offrouter-core 0.2.0 → 0.2.2

package/dist/secrets.js

@@ -0,0 +1,326 @@
+/**
+ * Secret store boundary for OffRouter V1.
+ *
+ * Secrets are stored only by OffRouter under user control:
+ * - FileSecretStore: `secrets.json` fallback (chmod 0600 on POSIX)
+ * - KeychainSecretStore: OS keychain boundary/stub for real runs
+ *
+ * Never scrapes, copies, or reverse-engineers credentials from other CLIs.
+ * No network access. No live credential discovery.
+ */
+import { readFileSync } from "node:fs";
+import { mkdir, readFile, rename, unlink, writeFile, chmod, } from "node:fs/promises";
+import { dirname } from "node:path";
+import { randomBytes } from "node:crypto";
+/** Placeholder substituted for secret material in log-safe strings. */
+/** Placeholder substituted for secret material in log-safe strings. */
+export const REDACTED = "[REDACTED]";
+const DEFAULT_KEYCHAIN_SERVICE = "offrouter";
+const DEFAULT_ACCOUNT_PREFIX = "provider:";
+/**
+ * Common API-key / token shapes seen in provider error messages.
+ * Patterns are intentionally conservative (long alphabetic payload)
+ * to avoid eating short unrelated tokens while still catching leaks.
+ */
+const API_KEY_PATTERNS = [
+    // Anthropic: sk-ant-...
+    /\bsk-ant-[a-zA-Z0-9_-]{16,}\b/g,
+    // OpenAI / OpenRouter-style: sk-... (including sk-live-, sk-proj-, etc.)
+    /\bsk-[a-zA-Z0-9_-]{16,}\b/g,
+    // Google API keys
+    /\bAIza[0-9A-Za-z_-]{20,}\b/g,
+    // Bearer tokens in Authorization headers / log lines
+    /\bBearer\s+[A-Za-z0-9._\-+=/]{16,}\b/gi,
+    // OpenAI project / service-account style
+    /\bsk-proj-[a-zA-Z0-9_-]{16,}\b/g,
+];
+function assertProviderId(providerId) {
+    if (typeof providerId !== "string" || providerId.trim() === "") {
+        throw new TypeError("providerId must be a non-empty string");
+    }
+    if (providerId !== providerId.trim()) {
+        throw new TypeError("providerId must not have leading/trailing whitespace");
+    }
+}
+function assertSecret(secret) {
+    if (typeof secret !== "string" || secret.length === 0) {
+        throw new TypeError("secret must be a non-empty string");
+    }
+}
+/**
+ * Standalone redaction for log/audit paths that do not hold a store.
+ * Optionally rejects known secret values (longest-first to avoid partials).
+ */
+export function redact(value, knownSecrets = []) {
+    if (typeof value !== "string" || value.length === 0) {
+        return value == null ? "" : String(value ?? "");
+    }
+    let out = value;
+    const known = [...knownSecrets]
+        .filter((s) => typeof s === "string" && s.length > 0)
+        .sort((a, b) => b.length - a.length);
+    for (const secret of known) {
+        if (!out.includes(secret))
+            continue;
+        // Split/join avoids RegExp special-character issues in secret material.
+        out = out.split(secret).join(REDACTED);
+    }
+    for (const pattern of API_KEY_PATTERNS) {
+        // Reset lastIndex for global regexes reused across calls.
+        pattern.lastIndex = 0;
+        out = out.replace(pattern, REDACTED);
+    }
+    return out;
+}
+/**
+ * File-backed secret store for tests and user-approved fallback.
+ * Writes `$filePath` with mode `0o600` on POSIX after every mutation.
+ */
+export class FileSecretStore {
+    filePath;
+    #fs;
+    #cache = null;
+    /** Provider ids currently known (for toJSON without leaking values). */
+    #providerIds = [];
+    constructor(options) {
+        if (!options?.filePath || typeof options.filePath !== "string") {
+            throw new TypeError("FileSecretStore requires options.filePath");
+        }
+        this.filePath = options.filePath;
+        this.#fs = {
+            mkdir,
+            readFile,
+            rename,
+            unlink,
+            writeFile,
+            chmod,
+            ...options.fileSystem,
+        };
+    }
+    async get(providerId) {
+        assertProviderId(providerId);
+        const doc = await this.#load();
+        const value = doc.secrets[providerId];
+        return value === undefined ? undefined : value;
+    }
+    async set(providerId, secret) {
+        assertProviderId(providerId);
+        assertSecret(secret);
+        const doc = await this.#load();
+        doc.secrets[providerId] = secret;
+        await this.#persist(doc);
+    }
+    async delete(providerId) {
+        assertProviderId(providerId);
+        const doc = await this.#load();
+        if (!(providerId in doc.secrets)) {
+            return;
+        }
+        delete doc.secrets[providerId];
+        await this.#persist(doc);
+    }
+    async listProviders() {
+        const doc = await this.#load();
+        return Object.keys(doc.secrets).sort((a, b) => a.localeCompare(b));
+    }
+    redact(value) {
+        const known = this.#cache
+            ? Object.values(this.#cache.secrets)
+            : this.#loadKnownSecretsSync();
+        return redact(value, known);
+    }
+    toJSON() {
+        return {
+            kind: "file",
+            filePath: this.filePath,
+            providers: [...this.#providerIds],
+            // loaded reflects whether secrets were read into memory; never the values.
+            loaded: this.#cache !== null,
+        };
+    }
+    async #load() {
+        if (this.#cache) {
+            return this.#cache;
+        }
+        try {
+            const raw = await this.#fs.readFile(this.filePath, "utf8");
+            const parsed = parseSecretDocument(raw, this.filePath);
+            this.#remember(parsed);
+            return parsed;
+        }
+        catch (err) {
+            if (err &&
+                typeof err === "object" &&
+                "code" in err &&
+                err.code === "ENOENT") {
+                const empty = { version: 1, secrets: {} };
+                this.#remember(empty);
+                return empty;
+            }
+            throw err;
+        }
+    }
+    async #persist(doc) {
+        await this.#fs.mkdir(dirname(this.filePath), { recursive: true });
+        const payload = `${JSON.stringify({ version: 1, secrets: doc.secrets }, null, 2)}\n`;
+        // Write via temp + rename so a crash mid-write cannot corrupt the store.
+        const tmp = `${this.filePath}.${randomBytes(8).toString("hex")}.tmp`;
+        try {
+            await this.#fs.writeFile(tmp, payload, { encoding: "utf8", mode: 0o600 });
+            // Re-assert 0600 on platforms that honor mode bits (no-op semantics on win).
+            await this.#fs.chmod(tmp, 0o600);
+            await this.#fs.rename(tmp, this.filePath);
+            // rename may preserve source perms, but assert again on final path for
+            // files that previously existed with looser permissions.
+            await this.#fs.chmod(this.filePath, 0o600);
+            this.#remember(doc);
+        }
+        catch (err) {
+            await this.#fs.unlink(tmp).catch((unlinkErr) => {
+                if (unlinkErr &&
+                    typeof unlinkErr === "object" &&
+                    "code" in unlinkErr &&
+                    unlinkErr.code === "ENOENT") {
+                    return;
+                }
+                throw unlinkErr;
+            });
+            throw err;
+        }
+    }
+    #remember(doc) {
+        this.#cache = doc;
+        this.#providerIds = Object.keys(doc.secrets).sort((a, b) => a.localeCompare(b));
+    }
+    #loadKnownSecretsSync() {
+        try {
+            const raw = readFileSync(this.filePath, "utf8");
+            const parsed = parseSecretDocument(raw, this.filePath);
+            this.#remember(parsed);
+            return Object.values(parsed.secrets);
+        }
+        catch {
+            // redact() must be non-throwing. Pattern-based redaction still runs.
+            return [];
+        }
+    }
+}
+/**
+ * Raised when the OS keychain/keyring backend is not available or not wired.
+ * Callers should fall back to FileSecretStore only with explicit user approval.
+ */
+export class KeychainUnavailableError extends Error {
+    code = "keychain_unavailable";
+    constructor(message, options) {
+        super(message, options);
+        this.name = "KeychainUnavailableError";
+    }
+}
+/**
+ * OS keychain boundary for real runs.
+ *
+ * V1 ships this as a typed stub: it never scrapes other CLIs and does not
+ * perform network I/O. Get/set/delete/list reject with KeychainUnavailableError
+ * until a platform backend is wired. Prefer this store at the seams of real
+ * runs once keychain support lands; tests and dry runs use FileSecretStore.
+ */
+export class KeychainSecretStore {
+    service;
+    accountPrefix;
+    constructor(options = {}) {
+        this.service = options.service?.trim() || DEFAULT_KEYCHAIN_SERVICE;
+        this.accountPrefix =
+            options.accountPrefix === undefined
+                ? DEFAULT_ACCOUNT_PREFIX
+                : options.accountPrefix;
+    }
+    async get(providerId) {
+        assertProviderId(providerId);
+        this.#reject("get");
+    }
+    async set(providerId, secret) {
+        assertProviderId(providerId);
+        assertSecret(secret);
+        this.#reject("set");
+    }
+    async delete(providerId) {
+        assertProviderId(providerId);
+        this.#reject("delete");
+    }
+    async listProviders() {
+        this.#reject("listProviders");
+    }
+    redact(value) {
+        // Stub holds no secrets in-process; still scrub common API key shapes.
+        return redact(value);
+    }
+    toJSON() {
+        return {
+            kind: "keychain",
+            service: this.service,
+            accountPrefix: this.accountPrefix,
+            available: false,
+        };
+    }
+    #reject(operation) {
+        throw new KeychainUnavailableError(`KeychainSecretStore.${operation} is unavailable: OS keychain backend is not wired in this OffRouter build. ` +
+            `OffRouter will not scrape other CLI credential stores. Use FileSecretStore for tests, or approve an ` +
+            `explicit file fallback for real runs when keychain is unavailable.`);
+    }
+}
+/**
+ * Retrieve a provider token from the secret store.
+ * Returns undefined if no token is stored or the store is unavailable.
+ */
+export async function getProviderToken(providerId, store) {
+    try {
+        const value = await store.get(providerId);
+        if (typeof value === "string" && value.length > 0) {
+            return value;
+        }
+    }
+    catch {
+        // KeychainUnavailableError or other errors: treat as missing.
+    }
+    return undefined;
+}
+/**
+ * Store a provider token in the secret store.
+ * Throws if the store is unavailable (e.g., KeychainUnavailableError).
+ */
+export async function setProviderToken(providerId, token, store) {
+    await store.set(providerId, token);
+}
+function parseSecretDocument(raw, filePath) {
+    let parsed;
+    try {
+        parsed = JSON.parse(raw);
+    }
+    catch (err) {
+        const message = err instanceof Error ? err.message : String(err);
+        throw new Error(`Invalid secrets file ${filePath}: ${message}`, {
+            cause: err,
+        });
+    }
+    if (typeof parsed !== "object" ||
+        parsed === null ||
+        Array.isArray(parsed)) {
+        throw new Error(`Invalid secrets file ${filePath}: expected a JSON object`);
+    }
+    const record = parsed;
+    const secretsRaw = record.secrets;
+    if (typeof secretsRaw !== "object" ||
+        secretsRaw === null ||
+        Array.isArray(secretsRaw)) {
+        throw new Error(`Invalid secrets file ${filePath}: missing object field "secrets"`);
+    }
+    const secrets = {};
+    for (const [key, value] of Object.entries(secretsRaw)) {
+        if (typeof value !== "string") {
+            throw new Error(`Invalid secrets file ${filePath}: secret for "${key}" must be a string`);
+        }
+        secrets[key] = value;
+    }
+    return { version: 1, secrets };
+}
+//# sourceMappingURL=secrets.js.map

package/dist/secrets.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets.js","sourceRoot":"","sources":["../src/secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AACvC,OAAO,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,MAAM,EACN,SAAS,EACT,KAAK,GACN,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,OAAO,EAAE,MAAM,WAAW,CAAC;AACpC,OAAO,EAAE,WAAW,EAAE,MAAM,aAAa,CAAC;AAE1C,uEAAuE;AACvE,uEAAuE;AACvE,MAAM,CAAC,MAAM,QAAQ,GAAG,YAAqB,CAAC;AA0D9C,MAAM,wBAAwB,GAAG,WAAW,CAAC;AAC7C,MAAM,sBAAsB,GAAG,WAAW,CAAC;AAE3C;;;;GAIG;AACH,MAAM,gBAAgB,GAAsB;IAC1C,wBAAwB;IACxB,gCAAgC;IAChC,yEAAyE;IACzE,4BAA4B;IAC5B,kBAAkB;IAClB,6BAA6B;IAC7B,qDAAqD;IACrD,wCAAwC;IACxC,yCAAyC;IACzC,iCAAiC;CAClC,CAAC;AAEF,SAAS,gBAAgB,CAAC,UAAkB;IAC1C,IAAI,OAAO,UAAU,KAAK,QAAQ,IAAI,UAAU,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC;QAC/D,MAAM,IAAI,SAAS,CAAC,uCAAuC,CAAC,CAAC;IAC/D,CAAC;IACD,IAAI,UAAU,KAAK,UAAU,CAAC,IAAI,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,SAAS,CAAC,sDAAsD,CAAC,CAAC;IAC9E,CAAC;AACH,CAAC;AAED,SAAS,YAAY,CAAC,MAAc;IAClC,IAAI,OAAO,MAAM,KAAK,QAAQ,IAAI,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACtD,MAAM,IAAI,SAAS,CAAC,mCAAmC,CAAC,CAAC;IAC3D,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,MAAM,CACpB,KAAa,EACb,eAAiC,EAAE;IAEnC,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACpD,OAAO,KAAK,IAAI,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,IAAI,EAAE,CAAC,CAAC;IAClD,CAAC;IAED,IAAI,GAAG,GAAG,KAAK,CAAC;IAEhB,MAAM,KAAK,GAAG,CAAC,GAAG,YAAY,CAAC;SAC5B,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,OAAO,CAAC,KAAK,QAAQ,IAAI,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC;SACpD,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC;IAEvC,KAAK,MAAM,MAAM,IAAI,KAAK,EAAE,CAAC;QAC3B,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,MAAM,CAAC;YAAE,SAAS;QACpC,wEAAwE;QACxE,GAAG,GAAG,GAAG,CAAC,KAAK,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC;IACzC,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,gBAAgB,EAAE,CAAC;QACvC,0DAA0D;QAC1D,OAAO,CAAC,SAAS,GAAG,CAAC,CAAC;QACtB,GAAG,GAAG,GAAG,CAAC,OAAO,CAAC,OAAO,EAAE,QAAQ,CAAC,CAAC;IACvC,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED;;;GAGG;AACH,MAAM,OAAO,eAAe;IACjB,QAAQ,CAAS;IACjB,GAAG,CAA4B;IACxC,MAAM,GAA8B,IAAI,CAAC;IACzC,wEAAwE;IACxE,YAAY,GAAa,EAAE,CAAC;IAE5B,YAAY,OAA+B;QACzC,IAAI,CAAC,OAAO,EAAE,QAAQ,IAAI,OAAO,OAAO,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;YAC/D,MAAM,IAAI,SAAS,CAAC,2CAA2C,CAAC,CAAC;QACnE,CAAC;QACD,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;QACjC,IAAI,CAAC,GAAG,GAAG;YACT,KAAK;YACL,QAAQ;YACR,MAAM;YACN,MAAM;YACN,SAAS;YACT,KAAK;YACL,GAAG,OAAO,CAAC,UAAU;SACtB,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAAkB;QAC1B,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,MAAM,KAAK,GAAG,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QACtC,OAAO,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,CAAC;IACjD,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAAkB,EAAE,MAAc;QAC1C,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,GAAG,MAAM,CAAC;QACjC,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,IAAI,CAAC,CAAC,UAAU,IAAI,GAAG,CAAC,OAAO,CAAC,EAAE,CAAC;YACjC,OAAO;QACT,CAAC;QACD,OAAO,GAAG,CAAC,OAAO,CAAC,UAAU,CAAC,CAAC;QAC/B,MAAM,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;IAC3B,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,EAAE,CAAC;QAC/B,OAAO,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,CAAC;IACrE,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,MAAM,KAAK,GAAG,IAAI,CAAC,MAAM;YACvB,CAAC,CAAC,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC;YACpC,CAAC,CAAC,IAAI,CAAC,qBAAqB,EAAE,CAAC;QACjC,OAAO,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,CAAC;IAC9B,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,MAAM;YACZ,QAAQ,EAAE,IAAI,CAAC,QAAQ;YACvB,SAAS,EAAE,CAAC,GAAG,IAAI,CAAC,YAAY,CAAC;YACjC,2EAA2E;YAC3E,MAAM,EAAE,IAAI,CAAC,MAAM,KAAK,IAAI;SAC7B,CAAC;IACJ,CAAC;IAED,KAAK,CAAC,KAAK;QACT,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,OAAO,IAAI,CAAC,MAAM,CAAC;QACrB,CAAC;QACD,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAC3D,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,MAAM,CAAC;QAChB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,IACE,GAAG;gBACH,OAAO,GAAG,KAAK,QAAQ;gBACvB,MAAM,IAAI,GAAG;gBACZ,GAAyB,CAAC,IAAI,KAAK,QAAQ,EAC5C,CAAC;gBACD,MAAM,KAAK,GAAuB,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,CAAC;gBAC9D,IAAI,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;gBACtB,OAAO,KAAK,CAAC;YACf,CAAC;YACD,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,QAAQ,CAAC,GAAuB;QACpC,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAClE,MAAM,OAAO,GAAG,GAAG,IAAI,CAAC,SAAS,CAC/B,EAAE,OAAO,EAAE,CAAU,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,EAC7C,IAAI,EACJ,CAAC,CACF,IAAI,CAAC;QAEN,yEAAyE;QACzE,MAAM,GAAG,GAAG,GAAG,IAAI,CAAC,QAAQ,IAAI,WAAW,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC,KAAK,CAAC,MAAM,CAAC;QACrE,IAAI,CAAC;YACH,MAAM,IAAI,CAAC,GAAG,CAAC,SAAS,CAAC,GAAG,EAAE,OAAO,EAAE,EAAE,QAAQ,EAAE,MAAM,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;YAC1E,6EAA6E;YAC7E,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;YACjC,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YAC1C,uEAAuE;YACvE,yDAAyD;YACzD,MAAM,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,QAAQ,EAAE,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,CAAC;QACtB,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,MAAM,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,SAAkB,EAAE,EAAE;gBACtD,IACE,SAAS;oBACT,OAAO,SAAS,KAAK,QAAQ;oBAC7B,MAAM,IAAI,SAAS;oBAClB,SAA+B,CAAC,IAAI,KAAK,QAAQ,EAClD,CAAC;oBACD,OAAO;gBACT,CAAC;gBACD,MAAM,SAAS,CAAC;YAClB,CAAC,CAAC,CAAC;YACH,MAAM,GAAG,CAAC;QACZ,CAAC;IACH,CAAC;IAED,SAAS,CAAC,GAAuB;QAC/B,IAAI,CAAC,MAAM,GAAG,GAAG,CAAC;QAClB,IAAI,CAAC,YAAY,GAAG,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CACzD,CAAC,CAAC,aAAa,CAAC,CAAC,CAAC,CACnB,CAAC;IACJ,CAAC;IAED,qBAAqB;QACnB,IAAI,CAAC;YACH,MAAM,GAAG,GAAG,YAAY,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;YAChD,MAAM,MAAM,GAAG,mBAAmB,CAAC,GAAG,EAAE,IAAI,CAAC,QAAQ,CAAC,CAAC;YACvD,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;YACvB,OAAO,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACP,qEAAqE;YACrE,OAAO,EAAE,CAAC;QACZ,CAAC;IACH,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,OAAO,wBAAyB,SAAQ,KAAK;IACxC,IAAI,GAAG,sBAA+B,CAAC;IAEhD,YAAY,OAAe,EAAE,OAA6B;QACxD,KAAK,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC;QACxB,IAAI,CAAC,IAAI,GAAG,0BAA0B,CAAC;IACzC,CAAC;CACF;AAED;;;;;;;GAOG;AACH,MAAM,OAAO,mBAAmB;IACrB,OAAO,CAAS;IAChB,aAAa,CAAS;IAE/B,YAAY,UAAsC,EAAE;QAClD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,EAAE,IAAI,EAAE,IAAI,wBAAwB,CAAC;QACnE,IAAI,CAAC,aAAa;YAChB,OAAO,CAAC,aAAa,KAAK,SAAS;gBACjC,CAAC,CAAC,sBAAsB;gBACxB,CAAC,CAAC,OAAO,CAAC,aAAa,CAAC;IAC9B,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAAkB;QAC1B,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,UAAkB,EAAE,MAAc;QAC1C,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,YAAY,CAAC,MAAM,CAAC,CAAC;QACrB,IAAI,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtB,CAAC;IAED,KAAK,CAAC,MAAM,CAAC,UAAkB;QAC7B,gBAAgB,CAAC,UAAU,CAAC,CAAC;QAC7B,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACzB,CAAC;IAED,KAAK,CAAC,aAAa;QACjB,IAAI,CAAC,OAAO,CAAC,eAAe,CAAC,CAAC;IAChC,CAAC;IAED,MAAM,CAAC,KAAa;QAClB,uEAAuE;QACvE,OAAO,MAAM,CAAC,KAAK,CAAC,CAAC;IACvB,CAAC;IAED,MAAM;QACJ,OAAO;YACL,IAAI,EAAE,UAAU;YAChB,OAAO,EAAE,IAAI,CAAC,OAAO;YACrB,aAAa,EAAE,IAAI,CAAC,aAAa;YACjC,SAAS,EAAE,KAAK;SACjB,CAAC;IACJ,CAAC;IAED,OAAO,CAAC,SAAiB;QACvB,MAAM,IAAI,wBAAwB,CAChC,uBAAuB,SAAS,6EAA6E;YAC3G,sGAAsG;YACtG,oEAAoE,CACvE,CAAC;IACJ,CAAC;CACF;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,KAAkB;IAElB,IAAI,CAAC;QACH,MAAM,KAAK,GAAG,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,CAAC,CAAC;QAC1C,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAClD,OAAO,KAAK,CAAC;QACf,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,8DAA8D;IAChE,CAAC;IACD,OAAO,SAAS,CAAC;AACnB,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,gBAAgB,CACpC,UAAkB,EAClB,KAAa,EACb,KAAkB;IAElB,MAAM,KAAK,CAAC,GAAG,CAAC,UAAU,EAAE,KAAK,CAAC,CAAC;AACrC,CAAC;AAED,SAAS,mBAAmB,CAC1B,GAAW,EACX,QAAgB;IAEhB,IAAI,MAAe,CAAC;IACpB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAY,CAAC;IACtC,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,MAAM,IAAI,KAAK,CAAC,wBAAwB,QAAQ,KAAK,OAAO,EAAE,EAAE;YAC9D,KAAK,EAAE,GAAG;SACX,CAAC,CAAC;IACL,CAAC;IAED,IACE,OAAO,MAAM,KAAK,QAAQ;QAC1B,MAAM,KAAK,IAAI;QACf,KAAK,CAAC,OAAO,CAAC,MAAM,CAAC,EACrB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wBAAwB,QAAQ,0BAA0B,CAC3D,CAAC;IACJ,CAAC;IAED,MAAM,MAAM,GAAG,MAAiC,CAAC;IACjD,MAAM,UAAU,GAAG,MAAM,CAAC,OAAO,CAAC;IAClC,IACE,OAAO,UAAU,KAAK,QAAQ;QAC9B,UAAU,KAAK,IAAI;QACnB,KAAK,CAAC,OAAO,CAAC,UAAU,CAAC,EACzB,CAAC;QACD,MAAM,IAAI,KAAK,CACb,wBAAwB,QAAQ,kCAAkC,CACnE,CAAC;IACJ,CAAC;IAED,MAAM,OAAO,GAA2B,EAAE,CAAC;IAC3C,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CACvC,UAAqC,CACtC,EAAE,CAAC;QACF,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CACb,wBAAwB,QAAQ,iBAAiB,GAAG,oBAAoB,CACzE,CAAC;QACJ,CAAC;QACD,OAAO,CAAC,GAAG,CAAC,GAAG,KAAK,CAAC;IACvB,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE,OAAO,EAAE,CAAC;AACjC,CAAC"}

package/dist/types.d.ts

@@ -0,0 +1,117 @@
+/**
+ * OffRouter V1 routing types.
+ * Aligned with docs/contracts/v1-routing-contract.md
+ */
+export type AuthTier = "subscription" | "local" | "api-key";
+export type AuthScope = "first-party" | "third-party" | "unknown";
+export type SubscriptionStatus = "active" | "near-limit" | "exhausted" | "rate-limited" | "expired" | "unconfigured" | "unknown";
+export type ProviderHealth = "healthy" | "degraded" | "dead";
+export type FallbackReason = "primary" | "subscription_exhausted" | "subscription_degraded" | "subscription_unconfigured" | "subscription_scope_denied" | "local_preferred" | "api_key_fallback" | "policy_denied" | "provider_error";
+export type HarnessKind = "claude" | "codex" | "gemini" | "grok" | "cursor" | "pi" | "other";
+export type TaskKind = "explain" | "code" | "review" | "plan" | "research" | "image" | "tools" | "other";
+export type RiskLevel = "low" | "medium" | "high";
+export type PolicyDenialCode = "profile_not_allowlisted" | "work_profile_denied" | "provider_denied" | "project_untrusted" | "privacy_label_denied" | "local_only_required" | "cost_cap_exceeded" | "api_key_blocked_by_subscription_first_policy" | "subscription_scope_denied" | "capability_missing";
+export type PolicyDenialTarget = "profile" | "provider" | "model" | "workspace" | "candidate";
+export interface PolicyDenial {
+    code: PolicyDenialCode;
+    target: PolicyDenialTarget;
+    id: string;
+    message: string;
+}
+export interface ProviderCandidate {
+    providerId: string;
+    modelId: string;
+    displayName?: string;
+    authTier: AuthTier;
+    authScope: AuthScope;
+    subscriptionStatus?: SubscriptionStatus;
+    health: ProviderHealth;
+    accountId?: string;
+    subscriptionQuotaPercentRemaining?: number;
+    supportsTools: boolean;
+    supportsStreaming: boolean;
+    supportsJson: boolean;
+    supportsImages: boolean;
+    contextWindowTokens?: number;
+    maxOutputTokens?: number;
+    estimatedCostUsd?: number;
+}
+export interface HarnessRef {
+    kind: HarnessKind;
+    profile: string;
+}
+/**
+ * Route request carries prompt preview + digest only.
+ * Full prompt text belongs in delegation requests after policy allows a provider.
+ */
+export interface RouteTask {
+    promptPreview: string;
+    promptDigest: string;
+    kind: TaskKind;
+    risk: RiskLevel;
+    requiresTools?: boolean;
+    requiresImages?: boolean;
+    requiresStreaming?: boolean;
+    requiresJson?: boolean;
+}
+export interface WorkspaceRef {
+    cwd: string;
+    trusted: boolean;
+    privacyLabel?: string;
+}
+export interface RouteConstraints {
+    maxCostUsd?: number;
+    localOnly?: boolean;
+    allowApiKeyFallback?: boolean;
+    subscriptionFirst?: boolean;
+}
+export interface RouteRequest {
+    protocolVersion: "offrouter.route.v1";
+    requestId: string;
+    harness: HarnessRef;
+    task: RouteTask;
+    workspace: WorkspaceRef;
+    constraints: RouteConstraints;
+}
+export interface SelectedRoute {
+    provider: string;
+    model: string;
+    authTier: AuthTier;
+    authScope?: AuthScope;
+    accountId?: string;
+}
+export interface FallbackChainEntry {
+    provider: string;
+    model: string;
+    authTier: AuthTier;
+    reason: FallbackReason;
+}
+export interface RouteDecision {
+    protocolVersion: "offrouter.route.v1";
+    decisionId: string;
+    requestId: string;
+    /** Selected route when routing succeeds; omitted/null when blocked. */
+    route?: SelectedRoute | null;
+    /** Short machine-oriented reason code for the decision. */
+    reason: string;
+    /** Human-readable explanation of why this route (or block) was chosen. */
+    explanation: string;
+    fallbackChain?: FallbackChainEntry[];
+    policyDenials?: PolicyDenial[];
+    confidence?: number;
+    /** Audit-safe summary; must not contain raw prompt text. */
+    auditSummary?: string;
+    blocked?: boolean;
+    needsConfiguration?: boolean;
+    /** Warning when the selected route is a near-limit subscription with no healthy alternative. */
+    nearLimitWarning?: string;
+}
+/**
+ * Outcome of evaluatePolicy: filtered candidates plus structured denials.
+ * Policy engine is implemented in a later task; this type is the contract edge.
+ */
+export interface PolicyDecision {
+    allowed: ProviderCandidate[];
+    denials: PolicyDenial[];
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,MAAM,QAAQ,GAAG,cAAc,GAAG,OAAO,GAAG,SAAS,CAAC;AAE5D,MAAM,MAAM,SAAS,GAAG,aAAa,GAAG,aAAa,GAAG,SAAS,CAAC;AAElE,MAAM,MAAM,kBAAkB,GAC1B,QAAQ,GACR,YAAY,GACZ,WAAW,GACX,cAAc,GACd,SAAS,GACT,cAAc,GACd,SAAS,CAAC;AAEd,MAAM,MAAM,cAAc,GAAG,SAAS,GAAG,UAAU,GAAG,MAAM,CAAC;AAE7D,MAAM,MAAM,cAAc,GACtB,SAAS,GACT,wBAAwB,GACxB,uBAAuB,GACvB,2BAA2B,GAC3B,2BAA2B,GAC3B,iBAAiB,GACjB,kBAAkB,GAClB,eAAe,GACf,gBAAgB,CAAC;AAErB,MAAM,MAAM,WAAW,GACrB,QAAQ,GAAG,OAAO,GAAG,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,IAAI,GAAG,OAAO,CAAC;AAErE,MAAM,MAAM,QAAQ,GAChB,SAAS,GACT,MAAM,GACN,QAAQ,GACR,MAAM,GACN,UAAU,GACV,OAAO,GACP,OAAO,GACP,OAAO,CAAC;AAEZ,MAAM,MAAM,SAAS,GAAG,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;AAElD,MAAM,MAAM,gBAAgB,GACxB,yBAAyB,GACzB,qBAAqB,GACrB,iBAAiB,GACjB,mBAAmB,GACnB,sBAAsB,GACtB,qBAAqB,GACrB,mBAAmB,GACnB,8CAA8C,GAC9C,2BAA2B,GAC3B,oBAAoB,CAAC;AAEzB,MAAM,MAAM,kBAAkB,GAC5B,SAAS,GAAG,UAAU,GAAG,OAAO,GAAG,WAAW,GAAG,WAAW,CAAC;AAE/D,MAAM,WAAW,YAAY;IAC3B,IAAI,EAAE,gBAAgB,CAAC;IACvB,MAAM,EAAE,kBAAkB,CAAC;IAC3B,EAAE,EAAE,MAAM,CAAC;IACX,OAAO,EAAE,MAAM,CAAC;CACjB;AAED,MAAM,WAAW,iBAAiB;IAChC,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,EAAE,SAAS,CAAC;IACrB,kBAAkB,CAAC,EAAE,kBAAkB,CAAC;IACxC,MAAM,EAAE,cAAc,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,iCAAiC,CAAC,EAAE,MAAM,CAAC;IAC3C,aAAa,EAAE,OAAO,CAAC;IACvB,iBAAiB,EAAE,OAAO,CAAC;IAC3B,YAAY,EAAE,OAAO,CAAC;IACtB,cAAc,EAAE,OAAO,CAAC;IACxB,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED,MAAM,WAAW,UAAU;IACzB,IAAI,EAAE,WAAW,CAAC;IAClB,OAAO,EAAE,MAAM,CAAC;CACjB;AAED;;;GAGG;AACH,MAAM,WAAW,SAAS;IACxB,aAAa,EAAE,MAAM,CAAC;IACtB,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,EAAE,QAAQ,CAAC;IACf,IAAI,EAAE,SAAS,CAAC;IAChB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,cAAc,CAAC,EAAE,OAAO,CAAC;IACzB,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,MAAM,WAAW,YAAY;IAC3B,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,gBAAgB;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,mBAAmB,CAAC,EAAE,OAAO,CAAC;IAC9B,iBAAiB,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,eAAe,EAAE,oBAAoB,CAAC;IACtC,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,UAAU,CAAC;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,SAAS,EAAE,YAAY,CAAC;IACxB,WAAW,EAAE,gBAAgB,CAAC;CAC/B;AAED,MAAM,WAAW,aAAa;IAC5B,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,SAAS,CAAC,EAAE,SAAS,CAAC;IACtB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAED,MAAM,WAAW,kBAAkB;IACjC,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,QAAQ,EAAE,QAAQ,CAAC;IACnB,MAAM,EAAE,cAAc,CAAC;CACxB;AAED,MAAM,WAAW,aAAa;IAC5B,eAAe,EAAE,oBAAoB,CAAC;IACtC,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,uEAAuE;IACvE,KAAK,CAAC,EAAE,aAAa,GAAG,IAAI,CAAC;IAC7B,2DAA2D;IAC3D,MAAM,EAAE,MAAM,CAAC;IACf,0EAA0E;IAC1E,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,kBAAkB,EAAE,CAAC;IACrC,aAAa,CAAC,EAAE,YAAY,EAAE,CAAC;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,4DAA4D;IAC5D,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE,OAAO,CAAC;IAClB,kBAAkB,CAAC,EAAE,OAAO,CAAC;IAC7B,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;;GAGG;AACH,MAAM,WAAW,cAAc;IAC7B,OAAO,EAAE,iBAAiB,EAAE,CAAC;IAC7B,OAAO,EAAE,YAAY,EAAE,CAAC;CACzB"}

package/dist/types.js

@@ -0,0 +1,6 @@
+/**
+ * OffRouter V1 routing types.
+ * Aligned with docs/contracts/v1-routing-contract.md
+ */
+export {};
+//# sourceMappingURL=types.js.map

package/dist/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../src/types.ts"],"names":[],"mappings":"AAAA;;;GAGG"}

package/dist/usage-file.d.ts

@@ -0,0 +1,59 @@
+import { chmod, mkdir, readFile, rename, unlink, writeFile } from "node:fs/promises";
+import { type AccountUsageSnapshot, type PaidFallbackExplanation, type ProviderUsageSnapshot, type RecordUsageResult, type UsageEvent, type UsageStore } from "./usage.js";
+export { DEFAULT_NEAR_LIMIT_THRESHOLD } from "./usage.js";
+export { InMemoryUsageStore } from "./usage.js";
+export type { UsageStore } from "./usage.js";
+export interface FileUsageStoreFileSystem {
+    mkdir: typeof mkdir;
+    readFile: typeof readFile;
+    rename: typeof rename;
+    unlink: typeof unlink;
+    writeFile: typeof writeFile;
+    chmod: typeof chmod;
+}
+export interface FileUsageStoreOptions {
+    /** Absolute path to usage.json (typically `$OFFROUTER_HOME/state/usage.json`). */
+    filePath: string;
+    /** Injectable file operations for failure-path tests. Defaults to node fs. */
+    fileSystem?: Partial<FileUsageStoreFileSystem>;
+    /** Injectable clock for tests. */
+    now?: () => Date;
+    /**
+     * In-memory store that owns provider health/quota logic. Account usage is
+     * persisted separately and mirrored onto this delegate. Useful for tests.
+     */
+    delegate?: UsageStore;
+}
+/**
+ * File-backed UsageStore. Persists per-account quota usage atomically and
+ * delegates provider health/quota logic to an in-memory engine.
+ */
+export declare class FileUsageStore implements UsageStore {
+    #private;
+    readonly filePath: string;
+    constructor(options: FileUsageStoreOptions);
+    record(event: UsageEvent): Promise<RecordUsageResult>;
+    getProvider(providerId: string): Promise<ProviderUsageSnapshot | undefined>;
+    listProviders(): Promise<ProviderUsageSnapshot[]>;
+    setSubscriptionQuota(providerId: string, input: {
+        limit?: number;
+        used?: number;
+        status?: import("./types.js").SubscriptionStatus;
+        modelId?: string;
+        at?: Date;
+    }): Promise<ProviderUsageSnapshot>;
+    explainPaidFallback(providerId: string, options?: {
+        hasApiKeyCandidate?: boolean;
+    }): Promise<PaidFallbackExplanation>;
+    recordUsage(providerId: string, accountId: string, input: {
+        used?: number;
+        limit?: number;
+        at?: Date;
+    }): Promise<AccountUsageSnapshot>;
+    isNearLimit(providerId: string, accountId: string, threshold?: number): Promise<boolean>;
+    getNearLimitAccounts(threshold?: number): Promise<AccountUsageSnapshot[]>;
+    getAccountUsage(providerId: string, accountId: string): Promise<AccountUsageSnapshot | undefined>;
+    listAccountUsage(): Promise<AccountUsageSnapshot[]>;
+    toJSON(): Record<string, unknown>;
+}
+//# sourceMappingURL=usage-file.d.ts.map

package/dist/usage-file.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"usage-file.d.ts","sourceRoot":"","sources":["../src/usage-file.ts"],"names":[],"mappings":"AAoBA,OAAO,EACL,KAAK,EACL,KAAK,EACL,QAAQ,EACR,MAAM,EACN,MAAM,EACN,SAAS,EACV,MAAM,kBAAkB,CAAC;AAG1B,OAAO,EAIL,KAAK,oBAAoB,EACzB,KAAK,uBAAuB,EAC5B,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,UAAU,EACf,KAAK,UAAU,EAChB,MAAM,YAAY,CAAC;AAGpB,OAAO,EAAE,4BAA4B,EAAE,MAAM,YAAY,CAAC;AAC1D,OAAO,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAChD,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAE7C,MAAM,WAAW,wBAAwB;IACvC,KAAK,EAAE,OAAO,KAAK,CAAC;IACpB,QAAQ,EAAE,OAAO,QAAQ,CAAC;IAC1B,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,MAAM,EAAE,OAAO,MAAM,CAAC;IACtB,SAAS,EAAE,OAAO,SAAS,CAAC;IAC5B,KAAK,EAAE,OAAO,KAAK,CAAC;CACrB;AAED,MAAM,WAAW,qBAAqB;IACpC,kFAAkF;IAClF,QAAQ,EAAE,MAAM,CAAC;IACjB,8EAA8E;IAC9E,UAAU,CAAC,EAAE,OAAO,CAAC,wBAAwB,CAAC,CAAC;IAC/C,kCAAkC;IAClC,GAAG,CAAC,EAAE,MAAM,IAAI,CAAC;IACjB;;;OAGG;IACH,QAAQ,CAAC,EAAE,UAAU,CAAC;CACvB;AAoFD;;;GAGG;AACH,qBAAa,cAAe,YAAW,UAAU;;IAC/C,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;gBASd,OAAO,EAAE,qBAAqB;IA6I1C,MAAM,CAAC,KAAK,EAAE,UAAU,GAAG,OAAO,CAAC,iBAAiB,CAAC;IAIrD,WAAW,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,qBAAqB,GAAG,SAAS,CAAC;IAI3E,aAAa,IAAI,OAAO,CAAC,qBAAqB,EAAE,CAAC;IAIjD,oBAAoB,CAClB,UAAU,EAAE,MAAM,EAClB,KAAK,EAAE;QACL,KAAK,CAAC,EAAE,MAAM,CAAC;QACf,IAAI,CAAC,EAAE,MAAM,CAAC;QACd,MAAM,CAAC,EAAE,OAAO,YAAY,EAAE,kBAAkB,CAAC;QACjD,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,EAAE,CAAC,EAAE,IAAI,CAAC;KACX,GACA,OAAO,CAAC,qBAAqB,CAAC;IAIjC,mBAAmB,CACjB,UAAU,EAAE,MAAM,EAClB,OAAO,CAAC,EAAE;QAAE,kBAAkB,CAAC,EAAE,OAAO,CAAA;KAAE,GACzC,OAAO,CAAC,uBAAuB,CAAC;IAM7B,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,KAAK,EAAE;QAAE,IAAI,CAAC,EAAE,MAAM,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAC;QAAC,EAAE,CAAC,EAAE,IAAI,CAAA;KAAE,GAClD,OAAO,CAAC,oBAAoB,CAAC;IAuB1B,WAAW,CACf,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,EACjB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,OAAO,CAAC;IASb,oBAAoB,CACxB,SAAS,CAAC,EAAE,MAAM,GACjB,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAgB5B,eAAe,CACnB,UAAU,EAAE,MAAM,EAClB,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAStC,gBAAgB,IAAI,OAAO,CAAC,oBAAoB,EAAE,CAAC;IAezD,MAAM,IAAI,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;CAQlC"}