borgmcp 1.1.14 → 2.0.1

package/dist/config-utils.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"config-utils.js","sourceRoot":"","sources":["../src/config-utils.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,QAAQ,EAAE,MAAM,eAAe,CAAC;AACzC,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,EAAE,MAAM,IAAI,CAAC;AACpB,OAAO,IAAI,MAAM,MAAM,CAAC;AACxB,OAAO,EAAE,aAAa,EAAE,MAAM,KAAK,CAAC;AACpC,OAAO,EAAE,OAAO,EAAE,MAAM,MAAM,CAAC;AAC/B,OAAO,EACL,mBAAmB,EACnB,0BAA0B,EAC1B,mBAAmB,GACpB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,oBAAoB,EACpB,gBAAgB,EAChB,sBAAsB,EACtB,mBAAmB,GACpB,MAAM,gBAAgB,CAAC;AACxB,OAAO,EAAE,WAAW,EAAE,MAAM,mBAAmB,CAAC;AAEhD,kCAAkC;AAClC,MAAM,UAAU,GAAG,aAAa,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAClD,MAAM,SAAS,GAAG,OAAO,CAAC,UAAU,CAAC,CAAC;AAEtC,yEAAyE;AACzE,wEAAwE;AACxE,6CAA6C;AAC7C,MAAM,YAAY,GAAG,WAAW,CAAC,gBAAgB,EAAE,CAAC,CAAC;AACrD,MAAM,yBAAyB,GAAG,WAAW,CAAC,sBAAsB,EAAE,CAAC,CAAC;AACxE,MAAM,kBAAkB,GAAG,WAAW,CAAC,mBAAmB,EAAE,CAAC,CAAC;AAC9D,MAAM,UAAU,GAAG,oBAAoB,EAAE,CAAC;AAE1C;;;;;;;;GAQG;AACH,MAAM,kBAAkB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,cAAc,CAAC,CAAC;AACnE,MAAM,iBAAiB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,aAAa,CAAC,CAAC;AAC3E,MAAM,gBAAgB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,YAAY,CAAC,CAAC;AACzE,MAAM,oBAAoB,GAAG,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,UAAU,EAAE,eAAe,CAAC,CAAC;AAC7F,MAAM,eAAe,GAAG,MAAM,CAAC;AAE/B,SAAS,YAAY;IACnB,OAAO,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,eAAe,CAAC,CAAC;AAC7D,CAAC;AAED,SAAS,YAAY;IACnB,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;IACzB,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,QAAa;IAClC,MAAM,CAAC,GAAG,YAAY,EAAE,CAAC;IACzB,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACzE,CAAC;AAED,SAAS,YAAY,CAAC,CAAS;IAC7B,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,CAAC,CAAC;QAAE,OAAO,EAAE,CAAC;IACjC,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,CAAC,EAAE,OAAO,CAAC,CAAC;IACzC,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;QAAE,OAAO,EAAE,CAAC;IAC5B,OAAO,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;AAC1B,CAAC;AAED,SAAS,aAAa,CAAC,CAAS,EAAE,IAAS;IACzC,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IACnD,EAAE,CAAC,aAAa,CAAC,CAAC,EAAE,IAAI,CAAC,SAAS,CAAC,IAAI,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC;AACrE,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,mBAAmB;IACjC,OAAO,qBAAqB,CAAC,YAAY,EAAE,CAAC,CAAC;AAC/C,CAAC;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,0BAA0B,CAAC,WAAmB;IAC5D,OAAO,qBAAqB,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;AACvE,CAAC;AAED,gEAAgE;AAChE,MAAM,UAAU,mCAAmC,CAAC,WAAmB;IACrE,OAAO,4BAA4B,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,IAAI,CAAC,CAAC;AAC9E,CAAC;AAED,SAAS,mBAAmB,CAAC,WAAmB;IAC9C,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,SAAS,EAAE,qBAAqB,CAAC,CAAC;AAClE,CAAC;AAED,SAAS,qBAAqB,CAAC,YAAoB,EAAE,kBAAkB,GAAG,KAAK;IAC7E,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,qBAAqB,YAAY,KAAK,GAAG,CAAC,OAAO,wDAAwD,CAAC,CAAC;QACzH,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,YAAY,KAAK,EAAE,CAAC;IAEnC,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,sEAAsE;IACtE,sEAAsE;IACtE,gCAAgC;IAChC,OAAO,GAAG,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,OAAO,CAAC;IAE5E,IAAI,CAAC,cAAc,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,EAAE,YAAY,CAAC,EAAE,CAAC;QAC/D,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,IAAI,CAAC;YAC/B,OAAO,EAAE,GAAG;YACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,YAAY,EAAE,CAAC;SACpD,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,wEAAwE;IACxE,4EAA4E;IAC5E,0EAA0E;IAC1E,kDAAkD;IAClD,IAAI,kBAAkB,EAAE,CAAC;QACvB,MAAM,UAAU,GAAG,wBAAwB,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC;QACzE,IAAI,UAAU,EAAE,CAAC;YACf,QAAQ,CAAC,KAAK,CAAC,YAAY,GAAG,UAAU,CAAC;YACzC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,IAAI,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAE3B,aAAa,CAAC,YAAY,EAAE,QAAQ,CAAC,CAAC;IACtC,OAAO,IAAI,CAAC;AACd,CAAC;AAED,4EAA4E;AAC5E,gFAAgF;AAChF,SAAS,cAAc,CAAC,YAAoB,EAAE,QAAgB,EAAE,YAAoB;IAClF,MAAM,OAAO,GAAG,WAAW,CAAC,YAAY,CAAC,CAAC;IAC1C,IAAI,YAAY,KAAK,OAAO,IAAI,YAAY,KAAK,YAAY,IAAI,YAAY,KAAK,QAAQ;QAAE,OAAO,IAAI,CAAC;IACxG,yDAAyD;IACzD,iEAAiE;IACjE,oEAAoE;IACpE,mEAAmE;IACnE,IAAI,YAAY,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,YAAY,CAAC,QAAQ,CAAC,IAAI,QAAQ,EAAE,CAAC;QAAE,OAAO,IAAI,CAAC;IACvF,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;4DAS4D;AAC5D,SAAS,cAAc,CAAC,OAAe;IACrC,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC;IAE/C,qCAAqC;IACrC,IAAI,QAAQ,KAAK,eAAe;QAAE,OAAO,YAAY,CAAC;IACtD,IAAI,QAAQ,KAAK,iBAAiB;QAAE,OAAO,yBAAyB,CAAC;IACrE,IAAI,QAAQ,KAAK,cAAc;QAAE,OAAO,kBAAkB,CAAC;IAE3D,4EAA4E;IAC5E,2CAA2C;IAC3C,IAAI,OAAO,KAAK,YAAY,IAAI,QAAQ,KAAK,gBAAgB,EAAE;QAAE,OAAO,YAAY,CAAC;IACrF,IAAI,OAAO,KAAK,yBAAyB,IAAI,QAAQ,KAAK,sBAAsB,EAAE;QAAE,OAAO,yBAAyB,CAAC;IACrH,IAAI,OAAO,KAAK,kBAAkB,IAAI,QAAQ,KAAK,mBAAmB,EAAE;QAAE,OAAO,kBAAkB,CAAC;IAEpG,8EAA8E;IAC9E,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,CAAC,SAAS,CAAC,IAAI,QAAQ,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;QAChG,MAAM,IAAI,GAAG,QAAQ,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;QAC7C,IAAI,IAAI,KAAK,UAAU;YAAE,OAAO,YAAY,CAAC;QAC7C,IAAI,IAAI,KAAK,iBAAiB;YAAE,OAAO,yBAAyB,CAAC;QACjE,IAAI,IAAI,KAAK,cAAc;YAAE,OAAO,kBAAkB,CAAC;IACzD,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;GAKG;AACH,SAAS,yBAAyB,CAAC,OAAc;IAC/C,IAAI,OAAO,GAAG,KAAK,CAAC;IAEpB,iDAAiD;IACjD,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,SAAS;QAC3C,KAAK,MAAM,IAAI,IAAI,KAAK,CAAC,KAAK,EAAE,CAAC;YAC/B,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ;gBAAE,SAAS;YAC5E,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,SAAS,IAAI,IAAI,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;gBAC5C,IAAI,CAAC,OAAO,GAAG,SAAS,CAAC;gBACzB,OAAO,GAAG,IAAI,CAAC;YACjB,CAAC;QACH,CAAC;IACH,CAAC;IAED,2EAA2E;IAC3E,yEAAyE;IACzE,qEAAqE;IACrE,MAAM,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACzC,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,SAAS;QAC3C,MAAM,MAAM,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC;QAClC,KAAK,CAAC,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAS,EAAE,EAAE;YAC7C,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YAC/E,MAAM,SAAS,GAAG,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/C,IAAI,CAAC,SAAS;gBAAE,OAAO,IAAI,CAAC;YAC5B,IAAI,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAClC,OAAO,GAAG,IAAI,CAAC;gBACf,OAAO,KAAK,CAAC;YACf,CAAC;YACD,cAAc,CAAC,GAAG,CAAC,SAAS,CAAC,CAAC;YAC9B,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,MAAM;YAAE,OAAO,GAAG,IAAI,CAAC;IACpD,CAAC;IAED,wDAAwD;IACxD,KAAK,IAAI,CAAC,GAAG,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC,IAAI,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC7C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,CAAC,EAAE,KAAK,CAAC,IAAI,OAAO,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC;YACrB,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;IACH,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;uEAEuE;AACvE,SAAS,kBAAkB,CAAC,YAAoB,EAAE,SAAiB;IACjE,OAAO,YAAY,KAAK,SAAS,CAAC;AACpC,CAAC;AAED,MAAM,eAAe,GAAG,YAAY,CAAC;AACrC,MAAM,iBAAiB,GAAG,mBAAmB,CAAC;AAC9C,MAAM,cAAc,GAAG,gBAAgB,CAAC;AAExC,SAAS,cAAc,CAAC,OAAc,EAAE,OAAe;IACrD,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAU,EAAE,EAAE,CACjC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE;YAC1B,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1E,uEAAuE;YACvE,yEAAyE;YACzE,oEAAoE;YACpE,8DAA8D;YAC9D,IAAI,OAAO,KAAK,YAAY,IAAI,OAAO,KAAK,yBAAyB,IAAI,OAAO,KAAK,kBAAkB,EAAE,CAAC;gBACxG,OAAO,cAAc,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,OAAO,CAAC;YAC/C,CAAC;YACD,OAAO,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;QAC/B,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,6EAA6E;AAC7E,SAAS,uBAAuB,CAAC,OAAc,EAAE,OAAe;IAC9D,OAAO,OAAO,CAAC,IAAI,CAAC,CAAC,KAAU,EAAE,EAAE,CACjC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE;YAC1B,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1E,OAAO,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QAChD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED,SAAS,oBAAoB,CAAC,IAAS;IACrC,IAAI,IAAI,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,IAAI,EAAE,OAAO,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAChF,OAAO,cAAc,CAAC,IAAI,CAAC,OAAO,EAAE,iBAAiB,EAAE,sBAAsB,EAAE,CAAC,CAAC;AACnF,CAAC;AAED,SAAS,2BAA2B,CAAC,KAAU;IAC7C,OAAO,KAAK,EAAE,OAAO,KAAK,OAAO;QAC/B,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,MAAM,KAAK,CAAC;QACxB,kBAAkB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,yBAAyB,CAAC;QACrE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,WAAW,KAAK,IAAI,CAAC;AACxC,CAAC;AAED;;;;;GAKG;AACH,SAAS,wBAAwB,CAAC,OAAc;IAC9C,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,KAAU,EAAE,EAAE;QACxC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,IAAS,EAAE,EAAE;YAC1C,IAAI,oBAAoB,CAAC,IAAI,CAAC,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,OAAO,EAAE,yBAAyB,CAAC,EAAE,CAAC;gBAC/F,QAAQ,GAAG,IAAI,CAAC;gBAChB,OAAO,EAAE,GAAG,IAAI,EAAE,OAAO,EAAE,yBAAyB,EAAE,CAAC;YACzD,CAAC;YACD,OAAO,IAAI,CAAC;QACd,CAAC,CAAC,CAAC;QACH,OAAO,KAAK,KAAK,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC;IAC7D,CAAC,CAAC,CAAC;IAEH,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,CAChC,CAAC,KAAK,EAAE,KAAK,EAAE,EAAE,CAAC,KAAK,GAAG,CACxB,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAClF,EACD,CAAC,CACF,CAAC;IACF,IAAI,YAAY,KAAK,CAAC,IAAI,MAAM,CAAC,IAAI,CAAC,2BAA2B,CAAC,EAAE,CAAC;QACnE,OAAO,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;IAClC,CAAC;IAED,MAAM,mBAAmB,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC,KAAU,EAAE,EAAE;QACxD,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,CAAC,KAAK,CAAC,CAAC;QACjD,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAS,EAAE,EAAE,CAAC,CAAC,oBAAoB,CAAC,IAAI,CAAC,CAAC,CAAC;QAC7E,OAAO,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;IACvD,CAAC,CAAC,CAAC;IACH,mBAAmB,CAAC,IAAI,CAAC;QACvB,OAAO,EAAE,OAAO;QAChB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,yBAAyB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;KACpF,CAAC,CAAC;IACH,OAAO,mBAAmB,CAAC;AAC7B,CAAC;AAED,SAAS,4BAA4B,CAAC,YAAoB,EAAE,kBAAkB,GAAG,KAAK;IACpF,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,CAAC,YAAY,CAAC,CAAC;IACxC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,uBAAuB,CAAC,GAAG,EAAE,YAAY,CAAC;QAC/C,CAAC,CAAC,kBAAkB,IAAI,wBAAwB,CAAC,GAAG,CAAC,KAAK,IAAI,CAAC,CAAC;AACpE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,4BAA4B;IAC1C,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,EAAE,KAAK,EAAE,YAAY,CAAC;IAC1C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAU,EAAE,EAAE,CAC7B,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE;YAC1B,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1E,OAAO,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,YAAY,CAAC,CAAC;QACrD,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,gCAAgC;IAC9C,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,MAAM,GAAG,GAAG,QAAQ,EAAE,KAAK,EAAE,gBAAgB,CAAC;IAC9C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAU,EAAE,EAAE,CAC7B,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;QAC3B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE;YAC1B,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ;gBAAE,OAAO,KAAK,CAAC;YAC1E,OAAO,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,kBAAkB,CAAC,CAAC;QAC3D,CAAC,CAAC,CACH,CAAC;AACJ,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,sBAAsB;IACpC,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,YAAY;QAAE,OAAO,KAAK,CAAC;IAEjD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,YAAY,GAAG,QAAQ,CAAC,KAAK,CAAC,YAAY;SACtD,GAAG,CAAC,CAAC,KAAU,EAAE,EAAE;QAClB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE;YAC7C,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACzE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,eAAe,EAAE,YAAY,CAAC,CAAC;QACnE,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEjF,IAAI,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC;IACrC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,IAAI,OAAO;QAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,uBAAuB;IACrC,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,EAAE,CAAC;IAC5B,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,qBAAqB,YAAY,EAAE,KAAK,GAAG,CAAC,OAAO,qCAAqC,CAAC,CAAC;QACxG,OAAO,KAAK,CAAC;IACf,CAAC;IAED,QAAQ,CAAC,KAAK,KAAK,EAAE,CAAC;IACtB,QAAQ,CAAC,KAAK,CAAC,gBAAgB,KAAK,EAAE,CAAC;IAEvC,sEAAsE;IACtE,sEAAsE;IACtE,gCAAgC;IAChC,IAAI,OAAO,GAAG,yBAAyB,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,CAAC;IAEzE,IAAI,CAAC,uBAAuB,CAAC,QAAQ,CAAC,KAAK,CAAC,gBAAgB,EAAE,kBAAkB,CAAC,EAAE,CAAC;QAClF,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,IAAI,CAAC;YACnC,OAAO,EAAE,GAAG;YACZ,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,kBAAkB,EAAE,CAAC;SAC1D,CAAC,CAAC;QACH,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,IAAI,OAAO;QAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,0BAA0B;IACxC,IAAI,QAAa,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,YAAY,EAAE,CAAC;IAC5B,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;IACD,IAAI,CAAC,QAAQ,EAAE,KAAK,EAAE,gBAAgB;QAAE,OAAO,KAAK,CAAC;IAErD,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,QAAQ,CAAC,KAAK,CAAC,gBAAgB,GAAG,QAAQ,CAAC,KAAK,CAAC,gBAAgB;SAC9D,GAAG,CAAC,CAAC,KAAU,EAAE,EAAE;QAClB,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,MAAM,QAAQ,GAAG,KAAK,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAM,EAAE,EAAE;YAC7C,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ;gBAAE,OAAO,IAAI,CAAC;YACzE,OAAO,CAAC,cAAc,CAAC,CAAC,CAAC,OAAO,EAAE,cAAc,EAAE,kBAAkB,CAAC,CAAC;QACxE,CAAC,CAAC,CAAC;QACH,IAAI,QAAQ,CAAC,MAAM,KAAK,KAAK,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC;YAC3C,OAAO,GAAG,IAAI,CAAC;YACf,OAAO,EAAE,GAAG,KAAK,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC;QACvC,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC,CAAC;SACD,MAAM,CAAC,CAAC,KAAU,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,KAAK,CAAC,KAAK,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IAEjF,IAAI,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACjD,OAAO,QAAQ,CAAC,KAAK,CAAC,gBAAgB,CAAC;IACzC,CAAC;IACD,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QAC7C,OAAO,QAAQ,CAAC,KAAK,CAAC;IACxB,CAAC;IAED,IAAI,OAAO;QAAE,aAAa,CAAC,QAAQ,CAAC,CAAC;IACrC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,UAAU,qBAAqB,CACnC,aAAqB,kBAAkB;IAEvC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACxD,MAAM,OAAO,GAAI,MAAc,CAAC,UAAU,CAAC;QAC3C,IAAI,CAAC,OAAO,IAAI,OAAO,OAAO,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;YAAE,OAAO,KAAK,CAAC;QACpF,OAAO,eAAe,IAAI,OAAO,CAAC;IACpC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED,MAAM,UAAU,0BAA0B,CACxC,aAAqB,iBAAiB;IAEtC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,MAAM,aAAa,GAAG,gCAAgC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QAClE,MAAM,sBAAsB,GAAG,IAAI,MAAM,CACvC,QAAQ,mBAAmB,uBAAuB,EAClD,GAAG,CACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,kEAAkE;QAClE,yEAAyE;QACzE,0EAA0E;QAC1E,yBAAyB;QACzB,MAAM,2BAA2B,GAAG,IAAI,MAAM,CAC5C,QAAQ,0BAA0B,mBAAmB,EACrD,GAAG,CACJ,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;QACb,OAAO,aAAa,IAAI,CAAC,sBAAsB,IAAI,2BAA2B,CAAC,CAAC;IAClF,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa;IAC3B,qEAAqE;IACrE,uBAAuB;IACvB,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;AAC1C,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,YAAY;IAC1B,IAAI,CAAC;QACH,6EAA6E;QAC7E,IAAI,CAAC;YACH,QAAQ,CAAC,qCAAqC,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACvE,CAAC;QAAC,MAAM,CAAC;YACP,sCAAsC;QACxC,CAAC;QAED,uEAAuE;QACvE,+DAA+D;QAC/D,MAAM,OAAO,GAAG,oCAAoC,UAAU,CAAC,UAAU,CAAC,EAAE,CAAC;QAE7E,QAAQ,CAAC,OAAO,EAAE;YAChB,KAAK,EAAE,SAAS,EAAE,sBAAsB;YACxC,gEAAgE;YAChE,4DAA4D;YAC5D,GAAG,EAAE,OAAO,CAAC,GAAG;SACjB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;QAC7E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,6BAA6B,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAChE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,iBAAiB;IAC/B,IAAI,CAAC;QACH,IAAI,CAAC;YACH,QAAQ,CAAC,uBAAuB,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;QACzD,CAAC;QAAC,MAAM,CAAC;YACP,uCAAuC;QACzC,CAAC;QAED,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACxC,iEAAiE;QACjE,yEAAyE;QACzE,yDAAyD;QACzD,iEAAiE;QACjE,MAAM,cAAc,GAAG,mBAAmB,CAAC,OAAO,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;QACjE,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,uBAAuB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,QAAQ,CAAC,oBAAoB;YAC3B,YAAY;YACZ,UAAU,mBAAmB,QAAQ;YACrC,OAAO,UAAU,CAAC,UAAU,CAAC,EAAE,EAAE;YACjC,KAAK,EAAE,SAAS;YAChB,GAAG,EAAE,cAAc;SACpB,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,kDAAkD,CAAC,CAAC;QACtE,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IACzE,CAAC;AACH,CAAC;AAED,SAAS,UAAU,CAAC,KAAa;IAC/B,OAAO,IAAI,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,GAAG,CAAC;AAC7C,CAAC;AAED,SAAS,YAAY,CAAC,SAA8C,EAAE,OAAe,EAAE,UAAkD,EAAE;IACzI,IAAI,SAAc,CAAC;IACnB,IAAI,CAAC;QACH,SAAS,GAAG,YAAY,CAAC,gBAAgB,CAAC,CAAC;IAC7C,CAAC;IAAC,OAAO,GAAQ,EAAE,CAAC;QAClB,OAAO,CAAC,KAAK,CAAC,qBAAqB,gBAAgB,KAAK,GAAG,CAAC,OAAO,qCAAqC,CAAC,CAAC;QAC1G,OAAO,KAAK,CAAC;IACf,CAAC;IAED,SAAS,CAAC,KAAK,KAAK,EAAE,CAAC;IACvB,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,EAAE,CAAC;IAClC,MAAM,OAAO,GAAG,SAAS,CAAC,KAAK,CAAC,SAAS,CAAC,CAAC;IAC3C,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,OAAO,CAAC;QAAE,OAAO,KAAK,CAAC;IAE1C,sEAAsE;IACtE,sEAAsE;IACtE,gCAAgC;IAChC,IAAI,OAAO,GAAG,yBAAyB,CAAC,OAAO,CAAC,CAAC;IAEjD,IAAI,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,EAAE,CAAC;QAC/C,MAAM,KAAK,GAAQ;YACjB,KAAK,EAAE,CAAC,EAAE,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,CAAC;SACtC,CAAC;QACF,IAAI,OAAO,CAAC,OAAO;YAAE,KAAK,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QACrD,IAAI,OAAO,OAAO,CAAC,OAAO,KAAK,QAAQ;YAAE,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC;QAClF,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpB,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IACD,IAAI,OAAO;QAAE,aAAa,CAAC,gBAAgB,EAAE,SAAS,CAAC,CAAC;IACxD,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,YAAY,CAAC,cAAc,EAAE,YAAY,EAAE,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAChG,CAAC;AAED,MAAM,UAAU,4BAA4B;IAC1C,OAAO,YAAY,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC,CAAC;AAC/E,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,SAAuD,EACvD,OAAe,EACf,YAAoB,gBAAgB;IAEpC,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,CAAC;QACvC,MAAM,GAAG,GAAG,MAAM,EAAE,KAAK,EAAE,CAAC,SAAS,CAAC,CAAC;QACvC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,GAAG,CAAC;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,GAAG,CAAC,IAAI,CAAC,CAAC,KAAU,EAAE,EAAE,CAC7B,KAAK,CAAC,OAAO,CAAC,KAAK,EAAE,KAAK,CAAC;YAC3B,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAM,EAAE,EAAE;gBAC1B,IAAI,CAAC,EAAE,IAAI,KAAK,SAAS,IAAI,OAAO,CAAC,EAAE,OAAO,KAAK,QAAQ;oBAAE,OAAO,KAAK,CAAC;gBAC1E,IAAI,OAAO,KAAK,YAAY;oBAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAC5E,IAAI,OAAO,KAAK,kBAAkB;oBAAE,OAAO,kBAAkB,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;gBAClF,OAAO,CAAC,CAAC,OAAO,KAAK,OAAO,CAAC;YAC/B,CAAC,CAAC,CACH,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,iCAAiC,CAAC,YAAoB,gBAAgB;IACpF,OAAO,qBAAqB,CAAC,cAAc,EAAE,YAAY,EAAE,SAAS,CAAC,CAAC;AACxE,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,qCAAqC,CAAC,YAAoB,gBAAgB;IACxF,OAAO,qBAAqB,CAAC,kBAAkB,EAAE,kBAAkB,EAAE,SAAS,CAAC,CAAC;AAClF,CAAC;AAED,4EAA4E;AAE5E;;;;;;GAMG;AACH,MAAM,UAAU,6BAA6B,CAC3C,aAAqB,oBAAoB;IAEzC,IAAI,CAAC;QACH,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,UAAU,CAAC;YAAE,OAAO,KAAK,CAAC;QAC7C,MAAM,IAAI,GAAG,EAAE,CAAC,YAAY,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;QAClD,IAAI,CAAC,IAAI,CAAC,IAAI,EAAE;YAAE,OAAO,KAAK,CAAC;QAC/B,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QAChC,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QACxD,MAAM,UAAU,GAAI,MAAc,CAAC,GAAG,EAAE,IAAI,CAAC;QAC7C,IAAI,CAAC,UAAU,IAAI,OAAO,UAAU,KAAK,QAAQ;YAAE,OAAO,KAAK,CAAC;QAChE,OAAO,UAAU,CAAC,IAAI,KAAK,OAAO,CAAC;IACrC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,KAAK,CAAC;IACf,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,oBAAoB;IAClC,IAAI,CAAC;QACH,yEAAyE;QACzE,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,YAAY,CAAC;QACxC,MAAM,YAAY,GAAG,MAAM,CAAC,CAAC,CAAC,uBAAuB,UAAU,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;QAC/E,iEAAiE;QACjE,QAAQ,CACN,kGAAkG,YAAY,OAAO,UAAU,CAAC,UAAU,CAAC,EAAE,EAC7I,EAAE,KAAK,EAAE,SAAS,EAAE,CACrB,CAAC;IACJ,CAAC;IAAC,OAAO,KAAU,EAAE,CAAC;QACpB,IAAI,KAAK,CAAC,OAAO,EAAE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,CAAC;YACjD,MAAM,IAAI,KAAK,CAAC,wDAAwD,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;IAC5E,CAAC;AACH,CAAC"}

package/dist/config.d.ts

@@ -1,72 +1,109 @@
+import type { ServerCapability } from 'borgmcp-shared/protocol';
 import { type TokenBackend } from './token-store.js';
+export interface ServerCredentialRecord {
+    origin: string;
+    trustIdentity: string;
+    credential: string;
+    clientId?: string | null;
+    serverCapabilities?: ServerCapability[];
+}
+export interface ActiveServerCredentialRecord {
+    origin: string;
+    trustIdentity: string;
+    credential: string;
+    clientId: string | null;
+    serverCapabilities: ServerCapability[];
+}
+export interface PendingServerEnrollmentRecord {
+    origin: string;
+    trustIdentity: string;
+    invitation: string;
+    retryKey: string;
+    credential: string;
+    clientName?: string;
+}
+export interface PendingServerCubeCreationRecord {
+    origin: string;
+    trustIdentity: string;
+    clientId: string;
+    repositoryBinding: string;
+    retryKey: string;
+    name: string;
+    template: 'default';
+}
 /**
- * gh#860: is THIS process's selected persistent backend the OS keychain? The
- * runtime-fallback (auth.ts) gates on this so a keychain WRITE failure migrates
- * to file ONLY from the keychain — a write failure already on the file backend
- * is a real disk problem, not a locked keychain, and must NOT loop.
+ * S1 clean-slate local drone-session record. The client CSPRNG-generates the
+ * bearer and persists it PENDING (keyed by the stable per-seat attach identity
+ * origin+trustIdentity+cube+role — no drone id yet on first attach) BEFORE the
+ * attach request. The bearer digest is the sole server correlator, so a lost
+ * response is recovered by re-sending the exact same bearer. After a verified
+ * `created`/`reused` response the SAME record is enriched in place with the
+ * server-assigned drone/session identity — no generation, no rotation.
  */
-export declare function isUsingKeychainBackend(): Promise<boolean>;
 /**
- * gh#860: runtime fallback — re-point THIS process's persistent backend to the
- * encrypted-file backend after a keychain WRITE failure (the temporal #858 case:
- * keychain worked at setup, an aged background child later loses write access).
- * This is an in-memory, per-process switch — NOT a persisted setting: keychain
- * stays the default for every other install and the next fresh process re-probes.
- * The durable opt-in (BORG_TOKEN_STORE=file) is the persistent counterpart.
- *
- * ATOMIC (gh#860 SR HIGH 3bed8571): build the file backend, write ALL token
- * accounts to it, and commit the process backend switch (backendPromise) ONLY
- * after every write succeeds. On any write failure: best-effort roll back the
- * partial file write and DO NOT commit — the process stays on its current
- * (keychain) backend, so a failed migration can never SILENTLY leave the process
- * file-backed (obfuscation-grade) without the caller's at-rest warning, nor leave
- * a partial credential behind. Returns true iff the tokens are durably saved to
- * file (caller then warns about the at-rest tradeoff); false leaves the process
- * exactly as it was (caller falls back to #858's transient surface).
- *
- * The file backend is obfuscation-grade (token-crypto.ts) — weaker at-rest than
- * the keychain. On a true return the caller MUST surface that tradeoff.
- */
-export declare function migrateToFileBackendWithTokens(tokens: {
-    idToken: string;
-    expiresAt: number;
-    refreshToken?: string;
-}, deps?: {
-    fileBackend?: TokenBackend;
-}): Promise<boolean>;
-/** Test-only: force the memoized backend so migration atomicity is testable. */
-export declare function __setBackendForTest(backend: TokenBackend | null): void;
-/**
- * Store Google OAuth ID token securely in the selected backend.
- */
-export declare function storeIdToken(idToken: string, expiresAt: number): Promise<void>;
-/**
- * Store Google OAuth refresh token securely in the selected backend.
+ * The seat/sibling operation dimension for a pending session. Because the client
+ * bearer digest is the SOLE server correlator, distinct seats require distinct
+ * bearers; a deliberate sibling attach must therefore namespace its bearer apart
+ * from the durable in-place seat for the same (origin,trust,cube,role). Ported
+ * from the retired local-attach `operationBindingKey`. projectRoot is captured
+ * before a successful sibling attach changes cwd, so it is stable across the
+ * whole prepare→activate lifecycle.
  */
-export declare function storeRefreshToken(refreshToken: string): Promise<void>;
+export interface ServerSessionOperation {
+    projectRoot: string;
+    kind: 'seat' | 'sibling';
+    operationKey: string;
+}
+/** Test-only credential-store backend injection. */
+export declare function __setServerCredentialBackendForTest(backend: TokenBackend | null): void;
 /**
- * Retrieve the Google OAuth ID token.
+ * Persist one self-hosted server credential in the dedicated 0600 credential store.
  *
- * A caller-managed token (BORG_TOKEN / BORG_TOKEN_FILE) takes precedence and
- * is returned verbatim — the caller owns its freshness, so the expiry buffer
- * does not apply. Otherwise reads the persistent backend and returns null if
- * not stored or within the 5-minute expiry buffer.
- */
-export declare function getIdToken(): Promise<string | null>;
-/**
- * Retrieve the Google OAuth refresh token. There is no refresh_token in
- * caller-managed mode (the externally-supplied id_token has no refresh
- * counterpart), so this returns null whenever a caller-managed token is set.
- */
-export declare function getRefreshToken(): Promise<string | null>;
-/**
- * Clear all stored tokens from the selected backend. Idempotent — clearing
- * an already-empty store is a no-op. Does not touch caller-managed env vars
- * (those are the caller's to manage).
+ * The account key binds both the canonical authority origin and the verified
+ * server/CA identity. A credential enrolled for one authority is therefore
+ * never considered for another endpoint or trust anchor. Enrollment owns the
+ * write; command-line arguments and environment variables are intentionally
+ * not credential sources. CR3b: the load→set→rename runs inside ONE hold of the
+ * single store lock so a concurrent writer cannot lose an unrelated account.
  */
-export declare function clearTokens(): Promise<void>;
+export declare function storeServerCredential(record: ServerCredentialRecord): Promise<void>;
+/** Read an authority-bound active client record, failing closed on corruption. */
+export declare function getServerCredentialRecord(origin: string, trustIdentity: string): Promise<ActiveServerCredentialRecord | null>;
+/** Read only the bearer for existing call sites that do not need capability metadata. */
+export declare function getServerCredential(origin: string, trustIdentity: string): Promise<string | null>;
+/** Load an exact durable PENDING tuple so a new process can resume it. */
+export declare function getPendingServerEnrollment(origin: string, trustIdentity: string): Promise<PendingServerEnrollmentRecord | null>;
 /**
- * Check if user has valid authentication.
+ * Generate and persist an exact enrollment tuple before network I/O. A
+ * pre-existing PENDING tuple must match the invitation and presentation name;
+ * this makes response-loss retries exact without minting a second bearer.
  */
-export declare function isAuthenticated(): Promise<boolean>;
+export declare function getOrCreatePendingServerEnrollment(input: {
+    origin: string;
+    trustIdentity: string;
+    invitation: string;
+    clientName?: string;
+}): Promise<PendingServerEnrollmentRecord>;
+/** Activate the exact pending tuple only after a verified server response. */
+export declare function activatePendingServerEnrollment(input: {
+    origin: string;
+    trustIdentity: string;
+    retryKey: string;
+    credential: string;
+    clientId: string;
+    serverCapabilities: ServerCapability[];
+}): Promise<void>;
+/** Delete only the exact definitively rejected pending attempt. */
+export declare function clearPendingServerEnrollment(origin: string, trustIdentity: string, retryKey: string): Promise<void>;
+/** Persist one repository-scoped cube-create idempotency key in the 0600 credential store. */
+export declare function getOrCreatePendingServerCubeCreation(input: {
+    origin: string;
+    trustIdentity: string;
+    clientId: string;
+    projectRoot: string;
+    name: string;
+    template: 'default';
+}): Promise<PendingServerCubeCreationRecord>;
+export declare function clearPendingServerCubeCreation(record: PendingServerCubeCreationRecord): Promise<void>;
+export declare function clearServerCredential(origin: string, trustIdentity: string): Promise<void>;
 //# sourceMappingURL=config.d.ts.map

package/dist/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../src/config.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,yBAAyB,CAAC;AAEhE,OAAO,EAEL,KAAK,YAAY,EAClB,MAAM,kBAAkB,CAAC;AAY1B,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,kBAAkB,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACzC;AAED,MAAM,WAAW,4BAA4B;IAC3C,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;CACxC;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,+BAA+B;IAC9C,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,iBAAiB,EAAE,MAAM,CAAC;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,SAAS,CAAC;CACrB;AAED;;;;;;;;GAQG;AACH;;;;;;;;GAQG;AACH,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,YAAY,EAAE,MAAM,CAAC;CACtB;AA0HD,oDAAoD;AACpD,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,YAAY,GAAG,IAAI,GAAG,IAAI,CAEtF;AA+BD;;;;;;;;;GASG;AACH,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,sBAAsB,GAAG,OAAO,CAAC,IAAI,CAAC,CAGzF;AAED,kFAAkF;AAClF,wBAAsB,yBAAyB,CAC7C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAoC9C;AAED,yFAAyF;AACzF,wBAAsB,mBAAmB,CACvC,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAExB;AAmCD,0EAA0E;AAC1E,wBAAsB,0BAA0B,CAC9C,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,GACpB,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAa/C;AAED;;;;GAIG;AACH,wBAAsB,kCAAkC,CACtD,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,GACA,OAAO,CAAC,6BAA6B,CAAC,CA2CxC;AAED,8EAA8E;AAC9E,wBAAsB,+BAA+B,CACnD,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,kBAAkB,EAAE,gBAAgB,EAAE,CAAC;CACxC,GACA,OAAO,CAAC,IAAI,CAAC,CAkCf;AAED,mEAAmE;AACnE,wBAAsB,4BAA4B,CAChD,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,QAAQ,EAAE,MAAM,GACf,OAAO,CAAC,IAAI,CAAC,CAef;AAED,8FAA8F;AAC9F,wBAAsB,oCAAoC,CACxD,KAAK,EAAE;IACL,MAAM,EAAE,MAAM,CAAC;IACf,aAAa,EAAE,MAAM,CAAC;IACtB,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,SAAS,CAAC;CACrB,GACA,OAAO,CAAC,+BAA+B,CAAC,CAoE1C;AAED,wBAAsB,8BAA8B,CAClD,MAAM,EAAE,+BAA+B,GACtC,OAAO,CAAC,IAAI,CAAC,CAmBf;AAED,wBAAsB,qBAAqB,CAAC,MAAM,EAAE,MAAM,EAAE,aAAa,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAOhG"}

package/dist/config.js

@@ -1 +1,426 @@
-import k from"os";import y from"path";import{promises as r}from"fs";import{isKeyringAvailable as T}from"./auth-env.js";import{deriveMachineKey as g}from"./token-crypto.js";import{makeKeychainBackend as E,makeEncryptedFileBackend as x,selectTokenBackend as p,readCallerManagedIdToken as F}from"./token-store.js";const u="google-id-token",f="google-refresh-token",d="token-expiry";function v(){return y.join(k.homedir(),".borg","credentials")}const b={readFile:e=>r.readFile(e,"utf8"),writeFile:async(e,t,n)=>{await r.writeFile(e,t,{mode:n}),await r.chmod(e,n)},mkdir:async(e,t)=>{await r.mkdir(e,{recursive:!0,mode:t})},rename:(e,t)=>r.rename(e,t),createExclusive:async(e,t)=>{try{return await r.writeFile(e,t,{flag:"wx",mode:384}),!0}catch(n){if(n?.code==="EEXIST")return!1;throw n}},removeFile:async e=>{try{await r.unlink(e)}catch(t){if(t?.code!=="ENOENT")throw t}},fileAgeMs:async e=>{try{const t=await r.stat(e);return Date.now()-t.mtimeMs}catch(t){if(t?.code==="ENOENT")return null;throw t}}};function N(e){const t=e?.trim().toLowerCase();if(t==="keychain")return"keychain";if(t==="file"||t==="encrypted-file")return"file"}function w(e){return{keyringAvailable:()=>T(),makeKeychain:()=>E(),makeFile:()=>x({filePath:v(),key:g({hostname:k.hostname(),username:k.userInfo().username,platform:process.platform}),fs:b}),forced:e}}let c=null;function o(){return c||(c=p(w(N(process.env.BORG_TOKEN_STORE)))),c}async function S(){return(await o()).name==="keychain"}async function R(e,t={}){const n=t.fileBackend??await p(w("file")),i=[];e.refreshToken!==void 0&&i.push([f,e.refreshToken]),i.push([u,e.idToken]),i.push([d,e.expiresAt.toString()]);const s=[];try{for(const[a,l]of i){const h=await n.get(a);await n.set(a,l),s.push({account:a,prior:h})}}catch{for(const{account:a,prior:l}of s.reverse())try{l===null?await n.delete(a):await n.set(a,l)}catch{}return!1}return c=Promise.resolve(n),!0}function M(e){c=e?Promise.resolve(e):null}function m(){return F({env:process.env,readFile:e=>r.readFile(e,"utf8")})}async function P(e,t){const n=await o();await n.set(u,e),await n.set(d,t.toString())}async function D(e){await(await o()).set(f,e)}async function O(){const e=await m();if(e)return e;const t=await o(),n=await t.get(u),i=await t.get(d);if(!n||!i)return null;const s=parseInt(i,10),a=Date.now();return s-a<300*1e3?null:n}async function U(){return await m()?null:(await o()).get(f)}async function W(){const e=await o();await e.delete(u),await e.delete(f),await e.delete(d)}async function X(){return await O()!==null}export{M as __setBackendForTest,W as clearTokens,O as getIdToken,U as getRefreshToken,X as isAuthenticated,S as isUsingKeychainBackend,R as migrateToFileBackendWithTokens,P as storeIdToken,D as storeRefreshToken};
+/**
+ * Secure local-server credential storage.
+ *
+ * The self-hosted-server credential group (enrollment credentials, pending
+ * enrollment/cube-creation records, and the per-seat drone-session bearers)
+ * rests ONLY in the 0600 credential file store (Queen rescope) — parity with the
+ * server's own TLS private keys. The OS keychain is gone; the raw secret never
+ * leaves the 0600 file, and a single store flock serializes every read-compare-write.
+ */
+import os from 'os';
+import path from 'path';
+import { createHash, randomBytes, randomUUID } from 'crypto';
+import { withStoreLock } from './seat-store.js';
+import { makeFileBackend, } from './token-store.js';
+const SERVER_CREDENTIAL_RECORD_VERSION = 2;
+const SERVER_PENDING_ENROLLMENT_RECORD_VERSION = 1;
+const SERVER_CUBE_RETRY_RECORD_VERSION = 1;
+// The 0600 credential store (Queen rescope: replaces the OS keychain). A single
+// file holds every server credential/session/enrollment record; a single flock
+// serializes every mutator + observer that must (SR-seven #4).
+const CREDENTIALS_FILE = path.join(os.homedir(), '.config', 'borgmcp', 'credentials.json');
+const CREDENTIALS_LOCK = `${CREDENTIALS_FILE}.lock`;
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+function validateServerCredentialBinding(origin, trustIdentity) {
+    let parsed;
+    try {
+        parsed = new URL(origin);
+    }
+    catch {
+        throw new Error('invalid Borg server credential origin');
+    }
+    if (parsed.origin !== origin || parsed.protocol !== 'https:') {
+        throw new Error('Borg server credentials require a canonical HTTPS origin');
+    }
+    if (trustIdentity.length < 1 ||
+        trustIdentity.length > 512 ||
+        /[\u0000-\u001f\u007f]/.test(trustIdentity)) {
+        throw new Error('invalid Borg server trust identity');
+    }
+}
+function serverCredentialAccount(origin, trustIdentity) {
+    validateServerCredentialBinding(origin, trustIdentity);
+    const binding = createHash('sha256')
+        .update(origin)
+        .update('\0')
+        .update(trustIdentity)
+        .digest('hex');
+    return `borg-server-credential:${binding}`;
+}
+// The whole 0600 credential store is serialized by the SINGLE store lock
+// (seat-store.withStoreLock over CREDENTIALS_LOCK). Every mutator AND every
+// observer that must serialize runs its entire read-compare-write inside one
+// continuous hold, released on EVERY path incl throw (SR-seven #4). There is no
+// per-account lock and no compat shim — call sites acquire the store lock directly.
+function serverPendingEnrollmentAccount(origin, trustIdentity) {
+    validateServerCredentialBinding(origin, trustIdentity);
+    const binding = createHash('sha256')
+        .update(origin)
+        .update('\0')
+        .update(trustIdentity)
+        .digest('hex');
+    return `borg-server-enrollment-pending:${binding}`;
+}
+function validateUuid(value, label) {
+    if (!UUID_RE.test(value))
+        throw new Error(`invalid Borg server ${label}`);
+}
+function validateServerCapabilities(value) {
+    if (value.length > 1 || value.some((capability) => capability !== 'create_cube')) {
+        throw new Error('invalid Borg server capabilities');
+    }
+    return [...value];
+}
+function validateClientName(clientName) {
+    if (clientName !== undefined &&
+        (Buffer.byteLength(clientName, 'utf8') < 1 ||
+            Buffer.byteLength(clientName, 'utf8') > 120 ||
+            !/^[A-Za-z0-9][A-Za-z0-9 ._-]*$/.test(clientName))) {
+        throw new Error('invalid Borg server client name');
+    }
+}
+function validateInvitation(invitation) {
+    if (invitation.length < 43 ||
+        invitation.length > 1024 ||
+        !/^[A-Za-z0-9_-]+$/.test(invitation)) {
+        throw new Error('invalid Borg server invitation');
+    }
+}
+function validateEnrollmentCredential(credential) {
+    if (!/^[A-Za-z0-9_-]{43}$/.test(credential)) {
+        throw new Error('invalid Borg server credential');
+    }
+}
+function serverCubeRetryAccount(origin, trustIdentity, clientId, repositoryBinding) {
+    validateServerCredentialBinding(origin, trustIdentity);
+    validateUuid(clientId, 'client identity');
+    if (!/^[a-f0-9]{64}$/.test(repositoryBinding)) {
+        throw new Error('invalid Borg server repository binding');
+    }
+    const binding = createHash('sha256')
+        .update(origin)
+        .update('\0')
+        .update(trustIdentity)
+        .update('\0')
+        .update(clientId)
+        .update('\0')
+        .update(repositoryBinding)
+        .digest('hex');
+    return `borg-server-cube-pending:${binding}`;
+}
+// Local-server bearers rest ONLY in the 0600 credential store (Queen rescope —
+// parity with the server's TLS keys; no OS keychain, no obfuscation-grade
+// fallback). The single store lock (CREDENTIALS_LOCK) serializes the RCW.
+let serverCredentialBackendPromise = null;
+async function getServerCredentialBackend() {
+    if (!serverCredentialBackendPromise) {
+        serverCredentialBackendPromise = Promise.resolve(makeFileBackend(CREDENTIALS_FILE));
+    }
+    return serverCredentialBackendPromise;
+}
+/** Test-only credential-store backend injection. */
+export function __setServerCredentialBackendForTest(backend) {
+    serverCredentialBackendPromise = backend ? Promise.resolve(backend) : null;
+}
+/**
+ * CR3b: the UNLOCKED credential write body. Validates then set()s the account.
+ * Callers that ALREADY hold the credential-store lock (activatePendingServerEnrollment)
+ * invoke this directly so they do not re-acquire (and self-deadlock on) the single
+ * store lock; the public storeServerCredential wraps it in one lock hold.
+ */
+async function writeServerCredentialRecord(backend, record) {
+    validateServerCredentialBinding(record.origin, record.trustIdentity);
+    validateEnrollmentCredential(record.credential);
+    if (record.clientId !== undefined && record.clientId !== null) {
+        validateUuid(record.clientId, 'client identity');
+    }
+    const serverCapabilities = validateServerCapabilities(record.serverCapabilities ?? []);
+    await backend.set(serverCredentialAccount(record.origin, record.trustIdentity), JSON.stringify({
+        version: SERVER_CREDENTIAL_RECORD_VERSION,
+        origin: record.origin,
+        trustIdentity: record.trustIdentity,
+        credential: record.credential,
+        clientId: record.clientId ?? null,
+        serverCapabilities,
+    }));
+}
+/**
+ * Persist one self-hosted server credential in the dedicated 0600 credential store.
+ *
+ * The account key binds both the canonical authority origin and the verified
+ * server/CA identity. A credential enrolled for one authority is therefore
+ * never considered for another endpoint or trust anchor. Enrollment owns the
+ * write; command-line arguments and environment variables are intentionally
+ * not credential sources. CR3b: the load→set→rename runs inside ONE hold of the
+ * single store lock so a concurrent writer cannot lose an unrelated account.
+ */
+export async function storeServerCredential(record) {
+    const backend = await getServerCredentialBackend();
+    await withStoreLock(CREDENTIALS_LOCK, () => writeServerCredentialRecord(backend, record));
+}
+/** Read an authority-bound active client record, failing closed on corruption. */
+export async function getServerCredentialRecord(origin, trustIdentity) {
+    const backend = await getServerCredentialBackend();
+    const stored = await backend.get(serverCredentialAccount(origin, trustIdentity));
+    if (!stored)
+        return null;
+    try {
+        const record = JSON.parse(stored);
+        if (record.version !== SERVER_CREDENTIAL_RECORD_VERSION ||
+            record.origin !== origin ||
+            record.trustIdentity !== trustIdentity ||
+            typeof record.credential !== 'string' ||
+            !/^[A-Za-z0-9_-]{43}$/.test(record.credential) ||
+            (record.clientId !== null &&
+                (typeof record.clientId !== 'string' || !UUID_RE.test(record.clientId))) ||
+            !Array.isArray(record.serverCapabilities)) {
+            return null;
+        }
+        let serverCapabilities;
+        try {
+            serverCapabilities = validateServerCapabilities(record.serverCapabilities);
+        }
+        catch {
+            return null;
+        }
+        return {
+            origin,
+            trustIdentity,
+            credential: record.credential,
+            clientId: record.clientId,
+            serverCapabilities,
+        };
+    }
+    catch {
+        return null;
+    }
+}
+/** Read only the bearer for existing call sites that do not need capability metadata. */
+export async function getServerCredential(origin, trustIdentity) {
+    return (await getServerCredentialRecord(origin, trustIdentity))?.credential ?? null;
+}
+function decodePendingServerEnrollment(stored, origin, trustIdentity) {
+    const record = JSON.parse(stored);
+    if (record.version !== SERVER_PENDING_ENROLLMENT_RECORD_VERSION ||
+        record.state !== 'pending' ||
+        record.origin !== origin ||
+        record.trustIdentity !== trustIdentity ||
+        typeof record.invitation !== 'string' ||
+        typeof record.retryKey !== 'string' || !UUID_RE.test(record.retryKey) ||
+        typeof record.credential !== 'string' || !/^[A-Za-z0-9_-]{43}$/.test(record.credential) ||
+        (record.clientName !== undefined && typeof record.clientName !== 'string')) {
+        throw new Error('invalid');
+    }
+    validateInvitation(record.invitation);
+    validateClientName(record.clientName);
+    return {
+        origin,
+        trustIdentity,
+        invitation: record.invitation,
+        retryKey: record.retryKey,
+        credential: record.credential,
+        ...(record.clientName === undefined ? {} : { clientName: record.clientName }),
+    };
+}
+/** Load an exact durable PENDING tuple so a new process can resume it. */
+export async function getPendingServerEnrollment(origin, trustIdentity) {
+    validateServerCredentialBinding(origin, trustIdentity);
+    const backend = await getServerCredentialBackend();
+    const account = serverPendingEnrollmentAccount(origin, trustIdentity);
+    return withStoreLock(CREDENTIALS_LOCK, async () => {
+        const stored = await backend.get(account);
+        if (!stored)
+            return null;
+        try {
+            return decodePendingServerEnrollment(stored, origin, trustIdentity);
+        }
+        catch {
+            throw new Error('pending Borg server enrollment is corrupt');
+        }
+    });
+}
+/**
+ * Generate and persist an exact enrollment tuple before network I/O. A
+ * pre-existing PENDING tuple must match the invitation and presentation name;
+ * this makes response-loss retries exact without minting a second bearer.
+ */
+export async function getOrCreatePendingServerEnrollment(input) {
+    validateServerCredentialBinding(input.origin, input.trustIdentity);
+    validateInvitation(input.invitation);
+    validateClientName(input.clientName);
+    const backend = await getServerCredentialBackend();
+    const account = serverPendingEnrollmentAccount(input.origin, input.trustIdentity);
+    return withStoreLock(CREDENTIALS_LOCK, async () => {
+        const stored = await backend.get(account);
+        if (stored) {
+            try {
+                const record = decodePendingServerEnrollment(stored, input.origin, input.trustIdentity);
+                if (record.invitation !== input.invitation ||
+                    record.clientName !== input.clientName) {
+                    throw new Error('mismatch');
+                }
+                return record;
+            }
+            catch {
+                throw new Error('pending Borg server enrollment does not match this request');
+            }
+        }
+        const record = {
+            origin: input.origin,
+            trustIdentity: input.trustIdentity,
+            invitation: input.invitation,
+            retryKey: randomUUID(),
+            credential: randomBytes(32).toString('base64url'),
+            ...(input.clientName === undefined ? {} : { clientName: input.clientName }),
+        };
+        validateEnrollmentCredential(record.credential);
+        await backend.set(account, JSON.stringify({
+            version: SERVER_PENDING_ENROLLMENT_RECORD_VERSION,
+            state: 'pending',
+            ...record,
+        }));
+        return record;
+    });
+}
+/** Activate the exact pending tuple only after a verified server response. */
+export async function activatePendingServerEnrollment(input) {
+    validateServerCredentialBinding(input.origin, input.trustIdentity);
+    validateUuid(input.retryKey, 'enrollment retry key');
+    validateEnrollmentCredential(input.credential);
+    validateUuid(input.clientId, 'client identity');
+    const serverCapabilities = validateServerCapabilities(input.serverCapabilities);
+    const backend = await getServerCredentialBackend();
+    const pendingAccount = serverPendingEnrollmentAccount(input.origin, input.trustIdentity);
+    await withStoreLock(CREDENTIALS_LOCK, async () => {
+        const stored = await backend.get(pendingAccount);
+        if (!stored)
+            throw new Error('pending Borg server enrollment is missing');
+        try {
+            const pending = decodePendingServerEnrollment(stored, input.origin, input.trustIdentity);
+            if (pending.retryKey !== input.retryKey || pending.credential !== input.credential) {
+                throw new Error('mismatch');
+            }
+        }
+        catch {
+            throw new Error('pending Borg server enrollment does not match the verified response');
+        }
+        // Already inside the single store lock — use the UNLOCKED write body so we do
+        // not re-acquire (and self-deadlock on) CREDENTIALS_LOCK (CR3b).
+        await writeServerCredentialRecord(backend, {
+            origin: input.origin,
+            trustIdentity: input.trustIdentity,
+            credential: input.credential,
+            clientId: input.clientId,
+            serverCapabilities,
+        });
+        await backend.delete(pendingAccount);
+    });
+}
+/** Delete only the exact definitively rejected pending attempt. */
+export async function clearPendingServerEnrollment(origin, trustIdentity, retryKey) {
+    validateUuid(retryKey, 'enrollment retry key');
+    const backend = await getServerCredentialBackend();
+    const account = serverPendingEnrollmentAccount(origin, trustIdentity);
+    await withStoreLock(CREDENTIALS_LOCK, async () => {
+        const stored = await backend.get(account);
+        if (!stored)
+            return;
+        try {
+            const pending = decodePendingServerEnrollment(stored, origin, trustIdentity);
+            if (pending.retryKey !== retryKey)
+                return;
+        }
+        catch {
+            return;
+        }
+        await backend.delete(account);
+    });
+}
+/** Persist one repository-scoped cube-create idempotency key in the 0600 credential store. */
+export async function getOrCreatePendingServerCubeCreation(input) {
+    validateServerCredentialBinding(input.origin, input.trustIdentity);
+    validateUuid(input.clientId, 'client identity');
+    if (input.projectRoot.length < 1 || input.projectRoot.length > 4096 || /[\u0000-\u001f\u007f]/.test(input.projectRoot)) {
+        throw new Error('invalid Borg server repository binding');
+    }
+    if (Buffer.byteLength(input.name, 'utf8') < 1 || Buffer.byteLength(input.name, 'utf8') > 120 ||
+        !/^[A-Za-z0-9][A-Za-z0-9 ._-]*$/.test(input.name)) {
+        throw new Error('invalid Borg server cube name');
+    }
+    const repositoryBinding = createHash('sha256').update(input.projectRoot).digest('hex');
+    const backend = await getServerCredentialBackend();
+    const account = serverCubeRetryAccount(input.origin, input.trustIdentity, input.clientId, repositoryBinding);
+    return withStoreLock(CREDENTIALS_LOCK, async () => {
+        const stored = await backend.get(account);
+        if (stored) {
+            try {
+                const record = JSON.parse(stored);
+                if (record.version !== SERVER_CUBE_RETRY_RECORD_VERSION ||
+                    record.state !== 'pending' ||
+                    record.origin !== input.origin ||
+                    record.trustIdentity !== input.trustIdentity ||
+                    record.clientId !== input.clientId ||
+                    record.repositoryBinding !== repositoryBinding ||
+                    record.name !== input.name ||
+                    record.template !== input.template ||
+                    typeof record.retryKey !== 'string' || !UUID_RE.test(record.retryKey)) {
+                    throw new Error('mismatch');
+                }
+                return {
+                    origin: input.origin,
+                    trustIdentity: input.trustIdentity,
+                    clientId: input.clientId,
+                    repositoryBinding,
+                    retryKey: record.retryKey,
+                    name: input.name,
+                    template: input.template,
+                };
+            }
+            catch {
+                throw new Error('pending Borg server cube creation does not match this repository');
+            }
+        }
+        const record = {
+            origin: input.origin,
+            trustIdentity: input.trustIdentity,
+            clientId: input.clientId,
+            repositoryBinding,
+            retryKey: randomUUID(),
+            name: input.name,
+            template: input.template,
+        };
+        await backend.set(account, JSON.stringify({
+            version: SERVER_CUBE_RETRY_RECORD_VERSION,
+            state: 'pending',
+            ...record,
+        }));
+        return record;
+    });
+}
+export async function clearPendingServerCubeCreation(record) {
+    const backend = await getServerCredentialBackend();
+    const account = serverCubeRetryAccount(record.origin, record.trustIdentity, record.clientId, record.repositoryBinding);
+    await withStoreLock(CREDENTIALS_LOCK, async () => {
+        const stored = await backend.get(account);
+        if (!stored)
+            return;
+        try {
+            const pending = JSON.parse(stored);
+            if (pending.retryKey !== record.retryKey)
+                return;
+        }
+        catch {
+            return;
+        }
+        await backend.delete(account);
+    });
+}
+export async function clearServerCredential(origin, trustIdentity) {
+    const backend = await getServerCredentialBackend();
+    const pendingAccount = serverPendingEnrollmentAccount(origin, trustIdentity);
+    await withStoreLock(CREDENTIALS_LOCK, async () => {
+        await backend.delete(serverCredentialAccount(origin, trustIdentity));
+        await backend.delete(pendingAccount);
+    });
+}
+//# sourceMappingURL=config.js.map