB,CAAC,QAAoB;QAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG;YAAE,OAAO,IAAI,CAAC;QACjD,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,OAAO,GAAuB;YAClC,UAAU,EAAE,EAAE,IAAI,CAAC,4BAA4B;YAC/C,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC,mBAAmB,EAAE;SACpE,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE;gBACN,QAAQ;gBACR,MAAM,EAAE,cAAc;gBACtB,IAAI,EAAE,iBAAiB;gBACvB,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC;YACD,YAAY,EAAE,OAAO,KAAK,SAAS;SACpC,CAAC;IACJ,CAAC;IAED;6EACyE;IACzE,uBAAuB,CAAC,QAAoB,EAAE,aAAqB;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,aAAa;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED,YAAY,CAAC,QAAoB;QAC/B,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,OAAO,CAAC,eAAe,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACtG,CAAC;IAED,WAAW,CAAC,QAAoB;QAC9B,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC;IAC7C,CAAC;IAEO,mBAAmB,CAAC,QAAgC;QAC1D,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACrD,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvD,OAAO,OAAO;oBACZ,CAAC,CAAC;wBACA,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,MAAM,EAAE,cAAc;wBACtB,IAAI,EAAE,iBAAiB;wBACvB,aAAa,EAAE,OAAO,CAAC,aAAa;qBACrC;oBACD,CAAC,CAAC,GAAG,CAAC;YACV,CAAC,CAAC;SACH,CAAC;IACJ,CAAC;IAEO,eAAe;QAIrB,MAAM,UAAU,GAAG,EAAE,IAAI,CAAC,mBAAmB,CAAC;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;aAC7E,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;YAClB,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;gBAC/D,IAAI,CAAC,SAAS,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC;YACnE,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACL,qEAAqE;QACrE,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,KAAK,GAAG;YACZ,GAAG;YACH,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;SACpE,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE;YACpB,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;gBAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,UAA8B;QAChD,IAAI,MAA6B,CAAC;QAClC,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,UAAU,EAAE,kBAAkB,CAAC,CAAC;QACrG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;QAC5F,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;QAChE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC;CACF"}
+{"version":3,"file":"provider-auth.js","sourceRoot":"","sources":["../../src/core/provider-auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,UAAU,EAAE,MAAM,aAAa,CAAC;AACzC,OAAO,EAAE,uBAAuB,EAAE,MAAM,yBAAyB,CAAC;AAClE,OAAO,EAAE,UAAU,EAAE,MAAM,qBAAqB,CAAC;AACjD,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,MAAM,CAAC,MAAM,YAAY,GAAG,CAAC,QAAQ,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,CAAU,CAAC;AA0C3E;;;;;;;GAOG;AACH,MAAM,UAAU,0BAA0B,CACxC,GAAG,GAAsB,OAAO,CAAC,GAAG;IAEpC,OAAO,GAAG,CAAC,uBAAuB,CAAC,KAAK,GAAG,CAAC;AAC9C,CAAC;AAWD,MAAM,kBAAkB,GAAG,MAAM,CAAC;AAClC;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,MAAM,gBAAgB,GAAG,EAAE,GAAG,MAAM,CAAC;AACrC,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAEhC;;;;;;oDAMoD;AACpD,SAAS,WAAW,CAAC,IAA+B;IAClD,OAAO,IAAI,CAAC,KAAK,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC;AAC/F,CAAC;AACD,MAAM,YAAY,GAAG,kDAAkD,CAAC;AACxE,MAAM,YAAY,GAAG,4CAA4C,CAAC;AAClE,MAAM,iBAAiB,GACrB,sEAAsE,CAAC;AACzE,MAAM,aAAa,GAAG,4BAA4B,CAAC;AACnD,MAAM,6BAA6B,GAAG;IACpC,oFAAoF;IACpF,wBAAwB;IACxB,8EAA8E;IAC9E,8EAA8E;IAC9E,4EAA4E;IAC5E,4EAA4E;CACpE,CAAC;AACX,MAAM,gCAAgC,GAAG;IACvC,oEAAoE;IACpE,gEAAgE;IAChE,8OAA8O;IAC9O,sEAAsE;IACtE,2EAA2E;IAC3E,uEAAuE;IACvE,kDAAkD;IAClD,kOAAkO;CAC1N,CAAC;AAEX,MAAM,UAAU,4BAA4B,CAAC,OAAe;IAC1D,OAAO,CAAC,GAAG,6BAA6B,EAAE,GAAG,gCAAgC,CAAC;SAC3E,IAAI,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC;AAC9C,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAc;IACtC,OAAO,MAAM,CAAC,OAAO,CAAC,aAAa,EAAE,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AAChE,CAAC;AAED,SAAS,eAAe,CAAC,GAAG,OAAiB;IAC3C,OAAO,OAAO,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,gBAAgB,CAAC,MAAM,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;SACxE,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;SAC1B,MAAM,CAAC,OAAO,CAAC,CAAC;AACrB,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA6B;IACtD,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,CAA2B,CAAC;QAClE,IAAI,KAAK,CAAC,QAAQ,KAAK,IAAI,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,WAAW,CAAC;QACzE,IAAI,KAAK,CAAC,QAAQ,KAAK,KAAK,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;YAAE,OAAO,cAAc,CAAC;QAC7E,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,gBAAgB,CAAC,MAA6B;IACrD,MAAM,OAAO,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;SAC1D,GAAG,CAAC,CAAC,IAAI,EAAkC,EAAE;QAC5C,IACE,IAAI,KAAK,yBAAyB;eAC/B,IAAI,KAAK,4BAA4B;eACrC,IAAI,KAAK,gCAAgC;eACzC,IAAI,KAAK,8BAA8B;eACvC,IAAI,KAAK,uCAAuC;eAChD,IAAI,KAAK,wCAAwC;eACjD,0DAA0D,CAAC,IAAI,CAAC,IAAI,CAAC,EACxE,CAAC;YACD,OAAO,WAAW,CAAC;QACrB,CAAC;QACD,IAAI,IAAI,KAAK,eAAe,IAAI,IAAI,KAAK,iCAAiC,EAAE,CAAC;YAC3E,OAAO,cAAc,CAAC;QACxB,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,MAAM,EAAqC,EAAE,CAAC,MAAM,KAAK,IAAI,CAAC,CAAC;IAC1E,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACtC,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,WAAW,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,WAAW,CAAC;IAC5E,IAAI,OAAO,CAAC,CAAC,CAAC,KAAK,cAAc,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,cAAc,CAAC;IAClF,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA6B;IACxD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,MAAM,eAAe,GAAG,KAAK;SAC1B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,kCAAkC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAClE,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3D,IAAI,eAAe,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IAC9C,MAAM,WAAW,GAAG,MAAM,CAAC,eAAe,CAAC,CAAC,CAAC,CAAC,CAAC;IAC/C,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,WAAW,CAAC;QAAE,OAAO,IAAI,CAAC;IAEpD,MAAM,oBAAoB,GAAG,KAAK;SAC/B,GAAG,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,8CAA8C,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;SAC9E,MAAM,CAAC,CAAC,KAAK,EAAmB,EAAE,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC;IAC3D,MAAM,mBAAmB,GAAG,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,yBAAyB,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC;IACvF,IAAI,oBAAoB,CAAC,MAAM,GAAG,CAAC;QAAE,OAAO,IAAI,CAAC;IACjD,IAAI,mBAAmB,KAAK,CAAC,oBAAoB,CAAC,MAAM,KAAK,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IAC7E,MAAM,gBAAgB,GAAG,oBAAoB,CAAC,MAAM,KAAK,CAAC;QACxD,CAAC,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,CAAC,CAAC;QACjC,CAAC,CAAC,CAAC,CAAC;IACN,IAAI,CAAC,MAAM,CAAC,aAAa,CAAC,gBAAgB,CAAC;QAAE,OAAO,IAAI,CAAC;IAEzD,OAAO,WAAW,GAAG,CAAC,IAAI,gBAAgB,GAAG,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,cAAc,CAAC;AAChF,CAAC;AAED,SAAS,aAAa,CAAC,MAA6B;IAClD,IAAI,MAAM,CAAC,QAAQ,KAAK,CAAC;QAAE,OAAO,IAAI,CAAC;IACvC,MAAM,KAAK,GAAG,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IAC7C,IAAI,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,4DAA4D,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,EAAE,CAAC;QAClG,OAAO,WAAW,CAAC;IACrB,CAAC;IACD,IACE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,qBAAqB,CAAC,CAAC;WACvD,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,EAAE,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC,EAChD,CAAC;QACD,OAAO,cAAc,CAAC;IACxB,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,MAAM,WAAW,GAAkC;IACjD;QACE,EAAE,EAAE,QAAQ;QACZ,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,cAAc,IAAI,QAAQ;QACxD,UAAU,EAAE,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,CAAC;QACxC,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,oDAAoD;QACjE,KAAK,EAAE,iBAAiB;KACzB;IACD;QACE,EAAE,EAAE,OAAO;QACX,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,aAAa,IAAI,OAAO;QACtD,UAAU,EAAE,CAAC,OAAO,EAAE,QAAQ,CAAC;QAC/B,SAAS,EAAE,CAAC,OAAO,CAAC;QACpB,WAAW,EAAE,gDAAgD;QAC7D,KAAK,EAAE,gBAAgB;KACxB;IACD;QACE,EAAE,EAAE,UAAU;QACd,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,gBAAgB,IAAI,UAAU;QAC5D,UAAU,EAAE,CAAC,MAAM,EAAE,MAAM,CAAC;QAC5B,SAAS,EAAE,CAAC,MAAM,EAAE,OAAO,CAAC;QAC5B,WAAW,EAAE,mDAAmD;QAChE,KAAK,EAAE,mBAAmB;KAC3B;IACD;QACE,EAAE,EAAE,IAAI;QACR,UAAU,EAAE,GAAG,EAAE,CAAC,OAAO,CAAC,GAAG,CAAC,UAAU,IAAI,IAAI;QAChD,UAAU,EAAE,CAAC,eAAe,CAAC;QAC7B,SAAS,EAAE,CAAC,QAAQ,CAAC;QACrB,WAAW,EAAE,mCAAmC;QAChD,KAAK,EAAE,aAAa;KACrB;CACF,CAAC;AAEF,SAAS,yBAAyB,CAChC,UAAkB,EAClB,IAAuB,EACvB,SAAiB,EACjB,GAA4B;IAE5B,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;QAC7B,QAAQ,CACN,UAAU,EACV,IAAI,EACJ;YACE,OAAO,EAAE,SAAS;YAClB,WAAW,EAAE,IAAI;YACjB,SAAS,EAAE,GAAG,GAAG,IAAI;YACrB,qFAAqF;YACrF,yFAAyF;YACzF,0FAA0F;YAC1F,GAAG,CAAC,GAAG,IAAI,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SACnF,EACD,CAAC,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YACxB,MAAM,YAAY,GAAG,KAGZ,CAAC;YACV,MAAM,IAAI,GAAG,YAAY,EAAE,IAAI,CAAC;YAChC,OAAO,CAAC;gBACN,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC;gBACtB,QAAQ,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;gBAC5D,SAAS,EAAE,OAAO,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,SAAS;gBACtD,QAAQ,EAAE,YAAY,EAAE,IAAI,KAAK,WAAW;uBACvC,CAAC,YAAY,EAAE,MAAM,KAAK,IAAI,IAAI,YAAY,CAAC,MAAM,KAAK,SAAS,CAAC;aAC1E,CAAC,CAAC;QACL,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED,SAAS,eAAe,CAAC,UAAkB,EAAE,QAAyB;IACpE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,IAAI,UAAU,CAAC,OAAO,CAAC,SAAS,EAAE,KAAK,CAAC,GAAG,CAAC;IACrD,CAAC;IACD,OAAO,IAAI,UAAU,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AACpD,CAAC;AAED;mGACmG;AACnG,SAAS,eAAe,CAAC,QAAoB,EAAE,SAAiB;IAC9D,OAAO,GAAG,QAAQ,SAAS,SAAS,EAAE,CAAC;AACzC,CAAC;AAED,SAAS,aAAa,CAAC,QAAoB;IACzC,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,EAAE,KAAK,QAAQ,CAAC,CAAC;IACjE,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,qBAAqB,QAAQ,EAAE,CAAC,CAAC;IAClE,OAAO,UAAU,CAAC;AACpB,CAAC;AAmBD,MAAM,OAAO,mBAAmB;IACb,UAAU,CAAqB;IAC/B,GAAG,CAAe;IAClB,QAAQ,CAAkB;IAC1B,mBAAmB,CAAe;IAClC,eAAe,GAAG,IAAI,GAAG,EAAkC,CAAC;IACrE,4BAA4B,GAAG,CAAC,CAAC;IACjC,mBAAmB,GAAG,CAAC,CAAC;IACxB,SAAS,CAIf;IACM,QAAQ,CAGd;IACF;;4FAEwF;IACvE,iBAAiB,GAAG,IAAI,GAAG,EAAyD,CAAC;IACrF,gBAAgB,GAAG,IAAI,GAAG,EAAmC,CAAC;IAE/E,YAAY,OAKX;QACC,IAAI,CAAC,UAAU,GAAG,OAAO,EAAE,UAAU,IAAI,yBAAyB,CAAC;QACnE,IAAI,CAAC,GAAG,GAAG,OAAO,EAAE,GAAG,IAAI,IAAI,CAAC,GAAG,CAAC;QACpC,IAAI,CAAC,QAAQ,GAAG,OAAO,EAAE,QAAQ,IAAI,OAAO,CAAC,QAAQ,CAAC;QACtD,IAAI,CAAC,mBAAmB,GAAG,OAAO,EAAE,mBAAmB,IAAI,UAAU,CAAC;IACxE,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,MAAM,CAAC,OAA+B;QACpC,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,IAAI,0BAA0B,EAAE,EAAE,CAAC;YACpE,OAAO,OAAO,CAAC,OAAO,CAAC;gBACrB,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;aAC/E,CAAC,CAAC;QACL,CAAC;QAED,IAAI,OAAO,EAAE,OAAO,EAAE,CAAC;YACrB,4FAA4F;YAC5F,wDAAwD;YACxD,OAAO,IAAI,CAAC,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC;QAChF,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,2FAA2F;YAC3F,8EAA8E;YAC9E,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,SAAS,CAAC,SAAS,IAAI,WAAW,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;gBAC5F,IAAI,CAAC,IAAI,CAAC,QAAQ;oBAAE,KAAK,IAAI,CAAC,eAAe,EAAE,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,GAAE,CAAC,CAAC,CAAC;YACtE,CAAC;YACD,OAAO,OAAO,CAAC,OAAO,CAAC,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC,CAAC;QAC5E,CAAC;QACD,IAAI,IAAI,CAAC,QAAQ;YAAE,OAAO,IAAI,CAAC,QAAQ,CAAC,OAAO,CAAC;QAChD,OAAO,IAAI,CAAC,eAAe,EAAE,CAAC,OAAO,CAAC;IACxC,CAAC;IAED,wBAAwB,CAAC,QAAoB;QAC3C,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,IAAI,0BAA0B,EAAE;YAAE,OAAO,IAAI,CAAC;QACjF,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,MAAM,OAAO,GAAuB;YAClC,UAAU,EAAE,EAAE,IAAI,CAAC,4BAA4B;YAC/C,aAAa,EAAE,OAAO,EAAE,aAAa,IAAI,IAAI,CAAC,mBAAmB,EAAE;SACpE,CAAC;QACF,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;QAC5C,OAAO;YACL,MAAM,EAAE;gBACN,QAAQ;gBACR,MAAM,EAAE,cAAc;gBACtB,IAAI,EAAE,iBAAiB;gBACvB,aAAa,EAAE,OAAO,CAAC,aAAa;aACrC;YACD,YAAY,EAAE,OAAO,KAAK,SAAS;SACpC,CAAC;IACJ,CAAC;IAED;6EACyE;IACzE,uBAAuB,CAAC,QAAoB,EAAE,aAAqB;QACjE,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;QACnD,IAAI,CAAC,OAAO,IAAI,OAAO,CAAC,aAAa,KAAK,aAAa;YAAE,OAAO,KAAK,CAAC;QACtE,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC;QACtC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;OAQG;IACH,YAAY,CAAC,QAAoB,EAAE,SAAyB;QAC1D,MAAM,UAAU,GAAG,aAAa,CAAC,QAAQ,CAAC,CAAC;QAC3C,MAAM,OAAO,GAAG,CAAC,eAAe,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,IAAI,CAAC,QAAQ,CAAC,EAAE,GAAG,UAAU,CAAC,SAAS,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAC7G,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;QAC7D,OAAO,aAAa,CAAC,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;IACpD,CAAC;IAED,WAAW,CAAC,QAAoB;QAC9B,OAAO,aAAa,CAAC,QAAQ,CAAC,CAAC,WAAW,CAAC;IAC7C,CAAC;IAEO,mBAAmB,CAAC,QAAgC;QAC1D,IAAI,IAAI,CAAC,eAAe,CAAC,IAAI,KAAK,CAAC;YAAE,OAAO,QAAQ,CAAC;QACrD,OAAO;YACL,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;gBACxC,MAAM,OAAO,GAAG,IAAI,CAAC,eAAe,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;gBACvD,OAAO,OAAO;oBACZ,CAAC,CAAC;wBACA,QAAQ,EAAE,GAAG,CAAC,QAAQ;wBACtB,MAAM,EAAE,cAAc;wBACtB,IAAI,EAAE,iBAAiB;wBACvB,aAAa,EAAE,OAAO,CAAC,aAAa;qBACrC;oBACD,CAAC,CAAC,GAAG,CAAC;YACV,CAAC,CAAC;SACH,CAAC;IACJ,CAAC;IAEO,eAAe;QAIrB,MAAM,UAAU,GAAG,EAAE,IAAI,CAAC,mBAAmB,CAAC;QAC9C,MAAM,GAAG,GAAG,OAAO,CAAC,GAAG,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC,UAAU,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,CAAC;aAC7E,IAAI,CAAC,CAAC,SAAS,EAAE,EAAE;YAClB,MAAM,QAAQ,GAAG,EAAE,SAAS,EAAE,CAAC;YAC/B,IAAI,CAAC,IAAI,CAAC,SAAS,IAAI,UAAU,IAAI,IAAI,CAAC,SAAS,CAAC,UAAU,EAAE,CAAC;gBAC/D,IAAI,CAAC,SAAS,GAAG,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,UAAU,EAAE,CAAC;YACnE,CAAC;YACD,OAAO,QAAQ,CAAC;QAClB,CAAC,CAAC,CAAC;QACL,qEAAqE;QACrE,uEAAuE;QACvE,gDAAgD;QAChD,MAAM,KAAK,GAAG;YACZ,GAAG;YACH,OAAO,EAAE,GAAG,CAAC,IAAI,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,IAAI,CAAC,mBAAmB,CAAC,QAAQ,CAAC,CAAC;SACpE,CAAC;QACF,IAAI,CAAC,QAAQ,GAAG,KAAK,CAAC;QACtB,KAAK,GAAG,CAAC,OAAO,CAAC,GAAG,EAAE;YACpB,IAAI,IAAI,CAAC,QAAQ,KAAK,KAAK;gBAAE,IAAI,CAAC,QAAQ,GAAG,SAAS,CAAC;QACzD,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;;;;;;OAYG;IACH,KAAK,CAAC,aAAa,CACjB,QAAoB,EACpB,OAAiD;QAEjD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;QAClE,CAAC;QACD,MAAM,GAAG,GAAG,eAAe,CAAC,QAAQ,EAAE,OAAO,CAAC,EAAE,CAAC,CAAC;QAClD,MAAM,MAAM,GAAG,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,MAAM,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,SAAS,GAAG,WAAW,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;YAAE,OAAO,MAAM,CAAC,MAAM,CAAC;QACjG,MAAM,OAAO,GAAG,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,CAAC;QAC/C,IAAI,OAAO;YAAE,OAAO,OAAO,CAAC;QAC5B,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC,SAAS,CAAC;aACjE,IAAI,CAAC,CAAC,MAAM,EAAE,EAAE;YACf,MAAM,OAAO,GAAmB,EAAE,GAAG,MAAM,EAAE,SAAS,EAAE,OAAO,CAAC,EAAE,EAAE,CAAC;YACrE,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,GAAG,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC5E,OAAO,OAAO,CAAC;QACjB,CAAC,CAAC;aACD,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,KAAK;gBAAE,IAAI,CAAC,gBAAgB,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAClF,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,gBAAgB,CAAC,GAAG,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;QACtC,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;;;;OAOG;IACH,mBAAmB,CAAC,QAAqB,EAAE,SAAkB;QAC3D,IAAI,QAAQ,KAAK,SAAS,IAAI,SAAS,KAAK,SAAS,EAAE,CAAC;YACtD,IAAI,CAAC,iBAAiB,CAAC,KAAK,EAAE,CAAC;YAC/B,OAAO;QACT,CAAC;QACD,IAAI,CAAC,iBAAiB,CAAC,MAAM,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,CAAC;IACtE,CAAC;IAED;;;;;;;;;;;;;;;;OAgBG;IACH,iBAAiB,CAAC,QAAoB,EAAE,SAAiB;QACvD,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,SAAS,EAAE,CAAC;QACtD,CAAC;QACD,OAAO,IAAI,CAAC,iBAAiB,CAAC,GAAG,CAAC,eAAe,CAAC,QAAQ,EAAE,SAAS,CAAC,CAAC,EAAE,MAAM,CAAC;IAClF,CAAC;IAED;0DACsD;IACtD,UAAU;QACR,IAAI,OAAO,CAAC,GAAG,CAAC,WAAW,KAAK,GAAG,EAAE,CAAC;YACpC,OAAO,EAAE,SAAS,EAAE,YAAY,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,QAAQ,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC,EAAE,CAAC;QAC5F,CAAC;QACD,IAAI,CAAC,IAAI,CAAC,SAAS;YAAE,OAAO,SAAS,CAAC;QACtC,OAAO,IAAI,CAAC,mBAAmB,CAAC,IAAI,CAAC,SAAS,CAAC,QAAQ,CAAC,CAAC;IAC3D,CAAC;IAEO,KAAK,CAAC,KAAK,CAAC,UAA8B,EAAE,SAAyB;QAC3E,IAAI,MAA6B,CAAC;QAClC,qFAAqF;QACrF,qFAAqF;QACrF,2FAA2F;QAC3F,oBAAoB;QACpB,MAAM,GAAG,GAAG,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,CAAC;QACzE,IAAI,CAAC;YACH,MAAM,GAAG,MAAM,CAAC,GAAG,KAAK,SAAS;gBAC/B,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,UAAU,EAAE,kBAAkB,CAAC;gBACrF,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,EAAE,EAAE,UAAU,CAAC,UAAU,EAAE,kBAAkB,EAAE,GAAG,CAAC,CAAC,CAAC;QAChG,CAAC;QAAC,MAAM,CAAC;YACP,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,KAAK,QAAQ,EAAE,CAAC;YAClC,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,eAAe,EAAE,IAAI,EAAE,UAAU,CAAC,WAAW,EAAE,CAAC;QAC5F,CAAC;QACD,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;YACpB,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC5E,CAAC;QACD,IAAI,MAAM,CAAC,SAAS,EAAE,CAAC;YACrB,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;QAC5E,CAAC;QACD,MAAM,MAAM,GAAG,UAAU,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC;QACxC,IAAI,MAAM,KAAK,IAAI;YAAE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,CAAC;QAChE,OAAO,EAAE,QAAQ,EAAE,UAAU,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;IAC5E,CAAC;CACF"}

package/dist/core/provider-availability.d.ts

@@ -1,3 +1,3 @@
-import type { ProviderId, ProviderStatus, ProviderStatusResponse } from './provider-auth.ts';
+import { type ProviderId, type ProviderStatus, type ProviderStatusResponse } from './provider-auth.ts';
 export declare function applyProviderEnablement(response: ProviderStatusResponse, disabledProviders: readonly ProviderId[]): ProviderStatusResponse;
 export declare function isProviderUsable(row: ProviderStatus): boolean;

package/dist/core/provider-availability.js

@@ -1,5 +1,6 @@
+import { providerAuthChecksDisabled, } from './provider-auth.js';
 export function applyProviderEnablement(response, disabledProviders) {
-    const disabled = new Set(disabledProviders);
+    const disabled = new Set(providerAuthChecksDisabled() ? [] : disabledProviders);
     return {
         providers: response.providers.map((row) => ({
             ...row,

package/dist/core/provider-availability.js.map

@@ -1 +1 @@
-{"version":3,"file":"provider-availability.js","sourceRoot":"","sources":["../../src/core/provider-availability.ts"],"names":[],"mappings":"AAMA,MAAM,UAAU,uBAAuB,CACrC,QAAgC,EAChC,iBAAwC;IAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC5C,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1C,GAAG,GAAG;YACN,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;SACrC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IAClD,OAAO,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;AAC7D,CAAC"}
+{"version":3,"file":"provider-availability.js","sourceRoot":"","sources":["../../src/core/provider-availability.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,0BAA0B,GAI3B,MAAM,oBAAoB,CAAC;AAE5B,MAAM,UAAU,uBAAuB,CACrC,QAAgC,EAChC,iBAAwC;IAExC,MAAM,QAAQ,GAAG,IAAI,GAAG,CACtB,0BAA0B,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,iBAAiB,CACtD,CAAC;IACF,OAAO;QACL,SAAS,EAAE,QAAQ,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;YAC1C,GAAG,GAAG;YACN,OAAO,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,GAAG,CAAC,QAAQ,CAAC;SACrC,CAAC,CAAC;KACJ,CAAC;AACJ,CAAC;AAED,MAAM,UAAU,gBAAgB,CAAC,GAAmB;IAClD,OAAO,GAAG,CAAC,OAAO,KAAK,KAAK,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,CAAC;AAC7D,CAAC"}

package/dist/core/runner-factory.js

@@ -1,6 +1,7 @@
 import { ClaudeCliRunner } from './claude-cli-runner.js';
 import { CodexAppServerRunner } from './codex-app-server-runner.js';
 import { OpencodeServerRunner } from './opencode-server-runner.js';
+import { PiRunner } from './pi-runner.js';
 /**
  * The single place that maps a backend id onto a concrete runner. Everything
  * that used to `new ClaudeCliRunner()` (the planner and the workflow engine)
@@ -13,6 +14,8 @@ export function createRunner(backend) {
             return new CodexAppServerRunner();
         case 'opencode':
             return new OpencodeServerRunner();
+        case 'pi':
+            return new PiRunner();
         case 'claude':
         case 'claude-cli':
         default:

package/dist/core/runner-factory.js.map

@@ -1 +1 @@
-{"version":3,"file":"runner-factory.js","sourceRoot":"","sources":["../../src/core/runner-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AAEnE;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4C;IACvE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACpC,KAAK,UAAU;YACb,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACpC,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY,CAAC;QAClB;YACE,OAAO,IAAI,eAAe,EAAE,CAAC;IACjC,CAAC;AACH,CAAC"}
+{"version":3,"file":"runner-factory.js","sourceRoot":"","sources":["../../src/core/runner-factory.ts"],"names":[],"mappings":"AACA,OAAO,EAAE,eAAe,EAAE,MAAM,wBAAwB,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,8BAA8B,CAAC;AACpE,OAAO,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnE,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAE1C;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,OAA4C;IACvE,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,OAAO;YACV,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACpC,KAAK,UAAU;YACb,OAAO,IAAI,oBAAoB,EAAE,CAAC;QACpC,KAAK,IAAI;YACP,OAAO,IAAI,QAAQ,EAAE,CAAC;QACxB,KAAK,QAAQ,CAAC;QACd,KAAK,YAAY,CAAC;QAClB;YACE,OAAO,IAAI,eAAe,EAAE,CAAC;IACjC,CAAC;AACH,CAAC"}

package/dist/core/shell-env.d.ts

@@ -0,0 +1,28 @@
+/**
+ * Rendering environment assignments into a shell command line — the CLI-handoff half of agent
+ * profiles (spec 2026-07-29-agent-profiles).
+ *
+ * A run executed under a second account only resumes under that same account: `claude --resume
+ * <id>` reads `<CLAUDE_CONFIG_DIR>/sessions`, so a handoff without the variable does not fail
+ * loudly — it silently starts a fresh conversation. The variable therefore has to travel with
+ * every command cezar hands to a terminal, and it has to SURVIVE the command, because the window
+ * stays open and the user types the next `claude` in it themselves. Hence `export` / `set` rather
+ * than a one-shot `VAR=v cmd` prefix.
+ *
+ * There is no portable spelling: `VAR=v cmd` is meaningless to `cmd.exe`, and `set "VAR=v"` is
+ * meaningless to a POSIX shell. So this renders per platform, and — the load-bearing part —
+ * refuses rather than guesses. `null` means "this value cannot be embedded safely here", and
+ * every caller must then fail closed: opening a terminal on the WRONG account is worse than not
+ * opening one, because the user cannot see which account a shell is pointed at.
+ */
+/** POSIX single-quoting — the `'\''` dance, so any character but a control one is inert. */
+export declare function shellQuote(value: string): string;
+/**
+ * Assignments that persist for the rest of the shell session, or `null` when any value cannot be
+ * embedded safely on `platform`. An empty `env` renders `''` — the zero-config path adds nothing.
+ *
+ * The result is a PREFIX ready to concatenate: it already ends with its own separator.
+ */
+export declare function renderEnvPrefix(env: Record<string, string>, platform: NodeJS.Platform): string | null;
+/** `renderEnvPrefix` applied to a command, or `null` when the env cannot be rendered safely. */
+export declare function withEnvPrefix(command: string, env: Record<string, string>, platform: NodeJS.Platform): string | null;

package/dist/core/shell-env.js

@@ -0,0 +1,56 @@
+/**
+ * Rendering environment assignments into a shell command line — the CLI-handoff half of agent
+ * profiles (spec 2026-07-29-agent-profiles).
+ *
+ * A run executed under a second account only resumes under that same account: `claude --resume
+ * <id>` reads `<CLAUDE_CONFIG_DIR>/sessions`, so a handoff without the variable does not fail
+ * loudly — it silently starts a fresh conversation. The variable therefore has to travel with
+ * every command cezar hands to a terminal, and it has to SURVIVE the command, because the window
+ * stays open and the user types the next `claude` in it themselves. Hence `export` / `set` rather
+ * than a one-shot `VAR=v cmd` prefix.
+ *
+ * There is no portable spelling: `VAR=v cmd` is meaningless to `cmd.exe`, and `set "VAR=v"` is
+ * meaningless to a POSIX shell. So this renders per platform, and — the load-bearing part —
+ * refuses rather than guesses. `null` means "this value cannot be embedded safely here", and
+ * every caller must then fail closed: opening a terminal on the WRONG account is worse than not
+ * opening one, because the user cannot see which account a shell is pointed at.
+ */
+/** Values that cannot be embedded safely, per platform. Control characters are rejected
+ *  everywhere (they would break the line-based launch script and are never a real path). */
+const CONTROL_CHARS_RE = /[\u0000-\u001f\u007f]/;
+/** `cmd.exe` has no escape inside a quoted `set` argument: `"` ends the quote and `%`/`!` expand.
+ *  A path containing one is pathological, so refusing is honest rather than limiting. */
+const WIN32_UNSAFE_RE = /["%!]/;
+/** POSIX single-quoting — the `'\''` dance, so any character but a control one is inert. */
+export function shellQuote(value) {
+    return `'${value.replaceAll("'", `'\\''`)}'`;
+}
+/**
+ * Assignments that persist for the rest of the shell session, or `null` when any value cannot be
+ * embedded safely on `platform`. An empty `env` renders `''` — the zero-config path adds nothing.
+ *
+ * The result is a PREFIX ready to concatenate: it already ends with its own separator.
+ */
+export function renderEnvPrefix(env, platform) {
+    const entries = Object.entries(env);
+    if (entries.length === 0)
+        return '';
+    for (const [name, value] of entries) {
+        if (CONTROL_CHARS_RE.test(name) || CONTROL_CHARS_RE.test(value))
+            return null;
+        if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name))
+            return null;
+        if (platform === 'win32' && (WIN32_UNSAFE_RE.test(name) || WIN32_UNSAFE_RE.test(value)))
+            return null;
+    }
+    if (platform === 'win32') {
+        return entries.map(([name, value]) => `set "${name}=${value}" && `).join('');
+    }
+    return entries.map(([name, value]) => `export ${name}=${shellQuote(value)}; `).join('');
+}
+/** `renderEnvPrefix` applied to a command, or `null` when the env cannot be rendered safely. */
+export function withEnvPrefix(command, env, platform) {
+    const prefix = renderEnvPrefix(env, platform);
+    return prefix === null ? null : `${prefix}${command}`;
+}
+//# sourceMappingURL=shell-env.js.map

package/dist/core/shell-env.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-env.js","sourceRoot":"","sources":["../../src/core/shell-env.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH;4FAC4F;AAC5F,MAAM,gBAAgB,GAAG,uBAAuB,CAAC;AACjD;yFACyF;AACzF,MAAM,eAAe,GAAG,OAAO,CAAC;AAEhC,4FAA4F;AAC5F,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,IAAI,KAAK,CAAC,UAAU,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC;AAC/C,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,eAAe,CAC7B,GAA2B,EAC3B,QAAyB;IAEzB,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACpC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,EAAE,CAAC;IACpC,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,OAAO,EAAE,CAAC;QACpC,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC;YAAE,OAAO,IAAI,CAAC;QAC7E,IAAI,CAAC,0BAA0B,CAAC,IAAI,CAAC,IAAI,CAAC;YAAE,OAAO,IAAI,CAAC;QACxD,IAAI,QAAQ,KAAK,OAAO,IAAI,CAAC,eAAe,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,eAAe,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;YAAE,OAAO,IAAI,CAAC;IACvG,CAAC;IACD,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,QAAQ,IAAI,IAAI,KAAK,OAAO,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;IAC/E,CAAC;IACD,OAAO,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,UAAU,IAAI,IAAI,UAAU,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,aAAa,CAC3B,OAAe,EACf,GAA2B,EAC3B,QAAyB;IAEzB,MAAM,MAAM,GAAG,eAAe,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,OAAO,MAAM,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,GAAG,MAAM,GAAG,OAAO,EAAE,CAAC;AACxD,CAAC"}

package/dist/core/ui-events.d.ts

@@ -24,7 +24,7 @@
 /** The backend that produced a session — mirrors `RunnerId` in
  *  `agent-runner.ts` (kept structurally identical; a type-level test
  *  guards against drift so this module stays dependency-free). */
-export type UiBackend = 'claude' | 'codex' | 'opencode';
+export type UiBackend = 'claude' | 'codex' | 'opencode' | 'pi';
 /**
  * Tool lifecycle status (ACP: pending/in_progress/completed/failed).
  * `running` ≡ ACP `in_progress` (opencode's word — reads better in code);

package/dist/core/usage-limit.d.ts

@@ -0,0 +1,42 @@
+/**
+ * Provider usage-limit detection (spec 2026-08-03-auto-resume-after-usage-limit).
+ *
+ * A subscription that runs out of its window does not fail like an agent bug does: the work is
+ * fine, the account is simply closed until a KNOWN instant. That instant is the whole feature —
+ * without it there is nothing to schedule, so this module answers exactly one question about a
+ * terminal error string: "is this a usage limit, and when does it lift?".
+ *
+ * The evidence differs per backend, so the shapes are recognized in order of how exact they are:
+ *
+ *  1. Claude Code's machine-readable envelope, `Claude AI usage limit reached|<epoch>` — the CLI
+ *     puts it in an `is_error` result frame, which reaches cezar verbatim as the run's `error`.
+ *     Exact, no locale, no parsing of prose. This is the one that matters in practice.
+ *  2. An explicit reset instant in the prose (`try again at 2026-08-03T18:00:00Z`) — how Codex and
+ *     OpenCode phrase the same thing when they carry a timestamp at all.
+ *  3. A clock-only reset in prose (`resets 8:10pm (Europe/Warsaw)`) — how Claude Code phrases
+ *     session windows in some interactive output.
+ *  4. A relative delay (`try again in 42 minutes`, `retry-after: 3600`).
+ *
+ * Nothing else counts. A limit message with no recoverable reset instant returns `null` on
+ * purpose: guessing a window would turn one interruption into a retry loop against a provider
+ * that is still refusing, and "we don't know when" is an honest answer the caller can surface.
+ */
+export interface UsageLimitHit {
+    /** When the provider says the limit lifts. Never in the past — a stale instant clamps to now. */
+    resetAt: Date;
+    /** Which shape carried it — the lifecycle note quotes this so the schedule is auditable. */
+    evidence: 'claude-marker' | 'timestamp' | 'clock' | 'delay';
+}
+/**
+ * The furthest ahead a reset may sit and still be believed. Claude's weekly window is the real
+ * ceiling; anything beyond a week is a corrupt or unit-confused number, and parking a task on it
+ * would be indistinguishable from losing the task.
+ */
+export declare const MAX_USAGE_LIMIT_WAIT_MS: number;
+/**
+ * Read a usage limit out of a terminal error message, or `null` when it is not one (or carries no
+ * usable reset instant). `now` is injected so callers and tests share one clock.
+ *
+ * Never throws: this runs on the failure path of every run, where a second failure helps nobody.
+ */
+export declare function parseUsageLimit(message: string | undefined, now?: number): UsageLimitHit | null;