@quatronic/qore 0.1.1 → 0.1.2

package/dist/cli.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/cli.ts","../src/cli/io.ts","../src/platform/browser.ts","../src/core/errors.ts","../src/cli/program.ts","../src/core/api/http.ts","../src/cli/render.ts","../src/cli/commands/env.ts","../src/core/context/repoConfig.ts","../src/core/api/meta.ts","../src/core/api/capabilities.ts","../src/core/context/resolver.ts","../src/core/auth/tokenStore.ts","../src/core/profiles.ts","../src/core/api/client.ts","../src/core/auth/refresh.ts","../src/core/session.ts","../src/core/context/cache.ts","../src/core/jsonFile.ts","../src/core/context/repoKey.ts","../src/core/context/repoRoot.ts","../src/core/env/fetch.ts","../src/core/env/merge.ts","../src/core/env/pull.ts","../src/cli/context.ts","../src/core/trust.ts","../src/cli/trustPrompt.ts","../src/core/auth/oidc.ts","../src/core/auth/login.ts","../src/cli/commands/login.ts","../src/cli/commands/logout.ts","../src/cli/commands/run.ts","../src/cli/format.ts","../src/cli/commands/status.ts","../src/cli/commands/tenant.ts","../src/cli/commands/version.ts","../src/cli/commands/whoami.ts","../src/cli/commands/index.ts","../src/cli/updateCheck.ts","../src/core/config.ts","../src/platform/git.ts","../src/platform/keychain.ts","../src/platform/lock.ts","../src/platform/paths.ts","../src/platform/spawn.ts","../src/version.ts"],"sourcesContent":["import { homedir } from \"node:os\"\nimport { EnvHttpProxyAgent, setGlobalDispatcher } from \"undici\"\nimport { isInteractive, processIo } from \"./cli/io.js\"\nimport { argvBeforeSeparator, run } from \"./cli/program.js\"\nimport { COMMANDS } from \"./cli/commands/index.js\"\nimport { childRunning } from \"./cli/commands/run.js\"\nimport { maybeNotifyUpdate } from \"./cli/updateCheck.js\"\nimport { abortableFetch } from \"./core/api/http.js\"\nimport { createOidc } from \"./core/auth/oidc.js\"\nimport { ConfigStore } from \"./core/config.js\"\nimport type { Deps } from \"./core/deps.js\"\nimport { systemGit } from \"./platform/git.js\"\nimport { OsKeychain } from \"./platform/keychain.js\"\nimport { fileLock } from \"./platform/lock.js\"\nimport { configDir } from \"./platform/paths.js\"\nimport { crossSpawner } from \"./platform/spawn.js\"\nimport { VERSION } from \"./version.js\"\n\nif (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent())\n\nconst dir = configDir(process.env, process.platform, homedir())\nconst argv = process.argv.slice(2)\n// Ruling R12: a child's own --json/--no-input (after --, e.g. `qore run -- node --json`)\n// must never reach qore's own flag scanning.\nconst preSeparatorArgv = argvBeforeSeparator(argv)\nconst json = preSeparatorArgv.includes(\"--json\")\n// Ctrl+C: the first one aborts every in-flight request and prompt through `ac.signal`\n// (→ CancelledError → exit 130); a second one exits at once, whatever is still running —\n// except while `qore run`'s child is alive (ruling R3, spec §11.2): the terminal already\n// delivered this SIGINT to the whole foreground process group, so the child's own exit\n// (its code, or the signal `run` re-raises) is what decides qore's exit code, not a forced\n// exit(130) here.\nconst ac = new AbortController()\nprocess.on(\"SIGINT\", () => {\n  if (ac.signal.aborted) {\n    if (childRunning.current) return\n    process.exit(130)\n  }\n  ac.abort()\n})\nconst fetch = abortableFetch(globalThis.fetch, ac.signal)\nconst deps: Deps = {\n  fetch,\n  keychain: new OsKeychain(),\n  config: new ConfigStore(dir),\n  withLock: fileLock(dir),\n  now: () => new Date(),\n  oidcFor: (issuer) => createOidc({ issuer, clientId: \"qore-cli\", fetch }),\n  env: process.env,\n  platform: process.platform,\n  version: VERSION,\n  cwd: process.cwd(),\n  git: systemGit,\n  spawn: crossSpawner,\n  raise: (signal) => { process.removeAllListeners(signal); process.kill(process.pid, signal) },\n}\nconst io = processIo(isInteractive({ stdinTTY: Boolean(process.stdin.isTTY), stdoutTTY: Boolean(process.stdout.isTTY),\n  json, noInput: preSeparatorArgv.includes(\"--no-input\"), env: process.env }))\nprocess.exitCode = await run(argv, deps, io, ac.signal, COMMANDS)\nif (!ac.signal.aborted) {\n  try {\n    await maybeNotifyUpdate(deps, io, { json })\n  } catch {\n    // an update check must never change the exit code\n  }\n}\n","import { confirm, select } from \"@inquirer/prompts\"\nimport { createInterface } from \"node:readline\"\nimport { openBrowser } from \"../platform/browser.js\"\nimport { CancelledError } from \"../core/errors.js\"\n\nexport interface Io {\n  out(s: string): void\n  err(s: string): void\n  interactive: boolean\n  select<T>(msg: string, choices: { name: string; value: T; description?: string }[]): Promise<T>\n  confirm(message: string): Promise<boolean>\n  waitForEnter(msg: string, signal: AbortSignal): Promise<void>\n  openUrl(url: string): Promise<boolean>\n}\n\nexport function isInteractive(o: { stdinTTY: boolean; stdoutTTY: boolean; json: boolean; noInput: boolean; env: NodeJS.ProcessEnv }): boolean {\n  return o.stdinTTY && o.stdoutTTY && !o.json && !o.noInput && !o.env.CI\n}\n\nexport function processIo(interactive: boolean): Io {\n  return {\n    out: (s) => { process.stdout.write(s + \"\\n\") },\n    err: (s) => { process.stderr.write(s + \"\\n\") },\n    interactive,\n    async select(message, choices) {\n      try { return await select({ message, choices }) } catch (e) {\n        if ((e as Error).name === \"ExitPromptError\") throw new CancelledError()\n        throw e\n      }\n    },\n    async confirm(message) {\n      try { return await confirm({ message, default: false }) } catch (e) {\n        if ((e as Error).name === \"ExitPromptError\") throw new CancelledError()\n        throw e\n      }\n    },\n    waitForEnter: createWaitForEnter(process.stdin, process.stderr),\n    openUrl: openBrowser,\n  }\n}\n\n/** Builds a `waitForEnter` bound to the given streams, so tests can drive it without a\n * real TTY. Readline puts a TTY's stdin in raw mode, which turns Ctrl+C into the\n * interface's own 'SIGINT' event rather than a process-level SIGINT (R16) — that must be\n * turned into a CancelledError itself, since `process.once(\"SIGINT\", …)` in cli.ts never\n * fires for it. `terminal: true` makes readline parse Ctrl+C the same way on any stream. */\nexport function createWaitForEnter(\n  input: NodeJS.ReadableStream, output: NodeJS.WritableStream,\n): (message: string, signal: AbortSignal) => Promise<void> {\n  return (message, signal) => new Promise((resolve, reject) => {\n    const rl = createInterface({ input, output, terminal: true })\n    const onAbort = () => { rl.close(); reject(new CancelledError()) }\n    const done = () => { signal.removeEventListener(\"abort\", onAbort); rl.close(); resolve() }\n    signal.addEventListener(\"abort\", onAbort, { once: true })\n    rl.on(\"SIGINT\", () => { signal.removeEventListener(\"abort\", onAbort); rl.close(); reject(new CancelledError()) })\n    rl.question(message, done)\n  })\n}\n","import open from \"open\"\n\n/** Opens the URL; false when there is no display (SSH, container) or it fails. */\nexport async function openBrowser(url: string): Promise<boolean> {\n  if (process.platform === \"linux\" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) return false\n  try { await open(url); return true } catch { return false }\n}\n","export const EXIT = {\n  QORE_INTERNAL: 1,\n  QORE_KEYCHAIN_UNAVAILABLE: 1,\n  QORE_KEYCHAIN_DENIED: 1,\n  QORE_GIT_UNAVAILABLE: 1,\n  QORE_CONTEXT_REQUIRED: 2,\n  QORE_CONTEXT_INVALID: 2,\n  QORE_CONTEXT_UNSUPPORTED: 2,\n  QORE_APP_AMBIGUOUS: 2,\n  QORE_NOT_LOGGED_IN: 4,\n  QORE_SESSION_EXPIRED: 4,\n  QORE_LOGIN_EXPIRED: 4,\n  QORE_LOGIN_DENIED: 4,\n  QORE_CLOCK_SKEW: 4,\n  QORE_TENANT_ACCESS_LOST: 5,\n  QORE_RESOURCE_NOT_FOUND: 5,\n  QORE_ACCESS_DENIED: 5,\n  QORE_NO_DEVELOPER_ACCESS: 5,\n  QORE_AUTH_UNAVAILABLE: 6,\n  QORE_AUTH_BUSY: 6,\n  QORE_API_UNREACHABLE: 6,\n  QORE_API_UNAVAILABLE: 6,\n  QORE_INCOMPATIBLE_SERVER: 7,\n  QORE_UNSUPPORTED_BY_SERVER: 7,\n  QORE_UPGRADE_REQUIRED: 7,\n  QORE_PORTAL_UNTRUSTED: 7,\n  QORE_RATE_LIMITED: 8,\n} as const\n\nexport type QoreErrorCode = keyof typeof EXIT\n\n/** One element of `error.candidates`, the same shape under every code (--json is a\n * semver contract): what the user can pick from to resolve the error. `tenant` (a\n * tenant slug) accompanies module candidates, whose slugs are unique only per tenant. */\nexport type Candidate = {\n  kind: \"module\" | \"tenant\" | \"app\"\n  id?: string\n  slug: string\n  name?: string\n  remote?: string\n  tenant?: string\n}\n\ntype Opts = {\n  hint?: string\n  status?: number\n  requestId?: string\n  candidates?: Candidate[]\n  serverCode?: string\n  details?: Record<string, unknown>\n  cause?: unknown\n}\n\nexport class QoreError extends Error {\n  readonly code: QoreErrorCode\n  readonly hint?: string\n  readonly status?: number\n  readonly requestId?: string\n  readonly candidates?: Candidate[]\n  readonly serverCode?: string\n  readonly details?: Record<string, unknown>\n\n  constructor(code: QoreErrorCode, message: string, opts: Opts = {}) {\n    super(message, opts.cause === undefined ? undefined : { cause: opts.cause })\n    this.name = \"QoreError\"\n    this.code = code\n    this.hint = opts.hint\n    this.status = opts.status\n    this.requestId = opts.requestId\n    this.candidates = opts.candidates\n    this.serverCode = opts.serverCode\n    this.details = opts.details\n  }\n}\n\nexport class CancelledError extends Error {\n  constructor() {\n    super(\"Cancelled\")\n    this.name = \"CancelledError\"\n  }\n}\n\nexport function exitCodeFor(err: unknown): number {\n  if (err instanceof CancelledError || (err instanceof Error && err.name === \"CancelledError\")) return 130\n  if (err instanceof QoreError) return EXIT[err.code]\n  return 1\n}\n\nexport function toJsonError(err: unknown): Record<string, unknown> {\n  if (!(err instanceof QoreError)) {\n    return { code: \"QORE_INTERNAL\", message: err instanceof Error ? err.message : String(err) }\n  }\n  const out: Record<string, unknown> = { code: err.code, message: err.message }\n  for (const k of [\"hint\", \"status\", \"requestId\", \"candidates\", \"serverCode\", \"details\"] as const) {\n    if (err[k] !== undefined) out[k] = err[k]\n  }\n  return out\n}\n","import { Command, CommanderError } from \"commander\"\nimport type { Deps } from \"../core/deps.js\"\nimport { isAbortError } from \"../core/api/http.js\"\nimport { CancelledError, exitCodeFor } from \"../core/errors.js\"\nimport type { Io } from \"./io.js\"\nimport pc from \"picocolors\"\nimport { renderError } from \"./render.js\"\n\n/** The portion of argv before the first bare `--`. Everything from `--` on belongs to\n * a child command (e.g. `qore run -- node --json --no-input`), so no qore-side argv\n * scan — here or in cli.ts — may look past it (ruling R12): a child's own `--json` must\n * not switch qore into JSON mode, and a child's own `--no-input` must not disable\n * prompting. */\nexport function argvBeforeSeparator(argv: string[]): string[] {\n  const i = argv.indexOf(\"--\")\n  return i === -1 ? argv : argv.slice(0, i)\n}\n\n/** Detects --json before commander has parsed anything, so a parse error (thrown before\n * global opts exist) can still be rendered as JSON, and commander's own stderr line\n * can be suppressed in that mode. See ruling R12. */\nfunction jsonFromArgv(argv: string[]): boolean {\n  return argvBeforeSeparator(argv).some((a) => a === \"--json\" || a.startsWith(\"--json=\"))\n}\n\nexport type GlobalOpts = { portal?: string; json?: boolean; input?: boolean; verbose?: boolean; color?: boolean }\n\nexport type CommandContext = { deps: Deps; io: Io; signal: AbortSignal; opts: () => GlobalOpts; setExitCode: (code: number) => void }\n\nexport type Register = (program: Command, ctx: CommandContext) => void\n\n/** `--verbose`: request lines (method, path, status, request id; never a token) on stderr. */\nexport function requestLog(ctx: CommandContext): ((line: string) => void) | undefined {\n  return ctx.opts().verbose ? (line) => ctx.io.err(line) : undefined\n}\n\nexport function buildProgram(deps: Deps, io: Io, signal: AbortSignal, register: Register[], setExitCode: (code: number) => void): Command {\n  const program = new Command(\"qore\")\n    .description(\"Qore developer CLI\")\n    .option(\"--portal <name|url>\", \"prod, staging, or a portal URL (default: the portal you last logged in to, else prod)\")\n    .option(\"--json\", \"print exactly one JSON document on stdout\")\n    .option(\"--no-input\", \"never prompt\")\n    .option(\"--verbose\", \"log request lines (never secrets)\")\n    .option(\"--no-color\", \"disable colours\")\n    .exitOverride()\n    .configureOutput({ writeOut: (s) => io.out(s.trimEnd()), writeErr: (s) => io.err(s.trimEnd()) })\n  const ctx: CommandContext = { deps, io, signal, opts: () => program.opts<GlobalOpts>(), setExitCode }\n  for (const r of register) r(program, ctx)\n  return program\n}\n\nexport async function run(argv: string[], deps: Deps, io: Io, signal: AbortSignal, register: Register[]): Promise<number> {\n  const json = jsonFromArgv(argv)\n  // Commander may throw before global opts exist (e.g. an unknown option), and by default\n  // writes its own message to stderr on the way there. In --json mode that would land\n  // alongside our single JSON document, so suppress it here and render the error ourselves.\n  const parseIo: Io = json ? { ...io, err: () => {} } : io\n  const state: { exitCode?: number } = {}\n  const program = buildProgram(deps, parseIo, signal, register, (code) => { state.exitCode = code })\n  try {\n    await program.parseAsync(argv, { from: \"user\" })\n    return state.exitCode ?? 0\n  } catch (caught) {\n    // Once Ctrl+C has fired, any AbortError that escaped a mapping is that cancel.\n    const e = signal.aborted && isAbortError(caught) ? new CancelledError() : caught\n    if (e instanceof CommanderError) {\n      if (e.exitCode === 0) return 0\n      if (json) io.out(JSON.stringify({ ok: false, error: { code: \"QORE_CONTEXT_INVALID\", message: e.message } }))\n      return 2\n    }\n    const opts = program.opts<GlobalOpts>()\n    renderError(io, e, Boolean(opts.json), pc.isColorSupported && opts.color !== false)\n    return exitCodeFor(e)\n  }\n}\n","import { CancelledError, QoreError, type QoreErrorCode } from \"../errors.js\"\n\nexport type Fetch = (input: string | URL, init?: RequestInit) => Promise<Response>\n\n/** Every request also carries `signal` (the process's Ctrl+C signal), next to any signal\n * of the caller's own, so a cancel aborts whatever is in flight (spec §4). */\nexport function abortableFetch(fetch: Fetch, signal: AbortSignal): Fetch {\n  return (input, init) => fetch(input, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal })\n}\n\nconst TLS = new Set([\"SELF_SIGNED_CERT_IN_CHAIN\", \"UNABLE_TO_GET_ISSUER_CERT_LOCALLY\",\n  \"DEPTH_ZERO_SELF_SIGNED_CERT\", \"UNABLE_TO_VERIFY_LEAF_SIGNATURE\", \"CERT_HAS_EXPIRED\"])\n\nfunction causeCode(e: unknown): string | undefined {\n  const c = (e as { cause?: { code?: unknown } })?.cause\n  const code = c?.code ?? (e as { code?: unknown })?.code\n  // DOMException carries a numeric legacy `code`; only errno-style strings are meaningful here.\n  return typeof code === \"string\" ? code : undefined\n}\n\nexport function isAbortError(e: unknown): boolean {\n  return (e as { name?: unknown } | null)?.name === \"AbortError\"\n}\n\n/** A failed fetch: a cancel (Ctrl+C aborted the request) or a network failure. */\nexport function fetchError(e: unknown, host: string): Error {\n  return isAbortError(e) ? new CancelledError() : networkError(e, host)\n}\n\nexport function networkError(e: unknown, host: string): QoreError {\n  const code = causeCode(e) ?? \"\"\n  let reason = \"connect\"\n  let hint = \"Check your network or VPN.\"\n  if (code === \"ENOTFOUND\" || code === \"EAI_AGAIN\") {\n    reason = \"dns\"; hint = `${host} could not be resolved. Check your network or VPN.`\n  } else if (TLS.has(code)) {\n    reason = \"tls\"\n    hint = \"A proxy is re-signing TLS. Point NODE_EXTRA_CA_CERTS at your organisation's CA certificate.\"\n  } else if (code.includes(\"TIMEOUT\") || code === \"ETIMEDOUT\") {\n    reason = \"timeout\"\n  } else if (!process.env.HTTPS_PROXY && !process.env.https_proxy) {\n    hint = \"Check your network. Behind a corporate proxy, set HTTPS_PROXY.\"\n  }\n  return new QoreError(\"QORE_API_UNREACHABLE\", `Could not reach ${host}`, { hint, details: { reason, host, errno: code || undefined }, cause: e })\n}\n\nconst BY_SERVER_CODE: Record<string, QoreErrorCode> = {\n  \"app.access.denied\": \"QORE_ACCESS_DENIED\",\n  \"auth.scope.insufficient\": \"QORE_ACCESS_DENIED\",\n  \"cli.upgrade_required\": \"QORE_UPGRADE_REQUIRED\",\n  \"rate_limited\": \"QORE_RATE_LIMITED\",\n  \"module.not_found\": \"QORE_RESOURCE_NOT_FOUND\",\n  \"tenant.not_found\": \"QORE_RESOURCE_NOT_FOUND\",\n  \"module.app_ambiguous\": \"QORE_APP_AMBIGUOUS\",\n}\n\nfunction byStatus(status: number): QoreErrorCode {\n  if (status === 403) return \"QORE_ACCESS_DENIED\"\n  if (status === 404) return \"QORE_RESOURCE_NOT_FOUND\"\n  if (status === 426) return \"QORE_UPGRADE_REQUIRED\"\n  if (status === 429) return \"QORE_RATE_LIMITED\"\n  if (status === 502 || status === 503 || status === 504) return \"QORE_API_UNAVAILABLE\"\n  return \"QORE_INTERNAL\"\n}\n\nexport async function problemToError(res: Response): Promise<QoreError> {\n  let body: { code?: string; title?: string; detail?: unknown } = {}\n  try { body = (await res.json()) as typeof body } catch { /* not JSON */ }\n  const serverCode = body.code\n  const code = (serverCode && BY_SERVER_CODE[serverCode]) || byStatus(res.status)\n  const requestId = res.headers.get(\"x-request-id\") ?? undefined\n  const details: Record<string, unknown> = {}\n  if (body.detail && typeof body.detail === \"object\") Object.assign(details, body.detail)\n  const detail = typeof body.detail === \"string\" && body.detail ? body.detail : undefined\n  if (detail) details.detail = detail\n  const retry = res.headers.get(\"retry-after\")\n  if (retry && /^\\d+$/.test(retry)) details.retryAfter = Number(retry)\n  const hint =\n    code === \"QORE_UPGRADE_REQUIRED\" ? \"Run: npm i -g @quatronic/qore\"\n    : code === \"QORE_RATE_LIMITED\" ? `Wait ${details.retryAfter ?? \"a moment\"} s and retry.`\n    : code === \"QORE_API_UNAVAILABLE\" ? \"Qore is temporarily unavailable; retry in a minute.\"\n    : code === \"QORE_APP_AMBIGUOUS\" ? \"Pass --app <slug>.\"\n    : undefined\n  const apps = (body.detail as { apps?: unknown } | undefined)?.apps\n  const candidates = code === \"QORE_APP_AMBIGUOUS\" && Array.isArray(apps)\n    ? (apps as { id?: string; slug: string; name?: string }[]).map((a) => ({ kind: \"app\" as const, id: a.id, slug: a.slug, name: a.name }))\n    : undefined\n  if (candidates) delete details.apps\n  // portal-api falls back to the title \"HTTP error\"; a server code is no message either.\n  // Then the string detail is the most useful message there is.\n  const genericTitle = !body.title || body.title === \"HTTP error\" || body.title === serverCode\n  const message = (genericTitle && detail) || body.title || `Request failed (${res.status})`\n  return new QoreError(code, message, {\n    status: res.status, requestId, serverCode, hint, candidates,\n    details: Object.keys(details).length ? details : undefined,\n  })\n}\n","import pc, { createColors } from \"picocolors\"\nimport { QoreError, toJsonError } from \"../core/errors.js\"\nimport type { Io } from \"./io.js\"\n\nexport function renderJson(io: Io, data: unknown): void {\n  io.out(JSON.stringify({ ok: true, data }))\n}\n\nexport function renderError(io: Io, err: unknown, json: boolean, colorEnabled = pc.isColorSupported): void {\n  if (json) { io.out(JSON.stringify({ ok: false, error: toJsonError(err) })); return }\n  if (err instanceof Error && err.name === \"CancelledError\") { io.err(\"Cancelled\"); return }\n  const c = createColors(colorEnabled)\n  const e = err instanceof QoreError ? err : new QoreError(\"QORE_INTERNAL\", err instanceof Error ? err.message : String(err))\n  io.err(c.red(`Error: ${e.message}`))\n  if (e.hint) io.err(e.hint)\n  io.err(c.dim(`Code: ${e.code}${e.requestId ? ` (request ${e.requestId})` : \"\"}`))\n}\n","import { randomBytes } from \"node:crypto\"\nimport { chmod, readFile, realpath, rename, unlink, writeFile } from \"node:fs/promises\"\nimport { basename, dirname, join, relative } from \"node:path\"\nimport type { Command } from \"commander\"\nimport { moduleDefaults, readRepoConfig } from \"../../core/context/repoConfig.js\"\nimport { QoreError } from \"../../core/errors.js\"\nimport { fetchLocalEnv } from \"../../core/env/fetch.js\"\nimport { parseEnv } from \"../../core/env/merge.js\"\nimport { planPull, resolveTarget, type PullPlan } from \"../../core/env/pull.js\"\nimport { appFor, contextJson, moduleContextFor } from \"../context.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\nimport { ensureTrusted } from \"../trustPrompt.js\"\n\n/** Ruling T10-I1: spec §11.1 (\"values masked\") plus T8 (\"qore never prints values\")\n * override the brief's SDK maskSecret rule — every value in the conflict prompt is\n * masked, showing only its length, never its content (even for a non-sensitive key). */\nconst maskLen = (v: string | undefined) => (v === undefined ? \"(unset)\" : `•••• (${v.length} chars)`)\n\nasync function readOrNull(p: string): Promise<string | null> {\n  try { return await readFile(p, \"utf8\") } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return null\n    throw e\n  }\n}\n\n/** T10-WRITE + ruling T10-I2/I3: write via a temp file in the target's own directory,\n * created with \"wx\" (never follow a pre-existing path at the temp name) and mode 0600,\n * then rename over the target — never write through a symlink an attacker plants at the\n * target path after `resolveTarget` checked it. Cleaned up in a `finally`, which covers\n * every non-crash failure path (a kill between `writeFile` and `rename` is the one window\n * it cannot cover).\n *\n * The temp name is built to fall under the generated templates' own ignore patterns where\n * possible: next-base ignores `.env*.local`, so a `<name>.local` target gets a temp name\n * of `<name-without-.local>.qore-<hex>.local` (e.g. `.env.qore-ab12.local` for\n * `.env.local`), which still matches that pattern. A plain `.env` target has no such\n * pattern to fall under (node-backend-base ignores the literal `.env`, not `.env*`), so its\n * temp name is just `.env.qore-<hex>.tmp` — untracked-but-not-ignored is the accepted\n * residual risk for that crash window (M2). */\nasync function writeSecurely(target: string, text: string): Promise<void> {\n  const base = basename(target)\n  const tmpName = base.endsWith(\".local\")\n    ? `${base.slice(0, -\".local\".length)}.qore-${randomBytes(6).toString(\"hex\")}.local`\n    : `${base}.qore-${randomBytes(6).toString(\"hex\")}.tmp`\n  const tmp = join(dirname(target), tmpName)\n  try {\n    await writeFile(tmp, text, { mode: 0o600, flag: \"wx\" })\n    await chmod(tmp, 0o600)\n    await rename(tmp, target)\n  } finally {\n    await unlink(tmp).catch(() => {})\n  }\n}\n\ntype Flags = { module?: string; app?: string; target?: string; usePortal?: boolean; yes?: boolean }\n\nexport function registerEnv(program: Command, ctx: CommandContext): void {\n  const env = program.command(\"env\").description(\"Local environment\")\n  env.command(\"pull\").description(\"Write this module's local secrets into its env file\")\n    .option(\"--module <slug|id>\", \"the module (default: from this repository's git remote)\")\n    .option(\"--app <slug|id>\", \"the app, when the module is part of several\")\n    .option(\"--target <path>\", \"env file to write (inside the repository)\")\n    .option(\"--use-portal\", \"take the portal's value for keys that differ locally\")\n    .option(\"--yes\", \"trust this repository without asking\")\n    .action(async (f: Flags) => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const mc = await moduleContextFor(ctx, f, \"env pull\")\n      if (!mc.repoRoot) {\n        throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"env pull writes into a module repository\", { hint: \"cd into the module's repository.\" })\n      }\n      const app = await appFor(ctx, mc, f.app)\n      const cfg = await readRepoConfig(mc.repoRoot)\n      const defaults = moduleDefaults(mc.module.type)\n      // R11: --target resolves against the cwd; .qore.json's envFile resolves against the\n      // repository root. Both must still land inside the repository.\n      // Ruling T10-ORDER: target → trust → fetch, so --yes never saves trust for a pull\n      // whose target is then rejected.\n      const target = f.target\n        ? await resolveTarget(mc.repoRoot, f.target, deps.cwd)\n        : await resolveTarget(mc.repoRoot, cfg.envFile ?? defaults.envFile)\n      await ensureTrusted(ctx, mc, app, { yes: f.yes })\n      const existing = await readOrNull(target)\n      const example = existing === null ? await readOrNull(join(dirname(target), \".env.example\")) : null\n      const local = await fetchLocalEnv(deps, mc, app)\n      const inputs = {\n        existing, example, fetched: local.env, managed: local.managedKeys,\n        localSecrets: cfg.localSecrets ?? defaults.localSecrets,\n        defaultChoice: f.usePortal ? \"use-portal\" as const : \"keep\" as const,\n        random: () => randomBytes(32).toString(\"hex\"),\n      }\n      let plan = planPull(inputs)\n      if (plan.conflicts.length && io.interactive && !f.usePortal) {\n        const current = parseEnv(existing ?? example ?? \"\")\n        const choices: Record<string, \"keep\" | \"use-portal\"> = {}\n        let bulk: \"keep\" | \"use-portal\" | undefined\n        for (const key of plan.conflicts) {\n          if (bulk) { choices[key] = bulk; continue }\n          const pick = await io.select<\"keep\" | \"portal\" | \"all\" | \"skip\">(\n            `${key} differs  (local ${maskLen(current.get(key))}, portal ${maskLen(local.env[key])})`,\n            [{ name: \"keep local\", value: \"keep\" }, { name: \"use portal\", value: \"portal\" },\n             { name: \"use portal for all\", value: \"all\" }, { name: \"keep local for all\", value: \"skip\" }])\n          if (pick === \"all\") bulk = \"use-portal\"\n          if (pick === \"skip\") bulk = \"keep\"\n          choices[key] = pick === \"portal\" || pick === \"all\" ? \"use-portal\" : \"keep\"\n        }\n        plan = planPull({ ...inputs, choices })\n      }\n      // M5: when nothing changed, skip the write (and its rename/mtime bump — Next's dev\n      // server reloads env on mtime change) and only enforce the 0600 mode.\n      if (existing !== null && plan.text === existing) {\n        await chmod(target, 0o600)\n      } else {\n        await writeSecurely(target, plan.text)\n      }\n      // resolveTarget resolved through realpath (e.g. macOS's /var → /private/var), so the\n      // relative path must be computed against the repo root's realpath too.\n      const rel = relative(await realpath(mc.repoRoot), target)\n      if (g.json) {\n        const names: Omit<PullPlan, \"text\"> = {\n          created: plan.created, seededFromExample: plan.seededFromExample, added: plan.added,\n          updated: plan.updated, kept: plan.kept, replaced: plan.replaced, unchanged: plan.unchanged, generated: plan.generated,\n        }\n        renderJson(io, { context: contextJson(mc, app), target: rel, ...names })\n        return\n      }\n      if (plan.kept.length && !io.interactive) {\n        io.err(`! ${plan.kept.length} key(s) differ locally and were kept: ${plan.kept.join(\", \")} — --use-portal takes the portal's values`)\n      }\n      const parts = [\n        plan.added.length && `${plan.added.length} added`,\n        plan.updated.length && `${plan.updated.length} updated (managed)`,\n        plan.replaced.length && `${plan.replaced.length} replaced`,\n        plan.kept.length && `${plan.kept.length} kept (differs locally; --use-portal to overwrite)`,\n        plan.generated.length && `${plan.generated.length} generated`,\n      ].filter(Boolean)\n      io.out(`✓ ${rel}${plan.seededFromExample ? \" (created from .env.example)\" : \"\"} — ${parts.length ? parts.join(\", \") : \"up to date\"}`)\n    })\n}\n","import { readFile } from \"node:fs/promises\"\nimport { join } from \"node:path\"\nimport { QoreError } from \"../errors.js\"\n\nexport type RepoConfig = { envFile?: string; localSecrets?: string[] }\n\n// A field that would pick a resource or a server: refused so a repository cannot\n// steer secrets or tokens (spec §5.2, §10.1 T4/T5). Keep in step with schema/qore.schema.json.\nconst FORBIDDEN = [\"portal\", \"api\", \"apiOrigin\", \"issuer\", \"tenant\", \"tenantId\", \"app\", \"appId\", \"module\", \"moduleId\"]\nconst KEY = /^[A-Za-z_][A-Za-z0-9_]*$/\n\nconst invalid = (msg: string, details?: Record<string, unknown>) =>\n  new QoreError(\"QORE_CONTEXT_INVALID\", `.qore.json: ${msg}`, { hint: \"Fix .qore.json in the repository root; see the $schema it names.\", details })\n\nexport function moduleDefaults(type: string): { envFile: string; localSecrets: string[] } {\n  return type === \"frontend\"\n    ? { envFile: \".env.local\", localSecrets: [\"SESSION_COOKIE_SECRET\"] }\n    : { envFile: \".env\", localSecrets: [] }\n}\n\nexport async function readRepoConfig(root: string): Promise<RepoConfig> {\n  let raw: string\n  try { raw = await readFile(join(root, \".qore.json\"), \"utf8\") } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return {}\n    throw e\n  }\n  let doc: Record<string, unknown>\n  try { doc = JSON.parse(raw) as Record<string, unknown> } catch { throw invalid(\"not valid JSON\") }\n  if (!doc || typeof doc !== \"object\" || Array.isArray(doc)) throw invalid(\"must be an object\")\n  // M9: `??` would also default an explicit `null` to 1, silently accepting a value the\n  // schema (`\"type\": \"integer\"`) rejects. Only a genuinely absent key gets the default.\n  const v = doc.schemaVersion === undefined ? 1 : doc.schemaVersion\n  if (!Number.isInteger(v) || (v as number) < 1) throw invalid(\"schemaVersion must be a positive integer\")\n  if ((v as number) > 1) {\n    throw new QoreError(\"QORE_CONTEXT_UNSUPPORTED\", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: \"Run: npm i -g @quatronic/qore\" })\n  }\n  for (const f of FORBIDDEN) if (f in doc) throw invalid(`\"${f}\" is not allowed — .qore.json never selects a portal or a resource`, { field: f })\n  const out: RepoConfig = {}\n  if (doc.envFile !== undefined) {\n    if (typeof doc.envFile !== \"string\" || !doc.envFile) throw invalid(\"envFile must be a non-empty string\")\n    out.envFile = doc.envFile\n  }\n  if (doc.localSecrets !== undefined) {\n    if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === \"string\" && KEY.test(k))) {\n      throw invalid(\"localSecrets must be a list of env key names\")\n    }\n    // M9: the schema declares `uniqueItems`; reject a duplicate rather than silently\n    // deduplicating, for consistency with the schemaVersion fix above (reject, don't coerce).\n    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid(\"localSecrets must not contain duplicates\")\n    out.localSecrets = doc.localSecrets as string[]\n  }\n  return out\n}\n","import { QoreError } from \"../errors.js\"\nimport type { PortalRef } from \"../profiles.js\"\nimport { fetchError, problemToError, type Fetch } from \"./http.js\"\nimport type { CliMeta } from \"./types.js\"\n\nconst SUPPORTED = [\"v1\"] as const\nconst SEMVER = /^(\\d+)\\.(\\d+)\\.(\\d+)(?:-([0-9A-Za-z.-]+))?/\n\nexport function compareVersions(a: string, b: string): number {\n  const pa = SEMVER.exec(a), pb = SEMVER.exec(b)\n  if (!pa || !pb) return 0\n  for (let i = 1; i <= 3; i++) {\n    const d = Number(pa[i]) - Number(pb[i])\n    if (d !== 0) return d\n  }\n  if (pa[4] && !pb[4]) return -1\n  if (!pa[4] && pb[4]) return 1\n  return 0\n}\n\nexport async function fetchMeta(fetch: Fetch, apiOrigin: string): Promise<CliMeta> {\n  let res: Response\n  try { res = await fetch(`${apiOrigin}/api/cli/meta`, { headers: { accept: \"application/json\" } }) }\n  catch (e) { throw fetchError(e, new URL(apiOrigin).host) }\n  if (res.status === 404) {\n    // No CLI surface at all: a portal-api from before the CLI (or the wrong URL).\n    throw new QoreError(\"QORE_INCOMPATIBLE_SERVER\", \"This portal does not support the Qore CLI yet\", {\n      status: 404, requestId: res.headers.get(\"x-request-id\") ?? undefined,\n      hint: `Check the portal URL (${apiOrigin}); if it is right, the portal must be upgraded before qore can use it.`,\n    })\n  }\n  if (!res.ok) throw await problemToError(res)\n  return (await res.json()) as CliMeta\n}\n\nexport function negotiate(meta: CliMeta, portal: PortalRef, cliVersion: string): { apiVersion: \"v1\" } {\n  if (portal.pinnedIssuer && meta.auth.issuer !== portal.pinnedIssuer) {\n    throw new QoreError(\"QORE_PORTAL_UNTRUSTED\", `${portal.apiOrigin} names an unexpected identity provider`, {\n      details: { expected: portal.pinnedIssuer, got: meta.auth.issuer },\n      hint: \"Refusing to log in. Check the portal URL and your network.\",\n    })\n  }\n  const apiVersion = SUPPORTED.find((v) => meta.apiVersions.includes(v))\n  if (!apiVersion) {\n    throw new QoreError(\"QORE_INCOMPATIBLE_SERVER\", \"This portal speaks no API version this qore knows\", {\n      details: { server: meta.apiVersions, client: [...SUPPORTED] }, hint: \"Run: npm i -g @quatronic/qore\",\n    })\n  }\n  if (!cliVersion.endsWith(\"-dev\") && compareVersions(cliVersion, meta.minCliVersion) < 0) {\n    throw new QoreError(\"QORE_UPGRADE_REQUIRED\", `qore ${cliVersion} is too old for this portal (needs ${meta.minCliVersion})`, {\n      hint: \"Run: npm i -g @quatronic/qore\",\n    })\n  }\n  return { apiVersion }\n}\n","import type { Deps } from \"../deps.js\"\nimport { QoreError } from \"../errors.js\"\nimport { fetchMeta } from \"./meta.js\"\nimport type { CliMeta } from \"./types.js\"\n\nconst TTL_MS = 3600_000\n\nfunction isMeta(doc: unknown): doc is CliMeta {\n  return !!doc && typeof doc === \"object\" && Array.isArray((doc as CliMeta).capabilities)\n}\n\nasync function loadMeta(deps: Deps, apiOrigin: string, refresh: boolean): Promise<{ meta: CliMeta; cached: boolean }> {\n  const cached = (await deps.config.read()).profiles[apiOrigin]?.meta\n  if (!refresh && cached && isMeta(cached.doc) && deps.now().getTime() - new Date(cached.fetchedAt).getTime() < TTL_MS) {\n    return { meta: cached.doc, cached: true }\n  }\n  const meta = await fetchMeta(deps.fetch, apiOrigin)\n  await deps.config.update((c) => {\n    const p = c.profiles[apiOrigin]\n    if (p) p.meta = { fetchedAt: deps.now().toISOString(), doc: meta }\n  })\n  return { meta, cached: false }\n}\n\n/** Meta per profile, cached 1 h in the profile (spec §9.1). The issuer was pinned at\n * login; a refresh here only updates capabilities and versions. */\nexport async function metaFor(deps: Deps, apiOrigin: string): Promise<CliMeta> {\n  return (await loadMeta(deps, apiOrigin, false)).meta\n}\n\n/** `requireCapability` against the profile's meta. A miss on *cached* meta refetches once\n * before failing: the cache may predate a portal upgrade, and \"try again once it has been\n * updated\" is wrong advice for an hour after it has been. */\nexport async function ensureCapability(deps: Deps, apiOrigin: string, capability: string): Promise<CliMeta> {\n  const first = await loadMeta(deps, apiOrigin, false)\n  let meta = first.meta\n  if (!meta.capabilities.includes(capability) && first.cached) meta = (await loadMeta(deps, apiOrigin, true)).meta\n  requireCapability(meta, capability, apiOrigin)\n  return meta\n}\n\nexport function requireCapability(meta: CliMeta, capability: string, apiOrigin: string): void {\n  if (meta.capabilities.includes(capability)) return\n  throw new QoreError(\"QORE_UNSUPPORTED_BY_SERVER\", `This portal does not support ${capability} yet`, {\n    hint: `The portal at ${apiOrigin} is older than this qore. Try again once it has been updated.`,\n    details: { capability, portal: apiOrigin },\n  })\n}\n","import { join } from \"node:path\"\nimport { ensureCapability } from \"../api/capabilities.js\"\nimport { TokenStore } from \"../auth/tokenStore.js\"\nimport type { CliMe, CliModuleDetail, CliRef, CliRepoResolve } from \"../api/types.js\"\nimport type { QoreConfig } from \"../config.js\"\nimport type { Deps } from \"../deps.js\"\nimport { CancelledError, QoreError, type Candidate, type QoreErrorCode } from \"../errors.js\"\nimport { BUILTIN_PORTALS, profileHash, resolvePortal, type PortalRef } from \"../profiles.js\"\nimport { openSession, type Session } from \"../session.js\"\nimport type { Remote } from \"../../platform/git.js\"\nimport { ResolutionCache } from \"./cache.js\"\nimport { repoKey } from \"./repoKey.js\"\nimport { findRepoRoot } from \"./repoRoot.js\"\n\nexport type ContextSource =\n  | { kind: \"remote\"; remote: string; url: string }\n  | { kind: \"flag\"; overrides?: string } // overrides = the remote whose derived module differs from --module\nexport type ModuleContext = { portal: PortalRef; session: Session; module: CliModuleDetail; source: ContextSource; repoRoot: string | null }\ntype Keyed = Remote & { key: string }\ntype Opts = {\n  portal?: string\n  module?: string\n  choose?: string // module id picked from QORE_CONTEXT_REQUIRED's module candidates\n  tenant?: string // tenant id picked from QORE_CONTEXT_REQUIRED's tenant candidates (--module <slug>)\n  command: string\n  onRequest?: (l: string) => void\n}\ntype Skipped = { profile: string; code: QoreErrorCode; message: string }\n\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\nconst HINT_FLAG = \"cd into a module repository, or pass --module <slug|id>.\"\nconst RESOLVE = \"/api/cli/v1/repos/resolve\"\n\n/** Errors that make one profile unusable for this walk without saying anything about the\n * repository: the portal is unreachable, or the profile has no usable token (spec §3, §14.2). */\nconst SKIPPABLE = new Set<QoreErrorCode>([\n  \"QORE_API_UNREACHABLE\", \"QORE_API_UNAVAILABLE\", \"QORE_AUTH_UNAVAILABLE\",\n  \"QORE_NOT_LOGGED_IN\", \"QORE_SESSION_EXPIRED\",\n])\n\nconst label = (p: PortalRef) => p.builtin ?? p.apiOrigin\n\n/** origin first, then upstream, then the rest in git order. */\nfunction byPreference(remotes: Keyed[]): Keyed[] {\n  const rank = (r: Keyed) => (r.name === \"origin\" ? 0 : r.name === \"upstream\" ? 1 : 2)\n  return [...remotes].sort((a, b) => rank(a) - rank(b)) // stable: git order within a rank\n}\nconst preferred = (remotes: Keyed[]): Keyed => byPreference(remotes)[0]!\n\n/** null outside a repository. A failing `git remote` (a broken or half-initialised\n * repository) counts as \"no remotes\" so it ends in QORE_CONTEXT_REQUIRED rather than\n * QORE_INTERNAL; git missing from PATH stays QORE_GIT_UNAVAILABLE. */\nasync function repoRemotes(deps: Deps): Promise<{ root: string; keyed: Keyed[]; gitError?: QoreError } | null> {\n  const root = await findRepoRoot(deps.cwd)\n  if (!root) return null\n  let remotes: Remote[]\n  try {\n    remotes = await deps.git.remotes(root)\n  } catch (e) {\n    if (e instanceof QoreError && e.code !== \"QORE_GIT_UNAVAILABLE\") return { root, keyed: [], gitError: e }\n    throw e\n  }\n  const keyed = remotes.map((r) => ({ ...r, key: repoKey(r.url) })).filter((r): r is Keyed => r.key !== null)\n  return { root, keyed }\n}\n\nfunction detail(session: Session, id: string): Promise<CliModuleDetail> {\n  return session.api.get<CliModuleDetail>(`/api/cli/v1/modules/${encodeURIComponent(id)}`)\n}\n\n/** Spec §5.3: with --module inside a repository, the remote's own module is derived too\n * (cache first, else one repos/resolve on the same profile) so the context line can say\n * \"--module, overrides <remote>\". Best effort: any failure means \"nothing derived\". */\nasync function flagOverrides(deps: Deps, session: Session, portal: PortalRef, cache: ResolutionCache, moduleId: string) {\n  try {\n    const keyed = (await repoRemotes(deps))?.keyed ?? []\n    const derived = new Map<string, Set<string>>()\n    const uncached: string[] = []\n    for (const key of new Set(keyed.map((r) => r.key))) {\n      const id = await cache.get(portal.apiOrigin, key)\n      if (id) derived.set(key, new Set([id]))\n      else uncached.push(key)\n    }\n    if (uncached.length > 0) {\n      try {\n        const { matches } = await session.api.post<CliRepoResolve>(RESOLVE, { repoKeys: uncached })\n        for (const m of matches) derived.set(m.repoKey, (derived.get(m.repoKey) ?? new Set()).add(m.module.id))\n        const ids = new Set(matches.map((m) => m.module.id))\n        if (ids.size === 1) for (const m of matches) await cache.put(portal.apiOrigin, m.repoKey, m.module.id)\n      } catch (e) { if (e instanceof CancelledError) throw e /* else best effort */ }\n    }\n    return byPreference(keyed).find((r) => [...(derived.get(r.key) ?? [])].some((id) => id !== moduleId))?.name\n  } catch (e) {\n    if (e instanceof CancelledError) throw e // Ctrl+C is never \"best effort\"\n    return undefined\n  }\n}\n\nasync function byFlag(deps: Deps, o: Opts, cache: ResolutionCache): Promise<ModuleContext> {\n  const cfg = await deps.config.read()\n  const portal = resolvePortal(o.portal, cfg.defaultProfile)\n  const session = await openSession(deps, portal, o.command, o.onRequest)\n  await ensureCapability(deps, portal.apiOrigin, \"repo.resolve\")\n  let id = o.module!\n  if (!UUID.test(id)) {\n    let tenantId = o.tenant ?? session.profile.activeTenant?.id\n    if (!tenantId) {\n      const me = await session.api.get<CliMe>(\"/api/cli/v1/me\")\n      // /me lists only developer (non end_user) memberships.\n      if (me.tenants.length === 0) {\n        throw new QoreError(\"QORE_NO_DEVELOPER_ACCESS\", \"Your account is not a developer in any organisation\", {\n          hint: \"Ask an admin to invite you as a developer.\",\n        })\n      }\n      if (me.tenants.length > 1) {\n        const candidates: Candidate[] = me.tenants.map((t) => ({ kind: \"tenant\", id: t.id, slug: t.slug, name: t.name }))\n        throw new QoreError(\"QORE_CONTEXT_REQUIRED\", `Which tenant is \"${id}\" in?`, {\n          hint: \"Run `qore tenant use <slug>`, or pass the module id.\", candidates,\n        })\n      }\n      tenantId = me.tenants[0]!.id\n    }\n    id = (await session.api.get<{ id: string }>(\n      `/api/cli/v1/tenants/${encodeURIComponent(tenantId)}/modules/resolve?slug=${encodeURIComponent(id)}`)).id\n  }\n  const module = await detail(session, id)\n  const overrides = await flagOverrides(deps, session, portal, cache, module.id)\n  const repoRoot = await findRepoRoot(deps.cwd)\n  return { portal, session, module, source: overrides ? { kind: \"flag\", overrides } : { kind: \"flag\" }, repoRoot }\n}\n\nfunction profileOrder(cfg: QoreConfig, cachedOrigins: string[], portalArg?: string): PortalRef[] {\n  if (portalArg) return [resolvePortal(portalArg, cfg.defaultProfile)]\n  const rank = (o: string) => (o === BUILTIN_PORTALS.prod.apiOrigin ? 0 : o === BUILTIN_PORTALS.staging.apiOrigin ? 1 : 2)\n  const rest = Object.keys(cfg.profiles).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b))\n  // Cached origins are filtered to known profiles *before* parsing: a garbage origin in the\n  // cache file must not become QORE_CONTEXT_INVALID (a malformed cache is an empty cache).\n  const cached = cachedOrigins.filter((c) => cfg.profiles[c])\n  const origins = [...cached, resolvePortal(undefined, cfg.defaultProfile).apiOrigin, ...rest]\n  return [...new Set(origins)].filter((c) => cfg.profiles[c]).map((c) => resolvePortal(c, undefined))\n}\n\n/** Merge extra `details` onto a QoreError, keeping its other fields (status, requestId,\n * candidates, serverCode) and chaining the original as `cause`. An explicit `hint`\n * replaces the original's; omitted, the original's hint carries over. Shared with\n * `core/env/fetch.ts` so both callers wrap an upstream error the same way. */\nexport function withDetails(e: QoreError, extra: Record<string, unknown>, hint?: string): QoreError {\n  return new QoreError(e.code, e.message, {\n    hint: hint ?? e.hint, status: e.status, requestId: e.requestId, candidates: e.candidates, serverCode: e.serverCode,\n    details: { ...e.details, ...extra }, cause: e,\n  })\n}\n\n/** One profile of the walk: the module, null for \"no match here\", or a throw. */\nasync function onProfile(deps: Deps, o: Opts, cache: ResolutionCache, portal: PortalRef, keyed: Keyed[], keys: string[],\n  repoRoot: string, unsupported: (e: QoreError) => void): Promise<ModuleContext | null> {\n  const session = await openSession(deps, portal, o.command, o.onRequest)\n  try {\n    await ensureCapability(deps, portal.apiOrigin, \"repo.resolve\")\n  } catch (e) {\n    // A transport failure is a skippable profile (rethrown to the walk), not \"unsupported\".\n    if (!(e instanceof QoreError) || e.code !== \"QORE_UNSUPPORTED_BY_SERVER\") throw e\n    unsupported(e)\n    return null\n  }\n\n  // The cache may answer only when it cannot contradict spec §5.2: every keyed remote is\n  // cached to one and the same module, or not cached at all. Remotes cached to different\n  // modules go to repos/resolve, which decides (and asks when several match).\n  const hits: { remote: Keyed; id: string }[] = []\n  for (const r of byPreference(keyed)) {\n    const id = await cache.get(portal.apiOrigin, r.key)\n    if (id) hits.push({ remote: r, id })\n  }\n  if (hits.length > 0 && hits.every((h) => h.id === hits[0]!.id)) {\n    const { remote: r, id } = hits[0]!\n    try {\n      return { portal, session, module: await detail(session, id), source: { kind: \"remote\", remote: r.name, url: r.url }, repoRoot }\n    } catch (e) {\n      if (!(e instanceof QoreError) || e.code !== \"QORE_RESOURCE_NOT_FOUND\") throw e\n      for (const h of hits) await cache.drop(portal.apiOrigin, h.remote.key)\n    }\n  }\n\n  const { matches } = await session.api.post<CliRepoResolve>(RESOLVE, { repoKeys: keys })\n  const ids = [...new Set(matches.map((m) => m.module.id))]\n  if (ids.length === 0) return null\n  let id = ids[0]!\n  if (ids.length > 1) {\n    if (o.choose && ids.includes(o.choose)) id = o.choose\n    else {\n      const candidates: Candidate[] = ids.map((mid) => {\n        const own = matches.filter((m) => m.module.id === mid)\n        const m = own[0]!\n        const remote = preferred(keyed.filter((r) => own.some((x) => x.repoKey === r.key))).name\n        return { kind: \"module\", id: m.module.id, slug: m.module.slug, name: m.module.name, remote, tenant: m.tenant.slug }\n      })\n      throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"This repository's remotes match several modules\", {\n        hint: \"Pass --module <slug|id>.\", candidates,\n      })\n    }\n  }\n  const matchedKeys = new Set(matches.filter((m) => m.module.id === id).map((m) => m.repoKey))\n  // Only an unambiguous match is cached (spec §5.2): a pick among several must be asked again.\n  if (ids.length === 1) for (const k of matchedKeys) await cache.put(portal.apiOrigin, k, id)\n  const remote = preferred(keyed.filter((r) => matchedKeys.has(r.key)))\n  return { portal, session, module: await detail(session, id), source: { kind: \"remote\", remote: remote.name, url: remote.url }, repoRoot }\n}\n\nasync function anyLoggedIn(deps: Deps, cfg: QoreConfig): Promise<boolean> {\n  for (const p of Object.values(cfg.profiles)) {\n    if (await new TokenStore(deps.keychain, profileHash(p.apiOrigin, p.issuer)).getRefresh()) return true\n  }\n  return false\n}\n\nexport async function resolveModuleContext(deps: Deps, o: Opts): Promise<ModuleContext> {\n  const cache = new ResolutionCache(join(deps.config.dir, \"cache\"), deps.now)\n  if (o.module) return byFlag(deps, o, cache)\n\n  // Login before repository: a logged-out user cannot pass --module either, so\n  // \"log in\" is the more useful first answer (pinned by the E2E test in Task 13).\n  const cfg = await deps.config.read()\n  const first = resolvePortal(o.portal, cfg.defaultProfile)\n  // Based on tokens, not rows: `qore logout` clears the keychain but keeps the profile row.\n  if (o.portal || !(await anyLoggedIn(deps, cfg))) {\n    await openSession(deps, first, o.command) // throws QORE_NOT_LOGGED_IN with the right hint\n  }\n\n  const repo = await repoRemotes(deps)\n  if (repo === null) throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"Not inside a module repository\", { hint: HINT_FLAG })\n  const { root, keyed, gitError } = repo\n  if (keyed.length === 0) {\n    // git's own last stderr line (e.g. \"detected dubious ownership\") says why there are\n    // no remotes; without it the message would claim the opposite of the truth (§14.1).\n    const said = gitError?.hint\n    throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"This repository has no remote Qore can match\", {\n      hint: said ? `${HINT_FLAG} git said: ${said}` : HINT_FLAG,\n      details: gitError ? { git: said ?? gitError.message } : undefined,\n      cause: gitError,\n    })\n  }\n  const keys = [...new Set(keyed.map((r) => r.key))]\n\n  const tried: string[] = []      // every profile walked, in order\n  const answered: string[] = []   // profiles whose repos/resolve answered \"no match\"\n  const skipped: Skipped[] = []\n  const skipErrors: QoreError[] = []\n  let unsupported: QoreError | undefined\n  for (const portal of profileOrder(cfg, await cache.originsFor(keys), o.portal)) {\n    tried.push(label(portal))\n    let capabilityMissing = false\n    try {\n      const mc = await onProfile(deps, o, cache, portal, keyed, keys, root, (e) => {\n        capabilityMissing = true\n        unsupported ??= e\n        skipped.push({ profile: label(portal), code: e.code, message: e.message })\n      })\n      if (mc) return mc\n      if (!capabilityMissing) answered.push(label(portal))\n    } catch (e) {\n      if (!(e instanceof QoreError) || !SKIPPABLE.has(e.code)) throw e\n      skipped.push({ profile: label(portal), code: e.code, message: e.message })\n      skipErrors.push(e)\n    }\n  }\n\n  const details: Record<string, unknown> = { triedProfiles: tried }\n  if (skipped.length > 0) details.skippedProfiles = skipped\n  if (answered.length === 0) {\n    // No profile could say anything about this repository: its own failure is the answer\n    // (unreachable → QORE_API_UNREACHABLE, no token → QORE_NOT_LOGGED_IN, too old →\n    // QORE_UNSUPPORTED_BY_SERVER), not \"no module selected\".\n    const cause = skipErrors[0] ?? unsupported\n    if (cause) throw withDetails(cause, details)\n  }\n  const unchecked = skipped.length ? ` ${skipped.map((s) => s.profile).join(\", \")} could not be checked (${skipped.map((s) => s.code).join(\", \")}).` : \"\"\n  // A staging row without a usable token needs the same remedy as no staging row at all.\n  const stagingLoggedIn = Boolean(cfg.profiles[BUILTIN_PORTALS.staging.apiOrigin])\n    && !skipped.some((s) => s.profile === \"staging\" && (s.code === \"QORE_NOT_LOGGED_IN\" || s.code === \"QORE_SESSION_EXPIRED\"))\n  throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"No module selected\", {\n    hint: `This repository's remotes match no module you can access on ${answered.join(\", \")}; pass --module <slug|id>.`\n      + unchecked\n      + (stagingLoggedIn ? \"\" : \" If it is a staging repository, run `qore login --portal staging`.\"),\n    details,\n  })\n}\n\nconst appCandidates = (apps: CliRef[]): Candidate[] => apps.map((a) => ({ kind: \"app\", id: a.id, slug: a.slug, name: a.name }))\n\nexport function pickApp(mc: Pick<ModuleContext, \"module\">, app?: string): CliRef {\n  const apps = mc.module.apps\n  if (app) {\n    const found = apps.find((a) => a.id === app || a.slug === app)\n    if (!found) {\n      throw new QoreError(\"QORE_RESOURCE_NOT_FOUND\", `${mc.module.slug} is not part of an app \"${app}\" you can read`, {\n        candidates: appCandidates(apps),\n      })\n    }\n    return found\n  }\n  if (apps.length === 1) return apps[0]!\n  if (apps.length === 0) throw new QoreError(\"QORE_RESOURCE_NOT_FOUND\", `${mc.module.slug} is not part of an app you can read`)\n  throw new QoreError(\"QORE_APP_AMBIGUOUS\", `${mc.module.slug} is part of several apps`, { hint: \"Pass --app <slug>.\", candidates: appCandidates(apps) })\n}\n","import type { Keychain } from \"../../platform/keychain.js\"\n\nexport type StoredRefresh = { rt: string; sub: string; scope: string; obtainedAt: string }\nexport type StoredAccess = { at: string; expiresAt: string }\n\nexport class TokenStore {\n  constructor(private readonly kc: Keychain, private readonly hash: string) {}\n\n  private async read<T>(suffix: string): Promise<T | null> {\n    const raw = await this.kc.get(`${this.hash}:${suffix}`)\n    if (raw === null) return null\n    try { return JSON.parse(raw) as T } catch { return null }\n  }\n\n  getRefresh() { return this.read<StoredRefresh>(\"refresh\") }\n  getAccess() { return this.read<StoredAccess>(\"access\") }\n  setRefresh(v: StoredRefresh) { return this.kc.set(`${this.hash}:refresh`, JSON.stringify(v)) }\n  setAccess(v: StoredAccess) { return this.kc.set(`${this.hash}:access`, JSON.stringify(v)) }\n  async clear() {\n    await this.kc.delete(`${this.hash}:access`)\n    await this.kc.delete(`${this.hash}:refresh`)\n  }\n}\n","import { createHash } from \"node:crypto\"\nimport { QoreError } from \"./errors.js\"\n\nexport type PortalRef = { apiOrigin: string; pinnedIssuer: string | null; builtin: \"prod\" | \"staging\" | null }\n\nexport const BUILTIN_PORTALS = {\n  prod: {\n    apiOrigin: \"https://api.quatronic.app\",\n    pinnedIssuer: \"https://auth.quatronic.app/realms/platform-prod\",\n  },\n  staging: {\n    apiOrigin: \"https://p01--portal-api-staging--hcywmtb2vksv.code.run\",\n    pinnedIssuer: \"https://auth-staging.quatronic.app/realms/platform-staging\",\n  },\n} as const satisfies Record<string, { apiOrigin: string; pinnedIssuer: string | null }>\n\nfunction builtinFor(origin: string): PortalRef | null {\n  for (const [name, p] of Object.entries(BUILTIN_PORTALS)) {\n    if (p.apiOrigin === origin) return { ...p, builtin: name as \"prod\" | \"staging\" }\n  }\n  return null\n}\n\nfunction toOrigin(raw: string): string {\n  let url: URL\n  try { url = new URL(raw) } catch {\n    throw new QoreError(\"QORE_CONTEXT_INVALID\", `Not a portal name or URL: ${raw}`, {\n      hint: \"Use --portal prod, --portal staging or --portal https://…\",\n    })\n  }\n  const loopback = url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\"\n  if (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && loopback)) {\n    throw new QoreError(\"QORE_CONTEXT_INVALID\", \"A portal URL must use https (http only for localhost)\")\n  }\n  return url.origin.toLowerCase()\n}\n\nexport function resolvePortal(arg: string | undefined, defaultProfile: string | undefined): PortalRef {\n  const chosen = arg ?? defaultProfile\n  if (chosen === undefined || chosen === \"prod\") return { ...BUILTIN_PORTALS.prod, builtin: \"prod\" }\n  if (chosen === \"staging\") return { ...BUILTIN_PORTALS.staging, builtin: \"staging\" }\n  const origin = toOrigin(chosen)\n  return builtinFor(origin) ?? { apiOrigin: origin, pinnedIssuer: null, builtin: null }\n}\n\nexport function profileHash(apiOrigin: string, issuer: string): string {\n  return createHash(\"sha256\").update(`${apiOrigin}|${issuer}`).digest(\"hex\").slice(0, 16)\n}\n","import { QoreError } from \"../errors.js\"\nimport { fetchError, problemToError, type Fetch } from \"./http.js\"\n\nexport class QoreApiClient {\n  constructor(private readonly o: {\n    apiOrigin: string; fetch: Fetch; token: (force: boolean) => Promise<string>\n    cliVersion: string; command: string; platform: string; onRequest?: (line: string) => void\n  }) {}\n\n  private async once(method: \"GET\" | \"POST\", path: string, body: unknown, force: boolean): Promise<Response> {\n    const token = await this.o.token(force)\n    const headers: Record<string, string> = {\n      authorization: `Bearer ${token}`,\n      accept: \"application/json\",\n      \"qore-cli-version\": this.o.cliVersion,\n      \"qore-command\": this.o.command,\n      \"user-agent\": `qore/${this.o.cliVersion} (${this.o.platform})`,\n    }\n    if (body !== undefined) headers[\"content-type\"] = \"application/json\"\n    let res: Response\n    try {\n      res = await this.o.fetch(`${this.o.apiOrigin}${path}`, {\n        method, headers, body: body === undefined ? undefined : JSON.stringify(body),\n      })\n    } catch (e) { throw fetchError(e, new URL(this.o.apiOrigin).host) }\n    const rid = res.headers.get(\"x-request-id\")\n    this.o.onRequest?.(`${method} ${path} → ${res.status}${rid ? ` (${rid})` : \"\"}`)\n    return res\n  }\n\n  private async request<T>(method: \"GET\" | \"POST\", path: string, body?: unknown): Promise<T> {\n    let res = await this.once(method, path, body, false)\n    if (res.status === 401) {\n      res = await this.once(method, path, body, true)\n      if (res.status === 401) {\n        throw new QoreError(\"QORE_SESSION_EXPIRED\", \"The portal no longer accepts your session\", {\n          hint: \"Run `qore login`.\", status: 401, requestId: res.headers.get(\"x-request-id\") ?? undefined,\n        })\n      }\n    }\n    if (!res.ok) throw await problemToError(res)\n    return (await res.json()) as T\n  }\n\n  get<T>(path: string): Promise<T> { return this.request<T>(\"GET\", path) }\n  post<T>(path: string, body: unknown): Promise<T> { return this.request<T>(\"POST\", path, body) }\n}\n","import { QoreError } from \"../errors.js\"\nimport type { WithLock } from \"../../platform/lock.js\"\nimport type { Oidc, TokenSet } from \"./oidc.js\"\nimport type { TokenStore } from \"./tokenStore.js\"\n\nconst SKEW_MS = 60_000\n\nexport class RefreshCoordinator {\n  constructor(private readonly o: {\n    store: TokenStore; oidc: () => Promise<Oidc>; withLock: WithLock; lockName: string; now: () => Date\n  }) {}\n\n  private fresh(expiresAt: string): boolean {\n    return new Date(expiresAt).getTime() - this.o.now().getTime() > SKEW_MS\n  }\n\n  private async rotate(scope?: string): Promise<TokenSet> {\n    let stored = await this.o.store.getRefresh()\n    if (!stored) throw new QoreError(\"QORE_NOT_LOGGED_IN\", \"Not logged in\", { hint: \"Run `qore login`.\" })\n    let t: TokenSet\n    for (let attempt = 0; ; attempt++) {\n      try {\n        t = await (await this.o.oidc()).refresh(stored.rt, scope)\n        break\n      } catch (e) {\n        if (!(e instanceof QoreError && e.code === \"QORE_SESSION_EXPIRED\")) throw e\n        // Only the RT we presented was rejected. Another process may have rotated it\n        // meanwhile (a stolen stale lock, a second config dir, a lost response): then the\n        // stored RT is newer, so retry once with it instead of logging the user out.\n        const now = await this.o.store.getRefresh()\n        if (now && now.rt !== stored.rt) {\n          if (attempt === 0) { stored = now; continue }\n          throw e\n        }\n        await this.o.store.clear()\n        throw e\n      }\n    }\n    // Store the scope the token response reports: after a downscoped refresh the rotated RT\n    // may carry only the narrowed scope, so never record the old full scope for it. An empty\n    // response scope means \"as requested\" (RFC 6749 §5.1).\n    await this.o.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope || (scope ?? stored.scope), obtainedAt: this.o.now().toISOString() })\n    return t\n  }\n\n  async accessToken(opts: { force?: boolean } = {}): Promise<string> {\n    const seen = await this.o.store.getAccess()\n    if (!opts.force && seen && this.fresh(seen.expiresAt)) return seen.at\n    return this.o.withLock(this.o.lockName, async () => {\n      const again = await this.o.store.getAccess()\n      if (again && again.at !== seen?.at && this.fresh(again.expiresAt)) return again.at\n      const t = await this.rotate()\n      await this.o.store.setAccess({ at: t.accessToken, expiresAt: new Date(this.o.now().getTime() + t.expiresIn * 1000).toISOString() })\n      return t.accessToken\n    })\n  }\n\n  /** A token carrying only `scopes`, held in memory by the caller (qore mcp). */\n  async downscoped(scopes: string[]): Promise<string> {\n    return this.o.withLock(this.o.lockName, async () => (await this.rotate(scopes.join(\" \"))).accessToken)\n  }\n}\n","import { QoreApiClient } from \"./api/client.js\"\nimport { RefreshCoordinator } from \"./auth/refresh.js\"\nimport { TokenStore } from \"./auth/tokenStore.js\"\nimport type { ProfileRecord } from \"./config.js\"\nimport type { Deps } from \"./deps.js\"\nimport { QoreError } from \"./errors.js\"\nimport { profileHash, type PortalRef } from \"./profiles.js\"\n\nexport function loginHint(portal: PortalRef): string {\n  return portal.builtin === \"prod\" ? \"Run `qore login`.\" : `Run \\`qore login --portal ${portal.builtin ?? portal.apiOrigin}\\`.`\n}\n\nexport async function openSession(deps: Deps, portal: PortalRef, command: string, onRequest?: (l: string) => void) {\n  const profile: ProfileRecord | undefined = (await deps.config.read()).profiles[portal.apiOrigin]\n  if (!profile) throw new QoreError(\"QORE_NOT_LOGGED_IN\", `Not logged in to ${portal.apiOrigin}`, { hint: loginHint(portal) })\n  const hash = profileHash(profile.apiOrigin, profile.issuer)\n  const tokens = new TokenStore(deps.keychain, hash)\n  if (!(await tokens.getRefresh())) throw new QoreError(\"QORE_NOT_LOGGED_IN\", `Not logged in to ${portal.apiOrigin}`, { hint: loginHint(portal) })\n  const refresh = new RefreshCoordinator({ store: tokens, oidc: () => deps.oidcFor(profile.issuer), withLock: deps.withLock, lockName: hash, now: deps.now })\n  const api = new QoreApiClient({\n    apiOrigin: profile.apiOrigin, fetch: deps.fetch, token: (force) => refresh.accessToken({ force }),\n    cliVersion: deps.version, command, platform: `${deps.platform} ${process.arch}; node ${process.versions.node}`, onRequest,\n  })\n  return { profile, api, tokens, refresh }\n}\n\nexport type Session = Awaited<ReturnType<typeof openSession>>\n","import { join } from \"node:path\"\nimport { readJson, writeJsonAtomic } from \"../jsonFile.js\"\n\ntype Entry = { moduleId: string; resolvedAt: string }\ntype CacheFile = { schemaVersion: 1; entries: Record<string, Entry> }\nconst TTL_MS = 24 * 3600_000\n\n/** Speed and offline display only — every command still sends the moduleId to the\n * server, which authorizes it afresh (spec §5.2). */\nexport class ResolutionCache {\n  constructor(private readonly dir: string, private readonly now: () => Date) {}\n\n  private async load(): Promise<CacheFile> {\n    try {\n      const f = await readJson<CacheFile>(join(this.dir, \"repos.json\"))\n      if (f && f.schemaVersion === 1 && typeof f.entries === \"object\" && f.entries) return f\n    } catch { /* a malformed cache is an empty cache */ }\n    return { schemaVersion: 1, entries: {} }\n  }\n\n  private fresh(e: Entry | undefined): e is Entry {\n    return !!e && this.now().getTime() - new Date(e.resolvedAt).getTime() < TTL_MS\n  }\n\n  async get(origin: string, key: string): Promise<string | null> {\n    const e = (await this.load()).entries[`${origin}|${key}`]\n    return this.fresh(e) ? e.moduleId : null\n  }\n\n  /** Never throws: a read-only config dir, a full disk or a Windows EPERM on rename\n   * (another qore holding the file) must not fail a command that already resolved. */\n  async put(origin: string, key: string, moduleId: string): Promise<void> {\n    const f = await this.load()\n    f.entries[`${origin}|${key}`] = { moduleId, resolvedAt: this.now().toISOString() }\n    for (const [k, e] of Object.entries(f.entries)) if (!this.fresh(e)) delete f.entries[k]\n    await this.save(f)\n  }\n\n  /** Never throws, like `put`. */\n  async drop(origin: string, key: string): Promise<void> {\n    const f = await this.load()\n    if (!(`${origin}|${key}` in f.entries)) return\n    delete f.entries[`${origin}|${key}`]\n    await this.save(f)\n  }\n\n  private async save(f: CacheFile): Promise<void> {\n    try { await writeJsonAtomic(this.dir, \"repos.json\", f) } catch { /* cache only */ }\n  }\n\n  async originsFor(keys: string[]): Promise<string[]> {\n    const f = await this.load()\n    const hits: { origin: string; at: number }[] = []\n    for (const [k, e] of Object.entries(f.entries)) {\n      const sep = k.lastIndexOf(\"|\")\n      if (keys.includes(k.slice(sep + 1)) && this.fresh(e)) hits.push({ origin: k.slice(0, sep), at: new Date(e.resolvedAt).getTime() })\n    }\n    hits.sort((a, b) => b.at - a.at)\n    return [...new Set(hits.map((h) => h.origin))]\n  }\n}\n","import { chmod, mkdir, readFile, rename, writeFile } from \"node:fs/promises\"\nimport { join } from \"node:path\"\nimport { randomBytes } from \"node:crypto\"\n\nexport async function readJson<T>(file: string): Promise<T | null> {\n  let raw: string\n  try { raw = await readFile(file, \"utf8\") } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return null\n    throw e\n  }\n  return JSON.parse(raw) as T\n}\n\nexport async function writeJsonAtomic(dir: string, name: string, data: unknown): Promise<void> {\n  await mkdir(dir, { recursive: true, mode: 0o700 })\n  const tmp = join(dir, `.${name}.${randomBytes(6).toString(\"hex\")}.tmp`)\n  await writeFile(tmp, JSON.stringify(data, null, 2) + \"\\n\", { mode: 0o600 })\n  await chmod(tmp, 0o600)\n  await rename(tmp, join(dir, name))\n}\n","/** `host/owner/repo`, lowercase — the same normalisation portal-api applies\n * (QDC `services/cli_repo_key.py`), pinned by a shared parity table. */\n\n// scp-like git syntax: [user@]host:path, path not starting with \"/\".\nconst SCP = /^(?:[^@/]+@)?([^:/]+):([^/].*)$/\nconst SCHEMES = new Set([\"https:\", \"http:\", \"ssh:\", \"git:\"])\n// Dot segments, also percent-encoded: WHATWG URL resolves these and Python's urlsplit\n// does not, so the two sides would disagree. Neither is a realistic remote: reject.\nconst DOT_SEGMENTS = new Set([\".\", \"..\", \"%2e\", \"%2e%2e\", \".%2e\", \"%2e.\"])\nconst hasDotSegment = (pieces: string[]) => pieces.some((p) => DOT_SEGMENTS.has(p.toLowerCase()))\n\nexport function repoKey(url: string): string | null {\n  let raw = url.trim()\n  if (raw.startsWith(\"git+\")) raw = raw.slice(4)\n  // A backslash is a separator to WHATWG but a literal to urlsplit: reject it outright.\n  if (!raw || raw.includes(\"\\\\\")) return null\n  let host: string\n  let path: string\n  if (raw.includes(\"://\")) {\n    if (hasDotSegment(raw.slice(raw.indexOf(\"://\") + 3).split(\"/\").slice(1))) return null\n    let u: URL\n    try { u = new URL(raw) } catch { return null }\n    if (!SCHEMES.has(u.protocol.toLowerCase())) return null\n    // WHATWG leaves non-special hosts (ssh:, git:) in their original case.\n    host = u.hostname\n    path = u.pathname\n  } else {\n    const m = SCP.exec(raw)\n    if (!m) return null\n    host = m[1]!\n    path = m[2]!\n  }\n  const segments = path.split(\"/\").filter(Boolean)\n  if (!host || segments.length !== 2 || hasDotSegment(segments)) return null\n  const owner = segments[0]!\n  let repo = segments[1]!\n  if (repo.toLowerCase().endsWith(\".git\")) repo = repo.slice(0, -4)\n  if (!repo) return null\n  return `${host.toLowerCase()}/${owner.toLowerCase()}/${repo.toLowerCase()}`\n}\n","import { stat } from \"node:fs/promises\"\nimport { dirname, join, resolve } from \"node:path\"\n\n/** The first directory upwards that holds `.git` — a directory, or a file in a\n * worktree or submodule (spec §5.2 step 1, §15). */\nexport async function findRepoRoot(start: string): Promise<string | null> {\n  let dir = resolve(start)\n  for (;;) {\n    try {\n      await stat(join(dir, \".git\"))\n      return dir\n    } catch { /* not here (or unreadable): keep walking up */ }\n    const up = dirname(dir)\n    if (up === dir) return null\n    dir = up\n  }\n}\n","import { ensureCapability } from \"../api/capabilities.js\"\nimport type { CliLocalEnv, CliRef } from \"../api/types.js\"\nimport { withDetails } from \"../context/resolver.js\"\nimport type { ModuleContext } from \"../context/resolver.js\"\nimport type { Deps } from \"../deps.js\"\nimport { QoreError } from \"../errors.js\"\n\nexport async function fetchLocalEnv(deps: Deps, mc: ModuleContext, app: CliRef): Promise<CliLocalEnv> {\n  await ensureCapability(deps, mc.portal.apiOrigin, \"module.local-env\")\n  try {\n    return await mc.session.api.get<CliLocalEnv>(\n      `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/local-env?app_id=${encodeURIComponent(app.id)}`)\n  } catch (e) {\n    if (!(e instanceof QoreError) || e.code !== \"QORE_ACCESS_DENIED\") throw e\n    if (e.serverCode === \"app.access.denied\") {\n      throw withDetails(e, { required: \"write\", have: mc.module.access },\n        `You have ${mc.module.access} on ${mc.module.slug}; local secrets need write. Ask a maintainer of the app's dev team for write access.`)\n    }\n    // C13: a token minted before qore:local-env existed as a scope.\n    if (e.serverCode === \"auth.scope.insufficient\") throw withDetails(e, {}, \"Run `qore login` again.\")\n    throw e\n  }\n}\n","/** .env merge semantics, ported behaviour-identically from qdc-sdk\n * packages/sdk/src/cli/setup-env-core.ts (spec §11.1). Keep the two in step until\n * the SDK's copy is removed in migration phase 2. */\n\n/** Parse `.env` text into an ordered Map<key,value>. Comments and blank lines\n *  are not represented (preserved separately by renderEnv). */\nexport function parseEnv(contents: string): Map<string, string> {\n  const map = new Map<string, string>()\n  for (const line of contents.split(\"\\n\")) {\n    const m = line.replace(/\\r$/, \"\").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/)\n    if (m?.[1] !== undefined && m[2] !== undefined) map.set(m[1], m[2])\n  }\n  return map\n}\n\n/** Does `key` match one of the portal's managed-key patterns? Exact match, or\n *  the single wildcard form `PREFIX_*` used for CONN_*. */\nexport function isManagedKey(key: string, managed: string[]): boolean {\n  for (const pattern of managed) {\n    if (pattern.endsWith(\"*\")) {\n      if (key.startsWith(pattern.slice(0, -1))) return true\n    } else if (key === pattern) return true\n  }\n  return false\n}\n\nexport function planEnvUpdate({\n  current,\n  fetched,\n  choices = {},\n  defaultChoice = \"keep\",\n  managed = [],\n}: {\n  current: Map<string, string>\n  fetched: Record<string, string>\n  choices?: Record<string, \"keep\" | \"use-portal\">\n  defaultChoice?: \"keep\" | \"use-portal\"\n  managed?: string[]\n}): {\n  merged: Map<string, string>\n  conflicts: string[]\n  added: string[]\n  unchanged: string[]\n  overwritten: string[]\n} {\n  const merged = new Map(current)\n  const conflicts: string[] = []\n  const added: string[] = []\n  const unchanged: string[] = []\n  const overwritten: string[] = []\n\n  for (const [key, portalValue] of Object.entries(fetched)) {\n    const hasLocal = current.has(key)\n    const localValue = current.get(key)\n    const localEmpty = !hasLocal || localValue === \"\" || localValue === '\"\"' || localValue === \"''\"\n\n    if (localEmpty) {\n      merged.set(key, portalValue)\n      added.push(key)\n      continue\n    }\n    if (localValue === portalValue) {\n      unchanged.push(key)\n      continue\n    }\n    // The portal owns this key: take its value without asking. Anything the\n    // developer needs to override permanently belongs in the portal as a\n    // `local` secret, not in a hand-edited .env.local.\n    if (isManagedKey(key, managed)) {\n      merged.set(key, portalValue)\n      overwritten.push(key)\n      continue\n    }\n    conflicts.push(key)\n    const choice = choices[key] ?? defaultChoice\n    merged.set(key, choice === \"use-portal\" ? portalValue : localValue!)\n  }\n\n  return { merged, conflicts, added, unchanged, overwritten }\n}\n\n/** Render the merged Map back to `.env` text, preserving original comments,\n *  blank lines, and key order. New keys are appended at the end. */\nexport function renderEnv(original: string, merged: Map<string, string>): string {\n  const seen = new Set<string>()\n  const lines = original.split(\"\\n\")\n  const out = lines.map((line) => {\n    const m = line.replace(/\\r$/, \"\").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/)\n    if (!m?.[1]) return line\n    const key: string = m[1]\n    if (!merged.has(key)) return line\n    seen.add(key)\n    return `${key}=${merged.get(key) ?? \"\"}`\n  })\n\n  const appended: string[] = []\n  for (const [key, value] of merged) {\n    if (!seen.has(key)) appended.push(`${key}=${value}`)\n  }\n\n  let text = out.join(\"\\n\")\n  if (appended.length) {\n    if (text.length && !text.endsWith(\"\\n\")) text += \"\\n\"\n    text += appended.join(\"\\n\") + \"\\n\"\n  }\n  return text\n}\n","import { lstat, realpath } from \"node:fs/promises\"\nimport { basename, dirname, isAbsolute, relative, resolve, sep } from \"node:path\"\nimport { QoreError } from \"../errors.js\"\nimport { parseEnv, planEnvUpdate, renderEnv } from \"./merge.js\"\n\nconst outside = (target: string) => new QoreError(\"QORE_CONTEXT_INVALID\", `The env file must be inside the repository (got ${target})`, {\n  hint: \"Use a path inside the repository for --target or .qore.json envFile.\",\n})\n\nconst symlinked = (target: string) => new QoreError(\"QORE_CONTEXT_INVALID\", `The env file target must not be a symlink (got ${target})`, {\n  hint: \"Use a path inside the repository for --target or .qore.json envFile.\",\n})\n\nfunction inside(root: string, p: string): boolean {\n  const rel = relative(root, p)\n  return rel !== \"\" && rel !== \"..\" && !rel.startsWith(\"..\" + sep) && !isAbsolute(rel)\n}\n\n/** Spec §11.1 step 3, carried over from qdc-setup-env — plus a realpath check, so a\n * symlinked directory cannot carry the write out of the repository (review focus 1).\n *\n * `base` is where `target` is resolved from: the cwd for `--target`, the repository root\n * for `.qore.json`'s `envFile` (ruling R11) — both must still land inside `root`. Both sides\n * are compared by realpath(root) so macOS's /var → /private/var symlink cannot make an\n * in-repo path look external (ruling B5). */\nexport async function resolveTarget(root: string, target: string, base: string = root): Promise<string> {\n  const realRoot = await realpath(root)\n  const realBase = base === root ? realRoot : await realpath(base)\n  const abs = resolve(realBase, target)\n  // I2: `abs` is not yet realpath'd, so an absolute target spelled through a symlinked\n  // directory (e.g. a repo under macOS /var, whose realpath is /private/var) would be\n  // falsely rejected here even though it lands inside the repository. Containment is\n  // enforced for real below, once the path is realpath'd (`final`, `realFinal`). This is\n  // only a cheap pre-filter for the common relative-escape case (`../../etc/passwd`),\n  // where realpath'ing an already-inside `abs` is pointless work to skip.\n  if (!isAbsolute(target) && !inside(realRoot, abs)) throw outside(target)\n  let parent: string\n  try { parent = await realpath(dirname(abs)) } catch (e) {\n    if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e\n    throw new QoreError(\"QORE_CONTEXT_INVALID\", `The directory for ${target} does not exist`, {\n      hint: \"Create the parent directory, or point --target / .qore.json envFile at an existing one.\",\n    })\n  }\n  const final = resolve(parent, basename(abs))\n  if (!inside(realRoot, final)) throw outside(target)\n\n  // Review focus 1: an existing final path component that is itself a symlink is refused\n  // outright — its target is never trusted, in or out of the repo — and if somehow not a\n  // symlink but its realpath still escapes, that is refused too.\n  try {\n    const st = await lstat(final)\n    if (st.isSymbolicLink()) throw symlinked(target)\n    const realFinal = await realpath(final)\n    if (!inside(realRoot, realFinal)) throw outside(target)\n  } catch (e) {\n    if (e instanceof QoreError) throw e\n    if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e\n  }\n\n  return final\n}\n\nexport type PullPlan = {\n  text: string; created: boolean; seededFromExample: boolean\n  added: string[]; updated: string[]; kept: string[]; replaced: string[]; unchanged: string[]; generated: string[]\n}\n\nexport function planPull(o: {\n  existing: string | null; example: string | null; fetched: Record<string, string>; managed: string[]\n  localSecrets: string[]; choices?: Record<string, \"keep\" | \"use-portal\">; defaultChoice: \"keep\" | \"use-portal\"; random: () => string\n}): PullPlan & { conflicts: string[] } {\n  const original = o.existing ?? o.example ?? \"\"\n  const current = parseEnv(original)\n  const r = planEnvUpdate({ current, fetched: o.fetched, choices: o.choices ?? {}, defaultChoice: o.defaultChoice, managed: o.managed })\n  const choiceOf = (k: string) => o.choices?.[k] ?? o.defaultChoice\n  const generated: string[] = []\n  for (const key of o.localSecrets) {\n    const v = r.merged.get(key)\n    if (v === undefined || v === \"\" || v === '\"\"' || v === \"''\") { r.merged.set(key, o.random()); generated.push(key) }\n  }\n  return {\n    text: renderEnv(original, r.merged),\n    created: o.existing === null,\n    seededFromExample: o.existing === null && o.example !== null,\n    added: r.added, updated: r.overwritten, unchanged: r.unchanged, conflicts: r.conflicts,\n    kept: r.conflicts.filter((k) => choiceOf(k) === \"keep\"),\n    replaced: r.conflicts.filter((k) => choiceOf(k) === \"use-portal\"),\n    generated,\n  }\n}\n","import type { CliRef } from \"../core/api/types.js\"\nimport { QoreError, type Candidate } from \"../core/errors.js\"\nimport { pickApp, resolveModuleContext, type ModuleContext } from \"../core/context/resolver.js\"\nimport type { CommandContext } from \"./program.js\"\n\nconst allOfKind = (c: Candidate[] | undefined, kind: Candidate[\"kind\"]): c is (Candidate & { id: string })[] =>\n  !!c && c.length > 0 && c.every((x) => x.kind === kind && typeof x.id === \"string\")\n\nexport async function moduleContextFor(ctx: CommandContext, flags: { module?: string }, command: string): Promise<ModuleContext> {\n  const g = ctx.opts()\n  const onRequest = g.verbose ? (l: string) => ctx.io.err(l) : undefined\n  const base = { portal: g.portal, module: flags.module, command, onRequest }\n  try {\n    return await resolveModuleContext(ctx.deps, base)\n  } catch (e) {\n    if (!(e instanceof QoreError) || e.code !== \"QORE_CONTEXT_REQUIRED\" || !ctx.io.interactive) throw e\n    // core/ never prompts (R5): it names the candidates, and only here do they become a picker.\n    if (allOfKind(e.candidates, \"module\")) {\n      const choose = await ctx.io.select(\"Select a module\",\n        e.candidates.map((c) => ({ name: `${c.tenant ? `${c.tenant} / ` : \"\"}${c.slug}  (${c.remote})`, value: c.id })))\n      return resolveModuleContext(ctx.deps, { ...base, choose })\n    }\n    if (allOfKind(e.candidates, \"tenant\")) {\n      const tenant = await ctx.io.select(\"Select a tenant\", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.id })))\n      return resolveModuleContext(ctx.deps, { ...base, tenant })\n    }\n    throw e\n  }\n}\n\nexport async function appFor(ctx: CommandContext, mc: ModuleContext, app?: string): Promise<CliRef> {\n  try {\n    return pickApp(mc, app)\n  } catch (e) {\n    if (!(e instanceof QoreError) || e.code !== \"QORE_APP_AMBIGUOUS\" || !ctx.io.interactive) throw e\n    const id = await ctx.io.select(\"Select an app\", mc.module.apps.map((a) => ({ name: a.name, value: a.id })))\n    return pickApp(mc, id)\n  }\n}\n\nfunction sourceText(mc: ModuleContext): string {\n  if (mc.source.kind === \"remote\") return mc.source.remote\n  return mc.source.overrides ? `--module, overrides ${mc.source.overrides}` : \"--module\"\n}\n\nexport function contextLine(mc: ModuleContext, app?: CliRef): string {\n  const parts = [mc.module.tenant.name, ...(app ? [app.name] : []), mc.module.slug]\n  return `→ ${parts.join(\" / \")}  (${sourceText(mc)})`\n}\n\nexport function contextJson(mc: ModuleContext, app?: CliRef) {\n  const { id, slug, name, type, access } = mc.module\n  return {\n    portal: mc.portal.builtin ?? mc.portal.apiOrigin,\n    tenant: mc.module.tenant,\n    app: app ?? null,\n    module: { id, slug, name, type, access },\n    source: mc.source.kind === \"remote\" ? mc.source.remote : \"--module\",\n    ...(mc.source.kind === \"flag\" && mc.source.overrides ? { overrides: mc.source.overrides } : {}),\n  }\n}\n","import { realpath } from \"node:fs/promises\"\nimport type { Deps } from \"./deps.js\"\n\n/** Spec §5.4: a safety interlock, not authorization — the server still authorizes. */\nexport function trustKey(root: string, platform: NodeJS.Platform): string {\n  return platform === \"win32\" ? root.toLowerCase() : root\n}\n\nasync function keyOf(deps: Deps, root: string): Promise<string> {\n  let real = root\n  try {\n    real = await realpath(root)\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e\n    // a vanished dir keeps its literal path\n  }\n  return trustKey(real, deps.platform)\n}\n\nexport async function isTrusted(deps: Deps, root: string, moduleId: string): Promise<boolean> {\n  const cfg = await deps.config.read()\n  return (cfg.trustedRepos?.[await keyOf(deps, root)] ?? []).includes(moduleId)\n}\n\nexport async function trust(deps: Deps, root: string, moduleId: string): Promise<void> {\n  const key = await keyOf(deps, root)\n  await deps.config.update((c) => {\n    const repos = (c.trustedRepos ??= {})\n    const list = new Set(repos[key] ?? [])\n    list.add(moduleId)\n    repos[key] = [...list]\n  })\n}\n","import type { CliRef } from \"../core/api/types.js\"\nimport { repoKey } from \"../core/context/repoKey.js\"\nimport type { ModuleContext } from \"../core/context/resolver.js\"\nimport { CancelledError, QoreError } from \"../core/errors.js\"\nimport { isTrusted, trust } from \"../core/trust.js\"\nimport { contextLine } from \"./context.js\"\nimport type { CommandContext } from \"./program.js\"\n\n/** Task 10: the trust interlock (spec §5.4) as a first-use prompt. Trust is a safety\n * interlock, not authorization — the server still authorizes every fetch.\n *\n * Ruling C8: the context line prints exactly once, here — before the trust prompt, and\n * also before the untrusted non-TTY error — so the caller (env.ts) must not print it\n * again after calling this. */\nexport async function ensureTrusted(ctx: CommandContext, mc: ModuleContext, app: CliRef, o: { yes?: boolean }): Promise<void> {\n  const root = mc.repoRoot ?? ctx.deps.cwd\n  if (!ctx.opts().json) ctx.io.err(contextLine(mc, app))\n  if (await isTrusted(ctx.deps, root, mc.module.id)) return\n  if (o.yes) { await trust(ctx.deps, root, mc.module.id); return }\n  if (!ctx.io.interactive) {\n    throw new QoreError(\"QORE_CONTEXT_REQUIRED\", `This repository is not trusted for ${mc.module.slug} yet`, {\n      hint: \"Run interactively once, or pass --yes.\", details: { reason: \"untrusted\", repository: root },\n    })\n  }\n  if (mc.source.kind === \"remote\") {\n    // I1: never print the raw remote URL — it may embed credentials (e.g. an\n    // https x-access-token PAT). Print the normalised repo key instead.\n    const key = repoKey(mc.source.url)\n    ctx.io.err(`  from remote ${mc.source.remote}: ${key ?? \"(unparsable remote URL)\"}`)\n  }\n  if (!(await ctx.io.confirm(\"Pull local secrets for this module into this repository?\"))) throw new CancelledError()\n  await trust(ctx.deps, root, mc.module.id)\n}\n","import * as oc from \"openid-client\"\nimport { CancelledError, QoreError } from \"../errors.js\"\nimport type { Fetch } from \"../api/http.js\"\nimport { isAbortError, networkError } from \"../api/http.js\"\n\nexport type DeviceStart = { userCode: string; verificationUri: string; verificationUriComplete?: string; expiresIn: number; handle: unknown }\nexport type TokenSet = { accessToken: string; refreshToken: string; expiresIn: number; scope: string; sub: string; email?: string }\n\nexport interface Oidc {\n  startDevice(scope: string): Promise<DeviceStart>\n  pollDevice(start: DeviceStart, signal: AbortSignal): Promise<TokenSet>\n  refresh(rt: string, scope?: string): Promise<TokenSet>\n  revoke(rt: string): Promise<void>\n}\n\nexport const LOGIN_SCOPE = \"openid profile email offline_access qore:read qore:local-env\"\n\nfunction decodeSub(accessToken: string): { sub: string; email?: string } {\n  const part = accessToken.split(\".\")[1] ?? \"\"\n  const claims = JSON.parse(Buffer.from(part, \"base64url\").toString(\"utf8\")) as { sub: string; email?: string }\n  return { sub: claims.sub, email: claims.email }\n}\n\nfunction toTokenSet(t: oc.TokenEndpointResponse, fallbackRt?: string): TokenSet {\n  const rt = t.refresh_token ?? fallbackRt\n  if (!rt) throw new QoreError(\"QORE_INTERNAL\", \"Keycloak returned no refresh token\")\n  return { accessToken: t.access_token, refreshToken: rt, expiresIn: t.expires_in ?? 600,\n    scope: t.scope ?? \"\", ...decodeSub(t.access_token) }\n}\n\n/** Keycloak unreachable is QORE_AUTH_UNAVAILABLE (spec §7, §14; R19), not the portal's\n * QORE_API_UNREACHABLE — with the same network diagnosis (hint, reason, host). */\nfunction unreachable(e: unknown, host: string): QoreError {\n  const n = networkError(e, host)\n  return new QoreError(\"QORE_AUTH_UNAVAILABLE\", n.message, { hint: n.hint, details: n.details, cause: e })\n}\n\nexport function mapOidcError(e: unknown, host: string): Error {\n  if (e instanceof QoreError || e instanceof CancelledError) return e\n  // Ctrl+C aborts the request's signal; openid-client wraps that DOMException as\n  // ClientError { code: \"OAUTH_ABORT\", cause }.\n  if (isAbortError(e) || (e as { code?: unknown })?.code === \"OAUTH_ABORT\" || isAbortError((e as { cause?: unknown })?.cause)) {\n    return new CancelledError()\n  }\n  const err = (e as { error?: string }).error\n  if (err === \"access_denied\") return new QoreError(\"QORE_LOGIN_DENIED\", \"The login was denied in the browser\")\n  if (err === \"expired_token\") return new QoreError(\"QORE_LOGIN_EXPIRED\", \"The login code expired\", { hint: \"Run `qore login` again.\" })\n  if (err === \"invalid_grant\") return new QoreError(\"QORE_SESSION_EXPIRED\", \"Your session has ended\", { hint: \"Run `qore login`.\" })\n  const status = (e as { status?: number }).status\n  if (status && status >= 500) return new QoreError(\"QORE_AUTH_UNAVAILABLE\", \"Keycloak is unavailable\", { cause: e })\n  if (e instanceof TypeError) return unreachable(e, host)\n  // openid-client sometimes wraps the raw fetch TypeError (DNS/TLS/connect/timeout) one\n  // level deep, e.g. `new ClientError(\"something went wrong\", { cause: err })`.\n  const cause = (e as { cause?: unknown })?.cause\n  if (cause instanceof TypeError) return unreachable(cause, host)\n  return new QoreError(\"QORE_AUTH_UNAVAILABLE\", \"Login failed\", { cause: e })\n}\n\nexport async function createOidc(opts: { issuer: string; clientId: string; fetch: Fetch }): Promise<Oidc> {\n  const host = new URL(opts.issuer).host\n  const execute = new URL(opts.issuer).protocol === \"http:\" ? [oc.allowInsecureRequests] : []\n  let config: oc.Configuration\n  try {\n    config = await oc.discovery(new URL(opts.issuer), opts.clientId, undefined, oc.None(), {\n      execute, [oc.customFetch]: opts.fetch as unknown as oc.CustomFetch,\n    })\n  } catch (e) { throw mapOidcError(e, host) }\n\n  return {\n    async startDevice(scope) {\n      try {\n        const r = await oc.initiateDeviceAuthorization(config, { scope })\n        return { userCode: r.user_code, verificationUri: r.verification_uri,\n          verificationUriComplete: r.verification_uri_complete, expiresIn: r.expires_in, handle: r }\n      } catch (e) { throw mapOidcError(e, host) }\n    },\n    async pollDevice(start, signal) {\n      try {\n        const t = await oc.pollDeviceAuthorizationGrant(config, start.handle as oc.DeviceAuthorizationResponse, undefined, { signal })\n        return toTokenSet(t)\n      } catch (e) { throw mapOidcError(e, host) }\n    },\n    async refresh(rt, scope) {\n      try {\n        const t = await oc.refreshTokenGrant(config, rt, scope ? { scope } : undefined)\n        return toTokenSet(t, rt)\n      } catch (e) { throw mapOidcError(e, host) }\n    },\n    async revoke(rt) {\n      try { await oc.tokenRevocation(config, rt, { token_type_hint: \"refresh_token\" }) }\n      catch (e) { throw mapOidcError(e, host) }\n    },\n  }\n}\n","import type { WithLock } from \"../../platform/lock.js\"\nimport type { DeviceStart, Oidc, TokenSet } from \"./oidc.js\"\nimport { LOGIN_SCOPE } from \"./oidc.js\"\nimport type { TokenStore } from \"./tokenStore.js\"\n\nexport async function deviceLogin(opts: {\n  oidc: Oidc\n  store: TokenStore\n  now: () => Date\n  /** Shows the code. Polling already runs meanwhile; `settled` aborts once it succeeds or\n   * fails, so a prompt waiting on the user (who may have opened the URL themselves) can end. */\n  onCode: (s: DeviceStart, settled: AbortSignal) => void | Promise<void>\n  signal: AbortSignal\n  withLock?: WithLock\n  lockName?: string\n}): Promise<TokenSet> {\n  // Probe the keychain first: an unusable or denied keychain must fail before the user\n  // approves anything in the browser (Review Focus #4), not after.\n  await opts.store.getRefresh()\n  const start = await opts.oidc.startDevice(LOGIN_SCOPE)\n  const stopPoll = new AbortController()\n  const settled = new AbortController()\n  const poll = opts.oidc.pollDevice(start, AbortSignal.any([opts.signal, stopPoll.signal]))\n    .finally(() => settled.abort())\n  // Awaited below; this only keeps a poll that fails while onCode runs from counting as unhandled.\n  poll.catch(() => {})\n  try {\n    await opts.onCode(start, settled.signal)\n  } catch (e) {\n    stopPoll.abort()\n    // Approved just before onCode failed: that session is never stored, so end it server-side.\n    const late = await poll.catch(() => null)\n    if (late) await opts.oidc.revoke(late.refreshToken).catch(() => {})\n    throw e\n  }\n  const t = await poll\n  const at = opts.now()\n  const write = async () => {\n    // Refresh first: a crash between the two writes then leaves a usable session.\n    await opts.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope, obtainedAt: at.toISOString() })\n    await opts.store.setAccess({ at: t.accessToken, expiresAt: new Date(at.getTime() + t.expiresIn * 1000).toISOString() })\n  }\n  try {\n    if (opts.withLock && opts.lockName) await opts.withLock(opts.lockName, write)\n    else await write()\n  } catch (e) {\n    // The new session cannot be kept: end it server-side and drop any half-written entry.\n    // Both best-effort; the original (keychain) error is what the user needs to see.\n    await opts.oidc.revoke(t.refreshToken).catch(() => {})\n    await opts.store.clear().catch(() => {})\n    throw e\n  }\n  return t\n}\n","import type { Command } from \"commander\"\nimport { fetchMeta, negotiate } from \"../../core/api/meta.js\"\nimport type { CliMe, CliMeta } from \"../../core/api/types.js\"\nimport { deviceLogin } from \"../../core/auth/login.js\"\nimport { TokenStore } from \"../../core/auth/tokenStore.js\"\nimport { profileHash, resolvePortal } from \"../../core/profiles.js\"\nimport { openSession } from \"../../core/session.js\"\nimport { requestLog, type CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerLogin(program: Command, ctx: CommandContext): void {\n  program.command(\"login\").description(\"Log in with your Qore account\")\n    .option(\"--no-browser\", \"only print the URL\")\n    .action(async (cmd: { browser: boolean }) => {\n      const { deps, io, signal } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      const meta: CliMeta = await fetchMeta(deps.fetch, portal.apiOrigin)\n      const known = cfg.profiles[portal.apiOrigin]?.issuer\n      const pinned = { ...portal, pinnedIssuer: portal.pinnedIssuer ?? known ?? null }\n      if (!pinned.pinnedIssuer && portal.builtin === null) {\n        io.err(`! Logging in to ${portal.apiOrigin}, identity provider ${meta.auth.issuer}`)\n      }\n      negotiate(meta, pinned, deps.version)\n      const issuer = pinned.pinnedIssuer ?? meta.auth.issuer\n      const hash = profileHash(portal.apiOrigin, issuer)\n      const store = new TokenStore(deps.keychain, hash)\n      const t = await deviceLogin({\n        oidc: await deps.oidcFor(issuer), store, now: deps.now, signal,\n        withLock: deps.withLock, lockName: hash,\n        onCode: async (s, settled) => {\n          const url = s.verificationUriComplete ?? s.verificationUri\n          io.err(`! First copy your one-time code: ${s.userCode}`)\n          if (io.interactive && cmd.browser) {\n            try {\n              await io.waitForEnter(`  Press Enter to open ${url} (or open it yourself)`, AbortSignal.any([signal, settled]))\n            } catch (e) {\n              // Approved (or denied) in a browser the user opened themselves: nothing left to open.\n              if (settled.aborted && !signal.aborted) return\n              throw e\n            }\n            if (settled.aborted) return\n            if (!(await io.openUrl(url))) io.err(`  Open ${url} in a browser`)\n          } else {\n            io.err(`  Open ${url} in a browser`)\n          }\n        },\n      })\n      await deps.config.update((c) => {\n        c.profiles[portal.apiOrigin] = { ...c.profiles[portal.apiOrigin], apiOrigin: portal.apiOrigin, issuer,\n          sub: t.sub, email: t.email, meta: { fetchedAt: deps.now().toISOString(), doc: meta } }\n        if (g.portal || !c.defaultProfile) c.defaultProfile = portal.apiOrigin\n      })\n      const { api } = await openSession(deps, { ...portal, pinnedIssuer: issuer }, \"login\", requestLog(ctx))\n      const me = await api.get<CliMe>(\"/api/cli/v1/me\")\n      const prev = cfg.profiles[portal.apiOrigin]\n      let active: { id: string; slug: string } | undefined =\n        prev?.sub === t.sub && prev.activeTenant && me.tenants.some((x) => x.id === prev.activeTenant!.id)\n          ? prev.activeTenant\n          : undefined\n      if (active) {\n        // A previous session's active tenant is still valid for this sub: keep it, no re-selection.\n      } else if (me.tenants.length === 0) {\n        io.err(\"! Your account is not a developer in any organisation. Ask an admin to invite you as developer.\")\n      } else if (me.tenants.length === 1) {\n        active = { id: me.tenants[0]!.id, slug: me.tenants[0]!.slug }\n        io.err(`✓ Using tenant ${me.tenants[0]!.name}`)\n      } else if (io.interactive) {\n        active = await io.select(\"Select a tenant\", me.tenants.map((x) => ({ name: `${x.name}  ${x.role}`, value: { id: x.id, slug: x.slug } })))\n      } else {\n        io.err(`! You belong to ${me.tenants.length} tenants; choose one with \\`qore tenant use <slug>\\``)\n      }\n      await deps.config.update((c) => { c.profiles[portal.apiOrigin]!.activeTenant = active })\n      const label = portal.builtin ?? portal.apiOrigin\n      if (g.json) renderJson(io, { portal: label, email: me.email, activeTenant: active ?? null })\n      else io.out(`✓ Logged in as ${me.email} (${label})`)\n    })\n}\n","import type { Command } from \"commander\"\nimport { TokenStore } from \"../../core/auth/tokenStore.js\"\nimport { QoreError } from \"../../core/errors.js\"\nimport { profileHash, resolvePortal } from \"../../core/profiles.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerLogout(program: Command, ctx: CommandContext): void {\n  program.command(\"logout\").description(\"End the CLI session\")\n    .option(\"--all\", \"log out of every portal\")\n    .action(async (cmd: { all?: boolean }) => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const targets = cmd.all ? Object.values(cfg.profiles)\n        : [cfg.profiles[resolvePortal(g.portal, cfg.defaultProfile).apiOrigin]].filter((p) => p !== undefined)\n      const done: string[] = []\n      for (const p of targets) {\n        const hash = profileHash(p.apiOrigin, p.issuer)\n        const store = new TokenStore(deps.keychain, hash)\n        const host = new URL(p.issuer).host\n        // Read, revoke and clear under one lock, so a concurrent refresh cannot rotate the\n        // RT between our read and the revoke (we would revoke a stale one) or resurrect it.\n        await deps.withLock(hash, async () => {\n          const rt = await store.getRefresh()\n          if (rt) {\n            try { await (await deps.oidcFor(p.issuer)).revoke(rt.rt) }\n            catch (e) {\n              const network = e instanceof QoreError && e.details?.reason !== undefined\n              io.err(network\n                ? `! Could not reach ${host}; the server session may persist until it expires.`\n                : `! Could not revoke the session at ${host} (${e instanceof Error ? e.message : String(e)}); the server session may persist until it expires.`)\n            }\n          }\n          await store.clear()\n        })\n        done.push(p.apiOrigin)\n      }\n      if (g.json) renderJson(io, { loggedOut: done })\n      else if (done.length === 0) io.out(\"Not logged in\")\n      else io.out(`✓ Logged out of ${done.map((o) => resolvePortal(o, undefined).builtin ?? o).join(\", \")}`)\n    })\n}\n","import { constants } from \"node:os\"\nimport type { Command } from \"commander\"\nimport { QoreError } from \"../../core/errors.js\"\nimport { fetchLocalEnv } from \"../../core/env/fetch.js\"\nimport { appFor, moduleContextFor } from \"../context.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { ensureTrusted } from \"../trustPrompt.js\"\n\n/** Ruling R3: while the child runs, cli.ts's own SIGINT handler must not force `exit(130)`\n * — the terminal already delivers Ctrl+C to the whole foreground process group (see\n * platform/spawn.ts), so the child's own exit (code or re-raised signal) is what decides\n * qore's exit code. This flag is the narrow hook cli.ts checks; it brackets exactly the\n * `deps.spawn.run` call, nothing more. */\nexport const childRunning = { current: false }\n\nexport function registerRun(program: Command, ctx: CommandContext): void {\n  program\n    .command(\"run\")\n    .description(\"Run a command with this module's local secrets in its environment\")\n    .option(\"--module <slug|id>\", \"the module (default: from this repository's git remote)\")\n    .option(\"--app <slug|id>\", \"the app, when the module is part of several\")\n    .option(\"--yes\", \"trust this repository without asking\")\n    .argument(\"<command>\", \"the command to run (after --)\")\n    .argument(\"[args...]\", \"its arguments, passed verbatim\")\n    .action(async (cmd: string, args: string[], f: { module?: string; app?: string; yes?: boolean }) => {\n      const { deps } = ctx\n      if (ctx.opts().json) {\n        throw new QoreError(\"QORE_CONTEXT_INVALID\", \"run has no --json output\", {\n          hint: \"Drop --json; the child's own output passes through.\",\n        })\n      }\n      const mc = await moduleContextFor(ctx, f, \"run\")\n      const app = await appFor(ctx, mc, f.app)\n      // C8: ensureTrusted prints the context line exactly once — do not print it again here.\n      await ensureTrusted(ctx, mc, app, { yes: f.yes })\n      const local = await fetchLocalEnv(deps, mc, app) // fetched on every run, never cached (§11.2)\n      childRunning.current = true\n      let exit\n      try {\n        exit = await deps.spawn.run(cmd, args, { ...deps.env, ...local.env })\n      } finally {\n        childRunning.current = false\n      }\n      if (exit.signal) {\n        deps.raise(exit.signal)\n        ctx.setExitCode(128 + (constants.signals[exit.signal] ?? 0))\n        return\n      }\n      ctx.setExitCode(exit.code ?? 1)\n    })\n}\n","import type { CliHealth } from \"../core/api/types.js\"\n\nexport function ago(iso: string | null, now: Date): string {\n  if (!iso) return \"–\"\n  const s = Math.max(0, Math.round((now.getTime() - new Date(iso).getTime()) / 1000))\n  if (s < 60) return \"just now\"\n  if (s < 3600) return `${Math.floor(s / 60)}m ago`\n  if (s < 86400) return `${Math.floor(s / 3600)}h ago`\n  return `${Math.floor(s / 86400)}d ago`\n}\n\nconst pct = (f: number) => String(Number((f * 100).toFixed(2)))\n\nexport function uptime(h: CliHealth | null): string {\n  if (!h) return \"–\"\n  const kind = h.cause && h.kind !== \"up\" ? `${h.kind}: ${h.cause}` : h.kind\n  return h.uptime24h === null ? kind : `${kind} (${pct(h.uptime24h)}% 24h)`\n}\n\nexport function table(rows: string[][]): string[] {\n  const widths = rows[0]!.map((_, i) => Math.max(...rows.map((r) => (r[i] ?? \"\").length)))\n  return rows.map((r) => \"  \" + r.map((c, i) => (i === r.length - 1 ? c : c.padEnd(widths[i]!))).join(\"  \"))\n}\n","import type { Command } from \"commander\"\nimport { ensureCapability } from \"../../core/api/capabilities.js\"\nimport type { CliModuleStatus } from \"../../core/api/types.js\"\nimport { appFor, contextJson, contextLine, moduleContextFor } from \"../context.js\"\nimport { ago, table, uptime } from \"../format.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerStatus(program: Command, ctx: CommandContext): void {\n  program.command(\"status\").description(\"Deployment and health per environment for this module\")\n    .option(\"--module <slug|id>\", \"the module (default: from this repository's git remote)\")\n    .option(\"--app <slug|id>\", \"the app, when the module is part of several\")\n    .action(async (flags: { module?: string; app?: string }) => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const mc = await moduleContextFor(ctx, flags, \"status\")\n      await ensureCapability(deps, mc.portal.apiOrigin, \"module.status\")\n      const app = await appFor(ctx, mc, flags.app)\n      if (!g.json) io.err(contextLine(mc, app))\n      const st = await mc.session.api.get<CliModuleStatus>(\n        `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/status?app_id=${encodeURIComponent(app.id)}`)\n      if (g.json) { renderJson(io, { context: contextJson(mc, app), environments: st.environments }); return }\n      if (st.environments.length === 0) { io.out(\"No environments yet.\"); return }\n      const now = deps.now()\n      const rows = [[\"ENV\", \"DEPLOY\", \"COMMIT\", \"DEPLOYED\", \"APP HEALTH\"],\n        ...st.environments.map((e) => [e.name, e.paused ? \"paused\" : e.status, e.commit?.sha ?? \"–\",\n          ago(e.commit?.deployedAt ?? null, now), uptime(e.health)])]\n      for (const line of table(rows)) io.out(line)\n    })\n}\n","import type { Command } from \"commander\"\nimport type { CliMe } from \"../../core/api/types.js\"\nimport { QoreError, type Candidate } from \"../../core/errors.js\"\nimport { resolvePortal } from \"../../core/profiles.js\"\nimport { openSession } from \"../../core/session.js\"\nimport { requestLog, type CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerTenant(program: Command, ctx: CommandContext): void {\n  const tenant = program.command(\"tenant\").description(\"Manage the active tenant\")\n\n  tenant.command(\"list\").description(\"List tenants you have access to\")\n    .action(async () => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      const { profile, api } = await openSession(deps, portal, \"tenant list\", requestLog(ctx))\n      const me = await api.get<CliMe>(\"/api/cli/v1/me\")\n      const activeId = profile.activeTenant?.id\n      if (g.json) {\n        renderJson(io, { tenants: me.tenants.map((t) => ({ ...t, active: t.id === activeId })) })\n        return\n      }\n      for (const t of me.tenants) {\n        const mark = t.id === activeId ? \"*\" : \" \"\n        io.out(`${mark} ${t.name}  ${t.role}`)\n      }\n    })\n\n  tenant.command(\"use\").description(\"Set the active tenant\").argument(\"[slug]\", \"tenant slug\")\n    .action(async (slug: string | undefined) => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      const { api } = await openSession(deps, portal, \"tenant use\", requestLog(ctx))\n      const me = await api.get<CliMe>(\"/api/cli/v1/me\")\n      const candidates: Candidate[] = me.tenants.map((t) => ({ kind: \"tenant\", id: t.id, slug: t.slug, name: t.name }))\n      let chosen: { id: string; slug: string }\n      if (slug) {\n        const found = me.tenants.find((t) => t.slug === slug)\n        if (!found) throw new QoreError(\"QORE_RESOURCE_NOT_FOUND\", `No tenant \"${slug}\" for this account`, { candidates })\n        chosen = { id: found.id, slug: found.slug }\n      } else if (io.interactive) {\n        chosen = await io.select(\"Select a tenant\", me.tenants.map((t) => ({ name: `${t.name}  ${t.role}`, value: { id: t.id, slug: t.slug } })))\n      } else {\n        throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"Which tenant? Pass a slug or run interactively.\", { candidates })\n      }\n      await deps.config.update((c) => { c.profiles[portal.apiOrigin]!.activeTenant = chosen })\n      if (g.json) renderJson(io, { activeTenant: chosen })\n      else io.out(`✓ Using tenant ${chosen.slug}`)\n    })\n}\n","import type { Command } from \"commander\"\nimport { fetchMeta } from \"../../core/api/meta.js\"\nimport { CancelledError } from \"../../core/errors.js\"\nimport { resolvePortal } from \"../../core/profiles.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerVersion(program: Command, ctx: CommandContext): void {\n  program.command(\"version\").description(\"Show the CLI and portal version\")\n    .action(async () => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      let portalInfo: { apiVersions: string[]; minCliVersion: string; latestCliVersion: string; capabilities: string[] } | null = null\n      try {\n        const meta = await fetchMeta(deps.fetch, portal.apiOrigin)\n        portalInfo = { apiVersions: meta.apiVersions, minCliVersion: meta.minCliVersion, latestCliVersion: meta.latestCliVersion, capabilities: meta.capabilities }\n      } catch (e) {\n        // A cancel is not \"unreachable\": Ctrl+C still exits 130.\n        if (e instanceof CancelledError) throw e\n        /* portal unreachable; report null below */\n      }\n      if (g.json) {\n        renderJson(io, { cli: deps.version, portal: portalInfo })\n        return\n      }\n      io.out(`qore ${deps.version}`)\n      const label = portal.builtin ?? portal.apiOrigin\n      if (portalInfo) {\n        io.out(`portal ${label}: api ${portalInfo.apiVersions.join(\",\")}, min ${portalInfo.minCliVersion}, latest ${portalInfo.latestCliVersion}`)\n      } else {\n        io.out(`portal ${label}: unreachable`)\n      }\n    })\n}\n","import type { Command } from \"commander\"\nimport type { CliMe } from \"../../core/api/types.js\"\nimport { resolvePortal } from \"../../core/profiles.js\"\nimport { openSession } from \"../../core/session.js\"\nimport { requestLog, type CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerWhoami(program: Command, ctx: CommandContext): void {\n  program.command(\"whoami\").description(\"Show who you're logged in as\")\n    .action(async () => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      const { profile, api } = await openSession(deps, portal, \"whoami\", requestLog(ctx))\n      const me = await api.get<CliMe>(\"/api/cli/v1/me\")\n      const activeTenant = profile.activeTenant\n      if (activeTenant && !me.tenants.some((t) => t.id === activeTenant.id)) {\n        io.err(`! You no longer have developer access to ${activeTenant.slug}`)\n      }\n      const label = portal.builtin ?? portal.apiOrigin\n      if (g.json) {\n        renderJson(io, { portal: label, activeTenant: activeTenant ?? null, me })\n        return\n      }\n      io.out(`${me.email} (${label})`)\n      for (const t of me.tenants) {\n        const mark = activeTenant?.id === t.id ? \"*\" : \" \"\n        io.out(`${mark} ${t.name}  ${t.role}`)\n        for (const a of t.apps) {\n          io.out(`  ${a.slug}  ${a.access}`)\n          for (const m of a.modules) {\n            io.out(`    ${m.slug}  ${m.type}  ${m.access}`)\n          }\n        }\n      }\n    })\n}\n","import type { Register } from \"../program.js\"\nimport { registerEnv } from \"./env.js\"\nimport { registerLogin } from \"./login.js\"\nimport { registerLogout } from \"./logout.js\"\nimport { registerRun } from \"./run.js\"\nimport { registerStatus } from \"./status.js\"\nimport { registerTenant } from \"./tenant.js\"\nimport { registerVersion } from \"./version.js\"\nimport { registerWhoami } from \"./whoami.js\"\n\nexport const COMMANDS: Register[] = [\n  registerLogin, registerLogout, registerWhoami, registerTenant, registerStatus, registerEnv, registerRun, registerVersion,\n]\n","import { compareVersions } from \"../core/api/meta.js\"\nimport type { Deps } from \"../core/deps.js\"\nimport type { Io } from \"./io.js\"\n\nconst REGISTRY_URL = \"https://registry.npmjs.org/@quatronic%2Fqore/latest\"\nconst DAY_MS = 24 * 60 * 60 * 1000\nconst DEFAULT_TIMEOUT_MS = 1500\n\nexport async function maybeNotifyUpdate(deps: Deps, io: Io, o: { json: boolean }, timeoutMs = DEFAULT_TIMEOUT_MS): Promise<void> {\n  if (o.json || deps.env.CI || deps.env.QORE_NO_UPDATE_CHECK === \"1\" || !io.interactive) return\n  const cfg = await deps.config.read()\n  const last = cfg.updateCheck?.lastCheckedAt\n  if (last && deps.now().getTime() - new Date(last).getTime() < DAY_MS) return\n  const controller = new AbortController()\n  const timer = setTimeout(() => controller.abort(), timeoutMs)\n  let latest: string | undefined\n  try {\n    const res = await deps.fetch(REGISTRY_URL, { signal: controller.signal })\n    if (res.ok) latest = ((await res.json()) as { version?: string }).version\n  } catch { /* silent: an update check never affects the run */ }\n  finally { clearTimeout(timer) }\n  try {\n    // Recorded after a failed, non-OK or timed-out check too, so an offline user does not\n    // pay the timeout on every command; the last known latest version is kept then.\n    await deps.config.update((c) => {\n      c.updateCheck = { lastCheckedAt: deps.now().toISOString(), latest: latest ?? c.updateCheck?.latest ?? deps.version }\n    })\n  } catch { return }\n  if (latest && compareVersions(latest, deps.version) > 0) {\n    io.err(`A new qore is available: ${deps.version} → ${latest}  npm i -g @quatronic/qore`)\n  }\n}\n","import { readFile } from \"node:fs/promises\"\nimport { join } from \"node:path\"\nimport { QoreError } from \"./errors.js\"\nimport { writeJsonAtomic } from \"./jsonFile.js\"\n\nexport type ProfileRecord = {\n  apiOrigin: string\n  issuer: string\n  sub?: string\n  email?: string\n  activeTenant?: { id: string; slug: string }\n  meta?: { fetchedAt: string; doc: unknown }\n}\n\nexport type QoreConfig = {\n  schemaVersion: 1\n  defaultProfile?: string\n  profiles: Record<string, ProfileRecord>\n  updateCheck?: { lastCheckedAt: string; latest: string }\n  trustedRepos?: Record<string, string[]>\n}\n\nconst empty = (): QoreConfig => ({ schemaVersion: 1, profiles: {} })\n\nexport class ConfigStore {\n  constructor(readonly dir: string) {}\n\n  private get file() { return join(this.dir, \"config.json\") }\n\n  async read(): Promise<QoreConfig> {\n    let raw: string\n    try {\n      raw = await readFile(this.file, \"utf8\")\n    } catch (e) {\n      if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return empty()\n      throw e\n    }\n    try {\n      const parsed = JSON.parse(raw) as QoreConfig\n      if (parsed.schemaVersion !== 1 || typeof parsed.profiles !== \"object\") throw new Error(\"shape\")\n      return parsed\n    } catch (cause) {\n      throw new QoreError(\"QORE_CONTEXT_INVALID\", `Qore config is malformed: ${this.file}`, {\n        hint: \"Fix or delete the file, then run `qore login` again\", cause,\n      })\n    }\n  }\n\n  async update(fn: (c: QoreConfig) => QoreConfig | void): Promise<QoreConfig> {\n    const current = await this.read()\n    const next = fn(current) ?? current\n    await writeJsonAtomic(this.dir, \"config.json\", next)\n    return next\n  }\n}\n","import { execFile, type ExecFileOptions } from \"node:child_process\"\nimport { homedir } from \"node:os\"\nimport { QoreError } from \"../core/errors.js\"\n\nexport type Remote = { name: string; url: string }\nexport interface Git { remotes(repoRoot: string): Promise<Remote[]> }\n\nexport function parseRemotes(stdout: string): Remote[] {\n  const seen = new Set<string>()\n  const out: Remote[] = []\n  for (const line of stdout.split(/\\r?\\n/)) {\n    const m = /^(\\S+)\\t(.+) \\(fetch\\)$/.exec(line)\n    if (!m || seen.has(m[1]!)) continue\n    seen.add(m[1]!)\n    out.push({ name: m[1]!, url: m[2]! })\n  }\n  return out\n}\n\n/** Options for every git child. `cwd` is pinned to the home directory because on\n * Windows a bare \"git\" is looked up in the child's cwd before PATH: running from a\n * cloned repo would execute a git.exe planted at its top level. `-C <root>` only\n * steers git after it has started, so the repo stays the directory git works in. */\nexport function gitExecOptions(): ExecFileOptions {\n  return { cwd: homedir(), env: { ...process.env, LC_ALL: \"C\" }, windowsHide: true }\n}\n\n/** `git -C <root> remote -v` — argv only, never a shell; LC_ALL=C for stable output.\n * Reading through git (not .git/config) means insteadOf rewrites and worktrees\n * behave exactly as git sees them (spec §2). */\nexport const systemGit: Git = {\n  remotes(repoRoot) {\n    return new Promise((resolve, reject) => {\n      execFile(\"git\", [\"-C\", repoRoot, \"remote\", \"-v\"], gitExecOptions(),\n        (err, stdout, stderr) => {\n          if (err) {\n            if ((err as NodeJS.ErrnoException).code === \"ENOENT\") {\n              reject(new QoreError(\"QORE_GIT_UNAVAILABLE\", \"git is not installed or not on PATH\", {\n                hint: \"Install git (https://git-scm.com/downloads) and open a new terminal.\" }))\n              return\n            }\n            const last = String(stderr).trim().split(/\\r?\\n/).pop() ?? \"\"\n            reject(new QoreError(\"QORE_INTERNAL\", `git remote -v failed in ${repoRoot}`, {\n              hint: last || undefined, details: { command: \"git remote -v\", cwd: repoRoot }, cause: err }))\n            return\n          }\n          resolve(parseRemotes(String(stdout)))\n        })\n    })\n  },\n}\n","import { Entry } from \"@napi-rs/keyring\"\nimport { QoreError } from \"../core/errors.js\"\n\nexport interface Keychain {\n  get(account: string): Promise<string | null>\n  set(account: string, value: string): Promise<void>\n  delete(account: string): Promise<void>\n}\n\nconst SERVICE = \"qore\"\nconst HINTS: Partial<Record<NodeJS.Platform, string>> = {\n  linux: \"Install and unlock a Secret Service provider (gnome-keyring or KWallet); headless machines and containers have none.\",\n  darwin: \"Unlock your login keychain in Keychain Access.\",\n  win32: \"Windows Credential Manager must be available for your user.\",\n}\n\nexport function classifyKeychainError(e: unknown, platform: NodeJS.Platform): QoreError {\n  const msg = e instanceof Error ? e.message : String(e)\n  // keyring-rs Error::TooLong (\"… is longer than the platform limit of N chars\"): Windows\n  // Credential Manager caps a credential blob (R18). Still UNAVAILABLE, but say what it is.\n  if (/TooLong|longer than the platform limit/i.test(msg)) {\n    return new QoreError(\"QORE_KEYCHAIN_UNAVAILABLE\", \"The session token is too large for the OS keychain\", {\n      hint: platform === \"win32\"\n        ? \"The token exceeds the Windows Credential Manager size limit. Report this to the Qore team.\"\n        : \"The token exceeds the keychain's size limit. Report this to the Qore team.\",\n      cause: e,\n    })\n  }\n  if (/cancel|denied|errSecAuthFailed|user interaction/i.test(msg)) {\n    return new QoreError(\"QORE_KEYCHAIN_DENIED\", \"Access to the OS keychain was denied\", {\n      hint: \"Allow qore to use the keychain when your OS asks, then retry.\", cause: e,\n    })\n  }\n  return new QoreError(\"QORE_KEYCHAIN_UNAVAILABLE\", \"No usable OS keychain\", {\n    hint: HINTS[platform] ?? \"qore stores tokens only in the OS keychain.\", cause: e,\n  })\n}\n\nexport class OsKeychain implements Keychain {\n  constructor(private readonly platform: NodeJS.Platform = process.platform) {}\n\n  private wrap<T>(fn: () => T): Promise<T> {\n    try { return Promise.resolve(fn()) } catch (e) { return Promise.reject(classifyKeychainError(e, this.platform)) }\n  }\n\n  get(account: string) { return this.wrap(() => new Entry(SERVICE, account).getPassword() ?? null) }\n  set(account: string, value: string) { return this.wrap(() => { new Entry(SERVICE, account).setPassword(value) }) }\n  delete(account: string) {\n    // deletePassword() returns false (rather than throwing) when there is no entry.\n    return this.wrap(() => { new Entry(SERVICE, account).deletePassword() })\n  }\n}\n","import { mkdir, writeFile } from \"node:fs/promises\"\nimport { join } from \"node:path\"\nimport lockfile from \"proper-lockfile\"\nimport { QoreError } from \"../core/errors.js\"\n\nexport type WithLock = <T>(name: string, fn: () => Promise<T>) => Promise<T>\n\nexport function fileLock(dir: string): WithLock {\n  return async (name, fn) => {\n    const locks = join(dir, \"locks\")\n    await mkdir(locks, { recursive: true, mode: 0o700 })\n    const target = join(locks, `${name}.lock`)\n    await writeFile(target, \"\", { flag: \"a\" })\n    let release: () => Promise<void>\n    // proper-lockfile's default onCompromised throws from a timer (an uncaught crash). A\n    // compromised lock (mtime update failed, or another process took it as stale) is only\n    // recorded: the keychain writes under it are idempotent, and refresh re-reads the RT.\n    let compromised: Error | undefined\n    try {\n      release = await lockfile.lock(target, {\n        stale: 30_000,\n        retries: { retries: 30, minTimeout: 100, maxTimeout: 1000, randomize: true },\n        onCompromised: (err) => { compromised = err },\n      })\n    } catch (cause) {\n      throw new QoreError(\"QORE_AUTH_BUSY\", \"Another qore process is refreshing the session\", { hint: \"Retry in a moment.\", cause })\n    }\n    try { return await fn() } finally {\n      // After a compromise release() rejects (ERELEASED); that must not replace fn's outcome.\n      await release().catch((e: unknown) => { if (!compromised) throw e })\n    }\n  }\n}\n","import { posix, win32 } from \"node:path\"\n\nexport function configDir(env: NodeJS.ProcessEnv, platform: NodeJS.Platform, home: string): string {\n  if (platform === \"win32\") return win32.join(env.APPDATA ?? win32.join(home, \"AppData\", \"Roaming\"), \"qore\")\n  // posix.join, not the host's join: the result is for the target platform, whatever the host\n  // (tests run on Windows CI too).\n  if (platform === \"darwin\") return posix.join(home, \"Library\", \"Application Support\", \"qore\")\n  // XDG Base Directory spec: a relative $XDG_CONFIG_HOME is invalid and must be ignored.\n  const xdg = env.XDG_CONFIG_HOME && posix.isAbsolute(env.XDG_CONFIG_HOME) ? env.XDG_CONFIG_HOME : undefined\n  return posix.join(xdg ?? posix.join(home, \".config\"), \"qore\")\n}\n","import spawn from \"cross-spawn\"\nimport type { ChildProcess } from \"node:child_process\"\nimport { QoreError } from \"../core/errors.js\"\n\nexport type ChildExit = { code: number | null; signal: NodeJS.Signals | null }\nexport interface Spawner { run(cmd: string, args: string[], env: NodeJS.ProcessEnv): Promise<ChildExit> }\n\n/** Which signals `crossSpawner` ignores (left to the terminal's own process-group\n * delivery) vs. forwards to the child, per platform. Exported so tests can derive\n * the expected lists for the platform they run on instead of hard-coding POSIX's. */\nexport function signalsFor(platform: NodeJS.Platform): { ignore: NodeJS.Signals[]; forward: NodeJS.Signals[] } {\n  return platform === \"win32\"\n    ? { ignore: [\"SIGINT\", \"SIGBREAK\"], forward: [] }\n    : { ignore: [\"SIGINT\", \"SIGQUIT\"], forward: [\"SIGTERM\", \"SIGHUP\"] }\n}\n\nconst { ignore: IGNORE, forward: FORWARD } = signalsFor(process.platform)\n\n/** The slice of `process` that `crossSpawner` touches: signal handler registration.\n * Injectable so tests can drive signal ignore/forward behaviour with a fake child and\n * a fake signal source, without sending real signals to the test runner's own process. */\nexport interface ProcessSignals {\n  on(signal: NodeJS.Signals, listener: () => void): void\n  off(signal: NodeJS.Signals, listener: () => void): void\n}\n\ntype SpawnFn = (cmd: string, args: string[], opts: { stdio: \"inherit\"; shell: false; env: NodeJS.ProcessEnv; windowsHide: true }) => ChildProcess\n\n/** Spec §11.2. The terminal delivers Ctrl+C / Ctrl+\\ to the whole foreground process\n * group, so forwarding them would double-signal the child: the parent only ignores\n * them and waits. SIGTERM/SIGHUP come to the parent alone and are passed on. */\nexport function makeSpawner(spawnFn: SpawnFn, proc: ProcessSignals): Spawner {\n  return {\n    run(cmd, args, env) {\n      return new Promise((resolve, reject) => {\n        let child: ChildProcess\n        try {\n          child = spawnFn(cmd, args, { stdio: \"inherit\", shell: false, env, windowsHide: true })\n        } catch (e) {\n          // Node validates `options.env` synchronously (e.g. ERR_INVALID_ARG_VALUE for a\n          // NUL byte in a value) and embeds the offending value in its message — never\n          // pass that message through, only the error code, same as the \"error\" path below.\n          reject(new QoreError(\"QORE_INTERNAL\", `Could not start ${cmd}: ${(e as NodeJS.ErrnoException).code ?? \"error\"}`))\n          return\n        }\n        const ignore = () => {}\n        const forwarders = FORWARD.map((sig) => [sig, () => { child.kill(sig) }] as const)\n        for (const sig of IGNORE) proc.on(sig, ignore)\n        for (const [sig, fn] of forwarders) proc.on(sig, fn)\n        const cleanup = () => {\n          for (const sig of IGNORE) proc.off(sig, ignore)\n          for (const [sig, fn] of forwarders) proc.off(sig, fn)\n        }\n        child.once(\"error\", (e: NodeJS.ErrnoException) => {\n          cleanup()\n          reject(e.code === \"ENOENT\"\n            ? new QoreError(\"QORE_INTERNAL\", `Command not found: ${cmd}`, { hint: \"Check the command after --; it runs without a shell.\" })\n            : new QoreError(\"QORE_INTERNAL\", `Could not start ${cmd}: ${e.code ?? \"error\"}`))\n        })\n        child.once(\"exit\", (code, signal) => { cleanup(); resolve({ code, signal }) })\n      })\n    },\n  }\n}\n\nexport const crossSpawner: Spawner = makeSpawner(spawn, process)\n","declare const __QORE_VERSION__: string | undefined\n// tsup replaces __QORE_VERSION__ at build time; tests run from source and see \"0.0.0-dev\".\nexport const VERSION: string = typeof __QORE_VERSION__ === \"string\" ? __QORE_VERSION__ : \"0.0.0-dev\"\n"],"mappings":";;;AAAA,SAAS,WAAAA,gBAAe;AACxB,SAAS,mBAAmB,2BAA2B;;;ACDvD,SAAS,SAAS,cAAc;AAChC,SAAS,uBAAuB;;;ACDhC,OAAO,UAAU;AAGjB,eAAsB,YAAY,KAA+B;AAC/D,MAAI,QAAQ,aAAa,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,IAAI,gBAAiB,QAAO;AACjG,MAAI;AAAE,UAAM,KAAK,GAAG;AAAG,WAAO;AAAA,EAAK,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5D;;;ACNO,IAAM,OAAO;AAAA,EAClB,eAAe;AAAA,EACf,2BAA2B;AAAA,EAC3B,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,sBAAsB;AAAA,EACtB,0BAA0B;AAAA,EAC1B,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,oBAAoB;AAAA,EACpB,0BAA0B;AAAA,EAC1B,uBAAuB;AAAA,EACvB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,0BAA0B;AAAA,EAC1B,4BAA4B;AAAA,EAC5B,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,mBAAmB;AACrB;AA0BO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqB,SAAiB,OAAa,CAAC,GAAG;AACjE,UAAM,SAAS,KAAK,UAAU,SAAY,SAAY,EAAE,OAAO,KAAK,MAAM,CAAC;AAC3E,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,aAAa,KAAK;AACvB,SAAK,aAAa,KAAK;AACvB,SAAK,UAAU,KAAK;AAAA,EACtB;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,cAAc;AACZ,UAAM,WAAW;AACjB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,YAAY,KAAsB;AAChD,MAAI,eAAe,kBAAmB,eAAe,SAAS,IAAI,SAAS,iBAAmB,QAAO;AACrG,MAAI,eAAe,UAAW,QAAO,KAAK,IAAI,IAAI;AAClD,SAAO;AACT;AAEO,SAAS,YAAY,KAAuC;AACjE,MAAI,EAAE,eAAe,YAAY;AAC/B,WAAO,EAAE,MAAM,iBAAiB,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE;AAAA,EAC5F;AACA,QAAM,MAA+B,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ;AAC5E,aAAW,KAAK,CAAC,QAAQ,UAAU,aAAa,cAAc,cAAc,SAAS,GAAY;AAC/F,QAAI,IAAI,CAAC,MAAM,OAAW,KAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;;;AFlFO,SAAS,cAAc,GAAgH;AAC5I,SAAO,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,EAAE,IAAI;AACtE;AAEO,SAAS,UAAU,aAA0B;AAClD,SAAO;AAAA,IACL,KAAK,CAAC,MAAM;AAAE,cAAQ,OAAO,MAAM,IAAI,IAAI;AAAA,IAAE;AAAA,IAC7C,KAAK,CAAC,MAAM;AAAE,cAAQ,OAAO,MAAM,IAAI,IAAI;AAAA,IAAE;AAAA,IAC7C;AAAA,IACA,MAAM,OAAO,SAAS,SAAS;AAC7B,UAAI;AAAE,eAAO,MAAM,OAAO,EAAE,SAAS,QAAQ,CAAC;AAAA,MAAE,SAAS,GAAG;AAC1D,YAAK,EAAY,SAAS,kBAAmB,OAAM,IAAI,eAAe;AACtE,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,UAAI;AAAE,eAAO,MAAM,QAAQ,EAAE,SAAS,SAAS,MAAM,CAAC;AAAA,MAAE,SAAS,GAAG;AAClE,YAAK,EAAY,SAAS,kBAAmB,OAAM,IAAI,eAAe;AACtE,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,cAAc,mBAAmB,QAAQ,OAAO,QAAQ,MAAM;AAAA,IAC9D,SAAS;AAAA,EACX;AACF;AAOO,SAAS,mBACd,OAA8B,QAC2B;AACzD,SAAO,CAAC,SAAS,WAAW,IAAI,QAAQ,CAACC,UAAS,WAAW;AAC3D,UAAM,KAAK,gBAAgB,EAAE,OAAO,QAAQ,UAAU,KAAK,CAAC;AAC5D,UAAM,UAAU,MAAM;AAAE,SAAG,MAAM;AAAG,aAAO,IAAI,eAAe,CAAC;AAAA,IAAE;AACjE,UAAM,OAAO,MAAM;AAAE,aAAO,oBAAoB,SAAS,OAAO;AAAG,SAAG,MAAM;AAAG,MAAAA,SAAQ;AAAA,IAAE;AACzF,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,OAAG,GAAG,UAAU,MAAM;AAAE,aAAO,oBAAoB,SAAS,OAAO;AAAG,SAAG,MAAM;AAAG,aAAO,IAAI,eAAe,CAAC;AAAA,IAAE,CAAC;AAChH,OAAG,SAAS,SAAS,IAAI;AAAA,EAC3B,CAAC;AACH;;;AGzDA,SAAS,SAAS,sBAAsB;;;ACMjC,SAAS,eAAeC,QAAc,QAA4B;AACvE,SAAO,CAAC,OAAO,SAASA,OAAM,OAAO,EAAE,GAAG,MAAM,QAAQ,MAAM,SAAS,YAAY,IAAI,CAAC,KAAK,QAAQ,MAAM,CAAC,IAAI,OAAO,CAAC;AAC1H;AAEA,IAAM,MAAM,oBAAI,IAAI;AAAA,EAAC;AAAA,EAA6B;AAAA,EAChD;AAAA,EAA+B;AAAA,EAAmC;AAAkB,CAAC;AAEvF,SAAS,UAAU,GAAgC;AACjD,QAAM,IAAK,GAAsC;AACjD,QAAM,OAAO,GAAG,QAAS,GAA0B;AAEnD,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEO,SAAS,aAAa,GAAqB;AAChD,SAAQ,GAAiC,SAAS;AACpD;AAGO,SAAS,WAAW,GAAY,MAAqB;AAC1D,SAAO,aAAa,CAAC,IAAI,IAAI,eAAe,IAAI,aAAa,GAAG,IAAI;AACtE;AAEO,SAAS,aAAa,GAAY,MAAyB;AAChE,QAAM,OAAO,UAAU,CAAC,KAAK;AAC7B,MAAI,SAAS;AACb,MAAI,OAAO;AACX,MAAI,SAAS,eAAe,SAAS,aAAa;AAChD,aAAS;AAAO,WAAO,GAAG,IAAI;AAAA,EAChC,WAAW,IAAI,IAAI,IAAI,GAAG;AACxB,aAAS;AACT,WAAO;AAAA,EACT,WAAW,KAAK,SAAS,SAAS,KAAK,SAAS,aAAa;AAC3D,aAAS;AAAA,EACX,WAAW,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,IAAI,aAAa;AAC/D,WAAO;AAAA,EACT;AACA,SAAO,IAAI,UAAU,wBAAwB,mBAAmB,IAAI,IAAI,EAAE,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,QAAQ,OAAU,GAAG,OAAO,EAAE,CAAC;AACjJ;AAEA,IAAM,iBAAgD;AAAA,EACpD,qBAAqB;AAAA,EACrB,2BAA2B;AAAA,EAC3B,wBAAwB;AAAA,EACxB,gBAAgB;AAAA,EAChB,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,wBAAwB;AAC1B;AAEA,SAAS,SAAS,QAA+B;AAC/C,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,WAAW,IAAK,QAAO;AAC3B,MAAI,WAAW,OAAO,WAAW,OAAO,WAAW,IAAK,QAAO;AAC/D,SAAO;AACT;AAEA,eAAsB,eAAe,KAAmC;AACtE,MAAI,OAA4D,CAAC;AACjE,MAAI;AAAE,WAAQ,MAAM,IAAI,KAAK;AAAA,EAAkB,QAAQ;AAAA,EAAiB;AACxE,QAAM,aAAa,KAAK;AACxB,QAAM,OAAQ,cAAc,eAAe,UAAU,KAAM,SAAS,IAAI,MAAM;AAC9E,QAAM,YAAY,IAAI,QAAQ,IAAI,cAAc,KAAK;AACrD,QAAM,UAAmC,CAAC;AAC1C,MAAI,KAAK,UAAU,OAAO,KAAK,WAAW,SAAU,QAAO,OAAO,SAAS,KAAK,MAAM;AACtF,QAAMC,UAAS,OAAO,KAAK,WAAW,YAAY,KAAK,SAAS,KAAK,SAAS;AAC9E,MAAIA,QAAQ,SAAQ,SAASA;AAC7B,QAAM,QAAQ,IAAI,QAAQ,IAAI,aAAa;AAC3C,MAAI,SAAS,QAAQ,KAAK,KAAK,EAAG,SAAQ,aAAa,OAAO,KAAK;AACnE,QAAM,OACJ,SAAS,0BAA0B,kCACjC,SAAS,sBAAsB,QAAQ,QAAQ,cAAc,UAAU,kBACvE,SAAS,yBAAyB,wDAClC,SAAS,uBAAuB,uBAChC;AACJ,QAAM,OAAQ,KAAK,QAA2C;AAC9D,QAAM,aAAa,SAAS,wBAAwB,MAAM,QAAQ,IAAI,IACjE,KAAwD,IAAI,CAAC,OAAO,EAAE,MAAM,OAAgB,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,EAAE,IACpI;AACJ,MAAI,WAAY,QAAO,QAAQ;AAG/B,QAAM,eAAe,CAAC,KAAK,SAAS,KAAK,UAAU,gBAAgB,KAAK,UAAU;AAClF,QAAM,UAAW,gBAAgBA,WAAW,KAAK,SAAS,mBAAmB,IAAI,MAAM;AACvF,SAAO,IAAI,UAAU,MAAM,SAAS;AAAA,IAClC,QAAQ,IAAI;AAAA,IAAQ;AAAA,IAAW;AAAA,IAAY;AAAA,IAAM;AAAA,IACjD,SAAS,OAAO,KAAK,OAAO,EAAE,SAAS,UAAU;AAAA,EACnD,CAAC;AACH;;;AD3FA,OAAOC,SAAQ;;;AELf,OAAO,MAAM,oBAAoB;AAI1B,SAAS,WAAWC,KAAQ,MAAqB;AACtD,EAAAA,IAAG,IAAI,KAAK,UAAU,EAAE,IAAI,MAAM,KAAK,CAAC,CAAC;AAC3C;AAEO,SAAS,YAAYA,KAAQ,KAAcC,OAAe,eAAe,GAAG,kBAAwB;AACzG,MAAIA,OAAM;AAAE,IAAAD,IAAG,IAAI,KAAK,UAAU,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,CAAC,CAAC;AAAG;AAAA,EAAO;AACnF,MAAI,eAAe,SAAS,IAAI,SAAS,kBAAkB;AAAE,IAAAA,IAAG,IAAI,WAAW;AAAG;AAAA,EAAO;AACzF,QAAM,IAAI,aAAa,YAAY;AACnC,QAAM,IAAI,eAAe,YAAY,MAAM,IAAI,UAAU,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC1H,EAAAA,IAAG,IAAI,EAAE,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;AACnC,MAAI,EAAE,KAAM,CAAAA,IAAG,IAAI,EAAE,IAAI;AACzB,EAAAA,IAAG,IAAI,EAAE,IAAI,SAAS,EAAE,IAAI,GAAG,EAAE,YAAY,aAAa,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC;AAClF;;;AFHO,SAAS,oBAAoBE,OAA0B;AAC5D,QAAM,IAAIA,MAAK,QAAQ,IAAI;AAC3B,SAAO,MAAM,KAAKA,QAAOA,MAAK,MAAM,GAAG,CAAC;AAC1C;AAKA,SAAS,aAAaA,OAAyB;AAC7C,SAAO,oBAAoBA,KAAI,EAAE,KAAK,CAAC,MAAM,MAAM,YAAY,EAAE,WAAW,SAAS,CAAC;AACxF;AASO,SAAS,WAAW,KAA2D;AACpF,SAAO,IAAI,KAAK,EAAE,UAAU,CAAC,SAAS,IAAI,GAAG,IAAI,IAAI,IAAI;AAC3D;AAEO,SAAS,aAAaC,OAAYC,KAAQ,QAAqB,UAAsB,aAA8C;AACxI,QAAM,UAAU,IAAI,QAAQ,MAAM,EAC/B,YAAY,oBAAoB,EAChC,OAAO,uBAAuB,uFAAuF,EACrH,OAAO,UAAU,2CAA2C,EAC5D,OAAO,cAAc,cAAc,EACnC,OAAO,aAAa,mCAAmC,EACvD,OAAO,cAAc,iBAAiB,EACtC,aAAa,EACb,gBAAgB,EAAE,UAAU,CAAC,MAAMA,IAAG,IAAI,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,MAAMA,IAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;AACjG,QAAM,MAAsB,EAAE,MAAAD,OAAM,IAAAC,KAAI,QAAQ,MAAM,MAAM,QAAQ,KAAiB,GAAG,YAAY;AACpG,aAAW,KAAK,SAAU,GAAE,SAAS,GAAG;AACxC,SAAO;AACT;AAEA,eAAsB,IAAIF,OAAgBC,OAAYC,KAAQ,QAAqB,UAAuC;AACxH,QAAMC,QAAO,aAAaH,KAAI;AAI9B,QAAM,UAAcG,QAAO,EAAE,GAAGD,KAAI,KAAK,MAAM;AAAA,EAAC,EAAE,IAAIA;AACtD,QAAM,QAA+B,CAAC;AACtC,QAAM,UAAU,aAAaD,OAAM,SAAS,QAAQ,UAAU,CAAC,SAAS;AAAE,UAAM,WAAW;AAAA,EAAK,CAAC;AACjG,MAAI;AACF,UAAM,QAAQ,WAAWD,OAAM,EAAE,MAAM,OAAO,CAAC;AAC/C,WAAO,MAAM,YAAY;AAAA,EAC3B,SAAS,QAAQ;AAEf,UAAM,IAAI,OAAO,WAAW,aAAa,MAAM,IAAI,IAAI,eAAe,IAAI;AAC1E,QAAI,aAAa,gBAAgB;AAC/B,UAAI,EAAE,aAAa,EAAG,QAAO;AAC7B,UAAIG,MAAM,CAAAD,IAAG,IAAI,KAAK,UAAU,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,wBAAwB,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC3G,aAAO;AAAA,IACT;AACA,UAAM,OAAO,QAAQ,KAAiB;AACtC,gBAAYA,KAAI,GAAG,QAAQ,KAAK,IAAI,GAAGE,IAAG,oBAAoB,KAAK,UAAU,KAAK;AAClF,WAAO,YAAY,CAAC;AAAA,EACtB;AACF;;;AG1EA,SAAS,eAAAC,oBAAmB;AAC5B,SAAS,SAAAC,QAAO,YAAAC,WAAU,YAAAC,WAAU,UAAAC,SAAQ,QAAQ,aAAAC,kBAAiB;AACrE,SAAS,YAAAC,WAAU,WAAAC,UAAS,QAAAC,OAAM,YAAAC,iBAAgB;;;ACFlD,SAAS,gBAAgB;AACzB,SAAS,YAAY;AAOrB,IAAM,YAAY,CAAC,UAAU,OAAO,aAAa,UAAU,UAAU,YAAY,OAAO,SAAS,UAAU,UAAU;AACrH,IAAM,MAAM;AAEZ,IAAM,UAAU,CAAC,KAAa,YAC5B,IAAI,UAAU,wBAAwB,eAAe,GAAG,IAAI,EAAE,MAAM,oEAAoE,QAAQ,CAAC;AAE5I,SAAS,eAAe,MAA2D;AACxF,SAAO,SAAS,aACZ,EAAE,SAAS,cAAc,cAAc,CAAC,uBAAuB,EAAE,IACjE,EAAE,SAAS,QAAQ,cAAc,CAAC,EAAE;AAC1C;AAEA,eAAsB,eAAe,MAAmC;AACtE,MAAI;AACJ,MAAI;AAAE,UAAM,MAAM,SAAS,KAAK,MAAM,YAAY,GAAG,MAAM;AAAA,EAAE,SAAS,GAAG;AACvE,QAAK,EAA4B,SAAS,SAAU,QAAO,CAAC;AAC5D,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AAAE,UAAM,KAAK,MAAM,GAAG;AAAA,EAA6B,QAAQ;AAAE,UAAM,QAAQ,gBAAgB;AAAA,EAAE;AACjG,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,OAAM,QAAQ,mBAAmB;AAG5F,QAAM,IAAI,IAAI,kBAAkB,SAAY,IAAI,IAAI;AACpD,MAAI,CAAC,OAAO,UAAU,CAAC,KAAM,IAAe,EAAG,OAAM,QAAQ,0CAA0C;AACvG,MAAK,IAAe,GAAG;AACrB,UAAM,IAAI,UAAU,4BAA4B,4BAA4B,CAAC,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAAA,EACpJ;AACA,aAAW,KAAK,UAAW,KAAI,KAAK,IAAK,OAAM,QAAQ,IAAI,CAAC,2EAAsE,EAAE,OAAO,EAAE,CAAC;AAC9I,QAAM,MAAkB,CAAC;AACzB,MAAI,IAAI,YAAY,QAAW;AAC7B,QAAI,OAAO,IAAI,YAAY,YAAY,CAAC,IAAI,QAAS,OAAM,QAAQ,oCAAoC;AACvG,QAAI,UAAU,IAAI;AAAA,EACpB;AACA,MAAI,IAAI,iBAAiB,QAAW;AAClC,QAAI,CAAC,MAAM,QAAQ,IAAI,YAAY,KAAK,CAAC,IAAI,aAAa,MAAM,CAAC,MAAM,OAAO,MAAM,YAAY,IAAI,KAAK,CAAC,CAAC,GAAG;AAC5G,YAAM,QAAQ,8CAA8C;AAAA,IAC9D;AAGA,QAAI,IAAI,IAAI,IAAI,YAAY,EAAE,SAAS,IAAI,aAAa,OAAQ,OAAM,QAAQ,0CAA0C;AACxH,QAAI,eAAe,IAAI;AAAA,EACzB;AACA,SAAO;AACT;;;AC/CA,IAAM,YAAY,CAAC,IAAI;AACvB,IAAM,SAAS;AAER,SAAS,gBAAgB,GAAW,GAAmB;AAC5D,QAAM,KAAK,OAAO,KAAK,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC;AAC7C,MAAI,CAAC,MAAM,CAAC,GAAI,QAAO;AACvB,WAAS,IAAI,GAAG,KAAK,GAAG,KAAK;AAC3B,UAAM,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AACtC,QAAI,MAAM,EAAG,QAAO;AAAA,EACtB;AACA,MAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAG,QAAO;AAC5B,MAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAG,QAAO;AAC5B,SAAO;AACT;AAEA,eAAsB,UAAUC,QAAc,WAAqC;AACjF,MAAI;AACJ,MAAI;AAAE,UAAM,MAAMA,OAAM,GAAG,SAAS,iBAAiB,EAAE,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;AAAA,EAAE,SAC3F,GAAG;AAAE,UAAM,WAAW,GAAG,IAAI,IAAI,SAAS,EAAE,IAAI;AAAA,EAAE;AACzD,MAAI,IAAI,WAAW,KAAK;AAEtB,UAAM,IAAI,UAAU,4BAA4B,iDAAiD;AAAA,MAC/F,QAAQ;AAAA,MAAK,WAAW,IAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MAC3D,MAAM,yBAAyB,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAQ,MAAM,IAAI,KAAK;AACzB;AAEO,SAAS,UAAU,MAAe,QAAmB,YAA0C;AACpG,MAAI,OAAO,gBAAgB,KAAK,KAAK,WAAW,OAAO,cAAc;AACnE,UAAM,IAAI,UAAU,yBAAyB,GAAG,OAAO,SAAS,0CAA0C;AAAA,MACxG,SAAS,EAAE,UAAU,OAAO,cAAc,KAAK,KAAK,KAAK,OAAO;AAAA,MAChE,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,aAAa,UAAU,KAAK,CAAC,MAAM,KAAK,YAAY,SAAS,CAAC,CAAC;AACrE,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,UAAU,4BAA4B,qDAAqD;AAAA,MACnG,SAAS,EAAE,QAAQ,KAAK,aAAa,QAAQ,CAAC,GAAG,SAAS,EAAE;AAAA,MAAG,MAAM;AAAA,IACvE,CAAC;AAAA,EACH;AACA,MAAI,CAAC,WAAW,SAAS,MAAM,KAAK,gBAAgB,YAAY,KAAK,aAAa,IAAI,GAAG;AACvF,UAAM,IAAI,UAAU,yBAAyB,QAAQ,UAAU,sCAAsC,KAAK,aAAa,KAAK;AAAA,MAC1H,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,EAAE,WAAW;AACtB;;;ACjDA,IAAM,SAAS;AAEf,SAAS,OAAO,KAA8B;AAC5C,SAAO,CAAC,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAS,IAAgB,YAAY;AACxF;AAEA,eAAe,SAASC,OAAY,WAAmB,SAA+D;AACpH,QAAM,UAAU,MAAMA,MAAK,OAAO,KAAK,GAAG,SAAS,SAAS,GAAG;AAC/D,MAAI,CAAC,WAAW,UAAU,OAAO,OAAO,GAAG,KAAKA,MAAK,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,OAAO,SAAS,EAAE,QAAQ,IAAI,QAAQ;AACpH,WAAO,EAAE,MAAM,OAAO,KAAK,QAAQ,KAAK;AAAA,EAC1C;AACA,QAAM,OAAO,MAAM,UAAUA,MAAK,OAAO,SAAS;AAClD,QAAMA,MAAK,OAAO,OAAO,CAAC,MAAM;AAC9B,UAAM,IAAI,EAAE,SAAS,SAAS;AAC9B,QAAI,EAAG,GAAE,OAAO,EAAE,WAAWA,MAAK,IAAI,EAAE,YAAY,GAAG,KAAK,KAAK;AAAA,EACnE,CAAC;AACD,SAAO,EAAE,MAAM,QAAQ,MAAM;AAC/B;AAWA,eAAsB,iBAAiBC,OAAY,WAAmB,YAAsC;AAC1G,QAAM,QAAQ,MAAM,SAASA,OAAM,WAAW,KAAK;AACnD,MAAI,OAAO,MAAM;AACjB,MAAI,CAAC,KAAK,aAAa,SAAS,UAAU,KAAK,MAAM,OAAQ,SAAQ,MAAM,SAASA,OAAM,WAAW,IAAI,GAAG;AAC5G,oBAAkB,MAAM,YAAY,SAAS;AAC7C,SAAO;AACT;AAEO,SAAS,kBAAkB,MAAe,YAAoB,WAAyB;AAC5F,MAAI,KAAK,aAAa,SAAS,UAAU,EAAG;AAC5C,QAAM,IAAI,UAAU,8BAA8B,gCAAgC,UAAU,QAAQ;AAAA,IAClG,MAAM,iBAAiB,SAAS;AAAA,IAChC,SAAS,EAAE,YAAY,QAAQ,UAAU;AAAA,EAC3C,CAAC;AACH;;;AC/CA,SAAS,QAAAC,aAAY;;;ACKd,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,IAA+B,MAAc;AAA7C;AAA+B;AAAA,EAAe;AAAA,EAA9C;AAAA,EAA+B;AAAA,EAE5D,MAAc,KAAQ,QAAmC;AACvD,UAAM,MAAM,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,EAAE;AACtD,QAAI,QAAQ,KAAM,QAAO;AACzB,QAAI;AAAE,aAAO,KAAK,MAAM,GAAG;AAAA,IAAO,QAAQ;AAAE,aAAO;AAAA,IAAK;AAAA,EAC1D;AAAA,EAEA,aAAa;AAAE,WAAO,KAAK,KAAoB,SAAS;AAAA,EAAE;AAAA,EAC1D,YAAY;AAAE,WAAO,KAAK,KAAmB,QAAQ;AAAA,EAAE;AAAA,EACvD,WAAW,GAAkB;AAAE,WAAO,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,YAAY,KAAK,UAAU,CAAC,CAAC;AAAA,EAAE;AAAA,EAC7F,UAAU,GAAiB;AAAE,WAAO,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,WAAW,KAAK,UAAU,CAAC,CAAC;AAAA,EAAE;AAAA,EAC1F,MAAM,QAAQ;AACZ,UAAM,KAAK,GAAG,OAAO,GAAG,KAAK,IAAI,SAAS;AAC1C,UAAM,KAAK,GAAG,OAAO,GAAG,KAAK,IAAI,UAAU;AAAA,EAC7C;AACF;;;ACtBA,SAAS,kBAAkB;AAKpB,IAAM,kBAAkB;AAAA,EAC7B,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA,EACA,SAAS;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AACF;AAEA,SAAS,WAAW,QAAkC;AACpD,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AACvD,QAAI,EAAE,cAAc,OAAQ,QAAO,EAAE,GAAG,GAAG,SAAS,KAA2B;AAAA,EACjF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,KAAqB;AACrC,MAAI;AACJ,MAAI;AAAE,UAAM,IAAI,IAAI,GAAG;AAAA,EAAE,QAAQ;AAC/B,UAAM,IAAI,UAAU,wBAAwB,6BAA6B,GAAG,IAAI;AAAA,MAC9E,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,WAAW,IAAI,aAAa,eAAe,IAAI,aAAa;AAClE,MAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,WAAW;AACxE,UAAM,IAAI,UAAU,wBAAwB,uDAAuD;AAAA,EACrG;AACA,SAAO,IAAI,OAAO,YAAY;AAChC;AAEO,SAAS,cAAc,KAAyB,gBAA+C;AACpG,QAAM,SAAS,OAAO;AACtB,MAAI,WAAW,UAAa,WAAW,OAAQ,QAAO,EAAE,GAAG,gBAAgB,MAAM,SAAS,OAAO;AACjG,MAAI,WAAW,UAAW,QAAO,EAAE,GAAG,gBAAgB,SAAS,SAAS,UAAU;AAClF,QAAM,SAAS,SAAS,MAAM;AAC9B,SAAO,WAAW,MAAM,KAAK,EAAE,WAAW,QAAQ,cAAc,MAAM,SAAS,KAAK;AACtF;AAEO,SAAS,YAAY,WAAmB,QAAwB;AACrE,SAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,SAAS,IAAI,MAAM,EAAE,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACxF;;;AC5CO,IAAM,gBAAN,MAAoB;AAAA,EACzB,YAA6B,GAG1B;AAH0B;AAAA,EAGzB;AAAA,EAHyB;AAAA,EAK7B,MAAc,KAAK,QAAwB,MAAc,MAAe,OAAmC;AACzG,UAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,KAAK;AACtC,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK;AAAA,MAC9B,QAAQ;AAAA,MACR,oBAAoB,KAAK,EAAE;AAAA,MAC3B,gBAAgB,KAAK,EAAE;AAAA,MACvB,cAAc,QAAQ,KAAK,EAAE,UAAU,KAAK,KAAK,EAAE,QAAQ;AAAA,IAC7D;AACA,QAAI,SAAS,OAAW,SAAQ,cAAc,IAAI;AAClD,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,SAAS,GAAG,IAAI,IAAI;AAAA,QACrD;AAAA,QAAQ;AAAA,QAAS,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC7E,CAAC;AAAA,IACH,SAAS,GAAG;AAAE,YAAM,WAAW,GAAG,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,IAAI;AAAA,IAAE;AAClE,UAAM,MAAM,IAAI,QAAQ,IAAI,cAAc;AAC1C,SAAK,EAAE,YAAY,GAAG,MAAM,IAAI,IAAI,WAAM,IAAI,MAAM,GAAG,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE;AAC/E,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,QAAW,QAAwB,MAAc,MAA4B;AACzF,QAAI,MAAM,MAAM,KAAK,KAAK,QAAQ,MAAM,MAAM,KAAK;AACnD,QAAI,IAAI,WAAW,KAAK;AACtB,YAAM,MAAM,KAAK,KAAK,QAAQ,MAAM,MAAM,IAAI;AAC9C,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,IAAI,UAAU,wBAAwB,6CAA6C;AAAA,UACvF,MAAM;AAAA,UAAqB,QAAQ;AAAA,UAAK,WAAW,IAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,QACxF,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,IAAO,MAA0B;AAAE,WAAO,KAAK,QAAW,OAAO,IAAI;AAAA,EAAE;AAAA,EACvE,KAAQ,MAAc,MAA2B;AAAE,WAAO,KAAK,QAAW,QAAQ,MAAM,IAAI;AAAA,EAAE;AAChG;;;ACzCA,IAAM,UAAU;AAET,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YAA6B,GAE1B;AAF0B;AAAA,EAEzB;AAAA,EAFyB;AAAA,EAIrB,MAAM,WAA4B;AACxC,WAAO,IAAI,KAAK,SAAS,EAAE,QAAQ,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClE;AAAA,EAEA,MAAc,OAAO,OAAmC;AACtD,QAAI,SAAS,MAAM,KAAK,EAAE,MAAM,WAAW;AAC3C,QAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,sBAAsB,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACrG,QAAI;AACJ,aAAS,UAAU,KAAK,WAAW;AACjC,UAAI;AACF,YAAI,OAAO,MAAM,KAAK,EAAE,KAAK,GAAG,QAAQ,OAAO,IAAI,KAAK;AACxD;AAAA,MACF,SAAS,GAAG;AACV,YAAI,EAAE,aAAa,aAAa,EAAE,SAAS,wBAAyB,OAAM;AAI1E,cAAM,MAAM,MAAM,KAAK,EAAE,MAAM,WAAW;AAC1C,YAAI,OAAO,IAAI,OAAO,OAAO,IAAI;AAC/B,cAAI,YAAY,GAAG;AAAE,qBAAS;AAAK;AAAA,UAAS;AAC5C,gBAAM;AAAA,QACR;AACA,cAAM,KAAK,EAAE,MAAM,MAAM;AACzB,cAAM;AAAA,MACR;AAAA,IACF;AAIA,UAAM,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,EAAE,cAAc,KAAK,EAAE,KAAK,OAAO,EAAE,UAAU,SAAS,OAAO,QAAQ,YAAY,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACnJ,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,OAA4B,CAAC,GAAoB;AACjE,UAAM,OAAO,MAAM,KAAK,EAAE,MAAM,UAAU;AAC1C,QAAI,CAAC,KAAK,SAAS,QAAQ,KAAK,MAAM,KAAK,SAAS,EAAG,QAAO,KAAK;AACnE,WAAO,KAAK,EAAE,SAAS,KAAK,EAAE,UAAU,YAAY;AAClD,YAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,UAAU;AAC3C,UAAI,SAAS,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,MAAM,SAAS,EAAG,QAAO,MAAM;AAChF,YAAM,IAAI,MAAM,KAAK,OAAO;AAC5B,YAAM,KAAK,EAAE,MAAM,UAAU,EAAE,IAAI,EAAE,aAAa,WAAW,IAAI,KAAK,KAAK,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,YAAY,GAAI,EAAE,YAAY,EAAE,CAAC;AAClI,aAAO,EAAE;AAAA,IACX,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAW,QAAmC;AAClD,WAAO,KAAK,EAAE,SAAS,KAAK,EAAE,UAAU,aAAa,MAAM,KAAK,OAAO,OAAO,KAAK,GAAG,CAAC,GAAG,WAAW;AAAA,EACvG;AACF;;;ACrDO,SAAS,UAAU,QAA2B;AACnD,SAAO,OAAO,YAAY,SAAS,sBAAsB,6BAA6B,OAAO,WAAW,OAAO,SAAS;AAC1H;AAEA,eAAsB,YAAYC,OAAY,QAAmB,SAAiB,WAAiC;AACjH,QAAM,WAAsC,MAAMA,MAAK,OAAO,KAAK,GAAG,SAAS,OAAO,SAAS;AAC/F,MAAI,CAAC,QAAS,OAAM,IAAI,UAAU,sBAAsB,oBAAoB,OAAO,SAAS,IAAI,EAAE,MAAM,UAAU,MAAM,EAAE,CAAC;AAC3H,QAAM,OAAO,YAAY,QAAQ,WAAW,QAAQ,MAAM;AAC1D,QAAM,SAAS,IAAI,WAAWA,MAAK,UAAU,IAAI;AACjD,MAAI,CAAE,MAAM,OAAO,WAAW,EAAI,OAAM,IAAI,UAAU,sBAAsB,oBAAoB,OAAO,SAAS,IAAI,EAAE,MAAM,UAAU,MAAM,EAAE,CAAC;AAC/I,QAAM,UAAU,IAAI,mBAAmB,EAAE,OAAO,QAAQ,MAAM,MAAMA,MAAK,QAAQ,QAAQ,MAAM,GAAG,UAAUA,MAAK,UAAU,UAAU,MAAM,KAAKA,MAAK,IAAI,CAAC;AAC1J,QAAM,MAAM,IAAI,cAAc;AAAA,IAC5B,WAAW,QAAQ;AAAA,IAAW,OAAOA,MAAK;AAAA,IAAO,OAAO,CAAC,UAAU,QAAQ,YAAY,EAAE,MAAM,CAAC;AAAA,IAChG,YAAYA,MAAK;AAAA,IAAS;AAAA,IAAS,UAAU,GAAGA,MAAK,QAAQ,IAAI,QAAQ,IAAI,UAAU,QAAQ,SAAS,IAAI;AAAA,IAAI;AAAA,EAClH,CAAC;AACD,SAAO,EAAE,SAAS,KAAK,QAAQ,QAAQ;AACzC;;;ACxBA,SAAS,QAAAC,aAAY;;;ACArB,SAAS,OAAO,OAAO,YAAAC,WAAU,QAAQ,iBAAiB;AAC1D,SAAS,QAAAC,aAAY;AACrB,SAAS,mBAAmB;AAE5B,eAAsB,SAAY,MAAiC;AACjE,MAAI;AACJ,MAAI;AAAE,UAAM,MAAMD,UAAS,MAAM,MAAM;AAAA,EAAE,SAAS,GAAG;AACnD,QAAK,EAA4B,SAAS,SAAU,QAAO;AAC3D,UAAM;AAAA,EACR;AACA,SAAO,KAAK,MAAM,GAAG;AACvB;AAEA,eAAsB,gBAAgBE,MAAa,MAAc,MAA8B;AAC7F,QAAM,MAAMA,MAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACjD,QAAM,MAAMD,MAAKC,MAAK,IAAI,IAAI,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM;AACtE,QAAM,UAAU,KAAK,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;AAC1E,QAAM,MAAM,KAAK,GAAK;AACtB,QAAM,OAAO,KAAKD,MAAKC,MAAK,IAAI,CAAC;AACnC;;;ADdA,IAAMC,UAAS,KAAK;AAIb,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6BC,MAA8B,KAAiB;AAA/C,eAAAA;AAA8B;AAAA,EAAkB;AAAA,EAAhD;AAAA,EAA8B;AAAA,EAE3D,MAAc,OAA2B;AACvC,QAAI;AACF,YAAM,IAAI,MAAM,SAAoBC,MAAK,KAAK,KAAK,YAAY,CAAC;AAChE,UAAI,KAAK,EAAE,kBAAkB,KAAK,OAAO,EAAE,YAAY,YAAY,EAAE,QAAS,QAAO;AAAA,IACvF,QAAQ;AAAA,IAA4C;AACpD,WAAO,EAAE,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA,EACzC;AAAA,EAEQ,MAAM,GAAkC;AAC9C,WAAO,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,IAAIF;AAAA,EAC1E;AAAA,EAEA,MAAM,IAAI,QAAgB,KAAqC;AAC7D,UAAM,KAAK,MAAM,KAAK,KAAK,GAAG,QAAQ,GAAG,MAAM,IAAI,GAAG,EAAE;AACxD,WAAO,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW;AAAA,EACtC;AAAA;AAAA;AAAA,EAIA,MAAM,IAAI,QAAgB,KAAa,UAAiC;AACtE,UAAM,IAAI,MAAM,KAAK,KAAK;AAC1B,MAAE,QAAQ,GAAG,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,YAAY,KAAK,IAAI,EAAE,YAAY,EAAE;AACjF,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,OAAO,EAAG,KAAI,CAAC,KAAK,MAAM,CAAC,EAAG,QAAO,EAAE,QAAQ,CAAC;AACtF,UAAM,KAAK,KAAK,CAAC;AAAA,EACnB;AAAA;AAAA,EAGA,MAAM,KAAK,QAAgB,KAA4B;AACrD,UAAM,IAAI,MAAM,KAAK,KAAK;AAC1B,QAAI,EAAE,GAAG,MAAM,IAAI,GAAG,MAAM,EAAE,SAAU;AACxC,WAAO,EAAE,QAAQ,GAAG,MAAM,IAAI,GAAG,EAAE;AACnC,UAAM,KAAK,KAAK,CAAC;AAAA,EACnB;AAAA,EAEA,MAAc,KAAK,GAA6B;AAC9C,QAAI;AAAE,YAAM,gBAAgB,KAAK,KAAK,cAAc,CAAC;AAAA,IAAE,QAAQ;AAAA,IAAmB;AAAA,EACpF;AAAA,EAEA,MAAM,WAAW,MAAmC;AAClD,UAAM,IAAI,MAAM,KAAK,KAAK;AAC1B,UAAM,OAAyC,CAAC;AAChD,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,OAAO,GAAG;AAC9C,YAAMG,OAAM,EAAE,YAAY,GAAG;AAC7B,UAAI,KAAK,SAAS,EAAE,MAAMA,OAAM,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,EAAG,MAAK,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAGA,IAAG,GAAG,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAAA,IACnI;AACA,SAAK,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE;AAC/B,WAAO,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAAA,EAC/C;AACF;;;AExDA,IAAM,MAAM;AACZ,IAAM,UAAU,oBAAI,IAAI,CAAC,UAAU,SAAS,QAAQ,MAAM,CAAC;AAG3D,IAAM,eAAe,oBAAI,IAAI,CAAC,KAAK,MAAM,OAAO,UAAU,QAAQ,MAAM,CAAC;AACzE,IAAM,gBAAgB,CAAC,WAAqB,OAAO,KAAK,CAAC,MAAM,aAAa,IAAI,EAAE,YAAY,CAAC,CAAC;AAEzF,SAAS,QAAQ,KAA4B;AAClD,MAAI,MAAM,IAAI,KAAK;AACnB,MAAI,IAAI,WAAW,MAAM,EAAG,OAAM,IAAI,MAAM,CAAC;AAE7C,MAAI,CAAC,OAAO,IAAI,SAAS,IAAI,EAAG,QAAO;AACvC,MAAI;AACJ,MAAI;AACJ,MAAI,IAAI,SAAS,KAAK,GAAG;AACvB,QAAI,cAAc,IAAI,MAAM,IAAI,QAAQ,KAAK,IAAI,CAAC,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC,CAAC,EAAG,QAAO;AACjF,QAAI;AACJ,QAAI;AAAE,UAAI,IAAI,IAAI,GAAG;AAAA,IAAE,QAAQ;AAAE,aAAO;AAAA,IAAK;AAC7C,QAAI,CAAC,QAAQ,IAAI,EAAE,SAAS,YAAY,CAAC,EAAG,QAAO;AAEnD,WAAO,EAAE;AACT,WAAO,EAAE;AAAA,EACX,OAAO;AACL,UAAM,IAAI,IAAI,KAAK,GAAG;AACtB,QAAI,CAAC,EAAG,QAAO;AACf,WAAO,EAAE,CAAC;AACV,WAAO,EAAE,CAAC;AAAA,EACZ;AACA,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC/C,MAAI,CAAC,QAAQ,SAAS,WAAW,KAAK,cAAc,QAAQ,EAAG,QAAO;AACtE,QAAM,QAAQ,SAAS,CAAC;AACxB,MAAI,OAAO,SAAS,CAAC;AACrB,MAAI,KAAK,YAAY,EAAE,SAAS,MAAM,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AAChE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,GAAG,KAAK,YAAY,CAAC,IAAI,MAAM,YAAY,CAAC,IAAI,KAAK,YAAY,CAAC;AAC3E;;;ACvCA,SAAS,YAAY;AACrB,SAAS,SAAS,QAAAC,OAAM,eAAe;AAIvC,eAAsB,aAAa,OAAuC;AACxE,MAAIC,OAAM,QAAQ,KAAK;AACvB,aAAS;AACP,QAAI;AACF,YAAM,KAAKD,MAAKC,MAAK,MAAM,CAAC;AAC5B,aAAOA;AAAA,IACT,QAAQ;AAAA,IAAkD;AAC1D,UAAM,KAAK,QAAQA,IAAG;AACtB,QAAI,OAAOA,KAAK,QAAO;AACvB,IAAAA,OAAM;AAAA,EACR;AACF;;;ATaA,IAAM,OAAO;AACb,IAAM,YAAY;AAClB,IAAM,UAAU;AAIhB,IAAM,YAAY,oBAAI,IAAmB;AAAA,EACvC;AAAA,EAAwB;AAAA,EAAwB;AAAA,EAChD;AAAA,EAAsB;AACxB,CAAC;AAED,IAAM,QAAQ,CAAC,MAAiB,EAAE,WAAW,EAAE;AAG/C,SAAS,aAAa,SAA2B;AAC/C,QAAM,OAAO,CAAC,MAAc,EAAE,SAAS,WAAW,IAAI,EAAE,SAAS,aAAa,IAAI;AAClF,SAAO,CAAC,GAAG,OAAO,EAAE,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;AACtD;AACA,IAAM,YAAY,CAAC,YAA4B,aAAa,OAAO,EAAE,CAAC;AAKtE,eAAe,YAAYC,OAAoF;AAC7G,QAAM,OAAO,MAAM,aAAaA,MAAK,GAAG;AACxC,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI;AACJ,MAAI;AACF,cAAU,MAAMA,MAAK,IAAI,QAAQ,IAAI;AAAA,EACvC,SAAS,GAAG;AACV,QAAI,aAAa,aAAa,EAAE,SAAS,uBAAwB,QAAO,EAAE,MAAM,OAAO,CAAC,GAAG,UAAU,EAAE;AACvG,UAAM;AAAA,EACR;AACA,QAAM,QAAQ,QAAQ,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,KAAK,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,MAAkB,EAAE,QAAQ,IAAI;AAC1G,SAAO,EAAE,MAAM,MAAM;AACvB;AAEA,SAAS,OAAO,SAAkB,IAAsC;AACtE,SAAO,QAAQ,IAAI,IAAqB,uBAAuB,mBAAmB,EAAE,CAAC,EAAE;AACzF;AAKA,eAAe,cAAcA,OAAY,SAAkB,QAAmB,OAAwB,UAAkB;AACtH,MAAI;AACF,UAAM,SAAS,MAAM,YAAYA,KAAI,IAAI,SAAS,CAAC;AACnD,UAAM,UAAU,oBAAI,IAAyB;AAC7C,UAAM,WAAqB,CAAC;AAC5B,eAAW,OAAO,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG;AAClD,YAAM,KAAK,MAAM,MAAM,IAAI,OAAO,WAAW,GAAG;AAChD,UAAI,GAAI,SAAQ,IAAI,KAAK,oBAAI,IAAI,CAAC,EAAE,CAAC,CAAC;AAAA,UACjC,UAAS,KAAK,GAAG;AAAA,IACxB;AACA,QAAI,SAAS,SAAS,GAAG;AACvB,UAAI;AACF,cAAM,EAAE,QAAQ,IAAI,MAAM,QAAQ,IAAI,KAAqB,SAAS,EAAE,UAAU,SAAS,CAAC;AAC1F,mBAAW,KAAK,QAAS,SAAQ,IAAI,EAAE,UAAU,QAAQ,IAAI,EAAE,OAAO,KAAK,oBAAI,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;AACtG,cAAM,MAAM,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AACnD,YAAI,IAAI,SAAS,EAAG,YAAW,KAAK,QAAS,OAAM,MAAM,IAAI,OAAO,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE;AAAA,MACvG,SAAS,GAAG;AAAE,YAAI,aAAa,eAAgB,OAAM;AAAA,MAAyB;AAAA,IAChF;AACA,WAAO,aAAa,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAI,QAAQ,IAAI,EAAE,GAAG,KAAK,CAAC,CAAE,EAAE,KAAK,CAAC,OAAO,OAAO,QAAQ,CAAC,GAAG;AAAA,EACzG,SAAS,GAAG;AACV,QAAI,aAAa,eAAgB,OAAM;AACvC,WAAO;AAAA,EACT;AACF;AAEA,eAAe,OAAOA,OAAY,GAAS,OAAgD;AACzF,QAAM,MAAM,MAAMA,MAAK,OAAO,KAAK;AACnC,QAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,QAAM,UAAU,MAAM,YAAYA,OAAM,QAAQ,EAAE,SAAS,EAAE,SAAS;AACtE,QAAM,iBAAiBA,OAAM,OAAO,WAAW,cAAc;AAC7D,MAAI,KAAK,EAAE;AACX,MAAI,CAAC,KAAK,KAAK,EAAE,GAAG;AAClB,QAAI,WAAW,EAAE,UAAU,QAAQ,QAAQ,cAAc;AACzD,QAAI,CAAC,UAAU;AACb,YAAM,KAAK,MAAM,QAAQ,IAAI,IAAW,gBAAgB;AAExD,UAAI,GAAG,QAAQ,WAAW,GAAG;AAC3B,cAAM,IAAI,UAAU,4BAA4B,uDAAuD;AAAA,UACrG,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AACA,UAAI,GAAG,QAAQ,SAAS,GAAG;AACzB,cAAM,aAA0B,GAAG,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,UAAU,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,EAAE;AAChH,cAAM,IAAI,UAAU,yBAAyB,oBAAoB,EAAE,SAAS;AAAA,UAC1E,MAAM;AAAA,UAAwD;AAAA,QAChE,CAAC;AAAA,MACH;AACA,iBAAW,GAAG,QAAQ,CAAC,EAAG;AAAA,IAC5B;AACA,UAAM,MAAM,QAAQ,IAAI;AAAA,MACtB,uBAAuB,mBAAmB,QAAQ,CAAC,yBAAyB,mBAAmB,EAAE,CAAC;AAAA,IAAE,GAAG;AAAA,EAC3G;AACA,QAAM,SAAS,MAAM,OAAO,SAAS,EAAE;AACvC,QAAM,YAAY,MAAM,cAAcA,OAAM,SAAS,QAAQ,OAAO,OAAO,EAAE;AAC7E,QAAM,WAAW,MAAM,aAAaA,MAAK,GAAG;AAC5C,SAAO,EAAE,QAAQ,SAAS,QAAQ,QAAQ,YAAY,EAAE,MAAM,QAAQ,UAAU,IAAI,EAAE,MAAM,OAAO,GAAG,SAAS;AACjH;AAEA,SAAS,aAAa,KAAiB,eAAyB,WAAiC;AAC/F,MAAI,UAAW,QAAO,CAAC,cAAc,WAAW,IAAI,cAAc,CAAC;AACnE,QAAM,OAAO,CAAC,MAAe,MAAM,gBAAgB,KAAK,YAAY,IAAI,MAAM,gBAAgB,QAAQ,YAAY,IAAI;AACtH,QAAM,OAAO,OAAO,KAAK,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AAG7F,QAAM,SAAS,cAAc,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;AAC1D,QAAM,UAAU,CAAC,GAAG,QAAQ,cAAc,QAAW,IAAI,cAAc,EAAE,WAAW,GAAG,IAAI;AAC3F,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,cAAc,GAAG,MAAS,CAAC;AACpG;AAMO,SAAS,YAAY,GAAc,OAAgC,MAA0B;AAClG,SAAO,IAAI,UAAU,EAAE,MAAM,EAAE,SAAS;AAAA,IACtC,MAAM,QAAQ,EAAE;AAAA,IAAM,QAAQ,EAAE;AAAA,IAAQ,WAAW,EAAE;AAAA,IAAW,YAAY,EAAE;AAAA,IAAY,YAAY,EAAE;AAAA,IACxG,SAAS,EAAE,GAAG,EAAE,SAAS,GAAG,MAAM;AAAA,IAAG,OAAO;AAAA,EAC9C,CAAC;AACH;AAGA,eAAe,UAAUA,OAAY,GAAS,OAAwB,QAAmB,OAAgB,MACvG,UAAkB,aAAoE;AACtF,QAAM,UAAU,MAAM,YAAYA,OAAM,QAAQ,EAAE,SAAS,EAAE,SAAS;AACtE,MAAI;AACF,UAAM,iBAAiBA,OAAM,OAAO,WAAW,cAAc;AAAA,EAC/D,SAAS,GAAG;AAEV,QAAI,EAAE,aAAa,cAAc,EAAE,SAAS,6BAA8B,OAAM;AAChF,gBAAY,CAAC;AACb,WAAO;AAAA,EACT;AAKA,QAAM,OAAwC,CAAC;AAC/C,aAAW,KAAK,aAAa,KAAK,GAAG;AACnC,UAAMC,MAAK,MAAM,MAAM,IAAI,OAAO,WAAW,EAAE,GAAG;AAClD,QAAIA,IAAI,MAAK,KAAK,EAAE,QAAQ,GAAG,IAAAA,IAAG,CAAC;AAAA,EACrC;AACA,MAAI,KAAK,SAAS,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC,EAAG,EAAE,GAAG;AAC9D,UAAM,EAAE,QAAQ,GAAG,IAAAA,IAAG,IAAI,KAAK,CAAC;AAChC,QAAI;AACF,aAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO,SAASA,GAAE,GAAG,QAAQ,EAAE,MAAM,UAAU,QAAQ,EAAE,MAAM,KAAK,EAAE,IAAI,GAAG,SAAS;AAAA,IAChI,SAAS,GAAG;AACV,UAAI,EAAE,aAAa,cAAc,EAAE,SAAS,0BAA2B,OAAM;AAC7E,iBAAW,KAAK,KAAM,OAAM,MAAM,KAAK,OAAO,WAAW,EAAE,OAAO,GAAG;AAAA,IACvE;AAAA,EACF;AAEA,QAAM,EAAE,QAAQ,IAAI,MAAM,QAAQ,IAAI,KAAqB,SAAS,EAAE,UAAU,KAAK,CAAC;AACtF,QAAM,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACxD,MAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,MAAI,KAAK,IAAI,CAAC;AACd,MAAI,IAAI,SAAS,GAAG;AAClB,QAAI,EAAE,UAAU,IAAI,SAAS,EAAE,MAAM,EAAG,MAAK,EAAE;AAAA,SAC1C;AACH,YAAM,aAA0B,IAAI,IAAI,CAAC,QAAQ;AAC/C,cAAM,MAAM,QAAQ,OAAO,CAACC,OAAMA,GAAE,OAAO,OAAO,GAAG;AACrD,cAAM,IAAI,IAAI,CAAC;AACf,cAAMC,UAAS,UAAU,MAAM,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE;AACpF,eAAO,EAAE,MAAM,UAAU,IAAI,EAAE,OAAO,IAAI,MAAM,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO,MAAM,QAAAA,SAAQ,QAAQ,EAAE,OAAO,KAAK;AAAA,MACpH,CAAC;AACD,YAAM,IAAI,UAAU,yBAAyB,mDAAmD;AAAA,QAC9F,MAAM;AAAA,QAA4B;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,cAAc,IAAI,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,OAAO,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;AAE3F,MAAI,IAAI,WAAW,EAAG,YAAW,KAAK,YAAa,OAAM,MAAM,IAAI,OAAO,WAAW,GAAG,EAAE;AAC1F,QAAM,SAAS,UAAU,MAAM,OAAO,CAAC,MAAM,YAAY,IAAI,EAAE,GAAG,CAAC,CAAC;AACpE,SAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO,SAAS,EAAE,GAAG,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,GAAG,SAAS;AAC1I;AAEA,eAAe,YAAYH,OAAY,KAAmC;AACxE,aAAW,KAAK,OAAO,OAAO,IAAI,QAAQ,GAAG;AAC3C,QAAI,MAAM,IAAI,WAAWA,MAAK,UAAU,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,EAAG,QAAO;AAAA,EACnG;AACA,SAAO;AACT;AAEA,eAAsB,qBAAqBA,OAAY,GAAiC;AACtF,QAAM,QAAQ,IAAI,gBAAgBI,MAAKJ,MAAK,OAAO,KAAK,OAAO,GAAGA,MAAK,GAAG;AAC1E,MAAI,EAAE,OAAQ,QAAO,OAAOA,OAAM,GAAG,KAAK;AAI1C,QAAM,MAAM,MAAMA,MAAK,OAAO,KAAK;AACnC,QAAM,QAAQ,cAAc,EAAE,QAAQ,IAAI,cAAc;AAExD,MAAI,EAAE,UAAU,CAAE,MAAM,YAAYA,OAAM,GAAG,GAAI;AAC/C,UAAM,YAAYA,OAAM,OAAO,EAAE,OAAO;AAAA,EAC1C;AAEA,QAAM,OAAO,MAAM,YAAYA,KAAI;AACnC,MAAI,SAAS,KAAM,OAAM,IAAI,UAAU,yBAAyB,kCAAkC,EAAE,MAAM,UAAU,CAAC;AACrH,QAAM,EAAE,MAAM,OAAO,SAAS,IAAI;AAClC,MAAI,MAAM,WAAW,GAAG;AAGtB,UAAM,OAAO,UAAU;AACvB,UAAM,IAAI,UAAU,yBAAyB,gDAAgD;AAAA,MAC3F,MAAM,OAAO,GAAG,SAAS,cAAc,IAAI,KAAK;AAAA,MAChD,SAAS,WAAW,EAAE,KAAK,QAAQ,SAAS,QAAQ,IAAI;AAAA,MACxD,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEjD,QAAM,QAAkB,CAAC;AACzB,QAAM,WAAqB,CAAC;AAC5B,QAAM,UAAqB,CAAC;AAC5B,QAAM,aAA0B,CAAC;AACjC,MAAI;AACJ,aAAW,UAAU,aAAa,KAAK,MAAM,MAAM,WAAW,IAAI,GAAG,EAAE,MAAM,GAAG;AAC9E,UAAM,KAAK,MAAM,MAAM,CAAC;AACxB,QAAI,oBAAoB;AACxB,QAAI;AACF,YAAM,KAAK,MAAM,UAAUA,OAAM,GAAG,OAAO,QAAQ,OAAO,MAAM,MAAM,CAAC,MAAM;AAC3E,4BAAoB;AACpB,wBAAgB;AAChB,gBAAQ,KAAK,EAAE,SAAS,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ,CAAC;AAAA,MAC3E,CAAC;AACD,UAAI,GAAI,QAAO;AACf,UAAI,CAAC,kBAAmB,UAAS,KAAK,MAAM,MAAM,CAAC;AAAA,IACrD,SAAS,GAAG;AACV,UAAI,EAAE,aAAa,cAAc,CAAC,UAAU,IAAI,EAAE,IAAI,EAAG,OAAM;AAC/D,cAAQ,KAAK,EAAE,SAAS,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ,CAAC;AACzE,iBAAW,KAAK,CAAC;AAAA,IACnB;AAAA,EACF;AAEA,QAAM,UAAmC,EAAE,eAAe,MAAM;AAChE,MAAI,QAAQ,SAAS,EAAG,SAAQ,kBAAkB;AAClD,MAAI,SAAS,WAAW,GAAG;AAIzB,UAAM,QAAQ,WAAW,CAAC,KAAK;AAC/B,QAAI,MAAO,OAAM,YAAY,OAAO,OAAO;AAAA,EAC7C;AACA,QAAM,YAAY,QAAQ,SAAS,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC,0BAA0B,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,OAAO;AAErJ,QAAM,kBAAkB,QAAQ,IAAI,SAAS,gBAAgB,QAAQ,SAAS,CAAC,KAC1E,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,YAAY,cAAc,EAAE,SAAS,wBAAwB,EAAE,SAAS,uBAAuB;AAC3H,QAAM,IAAI,UAAU,yBAAyB,sBAAsB;AAAA,IACjE,MAAM,+DAA+D,SAAS,KAAK,IAAI,CAAC,+BACpF,aACC,kBAAkB,KAAK;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,IAAM,gBAAgB,CAAC,SAAgC,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,EAAE;AAEvH,SAAS,QAAQ,IAAmC,KAAsB;AAC/E,QAAM,OAAO,GAAG,OAAO;AACvB,MAAI,KAAK;AACP,UAAM,QAAQ,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO,EAAE,SAAS,GAAG;AAC7D,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,UAAU,2BAA2B,GAAG,GAAG,OAAO,IAAI,2BAA2B,GAAG,kBAAkB;AAAA,QAC9G,YAAY,cAAc,IAAI;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,MAAI,KAAK,WAAW,EAAG,QAAO,KAAK,CAAC;AACpC,MAAI,KAAK,WAAW,EAAG,OAAM,IAAI,UAAU,2BAA2B,GAAG,GAAG,OAAO,IAAI,qCAAqC;AAC5H,QAAM,IAAI,UAAU,sBAAsB,GAAG,GAAG,OAAO,IAAI,4BAA4B,EAAE,MAAM,sBAAsB,YAAY,cAAc,IAAI,EAAE,CAAC;AACxJ;;;AUzSA,eAAsB,cAAcK,OAAY,IAAmB,KAAmC;AACpG,QAAM,iBAAiBA,OAAM,GAAG,OAAO,WAAW,kBAAkB;AACpE,MAAI;AACF,WAAO,MAAM,GAAG,QAAQ,IAAI;AAAA,MAC1B,uBAAuB,mBAAmB,GAAG,OAAO,EAAE,CAAC,qBAAqB,mBAAmB,IAAI,EAAE,CAAC;AAAA,IAAE;AAAA,EAC5G,SAAS,GAAG;AACV,QAAI,EAAE,aAAa,cAAc,EAAE,SAAS,qBAAsB,OAAM;AACxE,QAAI,EAAE,eAAe,qBAAqB;AACxC,YAAM;AAAA,QAAY;AAAA,QAAG,EAAE,UAAU,SAAS,MAAM,GAAG,OAAO,OAAO;AAAA,QAC/D,YAAY,GAAG,OAAO,MAAM,OAAO,GAAG,OAAO,IAAI;AAAA,MAAsF;AAAA,IAC3I;AAEA,QAAI,EAAE,eAAe,0BAA2B,OAAM,YAAY,GAAG,CAAC,GAAG,yBAAyB;AAClG,UAAM;AAAA,EACR;AACF;;;AChBO,SAAS,SAAS,UAAuC;AAC9D,QAAM,MAAM,oBAAI,IAAoB;AACpC,aAAW,QAAQ,SAAS,MAAM,IAAI,GAAG;AACvC,UAAM,IAAI,KAAK,QAAQ,OAAO,EAAE,EAAE,MAAM,iCAAiC;AACzE,QAAI,IAAI,CAAC,MAAM,UAAa,EAAE,CAAC,MAAM,OAAW,KAAI,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;AAAA,EACpE;AACA,SAAO;AACT;AAIO,SAAS,aAAa,KAAa,SAA4B;AACpE,aAAW,WAAW,SAAS;AAC7B,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,UAAI,IAAI,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC,EAAG,QAAO;AAAA,IACnD,WAAW,QAAQ,QAAS,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA,UAAU,CAAC;AAAA,EACX,gBAAgB;AAAA,EAChB,UAAU,CAAC;AACb,GAYE;AACA,QAAM,SAAS,IAAI,IAAI,OAAO;AAC9B,QAAM,YAAsB,CAAC;AAC7B,QAAM,QAAkB,CAAC;AACzB,QAAM,YAAsB,CAAC;AAC7B,QAAM,cAAwB,CAAC;AAE/B,aAAW,CAAC,KAAK,WAAW,KAAK,OAAO,QAAQ,OAAO,GAAG;AACxD,UAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,UAAM,aAAa,QAAQ,IAAI,GAAG;AAClC,UAAM,aAAa,CAAC,YAAY,eAAe,MAAM,eAAe,QAAQ,eAAe;AAE3F,QAAI,YAAY;AACd,aAAO,IAAI,KAAK,WAAW;AAC3B,YAAM,KAAK,GAAG;AACd;AAAA,IACF;AACA,QAAI,eAAe,aAAa;AAC9B,gBAAU,KAAK,GAAG;AAClB;AAAA,IACF;AAIA,QAAI,aAAa,KAAK,OAAO,GAAG;AAC9B,aAAO,IAAI,KAAK,WAAW;AAC3B,kBAAY,KAAK,GAAG;AACpB;AAAA,IACF;AACA,cAAU,KAAK,GAAG;AAClB,UAAM,SAAS,QAAQ,GAAG,KAAK;AAC/B,WAAO,IAAI,KAAK,WAAW,eAAe,cAAc,UAAW;AAAA,EACrE;AAEA,SAAO,EAAE,QAAQ,WAAW,OAAO,WAAW,YAAY;AAC5D;AAIO,SAAS,UAAU,UAAkB,QAAqC;AAC/E,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,QAAM,MAAM,MAAM,IAAI,CAAC,SAAS;AAC9B,UAAM,IAAI,KAAK,QAAQ,OAAO,EAAE,EAAE,MAAM,iCAAiC;AACzE,QAAI,CAAC,IAAI,CAAC,EAAG,QAAO;AACpB,UAAM,MAAc,EAAE,CAAC;AACvB,QAAI,CAAC,OAAO,IAAI,GAAG,EAAG,QAAO;AAC7B,SAAK,IAAI,GAAG;AACZ,WAAO,GAAG,GAAG,IAAI,OAAO,IAAI,GAAG,KAAK,EAAE;AAAA,EACxC,CAAC;AAED,QAAM,WAAqB,CAAC;AAC5B,aAAW,CAAC,KAAK,KAAK,KAAK,QAAQ;AACjC,QAAI,CAAC,KAAK,IAAI,GAAG,EAAG,UAAS,KAAK,GAAG,GAAG,IAAI,KAAK,EAAE;AAAA,EACrD;AAEA,MAAI,OAAO,IAAI,KAAK,IAAI;AACxB,MAAI,SAAS,QAAQ;AACnB,QAAI,KAAK,UAAU,CAAC,KAAK,SAAS,IAAI,EAAG,SAAQ;AACjD,YAAQ,SAAS,KAAK,IAAI,IAAI;AAAA,EAChC;AACA,SAAO;AACT;;;AC1GA,SAAS,OAAO,gBAAgB;AAChC,SAAS,UAAU,WAAAC,UAAS,YAAY,UAAU,WAAAC,UAAS,WAAW;AAItE,IAAM,UAAU,CAAC,WAAmB,IAAI,UAAU,wBAAwB,mDAAmD,MAAM,KAAK;AAAA,EACtI,MAAM;AACR,CAAC;AAED,IAAM,YAAY,CAAC,WAAmB,IAAI,UAAU,wBAAwB,kDAAkD,MAAM,KAAK;AAAA,EACvI,MAAM;AACR,CAAC;AAED,SAAS,OAAO,MAAc,GAAoB;AAChD,QAAM,MAAM,SAAS,MAAM,CAAC;AAC5B,SAAO,QAAQ,MAAM,QAAQ,QAAQ,CAAC,IAAI,WAAW,OAAO,GAAG,KAAK,CAAC,WAAW,GAAG;AACrF;AASA,eAAsB,cAAc,MAAc,QAAgB,OAAe,MAAuB;AACtG,QAAM,WAAW,MAAM,SAAS,IAAI;AACpC,QAAM,WAAW,SAAS,OAAO,WAAW,MAAM,SAAS,IAAI;AAC/D,QAAM,MAAMC,SAAQ,UAAU,MAAM;AAOpC,MAAI,CAAC,WAAW,MAAM,KAAK,CAAC,OAAO,UAAU,GAAG,EAAG,OAAM,QAAQ,MAAM;AACvE,MAAI;AACJ,MAAI;AAAE,aAAS,MAAM,SAASC,SAAQ,GAAG,CAAC;AAAA,EAAE,SAAS,GAAG;AACtD,QAAK,EAA4B,SAAS,SAAU,OAAM;AAC1D,UAAM,IAAI,UAAU,wBAAwB,qBAAqB,MAAM,mBAAmB;AAAA,MACxF,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,QAAQD,SAAQ,QAAQ,SAAS,GAAG,CAAC;AAC3C,MAAI,CAAC,OAAO,UAAU,KAAK,EAAG,OAAM,QAAQ,MAAM;AAKlD,MAAI;AACF,UAAM,KAAK,MAAM,MAAM,KAAK;AAC5B,QAAI,GAAG,eAAe,EAAG,OAAM,UAAU,MAAM;AAC/C,UAAM,YAAY,MAAM,SAAS,KAAK;AACtC,QAAI,CAAC,OAAO,UAAU,SAAS,EAAG,OAAM,QAAQ,MAAM;AAAA,EACxD,SAAS,GAAG;AACV,QAAI,aAAa,UAAW,OAAM;AAClC,QAAK,EAA4B,SAAS,SAAU,OAAM;AAAA,EAC5D;AAEA,SAAO;AACT;AAOO,SAAS,SAAS,GAGc;AACrC,QAAM,WAAW,EAAE,YAAY,EAAE,WAAW;AAC5C,QAAM,UAAU,SAAS,QAAQ;AACjC,QAAM,IAAI,cAAc,EAAE,SAAS,SAAS,EAAE,SAAS,SAAS,EAAE,WAAW,CAAC,GAAG,eAAe,EAAE,eAAe,SAAS,EAAE,QAAQ,CAAC;AACrI,QAAM,WAAW,CAAC,MAAc,EAAE,UAAU,CAAC,KAAK,EAAE;AACpD,QAAM,YAAsB,CAAC;AAC7B,aAAW,OAAO,EAAE,cAAc;AAChC,UAAM,IAAI,EAAE,OAAO,IAAI,GAAG;AAC1B,QAAI,MAAM,UAAa,MAAM,MAAM,MAAM,QAAQ,MAAM,MAAM;AAAE,QAAE,OAAO,IAAI,KAAK,EAAE,OAAO,CAAC;AAAG,gBAAU,KAAK,GAAG;AAAA,IAAE;AAAA,EACpH;AACA,SAAO;AAAA,IACL,MAAM,UAAU,UAAU,EAAE,MAAM;AAAA,IAClC,SAAS,EAAE,aAAa;AAAA,IACxB,mBAAmB,EAAE,aAAa,QAAQ,EAAE,YAAY;AAAA,IACxD,OAAO,EAAE;AAAA,IAAO,SAAS,EAAE;AAAA,IAAa,WAAW,EAAE;AAAA,IAAW,WAAW,EAAE;AAAA,IAC7E,MAAM,EAAE,UAAU,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,MAAM;AAAA,IACtD,UAAU,EAAE,UAAU,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,YAAY;AAAA,IAChE;AAAA,EACF;AACF;;;ACpFA,IAAM,YAAY,CAAC,GAA4B,SAC7C,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,QAAQ,OAAO,EAAE,OAAO,QAAQ;AAEnF,eAAsB,iBAAiB,KAAqB,OAA4B,SAAyC;AAC/H,QAAM,IAAI,IAAI,KAAK;AACnB,QAAM,YAAY,EAAE,UAAU,CAAC,MAAc,IAAI,GAAG,IAAI,CAAC,IAAI;AAC7D,QAAM,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,SAAS,UAAU;AAC1E,MAAI;AACF,WAAO,MAAM,qBAAqB,IAAI,MAAM,IAAI;AAAA,EAClD,SAAS,GAAG;AACV,QAAI,EAAE,aAAa,cAAc,EAAE,SAAS,2BAA2B,CAAC,IAAI,GAAG,YAAa,OAAM;AAElG,QAAI,UAAU,EAAE,YAAY,QAAQ,GAAG;AACrC,YAAM,SAAS,MAAM,IAAI,GAAG;AAAA,QAAO;AAAA,QACjC,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,EAAE,SAAS,GAAG,EAAE,MAAM,QAAQ,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,MAAM,KAAK,OAAO,EAAE,GAAG,EAAE;AAAA,MAAC;AACjH,aAAO,qBAAqB,IAAI,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,UAAU,EAAE,YAAY,QAAQ,GAAG;AACrC,YAAM,SAAS,MAAM,IAAI,GAAG,OAAO,mBAAmB,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,EAAE,GAAG,EAAE,CAAC;AACxH,aAAO,qBAAqB,IAAI,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,OAAO,KAAqB,IAAmB,KAA+B;AAClG,MAAI;AACF,WAAO,QAAQ,IAAI,GAAG;AAAA,EACxB,SAAS,GAAG;AACV,QAAI,EAAE,aAAa,cAAc,EAAE,SAAS,wBAAwB,CAAC,IAAI,GAAG,YAAa,OAAM;AAC/F,UAAM,KAAK,MAAM,IAAI,GAAG,OAAO,iBAAiB,GAAG,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1G,WAAO,QAAQ,IAAI,EAAE;AAAA,EACvB;AACF;AAEA,SAAS,WAAW,IAA2B;AAC7C,MAAI,GAAG,OAAO,SAAS,SAAU,QAAO,GAAG,OAAO;AAClD,SAAO,GAAG,OAAO,YAAY,uBAAuB,GAAG,OAAO,SAAS,KAAK;AAC9E;AAEO,SAAS,YAAY,IAAmB,KAAsB;AACnE,QAAM,QAAQ,CAAC,GAAG,OAAO,OAAO,MAAM,GAAI,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,GAAI,GAAG,OAAO,IAAI;AAChF,SAAO,UAAK,MAAM,KAAK,KAAK,CAAC,MAAM,WAAW,EAAE,CAAC;AACnD;AAEO,SAAS,YAAY,IAAmB,KAAc;AAC3D,QAAM,EAAE,IAAI,MAAM,MAAM,MAAM,OAAO,IAAI,GAAG;AAC5C,SAAO;AAAA,IACL,QAAQ,GAAG,OAAO,WAAW,GAAG,OAAO;AAAA,IACvC,QAAQ,GAAG,OAAO;AAAA,IAClB,KAAK,OAAO;AAAA,IACZ,QAAQ,EAAE,IAAI,MAAM,MAAM,MAAM,OAAO;AAAA,IACvC,QAAQ,GAAG,OAAO,SAAS,WAAW,GAAG,OAAO,SAAS;AAAA,IACzD,GAAI,GAAG,OAAO,SAAS,UAAU,GAAG,OAAO,YAAY,EAAE,WAAW,GAAG,OAAO,UAAU,IAAI,CAAC;AAAA,EAC/F;AACF;;;AC5DA,SAAS,YAAAE,iBAAgB;AAIlB,SAAS,SAAS,MAAc,UAAmC;AACxE,SAAO,aAAa,UAAU,KAAK,YAAY,IAAI;AACrD;AAEA,eAAe,MAAMC,OAAY,MAA+B;AAC9D,MAAI,OAAO;AACX,MAAI;AACF,WAAO,MAAMD,UAAS,IAAI;AAAA,EAC5B,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,SAAU,OAAM;AAAA,EAE5D;AACA,SAAO,SAAS,MAAMC,MAAK,QAAQ;AACrC;AAEA,eAAsB,UAAUA,OAAY,MAAc,UAAoC;AAC5F,QAAM,MAAM,MAAMA,MAAK,OAAO,KAAK;AACnC,UAAQ,IAAI,eAAe,MAAM,MAAMA,OAAM,IAAI,CAAC,KAAK,CAAC,GAAG,SAAS,QAAQ;AAC9E;AAEA,eAAsB,MAAMA,OAAY,MAAc,UAAiC;AACrF,QAAM,MAAM,MAAM,MAAMA,OAAM,IAAI;AAClC,QAAMA,MAAK,OAAO,OAAO,CAAC,MAAM;AAC9B,UAAM,QAAS,EAAE,iBAAiB,CAAC;AACnC,UAAM,OAAO,IAAI,IAAI,MAAM,GAAG,KAAK,CAAC,CAAC;AACrC,SAAK,IAAI,QAAQ;AACjB,UAAM,GAAG,IAAI,CAAC,GAAG,IAAI;AAAA,EACvB,CAAC;AACH;;;AClBA,eAAsB,cAAc,KAAqB,IAAmB,KAAa,GAAqC;AAC5H,QAAM,OAAO,GAAG,YAAY,IAAI,KAAK;AACrC,MAAI,CAAC,IAAI,KAAK,EAAE,KAAM,KAAI,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC;AACrD,MAAI,MAAM,UAAU,IAAI,MAAM,MAAM,GAAG,OAAO,EAAE,EAAG;AACnD,MAAI,EAAE,KAAK;AAAE,UAAM,MAAM,IAAI,MAAM,MAAM,GAAG,OAAO,EAAE;AAAG;AAAA,EAAO;AAC/D,MAAI,CAAC,IAAI,GAAG,aAAa;AACvB,UAAM,IAAI,UAAU,yBAAyB,sCAAsC,GAAG,OAAO,IAAI,QAAQ;AAAA,MACvG,MAAM;AAAA,MAA0C,SAAS,EAAE,QAAQ,aAAa,YAAY,KAAK;AAAA,IACnG,CAAC;AAAA,EACH;AACA,MAAI,GAAG,OAAO,SAAS,UAAU;AAG/B,UAAM,MAAM,QAAQ,GAAG,OAAO,GAAG;AACjC,QAAI,GAAG,IAAI,iBAAiB,GAAG,OAAO,MAAM,KAAK,OAAO,yBAAyB,EAAE;AAAA,EACrF;AACA,MAAI,CAAE,MAAM,IAAI,GAAG,QAAQ,0DAA0D,EAAI,OAAM,IAAI,eAAe;AAClH,QAAM,MAAM,IAAI,MAAM,MAAM,GAAG,OAAO,EAAE;AAC1C;;;AnBfA,IAAM,UAAU,CAAC,MAA2B,MAAM,SAAY,YAAY,6BAAS,EAAE,MAAM;AAE3F,eAAe,WAAW,GAAmC;AAC3D,MAAI;AAAE,WAAO,MAAMC,UAAS,GAAG,MAAM;AAAA,EAAE,SAAS,GAAG;AACjD,QAAK,EAA4B,SAAS,SAAU,QAAO;AAC3D,UAAM;AAAA,EACR;AACF;AAgBA,eAAe,cAAc,QAAgB,MAA6B;AACxE,QAAM,OAAOC,UAAS,MAAM;AAC5B,QAAM,UAAU,KAAK,SAAS,QAAQ,IAClC,GAAG,KAAK,MAAM,GAAG,CAAC,SAAS,MAAM,CAAC,SAASC,aAAY,CAAC,EAAE,SAAS,KAAK,CAAC,WACzE,GAAG,IAAI,SAASA,aAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAClD,QAAM,MAAMC,MAAKC,SAAQ,MAAM,GAAG,OAAO;AACzC,MAAI;AACF,UAAMC,WAAU,KAAK,MAAM,EAAE,MAAM,KAAO,MAAM,KAAK,CAAC;AACtD,UAAMC,OAAM,KAAK,GAAK;AACtB,UAAMC,QAAO,KAAK,MAAM;AAAA,EAC1B,UAAE;AACA,UAAM,OAAO,GAAG,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC;AACF;AAIO,SAAS,YAAY,SAAkB,KAA2B;AACvE,QAAM,MAAM,QAAQ,QAAQ,KAAK,EAAE,YAAY,mBAAmB;AAClE,MAAI,QAAQ,MAAM,EAAE,YAAY,qDAAqD,EAClF,OAAO,sBAAsB,yDAAyD,EACtF,OAAO,mBAAmB,6CAA6C,EACvE,OAAO,mBAAmB,2CAA2C,EACrE,OAAO,gBAAgB,sDAAsD,EAC7E,OAAO,SAAS,sCAAsC,EACtD,OAAO,OAAO,MAAa;AAC1B,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,KAAK,MAAM,iBAAiB,KAAK,GAAG,UAAU;AACpD,QAAI,CAAC,GAAG,UAAU;AAChB,YAAM,IAAI,UAAU,yBAAyB,4CAA4C,EAAE,MAAM,mCAAmC,CAAC;AAAA,IACvI;AACA,UAAM,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE,GAAG;AACvC,UAAM,MAAM,MAAM,eAAe,GAAG,QAAQ;AAC5C,UAAM,WAAW,eAAe,GAAG,OAAO,IAAI;AAK9C,UAAM,SAAS,EAAE,SACb,MAAM,cAAc,GAAG,UAAU,EAAE,QAAQD,MAAK,GAAG,IACnD,MAAM,cAAc,GAAG,UAAU,IAAI,WAAW,SAAS,OAAO;AACpE,UAAM,cAAc,KAAK,IAAI,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;AAChD,UAAM,WAAW,MAAM,WAAW,MAAM;AACxC,UAAM,UAAU,aAAa,OAAO,MAAM,WAAWL,MAAKC,SAAQ,MAAM,GAAG,cAAc,CAAC,IAAI;AAC9F,UAAM,QAAQ,MAAM,cAAcI,OAAM,IAAI,GAAG;AAC/C,UAAM,SAAS;AAAA,MACb;AAAA,MAAU;AAAA,MAAS,SAAS,MAAM;AAAA,MAAK,SAAS,MAAM;AAAA,MACtD,cAAc,IAAI,gBAAgB,SAAS;AAAA,MAC3C,eAAe,EAAE,YAAY,eAAwB;AAAA,MACrD,QAAQ,MAAMN,aAAY,EAAE,EAAE,SAAS,KAAK;AAAA,IAC9C;AACA,QAAI,OAAO,SAAS,MAAM;AAC1B,QAAI,KAAK,UAAU,UAAUO,IAAG,eAAe,CAAC,EAAE,WAAW;AAC3D,YAAM,UAAU,SAAS,YAAY,WAAW,EAAE;AAClD,YAAM,UAAiD,CAAC;AACxD,UAAI;AACJ,iBAAW,OAAO,KAAK,WAAW;AAChC,YAAI,MAAM;AAAE,kBAAQ,GAAG,IAAI;AAAM;AAAA,QAAS;AAC1C,cAAM,OAAO,MAAMA,IAAG;AAAA,UACpB,GAAG,GAAG,oBAAoB,QAAQ,QAAQ,IAAI,GAAG,CAAC,CAAC,YAAY,QAAQ,MAAM,IAAI,GAAG,CAAC,CAAC;AAAA,UACtF;AAAA,YAAC,EAAE,MAAM,cAAc,OAAO,OAAO;AAAA,YAAG,EAAE,MAAM,cAAc,OAAO,SAAS;AAAA,YAC7E,EAAE,MAAM,sBAAsB,OAAO,MAAM;AAAA,YAAG,EAAE,MAAM,sBAAsB,OAAO,OAAO;AAAA,UAAC;AAAA,QAAC;AAC/F,YAAI,SAAS,MAAO,QAAO;AAC3B,YAAI,SAAS,OAAQ,QAAO;AAC5B,gBAAQ,GAAG,IAAI,SAAS,YAAY,SAAS,QAAQ,eAAe;AAAA,MACtE;AACA,aAAO,SAAS,EAAE,GAAG,QAAQ,QAAQ,CAAC;AAAA,IACxC;AAGA,QAAI,aAAa,QAAQ,KAAK,SAAS,UAAU;AAC/C,YAAMH,OAAM,QAAQ,GAAK;AAAA,IAC3B,OAAO;AACL,YAAM,cAAc,QAAQ,KAAK,IAAI;AAAA,IACvC;AAGA,UAAM,MAAMI,UAAS,MAAMC,UAAS,GAAG,QAAQ,GAAG,MAAM;AACxD,QAAI,EAAE,MAAM;AACV,YAAM,QAAgC;AAAA,QACpC,SAAS,KAAK;AAAA,QAAS,mBAAmB,KAAK;AAAA,QAAmB,OAAO,KAAK;AAAA,QAC9E,SAAS,KAAK;AAAA,QAAS,MAAM,KAAK;AAAA,QAAM,UAAU,KAAK;AAAA,QAAU,WAAW,KAAK;AAAA,QAAW,WAAW,KAAK;AAAA,MAC9G;AACA,iBAAWF,KAAI,EAAE,SAAS,YAAY,IAAI,GAAG,GAAG,QAAQ,KAAK,GAAG,MAAM,CAAC;AACvE;AAAA,IACF;AACA,QAAI,KAAK,KAAK,UAAU,CAACA,IAAG,aAAa;AACvC,MAAAA,IAAG,IAAI,KAAK,KAAK,KAAK,MAAM,yCAAyC,KAAK,KAAK,KAAK,IAAI,CAAC,gDAA2C;AAAA,IACtI;AACA,UAAM,QAAQ;AAAA,MACZ,KAAK,MAAM,UAAU,GAAG,KAAK,MAAM,MAAM;AAAA,MACzC,KAAK,QAAQ,UAAU,GAAG,KAAK,QAAQ,MAAM;AAAA,MAC7C,KAAK,SAAS,UAAU,GAAG,KAAK,SAAS,MAAM;AAAA,MAC/C,KAAK,KAAK,UAAU,GAAG,KAAK,KAAK,MAAM;AAAA,MACvC,KAAK,UAAU,UAAU,GAAG,KAAK,UAAU,MAAM;AAAA,IACnD,EAAE,OAAO,OAAO;AAChB,IAAAA,IAAG,IAAI,UAAK,GAAG,GAAG,KAAK,oBAAoB,iCAAiC,EAAE,WAAM,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,YAAY,EAAE;AAAA,EACtI,CAAC;AACL;;;AoB3IA,YAAY,QAAQ;AAeb,IAAM,cAAc;AAE3B,SAAS,UAAU,aAAsD;AACvE,QAAM,OAAO,YAAY,MAAM,GAAG,EAAE,CAAC,KAAK;AAC1C,QAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,EAAE,SAAS,MAAM,CAAC;AACzE,SAAO,EAAE,KAAK,OAAO,KAAK,OAAO,OAAO,MAAM;AAChD;AAEA,SAAS,WAAW,GAA6B,YAA+B;AAC9E,QAAM,KAAK,EAAE,iBAAiB;AAC9B,MAAI,CAAC,GAAI,OAAM,IAAI,UAAU,iBAAiB,oCAAoC;AAClF,SAAO;AAAA,IAAE,aAAa,EAAE;AAAA,IAAc,cAAc;AAAA,IAAI,WAAW,EAAE,cAAc;AAAA,IACjF,OAAO,EAAE,SAAS;AAAA,IAAI,GAAG,UAAU,EAAE,YAAY;AAAA,EAAE;AACvD;AAIA,SAAS,YAAY,GAAY,MAAyB;AACxD,QAAM,IAAI,aAAa,GAAG,IAAI;AAC9B,SAAO,IAAI,UAAU,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;AACzG;AAEO,SAAS,aAAa,GAAY,MAAqB;AAC5D,MAAI,aAAa,aAAa,aAAa,eAAgB,QAAO;AAGlE,MAAI,aAAa,CAAC,KAAM,GAA0B,SAAS,iBAAiB,aAAc,GAA2B,KAAK,GAAG;AAC3H,WAAO,IAAI,eAAe;AAAA,EAC5B;AACA,QAAM,MAAO,EAAyB;AACtC,MAAI,QAAQ,gBAAiB,QAAO,IAAI,UAAU,qBAAqB,qCAAqC;AAC5G,MAAI,QAAQ,gBAAiB,QAAO,IAAI,UAAU,sBAAsB,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACrI,MAAI,QAAQ,gBAAiB,QAAO,IAAI,UAAU,wBAAwB,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACjI,QAAM,SAAU,EAA0B;AAC1C,MAAI,UAAU,UAAU,IAAK,QAAO,IAAI,UAAU,yBAAyB,2BAA2B,EAAE,OAAO,EAAE,CAAC;AAClH,MAAI,aAAa,UAAW,QAAO,YAAY,GAAG,IAAI;AAGtD,QAAM,QAAS,GAA2B;AAC1C,MAAI,iBAAiB,UAAW,QAAO,YAAY,OAAO,IAAI;AAC9D,SAAO,IAAI,UAAU,yBAAyB,gBAAgB,EAAE,OAAO,EAAE,CAAC;AAC5E;AAEA,eAAsB,WAAW,MAAyE;AACxG,QAAM,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE;AAClC,QAAM,UAAU,IAAI,IAAI,KAAK,MAAM,EAAE,aAAa,UAAU,CAAI,wBAAqB,IAAI,CAAC;AAC1F,MAAI;AACJ,MAAI;AACF,aAAS,MAAS,aAAU,IAAI,IAAI,KAAK,MAAM,GAAG,KAAK,UAAU,QAAc,QAAK,GAAG;AAAA,MACrF;AAAA,MAAS,CAAI,cAAW,GAAG,KAAK;AAAA,IAClC,CAAC;AAAA,EACH,SAAS,GAAG;AAAE,UAAM,aAAa,GAAG,IAAI;AAAA,EAAE;AAE1C,SAAO;AAAA,IACL,MAAM,YAAY,OAAO;AACvB,UAAI;AACF,cAAM,IAAI,MAAS,+BAA4B,QAAQ,EAAE,MAAM,CAAC;AAChE,eAAO;AAAA,UAAE,UAAU,EAAE;AAAA,UAAW,iBAAiB,EAAE;AAAA,UACjD,yBAAyB,EAAE;AAAA,UAA2B,WAAW,EAAE;AAAA,UAAY,QAAQ;AAAA,QAAE;AAAA,MAC7F,SAAS,GAAG;AAAE,cAAM,aAAa,GAAG,IAAI;AAAA,MAAE;AAAA,IAC5C;AAAA,IACA,MAAM,WAAW,OAAO,QAAQ;AAC9B,UAAI;AACF,cAAM,IAAI,MAAS,gCAA6B,QAAQ,MAAM,QAA0C,QAAW,EAAE,OAAO,CAAC;AAC7H,eAAO,WAAW,CAAC;AAAA,MACrB,SAAS,GAAG;AAAE,cAAM,aAAa,GAAG,IAAI;AAAA,MAAE;AAAA,IAC5C;AAAA,IACA,MAAM,QAAQ,IAAI,OAAO;AACvB,UAAI;AACF,cAAM,IAAI,MAAS,qBAAkB,QAAQ,IAAI,QAAQ,EAAE,MAAM,IAAI,MAAS;AAC9E,eAAO,WAAW,GAAG,EAAE;AAAA,MACzB,SAAS,GAAG;AAAE,cAAM,aAAa,GAAG,IAAI;AAAA,MAAE;AAAA,IAC5C;AAAA,IACA,MAAM,OAAO,IAAI;AACf,UAAI;AAAE,cAAS,mBAAgB,QAAQ,IAAI,EAAE,iBAAiB,gBAAgB,CAAC;AAAA,MAAE,SAC1E,GAAG;AAAE,cAAM,aAAa,GAAG,IAAI;AAAA,MAAE;AAAA,IAC1C;AAAA,EACF;AACF;;;ACxFA,eAAsB,YAAY,MAUZ;AAGpB,QAAM,KAAK,MAAM,WAAW;AAC5B,QAAM,QAAQ,MAAM,KAAK,KAAK,YAAY,WAAW;AACrD,QAAM,WAAW,IAAI,gBAAgB;AACrC,QAAM,UAAU,IAAI,gBAAgB;AACpC,QAAM,OAAO,KAAK,KAAK,WAAW,OAAO,YAAY,IAAI,CAAC,KAAK,QAAQ,SAAS,MAAM,CAAC,CAAC,EACrF,QAAQ,MAAM,QAAQ,MAAM,CAAC;AAEhC,OAAK,MAAM,MAAM;AAAA,EAAC,CAAC;AACnB,MAAI;AACF,UAAM,KAAK,OAAO,OAAO,QAAQ,MAAM;AAAA,EACzC,SAAS,GAAG;AACV,aAAS,MAAM;AAEf,UAAM,OAAO,MAAM,KAAK,MAAM,MAAM,IAAI;AACxC,QAAI,KAAM,OAAM,KAAK,KAAK,OAAO,KAAK,YAAY,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAClE,UAAM;AAAA,EACR;AACA,QAAM,IAAI,MAAM;AAChB,QAAM,KAAK,KAAK,IAAI;AACpB,QAAM,QAAQ,YAAY;AAExB,UAAM,KAAK,MAAM,WAAW,EAAE,IAAI,EAAE,cAAc,KAAK,EAAE,KAAK,OAAO,EAAE,OAAO,YAAY,GAAG,YAAY,EAAE,CAAC;AAC5G,UAAM,KAAK,MAAM,UAAU,EAAE,IAAI,EAAE,aAAa,WAAW,IAAI,KAAK,GAAG,QAAQ,IAAI,EAAE,YAAY,GAAI,EAAE,YAAY,EAAE,CAAC;AAAA,EACxH;AACA,MAAI;AACF,QAAI,KAAK,YAAY,KAAK,SAAU,OAAM,KAAK,SAAS,KAAK,UAAU,KAAK;AAAA,QACvE,OAAM,MAAM;AAAA,EACnB,SAAS,GAAG;AAGV,UAAM,KAAK,KAAK,OAAO,EAAE,YAAY,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACrD,UAAM,KAAK,MAAM,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACvC,UAAM;AAAA,EACR;AACA,SAAO;AACT;;;AC3CO,SAAS,cAAc,SAAkB,KAA2B;AACzE,UAAQ,QAAQ,OAAO,EAAE,YAAY,+BAA+B,EACjE,OAAO,gBAAgB,oBAAoB,EAC3C,OAAO,OAAO,QAA8B;AAC3C,UAAM,EAAE,MAAAG,OAAM,IAAAC,KAAI,OAAO,IAAI;AAC7B,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,UAAM,OAAgB,MAAM,UAAUA,MAAK,OAAO,OAAO,SAAS;AAClE,UAAM,QAAQ,IAAI,SAAS,OAAO,SAAS,GAAG;AAC9C,UAAM,SAAS,EAAE,GAAG,QAAQ,cAAc,OAAO,gBAAgB,SAAS,KAAK;AAC/E,QAAI,CAAC,OAAO,gBAAgB,OAAO,YAAY,MAAM;AACnD,MAAAC,IAAG,IAAI,mBAAmB,OAAO,SAAS,uBAAuB,KAAK,KAAK,MAAM,EAAE;AAAA,IACrF;AACA,cAAU,MAAM,QAAQD,MAAK,OAAO;AACpC,UAAM,SAAS,OAAO,gBAAgB,KAAK,KAAK;AAChD,UAAM,OAAO,YAAY,OAAO,WAAW,MAAM;AACjD,UAAM,QAAQ,IAAI,WAAWA,MAAK,UAAU,IAAI;AAChD,UAAM,IAAI,MAAM,YAAY;AAAA,MAC1B,MAAM,MAAMA,MAAK,QAAQ,MAAM;AAAA,MAAG;AAAA,MAAO,KAAKA,MAAK;AAAA,MAAK;AAAA,MACxD,UAAUA,MAAK;AAAA,MAAU,UAAU;AAAA,MACnC,QAAQ,OAAO,GAAG,YAAY;AAC5B,cAAM,MAAM,EAAE,2BAA2B,EAAE;AAC3C,QAAAC,IAAG,IAAI,oCAAoC,EAAE,QAAQ,EAAE;AACvD,YAAIA,IAAG,eAAe,IAAI,SAAS;AACjC,cAAI;AACF,kBAAMA,IAAG,aAAa,yBAAyB,GAAG,0BAA0B,YAAY,IAAI,CAAC,QAAQ,OAAO,CAAC,CAAC;AAAA,UAChH,SAAS,GAAG;AAEV,gBAAI,QAAQ,WAAW,CAAC,OAAO,QAAS;AACxC,kBAAM;AAAA,UACR;AACA,cAAI,QAAQ,QAAS;AACrB,cAAI,CAAE,MAAMA,IAAG,QAAQ,GAAG,EAAI,CAAAA,IAAG,IAAI,UAAU,GAAG,eAAe;AAAA,QACnE,OAAO;AACL,UAAAA,IAAG,IAAI,UAAU,GAAG,eAAe;AAAA,QACrC;AAAA,MACF;AAAA,IACF,CAAC;AACD,UAAMD,MAAK,OAAO,OAAO,CAAC,MAAM;AAC9B,QAAE,SAAS,OAAO,SAAS,IAAI;AAAA,QAAE,GAAG,EAAE,SAAS,OAAO,SAAS;AAAA,QAAG,WAAW,OAAO;AAAA,QAAW;AAAA,QAC7F,KAAK,EAAE;AAAA,QAAK,OAAO,EAAE;AAAA,QAAO,MAAM,EAAE,WAAWA,MAAK,IAAI,EAAE,YAAY,GAAG,KAAK,KAAK;AAAA,MAAE;AACvF,UAAI,EAAE,UAAU,CAAC,EAAE,eAAgB,GAAE,iBAAiB,OAAO;AAAA,IAC/D,CAAC;AACD,UAAM,EAAE,IAAI,IAAI,MAAM,YAAYA,OAAM,EAAE,GAAG,QAAQ,cAAc,OAAO,GAAG,SAAS,WAAW,GAAG,CAAC;AACrG,UAAM,KAAK,MAAM,IAAI,IAAW,gBAAgB;AAChD,UAAM,OAAO,IAAI,SAAS,OAAO,SAAS;AAC1C,QAAI,SACF,MAAM,QAAQ,EAAE,OAAO,KAAK,gBAAgB,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,aAAc,EAAE,IAC7F,KAAK,eACL;AACN,QAAI,QAAQ;AAAA,IAEZ,WAAW,GAAG,QAAQ,WAAW,GAAG;AAClC,MAAAC,IAAG,IAAI,iGAAiG;AAAA,IAC1G,WAAW,GAAG,QAAQ,WAAW,GAAG;AAClC,eAAS,EAAE,IAAI,GAAG,QAAQ,CAAC,EAAG,IAAI,MAAM,GAAG,QAAQ,CAAC,EAAG,KAAK;AAC5D,MAAAA,IAAG,IAAI,uBAAkB,GAAG,QAAQ,CAAC,EAAG,IAAI,EAAE;AAAA,IAChD,WAAWA,IAAG,aAAa;AACzB,eAAS,MAAMA,IAAG,OAAO,mBAAmB,GAAG,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;AAAA,IAC1I,OAAO;AACL,MAAAA,IAAG,IAAI,mBAAmB,GAAG,QAAQ,MAAM,sDAAsD;AAAA,IACnG;AACA,UAAMD,MAAK,OAAO,OAAO,CAAC,MAAM;AAAE,QAAE,SAAS,OAAO,SAAS,EAAG,eAAe;AAAA,IAAO,CAAC;AACvF,UAAME,SAAQ,OAAO,WAAW,OAAO;AACvC,QAAI,EAAE,KAAM,YAAWD,KAAI,EAAE,QAAQC,QAAO,OAAO,GAAG,OAAO,cAAc,UAAU,KAAK,CAAC;AAAA,QACtF,CAAAD,IAAG,IAAI,uBAAkB,GAAG,KAAK,KAAKC,MAAK,GAAG;AAAA,EACrD,CAAC;AACL;;;ACvEO,SAAS,eAAe,SAAkB,KAA2B;AAC1E,UAAQ,QAAQ,QAAQ,EAAE,YAAY,qBAAqB,EACxD,OAAO,SAAS,yBAAyB,EACzC,OAAO,OAAO,QAA2B;AACxC,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,UAAU,IAAI,MAAM,OAAO,OAAO,IAAI,QAAQ,IAChD,CAAC,IAAI,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,MAAS;AACvG,UAAM,OAAiB,CAAC;AACxB,eAAW,KAAK,SAAS;AACvB,YAAM,OAAO,YAAY,EAAE,WAAW,EAAE,MAAM;AAC9C,YAAM,QAAQ,IAAI,WAAWA,MAAK,UAAU,IAAI;AAChD,YAAM,OAAO,IAAI,IAAI,EAAE,MAAM,EAAE;AAG/B,YAAMA,MAAK,SAAS,MAAM,YAAY;AACpC,cAAM,KAAK,MAAM,MAAM,WAAW;AAClC,YAAI,IAAI;AACN,cAAI;AAAE,mBAAO,MAAMA,MAAK,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,EAAE;AAAA,UAAE,SAClD,GAAG;AACR,kBAAM,UAAU,aAAa,aAAa,EAAE,SAAS,WAAW;AAChE,YAAAC,IAAG,IAAI,UACH,qBAAqB,IAAI,uDACzB,qCAAqC,IAAI,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,qDAAqD;AAAA,UACnJ;AAAA,QACF;AACA,cAAM,MAAM,MAAM;AAAA,MACpB,CAAC;AACD,WAAK,KAAK,EAAE,SAAS;AAAA,IACvB;AACA,QAAI,EAAE,KAAM,YAAWA,KAAI,EAAE,WAAW,KAAK,CAAC;AAAA,aACrC,KAAK,WAAW,EAAG,CAAAA,IAAG,IAAI,eAAe;AAAA,QAC7C,CAAAA,IAAG,IAAI,wBAAmB,KAAK,IAAI,CAAC,MAAM,cAAc,GAAG,MAAS,EAAE,WAAW,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EACvG,CAAC;AACL;;;AC1CA,SAAS,iBAAiB;AAanB,IAAM,eAAe,EAAE,SAAS,MAAM;AAEtC,SAAS,YAAY,SAAkB,KAA2B;AACvE,UACG,QAAQ,KAAK,EACb,YAAY,mEAAmE,EAC/E,OAAO,sBAAsB,yDAAyD,EACtF,OAAO,mBAAmB,6CAA6C,EACvE,OAAO,SAAS,sCAAsC,EACtD,SAAS,aAAa,+BAA+B,EACrD,SAAS,aAAa,gCAAgC,EACtD,OAAO,OAAO,KAAa,MAAgB,MAAwD;AAClG,UAAM,EAAE,MAAAC,MAAK,IAAI;AACjB,QAAI,IAAI,KAAK,EAAE,MAAM;AACnB,YAAM,IAAI,UAAU,wBAAwB,4BAA4B;AAAA,QACtE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,UAAM,KAAK,MAAM,iBAAiB,KAAK,GAAG,KAAK;AAC/C,UAAM,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE,GAAG;AAEvC,UAAM,cAAc,KAAK,IAAI,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;AAChD,UAAM,QAAQ,MAAM,cAAcA,OAAM,IAAI,GAAG;AAC/C,iBAAa,UAAU;AACvB,QAAI;AACJ,QAAI;AACF,aAAO,MAAMA,MAAK,MAAM,IAAI,KAAK,MAAM,EAAE,GAAGA,MAAK,KAAK,GAAG,MAAM,IAAI,CAAC;AAAA,IACtE,UAAE;AACA,mBAAa,UAAU;AAAA,IACzB;AACA,QAAI,KAAK,QAAQ;AACf,MAAAA,MAAK,MAAM,KAAK,MAAM;AACtB,UAAI,YAAY,OAAO,UAAU,QAAQ,KAAK,MAAM,KAAK,EAAE;AAC3D;AAAA,IACF;AACA,QAAI,YAAY,KAAK,QAAQ,CAAC;AAAA,EAChC,CAAC;AACL;;;AChDO,SAAS,IAAI,KAAoB,KAAmB;AACzD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,IAAI,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,QAAQ,IAAI,IAAI,KAAK,GAAG,EAAE,QAAQ,KAAK,GAAI,CAAC;AAClF,MAAI,IAAI,GAAI,QAAO;AACnB,MAAI,IAAI,KAAM,QAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC1C,MAAI,IAAI,MAAO,QAAO,GAAG,KAAK,MAAM,IAAI,IAAI,CAAC;AAC7C,SAAO,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC;AACjC;AAEA,IAAM,MAAM,CAAC,MAAc,OAAO,QAAQ,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;AAEvD,SAAS,OAAO,GAA6B;AAClD,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,EAAE,SAAS,EAAE,SAAS,OAAO,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE;AACtE,SAAO,EAAE,cAAc,OAAO,OAAO,GAAG,IAAI,KAAK,IAAI,EAAE,SAAS,CAAC;AACnE;AAEO,SAAS,MAAM,MAA4B;AAChD,QAAM,SAAS,KAAK,CAAC,EAAG,IAAI,CAAC,GAAG,MAAM,KAAK,IAAI,GAAG,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;AACvF,SAAO,KAAK,IAAI,CAAC,MAAM,OAAO,EAAE,IAAI,CAAC,GAAG,MAAO,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,OAAO,CAAC,CAAE,CAAE,EAAE,KAAK,IAAI,CAAC;AAC3G;;;ACdO,SAAS,eAAe,SAAkB,KAA2B;AAC1E,UAAQ,QAAQ,QAAQ,EAAE,YAAY,uDAAuD,EAC1F,OAAO,sBAAsB,yDAAyD,EACtF,OAAO,mBAAmB,6CAA6C,EACvE,OAAO,OAAO,UAA6C;AAC1D,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,KAAK,MAAM,iBAAiB,KAAK,OAAO,QAAQ;AACtD,UAAM,iBAAiBD,OAAM,GAAG,OAAO,WAAW,eAAe;AACjE,UAAM,MAAM,MAAM,OAAO,KAAK,IAAI,MAAM,GAAG;AAC3C,QAAI,CAAC,EAAE,KAAM,CAAAC,IAAG,IAAI,YAAY,IAAI,GAAG,CAAC;AACxC,UAAM,KAAK,MAAM,GAAG,QAAQ,IAAI;AAAA,MAC9B,uBAAuB,mBAAmB,GAAG,OAAO,EAAE,CAAC,kBAAkB,mBAAmB,IAAI,EAAE,CAAC;AAAA,IAAE;AACvG,QAAI,EAAE,MAAM;AAAE,iBAAWA,KAAI,EAAE,SAAS,YAAY,IAAI,GAAG,GAAG,cAAc,GAAG,aAAa,CAAC;AAAG;AAAA,IAAO;AACvG,QAAI,GAAG,aAAa,WAAW,GAAG;AAAE,MAAAA,IAAG,IAAI,sBAAsB;AAAG;AAAA,IAAO;AAC3E,UAAM,MAAMD,MAAK,IAAI;AACrB,UAAM,OAAO;AAAA,MAAC,CAAC,OAAO,UAAU,UAAU,YAAY,YAAY;AAAA,MAChE,GAAG,GAAG,aAAa,IAAI,CAAC,MAAM;AAAA,QAAC,EAAE;AAAA,QAAM,EAAE,SAAS,WAAW,EAAE;AAAA,QAAQ,EAAE,QAAQ,OAAO;AAAA,QACtF,IAAI,EAAE,QAAQ,cAAc,MAAM,GAAG;AAAA,QAAG,OAAO,EAAE,MAAM;AAAA,MAAC,CAAC;AAAA,IAAC;AAC9D,eAAW,QAAQ,MAAM,IAAI,EAAG,CAAAC,IAAG,IAAI,IAAI;AAAA,EAC7C,CAAC;AACL;;;ACrBO,SAAS,eAAe,SAAkB,KAA2B;AAC1E,QAAM,SAAS,QAAQ,QAAQ,QAAQ,EAAE,YAAY,0BAA0B;AAE/E,SAAO,QAAQ,MAAM,EAAE,YAAY,iCAAiC,EACjE,OAAO,YAAY;AAClB,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,UAAM,EAAE,SAAS,IAAI,IAAI,MAAM,YAAYA,OAAM,QAAQ,eAAe,WAAW,GAAG,CAAC;AACvF,UAAM,KAAK,MAAM,IAAI,IAAW,gBAAgB;AAChD,UAAM,WAAW,QAAQ,cAAc;AACvC,QAAI,EAAE,MAAM;AACV,iBAAWC,KAAI,EAAE,SAAS,GAAG,QAAQ,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,OAAO,SAAS,EAAE,EAAE,CAAC;AACxF;AAAA,IACF;AACA,eAAW,KAAK,GAAG,SAAS;AAC1B,YAAM,OAAO,EAAE,OAAO,WAAW,MAAM;AACvC,MAAAA,IAAG,IAAI,GAAG,IAAI,IAAI,EAAE,IAAI,KAAK,EAAE,IAAI,EAAE;AAAA,IACvC;AAAA,EACF,CAAC;AAEH,SAAO,QAAQ,KAAK,EAAE,YAAY,uBAAuB,EAAE,SAAS,UAAU,aAAa,EACxF,OAAO,OAAO,SAA6B;AAC1C,UAAM,EAAE,MAAAD,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,UAAM,EAAE,IAAI,IAAI,MAAM,YAAYA,OAAM,QAAQ,cAAc,WAAW,GAAG,CAAC;AAC7E,UAAM,KAAK,MAAM,IAAI,IAAW,gBAAgB;AAChD,UAAM,aAA0B,GAAG,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,UAAU,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,EAAE;AAChH,QAAI;AACJ,QAAI,MAAM;AACR,YAAM,QAAQ,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AACpD,UAAI,CAAC,MAAO,OAAM,IAAI,UAAU,2BAA2B,cAAc,IAAI,sBAAsB,EAAE,WAAW,CAAC;AACjH,eAAS,EAAE,IAAI,MAAM,IAAI,MAAM,MAAM,KAAK;AAAA,IAC5C,WAAWC,IAAG,aAAa;AACzB,eAAS,MAAMA,IAAG,OAAO,mBAAmB,GAAG,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;AAAA,IAC1I,OAAO;AACL,YAAM,IAAI,UAAU,yBAAyB,mDAAmD,EAAE,WAAW,CAAC;AAAA,IAChH;AACA,UAAMD,MAAK,OAAO,OAAO,CAAC,MAAM;AAAE,QAAE,SAAS,OAAO,SAAS,EAAG,eAAe;AAAA,IAAO,CAAC;AACvF,QAAI,EAAE,KAAM,YAAWC,KAAI,EAAE,cAAc,OAAO,CAAC;AAAA,QAC9C,CAAAA,IAAG,IAAI,uBAAkB,OAAO,IAAI,EAAE;AAAA,EAC7C,CAAC;AACL;;;AC9CO,SAAS,gBAAgB,SAAkB,KAA2B;AAC3E,UAAQ,QAAQ,SAAS,EAAE,YAAY,iCAAiC,EACrE,OAAO,YAAY;AAClB,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,QAAI,aAAwH;AAC5H,QAAI;AACF,YAAM,OAAO,MAAM,UAAUA,MAAK,OAAO,OAAO,SAAS;AACzD,mBAAa,EAAE,aAAa,KAAK,aAAa,eAAe,KAAK,eAAe,kBAAkB,KAAK,kBAAkB,cAAc,KAAK,aAAa;AAAA,IAC5J,SAAS,GAAG;AAEV,UAAI,aAAa,eAAgB,OAAM;AAAA,IAEzC;AACA,QAAI,EAAE,MAAM;AACV,iBAAWC,KAAI,EAAE,KAAKD,MAAK,SAAS,QAAQ,WAAW,CAAC;AACxD;AAAA,IACF;AACA,IAAAC,IAAG,IAAI,QAAQD,MAAK,OAAO,EAAE;AAC7B,UAAME,SAAQ,OAAO,WAAW,OAAO;AACvC,QAAI,YAAY;AACd,MAAAD,IAAG,IAAI,UAAUC,MAAK,SAAS,WAAW,YAAY,KAAK,GAAG,CAAC,SAAS,WAAW,aAAa,YAAY,WAAW,gBAAgB,EAAE;AAAA,IAC3I,OAAO;AACL,MAAAD,IAAG,IAAI,UAAUC,MAAK,eAAe;AAAA,IACvC;AAAA,EACF,CAAC;AACL;;;AC5BO,SAAS,eAAe,SAAkB,KAA2B;AAC1E,UAAQ,QAAQ,QAAQ,EAAE,YAAY,8BAA8B,EACjE,OAAO,YAAY;AAClB,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,UAAM,EAAE,SAAS,IAAI,IAAI,MAAM,YAAYA,OAAM,QAAQ,UAAU,WAAW,GAAG,CAAC;AAClF,UAAM,KAAK,MAAM,IAAI,IAAW,gBAAgB;AAChD,UAAM,eAAe,QAAQ;AAC7B,QAAI,gBAAgB,CAAC,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,aAAa,EAAE,GAAG;AACrE,MAAAC,IAAG,IAAI,4CAA4C,aAAa,IAAI,EAAE;AAAA,IACxE;AACA,UAAMC,SAAQ,OAAO,WAAW,OAAO;AACvC,QAAI,EAAE,MAAM;AACV,iBAAWD,KAAI,EAAE,QAAQC,QAAO,cAAc,gBAAgB,MAAM,GAAG,CAAC;AACxE;AAAA,IACF;AACA,IAAAD,IAAG,IAAI,GAAG,GAAG,KAAK,KAAKC,MAAK,GAAG;AAC/B,eAAW,KAAK,GAAG,SAAS;AAC1B,YAAM,OAAO,cAAc,OAAO,EAAE,KAAK,MAAM;AAC/C,MAAAD,IAAG,IAAI,GAAG,IAAI,IAAI,EAAE,IAAI,KAAK,EAAE,IAAI,EAAE;AACrC,iBAAW,KAAK,EAAE,MAAM;AACtB,QAAAA,IAAG,IAAI,KAAK,EAAE,IAAI,KAAK,EAAE,MAAM,EAAE;AACjC,mBAAW,KAAK,EAAE,SAAS;AACzB,UAAAA,IAAG,IAAI,OAAO,EAAE,IAAI,KAAK,EAAE,IAAI,KAAK,EAAE,MAAM,EAAE;AAAA,QAChD;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACL;;;AC3BO,IAAM,WAAuB;AAAA,EAClC;AAAA,EAAe;AAAA,EAAgB;AAAA,EAAgB;AAAA,EAAgB;AAAA,EAAgB;AAAA,EAAa;AAAA,EAAa;AAC3G;;;ACRA,IAAM,eAAe;AACrB,IAAM,SAAS,KAAK,KAAK,KAAK;AAC9B,IAAM,qBAAqB;AAE3B,eAAsB,kBAAkBE,OAAYC,KAAQ,GAAsB,YAAY,oBAAmC;AAC/H,MAAI,EAAE,QAAQD,MAAK,IAAI,MAAMA,MAAK,IAAI,yBAAyB,OAAO,CAACC,IAAG,YAAa;AACvF,QAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,QAAM,OAAO,IAAI,aAAa;AAC9B,MAAI,QAAQA,MAAK,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,QAAQ,IAAI,OAAQ;AACtE,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAMA,MAAK,MAAM,cAAc,EAAE,QAAQ,WAAW,OAAO,CAAC;AACxE,QAAI,IAAI,GAAI,WAAW,MAAM,IAAI,KAAK,GAA4B;AAAA,EACpE,QAAQ;AAAA,EAAsD,UAC9D;AAAU,iBAAa,KAAK;AAAA,EAAE;AAC9B,MAAI;AAGF,UAAMA,MAAK,OAAO,OAAO,CAAC,MAAM;AAC9B,QAAE,cAAc,EAAE,eAAeA,MAAK,IAAI,EAAE,YAAY,GAAG,QAAQ,UAAU,EAAE,aAAa,UAAUA,MAAK,QAAQ;AAAA,IACrH,CAAC;AAAA,EACH,QAAQ;AAAE;AAAA,EAAO;AACjB,MAAI,UAAU,gBAAgB,QAAQA,MAAK,OAAO,IAAI,GAAG;AACvD,IAAAC,IAAG,IAAI,4BAA4BD,MAAK,OAAO,WAAM,MAAM,4BAA4B;AAAA,EACzF;AACF;;;AC/BA,SAAS,YAAAE,iBAAgB;AACzB,SAAS,QAAAC,aAAY;AAqBrB,IAAM,QAAQ,OAAmB,EAAE,eAAe,GAAG,UAAU,CAAC,EAAE;AAE3D,IAAM,cAAN,MAAkB;AAAA,EACvB,YAAqBC,MAAa;AAAb,eAAAA;AAAA,EAAc;AAAA,EAAd;AAAA,EAErB,IAAY,OAAO;AAAE,WAAOC,MAAK,KAAK,KAAK,aAAa;AAAA,EAAE;AAAA,EAE1D,MAAM,OAA4B;AAChC,QAAI;AACJ,QAAI;AACF,YAAM,MAAMC,UAAS,KAAK,MAAM,MAAM;AAAA,IACxC,SAAS,GAAG;AACV,UAAK,EAA4B,SAAS,SAAU,QAAO,MAAM;AACjE,YAAM;AAAA,IACR;AACA,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,OAAO,kBAAkB,KAAK,OAAO,OAAO,aAAa,SAAU,OAAM,IAAI,MAAM,OAAO;AAC9F,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,IAAI,UAAU,wBAAwB,6BAA6B,KAAK,IAAI,IAAI;AAAA,QACpF,MAAM;AAAA,QAAuD;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,IAA+D;AAC1E,UAAM,UAAU,MAAM,KAAK,KAAK;AAChC,UAAM,OAAO,GAAG,OAAO,KAAK;AAC5B,UAAM,gBAAgB,KAAK,KAAK,eAAe,IAAI;AACnD,WAAO;AAAA,EACT;AACF;;;ACtDA,SAAS,gBAAsC;AAC/C,SAAS,eAAe;AAMjB,SAAS,aAAa,QAA0B;AACrD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAgB,CAAC;AACvB,aAAW,QAAQ,OAAO,MAAM,OAAO,GAAG;AACxC,UAAM,IAAI,0BAA0B,KAAK,IAAI;AAC7C,QAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC,CAAE,EAAG;AAC3B,SAAK,IAAI,EAAE,CAAC,CAAE;AACd,QAAI,KAAK,EAAE,MAAM,EAAE,CAAC,GAAI,KAAK,EAAE,CAAC,EAAG,CAAC;AAAA,EACtC;AACA,SAAO;AACT;AAMO,SAAS,iBAAkC;AAChD,SAAO,EAAE,KAAK,QAAQ,GAAG,KAAK,EAAE,GAAG,QAAQ,KAAK,QAAQ,IAAI,GAAG,aAAa,KAAK;AACnF;AAKO,IAAM,YAAiB;AAAA,EAC5B,QAAQ,UAAU;AAChB,WAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC;AAAA,QAAS;AAAA,QAAO,CAAC,MAAM,UAAU,UAAU,IAAI;AAAA,QAAG,eAAe;AAAA,QAC/D,CAAC,KAAK,QAAQ,WAAW;AACvB,cAAI,KAAK;AACP,gBAAK,IAA8B,SAAS,UAAU;AACpD,qBAAO,IAAI,UAAU,wBAAwB,uCAAuC;AAAA,gBAClF,MAAM;AAAA,cAAuE,CAAC,CAAC;AACjF;AAAA,YACF;AACA,kBAAM,OAAO,OAAO,MAAM,EAAE,KAAK,EAAE,MAAM,OAAO,EAAE,IAAI,KAAK;AAC3D,mBAAO,IAAI,UAAU,iBAAiB,2BAA2B,QAAQ,IAAI;AAAA,cAC3E,MAAM,QAAQ;AAAA,cAAW,SAAS,EAAE,SAAS,iBAAiB,KAAK,SAAS;AAAA,cAAG,OAAO;AAAA,YAAI,CAAC,CAAC;AAC9F;AAAA,UACF;AACA,UAAAA,SAAQ,aAAa,OAAO,MAAM,CAAC,CAAC;AAAA,QACtC;AAAA,MAAC;AAAA,IACL,CAAC;AAAA,EACH;AACF;;;AClDA,SAAS,aAAa;AAStB,IAAM,UAAU;AAChB,IAAM,QAAkD;AAAA,EACtD,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,OAAO;AACT;AAEO,SAAS,sBAAsB,GAAY,UAAsC;AACtF,QAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAGrD,MAAI,0CAA0C,KAAK,GAAG,GAAG;AACvD,WAAO,IAAI,UAAU,6BAA6B,sDAAsD;AAAA,MACtG,MAAM,aAAa,UACf,+FACA;AAAA,MACJ,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,mDAAmD,KAAK,GAAG,GAAG;AAChE,WAAO,IAAI,UAAU,wBAAwB,wCAAwC;AAAA,MACnF,MAAM;AAAA,MAAiE,OAAO;AAAA,IAChF,CAAC;AAAA,EACH;AACA,SAAO,IAAI,UAAU,6BAA6B,yBAAyB;AAAA,IACzE,MAAM,MAAM,QAAQ,KAAK;AAAA,IAA+C,OAAO;AAAA,EACjF,CAAC;AACH;AAEO,IAAM,aAAN,MAAqC;AAAA,EAC1C,YAA6B,WAA4B,QAAQ,UAAU;AAA9C;AAAA,EAA+C;AAAA,EAA/C;AAAA,EAErB,KAAQ,IAAyB;AACvC,QAAI;AAAE,aAAO,QAAQ,QAAQ,GAAG,CAAC;AAAA,IAAE,SAAS,GAAG;AAAE,aAAO,QAAQ,OAAO,sBAAsB,GAAG,KAAK,QAAQ,CAAC;AAAA,IAAE;AAAA,EAClH;AAAA,EAEA,IAAI,SAAiB;AAAE,WAAO,KAAK,KAAK,MAAM,IAAI,MAAM,SAAS,OAAO,EAAE,YAAY,KAAK,IAAI;AAAA,EAAE;AAAA,EACjG,IAAI,SAAiB,OAAe;AAAE,WAAO,KAAK,KAAK,MAAM;AAAE,UAAI,MAAM,SAAS,OAAO,EAAE,YAAY,KAAK;AAAA,IAAE,CAAC;AAAA,EAAE;AAAA,EACjH,OAAO,SAAiB;AAEtB,WAAO,KAAK,KAAK,MAAM;AAAE,UAAI,MAAM,SAAS,OAAO,EAAE,eAAe;AAAA,IAAE,CAAC;AAAA,EACzE;AACF;;;ACnDA,SAAS,SAAAC,QAAO,aAAAC,kBAAiB;AACjC,SAAS,QAAAC,aAAY;AACrB,OAAO,cAAc;AAKd,SAAS,SAASC,MAAuB;AAC9C,SAAO,OAAO,MAAM,OAAO;AACzB,UAAM,QAAQC,MAAKD,MAAK,OAAO;AAC/B,UAAME,OAAM,OAAO,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACnD,UAAM,SAASD,MAAK,OAAO,GAAG,IAAI,OAAO;AACzC,UAAME,WAAU,QAAQ,IAAI,EAAE,MAAM,IAAI,CAAC;AACzC,QAAI;AAIJ,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,SAAS,KAAK,QAAQ;AAAA,QACpC,OAAO;AAAA,QACP,SAAS,EAAE,SAAS,IAAI,YAAY,KAAK,YAAY,KAAM,WAAW,KAAK;AAAA,QAC3E,eAAe,CAAC,QAAQ;AAAE,wBAAc;AAAA,QAAI;AAAA,MAC9C,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI,UAAU,kBAAkB,kDAAkD,EAAE,MAAM,sBAAsB,MAAM,CAAC;AAAA,IAC/H;AACA,QAAI;AAAE,aAAO,MAAM,GAAG;AAAA,IAAE,UAAE;AAExB,YAAM,QAAQ,EAAE,MAAM,CAAC,MAAe;AAAE,YAAI,CAAC,YAAa,OAAM;AAAA,MAAE,CAAC;AAAA,IACrE;AAAA,EACF;AACF;;;AChCA,SAAS,OAAO,aAAa;AAEtB,SAAS,UAAU,KAAwB,UAA2B,MAAsB;AACjG,MAAI,aAAa,QAAS,QAAO,MAAM,KAAK,IAAI,WAAW,MAAM,KAAK,MAAM,WAAW,SAAS,GAAG,MAAM;AAGzG,MAAI,aAAa,SAAU,QAAO,MAAM,KAAK,MAAM,WAAW,uBAAuB,MAAM;AAE3F,QAAM,MAAM,IAAI,mBAAmB,MAAM,WAAW,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACjG,SAAO,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,SAAS,GAAG,MAAM;AAC9D;;;ACVA,OAAO,WAAW;AAUX,SAAS,WAAW,UAAoF;AAC7G,SAAO,aAAa,UAChB,EAAE,QAAQ,CAAC,UAAU,UAAU,GAAG,SAAS,CAAC,EAAE,IAC9C,EAAE,QAAQ,CAAC,UAAU,SAAS,GAAG,SAAS,CAAC,WAAW,QAAQ,EAAE;AACtE;AAEA,IAAM,EAAE,QAAQ,QAAQ,SAAS,QAAQ,IAAI,WAAW,QAAQ,QAAQ;AAejE,SAAS,YAAY,SAAkB,MAA+B;AAC3E,SAAO;AAAA,IACL,IAAI,KAAK,MAAM,KAAK;AAClB,aAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,YAAI;AACJ,YAAI;AACF,kBAAQ,QAAQ,KAAK,MAAM,EAAE,OAAO,WAAW,OAAO,OAAO,KAAK,aAAa,KAAK,CAAC;AAAA,QACvF,SAAS,GAAG;AAIV,iBAAO,IAAI,UAAU,iBAAiB,mBAAmB,GAAG,KAAM,EAA4B,QAAQ,OAAO,EAAE,CAAC;AAChH;AAAA,QACF;AACA,cAAM,SAAS,MAAM;AAAA,QAAC;AACtB,cAAM,aAAa,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM;AAAE,gBAAM,KAAK,GAAG;AAAA,QAAE,CAAC,CAAU;AACjF,mBAAW,OAAO,OAAQ,MAAK,GAAG,KAAK,MAAM;AAC7C,mBAAW,CAAC,KAAK,EAAE,KAAK,WAAY,MAAK,GAAG,KAAK,EAAE;AACnD,cAAM,UAAU,MAAM;AACpB,qBAAW,OAAO,OAAQ,MAAK,IAAI,KAAK,MAAM;AAC9C,qBAAW,CAAC,KAAK,EAAE,KAAK,WAAY,MAAK,IAAI,KAAK,EAAE;AAAA,QACtD;AACA,cAAM,KAAK,SAAS,CAAC,MAA6B;AAChD,kBAAQ;AACR,iBAAO,EAAE,SAAS,WACd,IAAI,UAAU,iBAAiB,sBAAsB,GAAG,IAAI,EAAE,MAAM,uDAAuD,CAAC,IAC5H,IAAI,UAAU,iBAAiB,mBAAmB,GAAG,KAAK,EAAE,QAAQ,OAAO,EAAE,CAAC;AAAA,QACpF,CAAC;AACD,cAAM,KAAK,QAAQ,CAAC,MAAM,WAAW;AAAE,kBAAQ;AAAG,UAAAA,SAAQ,EAAE,MAAM,OAAO,CAAC;AAAA,QAAE,CAAC;AAAA,MAC/E,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,eAAwB,YAAY,OAAO,OAAO;;;AC/DxD,IAAM,UAAkB,OAAuC,UAAmB;;;A7CgBzF,IAAI,QAAQ,IAAI,eAAe,QAAQ,IAAI,eAAe,QAAQ,IAAI,WAAY,qBAAoB,IAAI,kBAAkB,CAAC;AAE7H,IAAM,MAAM,UAAU,QAAQ,KAAK,QAAQ,UAAUC,SAAQ,CAAC;AAC9D,IAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AAGjC,IAAM,mBAAmB,oBAAoB,IAAI;AACjD,IAAM,OAAO,iBAAiB,SAAS,QAAQ;AAO/C,IAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAQ,GAAG,UAAU,MAAM;AACzB,MAAI,GAAG,OAAO,SAAS;AACrB,QAAI,aAAa,QAAS;AAC1B,YAAQ,KAAK,GAAG;AAAA,EAClB;AACA,KAAG,MAAM;AACX,CAAC;AACD,IAAM,QAAQ,eAAe,WAAW,OAAO,GAAG,MAAM;AACxD,IAAM,OAAa;AAAA,EACjB;AAAA,EACA,UAAU,IAAI,WAAW;AAAA,EACzB,QAAQ,IAAI,YAAY,GAAG;AAAA,EAC3B,UAAU,SAAS,GAAG;AAAA,EACtB,KAAK,MAAM,oBAAI,KAAK;AAAA,EACpB,SAAS,CAAC,WAAW,WAAW,EAAE,QAAQ,UAAU,YAAY,MAAM,CAAC;AAAA,EACvE,KAAK,QAAQ;AAAA,EACb,UAAU,QAAQ;AAAA,EAClB,SAAS;AAAA,EACT,KAAK,QAAQ,IAAI;AAAA,EACjB,KAAK;AAAA,EACL,OAAO;AAAA,EACP,OAAO,CAAC,WAAW;AAAE,YAAQ,mBAAmB,MAAM;AAAG,YAAQ,KAAK,QAAQ,KAAK,MAAM;AAAA,EAAE;AAC7F;AACA,IAAM,KAAK,UAAU,cAAc;AAAA,EAAE,UAAU,QAAQ,QAAQ,MAAM,KAAK;AAAA,EAAG,WAAW,QAAQ,QAAQ,OAAO,KAAK;AAAA,EAClH;AAAA,EAAM,SAAS,iBAAiB,SAAS,YAAY;AAAA,EAAG,KAAK,QAAQ;AAAI,CAAC,CAAC;AAC7E,QAAQ,WAAW,MAAM,IAAI,MAAM,MAAM,IAAI,GAAG,QAAQ,QAAQ;AAChE,IAAI,CAAC,GAAG,OAAO,SAAS;AACtB,MAAI;AACF,UAAM,kBAAkB,MAAM,IAAI,EAAE,KAAK,CAAC;AAAA,EAC5C,QAAQ;AAAA,EAER;AACF;","names":["homedir","resolve","fetch","detail","pc","io","json","argv","deps","io","json","pc","randomBytes","chmod","readFile","realpath","rename","writeFile","basename","dirname","join","relative","fetch","deps","deps","join","deps","join","readFile","join","dir","TTL_MS","dir","join","sep","join","dir","deps","id","m","remote","join","deps","dirname","resolve","resolve","dirname","realpath","deps","readFile","basename","randomBytes","join","dirname","writeFile","chmod","rename","deps","io","relative","realpath","deps","io","label","deps","io","deps","deps","io","deps","io","deps","io","label","deps","io","label","deps","io","readFile","join","dir","join","readFile","resolve","mkdir","writeFile","join","dir","join","mkdir","writeFile","resolve","homedir"]}
+{"version":3,"sources":["../src/cli.ts","../src/cli/io.ts","../src/platform/browser.ts","../src/core/errors.ts","../src/cli/program.ts","../src/core/api/http.ts","../src/cli/render.ts","../src/cli/commands/clone.ts","../src/core/api/meta.ts","../src/core/api/capabilities.ts","../src/core/profiles.ts","../src/core/api/client.ts","../src/core/auth/refresh.ts","../src/core/auth/tokenStore.ts","../src/core/session.ts","../src/core/workspace/apps.ts","../src/core/workspace/apply.ts","../src/core/context/cache.ts","../src/core/jsonFile.ts","../src/core/context/repoKey.ts","../src/core/trust.ts","../src/core/workspace/plan.ts","../src/core/workspace/diagnose.ts","../src/core/workspace/file.ts","../src/core/workspace/safety.ts","../src/cli/workspaceReport.ts","../src/cli/commands/env.ts","../src/core/context/repoConfig.ts","../src/core/context/resolver.ts","../src/core/context/repoRoot.ts","../src/core/env/fetch.ts","../src/core/env/merge.ts","../src/core/env/pull.ts","../src/cli/context.ts","../src/cli/trustPrompt.ts","../src/core/auth/oidc.ts","../src/core/auth/login.ts","../src/cli/commands/login.ts","../src/cli/commands/logout.ts","../src/cli/commands/run.ts","../src/cli/format.ts","../src/cli/commands/status.ts","../src/cli/commands/sync.ts","../src/cli/commands/tenant.ts","../src/cli/commands/version.ts","../src/cli/commands/whoami.ts","../src/cli/commands/index.ts","../src/cli/updateCheck.ts","../src/core/config.ts","../src/platform/git.ts","../src/platform/keychain.ts","../src/platform/lock.ts","../src/platform/paths.ts","../src/platform/spawn.ts","../src/version.ts"],"sourcesContent":["import { homedir } from \"node:os\"\nimport { EnvHttpProxyAgent, setGlobalDispatcher } from \"undici\"\nimport { isInteractive, processIo } from \"./cli/io.js\"\nimport { argvBeforeSeparator, run } from \"./cli/program.js\"\nimport { COMMANDS } from \"./cli/commands/index.js\"\nimport { childRunning } from \"./cli/commands/run.js\"\nimport { maybeNotifyUpdate } from \"./cli/updateCheck.js\"\nimport { abortableFetch } from \"./core/api/http.js\"\nimport { createOidc } from \"./core/auth/oidc.js\"\nimport { ConfigStore } from \"./core/config.js\"\nimport type { Deps } from \"./core/deps.js\"\nimport { systemGit } from \"./platform/git.js\"\nimport { OsKeychain } from \"./platform/keychain.js\"\nimport { fileLock } from \"./platform/lock.js\"\nimport { configDir } from \"./platform/paths.js\"\nimport { crossSpawner } from \"./platform/spawn.js\"\nimport { VERSION } from \"./version.js\"\n\nif (process.env.HTTPS_PROXY || process.env.https_proxy || process.env.HTTP_PROXY) setGlobalDispatcher(new EnvHttpProxyAgent())\n\nconst dir = configDir(process.env, process.platform, homedir())\nconst argv = process.argv.slice(2)\n// Ruling R12: a child's own --json/--no-input (after --, e.g. `qore run -- node --json`)\n// must never reach qore's own flag scanning.\nconst preSeparatorArgv = argvBeforeSeparator(argv)\nconst json = preSeparatorArgv.includes(\"--json\")\n// Ctrl+C: the first one aborts every in-flight request and prompt through `ac.signal`\n// (→ CancelledError → exit 130); a second one exits at once, whatever is still running —\n// except while `qore run`'s child is alive (ruling R3, spec §11.2): the terminal already\n// delivered this SIGINT to the whole foreground process group, so the child's own exit\n// (its code, or the signal `run` re-raises) is what decides qore's exit code, not a forced\n// exit(130) here.\nconst ac = new AbortController()\nprocess.on(\"SIGINT\", () => {\n  if (ac.signal.aborted) {\n    if (childRunning.current) return\n    process.exit(130)\n  }\n  ac.abort()\n})\nconst fetch = abortableFetch(globalThis.fetch, ac.signal)\nconst deps: Deps = {\n  fetch,\n  keychain: new OsKeychain(),\n  config: new ConfigStore(dir),\n  withLock: fileLock(dir),\n  now: () => new Date(),\n  oidcFor: (issuer) => createOidc({ issuer, clientId: \"qore-cli\", fetch }),\n  env: process.env,\n  platform: process.platform,\n  version: VERSION,\n  cwd: process.cwd(),\n  home: homedir(),\n  git: systemGit,\n  spawn: crossSpawner,\n  raise: (signal) => { process.removeAllListeners(signal); process.kill(process.pid, signal) },\n}\nconst io = processIo(isInteractive({ stdinTTY: Boolean(process.stdin.isTTY), stdoutTTY: Boolean(process.stdout.isTTY),\n  json, noInput: preSeparatorArgv.includes(\"--no-input\"), env: process.env }))\nprocess.exitCode = await run(argv, deps, io, ac.signal, COMMANDS)\nif (!ac.signal.aborted) {\n  try {\n    await maybeNotifyUpdate(deps, io, { json })\n  } catch {\n    // an update check must never change the exit code\n  }\n}\n","import { confirm, select } from \"@inquirer/prompts\"\nimport { createInterface } from \"node:readline\"\nimport { openBrowser } from \"../platform/browser.js\"\nimport { CancelledError } from \"../core/errors.js\"\n\nexport interface Io {\n  out(s: string): void\n  err(s: string): void\n  interactive: boolean\n  select<T>(msg: string, choices: { name: string; value: T; description?: string }[]): Promise<T>\n  confirm(message: string): Promise<boolean>\n  waitForEnter(msg: string, signal: AbortSignal): Promise<void>\n  openUrl(url: string): Promise<boolean>\n}\n\nexport function isInteractive(o: { stdinTTY: boolean; stdoutTTY: boolean; json: boolean; noInput: boolean; env: NodeJS.ProcessEnv }): boolean {\n  return o.stdinTTY && o.stdoutTTY && !o.json && !o.noInput && !o.env.CI\n}\n\nexport function processIo(interactive: boolean): Io {\n  return {\n    out: (s) => { process.stdout.write(s + \"\\n\") },\n    err: (s) => { process.stderr.write(s + \"\\n\") },\n    interactive,\n    async select(message, choices) {\n      try { return await select({ message, choices }) } catch (e) {\n        if ((e as Error).name === \"ExitPromptError\") throw new CancelledError()\n        throw e\n      }\n    },\n    async confirm(message) {\n      try { return await confirm({ message, default: false }) } catch (e) {\n        if ((e as Error).name === \"ExitPromptError\") throw new CancelledError()\n        throw e\n      }\n    },\n    waitForEnter: createWaitForEnter(process.stdin, process.stderr),\n    openUrl: openBrowser,\n  }\n}\n\n/** Builds a `waitForEnter` bound to the given streams, so tests can drive it without a\n * real TTY. Readline puts a TTY's stdin in raw mode, which turns Ctrl+C into the\n * interface's own 'SIGINT' event rather than a process-level SIGINT (R16) — that must be\n * turned into a CancelledError itself, since `process.once(\"SIGINT\", …)` in cli.ts never\n * fires for it. `terminal: true` makes readline parse Ctrl+C the same way on any stream. */\nexport function createWaitForEnter(\n  input: NodeJS.ReadableStream, output: NodeJS.WritableStream,\n): (message: string, signal: AbortSignal) => Promise<void> {\n  return (message, signal) => new Promise((resolve, reject) => {\n    const rl = createInterface({ input, output, terminal: true })\n    const onAbort = () => { rl.close(); reject(new CancelledError()) }\n    const done = () => { signal.removeEventListener(\"abort\", onAbort); rl.close(); resolve() }\n    signal.addEventListener(\"abort\", onAbort, { once: true })\n    rl.on(\"SIGINT\", () => { signal.removeEventListener(\"abort\", onAbort); rl.close(); reject(new CancelledError()) })\n    rl.question(message, done)\n  })\n}\n","import open from \"open\"\n\n/** Opens the URL; false when there is no display (SSH, container) or it fails. */\nexport async function openBrowser(url: string): Promise<boolean> {\n  if (process.platform === \"linux\" && !process.env.DISPLAY && !process.env.WAYLAND_DISPLAY) return false\n  try { await open(url); return true } catch { return false }\n}\n","export const EXIT = {\n  QORE_INTERNAL: 1,\n  QORE_KEYCHAIN_UNAVAILABLE: 1,\n  QORE_KEYCHAIN_DENIED: 1,\n  QORE_GIT_UNAVAILABLE: 1,\n  QORE_CONTEXT_REQUIRED: 2,\n  QORE_CONTEXT_INVALID: 2,\n  QORE_CONTEXT_UNSUPPORTED: 2,\n  QORE_APP_AMBIGUOUS: 2,\n  QORE_NOT_LOGGED_IN: 4,\n  QORE_SESSION_EXPIRED: 4,\n  QORE_LOGIN_EXPIRED: 4,\n  QORE_LOGIN_DENIED: 4,\n  QORE_CLOCK_SKEW: 4,\n  QORE_TENANT_ACCESS_LOST: 5,\n  QORE_RESOURCE_NOT_FOUND: 5,\n  QORE_ACCESS_DENIED: 5,\n  QORE_NO_DEVELOPER_ACCESS: 5,\n  QORE_GITHUB_NOT_LINKED: 5,\n  QORE_REPO_NO_ACCESS: 5,\n  QORE_REPO_ACCESS_PENDING: 5,\n  QORE_GIT_AUTH: 5,\n  QORE_WORKSPACE_CONFLICT: 2,\n  QORE_AUTH_UNAVAILABLE: 6,\n  QORE_AUTH_BUSY: 6,\n  QORE_API_UNREACHABLE: 6,\n  QORE_API_UNAVAILABLE: 6,\n  QORE_INCOMPATIBLE_SERVER: 7,\n  QORE_UNSUPPORTED_BY_SERVER: 7,\n  QORE_UPGRADE_REQUIRED: 7,\n  QORE_PORTAL_UNTRUSTED: 7,\n  QORE_RATE_LIMITED: 8,\n} as const\n\nexport type QoreErrorCode = keyof typeof EXIT\n\n/** One element of `error.candidates`, the same shape under every code (--json is a\n * semver contract): what the user can pick from to resolve the error. `tenant` (a\n * tenant slug) accompanies module candidates, whose slugs are unique only per tenant. */\nexport type Candidate = {\n  kind: \"module\" | \"tenant\" | \"app\"\n  id?: string\n  slug: string\n  name?: string\n  remote?: string\n  tenant?: string\n}\n\ntype Opts = {\n  hint?: string\n  status?: number\n  requestId?: string\n  candidates?: Candidate[]\n  serverCode?: string\n  details?: Record<string, unknown>\n  cause?: unknown\n}\n\nexport class QoreError extends Error {\n  readonly code: QoreErrorCode\n  readonly hint?: string\n  readonly status?: number\n  readonly requestId?: string\n  readonly candidates?: Candidate[]\n  readonly serverCode?: string\n  readonly details?: Record<string, unknown>\n\n  constructor(code: QoreErrorCode, message: string, opts: Opts = {}) {\n    super(message, opts.cause === undefined ? undefined : { cause: opts.cause })\n    this.name = \"QoreError\"\n    this.code = code\n    this.hint = opts.hint\n    this.status = opts.status\n    this.requestId = opts.requestId\n    this.candidates = opts.candidates\n    this.serverCode = opts.serverCode\n    this.details = opts.details\n  }\n}\n\nexport class CancelledError extends Error {\n  constructor() {\n    super(\"Cancelled\")\n    this.name = \"CancelledError\"\n  }\n}\n\nexport function exitCodeFor(err: unknown): number {\n  if (err instanceof CancelledError || (err instanceof Error && err.name === \"CancelledError\")) return 130\n  if (err instanceof QoreError) return EXIT[err.code]\n  return 1\n}\n\nexport function toJsonError(err: unknown): Record<string, unknown> {\n  if (!(err instanceof QoreError)) {\n    return { code: \"QORE_INTERNAL\", message: err instanceof Error ? err.message : String(err) }\n  }\n  const out: Record<string, unknown> = { code: err.code, message: err.message }\n  for (const k of [\"hint\", \"status\", \"requestId\", \"candidates\", \"serverCode\", \"details\"] as const) {\n    if (err[k] !== undefined) out[k] = err[k]\n  }\n  return out\n}\n","import { Command, CommanderError } from \"commander\"\nimport type { Deps } from \"../core/deps.js\"\nimport { isAbortError } from \"../core/api/http.js\"\nimport { CancelledError, exitCodeFor } from \"../core/errors.js\"\nimport type { Io } from \"./io.js\"\nimport pc from \"picocolors\"\nimport { renderError } from \"./render.js\"\n\n/** The portion of argv before the first bare `--`. Everything from `--` on belongs to\n * a child command (e.g. `qore run -- node --json --no-input`), so no qore-side argv\n * scan — here or in cli.ts — may look past it (ruling R12): a child's own `--json` must\n * not switch qore into JSON mode, and a child's own `--no-input` must not disable\n * prompting. */\nexport function argvBeforeSeparator(argv: string[]): string[] {\n  const i = argv.indexOf(\"--\")\n  return i === -1 ? argv : argv.slice(0, i)\n}\n\n/** Detects --json before commander has parsed anything, so a parse error (thrown before\n * global opts exist) can still be rendered as JSON, and commander's own stderr line\n * can be suppressed in that mode. See ruling R12. */\nfunction jsonFromArgv(argv: string[]): boolean {\n  return argvBeforeSeparator(argv).some((a) => a === \"--json\" || a.startsWith(\"--json=\"))\n}\n\nexport type GlobalOpts = { portal?: string; json?: boolean; input?: boolean; verbose?: boolean; color?: boolean }\n\nexport type CommandContext = { deps: Deps; io: Io; signal: AbortSignal; opts: () => GlobalOpts; setExitCode: (code: number) => void }\n\nexport type Register = (program: Command, ctx: CommandContext) => void\n\n/** `--verbose`: request lines (method, path, status, request id; never a token) on stderr. */\nexport function requestLog(ctx: CommandContext): ((line: string) => void) | undefined {\n  return ctx.opts().verbose ? (line) => ctx.io.err(line) : undefined\n}\n\nexport function buildProgram(deps: Deps, io: Io, signal: AbortSignal, register: Register[], setExitCode: (code: number) => void): Command {\n  const program = new Command(\"qore\")\n    .description(\"Qore developer CLI\")\n    .option(\"--portal <name|url>\", \"prod, staging, or a portal URL (default: the portal you last logged in to, else prod)\")\n    .option(\"--json\", \"print exactly one JSON document on stdout\")\n    .option(\"--no-input\", \"never prompt\")\n    .option(\"--verbose\", \"log request lines (never secrets)\")\n    .option(\"--no-color\", \"disable colours\")\n    .exitOverride()\n    .configureOutput({ writeOut: (s) => io.out(s.trimEnd()), writeErr: (s) => io.err(s.trimEnd()) })\n  const ctx: CommandContext = { deps, io, signal, opts: () => program.opts<GlobalOpts>(), setExitCode }\n  for (const r of register) r(program, ctx)\n  return program\n}\n\nexport async function run(argv: string[], deps: Deps, io: Io, signal: AbortSignal, register: Register[]): Promise<number> {\n  const json = jsonFromArgv(argv)\n  // Commander may throw before global opts exist (e.g. an unknown option), and by default\n  // writes its own message to stderr on the way there. In --json mode that would land\n  // alongside our single JSON document, so suppress it here and render the error ourselves.\n  const parseIo: Io = json ? { ...io, err: () => {} } : io\n  const state: { exitCode?: number } = {}\n  const program = buildProgram(deps, parseIo, signal, register, (code) => { state.exitCode = code })\n  try {\n    await program.parseAsync(argv, { from: \"user\" })\n    return state.exitCode ?? 0\n  } catch (caught) {\n    // Once Ctrl+C has fired, any AbortError that escaped a mapping is that cancel.\n    const e = signal.aborted && isAbortError(caught) ? new CancelledError() : caught\n    if (e instanceof CommanderError) {\n      if (e.exitCode === 0) return 0\n      if (json) io.out(JSON.stringify({ ok: false, error: { code: \"QORE_CONTEXT_INVALID\", message: e.message } }))\n      return 2\n    }\n    const opts = program.opts<GlobalOpts>()\n    renderError(io, e, Boolean(opts.json), pc.isColorSupported && opts.color !== false)\n    return exitCodeFor(e)\n  }\n}\n","import { CancelledError, QoreError, type QoreErrorCode } from \"../errors.js\"\n\nexport type Fetch = (input: string | URL, init?: RequestInit) => Promise<Response>\n\n/** Every request also carries `signal` (the process's Ctrl+C signal), next to any signal\n * of the caller's own, so a cancel aborts whatever is in flight (spec §4). */\nexport function abortableFetch(fetch: Fetch, signal: AbortSignal): Fetch {\n  return (input, init) => fetch(input, { ...init, signal: init?.signal ? AbortSignal.any([init.signal, signal]) : signal })\n}\n\nconst TLS = new Set([\"SELF_SIGNED_CERT_IN_CHAIN\", \"UNABLE_TO_GET_ISSUER_CERT_LOCALLY\",\n  \"DEPTH_ZERO_SELF_SIGNED_CERT\", \"UNABLE_TO_VERIFY_LEAF_SIGNATURE\", \"CERT_HAS_EXPIRED\"])\n\nfunction causeCode(e: unknown): string | undefined {\n  const c = (e as { cause?: { code?: unknown } })?.cause\n  const code = c?.code ?? (e as { code?: unknown })?.code\n  // DOMException carries a numeric legacy `code`; only errno-style strings are meaningful here.\n  return typeof code === \"string\" ? code : undefined\n}\n\nexport function isAbortError(e: unknown): boolean {\n  return (e as { name?: unknown } | null)?.name === \"AbortError\"\n}\n\n/** A failed fetch: a cancel (Ctrl+C aborted the request) or a network failure. */\nexport function fetchError(e: unknown, host: string): Error {\n  return isAbortError(e) ? new CancelledError() : networkError(e, host)\n}\n\nexport function networkError(e: unknown, host: string): QoreError {\n  const code = causeCode(e) ?? \"\"\n  let reason = \"connect\"\n  let hint = \"Check your network or VPN.\"\n  if (code === \"ENOTFOUND\" || code === \"EAI_AGAIN\") {\n    reason = \"dns\"; hint = `${host} could not be resolved. Check your network or VPN.`\n  } else if (TLS.has(code)) {\n    reason = \"tls\"\n    hint = \"A proxy is re-signing TLS. Point NODE_EXTRA_CA_CERTS at your organisation's CA certificate.\"\n  } else if (code.includes(\"TIMEOUT\") || code === \"ETIMEDOUT\") {\n    reason = \"timeout\"\n  } else if (!process.env.HTTPS_PROXY && !process.env.https_proxy) {\n    hint = \"Check your network. Behind a corporate proxy, set HTTPS_PROXY.\"\n  }\n  return new QoreError(\"QORE_API_UNREACHABLE\", `Could not reach ${host}`, { hint, details: { reason, host, errno: code || undefined }, cause: e })\n}\n\nconst BY_SERVER_CODE: Record<string, QoreErrorCode> = {\n  \"app.access.denied\": \"QORE_ACCESS_DENIED\",\n  \"auth.scope.insufficient\": \"QORE_ACCESS_DENIED\",\n  \"cli.upgrade_required\": \"QORE_UPGRADE_REQUIRED\",\n  \"rate_limited\": \"QORE_RATE_LIMITED\",\n  \"module.not_found\": \"QORE_RESOURCE_NOT_FOUND\",\n  \"tenant.not_found\": \"QORE_RESOURCE_NOT_FOUND\",\n  \"module.app_ambiguous\": \"QORE_APP_AMBIGUOUS\",\n}\n\nfunction byStatus(status: number): QoreErrorCode {\n  if (status === 403) return \"QORE_ACCESS_DENIED\"\n  if (status === 404) return \"QORE_RESOURCE_NOT_FOUND\"\n  if (status === 426) return \"QORE_UPGRADE_REQUIRED\"\n  if (status === 429) return \"QORE_RATE_LIMITED\"\n  if (status === 502 || status === 503 || status === 504) return \"QORE_API_UNAVAILABLE\"\n  return \"QORE_INTERNAL\"\n}\n\nexport async function problemToError(res: Response): Promise<QoreError> {\n  let body: { code?: string; title?: string; detail?: unknown } = {}\n  try { body = (await res.json()) as typeof body } catch { /* not JSON */ }\n  const serverCode = body.code\n  const code = (serverCode && BY_SERVER_CODE[serverCode]) || byStatus(res.status)\n  const requestId = res.headers.get(\"x-request-id\") ?? undefined\n  const details: Record<string, unknown> = {}\n  if (body.detail && typeof body.detail === \"object\") Object.assign(details, body.detail)\n  const detail = typeof body.detail === \"string\" && body.detail ? body.detail : undefined\n  if (detail) details.detail = detail\n  const retry = res.headers.get(\"retry-after\")\n  if (retry && /^\\d+$/.test(retry)) details.retryAfter = Number(retry)\n  const hint =\n    code === \"QORE_UPGRADE_REQUIRED\" ? \"Run: npm i -g @quatronic/qore\"\n    : code === \"QORE_RATE_LIMITED\" ? `Wait ${details.retryAfter ?? \"a moment\"} s and retry.`\n    : code === \"QORE_API_UNAVAILABLE\" ? \"Qore is temporarily unavailable; retry in a minute.\"\n    : code === \"QORE_APP_AMBIGUOUS\" ? \"Pass --app <slug>.\"\n    : undefined\n  const apps = (body.detail as { apps?: unknown } | undefined)?.apps\n  const candidates = code === \"QORE_APP_AMBIGUOUS\" && Array.isArray(apps)\n    ? (apps as { id?: string; slug: string; name?: string }[]).map((a) => ({ kind: \"app\" as const, id: a.id, slug: a.slug, name: a.name }))\n    : undefined\n  if (candidates) delete details.apps\n  // portal-api falls back to the title \"HTTP error\"; a server code is no message either.\n  // Then the string detail is the most useful message there is.\n  const genericTitle = !body.title || body.title === \"HTTP error\" || body.title === serverCode\n  const message = (genericTitle && detail) || body.title || `Request failed (${res.status})`\n  return new QoreError(code, message, {\n    status: res.status, requestId, serverCode, hint, candidates,\n    details: Object.keys(details).length ? details : undefined,\n  })\n}\n","import pc, { createColors } from \"picocolors\"\nimport { QoreError, toJsonError } from \"../core/errors.js\"\nimport type { Io } from \"./io.js\"\n\nexport function renderJson(io: Io, data: unknown): void {\n  io.out(JSON.stringify({ ok: true, data }))\n}\n\nexport function renderError(io: Io, err: unknown, json: boolean, colorEnabled = pc.isColorSupported): void {\n  if (json) { io.out(JSON.stringify({ ok: false, error: toJsonError(err) })); return }\n  if (err instanceof Error && err.name === \"CancelledError\") { io.err(\"Cancelled\"); return }\n  const c = createColors(colorEnabled)\n  const e = err instanceof QoreError ? err : new QoreError(\"QORE_INTERNAL\", err instanceof Error ? err.message : String(err))\n  io.err(c.red(`Error: ${e.message}`))\n  if (e.hint) io.err(e.hint)\n  io.err(c.dim(`Code: ${e.code}${e.requestId ? ` (request ${e.requestId})` : \"\"}`))\n}\n","import { join, relative, resolve } from \"node:path\"\nimport { Option, type Command } from \"commander\"\nimport { ensureCapability } from \"../../core/api/capabilities.js\"\nimport type { CliAppModule, CliAppModules } from \"../../core/api/types.js\"\nimport type { DirInfo } from \"../../platform/git.js\"\nimport { QoreError } from \"../../core/errors.js\"\nimport { resolvePortal } from \"../../core/profiles.js\"\nimport { openSession, type Session } from \"../../core/session.js\"\nimport { resolveAppRef } from \"../../core/workspace/apps.js\"\nimport { applyActions, type ModuleResult } from \"../../core/workspace/apply.js\"\nimport { readWorkspace, writeWorkspace } from \"../../core/workspace/file.js\"\nimport { planWorkspace } from \"../../core/workspace/plan.js\"\nimport { isSafeSlug, unsafeSlugError } from \"../../core/workspace/safety.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { reportWorkspaceRun } from \"../workspaceReport.js\"\n\n/** A `QoreError` thrown for one module/directory is that module's own failed result —\n * the caller keeps going with the rest (controller ruling: per-module isolation). */\nfunction asFailure(slug: string, e: unknown): ModuleResult {\n  // Mirrors apply.ts's toFailure: git missing from PATH aborts the run once rather than\n  // being reported once per module.\n  if (e instanceof QoreError && e.code !== \"QORE_GIT_UNAVAILABLE\") {\n    return { slug, status: \"failed\", error: { code: e.code, message: e.message, hint: e.hint } }\n  }\n  throw e\n}\n\ntype Flags = { tenant?: string; protocol: \"https\" | \"ssh\" }\n\n/** core/ never prompts (R5): resolveAppRef only names candidates in QORE_CONTEXT_REQUIRED\n * / QORE_TENANT_ACCESS_LOST, and only here — the CLI layer — does an interactive session\n * turn that into a picker and retry once with the chosen slug as `--tenant`. A\n * non-interactive session, or an error without candidates, is rethrown as-is. */\nasync function resolveApp(\n  deps: CommandContext[\"deps\"], io: CommandContext[\"io\"], session: Session, appArg: string, tenantFlag: string | undefined,\n) {\n  try {\n    return await resolveAppRef(deps, session, appArg, tenantFlag)\n  } catch (e) {\n    if (!(e instanceof QoreError) || (e.code !== \"QORE_CONTEXT_REQUIRED\" && e.code !== \"QORE_TENANT_ACCESS_LOST\")) throw e\n    if (!io.interactive || !e.candidates?.length) throw e\n    const slug = await io.select(\"Select a tenant\", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.slug })))\n    return resolveAppRef(deps, session, appArg, slug)\n  }\n}\n\nexport function registerClone(program: Command, ctx: CommandContext): void {\n  program.command(\"clone\")\n    .description(\"Clone an app's modules into a new workspace directory\")\n    .argument(\"<app>\", \"app slug or id\")\n    .argument(\"[dir]\", \"target directory (default: the app's slug)\")\n    .option(\"--tenant <slug>\", \"tenant the app slug belongs to, when it is not your active one\")\n    .addOption(new Option(\"--protocol <https|ssh>\", \"clone URL protocol\").choices([\"https\", \"ssh\"]).default(\"https\"))\n    .action(async (appArg: string, dirArg: string | undefined, flags: Flags) => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      const onRequest = g.verbose ? (l: string) => io.err(l) : undefined\n      const session = await openSession(deps, portal, \"clone\", onRequest)\n      await ensureCapability(deps, portal.apiOrigin, \"app.modules\")\n\n      const ref = await resolveApp(deps, io, session, appArg, flags.tenant)\n      const app = await session.api.get<CliAppModules>(`/api/cli/v1/apps/${encodeURIComponent(ref.appId)}/modules`)\n\n      // The default directory name comes from the server (app.slug); it must be a single\n      // safe path segment before it is joined into a filesystem path (defence in depth —\n      // a directory the caller typed themselves on the command line is their own choice).\n      if (dirArg === undefined && !isSafeSlug(app.app.slug)) throw unsafeSlugError(app.app.slug)\n      const dirLabel = dirArg ?? app.app.slug\n      const root = resolve(deps.cwd, dirLabel)\n\n      // Conflict check before writing anything (controller ruling): the target may hold\n      // someone else's files, or another app's/portal's workspace — only *this* app's own\n      // workspace at the root is allowed to continue, in which case clone behaves like a\n      // sync without fetch (present modules are reported, never re-cloned).\n      const info = await deps.git.inspect(root)\n      if (info.exists && !info.empty) {\n        const ws = await readWorkspace(root)\n        if (!ws || ws.appId !== app.app.id || ws.portal !== portal.apiOrigin) {\n          throw new QoreError(\"QORE_WORKSPACE_CONFLICT\", `${root} exists and is not the workspace of ${app.app.slug}`, {\n            hint: `Pick another directory: qore clone ${appArg} <dir>.`,\n          })\n        }\n      }\n\n      await writeWorkspace(root, { portal: portal.apiOrigin, appId: app.app.id })\n\n      const dirs: Record<string, DirInfo> = {}\n      const modulesForPlan: CliAppModule[] = []\n      const earlyFailures: ModuleResult[] = []\n      for (const m of app.modules) {\n        if (!isSafeSlug(m.slug)) {\n          earlyFailures.push(asFailure(m.slug, unsafeSlugError(m.slug)))\n          continue\n        }\n        try {\n          dirs[m.slug] = await deps.git.inspect(join(root, m.slug))\n          modulesForPlan.push(m)\n        } catch (e) {\n          earlyFailures.push(asFailure(m.slug, e))\n        }\n      }\n\n      const { actions } = planWorkspace(root, modulesForPlan, dirs, [])\n      const applied = await applyActions(deps, { portal, app, actions, protocol: flags.protocol, onResult: () => {} })\n      for (const r of applied) {\n        if (r.status === \"cloned\" && r.dir) r.dir = relative(deps.cwd, r.dir) || \".\"\n      }\n      const results = [...earlyFailures, ...applied]\n\n      const err = reportWorkspaceRun(io, results, Boolean(g.json))\n      if (!g.json) {\n        // The workspace file is written before any module is cloned, so it exists even when\n        // some (or every) clone failed — say so, then let the failure decide the exit code.\n        io.out(`✓ Wrote ${join(dirLabel, \"qore.workspace.json\")}`)\n        const first = results.find((r) => r.status === \"cloned\" || r.status === \"present\")\n        if (first && !err) io.out(`Next: cd ${join(dirLabel, first.slug)} && qore env pull`)\n      }\n      if (err) throw err\n    })\n}\n","import { QoreError } from \"../errors.js\"\nimport type { PortalRef } from \"../profiles.js\"\nimport { fetchError, problemToError, type Fetch } from \"./http.js\"\nimport type { CliMeta } from \"./types.js\"\n\nconst SUPPORTED = [\"v1\"] as const\nconst SEMVER = /^(\\d+)\\.(\\d+)\\.(\\d+)(?:-([0-9A-Za-z.-]+))?/\n\nexport function compareVersions(a: string, b: string): number {\n  const pa = SEMVER.exec(a), pb = SEMVER.exec(b)\n  if (!pa || !pb) return 0\n  for (let i = 1; i <= 3; i++) {\n    const d = Number(pa[i]) - Number(pb[i])\n    if (d !== 0) return d\n  }\n  if (pa[4] && !pb[4]) return -1\n  if (!pa[4] && pb[4]) return 1\n  return 0\n}\n\nexport async function fetchMeta(fetch: Fetch, apiOrigin: string): Promise<CliMeta> {\n  let res: Response\n  try { res = await fetch(`${apiOrigin}/api/cli/meta`, { headers: { accept: \"application/json\" } }) }\n  catch (e) { throw fetchError(e, new URL(apiOrigin).host) }\n  if (res.status === 404) {\n    // No CLI surface at all: a portal-api from before the CLI (or the wrong URL).\n    throw new QoreError(\"QORE_INCOMPATIBLE_SERVER\", \"This portal does not support the Qore CLI yet\", {\n      status: 404, requestId: res.headers.get(\"x-request-id\") ?? undefined,\n      hint: `Check the portal URL (${apiOrigin}); if it is right, the portal must be upgraded before qore can use it.`,\n    })\n  }\n  if (!res.ok) throw await problemToError(res)\n  return (await res.json()) as CliMeta\n}\n\nexport function negotiate(meta: CliMeta, portal: PortalRef, cliVersion: string): { apiVersion: \"v1\" } {\n  if (portal.pinnedIssuer && meta.auth.issuer !== portal.pinnedIssuer) {\n    throw new QoreError(\"QORE_PORTAL_UNTRUSTED\", `${portal.apiOrigin} names an unexpected identity provider`, {\n      details: { expected: portal.pinnedIssuer, got: meta.auth.issuer },\n      hint: \"Refusing to log in. Check the portal URL and your network.\",\n    })\n  }\n  const apiVersion = SUPPORTED.find((v) => meta.apiVersions.includes(v))\n  if (!apiVersion) {\n    throw new QoreError(\"QORE_INCOMPATIBLE_SERVER\", \"This portal speaks no API version this qore knows\", {\n      details: { server: meta.apiVersions, client: [...SUPPORTED] }, hint: \"Run: npm i -g @quatronic/qore\",\n    })\n  }\n  if (!cliVersion.endsWith(\"-dev\") && compareVersions(cliVersion, meta.minCliVersion) < 0) {\n    throw new QoreError(\"QORE_UPGRADE_REQUIRED\", `qore ${cliVersion} is too old for this portal (needs ${meta.minCliVersion})`, {\n      hint: \"Run: npm i -g @quatronic/qore\",\n    })\n  }\n  return { apiVersion }\n}\n","import type { Deps } from \"../deps.js\"\nimport { QoreError } from \"../errors.js\"\nimport { fetchMeta } from \"./meta.js\"\nimport type { CliMeta } from \"./types.js\"\n\nconst TTL_MS = 3600_000\n\nfunction isMeta(doc: unknown): doc is CliMeta {\n  return !!doc && typeof doc === \"object\" && Array.isArray((doc as CliMeta).capabilities)\n}\n\nasync function loadMeta(deps: Deps, apiOrigin: string, refresh: boolean): Promise<{ meta: CliMeta; cached: boolean }> {\n  const cached = (await deps.config.read()).profiles[apiOrigin]?.meta\n  if (!refresh && cached && isMeta(cached.doc) && deps.now().getTime() - new Date(cached.fetchedAt).getTime() < TTL_MS) {\n    return { meta: cached.doc, cached: true }\n  }\n  const meta = await fetchMeta(deps.fetch, apiOrigin)\n  await deps.config.update((c) => {\n    const p = c.profiles[apiOrigin]\n    if (p) p.meta = { fetchedAt: deps.now().toISOString(), doc: meta }\n  })\n  return { meta, cached: false }\n}\n\n/** Meta per profile, cached 1 h in the profile (spec §9.1). The issuer was pinned at\n * login; a refresh here only updates capabilities and versions. */\nexport async function metaFor(deps: Deps, apiOrigin: string): Promise<CliMeta> {\n  return (await loadMeta(deps, apiOrigin, false)).meta\n}\n\n/** `requireCapability` against the profile's meta. A miss on *cached* meta refetches once\n * before failing: the cache may predate a portal upgrade, and \"try again once it has been\n * updated\" is wrong advice for an hour after it has been. */\nexport async function ensureCapability(deps: Deps, apiOrigin: string, capability: string): Promise<CliMeta> {\n  const first = await loadMeta(deps, apiOrigin, false)\n  let meta = first.meta\n  if (!meta.capabilities.includes(capability) && first.cached) meta = (await loadMeta(deps, apiOrigin, true)).meta\n  requireCapability(meta, capability, apiOrigin)\n  return meta\n}\n\nexport function requireCapability(meta: CliMeta, capability: string, apiOrigin: string): void {\n  if (meta.capabilities.includes(capability)) return\n  throw new QoreError(\"QORE_UNSUPPORTED_BY_SERVER\", `This portal does not support ${capability} yet`, {\n    hint: `The portal at ${apiOrigin} is older than this qore. Try again once it has been updated.`,\n    details: { capability, portal: apiOrigin },\n  })\n}\n","import { createHash } from \"node:crypto\"\nimport { QoreError } from \"./errors.js\"\n\nexport type PortalRef = { apiOrigin: string; pinnedIssuer: string | null; builtin: \"prod\" | \"staging\" | null }\n\nexport const BUILTIN_PORTALS = {\n  prod: {\n    apiOrigin: \"https://api.quatronic.app\",\n    pinnedIssuer: \"https://auth.quatronic.app/realms/platform-prod\",\n  },\n  staging: {\n    apiOrigin: \"https://p01--portal-api-staging--hcywmtb2vksv.code.run\",\n    pinnedIssuer: \"https://auth-staging.quatronic.app/realms/platform-staging\",\n  },\n} as const satisfies Record<string, { apiOrigin: string; pinnedIssuer: string | null }>\n\nfunction builtinFor(origin: string): PortalRef | null {\n  for (const [name, p] of Object.entries(BUILTIN_PORTALS)) {\n    if (p.apiOrigin === origin) return { ...p, builtin: name as \"prod\" | \"staging\" }\n  }\n  return null\n}\n\nfunction toOrigin(raw: string): string {\n  let url: URL\n  try { url = new URL(raw) } catch {\n    throw new QoreError(\"QORE_CONTEXT_INVALID\", `Not a portal name or URL: ${raw}`, {\n      hint: \"Use --portal prod, --portal staging or --portal https://…\",\n    })\n  }\n  const loopback = url.hostname === \"localhost\" || url.hostname === \"127.0.0.1\"\n  if (url.protocol !== \"https:\" && !(url.protocol === \"http:\" && loopback)) {\n    throw new QoreError(\"QORE_CONTEXT_INVALID\", \"A portal URL must use https (http only for localhost)\")\n  }\n  return url.origin.toLowerCase()\n}\n\nexport function resolvePortal(arg: string | undefined, defaultProfile: string | undefined): PortalRef {\n  const chosen = arg ?? defaultProfile\n  if (chosen === undefined || chosen === \"prod\") return { ...BUILTIN_PORTALS.prod, builtin: \"prod\" }\n  if (chosen === \"staging\") return { ...BUILTIN_PORTALS.staging, builtin: \"staging\" }\n  const origin = toOrigin(chosen)\n  return builtinFor(origin) ?? { apiOrigin: origin, pinnedIssuer: null, builtin: null }\n}\n\nexport function profileHash(apiOrigin: string, issuer: string): string {\n  return createHash(\"sha256\").update(`${apiOrigin}|${issuer}`).digest(\"hex\").slice(0, 16)\n}\n","import { QoreError } from \"../errors.js\"\nimport { fetchError, problemToError, type Fetch } from \"./http.js\"\n\nexport class QoreApiClient {\n  constructor(private readonly o: {\n    apiOrigin: string; fetch: Fetch; token: (force: boolean) => Promise<string>\n    cliVersion: string; command: string; platform: string; onRequest?: (line: string) => void\n  }) {}\n\n  private async once(method: \"GET\" | \"POST\", path: string, body: unknown, force: boolean): Promise<Response> {\n    const token = await this.o.token(force)\n    const headers: Record<string, string> = {\n      authorization: `Bearer ${token}`,\n      accept: \"application/json\",\n      \"qore-cli-version\": this.o.cliVersion,\n      \"qore-command\": this.o.command,\n      \"user-agent\": `qore/${this.o.cliVersion} (${this.o.platform})`,\n    }\n    if (body !== undefined) headers[\"content-type\"] = \"application/json\"\n    let res: Response\n    try {\n      res = await this.o.fetch(`${this.o.apiOrigin}${path}`, {\n        method, headers, body: body === undefined ? undefined : JSON.stringify(body),\n      })\n    } catch (e) { throw fetchError(e, new URL(this.o.apiOrigin).host) }\n    const rid = res.headers.get(\"x-request-id\")\n    this.o.onRequest?.(`${method} ${path} → ${res.status}${rid ? ` (${rid})` : \"\"}`)\n    return res\n  }\n\n  private async request<T>(method: \"GET\" | \"POST\", path: string, body?: unknown): Promise<T> {\n    let res = await this.once(method, path, body, false)\n    if (res.status === 401) {\n      res = await this.once(method, path, body, true)\n      if (res.status === 401) {\n        throw new QoreError(\"QORE_SESSION_EXPIRED\", \"The portal no longer accepts your session\", {\n          hint: \"Run `qore login`.\", status: 401, requestId: res.headers.get(\"x-request-id\") ?? undefined,\n        })\n      }\n    }\n    if (!res.ok) throw await problemToError(res)\n    return (await res.json()) as T\n  }\n\n  get<T>(path: string): Promise<T> { return this.request<T>(\"GET\", path) }\n  post<T>(path: string, body: unknown): Promise<T> { return this.request<T>(\"POST\", path, body) }\n}\n","import { QoreError } from \"../errors.js\"\nimport type { WithLock } from \"../../platform/lock.js\"\nimport type { Oidc, TokenSet } from \"./oidc.js\"\nimport type { TokenStore } from \"./tokenStore.js\"\n\nconst SKEW_MS = 60_000\n\nexport class RefreshCoordinator {\n  constructor(private readonly o: {\n    store: TokenStore; oidc: () => Promise<Oidc>; withLock: WithLock; lockName: string; now: () => Date\n  }) {}\n\n  private fresh(expiresAt: string): boolean {\n    return new Date(expiresAt).getTime() - this.o.now().getTime() > SKEW_MS\n  }\n\n  private async rotate(scope?: string): Promise<TokenSet> {\n    let stored = await this.o.store.getRefresh()\n    if (!stored) throw new QoreError(\"QORE_NOT_LOGGED_IN\", \"Not logged in\", { hint: \"Run `qore login`.\" })\n    let t: TokenSet\n    for (let attempt = 0; ; attempt++) {\n      try {\n        t = await (await this.o.oidc()).refresh(stored.rt, scope)\n        break\n      } catch (e) {\n        if (!(e instanceof QoreError && e.code === \"QORE_SESSION_EXPIRED\")) throw e\n        // Only the RT we presented was rejected. Another process may have rotated it\n        // meanwhile (a stolen stale lock, a second config dir, a lost response): then the\n        // stored RT is newer, so retry once with it instead of logging the user out.\n        const now = await this.o.store.getRefresh()\n        if (now && now.rt !== stored.rt) {\n          if (attempt === 0) { stored = now; continue }\n          throw e\n        }\n        await this.o.store.clear()\n        throw e\n      }\n    }\n    // Store the scope the token response reports: after a downscoped refresh the rotated RT\n    // may carry only the narrowed scope, so never record the old full scope for it. An empty\n    // response scope means \"as requested\" (RFC 6749 §5.1).\n    await this.o.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope || (scope ?? stored.scope), obtainedAt: this.o.now().toISOString() })\n    return t\n  }\n\n  async accessToken(opts: { force?: boolean } = {}): Promise<string> {\n    const seen = await this.o.store.getAccess()\n    if (!opts.force && seen && this.fresh(seen.expiresAt)) return seen.at\n    return this.o.withLock(this.o.lockName, async () => {\n      const again = await this.o.store.getAccess()\n      if (again && again.at !== seen?.at && this.fresh(again.expiresAt)) return again.at\n      const t = await this.rotate()\n      await this.o.store.setAccess({ at: t.accessToken, expiresAt: new Date(this.o.now().getTime() + t.expiresIn * 1000).toISOString() })\n      return t.accessToken\n    })\n  }\n\n  /** A token carrying only `scopes`, held in memory by the caller (qore mcp). */\n  async downscoped(scopes: string[]): Promise<string> {\n    return this.o.withLock(this.o.lockName, async () => (await this.rotate(scopes.join(\" \"))).accessToken)\n  }\n}\n","import type { Keychain } from \"../../platform/keychain.js\"\n\nexport type StoredRefresh = { rt: string; sub: string; scope: string; obtainedAt: string }\nexport type StoredAccess = { at: string; expiresAt: string }\n\nexport class TokenStore {\n  constructor(private readonly kc: Keychain, private readonly hash: string) {}\n\n  private async read<T>(suffix: string): Promise<T | null> {\n    const raw = await this.kc.get(`${this.hash}:${suffix}`)\n    if (raw === null) return null\n    try { return JSON.parse(raw) as T } catch { return null }\n  }\n\n  getRefresh() { return this.read<StoredRefresh>(\"refresh\") }\n  getAccess() { return this.read<StoredAccess>(\"access\") }\n  setRefresh(v: StoredRefresh) { return this.kc.set(`${this.hash}:refresh`, JSON.stringify(v)) }\n  setAccess(v: StoredAccess) { return this.kc.set(`${this.hash}:access`, JSON.stringify(v)) }\n  async clear() {\n    await this.kc.delete(`${this.hash}:access`)\n    await this.kc.delete(`${this.hash}:refresh`)\n  }\n}\n","import { QoreApiClient } from \"./api/client.js\"\nimport { RefreshCoordinator } from \"./auth/refresh.js\"\nimport { TokenStore } from \"./auth/tokenStore.js\"\nimport type { ProfileRecord } from \"./config.js\"\nimport type { Deps } from \"./deps.js\"\nimport { QoreError } from \"./errors.js\"\nimport { profileHash, type PortalRef } from \"./profiles.js\"\n\nexport function loginHint(portal: PortalRef): string {\n  return portal.builtin === \"prod\" ? \"Run `qore login`.\" : `Run \\`qore login --portal ${portal.builtin ?? portal.apiOrigin}\\`.`\n}\n\nexport async function openSession(deps: Deps, portal: PortalRef, command: string, onRequest?: (l: string) => void) {\n  const profile: ProfileRecord | undefined = (await deps.config.read()).profiles[portal.apiOrigin]\n  if (!profile) throw new QoreError(\"QORE_NOT_LOGGED_IN\", `Not logged in to ${portal.apiOrigin}`, { hint: loginHint(portal) })\n  const hash = profileHash(profile.apiOrigin, profile.issuer)\n  const tokens = new TokenStore(deps.keychain, hash)\n  if (!(await tokens.getRefresh())) throw new QoreError(\"QORE_NOT_LOGGED_IN\", `Not logged in to ${portal.apiOrigin}`, { hint: loginHint(portal) })\n  const refresh = new RefreshCoordinator({ store: tokens, oidc: () => deps.oidcFor(profile.issuer), withLock: deps.withLock, lockName: hash, now: deps.now })\n  const api = new QoreApiClient({\n    apiOrigin: profile.apiOrigin, fetch: deps.fetch, token: (force) => refresh.accessToken({ force }),\n    cliVersion: deps.version, command, platform: `${deps.platform} ${process.arch}; node ${process.versions.node}`, onRequest,\n  })\n  return { profile, api, tokens, refresh }\n}\n\nexport type Session = Awaited<ReturnType<typeof openSession>>\n","import type { CliMe } from \"../api/types.js\"\nimport type { Deps } from \"../deps.js\"\nimport { QoreError, type Candidate } from \"../errors.js\"\nimport type { Session } from \"../session.js\"\n\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nconst tenantCandidates = (tenants: CliMe[\"tenants\"]): Candidate[] =>\n  tenants.map((t) => ({ kind: \"tenant\", id: t.id, slug: t.slug, name: t.name }))\n\n/** §5.1: the app arg is either a bare app id, or a slug resolved against a tenant.\n * `--tenant` is validated against `/me`; otherwise the profile's `activeTenant` is\n * revalidated against `/me` (QORE_TENANT_ACCESS_LOST if it is gone); otherwise the single\n * tenant in `/me`; otherwise QORE_CONTEXT_REQUIRED naming every tenant slug as a candidate\n * (the CLI layer turns that, and QORE_TENANT_ACCESS_LOST, into an interactive picker). */\nexport async function resolveAppRef(\n  deps: Deps,\n  session: Session,\n  arg: string,\n  tenantFlag?: string,\n): Promise<{ appId: string; tenant: { id: string; slug: string } | null }> {\n  if (UUID.test(arg)) return { appId: arg, tenant: null }\n\n  const me = await session.api.get<CliMe>(\"/api/cli/v1/me\")\n  let tenant: { id: string; slug: string }\n  if (tenantFlag) {\n    const found = me.tenants.find((t) => t.slug === tenantFlag)\n    if (!found) {\n      throw new QoreError(\"QORE_RESOURCE_NOT_FOUND\", `No tenant \"${tenantFlag}\" for this account`, {\n        candidates: tenantCandidates(me.tenants),\n      })\n    }\n    tenant = { id: found.id, slug: found.slug }\n  } else if (session.profile.activeTenant) {\n    const active = session.profile.activeTenant\n    const found = me.tenants.find((t) => t.id === active.id)\n    if (!found) {\n      throw new QoreError(\"QORE_TENANT_ACCESS_LOST\", `You no longer have developer access to ${active.slug}`, {\n        hint: \"Run `qore tenant use <slug>`.\", candidates: tenantCandidates(me.tenants),\n      })\n    }\n    tenant = { id: found.id, slug: found.slug }\n  } else if (me.tenants.length === 1) {\n    tenant = { id: me.tenants[0]!.id, slug: me.tenants[0]!.slug }\n  } else {\n    throw new QoreError(\"QORE_CONTEXT_REQUIRED\", `Which tenant is \"${arg}\" in?`, {\n      hint: \"Run `qore tenant use <slug>`, or pass --tenant <slug>.\", candidates: tenantCandidates(me.tenants),\n    })\n  }\n\n  try {\n    const { id } = await session.api.get<{ id: string }>(\n      `/api/cli/v1/tenants/${encodeURIComponent(tenant.id)}/apps/resolve?slug=${encodeURIComponent(arg)}`)\n    return { appId: id, tenant }\n  } catch (e) {\n    // The generic 404 mapping (problemToError) carries no hint — this call site knows\n    // specifically that the slug didn't resolve to an app, so it can say what to do\n    // about it. Only fills in a hint the server/generic mapping left empty.\n    if (e instanceof QoreError && e.code === \"QORE_RESOURCE_NOT_FOUND\" && !e.hint) {\n      throw new QoreError(e.code, e.message, {\n        hint: \"Check the slug; `qore whoami` lists the apps you can see.\",\n        status: e.status, requestId: e.requestId, candidates: e.candidates, serverCode: e.serverCode, details: e.details, cause: e.cause,\n      })\n    }\n    throw e\n  }\n}\n","import { join, relative } from \"node:path\"\nimport type { CliAppModules } from \"../api/types.js\"\nimport { ResolutionCache } from \"../context/cache.js\"\nimport { repoKey } from \"../context/repoKey.js\"\nimport type { Deps } from \"../deps.js\"\nimport { QoreError } from \"../errors.js\"\nimport type { PortalRef } from \"../profiles.js\"\nimport { trust } from \"../trust.js\"\nimport { classifyCloneFailure, classifyPullFailure } from \"./diagnose.js\"\nimport { cloneUrl, unsupportedRepoUrlError, type ModuleAction } from \"./plan.js\"\n\nexport type ModuleResult = {\n  slug: string\n  status: \"cloned\" | \"present\" | \"fetched\" | \"pulled\" | \"skipped\" | \"failed\" | \"conflict\" | \"no-repo\" | \"removed\"\n  reason?: string\n  error?: { code: string; message: string; hint?: string }\n  /** Set only for `cloned` — the destination directory, for the human-mode `→ <dir>` line. */\n  dir?: string\n}\n\n/** Per-module isolation (controller ruling): a `QoreError` thrown by a git call for one\n * module is caught and turned into that module's own `failed` result, and the loop moves\n * on to the next module — a broken `.git` directory or a `git remote -v` failure in one\n * repository must never abort the whole run. Anything that is not a `QoreError` is a bug,\n * not a per-module failure, and keeps propagating. */\nfunction toFailure(slug: string, e: unknown): ModuleResult {\n  // git missing from PATH is not a per-module condition — every remaining git call in this\n  // run would fail the same way, so it aborts the run once instead of being reported once\n  // per module.\n  if (e instanceof QoreError && e.code !== \"QORE_GIT_UNAVAILABLE\") {\n    return { slug, status: \"failed\", error: { code: e.code, message: e.message, hint: e.hint } }\n  }\n  throw e\n}\n\n/** Spec §14.2: a conflicting module directory names the directory and what it holds, and\n * the remedy — qore itself never moves it. `dir` is shown relative to the cwd. */\nfunction conflictResult(deps: Deps, action: ModuleAction): ModuleResult {\n  const dir = relative(deps.cwd, action.dir) || \".\"\n  const what = action.reason === \"not a git repository\"\n    ? \"it is not a git repository\"\n    : action.origin ? `its origin is ${action.origin}, not ${action.module.repoUrl}` : \"it has no origin remote\"\n  const message = action.reason === \"not a git repository\"\n    ? `${dir} is not a git repository`\n    : action.origin ? `${dir} holds another repository (its origin is ${action.origin}, not ${action.module.repoUrl})`\n    : `${dir} has no origin remote`\n  return {\n    slug: action.module.slug, status: \"conflict\", reason: action.reason,\n    error: { code: \"QORE_WORKSPACE_CONFLICT\", message, hint: `Move ${dir} aside (${what}), then run \\`qore sync\\`.` },\n  }\n}\n\n/** Sequential, never destructive (Global Constraints: \"Clone and sync behaviour\"). A\n * present/conflict/no-repo action is only reported — it never touches the directory. A\n * clone action that succeeds is trusted (spec §5.4: cloned by qore = trusted) and cached,\n * so a later `qore status` in that repository resolves without another repos/resolve. */\nexport async function applyActions(deps: Deps, o: {\n  portal: PortalRef\n  app: CliAppModules\n  actions: ModuleAction[]\n  protocol: \"https\" | \"ssh\"\n  onResult: (r: ModuleResult) => void\n}): Promise<ModuleResult[]> {\n  const cache = new ResolutionCache(join(deps.config.dir, \"cache\"), deps.now)\n  const results: ModuleResult[] = []\n  for (const action of o.actions) {\n    let result: ModuleResult\n    switch (action.kind) {\n      case \"present\":\n        result = { slug: action.module.slug, status: \"present\" }\n        break\n      case \"conflict\":\n        result = conflictResult(deps, action)\n        break\n      case \"unsupported\": {\n        const e = unsupportedRepoUrlError(action.module.slug, action.module.repoUrl ?? \"\")\n        result = { slug: action.module.slug, status: \"failed\", reason: action.reason, error: { code: e.code, message: e.message, hint: e.hint } }\n        break\n      }\n      case \"no-repo\":\n        result = { slug: action.module.slug, status: \"no-repo\", reason: action.reason }\n        break\n      case \"clone\": {\n        try {\n          const url = cloneUrl(action.module.repoUrl!, o.protocol)\n          const r = await deps.git.clone(url, action.dir)\n          if (r.ok) {\n            await trust(deps, action.dir, action.module.id)\n            const key = repoKey(action.module.repoUrl!)\n            if (key) await cache.put(o.portal.apiOrigin, key, action.module.id)\n            result = { slug: action.module.slug, status: \"cloned\", dir: action.dir }\n          } else {\n            const err = classifyCloneFailure(r.stderr, action.module, o.app, o.protocol)\n            result = { slug: action.module.slug, status: \"failed\", error: { code: err.code, message: err.message, hint: err.hint } }\n          }\n        } catch (e) {\n          result = toFailure(action.module.slug, e)\n        }\n        break\n      }\n    }\n    results.push(result)\n    o.onResult(result)\n  }\n  return results\n}\n\n/** Fetches every `present` repository; `pull` additionally fast-forwards a clean\n * repository with an upstream. Mutates `results` in place — the caller passes the same\n * array it renders and reports the exit code from. A dirty tree, one without an upstream,\n * or a `status`/`pull` failure is `skipped` with its reason, never touched further. Per\n * the controller ruling, a thrown `QoreError` from any git call is that module's own\n * `failed` result — it never aborts the remaining modules. */\nexport async function syncPresent(\n  deps: Deps,\n  results: ModuleResult[],\n  actions: ModuleAction[],\n  pull: boolean,\n  ctx: { app: CliAppModules; protocol: \"https\" | \"ssh\" },\n): Promise<void> {\n  const bySlug = new Map(actions.map((a) => [a.module.slug, a]))\n  for (const result of results) {\n    if (result.status !== \"present\") continue\n    const action = bySlug.get(result.slug)\n    if (!action) continue\n\n    let fetchRes\n    try {\n      fetchRes = await deps.git.fetch(action.dir)\n    } catch (e) {\n      Object.assign(result, toFailure(result.slug, e))\n      continue\n    }\n    if (!fetchRes.ok) {\n      const err = classifyCloneFailure(fetchRes.stderr, action.module, ctx.app, ctx.protocol)\n      result.status = \"failed\"\n      result.error = { code: err.code, message: err.message, hint: err.hint }\n      continue\n    }\n    result.status = \"fetched\"\n    if (!pull) continue\n\n    let st\n    try {\n      st = await deps.git.status(action.dir)\n    } catch (e) {\n      Object.assign(result, toFailure(result.slug, e))\n      continue\n    }\n    if (!st.ok) {\n      result.status = \"skipped\"\n      result.reason = classifyPullFailure(st.stderr)\n      continue\n    }\n    if (st.dirty) {\n      result.status = \"skipped\"\n      result.reason = \"uncommitted changes\"\n      continue\n    }\n    if (!st.upstream) {\n      result.status = \"skipped\"\n      result.reason = \"no upstream branch\"\n      continue\n    }\n\n    let pullRes\n    try {\n      pullRes = await deps.git.pullFfOnly(action.dir)\n    } catch (e) {\n      Object.assign(result, toFailure(result.slug, e))\n      continue\n    }\n    if (!pullRes.ok) {\n      result.status = \"skipped\"\n      result.reason = classifyPullFailure(pullRes.stderr)\n      continue\n    }\n    result.status = \"pulled\"\n  }\n}\n","import { join } from \"node:path\"\nimport { readJson, writeJsonAtomic } from \"../jsonFile.js\"\n\ntype Entry = { moduleId: string; resolvedAt: string }\ntype CacheFile = { schemaVersion: 1; entries: Record<string, Entry> }\nconst TTL_MS = 24 * 3600_000\n\n/** Speed and offline display only — every command still sends the moduleId to the\n * server, which authorizes it afresh (spec §5.2). */\nexport class ResolutionCache {\n  constructor(private readonly dir: string, private readonly now: () => Date) {}\n\n  private async load(): Promise<CacheFile> {\n    try {\n      const f = await readJson<CacheFile>(join(this.dir, \"repos.json\"))\n      if (f && f.schemaVersion === 1 && typeof f.entries === \"object\" && f.entries) return f\n    } catch { /* a malformed cache is an empty cache */ }\n    return { schemaVersion: 1, entries: {} }\n  }\n\n  private fresh(e: Entry | undefined): e is Entry {\n    return !!e && this.now().getTime() - new Date(e.resolvedAt).getTime() < TTL_MS\n  }\n\n  async get(origin: string, key: string): Promise<string | null> {\n    const e = (await this.load()).entries[`${origin}|${key}`]\n    return this.fresh(e) ? e.moduleId : null\n  }\n\n  /** Never throws: a read-only config dir, a full disk or a Windows EPERM on rename\n   * (another qore holding the file) must not fail a command that already resolved. */\n  async put(origin: string, key: string, moduleId: string): Promise<void> {\n    const f = await this.load()\n    f.entries[`${origin}|${key}`] = { moduleId, resolvedAt: this.now().toISOString() }\n    for (const [k, e] of Object.entries(f.entries)) if (!this.fresh(e)) delete f.entries[k]\n    await this.save(f)\n  }\n\n  /** Never throws, like `put`. */\n  async drop(origin: string, key: string): Promise<void> {\n    const f = await this.load()\n    if (!(`${origin}|${key}` in f.entries)) return\n    delete f.entries[`${origin}|${key}`]\n    await this.save(f)\n  }\n\n  private async save(f: CacheFile): Promise<void> {\n    try { await writeJsonAtomic(this.dir, \"repos.json\", f) } catch { /* cache only */ }\n  }\n\n  async originsFor(keys: string[]): Promise<string[]> {\n    const f = await this.load()\n    const hits: { origin: string; at: number }[] = []\n    for (const [k, e] of Object.entries(f.entries)) {\n      const sep = k.lastIndexOf(\"|\")\n      if (keys.includes(k.slice(sep + 1)) && this.fresh(e)) hits.push({ origin: k.slice(0, sep), at: new Date(e.resolvedAt).getTime() })\n    }\n    hits.sort((a, b) => b.at - a.at)\n    return [...new Set(hits.map((h) => h.origin))]\n  }\n}\n","import { chmod, mkdir, readFile, rename, writeFile } from \"node:fs/promises\"\nimport { join } from \"node:path\"\nimport { randomBytes } from \"node:crypto\"\n\nexport async function readJson<T>(file: string): Promise<T | null> {\n  let raw: string\n  try { raw = await readFile(file, \"utf8\") } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return null\n    throw e\n  }\n  return JSON.parse(raw) as T\n}\n\nexport async function writeJsonAtomic(dir: string, name: string, data: unknown): Promise<void> {\n  await mkdir(dir, { recursive: true, mode: 0o700 })\n  const tmp = join(dir, `.${name}.${randomBytes(6).toString(\"hex\")}.tmp`)\n  await writeFile(tmp, JSON.stringify(data, null, 2) + \"\\n\", { mode: 0o600 })\n  await chmod(tmp, 0o600)\n  await rename(tmp, join(dir, name))\n}\n","/** `host/owner/repo`, lowercase — the same normalisation portal-api applies\n * (QDC `services/cli_repo_key.py`), pinned by a shared parity table. */\n\n// scp-like git syntax: [user@]host:path, path not starting with \"/\".\nconst SCP = /^(?:[^@/]+@)?([^:/]+):([^/].*)$/\nconst SCHEMES = new Set([\"https:\", \"http:\", \"ssh:\", \"git:\"])\n// Dot segments, also percent-encoded: WHATWG URL resolves these and Python's urlsplit\n// does not, so the two sides would disagree. Neither is a realistic remote: reject.\nconst DOT_SEGMENTS = new Set([\".\", \"..\", \"%2e\", \"%2e%2e\", \".%2e\", \"%2e.\"])\nconst hasDotSegment = (pieces: string[]) => pieces.some((p) => DOT_SEGMENTS.has(p.toLowerCase()))\n\nexport function repoKey(url: string): string | null {\n  let raw = url.trim()\n  if (raw.startsWith(\"git+\")) raw = raw.slice(4)\n  // A backslash is a separator to WHATWG but a literal to urlsplit: reject it outright.\n  if (!raw || raw.includes(\"\\\\\")) return null\n  let host: string\n  let path: string\n  if (raw.includes(\"://\")) {\n    if (hasDotSegment(raw.slice(raw.indexOf(\"://\") + 3).split(\"/\").slice(1))) return null\n    let u: URL\n    try { u = new URL(raw) } catch { return null }\n    if (!SCHEMES.has(u.protocol.toLowerCase())) return null\n    // WHATWG leaves non-special hosts (ssh:, git:) in their original case.\n    host = u.hostname\n    path = u.pathname\n  } else {\n    const m = SCP.exec(raw)\n    if (!m) return null\n    host = m[1]!\n    path = m[2]!\n  }\n  const segments = path.split(\"/\").filter(Boolean)\n  if (!host || segments.length !== 2 || hasDotSegment(segments)) return null\n  const owner = segments[0]!\n  let repo = segments[1]!\n  if (repo.toLowerCase().endsWith(\".git\")) repo = repo.slice(0, -4)\n  if (!repo) return null\n  return `${host.toLowerCase()}/${owner.toLowerCase()}/${repo.toLowerCase()}`\n}\n","import { realpath } from \"node:fs/promises\"\nimport type { Deps } from \"./deps.js\"\n\n/** Spec §5.4: a safety interlock, not authorization — the server still authorizes. */\nexport function trustKey(root: string, platform: NodeJS.Platform): string {\n  return platform === \"win32\" ? root.toLowerCase() : root\n}\n\nasync function keyOf(deps: Deps, root: string): Promise<string> {\n  let real = root\n  try {\n    real = await realpath(root)\n  } catch (e) {\n    if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e\n    // a vanished dir keeps its literal path\n  }\n  return trustKey(real, deps.platform)\n}\n\nexport async function isTrusted(deps: Deps, root: string, moduleId: string): Promise<boolean> {\n  const cfg = await deps.config.read()\n  return (cfg.trustedRepos?.[await keyOf(deps, root)] ?? []).includes(moduleId)\n}\n\nexport async function trust(deps: Deps, root: string, moduleId: string): Promise<void> {\n  const key = await keyOf(deps, root)\n  await deps.config.update((c) => {\n    const repos = (c.trustedRepos ??= {})\n    const list = new Set(repos[key] ?? [])\n    list.add(moduleId)\n    repos[key] = [...list]\n  })\n}\n","import { join } from \"node:path\"\nimport type { CliAppModule } from \"../api/types.js\"\nimport { repoKey } from \"../context/repoKey.js\"\nimport { QoreError } from \"../errors.js\"\nimport type { DirInfo } from \"../../platform/git.js\"\n\nexport type ModuleAction = {\n  module: CliAppModule\n  dir: string\n  kind: \"clone\" | \"present\" | \"conflict\" | \"no-repo\" | \"unsupported\"\n  reason?: string\n  /** For a re-pointed conflict: the URL the directory's `origin` points at (null: no origin). */\n  origin?: string | null\n}\n\nconst SEGMENT = /^[A-Za-z0-9_.-]+$/\n\n/** Only `https://<host>/<owner>/<repo>[.git]` — the shape the portal hands out. Anything\n * else (another scheme, credentials, a query, extra path segments, a host or segment that\n * could read as an option) is refused before it reaches `git clone` or the ssh rewrite. */\nexport function isSupportedRepoUrl(repoUrl: string): boolean {\n  let u: URL\n  try { u = new URL(repoUrl) } catch { return false }\n  if (u.protocol !== \"https:\" || !u.hostname || u.hostname.startsWith(\"-\")) return false\n  if (u.username || u.password || u.search || u.hash) return false\n  const segments = u.pathname.replace(/\\/+$/, \"\").split(\"/\").slice(1)\n  return segments.length === 2 && segments.every((s) => SEGMENT.test(s) && !s.startsWith(\"-\") && s !== \".\" && s !== \"..\")\n}\n\nexport function unsupportedRepoUrlError(slug: string, repoUrl: string): QoreError {\n  return new QoreError(\"QORE_INTERNAL\", `${slug}: unsupported repository URL ${JSON.stringify(repoUrl)}`, {\n    hint: \"This looks like a portal bug — please report it.\",\n  })\n}\n\nexport function cloneUrl(repoUrl: string, protocol: \"https\" | \"ssh\"): string {\n  if (!isSupportedRepoUrl(repoUrl)) throw unsupportedRepoUrlError(\"module\", repoUrl)\n  if (protocol === \"https\") return repoUrl\n  const u = new URL(repoUrl)\n  return `git@${u.hostname}:${u.pathname.replace(/^\\/+/, \"\").replace(/\\/+$/, \"\").replace(/\\.git$/, \"\")}.git`\n}\n\n/** Pure (spec §15): what clone/sync would do; it never touches a present directory. A\n * directory is `present` only when its `origin` — the remote `git fetch`/`git pull` use —\n * points at the module's repository; another remote that happens to match does not count,\n * because sync would still fetch from the re-pointed origin. */\nexport function planWorkspace(\n  root: string,\n  modules: CliAppModule[],\n  dirs: Record<string, DirInfo>,\n  strayRepos: string[],\n): { actions: ModuleAction[]; removed: string[] } {\n  const actions: ModuleAction[] = modules.map((module) => {\n    const dir = join(root, module.slug)\n    if (!module.repoUrl) return { module, dir, kind: \"no-repo\", reason: \"no repository yet\" }\n    if (!isSupportedRepoUrl(module.repoUrl)) return { module, dir, kind: \"unsupported\", reason: \"unsupported repository URL\" }\n    const info = dirs[module.slug] ?? { exists: false, empty: false, isRepo: false, remotes: [] }\n    if (!info.exists || info.empty) return { module, dir, kind: \"clone\" }\n    if (!info.isRepo) return { module, dir, kind: \"conflict\", reason: \"not a git repository\" }\n    const want = repoKey(module.repoUrl)\n    const origin = info.remotes.find((r) => r.name === \"origin\")\n    if (want !== null && origin && repoKey(origin.url) === want) return { module, dir, kind: \"present\" }\n    return { module, dir, kind: \"conflict\", reason: `re-pointed: ${origin?.url ?? \"no origin remote\"}`, origin: origin?.url ?? null }\n  })\n  const slugs = new Set(modules.map((m) => m.slug))\n  return { actions, removed: strayRepos.filter((s) => !slugs.has(s)) }\n}\n","import type { CliAppModule, CliAppModules } from \"../api/types.js\"\nimport { repoKey } from \"../context/repoKey.js\"\nimport { QoreError } from \"../errors.js\"\nimport { cloneUrl, isSupportedRepoUrl } from \"./plan.js\"\n\nexport const ACCESS_CODES = new Set([\"QORE_GITHUB_NOT_LINKED\", \"QORE_REPO_NO_ACCESS\", \"QORE_REPO_ACCESS_PENDING\"])\n\nconst lastLines = (s: string, n: number) => s.split(/\\r?\\n/).map((l) => l.trim()).filter(Boolean).slice(-n)\n\n/** Spec §14.1/§14.2: git's error combined with what the portal knows, never a bare \"failed\".\n * GitHub says \"Repository not found\" both for a missing repo and for one you may not read. */\nexport function classifyCloneFailure(\n  stderr: string,\n  m: CliAppModule,\n  app: CliAppModules,\n  protocol: \"https\" | \"ssh\",\n): QoreError {\n  // Never throws from here: an unsupported URL is refused before any git call, but a\n  // classifier must not be the place a malformed URL finally escapes as an exception.\n  const url = isSupportedRepoUrl(m.repoUrl!) ? cloneUrl(m.repoUrl!, protocol) : m.repoUrl!\n  const details = { module: m.slug, protocol, url }\n  if (/SAML SSO|single sign-on/i.test(stderr)) {\n    const link = /https:\\/\\/\\S+/.exec(stderr)?.[0]\n    return new QoreError(\"QORE_GIT_AUTH\", `GitHub wants SSO authorisation for ${m.slug}`, {\n      hint: `Authorise your ${protocol === \"ssh\" ? \"SSH key\" : \"token\"} for the organisation${link ? `: ${link}` : \"\"}.`,\n      details: { ...details, reason: \"sso\" },\n    })\n  }\n  if (/Host key verification failed/.test(stderr)) {\n    const host = /\\bfor ([\\w.-]+) and you have requested strict checking/.exec(stderr)?.[1] ?? \"github.com\"\n    return new QoreError(\"QORE_GIT_AUTH\", `ssh could not verify ${host}'s host key (${m.slug})`, {\n      hint: `Run \\`ssh -T git@${host}\\` once to accept its host key (or to see why it changed), then run \\`qore sync\\`.`,\n      details: { ...details, protocol: \"ssh\", reason: \"host-key\" },\n    })\n  }\n  if (/Permission denied \\(publickey\\)/.test(stderr)) {\n    return new QoreError(\"QORE_GIT_AUTH\", `GitHub refused your SSH key for ${m.slug}`, {\n      hint: \"Check with `ssh -T git@github.com`, or clone over https: `--protocol https` after `gh auth login`.\",\n      details: { ...details, protocol: \"ssh\" },\n    })\n  }\n  if (/could not read Username|Authentication failed|Invalid username or (password|token)/i.test(stderr)) {\n    return new QoreError(\"QORE_GIT_AUTH\", `git has no GitHub credentials for ${m.slug}`, {\n      hint: \"`gh auth login` sets up git credentials; or use `--protocol ssh`.\",\n      details: { ...details, protocol: \"https\" },\n    })\n  }\n  if (/Repository not found|repository '.*' not found/i.test(stderr)) {\n    if (!m.githubLinked) {\n      return new QoreError(\"QORE_GITHUB_NOT_LINKED\", `Your GitHub account is not linked in Qore (${m.slug})`, {\n        hint: `Link your GitHub account at ${app.accountUrl}, then run \\`qore sync\\`.`,\n        details,\n      })\n    }\n    if (m.repoAccess === \"none\") {\n      // `devTeamIds` names the dev team(s) that actually build this module (a subset of\n      // the app's teams). Absent or empty (older server, or a module not yet scoped)\n      // falls back to naming every one of the app's dev teams, as before — and so does a\n      // non-empty devTeamIds that matches none of app.devTeams (a stale id, a team the\n      // caller can't see): an empty filter result is never mistaken for \"no dev team\n      // builds this\", which would otherwise drop to the bare \"ask your tenant owner\" text.\n      // A partial match narrows to only the ids that did match.\n      const filtered = m.devTeamIds?.length ? app.devTeams.filter((t) => m.devTeamIds!.includes(t.id)) : []\n      const moduleTeams = filtered.length ? filtered : app.devTeams\n      const teams = moduleTeams.map((t) => `\"${t.name}\"`).join(\" or \")\n      const emails = [...new Set(moduleTeams.flatMap((t) => t.maintainers))].join(\", \")\n      return new QoreError(\"QORE_REPO_NO_ACCESS\", `No repository access to ${m.slug}`, {\n        hint: teams\n          ? `Ask a maintainer of dev team ${teams} for a seat${emails ? `: ${emails}` : \"\"}.`\n          : `Ask your tenant owner which dev team builds ${m.slug}.`,\n        details: { ...details, devTeams: moduleTeams.map((t) => t.name) },\n      })\n    }\n    const owner = repoKey(m.repoUrl!)?.split(\"/\")[1]\n    const invitation = owner ? ` https://github.com/orgs/${owner}/invitation` : \"\"\n    return new QoreError(\"QORE_REPO_ACCESS_PENDING\", `GitHub does not grant ${m.slug} yet`, {\n      hint: `Access was granted recently, or your invitation to the GitHub organisation is not accepted yet:${invitation} — then retry in a minute.`,\n      details,\n    })\n  }\n  return new QoreError(\"QORE_INTERNAL\", `Cloning ${m.slug} failed`, {\n    hint: [...lastLines(stderr, 3), `\\`git clone ${url}\\``].join(\"\\n\"),\n    details,\n  })\n}\n\nexport function classifyPullFailure(stderr: string): string {\n  if (/Not possible to fast-forward/i.test(stderr)) return \"diverged\"\n  return lastLines(stderr, 1)[0] ?? \"pull failed\"\n}\n","import { randomBytes } from \"node:crypto\"\nimport { mkdir, readFile, rename, rm, writeFile } from \"node:fs/promises\"\nimport { dirname, join, resolve } from \"node:path\"\nimport { TokenStore } from \"../auth/tokenStore.js\"\nimport type { Deps } from \"../deps.js\"\nimport { QoreError } from \"../errors.js\"\nimport { profileHash, resolvePortal, type PortalRef } from \"../profiles.js\"\n\nexport const WORKSPACE_FILE = \"qore.workspace.json\"\nexport type Workspace = { root: string; portal: string; appId: string }\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nconst invalid = (file: string, msg: string) =>\n  new QoreError(\"QORE_CONTEXT_INVALID\", `${file}: ${msg}`, { hint: \"Fix or delete the file; `qore clone <app>` writes a fresh one.\" })\n\nasync function readAt(dir: string): Promise<Workspace | null> {\n  const file = join(dir, WORKSPACE_FILE)\n  let raw: string\n  try {\n    raw = await readFile(file, \"utf8\")\n  } catch (e) {\n    const code = (e as NodeJS.ErrnoException).code\n    if (code === \"ENOENT\" || code === \"ENOTDIR\") return null\n    // Present but unreadable (EACCES, EISDIR, …): a broken workspace file, not \"no workspace\".\n    throw new QoreError(\"QORE_CONTEXT_INVALID\", `${file}: cannot be read (${code ?? \"unknown error\"})`, {\n      hint: \"Fix its permissions, or remove it; `qore clone <app>` writes a fresh one.\", cause: e,\n    })\n  }\n  let doc: Record<string, unknown>\n  try {\n    doc = JSON.parse(raw) as Record<string, unknown>\n  } catch {\n    throw invalid(file, \"not valid JSON\")\n  }\n  const v = doc?.schemaVersion\n  if (!Number.isInteger(v) || (v as number) < 1) throw invalid(file, \"schemaVersion must be a positive integer\")\n  if ((v as number) > 1) throw new QoreError(\"QORE_CONTEXT_UNSUPPORTED\", `${file} is newer than this qore`, { hint: \"Run: npm i -g @quatronic/qore\" })\n  if (typeof doc.portal !== \"string\" || !/^https?:\\/\\//.test(doc.portal)) throw invalid(file, \"portal must be a portal URL\")\n  if (typeof doc.appId !== \"string\" || !UUID.test(doc.appId)) throw invalid(file, \"appId must be an app id\")\n  return { root: dir, portal: new URL(doc.portal).origin.toLowerCase(), appId: doc.appId }\n}\n\n/** Reads the workspace file ONLY in `dir` — no walk. Used for the clone conflict check. */\nexport async function readWorkspace(dir: string): Promise<Workspace | null> {\n  return readAt(dir)\n}\n\n/** Walks up from `start`; the nearest file wins. The walk stops at `home` (inclusive) or the filesystem root. */\nexport async function findWorkspace(start: string, home: string): Promise<Workspace | null> {\n  let dir = resolve(start)\n  const stop = resolve(home)\n  for (;;) {\n    const ws = await readAt(dir)\n    if (ws) return ws\n    const up = dirname(dir)\n    if (dir === stop || up === dir) return null\n    dir = up\n  }\n}\n\n/** Atomic (temp file + rename) but NOT private: unlike qore's own config/cache files,\n * the workspace is an ordinary code checkout, so the root is created with the default\n * directory mode and the file with 0666 — both minus the umask, i.e. usually 0755/0644. */\nexport async function writeWorkspace(root: string, o: { portal: string; appId: string }): Promise<void> {\n  await mkdir(root, { recursive: true })\n  const tmp = join(root, `.${WORKSPACE_FILE}.${randomBytes(6).toString(\"hex\")}.tmp`)\n  try {\n    await writeFile(tmp, JSON.stringify({ schemaVersion: 1, portal: o.portal, appId: o.appId }, null, 2) + \"\\n\", { mode: 0o666 })\n    await rename(tmp, join(root, WORKSPACE_FILE))\n  } catch (e) {\n    await rm(tmp, { force: true }).catch(() => {})\n    throw new QoreError(\"QORE_INTERNAL\", `could not write ${join(root, WORKSPACE_FILE)}`, { cause: e })\n  }\n}\n\n/** A workspace names one of the user's existing profiles, and never triggers a login. */\nexport async function workspacePortal(deps: Deps, ws: Workspace): Promise<PortalRef> {\n  const portal = resolvePortal(ws.portal, undefined)\n  const label = portal.builtin ?? portal.apiOrigin\n  const profile = (await deps.config.read()).profiles[portal.apiOrigin]\n  const loggedIn = profile && (await new TokenStore(deps.keychain, profileHash(profile.apiOrigin, profile.issuer)).getRefresh())\n  if (!loggedIn) {\n    throw new QoreError(\"QORE_NOT_LOGGED_IN\", `This workspace belongs to ${label}, which you are not logged in to`, {\n      hint: `Run \\`qore login --portal ${label}\\`.`,\n    })\n  }\n  return portal\n}\n","import { QoreError } from \"../errors.js\"\n\n/** A single safe path segment: lowercase alphanumeric, starting with a letter or digit,\n * dashes allowed after that. No `.`, `/`, `\\`, leading dot, or anything else. */\nconst SAFE_SEGMENT = /^[a-z0-9][a-z0-9-]*$/\n/** Windows device names: a directory called `con` or `lpt1` cannot be created (or opens\n * the device instead), whatever the case — slugs are lowercase already. */\nconst WINDOWS_RESERVED = /^(con|prn|aux|nul|com[1-9]|lpt[1-9])$/\n\n/** Defence in depth (never the only check — the server is trusted, but a slug going\n * straight into `join(root, slug)` deserves its own guard regardless): rejects anything\n * that is not a single safe path segment, in particular `..`, an absolute path and a\n * Windows reserved device name. */\nexport function isSafeSlug(slug: string): boolean {\n  return SAFE_SEGMENT.test(slug) && !WINDOWS_RESERVED.test(slug)\n}\n\nexport function unsafeSlugError(slug: string): QoreError {\n  return new QoreError(\"QORE_INTERNAL\", `\"${slug}\" is not a safe directory name`, {\n    hint: \"This looks like a portal bug — please report it.\",\n  })\n}\n","import type { ModuleResult } from \"../core/workspace/apply.js\"\nimport { ACCESS_CODES } from \"../core/workspace/diagnose.js\"\nimport { QoreError, type QoreErrorCode } from \"../core/errors.js\"\nimport type { Io } from \"./io.js\"\nimport { renderJson } from \"./render.js\"\n\n/** Global Constraints, \"Exit rule\": success needs at least one clone/present/fetched/\n * pulled/skipped module AND every failure to be an access failure. Otherwise the first\n * non-access failure's code wins, or — if nothing succeeded at all — the first failure's. */\nexport function exitFor(results: ModuleResult[]): QoreError | null {\n  const failures = results.filter((r) => r.status === \"failed\" || r.status === \"conflict\")\n  if (failures.length === 0) return null\n  const ok = results.some((r) => [\"cloned\", \"present\", \"fetched\", \"pulled\", \"skipped\"].includes(r.status))\n  const code = (r: ModuleResult) => (r.status === \"conflict\" ? \"QORE_WORKSPACE_CONFLICT\" : r.error?.code ?? \"QORE_INTERNAL\")\n  const nonAccess = failures.find((r) => !ACCESS_CODES.has(code(r)))\n  if (ok && !nonAccess) return null\n  const first = nonAccess ?? failures[0]!\n  // \"removed\" is a stray directory found on disk, never one of the app's own modules\n  // (plan.ts reports it by its .git entry alone, with no git call) — it can never fail,\n  // and doesn't count toward the app's module total either.\n  const moduleCount = results.filter((r) => r.status !== \"removed\").length\n  return new QoreError(code(first) as QoreErrorCode, `${failures.length} of ${moduleCount} modules need attention`, {\n    hint: first.error?.hint, details: { results },\n  })\n}\n\nconst FAILURE_LABELS: Record<string, string> = {\n  QORE_GITHUB_NOT_LINKED: \"GitHub not linked\",\n  QORE_REPO_NO_ACCESS: \"no repository access\",\n  QORE_REPO_ACCESS_PENDING: \"access pending\",\n  QORE_GIT_AUTH: \"git authentication\",\n}\n\n/** The first sentence of a hint, first letter lowercased, to read naturally after a dash.\n * Cutting a hint at the first \". \" can truncate a backtick-quoted URL or path that\n * itself contains \". \" (e.g. `` `https://example.com/a. b` ``). So a cut is only taken\n * at a \". \" that is followed by a non-space character (any ordinary sentence start, not\n * just an uppercase one — a hint may reasonably continue in lowercase, e.g. after a\n * code-quoted term) and that does not fall inside a backtick-quoted span; otherwise the\n * whole hint is kept. */\nfunction firstSentenceLower(hint: string | undefined): string {\n  if (!hint) return \"\"\n  let sentence = hint\n  const re = /\\. (?=\\S)/g\n  let m: RegExpExecArray | null\n  while ((m = re.exec(hint))) {\n    const before = hint.slice(0, m.index)\n    const backtickCount = (before.match(/`/g) ?? []).length\n    if (backtickCount % 2 === 0) {\n      sentence = hint.slice(0, m.index + 1)\n      break\n    }\n  }\n  sentence = sentence.trim()\n  return sentence.length ? sentence[0]!.toLowerCase() + sentence.slice(1) : sentence\n}\n\nfunction failedLine(r: ModuleResult): string {\n  const label = FAILURE_LABELS[r.error?.code ?? \"\"] ?? \"failed\"\n  const detail = firstSentenceLower(r.error?.hint)\n  return `✗ ${r.slug}   ${label}${detail ? ` — ${detail}` : \"\"}`\n}\n\nfunction line(r: ModuleResult, conflictCount: number): string {\n  switch (r.status) {\n    case \"cloned\":\n      return `✓ ${r.slug}   cloned${r.dir ? `  → ${r.dir}` : \"\"}`\n    case \"pulled\":\n      return `✓ ${r.slug}   pulled`\n    case \"present\":\n      return `  ${r.slug}   present`\n    case \"skipped\":\n      return `! ${r.slug}   skipped — ${r.reason}`\n    case \"no-repo\":\n      return `  ${r.slug}   ${r.reason ?? \"no repository yet\"}`\n    case \"removed\":\n      return `! ${r.slug}   not a module of this app — left in place`\n    case \"conflict\": {\n      // The Error hint (`renderError` prints it once on stderr) only ever carries the\n      // *first* non-access failure's remedy — `exitFor` picks one. With exactly one\n      // conflict that's this module's own remedy, so repeating it on the line would just\n      // duplicate it; the line stays short. With more than one conflict, every module\n      // past the first would otherwise lose its remedy entirely (it's not the one\n      // `exitFor` surfaced), so each line keeps its own.\n      const detail = conflictCount > 1 ? firstSentenceLower(r.error?.hint) : \"\"\n      return `✗ ${r.slug}   ${r.reason ?? \"conflict\"}${detail ? ` — ${detail}` : \"\"}`\n    }\n    case \"failed\":\n      return failedLine(r)\n    case \"fetched\":\n      return `  ${r.slug}   fetched`\n  }\n}\n\n/** One line per module. Consecutive `fetched` (or `pulled`) results collapse into a\n * single line, e.g. `  web, api   fetched` — the common case of a sync that changed\n * nothing worth calling out module by module. */\nexport function renderResults(io: Io, results: ModuleResult[], json: boolean): void {\n  if (json) {\n    renderJson(io, { results })\n    return\n  }\n  const conflictCount = results.filter((r) => r.status === \"conflict\").length\n  let i = 0\n  while (i < results.length) {\n    const r = results[i]!\n    if (r.status === \"fetched\" || r.status === \"pulled\") {\n      const group = [r]\n      let j = i + 1\n      while (j < results.length && results[j]!.status === r.status) {\n        group.push(results[j]!)\n        j++\n      }\n      io.out(`  ${group.map((g) => g.slug).join(\", \")}   ${r.status}`)\n      i = j\n      continue\n    }\n    io.out(line(r, conflictCount))\n    i++\n  }\n}\n\n/** Shared by `sync` and (Task 9) `clone`: computes the exit rule and renders the report.\n * In human mode the per-module lines are always printed — including on failure, since\n * otherwise a throw before rendering would leave the user with only the one-line summary\n * `renderError` prints on stderr and no idea which module needs attention. In `--json`\n * mode a failure renders nothing here: the single JSON document is `renderError`'s\n * `{ok:false, error: {..., details:{results}}}`, printed once by the program's own\n * error handler — printing a second, successful-looking `{ok:true, ...}` document first\n * would break the \"--json prints exactly one JSON document\" contract. */\nexport function reportWorkspaceRun(io: Io, results: ModuleResult[], json: boolean): QoreError | null {\n  const err = exitFor(results)\n  if (!err || !json) renderResults(io, results, json)\n  return err\n}\n","import { randomBytes } from \"node:crypto\"\nimport { chmod, readFile, realpath, rename, unlink, writeFile } from \"node:fs/promises\"\nimport { basename, dirname, join, relative } from \"node:path\"\nimport type { Command } from \"commander\"\nimport { moduleDefaults, readRepoConfig } from \"../../core/context/repoConfig.js\"\nimport { QoreError } from \"../../core/errors.js\"\nimport { fetchLocalEnv } from \"../../core/env/fetch.js\"\nimport { parseEnv } from \"../../core/env/merge.js\"\nimport { planPull, resolveTarget, type PullPlan } from \"../../core/env/pull.js\"\nimport { appFor, contextJson, moduleContextFor } from \"../context.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\nimport { ensureTrusted } from \"../trustPrompt.js\"\n\n/** Ruling T10-I1: spec §11.1 (\"values masked\") plus T8 (\"qore never prints values\")\n * override the brief's SDK maskSecret rule — every value in the conflict prompt is\n * masked, showing only its length, never its content (even for a non-sensitive key). */\nconst maskLen = (v: string | undefined) => (v === undefined ? \"(unset)\" : `•••• (${v.length} chars)`)\n\nasync function readOrNull(p: string): Promise<string | null> {\n  try { return await readFile(p, \"utf8\") } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return null\n    throw e\n  }\n}\n\n/** T10-WRITE + ruling T10-I2/I3: write via a temp file in the target's own directory,\n * created with \"wx\" (never follow a pre-existing path at the temp name) and mode 0600,\n * then rename over the target — never write through a symlink an attacker plants at the\n * target path after `resolveTarget` checked it. Cleaned up in a `finally`, which covers\n * every non-crash failure path (a kill between `writeFile` and `rename` is the one window\n * it cannot cover).\n *\n * The temp name is built to fall under the generated templates' own ignore patterns where\n * possible: next-base ignores `.env*.local`, so a `<name>.local` target gets a temp name\n * of `<name-without-.local>.qore-<hex>.local` (e.g. `.env.qore-ab12.local` for\n * `.env.local`), which still matches that pattern. A plain `.env` target has no such\n * pattern to fall under (node-backend-base ignores the literal `.env`, not `.env*`), so its\n * temp name is just `.env.qore-<hex>.tmp` — untracked-but-not-ignored is the accepted\n * residual risk for that crash window (M2). */\nasync function writeSecurely(target: string, text: string): Promise<void> {\n  const base = basename(target)\n  const tmpName = base.endsWith(\".local\")\n    ? `${base.slice(0, -\".local\".length)}.qore-${randomBytes(6).toString(\"hex\")}.local`\n    : `${base}.qore-${randomBytes(6).toString(\"hex\")}.tmp`\n  const tmp = join(dirname(target), tmpName)\n  try {\n    await writeFile(tmp, text, { mode: 0o600, flag: \"wx\" })\n    await chmod(tmp, 0o600)\n    await rename(tmp, target)\n  } finally {\n    await unlink(tmp).catch(() => {})\n  }\n}\n\ntype Flags = { module?: string; app?: string; target?: string; usePortal?: boolean; yes?: boolean }\n\nexport function registerEnv(program: Command, ctx: CommandContext): void {\n  const env = program.command(\"env\").description(\"Local environment\")\n  env.command(\"pull\").description(\"Write this module's local secrets into its env file\")\n    .option(\"--module <slug|id>\", \"the module (default: from this repository's git remote)\")\n    .option(\"--app <slug|id>\", \"the app, when the module is part of several\")\n    .option(\"--target <path>\", \"env file to write (inside the repository)\")\n    .option(\"--use-portal\", \"take the portal's value for keys that differ locally\")\n    .option(\"--yes\", \"trust this repository without asking\")\n    .action(async (f: Flags) => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const mc = await moduleContextFor(ctx, f, \"env pull\")\n      if (!mc.repoRoot) {\n        throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"env pull writes into a module repository\", { hint: \"cd into the module's repository.\" })\n      }\n      const app = await appFor(ctx, mc, f.app)\n      const cfg = await readRepoConfig(mc.repoRoot)\n      const defaults = moduleDefaults(mc.module.type)\n      // R11: --target resolves against the cwd; .qore.json's envFile resolves against the\n      // repository root. Both must still land inside the repository.\n      // Ruling T10-ORDER: target → trust → fetch, so --yes never saves trust for a pull\n      // whose target is then rejected.\n      const target = f.target\n        ? await resolveTarget(mc.repoRoot, f.target, deps.cwd)\n        : await resolveTarget(mc.repoRoot, cfg.envFile ?? defaults.envFile)\n      await ensureTrusted(ctx, mc, app, { yes: f.yes })\n      const existing = await readOrNull(target)\n      const example = existing === null ? await readOrNull(join(dirname(target), \".env.example\")) : null\n      const local = await fetchLocalEnv(deps, mc, app)\n      const inputs = {\n        existing, example, fetched: local.env, managed: local.managedKeys,\n        localSecrets: cfg.localSecrets ?? defaults.localSecrets,\n        defaultChoice: f.usePortal ? \"use-portal\" as const : \"keep\" as const,\n        random: () => randomBytes(32).toString(\"hex\"),\n      }\n      let plan = planPull(inputs)\n      if (plan.conflicts.length && io.interactive && !f.usePortal) {\n        const current = parseEnv(existing ?? example ?? \"\")\n        const choices: Record<string, \"keep\" | \"use-portal\"> = {}\n        let bulk: \"keep\" | \"use-portal\" | undefined\n        for (const key of plan.conflicts) {\n          if (bulk) { choices[key] = bulk; continue }\n          const pick = await io.select<\"keep\" | \"portal\" | \"all\" | \"skip\">(\n            `${key} differs  (local ${maskLen(current.get(key))}, portal ${maskLen(local.env[key])})`,\n            [{ name: \"keep local\", value: \"keep\" }, { name: \"use portal\", value: \"portal\" },\n             { name: \"use portal for all\", value: \"all\" }, { name: \"keep local for all\", value: \"skip\" }])\n          if (pick === \"all\") bulk = \"use-portal\"\n          if (pick === \"skip\") bulk = \"keep\"\n          choices[key] = pick === \"portal\" || pick === \"all\" ? \"use-portal\" : \"keep\"\n        }\n        plan = planPull({ ...inputs, choices })\n      }\n      // M5: when nothing changed, skip the write (and its rename/mtime bump — Next's dev\n      // server reloads env on mtime change) and only enforce the 0600 mode.\n      if (existing !== null && plan.text === existing) {\n        await chmod(target, 0o600)\n      } else {\n        await writeSecurely(target, plan.text)\n      }\n      // resolveTarget resolved through realpath (e.g. macOS's /var → /private/var), so the\n      // relative path must be computed against the repo root's realpath too.\n      const rel = relative(await realpath(mc.repoRoot), target)\n      if (g.json) {\n        const names: Omit<PullPlan, \"text\"> = {\n          created: plan.created, seededFromExample: plan.seededFromExample, added: plan.added,\n          updated: plan.updated, kept: plan.kept, replaced: plan.replaced, unchanged: plan.unchanged, generated: plan.generated,\n        }\n        renderJson(io, { context: contextJson(mc, app), target: rel, ...names })\n        return\n      }\n      if (plan.kept.length && !io.interactive) {\n        io.err(`! ${plan.kept.length} key(s) differ locally and were kept: ${plan.kept.join(\", \")} — --use-portal takes the portal's values`)\n      }\n      const parts = [\n        plan.added.length && `${plan.added.length} added`,\n        plan.updated.length && `${plan.updated.length} updated (managed)`,\n        plan.replaced.length && `${plan.replaced.length} replaced`,\n        plan.kept.length && `${plan.kept.length} kept (differs locally; --use-portal to overwrite)`,\n        plan.generated.length && `${plan.generated.length} generated`,\n      ].filter(Boolean)\n      io.out(`✓ ${rel}${plan.seededFromExample ? \" (created from .env.example)\" : \"\"} — ${parts.length ? parts.join(\", \") : \"up to date\"}`)\n    })\n}\n","import { readFile } from \"node:fs/promises\"\nimport { join } from \"node:path\"\nimport { QoreError } from \"../errors.js\"\n\nexport type RepoConfig = { envFile?: string; localSecrets?: string[] }\n\n// A field that would pick a resource or a server: refused so a repository cannot\n// steer secrets or tokens (spec §5.2, §10.1 T4/T5). Keep in step with schema/qore.schema.json.\nconst FORBIDDEN = [\"portal\", \"api\", \"apiOrigin\", \"issuer\", \"tenant\", \"tenantId\", \"app\", \"appId\", \"module\", \"moduleId\"]\nconst KEY = /^[A-Za-z_][A-Za-z0-9_]*$/\n\nconst invalid = (msg: string, details?: Record<string, unknown>) =>\n  new QoreError(\"QORE_CONTEXT_INVALID\", `.qore.json: ${msg}`, { hint: \"Fix .qore.json in the repository root; see the $schema it names.\", details })\n\nexport function moduleDefaults(type: string): { envFile: string; localSecrets: string[] } {\n  return type === \"frontend\"\n    ? { envFile: \".env.local\", localSecrets: [\"SESSION_COOKIE_SECRET\"] }\n    : { envFile: \".env\", localSecrets: [] }\n}\n\nexport async function readRepoConfig(root: string): Promise<RepoConfig> {\n  let raw: string\n  try { raw = await readFile(join(root, \".qore.json\"), \"utf8\") } catch (e) {\n    if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return {}\n    throw e\n  }\n  let doc: Record<string, unknown>\n  try { doc = JSON.parse(raw) as Record<string, unknown> } catch { throw invalid(\"not valid JSON\") }\n  if (!doc || typeof doc !== \"object\" || Array.isArray(doc)) throw invalid(\"must be an object\")\n  // M9: `??` would also default an explicit `null` to 1, silently accepting a value the\n  // schema (`\"type\": \"integer\"`) rejects. Only a genuinely absent key gets the default.\n  const v = doc.schemaVersion === undefined ? 1 : doc.schemaVersion\n  if (!Number.isInteger(v) || (v as number) < 1) throw invalid(\"schemaVersion must be a positive integer\")\n  if ((v as number) > 1) {\n    throw new QoreError(\"QORE_CONTEXT_UNSUPPORTED\", `.qore.json schemaVersion ${v} is newer than this qore`, { hint: \"Run: npm i -g @quatronic/qore\" })\n  }\n  for (const f of FORBIDDEN) if (f in doc) throw invalid(`\"${f}\" is not allowed — .qore.json never selects a portal or a resource`, { field: f })\n  const out: RepoConfig = {}\n  if (doc.envFile !== undefined) {\n    if (typeof doc.envFile !== \"string\" || !doc.envFile) throw invalid(\"envFile must be a non-empty string\")\n    out.envFile = doc.envFile\n  }\n  if (doc.localSecrets !== undefined) {\n    if (!Array.isArray(doc.localSecrets) || !doc.localSecrets.every((k) => typeof k === \"string\" && KEY.test(k))) {\n      throw invalid(\"localSecrets must be a list of env key names\")\n    }\n    // M9: the schema declares `uniqueItems`; reject a duplicate rather than silently\n    // deduplicating, for consistency with the schemaVersion fix above (reject, don't coerce).\n    if (new Set(doc.localSecrets).size !== doc.localSecrets.length) throw invalid(\"localSecrets must not contain duplicates\")\n    out.localSecrets = doc.localSecrets as string[]\n  }\n  return out\n}\n","import { isAbsolute, join, relative } from \"node:path\"\nimport { ensureCapability } from \"../api/capabilities.js\"\nimport { TokenStore } from \"../auth/tokenStore.js\"\nimport type { CliAppModules, CliMe, CliModuleDetail, CliRef, CliRepoResolve } from \"../api/types.js\"\nimport type { QoreConfig } from \"../config.js\"\nimport type { Deps } from \"../deps.js\"\nimport { CancelledError, QoreError, type Candidate, type QoreErrorCode } from \"../errors.js\"\nimport { BUILTIN_PORTALS, profileHash, resolvePortal, type PortalRef } from \"../profiles.js\"\nimport { openSession, type Session } from \"../session.js\"\nimport type { Remote } from \"../../platform/git.js\"\nimport { findWorkspace, readWorkspace, workspacePortal, type Workspace } from \"../workspace/file.js\"\nimport { ResolutionCache } from \"./cache.js\"\nimport { repoKey } from \"./repoKey.js\"\nimport { findRepoRoot } from \"./repoRoot.js\"\n\nexport type ContextSource =\n  | { kind: \"remote\"; remote: string; url: string }\n  | { kind: \"flag\"; overrides?: string } // overrides = the remote whose derived module differs from --module\n  | { kind: \"workspace\" } // picked among the workspace's modules in a workspace root\nexport type ModuleContext = {\n  portal: PortalRef; session: Session; module: CliModuleDetail; source: ContextSource; repoRoot: string | null\n  workspace: Workspace | null\n}\ntype Keyed = Remote & { key: string }\ntype Opts = {\n  portal?: string\n  module?: string\n  choose?: string // module id picked from QORE_CONTEXT_REQUIRED's module candidates\n  tenant?: string // tenant id picked from QORE_CONTEXT_REQUIRED's tenant candidates (--module <slug>)\n  command: string\n  onRequest?: (l: string) => void\n}\ntype Skipped = { profile: string; code: QoreErrorCode; message: string }\n\nconst UUID = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\nconst HINT_FLAG = \"cd into a module repository, or pass --module <slug|id>.\"\nconst RESOLVE = \"/api/cli/v1/repos/resolve\"\n\n/** Errors that make one profile unusable for this walk without saying anything about the\n * repository: the portal is unreachable, or the profile has no usable token (spec §3, §14.2). */\nconst SKIPPABLE = new Set<QoreErrorCode>([\n  \"QORE_API_UNREACHABLE\", \"QORE_API_UNAVAILABLE\", \"QORE_AUTH_UNAVAILABLE\",\n  \"QORE_NOT_LOGGED_IN\", \"QORE_SESSION_EXPIRED\",\n])\n\nconst label = (p: PortalRef) => p.builtin ?? p.apiOrigin\n\n/** origin first, then upstream, then the rest in git order. */\nfunction byPreference(remotes: Keyed[]): Keyed[] {\n  const rank = (r: Keyed) => (r.name === \"origin\" ? 0 : r.name === \"upstream\" ? 1 : 2)\n  return [...remotes].sort((a, b) => rank(a) - rank(b)) // stable: git order within a rank\n}\nconst preferred = (remotes: Keyed[]): Keyed => byPreference(remotes)[0]!\n\n/** null outside a repository. A failing `git remote` (a broken or half-initialised\n * repository) counts as \"no remotes\" so it ends in QORE_CONTEXT_REQUIRED rather than\n * QORE_INTERNAL; git missing from PATH stays QORE_GIT_UNAVAILABLE. */\nasync function repoRemotes(deps: Deps): Promise<{ root: string; keyed: Keyed[]; gitError?: QoreError } | null> {\n  const root = await findRepoRoot(deps.cwd)\n  if (!root) return null\n  let remotes: Remote[]\n  try {\n    remotes = await deps.git.remotes(root)\n  } catch (e) {\n    if (e instanceof QoreError && e.code !== \"QORE_GIT_UNAVAILABLE\") return { root, keyed: [], gitError: e }\n    throw e\n  }\n  const keyed = remotes.map((r) => ({ ...r, key: repoKey(r.url) })).filter((r): r is Keyed => r.key !== null)\n  return { root, keyed }\n}\n\nfunction detail(session: Session, id: string): Promise<CliModuleDetail> {\n  return session.api.get<CliModuleDetail>(`/api/cli/v1/modules/${encodeURIComponent(id)}`)\n}\n\n/** Spec §5.3: with --module inside a repository, the remote's own module is derived too\n * (cache first, else one repos/resolve on the same profile) so the context line can say\n * \"--module, overrides <remote>\". Best effort: any failure means \"nothing derived\". */\nasync function flagOverrides(deps: Deps, session: Session, portal: PortalRef, cache: ResolutionCache, moduleId: string) {\n  try {\n    const keyed = (await repoRemotes(deps))?.keyed ?? []\n    const derived = new Map<string, Set<string>>()\n    const uncached: string[] = []\n    for (const key of new Set(keyed.map((r) => r.key))) {\n      const id = await cache.get(portal.apiOrigin, key)\n      if (id) derived.set(key, new Set([id]))\n      else uncached.push(key)\n    }\n    if (uncached.length > 0) {\n      try {\n        const { matches } = await session.api.post<CliRepoResolve>(RESOLVE, { repoKeys: uncached })\n        for (const m of matches) derived.set(m.repoKey, (derived.get(m.repoKey) ?? new Set()).add(m.module.id))\n        const ids = new Set(matches.map((m) => m.module.id))\n        if (ids.size === 1) for (const m of matches) await cache.put(portal.apiOrigin, m.repoKey, m.module.id)\n      } catch (e) { if (e instanceof CancelledError) throw e /* else best effort */ }\n    }\n    return byPreference(keyed).find((r) => [...(derived.get(r.key) ?? [])].some((id) => id !== moduleId))?.name\n  } catch (e) {\n    if (e instanceof CancelledError) throw e // Ctrl+C is never \"best effort\"\n    return undefined\n  }\n}\n\n/** Spec §3: `--portal` > workspace `portal` > `defaultProfile`. The workspace portal must be\n * a logged-in profile (QORE_NOT_LOGGED_IN otherwise, no request anywhere). */\nexport async function flagPortal(deps: Deps, portalArg: string | undefined, ws: Workspace | null): Promise<PortalRef> {\n  if (!portalArg && ws) return workspacePortal(deps, ws)\n  return resolvePortal(portalArg, (await deps.config.read()).defaultProfile)\n}\n\n/** The workspace app's modules. When `--portal` sent the request elsewhere and the app is not\n * there, the hint names the portal the workspace belongs to. */\nexport async function workspaceAppModules(session: Session, portal: PortalRef, ws: Workspace): Promise<CliAppModules> {\n  try {\n    return await session.api.get<CliAppModules>(`/api/cli/v1/apps/${encodeURIComponent(ws.appId)}/modules`)\n  } catch (e) {\n    if (e instanceof QoreError && e.code === \"QORE_RESOURCE_NOT_FOUND\" && portal.apiOrigin !== ws.portal) {\n      const p = resolvePortal(ws.portal, undefined)\n      const name = p.builtin ?? p.apiOrigin\n      throw withDetails(e, { workspacePortal: p.apiOrigin }, `This workspace belongs to ${name}; drop --portal, or pass --portal ${name}.`)\n    }\n    throw e\n  }\n}\n\nasync function byFlag(deps: Deps, o: Opts, cache: ResolutionCache, ws: Workspace | null): Promise<ModuleContext> {\n  const portal = await flagPortal(deps, o.portal, ws)\n  const session = await openSession(deps, portal, o.command, o.onRequest)\n  await ensureCapability(deps, portal.apiOrigin, \"repo.resolve\")\n  let id = o.module!\n  if (!UUID.test(id)) {\n    let tenantId = o.tenant ?? session.profile.activeTenant?.id\n    if (!tenantId) {\n      const me = await session.api.get<CliMe>(\"/api/cli/v1/me\")\n      // /me lists only developer (non end_user) memberships.\n      if (me.tenants.length === 0) {\n        throw new QoreError(\"QORE_NO_DEVELOPER_ACCESS\", \"Your account is not a developer in any organisation\", {\n          hint: \"Ask an admin to invite you as a developer.\",\n        })\n      }\n      if (me.tenants.length > 1) {\n        const candidates: Candidate[] = me.tenants.map((t) => ({ kind: \"tenant\", id: t.id, slug: t.slug, name: t.name }))\n        throw new QoreError(\"QORE_CONTEXT_REQUIRED\", `Which tenant is \"${id}\" in?`, {\n          hint: \"Run `qore tenant use <slug>`, or pass the module id.\", candidates,\n        })\n      }\n      tenantId = me.tenants[0]!.id\n    }\n    id = (await session.api.get<{ id: string }>(\n      `/api/cli/v1/tenants/${encodeURIComponent(tenantId)}/modules/resolve?slug=${encodeURIComponent(id)}`)).id\n  }\n  const module = await detail(session, id)\n  const overrides = await flagOverrides(deps, session, portal, cache, module.id)\n  const repoRoot = await findRepoRoot(deps.cwd)\n  return { portal, session, module, source: overrides ? { kind: \"flag\", overrides } : { kind: \"flag\" }, repoRoot, workspace: ws }\n}\n\n/** True when `dir` lies strictly below `root`. */\nconst isBelow = (root: string, dir: string) => {\n  const rel = relative(root, dir)\n  return rel !== \"\" && !rel.startsWith(\"..\") && !isAbsolute(rel)\n}\n\n/** Spec §5.3: a workspace root is \"in a workspace, not inside one of its repositories\" —\n * no repository at all, or one strictly ABOVE the workspace root (a whole workspace kept in\n * one git repository). A repository whose root is the workspace root or below it resolves\n * by its remote: a committed qore.workspace.json never steers module choice. */\nasync function inWorkspaceRoot(deps: Deps, ws: Workspace | null): Promise<boolean> {\n  if (!ws) return false\n  const repoRoot = await findRepoRoot(deps.cwd)\n  return repoRoot === null || isBelow(repoRoot, ws.root)\n}\n\n/** In a workspace root with no --module: a picked module (`o.choose`) is fetched directly on\n * the workspace session — never through byFlag, which would slug-resolve a non-UUID id —\n * otherwise the workspace's modules come back as QORE_CONTEXT_REQUIRED candidates. */\nasync function inWorkspace(deps: Deps, o: Opts, ws: Workspace, portal: PortalRef): Promise<ModuleContext> {\n  const session = await openSession(deps, portal, o.command, o.onRequest)\n  if (o.choose) {\n    // repoRoot null: a pick in the root never names a repository to write into (an outer\n    // repository, or <ws>/<slug> whose remote was never checked).\n    return { portal, session, module: await detail(session, o.choose), source: { kind: \"workspace\" }, repoRoot: null, workspace: ws }\n  }\n  await ensureCapability(deps, portal.apiOrigin, \"app.modules\")\n  const app = await workspaceAppModules(session, portal, ws)\n  const candidates: Candidate[] = app.modules.map((m) => ({\n    kind: \"module\", id: m.id, slug: m.slug, name: m.name, tenant: app.app.tenant.slug, remote: \"workspace\",\n  }))\n  throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"In a workspace root — which module?\", {\n    hint: \"cd into a module, or pass --module <slug>.\", candidates,\n  })\n}\n\n/** The workspace whose file sits in the cwd itself, else null. `status` uses it to show\n * the app-level view instead of asking for a module. The same strict-root rule as\n * `inWorkspaceRoot` applies: a module repository with a committed qore.workspace.json at\n * its own root is that module, not a workspace root. */\nexport async function workspaceRoot(deps: Deps): Promise<Workspace | null> {\n  const ws = await readWorkspace(deps.cwd)\n  return ws && (await inWorkspaceRoot(deps, ws)) ? ws : null\n}\n\nfunction profileOrder(cfg: QoreConfig, cachedOrigins: string[], portalArg?: string, wsPortal?: PortalRef): PortalRef[] {\n  if (portalArg) return [resolvePortal(portalArg, cfg.defaultProfile)]\n  const rank = (o: string) => (o === BUILTIN_PORTALS.prod.apiOrigin ? 0 : o === BUILTIN_PORTALS.staging.apiOrigin ? 1 : 2)\n  const rest = Object.keys(cfg.profiles).sort((a, b) => rank(a) - rank(b) || a.localeCompare(b))\n  // Cached origins are filtered to known profiles *before* parsing: a garbage origin in the\n  // cache file must not become QORE_CONTEXT_INVALID (a malformed cache is an empty cache).\n  const cached = cachedOrigins.filter((c) => cfg.profiles[c])\n  // Spec §3: the workspace portal comes before the cache (already checked to be logged in).\n  const origins = [...(wsPortal ? [wsPortal.apiOrigin] : []), ...cached, resolvePortal(undefined, cfg.defaultProfile).apiOrigin, ...rest]\n  return [...new Set(origins)].filter((c) => cfg.profiles[c]).map((c) => resolvePortal(c, undefined))\n}\n\n/** Merge extra `details` onto a QoreError, keeping its other fields (status, requestId,\n * candidates, serverCode) and chaining the original as `cause`. An explicit `hint`\n * replaces the original's; omitted, the original's hint carries over. Shared with\n * `core/env/fetch.ts` so both callers wrap an upstream error the same way. */\nexport function withDetails(e: QoreError, extra: Record<string, unknown>, hint?: string): QoreError {\n  return new QoreError(e.code, e.message, {\n    hint: hint ?? e.hint, status: e.status, requestId: e.requestId, candidates: e.candidates, serverCode: e.serverCode,\n    details: { ...e.details, ...extra }, cause: e,\n  })\n}\n\n/** One profile of the walk: the module, null for \"no match here\", or a throw. */\nasync function onProfile(deps: Deps, o: Opts, cache: ResolutionCache, portal: PortalRef, keyed: Keyed[], keys: string[],\n  repoRoot: string, workspace: Workspace | null, unsupported: (e: QoreError) => void): Promise<ModuleContext | null> {\n  const session = await openSession(deps, portal, o.command, o.onRequest)\n  try {\n    await ensureCapability(deps, portal.apiOrigin, \"repo.resolve\")\n  } catch (e) {\n    // A transport failure is a skippable profile (rethrown to the walk), not \"unsupported\".\n    if (!(e instanceof QoreError) || e.code !== \"QORE_UNSUPPORTED_BY_SERVER\") throw e\n    unsupported(e)\n    return null\n  }\n\n  // The cache may answer only when it cannot contradict spec §5.2: every keyed remote is\n  // cached to one and the same module, or not cached at all. Remotes cached to different\n  // modules go to repos/resolve, which decides (and asks when several match).\n  const hits: { remote: Keyed; id: string }[] = []\n  for (const r of byPreference(keyed)) {\n    const id = await cache.get(portal.apiOrigin, r.key)\n    if (id) hits.push({ remote: r, id })\n  }\n  if (hits.length > 0 && hits.every((h) => h.id === hits[0]!.id)) {\n    const { remote: r, id } = hits[0]!\n    try {\n      return { portal, session, module: await detail(session, id), source: { kind: \"remote\", remote: r.name, url: r.url }, repoRoot, workspace }\n    } catch (e) {\n      if (!(e instanceof QoreError) || e.code !== \"QORE_RESOURCE_NOT_FOUND\") throw e\n      for (const h of hits) await cache.drop(portal.apiOrigin, h.remote.key)\n    }\n  }\n\n  const { matches } = await session.api.post<CliRepoResolve>(RESOLVE, { repoKeys: keys })\n  const ids = [...new Set(matches.map((m) => m.module.id))]\n  if (ids.length === 0) return null\n  let id = ids[0]!\n  if (ids.length > 1) {\n    if (o.choose && ids.includes(o.choose)) id = o.choose\n    else {\n      const candidates: Candidate[] = ids.map((mid) => {\n        const own = matches.filter((m) => m.module.id === mid)\n        const m = own[0]!\n        const remote = preferred(keyed.filter((r) => own.some((x) => x.repoKey === r.key))).name\n        return { kind: \"module\", id: m.module.id, slug: m.module.slug, name: m.module.name, remote, tenant: m.tenant.slug }\n      })\n      throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"This repository's remotes match several modules\", {\n        hint: \"Pass --module <slug|id>.\", candidates,\n      })\n    }\n  }\n  const matchedKeys = new Set(matches.filter((m) => m.module.id === id).map((m) => m.repoKey))\n  // Only an unambiguous match is cached (spec §5.2): a pick among several must be asked again.\n  if (ids.length === 1) for (const k of matchedKeys) await cache.put(portal.apiOrigin, k, id)\n  const remote = preferred(keyed.filter((r) => matchedKeys.has(r.key)))\n  return { portal, session, module: await detail(session, id), source: { kind: \"remote\", remote: remote.name, url: remote.url }, repoRoot, workspace }\n}\n\nasync function anyLoggedIn(deps: Deps, cfg: QoreConfig): Promise<boolean> {\n  for (const p of Object.values(cfg.profiles)) {\n    if (await new TokenStore(deps.keychain, profileHash(p.apiOrigin, p.issuer)).getRefresh()) return true\n  }\n  return false\n}\n\nexport async function resolveModuleContext(deps: Deps, o: Opts): Promise<ModuleContext> {\n  const cache = new ResolutionCache(join(deps.config.dir, \"cache\"), deps.now)\n  const ws = await findWorkspace(deps.cwd, deps.home)\n  if (o.module) return byFlag(deps, o, cache, ws)\n\n  // Login before repository: a logged-out user cannot pass --module either, so\n  // \"log in\" is the more useful first answer (pinned by the E2E test in Task 13).\n  const cfg = await deps.config.read()\n  const first = resolvePortal(o.portal, cfg.defaultProfile)\n  // Based on tokens, not rows: `qore logout` clears the keychain but keeps the profile row.\n  // A workspace names its portal: not logged in there is QORE_NOT_LOGGED_IN naming it,\n  // before any request to another portal (spec §3).\n  const wsPortal = ws && !o.portal ? await workspacePortal(deps, ws) : undefined\n  if (o.portal || !(await anyLoggedIn(deps, cfg))) {\n    await openSession(deps, first, o.command) // throws QORE_NOT_LOGGED_IN with the right hint\n  }\n\n  if (ws && (await inWorkspaceRoot(deps, ws))) return inWorkspace(deps, o, ws, wsPortal ?? first)\n  const repo = await repoRemotes(deps)\n  if (repo === null) throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"Not inside a module repository\", { hint: HINT_FLAG })\n  const { root, keyed, gitError } = repo\n  if (keyed.length === 0) {\n    // git's own last stderr line (e.g. \"detected dubious ownership\") says why there are\n    // no remotes; without it the message would claim the opposite of the truth (§14.1).\n    const said = gitError?.hint\n    throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"This repository has no remote Qore can match\", {\n      hint: said ? `${HINT_FLAG} git said: ${said}` : HINT_FLAG,\n      details: gitError ? { git: said ?? gitError.message } : undefined,\n      cause: gitError,\n    })\n  }\n  const keys = [...new Set(keyed.map((r) => r.key))]\n\n  const tried: string[] = []      // every profile walked, in order\n  const answered: string[] = []   // profiles whose repos/resolve answered \"no match\"\n  const skipped: Skipped[] = []\n  const skipErrors: QoreError[] = []\n  let unsupported: QoreError | undefined\n  for (const portal of profileOrder(cfg, await cache.originsFor(keys), o.portal, wsPortal)) {\n    tried.push(label(portal))\n    let capabilityMissing = false\n    try {\n      const mc = await onProfile(deps, o, cache, portal, keyed, keys, root, ws, (e) => {\n        capabilityMissing = true\n        unsupported ??= e\n        skipped.push({ profile: label(portal), code: e.code, message: e.message })\n      })\n      if (mc) return mc\n      if (!capabilityMissing) answered.push(label(portal))\n    } catch (e) {\n      if (!(e instanceof QoreError) || !SKIPPABLE.has(e.code)) throw e\n      skipped.push({ profile: label(portal), code: e.code, message: e.message })\n      skipErrors.push(e)\n    }\n  }\n\n  const details: Record<string, unknown> = { triedProfiles: tried }\n  if (skipped.length > 0) details.skippedProfiles = skipped\n  if (answered.length === 0) {\n    // No profile could say anything about this repository: its own failure is the answer\n    // (unreachable → QORE_API_UNREACHABLE, no token → QORE_NOT_LOGGED_IN, too old →\n    // QORE_UNSUPPORTED_BY_SERVER), not \"no module selected\".\n    const cause = skipErrors[0] ?? unsupported\n    if (cause) throw withDetails(cause, details)\n  }\n  const unchecked = skipped.length ? ` ${skipped.map((s) => s.profile).join(\", \")} could not be checked (${skipped.map((s) => s.code).join(\", \")}).` : \"\"\n  // A staging row without a usable token needs the same remedy as no staging row at all.\n  const stagingLoggedIn = Boolean(cfg.profiles[BUILTIN_PORTALS.staging.apiOrigin])\n    && !skipped.some((s) => s.profile === \"staging\" && (s.code === \"QORE_NOT_LOGGED_IN\" || s.code === \"QORE_SESSION_EXPIRED\"))\n  throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"No module selected\", {\n    hint: `This repository's remotes match no module you can access on ${answered.join(\", \")}; pass --module <slug|id>.`\n      + unchecked\n      + (stagingLoggedIn ? \"\" : \" If it is a staging repository, run `qore login --portal staging`.\"),\n    details,\n  })\n}\n\nconst appCandidates = (apps: CliRef[]): Candidate[] => apps.map((a) => ({ kind: \"app\", id: a.id, slug: a.slug, name: a.name }))\n\nexport function pickApp(mc: Pick<ModuleContext, \"module\"> & { workspace?: Workspace | null }, app?: string): CliRef {\n  const apps = mc.module.apps\n  if (app) {\n    const found = apps.find((a) => a.id === app || a.slug === app)\n    if (!found) {\n      throw new QoreError(\"QORE_RESOURCE_NOT_FOUND\", `${mc.module.slug} is not part of an app \"${app}\" you can read`, {\n        candidates: appCandidates(apps),\n      })\n    }\n    return found\n  }\n  if (apps.length === 1) return apps[0]!\n  if (apps.length === 0) throw new QoreError(\"QORE_RESOURCE_NOT_FOUND\", `${mc.module.slug} is not part of an app you can read`)\n  // Spec §5.2: the workspace's appId disambiguates a shared module.\n  const wsApp = mc.workspace && apps.find((a) => a.id === mc.workspace!.appId)\n  if (wsApp) return wsApp\n  throw new QoreError(\"QORE_APP_AMBIGUOUS\", `${mc.module.slug} is part of several apps`, { hint: \"Pass --app <slug>.\", candidates: appCandidates(apps) })\n}\n","import { stat } from \"node:fs/promises\"\nimport { dirname, join, resolve } from \"node:path\"\n\n/** The first directory upwards that holds `.git` — a directory, or a file in a\n * worktree or submodule (spec §5.2 step 1, §15). */\nexport async function findRepoRoot(start: string): Promise<string | null> {\n  let dir = resolve(start)\n  for (;;) {\n    try {\n      await stat(join(dir, \".git\"))\n      return dir\n    } catch { /* not here (or unreadable): keep walking up */ }\n    const up = dirname(dir)\n    if (up === dir) return null\n    dir = up\n  }\n}\n","import { ensureCapability } from \"../api/capabilities.js\"\nimport type { CliLocalEnv, CliRef } from \"../api/types.js\"\nimport { withDetails } from \"../context/resolver.js\"\nimport type { ModuleContext } from \"../context/resolver.js\"\nimport type { Deps } from \"../deps.js\"\nimport { QoreError } from \"../errors.js\"\n\nexport async function fetchLocalEnv(deps: Deps, mc: ModuleContext, app: CliRef): Promise<CliLocalEnv> {\n  await ensureCapability(deps, mc.portal.apiOrigin, \"module.local-env\")\n  try {\n    return await mc.session.api.get<CliLocalEnv>(\n      `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/local-env?app_id=${encodeURIComponent(app.id)}`)\n  } catch (e) {\n    if (!(e instanceof QoreError) || e.code !== \"QORE_ACCESS_DENIED\") throw e\n    if (e.serverCode === \"app.access.denied\") {\n      throw withDetails(e, { required: \"write\", have: mc.module.access },\n        `You have ${mc.module.access} on ${mc.module.slug}; local secrets need write. Ask a maintainer of the app's dev team for write access.`)\n    }\n    // C13: a token minted before qore:local-env existed as a scope.\n    if (e.serverCode === \"auth.scope.insufficient\") throw withDetails(e, {}, \"Run `qore login` again.\")\n    throw e\n  }\n}\n","/** .env merge semantics, ported behaviour-identically from qdc-sdk\n * packages/sdk/src/cli/setup-env-core.ts (spec §11.1). Keep the two in step until\n * the SDK's copy is removed in migration phase 2. */\n\n/** Parse `.env` text into an ordered Map<key,value>. Comments and blank lines\n *  are not represented (preserved separately by renderEnv). */\nexport function parseEnv(contents: string): Map<string, string> {\n  const map = new Map<string, string>()\n  for (const line of contents.split(\"\\n\")) {\n    const m = line.replace(/\\r$/, \"\").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/)\n    if (m?.[1] !== undefined && m[2] !== undefined) map.set(m[1], m[2])\n  }\n  return map\n}\n\n/** Does `key` match one of the portal's managed-key patterns? Exact match, or\n *  the single wildcard form `PREFIX_*` used for CONN_*. */\nexport function isManagedKey(key: string, managed: string[]): boolean {\n  for (const pattern of managed) {\n    if (pattern.endsWith(\"*\")) {\n      if (key.startsWith(pattern.slice(0, -1))) return true\n    } else if (key === pattern) return true\n  }\n  return false\n}\n\nexport function planEnvUpdate({\n  current,\n  fetched,\n  choices = {},\n  defaultChoice = \"keep\",\n  managed = [],\n}: {\n  current: Map<string, string>\n  fetched: Record<string, string>\n  choices?: Record<string, \"keep\" | \"use-portal\">\n  defaultChoice?: \"keep\" | \"use-portal\"\n  managed?: string[]\n}): {\n  merged: Map<string, string>\n  conflicts: string[]\n  added: string[]\n  unchanged: string[]\n  overwritten: string[]\n} {\n  const merged = new Map(current)\n  const conflicts: string[] = []\n  const added: string[] = []\n  const unchanged: string[] = []\n  const overwritten: string[] = []\n\n  for (const [key, portalValue] of Object.entries(fetched)) {\n    const hasLocal = current.has(key)\n    const localValue = current.get(key)\n    const localEmpty = !hasLocal || localValue === \"\" || localValue === '\"\"' || localValue === \"''\"\n\n    if (localEmpty) {\n      merged.set(key, portalValue)\n      added.push(key)\n      continue\n    }\n    if (localValue === portalValue) {\n      unchanged.push(key)\n      continue\n    }\n    // The portal owns this key: take its value without asking. Anything the\n    // developer needs to override permanently belongs in the portal as a\n    // `local` secret, not in a hand-edited .env.local.\n    if (isManagedKey(key, managed)) {\n      merged.set(key, portalValue)\n      overwritten.push(key)\n      continue\n    }\n    conflicts.push(key)\n    const choice = choices[key] ?? defaultChoice\n    merged.set(key, choice === \"use-portal\" ? portalValue : localValue!)\n  }\n\n  return { merged, conflicts, added, unchanged, overwritten }\n}\n\n/** Render the merged Map back to `.env` text, preserving original comments,\n *  blank lines, and key order. New keys are appended at the end. */\nexport function renderEnv(original: string, merged: Map<string, string>): string {\n  const seen = new Set<string>()\n  const lines = original.split(\"\\n\")\n  const out = lines.map((line) => {\n    const m = line.replace(/\\r$/, \"\").match(/^([A-Za-z_][A-Za-z0-9_]*)=(.*)$/)\n    if (!m?.[1]) return line\n    const key: string = m[1]\n    if (!merged.has(key)) return line\n    seen.add(key)\n    return `${key}=${merged.get(key) ?? \"\"}`\n  })\n\n  const appended: string[] = []\n  for (const [key, value] of merged) {\n    if (!seen.has(key)) appended.push(`${key}=${value}`)\n  }\n\n  let text = out.join(\"\\n\")\n  if (appended.length) {\n    if (text.length && !text.endsWith(\"\\n\")) text += \"\\n\"\n    text += appended.join(\"\\n\") + \"\\n\"\n  }\n  return text\n}\n","import { lstat, realpath } from \"node:fs/promises\"\nimport { basename, dirname, isAbsolute, relative, resolve, sep } from \"node:path\"\nimport { QoreError } from \"../errors.js\"\nimport { parseEnv, planEnvUpdate, renderEnv } from \"./merge.js\"\n\nconst outside = (target: string) => new QoreError(\"QORE_CONTEXT_INVALID\", `The env file must be inside the repository (got ${target})`, {\n  hint: \"Use a path inside the repository for --target or .qore.json envFile.\",\n})\n\nconst symlinked = (target: string) => new QoreError(\"QORE_CONTEXT_INVALID\", `The env file target must not be a symlink (got ${target})`, {\n  hint: \"Use a path inside the repository for --target or .qore.json envFile.\",\n})\n\nfunction inside(root: string, p: string): boolean {\n  const rel = relative(root, p)\n  return rel !== \"\" && rel !== \"..\" && !rel.startsWith(\"..\" + sep) && !isAbsolute(rel)\n}\n\n/** Spec §11.1 step 3, carried over from qdc-setup-env — plus a realpath check, so a\n * symlinked directory cannot carry the write out of the repository (review focus 1).\n *\n * `base` is where `target` is resolved from: the cwd for `--target`, the repository root\n * for `.qore.json`'s `envFile` (ruling R11) — both must still land inside `root`. Both sides\n * are compared by realpath(root) so macOS's /var → /private/var symlink cannot make an\n * in-repo path look external (ruling B5). */\nexport async function resolveTarget(root: string, target: string, base: string = root): Promise<string> {\n  const realRoot = await realpath(root)\n  const realBase = base === root ? realRoot : await realpath(base)\n  const abs = resolve(realBase, target)\n  // I2: `abs` is not yet realpath'd, so an absolute target spelled through a symlinked\n  // directory (e.g. a repo under macOS /var, whose realpath is /private/var) would be\n  // falsely rejected here even though it lands inside the repository. Containment is\n  // enforced for real below, once the path is realpath'd (`final`, `realFinal`). This is\n  // only a cheap pre-filter for the common relative-escape case (`../../etc/passwd`),\n  // where realpath'ing an already-inside `abs` is pointless work to skip.\n  if (!isAbsolute(target) && !inside(realRoot, abs)) throw outside(target)\n  let parent: string\n  try { parent = await realpath(dirname(abs)) } catch (e) {\n    if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e\n    throw new QoreError(\"QORE_CONTEXT_INVALID\", `The directory for ${target} does not exist`, {\n      hint: \"Create the parent directory, or point --target / .qore.json envFile at an existing one.\",\n    })\n  }\n  const final = resolve(parent, basename(abs))\n  if (!inside(realRoot, final)) throw outside(target)\n\n  // Review focus 1: an existing final path component that is itself a symlink is refused\n  // outright — its target is never trusted, in or out of the repo — and if somehow not a\n  // symlink but its realpath still escapes, that is refused too.\n  try {\n    const st = await lstat(final)\n    if (st.isSymbolicLink()) throw symlinked(target)\n    const realFinal = await realpath(final)\n    if (!inside(realRoot, realFinal)) throw outside(target)\n  } catch (e) {\n    if (e instanceof QoreError) throw e\n    if ((e as NodeJS.ErrnoException).code !== \"ENOENT\") throw e\n  }\n\n  return final\n}\n\nexport type PullPlan = {\n  text: string; created: boolean; seededFromExample: boolean\n  added: string[]; updated: string[]; kept: string[]; replaced: string[]; unchanged: string[]; generated: string[]\n}\n\nexport function planPull(o: {\n  existing: string | null; example: string | null; fetched: Record<string, string>; managed: string[]\n  localSecrets: string[]; choices?: Record<string, \"keep\" | \"use-portal\">; defaultChoice: \"keep\" | \"use-portal\"; random: () => string\n}): PullPlan & { conflicts: string[] } {\n  const original = o.existing ?? o.example ?? \"\"\n  const current = parseEnv(original)\n  const r = planEnvUpdate({ current, fetched: o.fetched, choices: o.choices ?? {}, defaultChoice: o.defaultChoice, managed: o.managed })\n  const choiceOf = (k: string) => o.choices?.[k] ?? o.defaultChoice\n  const generated: string[] = []\n  for (const key of o.localSecrets) {\n    const v = r.merged.get(key)\n    if (v === undefined || v === \"\" || v === '\"\"' || v === \"''\") { r.merged.set(key, o.random()); generated.push(key) }\n  }\n  return {\n    text: renderEnv(original, r.merged),\n    created: o.existing === null,\n    seededFromExample: o.existing === null && o.example !== null,\n    added: r.added, updated: r.overwritten, unchanged: r.unchanged, conflicts: r.conflicts,\n    kept: r.conflicts.filter((k) => choiceOf(k) === \"keep\"),\n    replaced: r.conflicts.filter((k) => choiceOf(k) === \"use-portal\"),\n    generated,\n  }\n}\n","import type { CliRef } from \"../core/api/types.js\"\nimport { QoreError, type Candidate } from \"../core/errors.js\"\nimport { pickApp, resolveModuleContext, type ModuleContext } from \"../core/context/resolver.js\"\nimport { WORKSPACE_FILE } from \"../core/workspace/file.js\"\nimport type { CommandContext } from \"./program.js\"\n\nconst allOfKind = (c: Candidate[] | undefined, kind: Candidate[\"kind\"]): c is (Candidate & { id: string })[] =>\n  !!c && c.length > 0 && c.every((x) => x.kind === kind && typeof x.id === \"string\")\n\nexport async function moduleContextFor(ctx: CommandContext, flags: { module?: string }, command: string): Promise<ModuleContext> {\n  const g = ctx.opts()\n  const onRequest = g.verbose ? (l: string) => ctx.io.err(l) : undefined\n  const base = { portal: g.portal, module: flags.module, command, onRequest }\n  try {\n    return await resolveModuleContext(ctx.deps, base)\n  } catch (e) {\n    if (!(e instanceof QoreError) || e.code !== \"QORE_CONTEXT_REQUIRED\" || !ctx.io.interactive) throw e\n    // core/ never prompts (R5): it names the candidates, and only here do they become a picker.\n    if (allOfKind(e.candidates, \"module\")) {\n      const choose = await ctx.io.select(\"Select a module\",\n        e.candidates.map((c) => ({ name: `${c.tenant ? `${c.tenant} / ` : \"\"}${c.slug}  (${c.remote})`, value: c.id })))\n      return resolveModuleContext(ctx.deps, { ...base, choose })\n    }\n    if (allOfKind(e.candidates, \"tenant\")) {\n      const tenant = await ctx.io.select(\"Select a tenant\", e.candidates.map((c) => ({ name: c.name ?? c.slug, value: c.id })))\n      return resolveModuleContext(ctx.deps, { ...base, tenant })\n    }\n    throw e\n  }\n}\n\nexport async function appFor(ctx: CommandContext, mc: ModuleContext, app?: string): Promise<CliRef> {\n  try {\n    return pickApp(mc, app)\n  } catch (e) {\n    if (!(e instanceof QoreError) || e.code !== \"QORE_APP_AMBIGUOUS\" || !ctx.io.interactive) throw e\n    const id = await ctx.io.select(\"Select an app\", mc.module.apps.map((a) => ({ name: a.name, value: a.id })))\n    return pickApp(mc, id)\n  }\n}\n\nfunction sourceText(mc: ModuleContext): string {\n  if (mc.source.kind === \"remote\") return mc.source.remote\n  if (mc.source.kind === \"workspace\") return WORKSPACE_FILE\n  return mc.source.overrides ? `--module, overrides ${mc.source.overrides}` : \"--module\"\n}\n\nexport function contextLine(mc: ModuleContext, app?: CliRef): string {\n  const parts = [mc.module.tenant.name, ...(app ? [app.name] : []), mc.module.slug]\n  return `→ ${parts.join(\" / \")}  (${sourceText(mc)})`\n}\n\nexport function contextJson(mc: ModuleContext, app?: CliRef) {\n  const { id, slug, name, type, access } = mc.module\n  return {\n    portal: mc.portal.builtin ?? mc.portal.apiOrigin,\n    tenant: mc.module.tenant,\n    app: app ?? null,\n    module: { id, slug, name, type, access },\n    source: mc.source.kind === \"remote\" ? mc.source.remote : mc.source.kind === \"workspace\" ? WORKSPACE_FILE : \"--module\",\n    ...(mc.source.kind === \"flag\" && mc.source.overrides ? { overrides: mc.source.overrides } : {}),\n  }\n}\n","import type { CliRef } from \"../core/api/types.js\"\nimport { repoKey } from \"../core/context/repoKey.js\"\nimport type { ModuleContext } from \"../core/context/resolver.js\"\nimport { CancelledError, QoreError } from \"../core/errors.js\"\nimport { isTrusted, trust } from \"../core/trust.js\"\nimport { contextLine } from \"./context.js\"\nimport type { CommandContext } from \"./program.js\"\n\n/** Task 10: the trust interlock (spec §5.4) as a first-use prompt. Trust is a safety\n * interlock, not authorization — the server still authorizes every fetch.\n *\n * Ruling C8: the context line prints exactly once, here — before the trust prompt, and\n * also before the untrusted non-TTY error — so the caller (env.ts) must not print it\n * again after calling this. */\nexport async function ensureTrusted(ctx: CommandContext, mc: ModuleContext, app: CliRef, o: { yes?: boolean }): Promise<void> {\n  const root = mc.repoRoot ?? ctx.deps.cwd\n  if (!ctx.opts().json) ctx.io.err(contextLine(mc, app))\n  if (await isTrusted(ctx.deps, root, mc.module.id)) return\n  if (o.yes) { await trust(ctx.deps, root, mc.module.id); return }\n  if (!ctx.io.interactive) {\n    throw new QoreError(\"QORE_CONTEXT_REQUIRED\", `This repository is not trusted for ${mc.module.slug} yet`, {\n      hint: \"Run interactively once, or pass --yes.\", details: { reason: \"untrusted\", repository: root },\n    })\n  }\n  if (mc.source.kind === \"remote\") {\n    // I1: never print the raw remote URL — it may embed credentials (e.g. an\n    // https x-access-token PAT). Print the normalised repo key instead.\n    const key = repoKey(mc.source.url)\n    ctx.io.err(`  from remote ${mc.source.remote}: ${key ?? \"(unparsable remote URL)\"}`)\n  }\n  if (!(await ctx.io.confirm(\"Pull local secrets for this module into this repository?\"))) throw new CancelledError()\n  await trust(ctx.deps, root, mc.module.id)\n}\n","import * as oc from \"openid-client\"\nimport { CancelledError, QoreError } from \"../errors.js\"\nimport type { Fetch } from \"../api/http.js\"\nimport { isAbortError, networkError } from \"../api/http.js\"\n\nexport type DeviceStart = { userCode: string; verificationUri: string; verificationUriComplete?: string; expiresIn: number; handle: unknown }\nexport type TokenSet = { accessToken: string; refreshToken: string; expiresIn: number; scope: string; sub: string; email?: string }\n\nexport interface Oidc {\n  startDevice(scope: string): Promise<DeviceStart>\n  pollDevice(start: DeviceStart, signal: AbortSignal): Promise<TokenSet>\n  refresh(rt: string, scope?: string): Promise<TokenSet>\n  revoke(rt: string): Promise<void>\n}\n\nexport const LOGIN_SCOPE = \"openid profile email offline_access qore:read qore:local-env\"\n\nfunction decodeSub(accessToken: string): { sub: string; email?: string } {\n  const part = accessToken.split(\".\")[1] ?? \"\"\n  const claims = JSON.parse(Buffer.from(part, \"base64url\").toString(\"utf8\")) as { sub: string; email?: string }\n  return { sub: claims.sub, email: claims.email }\n}\n\nfunction toTokenSet(t: oc.TokenEndpointResponse, fallbackRt?: string): TokenSet {\n  const rt = t.refresh_token ?? fallbackRt\n  if (!rt) throw new QoreError(\"QORE_INTERNAL\", \"Keycloak returned no refresh token\")\n  return { accessToken: t.access_token, refreshToken: rt, expiresIn: t.expires_in ?? 600,\n    scope: t.scope ?? \"\", ...decodeSub(t.access_token) }\n}\n\n/** Keycloak unreachable is QORE_AUTH_UNAVAILABLE (spec §7, §14; R19), not the portal's\n * QORE_API_UNREACHABLE — with the same network diagnosis (hint, reason, host). */\nfunction unreachable(e: unknown, host: string): QoreError {\n  const n = networkError(e, host)\n  return new QoreError(\"QORE_AUTH_UNAVAILABLE\", n.message, { hint: n.hint, details: n.details, cause: e })\n}\n\nexport function mapOidcError(e: unknown, host: string): Error {\n  if (e instanceof QoreError || e instanceof CancelledError) return e\n  // Ctrl+C aborts the request's signal; openid-client wraps that DOMException as\n  // ClientError { code: \"OAUTH_ABORT\", cause }.\n  if (isAbortError(e) || (e as { code?: unknown })?.code === \"OAUTH_ABORT\" || isAbortError((e as { cause?: unknown })?.cause)) {\n    return new CancelledError()\n  }\n  const err = (e as { error?: string }).error\n  if (err === \"access_denied\") return new QoreError(\"QORE_LOGIN_DENIED\", \"The login was denied in the browser\")\n  if (err === \"expired_token\") return new QoreError(\"QORE_LOGIN_EXPIRED\", \"The login code expired\", { hint: \"Run `qore login` again.\" })\n  if (err === \"invalid_grant\") return new QoreError(\"QORE_SESSION_EXPIRED\", \"Your session has ended\", { hint: \"Run `qore login`.\" })\n  const status = (e as { status?: number }).status\n  if (status && status >= 500) return new QoreError(\"QORE_AUTH_UNAVAILABLE\", \"Keycloak is unavailable\", { cause: e })\n  if (e instanceof TypeError) return unreachable(e, host)\n  // openid-client sometimes wraps the raw fetch TypeError (DNS/TLS/connect/timeout) one\n  // level deep, e.g. `new ClientError(\"something went wrong\", { cause: err })`.\n  const cause = (e as { cause?: unknown })?.cause\n  if (cause instanceof TypeError) return unreachable(cause, host)\n  return new QoreError(\"QORE_AUTH_UNAVAILABLE\", \"Login failed\", { cause: e })\n}\n\nexport async function createOidc(opts: { issuer: string; clientId: string; fetch: Fetch }): Promise<Oidc> {\n  const host = new URL(opts.issuer).host\n  const execute = new URL(opts.issuer).protocol === \"http:\" ? [oc.allowInsecureRequests] : []\n  let config: oc.Configuration\n  try {\n    config = await oc.discovery(new URL(opts.issuer), opts.clientId, undefined, oc.None(), {\n      execute, [oc.customFetch]: opts.fetch as unknown as oc.CustomFetch,\n    })\n  } catch (e) { throw mapOidcError(e, host) }\n\n  return {\n    async startDevice(scope) {\n      try {\n        const r = await oc.initiateDeviceAuthorization(config, { scope })\n        return { userCode: r.user_code, verificationUri: r.verification_uri,\n          verificationUriComplete: r.verification_uri_complete, expiresIn: r.expires_in, handle: r }\n      } catch (e) { throw mapOidcError(e, host) }\n    },\n    async pollDevice(start, signal) {\n      try {\n        const t = await oc.pollDeviceAuthorizationGrant(config, start.handle as oc.DeviceAuthorizationResponse, undefined, { signal })\n        return toTokenSet(t)\n      } catch (e) { throw mapOidcError(e, host) }\n    },\n    async refresh(rt, scope) {\n      try {\n        const t = await oc.refreshTokenGrant(config, rt, scope ? { scope } : undefined)\n        return toTokenSet(t, rt)\n      } catch (e) { throw mapOidcError(e, host) }\n    },\n    async revoke(rt) {\n      try { await oc.tokenRevocation(config, rt, { token_type_hint: \"refresh_token\" }) }\n      catch (e) { throw mapOidcError(e, host) }\n    },\n  }\n}\n","import type { WithLock } from \"../../platform/lock.js\"\nimport type { DeviceStart, Oidc, TokenSet } from \"./oidc.js\"\nimport { LOGIN_SCOPE } from \"./oidc.js\"\nimport type { TokenStore } from \"./tokenStore.js\"\n\nexport async function deviceLogin(opts: {\n  oidc: Oidc\n  store: TokenStore\n  now: () => Date\n  /** Shows the code. Polling already runs meanwhile; `settled` aborts once it succeeds or\n   * fails, so a prompt waiting on the user (who may have opened the URL themselves) can end. */\n  onCode: (s: DeviceStart, settled: AbortSignal) => void | Promise<void>\n  signal: AbortSignal\n  withLock?: WithLock\n  lockName?: string\n}): Promise<TokenSet> {\n  // Probe the keychain first: an unusable or denied keychain must fail before the user\n  // approves anything in the browser (Review Focus #4), not after.\n  await opts.store.getRefresh()\n  const start = await opts.oidc.startDevice(LOGIN_SCOPE)\n  const stopPoll = new AbortController()\n  const settled = new AbortController()\n  const poll = opts.oidc.pollDevice(start, AbortSignal.any([opts.signal, stopPoll.signal]))\n    .finally(() => settled.abort())\n  // Awaited below; this only keeps a poll that fails while onCode runs from counting as unhandled.\n  poll.catch(() => {})\n  try {\n    await opts.onCode(start, settled.signal)\n  } catch (e) {\n    stopPoll.abort()\n    // Approved just before onCode failed: that session is never stored, so end it server-side.\n    const late = await poll.catch(() => null)\n    if (late) await opts.oidc.revoke(late.refreshToken).catch(() => {})\n    throw e\n  }\n  const t = await poll\n  const at = opts.now()\n  const write = async () => {\n    // Refresh first: a crash between the two writes then leaves a usable session.\n    await opts.store.setRefresh({ rt: t.refreshToken, sub: t.sub, scope: t.scope, obtainedAt: at.toISOString() })\n    await opts.store.setAccess({ at: t.accessToken, expiresAt: new Date(at.getTime() + t.expiresIn * 1000).toISOString() })\n  }\n  try {\n    if (opts.withLock && opts.lockName) await opts.withLock(opts.lockName, write)\n    else await write()\n  } catch (e) {\n    // The new session cannot be kept: end it server-side and drop any half-written entry.\n    // Both best-effort; the original (keychain) error is what the user needs to see.\n    await opts.oidc.revoke(t.refreshToken).catch(() => {})\n    await opts.store.clear().catch(() => {})\n    throw e\n  }\n  return t\n}\n","import type { Command } from \"commander\"\nimport { fetchMeta, negotiate } from \"../../core/api/meta.js\"\nimport type { CliMe, CliMeta } from \"../../core/api/types.js\"\nimport { deviceLogin } from \"../../core/auth/login.js\"\nimport { TokenStore } from \"../../core/auth/tokenStore.js\"\nimport { profileHash, resolvePortal } from \"../../core/profiles.js\"\nimport { openSession } from \"../../core/session.js\"\nimport { requestLog, type CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerLogin(program: Command, ctx: CommandContext): void {\n  program.command(\"login\").description(\"Log in with your Qore account\")\n    .option(\"--no-browser\", \"only print the URL\")\n    .action(async (cmd: { browser: boolean }) => {\n      const { deps, io, signal } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      const meta: CliMeta = await fetchMeta(deps.fetch, portal.apiOrigin)\n      const known = cfg.profiles[portal.apiOrigin]?.issuer\n      const pinned = { ...portal, pinnedIssuer: portal.pinnedIssuer ?? known ?? null }\n      if (!pinned.pinnedIssuer && portal.builtin === null) {\n        io.err(`! Logging in to ${portal.apiOrigin}, identity provider ${meta.auth.issuer}`)\n      }\n      negotiate(meta, pinned, deps.version)\n      const issuer = pinned.pinnedIssuer ?? meta.auth.issuer\n      const hash = profileHash(portal.apiOrigin, issuer)\n      const store = new TokenStore(deps.keychain, hash)\n      const t = await deviceLogin({\n        oidc: await deps.oidcFor(issuer), store, now: deps.now, signal,\n        withLock: deps.withLock, lockName: hash,\n        onCode: async (s, settled) => {\n          const url = s.verificationUriComplete ?? s.verificationUri\n          io.err(`! First copy your one-time code: ${s.userCode}`)\n          if (io.interactive && cmd.browser) {\n            try {\n              await io.waitForEnter(`  Press Enter to open ${url} (or open it yourself)`, AbortSignal.any([signal, settled]))\n            } catch (e) {\n              // Approved (or denied) in a browser the user opened themselves: nothing left to open.\n              if (settled.aborted && !signal.aborted) return\n              throw e\n            }\n            if (settled.aborted) return\n            if (!(await io.openUrl(url))) io.err(`  Open ${url} in a browser`)\n          } else {\n            io.err(`  Open ${url} in a browser`)\n          }\n        },\n      })\n      await deps.config.update((c) => {\n        c.profiles[portal.apiOrigin] = { ...c.profiles[portal.apiOrigin], apiOrigin: portal.apiOrigin, issuer,\n          sub: t.sub, email: t.email, meta: { fetchedAt: deps.now().toISOString(), doc: meta } }\n        if (g.portal || !c.defaultProfile) c.defaultProfile = portal.apiOrigin\n      })\n      const { api } = await openSession(deps, { ...portal, pinnedIssuer: issuer }, \"login\", requestLog(ctx))\n      const me = await api.get<CliMe>(\"/api/cli/v1/me\")\n      const prev = cfg.profiles[portal.apiOrigin]\n      let active: { id: string; slug: string } | undefined =\n        prev?.sub === t.sub && prev.activeTenant && me.tenants.some((x) => x.id === prev.activeTenant!.id)\n          ? prev.activeTenant\n          : undefined\n      if (active) {\n        // A previous session's active tenant is still valid for this sub: keep it, no re-selection.\n      } else if (me.tenants.length === 0) {\n        io.err(\"! Your account is not a developer in any organisation. Ask an admin to invite you as developer.\")\n      } else if (me.tenants.length === 1) {\n        active = { id: me.tenants[0]!.id, slug: me.tenants[0]!.slug }\n        io.err(`✓ Using tenant ${me.tenants[0]!.name}`)\n      } else if (io.interactive) {\n        active = await io.select(\"Select a tenant\", me.tenants.map((x) => ({ name: `${x.name}  ${x.role}`, value: { id: x.id, slug: x.slug } })))\n      } else {\n        io.err(`! You belong to ${me.tenants.length} tenants; choose one with \\`qore tenant use <slug>\\``)\n      }\n      await deps.config.update((c) => { c.profiles[portal.apiOrigin]!.activeTenant = active })\n      const label = portal.builtin ?? portal.apiOrigin\n      if (g.json) renderJson(io, { portal: label, email: me.email, activeTenant: active ?? null })\n      else io.out(`✓ Logged in as ${me.email} (${label})`)\n    })\n}\n","import type { Command } from \"commander\"\nimport { TokenStore } from \"../../core/auth/tokenStore.js\"\nimport { QoreError } from \"../../core/errors.js\"\nimport { profileHash, resolvePortal } from \"../../core/profiles.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerLogout(program: Command, ctx: CommandContext): void {\n  program.command(\"logout\").description(\"End the CLI session\")\n    .option(\"--all\", \"log out of every portal\")\n    .action(async (cmd: { all?: boolean }) => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const targets = cmd.all ? Object.values(cfg.profiles)\n        : [cfg.profiles[resolvePortal(g.portal, cfg.defaultProfile).apiOrigin]].filter((p) => p !== undefined)\n      const done: string[] = []\n      for (const p of targets) {\n        const hash = profileHash(p.apiOrigin, p.issuer)\n        const store = new TokenStore(deps.keychain, hash)\n        const host = new URL(p.issuer).host\n        // Read, revoke and clear under one lock, so a concurrent refresh cannot rotate the\n        // RT between our read and the revoke (we would revoke a stale one) or resurrect it.\n        await deps.withLock(hash, async () => {\n          const rt = await store.getRefresh()\n          if (rt) {\n            try { await (await deps.oidcFor(p.issuer)).revoke(rt.rt) }\n            catch (e) {\n              const network = e instanceof QoreError && e.details?.reason !== undefined\n              io.err(network\n                ? `! Could not reach ${host}; the server session may persist until it expires.`\n                : `! Could not revoke the session at ${host} (${e instanceof Error ? e.message : String(e)}); the server session may persist until it expires.`)\n            }\n          }\n          await store.clear()\n        })\n        done.push(p.apiOrigin)\n      }\n      if (g.json) renderJson(io, { loggedOut: done })\n      else if (done.length === 0) io.out(\"Not logged in\")\n      else io.out(`✓ Logged out of ${done.map((o) => resolvePortal(o, undefined).builtin ?? o).join(\", \")}`)\n    })\n}\n","import { constants } from \"node:os\"\nimport type { Command } from \"commander\"\nimport { QoreError } from \"../../core/errors.js\"\nimport { fetchLocalEnv } from \"../../core/env/fetch.js\"\nimport { appFor, moduleContextFor } from \"../context.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { ensureTrusted } from \"../trustPrompt.js\"\n\n/** Ruling R3: while the child runs, cli.ts's own SIGINT handler must not force `exit(130)`\n * — the terminal already delivers Ctrl+C to the whole foreground process group (see\n * platform/spawn.ts), so the child's own exit (code or re-raised signal) is what decides\n * qore's exit code. This flag is the narrow hook cli.ts checks; it brackets exactly the\n * `deps.spawn.run` call, nothing more. */\nexport const childRunning = { current: false }\n\nexport function registerRun(program: Command, ctx: CommandContext): void {\n  program\n    .command(\"run\")\n    .description(\"Run a command with this module's local secrets in its environment\")\n    .option(\"--module <slug|id>\", \"the module (default: from this repository's git remote)\")\n    .option(\"--app <slug|id>\", \"the app, when the module is part of several\")\n    .option(\"--yes\", \"trust this repository without asking\")\n    .argument(\"<command>\", \"the command to run (after --)\")\n    .argument(\"[args...]\", \"its arguments, passed verbatim\")\n    .action(async (cmd: string, args: string[], f: { module?: string; app?: string; yes?: boolean }) => {\n      const { deps } = ctx\n      if (ctx.opts().json) {\n        throw new QoreError(\"QORE_CONTEXT_INVALID\", \"run has no --json output\", {\n          hint: \"Drop --json; the child's own output passes through.\",\n        })\n      }\n      const mc = await moduleContextFor(ctx, f, \"run\")\n      const app = await appFor(ctx, mc, f.app)\n      // C8: ensureTrusted prints the context line exactly once — do not print it again here.\n      await ensureTrusted(ctx, mc, app, { yes: f.yes })\n      const local = await fetchLocalEnv(deps, mc, app) // fetched on every run, never cached (§11.2)\n      childRunning.current = true\n      let exit\n      try {\n        exit = await deps.spawn.run(cmd, args, { ...deps.env, ...local.env })\n      } finally {\n        childRunning.current = false\n      }\n      if (exit.signal) {\n        deps.raise(exit.signal)\n        ctx.setExitCode(128 + (constants.signals[exit.signal] ?? 0))\n        return\n      }\n      ctx.setExitCode(exit.code ?? 1)\n    })\n}\n","import type { CliHealth } from \"../core/api/types.js\"\n\nexport function ago(iso: string | null, now: Date): string {\n  if (!iso) return \"–\"\n  const s = Math.max(0, Math.round((now.getTime() - new Date(iso).getTime()) / 1000))\n  if (s < 60) return \"just now\"\n  if (s < 3600) return `${Math.floor(s / 60)}m ago`\n  if (s < 86400) return `${Math.floor(s / 3600)}h ago`\n  return `${Math.floor(s / 86400)}d ago`\n}\n\nconst pct = (f: number) => String(Number((f * 100).toFixed(2)))\n\nexport function uptime(h: CliHealth | null): string {\n  if (!h) return \"–\"\n  const kind = h.cause && h.kind !== \"up\" ? `${h.kind}: ${h.cause}` : h.kind\n  return h.uptime24h === null ? kind : `${kind} (${pct(h.uptime24h)}% 24h)`\n}\n\nexport function table(rows: string[][]): string[] {\n  const widths = rows[0]!.map((_, i) => Math.max(...rows.map((r) => (r[i] ?? \"\").length)))\n  return rows.map((r) => \"  \" + r.map((c, i) => (i === r.length - 1 ? c : c.padEnd(widths[i]!))).join(\"  \"))\n}\n","import type { Command } from \"commander\"\nimport { ensureCapability } from \"../../core/api/capabilities.js\"\nimport type { CliModuleStatus } from \"../../core/api/types.js\"\nimport { flagPortal, workspaceAppModules, workspaceRoot } from \"../../core/context/resolver.js\"\nimport { QoreError } from \"../../core/errors.js\"\nimport { openSession } from \"../../core/session.js\"\nimport { WORKSPACE_FILE, type Workspace } from \"../../core/workspace/file.js\"\nimport { appFor, contextJson, contextLine, moduleContextFor } from \"../context.js\"\nimport { ago, table, uptime } from \"../format.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\ntype Env = CliModuleStatus[\"environments\"][number]\nconst HEAD = [\"ENV\", \"DEPLOY\", \"COMMIT\", \"DEPLOYED\", \"APP HEALTH\"]\nconst envRow = (e: Env, now: Date) =>\n  [e.name, e.paused ? \"paused\" : e.status, e.commit?.sha ?? \"–\", ago(e.commit?.deployedAt ?? null, now), uptime(e.health)]\n\n/** Spec §5.3: in a workspace root `status` is app-level — every module of the workspace app\n * that has a repository, in one table with a leading MODULE column. */\nasync function appStatus(ctx: CommandContext, ws: Workspace, appFlag?: string): Promise<void> {\n  const { deps, io } = ctx\n  const g = ctx.opts()\n  const portal = await flagPortal(deps, g.portal, ws) // spec §3: --portal wins over the workspace\n  const onRequest = g.verbose ? (l: string) => io.err(l) : undefined\n  const session = await openSession(deps, portal, \"status\", onRequest)\n  await ensureCapability(deps, portal.apiOrigin, \"app.modules\")\n  await ensureCapability(deps, portal.apiOrigin, \"module.status\")\n  const am = await workspaceAppModules(session, portal, ws)\n  const { tenant, ...app } = am.app\n  if (appFlag && appFlag !== app.id && appFlag !== app.slug) {\n    throw new QoreError(\"QORE_RESOURCE_NOT_FOUND\", `This workspace is for ${app.slug}, not \"${appFlag}\"`, {\n      hint: \"Pass --module <slug> --app <slug>.\",\n    })\n  }\n  if (!g.json) io.err(`→ ${tenant.name} / ${app.name}  (${WORKSPACE_FILE})`)\n  const modules: { module: { id: string; slug: string; name: string; type: string }; environments: Env[] }[] = []\n  for (const m of am.modules.filter((x) => x.repoUrl !== null)) {\n    const st = await session.api.get<CliModuleStatus>(\n      `/api/cli/v1/modules/${encodeURIComponent(m.id)}/status?app_id=${encodeURIComponent(app.id)}`)\n    modules.push({ module: { id: m.id, slug: m.slug, name: m.name, type: m.type }, environments: st.environments })\n  }\n  if (g.json) {\n    renderJson(io, { context: { portal: portal.builtin ?? portal.apiOrigin, tenant, app, source: WORKSPACE_FILE }, modules })\n    return\n  }\n  if (modules.length === 0) { io.out(\"No modules with a repository yet.\"); return }\n  const now = deps.now()\n  const rows = [[\"MODULE\", ...HEAD], ...modules.flatMap(({ module, environments }) => environments.length === 0\n    ? [[module.slug, \"–\", \"no environments yet\", \"–\", \"–\", \"–\"]]\n    : environments.map((e) => [module.slug, ...envRow(e, now)]))]\n  for (const line of table(rows)) io.out(line)\n}\n\nexport function registerStatus(program: Command, ctx: CommandContext): void {\n  program.command(\"status\").description(\"Deployment and health per environment for this module (or, in a workspace root, the app)\")\n    .option(\"--module <slug|id>\", \"the module (default: from this repository's git remote)\")\n    .option(\"--app <slug|id>\", \"the app, when the module is part of several\")\n    .action(async (flags: { module?: string; app?: string }) => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      if (!flags.module) {\n        const ws = await workspaceRoot(deps)\n        if (ws) { await appStatus(ctx, ws, flags.app); return }\n      }\n      const mc = await moduleContextFor(ctx, flags, \"status\")\n      await ensureCapability(deps, mc.portal.apiOrigin, \"module.status\")\n      const app = await appFor(ctx, mc, flags.app)\n      if (!g.json) io.err(contextLine(mc, app))\n      const st = await mc.session.api.get<CliModuleStatus>(\n        `/api/cli/v1/modules/${encodeURIComponent(mc.module.id)}/status?app_id=${encodeURIComponent(app.id)}`)\n      if (g.json) { renderJson(io, { context: contextJson(mc, app), environments: st.environments }); return }\n      if (st.environments.length === 0) { io.out(\"No environments yet.\"); return }\n      const now = deps.now()\n      const rows = [HEAD, ...st.environments.map((e) => envRow(e, now))]\n      for (const line of table(rows)) io.out(line)\n    })\n}\n","import { lstat, readdir } from \"node:fs/promises\"\nimport { join, relative } from \"node:path\"\nimport { Option, type Command } from \"commander\"\nimport { ensureCapability } from \"../../core/api/capabilities.js\"\nimport type { CliAppModule } from \"../../core/api/types.js\"\nimport type { DirInfo } from \"../../platform/git.js\"\nimport { QoreError } from \"../../core/errors.js\"\nimport { openSession } from \"../../core/session.js\"\nimport { applyActions, syncPresent, type ModuleResult } from \"../../core/workspace/apply.js\"\nimport { findWorkspace } from \"../../core/workspace/file.js\"\nimport { flagPortal, workspaceAppModules } from \"../../core/context/resolver.js\"\nimport { planWorkspace } from \"../../core/workspace/plan.js\"\nimport { isSafeSlug, unsafeSlugError } from \"../../core/workspace/safety.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { reportWorkspaceRun } from \"../workspaceReport.js\"\n\n/** A `QoreError` thrown for one module/directory is that module's own failed result —\n * the caller keeps going with the rest (controller ruling: per-module isolation). */\nfunction asFailure(slug: string, e: unknown): ModuleResult {\n  // Mirrors apply.ts's toFailure: git missing from PATH aborts the run once rather than\n  // being reported once per module/directory.\n  if (e instanceof QoreError && e.code !== \"QORE_GIT_UNAVAILABLE\") {\n    return { slug, status: \"failed\", error: { code: e.code, message: e.message, hint: e.hint } }\n  }\n  throw e\n}\n\n/** Directories directly under `root`, minus the module slugs, holding a `.git` entry.\n * These are what `planWorkspace` reports as `removed`: a module that left the app but whose\n * clone is still on disk. Only the `.git` entry is looked at — no git call runs in a\n * directory that is not one of the app's modules — and a directory that cannot be read is\n * simply not reported: a stray is informational and never makes the run fail. */\nasync function strayRepos(root: string, slugs: Set<string>): Promise<string[]> {\n  let entries: string[]\n  try {\n    entries = (await readdir(root, { withFileTypes: true })).filter((e) => e.isDirectory()).map((e) => e.name)\n  } catch {\n    return []\n  }\n  const names: string[] = []\n  for (const name of entries) {\n    if (slugs.has(name)) continue\n    try {\n      await lstat(join(root, name, \".git\"))\n      names.push(name)\n    } catch { /* no .git (or unreadable): not a stray repository */ }\n  }\n  return names.sort()\n}\n\ntype Flags = { pull?: boolean; protocol: \"https\" | \"ssh\" }\n\nexport function registerSync(program: Command, ctx: CommandContext): void {\n  program.command(\"sync\")\n    .description(\"Clone new modules, fetch present ones, report removed and re-pointed ones\")\n    .option(\"--pull\", \"fast-forward every clean present repository with an upstream\")\n    .addOption(new Option(\"--protocol <https|ssh>\", \"clone URL protocol\").choices([\"https\", \"ssh\"]).default(\"https\"))\n    .action(async (flags: Flags) => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const ws = await findWorkspace(deps.cwd, deps.home)\n      if (!ws) {\n        throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"Not inside a workspace\", { hint: \"Run `qore clone <app>` first.\" })\n      }\n      const portal = await flagPortal(deps, g.portal, ws) // spec §3: --portal wins over the workspace\n      const onRequest = g.verbose ? (l: string) => io.err(l) : undefined\n      const session = await openSession(deps, portal, \"sync\", onRequest)\n      await ensureCapability(deps, portal.apiOrigin, \"app.modules\")\n      const app = await workspaceAppModules(session, portal, ws)\n      if (!g.json) io.err(`→ ${app.app.tenant.name} / ${app.app.name}  (qore.workspace.json)`)\n\n      const slugs = new Set(app.modules.map((m) => m.slug))\n      const dirs: Record<string, DirInfo> = {}\n      const earlyFailures: ModuleResult[] = []\n      const modulesForPlan: CliAppModule[] = []\n      for (const m of app.modules) {\n        if (!isSafeSlug(m.slug)) {\n          earlyFailures.push(asFailure(m.slug, unsafeSlugError(m.slug)))\n          continue\n        }\n        try {\n          dirs[m.slug] = await deps.git.inspect(join(ws.root, m.slug))\n          modulesForPlan.push(m)\n        } catch (e) {\n          earlyFailures.push(asFailure(m.slug, e))\n        }\n      }\n      const strays = await strayRepos(ws.root, slugs)\n\n      const { actions, removed } = planWorkspace(ws.root, modulesForPlan, dirs, strays)\n      const applied = await applyActions(deps, { portal, app, actions, protocol: flags.protocol, onResult: () => {} })\n      await syncPresent(deps, applied, actions, Boolean(flags.pull), { app, protocol: flags.protocol })\n      for (const r of applied) {\n        if (r.status === \"cloned\" && r.dir) r.dir = relative(deps.cwd, r.dir) || \".\"\n      }\n      const removedResults: ModuleResult[] = removed.map((slug) => ({ slug, status: \"removed\", reason: \"not a module of this app — left in place\" }))\n      const results = [...earlyFailures, ...applied, ...removedResults]\n\n      const err = reportWorkspaceRun(io, results, Boolean(g.json))\n      if (err) throw err\n    })\n}\n","import type { Command } from \"commander\"\nimport type { CliMe } from \"../../core/api/types.js\"\nimport { QoreError, type Candidate } from \"../../core/errors.js\"\nimport { resolvePortal } from \"../../core/profiles.js\"\nimport { openSession } from \"../../core/session.js\"\nimport { requestLog, type CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerTenant(program: Command, ctx: CommandContext): void {\n  const tenant = program.command(\"tenant\").description(\"Manage the active tenant\")\n\n  tenant.command(\"list\").description(\"List tenants you have access to\")\n    .action(async () => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      const { profile, api } = await openSession(deps, portal, \"tenant list\", requestLog(ctx))\n      const me = await api.get<CliMe>(\"/api/cli/v1/me\")\n      const activeId = profile.activeTenant?.id\n      if (g.json) {\n        renderJson(io, { tenants: me.tenants.map((t) => ({ ...t, active: t.id === activeId })) })\n        return\n      }\n      for (const t of me.tenants) {\n        const mark = t.id === activeId ? \"*\" : \" \"\n        io.out(`${mark} ${t.name}  ${t.role}`)\n      }\n    })\n\n  tenant.command(\"use\").description(\"Set the active tenant\").argument(\"[slug]\", \"tenant slug\")\n    .action(async (slug: string | undefined) => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      const { api } = await openSession(deps, portal, \"tenant use\", requestLog(ctx))\n      const me = await api.get<CliMe>(\"/api/cli/v1/me\")\n      const candidates: Candidate[] = me.tenants.map((t) => ({ kind: \"tenant\", id: t.id, slug: t.slug, name: t.name }))\n      let chosen: { id: string; slug: string }\n      if (slug) {\n        const found = me.tenants.find((t) => t.slug === slug)\n        if (!found) throw new QoreError(\"QORE_RESOURCE_NOT_FOUND\", `No tenant \"${slug}\" for this account`, { candidates })\n        chosen = { id: found.id, slug: found.slug }\n      } else if (io.interactive) {\n        chosen = await io.select(\"Select a tenant\", me.tenants.map((t) => ({ name: `${t.name}  ${t.role}`, value: { id: t.id, slug: t.slug } })))\n      } else {\n        throw new QoreError(\"QORE_CONTEXT_REQUIRED\", \"Which tenant? Pass a slug or run interactively.\", { candidates })\n      }\n      await deps.config.update((c) => { c.profiles[portal.apiOrigin]!.activeTenant = chosen })\n      if (g.json) renderJson(io, { activeTenant: chosen })\n      else io.out(`✓ Using tenant ${chosen.slug}`)\n    })\n}\n","import type { Command } from \"commander\"\nimport { fetchMeta } from \"../../core/api/meta.js\"\nimport { CancelledError } from \"../../core/errors.js\"\nimport { resolvePortal } from \"../../core/profiles.js\"\nimport type { CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerVersion(program: Command, ctx: CommandContext): void {\n  program.command(\"version\").description(\"Show the CLI and portal version\")\n    .action(async () => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      let portalInfo: { apiVersions: string[]; minCliVersion: string; latestCliVersion: string; capabilities: string[] } | null = null\n      try {\n        const meta = await fetchMeta(deps.fetch, portal.apiOrigin)\n        portalInfo = { apiVersions: meta.apiVersions, minCliVersion: meta.minCliVersion, latestCliVersion: meta.latestCliVersion, capabilities: meta.capabilities }\n      } catch (e) {\n        // A cancel is not \"unreachable\": Ctrl+C still exits 130.\n        if (e instanceof CancelledError) throw e\n        /* portal unreachable; report null below */\n      }\n      if (g.json) {\n        renderJson(io, { cli: deps.version, portal: portalInfo })\n        return\n      }\n      io.out(`qore ${deps.version}`)\n      const label = portal.builtin ?? portal.apiOrigin\n      if (portalInfo) {\n        io.out(`portal ${label}: api ${portalInfo.apiVersions.join(\",\")}, min ${portalInfo.minCliVersion}, latest ${portalInfo.latestCliVersion}`)\n      } else {\n        io.out(`portal ${label}: unreachable`)\n      }\n    })\n}\n","import type { Command } from \"commander\"\nimport type { CliMe } from \"../../core/api/types.js\"\nimport { resolvePortal } from \"../../core/profiles.js\"\nimport { openSession } from \"../../core/session.js\"\nimport { requestLog, type CommandContext } from \"../program.js\"\nimport { renderJson } from \"../render.js\"\n\nexport function registerWhoami(program: Command, ctx: CommandContext): void {\n  program.command(\"whoami\").description(\"Show who you're logged in as\")\n    .action(async () => {\n      const { deps, io } = ctx\n      const g = ctx.opts()\n      const cfg = await deps.config.read()\n      const portal = resolvePortal(g.portal, cfg.defaultProfile)\n      const { profile, api } = await openSession(deps, portal, \"whoami\", requestLog(ctx))\n      const me = await api.get<CliMe>(\"/api/cli/v1/me\")\n      const activeTenant = profile.activeTenant\n      if (activeTenant && !me.tenants.some((t) => t.id === activeTenant.id)) {\n        io.err(`! You no longer have developer access to ${activeTenant.slug}`)\n      }\n      const label = portal.builtin ?? portal.apiOrigin\n      if (g.json) {\n        renderJson(io, { portal: label, activeTenant: activeTenant ?? null, me })\n        return\n      }\n      io.out(`${me.email} (${label})`)\n      for (const t of me.tenants) {\n        const mark = activeTenant?.id === t.id ? \"*\" : \" \"\n        io.out(`${mark} ${t.name}  ${t.role}`)\n        for (const a of t.apps) {\n          io.out(`  ${a.slug}  ${a.access}`)\n          for (const m of a.modules) {\n            io.out(`    ${m.slug}  ${m.type}  ${m.access}`)\n          }\n        }\n      }\n    })\n}\n","import type { Register } from \"../program.js\"\nimport { registerClone } from \"./clone.js\"\nimport { registerEnv } from \"./env.js\"\nimport { registerLogin } from \"./login.js\"\nimport { registerLogout } from \"./logout.js\"\nimport { registerRun } from \"./run.js\"\nimport { registerStatus } from \"./status.js\"\nimport { registerSync } from \"./sync.js\"\nimport { registerTenant } from \"./tenant.js\"\nimport { registerVersion } from \"./version.js\"\nimport { registerWhoami } from \"./whoami.js\"\n\nexport const COMMANDS: Register[] = [\n  registerLogin, registerLogout, registerWhoami, registerTenant, registerStatus, registerEnv, registerRun, registerClone, registerSync,\n  registerVersion,\n]\n","import { compareVersions } from \"../core/api/meta.js\"\nimport type { Deps } from \"../core/deps.js\"\nimport type { Io } from \"./io.js\"\n\nconst REGISTRY_URL = \"https://registry.npmjs.org/@quatronic%2Fqore/latest\"\nconst DAY_MS = 24 * 60 * 60 * 1000\nconst DEFAULT_TIMEOUT_MS = 1500\n\nexport async function maybeNotifyUpdate(deps: Deps, io: Io, o: { json: boolean }, timeoutMs = DEFAULT_TIMEOUT_MS): Promise<void> {\n  if (o.json || deps.env.CI || deps.env.QORE_NO_UPDATE_CHECK === \"1\" || !io.interactive) return\n  const cfg = await deps.config.read()\n  const last = cfg.updateCheck?.lastCheckedAt\n  if (last && deps.now().getTime() - new Date(last).getTime() < DAY_MS) return\n  const controller = new AbortController()\n  const timer = setTimeout(() => controller.abort(), timeoutMs)\n  let latest: string | undefined\n  try {\n    const res = await deps.fetch(REGISTRY_URL, { signal: controller.signal })\n    if (res.ok) latest = ((await res.json()) as { version?: string }).version\n  } catch { /* silent: an update check never affects the run */ }\n  finally { clearTimeout(timer) }\n  try {\n    // Recorded after a failed, non-OK or timed-out check too, so an offline user does not\n    // pay the timeout on every command; the last known latest version is kept then.\n    await deps.config.update((c) => {\n      c.updateCheck = { lastCheckedAt: deps.now().toISOString(), latest: latest ?? c.updateCheck?.latest ?? deps.version }\n    })\n  } catch { return }\n  if (latest && compareVersions(latest, deps.version) > 0) {\n    io.err(`A new qore is available: ${deps.version} → ${latest}  npm i -g @quatronic/qore`)\n  }\n}\n","import { readFile } from \"node:fs/promises\"\nimport { join } from \"node:path\"\nimport { QoreError } from \"./errors.js\"\nimport { writeJsonAtomic } from \"./jsonFile.js\"\n\nexport type ProfileRecord = {\n  apiOrigin: string\n  issuer: string\n  sub?: string\n  email?: string\n  activeTenant?: { id: string; slug: string }\n  meta?: { fetchedAt: string; doc: unknown }\n}\n\nexport type QoreConfig = {\n  schemaVersion: 1\n  defaultProfile?: string\n  profiles: Record<string, ProfileRecord>\n  updateCheck?: { lastCheckedAt: string; latest: string }\n  trustedRepos?: Record<string, string[]>\n}\n\nconst empty = (): QoreConfig => ({ schemaVersion: 1, profiles: {} })\n\nexport class ConfigStore {\n  constructor(readonly dir: string) {}\n\n  private get file() { return join(this.dir, \"config.json\") }\n\n  async read(): Promise<QoreConfig> {\n    let raw: string\n    try {\n      raw = await readFile(this.file, \"utf8\")\n    } catch (e) {\n      if ((e as NodeJS.ErrnoException).code === \"ENOENT\") return empty()\n      throw e\n    }\n    try {\n      const parsed = JSON.parse(raw) as QoreConfig\n      if (parsed.schemaVersion !== 1 || typeof parsed.profiles !== \"object\") throw new Error(\"shape\")\n      return parsed\n    } catch (cause) {\n      throw new QoreError(\"QORE_CONTEXT_INVALID\", `Qore config is malformed: ${this.file}`, {\n        hint: \"Fix or delete the file, then run `qore login` again\", cause,\n      })\n    }\n  }\n\n  async update(fn: (c: QoreConfig) => QoreConfig | void): Promise<QoreConfig> {\n    const current = await this.read()\n    const next = fn(current) ?? current\n    await writeJsonAtomic(this.dir, \"config.json\", next)\n    return next\n  }\n}\n","import { execFile, execFileSync, type ExecFileOptions } from \"node:child_process\"\nimport { mkdir, readdir, stat } from \"node:fs/promises\"\nimport { homedir } from \"node:os\"\nimport { dirname, join } from \"node:path\"\nimport { QoreError } from \"../core/errors.js\"\n\nexport type Remote = { name: string; url: string }\nexport type GitResult = { ok: true } | { ok: false; stderr: string; command: string }\nexport type RepoStatus =\n  | { ok: true; dirty: boolean; branch: string | null; upstream: boolean }\n  | { ok: false; stderr: string; command: string }\nexport type DirInfo = { exists: boolean; empty: boolean; isRepo: boolean; remotes: Remote[] }\n\nexport interface Git {\n  remotes(repoRoot: string): Promise<Remote[]>\n  clone(url: string, dir: string): Promise<GitResult>\n  fetch(repoRoot: string): Promise<GitResult>\n  pullFfOnly(repoRoot: string): Promise<GitResult>\n  status(repoRoot: string): Promise<RepoStatus>\n  inspect(dir: string): Promise<DirInfo>\n}\n\nexport function parseRemotes(stdout: string): Remote[] {\n  const seen = new Set<string>()\n  const out: Remote[] = []\n  for (const line of stdout.split(/\\r?\\n/)) {\n    const m = /^(\\S+)\\t(.+) \\(fetch\\)$/.exec(line)\n    if (!m || seen.has(m[1]!)) continue\n    seen.add(m[1]!)\n    out.push({ name: m[1]!, url: m[2]! })\n  }\n  return out\n}\n\n/** Whether the developer configured `core.sshCommand` themselves, keyed by the directory\n * git was asked about (\"\" = no repository: global/system config only). Cached for the\n * life of the process — it only decides whether `gitExecOptions()` injects its own\n * non-interactive default, so a value edited mid-process is not worth a git call on every\n * single invocation.\n *\n * For a repository command (fetch, pull, status, remote) the question is asked of THAT\n * repository — `git -C <repo> config --get core.sshCommand` — so a repo-local value and an\n * `includeIf \"gitdir:…\"`-scoped one are seen exactly as git itself would see them; an\n * injected `GIT_SSH_COMMAND` would otherwise override them (the environment variable beats\n * config). For `clone` there is no repository yet, so only global/system config is read:\n * a `core.sshCommand` that only an `includeIf \"gitdir:…\"` block would select for the\n * destination is NOT seen, and there `ssh -o BatchMode=yes` is injected. Known gap; the\n * remedy for such a setup is exporting `GIT_SSH_COMMAND` (which always wins). */\nconst configuredSshCommand = new Map<string, boolean>()\nexport function __resetSshCommandCacheForTests(): void { configuredSshCommand.clear() }\n\nfunction hasConfiguredSshCommand(repoDir?: string): boolean {\n  const key = repoDir ?? \"\"\n  let v = configuredSshCommand.get(key)\n  if (v === undefined) {\n    const args = repoDir ? [\"-C\", repoDir, \"config\", \"--get\", \"core.sshCommand\"] : [\"config\", \"--get\", \"core.sshCommand\"]\n    try {\n      v = execFileSync(\"git\", args, {\n        cwd: homedir(),\n        env: { ...process.env, LC_ALL: \"C\", GIT_TERMINAL_PROMPT: \"0\" },\n        stdio: [\"ignore\", \"pipe\", \"ignore\"],\n        windowsHide: true,\n        timeout: 5000,\n      })\n        .toString().trim().length > 0\n    } catch {\n      v = false // unset (exit 1), not a repository, git missing: nothing of theirs to respect\n    }\n    configuredSshCommand.set(key, v)\n  }\n  return v\n}\n\n/** Options for every git child. `cwd` is pinned to the home directory because on\n * Windows a bare \"git\" is looked up in the child's cwd before PATH: running from a\n * cloned repo would execute a git.exe planted at its top level. `-C <root>` only\n * steers git after it has started, so the repo stays the directory git works in.\n * `LC_ALL=C` keeps output stable across locales; `GIT_TERMINAL_PROMPT=0` means git\n * never hangs on a credential prompt; `GIT_HTTP_LOW_SPEED_LIMIT/TIME` (unless the\n * developer set their own) make a stalled https transfer fail after a minute instead of\n * hanging forever. A non-interactive `GIT_SSH_COMMAND` is added only when the environment\n * (`GIT_SSH_COMMAND`/`GIT_SSH`) and the developer's own git config (`core.sshCommand`, as\n * seen from `repoDir` when given) are all silent on the matter — otherwise their choice\n * (an SSH agent wrapper, a jump host, ProxyCommand, …) wins untouched. */\nexport function gitExecOptions(repoDir?: string): ExecFileOptions {\n  const env: NodeJS.ProcessEnv = { ...process.env, LC_ALL: \"C\", GIT_TERMINAL_PROMPT: \"0\" }\n  if (!env.GIT_HTTP_LOW_SPEED_LIMIT) env.GIT_HTTP_LOW_SPEED_LIMIT = \"1000\"\n  if (!env.GIT_HTTP_LOW_SPEED_TIME) env.GIT_HTTP_LOW_SPEED_TIME = \"60\"\n  if (!env.GIT_SSH_COMMAND && !env.GIT_SSH && !hasConfiguredSshCommand(repoDir)) {\n    env.GIT_SSH_COMMAND = \"ssh -o BatchMode=yes\"\n  }\n  return { cwd: homedir(), env, windowsHide: true, maxBuffer: 8 * 1024 * 1024 }\n}\n\n/** `repoDir` names the repository the command runs in (the `-C` argument), so the\n * `core.sshCommand` check is asked of that repository; omitted for `clone`. */\nfunction runGit(args: string[], repoDir?: string): Promise<{ code: number; stdout: string; stderr: string; err?: Error }> {\n  return new Promise((resolve, reject) => {\n    execFile(\"git\", args, gitExecOptions(repoDir), (err, stdout, stderr) => {\n      if (err && (err as NodeJS.ErrnoException).code === \"ENOENT\") {\n        reject(new QoreError(\"QORE_GIT_UNAVAILABLE\", \"git is not installed or not on PATH\", {\n          hint: \"Install git (https://git-scm.com/downloads) and open a new terminal.\" }))\n        return\n      }\n      const code = err ? (typeof (err as { code?: unknown }).code === \"number\" ? (err as { code: number }).code : 1) : 0\n      resolve({ code, stdout: String(stdout), stderr: String(stderr), err: err ?? undefined })\n    })\n  })\n}\n\nconst toResult = (r: { code: number; stderr: string }, command: string): GitResult =>\n  r.code === 0 ? { ok: true } : { ok: false, stderr: r.stderr, command }\n\nasync function remotes(repoRoot: string): Promise<Remote[]> {\n  const r = await runGit([\"-C\", repoRoot, \"remote\", \"-v\"], repoRoot)\n  if (r.code !== 0) {\n    const last = r.stderr.trim().split(/\\r?\\n/).pop() ?? \"\"\n    throw new QoreError(\"QORE_INTERNAL\", `git remote -v failed in ${repoRoot}`, {\n      hint: last || undefined, details: { command: \"git remote -v\", cwd: repoRoot }, cause: r.err })\n  }\n  return parseRemotes(r.stdout)\n}\n\n/** `-- <url> <dir>` so neither a URL nor a destination beginning with `-` can ever be\n * read as an option — `--` ends option parsing for the rest of the command line. */\nasync function clone(url: string, dir: string): Promise<GitResult> {\n  await mkdir(dirname(dir), { recursive: true })\n  const r = await runGit([\"clone\", \"--\", url, dir])\n  return toResult(r, \"git clone\")\n}\n\n/** Plain `git fetch` — no `--prune`: sync never deletes anything, remote-tracking refs\n * included. */\nasync function fetch(repoRoot: string): Promise<GitResult> {\n  const r = await runGit([\"-C\", repoRoot, \"fetch\"], repoRoot)\n  return toResult(r, \"git fetch\")\n}\n\nasync function pullFfOnly(repoRoot: string): Promise<GitResult> {\n  const r = await runGit([\"-C\", repoRoot, \"pull\", \"--no-rebase\", \"--ff-only\"], repoRoot)\n  return toResult(r, \"git pull --no-rebase --ff-only\")\n}\n\n/** One call, `status --porcelain=v2 --branch`, so branch/upstream/dirty come from a\n * single consistent snapshot instead of three separate `rev-parse`s that can each\n * fail their own way. `--no-optional-locks` keeps a concurrent status read from\n * taking the index lock. A non-zero exit (not a repo, dubious ownership, …) is\n * reported as unmeasured — never folded into `dirty:false` — so the caller can\n * classify it instead of the platform layer guessing. */\nasync function status(repoRoot: string): Promise<RepoStatus> {\n  const command = \"git status --porcelain=v2 --branch\"\n  const r = await runGit([\"--no-optional-locks\", \"-C\", repoRoot, \"status\", \"--porcelain=v2\", \"--branch\"], repoRoot)\n  if (r.code !== 0) return { ok: false, stderr: r.stderr, command }\n  let branch: string | null = null\n  let upstream = false\n  let dirty = false\n  for (const line of r.stdout.split(/\\r?\\n/)) {\n    if (line.startsWith(\"# branch.head \")) {\n      const name = line.slice(\"# branch.head \".length).trim()\n      branch = name === \"(detached)\" ? null : name\n    } else if (line.startsWith(\"# branch.upstream \")) {\n      upstream = true\n    } else if (line.startsWith(\"#\")) {\n      continue\n    } else if (line.trim().length > 0) {\n      dirty = true\n    }\n  }\n  return { ok: true, dirty, branch, upstream }\n}\n\nasync function statOrThrow(path: string): Promise<Awaited<ReturnType<typeof stat>> | undefined> {\n  try {\n    return await stat(path)\n  } catch (err) {\n    if ((err as NodeJS.ErrnoException).code === \"ENOENT\") return undefined\n    throw new QoreError(\"QORE_INTERNAL\", `could not stat ${path}`, { cause: err })\n  }\n}\n\nasync function inspect(dir: string): Promise<DirInfo> {\n  const st = await statOrThrow(dir)\n  if (!st) return { exists: false, empty: false, isRepo: false, remotes: [] }\n  if (!st.isDirectory()) return { exists: true, empty: false, isRepo: false, remotes: [] }\n  let entries: string[]\n  try {\n    entries = await readdir(dir)\n  } catch (err) {\n    throw new QoreError(\"QORE_INTERNAL\", `could not read ${dir}`, { cause: err })\n  }\n  const empty = entries.length === 0\n  const isRepo = (await statOrThrow(join(dir, \".git\"))) !== undefined\n  const dirRemotes = isRepo ? await remotes(dir) : []\n  return { exists: true, empty, isRepo, remotes: dirRemotes }\n}\n\n/** Reading through git (not .git/config) means insteadOf rewrites and worktrees\n * behave exactly as git sees them (spec §2). */\nexport const systemGit: Git = { remotes, clone, fetch, pullFfOnly, status, inspect }\n","import { Entry } from \"@napi-rs/keyring\"\nimport { QoreError } from \"../core/errors.js\"\n\nexport interface Keychain {\n  get(account: string): Promise<string | null>\n  set(account: string, value: string): Promise<void>\n  delete(account: string): Promise<void>\n}\n\nconst SERVICE = \"qore\"\nconst HINTS: Partial<Record<NodeJS.Platform, string>> = {\n  linux: \"Install and unlock a Secret Service provider (gnome-keyring or KWallet); headless machines and containers have none.\",\n  darwin: \"Unlock your login keychain in Keychain Access.\",\n  win32: \"Windows Credential Manager must be available for your user.\",\n}\n\nexport function classifyKeychainError(e: unknown, platform: NodeJS.Platform): QoreError {\n  const msg = e instanceof Error ? e.message : String(e)\n  // keyring-rs Error::TooLong (\"… is longer than the platform limit of N chars\"): Windows\n  // Credential Manager caps a credential blob (R18). Still UNAVAILABLE, but say what it is.\n  if (/TooLong|longer than the platform limit/i.test(msg)) {\n    return new QoreError(\"QORE_KEYCHAIN_UNAVAILABLE\", \"The session token is too large for the OS keychain\", {\n      hint: platform === \"win32\"\n        ? \"The token exceeds the Windows Credential Manager size limit. Report this to the Qore team.\"\n        : \"The token exceeds the keychain's size limit. Report this to the Qore team.\",\n      cause: e,\n    })\n  }\n  if (/cancel|denied|errSecAuthFailed|user interaction/i.test(msg)) {\n    return new QoreError(\"QORE_KEYCHAIN_DENIED\", \"Access to the OS keychain was denied\", {\n      hint: \"Allow qore to use the keychain when your OS asks, then retry.\", cause: e,\n    })\n  }\n  return new QoreError(\"QORE_KEYCHAIN_UNAVAILABLE\", \"No usable OS keychain\", {\n    hint: HINTS[platform] ?? \"qore stores tokens only in the OS keychain.\", cause: e,\n  })\n}\n\nexport class OsKeychain implements Keychain {\n  constructor(private readonly platform: NodeJS.Platform = process.platform) {}\n\n  private wrap<T>(fn: () => T): Promise<T> {\n    try { return Promise.resolve(fn()) } catch (e) { return Promise.reject(classifyKeychainError(e, this.platform)) }\n  }\n\n  get(account: string) { return this.wrap(() => new Entry(SERVICE, account).getPassword() ?? null) }\n  set(account: string, value: string) { return this.wrap(() => { new Entry(SERVICE, account).setPassword(value) }) }\n  delete(account: string) {\n    // deletePassword() returns false (rather than throwing) when there is no entry.\n    return this.wrap(() => { new Entry(SERVICE, account).deletePassword() })\n  }\n}\n","import { mkdir, writeFile } from \"node:fs/promises\"\nimport { join } from \"node:path\"\nimport lockfile from \"proper-lockfile\"\nimport { QoreError } from \"../core/errors.js\"\n\nexport type WithLock = <T>(name: string, fn: () => Promise<T>) => Promise<T>\n\nexport function fileLock(dir: string): WithLock {\n  return async (name, fn) => {\n    const locks = join(dir, \"locks\")\n    await mkdir(locks, { recursive: true, mode: 0o700 })\n    const target = join(locks, `${name}.lock`)\n    await writeFile(target, \"\", { flag: \"a\" })\n    let release: () => Promise<void>\n    // proper-lockfile's default onCompromised throws from a timer (an uncaught crash). A\n    // compromised lock (mtime update failed, or another process took it as stale) is only\n    // recorded: the keychain writes under it are idempotent, and refresh re-reads the RT.\n    let compromised: Error | undefined\n    try {\n      release = await lockfile.lock(target, {\n        stale: 30_000,\n        retries: { retries: 30, minTimeout: 100, maxTimeout: 1000, randomize: true },\n        onCompromised: (err) => { compromised = err },\n      })\n    } catch (cause) {\n      throw new QoreError(\"QORE_AUTH_BUSY\", \"Another qore process is refreshing the session\", { hint: \"Retry in a moment.\", cause })\n    }\n    try { return await fn() } finally {\n      // After a compromise release() rejects (ERELEASED); that must not replace fn's outcome.\n      await release().catch((e: unknown) => { if (!compromised) throw e })\n    }\n  }\n}\n","import { posix, win32 } from \"node:path\"\n\nexport function configDir(env: NodeJS.ProcessEnv, platform: NodeJS.Platform, home: string): string {\n  if (platform === \"win32\") return win32.join(env.APPDATA ?? win32.join(home, \"AppData\", \"Roaming\"), \"qore\")\n  // posix.join, not the host's join: the result is for the target platform, whatever the host\n  // (tests run on Windows CI too).\n  if (platform === \"darwin\") return posix.join(home, \"Library\", \"Application Support\", \"qore\")\n  // XDG Base Directory spec: a relative $XDG_CONFIG_HOME is invalid and must be ignored.\n  const xdg = env.XDG_CONFIG_HOME && posix.isAbsolute(env.XDG_CONFIG_HOME) ? env.XDG_CONFIG_HOME : undefined\n  return posix.join(xdg ?? posix.join(home, \".config\"), \"qore\")\n}\n","import spawn from \"cross-spawn\"\nimport type { ChildProcess } from \"node:child_process\"\nimport { QoreError } from \"../core/errors.js\"\n\nexport type ChildExit = { code: number | null; signal: NodeJS.Signals | null }\nexport interface Spawner { run(cmd: string, args: string[], env: NodeJS.ProcessEnv): Promise<ChildExit> }\n\n/** Which signals `crossSpawner` ignores (left to the terminal's own process-group\n * delivery) vs. forwards to the child, per platform. Exported so tests can derive\n * the expected lists for the platform they run on instead of hard-coding POSIX's. */\nexport function signalsFor(platform: NodeJS.Platform): { ignore: NodeJS.Signals[]; forward: NodeJS.Signals[] } {\n  return platform === \"win32\"\n    ? { ignore: [\"SIGINT\", \"SIGBREAK\"], forward: [] }\n    : { ignore: [\"SIGINT\", \"SIGQUIT\"], forward: [\"SIGTERM\", \"SIGHUP\"] }\n}\n\nconst { ignore: IGNORE, forward: FORWARD } = signalsFor(process.platform)\n\n/** The slice of `process` that `crossSpawner` touches: signal handler registration.\n * Injectable so tests can drive signal ignore/forward behaviour with a fake child and\n * a fake signal source, without sending real signals to the test runner's own process. */\nexport interface ProcessSignals {\n  on(signal: NodeJS.Signals, listener: () => void): void\n  off(signal: NodeJS.Signals, listener: () => void): void\n}\n\ntype SpawnFn = (cmd: string, args: string[], opts: { stdio: \"inherit\"; shell: false; env: NodeJS.ProcessEnv; windowsHide: true }) => ChildProcess\n\n/** Spec §11.2. The terminal delivers Ctrl+C / Ctrl+\\ to the whole foreground process\n * group, so forwarding them would double-signal the child: the parent only ignores\n * them and waits. SIGTERM/SIGHUP come to the parent alone and are passed on. */\nexport function makeSpawner(spawnFn: SpawnFn, proc: ProcessSignals): Spawner {\n  return {\n    run(cmd, args, env) {\n      return new Promise((resolve, reject) => {\n        let child: ChildProcess\n        try {\n          child = spawnFn(cmd, args, { stdio: \"inherit\", shell: false, env, windowsHide: true })\n        } catch (e) {\n          // Node validates `options.env` synchronously (e.g. ERR_INVALID_ARG_VALUE for a\n          // NUL byte in a value) and embeds the offending value in its message — never\n          // pass that message through, only the error code, same as the \"error\" path below.\n          reject(new QoreError(\"QORE_INTERNAL\", `Could not start ${cmd}: ${(e as NodeJS.ErrnoException).code ?? \"error\"}`))\n          return\n        }\n        const ignore = () => {}\n        const forwarders = FORWARD.map((sig) => [sig, () => { child.kill(sig) }] as const)\n        for (const sig of IGNORE) proc.on(sig, ignore)\n        for (const [sig, fn] of forwarders) proc.on(sig, fn)\n        const cleanup = () => {\n          for (const sig of IGNORE) proc.off(sig, ignore)\n          for (const [sig, fn] of forwarders) proc.off(sig, fn)\n        }\n        child.once(\"error\", (e: NodeJS.ErrnoException) => {\n          cleanup()\n          reject(e.code === \"ENOENT\"\n            ? new QoreError(\"QORE_INTERNAL\", `Command not found: ${cmd}`, { hint: \"Check the command after --; it runs without a shell.\" })\n            : new QoreError(\"QORE_INTERNAL\", `Could not start ${cmd}: ${e.code ?? \"error\"}`))\n        })\n        child.once(\"exit\", (code, signal) => { cleanup(); resolve({ code, signal }) })\n      })\n    },\n  }\n}\n\nexport const crossSpawner: Spawner = makeSpawner(spawn, process)\n","declare const __QORE_VERSION__: string | undefined\n// tsup replaces __QORE_VERSION__ at build time; tests run from source and see \"0.0.0-dev\".\nexport const VERSION: string = typeof __QORE_VERSION__ === \"string\" ? __QORE_VERSION__ : \"0.0.0-dev\"\n"],"mappings":";;;AAAA,SAAS,WAAAA,gBAAe;AACxB,SAAS,mBAAmB,2BAA2B;;;ACDvD,SAAS,SAAS,cAAc;AAChC,SAAS,uBAAuB;;;ACDhC,OAAO,UAAU;AAGjB,eAAsB,YAAY,KAA+B;AAC/D,MAAI,QAAQ,aAAa,WAAW,CAAC,QAAQ,IAAI,WAAW,CAAC,QAAQ,IAAI,gBAAiB,QAAO;AACjG,MAAI;AAAE,UAAM,KAAK,GAAG;AAAG,WAAO;AAAA,EAAK,QAAQ;AAAE,WAAO;AAAA,EAAM;AAC5D;;;ACNO,IAAM,OAAO;AAAA,EAClB,eAAe;AAAA,EACf,2BAA2B;AAAA,EAC3B,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,uBAAuB;AAAA,EACvB,sBAAsB;AAAA,EACtB,0BAA0B;AAAA,EAC1B,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,sBAAsB;AAAA,EACtB,oBAAoB;AAAA,EACpB,mBAAmB;AAAA,EACnB,iBAAiB;AAAA,EACjB,yBAAyB;AAAA,EACzB,yBAAyB;AAAA,EACzB,oBAAoB;AAAA,EACpB,0BAA0B;AAAA,EAC1B,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,eAAe;AAAA,EACf,yBAAyB;AAAA,EACzB,uBAAuB;AAAA,EACvB,gBAAgB;AAAA,EAChB,sBAAsB;AAAA,EACtB,sBAAsB;AAAA,EACtB,0BAA0B;AAAA,EAC1B,4BAA4B;AAAA,EAC5B,uBAAuB;AAAA,EACvB,uBAAuB;AAAA,EACvB,mBAAmB;AACrB;AA0BO,IAAM,YAAN,cAAwB,MAAM;AAAA,EAC1B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EAET,YAAY,MAAqB,SAAiB,OAAa,CAAC,GAAG;AACjE,UAAM,SAAS,KAAK,UAAU,SAAY,SAAY,EAAE,OAAO,KAAK,MAAM,CAAC;AAC3E,SAAK,OAAO;AACZ,SAAK,OAAO;AACZ,SAAK,OAAO,KAAK;AACjB,SAAK,SAAS,KAAK;AACnB,SAAK,YAAY,KAAK;AACtB,SAAK,aAAa,KAAK;AACvB,SAAK,aAAa,KAAK;AACvB,SAAK,UAAU,KAAK;AAAA,EACtB;AACF;AAEO,IAAM,iBAAN,cAA6B,MAAM;AAAA,EACxC,cAAc;AACZ,UAAM,WAAW;AACjB,SAAK,OAAO;AAAA,EACd;AACF;AAEO,SAAS,YAAY,KAAsB;AAChD,MAAI,eAAe,kBAAmB,eAAe,SAAS,IAAI,SAAS,iBAAmB,QAAO;AACrG,MAAI,eAAe,UAAW,QAAO,KAAK,IAAI,IAAI;AAClD,SAAO;AACT;AAEO,SAAS,YAAY,KAAuC;AACjE,MAAI,EAAE,eAAe,YAAY;AAC/B,WAAO,EAAE,MAAM,iBAAiB,SAAS,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,EAAE;AAAA,EAC5F;AACA,QAAM,MAA+B,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,QAAQ;AAC5E,aAAW,KAAK,CAAC,QAAQ,UAAU,aAAa,cAAc,cAAc,SAAS,GAAY;AAC/F,QAAI,IAAI,CAAC,MAAM,OAAW,KAAI,CAAC,IAAI,IAAI,CAAC;AAAA,EAC1C;AACA,SAAO;AACT;;;AFvFO,SAAS,cAAc,GAAgH;AAC5I,SAAO,EAAE,YAAY,EAAE,aAAa,CAAC,EAAE,QAAQ,CAAC,EAAE,WAAW,CAAC,EAAE,IAAI;AACtE;AAEO,SAAS,UAAU,aAA0B;AAClD,SAAO;AAAA,IACL,KAAK,CAAC,MAAM;AAAE,cAAQ,OAAO,MAAM,IAAI,IAAI;AAAA,IAAE;AAAA,IAC7C,KAAK,CAAC,MAAM;AAAE,cAAQ,OAAO,MAAM,IAAI,IAAI;AAAA,IAAE;AAAA,IAC7C;AAAA,IACA,MAAM,OAAO,SAAS,SAAS;AAC7B,UAAI;AAAE,eAAO,MAAM,OAAO,EAAE,SAAS,QAAQ,CAAC;AAAA,MAAE,SAAS,GAAG;AAC1D,YAAK,EAAY,SAAS,kBAAmB,OAAM,IAAI,eAAe;AACtE,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,MAAM,QAAQ,SAAS;AACrB,UAAI;AAAE,eAAO,MAAM,QAAQ,EAAE,SAAS,SAAS,MAAM,CAAC;AAAA,MAAE,SAAS,GAAG;AAClE,YAAK,EAAY,SAAS,kBAAmB,OAAM,IAAI,eAAe;AACtE,cAAM;AAAA,MACR;AAAA,IACF;AAAA,IACA,cAAc,mBAAmB,QAAQ,OAAO,QAAQ,MAAM;AAAA,IAC9D,SAAS;AAAA,EACX;AACF;AAOO,SAAS,mBACd,OAA8B,QAC2B;AACzD,SAAO,CAAC,SAAS,WAAW,IAAI,QAAQ,CAACC,UAAS,WAAW;AAC3D,UAAM,KAAK,gBAAgB,EAAE,OAAO,QAAQ,UAAU,KAAK,CAAC;AAC5D,UAAM,UAAU,MAAM;AAAE,SAAG,MAAM;AAAG,aAAO,IAAI,eAAe,CAAC;AAAA,IAAE;AACjE,UAAM,OAAO,MAAM;AAAE,aAAO,oBAAoB,SAAS,OAAO;AAAG,SAAG,MAAM;AAAG,MAAAA,SAAQ;AAAA,IAAE;AACzF,WAAO,iBAAiB,SAAS,SAAS,EAAE,MAAM,KAAK,CAAC;AACxD,OAAG,GAAG,UAAU,MAAM;AAAE,aAAO,oBAAoB,SAAS,OAAO;AAAG,SAAG,MAAM;AAAG,aAAO,IAAI,eAAe,CAAC;AAAA,IAAE,CAAC;AAChH,OAAG,SAAS,SAAS,IAAI;AAAA,EAC3B,CAAC;AACH;;;AGzDA,SAAS,SAAS,sBAAsB;;;ACMjC,SAAS,eAAeC,QAAc,QAA4B;AACvE,SAAO,CAAC,OAAO,SAASA,OAAM,OAAO,EAAE,GAAG,MAAM,QAAQ,MAAM,SAAS,YAAY,IAAI,CAAC,KAAK,QAAQ,MAAM,CAAC,IAAI,OAAO,CAAC;AAC1H;AAEA,IAAM,MAAM,oBAAI,IAAI;AAAA,EAAC;AAAA,EAA6B;AAAA,EAChD;AAAA,EAA+B;AAAA,EAAmC;AAAkB,CAAC;AAEvF,SAAS,UAAU,GAAgC;AACjD,QAAM,IAAK,GAAsC;AACjD,QAAM,OAAO,GAAG,QAAS,GAA0B;AAEnD,SAAO,OAAO,SAAS,WAAW,OAAO;AAC3C;AAEO,SAAS,aAAa,GAAqB;AAChD,SAAQ,GAAiC,SAAS;AACpD;AAGO,SAAS,WAAW,GAAY,MAAqB;AAC1D,SAAO,aAAa,CAAC,IAAI,IAAI,eAAe,IAAI,aAAa,GAAG,IAAI;AACtE;AAEO,SAAS,aAAa,GAAY,MAAyB;AAChE,QAAM,OAAO,UAAU,CAAC,KAAK;AAC7B,MAAI,SAAS;AACb,MAAI,OAAO;AACX,MAAI,SAAS,eAAe,SAAS,aAAa;AAChD,aAAS;AAAO,WAAO,GAAG,IAAI;AAAA,EAChC,WAAW,IAAI,IAAI,IAAI,GAAG;AACxB,aAAS;AACT,WAAO;AAAA,EACT,WAAW,KAAK,SAAS,SAAS,KAAK,SAAS,aAAa;AAC3D,aAAS;AAAA,EACX,WAAW,CAAC,QAAQ,IAAI,eAAe,CAAC,QAAQ,IAAI,aAAa;AAC/D,WAAO;AAAA,EACT;AACA,SAAO,IAAI,UAAU,wBAAwB,mBAAmB,IAAI,IAAI,EAAE,MAAM,SAAS,EAAE,QAAQ,MAAM,OAAO,QAAQ,OAAU,GAAG,OAAO,EAAE,CAAC;AACjJ;AAEA,IAAM,iBAAgD;AAAA,EACpD,qBAAqB;AAAA,EACrB,2BAA2B;AAAA,EAC3B,wBAAwB;AAAA,EACxB,gBAAgB;AAAA,EAChB,oBAAoB;AAAA,EACpB,oBAAoB;AAAA,EACpB,wBAAwB;AAC1B;AAEA,SAAS,SAASC,SAA+B;AAC/C,MAAIA,YAAW,IAAK,QAAO;AAC3B,MAAIA,YAAW,IAAK,QAAO;AAC3B,MAAIA,YAAW,IAAK,QAAO;AAC3B,MAAIA,YAAW,IAAK,QAAO;AAC3B,MAAIA,YAAW,OAAOA,YAAW,OAAOA,YAAW,IAAK,QAAO;AAC/D,SAAO;AACT;AAEA,eAAsB,eAAe,KAAmC;AACtE,MAAI,OAA4D,CAAC;AACjE,MAAI;AAAE,WAAQ,MAAM,IAAI,KAAK;AAAA,EAAkB,QAAQ;AAAA,EAAiB;AACxE,QAAM,aAAa,KAAK;AACxB,QAAM,OAAQ,cAAc,eAAe,UAAU,KAAM,SAAS,IAAI,MAAM;AAC9E,QAAM,YAAY,IAAI,QAAQ,IAAI,cAAc,KAAK;AACrD,QAAM,UAAmC,CAAC;AAC1C,MAAI,KAAK,UAAU,OAAO,KAAK,WAAW,SAAU,QAAO,OAAO,SAAS,KAAK,MAAM;AACtF,QAAMC,UAAS,OAAO,KAAK,WAAW,YAAY,KAAK,SAAS,KAAK,SAAS;AAC9E,MAAIA,QAAQ,SAAQ,SAASA;AAC7B,QAAM,QAAQ,IAAI,QAAQ,IAAI,aAAa;AAC3C,MAAI,SAAS,QAAQ,KAAK,KAAK,EAAG,SAAQ,aAAa,OAAO,KAAK;AACnE,QAAM,OACJ,SAAS,0BAA0B,kCACjC,SAAS,sBAAsB,QAAQ,QAAQ,cAAc,UAAU,kBACvE,SAAS,yBAAyB,wDAClC,SAAS,uBAAuB,uBAChC;AACJ,QAAM,OAAQ,KAAK,QAA2C;AAC9D,QAAM,aAAa,SAAS,wBAAwB,MAAM,QAAQ,IAAI,IACjE,KAAwD,IAAI,CAAC,OAAO,EAAE,MAAM,OAAgB,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,EAAE,IACpI;AACJ,MAAI,WAAY,QAAO,QAAQ;AAG/B,QAAM,eAAe,CAAC,KAAK,SAAS,KAAK,UAAU,gBAAgB,KAAK,UAAU;AAClF,QAAM,UAAW,gBAAgBA,WAAW,KAAK,SAAS,mBAAmB,IAAI,MAAM;AACvF,SAAO,IAAI,UAAU,MAAM,SAAS;AAAA,IAClC,QAAQ,IAAI;AAAA,IAAQ;AAAA,IAAW;AAAA,IAAY;AAAA,IAAM;AAAA,IACjD,SAAS,OAAO,KAAK,OAAO,EAAE,SAAS,UAAU;AAAA,EACnD,CAAC;AACH;;;AD3FA,OAAOC,SAAQ;;;AELf,OAAO,MAAM,oBAAoB;AAI1B,SAAS,WAAWC,KAAQ,MAAqB;AACtD,EAAAA,IAAG,IAAI,KAAK,UAAU,EAAE,IAAI,MAAM,KAAK,CAAC,CAAC;AAC3C;AAEO,SAAS,YAAYA,KAAQ,KAAcC,OAAe,eAAe,GAAG,kBAAwB;AACzG,MAAIA,OAAM;AAAE,IAAAD,IAAG,IAAI,KAAK,UAAU,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,CAAC,CAAC;AAAG;AAAA,EAAO;AACnF,MAAI,eAAe,SAAS,IAAI,SAAS,kBAAkB;AAAE,IAAAA,IAAG,IAAI,WAAW;AAAG;AAAA,EAAO;AACzF,QAAM,IAAI,aAAa,YAAY;AACnC,QAAM,IAAI,eAAe,YAAY,MAAM,IAAI,UAAU,iBAAiB,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC;AAC1H,EAAAA,IAAG,IAAI,EAAE,IAAI,UAAU,EAAE,OAAO,EAAE,CAAC;AACnC,MAAI,EAAE,KAAM,CAAAA,IAAG,IAAI,EAAE,IAAI;AACzB,EAAAA,IAAG,IAAI,EAAE,IAAI,SAAS,EAAE,IAAI,GAAG,EAAE,YAAY,aAAa,EAAE,SAAS,MAAM,EAAE,EAAE,CAAC;AAClF;;;AFHO,SAAS,oBAAoBE,OAA0B;AAC5D,QAAM,IAAIA,MAAK,QAAQ,IAAI;AAC3B,SAAO,MAAM,KAAKA,QAAOA,MAAK,MAAM,GAAG,CAAC;AAC1C;AAKA,SAAS,aAAaA,OAAyB;AAC7C,SAAO,oBAAoBA,KAAI,EAAE,KAAK,CAAC,MAAM,MAAM,YAAY,EAAE,WAAW,SAAS,CAAC;AACxF;AASO,SAAS,WAAW,KAA2D;AACpF,SAAO,IAAI,KAAK,EAAE,UAAU,CAACC,UAAS,IAAI,GAAG,IAAIA,KAAI,IAAI;AAC3D;AAEO,SAAS,aAAaC,OAAYC,KAAQ,QAAqB,UAAsB,aAA8C;AACxI,QAAM,UAAU,IAAI,QAAQ,MAAM,EAC/B,YAAY,oBAAoB,EAChC,OAAO,uBAAuB,uFAAuF,EACrH,OAAO,UAAU,2CAA2C,EAC5D,OAAO,cAAc,cAAc,EACnC,OAAO,aAAa,mCAAmC,EACvD,OAAO,cAAc,iBAAiB,EACtC,aAAa,EACb,gBAAgB,EAAE,UAAU,CAAC,MAAMA,IAAG,IAAI,EAAE,QAAQ,CAAC,GAAG,UAAU,CAAC,MAAMA,IAAG,IAAI,EAAE,QAAQ,CAAC,EAAE,CAAC;AACjG,QAAM,MAAsB,EAAE,MAAAD,OAAM,IAAAC,KAAI,QAAQ,MAAM,MAAM,QAAQ,KAAiB,GAAG,YAAY;AACpG,aAAW,KAAK,SAAU,GAAE,SAAS,GAAG;AACxC,SAAO;AACT;AAEA,eAAsB,IAAIH,OAAgBE,OAAYC,KAAQ,QAAqB,UAAuC;AACxH,QAAMC,QAAO,aAAaJ,KAAI;AAI9B,QAAM,UAAcI,QAAO,EAAE,GAAGD,KAAI,KAAK,MAAM;AAAA,EAAC,EAAE,IAAIA;AACtD,QAAM,QAA+B,CAAC;AACtC,QAAM,UAAU,aAAaD,OAAM,SAAS,QAAQ,UAAU,CAAC,SAAS;AAAE,UAAM,WAAW;AAAA,EAAK,CAAC;AACjG,MAAI;AACF,UAAM,QAAQ,WAAWF,OAAM,EAAE,MAAM,OAAO,CAAC;AAC/C,WAAO,MAAM,YAAY;AAAA,EAC3B,SAAS,QAAQ;AAEf,UAAM,IAAI,OAAO,WAAW,aAAa,MAAM,IAAI,IAAI,eAAe,IAAI;AAC1E,QAAI,aAAa,gBAAgB;AAC/B,UAAI,EAAE,aAAa,EAAG,QAAO;AAC7B,UAAII,MAAM,CAAAD,IAAG,IAAI,KAAK,UAAU,EAAE,IAAI,OAAO,OAAO,EAAE,MAAM,wBAAwB,SAAS,EAAE,QAAQ,EAAE,CAAC,CAAC;AAC3G,aAAO;AAAA,IACT;AACA,UAAM,OAAO,QAAQ,KAAiB;AACtC,gBAAYA,KAAI,GAAG,QAAQ,KAAK,IAAI,GAAGE,IAAG,oBAAoB,KAAK,UAAU,KAAK;AAClF,WAAO,YAAY,CAAC;AAAA,EACtB;AACF;;;AG1EA,SAAS,QAAAC,OAAM,YAAAC,WAAU,WAAAC,gBAAe;AACxC,SAAS,cAA4B;;;ACIrC,IAAM,YAAY,CAAC,IAAI;AACvB,IAAM,SAAS;AAER,SAAS,gBAAgB,GAAW,GAAmB;AAC5D,QAAM,KAAK,OAAO,KAAK,CAAC,GAAG,KAAK,OAAO,KAAK,CAAC;AAC7C,MAAI,CAAC,MAAM,CAAC,GAAI,QAAO;AACvB,WAAS,IAAI,GAAG,KAAK,GAAG,KAAK;AAC3B,UAAM,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC;AACtC,QAAI,MAAM,EAAG,QAAO;AAAA,EACtB;AACA,MAAI,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,EAAG,QAAO;AAC5B,MAAI,CAAC,GAAG,CAAC,KAAK,GAAG,CAAC,EAAG,QAAO;AAC5B,SAAO;AACT;AAEA,eAAsB,UAAUC,QAAc,WAAqC;AACjF,MAAI;AACJ,MAAI;AAAE,UAAM,MAAMA,OAAM,GAAG,SAAS,iBAAiB,EAAE,SAAS,EAAE,QAAQ,mBAAmB,EAAE,CAAC;AAAA,EAAE,SAC3F,GAAG;AAAE,UAAM,WAAW,GAAG,IAAI,IAAI,SAAS,EAAE,IAAI;AAAA,EAAE;AACzD,MAAI,IAAI,WAAW,KAAK;AAEtB,UAAM,IAAI,UAAU,4BAA4B,iDAAiD;AAAA,MAC/F,QAAQ;AAAA,MAAK,WAAW,IAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MAC3D,MAAM,yBAAyB,SAAS;AAAA,IAC1C,CAAC;AAAA,EACH;AACA,MAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,SAAQ,MAAM,IAAI,KAAK;AACzB;AAEO,SAAS,UAAU,MAAe,QAAmB,YAA0C;AACpG,MAAI,OAAO,gBAAgB,KAAK,KAAK,WAAW,OAAO,cAAc;AACnE,UAAM,IAAI,UAAU,yBAAyB,GAAG,OAAO,SAAS,0CAA0C;AAAA,MACxG,SAAS,EAAE,UAAU,OAAO,cAAc,KAAK,KAAK,KAAK,OAAO;AAAA,MAChE,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,aAAa,UAAU,KAAK,CAAC,MAAM,KAAK,YAAY,SAAS,CAAC,CAAC;AACrE,MAAI,CAAC,YAAY;AACf,UAAM,IAAI,UAAU,4BAA4B,qDAAqD;AAAA,MACnG,SAAS,EAAE,QAAQ,KAAK,aAAa,QAAQ,CAAC,GAAG,SAAS,EAAE;AAAA,MAAG,MAAM;AAAA,IACvE,CAAC;AAAA,EACH;AACA,MAAI,CAAC,WAAW,SAAS,MAAM,KAAK,gBAAgB,YAAY,KAAK,aAAa,IAAI,GAAG;AACvF,UAAM,IAAI,UAAU,yBAAyB,QAAQ,UAAU,sCAAsC,KAAK,aAAa,KAAK;AAAA,MAC1H,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,SAAO,EAAE,WAAW;AACtB;;;ACjDA,IAAM,SAAS;AAEf,SAAS,OAAO,KAA8B;AAC5C,SAAO,CAAC,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAS,IAAgB,YAAY;AACxF;AAEA,eAAe,SAASC,OAAY,WAAmB,SAA+D;AACpH,QAAM,UAAU,MAAMA,MAAK,OAAO,KAAK,GAAG,SAAS,SAAS,GAAG;AAC/D,MAAI,CAAC,WAAW,UAAU,OAAO,OAAO,GAAG,KAAKA,MAAK,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,OAAO,SAAS,EAAE,QAAQ,IAAI,QAAQ;AACpH,WAAO,EAAE,MAAM,OAAO,KAAK,QAAQ,KAAK;AAAA,EAC1C;AACA,QAAM,OAAO,MAAM,UAAUA,MAAK,OAAO,SAAS;AAClD,QAAMA,MAAK,OAAO,OAAO,CAAC,MAAM;AAC9B,UAAM,IAAI,EAAE,SAAS,SAAS;AAC9B,QAAI,EAAG,GAAE,OAAO,EAAE,WAAWA,MAAK,IAAI,EAAE,YAAY,GAAG,KAAK,KAAK;AAAA,EACnE,CAAC;AACD,SAAO,EAAE,MAAM,QAAQ,MAAM;AAC/B;AAWA,eAAsB,iBAAiBC,OAAY,WAAmB,YAAsC;AAC1G,QAAM,QAAQ,MAAM,SAASA,OAAM,WAAW,KAAK;AACnD,MAAI,OAAO,MAAM;AACjB,MAAI,CAAC,KAAK,aAAa,SAAS,UAAU,KAAK,MAAM,OAAQ,SAAQ,MAAM,SAASA,OAAM,WAAW,IAAI,GAAG;AAC5G,oBAAkB,MAAM,YAAY,SAAS;AAC7C,SAAO;AACT;AAEO,SAAS,kBAAkB,MAAe,YAAoB,WAAyB;AAC5F,MAAI,KAAK,aAAa,SAAS,UAAU,EAAG;AAC5C,QAAM,IAAI,UAAU,8BAA8B,gCAAgC,UAAU,QAAQ;AAAA,IAClG,MAAM,iBAAiB,SAAS;AAAA,IAChC,SAAS,EAAE,YAAY,QAAQ,UAAU;AAAA,EAC3C,CAAC;AACH;;;AC/CA,SAAS,kBAAkB;AAKpB,IAAM,kBAAkB;AAAA,EAC7B,MAAM;AAAA,IACJ,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AAAA,EACA,SAAS;AAAA,IACP,WAAW;AAAA,IACX,cAAc;AAAA,EAChB;AACF;AAEA,SAAS,WAAW,QAAkC;AACpD,aAAW,CAAC,MAAM,CAAC,KAAK,OAAO,QAAQ,eAAe,GAAG;AACvD,QAAI,EAAE,cAAc,OAAQ,QAAO,EAAE,GAAG,GAAG,SAAS,KAA2B;AAAA,EACjF;AACA,SAAO;AACT;AAEA,SAAS,SAAS,KAAqB;AACrC,MAAI;AACJ,MAAI;AAAE,UAAM,IAAI,IAAI,GAAG;AAAA,EAAE,QAAQ;AAC/B,UAAM,IAAI,UAAU,wBAAwB,6BAA6B,GAAG,IAAI;AAAA,MAC9E,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,WAAW,IAAI,aAAa,eAAe,IAAI,aAAa;AAClE,MAAI,IAAI,aAAa,YAAY,EAAE,IAAI,aAAa,WAAW,WAAW;AACxE,UAAM,IAAI,UAAU,wBAAwB,uDAAuD;AAAA,EACrG;AACA,SAAO,IAAI,OAAO,YAAY;AAChC;AAEO,SAAS,cAAc,KAAyB,gBAA+C;AACpG,QAAM,SAAS,OAAO;AACtB,MAAI,WAAW,UAAa,WAAW,OAAQ,QAAO,EAAE,GAAG,gBAAgB,MAAM,SAAS,OAAO;AACjG,MAAI,WAAW,UAAW,QAAO,EAAE,GAAG,gBAAgB,SAAS,SAAS,UAAU;AAClF,QAAM,SAAS,SAAS,MAAM;AAC9B,SAAO,WAAW,MAAM,KAAK,EAAE,WAAW,QAAQ,cAAc,MAAM,SAAS,KAAK;AACtF;AAEO,SAAS,YAAY,WAAmB,QAAwB;AACrE,SAAO,WAAW,QAAQ,EAAE,OAAO,GAAG,SAAS,IAAI,MAAM,EAAE,EAAE,OAAO,KAAK,EAAE,MAAM,GAAG,EAAE;AACxF;;;AC5CO,IAAM,gBAAN,MAAoB;AAAA,EACzB,YAA6B,GAG1B;AAH0B;AAAA,EAGzB;AAAA,EAHyB;AAAA,EAK7B,MAAc,KAAK,QAAwB,MAAc,MAAe,OAAmC;AACzG,UAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,KAAK;AACtC,UAAM,UAAkC;AAAA,MACtC,eAAe,UAAU,KAAK;AAAA,MAC9B,QAAQ;AAAA,MACR,oBAAoB,KAAK,EAAE;AAAA,MAC3B,gBAAgB,KAAK,EAAE;AAAA,MACvB,cAAc,QAAQ,KAAK,EAAE,UAAU,KAAK,KAAK,EAAE,QAAQ;AAAA,IAC7D;AACA,QAAI,SAAS,OAAW,SAAQ,cAAc,IAAI;AAClD,QAAI;AACJ,QAAI;AACF,YAAM,MAAM,KAAK,EAAE,MAAM,GAAG,KAAK,EAAE,SAAS,GAAG,IAAI,IAAI;AAAA,QACrD;AAAA,QAAQ;AAAA,QAAS,MAAM,SAAS,SAAY,SAAY,KAAK,UAAU,IAAI;AAAA,MAC7E,CAAC;AAAA,IACH,SAAS,GAAG;AAAE,YAAM,WAAW,GAAG,IAAI,IAAI,KAAK,EAAE,SAAS,EAAE,IAAI;AAAA,IAAE;AAClE,UAAM,MAAM,IAAI,QAAQ,IAAI,cAAc;AAC1C,SAAK,EAAE,YAAY,GAAG,MAAM,IAAI,IAAI,WAAM,IAAI,MAAM,GAAG,MAAM,KAAK,GAAG,MAAM,EAAE,EAAE;AAC/E,WAAO;AAAA,EACT;AAAA,EAEA,MAAc,QAAW,QAAwB,MAAc,MAA4B;AACzF,QAAI,MAAM,MAAM,KAAK,KAAK,QAAQ,MAAM,MAAM,KAAK;AACnD,QAAI,IAAI,WAAW,KAAK;AACtB,YAAM,MAAM,KAAK,KAAK,QAAQ,MAAM,MAAM,IAAI;AAC9C,UAAI,IAAI,WAAW,KAAK;AACtB,cAAM,IAAI,UAAU,wBAAwB,6CAA6C;AAAA,UACvF,MAAM;AAAA,UAAqB,QAAQ;AAAA,UAAK,WAAW,IAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,QACxF,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,IAAI,GAAI,OAAM,MAAM,eAAe,GAAG;AAC3C,WAAQ,MAAM,IAAI,KAAK;AAAA,EACzB;AAAA,EAEA,IAAO,MAA0B;AAAE,WAAO,KAAK,QAAW,OAAO,IAAI;AAAA,EAAE;AAAA,EACvE,KAAQ,MAAc,MAA2B;AAAE,WAAO,KAAK,QAAW,QAAQ,MAAM,IAAI;AAAA,EAAE;AAChG;;;ACzCA,IAAM,UAAU;AAET,IAAM,qBAAN,MAAyB;AAAA,EAC9B,YAA6B,GAE1B;AAF0B;AAAA,EAEzB;AAAA,EAFyB;AAAA,EAIrB,MAAM,WAA4B;AACxC,WAAO,IAAI,KAAK,SAAS,EAAE,QAAQ,IAAI,KAAK,EAAE,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClE;AAAA,EAEA,MAAc,OAAO,OAAmC;AACtD,QAAI,SAAS,MAAM,KAAK,EAAE,MAAM,WAAW;AAC3C,QAAI,CAAC,OAAQ,OAAM,IAAI,UAAU,sBAAsB,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACrG,QAAI;AACJ,aAAS,UAAU,KAAK,WAAW;AACjC,UAAI;AACF,YAAI,OAAO,MAAM,KAAK,EAAE,KAAK,GAAG,QAAQ,OAAO,IAAI,KAAK;AACxD;AAAA,MACF,SAAS,GAAG;AACV,YAAI,EAAE,aAAa,aAAa,EAAE,SAAS,wBAAyB,OAAM;AAI1E,cAAM,MAAM,MAAM,KAAK,EAAE,MAAM,WAAW;AAC1C,YAAI,OAAO,IAAI,OAAO,OAAO,IAAI;AAC/B,cAAI,YAAY,GAAG;AAAE,qBAAS;AAAK;AAAA,UAAS;AAC5C,gBAAM;AAAA,QACR;AACA,cAAM,KAAK,EAAE,MAAM,MAAM;AACzB,cAAM;AAAA,MACR;AAAA,IACF;AAIA,UAAM,KAAK,EAAE,MAAM,WAAW,EAAE,IAAI,EAAE,cAAc,KAAK,EAAE,KAAK,OAAO,EAAE,UAAU,SAAS,OAAO,QAAQ,YAAY,KAAK,EAAE,IAAI,EAAE,YAAY,EAAE,CAAC;AACnJ,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,YAAY,OAA4B,CAAC,GAAoB;AACjE,UAAM,OAAO,MAAM,KAAK,EAAE,MAAM,UAAU;AAC1C,QAAI,CAAC,KAAK,SAAS,QAAQ,KAAK,MAAM,KAAK,SAAS,EAAG,QAAO,KAAK;AACnE,WAAO,KAAK,EAAE,SAAS,KAAK,EAAE,UAAU,YAAY;AAClD,YAAM,QAAQ,MAAM,KAAK,EAAE,MAAM,UAAU;AAC3C,UAAI,SAAS,MAAM,OAAO,MAAM,MAAM,KAAK,MAAM,MAAM,SAAS,EAAG,QAAO,MAAM;AAChF,YAAM,IAAI,MAAM,KAAK,OAAO;AAC5B,YAAM,KAAK,EAAE,MAAM,UAAU,EAAE,IAAI,EAAE,aAAa,WAAW,IAAI,KAAK,KAAK,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,YAAY,GAAI,EAAE,YAAY,EAAE,CAAC;AAClI,aAAO,EAAE;AAAA,IACX,CAAC;AAAA,EACH;AAAA;AAAA,EAGA,MAAM,WAAW,QAAmC;AAClD,WAAO,KAAK,EAAE,SAAS,KAAK,EAAE,UAAU,aAAa,MAAM,KAAK,OAAO,OAAO,KAAK,GAAG,CAAC,GAAG,WAAW;AAAA,EACvG;AACF;;;ACxDO,IAAM,aAAN,MAAiB;AAAA,EACtB,YAA6B,IAA+B,MAAc;AAA7C;AAA+B;AAAA,EAAe;AAAA,EAA9C;AAAA,EAA+B;AAAA,EAE5D,MAAc,KAAQ,QAAmC;AACvD,UAAM,MAAM,MAAM,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,IAAI,MAAM,EAAE;AACtD,QAAI,QAAQ,KAAM,QAAO;AACzB,QAAI;AAAE,aAAO,KAAK,MAAM,GAAG;AAAA,IAAO,QAAQ;AAAE,aAAO;AAAA,IAAK;AAAA,EAC1D;AAAA,EAEA,aAAa;AAAE,WAAO,KAAK,KAAoB,SAAS;AAAA,EAAE;AAAA,EAC1D,YAAY;AAAE,WAAO,KAAK,KAAmB,QAAQ;AAAA,EAAE;AAAA,EACvD,WAAW,GAAkB;AAAE,WAAO,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,YAAY,KAAK,UAAU,CAAC,CAAC;AAAA,EAAE;AAAA,EAC7F,UAAU,GAAiB;AAAE,WAAO,KAAK,GAAG,IAAI,GAAG,KAAK,IAAI,WAAW,KAAK,UAAU,CAAC,CAAC;AAAA,EAAE;AAAA,EAC1F,MAAM,QAAQ;AACZ,UAAM,KAAK,GAAG,OAAO,GAAG,KAAK,IAAI,SAAS;AAC1C,UAAM,KAAK,GAAG,OAAO,GAAG,KAAK,IAAI,UAAU;AAAA,EAC7C;AACF;;;ACdO,SAAS,UAAU,QAA2B;AACnD,SAAO,OAAO,YAAY,SAAS,sBAAsB,6BAA6B,OAAO,WAAW,OAAO,SAAS;AAC1H;AAEA,eAAsB,YAAYC,OAAY,QAAmB,SAAiB,WAAiC;AACjH,QAAM,WAAsC,MAAMA,MAAK,OAAO,KAAK,GAAG,SAAS,OAAO,SAAS;AAC/F,MAAI,CAAC,QAAS,OAAM,IAAI,UAAU,sBAAsB,oBAAoB,OAAO,SAAS,IAAI,EAAE,MAAM,UAAU,MAAM,EAAE,CAAC;AAC3H,QAAM,OAAO,YAAY,QAAQ,WAAW,QAAQ,MAAM;AAC1D,QAAM,SAAS,IAAI,WAAWA,MAAK,UAAU,IAAI;AACjD,MAAI,CAAE,MAAM,OAAO,WAAW,EAAI,OAAM,IAAI,UAAU,sBAAsB,oBAAoB,OAAO,SAAS,IAAI,EAAE,MAAM,UAAU,MAAM,EAAE,CAAC;AAC/I,QAAM,UAAU,IAAI,mBAAmB,EAAE,OAAO,QAAQ,MAAM,MAAMA,MAAK,QAAQ,QAAQ,MAAM,GAAG,UAAUA,MAAK,UAAU,UAAU,MAAM,KAAKA,MAAK,IAAI,CAAC;AAC1J,QAAM,MAAM,IAAI,cAAc;AAAA,IAC5B,WAAW,QAAQ;AAAA,IAAW,OAAOA,MAAK;AAAA,IAAO,OAAO,CAAC,UAAU,QAAQ,YAAY,EAAE,MAAM,CAAC;AAAA,IAChG,YAAYA,MAAK;AAAA,IAAS;AAAA,IAAS,UAAU,GAAGA,MAAK,QAAQ,IAAI,QAAQ,IAAI,UAAU,QAAQ,SAAS,IAAI;AAAA,IAAI;AAAA,EAClH,CAAC;AACD,SAAO,EAAE,SAAS,KAAK,QAAQ,QAAQ;AACzC;;;ACnBA,IAAM,OAAO;AAEb,IAAM,mBAAmB,CAAC,YACxB,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,UAAU,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,EAAE;AAO/E,eAAsB,cACpBC,OACA,SACA,KACA,YACyE;AACzE,MAAI,KAAK,KAAK,GAAG,EAAG,QAAO,EAAE,OAAO,KAAK,QAAQ,KAAK;AAEtD,QAAM,KAAK,MAAM,QAAQ,IAAI,IAAW,gBAAgB;AACxD,MAAI;AACJ,MAAI,YAAY;AACd,UAAM,QAAQ,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,UAAU;AAC1D,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,UAAU,2BAA2B,cAAc,UAAU,sBAAsB;AAAA,QAC3F,YAAY,iBAAiB,GAAG,OAAO;AAAA,MACzC,CAAC;AAAA,IACH;AACA,aAAS,EAAE,IAAI,MAAM,IAAI,MAAM,MAAM,KAAK;AAAA,EAC5C,WAAW,QAAQ,QAAQ,cAAc;AACvC,UAAM,SAAS,QAAQ,QAAQ;AAC/B,UAAM,QAAQ,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO,EAAE;AACvD,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,UAAU,2BAA2B,0CAA0C,OAAO,IAAI,IAAI;AAAA,QACtG,MAAM;AAAA,QAAiC,YAAY,iBAAiB,GAAG,OAAO;AAAA,MAChF,CAAC;AAAA,IACH;AACA,aAAS,EAAE,IAAI,MAAM,IAAI,MAAM,MAAM,KAAK;AAAA,EAC5C,WAAW,GAAG,QAAQ,WAAW,GAAG;AAClC,aAAS,EAAE,IAAI,GAAG,QAAQ,CAAC,EAAG,IAAI,MAAM,GAAG,QAAQ,CAAC,EAAG,KAAK;AAAA,EAC9D,OAAO;AACL,UAAM,IAAI,UAAU,yBAAyB,oBAAoB,GAAG,SAAS;AAAA,MAC3E,MAAM;AAAA,MAA0D,YAAY,iBAAiB,GAAG,OAAO;AAAA,IACzG,CAAC;AAAA,EACH;AAEA,MAAI;AACF,UAAM,EAAE,GAAG,IAAI,MAAM,QAAQ,IAAI;AAAA,MAC/B,uBAAuB,mBAAmB,OAAO,EAAE,CAAC,sBAAsB,mBAAmB,GAAG,CAAC;AAAA,IAAE;AACrG,WAAO,EAAE,OAAO,IAAI,OAAO;AAAA,EAC7B,SAAS,GAAG;AAIV,QAAI,aAAa,aAAa,EAAE,SAAS,6BAA6B,CAAC,EAAE,MAAM;AAC7E,YAAM,IAAI,UAAU,EAAE,MAAM,EAAE,SAAS;AAAA,QACrC,MAAM;AAAA,QACN,QAAQ,EAAE;AAAA,QAAQ,WAAW,EAAE;AAAA,QAAW,YAAY,EAAE;AAAA,QAAY,YAAY,EAAE;AAAA,QAAY,SAAS,EAAE;AAAA,QAAS,OAAO,EAAE;AAAA,MAC7H,CAAC;AAAA,IACH;AACA,UAAM;AAAA,EACR;AACF;;;AClEA,SAAS,QAAAC,OAAM,gBAAgB;;;ACA/B,SAAS,QAAAC,aAAY;;;ACArB,SAAS,OAAO,OAAO,UAAU,QAAQ,iBAAiB;AAC1D,SAAS,YAAY;AACrB,SAAS,mBAAmB;AAE5B,eAAsB,SAAY,MAAiC;AACjE,MAAI;AACJ,MAAI;AAAE,UAAM,MAAM,SAAS,MAAM,MAAM;AAAA,EAAE,SAAS,GAAG;AACnD,QAAK,EAA4B,SAAS,SAAU,QAAO;AAC3D,UAAM;AAAA,EACR;AACA,SAAO,KAAK,MAAM,GAAG;AACvB;AAEA,eAAsB,gBAAgBC,MAAa,MAAc,MAA8B;AAC7F,QAAM,MAAMA,MAAK,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACjD,QAAM,MAAM,KAAKA,MAAK,IAAI,IAAI,IAAI,YAAY,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM;AACtE,QAAM,UAAU,KAAK,KAAK,UAAU,MAAM,MAAM,CAAC,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;AAC1E,QAAM,MAAM,KAAK,GAAK;AACtB,QAAM,OAAO,KAAK,KAAKA,MAAK,IAAI,CAAC;AACnC;;;ADdA,IAAMC,UAAS,KAAK;AAIb,IAAM,kBAAN,MAAsB;AAAA,EAC3B,YAA6BC,MAA8B,KAAiB;AAA/C,eAAAA;AAA8B;AAAA,EAAkB;AAAA,EAAhD;AAAA,EAA8B;AAAA,EAE3D,MAAc,OAA2B;AACvC,QAAI;AACF,YAAM,IAAI,MAAM,SAAoBC,MAAK,KAAK,KAAK,YAAY,CAAC;AAChE,UAAI,KAAK,EAAE,kBAAkB,KAAK,OAAO,EAAE,YAAY,YAAY,EAAE,QAAS,QAAO;AAAA,IACvF,QAAQ;AAAA,IAA4C;AACpD,WAAO,EAAE,eAAe,GAAG,SAAS,CAAC,EAAE;AAAA,EACzC;AAAA,EAEQ,MAAM,GAAkC;AAC9C,WAAO,CAAC,CAAC,KAAK,KAAK,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,IAAIF;AAAA,EAC1E;AAAA,EAEA,MAAM,IAAI,QAAgB,KAAqC;AAC7D,UAAM,KAAK,MAAM,KAAK,KAAK,GAAG,QAAQ,GAAG,MAAM,IAAI,GAAG,EAAE;AACxD,WAAO,KAAK,MAAM,CAAC,IAAI,EAAE,WAAW;AAAA,EACtC;AAAA;AAAA;AAAA,EAIA,MAAM,IAAI,QAAgB,KAAa,UAAiC;AACtE,UAAM,IAAI,MAAM,KAAK,KAAK;AAC1B,MAAE,QAAQ,GAAG,MAAM,IAAI,GAAG,EAAE,IAAI,EAAE,UAAU,YAAY,KAAK,IAAI,EAAE,YAAY,EAAE;AACjF,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,OAAO,EAAG,KAAI,CAAC,KAAK,MAAM,CAAC,EAAG,QAAO,EAAE,QAAQ,CAAC;AACtF,UAAM,KAAK,KAAK,CAAC;AAAA,EACnB;AAAA;AAAA,EAGA,MAAM,KAAK,QAAgB,KAA4B;AACrD,UAAM,IAAI,MAAM,KAAK,KAAK;AAC1B,QAAI,EAAE,GAAG,MAAM,IAAI,GAAG,MAAM,EAAE,SAAU;AACxC,WAAO,EAAE,QAAQ,GAAG,MAAM,IAAI,GAAG,EAAE;AACnC,UAAM,KAAK,KAAK,CAAC;AAAA,EACnB;AAAA,EAEA,MAAc,KAAK,GAA6B;AAC9C,QAAI;AAAE,YAAM,gBAAgB,KAAK,KAAK,cAAc,CAAC;AAAA,IAAE,QAAQ;AAAA,IAAmB;AAAA,EACpF;AAAA,EAEA,MAAM,WAAW,MAAmC;AAClD,UAAM,IAAI,MAAM,KAAK,KAAK;AAC1B,UAAM,OAAyC,CAAC;AAChD,eAAW,CAAC,GAAG,CAAC,KAAK,OAAO,QAAQ,EAAE,OAAO,GAAG;AAC9C,YAAMG,OAAM,EAAE,YAAY,GAAG;AAC7B,UAAI,KAAK,SAAS,EAAE,MAAMA,OAAM,CAAC,CAAC,KAAK,KAAK,MAAM,CAAC,EAAG,MAAK,KAAK,EAAE,QAAQ,EAAE,MAAM,GAAGA,IAAG,GAAG,IAAI,IAAI,KAAK,EAAE,UAAU,EAAE,QAAQ,EAAE,CAAC;AAAA,IACnI;AACA,SAAK,KAAK,CAAC,GAAG,MAAM,EAAE,KAAK,EAAE,EAAE;AAC/B,WAAO,CAAC,GAAG,IAAI,IAAI,KAAK,IAAI,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;AAAA,EAC/C;AACF;;;AExDA,IAAM,MAAM;AACZ,IAAM,UAAU,oBAAI,IAAI,CAAC,UAAU,SAAS,QAAQ,MAAM,CAAC;AAG3D,IAAM,eAAe,oBAAI,IAAI,CAAC,KAAK,MAAM,OAAO,UAAU,QAAQ,MAAM,CAAC;AACzE,IAAM,gBAAgB,CAAC,WAAqB,OAAO,KAAK,CAAC,MAAM,aAAa,IAAI,EAAE,YAAY,CAAC,CAAC;AAEzF,SAAS,QAAQ,KAA4B;AAClD,MAAI,MAAM,IAAI,KAAK;AACnB,MAAI,IAAI,WAAW,MAAM,EAAG,OAAM,IAAI,MAAM,CAAC;AAE7C,MAAI,CAAC,OAAO,IAAI,SAAS,IAAI,EAAG,QAAO;AACvC,MAAI;AACJ,MAAI;AACJ,MAAI,IAAI,SAAS,KAAK,GAAG;AACvB,QAAI,cAAc,IAAI,MAAM,IAAI,QAAQ,KAAK,IAAI,CAAC,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC,CAAC,EAAG,QAAO;AACjF,QAAI;AACJ,QAAI;AAAE,UAAI,IAAI,IAAI,GAAG;AAAA,IAAE,QAAQ;AAAE,aAAO;AAAA,IAAK;AAC7C,QAAI,CAAC,QAAQ,IAAI,EAAE,SAAS,YAAY,CAAC,EAAG,QAAO;AAEnD,WAAO,EAAE;AACT,WAAO,EAAE;AAAA,EACX,OAAO;AACL,UAAM,IAAI,IAAI,KAAK,GAAG;AACtB,QAAI,CAAC,EAAG,QAAO;AACf,WAAO,EAAE,CAAC;AACV,WAAO,EAAE,CAAC;AAAA,EACZ;AACA,QAAM,WAAW,KAAK,MAAM,GAAG,EAAE,OAAO,OAAO;AAC/C,MAAI,CAAC,QAAQ,SAAS,WAAW,KAAK,cAAc,QAAQ,EAAG,QAAO;AACtE,QAAM,QAAQ,SAAS,CAAC;AACxB,MAAI,OAAO,SAAS,CAAC;AACrB,MAAI,KAAK,YAAY,EAAE,SAAS,MAAM,EAAG,QAAO,KAAK,MAAM,GAAG,EAAE;AAChE,MAAI,CAAC,KAAM,QAAO;AAClB,SAAO,GAAG,KAAK,YAAY,CAAC,IAAI,MAAM,YAAY,CAAC,IAAI,KAAK,YAAY,CAAC;AAC3E;;;ACvCA,SAAS,gBAAgB;AAIlB,SAAS,SAAS,MAAc,UAAmC;AACxE,SAAO,aAAa,UAAU,KAAK,YAAY,IAAI;AACrD;AAEA,eAAe,MAAMC,OAAY,MAA+B;AAC9D,MAAI,OAAO;AACX,MAAI;AACF,WAAO,MAAM,SAAS,IAAI;AAAA,EAC5B,SAAS,GAAG;AACV,QAAK,EAA4B,SAAS,SAAU,OAAM;AAAA,EAE5D;AACA,SAAO,SAAS,MAAMA,MAAK,QAAQ;AACrC;AAEA,eAAsB,UAAUA,OAAY,MAAc,UAAoC;AAC5F,QAAM,MAAM,MAAMA,MAAK,OAAO,KAAK;AACnC,UAAQ,IAAI,eAAe,MAAM,MAAMA,OAAM,IAAI,CAAC,KAAK,CAAC,GAAG,SAAS,QAAQ;AAC9E;AAEA,eAAsB,MAAMA,OAAY,MAAc,UAAiC;AACrF,QAAM,MAAM,MAAM,MAAMA,OAAM,IAAI;AAClC,QAAMA,MAAK,OAAO,OAAO,CAAC,MAAM;AAC9B,UAAM,QAAS,EAAE,iBAAiB,CAAC;AACnC,UAAM,OAAO,IAAI,IAAI,MAAM,GAAG,KAAK,CAAC,CAAC;AACrC,SAAK,IAAI,QAAQ;AACjB,UAAM,GAAG,IAAI,CAAC,GAAG,IAAI;AAAA,EACvB,CAAC;AACH;;;AChCA,SAAS,QAAAC,aAAY;AAerB,IAAM,UAAU;AAKT,SAAS,mBAAmB,SAA0B;AAC3D,MAAI;AACJ,MAAI;AAAE,QAAI,IAAI,IAAI,OAAO;AAAA,EAAE,QAAQ;AAAE,WAAO;AAAA,EAAM;AAClD,MAAI,EAAE,aAAa,YAAY,CAAC,EAAE,YAAY,EAAE,SAAS,WAAW,GAAG,EAAG,QAAO;AACjF,MAAI,EAAE,YAAY,EAAE,YAAY,EAAE,UAAU,EAAE,KAAM,QAAO;AAC3D,QAAM,WAAW,EAAE,SAAS,QAAQ,QAAQ,EAAE,EAAE,MAAM,GAAG,EAAE,MAAM,CAAC;AAClE,SAAO,SAAS,WAAW,KAAK,SAAS,MAAM,CAAC,MAAM,QAAQ,KAAK,CAAC,KAAK,CAAC,EAAE,WAAW,GAAG,KAAK,MAAM,OAAO,MAAM,IAAI;AACxH;AAEO,SAAS,wBAAwB,MAAc,SAA4B;AAChF,SAAO,IAAI,UAAU,iBAAiB,GAAG,IAAI,gCAAgC,KAAK,UAAU,OAAO,CAAC,IAAI;AAAA,IACtG,MAAM;AAAA,EACR,CAAC;AACH;AAEO,SAAS,SAAS,SAAiB,UAAmC;AAC3E,MAAI,CAAC,mBAAmB,OAAO,EAAG,OAAM,wBAAwB,UAAU,OAAO;AACjF,MAAI,aAAa,QAAS,QAAO;AACjC,QAAM,IAAI,IAAI,IAAI,OAAO;AACzB,SAAO,OAAO,EAAE,QAAQ,IAAI,EAAE,SAAS,QAAQ,QAAQ,EAAE,EAAE,QAAQ,QAAQ,EAAE,EAAE,QAAQ,UAAU,EAAE,CAAC;AACtG;AAMO,SAAS,cACd,MACA,SACA,MACAC,aACgD;AAChD,QAAM,UAA0B,QAAQ,IAAI,CAAC,WAAW;AACtD,UAAMC,OAAMC,MAAK,MAAM,OAAO,IAAI;AAClC,QAAI,CAAC,OAAO,QAAS,QAAO,EAAE,QAAQ,KAAAD,MAAK,MAAM,WAAW,QAAQ,oBAAoB;AACxF,QAAI,CAAC,mBAAmB,OAAO,OAAO,EAAG,QAAO,EAAE,QAAQ,KAAAA,MAAK,MAAM,eAAe,QAAQ,6BAA6B;AACzH,UAAM,OAAO,KAAK,OAAO,IAAI,KAAK,EAAE,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,SAAS,CAAC,EAAE;AAC5F,QAAI,CAAC,KAAK,UAAU,KAAK,MAAO,QAAO,EAAE,QAAQ,KAAAA,MAAK,MAAM,QAAQ;AACpE,QAAI,CAAC,KAAK,OAAQ,QAAO,EAAE,QAAQ,KAAAA,MAAK,MAAM,YAAY,QAAQ,uBAAuB;AACzF,UAAM,OAAO,QAAQ,OAAO,OAAO;AACnC,UAAM,SAAS,KAAK,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,QAAQ;AAC3D,QAAI,SAAS,QAAQ,UAAU,QAAQ,OAAO,GAAG,MAAM,KAAM,QAAO,EAAE,QAAQ,KAAAA,MAAK,MAAM,UAAU;AACnG,WAAO,EAAE,QAAQ,KAAAA,MAAK,MAAM,YAAY,QAAQ,eAAe,QAAQ,OAAO,kBAAkB,IAAI,QAAQ,QAAQ,OAAO,KAAK;AAAA,EAClI,CAAC;AACD,QAAM,QAAQ,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AAChD,SAAO,EAAE,SAAS,SAASD,YAAW,OAAO,CAAC,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,EAAE;AACrE;;;AC7DO,IAAM,eAAe,oBAAI,IAAI,CAAC,0BAA0B,uBAAuB,0BAA0B,CAAC;AAEjH,IAAM,YAAY,CAAC,GAAW,MAAc,EAAE,MAAM,OAAO,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO,EAAE,MAAM,CAAC,CAAC;AAInG,SAAS,qBACd,QACA,GACA,KACA,UACW;AAGX,QAAM,MAAM,mBAAmB,EAAE,OAAQ,IAAI,SAAS,EAAE,SAAU,QAAQ,IAAI,EAAE;AAChF,QAAM,UAAU,EAAE,QAAQ,EAAE,MAAM,UAAU,IAAI;AAChD,MAAI,2BAA2B,KAAK,MAAM,GAAG;AAC3C,UAAM,OAAO,gBAAgB,KAAK,MAAM,IAAI,CAAC;AAC7C,WAAO,IAAI,UAAU,iBAAiB,sCAAsC,EAAE,IAAI,IAAI;AAAA,MACpF,MAAM,kBAAkB,aAAa,QAAQ,YAAY,OAAO,wBAAwB,OAAO,KAAK,IAAI,KAAK,EAAE;AAAA,MAC/G,SAAS,EAAE,GAAG,SAAS,QAAQ,MAAM;AAAA,IACvC,CAAC;AAAA,EACH;AACA,MAAI,+BAA+B,KAAK,MAAM,GAAG;AAC/C,UAAM,OAAO,yDAAyD,KAAK,MAAM,IAAI,CAAC,KAAK;AAC3F,WAAO,IAAI,UAAU,iBAAiB,wBAAwB,IAAI,gBAAgB,EAAE,IAAI,KAAK;AAAA,MAC3F,MAAM,oBAAoB,IAAI;AAAA,MAC9B,SAAS,EAAE,GAAG,SAAS,UAAU,OAAO,QAAQ,WAAW;AAAA,IAC7D,CAAC;AAAA,EACH;AACA,MAAI,kCAAkC,KAAK,MAAM,GAAG;AAClD,WAAO,IAAI,UAAU,iBAAiB,mCAAmC,EAAE,IAAI,IAAI;AAAA,MACjF,MAAM;AAAA,MACN,SAAS,EAAE,GAAG,SAAS,UAAU,MAAM;AAAA,IACzC,CAAC;AAAA,EACH;AACA,MAAI,sFAAsF,KAAK,MAAM,GAAG;AACtG,WAAO,IAAI,UAAU,iBAAiB,qCAAqC,EAAE,IAAI,IAAI;AAAA,MACnF,MAAM;AAAA,MACN,SAAS,EAAE,GAAG,SAAS,UAAU,QAAQ;AAAA,IAC3C,CAAC;AAAA,EACH;AACA,MAAI,kDAAkD,KAAK,MAAM,GAAG;AAClE,QAAI,CAAC,EAAE,cAAc;AACnB,aAAO,IAAI,UAAU,0BAA0B,8CAA8C,EAAE,IAAI,KAAK;AAAA,QACtG,MAAM,+BAA+B,IAAI,UAAU;AAAA,QACnD;AAAA,MACF,CAAC;AAAA,IACH;AACA,QAAI,EAAE,eAAe,QAAQ;AAQ3B,YAAM,WAAW,EAAE,YAAY,SAAS,IAAI,SAAS,OAAO,CAAC,MAAM,EAAE,WAAY,SAAS,EAAE,EAAE,CAAC,IAAI,CAAC;AACpG,YAAM,cAAc,SAAS,SAAS,WAAW,IAAI;AACrD,YAAM,QAAQ,YAAY,IAAI,CAAC,MAAM,IAAI,EAAE,IAAI,GAAG,EAAE,KAAK,MAAM;AAC/D,YAAM,SAAS,CAAC,GAAG,IAAI,IAAI,YAAY,QAAQ,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC,EAAE,KAAK,IAAI;AAChF,aAAO,IAAI,UAAU,uBAAuB,2BAA2B,EAAE,IAAI,IAAI;AAAA,QAC/E,MAAM,QACF,gCAAgC,KAAK,cAAc,SAAS,KAAK,MAAM,KAAK,EAAE,MAC9E,+CAA+C,EAAE,IAAI;AAAA,QACzD,SAAS,EAAE,GAAG,SAAS,UAAU,YAAY,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE;AAAA,MAClE,CAAC;AAAA,IACH;AACA,UAAM,QAAQ,QAAQ,EAAE,OAAQ,GAAG,MAAM,GAAG,EAAE,CAAC;AAC/C,UAAM,aAAa,QAAQ,4BAA4B,KAAK,gBAAgB;AAC5E,WAAO,IAAI,UAAU,4BAA4B,yBAAyB,EAAE,IAAI,QAAQ;AAAA,MACtF,MAAM,kGAAkG,UAAU;AAAA,MAClH;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO,IAAI,UAAU,iBAAiB,WAAW,EAAE,IAAI,WAAW;AAAA,IAChE,MAAM,CAAC,GAAG,UAAU,QAAQ,CAAC,GAAG,eAAe,GAAG,IAAI,EAAE,KAAK,IAAI;AAAA,IACjE;AAAA,EACF,CAAC;AACH;AAEO,SAAS,oBAAoB,QAAwB;AAC1D,MAAI,gCAAgC,KAAK,MAAM,EAAG,QAAO;AACzD,SAAO,UAAU,QAAQ,CAAC,EAAE,CAAC,KAAK;AACpC;;;ANhEA,SAAS,UAAU,MAAc,GAA0B;AAIzD,MAAI,aAAa,aAAa,EAAE,SAAS,wBAAwB;AAC/D,WAAO,EAAE,MAAM,QAAQ,UAAU,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,MAAM,EAAE,KAAK,EAAE;AAAA,EAC7F;AACA,QAAM;AACR;AAIA,SAAS,eAAeG,OAAY,QAAoC;AACtE,QAAMC,OAAM,SAASD,MAAK,KAAK,OAAO,GAAG,KAAK;AAC9C,QAAM,OAAO,OAAO,WAAW,yBAC3B,+BACA,OAAO,SAAS,iBAAiB,OAAO,MAAM,SAAS,OAAO,OAAO,OAAO,KAAK;AACrF,QAAM,UAAU,OAAO,WAAW,yBAC9B,GAAGC,IAAG,6BACN,OAAO,SAAS,GAAGA,IAAG,4CAA4C,OAAO,MAAM,SAAS,OAAO,OAAO,OAAO,MAC7G,GAAGA,IAAG;AACV,SAAO;AAAA,IACL,MAAM,OAAO,OAAO;AAAA,IAAM,QAAQ;AAAA,IAAY,QAAQ,OAAO;AAAA,IAC7D,OAAO,EAAE,MAAM,2BAA2B,SAAS,MAAM,QAAQA,IAAG,WAAW,IAAI,6BAA6B;AAAA,EAClH;AACF;AAMA,eAAsB,aAAaD,OAAY,GAMnB;AAC1B,QAAM,QAAQ,IAAI,gBAAgBE,MAAKF,MAAK,OAAO,KAAK,OAAO,GAAGA,MAAK,GAAG;AAC1E,QAAM,UAA0B,CAAC;AACjC,aAAW,UAAU,EAAE,SAAS;AAC9B,QAAI;AACJ,YAAQ,OAAO,MAAM;AAAA,MACnB,KAAK;AACH,iBAAS,EAAE,MAAM,OAAO,OAAO,MAAM,QAAQ,UAAU;AACvD;AAAA,MACF,KAAK;AACH,iBAAS,eAAeA,OAAM,MAAM;AACpC;AAAA,MACF,KAAK,eAAe;AAClB,cAAM,IAAI,wBAAwB,OAAO,OAAO,MAAM,OAAO,OAAO,WAAW,EAAE;AACjF,iBAAS,EAAE,MAAM,OAAO,OAAO,MAAM,QAAQ,UAAU,QAAQ,OAAO,QAAQ,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,MAAM,EAAE,KAAK,EAAE;AACxI;AAAA,MACF;AAAA,MACA,KAAK;AACH,iBAAS,EAAE,MAAM,OAAO,OAAO,MAAM,QAAQ,WAAW,QAAQ,OAAO,OAAO;AAC9E;AAAA,MACF,KAAK,SAAS;AACZ,YAAI;AACF,gBAAM,MAAM,SAAS,OAAO,OAAO,SAAU,EAAE,QAAQ;AACvD,gBAAM,IAAI,MAAMA,MAAK,IAAI,MAAM,KAAK,OAAO,GAAG;AAC9C,cAAI,EAAE,IAAI;AACR,kBAAM,MAAMA,OAAM,OAAO,KAAK,OAAO,OAAO,EAAE;AAC9C,kBAAM,MAAM,QAAQ,OAAO,OAAO,OAAQ;AAC1C,gBAAI,IAAK,OAAM,MAAM,IAAI,EAAE,OAAO,WAAW,KAAK,OAAO,OAAO,EAAE;AAClE,qBAAS,EAAE,MAAM,OAAO,OAAO,MAAM,QAAQ,UAAU,KAAK,OAAO,IAAI;AAAA,UACzE,OAAO;AACL,kBAAM,MAAM,qBAAqB,EAAE,QAAQ,OAAO,QAAQ,EAAE,KAAK,EAAE,QAAQ;AAC3E,qBAAS,EAAE,MAAM,OAAO,OAAO,MAAM,QAAQ,UAAU,OAAO,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,MAAM,IAAI,KAAK,EAAE;AAAA,UACzH;AAAA,QACF,SAAS,GAAG;AACV,mBAAS,UAAU,OAAO,OAAO,MAAM,CAAC;AAAA,QAC1C;AACA;AAAA,MACF;AAAA,IACF;AACA,YAAQ,KAAK,MAAM;AACnB,MAAE,SAAS,MAAM;AAAA,EACnB;AACA,SAAO;AACT;AAQA,eAAsB,YACpBA,OACA,SACA,SACA,MACA,KACe;AACf,QAAM,SAAS,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,CAAC,EAAE,OAAO,MAAM,CAAC,CAAC,CAAC;AAC7D,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,WAAW,UAAW;AACjC,UAAM,SAAS,OAAO,IAAI,OAAO,IAAI;AACrC,QAAI,CAAC,OAAQ;AAEb,QAAI;AACJ,QAAI;AACF,iBAAW,MAAMA,MAAK,IAAI,MAAM,OAAO,GAAG;AAAA,IAC5C,SAAS,GAAG;AACV,aAAO,OAAO,QAAQ,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/C;AAAA,IACF;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,MAAM,qBAAqB,SAAS,QAAQ,OAAO,QAAQ,IAAI,KAAK,IAAI,QAAQ;AACtF,aAAO,SAAS;AAChB,aAAO,QAAQ,EAAE,MAAM,IAAI,MAAM,SAAS,IAAI,SAAS,MAAM,IAAI,KAAK;AACtE;AAAA,IACF;AACA,WAAO,SAAS;AAChB,QAAI,CAAC,KAAM;AAEX,QAAI;AACJ,QAAI;AACF,WAAK,MAAMA,MAAK,IAAI,OAAO,OAAO,GAAG;AAAA,IACvC,SAAS,GAAG;AACV,aAAO,OAAO,QAAQ,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/C;AAAA,IACF;AACA,QAAI,CAAC,GAAG,IAAI;AACV,aAAO,SAAS;AAChB,aAAO,SAAS,oBAAoB,GAAG,MAAM;AAC7C;AAAA,IACF;AACA,QAAI,GAAG,OAAO;AACZ,aAAO,SAAS;AAChB,aAAO,SAAS;AAChB;AAAA,IACF;AACA,QAAI,CAAC,GAAG,UAAU;AAChB,aAAO,SAAS;AAChB,aAAO,SAAS;AAChB;AAAA,IACF;AAEA,QAAI;AACJ,QAAI;AACF,gBAAU,MAAMA,MAAK,IAAI,WAAW,OAAO,GAAG;AAAA,IAChD,SAAS,GAAG;AACV,aAAO,OAAO,QAAQ,UAAU,OAAO,MAAM,CAAC,CAAC;AAC/C;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,IAAI;AACf,aAAO,SAAS;AAChB,aAAO,SAAS,oBAAoB,QAAQ,MAAM;AAClD;AAAA,IACF;AACA,WAAO,SAAS;AAAA,EAClB;AACF;;;AOnLA,SAAS,eAAAG,oBAAmB;AAC5B,SAAS,SAAAC,QAAO,YAAAC,WAAU,UAAAC,SAAQ,IAAI,aAAAC,kBAAiB;AACvD,SAAS,SAAS,QAAAC,OAAM,eAAe;AAMhC,IAAM,iBAAiB;AAE9B,IAAMC,QAAO;AAEb,IAAM,UAAU,CAAC,MAAc,QAC7B,IAAI,UAAU,wBAAwB,GAAG,IAAI,KAAK,GAAG,IAAI,EAAE,MAAM,iEAAiE,CAAC;AAErI,eAAe,OAAOC,MAAwC;AAC5D,QAAM,OAAOC,MAAKD,MAAK,cAAc;AACrC,MAAI;AACJ,MAAI;AACF,UAAM,MAAME,UAAS,MAAM,MAAM;AAAA,EACnC,SAAS,GAAG;AACV,UAAM,OAAQ,EAA4B;AAC1C,QAAI,SAAS,YAAY,SAAS,UAAW,QAAO;AAEpD,UAAM,IAAI,UAAU,wBAAwB,GAAG,IAAI,qBAAqB,QAAQ,eAAe,KAAK;AAAA,MAClG,MAAM;AAAA,MAA6E,OAAO;AAAA,IAC5F,CAAC;AAAA,EACH;AACA,MAAI;AACJ,MAAI;AACF,UAAM,KAAK,MAAM,GAAG;AAAA,EACtB,QAAQ;AACN,UAAM,QAAQ,MAAM,gBAAgB;AAAA,EACtC;AACA,QAAM,IAAI,KAAK;AACf,MAAI,CAAC,OAAO,UAAU,CAAC,KAAM,IAAe,EAAG,OAAM,QAAQ,MAAM,0CAA0C;AAC7G,MAAK,IAAe,EAAG,OAAM,IAAI,UAAU,4BAA4B,GAAG,IAAI,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AACnJ,MAAI,OAAO,IAAI,WAAW,YAAY,CAAC,eAAe,KAAK,IAAI,MAAM,EAAG,OAAM,QAAQ,MAAM,6BAA6B;AACzH,MAAI,OAAO,IAAI,UAAU,YAAY,CAACH,MAAK,KAAK,IAAI,KAAK,EAAG,OAAM,QAAQ,MAAM,yBAAyB;AACzG,SAAO,EAAE,MAAMC,MAAK,QAAQ,IAAI,IAAI,IAAI,MAAM,EAAE,OAAO,YAAY,GAAG,OAAO,IAAI,MAAM;AACzF;AAGA,eAAsB,cAAcA,MAAwC;AAC1E,SAAO,OAAOA,IAAG;AACnB;AAGA,eAAsB,cAAc,OAAe,MAAyC;AAC1F,MAAIA,OAAM,QAAQ,KAAK;AACvB,QAAM,OAAO,QAAQ,IAAI;AACzB,aAAS;AACP,UAAM,KAAK,MAAM,OAAOA,IAAG;AAC3B,QAAI,GAAI,QAAO;AACf,UAAM,KAAK,QAAQA,IAAG;AACtB,QAAIA,SAAQ,QAAQ,OAAOA,KAAK,QAAO;AACvC,IAAAA,OAAM;AAAA,EACR;AACF;AAKA,eAAsB,eAAe,MAAc,GAAqD;AACtG,QAAMG,OAAM,MAAM,EAAE,WAAW,KAAK,CAAC;AACrC,QAAM,MAAMF,MAAK,MAAM,IAAI,cAAc,IAAIG,aAAY,CAAC,EAAE,SAAS,KAAK,CAAC,MAAM;AACjF,MAAI;AACF,UAAMC,WAAU,KAAK,KAAK,UAAU,EAAE,eAAe,GAAG,QAAQ,EAAE,QAAQ,OAAO,EAAE,MAAM,GAAG,MAAM,CAAC,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;AAC5H,UAAMC,QAAO,KAAKL,MAAK,MAAM,cAAc,CAAC;AAAA,EAC9C,SAAS,GAAG;AACV,UAAM,GAAG,KAAK,EAAE,OAAO,KAAK,CAAC,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAC7C,UAAM,IAAI,UAAU,iBAAiB,mBAAmBA,MAAK,MAAM,cAAc,CAAC,IAAI,EAAE,OAAO,EAAE,CAAC;AAAA,EACpG;AACF;AAGA,eAAsB,gBAAgBM,OAAY,IAAmC;AACnF,QAAM,SAAS,cAAc,GAAG,QAAQ,MAAS;AACjD,QAAMC,SAAQ,OAAO,WAAW,OAAO;AACvC,QAAM,WAAW,MAAMD,MAAK,OAAO,KAAK,GAAG,SAAS,OAAO,SAAS;AACpE,QAAM,WAAW,WAAY,MAAM,IAAI,WAAWA,MAAK,UAAU,YAAY,QAAQ,WAAW,QAAQ,MAAM,CAAC,EAAE,WAAW;AAC5H,MAAI,CAAC,UAAU;AACb,UAAM,IAAI,UAAU,sBAAsB,6BAA6BC,MAAK,oCAAoC;AAAA,MAC9G,MAAM,6BAA6BA,MAAK;AAAA,IAC1C,CAAC;AAAA,EACH;AACA,SAAO;AACT;;;ACnFA,IAAM,eAAe;AAGrB,IAAM,mBAAmB;AAMlB,SAAS,WAAW,MAAuB;AAChD,SAAO,aAAa,KAAK,IAAI,KAAK,CAAC,iBAAiB,KAAK,IAAI;AAC/D;AAEO,SAAS,gBAAgB,MAAyB;AACvD,SAAO,IAAI,UAAU,iBAAiB,IAAI,IAAI,kCAAkC;AAAA,IAC9E,MAAM;AAAA,EACR,CAAC;AACH;;;ACZO,SAAS,QAAQ,SAA2C;AACjE,QAAM,WAAW,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,YAAY,EAAE,WAAW,UAAU;AACvF,MAAI,SAAS,WAAW,EAAG,QAAO;AAClC,QAAM,KAAK,QAAQ,KAAK,CAAC,MAAM,CAAC,UAAU,WAAW,WAAW,UAAU,SAAS,EAAE,SAAS,EAAE,MAAM,CAAC;AACvG,QAAM,OAAO,CAAC,MAAqB,EAAE,WAAW,aAAa,4BAA4B,EAAE,OAAO,QAAQ;AAC1G,QAAM,YAAY,SAAS,KAAK,CAAC,MAAM,CAAC,aAAa,IAAI,KAAK,CAAC,CAAC,CAAC;AACjE,MAAI,MAAM,CAAC,UAAW,QAAO;AAC7B,QAAM,QAAQ,aAAa,SAAS,CAAC;AAIrC,QAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,SAAS,EAAE;AAClE,SAAO,IAAI,UAAU,KAAK,KAAK,GAAoB,GAAG,SAAS,MAAM,OAAO,WAAW,2BAA2B;AAAA,IAChH,MAAM,MAAM,OAAO;AAAA,IAAM,SAAS,EAAE,QAAQ;AAAA,EAC9C,CAAC;AACH;AAEA,IAAM,iBAAyC;AAAA,EAC7C,wBAAwB;AAAA,EACxB,qBAAqB;AAAA,EACrB,0BAA0B;AAAA,EAC1B,eAAe;AACjB;AASA,SAAS,mBAAmB,MAAkC;AAC5D,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,WAAW;AACf,QAAM,KAAK;AACX,MAAI;AACJ,SAAQ,IAAI,GAAG,KAAK,IAAI,GAAI;AAC1B,UAAM,SAAS,KAAK,MAAM,GAAG,EAAE,KAAK;AACpC,UAAM,iBAAiB,OAAO,MAAM,IAAI,KAAK,CAAC,GAAG;AACjD,QAAI,gBAAgB,MAAM,GAAG;AAC3B,iBAAW,KAAK,MAAM,GAAG,EAAE,QAAQ,CAAC;AACpC;AAAA,IACF;AAAA,EACF;AACA,aAAW,SAAS,KAAK;AACzB,SAAO,SAAS,SAAS,SAAS,CAAC,EAAG,YAAY,IAAI,SAAS,MAAM,CAAC,IAAI;AAC5E;AAEA,SAAS,WAAW,GAAyB;AAC3C,QAAMC,SAAQ,eAAe,EAAE,OAAO,QAAQ,EAAE,KAAK;AACrD,QAAMC,UAAS,mBAAmB,EAAE,OAAO,IAAI;AAC/C,SAAO,UAAK,EAAE,IAAI,MAAMD,MAAK,GAAGC,UAAS,WAAMA,OAAM,KAAK,EAAE;AAC9D;AAEA,SAAS,KAAK,GAAiB,eAA+B;AAC5D,UAAQ,EAAE,QAAQ;AAAA,IAChB,KAAK;AACH,aAAO,UAAK,EAAE,IAAI,YAAY,EAAE,MAAM,YAAO,EAAE,GAAG,KAAK,EAAE;AAAA,IAC3D,KAAK;AACH,aAAO,UAAK,EAAE,IAAI;AAAA,IACpB,KAAK;AACH,aAAO,KAAK,EAAE,IAAI;AAAA,IACpB,KAAK;AACH,aAAO,KAAK,EAAE,IAAI,qBAAgB,EAAE,MAAM;AAAA,IAC5C,KAAK;AACH,aAAO,KAAK,EAAE,IAAI,MAAM,EAAE,UAAU,mBAAmB;AAAA,IACzD,KAAK;AACH,aAAO,KAAK,EAAE,IAAI;AAAA,IACpB,KAAK,YAAY;AAOf,YAAMA,UAAS,gBAAgB,IAAI,mBAAmB,EAAE,OAAO,IAAI,IAAI;AACvE,aAAO,UAAK,EAAE,IAAI,MAAM,EAAE,UAAU,UAAU,GAAGA,UAAS,WAAMA,OAAM,KAAK,EAAE;AAAA,IAC/E;AAAA,IACA,KAAK;AACH,aAAO,WAAW,CAAC;AAAA,IACrB,KAAK;AACH,aAAO,KAAK,EAAE,IAAI;AAAA,EACtB;AACF;AAKO,SAAS,cAAcC,KAAQ,SAAyBC,OAAqB;AAClF,MAAIA,OAAM;AACR,eAAWD,KAAI,EAAE,QAAQ,CAAC;AAC1B;AAAA,EACF;AACA,QAAM,gBAAgB,QAAQ,OAAO,CAAC,MAAM,EAAE,WAAW,UAAU,EAAE;AACrE,MAAI,IAAI;AACR,SAAO,IAAI,QAAQ,QAAQ;AACzB,UAAM,IAAI,QAAQ,CAAC;AACnB,QAAI,EAAE,WAAW,aAAa,EAAE,WAAW,UAAU;AACnD,YAAM,QAAQ,CAAC,CAAC;AAChB,UAAI,IAAI,IAAI;AACZ,aAAO,IAAI,QAAQ,UAAU,QAAQ,CAAC,EAAG,WAAW,EAAE,QAAQ;AAC5D,cAAM,KAAK,QAAQ,CAAC,CAAE;AACtB;AAAA,MACF;AACA,MAAAA,IAAG,IAAI,KAAK,MAAM,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE;AAC/D,UAAI;AACJ;AAAA,IACF;AACA,IAAAA,IAAG,IAAI,KAAK,GAAG,aAAa,CAAC;AAC7B;AAAA,EACF;AACF;AAUO,SAAS,mBAAmBA,KAAQ,SAAyBC,OAAiC;AACnG,QAAM,MAAM,QAAQ,OAAO;AAC3B,MAAI,CAAC,OAAO,CAACA,MAAM,eAAcD,KAAI,SAASC,KAAI;AAClD,SAAO;AACT;;;AlBpHA,SAAS,UAAU,MAAc,GAA0B;AAGzD,MAAI,aAAa,aAAa,EAAE,SAAS,wBAAwB;AAC/D,WAAO,EAAE,MAAM,QAAQ,UAAU,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,MAAM,EAAE,KAAK,EAAE;AAAA,EAC7F;AACA,QAAM;AACR;AAQA,eAAe,WACbC,OAA8BC,KAA0B,SAAkB,QAAgB,YAC1F;AACA,MAAI;AACF,WAAO,MAAM,cAAcD,OAAM,SAAS,QAAQ,UAAU;AAAA,EAC9D,SAAS,GAAG;AACV,QAAI,EAAE,aAAa,cAAe,EAAE,SAAS,2BAA2B,EAAE,SAAS,0BAA4B,OAAM;AACrH,QAAI,CAACC,IAAG,eAAe,CAAC,EAAE,YAAY,OAAQ,OAAM;AACpD,UAAM,OAAO,MAAMA,IAAG,OAAO,mBAAmB,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,EAAE,KAAK,EAAE,CAAC;AACpH,WAAO,cAAcD,OAAM,SAAS,QAAQ,IAAI;AAAA,EAClD;AACF;AAEO,SAAS,cAAc,SAAkB,KAA2B;AACzE,UAAQ,QAAQ,OAAO,EACpB,YAAY,uDAAuD,EACnE,SAAS,SAAS,gBAAgB,EAClC,SAAS,SAAS,4CAA4C,EAC9D,OAAO,mBAAmB,gEAAgE,EAC1F,UAAU,IAAI,OAAO,0BAA0B,oBAAoB,EAAE,QAAQ,CAAC,SAAS,KAAK,CAAC,EAAE,QAAQ,OAAO,CAAC,EAC/G,OAAO,OAAO,QAAgB,QAA4B,UAAiB;AAC1E,UAAM,EAAE,MAAAA,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,UAAM,YAAY,EAAE,UAAU,CAAC,MAAcC,IAAG,IAAI,CAAC,IAAI;AACzD,UAAM,UAAU,MAAM,YAAYD,OAAM,QAAQ,SAAS,SAAS;AAClE,UAAM,iBAAiBA,OAAM,OAAO,WAAW,aAAa;AAE5D,UAAM,MAAM,MAAM,WAAWA,OAAMC,KAAI,SAAS,QAAQ,MAAM,MAAM;AACpE,UAAM,MAAM,MAAM,QAAQ,IAAI,IAAmB,oBAAoB,mBAAmB,IAAI,KAAK,CAAC,UAAU;AAK5G,QAAI,WAAW,UAAa,CAAC,WAAW,IAAI,IAAI,IAAI,EAAG,OAAM,gBAAgB,IAAI,IAAI,IAAI;AACzF,UAAM,WAAW,UAAU,IAAI,IAAI;AACnC,UAAM,OAAOC,SAAQF,MAAK,KAAK,QAAQ;AAMvC,UAAM,OAAO,MAAMA,MAAK,IAAI,QAAQ,IAAI;AACxC,QAAI,KAAK,UAAU,CAAC,KAAK,OAAO;AAC9B,YAAM,KAAK,MAAM,cAAc,IAAI;AACnC,UAAI,CAAC,MAAM,GAAG,UAAU,IAAI,IAAI,MAAM,GAAG,WAAW,OAAO,WAAW;AACpE,cAAM,IAAI,UAAU,2BAA2B,GAAG,IAAI,uCAAuC,IAAI,IAAI,IAAI,IAAI;AAAA,UAC3G,MAAM,sCAAsC,MAAM;AAAA,QACpD,CAAC;AAAA,MACH;AAAA,IACF;AAEA,UAAM,eAAe,MAAM,EAAE,QAAQ,OAAO,WAAW,OAAO,IAAI,IAAI,GAAG,CAAC;AAE1E,UAAM,OAAgC,CAAC;AACvC,UAAM,iBAAiC,CAAC;AACxC,UAAM,gBAAgC,CAAC;AACvC,eAAW,KAAK,IAAI,SAAS;AAC3B,UAAI,CAAC,WAAW,EAAE,IAAI,GAAG;AACvB,sBAAc,KAAK,UAAU,EAAE,MAAM,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC7D;AAAA,MACF;AACA,UAAI;AACF,aAAK,EAAE,IAAI,IAAI,MAAMA,MAAK,IAAI,QAAQG,MAAK,MAAM,EAAE,IAAI,CAAC;AACxD,uBAAe,KAAK,CAAC;AAAA,MACvB,SAAS,GAAG;AACV,sBAAc,KAAK,UAAU,EAAE,MAAM,CAAC,CAAC;AAAA,MACzC;AAAA,IACF;AAEA,UAAM,EAAE,QAAQ,IAAI,cAAc,MAAM,gBAAgB,MAAM,CAAC,CAAC;AAChE,UAAM,UAAU,MAAM,aAAaH,OAAM,EAAE,QAAQ,KAAK,SAAS,UAAU,MAAM,UAAU,UAAU,MAAM;AAAA,IAAC,EAAE,CAAC;AAC/G,eAAW,KAAK,SAAS;AACvB,UAAI,EAAE,WAAW,YAAY,EAAE,IAAK,GAAE,MAAMI,UAASJ,MAAK,KAAK,EAAE,GAAG,KAAK;AAAA,IAC3E;AACA,UAAM,UAAU,CAAC,GAAG,eAAe,GAAG,OAAO;AAE7C,UAAM,MAAM,mBAAmBC,KAAI,SAAS,QAAQ,EAAE,IAAI,CAAC;AAC3D,QAAI,CAAC,EAAE,MAAM;AAGX,MAAAA,IAAG,IAAI,gBAAWE,MAAK,UAAU,qBAAqB,CAAC,EAAE;AACzD,YAAM,QAAQ,QAAQ,KAAK,CAAC,MAAM,EAAE,WAAW,YAAY,EAAE,WAAW,SAAS;AACjF,UAAI,SAAS,CAAC,IAAK,CAAAF,IAAG,IAAI,YAAYE,MAAK,UAAU,MAAM,IAAI,CAAC,mBAAmB;AAAA,IACrF;AACA,QAAI,IAAK,OAAM;AAAA,EACjB,CAAC;AACL;;;AmBzHA,SAAS,eAAAE,oBAAmB;AAC5B,SAAS,SAAAC,QAAO,YAAAC,WAAU,YAAAC,WAAU,UAAAC,SAAQ,QAAQ,aAAAC,kBAAiB;AACrE,SAAS,YAAAC,WAAU,WAAAC,UAAS,QAAAC,QAAM,YAAAC,iBAAgB;;;ACFlD,SAAS,YAAAC,iBAAgB;AACzB,SAAS,QAAAC,aAAY;AAOrB,IAAM,YAAY,CAAC,UAAU,OAAO,aAAa,UAAU,UAAU,YAAY,OAAO,SAAS,UAAU,UAAU;AACrH,IAAM,MAAM;AAEZ,IAAMC,WAAU,CAAC,KAAa,YAC5B,IAAI,UAAU,wBAAwB,eAAe,GAAG,IAAI,EAAE,MAAM,oEAAoE,QAAQ,CAAC;AAE5I,SAAS,eAAe,MAA2D;AACxF,SAAO,SAAS,aACZ,EAAE,SAAS,cAAc,cAAc,CAAC,uBAAuB,EAAE,IACjE,EAAE,SAAS,QAAQ,cAAc,CAAC,EAAE;AAC1C;AAEA,eAAsB,eAAe,MAAmC;AACtE,MAAI;AACJ,MAAI;AAAE,UAAM,MAAMC,UAASC,MAAK,MAAM,YAAY,GAAG,MAAM;AAAA,EAAE,SAAS,GAAG;AACvE,QAAK,EAA4B,SAAS,SAAU,QAAO,CAAC;AAC5D,UAAM;AAAA,EACR;AACA,MAAI;AACJ,MAAI;AAAE,UAAM,KAAK,MAAM,GAAG;AAAA,EAA6B,QAAQ;AAAE,UAAMF,SAAQ,gBAAgB;AAAA,EAAE;AACjG,MAAI,CAAC,OAAO,OAAO,QAAQ,YAAY,MAAM,QAAQ,GAAG,EAAG,OAAMA,SAAQ,mBAAmB;AAG5F,QAAM,IAAI,IAAI,kBAAkB,SAAY,IAAI,IAAI;AACpD,MAAI,CAAC,OAAO,UAAU,CAAC,KAAM,IAAe,EAAG,OAAMA,SAAQ,0CAA0C;AACvG,MAAK,IAAe,GAAG;AACrB,UAAM,IAAI,UAAU,4BAA4B,4BAA4B,CAAC,4BAA4B,EAAE,MAAM,gCAAgC,CAAC;AAAA,EACpJ;AACA,aAAW,KAAK,UAAW,KAAI,KAAK,IAAK,OAAMA,SAAQ,IAAI,CAAC,2EAAsE,EAAE,OAAO,EAAE,CAAC;AAC9I,QAAM,MAAkB,CAAC;AACzB,MAAI,IAAI,YAAY,QAAW;AAC7B,QAAI,OAAO,IAAI,YAAY,YAAY,CAAC,IAAI,QAAS,OAAMA,SAAQ,oCAAoC;AACvG,QAAI,UAAU,IAAI;AAAA,EACpB;AACA,MAAI,IAAI,iBAAiB,QAAW;AAClC,QAAI,CAAC,MAAM,QAAQ,IAAI,YAAY,KAAK,CAAC,IAAI,aAAa,MAAM,CAAC,MAAM,OAAO,MAAM,YAAY,IAAI,KAAK,CAAC,CAAC,GAAG;AAC5G,YAAMA,SAAQ,8CAA8C;AAAA,IAC9D;AAGA,QAAI,IAAI,IAAI,IAAI,YAAY,EAAE,SAAS,IAAI,aAAa,OAAQ,OAAMA,SAAQ,0CAA0C;AACxH,QAAI,eAAe,IAAI;AAAA,EACzB;AACA,SAAO;AACT;;;ACpDA,SAAS,YAAY,QAAAG,OAAM,YAAAC,iBAAgB;;;ACA3C,SAAS,YAAY;AACrB,SAAS,WAAAC,UAAS,QAAAC,OAAM,WAAAC,gBAAe;AAIvC,eAAsB,aAAa,OAAuC;AACxE,MAAIC,OAAMD,SAAQ,KAAK;AACvB,aAAS;AACP,QAAI;AACF,YAAM,KAAKD,MAAKE,MAAK,MAAM,CAAC;AAC5B,aAAOA;AAAA,IACT,QAAQ;AAAA,IAAkD;AAC1D,UAAM,KAAKH,SAAQG,IAAG;AACtB,QAAI,OAAOA,KAAK,QAAO;AACvB,IAAAA,OAAM;AAAA,EACR;AACF;;;ADkBA,IAAMC,QAAO;AACb,IAAM,YAAY;AAClB,IAAM,UAAU;AAIhB,IAAM,YAAY,oBAAI,IAAmB;AAAA,EACvC;AAAA,EAAwB;AAAA,EAAwB;AAAA,EAChD;AAAA,EAAsB;AACxB,CAAC;AAED,IAAM,QAAQ,CAAC,MAAiB,EAAE,WAAW,EAAE;AAG/C,SAAS,aAAaC,UAA2B;AAC/C,QAAM,OAAO,CAAC,MAAc,EAAE,SAAS,WAAW,IAAI,EAAE,SAAS,aAAa,IAAI;AAClF,SAAO,CAAC,GAAGA,QAAO,EAAE,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,CAAC;AACtD;AACA,IAAM,YAAY,CAACA,aAA4B,aAAaA,QAAO,EAAE,CAAC;AAKtE,eAAe,YAAYC,OAAoF;AAC7G,QAAM,OAAO,MAAM,aAAaA,MAAK,GAAG;AACxC,MAAI,CAAC,KAAM,QAAO;AAClB,MAAID;AACJ,MAAI;AACF,IAAAA,WAAU,MAAMC,MAAK,IAAI,QAAQ,IAAI;AAAA,EACvC,SAAS,GAAG;AACV,QAAI,aAAa,aAAa,EAAE,SAAS,uBAAwB,QAAO,EAAE,MAAM,OAAO,CAAC,GAAG,UAAU,EAAE;AACvG,UAAM;AAAA,EACR;AACA,QAAM,QAAQD,SAAQ,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,KAAK,QAAQ,EAAE,GAAG,EAAE,EAAE,EAAE,OAAO,CAAC,MAAkB,EAAE,QAAQ,IAAI;AAC1G,SAAO,EAAE,MAAM,MAAM;AACvB;AAEA,SAAS,OAAO,SAAkB,IAAsC;AACtE,SAAO,QAAQ,IAAI,IAAqB,uBAAuB,mBAAmB,EAAE,CAAC,EAAE;AACzF;AAKA,eAAe,cAAcC,OAAY,SAAkB,QAAmB,OAAwB,UAAkB;AACtH,MAAI;AACF,UAAM,SAAS,MAAM,YAAYA,KAAI,IAAI,SAAS,CAAC;AACnD,UAAM,UAAU,oBAAI,IAAyB;AAC7C,UAAM,WAAqB,CAAC;AAC5B,eAAW,OAAO,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,GAAG;AAClD,YAAM,KAAK,MAAM,MAAM,IAAI,OAAO,WAAW,GAAG;AAChD,UAAI,GAAI,SAAQ,IAAI,KAAK,oBAAI,IAAI,CAAC,EAAE,CAAC,CAAC;AAAA,UACjC,UAAS,KAAK,GAAG;AAAA,IACxB;AACA,QAAI,SAAS,SAAS,GAAG;AACvB,UAAI;AACF,cAAM,EAAE,QAAQ,IAAI,MAAM,QAAQ,IAAI,KAAqB,SAAS,EAAE,UAAU,SAAS,CAAC;AAC1F,mBAAW,KAAK,QAAS,SAAQ,IAAI,EAAE,UAAU,QAAQ,IAAI,EAAE,OAAO,KAAK,oBAAI,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,CAAC;AACtG,cAAM,MAAM,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC;AACnD,YAAI,IAAI,SAAS,EAAG,YAAW,KAAK,QAAS,OAAM,MAAM,IAAI,OAAO,WAAW,EAAE,SAAS,EAAE,OAAO,EAAE;AAAA,MACvG,SAAS,GAAG;AAAE,YAAI,aAAa,eAAgB,OAAM;AAAA,MAAyB;AAAA,IAChF;AACA,WAAO,aAAa,KAAK,EAAE,KAAK,CAAC,MAAM,CAAC,GAAI,QAAQ,IAAI,EAAE,GAAG,KAAK,CAAC,CAAE,EAAE,KAAK,CAAC,OAAO,OAAO,QAAQ,CAAC,GAAG;AAAA,EACzG,SAAS,GAAG;AACV,QAAI,aAAa,eAAgB,OAAM;AACvC,WAAO;AAAA,EACT;AACF;AAIA,eAAsB,WAAWA,OAAY,WAA+B,IAA0C;AACpH,MAAI,CAAC,aAAa,GAAI,QAAO,gBAAgBA,OAAM,EAAE;AACrD,SAAO,cAAc,YAAY,MAAMA,MAAK,OAAO,KAAK,GAAG,cAAc;AAC3E;AAIA,eAAsB,oBAAoB,SAAkB,QAAmB,IAAuC;AACpH,MAAI;AACF,WAAO,MAAM,QAAQ,IAAI,IAAmB,oBAAoB,mBAAmB,GAAG,KAAK,CAAC,UAAU;AAAA,EACxG,SAAS,GAAG;AACV,QAAI,aAAa,aAAa,EAAE,SAAS,6BAA6B,OAAO,cAAc,GAAG,QAAQ;AACpG,YAAM,IAAI,cAAc,GAAG,QAAQ,MAAS;AAC5C,YAAM,OAAO,EAAE,WAAW,EAAE;AAC5B,YAAM,YAAY,GAAG,EAAE,iBAAiB,EAAE,UAAU,GAAG,6BAA6B,IAAI,qCAAqC,IAAI,GAAG;AAAA,IACtI;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAe,OAAOA,OAAY,GAAS,OAAwB,IAA8C;AAC/G,QAAM,SAAS,MAAM,WAAWA,OAAM,EAAE,QAAQ,EAAE;AAClD,QAAM,UAAU,MAAM,YAAYA,OAAM,QAAQ,EAAE,SAAS,EAAE,SAAS;AACtE,QAAM,iBAAiBA,OAAM,OAAO,WAAW,cAAc;AAC7D,MAAI,KAAK,EAAE;AACX,MAAI,CAACF,MAAK,KAAK,EAAE,GAAG;AAClB,QAAI,WAAW,EAAE,UAAU,QAAQ,QAAQ,cAAc;AACzD,QAAI,CAAC,UAAU;AACb,YAAM,KAAK,MAAM,QAAQ,IAAI,IAAW,gBAAgB;AAExD,UAAI,GAAG,QAAQ,WAAW,GAAG;AAC3B,cAAM,IAAI,UAAU,4BAA4B,uDAAuD;AAAA,UACrG,MAAM;AAAA,QACR,CAAC;AAAA,MACH;AACA,UAAI,GAAG,QAAQ,SAAS,GAAG;AACzB,cAAM,aAA0B,GAAG,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,UAAU,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,EAAE;AAChH,cAAM,IAAI,UAAU,yBAAyB,oBAAoB,EAAE,SAAS;AAAA,UAC1E,MAAM;AAAA,UAAwD;AAAA,QAChE,CAAC;AAAA,MACH;AACA,iBAAW,GAAG,QAAQ,CAAC,EAAG;AAAA,IAC5B;AACA,UAAM,MAAM,QAAQ,IAAI;AAAA,MACtB,uBAAuB,mBAAmB,QAAQ,CAAC,yBAAyB,mBAAmB,EAAE,CAAC;AAAA,IAAE,GAAG;AAAA,EAC3G;AACA,QAAM,SAAS,MAAM,OAAO,SAAS,EAAE;AACvC,QAAM,YAAY,MAAM,cAAcE,OAAM,SAAS,QAAQ,OAAO,OAAO,EAAE;AAC7E,QAAM,WAAW,MAAM,aAAaA,MAAK,GAAG;AAC5C,SAAO,EAAE,QAAQ,SAAS,QAAQ,QAAQ,YAAY,EAAE,MAAM,QAAQ,UAAU,IAAI,EAAE,MAAM,OAAO,GAAG,UAAU,WAAW,GAAG;AAChI;AAGA,IAAM,UAAU,CAAC,MAAcC,SAAgB;AAC7C,QAAM,MAAMC,UAAS,MAAMD,IAAG;AAC9B,SAAO,QAAQ,MAAM,CAAC,IAAI,WAAW,IAAI,KAAK,CAAC,WAAW,GAAG;AAC/D;AAMA,eAAe,gBAAgBD,OAAY,IAAwC;AACjF,MAAI,CAAC,GAAI,QAAO;AAChB,QAAM,WAAW,MAAM,aAAaA,MAAK,GAAG;AAC5C,SAAO,aAAa,QAAQ,QAAQ,UAAU,GAAG,IAAI;AACvD;AAKA,eAAe,YAAYA,OAAY,GAAS,IAAe,QAA2C;AACxG,QAAM,UAAU,MAAM,YAAYA,OAAM,QAAQ,EAAE,SAAS,EAAE,SAAS;AACtE,MAAI,EAAE,QAAQ;AAGZ,WAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO,SAAS,EAAE,MAAM,GAAG,QAAQ,EAAE,MAAM,YAAY,GAAG,UAAU,MAAM,WAAW,GAAG;AAAA,EAClI;AACA,QAAM,iBAAiBA,OAAM,OAAO,WAAW,aAAa;AAC5D,QAAM,MAAM,MAAM,oBAAoB,SAAS,QAAQ,EAAE;AACzD,QAAM,aAA0B,IAAI,QAAQ,IAAI,CAAC,OAAO;AAAA,IACtD,MAAM;AAAA,IAAU,IAAI,EAAE;AAAA,IAAI,MAAM,EAAE;AAAA,IAAM,MAAM,EAAE;AAAA,IAAM,QAAQ,IAAI,IAAI,OAAO;AAAA,IAAM,QAAQ;AAAA,EAC7F,EAAE;AACF,QAAM,IAAI,UAAU,yBAAyB,4CAAuC;AAAA,IAClF,MAAM;AAAA,IAA8C;AAAA,EACtD,CAAC;AACH;AAMA,eAAsB,cAAcA,OAAuC;AACzE,QAAM,KAAK,MAAM,cAAcA,MAAK,GAAG;AACvC,SAAO,MAAO,MAAM,gBAAgBA,OAAM,EAAE,IAAK,KAAK;AACxD;AAEA,SAAS,aAAa,KAAiB,eAAyB,WAAoB,UAAmC;AACrH,MAAI,UAAW,QAAO,CAAC,cAAc,WAAW,IAAI,cAAc,CAAC;AACnE,QAAM,OAAO,CAAC,MAAe,MAAM,gBAAgB,KAAK,YAAY,IAAI,MAAM,gBAAgB,QAAQ,YAAY,IAAI;AACtH,QAAM,OAAO,OAAO,KAAK,IAAI,QAAQ,EAAE,KAAK,CAAC,GAAG,MAAM,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,EAAE,cAAc,CAAC,CAAC;AAG7F,QAAM,SAAS,cAAc,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC;AAE1D,QAAM,UAAU,CAAC,GAAI,WAAW,CAAC,SAAS,SAAS,IAAI,CAAC,GAAI,GAAG,QAAQ,cAAc,QAAW,IAAI,cAAc,EAAE,WAAW,GAAG,IAAI;AACtI,SAAO,CAAC,GAAG,IAAI,IAAI,OAAO,CAAC,EAAE,OAAO,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,EAAE,IAAI,CAAC,MAAM,cAAc,GAAG,MAAS,CAAC;AACpG;AAMO,SAAS,YAAY,GAAc,OAAgC,MAA0B;AAClG,SAAO,IAAI,UAAU,EAAE,MAAM,EAAE,SAAS;AAAA,IACtC,MAAM,QAAQ,EAAE;AAAA,IAAM,QAAQ,EAAE;AAAA,IAAQ,WAAW,EAAE;AAAA,IAAW,YAAY,EAAE;AAAA,IAAY,YAAY,EAAE;AAAA,IACxG,SAAS,EAAE,GAAG,EAAE,SAAS,GAAG,MAAM;AAAA,IAAG,OAAO;AAAA,EAC9C,CAAC;AACH;AAGA,eAAe,UAAUA,OAAY,GAAS,OAAwB,QAAmB,OAAgB,MACvG,UAAkB,WAA6B,aAAoE;AACnH,QAAM,UAAU,MAAM,YAAYA,OAAM,QAAQ,EAAE,SAAS,EAAE,SAAS;AACtE,MAAI;AACF,UAAM,iBAAiBA,OAAM,OAAO,WAAW,cAAc;AAAA,EAC/D,SAAS,GAAG;AAEV,QAAI,EAAE,aAAa,cAAc,EAAE,SAAS,6BAA8B,OAAM;AAChF,gBAAY,CAAC;AACb,WAAO;AAAA,EACT;AAKA,QAAM,OAAwC,CAAC;AAC/C,aAAW,KAAK,aAAa,KAAK,GAAG;AACnC,UAAMG,MAAK,MAAM,MAAM,IAAI,OAAO,WAAW,EAAE,GAAG;AAClD,QAAIA,IAAI,MAAK,KAAK,EAAE,QAAQ,GAAG,IAAAA,IAAG,CAAC;AAAA,EACrC;AACA,MAAI,KAAK,SAAS,KAAK,KAAK,MAAM,CAAC,MAAM,EAAE,OAAO,KAAK,CAAC,EAAG,EAAE,GAAG;AAC9D,UAAM,EAAE,QAAQ,GAAG,IAAAA,IAAG,IAAI,KAAK,CAAC;AAChC,QAAI;AACF,aAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO,SAASA,GAAE,GAAG,QAAQ,EAAE,MAAM,UAAU,QAAQ,EAAE,MAAM,KAAK,EAAE,IAAI,GAAG,UAAU,UAAU;AAAA,IAC3I,SAAS,GAAG;AACV,UAAI,EAAE,aAAa,cAAc,EAAE,SAAS,0BAA2B,OAAM;AAC7E,iBAAW,KAAK,KAAM,OAAM,MAAM,KAAK,OAAO,WAAW,EAAE,OAAO,GAAG;AAAA,IACvE;AAAA,EACF;AAEA,QAAM,EAAE,QAAQ,IAAI,MAAM,QAAQ,IAAI,KAAqB,SAAS,EAAE,UAAU,KAAK,CAAC;AACtF,QAAM,MAAM,CAAC,GAAG,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,CAAC,CAAC;AACxD,MAAI,IAAI,WAAW,EAAG,QAAO;AAC7B,MAAI,KAAK,IAAI,CAAC;AACd,MAAI,IAAI,SAAS,GAAG;AAClB,QAAI,EAAE,UAAU,IAAI,SAAS,EAAE,MAAM,EAAG,MAAK,EAAE;AAAA,SAC1C;AACH,YAAM,aAA0B,IAAI,IAAI,CAAC,QAAQ;AAC/C,cAAM,MAAM,QAAQ,OAAO,CAACC,OAAMA,GAAE,OAAO,OAAO,GAAG;AACrD,cAAM,IAAI,IAAI,CAAC;AACf,cAAMC,UAAS,UAAU,MAAM,OAAO,CAAC,MAAM,IAAI,KAAK,CAAC,MAAM,EAAE,YAAY,EAAE,GAAG,CAAC,CAAC,EAAE;AACpF,eAAO,EAAE,MAAM,UAAU,IAAI,EAAE,OAAO,IAAI,MAAM,EAAE,OAAO,MAAM,MAAM,EAAE,OAAO,MAAM,QAAAA,SAAQ,QAAQ,EAAE,OAAO,KAAK;AAAA,MACpH,CAAC;AACD,YAAM,IAAI,UAAU,yBAAyB,mDAAmD;AAAA,QAC9F,MAAM;AAAA,QAA4B;AAAA,MACpC,CAAC;AAAA,IACH;AAAA,EACF;AACA,QAAM,cAAc,IAAI,IAAI,QAAQ,OAAO,CAAC,MAAM,EAAE,OAAO,OAAO,EAAE,EAAE,IAAI,CAAC,MAAM,EAAE,OAAO,CAAC;AAE3F,MAAI,IAAI,WAAW,EAAG,YAAW,KAAK,YAAa,OAAM,MAAM,IAAI,OAAO,WAAW,GAAG,EAAE;AAC1F,QAAM,SAAS,UAAU,MAAM,OAAO,CAAC,MAAM,YAAY,IAAI,EAAE,GAAG,CAAC,CAAC;AACpE,SAAO,EAAE,QAAQ,SAAS,QAAQ,MAAM,OAAO,SAAS,EAAE,GAAG,QAAQ,EAAE,MAAM,UAAU,QAAQ,OAAO,MAAM,KAAK,OAAO,IAAI,GAAG,UAAU,UAAU;AACrJ;AAEA,eAAe,YAAYL,OAAY,KAAmC;AACxE,aAAW,KAAK,OAAO,OAAO,IAAI,QAAQ,GAAG;AAC3C,QAAI,MAAM,IAAI,WAAWA,MAAK,UAAU,YAAY,EAAE,WAAW,EAAE,MAAM,CAAC,EAAE,WAAW,EAAG,QAAO;AAAA,EACnG;AACA,SAAO;AACT;AAEA,eAAsB,qBAAqBA,OAAY,GAAiC;AACtF,QAAM,QAAQ,IAAI,gBAAgBM,MAAKN,MAAK,OAAO,KAAK,OAAO,GAAGA,MAAK,GAAG;AAC1E,QAAM,KAAK,MAAM,cAAcA,MAAK,KAAKA,MAAK,IAAI;AAClD,MAAI,EAAE,OAAQ,QAAO,OAAOA,OAAM,GAAG,OAAO,EAAE;AAI9C,QAAM,MAAM,MAAMA,MAAK,OAAO,KAAK;AACnC,QAAM,QAAQ,cAAc,EAAE,QAAQ,IAAI,cAAc;AAIxD,QAAM,WAAW,MAAM,CAAC,EAAE,SAAS,MAAM,gBAAgBA,OAAM,EAAE,IAAI;AACrE,MAAI,EAAE,UAAU,CAAE,MAAM,YAAYA,OAAM,GAAG,GAAI;AAC/C,UAAM,YAAYA,OAAM,OAAO,EAAE,OAAO;AAAA,EAC1C;AAEA,MAAI,MAAO,MAAM,gBAAgBA,OAAM,EAAE,EAAI,QAAO,YAAYA,OAAM,GAAG,IAAI,YAAY,KAAK;AAC9F,QAAM,OAAO,MAAM,YAAYA,KAAI;AACnC,MAAI,SAAS,KAAM,OAAM,IAAI,UAAU,yBAAyB,kCAAkC,EAAE,MAAM,UAAU,CAAC;AACrH,QAAM,EAAE,MAAM,OAAO,SAAS,IAAI;AAClC,MAAI,MAAM,WAAW,GAAG;AAGtB,UAAM,OAAO,UAAU;AACvB,UAAM,IAAI,UAAU,yBAAyB,gDAAgD;AAAA,MAC3F,MAAM,OAAO,GAAG,SAAS,cAAc,IAAI,KAAK;AAAA,MAChD,SAAS,WAAW,EAAE,KAAK,QAAQ,SAAS,QAAQ,IAAI;AAAA,MACxD,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,QAAM,OAAO,CAAC,GAAG,IAAI,IAAI,MAAM,IAAI,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;AAEjD,QAAM,QAAkB,CAAC;AACzB,QAAM,WAAqB,CAAC;AAC5B,QAAM,UAAqB,CAAC;AAC5B,QAAM,aAA0B,CAAC;AACjC,MAAI;AACJ,aAAW,UAAU,aAAa,KAAK,MAAM,MAAM,WAAW,IAAI,GAAG,EAAE,QAAQ,QAAQ,GAAG;AACxF,UAAM,KAAK,MAAM,MAAM,CAAC;AACxB,QAAI,oBAAoB;AACxB,QAAI;AACF,YAAM,KAAK,MAAM,UAAUA,OAAM,GAAG,OAAO,QAAQ,OAAO,MAAM,MAAM,IAAI,CAAC,MAAM;AAC/E,4BAAoB;AACpB,wBAAgB;AAChB,gBAAQ,KAAK,EAAE,SAAS,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ,CAAC;AAAA,MAC3E,CAAC;AACD,UAAI,GAAI,QAAO;AACf,UAAI,CAAC,kBAAmB,UAAS,KAAK,MAAM,MAAM,CAAC;AAAA,IACrD,SAAS,GAAG;AACV,UAAI,EAAE,aAAa,cAAc,CAAC,UAAU,IAAI,EAAE,IAAI,EAAG,OAAM;AAC/D,cAAQ,KAAK,EAAE,SAAS,MAAM,MAAM,GAAG,MAAM,EAAE,MAAM,SAAS,EAAE,QAAQ,CAAC;AACzE,iBAAW,KAAK,CAAC;AAAA,IACnB;AAAA,EACF;AAEA,QAAM,UAAmC,EAAE,eAAe,MAAM;AAChE,MAAI,QAAQ,SAAS,EAAG,SAAQ,kBAAkB;AAClD,MAAI,SAAS,WAAW,GAAG;AAIzB,UAAM,QAAQ,WAAW,CAAC,KAAK;AAC/B,QAAI,MAAO,OAAM,YAAY,OAAO,OAAO;AAAA,EAC7C;AACA,QAAM,YAAY,QAAQ,SAAS,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,OAAO,EAAE,KAAK,IAAI,CAAC,0BAA0B,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,KAAK,IAAI,CAAC,OAAO;AAErJ,QAAM,kBAAkB,QAAQ,IAAI,SAAS,gBAAgB,QAAQ,SAAS,CAAC,KAC1E,CAAC,QAAQ,KAAK,CAAC,MAAM,EAAE,YAAY,cAAc,EAAE,SAAS,wBAAwB,EAAE,SAAS,uBAAuB;AAC3H,QAAM,IAAI,UAAU,yBAAyB,sBAAsB;AAAA,IACjE,MAAM,+DAA+D,SAAS,KAAK,IAAI,CAAC,+BACpF,aACC,kBAAkB,KAAK;AAAA,IAC5B;AAAA,EACF,CAAC;AACH;AAEA,IAAM,gBAAgB,CAAC,SAAgC,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,OAAO,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,EAAE;AAEvH,SAAS,QAAQ,IAAsE,KAAsB;AAClH,QAAM,OAAO,GAAG,OAAO;AACvB,MAAI,KAAK;AACP,UAAM,QAAQ,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,OAAO,EAAE,SAAS,GAAG;AAC7D,QAAI,CAAC,OAAO;AACV,YAAM,IAAI,UAAU,2BAA2B,GAAG,GAAG,OAAO,IAAI,2BAA2B,GAAG,kBAAkB;AAAA,QAC9G,YAAY,cAAc,IAAI;AAAA,MAChC,CAAC;AAAA,IACH;AACA,WAAO;AAAA,EACT;AACA,MAAI,KAAK,WAAW,EAAG,QAAO,KAAK,CAAC;AACpC,MAAI,KAAK,WAAW,EAAG,OAAM,IAAI,UAAU,2BAA2B,GAAG,GAAG,OAAO,IAAI,qCAAqC;AAE5H,QAAM,QAAQ,GAAG,aAAa,KAAK,KAAK,CAAC,MAAM,EAAE,OAAO,GAAG,UAAW,KAAK;AAC3E,MAAI,MAAO,QAAO;AAClB,QAAM,IAAI,UAAU,sBAAsB,GAAG,GAAG,OAAO,IAAI,4BAA4B,EAAE,MAAM,sBAAsB,YAAY,cAAc,IAAI,EAAE,CAAC;AACxJ;;;AEzXA,eAAsB,cAAcO,OAAY,IAAmB,KAAmC;AACpG,QAAM,iBAAiBA,OAAM,GAAG,OAAO,WAAW,kBAAkB;AACpE,MAAI;AACF,WAAO,MAAM,GAAG,QAAQ,IAAI;AAAA,MAC1B,uBAAuB,mBAAmB,GAAG,OAAO,EAAE,CAAC,qBAAqB,mBAAmB,IAAI,EAAE,CAAC;AAAA,IAAE;AAAA,EAC5G,SAAS,GAAG;AACV,QAAI,EAAE,aAAa,cAAc,EAAE,SAAS,qBAAsB,OAAM;AACxE,QAAI,EAAE,eAAe,qBAAqB;AACxC,YAAM;AAAA,QAAY;AAAA,QAAG,EAAE,UAAU,SAAS,MAAM,GAAG,OAAO,OAAO;AAAA,QAC/D,YAAY,GAAG,OAAO,MAAM,OAAO,GAAG,OAAO,IAAI;AAAA,MAAsF;AAAA,IAC3I;AAEA,QAAI,EAAE,eAAe,0BAA2B,OAAM,YAAY,GAAG,CAAC,GAAG,yBAAyB;AAClG,UAAM;AAAA,EACR;AACF;;;AChBO,SAAS,SAAS,UAAuC;AAC9D,QAAM,MAAM,oBAAI,IAAoB;AACpC,aAAWC,SAAQ,SAAS,MAAM,IAAI,GAAG;AACvC,UAAM,IAAIA,MAAK,QAAQ,OAAO,EAAE,EAAE,MAAM,iCAAiC;AACzE,QAAI,IAAI,CAAC,MAAM,UAAa,EAAE,CAAC,MAAM,OAAW,KAAI,IAAI,EAAE,CAAC,GAAG,EAAE,CAAC,CAAC;AAAA,EACpE;AACA,SAAO;AACT;AAIO,SAAS,aAAa,KAAa,SAA4B;AACpE,aAAW,WAAW,SAAS;AAC7B,QAAI,QAAQ,SAAS,GAAG,GAAG;AACzB,UAAI,IAAI,WAAW,QAAQ,MAAM,GAAG,EAAE,CAAC,EAAG,QAAO;AAAA,IACnD,WAAW,QAAQ,QAAS,QAAO;AAAA,EACrC;AACA,SAAO;AACT;AAEO,SAAS,cAAc;AAAA,EAC5B;AAAA,EACA;AAAA,EACA,UAAU,CAAC;AAAA,EACX,gBAAgB;AAAA,EAChB,UAAU,CAAC;AACb,GAYE;AACA,QAAM,SAAS,IAAI,IAAI,OAAO;AAC9B,QAAM,YAAsB,CAAC;AAC7B,QAAM,QAAkB,CAAC;AACzB,QAAM,YAAsB,CAAC;AAC7B,QAAM,cAAwB,CAAC;AAE/B,aAAW,CAAC,KAAK,WAAW,KAAK,OAAO,QAAQ,OAAO,GAAG;AACxD,UAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,UAAM,aAAa,QAAQ,IAAI,GAAG;AAClC,UAAM,aAAa,CAAC,YAAY,eAAe,MAAM,eAAe,QAAQ,eAAe;AAE3F,QAAI,YAAY;AACd,aAAO,IAAI,KAAK,WAAW;AAC3B,YAAM,KAAK,GAAG;AACd;AAAA,IACF;AACA,QAAI,eAAe,aAAa;AAC9B,gBAAU,KAAK,GAAG;AAClB;AAAA,IACF;AAIA,QAAI,aAAa,KAAK,OAAO,GAAG;AAC9B,aAAO,IAAI,KAAK,WAAW;AAC3B,kBAAY,KAAK,GAAG;AACpB;AAAA,IACF;AACA,cAAU,KAAK,GAAG;AAClB,UAAM,SAAS,QAAQ,GAAG,KAAK;AAC/B,WAAO,IAAI,KAAK,WAAW,eAAe,cAAc,UAAW;AAAA,EACrE;AAEA,SAAO,EAAE,QAAQ,WAAW,OAAO,WAAW,YAAY;AAC5D;AAIO,SAAS,UAAU,UAAkB,QAAqC;AAC/E,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,QAAQ,SAAS,MAAM,IAAI;AACjC,QAAM,MAAM,MAAM,IAAI,CAACA,UAAS;AAC9B,UAAM,IAAIA,MAAK,QAAQ,OAAO,EAAE,EAAE,MAAM,iCAAiC;AACzE,QAAI,CAAC,IAAI,CAAC,EAAG,QAAOA;AACpB,UAAM,MAAc,EAAE,CAAC;AACvB,QAAI,CAAC,OAAO,IAAI,GAAG,EAAG,QAAOA;AAC7B,SAAK,IAAI,GAAG;AACZ,WAAO,GAAG,GAAG,IAAI,OAAO,IAAI,GAAG,KAAK,EAAE;AAAA,EACxC,CAAC;AAED,QAAM,WAAqB,CAAC;AAC5B,aAAW,CAAC,KAAK,KAAK,KAAK,QAAQ;AACjC,QAAI,CAAC,KAAK,IAAI,GAAG,EAAG,UAAS,KAAK,GAAG,GAAG,IAAI,KAAK,EAAE;AAAA,EACrD;AAEA,MAAI,OAAO,IAAI,KAAK,IAAI;AACxB,MAAI,SAAS,QAAQ;AACnB,QAAI,KAAK,UAAU,CAAC,KAAK,SAAS,IAAI,EAAG,SAAQ;AACjD,YAAQ,SAAS,KAAK,IAAI,IAAI;AAAA,EAChC;AACA,SAAO;AACT;;;AC1GA,SAAS,OAAO,YAAAC,iBAAgB;AAChC,SAAS,UAAU,WAAAC,UAAS,cAAAC,aAAY,YAAAC,WAAU,WAAAC,UAAS,WAAW;AAItE,IAAM,UAAU,CAAC,WAAmB,IAAI,UAAU,wBAAwB,mDAAmD,MAAM,KAAK;AAAA,EACtI,MAAM;AACR,CAAC;AAED,IAAM,YAAY,CAAC,WAAmB,IAAI,UAAU,wBAAwB,kDAAkD,MAAM,KAAK;AAAA,EACvI,MAAM;AACR,CAAC;AAED,SAAS,OAAO,MAAc,GAAoB;AAChD,QAAM,MAAMC,UAAS,MAAM,CAAC;AAC5B,SAAO,QAAQ,MAAM,QAAQ,QAAQ,CAAC,IAAI,WAAW,OAAO,GAAG,KAAK,CAACC,YAAW,GAAG;AACrF;AASA,eAAsB,cAAc,MAAc,QAAgB,OAAe,MAAuB;AACtG,QAAM,WAAW,MAAMC,UAAS,IAAI;AACpC,QAAM,WAAW,SAAS,OAAO,WAAW,MAAMA,UAAS,IAAI;AAC/D,QAAM,MAAMC,SAAQ,UAAU,MAAM;AAOpC,MAAI,CAACF,YAAW,MAAM,KAAK,CAAC,OAAO,UAAU,GAAG,EAAG,OAAM,QAAQ,MAAM;AACvE,MAAI;AACJ,MAAI;AAAE,aAAS,MAAMC,UAASE,SAAQ,GAAG,CAAC;AAAA,EAAE,SAAS,GAAG;AACtD,QAAK,EAA4B,SAAS,SAAU,OAAM;AAC1D,UAAM,IAAI,UAAU,wBAAwB,qBAAqB,MAAM,mBAAmB;AAAA,MACxF,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,QAAM,QAAQD,SAAQ,QAAQ,SAAS,GAAG,CAAC;AAC3C,MAAI,CAAC,OAAO,UAAU,KAAK,EAAG,OAAM,QAAQ,MAAM;AAKlD,MAAI;AACF,UAAM,KAAK,MAAM,MAAM,KAAK;AAC5B,QAAI,GAAG,eAAe,EAAG,OAAM,UAAU,MAAM;AAC/C,UAAM,YAAY,MAAMD,UAAS,KAAK;AACtC,QAAI,CAAC,OAAO,UAAU,SAAS,EAAG,OAAM,QAAQ,MAAM;AAAA,EACxD,SAAS,GAAG;AACV,QAAI,aAAa,UAAW,OAAM;AAClC,QAAK,EAA4B,SAAS,SAAU,OAAM;AAAA,EAC5D;AAEA,SAAO;AACT;AAOO,SAAS,SAAS,GAGc;AACrC,QAAM,WAAW,EAAE,YAAY,EAAE,WAAW;AAC5C,QAAM,UAAU,SAAS,QAAQ;AACjC,QAAM,IAAI,cAAc,EAAE,SAAS,SAAS,EAAE,SAAS,SAAS,EAAE,WAAW,CAAC,GAAG,eAAe,EAAE,eAAe,SAAS,EAAE,QAAQ,CAAC;AACrI,QAAM,WAAW,CAAC,MAAc,EAAE,UAAU,CAAC,KAAK,EAAE;AACpD,QAAM,YAAsB,CAAC;AAC7B,aAAW,OAAO,EAAE,cAAc;AAChC,UAAM,IAAI,EAAE,OAAO,IAAI,GAAG;AAC1B,QAAI,MAAM,UAAa,MAAM,MAAM,MAAM,QAAQ,MAAM,MAAM;AAAE,QAAE,OAAO,IAAI,KAAK,EAAE,OAAO,CAAC;AAAG,gBAAU,KAAK,GAAG;AAAA,IAAE;AAAA,EACpH;AACA,SAAO;AAAA,IACL,MAAM,UAAU,UAAU,EAAE,MAAM;AAAA,IAClC,SAAS,EAAE,aAAa;AAAA,IACxB,mBAAmB,EAAE,aAAa,QAAQ,EAAE,YAAY;AAAA,IACxD,OAAO,EAAE;AAAA,IAAO,SAAS,EAAE;AAAA,IAAa,WAAW,EAAE;AAAA,IAAW,WAAW,EAAE;AAAA,IAC7E,MAAM,EAAE,UAAU,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,MAAM;AAAA,IACtD,UAAU,EAAE,UAAU,OAAO,CAAC,MAAM,SAAS,CAAC,MAAM,YAAY;AAAA,IAChE;AAAA,EACF;AACF;;;ACnFA,IAAM,YAAY,CAAC,GAA4B,SAC7C,CAAC,CAAC,KAAK,EAAE,SAAS,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,QAAQ,OAAO,EAAE,OAAO,QAAQ;AAEnF,eAAsB,iBAAiB,KAAqB,OAA4B,SAAyC;AAC/H,QAAM,IAAI,IAAI,KAAK;AACnB,QAAM,YAAY,EAAE,UAAU,CAAC,MAAc,IAAI,GAAG,IAAI,CAAC,IAAI;AAC7D,QAAM,OAAO,EAAE,QAAQ,EAAE,QAAQ,QAAQ,MAAM,QAAQ,SAAS,UAAU;AAC1E,MAAI;AACF,WAAO,MAAM,qBAAqB,IAAI,MAAM,IAAI;AAAA,EAClD,SAAS,GAAG;AACV,QAAI,EAAE,aAAa,cAAc,EAAE,SAAS,2BAA2B,CAAC,IAAI,GAAG,YAAa,OAAM;AAElG,QAAI,UAAU,EAAE,YAAY,QAAQ,GAAG;AACrC,YAAM,SAAS,MAAM,IAAI,GAAG;AAAA,QAAO;AAAA,QACjC,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,EAAE,SAAS,GAAG,EAAE,MAAM,QAAQ,EAAE,GAAG,EAAE,IAAI,MAAM,EAAE,MAAM,KAAK,OAAO,EAAE,GAAG,EAAE;AAAA,MAAC;AACjH,aAAO,qBAAqB,IAAI,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;AAAA,IAC3D;AACA,QAAI,UAAU,EAAE,YAAY,QAAQ,GAAG;AACrC,YAAM,SAAS,MAAM,IAAI,GAAG,OAAO,mBAAmB,EAAE,WAAW,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,OAAO,EAAE,GAAG,EAAE,CAAC;AACxH,aAAO,qBAAqB,IAAI,MAAM,EAAE,GAAG,MAAM,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,OAAO,KAAqB,IAAmB,KAA+B;AAClG,MAAI;AACF,WAAO,QAAQ,IAAI,GAAG;AAAA,EACxB,SAAS,GAAG;AACV,QAAI,EAAE,aAAa,cAAc,EAAE,SAAS,wBAAwB,CAAC,IAAI,GAAG,YAAa,OAAM;AAC/F,UAAM,KAAK,MAAM,IAAI,GAAG,OAAO,iBAAiB,GAAG,OAAO,KAAK,IAAI,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,OAAO,EAAE,GAAG,EAAE,CAAC;AAC1G,WAAO,QAAQ,IAAI,EAAE;AAAA,EACvB;AACF;AAEA,SAAS,WAAW,IAA2B;AAC7C,MAAI,GAAG,OAAO,SAAS,SAAU,QAAO,GAAG,OAAO;AAClD,MAAI,GAAG,OAAO,SAAS,YAAa,QAAO;AAC3C,SAAO,GAAG,OAAO,YAAY,uBAAuB,GAAG,OAAO,SAAS,KAAK;AAC9E;AAEO,SAAS,YAAY,IAAmB,KAAsB;AACnE,QAAM,QAAQ,CAAC,GAAG,OAAO,OAAO,MAAM,GAAI,MAAM,CAAC,IAAI,IAAI,IAAI,CAAC,GAAI,GAAG,OAAO,IAAI;AAChF,SAAO,UAAK,MAAM,KAAK,KAAK,CAAC,MAAM,WAAW,EAAE,CAAC;AACnD;AAEO,SAAS,YAAY,IAAmB,KAAc;AAC3D,QAAM,EAAE,IAAI,MAAM,MAAM,MAAM,OAAO,IAAI,GAAG;AAC5C,SAAO;AAAA,IACL,QAAQ,GAAG,OAAO,WAAW,GAAG,OAAO;AAAA,IACvC,QAAQ,GAAG,OAAO;AAAA,IAClB,KAAK,OAAO;AAAA,IACZ,QAAQ,EAAE,IAAI,MAAM,MAAM,MAAM,OAAO;AAAA,IACvC,QAAQ,GAAG,OAAO,SAAS,WAAW,GAAG,OAAO,SAAS,GAAG,OAAO,SAAS,cAAc,iBAAiB;AAAA,IAC3G,GAAI,GAAG,OAAO,SAAS,UAAU,GAAG,OAAO,YAAY,EAAE,WAAW,GAAG,OAAO,UAAU,IAAI,CAAC;AAAA,EAC/F;AACF;;;AChDA,eAAsB,cAAc,KAAqB,IAAmB,KAAa,GAAqC;AAC5H,QAAM,OAAO,GAAG,YAAY,IAAI,KAAK;AACrC,MAAI,CAAC,IAAI,KAAK,EAAE,KAAM,KAAI,GAAG,IAAI,YAAY,IAAI,GAAG,CAAC;AACrD,MAAI,MAAM,UAAU,IAAI,MAAM,MAAM,GAAG,OAAO,EAAE,EAAG;AACnD,MAAI,EAAE,KAAK;AAAE,UAAM,MAAM,IAAI,MAAM,MAAM,GAAG,OAAO,EAAE;AAAG;AAAA,EAAO;AAC/D,MAAI,CAAC,IAAI,GAAG,aAAa;AACvB,UAAM,IAAI,UAAU,yBAAyB,sCAAsC,GAAG,OAAO,IAAI,QAAQ;AAAA,MACvG,MAAM;AAAA,MAA0C,SAAS,EAAE,QAAQ,aAAa,YAAY,KAAK;AAAA,IACnG,CAAC;AAAA,EACH;AACA,MAAI,GAAG,OAAO,SAAS,UAAU;AAG/B,UAAM,MAAM,QAAQ,GAAG,OAAO,GAAG;AACjC,QAAI,GAAG,IAAI,iBAAiB,GAAG,OAAO,MAAM,KAAK,OAAO,yBAAyB,EAAE;AAAA,EACrF;AACA,MAAI,CAAE,MAAM,IAAI,GAAG,QAAQ,0DAA0D,EAAI,OAAM,IAAI,eAAe;AAClH,QAAM,MAAM,IAAI,MAAM,MAAM,GAAG,OAAO,EAAE;AAC1C;;;ARfA,IAAM,UAAU,CAAC,MAA2B,MAAM,SAAY,YAAY,6BAAS,EAAE,MAAM;AAE3F,eAAe,WAAW,GAAmC;AAC3D,MAAI;AAAE,WAAO,MAAMG,UAAS,GAAG,MAAM;AAAA,EAAE,SAAS,GAAG;AACjD,QAAK,EAA4B,SAAS,SAAU,QAAO;AAC3D,UAAM;AAAA,EACR;AACF;AAgBA,eAAe,cAAc,QAAgB,MAA6B;AACxE,QAAM,OAAOC,UAAS,MAAM;AAC5B,QAAM,UAAU,KAAK,SAAS,QAAQ,IAClC,GAAG,KAAK,MAAM,GAAG,CAAC,SAAS,MAAM,CAAC,SAASC,aAAY,CAAC,EAAE,SAAS,KAAK,CAAC,WACzE,GAAG,IAAI,SAASA,aAAY,CAAC,EAAE,SAAS,KAAK,CAAC;AAClD,QAAM,MAAMC,OAAKC,SAAQ,MAAM,GAAG,OAAO;AACzC,MAAI;AACF,UAAMC,WAAU,KAAK,MAAM,EAAE,MAAM,KAAO,MAAM,KAAK,CAAC;AACtD,UAAMC,OAAM,KAAK,GAAK;AACtB,UAAMC,QAAO,KAAK,MAAM;AAAA,EAC1B,UAAE;AACA,UAAM,OAAO,GAAG,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAAA,EAClC;AACF;AAIO,SAAS,YAAY,SAAkB,KAA2B;AACvE,QAAM,MAAM,QAAQ,QAAQ,KAAK,EAAE,YAAY,mBAAmB;AAClE,MAAI,QAAQ,MAAM,EAAE,YAAY,qDAAqD,EAClF,OAAO,sBAAsB,yDAAyD,EACtF,OAAO,mBAAmB,6CAA6C,EACvE,OAAO,mBAAmB,2CAA2C,EACrE,OAAO,gBAAgB,sDAAsD,EAC7E,OAAO,SAAS,sCAAsC,EACtD,OAAO,OAAO,MAAa;AAC1B,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,KAAK,MAAM,iBAAiB,KAAK,GAAG,UAAU;AACpD,QAAI,CAAC,GAAG,UAAU;AAChB,YAAM,IAAI,UAAU,yBAAyB,4CAA4C,EAAE,MAAM,mCAAmC,CAAC;AAAA,IACvI;AACA,UAAM,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE,GAAG;AACvC,UAAM,MAAM,MAAM,eAAe,GAAG,QAAQ;AAC5C,UAAM,WAAW,eAAe,GAAG,OAAO,IAAI;AAK9C,UAAM,SAAS,EAAE,SACb,MAAM,cAAc,GAAG,UAAU,EAAE,QAAQD,MAAK,GAAG,IACnD,MAAM,cAAc,GAAG,UAAU,IAAI,WAAW,SAAS,OAAO;AACpE,UAAM,cAAc,KAAK,IAAI,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;AAChD,UAAM,WAAW,MAAM,WAAW,MAAM;AACxC,UAAM,UAAU,aAAa,OAAO,MAAM,WAAWL,OAAKC,SAAQ,MAAM,GAAG,cAAc,CAAC,IAAI;AAC9F,UAAM,QAAQ,MAAM,cAAcI,OAAM,IAAI,GAAG;AAC/C,UAAM,SAAS;AAAA,MACb;AAAA,MAAU;AAAA,MAAS,SAAS,MAAM;AAAA,MAAK,SAAS,MAAM;AAAA,MACtD,cAAc,IAAI,gBAAgB,SAAS;AAAA,MAC3C,eAAe,EAAE,YAAY,eAAwB;AAAA,MACrD,QAAQ,MAAMN,aAAY,EAAE,EAAE,SAAS,KAAK;AAAA,IAC9C;AACA,QAAI,OAAO,SAAS,MAAM;AAC1B,QAAI,KAAK,UAAU,UAAUO,IAAG,eAAe,CAAC,EAAE,WAAW;AAC3D,YAAM,UAAU,SAAS,YAAY,WAAW,EAAE;AAClD,YAAM,UAAiD,CAAC;AACxD,UAAI;AACJ,iBAAW,OAAO,KAAK,WAAW;AAChC,YAAI,MAAM;AAAE,kBAAQ,GAAG,IAAI;AAAM;AAAA,QAAS;AAC1C,cAAM,OAAO,MAAMA,IAAG;AAAA,UACpB,GAAG,GAAG,oBAAoB,QAAQ,QAAQ,IAAI,GAAG,CAAC,CAAC,YAAY,QAAQ,MAAM,IAAI,GAAG,CAAC,CAAC;AAAA,UACtF;AAAA,YAAC,EAAE,MAAM,cAAc,OAAO,OAAO;AAAA,YAAG,EAAE,MAAM,cAAc,OAAO,SAAS;AAAA,YAC7E,EAAE,MAAM,sBAAsB,OAAO,MAAM;AAAA,YAAG,EAAE,MAAM,sBAAsB,OAAO,OAAO;AAAA,UAAC;AAAA,QAAC;AAC/F,YAAI,SAAS,MAAO,QAAO;AAC3B,YAAI,SAAS,OAAQ,QAAO;AAC5B,gBAAQ,GAAG,IAAI,SAAS,YAAY,SAAS,QAAQ,eAAe;AAAA,MACtE;AACA,aAAO,SAAS,EAAE,GAAG,QAAQ,QAAQ,CAAC;AAAA,IACxC;AAGA,QAAI,aAAa,QAAQ,KAAK,SAAS,UAAU;AAC/C,YAAMH,OAAM,QAAQ,GAAK;AAAA,IAC3B,OAAO;AACL,YAAM,cAAc,QAAQ,KAAK,IAAI;AAAA,IACvC;AAGA,UAAM,MAAMI,UAAS,MAAMC,UAAS,GAAG,QAAQ,GAAG,MAAM;AACxD,QAAI,EAAE,MAAM;AACV,YAAM,QAAgC;AAAA,QACpC,SAAS,KAAK;AAAA,QAAS,mBAAmB,KAAK;AAAA,QAAmB,OAAO,KAAK;AAAA,QAC9E,SAAS,KAAK;AAAA,QAAS,MAAM,KAAK;AAAA,QAAM,UAAU,KAAK;AAAA,QAAU,WAAW,KAAK;AAAA,QAAW,WAAW,KAAK;AAAA,MAC9G;AACA,iBAAWF,KAAI,EAAE,SAAS,YAAY,IAAI,GAAG,GAAG,QAAQ,KAAK,GAAG,MAAM,CAAC;AACvE;AAAA,IACF;AACA,QAAI,KAAK,KAAK,UAAU,CAACA,IAAG,aAAa;AACvC,MAAAA,IAAG,IAAI,KAAK,KAAK,KAAK,MAAM,yCAAyC,KAAK,KAAK,KAAK,IAAI,CAAC,gDAA2C;AAAA,IACtI;AACA,UAAM,QAAQ;AAAA,MACZ,KAAK,MAAM,UAAU,GAAG,KAAK,MAAM,MAAM;AAAA,MACzC,KAAK,QAAQ,UAAU,GAAG,KAAK,QAAQ,MAAM;AAAA,MAC7C,KAAK,SAAS,UAAU,GAAG,KAAK,SAAS,MAAM;AAAA,MAC/C,KAAK,KAAK,UAAU,GAAG,KAAK,KAAK,MAAM;AAAA,MACvC,KAAK,UAAU,UAAU,GAAG,KAAK,UAAU,MAAM;AAAA,IACnD,EAAE,OAAO,OAAO;AAChB,IAAAA,IAAG,IAAI,UAAK,GAAG,GAAG,KAAK,oBAAoB,iCAAiC,EAAE,WAAM,MAAM,SAAS,MAAM,KAAK,IAAI,IAAI,YAAY,EAAE;AAAA,EACtI,CAAC;AACL;;;AS3IA,YAAY,QAAQ;AAeb,IAAM,cAAc;AAE3B,SAAS,UAAU,aAAsD;AACvE,QAAM,OAAO,YAAY,MAAM,GAAG,EAAE,CAAC,KAAK;AAC1C,QAAM,SAAS,KAAK,MAAM,OAAO,KAAK,MAAM,WAAW,EAAE,SAAS,MAAM,CAAC;AACzE,SAAO,EAAE,KAAK,OAAO,KAAK,OAAO,OAAO,MAAM;AAChD;AAEA,SAAS,WAAW,GAA6B,YAA+B;AAC9E,QAAM,KAAK,EAAE,iBAAiB;AAC9B,MAAI,CAAC,GAAI,OAAM,IAAI,UAAU,iBAAiB,oCAAoC;AAClF,SAAO;AAAA,IAAE,aAAa,EAAE;AAAA,IAAc,cAAc;AAAA,IAAI,WAAW,EAAE,cAAc;AAAA,IACjF,OAAO,EAAE,SAAS;AAAA,IAAI,GAAG,UAAU,EAAE,YAAY;AAAA,EAAE;AACvD;AAIA,SAAS,YAAY,GAAY,MAAyB;AACxD,QAAM,IAAI,aAAa,GAAG,IAAI;AAC9B,SAAO,IAAI,UAAU,yBAAyB,EAAE,SAAS,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,OAAO,EAAE,CAAC;AACzG;AAEO,SAAS,aAAa,GAAY,MAAqB;AAC5D,MAAI,aAAa,aAAa,aAAa,eAAgB,QAAO;AAGlE,MAAI,aAAa,CAAC,KAAM,GAA0B,SAAS,iBAAiB,aAAc,GAA2B,KAAK,GAAG;AAC3H,WAAO,IAAI,eAAe;AAAA,EAC5B;AACA,QAAM,MAAO,EAAyB;AACtC,MAAI,QAAQ,gBAAiB,QAAO,IAAI,UAAU,qBAAqB,qCAAqC;AAC5G,MAAI,QAAQ,gBAAiB,QAAO,IAAI,UAAU,sBAAsB,0BAA0B,EAAE,MAAM,0BAA0B,CAAC;AACrI,MAAI,QAAQ,gBAAiB,QAAO,IAAI,UAAU,wBAAwB,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AACjI,QAAMG,UAAU,EAA0B;AAC1C,MAAIA,WAAUA,WAAU,IAAK,QAAO,IAAI,UAAU,yBAAyB,2BAA2B,EAAE,OAAO,EAAE,CAAC;AAClH,MAAI,aAAa,UAAW,QAAO,YAAY,GAAG,IAAI;AAGtD,QAAM,QAAS,GAA2B;AAC1C,MAAI,iBAAiB,UAAW,QAAO,YAAY,OAAO,IAAI;AAC9D,SAAO,IAAI,UAAU,yBAAyB,gBAAgB,EAAE,OAAO,EAAE,CAAC;AAC5E;AAEA,eAAsB,WAAW,MAAyE;AACxG,QAAM,OAAO,IAAI,IAAI,KAAK,MAAM,EAAE;AAClC,QAAM,UAAU,IAAI,IAAI,KAAK,MAAM,EAAE,aAAa,UAAU,CAAI,wBAAqB,IAAI,CAAC;AAC1F,MAAI;AACJ,MAAI;AACF,aAAS,MAAS,aAAU,IAAI,IAAI,KAAK,MAAM,GAAG,KAAK,UAAU,QAAc,QAAK,GAAG;AAAA,MACrF;AAAA,MAAS,CAAI,cAAW,GAAG,KAAK;AAAA,IAClC,CAAC;AAAA,EACH,SAAS,GAAG;AAAE,UAAM,aAAa,GAAG,IAAI;AAAA,EAAE;AAE1C,SAAO;AAAA,IACL,MAAM,YAAY,OAAO;AACvB,UAAI;AACF,cAAM,IAAI,MAAS,+BAA4B,QAAQ,EAAE,MAAM,CAAC;AAChE,eAAO;AAAA,UAAE,UAAU,EAAE;AAAA,UAAW,iBAAiB,EAAE;AAAA,UACjD,yBAAyB,EAAE;AAAA,UAA2B,WAAW,EAAE;AAAA,UAAY,QAAQ;AAAA,QAAE;AAAA,MAC7F,SAAS,GAAG;AAAE,cAAM,aAAa,GAAG,IAAI;AAAA,MAAE;AAAA,IAC5C;AAAA,IACA,MAAM,WAAW,OAAO,QAAQ;AAC9B,UAAI;AACF,cAAM,IAAI,MAAS,gCAA6B,QAAQ,MAAM,QAA0C,QAAW,EAAE,OAAO,CAAC;AAC7H,eAAO,WAAW,CAAC;AAAA,MACrB,SAAS,GAAG;AAAE,cAAM,aAAa,GAAG,IAAI;AAAA,MAAE;AAAA,IAC5C;AAAA,IACA,MAAM,QAAQ,IAAI,OAAO;AACvB,UAAI;AACF,cAAM,IAAI,MAAS,qBAAkB,QAAQ,IAAI,QAAQ,EAAE,MAAM,IAAI,MAAS;AAC9E,eAAO,WAAW,GAAG,EAAE;AAAA,MACzB,SAAS,GAAG;AAAE,cAAM,aAAa,GAAG,IAAI;AAAA,MAAE;AAAA,IAC5C;AAAA,IACA,MAAM,OAAO,IAAI;AACf,UAAI;AAAE,cAAS,mBAAgB,QAAQ,IAAI,EAAE,iBAAiB,gBAAgB,CAAC;AAAA,MAAE,SAC1E,GAAG;AAAE,cAAM,aAAa,GAAG,IAAI;AAAA,MAAE;AAAA,IAC1C;AAAA,EACF;AACF;;;ACxFA,eAAsB,YAAY,MAUZ;AAGpB,QAAM,KAAK,MAAM,WAAW;AAC5B,QAAM,QAAQ,MAAM,KAAK,KAAK,YAAY,WAAW;AACrD,QAAM,WAAW,IAAI,gBAAgB;AACrC,QAAM,UAAU,IAAI,gBAAgB;AACpC,QAAM,OAAO,KAAK,KAAK,WAAW,OAAO,YAAY,IAAI,CAAC,KAAK,QAAQ,SAAS,MAAM,CAAC,CAAC,EACrF,QAAQ,MAAM,QAAQ,MAAM,CAAC;AAEhC,OAAK,MAAM,MAAM;AAAA,EAAC,CAAC;AACnB,MAAI;AACF,UAAM,KAAK,OAAO,OAAO,QAAQ,MAAM;AAAA,EACzC,SAAS,GAAG;AACV,aAAS,MAAM;AAEf,UAAM,OAAO,MAAM,KAAK,MAAM,MAAM,IAAI;AACxC,QAAI,KAAM,OAAM,KAAK,KAAK,OAAO,KAAK,YAAY,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AAClE,UAAM;AAAA,EACR;AACA,QAAM,IAAI,MAAM;AAChB,QAAM,KAAK,KAAK,IAAI;AACpB,QAAM,QAAQ,YAAY;AAExB,UAAM,KAAK,MAAM,WAAW,EAAE,IAAI,EAAE,cAAc,KAAK,EAAE,KAAK,OAAO,EAAE,OAAO,YAAY,GAAG,YAAY,EAAE,CAAC;AAC5G,UAAM,KAAK,MAAM,UAAU,EAAE,IAAI,EAAE,aAAa,WAAW,IAAI,KAAK,GAAG,QAAQ,IAAI,EAAE,YAAY,GAAI,EAAE,YAAY,EAAE,CAAC;AAAA,EACxH;AACA,MAAI;AACF,QAAI,KAAK,YAAY,KAAK,SAAU,OAAM,KAAK,SAAS,KAAK,UAAU,KAAK;AAAA,QACvE,OAAM,MAAM;AAAA,EACnB,SAAS,GAAG;AAGV,UAAM,KAAK,KAAK,OAAO,EAAE,YAAY,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACrD,UAAM,KAAK,MAAM,MAAM,EAAE,MAAM,MAAM;AAAA,IAAC,CAAC;AACvC,UAAM;AAAA,EACR;AACA,SAAO;AACT;;;AC3CO,SAAS,cAAc,SAAkB,KAA2B;AACzE,UAAQ,QAAQ,OAAO,EAAE,YAAY,+BAA+B,EACjE,OAAO,gBAAgB,oBAAoB,EAC3C,OAAO,OAAO,QAA8B;AAC3C,UAAM,EAAE,MAAAC,OAAM,IAAAC,KAAI,OAAO,IAAI;AAC7B,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,UAAM,OAAgB,MAAM,UAAUA,MAAK,OAAO,OAAO,SAAS;AAClE,UAAM,QAAQ,IAAI,SAAS,OAAO,SAAS,GAAG;AAC9C,UAAM,SAAS,EAAE,GAAG,QAAQ,cAAc,OAAO,gBAAgB,SAAS,KAAK;AAC/E,QAAI,CAAC,OAAO,gBAAgB,OAAO,YAAY,MAAM;AACnD,MAAAC,IAAG,IAAI,mBAAmB,OAAO,SAAS,uBAAuB,KAAK,KAAK,MAAM,EAAE;AAAA,IACrF;AACA,cAAU,MAAM,QAAQD,MAAK,OAAO;AACpC,UAAM,SAAS,OAAO,gBAAgB,KAAK,KAAK;AAChD,UAAM,OAAO,YAAY,OAAO,WAAW,MAAM;AACjD,UAAM,QAAQ,IAAI,WAAWA,MAAK,UAAU,IAAI;AAChD,UAAM,IAAI,MAAM,YAAY;AAAA,MAC1B,MAAM,MAAMA,MAAK,QAAQ,MAAM;AAAA,MAAG;AAAA,MAAO,KAAKA,MAAK;AAAA,MAAK;AAAA,MACxD,UAAUA,MAAK;AAAA,MAAU,UAAU;AAAA,MACnC,QAAQ,OAAO,GAAG,YAAY;AAC5B,cAAM,MAAM,EAAE,2BAA2B,EAAE;AAC3C,QAAAC,IAAG,IAAI,oCAAoC,EAAE,QAAQ,EAAE;AACvD,YAAIA,IAAG,eAAe,IAAI,SAAS;AACjC,cAAI;AACF,kBAAMA,IAAG,aAAa,yBAAyB,GAAG,0BAA0B,YAAY,IAAI,CAAC,QAAQ,OAAO,CAAC,CAAC;AAAA,UAChH,SAAS,GAAG;AAEV,gBAAI,QAAQ,WAAW,CAAC,OAAO,QAAS;AACxC,kBAAM;AAAA,UACR;AACA,cAAI,QAAQ,QAAS;AACrB,cAAI,CAAE,MAAMA,IAAG,QAAQ,GAAG,EAAI,CAAAA,IAAG,IAAI,UAAU,GAAG,eAAe;AAAA,QACnE,OAAO;AACL,UAAAA,IAAG,IAAI,UAAU,GAAG,eAAe;AAAA,QACrC;AAAA,MACF;AAAA,IACF,CAAC;AACD,UAAMD,MAAK,OAAO,OAAO,CAAC,MAAM;AAC9B,QAAE,SAAS,OAAO,SAAS,IAAI;AAAA,QAAE,GAAG,EAAE,SAAS,OAAO,SAAS;AAAA,QAAG,WAAW,OAAO;AAAA,QAAW;AAAA,QAC7F,KAAK,EAAE;AAAA,QAAK,OAAO,EAAE;AAAA,QAAO,MAAM,EAAE,WAAWA,MAAK,IAAI,EAAE,YAAY,GAAG,KAAK,KAAK;AAAA,MAAE;AACvF,UAAI,EAAE,UAAU,CAAC,EAAE,eAAgB,GAAE,iBAAiB,OAAO;AAAA,IAC/D,CAAC;AACD,UAAM,EAAE,IAAI,IAAI,MAAM,YAAYA,OAAM,EAAE,GAAG,QAAQ,cAAc,OAAO,GAAG,SAAS,WAAW,GAAG,CAAC;AACrG,UAAM,KAAK,MAAM,IAAI,IAAW,gBAAgB;AAChD,UAAM,OAAO,IAAI,SAAS,OAAO,SAAS;AAC1C,QAAI,SACF,MAAM,QAAQ,EAAE,OAAO,KAAK,gBAAgB,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,KAAK,aAAc,EAAE,IAC7F,KAAK,eACL;AACN,QAAI,QAAQ;AAAA,IAEZ,WAAW,GAAG,QAAQ,WAAW,GAAG;AAClC,MAAAC,IAAG,IAAI,iGAAiG;AAAA,IAC1G,WAAW,GAAG,QAAQ,WAAW,GAAG;AAClC,eAAS,EAAE,IAAI,GAAG,QAAQ,CAAC,EAAG,IAAI,MAAM,GAAG,QAAQ,CAAC,EAAG,KAAK;AAC5D,MAAAA,IAAG,IAAI,uBAAkB,GAAG,QAAQ,CAAC,EAAG,IAAI,EAAE;AAAA,IAChD,WAAWA,IAAG,aAAa;AACzB,eAAS,MAAMA,IAAG,OAAO,mBAAmB,GAAG,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;AAAA,IAC1I,OAAO;AACL,MAAAA,IAAG,IAAI,mBAAmB,GAAG,QAAQ,MAAM,sDAAsD;AAAA,IACnG;AACA,UAAMD,MAAK,OAAO,OAAO,CAAC,MAAM;AAAE,QAAE,SAAS,OAAO,SAAS,EAAG,eAAe;AAAA,IAAO,CAAC;AACvF,UAAME,SAAQ,OAAO,WAAW,OAAO;AACvC,QAAI,EAAE,KAAM,YAAWD,KAAI,EAAE,QAAQC,QAAO,OAAO,GAAG,OAAO,cAAc,UAAU,KAAK,CAAC;AAAA,QACtF,CAAAD,IAAG,IAAI,uBAAkB,GAAG,KAAK,KAAKC,MAAK,GAAG;AAAA,EACrD,CAAC;AACL;;;ACvEO,SAAS,eAAe,SAAkB,KAA2B;AAC1E,UAAQ,QAAQ,QAAQ,EAAE,YAAY,qBAAqB,EACxD,OAAO,SAAS,yBAAyB,EACzC,OAAO,OAAO,QAA2B;AACxC,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,UAAU,IAAI,MAAM,OAAO,OAAO,IAAI,QAAQ,IAChD,CAAC,IAAI,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc,EAAE,SAAS,CAAC,EAAE,OAAO,CAAC,MAAM,MAAM,MAAS;AACvG,UAAM,OAAiB,CAAC;AACxB,eAAW,KAAK,SAAS;AACvB,YAAM,OAAO,YAAY,EAAE,WAAW,EAAE,MAAM;AAC9C,YAAM,QAAQ,IAAI,WAAWA,MAAK,UAAU,IAAI;AAChD,YAAM,OAAO,IAAI,IAAI,EAAE,MAAM,EAAE;AAG/B,YAAMA,MAAK,SAAS,MAAM,YAAY;AACpC,cAAM,KAAK,MAAM,MAAM,WAAW;AAClC,YAAI,IAAI;AACN,cAAI;AAAE,mBAAO,MAAMA,MAAK,QAAQ,EAAE,MAAM,GAAG,OAAO,GAAG,EAAE;AAAA,UAAE,SAClD,GAAG;AACR,kBAAM,UAAU,aAAa,aAAa,EAAE,SAAS,WAAW;AAChE,YAAAC,IAAG,IAAI,UACH,qBAAqB,IAAI,uDACzB,qCAAqC,IAAI,KAAK,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC,CAAC,qDAAqD;AAAA,UACnJ;AAAA,QACF;AACA,cAAM,MAAM,MAAM;AAAA,MACpB,CAAC;AACD,WAAK,KAAK,EAAE,SAAS;AAAA,IACvB;AACA,QAAI,EAAE,KAAM,YAAWA,KAAI,EAAE,WAAW,KAAK,CAAC;AAAA,aACrC,KAAK,WAAW,EAAG,CAAAA,IAAG,IAAI,eAAe;AAAA,QAC7C,CAAAA,IAAG,IAAI,wBAAmB,KAAK,IAAI,CAAC,MAAM,cAAc,GAAG,MAAS,EAAE,WAAW,CAAC,EAAE,KAAK,IAAI,CAAC,EAAE;AAAA,EACvG,CAAC;AACL;;;AC1CA,SAAS,iBAAiB;AAanB,IAAM,eAAe,EAAE,SAAS,MAAM;AAEtC,SAAS,YAAY,SAAkB,KAA2B;AACvE,UACG,QAAQ,KAAK,EACb,YAAY,mEAAmE,EAC/E,OAAO,sBAAsB,yDAAyD,EACtF,OAAO,mBAAmB,6CAA6C,EACvE,OAAO,SAAS,sCAAsC,EACtD,SAAS,aAAa,+BAA+B,EACrD,SAAS,aAAa,gCAAgC,EACtD,OAAO,OAAO,KAAa,MAAgB,MAAwD;AAClG,UAAM,EAAE,MAAAC,MAAK,IAAI;AACjB,QAAI,IAAI,KAAK,EAAE,MAAM;AACnB,YAAM,IAAI,UAAU,wBAAwB,4BAA4B;AAAA,QACtE,MAAM;AAAA,MACR,CAAC;AAAA,IACH;AACA,UAAM,KAAK,MAAM,iBAAiB,KAAK,GAAG,KAAK;AAC/C,UAAM,MAAM,MAAM,OAAO,KAAK,IAAI,EAAE,GAAG;AAEvC,UAAM,cAAc,KAAK,IAAI,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC;AAChD,UAAM,QAAQ,MAAM,cAAcA,OAAM,IAAI,GAAG;AAC/C,iBAAa,UAAU;AACvB,QAAI;AACJ,QAAI;AACF,aAAO,MAAMA,MAAK,MAAM,IAAI,KAAK,MAAM,EAAE,GAAGA,MAAK,KAAK,GAAG,MAAM,IAAI,CAAC;AAAA,IACtE,UAAE;AACA,mBAAa,UAAU;AAAA,IACzB;AACA,QAAI,KAAK,QAAQ;AACf,MAAAA,MAAK,MAAM,KAAK,MAAM;AACtB,UAAI,YAAY,OAAO,UAAU,QAAQ,KAAK,MAAM,KAAK,EAAE;AAC3D;AAAA,IACF;AACA,QAAI,YAAY,KAAK,QAAQ,CAAC;AAAA,EAChC,CAAC;AACL;;;AChDO,SAAS,IAAI,KAAoB,KAAmB;AACzD,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,IAAI,KAAK,IAAI,GAAG,KAAK,OAAO,IAAI,QAAQ,IAAI,IAAI,KAAK,GAAG,EAAE,QAAQ,KAAK,GAAI,CAAC;AAClF,MAAI,IAAI,GAAI,QAAO;AACnB,MAAI,IAAI,KAAM,QAAO,GAAG,KAAK,MAAM,IAAI,EAAE,CAAC;AAC1C,MAAI,IAAI,MAAO,QAAO,GAAG,KAAK,MAAM,IAAI,IAAI,CAAC;AAC7C,SAAO,GAAG,KAAK,MAAM,IAAI,KAAK,CAAC;AACjC;AAEA,IAAM,MAAM,CAAC,MAAc,OAAO,QAAQ,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC;AAEvD,SAAS,OAAO,GAA6B;AAClD,MAAI,CAAC,EAAG,QAAO;AACf,QAAM,OAAO,EAAE,SAAS,EAAE,SAAS,OAAO,GAAG,EAAE,IAAI,KAAK,EAAE,KAAK,KAAK,EAAE;AACtE,SAAO,EAAE,cAAc,OAAO,OAAO,GAAG,IAAI,KAAK,IAAI,EAAE,SAAS,CAAC;AACnE;AAEO,SAAS,MAAM,MAA4B;AAChD,QAAM,SAAS,KAAK,CAAC,EAAG,IAAI,CAAC,GAAG,MAAM,KAAK,IAAI,GAAG,KAAK,IAAI,CAAC,OAAO,EAAE,CAAC,KAAK,IAAI,MAAM,CAAC,CAAC;AACvF,SAAO,KAAK,IAAI,CAAC,MAAM,OAAO,EAAE,IAAI,CAAC,GAAG,MAAO,MAAM,EAAE,SAAS,IAAI,IAAI,EAAE,OAAO,OAAO,CAAC,CAAE,CAAE,EAAE,KAAK,IAAI,CAAC;AAC3G;;;ACTA,IAAM,OAAO,CAAC,OAAO,UAAU,UAAU,YAAY,YAAY;AACjE,IAAM,SAAS,CAAC,GAAQ,QACtB,CAAC,EAAE,MAAM,EAAE,SAAS,WAAW,EAAE,QAAQ,EAAE,QAAQ,OAAO,UAAK,IAAI,EAAE,QAAQ,cAAc,MAAM,GAAG,GAAG,OAAO,EAAE,MAAM,CAAC;AAIzH,eAAe,UAAU,KAAqB,IAAe,SAAiC;AAC5F,QAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,QAAM,IAAI,IAAI,KAAK;AACnB,QAAM,SAAS,MAAM,WAAWD,OAAM,EAAE,QAAQ,EAAE;AAClD,QAAM,YAAY,EAAE,UAAU,CAAC,MAAcC,IAAG,IAAI,CAAC,IAAI;AACzD,QAAM,UAAU,MAAM,YAAYD,OAAM,QAAQ,UAAU,SAAS;AACnE,QAAM,iBAAiBA,OAAM,OAAO,WAAW,aAAa;AAC5D,QAAM,iBAAiBA,OAAM,OAAO,WAAW,eAAe;AAC9D,QAAM,KAAK,MAAM,oBAAoB,SAAS,QAAQ,EAAE;AACxD,QAAM,EAAE,QAAQ,GAAG,IAAI,IAAI,GAAG;AAC9B,MAAI,WAAW,YAAY,IAAI,MAAM,YAAY,IAAI,MAAM;AACzD,UAAM,IAAI,UAAU,2BAA2B,yBAAyB,IAAI,IAAI,UAAU,OAAO,KAAK;AAAA,MACpG,MAAM;AAAA,IACR,CAAC;AAAA,EACH;AACA,MAAI,CAAC,EAAE,KAAM,CAAAC,IAAG,IAAI,UAAK,OAAO,IAAI,MAAM,IAAI,IAAI,MAAM,cAAc,GAAG;AACzE,QAAM,UAAuG,CAAC;AAC9G,aAAW,KAAK,GAAG,QAAQ,OAAO,CAAC,MAAM,EAAE,YAAY,IAAI,GAAG;AAC5D,UAAM,KAAK,MAAM,QAAQ,IAAI;AAAA,MAC3B,uBAAuB,mBAAmB,EAAE,EAAE,CAAC,kBAAkB,mBAAmB,IAAI,EAAE,CAAC;AAAA,IAAE;AAC/F,YAAQ,KAAK,EAAE,QAAQ,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,GAAG,cAAc,GAAG,aAAa,CAAC;AAAA,EAChH;AACA,MAAI,EAAE,MAAM;AACV,eAAWA,KAAI,EAAE,SAAS,EAAE,QAAQ,OAAO,WAAW,OAAO,WAAW,QAAQ,KAAK,QAAQ,eAAe,GAAG,QAAQ,CAAC;AACxH;AAAA,EACF;AACA,MAAI,QAAQ,WAAW,GAAG;AAAE,IAAAA,IAAG,IAAI,mCAAmC;AAAG;AAAA,EAAO;AAChF,QAAM,MAAMD,MAAK,IAAI;AACrB,QAAM,OAAO,CAAC,CAAC,UAAU,GAAG,IAAI,GAAG,GAAG,QAAQ,QAAQ,CAAC,EAAE,QAAQ,aAAa,MAAM,aAAa,WAAW,IACxG,CAAC,CAAC,OAAO,MAAM,UAAK,uBAAuB,UAAK,UAAK,QAAG,CAAC,IACzD,aAAa,IAAI,CAAC,MAAM,CAAC,OAAO,MAAM,GAAG,OAAO,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;AAC9D,aAAWE,SAAQ,MAAM,IAAI,EAAG,CAAAD,IAAG,IAAIC,KAAI;AAC7C;AAEO,SAAS,eAAe,SAAkB,KAA2B;AAC1E,UAAQ,QAAQ,QAAQ,EAAE,YAAY,0FAA0F,EAC7H,OAAO,sBAAsB,yDAAyD,EACtF,OAAO,mBAAmB,6CAA6C,EACvE,OAAO,OAAO,UAA6C;AAC1D,UAAM,EAAE,MAAAF,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,QAAI,CAAC,MAAM,QAAQ;AACjB,YAAM,KAAK,MAAM,cAAcD,KAAI;AACnC,UAAI,IAAI;AAAE,cAAM,UAAU,KAAK,IAAI,MAAM,GAAG;AAAG;AAAA,MAAO;AAAA,IACxD;AACA,UAAM,KAAK,MAAM,iBAAiB,KAAK,OAAO,QAAQ;AACtD,UAAM,iBAAiBA,OAAM,GAAG,OAAO,WAAW,eAAe;AACjE,UAAM,MAAM,MAAM,OAAO,KAAK,IAAI,MAAM,GAAG;AAC3C,QAAI,CAAC,EAAE,KAAM,CAAAC,IAAG,IAAI,YAAY,IAAI,GAAG,CAAC;AACxC,UAAM,KAAK,MAAM,GAAG,QAAQ,IAAI;AAAA,MAC9B,uBAAuB,mBAAmB,GAAG,OAAO,EAAE,CAAC,kBAAkB,mBAAmB,IAAI,EAAE,CAAC;AAAA,IAAE;AACvG,QAAI,EAAE,MAAM;AAAE,iBAAWA,KAAI,EAAE,SAAS,YAAY,IAAI,GAAG,GAAG,cAAc,GAAG,aAAa,CAAC;AAAG;AAAA,IAAO;AACvG,QAAI,GAAG,aAAa,WAAW,GAAG;AAAE,MAAAA,IAAG,IAAI,sBAAsB;AAAG;AAAA,IAAO;AAC3E,UAAM,MAAMD,MAAK,IAAI;AACrB,UAAM,OAAO,CAAC,MAAM,GAAG,GAAG,aAAa,IAAI,CAAC,MAAM,OAAO,GAAG,GAAG,CAAC,CAAC;AACjE,eAAWE,SAAQ,MAAM,IAAI,EAAG,CAAAD,IAAG,IAAIC,KAAI;AAAA,EAC7C,CAAC;AACL;;;AC5EA,SAAS,SAAAC,QAAO,eAAe;AAC/B,SAAS,QAAAC,QAAM,YAAAC,iBAAgB;AAC/B,SAAS,UAAAC,eAA4B;AAgBrC,SAASC,WAAU,MAAc,GAA0B;AAGzD,MAAI,aAAa,aAAa,EAAE,SAAS,wBAAwB;AAC/D,WAAO,EAAE,MAAM,QAAQ,UAAU,OAAO,EAAE,MAAM,EAAE,MAAM,SAAS,EAAE,SAAS,MAAM,EAAE,KAAK,EAAE;AAAA,EAC7F;AACA,QAAM;AACR;AAOA,eAAe,WAAW,MAAc,OAAuC;AAC7E,MAAI;AACJ,MAAI;AACF,eAAW,MAAM,QAAQ,MAAM,EAAE,eAAe,KAAK,CAAC,GAAG,OAAO,CAAC,MAAM,EAAE,YAAY,CAAC,EAAE,IAAI,CAAC,MAAM,EAAE,IAAI;AAAA,EAC3G,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACA,QAAM,QAAkB,CAAC;AACzB,aAAW,QAAQ,SAAS;AAC1B,QAAI,MAAM,IAAI,IAAI,EAAG;AACrB,QAAI;AACF,YAAMC,OAAMC,OAAK,MAAM,MAAM,MAAM,CAAC;AACpC,YAAM,KAAK,IAAI;AAAA,IACjB,QAAQ;AAAA,IAAwD;AAAA,EAClE;AACA,SAAO,MAAM,KAAK;AACpB;AAIO,SAAS,aAAa,SAAkB,KAA2B;AACxE,UAAQ,QAAQ,MAAM,EACnB,YAAY,2EAA2E,EACvF,OAAO,UAAU,8DAA8D,EAC/E,UAAU,IAAIC,QAAO,0BAA0B,oBAAoB,EAAE,QAAQ,CAAC,SAAS,KAAK,CAAC,EAAE,QAAQ,OAAO,CAAC,EAC/G,OAAO,OAAO,UAAiB;AAC9B,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,KAAK,MAAM,cAAcD,MAAK,KAAKA,MAAK,IAAI;AAClD,QAAI,CAAC,IAAI;AACP,YAAM,IAAI,UAAU,yBAAyB,0BAA0B,EAAE,MAAM,gCAAgC,CAAC;AAAA,IAClH;AACA,UAAM,SAAS,MAAM,WAAWA,OAAM,EAAE,QAAQ,EAAE;AAClD,UAAM,YAAY,EAAE,UAAU,CAAC,MAAcC,IAAG,IAAI,CAAC,IAAI;AACzD,UAAM,UAAU,MAAM,YAAYD,OAAM,QAAQ,QAAQ,SAAS;AACjE,UAAM,iBAAiBA,OAAM,OAAO,WAAW,aAAa;AAC5D,UAAM,MAAM,MAAM,oBAAoB,SAAS,QAAQ,EAAE;AACzD,QAAI,CAAC,EAAE,KAAM,CAAAC,IAAG,IAAI,UAAK,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,IAAI,IAAI,yBAAyB;AAEvF,UAAM,QAAQ,IAAI,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,IAAI,CAAC;AACpD,UAAM,OAAgC,CAAC;AACvC,UAAM,gBAAgC,CAAC;AACvC,UAAM,iBAAiC,CAAC;AACxC,eAAW,KAAK,IAAI,SAAS;AAC3B,UAAI,CAAC,WAAW,EAAE,IAAI,GAAG;AACvB,sBAAc,KAAKL,WAAU,EAAE,MAAM,gBAAgB,EAAE,IAAI,CAAC,CAAC;AAC7D;AAAA,MACF;AACA,UAAI;AACF,aAAK,EAAE,IAAI,IAAI,MAAMI,MAAK,IAAI,QAAQF,OAAK,GAAG,MAAM,EAAE,IAAI,CAAC;AAC3D,uBAAe,KAAK,CAAC;AAAA,MACvB,SAAS,GAAG;AACV,sBAAc,KAAKF,WAAU,EAAE,MAAM,CAAC,CAAC;AAAA,MACzC;AAAA,IACF;AACA,UAAM,SAAS,MAAM,WAAW,GAAG,MAAM,KAAK;AAE9C,UAAM,EAAE,SAAS,QAAQ,IAAI,cAAc,GAAG,MAAM,gBAAgB,MAAM,MAAM;AAChF,UAAM,UAAU,MAAM,aAAaI,OAAM,EAAE,QAAQ,KAAK,SAAS,UAAU,MAAM,UAAU,UAAU,MAAM;AAAA,IAAC,EAAE,CAAC;AAC/G,UAAM,YAAYA,OAAM,SAAS,SAAS,QAAQ,MAAM,IAAI,GAAG,EAAE,KAAK,UAAU,MAAM,SAAS,CAAC;AAChG,eAAW,KAAK,SAAS;AACvB,UAAI,EAAE,WAAW,YAAY,EAAE,IAAK,GAAE,MAAME,UAASF,MAAK,KAAK,EAAE,GAAG,KAAK;AAAA,IAC3E;AACA,UAAM,iBAAiC,QAAQ,IAAI,CAAC,UAAU,EAAE,MAAM,QAAQ,WAAW,QAAQ,gDAA2C,EAAE;AAC9I,UAAM,UAAU,CAAC,GAAG,eAAe,GAAG,SAAS,GAAG,cAAc;AAEhE,UAAM,MAAM,mBAAmBC,KAAI,SAAS,QAAQ,EAAE,IAAI,CAAC;AAC3D,QAAI,IAAK,OAAM;AAAA,EACjB,CAAC;AACL;;;AC7FO,SAAS,eAAe,SAAkB,KAA2B;AAC1E,QAAM,SAAS,QAAQ,QAAQ,QAAQ,EAAE,YAAY,0BAA0B;AAE/E,SAAO,QAAQ,MAAM,EAAE,YAAY,iCAAiC,EACjE,OAAO,YAAY;AAClB,UAAM,EAAE,MAAAE,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,UAAM,EAAE,SAAS,IAAI,IAAI,MAAM,YAAYA,OAAM,QAAQ,eAAe,WAAW,GAAG,CAAC;AACvF,UAAM,KAAK,MAAM,IAAI,IAAW,gBAAgB;AAChD,UAAM,WAAW,QAAQ,cAAc;AACvC,QAAI,EAAE,MAAM;AACV,iBAAWC,KAAI,EAAE,SAAS,GAAG,QAAQ,IAAI,CAAC,OAAO,EAAE,GAAG,GAAG,QAAQ,EAAE,OAAO,SAAS,EAAE,EAAE,CAAC;AACxF;AAAA,IACF;AACA,eAAW,KAAK,GAAG,SAAS;AAC1B,YAAM,OAAO,EAAE,OAAO,WAAW,MAAM;AACvC,MAAAA,IAAG,IAAI,GAAG,IAAI,IAAI,EAAE,IAAI,KAAK,EAAE,IAAI,EAAE;AAAA,IACvC;AAAA,EACF,CAAC;AAEH,SAAO,QAAQ,KAAK,EAAE,YAAY,uBAAuB,EAAE,SAAS,UAAU,aAAa,EACxF,OAAO,OAAO,SAA6B;AAC1C,UAAM,EAAE,MAAAD,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,UAAM,EAAE,IAAI,IAAI,MAAM,YAAYA,OAAM,QAAQ,cAAc,WAAW,GAAG,CAAC;AAC7E,UAAM,KAAK,MAAM,IAAI,IAAW,gBAAgB;AAChD,UAAM,aAA0B,GAAG,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,UAAU,IAAI,EAAE,IAAI,MAAM,EAAE,MAAM,MAAM,EAAE,KAAK,EAAE;AAChH,QAAI;AACJ,QAAI,MAAM;AACR,YAAM,QAAQ,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,SAAS,IAAI;AACpD,UAAI,CAAC,MAAO,OAAM,IAAI,UAAU,2BAA2B,cAAc,IAAI,sBAAsB,EAAE,WAAW,CAAC;AACjH,eAAS,EAAE,IAAI,MAAM,IAAI,MAAM,MAAM,KAAK;AAAA,IAC5C,WAAWC,IAAG,aAAa;AACzB,eAAS,MAAMA,IAAG,OAAO,mBAAmB,GAAG,QAAQ,IAAI,CAAC,OAAO,EAAE,MAAM,GAAG,EAAE,IAAI,KAAK,EAAE,IAAI,IAAI,OAAO,EAAE,IAAI,EAAE,IAAI,MAAM,EAAE,KAAK,EAAE,EAAE,CAAC;AAAA,IAC1I,OAAO;AACL,YAAM,IAAI,UAAU,yBAAyB,mDAAmD,EAAE,WAAW,CAAC;AAAA,IAChH;AACA,UAAMD,MAAK,OAAO,OAAO,CAAC,MAAM;AAAE,QAAE,SAAS,OAAO,SAAS,EAAG,eAAe;AAAA,IAAO,CAAC;AACvF,QAAI,EAAE,KAAM,YAAWC,KAAI,EAAE,cAAc,OAAO,CAAC;AAAA,QAC9C,CAAAA,IAAG,IAAI,uBAAkB,OAAO,IAAI,EAAE;AAAA,EAC7C,CAAC;AACL;;;AC9CO,SAAS,gBAAgB,SAAkB,KAA2B;AAC3E,UAAQ,QAAQ,SAAS,EAAE,YAAY,iCAAiC,EACrE,OAAO,YAAY;AAClB,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,QAAI,aAAwH;AAC5H,QAAI;AACF,YAAM,OAAO,MAAM,UAAUA,MAAK,OAAO,OAAO,SAAS;AACzD,mBAAa,EAAE,aAAa,KAAK,aAAa,eAAe,KAAK,eAAe,kBAAkB,KAAK,kBAAkB,cAAc,KAAK,aAAa;AAAA,IAC5J,SAAS,GAAG;AAEV,UAAI,aAAa,eAAgB,OAAM;AAAA,IAEzC;AACA,QAAI,EAAE,MAAM;AACV,iBAAWC,KAAI,EAAE,KAAKD,MAAK,SAAS,QAAQ,WAAW,CAAC;AACxD;AAAA,IACF;AACA,IAAAC,IAAG,IAAI,QAAQD,MAAK,OAAO,EAAE;AAC7B,UAAME,SAAQ,OAAO,WAAW,OAAO;AACvC,QAAI,YAAY;AACd,MAAAD,IAAG,IAAI,UAAUC,MAAK,SAAS,WAAW,YAAY,KAAK,GAAG,CAAC,SAAS,WAAW,aAAa,YAAY,WAAW,gBAAgB,EAAE;AAAA,IAC3I,OAAO;AACL,MAAAD,IAAG,IAAI,UAAUC,MAAK,eAAe;AAAA,IACvC;AAAA,EACF,CAAC;AACL;;;AC5BO,SAAS,eAAe,SAAkB,KAA2B;AAC1E,UAAQ,QAAQ,QAAQ,EAAE,YAAY,8BAA8B,EACjE,OAAO,YAAY;AAClB,UAAM,EAAE,MAAAC,OAAM,IAAAC,IAAG,IAAI;AACrB,UAAM,IAAI,IAAI,KAAK;AACnB,UAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,UAAM,SAAS,cAAc,EAAE,QAAQ,IAAI,cAAc;AACzD,UAAM,EAAE,SAAS,IAAI,IAAI,MAAM,YAAYA,OAAM,QAAQ,UAAU,WAAW,GAAG,CAAC;AAClF,UAAM,KAAK,MAAM,IAAI,IAAW,gBAAgB;AAChD,UAAM,eAAe,QAAQ;AAC7B,QAAI,gBAAgB,CAAC,GAAG,QAAQ,KAAK,CAAC,MAAM,EAAE,OAAO,aAAa,EAAE,GAAG;AACrE,MAAAC,IAAG,IAAI,4CAA4C,aAAa,IAAI,EAAE;AAAA,IACxE;AACA,UAAMC,SAAQ,OAAO,WAAW,OAAO;AACvC,QAAI,EAAE,MAAM;AACV,iBAAWD,KAAI,EAAE,QAAQC,QAAO,cAAc,gBAAgB,MAAM,GAAG,CAAC;AACxE;AAAA,IACF;AACA,IAAAD,IAAG,IAAI,GAAG,GAAG,KAAK,KAAKC,MAAK,GAAG;AAC/B,eAAW,KAAK,GAAG,SAAS;AAC1B,YAAM,OAAO,cAAc,OAAO,EAAE,KAAK,MAAM;AAC/C,MAAAD,IAAG,IAAI,GAAG,IAAI,IAAI,EAAE,IAAI,KAAK,EAAE,IAAI,EAAE;AACrC,iBAAW,KAAK,EAAE,MAAM;AACtB,QAAAA,IAAG,IAAI,KAAK,EAAE,IAAI,KAAK,EAAE,MAAM,EAAE;AACjC,mBAAW,KAAK,EAAE,SAAS;AACzB,UAAAA,IAAG,IAAI,OAAO,EAAE,IAAI,KAAK,EAAE,IAAI,KAAK,EAAE,MAAM,EAAE;AAAA,QAChD;AAAA,MACF;AAAA,IACF;AAAA,EACF,CAAC;AACL;;;ACzBO,IAAM,WAAuB;AAAA,EAClC;AAAA,EAAe;AAAA,EAAgB;AAAA,EAAgB;AAAA,EAAgB;AAAA,EAAgB;AAAA,EAAa;AAAA,EAAa;AAAA,EAAe;AAAA,EACxH;AACF;;;ACXA,IAAM,eAAe;AACrB,IAAM,SAAS,KAAK,KAAK,KAAK;AAC9B,IAAM,qBAAqB;AAE3B,eAAsB,kBAAkBE,OAAYC,KAAQ,GAAsB,YAAY,oBAAmC;AAC/H,MAAI,EAAE,QAAQD,MAAK,IAAI,MAAMA,MAAK,IAAI,yBAAyB,OAAO,CAACC,IAAG,YAAa;AACvF,QAAM,MAAM,MAAMD,MAAK,OAAO,KAAK;AACnC,QAAM,OAAO,IAAI,aAAa;AAC9B,MAAI,QAAQA,MAAK,IAAI,EAAE,QAAQ,IAAI,IAAI,KAAK,IAAI,EAAE,QAAQ,IAAI,OAAQ;AACtE,QAAM,aAAa,IAAI,gBAAgB;AACvC,QAAM,QAAQ,WAAW,MAAM,WAAW,MAAM,GAAG,SAAS;AAC5D,MAAI;AACJ,MAAI;AACF,UAAM,MAAM,MAAMA,MAAK,MAAM,cAAc,EAAE,QAAQ,WAAW,OAAO,CAAC;AACxE,QAAI,IAAI,GAAI,WAAW,MAAM,IAAI,KAAK,GAA4B;AAAA,EACpE,QAAQ;AAAA,EAAsD,UAC9D;AAAU,iBAAa,KAAK;AAAA,EAAE;AAC9B,MAAI;AAGF,UAAMA,MAAK,OAAO,OAAO,CAAC,MAAM;AAC9B,QAAE,cAAc,EAAE,eAAeA,MAAK,IAAI,EAAE,YAAY,GAAG,QAAQ,UAAU,EAAE,aAAa,UAAUA,MAAK,QAAQ;AAAA,IACrH,CAAC;AAAA,EACH,QAAQ;AAAE;AAAA,EAAO;AACjB,MAAI,UAAU,gBAAgB,QAAQA,MAAK,OAAO,IAAI,GAAG;AACvD,IAAAC,IAAG,IAAI,4BAA4BD,MAAK,OAAO,WAAM,MAAM,4BAA4B;AAAA,EACzF;AACF;;;AC/BA,SAAS,YAAAE,iBAAgB;AACzB,SAAS,QAAAC,cAAY;AAqBrB,IAAM,QAAQ,OAAmB,EAAE,eAAe,GAAG,UAAU,CAAC,EAAE;AAE3D,IAAM,cAAN,MAAkB;AAAA,EACvB,YAAqBC,MAAa;AAAb,eAAAA;AAAA,EAAc;AAAA,EAAd;AAAA,EAErB,IAAY,OAAO;AAAE,WAAOC,OAAK,KAAK,KAAK,aAAa;AAAA,EAAE;AAAA,EAE1D,MAAM,OAA4B;AAChC,QAAI;AACJ,QAAI;AACF,YAAM,MAAMC,UAAS,KAAK,MAAM,MAAM;AAAA,IACxC,SAAS,GAAG;AACV,UAAK,EAA4B,SAAS,SAAU,QAAO,MAAM;AACjE,YAAM;AAAA,IACR;AACA,QAAI;AACF,YAAM,SAAS,KAAK,MAAM,GAAG;AAC7B,UAAI,OAAO,kBAAkB,KAAK,OAAO,OAAO,aAAa,SAAU,OAAM,IAAI,MAAM,OAAO;AAC9F,aAAO;AAAA,IACT,SAAS,OAAO;AACd,YAAM,IAAI,UAAU,wBAAwB,6BAA6B,KAAK,IAAI,IAAI;AAAA,QACpF,MAAM;AAAA,QAAuD;AAAA,MAC/D,CAAC;AAAA,IACH;AAAA,EACF;AAAA,EAEA,MAAM,OAAO,IAA+D;AAC1E,UAAM,UAAU,MAAM,KAAK,KAAK;AAChC,UAAM,OAAO,GAAG,OAAO,KAAK;AAC5B,UAAM,gBAAgB,KAAK,KAAK,eAAe,IAAI;AACnD,WAAO;AAAA,EACT;AACF;;;ACtDA,SAAS,UAAU,oBAA0C;AAC7D,SAAS,SAAAC,QAAO,WAAAC,UAAS,QAAAC,aAAY;AACrC,SAAS,eAAe;AACxB,SAAS,WAAAC,UAAS,QAAAC,cAAY;AAmBvB,SAAS,aAAa,QAA0B;AACrD,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAgB,CAAC;AACvB,aAAWC,SAAQ,OAAO,MAAM,OAAO,GAAG;AACxC,UAAM,IAAI,0BAA0B,KAAKA,KAAI;AAC7C,QAAI,CAAC,KAAK,KAAK,IAAI,EAAE,CAAC,CAAE,EAAG;AAC3B,SAAK,IAAI,EAAE,CAAC,CAAE;AACd,QAAI,KAAK,EAAE,MAAM,EAAE,CAAC,GAAI,KAAK,EAAE,CAAC,EAAG,CAAC;AAAA,EACtC;AACA,SAAO;AACT;AAgBA,IAAM,uBAAuB,oBAAI,IAAqB;AAGtD,SAAS,wBAAwB,SAA2B;AAC1D,QAAM,MAAM,WAAW;AACvB,MAAI,IAAI,qBAAqB,IAAI,GAAG;AACpC,MAAI,MAAM,QAAW;AACnB,UAAM,OAAO,UAAU,CAAC,MAAM,SAAS,UAAU,SAAS,iBAAiB,IAAI,CAAC,UAAU,SAAS,iBAAiB;AACpH,QAAI;AACF,UAAI,aAAa,OAAO,MAAM;AAAA,QAC5B,KAAK,QAAQ;AAAA,QACb,KAAK,EAAE,GAAG,QAAQ,KAAK,QAAQ,KAAK,qBAAqB,IAAI;AAAA,QAC7D,OAAO,CAAC,UAAU,QAAQ,QAAQ;AAAA,QAClC,aAAa;AAAA,QACb,SAAS;AAAA,MACX,CAAC,EACE,SAAS,EAAE,KAAK,EAAE,SAAS;AAAA,IAChC,QAAQ;AACN,UAAI;AAAA,IACN;AACA,yBAAqB,IAAI,KAAK,CAAC;AAAA,EACjC;AACA,SAAO;AACT;AAaO,SAAS,eAAe,SAAmC;AAChE,QAAM,MAAyB,EAAE,GAAG,QAAQ,KAAK,QAAQ,KAAK,qBAAqB,IAAI;AACvF,MAAI,CAAC,IAAI,yBAA0B,KAAI,2BAA2B;AAClE,MAAI,CAAC,IAAI,wBAAyB,KAAI,0BAA0B;AAChE,MAAI,CAAC,IAAI,mBAAmB,CAAC,IAAI,WAAW,CAAC,wBAAwB,OAAO,GAAG;AAC7E,QAAI,kBAAkB;AAAA,EACxB;AACA,SAAO,EAAE,KAAK,QAAQ,GAAG,KAAK,aAAa,MAAM,WAAW,IAAI,OAAO,KAAK;AAC9E;AAIA,SAAS,OAAO,MAAgB,SAA0F;AACxH,SAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,aAAS,OAAO,MAAM,eAAe,OAAO,GAAG,CAAC,KAAK,QAAQ,WAAW;AACtE,UAAI,OAAQ,IAA8B,SAAS,UAAU;AAC3D,eAAO,IAAI,UAAU,wBAAwB,uCAAuC;AAAA,UAClF,MAAM;AAAA,QAAuE,CAAC,CAAC;AACjF;AAAA,MACF;AACA,YAAM,OAAO,MAAO,OAAQ,IAA2B,SAAS,WAAY,IAAyB,OAAO,IAAK;AACjH,MAAAA,SAAQ,EAAE,MAAM,QAAQ,OAAO,MAAM,GAAG,QAAQ,OAAO,MAAM,GAAG,KAAK,OAAO,OAAU,CAAC;AAAA,IACzF,CAAC;AAAA,EACH,CAAC;AACH;AAEA,IAAM,WAAW,CAAC,GAAqC,YACrD,EAAE,SAAS,IAAI,EAAE,IAAI,KAAK,IAAI,EAAE,IAAI,OAAO,QAAQ,EAAE,QAAQ,QAAQ;AAEvE,eAAe,QAAQ,UAAqC;AAC1D,QAAM,IAAI,MAAM,OAAO,CAAC,MAAM,UAAU,UAAU,IAAI,GAAG,QAAQ;AACjE,MAAI,EAAE,SAAS,GAAG;AAChB,UAAM,OAAO,EAAE,OAAO,KAAK,EAAE,MAAM,OAAO,EAAE,IAAI,KAAK;AACrD,UAAM,IAAI,UAAU,iBAAiB,2BAA2B,QAAQ,IAAI;AAAA,MAC1E,MAAM,QAAQ;AAAA,MAAW,SAAS,EAAE,SAAS,iBAAiB,KAAK,SAAS;AAAA,MAAG,OAAO,EAAE;AAAA,IAAI,CAAC;AAAA,EACjG;AACA,SAAO,aAAa,EAAE,MAAM;AAC9B;AAIA,eAAe,MAAM,KAAaC,MAAiC;AACjE,QAAMC,OAAMC,SAAQF,IAAG,GAAG,EAAE,WAAW,KAAK,CAAC;AAC7C,QAAM,IAAI,MAAM,OAAO,CAAC,SAAS,MAAM,KAAKA,IAAG,CAAC;AAChD,SAAO,SAAS,GAAG,WAAW;AAChC;AAIA,eAAe,MAAM,UAAsC;AACzD,QAAM,IAAI,MAAM,OAAO,CAAC,MAAM,UAAU,OAAO,GAAG,QAAQ;AAC1D,SAAO,SAAS,GAAG,WAAW;AAChC;AAEA,eAAe,WAAW,UAAsC;AAC9D,QAAM,IAAI,MAAM,OAAO,CAAC,MAAM,UAAU,QAAQ,eAAe,WAAW,GAAG,QAAQ;AACrF,SAAO,SAAS,GAAG,gCAAgC;AACrD;AAQA,eAAe,OAAO,UAAuC;AAC3D,QAAM,UAAU;AAChB,QAAM,IAAI,MAAM,OAAO,CAAC,uBAAuB,MAAM,UAAU,UAAU,kBAAkB,UAAU,GAAG,QAAQ;AAChH,MAAI,EAAE,SAAS,EAAG,QAAO,EAAE,IAAI,OAAO,QAAQ,EAAE,QAAQ,QAAQ;AAChE,MAAI,SAAwB;AAC5B,MAAI,WAAW;AACf,MAAI,QAAQ;AACZ,aAAWG,SAAQ,EAAE,OAAO,MAAM,OAAO,GAAG;AAC1C,QAAIA,MAAK,WAAW,gBAAgB,GAAG;AACrC,YAAM,OAAOA,MAAK,MAAM,iBAAiB,MAAM,EAAE,KAAK;AACtD,eAAS,SAAS,eAAe,OAAO;AAAA,IAC1C,WAAWA,MAAK,WAAW,oBAAoB,GAAG;AAChD,iBAAW;AAAA,IACb,WAAWA,MAAK,WAAW,GAAG,GAAG;AAC/B;AAAA,IACF,WAAWA,MAAK,KAAK,EAAE,SAAS,GAAG;AACjC,cAAQ;AAAA,IACV;AAAA,EACF;AACA,SAAO,EAAE,IAAI,MAAM,OAAO,QAAQ,SAAS;AAC7C;AAEA,eAAe,YAAY,MAAqE;AAC9F,MAAI;AACF,WAAO,MAAMC,MAAK,IAAI;AAAA,EACxB,SAAS,KAAK;AACZ,QAAK,IAA8B,SAAS,SAAU,QAAO;AAC7D,UAAM,IAAI,UAAU,iBAAiB,kBAAkB,IAAI,IAAI,EAAE,OAAO,IAAI,CAAC;AAAA,EAC/E;AACF;AAEA,eAAe,QAAQJ,MAA+B;AACpD,QAAM,KAAK,MAAM,YAAYA,IAAG;AAChC,MAAI,CAAC,GAAI,QAAO,EAAE,QAAQ,OAAO,OAAO,OAAO,QAAQ,OAAO,SAAS,CAAC,EAAE;AAC1E,MAAI,CAAC,GAAG,YAAY,EAAG,QAAO,EAAE,QAAQ,MAAM,OAAO,OAAO,QAAQ,OAAO,SAAS,CAAC,EAAE;AACvF,MAAI;AACJ,MAAI;AACF,cAAU,MAAMK,SAAQL,IAAG;AAAA,EAC7B,SAAS,KAAK;AACZ,UAAM,IAAI,UAAU,iBAAiB,kBAAkBA,IAAG,IAAI,EAAE,OAAO,IAAI,CAAC;AAAA,EAC9E;AACA,QAAMM,SAAQ,QAAQ,WAAW;AACjC,QAAM,SAAU,MAAM,YAAYC,OAAKP,MAAK,MAAM,CAAC,MAAO;AAC1D,QAAM,aAAa,SAAS,MAAM,QAAQA,IAAG,IAAI,CAAC;AAClD,SAAO,EAAE,QAAQ,MAAM,OAAAM,QAAO,QAAQ,SAAS,WAAW;AAC5D;AAIO,IAAM,YAAiB,EAAE,SAAS,OAAO,OAAO,YAAY,QAAQ,QAAQ;;;ACtMnF,SAAS,aAAa;AAStB,IAAM,UAAU;AAChB,IAAM,QAAkD;AAAA,EACtD,OAAO;AAAA,EACP,QAAQ;AAAA,EACR,OAAO;AACT;AAEO,SAAS,sBAAsB,GAAY,UAAsC;AACtF,QAAM,MAAM,aAAa,QAAQ,EAAE,UAAU,OAAO,CAAC;AAGrD,MAAI,0CAA0C,KAAK,GAAG,GAAG;AACvD,WAAO,IAAI,UAAU,6BAA6B,sDAAsD;AAAA,MACtG,MAAM,aAAa,UACf,+FACA;AAAA,MACJ,OAAO;AAAA,IACT,CAAC;AAAA,EACH;AACA,MAAI,mDAAmD,KAAK,GAAG,GAAG;AAChE,WAAO,IAAI,UAAU,wBAAwB,wCAAwC;AAAA,MACnF,MAAM;AAAA,MAAiE,OAAO;AAAA,IAChF,CAAC;AAAA,EACH;AACA,SAAO,IAAI,UAAU,6BAA6B,yBAAyB;AAAA,IACzE,MAAM,MAAM,QAAQ,KAAK;AAAA,IAA+C,OAAO;AAAA,EACjF,CAAC;AACH;AAEO,IAAM,aAAN,MAAqC;AAAA,EAC1C,YAA6B,WAA4B,QAAQ,UAAU;AAA9C;AAAA,EAA+C;AAAA,EAA/C;AAAA,EAErB,KAAQ,IAAyB;AACvC,QAAI;AAAE,aAAO,QAAQ,QAAQ,GAAG,CAAC;AAAA,IAAE,SAAS,GAAG;AAAE,aAAO,QAAQ,OAAO,sBAAsB,GAAG,KAAK,QAAQ,CAAC;AAAA,IAAE;AAAA,EAClH;AAAA,EAEA,IAAI,SAAiB;AAAE,WAAO,KAAK,KAAK,MAAM,IAAI,MAAM,SAAS,OAAO,EAAE,YAAY,KAAK,IAAI;AAAA,EAAE;AAAA,EACjG,IAAI,SAAiB,OAAe;AAAE,WAAO,KAAK,KAAK,MAAM;AAAE,UAAI,MAAM,SAAS,OAAO,EAAE,YAAY,KAAK;AAAA,IAAE,CAAC;AAAA,EAAE;AAAA,EACjH,OAAO,SAAiB;AAEtB,WAAO,KAAK,KAAK,MAAM;AAAE,UAAI,MAAM,SAAS,OAAO,EAAE,eAAe;AAAA,IAAE,CAAC;AAAA,EACzE;AACF;;;ACnDA,SAAS,SAAAE,QAAO,aAAAC,kBAAiB;AACjC,SAAS,QAAAC,cAAY;AACrB,OAAO,cAAc;AAKd,SAAS,SAASC,MAAuB;AAC9C,SAAO,OAAO,MAAM,OAAO;AACzB,UAAM,QAAQC,OAAKD,MAAK,OAAO;AAC/B,UAAME,OAAM,OAAO,EAAE,WAAW,MAAM,MAAM,IAAM,CAAC;AACnD,UAAM,SAASD,OAAK,OAAO,GAAG,IAAI,OAAO;AACzC,UAAME,WAAU,QAAQ,IAAI,EAAE,MAAM,IAAI,CAAC;AACzC,QAAI;AAIJ,QAAI;AACJ,QAAI;AACF,gBAAU,MAAM,SAAS,KAAK,QAAQ;AAAA,QACpC,OAAO;AAAA,QACP,SAAS,EAAE,SAAS,IAAI,YAAY,KAAK,YAAY,KAAM,WAAW,KAAK;AAAA,QAC3E,eAAe,CAAC,QAAQ;AAAE,wBAAc;AAAA,QAAI;AAAA,MAC9C,CAAC;AAAA,IACH,SAAS,OAAO;AACd,YAAM,IAAI,UAAU,kBAAkB,kDAAkD,EAAE,MAAM,sBAAsB,MAAM,CAAC;AAAA,IAC/H;AACA,QAAI;AAAE,aAAO,MAAM,GAAG;AAAA,IAAE,UAAE;AAExB,YAAM,QAAQ,EAAE,MAAM,CAAC,MAAe;AAAE,YAAI,CAAC,YAAa,OAAM;AAAA,MAAE,CAAC;AAAA,IACrE;AAAA,EACF;AACF;;;AChCA,SAAS,OAAO,aAAa;AAEtB,SAAS,UAAU,KAAwB,UAA2B,MAAsB;AACjG,MAAI,aAAa,QAAS,QAAO,MAAM,KAAK,IAAI,WAAW,MAAM,KAAK,MAAM,WAAW,SAAS,GAAG,MAAM;AAGzG,MAAI,aAAa,SAAU,QAAO,MAAM,KAAK,MAAM,WAAW,uBAAuB,MAAM;AAE3F,QAAM,MAAM,IAAI,mBAAmB,MAAM,WAAW,IAAI,eAAe,IAAI,IAAI,kBAAkB;AACjG,SAAO,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,SAAS,GAAG,MAAM;AAC9D;;;ACVA,OAAO,WAAW;AAUX,SAAS,WAAW,UAAoF;AAC7G,SAAO,aAAa,UAChB,EAAE,QAAQ,CAAC,UAAU,UAAU,GAAG,SAAS,CAAC,EAAE,IAC9C,EAAE,QAAQ,CAAC,UAAU,SAAS,GAAG,SAAS,CAAC,WAAW,QAAQ,EAAE;AACtE;AAEA,IAAM,EAAE,QAAQ,QAAQ,SAAS,QAAQ,IAAI,WAAW,QAAQ,QAAQ;AAejE,SAAS,YAAY,SAAkB,MAA+B;AAC3E,SAAO;AAAA,IACL,IAAI,KAAK,MAAM,KAAK;AAClB,aAAO,IAAI,QAAQ,CAACC,UAAS,WAAW;AACtC,YAAI;AACJ,YAAI;AACF,kBAAQ,QAAQ,KAAK,MAAM,EAAE,OAAO,WAAW,OAAO,OAAO,KAAK,aAAa,KAAK,CAAC;AAAA,QACvF,SAAS,GAAG;AAIV,iBAAO,IAAI,UAAU,iBAAiB,mBAAmB,GAAG,KAAM,EAA4B,QAAQ,OAAO,EAAE,CAAC;AAChH;AAAA,QACF;AACA,cAAM,SAAS,MAAM;AAAA,QAAC;AACtB,cAAM,aAAa,QAAQ,IAAI,CAAC,QAAQ,CAAC,KAAK,MAAM;AAAE,gBAAM,KAAK,GAAG;AAAA,QAAE,CAAC,CAAU;AACjF,mBAAW,OAAO,OAAQ,MAAK,GAAG,KAAK,MAAM;AAC7C,mBAAW,CAAC,KAAK,EAAE,KAAK,WAAY,MAAK,GAAG,KAAK,EAAE;AACnD,cAAM,UAAU,MAAM;AACpB,qBAAW,OAAO,OAAQ,MAAK,IAAI,KAAK,MAAM;AAC9C,qBAAW,CAAC,KAAK,EAAE,KAAK,WAAY,MAAK,IAAI,KAAK,EAAE;AAAA,QACtD;AACA,cAAM,KAAK,SAAS,CAAC,MAA6B;AAChD,kBAAQ;AACR,iBAAO,EAAE,SAAS,WACd,IAAI,UAAU,iBAAiB,sBAAsB,GAAG,IAAI,EAAE,MAAM,uDAAuD,CAAC,IAC5H,IAAI,UAAU,iBAAiB,mBAAmB,GAAG,KAAK,EAAE,QAAQ,OAAO,EAAE,CAAC;AAAA,QACpF,CAAC;AACD,cAAM,KAAK,QAAQ,CAAC,MAAM,WAAW;AAAE,kBAAQ;AAAG,UAAAA,SAAQ,EAAE,MAAM,OAAO,CAAC;AAAA,QAAE,CAAC;AAAA,MAC/E,CAAC;AAAA,IACH;AAAA,EACF;AACF;AAEO,IAAM,eAAwB,YAAY,OAAO,OAAO;;;AC/DxD,IAAM,UAAkB,OAAuC,UAAmB;;;AtDgBzF,IAAI,QAAQ,IAAI,eAAe,QAAQ,IAAI,eAAe,QAAQ,IAAI,WAAY,qBAAoB,IAAI,kBAAkB,CAAC;AAE7H,IAAM,MAAM,UAAU,QAAQ,KAAK,QAAQ,UAAUC,SAAQ,CAAC;AAC9D,IAAM,OAAO,QAAQ,KAAK,MAAM,CAAC;AAGjC,IAAM,mBAAmB,oBAAoB,IAAI;AACjD,IAAM,OAAO,iBAAiB,SAAS,QAAQ;AAO/C,IAAM,KAAK,IAAI,gBAAgB;AAC/B,QAAQ,GAAG,UAAU,MAAM;AACzB,MAAI,GAAG,OAAO,SAAS;AACrB,QAAI,aAAa,QAAS;AAC1B,YAAQ,KAAK,GAAG;AAAA,EAClB;AACA,KAAG,MAAM;AACX,CAAC;AACD,IAAMC,SAAQ,eAAe,WAAW,OAAO,GAAG,MAAM;AACxD,IAAM,OAAa;AAAA,EACjB,OAAAA;AAAA,EACA,UAAU,IAAI,WAAW;AAAA,EACzB,QAAQ,IAAI,YAAY,GAAG;AAAA,EAC3B,UAAU,SAAS,GAAG;AAAA,EACtB,KAAK,MAAM,oBAAI,KAAK;AAAA,EACpB,SAAS,CAAC,WAAW,WAAW,EAAE,QAAQ,UAAU,YAAY,OAAAA,OAAM,CAAC;AAAA,EACvE,KAAK,QAAQ;AAAA,EACb,UAAU,QAAQ;AAAA,EAClB,SAAS;AAAA,EACT,KAAK,QAAQ,IAAI;AAAA,EACjB,MAAMD,SAAQ;AAAA,EACd,KAAK;AAAA,EACL,OAAO;AAAA,EACP,OAAO,CAAC,WAAW;AAAE,YAAQ,mBAAmB,MAAM;AAAG,YAAQ,KAAK,QAAQ,KAAK,MAAM;AAAA,EAAE;AAC7F;AACA,IAAM,KAAK,UAAU,cAAc;AAAA,EAAE,UAAU,QAAQ,QAAQ,MAAM,KAAK;AAAA,EAAG,WAAW,QAAQ,QAAQ,OAAO,KAAK;AAAA,EAClH;AAAA,EAAM,SAAS,iBAAiB,SAAS,YAAY;AAAA,EAAG,KAAK,QAAQ;AAAI,CAAC,CAAC;AAC7E,QAAQ,WAAW,MAAM,IAAI,MAAM,MAAM,IAAI,GAAG,QAAQ,QAAQ;AAChE,IAAI,CAAC,GAAG,OAAO,SAAS;AACtB,MAAI;AACF,UAAM,kBAAkB,MAAM,IAAI,EAAE,KAAK,CAAC;AAAA,EAC5C,QAAQ;AAAA,EAER;AACF;","names":["homedir","resolve","fetch","status","detail","pc","io","json","argv","line","deps","io","json","pc","join","relative","resolve","fetch","deps","deps","deps","deps","join","join","dir","TTL_MS","dir","join","sep","deps","join","strayRepos","dir","join","deps","dir","join","randomBytes","mkdir","readFile","rename","writeFile","join","UUID","dir","join","readFile","mkdir","randomBytes","writeFile","rename","deps","label","label","detail","io","json","deps","io","resolve","join","relative","randomBytes","chmod","readFile","realpath","rename","writeFile","basename","dirname","join","relative","readFile","join","invalid","readFile","join","join","relative","dirname","join","resolve","dir","UUID","remotes","deps","dir","relative","id","m","remote","join","deps","line","realpath","dirname","isAbsolute","relative","resolve","relative","isAbsolute","realpath","resolve","dirname","readFile","basename","randomBytes","join","dirname","writeFile","chmod","rename","deps","io","relative","realpath","status","deps","io","label","deps","io","deps","deps","io","line","lstat","join","relative","Option","asFailure","lstat","join","Option","deps","io","relative","deps","io","deps","io","label","deps","io","label","deps","io","readFile","join","dir","join","readFile","mkdir","readdir","stat","dirname","join","line","resolve","dir","mkdir","dirname","line","stat","readdir","empty","join","mkdir","writeFile","join","dir","join","mkdir","writeFile","resolve","homedir","fetch"]}