expandai 0.0.4 → 0.0.6

package/build/esm/ApiClient.js

@@ -1,305 +0,0 @@
-import { HttpClient, HttpClientRequest, HttpClientResponse } from '@effect/platform';
-import { NodeHttpClient } from '@effect/platform-node';
-import { fetchObjectModeJson, fetchSnapshotSearch } from '@expandai/sdk/FetchJson';
-import * as Generated from '@expandai/sdk/Generated';
-import { decodeError, unexpectedStatus } from '@expandai/sdk/HttpClientHelpers';
-import { Data, DateTime, Duration, Effect, flow, Match, Option, Redacted, Schema } from 'effect';
-import { CLI_AUTHORIZATION_CLIENT_ID } from './Auth/Domain.js';
-import { BrowserOAuthService } from './BrowserOAuth.js';
-import { ConfigManager, OAuthConfig, OAuthTokenExpired } from './Config.js';
-import { CurrentRequestHeaders } from './Mcp/RequestHeaders.js';
-export class DeviceAuthorizationCreated extends Schema.Class('DeviceAuthorizationCreated')({
-    deviceCode: Schema.Redacted(Schema.NonEmptyString),
-    userCode: Schema.NonEmptyString,
-    // `Schema.URL` decodes to a `URL`; the wire form stays a string. The CLI
-    // hands this to the user to open, so a malformed `appUrls.app` should fail
-    // here rather than in a browser.
-    verificationUri: Schema.URL,
-    // Whole seconds. A zero or negative `expiresIn` is a window that has already
-    // closed, so it must be positive.
-    expiresIn: Schema.Int.pipe(Schema.positive()),
-    // `interval` is RFC 8628's *minimum* wait between polls, so zero is
-    // meaningful — poll without delay. Only negative is nonsense, and it would
-    // make `nextPollAt` drift backwards forever.
-    interval: Schema.Int.pipe(Schema.nonNegative()),
-}) {
-}
-const ManualAuthorizationTokenResponse = Schema.Struct({
-    access_token: Schema.Redacted(Schema.NonEmptyString),
-    refresh_token: Schema.Redacted(Schema.NonEmptyString),
-    token_type: Schema.NonEmptyString,
-    expires_in: Schema.Number.pipe(Schema.positive()),
-    scope: Schema.optional(Schema.String),
-});
-const ManualAuthorizationOperation = Schema.Literal('create', 'poll');
-export class ManualAuthorizationApiError extends Schema.TaggedError()('ManualAuthorizationApiError', {
-    operation: ManualAuthorizationOperation,
-    kind: Schema.Literal('request_failed', 'rejected', 'invalid_response'),
-    status: Schema.optional(Schema.Number),
-    recoverable: Schema.Boolean,
-}) {
-    get message() {
-        return this.kind === 'rejected'
-            ? `Manual authorization ${this.operation} was rejected. Restart authorization if the problem persists.`
-            : `Manual authorization ${this.operation} could not be completed safely. Try again.`;
-    }
-}
-/**
- * Single user-facing error for any failure crossing the API boundary. The
- * generated client raises a half-dozen status-specific tagged classes plus
- * transport/decode errors; we collapse them here so the rest of the app sees
- * one tag with a ready-made `.message` and never has to know about
- * `Generated.ts` types.
- */
-export class ApiRequestFailed extends Schema.TaggedError()('ApiRequestFailed', {
-    detail: Schema.String,
-}) {
-    get message() {
-        return this.detail;
-    }
-}
-const OAUTH_REFRESH_SKEW = Duration.minutes(1);
-class OAuthAuthMethodChanged extends Data.TaggedError('OAuthAuthMethodChanged') {
-}
-function getField(value, key) {
-    return typeof value === 'object' && value !== null && key in value ? value[key] : undefined;
-}
-function getStringField(value, key) {
-    const field = getField(value, key);
-    return typeof field === 'string' ? field : undefined;
-}
-function getIssueList(value) {
-    const issues = getField(value, 'issues');
-    return Array.isArray(issues) ? issues : [];
-}
-function getUnsupportedFields(value) {
-    const unsupportedFields = getField(value, 'unsupportedFields');
-    return Array.isArray(unsupportedFields) ? unsupportedFields.filter((field) => typeof field === 'string') : [];
-}
-function formatIssue({ path, message }) {
-    const prefix = path.map((segment) => (typeof segment === 'object' ? segment.key : String(segment))).join('.');
-    return prefix ? `${prefix}: ${message}` : message;
-}
-function formatApiFailure(error) {
-    switch (getStringField(error, '_tag')) {
-        case 'HttpApiDecodeError': {
-            const issues = getIssueList(error);
-            return issues.length === 0
-                ? (getStringField(error, 'message') ?? 'Invalid request')
-                : issues.map(formatIssue).join('; ');
-        }
-        case 'AuthFailed':
-            return `Authentication failed (${getStringField(error, 'reason') ?? 'unknown'}). Run \`expandai login\` to re-authenticate.`;
-        case 'AccessBlocked':
-            return 'Access blocked. Check your billing status or contact support.';
-        case 'BatchedIncludeUnsupported':
-            return `Unsupported batched include fields: ${getUnsupportedFields(error).join(', ')}.`;
-        case 'FetchSnapshotSearchNotFound':
-            return 'Fetch snapshot not found.';
-        case 'PayloadTooLarge':
-            return 'Request payload is too large.';
-        case 'TooManyRequests':
-            return 'Rate limit exceeded — try again in a moment.';
-        case 'InternalError':
-            return 'The expand.ai API returned an internal error. Try again or contact support.';
-        case 'ServiceUnavailable':
-            return 'The expand.ai API is temporarily unavailable. Try again shortly.';
-        default:
-            return error instanceof Error ? error.message : (getStringField(error, 'message') ?? 'Expand API request failed.');
-    }
-}
-const liftApiError = (self) => self.pipe(Effect.catchAll((error) => new ApiRequestFailed({ detail: formatApiFailure(error) })));
-/** Public, unauthenticated HTTP boundary for device-flow CLI authorization. */
-export class ManualAuthorizationApiClient extends Effect.Service()('@expandai/cli/ManualAuthorizationApiClient', {
-    dependencies: [NodeHttpClient.layer, ConfigManager.Default],
-    effect: Effect.gen(function* () {
-        const httpClient = yield* HttpClient.HttpClient;
-        const configManager = yield* ConfigManager;
-        const apiError = (operation, kind, status) => new ManualAuthorizationApiError({
-            operation,
-            kind,
-            status,
-            recoverable: kind !== 'invalid_response',
-        });
-        const create = Effect.fn('ManualAuthorizationApiClient.create')(function* (input) {
-            const apiUrl = yield* configManager.getApiUrl();
-            const request = yield* HttpClientRequest.post(new URL('/v1/cli-authorization/device', apiUrl)).pipe(HttpClientRequest.bodyJson(input), Effect.mapError(() => apiError('create', 'request_failed')));
-            return yield* httpClient.execute(request).pipe(Effect.flatMap((response) => response.status >= 200 && response.status < 300
-                ? HttpClientResponse.schemaBodyJson(DeviceAuthorizationCreated)(response).pipe(Effect.mapError(() => apiError('create', 'invalid_response')))
-                : Effect.fail(apiError('create', 'rejected', response.status))), Effect.catchAll((error) => error instanceof ManualAuthorizationApiError
-                ? Effect.fail(error)
-                : Effect.fail(apiError('create', 'request_failed'))));
-        });
-        const PollErrorBody = Schema.Struct({
-            error: Schema.String,
-            error_description: Schema.optional(Schema.String),
-        });
-        /**
-         * RFC 6749/8628 errors that describe the *request* rather than the state
-         * of this particular code. Re-minting produces a code that fails
-         * identically, so treating these as "expired" is what turns a
-         * misconfiguration into an endless approve loop.
-         */
-        const PERMANENT_REFUSALS = new Set([
-            'invalid_target',
-            'invalid_client',
-            'invalid_scope',
-            'unsupported_grant_type',
-            'unauthorized_client',
-            'invalid_request',
-        ]);
-        /**
-         * One poll of the OAuth token endpoint (RFC 8628). Form-encoded, and
-         * always against `/oauth2/token`: `/device/token` is the first-party
-         * session path and the server rejects our client there by design.
-         */
-        const poll = Effect.fn('ManualAuthorizationApiClient.poll')(function* (deviceCode) {
-            const apiUrl = yield* configManager.getApiUrl();
-            const request = HttpClientRequest.post(new URL('/api/auth/oauth2/token', apiUrl)).pipe(HttpClientRequest.bodyUrlParams({
-                grant_type: 'urn:ietf:params:oauth:grant-type:device_code',
-                device_code: Redacted.value(deviceCode),
-                client_id: CLI_AUTHORIZATION_CLIENT_ID,
-            }));
-            return yield* httpClient.execute(request).pipe(Effect.flatMap(Effect.fnUntraced(function* (response) {
-                if (response.status >= 200 && response.status < 300) {
-                    const token = yield* HttpClientResponse.schemaBodyJson(ManualAuthorizationTokenResponse)(response).pipe(Effect.mapError(() => apiError('poll', 'invalid_response')));
-                    return { _tag: 'Tokens', token };
-                }
-                if (response.status >= 500)
-                    return yield* apiError('poll', 'rejected', response.status);
-                const body = yield* HttpClientResponse.schemaBodyJson(PollErrorBody)(response).pipe(Effect.mapError(() => apiError('poll', 'invalid_response')));
-                switch (body.error) {
-                    case 'authorization_pending':
-                        return { _tag: 'Pending' };
-                    case 'slow_down':
-                        return { _tag: 'SlowDown' };
-                    case 'access_denied':
-                        return { _tag: 'Denied' };
-                    case 'expired_token':
-                        return { _tag: 'Expired' };
-                    default:
-                        return PERMANENT_REFUSALS.has(body.error)
-                            ? {
-                                _tag: 'Refused',
-                                error: body.error,
-                                ...(body.error_description === undefined ? {} : { description: body.error_description }),
-                            }
-                            : { _tag: 'Invalid' };
-                }
-            })), Effect.catchAll((error) => error instanceof ManualAuthorizationApiError
-                ? Effect.fail(error)
-                : Effect.fail(apiError('poll', 'request_failed'))));
-        });
-        return { create, poll };
-    }),
-}) {
-}
-/**
- * Resolves outgoing API auth per call. When the current request scope carries
- * an `Authorization` header (via `CurrentRequestHeaders`), that value is
- * forwarded; otherwise auth comes from `~/.config/expandai/config.json`.
- */
-export class ApiClient extends Effect.Service()('@expandai/cli/ApiClient', {
-    dependencies: [NodeHttpClient.layer, ConfigManager.Default, BrowserOAuthService.Default],
-    scoped: Effect.gen(function* () {
-        const configManager = yield* ConfigManager;
-        const browserOAuth = yield* BrowserOAuthService;
-        const baseClient = yield* HttpClient.HttpClient;
-        const refreshLock = yield* Effect.makeSemaphore(1);
-        const freshOAuthAccessToken = Effect.fn('ApiClient.freshOAuthAccessToken')(function* ({ accessToken, expiresAt, refreshToken, }) {
-            const now = yield* DateTime.now;
-            const refreshThreshold = refreshToken === undefined ? now : DateTime.addDuration(now, OAUTH_REFRESH_SKEW);
-            if (DateTime.lessThan(refreshThreshold, expiresAt)) {
-                return Option.some(Redacted.value(accessToken));
-            }
-            return Option.none();
-        });
-        const refreshOAuthToken = Effect.fn('ApiClient.refreshOAuthToken')(function* ({ refreshToken, expiresAt, clientId, }) {
-            if (refreshToken === undefined) {
-                return yield* new OAuthTokenExpired({ expiredAt: expiresAt });
-            }
-            const now = yield* DateTime.now;
-            const token = yield* browserOAuth.refreshToken(Redacted.value(refreshToken), clientId);
-            if (token === undefined) {
-                return yield* new OAuthTokenExpired({ expiredAt: expiresAt });
-            }
-            const refreshedExpiresAt = DateTime.addDuration(now, token.expires_in);
-            const nextRefreshToken = token.refresh_token === undefined ? refreshToken : Redacted.make(token.refresh_token);
-            yield* configManager.updateConfig({
-                authMethod: OAuthConfig.make({
-                    accessToken: Redacted.make(token.access_token),
-                    refreshToken: nextRefreshToken,
-                    expiresAt: refreshedExpiresAt,
-                    clientId,
-                }),
-            });
-            return token.access_token;
-        });
-        const oauthBearerToken = Effect.fn('ApiClient.oauthBearerToken')(function* (authMethod) {
-            const alreadyFresh = yield* freshOAuthAccessToken(authMethod);
-            if (Option.isSome(alreadyFresh)) {
-                return alreadyFresh.value;
-            }
-            return yield* refreshLock.withPermits(1)(Effect.gen(function* () {
-                const { authMethod: persistedAuthMethod } = yield* configManager.loadConfig();
-                if (persistedAuthMethod._tag !== 'OAuth') {
-                    return yield* new OAuthAuthMethodChanged({});
-                }
-                const persistedFresh = yield* freshOAuthAccessToken(persistedAuthMethod);
-                if (Option.isSome(persistedFresh)) {
-                    return persistedFresh.value;
-                }
-                return yield* refreshOAuthToken(persistedAuthMethod);
-            }));
-        });
-        // Resolved per call, not at construction. Effect Layers are globally
-        // memoized, so capturing CurrentRequestHeaders here once would freeze
-        // auth resolution to whatever was on the first request. Reading per
-        // call also keeps the OAuth `expiresAt` check live against `DateTime.now`.
-        // `Effect.serviceOption` reads the tag from the outer fiber context
-        // without leaking it into our R, so the API's per-request
-        // `Context.make(CurrentRequestHeaders, headers)` flows through and the
-        // stdio MCP path simply gets `Option.none` → empty headers.
-        const buildAuthedClientOnce = () => Effect.gen(function* () {
-            const forwardedHeaders = yield* Effect.serviceOption(CurrentRequestHeaders).pipe(Effect.map(Option.getOrElse(() => ({}))));
-            // header keys are lowercase per WHATWG Headers spec.
-            const forwardedAuth = Option.fromNullable(forwardedHeaders['authorization']);
-            if (Option.isSome(forwardedAuth)) {
-                // Forwarded path: caller owns the token's lifecycle (their session,
-                // their bearer). We don't re-check expiry — if it's stale the API
-                // will return 401. `OAuthTokenExpired` is for the *persisted*
-                // OAuth in the loadConfig branch only.
-                const apiUrl = yield* configManager.getApiUrl();
-                const mapRequest = flow(HttpClientRequest.prependUrl(apiUrl.toString()), HttpClientRequest.setHeader('authorization', forwardedAuth.value));
-                return baseClient.pipe(HttpClient.mapRequest(mapRequest));
-            }
-            const { authMethod, apiUrl } = yield* configManager.loadConfig();
-            const applyAuth = yield* Match.value(authMethod).pipe(Match.tag('ApiKey', ({ apiKey }) => Effect.succeed(HttpClientRequest.setHeader('x-expand-api-key', Redacted.value(apiKey)))), Match.tag('OAuth', (authMethod) => oauthBearerToken(authMethod).pipe(Effect.map((accessToken) => HttpClientRequest.bearerToken(accessToken)))), Match.exhaustive);
-            const mapRequest = flow(HttpClientRequest.prependUrl(apiUrl.toString()), applyAuth);
-            return baseClient.pipe(HttpClient.mapRequest(mapRequest));
-        });
-        const buildAuthedClient = () => buildAuthedClientOnce().pipe(Effect.catchTag('OAuthAuthMethodChanged', () => buildAuthedClientOnce()));
-        const buildAuthed = () => buildAuthedClient().pipe(Effect.map(Generated.make));
-        const fetchMarkdown = (client, options) => HttpClientRequest.make('POST')('/v1/fetch').pipe(HttpClientRequest.setUrlParams(options.params.include !== undefined ? { include: options.params.include } : {}), (req) => Effect.orDie(HttpClientRequest.bodyJson(req, options.payload)), Effect.flatMap((request) => Effect.flatMap(client.execute(request), HttpClientResponse.matchStatus({
-            '200': (response) => response.text,
-            '400': (response) => decodeError(response, Generated.FetchFetch400),
-            '401': (response) => decodeError(response, Generated.AuthFailed),
-            '403': (response) => decodeError(response, Generated.FetchFetch403),
-            '413': (response) => decodeError(response, Generated.PayloadTooLarge),
-            '429': (response) => decodeError(response, Generated.TooManyRequests),
-            '500': (response) => decodeError(response, Generated.InternalError),
-            '503': (response) => decodeError(response, Generated.ServiceUnavailable),
-            orElse: (response) => unexpectedStatus(request, response),
-        }))));
-        return {
-            fetchFetch: (...args) => buildAuthedClient().pipe(Effect.flatMap((client) => fetchMarkdown(client, ...args).pipe(liftApiError))),
-            fetchFetchResult: (...args) => buildAuthedClient().pipe(Effect.flatMap((client) => fetchObjectModeJson(client, ...args).pipe(liftApiError))),
-            fetchFetchJson: (...args) => buildAuthedClient().pipe(Effect.flatMap((client) => fetchObjectModeJson(client, ...args).pipe(liftApiError))),
-            fetchFetchSearch: (...args) => buildAuthedClient().pipe(Effect.flatMap((client) => fetchSnapshotSearch(client, ...args).pipe(liftApiError))),
-            fetchBatched: (...args) => buildAuthed().pipe(Effect.flatMap((client) => client.fetchBatched(...args).pipe(liftApiError))),
-            fetchGetBatched: (...args) => buildAuthed().pipe(Effect.flatMap((client) => client.fetchGetBatched(...args).pipe(liftApiError))),
-        };
-    }),
-}) {
-}
-//# sourceMappingURL=ApiClient.js.map

package/build/esm/ApiClient.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"ApiClient.js","sourceRoot":"","sources":["../../src/ApiClient.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAA;AACpF,OAAO,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAA;AACtD,OAAO,EAAE,mBAAmB,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAA;AAClF,OAAO,KAAK,SAAS,MAAM,yBAAyB,CAAA;AACpD,OAAO,EAAE,WAAW,EAAE,gBAAgB,EAAE,MAAM,iCAAiC,CAAA;AAC/E,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAChG,OAAO,EAAE,2BAA2B,EAAE,MAAM,kBAAkB,CAAA;AAC9D,OAAO,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAA;AACvD,OAAO,EAAE,aAAa,EAAE,WAAW,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAA;AAC3E,OAAO,EAAE,qBAAqB,EAAE,MAAM,yBAAyB,CAAA;AAE/D,MAAM,OAAO,0BAA2B,SAAQ,MAAM,CAAC,KAAK,CAA6B,4BAA4B,CAAC,CAAC;IACtH,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;IAClD,QAAQ,EAAE,MAAM,CAAC,cAAc;IAC/B,yEAAyE;IACzE,2EAA2E;IAC3E,iCAAiC;IACjC,eAAe,EAAE,MAAM,CAAC,GAAG;IAC3B,6EAA6E;IAC7E,kCAAkC;IAClC,SAAS,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IAC7C,oEAAoE;IACpE,2EAA2E;IAC3E,6CAA6C;IAC7C,QAAQ,EAAE,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,CAAC;CAC/C,CAAC;CAAG;AAEL,MAAM,gCAAgC,GAAG,MAAM,CAAC,MAAM,CAAC;IACtD,YAAY,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;IACpD,aAAa,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc,CAAC;IACrD,UAAU,EAAE,MAAM,CAAC,cAAc;IACjC,UAAU,EAAE,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC;IACjD,KAAK,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;CACrC,CAAC,CAAA;AAyBF,MAAM,4BAA4B,GAAG,MAAM,CAAC,OAAO,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAA;AAErE,MAAM,OAAO,2BAA4B,SAAQ,MAAM,CAAC,WAAW,EAA+B,CACjG,6BAA6B,EAC7B;IACC,SAAS,EAAE,4BAA4B;IACvC,IAAI,EAAE,MAAM,CAAC,OAAO,CAAC,gBAAgB,EAAE,UAAU,EAAE,kBAAkB,CAAC;IACtE,MAAM,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IACtC,WAAW,EAAE,MAAM,CAAC,OAAO;CAC3B,CACD;IACA,IAAI,OAAO;QACV,OAAO,IAAI,CAAC,IAAI,KAAK,UAAU;YAC9B,CAAC,CAAC,wBAAwB,IAAI,CAAC,SAAS,+DAA+D;YACvG,CAAC,CAAC,wBAAwB,IAAI,CAAC,SAAS,4CAA4C,CAAA;IACtF,CAAC;CACD;AAED;;;;;;GAMG;AACH,MAAM,OAAO,gBAAiB,SAAQ,MAAM,CAAC,WAAW,EAAoB,CAAC,kBAAkB,EAAE;IAChG,MAAM,EAAE,MAAM,CAAC,MAAM;CACrB,CAAC;IACD,IAAI,OAAO;QACV,OAAO,IAAI,CAAC,MAAM,CAAA;IACnB,CAAC;CACD;AAYD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC,CAAC,CAAA;AAE9C,MAAM,sBAAuB,SAAQ,IAAI,CAAC,WAAW,CAAC,wBAAwB,CAAwB;CAAG;AAEzG,SAAS,QAAQ,CAAC,KAAc,EAAE,GAAW;IAC5C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,IAAI,GAAG,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,GAAyB,CAAC,CAAC,CAAC,CAAC,SAAS,CAAA;AAClH,CAAC;AAED,SAAS,cAAc,CAAC,KAAc,EAAE,GAAW;IAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,KAAK,EAAE,GAAG,CAAC,CAAA;IAClC,OAAO,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,SAAS,CAAA;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IACnC,MAAM,MAAM,GAAG,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAA;IACxC,OAAO,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAE,MAAkB,CAAC,CAAC,CAAC,EAAE,CAAA;AACxD,CAAC;AAED,SAAS,oBAAoB,CAAC,KAAc;IAC3C,MAAM,iBAAiB,GAAG,QAAQ,CAAC,KAAK,EAAE,mBAAmB,CAAC,CAAA;IAC9D,OAAO,KAAK,CAAC,OAAO,CAAC,iBAAiB,CAAC,CAAC,CAAC,CAAC,iBAAiB,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,OAAO,KAAK,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,EAAE,CAAA;AAC9G,CAAC;AAED,SAAS,WAAW,CAAC,EAAE,IAAI,EAAE,OAAO,EAAS;IAC5C,MAAM,MAAM,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,OAAO,EAAE,EAAE,CAAC,CAAC,OAAO,OAAO,KAAK,QAAQ,CAAC,CAAC,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAA;IAC7G,OAAO,MAAM,CAAC,CAAC,CAAC,GAAG,MAAM,KAAK,OAAO,EAAE,CAAC,CAAC,CAAC,OAAO,CAAA;AAClD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAkB;IAC3C,QAAQ,cAAc,CAAC,KAAK,EAAE,MAAM,CAAC,EAAE,CAAC;QACvC,KAAK,oBAAoB,EAAE,CAAC;YAC3B,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,CAAC,CAAA;YAClC,OAAO,MAAM,CAAC,MAAM,KAAK,CAAC;gBACzB,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,iBAAiB,CAAC;gBACzD,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAA;QACtC,CAAC;QACD,KAAK,YAAY;YAChB,OAAO,0BAA0B,cAAc,CAAC,KAAK,EAAE,QAAQ,CAAC,IAAI,SAAS,+CAA+C,CAAA;QAC7H,KAAK,eAAe;YACnB,OAAO,+DAA+D,CAAA;QACvE,KAAK,2BAA2B;YAC/B,OAAO,uCAAuC,oBAAoB,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAA;QACxF,KAAK,6BAA6B;YACjC,OAAO,2BAA2B,CAAA;QACnC,KAAK,iBAAiB;YACrB,OAAO,+BAA+B,CAAA;QACvC,KAAK,iBAAiB;YACrB,OAAO,8CAA8C,CAAA;QACtD,KAAK,eAAe;YACnB,OAAO,6EAA6E,CAAA;QACrF,KAAK,oBAAoB;YACxB,OAAO,kEAAkE,CAAA;QAC1E;YACC,OAAO,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,cAAc,CAAC,KAAK,EAAE,SAAS,CAAC,IAAI,4BAA4B,CAAC,CAAA;IACpH,CAAC;AACF,CAAC;AAED,MAAM,YAAY,GAAG,CAAO,IAAsC,EAAE,EAAE,CACrE,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,IAAI,gBAAgB,CAAC,EAAE,MAAM,EAAE,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC,CAAC,CAAA;AAEjG,+EAA+E;AAC/E,MAAM,OAAO,4BAA6B,SAAQ,MAAM,CAAC,OAAO,EAAgC,CAC/F,4CAA4C,EAC5C;IACC,YAAY,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,CAAC;IAC3D,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3B,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;QAC/C,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,aAAa,CAAA;QAE1C,MAAM,QAAQ,GAAG,CAChB,SAAmD,EACnD,IAAwD,EACxD,MAAe,EACd,EAAE,CACH,IAAI,2BAA2B,CAAC;YAC/B,SAAS;YACT,IAAI;YACJ,MAAM;YACN,WAAW,EAAE,IAAI,KAAK,kBAAkB;SACxC,CAAC,CAAA;QAEH,MAAM,MAAM,GAAG,MAAM,CAAC,EAAE,CAAC,qCAAqC,CAAC,CAAC,QAAQ,CAAC,EAAE,KAM1E;YACA,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,CAAA;YAC/C,MAAM,OAAO,GAAG,KAAK,CAAC,CAAC,iBAAiB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,8BAA8B,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CAClG,iBAAiB,CAAC,QAAQ,CAAC,KAAK,CAAC,EACjC,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CAC3D,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,OAAO,CAAC,CAAC,QAAQ,EAAE,EAAE,CAC3B,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG;gBAC9C,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,0BAA0B,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAC5E,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAC7D;gBACF,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAC,CAC/D,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,KAAK,YAAY,2BAA2B;gBAC3C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,QAAQ,EAAE,gBAAgB,CAAC,CAAC,CACpD,CACD,CAAA;QACF,CAAC,CAAC,CAAA;QAEF,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC;YACnC,KAAK,EAAE,MAAM,CAAC,MAAM;YACpB,iBAAiB,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;SACjD,CAAC,CAAA;QAEF;;;;;WAKG;QACH,MAAM,kBAAkB,GAAG,IAAI,GAAG,CAAC;YAClC,gBAAgB;YAChB,gBAAgB;YAChB,eAAe;YACf,wBAAwB;YACxB,qBAAqB;YACrB,iBAAiB;SACjB,CAAC,CAAA;QAEF;;;;WAIG;QACH,MAAM,IAAI,GAAG,MAAM,CAAC,EAAE,CAAC,mCAAmC,CAAC,CAAC,QAAQ,CAAC,EAAE,UAAqC;YAC3G,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,CAAA;YAC/C,MAAM,OAAO,GAAG,iBAAiB,CAAC,IAAI,CAAC,IAAI,GAAG,CAAC,wBAAwB,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,CACrF,iBAAiB,CAAC,aAAa,CAAC;gBAC/B,UAAU,EAAE,8CAA8C;gBAC1D,WAAW,EAAE,QAAQ,CAAC,KAAK,CAAC,UAAU,CAAC;gBACvC,SAAS,EAAE,2BAA2B;aACtC,CAAC,CACF,CAAA;YACD,OAAO,KAAK,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,OAAO,CAAC,CAAC,IAAI,CAC7C,MAAM,CAAC,OAAO,CACb,MAAM,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,QAAQ;gBACpC,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG,IAAI,QAAQ,CAAC,MAAM,GAAG,GAAG,EAAE,CAAC;oBACrD,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,gCAAgC,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CACtG,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAC3D,CAAA;oBACD,OAAO,EAAE,IAAI,EAAE,QAAQ,EAAE,KAAK,EAA8B,CAAA;gBAC7D,CAAC;gBACD,IAAI,QAAQ,CAAC,MAAM,IAAI,GAAG;oBAAE,OAAO,KAAK,CAAC,CAAC,QAAQ,CAAC,MAAM,EAAE,UAAU,EAAE,QAAQ,CAAC,MAAM,CAAC,CAAA;gBACvF,MAAM,IAAI,GAAG,KAAK,CAAC,CAAC,kBAAkB,CAAC,cAAc,CAAC,aAAa,CAAC,CAAC,QAAQ,CAAC,CAAC,IAAI,CAClF,MAAM,CAAC,QAAQ,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,MAAM,EAAE,kBAAkB,CAAC,CAAC,CAC3D,CAAA;gBACD,QAAQ,IAAI,CAAC,KAAK,EAAE,CAAC;oBACpB,KAAK,uBAAuB;wBAC3B,OAAO,EAAE,IAAI,EAAE,SAAS,EAA8B,CAAA;oBACvD,KAAK,WAAW;wBACf,OAAO,EAAE,IAAI,EAAE,UAAU,EAA8B,CAAA;oBACxD,KAAK,eAAe;wBACnB,OAAO,EAAE,IAAI,EAAE,QAAQ,EAA8B,CAAA;oBACtD,KAAK,eAAe;wBACnB,OAAO,EAAE,IAAI,EAAE,SAAS,EAA8B,CAAA;oBACvD;wBACC,OAAO,kBAAkB,CAAC,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC;4BACxC,CAAC,CAAE;gCACD,IAAI,EAAE,SAAS;gCACf,KAAK,EAAE,IAAI,CAAC,KAAK;gCACjB,GAAG,CAAC,IAAI,CAAC,iBAAiB,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,IAAI,CAAC,iBAAiB,EAAE,CAAC;6BAC3D;4BAC/B,CAAC,CAAE,EAAE,IAAI,EAAE,SAAS,EAA+B,CAAA;gBACtD,CAAC;YACF,CAAC,CAAC,CACF,EACD,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,EAAE,EAAE,CACzB,KAAK,YAAY,2BAA2B;gBAC3C,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC;gBACpB,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC,CAClD,CACD,CAAA;QACF,CAAC,CAAC,CAAA;QAEF,OAAO,EAAE,MAAM,EAAE,IAAI,EAAW,CAAA;IACjC,CAAC,CAAC;CACF,CACD;CAAG;AAEJ;;;;GAIG;AACH,MAAM,OAAO,SAAU,SAAQ,MAAM,CAAC,OAAO,EAAa,CAAC,yBAAyB,EAAE;IACrF,YAAY,EAAE,CAAC,cAAc,CAAC,KAAK,EAAE,aAAa,CAAC,OAAO,EAAE,mBAAmB,CAAC,OAAO,CAAC;IACxF,MAAM,EAAE,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;QAC3B,MAAM,aAAa,GAAG,KAAK,CAAC,CAAC,aAAa,CAAA;QAC1C,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,mBAAmB,CAAA;QAC/C,MAAM,UAAU,GAAG,KAAK,CAAC,CAAC,UAAU,CAAC,UAAU,CAAA;QAC/C,MAAM,WAAW,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,CAAA;QAElD,MAAM,qBAAqB,GAAG,MAAM,CAAC,EAAE,CAAC,iCAAiC,CAAC,CAAC,QAAQ,CAAC,EAAE,EACrF,WAAW,EACX,SAAS,EACT,YAAY,GACK;YACjB,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAA;YAC/B,MAAM,gBAAgB,GAAG,YAAY,KAAK,SAAS,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,kBAAkB,CAAC,CAAA;YACzG,IAAI,QAAQ,CAAC,QAAQ,CAAC,gBAAgB,EAAE,SAAS,CAAC,EAAE,CAAC;gBACpD,OAAO,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,KAAK,CAAC,WAAW,CAAC,CAAC,CAAA;YAChD,CAAC;YACD,OAAO,MAAM,CAAC,IAAI,EAAU,CAAA;QAC7B,CAAC,CAAC,CAAA;QAEF,MAAM,iBAAiB,GAAG,MAAM,CAAC,EAAE,CAAC,6BAA6B,CAAC,CAAC,QAAQ,CAAC,EAAE,EAC7E,YAAY,EACZ,SAAS,EACT,QAAQ,GACS;YACjB,IAAI,YAAY,KAAK,SAAS,EAAE,CAAC;gBAChC,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;YAC9D,CAAC;YAED,MAAM,GAAG,GAAG,KAAK,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAA;YAC/B,MAAM,KAAK,GAAG,KAAK,CAAC,CAAC,YAAY,CAAC,YAAY,CAAC,QAAQ,CAAC,KAAK,CAAC,YAAY,CAAC,EAAE,QAAQ,CAAC,CAAA;YACtF,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;gBACzB,OAAO,KAAK,CAAC,CAAC,IAAI,iBAAiB,CAAC,EAAE,SAAS,EAAE,SAAS,EAAE,CAAC,CAAA;YAC9D,CAAC;YACD,MAAM,kBAAkB,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,EAAE,KAAK,CAAC,UAAU,CAAC,CAAA;YACtE,MAAM,gBAAgB,GAAG,KAAK,CAAC,aAAa,KAAK,SAAS,CAAC,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,CAAA;YAC9G,KAAK,CAAC,CAAC,aAAa,CAAC,YAAY,CAAC;gBACjC,UAAU,EAAE,WAAW,CAAC,IAAI,CAAC;oBAC5B,WAAW,EAAE,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,YAAY,CAAC;oBAC9C,YAAY,EAAE,gBAAgB;oBAC9B,SAAS,EAAE,kBAAkB;oBAC7B,QAAQ;iBACR,CAAC;aACF,CAAC,CAAA;YAEF,OAAO,KAAK,CAAC,YAAY,CAAA;QAC1B,CAAC,CAAC,CAAA;QAEF,MAAM,gBAAgB,GAAG,MAAM,CAAC,EAAE,CAAC,4BAA4B,CAAC,CAAC,QAAQ,CAAC,EAAE,UAA2B;YACtG,MAAM,YAAY,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,UAAU,CAAC,CAAA;YAC7D,IAAI,MAAM,CAAC,MAAM,CAAC,YAAY,CAAC,EAAE,CAAC;gBACjC,OAAO,YAAY,CAAC,KAAK,CAAA;YAC1B,CAAC;YAED,OAAO,KAAK,CAAC,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CACvC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;gBACnB,MAAM,EAAE,UAAU,EAAE,mBAAmB,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,CAAA;gBAC7E,IAAI,mBAAmB,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;oBAC1C,OAAO,KAAK,CAAC,CAAC,IAAI,sBAAsB,CAAC,EAAE,CAAC,CAAA;gBAC7C,CAAC;gBAED,MAAM,cAAc,GAAG,KAAK,CAAC,CAAC,qBAAqB,CAAC,mBAAmB,CAAC,CAAA;gBACxE,IAAI,MAAM,CAAC,MAAM,CAAC,cAAc,CAAC,EAAE,CAAC;oBACnC,OAAO,cAAc,CAAC,KAAK,CAAA;gBAC5B,CAAC;gBAED,OAAO,KAAK,CAAC,CAAC,iBAAiB,CAAC,mBAAmB,CAAC,CAAA;YACrD,CAAC,CAAC,CACF,CAAA;QACF,CAAC,CAAC,CAAA;QAEF,qEAAqE;QACrE,sEAAsE;QACtE,oEAAoE;QACpE,2EAA2E;QAC3E,oEAAoE;QACpE,0DAA0D;QAC1D,uEAAuE;QACvE,4DAA4D;QAC5D,MAAM,qBAAqB,GAAG,GAAG,EAAE,CAClC,MAAM,CAAC,GAAG,CAAC,QAAQ,CAAC;YACnB,MAAM,gBAAgB,GAAG,KAAK,CAAC,CAAC,MAAM,CAAC,aAAa,CAAC,qBAAqB,CAAC,CAAC,IAAI,CAC/E,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,SAAS,CAAC,GAAG,EAAE,CAAC,CAAC,EAAE,CAA2B,CAAC,CAAC,CAClE,CAAA;YACD,qDAAqD;YACrD,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,gBAAgB,CAAC,eAAe,CAAC,CAAC,CAAA;YAE5E,IAAI,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,EAAE,CAAC;gBAClC,oEAAoE;gBACpE,kEAAkE;gBAClE,8DAA8D;gBAC9D,uCAAuC;gBACvC,MAAM,MAAM,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,SAAS,EAAE,CAAA;gBAC/C,MAAM,UAAU,GAAG,IAAI,CACtB,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAC/C,iBAAiB,CAAC,SAAS,CAAC,eAAe,EAAE,aAAa,CAAC,KAAK,CAAC,CACjE,CAAA;gBACD,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;YAC1D,CAAC;YAED,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC,CAAC,aAAa,CAAC,UAAU,EAAE,CAAA;YAChE,MAAM,SAAS,GAAG,KAAK,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC,IAAI,CACpD,KAAK,CAAC,GAAG,CAAC,QAAQ,EAAE,CAAC,EAAE,MAAM,EAAE,EAAE,EAAE,CAClC,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC,SAAS,CAAC,kBAAkB,EAAE,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CACvF,EACD,KAAK,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,EAAE,CACjC,gBAAgB,CAAC,UAAU,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC,iBAAiB,CAAC,WAAW,CAAC,WAAW,CAAC,CAAC,CAAC,CAC1G,EACD,KAAK,CAAC,UAAU,CAChB,CAAA;YACD,MAAM,UAAU,GAAG,IAAI,CAAC,iBAAiB,CAAC,UAAU,CAAC,MAAM,CAAC,QAAQ,EAAE,CAAC,EAAE,SAAS,CAAC,CAAA;YACnF,OAAO,UAAU,CAAC,IAAI,CAAC,UAAU,CAAC,UAAU,CAAC,UAAU,CAAC,CAAC,CAAA;QAC1D,CAAC,CAAC,CAAA;QACH,MAAM,iBAAiB,GAAG,GAAG,EAAE,CAC9B,qBAAqB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,wBAAwB,EAAE,GAAG,EAAE,CAAC,qBAAqB,EAAE,CAAC,CAAC,CAAA;QACvG,MAAM,WAAW,GAAG,GAAG,EAAE,CAAC,iBAAiB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAA;QAC9E,MAAM,aAAa,GAAG,CAAC,MAA6B,EAAE,OAAsD,EAAE,EAAE,CAC/G,iBAAiB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,WAAW,CAAC,CAAC,IAAI,CAC/C,iBAAiB,CAAC,YAAY,CAAC,OAAO,CAAC,MAAM,CAAC,OAAO,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,EAC/G,CAAC,GAAG,EAAE,EAAE,CAAC,MAAM,CAAC,KAAK,CAAC,iBAAiB,CAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC,OAAO,CAAC,CAAC,EACvE,MAAM,CAAC,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE,CAC1B,MAAM,CAAC,OAAO,CACb,MAAM,CAAC,OAAO,CAAC,OAAO,CAAC,EACvB,kBAAkB,CAAC,WAAW,CAAC;YAC9B,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,QAAQ,CAAC,IAAI;YAClC,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC;YACnE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,UAAU,CAAC;YAChE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC;YACnE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,eAAe,CAAC;YACrE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,eAAe,CAAC;YACrE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,aAAa,CAAC;YACnE,KAAK,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,WAAW,CAAC,QAAQ,EAAE,SAAS,CAAC,kBAAkB,CAAC;YACxE,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,gBAAgB,CAAC,OAAO,EAAE,QAAQ,CAAC;SACzD,CAAC,CACF,CACD,CACD,CAAA;QAEF,OAAO;YACN,UAAU,EAAE,CAAC,GAAG,IAAgD,EAAE,EAAE,CACnE,iBAAiB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YACxG,gBAAgB,EAAE,CAAC,GAAG,IAAoD,EAAE,EAAE,CAC7E,iBAAiB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,cAAc,EAAE,CAAC,GAAG,IAAoD,EAAE,EAAE,CAC3E,iBAAiB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,gBAAgB,EAAE,CAAC,GAAG,IAAsD,EAAE,EAAE,CAC/E,iBAAiB,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,mBAAmB,CAAC,MAAM,EAAE,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YAC9G,YAAY,EAAE,CAAC,GAAG,IAAkD,EAAE,EAAE,CACvE,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,YAAY,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;YAChG,eAAe,EAAE,CAAC,GAAG,IAAqD,EAAE,EAAE,CAC7E,WAAW,EAAE,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,CAAC,eAAe,CAAC,GAAG,IAAI,CAAC,CAAC,IAAI,CAAC,YAAY,CAAC,CAAC,CAAC;SAC1F,CAAA;IACX,CAAC,CAAC;CACF,CAAC;CAAG"}

package/build/esm/Auth/Domain.js

@@ -1,56 +0,0 @@
-import { Schema } from 'effect';
-/**
- * The OAuth client for browser-approved CLI setup. Distinct from the
- * `expandai-cli` client that `expandai login` uses: that one keeps loopback
- * redirect URIs and must keep showing a consent screen, because Better Auth
- * matches loopback URIs without comparing the port.
- */
-export const CLI_AUTHORIZATION_CLIENT_ID = 'expandai-cli-browser';
-export const PendingInitKey = Schema.Struct({
-    apiOrigin: Schema.String,
-    clientId: Schema.Literal(CLI_AUTHORIZATION_CLIENT_ID),
-    harness: Schema.Literal('agent-harnesses'),
-    scope: Schema.Literal('project', 'global'),
-    canonicalScopeRoot: Schema.String,
-});
-/**
- * One pending RFC 8628 device authorization. The `deviceCode` is the whole
- * credential — better-auth binds it to our client id server-side and it never
- * leaves this machine — so the record keeps the same 0600/no-symlink storage
- * discipline the PKCE verifier had.
- */
-export class PendingInitRecord extends Schema.Class('PendingInitRecord')({
-    key: PendingInitKey,
-    deviceCode: Schema.Redacted(Schema.String),
-    userCode: Schema.String,
-    verificationUri: Schema.String,
-    // RFC 8628 §3.5: current polling interval in seconds. `slow_down` adds five,
-    // permanently, so the backoff has to be persisted — each `init` invocation
-    // polls at most once and exits.
-    intervalSeconds: Schema.Number,
-    // Earliest wall-clock time the next poll may hit the network. An agent
-    // re-running `init` faster than the interval gets a local "still pending"
-    // instead of a request the server would answer with `slow_down`.
-    nextPollAt: Schema.DateTimeUtc,
-    approvalExpiresAt: Schema.DateTimeUtc,
-}) {
-}
-export class PendingInitCorrupt extends Schema.TaggedError()('PendingInitCorrupt', {
-    path: Schema.String,
-    error: Schema.Defect,
-}) {
-    recoverable = true;
-    get message() {
-        return `Pending authorization state at ${this.path} is corrupt and was left unchanged.`;
-    }
-}
-export class PendingInitStorageError extends Schema.TaggedError()('PendingInitStorageError', {
-    path: Schema.String,
-    error: Schema.Defect,
-}) {
-    recoverable = true;
-    get message() {
-        return `Could not access pending authorization state at ${this.path}.`;
-    }
-}
-//# sourceMappingURL=Domain.js.map

package/build/esm/Auth/Domain.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"Domain.js","sourceRoot":"","sources":["../../../src/Auth/Domain.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAA;AAE/B;;;;;GAKG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG,sBAAsB,CAAA;AAEjE,MAAM,CAAC,MAAM,cAAc,GAAG,MAAM,CAAC,MAAM,CAAC;IAC3C,SAAS,EAAE,MAAM,CAAC,MAAM;IACxB,QAAQ,EAAE,MAAM,CAAC,OAAO,CAAC,2BAA2B,CAAC;IACrD,OAAO,EAAE,MAAM,CAAC,OAAO,CAAC,iBAAiB,CAAC;IAC1C,KAAK,EAAE,MAAM,CAAC,OAAO,CAAC,SAAS,EAAE,QAAQ,CAAC;IAC1C,kBAAkB,EAAE,MAAM,CAAC,MAAM;CACjC,CAAC,CAAA;AAIF;;;;;GAKG;AACH,MAAM,OAAO,iBAAkB,SAAQ,MAAM,CAAC,KAAK,CAAoB,mBAAmB,CAAC,CAAC;IAC3F,GAAG,EAAE,cAAc;IACnB,UAAU,EAAE,MAAM,CAAC,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC;IAC1C,QAAQ,EAAE,MAAM,CAAC,MAAM;IACvB,eAAe,EAAE,MAAM,CAAC,MAAM;IAC9B,6EAA6E;IAC7E,2EAA2E;IAC3E,gCAAgC;IAChC,eAAe,EAAE,MAAM,CAAC,MAAM;IAC9B,uEAAuE;IACvE,0EAA0E;IAC1E,iEAAiE;IACjE,UAAU,EAAE,MAAM,CAAC,WAAW;IAC9B,iBAAiB,EAAE,MAAM,CAAC,WAAW;CACrC,CAAC;CAAG;AAEL,MAAM,OAAO,kBAAmB,SAAQ,MAAM,CAAC,WAAW,EAAsB,CAAC,oBAAoB,EAAE;IACtG,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM;CACpB,CAAC;IACQ,WAAW,GAAG,IAAI,CAAA;IAE3B,IAAI,OAAO;QACV,OAAO,kCAAkC,IAAI,CAAC,IAAI,qCAAqC,CAAA;IACxF,CAAC;CACD;AAED,MAAM,OAAO,uBAAwB,SAAQ,MAAM,CAAC,WAAW,EAA2B,CAAC,yBAAyB,EAAE;IACrH,IAAI,EAAE,MAAM,CAAC,MAAM;IACnB,KAAK,EAAE,MAAM,CAAC,MAAM;CACpB,CAAC;IACQ,WAAW,GAAG,IAAI,CAAA;IAE3B,IAAI,OAAO;QACV,OAAO,mDAAmD,IAAI,CAAC,IAAI,GAAG,CAAA;IACvE,CAAC;CACD"}

package/build/esm/Auth/ManualAuthorization.js

@@ -1,253 +0,0 @@
-import { DateTime, Duration, Effect, Either, Option, Schema } from 'effect';
-import { ManualAuthorizationApiClient, ManualAuthorizationApiError } from '../ApiClient.js';
-import { ConfigManager, OAuthConfig } from '../Config.js';
-import { InitScope } from '../Init/Domain.js';
-import { CLI_VERSION } from '../Version.js';
-import { CLI_AUTHORIZATION_CLIENT_ID, PendingInitRecord } from './Domain.js';
-import { PendingInitStore } from './PendingInit.js';
-export { ALREADY_AUTHENTICATED_MESSAGE, AUTHORIZATION_CONSUMED_MESSAGE, AUTHORIZATION_REQUIRED_MESSAGE, } from '../Init/Domain.js';
-const CLIENT_ID = CLI_AUTHORIZATION_CLIENT_ID;
-/** RFC 8628 §3.5: `slow_down` permanently adds five seconds to the interval. */
-const SLOW_DOWN_INCREMENT_SECONDS = 5;
-export class ManualAuthorizationInput extends Schema.Class('ManualAuthorizationInput')({
-    harness: Schema.Literal('agent-harnesses'),
-    scope: InitScope,
-    cwd: Schema.optional(Schema.String),
-    platform: Schema.optional(Schema.String),
-}) {
-}
-/** What the agent relays: where to approve, and the code to type there. */
-export class ManualAuthorizationRequired extends Schema.Class('ManualAuthorizationRequired')({
-    verificationUri: Schema.String,
-    userCode: Schema.NonEmptyString,
-    approvalExpiresAt: Schema.DateTimeUtc,
-}) {
-}
-/**
- * One `advance` call moves the flow as far as it can without blocking, then
- * returns. RFC 8628's polling loop is inverted: the agent re-invokes the CLI,
- * and each invocation polls the token endpoint at most once — or not at all,
- * when the persisted interval says the server would answer `slow_down`.
- */
-export class TokensSaved extends Schema.TaggedClass()('TokensSaved', {}) {
-}
-export class AuthorizationPending extends Schema.TaggedClass()('AuthorizationPending', {
-    pending: ManualAuthorizationRequired,
-}) {
-}
-export const ManualAuthorizationOutcome = Schema.Union(TokensSaved, AuthorizationPending);
-export class ManualAuthorizationDenied extends Schema.TaggedError()('ManualAuthorizationDenied', {
-    recoverable: Schema.Literal(true),
-}) {
-    get message() {
-        return 'The authorization request was denied in the browser. Run the same command again to start a new one.';
-    }
-}
-/**
- * The server refused redemption for a reason a fresh code cannot fix. Kept
- * separate from every other failure because the correct response is the
- * opposite of the usual one: do not start over, stop and report. Re-minting
- * here is what produced an endless approve loop — each new code is approved by
- * the user and then refused identically, with nothing surfaced.
- */
-export class ManualAuthorizationRefused extends Schema.TaggedError()('ManualAuthorizationRefused', {
-    error: Schema.String,
-    description: Schema.optional(Schema.String),
-    recoverable: Schema.Literal(false),
-}) {
-    get message() {
-        const detail = this.description === undefined ? '' : ` — ${this.description}`;
-        return `Expand refused to complete this authorization: ${this.error}${detail}. This is a server-side configuration problem, not something a new code can fix. Do not start setup again; report this error.`;
-    }
-}
-export class ManualAuthorizationCredentialSaveFailed extends Schema.TaggedError()('ManualAuthorizationCredentialSaveFailed', {
-    recoverable: Schema.Literal(false),
-}) {
-    get message() {
-        return 'Authorization succeeded, but credentials could not be saved. Start authorization again.';
-    }
-}
-function platformName(input) {
-    return input.platform ?? process.platform;
-}
-function required(record) {
-    return new ManualAuthorizationRequired({
-        verificationUri: record.verificationUri,
-        userCode: record.userCode,
-        approvalExpiresAt: record.approvalExpiresAt,
-    });
-}
-export class ManualAuthorization extends Effect.Service()('@expandai/cli/Auth/ManualAuthorization', {
-    dependencies: [ConfigManager.Default, PendingInitStore.Default, ManualAuthorizationApiClient.Default],
-    effect: Effect.gen(function* () {
-        const configManager = yield* ConfigManager;
-        const pendingStore = yield* PendingInitStore;
-        const apiClient = yield* ManualAuthorizationApiClient;
-        const preflight = Effect.fnUntraced(function* (input) {
-            yield* configManager.ensureSecureStorage();
-            yield* pendingStore.pruneExpired();
-            const apiUrl = yield* configManager.getApiUrl();
-            const canonicalScopeRoot = yield* pendingStore.canonicalScopeRoot(input.scope, input.cwd);
-            const key = {
-                apiOrigin: apiUrl.origin,
-                clientId: CLIENT_ID,
-                harness: input.harness,
-                scope: input.scope,
-                canonicalScopeRoot,
-            };
-            return key;
-        });
-        const create = Effect.fnUntraced(function* (input, key) {
-            const created = yield* apiClient.create({
-                harness: input.harness,
-                scope: input.scope,
-                platform: platformName(input),
-                machineLabel: `${platformName(input)}-${process.arch}`,
-                cliVersion: CLI_VERSION,
-            });
-            const now = yield* DateTime.now;
-            const record = new PendingInitRecord({
-                key,
-                deviceCode: created.deviceCode,
-                userCode: created.userCode,
-                // The stored record is JSON on disk, so the decoded `URL` goes back to
-                // its string form here rather than at the schema boundary.
-                verificationUri: created.verificationUri.toString(),
-                intervalSeconds: created.interval,
-                nextPollAt: DateTime.addDuration(now, Duration.seconds(created.interval)),
-                approvalExpiresAt: DateTime.addDuration(now, Duration.seconds(created.expiresIn)),
-            });
-            const stored = yield* Effect.either(pendingStore.putIfAbsent(record));
-            if (Either.isLeft(stored))
-                return yield* stored.left;
-            // A concurrent process may have won the write; its record is the live one.
-            return stored.right;
-        });
-        const saveTokens = Effect.fnUntraced(function* (token) {
-            const now = yield* DateTime.now;
-            const saved = yield* Effect.either(configManager.updateConfig({
-                authMethod: OAuthConfig.make({
-                    accessToken: token.access_token,
-                    refreshToken: token.refresh_token,
-                    expiresAt: DateTime.addDuration(now, Duration.seconds(token.expires_in)),
-                    clientId: CLIENT_ID,
-                }),
-            }));
-            if (Either.isLeft(saved)) {
-                return yield* new ManualAuthorizationCredentialSaveFailed({ recoverable: false });
-            }
-        });
-        const updateAfterPoll = Effect.fnUntraced(function* (record, slowDown) {
-            const now = yield* DateTime.now;
-            const intervalSeconds = record.intervalSeconds + (slowDown ? SLOW_DOWN_INCREMENT_SECONDS : 0);
-            const next = new PendingInitRecord({
-                ...record,
-                intervalSeconds,
-                nextPollAt: DateTime.addDuration(now, Duration.seconds(intervalSeconds)),
-            });
-            // One atomic publish, not delete-then-create: an interrupt between those
-            // two lost the device code entirely, and this runs on every poll.
-            const replaced = yield* Effect.either(pendingStore.replaceIfMatch(record, next));
-            if (Either.isLeft(replaced))
-                return record;
-            return replaced.right ? next : record;
-        });
-        const advance = Effect.fn('ManualAuthorization.advance')(function* (input) {
-            const key = yield* preflight(input);
-            const existing = yield* pendingStore.get(key);
-            if (Option.isNone(existing)) {
-                const record = yield* create(input, key);
-                return new AuthorizationPending({ pending: required(record) });
-            }
-            const record = existing.value;
-            const now = yield* DateTime.now;
-            if (DateTime.greaterThan(now, record.approvalExpiresAt)) {
-                // Expired locally: start over transparently. The user sees a fresh
-                // code, not an error about a code they never got to use.
-                yield* pendingStore.removeIfMatch(record);
-                const fresh = yield* create(input, key);
-                return new AuthorizationPending({ pending: required(fresh) });
-            }
-            if (DateTime.lessThan(now, record.nextPollAt)) {
-                // Inside the polling interval — answering locally is what keeps an
-                // eagerly re-running agent from earning `slow_down` penalties.
-                return new AuthorizationPending({ pending: required(record) });
-            }
-            const outcome = yield* apiClient.poll(record.deviceCode);
-            switch (outcome._tag) {
-                case 'Tokens': {
-                    yield* saveTokens(outcome.token);
-                    yield* pendingStore.removeIfMatch(record);
-                    return new TokensSaved();
-                }
-                case 'Pending': {
-                    const next = yield* updateAfterPoll(record, false);
-                    return new AuthorizationPending({ pending: required(next) });
-                }
-                case 'SlowDown': {
-                    const next = yield* updateAfterPoll(record, true);
-                    return new AuthorizationPending({ pending: required(next) });
-                }
-                case 'Denied': {
-                    yield* pendingStore.removeIfMatch(record);
-                    return yield* new ManualAuthorizationDenied({ recoverable: true });
-                }
-                case 'Refused': {
-                    // Deliberately keeps the pending record. Discarding it would mint a
-                    // fresh code on the next run, which the server refuses identically —
-                    // so the user approves again, and again. Holding the record means a
-                    // re-run reports the same error instead of asking for more approvals.
-                    return yield* new ManualAuthorizationRefused({
-                        error: outcome.error,
-                        ...(outcome.description === undefined ? {} : { description: outcome.description }),
-                        recoverable: false,
-                    });
-                }
-                case 'Expired':
-                case 'Invalid': {
-                    // The server no longer honours this code — expired, already consumed
-                    // by a response we never received, or unknown. All three recover the
-                    // same way: a fresh request and a fresh approval.
-                    yield* pendingStore.removeIfMatch(record);
-                    const fresh = yield* create(input, key);
-                    return new AuthorizationPending({ pending: required(fresh) });
-                }
-            }
-        });
-        /**
-         * Redeems a device code that arrived out of band — the dashboard's
-         * pre-approved setup token. No pending record is kept: the code is
-         * single-use and either redeems on this first poll or never will.
-         */
-        const redeemPreApproved = Effect.fn('ManualAuthorization.redeemPreApproved')(function* (deviceCode) {
-            const outcome = yield* apiClient.poll(deviceCode);
-            switch (outcome._tag) {
-                case 'Tokens':
-                    return yield* saveTokens(outcome.token);
-                case 'Denied':
-                    return yield* new ManualAuthorizationDenied({ recoverable: true });
-                case 'Refused':
-                    return yield* new ManualAuthorizationRefused({
-                        error: outcome.error,
-                        ...(outcome.description === undefined ? {} : { description: outcome.description }),
-                        recoverable: false,
-                    });
-                case 'Pending':
-                case 'SlowDown':
-                case 'Expired':
-                case 'Invalid':
-                    // A dashboard token is minted approved; anything else means it was
-                    // not produced by that flow, expired, or is already spent.
-                    return yield* new ManualAuthorizationApiError({
-                        operation: 'poll',
-                        kind: 'rejected',
-                        status: 400,
-                        recoverable: false,
-                    });
-            }
-        });
-        return { advance, redeemPreApproved };
-    }),
-}) {
-}
-//# sourceMappingURL=ManualAuthorization.js.map