aibroker 0.13.0 → 0.14.0

package/dist/daemon/todoist-ingress.js

@@ -0,0 +1,101 @@
+/**
+ * daemon/todoist-ingress.ts — granting a project the right to reach a session.
+ *
+ * The allowlist began as one environment variable of opaque project ids, read
+ * once at daemon start. That is the wrong shape for something you change while
+ * using the system: creating a Todoist project and then editing a file and
+ * restarting a daemon is not a workflow anyone will follow, and a project that
+ * looks ready but routes nowhere fails exactly the way this codebase keeps
+ * trying to stop things failing — silently, with everything appearing fine.
+ *
+ * So grants live here too, in a store the daemon re-reads, and every change is
+ * an operation with an audit record rather than a file edit. The environment
+ * variable still works and still wins nothing: the two are merged, so an
+ * existing setup keeps behaving exactly as it did.
+ *
+ * What does NOT change is that the list stays explicit. A task filed into a
+ * project becomes an instruction a session runs with the user's full rights,
+ * and Todoist's payload documents that the initiator may be a collaborator on
+ * a shared project. Granting ingress must be a decision. It is now a decision
+ * that is recorded.
+ */
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { loadJson, saveJson } from "../core/json-store.js";
+import { audit } from "./audit.js";
+import { log } from "../core/log.js";
+const FILE = join(homedir(), ".aibroker", "todoist-ingress.json");
+function read() {
+    const r = loadJson(FILE);
+    if (r.status === "ok" && Array.isArray(r.data?.grants))
+        return r.data;
+    if (r.status === "unreadable") {
+        // Never rewrite a file we could not parse: an ingress list is a security
+        // boundary, and silently replacing it with an empty one is worse than
+        // refusing to add to it.
+        log(`todoist-ingress: ${FILE} is unreadable — grants from it are not in effect`);
+    }
+    return { grants: [] };
+}
+export function listGrants() {
+    return read().grants;
+}
+/** Grant a project the right to reach a session. Idempotent. */
+export function grantIngress(projectId, opts = {}) {
+    const s = read();
+    const existing = s.grants.find((g) => g.projectId === projectId);
+    const grant = existing ?? {
+        projectId,
+        grantedAt: new Date().toISOString(),
+    };
+    if (opts.owner !== undefined)
+        grant.owner = opts.owner;
+    if (opts.projectName !== undefined)
+        grant.projectName = opts.projectName;
+    if (!existing)
+        s.grants.push(grant);
+    saveJson(FILE, s);
+    audit({
+        action: "ingress", actor: "aibroker", target: `todoist:project:${projectId}`,
+        outcome: existing ? "updated" : "granted",
+        reason: `${opts.projectName ?? projectId} → ${grant.owner ?? "(default owner)"}`,
+    });
+    log(`todoist-ingress: ${existing ? "updated" : "granted"} ${opts.projectName ?? projectId} → ${grant.owner ?? "default"}`);
+    return grant;
+}
+/** Revoke a grant. Returns whether anything was there to revoke. */
+export function revokeIngress(projectId) {
+    const s = read();
+    const before = s.grants.length;
+    s.grants = s.grants.filter((g) => g.projectId !== projectId);
+    if (s.grants.length === before)
+        return false;
+    saveJson(FILE, s);
+    audit({
+        action: "ingress", actor: "aibroker", target: `todoist:project:${projectId}`,
+        outcome: "revoked",
+    });
+    log(`todoist-ingress: revoked ${projectId}`);
+    return true;
+}
+/**
+ * Merge stored grants into a config read from the environment.
+ *
+ * Called per request rather than at startup: the point of the store is that a
+ * grant takes effect when it is made, not when the daemon is next restarted.
+ * Returns a new object — the caller's config is never mutated.
+ */
+export function applyGrants(cfg) {
+    const grants = listGrants();
+    if (grants.length === 0)
+        return cfg;
+    const ids = new Set(cfg.ingressProjectIds);
+    const owners = new Map(cfg.projectOwners);
+    for (const g of grants) {
+        ids.add(g.projectId);
+        if (g.owner)
+            owners.set(g.projectId, g.owner);
+    }
+    return { ...cfg, ingressProjectIds: ids, projectOwners: owners };
+}
+//# sourceMappingURL=todoist-ingress.js.map

package/dist/daemon/todoist-ingress.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-ingress.js","sourceRoot":"","sources":["../../src/daemon/todoist-ingress.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAC3D,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AAGrC,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,sBAAsB,CAAC,CAAC;AAelE,SAAS,IAAI;IACX,MAAM,CAAC,GAAG,QAAQ,CAAQ,IAAI,CAAC,CAAC;IAChC,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,MAAM,CAAC;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IACtE,IAAI,CAAC,CAAC,MAAM,KAAK,YAAY,EAAE,CAAC;QAC9B,yEAAyE;QACzE,sEAAsE;QACtE,yBAAyB;QACzB,GAAG,CAAC,oBAAoB,IAAI,mDAAmD,CAAC,CAAC;IACnF,CAAC;IACD,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACxB,CAAC;AAED,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC;AACvB,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,YAAY,CAAC,SAAiB,EAAE,OAAiD,EAAE;IACjG,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IACjB,MAAM,QAAQ,GAAG,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IACjE,MAAM,KAAK,GAAiB,QAAQ,IAAI;QACtC,SAAS;QACT,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC;IACF,IAAI,IAAI,CAAC,KAAK,KAAK,SAAS;QAAE,KAAK,CAAC,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC;IACvD,IAAI,IAAI,CAAC,WAAW,KAAK,SAAS;QAAE,KAAK,CAAC,WAAW,GAAG,IAAI,CAAC,WAAW,CAAC;IACzE,IAAI,CAAC,QAAQ;QAAE,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACpC,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAElB,KAAK,CAAC;QACJ,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,SAAS,EAAE;QAC5E,OAAO,EAAE,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS;QACzC,MAAM,EAAE,GAAG,IAAI,CAAC,WAAW,IAAI,SAAS,MAAM,KAAK,CAAC,KAAK,IAAI,iBAAiB,EAAE;KACjF,CAAC,CAAC;IACH,GAAG,CAAC,oBAAoB,QAAQ,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,SAAS,IAAI,IAAI,CAAC,WAAW,IAAI,SAAS,MAAM,KAAK,CAAC,KAAK,IAAI,SAAS,EAAE,CAAC,CAAC;IAC3H,OAAO,KAAK,CAAC;AACf,CAAC;AAED,oEAAoE;AACpE,MAAM,UAAU,aAAa,CAAC,SAAiB;IAC7C,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IACjB,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC;IAC/B,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC;IAC7D,IAAI,CAAC,CAAC,MAAM,CAAC,MAAM,KAAK,MAAM;QAAE,OAAO,KAAK,CAAC;IAC7C,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;IAClB,KAAK,CAAC;QACJ,MAAM,EAAE,SAAS,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,EAAE,mBAAmB,SAAS,EAAE;QAC5E,OAAO,EAAE,SAAS;KACnB,CAAC,CAAC;IACH,GAAG,CAAC,4BAA4B,SAAS,EAAE,CAAC,CAAC;IAC7C,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CAAC,GAAkB;IAC5C,MAAM,MAAM,GAAG,UAAU,EAAE,CAAC;IAC5B,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,GAAG,CAAC;IAEpC,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC3C,MAAM,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,aAAa,CAAC,CAAC;IAC1C,KAAK,MAAM,CAAC,IAAI,MAAM,EAAE,CAAC;QACvB,GAAG,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC;QACrB,IAAI,CAAC,CAAC,KAAK;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,SAAS,EAAE,CAAC,CAAC,KAAK,CAAC,CAAC;IAChD,CAAC;IACD,OAAO,EAAE,GAAG,GAAG,EAAE,iBAAiB,EAAE,GAAG,EAAE,aAAa,EAAE,MAAM,EAAE,CAAC;AACnE,CAAC"}

package/dist/daemon/todoist-oauth.d.ts

@@ -0,0 +1,69 @@
+/**
+ * daemon/todoist-oauth.ts — the OAuth landing the redirect URL actually needs.
+ *
+ * Todoist does not deliver webhooks to the account that created the app. The
+ * app has to be authorised like any third party would authorise it, and the
+ * console's "install for myself" button does not do that — only a completed
+ * OAuth round trip does. Todoist's own guidance is to run the flow by hand and
+ * lift the `code` out of the address bar with developer tools, then exchange it
+ * from a separate HTTP client because the exchange has to be a POST.
+ *
+ * That instruction is a description of a missing endpoint. The redirect URL is
+ * ours; if it serves nothing, the browser lands on a 404 and the human has to
+ * play proxy for a machine-to-machine step. So we serve it: this module takes
+ * the `code` off the redirect, does the token exchange itself, stores the token
+ * and reports what happened — on the page and in the audit trail.
+ *
+ * The state parameter is not decoration. `aibroker todoist auth` mints one and
+ * records it; a callback that cannot present it is refused, because otherwise
+ * anyone who can reach the redirect can drive a code of their choosing into
+ * this exchange.
+ */
+/** Anything Todoist hands back on a successful exchange, plus when we got it. */
+export interface StoredToken {
+    access_token: string;
+    token_type: string;
+    scope?: string;
+    obtained_at: string;
+}
+/** Mint and record the state for one authorisation attempt. */
+export declare function beginAuth(): string;
+/**
+ * Check a callback's state against the recorded one and consume it.
+ *
+ * Returns a reason when it does not hold up, so the caller can say precisely
+ * what was wrong rather than "invalid request".
+ */
+export declare function consumeState(got: string | null): {
+    ok: true;
+} | {
+    ok: false;
+    reason: string;
+};
+export declare function loadToken(): StoredToken | null;
+export declare function saveToken(t: StoredToken): void;
+/** Build the URL a browser has to visit to authorise the app. */
+export declare function authorizeUrl(clientId: string, scope: string, state: string): string;
+/**
+ * Trade the authorisation code for a token.
+ *
+ * Kept separate from the request handler so the exchange can be tested and so
+ * the secret is used in exactly one place.
+ */
+export declare function exchangeCode(clientId: string, clientSecret: string, code: string, fetchImpl?: typeof fetch): Promise<StoredToken>;
+export interface OAuthDeps {
+    clientId?: string;
+    clientSecret: string;
+    fetchImpl?: typeof fetch;
+}
+/**
+ * Handle the redirect Todoist sends the browser to.
+ *
+ * Always answers with a readable page — this is the one endpoint here a human
+ * looks at directly, and "404" taught the last person to debug it nothing.
+ */
+export declare function handleOAuthCallback(url: URL, deps: OAuthDeps): Promise<{
+    status: number;
+    html: string;
+}>;
+//# sourceMappingURL=todoist-oauth.d.ts.map

package/dist/daemon/todoist-oauth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-oauth.d.ts","sourceRoot":"","sources":["../../src/daemon/todoist-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAaH,iFAAiF;AACjF,MAAM,WAAW,WAAW;IAC1B,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;CACrB;AA4BD,+DAA+D;AAC/D,wBAAgB,SAAS,IAAI,MAAM,CAIlC;AAED;;;;;GAKG;AACH,wBAAgB,YAAY,CAAC,GAAG,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,EAAE,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAU7F;AAED,wBAAgB,SAAS,IAAI,WAAW,GAAG,IAAI,CAE9C;AAED,wBAAgB,SAAS,CAAC,CAAC,EAAE,WAAW,GAAG,IAAI,CAE9C;AAED,iEAAiE;AACjE,wBAAgB,YAAY,CAAC,QAAQ,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,MAAM,CAGnF;AAED;;;;;GAKG;AACH,wBAAsB,YAAY,CAChC,QAAQ,EAAE,MAAM,EAChB,YAAY,EAAE,MAAM,EACpB,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,WAAW,CAAC,CAwBtB;AAgBD,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,OAAO,KAAK,CAAC;CAC1B;AAED;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,GAAG,EAAE,GAAG,EACR,IAAI,EAAE,SAAS,GACd,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC,CAoD3C"}

package/dist/daemon/todoist-oauth.js

@@ -0,0 +1,182 @@
+/**
+ * daemon/todoist-oauth.ts — the OAuth landing the redirect URL actually needs.
+ *
+ * Todoist does not deliver webhooks to the account that created the app. The
+ * app has to be authorised like any third party would authorise it, and the
+ * console's "install for myself" button does not do that — only a completed
+ * OAuth round trip does. Todoist's own guidance is to run the flow by hand and
+ * lift the `code` out of the address bar with developer tools, then exchange it
+ * from a separate HTTP client because the exchange has to be a POST.
+ *
+ * That instruction is a description of a missing endpoint. The redirect URL is
+ * ours; if it serves nothing, the browser lands on a 404 and the human has to
+ * play proxy for a machine-to-machine step. So we serve it: this module takes
+ * the `code` off the redirect, does the token exchange itself, stores the token
+ * and reports what happened — on the page and in the audit trail.
+ *
+ * The state parameter is not decoration. `aibroker todoist auth` mints one and
+ * records it; a callback that cannot present it is refused, because otherwise
+ * anyone who can reach the redirect can drive a code of their choosing into
+ * this exchange.
+ */
+import { randomBytes } from "node:crypto";
+import { chmodSync, mkdirSync, readFileSync, writeFileSync, existsSync, unlinkSync } from "node:fs";
+import { homedir } from "node:os";
+import { join } from "node:path";
+import { log } from "../core/log.js";
+import { audit } from "./audit.js";
+const STATE_DIR = join(homedir(), ".aibroker");
+const TOKEN_FILE = join(STATE_DIR, "todoist-oauth.json");
+const PENDING_FILE = join(STATE_DIR, "todoist-oauth-pending.json");
+/** A pending authorisation is only good for one attempt, and not for long. */
+const PENDING_TTL_MS = 15 * 60 * 1000;
+function writePrivate(file, data) {
+    mkdirSync(STATE_DIR, { recursive: true });
+    writeFileSync(file, JSON.stringify(data, null, 2), "utf-8");
+    // The token is a bearer credential for the whole account. Group and world
+    // have no business reading it, and the default umask is not a guarantee.
+    chmodSync(file, 0o600);
+}
+function readJson(file) {
+    if (!existsSync(file))
+        return null;
+    try {
+        return JSON.parse(readFileSync(file, "utf-8"));
+    }
+    catch {
+        // A corrupt file is not a reason to erase it — see core/json-store.
+        return null;
+    }
+}
+/** Mint and record the state for one authorisation attempt. */
+export function beginAuth() {
+    const state = randomBytes(16).toString("hex");
+    writePrivate(PENDING_FILE, { state, created_at: new Date().toISOString() });
+    return state;
+}
+/**
+ * Check a callback's state against the recorded one and consume it.
+ *
+ * Returns a reason when it does not hold up, so the caller can say precisely
+ * what was wrong rather than "invalid request".
+ */
+export function consumeState(got) {
+    const pending = readJson(PENDING_FILE);
+    if (!pending)
+        return { ok: false, reason: "no authorisation is in progress — run `aibroker todoist auth` first" };
+    if (Date.now() - Date.parse(pending.created_at) > PENDING_TTL_MS) {
+        unlinkSync(PENDING_FILE);
+        return { ok: false, reason: "the authorisation attempt expired — run `aibroker todoist auth` again" };
+    }
+    if (!got || got !== pending.state)
+        return { ok: false, reason: "state did not match the pending authorisation" };
+    unlinkSync(PENDING_FILE);
+    return { ok: true };
+}
+export function loadToken() {
+    return readJson(TOKEN_FILE);
+}
+export function saveToken(t) {
+    writePrivate(TOKEN_FILE, t);
+}
+/** Build the URL a browser has to visit to authorise the app. */
+export function authorizeUrl(clientId, scope, state) {
+    const q = new URLSearchParams({ client_id: clientId, scope, state });
+    return `https://todoist.com/oauth/authorize?${q.toString()}`;
+}
+/**
+ * Trade the authorisation code for a token.
+ *
+ * Kept separate from the request handler so the exchange can be tested and so
+ * the secret is used in exactly one place.
+ */
+export async function exchangeCode(clientId, clientSecret, code, fetchImpl = fetch) {
+    const res = await fetchImpl("https://todoist.com/oauth/access_token", {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body: new URLSearchParams({ client_id: clientId, client_secret: clientSecret, code }).toString(),
+    });
+    const text = await res.text();
+    if (!res.ok)
+        throw new Error(`token exchange returned ${res.status}: ${text.slice(0, 200)}`);
+    let body;
+    try {
+        body = JSON.parse(text);
+    }
+    catch {
+        throw new Error(`token exchange returned unparseable body: ${text.slice(0, 200)}`);
+    }
+    if (body.error)
+        throw new Error(`token exchange refused: ${body.error}`);
+    if (!body.access_token)
+        throw new Error("token exchange returned no access_token");
+    return {
+        access_token: body.access_token,
+        token_type: body.token_type ?? "Bearer",
+        scope: body.scope,
+        obtained_at: new Date().toISOString(),
+    };
+}
+function page(title, detail, ok) {
+    const accent = ok ? "#2d7a4b" : "#a33";
+    return `<!doctype html><meta charset="utf-8"><title>${title}</title>
+<style>
+ body{font:16px/1.5 -apple-system,system-ui,sans-serif;margin:0;display:grid;place-items:center;height:100vh;background:#faf9f7;color:#1a1a1a}
+ main{max-width:34rem;padding:2rem}
+ h1{font-size:1.3rem;margin:0 0 .6rem;color:${accent}}
+ p{margin:.4rem 0;color:#444}
+ code{background:#eee;padding:.1rem .3rem;border-radius:3px;font-size:.9em}
+ @media(prefers-color-scheme:dark){body{background:#141414;color:#eee}p{color:#bbb}code{background:#2a2a2a}}
+</style>
+<main><h1>${title}</h1><p>${detail}</p></main>`;
+}
+/**
+ * Handle the redirect Todoist sends the browser to.
+ *
+ * Always answers with a readable page — this is the one endpoint here a human
+ * looks at directly, and "404" taught the last person to debug it nothing.
+ */
+export async function handleOAuthCallback(url, deps) {
+    const fail = (status, title, detail, reason) => {
+        audit({ action: "todoist-oauth", actor: "todoist", target: "aibroker", outcome: "failed", reason });
+        log(`todoist-oauth: ${reason}`);
+        return { status, html: page(title, detail, false) };
+    };
+    const denied = url.searchParams.get("error");
+    if (denied) {
+        return fail(400, "Authorisation declined", `Todoist reported <code>${denied}</code>. Nothing was changed.`, `authorisation declined by Todoist: ${denied}`);
+    }
+    const code = url.searchParams.get("code");
+    if (!code) {
+        return fail(400, "Nothing to exchange", "This is the OAuth landing for the AIBroker Todoist bridge. It expects a <code>code</code> from Todoist; " +
+            "opening it directly does nothing. Start with <code>aibroker todoist auth</code>.", "callback carried no code");
+    }
+    if (!deps.clientId) {
+        return fail(500, "Not configured", "Set <code>TODOIST_CLIENT_ID</code> in <code>~/.aibroker/env</code> and restart the daemon — " +
+            "the exchange cannot be made without it.", "TODOIST_CLIENT_ID is not set");
+    }
+    const state = consumeState(url.searchParams.get("state"));
+    if (!state.ok) {
+        return fail(400, "Unexpected callback", state.reason, `state check failed: ${state.reason}`);
+    }
+    try {
+        const token = await exchangeCode(deps.clientId, deps.clientSecret, code, deps.fetchImpl);
+        saveToken(token);
+        audit({
+            action: "todoist-oauth", actor: "todoist", target: "aibroker", outcome: "authorized",
+            // The token itself is never recorded — only that one was obtained, and for what.
+            meta: { scope: token.scope },
+        });
+        log(`todoist-oauth: authorised, scope ${token.scope ?? "(unreported)"}`);
+        return {
+            status: 200,
+            html: page("Authorised", `AIBroker can now act on this Todoist account${token.scope ? ` with <code>${token.scope}</code>` : ""}. ` +
+                "Webhooks will be delivered from now on. You can close this tab.", true),
+        };
+    }
+    catch (err) {
+        const reason = err instanceof Error ? err.message : String(err);
+        return fail(502, "Exchange failed", reason, reason);
+    }
+}
+//# sourceMappingURL=todoist-oauth.js.map

package/dist/daemon/todoist-oauth.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-oauth.js","sourceRoot":"","sources":["../../src/daemon/todoist-oauth.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,SAAS,EAAE,SAAS,EAAE,YAAY,EAAE,aAAa,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AACpG,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,GAAG,EAAE,MAAM,gBAAgB,CAAC;AACrC,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AAEnC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,CAAC,CAAC;AAC/C,MAAM,UAAU,GAAG,IAAI,CAAC,SAAS,EAAE,oBAAoB,CAAC,CAAC;AACzD,MAAM,YAAY,GAAG,IAAI,CAAC,SAAS,EAAE,4BAA4B,CAAC,CAAC;AAenE,8EAA8E;AAC9E,MAAM,cAAc,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC;AAEtC,SAAS,YAAY,CAAC,IAAY,EAAE,IAAa;IAC/C,SAAS,CAAC,SAAS,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC1C,aAAa,CAAC,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IAC5D,0EAA0E;IAC1E,yEAAyE;IACzE,SAAS,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;AACzB,CAAC;AAED,SAAS,QAAQ,CAAI,IAAY;IAC/B,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAAE,OAAO,IAAI,CAAC;IACnC,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,EAAE,OAAO,CAAC,CAAM,CAAC;IACtD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;QACpE,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,+DAA+D;AAC/D,MAAM,UAAU,SAAS;IACvB,MAAM,KAAK,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAC9C,YAAY,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,UAAU,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE,EAAoB,CAAC,CAAC;IAC9F,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,YAAY,CAAC,GAAkB;IAC7C,MAAM,OAAO,GAAG,QAAQ,CAAU,YAAY,CAAC,CAAC;IAChD,IAAI,CAAC,OAAO;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,qEAAqE,EAAE,CAAC;IAClH,IAAI,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,cAAc,EAAE,CAAC;QACjE,UAAU,CAAC,YAAY,CAAC,CAAC;QACzB,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,uEAAuE,EAAE,CAAC;IACxG,CAAC;IACD,IAAI,CAAC,GAAG,IAAI,GAAG,KAAK,OAAO,CAAC,KAAK;QAAE,OAAO,EAAE,EAAE,EAAE,KAAK,EAAE,MAAM,EAAE,+CAA+C,EAAE,CAAC;IACjH,UAAU,CAAC,YAAY,CAAC,CAAC;IACzB,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,CAAC;AACtB,CAAC;AAED,MAAM,UAAU,SAAS;IACvB,OAAO,QAAQ,CAAc,UAAU,CAAC,CAAC;AAC3C,CAAC;AAED,MAAM,UAAU,SAAS,CAAC,CAAc;IACtC,YAAY,CAAC,UAAU,EAAE,CAAC,CAAC,CAAC;AAC9B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,YAAY,CAAC,QAAgB,EAAE,KAAa,EAAE,KAAa;IACzE,MAAM,CAAC,GAAG,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC;IACrE,OAAO,uCAAuC,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC;AAC/D,CAAC;AAED;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,YAAY,CAChC,QAAgB,EAChB,YAAoB,EACpB,IAAY,EACZ,YAA0B,KAAK;IAE/B,MAAM,GAAG,GAAG,MAAM,SAAS,CAAC,wCAAwC,EAAE;QACpE,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,mCAAmC,EAAE;QAChE,IAAI,EAAE,IAAI,eAAe,CAAC,EAAE,SAAS,EAAE,QAAQ,EAAE,aAAa,EAAE,YAAY,EAAE,IAAI,EAAE,CAAC,CAAC,QAAQ,EAAE;KACjG,CAAC,CAAC;IACH,MAAM,IAAI,GAAG,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,CAAC,EAAE;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,GAAG,CAAC,MAAM,KAAK,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IAE7F,IAAI,IAAoF,CAAC;IACzF,IAAI,CAAC;QACH,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAgB,CAAC;IACzC,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,6CAA6C,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC;IACrF,CAAC;IACD,IAAI,IAAI,CAAC,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,2BAA2B,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC;IACzE,IAAI,CAAC,IAAI,CAAC,YAAY;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAEnF,OAAO;QACL,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,UAAU,EAAE,IAAI,CAAC,UAAU,IAAI,QAAQ;QACvC,KAAK,EAAE,IAAI,CAAC,KAAK;QACjB,WAAW,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACtC,CAAC;AACJ,CAAC;AAED,SAAS,IAAI,CAAC,KAAa,EAAE,MAAc,EAAE,EAAW;IACtD,MAAM,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,MAAM,CAAC;IACvC,OAAO,+CAA+C,KAAK;;;;8CAIf,MAAM;;;;;YAKxC,KAAK,WAAW,MAAM,aAAa,CAAC;AAChD,CAAC;AAQD;;;;;GAKG;AACH,MAAM,CAAC,KAAK,UAAU,mBAAmB,CACvC,GAAQ,EACR,IAAe;IAEf,MAAM,IAAI,GAAG,CAAC,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE;QAC7E,KAAK,CAAC,EAAE,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,EAAE,CAAC,CAAC;QACpG,GAAG,CAAC,kBAAkB,MAAM,EAAE,CAAC,CAAC;QAChC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,IAAI,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,EAAE,CAAC;IACtD,CAAC,CAAC;IAEF,MAAM,MAAM,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;IAC7C,IAAI,MAAM,EAAE,CAAC;QACX,OAAO,IAAI,CAAC,GAAG,EAAE,wBAAwB,EAAE,0BAA0B,MAAM,+BAA+B,EACxG,sCAAsC,MAAM,EAAE,CAAC,CAAC;IACpD,CAAC;IAED,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IAC1C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,IAAI,CAAC,GAAG,EAAE,qBAAqB,EACpC,0GAA0G;YAC1G,kFAAkF,EAClF,0BAA0B,CAAC,CAAC;IAChC,CAAC;IAED,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,CAAC;QACnB,OAAO,IAAI,CAAC,GAAG,EAAE,gBAAgB,EAC/B,8FAA8F;YAC9F,yCAAyC,EACzC,8BAA8B,CAAC,CAAC;IACpC,CAAC;IAED,MAAM,KAAK,GAAG,YAAY,CAAC,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC;IAC1D,IAAI,CAAC,KAAK,CAAC,EAAE,EAAE,CAAC;QACd,OAAO,IAAI,CAAC,GAAG,EAAE,qBAAqB,EAAE,KAAK,CAAC,MAAM,EAAE,uBAAuB,KAAK,CAAC,MAAM,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,IAAI,CAAC,YAAY,EAAE,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,CAAC;QACzF,SAAS,CAAC,KAAK,CAAC,CAAC;QACjB,KAAK,CAAC;YACJ,MAAM,EAAE,eAAe,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,YAAY;YACpF,iFAAiF;YACjF,IAAI,EAAE,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,EAAE;SAC7B,CAAC,CAAC;QACH,GAAG,CAAC,oCAAoC,KAAK,CAAC,KAAK,IAAI,cAAc,EAAE,CAAC,CAAC;QACzE,OAAO;YACL,MAAM,EAAE,GAAG;YACX,IAAI,EAAE,IAAI,CAAC,YAAY,EACrB,+CAA+C,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe,KAAK,CAAC,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,IAAI;gBACzG,iEAAiE,EAAE,IAAI,CAAC;SAC3E,CAAC;IACJ,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChE,OAAO,IAAI,CAAC,GAAG,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;IACtD,CAAC;AACH,CAAC"}

package/dist/daemon/todoist-owners.d.ts

@@ -0,0 +1,23 @@
+/**
+ * daemon/todoist-owners.ts — which session took which task.
+ *
+ * A comment on a task is a correction to work already in flight: "actually, do
+ * it this way", "that's wrong, try again". It has to reach the session holding
+ * that work, and re-deriving the owner from the parent's project and labels is
+ * not the same thing. The original may have been addressed in its title — "pai
+ * send me a mail" — while the comment says only "make it next month". Re-derive
+ * and the correction lands on whatever the project or the default says, which
+ * is a different session than the one that did the work.
+ *
+ * So the owner is remembered at delivery and preferred at comment time.
+ *
+ * Bounded and on disk: bounded because this is a cache, not a ledger, and on
+ * disk because the daemon restarts more often than a conversation ends.
+ */
+/** Record who took a task, so a later comment on it reaches the same session. */
+export declare function rememberOwner(taskId: string, owner: string): void;
+/** Who took this task, if we still know. */
+export declare function ownerOf(taskId: string): string | undefined;
+/** Test seam: forget everything. */
+export declare function forgetAllOwners(): void;
+//# sourceMappingURL=todoist-owners.d.ts.map

package/dist/daemon/todoist-owners.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-owners.d.ts","sourceRoot":"","sources":["../../src/daemon/todoist-owners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AA8BH,iFAAiF;AACjF,wBAAgB,aAAa,CAAC,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAUjE;AAED,4CAA4C;AAC5C,wBAAgB,OAAO,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAG1D;AAED,oCAAoC;AACpC,wBAAgB,eAAe,IAAI,IAAI,CAEtC"}

package/dist/daemon/todoist-owners.js

@@ -0,0 +1,60 @@
+/**
+ * daemon/todoist-owners.ts — which session took which task.
+ *
+ * A comment on a task is a correction to work already in flight: "actually, do
+ * it this way", "that's wrong, try again". It has to reach the session holding
+ * that work, and re-deriving the owner from the parent's project and labels is
+ * not the same thing. The original may have been addressed in its title — "pai
+ * send me a mail" — while the comment says only "make it next month". Re-derive
+ * and the correction lands on whatever the project or the default says, which
+ * is a different session than the one that did the work.
+ *
+ * So the owner is remembered at delivery and preferred at comment time.
+ *
+ * Bounded and on disk: bounded because this is a cache, not a ledger, and on
+ * disk because the daemon restarts more often than a conversation ends.
+ */
+import { join } from "node:path";
+import { homedir } from "node:os";
+import { loadJson, saveJson } from "../core/json-store.js";
+const FILE = join(homedir(), ".aibroker", "todoist-owners.json");
+/** Enough for any live conversation; old entries are not worth keeping. */
+const MAX = 500;
+function empty() {
+    return { order: [], owners: {} };
+}
+function read() {
+    const r = loadJson(FILE);
+    // An unreadable cache is not a reason to lose the daemon: start empty and
+    // let the next delivery repopulate it. Never erase the file on a parse error
+    // — that is the bug core/json-store exists to avoid.
+    if (r.status === "ok" && Array.isArray(r.data?.order) && r.data?.owners)
+        return r.data;
+    return empty();
+}
+/** Record who took a task, so a later comment on it reaches the same session. */
+export function rememberOwner(taskId, owner) {
+    if (!taskId || !owner)
+        return;
+    const s = read();
+    if (!(taskId in s.owners))
+        s.order.push(taskId);
+    s.owners[taskId] = owner;
+    while (s.order.length > MAX) {
+        const drop = s.order.shift();
+        if (drop)
+            delete s.owners[drop];
+    }
+    saveJson(FILE, s);
+}
+/** Who took this task, if we still know. */
+export function ownerOf(taskId) {
+    if (!taskId)
+        return undefined;
+    return read().owners[taskId];
+}
+/** Test seam: forget everything. */
+export function forgetAllOwners() {
+    saveJson(FILE, empty());
+}
+//# sourceMappingURL=todoist-owners.js.map

package/dist/daemon/todoist-owners.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-owners.js","sourceRoot":"","sources":["../../src/daemon/todoist-owners.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AAEH,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,OAAO,EAAE,MAAM,SAAS,CAAC;AAClC,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,uBAAuB,CAAC;AAE3D,MAAM,IAAI,GAAG,IAAI,CAAC,OAAO,EAAE,EAAE,WAAW,EAAE,qBAAqB,CAAC,CAAC;AAEjE,2EAA2E;AAC3E,MAAM,GAAG,GAAG,GAAG,CAAC;AAQhB,SAAS,KAAK;IACZ,OAAO,EAAE,KAAK,EAAE,EAAE,EAAE,MAAM,EAAE,EAAE,EAAE,CAAC;AACnC,CAAC;AAED,SAAS,IAAI;IACX,MAAM,CAAC,GAAG,QAAQ,CAAQ,IAAI,CAAC,CAAC;IAChC,0EAA0E;IAC1E,6EAA6E;IAC7E,qDAAqD;IACrD,IAAI,CAAC,CAAC,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC,IAAI,EAAE,MAAM;QAAE,OAAO,CAAC,CAAC,IAAI,CAAC;IACvF,OAAO,KAAK,EAAE,CAAC;AACjB,CAAC;AAED,iFAAiF;AACjF,MAAM,UAAU,aAAa,CAAC,MAAc,EAAE,KAAa;IACzD,IAAI,CAAC,MAAM,IAAI,CAAC,KAAK;QAAE,OAAO;IAC9B,MAAM,CAAC,GAAG,IAAI,EAAE,CAAC;IACjB,IAAI,CAAC,CAAC,MAAM,IAAI,CAAC,CAAC,MAAM,CAAC;QAAE,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAChD,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,KAAK,CAAC;IACzB,OAAO,CAAC,CAAC,KAAK,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;QAC5B,MAAM,IAAI,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,EAAE,CAAC;QAC7B,IAAI,IAAI;YAAE,OAAO,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAClC,CAAC;IACD,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC,CAAC;AACpB,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,OAAO,CAAC,MAAc;IACpC,IAAI,CAAC,MAAM;QAAE,OAAO,SAAS,CAAC;IAC9B,OAAO,IAAI,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;AAC/B,CAAC;AAED,oCAAoC;AACpC,MAAM,UAAU,eAAe;IAC7B,QAAQ,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AAC1B,CAAC"}

package/dist/daemon/todoist-reply.d.ts

@@ -0,0 +1,58 @@
+/**
+ * daemon/todoist-reply.ts — answering on the task you were asked from.
+ *
+ * A task arriving here is often a question, not a work order, and until now the
+ * answer went to a terminal the asker was not looking at. Filing from a watch
+ * and reading the reply at a desk is not a channel; it is two half channels.
+ *
+ * So a session answers on the task itself. The comment carries the agent mark,
+ * which `route()` already drops before anything else, so our own writes cannot
+ * come back as instructions.
+ *
+ * Deliberately does NOT complete the task. Completion is the human saying done
+ * — the same rule the receiver enforces on the way in — and a question whose
+ * answer you have not read yet is not done. Left open, the task keeps its place
+ * in the list with a comment indicator; completed, it vanishes from view and
+ * the answer with it.
+ */
+export interface ReplyResult {
+    commentId: string;
+    taskId: string;
+}
+/** What a comment event needs from its parent task to be routable at all. */
+export interface ParentTask {
+    content: string;
+    projectId: string;
+    labels: string[];
+}
+/**
+ * Fetch the task a comment belongs to.
+ *
+ * A `note:added` payload carries `item_id` and the comment text and nothing
+ * else — no project, no labels. Without them the security boundary cannot be
+ * evaluated, so a comment is unroutable until its parent is resolved. This is
+ * the lookup that makes replying-by-comment possible at all.
+ */
+export declare function fetchParentTask(taskId: string, fetchImpl?: typeof fetch): Promise<ParentTask>;
+/**
+ * Post a comment on a task as the agent.
+ *
+ * The mark is added here rather than trusted to callers: every path that can
+ * write to Todoist has to be echo-safe, and "remember the prefix" is not a
+ * safety mechanism.
+ */
+export declare function replyToTask(taskId: string, text: string, fetchImpl?: typeof fetch): Promise<ReplyResult>;
+/**
+ * How many OPEN tasks in this project share a title.
+ *
+ * Two tasks called the same thing are indistinguishable in a list, so a reply
+ * posted on one looks — to whoever is watching the other — exactly like being
+ * ignored. That cost two full rounds today: comment routing was working
+ * perfectly and the answers were landing on a sibling nobody was looking at.
+ * Being ignored and being answered elsewhere must not look the same.
+ *
+ * Returns 1 in the ordinary case (this task alone) and 0 when it cannot tell —
+ * a lookup failure must not invent a duplicate warning.
+ */
+export declare function countTasksWithTitle(projectId: string, title: string, fetchImpl?: typeof fetch): Promise<number>;
+//# sourceMappingURL=todoist-reply.d.ts.map

package/dist/daemon/todoist-reply.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"todoist-reply.d.ts","sourceRoot":"","sources":["../../src/daemon/todoist-reply.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAOH,MAAM,WAAW,WAAW;IAC1B,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,6EAA6E;AAC7E,MAAM,WAAW,UAAU;IACzB,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,EAAE,CAAC;CAClB;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,MAAM,EAAE,MAAM,EACd,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,UAAU,CAAC,CAqBrB;AAED;;;;;;GAMG;AACH,wBAAsB,WAAW,CAC/B,MAAM,EAAE,MAAM,EACd,IAAI,EAAE,MAAM,EACZ,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,WAAW,CAAC,CAiCtB;AAQD;;;;;;;;;;;GAWG;AACH,wBAAsB,mBAAmB,CACvC,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE,MAAM,EACb,SAAS,GAAE,OAAO,KAAa,GAC9B,OAAO,CAAC,MAAM,CAAC,CA4BjB"}