openmeld 0.3.104 → 0.3.105

package/dist/{auth-session-DEVzh7Bz.js.map → auth-session-p_bMqNdz.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-session-DEVzh7Bz.js","names":["toErrorMessage","isFileNotFoundError","exhaustiveState"],"sources":["../../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js","../src/strategy-constants.ts","../src/runtime/distribution.ts","../src/config/macos-native-keychain.ts","../src/config/token-store.ts","../src/config/auth-session.ts"],"sourcesContent":["import { z } from \"zod/v4\";\n//#region src/schemas/local-machine/macos-keychain-helper.ts\nconst MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION = 2;\nconst MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = \"disallow\";\nconst macOsKeychainServiceSchema = z.string().trim().min(1).max(512);\nconst macOsKeychainAccountSchema = z.string().trim().min(1).max(512);\nconst macOsKeychainAccessTokenSchema = z.string().min(1).max(65536);\nconst macOsKeychainHelperOperationSchema = z.enum([\n\t\"store\",\n\t\"read\",\n\t\"delete\"\n]);\nconst macOsKeychainHelperRequestSchema = z.discriminatedUnion(\"operation\", [\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"store\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\taccessToken: macOsKeychainAccessTokenSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"read\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"delete\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t})\n]);\nconst macOsKeychainHelperMutationSuccessSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(true),\n\toperation: z.enum([\"store\", \"delete\"])\n});\nconst macOsKeychainHelperReadSuccessSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(true),\n\toperation: z.literal(\"read\"),\n\taccessToken: z.union([macOsKeychainAccessTokenSchema, z.null()])\n});\nconst macOsKeychainHelperErrorSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(false),\n\toperation: macOsKeychainHelperOperationSchema,\n\terrorMessage: z.string().trim().min(1).max(2048)\n});\nconst macOsKeychainHelperResponseSchema = z.union([\n\tmacOsKeychainHelperMutationSuccessSchema,\n\tmacOsKeychainHelperReadSuccessSchema,\n\tmacOsKeychainHelperErrorSchema\n]);\n//#endregion\nexport { MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION, MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION, macOsKeychainHelperOperationSchema, macOsKeychainHelperRequestSchema, macOsKeychainHelperResponseSchema };\n\n//# sourceMappingURL=macos-keychain-helper.js.map","import { CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from \"@openmeld/schemas\";\n\n// CLI and local daemon timing policy values. Keep this deployment-local; Core\n// and Web have their own constants files even when values intentionally match.\nexport const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 30_000;\nexport const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8000;\nexport const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;\nexport const DEFAULT_WEB_AGENT_SELECTION_TIMEOUT_MS = 30 * 60 * 1000;\nexport const DEFAULT_WEB_AGENT_SELECTION_POLL_INTERVAL_MS = 2000;\nexport const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS = 60_000;\nexport const MIN_SPACE_REQUEST_TIMEOUT_MS = 1000;\nexport const MAX_SPACE_REQUEST_TIMEOUT_MS = 120_000;\nexport const DEFAULT_HEARTBEAT_INTERVAL_MS = 25_000;\nexport const MIN_HEARTBEAT_INTERVAL_MS = 5000;\nexport const MAX_HEARTBEAT_INTERVAL_MS = 60_000;\n// Daemon stream keepalive PING cadence. Sub-idle (below the gateway/Cloudflare\n// idle-eviction window) and independent of the heartbeat, so a quiet daemon\n// socket stays warm even when no heartbeat is due. Carries no lease/readiness.\nexport const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 20_000;\n// Each keepalive PING must see the hub's auto-answered PONG within this\n// window, or the socket is treated as half-open and terminated so the normal\n// reconnect path (which also redelivers in-flight dispatch pushes) can run.\n// Without this deadline a half-open socket is only detected by the heartbeat\n// failure path, which can take ~40s+ at the idle-grown heartbeat interval.\nexport const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 10_000;\nexport const CATALOG_SYNC_INTERVAL_MULTIPLIER = 3;\nexport const MIN_CATALOG_SYNC_INTERVAL_MS = 15_000;\nexport const MAX_CATALOG_SYNC_INTERVAL_MS = 45_000;\nexport const CATALOG_SYNC_RETRY_INTERVAL_MS = 5000;\nexport const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1000;\nexport const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 60_000;\nexport const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15_000;\nexport const REGISTER_RESPONSE_TIMEOUT_MS = 10_000;\nexport const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15_000;\nexport const DAEMON_RUNTIME_CONTRACT_EPOCH =\n  CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;\nexport const OPENCLAW_CLI_TIMEOUT_MS = 30_000;\n","/**\n * Build-time distribution marker.\n *\n * `OpenMeldDistribution` records how this CLI build is shipped and run. It is\n * orthogonal to the runtime lane / env preset (prod | dev-local | canary):\n *\n * - `npm`: shipped as the `openmeld` npm package, run via `node dist/*.js`; the\n *   OpenMeld Service daemon runs as a self-contained node bundle (dist copy +\n *   node_modules dependency closure).\n * - `binary`: shipped as a precompiled single binary (`bun build --compile`),\n *   run and self-installed as one executable; the daemon runs the same binary\n *   via its `service run` subcommand.\n *\n * The value is injected at build time (tsdown defines `\"npm\"`;\n * `scripts/release/build-cli-binary.mjs` defines `\"binary\"` via Bun `--define`)\n * so distribution-mode branching never guesses from paths and cannot be spoofed\n * by a runtime environment variable.\n */\ndeclare const __OPENMELD_DISTRIBUTION__: string | undefined;\n\nexport type OpenMeldDistribution = \"binary\" | \"npm\";\n\nconst BINARY_DISTRIBUTION: OpenMeldDistribution = \"binary\";\nconst NPM_DISTRIBUTION: OpenMeldDistribution = \"npm\";\n\n/**\n * The distribution form this CLI build was compiled for. Falls back to `npm`\n * when the marker is absent (e.g. under Vitest, where no build-time define\n * runs), which keeps the safe, path-independent default.\n */\nexport function resolveOpenMeldDistribution(): OpenMeldDistribution {\n  const injected =\n    typeof __OPENMELD_DISTRIBUTION__ === \"string\"\n      ? __OPENMELD_DISTRIBUTION__\n      : undefined;\n  return injected === BINARY_DISTRIBUTION\n    ? BINARY_DISTRIBUTION\n    : NPM_DISTRIBUTION;\n}\n\nexport function isBinaryDistribution(): boolean {\n  return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;\n}\n","import { spawn } from \"node:child_process\";\nimport { createRequire } from \"node:module\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n  MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n  type MacOsKeychainHelperRequest,\n  macOsKeychainHelperRequestSchema,\n  macOsKeychainHelperResponseSchema,\n} from \"@openmeld/schemas\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\n\nconst MAC_OS_KEYCHAIN_HELPER_ARG = \"__openmeld_macos_keychain_helper\";\nconst HELPER_OUTPUT_MAX_BYTES = 128 * 1024;\nexport const MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS = 5000;\n\ntype MacOsKeychainAddon = {\n  isParentSameExecutable(): boolean;\n  read(service: string, account: string): string | null;\n  remove(service: string, account: string): void;\n  store(service: string, account: string, accessToken: string): void;\n};\n\ntype KeychainAddress = {\n  account: string;\n  service: string;\n};\n\ntype MacOsKeychainHelperRequestInput =\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"read\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"store\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"delete\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >;\ntype MacOsKeychainHelperReadRequestInput = Extract<\n  MacOsKeychainHelperRequestInput,\n  { operation: \"read\" }\n>;\ntype MacOsKeychainHelperMutationRequestInput = Exclude<\n  MacOsKeychainHelperRequestInput,\n  MacOsKeychainHelperReadRequestInput\n>;\n\nlet loadedAddon: MacOsKeychainAddon | null = null;\nlet unresponsiveKeychainError: Error | null = null;\n\nexport async function storeMacOsNativeKeychainToken(\n  input: KeychainAddress & { accessToken: string }\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"store\",\n      service: input.service,\n      account: input.account,\n      accessToken: input.accessToken,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.store(input.service, input.account, input.accessToken);\n}\n\nexport async function readMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<string | null> {\n  if (isBinaryDistribution()) {\n    return await runBoundedMacOsNativeKeychainRequest({\n      operation: \"read\",\n      service: input.service,\n      account: input.account,\n    });\n  }\n  const addon = await loadAddon();\n  return addon.read(input.service, input.account);\n}\n\nexport async function deleteMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"delete\",\n      service: input.service,\n      account: input.account,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.remove(input.service, input.account);\n}\n\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperReadRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<string | null>;\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperMutationRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<undefined>;\nexport async function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperRequestInput,\n  options: { timeoutMs?: number } = {}\n): Promise<string | null | undefined> {\n  const request = macOsKeychainHelperRequestSchema.parse({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n    ...input,\n  });\n  const timeoutMs = options.timeoutMs ?? MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS;\n  if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) {\n    throw new Error(\"macOS Keychain helper timeout must be a positive integer\");\n  }\n\n  return await new Promise<string | null | undefined>((resolve, reject) => {\n    const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {\n      env: process.env,\n      shell: false,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      windowsHide: true,\n    });\n    let settled = false;\n    let stdout = \"\";\n    let stderr = \"\";\n\n    const clearDeadline = () => {\n      clearTimeout(deadline);\n    };\n    const rejectOnce = (error: Error) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearDeadline();\n      reject(error);\n    };\n    const deadline = setTimeout(() => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      child.kill(\"SIGKILL\");\n      reject(\n        new MacOsNativeKeychainTimeoutError(\n          `macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`\n        )\n      );\n    }, timeoutMs);\n\n    child.stdout.setEncoding(\"utf8\");\n    child.stderr.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: unknown) => {\n      stdout += String(chunk);\n      if (Buffer.byteLength(stdout, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        child.kill(\"SIGKILL\");\n        rejectOnce(new Error(\"macOS Keychain helper output was too large\"));\n      }\n    });\n    child.stderr.on(\"data\", (chunk: unknown) => {\n      stderr += String(chunk);\n      if (Buffer.byteLength(stderr, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        stderr = stderr.slice(-HELPER_OUTPUT_MAX_BYTES);\n      }\n    });\n    child.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper could not start: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.stdin.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper input failed: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.once(\"close\", (code) => {\n      if (settled) {\n        return;\n      }\n      clearDeadline();\n      settled = true;\n      try {\n        resolve(\n          parseMacOsKeychainHelperResult({\n            code,\n            operation: request.operation,\n            stderr,\n            stdout,\n          })\n        );\n      } catch (error) {\n        reject(toError(error));\n      }\n    });\n\n    child.stdin.end(JSON.stringify(request), \"utf8\");\n  });\n}\n\nexport async function runMacOsNativeKeychainHelperIfRequested(\n  argv: readonly string[] = process.argv\n): Promise<boolean> {\n  if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) {\n    return false;\n  }\n  if (!(isBinaryDistribution() && process.platform === \"darwin\")) {\n    throw new Error(\n      \"the internal macOS Keychain helper is only available in the macOS binary\"\n    );\n  }\n\n  const addon = await loadAddon();\n  if (!addon.isParentSameExecutable()) {\n    throw new Error(\n      \"the internal macOS Keychain helper is reserved for an OpenMeld child process\"\n    );\n  }\n\n  const rawRequest = await readHelperStdin();\n  let json: unknown;\n  try {\n    json = JSON.parse(rawRequest);\n  } catch {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n  const request = macOsKeychainHelperRequestSchema.safeParse(json);\n  if (!request.success) {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n\n  const response = await executeHelperRequest(request.data).catch((error) => ({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: false as const,\n    operation: request.data.operation,\n    errorMessage: truncateErrorMessage(toErrorMessage(error)),\n  }));\n  process.stdout.write(JSON.stringify(response));\n  return true;\n}\n\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperReadRequestInput\n): Promise<string | null>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperMutationRequestInput\n): Promise<undefined>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperRequestInput\n): Promise<string | null | undefined> {\n  if (unresponsiveKeychainError) {\n    throw unresponsiveKeychainError;\n  }\n  try {\n    if (input.operation === \"read\") {\n      return await runMacOsNativeKeychainRequestInChild(input);\n    }\n    await runMacOsNativeKeychainRequestInChild(input);\n  } catch (error) {\n    if (error instanceof MacOsNativeKeychainTimeoutError) {\n      unresponsiveKeychainError = error;\n    }\n    throw error;\n  }\n}\n\nfunction parseMacOsKeychainHelperResult(input: {\n  code: number | null;\n  operation: MacOsKeychainHelperRequest[\"operation\"];\n  stderr: string;\n  stdout: string;\n}): string | null | undefined {\n  if (input.code !== 0) {\n    throw new Error(\n      `macOS Keychain helper exited with code ${input.code ?? \"unknown\"}${\n        input.stderr.trim() ? `: ${input.stderr.trim()}` : \"\"\n      }`\n    );\n  }\n\n  let rawResponse: unknown;\n  try {\n    rawResponse = JSON.parse(input.stdout);\n  } catch {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);\n  if (!(parsed.success && parsed.data.operation === input.operation)) {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  if (!parsed.data.ok) {\n    throw new Error(parsed.data.errorMessage);\n  }\n  return parsed.data.operation === \"read\" ? parsed.data.accessToken : undefined;\n}\n\nasync function executeHelperRequest(input: MacOsKeychainHelperRequest) {\n  const addon = await loadAddon();\n  if (input.operation === \"store\") {\n    addon.store(input.service, input.account, input.accessToken);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"store\" as const,\n    };\n  }\n  if (input.operation === \"delete\") {\n    addon.remove(input.service, input.account);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"delete\" as const,\n    };\n  }\n  return {\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: true as const,\n    operation: \"read\" as const,\n    accessToken: addon.read(input.service, input.account),\n  };\n}\n\nasync function readHelperStdin(): Promise<string> {\n  let raw = \"\";\n  process.stdin.setEncoding(\"utf8\");\n  for await (const chunk of process.stdin) {\n    raw += String(chunk);\n    if (Buffer.byteLength(raw, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n      throw new Error(\"macOS Keychain helper request was too large\");\n    }\n  }\n  return raw;\n}\n\nfunction truncateErrorMessage(message: string): string {\n  const normalized = message.trim() || \"macOS Keychain operation failed\";\n  return normalized.slice(0, 2048);\n}\n\nfunction formatTimeout(timeoutMs: number): string {\n  return timeoutMs % 1000 === 0\n    ? `${timeoutMs / 1000} seconds`\n    : `${timeoutMs} ms`;\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\nclass MacOsNativeKeychainTimeoutError extends Error {\n  override readonly name = \"MacOsNativeKeychainTimeoutError\";\n}\n\nasync function loadAddon(): Promise<MacOsKeychainAddon> {\n  if (loadedAddon) {\n    return loadedAddon;\n  }\n  if (process.platform !== \"darwin\") {\n    throw new Error(\"macOS Keychain is only available on macOS\");\n  }\n\n  if (isBinaryDistribution()) {\n    const embedded = await import(\"./macos-native-keychain-embedded\");\n    loadedAddon = embedded.loadEmbeddedMacOsKeychainAddon();\n    return loadedAddon;\n  }\n\n  const require = createRequire(import.meta.url);\n  const addonPath = fileURLToPath(\n    new URL(\"./native/openmeld-keychain.node\", import.meta.url)\n  );\n  loadedAddon = require(addonPath) as MacOsKeychainAddon;\n  return loadedAddon;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\nimport {\n  deleteMacOsNativeKeychainToken,\n  readMacOsNativeKeychainToken,\n  storeMacOsNativeKeychainToken,\n} from \"./macos-native-keychain\";\nimport { openMeldRootDir } from \"./paths\";\n\nconst TOKEN_STORE_KEYCHAIN_SERVICE = \"sh.openmeld.auth.token\";\nconst INSECURE_FALLBACK_ENV_KEY = \"OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN\";\nconst FORCE_INSECURE_STORE_ENV_KEY = \"OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN\";\nconst MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE =\n  \"macOS Keychain access is unavailable in this OpenMeld distribution. \" +\n  \"OpenMeld will not open an authorization window from an unattended process. \" +\n  \"Run setup or login with the current packaged OpenMeld CLI.\";\nconst COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;\nconst EXEC_FILE_BASE_OPTIONS = {\n  windowsHide: true,\n  maxBuffer: COMMAND_MAX_BUFFER_BYTES,\n  timeout: COMMAND_TIMEOUT_MS,\n} as const;\nlet insecureFallbackWarningShown = false;\nlet macOsPrivateStorageWarningShown = false;\n\ntype MacOsTokenRef = {\n  provider: \"macos-keychain\";\n  service: string;\n  account: string;\n};\n\ntype WindowsDpapiTokenRef = {\n  provider: \"windows-dpapi\";\n  key: string;\n};\n\ntype InsecureFileTokenRef = {\n  provider: \"insecure-file\";\n  key: string;\n};\n\nexport type StoredTokenRef =\n  | MacOsTokenRef\n  | WindowsDpapiTokenRef\n  | InsecureFileTokenRef;\n\nexport type AccessTokenReadResult =\n  | {\n      accessToken: string;\n      status: \"found\";\n    }\n  | {\n      status: \"missing\";\n    }\n  | {\n      errorMessage: string;\n      status: \"unavailable\";\n    };\n\ntype StoreTokenInput = {\n  accessToken: string;\n  authBaseUrl: string;\n  clientId: string;\n};\n\nexport async function storeAccessToken(\n  input: StoreTokenInput\n): Promise<StoredTokenRef> {\n  const key = buildTokenKey({\n    authBaseUrl: input.authBaseUrl,\n    clientId: input.clientId,\n  });\n\n  if (shouldForceInsecureStore()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  if (process.platform === \"darwin\") {\n    try {\n      const account = buildUniqueMacOsAccount(key);\n      if (shouldUseNativeMacOsKeychain()) {\n        await storeMacOsNativeKeychainToken({\n          account,\n          service: TOKEN_STORE_KEYCHAIN_SERVICE,\n          accessToken: input.accessToken,\n        });\n      } else {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      return {\n        provider: \"macos-keychain\",\n        service: TOKEN_STORE_KEYCHAIN_SERVICE,\n        account,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      const privateKey = buildUniqueTokenFileKey(key);\n      await setInsecureFileToken({\n        key: privateKey,\n        accessToken: input.accessToken,\n      });\n      warnMacOsPrivateStorageFallback(error);\n      return { provider: \"insecure-file\", key: privateKey };\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      await setWindowsDpapiToken({\n        key,\n        accessToken: input.accessToken,\n      });\n      return {\n        provider: \"windows-dpapi\",\n        key,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      throw new Error(\n        `failed to store access token via Windows DPAPI: ${toErrorMessage(error)}`\n      );\n    }\n  }\n\n  if (allowInsecureFallback()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  throw new Error(\n    `secure token storage is unavailable on platform \"${process.platform}\". ` +\n      `Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`\n  );\n}\n\nexport async function readAccessToken(\n  ref: StoredTokenRef\n): Promise<AccessTokenReadResult> {\n  try {\n    if (ref.provider === \"macos-keychain\") {\n      if (!shouldUseNativeMacOsKeychain()) {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      const token = await readMacOsNativeKeychainToken(ref);\n      return toAccessTokenReadResult(token);\n    }\n    if (ref.provider === \"windows-dpapi\") {\n      return toAccessTokenReadResult(await getWindowsDpapiToken(ref));\n    }\n    if (ref.provider === \"insecure-file\") {\n      return toAccessTokenReadResult(await getInsecureFileToken(ref));\n    }\n    return { status: \"missing\" };\n  } catch (error) {\n    return {\n      errorMessage: toErrorMessage(error),\n      status: \"unavailable\",\n    };\n  }\n}\n\nexport async function deleteAccessToken(ref: StoredTokenRef): Promise<void> {\n  if (ref.provider === \"macos-keychain\") {\n    if (!shouldUseNativeMacOsKeychain()) {\n      throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n    }\n    await deleteMacOsNativeKeychainToken(ref);\n    return;\n  }\n  if (ref.provider === \"windows-dpapi\") {\n    await deleteWindowsDpapiToken(ref);\n    return;\n  }\n  if (ref.provider === \"insecure-file\") {\n    await deleteInsecureFileToken(ref);\n  }\n}\n\nexport function isStoredTokenRef(value: unknown): value is StoredTokenRef {\n  if (!(value && typeof value === \"object\")) {\n    return false;\n  }\n  const record = value as Record<string, unknown>;\n  const provider = normalizeString(record.provider);\n  if (provider === \"macos-keychain\") {\n    return Boolean(\n      normalizeString(record.service) &&\n        normalizeString(record.account) &&\n        record.accessGroup === undefined\n    );\n  }\n  if (provider === \"windows-dpapi\" || provider === \"insecure-file\") {\n    return normalizeTokenFileKey(record.key) !== null;\n  }\n  return false;\n}\n\nfunction buildTokenKey(input: {\n  authBaseUrl: string;\n  clientId: string;\n}): string {\n  const rootDir = resolve(openMeldRootDir());\n  return createHash(\"sha256\")\n    .update(`${input.clientId}\\n${input.authBaseUrl}\\n${rootDir}`)\n    .digest(\"hex\");\n}\n\nfunction buildUniqueMacOsAccount(key: string): string {\n  return `openmeld-auth-${key}-${randomUUID()}`;\n}\n\nfunction buildUniqueTokenFileKey(key: string): string {\n  return createHash(\"sha256\").update(`${key}\\n${randomUUID()}`).digest(\"hex\");\n}\n\nfunction shouldUseNativeMacOsKeychain(): boolean {\n  return isBinaryDistribution();\n}\n\nasync function setWindowsDpapiToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  const encrypted = await runPowerShellScript(\n    WINDOWS_DPAPI_ENCRYPT_SCRIPT,\n    input.accessToken,\n    input.key\n  );\n  await mkdir(tokenDirectoryPath(), { recursive: true });\n  // NOTE: `mode: 0o600` is POSIX-only and Windows ignores it.\n  // For `tokenDirectoryPath()` + `windowsDpapiTokenPath()` we rely on DPAPI\n  // and Windows ACLs for equivalent protection.\n  await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n}\n\nasync function getWindowsDpapiToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const encrypted = await readFile(\n    windowsDpapiTokenPath(input.key),\n    \"utf8\"\n  ).catch((error) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw error;\n  });\n  if (!encrypted) {\n    return null;\n  }\n  return runPowerShellScript(\n    WINDOWS_DPAPI_DECRYPT_SCRIPT,\n    encrypted.trim(),\n    input.key\n  );\n}\n\nasync function deleteWindowsDpapiToken(input: { key: string }): Promise<void> {\n  await rm(windowsDpapiTokenPath(input.key), { force: true });\n}\n\nasync function setInsecureFileToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  await ensurePrivateTokenDirectory();\n  const path = insecureTokenPath(input.key);\n  await writeFile(path, `${input.accessToken}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  if (process.platform !== \"win32\") {\n    await chmod(path, 0o600);\n  }\n}\n\nasync function getInsecureFileToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const raw = await readFile(insecureTokenPath(input.key), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  return raw ? raw.trim() : null;\n}\n\nasync function deleteInsecureFileToken(input: { key: string }): Promise<void> {\n  await rm(insecureTokenPath(input.key), { force: true });\n}\n\nfunction tokenDirectoryPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"tokens\");\n}\n\nfunction windowsDpapiTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);\n}\n\nfunction insecureTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);\n}\n\nfunction allowInsecureFallback(): boolean {\n  if (process.env[INSECURE_FALLBACK_ENV_KEY] === \"1\") {\n    warnInsecureFallback(\"env\");\n    return true;\n  }\n  // Known downgrade behavior:\n  // On platforms without native secure-store support, OpenMeld currently falls back\n  // to local file token storage by default for compatibility.\n  const fallbackEnabled = !isNativeSecureStorePlatform();\n  if (fallbackEnabled) {\n    warnInsecureFallback(\"platform\");\n  }\n  return fallbackEnabled;\n}\n\nfunction warnMacOsPrivateStorageFallback(error: unknown): void {\n  if (macOsPrivateStorageWarningShown) {\n    return;\n  }\n  macOsPrivateStorageWarningShown = true;\n  const storageExpectation = isBinaryDistribution()\n    ? \"This session stays in private local storage unless a later sign-in replaces it.\"\n    : \"This npm installation cannot use macOS Keychain. This session stays in private local storage.\";\n  console.warn(\n    \"[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this \" +\n      \"session in a private file protected for your macOS user account, so \" +\n      \"setup can continue. \" +\n      `${storageExpectation} Details: ${toErrorMessage(error)}`\n  );\n}\n\nfunction warnInsecureFallback(reason: \"env\" | \"platform\"): void {\n  if (insecureFallbackWarningShown) {\n    return;\n  }\n  insecureFallbackWarningShown = true;\n\n  const reasonText =\n    reason === \"env\"\n      ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1`\n      : `enabled automatically on platform \"${process.platform}\"`;\n  console.warn(\n    `[openmeld auth] plaintext file token storage fallback is active (${reasonText}). ` +\n      `Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, ` +\n      \"and prefer macOS or Windows for native secure token storage.\"\n  );\n}\n\nfunction shouldForceInsecureStore(): boolean {\n  return process.env[FORCE_INSECURE_STORE_ENV_KEY] === \"1\";\n}\n\nfunction isNativeSecureStorePlatform(): boolean {\n  return process.platform === \"darwin\" || process.platform === \"win32\";\n}\n\nasync function ensurePrivateTokenDirectory(): Promise<void> {\n  const directory = tokenDirectoryPath();\n  await mkdir(directory, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\") {\n    await chmod(directory, 0o700);\n  }\n}\n\nasync function runPowerShellScript(\n  script: string,\n  token: string,\n  entropy: string\n): Promise<string> {\n  const payload = JSON.stringify({ token, entropy });\n  const result = await runCommand(\n    \"powershell.exe\",\n    [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-ExecutionPolicy\",\n      \"Bypass\",\n      \"-Command\",\n      script,\n    ],\n    payload\n  );\n  return result.stdout.trim();\n}\n\nasync function runCommand(\n  command: string,\n  args: string[],\n  stdinPayload: string\n): Promise<{ stdout: string; stderr: string }> {\n  try {\n    const { execFile } = await import(\"node:child_process\");\n    const output = await new Promise<{ stdout: string; stderr: string }>(\n      (resolve, reject) => {\n        let stdout = \"\";\n        let stderr = \"\";\n\n        const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });\n\n        child.stdout?.setEncoding(\"utf8\");\n        child.stderr?.setEncoding(\"utf8\");\n        child.stdout?.on(\"data\", (chunk: unknown) => {\n          stdout += String(chunk);\n        });\n        child.stderr?.on(\"data\", (chunk: unknown) => {\n          stderr += String(chunk);\n        });\n\n        child.on(\"error\", (error) => {\n          reject(toCommandError(error, command));\n        });\n\n        child.on(\"close\", (code) => {\n          if (code === 0) {\n            resolve({ stdout, stderr });\n            return;\n          }\n          reject(\n            toCommandError(\n              {\n                message: `command failed (${command}) with exit code ${code}`,\n              },\n              command\n            )\n          );\n        });\n\n        child.stdin?.write(stdinPayload);\n        child.stdin?.end();\n      }\n    );\n    return output;\n  } catch (error) {\n    throw toCommandError(error, command);\n  }\n}\n\nfunction toCommandError(\n  error: unknown,\n  command: string\n): Error & { code?: number | null; stdout?: string; stderr?: string } {\n  if (!(error && typeof error === \"object\")) {\n    return new Error(`command failed (${command}): ${String(error)}`);\n  }\n  const e = error as NodeJS.ErrnoException & {\n    stdout?: string;\n    stderr?: string;\n    code?: number | null | string;\n  };\n  const code = typeof e.code === \"number\" ? e.code : null;\n  const messageParts = [`command failed (${command})`];\n  if (typeof e.stderr === \"string\" && e.stderr.trim()) {\n    messageParts.push(`stderr: ${e.stderr.trim()}`);\n  } else if (e.message) {\n    messageParts.push(e.message);\n  }\n  const wrapped = new Error(messageParts.join(\"; \")) as Error & {\n    code?: number | null;\n    stdout?: string;\n    stderr?: string;\n  };\n  wrapped.code = code;\n  wrapped.stdout = e.stdout;\n  wrapped.stderr = e.stderr;\n  return wrapped;\n}\n\nfunction normalizeString(value: unknown): string {\n  return String(value ?? \"\").trim();\n}\n\nfunction normalizeTokenFileKey(value: unknown): string | null {\n  const normalized = normalizeString(value);\n  if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction requireValidTokenFileKey(value: unknown): string {\n  const normalized = normalizeTokenFileKey(value);\n  if (normalized === null) {\n    throw new Error(\"stored token key is invalid\");\n  }\n  return normalized;\n}\n\nfunction normalizeToken(value: string | null): string | null {\n  if (value === null) {\n    return null;\n  }\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction toAccessTokenReadResult(value: string | null): AccessTokenReadResult {\n  const accessToken = normalizeToken(value);\n  if (!accessToken) {\n    return { status: \"missing\" };\n  }\n  return {\n    accessToken,\n    status: \"found\",\n  };\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  return String(error);\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nconst WINDOWS_DPAPI_ENCRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Convert]::ToBase64String($cipher)\",\n].join(\";\");\n\nconst WINDOWS_DPAPI_DECRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$cipher=[System.Convert]::FromBase64String($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Text.Encoding]::UTF8.GetString($plain)\",\n].join(\";\");\n","import { randomUUID } from \"node:crypto\";\nimport { mkdir, open, readFile, rename, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  DEFAULT_REMOTE_SESSION_TIMEOUT_MS,\n  LOOPBACK_REMOTE_SESSION_TIMEOUT_MS,\n} from \"../strategy-constants\";\nimport { openMeldRootDir } from \"./paths\";\nimport {\n  deleteAccessToken,\n  isStoredTokenRef,\n  readAccessToken,\n  type StoredTokenRef,\n  storeAccessToken,\n} from \"./token-store\";\n\ntype AuthSessionV1 = {\n  v: 1;\n  tokenRef: StoredTokenRef;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype PendingTokenCleanupV1 = {\n  v: 1;\n  tokenRefs: StoredTokenRef[];\n};\n\nexport type ClearAuthSessionResult = {\n  hadLocalSession: boolean;\n};\n\nexport type StoredActiveOrganization = {\n  id: string;\n  slug: string;\n  name: string;\n  role?: string;\n  personal?: boolean;\n};\n\nexport type StoredAuthSession = {\n  v: 1;\n  accessToken: string;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type AuthSessionState =\n  | \"missing\"\n  | \"valid\"\n  | \"expired\"\n  | \"invalid\"\n  | \"revoked\";\n\nexport type AuthSessionStateReasonCode =\n  | \"remote_session_invalid\"\n  | \"remote_session_revoked\"\n  | \"session_expired\"\n  | \"session_metadata_invalid\"\n  | \"session_missing\"\n  | \"session_token_missing\"\n  | \"session_token_ref_invalid\"\n  | \"session_token_unavailable\";\n\nexport type AuthSessionStateResult = {\n  errorMessage?: string;\n  reasonCode?: AuthSessionStateReasonCode;\n  state: AuthSessionState;\n  session: StoredAuthSession | null;\n};\n\nexport type AuthSessionMetadata = {\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype GetAuthSessionStateOptions = {\n  validateRemote?: boolean;\n};\n\ntype LocalAuthSessionState =\n  | {\n      errorMessage?: string;\n      reasonCode: Exclude<\n        AuthSessionStateReasonCode,\n        \"remote_session_invalid\" | \"remote_session_revoked\" | \"session_expired\"\n      >;\n      state: \"missing\" | \"invalid\";\n      session: null;\n    }\n  | {\n      reasonCode: \"session_expired\";\n      state: \"expired\";\n      session: StoredAuthSession;\n    }\n  | {\n      state: \"valid\";\n      session: StoredAuthSession;\n    };\n\ntype RemoteAuthSessionState = \"valid\" | \"invalid\" | \"revoked\" | \"unknown\";\ntype RemoteAuthSessionValidation = {\n  state: RemoteAuthSessionState;\n};\nconst TRAILING_SLASHES_RE = /\\/+$/u;\n\ntype CachedAuthSession = {\n  payloadKey: string;\n  session: StoredAuthSession;\n};\n\nlet cachedAuthSession: CachedAuthSession | null = null;\n\nexport async function getAuthSessionState(\n  options: GetAuthSessionStateOptions = {}\n): Promise<AuthSessionStateResult> {\n  const localState = await getLocalAuthSessionState();\n  switch (localState.state) {\n    case \"missing\":\n    case \"invalid\":\n    case \"expired\":\n      return localState;\n    case \"valid\":\n      break;\n    default:\n      return localState;\n  }\n  if (!options.validateRemote) {\n    return localState;\n  }\n\n  const remoteValidation = await getRemoteAuthSessionState(localState.session);\n  if (remoteValidation.state === \"valid\") {\n    return localState;\n  }\n  if (remoteValidation.state === \"unknown\") {\n    return localState;\n  }\n\n  return {\n    reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),\n    state: remoteValidation.state,\n    session: null,\n  };\n}\n\n// The signed-in owner user id from the local session, or null when signed\n// out. Callers use this as the expected owner for service account-alignment\n// checks; it never validates remotely.\nexport async function getCurrentAuthOwnerUserId(): Promise<string | null> {\n  const authState = await getAuthSessionState({\n    validateRemote: false,\n  }).catch(() => null);\n  const ownerUserId = authState?.session?.user?.id?.trim() ?? \"\";\n  return ownerUserId.length > 0 ? ownerUserId : null;\n}\n\nexport async function setAuthSession(input: {\n  accessToken: string;\n  tokenType?: string;\n  authBaseUrl: string;\n  clientId: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization | null;\n}): Promise<void> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  await retryPendingTokenCleanup();\n\n  const previousPayload = await readSessionPayload();\n  const previousTokenRef = normalizeTokenRef(previousPayload?.tokenRef);\n  const tokenRef = await storeAccessToken({\n    accessToken,\n    authBaseUrl,\n    clientId,\n  });\n\n  const payload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n    authBaseUrl,\n    clientId,\n    createdAt: new Date().toISOString(),\n    ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    ...buildAuthUserPayload(input.user),\n    ...buildActiveOrganizationPayload(input.activeOrganization),\n  };\n\n  const path = authSessionPath();\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n\n  try {\n    await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n    await writeSessionPayloadAtomically(path, payload);\n  } catch (error) {\n    await deleteAccessTokenOrRetainForCleanup(tokenRef);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload,\n    session: buildStoredAuthSession({ accessToken, payload }),\n  });\n  if (\n    previousTokenRef &&\n    !areStoredTokenRefsEqual(previousTokenRef, tokenRef)\n  ) {\n    await deleteAccessTokenOrRetainForCleanup(previousTokenRef);\n  }\n}\n\nexport async function getAuthSession(): Promise<StoredAuthSession | null> {\n  const localState = await getLocalAuthSessionState();\n  if (localState.state === \"missing\" || localState.state === \"invalid\") {\n    return null;\n  }\n  return localState.session;\n}\n\nexport async function getAuthSessionMetadata(): Promise<AuthSessionMetadata | null> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return null;\n  }\n\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(authBaseUrl && clientId && createdAt)) {\n    return null;\n  }\n\n  return {\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(payload.activeOrganization),\n  };\n}\n\nexport async function updateAuthSessionActiveOrganization(\n  activeOrganization: StoredActiveOrganization | null\n): Promise<void> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    throw new Error(\"cannot update active organization without auth session\");\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) {\n    throw new Error(\n      \"cannot update active organization for invalid auth session\"\n    );\n  }\n\n  const nextPayload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType,\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(activeOrganization),\n  };\n\n  await writeSessionPayloadAtomically(authSessionPath(), nextPayload);\n  const currentCachedSession = readCachedAuthSession(payload);\n  if (currentCachedSession) {\n    cacheAuthSession({\n      payload: nextPayload,\n      session: buildStoredAuthSession({\n        accessToken: currentCachedSession.accessToken,\n        payload: nextPayload,\n      }),\n    });\n  }\n}\n\nexport async function clearAuthSession(): Promise<ClearAuthSessionResult> {\n  cachedAuthSession = null;\n  await retryPendingTokenCleanup();\n  const hadLocalSession = await authSessionFileExists();\n  const payload = await readSessionPayload();\n  if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) {\n    await deleteAccessTokenOrRetainForCleanup(payload.tokenRef);\n  }\n  await removeSessionFile();\n  return { hadLocalSession };\n}\n\nasync function retryPendingTokenCleanup(): Promise<void> {\n  const pending = await readPendingTokenCleanup();\n  if (pending.tokenRefs.length === 0) {\n    return;\n  }\n\n  const remaining: StoredTokenRef[] = [];\n  for (const tokenRef of pending.tokenRefs) {\n    try {\n      await deleteAccessToken(tokenRef);\n    } catch {\n      remaining.push(tokenRef);\n    }\n  }\n  await persistPendingTokenCleanup(remaining);\n}\n\nasync function deleteAccessTokenOrRetainForCleanup(\n  tokenRef: StoredTokenRef\n): Promise<void> {\n  try {\n    await deleteAccessToken(tokenRef);\n  } catch {\n    const pending = await readPendingTokenCleanup();\n    if (\n      pending.tokenRefs.some((ref) => areStoredTokenRefsEqual(ref, tokenRef))\n    ) {\n      return;\n    }\n    await persistPendingTokenCleanup([...pending.tokenRefs, tokenRef]);\n  }\n}\n\nasync function readPendingTokenCleanup(): Promise<PendingTokenCleanupV1> {\n  const raw = await readFile(pendingTokenCleanupPath(), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  if (raw === null) {\n    return { v: 1, tokenRefs: [] };\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  if (\n    !(isRecord(parsed) && parsed.v === 1 && Array.isArray(parsed.tokenRefs))\n  ) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  const tokenRefs = parsed.tokenRefs.filter(isStoredTokenRef);\n  if (tokenRefs.length !== parsed.tokenRefs.length) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  return { v: 1, tokenRefs };\n}\n\nasync function persistPendingTokenCleanup(\n  tokenRefs: StoredTokenRef[]\n): Promise<void> {\n  const path = pendingTokenCleanupPath();\n  if (tokenRefs.length === 0) {\n    await rm(path, { force: true });\n    return;\n  }\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n  await writeJsonAtomically(path, { v: 1, tokenRefs });\n}\n\nfunction pendingTokenCleanupPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"pending-token-cleanup.json\");\n}\n\nasync function authSessionFileExists(): Promise<boolean> {\n  try {\n    await readFile(authSessionPath(), \"utf8\");\n    return true;\n  } catch (error) {\n    if (isFileNotFoundError(error)) {\n      return false;\n    }\n    throw error;\n  }\n}\n\nasync function getLocalAuthSessionState(): Promise<LocalAuthSessionState> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return {\n      reasonCode: \"session_missing\",\n      state: \"missing\",\n      session: null,\n    };\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  if (!tokenRef) {\n    return {\n      reasonCode: \"session_token_ref_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenType && authBaseUrl && clientId && createdAt)) {\n    return {\n      reasonCode: \"session_metadata_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  let session = readCachedAuthSession(payload);\n  if (!session) {\n    const accessToken = await readAccessToken(tokenRef);\n    if (accessToken.status === \"missing\") {\n      return {\n        reasonCode: \"session_token_missing\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    if (accessToken.status === \"unavailable\") {\n      return {\n        errorMessage: accessToken.errorMessage,\n        reasonCode: \"session_token_unavailable\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    session = buildStoredAuthSession({\n      accessToken: accessToken.accessToken,\n      payload: {\n        ...payload,\n        v: 1,\n        tokenRef,\n        tokenType,\n        authBaseUrl,\n        clientId,\n        createdAt,\n      },\n    });\n    cacheAuthSession({ payload, session });\n  }\n\n  if (isExpired(session.expiresAt)) {\n    return {\n      reasonCode: \"session_expired\",\n      state: \"expired\",\n      session,\n    };\n  }\n\n  return {\n    state: \"valid\",\n    session,\n  };\n}\n\nasync function assertStoredAccessTokenReloads(input: {\n  accessToken: string;\n  tokenRef: StoredTokenRef;\n}): Promise<void> {\n  const reloaded = await readAccessToken(input.tokenRef);\n  if (\n    reloaded.status === \"found\" &&\n    reloaded.accessToken === input.accessToken\n  ) {\n    return;\n  }\n  if (reloaded.status === \"unavailable\") {\n    throw new Error(\n      `stored access token could not be reloaded: ${reloaded.errorMessage}`\n    );\n  }\n  throw new Error(\"stored access token could not be reloaded\");\n}\n\nfunction buildStoredAuthSession(input: {\n  accessToken: string;\n  payload: AuthSessionV1;\n}): StoredAuthSession {\n  return {\n    v: 1,\n    accessToken: input.accessToken,\n    tokenType: input.payload.tokenType,\n    authBaseUrl: input.payload.authBaseUrl,\n    clientId: input.payload.clientId,\n    createdAt: input.payload.createdAt,\n    ...(typeof input.payload.expiresAt === \"string\" &&\n    input.payload.expiresAt.trim()\n      ? { expiresAt: input.payload.expiresAt.trim() }\n      : {}),\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n}\n\nfunction cacheAuthSession(input: {\n  payload: Partial<AuthSessionV1>;\n  session: StoredAuthSession;\n}): void {\n  cachedAuthSession = {\n    payloadKey: buildAuthSessionPayloadKey(input.payload),\n    session: input.session,\n  };\n}\n\nfunction readCachedAuthSession(\n  payload: Partial<AuthSessionV1>\n): StoredAuthSession | null {\n  const payloadKey = buildAuthSessionPayloadKey(payload);\n  return cachedAuthSession?.payloadKey === payloadKey\n    ? cachedAuthSession.session\n    : null;\n}\n\nfunction buildAuthSessionPayloadKey(payload: Partial<AuthSessionV1>): string {\n  return `${authSessionPath()}\\n${JSON.stringify(payload)}`;\n}\n\nfunction areStoredTokenRefsEqual(\n  left: StoredTokenRef,\n  right: StoredTokenRef\n): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction normalizeTokenRef(input: unknown): StoredTokenRef | null {\n  if (!isStoredTokenRef(input)) {\n    return null;\n  }\n  return input;\n}\n\nasync function getRemoteAuthSessionState(\n  session: StoredAuthSession\n): Promise<RemoteAuthSessionValidation> {\n  let endpoint = \"\";\n  try {\n    endpoint = toAuthEndpoint(session.authBaseUrl, \"/api/auth/get-session\");\n  } catch {\n    return { state: \"invalid\" };\n  }\n  try {\n    const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);\n    const response = await fetch(endpoint, {\n      method: \"GET\",\n      headers: {\n        Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}`,\n      },\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n\n    if (response.status === 401 || response.status === 403) {\n      return { state: \"revoked\" };\n    }\n    if (!response.ok) {\n      // Preserve local credentials on upstream/transient failures.\n      // Non-auth HTTP errors should be retried instead of treated as revocation.\n      return { state: \"unknown\" };\n    }\n\n    const payload = await parseResponseJson(response);\n    if (!hasActiveSessionPayload(payload)) {\n      return { state: \"invalid\" };\n    }\n    return { state: \"valid\" };\n  } catch {\n    return { state: \"unknown\" };\n  }\n}\n\nfunction resolveRemoteSessionTimeoutMs(endpoint: string): number {\n  const url = parseUrlOrNull(endpoint);\n  if (url && isLoopbackHostname(url.hostname)) {\n    return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;\n  }\n  return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n  );\n}\n\nfunction hasActiveSessionPayload(payload: unknown): boolean {\n  if (!isRecord(payload)) {\n    return false;\n  }\n\n  return (\n    isRecord((payload as Record<string, unknown>).session) &&\n    isRecord((payload as Record<string, unknown>).user)\n  );\n}\n\nfunction isExpired(expiresAt: string | undefined): boolean {\n  if (!expiresAt) {\n    return false;\n  }\n  const expiresAtMs = Date.parse(expiresAt);\n  if (Number.isNaN(expiresAtMs)) {\n    return false;\n  }\n  return expiresAtMs <= Date.now();\n}\n\nfunction resolveRemoteAuthSessionReasonCode(\n  state: Exclude<RemoteAuthSessionState, \"valid\" | \"unknown\">\n): AuthSessionStateReasonCode {\n  switch (state) {\n    case \"invalid\":\n      return \"remote_session_invalid\";\n    case \"revoked\":\n      return \"remote_session_revoked\";\n    default: {\n      const exhaustiveState: never = state;\n      throw new Error(\n        `unsupported remote auth session state: ${exhaustiveState}`\n      );\n    }\n  }\n}\n\nasync function readSessionPayload(): Promise<Partial<AuthSessionV1> | null> {\n  const raw = await readFile(authSessionPath(), \"utf8\").catch(() => null);\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw) as Partial<AuthSessionV1>;\n  } catch {\n    return null;\n  }\n}\n\nfunction authSessionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session.json\");\n}\n\nasync function writeSessionPayloadAtomically(\n  path: string,\n  payload: AuthSessionV1\n): Promise<void> {\n  await writeJsonAtomically(path, payload);\n}\n\nasync function writeJsonAtomically(\n  path: string,\n  payload: unknown\n): Promise<void> {\n  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;\n  try {\n    const file = await open(tempPath, \"wx\", 0o600);\n    try {\n      await file.writeFile(`${JSON.stringify(payload, null, 2)}\\n`, \"utf8\");\n      await file.sync();\n    } finally {\n      await file.close();\n    }\n\n    await rename(tempPath, path);\n  } catch (error) {\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nfunction buildAuthUserPayload(value: unknown): {\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n} {\n  if (!(value && typeof value === \"object\")) {\n    return {};\n  }\n  const record = value as Record<string, unknown>;\n  const id = normalizeOptionalString(record.id);\n  const email = normalizeOptionalString(record.email);\n  const name = normalizeOptionalString(record.name);\n  if (!(id || email || name)) {\n    return {};\n  }\n  return {\n    user: {\n      ...(id ? { id } : {}),\n      ...(email ? { email } : {}),\n      ...(name ? { name } : {}),\n    },\n  };\n}\n\nfunction buildActiveOrganizationPayload(value: unknown): {\n  activeOrganization?: StoredActiveOrganization;\n} {\n  const activeOrganization = normalizeStoredActiveOrganization(value);\n  return activeOrganization ? { activeOrganization } : {};\n}\n\nexport function normalizeStoredActiveOrganization(\n  value: unknown\n): StoredActiveOrganization | null {\n  if (!isRecord(value)) {\n    return null;\n  }\n  const id = normalizeOptionalString(value.id);\n  const slug = normalizeOptionalString(value.slug);\n  const name = normalizeOptionalString(value.name);\n  const role = normalizeOptionalString(value.role);\n  const personal = readOrganizationIsPersonal(value);\n  if (!(id && slug && name)) {\n    return null;\n  }\n  return {\n    id,\n    slug,\n    name,\n    ...(role ? { role } : {}),\n    ...(personal ? { personal } : {}),\n  };\n}\n\nexport function readActiveOrganizationIdFromSessionPayload(\n  payload: unknown\n): string | null {\n  if (!isRecord(payload)) {\n    return null;\n  }\n  return (\n    (isRecord(payload.session)\n      ? normalizeOptionalString(payload.session.activeOrganizationId)\n      : null) ?? normalizeOptionalString(payload.activeOrganizationId)\n  );\n}\n\nfunction normalizeTokenType(value: string): string {\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : \"Bearer\";\n}\n\nfunction normalizeOptionalString(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction readOrganizationIsPersonal(value: Record<string, unknown>): boolean {\n  if (value.personal === true || value.isPersonal === true) {\n    return true;\n  }\n\n  const metadata = readOrganizationMetadata(value.metadata);\n  return metadata?.personal === true;\n}\n\nfunction readOrganizationMetadata(\n  metadata: unknown\n): Record<string, unknown> | null {\n  if (metadata === null || metadata === undefined) {\n    return null;\n  }\n\n  if (typeof metadata === \"string\") {\n    try {\n      const parsed = JSON.parse(metadata) as unknown;\n      return isRecord(parsed) ? parsed : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return isRecord(metadata) ? metadata : null;\n}\n\nfunction toAuthEndpoint(baseUrl: string, pathname: string): string {\n  const url = new URL(baseUrl);\n  const normalizedBasePath = url.pathname.replace(TRAILING_SLASHES_RE, \"\");\n  const normalizedPathname = pathname.startsWith(\"/\")\n    ? pathname\n    : `/${pathname}`;\n  url.pathname = `${normalizedBasePath}${normalizedPathname}` || \"/\";\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\nasync function parseResponseJson(response: Response): Promise<unknown> {\n  const raw = await response.text();\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return { message: raw };\n  }\n}\n\nasync function removeSessionFile(): Promise<void> {\n  await rm(authSessionPath(), { force: true });\n}\n"],"mappings":";;;;;;;;;;;;AAGA,MAAM,6CAA6C;AACnD,MAAM,6BAA6B,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACnE,MAAM,6BAA6B,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACnE,MAAM,iCAAiC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;AAClE,MAAM,qCAAqC,EAAE,KAAK;CACjD;CACA;CACA;AACD,CAAC;AACD,MAAM,mCAAmC,EAAE,mBAAmB,aAAa;CAC1E,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,OAAO;EAC5B,SAAS;EACT,SAAS;EACT,aAAa;EACb,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;CACD,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,MAAM;EAC3B,SAAS;EACT,SAAS;EACT,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;CACD,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,QAAQ;EAC7B,SAAS;EACT,SAAS;EACT,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;AACF,CAAC;AACD,MAAM,2CAA2C,EAAE,aAAa;CAC/D,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,IAAI;CAClB,WAAW,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AACtC,CAAC;AACD,MAAM,uCAAuC,EAAE,aAAa;CAC3D,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,IAAI;CAClB,WAAW,EAAE,QAAQ,MAAM;CAC3B,aAAa,EAAE,MAAM,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AACD,MAAM,iCAAiC,EAAE,aAAa;CACrD,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,KAAK;CACnB,WAAW;CACX,cAAc,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAChD,CAAC;AACD,MAAM,oCAAoC,EAAE,MAAM;CACjD;CACA;CACA;AACD,CAAC;;;ACrDD,MAAa,mCAAmC;AAChD,MAAa,oCAAoC;AACjD,MAAa,qCAAqC;AAGlD,MAAa,mCAAmC;AAEhD,MAAa,+BAA+B;AAC5C,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,4BAA4B;AACzC,MAAa,4BAA4B;AAIzC,MAAa,sCAAsC;AAMnD,MAAa,0CAA0C;AAIvD,MAAa,iCAAiC;AAC9C,MAAa,uCAAuC;AACpD,MAAa,gCAAgC;AAC7C,MAAa,mDAAmD,IAAI;AACpE,MAAa,yDAAyD;AACtE,MAAa,+CAA+C,IAAI;AAChE,MAAa,qDAAqD;AAClE,MAAa,wCAAwC;AACrD,MAAa,mCAAmC;AAChD,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,gCACX;AACF,MAAa,0BAA0B;;;ACpBvC,MAAM,sBAA4C;AAClD,MAAM,mBAAyC;;;;;;AAO/C,SAAgB,8BAAoD;CAKlE,OAEI;AACN;AAEA,SAAgB,uBAAgC;CAC9C,OAAO,4BAA4B,MAAM;AAC3C;;;AC9BA,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AAqCtC,IAAI,cAAyC;AAC7C,IAAI,4BAA0C;AAE9C,eAAsB,8BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;GACf,aAAa,MAAM;EACrB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;AAC7D;AAEA,eAAsB,6BACpB,OACwB;CACxB,IAAI,qBAAqB,GACvB,OAAO,MAAM,qCAAqC;EAChD,WAAW;EACX,SAAS,MAAM;EACf,SAAS,MAAM;CACjB,CAAC;CAGH,QAAO,MADa,UAAU,EAAA,CACjB,KAAK,MAAM,SAAS,MAAM,OAAO;AAChD;AAEA,eAAsB,+BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;EACjB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,OAAO,MAAM,SAAS,MAAM,OAAO;AAC3C;AAUA,eAAsB,qCACpB,OACA,UAAkC,CAAC,GACC;CACpC,MAAM,UAAU,iCAAiC,MAAM;EACrD,eAAA;EACA,2BAA2B;EAC3B,GAAG;CACL,CAAC;CACD,MAAM,YAAY,QAAQ,aAAA;CAC1B,IAAI,EAAE,OAAO,cAAc,SAAS,KAAK,YAAY,IACnD,MAAM,IAAI,MAAM,0DAA0D;CAG5E,OAAO,MAAM,IAAI,SAAoC,SAAS,WAAW;EACvE,MAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,0BAA0B,GAAG;GAClE,KAAK,QAAQ;GACb,OAAO;GACP,OAAO;IAAC;IAAQ;IAAQ;GAAM;GAC9B,aAAa;EACf,CAAC;EACD,IAAI,UAAU;EACd,IAAI,SAAS;EACb,IAAI,SAAS;EAEb,MAAM,sBAAsB;GAC1B,aAAa,QAAQ;EACvB;EACA,MAAM,cAAc,UAAiB;GACnC,IAAI,SACF;GAEF,UAAU;GACV,cAAc;GACd,OAAO,KAAK;EACd;EACA,MAAM,WAAW,iBAAiB;GAChC,IAAI,SACF;GAEF,UAAU;GACV,MAAM,KAAK,SAAS;GACpB,OACE,IAAI,gCACF,yCAAyC,cAAc,SAAS,GAClE,CACF;EACF,GAAG,SAAS;EAEZ,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBAAyB;IAC/D,MAAM,KAAK,SAAS;IACpB,2BAAW,IAAI,MAAM,4CAA4C,CAAC;GACpE;EACF,CAAC;EACD,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBACtC,SAAS,OAAO,MAAM,OAAwB;EAElD,CAAC;EACD,MAAM,KAAK,UAAU,UAAU;GAC7B,2BACE,IAAI,MACF,0CAA0CA,iBAAe,KAAK,GAChE,CACF;EACF,CAAC;EACD,MAAM,MAAM,KAAK,UAAU,UAAU;GACnC,2BACE,IAAI,MACF,uCAAuCA,iBAAe,KAAK,GAC7D,CACF;EACF,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SACF;GAEF,cAAc;GACd,UAAU;GACV,IAAI;IACF,QACE,+BAA+B;KAC7B;KACA,WAAW,QAAQ;KACnB;KACA;IACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,OAAO,QAAQ,KAAK,CAAC;GACvB;EACF,CAAC;EAED,MAAM,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG,MAAM;CACjD,CAAC;AACH;AAEA,eAAsB,wCACpB,OAA0B,QAAQ,MAChB;CAClB,IAAI,CAAC,KAAK,SAAS,0BAA0B,GAC3C,OAAO;CAET,IAAI,EAAE,qBAAqB,KAAK,QAAQ,aAAa,WACnD,MAAM,IAAI,MACR,0EACF;CAIF,IAAI,EAAC,MADe,UAAU,EAAA,CACnB,uBAAuB,GAChC,MAAM,IAAI,MACR,8EACF;CAGF,MAAM,aAAa,MAAM,gBAAgB;CACzC,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,UAAU;CAC9B,QAAQ;EACN,MAAM,IAAI,MAAM,uCAAuC;CACzD;CACA,MAAM,UAAU,iCAAiC,UAAU,IAAI;CAC/D,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,WAAW,MAAM,qBAAqB,QAAQ,IAAI,CAAC,CAAC,OAAO,WAAW;EAC1E,eAAA;EACA,IAAI;EACJ,WAAW,QAAQ,KAAK;EACxB,cAAc,qBAAqBA,iBAAe,KAAK,CAAC;CAC1D,EAAE;CACF,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,CAAC;CAC7C,OAAO;AACT;AAQA,eAAe,qCACb,OACoC;CACpC,IAAI,2BACF,MAAM;CAER,IAAI;EACF,IAAI,MAAM,cAAc,QACtB,OAAO,MAAM,qCAAqC,KAAK;EAEzD,MAAM,qCAAqC,KAAK;CAClD,SAAS,OAAO;EACd,IAAI,iBAAiB,iCACnB,4BAA4B;EAE9B,MAAM;CACR;AACF;AAEA,SAAS,+BAA+B,OAKV;CAC5B,IAAI,MAAM,SAAS,GACjB,MAAM,IAAI,MACR,0CAA0C,MAAM,QAAQ,YACtD,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,IAEvD;CAGF,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,MAAM,MAAM;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,MAAM,SAAS,kCAAkC,UAAU,WAAW;CACtE,IAAI,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,MAAM,YACtD,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,CAAC,OAAO,KAAK,IACf,MAAM,IAAI,MAAM,OAAO,KAAK,YAAY;CAE1C,OAAO,OAAO,KAAK,cAAc,SAAS,OAAO,KAAK,cAAc,KAAA;AACtE;AAEA,eAAe,qBAAqB,OAAmC;CACrE,MAAM,QAAQ,MAAM,UAAU;CAC9B,IAAI,MAAM,cAAc,SAAS;EAC/B,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;EAC3D,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,IAAI,MAAM,cAAc,UAAU;EAChC,MAAM,OAAO,MAAM,SAAS,MAAM,OAAO;EACzC,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,OAAO;EACL,eAAA;EACA,IAAI;EACJ,WAAW;EACX,aAAa,MAAM,KAAK,MAAM,SAAS,MAAM,OAAO;CACtD;AACF;AAEA,eAAe,kBAAmC;CAChD,IAAI,MAAM;CACV,QAAQ,MAAM,YAAY,MAAM;CAChC,WAAW,MAAM,SAAS,QAAQ,OAAO;EACvC,OAAO,OAAO,KAAK;EACnB,IAAI,OAAO,WAAW,KAAK,MAAM,IAAI,yBACnC,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,SAAyB;CAErD,QADmB,QAAQ,KAAK,KAAK,kCAAA,CACnB,MAAM,GAAG,IAAI;AACjC;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,YAAY,QAAS,IACxB,GAAG,YAAY,IAAK,YACpB,GAAG,UAAU;AACnB;AAEA,SAASA,iBAAe,OAAwB;CAC9C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,OAAyB;AAC3B;AAEA,eAAe,YAAyC;CACtD,IAAI,aACF,OAAO;CAET,IAAI,QAAQ,aAAa,UACvB,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,qBAAqB,GAAG;EAE1B,eAAc,MADS,OAAO,2CAAA,CACP,+BAA+B;EACtD,OAAO;CACT;CAMA,cAJgB,cAAc,OAAO,KAAK,GAItB,CAAC,CAHH,cAChB,IAAI,IAAI,mCAAmC,OAAO,KAAK,GAAG,CAE9B,CAAC;CAC/B,OAAO;AACT;;;ACtXA,MAAM,+BAA+B;AACrC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,qDACJ;AAGF,MAAM,2BAA2B,OAAO;AACxC,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,yBAAyB;CAC7B,aAAa;CACb,WAAW;CACX,SAAS;AACX;AACA,IAAI,+BAA+B;AACnC,IAAI,kCAAkC;AA0CtC,eAAsB,iBACpB,OACyB;CACzB,MAAM,MAAM,cAAc;EACxB,aAAa,MAAM;EACnB,UAAU,MAAM;CAClB,CAAC;CAED,IAAI,yBAAyB,GAAG;EAC9B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,UAAU,wBAAwB,GAAG;EAC3C,IAAI,6BAA6B,GAC/B,MAAM,8BAA8B;GAClC;GACA,SAAS;GACT,aAAa,MAAM;EACrB,CAAC;OAED,MAAM,IAAI,MAAM,kDAAkD;EAEpE,OAAO;GACL,UAAU;GACV,SAAS;GACT;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,aAAa,wBAAwB,GAAG;EAC9C,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,gCAAgC,KAAK;EACrC,OAAO;GAAE,UAAU;GAAiB,KAAK;EAAW;CACtD;CAGF,IAAI,QAAQ,aAAa,SACvB,IAAI;EACF,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,IAAI,MACR,mDAAmD,eAAe,KAAK,GACzE;CACF;CAGF,IAAI,sBAAsB,GAAG;EAC3B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,MAAM,IAAI,MACR,oDAAoD,QAAQ,SAAS,SAC5D,0BAA0B,oCACrC;AACF;AAEA,eAAsB,gBACpB,KACgC;CAChC,IAAI;EACF,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;GAGpE,OAAO,wBAAwB,MADX,6BAA6B,GAAG,CAChB;EACtC;EACA,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,OAAO,EAAE,QAAQ,UAAU;CAC7B,SAAS,OAAO;EACd,OAAO;GACL,cAAc,eAAe,KAAK;GAClC,QAAQ;EACV;CACF;AACF;AAEA,eAAsB,kBAAkB,KAAoC;CAC1E,IAAI,IAAI,aAAa,kBAAkB;EACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,+BAA+B,GAAG;EACxC;CACF;CACA,IAAI,IAAI,aAAa,iBAAiB;EACpC,MAAM,wBAAwB,GAAG;EACjC;CACF;CACA,IAAI,IAAI,aAAa,iBACnB,MAAM,wBAAwB,GAAG;AAErC;AAEA,SAAgB,iBAAiB,OAAyC;CACxE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO;CAET,MAAM,SAAS;CACf,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,aAAa,kBACf,OAAO,QACL,gBAAgB,OAAO,OAAO,KAC5B,gBAAgB,OAAO,OAAO,KAC9B,OAAO,gBAAgB,KAAA,CAC3B;CAEF,IAAI,aAAa,mBAAmB,aAAa,iBAC/C,OAAO,sBAAsB,OAAO,GAAG,MAAM;CAE/C,OAAO;AACT;AAEA,SAAS,cAAc,OAGZ;CACT,MAAM,UAAU,QAAQ,gBAAgB,CAAC;CACzC,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,GAAG,MAAM,SAAS,IAAI,MAAM,YAAY,IAAI,SAAS,CAAC,CAC7D,OAAO,KAAK;AACjB;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,iBAAiB,IAAI,GAAG,WAAW;AAC5C;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,OAAO,KAAK;AAC5E;AAEA,SAAS,+BAAwC;CAC/C,OAAO,qBAAqB;AAC9B;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,YAAY,MAAM,oBACtB,8BACA,MAAM,aACN,MAAM,GACR;CACA,MAAM,MAAM,mBAAmB,GAAG,EAAE,WAAW,KAAK,CAAC;CAIrD,MAAM,UAAU,sBAAsB,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,EAAE,KAAK;EACzE,UAAU;EACV,MAAM;CACR,CAAC;AACH;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,YAAY,MAAM,SACtB,sBAAsB,MAAM,GAAG,GAC/B,MACF,CAAC,CAAC,OAAO,UAAU;EACjB,IAAIC,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CAAC;CACD,IAAI,CAAC,WACH,OAAO;CAET,OAAO,oBACL,8BACA,UAAU,KAAK,GACf,MAAM,GACR;AACF;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,sBAAsB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,4BAA4B;CAClC,MAAM,OAAO,kBAAkB,MAAM,GAAG;CACxC,MAAM,UAAU,MAAM,GAAG,MAAM,YAAY,KAAK;EAC9C,UAAU;EACV,MAAM;CACR,CAAC;CACD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,MAAM,GAAK;AAE3B;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,MAAM,MAAM,SAAS,kBAAkB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAC9D,UAAU;EACT,IAAIA,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,OAAO,MAAM,IAAI,KAAK,IAAI;AAC5B;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,kBAAkB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxD;AAEA,SAAS,qBAA6B;CACpC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,QAAQ;AACjD;AAEA,SAAS,sBAAsB,KAAqB;CAClD,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,kBAAkB,KAAqB;CAC9C,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,wBAAiC;CACxC,IAAI,QAAQ,IAAI,+BAA+B,KAAK;EAClD,qBAAqB,KAAK;EAC1B,OAAO;CACT;CAIA,MAAM,kBAAkB,CAAC,4BAA4B;CACrD,IAAI,iBACF,qBAAqB,UAAU;CAEjC,OAAO;AACT;AAEA,SAAS,gCAAgC,OAAsB;CAC7D,IAAI,iCACF;CAEF,kCAAkC;CAClC,MAAM,qBAAqB,qBAAqB,IAC5C,oFACA;CACJ,QAAQ,KACN,8JAGK,mBAAmB,YAAY,eAAe,KAAK,GAC1D;AACF;AAEA,SAAS,qBAAqB,QAAkC;CAC9D,IAAI,8BACF;CAEF,+BAA+B;CAE/B,MAAM,aACJ,WAAW,QACP,cAAc,0BAA0B,MACxC,sCAAsC,QAAQ,SAAS;CAC7D,QAAQ,KACN,oEAAoE,WAAW,WACpE,0BAA0B,0FAEvC;AACF;AAEA,SAAS,2BAAoC;CAC3C,OAAO,QAAQ,IAAI,kCAAkC;AACvD;AAEA,SAAS,8BAAuC;CAC9C,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa;AAC/D;AAEA,eAAe,8BAA6C;CAC1D,MAAM,YAAY,mBAAmB;CACrC,MAAM,MAAM,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACvD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,WAAW,GAAK;AAEhC;AAEA,eAAe,oBACb,QACA,OACA,SACiB;CACjB,MAAM,UAAU,KAAK,UAAU;EAAE;EAAO;CAAQ,CAAC;CAajD,QAAO,MAZc,WACnB,kBACA;EACE;EACA;EACA;EACA;EACA;EACA;CACF,GACA,OACF,EAAA,CACc,OAAO,KAAK;AAC5B;AAEA,eAAe,WACb,SACA,MACA,cAC6C;CAC7C,IAAI;EACF,MAAM,EAAE,aAAa,MAAM,OAAO;EAwClC,OAAO,MAvCc,IAAI,SACtB,SAAS,WAAW;GACnB,IAAI,SAAS;GACb,IAAI,SAAS;GAEb,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAAC;GAEnE,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GACD,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GAED,MAAM,GAAG,UAAU,UAAU;IAC3B,OAAO,eAAe,OAAO,OAAO,CAAC;GACvC,CAAC;GAED,MAAM,GAAG,UAAU,SAAS;IAC1B,IAAI,SAAS,GAAG;KACd,QAAQ;MAAE;MAAQ;KAAO,CAAC;KAC1B;IACF;IACA,OACE,eACE,EACE,SAAS,mBAAmB,QAAQ,mBAAmB,OACzD,GACA,OACF,CACF;GACF,CAAC;GAED,MAAM,OAAO,MAAM,YAAY;GAC/B,MAAM,OAAO,IAAI;EACnB,CACF;CAEF,SAAS,OAAO;EACd,MAAM,eAAe,OAAO,OAAO;CACrC;AACF;AAEA,SAAS,eACP,OACA,SACoE;CACpE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,uBAAO,IAAI,MAAM,mBAAmB,QAAQ,KAAK,OAAO,KAAK,GAAG;CAElE,MAAM,IAAI;CAKV,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;CACnD,MAAM,eAAe,CAAC,mBAAmB,QAAQ,EAAE;CACnD,IAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,GAChD,aAAa,KAAK,WAAW,EAAE,OAAO,KAAK,GAAG;MACzC,IAAI,EAAE,SACX,aAAa,KAAK,EAAE,OAAO;CAE7B,MAAM,UAAU,IAAI,MAAM,aAAa,KAAK,IAAI,CAAC;CAKjD,QAAQ,OAAO;CACf,QAAQ,SAAS,EAAE;CACnB,QAAQ,SAAS,EAAE;CACnB,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;AAClC;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,gBAAgB,KAAK;CACxC,IAAI,CAAC,uBAAuB,KAAK,UAAU,GACzC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,yBAAyB,OAAwB;CACxD,MAAM,aAAa,sBAAsB,KAAK;CAC9C,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAS,eAAe,OAAqC;CAC3D,IAAI,UAAU,MACZ,OAAO;CAET,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA6C;CAC5E,MAAM,cAAc,eAAe,KAAK;CACxC,IAAI,CAAC,aACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO;EACL;EACA,QAAQ;CACV;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAEf,OAAO,OAAO,KAAK;AACrB;AAEA,SAASA,sBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;AAEV,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;;;;;;;;;;;;ACncV,MAAM,sBAAsB;AAO5B,IAAI,oBAA8C;AAElD,eAAsB,oBACpB,UAAsC,CAAC,GACN;CACjC,MAAM,aAAa,MAAM,yBAAyB;CAClD,QAAQ,WAAW,OAAnB;EACE,KAAK;EACL,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH;EACF,SACE,OAAO;CACX;CACA,IAAI,CAAC,QAAQ,gBACX,OAAO;CAGT,MAAM,mBAAmB,MAAM,0BAA0B,WAAW,OAAO;CAC3E,IAAI,iBAAiB,UAAU,SAC7B,OAAO;CAET,IAAI,iBAAiB,UAAU,WAC7B,OAAO;CAGT,OAAO;EACL,YAAY,mCAAmC,iBAAiB,KAAK;EACrE,OAAO,iBAAiB;EACxB,SAAS;CACX;AACF;AAKA,eAAsB,4BAAoD;CAIxE,MAAM,eAAc,MAHI,oBAAoB,EAC1C,gBAAgB,MAClB,CAAC,CAAC,CAAC,YAAY,IAAI,EAAA,EACY,SAAS,MAAM,IAAI,KAAK,KAAK;CAC5D,OAAO,YAAY,SAAS,IAAI,cAAc;AAChD;AAEA,eAAsB,eAAe,OAanB;CAChB,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAG7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAGzC,MAAM,yBAAyB;CAG/B,MAAM,mBAAmB,mBAAkB,MADb,mBAAmB,EAAA,EACW,QAAQ;CACpE,MAAM,WAAW,MAAM,iBAAiB;EACtC;EACA;EACA;CACF,CAAC;CAED,MAAM,UAAyB;EAC7B,GAAG;EACH;EACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;EACzD;EACA;EACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,GAAG,qBAAqB,MAAM,IAAI;EAClC,GAAG,+BAA+B,MAAM,kBAAkB;CAC5D;CAEA,MAAM,OAAO,gBAAgB;CAC7B,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAEhE,IAAI;EACF,MAAM,+BAA+B;GAAE;GAAa;EAAS,CAAC;EAC9D,MAAM,8BAA8B,MAAM,OAAO;CACnD,SAAS,OAAO;EACd,MAAM,oCAAoC,QAAQ;EAClD,MAAM;CACR;CAEA,iBAAiB;EACf;EACA,SAAS,uBAAuB;GAAE;GAAa;EAAQ,CAAC;CAC1D,CAAC;CACD,IACE,oBACA,CAAC,wBAAwB,kBAAkB,QAAQ,GAEnD,MAAM,oCAAoC,gBAAgB;AAE9D;AAUA,eAAsB,yBAA8D;CAClF,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;CAGT,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,eAAe,YAAY,YAC/B,OAAO;CAGT,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,QAAQ,kBAAkB;CAC9D;AACF;AAEA,eAAsB,oCACpB,oBACe;CACf,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,MAAM,wDAAwD;CAG1E,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,YAAY,aAAa,eAAe,YAAY,YACxD,MAAM,IAAI,MACR,4DACF;CAGF,MAAM,cAA6B;EACjC,GAAG;EACH;EACA;EACA;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,kBAAkB;CACtD;CAEA,MAAM,8BAA8B,gBAAgB,GAAG,WAAW;CAClE,MAAM,uBAAuB,sBAAsB,OAAO;CAC1D,IAAI,sBACF,iBAAiB;EACf,SAAS;EACT,SAAS,uBAAuB;GAC9B,aAAa,qBAAqB;GAClC,SAAS;EACX,CAAC;CACH,CAAC;AAEL;AAEA,eAAsB,mBAAoD;CACxE,oBAAoB;CACpB,MAAM,yBAAyB;CAC/B,MAAM,kBAAkB,MAAM,sBAAsB;CACpD,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,KAAK,iBAAiB,QAAQ,QAAQ,GACvD,MAAM,oCAAoC,QAAQ,QAAQ;CAE5D,MAAM,kBAAkB;CACxB,OAAO,EAAE,gBAAgB;AAC3B;AAEA,eAAe,2BAA0C;CACvD,MAAM,UAAU,MAAM,wBAAwB;CAC9C,IAAI,QAAQ,UAAU,WAAW,GAC/B;CAGF,MAAM,YAA8B,CAAC;CACrC,KAAK,MAAM,YAAY,QAAQ,WAC7B,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,UAAU,KAAK,QAAQ;CACzB;CAEF,MAAM,2BAA2B,SAAS;AAC5C;AAEA,eAAe,oCACb,UACe;CACf,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,MAAM,UAAU,MAAM,wBAAwB;EAC9C,IACE,QAAQ,UAAU,MAAM,QAAQ,wBAAwB,KAAK,QAAQ,CAAC,GAEtE;EAEF,MAAM,2BAA2B,CAAC,GAAG,QAAQ,WAAW,QAAQ,CAAC;CACnE;AACF;AAEA,eAAe,0BAA0D;CACvE,MAAM,MAAM,MAAM,SAAS,wBAAwB,GAAG,MAAM,CAAC,CAAC,OAC3D,UAAU;EACT,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,IAAI,QAAQ,MACV,OAAO;EAAE,GAAG;EAAG,WAAW,CAAC;CAAE;CAG/B,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C;CACjE;CACA,IACE,EAAE,SAAS,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,SAAS,IAEtE,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,YAAY,OAAO,UAAU,OAAO,gBAAgB;CAC1D,IAAI,UAAU,WAAW,OAAO,UAAU,QACxC,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO;EAAE,GAAG;EAAG;CAAU;AAC3B;AAEA,eAAe,2BACb,WACe;CACf,MAAM,OAAO,wBAAwB;CACrC,IAAI,UAAU,WAAW,GAAG;EAC1B,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;EAC9B;CACF;CACA,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAChE,MAAM,oBAAoB,MAAM;EAAE,GAAG;EAAG;CAAU,CAAC;AACrD;AAEA,SAAS,0BAAkC;CACzC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,4BAA4B;AACrE;AAEA,eAAe,wBAA0C;CACvD,IAAI;EACF,MAAM,SAAS,gBAAgB,GAAG,MAAM;EACxC,OAAO;CACT,SAAS,OAAO;EACd,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR;AACF;AAEA,eAAe,2BAA2D;CACxE,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,IAAI,CAAC,UACH,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,aAAa,eAAe,YAAY,YAC5C,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,IAAI,UAAU,sBAAsB,OAAO;CAC3C,IAAI,CAAC,SAAS;EACZ,MAAM,cAAc,MAAM,gBAAgB,QAAQ;EAClD,IAAI,YAAY,WAAW,WACzB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,IAAI,YAAY,WAAW,eACzB,OAAO;GACL,cAAc,YAAY;GAC1B,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,UAAU,uBAAuB;GAC/B,aAAa,YAAY;GACzB,SAAS;IACP,GAAG;IACH,GAAG;IACH;IACA;IACA;IACA;IACA;GACF;EACF,CAAC;EACD,iBAAiB;GAAE;GAAS;EAAQ,CAAC;CACvC;CAEA,IAAI,UAAU,QAAQ,SAAS,GAC7B,OAAO;EACL,YAAY;EACZ,OAAO;EACP;CACF;CAGF,OAAO;EACL,OAAO;EACP;CACF;AACF;AAEA,eAAe,+BAA+B,OAG5B;CAChB,MAAM,WAAW,MAAM,gBAAgB,MAAM,QAAQ;CACrD,IACE,SAAS,WAAW,WACpB,SAAS,gBAAgB,MAAM,aAE/B;CAEF,IAAI,SAAS,WAAW,eACtB,MAAM,IAAI,MACR,8CAA8C,SAAS,cACzD;CAEF,MAAM,IAAI,MAAM,2CAA2C;AAC7D;AAEA,SAAS,uBAAuB,OAGV;CACpB,OAAO;EACL,GAAG;EACH,aAAa,MAAM;EACnB,WAAW,MAAM,QAAQ;EACzB,aAAa,MAAM,QAAQ;EAC3B,UAAU,MAAM,QAAQ;EACxB,WAAW,MAAM,QAAQ;EACzB,GAAI,OAAO,MAAM,QAAQ,cAAc,YACvC,MAAM,QAAQ,UAAU,KAAK,IACzB,EAAE,WAAW,MAAM,QAAQ,UAAU,KAAK,EAAE,IAC5C,CAAC;EACL,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;AACF;AAEA,SAAS,iBAAiB,OAGjB;CACP,oBAAoB;EAClB,YAAY,2BAA2B,MAAM,OAAO;EACpD,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,sBACP,SAC0B;CAC1B,MAAM,aAAa,2BAA2B,OAAO;CACrD,OAAO,mBAAmB,eAAe,aACrC,kBAAkB,UAClB;AACN;AAEA,SAAS,2BAA2B,SAAyC;CAC3E,OAAO,GAAG,gBAAgB,EAAE,IAAI,KAAK,UAAU,OAAO;AACxD;AAEA,SAAS,wBACP,MACA,OACS;CACT,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,kBAAkB,OAAuC;CAChE,IAAI,CAAC,iBAAiB,KAAK,GACzB,OAAO;CAET,OAAO;AACT;AAEA,eAAe,0BACb,SACsC;CACtC,IAAI,WAAW;CACf,IAAI;EACF,WAAW,eAAe,QAAQ,aAAa,uBAAuB;CACxE,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;CACA,IAAI;EACF,MAAM,YAAY,8BAA8B,QAAQ;EACxD,MAAM,WAAW,MAAM,MAAM,UAAU;GACrC,QAAQ;GACR,SAAS,EACP,eAAe,GAAG,mBAAmB,QAAQ,SAAS,EAAE,GAAG,QAAQ,cACrE;GACA,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,EAAE,OAAO,UAAU;EAE5B,IAAI,CAAC,SAAS,IAGZ,OAAO,EAAE,OAAO,UAAU;EAI5B,IAAI,CAAC,wBAAwB,MADP,kBAAkB,QAAQ,CACZ,GAClC,OAAO,EAAE,OAAO,UAAU;EAE5B,OAAO,EAAE,OAAO,QAAQ;CAC1B,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;AACF;AAEA,SAAS,8BAA8B,UAA0B;CAC/D,MAAM,MAAM,eAAe,QAAQ;CACnC,IAAI,OAAO,mBAAmB,IAAI,QAAQ,GACxC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,UAA2B;CACrD,OACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEA,SAAS,wBAAwB,SAA2B;CAC1D,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO;CAGT,OACE,SAAU,QAAoC,OAAO,KACrD,SAAU,QAAoC,IAAI;AAEtD;AAEA,SAAS,UAAU,WAAwC;CACzD,IAAI,CAAC,WACH,OAAO;CAET,MAAM,cAAc,KAAK,MAAM,SAAS;CACxC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO;CAET,OAAO,eAAe,KAAK,IAAI;AACjC;AAEA,SAAS,mCACP,OAC4B;CAC5B,QAAQ,OAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SAEE,MAAM,IAAI,MACR,0CAA0CC,OAC5C;CAEJ;AACF;AAEA,eAAe,qBAA6D;CAC1E,MAAM,MAAM,MAAM,SAAS,gBAAgB,GAAG,MAAM,CAAC,CAAC,YAAY,IAAI;CACtE,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAA0B;CACjC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,cAAc;AACvD;AAEA,eAAe,8BACb,MACA,SACe;CACf,MAAM,oBAAoB,MAAM,OAAO;AACzC;AAEA,eAAe,oBACb,MACA,SACe;CACf,MAAM,WAAW,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CACxE,IAAI;EACF,MAAM,OAAO,MAAM,KAAK,UAAU,MAAM,GAAK;EAC7C,IAAI;GACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;GACpE,MAAM,KAAK,KAAK;EAClB,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;EAEA,MAAM,OAAO,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,MAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EACzD,MAAM;CACR;AACF;AAEA,SAAS,oBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,SAAS,qBAAqB,OAM5B;CACA,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO,CAAC;CAEV,MAAM,SAAS;CACf,MAAM,KAAK,wBAAwB,OAAO,EAAE;CAC5C,MAAM,QAAQ,wBAAwB,OAAO,KAAK;CAClD,MAAM,OAAO,wBAAwB,OAAO,IAAI;CAChD,IAAI,EAAE,MAAM,SAAS,OACnB,OAAO,CAAC;CAEV,OAAO,EACL,MAAM;EACJ,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;EACnB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EACzB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;CACzB,EACF;AACF;AAEA,SAAS,+BAA+B,OAEtC;CACA,MAAM,qBAAqB,kCAAkC,KAAK;CAClE,OAAO,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AACxD;AAEA,SAAgB,kCACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,MAAM,KAAK,wBAAwB,MAAM,EAAE;CAC3C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,WAAW,2BAA2B,KAAK;CACjD,IAAI,EAAE,MAAM,QAAQ,OAClB,OAAO;CAET,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC;AACF;AAeA,SAAS,mBAAmB,OAAuB;CACjD,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA+B;CAC9D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,2BAA2B,OAAyC;CAC3E,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,OAAO;CAIT,OADiB,yBAAyB,MAAM,QAClC,CAAC,EAAE,aAAa;AAChC;AAEA,SAAS,yBACP,UACgC;CAChC,IAAI,aAAa,QAAQ,aAAa,KAAA,GACpC,OAAO;CAGT,IAAI,OAAO,aAAa,UACtB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,QAAQ;EAClC,OAAO,SAAS,MAAM,IAAI,SAAS;CACrC,QAAQ;EACN,OAAO;CACT;CAGF,OAAO,SAAS,QAAQ,IAAI,WAAW;AACzC;AAEA,SAAS,eAAe,SAAiB,UAA0B;CACjE,MAAM,MAAM,IAAI,IAAI,OAAO;CAK3B,IAAI,WAAW,GAJY,IAAI,SAAS,QAAQ,qBAAqB,EAIlC,IAHR,SAAS,WAAW,GAAG,IAC9C,WACA,IAAI,gBACuD;CAC/D,IAAI,SAAS;CACb,IAAI,OAAO;CACX,OAAO,IAAI,SAAS;AACtB;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAEA,eAAe,kBAAkB,UAAsC;CACrE,MAAM,MAAM,MAAM,SAAS,KAAK;CAChC,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO,EAAE,SAAS,IAAI;CACxB;AACF;AAEA,eAAe,oBAAmC;CAChD,MAAM,GAAG,gBAAgB,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7C"}
+{"version":3,"file":"auth-session-p_bMqNdz.js","names":["toErrorMessage","isFileNotFoundError","exhaustiveState"],"sources":["../../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js","../src/strategy-constants.ts","../src/runtime/distribution.ts","../src/config/macos-native-keychain.ts","../src/config/token-store.ts","../src/config/auth-session.ts"],"sourcesContent":["import { z } from \"zod/v4\";\n//#region src/schemas/local-machine/macos-keychain-helper.ts\nconst MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION = 2;\nconst MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = \"disallow\";\nconst macOsKeychainServiceSchema = z.string().trim().min(1).max(512);\nconst macOsKeychainAccountSchema = z.string().trim().min(1).max(512);\nconst macOsKeychainAccessTokenSchema = z.string().min(1).max(65536);\nconst macOsKeychainHelperOperationSchema = z.enum([\n\t\"store\",\n\t\"read\",\n\t\"delete\"\n]);\nconst macOsKeychainHelperRequestSchema = z.discriminatedUnion(\"operation\", [\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"store\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\taccessToken: macOsKeychainAccessTokenSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"read\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz.strictObject({\n\t\tschemaVersion: z.literal(2),\n\t\toperation: z.literal(\"delete\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t})\n]);\nconst macOsKeychainHelperMutationSuccessSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(true),\n\toperation: z.enum([\"store\", \"delete\"])\n});\nconst macOsKeychainHelperReadSuccessSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(true),\n\toperation: z.literal(\"read\"),\n\taccessToken: z.union([macOsKeychainAccessTokenSchema, z.null()])\n});\nconst macOsKeychainHelperErrorSchema = z.strictObject({\n\tschemaVersion: z.literal(2),\n\tok: z.literal(false),\n\toperation: macOsKeychainHelperOperationSchema,\n\terrorMessage: z.string().trim().min(1).max(2048)\n});\nconst macOsKeychainHelperResponseSchema = z.union([\n\tmacOsKeychainHelperMutationSuccessSchema,\n\tmacOsKeychainHelperReadSuccessSchema,\n\tmacOsKeychainHelperErrorSchema\n]);\n//#endregion\nexport { MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION, MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION, macOsKeychainHelperOperationSchema, macOsKeychainHelperRequestSchema, macOsKeychainHelperResponseSchema };\n\n//# sourceMappingURL=macos-keychain-helper.js.map","import { CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from \"@openmeld/schemas\";\n\n// CLI and local daemon timing policy values. Keep this deployment-local; Core\n// and Web have their own constants files even when values intentionally match.\nexport const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 30_000;\nexport const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8000;\nexport const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;\nexport const DEFAULT_WEB_AGENT_SELECTION_TIMEOUT_MS = 30 * 60 * 1000;\nexport const DEFAULT_WEB_AGENT_SELECTION_POLL_INTERVAL_MS = 2000;\nexport const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS = 60_000;\nexport const MIN_SPACE_REQUEST_TIMEOUT_MS = 1000;\nexport const MAX_SPACE_REQUEST_TIMEOUT_MS = 120_000;\nexport const DEFAULT_HEARTBEAT_INTERVAL_MS = 25_000;\nexport const MIN_HEARTBEAT_INTERVAL_MS = 5000;\nexport const MAX_HEARTBEAT_INTERVAL_MS = 60_000;\n// Daemon stream keepalive PING cadence. Sub-idle (below the gateway/Cloudflare\n// idle-eviction window) and independent of the heartbeat, so a quiet daemon\n// socket stays warm even when no heartbeat is due. Carries no lease/readiness.\nexport const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 20_000;\n// Each keepalive PING must see the hub's auto-answered PONG within this\n// window, or the socket is treated as half-open and terminated so the normal\n// reconnect path (which also redelivers in-flight dispatch pushes) can run.\n// Without this deadline a half-open socket is only detected by the heartbeat\n// failure path, which can take ~40s+ at the idle-grown heartbeat interval.\nexport const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 10_000;\nexport const CATALOG_SYNC_INTERVAL_MULTIPLIER = 3;\nexport const MIN_CATALOG_SYNC_INTERVAL_MS = 15_000;\nexport const MAX_CATALOG_SYNC_INTERVAL_MS = 45_000;\nexport const CATALOG_SYNC_RETRY_INTERVAL_MS = 5000;\nexport const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1000;\nexport const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 60_000;\nexport const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15_000;\nexport const REGISTER_RESPONSE_TIMEOUT_MS = 10_000;\nexport const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15_000;\nexport const DAEMON_RUNTIME_CONTRACT_EPOCH =\n  CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;\nexport const OPENCLAW_CLI_TIMEOUT_MS = 30_000;\n","/**\n * Build-time distribution marker.\n *\n * `OpenMeldDistribution` records how this CLI build is shipped and run. It is\n * orthogonal to the runtime lane / env preset (prod | dev-local | canary):\n *\n * - `npm`: shipped as the `openmeld` npm package, run via `node dist/*.js`; the\n *   OpenMeld Service daemon runs as a self-contained node bundle (dist copy +\n *   node_modules dependency closure).\n * - `binary`: shipped as a precompiled single binary (`bun build --compile`),\n *   run and self-installed as one executable; the daemon runs the same binary\n *   via its `service run` subcommand.\n *\n * The value is injected at build time (tsdown defines `\"npm\"`;\n * `scripts/release/build-cli-binary.mjs` defines `\"binary\"` via Bun `--define`)\n * so distribution-mode branching never guesses from paths and cannot be spoofed\n * by a runtime environment variable.\n */\ndeclare const __OPENMELD_DISTRIBUTION__: string | undefined;\n\nexport type OpenMeldDistribution = \"binary\" | \"npm\";\n\nconst BINARY_DISTRIBUTION: OpenMeldDistribution = \"binary\";\nconst NPM_DISTRIBUTION: OpenMeldDistribution = \"npm\";\n\n/**\n * The distribution form this CLI build was compiled for. Falls back to `npm`\n * when the marker is absent (e.g. under Vitest, where no build-time define\n * runs), which keeps the safe, path-independent default.\n */\nexport function resolveOpenMeldDistribution(): OpenMeldDistribution {\n  const injected =\n    typeof __OPENMELD_DISTRIBUTION__ === \"string\"\n      ? __OPENMELD_DISTRIBUTION__\n      : undefined;\n  return injected === BINARY_DISTRIBUTION\n    ? BINARY_DISTRIBUTION\n    : NPM_DISTRIBUTION;\n}\n\nexport function isBinaryDistribution(): boolean {\n  return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;\n}\n","import { spawn } from \"node:child_process\";\nimport { createRequire } from \"node:module\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n  MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n  type MacOsKeychainHelperRequest,\n  macOsKeychainHelperRequestSchema,\n  macOsKeychainHelperResponseSchema,\n} from \"@openmeld/schemas\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\n\nconst MAC_OS_KEYCHAIN_HELPER_ARG = \"__openmeld_macos_keychain_helper\";\nconst HELPER_OUTPUT_MAX_BYTES = 128 * 1024;\nexport const MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS = 5000;\n\ntype MacOsKeychainAddon = {\n  isParentSameExecutable(): boolean;\n  read(service: string, account: string): string | null;\n  remove(service: string, account: string): void;\n  store(service: string, account: string, accessToken: string): void;\n};\n\ntype KeychainAddress = {\n  account: string;\n  service: string;\n};\n\ntype MacOsKeychainHelperRequestInput =\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"read\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"store\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"delete\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >;\ntype MacOsKeychainHelperReadRequestInput = Extract<\n  MacOsKeychainHelperRequestInput,\n  { operation: \"read\" }\n>;\ntype MacOsKeychainHelperMutationRequestInput = Exclude<\n  MacOsKeychainHelperRequestInput,\n  MacOsKeychainHelperReadRequestInput\n>;\n\nlet loadedAddon: MacOsKeychainAddon | null = null;\nlet unresponsiveKeychainError: Error | null = null;\n\nexport async function storeMacOsNativeKeychainToken(\n  input: KeychainAddress & { accessToken: string }\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"store\",\n      service: input.service,\n      account: input.account,\n      accessToken: input.accessToken,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.store(input.service, input.account, input.accessToken);\n}\n\nexport async function readMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<string | null> {\n  if (isBinaryDistribution()) {\n    return await runBoundedMacOsNativeKeychainRequest({\n      operation: \"read\",\n      service: input.service,\n      account: input.account,\n    });\n  }\n  const addon = await loadAddon();\n  return addon.read(input.service, input.account);\n}\n\nexport async function deleteMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"delete\",\n      service: input.service,\n      account: input.account,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.remove(input.service, input.account);\n}\n\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperReadRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<string | null>;\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperMutationRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<undefined>;\nexport async function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperRequestInput,\n  options: { timeoutMs?: number } = {}\n): Promise<string | null | undefined> {\n  const request = macOsKeychainHelperRequestSchema.parse({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n    ...input,\n  });\n  const timeoutMs = options.timeoutMs ?? MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS;\n  if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) {\n    throw new Error(\"macOS Keychain helper timeout must be a positive integer\");\n  }\n\n  return await new Promise<string | null | undefined>((resolve, reject) => {\n    const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {\n      env: process.env,\n      shell: false,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      windowsHide: true,\n    });\n    let settled = false;\n    let stdout = \"\";\n    let stderr = \"\";\n\n    const clearDeadline = () => {\n      clearTimeout(deadline);\n    };\n    const rejectOnce = (error: Error) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearDeadline();\n      reject(error);\n    };\n    const deadline = setTimeout(() => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      child.kill(\"SIGKILL\");\n      reject(\n        new MacOsNativeKeychainTimeoutError(\n          `macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`\n        )\n      );\n    }, timeoutMs);\n\n    child.stdout.setEncoding(\"utf8\");\n    child.stderr.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: unknown) => {\n      stdout += String(chunk);\n      if (Buffer.byteLength(stdout, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        child.kill(\"SIGKILL\");\n        rejectOnce(new Error(\"macOS Keychain helper output was too large\"));\n      }\n    });\n    child.stderr.on(\"data\", (chunk: unknown) => {\n      stderr += String(chunk);\n      if (Buffer.byteLength(stderr, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        stderr = stderr.slice(-HELPER_OUTPUT_MAX_BYTES);\n      }\n    });\n    child.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper could not start: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.stdin.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper input failed: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.once(\"close\", (code) => {\n      if (settled) {\n        return;\n      }\n      clearDeadline();\n      settled = true;\n      try {\n        resolve(\n          parseMacOsKeychainHelperResult({\n            code,\n            operation: request.operation,\n            stderr,\n            stdout,\n          })\n        );\n      } catch (error) {\n        reject(toError(error));\n      }\n    });\n\n    child.stdin.end(JSON.stringify(request), \"utf8\");\n  });\n}\n\nexport async function runMacOsNativeKeychainHelperIfRequested(\n  argv: readonly string[] = process.argv\n): Promise<boolean> {\n  if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) {\n    return false;\n  }\n  if (!(isBinaryDistribution() && process.platform === \"darwin\")) {\n    throw new Error(\n      \"the internal macOS Keychain helper is only available in the macOS binary\"\n    );\n  }\n\n  const addon = await loadAddon();\n  if (!addon.isParentSameExecutable()) {\n    throw new Error(\n      \"the internal macOS Keychain helper is reserved for an OpenMeld child process\"\n    );\n  }\n\n  const rawRequest = await readHelperStdin();\n  let json: unknown;\n  try {\n    json = JSON.parse(rawRequest);\n  } catch {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n  const request = macOsKeychainHelperRequestSchema.safeParse(json);\n  if (!request.success) {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n\n  const response = await executeHelperRequest(request.data).catch((error) => ({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: false as const,\n    operation: request.data.operation,\n    errorMessage: truncateErrorMessage(toErrorMessage(error)),\n  }));\n  process.stdout.write(JSON.stringify(response));\n  return true;\n}\n\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperReadRequestInput\n): Promise<string | null>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperMutationRequestInput\n): Promise<undefined>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperRequestInput\n): Promise<string | null | undefined> {\n  if (unresponsiveKeychainError) {\n    throw unresponsiveKeychainError;\n  }\n  try {\n    if (input.operation === \"read\") {\n      return await runMacOsNativeKeychainRequestInChild(input);\n    }\n    await runMacOsNativeKeychainRequestInChild(input);\n  } catch (error) {\n    if (error instanceof MacOsNativeKeychainTimeoutError) {\n      unresponsiveKeychainError = error;\n    }\n    throw error;\n  }\n}\n\nfunction parseMacOsKeychainHelperResult(input: {\n  code: number | null;\n  operation: MacOsKeychainHelperRequest[\"operation\"];\n  stderr: string;\n  stdout: string;\n}): string | null | undefined {\n  if (input.code !== 0) {\n    throw new Error(\n      `macOS Keychain helper exited with code ${input.code ?? \"unknown\"}${\n        input.stderr.trim() ? `: ${input.stderr.trim()}` : \"\"\n      }`\n    );\n  }\n\n  let rawResponse: unknown;\n  try {\n    rawResponse = JSON.parse(input.stdout);\n  } catch {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);\n  if (!(parsed.success && parsed.data.operation === input.operation)) {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  if (!parsed.data.ok) {\n    throw new Error(parsed.data.errorMessage);\n  }\n  return parsed.data.operation === \"read\" ? parsed.data.accessToken : undefined;\n}\n\nasync function executeHelperRequest(input: MacOsKeychainHelperRequest) {\n  const addon = await loadAddon();\n  if (input.operation === \"store\") {\n    addon.store(input.service, input.account, input.accessToken);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"store\" as const,\n    };\n  }\n  if (input.operation === \"delete\") {\n    addon.remove(input.service, input.account);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"delete\" as const,\n    };\n  }\n  return {\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: true as const,\n    operation: \"read\" as const,\n    accessToken: addon.read(input.service, input.account),\n  };\n}\n\nasync function readHelperStdin(): Promise<string> {\n  let raw = \"\";\n  process.stdin.setEncoding(\"utf8\");\n  for await (const chunk of process.stdin) {\n    raw += String(chunk);\n    if (Buffer.byteLength(raw, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n      throw new Error(\"macOS Keychain helper request was too large\");\n    }\n  }\n  return raw;\n}\n\nfunction truncateErrorMessage(message: string): string {\n  const normalized = message.trim() || \"macOS Keychain operation failed\";\n  return normalized.slice(0, 2048);\n}\n\nfunction formatTimeout(timeoutMs: number): string {\n  return timeoutMs % 1000 === 0\n    ? `${timeoutMs / 1000} seconds`\n    : `${timeoutMs} ms`;\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\nclass MacOsNativeKeychainTimeoutError extends Error {\n  override readonly name = \"MacOsNativeKeychainTimeoutError\";\n}\n\nasync function loadAddon(): Promise<MacOsKeychainAddon> {\n  if (loadedAddon) {\n    return loadedAddon;\n  }\n  if (process.platform !== \"darwin\") {\n    throw new Error(\"macOS Keychain is only available on macOS\");\n  }\n\n  if (isBinaryDistribution()) {\n    const embedded = await import(\"./macos-native-keychain-embedded\");\n    loadedAddon = embedded.loadEmbeddedMacOsKeychainAddon();\n    return loadedAddon;\n  }\n\n  const require = createRequire(import.meta.url);\n  const addonPath = fileURLToPath(\n    new URL(\"./native/openmeld-keychain.node\", import.meta.url)\n  );\n  loadedAddon = require(addonPath) as MacOsKeychainAddon;\n  return loadedAddon;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\nimport {\n  deleteMacOsNativeKeychainToken,\n  readMacOsNativeKeychainToken,\n  storeMacOsNativeKeychainToken,\n} from \"./macos-native-keychain\";\nimport { openMeldRootDir } from \"./paths\";\n\nconst TOKEN_STORE_KEYCHAIN_SERVICE = \"sh.openmeld.auth.token\";\nconst INSECURE_FALLBACK_ENV_KEY = \"OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN\";\nconst FORCE_INSECURE_STORE_ENV_KEY = \"OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN\";\nconst MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE =\n  \"macOS Keychain access is unavailable in this OpenMeld distribution. \" +\n  \"OpenMeld will not open an authorization window from an unattended process. \" +\n  \"Run setup or login with the current packaged OpenMeld CLI.\";\nconst COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;\nconst EXEC_FILE_BASE_OPTIONS = {\n  windowsHide: true,\n  maxBuffer: COMMAND_MAX_BUFFER_BYTES,\n  timeout: COMMAND_TIMEOUT_MS,\n} as const;\nlet insecureFallbackWarningShown = false;\nlet macOsPrivateStorageWarningShown = false;\n\ntype MacOsTokenRef = {\n  provider: \"macos-keychain\";\n  service: string;\n  account: string;\n};\n\ntype WindowsDpapiTokenRef = {\n  provider: \"windows-dpapi\";\n  key: string;\n};\n\ntype InsecureFileTokenRef = {\n  provider: \"insecure-file\";\n  key: string;\n};\n\nexport type StoredTokenRef =\n  | MacOsTokenRef\n  | WindowsDpapiTokenRef\n  | InsecureFileTokenRef;\n\nexport type AccessTokenReadResult =\n  | {\n      accessToken: string;\n      status: \"found\";\n    }\n  | {\n      status: \"missing\";\n    }\n  | {\n      errorMessage: string;\n      status: \"unavailable\";\n    };\n\ntype StoreTokenInput = {\n  accessToken: string;\n  authBaseUrl: string;\n  clientId: string;\n};\n\nexport async function storeAccessToken(\n  input: StoreTokenInput\n): Promise<StoredTokenRef> {\n  const key = buildTokenKey({\n    authBaseUrl: input.authBaseUrl,\n    clientId: input.clientId,\n  });\n\n  if (shouldForceInsecureStore()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  if (process.platform === \"darwin\") {\n    try {\n      const account = buildUniqueMacOsAccount(key);\n      if (shouldUseNativeMacOsKeychain()) {\n        await storeMacOsNativeKeychainToken({\n          account,\n          service: TOKEN_STORE_KEYCHAIN_SERVICE,\n          accessToken: input.accessToken,\n        });\n      } else {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      return {\n        provider: \"macos-keychain\",\n        service: TOKEN_STORE_KEYCHAIN_SERVICE,\n        account,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      const privateKey = buildUniqueTokenFileKey(key);\n      await setInsecureFileToken({\n        key: privateKey,\n        accessToken: input.accessToken,\n      });\n      warnMacOsPrivateStorageFallback(error);\n      return { provider: \"insecure-file\", key: privateKey };\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      await setWindowsDpapiToken({\n        key,\n        accessToken: input.accessToken,\n      });\n      return {\n        provider: \"windows-dpapi\",\n        key,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      throw new Error(\n        `failed to store access token via Windows DPAPI: ${toErrorMessage(error)}`\n      );\n    }\n  }\n\n  if (allowInsecureFallback()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  throw new Error(\n    `secure token storage is unavailable on platform \"${process.platform}\". ` +\n      `Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`\n  );\n}\n\nexport async function readAccessToken(\n  ref: StoredTokenRef\n): Promise<AccessTokenReadResult> {\n  try {\n    if (ref.provider === \"macos-keychain\") {\n      if (!shouldUseNativeMacOsKeychain()) {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      const token = await readMacOsNativeKeychainToken(ref);\n      return toAccessTokenReadResult(token);\n    }\n    if (ref.provider === \"windows-dpapi\") {\n      return toAccessTokenReadResult(await getWindowsDpapiToken(ref));\n    }\n    if (ref.provider === \"insecure-file\") {\n      return toAccessTokenReadResult(await getInsecureFileToken(ref));\n    }\n    return { status: \"missing\" };\n  } catch (error) {\n    return {\n      errorMessage: toErrorMessage(error),\n      status: \"unavailable\",\n    };\n  }\n}\n\nexport async function deleteAccessToken(ref: StoredTokenRef): Promise<void> {\n  if (ref.provider === \"macos-keychain\") {\n    if (!shouldUseNativeMacOsKeychain()) {\n      throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n    }\n    await deleteMacOsNativeKeychainToken(ref);\n    return;\n  }\n  if (ref.provider === \"windows-dpapi\") {\n    await deleteWindowsDpapiToken(ref);\n    return;\n  }\n  if (ref.provider === \"insecure-file\") {\n    await deleteInsecureFileToken(ref);\n  }\n}\n\nexport function isStoredTokenRef(value: unknown): value is StoredTokenRef {\n  if (!(value && typeof value === \"object\")) {\n    return false;\n  }\n  const record = value as Record<string, unknown>;\n  const provider = normalizeString(record.provider);\n  if (provider === \"macos-keychain\") {\n    return Boolean(\n      normalizeString(record.service) &&\n        normalizeString(record.account) &&\n        record.accessGroup === undefined\n    );\n  }\n  if (provider === \"windows-dpapi\" || provider === \"insecure-file\") {\n    return normalizeTokenFileKey(record.key) !== null;\n  }\n  return false;\n}\n\nfunction buildTokenKey(input: {\n  authBaseUrl: string;\n  clientId: string;\n}): string {\n  const rootDir = resolve(openMeldRootDir());\n  return createHash(\"sha256\")\n    .update(`${input.clientId}\\n${input.authBaseUrl}\\n${rootDir}`)\n    .digest(\"hex\");\n}\n\nfunction buildUniqueMacOsAccount(key: string): string {\n  return `openmeld-auth-${key}-${randomUUID()}`;\n}\n\nfunction buildUniqueTokenFileKey(key: string): string {\n  return createHash(\"sha256\").update(`${key}\\n${randomUUID()}`).digest(\"hex\");\n}\n\nfunction shouldUseNativeMacOsKeychain(): boolean {\n  return isBinaryDistribution();\n}\n\nasync function setWindowsDpapiToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  const encrypted = await runPowerShellScript(\n    WINDOWS_DPAPI_ENCRYPT_SCRIPT,\n    input.accessToken,\n    input.key\n  );\n  await mkdir(tokenDirectoryPath(), { recursive: true });\n  // NOTE: `mode: 0o600` is POSIX-only and Windows ignores it.\n  // For `tokenDirectoryPath()` + `windowsDpapiTokenPath()` we rely on DPAPI\n  // and Windows ACLs for equivalent protection.\n  await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n}\n\nasync function getWindowsDpapiToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const encrypted = await readFile(\n    windowsDpapiTokenPath(input.key),\n    \"utf8\"\n  ).catch((error) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw error;\n  });\n  if (!encrypted) {\n    return null;\n  }\n  return runPowerShellScript(\n    WINDOWS_DPAPI_DECRYPT_SCRIPT,\n    encrypted.trim(),\n    input.key\n  );\n}\n\nasync function deleteWindowsDpapiToken(input: { key: string }): Promise<void> {\n  await rm(windowsDpapiTokenPath(input.key), { force: true });\n}\n\nasync function setInsecureFileToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  await ensurePrivateTokenDirectory();\n  const path = insecureTokenPath(input.key);\n  await writeFile(path, `${input.accessToken}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  if (process.platform !== \"win32\") {\n    await chmod(path, 0o600);\n  }\n}\n\nasync function getInsecureFileToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const raw = await readFile(insecureTokenPath(input.key), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  return raw ? raw.trim() : null;\n}\n\nasync function deleteInsecureFileToken(input: { key: string }): Promise<void> {\n  await rm(insecureTokenPath(input.key), { force: true });\n}\n\nfunction tokenDirectoryPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"tokens\");\n}\n\nfunction windowsDpapiTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);\n}\n\nfunction insecureTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);\n}\n\nfunction allowInsecureFallback(): boolean {\n  if (process.env[INSECURE_FALLBACK_ENV_KEY] === \"1\") {\n    warnInsecureFallback(\"env\");\n    return true;\n  }\n  // Known downgrade behavior:\n  // On platforms without native secure-store support, OpenMeld currently falls back\n  // to local file token storage by default for compatibility.\n  const fallbackEnabled = !isNativeSecureStorePlatform();\n  if (fallbackEnabled) {\n    warnInsecureFallback(\"platform\");\n  }\n  return fallbackEnabled;\n}\n\nfunction warnMacOsPrivateStorageFallback(error: unknown): void {\n  if (macOsPrivateStorageWarningShown) {\n    return;\n  }\n  macOsPrivateStorageWarningShown = true;\n  const storageExpectation = isBinaryDistribution()\n    ? \"This session stays in private local storage unless a later sign-in replaces it.\"\n    : \"This npm installation cannot use macOS Keychain. This session stays in private local storage.\";\n  console.warn(\n    \"[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this \" +\n      \"session in a private file protected for your macOS user account, so \" +\n      \"setup can continue. \" +\n      `${storageExpectation} Details: ${toErrorMessage(error)}`\n  );\n}\n\nfunction warnInsecureFallback(reason: \"env\" | \"platform\"): void {\n  if (insecureFallbackWarningShown) {\n    return;\n  }\n  insecureFallbackWarningShown = true;\n\n  const reasonText =\n    reason === \"env\"\n      ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1`\n      : `enabled automatically on platform \"${process.platform}\"`;\n  console.warn(\n    `[openmeld auth] plaintext file token storage fallback is active (${reasonText}). ` +\n      `Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, ` +\n      \"and prefer macOS or Windows for native secure token storage.\"\n  );\n}\n\nfunction shouldForceInsecureStore(): boolean {\n  return process.env[FORCE_INSECURE_STORE_ENV_KEY] === \"1\";\n}\n\nfunction isNativeSecureStorePlatform(): boolean {\n  return process.platform === \"darwin\" || process.platform === \"win32\";\n}\n\nasync function ensurePrivateTokenDirectory(): Promise<void> {\n  const directory = tokenDirectoryPath();\n  await mkdir(directory, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\") {\n    await chmod(directory, 0o700);\n  }\n}\n\nasync function runPowerShellScript(\n  script: string,\n  token: string,\n  entropy: string\n): Promise<string> {\n  const payload = JSON.stringify({ token, entropy });\n  const result = await runCommand(\n    \"powershell.exe\",\n    [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-ExecutionPolicy\",\n      \"Bypass\",\n      \"-Command\",\n      script,\n    ],\n    payload\n  );\n  return result.stdout.trim();\n}\n\nasync function runCommand(\n  command: string,\n  args: string[],\n  stdinPayload: string\n): Promise<{ stdout: string; stderr: string }> {\n  try {\n    const { execFile } = await import(\"node:child_process\");\n    const output = await new Promise<{ stdout: string; stderr: string }>(\n      (resolve, reject) => {\n        let stdout = \"\";\n        let stderr = \"\";\n\n        const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });\n\n        child.stdout?.setEncoding(\"utf8\");\n        child.stderr?.setEncoding(\"utf8\");\n        child.stdout?.on(\"data\", (chunk: unknown) => {\n          stdout += String(chunk);\n        });\n        child.stderr?.on(\"data\", (chunk: unknown) => {\n          stderr += String(chunk);\n        });\n\n        child.on(\"error\", (error) => {\n          reject(toCommandError(error, command));\n        });\n\n        child.on(\"close\", (code) => {\n          if (code === 0) {\n            resolve({ stdout, stderr });\n            return;\n          }\n          reject(\n            toCommandError(\n              {\n                message: `command failed (${command}) with exit code ${code}`,\n              },\n              command\n            )\n          );\n        });\n\n        child.stdin?.write(stdinPayload);\n        child.stdin?.end();\n      }\n    );\n    return output;\n  } catch (error) {\n    throw toCommandError(error, command);\n  }\n}\n\nfunction toCommandError(\n  error: unknown,\n  command: string\n): Error & { code?: number | null; stdout?: string; stderr?: string } {\n  if (!(error && typeof error === \"object\")) {\n    return new Error(`command failed (${command}): ${String(error)}`);\n  }\n  const e = error as NodeJS.ErrnoException & {\n    stdout?: string;\n    stderr?: string;\n    code?: number | null | string;\n  };\n  const code = typeof e.code === \"number\" ? e.code : null;\n  const messageParts = [`command failed (${command})`];\n  if (typeof e.stderr === \"string\" && e.stderr.trim()) {\n    messageParts.push(`stderr: ${e.stderr.trim()}`);\n  } else if (e.message) {\n    messageParts.push(e.message);\n  }\n  const wrapped = new Error(messageParts.join(\"; \")) as Error & {\n    code?: number | null;\n    stdout?: string;\n    stderr?: string;\n  };\n  wrapped.code = code;\n  wrapped.stdout = e.stdout;\n  wrapped.stderr = e.stderr;\n  return wrapped;\n}\n\nfunction normalizeString(value: unknown): string {\n  return String(value ?? \"\").trim();\n}\n\nfunction normalizeTokenFileKey(value: unknown): string | null {\n  const normalized = normalizeString(value);\n  if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction requireValidTokenFileKey(value: unknown): string {\n  const normalized = normalizeTokenFileKey(value);\n  if (normalized === null) {\n    throw new Error(\"stored token key is invalid\");\n  }\n  return normalized;\n}\n\nfunction normalizeToken(value: string | null): string | null {\n  if (value === null) {\n    return null;\n  }\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction toAccessTokenReadResult(value: string | null): AccessTokenReadResult {\n  const accessToken = normalizeToken(value);\n  if (!accessToken) {\n    return { status: \"missing\" };\n  }\n  return {\n    accessToken,\n    status: \"found\",\n  };\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  return String(error);\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nconst WINDOWS_DPAPI_ENCRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Convert]::ToBase64String($cipher)\",\n].join(\";\");\n\nconst WINDOWS_DPAPI_DECRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$cipher=[System.Convert]::FromBase64String($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Text.Encoding]::UTF8.GetString($plain)\",\n].join(\";\");\n","import { randomUUID } from \"node:crypto\";\nimport { mkdir, open, readFile, rename, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  DEFAULT_REMOTE_SESSION_TIMEOUT_MS,\n  LOOPBACK_REMOTE_SESSION_TIMEOUT_MS,\n} from \"../strategy-constants\";\nimport { openMeldRootDir } from \"./paths\";\nimport {\n  deleteAccessToken,\n  isStoredTokenRef,\n  readAccessToken,\n  type StoredTokenRef,\n  storeAccessToken,\n} from \"./token-store\";\n\ntype AuthSessionV1 = {\n  v: 1;\n  tokenRef: StoredTokenRef;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype PendingTokenCleanupV1 = {\n  v: 1;\n  tokenRefs: StoredTokenRef[];\n};\n\nexport type ClearAuthSessionResult = {\n  hadLocalSession: boolean;\n};\n\nexport type StoredActiveOrganization = {\n  id: string;\n  slug: string;\n  name: string;\n  role?: string;\n  personal?: boolean;\n};\n\nexport type StoredAuthSession = {\n  v: 1;\n  accessToken: string;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type AuthSessionState =\n  | \"missing\"\n  | \"valid\"\n  | \"expired\"\n  | \"invalid\"\n  | \"revoked\";\n\nexport type AuthSessionStateReasonCode =\n  | \"remote_session_invalid\"\n  | \"remote_session_revoked\"\n  | \"session_expired\"\n  | \"session_metadata_invalid\"\n  | \"session_missing\"\n  | \"session_token_missing\"\n  | \"session_token_ref_invalid\"\n  | \"session_token_unavailable\";\n\nexport type AuthSessionStateResult = {\n  errorMessage?: string;\n  reasonCode?: AuthSessionStateReasonCode;\n  state: AuthSessionState;\n  session: StoredAuthSession | null;\n};\n\nexport type AuthSessionMetadata = {\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype GetAuthSessionStateOptions = {\n  validateRemote?: boolean;\n};\n\ntype LocalAuthSessionState =\n  | {\n      errorMessage?: string;\n      reasonCode: Exclude<\n        AuthSessionStateReasonCode,\n        \"remote_session_invalid\" | \"remote_session_revoked\" | \"session_expired\"\n      >;\n      state: \"missing\" | \"invalid\";\n      session: null;\n    }\n  | {\n      reasonCode: \"session_expired\";\n      state: \"expired\";\n      session: StoredAuthSession;\n    }\n  | {\n      state: \"valid\";\n      session: StoredAuthSession;\n    };\n\ntype RemoteAuthSessionState = \"valid\" | \"invalid\" | \"revoked\" | \"unknown\";\ntype RemoteAuthSessionValidation = {\n  state: RemoteAuthSessionState;\n};\nconst TRAILING_SLASHES_RE = /\\/+$/u;\n\ntype CachedAuthSession = {\n  payloadKey: string;\n  session: StoredAuthSession;\n};\n\nlet cachedAuthSession: CachedAuthSession | null = null;\n\nexport async function getAuthSessionState(\n  options: GetAuthSessionStateOptions = {}\n): Promise<AuthSessionStateResult> {\n  const localState = await getLocalAuthSessionState();\n  switch (localState.state) {\n    case \"missing\":\n    case \"invalid\":\n    case \"expired\":\n      return localState;\n    case \"valid\":\n      break;\n    default:\n      return localState;\n  }\n  if (!options.validateRemote) {\n    return localState;\n  }\n\n  const remoteValidation = await getRemoteAuthSessionState(localState.session);\n  if (remoteValidation.state === \"valid\") {\n    return localState;\n  }\n  if (remoteValidation.state === \"unknown\") {\n    return localState;\n  }\n\n  return {\n    reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),\n    state: remoteValidation.state,\n    session: null,\n  };\n}\n\n// The signed-in owner user id from the local session, or null when signed\n// out. Callers use this as the expected owner for service account-alignment\n// checks; it never validates remotely.\nexport async function getCurrentAuthOwnerUserId(): Promise<string | null> {\n  const authState = await getAuthSessionState({\n    validateRemote: false,\n  }).catch(() => null);\n  const ownerUserId = authState?.session?.user?.id?.trim() ?? \"\";\n  return ownerUserId.length > 0 ? ownerUserId : null;\n}\n\nexport async function setAuthSession(input: {\n  accessToken: string;\n  tokenType?: string;\n  authBaseUrl: string;\n  clientId: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization | null;\n}): Promise<void> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  await retryPendingTokenCleanup();\n\n  const previousPayload = await readSessionPayload();\n  const previousTokenRef = normalizeTokenRef(previousPayload?.tokenRef);\n  const tokenRef = await storeAccessToken({\n    accessToken,\n    authBaseUrl,\n    clientId,\n  });\n\n  const payload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n    authBaseUrl,\n    clientId,\n    createdAt: new Date().toISOString(),\n    ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    ...buildAuthUserPayload(input.user),\n    ...buildActiveOrganizationPayload(input.activeOrganization),\n  };\n\n  const path = authSessionPath();\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n\n  try {\n    await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n    await writeSessionPayloadAtomically(path, payload);\n  } catch (error) {\n    await deleteAccessTokenOrRetainForCleanup(tokenRef);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload,\n    session: buildStoredAuthSession({ accessToken, payload }),\n  });\n  if (\n    previousTokenRef &&\n    !areStoredTokenRefsEqual(previousTokenRef, tokenRef)\n  ) {\n    await deleteAccessTokenOrRetainForCleanup(previousTokenRef);\n  }\n}\n\nexport async function getAuthSession(): Promise<StoredAuthSession | null> {\n  const localState = await getLocalAuthSessionState();\n  if (localState.state === \"missing\" || localState.state === \"invalid\") {\n    return null;\n  }\n  return localState.session;\n}\n\nexport async function getAuthSessionMetadata(): Promise<AuthSessionMetadata | null> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return null;\n  }\n\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(authBaseUrl && clientId && createdAt)) {\n    return null;\n  }\n\n  return {\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(payload.activeOrganization),\n  };\n}\n\nexport async function updateAuthSessionActiveOrganization(\n  activeOrganization: StoredActiveOrganization | null\n): Promise<void> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    throw new Error(\"cannot update active organization without auth session\");\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) {\n    throw new Error(\n      \"cannot update active organization for invalid auth session\"\n    );\n  }\n\n  const nextPayload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType,\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(activeOrganization),\n  };\n\n  await writeSessionPayloadAtomically(authSessionPath(), nextPayload);\n  const currentCachedSession = readCachedAuthSession(payload);\n  if (currentCachedSession) {\n    cacheAuthSession({\n      payload: nextPayload,\n      session: buildStoredAuthSession({\n        accessToken: currentCachedSession.accessToken,\n        payload: nextPayload,\n      }),\n    });\n  }\n}\n\nexport async function clearAuthSession(): Promise<ClearAuthSessionResult> {\n  cachedAuthSession = null;\n  await retryPendingTokenCleanup();\n  const hadLocalSession = await authSessionFileExists();\n  const payload = await readSessionPayload();\n  if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) {\n    await deleteAccessTokenOrRetainForCleanup(payload.tokenRef);\n  }\n  await removeSessionFile();\n  return { hadLocalSession };\n}\n\nasync function retryPendingTokenCleanup(): Promise<void> {\n  const pending = await readPendingTokenCleanup();\n  if (pending.tokenRefs.length === 0) {\n    return;\n  }\n\n  const remaining: StoredTokenRef[] = [];\n  for (const tokenRef of pending.tokenRefs) {\n    try {\n      await deleteAccessToken(tokenRef);\n    } catch {\n      remaining.push(tokenRef);\n    }\n  }\n  await persistPendingTokenCleanup(remaining);\n}\n\nasync function deleteAccessTokenOrRetainForCleanup(\n  tokenRef: StoredTokenRef\n): Promise<void> {\n  try {\n    await deleteAccessToken(tokenRef);\n  } catch {\n    const pending = await readPendingTokenCleanup();\n    if (\n      pending.tokenRefs.some((ref) => areStoredTokenRefsEqual(ref, tokenRef))\n    ) {\n      return;\n    }\n    await persistPendingTokenCleanup([...pending.tokenRefs, tokenRef]);\n  }\n}\n\nasync function readPendingTokenCleanup(): Promise<PendingTokenCleanupV1> {\n  const raw = await readFile(pendingTokenCleanupPath(), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  if (raw === null) {\n    return { v: 1, tokenRefs: [] };\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  if (\n    !(isRecord(parsed) && parsed.v === 1 && Array.isArray(parsed.tokenRefs))\n  ) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  const tokenRefs = parsed.tokenRefs.filter(isStoredTokenRef);\n  if (tokenRefs.length !== parsed.tokenRefs.length) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  return { v: 1, tokenRefs };\n}\n\nasync function persistPendingTokenCleanup(\n  tokenRefs: StoredTokenRef[]\n): Promise<void> {\n  const path = pendingTokenCleanupPath();\n  if (tokenRefs.length === 0) {\n    await rm(path, { force: true });\n    return;\n  }\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n  await writeJsonAtomically(path, { v: 1, tokenRefs });\n}\n\nfunction pendingTokenCleanupPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"pending-token-cleanup.json\");\n}\n\nasync function authSessionFileExists(): Promise<boolean> {\n  try {\n    await readFile(authSessionPath(), \"utf8\");\n    return true;\n  } catch (error) {\n    if (isFileNotFoundError(error)) {\n      return false;\n    }\n    throw error;\n  }\n}\n\nasync function getLocalAuthSessionState(): Promise<LocalAuthSessionState> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return {\n      reasonCode: \"session_missing\",\n      state: \"missing\",\n      session: null,\n    };\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  if (!tokenRef) {\n    return {\n      reasonCode: \"session_token_ref_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenType && authBaseUrl && clientId && createdAt)) {\n    return {\n      reasonCode: \"session_metadata_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  let session = readCachedAuthSession(payload);\n  if (!session) {\n    const accessToken = await readAccessToken(tokenRef);\n    if (accessToken.status === \"missing\") {\n      return {\n        reasonCode: \"session_token_missing\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    if (accessToken.status === \"unavailable\") {\n      return {\n        errorMessage: accessToken.errorMessage,\n        reasonCode: \"session_token_unavailable\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    session = buildStoredAuthSession({\n      accessToken: accessToken.accessToken,\n      payload: {\n        ...payload,\n        v: 1,\n        tokenRef,\n        tokenType,\n        authBaseUrl,\n        clientId,\n        createdAt,\n      },\n    });\n    cacheAuthSession({ payload, session });\n  }\n\n  if (isExpired(session.expiresAt)) {\n    return {\n      reasonCode: \"session_expired\",\n      state: \"expired\",\n      session,\n    };\n  }\n\n  return {\n    state: \"valid\",\n    session,\n  };\n}\n\nasync function assertStoredAccessTokenReloads(input: {\n  accessToken: string;\n  tokenRef: StoredTokenRef;\n}): Promise<void> {\n  const reloaded = await readAccessToken(input.tokenRef);\n  if (\n    reloaded.status === \"found\" &&\n    reloaded.accessToken === input.accessToken\n  ) {\n    return;\n  }\n  if (reloaded.status === \"unavailable\") {\n    throw new Error(\n      `stored access token could not be reloaded: ${reloaded.errorMessage}`\n    );\n  }\n  throw new Error(\"stored access token could not be reloaded\");\n}\n\nfunction buildStoredAuthSession(input: {\n  accessToken: string;\n  payload: AuthSessionV1;\n}): StoredAuthSession {\n  return {\n    v: 1,\n    accessToken: input.accessToken,\n    tokenType: input.payload.tokenType,\n    authBaseUrl: input.payload.authBaseUrl,\n    clientId: input.payload.clientId,\n    createdAt: input.payload.createdAt,\n    ...(typeof input.payload.expiresAt === \"string\" &&\n    input.payload.expiresAt.trim()\n      ? { expiresAt: input.payload.expiresAt.trim() }\n      : {}),\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n}\n\nfunction cacheAuthSession(input: {\n  payload: Partial<AuthSessionV1>;\n  session: StoredAuthSession;\n}): void {\n  cachedAuthSession = {\n    payloadKey: buildAuthSessionPayloadKey(input.payload),\n    session: input.session,\n  };\n}\n\nfunction readCachedAuthSession(\n  payload: Partial<AuthSessionV1>\n): StoredAuthSession | null {\n  const payloadKey = buildAuthSessionPayloadKey(payload);\n  return cachedAuthSession?.payloadKey === payloadKey\n    ? cachedAuthSession.session\n    : null;\n}\n\nfunction buildAuthSessionPayloadKey(payload: Partial<AuthSessionV1>): string {\n  return `${authSessionPath()}\\n${JSON.stringify(payload)}`;\n}\n\nfunction areStoredTokenRefsEqual(\n  left: StoredTokenRef,\n  right: StoredTokenRef\n): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction normalizeTokenRef(input: unknown): StoredTokenRef | null {\n  if (!isStoredTokenRef(input)) {\n    return null;\n  }\n  return input;\n}\n\nasync function getRemoteAuthSessionState(\n  session: StoredAuthSession\n): Promise<RemoteAuthSessionValidation> {\n  let endpoint = \"\";\n  try {\n    endpoint = toAuthEndpoint(session.authBaseUrl, \"/api/auth/get-session\");\n  } catch {\n    return { state: \"invalid\" };\n  }\n  try {\n    const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);\n    const response = await fetch(endpoint, {\n      method: \"GET\",\n      headers: {\n        Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}`,\n      },\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n\n    if (response.status === 401 || response.status === 403) {\n      return { state: \"revoked\" };\n    }\n    if (!response.ok) {\n      // Preserve local credentials on upstream/transient failures.\n      // Non-auth HTTP errors should be retried instead of treated as revocation.\n      return { state: \"unknown\" };\n    }\n\n    const payload = await parseResponseJson(response);\n    if (!hasActiveSessionPayload(payload)) {\n      return { state: \"invalid\" };\n    }\n    return { state: \"valid\" };\n  } catch {\n    return { state: \"unknown\" };\n  }\n}\n\nfunction resolveRemoteSessionTimeoutMs(endpoint: string): number {\n  const url = parseUrlOrNull(endpoint);\n  if (url && isLoopbackHostname(url.hostname)) {\n    return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;\n  }\n  return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n  );\n}\n\nfunction hasActiveSessionPayload(payload: unknown): boolean {\n  if (!isRecord(payload)) {\n    return false;\n  }\n\n  return (\n    isRecord((payload as Record<string, unknown>).session) &&\n    isRecord((payload as Record<string, unknown>).user)\n  );\n}\n\nfunction isExpired(expiresAt: string | undefined): boolean {\n  if (!expiresAt) {\n    return false;\n  }\n  const expiresAtMs = Date.parse(expiresAt);\n  if (Number.isNaN(expiresAtMs)) {\n    return false;\n  }\n  return expiresAtMs <= Date.now();\n}\n\nfunction resolveRemoteAuthSessionReasonCode(\n  state: Exclude<RemoteAuthSessionState, \"valid\" | \"unknown\">\n): AuthSessionStateReasonCode {\n  switch (state) {\n    case \"invalid\":\n      return \"remote_session_invalid\";\n    case \"revoked\":\n      return \"remote_session_revoked\";\n    default: {\n      const exhaustiveState: never = state;\n      throw new Error(\n        `unsupported remote auth session state: ${exhaustiveState}`\n      );\n    }\n  }\n}\n\nasync function readSessionPayload(): Promise<Partial<AuthSessionV1> | null> {\n  const raw = await readFile(authSessionPath(), \"utf8\").catch(() => null);\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw) as Partial<AuthSessionV1>;\n  } catch {\n    return null;\n  }\n}\n\nfunction authSessionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session.json\");\n}\n\nasync function writeSessionPayloadAtomically(\n  path: string,\n  payload: AuthSessionV1\n): Promise<void> {\n  await writeJsonAtomically(path, payload);\n}\n\nasync function writeJsonAtomically(\n  path: string,\n  payload: unknown\n): Promise<void> {\n  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;\n  try {\n    const file = await open(tempPath, \"wx\", 0o600);\n    try {\n      await file.writeFile(`${JSON.stringify(payload, null, 2)}\\n`, \"utf8\");\n      await file.sync();\n    } finally {\n      await file.close();\n    }\n\n    await rename(tempPath, path);\n  } catch (error) {\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nfunction buildAuthUserPayload(value: unknown): {\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n} {\n  if (!(value && typeof value === \"object\")) {\n    return {};\n  }\n  const record = value as Record<string, unknown>;\n  const id = normalizeOptionalString(record.id);\n  const email = normalizeOptionalString(record.email);\n  const name = normalizeOptionalString(record.name);\n  if (!(id || email || name)) {\n    return {};\n  }\n  return {\n    user: {\n      ...(id ? { id } : {}),\n      ...(email ? { email } : {}),\n      ...(name ? { name } : {}),\n    },\n  };\n}\n\nfunction buildActiveOrganizationPayload(value: unknown): {\n  activeOrganization?: StoredActiveOrganization;\n} {\n  const activeOrganization = normalizeStoredActiveOrganization(value);\n  return activeOrganization ? { activeOrganization } : {};\n}\n\nexport function normalizeStoredActiveOrganization(\n  value: unknown\n): StoredActiveOrganization | null {\n  if (!isRecord(value)) {\n    return null;\n  }\n  const id = normalizeOptionalString(value.id);\n  const slug = normalizeOptionalString(value.slug);\n  const name = normalizeOptionalString(value.name);\n  const role = normalizeOptionalString(value.role);\n  const personal = readOrganizationIsPersonal(value);\n  if (!(id && slug && name)) {\n    return null;\n  }\n  return {\n    id,\n    slug,\n    name,\n    ...(role ? { role } : {}),\n    ...(personal ? { personal } : {}),\n  };\n}\n\nexport function readActiveOrganizationIdFromSessionPayload(\n  payload: unknown\n): string | null {\n  if (!isRecord(payload)) {\n    return null;\n  }\n  return (\n    (isRecord(payload.session)\n      ? normalizeOptionalString(payload.session.activeOrganizationId)\n      : null) ?? normalizeOptionalString(payload.activeOrganizationId)\n  );\n}\n\nfunction normalizeTokenType(value: string): string {\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : \"Bearer\";\n}\n\nfunction normalizeOptionalString(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction readOrganizationIsPersonal(value: Record<string, unknown>): boolean {\n  if (value.personal === true || value.isPersonal === true) {\n    return true;\n  }\n\n  const metadata = readOrganizationMetadata(value.metadata);\n  return metadata?.personal === true;\n}\n\nfunction readOrganizationMetadata(\n  metadata: unknown\n): Record<string, unknown> | null {\n  if (metadata === null || metadata === undefined) {\n    return null;\n  }\n\n  if (typeof metadata === \"string\") {\n    try {\n      const parsed = JSON.parse(metadata) as unknown;\n      return isRecord(parsed) ? parsed : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return isRecord(metadata) ? metadata : null;\n}\n\nfunction toAuthEndpoint(baseUrl: string, pathname: string): string {\n  const url = new URL(baseUrl);\n  const normalizedBasePath = url.pathname.replace(TRAILING_SLASHES_RE, \"\");\n  const normalizedPathname = pathname.startsWith(\"/\")\n    ? pathname\n    : `/${pathname}`;\n  url.pathname = `${normalizedBasePath}${normalizedPathname}` || \"/\";\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\nasync function parseResponseJson(response: Response): Promise<unknown> {\n  const raw = await response.text();\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return { message: raw };\n  }\n}\n\nasync function removeSessionFile(): Promise<void> {\n  await rm(authSessionPath(), { force: true });\n}\n"],"mappings":";;;;;;;;;;;;AAGA,MAAM,6CAA6C;AACnD,MAAM,6BAA6B,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACnE,MAAM,6BAA6B,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACnE,MAAM,iCAAiC,EAAE,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;AAClE,MAAM,qCAAqC,EAAE,KAAK;CACjD;CACA;CACA;AACD,CAAC;AACD,MAAM,mCAAmC,EAAE,mBAAmB,aAAa;CAC1E,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,OAAO;EAC5B,SAAS;EACT,SAAS;EACT,aAAa;EACb,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;CACD,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,MAAM;EAC3B,SAAS;EACT,SAAS;EACT,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;CACD,EAAE,aAAa;EACd,eAAe,EAAE,QAAQ,CAAC;EAC1B,WAAW,EAAE,QAAQ,QAAQ;EAC7B,SAAS;EACT,SAAS;EACT,2BAA2B,EAAE,QAAQ,0CAA0C;CAChF,CAAC;AACF,CAAC;AACD,MAAM,2CAA2C,EAAE,aAAa;CAC/D,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,IAAI;CAClB,WAAW,EAAE,KAAK,CAAC,SAAS,QAAQ,CAAC;AACtC,CAAC;AACD,MAAM,uCAAuC,EAAE,aAAa;CAC3D,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,IAAI;CAClB,WAAW,EAAE,QAAQ,MAAM;CAC3B,aAAa,EAAE,MAAM,CAAC,gCAAgC,EAAE,KAAK,CAAC,CAAC;AAChE,CAAC;AACD,MAAM,iCAAiC,EAAE,aAAa;CACrD,eAAe,EAAE,QAAQ,CAAC;CAC1B,IAAI,EAAE,QAAQ,KAAK;CACnB,WAAW;CACX,cAAc,EAAE,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAChD,CAAC;AACD,MAAM,oCAAoC,EAAE,MAAM;CACjD;CACA;CACA;AACD,CAAC;;;ACrDD,MAAa,mCAAmC;AAChD,MAAa,oCAAoC;AACjD,MAAa,qCAAqC;AAGlD,MAAa,mCAAmC;AAEhD,MAAa,+BAA+B;AAC5C,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,4BAA4B;AACzC,MAAa,4BAA4B;AAIzC,MAAa,sCAAsC;AAMnD,MAAa,0CAA0C;AAIvD,MAAa,iCAAiC;AAC9C,MAAa,uCAAuC;AACpD,MAAa,gCAAgC;AAC7C,MAAa,mDAAmD,IAAI;AACpE,MAAa,yDAAyD;AACtE,MAAa,+CAA+C,IAAI;AAChE,MAAa,qDAAqD;AAClE,MAAa,wCAAwC;AACrD,MAAa,mCAAmC;AAChD,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,gCACX;AACF,MAAa,0BAA0B;;;ACpBvC,MAAM,sBAA4C;AAClD,MAAM,mBAAyC;;;;;;AAO/C,SAAgB,8BAAoD;CAKlE,OAEI;AACN;AAEA,SAAgB,uBAAgC;CAC9C,OAAO,4BAA4B,MAAM;AAC3C;;;AC9BA,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AAqCtC,IAAI,cAAyC;AAC7C,IAAI,4BAA0C;AAE9C,eAAsB,8BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;GACf,aAAa,MAAM;EACrB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;AAC7D;AAEA,eAAsB,6BACpB,OACwB;CACxB,IAAI,qBAAqB,GACvB,OAAO,MAAM,qCAAqC;EAChD,WAAW;EACX,SAAS,MAAM;EACf,SAAS,MAAM;CACjB,CAAC;CAGH,QAAO,MADa,UAAU,EAAA,CACjB,KAAK,MAAM,SAAS,MAAM,OAAO;AAChD;AAEA,eAAsB,+BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;EACjB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,OAAO,MAAM,SAAS,MAAM,OAAO;AAC3C;AAUA,eAAsB,qCACpB,OACA,UAAkC,CAAC,GACC;CACpC,MAAM,UAAU,iCAAiC,MAAM;EACrD,eAAA;EACA,2BAA2B;EAC3B,GAAG;CACL,CAAC;CACD,MAAM,YAAY,QAAQ,aAAA;CAC1B,IAAI,EAAE,OAAO,cAAc,SAAS,KAAK,YAAY,IACnD,MAAM,IAAI,MAAM,0DAA0D;CAG5E,OAAO,MAAM,IAAI,SAAoC,SAAS,WAAW;EACvE,MAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,0BAA0B,GAAG;GAClE,KAAK,QAAQ;GACb,OAAO;GACP,OAAO;IAAC;IAAQ;IAAQ;GAAM;GAC9B,aAAa;EACf,CAAC;EACD,IAAI,UAAU;EACd,IAAI,SAAS;EACb,IAAI,SAAS;EAEb,MAAM,sBAAsB;GAC1B,aAAa,QAAQ;EACvB;EACA,MAAM,cAAc,UAAiB;GACnC,IAAI,SACF;GAEF,UAAU;GACV,cAAc;GACd,OAAO,KAAK;EACd;EACA,MAAM,WAAW,iBAAiB;GAChC,IAAI,SACF;GAEF,UAAU;GACV,MAAM,KAAK,SAAS;GACpB,OACE,IAAI,gCACF,yCAAyC,cAAc,SAAS,GAClE,CACF;EACF,GAAG,SAAS;EAEZ,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBAAyB;IAC/D,MAAM,KAAK,SAAS;IACpB,2BAAW,IAAI,MAAM,4CAA4C,CAAC;GACpE;EACF,CAAC;EACD,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBACtC,SAAS,OAAO,MAAM,OAAwB;EAElD,CAAC;EACD,MAAM,KAAK,UAAU,UAAU;GAC7B,2BACE,IAAI,MACF,0CAA0CA,iBAAe,KAAK,GAChE,CACF;EACF,CAAC;EACD,MAAM,MAAM,KAAK,UAAU,UAAU;GACnC,2BACE,IAAI,MACF,uCAAuCA,iBAAe,KAAK,GAC7D,CACF;EACF,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SACF;GAEF,cAAc;GACd,UAAU;GACV,IAAI;IACF,QACE,+BAA+B;KAC7B;KACA,WAAW,QAAQ;KACnB;KACA;IACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,OAAO,QAAQ,KAAK,CAAC;GACvB;EACF,CAAC;EAED,MAAM,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG,MAAM;CACjD,CAAC;AACH;AAEA,eAAsB,wCACpB,OAA0B,QAAQ,MAChB;CAClB,IAAI,CAAC,KAAK,SAAS,0BAA0B,GAC3C,OAAO;CAET,IAAI,EAAE,qBAAqB,KAAK,QAAQ,aAAa,WACnD,MAAM,IAAI,MACR,0EACF;CAIF,IAAI,EAAC,MADe,UAAU,EAAA,CACnB,uBAAuB,GAChC,MAAM,IAAI,MACR,8EACF;CAGF,MAAM,aAAa,MAAM,gBAAgB;CACzC,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,UAAU;CAC9B,QAAQ;EACN,MAAM,IAAI,MAAM,uCAAuC;CACzD;CACA,MAAM,UAAU,iCAAiC,UAAU,IAAI;CAC/D,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,WAAW,MAAM,qBAAqB,QAAQ,IAAI,CAAC,CAAC,OAAO,WAAW;EAC1E,eAAA;EACA,IAAI;EACJ,WAAW,QAAQ,KAAK;EACxB,cAAc,qBAAqBA,iBAAe,KAAK,CAAC;CAC1D,EAAE;CACF,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,CAAC;CAC7C,OAAO;AACT;AAQA,eAAe,qCACb,OACoC;CACpC,IAAI,2BACF,MAAM;CAER,IAAI;EACF,IAAI,MAAM,cAAc,QACtB,OAAO,MAAM,qCAAqC,KAAK;EAEzD,MAAM,qCAAqC,KAAK;CAClD,SAAS,OAAO;EACd,IAAI,iBAAiB,iCACnB,4BAA4B;EAE9B,MAAM;CACR;AACF;AAEA,SAAS,+BAA+B,OAKV;CAC5B,IAAI,MAAM,SAAS,GACjB,MAAM,IAAI,MACR,0CAA0C,MAAM,QAAQ,YACtD,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,IAEvD;CAGF,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,MAAM,MAAM;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,MAAM,SAAS,kCAAkC,UAAU,WAAW;CACtE,IAAI,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,MAAM,YACtD,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,CAAC,OAAO,KAAK,IACf,MAAM,IAAI,MAAM,OAAO,KAAK,YAAY;CAE1C,OAAO,OAAO,KAAK,cAAc,SAAS,OAAO,KAAK,cAAc,KAAA;AACtE;AAEA,eAAe,qBAAqB,OAAmC;CACrE,MAAM,QAAQ,MAAM,UAAU;CAC9B,IAAI,MAAM,cAAc,SAAS;EAC/B,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;EAC3D,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,IAAI,MAAM,cAAc,UAAU;EAChC,MAAM,OAAO,MAAM,SAAS,MAAM,OAAO;EACzC,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,OAAO;EACL,eAAA;EACA,IAAI;EACJ,WAAW;EACX,aAAa,MAAM,KAAK,MAAM,SAAS,MAAM,OAAO;CACtD;AACF;AAEA,eAAe,kBAAmC;CAChD,IAAI,MAAM;CACV,QAAQ,MAAM,YAAY,MAAM;CAChC,WAAW,MAAM,SAAS,QAAQ,OAAO;EACvC,OAAO,OAAO,KAAK;EACnB,IAAI,OAAO,WAAW,KAAK,MAAM,IAAI,yBACnC,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,SAAyB;CAErD,QADmB,QAAQ,KAAK,KAAK,kCAAA,CACnB,MAAM,GAAG,IAAI;AACjC;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,YAAY,QAAS,IACxB,GAAG,YAAY,IAAK,YACpB,GAAG,UAAU;AACnB;AAEA,SAASA,iBAAe,OAAwB;CAC9C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,OAAyB;AAC3B;AAEA,eAAe,YAAyC;CACtD,IAAI,aACF,OAAO;CAET,IAAI,QAAQ,aAAa,UACvB,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,qBAAqB,GAAG;EAE1B,eAAc,MADS,OAAO,2CAAA,CACP,+BAA+B;EACtD,OAAO;CACT;CAMA,cAJgB,cAAc,OAAO,KAAK,GAItB,CAAC,CAHH,cAChB,IAAI,IAAI,mCAAmC,OAAO,KAAK,GAAG,CAE9B,CAAC;CAC/B,OAAO;AACT;;;ACtXA,MAAM,+BAA+B;AACrC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,qDACJ;AAGF,MAAM,2BAA2B,OAAO;AACxC,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,yBAAyB;CAC7B,aAAa;CACb,WAAW;CACX,SAAS;AACX;AACA,IAAI,+BAA+B;AACnC,IAAI,kCAAkC;AA0CtC,eAAsB,iBACpB,OACyB;CACzB,MAAM,MAAM,cAAc;EACxB,aAAa,MAAM;EACnB,UAAU,MAAM;CAClB,CAAC;CAED,IAAI,yBAAyB,GAAG;EAC9B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,UAAU,wBAAwB,GAAG;EAC3C,IAAI,6BAA6B,GAC/B,MAAM,8BAA8B;GAClC;GACA,SAAS;GACT,aAAa,MAAM;EACrB,CAAC;OAED,MAAM,IAAI,MAAM,kDAAkD;EAEpE,OAAO;GACL,UAAU;GACV,SAAS;GACT;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,aAAa,wBAAwB,GAAG;EAC9C,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,gCAAgC,KAAK;EACrC,OAAO;GAAE,UAAU;GAAiB,KAAK;EAAW;CACtD;CAGF,IAAI,QAAQ,aAAa,SACvB,IAAI;EACF,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,IAAI,MACR,mDAAmD,eAAe,KAAK,GACzE;CACF;CAGF,IAAI,sBAAsB,GAAG;EAC3B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,MAAM,IAAI,MACR,oDAAoD,QAAQ,SAAS,SAC5D,0BAA0B,oCACrC;AACF;AAEA,eAAsB,gBACpB,KACgC;CAChC,IAAI;EACF,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;GAGpE,OAAO,wBAAwB,MADX,6BAA6B,GAAG,CAChB;EACtC;EACA,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,OAAO,EAAE,QAAQ,UAAU;CAC7B,SAAS,OAAO;EACd,OAAO;GACL,cAAc,eAAe,KAAK;GAClC,QAAQ;EACV;CACF;AACF;AAEA,eAAsB,kBAAkB,KAAoC;CAC1E,IAAI,IAAI,aAAa,kBAAkB;EACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,+BAA+B,GAAG;EACxC;CACF;CACA,IAAI,IAAI,aAAa,iBAAiB;EACpC,MAAM,wBAAwB,GAAG;EACjC;CACF;CACA,IAAI,IAAI,aAAa,iBACnB,MAAM,wBAAwB,GAAG;AAErC;AAEA,SAAgB,iBAAiB,OAAyC;CACxE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO;CAET,MAAM,SAAS;CACf,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,aAAa,kBACf,OAAO,QACL,gBAAgB,OAAO,OAAO,KAC5B,gBAAgB,OAAO,OAAO,KAC9B,OAAO,gBAAgB,KAAA,CAC3B;CAEF,IAAI,aAAa,mBAAmB,aAAa,iBAC/C,OAAO,sBAAsB,OAAO,GAAG,MAAM;CAE/C,OAAO;AACT;AAEA,SAAS,cAAc,OAGZ;CACT,MAAM,UAAU,QAAQ,gBAAgB,CAAC;CACzC,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,GAAG,MAAM,SAAS,IAAI,MAAM,YAAY,IAAI,SAAS,CAAC,CAC7D,OAAO,KAAK;AACjB;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,iBAAiB,IAAI,GAAG,WAAW;AAC5C;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,OAAO,KAAK;AAC5E;AAEA,SAAS,+BAAwC;CAC/C,OAAO,qBAAqB;AAC9B;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,YAAY,MAAM,oBACtB,8BACA,MAAM,aACN,MAAM,GACR;CACA,MAAM,MAAM,mBAAmB,GAAG,EAAE,WAAW,KAAK,CAAC;CAIrD,MAAM,UAAU,sBAAsB,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,EAAE,KAAK;EACzE,UAAU;EACV,MAAM;CACR,CAAC;AACH;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,YAAY,MAAM,SACtB,sBAAsB,MAAM,GAAG,GAC/B,MACF,CAAC,CAAC,OAAO,UAAU;EACjB,IAAIC,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CAAC;CACD,IAAI,CAAC,WACH,OAAO;CAET,OAAO,oBACL,8BACA,UAAU,KAAK,GACf,MAAM,GACR;AACF;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,sBAAsB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,4BAA4B;CAClC,MAAM,OAAO,kBAAkB,MAAM,GAAG;CACxC,MAAM,UAAU,MAAM,GAAG,MAAM,YAAY,KAAK;EAC9C,UAAU;EACV,MAAM;CACR,CAAC;CACD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,MAAM,GAAK;AAE3B;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,MAAM,MAAM,SAAS,kBAAkB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAC9D,UAAU;EACT,IAAIA,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,OAAO,MAAM,IAAI,KAAK,IAAI;AAC5B;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,kBAAkB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxD;AAEA,SAAS,qBAA6B;CACpC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,QAAQ;AACjD;AAEA,SAAS,sBAAsB,KAAqB;CAClD,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,kBAAkB,KAAqB;CAC9C,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,wBAAiC;CACxC,IAAI,QAAQ,IAAI,+BAA+B,KAAK;EAClD,qBAAqB,KAAK;EAC1B,OAAO;CACT;CAIA,MAAM,kBAAkB,CAAC,4BAA4B;CACrD,IAAI,iBACF,qBAAqB,UAAU;CAEjC,OAAO;AACT;AAEA,SAAS,gCAAgC,OAAsB;CAC7D,IAAI,iCACF;CAEF,kCAAkC;CAClC,MAAM,qBAAqB,qBAAqB,IAC5C,oFACA;CACJ,QAAQ,KACN,8JAGK,mBAAmB,YAAY,eAAe,KAAK,GAC1D;AACF;AAEA,SAAS,qBAAqB,QAAkC;CAC9D,IAAI,8BACF;CAEF,+BAA+B;CAE/B,MAAM,aACJ,WAAW,QACP,cAAc,0BAA0B,MACxC,sCAAsC,QAAQ,SAAS;CAC7D,QAAQ,KACN,oEAAoE,WAAW,WACpE,0BAA0B,0FAEvC;AACF;AAEA,SAAS,2BAAoC;CAC3C,OAAO,QAAQ,IAAI,kCAAkC;AACvD;AAEA,SAAS,8BAAuC;CAC9C,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa;AAC/D;AAEA,eAAe,8BAA6C;CAC1D,MAAM,YAAY,mBAAmB;CACrC,MAAM,MAAM,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACvD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,WAAW,GAAK;AAEhC;AAEA,eAAe,oBACb,QACA,OACA,SACiB;CACjB,MAAM,UAAU,KAAK,UAAU;EAAE;EAAO;CAAQ,CAAC;CAajD,QAAO,MAZc,WACnB,kBACA;EACE;EACA;EACA;EACA;EACA;EACA;CACF,GACA,OACF,EAAA,CACc,OAAO,KAAK;AAC5B;AAEA,eAAe,WACb,SACA,MACA,cAC6C;CAC7C,IAAI;EACF,MAAM,EAAE,aAAa,MAAM,OAAO;EAwClC,OAAO,MAvCc,IAAI,SACtB,SAAS,WAAW;GACnB,IAAI,SAAS;GACb,IAAI,SAAS;GAEb,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAAC;GAEnE,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GACD,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GAED,MAAM,GAAG,UAAU,UAAU;IAC3B,OAAO,eAAe,OAAO,OAAO,CAAC;GACvC,CAAC;GAED,MAAM,GAAG,UAAU,SAAS;IAC1B,IAAI,SAAS,GAAG;KACd,QAAQ;MAAE;MAAQ;KAAO,CAAC;KAC1B;IACF;IACA,OACE,eACE,EACE,SAAS,mBAAmB,QAAQ,mBAAmB,OACzD,GACA,OACF,CACF;GACF,CAAC;GAED,MAAM,OAAO,MAAM,YAAY;GAC/B,MAAM,OAAO,IAAI;EACnB,CACF;CAEF,SAAS,OAAO;EACd,MAAM,eAAe,OAAO,OAAO;CACrC;AACF;AAEA,SAAS,eACP,OACA,SACoE;CACpE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,uBAAO,IAAI,MAAM,mBAAmB,QAAQ,KAAK,OAAO,KAAK,GAAG;CAElE,MAAM,IAAI;CAKV,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;CACnD,MAAM,eAAe,CAAC,mBAAmB,QAAQ,EAAE;CACnD,IAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,GAChD,aAAa,KAAK,WAAW,EAAE,OAAO,KAAK,GAAG;MACzC,IAAI,EAAE,SACX,aAAa,KAAK,EAAE,OAAO;CAE7B,MAAM,UAAU,IAAI,MAAM,aAAa,KAAK,IAAI,CAAC;CAKjD,QAAQ,OAAO;CACf,QAAQ,SAAS,EAAE;CACnB,QAAQ,SAAS,EAAE;CACnB,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;AAClC;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,gBAAgB,KAAK;CACxC,IAAI,CAAC,uBAAuB,KAAK,UAAU,GACzC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,yBAAyB,OAAwB;CACxD,MAAM,aAAa,sBAAsB,KAAK;CAC9C,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAS,eAAe,OAAqC;CAC3D,IAAI,UAAU,MACZ,OAAO;CAET,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA6C;CAC5E,MAAM,cAAc,eAAe,KAAK;CACxC,IAAI,CAAC,aACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO;EACL;EACA,QAAQ;CACV;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAEf,OAAO,OAAO,KAAK;AACrB;AAEA,SAASA,sBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;AAEV,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;;;;;;;;;;;;ACncV,MAAM,sBAAsB;AAO5B,IAAI,oBAA8C;AAElD,eAAsB,oBACpB,UAAsC,CAAC,GACN;CACjC,MAAM,aAAa,MAAM,yBAAyB;CAClD,QAAQ,WAAW,OAAnB;EACE,KAAK;EACL,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH;EACF,SACE,OAAO;CACX;CACA,IAAI,CAAC,QAAQ,gBACX,OAAO;CAGT,MAAM,mBAAmB,MAAM,0BAA0B,WAAW,OAAO;CAC3E,IAAI,iBAAiB,UAAU,SAC7B,OAAO;CAET,IAAI,iBAAiB,UAAU,WAC7B,OAAO;CAGT,OAAO;EACL,YAAY,mCAAmC,iBAAiB,KAAK;EACrE,OAAO,iBAAiB;EACxB,SAAS;CACX;AACF;AAKA,eAAsB,4BAAoD;CAIxE,MAAM,eAAc,MAHI,oBAAoB,EAC1C,gBAAgB,MAClB,CAAC,CAAC,CAAC,YAAY,IAAI,EAAA,EACY,SAAS,MAAM,IAAI,KAAK,KAAK;CAC5D,OAAO,YAAY,SAAS,IAAI,cAAc;AAChD;AAEA,eAAsB,eAAe,OAanB;CAChB,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAG7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAGzC,MAAM,yBAAyB;CAG/B,MAAM,mBAAmB,mBAAkB,MADb,mBAAmB,EAAA,EACW,QAAQ;CACpE,MAAM,WAAW,MAAM,iBAAiB;EACtC;EACA;EACA;CACF,CAAC;CAED,MAAM,UAAyB;EAC7B,GAAG;EACH;EACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;EACzD;EACA;EACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,GAAG,qBAAqB,MAAM,IAAI;EAClC,GAAG,+BAA+B,MAAM,kBAAkB;CAC5D;CAEA,MAAM,OAAO,gBAAgB;CAC7B,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAEhE,IAAI;EACF,MAAM,+BAA+B;GAAE;GAAa;EAAS,CAAC;EAC9D,MAAM,8BAA8B,MAAM,OAAO;CACnD,SAAS,OAAO;EACd,MAAM,oCAAoC,QAAQ;EAClD,MAAM;CACR;CAEA,iBAAiB;EACf;EACA,SAAS,uBAAuB;GAAE;GAAa;EAAQ,CAAC;CAC1D,CAAC;CACD,IACE,oBACA,CAAC,wBAAwB,kBAAkB,QAAQ,GAEnD,MAAM,oCAAoC,gBAAgB;AAE9D;AAUA,eAAsB,yBAA8D;CAClF,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;CAGT,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,eAAe,YAAY,YAC/B,OAAO;CAGT,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,QAAQ,kBAAkB;CAC9D;AACF;AAEA,eAAsB,oCACpB,oBACe;CACf,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,MAAM,wDAAwD;CAG1E,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,YAAY,aAAa,eAAe,YAAY,YACxD,MAAM,IAAI,MACR,4DACF;CAGF,MAAM,cAA6B;EACjC,GAAG;EACH;EACA;EACA;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,kBAAkB;CACtD;CAEA,MAAM,8BAA8B,gBAAgB,GAAG,WAAW;CAClE,MAAM,uBAAuB,sBAAsB,OAAO;CAC1D,IAAI,sBACF,iBAAiB;EACf,SAAS;EACT,SAAS,uBAAuB;GAC9B,aAAa,qBAAqB;GAClC,SAAS;EACX,CAAC;CACH,CAAC;AAEL;AAEA,eAAsB,mBAAoD;CACxE,oBAAoB;CACpB,MAAM,yBAAyB;CAC/B,MAAM,kBAAkB,MAAM,sBAAsB;CACpD,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,KAAK,iBAAiB,QAAQ,QAAQ,GACvD,MAAM,oCAAoC,QAAQ,QAAQ;CAE5D,MAAM,kBAAkB;CACxB,OAAO,EAAE,gBAAgB;AAC3B;AAEA,eAAe,2BAA0C;CACvD,MAAM,UAAU,MAAM,wBAAwB;CAC9C,IAAI,QAAQ,UAAU,WAAW,GAC/B;CAGF,MAAM,YAA8B,CAAC;CACrC,KAAK,MAAM,YAAY,QAAQ,WAC7B,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,UAAU,KAAK,QAAQ;CACzB;CAEF,MAAM,2BAA2B,SAAS;AAC5C;AAEA,eAAe,oCACb,UACe;CACf,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,MAAM,UAAU,MAAM,wBAAwB;EAC9C,IACE,QAAQ,UAAU,MAAM,QAAQ,wBAAwB,KAAK,QAAQ,CAAC,GAEtE;EAEF,MAAM,2BAA2B,CAAC,GAAG,QAAQ,WAAW,QAAQ,CAAC;CACnE;AACF;AAEA,eAAe,0BAA0D;CACvE,MAAM,MAAM,MAAM,SAAS,wBAAwB,GAAG,MAAM,CAAC,CAAC,OAC3D,UAAU;EACT,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,IAAI,QAAQ,MACV,OAAO;EAAE,GAAG;EAAG,WAAW,CAAC;CAAE;CAG/B,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C;CACjE;CACA,IACE,EAAE,SAAS,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,SAAS,IAEtE,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,YAAY,OAAO,UAAU,OAAO,gBAAgB;CAC1D,IAAI,UAAU,WAAW,OAAO,UAAU,QACxC,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO;EAAE,GAAG;EAAG;CAAU;AAC3B;AAEA,eAAe,2BACb,WACe;CACf,MAAM,OAAO,wBAAwB;CACrC,IAAI,UAAU,WAAW,GAAG;EAC1B,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;EAC9B;CACF;CACA,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAChE,MAAM,oBAAoB,MAAM;EAAE,GAAG;EAAG;CAAU,CAAC;AACrD;AAEA,SAAS,0BAAkC;CACzC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,4BAA4B;AACrE;AAEA,eAAe,wBAA0C;CACvD,IAAI;EACF,MAAM,SAAS,gBAAgB,GAAG,MAAM;EACxC,OAAO;CACT,SAAS,OAAO;EACd,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR;AACF;AAEA,eAAe,2BAA2D;CACxE,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,IAAI,CAAC,UACH,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,aAAa,eAAe,YAAY,YAC5C,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,IAAI,UAAU,sBAAsB,OAAO;CAC3C,IAAI,CAAC,SAAS;EACZ,MAAM,cAAc,MAAM,gBAAgB,QAAQ;EAClD,IAAI,YAAY,WAAW,WACzB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,IAAI,YAAY,WAAW,eACzB,OAAO;GACL,cAAc,YAAY;GAC1B,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,UAAU,uBAAuB;GAC/B,aAAa,YAAY;GACzB,SAAS;IACP,GAAG;IACH,GAAG;IACH;IACA;IACA;IACA;IACA;GACF;EACF,CAAC;EACD,iBAAiB;GAAE;GAAS;EAAQ,CAAC;CACvC;CAEA,IAAI,UAAU,QAAQ,SAAS,GAC7B,OAAO;EACL,YAAY;EACZ,OAAO;EACP;CACF;CAGF,OAAO;EACL,OAAO;EACP;CACF;AACF;AAEA,eAAe,+BAA+B,OAG5B;CAChB,MAAM,WAAW,MAAM,gBAAgB,MAAM,QAAQ;CACrD,IACE,SAAS,WAAW,WACpB,SAAS,gBAAgB,MAAM,aAE/B;CAEF,IAAI,SAAS,WAAW,eACtB,MAAM,IAAI,MACR,8CAA8C,SAAS,cACzD;CAEF,MAAM,IAAI,MAAM,2CAA2C;AAC7D;AAEA,SAAS,uBAAuB,OAGV;CACpB,OAAO;EACL,GAAG;EACH,aAAa,MAAM;EACnB,WAAW,MAAM,QAAQ;EACzB,aAAa,MAAM,QAAQ;EAC3B,UAAU,MAAM,QAAQ;EACxB,WAAW,MAAM,QAAQ;EACzB,GAAI,OAAO,MAAM,QAAQ,cAAc,YACvC,MAAM,QAAQ,UAAU,KAAK,IACzB,EAAE,WAAW,MAAM,QAAQ,UAAU,KAAK,EAAE,IAC5C,CAAC;EACL,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;AACF;AAEA,SAAS,iBAAiB,OAGjB;CACP,oBAAoB;EAClB,YAAY,2BAA2B,MAAM,OAAO;EACpD,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,sBACP,SAC0B;CAC1B,MAAM,aAAa,2BAA2B,OAAO;CACrD,OAAO,mBAAmB,eAAe,aACrC,kBAAkB,UAClB;AACN;AAEA,SAAS,2BAA2B,SAAyC;CAC3E,OAAO,GAAG,gBAAgB,EAAE,IAAI,KAAK,UAAU,OAAO;AACxD;AAEA,SAAS,wBACP,MACA,OACS;CACT,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,kBAAkB,OAAuC;CAChE,IAAI,CAAC,iBAAiB,KAAK,GACzB,OAAO;CAET,OAAO;AACT;AAEA,eAAe,0BACb,SACsC;CACtC,IAAI,WAAW;CACf,IAAI;EACF,WAAW,eAAe,QAAQ,aAAa,uBAAuB;CACxE,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;CACA,IAAI;EACF,MAAM,YAAY,8BAA8B,QAAQ;EACxD,MAAM,WAAW,MAAM,MAAM,UAAU;GACrC,QAAQ;GACR,SAAS,EACP,eAAe,GAAG,mBAAmB,QAAQ,SAAS,EAAE,GAAG,QAAQ,cACrE;GACA,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,EAAE,OAAO,UAAU;EAE5B,IAAI,CAAC,SAAS,IAGZ,OAAO,EAAE,OAAO,UAAU;EAI5B,IAAI,CAAC,wBAAwB,MADP,kBAAkB,QAAQ,CACZ,GAClC,OAAO,EAAE,OAAO,UAAU;EAE5B,OAAO,EAAE,OAAO,QAAQ;CAC1B,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;AACF;AAEA,SAAS,8BAA8B,UAA0B;CAC/D,MAAM,MAAM,eAAe,QAAQ;CACnC,IAAI,OAAO,mBAAmB,IAAI,QAAQ,GACxC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,UAA2B;CACrD,OACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEA,SAAS,wBAAwB,SAA2B;CAC1D,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO;CAGT,OACE,SAAU,QAAoC,OAAO,KACrD,SAAU,QAAoC,IAAI;AAEtD;AAEA,SAAS,UAAU,WAAwC;CACzD,IAAI,CAAC,WACH,OAAO;CAET,MAAM,cAAc,KAAK,MAAM,SAAS;CACxC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO;CAET,OAAO,eAAe,KAAK,IAAI;AACjC;AAEA,SAAS,mCACP,OAC4B;CAC5B,QAAQ,OAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SAEE,MAAM,IAAI,MACR,0CAA0CC,OAC5C;CAEJ;AACF;AAEA,eAAe,qBAA6D;CAC1E,MAAM,MAAM,MAAM,SAAS,gBAAgB,GAAG,MAAM,CAAC,CAAC,YAAY,IAAI;CACtE,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAA0B;CACjC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,cAAc;AACvD;AAEA,eAAe,8BACb,MACA,SACe;CACf,MAAM,oBAAoB,MAAM,OAAO;AACzC;AAEA,eAAe,oBACb,MACA,SACe;CACf,MAAM,WAAW,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CACxE,IAAI;EACF,MAAM,OAAO,MAAM,KAAK,UAAU,MAAM,GAAK;EAC7C,IAAI;GACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;GACpE,MAAM,KAAK,KAAK;EAClB,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;EAEA,MAAM,OAAO,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,MAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EACzD,MAAM;CACR;AACF;AAEA,SAAS,oBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,SAAS,qBAAqB,OAM5B;CACA,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO,CAAC;CAEV,MAAM,SAAS;CACf,MAAM,KAAK,wBAAwB,OAAO,EAAE;CAC5C,MAAM,QAAQ,wBAAwB,OAAO,KAAK;CAClD,MAAM,OAAO,wBAAwB,OAAO,IAAI;CAChD,IAAI,EAAE,MAAM,SAAS,OACnB,OAAO,CAAC;CAEV,OAAO,EACL,MAAM;EACJ,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;EACnB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EACzB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;CACzB,EACF;AACF;AAEA,SAAS,+BAA+B,OAEtC;CACA,MAAM,qBAAqB,kCAAkC,KAAK;CAClE,OAAO,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AACxD;AAEA,SAAgB,kCACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,MAAM,KAAK,wBAAwB,MAAM,EAAE;CAC3C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,WAAW,2BAA2B,KAAK;CACjD,IAAI,EAAE,MAAM,QAAQ,OAClB,OAAO;CAET,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC;AACF;AAeA,SAAS,mBAAmB,OAAuB;CACjD,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA+B;CAC9D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,2BAA2B,OAAyC;CAC3E,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,OAAO;CAIT,OADiB,yBAAyB,MAAM,QAClC,CAAC,EAAE,aAAa;AAChC;AAEA,SAAS,yBACP,UACgC;CAChC,IAAI,aAAa,QAAQ,aAAa,KAAA,GACpC,OAAO;CAGT,IAAI,OAAO,aAAa,UACtB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,QAAQ;EAClC,OAAO,SAAS,MAAM,IAAI,SAAS;CACrC,QAAQ;EACN,OAAO;CACT;CAGF,OAAO,SAAS,QAAQ,IAAI,WAAW;AACzC;AAEA,SAAS,eAAe,SAAiB,UAA0B;CACjE,MAAM,MAAM,IAAI,IAAI,OAAO;CAK3B,IAAI,WAAW,GAJY,IAAI,SAAS,QAAQ,qBAAqB,EAIlC,IAHR,SAAS,WAAW,GAAG,IAC9C,WACA,IAAI,gBACuD;CAC/D,IAAI,SAAS;CACb,IAAI,OAAO;CACX,OAAO,IAAI,SAAS;AACtB;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAEA,eAAe,kBAAkB,UAAsC;CACrE,MAAM,MAAM,MAAM,SAAS,KAAK;CAChC,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO,EAAE,SAAS,IAAI;CACxB;AACF;AAEA,eAAe,oBAAmC;CAChD,MAAM,GAAG,gBAAgB,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7C"}

package/dist/{base-url-Cv9x5Es9.js → base-url-Dq4Lk2FB.js}

@@ -1526,6 +1526,14 @@ async function getConfiguredDeviceRuntimeState() {
 async function getConfiguredDaemonDispatchLimits() {
 	return resolveRuntimeDaemonDispatchLimits((await readRuntimeConfig())?.daemon?.dispatch);
 }
+async function getConfiguredOpenMeldToolsMaintenance() {
+	const result = await readRuntimeConfigDetailed();
+	if (result.health.parseFallback) throw new Error("OpenMeld update setting is invalid.");
+	const preferencesFile = await readOptionalJsonFile(devicePreferencesPath());
+	if (preferencesFile.error) throw new Error("OpenMeld update setting is invalid.");
+	if (preferencesFile.found && preferencesFile.value && typeof preferencesFile.value === "object" && "openMeldToolsMaintenance" in preferencesFile.value && !parseRuntimeOpenMeldToolsMaintenanceConfig(preferencesFile.value.openMeldToolsMaintenance)) throw new Error("OpenMeld update setting is invalid.");
+	return result.config?.openMeldToolsMaintenance ?? { automaticUpdatesEnabled: true };
+}
 async function getConfiguredOnboardingConfig() {
 	return (await readRuntimeConfig())?.onboarding ?? null;
 }
@@ -1616,6 +1624,7 @@ function buildNextConfig(previous, overrides) {
 	const viewCustomization = resolveConfigOverride("viewCustomization", previous?.viewCustomization, overrides);
 	const skills = resolveConfigOverride("skills", previous?.skills, overrides);
 	const daemon = resolveConfigOverride("daemon", previous?.daemon, overrides);
+	const openMeldToolsMaintenance = resolveConfigOverride("openMeldToolsMaintenance", previous?.openMeldToolsMaintenance, overrides);
 	const deviceRuntimeState = resolveConfigOverride("deviceRuntimeState", previous?.deviceRuntimeState, overrides);
 	const onboarding = resolveConfigOverride("onboarding", previous?.onboarding, overrides);
 	return {
@@ -1624,6 +1633,7 @@ function buildNextConfig(previous, overrides) {
 		...viewCustomization ? { viewCustomization } : {},
 		...skills ? { skills } : {},
 		...daemon ? { daemon } : {},
+		...openMeldToolsMaintenance ? { openMeldToolsMaintenance } : {},
 		...deviceRuntimeState ? { deviceRuntimeState } : {},
 		...onboarding ? { onboarding } : {},
 		updatedAt: (/* @__PURE__ */ new Date()).toISOString()
@@ -1712,6 +1722,12 @@ function parseRuntimeDaemonConfig(value) {
 	if (!dispatch) return;
 	return { dispatch };
 }
+function parseRuntimeOpenMeldToolsMaintenanceConfig(value) {
+	if (!value || typeof value !== "object") return;
+	const automaticUpdatesEnabled = value.automaticUpdatesEnabled;
+	if (typeof automaticUpdatesEnabled !== "boolean") return;
+	return { automaticUpdatesEnabled };
+}
 function parseRuntimeDaemonDispatchConfig(value) {
 	if (!value || typeof value !== "object") return;
 	const obj = value;
@@ -2039,6 +2055,7 @@ async function readSplitRuntimeConfigDetailed() {
 			baseUrl: preferences.baseUrl,
 			viewCustomization: preferences.viewCustomization,
 			daemon: preferences.daemon,
+			openMeldToolsMaintenance: preferences.openMeldToolsMaintenance,
 			onboarding: preferences.onboarding,
 			deviceRuntimeState: agentRuntime,
 			skills
@@ -2091,6 +2108,7 @@ async function readLegacyRuntimeConfigDetailed() {
 			viewCustomization: parseRuntimeViewCustomization(parsed.viewCustomization),
 			skills: parseRuntimeSkillsConfig(parsed.skills),
 			daemon: parseRuntimeDaemonConfig(parsed.daemon),
+			openMeldToolsMaintenance: parseRuntimeOpenMeldToolsMaintenanceConfig(parsed.openMeldToolsMaintenance),
 			deviceRuntimeState: parseRuntimeDeviceRuntimeState(parsed.deviceRuntimeState),
 			onboarding: parseRuntimeOnboardingConfig(parsed.onboarding),
 			updatedAt: typeof parsed.updatedAt === "string" ? parsed.updatedAt : (/* @__PURE__ */ new Date()).toISOString()
@@ -2100,13 +2118,14 @@ async function readLegacyRuntimeConfigDetailed() {
 }
 function buildRuntimeConfigFromParts(input) {
 	const updatedAt = input.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString();
-	if (!(input.baseUrl || input.viewCustomization || input.skills || input.daemon || input.deviceRuntimeState || input.onboarding)) return null;
+	if (!(input.baseUrl || input.viewCustomization || input.skills || input.daemon || input.openMeldToolsMaintenance || input.deviceRuntimeState || input.onboarding)) return null;
 	return {
 		v: 1,
 		...input.baseUrl ? { baseUrl: input.baseUrl } : {},
 		...input.viewCustomization ? { viewCustomization: input.viewCustomization } : {},
 		...input.skills ? { skills: input.skills } : {},
 		...input.daemon ? { daemon: input.daemon } : {},
+		...input.openMeldToolsMaintenance ? { openMeldToolsMaintenance: input.openMeldToolsMaintenance } : {},
 		...input.deviceRuntimeState ? { deviceRuntimeState: input.deviceRuntimeState } : {},
 		...input.onboarding ? { onboarding: input.onboarding } : {},
 		updatedAt
@@ -2120,6 +2139,7 @@ function parseDevicePreferencesConfig(value) {
 		...parseConfiguredBaseUrl(parsed.baseUrl) ? { baseUrl: parseConfiguredBaseUrl(parsed.baseUrl) } : {},
 		...parseRuntimeViewCustomization(parsed.viewCustomization) ? { viewCustomization: parseRuntimeViewCustomization(parsed.viewCustomization) } : {},
 		...parseRuntimeDaemonConfig(parsed.daemon) ? { daemon: parseRuntimeDaemonConfig(parsed.daemon) } : {},
+		...parseRuntimeOpenMeldToolsMaintenanceConfig(parsed.openMeldToolsMaintenance) ? { openMeldToolsMaintenance: parseRuntimeOpenMeldToolsMaintenanceConfig(parsed.openMeldToolsMaintenance) } : {},
 		...parseRuntimeOnboardingConfig(parsed.onboarding) ? { onboarding: parseRuntimeOnboardingConfig(parsed.onboarding) } : {}
 	};
 }
@@ -2163,12 +2183,13 @@ function mergeRuntimeSkillsConfig(input) {
 	};
 }
 function buildDevicePreferencesState(next, updatedAt) {
-	if (!(next.baseUrl || next.viewCustomization || next.daemon || next.onboarding)) return null;
+	if (!(next.baseUrl || next.viewCustomization || next.daemon || next.openMeldToolsMaintenance || next.onboarding)) return null;
 	return {
 		v: 1,
 		...next.baseUrl ? { baseUrl: next.baseUrl } : {},
 		...next.viewCustomization ? { viewCustomization: next.viewCustomization } : {},
 		...next.daemon ? { daemon: next.daemon } : {},
+		...next.openMeldToolsMaintenance ? { openMeldToolsMaintenance: next.openMeldToolsMaintenance } : {},
 		...next.onboarding ? { onboarding: next.onboarding } : {},
 		updatedAt
 	};
@@ -2338,6 +2359,6 @@ function toErrorMessage(error) {
 	return error instanceof Error ? error.message : String(error);
 }
 //#endregion
-export { LEGACY_OPENMELD_AGENT_SESSION_ENV_KEY as $, runtimeDispatchPolicySchema as $t, toSpaceCursorUrl as A, openMeldManagedBinaryPath as At, toSpaceUpdatesUrl as B, resolveOpenMeldCliEntryNameFromArgv as Bt, updateConfiguredSkillsConfig as C, deviceOpenClawProfileWorkspaceDir as Ct, toSpaceBoardUrl as D, normalizeOpenMeldProfileId as Dt, toDaemonRouteObservationUrl as E, normalizeAccountKey as Et, toSpaceMembersUrl as F, organizationSkillReleaseDir as Ft, isOpenMeldOrphanedLockError as G, runtimeLogsDir as Gt, acquireLock as H, resolveOpenMeldPresetOwnedPathInput as Ht, toSpaceMetaUrl as I, profileDir as It, releaseLockSync as J, systemDir as Jt, readLockMeta as K, skillsDir as Kt, toSpacePasswordUrl as L, profileViewPath as Lt, toSpaceDispatchLookupUrl as M, openMeldManagedVersionDir as Mt, toSpaceDispatchTraceUrl as N, openMeldRootDir as Nt, toSpaceContractUrl as O, openMeldBackupsDir as Ot, toSpaceLeaveUrl as P, openMeldVersionsDir as Pt, tryCleanupStaleLock as Q, runtimeAgentControllerLaunchContractSchema as Qt, toSpaceRemoveMembersUrl as R, resolveDefaultOpenMeldHomeDirname as Rt, updateConfiguredOnboardingConfig as S, deviceOpenClawProfileDir as St, normalizeBaseUrl as T, legacyAccountProfileSpacesDir as Tt, buildOpenMeldOrphanedLockAction as U, resolveOpenMeldRootDir as Ut, toSpaceWsUrl as V, resolveOpenMeldEnvPreset as Vt, isOpenMeldLockError as W, runtimeDir as Wt, resolveOpenMeldOrphanedLockIssue as X, LEGACY_RUNTIME_DISPATCH_POLICY as Xt, repairOrphanedLegacyLocks as Y, formatLocalMachineIssueMessage as Yt, runWithHeldLock as Z, runtimeAgentControllerConversationIdMappingSpecSchema as Zt, getRuntimeConfigReadHealth as _, __exportAll as _n, accountProfileSpaceCacheDir as _t, resolveBaseUrl as a, resolveBuiltinAgentControllerConversationKind as an, writeCliContextState as at, setConfiguredSkillsConfig as b, accountsDir as bt, resolveExplicitGatewayUrlOrThrow as c, agentControllerRefSchema as cn, LocalMachineFailureError as ct, createDefaultRuntimeAgentControllerSettings as d, canonicalizeBuiltinAgentControllerRef as dn, createBackgroundExecutionBlockedIssue as dt, runtimeStreamingModeSchema as en, OPENMELD_CLI_CONTEXT_ENV_KEY as et, getConfiguredDaemonDispatchLimits as f, normalizeBuiltinAgentControllerId as fn, createOrphanedSetupConcurrencyIssue as ft, getConfiguredViewCustomization as g, resolveBuiltinAgentControllerConversationCapability as gn, accountProfileLocalMetaPath as gt, getConfiguredSkillsConfig as h, agentControllerConversationCapabilitySchema as hn, OPENMELD_HOME_ENV_KEY as ht, normalizeGatewayBaseUrlOrNull as i, conversationPolicySchema as in, resolveCliContextId as it, toSpaceDeleteUrl as j, openMeldManagedVersionBinaryPath as jt, toSpaceCreateUrl as k, openMeldBinDir as kt, DEFAULT_RUNTIME_AGENT_TRANSPORT_MODE as l, buildAgentControllerRoutingKey as ln, assessLocalMachineFailure as lt, getConfiguredOnboardingDisclaimerAcceptedAt as m, parseAgentControllerRef as mn, toRecognizedLocalMachineFailureError as mt, base_url_exports as n, agentControllerConversationRefSchema as nn, readCliContextState as nt, resolveBaseUrlOrNull as o, HOSTED_CENTER_AGENT_CONTROLLER_REF as on, formatLaneScopeSentence as ot, getConfiguredDeviceRuntimeState as p, normalizeKnownBuiltinAgentControllerId as pn, isLocalMachineFailureError as pt, releaseLock as q, spacesDir as qt, normalizeGatewayBaseUrl as r, buildAgentControllerConversationRef as rn, resolveCliContext as rt, resolveDefaultGatewayBaseUrl as s, HOSTED_CENTER_AGENT_CONTROLLER_REF_ID as sn, resolveOpenMeldLaneDescriptor as st, DEV_LOCAL_GATEWAY_BASE_URL as t, runtimeTransportModeSchema as tn, listCliContextStates as tt, alignRuntimeConfigStorage as u, canonicalizeAgentControllerRef as un, createActiveSetupConcurrencyIssue as ut, resolveRuntimeSkillsCustomTargetId as v, accountProfileViewPath as vt, updateConfiguredStartV1OnboardingState as w, isPublishedOpenMeldHome as wt, updateConfiguredDeviceRuntimeState as x, deviceOpenClawProfileBootstrapPath as xt, setConfiguredBaseUrl as y, accountProfileWorkspacePath as yt, toSpaceResultUrl as z, resolveExplicitOpenMeldEnvPreset as zt };
+export { tryCleanupStaleLock as $, runtimeAgentControllerLaunchContractSchema as $t, toSpaceCreateUrl as A, openMeldBinDir as At, toSpaceResultUrl as B, resolveExplicitOpenMeldEnvPreset as Bt, updateConfiguredOnboardingConfig as C, deviceOpenClawProfileDir as Ct, toDaemonRouteObservationUrl as D, normalizeAccountKey as Dt, normalizeBaseUrl as E, legacyAccountProfileSpacesDir as Et, toSpaceLeaveUrl as F, openMeldVersionsDir as Ft, isOpenMeldLockError as G, runtimeDir as Gt, toSpaceWsUrl as H, resolveOpenMeldEnvPreset as Ht, toSpaceMembersUrl as I, organizationSkillReleaseDir as It, releaseLock as J, spacesDir as Jt, isOpenMeldOrphanedLockError as K, runtimeLogsDir as Kt, toSpaceMetaUrl as L, profileDir as Lt, toSpaceDeleteUrl as M, openMeldManagedVersionBinaryPath as Mt, toSpaceDispatchLookupUrl as N, openMeldManagedVersionDir as Nt, toSpaceBoardUrl as O, normalizeOpenMeldProfileId as Ot, toSpaceDispatchTraceUrl as P, openMeldRootDir as Pt, runWithHeldLock as Q, runtimeAgentControllerConversationIdMappingSpecSchema as Qt, toSpacePasswordUrl as R, profileViewPath as Rt, updateConfiguredDeviceRuntimeState as S, deviceOpenClawProfileBootstrapPath as St, updateConfiguredStartV1OnboardingState as T, isPublishedOpenMeldHome as Tt, acquireLock as U, resolveOpenMeldPresetOwnedPathInput as Ut, toSpaceUpdatesUrl as V, resolveOpenMeldCliEntryNameFromArgv as Vt, buildOpenMeldOrphanedLockAction as W, resolveOpenMeldRootDir as Wt, repairOrphanedLegacyLocks as X, formatLocalMachineIssueMessage as Xt, releaseLockSync as Y, systemDir as Yt, resolveOpenMeldOrphanedLockIssue as Z, LEGACY_RUNTIME_DISPATCH_POLICY as Zt, getConfiguredViewCustomization as _, resolveBuiltinAgentControllerConversationCapability as _n, accountProfileLocalMetaPath as _t, resolveBaseUrl as a, conversationPolicySchema as an, resolveCliContextId as at, setConfiguredBaseUrl as b, accountProfileWorkspacePath as bt, resolveExplicitGatewayUrlOrThrow as c, HOSTED_CENTER_AGENT_CONTROLLER_REF_ID as cn, resolveOpenMeldLaneDescriptor as ct, createDefaultRuntimeAgentControllerSettings as d, canonicalizeAgentControllerRef as dn, createActiveSetupConcurrencyIssue as dt, runtimeDispatchPolicySchema as en, LEGACY_OPENMELD_AGENT_SESSION_ENV_KEY as et, getConfiguredDaemonDispatchLimits as f, canonicalizeBuiltinAgentControllerRef as fn, createBackgroundExecutionBlockedIssue as ft, getConfiguredSkillsConfig as g, agentControllerConversationCapabilitySchema as gn, OPENMELD_HOME_ENV_KEY as gt, getConfiguredOpenMeldToolsMaintenance as h, parseAgentControllerRef as hn, toRecognizedLocalMachineFailureError as ht, normalizeGatewayBaseUrlOrNull as i, buildAgentControllerConversationRef as in, resolveCliContext as it, toSpaceCursorUrl as j, openMeldManagedBinaryPath as jt, toSpaceContractUrl as k, openMeldBackupsDir as kt, DEFAULT_RUNTIME_AGENT_TRANSPORT_MODE as l, agentControllerRefSchema as ln, LocalMachineFailureError as lt, getConfiguredOnboardingDisclaimerAcceptedAt as m, normalizeKnownBuiltinAgentControllerId as mn, isLocalMachineFailureError as mt, base_url_exports as n, runtimeTransportModeSchema as nn, listCliContextStates as nt, resolveBaseUrlOrNull as o, resolveBuiltinAgentControllerConversationKind as on, writeCliContextState as ot, getConfiguredDeviceRuntimeState as p, normalizeBuiltinAgentControllerId as pn, createOrphanedSetupConcurrencyIssue as pt, readLockMeta as q, skillsDir as qt, normalizeGatewayBaseUrl as r, agentControllerConversationRefSchema as rn, readCliContextState as rt, resolveDefaultGatewayBaseUrl as s, HOSTED_CENTER_AGENT_CONTROLLER_REF as sn, formatLaneScopeSentence as st, DEV_LOCAL_GATEWAY_BASE_URL as t, runtimeStreamingModeSchema as tn, OPENMELD_CLI_CONTEXT_ENV_KEY as tt, alignRuntimeConfigStorage as u, buildAgentControllerRoutingKey as un, assessLocalMachineFailure as ut, getRuntimeConfigReadHealth as v, __exportAll as vn, accountProfileSpaceCacheDir as vt, updateConfiguredSkillsConfig as w, deviceOpenClawProfileWorkspaceDir as wt, setConfiguredSkillsConfig as x, accountsDir as xt, resolveRuntimeSkillsCustomTargetId as y, accountProfileViewPath as yt, toSpaceRemoveMembersUrl as z, resolveDefaultOpenMeldHomeDirname as zt };
 
-//# sourceMappingURL=base-url-Cv9x5Es9.js.map
+//# sourceMappingURL=base-url-Dq4Lk2FB.js.map