noxctl 0.7.3 → 0.8.0

package/README.md

@@ -1,32 +1,68 @@
 # noxctl
 
-Command-line interface (CLI) and Model Context Protocol (MCP) server for Fortnox — manage invoices, customers, bookkeeping, and VAT (Value Added Tax) from the terminal or from AI (Artificial Intelligence) agents like Claude Code.
+[![CI](https://github.com/Magnus-Gille/noxctl/actions/workflows/ci.yml/badge.svg)](https://github.com/Magnus-Gille/noxctl/actions/workflows/ci.yml) [![npm](https://img.shields.io/npm/v/noxctl?logo=npm)](https://www.npmjs.com/package/noxctl) [![Node.js](https://img.shields.io/node/v/noxctl?logo=node.js)](https://www.npmjs.com/package/noxctl) [![License: MIT](https://img.shields.io/github/license/Magnus-Gille/noxctl)](LICENSE)
 
-```
+**Fortnox from the terminal — or from an MCP-compatible AI assistant.**
+
+noxctl is a command-line interface (CLI) and Model Context Protocol (MCP) server for
+invoices, customers, suppliers, bookkeeping, VAT, payroll, and more. Fortnox operations
+share the same CLI and MCP command surface, so you can use noxctl interactively, in
+scripts, or through tools such as Claude Code.
+
+You bring your own Fortnox developer app. Credentials stay in your operating system's
+secure store, and requests go directly from your machine to the Fortnox API — there is
+no shared credential and no backend operated by this project.
+
+> [!IMPORTANT]
+> noxctl is an independent, **unofficial** open-source project. It is **not affiliated
+> with, endorsed by, or certified by Fortnox AB.** You remain responsible for reviewing
+> every operation and complying with applicable terms and accounting, tax, payroll, and
+> privacy rules. See the full [Disclaimer](#disclaimer).
+
+## Why noxctl?
+
+- **One interface, two ways to work:** Fortnox operations are available from both the
+  CLI and MCP; local setup and profile utilities stay in the CLI.
+- **Safe writes by default:** mutations prompt for confirmation, fail closed when piped,
+  and support `--dry-run` / `dryRun` previews.
+- **Built for automation:** human-readable tables in a terminal and stable JSON when
+  piped or requested explicitly.
+- **Local credential control:** OAuth credentials are stored in macOS Keychain, Linux
+  Secret Service, or a DPAPI-protected Windows store.
+- **Multiple companies:** named profiles keep Fortnox tenants separate.
+
+## Quick start
+
+You need Node.js 22.12+, a Fortnox account with API access, and your own Fortnox
+developer app. Linux also requires `secret-tool` for secure credential storage.
+
+```bash
+npm install --global noxctl
 noxctl init                          # interactive setup wizard
-noxctl company info                  # verify connection
+noxctl company info                  # verify the connection
+```
+
+Then explore from the terminal:
+
+```bash
 noxctl customers list                # list customers
 noxctl invoices list --filter unpaid # unpaid invoices
 noxctl -o json invoices list | jq .  # JSON output for scripting/AI
 ```
 
-## Status
+Prefer not to install globally? Skip the install command and run CLI commands as `npx noxctl <command>` instead.
 
-noxctl is an independent, **unofficial** open-source project. It is **not affiliated with, endorsed by, or certified by Fortnox AB.**
-
-Use it with your own Fortnox account and developer credentials. **It is provided "as is", with no warranty and no liability — the author takes no responsibility for anything you do with it; you use it entirely at your own risk and are responsible for complying with Fortnox terms, Swedish bookkeeping/tax/payroll rules, and your own privacy obligations.** See the full [Disclaimer](#disclaimer).
-
-## Prerequisites
-
-- **Node.js** 22.12+
-- **Fortnox account** with API (Application Programming Interface) access
-- **Your own Fortnox developer app** with the required scopes enabled
-- **Linux only:** `secret-tool` available for secure credential storage
-
-Fortnox product plans, API activation requirements, and integration licensing can change. Verify the current Fortnox requirements before publishing or relying on this setup for business-critical work.
+**Documentation:** [full setup](#setup) · [profiles](#profiles-multi-tenant) ·
+[commands and MCP tools](#tools) · [mutation safety](#mutation-safety) ·
+[embedded runtimes](docs/embedded.md) · [troubleshooting](#troubleshooting) ·
+[contributing](CONTRIBUTING.md)
 
 ## Setup
 
+Fortnox product plans, API activation requirements, and integration licensing can
+change. Verify the current Fortnox requirements before publishing or relying on this
+setup for business-critical work.
+
 ### How it connects to Fortnox
 
 noxctl is a thin client over the **Fortnox REST API (v3)** at `https://api.fortnox.se/3`. It uses a **bring-your-own-app** model — there is no shared backend and no middleman:
@@ -184,12 +220,41 @@ claude mcp add fortnox-prod     -- npx noxctl serve
 claude mcp add fortnox-staging  -e NOXCTL_PROFILE=staging -- npx noxctl serve
 ```
 
+### Embedded and hosted runtimes
+
+Applications that supply their own authenticated Fortnox tenant context can use the supported `noxctl/embedded` package entry point. It provides an isolated client, typed operation set, and MCP server factory without exporting the local profile, keychain, or CLI startup APIs. See the [embedded runtime API and host responsibility boundary](docs/embedded.md).
+
 Non-default sessions print a `[profile: <name>]` stderr banner on startup and prefix every Fortnox API error and token-refresh failure with the same tag so mis-bound sessions are diagnosable from a single error line.
 
 ### Fail-closed pointer semantics
 
 If the active pointer becomes unreadable or corrupt and no explicit `--profile` flag or `NOXCTL_PROFILE` is set, `noxctl serve` **refuses to start** rather than silently falling back to `default`. This prevents a corrupted pointer from routing production MCP sessions to the wrong tenant. The CLI's `doctor` and `profile use` commands are exempt — they can still run against a broken pointer so you can repair it.
 
+### Credential recovery from sandboxes and automation
+
+Credential diagnostics use the same four states in `doctor`, `keychain status`,
+and MCP status: `available`, `missing`, `locked`, and `inaccessible`. Only
+`missing` means no registered profile or credential was found. `inaccessible`
+means noxctl cannot safely determine whether credentials exist in the current
+execution context; it will not recommend or start OAuth replacement from that
+state.
+
+Use this recovery flow when a sandboxed agent and your terminal disagree:
+
+```bash
+# Run these in a normal, unsandboxed terminal.
+noxctl keychain status
+noxctl keychain unlock                    # only when the dedicated keychain is locked
+noxctl --profile <name> doctor
+noxctl --profile <name> company info
+```
+
+Do not re-run `noxctl init` while the state is `locked` or `inaccessible`.
+Resolve access first, then retry with an explicit profile. An MCP server is
+pinned to the profile selected when that process starts; changing the active
+pointer does not retarget it. Restart the MCP server after correcting profile
+selection or unlocking credentials.
+
 ## YubiKey-locked keychain (macOS)
 
 By default, credentials live in your macOS **login keychain**, which unlocks automatically when you log in. That's convenient, but it means an AI agent (or anything running as you) can read the tokens without a per-session gesture from you.
@@ -568,7 +633,12 @@ Once authorized, the tokens are stored in the OS keychain. No env vars are neede
 
 **"Not authenticated. Run `noxctl init`"**
 
-Credentials are missing or were not saved. Re-run the setup step. On macOS, check that Keychain Access is not blocking the `security` command. On Linux, ensure `secret-tool` is installed (`sudo apt install libsecret-tools`).
+This message is emitted only when the credential state is `missing`. Re-run the
+setup step. If the message instead says `locked` or `inaccessible`, do not
+replace the credentials: follow the
+[sandbox/automation recovery flow](#credential-recovery-from-sandboxes-and-automation).
+On Linux, an inaccessible store can also mean that `secret-tool` is unavailable
+(`sudo apt install libsecret-tools`).
 
 **403 Forbidden from Fortnox API**
 
@@ -591,6 +661,8 @@ npm test             # run tests
 npm run test:watch   # watch mode
 npm run lint         # ESLint with typescript-eslint
 npm run format       # format
+npm run check:api    # refresh the git-ignored OpenAPI cache and detect API drift
+npm run audit:schemas # compare selected MCP write schemas with the local cache
 ```
 
 ## Architecture

package/dist/auth.d.ts

@@ -1,3 +1,4 @@
+import { type ProfileSource } from './profiles.js';
 export declare const SCOPES = "article customer invoice payment supplier supplierinvoice bookkeeping companyinformation settings project costcenter price inbox connectfile";
 export declare const ORDER_SCOPES = "offer order";
 export declare const LEGACY_SCOPES = "article customer invoice payment supplier supplierinvoice bookkeeping companyinformation settings inbox connectfile";
@@ -26,9 +27,24 @@ export interface FortnoxAppConfig {
     clientSecret: string;
     serviceAccount?: boolean;
 }
-export declare function setResolvedProfile(name: string): void;
+export declare function setResolvedProfile(name: string, source?: ProfileSource): void;
 export declare function getResolvedProfile(): string;
+export declare function getResolvedProfileSource(): ProfileSource;
 export declare function __resetLegacyObservedForDefault(): void;
+export type CredentialState = 'available' | 'missing' | 'locked' | 'inaccessible';
+export interface CredentialInspection {
+    state: CredentialState;
+    profile: string;
+    source: ProfileSource | 'explicit';
+    credentials: FortnoxCredentials | null;
+    detail: string;
+}
+export declare class CredentialAccessError extends Error {
+    readonly profile: string;
+    readonly source: ProfileSource | 'explicit';
+    constructor(profile: string, source: ProfileSource | 'explicit', message: string);
+}
+export declare function inspectCredentials(profile?: string): Promise<CredentialInspection>;
 export declare function loadCredentials(profile?: string): Promise<FortnoxCredentials | null>;
 export declare function saveCredentials(creds: FortnoxCredentials, profile?: string): Promise<void>;
 export declare function exchangeCodeForTokens(code: string, redirectUri: string, config: FortnoxAppConfig): Promise<{

package/dist/auth.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AA4BA,eAAO,MAAM,MAAM,iJAC6H,CAAC;AAOjJ,eAAO,MAAM,YAAY,gBAAgB,CAAC;AAe1C,eAAO,MAAM,aAAa,wHAC6F,CAAC;AAQxH,eAAO,MAAM,YAAY,WAAW,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,SAAS,GAC3D,MAAM,CAER;AAED,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAmBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,CAErD;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAGD,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAuBD,wBAAsB,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CA2B1F;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhG;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B9E;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAwC7B;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAqC7B;AAED,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8CrE;AAED,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAepF;AAED,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAgB3F;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,GAAG,EAAE,MAAM,GACV;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAclC;AAaD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,EACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAe,GACtB,MAAM,CAeR;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE,MAAwB,EACjC,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAoIf"}
+{"version":3,"file":"auth.d.ts","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAWA,OAAO,EAIL,KAAK,aAAa,EACnB,MAAM,eAAe,CAAC;AAsBvB,eAAO,MAAM,MAAM,iJAC6H,CAAC;AAOjJ,eAAO,MAAM,YAAY,gBAAgB,CAAC;AAe1C,eAAO,MAAM,aAAa,wHAC6F,CAAC;AAQxH,eAAO,MAAM,YAAY,WAAW,CAAC;AAErC;;;;GAIG;AACH,wBAAgB,eAAe,CAC7B,KAAK,EAAE,IAAI,CAAC,kBAAkB,EAAE,QAAQ,CAAC,GAAG,IAAI,GAAG,SAAS,GAC3D,MAAM,CAER;AAED,eAAO,MAAM,yBAAyB,IAAI,CAAC;AAE3C,MAAM,WAAW,kBAAkB;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,aAAa,EAAE,MAAM,CAAC;IACtB,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,YAAY,CAAC,EAAE,MAAM,CAAC;IAMtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,CAAC,EAAE,OAAO,CAAC;CAC1B;AAoBD,wBAAgB,kBAAkB,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,GAAE,aAAyB,GAAG,IAAI,CAGxF;AAED,wBAAgB,kBAAkB,IAAI,MAAM,CAE3C;AAED,wBAAgB,wBAAwB,IAAI,aAAa,CAExD;AAGD,wBAAgB,+BAA+B,IAAI,IAAI,CAEtD;AAyBD,MAAM,MAAM,eAAe,GAAG,WAAW,GAAG,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;AAElF,MAAM,WAAW,oBAAoB;IACnC,KAAK,EAAE,eAAe,CAAC;IACvB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,aAAa,GAAG,UAAU,CAAC;IACnC,WAAW,EAAE,kBAAkB,GAAG,IAAI,CAAC;IACvC,MAAM,EAAE,MAAM,CAAC;CAChB;AAED,qBAAa,qBAAsB,SAAQ,KAAK;aAE5B,OAAO,EAAE,MAAM;aACf,MAAM,EAAE,aAAa,GAAG,UAAU;gBADlC,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,aAAa,GAAG,UAAU,EAClD,OAAO,EAAE,MAAM;CAKlB;AAmBD,wBAAsB,kBAAkB,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,oBAAoB,CAAC,CAoGxF;AAED,wBAAsB,eAAe,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,kBAAkB,GAAG,IAAI,CAAC,CAM1F;AAED,wBAAsB,eAAe,CAAC,KAAK,EAAE,kBAAkB,EAAE,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAUhG;AAED,wBAAsB,qBAAqB,CACzC,IAAI,EAAE,MAAM,EACZ,WAAW,EAAE,MAAM,EACnB,MAAM,EAAE,gBAAgB,GACvB,OAAO,CAAC;IAAE,YAAY,EAAE,MAAM,CAAC;IAAC,aAAa,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,CAAA;CAAE,CAAC,CA2B9E;AAED,wBAAsB,4BAA4B,CAChD,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAwC7B;AAED,wBAAsB,kBAAkB,CACtC,KAAK,EAAE,kBAAkB,EACzB,OAAO,CAAC,EAAE,MAAM,GACf,OAAO,CAAC,kBAAkB,CAAC,CAqC7B;AAED,wBAAsB,aAAa,CAAC,OAAO,CAAC,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CA8CrE;AAED,wBAAsB,aAAa,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAepF;AAED,wBAAsB,oBAAoB,CAAC,WAAW,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,SAAS,CAAC,CAgB3F;AAED;;;;;;;;GAQG;AACH,wBAAgB,kBAAkB,CAChC,QAAQ,EAAE,MAAM,CAAC,QAAQ,EACzB,GAAG,EAAE,MAAM,GACV;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,EAAE,CAAA;CAAE,CAclC;AAaD,wBAAgB,UAAU,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM,CAOhD;AAED,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,gBAAgB,EACxB,WAAW,EAAE,MAAM,EACnB,KAAK,EAAE,MAAM,EACb,MAAM,GAAE,MAAe,GACtB,MAAM,CAeR;AAED,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,OAAO,GAAE,MAAwB,EACjC,MAAM,GAAE,MAAe,GACtB,OAAO,CAAC,IAAI,CAAC,CAoIf"}

package/dist/auth.js

@@ -1,10 +1,10 @@
 import { createServer } from 'node:http';
 import { randomBytes } from 'node:crypto';
 import { execFileSync } from 'node:child_process';
-import { loadCredentialBlob, saveCredentialBlob } from './credentials-store.js';
+import { CredentialStoreAccessError, loadCredentialBlob, saveCredentialBlob, } from './credentials-store.js';
 import { KeychainLockedError } from './keychain-target.js';
 import { DEFAULT_PROFILE, validateProfileName } from './profile-name.js';
-import { migrateLegacyIfNeeded, readProfileIndex, upsertProfile } from './profiles.js';
+import { migrateLegacyIfNeeded, readProfileIndex, upsertProfile, } from './profiles.js';
 const FORTNOX_AUTH_URL = 'https://apps.fortnox.se/oauth-v1/auth';
 const FORTNOX_TOKEN_URL = 'https://apps.fortnox.se/oauth-v1/token';
 const CALLBACK_HOST = '127.0.0.1';
@@ -66,6 +66,7 @@ export const CREDENTIAL_SCHEMA_VERSION = 2;
 // instance would share this state. Revisit if the MCP SDK grows request-local
 // context that handlers can read.
 let resolvedProfile = DEFAULT_PROFILE;
+let resolvedProfileSource = 'default';
 // Token endpoints may rotate refresh tokens, so concurrent requests for the
 // same profile must share one refresh and one credential-store write. Profile
 // names are case-insensitive throughout the storage layer.
@@ -74,12 +75,16 @@ const tokenRefreshes = new Map();
 // successful load of the default profile. Set only by loadCredentials; read by
 // saveCredentials to decide whether to dual-write during the 0.2.x window.
 let legacyObservedForDefault = false;
-export function setResolvedProfile(name) {
+export function setResolvedProfile(name, source = 'default') {
     resolvedProfile = validateProfileName(name);
+    resolvedProfileSource = source;
 }
 export function getResolvedProfile() {
     return resolvedProfile;
 }
+export function getResolvedProfileSource() {
+    return resolvedProfileSource;
+}
 // Test-only: reset module-level observation state between cases.
 export function __resetLegacyObservedForDefault() {
     legacyObservedForDefault = false;
@@ -87,6 +92,30 @@ export function __resetLegacyObservedForDefault() {
 function profileOrResolved(profile) {
     return profile ?? resolvedProfile;
 }
+function sourceForProfile(profile) {
+    return profile.toLowerCase() === resolvedProfile.toLowerCase()
+        ? resolvedProfileSource
+        : 'explicit';
+}
+function credentialContext(profile) {
+    return `profile "${profile}" (source: ${sourceForProfile(profile)})`;
+}
+function inaccessibleRecovery(profile) {
+    return (`Run \`noxctl keychain status\` and, if needed, \`noxctl keychain unlock\` in an ` +
+        `unsandboxed terminal, then retry with \`--profile ${profile}\`. An already-running MCP ` +
+        `server remains pinned to the profile selected at startup; changing the active profile ` +
+        `pointer will not retarget it, so restart that MCP process after correcting the profile.`);
+}
+export class CredentialAccessError extends Error {
+    profile;
+    source;
+    constructor(profile, source, message) {
+        super(message);
+        this.profile = profile;
+        this.source = source;
+        this.name = 'CredentialAccessError';
+    }
+}
 function isDefaultProfile(name) {
     return name.toLowerCase() === DEFAULT_PROFILE;
 }
@@ -99,18 +128,31 @@ function legacySlotExists(source) {
         source === 'both-legacy-preferred' ||
         source === 'legacy-plaintext');
 }
-export async function loadCredentials(profile) {
+export async function inspectCredentials(profile) {
     const target = profileOrResolved(profile);
+    const source = sourceForProfile(target);
     let result;
     try {
         result = await loadCredentialBlob(target);
     }
     catch (err) {
-        // A locked dedicated keychain must surface, not look like "no credentials" —
-        // the caller tells the user to run `noxctl keychain unlock` (tap YubiKey).
-        if (err instanceof KeychainLockedError)
-            throw err;
-        return null;
+        if (err instanceof KeychainLockedError) {
+            return {
+                state: 'locked',
+                profile: target,
+                source,
+                credentials: null,
+                detail: `Credential state: locked for ${credentialContext(target)} — ${err.message}`,
+            };
+        }
+        const reason = err instanceof CredentialStoreAccessError || err instanceof Error ? err.message : String(err);
+        return {
+            state: 'inaccessible',
+            profile: target,
+            source,
+            credentials: null,
+            detail: `Credential state: inaccessible for ${credentialContext(target)} — ${reason}. ${inaccessibleRecovery(target)}`,
+        };
     }
     if (isDefaultProfile(target) && legacySlotExists(result.source)) {
         legacyObservedForDefault = true;
@@ -118,17 +160,82 @@ export async function loadCredentials(profile) {
         // the raw legacy blob — not result.blob, which may be the new slot if
         // pickHigher preferred it and would lose legacy-only metadata on drift.
         // A failure here must not break auth — Chunk D's `doctor` will surface it.
-        await migrateLegacyIfNeeded(result.legacyBlob);
+        try {
+            await migrateLegacyIfNeeded(result.legacyBlob);
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            return {
+                state: 'inaccessible',
+                profile: target,
+                source,
+                credentials: null,
+                detail: `Credential state: inaccessible for ${credentialContext(target)} — legacy profile metadata could not be inspected (${reason}). ${inaccessibleRecovery(target)}`,
+            };
+        }
+    }
+    if (!result.blob) {
+        let registered = false;
+        try {
+            const index = await readProfileIndex();
+            registered = index.profiles.some((entry) => entry.name.toLowerCase() === target.toLowerCase());
+        }
+        catch (err) {
+            const reason = err instanceof Error ? err.message : String(err);
+            return {
+                state: 'inaccessible',
+                profile: target,
+                source,
+                credentials: null,
+                detail: `Credential state: inaccessible for ${credentialContext(target)} — the profile index could not be read (${reason}). ${inaccessibleRecovery(target)}`,
+            };
+        }
+        if (registered) {
+            return {
+                state: 'inaccessible',
+                profile: target,
+                source,
+                credentials: null,
+                detail: `Credential state: inaccessible for ${credentialContext(target)} — the registered profile exists, but credential lookup returned no item in this execution context. ${inaccessibleRecovery(target)}`,
+            };
+        }
+        return {
+            state: 'missing',
+            profile: target,
+            source,
+            credentials: null,
+            detail: `Credential state: missing for ${credentialContext(target)}. Run ${isDefaultProfile(target) ? '`noxctl init`' : `\`noxctl init --profile ${target}\``} to connect your Fortnox account.`,
+        };
     }
-    if (!result.blob)
-        return null;
     try {
-        return JSON.parse(result.blob);
+        return {
+            state: 'available',
+            profile: target,
+            source,
+            credentials: JSON.parse(result.blob),
+            detail: `Credential state: available for ${credentialContext(target)}`,
+        };
     }
     catch {
-        return null;
+        return {
+            state: 'inaccessible',
+            profile: target,
+            source,
+            credentials: null,
+            detail: `Credential state: inaccessible for ${credentialContext(target)} — the stored credential blob could not be parsed. ${inaccessibleRecovery(target)}`,
+        };
     }
 }
+export async function loadCredentials(profile) {
+    const inspected = await inspectCredentials(profile);
+    if (inspected.state === 'available')
+        return inspected.credentials;
+    if (inspected.state === 'missing')
+        return null;
+    if (inspected.state === 'locked')
+        throw new KeychainLockedError(inspected.detail);
+    throw new CredentialAccessError(inspected.profile, inspected.source, inspected.detail);
+}
 export async function saveCredentials(creds, profile) {
     const target = profileOrResolved(profile);
     const stamped = {
@@ -226,7 +333,7 @@ export async function getValidToken(profile) {
         const initCmd = isDefaultProfile(target)
             ? '`noxctl init`'
             : `\`noxctl init --profile ${target}\``;
-        throw new Error(`${profileTag(target)}Not authenticated. Run ${initCmd} to connect your Fortnox account.`);
+        throw new Error(`[profile: ${target}, source: ${sourceForProfile(target)}] Not authenticated. Run ${initCmd} to connect your Fortnox account.`);
     }
     // Token still valid — use it
     if (Date.now() <= creds.expires_at - 5 * 60 * 1000) {

package/dist/auth.js.map

@@ -1 +1 @@
-{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EAAE,kBAAkB,EAAE,kBAAkB,EAAmB,MAAM,wBAAwB,CAAC;AACjG,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,qBAAqB,EAAE,gBAAgB,EAAE,aAAa,EAAE,MAAM,eAAe,CAAC;AAEvF,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AACjE,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AACnE,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,SAAS,SAAS,CAAC,KAAmB,EAAE,OAAoB,EAAE;IAC5D,OAAO,KAAK,CAAC,KAAK,EAAE;QAClB,GAAG,IAAI;QACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,iFAAiF;AACjF,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,kFAAkF;AAClF,MAAM,CAAC,MAAM,MAAM,GACjB,8IAA8I,CAAC;AAEjJ,iFAAiF;AACjF,iFAAiF;AACjF,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,6EAA6E;AAC7E,gFAAgF;AAChF,0EAA0E;AAC1E,4EAA4E;AAC5E,EAAE;AACF,mFAAmF;AACnF,mFAAmF;AACnF,mFAAmF;AACnF,4CAA4C;AAC5C,MAAM,CAAC,MAAM,aAAa,GACxB,qHAAqH,CAAC;AAExH,4EAA4E;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA4D;IAE5D,OAAO,KAAK,EAAE,MAAM,IAAI,aAAa,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AA0B3C,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,kCAAkC;AAClC,IAAI,eAAe,GAAW,eAAe,CAAC;AAE9C,4EAA4E;AAC5E,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE1D,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,IAAI,wBAAwB,GAAG,KAAK,CAAC;AAErC,MAAM,UAAU,kBAAkB,CAAC,IAAY;IAC7C,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;AAC9C,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,+BAA+B;IAC7C,wBAAwB,GAAG,KAAK,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,OAAO,IAAI,eAAe,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,OAAO,CACL,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,oBAAoB;QAC/B,MAAM,KAAK,uBAAuB;QAClC,MAAM,KAAK,kBAAkB,CAC9B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB;IACpD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,IAAI,MAA8E,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,6EAA6E;QAC7E,2EAA2E;QAC3E,IAAI,GAAG,YAAY,mBAAmB;YAAE,MAAM,GAAG,CAAC;QAClD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,wBAAwB,GAAG,IAAI,CAAC;QAChC,2EAA2E;QAC3E,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,MAAM,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACjD,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI;QAAE,OAAO,IAAI,CAAC;IAC9B,IAAI,CAAC;QACH,OAAO,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAuB,CAAC;IACvD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAyB,EAAE,OAAgB;IAC/E,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAuB;QAClC,GAAG,KAAK;QACR,cAAc,EAAE,yBAAyB;QACzC,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE;KAC7B,CAAC;IACF,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE;QACxD,eAAe,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,wBAAwB;KACtE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,WAAmB,EACnB,MAAwB;IAExB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,iBAAiB,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,aAAa,EACX,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACzF;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAI5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAyB,EACzB,OAAgB;IAEhB,MAAM,GAAG,GAAG,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,6DAA6D,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;KAC9B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,iBAAiB,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,aAAa,EACX,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxF,QAAQ,EAAE,KAAK,CAAC,SAAS;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,4CAA4C,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;IAEF,MAAM,OAAO,GAAuB;QAClC,GAAG,KAAK;QACR,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;KAChD,CAAC;IAEF,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAyB,EACzB,OAAgB;IAEhB,MAAM,GAAG,GAAG,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,iBAAiB,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,aAAa,EACX,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACzF;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,yBAAyB,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;IAEF,MAAM,OAAO,GAAuB;QAClC,GAAG,KAAK;QACR,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;KAChD,CAAC;IAEF,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC;YACtC,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,2BAA2B,MAAM,IAAI,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,GAAG,UAAU,CAAC,MAAM,CAAC,0BAA0B,OAAO,mCAAmC,CAC1F,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAqB,EAAE;QAC3C,0EAA0E;QAC1E,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACpE,OAAO,SAAS,CAAC,YAAY,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,SAAS,CAAC,YAAY,CAAC;IAChC,CAAC,CAAC,EAAE,CAAC;IAEL,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO;YAAE,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,WAAmB;IACrD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,6CAA6C,EAAE;QAC9E,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;IAEF,OAAO,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,6CAA6C,EAAE;YAC9E,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;QACF,OAAO,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,GAAW;IAEX,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAChE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE;gBACJ,YAAY;gBACZ,iBAAiB;gBACjB,UAAU;gBACV,kBAAkB,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;aAC7C;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,qEAAqE;QACrE,qDAAqD;QACrD,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAwB,EACxB,WAAmB,EACnB,KAAa,EACb,SAAiB,MAAM;IAEvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,MAAM;QACb,KAAK;QACL,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,SAAS;KACvB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,GAAG,gBAAgB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAwB,EACxB,UAAkB,eAAe,EACjC,SAAiB,MAAM;IAEvB,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC;IAClB,MAAM,YAAY,GAAG,oBAAoB,IAAI,WAAW,CAAC;IACzD,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC7B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;YAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAEhE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;oBAClE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,GAAG,CAAC,GAAG,CACL,yCAAyC,UAAU,CAAC,KAAK,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAM,CAChG,CAAC;oBACF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;oBAChF,OAAO;gBACT,CAAC;gBAED,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,GAAG,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;oBAC5E,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,GAAG,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;oBACrD,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;oBAEvE,8CAA8C;oBAC9C,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;oBACrC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;oBAC1D,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;oBAEpE,MAAM,KAAK,GAAuB;wBAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;wBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;wBAClC,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;wBACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI;wBACjD,SAAS,EAAE,QAAQ;wBACnB,YAAY,EAAE,WAAW;wBACzB,MAAM;qBACP,CAAC;oBAEF,sEAAsE;oBACtE,mEAAmE;oBACnE,oEAAoE;oBACpE,sEAAsE;oBACtE,oEAAoE;oBACpE,yDAAyD;oBACzD,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,WAAW,EAAE,CAC/D,CAAC;oBACF,MAAM,aAAa,CAAC;wBAClB,IAAI,EAAE,gBAAgB;wBACtB,SAAS,EAAE,QAAQ;wBACnB,YAAY,EAAE,WAAW;wBACzB,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBAC5D,cAAc,EAAE,CAAC;qBAClB,CAAC,CAAC;oBACH,MAAM,eAAe,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;oBAE/C,MAAM,SAAS,GAAG,QAAQ;wBACxB,CAAC,CAAC,mCAAmC;wBACrC,CAAC,CAAC,oDAAoD,CAAC;oBAEzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,GAAG,CAAC,GAAG,CACL,gGAAgG,CACjG,CAAC;oBAEF,OAAO,CAAC,GAAG,CAAC,uCAAuC,SAAS,IAAI,CAAC,CAAC;oBAClE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;oBAC7C,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;oBAC1D,MAAM,EAAE,CAAC;gBACX,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACjE,GAAG,CAAC,GAAG,CAAC,6BAA6B,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAChE,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC1D,CAAC;wBAAS,CAAC;oBACT,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE;YACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACxD,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,sEAAsE;YACtE,yEAAyE;YACzE,OAAO,CAAC,GAAG,CAAC,6DAA6D,OAAO,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,GAAG,CAAC,0CAA0C,aAAa,IAAI,IAAI,KAAK,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}
+{"version":3,"file":"auth.js","sourceRoot":"","sources":["../src/auth.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,YAAY,EAA6C,MAAM,WAAW,CAAC;AACpF,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAC1C,OAAO,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAClD,OAAO,EACL,0BAA0B,EAC1B,kBAAkB,EAClB,kBAAkB,GAEnB,MAAM,wBAAwB,CAAC;AAChC,OAAO,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EACL,qBAAqB,EACrB,gBAAgB,EAChB,aAAa,GAEd,MAAM,eAAe,CAAC;AAEvB,MAAM,gBAAgB,GAAG,uCAAuC,CAAC;AACjE,MAAM,iBAAiB,GAAG,wCAAwC,CAAC;AACnE,MAAM,aAAa,GAAG,WAAW,CAAC;AAClC,MAAM,uBAAuB,GAAG,MAAM,CAAC;AAEvC,SAAS,SAAS,CAAC,KAAmB,EAAE,OAAoB,EAAE;IAC5D,OAAO,KAAK,CAAC,KAAK,EAAE;QAClB,GAAG,IAAI;QACP,MAAM,EAAE,IAAI,CAAC,MAAM,IAAI,WAAW,CAAC,OAAO,CAAC,uBAAuB,CAAC;KACpE,CAAC,CAAC;AACL,CAAC;AAED,4EAA4E;AAC5E,iFAAiF;AACjF,8EAA8E;AAC9E,uEAAuE;AACvE,6EAA6E;AAC7E,4EAA4E;AAC5E,4EAA4E;AAC5E,kFAAkF;AAClF,MAAM,CAAC,MAAM,MAAM,GACjB,8IAA8I,CAAC;AAEjJ,iFAAiF;AACjF,iFAAiF;AACjF,2EAA2E;AAC3E,4EAA4E;AAC5E,uEAAuE;AACvE,MAAM,CAAC,MAAM,YAAY,GAAG,aAAa,CAAC;AAE1C,8EAA8E;AAC9E,kFAAkF;AAClF,gFAAgF;AAChF,mFAAmF;AACnF,6EAA6E;AAC7E,gFAAgF;AAChF,0EAA0E;AAC1E,4EAA4E;AAC5E,EAAE;AACF,mFAAmF;AACnF,mFAAmF;AACnF,mFAAmF;AACnF,4CAA4C;AAC5C,MAAM,CAAC,MAAM,aAAa,GACxB,qHAAqH,CAAC;AAExH,4EAA4E;AAC5E,2EAA2E;AAC3E,8EAA8E;AAC9E,6EAA6E;AAC7E,yEAAyE;AACzE,uDAAuD;AACvD,MAAM,CAAC,MAAM,YAAY,GAAG,QAAQ,CAAC;AAErC;;;;GAIG;AACH,MAAM,UAAU,eAAe,CAC7B,KAA4D;IAE5D,OAAO,KAAK,EAAE,MAAM,IAAI,aAAa,CAAC;AACxC,CAAC;AAED,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,CAAC;AA0B3C,6EAA6E;AAC7E,6EAA6E;AAC7E,4EAA4E;AAC5E,8EAA8E;AAC9E,kCAAkC;AAClC,IAAI,eAAe,GAAW,eAAe,CAAC;AAC9C,IAAI,qBAAqB,GAAkB,SAAS,CAAC;AAErD,4EAA4E;AAC5E,8EAA8E;AAC9E,2DAA2D;AAC3D,MAAM,cAAc,GAAG,IAAI,GAAG,EAA2B,CAAC;AAE1D,+EAA+E;AAC/E,+EAA+E;AAC/E,2EAA2E;AAC3E,IAAI,wBAAwB,GAAG,KAAK,CAAC;AAErC,MAAM,UAAU,kBAAkB,CAAC,IAAY,EAAE,SAAwB,SAAS;IAChF,eAAe,GAAG,mBAAmB,CAAC,IAAI,CAAC,CAAC;IAC5C,qBAAqB,GAAG,MAAM,CAAC;AACjC,CAAC;AAED,MAAM,UAAU,kBAAkB;IAChC,OAAO,eAAe,CAAC;AACzB,CAAC;AAED,MAAM,UAAU,wBAAwB;IACtC,OAAO,qBAAqB,CAAC;AAC/B,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,+BAA+B;IAC7C,wBAAwB,GAAG,KAAK,CAAC;AACnC,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAgB;IACzC,OAAO,OAAO,IAAI,eAAe,CAAC;AACpC,CAAC;AAED,SAAS,gBAAgB,CAAC,OAAe;IACvC,OAAO,OAAO,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,WAAW,EAAE;QAC5D,CAAC,CAAC,qBAAqB;QACvB,CAAC,CAAC,UAAU,CAAC;AACjB,CAAC;AAED,SAAS,iBAAiB,CAAC,OAAe;IACxC,OAAO,YAAY,OAAO,cAAc,gBAAgB,CAAC,OAAO,CAAC,GAAG,CAAC;AACvE,CAAC;AAED,SAAS,oBAAoB,CAAC,OAAe;IAC3C,OAAO,CACL,kFAAkF;QAClF,qDAAqD,OAAO,6BAA6B;QACzF,wFAAwF;QACxF,yFAAyF,CAC1F,CAAC;AACJ,CAAC;AAYD,MAAM,OAAO,qBAAsB,SAAQ,KAAK;IAE5B;IACA;IAFlB,YACkB,OAAe,EACf,MAAkC,EAClD,OAAe;QAEf,KAAK,CAAC,OAAO,CAAC,CAAC;QAJC,YAAO,GAAP,OAAO,CAAQ;QACf,WAAM,GAAN,MAAM,CAA4B;QAIlD,IAAI,CAAC,IAAI,GAAG,uBAAuB,CAAC;IACtC,CAAC;CACF;AAED,SAAS,gBAAgB,CAAC,IAAY;IACpC,OAAO,IAAI,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC;AAChD,CAAC;AAED,SAAS,UAAU,CAAC,IAAY;IAC9B,OAAO,gBAAgB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,aAAa,IAAI,IAAI,CAAC;AAC7D,CAAC;AAED,SAAS,gBAAgB,CAAC,MAAkB;IAC1C,OAAO,CACL,MAAM,KAAK,QAAQ;QACnB,MAAM,KAAK,oBAAoB;QAC/B,MAAM,KAAK,uBAAuB;QAClC,MAAM,KAAK,kBAAkB,CAC9B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,OAAgB;IACvD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,MAAM,GAAG,gBAAgB,CAAC,MAAM,CAAC,CAAC;IACxC,IAAI,MAA8E,CAAC;IACnF,IAAI,CAAC;QACH,MAAM,GAAG,MAAM,kBAAkB,CAAC,MAAM,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,IAAI,GAAG,YAAY,mBAAmB,EAAE,CAAC;YACvC,OAAO;gBACL,KAAK,EAAE,QAAQ;gBACf,OAAO,EAAE,MAAM;gBACf,MAAM;gBACN,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,gCAAgC,iBAAiB,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,OAAO,EAAE;aACrF,CAAC;QACJ,CAAC;QACD,MAAM,MAAM,GACV,GAAG,YAAY,0BAA0B,IAAI,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QAChG,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,MAAM;YACf,MAAM;YACN,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,sCAAsC,iBAAiB,CAAC,MAAM,CAAC,MAAM,MAAM,KAAK,oBAAoB,CAAC,MAAM,CAAC,EAAE;SACvH,CAAC;IACJ,CAAC;IAED,IAAI,gBAAgB,CAAC,MAAM,CAAC,IAAI,gBAAgB,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAChE,wBAAwB,GAAG,IAAI,CAAC;QAChC,2EAA2E;QAC3E,sEAAsE;QACtE,wEAAwE;QACxE,2EAA2E;QAC3E,IAAI,CAAC;YACH,MAAM,qBAAqB,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;QACjD,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,OAAO;gBACL,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,MAAM;gBACf,MAAM;gBACN,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,sCAAsC,iBAAiB,CAAC,MAAM,CAAC,sDAAsD,MAAM,MAAM,oBAAoB,CAAC,MAAM,CAAC,EAAE;aACxK,CAAC;QACJ,CAAC;IACH,CAAC;IAED,IAAI,CAAC,MAAM,CAAC,IAAI,EAAE,CAAC;QACjB,IAAI,UAAU,GAAG,KAAK,CAAC;QACvB,IAAI,CAAC;YACH,MAAM,KAAK,GAAG,MAAM,gBAAgB,EAAE,CAAC;YACvC,UAAU,GAAG,KAAK,CAAC,QAAQ,CAAC,IAAI,CAC9B,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAC7D,CAAC;QACJ,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,MAAM,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;YAChE,OAAO;gBACL,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,MAAM;gBACf,MAAM;gBACN,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,sCAAsC,iBAAiB,CAAC,MAAM,CAAC,2CAA2C,MAAM,MAAM,oBAAoB,CAAC,MAAM,CAAC,EAAE;aAC7J,CAAC;QACJ,CAAC;QACD,IAAI,UAAU,EAAE,CAAC;YACf,OAAO;gBACL,KAAK,EAAE,cAAc;gBACrB,OAAO,EAAE,MAAM;gBACf,MAAM;gBACN,WAAW,EAAE,IAAI;gBACjB,MAAM,EAAE,sCAAsC,iBAAiB,CAAC,MAAM,CAAC,uGAAuG,oBAAoB,CAAC,MAAM,CAAC,EAAE;aAC7M,CAAC;QACJ,CAAC;QACD,OAAO;YACL,KAAK,EAAE,SAAS;YAChB,OAAO,EAAE,MAAM;YACf,MAAM;YACN,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,iCAAiC,iBAAiB,CAAC,MAAM,CAAC,SAChE,gBAAgB,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,2BAA2B,MAAM,IAChF,mCAAmC;SACpC,CAAC;IACJ,CAAC;IACD,IAAI,CAAC;QACH,OAAO;YACL,KAAK,EAAE,WAAW;YAClB,OAAO,EAAE,MAAM;YACf,MAAM;YACN,WAAW,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,IAAI,CAAuB;YAC1D,MAAM,EAAE,mCAAmC,iBAAiB,CAAC,MAAM,CAAC,EAAE;SACvE,CAAC;IACJ,CAAC;IAAC,MAAM,CAAC;QACP,OAAO;YACL,KAAK,EAAE,cAAc;YACrB,OAAO,EAAE,MAAM;YACf,MAAM;YACN,WAAW,EAAE,IAAI;YACjB,MAAM,EAAE,sCAAsC,iBAAiB,CAAC,MAAM,CAAC,sDAAsD,oBAAoB,CAAC,MAAM,CAAC,EAAE;SAC5J,CAAC;IACJ,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,OAAgB;IACpD,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,OAAO,CAAC,CAAC;IACpD,IAAI,SAAS,CAAC,KAAK,KAAK,WAAW;QAAE,OAAO,SAAS,CAAC,WAAW,CAAC;IAClE,IAAI,SAAS,CAAC,KAAK,KAAK,SAAS;QAAE,OAAO,IAAI,CAAC;IAC/C,IAAI,SAAS,CAAC,KAAK,KAAK,QAAQ;QAAE,MAAM,IAAI,mBAAmB,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;IAClF,MAAM,IAAI,qBAAqB,CAAC,SAAS,CAAC,OAAO,EAAE,SAAS,CAAC,MAAM,EAAE,SAAS,CAAC,MAAM,CAAC,CAAC;AACzF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,KAAyB,EAAE,OAAgB;IAC/E,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,OAAO,GAAuB;QAClC,GAAG,KAAK;QACR,cAAc,EAAE,yBAAyB;QACzC,gBAAgB,EAAE,IAAI,CAAC,GAAG,EAAE;KAC7B,CAAC;IACF,MAAM,kBAAkB,CAAC,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,MAAM,EAAE;QACxD,eAAe,EAAE,gBAAgB,CAAC,MAAM,CAAC,IAAI,wBAAwB;KACtE,CAAC,CAAC;AACL,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,IAAY,EACZ,WAAmB,EACnB,MAAwB;IAExB,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,IAAI;QACJ,YAAY,EAAE,WAAW;KAC1B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,iBAAiB,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,aAAa,EACX,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,MAAM,CAAC,QAAQ,IAAI,MAAM,CAAC,YAAY,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACzF;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,0BAA0B,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACzE,CAAC;IAED,OAAO,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAI5B,CAAC;AACJ,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,4BAA4B,CAChD,KAAyB,EACzB,OAAgB;IAEhB,MAAM,GAAG,GAAG,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,IAAI,CAAC,KAAK,CAAC,SAAS,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,6DAA6D,CAAC,CAAC;IACvF,CAAC;IAED,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,oBAAoB;QAChC,KAAK,EAAE,eAAe,CAAC,KAAK,CAAC;KAC9B,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,iBAAiB,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,aAAa,EACX,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;YACxF,QAAQ,EAAE,KAAK,CAAC,SAAS;SAC1B;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,4CAA4C,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IACjG,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAGlC,CAAC;IAEF,MAAM,OAAO,GAAuB;QAClC,GAAG,KAAK;QACR,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;KAChD,CAAC;IAEF,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,kBAAkB,CACtC,KAAyB,EACzB,OAAgB;IAEhB,MAAM,GAAG,GAAG,UAAU,CAAC,iBAAiB,CAAC,OAAO,CAAC,CAAC,CAAC;IACnD,MAAM,IAAI,GAAG,IAAI,eAAe,CAAC;QAC/B,UAAU,EAAE,eAAe;QAC3B,aAAa,EAAE,KAAK,CAAC,aAAa;KACnC,CAAC,CAAC;IAEH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,iBAAiB,EAAE;QAClD,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,mCAAmC;YACnD,aAAa,EACX,QAAQ,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,KAAK,CAAC,SAAS,IAAI,KAAK,CAAC,aAAa,EAAE,CAAC,CAAC,QAAQ,CAAC,QAAQ,CAAC;SACzF;QACD,IAAI,EAAE,IAAI,CAAC,QAAQ,EAAE;KACtB,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,CAAC;QACjB,MAAM,IAAI,GAAG,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC;QACnC,MAAM,IAAI,KAAK,CAAC,GAAG,GAAG,yBAAyB,QAAQ,CAAC,MAAM,MAAM,IAAI,EAAE,CAAC,CAAC;IAC9E,CAAC;IAED,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAIlC,CAAC;IAEF,MAAM,OAAO,GAAuB;QAClC,GAAG,KAAK;QACR,YAAY,EAAE,IAAI,CAAC,YAAY;QAC/B,aAAa,EAAE,IAAI,CAAC,aAAa;QACjC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,UAAU,GAAG,IAAI;KAChD,CAAC;IAEF,MAAM,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;IACxC,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,OAAgB;IAClD,MAAM,MAAM,GAAG,iBAAiB,CAAC,OAAO,CAAC,CAAC;IAC1C,MAAM,KAAK,GAAG,MAAM,eAAe,CAAC,MAAM,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK,EAAE,CAAC;QACX,MAAM,OAAO,GAAG,gBAAgB,CAAC,MAAM,CAAC;YACtC,CAAC,CAAC,eAAe;YACjB,CAAC,CAAC,2BAA2B,MAAM,IAAI,CAAC;QAC1C,MAAM,IAAI,KAAK,CACb,aAAa,MAAM,aAAa,gBAAgB,CAAC,MAAM,CAAC,4BAA4B,OAAO,mCAAmC,CAC/H,CAAC;IACJ,CAAC;IAED,6BAA6B;IAC7B,IAAI,IAAI,CAAC,GAAG,EAAE,IAAI,KAAK,CAAC,UAAU,GAAG,CAAC,GAAG,EAAE,GAAG,IAAI,EAAE,CAAC;QACnD,OAAO,KAAK,CAAC,YAAY,CAAC;IAC5B,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,WAAW,EAAE,CAAC;IACxC,MAAM,QAAQ,GAAG,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;IAChD,IAAI,QAAQ;QAAE,OAAO,QAAQ,CAAC;IAE9B,MAAM,OAAO,GAAG,CAAC,KAAK,IAAqB,EAAE;QAC3C,0EAA0E;QAC1E,2EAA2E;QAC3E,mDAAmD;QACnD,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YACpB,IAAI,CAAC;gBACH,MAAM,SAAS,GAAG,MAAM,4BAA4B,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;gBACpE,OAAO,SAAS,CAAC,YAAY,CAAC;YAChC,CAAC;YAAC,MAAM,CAAC;gBACP,qCAAqC;YACvC,CAAC;QACH,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,kBAAkB,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC;QAC1D,OAAO,SAAS,CAAC,YAAY,CAAC;IAChC,CAAC,CAAC,EAAE,CAAC;IAEL,cAAc,CAAC,GAAG,CAAC,UAAU,EAAE,OAAO,CAAC,CAAC;IACxC,IAAI,CAAC;QACH,OAAO,MAAM,OAAO,CAAC;IACvB,CAAC;YAAS,CAAC;QACT,0EAA0E;QAC1E,iEAAiE;QACjE,IAAI,cAAc,CAAC,GAAG,CAAC,UAAU,CAAC,KAAK,OAAO;YAAE,cAAc,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;IACpF,CAAC;AACH,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,WAAmB;IACrD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,6CAA6C,EAAE;QAC9E,OAAO,EAAE;YACP,aAAa,EAAE,UAAU,WAAW,EAAE;YACtC,MAAM,EAAE,kBAAkB;SAC3B;KACF,CAAC,CAAC;IAEH,IAAI,CAAC,QAAQ,CAAC,EAAE;QAAE,OAAO,SAAS,CAAC;IAEnC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;IAEF,OAAO,IAAI,CAAC,kBAAkB,EAAE,cAAc,CAAC;AACjD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,oBAAoB,CAAC,WAAmB;IAC5D,IAAI,CAAC;QACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,6CAA6C,EAAE;YAC9E,OAAO,EAAE;gBACP,aAAa,EAAE,UAAU,WAAW,EAAE;gBACtC,MAAM,EAAE,kBAAkB;aAC3B;SACF,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,EAAE;YAAE,OAAO,SAAS,CAAC;QACnC,MAAM,IAAI,GAAG,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAElC,CAAC;QACF,OAAO,IAAI,CAAC,kBAAkB,EAAE,WAAW,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,SAAS,CAAC;IACnB,CAAC;AACH,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,QAAyB,EACzB,GAAW;IAEX,IAAI,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,IAAI,EAAE,MAAM,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;IAChE,IAAI,QAAQ,KAAK,OAAO,EAAE,CAAC;QACzB,OAAO;YACL,IAAI,EAAE,YAAY;YAClB,IAAI,EAAE;gBACJ,YAAY;gBACZ,iBAAiB;gBACjB,UAAU;gBACV,kBAAkB,GAAG,CAAC,OAAO,CAAC,IAAI,EAAE,IAAI,CAAC,GAAG;aAC7C;SACF,CAAC;IACJ,CAAC;IACD,OAAO,EAAE,IAAI,EAAE,UAAU,EAAE,IAAI,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC;AAC3C,CAAC;AAED,SAAS,WAAW,CAAC,GAAW;IAC9B,MAAM,EAAE,IAAI,EAAE,IAAI,EAAE,GAAG,kBAAkB,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,CAAC;IACjE,IAAI,CAAC;QACH,qEAAqE;QACrE,qDAAqD;QACrD,YAAY,CAAC,IAAI,EAAE,IAAI,EAAE,EAAE,KAAK,EAAE,QAAQ,EAAE,CAAC,CAAC;IAChD,CAAC;IAAC,MAAM,CAAC;QACP,oEAAoE;IACtE,CAAC;AACH,CAAC;AAED,MAAM,UAAU,UAAU,CAAC,KAAa;IACtC,OAAO,KAAK;SACT,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC;SACtB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,MAAM,CAAC;SACrB,OAAO,CAAC,IAAI,EAAE,QAAQ,CAAC;SACvB,OAAO,CAAC,IAAI,EAAE,OAAO,CAAC,CAAC;AAC5B,CAAC;AAED,MAAM,UAAU,qBAAqB,CACnC,MAAwB,EACxB,WAAmB,EACnB,KAAa,EACb,SAAiB,MAAM;IAEvB,MAAM,MAAM,GAAG,IAAI,eAAe,CAAC;QACjC,SAAS,EAAE,MAAM,CAAC,QAAQ;QAC1B,YAAY,EAAE,WAAW;QACzB,KAAK,EAAE,MAAM;QACb,KAAK;QACL,aAAa,EAAE,MAAM;QACrB,WAAW,EAAE,SAAS;KACvB,CAAC,CAAC;IAEH,IAAI,MAAM,CAAC,cAAc,EAAE,CAAC;QAC1B,MAAM,CAAC,GAAG,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;IACxC,CAAC;IAED,OAAO,GAAG,gBAAgB,IAAI,MAAM,CAAC,QAAQ,EAAE,EAAE,CAAC;AACpD,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,MAAwB,EACxB,UAAkB,eAAe,EACjC,SAAiB,MAAM;IAEvB,MAAM,gBAAgB,GAAG,mBAAmB,CAAC,OAAO,CAAC,CAAC;IACtD,MAAM,IAAI,GAAG,IAAI,CAAC;IAClB,MAAM,YAAY,GAAG,oBAAoB,IAAI,WAAW,CAAC;IACzD,MAAM,UAAU,GAAG,WAAW,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,CAAC;IAEnD,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,IAAI,OAAO,GAAG,KAAK,CAAC;QAEpB,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE;YAC7B,IAAI,OAAO;gBAAE,OAAO;YACpB,OAAO,GAAG,IAAI,CAAC;YACf,IAAI,GAAG,EAAE,CAAC;gBACR,MAAM,CAAC,GAAG,CAAC,CAAC;gBACZ,OAAO;YACT,CAAC;YACD,OAAO,EAAE,CAAC;QACZ,CAAC,CAAC;QAEF,MAAM,MAAM,GAAG,YAAY,CAAC,KAAK,EAAE,GAAoB,EAAE,GAAmB,EAAE,EAAE;YAC9E,MAAM,GAAG,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,GAAG,IAAI,GAAG,EAAE,oBAAoB,IAAI,EAAE,CAAC,CAAC;YAEhE,IAAI,GAAG,CAAC,QAAQ,KAAK,WAAW,EAAE,CAAC;gBACjC,MAAM,IAAI,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;gBAC1C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAC5C,MAAM,KAAK,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;gBAE5C,IAAI,KAAK,EAAE,CAAC;oBACV,MAAM,SAAS,GAAG,GAAG,CAAC,YAAY,CAAC,GAAG,CAAC,mBAAmB,CAAC,IAAI,EAAE,CAAC;oBAClE,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,GAAG,CAAC,GAAG,CACL,yCAAyC,UAAU,CAAC,KAAK,CAAC,UAAU,UAAU,CAAC,SAAS,CAAC,MAAM,CAChG,CAAC;oBACF,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gBAAgB,KAAK,GAAG,SAAS,CAAC,CAAC,CAAC,MAAM,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC;oBAChF,OAAO;gBACT,CAAC;gBAED,IAAI,KAAK,KAAK,UAAU,EAAE,CAAC;oBACzB,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,GAAG,CAAC,GAAG,CAAC,kEAAkE,CAAC,CAAC;oBAC5E,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,sBAAsB,CAAC,CAAC,CAAC;oBAC1C,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC,IAAI,EAAE,CAAC;oBACV,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,GAAG,CAAC,GAAG,CAAC,2CAA2C,CAAC,CAAC;oBACrD,MAAM,CAAC,KAAK,EAAE,CAAC;oBACf,MAAM,CAAC,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC,CAAC;oBACpD,OAAO;gBACT,CAAC;gBAED,IAAI,CAAC;oBACH,MAAM,MAAM,GAAG,MAAM,qBAAqB,CAAC,IAAI,EAAE,YAAY,EAAE,MAAM,CAAC,CAAC;oBAEvE,8CAA8C;oBAC9C,OAAO,CAAC,GAAG,CAAC,uBAAuB,CAAC,CAAC;oBACrC,MAAM,QAAQ,GAAG,MAAM,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;oBAC1D,MAAM,WAAW,GAAG,MAAM,oBAAoB,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;oBAEpE,MAAM,KAAK,GAAuB;wBAChC,SAAS,EAAE,MAAM,CAAC,QAAQ;wBAC1B,aAAa,EAAE,MAAM,CAAC,YAAY;wBAClC,YAAY,EAAE,MAAM,CAAC,YAAY;wBACjC,aAAa,EAAE,MAAM,CAAC,aAAa;wBACnC,UAAU,EAAE,IAAI,CAAC,GAAG,EAAE,GAAG,MAAM,CAAC,UAAU,GAAG,IAAI;wBACjD,SAAS,EAAE,QAAQ;wBACnB,YAAY,EAAE,WAAW;wBACzB,MAAM;qBACP,CAAC;oBAEF,sEAAsE;oBACtE,mEAAmE;oBACnE,oEAAoE;oBACpE,sEAAsE;oBACtE,oEAAoE;oBACpE,yDAAyD;oBACzD,MAAM,QAAQ,GAAG,CAAC,MAAM,gBAAgB,EAAE,CAAC,CAAC,QAAQ,CAAC,IAAI,CACvD,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,EAAE,KAAK,gBAAgB,CAAC,WAAW,EAAE,CAC/D,CAAC;oBACF,MAAM,aAAa,CAAC;wBAClB,IAAI,EAAE,gBAAgB;wBACtB,SAAS,EAAE,QAAQ;wBACnB,YAAY,EAAE,WAAW;wBACzB,UAAU,EAAE,QAAQ,EAAE,UAAU,IAAI,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;wBAC5D,cAAc,EAAE,CAAC;qBAClB,CAAC,CAAC;oBACH,MAAM,eAAe,CAAC,KAAK,EAAE,gBAAgB,CAAC,CAAC;oBAE/C,MAAM,SAAS,GAAG,QAAQ;wBACxB,CAAC,CAAC,mCAAmC;wBACrC,CAAC,CAAC,oDAAoD,CAAC;oBAEzD,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,GAAG,CAAC,GAAG,CACL,gGAAgG,CACjG,CAAC;oBAEF,OAAO,CAAC,GAAG,CAAC,uCAAuC,SAAS,IAAI,CAAC,CAAC;oBAClE,OAAO,CAAC,GAAG,CAAC,+BAA+B,CAAC,CAAC;oBAC7C,OAAO,CAAC,GAAG,CAAC,4CAA4C,CAAC,CAAC;oBAC1D,MAAM,EAAE,CAAC;gBACX,CAAC;gBAAC,OAAO,GAAG,EAAE,CAAC;oBACb,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,cAAc,EAAE,0BAA0B,EAAE,CAAC,CAAC;oBACnE,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;oBACjE,GAAG,CAAC,GAAG,CAAC,6BAA6B,UAAU,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;oBAChE,MAAM,CAAC,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;gBAC1D,CAAC;wBAAS,CAAC;oBACT,MAAM,CAAC,KAAK,EAAE,CAAC;gBACjB,CAAC;YACH,CAAC;iBAAM,CAAC;gBACN,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;gBACnB,GAAG,CAAC,GAAG,CAAC,WAAW,CAAC,CAAC;YACvB,CAAC;QACH,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,aAAa,EAAE,GAAG,EAAE;YACtC,MAAM,OAAO,GAAG,qBAAqB,CAAC,MAAM,EAAE,YAAY,EAAE,UAAU,EAAE,MAAM,CAAC,CAAC;YAChF,OAAO,CAAC,GAAG,CAAC,0CAA0C,CAAC,CAAC;YACxD,WAAW,CAAC,OAAO,CAAC,CAAC;YACrB,sEAAsE;YACtE,yEAAyE;YACzE,OAAO,CAAC,GAAG,CAAC,6DAA6D,OAAO,EAAE,CAAC,CAAC;YACpF,OAAO,CAAC,GAAG,CAAC,0CAA0C,aAAa,IAAI,IAAI,KAAK,CAAC,CAAC;QACpF,CAAC,CAAC,CAAC;QAEH,MAAM,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,GAAG,EAAE,EAAE;YACzB,MAAM,CAAC,IAAI,KAAK,CAAC,oCAAoC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,CAAC;QACvE,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;AACL,CAAC"}

package/dist/cli.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAcA,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AAuIvB,wBAAgB,sBAAsB,IAAI,eAAe,CAExD"}
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../src/cli.ts"],"names":[],"mappings":";AAcA,OAAO,EAOL,KAAK,eAAe,EACrB,MAAM,eAAe,CAAC;AAwIvB,wBAAgB,sBAAsB,IAAI,eAAe,CAExD"}

package/dist/cli.js

@@ -7,6 +7,7 @@ import { readActivePointer, readActivePointerOutcome, writeActivePointer, delete
 import { setResolvedProfile } from './auth.js';
 import { applyPeriod } from './date-periods.js';
 import { DEFAULT_PROFILE, InvalidProfileNameError } from './profile-name.js';
+import { VERSION } from './version.js';
 import { invoiceListColumns, invoiceDetailColumns, invoiceConfirmColumns, customerListColumns, customerDetailColumns, voucherListColumns, voucherDetailColumns, voucherRowColumns, accountListColumns, companyDetailColumns, articleListColumns, articleDetailColumns, supplierListColumns, supplierDetailColumns, supplierInvoiceListColumns, supplierInvoiceDetailColumns, supplierInvoiceConfirmColumns, invoicePaymentListColumns, invoicePaymentDetailColumns, supplierInvoicePaymentListColumns, supplierInvoicePaymentDetailColumns, offerListColumns, offerDetailColumns, orderListColumns, orderDetailColumns, projectListColumns, projectDetailColumns, costCenterListColumns, costCenterDetailColumns, taxReductionListColumns, taxReductionDetailColumns, priceListListColumns, priceListDetailColumns, priceListColumns, priceDetailColumns, financialYearListColumns, financialYearDetailColumns, lockedPeriodDetailColumns, contractListColumns, contractDetailColumns, recurringListColumns, recurringDetailColumns, invoiceRequestListColumns, invoiceRequestDetailColumns, topCustomerColumns, monthlyRevenueColumns, voucherAttachmentColumns, employeeListColumns, employeeDetailColumns, salaryTransactionListColumns, salaryTransactionDetailColumns, attendanceTransactionListColumns, attendanceTransactionDetailColumns, absenceTransactionListColumns, absenceTransactionDetailColumns, scheduleTimeDetailColumns, } from './views.js';
 const program = new Command();
 // A closed downstream pipe (`noxctl ... | head`, or a reader that exits early)
@@ -22,7 +23,7 @@ process.stdout.on('error', (err) => {
 program
     .name('noxctl')
     .description('CLI and MCP server for Fortnox accounting')
-    .version('0.7.3')
+    .version(VERSION)
     .addOption(new Option('-o, --output <format>', 'Output format (default: table on TTY, json when piped)')
     .choices(['json', 'table'])
     .default(undefined))
@@ -105,7 +106,7 @@ program.hook('preAction', async (thisCommand, actionCommand) => {
         }
         throw err;
     }
-    setResolvedProfile(resolvedProfileInfo.name);
+    setResolvedProfile(resolvedProfileInfo.name, resolvedProfileInfo.source);
     // Banner ownership: MCP `serve` prints its own banner in bindStartupProfile
     // so host logs (Claude Desktop) always see it. Suppress here to avoid a
     // duplicate on TTY invocations like `noxctl --profile X serve`.
@@ -199,7 +200,7 @@ program
     .option('--with-salary', 'Also request the Lön (salary/payroll) scope — requires the Lön permission enabled on your Fortnox app')
     .option('--with-orders', 'Also request the offer/order scopes — requires the Order licence on the Fortnox company')
     .action(async (initOpts) => {
-    const { loadCredentials, runOAuthSetup, SCOPES, SALARY_SCOPE, ORDER_SCOPES } = await import('./auth.js');
+    const { inspectCredentials, runOAuthSetup, SCOPES, SALARY_SCOPE, ORDER_SCOPES } = await import('./auth.js');
     const { validateProfileName } = await import('./profile-name.js');
     // Opt-in scopes: flag for TTY, env var for non-interactive/CI runs. Both are
     // licence-gated in Fortnox (Lön / Order), and asking for a scope the company
@@ -222,11 +223,15 @@ program
     // (verification via getCompanyInfo, runOAuthSetup's internal saveCredentials
     // call chain) targets the profile being initialized — not a stale pointer.
     if (targetProfile.toLowerCase() !== resolvedProfileInfo.name.toLowerCase()) {
-        setResolvedProfile(targetProfile);
+        setResolvedProfile(targetProfile, 'flag');
         resolvedProfileInfo = { name: targetProfile, source: 'flag' };
     }
     // Step 1: Check if already configured
-    const existing = await loadCredentials(targetProfile);
+    const inspection = await inspectCredentials(targetProfile);
+    if (inspection.state === 'locked' || inspection.state === 'inaccessible') {
+        fail(inspection.detail);
+    }
+    const existing = inspection.credentials;
     if (existing) {
         console.log('Existing credentials found.');
         if (process.stdin.isTTY && process.stdout.isTTY) {
@@ -556,9 +561,12 @@ profile
         console.error(err instanceof Error ? err.message : String(err));
         process.exit(2);
     }
-    const { loadCredentials } = await import('./auth.js');
-    const creds = await loadCredentials(validated);
-    if (!creds) {
+    const { inspectCredentials } = await import('./auth.js');
+    const inspection = await inspectCredentials(validated);
+    if (inspection.state === 'locked' || inspection.state === 'inaccessible') {
+        fail(inspection.detail);
+    }
+    if (inspection.state === 'missing') {
         console.error(`No credentials found for profile "${validated}". Run \`noxctl init --profile ${validated}\` first.`);
         process.exit(1);
     }
@@ -606,7 +614,7 @@ program
     .command('doctor')
     .description('Check setup: credentials, token, API connectivity, and scopes')
     .action(async () => {
-    const { loadCredentials } = await import('./auth.js');
+    const { inspectCredentials } = await import('./auth.js');
     let ok = true;
     function pass(label, detail) {
         console.log(`  ✓ ${label}${detail ? ` — ${detail}` : ''}`);
@@ -641,6 +649,9 @@ program
             if (state === 'locked') {
                 fail('Dedicated keychain', 'locked — run `noxctl keychain unlock` (tap your YubiKey)');
             }
+            else if (state === 'missing') {
+                fail('Dedicated keychain', `configured but inaccessible at ${activePath} — inspect it from an unsandboxed terminal`);
+            }
             else {
                 pass('Dedicated keychain', `active, ${state} (${activePath})`);
             }
@@ -682,27 +693,21 @@ program
     catch {
         // best-effort diagnostic — don't block doctor on filesystem issues
     }
-    // 3. Credentials exist
-    let creds;
-    try {
-        creds = await loadCredentials();
-    }
-    catch (err) {
-        const { KeychainLockedError } = await import('./keychain-target.js');
-        if (err instanceof KeychainLockedError) {
-            fail('Credentials', err.message);
-            console.log(`\n${ok ? 'All checks passed.' : 'Some checks failed.'}`);
-            return;
-        }
-        throw err;
+    // 3. Credential state
+    const inspection = await inspectCredentials();
+    if (inspection.state === 'locked' || inspection.state === 'inaccessible') {
+        fail('Credentials', `${inspection.state} — ${inspection.detail}`);
+        console.log(`\n${ok ? 'All checks passed.' : 'Some checks failed.'}`);
+        return;
     }
-    if (!creds) {
-        fail('Credentials', `not found for profile "${resolvedProfileInfo.name}" — run \`noxctl init${resolvedProfileInfo.name === DEFAULT_PROFILE
+    if (inspection.state === 'missing') {
+        fail('Credentials', `missing — not found for profile "${resolvedProfileInfo.name}" — run \`noxctl init${resolvedProfileInfo.name === DEFAULT_PROFILE
             ? ''
             : ` --profile ${resolvedProfileInfo.name}`}\` to set up`);
         console.log(`\n${ok ? 'All checks passed.' : 'Some checks failed.'}`);
         return;
     }
+    const creds = inspection.credentials;
     pass('Credentials', 'found');
     if (creds.company_name) {
         pass('Company (cached)', creds.company_name);
@@ -795,6 +800,12 @@ keychain
     const onDarwin = process.platform === 'darwin';
     console.log('Keychain status\n');
     console.log(`  Platform          ${process.platform}${onDarwin ? '' : ' (dedicated keychain is macOS-only)'}`);
+    const { inspectCredentials } = await import('./auth.js');
+    const inspection = await inspectCredentials();
+    console.log(`  Credential state  ${inspection.state} — profile "${inspection.profile}" (source: ${inspection.source})`);
+    if (inspection.state === 'locked' || inspection.state === 'inaccessible') {
+        console.log(`\n  ${inspection.detail}`);
+    }
     if (!onDarwin)
         return;
     const activePath = kt.activeKeychainPath();
@@ -822,10 +833,13 @@ keychain
     .action(async () => {
     requireDarwin();
     const kt = await import('./keychain-target.js');
-    const kcPath = kt.activeKeychainPath() ?? kt.dedicatedKeychainPath();
+    const activePath = kt.activeKeychainPath();
+    const kcPath = activePath ?? kt.dedicatedKeychainPath();
     const state = kt.keychainLockState(kcPath);
     if (state === 'missing') {
-        console.error('No dedicated keychain found. Run `noxctl keychain init` first.');
+        console.error(activePath
+            ? `The configured keychain at ${kcPath} is inaccessible. Retry from an unsandboxed terminal; do not re-run noxctl keychain init.`
+            : 'No dedicated keychain found. Run `noxctl keychain init` first.');
         process.exit(1);
     }
     if (state === 'unlocked') {
@@ -868,9 +882,12 @@ keychain
     .action(async () => {
     requireDarwin();
     const kt = await import('./keychain-target.js');
-    const kcPath = kt.activeKeychainPath() ?? kt.dedicatedKeychainPath();
+    const activePath = kt.activeKeychainPath();
+    const kcPath = activePath ?? kt.dedicatedKeychainPath();
     if (kt.keychainLockState(kcPath) === 'missing') {
-        console.error('No dedicated keychain found.');
+        console.error(activePath
+            ? `The configured keychain at ${kcPath} is inaccessible. Retry from an unsandboxed terminal.`
+            : 'No dedicated keychain found.');
         process.exit(1);
     }
     kt.lockKeychain(kcPath);