dsh-agy 0.2.1 → 0.2.3

package/lib/accounts-BvX5zmPa.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"accounts-BvX5zmPa.mjs","names":["parseFutureResetMs","fingerprintData","parseFutureResetMs","ENC_PREFIX"],"sources":["../src/types.ts","../src/proxy.ts","../src/oauth/constants.ts","../src/runtime/identity.ts","../src/runtime/version.ts","../src/oauth/auth.ts","../src/oauth/refresh.ts","../src/runtime/rotation.ts","../src/runtime/quota.ts","../src/runtime/fingerprint-data.json","../src/runtime/fingerprint.ts","../src/runtime/risk.ts","../src/session.ts","../src/store/keyring.ts","../src/store/accounts.ts"],"sourcesContent":["/** Shared domain types for dsh-agy. */\n\n/**\n * Device fingerprint persisted per account (rate-limit mitigation).\n * Client-Metadata must only transmit ideType: the backend's enum validation\n * rejects freely-added platform/pluginType fields (AGENTS.md invariant).\n */\nexport interface ClientMetadata {\n  ideType: string\n}\n\nexport interface Fingerprint {\n  deviceId: string\n  sessionToken: string\n  userAgent: string\n  apiClient: string\n  clientMetadata: ClientMetadata\n  createdAt: number\n}\n\nexport interface FingerprintVersion {\n  fingerprint: Fingerprint\n  timestamp: number\n  reason: 'initial' | 'regenerated' | 'restored'\n}\n\nexport type CooldownReason =\n  | 'auth-failure'\n  | 'network-error'\n  | 'project-error'\n  | 'quota-exhausted'\n  | 'validation-required'\n\n/** Per-account quota cache keyed by model id. */\nexport interface CachedQuota {\n  remainingFraction?: number\n  resetTime?: string\n  modelCount?: number\n}\n\n/** One account in the pool. `refresh` is the packed `refreshToken|projectId|managedProjectId` string. */\nexport interface ManagedAccount {\n  id?: string\n  email?: string\n  refresh: string\n  projectId?: string\n  managedProjectId?: string\n  clientId?: string\n  addedAt: number\n  lastUsed: number\n  enabled?: boolean\n  rateLimitResetTimes?: Record<string, number>\n  coolingDownUntil?: number\n  cooldownReason?: CooldownReason\n  verificationRequired?: boolean\n  verificationRequiredAt?: number\n  verificationRequiredReason?: string\n  verificationUrl?: string\n  fingerprint?: Fingerprint\n  fingerprintHistory?: FingerprintVersion[]\n  cachedQuota?: Record<string, CachedQuota>\n  cachedQuotaUpdatedAt?: number\n}\n\nexport interface AccountStorageV1 {\n  version: 1\n  accounts: Array<{\n    email?: string\n    refreshToken: string\n    projectId?: string\n    managedProjectId?: string\n    addedAt: number\n    lastUsed: number\n    isRateLimited?: boolean\n    rateLimitResetTime?: number\n    lastSwitchReason?: 'rate-limit' | 'initial' | 'rotation'\n  }>\n  activeIndex: number\n}\n\nexport interface AccountStorageV2 {\n  version: 2\n  accounts: Array<{\n    email?: string\n    refreshToken: string\n    projectId?: string\n    managedProjectId?: string\n    addedAt: number\n    lastUsed: number\n    lastSwitchReason?: 'rate-limit' | 'initial' | 'rotation'\n    rateLimitResetTimes?: Record<string, number>\n  }>\n  activeIndex: number\n}\n\nexport interface AccountStorageV3 {\n  version: 3\n  accounts: ManagedAccount[]\n  activeIndex: number\n}\n\nexport interface AccountStorageV4 {\n  version: 4\n  accounts: ManagedAccount[]\n  activeIndex: number\n}\n\nexport type AccountStorage = AccountStorageV1 | AccountStorageV2 | AccountStorageV3 | AccountStorageV4\n\n/** Parsed halves of the packed refresh string. */\nexport interface RefreshParts {\n  refreshToken?: string\n  projectId?: string\n  managedProjectId?: string\n}\n\n/** OAuth token view of an account used by the refresh path. */\nexport interface OAuthAuthDetails {\n  access: string\n  expires: number\n  refresh: string\n}\n\n/** Result of the OAuth token exchange. */\nexport interface TokenExchangeSuccess {\n  type: 'success'\n  refresh: string\n  access: string\n  expires: number\n  email?: string\n  projectId: string\n  tier?: string\n  clientId?: string\n}\n\nexport interface TokenExchangeFailure {\n  type: 'failed'\n  error: string\n}\n\nexport type TokenExchangeResult = TokenExchangeSuccess | TokenExchangeFailure\n\nexport interface AgyAccountSession {\n  auth: OAuthAuthDetails\n  account: ManagedAccount\n  index: number\n  /** Fingerprint + randomized impersonation headers for this request. */\n  impersonation: {\n    'User-Agent': string\n    'X-Goog-Api-Client': string\n    'Client-Metadata': string\n  }\n}\n\n/** Authentication failure while resolving an account session. */\nexport type AgyAuthErrorKind = 'transport' | 'rate-limit' | 'invalid-credential'\n\n/**\n * Host-independent authentication error. The adapter maps `kind` to the DSH\n * error protocol without coupling the session or CLI layers to dsh-llm.\n */\nexport class AgyAuthError extends Error {\n  readonly kind: AgyAuthErrorKind\n\n  constructor(kind: AgyAuthErrorKind, message: string, options?: ErrorOptions) {\n    super(message, options)\n    this.name = 'AgyAuthError'\n    this.kind = kind\n  }\n}\n\n/** Why an enabled account pool cannot currently serve one model family. */\nexport type PoolBlockedKind = 'retryable' | 'quota-exhausted'\n\n/**\n * Enabled accounts exist, but every candidate is temporarily blocked. Kept\n * independent of dsh-llm so CLI and web entry points do not gain a host import.\n */\nexport class AgyPoolBlockedError extends Error {\n  readonly kind: PoolBlockedKind\n  readonly blockedUntil: number\n\n  constructor(kind: PoolBlockedKind, blockedUntil: number) {\n    super(kind === 'quota-exhausted'\n      ? 'All agy accounts have exhausted quota for the requested model family.'\n      : 'All agy accounts are temporarily blocked for the requested model family.')\n    this.name = 'AgyPoolBlockedError'\n    this.kind = kind\n    this.blockedUntil = blockedUntil\n  }\n}\n\n/** Classified upstream failure kinds consumed by the rotation state machine. */\nexport type FailureKind =\n  | 'rate-limit'\n  | 'auth-failure'\n  | 'network-error'\n  | 'project-error'\n  | 'request-error'\n  | 'transient'\n\n/** Rotation state machine decision for one failed attempt. */\nexport type RotationAction =\n  | { action: 'retry'; backoffMs: number }\n  | { action: 'cool'; backoffMs: number }\n  | { action: 'rotate'; backoffMs: number }\n  | { action: 'revoke' }\n  /** Permanent request-construction error: no state change, surface as-is. */\n  | { action: 'noop' }\n","/**\n * Proxy-aware fetch: respects the standard HTTP_PROXY / HTTPS_PROXY / NO_PROXY\n * environment variables (lowercase variants included) via undici's\n * EnvHttpProxyAgent. Applied per-request through the `dispatcher` option so the\n * plugin never mutates the host process's global dispatcher — DSH's own fetch\n * calls stay untouched.\n */\n\nimport { EnvHttpProxyAgent } from 'undici'\n\nconst agent = new EnvHttpProxyAgent()\n\n/** The proxy agent built from the environment (exported for tests). */\nexport const proxyAgent = agent\n\n/** fetch() that routes through the env-configured proxy when one is set. */\nexport const proxiedFetch: typeof fetch = (input, init) =>\n  // The Dispatcher type in undici's own types drifts from the undici-types\n  // bundled with @types/node; the runtime interface is stable across versions.\n  fetch(input, { ...init, dispatcher: agent as any })","/**\n * Antigravity (agy) OAuth and API constants.\n *\n * The client id/secret below are the public Google consumer-OAuth credentials\n * shipped inside the Antigravity desktop product and its `agy` CLI; they are\n * embedded in many public tools (see NOTICE.md). They are not secrets owned by\n * this project.\n */\n\nimport { proxiedFetch } from '../proxy.ts'\n\nexport const AGY_CLIENT_ID =\n  '1071006060591-tmhssin2h21lcre235vtolojh4g403ep.apps.googleusercontent.com'\n\nexport const AGY_CLIENT_SECRET = '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'\n\n/**\n * Effective OAuth client credentials: AGY_CLIENT_ID / AGY_CLIENT_SECRET env\n * overrides win when set (BYO OAuth app escape hatch, mirrors pi-antigravity);\n * otherwise the embedded public Antigravity credentials are used.\n */\nexport function resolveAgyClientCredentials(overrideClientId?: string): { clientId: string; clientSecret: string } {\n  if (overrideClientId) {\n    if (overrideClientId === AGY_CLIENT_ID) {\n      return { clientId: AGY_CLIENT_ID, clientSecret: AGY_CLIENT_SECRET }\n    }\n    return {\n      clientId: overrideClientId,\n      clientSecret: process.env.AGY_CLIENT_SECRET || AGY_CLIENT_SECRET,\n    }\n  }\n  return {\n    clientId: process.env.AGY_CLIENT_ID || AGY_CLIENT_ID,\n    clientSecret: process.env.AGY_CLIENT_SECRET || AGY_CLIENT_SECRET,\n  }\n}\n\n/** Required scopes. `openid` must NOT be added: it routes Google into the hanging\n * `firstparty/nativeapp` consent for this client (verified by OmniRoute). */\nexport const AGY_SCOPES: readonly string[] = [\n  'https://www.googleapis.com/auth/cloud-platform',\n  'https://www.googleapis.com/auth/userinfo.email',\n  'https://www.googleapis.com/auth/userinfo.profile',\n  'https://www.googleapis.com/auth/cclog',\n  'https://www.googleapis.com/auth/experimentsandconfigs',\n]\n\nexport const OAUTH_AUTHORIZE_URL = 'https://accounts.google.com/o/oauth2/v2/auth'\nexport const OAUTH_TOKEN_URL = 'https://oauth2.googleapis.com/token'\nexport const OAUTH_USERINFO_URL = 'https://www.googleapis.com/oauth2/v1/userinfo'\n\n/** Default loopback callback used by the standalone CLI listener (fixed port, like opencode). */\nexport const AGY_DEFAULT_REDIRECT_URI = 'http://localhost:51121/oauth-callback'\n\n/**\n * Antigravity API endpoints. The daily runtime host (no .sandbox suffix) is the\n * live endpoint for consumer OAuth accounts — cloudcode-pa.googleapis.com\n * answers RESOURCE_EXHAUSTED for them (verified by live probe), while the\n * daily host answers 200. Order matters: first reachable non-429/403 wins.\n */\nexport const AGY_ENDPOINT_DAILY = 'https://daily-cloudcode-pa.googleapis.com'\nexport const AGY_ENDPOINT_PROD = 'https://cloudcode-pa.googleapis.com'\nexport const AGY_ENDPOINT_DAILY_SANDBOX = 'https://daily-cloudcode-pa.sandbox.googleapis.com'\nexport const AGY_ENDPOINT_AUTOPUSH = 'https://autopush-cloudcode-pa.sandbox.googleapis.com'\n\n/** Runtime/bootstrap endpoint fallback order (daily first, mirroring OmniRoute). */\nexport const AGY_ENDPOINT_FALLBACKS: readonly string[] = [\n  AGY_ENDPOINT_DAILY,\n  AGY_ENDPOINT_PROD,\n  AGY_ENDPOINT_DAILY_SANDBOX,\n  AGY_ENDPOINT_AUTOPUSH,\n]\n\n/** Statuses that mean \"this endpoint is not usable for this account\"; skip to the next. */\nexport const AGY_ENDPOINT_SKIP_STATUSES = new Set([429, 403])\n\n/**\n * Try each runtime endpoint in order, skipping unusable ones (429/403/network).\n * Returns the first other response (2xx or a real error like 400/401); when\n * every endpoint is unusable, returns the last skipped response so the caller's\n * classifier can still produce a meaningful error.\n */\nexport async function fetchAgyFirstOk(\n  urlPath: string,\n  init: RequestInit,\n  fetchImpl: typeof fetch = proxiedFetch,\n): Promise<Response> {\n  let lastSkipped: Response | null = null\n  for (const baseEndpoint of AGY_ENDPOINT_FALLBACKS) {\n    try {\n      const response = await fetchImpl(`${baseEndpoint}${urlPath}`, init)\n      if (!AGY_ENDPOINT_SKIP_STATUSES.has(response.status)) return response\n      lastSkipped = response\n    } catch {\n      // network error — try the next endpoint\n    }\n  }\n  if (lastSkipped) return lastSkipped\n  throw new Error('all agy endpoints failed')\n}\n\n/** Default Antigravity client version used in User-Agent strings; overridden by the\n * runtime version fetcher (see runtime/fingerprint.ts). */\nexport const AGY_VERSION_FALLBACK = '1.18.3'\n\n/** Electron-style UA used for bootstrap calls (loadCodeAssist/onboardUser). */\nexport function getAgyBootstrapUserAgent(version = AGY_VERSION_FALLBACK): string {\n  return `Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Antigravity/${version} Chrome/138.0.7204.235 Electron/37.3.1 Safari/537.36`\n}\n\n/** Client-Metadata payload for bootstrap calls — ideType only (backend enum\n * validation rejects freely-added platform/pluginType; AGENTS.md invariant). */\nexport function getAgyBootstrapClientMetadata(): string {\n  return '{\"ideType\":\"ANTIGRAVITY\"}'\n}\n","/**\n * Antigravity request/session identity generation (mirrors the active\n * OmniRoute implementation; the archived reference stopped maintaining these).\n */\n\nimport { randomBytes } from 'node:crypto'\n\n/** One request id per upstream call: `agent/<epoch>/<8 hex>`. */\nexport function generateAntigravityRequestId(): string {\n  return `agent/${Date.now()}/${randomBytes(4).toString('hex')}`\n}\n\n/**\n * Uniformly random session id in `-{0..9e18}` via rejection sampling (avoids\n * modulo bias). The negative numeric shape matches what the backend issues.\n */\nexport function generateAntigravitySessionId(): string {\n  const max = 18_446_744_073_709_551_615n // 2^64 - 1\n  const target = 9_000_000_000_000_000_000n\n  const limit = max - (max % target)\n  let value: bigint\n  do {\n    value = randomBytes(8).readBigUInt64BE()\n  } while (value >= limit)\n  return `-${(value % target).toString()}`\n}\n\nconst FNV_OFFSET_I64 = -3_750_763_044_362_895_579n\nconst FNV_PRIME_I64 = 1_099_511_628_211n\n\n/** 64-bit FNV-1a hash of a string (stable across processes). */\nexport function fnv1a64(input: string): bigint {\n  let hash = FNV_OFFSET_I64\n  for (let i = 0; i < input.length; i++) {\n    hash ^= BigInt(input.charCodeAt(i))\n    hash = BigInt.asIntN(64, hash * FNV_PRIME_I64)\n  }\n  return hash\n}\n\n/**\n * Stable per-account session id: same account always derives the same id, so\n * multi-turn context caching keys consistently; unknown accounts get a fresh\n * random id.\n */\nexport function deriveAntigravitySessionId(accountKey: string | null | undefined): string | null {\n  if (!accountKey || accountKey.trim().length === 0) return null\n  const hash = fnv1a64(accountKey.trim())\n  // Fold into the positive 9e18 range the backend accepts.\n  const target = 9_000_000_000_000_000_000n\n  const folded = hash < 0n ? -hash : hash\n  return `-${(folded % target).toString()}`\n}\n","/**\n * Fresh Antigravity client version resolution: fetch from the product's own\n * release feeds (6h TTL, single in-flight dedupe), falling back to the pinned\n * pool. Keeps fingerprint User-Agent version strings current — a stale version\n * is the most detectable fingerprint anomaly.\n */\n\nimport { AGY_VERSION_FALLBACK } from '../oauth/constants.ts'\nimport { proxiedFetch } from '../proxy.ts'\n\nconst VERSION_CACHE_TTL_MS = 6 * 60 * 60 * 1000\nconst VERSION_FETCH_TIMEOUT_MS = 5_000\n\n/** Source 1: Antigravity IDE auto-update release feed (array of {version}). */\nconst IDE_RELEASE_FEED_URL = 'https://antigravity-auto-updater-974169037036.us-central1.run.app/releases'\n/** Source 2: agy CLI GitHub releases (object with tag_name). */\nconst CLI_RELEASE_URL = 'https://api.github.com/repos/google-antigravity/antigravity-cli/releases/latest'\n\nexport interface FetchLike {\n  (input: string | URL, init?: RequestInit): Promise<Response>\n}\n\nexport interface VersionState {\n  cache?: { version: string; fetchedAt: number }\n  inFlight: Promise<string> | null\n}\n\nfunction compareSemver(a: string, b: string): number {\n  const pa = a.split('.').map((n) => Number(n) || 0)\n  const pb = b.split('.').map((n) => Number(n) || 0)\n  for (let i = 0; i < 3; i++) {\n    const diff = (pa[i] ?? 0) - (pb[i] ?? 0)\n    if (diff !== 0) return diff\n  }\n  return 0\n}\n\nfunction pickNewestVersion(...versions: Array<unknown>): string | null {\n  const valid = versions\n    .filter((v): v is string => typeof v === 'string' && /^\\d+\\.\\d+\\.\\d+$/.test(v))\n  if (valid.length === 0) return null\n  return valid.reduce<string | null>((best, v) => (!best || compareSemver(v, best) > 0 ? v : best), null)\n}\n\nfunction parseIdeReleaseFeed(payload: unknown): string | null {\n  if (!Array.isArray(payload)) return null\n  return pickNewestVersion(...payload.map((entry) => (entry as { version?: unknown })?.version))\n}\n\nfunction parseCliRelease(payload: unknown): string | null {\n  if (!payload || typeof payload !== 'object') return null\n  const release = payload as { name?: unknown; tag_name?: unknown }\n  return pickNewestVersion(release.tag_name ?? release.name)\n}\n\nasync function fetchJsonWithTimeout(fetchImpl: FetchLike, url: string): Promise<unknown> {\n  const controller = new AbortController()\n  const timeoutId = setTimeout(() => controller.abort(), VERSION_FETCH_TIMEOUT_MS)\n  try {\n    const response = await fetchImpl(url, {\n      headers: { Accept: 'application/json', 'User-Agent': 'dsh-agy/0.1' },\n      signal: controller.signal,\n    })\n    if (!response.ok) throw new Error(`Version source ${url} returned ${response.status}`)\n    return response.json()\n  } finally {\n    clearTimeout(timeoutId)\n  }\n}\n\nasync function resolveProductVersion(\n  state: VersionState,\n  fallback: string,\n  sourceUrl: string,\n  parse: (payload: unknown) => string | null,\n  fetchImpl: FetchLike,\n): Promise<string> {\n  const now = Date.now()\n  if (state.cache && now - state.cache.fetchedAt < VERSION_CACHE_TTL_MS) {\n    return pickNewestVersion(state.cache.version, fallback) ?? fallback\n  }\n  if (state.inFlight) return state.inFlight\n\n  state.inFlight = (async () => {\n    let resolved: string | null = null\n    try {\n      resolved = parse(await fetchJsonWithTimeout(fetchImpl, sourceUrl))\n    } catch {\n      resolved = null\n    }\n    const version = pickNewestVersion(resolved, state.cache?.version, fallback) ?? fallback\n    if (resolved) state.cache = { version, fetchedAt: Date.now() }\n    return version\n  })()\n\n  try {\n    return await state.inFlight\n  } finally {\n    state.inFlight = null\n  }\n}\n\n/** Resolve the newest known Antigravity version from the IDE feed. */\nexport function resolveAntigravityIdeVersion(fetchImpl: FetchLike = proxiedFetch): Promise<string> {\n  return resolveProductVersion(ideState, AGY_VERSION_FALLBACK, IDE_RELEASE_FEED_URL, parseIdeReleaseFeed, fetchImpl)\n}\n\n/** Resolve the newest known Antigravity version from the CLI releases. */\nexport function resolveAntigravityCliVersion(fetchImpl: FetchLike = proxiedFetch): Promise<string> {\n  return resolveProductVersion(cliState, AGY_VERSION_FALLBACK, CLI_RELEASE_URL, parseCliRelease, fetchImpl)\n}\n\n/** Best available version: newest of both sources, cached 6h. */\nexport async function resolveAntigravityVersion(fetchImpl: FetchLike = proxiedFetch): Promise<string> {\n  const [ide, cli] = await Promise.all([resolveAntigravityIdeVersion(fetchImpl), resolveAntigravityCliVersion(fetchImpl)])\n  return pickNewestVersion(ide, cli) ?? AGY_VERSION_FALLBACK\n}\n\n/**\n * Bounded resolve for fingerprint generation: never block the failure path on\n * cold version feeds. Resolves undefined on timeout/error so callers fall\n * back to the pinned version pool; the abandoned fetch keeps running and\n * populates the 6h cache for later calls.\n */\nexport async function resolveAntigravityVersionBounded(timeoutMs = 750): Promise<string | undefined> {\n  let timer: NodeJS.Timeout | undefined\n  try {\n    return await Promise.race([\n      resolveAntigravityVersion().catch(() => undefined),\n      new Promise<undefined>((resolve) => {\n        timer = setTimeout(() => resolve(undefined), timeoutMs)\n      }),\n    ])\n  } finally {\n    clearTimeout(timer)\n  }\n}\n\n/** Synchronously peek at a fresh cached version (no network). */\nexport function peekCachedAntigravityVersion(): string | undefined {\n  const now = Date.now()\n  for (const state of [ideState, cliState]) {\n    if (state.cache && now - state.cache.fetchedAt < VERSION_CACHE_TTL_MS) {\n      return state.cache.version\n    }\n  }\n  return undefined\n}\n\nconst ideState: VersionState = { inFlight: null }\nconst cliState: VersionState = { inFlight: null }\n","/** Packed refresh-string helpers and access-token expiry math. */\n\nimport type { OAuthAuthDetails, RefreshParts } from '../types.ts'\n\nconst ACCESS_TOKEN_EXPIRY_BUFFER_MS = 60 * 1000\n\n/** Split the packed refresh string into its constituent refresh token and project ids. */\nexport function parseRefreshParts(refresh: string): RefreshParts {\n  const [refreshToken = '', projectId = '', managedProjectId = ''] = (refresh ?? '').split('|')\n  return {\n    refreshToken: refreshToken || undefined,\n    projectId: projectId || undefined,\n    managedProjectId: managedProjectId || undefined,\n  }\n}\n\n/** Serialize refresh token parts into the stored string format. */\nexport function formatRefreshParts(parts: RefreshParts): string {\n  const projectSegment = parts.projectId ?? ''\n  const base = `${parts.refreshToken ?? ''}|${projectSegment}`\n  return parts.managedProjectId ? `${base}|${parts.managedProjectId}` : base\n}\n\n/** Whether the access token is expired or missing, with a buffer for clock skew. */\nexport function accessTokenExpired(auth: OAuthAuthDetails): boolean {\n  if (!auth.access || typeof auth.expires !== 'number') {\n    return true\n  }\n  return auth.expires <= Date.now() + ACCESS_TOKEN_EXPIRY_BUFFER_MS\n}\n\n/** Absolute expiry timestamp from a duration; malformed durations expire immediately. */\nexport function calculateTokenExpiry(requestTimeMs: number, expiresInSeconds: unknown): number {\n  const seconds = typeof expiresInSeconds === 'number' ? expiresInSeconds : 3600\n  if (Number.isNaN(seconds) || seconds <= 0) {\n    return requestTimeMs\n  }\n  return requestTimeMs + seconds * 1000\n}\n","/**\n * Refresh an agy access token, handling Google's varied error payload shapes and\n * marking revocation (`invalid_grant`) distinctly so callers can drop the account.\n */\n\nimport type { OAuthAuthDetails } from '../types.ts'\nimport { calculateTokenExpiry, formatRefreshParts, parseRefreshParts } from './auth.ts'\nimport { AGY_CLIENT_ID, OAUTH_TOKEN_URL, resolveAgyClientCredentials } from './constants.ts'\nimport { proxiedFetch } from '../proxy.ts'\n\ninterface OAuthErrorPayload {\n  error?:\n    | string\n    | {\n        code?: string\n        status?: string\n        message?: string\n      }\n  error_description?: string\n}\n\nexport class AgyTokenRefreshError extends Error {\n  code?: string\n  description?: string\n  status: number\n  statusText: string\n\n  constructor(options: {\n    message: string\n    code?: string\n    description?: string\n    status: number\n    statusText: string\n  }) {\n    super(options.message)\n    this.name = 'AgyTokenRefreshError'\n    this.code = options.code\n    this.description = options.description\n    this.status = options.status\n    this.statusText = options.statusText\n  }\n}\n\n/** Parse Google token-endpoint error payloads, tolerating varied shapes. */\nexport function parseOAuthErrorPayload(text: string | undefined): { code?: string; description?: string } {\n  if (!text) return {}\n\n  try {\n    const payload = JSON.parse(text) as OAuthErrorPayload\n    if (!payload || typeof payload !== 'object') {\n      return { description: text }\n    }\n\n    let code: string | undefined\n    if (typeof payload.error === 'string') {\n      code = payload.error\n    } else if (payload.error && typeof payload.error === 'object') {\n      code = payload.error.status ?? payload.error.code\n      if (!payload.error_description && payload.error.message) {\n        return { code, description: payload.error.message }\n      }\n    }\n\n    const description = payload.error_description\n    if (description) return { code, description }\n\n    if (payload.error && typeof payload.error === 'object' && payload.error.message) {\n      return { code, description: payload.error.message }\n    }\n\n    return { code }\n  } catch {\n    return { description: text }\n  }\n}\n\nexport type RefreshResult =\n  | { type: 'success'; auth: OAuthAuthDetails; clientId: string }\n  | { type: 'revoked' }\n  | { type: 'failed'; error: AgyTokenRefreshError }\n\n/**\n * Refresh the access token for an account. `revoked` means Google rejected the\n * refresh token (`invalid_grant`) — the account must be re-authenticated.\n * For legacy accounts without a stored clientId, embedded credentials are tried\n * first with an env-override fallback before treating invalid_grant as fatal.\n */\nexport async function refreshAccessToken(auth: OAuthAuthDetails, options?: { clientId?: string }): Promise<RefreshResult> {\n  const parts = parseRefreshParts(auth.refresh)\n  if (!parts.refreshToken) {\n    return { type: 'failed', error: new AgyTokenRefreshError({\n      message: 'Missing refresh token',\n      status: 400,\n      statusText: 'Bad Request',\n    }) }\n  }\n\n  // Candidate client IDs to try: explicit stored clientId first; for legacy\n  // accounts, try embedded first, then env override (if distinct).\n  const candidateIds = options?.clientId\n    ? [options.clientId]\n    : Array.from(new Set([AGY_CLIENT_ID, process.env.AGY_CLIENT_ID].filter((id): id is string => Boolean(id && id.length > 0))))\n\n  let revokedCount = 0\n  let transientFailure: RefreshResult | undefined\n\n  for (const currentClientId of candidateIds) {\n    try {\n      const startTime = Date.now()\n      const { clientId, clientSecret } = resolveAgyClientCredentials(currentClientId)\n      const response = await proxiedFetch(OAUTH_TOKEN_URL, {\n        method: 'POST',\n        headers: {\n          'Content-Type': 'application/x-www-form-urlencoded',\n        },\n        body: new URLSearchParams({\n          grant_type: 'refresh_token',\n          refresh_token: parts.refreshToken,\n          client_id: clientId,\n          client_secret: clientSecret,\n        }),\n      })\n\n      if (!response.ok) {\n        const errorText = await response.text().catch(() => undefined)\n        const { code, description } = parseOAuthErrorPayload(errorText)\n        const details = [code, description ?? errorText].filter(Boolean).join(': ')\n        const baseMessage = `Agy token refresh failed (${response.status} ${response.statusText})`\n        const message = details ? `${baseMessage} - ${details}` : baseMessage\n\n        if (code === 'invalid_grant') {\n          revokedCount++\n          continue // try next candidate if available before revoking\n        }\n\n        transientFailure = {\n          type: 'failed',\n          error: new AgyTokenRefreshError({\n            message,\n            code,\n            description: description ?? errorText,\n            status: response.status,\n            statusText: response.statusText,\n          }),\n        }\n        continue\n      }\n      const payload = (await response.json()) as {\n        access_token: string\n        expires_in?: number\n        refresh_token?: string\n      }\n\n      const refreshedParts = {\n        refreshToken: payload.refresh_token ?? parts.refreshToken,\n        projectId: parts.projectId,\n        managedProjectId: parts.managedProjectId,\n      }\n\n      return {\n        type: 'success',\n        auth: {\n          access: payload.access_token,\n          expires: calculateTokenExpiry(startTime, payload.expires_in),\n          refresh: formatRefreshParts(refreshedParts),\n        },\n        clientId,\n      }\n    } catch (error) {\n      transientFailure = {\n        type: 'failed',\n        error: new AgyTokenRefreshError({\n          message: error instanceof Error ? error.message : 'Unknown refresh error',\n          status: 0,\n          statusText: 'Network Error',\n        }),\n      }\n    }\n  }\n\n  // If any candidate encountered a transient / inconclusive error, do NOT revoke.\n  if (transientFailure) return transientFailure\n  // Only if ALL candidates were definitively rejected with invalid_grant, revoke.\n  if (revokedCount === candidateIds.length) return { type: 'revoked' }\n\n  return {\n    type: 'failed',\n    error: new AgyTokenRefreshError({\n      message: 'Token refresh failed on all candidate client IDs',\n      status: 400,\n      statusText: 'Bad Request',\n    }),\n  }\n}\n","/**\n * Rotation state machine: decides retry / cool / rotate / revoke for one failed\n * attempt, with tiered backoff and soft-quota pre-checks.\n */\n\nimport type { CachedQuota, FailureKind, ManagedAccount, RotationAction } from '../types.ts'\nimport type { RateLimitCategory } from './classify.ts'\n\nexport const BACKOFF_TIERS_MS = [5_000, 10_000, 20_000, 30_000, 60_000] as const\n\n/** Below this remaining fraction the account is treated as soft-quota-exhausted. */\nexport const SOFT_QUOTA_THRESHOLD = 0.15\n\nexport const MAX_ACCOUNTS = 10\n\nfunction backoffFor(consecutiveFailures: number, maxJitterMs = 1_000): number {\n  const index = Math.min(Math.max(consecutiveFailures, 0), BACKOFF_TIERS_MS.length - 1)\n  const base = BACKOFF_TIERS_MS[index] ?? BACKOFF_TIERS_MS[BACKOFF_TIERS_MS.length - 1]!\n  return base + Math.floor(Math.random() * maxJitterMs)\n}\n\n/** Whether the account's cached quota for a model is below the soft threshold. */\nexport function isOverSoftQuota(\n  account: ManagedAccount,\n  model: string | undefined,\n  now = Date.now(),\n): boolean {\n  if (!model) return false\n  const cached = account.cachedQuota?.[model]\n  if (!cached || typeof cached.remainingFraction !== 'number') return false\n  if (cached.resetTime && Date.parse(cached.resetTime) <= now) return false\n  return cached.remainingFraction < SOFT_QUOTA_THRESHOLD\n}\n\n/** Whether the account is currently in a cooldown window. */\nexport function isCoolingDown(account: ManagedAccount, now = Date.now()): boolean {\n  return (account.coolingDownUntil ?? 0) > now\n}\n\n/** Whether any model rate limit on the account is still active. */\nexport function isRateLimited(account: ManagedAccount, now = Date.now()): boolean {\n  const times = account.rateLimitResetTimes ?? {}\n  return Object.values(times).some((reset) => typeof reset === 'number' && reset > now)\n}\n\n/** Whether the requested model family on this account is rate-limited. */\nexport function isFamilyRateLimited(account: ManagedAccount, family: string | undefined, now = Date.now()): boolean {\n  if (!family) return false\n  const resetAt = account.rateLimitResetTimes?.[family]\n  return typeof resetAt === 'number' && resetAt > now\n}\n\n/** Record a rate-limit reset for one model key, retaining the latest reset time. */\nexport function recordRateLimit(account: ManagedAccount, modelKey: string, resetAtMs: number): void {\n  const current = account.rateLimitResetTimes?.[modelKey] ?? 0\n  account.rateLimitResetTimes = {\n    ...(account.rateLimitResetTimes ?? {}),\n    [modelKey]: Math.max(current, resetAtMs),\n  }\n}\n\n/** Clear expired rate limits and cooldowns in place. */\nexport function clearExpiredState(account: ManagedAccount, now = Date.now()): void {\n  if (account.rateLimitResetTimes) {\n    const fresh = Object.fromEntries(\n      Object.entries(account.rateLimitResetTimes).filter(([, reset]) => reset > now),\n    )\n    account.rateLimitResetTimes = Object.keys(fresh).length > 0 ? fresh : undefined\n  }\n  if (account.coolingDownUntil && account.coolingDownUntil <= now) {\n    account.coolingDownUntil = undefined\n    account.cooldownReason = undefined\n  }\n}\n\n/** 24h cooldown for a fully exhausted daily quota (single-account: stop hitting the wall). */\nexport const FULL_QUOTA_COOLDOWN_MS = 24 * 60 * 60 * 1000\n/** 5min cooldown for per-minute rate limits. */\nexport const RATE_LIMIT_COOLDOWN_MS = 5 * 60 * 1000\n/** Cap for a server-reported reset time on per-minute limits (guards against bogus far-future values). */\nexport const MAX_RATE_LIMIT_COOLDOWN_MS = 30 * 60 * 1000\n\n/** Absolute server-reported reset in ms when it lies in the future, else undefined. */\nexport function parseFutureResetMs(resetTime: string | undefined, now = Date.now()): number | undefined {\n  if (!resetTime) return undefined\n  const reset = Date.parse(resetTime)\n  if (Number.isNaN(reset) || reset <= now) return undefined\n  return reset\n}\n\n/**\n * Decide what to do after one failed attempt.\n * @param kind - classified failure kind.\n * @param category - 429 sub-category when kind is rate-limit.\n * @param account - the account that failed (mutated with cooldown/rate-limit state).\n * @param consecutiveFailures - consecutive failures on this account.\n * @param retryAfterMs - server-provided retry delay when present.\n * @param resetTime - server-provided absolute reset time; cooldowns use it (capped) instead of fixed windows.\n */\nexport function decideRotation(\n  kind: FailureKind,\n  account: ManagedAccount,\n  consecutiveFailures: number,\n  retryAfterMs?: number,\n  category: RateLimitCategory = 'unknown',\n  resetTime?: string,\n): RotationAction {\n  const now = Date.now()\n  const backoffMs = backoffFor(consecutiveFailures)\n\n  switch (kind) {\n    case 'rate-limit': {\n      if (category === 'soft_rate_limit') {\n        // Transient burst: retry the same account almost immediately.\n        return { action: 'retry', backoffMs: Math.min(retryAfterMs ?? backoffMs, 3000) }\n      }\n      if (category === 'quota_exhausted') {\n        // Daily/plan quota gone: cool until the real reset when the backend\n        // reported one (capped at 24h), else the fixed daily window.\n        const resetMs = parseFutureResetMs(resetTime, now)\n        const cooldownMs = resetMs !== undefined\n          ? Math.min(resetMs - now, FULL_QUOTA_COOLDOWN_MS)\n          : FULL_QUOTA_COOLDOWN_MS\n        account.coolingDownUntil = now + Math.max(cooldownMs, 60_000)\n        account.cooldownReason = 'quota-exhausted'\n        return { action: 'cool', backoffMs: Math.max(cooldownMs, 60_000) }\n      }\n      // Per-minute rate limit: prefer the server's real reset (capped), then\n      // Retry-After, then the fixed short window. The family-scoped reset is\n      // recorded in account.rateLimitResetTimes, so other model families on\n      // this account stay unblocked (AuthStorage-aligned).\n      const resetMs = parseFutureResetMs(resetTime, now)\n      const cooldownMs = resetMs !== undefined\n        ? Math.min(resetMs - now, MAX_RATE_LIMIT_COOLDOWN_MS)\n        : (retryAfterMs ?? RATE_LIMIT_COOLDOWN_MS)\n      return { action: 'rotate', backoffMs: Math.max(cooldownMs, 1000) }\n    }\n    case 'auth-failure': {\n      // Terminal: account credentials are dead; never auto-recover.\n      account.verificationRequired = true\n      account.verificationRequiredAt = now\n      account.verificationRequiredReason = 'auth-failure'\n      account.enabled = false\n      return { action: 'revoke' }\n    }\n    case 'network-error': {\n      account.coolingDownUntil = now + backoffMs\n      account.cooldownReason = 'network-error'\n      return { action: 'rotate', backoffMs }\n    }\n    case 'project-error': {\n      account.coolingDownUntil = now + backoffMs\n      account.cooldownReason = 'project-error'\n      return { action: 'cool', backoffMs }\n    }\n    case 'request-error': {\n      // Request-construction error (e.g. generic 400): permanent, retrying\n      // resends the same broken payload. No cooldown, no rotation, no revoke —\n      // the adapter surfaces it as a terminal UPSTREAM error.\n      return { action: 'noop' }\n    }\n    case 'transient': {\n      return { action: 'retry', backoffMs }\n    }\n  }\n}\n\n/**\n * Pick the next account index for rotation (round-robin across enabled,\n * non-cooling accounts; falls back to the active one when all are cooling).\n */\nexport function pickNextAccountIndex(\n  accounts: ManagedAccount[],\n  currentIndex: number,\n  now = Date.now(),\n  modelOrFamily?: string,\n): number {\n  if (accounts.length <= 1) return currentIndex\n  const enabled = accounts.map((a, i) => ({ account: a, index: i }))\n    .filter(({ account, index }) => {\n      if (index === currentIndex || account.enabled === false) return false\n      if (isCoolingDown(account, now)) return false\n      if (modelOrFamily && isFamilyRateLimited(account, modelOrFamily, now)) return false\n      return true\n    })\n  if (enabled.length === 0) return currentIndex\n  // Round-robin: first candidate after current index, else first eligible.\n  const after = enabled.find((e) => e.index > currentIndex)\n  return (after ?? enabled[0]!)!.index\n}\n\n/** Build the soft-quota cache TTL: short when low, long when healthy. */\nexport function computeSoftQuotaCacheTtlMs(remainingFraction: number | undefined, now = Date.now()): number {\n  if (typeof remainingFraction !== 'number') return 10 * 60 * 1000\n  if (remainingFraction < SOFT_QUOTA_THRESHOLD) return 60 * 1000\n  if (remainingFraction < 0.5) return 5 * 60 * 1000\n  return 15 * 60 * 1000\n}\n\nexport type { CachedQuota }\n","/**\n * Usage-aware account pool scheduling, aligned with oh-my-pi's\n * google-antigravity usage provider + ranking strategy (AuthStorage):\n *\n * - Backend quotas are counters scoped by model family (google/anthropic/openai);\n *   the requested model maps to one family via its id prefix.\n * - `fetchAvailableModels` quotaInfo entries are aggregated per family\n *   (most-pressured model wins the family's remaining fraction).\n * - Candidates rank by: unblocked first, hot windows last, measured usage before\n *   unmeasured, required-drain descending (headroom / hours-to-reset — \"use it\n *   or lose it\"), then used-fraction ascending. Exhausted families block the\n *   account until their real reset time.\n */\n\nimport type { DiscoveredModels } from '../adapter/models.ts'\nimport type { CachedQuota, ManagedAccount } from '../types.ts'\nimport { SOFT_QUOTA_THRESHOLD, computeSoftQuotaCacheTtlMs } from './rotation.ts'\n\nexport type ModelFamily = 'google' | 'anthropic' | 'openai'\n\n/** Family bucket for model ids with no recognizable prefix (mirrors OMP's counter:unknown). */\nexport const FAMILY_UNKNOWN = 'unknown'\n\n/** Mirrors AuthStorage.PRIMARY_WINDOW_HOT_FRACTION: near-exhausted windows rank last. */\nexport const PRIMARY_WINDOW_HOT_FRACTION = 0.85\n\nconst DAY_MS = 24 * 60 * 60 * 1000\n/** Floor for remaining-time in drain-urgency scores (mirrors AuthStorage; a stale reset must not explode the score). */\nconst DRAIN_FLOOR_MS = 60_000\n\n/** Map a model id to its backend quota counter family (OMP getAntigravityCounterKeyForModel). */\nexport function modelFamilyOf(modelId?: string): ModelFamily | undefined {\n  if (!modelId) return undefined\n  const id = modelId.toLowerCase()\n  if (id.startsWith('claude-')) return 'anthropic'\n  if (id.startsWith('gemini-') || id.startsWith('gemma-')) return 'google'\n  if (id.startsWith('gpt-') || id.startsWith('openai/')) return 'openai'\n  return undefined\n}\n\n/** Quota-cache key for a request: the model's family, or the unknown bucket. */\nexport function familyKeyOf(modelId?: string): string {\n  return modelFamilyOf(modelId) ?? FAMILY_UNKNOWN\n}\n\nfunction earliestResetTime(a?: string, b?: string): string | undefined {\n  if (!a) return b\n  if (!b) return a\n  const ta = Date.parse(a)\n  const tb = Date.parse(b)\n  if (Number.isNaN(ta)) return b\n  if (Number.isNaN(tb)) return a\n  return ta <= tb ? a : b\n}\n\n/**\n * Aggregate a fetchAvailableModels response into per-family quota records:\n * the family's remaining fraction is its most-pressured model's, and the\n * reset time is the earliest across the family (the bottleneck resets first).\n */\nexport function ingestFamilyQuotas(discovered: DiscoveredModels): Record<string, CachedQuota> {\n  const families = new Map<string, CachedQuota>()\n  for (const [modelId, entry] of Object.entries(discovered.models ?? {})) {\n    const remaining = entry.quotaInfo?.remainingFraction\n    if (typeof remaining !== 'number' || !Number.isFinite(remaining)) continue\n    const key = familyKeyOf(modelId)\n    const current = families.get(key)\n    const resetTime = earliestResetTime(current?.resetTime, entry.quotaInfo?.resetTime)\n    families.set(key, {\n      remainingFraction: current ? Math.min(current.remainingFraction ?? 1, remaining) : remaining,\n      ...(resetTime ? { resetTime } : {}),\n      modelCount: (current?.modelCount ?? 0) + 1,\n    })\n  }\n  return Object.fromEntries(families)\n}\n\n/** The quota record for one family, or the most-pressured family when the model is unknown. */\nexport function familyQuotaFor(account: ManagedAccount, family?: ModelFamily): CachedQuota | undefined {\n  const cache = account.cachedQuota ?? {}\n  if (family) return cache[family]\n  let worst: CachedQuota | undefined\n  for (const entry of Object.values(cache)) {\n    if (typeof entry.remainingFraction !== 'number') continue\n    if (!worst || entry.remainingFraction < (worst.remainingFraction ?? 1)) worst = entry\n  }\n  return worst\n}\n\n/** Whether the account's quota cache needs a refresh (missing, or past its health-based TTL). */\nexport function isQuotaStale(account: ManagedAccount, now = Date.now()): boolean {\n  if (!account.cachedQuota || !account.cachedQuotaUpdatedAt) return true\n  const mostPressured = familyQuotaFor(account)\n  const ttl = computeSoftQuotaCacheTtlMs(mostPressured?.remainingFraction)\n  return now - account.cachedQuotaUpdatedAt > ttl\n}\n\n/** Whether the requested family on this account is soft-quota-exhausted (below the pre-check threshold). */\nexport function isFamilyDrained(account: ManagedAccount, family?: ModelFamily, now = Date.now()): boolean {\n  const quota = familyQuotaFor(account, family)\n  if (!quota || typeof quota.remainingFraction !== 'number') return false\n  if (quota.resetTime) {\n    const reset = Date.parse(quota.resetTime)\n    if (!Number.isNaN(reset) && reset <= now) return false\n  }\n  return quota.remainingFraction < SOFT_QUOTA_THRESHOLD\n}\n\n/**\n * Required drain rate: headroomFraction / remainingHours — how fast the\n * family's remaining quota must be consumed to avoid expiring unused at its\n * reset (mirrors AuthStorage.#computeWindowRequiredDrain with a daily window).\n */\nexport function requiredDrainFor(quota: CachedQuota | undefined, now = Date.now()): number {\n  const remaining = quota?.remainingFraction\n  if (typeof remaining !== 'number' || !Number.isFinite(remaining)) return 0\n  // Headroom IS the remaining fraction (mirrors AuthStorage: headroom = 1 - used).\n  const headroom = Math.min(Math.max(remaining, 0), 1)\n  if (headroom <= 0) return 0\n  let remainingMs = DAY_MS\n  const resetTime = quota?.resetTime\n  if (resetTime) {\n    const resetAt = Date.parse(resetTime)\n    if (!Number.isNaN(resetAt)) remainingMs = Math.min(remainingMs, Math.max(resetAt - now, 0))\n  }\n  const remainingHours = Math.max(remainingMs, DRAIN_FLOOR_MS) / (60 * 60 * 1000)\n  return headroom / remainingHours\n}\n\nexport interface PoolCandidate {\n  account: ManagedAccount\n  index: number\n  /** Cooldown/limit wall blocking this account (null when usable). */\n  blockedUntil: number | null\n  /** Used fraction of the requested family's quota (measured accounts only). */\n  usedFraction?: number\n  requiredDrain: number\n  hot: boolean\n  measured: boolean\n}\n\n/** Candidate with its rotation-order position, used only while sorting. */\ninterface PoolCandidateWithOrder extends PoolCandidate {\n  orderPos: number\n}\n\nfunction parseFutureResetMs(resetTime: string | undefined, now: number): number | undefined {\n  if (!resetTime) return undefined\n  const reset = Date.parse(resetTime)\n  if (Number.isNaN(reset) || reset <= now) return undefined\n  return reset\n}\n\n/**\n * Rank pool candidates for one request, mirroring AuthStorage's antigravity\n * ordering: unblocked first (earliest unblock time among blocked), hot windows\n * last, measured usage before unmeasured, required-drain descending, then\n * used-fraction ascending. Ties preserve the rotation order seeded from\n * `startIndex` so an unmeasured pool keeps the active-account bias.\n */\nexport function rankPoolCandidates(\n  entries: ReadonlyArray<{ account: ManagedAccount; index: number }>,\n  modelId: string | undefined,\n  now = Date.now(),\n  startIndex = 0,\n): PoolCandidate[] {\n  const family = modelFamilyOf(modelId)\n  const activePos = entries.findIndex((e) => e.index === startIndex)\n  const clampedStart = activePos >= 0 ? activePos : 0\n  const ordered = entries.length === 0 ? [] : [...entries.slice(clampedStart), ...entries.slice(0, clampedStart)]\n  const candidates: PoolCandidateWithOrder[] = ordered.map(({ account, index }, orderPos) => {\n    const quota = familyQuotaFor(account, family)\n    const remaining = quota?.remainingFraction\n    const used = typeof remaining === 'number' ? Math.min(Math.max(1 - remaining, 0), 1) : undefined\n\n    let blockedUntil: number | null = null\n    if (account.coolingDownUntil && account.coolingDownUntil > now) {\n      blockedUntil = account.coolingDownUntil\n    }\n    const familyLimit = account.rateLimitResetTimes?.[familyKeyOf(modelId)]\n    if (familyLimit !== undefined && familyLimit > now) {\n      blockedUntil = blockedUntil === null ? familyLimit : Math.max(blockedUntil, familyLimit)\n    }\n    // A measured zero-remaining family with a future reset blocks the account\n    // until the real reset (mirrors AuthStorage usage-limit blocking); drained\n    // (low but non-zero) families are ranked, not blocked.\n    if (blockedUntil === null && quota && typeof remaining === 'number' && remaining <= 0) {\n      const resetMs = parseFutureResetMs(quota.resetTime, now)\n      if (resetMs !== undefined) blockedUntil = resetMs\n    }\n\n    return {\n      account,\n      index,\n      orderPos,\n      blockedUntil,\n      usedFraction: used,\n      requiredDrain: requiredDrainFor(quota, now),\n      hot: used !== undefined && used >= PRIMARY_WINDOW_HOT_FRACTION,\n      measured: used !== undefined,\n    }\n  })\n\n  candidates.sort((left, right) => {\n    const leftBlocked = left.blockedUntil !== null\n    const rightBlocked = right.blockedUntil !== null\n    if (leftBlocked !== rightBlocked) return leftBlocked ? 1 : -1\n    if (leftBlocked && rightBlocked) return (left.blockedUntil ?? 0) - (right.blockedUntil ?? 0)\n    if (left.hot !== right.hot) return left.hot ? 1 : -1\n    if (left.measured !== right.measured) return left.measured ? -1 : 1\n    const drain = right.requiredDrain - left.requiredDrain\n    if (drain !== 0) return drain\n    const usedDiff = (left.usedFraction ?? 0.5) - (right.usedFraction ?? 0.5)\n    if (usedDiff !== 0) return usedDiff\n    return left.orderPos - right.orderPos\n  })\n\n  return candidates.map(({ account, index, blockedUntil, usedFraction, requiredDrain, hot, measured }) => ({\n    account, index, blockedUntil, usedFraction, requiredDrain, hot, measured,\n  }))\n}\n","","/**\n * Device fingerprint generation for rate-limit mitigation (two layers):\n *\n * 1. Per-request randomized headers — platform/arch/SDK-client pools.\n * 2. Per-account persistent fingerprint — deviceId/sessionToken/UA snapshot\n *    with bounded history (≤5 versions, restorable), regenerated when an\n *    account's capacity looks exhausted.\n *\n * All tunable pools live in fingerprint-data.json so they can be updated\n * without a code release (the reference implementation stopped at an old\n * version string once archived — that staleness is the detectable signal).\n */\n\nimport { existsSync, readFileSync } from 'node:fs'\nimport { join } from 'node:path'\nimport { randomBytes, randomUUID } from 'node:crypto'\nimport type { ClientMetadata, Fingerprint, FingerprintVersion } from '../types.ts'\nimport fingerprintData from './fingerprint-data.json'\n\nexport interface FingerprintData {\n  versionPool: string[]\n  platforms: string[]\n  architectures: string[]\n  osVersions: Record<string, string[]>\n  sdkClients: string[]\n  ideTypes: string[]\n  pluginTypes: string[]\n}\n\nexport const DEFAULT_FINGERPRINT_DATA = fingerprintData as FingerprintData\n\nexport const MAX_FINGERPRINT_HISTORY = 5\n\nconst USER_OVERRIDE_FILE = 'agy-fingerprint-data.json'\n\n/**\n * Effective fingerprint data: a user override at `$DSH_HOME/agy-fingerprint-data.json`\n * wins when present and parseable (hot-updatable without a code release — the\n * bundled copy is compiled in), otherwise the bundled defaults.\n */\nlet cachedData: FingerprintData | null = null\nexport function getFingerprintData(): FingerprintData {\n  if (cachedData) return cachedData\n  try {\n    const dshHome = process.env.DSH_HOME ? process.env.DSH_HOME : join(process.env.HOME ?? '.', '.dsh')\n    const overrideFile = join(dshHome, USER_OVERRIDE_FILE)\n    if (existsSync(overrideFile)) {\n      const parsed = JSON.parse(readFileSync(overrideFile, 'utf8')) as FingerprintData\n      if (parsed && Array.isArray(parsed.versionPool) && parsed.versionPool.length > 0) {\n        cachedData = parsed\n        return cachedData\n      }\n    }\n  } catch {\n    // unreadable override — fall through to bundled defaults\n  }\n  cachedData = DEFAULT_FINGERPRINT_DATA\n  return cachedData\n}\n\nfunction randomFrom<T>(arr: readonly T[]): T {\n  return arr[Math.floor(Math.random() * arr.length)]!\n}\n\n/** Generate a randomized device fingerprint representing one apparent device. */\nexport function generateFingerprint(\n  data: FingerprintData = getFingerprintData(),\n  version = randomFrom(data.versionPool),\n): Fingerprint {\n  const platform = randomFrom(data.platforms)\n  return {\n    deviceId: randomUUID(),\n    sessionToken: randomBytes(16).toString('hex'),\n    userAgent: `antigravity/${version} ${platform}`,\n    apiClient: randomFrom(data.sdkClients),\n    // Client-Metadata must only transmit ideType (backend enum validation\n    // rejects freely-added platform/pluginType; AGENTS.md invariant).\n    clientMetadata: {\n      ideType: randomFrom(data.ideTypes),\n    },\n    createdAt: Date.now(),\n  }\n}\n\n/** The only header composed from a fingerprint (the rest are per-request random). */\nexport function buildFingerprintHeaders(fingerprint: Fingerprint | null): { 'User-Agent'?: string } {\n  if (!fingerprint) return {}\n  return { 'User-Agent': fingerprint.userAgent }\n}\n\n/** Per-request randomized headers (platform + SDK client pools). */\nexport function getRandomizedHeaders(\n  data: FingerprintData = getFingerprintData(),\n  version = randomFrom(data.versionPool),\n): { 'User-Agent': string; 'X-Goog-Api-Client': string; 'Client-Metadata': string } {\n  const platform = randomFrom(data.platforms)\n  return {\n    'User-Agent': `antigravity/${version} ${platform}`,\n    'X-Goog-Api-Client': randomFrom(data.sdkClients),\n    'Client-Metadata': JSON.stringify({\n      ideType: randomFrom(data.ideTypes),\n    }),\n  }\n}\n\n/**\n * Deterministic fallback headers for the `stable` fingerprint mode: the first\n * entry of each pool, every call — one fixed client identity instead of\n * per-request randomization (OMP-style fixed-client posture).\n */\nexport function getStableHeaders(\n  data: FingerprintData = getFingerprintData(),\n  version = data.versionPool[0] ?? '',\n): { 'User-Agent': string; 'X-Goog-Api-Client': string; 'Client-Metadata': string } {\n  const platform = data.platforms[0] ?? 'windows/amd64'\n  return {\n    'User-Agent': `antigravity/${version || '1.18.3'} ${platform}`,\n    'X-Goog-Api-Client': data.sdkClients[0] ?? '',\n    'Client-Metadata': JSON.stringify({\n      ideType: data.ideTypes[0] ?? 'ANTIGRAVITY',\n    }),\n  }\n}\n\n/** Rewrite the version inside a fingerprint UA; reports whether it changed. */\nexport function updateFingerprintVersion(fingerprint: Fingerprint, version: string): boolean {\n  const pattern = /^(antigravity\\/)([\\d.]+)/\n  const match = fingerprint.userAgent.match(pattern)\n  if (!match || match[2] === version) return false\n  fingerprint.userAgent = fingerprint.userAgent.replace(pattern, `$1${version}`)\n  return true\n}\n\n/** Append a fingerprint to the account history (bounded), then use it as current. */\nexport function recordFingerprintVersion(\n  history: FingerprintVersion[] | undefined,\n  fingerprint: Fingerprint,\n  reason: FingerprintVersion['reason'],\n): FingerprintVersion[] {\n  const next = [...(history ?? []), { fingerprint, timestamp: Date.now(), reason }]\n  return next.slice(-MAX_FINGERPRINT_HISTORY)\n}\n\n/**\n * Restore a stable prior identity: the oldest restorable fingerprint\n * (`initial`, else most recent `restored`). Returns `current` when the history\n * holds nothing restorable (e.g. the initial entry was evicted).\n */\nexport function restoreFingerprint(\n  history: FingerprintVersion[] | undefined,\n  current: Fingerprint | undefined,\n): Fingerprint | undefined {\n  if (!history || history.length === 0) return current\n  const initial = history.find((v) => v.reason === 'initial')\n  const restored = [...history].reverse().find((v) => v.reason === 'restored')\n  const restorable = initial ?? restored\n  if (!restorable) return current\n  return restorable.fingerprint\n}\n","/**\n * Risk-control switches (compliance posture): env-gated behaviors that keep\n * the grey-zone product honest —\n *\n * - DSH_AGY_DISABLE=1: global kill switch, the plugin registers nothing.\n * - DSH_AGY_FINGERPRINT_MODE=stable: one identity per account, never\n *   regenerated, deterministic fallback headers (OMP-style fixed-client\n *   posture). Default `dynamic` keeps the upstream per-request randomization.\n *\n * The BYO OAuth app escape hatch (AGY_CLIENT_ID / AGY_CLIENT_SECRET) lives in\n * oauth/constants.ts (resolveAgyClientCredentials) — oauth/ is a dependency\n * leaf and must not import runtime/.\n */\n\nexport type FingerprintMode = 'dynamic' | 'stable'\n\nconst TRUE_VALUES = new Set(['1', 'true', 'yes', 'on'])\n\nfunction envFlag(name: string): boolean {\n  const value = process.env[name]\n  return value !== undefined && TRUE_VALUES.has(value.trim().toLowerCase())\n}\n\n/** Global kill switch: DSH_AGY_DISABLE=1 keeps the plugin from registering anything. */\nexport function isAgyDisabled(): boolean {\n  return envFlag('DSH_AGY_DISABLE')\n}\n\n/**\n * Fingerprint strategy: `dynamic` (default, upstream behavior: per-request\n * header randomization + regeneration on repeated rate-limits) or `stable`\n * (one identity per account, never regenerated, deterministic fallback\n * headers — mirrors OMP's fixed-client posture).\n */\nexport function fingerprintMode(): FingerprintMode {\n  return process.env.DSH_AGY_FINGERPRINT_MODE === 'stable' ? 'stable' : 'dynamic'\n}\n","/**\n * Account session manager: the shared runtime glue between the store, the\n * OAuth refresh path, rotation/fingerprint logic, and the adapter. Used by the\n * in-harness plugin shell, the CLI, and the web routes.\n */\n\nimport { AgyAuthError, AgyPoolBlockedError } from './types.ts'\nimport type { AccountStorageV4, AgyAccountSession, CachedQuota, FailureKind, ManagedAccount, OAuthAuthDetails } from './types.ts'\nimport { refreshAccessToken } from './oauth/refresh.ts'\nimport { accessTokenExpired, formatRefreshParts, parseRefreshParts } from './oauth/auth.ts'\nimport type { AccountStore } from './store/accounts.ts'\nimport {\n  MAX_RATE_LIMIT_COOLDOWN_MS,\n  RATE_LIMIT_COOLDOWN_MS,\n  clearExpiredState,\n  decideRotation,\n  isCoolingDown,\n  isFamilyRateLimited,\n  parseFutureResetMs,\n  pickNextAccountIndex,\n  recordRateLimit,\n} from './runtime/rotation.ts'\nimport {\n  familyKeyOf,\n  familyQuotaFor,\n  ingestFamilyQuotas,\n  isFamilyDrained,\n  isQuotaStale,\n  modelFamilyOf,\n  rankPoolCandidates,\n} from './runtime/quota.ts'\nimport {\n  DEFAULT_FINGERPRINT_DATA,\n  generateFingerprint,\n  getRandomizedHeaders,\n  getStableHeaders,\n  recordFingerprintVersion,\n  updateFingerprintVersion,\n} from './runtime/fingerprint.ts'\nimport { deriveAntigravitySessionId } from './runtime/identity.ts'\nimport { fingerprintMode } from './runtime/risk.ts'\nimport { peekCachedAntigravityVersion, resolveAntigravityVersionBounded } from './runtime/version.ts'\nimport { proxiedFetch } from './proxy.ts'\nimport type { Fingerprint } from './types.ts'\n\nexport interface SessionManagerOptions {\n  store: AccountStore\n  /** Called after rotation changes the active index (for logging/UI). */\n  onRotate?: (fromIndex: number, toIndex: number, reason: FailureKind) => void\n  /** Called after a health check finishes (batch probe results). */\n  onHealthReport?: (results: AccountHealthResult[]) => void\n}\n\n/** One account's health check result (refresh + userinfo). */\nexport interface AccountHealthResult {\n  index: number\n  email?: string\n  ok: boolean\n  error?: string\n}\n\n/**\n * Session affinity window: reuse the last-used account for new requests within\n * this window (proxy for one DSH conversation, which exposes no id). After the\n * window or on failure the pool re-balances.\n */\nexport const SESSION_AFFINITY_WINDOW_MS = 10 * 60 * 1000\n\ninterface TokenCacheEntry {\n  access: string\n  expires: number\n}\n\ninterface QuotaRefreshResult {\n  key: string\n  quotas: Record<string, CachedQuota>\n  updatedAt: number\n}\n\n/**\n * Resolve the impersonation headers for one request from the account's\n * persistent fingerprint (stable identity). The fallback randomizes per\n * request in `dynamic` mode and pins one identity in `stable` mode.\n */\nexport function impersonationHeadersFor(account: ManagedAccount): AgyAccountSession['impersonation'] {\n  const fingerprint = account.fingerprint\n  if (fingerprint) {\n    return {\n      'User-Agent': fingerprint.userAgent,\n      'X-Goog-Api-Client': fingerprint.apiClient,\n      'Client-Metadata': JSON.stringify(fingerprint.clientMetadata),\n    }\n  }\n  const headers = fingerprintMode() === 'stable'\n    ? getStableHeaders(DEFAULT_FINGERPRINT_DATA)\n    : getRandomizedHeaders(DEFAULT_FINGERPRINT_DATA)\n  return {\n    'User-Agent': headers['User-Agent'],\n    'X-Goog-Api-Client': headers['X-Goog-Api-Client'],\n    'Client-Metadata': headers['Client-Metadata'],\n  }\n}\n\nexport class AgySessionManager {\n  private readonly store: AccountStore\n  private readonly onRotate: SessionManagerOptions['onRotate']\n  private readonly onHealthReport: SessionManagerOptions['onHealthReport']\n  private readonly tokenCache = new Map<string, TokenCacheEntry>()\n  /** In-flight refresh promises keyed by account: concurrent requests share one refresh. */\n  private readonly refreshInFlight = new Map<string, Promise<OAuthAuthDetails | undefined>>()\n  /** In-flight quota fetches keyed by account: concurrent selections share one fetchAvailableModels call. */\n  private readonly quotaRefreshInFlight = new Map<string, Promise<QuotaRefreshResult | null>>()\n  private readonly failureCounts = new Map<string, number>()\n  /** Accounts whose request-time project discovery already failed (no retry per request). */\n  private readonly projectRetryFailed = new Set<string>()\n\n  /** Bound for one quota poll so selection never stalls on a hung endpoint. */\n  private static readonly QUOTA_FETCH_TIMEOUT_MS = 3_000\n  /** Refresh the token this far ahead of expiry so a request never blocks on the token endpoint. */\n  private static readonly REFRESH_SKEW_MS = 2 * 60 * 1000\n\n  /**\n   * Session affinity (time-window approximation): DSH exposes no conversation\n   * id, so instead of pinning per session we reuse the last-used account while\n   * it is fresh. Keeps upstream prefix caching and sessionId continuity across\n   * the turns of one conversation (OmniRoute pins by session for the same\n   * reason). Cleared on rotate so a failure re-picks from activeIndex.\n   */\n  private lastUsed: { key: string; at: number } | null = null\n\n  constructor(options: SessionManagerOptions) {\n    this.store = options.store\n    this.onRotate = options.onRotate\n    this.onHealthReport = options.onHealthReport\n  }\n\n  private accountKey(account: ManagedAccount): string {\n    return account.id ?? account.email ?? `idx-${account.refresh}`\n  }\n\n  /**\n   * Refresh the account's access token (single-flight per account). A transient\n   * refresh failure keeps the cached token in place (retain-last-good): the old\n   * token stays valid until its own expiry and a later request retries the\n   * refresh. Only `invalid_grant` drops the cache.\n   */\n  private refreshToken(key: string, account: ManagedAccount, cached?: TokenCacheEntry): Promise<OAuthAuthDetails | undefined> {\n    const inFlight = this.refreshInFlight.get(key)\n    if (inFlight) return inFlight\n\n    const refreshing = (async (): Promise<OAuthAuthDetails | undefined> => {\n      const result = await refreshAccessToken(\n        { access: cached?.access ?? '', expires: cached?.expires ?? 0, refresh: account.refresh },\n        { clientId: account.clientId },\n      )\n      if (result.type === 'success') {\n        if (!account.clientId && result.clientId) {\n          await this.store.mutate((s) => {\n            const target = s.accounts.find((candidate) => this.accountKey(candidate) === key)\n            if (!target) throw new Error(`Account ${key} not found during clientId migration`)\n            target.clientId = result.clientId\n          })\n          account.clientId = result.clientId\n        }\n        // Cache token strictly AFTER disk persistence has succeeded\n        this.tokenCache.set(key, { access: result.auth.access, expires: result.auth.expires })\n        return result.auth\n      }\n      if (result.type === 'failed') {\n        if (cached && !accessTokenExpired({ access: cached.access, expires: cached.expires, refresh: account.refresh })) {\n          return { access: cached.access, expires: cached.expires, refresh: account.refresh }\n        }\n        const kind = result.error.status === 429\n          ? 'rate-limit'\n          : result.error.status === 0 || result.error.status === 408 || result.error.status >= 500\n            ? 'transport'\n            : 'invalid-credential'\n        throw new AgyAuthError(kind, result.error.message, { cause: result.error })\n      }\n      if (result.type === 'revoked') {\n        // Account credentials are dead — mark it disabled and verificationRequired in the store\n        this.tokenCache.delete(key)\n        await this.store.mutate((s) => {\n          const target = s.accounts.find((candidate) => this.accountKey(candidate) === key)\n          if (target) {\n            target.enabled = false\n            target.verificationRequired = true\n            target.verificationRequiredAt = Date.now()\n            target.verificationRequiredReason = 'auth-failure'\n          }\n        })\n        account.enabled = false\n        account.verificationRequired = true\n        account.verificationRequiredAt = Date.now()\n        account.verificationRequiredReason = 'auth-failure'\n        return undefined\n      }\n      return undefined\n    })()\n    this.refreshInFlight.set(key, refreshing)\n    refreshing.then(\n      () => this.refreshInFlight.delete(key),\n      () => this.refreshInFlight.delete(key),\n    )\n    return refreshing\n  }\n\n  /** Resolve a usable access token for the account, pre-emptively refreshing near expiry. */\n  private async accessTokenFor(account: ManagedAccount): Promise<OAuthAuthDetails | undefined> {\n    const key = this.accountKey(account)\n    const cached = this.tokenCache.get(key)\n    const now = Date.now()\n    if (cached && !accessTokenExpired({ access: cached.access, expires: cached.expires, refresh: account.refresh })) {\n      // Pre-emptive refresh within the skew: serve the still-valid token and\n      // refresh in the background (OMP-style refresh skew).\n      if (cached.expires <= now + AgySessionManager.REFRESH_SKEW_MS) {\n        void this.refreshToken(key, account, cached)\n      }\n      return { access: cached.access, expires: cached.expires, refresh: account.refresh }\n    }\n    return this.refreshToken(key, account, cached)\n  }\n\n  /**\n   * Refresh stale per-account quota caches (family-scoped, health-based TTL).\n   * Failures leave the account unmeasured: ranking treats it as a fallback\n   * instead of blocking selection on a hung endpoint.\n   */\n  private async refreshQuotaCache(storage: AccountStorageV4): Promise<void> {\n    const now = Date.now()\n    const stale = storage.accounts.filter((account) => account.enabled !== false && isQuotaStale(account, now))\n    if (stale.length === 0) return\n\n    const results = await Promise.all(stale.map(async (account) => {\n      const key = this.accountKey(account)\n      if (this.quotaRefreshInFlight.has(key)) return this.quotaRefreshInFlight.get(key)\n      const refresh = (async () => {\n        try {\n          const auth = await this.accessTokenFor(account)\n          if (!auth) return null\n          const { fetchAvailableModels } = await import('./adapter/models.ts')\n          const boundedFetch: typeof fetch = (input, init) => {\n            const timeout = AbortSignal.timeout(AgySessionManager.QUOTA_FETCH_TIMEOUT_MS)\n            const signal = init?.signal ? AbortSignal.any([init.signal, timeout]) : timeout\n            return fetch(input, { ...init, signal })\n          }\n          const discovered = await fetchAvailableModels(auth.access, account.projectId, boundedFetch)\n          const quotas = ingestFamilyQuotas(discovered)\n          return { key, quotas, updatedAt: Date.now() }\n        } catch {\n          return null\n        }\n      })()\n      this.quotaRefreshInFlight.set(key, refresh)\n      try {\n        return await refresh\n      } finally {\n        this.quotaRefreshInFlight.delete(key)\n      }\n    }))\n\n    const updates = results.filter((r): r is { key: string; quotas: Record<string, CachedQuota>; updatedAt: number } => Boolean(r && Object.keys(r.quotas).length > 0))\n    if (updates.length > 0) {\n      for (const update of updates) {\n        const target = storage.accounts.find((candidate) => this.accountKey(candidate) === update.key)\n        if (target) {\n          target.cachedQuota = update.quotas\n          target.cachedQuotaUpdatedAt = update.updatedAt\n        }\n      }\n      try {\n        await this.store.mutate((s) => {\n          for (const update of updates) {\n            const target = s.accounts.find((candidate) => this.accountKey(candidate) === update.key)\n            if (target) {\n              target.cachedQuota = update.quotas\n              target.cachedQuotaUpdatedAt = update.updatedAt\n            }\n          }\n        })\n      } catch {\n        // Quota is a derived cache — a failed write degrades gracefully without\n        // failing the active request (next refresh cycle re-ingests).\n      }\n    }\n  }\n\n  /**\n   * Pick the account for one request: the affinity pin wins while it is fresh,\n   * healthy, and not drained for the requested model; otherwise the pool is\n   * ranked by family-scoped usage (OMP-aligned) and the best candidate wins.\n   */\n  private async pickAccount(storage: AccountStorageV4, model?: string): Promise<{ account: ManagedAccount; index: number } | undefined> {\n    const now = Date.now()\n    for (const account of storage.accounts) clearExpiredState(account, now)\n\n    const family = modelFamilyOf(model)\n    const familyKey = familyKeyOf(model)\n    // Session affinity (time-window approximation): reuse the last-used account\n    // while it is fresh and healthy, so one conversation stays on one account\n    // (upstream prefix cache + sessionId continuity). A drained family or a\n    // cooldown breaks the pin and re-ranks, mirroring OMP's pinned-until-unusable.\n    if (this.lastUsed && now - this.lastUsed.at < SESSION_AFFINITY_WINDOW_MS) {\n      const lastIndex = storage.accounts.findIndex((a) => this.accountKey(a) === this.lastUsed!.key)\n      if (lastIndex !== -1) {\n        const last = storage.accounts[lastIndex]!\n        if (\n          last.enabled !== false &&\n          !isCoolingDown(last, now) &&\n          !isFamilyRateLimited(last, familyKey, now) &&\n          !isFamilyDrained(last, family, now)\n        ) {\n          return { account: last, index: lastIndex }\n        }\n      }\n    }\n    const eligible = storage.accounts\n      .map((account, index) => ({ account, index }))\n      .filter(({ account }) => account.enabled !== false)\n    if (eligible.length === 0) return undefined\n\n    const ranked = rankPoolCandidates(eligible, model, now, storage.activeIndex)\n    const picked = ranked.find((candidate) => candidate.blockedUntil === null)\n    if (!picked) {\n      const quotaExhausted = (account: ManagedAccount): boolean => {\n        if (account.cooldownReason === 'quota-exhausted' && (account.coolingDownUntil ?? 0) > now) return true\n        const quota = familyQuotaFor(account, family)\n        if ((quota?.remainingFraction ?? 1) > 0 || !quota?.resetTime) return false\n        const resetAt = Date.parse(quota.resetTime)\n        return !Number.isNaN(resetAt) && resetAt > now\n      }\n      const retryable = ranked.filter((candidate) => !quotaExhausted(candidate.account))\n      const blocked = retryable.length > 0 ? retryable : ranked\n      const blockedUntil = Math.min(...blocked.map((candidate) => candidate.blockedUntil ?? now))\n      throw new AgyPoolBlockedError(retryable.length > 0 ? 'retryable' : 'quota-exhausted', blockedUntil)\n    }\n    if (picked.index !== storage.activeIndex) {\n      storage.activeIndex = picked.index\n      await this.store.mutate((s) => {\n        s.activeIndex = picked.index\n      })\n    }\n    return { account: picked.account, index: picked.index }\n  }\n  /**\n   * Adapter hook: resolve the active session (refresh if needed), healing a\n   * missing projectId at request time — the OAuth-time loadCodeAssist may have\n   * transiently failed even when the Google account owns a Cloud Code project\n   * (mirrors OmniRoute's ensureAntigravityProjectAssigned + persistence).\n   * @param model - requested model id; drives family-scoped quota ranking.\n   */\n  async getSession(model?: string): Promise<AgyAccountSession | undefined> {\n    let storage = await this.store.load()\n    const maxAttempts = storage.accounts.filter((account) => account.enabled !== false).length\n\n    for (let attempt = 0; attempt < maxAttempts; attempt++) {\n      const eligible = storage.accounts.filter((account) => account.enabled !== false)\n      if (eligible.length > 1) {\n        await this.refreshQuotaCache(storage)\n        // In-memory overlay on storage already took place in refreshQuotaCache.\n      }\n      const picked = await this.pickAccount(storage, model)\n      if (!picked) return undefined\n      const auth = await this.accessTokenFor(picked.account)\n      if (!auth) {\n        // The selected credential was revoked and disabled by accessTokenFor.\n        // Re-read and select another enabled account within this same request.\n        this.lastUsed = null\n        storage = await this.store.load()\n        continue\n      }\n\n      const key = this.accountKey(picked.account)\n      if (!picked.account.projectId && !this.projectRetryFailed.has(key)) {\n        try {\n          const { loadCodeAssist } = await import('./oauth/exchange.ts')\n          const { projectId } = await loadCodeAssist(auth.access)\n          if (projectId) {\n            await this.store.mutate((s) => {\n              const account = s.accounts.find((candidate) => this.accountKey(candidate) === key)\n              if (account) {\n                account.projectId = projectId\n                // Keep the packed refresh string in sync.\n                const parts = parseRefreshParts(account.refresh)\n                account.refresh = formatRefreshParts({\n                  refreshToken: parts.refreshToken,\n                  projectId,\n                  managedProjectId: parts.managedProjectId,\n                })\n              }\n            })\n            picked.account.projectId = projectId\n          } else {\n            this.projectRetryFailed.add(key)\n          }\n        } catch {\n          this.projectRetryFailed.add(key)\n        }\n      }\n\n      this.lastUsed = { key, at: Date.now() }\n      return {\n        auth,\n        account: picked.account,\n        index: picked.index,\n        impersonation: impersonationHeadersFor(picked.account),\n      }\n    }\n\n    return undefined\n  }\n\n  /** Adapter hook: apply rotation decisions and fingerprint regeneration. */\n  async reportFailure(\n    kind: FailureKind,\n    session: AgyAccountSession,\n    info?: {\n      retryAfterMs?: number\n      status?: number\n      rateLimitCategory?: import('./runtime/classify.ts').RateLimitCategory\n      /** Server-reported absolute reset time; drives precise cooldowns. */\n      resetTime?: string\n      /** Requested model id; drives family-scoped rate-limit bookkeeping. */\n      model?: string\n    },\n  ): Promise<void> {\n    if (!session?.account) return\n    const key = this.accountKey(session.account)\n    const consecutive = (this.failureCounts.get(key) ?? 0) + 1\n    this.failureCounts.set(key, consecutive)\n    let nextIndexToRotate: number | null = null\n    const fpCachedVersion = kind === 'rate-limit' ? peekCachedAntigravityVersion() : null\n    const fpResolvedVersion = (kind === 'rate-limit' && !fpCachedVersion) ? await resolveAntigravityVersionBounded() : (fpCachedVersion ?? '1.18.3')\n\n    await this.store.mutate((storage) => {\n      const account = storage.accounts.find((a) => this.accountKey(a) === key)\n      if (!account) return\n\n      const decision = decideRotation(kind, account, consecutive, info?.retryAfterMs, info?.rateLimitCategory, info?.resetTime)\n\n      if (kind === 'rate-limit' && info?.rateLimitCategory !== 'soft_rate_limit') {\n        // Family-scoped bookkeeping of the real reset (display + ranking wall).\n        // Soft rate limits are transient bursts handled via immediate retry — do not block the family.\n        const familyKey = familyKeyOf(info?.model)\n        const resetMs = parseFutureResetMs(info?.resetTime, Date.now()) ??\n          (Date.now() + Math.min(info?.retryAfterMs ?? RATE_LIMIT_COOLDOWN_MS, MAX_RATE_LIMIT_COOLDOWN_MS))\n        recordRateLimit(account, familyKey, resetMs)\n      }\n\n      if (decision.action === 'revoke') {\n        this.tokenCache.delete(key)\n        this.failureCounts.delete(key)\n        return\n      }\n\n      // Fingerprint lifecycle: create on first rate-limit, regenerate after\n      // repeated failures (bounded by history inside recordFingerprintVersion).\n      // UA versions come from the version resolver (bounded, cached 6h) so\n      // fingerprints never pin a stale Antigravity client version. The `stable`\n      // risk mode pins one identity per account: create once, never regenerate.\n      if (kind === 'rate-limit' && info?.rateLimitCategory !== 'soft_rate_limit') {\n        if (!account.fingerprint) {\n          account.fingerprint = generateFingerprint(undefined, fpResolvedVersion)\n          account.fingerprintHistory = recordFingerprintVersion(account.fingerprintHistory, account.fingerprint, 'initial')\n        } else {\n          if (fpCachedVersion) updateFingerprintVersion(account.fingerprint, fpCachedVersion)\n          if (fingerprintMode() !== 'stable' && consecutive >= 2) {\n            const fresh = generateFingerprint(undefined, fpResolvedVersion)\n            account.fingerprintHistory = recordFingerprintVersion(account.fingerprintHistory, fresh, 'regenerated')\n            account.fingerprint = fresh\n          }\n        }\n      }\n\n      if (decision.action === 'rotate') {\n        const currentIndex = storage.accounts.findIndex((a) => this.accountKey(a) === key)\n        const familyKey = familyKeyOf(info?.model)\n        const nextIndex = pickNextAccountIndex(storage.accounts, currentIndex >= 0 ? currentIndex : storage.activeIndex, Date.now(), familyKey)\n        if (nextIndex !== storage.activeIndex) {\n          storage.activeIndex = nextIndex\n          nextIndexToRotate = nextIndex\n        }\n        this.lastUsed = null\n      }\n    })\n\n    if (nextIndexToRotate !== null) {\n      this.onRotate?.(session.index, nextIndexToRotate, kind)\n    }\n  }\n  /** Adapter hook: reset the failure counter after a clean completion. */\n  async markSuccess(session: AgyAccountSession): Promise<void> {\n    const account = session.account\n    const key = this.accountKey(account)\n    this.failureCounts.delete(key)\n  }\n\n  /**\n   * Test call: one short streaming request against the live backend.\n   * Returns the collected text or a structured error message.\n   */\n  async testCall(model: string, prompt = 'Reply with exactly: OK', maxTokens = 1024): Promise<{ ok: boolean; text?: string; error?: string }> {\n    try {\n      const session = await this.getSession(model)\n      if (!session) return { ok: false, error: 'No agy account configured — run `dsh-agy login` first.' }\n      const { toAgyRequestBody } = await import('./adapter/translate.ts')\n      const { fetchAgyFirstOk } = await import('./oauth/constants.ts')\n      const { parseAgySse } = await import('./adapter/parse.ts')\n      const body = toAgyRequestBody(\n        {\n          provider: 'agy',\n          model,\n          messages: [{ id: 'test-1', role: 'user', content: [{ type: 'text', text: prompt }] }],\n          maxTokens,\n        } as never,\n        { projectId: session.account.projectId, sessionId: deriveAntigravitySessionId(session.account.email) ?? undefined },\n      )\n      const headers = {\n        authorization: `Bearer ${session.auth.access}`,\n        'content-type': 'application/json',\n        accept: 'text/event-stream',\n        ...session.impersonation,\n      }\n      const response = await fetchAgyFirstOk('/v1internal:streamGenerateContent?alt=sse', {\n        method: 'POST',\n        headers,\n        body: JSON.stringify(body),\n      })\n      if (!response.ok) {\n        const text = await response.text().catch(() => '')\n        return { ok: false, error: `HTTP ${response.status}: ${text.slice(0, 300)}` }\n      }\n      if (!response.body) return { ok: false, error: 'no response body' }\n      const text: string[] = []\n      for await (const chunk of parseAgySse(response.body)) {\n        if (chunk.type === 'text-delta') text.push(chunk.text)\n      }\n      return { ok: text.length > 0, text: text.join(''), error: text.length > 0 ? undefined : 'empty response' }\n    } catch (error) {\n      return { ok: false, error: error instanceof Error ? error.message : String(error) }\n    }\n  }\n\n  /** Export one account as a paste-credential blob (for migration to another host). */\n  async exportBlob(index: number): Promise<{ blob?: string; error?: string }> {\n    const storage = await this.store.load()\n    const account = storage.accounts[index]\n    if (!account) return { error: 'account not found' }\n    try {\n      const auth = await this.accessTokenFor(account)\n      if (!auth) return { error: 'refresh failed (revoked?)' }\n      const { encodeCredentialBlob } = await import('./oauth/blob.ts')\n      const parts = parseRefreshParts(account.refresh)\n      return {\n        blob: encodeCredentialBlob('agy', {\n          access_token: auth.access,\n          refresh_token: parts.refreshToken,\n          expires_in: Math.max(0, Math.round((auth.expires - Date.now()) / 1000)),\n        }),\n      }\n    } catch (error) {\n      return { error: error instanceof Error ? error.message : String(error) }\n    }\n  }\n\n  /** Probe one account: refresh + userinfo; a live credential re-enables the account. */\n  private async probeAccount(index: number, account: ManagedAccount): Promise<{ ok: boolean; email?: string; error?: string }> {\n    try {\n      const auth = await this.accessTokenFor(account)\n      if (!auth) return { ok: false, error: 'refresh failed (revoked?)' }\n      const response = await proxiedFetch('https://www.googleapis.com/oauth2/v1/userinfo?alt=json', {\n        headers: { Authorization: `Bearer ${auth.access}` },\n      })\n      if (!response.ok) return { ok: false, error: `userinfo ${response.status}` }\n      const info = (await response.json()) as { email?: string }\n      // Credentials are live again — clear any auth-failure disable so the\n      // account re-enters rotation without a manual re-import.\n      await this.store.mutate((s) => {\n        const target = s.accounts[index]\n        if (target) {\n          target.enabled = true\n          target.verificationRequired = false\n          target.verificationRequiredAt = undefined\n          target.verificationRequiredReason = undefined\n          target.verificationUrl = undefined\n        }\n      })\n      return { ok: true, email: info.email }\n    } catch (error) {\n      return { ok: false, error: error instanceof Error ? error.message : String(error) }\n    }\n  }\n\n  /** CLI/web helper: verify an account's credentials (refresh + userinfo). */\n  async verifyAccount(index: number): Promise<{ ok: boolean; email?: string; error?: string }> {\n    const storage = await this.store.load()\n    const account = storage.accounts[index]\n    if (!account) return { ok: false, error: 'account not found' }\n    return this.probeAccount(index, account)\n  }\n\n  /**\n   * Batch health check over all enabled accounts (or the given indices):\n   * refresh + userinfo per account, live credentials re-enable the account.\n   * Reports results through onHealthReport when a listener is registered.\n   */\n  async checkAccounts(indices?: number[]): Promise<AccountHealthResult[]> {\n    const storage = await this.store.load()\n    const targets = indices !== undefined\n      ? indices.filter((index) => storage.accounts[index])\n      : storage.accounts.map((_, index) => index).filter((index) => storage.accounts[index]!.enabled !== false)\n\n    const results: AccountHealthResult[] = await Promise.all(targets.map(async (index) => {\n      const probed = await this.probeAccount(index, storage.accounts[index]!)\n      return { index, ...probed }\n    }))\n    this.onHealthReport?.(results)\n    return results\n  }\n\n  /**\n   * Start a background health probe on an interval (disposable stop handle).\n   * The timer is unref'd unless told otherwise so harness processes can still\n   * exit; the CLI loop mode passes `unref: false`.\n   */\n  startHealthProbe(intervalMs: number, options: { unref?: boolean } = {}): () => void {\n    if (!Number.isFinite(intervalMs) || intervalMs <= 0) return () => {}\n    const timer = setInterval(() => {\n      void this.checkAccounts().catch(() => {})\n    }, intervalMs)\n    if (options.unref !== false) timer.unref?.()\n    return () => clearInterval(timer)\n  }\n}\n\nexport type { Fingerprint }\n","/**\n * Master-key management and AES-256-GCM secret codec for the account store.\n *\n * The master key lives in the DSH credentials document (`~/.dsh/.credentials.yaml`,\n * 0600) under `AGY_MASTER_KEY` so both the in-harness plugin (via\n * `ctx.credentials`) and the standalone `dsh-agy` CLI (direct file read) can\n * encrypt and decrypt the same account store.\n */\n\nimport { createCipheriv, createDecipheriv, createHash, randomBytes } from 'node:crypto'\nimport { readFileSync, renameSync, writeFileSync } from 'node:fs'\nimport { dirname, join, resolve } from 'node:path'\nimport { existsSync, mkdirSync, statSync } from 'node:fs'\n\nexport const MASTER_KEY_REF = 'AGY_MASTER_KEY'\n\n/** Encrypt/decrypt secrets at rest. */\nexport interface SecretCodec {\n  encrypt(plaintext: string): string\n  decrypt(payload: string): string\n}\n\nconst ENC_PREFIX = 'enc:v1:'\n\n/** AES-256-GCM codec; ciphertext format `enc:v1:<iv-b64>:<tag-b64>:<data-b64>`. */\nexport function createAesGcmCodec(key: Buffer): SecretCodec {\n  if (key.length !== 32) {\n    throw new Error(`createAesGcmCodec: master key must be 32 bytes, got ${key.length}`)\n  }\n  return {\n    encrypt(plaintext: string): string {\n      const iv = randomBytes(12)\n      const cipher = createCipheriv('aes-256-gcm', key, iv)\n      const data = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()])\n      const tag = cipher.getAuthTag()\n      return `${ENC_PREFIX}${iv.toString('base64url')}:${tag.toString('base64url')}:${data.toString('base64url')}`\n    },\n    decrypt(payload: string): string {\n      if (!payload.startsWith(ENC_PREFIX)) {\n        throw new Error('decrypt: payload is not in encrypted format')\n      }\n      const [, , ivB64 = '', tagB64 = '', dataB64 = ''] = payload.split(':')\n      const decipher = createDecipheriv('aes-256-gcm', key, Buffer.from(ivB64, 'base64url'))\n      decipher.setAuthTag(Buffer.from(tagB64, 'base64url'))\n      const plain = Buffer.concat([decipher.update(Buffer.from(dataB64, 'base64url')), decipher.final()])\n      return plain.toString('utf8')\n    },\n  }\n}\n\n/** Derive a 32-byte key from an arbitrary master-key string (SHA-256). */\nexport function deriveKey(masterKey: string): Buffer {\n  return createHash('sha256').update(masterKey, 'utf8').digest()\n}\n\n/** Default DSH home (`~/.dsh`), honoring `$DSH_HOME`. */\nexport function resolveDshHome(): string {\n  return process.env.DSH_HOME ? resolve(process.env.DSH_HOME) : join(homedir(), '.dsh')\n}\n\nfunction homedir(): string {\n  return process.env.HOME ?? process.env.USERPROFILE ?? '.'\n}\n\n/**\n * Minimal reader for the DSH credentials document: a flat YAML mapping of\n * `KEY: \"value\"` / `KEY: value` lines. Values are unquoted with JSON-style\n * escaping for double-quoted scalars; anything more complex fails loudly.\n */\nexport function readCredentialsDocument(file: string): Map<string, string> {\n  if (!existsSync(file)) return new Map()\n  const entries = new Map<string, string>()\n  const text = readFileSync(file, 'utf8')\n  for (const line of text.split(/\\r?\\n/)) {\n    const trimmed = line.trim()\n    if (!trimmed || trimmed.startsWith('#') || trimmed.startsWith('---')) continue\n    const match = /^([A-Za-z_][A-Za-z0-9_]*):\\s*(.*)$/.exec(trimmed)\n    if (!match) continue\n    const [, key = '', rawValue = ''] = match\n    let value: string\n    if (rawValue.startsWith('\"')) {\n      try {\n        value = JSON.parse(rawValue) as string\n      } catch {\n        throw new Error(`readCredentialsDocument: invalid quoted value for \"${key}\" in ${file}`)\n      }\n    } else if (rawValue.startsWith(\"'\")) {\n      if (!rawValue.endsWith(\"'\") || rawValue.length < 2) {\n        throw new Error(`readCredentialsDocument: unterminated single-quoted value for \"${key}\" in ${file}`)\n      }\n      value = rawValue.slice(1, -1).replace(/''/g, \"'\")\n    } else {\n      value = rawValue\n    }\n    if (value.length === 0) continue\n    entries.set(key, value)\n  }\n  return entries\n}\n\n/**\n * POSIX owner-only enforcement. Windows mode bits never report 0600 (and\n * chmod is a no-op there), so the check is skipped on win32; the encrypted\n * account file and credentials document remain the only defense-in-depth\n * layer on that platform.\n */\nexport function assertOwnerOnly(file: string): void {\n  if (process.platform === 'win32') return\n  const mode = statSync(file).mode & 0o777\n  if (mode !== 0o600) {\n    throw new Error(\n      `dsh-agy: ${file} is readable beyond its owner (mode ${mode.toString(8)}); ` +\n        'run \"chmod 600\" before starting again',\n    )\n  }\n}\n\n/**\n * Load the master key from the DSH credentials document. Returns undefined when\n * the document or the reference is absent.\n */\nexport function loadMasterKey(dshHome: string): string | undefined {\n  const file = join(dshHome, '.credentials.yaml')\n  if (!existsSync(file)) return undefined\n  assertOwnerOnly(file)\n  return readCredentialsDocument(file).get(MASTER_KEY_REF)\n}\n\n/**\n * Generate and persist a fresh master key (0600) in the DSH credentials document.\n *\n * Append-only + atomic rename: the DSH credentials service owns this file and\n * preserves comments and the formatting of untouched entries (and may hold\n * YAML constructs this minimal reader cannot parse). Rewriting the whole file\n * from our parsed view would silently drop those; appending keeps them.\n */\nexport function persistMasterKey(dshHome: string, masterKey: string): void {\n  const file = join(dshHome, '.credentials.yaml')\n  mkdirSync(dirname(file), { recursive: true })\n  const existingText = existsSync(file) ? readFileSync(file, 'utf8') : ''\n  if (existingText.length > 0 && readCredentialsDocument(file).has(MASTER_KEY_REF)) {\n    throw new Error(`persistMasterKey: ${MASTER_KEY_REF} already exists in ${file}`)\n  }\n  const entry = `${MASTER_KEY_REF}: ${JSON.stringify(masterKey)}`\n  const next = existingText.length > 0 && !existingText.endsWith('\\n')\n    ? `${existingText}\\n${entry}\\n`\n    : `${existingText}${entry}\\n`\n  const tmp = `${file}.tmp-masterkey`\n  writeFileSync(tmp, next, { mode: 0o600 })\n  renameSync(tmp, file)\n}\n\n/**\n * Resolve (load or create) the master key for a dsh home, then build the codec.\n * Creating a key writes the credentials document; read-only setups should call\n * {@link loadMasterKey} first and surface a friendly error instead.\n */\nexport function resolveMasterKeyCodec(dshHome: string): { codec: SecretCodec; created: boolean } {\n  let masterKey = loadMasterKey(dshHome)\n  let created = false\n  if (!masterKey) {\n    masterKey = randomBytes(32).toString('hex')\n    persistMasterKey(dshHome, masterKey)\n    created = true\n  }\n  return { codec: createAesGcmCodec(deriveKey(masterKey)), created }\n}\n","/**\n * Account pool store: an interface plus a JSON-file implementation\n * (proper-lockfile cross-process mutual exclusion, 0600 permissions, versioned\n * migrations, AES-encrypted refresh tokens) and an in-memory fake for tests.\n */\n\nimport { existsSync, mkdirSync, readFileSync, renameSync, statSync, writeFileSync } from 'node:fs'\nimport { dirname } from 'node:path'\nimport { randomUUID } from 'node:crypto'\nimport lockfile from 'proper-lockfile'\nimport type {\n  AccountStorage,\n  AccountStorageV1,\n  AccountStorageV2,\n  AccountStorageV3,\n  AccountStorageV4,\n  ManagedAccount,\n} from '../types.ts'\nimport { assertOwnerOnly } from './keyring.ts'\nimport type { SecretCodec } from './keyring.ts'\n\nexport const CURRENT_STORAGE_VERSION = 4\nconst ENC_PREFIX = 'enc:v1:'\n\n/** Cross-process file lock adapter (proper-lockfile behind a small seam for tests). */\nexport interface FileLock {\n  withLock<T>(file: string, fn: () => Promise<T>): Promise<T>\n}\n\nexport const properFileLock: FileLock = {\n  async withLock<T>(file: string, fn: () => Promise<T>): Promise<T> {\n    const release = await lockfile.lock(file, {\n      stale: 30_000,\n      update: 10_000,\n      retries: { retries: 10, factor: 1.5, minTimeout: 50, maxTimeout: 2_000 },\n    })\n    try {\n      return await fn()\n    } finally {\n      await release()\n    }\n  },\n}\n\n/** No-op lock for tests / single-process use. */\nexport const noopFileLock: FileLock = {\n  async withLock<T>(_file: string, fn: () => Promise<T>): Promise<T> {\n    return fn()\n  },\n}\n\nexport interface AccountStore {\n  /** Load the current (migrated) storage document. */\n  load(): Promise<AccountStorageV4>\n  /** Persist the full document (encrypting secrets). */\n  save(storage: AccountStorageV4): Promise<void>\n  /** Load-mutate-save atomically under the file lock; returns the mutation result. */\n  mutate<T>(fn: (storage: AccountStorageV4) => T | Promise<T>): Promise<T>\n}\n\nexport interface JsonAccountStoreOptions {\n  file: string\n  codec: SecretCodec\n  lock?: FileLock\n}\n\nfunction isEncrypted(value: string): boolean {\n  return value.startsWith(ENC_PREFIX)\n}\n\n/** Decrypt one account's refresh field when encrypted; plaintext passes through (legacy). */\nfunction decryptAccount(account: ManagedAccount, codec: SecretCodec): ManagedAccount {\n  if (isEncrypted(account.refresh)) {\n    return { ...account, refresh: codec.decrypt(account.refresh) }\n  }\n  return account\n}\n\n/** Encrypt one account's refresh field (plaintext stays plaintext if no codec change). */\nfunction encryptAccount(account: ManagedAccount, codec: SecretCodec): ManagedAccount {\n  if (!isEncrypted(account.refresh)) {\n    return { ...account, refresh: codec.encrypt(account.refresh) }\n  }\n  return account\n}\n\nexport function ensureAccountIds(storage: AccountStorageV4): { storage: AccountStorageV4; mutated: boolean } {\n  let mutated = false\n  const seenIds = new Set<string>()\n  for (const account of storage.accounts) {\n    if (!account.id || seenIds.has(account.id)) {\n      account.id = randomUUID()\n      mutated = true\n    }\n    seenIds.add(account.id)\n  }\n  return { storage, mutated }\n}\n\nexport function decryptStorage(storage: AccountStorageV4, codec: SecretCodec): AccountStorageV4 {\n  return { ...storage, accounts: storage.accounts.map((a) => decryptAccount(a, codec)) }\n}\n\nexport function encryptStorage(storage: AccountStorageV4, codec: SecretCodec): AccountStorageV4 {\n  return { ...storage, accounts: storage.accounts.map((a) => encryptAccount(a, codec)) }\n}\n// ──── Migrations ────────────────────────────────────────────────────────────\n\nexport function migrateV1ToV2(v1: AccountStorageV1): AccountStorageV2 {\n  return {\n    version: 2,\n    accounts: v1.accounts.map((acc) => ({\n      email: acc.email,\n      refreshToken: acc.refreshToken,\n      projectId: acc.projectId,\n      managedProjectId: acc.managedProjectId,\n      addedAt: acc.addedAt,\n      lastUsed: acc.lastUsed,\n      lastSwitchReason: acc.lastSwitchReason,\n      rateLimitResetTimes: acc.isRateLimited && acc.rateLimitResetTime\n        ? { default: acc.rateLimitResetTime }\n        : undefined,\n    })),\n    activeIndex: v1.activeIndex,\n  }\n}\n\nexport function migrateV2ToV3(v2: AccountStorageV2): AccountStorageV3 {\n  return {\n    version: 3,\n    accounts: v2.accounts.map((acc) => ({\n      email: acc.email,\n      refresh: `${acc.refreshToken}|${acc.projectId ?? ''}|${acc.managedProjectId ?? ''}`,\n      projectId: acc.projectId,\n      managedProjectId: acc.managedProjectId,\n      addedAt: acc.addedAt,\n      lastUsed: acc.lastUsed,\n      enabled: true,\n      lastSwitchReason: acc.lastSwitchReason,\n      rateLimitResetTimes: acc.rateLimitResetTimes,\n    })),\n    activeIndex: v2.activeIndex,\n  }\n}\n\nexport function migrateV3ToV4(v3: AccountStorageV3): AccountStorageV4 {\n  return { version: 4, accounts: v3.accounts, activeIndex: v3.activeIndex }\n}\n\nexport function migrateStorage(raw: AccountStorage): AccountStorageV4 {\n  switch (raw.version) {\n    case 1:\n      return migrateStorage(migrateV1ToV2(raw))\n    case 2:\n      return migrateStorage(migrateV2ToV3(raw))\n    case 3:\n      return migrateStorage(migrateV3ToV4(raw))\n    case 4:\n      return raw\n    default:\n      throw new Error(`migrateStorage: unsupported storage version ${(raw as { version: number }).version}`)\n  }\n}\n\n// ──── JSON file implementation ──────────────────────────────────────────────\n\nexport class JsonAccountStore implements AccountStore {\n  private readonly file: string\n  private readonly codec: SecretCodec\n  private readonly lock: FileLock\n\n  constructor(options: JsonAccountStoreOptions) {\n    this.file = options.file\n    this.codec = options.codec\n    this.lock = options.lock ?? properFileLock\n  }\n\n  private ensureFile(): void {\n    if (existsSync(this.file)) return\n    mkdirSync(dirname(this.file), { recursive: true })\n    const tmp = `${this.file}.tmp-init`\n    writeFileSync(tmp, JSON.stringify({ version: CURRENT_STORAGE_VERSION, accounts: [], activeIndex: 0 }) + '\\n', { mode: 0o600 })\n    renameSync(tmp, this.file)\n  }\n\n  private readAndMigrateUnlocked(): { storage: AccountStorageV4; mutated: boolean } {\n    let text: string\n    try {\n      text = readFileSync(this.file, 'utf8')\n    } catch (error) {\n      if ((error as NodeJS.ErrnoException).code === 'ENOENT') {\n        return { storage: { version: CURRENT_STORAGE_VERSION, accounts: [], activeIndex: 0 }, mutated: false }\n      }\n      throw error\n    }\n    assertOwnerOnly(this.file)\n    const raw = JSON.parse(text) as AccountStorage\n    const migrated = migrateStorage(raw)\n    const decrypted = decryptStorage(migrated, this.codec)\n    return ensureAccountIds(decrypted)\n  }\n\n  private writeUnlocked(storage: AccountStorageV4): void {\n    const encrypted = encryptStorage(ensureAccountIds(storage).storage, this.codec)\n    mkdirSync(dirname(this.file), { recursive: true })\n    const tmp = `${this.file}.tmp`\n    writeFileSync(tmp, JSON.stringify(encrypted, null, 2) + '\\n', { mode: 0o600 })\n    renameSync(tmp, this.file)\n  }\n\n  /**\n   * Materialize and persist generated/repaired UUIDs under the file lock:\n   * re-reads the fresh on-disk state under the lock so concurrent mutations\n   * are never clobbered by a stale pre-lock snapshot.\n   */\n  private async materializeIdsWithLock(): Promise<AccountStorageV4> {\n    this.ensureFile()\n    return this.lock.withLock(this.file, async () => {\n      const { storage, mutated } = this.readAndMigrateUnlocked()\n      if (mutated) {\n        this.writeUnlocked(storage)\n      }\n      return storage\n    })\n  }\n\n  async load(): Promise<AccountStorageV4> {\n    const { storage, mutated } = this.readAndMigrateUnlocked()\n    if (mutated) {\n      // Missing or duplicate IDs detected: atomically materialize and persist under the lock.\n      return this.materializeIdsWithLock()\n    }\n    return storage\n  }\n\n  async save(storage: AccountStorageV4): Promise<void> {\n    this.ensureFile()\n    await this.lock.withLock(this.file, async () => {\n      this.writeUnlocked(storage)\n    })\n  }\n\n  async mutate<T>(fn: (storage: AccountStorageV4) => T | Promise<T>): Promise<T> {\n    this.ensureFile()\n    return this.lock.withLock(this.file, async () => {\n      const { storage } = this.readAndMigrateUnlocked()\n      const result = await fn(storage)\n      this.writeUnlocked(storage)\n      return result\n    })\n  }\n}\n\n// ──── In-memory fake (the second adapter that justifies the seam) ───────────\n\nexport class InMemoryAccountStore implements AccountStore {\n  private storage: AccountStorageV4\n  private mutateChain: Promise<unknown> = Promise.resolve()\n\n  constructor(initial: AccountStorageV4 = { version: CURRENT_STORAGE_VERSION, accounts: [], activeIndex: 0 }) {\n    this.storage = ensureAccountIds(initial).storage\n  }\n\n  async load(): Promise<AccountStorageV4> {\n    const { storage, mutated } = ensureAccountIds(this.storage)\n    if (mutated) this.storage = storage\n    return structuredClone(this.storage)\n  }\n\n  async save(storage: AccountStorageV4): Promise<void> {\n    this.storage = structuredClone(ensureAccountIds(storage).storage)\n  }\n\n  async mutate<T>(fn: (storage: AccountStorageV4) => T | Promise<T>): Promise<T> {\n    const run = async () => {\n      const storage = structuredClone(ensureAccountIds(this.storage).storage)\n      const result = await fn(storage)\n      this.storage = ensureAccountIds(storage).storage\n      return result\n    }\n    const next = this.mutateChain.then(run, run)\n    this.mutateChain = next\n    return next\n  }\n}\n\n// ──── Pool helpers ──────────────────────────────────────────────────────────\n\n/** Keep one account per email (case-insensitive), first occurrence wins. */\nexport function deduplicateAccountsByEmail(accounts: ManagedAccount[]): ManagedAccount[] {\n  const seen = new Set<string>()\n  const result: ManagedAccount[] = []\n  for (const account of accounts) {\n    const key = account.email?.toLowerCase()\n    if (key && seen.has(key)) continue\n    if (key) seen.add(key)\n    result.push(account)\n  }\n  return result\n}\n\n/** Pick the active account, falling back to the first enabled one. */\nexport function resolveActiveAccount(\n  storage: AccountStorageV4,\n): { account: ManagedAccount; index: number } | undefined {\n  const accounts = storage.accounts\n  if (accounts.length === 0) return undefined\n  const active = accounts[storage.activeIndex]\n  if (active && active.enabled !== false) return { account: active, index: storage.activeIndex }\n  const fallbackIndex = accounts.findIndex((a) => a.enabled !== false)\n  if (fallbackIndex === -1) return undefined\n  return { account: accounts[fallbackIndex]!, index: fallbackIndex }\n}\n"],"mappings":";;;;;;;;;;;AAiKA,IAAa,eAAb,cAAkC,MAAM;CACtC;CAEA,YAAY,MAAwB,SAAiB,SAAwB;EAC3E,MAAM,SAAS,OAAO;EACtB,KAAK,OAAO;EACZ,KAAK,OAAO;CACd;AACF;;;;;AASA,IAAa,sBAAb,cAAyC,MAAM;CAC7C;CACA;CAEA,YAAY,MAAuB,cAAsB;EACvD,MAAM,SAAS,oBACX,0EACA,0EAA0E;EAC9E,KAAK,OAAO;EACZ,KAAK,OAAO;EACZ,KAAK,eAAe;CACtB;AACF;;;;;;;;;;ACpLA,MAAM,QAAQ,IAAI,kBAAkB;;AAMpC,MAAa,gBAA8B,OAAO,SAGhD,MAAM,OAAO;CAAE,GAAG;CAAM,YAAY;AAAa,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;ACRpD,MAAa,gBACX;AAEF,MAAa,oBAAoB;;;;;;AAOjC,SAAgB,4BAA4B,kBAAuE;CACjH,IAAI,kBAAkB;EACpB,IAAI,qBAAA,6EACF,OAAO;GAAE,UAAU;GAAe,cAAc;EAAkB;EAEpE,OAAO;GACL,UAAU;GACV,cAAc,QAAQ,IAAI,qBAAA;EAC5B;CACF;CACA,OAAO;EACL,UAAU,QAAQ,IAAI,iBAAA;EACtB,cAAc,QAAQ,IAAI,qBAAA;CAC5B;AACF;;;AAIA,MAAa,aAAgC;CAC3C;CACA;CACA;CACA;CACA;AACF;AAEA,MAAa,sBAAsB;AACnC,MAAa,kBAAkB;AAC/B,MAAa,qBAAqB;;AAGlC,MAAa,2BAA2B;;;;;;;AAQxC,MAAa,qBAAqB;AAClC,MAAa,oBAAoB;AACjC,MAAa,6BAA6B;AAC1C,MAAa,wBAAwB;;AAGrC,MAAa,yBAA4C;CACvD;CACA;CACA;CACA;AACF;;AAGA,MAAa,6CAA6B,IAAI,IAAI,CAAC,KAAK,GAAG,CAAC;;;;;;;AAQ5D,eAAsB,gBACpB,SACA,MACA,YAA0B,cACP;CACnB,IAAI,cAA+B;CACnC,KAAK,MAAM,gBAAgB,wBACzB,IAAI;EACF,MAAM,WAAW,MAAM,UAAU,GAAG,eAAe,WAAW,IAAI;EAClE,IAAI,CAAC,2BAA2B,IAAI,SAAS,MAAM,GAAG,OAAO;EAC7D,cAAc;CAChB,QAAQ,CAER;CAEF,IAAI,aAAa,OAAO;CACxB,MAAM,IAAI,MAAM,0BAA0B;AAC5C;;;AAIA,MAAa,uBAAuB;;AAGpC,SAAgB,yBAAyB,UAAU,sBAA8B;CAC/E,OAAO,gGAAgG,QAAQ;AACjH;;;AAIA,SAAgB,gCAAwC;CACtD,OAAO;AACT;;;;;;;;AC1GA,SAAgB,+BAAuC;CACrD,OAAO,SAAS,KAAK,IAAI,EAAE,GAAG,YAAY,CAAC,CAAC,CAAC,SAAS,KAAK;AAC7D;AAiBA,MAAM,iBAAiB,CAAC;AACxB,MAAM,gBAAgB;;AAGtB,SAAgB,QAAQ,OAAuB;CAC7C,IAAI,OAAO;CACX,KAAK,IAAI,IAAI,GAAG,IAAI,MAAM,QAAQ,KAAK;EACrC,QAAQ,OAAO,MAAM,WAAW,CAAC,CAAC;EAClC,OAAO,OAAO,OAAO,IAAI,OAAO,aAAa;CAC/C;CACA,OAAO;AACT;;;;;;AAOA,SAAgB,2BAA2B,YAAsD;CAC/F,IAAI,CAAC,cAAc,WAAW,KAAK,CAAC,CAAC,WAAW,GAAG,OAAO;CAC1D,MAAM,OAAO,QAAQ,WAAW,KAAK,CAAC;CAItC,OAAO,MADQ,OAAO,KAAK,CAAC,OAAO,QACd,qBAAA,CAAQ,SAAS;AACxC;;;;;;;;;AC1CA,MAAM,uBAAuB;AAC7B,MAAM,2BAA2B;;AAGjC,MAAM,uBAAuB;;AAE7B,MAAM,kBAAkB;AAWxB,SAAS,cAAc,GAAW,GAAmB;CACnD,MAAM,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,OAAO,CAAC,KAAK,CAAC;CACjD,MAAM,KAAK,EAAE,MAAM,GAAG,CAAC,CAAC,KAAK,MAAM,OAAO,CAAC,KAAK,CAAC;CACjD,KAAK,IAAI,IAAI,GAAG,IAAI,GAAG,KAAK;EAC1B,MAAM,QAAQ,GAAG,MAAM,MAAM,GAAG,MAAM;EACtC,IAAI,SAAS,GAAG,OAAO;CACzB;CACA,OAAO;AACT;AAEA,SAAS,kBAAkB,GAAG,UAAyC;CACrE,MAAM,QAAQ,SACX,QAAQ,MAAmB,OAAO,MAAM,YAAY,kBAAkB,KAAK,CAAC,CAAC;CAChF,IAAI,MAAM,WAAW,GAAG,OAAO;CAC/B,OAAO,MAAM,QAAuB,MAAM,MAAO,CAAC,QAAQ,cAAc,GAAG,IAAI,IAAI,IAAI,IAAI,MAAO,IAAI;AACxG;AAEA,SAAS,oBAAoB,SAAiC;CAC5D,IAAI,CAAC,MAAM,QAAQ,OAAO,GAAG,OAAO;CACpC,OAAO,kBAAkB,GAAG,QAAQ,KAAK,UAAW,OAAiC,OAAO,CAAC;AAC/F;AAEA,SAAS,gBAAgB,SAAiC;CACxD,IAAI,CAAC,WAAW,OAAO,YAAY,UAAU,OAAO;CACpD,MAAM,UAAU;CAChB,OAAO,kBAAkB,QAAQ,YAAY,QAAQ,IAAI;AAC3D;AAEA,eAAe,qBAAqB,WAAsB,KAA+B;CACvF,MAAM,aAAa,IAAI,gBAAgB;CACvC,MAAM,YAAY,iBAAiB,WAAW,MAAM,GAAG,wBAAwB;CAC/E,IAAI;EACF,MAAM,WAAW,MAAM,UAAU,KAAK;GACpC,SAAS;IAAE,QAAQ;IAAoB,cAAc;GAAc;GACnE,QAAQ,WAAW;EACrB,CAAC;EACD,IAAI,CAAC,SAAS,IAAI,MAAM,IAAI,MAAM,kBAAkB,IAAI,YAAY,SAAS,QAAQ;EACrF,OAAO,SAAS,KAAK;CACvB,UAAU;EACR,aAAa,SAAS;CACxB;AACF;AAEA,eAAe,sBACb,OACA,UACA,WACA,OACA,WACiB;CACjB,MAAM,MAAM,KAAK,IAAI;CACrB,IAAI,MAAM,SAAS,MAAM,MAAM,MAAM,YAAY,sBAC/C,OAAO,kBAAkB,MAAM,MAAM,SAAS,QAAQ,KAAK;CAE7D,IAAI,MAAM,UAAU,OAAO,MAAM;CAEjC,MAAM,YAAY,YAAY;EAC5B,IAAI,WAA0B;EAC9B,IAAI;GACF,WAAW,MAAM,MAAM,qBAAqB,WAAW,SAAS,CAAC;EACnE,QAAQ;GACN,WAAW;EACb;EACA,MAAM,UAAU,kBAAkB,UAAU,MAAM,OAAO,SAAS,QAAQ,KAAK;EAC/E,IAAI,UAAU,MAAM,QAAQ;GAAE;GAAS,WAAW,KAAK,IAAI;EAAE;EAC7D,OAAO;CACT,EAAA,CAAG;CAEH,IAAI;EACF,OAAO,MAAM,MAAM;CACrB,UAAU;EACR,MAAM,WAAW;CACnB;AACF;;AAGA,SAAgB,6BAA6B,YAAuB,cAA+B;CACjG,OAAO,sBAAsB,UAAU,sBAAsB,sBAAsB,qBAAqB,SAAS;AACnH;;AAGA,SAAgB,6BAA6B,YAAuB,cAA+B;CACjG,OAAO,sBAAsB,UAAU,sBAAsB,iBAAiB,iBAAiB,SAAS;AAC1G;;AAGA,eAAsB,0BAA0B,YAAuB,cAA+B;CACpG,MAAM,CAAC,KAAK,OAAO,MAAM,QAAQ,IAAI,CAAC,6BAA6B,SAAS,GAAG,6BAA6B,SAAS,CAAC,CAAC;CACvH,OAAO,kBAAkB,KAAK,GAAG,KAAA;AACnC;;;;;;;AAQA,eAAsB,iCAAiC,YAAY,KAAkC;CACnG,IAAI;CACJ,IAAI;EACF,OAAO,MAAM,QAAQ,KAAK,CACxB,0BAA0B,CAAC,CAAC,YAAY,KAAA,CAAS,GACjD,IAAI,SAAoB,YAAY;GAClC,QAAQ,iBAAiB,QAAQ,KAAA,CAAS,GAAG,SAAS;EACxD,CAAC,CACH,CAAC;CACH,UAAU;EACR,aAAa,KAAK;CACpB;AACF;;AAGA,SAAgB,+BAAmD;CACjE,MAAM,MAAM,KAAK,IAAI;CACrB,KAAK,MAAM,SAAS,CAAC,UAAU,QAAQ,GACrC,IAAI,MAAM,SAAS,MAAM,MAAM,MAAM,YAAY,sBAC/C,OAAO,MAAM,MAAM;AAIzB;AAEA,MAAM,WAAyB,EAAE,UAAU,KAAK;AAChD,MAAM,WAAyB,EAAE,UAAU,KAAK;;;AClJhD,MAAM,gCAAgC;;AAGtC,SAAgB,kBAAkB,SAA+B;CAC/D,MAAM,CAAC,eAAe,IAAI,YAAY,IAAI,mBAAmB,OAAO,WAAW,GAAA,CAAI,MAAM,GAAG;CAC5F,OAAO;EACL,cAAc,gBAAgB,KAAA;EAC9B,WAAW,aAAa,KAAA;EACxB,kBAAkB,oBAAoB,KAAA;CACxC;AACF;;AAGA,SAAgB,mBAAmB,OAA6B;CAC9D,MAAM,iBAAiB,MAAM,aAAa;CAC1C,MAAM,OAAO,GAAG,MAAM,gBAAgB,GAAG,GAAG;CAC5C,OAAO,MAAM,mBAAmB,GAAG,KAAK,GAAG,MAAM,qBAAqB;AACxE;;AAGA,SAAgB,mBAAmB,MAAiC;CAClE,IAAI,CAAC,KAAK,UAAU,OAAO,KAAK,YAAY,UAC1C,OAAO;CAET,OAAO,KAAK,WAAW,KAAK,IAAI,IAAI;AACtC;;AAGA,SAAgB,qBAAqB,eAAuB,kBAAmC;CAC7F,MAAM,UAAU,OAAO,qBAAqB,WAAW,mBAAmB;CAC1E,IAAI,OAAO,MAAM,OAAO,KAAK,WAAW,GACtC,OAAO;CAET,OAAO,gBAAgB,UAAU;AACnC;;;ACjBA,IAAa,uBAAb,cAA0C,MAAM;CAC9C;CACA;CACA;CACA;CAEA,YAAY,SAMT;EACD,MAAM,QAAQ,OAAO;EACrB,KAAK,OAAO;EACZ,KAAK,OAAO,QAAQ;EACpB,KAAK,cAAc,QAAQ;EAC3B,KAAK,SAAS,QAAQ;EACtB,KAAK,aAAa,QAAQ;CAC5B;AACF;;AAGA,SAAgB,uBAAuB,MAAmE;CACxG,IAAI,CAAC,MAAM,OAAO,CAAC;CAEnB,IAAI;EACF,MAAM,UAAU,KAAK,MAAM,IAAI;EAC/B,IAAI,CAAC,WAAW,OAAO,YAAY,UACjC,OAAO,EAAE,aAAa,KAAK;EAG7B,IAAI;EACJ,IAAI,OAAO,QAAQ,UAAU,UAC3B,OAAO,QAAQ;OACV,IAAI,QAAQ,SAAS,OAAO,QAAQ,UAAU,UAAU;GAC7D,OAAO,QAAQ,MAAM,UAAU,QAAQ,MAAM;GAC7C,IAAI,CAAC,QAAQ,qBAAqB,QAAQ,MAAM,SAC9C,OAAO;IAAE;IAAM,aAAa,QAAQ,MAAM;GAAQ;EAEtD;EAEA,MAAM,cAAc,QAAQ;EAC5B,IAAI,aAAa,OAAO;GAAE;GAAM;EAAY;EAE5C,IAAI,QAAQ,SAAS,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,SACtE,OAAO;GAAE;GAAM,aAAa,QAAQ,MAAM;EAAQ;EAGpD,OAAO,EAAE,KAAK;CAChB,QAAQ;EACN,OAAO,EAAE,aAAa,KAAK;CAC7B;AACF;;;;;;;AAaA,eAAsB,mBAAmB,MAAwB,SAAyD;CACxH,MAAM,QAAQ,kBAAkB,KAAK,OAAO;CAC5C,IAAI,CAAC,MAAM,cACT,OAAO;EAAE,MAAM;EAAU,OAAO,IAAI,qBAAqB;GACvD,SAAS;GACT,QAAQ;GACR,YAAY;EACd,CAAC;CAAE;CAKL,MAAM,eAAe,SAAS,WAC1B,CAAC,QAAQ,QAAQ,IACjB,MAAM,KAAK,IAAI,IAAI,CAAC,eAAe,QAAQ,IAAI,aAAa,CAAC,CAAC,QAAQ,OAAqB,QAAQ,MAAM,GAAG,SAAS,CAAC,CAAC,CAAC,CAAC;CAE7H,IAAI,eAAe;CACnB,IAAI;CAEJ,KAAK,MAAM,mBAAmB,cAC5B,IAAI;EACF,MAAM,YAAY,KAAK,IAAI;EAC3B,MAAM,EAAE,UAAU,iBAAiB,4BAA4B,eAAe;EAC9E,MAAM,WAAW,MAAM,aAAa,iBAAiB;GACnD,QAAQ;GACR,SAAS,EACP,gBAAgB,oCAClB;GACA,MAAM,IAAI,gBAAgB;IACxB,YAAY;IACZ,eAAe,MAAM;IACrB,WAAW;IACX,eAAe;GACjB,CAAC;EACH,CAAC;EAED,IAAI,CAAC,SAAS,IAAI;GAChB,MAAM,YAAY,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,KAAA,CAAS;GAC7D,MAAM,EAAE,MAAM,gBAAgB,uBAAuB,SAAS;GAC9D,MAAM,UAAU,CAAC,MAAM,eAAe,SAAS,CAAC,CAAC,OAAO,OAAO,CAAC,CAAC,KAAK,IAAI;GAC1E,MAAM,cAAc,6BAA6B,SAAS,OAAO,GAAG,SAAS,WAAW;GACxF,MAAM,UAAU,UAAU,GAAG,YAAY,KAAK,YAAY;GAE1D,IAAI,SAAS,iBAAiB;IAC5B;IACA;GACF;GAEA,mBAAmB;IACjB,MAAM;IACN,OAAO,IAAI,qBAAqB;KAC9B;KACA;KACA,aAAa,eAAe;KAC5B,QAAQ,SAAS;KACjB,YAAY,SAAS;IACvB,CAAC;GACH;GACA;EACF;EACA,MAAM,UAAW,MAAM,SAAS,KAAK;EAMrC,MAAM,iBAAiB;GACrB,cAAc,QAAQ,iBAAiB,MAAM;GAC7C,WAAW,MAAM;GACjB,kBAAkB,MAAM;EAC1B;EAEA,OAAO;GACL,MAAM;GACN,MAAM;IACJ,QAAQ,QAAQ;IAChB,SAAS,qBAAqB,WAAW,QAAQ,UAAU;IAC3D,SAAS,mBAAmB,cAAc;GAC5C;GACA;EACF;CACF,SAAS,OAAO;EACd,mBAAmB;GACjB,MAAM;GACN,OAAO,IAAI,qBAAqB;IAC9B,SAAS,iBAAiB,QAAQ,MAAM,UAAU;IAClD,QAAQ;IACR,YAAY;GACd,CAAC;EACH;CACF;CAIF,IAAI,kBAAkB,OAAO;CAE7B,IAAI,iBAAiB,aAAa,QAAQ,OAAO,EAAE,MAAM,UAAU;CAEnE,OAAO;EACL,MAAM;EACN,OAAO,IAAI,qBAAqB;GAC9B,SAAS;GACT,QAAQ;GACR,YAAY;EACd,CAAC;CACH;AACF;;;ACzLA,MAAa,mBAAmB;CAAC;CAAO;CAAQ;CAAQ;CAAQ;AAAM;;AAGtE,MAAa,uBAAuB;AAIpC,SAAS,WAAW,qBAA6B,cAAc,KAAe;CAC5E,MAAM,QAAQ,KAAK,IAAI,KAAK,IAAI,qBAAqB,CAAC,GAAG,iBAAiB,SAAS,CAAC;CAEpF,QADa,iBAAiB,UAAU,iBAAiB,iBAAiB,SAAS,MACrE,KAAK,MAAM,KAAK,OAAO,IAAI,WAAW;AACtD;;AAgBA,SAAgB,cAAc,SAAyB,MAAM,KAAK,IAAI,GAAY;CAChF,QAAQ,QAAQ,oBAAoB,KAAK;AAC3C;;AASA,SAAgB,oBAAoB,SAAyB,QAA4B,MAAM,KAAK,IAAI,GAAY;CAClH,IAAI,CAAC,QAAQ,OAAO;CACpB,MAAM,UAAU,QAAQ,sBAAsB;CAC9C,OAAO,OAAO,YAAY,YAAY,UAAU;AAClD;;AAGA,SAAgB,gBAAgB,SAAyB,UAAkB,WAAyB;CAClG,MAAM,UAAU,QAAQ,sBAAsB,aAAa;CAC3D,QAAQ,sBAAsB;EAC5B,GAAI,QAAQ,uBAAuB,CAAC;GACnC,WAAW,KAAK,IAAI,SAAS,SAAS;CACzC;AACF;;AAGA,SAAgB,kBAAkB,SAAyB,MAAM,KAAK,IAAI,GAAS;CACjF,IAAI,QAAQ,qBAAqB;EAC/B,MAAM,QAAQ,OAAO,YACnB,OAAO,QAAQ,QAAQ,mBAAmB,CAAC,CAAC,QAAQ,GAAG,WAAW,QAAQ,GAAG,CAC/E;EACA,QAAQ,sBAAsB,OAAO,KAAK,KAAK,CAAC,CAAC,SAAS,IAAI,QAAQ,KAAA;CACxE;CACA,IAAI,QAAQ,oBAAoB,QAAQ,oBAAoB,KAAK;EAC/D,QAAQ,mBAAmB,KAAA;EAC3B,QAAQ,iBAAiB,KAAA;CAC3B;AACF;;AAGA,MAAa,yBAAyB;;AAItC,MAAa,6BAA6B;;AAG1C,SAAgBA,qBAAmB,WAA+B,MAAM,KAAK,IAAI,GAAuB;CACtG,IAAI,CAAC,WAAW,OAAO,KAAA;CACvB,MAAM,QAAQ,KAAK,MAAM,SAAS;CAClC,IAAI,OAAO,MAAM,KAAK,KAAK,SAAS,KAAK,OAAO,KAAA;CAChD,OAAO;AACT;;;;;;;;;;AAWA,SAAgB,eACd,MACA,SACA,qBACA,cACA,WAA8B,WAC9B,WACgB;CAChB,MAAM,MAAM,KAAK,IAAI;CACrB,MAAM,YAAY,WAAW,mBAAmB;CAEhD,QAAQ,MAAR;EACE,KAAK,cAAc;GACjB,IAAI,aAAa,mBAEf,OAAO;IAAE,QAAQ;IAAS,WAAW,KAAK,IAAI,gBAAgB,WAAW,GAAI;GAAE;GAEjF,IAAI,aAAa,mBAAmB;IAGlC,MAAM,UAAUA,qBAAmB,WAAW,GAAG;IACjD,MAAM,aAAa,YAAY,KAAA,IAC3B,KAAK,IAAI,UAAU,KAAK,sBAAsB,IAC9C;IACJ,QAAQ,mBAAmB,MAAM,KAAK,IAAI,YAAY,GAAM;IAC5D,QAAQ,iBAAiB;IACzB,OAAO;KAAE,QAAQ;KAAQ,WAAW,KAAK,IAAI,YAAY,GAAM;IAAE;GACnE;GAKA,MAAM,UAAUA,qBAAmB,WAAW,GAAG;GACjD,MAAM,aAAa,YAAY,KAAA,IAC3B,KAAK,IAAI,UAAU,KAAK,0BAA0B,IACjD,gBAAA;GACL,OAAO;IAAE,QAAQ;IAAU,WAAW,KAAK,IAAI,YAAY,GAAI;GAAE;EACnE;EACA,KAAK;GAEH,QAAQ,uBAAuB;GAC/B,QAAQ,yBAAyB;GACjC,QAAQ,6BAA6B;GACrC,QAAQ,UAAU;GAClB,OAAO,EAAE,QAAQ,SAAS;EAE5B,KAAK;GACH,QAAQ,mBAAmB,MAAM;GACjC,QAAQ,iBAAiB;GACzB,OAAO;IAAE,QAAQ;IAAU;GAAU;EAEvC,KAAK;GACH,QAAQ,mBAAmB,MAAM;GACjC,QAAQ,iBAAiB;GACzB,OAAO;IAAE,QAAQ;IAAQ;GAAU;EAErC,KAAK,iBAIH,OAAO,EAAE,QAAQ,OAAO;EAE1B,KAAK,aACH,OAAO;GAAE,QAAQ;GAAS;EAAU;CAExC;AACF;;;;;AAMA,SAAgB,qBACd,UACA,cACA,MAAM,KAAK,IAAI,GACf,eACQ;CACR,IAAI,SAAS,UAAU,GAAG,OAAO;CACjC,MAAM,UAAU,SAAS,KAAK,GAAG,OAAO;EAAE,SAAS;EAAG,OAAO;CAAE,EAAE,CAAC,CAC/D,QAAQ,EAAE,SAAS,YAAY;EAC9B,IAAI,UAAU,gBAAgB,QAAQ,YAAY,OAAO,OAAO;EAChE,IAAI,cAAc,SAAS,GAAG,GAAG,OAAO;EACxC,IAAI,iBAAiB,oBAAoB,SAAS,eAAe,GAAG,GAAG,OAAO;EAC9E,OAAO;CACT,CAAC;CACH,IAAI,QAAQ,WAAW,GAAG,OAAO;CAGjC,QADc,QAAQ,MAAM,MAAM,EAAE,QAAQ,YAChC,KAAK,QAAQ,GAAA,CAAM;AACjC;;AAGA,SAAgB,2BAA2B,mBAAuC,MAAM,KAAK,IAAI,GAAW;CAC1G,IAAI,OAAO,sBAAsB,UAAU,OAAO;CAClD,IAAI,oBAAA,KAA0C,OAAO;CACrD,IAAI,oBAAoB,IAAK,OAAO;CACpC,OAAO;AACT;AC3KA,MAAM,SAAS;;AAEf,MAAM,iBAAiB;;AAGvB,SAAgB,cAAc,SAA2C;CACvE,IAAI,CAAC,SAAS,OAAO,KAAA;CACrB,MAAM,KAAK,QAAQ,YAAY;CAC/B,IAAI,GAAG,WAAW,SAAS,GAAG,OAAO;CACrC,IAAI,GAAG,WAAW,SAAS,KAAK,GAAG,WAAW,QAAQ,GAAG,OAAO;CAChE,IAAI,GAAG,WAAW,MAAM,KAAK,GAAG,WAAW,SAAS,GAAG,OAAO;AAEhE;;AAGA,SAAgB,YAAY,SAA0B;CACpD,OAAO,cAAc,OAAO,KAAA;AAC9B;AAEA,SAAS,kBAAkB,GAAY,GAAgC;CACrE,IAAI,CAAC,GAAG,OAAO;CACf,IAAI,CAAC,GAAG,OAAO;CACf,MAAM,KAAK,KAAK,MAAM,CAAC;CACvB,MAAM,KAAK,KAAK,MAAM,CAAC;CACvB,IAAI,OAAO,MAAM,EAAE,GAAG,OAAO;CAC7B,IAAI,OAAO,MAAM,EAAE,GAAG,OAAO;CAC7B,OAAO,MAAM,KAAK,IAAI;AACxB;;;;;;AAOA,SAAgB,mBAAmB,YAA2D;CAC5F,MAAM,2BAAW,IAAI,IAAyB;CAC9C,KAAK,MAAM,CAAC,SAAS,UAAU,OAAO,QAAQ,WAAW,UAAU,CAAC,CAAC,GAAG;EACtE,MAAM,YAAY,MAAM,WAAW;EACnC,IAAI,OAAO,cAAc,YAAY,CAAC,OAAO,SAAS,SAAS,GAAG;EAClE,MAAM,MAAM,YAAY,OAAO;EAC/B,MAAM,UAAU,SAAS,IAAI,GAAG;EAChC,MAAM,YAAY,kBAAkB,SAAS,WAAW,MAAM,WAAW,SAAS;EAClF,SAAS,IAAI,KAAK;GAChB,mBAAmB,UAAU,KAAK,IAAI,QAAQ,qBAAqB,GAAG,SAAS,IAAI;GACnF,GAAI,YAAY,EAAE,UAAU,IAAI,CAAC;GACjC,aAAa,SAAS,cAAc,KAAK;EAC3C,CAAC;CACH;CACA,OAAO,OAAO,YAAY,QAAQ;AACpC;;AAGA,SAAgB,eAAe,SAAyB,QAA+C;CACrG,MAAM,QAAQ,QAAQ,eAAe,CAAC;CACtC,IAAI,QAAQ,OAAO,MAAM;CACzB,IAAI;CACJ,KAAK,MAAM,SAAS,OAAO,OAAO,KAAK,GAAG;EACxC,IAAI,OAAO,MAAM,sBAAsB,UAAU;EACjD,IAAI,CAAC,SAAS,MAAM,qBAAqB,MAAM,qBAAqB,IAAI,QAAQ;CAClF;CACA,OAAO;AACT;;AAGA,SAAgB,aAAa,SAAyB,MAAM,KAAK,IAAI,GAAY;CAC/E,IAAI,CAAC,QAAQ,eAAe,CAAC,QAAQ,sBAAsB,OAAO;CAElE,MAAM,MAAM,2BADU,eAAe,OACE,CAAA,EAAe,iBAAiB;CACvE,OAAO,MAAM,QAAQ,uBAAuB;AAC9C;;AAGA,SAAgB,gBAAgB,SAAyB,QAAsB,MAAM,KAAK,IAAI,GAAY;CACxG,MAAM,QAAQ,eAAe,SAAS,MAAM;CAC5C,IAAI,CAAC,SAAS,OAAO,MAAM,sBAAsB,UAAU,OAAO;CAClE,IAAI,MAAM,WAAW;EACnB,MAAM,QAAQ,KAAK,MAAM,MAAM,SAAS;EACxC,IAAI,CAAC,OAAO,MAAM,KAAK,KAAK,SAAS,KAAK,OAAO;CACnD;CACA,OAAO,MAAM,oBAAoB;AACnC;;;;;;AAOA,SAAgB,iBAAiB,OAAgC,MAAM,KAAK,IAAI,GAAW;CACzF,MAAM,YAAY,OAAO;CACzB,IAAI,OAAO,cAAc,YAAY,CAAC,OAAO,SAAS,SAAS,GAAG,OAAO;CAEzE,MAAM,WAAW,KAAK,IAAI,KAAK,IAAI,WAAW,CAAC,GAAG,CAAC;CACnD,IAAI,YAAY,GAAG,OAAO;CAC1B,IAAI,cAAc;CAClB,MAAM,YAAY,OAAO;CACzB,IAAI,WAAW;EACb,MAAM,UAAU,KAAK,MAAM,SAAS;EACpC,IAAI,CAAC,OAAO,MAAM,OAAO,GAAG,cAAc,KAAK,IAAI,aAAa,KAAK,IAAI,UAAU,KAAK,CAAC,CAAC;CAC5F;CAEA,OAAO,YADgB,KAAK,IAAI,aAAa,cAAc,IAAK;AAElE;AAmBA,SAAS,mBAAmB,WAA+B,KAAiC;CAC1F,IAAI,CAAC,WAAW,OAAO,KAAA;CACvB,MAAM,QAAQ,KAAK,MAAM,SAAS;CAClC,IAAI,OAAO,MAAM,KAAK,KAAK,SAAS,KAAK,OAAO,KAAA;CAChD,OAAO;AACT;;;;;;;;AASA,SAAgB,mBACd,SACA,SACA,MAAM,KAAK,IAAI,GACf,aAAa,GACI;CACjB,MAAM,SAAS,cAAc,OAAO;CACpC,MAAM,YAAY,QAAQ,WAAW,MAAM,EAAE,UAAU,UAAU;CACjE,MAAM,eAAe,aAAa,IAAI,YAAY;CAElD,MAAM,cADU,QAAQ,WAAW,IAAI,CAAC,IAAI,CAAC,GAAG,QAAQ,MAAM,YAAY,GAAG,GAAG,QAAQ,MAAM,GAAG,YAAY,CAAC,EAAA,CACzD,KAAK,EAAE,SAAS,SAAS,aAAa;EACzF,MAAM,QAAQ,eAAe,SAAS,MAAM;EAC5C,MAAM,YAAY,OAAO;EACzB,MAAM,OAAO,OAAO,cAAc,WAAW,KAAK,IAAI,KAAK,IAAI,IAAI,WAAW,CAAC,GAAG,CAAC,IAAI,KAAA;EAEvF,IAAI,eAA8B;EAClC,IAAI,QAAQ,oBAAoB,QAAQ,mBAAmB,KACzD,eAAe,QAAQ;EAEzB,MAAM,cAAc,QAAQ,sBAAsB,YAAY,OAAO;EACrE,IAAI,gBAAgB,KAAA,KAAa,cAAc,KAC7C,eAAe,iBAAiB,OAAO,cAAc,KAAK,IAAI,cAAc,WAAW;EAKzF,IAAI,iBAAiB,QAAQ,SAAS,OAAO,cAAc,YAAY,aAAa,GAAG;GACrF,MAAM,UAAU,mBAAmB,MAAM,WAAW,GAAG;GACvD,IAAI,YAAY,KAAA,GAAW,eAAe;EAC5C;EAEA,OAAO;GACL;GACA;GACA;GACA;GACA,cAAc;GACd,eAAe,iBAAiB,OAAO,GAAG;GAC1C,KAAK,SAAS,KAAA,KAAa,QAAA;GAC3B,UAAU,SAAS,KAAA;EACrB;CACF,CAAC;CAED,WAAW,MAAM,MAAM,UAAU;EAC/B,MAAM,cAAc,KAAK,iBAAiB;EAC1C,MAAM,eAAe,MAAM,iBAAiB;EAC5C,IAAI,gBAAgB,cAAc,OAAO,cAAc,IAAI;EAC3D,IAAI,eAAe,cAAc,QAAQ,KAAK,gBAAgB,MAAM,MAAM,gBAAgB;EAC1F,IAAI,KAAK,QAAQ,MAAM,KAAK,OAAO,KAAK,MAAM,IAAI;EAClD,IAAI,KAAK,aAAa,MAAM,UAAU,OAAO,KAAK,WAAW,KAAK;EAClE,MAAM,QAAQ,MAAM,gBAAgB,KAAK;EACzC,IAAI,UAAU,GAAG,OAAO;EACxB,MAAM,YAAY,KAAK,gBAAgB,OAAQ,MAAM,gBAAgB;EACrE,IAAI,aAAa,GAAG,OAAO;EAC3B,OAAO,KAAK,WAAW,MAAM;CAC/B,CAAC;CAED,OAAO,WAAW,KAAK,EAAE,SAAS,OAAO,cAAc,cAAc,eAAe,KAAK,gBAAgB;EACvG;EAAS;EAAO;EAAc;EAAc;EAAe;EAAK;CAClE,EAAE;AACJ;;;;;;;;;;;;;;;AE/LA,MAAa,2BAA2BC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAAAA;AAIxC,MAAM,qBAAqB;;;;;;AAO3B,IAAI,aAAqC;AACzC,SAAgB,qBAAsC;CACpD,IAAI,YAAY,OAAO;CACvB,IAAI;EACF,MAAM,UAAU,QAAQ,IAAI,WAAW,QAAQ,IAAI,WAAW,KAAK,QAAQ,IAAI,QAAQ,KAAK,MAAM;EAClG,MAAM,eAAe,KAAK,SAAS,kBAAkB;EACrD,IAAI,WAAW,YAAY,GAAG;GAC5B,MAAM,SAAS,KAAK,MAAM,aAAa,cAAc,MAAM,CAAC;GAC5D,IAAI,UAAU,MAAM,QAAQ,OAAO,WAAW,KAAK,OAAO,YAAY,SAAS,GAAG;IAChF,aAAa;IACb,OAAO;GACT;EACF;CACF,QAAQ,CAER;CACA,aAAa;CACb,OAAO;AACT;AAEA,SAAS,WAAc,KAAsB;CAC3C,OAAO,IAAI,KAAK,MAAM,KAAK,OAAO,IAAI,IAAI,MAAM;AAClD;;AAGA,SAAgB,oBACd,OAAwB,mBAAmB,GAC3C,UAAU,WAAW,KAAK,WAAW,GACxB;CACb,MAAM,WAAW,WAAW,KAAK,SAAS;CAC1C,OAAO;EACL,UAAU,WAAW;EACrB,cAAc,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;EAC5C,WAAW,eAAe,QAAQ,GAAG;EACrC,WAAW,WAAW,KAAK,UAAU;EAGrC,gBAAgB,EACd,SAAS,WAAW,KAAK,QAAQ,EACnC;EACA,WAAW,KAAK,IAAI;CACtB;AACF;;AASA,SAAgB,qBACd,OAAwB,mBAAmB,GAC3C,UAAU,WAAW,KAAK,WAAW,GAC6C;CAElF,OAAO;EACL,cAAc,eAAe,QAAQ,GAFtB,WAAW,KAAK,SAEgB;EAC/C,qBAAqB,WAAW,KAAK,UAAU;EAC/C,mBAAmB,KAAK,UAAU,EAChC,SAAS,WAAW,KAAK,QAAQ,EACnC,CAAC;CACH;AACF;;;;;;AAOA,SAAgB,iBACd,OAAwB,mBAAmB,GAC3C,UAAU,KAAK,YAAY,MAAM,IACiD;CAClF,MAAM,WAAW,KAAK,UAAU,MAAM;CACtC,OAAO;EACL,cAAc,eAAe,WAAW,SAAS,GAAG;EACpD,qBAAqB,KAAK,WAAW,MAAM;EAC3C,mBAAmB,KAAK,UAAU,EAChC,SAAS,KAAK,SAAS,MAAM,cAC/B,CAAC;CACH;AACF;;AAGA,SAAgB,yBAAyB,aAA0B,SAA0B;CAC3F,MAAM,UAAU;CAChB,MAAM,QAAQ,YAAY,UAAU,MAAM,OAAO;CACjD,IAAI,CAAC,SAAS,MAAM,OAAO,SAAS,OAAO;CAC3C,YAAY,YAAY,YAAY,UAAU,QAAQ,SAAS,KAAK,SAAS;CAC7E,OAAO;AACT;;AAGA,SAAgB,yBACd,SACA,aACA,QACsB;CAEtB,OAAO,CADO,GAAI,WAAW,CAAC,GAAI;EAAE;EAAa,WAAW,KAAK,IAAI;EAAG;CAAO,CACrE,CAAC,CAAC,MAAM,EAAwB;AAC5C;;;AC7HA,MAAM,8BAAc,IAAI,IAAI;CAAC;CAAK;CAAQ;CAAO;AAAI,CAAC;AAEtD,SAAS,QAAQ,MAAuB;CACtC,MAAM,QAAQ,QAAQ,IAAI;CAC1B,OAAO,UAAU,KAAA,KAAa,YAAY,IAAI,MAAM,KAAK,CAAC,CAAC,YAAY,CAAC;AAC1E;;AAGA,SAAgB,gBAAyB;CACvC,OAAO,QAAQ,iBAAiB;AAClC;;;;;;;AAQA,SAAgB,kBAAmC;CACjD,OAAO,QAAQ,IAAI,6BAA6B,WAAW,WAAW;AACxE;;;;;;ACgDA,SAAgB,wBAAwB,SAA6D;CACnG,MAAM,cAAc,QAAQ;CAC5B,IAAI,aACF,OAAO;EACL,cAAc,YAAY;EAC1B,qBAAqB,YAAY;EACjC,mBAAmB,KAAK,UAAU,YAAY,cAAc;CAC9D;CAEF,MAAM,UAAU,gBAAgB,MAAM,WAClC,iBAAiB,wBAAwB,IACzC,qBAAqB,wBAAwB;CACjD,OAAO;EACL,cAAc,QAAQ;EACtB,qBAAqB,QAAQ;EAC7B,mBAAmB,QAAQ;CAC7B;AACF;AAEA,IAAa,oBAAb,MAAa,kBAAkB;CAC7B;CACA;CACA;CACA,6BAA8B,IAAI,IAA6B;;CAE/D,kCAAmC,IAAI,IAAmD;;CAE1F,uCAAwC,IAAI,IAAgD;CAC5F,gCAAiC,IAAI,IAAoB;;CAEzD,qCAAsC,IAAI,IAAY;;CAGtD,OAAwB,yBAAyB;;CAEjD,OAAwB,kBAAkB;;;;;;;;CAS1C,WAAuD;CAEvD,YAAY,SAAgC;EAC1C,KAAK,QAAQ,QAAQ;EACrB,KAAK,WAAW,QAAQ;EACxB,KAAK,iBAAiB,QAAQ;CAChC;CAEA,WAAmB,SAAiC;EAClD,OAAO,QAAQ,MAAM,QAAQ,SAAS,OAAO,QAAQ;CACvD;;;;;;;CAQA,aAAqB,KAAa,SAAyB,QAAiE;EAC1H,MAAM,WAAW,KAAK,gBAAgB,IAAI,GAAG;EAC7C,IAAI,UAAU,OAAO;EAErB,MAAM,cAAc,YAAmD;GACrE,MAAM,SAAS,MAAM,mBACnB;IAAE,QAAQ,QAAQ,UAAU;IAAI,SAAS,QAAQ,WAAW;IAAG,SAAS,QAAQ;GAAQ,GACxF,EAAE,UAAU,QAAQ,SAAS,CAC/B;GACA,IAAI,OAAO,SAAS,WAAW;IAC7B,IAAI,CAAC,QAAQ,YAAY,OAAO,UAAU;KACxC,MAAM,KAAK,MAAM,QAAQ,MAAM;MAC7B,MAAM,SAAS,EAAE,SAAS,MAAM,cAAc,KAAK,WAAW,SAAS,MAAM,GAAG;MAChF,IAAI,CAAC,QAAQ,MAAM,IAAI,MAAM,WAAW,IAAI,qCAAqC;MACjF,OAAO,WAAW,OAAO;KAC3B,CAAC;KACD,QAAQ,WAAW,OAAO;IAC5B;IAEA,KAAK,WAAW,IAAI,KAAK;KAAE,QAAQ,OAAO,KAAK;KAAQ,SAAS,OAAO,KAAK;IAAQ,CAAC;IACrF,OAAO,OAAO;GAChB;GACA,IAAI,OAAO,SAAS,UAAU;IAC5B,IAAI,UAAU,CAAC,mBAAmB;KAAE,QAAQ,OAAO;KAAQ,SAAS,OAAO;KAAS,SAAS,QAAQ;IAAQ,CAAC,GAC5G,OAAO;KAAE,QAAQ,OAAO;KAAQ,SAAS,OAAO;KAAS,SAAS,QAAQ;IAAQ;IAOpF,MAAM,IAAI,aALG,OAAO,MAAM,WAAW,MACjC,eACA,OAAO,MAAM,WAAW,KAAK,OAAO,MAAM,WAAW,OAAO,OAAO,MAAM,UAAU,MACjF,cACA,sBACuB,OAAO,MAAM,SAAS,EAAE,OAAO,OAAO,MAAM,CAAC;GAC5E;GACA,IAAI,OAAO,SAAS,WAAW;IAE7B,KAAK,WAAW,OAAO,GAAG;IAC1B,MAAM,KAAK,MAAM,QAAQ,MAAM;KAC7B,MAAM,SAAS,EAAE,SAAS,MAAM,cAAc,KAAK,WAAW,SAAS,MAAM,GAAG;KAChF,IAAI,QAAQ;MACV,OAAO,UAAU;MACjB,OAAO,uBAAuB;MAC9B,OAAO,yBAAyB,KAAK,IAAI;MACzC,OAAO,6BAA6B;KACtC;IACF,CAAC;IACD,QAAQ,UAAU;IAClB,QAAQ,uBAAuB;IAC/B,QAAQ,yBAAyB,KAAK,IAAI;IAC1C,QAAQ,6BAA6B;IACrC;GACF;EAEF,EAAA,CAAG;EACH,KAAK,gBAAgB,IAAI,KAAK,UAAU;EACxC,WAAW,WACH,KAAK,gBAAgB,OAAO,GAAG,SAC/B,KAAK,gBAAgB,OAAO,GAAG,CACvC;EACA,OAAO;CACT;;CAGA,MAAc,eAAe,SAAgE;EAC3F,MAAM,MAAM,KAAK,WAAW,OAAO;EACnC,MAAM,SAAS,KAAK,WAAW,IAAI,GAAG;EACtC,MAAM,MAAM,KAAK,IAAI;EACrB,IAAI,UAAU,CAAC,mBAAmB;GAAE,QAAQ,OAAO;GAAQ,SAAS,OAAO;GAAS,SAAS,QAAQ;EAAQ,CAAC,GAAG;GAG/G,IAAI,OAAO,WAAW,MAAM,kBAAkB,iBAC5C,KAAU,aAAa,KAAK,SAAS,MAAM;GAE7C,OAAO;IAAE,QAAQ,OAAO;IAAQ,SAAS,OAAO;IAAS,SAAS,QAAQ;GAAQ;EACpF;EACA,OAAO,KAAK,aAAa,KAAK,SAAS,MAAM;CAC/C;;;;;;CAOA,MAAc,kBAAkB,SAA0C;EACxE,MAAM,MAAM,KAAK,IAAI;EACrB,MAAM,QAAQ,QAAQ,SAAS,QAAQ,YAAY,QAAQ,YAAY,SAAS,aAAa,SAAS,GAAG,CAAC;EAC1G,IAAI,MAAM,WAAW,GAAG;EA8BxB,MAAM,WAAU,MA5BM,QAAQ,IAAI,MAAM,IAAI,OAAO,YAAY;GAC7D,MAAM,MAAM,KAAK,WAAW,OAAO;GACnC,IAAI,KAAK,qBAAqB,IAAI,GAAG,GAAG,OAAO,KAAK,qBAAqB,IAAI,GAAG;GAChF,MAAM,WAAW,YAAY;IAC3B,IAAI;KACF,MAAM,OAAO,MAAM,KAAK,eAAe,OAAO;KAC9C,IAAI,CAAC,MAAM,OAAO;KAClB,MAAM,EAAE,yBAAyB,MAAM,OAAO,wBAAsB,CAAA,MAAA,MAAA,EAAA,CAAA;KACpE,MAAM,gBAA8B,OAAO,SAAS;MAClD,MAAM,UAAU,YAAY,QAAQ,kBAAkB,sBAAsB;MAC5E,MAAM,SAAS,MAAM,SAAS,YAAY,IAAI,CAAC,KAAK,QAAQ,OAAO,CAAC,IAAI;MACxE,OAAO,MAAM,OAAO;OAAE,GAAG;OAAM;MAAO,CAAC;KACzC;KAEA,MAAM,SAAS,mBAAmB,MADT,qBAAqB,KAAK,QAAQ,QAAQ,WAAW,YAAY,CAC9C;KAC5C,OAAO;MAAE;MAAK;MAAQ,WAAW,KAAK,IAAI;KAAE;IAC9C,QAAQ;KACN,OAAO;IACT;GACF,EAAA,CAAG;GACH,KAAK,qBAAqB,IAAI,KAAK,OAAO;GAC1C,IAAI;IACF,OAAO,MAAM;GACf,UAAU;IACR,KAAK,qBAAqB,OAAO,GAAG;GACtC;EACF,CAAC,CAAC,EAAA,CAEsB,QAAQ,MAAoF,QAAQ,KAAK,OAAO,KAAK,EAAE,MAAM,CAAC,CAAC,SAAS,CAAC,CAAC;EAClK,IAAI,QAAQ,SAAS,GAAG;GACtB,KAAK,MAAM,UAAU,SAAS;IAC5B,MAAM,SAAS,QAAQ,SAAS,MAAM,cAAc,KAAK,WAAW,SAAS,MAAM,OAAO,GAAG;IAC7F,IAAI,QAAQ;KACV,OAAO,cAAc,OAAO;KAC5B,OAAO,uBAAuB,OAAO;IACvC;GACF;GACA,IAAI;IACF,MAAM,KAAK,MAAM,QAAQ,MAAM;KAC7B,KAAK,MAAM,UAAU,SAAS;MAC5B,MAAM,SAAS,EAAE,SAAS,MAAM,cAAc,KAAK,WAAW,SAAS,MAAM,OAAO,GAAG;MACvF,IAAI,QAAQ;OACV,OAAO,cAAc,OAAO;OAC5B,OAAO,uBAAuB,OAAO;MACvC;KACF;IACF,CAAC;GACH,QAAQ,CAGR;EACF;CACF;;;;;;CAOA,MAAc,YAAY,SAA2B,OAAiF;EACpI,MAAM,MAAM,KAAK,IAAI;EACrB,KAAK,MAAM,WAAW,QAAQ,UAAU,kBAAkB,SAAS,GAAG;EAEtE,MAAM,SAAS,cAAc,KAAK;EAClC,MAAM,YAAY,YAAY,KAAK;EAKnC,IAAI,KAAK,YAAY,MAAM,KAAK,SAAS,KAAA,KAAiC;GACxE,MAAM,YAAY,QAAQ,SAAS,WAAW,MAAM,KAAK,WAAW,CAAC,MAAM,KAAK,SAAU,GAAG;GAC7F,IAAI,cAAc,IAAI;IACpB,MAAM,OAAO,QAAQ,SAAS;IAC9B,IACE,KAAK,YAAY,SACjB,CAAC,cAAc,MAAM,GAAG,KACxB,CAAC,oBAAoB,MAAM,WAAW,GAAG,KACzC,CAAC,gBAAgB,MAAM,QAAQ,GAAG,GAElC,OAAO;KAAE,SAAS;KAAM,OAAO;IAAU;GAE7C;EACF;EACA,MAAM,WAAW,QAAQ,SACtB,KAAK,SAAS,WAAW;GAAE;GAAS;EAAM,EAAE,CAAC,CAC7C,QAAQ,EAAE,cAAc,QAAQ,YAAY,KAAK;EACpD,IAAI,SAAS,WAAW,GAAG,OAAO,KAAA;EAElC,MAAM,SAAS,mBAAmB,UAAU,OAAO,KAAK,QAAQ,WAAW;EAC3E,MAAM,SAAS,OAAO,MAAM,cAAc,UAAU,iBAAiB,IAAI;EACzE,IAAI,CAAC,QAAQ;GACX,MAAM,kBAAkB,YAAqC;IAC3D,IAAI,QAAQ,mBAAmB,sBAAsB,QAAQ,oBAAoB,KAAK,KAAK,OAAO;IAClG,MAAM,QAAQ,eAAe,SAAS,MAAM;IAC5C,KAAK,OAAO,qBAAqB,KAAK,KAAK,CAAC,OAAO,WAAW,OAAO;IACrE,MAAM,UAAU,KAAK,MAAM,MAAM,SAAS;IAC1C,OAAO,CAAC,OAAO,MAAM,OAAO,KAAK,UAAU;GAC7C;GACA,MAAM,YAAY,OAAO,QAAQ,cAAc,CAAC,eAAe,UAAU,OAAO,CAAC;GACjF,MAAM,UAAU,UAAU,SAAS,IAAI,YAAY;GACnD,MAAM,eAAe,KAAK,IAAI,GAAG,QAAQ,KAAK,cAAc,UAAU,gBAAgB,GAAG,CAAC;GAC1F,MAAM,IAAI,oBAAoB,UAAU,SAAS,IAAI,cAAc,mBAAmB,YAAY;EACpG;EACA,IAAI,OAAO,UAAU,QAAQ,aAAa;GACxC,QAAQ,cAAc,OAAO;GAC7B,MAAM,KAAK,MAAM,QAAQ,MAAM;IAC7B,EAAE,cAAc,OAAO;GACzB,CAAC;EACH;EACA,OAAO;GAAE,SAAS,OAAO;GAAS,OAAO,OAAO;EAAM;CACxD;;;;;;;;CAQA,MAAM,WAAW,OAAwD;EACvE,IAAI,UAAU,MAAM,KAAK,MAAM,KAAK;EACpC,MAAM,cAAc,QAAQ,SAAS,QAAQ,YAAY,QAAQ,YAAY,KAAK,CAAC,CAAC;EAEpF,KAAK,IAAI,UAAU,GAAG,UAAU,aAAa,WAAW;GAEtD,IADiB,QAAQ,SAAS,QAAQ,YAAY,QAAQ,YAAY,KAC/D,CAAC,CAAC,SAAS,GACpB,MAAM,KAAK,kBAAkB,OAAO;GAGtC,MAAM,SAAS,MAAM,KAAK,YAAY,SAAS,KAAK;GACpD,IAAI,CAAC,QAAQ,OAAO,KAAA;GACpB,MAAM,OAAO,MAAM,KAAK,eAAe,OAAO,OAAO;GACrD,IAAI,CAAC,MAAM;IAGT,KAAK,WAAW;IAChB,UAAU,MAAM,KAAK,MAAM,KAAK;IAChC;GACF;GAEA,MAAM,MAAM,KAAK,WAAW,OAAO,OAAO;GAC1C,IAAI,CAAC,OAAO,QAAQ,aAAa,CAAC,KAAK,mBAAmB,IAAI,GAAG,GAC/D,IAAI;IACF,MAAM,EAAE,mBAAmB,MAAM,OAAO,0BAAsB,CAAA,MAAA,MAAA,EAAA,CAAA;IAC9D,MAAM,EAAE,cAAc,MAAM,eAAe,KAAK,MAAM;IACtD,IAAI,WAAW;KACb,MAAM,KAAK,MAAM,QAAQ,MAAM;MAC7B,MAAM,UAAU,EAAE,SAAS,MAAM,cAAc,KAAK,WAAW,SAAS,MAAM,GAAG;MACjF,IAAI,SAAS;OACX,QAAQ,YAAY;OAEpB,MAAM,QAAQ,kBAAkB,QAAQ,OAAO;OAC/C,QAAQ,UAAU,mBAAmB;QACnC,cAAc,MAAM;QACpB;QACA,kBAAkB,MAAM;OAC1B,CAAC;MACH;KACF,CAAC;KACD,OAAO,QAAQ,YAAY;IAC7B,OACE,KAAK,mBAAmB,IAAI,GAAG;GAEnC,QAAQ;IACN,KAAK,mBAAmB,IAAI,GAAG;GACjC;GAGF,KAAK,WAAW;IAAE;IAAK,IAAI,KAAK,IAAI;GAAE;GACtC,OAAO;IACL;IACA,SAAS,OAAO;IAChB,OAAO,OAAO;IACd,eAAe,wBAAwB,OAAO,OAAO;GACvD;EACF;CAGF;;CAGA,MAAM,cACJ,MACA,SACA,MASe;EACf,IAAI,CAAC,SAAS,SAAS;EACvB,MAAM,MAAM,KAAK,WAAW,QAAQ,OAAO;EAC3C,MAAM,eAAe,KAAK,cAAc,IAAI,GAAG,KAAK,KAAK;EACzD,KAAK,cAAc,IAAI,KAAK,WAAW;EACvC,IAAI,oBAAmC;EACvC,MAAM,kBAAkB,SAAS,eAAe,6BAA6B,IAAI;EACjF,MAAM,oBAAqB,SAAS,gBAAgB,CAAC,kBAAmB,MAAM,iCAAiC,IAAK,mBAAmB;EAEvI,MAAM,KAAK,MAAM,QAAQ,YAAY;GACnC,MAAM,UAAU,QAAQ,SAAS,MAAM,MAAM,KAAK,WAAW,CAAC,MAAM,GAAG;GACvE,IAAI,CAAC,SAAS;GAEd,MAAM,WAAW,eAAe,MAAM,SAAS,aAAa,MAAM,cAAc,MAAM,mBAAmB,MAAM,SAAS;GAExH,IAAI,SAAS,gBAAgB,MAAM,sBAAsB,mBAMvD,gBAAgB,SAHE,YAAY,MAAM,KAGX,GAFTC,qBAAmB,MAAM,WAAW,KAAK,IAAI,CAAC,KAC3D,KAAK,IAAI,IAAI,KAAK,IAAI,MAAM,gBAAA,KAAA,IAAkE,CACtD;GAG7C,IAAI,SAAS,WAAW,UAAU;IAChC,KAAK,WAAW,OAAO,GAAG;IAC1B,KAAK,cAAc,OAAO,GAAG;IAC7B;GACF;GAOA,IAAI,SAAS,gBAAgB,MAAM,sBAAsB,mBAAmB;IAC1E,IAAI,CAAC,QAAQ,aAAa;KACxB,QAAQ,cAAc,oBAAoB,KAAA,GAAW,iBAAiB;KACtE,QAAQ,qBAAqB,yBAAyB,QAAQ,oBAAoB,QAAQ,aAAa,SAAS;IAClH,OAAO;KACL,IAAI,iBAAiB,yBAAyB,QAAQ,aAAa,eAAe;KAClF,IAAI,gBAAgB,MAAM,YAAY,eAAe,GAAG;MACtD,MAAM,QAAQ,oBAAoB,KAAA,GAAW,iBAAiB;MAC9D,QAAQ,qBAAqB,yBAAyB,QAAQ,oBAAoB,OAAO,aAAa;MACtG,QAAQ,cAAc;KACxB;IACF;GACF;GAEA,IAAI,SAAS,WAAW,UAAU;IAChC,MAAM,eAAe,QAAQ,SAAS,WAAW,MAAM,KAAK,WAAW,CAAC,MAAM,GAAG;IACjF,MAAM,YAAY,YAAY,MAAM,KAAK;IACzC,MAAM,YAAY,qBAAqB,QAAQ,UAAU,gBAAgB,IAAI,eAAe,QAAQ,aAAa,KAAK,IAAI,GAAG,SAAS;IACtI,IAAI,cAAc,QAAQ,aAAa;KACrC,QAAQ,cAAc;KACtB,oBAAoB;IACtB;IACA,KAAK,WAAW;GAClB;EACF,CAAC;EAED,IAAI,sBAAsB,MACxB,KAAK,WAAW,QAAQ,OAAO,mBAAmB,IAAI;CAE1D;;CAEA,MAAM,YAAY,SAA2C;EAC3D,MAAM,UAAU,QAAQ;EACxB,MAAM,MAAM,KAAK,WAAW,OAAO;EACnC,KAAK,cAAc,OAAO,GAAG;CAC/B;;;;;CAMA,MAAM,SAAS,OAAe,SAAS,0BAA0B,YAAY,MAA+D;EAC1I,IAAI;GACF,MAAM,UAAU,MAAM,KAAK,WAAW,KAAK;GAC3C,IAAI,CAAC,SAAS,OAAO;IAAE,IAAI;IAAO,OAAO;GAAyD;GAClG,MAAM,EAAE,qBAAqB,MAAM,OAAO,2BAAyB,CAAA,MAAA,MAAA,EAAA,CAAA;GACnE,MAAM,EAAE,oBAAoB,MAAA,QAAA,QAAA,CAAA,CAAA,WAAA,iBAAA;GAC5B,MAAM,EAAE,gBAAgB,MAAM,OAAO,uBAAqB,CAAA,MAAA,MAAA,EAAA,CAAA;GAC1D,MAAM,OAAO,iBACX;IACE,UAAU;IACV;IACA,UAAU,CAAC;KAAE,IAAI;KAAU,MAAM;KAAQ,SAAS,CAAC;MAAE,MAAM;MAAQ,MAAM;KAAO,CAAC;IAAE,CAAC;IACpF;GACF,GACA;IAAE,WAAW,QAAQ,QAAQ;IAAW,WAAW,2BAA2B,QAAQ,QAAQ,KAAK,KAAK,KAAA;GAAU,CACpH;GAOA,MAAM,WAAW,MAAM,gBAAgB,6CAA6C;IAClF,QAAQ;IACR,SAAA;KAPA,eAAe,UAAU,QAAQ,KAAK;KACtC,gBAAgB;KAChB,QAAQ;KACR,GAAG,QAAQ;IAIL;IACN,MAAM,KAAK,UAAU,IAAI;GAC3B,CAAC;GACD,IAAI,CAAC,SAAS,IAAI;IAChB,MAAM,OAAO,MAAM,SAAS,KAAK,CAAC,CAAC,YAAY,EAAE;IACjD,OAAO;KAAE,IAAI;KAAO,OAAO,QAAQ,SAAS,OAAO,IAAI,KAAK,MAAM,GAAG,GAAG;IAAI;GAC9E;GACA,IAAI,CAAC,SAAS,MAAM,OAAO;IAAE,IAAI;IAAO,OAAO;GAAmB;GAClE,MAAM,OAAiB,CAAC;GACxB,WAAW,MAAM,SAAS,YAAY,SAAS,IAAI,GACjD,IAAI,MAAM,SAAS,cAAc,KAAK,KAAK,MAAM,IAAI;GAEvD,OAAO;IAAE,IAAI,KAAK,SAAS;IAAG,MAAM,KAAK,KAAK,EAAE;IAAG,OAAO,KAAK,SAAS,IAAI,KAAA,IAAY;GAAiB;EAC3G,SAAS,OAAO;GACd,OAAO;IAAE,IAAI;IAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EACpF;CACF;;CAGA,MAAM,WAAW,OAA2D;EAE1E,MAAM,WAAU,MADM,KAAK,MAAM,KAAK,EAAA,CACd,SAAS;EACjC,IAAI,CAAC,SAAS,OAAO,EAAE,OAAO,oBAAoB;EAClD,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,eAAe,OAAO;GAC9C,IAAI,CAAC,MAAM,OAAO,EAAE,OAAO,4BAA4B;GACvD,MAAM,EAAE,yBAAyB,MAAM,OAAO,sBAAkB,CAAA,MAAA,MAAA,EAAA,CAAA;GAChE,MAAM,QAAQ,kBAAkB,QAAQ,OAAO;GAC/C,OAAO,EACL,MAAM,qBAAqB,OAAO;IAChC,cAAc,KAAK;IACnB,eAAe,MAAM;IACrB,YAAY,KAAK,IAAI,GAAG,KAAK,OAAO,KAAK,UAAU,KAAK,IAAI,KAAK,GAAI,CAAC;GACxE,CAAC,EACH;EACF,SAAS,OAAO;GACd,OAAO,EAAE,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE;EACzE;CACF;;CAGA,MAAc,aAAa,OAAe,SAAmF;EAC3H,IAAI;GACF,MAAM,OAAO,MAAM,KAAK,eAAe,OAAO;GAC9C,IAAI,CAAC,MAAM,OAAO;IAAE,IAAI;IAAO,OAAO;GAA4B;GAClE,MAAM,WAAW,MAAM,aAAa,0DAA0D,EAC5F,SAAS,EAAE,eAAe,UAAU,KAAK,SAAS,EACpD,CAAC;GACD,IAAI,CAAC,SAAS,IAAI,OAAO;IAAE,IAAI;IAAO,OAAO,YAAY,SAAS;GAAS;GAC3E,MAAM,OAAQ,MAAM,SAAS,KAAK;GAGlC,MAAM,KAAK,MAAM,QAAQ,MAAM;IAC7B,MAAM,SAAS,EAAE,SAAS;IAC1B,IAAI,QAAQ;KACV,OAAO,UAAU;KACjB,OAAO,uBAAuB;KAC9B,OAAO,yBAAyB,KAAA;KAChC,OAAO,6BAA6B,KAAA;KACpC,OAAO,kBAAkB,KAAA;IAC3B;GACF,CAAC;GACD,OAAO;IAAE,IAAI;IAAM,OAAO,KAAK;GAAM;EACvC,SAAS,OAAO;GACd,OAAO;IAAE,IAAI;IAAO,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;GAAE;EACpF;CACF;;CAGA,MAAM,cAAc,OAAyE;EAE3F,MAAM,WAAU,MADM,KAAK,MAAM,KAAK,EAAA,CACd,SAAS;EACjC,IAAI,CAAC,SAAS,OAAO;GAAE,IAAI;GAAO,OAAO;EAAoB;EAC7D,OAAO,KAAK,aAAa,OAAO,OAAO;CACzC;;;;;;CAOA,MAAM,cAAc,SAAoD;EACtE,MAAM,UAAU,MAAM,KAAK,MAAM,KAAK;EACtC,MAAM,UAAU,YAAY,KAAA,IACxB,QAAQ,QAAQ,UAAU,QAAQ,SAAS,MAAM,IACjD,QAAQ,SAAS,KAAK,GAAG,UAAU,KAAK,CAAC,CAAC,QAAQ,UAAU,QAAQ,SAAS,MAAM,CAAE,YAAY,KAAK;EAE1G,MAAM,UAAiC,MAAM,QAAQ,IAAI,QAAQ,IAAI,OAAO,UAAU;GAEpF,OAAO;IAAE;IAAO,GAAG,MADE,KAAK,aAAa,OAAO,QAAQ,SAAS,MAAO;GAC5C;EAC5B,CAAC,CAAC;EACF,KAAK,iBAAiB,OAAO;EAC7B,OAAO;CACT;;;;;;CAOA,iBAAiB,YAAoB,UAA+B,CAAC,GAAe;EAClF,IAAI,CAAC,OAAO,SAAS,UAAU,KAAK,cAAc,GAAG,aAAa,CAAC;EACnE,MAAM,QAAQ,kBAAkB;GAC9B,KAAU,cAAc,CAAC,CAAC,YAAY,CAAC,CAAC;EAC1C,GAAG,UAAU;EACb,IAAI,QAAQ,UAAU,OAAO,MAAM,QAAQ;EAC3C,aAAa,cAAc,KAAK;CAClC;AACF;;;;;;;;;;;AC3mBA,MAAa,iBAAiB;AAQ9B,MAAMC,eAAa;;AAGnB,SAAgB,kBAAkB,KAA0B;CAC1D,IAAI,IAAI,WAAW,IACjB,MAAM,IAAI,MAAM,uDAAuD,IAAI,QAAQ;CAErF,OAAO;EACL,QAAQ,WAA2B;GACjC,MAAM,KAAK,YAAY,EAAE;GACzB,MAAM,SAAS,eAAe,eAAe,KAAK,EAAE;GACpD,MAAM,OAAO,OAAO,OAAO,CAAC,OAAO,OAAO,WAAW,MAAM,GAAG,OAAO,MAAM,CAAC,CAAC;GAC7E,MAAM,MAAM,OAAO,WAAW;GAC9B,OAAO,GAAGA,eAAa,GAAG,SAAS,WAAW,EAAE,GAAG,IAAI,SAAS,WAAW,EAAE,GAAG,KAAK,SAAS,WAAW;EAC3G;EACA,QAAQ,SAAyB;GAC/B,IAAI,CAAC,QAAQ,WAAWA,YAAU,GAChC,MAAM,IAAI,MAAM,6CAA6C;GAE/D,MAAM,KAAK,QAAQ,IAAI,SAAS,IAAI,UAAU,MAAM,QAAQ,MAAM,GAAG;GACrE,MAAM,WAAW,iBAAiB,eAAe,KAAK,OAAO,KAAK,OAAO,WAAW,CAAC;GACrF,SAAS,WAAW,OAAO,KAAK,QAAQ,WAAW,CAAC;GAEpD,OADc,OAAO,OAAO,CAAC,SAAS,OAAO,OAAO,KAAK,SAAS,WAAW,CAAC,GAAG,SAAS,MAAM,CAAC,CACtF,CAAC,CAAC,SAAS,MAAM;EAC9B;CACF;AACF;;AAGA,SAAgB,UAAU,WAA2B;CACnD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,WAAW,MAAM,CAAC,CAAC,OAAO;AAC/D;;AAGA,SAAgB,iBAAyB;CACvC,OAAO,QAAQ,IAAI,WAAW,QAAQ,QAAQ,IAAI,QAAQ,IAAI,KAAK,QAAQ,GAAG,MAAM;AACtF;AAEA,SAAS,UAAkB;CACzB,OAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,eAAe;AACxD;;;;;;AAOA,SAAgB,wBAAwB,MAAmC;CACzE,IAAI,CAAC,WAAW,IAAI,GAAG,uBAAO,IAAI,IAAI;CACtC,MAAM,0BAAU,IAAI,IAAoB;CACxC,MAAM,OAAO,aAAa,MAAM,MAAM;CACtC,KAAK,MAAM,QAAQ,KAAK,MAAM,OAAO,GAAG;EACtC,MAAM,UAAU,KAAK,KAAK;EAC1B,IAAI,CAAC,WAAW,QAAQ,WAAW,GAAG,KAAK,QAAQ,WAAW,KAAK,GAAG;EACtE,MAAM,QAAQ,qCAAqC,KAAK,OAAO;EAC/D,IAAI,CAAC,OAAO;EACZ,MAAM,GAAG,MAAM,IAAI,WAAW,MAAM;EACpC,IAAI;EACJ,IAAI,SAAS,WAAW,IAAG,GACzB,IAAI;GACF,QAAQ,KAAK,MAAM,QAAQ;EAC7B,QAAQ;GACN,MAAM,IAAI,MAAM,sDAAsD,IAAI,OAAO,MAAM;EACzF;OACK,IAAI,SAAS,WAAW,GAAG,GAAG;GACnC,IAAI,CAAC,SAAS,SAAS,GAAG,KAAK,SAAS,SAAS,GAC/C,MAAM,IAAI,MAAM,kEAAkE,IAAI,OAAO,MAAM;GAErG,QAAQ,SAAS,MAAM,GAAG,EAAE,CAAC,CAAC,QAAQ,OAAO,GAAG;EAClD,OACE,QAAQ;EAEV,IAAI,MAAM,WAAW,GAAG;EACxB,QAAQ,IAAI,KAAK,KAAK;CACxB;CACA,OAAO;AACT;;;;;;;AAQA,SAAgB,gBAAgB,MAAoB;CAClD,IAAI,QAAQ,aAAa,SAAS;CAClC,MAAM,OAAO,SAAS,IAAI,CAAC,CAAC,OAAO;CACnC,IAAI,SAAS,KACX,MAAM,IAAI,MACR,YAAY,KAAK,sCAAsC,KAAK,SAAS,CAAC,EAAE,yCAE1E;AAEJ;;;;;AAMA,SAAgB,cAAc,SAAqC;CACjE,MAAM,OAAO,KAAK,SAAS,mBAAmB;CAC9C,IAAI,CAAC,WAAW,IAAI,GAAG,OAAO,KAAA;CAC9B,gBAAgB,IAAI;CACpB,OAAO,wBAAwB,IAAI,CAAC,CAAC,IAAI,cAAc;AACzD;;;;;;;;;AAUA,SAAgB,iBAAiB,SAAiB,WAAyB;CACzE,MAAM,OAAO,KAAK,SAAS,mBAAmB;CAC9C,UAAU,QAAQ,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;CAC5C,MAAM,eAAe,WAAW,IAAI,IAAI,aAAa,MAAM,MAAM,IAAI;CACrE,IAAI,aAAa,SAAS,KAAK,wBAAwB,IAAI,CAAC,CAAC,IAAA,gBAAkB,GAC7E,MAAM,IAAI,MAAM,qBAAqB,eAAe,qBAAqB,MAAM;CAEjF,MAAM,QAAQ,GAAG,eAAe,IAAI,KAAK,UAAU,SAAS;CAC5D,MAAM,OAAO,aAAa,SAAS,KAAK,CAAC,aAAa,SAAS,IAAI,IAC/D,GAAG,aAAa,IAAI,MAAM,MAC1B,GAAG,eAAe,MAAM;CAC5B,MAAM,MAAM,GAAG,KAAK;CACpB,cAAc,KAAK,MAAM,EAAE,MAAM,IAAM,CAAC;CACxC,WAAW,KAAK,IAAI;AACtB;;;;;;AAOA,SAAgB,sBAAsB,SAA2D;CAC/F,IAAI,YAAY,cAAc,OAAO;CACrC,IAAI,UAAU;CACd,IAAI,CAAC,WAAW;EACd,YAAY,YAAY,EAAE,CAAC,CAAC,SAAS,KAAK;EAC1C,iBAAiB,SAAS,SAAS;EACnC,UAAU;CACZ;CACA,OAAO;EAAE,OAAO,kBAAkB,UAAU,SAAS,CAAC;EAAG;CAAQ;AACnE;AChJA,MAAM,aAAa;AAOnB,MAAa,iBAA2B,EACtC,MAAM,SAAY,MAAc,IAAkC;CAChE,MAAM,UAAU,MAAM,SAAS,KAAK,MAAM;EACxC,OAAO;EACP,QAAQ;EACR,SAAS;GAAE,SAAS;GAAI,QAAQ;GAAK,YAAY;GAAI,YAAY;EAAM;CACzE,CAAC;CACD,IAAI;EACF,OAAO,MAAM,GAAG;CAClB,UAAU;EACR,MAAM,QAAQ;CAChB;AACF,EACF;AAwBA,SAAS,YAAY,OAAwB;CAC3C,OAAO,MAAM,WAAW,UAAU;AACpC;;AAGA,SAAS,eAAe,SAAyB,OAAoC;CACnF,IAAI,YAAY,QAAQ,OAAO,GAC7B,OAAO;EAAE,GAAG;EAAS,SAAS,MAAM,QAAQ,QAAQ,OAAO;CAAE;CAE/D,OAAO;AACT;;AAGA,SAAS,eAAe,SAAyB,OAAoC;CACnF,IAAI,CAAC,YAAY,QAAQ,OAAO,GAC9B,OAAO;EAAE,GAAG;EAAS,SAAS,MAAM,QAAQ,QAAQ,OAAO;CAAE;CAE/D,OAAO;AACT;AAEA,SAAgB,iBAAiB,SAA4E;CAC3G,IAAI,UAAU;CACd,MAAM,0BAAU,IAAI,IAAY;CAChC,KAAK,MAAM,WAAW,QAAQ,UAAU;EACtC,IAAI,CAAC,QAAQ,MAAM,QAAQ,IAAI,QAAQ,EAAE,GAAG;GAC1C,QAAQ,KAAK,WAAW;GACxB,UAAU;EACZ;EACA,QAAQ,IAAI,QAAQ,EAAE;CACxB;CACA,OAAO;EAAE;EAAS;CAAQ;AAC5B;AAEA,SAAgB,eAAe,SAA2B,OAAsC;CAC9F,OAAO;EAAE,GAAG;EAAS,UAAU,QAAQ,SAAS,KAAK,MAAM,eAAe,GAAG,KAAK,CAAC;CAAE;AACvF;AAEA,SAAgB,eAAe,SAA2B,OAAsC;CAC9F,OAAO;EAAE,GAAG;EAAS,UAAU,QAAQ,SAAS,KAAK,MAAM,eAAe,GAAG,KAAK,CAAC;CAAE;AACvF;AAGA,SAAgB,cAAc,IAAwC;CACpE,OAAO;EACL,SAAS;EACT,UAAU,GAAG,SAAS,KAAK,SAAS;GAClC,OAAO,IAAI;GACX,cAAc,IAAI;GAClB,WAAW,IAAI;GACf,kBAAkB,IAAI;GACtB,SAAS,IAAI;GACb,UAAU,IAAI;GACd,kBAAkB,IAAI;GACtB,qBAAqB,IAAI,iBAAiB,IAAI,qBAC1C,EAAE,SAAS,IAAI,mBAAmB,IAClC,KAAA;EACN,EAAE;EACF,aAAa,GAAG;CAClB;AACF;AAEA,SAAgB,cAAc,IAAwC;CACpE,OAAO;EACL,SAAS;EACT,UAAU,GAAG,SAAS,KAAK,SAAS;GAClC,OAAO,IAAI;GACX,SAAS,GAAG,IAAI,aAAa,GAAG,IAAI,aAAa,GAAG,GAAG,IAAI,oBAAoB;GAC/E,WAAW,IAAI;GACf,kBAAkB,IAAI;GACtB,SAAS,IAAI;GACb,UAAU,IAAI;GACd,SAAS;GACT,kBAAkB,IAAI;GACtB,qBAAqB,IAAI;EAC3B,EAAE;EACF,aAAa,GAAG;CAClB;AACF;AAEA,SAAgB,cAAc,IAAwC;CACpE,OAAO;EAAE,SAAS;EAAG,UAAU,GAAG;EAAU,aAAa,GAAG;CAAY;AAC1E;AAEA,SAAgB,eAAe,KAAuC;CACpE,QAAQ,IAAI,SAAZ;EACE,KAAK,GACH,OAAO,eAAe,cAAc,GAAG,CAAC;EAC1C,KAAK,GACH,OAAO,eAAe,cAAc,GAAG,CAAC;EAC1C,KAAK,GACH,OAAO,eAAe,cAAc,GAAG,CAAC;EAC1C,KAAK,GACH,OAAO;EACT,SACE,MAAM,IAAI,MAAM,+CAAgD,IAA4B,SAAS;CACzG;AACF;AAIA,IAAa,mBAAb,MAAsD;CACpD;CACA;CACA;CAEA,YAAY,SAAkC;EAC5C,KAAK,OAAO,QAAQ;EACpB,KAAK,QAAQ,QAAQ;EACrB,KAAK,OAAO,QAAQ,QAAQ;CAC9B;CAEA,aAA2B;EACzB,IAAI,WAAW,KAAK,IAAI,GAAG;EAC3B,UAAU,QAAQ,KAAK,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;EACjD,MAAM,MAAM,GAAG,KAAK,KAAK;EACzB,cAAc,KAAK,KAAK,UAAU;GAAE,SAAA;GAAkC,UAAU,CAAC;GAAG,aAAa;EAAE,CAAC,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;EAC7H,WAAW,KAAK,KAAK,IAAI;CAC3B;CAEA,yBAAkF;EAChF,IAAI;EACJ,IAAI;GACF,OAAO,aAAa,KAAK,MAAM,MAAM;EACvC,SAAS,OAAO;GACd,IAAK,MAAgC,SAAS,UAC5C,OAAO;IAAE,SAAS;KAAE,SAAA;KAAkC,UAAU,CAAC;KAAG,aAAa;IAAE;IAAG,SAAS;GAAM;GAEvG,MAAM;EACR;EACA,gBAAgB,KAAK,IAAI;EAIzB,OAAO,iBADW,eADD,eADL,KAAK,MAAM,IACW,CACM,GAAG,KAAK,KAChB,CAAC;CACnC;CAEA,cAAsB,SAAiC;EACrD,MAAM,YAAY,eAAe,iBAAiB,OAAO,CAAC,CAAC,SAAS,KAAK,KAAK;EAC9E,UAAU,QAAQ,KAAK,IAAI,GAAG,EAAE,WAAW,KAAK,CAAC;EACjD,MAAM,MAAM,GAAG,KAAK,KAAK;EACzB,cAAc,KAAK,KAAK,UAAU,WAAW,MAAM,CAAC,IAAI,MAAM,EAAE,MAAM,IAAM,CAAC;EAC7E,WAAW,KAAK,KAAK,IAAI;CAC3B;;;;;;CAOA,MAAc,yBAAoD;EAChE,KAAK,WAAW;EAChB,OAAO,KAAK,KAAK,SAAS,KAAK,MAAM,YAAY;GAC/C,MAAM,EAAE,SAAS,YAAY,KAAK,uBAAuB;GACzD,IAAI,SACF,KAAK,cAAc,OAAO;GAE5B,OAAO;EACT,CAAC;CACH;CAEA,MAAM,OAAkC;EACtC,MAAM,EAAE,SAAS,YAAY,KAAK,uBAAuB;EACzD,IAAI,SAEF,OAAO,KAAK,uBAAuB;EAErC,OAAO;CACT;CAEA,MAAM,KAAK,SAA0C;EACnD,KAAK,WAAW;EAChB,MAAM,KAAK,KAAK,SAAS,KAAK,MAAM,YAAY;GAC9C,KAAK,cAAc,OAAO;EAC5B,CAAC;CACH;CAEA,MAAM,OAAU,IAA+D;EAC7E,KAAK,WAAW;EAChB,OAAO,KAAK,KAAK,SAAS,KAAK,MAAM,YAAY;GAC/C,MAAM,EAAE,YAAY,KAAK,uBAAuB;GAChD,MAAM,SAAS,MAAM,GAAG,OAAO;GAC/B,KAAK,cAAc,OAAO;GAC1B,OAAO;EACT,CAAC;CACH;AACF"}

package/lib/cli/index.d.mts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/oauth/constants.ts","../../src/cli/index.ts"],"mappings":";;;cA6Ba;;;iBCiQG,iBAAiB"}
+{"version":3,"file":"index.d.mts","names":[],"sources":["../../src/oauth/constants.ts","../../src/cli/index.ts"],"mappings":";;;cAoDa;;;iBCyQG,iBAAiB"}

package/lib/cli/index.mjs

@@ -1,6 +1,6 @@
-import { c as loadMasterKey, d as resolveMasterKeyCodec, i as JsonAccountStore, o as createAesGcmCodec, s as deriveKey, t as AgySessionManager, u as resolveDshHome, y as AGY_DEFAULT_REDIRECT_URI } from "../session-CyoQxOqv.mjs";
-import { t as exchangeAntigravity } from "../exchange-BkQRoBzy.mjs";
-import { n as upsertImportedAccount, r as authorizeAntigravity, t as importManySources } from "../import-KAAtJXZP.mjs";
+import { a as loadMasterKey, c as resolveMasterKeyCodec, i as deriveKey, l as AgySessionManager, r as createAesGcmCodec, s as resolveDshHome, t as JsonAccountStore, u as isAgyDisabled, v as AGY_DEFAULT_REDIRECT_URI } from "../accounts-BvX5zmPa.mjs";
+import { t as exchangeAntigravity } from "../exchange-CteHnRzO.mjs";
+import { n as upsertImportedAccount, r as authorizeAntigravity, t as importManySources } from "../import-C7EV_tne.mjs";
 import { r as encodeCredentialBlob } from "../blob-D1e7_uT1.mjs";
 import { readFileSync, writeFileSync } from "node:fs";
 import { join } from "node:path";
@@ -209,7 +209,8 @@ async function loginCommand(options) {
 			expiresAt: new Date(result.expires).toISOString(),
 			authMethod: "oauth",
 			email: result.email ?? null,
-			projectId: result.projectId || null
+			projectId: result.projectId || null,
+			clientId: result.clientId || null
 		}, { overwriteExisting: true });
 		console.log(`${created ? "Added" : "Updated"} account: ${account.email ?? "(no email)"} (project: ${result.projectId || "default"})`);
 	}
@@ -230,7 +231,7 @@ async function statusCommand() {
 		console.log(` ${marker} [${index}] ${account.email ?? "(no email)"} — ${state}${account.projectId ? ` (project: ${account.projectId})` : ""}`);
 		const session = await sessions.getSession().catch(() => void 0);
 		if (session && session.index === index) try {
-			const { fetchAvailableModels } = await import("../models-BpIXp4vx.mjs").then((n) => n.n);
+			const { fetchAvailableModels } = await import("../models-I1UAEk9x.mjs").then((n) => n.r);
 			const discovered = await fetchAvailableModels(session.auth.access, session.account.projectId);
 			const entries = Object.entries(discovered.models ?? {});
 			if (entries.length > 0) {
@@ -311,6 +312,29 @@ async function verifyCommand(options) {
 		else console.log(`[${index}] ${account.email ?? ""} — FAILED: ${result.error}`);
 	}
 }
+async function healthCommand(options) {
+	const store = createReadOnlyStoreOrExit();
+	const sessions = new AgySessionManager({
+		store,
+		onHealthReport: (results) => {
+			for (const result of results) if (result.ok) console.log(`[${result.index}] ${result.email ?? ""} — OK`);
+			else console.log(`[${result.index}] ${result.email ?? ""} — FAILED: ${result.error}`);
+		}
+	});
+	const indices = options.index?.map((value) => Number(value));
+	if (options.interval) {
+		const intervalMs = Number(options.interval);
+		if (!Number.isFinite(intervalMs) || intervalMs <= 0) {
+			console.error("Error: --interval must be a positive number of milliseconds.");
+			process.exit(1);
+		}
+		console.log(`Health probe every ${intervalMs}ms (Ctrl+C to stop).`);
+		sessions.startHealthProbe(intervalMs, { unref: false });
+		await new Promise(() => {});
+		return;
+	}
+	if ((await sessions.checkAccounts(indices)).length === 0) console.log("No enabled accounts — run `dsh-agy login` first.");
+}
 async function logoutCommand(options) {
 	await createReadOnlyStoreOrExit().mutate((storage) => {
 		const index = options.index !== void 0 ? Number(options.index) : options.email ? storage.accounts.findIndex((a) => a.email?.toLowerCase() === options.email.toLowerCase()) : storage.activeIndex;
@@ -323,6 +347,12 @@ async function logoutCommand(options) {
 function createProgram() {
 	const program = new Command();
 	program.name("dsh-agy").description("Google Antigravity (agy) account management for DeepSeek Harness").version(PACKAGE_VERSION);
+	program.hook("preAction", () => {
+		if (isAgyDisabled()) {
+			console.error("dsh-agy is disabled (DSH_AGY_DISABLE=1).");
+			process.exit(1);
+		}
+	});
 	program.command("login").description("OAuth login (browser, or headless paste)").option("--headless", "print the URL and wait for a pasted redirect URL", false).option("--blob", "print a paste-credential blob instead of storing the account", false).option("--port <n>", "loopback callback port", "51121").option("--project <id>", "bind the login to a specific project").option("--timeout <ms>", "callback timeout", "300000").action(async (options) => {
 		await loginCommand({
 			...options,
@@ -344,6 +374,9 @@ function createProgram() {
 	program.command("verify").description("Verify account credentials (refresh + userinfo)").option("--index <n>", "verify one account by index; default all").action(async (options) => {
 		await verifyCommand(options);
 	});
+	program.command("health").description("Check every enabled account (refresh + userinfo), optionally on an interval").option("--interval <ms>", "repeat on an interval instead of once").option("--index <n...>", "check only these accounts").action(async (options) => {
+		await healthCommand(options);
+	});
 	program.command("logout").description("Remove an account").option("--index <n>", "account index (default: active)").option("--email <email>", "account email").action(async (options) => {
 		await logoutCommand(options);
 	});

package/lib/cli/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","names":[],"sources":["../../src/cli/callback-server.ts","../../src/cli/index.ts"],"sourcesContent":["/** Loopback OAuth callback server for the standalone CLI login flow. */\n\nimport { createServer } from 'node:http'\nimport type { Server } from 'node:http'\n\nexport interface CallbackResult {\n  code: string\n  state: string\n  url: string\n}\n\nexport interface CallbackHandle {\n  result: Promise<CallbackResult>\n  /** Resolves once the loopback listener is bound; rejects on bind errors. */\n  ready: Promise<void>\n  close(): Promise<void>\n}\n\nconst SUCCESS_HTML = `<!doctype html><html><head><meta charset=\"utf-8\"><title>Login successful</title></head>\n<body style=\"font-family:system-ui;text-align:center;padding:3rem\">\n<h2>✓ Authentication successful</h2>\n<p>You can close this tab and return to the terminal.</p>\n</body></html>`\n\n/** Listen on 127.0.0.1:<port>/oauth-callback and resolve with the code+state. */\nexport function startCallbackServer(options: { port?: number; timeoutMs?: number } = {}): CallbackHandle {\n  const port = options.port ?? 51121\n  const timeoutMs = options.timeoutMs ?? 300_000\n\n  let resolveResult: (value: CallbackResult) => void\n  let rejectResult: (reason: Error) => void\n  const result = new Promise<CallbackResult>((resolve, reject) => {\n    resolveResult = resolve\n    rejectResult = reject\n  })\n\n  let resolveReady: () => void\n  let rejectReady: (reason: Error) => void\n  const ready = new Promise<void>((resolve, reject) => {\n    resolveReady = resolve\n    rejectReady = reject\n  })\n\n  const server: Server = createServer((req, res) => {\n    const url = new URL(req.url ?? '/', 'http://localhost')\n    if (url.pathname === '/oauth-callback') {\n      const code = url.searchParams.get('code')\n      const state = url.searchParams.get('state')\n      if (!code || !state) {\n        res.writeHead(400, { 'Content-Type': 'text/html' })\n        res.end('<h2>Missing code or state</h2>')\n        return\n      }\n      res.writeHead(200, { 'Content-Type': 'text/html', connection: 'close' })\n      res.end(SUCCESS_HTML)\n      resolveResult({ code, state, url: url.toString() })\n      // Give the browser a moment to render before the server closes.\n      setTimeout(() => server.close(), 1500)\n      return\n    }\n    res.writeHead(404)\n    res.end('Not found')\n  })\n\n  server.on('error', (error: NodeJS.ErrnoException) => {\n    if (error.code === 'EADDRINUSE') {\n      rejectResult(new Error(`Port ${port} is already in use — pass --port to pick another.`))\n    } else {\n      rejectResult(error)\n    }\n    rejectReady(error)\n  })\n\n  server.listen(port, '127.0.0.1', () => {\n    resolveReady()\n  })\n\n  const timeout = setTimeout(() => {\n    rejectResult(new Error('Authentication timed out — no callback received.'))\n    server.close()\n  }, timeoutMs)\n\n  const handle: CallbackHandle = {\n    result,\n    ready,\n    async close() {\n      clearTimeout(timeout)\n      if (server.listening) {\n        // The success page's keep-alive connection would otherwise hold\n        // server.close() (and the CLI process) open indefinitely.\n        server.closeAllConnections()\n        await new Promise<void>((resolve) => server.close(() => resolve()))\n      }\n    },\n  }\n  return handle\n}\n\n/** Open a URL in the system browser (best effort). */\nexport async function openBrowser(url: string): Promise<boolean> {\n  const { spawn } = await import('node:child_process')\n  const platform = process.platform\n  const command = platform === 'darwin' ? ['open', url]\n    : platform === 'win32' ? ['cmd', '/c', 'start', '', url]\n    : ['xdg-open', url]\n  return new Promise<boolean>((resolve) => {\n    const child = spawn(command[0]!, command.slice(1), { stdio: 'ignore' })\n    child.on('error', () => resolve(false))\n    child.on('spawn', () => resolve(true))\n  })\n}\n","/**\n * dsh-agy CLI: login / status / import / verify / logout.\n * Standalone bin — the dsh launcher has no plugin subcommand slot, and the\n * remote paste-blob flow must run on machines without a harness.\n */\n\nimport { Command } from 'commander'\nimport { readFileSync, writeFileSync } from 'node:fs'\nimport { join } from 'node:path'\nimport { createInterface } from 'node:readline/promises'\nimport { stdin as input, stdout as output } from 'node:process'\nimport { authorizeAntigravity } from '../oauth/authorize.ts'\nimport { exchangeAntigravity } from '../oauth/exchange.ts'\nimport { encodeCredentialBlob } from '../oauth/blob.ts'\nimport { AGY_DEFAULT_REDIRECT_URI } from '../oauth/constants.ts'\nimport { createAesGcmCodec, deriveKey, loadMasterKey, resolveDshHome, resolveMasterKeyCodec } from '../store/keyring.ts'\nimport type { SecretCodec } from '../store/keyring.ts'\nimport { JsonAccountStore } from '../store/accounts.ts'\nimport { AgySessionManager } from '../session.ts'\nimport { startCallbackServer, openBrowser } from './callback-server.ts'\nimport { importManySources, upsertImportedAccount } from './import.ts'\n\n/** Package version, read from the shipped package.json — never hard-coded twice. */\nconst { version: PACKAGE_VERSION } = JSON.parse(\n  readFileSync(new URL('../../package.json', import.meta.url), 'utf8'),\n) as { version: string }\n\nfunction createStore(options: { readOnly?: boolean } = {}): JsonAccountStore {\n  const dshHome = resolveDshHome()\n  let codec: SecretCodec\n  if (options.readOnly) {\n    // Read-only commands must never create the master key or the credentials\n    // document: they would fail for no reason on a read-only HOME and write\n    // files nobody asked for anywhere else.\n    const masterKey = loadMasterKey(dshHome)\n    if (!masterKey) {\n      throw new Error('No agy account store found — run `dsh-agy login` first.')\n    }\n    codec = createAesGcmCodec(deriveKey(masterKey))\n  } else {\n    codec = resolveMasterKeyCodec(dshHome).codec\n  }\n  return new JsonAccountStore({ file: `${dshHome}/agy-accounts.json`, codec })\n}\n\n/** Read-only store with a friendly error when no credentials exist yet. */\nfunction createReadOnlyStoreOrExit(): JsonAccountStore {\n  try {\n    return createStore({ readOnly: true })\n  } catch (error) {\n    console.error(error instanceof Error ? error.message : String(error))\n    process.exit(1)\n  }\n}\n\nasync function ask(question: string): Promise<string> {\n  const rl = createInterface({ input, output })\n  try {\n    return (await rl.question(question)).trim()\n  } finally {\n    rl.close()\n  }\n}\n\n/** Remote/SSH sessions cannot reach a local browser; auto-select headless paste. */\nfunction isRemoteSession(): boolean {\n  return !!(process.env.SSH_CONNECTION || process.env.SSH_CLIENT || process.env.SSH_TTY)\n}\n\nasync function loginCommand(options: { headless: boolean; blob: boolean; port: number; project?: string; timeout?: string }) {\n  const store = createStore()\n  const redirectUri = `http://localhost:${options.port}/oauth-callback`\n  if (!options.headless && isRemoteSession()) {\n    console.log('(SSH session detected — using headless paste flow; pass --headless explicitly to force)')\n    options.headless = true\n  }\n\n  let callback: Awaited<ReturnType<typeof startCallbackServer>> | undefined\n  if (!options.headless) {\n    // Bind the loopback listener BEFORE the URL is shown: a local process\n    // squatting on the fixed port could otherwise capture code+state (the\n    // state carries the PKCE verifier) and steal the refresh token.\n    callback = startCallbackServer({ port: options.port, timeoutMs: Number(options.timeout) || 300_000 })\n    try {\n      await callback.ready\n    } catch (error) {\n      console.error(error instanceof Error ? error.message : String(error))\n      process.exit(1)\n    }\n  }\n\n  const { url, verifier } = await authorizeAntigravity(redirectUri, options.project ?? '')\n  console.log(`\\nOpen this URL in a browser to authorize:\\n\\n  ${url}\\n`)\n\n  let code: string\n  let state: string\n\n  if (options.headless) {\n    const pasted = await ask('After approving, paste the full redirected URL here: ')\n    const parsed = new URL(pasted)\n    code = parsed.searchParams.get('code') ?? ''\n    state = parsed.searchParams.get('state') ?? ''\n    if (!code || !state) {\n      console.error('Error: pasted URL is missing code or state.')\n      process.exit(1)\n    }\n  } else {\n    const opened = await openBrowser(url)\n    if (!opened) console.log('(Could not open a browser automatically — open the URL manually.)')\n    let callbackResult: { code: string; state: string; url: string }\n    try {\n      callbackResult = await callback!.result\n    } catch (error) {\n      console.error(error instanceof Error ? error.message : String(error))\n      process.exit(1)\n    }\n    code = callbackResult.code\n    state = callbackResult.state\n  }\n\n  // Bind the exchange to the verifier we issued: a state from any other login\n  // (pasted from another session, or fabricated) must be rejected.\n  const result = await exchangeAntigravity(code, state, redirectUri, verifier)\n  if (result.type === 'failed') {\n    console.error(`Login failed: ${result.error}`)\n    process.exit(1)\n  }\n\n  if (options.blob) {\n    const blob = encodeCredentialBlob('agy', {\n      access_token: result.access,\n      refresh_token: result.refresh.split('|')[0],\n      expires_in: Math.max(0, Math.round((result.expires - Date.now()) / 1000)),\n    })\n    console.log(`\\nPaste this blob into the remote dashboard/CLI:\\n\\n${blob}\\n`)\n  } else {\n    const { account, created } = await upsertImportedAccount(store, {\n      accessToken: result.access,\n      refreshToken: result.refresh.split('|')[0]!,\n      tokenType: 'Bearer',\n      expiresAt: new Date(result.expires).toISOString(),\n      authMethod: 'oauth',\n      email: result.email ?? null,\n      projectId: result.projectId || null,\n    }, { overwriteExisting: true })\n    console.log(`${created ? 'Added' : 'Updated'} account: ${account.email ?? '(no email)'} (project: ${result.projectId || 'default'})`)\n  }\n\n  await callback?.close()\n}\n\nasync function statusCommand() {\n  const store = createReadOnlyStoreOrExit()\n  const storage = await store.load()\n  if (storage.accounts.length === 0) {\n    console.log('No agy accounts. Run `dsh-agy login` first.')\n    return\n  }\n  console.log(`\\n${storage.accounts.length} account(s), active index ${storage.activeIndex}:\\n`)\n  const sessions = new AgySessionManager({ store })\n  for (const [index, account] of storage.accounts.entries()) {\n    const marker = index === storage.activeIndex ? '★' : ' '\n    const state = account.enabled === false ? 'disabled'\n      : account.verificationRequired ? 'verification-required'\n      : account.coolingDownUntil && account.coolingDownUntil > Date.now() ? 'cooling'\n      : 'active'\n    console.log(` ${marker} [${index}] ${account.email ?? '(no email)'} — ${state}${account.projectId ? ` (project: ${account.projectId})` : ''}`)\n\n    // Best-effort quota summary via fetchAvailableModels (fresh access token).\n    const session = await sessions.getSession().catch(() => undefined)\n    if (session && session.index === index) {\n      try {\n        const { fetchAvailableModels } = await import('../adapter/models.ts')\n        const discovered = await fetchAvailableModels(session.auth.access, session.account.projectId)\n        const entries = Object.entries(discovered.models ?? {})\n        if (entries.length > 0) {\n          const withQuota = entries\n            .map(([id, entry]) => ({ id, ...entry.quotaInfo }))\n            .filter((e) => typeof e.remainingFraction === 'number')\n            .sort((a, b) => (a.remainingFraction ?? 0) - (b.remainingFraction ?? 0))\n          if (withQuota.length > 0) {\n            const lowest = withQuota[0]!\n            console.log(`       models: ${entries.length}, lowest quota: ${Math.round((lowest.remainingFraction ?? 0) * 100)}% (${lowest.id})${lowest.resetTime ? `, resets ${new Date(lowest.resetTime).toISOString()}` : ''}`)\n          } else {\n            console.log(`       models: ${entries.length} (no per-model quota reported)`)\n          }\n        }\n      } catch (error) {\n        console.log(`       quota: unavailable (${error instanceof Error ? error.message : String(error)})`)\n      }\n    }\n  }\n}\n\nasync function importCommand(options: { blob: boolean; files?: string[]; email?: string; overwrite: boolean }) {\n  const store = createStore()\n  let items: Array<{ source: unknown; kind: 'json' | 'blob' }>\n  if (options.files && options.files.length > 0) {\n    items = options.files.map((file) => {\n      const raw = readFileSync(file, 'utf8')\n      return { source: options.blob ? raw : (JSON.parse(raw) as unknown), kind: options.blob ? 'blob' : 'json' }\n    })\n  } else {\n    const pasted = await ask('Paste the agy token JSON (or blob with --blob): ')\n    items = [{ source: pasted, kind: options.blob ? 'blob' : 'json' }]\n  }\n  const result = await importManySources(items, store, {\n    email: options.email,\n    overwriteExisting: options.overwrite,\n  })\n  console.log(`Imported ${result.imported}, replaced ${result.replaced}${result.errors.length > 0 ? `, ${result.errors.length} failed` : ''}`)\n  for (const error of result.errors) console.log(`  ! ${error}`)\n}\n\nasync function exportCommand(options: { index?: string; out?: string }) {\n  const store = createReadOnlyStoreOrExit()\n  const sessions = new AgySessionManager({ store })\n  const storage = await store.load()\n  const indices = options.index !== undefined\n    ? [Number(options.index)]\n    : storage.accounts.map((_, i) => i)\n\n  let exported = 0\n  for (const index of indices) {\n    const account = storage.accounts[index]\n    if (!account) {\n      console.log(`[${index}] not found`)\n      continue\n    }\n    const result = await sessions.exportBlob(index)\n    if (!result.blob) {\n      console.log(`[${index}] ${account.email ?? ''} — FAILED: ${result.error}`)\n      continue\n    }\n    if (options.out) {\n      const file = join(options.out, `dsh-agy-${index}.blob`)\n      writeFileSync(file, result.blob + '\\n')\n      console.log(`[${index}] ${account.email ?? ''} — wrote ${file}`)\n    } else {\n      console.log(result.blob)\n    }\n    exported++\n  }\n  if (!options.out) console.log(`\\n${exported} blob(s) exported — one line each, paste into a remote import`)\n}\n\nasync function verifyCommand(options: { index?: string }) {\n  const store = createReadOnlyStoreOrExit()\n  const sessions = new AgySessionManager({ store })\n  const storage = await store.load()\n  const indices = options.index !== undefined\n    ? [Number(options.index)]\n    : storage.accounts.map((_, i) => i)\n\n  for (const index of indices) {\n    const account = storage.accounts[index]\n    if (!account) {\n      console.log(`[${index}] not found`)\n      continue\n    }\n    const result = await sessions.verifyAccount(index)\n    if (result.ok) {\n      console.log(`[${index}] ${account.email ?? ''} — OK${result.email && result.email !== account.email ? ` (userinfo: ${result.email})` : ''}`)\n    } else {\n      console.log(`[${index}] ${account.email ?? ''} — FAILED: ${result.error}`)\n    }\n  }\n}\n\nasync function logoutCommand(options: { index?: string; email?: string }) {\n  const store = createReadOnlyStoreOrExit()\n  await store.mutate((storage) => {\n    const index = options.index !== undefined\n      ? Number(options.index)\n      : options.email\n        ? storage.accounts.findIndex((a) => a.email?.toLowerCase() === options.email!.toLowerCase())\n        : storage.activeIndex\n    if (index < 0 || index >= storage.accounts.length) {\n      throw new Error(`account not found (index ${index})`)\n    }\n    const [removed] = storage.accounts.splice(index, 1)\n    if (storage.activeIndex >= storage.accounts.length) storage.activeIndex = 0\n    console.log(`Removed account: ${removed?.email ?? `[${index}]`}`)\n  })\n}\n\nexport function createProgram(): Command {\n  const program = new Command()\n  program\n    .name('dsh-agy')\n    .description('Google Antigravity (agy) account management for DeepSeek Harness')\n    .version(PACKAGE_VERSION)\n\n  program\n    .command('login')\n    .description('OAuth login (browser, or headless paste)')\n    .option('--headless', 'print the URL and wait for a pasted redirect URL', false)\n    .option('--blob', 'print a paste-credential blob instead of storing the account', false)\n    .option('--port <n>', 'loopback callback port', '51121')\n    .option('--project <id>', 'bind the login to a specific project')\n    .option('--timeout <ms>', 'callback timeout', '300000')\n    .action(async (options) => {\n      await loginCommand({ ...options, timeout: options.timeout })\n    })\n\n  program\n    .command('status')\n    .description('List accounts and their health')\n    .action(async () => {\n      await statusCommand()\n    })\n\n  program\n    .command('import')\n    .description('Import agy token files or paste credentials')\n    .argument('[files...]', 'paths to agy auth.json token files (multiple allowed)')\n    .option('--blob', 'the pasted value is a credential blob', false)\n    .option('--email <email>', 'account email (skips userinfo verification)')\n    .option('--overwrite', 'replace an existing account with the same email', false)\n    .action(async (files: string[] | undefined, options: { blob: boolean; email?: string; overwrite: boolean }) => {\n      await importCommand({ ...options, files })\n    })\n\n  program\n    .command('export')\n    .description('Export account credentials as paste blobs')\n    .option('--index <n>', 'export one account by index; default all')\n    .option('--out <dir>', 'write one dsh-agy-<index>.blob file per account into this directory (default: print to stdout)')\n    .action(async (options: { index?: string; out?: string }) => {\n      await exportCommand(options)\n    })\n\n  program\n    .command('verify')\n    .description('Verify account credentials (refresh + userinfo)')\n    .option('--index <n>', 'verify one account by index; default all')\n    .action(async (options: { index?: string }) => {\n      await verifyCommand(options)\n    })\n\n  program\n    .command('logout')\n    .description('Remove an account')\n    .option('--index <n>', 'account index (default: active)')\n    .option('--email <email>', 'account email')\n    .action(async (options: { index?: string; email?: string }) => {\n      await logoutCommand(options)\n    })\n\n  return program\n}\n\nexport { AGY_DEFAULT_REDIRECT_URI }\n"],"mappings":";;;;;;;;;;;;AAkBA,MAAM,eAAe;;;;;;AAOrB,SAAgB,oBAAoB,UAAiD,CAAC,GAAmB;CACvG,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,YAAY,QAAQ,aAAa;CAEvC,IAAI;CACJ,IAAI;CACJ,MAAM,SAAS,IAAI,SAAyB,SAAS,WAAW;EAC9D,gBAAgB;EAChB,eAAe;CACjB,CAAC;CAED,IAAI;CACJ,IAAI;CACJ,MAAM,QAAQ,IAAI,SAAe,SAAS,WAAW;EACnD,eAAe;EACf,cAAc;CAChB,CAAC;CAED,MAAM,SAAiB,cAAc,KAAK,QAAQ;EAChD,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;EACtD,IAAI,IAAI,aAAa,mBAAmB;GACtC,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;GACxC,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;GAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO;IACnB,IAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;IAClD,IAAI,IAAI,gCAAgC;IACxC;GACF;GACA,IAAI,UAAU,KAAK;IAAE,gBAAgB;IAAa,YAAY;GAAQ,CAAC;GACvE,IAAI,IAAI,YAAY;GACpB,cAAc;IAAE;IAAM;IAAO,KAAK,IAAI,SAAS;GAAE,CAAC;GAElD,iBAAiB,OAAO,MAAM,GAAG,IAAI;GACrC;EACF;EACA,IAAI,UAAU,GAAG;EACjB,IAAI,IAAI,WAAW;CACrB,CAAC;CAED,OAAO,GAAG,UAAU,UAAiC;EACnD,IAAI,MAAM,SAAS,cACjB,6BAAa,IAAI,MAAM,QAAQ,KAAK,kDAAkD,CAAC;OAEvF,aAAa,KAAK;EAEpB,YAAY,KAAK;CACnB,CAAC;CAED,OAAO,OAAO,MAAM,mBAAmB;EACrC,aAAa;CACf,CAAC;CAED,MAAM,UAAU,iBAAiB;EAC/B,6BAAa,IAAI,MAAM,kDAAkD,CAAC;EAC1E,OAAO,MAAM;CACf,GAAG,SAAS;CAeZ,OAAO;EAZL;EACA;EACA,MAAM,QAAQ;GACZ,aAAa,OAAO;GACpB,IAAI,OAAO,WAAW;IAGpB,OAAO,oBAAoB;IAC3B,MAAM,IAAI,SAAe,YAAY,OAAO,YAAY,QAAQ,CAAC,CAAC;GACpE;EACF;CAEU;AACd;;AAGA,eAAsB,YAAY,KAA+B;CAC/D,MAAM,EAAE,UAAU,MAAM,OAAO;CAC/B,MAAM,WAAW,QAAQ;CACzB,MAAM,UAAU,aAAa,WAAW,CAAC,QAAQ,GAAG,IAChD,aAAa,UAAU;EAAC;EAAO;EAAM;EAAS;EAAI;CAAG,IACrD,CAAC,YAAY,GAAG;CACpB,OAAO,IAAI,SAAkB,YAAY;EACvC,MAAM,QAAQ,MAAM,QAAQ,IAAK,QAAQ,MAAM,CAAC,GAAG,EAAE,OAAO,SAAS,CAAC;EACtE,MAAM,GAAG,eAAe,QAAQ,KAAK,CAAC;EACtC,MAAM,GAAG,eAAe,QAAQ,IAAI,CAAC;CACvC,CAAC;AACH;;;;;;;;;ACvFA,MAAM,EAAE,SAAS,oBAAoB,KAAK,MACxC,aAAa,IAAI,IAAI,sBAAsB,YAAY,GAAG,GAAG,MAAM,CACrE;AAEA,SAAS,YAAY,UAAkC,CAAC,GAAqB;CAC3E,MAAM,UAAU,eAAe;CAC/B,IAAI;CACJ,IAAI,QAAQ,UAAU;EAIpB,MAAM,YAAY,cAAc,OAAO;EACvC,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,yDAAyD;EAE3E,QAAQ,kBAAkB,UAAU,SAAS,CAAC;CAChD,OACE,QAAQ,sBAAsB,OAAO,CAAC,CAAC;CAEzC,OAAO,IAAI,iBAAiB;EAAE,MAAM,GAAG,QAAQ;EAAqB;CAAM,CAAC;AAC7E;;AAGA,SAAS,4BAA8C;CACrD,IAAI;EACF,OAAO,YAAY,EAAE,UAAU,KAAK,CAAC;CACvC,SAAS,OAAO;EACd,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;EACpE,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAe,IAAI,UAAmC;CACpD,MAAM,KAAK,gBAAgB;EAAE,OAAA;EAAO,QAAA;CAAO,CAAC;CAC5C,IAAI;EACF,QAAQ,MAAM,GAAG,SAAS,QAAQ,EAAA,CAAG,KAAK;CAC5C,UAAU;EACR,GAAG,MAAM;CACX;AACF;;AAGA,SAAS,kBAA2B;CAClC,OAAO,CAAC,EAAE,QAAQ,IAAI,kBAAkB,QAAQ,IAAI,cAAc,QAAQ,IAAI;AAChF;AAEA,eAAe,aAAa,SAAiG;CAC3H,MAAM,QAAQ,YAAY;CAC1B,MAAM,cAAc,oBAAoB,QAAQ,KAAK;CACrD,IAAI,CAAC,QAAQ,YAAY,gBAAgB,GAAG;EAC1C,QAAQ,IAAI,yFAAyF;EACrG,QAAQ,WAAW;CACrB;CAEA,IAAI;CACJ,IAAI,CAAC,QAAQ,UAAU;EAIrB,WAAW,oBAAoB;GAAE,MAAM,QAAQ;GAAM,WAAW,OAAO,QAAQ,OAAO,KAAK;EAAQ,CAAC;EACpG,IAAI;GACF,MAAM,SAAS;EACjB,SAAS,OAAO;GACd,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;GACpE,QAAQ,KAAK,CAAC;EAChB;CACF;CAEA,MAAM,EAAE,KAAK,aAAa,MAAM,qBAAqB,aAAa,QAAQ,WAAW,EAAE;CACvF,QAAQ,IAAI,mDAAmD,IAAI,GAAG;CAEtE,IAAI;CACJ,IAAI;CAEJ,IAAI,QAAQ,UAAU;EACpB,MAAM,SAAS,MAAM,IAAI,uDAAuD;EAChF,MAAM,SAAS,IAAI,IAAI,MAAM;EAC7B,OAAO,OAAO,aAAa,IAAI,MAAM,KAAK;EAC1C,QAAQ,OAAO,aAAa,IAAI,OAAO,KAAK;EAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO;GACnB,QAAQ,MAAM,6CAA6C;GAC3D,QAAQ,KAAK,CAAC;EAChB;CACF,OAAO;EAEL,IAAI,CAAC,MADgB,YAAY,GAAG,GACvB,QAAQ,IAAI,mEAAmE;EAC5F,IAAI;EACJ,IAAI;GACF,iBAAiB,MAAM,SAAU;EACnC,SAAS,OAAO;GACd,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;GACpE,QAAQ,KAAK,CAAC;EAChB;EACA,OAAO,eAAe;EACtB,QAAQ,eAAe;CACzB;CAIA,MAAM,SAAS,MAAM,oBAAoB,MAAM,OAAO,aAAa,QAAQ;CAC3E,IAAI,OAAO,SAAS,UAAU;EAC5B,QAAQ,MAAM,iBAAiB,OAAO,OAAO;EAC7C,QAAQ,KAAK,CAAC;CAChB;CAEA,IAAI,QAAQ,MAAM;EAChB,MAAM,OAAO,qBAAqB,OAAO;GACvC,cAAc,OAAO;GACrB,eAAe,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC;GACzC,YAAY,KAAK,IAAI,GAAG,KAAK,OAAO,OAAO,UAAU,KAAK,IAAI,KAAK,GAAI,CAAC;EAC1E,CAAC;EACD,QAAQ,IAAI,uDAAuD,KAAK,GAAG;CAC7E,OAAO;EACL,MAAM,EAAE,SAAS,YAAY,MAAM,sBAAsB,OAAO;GAC9D,aAAa,OAAO;GACpB,cAAc,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC;GACxC,WAAW;GACX,WAAW,IAAI,KAAK,OAAO,OAAO,CAAC,CAAC,YAAY;GAChD,YAAY;GACZ,OAAO,OAAO,SAAS;GACvB,WAAW,OAAO,aAAa;EACjC,GAAG,EAAE,mBAAmB,KAAK,CAAC;EAC9B,QAAQ,IAAI,GAAG,UAAU,UAAU,UAAU,YAAY,QAAQ,SAAS,aAAa,aAAa,OAAO,aAAa,UAAU,EAAE;CACtI;CAEA,MAAM,UAAU,MAAM;AACxB;AAEA,eAAe,gBAAgB;CAC7B,MAAM,QAAQ,0BAA0B;CACxC,MAAM,UAAU,MAAM,MAAM,KAAK;CACjC,IAAI,QAAQ,SAAS,WAAW,GAAG;EACjC,QAAQ,IAAI,6CAA6C;EACzD;CACF;CACA,QAAQ,IAAI,KAAK,QAAQ,SAAS,OAAO,4BAA4B,QAAQ,YAAY,IAAI;CAC7F,MAAM,WAAW,IAAI,kBAAkB,EAAE,MAAM,CAAC;CAChD,KAAK,MAAM,CAAC,OAAO,YAAY,QAAQ,SAAS,QAAQ,GAAG;EACzD,MAAM,SAAS,UAAU,QAAQ,cAAc,MAAM;EACrD,MAAM,QAAQ,QAAQ,YAAY,QAAQ,aACtC,QAAQ,uBAAuB,0BAC/B,QAAQ,oBAAoB,QAAQ,mBAAmB,KAAK,IAAI,IAAI,YACpE;EACJ,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,QAAQ,SAAS,aAAa,KAAK,QAAQ,QAAQ,YAAY,cAAc,QAAQ,UAAU,KAAK,IAAI;EAG7I,MAAM,UAAU,MAAM,SAAS,WAAW,CAAC,CAAC,YAAY,KAAA,CAAS;EACjE,IAAI,WAAW,QAAQ,UAAU,OAC/B,IAAI;GACF,MAAM,EAAE,yBAAyB,MAAM,OAAO,yBAAuB,CAAA,MAAA,MAAA,EAAA,CAAA;GACrE,MAAM,aAAa,MAAM,qBAAqB,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,SAAS;GAC5F,MAAM,UAAU,OAAO,QAAQ,WAAW,UAAU,CAAC,CAAC;GACtD,IAAI,QAAQ,SAAS,GAAG;IACtB,MAAM,YAAY,QACf,KAAK,CAAC,IAAI,YAAY;KAAE;KAAI,GAAG,MAAM;IAAU,EAAE,CAAC,CAClD,QAAQ,MAAM,OAAO,EAAE,sBAAsB,QAAQ,CAAC,CACtD,MAAM,GAAG,OAAO,EAAE,qBAAqB,MAAM,EAAE,qBAAqB,EAAE;IACzE,IAAI,UAAU,SAAS,GAAG;KACxB,MAAM,SAAS,UAAU;KACzB,QAAQ,IAAI,kBAAkB,QAAQ,OAAO,kBAAkB,KAAK,OAAO,OAAO,qBAAqB,KAAK,GAAG,EAAE,KAAK,OAAO,GAAG,GAAG,OAAO,YAAY,YAAY,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,YAAY,MAAM,IAAI;IACrN,OACE,QAAQ,IAAI,kBAAkB,QAAQ,OAAO,+BAA+B;GAEhF;EACF,SAAS,OAAO;GACd,QAAQ,IAAI,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,EAAE;EACrG;CAEJ;AACF;AAEA,eAAe,cAAc,SAAkF;CAC7G,MAAM,QAAQ,YAAY;CAC1B,IAAI;CACJ,IAAI,QAAQ,SAAS,QAAQ,MAAM,SAAS,GAC1C,QAAQ,QAAQ,MAAM,KAAK,SAAS;EAClC,MAAM,MAAM,aAAa,MAAM,MAAM;EACrC,OAAO;GAAE,QAAQ,QAAQ,OAAO,MAAO,KAAK,MAAM,GAAG;GAAe,MAAM,QAAQ,OAAO,SAAS;EAAO;CAC3G,CAAC;MAGD,QAAQ,CAAC;EAAE,QAAQ,MADE,IAAI,kDAAkD;EAChD,MAAM,QAAQ,OAAO,SAAS;CAAO,CAAC;CAEnE,MAAM,SAAS,MAAM,kBAAkB,OAAO,OAAO;EACnD,OAAO,QAAQ;EACf,mBAAmB,QAAQ;CAC7B,CAAC;CACD,QAAQ,IAAI,YAAY,OAAO,SAAS,aAAa,OAAO,WAAW,OAAO,OAAO,SAAS,IAAI,KAAK,OAAO,OAAO,OAAO,WAAW,IAAI;CAC3I,KAAK,MAAM,SAAS,OAAO,QAAQ,QAAQ,IAAI,OAAO,OAAO;AAC/D;AAEA,eAAe,cAAc,SAA2C;CACtE,MAAM,QAAQ,0BAA0B;CACxC,MAAM,WAAW,IAAI,kBAAkB,EAAE,MAAM,CAAC;CAChD,MAAM,UAAU,MAAM,MAAM,KAAK;CACjC,MAAM,UAAU,QAAQ,UAAU,KAAA,IAC9B,CAAC,OAAO,QAAQ,KAAK,CAAC,IACtB,QAAQ,SAAS,KAAK,GAAG,MAAM,CAAC;CAEpC,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,UAAU,QAAQ,SAAS;EACjC,IAAI,CAAC,SAAS;GACZ,QAAQ,IAAI,IAAI,MAAM,YAAY;GAClC;EACF;EACA,MAAM,SAAS,MAAM,SAAS,WAAW,KAAK;EAC9C,IAAI,CAAC,OAAO,MAAM;GAChB,QAAQ,IAAI,IAAI,MAAM,IAAI,QAAQ,SAAS,GAAG,aAAa,OAAO,OAAO;GACzE;EACF;EACA,IAAI,QAAQ,KAAK;GACf,MAAM,OAAO,KAAK,QAAQ,KAAK,WAAW,MAAM,MAAM;GACtD,cAAc,MAAM,OAAO,OAAO,IAAI;GACtC,QAAQ,IAAI,IAAI,MAAM,IAAI,QAAQ,SAAS,GAAG,WAAW,MAAM;EACjE,OACE,QAAQ,IAAI,OAAO,IAAI;EAEzB;CACF;CACA,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,SAAS,8DAA8D;AAC5G;AAEA,eAAe,cAAc,SAA6B;CACxD,MAAM,QAAQ,0BAA0B;CACxC,MAAM,WAAW,IAAI,kBAAkB,EAAE,MAAM,CAAC;CAChD,MAAM,UAAU,MAAM,MAAM,KAAK;CACjC,MAAM,UAAU,QAAQ,UAAU,KAAA,IAC9B,CAAC,OAAO,QAAQ,KAAK,CAAC,IACtB,QAAQ,SAAS,KAAK,GAAG,MAAM,CAAC;CAEpC,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,UAAU,QAAQ,SAAS;EACjC,IAAI,CAAC,SAAS;GACZ,QAAQ,IAAI,IAAI,MAAM,YAAY;GAClC;EACF;EACA,MAAM,SAAS,MAAM,SAAS,cAAc,KAAK;EACjD,IAAI,OAAO,IACT,QAAQ,IAAI,IAAI,MAAM,IAAI,QAAQ,SAAS,GAAG,OAAO,OAAO,SAAS,OAAO,UAAU,QAAQ,QAAQ,eAAe,OAAO,MAAM,KAAK,IAAI;OAE3I,QAAQ,IAAI,IAAI,MAAM,IAAI,QAAQ,SAAS,GAAG,aAAa,OAAO,OAAO;CAE7E;AACF;AAEA,eAAe,cAAc,SAA6C;CAExE,MADc,0BACJ,CAAC,CAAC,QAAQ,YAAY;EAC9B,MAAM,QAAQ,QAAQ,UAAU,KAAA,IAC5B,OAAO,QAAQ,KAAK,IACpB,QAAQ,QACN,QAAQ,SAAS,WAAW,MAAM,EAAE,OAAO,YAAY,MAAM,QAAQ,MAAO,YAAY,CAAC,IACzF,QAAQ;EACd,IAAI,QAAQ,KAAK,SAAS,QAAQ,SAAS,QACzC,MAAM,IAAI,MAAM,4BAA4B,MAAM,EAAE;EAEtD,MAAM,CAAC,WAAW,QAAQ,SAAS,OAAO,OAAO,CAAC;EAClD,IAAI,QAAQ,eAAe,QAAQ,SAAS,QAAQ,QAAQ,cAAc;EAC1E,QAAQ,IAAI,oBAAoB,SAAS,SAAS,IAAI,MAAM,IAAI;CAClE,CAAC;AACH;AAEA,SAAgB,gBAAyB;CACvC,MAAM,UAAU,IAAI,QAAQ;CAC5B,QACG,KAAK,SAAS,CAAC,CACf,YAAY,kEAAkE,CAAC,CAC/E,QAAQ,eAAe;CAE1B,QACG,QAAQ,OAAO,CAAC,CAChB,YAAY,0CAA0C,CAAC,CACvD,OAAO,cAAc,oDAAoD,KAAK,CAAC,CAC/E,OAAO,UAAU,gEAAgE,KAAK,CAAC,CACvF,OAAO,cAAc,0BAA0B,OAAO,CAAC,CACvD,OAAO,kBAAkB,sCAAsC,CAAC,CAChE,OAAO,kBAAkB,oBAAoB,QAAQ,CAAC,CACtD,OAAO,OAAO,YAAY;EACzB,MAAM,aAAa;GAAE,GAAG;GAAS,SAAS,QAAQ;EAAQ,CAAC;CAC7D,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,gCAAgC,CAAC,CAC7C,OAAO,YAAY;EAClB,MAAM,cAAc;CACtB,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,6CAA6C,CAAC,CAC1D,SAAS,cAAc,uDAAuD,CAAC,CAC/E,OAAO,UAAU,yCAAyC,KAAK,CAAC,CAChE,OAAO,mBAAmB,6CAA6C,CAAC,CACxE,OAAO,eAAe,mDAAmD,KAAK,CAAC,CAC/E,OAAO,OAAO,OAA6B,YAAmE;EAC7G,MAAM,cAAc;GAAE,GAAG;GAAS;EAAM,CAAC;CAC3C,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,2CAA2C,CAAC,CACxD,OAAO,eAAe,0CAA0C,CAAC,CACjE,OAAO,eAAe,gGAAgG,CAAC,CACvH,OAAO,OAAO,YAA8C;EAC3D,MAAM,cAAc,OAAO;CAC7B,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,iDAAiD,CAAC,CAC9D,OAAO,eAAe,0CAA0C,CAAC,CACjE,OAAO,OAAO,YAAgC;EAC7C,MAAM,cAAc,OAAO;CAC7B,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,mBAAmB,CAAC,CAChC,OAAO,eAAe,iCAAiC,CAAC,CACxD,OAAO,mBAAmB,eAAe,CAAC,CAC1C,OAAO,OAAO,YAAgD;EAC7D,MAAM,cAAc,OAAO;CAC7B,CAAC;CAEH,OAAO;AACT"}
+{"version":3,"file":"index.mjs","names":[],"sources":["../../src/cli/callback-server.ts","../../src/cli/index.ts"],"sourcesContent":["/** Loopback OAuth callback server for the standalone CLI login flow. */\n\nimport { createServer } from 'node:http'\nimport type { Server } from 'node:http'\n\nexport interface CallbackResult {\n  code: string\n  state: string\n  url: string\n}\n\nexport interface CallbackHandle {\n  result: Promise<CallbackResult>\n  /** Resolves once the loopback listener is bound; rejects on bind errors. */\n  ready: Promise<void>\n  close(): Promise<void>\n}\n\nconst SUCCESS_HTML = `<!doctype html><html><head><meta charset=\"utf-8\"><title>Login successful</title></head>\n<body style=\"font-family:system-ui;text-align:center;padding:3rem\">\n<h2>✓ Authentication successful</h2>\n<p>You can close this tab and return to the terminal.</p>\n</body></html>`\n\n/** Listen on 127.0.0.1:<port>/oauth-callback and resolve with the code+state. */\nexport function startCallbackServer(options: { port?: number; timeoutMs?: number } = {}): CallbackHandle {\n  const port = options.port ?? 51121\n  const timeoutMs = options.timeoutMs ?? 300_000\n\n  let resolveResult: (value: CallbackResult) => void\n  let rejectResult: (reason: Error) => void\n  const result = new Promise<CallbackResult>((resolve, reject) => {\n    resolveResult = resolve\n    rejectResult = reject\n  })\n\n  let resolveReady: () => void\n  let rejectReady: (reason: Error) => void\n  const ready = new Promise<void>((resolve, reject) => {\n    resolveReady = resolve\n    rejectReady = reject\n  })\n\n  const server: Server = createServer((req, res) => {\n    const url = new URL(req.url ?? '/', 'http://localhost')\n    if (url.pathname === '/oauth-callback') {\n      const code = url.searchParams.get('code')\n      const state = url.searchParams.get('state')\n      if (!code || !state) {\n        res.writeHead(400, { 'Content-Type': 'text/html' })\n        res.end('<h2>Missing code or state</h2>')\n        return\n      }\n      res.writeHead(200, { 'Content-Type': 'text/html', connection: 'close' })\n      res.end(SUCCESS_HTML)\n      resolveResult({ code, state, url: url.toString() })\n      // Give the browser a moment to render before the server closes.\n      setTimeout(() => server.close(), 1500)\n      return\n    }\n    res.writeHead(404)\n    res.end('Not found')\n  })\n\n  server.on('error', (error: NodeJS.ErrnoException) => {\n    if (error.code === 'EADDRINUSE') {\n      rejectResult(new Error(`Port ${port} is already in use — pass --port to pick another.`))\n    } else {\n      rejectResult(error)\n    }\n    rejectReady(error)\n  })\n\n  server.listen(port, '127.0.0.1', () => {\n    resolveReady()\n  })\n\n  const timeout = setTimeout(() => {\n    rejectResult(new Error('Authentication timed out — no callback received.'))\n    server.close()\n  }, timeoutMs)\n\n  const handle: CallbackHandle = {\n    result,\n    ready,\n    async close() {\n      clearTimeout(timeout)\n      if (server.listening) {\n        // The success page's keep-alive connection would otherwise hold\n        // server.close() (and the CLI process) open indefinitely.\n        server.closeAllConnections()\n        await new Promise<void>((resolve) => server.close(() => resolve()))\n      }\n    },\n  }\n  return handle\n}\n\n/** Open a URL in the system browser (best effort). */\nexport async function openBrowser(url: string): Promise<boolean> {\n  const { spawn } = await import('node:child_process')\n  const platform = process.platform\n  const command = platform === 'darwin' ? ['open', url]\n    : platform === 'win32' ? ['cmd', '/c', 'start', '', url]\n    : ['xdg-open', url]\n  return new Promise<boolean>((resolve) => {\n    const child = spawn(command[0]!, command.slice(1), { stdio: 'ignore' })\n    child.on('error', () => resolve(false))\n    child.on('spawn', () => resolve(true))\n  })\n}\n","/**\n * dsh-agy CLI: login / status / import / verify / logout.\n * Standalone bin — the dsh launcher has no plugin subcommand slot, and the\n * remote paste-blob flow must run on machines without a harness.\n */\n\nimport { Command } from 'commander'\nimport { readFileSync, writeFileSync } from 'node:fs'\nimport { join } from 'node:path'\nimport { createInterface } from 'node:readline/promises'\nimport { stdin as input, stdout as output } from 'node:process'\nimport { authorizeAntigravity } from '../oauth/authorize.ts'\nimport { exchangeAntigravity } from '../oauth/exchange.ts'\nimport { encodeCredentialBlob } from '../oauth/blob.ts'\nimport { AGY_DEFAULT_REDIRECT_URI } from '../oauth/constants.ts'\nimport { createAesGcmCodec, deriveKey, loadMasterKey, resolveDshHome, resolveMasterKeyCodec } from '../store/keyring.ts'\nimport type { SecretCodec } from '../store/keyring.ts'\nimport { JsonAccountStore } from '../store/accounts.ts'\nimport { AgySessionManager } from '../session.ts'\nimport { isAgyDisabled } from '../runtime/risk.ts'\nimport { startCallbackServer, openBrowser } from './callback-server.ts'\nimport { importManySources, upsertImportedAccount } from './import.ts'\n\n/** Package version, read from the shipped package.json — never hard-coded twice. */\nconst { version: PACKAGE_VERSION } = JSON.parse(\n  readFileSync(new URL('../../package.json', import.meta.url), 'utf8'),\n) as { version: string }\n\nfunction createStore(options: { readOnly?: boolean } = {}): JsonAccountStore {\n  const dshHome = resolveDshHome()\n  let codec: SecretCodec\n  if (options.readOnly) {\n    // Read-only commands must never create the master key or the credentials\n    // document: they would fail for no reason on a read-only HOME and write\n    // files nobody asked for anywhere else.\n    const masterKey = loadMasterKey(dshHome)\n    if (!masterKey) {\n      throw new Error('No agy account store found — run `dsh-agy login` first.')\n    }\n    codec = createAesGcmCodec(deriveKey(masterKey))\n  } else {\n    codec = resolveMasterKeyCodec(dshHome).codec\n  }\n  return new JsonAccountStore({ file: `${dshHome}/agy-accounts.json`, codec })\n}\n\n/** Read-only store with a friendly error when no credentials exist yet. */\nfunction createReadOnlyStoreOrExit(): JsonAccountStore {\n  try {\n    return createStore({ readOnly: true })\n  } catch (error) {\n    console.error(error instanceof Error ? error.message : String(error))\n    process.exit(1)\n  }\n}\n\nasync function ask(question: string): Promise<string> {\n  const rl = createInterface({ input, output })\n  try {\n    return (await rl.question(question)).trim()\n  } finally {\n    rl.close()\n  }\n}\n\n/** Remote/SSH sessions cannot reach a local browser; auto-select headless paste. */\nfunction isRemoteSession(): boolean {\n  return !!(process.env.SSH_CONNECTION || process.env.SSH_CLIENT || process.env.SSH_TTY)\n}\n\nasync function loginCommand(options: { headless: boolean; blob: boolean; port: number; project?: string; timeout?: string }) {\n  const store = createStore()\n  const redirectUri = `http://localhost:${options.port}/oauth-callback`\n  if (!options.headless && isRemoteSession()) {\n    console.log('(SSH session detected — using headless paste flow; pass --headless explicitly to force)')\n    options.headless = true\n  }\n\n  let callback: Awaited<ReturnType<typeof startCallbackServer>> | undefined\n  if (!options.headless) {\n    // Bind the loopback listener BEFORE the URL is shown: a local process\n    // squatting on the fixed port could otherwise capture code+state (the\n    // state carries the PKCE verifier) and steal the refresh token.\n    callback = startCallbackServer({ port: options.port, timeoutMs: Number(options.timeout) || 300_000 })\n    try {\n      await callback.ready\n    } catch (error) {\n      console.error(error instanceof Error ? error.message : String(error))\n      process.exit(1)\n    }\n  }\n\n  const { url, verifier } = await authorizeAntigravity(redirectUri, options.project ?? '')\n  console.log(`\\nOpen this URL in a browser to authorize:\\n\\n  ${url}\\n`)\n\n  let code: string\n  let state: string\n\n  if (options.headless) {\n    const pasted = await ask('After approving, paste the full redirected URL here: ')\n    const parsed = new URL(pasted)\n    code = parsed.searchParams.get('code') ?? ''\n    state = parsed.searchParams.get('state') ?? ''\n    if (!code || !state) {\n      console.error('Error: pasted URL is missing code or state.')\n      process.exit(1)\n    }\n  } else {\n    const opened = await openBrowser(url)\n    if (!opened) console.log('(Could not open a browser automatically — open the URL manually.)')\n    let callbackResult: { code: string; state: string; url: string }\n    try {\n      callbackResult = await callback!.result\n    } catch (error) {\n      console.error(error instanceof Error ? error.message : String(error))\n      process.exit(1)\n    }\n    code = callbackResult.code\n    state = callbackResult.state\n  }\n\n  // Bind the exchange to the verifier we issued: a state from any other login\n  // (pasted from another session, or fabricated) must be rejected.\n  const result = await exchangeAntigravity(code, state, redirectUri, verifier)\n  if (result.type === 'failed') {\n    console.error(`Login failed: ${result.error}`)\n    process.exit(1)\n  }\n\n  if (options.blob) {\n    const blob = encodeCredentialBlob('agy', {\n      access_token: result.access,\n      refresh_token: result.refresh.split('|')[0],\n      expires_in: Math.max(0, Math.round((result.expires - Date.now()) / 1000)),\n    })\n    console.log(`\\nPaste this blob into the remote dashboard/CLI:\\n\\n${blob}\\n`)\n  } else {\n    const { account, created } = await upsertImportedAccount(store, {\n      accessToken: result.access,\n      refreshToken: result.refresh.split('|')[0]!,\n      tokenType: 'Bearer',\n      expiresAt: new Date(result.expires).toISOString(),\n      authMethod: 'oauth',\n      email: result.email ?? null,\n      projectId: result.projectId || null,\n      clientId: result.clientId || null,\n    }, { overwriteExisting: true })\n    console.log(`${created ? 'Added' : 'Updated'} account: ${account.email ?? '(no email)'} (project: ${result.projectId || 'default'})`)\n  }\n\n  await callback?.close()\n}\n\nasync function statusCommand() {\n  const store = createReadOnlyStoreOrExit()\n  const storage = await store.load()\n  if (storage.accounts.length === 0) {\n    console.log('No agy accounts. Run `dsh-agy login` first.')\n    return\n  }\n  console.log(`\\n${storage.accounts.length} account(s), active index ${storage.activeIndex}:\\n`)\n  const sessions = new AgySessionManager({ store })\n  for (const [index, account] of storage.accounts.entries()) {\n    const marker = index === storage.activeIndex ? '★' : ' '\n    const state = account.enabled === false ? 'disabled'\n      : account.verificationRequired ? 'verification-required'\n      : account.coolingDownUntil && account.coolingDownUntil > Date.now() ? 'cooling'\n      : 'active'\n    console.log(` ${marker} [${index}] ${account.email ?? '(no email)'} — ${state}${account.projectId ? ` (project: ${account.projectId})` : ''}`)\n\n    // Best-effort quota summary via fetchAvailableModels (fresh access token).\n    const session = await sessions.getSession().catch(() => undefined)\n    if (session && session.index === index) {\n      try {\n        const { fetchAvailableModels } = await import('../adapter/models.ts')\n        const discovered = await fetchAvailableModels(session.auth.access, session.account.projectId)\n        const entries = Object.entries(discovered.models ?? {})\n        if (entries.length > 0) {\n          const withQuota = entries\n            .map(([id, entry]) => ({ id, ...entry.quotaInfo }))\n            .filter((e) => typeof e.remainingFraction === 'number')\n            .sort((a, b) => (a.remainingFraction ?? 0) - (b.remainingFraction ?? 0))\n          if (withQuota.length > 0) {\n            const lowest = withQuota[0]!\n            console.log(`       models: ${entries.length}, lowest quota: ${Math.round((lowest.remainingFraction ?? 0) * 100)}% (${lowest.id})${lowest.resetTime ? `, resets ${new Date(lowest.resetTime).toISOString()}` : ''}`)\n          } else {\n            console.log(`       models: ${entries.length} (no per-model quota reported)`)\n          }\n        }\n      } catch (error) {\n        console.log(`       quota: unavailable (${error instanceof Error ? error.message : String(error)})`)\n      }\n    }\n  }\n}\n\nasync function importCommand(options: { blob: boolean; files?: string[]; email?: string; overwrite: boolean }) {\n  const store = createStore()\n  let items: Array<{ source: unknown; kind: 'json' | 'blob' }>\n  if (options.files && options.files.length > 0) {\n    items = options.files.map((file) => {\n      const raw = readFileSync(file, 'utf8')\n      return { source: options.blob ? raw : (JSON.parse(raw) as unknown), kind: options.blob ? 'blob' : 'json' }\n    })\n  } else {\n    const pasted = await ask('Paste the agy token JSON (or blob with --blob): ')\n    items = [{ source: pasted, kind: options.blob ? 'blob' : 'json' }]\n  }\n  const result = await importManySources(items, store, {\n    email: options.email,\n    overwriteExisting: options.overwrite,\n  })\n  console.log(`Imported ${result.imported}, replaced ${result.replaced}${result.errors.length > 0 ? `, ${result.errors.length} failed` : ''}`)\n  for (const error of result.errors) console.log(`  ! ${error}`)\n}\n\nasync function exportCommand(options: { index?: string; out?: string }) {\n  const store = createReadOnlyStoreOrExit()\n  const sessions = new AgySessionManager({ store })\n  const storage = await store.load()\n  const indices = options.index !== undefined\n    ? [Number(options.index)]\n    : storage.accounts.map((_, i) => i)\n\n  let exported = 0\n  for (const index of indices) {\n    const account = storage.accounts[index]\n    if (!account) {\n      console.log(`[${index}] not found`)\n      continue\n    }\n    const result = await sessions.exportBlob(index)\n    if (!result.blob) {\n      console.log(`[${index}] ${account.email ?? ''} — FAILED: ${result.error}`)\n      continue\n    }\n    if (options.out) {\n      const file = join(options.out, `dsh-agy-${index}.blob`)\n      writeFileSync(file, result.blob + '\\n')\n      console.log(`[${index}] ${account.email ?? ''} — wrote ${file}`)\n    } else {\n      console.log(result.blob)\n    }\n    exported++\n  }\n  if (!options.out) console.log(`\\n${exported} blob(s) exported — one line each, paste into a remote import`)\n}\n\nasync function verifyCommand(options: { index?: string }) {\n  const store = createReadOnlyStoreOrExit()\n  const sessions = new AgySessionManager({ store })\n  const storage = await store.load()\n  const indices = options.index !== undefined\n    ? [Number(options.index)]\n    : storage.accounts.map((_, i) => i)\n\n  for (const index of indices) {\n    const account = storage.accounts[index]\n    if (!account) {\n      console.log(`[${index}] not found`)\n      continue\n    }\n    const result = await sessions.verifyAccount(index)\n    if (result.ok) {\n      console.log(`[${index}] ${account.email ?? ''} — OK${result.email && result.email !== account.email ? ` (userinfo: ${result.email})` : ''}`)\n    } else {\n      console.log(`[${index}] ${account.email ?? ''} — FAILED: ${result.error}`)\n    }\n  }\n}\n\nasync function healthCommand(options: { interval?: string; index?: string[] }) {\n  const store = createReadOnlyStoreOrExit()\n  const sessions = new AgySessionManager({\n    store,\n    onHealthReport: (results) => {\n      for (const result of results) {\n        if (result.ok) console.log(`[${result.index}] ${result.email ?? ''} — OK`)\n        else console.log(`[${result.index}] ${result.email ?? ''} — FAILED: ${result.error}`)\n      }\n    },\n  })\n  const indices = options.index?.map((value) => Number(value))\n\n  if (options.interval) {\n    const intervalMs = Number(options.interval)\n    if (!Number.isFinite(intervalMs) || intervalMs <= 0) {\n      console.error('Error: --interval must be a positive number of milliseconds.')\n      process.exit(1)\n    }\n    console.log(`Health probe every ${intervalMs}ms (Ctrl+C to stop).`)\n    sessions.startHealthProbe(intervalMs, { unref: false })\n    await new Promise<void>(() => {}) // keep the loop alive\n    return\n  }\n\n  const results = await sessions.checkAccounts(indices)\n  if (results.length === 0) console.log('No enabled accounts — run `dsh-agy login` first.')\n}\n\nasync function logoutCommand(options: { index?: string; email?: string }) {\n  const store = createReadOnlyStoreOrExit()\n  await store.mutate((storage) => {\n    const index = options.index !== undefined\n      ? Number(options.index)\n      : options.email\n        ? storage.accounts.findIndex((a) => a.email?.toLowerCase() === options.email!.toLowerCase())\n        : storage.activeIndex\n    if (index < 0 || index >= storage.accounts.length) {\n      throw new Error(`account not found (index ${index})`)\n    }\n    const [removed] = storage.accounts.splice(index, 1)\n    if (storage.activeIndex >= storage.accounts.length) storage.activeIndex = 0\n    console.log(`Removed account: ${removed?.email ?? `[${index}]`}`)\n  })\n}\n\nexport function createProgram(): Command {\n  const program = new Command()\n  program\n    .name('dsh-agy')\n    .description('Google Antigravity (agy) account management for DeepSeek Harness')\n    .version(PACKAGE_VERSION)\n\n  program.hook('preAction', () => {\n    if (isAgyDisabled()) {\n      console.error('dsh-agy is disabled (DSH_AGY_DISABLE=1).')\n      process.exit(1)\n    }\n  })\n\n  program\n    .command('login')\n    .description('OAuth login (browser, or headless paste)')\n    .option('--headless', 'print the URL and wait for a pasted redirect URL', false)\n    .option('--blob', 'print a paste-credential blob instead of storing the account', false)\n    .option('--port <n>', 'loopback callback port', '51121')\n    .option('--project <id>', 'bind the login to a specific project')\n    .option('--timeout <ms>', 'callback timeout', '300000')\n    .action(async (options) => {\n      await loginCommand({ ...options, timeout: options.timeout })\n    })\n\n  program\n    .command('status')\n    .description('List accounts and their health')\n    .action(async () => {\n      await statusCommand()\n    })\n\n  program\n    .command('import')\n    .description('Import agy token files or paste credentials')\n    .argument('[files...]', 'paths to agy auth.json token files (multiple allowed)')\n    .option('--blob', 'the pasted value is a credential blob', false)\n    .option('--email <email>', 'account email (skips userinfo verification)')\n    .option('--overwrite', 'replace an existing account with the same email', false)\n    .action(async (files: string[] | undefined, options: { blob: boolean; email?: string; overwrite: boolean }) => {\n      await importCommand({ ...options, files })\n    })\n\n  program\n    .command('export')\n    .description('Export account credentials as paste blobs')\n    .option('--index <n>', 'export one account by index; default all')\n    .option('--out <dir>', 'write one dsh-agy-<index>.blob file per account into this directory (default: print to stdout)')\n    .action(async (options: { index?: string; out?: string }) => {\n      await exportCommand(options)\n    })\n\n  program\n    .command('verify')\n    .description('Verify account credentials (refresh + userinfo)')\n    .option('--index <n>', 'verify one account by index; default all')\n    .action(async (options: { index?: string }) => {\n      await verifyCommand(options)\n    })\n\n  program\n    .command('health')\n    .description('Check every enabled account (refresh + userinfo), optionally on an interval')\n    .option('--interval <ms>', 'repeat on an interval instead of once')\n    .option('--index <n...>', 'check only these accounts')\n    .action(async (options: { interval?: string; index?: string[] }) => {\n      await healthCommand(options)\n    })\n\n  program\n    .command('logout')\n    .description('Remove an account')\n    .option('--index <n>', 'account index (default: active)')\n    .option('--email <email>', 'account email')\n    .action(async (options: { index?: string; email?: string }) => {\n      await logoutCommand(options)\n    })\n\n  return program\n}\n\nexport { AGY_DEFAULT_REDIRECT_URI }\n"],"mappings":";;;;;;;;;;;;AAkBA,MAAM,eAAe;;;;;;AAOrB,SAAgB,oBAAoB,UAAiD,CAAC,GAAmB;CACvG,MAAM,OAAO,QAAQ,QAAQ;CAC7B,MAAM,YAAY,QAAQ,aAAa;CAEvC,IAAI;CACJ,IAAI;CACJ,MAAM,SAAS,IAAI,SAAyB,SAAS,WAAW;EAC9D,gBAAgB;EAChB,eAAe;CACjB,CAAC;CAED,IAAI;CACJ,IAAI;CACJ,MAAM,QAAQ,IAAI,SAAe,SAAS,WAAW;EACnD,eAAe;EACf,cAAc;CAChB,CAAC;CAED,MAAM,SAAiB,cAAc,KAAK,QAAQ;EAChD,MAAM,MAAM,IAAI,IAAI,IAAI,OAAO,KAAK,kBAAkB;EACtD,IAAI,IAAI,aAAa,mBAAmB;GACtC,MAAM,OAAO,IAAI,aAAa,IAAI,MAAM;GACxC,MAAM,QAAQ,IAAI,aAAa,IAAI,OAAO;GAC1C,IAAI,CAAC,QAAQ,CAAC,OAAO;IACnB,IAAI,UAAU,KAAK,EAAE,gBAAgB,YAAY,CAAC;IAClD,IAAI,IAAI,gCAAgC;IACxC;GACF;GACA,IAAI,UAAU,KAAK;IAAE,gBAAgB;IAAa,YAAY;GAAQ,CAAC;GACvE,IAAI,IAAI,YAAY;GACpB,cAAc;IAAE;IAAM;IAAO,KAAK,IAAI,SAAS;GAAE,CAAC;GAElD,iBAAiB,OAAO,MAAM,GAAG,IAAI;GACrC;EACF;EACA,IAAI,UAAU,GAAG;EACjB,IAAI,IAAI,WAAW;CACrB,CAAC;CAED,OAAO,GAAG,UAAU,UAAiC;EACnD,IAAI,MAAM,SAAS,cACjB,6BAAa,IAAI,MAAM,QAAQ,KAAK,kDAAkD,CAAC;OAEvF,aAAa,KAAK;EAEpB,YAAY,KAAK;CACnB,CAAC;CAED,OAAO,OAAO,MAAM,mBAAmB;EACrC,aAAa;CACf,CAAC;CAED,MAAM,UAAU,iBAAiB;EAC/B,6BAAa,IAAI,MAAM,kDAAkD,CAAC;EAC1E,OAAO,MAAM;CACf,GAAG,SAAS;CAeZ,OAAO;EAZL;EACA;EACA,MAAM,QAAQ;GACZ,aAAa,OAAO;GACpB,IAAI,OAAO,WAAW;IAGpB,OAAO,oBAAoB;IAC3B,MAAM,IAAI,SAAe,YAAY,OAAO,YAAY,QAAQ,CAAC,CAAC;GACpE;EACF;CAEU;AACd;;AAGA,eAAsB,YAAY,KAA+B;CAC/D,MAAM,EAAE,UAAU,MAAM,OAAO;CAC/B,MAAM,WAAW,QAAQ;CACzB,MAAM,UAAU,aAAa,WAAW,CAAC,QAAQ,GAAG,IAChD,aAAa,UAAU;EAAC;EAAO;EAAM;EAAS;EAAI;CAAG,IACrD,CAAC,YAAY,GAAG;CACpB,OAAO,IAAI,SAAkB,YAAY;EACvC,MAAM,QAAQ,MAAM,QAAQ,IAAK,QAAQ,MAAM,CAAC,GAAG,EAAE,OAAO,SAAS,CAAC;EACtE,MAAM,GAAG,eAAe,QAAQ,KAAK,CAAC;EACtC,MAAM,GAAG,eAAe,QAAQ,IAAI,CAAC;CACvC,CAAC;AACH;;;;;;;;;ACtFA,MAAM,EAAE,SAAS,oBAAoB,KAAK,MACxC,aAAa,IAAI,IAAI,sBAAsB,YAAY,GAAG,GAAG,MAAM,CACrE;AAEA,SAAS,YAAY,UAAkC,CAAC,GAAqB;CAC3E,MAAM,UAAU,eAAe;CAC/B,IAAI;CACJ,IAAI,QAAQ,UAAU;EAIpB,MAAM,YAAY,cAAc,OAAO;EACvC,IAAI,CAAC,WACH,MAAM,IAAI,MAAM,yDAAyD;EAE3E,QAAQ,kBAAkB,UAAU,SAAS,CAAC;CAChD,OACE,QAAQ,sBAAsB,OAAO,CAAC,CAAC;CAEzC,OAAO,IAAI,iBAAiB;EAAE,MAAM,GAAG,QAAQ;EAAqB;CAAM,CAAC;AAC7E;;AAGA,SAAS,4BAA8C;CACrD,IAAI;EACF,OAAO,YAAY,EAAE,UAAU,KAAK,CAAC;CACvC,SAAS,OAAO;EACd,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;EACpE,QAAQ,KAAK,CAAC;CAChB;AACF;AAEA,eAAe,IAAI,UAAmC;CACpD,MAAM,KAAK,gBAAgB;EAAE,OAAA;EAAO,QAAA;CAAO,CAAC;CAC5C,IAAI;EACF,QAAQ,MAAM,GAAG,SAAS,QAAQ,EAAA,CAAG,KAAK;CAC5C,UAAU;EACR,GAAG,MAAM;CACX;AACF;;AAGA,SAAS,kBAA2B;CAClC,OAAO,CAAC,EAAE,QAAQ,IAAI,kBAAkB,QAAQ,IAAI,cAAc,QAAQ,IAAI;AAChF;AAEA,eAAe,aAAa,SAAiG;CAC3H,MAAM,QAAQ,YAAY;CAC1B,MAAM,cAAc,oBAAoB,QAAQ,KAAK;CACrD,IAAI,CAAC,QAAQ,YAAY,gBAAgB,GAAG;EAC1C,QAAQ,IAAI,yFAAyF;EACrG,QAAQ,WAAW;CACrB;CAEA,IAAI;CACJ,IAAI,CAAC,QAAQ,UAAU;EAIrB,WAAW,oBAAoB;GAAE,MAAM,QAAQ;GAAM,WAAW,OAAO,QAAQ,OAAO,KAAK;EAAQ,CAAC;EACpG,IAAI;GACF,MAAM,SAAS;EACjB,SAAS,OAAO;GACd,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;GACpE,QAAQ,KAAK,CAAC;EAChB;CACF;CAEA,MAAM,EAAE,KAAK,aAAa,MAAM,qBAAqB,aAAa,QAAQ,WAAW,EAAE;CACvF,QAAQ,IAAI,mDAAmD,IAAI,GAAG;CAEtE,IAAI;CACJ,IAAI;CAEJ,IAAI,QAAQ,UAAU;EACpB,MAAM,SAAS,MAAM,IAAI,uDAAuD;EAChF,MAAM,SAAS,IAAI,IAAI,MAAM;EAC7B,OAAO,OAAO,aAAa,IAAI,MAAM,KAAK;EAC1C,QAAQ,OAAO,aAAa,IAAI,OAAO,KAAK;EAC5C,IAAI,CAAC,QAAQ,CAAC,OAAO;GACnB,QAAQ,MAAM,6CAA6C;GAC3D,QAAQ,KAAK,CAAC;EAChB;CACF,OAAO;EAEL,IAAI,CAAC,MADgB,YAAY,GAAG,GACvB,QAAQ,IAAI,mEAAmE;EAC5F,IAAI;EACJ,IAAI;GACF,iBAAiB,MAAM,SAAU;EACnC,SAAS,OAAO;GACd,QAAQ,MAAM,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,CAAC;GACpE,QAAQ,KAAK,CAAC;EAChB;EACA,OAAO,eAAe;EACtB,QAAQ,eAAe;CACzB;CAIA,MAAM,SAAS,MAAM,oBAAoB,MAAM,OAAO,aAAa,QAAQ;CAC3E,IAAI,OAAO,SAAS,UAAU;EAC5B,QAAQ,MAAM,iBAAiB,OAAO,OAAO;EAC7C,QAAQ,KAAK,CAAC;CAChB;CAEA,IAAI,QAAQ,MAAM;EAChB,MAAM,OAAO,qBAAqB,OAAO;GACvC,cAAc,OAAO;GACrB,eAAe,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC;GACzC,YAAY,KAAK,IAAI,GAAG,KAAK,OAAO,OAAO,UAAU,KAAK,IAAI,KAAK,GAAI,CAAC;EAC1E,CAAC;EACD,QAAQ,IAAI,uDAAuD,KAAK,GAAG;CAC7E,OAAO;EACL,MAAM,EAAE,SAAS,YAAY,MAAM,sBAAsB,OAAO;GAC9D,aAAa,OAAO;GACpB,cAAc,OAAO,QAAQ,MAAM,GAAG,CAAC,CAAC;GACxC,WAAW;GACX,WAAW,IAAI,KAAK,OAAO,OAAO,CAAC,CAAC,YAAY;GAChD,YAAY;GACZ,OAAO,OAAO,SAAS;GACvB,WAAW,OAAO,aAAa;GAC/B,UAAU,OAAO,YAAY;EAC/B,GAAG,EAAE,mBAAmB,KAAK,CAAC;EAC9B,QAAQ,IAAI,GAAG,UAAU,UAAU,UAAU,YAAY,QAAQ,SAAS,aAAa,aAAa,OAAO,aAAa,UAAU,EAAE;CACtI;CAEA,MAAM,UAAU,MAAM;AACxB;AAEA,eAAe,gBAAgB;CAC7B,MAAM,QAAQ,0BAA0B;CACxC,MAAM,UAAU,MAAM,MAAM,KAAK;CACjC,IAAI,QAAQ,SAAS,WAAW,GAAG;EACjC,QAAQ,IAAI,6CAA6C;EACzD;CACF;CACA,QAAQ,IAAI,KAAK,QAAQ,SAAS,OAAO,4BAA4B,QAAQ,YAAY,IAAI;CAC7F,MAAM,WAAW,IAAI,kBAAkB,EAAE,MAAM,CAAC;CAChD,KAAK,MAAM,CAAC,OAAO,YAAY,QAAQ,SAAS,QAAQ,GAAG;EACzD,MAAM,SAAS,UAAU,QAAQ,cAAc,MAAM;EACrD,MAAM,QAAQ,QAAQ,YAAY,QAAQ,aACtC,QAAQ,uBAAuB,0BAC/B,QAAQ,oBAAoB,QAAQ,mBAAmB,KAAK,IAAI,IAAI,YACpE;EACJ,QAAQ,IAAI,IAAI,OAAO,IAAI,MAAM,IAAI,QAAQ,SAAS,aAAa,KAAK,QAAQ,QAAQ,YAAY,cAAc,QAAQ,UAAU,KAAK,IAAI;EAG7I,MAAM,UAAU,MAAM,SAAS,WAAW,CAAC,CAAC,YAAY,KAAA,CAAS;EACjE,IAAI,WAAW,QAAQ,UAAU,OAC/B,IAAI;GACF,MAAM,EAAE,yBAAyB,MAAM,OAAO,yBAAuB,CAAA,MAAA,MAAA,EAAA,CAAA;GACrE,MAAM,aAAa,MAAM,qBAAqB,QAAQ,KAAK,QAAQ,QAAQ,QAAQ,SAAS;GAC5F,MAAM,UAAU,OAAO,QAAQ,WAAW,UAAU,CAAC,CAAC;GACtD,IAAI,QAAQ,SAAS,GAAG;IACtB,MAAM,YAAY,QACf,KAAK,CAAC,IAAI,YAAY;KAAE;KAAI,GAAG,MAAM;IAAU,EAAE,CAAC,CAClD,QAAQ,MAAM,OAAO,EAAE,sBAAsB,QAAQ,CAAC,CACtD,MAAM,GAAG,OAAO,EAAE,qBAAqB,MAAM,EAAE,qBAAqB,EAAE;IACzE,IAAI,UAAU,SAAS,GAAG;KACxB,MAAM,SAAS,UAAU;KACzB,QAAQ,IAAI,kBAAkB,QAAQ,OAAO,kBAAkB,KAAK,OAAO,OAAO,qBAAqB,KAAK,GAAG,EAAE,KAAK,OAAO,GAAG,GAAG,OAAO,YAAY,YAAY,IAAI,KAAK,OAAO,SAAS,CAAC,CAAC,YAAY,MAAM,IAAI;IACrN,OACE,QAAQ,IAAI,kBAAkB,QAAQ,OAAO,+BAA+B;GAEhF;EACF,SAAS,OAAO;GACd,QAAQ,IAAI,8BAA8B,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK,EAAE,EAAE;EACrG;CAEJ;AACF;AAEA,eAAe,cAAc,SAAkF;CAC7G,MAAM,QAAQ,YAAY;CAC1B,IAAI;CACJ,IAAI,QAAQ,SAAS,QAAQ,MAAM,SAAS,GAC1C,QAAQ,QAAQ,MAAM,KAAK,SAAS;EAClC,MAAM,MAAM,aAAa,MAAM,MAAM;EACrC,OAAO;GAAE,QAAQ,QAAQ,OAAO,MAAO,KAAK,MAAM,GAAG;GAAe,MAAM,QAAQ,OAAO,SAAS;EAAO;CAC3G,CAAC;MAGD,QAAQ,CAAC;EAAE,QAAQ,MADE,IAAI,kDAAkD;EAChD,MAAM,QAAQ,OAAO,SAAS;CAAO,CAAC;CAEnE,MAAM,SAAS,MAAM,kBAAkB,OAAO,OAAO;EACnD,OAAO,QAAQ;EACf,mBAAmB,QAAQ;CAC7B,CAAC;CACD,QAAQ,IAAI,YAAY,OAAO,SAAS,aAAa,OAAO,WAAW,OAAO,OAAO,SAAS,IAAI,KAAK,OAAO,OAAO,OAAO,WAAW,IAAI;CAC3I,KAAK,MAAM,SAAS,OAAO,QAAQ,QAAQ,IAAI,OAAO,OAAO;AAC/D;AAEA,eAAe,cAAc,SAA2C;CACtE,MAAM,QAAQ,0BAA0B;CACxC,MAAM,WAAW,IAAI,kBAAkB,EAAE,MAAM,CAAC;CAChD,MAAM,UAAU,MAAM,MAAM,KAAK;CACjC,MAAM,UAAU,QAAQ,UAAU,KAAA,IAC9B,CAAC,OAAO,QAAQ,KAAK,CAAC,IACtB,QAAQ,SAAS,KAAK,GAAG,MAAM,CAAC;CAEpC,IAAI,WAAW;CACf,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,UAAU,QAAQ,SAAS;EACjC,IAAI,CAAC,SAAS;GACZ,QAAQ,IAAI,IAAI,MAAM,YAAY;GAClC;EACF;EACA,MAAM,SAAS,MAAM,SAAS,WAAW,KAAK;EAC9C,IAAI,CAAC,OAAO,MAAM;GAChB,QAAQ,IAAI,IAAI,MAAM,IAAI,QAAQ,SAAS,GAAG,aAAa,OAAO,OAAO;GACzE;EACF;EACA,IAAI,QAAQ,KAAK;GACf,MAAM,OAAO,KAAK,QAAQ,KAAK,WAAW,MAAM,MAAM;GACtD,cAAc,MAAM,OAAO,OAAO,IAAI;GACtC,QAAQ,IAAI,IAAI,MAAM,IAAI,QAAQ,SAAS,GAAG,WAAW,MAAM;EACjE,OACE,QAAQ,IAAI,OAAO,IAAI;EAEzB;CACF;CACA,IAAI,CAAC,QAAQ,KAAK,QAAQ,IAAI,KAAK,SAAS,8DAA8D;AAC5G;AAEA,eAAe,cAAc,SAA6B;CACxD,MAAM,QAAQ,0BAA0B;CACxC,MAAM,WAAW,IAAI,kBAAkB,EAAE,MAAM,CAAC;CAChD,MAAM,UAAU,MAAM,MAAM,KAAK;CACjC,MAAM,UAAU,QAAQ,UAAU,KAAA,IAC9B,CAAC,OAAO,QAAQ,KAAK,CAAC,IACtB,QAAQ,SAAS,KAAK,GAAG,MAAM,CAAC;CAEpC,KAAK,MAAM,SAAS,SAAS;EAC3B,MAAM,UAAU,QAAQ,SAAS;EACjC,IAAI,CAAC,SAAS;GACZ,QAAQ,IAAI,IAAI,MAAM,YAAY;GAClC;EACF;EACA,MAAM,SAAS,MAAM,SAAS,cAAc,KAAK;EACjD,IAAI,OAAO,IACT,QAAQ,IAAI,IAAI,MAAM,IAAI,QAAQ,SAAS,GAAG,OAAO,OAAO,SAAS,OAAO,UAAU,QAAQ,QAAQ,eAAe,OAAO,MAAM,KAAK,IAAI;OAE3I,QAAQ,IAAI,IAAI,MAAM,IAAI,QAAQ,SAAS,GAAG,aAAa,OAAO,OAAO;CAE7E;AACF;AAEA,eAAe,cAAc,SAAkD;CAC7E,MAAM,QAAQ,0BAA0B;CACxC,MAAM,WAAW,IAAI,kBAAkB;EACrC;EACA,iBAAiB,YAAY;GAC3B,KAAK,MAAM,UAAU,SACnB,IAAI,OAAO,IAAI,QAAQ,IAAI,IAAI,OAAO,MAAM,IAAI,OAAO,SAAS,GAAG,MAAM;QACpE,QAAQ,IAAI,IAAI,OAAO,MAAM,IAAI,OAAO,SAAS,GAAG,aAAa,OAAO,OAAO;EAExF;CACF,CAAC;CACD,MAAM,UAAU,QAAQ,OAAO,KAAK,UAAU,OAAO,KAAK,CAAC;CAE3D,IAAI,QAAQ,UAAU;EACpB,MAAM,aAAa,OAAO,QAAQ,QAAQ;EAC1C,IAAI,CAAC,OAAO,SAAS,UAAU,KAAK,cAAc,GAAG;GACnD,QAAQ,MAAM,8DAA8D;GAC5E,QAAQ,KAAK,CAAC;EAChB;EACA,QAAQ,IAAI,sBAAsB,WAAW,qBAAqB;EAClE,SAAS,iBAAiB,YAAY,EAAE,OAAO,MAAM,CAAC;EACtD,MAAM,IAAI,cAAoB,CAAC,CAAC;EAChC;CACF;CAGA,KAAI,MADkB,SAAS,cAAc,OAAO,EAAA,CACxC,WAAW,GAAG,QAAQ,IAAI,kDAAkD;AAC1F;AAEA,eAAe,cAAc,SAA6C;CAExE,MADc,0BACJ,CAAC,CAAC,QAAQ,YAAY;EAC9B,MAAM,QAAQ,QAAQ,UAAU,KAAA,IAC5B,OAAO,QAAQ,KAAK,IACpB,QAAQ,QACN,QAAQ,SAAS,WAAW,MAAM,EAAE,OAAO,YAAY,MAAM,QAAQ,MAAO,YAAY,CAAC,IACzF,QAAQ;EACd,IAAI,QAAQ,KAAK,SAAS,QAAQ,SAAS,QACzC,MAAM,IAAI,MAAM,4BAA4B,MAAM,EAAE;EAEtD,MAAM,CAAC,WAAW,QAAQ,SAAS,OAAO,OAAO,CAAC;EAClD,IAAI,QAAQ,eAAe,QAAQ,SAAS,QAAQ,QAAQ,cAAc;EAC1E,QAAQ,IAAI,oBAAoB,SAAS,SAAS,IAAI,MAAM,IAAI;CAClE,CAAC;AACH;AAEA,SAAgB,gBAAyB;CACvC,MAAM,UAAU,IAAI,QAAQ;CAC5B,QACG,KAAK,SAAS,CAAC,CACf,YAAY,kEAAkE,CAAC,CAC/E,QAAQ,eAAe;CAE1B,QAAQ,KAAK,mBAAmB;EAC9B,IAAI,cAAc,GAAG;GACnB,QAAQ,MAAM,0CAA0C;GACxD,QAAQ,KAAK,CAAC;EAChB;CACF,CAAC;CAED,QACG,QAAQ,OAAO,CAAC,CAChB,YAAY,0CAA0C,CAAC,CACvD,OAAO,cAAc,oDAAoD,KAAK,CAAC,CAC/E,OAAO,UAAU,gEAAgE,KAAK,CAAC,CACvF,OAAO,cAAc,0BAA0B,OAAO,CAAC,CACvD,OAAO,kBAAkB,sCAAsC,CAAC,CAChE,OAAO,kBAAkB,oBAAoB,QAAQ,CAAC,CACtD,OAAO,OAAO,YAAY;EACzB,MAAM,aAAa;GAAE,GAAG;GAAS,SAAS,QAAQ;EAAQ,CAAC;CAC7D,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,gCAAgC,CAAC,CAC7C,OAAO,YAAY;EAClB,MAAM,cAAc;CACtB,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,6CAA6C,CAAC,CAC1D,SAAS,cAAc,uDAAuD,CAAC,CAC/E,OAAO,UAAU,yCAAyC,KAAK,CAAC,CAChE,OAAO,mBAAmB,6CAA6C,CAAC,CACxE,OAAO,eAAe,mDAAmD,KAAK,CAAC,CAC/E,OAAO,OAAO,OAA6B,YAAmE;EAC7G,MAAM,cAAc;GAAE,GAAG;GAAS;EAAM,CAAC;CAC3C,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,2CAA2C,CAAC,CACxD,OAAO,eAAe,0CAA0C,CAAC,CACjE,OAAO,eAAe,gGAAgG,CAAC,CACvH,OAAO,OAAO,YAA8C;EAC3D,MAAM,cAAc,OAAO;CAC7B,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,iDAAiD,CAAC,CAC9D,OAAO,eAAe,0CAA0C,CAAC,CACjE,OAAO,OAAO,YAAgC;EAC7C,MAAM,cAAc,OAAO;CAC7B,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,6EAA6E,CAAC,CAC1F,OAAO,mBAAmB,uCAAuC,CAAC,CAClE,OAAO,kBAAkB,2BAA2B,CAAC,CACrD,OAAO,OAAO,YAAqD;EAClE,MAAM,cAAc,OAAO;CAC7B,CAAC;CAEH,QACG,QAAQ,QAAQ,CAAC,CACjB,YAAY,mBAAmB,CAAC,CAChC,OAAO,eAAe,iCAAiC,CAAC,CACxD,OAAO,mBAAmB,eAAe,CAAC,CAC1C,OAAO,OAAO,YAAgD;EAC7D,MAAM,cAAc,OAAO;CAC7B,CAAC;CAEH,OAAO;AACT"}