openmeld 0.3.107 → 0.3.108

package/dist/{auth-session-Bcfr1k3c.js.map → auth-session-B_VxWQiU.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-session-Bcfr1k3c.js","names":["toErrorMessage","isFileNotFoundError","exhaustiveState"],"sources":["../../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js","../src/strategy-constants.ts","../src/runtime/distribution.ts","../src/config/macos-native-keychain.ts","../src/config/token-store.ts","../src/config/auth-session.ts"],"sourcesContent":["import * as z$1 from \"zod/v4\";\n//#region src/schemas/local-machine/macos-keychain-helper.ts\nconst MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION = 2;\nconst MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = \"disallow\";\nconst macOsKeychainServiceSchema = z$1.string().trim().min(1).max(512);\nconst macOsKeychainAccountSchema = z$1.string().trim().min(1).max(512);\nconst macOsKeychainAccessTokenSchema = z$1.string().min(1).max(65536);\nconst macOsKeychainHelperOperationSchema = z$1.enum([\n\t\"store\",\n\t\"read\",\n\t\"delete\"\n]);\nconst macOsKeychainHelperRequestSchema = z$1.discriminatedUnion(\"operation\", [\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"store\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\taccessToken: macOsKeychainAccessTokenSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"read\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"delete\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t})\n]);\nconst macOsKeychainHelperMutationSuccessSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(true),\n\toperation: z$1.enum([\"store\", \"delete\"])\n});\nconst macOsKeychainHelperReadSuccessSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(true),\n\toperation: z$1.literal(\"read\"),\n\taccessToken: z$1.union([macOsKeychainAccessTokenSchema, z$1.null()])\n});\nconst macOsKeychainHelperErrorSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(false),\n\toperation: macOsKeychainHelperOperationSchema,\n\terrorMessage: z$1.string().trim().min(1).max(2048)\n});\nconst macOsKeychainHelperResponseSchema = z$1.union([\n\tmacOsKeychainHelperMutationSuccessSchema,\n\tmacOsKeychainHelperReadSuccessSchema,\n\tmacOsKeychainHelperErrorSchema\n]);\n//#endregion\nexport { MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION, MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION, macOsKeychainHelperOperationSchema, macOsKeychainHelperRequestSchema, macOsKeychainHelperResponseSchema };\n\n//# sourceMappingURL=macos-keychain-helper.js.map","import { CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from \"@openmeld/schemas\";\n\n// CLI and local daemon timing policy values. Keep this deployment-local; Core\n// and Web have their own constants files even when values intentionally match.\nexport const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 30_000;\nexport const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8000;\nexport const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;\nexport const DEFAULT_WEB_AGENT_SELECTION_TIMEOUT_MS = 30 * 60 * 1000;\nexport const DEFAULT_WEB_AGENT_SELECTION_POLL_INTERVAL_MS = 2000;\nexport const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS = 60_000;\nexport const MIN_SPACE_REQUEST_TIMEOUT_MS = 1000;\nexport const MAX_SPACE_REQUEST_TIMEOUT_MS = 120_000;\nexport const DEFAULT_HEARTBEAT_INTERVAL_MS = 25_000;\nexport const MIN_HEARTBEAT_INTERVAL_MS = 5000;\nexport const MAX_HEARTBEAT_INTERVAL_MS = 60_000;\n// Daemon stream keepalive PING cadence. Sub-idle (below the gateway/Cloudflare\n// idle-eviction window) and independent of the heartbeat, so a quiet daemon\n// socket stays warm even when no heartbeat is due. Carries no lease/readiness.\nexport const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 20_000;\n// Each keepalive PING must see the hub's auto-answered PONG within this\n// window, or the socket is treated as half-open and terminated so the normal\n// reconnect path (which also redelivers in-flight dispatch pushes) can run.\n// Without this deadline a half-open socket is only detected by the heartbeat\n// failure path, which can take ~40s+ at the idle-grown heartbeat interval.\nexport const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 10_000;\nexport const CATALOG_SYNC_INTERVAL_MULTIPLIER = 3;\nexport const MIN_CATALOG_SYNC_INTERVAL_MS = 15_000;\nexport const MAX_CATALOG_SYNC_INTERVAL_MS = 45_000;\nexport const CATALOG_SYNC_RETRY_INTERVAL_MS = 5000;\nexport const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1000;\nexport const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 60_000;\nexport const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15_000;\nexport const REGISTER_RESPONSE_TIMEOUT_MS = 10_000;\nexport const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15_000;\nexport const DAEMON_RUNTIME_CONTRACT_EPOCH =\n  CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;\nexport const OPENCLAW_CLI_TIMEOUT_MS = 30_000;\n","/**\n * Build-time distribution marker.\n *\n * `OpenMeldDistribution` records how this CLI build is shipped and run. It is\n * orthogonal to the runtime lane / env preset (prod | dev-local | canary):\n *\n * - `npm`: shipped as the `openmeld` npm package, run via `node dist/*.js`; the\n *   OpenMeld Service daemon runs as a self-contained node bundle (dist copy +\n *   node_modules dependency closure).\n * - `binary`: shipped as a precompiled single binary (`bun build --compile`),\n *   run and self-installed as one executable; the daemon runs the same binary\n *   via its `service run` subcommand.\n *\n * The value is injected at build time (tsdown defines `\"npm\"`;\n * `scripts/release/build-cli-binary.mjs` defines `\"binary\"` via Bun `--define`)\n * so distribution-mode branching never guesses from paths and cannot be spoofed\n * by a runtime environment variable.\n */\ndeclare const __OPENMELD_DISTRIBUTION__: string | undefined;\n\nexport type OpenMeldDistribution = \"binary\" | \"npm\";\n\nconst BINARY_DISTRIBUTION: OpenMeldDistribution = \"binary\";\nconst NPM_DISTRIBUTION: OpenMeldDistribution = \"npm\";\n\n/**\n * The distribution form this CLI build was compiled for. Falls back to `npm`\n * when the marker is absent (e.g. under Vitest, where no build-time define\n * runs), which keeps the safe, path-independent default.\n */\nexport function resolveOpenMeldDistribution(): OpenMeldDistribution {\n  const injected =\n    typeof __OPENMELD_DISTRIBUTION__ === \"string\"\n      ? __OPENMELD_DISTRIBUTION__\n      : undefined;\n  return injected === BINARY_DISTRIBUTION\n    ? BINARY_DISTRIBUTION\n    : NPM_DISTRIBUTION;\n}\n\nexport function isBinaryDistribution(): boolean {\n  return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;\n}\n","import { spawn } from \"node:child_process\";\nimport { createRequire } from \"node:module\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n  MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n  type MacOsKeychainHelperRequest,\n  macOsKeychainHelperRequestSchema,\n  macOsKeychainHelperResponseSchema,\n} from \"@openmeld/schemas\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\n\nconst MAC_OS_KEYCHAIN_HELPER_ARG = \"__openmeld_macos_keychain_helper\";\nconst HELPER_OUTPUT_MAX_BYTES = 128 * 1024;\nexport const MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS = 5000;\n\ntype MacOsKeychainAddon = {\n  isParentSameExecutable(): boolean;\n  read(service: string, account: string): string | null;\n  remove(service: string, account: string): void;\n  store(service: string, account: string, accessToken: string): void;\n};\n\ntype KeychainAddress = {\n  account: string;\n  service: string;\n};\n\ntype MacOsKeychainHelperRequestInput =\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"read\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"store\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"delete\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >;\ntype MacOsKeychainHelperReadRequestInput = Extract<\n  MacOsKeychainHelperRequestInput,\n  { operation: \"read\" }\n>;\ntype MacOsKeychainHelperMutationRequestInput = Exclude<\n  MacOsKeychainHelperRequestInput,\n  MacOsKeychainHelperReadRequestInput\n>;\n\nlet loadedAddon: MacOsKeychainAddon | null = null;\nlet unresponsiveKeychainError: Error | null = null;\n\nexport async function storeMacOsNativeKeychainToken(\n  input: KeychainAddress & { accessToken: string }\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"store\",\n      service: input.service,\n      account: input.account,\n      accessToken: input.accessToken,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.store(input.service, input.account, input.accessToken);\n}\n\nexport async function readMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<string | null> {\n  if (isBinaryDistribution()) {\n    return await runBoundedMacOsNativeKeychainRequest({\n      operation: \"read\",\n      service: input.service,\n      account: input.account,\n    });\n  }\n  const addon = await loadAddon();\n  return addon.read(input.service, input.account);\n}\n\nexport async function deleteMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"delete\",\n      service: input.service,\n      account: input.account,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.remove(input.service, input.account);\n}\n\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperReadRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<string | null>;\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperMutationRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<undefined>;\nexport async function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperRequestInput,\n  options: { timeoutMs?: number } = {}\n): Promise<string | null | undefined> {\n  const request = macOsKeychainHelperRequestSchema.parse({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n    ...input,\n  });\n  const timeoutMs = options.timeoutMs ?? MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS;\n  if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) {\n    throw new Error(\"macOS Keychain helper timeout must be a positive integer\");\n  }\n\n  return await new Promise<string | null | undefined>((resolve, reject) => {\n    const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {\n      env: process.env,\n      shell: false,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      windowsHide: true,\n    });\n    let settled = false;\n    let stdout = \"\";\n    let stderr = \"\";\n\n    const clearDeadline = () => {\n      clearTimeout(deadline);\n    };\n    const rejectOnce = (error: Error) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearDeadline();\n      reject(error);\n    };\n    const deadline = setTimeout(() => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      child.kill(\"SIGKILL\");\n      reject(\n        new MacOsNativeKeychainTimeoutError(\n          `macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`\n        )\n      );\n    }, timeoutMs);\n\n    child.stdout.setEncoding(\"utf8\");\n    child.stderr.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: unknown) => {\n      stdout += String(chunk);\n      if (Buffer.byteLength(stdout, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        child.kill(\"SIGKILL\");\n        rejectOnce(new Error(\"macOS Keychain helper output was too large\"));\n      }\n    });\n    child.stderr.on(\"data\", (chunk: unknown) => {\n      stderr += String(chunk);\n      if (Buffer.byteLength(stderr, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        stderr = stderr.slice(-HELPER_OUTPUT_MAX_BYTES);\n      }\n    });\n    child.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper could not start: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.stdin.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper input failed: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.once(\"close\", (code) => {\n      if (settled) {\n        return;\n      }\n      clearDeadline();\n      settled = true;\n      try {\n        resolve(\n          parseMacOsKeychainHelperResult({\n            code,\n            operation: request.operation,\n            stderr,\n            stdout,\n          })\n        );\n      } catch (error) {\n        reject(toError(error));\n      }\n    });\n\n    child.stdin.end(JSON.stringify(request), \"utf8\");\n  });\n}\n\nexport async function runMacOsNativeKeychainHelperIfRequested(\n  argv: readonly string[] = process.argv\n): Promise<boolean> {\n  if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) {\n    return false;\n  }\n  if (!(isBinaryDistribution() && process.platform === \"darwin\")) {\n    throw new Error(\n      \"the internal macOS Keychain helper is only available in the macOS binary\"\n    );\n  }\n\n  const addon = await loadAddon();\n  if (!addon.isParentSameExecutable()) {\n    throw new Error(\n      \"the internal macOS Keychain helper is reserved for an OpenMeld child process\"\n    );\n  }\n\n  const rawRequest = await readHelperStdin();\n  let json: unknown;\n  try {\n    json = JSON.parse(rawRequest);\n  } catch {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n  const request = macOsKeychainHelperRequestSchema.safeParse(json);\n  if (!request.success) {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n\n  const response = await executeHelperRequest(request.data).catch((error) => ({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: false as const,\n    operation: request.data.operation,\n    errorMessage: truncateErrorMessage(toErrorMessage(error)),\n  }));\n  process.stdout.write(JSON.stringify(response));\n  return true;\n}\n\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperReadRequestInput\n): Promise<string | null>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperMutationRequestInput\n): Promise<undefined>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperRequestInput\n): Promise<string | null | undefined> {\n  if (unresponsiveKeychainError) {\n    throw unresponsiveKeychainError;\n  }\n  try {\n    if (input.operation === \"read\") {\n      return await runMacOsNativeKeychainRequestInChild(input);\n    }\n    await runMacOsNativeKeychainRequestInChild(input);\n  } catch (error) {\n    if (error instanceof MacOsNativeKeychainTimeoutError) {\n      unresponsiveKeychainError = error;\n    }\n    throw error;\n  }\n}\n\nfunction parseMacOsKeychainHelperResult(input: {\n  code: number | null;\n  operation: MacOsKeychainHelperRequest[\"operation\"];\n  stderr: string;\n  stdout: string;\n}): string | null | undefined {\n  if (input.code !== 0) {\n    throw new Error(\n      `macOS Keychain helper exited with code ${input.code ?? \"unknown\"}${\n        input.stderr.trim() ? `: ${input.stderr.trim()}` : \"\"\n      }`\n    );\n  }\n\n  let rawResponse: unknown;\n  try {\n    rawResponse = JSON.parse(input.stdout);\n  } catch {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);\n  if (!(parsed.success && parsed.data.operation === input.operation)) {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  if (!parsed.data.ok) {\n    throw new Error(parsed.data.errorMessage);\n  }\n  return parsed.data.operation === \"read\" ? parsed.data.accessToken : undefined;\n}\n\nasync function executeHelperRequest(input: MacOsKeychainHelperRequest) {\n  const addon = await loadAddon();\n  if (input.operation === \"store\") {\n    addon.store(input.service, input.account, input.accessToken);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"store\" as const,\n    };\n  }\n  if (input.operation === \"delete\") {\n    addon.remove(input.service, input.account);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"delete\" as const,\n    };\n  }\n  return {\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: true as const,\n    operation: \"read\" as const,\n    accessToken: addon.read(input.service, input.account),\n  };\n}\n\nasync function readHelperStdin(): Promise<string> {\n  let raw = \"\";\n  process.stdin.setEncoding(\"utf8\");\n  for await (const chunk of process.stdin) {\n    raw += String(chunk);\n    if (Buffer.byteLength(raw, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n      throw new Error(\"macOS Keychain helper request was too large\");\n    }\n  }\n  return raw;\n}\n\nfunction truncateErrorMessage(message: string): string {\n  const normalized = message.trim() || \"macOS Keychain operation failed\";\n  return normalized.slice(0, 2048);\n}\n\nfunction formatTimeout(timeoutMs: number): string {\n  return timeoutMs % 1000 === 0\n    ? `${timeoutMs / 1000} seconds`\n    : `${timeoutMs} ms`;\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\nclass MacOsNativeKeychainTimeoutError extends Error {\n  override readonly name = \"MacOsNativeKeychainTimeoutError\";\n}\n\nasync function loadAddon(): Promise<MacOsKeychainAddon> {\n  if (loadedAddon) {\n    return loadedAddon;\n  }\n  if (process.platform !== \"darwin\") {\n    throw new Error(\"macOS Keychain is only available on macOS\");\n  }\n\n  if (isBinaryDistribution()) {\n    const embedded = await import(\"./macos-native-keychain-embedded\");\n    loadedAddon = embedded.loadEmbeddedMacOsKeychainAddon();\n    return loadedAddon;\n  }\n\n  const require = createRequire(import.meta.url);\n  const addonPath = fileURLToPath(\n    new URL(\"./native/openmeld-keychain.node\", import.meta.url)\n  );\n  loadedAddon = require(addonPath) as MacOsKeychainAddon;\n  return loadedAddon;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\nimport {\n  deleteMacOsNativeKeychainToken,\n  readMacOsNativeKeychainToken,\n  storeMacOsNativeKeychainToken,\n} from \"./macos-native-keychain\";\nimport { openMeldRootDir } from \"./paths\";\n\nconst TOKEN_STORE_KEYCHAIN_SERVICE = \"sh.openmeld.auth.token\";\nconst INSECURE_FALLBACK_ENV_KEY = \"OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN\";\nconst FORCE_INSECURE_STORE_ENV_KEY = \"OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN\";\nconst MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE =\n  \"macOS Keychain access is unavailable in this OpenMeld distribution. \" +\n  \"OpenMeld will not open an authorization window from an unattended process. \" +\n  \"Run setup or login with the current packaged OpenMeld CLI.\";\nconst COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;\nconst EXEC_FILE_BASE_OPTIONS = {\n  windowsHide: true,\n  maxBuffer: COMMAND_MAX_BUFFER_BYTES,\n  timeout: COMMAND_TIMEOUT_MS,\n} as const;\nlet insecureFallbackWarningShown = false;\nlet macOsPrivateStorageWarningShown = false;\n\ntype MacOsTokenRef = {\n  provider: \"macos-keychain\";\n  service: string;\n  account: string;\n};\n\ntype WindowsDpapiTokenRef = {\n  provider: \"windows-dpapi\";\n  key: string;\n};\n\ntype InsecureFileTokenRef = {\n  provider: \"insecure-file\";\n  key: string;\n};\n\nexport type StoredTokenRef =\n  | MacOsTokenRef\n  | WindowsDpapiTokenRef\n  | InsecureFileTokenRef;\n\nexport type AccessTokenReadResult =\n  | {\n      accessToken: string;\n      status: \"found\";\n    }\n  | {\n      status: \"missing\";\n    }\n  | {\n      errorMessage: string;\n      status: \"unavailable\";\n    };\n\ntype StoreTokenInput = {\n  accessToken: string;\n  authBaseUrl: string;\n  clientId: string;\n};\n\nexport async function storeAccessToken(\n  input: StoreTokenInput\n): Promise<StoredTokenRef> {\n  const key = buildTokenKey({\n    authBaseUrl: input.authBaseUrl,\n    clientId: input.clientId,\n  });\n\n  if (shouldForceInsecureStore()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  if (process.platform === \"darwin\") {\n    try {\n      const account = buildUniqueMacOsAccount(key);\n      if (shouldUseNativeMacOsKeychain()) {\n        await storeMacOsNativeKeychainToken({\n          account,\n          service: TOKEN_STORE_KEYCHAIN_SERVICE,\n          accessToken: input.accessToken,\n        });\n      } else {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      return {\n        provider: \"macos-keychain\",\n        service: TOKEN_STORE_KEYCHAIN_SERVICE,\n        account,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      const privateKey = buildUniqueTokenFileKey(key);\n      await setInsecureFileToken({\n        key: privateKey,\n        accessToken: input.accessToken,\n      });\n      warnMacOsPrivateStorageFallback(error);\n      return { provider: \"insecure-file\", key: privateKey };\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      await setWindowsDpapiToken({\n        key,\n        accessToken: input.accessToken,\n      });\n      return {\n        provider: \"windows-dpapi\",\n        key,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      throw new Error(\n        `failed to store access token via Windows DPAPI: ${toErrorMessage(error)}`\n      );\n    }\n  }\n\n  if (allowInsecureFallback()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  throw new Error(\n    `secure token storage is unavailable on platform \"${process.platform}\". ` +\n      `Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`\n  );\n}\n\nexport async function readAccessToken(\n  ref: StoredTokenRef\n): Promise<AccessTokenReadResult> {\n  try {\n    if (ref.provider === \"macos-keychain\") {\n      if (!shouldUseNativeMacOsKeychain()) {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      const token = await readMacOsNativeKeychainToken(ref);\n      return toAccessTokenReadResult(token);\n    }\n    if (ref.provider === \"windows-dpapi\") {\n      return toAccessTokenReadResult(await getWindowsDpapiToken(ref));\n    }\n    if (ref.provider === \"insecure-file\") {\n      return toAccessTokenReadResult(await getInsecureFileToken(ref));\n    }\n    return { status: \"missing\" };\n  } catch (error) {\n    return {\n      errorMessage: toErrorMessage(error),\n      status: \"unavailable\",\n    };\n  }\n}\n\nexport async function deleteAccessToken(ref: StoredTokenRef): Promise<void> {\n  if (ref.provider === \"macos-keychain\") {\n    if (!shouldUseNativeMacOsKeychain()) {\n      throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n    }\n    await deleteMacOsNativeKeychainToken(ref);\n    return;\n  }\n  if (ref.provider === \"windows-dpapi\") {\n    await deleteWindowsDpapiToken(ref);\n    return;\n  }\n  if (ref.provider === \"insecure-file\") {\n    await deleteInsecureFileToken(ref);\n  }\n}\n\nexport function isStoredTokenRef(value: unknown): value is StoredTokenRef {\n  if (!(value && typeof value === \"object\")) {\n    return false;\n  }\n  const record = value as Record<string, unknown>;\n  const provider = normalizeString(record.provider);\n  if (provider === \"macos-keychain\") {\n    return Boolean(\n      normalizeString(record.service) &&\n        normalizeString(record.account) &&\n        record.accessGroup === undefined\n    );\n  }\n  if (provider === \"windows-dpapi\" || provider === \"insecure-file\") {\n    return normalizeTokenFileKey(record.key) !== null;\n  }\n  return false;\n}\n\nfunction buildTokenKey(input: {\n  authBaseUrl: string;\n  clientId: string;\n}): string {\n  const rootDir = resolve(openMeldRootDir());\n  return createHash(\"sha256\")\n    .update(`${input.clientId}\\n${input.authBaseUrl}\\n${rootDir}`)\n    .digest(\"hex\");\n}\n\nfunction buildUniqueMacOsAccount(key: string): string {\n  return `openmeld-auth-${key}-${randomUUID()}`;\n}\n\nfunction buildUniqueTokenFileKey(key: string): string {\n  return createHash(\"sha256\").update(`${key}\\n${randomUUID()}`).digest(\"hex\");\n}\n\nfunction shouldUseNativeMacOsKeychain(): boolean {\n  return isBinaryDistribution();\n}\n\nasync function setWindowsDpapiToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  const encrypted = await runPowerShellScript(\n    WINDOWS_DPAPI_ENCRYPT_SCRIPT,\n    input.accessToken,\n    input.key\n  );\n  await mkdir(tokenDirectoryPath(), { recursive: true });\n  // NOTE: `mode: 0o600` is POSIX-only and Windows ignores it.\n  // For `tokenDirectoryPath()` + `windowsDpapiTokenPath()` we rely on DPAPI\n  // and Windows ACLs for equivalent protection.\n  await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n}\n\nasync function getWindowsDpapiToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const encrypted = await readFile(\n    windowsDpapiTokenPath(input.key),\n    \"utf8\"\n  ).catch((error) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw error;\n  });\n  if (!encrypted) {\n    return null;\n  }\n  return runPowerShellScript(\n    WINDOWS_DPAPI_DECRYPT_SCRIPT,\n    encrypted.trim(),\n    input.key\n  );\n}\n\nasync function deleteWindowsDpapiToken(input: { key: string }): Promise<void> {\n  await rm(windowsDpapiTokenPath(input.key), { force: true });\n}\n\nasync function setInsecureFileToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  await ensurePrivateTokenDirectory();\n  const path = insecureTokenPath(input.key);\n  await writeFile(path, `${input.accessToken}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  if (process.platform !== \"win32\") {\n    await chmod(path, 0o600);\n  }\n}\n\nasync function getInsecureFileToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const raw = await readFile(insecureTokenPath(input.key), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  return raw ? raw.trim() : null;\n}\n\nasync function deleteInsecureFileToken(input: { key: string }): Promise<void> {\n  await rm(insecureTokenPath(input.key), { force: true });\n}\n\nfunction tokenDirectoryPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"tokens\");\n}\n\nfunction windowsDpapiTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);\n}\n\nfunction insecureTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);\n}\n\nfunction allowInsecureFallback(): boolean {\n  if (process.env[INSECURE_FALLBACK_ENV_KEY] === \"1\") {\n    warnInsecureFallback(\"env\");\n    return true;\n  }\n  // Known downgrade behavior:\n  // On platforms without native secure-store support, OpenMeld currently falls back\n  // to local file token storage by default for compatibility.\n  const fallbackEnabled = !isNativeSecureStorePlatform();\n  if (fallbackEnabled) {\n    warnInsecureFallback(\"platform\");\n  }\n  return fallbackEnabled;\n}\n\nfunction warnMacOsPrivateStorageFallback(error: unknown): void {\n  if (macOsPrivateStorageWarningShown) {\n    return;\n  }\n  macOsPrivateStorageWarningShown = true;\n  const storageExpectation = isBinaryDistribution()\n    ? \"This session stays in private local storage unless a later sign-in replaces it.\"\n    : \"This npm installation cannot use macOS Keychain. This session stays in private local storage.\";\n  console.warn(\n    \"[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this \" +\n      \"session in a private file protected for your macOS user account, so \" +\n      \"setup can continue. \" +\n      `${storageExpectation} Details: ${toErrorMessage(error)}`\n  );\n}\n\nfunction warnInsecureFallback(reason: \"env\" | \"platform\"): void {\n  if (insecureFallbackWarningShown) {\n    return;\n  }\n  insecureFallbackWarningShown = true;\n\n  const reasonText =\n    reason === \"env\"\n      ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1`\n      : `enabled automatically on platform \"${process.platform}\"`;\n  console.warn(\n    `[openmeld auth] plaintext file token storage fallback is active (${reasonText}). ` +\n      `Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, ` +\n      \"and prefer macOS or Windows for native secure token storage.\"\n  );\n}\n\nfunction shouldForceInsecureStore(): boolean {\n  return process.env[FORCE_INSECURE_STORE_ENV_KEY] === \"1\";\n}\n\nfunction isNativeSecureStorePlatform(): boolean {\n  return process.platform === \"darwin\" || process.platform === \"win32\";\n}\n\nasync function ensurePrivateTokenDirectory(): Promise<void> {\n  const directory = tokenDirectoryPath();\n  await mkdir(directory, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\") {\n    await chmod(directory, 0o700);\n  }\n}\n\nasync function runPowerShellScript(\n  script: string,\n  token: string,\n  entropy: string\n): Promise<string> {\n  const payload = JSON.stringify({ token, entropy });\n  const result = await runCommand(\n    \"powershell.exe\",\n    [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-ExecutionPolicy\",\n      \"Bypass\",\n      \"-Command\",\n      script,\n    ],\n    payload\n  );\n  return result.stdout.trim();\n}\n\nasync function runCommand(\n  command: string,\n  args: string[],\n  stdinPayload: string\n): Promise<{ stdout: string; stderr: string }> {\n  try {\n    const { execFile } = await import(\"node:child_process\");\n    const output = await new Promise<{ stdout: string; stderr: string }>(\n      (resolve, reject) => {\n        let stdout = \"\";\n        let stderr = \"\";\n\n        const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });\n\n        child.stdout?.setEncoding(\"utf8\");\n        child.stderr?.setEncoding(\"utf8\");\n        child.stdout?.on(\"data\", (chunk: unknown) => {\n          stdout += String(chunk);\n        });\n        child.stderr?.on(\"data\", (chunk: unknown) => {\n          stderr += String(chunk);\n        });\n\n        child.on(\"error\", (error) => {\n          reject(toCommandError(error, command));\n        });\n\n        child.on(\"close\", (code) => {\n          if (code === 0) {\n            resolve({ stdout, stderr });\n            return;\n          }\n          reject(\n            toCommandError(\n              {\n                message: `command failed (${command}) with exit code ${code}`,\n              },\n              command\n            )\n          );\n        });\n\n        child.stdin?.write(stdinPayload);\n        child.stdin?.end();\n      }\n    );\n    return output;\n  } catch (error) {\n    throw toCommandError(error, command);\n  }\n}\n\nfunction toCommandError(\n  error: unknown,\n  command: string\n): Error & { code?: number | null; stdout?: string; stderr?: string } {\n  if (!(error && typeof error === \"object\")) {\n    return new Error(`command failed (${command}): ${String(error)}`);\n  }\n  const e = error as NodeJS.ErrnoException & {\n    stdout?: string;\n    stderr?: string;\n    code?: number | null | string;\n  };\n  const code = typeof e.code === \"number\" ? e.code : null;\n  const messageParts = [`command failed (${command})`];\n  if (typeof e.stderr === \"string\" && e.stderr.trim()) {\n    messageParts.push(`stderr: ${e.stderr.trim()}`);\n  } else if (e.message) {\n    messageParts.push(e.message);\n  }\n  const wrapped = new Error(messageParts.join(\"; \")) as Error & {\n    code?: number | null;\n    stdout?: string;\n    stderr?: string;\n  };\n  wrapped.code = code;\n  wrapped.stdout = e.stdout;\n  wrapped.stderr = e.stderr;\n  return wrapped;\n}\n\nfunction normalizeString(value: unknown): string {\n  return String(value ?? \"\").trim();\n}\n\nfunction normalizeTokenFileKey(value: unknown): string | null {\n  const normalized = normalizeString(value);\n  if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction requireValidTokenFileKey(value: unknown): string {\n  const normalized = normalizeTokenFileKey(value);\n  if (normalized === null) {\n    throw new Error(\"stored token key is invalid\");\n  }\n  return normalized;\n}\n\nfunction normalizeToken(value: string | null): string | null {\n  if (value === null) {\n    return null;\n  }\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction toAccessTokenReadResult(value: string | null): AccessTokenReadResult {\n  const accessToken = normalizeToken(value);\n  if (!accessToken) {\n    return { status: \"missing\" };\n  }\n  return {\n    accessToken,\n    status: \"found\",\n  };\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  return String(error);\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nconst WINDOWS_DPAPI_ENCRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Convert]::ToBase64String($cipher)\",\n].join(\";\");\n\nconst WINDOWS_DPAPI_DECRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$cipher=[System.Convert]::FromBase64String($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Text.Encoding]::UTF8.GetString($plain)\",\n].join(\";\");\n","import { randomUUID } from \"node:crypto\";\nimport { mkdir, open, readFile, rename, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  DEFAULT_REMOTE_SESSION_TIMEOUT_MS,\n  LOOPBACK_REMOTE_SESSION_TIMEOUT_MS,\n} from \"../strategy-constants\";\nimport { openMeldRootDir } from \"./paths\";\nimport {\n  deleteAccessToken,\n  isStoredTokenRef,\n  readAccessToken,\n  type StoredTokenRef,\n  storeAccessToken,\n} from \"./token-store\";\n\ntype AuthSessionV1 = {\n  v: 1;\n  tokenRef: StoredTokenRef;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype PendingTokenCleanupV1 = {\n  v: 1;\n  tokenRefs: StoredTokenRef[];\n};\n\nexport type ClearAuthSessionResult = {\n  hadLocalSession: boolean;\n};\n\nexport type StoredActiveOrganization = {\n  id: string;\n  slug: string;\n  name: string;\n  role?: string;\n  personal?: boolean;\n};\n\nexport type StoredAuthSession = {\n  v: 1;\n  accessToken: string;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type AuthSessionState =\n  | \"missing\"\n  | \"valid\"\n  | \"expired\"\n  | \"invalid\"\n  | \"revoked\";\n\nexport type AuthSessionStateReasonCode =\n  | \"remote_session_invalid\"\n  | \"remote_session_revoked\"\n  | \"session_expired\"\n  | \"session_metadata_invalid\"\n  | \"session_missing\"\n  | \"session_token_missing\"\n  | \"session_token_ref_invalid\"\n  | \"session_token_unavailable\";\n\nexport type AuthSessionStateResult = {\n  errorMessage?: string;\n  reasonCode?: AuthSessionStateReasonCode;\n  state: AuthSessionState;\n  session: StoredAuthSession | null;\n};\n\nexport type AuthSessionMetadata = {\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype GetAuthSessionStateOptions = {\n  validateRemote?: boolean;\n};\n\ntype LocalAuthSessionState =\n  | {\n      errorMessage?: string;\n      reasonCode: Exclude<\n        AuthSessionStateReasonCode,\n        \"remote_session_invalid\" | \"remote_session_revoked\" | \"session_expired\"\n      >;\n      state: \"missing\" | \"invalid\";\n      session: null;\n    }\n  | {\n      reasonCode: \"session_expired\";\n      state: \"expired\";\n      session: StoredAuthSession;\n    }\n  | {\n      state: \"valid\";\n      session: StoredAuthSession;\n    };\n\ntype RemoteAuthSessionState = \"valid\" | \"invalid\" | \"revoked\" | \"unknown\";\ntype RemoteAuthSessionValidation = {\n  state: RemoteAuthSessionState;\n};\nconst TRAILING_SLASHES_RE = /\\/+$/u;\n\ntype CachedAuthSession = {\n  payloadKey: string;\n  session: StoredAuthSession;\n};\n\nlet cachedAuthSession: CachedAuthSession | null = null;\n\nexport async function getAuthSessionState(\n  options: GetAuthSessionStateOptions = {}\n): Promise<AuthSessionStateResult> {\n  const localState = await getLocalAuthSessionState();\n  switch (localState.state) {\n    case \"missing\":\n    case \"invalid\":\n    case \"expired\":\n      return localState;\n    case \"valid\":\n      break;\n    default:\n      return localState;\n  }\n  if (!options.validateRemote) {\n    return localState;\n  }\n\n  const remoteValidation = await getRemoteAuthSessionState(localState.session);\n  if (remoteValidation.state === \"valid\") {\n    return localState;\n  }\n  if (remoteValidation.state === \"unknown\") {\n    return localState;\n  }\n\n  return {\n    reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),\n    state: remoteValidation.state,\n    session: null,\n  };\n}\n\n// The signed-in owner user id from the local session, or null when signed\n// out. Callers use this as the expected owner for service account-alignment\n// checks; it never validates remotely.\nexport async function getCurrentAuthOwnerUserId(): Promise<string | null> {\n  const authState = await getAuthSessionState({\n    validateRemote: false,\n  }).catch(() => null);\n  const ownerUserId = authState?.session?.user?.id?.trim() ?? \"\";\n  return ownerUserId.length > 0 ? ownerUserId : null;\n}\n\nexport async function setAuthSession(input: {\n  accessToken: string;\n  tokenType?: string;\n  authBaseUrl: string;\n  clientId: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization | null;\n}): Promise<void> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  await retryPendingTokenCleanup();\n\n  const previousPayload = await readSessionPayload();\n  const previousTokenRef = normalizeTokenRef(previousPayload?.tokenRef);\n  const tokenRef = await storeAccessToken({\n    accessToken,\n    authBaseUrl,\n    clientId,\n  });\n\n  const payload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n    authBaseUrl,\n    clientId,\n    createdAt: new Date().toISOString(),\n    ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    ...buildAuthUserPayload(input.user),\n    ...buildActiveOrganizationPayload(input.activeOrganization),\n  };\n\n  const path = authSessionPath();\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n\n  try {\n    await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n    await writeSessionPayloadAtomically(path, payload);\n  } catch (error) {\n    await deleteAccessTokenOrRetainForCleanup(tokenRef);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload,\n    session: buildStoredAuthSession({ accessToken, payload }),\n  });\n  if (\n    previousTokenRef &&\n    !areStoredTokenRefsEqual(previousTokenRef, tokenRef)\n  ) {\n    await deleteAccessTokenOrRetainForCleanup(previousTokenRef);\n  }\n}\n\nexport async function getAuthSession(): Promise<StoredAuthSession | null> {\n  const localState = await getLocalAuthSessionState();\n  if (localState.state === \"missing\" || localState.state === \"invalid\") {\n    return null;\n  }\n  return localState.session;\n}\n\nexport async function getAuthSessionMetadata(): Promise<AuthSessionMetadata | null> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return null;\n  }\n\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(authBaseUrl && clientId && createdAt)) {\n    return null;\n  }\n\n  return {\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(payload.activeOrganization),\n  };\n}\n\nexport async function updateAuthSessionActiveOrganization(\n  activeOrganization: StoredActiveOrganization | null\n): Promise<void> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    throw new Error(\"cannot update active organization without auth session\");\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) {\n    throw new Error(\n      \"cannot update active organization for invalid auth session\"\n    );\n  }\n\n  const nextPayload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType,\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(activeOrganization),\n  };\n\n  await writeSessionPayloadAtomically(authSessionPath(), nextPayload);\n  const currentCachedSession = readCachedAuthSession(payload);\n  if (currentCachedSession) {\n    cacheAuthSession({\n      payload: nextPayload,\n      session: buildStoredAuthSession({\n        accessToken: currentCachedSession.accessToken,\n        payload: nextPayload,\n      }),\n    });\n  }\n}\n\nexport async function clearAuthSession(): Promise<ClearAuthSessionResult> {\n  cachedAuthSession = null;\n  await retryPendingTokenCleanup();\n  const hadLocalSession = await authSessionFileExists();\n  const payload = await readSessionPayload();\n  if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) {\n    await deleteAccessTokenOrRetainForCleanup(payload.tokenRef);\n  }\n  await removeSessionFile();\n  return { hadLocalSession };\n}\n\nasync function retryPendingTokenCleanup(): Promise<void> {\n  const pending = await readPendingTokenCleanup();\n  if (pending.tokenRefs.length === 0) {\n    return;\n  }\n\n  const remaining: StoredTokenRef[] = [];\n  for (const tokenRef of pending.tokenRefs) {\n    try {\n      await deleteAccessToken(tokenRef);\n    } catch {\n      remaining.push(tokenRef);\n    }\n  }\n  await persistPendingTokenCleanup(remaining);\n}\n\nasync function deleteAccessTokenOrRetainForCleanup(\n  tokenRef: StoredTokenRef\n): Promise<void> {\n  try {\n    await deleteAccessToken(tokenRef);\n  } catch {\n    const pending = await readPendingTokenCleanup();\n    if (\n      pending.tokenRefs.some((ref) => areStoredTokenRefsEqual(ref, tokenRef))\n    ) {\n      return;\n    }\n    await persistPendingTokenCleanup([...pending.tokenRefs, tokenRef]);\n  }\n}\n\nasync function readPendingTokenCleanup(): Promise<PendingTokenCleanupV1> {\n  const raw = await readFile(pendingTokenCleanupPath(), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  if (raw === null) {\n    return { v: 1, tokenRefs: [] };\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  if (\n    !(isRecord(parsed) && parsed.v === 1 && Array.isArray(parsed.tokenRefs))\n  ) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  const tokenRefs = parsed.tokenRefs.filter(isStoredTokenRef);\n  if (tokenRefs.length !== parsed.tokenRefs.length) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  return { v: 1, tokenRefs };\n}\n\nasync function persistPendingTokenCleanup(\n  tokenRefs: StoredTokenRef[]\n): Promise<void> {\n  const path = pendingTokenCleanupPath();\n  if (tokenRefs.length === 0) {\n    await rm(path, { force: true });\n    return;\n  }\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n  await writeJsonAtomically(path, { v: 1, tokenRefs });\n}\n\nfunction pendingTokenCleanupPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"pending-token-cleanup.json\");\n}\n\nasync function authSessionFileExists(): Promise<boolean> {\n  try {\n    await readFile(authSessionPath(), \"utf8\");\n    return true;\n  } catch (error) {\n    if (isFileNotFoundError(error)) {\n      return false;\n    }\n    throw error;\n  }\n}\n\nasync function getLocalAuthSessionState(): Promise<LocalAuthSessionState> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return {\n      reasonCode: \"session_missing\",\n      state: \"missing\",\n      session: null,\n    };\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  if (!tokenRef) {\n    return {\n      reasonCode: \"session_token_ref_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenType && authBaseUrl && clientId && createdAt)) {\n    return {\n      reasonCode: \"session_metadata_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  let session = readCachedAuthSession(payload);\n  if (!session) {\n    const accessToken = await readAccessToken(tokenRef);\n    if (accessToken.status === \"missing\") {\n      return {\n        reasonCode: \"session_token_missing\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    if (accessToken.status === \"unavailable\") {\n      return {\n        errorMessage: accessToken.errorMessage,\n        reasonCode: \"session_token_unavailable\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    session = buildStoredAuthSession({\n      accessToken: accessToken.accessToken,\n      payload: {\n        ...payload,\n        v: 1,\n        tokenRef,\n        tokenType,\n        authBaseUrl,\n        clientId,\n        createdAt,\n      },\n    });\n    cacheAuthSession({ payload, session });\n  }\n\n  if (isExpired(session.expiresAt)) {\n    return {\n      reasonCode: \"session_expired\",\n      state: \"expired\",\n      session,\n    };\n  }\n\n  return {\n    state: \"valid\",\n    session,\n  };\n}\n\nasync function assertStoredAccessTokenReloads(input: {\n  accessToken: string;\n  tokenRef: StoredTokenRef;\n}): Promise<void> {\n  const reloaded = await readAccessToken(input.tokenRef);\n  if (\n    reloaded.status === \"found\" &&\n    reloaded.accessToken === input.accessToken\n  ) {\n    return;\n  }\n  if (reloaded.status === \"unavailable\") {\n    throw new Error(\n      `stored access token could not be reloaded: ${reloaded.errorMessage}`\n    );\n  }\n  throw new Error(\"stored access token could not be reloaded\");\n}\n\nfunction buildStoredAuthSession(input: {\n  accessToken: string;\n  payload: AuthSessionV1;\n}): StoredAuthSession {\n  return {\n    v: 1,\n    accessToken: input.accessToken,\n    tokenType: input.payload.tokenType,\n    authBaseUrl: input.payload.authBaseUrl,\n    clientId: input.payload.clientId,\n    createdAt: input.payload.createdAt,\n    ...(typeof input.payload.expiresAt === \"string\" &&\n    input.payload.expiresAt.trim()\n      ? { expiresAt: input.payload.expiresAt.trim() }\n      : {}),\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n}\n\nfunction cacheAuthSession(input: {\n  payload: Partial<AuthSessionV1>;\n  session: StoredAuthSession;\n}): void {\n  cachedAuthSession = {\n    payloadKey: buildAuthSessionPayloadKey(input.payload),\n    session: input.session,\n  };\n}\n\nfunction readCachedAuthSession(\n  payload: Partial<AuthSessionV1>\n): StoredAuthSession | null {\n  const payloadKey = buildAuthSessionPayloadKey(payload);\n  return cachedAuthSession?.payloadKey === payloadKey\n    ? cachedAuthSession.session\n    : null;\n}\n\nfunction buildAuthSessionPayloadKey(payload: Partial<AuthSessionV1>): string {\n  return `${authSessionPath()}\\n${JSON.stringify(payload)}`;\n}\n\nfunction areStoredTokenRefsEqual(\n  left: StoredTokenRef,\n  right: StoredTokenRef\n): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction normalizeTokenRef(input: unknown): StoredTokenRef | null {\n  if (!isStoredTokenRef(input)) {\n    return null;\n  }\n  return input;\n}\n\nasync function getRemoteAuthSessionState(\n  session: StoredAuthSession\n): Promise<RemoteAuthSessionValidation> {\n  let endpoint = \"\";\n  try {\n    endpoint = toAuthEndpoint(session.authBaseUrl, \"/api/auth/get-session\");\n  } catch {\n    return { state: \"invalid\" };\n  }\n  try {\n    const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);\n    const response = await fetch(endpoint, {\n      method: \"GET\",\n      headers: {\n        Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}`,\n      },\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n\n    if (response.status === 401 || response.status === 403) {\n      return { state: \"revoked\" };\n    }\n    if (!response.ok) {\n      // Preserve local credentials on upstream/transient failures.\n      // Non-auth HTTP errors should be retried instead of treated as revocation.\n      return { state: \"unknown\" };\n    }\n\n    const payload = await parseResponseJson(response);\n    if (!hasActiveSessionPayload(payload)) {\n      return { state: \"invalid\" };\n    }\n    return { state: \"valid\" };\n  } catch {\n    return { state: \"unknown\" };\n  }\n}\n\nfunction resolveRemoteSessionTimeoutMs(endpoint: string): number {\n  const url = parseUrlOrNull(endpoint);\n  if (url && isLoopbackHostname(url.hostname)) {\n    return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;\n  }\n  return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n  );\n}\n\nfunction hasActiveSessionPayload(payload: unknown): boolean {\n  if (!isRecord(payload)) {\n    return false;\n  }\n\n  return (\n    isRecord((payload as Record<string, unknown>).session) &&\n    isRecord((payload as Record<string, unknown>).user)\n  );\n}\n\nfunction isExpired(expiresAt: string | undefined): boolean {\n  if (!expiresAt) {\n    return false;\n  }\n  const expiresAtMs = Date.parse(expiresAt);\n  if (Number.isNaN(expiresAtMs)) {\n    return false;\n  }\n  return expiresAtMs <= Date.now();\n}\n\nfunction resolveRemoteAuthSessionReasonCode(\n  state: Exclude<RemoteAuthSessionState, \"valid\" | \"unknown\">\n): AuthSessionStateReasonCode {\n  switch (state) {\n    case \"invalid\":\n      return \"remote_session_invalid\";\n    case \"revoked\":\n      return \"remote_session_revoked\";\n    default: {\n      const exhaustiveState: never = state;\n      throw new Error(\n        `unsupported remote auth session state: ${exhaustiveState}`\n      );\n    }\n  }\n}\n\nasync function readSessionPayload(): Promise<Partial<AuthSessionV1> | null> {\n  const raw = await readFile(authSessionPath(), \"utf8\").catch(() => null);\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw) as Partial<AuthSessionV1>;\n  } catch {\n    return null;\n  }\n}\n\nfunction authSessionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session.json\");\n}\n\nasync function writeSessionPayloadAtomically(\n  path: string,\n  payload: AuthSessionV1\n): Promise<void> {\n  await writeJsonAtomically(path, payload);\n}\n\nasync function writeJsonAtomically(\n  path: string,\n  payload: unknown\n): Promise<void> {\n  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;\n  try {\n    const file = await open(tempPath, \"wx\", 0o600);\n    try {\n      await file.writeFile(`${JSON.stringify(payload, null, 2)}\\n`, \"utf8\");\n      await file.sync();\n    } finally {\n      await file.close();\n    }\n\n    await rename(tempPath, path);\n  } catch (error) {\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nfunction buildAuthUserPayload(value: unknown): {\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n} {\n  if (!(value && typeof value === \"object\")) {\n    return {};\n  }\n  const record = value as Record<string, unknown>;\n  const id = normalizeOptionalString(record.id);\n  const email = normalizeOptionalString(record.email);\n  const name = normalizeOptionalString(record.name);\n  if (!(id || email || name)) {\n    return {};\n  }\n  return {\n    user: {\n      ...(id ? { id } : {}),\n      ...(email ? { email } : {}),\n      ...(name ? { name } : {}),\n    },\n  };\n}\n\nfunction buildActiveOrganizationPayload(value: unknown): {\n  activeOrganization?: StoredActiveOrganization;\n} {\n  const activeOrganization = normalizeStoredActiveOrganization(value);\n  return activeOrganization ? { activeOrganization } : {};\n}\n\nexport function normalizeStoredActiveOrganization(\n  value: unknown\n): StoredActiveOrganization | null {\n  if (!isRecord(value)) {\n    return null;\n  }\n  const id = normalizeOptionalString(value.id);\n  const slug = normalizeOptionalString(value.slug);\n  const name = normalizeOptionalString(value.name);\n  const role = normalizeOptionalString(value.role);\n  const personal = readOrganizationIsPersonal(value);\n  if (!(id && slug && name)) {\n    return null;\n  }\n  return {\n    id,\n    slug,\n    name,\n    ...(role ? { role } : {}),\n    ...(personal ? { personal } : {}),\n  };\n}\n\nexport function readActiveOrganizationIdFromSessionPayload(\n  payload: unknown\n): string | null {\n  if (!isRecord(payload)) {\n    return null;\n  }\n  return (\n    (isRecord(payload.session)\n      ? normalizeOptionalString(payload.session.activeOrganizationId)\n      : null) ?? normalizeOptionalString(payload.activeOrganizationId)\n  );\n}\n\nfunction normalizeTokenType(value: string): string {\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : \"Bearer\";\n}\n\nfunction normalizeOptionalString(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction readOrganizationIsPersonal(value: Record<string, unknown>): boolean {\n  if (value.personal === true || value.isPersonal === true) {\n    return true;\n  }\n\n  const metadata = readOrganizationMetadata(value.metadata);\n  return metadata?.personal === true;\n}\n\nfunction readOrganizationMetadata(\n  metadata: unknown\n): Record<string, unknown> | null {\n  if (metadata === null || metadata === undefined) {\n    return null;\n  }\n\n  if (typeof metadata === \"string\") {\n    try {\n      const parsed = JSON.parse(metadata) as unknown;\n      return isRecord(parsed) ? parsed : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return isRecord(metadata) ? metadata : null;\n}\n\nfunction toAuthEndpoint(baseUrl: string, pathname: string): string {\n  const url = new URL(baseUrl);\n  const normalizedBasePath = url.pathname.replace(TRAILING_SLASHES_RE, \"\");\n  const normalizedPathname = pathname.startsWith(\"/\")\n    ? pathname\n    : `/${pathname}`;\n  url.pathname = `${normalizedBasePath}${normalizedPathname}` || \"/\";\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\nasync function parseResponseJson(response: Response): Promise<unknown> {\n  const raw = await response.text();\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return { message: raw };\n  }\n}\n\nasync function removeSessionFile(): Promise<void> {\n  await rm(authSessionPath(), { force: true });\n}\n"],"mappings":";;;;;;;;;;;;AAGA,MAAM,6CAA6C;AACnD,MAAM,6BAA6B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrE,MAAM,6BAA6B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrE,MAAM,iCAAiC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;AACpE,MAAM,qCAAqC,IAAI,KAAK;CACnD;CACA;CACA;AACD,CAAC;AACD,MAAM,mCAAmC,IAAI,mBAAmB,aAAa;CAC5E,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,OAAO;EAC9B,SAAS;EACT,SAAS;EACT,aAAa;EACb,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;CACD,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,MAAM;EAC7B,SAAS;EACT,SAAS;EACT,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;CACD,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,QAAQ;EAC/B,SAAS;EACT,SAAS;EACT,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;AACF,CAAC;AACD,MAAM,2CAA2C,IAAI,aAAa;CACjE,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,IAAI;CACpB,WAAW,IAAI,KAAK,CAAC,SAAS,QAAQ,CAAC;AACxC,CAAC;AACD,MAAM,uCAAuC,IAAI,aAAa;CAC7D,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,IAAI;CACpB,WAAW,IAAI,QAAQ,MAAM;CAC7B,aAAa,IAAI,MAAM,CAAC,gCAAgC,IAAI,KAAK,CAAC,CAAC;AACpE,CAAC;AACD,MAAM,iCAAiC,IAAI,aAAa;CACvD,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,KAAK;CACrB,WAAW;CACX,cAAc,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAClD,CAAC;AACD,MAAM,oCAAoC,IAAI,MAAM;CACnD;CACA;CACA;AACD,CAAC;;;ACrDD,MAAa,mCAAmC;AAChD,MAAa,oCAAoC;AACjD,MAAa,qCAAqC;AAGlD,MAAa,mCAAmC;AAEhD,MAAa,+BAA+B;AAC5C,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,4BAA4B;AACzC,MAAa,4BAA4B;AAIzC,MAAa,sCAAsC;AAMnD,MAAa,0CAA0C;AAIvD,MAAa,iCAAiC;AAC9C,MAAa,uCAAuC;AACpD,MAAa,gCAAgC;AAC7C,MAAa,mDAAmD,IAAI;AACpE,MAAa,yDAAyD;AACtE,MAAa,+CAA+C,IAAI;AAChE,MAAa,qDAAqD;AAClE,MAAa,wCAAwC;AACrD,MAAa,mCAAmC;AAChD,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,gCACX;AACF,MAAa,0BAA0B;;;ACpBvC,MAAM,sBAA4C;AAClD,MAAM,mBAAyC;;;;;;AAO/C,SAAgB,8BAAoD;CAKlE,OAEI;AACN;AAEA,SAAgB,uBAAgC;CAC9C,OAAO,4BAA4B,MAAM;AAC3C;;;AC9BA,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AAqCtC,IAAI,cAAyC;AAC7C,IAAI,4BAA0C;AAE9C,eAAsB,8BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;GACf,aAAa,MAAM;EACrB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;AAC7D;AAEA,eAAsB,6BACpB,OACwB;CACxB,IAAI,qBAAqB,GACvB,OAAO,MAAM,qCAAqC;EAChD,WAAW;EACX,SAAS,MAAM;EACf,SAAS,MAAM;CACjB,CAAC;CAGH,QAAO,MADa,UAAU,EAAA,CACjB,KAAK,MAAM,SAAS,MAAM,OAAO;AAChD;AAEA,eAAsB,+BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;EACjB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,OAAO,MAAM,SAAS,MAAM,OAAO;AAC3C;AAUA,eAAsB,qCACpB,OACA,UAAkC,CAAC,GACC;CACpC,MAAM,UAAU,iCAAiC,MAAM;EACrD,eAAA;EACA,2BAA2B;EAC3B,GAAG;CACL,CAAC;CACD,MAAM,YAAY,QAAQ,aAAA;CAC1B,IAAI,EAAE,OAAO,cAAc,SAAS,KAAK,YAAY,IACnD,MAAM,IAAI,MAAM,0DAA0D;CAG5E,OAAO,MAAM,IAAI,SAAoC,SAAS,WAAW;EACvE,MAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,0BAA0B,GAAG;GAClE,KAAK,QAAQ;GACb,OAAO;GACP,OAAO;IAAC;IAAQ;IAAQ;GAAM;GAC9B,aAAa;EACf,CAAC;EACD,IAAI,UAAU;EACd,IAAI,SAAS;EACb,IAAI,SAAS;EAEb,MAAM,sBAAsB;GAC1B,aAAa,QAAQ;EACvB;EACA,MAAM,cAAc,UAAiB;GACnC,IAAI,SACF;GAEF,UAAU;GACV,cAAc;GACd,OAAO,KAAK;EACd;EACA,MAAM,WAAW,iBAAiB;GAChC,IAAI,SACF;GAEF,UAAU;GACV,MAAM,KAAK,SAAS;GACpB,OACE,IAAI,gCACF,yCAAyC,cAAc,SAAS,GAClE,CACF;EACF,GAAG,SAAS;EAEZ,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBAAyB;IAC/D,MAAM,KAAK,SAAS;IACpB,2BAAW,IAAI,MAAM,4CAA4C,CAAC;GACpE;EACF,CAAC;EACD,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBACtC,SAAS,OAAO,MAAM,OAAwB;EAElD,CAAC;EACD,MAAM,KAAK,UAAU,UAAU;GAC7B,2BACE,IAAI,MACF,0CAA0CA,iBAAe,KAAK,GAChE,CACF;EACF,CAAC;EACD,MAAM,MAAM,KAAK,UAAU,UAAU;GACnC,2BACE,IAAI,MACF,uCAAuCA,iBAAe,KAAK,GAC7D,CACF;EACF,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SACF;GAEF,cAAc;GACd,UAAU;GACV,IAAI;IACF,QACE,+BAA+B;KAC7B;KACA,WAAW,QAAQ;KACnB;KACA;IACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,OAAO,QAAQ,KAAK,CAAC;GACvB;EACF,CAAC;EAED,MAAM,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG,MAAM;CACjD,CAAC;AACH;AAEA,eAAsB,wCACpB,OAA0B,QAAQ,MAChB;CAClB,IAAI,CAAC,KAAK,SAAS,0BAA0B,GAC3C,OAAO;CAET,IAAI,EAAE,qBAAqB,KAAK,QAAQ,aAAa,WACnD,MAAM,IAAI,MACR,0EACF;CAIF,IAAI,EAAC,MADe,UAAU,EAAA,CACnB,uBAAuB,GAChC,MAAM,IAAI,MACR,8EACF;CAGF,MAAM,aAAa,MAAM,gBAAgB;CACzC,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,UAAU;CAC9B,QAAQ;EACN,MAAM,IAAI,MAAM,uCAAuC;CACzD;CACA,MAAM,UAAU,iCAAiC,UAAU,IAAI;CAC/D,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,WAAW,MAAM,qBAAqB,QAAQ,IAAI,CAAC,CAAC,OAAO,WAAW;EAC1E,eAAA;EACA,IAAI;EACJ,WAAW,QAAQ,KAAK;EACxB,cAAc,qBAAqBA,iBAAe,KAAK,CAAC;CAC1D,EAAE;CACF,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,CAAC;CAC7C,OAAO;AACT;AAQA,eAAe,qCACb,OACoC;CACpC,IAAI,2BACF,MAAM;CAER,IAAI;EACF,IAAI,MAAM,cAAc,QACtB,OAAO,MAAM,qCAAqC,KAAK;EAEzD,MAAM,qCAAqC,KAAK;CAClD,SAAS,OAAO;EACd,IAAI,iBAAiB,iCACnB,4BAA4B;EAE9B,MAAM;CACR;AACF;AAEA,SAAS,+BAA+B,OAKV;CAC5B,IAAI,MAAM,SAAS,GACjB,MAAM,IAAI,MACR,0CAA0C,MAAM,QAAQ,YACtD,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,IAEvD;CAGF,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,MAAM,MAAM;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,MAAM,SAAS,kCAAkC,UAAU,WAAW;CACtE,IAAI,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,MAAM,YACtD,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,CAAC,OAAO,KAAK,IACf,MAAM,IAAI,MAAM,OAAO,KAAK,YAAY;CAE1C,OAAO,OAAO,KAAK,cAAc,SAAS,OAAO,KAAK,cAAc,KAAA;AACtE;AAEA,eAAe,qBAAqB,OAAmC;CACrE,MAAM,QAAQ,MAAM,UAAU;CAC9B,IAAI,MAAM,cAAc,SAAS;EAC/B,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;EAC3D,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,IAAI,MAAM,cAAc,UAAU;EAChC,MAAM,OAAO,MAAM,SAAS,MAAM,OAAO;EACzC,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,OAAO;EACL,eAAA;EACA,IAAI;EACJ,WAAW;EACX,aAAa,MAAM,KAAK,MAAM,SAAS,MAAM,OAAO;CACtD;AACF;AAEA,eAAe,kBAAmC;CAChD,IAAI,MAAM;CACV,QAAQ,MAAM,YAAY,MAAM;CAChC,WAAW,MAAM,SAAS,QAAQ,OAAO;EACvC,OAAO,OAAO,KAAK;EACnB,IAAI,OAAO,WAAW,KAAK,MAAM,IAAI,yBACnC,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,SAAyB;CAErD,QADmB,QAAQ,KAAK,KAAK,kCAAA,CACnB,MAAM,GAAG,IAAI;AACjC;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,YAAY,QAAS,IACxB,GAAG,YAAY,IAAK,YACpB,GAAG,UAAU;AACnB;AAEA,SAASA,iBAAe,OAAwB;CAC9C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,OAAyB;AAC3B;AAEA,eAAe,YAAyC;CACtD,IAAI,aACF,OAAO;CAET,IAAI,QAAQ,aAAa,UACvB,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,qBAAqB,GAAG;EAE1B,eAAc,MADS,OAAO,2CAAA,CACP,+BAA+B;EACtD,OAAO;CACT;CAMA,cAJgB,cAAc,OAAO,KAAK,GAItB,CAAC,CAHH,cAChB,IAAI,IAAI,mCAAmC,OAAO,KAAK,GAAG,CAE9B,CAAC;CAC/B,OAAO;AACT;;;ACtXA,MAAM,+BAA+B;AACrC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,qDACJ;AAGF,MAAM,2BAA2B,OAAO;AACxC,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,yBAAyB;CAC7B,aAAa;CACb,WAAW;CACX,SAAS;AACX;AACA,IAAI,+BAA+B;AACnC,IAAI,kCAAkC;AA0CtC,eAAsB,iBACpB,OACyB;CACzB,MAAM,MAAM,cAAc;EACxB,aAAa,MAAM;EACnB,UAAU,MAAM;CAClB,CAAC;CAED,IAAI,yBAAyB,GAAG;EAC9B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,UAAU,wBAAwB,GAAG;EAC3C,IAAI,6BAA6B,GAC/B,MAAM,8BAA8B;GAClC;GACA,SAAS;GACT,aAAa,MAAM;EACrB,CAAC;OAED,MAAM,IAAI,MAAM,kDAAkD;EAEpE,OAAO;GACL,UAAU;GACV,SAAS;GACT;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,aAAa,wBAAwB,GAAG;EAC9C,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,gCAAgC,KAAK;EACrC,OAAO;GAAE,UAAU;GAAiB,KAAK;EAAW;CACtD;CAGF,IAAI,QAAQ,aAAa,SACvB,IAAI;EACF,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,IAAI,MACR,mDAAmD,eAAe,KAAK,GACzE;CACF;CAGF,IAAI,sBAAsB,GAAG;EAC3B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,MAAM,IAAI,MACR,oDAAoD,QAAQ,SAAS,SAC5D,0BAA0B,oCACrC;AACF;AAEA,eAAsB,gBACpB,KACgC;CAChC,IAAI;EACF,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;GAGpE,OAAO,wBAAwB,MADX,6BAA6B,GAAG,CAChB;EACtC;EACA,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,OAAO,EAAE,QAAQ,UAAU;CAC7B,SAAS,OAAO;EACd,OAAO;GACL,cAAc,eAAe,KAAK;GAClC,QAAQ;EACV;CACF;AACF;AAEA,eAAsB,kBAAkB,KAAoC;CAC1E,IAAI,IAAI,aAAa,kBAAkB;EACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,+BAA+B,GAAG;EACxC;CACF;CACA,IAAI,IAAI,aAAa,iBAAiB;EACpC,MAAM,wBAAwB,GAAG;EACjC;CACF;CACA,IAAI,IAAI,aAAa,iBACnB,MAAM,wBAAwB,GAAG;AAErC;AAEA,SAAgB,iBAAiB,OAAyC;CACxE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO;CAET,MAAM,SAAS;CACf,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,aAAa,kBACf,OAAO,QACL,gBAAgB,OAAO,OAAO,KAC5B,gBAAgB,OAAO,OAAO,KAC9B,OAAO,gBAAgB,KAAA,CAC3B;CAEF,IAAI,aAAa,mBAAmB,aAAa,iBAC/C,OAAO,sBAAsB,OAAO,GAAG,MAAM;CAE/C,OAAO;AACT;AAEA,SAAS,cAAc,OAGZ;CACT,MAAM,UAAU,QAAQ,gBAAgB,CAAC;CACzC,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,GAAG,MAAM,SAAS,IAAI,MAAM,YAAY,IAAI,SAAS,CAAC,CAC7D,OAAO,KAAK;AACjB;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,iBAAiB,IAAI,GAAG,WAAW;AAC5C;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,OAAO,KAAK;AAC5E;AAEA,SAAS,+BAAwC;CAC/C,OAAO,qBAAqB;AAC9B;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,YAAY,MAAM,oBACtB,8BACA,MAAM,aACN,MAAM,GACR;CACA,MAAM,MAAM,mBAAmB,GAAG,EAAE,WAAW,KAAK,CAAC;CAIrD,MAAM,UAAU,sBAAsB,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,EAAE,KAAK;EACzE,UAAU;EACV,MAAM;CACR,CAAC;AACH;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,YAAY,MAAM,SACtB,sBAAsB,MAAM,GAAG,GAC/B,MACF,CAAC,CAAC,OAAO,UAAU;EACjB,IAAIC,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CAAC;CACD,IAAI,CAAC,WACH,OAAO;CAET,OAAO,oBACL,8BACA,UAAU,KAAK,GACf,MAAM,GACR;AACF;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,sBAAsB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,4BAA4B;CAClC,MAAM,OAAO,kBAAkB,MAAM,GAAG;CACxC,MAAM,UAAU,MAAM,GAAG,MAAM,YAAY,KAAK;EAC9C,UAAU;EACV,MAAM;CACR,CAAC;CACD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,MAAM,GAAK;AAE3B;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,MAAM,MAAM,SAAS,kBAAkB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAC9D,UAAU;EACT,IAAIA,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,OAAO,MAAM,IAAI,KAAK,IAAI;AAC5B;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,kBAAkB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxD;AAEA,SAAS,qBAA6B;CACpC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,QAAQ;AACjD;AAEA,SAAS,sBAAsB,KAAqB;CAClD,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,kBAAkB,KAAqB;CAC9C,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,wBAAiC;CACxC,IAAI,QAAQ,IAAI,+BAA+B,KAAK;EAClD,qBAAqB,KAAK;EAC1B,OAAO;CACT;CAIA,MAAM,kBAAkB,CAAC,4BAA4B;CACrD,IAAI,iBACF,qBAAqB,UAAU;CAEjC,OAAO;AACT;AAEA,SAAS,gCAAgC,OAAsB;CAC7D,IAAI,iCACF;CAEF,kCAAkC;CAClC,MAAM,qBAAqB,qBAAqB,IAC5C,oFACA;CACJ,QAAQ,KACN,8JAGK,mBAAmB,YAAY,eAAe,KAAK,GAC1D;AACF;AAEA,SAAS,qBAAqB,QAAkC;CAC9D,IAAI,8BACF;CAEF,+BAA+B;CAE/B,MAAM,aACJ,WAAW,QACP,cAAc,0BAA0B,MACxC,sCAAsC,QAAQ,SAAS;CAC7D,QAAQ,KACN,oEAAoE,WAAW,WACpE,0BAA0B,0FAEvC;AACF;AAEA,SAAS,2BAAoC;CAC3C,OAAO,QAAQ,IAAI,kCAAkC;AACvD;AAEA,SAAS,8BAAuC;CAC9C,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa;AAC/D;AAEA,eAAe,8BAA6C;CAC1D,MAAM,YAAY,mBAAmB;CACrC,MAAM,MAAM,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACvD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,WAAW,GAAK;AAEhC;AAEA,eAAe,oBACb,QACA,OACA,SACiB;CACjB,MAAM,UAAU,KAAK,UAAU;EAAE;EAAO;CAAQ,CAAC;CAajD,QAAO,MAZc,WACnB,kBACA;EACE;EACA;EACA;EACA;EACA;EACA;CACF,GACA,OACF,EAAA,CACc,OAAO,KAAK;AAC5B;AAEA,eAAe,WACb,SACA,MACA,cAC6C;CAC7C,IAAI;EACF,MAAM,EAAE,aAAa,MAAM,OAAO;EAwClC,OAAO,MAvCc,IAAI,SACtB,SAAS,WAAW;GACnB,IAAI,SAAS;GACb,IAAI,SAAS;GAEb,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAAC;GAEnE,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GACD,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GAED,MAAM,GAAG,UAAU,UAAU;IAC3B,OAAO,eAAe,OAAO,OAAO,CAAC;GACvC,CAAC;GAED,MAAM,GAAG,UAAU,SAAS;IAC1B,IAAI,SAAS,GAAG;KACd,QAAQ;MAAE;MAAQ;KAAO,CAAC;KAC1B;IACF;IACA,OACE,eACE,EACE,SAAS,mBAAmB,QAAQ,mBAAmB,OACzD,GACA,OACF,CACF;GACF,CAAC;GAED,MAAM,OAAO,MAAM,YAAY;GAC/B,MAAM,OAAO,IAAI;EACnB,CACF;CAEF,SAAS,OAAO;EACd,MAAM,eAAe,OAAO,OAAO;CACrC;AACF;AAEA,SAAS,eACP,OACA,SACoE;CACpE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,uBAAO,IAAI,MAAM,mBAAmB,QAAQ,KAAK,OAAO,KAAK,GAAG;CAElE,MAAM,IAAI;CAKV,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;CACnD,MAAM,eAAe,CAAC,mBAAmB,QAAQ,EAAE;CACnD,IAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,GAChD,aAAa,KAAK,WAAW,EAAE,OAAO,KAAK,GAAG;MACzC,IAAI,EAAE,SACX,aAAa,KAAK,EAAE,OAAO;CAE7B,MAAM,UAAU,IAAI,MAAM,aAAa,KAAK,IAAI,CAAC;CAKjD,QAAQ,OAAO;CACf,QAAQ,SAAS,EAAE;CACnB,QAAQ,SAAS,EAAE;CACnB,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;AAClC;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,gBAAgB,KAAK;CACxC,IAAI,CAAC,uBAAuB,KAAK,UAAU,GACzC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,yBAAyB,OAAwB;CACxD,MAAM,aAAa,sBAAsB,KAAK;CAC9C,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAS,eAAe,OAAqC;CAC3D,IAAI,UAAU,MACZ,OAAO;CAET,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA6C;CAC5E,MAAM,cAAc,eAAe,KAAK;CACxC,IAAI,CAAC,aACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO;EACL;EACA,QAAQ;CACV;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAEf,OAAO,OAAO,KAAK;AACrB;AAEA,SAASA,sBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;AAEV,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;;;;;;;;;;;;ACncV,MAAM,sBAAsB;AAO5B,IAAI,oBAA8C;AAElD,eAAsB,oBACpB,UAAsC,CAAC,GACN;CACjC,MAAM,aAAa,MAAM,yBAAyB;CAClD,QAAQ,WAAW,OAAnB;EACE,KAAK;EACL,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH;EACF,SACE,OAAO;CACX;CACA,IAAI,CAAC,QAAQ,gBACX,OAAO;CAGT,MAAM,mBAAmB,MAAM,0BAA0B,WAAW,OAAO;CAC3E,IAAI,iBAAiB,UAAU,SAC7B,OAAO;CAET,IAAI,iBAAiB,UAAU,WAC7B,OAAO;CAGT,OAAO;EACL,YAAY,mCAAmC,iBAAiB,KAAK;EACrE,OAAO,iBAAiB;EACxB,SAAS;CACX;AACF;AAKA,eAAsB,4BAAoD;CAIxE,MAAM,eAAc,MAHI,oBAAoB,EAC1C,gBAAgB,MAClB,CAAC,CAAC,CAAC,YAAY,IAAI,EAAA,EACY,SAAS,MAAM,IAAI,KAAK,KAAK;CAC5D,OAAO,YAAY,SAAS,IAAI,cAAc;AAChD;AAEA,eAAsB,eAAe,OAanB;CAChB,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAG7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAGzC,MAAM,yBAAyB;CAG/B,MAAM,mBAAmB,mBAAkB,MADb,mBAAmB,EAAA,EACW,QAAQ;CACpE,MAAM,WAAW,MAAM,iBAAiB;EACtC;EACA;EACA;CACF,CAAC;CAED,MAAM,UAAyB;EAC7B,GAAG;EACH;EACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;EACzD;EACA;EACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,GAAG,qBAAqB,MAAM,IAAI;EAClC,GAAG,+BAA+B,MAAM,kBAAkB;CAC5D;CAEA,MAAM,OAAO,gBAAgB;CAC7B,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAEhE,IAAI;EACF,MAAM,+BAA+B;GAAE;GAAa;EAAS,CAAC;EAC9D,MAAM,8BAA8B,MAAM,OAAO;CACnD,SAAS,OAAO;EACd,MAAM,oCAAoC,QAAQ;EAClD,MAAM;CACR;CAEA,iBAAiB;EACf;EACA,SAAS,uBAAuB;GAAE;GAAa;EAAQ,CAAC;CAC1D,CAAC;CACD,IACE,oBACA,CAAC,wBAAwB,kBAAkB,QAAQ,GAEnD,MAAM,oCAAoC,gBAAgB;AAE9D;AAUA,eAAsB,yBAA8D;CAClF,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;CAGT,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,eAAe,YAAY,YAC/B,OAAO;CAGT,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,QAAQ,kBAAkB;CAC9D;AACF;AAEA,eAAsB,oCACpB,oBACe;CACf,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,MAAM,wDAAwD;CAG1E,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,YAAY,aAAa,eAAe,YAAY,YACxD,MAAM,IAAI,MACR,4DACF;CAGF,MAAM,cAA6B;EACjC,GAAG;EACH;EACA;EACA;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,kBAAkB;CACtD;CAEA,MAAM,8BAA8B,gBAAgB,GAAG,WAAW;CAClE,MAAM,uBAAuB,sBAAsB,OAAO;CAC1D,IAAI,sBACF,iBAAiB;EACf,SAAS;EACT,SAAS,uBAAuB;GAC9B,aAAa,qBAAqB;GAClC,SAAS;EACX,CAAC;CACH,CAAC;AAEL;AAEA,eAAsB,mBAAoD;CACxE,oBAAoB;CACpB,MAAM,yBAAyB;CAC/B,MAAM,kBAAkB,MAAM,sBAAsB;CACpD,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,KAAK,iBAAiB,QAAQ,QAAQ,GACvD,MAAM,oCAAoC,QAAQ,QAAQ;CAE5D,MAAM,kBAAkB;CACxB,OAAO,EAAE,gBAAgB;AAC3B;AAEA,eAAe,2BAA0C;CACvD,MAAM,UAAU,MAAM,wBAAwB;CAC9C,IAAI,QAAQ,UAAU,WAAW,GAC/B;CAGF,MAAM,YAA8B,CAAC;CACrC,KAAK,MAAM,YAAY,QAAQ,WAC7B,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,UAAU,KAAK,QAAQ;CACzB;CAEF,MAAM,2BAA2B,SAAS;AAC5C;AAEA,eAAe,oCACb,UACe;CACf,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,MAAM,UAAU,MAAM,wBAAwB;EAC9C,IACE,QAAQ,UAAU,MAAM,QAAQ,wBAAwB,KAAK,QAAQ,CAAC,GAEtE;EAEF,MAAM,2BAA2B,CAAC,GAAG,QAAQ,WAAW,QAAQ,CAAC;CACnE;AACF;AAEA,eAAe,0BAA0D;CACvE,MAAM,MAAM,MAAM,SAAS,wBAAwB,GAAG,MAAM,CAAC,CAAC,OAC3D,UAAU;EACT,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,IAAI,QAAQ,MACV,OAAO;EAAE,GAAG;EAAG,WAAW,CAAC;CAAE;CAG/B,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C;CACjE;CACA,IACE,EAAE,SAAS,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,SAAS,IAEtE,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,YAAY,OAAO,UAAU,OAAO,gBAAgB;CAC1D,IAAI,UAAU,WAAW,OAAO,UAAU,QACxC,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO;EAAE,GAAG;EAAG;CAAU;AAC3B;AAEA,eAAe,2BACb,WACe;CACf,MAAM,OAAO,wBAAwB;CACrC,IAAI,UAAU,WAAW,GAAG;EAC1B,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;EAC9B;CACF;CACA,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAChE,MAAM,oBAAoB,MAAM;EAAE,GAAG;EAAG;CAAU,CAAC;AACrD;AAEA,SAAS,0BAAkC;CACzC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,4BAA4B;AACrE;AAEA,eAAe,wBAA0C;CACvD,IAAI;EACF,MAAM,SAAS,gBAAgB,GAAG,MAAM;EACxC,OAAO;CACT,SAAS,OAAO;EACd,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR;AACF;AAEA,eAAe,2BAA2D;CACxE,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,IAAI,CAAC,UACH,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,aAAa,eAAe,YAAY,YAC5C,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,IAAI,UAAU,sBAAsB,OAAO;CAC3C,IAAI,CAAC,SAAS;EACZ,MAAM,cAAc,MAAM,gBAAgB,QAAQ;EAClD,IAAI,YAAY,WAAW,WACzB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,IAAI,YAAY,WAAW,eACzB,OAAO;GACL,cAAc,YAAY;GAC1B,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,UAAU,uBAAuB;GAC/B,aAAa,YAAY;GACzB,SAAS;IACP,GAAG;IACH,GAAG;IACH;IACA;IACA;IACA;IACA;GACF;EACF,CAAC;EACD,iBAAiB;GAAE;GAAS;EAAQ,CAAC;CACvC;CAEA,IAAI,UAAU,QAAQ,SAAS,GAC7B,OAAO;EACL,YAAY;EACZ,OAAO;EACP;CACF;CAGF,OAAO;EACL,OAAO;EACP;CACF;AACF;AAEA,eAAe,+BAA+B,OAG5B;CAChB,MAAM,WAAW,MAAM,gBAAgB,MAAM,QAAQ;CACrD,IACE,SAAS,WAAW,WACpB,SAAS,gBAAgB,MAAM,aAE/B;CAEF,IAAI,SAAS,WAAW,eACtB,MAAM,IAAI,MACR,8CAA8C,SAAS,cACzD;CAEF,MAAM,IAAI,MAAM,2CAA2C;AAC7D;AAEA,SAAS,uBAAuB,OAGV;CACpB,OAAO;EACL,GAAG;EACH,aAAa,MAAM;EACnB,WAAW,MAAM,QAAQ;EACzB,aAAa,MAAM,QAAQ;EAC3B,UAAU,MAAM,QAAQ;EACxB,WAAW,MAAM,QAAQ;EACzB,GAAI,OAAO,MAAM,QAAQ,cAAc,YACvC,MAAM,QAAQ,UAAU,KAAK,IACzB,EAAE,WAAW,MAAM,QAAQ,UAAU,KAAK,EAAE,IAC5C,CAAC;EACL,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;AACF;AAEA,SAAS,iBAAiB,OAGjB;CACP,oBAAoB;EAClB,YAAY,2BAA2B,MAAM,OAAO;EACpD,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,sBACP,SAC0B;CAC1B,MAAM,aAAa,2BAA2B,OAAO;CACrD,OAAO,mBAAmB,eAAe,aACrC,kBAAkB,UAClB;AACN;AAEA,SAAS,2BAA2B,SAAyC;CAC3E,OAAO,GAAG,gBAAgB,EAAE,IAAI,KAAK,UAAU,OAAO;AACxD;AAEA,SAAS,wBACP,MACA,OACS;CACT,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,kBAAkB,OAAuC;CAChE,IAAI,CAAC,iBAAiB,KAAK,GACzB,OAAO;CAET,OAAO;AACT;AAEA,eAAe,0BACb,SACsC;CACtC,IAAI,WAAW;CACf,IAAI;EACF,WAAW,eAAe,QAAQ,aAAa,uBAAuB;CACxE,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;CACA,IAAI;EACF,MAAM,YAAY,8BAA8B,QAAQ;EACxD,MAAM,WAAW,MAAM,MAAM,UAAU;GACrC,QAAQ;GACR,SAAS,EACP,eAAe,GAAG,mBAAmB,QAAQ,SAAS,EAAE,GAAG,QAAQ,cACrE;GACA,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,EAAE,OAAO,UAAU;EAE5B,IAAI,CAAC,SAAS,IAGZ,OAAO,EAAE,OAAO,UAAU;EAI5B,IAAI,CAAC,wBAAwB,MADP,kBAAkB,QAAQ,CACZ,GAClC,OAAO,EAAE,OAAO,UAAU;EAE5B,OAAO,EAAE,OAAO,QAAQ;CAC1B,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;AACF;AAEA,SAAS,8BAA8B,UAA0B;CAC/D,MAAM,MAAM,eAAe,QAAQ;CACnC,IAAI,OAAO,mBAAmB,IAAI,QAAQ,GACxC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,UAA2B;CACrD,OACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEA,SAAS,wBAAwB,SAA2B;CAC1D,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO;CAGT,OACE,SAAU,QAAoC,OAAO,KACrD,SAAU,QAAoC,IAAI;AAEtD;AAEA,SAAS,UAAU,WAAwC;CACzD,IAAI,CAAC,WACH,OAAO;CAET,MAAM,cAAc,KAAK,MAAM,SAAS;CACxC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO;CAET,OAAO,eAAe,KAAK,IAAI;AACjC;AAEA,SAAS,mCACP,OAC4B;CAC5B,QAAQ,OAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SAEE,MAAM,IAAI,MACR,0CAA0CC,OAC5C;CAEJ;AACF;AAEA,eAAe,qBAA6D;CAC1E,MAAM,MAAM,MAAM,SAAS,gBAAgB,GAAG,MAAM,CAAC,CAAC,YAAY,IAAI;CACtE,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAA0B;CACjC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,cAAc;AACvD;AAEA,eAAe,8BACb,MACA,SACe;CACf,MAAM,oBAAoB,MAAM,OAAO;AACzC;AAEA,eAAe,oBACb,MACA,SACe;CACf,MAAM,WAAW,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CACxE,IAAI;EACF,MAAM,OAAO,MAAM,KAAK,UAAU,MAAM,GAAK;EAC7C,IAAI;GACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;GACpE,MAAM,KAAK,KAAK;EAClB,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;EAEA,MAAM,OAAO,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,MAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EACzD,MAAM;CACR;AACF;AAEA,SAAS,oBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,SAAS,qBAAqB,OAM5B;CACA,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO,CAAC;CAEV,MAAM,SAAS;CACf,MAAM,KAAK,wBAAwB,OAAO,EAAE;CAC5C,MAAM,QAAQ,wBAAwB,OAAO,KAAK;CAClD,MAAM,OAAO,wBAAwB,OAAO,IAAI;CAChD,IAAI,EAAE,MAAM,SAAS,OACnB,OAAO,CAAC;CAEV,OAAO,EACL,MAAM;EACJ,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;EACnB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EACzB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;CACzB,EACF;AACF;AAEA,SAAS,+BAA+B,OAEtC;CACA,MAAM,qBAAqB,kCAAkC,KAAK;CAClE,OAAO,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AACxD;AAEA,SAAgB,kCACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,MAAM,KAAK,wBAAwB,MAAM,EAAE;CAC3C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,WAAW,2BAA2B,KAAK;CACjD,IAAI,EAAE,MAAM,QAAQ,OAClB,OAAO;CAET,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC;AACF;AAeA,SAAS,mBAAmB,OAAuB;CACjD,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA+B;CAC9D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,2BAA2B,OAAyC;CAC3E,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,OAAO;CAIT,OADiB,yBAAyB,MAAM,QAClC,CAAC,EAAE,aAAa;AAChC;AAEA,SAAS,yBACP,UACgC;CAChC,IAAI,aAAa,QAAQ,aAAa,KAAA,GACpC,OAAO;CAGT,IAAI,OAAO,aAAa,UACtB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,QAAQ;EAClC,OAAO,SAAS,MAAM,IAAI,SAAS;CACrC,QAAQ;EACN,OAAO;CACT;CAGF,OAAO,SAAS,QAAQ,IAAI,WAAW;AACzC;AAEA,SAAS,eAAe,SAAiB,UAA0B;CACjE,MAAM,MAAM,IAAI,IAAI,OAAO;CAK3B,IAAI,WAAW,GAJY,IAAI,SAAS,QAAQ,qBAAqB,EAIlC,IAHR,SAAS,WAAW,GAAG,IAC9C,WACA,IAAI,gBACuD;CAC/D,IAAI,SAAS;CACb,IAAI,OAAO;CACX,OAAO,IAAI,SAAS;AACtB;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAEA,eAAe,kBAAkB,UAAsC;CACrE,MAAM,MAAM,MAAM,SAAS,KAAK;CAChC,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO,EAAE,SAAS,IAAI;CACxB;AACF;AAEA,eAAe,oBAAmC;CAChD,MAAM,GAAG,gBAAgB,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7C"}
+{"version":3,"file":"auth-session-B_VxWQiU.js","names":["toErrorMessage","isFileNotFoundError","exhaustiveState"],"sources":["../../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js","../src/strategy-constants.ts","../src/runtime/distribution.ts","../src/config/macos-native-keychain.ts","../src/config/token-store.ts","../src/config/auth-session.ts"],"sourcesContent":["import * as z$1 from \"zod/v4\";\n//#region src/schemas/local-machine/macos-keychain-helper.ts\nconst MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION = 2;\nconst MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = \"disallow\";\nconst macOsKeychainServiceSchema = z$1.string().trim().min(1).max(512);\nconst macOsKeychainAccountSchema = z$1.string().trim().min(1).max(512);\nconst macOsKeychainAccessTokenSchema = z$1.string().min(1).max(65536);\nconst macOsKeychainHelperOperationSchema = z$1.enum([\n\t\"store\",\n\t\"read\",\n\t\"delete\"\n]);\nconst macOsKeychainHelperRequestSchema = z$1.discriminatedUnion(\"operation\", [\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"store\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\taccessToken: macOsKeychainAccessTokenSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"read\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"delete\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t})\n]);\nconst macOsKeychainHelperMutationSuccessSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(true),\n\toperation: z$1.enum([\"store\", \"delete\"])\n});\nconst macOsKeychainHelperReadSuccessSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(true),\n\toperation: z$1.literal(\"read\"),\n\taccessToken: z$1.union([macOsKeychainAccessTokenSchema, z$1.null()])\n});\nconst macOsKeychainHelperErrorSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(false),\n\toperation: macOsKeychainHelperOperationSchema,\n\terrorMessage: z$1.string().trim().min(1).max(2048)\n});\nconst macOsKeychainHelperResponseSchema = z$1.union([\n\tmacOsKeychainHelperMutationSuccessSchema,\n\tmacOsKeychainHelperReadSuccessSchema,\n\tmacOsKeychainHelperErrorSchema\n]);\n//#endregion\nexport { MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION, MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION, macOsKeychainHelperOperationSchema, macOsKeychainHelperRequestSchema, macOsKeychainHelperResponseSchema };\n\n//# sourceMappingURL=macos-keychain-helper.js.map","import { CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from \"@openmeld/schemas\";\n\n// CLI and local daemon timing policy values. Keep this deployment-local; Core\n// and Web have their own constants files even when values intentionally match.\nexport const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 30_000;\nexport const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8000;\nexport const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;\nexport const DEFAULT_WEB_AGENT_SELECTION_TIMEOUT_MS = 30 * 60 * 1000;\nexport const DEFAULT_WEB_AGENT_SELECTION_POLL_INTERVAL_MS = 2000;\nexport const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS = 60_000;\nexport const MIN_SPACE_REQUEST_TIMEOUT_MS = 1000;\nexport const MAX_SPACE_REQUEST_TIMEOUT_MS = 120_000;\nexport const DEFAULT_HEARTBEAT_INTERVAL_MS = 25_000;\nexport const MIN_HEARTBEAT_INTERVAL_MS = 5000;\nexport const MAX_HEARTBEAT_INTERVAL_MS = 60_000;\n// Daemon stream keepalive PING cadence. Sub-idle (below the gateway/Cloudflare\n// idle-eviction window) and independent of the heartbeat, so a quiet daemon\n// socket stays warm even when no heartbeat is due. Carries no lease/readiness.\nexport const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 20_000;\n// Each keepalive PING must see the hub's auto-answered PONG within this\n// window, or the socket is treated as half-open and terminated so the normal\n// reconnect path (which also redelivers in-flight dispatch pushes) can run.\n// Without this deadline a half-open socket is only detected by the heartbeat\n// failure path, which can take ~40s+ at the idle-grown heartbeat interval.\nexport const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 10_000;\nexport const CATALOG_SYNC_INTERVAL_MULTIPLIER = 3;\nexport const MIN_CATALOG_SYNC_INTERVAL_MS = 15_000;\nexport const MAX_CATALOG_SYNC_INTERVAL_MS = 45_000;\nexport const CATALOG_SYNC_RETRY_INTERVAL_MS = 5000;\nexport const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1000;\nexport const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 60_000;\nexport const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15_000;\nexport const REGISTER_RESPONSE_TIMEOUT_MS = 10_000;\nexport const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15_000;\nexport const DAEMON_RUNTIME_CONTRACT_EPOCH =\n  CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;\nexport const OPENCLAW_CLI_TIMEOUT_MS = 30_000;\n","/**\n * Build-time distribution marker.\n *\n * `OpenMeldDistribution` records how this CLI build is shipped and run. It is\n * orthogonal to the runtime lane / env preset (prod | dev-local | canary):\n *\n * - `npm`: shipped as the `openmeld` npm package, run via `node dist/*.js`; the\n *   OpenMeld Service daemon runs as a self-contained node bundle (dist copy +\n *   node_modules dependency closure).\n * - `binary`: shipped as a precompiled single binary (`bun build --compile`),\n *   run and self-installed as one executable; the daemon runs the same binary\n *   via its `service run` subcommand.\n *\n * The value is injected at build time (tsdown defines `\"npm\"`;\n * `scripts/release/build-cli-binary.mjs` defines `\"binary\"` via Bun `--define`)\n * so distribution-mode branching never guesses from paths and cannot be spoofed\n * by a runtime environment variable.\n */\ndeclare const __OPENMELD_DISTRIBUTION__: string | undefined;\n\nexport type OpenMeldDistribution = \"binary\" | \"npm\";\n\nconst BINARY_DISTRIBUTION: OpenMeldDistribution = \"binary\";\nconst NPM_DISTRIBUTION: OpenMeldDistribution = \"npm\";\n\n/**\n * The distribution form this CLI build was compiled for. Falls back to `npm`\n * when the marker is absent (e.g. under Vitest, where no build-time define\n * runs), which keeps the safe, path-independent default.\n */\nexport function resolveOpenMeldDistribution(): OpenMeldDistribution {\n  const injected =\n    typeof __OPENMELD_DISTRIBUTION__ === \"string\"\n      ? __OPENMELD_DISTRIBUTION__\n      : undefined;\n  return injected === BINARY_DISTRIBUTION\n    ? BINARY_DISTRIBUTION\n    : NPM_DISTRIBUTION;\n}\n\nexport function isBinaryDistribution(): boolean {\n  return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;\n}\n","import { spawn } from \"node:child_process\";\nimport { createRequire } from \"node:module\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n  MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n  type MacOsKeychainHelperRequest,\n  macOsKeychainHelperRequestSchema,\n  macOsKeychainHelperResponseSchema,\n} from \"@openmeld/schemas\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\n\nconst MAC_OS_KEYCHAIN_HELPER_ARG = \"__openmeld_macos_keychain_helper\";\nconst HELPER_OUTPUT_MAX_BYTES = 128 * 1024;\nexport const MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS = 5000;\n\ntype MacOsKeychainAddon = {\n  isParentSameExecutable(): boolean;\n  read(service: string, account: string): string | null;\n  remove(service: string, account: string): void;\n  store(service: string, account: string, accessToken: string): void;\n};\n\ntype KeychainAddress = {\n  account: string;\n  service: string;\n};\n\ntype MacOsKeychainHelperRequestInput =\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"read\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"store\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"delete\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >;\ntype MacOsKeychainHelperReadRequestInput = Extract<\n  MacOsKeychainHelperRequestInput,\n  { operation: \"read\" }\n>;\ntype MacOsKeychainHelperMutationRequestInput = Exclude<\n  MacOsKeychainHelperRequestInput,\n  MacOsKeychainHelperReadRequestInput\n>;\n\nlet loadedAddon: MacOsKeychainAddon | null = null;\nlet unresponsiveKeychainError: Error | null = null;\n\nexport async function storeMacOsNativeKeychainToken(\n  input: KeychainAddress & { accessToken: string }\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"store\",\n      service: input.service,\n      account: input.account,\n      accessToken: input.accessToken,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.store(input.service, input.account, input.accessToken);\n}\n\nexport async function readMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<string | null> {\n  if (isBinaryDistribution()) {\n    return await runBoundedMacOsNativeKeychainRequest({\n      operation: \"read\",\n      service: input.service,\n      account: input.account,\n    });\n  }\n  const addon = await loadAddon();\n  return addon.read(input.service, input.account);\n}\n\nexport async function deleteMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"delete\",\n      service: input.service,\n      account: input.account,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.remove(input.service, input.account);\n}\n\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperReadRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<string | null>;\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperMutationRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<undefined>;\nexport async function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperRequestInput,\n  options: { timeoutMs?: number } = {}\n): Promise<string | null | undefined> {\n  const request = macOsKeychainHelperRequestSchema.parse({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n    ...input,\n  });\n  const timeoutMs = options.timeoutMs ?? MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS;\n  if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) {\n    throw new Error(\"macOS Keychain helper timeout must be a positive integer\");\n  }\n\n  return await new Promise<string | null | undefined>((resolve, reject) => {\n    const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {\n      env: process.env,\n      shell: false,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      windowsHide: true,\n    });\n    let settled = false;\n    let stdout = \"\";\n    let stderr = \"\";\n\n    const clearDeadline = () => {\n      clearTimeout(deadline);\n    };\n    const rejectOnce = (error: Error) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearDeadline();\n      reject(error);\n    };\n    const deadline = setTimeout(() => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      child.kill(\"SIGKILL\");\n      reject(\n        new MacOsNativeKeychainTimeoutError(\n          `macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`\n        )\n      );\n    }, timeoutMs);\n\n    child.stdout.setEncoding(\"utf8\");\n    child.stderr.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: unknown) => {\n      stdout += String(chunk);\n      if (Buffer.byteLength(stdout, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        child.kill(\"SIGKILL\");\n        rejectOnce(new Error(\"macOS Keychain helper output was too large\"));\n      }\n    });\n    child.stderr.on(\"data\", (chunk: unknown) => {\n      stderr += String(chunk);\n      if (Buffer.byteLength(stderr, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        stderr = stderr.slice(-HELPER_OUTPUT_MAX_BYTES);\n      }\n    });\n    child.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper could not start: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.stdin.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper input failed: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.once(\"close\", (code) => {\n      if (settled) {\n        return;\n      }\n      clearDeadline();\n      settled = true;\n      try {\n        resolve(\n          parseMacOsKeychainHelperResult({\n            code,\n            operation: request.operation,\n            stderr,\n            stdout,\n          })\n        );\n      } catch (error) {\n        reject(toError(error));\n      }\n    });\n\n    child.stdin.end(JSON.stringify(request), \"utf8\");\n  });\n}\n\nexport async function runMacOsNativeKeychainHelperIfRequested(\n  argv: readonly string[] = process.argv\n): Promise<boolean> {\n  if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) {\n    return false;\n  }\n  if (!(isBinaryDistribution() && process.platform === \"darwin\")) {\n    throw new Error(\n      \"the internal macOS Keychain helper is only available in the macOS binary\"\n    );\n  }\n\n  const addon = await loadAddon();\n  if (!addon.isParentSameExecutable()) {\n    throw new Error(\n      \"the internal macOS Keychain helper is reserved for an OpenMeld child process\"\n    );\n  }\n\n  const rawRequest = await readHelperStdin();\n  let json: unknown;\n  try {\n    json = JSON.parse(rawRequest);\n  } catch {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n  const request = macOsKeychainHelperRequestSchema.safeParse(json);\n  if (!request.success) {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n\n  const response = await executeHelperRequest(request.data).catch((error) => ({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: false as const,\n    operation: request.data.operation,\n    errorMessage: truncateErrorMessage(toErrorMessage(error)),\n  }));\n  process.stdout.write(JSON.stringify(response));\n  return true;\n}\n\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperReadRequestInput\n): Promise<string | null>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperMutationRequestInput\n): Promise<undefined>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperRequestInput\n): Promise<string | null | undefined> {\n  if (unresponsiveKeychainError) {\n    throw unresponsiveKeychainError;\n  }\n  try {\n    if (input.operation === \"read\") {\n      return await runMacOsNativeKeychainRequestInChild(input);\n    }\n    await runMacOsNativeKeychainRequestInChild(input);\n  } catch (error) {\n    if (error instanceof MacOsNativeKeychainTimeoutError) {\n      unresponsiveKeychainError = error;\n    }\n    throw error;\n  }\n}\n\nfunction parseMacOsKeychainHelperResult(input: {\n  code: number | null;\n  operation: MacOsKeychainHelperRequest[\"operation\"];\n  stderr: string;\n  stdout: string;\n}): string | null | undefined {\n  if (input.code !== 0) {\n    throw new Error(\n      `macOS Keychain helper exited with code ${input.code ?? \"unknown\"}${\n        input.stderr.trim() ? `: ${input.stderr.trim()}` : \"\"\n      }`\n    );\n  }\n\n  let rawResponse: unknown;\n  try {\n    rawResponse = JSON.parse(input.stdout);\n  } catch {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);\n  if (!(parsed.success && parsed.data.operation === input.operation)) {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  if (!parsed.data.ok) {\n    throw new Error(parsed.data.errorMessage);\n  }\n  return parsed.data.operation === \"read\" ? parsed.data.accessToken : undefined;\n}\n\nasync function executeHelperRequest(input: MacOsKeychainHelperRequest) {\n  const addon = await loadAddon();\n  if (input.operation === \"store\") {\n    addon.store(input.service, input.account, input.accessToken);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"store\" as const,\n    };\n  }\n  if (input.operation === \"delete\") {\n    addon.remove(input.service, input.account);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"delete\" as const,\n    };\n  }\n  return {\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: true as const,\n    operation: \"read\" as const,\n    accessToken: addon.read(input.service, input.account),\n  };\n}\n\nasync function readHelperStdin(): Promise<string> {\n  let raw = \"\";\n  process.stdin.setEncoding(\"utf8\");\n  for await (const chunk of process.stdin) {\n    raw += String(chunk);\n    if (Buffer.byteLength(raw, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n      throw new Error(\"macOS Keychain helper request was too large\");\n    }\n  }\n  return raw;\n}\n\nfunction truncateErrorMessage(message: string): string {\n  const normalized = message.trim() || \"macOS Keychain operation failed\";\n  return normalized.slice(0, 2048);\n}\n\nfunction formatTimeout(timeoutMs: number): string {\n  return timeoutMs % 1000 === 0\n    ? `${timeoutMs / 1000} seconds`\n    : `${timeoutMs} ms`;\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\nclass MacOsNativeKeychainTimeoutError extends Error {\n  override readonly name = \"MacOsNativeKeychainTimeoutError\";\n}\n\nasync function loadAddon(): Promise<MacOsKeychainAddon> {\n  if (loadedAddon) {\n    return loadedAddon;\n  }\n  if (process.platform !== \"darwin\") {\n    throw new Error(\"macOS Keychain is only available on macOS\");\n  }\n\n  if (isBinaryDistribution()) {\n    const embedded = await import(\"./macos-native-keychain-embedded\");\n    loadedAddon = embedded.loadEmbeddedMacOsKeychainAddon();\n    return loadedAddon;\n  }\n\n  const require = createRequire(import.meta.url);\n  const addonPath = fileURLToPath(\n    new URL(\"./native/openmeld-keychain.node\", import.meta.url)\n  );\n  loadedAddon = require(addonPath) as MacOsKeychainAddon;\n  return loadedAddon;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\nimport {\n  deleteMacOsNativeKeychainToken,\n  readMacOsNativeKeychainToken,\n  storeMacOsNativeKeychainToken,\n} from \"./macos-native-keychain\";\nimport { openMeldRootDir } from \"./paths\";\n\nconst TOKEN_STORE_KEYCHAIN_SERVICE = \"sh.openmeld.auth.token\";\nconst INSECURE_FALLBACK_ENV_KEY = \"OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN\";\nconst FORCE_INSECURE_STORE_ENV_KEY = \"OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN\";\nconst MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE =\n  \"macOS Keychain access is unavailable in this OpenMeld distribution. \" +\n  \"OpenMeld will not open an authorization window from an unattended process. \" +\n  \"Run setup or login with the current packaged OpenMeld CLI.\";\nconst COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;\nconst EXEC_FILE_BASE_OPTIONS = {\n  windowsHide: true,\n  maxBuffer: COMMAND_MAX_BUFFER_BYTES,\n  timeout: COMMAND_TIMEOUT_MS,\n} as const;\nlet insecureFallbackWarningShown = false;\nlet macOsPrivateStorageWarningShown = false;\n\ntype MacOsTokenRef = {\n  provider: \"macos-keychain\";\n  service: string;\n  account: string;\n};\n\ntype WindowsDpapiTokenRef = {\n  provider: \"windows-dpapi\";\n  key: string;\n};\n\ntype InsecureFileTokenRef = {\n  provider: \"insecure-file\";\n  key: string;\n};\n\nexport type StoredTokenRef =\n  | MacOsTokenRef\n  | WindowsDpapiTokenRef\n  | InsecureFileTokenRef;\n\nexport type AccessTokenReadResult =\n  | {\n      accessToken: string;\n      status: \"found\";\n    }\n  | {\n      status: \"missing\";\n    }\n  | {\n      errorMessage: string;\n      status: \"unavailable\";\n    };\n\ntype StoreTokenInput = {\n  accessToken: string;\n  authBaseUrl: string;\n  clientId: string;\n};\n\nexport async function storeAccessToken(\n  input: StoreTokenInput\n): Promise<StoredTokenRef> {\n  const key = buildTokenKey({\n    authBaseUrl: input.authBaseUrl,\n    clientId: input.clientId,\n  });\n\n  if (shouldForceInsecureStore()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  if (process.platform === \"darwin\") {\n    try {\n      const account = buildUniqueMacOsAccount(key);\n      if (shouldUseNativeMacOsKeychain()) {\n        await storeMacOsNativeKeychainToken({\n          account,\n          service: TOKEN_STORE_KEYCHAIN_SERVICE,\n          accessToken: input.accessToken,\n        });\n      } else {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      return {\n        provider: \"macos-keychain\",\n        service: TOKEN_STORE_KEYCHAIN_SERVICE,\n        account,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      const privateKey = buildUniqueTokenFileKey(key);\n      await setInsecureFileToken({\n        key: privateKey,\n        accessToken: input.accessToken,\n      });\n      warnMacOsPrivateStorageFallback(error);\n      return { provider: \"insecure-file\", key: privateKey };\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      await setWindowsDpapiToken({\n        key,\n        accessToken: input.accessToken,\n      });\n      return {\n        provider: \"windows-dpapi\",\n        key,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key,\n        };\n      }\n      throw new Error(\n        `failed to store access token via Windows DPAPI: ${toErrorMessage(error)}`\n      );\n    }\n  }\n\n  if (allowInsecureFallback()) {\n    await setInsecureFileToken({\n      key,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key,\n    };\n  }\n\n  throw new Error(\n    `secure token storage is unavailable on platform \"${process.platform}\". ` +\n      `Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`\n  );\n}\n\nexport async function readAccessToken(\n  ref: StoredTokenRef\n): Promise<AccessTokenReadResult> {\n  try {\n    if (ref.provider === \"macos-keychain\") {\n      if (!shouldUseNativeMacOsKeychain()) {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      const token = await readMacOsNativeKeychainToken(ref);\n      return toAccessTokenReadResult(token);\n    }\n    if (ref.provider === \"windows-dpapi\") {\n      return toAccessTokenReadResult(await getWindowsDpapiToken(ref));\n    }\n    if (ref.provider === \"insecure-file\") {\n      return toAccessTokenReadResult(await getInsecureFileToken(ref));\n    }\n    return { status: \"missing\" };\n  } catch (error) {\n    return {\n      errorMessage: toErrorMessage(error),\n      status: \"unavailable\",\n    };\n  }\n}\n\nexport async function deleteAccessToken(ref: StoredTokenRef): Promise<void> {\n  if (ref.provider === \"macos-keychain\") {\n    if (!shouldUseNativeMacOsKeychain()) {\n      throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n    }\n    await deleteMacOsNativeKeychainToken(ref);\n    return;\n  }\n  if (ref.provider === \"windows-dpapi\") {\n    await deleteWindowsDpapiToken(ref);\n    return;\n  }\n  if (ref.provider === \"insecure-file\") {\n    await deleteInsecureFileToken(ref);\n  }\n}\n\nexport function isStoredTokenRef(value: unknown): value is StoredTokenRef {\n  if (!(value && typeof value === \"object\")) {\n    return false;\n  }\n  const record = value as Record<string, unknown>;\n  const provider = normalizeString(record.provider);\n  if (provider === \"macos-keychain\") {\n    return Boolean(\n      normalizeString(record.service) &&\n        normalizeString(record.account) &&\n        record.accessGroup === undefined\n    );\n  }\n  if (provider === \"windows-dpapi\" || provider === \"insecure-file\") {\n    return normalizeTokenFileKey(record.key) !== null;\n  }\n  return false;\n}\n\nfunction buildTokenKey(input: {\n  authBaseUrl: string;\n  clientId: string;\n}): string {\n  const rootDir = resolve(openMeldRootDir());\n  return createHash(\"sha256\")\n    .update(`${input.clientId}\\n${input.authBaseUrl}\\n${rootDir}`)\n    .digest(\"hex\");\n}\n\nfunction buildUniqueMacOsAccount(key: string): string {\n  return `openmeld-auth-${key}-${randomUUID()}`;\n}\n\nfunction buildUniqueTokenFileKey(key: string): string {\n  return createHash(\"sha256\").update(`${key}\\n${randomUUID()}`).digest(\"hex\");\n}\n\nfunction shouldUseNativeMacOsKeychain(): boolean {\n  return isBinaryDistribution();\n}\n\nasync function setWindowsDpapiToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  const encrypted = await runPowerShellScript(\n    WINDOWS_DPAPI_ENCRYPT_SCRIPT,\n    input.accessToken,\n    input.key\n  );\n  await mkdir(tokenDirectoryPath(), { recursive: true });\n  // NOTE: `mode: 0o600` is POSIX-only and Windows ignores it.\n  // For `tokenDirectoryPath()` + `windowsDpapiTokenPath()` we rely on DPAPI\n  // and Windows ACLs for equivalent protection.\n  await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n}\n\nasync function getWindowsDpapiToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const encrypted = await readFile(\n    windowsDpapiTokenPath(input.key),\n    \"utf8\"\n  ).catch((error) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw error;\n  });\n  if (!encrypted) {\n    return null;\n  }\n  return runPowerShellScript(\n    WINDOWS_DPAPI_DECRYPT_SCRIPT,\n    encrypted.trim(),\n    input.key\n  );\n}\n\nasync function deleteWindowsDpapiToken(input: { key: string }): Promise<void> {\n  await rm(windowsDpapiTokenPath(input.key), { force: true });\n}\n\nasync function setInsecureFileToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  await ensurePrivateTokenDirectory();\n  const path = insecureTokenPath(input.key);\n  await writeFile(path, `${input.accessToken}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  if (process.platform !== \"win32\") {\n    await chmod(path, 0o600);\n  }\n}\n\nasync function getInsecureFileToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const raw = await readFile(insecureTokenPath(input.key), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  return raw ? raw.trim() : null;\n}\n\nasync function deleteInsecureFileToken(input: { key: string }): Promise<void> {\n  await rm(insecureTokenPath(input.key), { force: true });\n}\n\nfunction tokenDirectoryPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"tokens\");\n}\n\nfunction windowsDpapiTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);\n}\n\nfunction insecureTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);\n}\n\nfunction allowInsecureFallback(): boolean {\n  if (process.env[INSECURE_FALLBACK_ENV_KEY] === \"1\") {\n    warnInsecureFallback(\"env\");\n    return true;\n  }\n  // Known downgrade behavior:\n  // On platforms without native secure-store support, OpenMeld currently falls back\n  // to local file token storage by default for compatibility.\n  const fallbackEnabled = !isNativeSecureStorePlatform();\n  if (fallbackEnabled) {\n    warnInsecureFallback(\"platform\");\n  }\n  return fallbackEnabled;\n}\n\nfunction warnMacOsPrivateStorageFallback(error: unknown): void {\n  if (macOsPrivateStorageWarningShown) {\n    return;\n  }\n  macOsPrivateStorageWarningShown = true;\n  const storageExpectation = isBinaryDistribution()\n    ? \"This session stays in private local storage unless a later sign-in replaces it.\"\n    : \"This npm installation cannot use macOS Keychain. This session stays in private local storage.\";\n  console.warn(\n    \"[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this \" +\n      \"session in a private file protected for your macOS user account, so \" +\n      \"setup can continue. \" +\n      `${storageExpectation} Details: ${toErrorMessage(error)}`\n  );\n}\n\nfunction warnInsecureFallback(reason: \"env\" | \"platform\"): void {\n  if (insecureFallbackWarningShown) {\n    return;\n  }\n  insecureFallbackWarningShown = true;\n\n  const reasonText =\n    reason === \"env\"\n      ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1`\n      : `enabled automatically on platform \"${process.platform}\"`;\n  console.warn(\n    `[openmeld auth] plaintext file token storage fallback is active (${reasonText}). ` +\n      `Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, ` +\n      \"and prefer macOS or Windows for native secure token storage.\"\n  );\n}\n\nfunction shouldForceInsecureStore(): boolean {\n  return process.env[FORCE_INSECURE_STORE_ENV_KEY] === \"1\";\n}\n\nfunction isNativeSecureStorePlatform(): boolean {\n  return process.platform === \"darwin\" || process.platform === \"win32\";\n}\n\nasync function ensurePrivateTokenDirectory(): Promise<void> {\n  const directory = tokenDirectoryPath();\n  await mkdir(directory, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\") {\n    await chmod(directory, 0o700);\n  }\n}\n\nasync function runPowerShellScript(\n  script: string,\n  token: string,\n  entropy: string\n): Promise<string> {\n  const payload = JSON.stringify({ token, entropy });\n  const result = await runCommand(\n    \"powershell.exe\",\n    [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-ExecutionPolicy\",\n      \"Bypass\",\n      \"-Command\",\n      script,\n    ],\n    payload\n  );\n  return result.stdout.trim();\n}\n\nasync function runCommand(\n  command: string,\n  args: string[],\n  stdinPayload: string\n): Promise<{ stdout: string; stderr: string }> {\n  try {\n    const { execFile } = await import(\"node:child_process\");\n    const output = await new Promise<{ stdout: string; stderr: string }>(\n      (resolve, reject) => {\n        let stdout = \"\";\n        let stderr = \"\";\n\n        const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });\n\n        child.stdout?.setEncoding(\"utf8\");\n        child.stderr?.setEncoding(\"utf8\");\n        child.stdout?.on(\"data\", (chunk: unknown) => {\n          stdout += String(chunk);\n        });\n        child.stderr?.on(\"data\", (chunk: unknown) => {\n          stderr += String(chunk);\n        });\n\n        child.on(\"error\", (error) => {\n          reject(toCommandError(error, command));\n        });\n\n        child.on(\"close\", (code) => {\n          if (code === 0) {\n            resolve({ stdout, stderr });\n            return;\n          }\n          reject(\n            toCommandError(\n              {\n                message: `command failed (${command}) with exit code ${code}`,\n              },\n              command\n            )\n          );\n        });\n\n        child.stdin?.write(stdinPayload);\n        child.stdin?.end();\n      }\n    );\n    return output;\n  } catch (error) {\n    throw toCommandError(error, command);\n  }\n}\n\nfunction toCommandError(\n  error: unknown,\n  command: string\n): Error & { code?: number | null; stdout?: string; stderr?: string } {\n  if (!(error && typeof error === \"object\")) {\n    return new Error(`command failed (${command}): ${String(error)}`);\n  }\n  const e = error as NodeJS.ErrnoException & {\n    stdout?: string;\n    stderr?: string;\n    code?: number | null | string;\n  };\n  const code = typeof e.code === \"number\" ? e.code : null;\n  const messageParts = [`command failed (${command})`];\n  if (typeof e.stderr === \"string\" && e.stderr.trim()) {\n    messageParts.push(`stderr: ${e.stderr.trim()}`);\n  } else if (e.message) {\n    messageParts.push(e.message);\n  }\n  const wrapped = new Error(messageParts.join(\"; \")) as Error & {\n    code?: number | null;\n    stdout?: string;\n    stderr?: string;\n  };\n  wrapped.code = code;\n  wrapped.stdout = e.stdout;\n  wrapped.stderr = e.stderr;\n  return wrapped;\n}\n\nfunction normalizeString(value: unknown): string {\n  return String(value ?? \"\").trim();\n}\n\nfunction normalizeTokenFileKey(value: unknown): string | null {\n  const normalized = normalizeString(value);\n  if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction requireValidTokenFileKey(value: unknown): string {\n  const normalized = normalizeTokenFileKey(value);\n  if (normalized === null) {\n    throw new Error(\"stored token key is invalid\");\n  }\n  return normalized;\n}\n\nfunction normalizeToken(value: string | null): string | null {\n  if (value === null) {\n    return null;\n  }\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction toAccessTokenReadResult(value: string | null): AccessTokenReadResult {\n  const accessToken = normalizeToken(value);\n  if (!accessToken) {\n    return { status: \"missing\" };\n  }\n  return {\n    accessToken,\n    status: \"found\",\n  };\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  return String(error);\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nconst WINDOWS_DPAPI_ENCRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Convert]::ToBase64String($cipher)\",\n].join(\";\");\n\nconst WINDOWS_DPAPI_DECRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$cipher=[System.Convert]::FromBase64String($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Text.Encoding]::UTF8.GetString($plain)\",\n].join(\";\");\n","import { randomUUID } from \"node:crypto\";\nimport { mkdir, open, readFile, rename, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  DEFAULT_REMOTE_SESSION_TIMEOUT_MS,\n  LOOPBACK_REMOTE_SESSION_TIMEOUT_MS,\n} from \"../strategy-constants\";\nimport { openMeldRootDir } from \"./paths\";\nimport {\n  deleteAccessToken,\n  isStoredTokenRef,\n  readAccessToken,\n  type StoredTokenRef,\n  storeAccessToken,\n} from \"./token-store\";\n\ntype AuthSessionV1 = {\n  v: 1;\n  tokenRef: StoredTokenRef;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype PendingTokenCleanupV1 = {\n  v: 1;\n  tokenRefs: StoredTokenRef[];\n};\n\nexport type ClearAuthSessionResult = {\n  hadLocalSession: boolean;\n};\n\nexport type StoredActiveOrganization = {\n  id: string;\n  slug: string;\n  name: string;\n  role?: string;\n  personal?: boolean;\n};\n\nexport type StoredAuthSession = {\n  v: 1;\n  accessToken: string;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type AuthSessionState =\n  | \"missing\"\n  | \"valid\"\n  | \"expired\"\n  | \"invalid\"\n  | \"revoked\";\n\nexport type AuthSessionStateReasonCode =\n  | \"remote_session_invalid\"\n  | \"remote_session_revoked\"\n  | \"session_expired\"\n  | \"session_metadata_invalid\"\n  | \"session_missing\"\n  | \"session_token_missing\"\n  | \"session_token_ref_invalid\"\n  | \"session_token_unavailable\";\n\nexport type AuthSessionStateResult = {\n  errorMessage?: string;\n  reasonCode?: AuthSessionStateReasonCode;\n  state: AuthSessionState;\n  session: StoredAuthSession | null;\n};\n\nexport type AuthSessionMetadata = {\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype GetAuthSessionStateOptions = {\n  validateRemote?: boolean;\n};\n\ntype LocalAuthSessionState =\n  | {\n      errorMessage?: string;\n      reasonCode: Exclude<\n        AuthSessionStateReasonCode,\n        \"remote_session_invalid\" | \"remote_session_revoked\" | \"session_expired\"\n      >;\n      state: \"missing\" | \"invalid\";\n      session: null;\n    }\n  | {\n      reasonCode: \"session_expired\";\n      state: \"expired\";\n      session: StoredAuthSession;\n    }\n  | {\n      state: \"valid\";\n      session: StoredAuthSession;\n    };\n\ntype RemoteAuthSessionState = \"valid\" | \"invalid\" | \"revoked\" | \"unknown\";\ntype RemoteAuthSessionValidation = {\n  state: RemoteAuthSessionState;\n};\nconst TRAILING_SLASHES_RE = /\\/+$/u;\n\ntype CachedAuthSession = {\n  payloadKey: string;\n  session: StoredAuthSession;\n};\n\nlet cachedAuthSession: CachedAuthSession | null = null;\n\nexport async function getAuthSessionState(\n  options: GetAuthSessionStateOptions = {}\n): Promise<AuthSessionStateResult> {\n  const localState = await getLocalAuthSessionState();\n  switch (localState.state) {\n    case \"missing\":\n    case \"invalid\":\n    case \"expired\":\n      return localState;\n    case \"valid\":\n      break;\n    default:\n      return localState;\n  }\n  if (!options.validateRemote) {\n    return localState;\n  }\n\n  const remoteValidation = await getRemoteAuthSessionState(localState.session);\n  if (remoteValidation.state === \"valid\") {\n    return localState;\n  }\n  if (remoteValidation.state === \"unknown\") {\n    return localState;\n  }\n\n  return {\n    reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),\n    state: remoteValidation.state,\n    session: null,\n  };\n}\n\n// The signed-in owner user id from the local session, or null when signed\n// out. Callers use this as the expected owner for service account-alignment\n// checks; it never validates remotely.\nexport async function getCurrentAuthOwnerUserId(): Promise<string | null> {\n  const authState = await getAuthSessionState({\n    validateRemote: false,\n  }).catch(() => null);\n  const ownerUserId = authState?.session?.user?.id?.trim() ?? \"\";\n  return ownerUserId.length > 0 ? ownerUserId : null;\n}\n\nexport async function setAuthSession(input: {\n  accessToken: string;\n  tokenType?: string;\n  authBaseUrl: string;\n  clientId: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization | null;\n}): Promise<void> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  await retryPendingTokenCleanup();\n\n  const previousPayload = await readSessionPayload();\n  const previousTokenRef = normalizeTokenRef(previousPayload?.tokenRef);\n  const tokenRef = await storeAccessToken({\n    accessToken,\n    authBaseUrl,\n    clientId,\n  });\n\n  const payload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n    authBaseUrl,\n    clientId,\n    createdAt: new Date().toISOString(),\n    ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n    ...(input.scope ? { scope: input.scope } : {}),\n    ...buildAuthUserPayload(input.user),\n    ...buildActiveOrganizationPayload(input.activeOrganization),\n  };\n\n  const path = authSessionPath();\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n\n  try {\n    await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n    await writeSessionPayloadAtomically(path, payload);\n  } catch (error) {\n    await deleteAccessTokenOrRetainForCleanup(tokenRef);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload,\n    session: buildStoredAuthSession({ accessToken, payload }),\n  });\n  if (\n    previousTokenRef &&\n    !areStoredTokenRefsEqual(previousTokenRef, tokenRef)\n  ) {\n    await deleteAccessTokenOrRetainForCleanup(previousTokenRef);\n  }\n}\n\nexport async function getAuthSession(): Promise<StoredAuthSession | null> {\n  const localState = await getLocalAuthSessionState();\n  if (localState.state === \"missing\" || localState.state === \"invalid\") {\n    return null;\n  }\n  return localState.session;\n}\n\nexport async function getAuthSessionMetadata(): Promise<AuthSessionMetadata | null> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return null;\n  }\n\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(authBaseUrl && clientId && createdAt)) {\n    return null;\n  }\n\n  return {\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(payload.activeOrganization),\n  };\n}\n\nexport async function updateAuthSessionActiveOrganization(\n  activeOrganization: StoredActiveOrganization | null\n): Promise<void> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    throw new Error(\"cannot update active organization without auth session\");\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) {\n    throw new Error(\n      \"cannot update active organization for invalid auth session\"\n    );\n  }\n\n  const nextPayload: AuthSessionV1 = {\n    v: 1,\n    tokenRef,\n    tokenType,\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(activeOrganization),\n  };\n\n  await writeSessionPayloadAtomically(authSessionPath(), nextPayload);\n  const currentCachedSession = readCachedAuthSession(payload);\n  if (currentCachedSession) {\n    cacheAuthSession({\n      payload: nextPayload,\n      session: buildStoredAuthSession({\n        accessToken: currentCachedSession.accessToken,\n        payload: nextPayload,\n      }),\n    });\n  }\n}\n\nexport async function clearAuthSession(): Promise<ClearAuthSessionResult> {\n  cachedAuthSession = null;\n  await retryPendingTokenCleanup();\n  const hadLocalSession = await authSessionFileExists();\n  const payload = await readSessionPayload();\n  if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) {\n    await deleteAccessTokenOrRetainForCleanup(payload.tokenRef);\n  }\n  await removeSessionFile();\n  return { hadLocalSession };\n}\n\nasync function retryPendingTokenCleanup(): Promise<void> {\n  const pending = await readPendingTokenCleanup();\n  if (pending.tokenRefs.length === 0) {\n    return;\n  }\n\n  const remaining: StoredTokenRef[] = [];\n  for (const tokenRef of pending.tokenRefs) {\n    try {\n      await deleteAccessToken(tokenRef);\n    } catch {\n      remaining.push(tokenRef);\n    }\n  }\n  await persistPendingTokenCleanup(remaining);\n}\n\nasync function deleteAccessTokenOrRetainForCleanup(\n  tokenRef: StoredTokenRef\n): Promise<void> {\n  try {\n    await deleteAccessToken(tokenRef);\n  } catch {\n    const pending = await readPendingTokenCleanup();\n    if (\n      pending.tokenRefs.some((ref) => areStoredTokenRefsEqual(ref, tokenRef))\n    ) {\n      return;\n    }\n    await persistPendingTokenCleanup([...pending.tokenRefs, tokenRef]);\n  }\n}\n\nasync function readPendingTokenCleanup(): Promise<PendingTokenCleanupV1> {\n  const raw = await readFile(pendingTokenCleanupPath(), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  if (raw === null) {\n    return { v: 1, tokenRefs: [] };\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  if (\n    !(isRecord(parsed) && parsed.v === 1 && Array.isArray(parsed.tokenRefs))\n  ) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  const tokenRefs = parsed.tokenRefs.filter(isStoredTokenRef);\n  if (tokenRefs.length !== parsed.tokenRefs.length) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  return { v: 1, tokenRefs };\n}\n\nasync function persistPendingTokenCleanup(\n  tokenRefs: StoredTokenRef[]\n): Promise<void> {\n  const path = pendingTokenCleanupPath();\n  if (tokenRefs.length === 0) {\n    await rm(path, { force: true });\n    return;\n  }\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n  await writeJsonAtomically(path, { v: 1, tokenRefs });\n}\n\nfunction pendingTokenCleanupPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"pending-token-cleanup.json\");\n}\n\nasync function authSessionFileExists(): Promise<boolean> {\n  try {\n    await readFile(authSessionPath(), \"utf8\");\n    return true;\n  } catch (error) {\n    if (isFileNotFoundError(error)) {\n      return false;\n    }\n    throw error;\n  }\n}\n\nasync function getLocalAuthSessionState(): Promise<LocalAuthSessionState> {\n  const payload = await readSessionPayload();\n  if (payload?.v !== 1) {\n    return {\n      reasonCode: \"session_missing\",\n      state: \"missing\",\n      session: null,\n    };\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  if (!tokenRef) {\n    return {\n      reasonCode: \"session_token_ref_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenType && authBaseUrl && clientId && createdAt)) {\n    return {\n      reasonCode: \"session_metadata_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  let session = readCachedAuthSession(payload);\n  if (!session) {\n    const accessToken = await readAccessToken(tokenRef);\n    if (accessToken.status === \"missing\") {\n      return {\n        reasonCode: \"session_token_missing\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    if (accessToken.status === \"unavailable\") {\n      return {\n        errorMessage: accessToken.errorMessage,\n        reasonCode: \"session_token_unavailable\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    session = buildStoredAuthSession({\n      accessToken: accessToken.accessToken,\n      payload: {\n        ...payload,\n        v: 1,\n        tokenRef,\n        tokenType,\n        authBaseUrl,\n        clientId,\n        createdAt,\n      },\n    });\n    cacheAuthSession({ payload, session });\n  }\n\n  if (isExpired(session.expiresAt)) {\n    return {\n      reasonCode: \"session_expired\",\n      state: \"expired\",\n      session,\n    };\n  }\n\n  return {\n    state: \"valid\",\n    session,\n  };\n}\n\nasync function assertStoredAccessTokenReloads(input: {\n  accessToken: string;\n  tokenRef: StoredTokenRef;\n}): Promise<void> {\n  const reloaded = await readAccessToken(input.tokenRef);\n  if (\n    reloaded.status === \"found\" &&\n    reloaded.accessToken === input.accessToken\n  ) {\n    return;\n  }\n  if (reloaded.status === \"unavailable\") {\n    throw new Error(\n      `stored access token could not be reloaded: ${reloaded.errorMessage}`\n    );\n  }\n  throw new Error(\"stored access token could not be reloaded\");\n}\n\nfunction buildStoredAuthSession(input: {\n  accessToken: string;\n  payload: AuthSessionV1;\n}): StoredAuthSession {\n  return {\n    v: 1,\n    accessToken: input.accessToken,\n    tokenType: input.payload.tokenType,\n    authBaseUrl: input.payload.authBaseUrl,\n    clientId: input.payload.clientId,\n    createdAt: input.payload.createdAt,\n    ...(typeof input.payload.expiresAt === \"string\" &&\n    input.payload.expiresAt.trim()\n      ? { expiresAt: input.payload.expiresAt.trim() }\n      : {}),\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n}\n\nfunction cacheAuthSession(input: {\n  payload: Partial<AuthSessionV1>;\n  session: StoredAuthSession;\n}): void {\n  cachedAuthSession = {\n    payloadKey: buildAuthSessionPayloadKey(input.payload),\n    session: input.session,\n  };\n}\n\nfunction readCachedAuthSession(\n  payload: Partial<AuthSessionV1>\n): StoredAuthSession | null {\n  const payloadKey = buildAuthSessionPayloadKey(payload);\n  return cachedAuthSession?.payloadKey === payloadKey\n    ? cachedAuthSession.session\n    : null;\n}\n\nfunction buildAuthSessionPayloadKey(payload: Partial<AuthSessionV1>): string {\n  return `${authSessionPath()}\\n${JSON.stringify(payload)}`;\n}\n\nfunction areStoredTokenRefsEqual(\n  left: StoredTokenRef,\n  right: StoredTokenRef\n): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction normalizeTokenRef(input: unknown): StoredTokenRef | null {\n  if (!isStoredTokenRef(input)) {\n    return null;\n  }\n  return input;\n}\n\nasync function getRemoteAuthSessionState(\n  session: StoredAuthSession\n): Promise<RemoteAuthSessionValidation> {\n  let endpoint = \"\";\n  try {\n    endpoint = toAuthEndpoint(session.authBaseUrl, \"/api/auth/get-session\");\n  } catch {\n    return { state: \"invalid\" };\n  }\n  try {\n    const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);\n    const response = await fetch(endpoint, {\n      method: \"GET\",\n      headers: {\n        Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}`,\n      },\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n\n    if (response.status === 401 || response.status === 403) {\n      return { state: \"revoked\" };\n    }\n    if (!response.ok) {\n      // Preserve local credentials on upstream/transient failures.\n      // Non-auth HTTP errors should be retried instead of treated as revocation.\n      return { state: \"unknown\" };\n    }\n\n    const payload = await parseResponseJson(response);\n    if (!hasActiveSessionPayload(payload)) {\n      return { state: \"invalid\" };\n    }\n    return { state: \"valid\" };\n  } catch {\n    return { state: \"unknown\" };\n  }\n}\n\nfunction resolveRemoteSessionTimeoutMs(endpoint: string): number {\n  const url = parseUrlOrNull(endpoint);\n  if (url && isLoopbackHostname(url.hostname)) {\n    return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;\n  }\n  return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction isLoopbackHostname(hostname: string): boolean {\n  return (\n    hostname === \"localhost\" || hostname === \"127.0.0.1\" || hostname === \"::1\"\n  );\n}\n\nfunction hasActiveSessionPayload(payload: unknown): boolean {\n  if (!isRecord(payload)) {\n    return false;\n  }\n\n  return (\n    isRecord((payload as Record<string, unknown>).session) &&\n    isRecord((payload as Record<string, unknown>).user)\n  );\n}\n\nfunction isExpired(expiresAt: string | undefined): boolean {\n  if (!expiresAt) {\n    return false;\n  }\n  const expiresAtMs = Date.parse(expiresAt);\n  if (Number.isNaN(expiresAtMs)) {\n    return false;\n  }\n  return expiresAtMs <= Date.now();\n}\n\nfunction resolveRemoteAuthSessionReasonCode(\n  state: Exclude<RemoteAuthSessionState, \"valid\" | \"unknown\">\n): AuthSessionStateReasonCode {\n  switch (state) {\n    case \"invalid\":\n      return \"remote_session_invalid\";\n    case \"revoked\":\n      return \"remote_session_revoked\";\n    default: {\n      const exhaustiveState: never = state;\n      throw new Error(\n        `unsupported remote auth session state: ${exhaustiveState}`\n      );\n    }\n  }\n}\n\nasync function readSessionPayload(): Promise<Partial<AuthSessionV1> | null> {\n  const raw = await readFile(authSessionPath(), \"utf8\").catch(() => null);\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw) as Partial<AuthSessionV1>;\n  } catch {\n    return null;\n  }\n}\n\nfunction authSessionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session.json\");\n}\n\nasync function writeSessionPayloadAtomically(\n  path: string,\n  payload: AuthSessionV1\n): Promise<void> {\n  await writeJsonAtomically(path, payload);\n}\n\nasync function writeJsonAtomically(\n  path: string,\n  payload: unknown\n): Promise<void> {\n  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;\n  try {\n    const file = await open(tempPath, \"wx\", 0o600);\n    try {\n      await file.writeFile(`${JSON.stringify(payload, null, 2)}\\n`, \"utf8\");\n      await file.sync();\n    } finally {\n      await file.close();\n    }\n\n    await rename(tempPath, path);\n  } catch (error) {\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nfunction buildAuthUserPayload(value: unknown): {\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n} {\n  if (!(value && typeof value === \"object\")) {\n    return {};\n  }\n  const record = value as Record<string, unknown>;\n  const id = normalizeOptionalString(record.id);\n  const email = normalizeOptionalString(record.email);\n  const name = normalizeOptionalString(record.name);\n  if (!(id || email || name)) {\n    return {};\n  }\n  return {\n    user: {\n      ...(id ? { id } : {}),\n      ...(email ? { email } : {}),\n      ...(name ? { name } : {}),\n    },\n  };\n}\n\nfunction buildActiveOrganizationPayload(value: unknown): {\n  activeOrganization?: StoredActiveOrganization;\n} {\n  const activeOrganization = normalizeStoredActiveOrganization(value);\n  return activeOrganization ? { activeOrganization } : {};\n}\n\nexport function normalizeStoredActiveOrganization(\n  value: unknown\n): StoredActiveOrganization | null {\n  if (!isRecord(value)) {\n    return null;\n  }\n  const id = normalizeOptionalString(value.id);\n  const slug = normalizeOptionalString(value.slug);\n  const name = normalizeOptionalString(value.name);\n  const role = normalizeOptionalString(value.role);\n  const personal = readOrganizationIsPersonal(value);\n  if (!(id && slug && name)) {\n    return null;\n  }\n  return {\n    id,\n    slug,\n    name,\n    ...(role ? { role } : {}),\n    ...(personal ? { personal } : {}),\n  };\n}\n\nexport function readActiveOrganizationIdFromSessionPayload(\n  payload: unknown\n): string | null {\n  if (!isRecord(payload)) {\n    return null;\n  }\n  return (\n    (isRecord(payload.session)\n      ? normalizeOptionalString(payload.session.activeOrganizationId)\n      : null) ?? normalizeOptionalString(payload.activeOrganizationId)\n  );\n}\n\nfunction normalizeTokenType(value: string): string {\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : \"Bearer\";\n}\n\nfunction normalizeOptionalString(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction readOrganizationIsPersonal(value: Record<string, unknown>): boolean {\n  if (value.personal === true || value.isPersonal === true) {\n    return true;\n  }\n\n  const metadata = readOrganizationMetadata(value.metadata);\n  return metadata?.personal === true;\n}\n\nfunction readOrganizationMetadata(\n  metadata: unknown\n): Record<string, unknown> | null {\n  if (metadata === null || metadata === undefined) {\n    return null;\n  }\n\n  if (typeof metadata === \"string\") {\n    try {\n      const parsed = JSON.parse(metadata) as unknown;\n      return isRecord(parsed) ? parsed : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return isRecord(metadata) ? metadata : null;\n}\n\nfunction toAuthEndpoint(baseUrl: string, pathname: string): string {\n  const url = new URL(baseUrl);\n  const normalizedBasePath = url.pathname.replace(TRAILING_SLASHES_RE, \"\");\n  const normalizedPathname = pathname.startsWith(\"/\")\n    ? pathname\n    : `/${pathname}`;\n  url.pathname = `${normalizedBasePath}${normalizedPathname}` || \"/\";\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\nasync function parseResponseJson(response: Response): Promise<unknown> {\n  const raw = await response.text();\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return { message: raw };\n  }\n}\n\nasync function removeSessionFile(): Promise<void> {\n  await rm(authSessionPath(), { force: true });\n}\n"],"mappings":";;;;;;;;;;;;AAGA,MAAM,6CAA6C;AACnD,MAAM,6BAA6B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrE,MAAM,6BAA6B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrE,MAAM,iCAAiC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;AACpE,MAAM,qCAAqC,IAAI,KAAK;CACnD;CACA;CACA;AACD,CAAC;AACD,MAAM,mCAAmC,IAAI,mBAAmB,aAAa;CAC5E,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,OAAO;EAC9B,SAAS;EACT,SAAS;EACT,aAAa;EACb,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;CACD,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,MAAM;EAC7B,SAAS;EACT,SAAS;EACT,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;CACD,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,QAAQ;EAC/B,SAAS;EACT,SAAS;EACT,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;AACF,CAAC;AACD,MAAM,2CAA2C,IAAI,aAAa;CACjE,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,IAAI;CACpB,WAAW,IAAI,KAAK,CAAC,SAAS,QAAQ,CAAC;AACxC,CAAC;AACD,MAAM,uCAAuC,IAAI,aAAa;CAC7D,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,IAAI;CACpB,WAAW,IAAI,QAAQ,MAAM;CAC7B,aAAa,IAAI,MAAM,CAAC,gCAAgC,IAAI,KAAK,CAAC,CAAC;AACpE,CAAC;AACD,MAAM,iCAAiC,IAAI,aAAa;CACvD,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,KAAK;CACrB,WAAW;CACX,cAAc,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAClD,CAAC;AACD,MAAM,oCAAoC,IAAI,MAAM;CACnD;CACA;CACA;AACD,CAAC;;;ACrDD,MAAa,mCAAmC;AAChD,MAAa,oCAAoC;AACjD,MAAa,qCAAqC;AAGlD,MAAa,mCAAmC;AAEhD,MAAa,+BAA+B;AAC5C,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,4BAA4B;AACzC,MAAa,4BAA4B;AAIzC,MAAa,sCAAsC;AAMnD,MAAa,0CAA0C;AAIvD,MAAa,iCAAiC;AAC9C,MAAa,uCAAuC;AACpD,MAAa,gCAAgC;AAC7C,MAAa,mDAAmD,IAAI;AACpE,MAAa,yDAAyD;AACtE,MAAa,+CAA+C,IAAI;AAChE,MAAa,qDAAqD;AAClE,MAAa,wCAAwC;AACrD,MAAa,mCAAmC;AAChD,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,gCACX;AACF,MAAa,0BAA0B;;;ACpBvC,MAAM,sBAA4C;AAClD,MAAM,mBAAyC;;;;;;AAO/C,SAAgB,8BAAoD;CAKlE,OAEI;AACN;AAEA,SAAgB,uBAAgC;CAC9C,OAAO,4BAA4B,MAAM;AAC3C;;;AC9BA,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AAqCtC,IAAI,cAAyC;AAC7C,IAAI,4BAA0C;AAE9C,eAAsB,8BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;GACf,aAAa,MAAM;EACrB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;AAC7D;AAEA,eAAsB,6BACpB,OACwB;CACxB,IAAI,qBAAqB,GACvB,OAAO,MAAM,qCAAqC;EAChD,WAAW;EACX,SAAS,MAAM;EACf,SAAS,MAAM;CACjB,CAAC;CAGH,QAAO,MADa,UAAU,EAAA,CACjB,KAAK,MAAM,SAAS,MAAM,OAAO;AAChD;AAEA,eAAsB,+BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;EACjB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,OAAO,MAAM,SAAS,MAAM,OAAO;AAC3C;AAUA,eAAsB,qCACpB,OACA,UAAkC,CAAC,GACC;CACpC,MAAM,UAAU,iCAAiC,MAAM;EACrD,eAAA;EACA,2BAA2B;EAC3B,GAAG;CACL,CAAC;CACD,MAAM,YAAY,QAAQ,aAAA;CAC1B,IAAI,EAAE,OAAO,cAAc,SAAS,KAAK,YAAY,IACnD,MAAM,IAAI,MAAM,0DAA0D;CAG5E,OAAO,MAAM,IAAI,SAAoC,SAAS,WAAW;EACvE,MAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,0BAA0B,GAAG;GAClE,KAAK,QAAQ;GACb,OAAO;GACP,OAAO;IAAC;IAAQ;IAAQ;GAAM;GAC9B,aAAa;EACf,CAAC;EACD,IAAI,UAAU;EACd,IAAI,SAAS;EACb,IAAI,SAAS;EAEb,MAAM,sBAAsB;GAC1B,aAAa,QAAQ;EACvB;EACA,MAAM,cAAc,UAAiB;GACnC,IAAI,SACF;GAEF,UAAU;GACV,cAAc;GACd,OAAO,KAAK;EACd;EACA,MAAM,WAAW,iBAAiB;GAChC,IAAI,SACF;GAEF,UAAU;GACV,MAAM,KAAK,SAAS;GACpB,OACE,IAAI,gCACF,yCAAyC,cAAc,SAAS,GAClE,CACF;EACF,GAAG,SAAS;EAEZ,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBAAyB;IAC/D,MAAM,KAAK,SAAS;IACpB,2BAAW,IAAI,MAAM,4CAA4C,CAAC;GACpE;EACF,CAAC;EACD,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBACtC,SAAS,OAAO,MAAM,OAAwB;EAElD,CAAC;EACD,MAAM,KAAK,UAAU,UAAU;GAC7B,2BACE,IAAI,MACF,0CAA0CA,iBAAe,KAAK,GAChE,CACF;EACF,CAAC;EACD,MAAM,MAAM,KAAK,UAAU,UAAU;GACnC,2BACE,IAAI,MACF,uCAAuCA,iBAAe,KAAK,GAC7D,CACF;EACF,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SACF;GAEF,cAAc;GACd,UAAU;GACV,IAAI;IACF,QACE,+BAA+B;KAC7B;KACA,WAAW,QAAQ;KACnB;KACA;IACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,OAAO,QAAQ,KAAK,CAAC;GACvB;EACF,CAAC;EAED,MAAM,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG,MAAM;CACjD,CAAC;AACH;AAEA,eAAsB,wCACpB,OAA0B,QAAQ,MAChB;CAClB,IAAI,CAAC,KAAK,SAAS,0BAA0B,GAC3C,OAAO;CAET,IAAI,EAAE,qBAAqB,KAAK,QAAQ,aAAa,WACnD,MAAM,IAAI,MACR,0EACF;CAIF,IAAI,EAAC,MADe,UAAU,EAAA,CACnB,uBAAuB,GAChC,MAAM,IAAI,MACR,8EACF;CAGF,MAAM,aAAa,MAAM,gBAAgB;CACzC,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,UAAU;CAC9B,QAAQ;EACN,MAAM,IAAI,MAAM,uCAAuC;CACzD;CACA,MAAM,UAAU,iCAAiC,UAAU,IAAI;CAC/D,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,WAAW,MAAM,qBAAqB,QAAQ,IAAI,CAAC,CAAC,OAAO,WAAW;EAC1E,eAAA;EACA,IAAI;EACJ,WAAW,QAAQ,KAAK;EACxB,cAAc,qBAAqBA,iBAAe,KAAK,CAAC;CAC1D,EAAE;CACF,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,CAAC;CAC7C,OAAO;AACT;AAQA,eAAe,qCACb,OACoC;CACpC,IAAI,2BACF,MAAM;CAER,IAAI;EACF,IAAI,MAAM,cAAc,QACtB,OAAO,MAAM,qCAAqC,KAAK;EAEzD,MAAM,qCAAqC,KAAK;CAClD,SAAS,OAAO;EACd,IAAI,iBAAiB,iCACnB,4BAA4B;EAE9B,MAAM;CACR;AACF;AAEA,SAAS,+BAA+B,OAKV;CAC5B,IAAI,MAAM,SAAS,GACjB,MAAM,IAAI,MACR,0CAA0C,MAAM,QAAQ,YACtD,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,IAEvD;CAGF,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,MAAM,MAAM;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,MAAM,SAAS,kCAAkC,UAAU,WAAW;CACtE,IAAI,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,MAAM,YACtD,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,CAAC,OAAO,KAAK,IACf,MAAM,IAAI,MAAM,OAAO,KAAK,YAAY;CAE1C,OAAO,OAAO,KAAK,cAAc,SAAS,OAAO,KAAK,cAAc,KAAA;AACtE;AAEA,eAAe,qBAAqB,OAAmC;CACrE,MAAM,QAAQ,MAAM,UAAU;CAC9B,IAAI,MAAM,cAAc,SAAS;EAC/B,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;EAC3D,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,IAAI,MAAM,cAAc,UAAU;EAChC,MAAM,OAAO,MAAM,SAAS,MAAM,OAAO;EACzC,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,OAAO;EACL,eAAA;EACA,IAAI;EACJ,WAAW;EACX,aAAa,MAAM,KAAK,MAAM,SAAS,MAAM,OAAO;CACtD;AACF;AAEA,eAAe,kBAAmC;CAChD,IAAI,MAAM;CACV,QAAQ,MAAM,YAAY,MAAM;CAChC,WAAW,MAAM,SAAS,QAAQ,OAAO;EACvC,OAAO,OAAO,KAAK;EACnB,IAAI,OAAO,WAAW,KAAK,MAAM,IAAI,yBACnC,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,SAAyB;CAErD,QADmB,QAAQ,KAAK,KAAK,kCAAA,CACnB,MAAM,GAAG,IAAI;AACjC;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,YAAY,QAAS,IACxB,GAAG,YAAY,IAAK,YACpB,GAAG,UAAU;AACnB;AAEA,SAASA,iBAAe,OAAwB;CAC9C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,OAAyB;AAC3B;AAEA,eAAe,YAAyC;CACtD,IAAI,aACF,OAAO;CAET,IAAI,QAAQ,aAAa,UACvB,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,qBAAqB,GAAG;EAE1B,eAAc,MADS,OAAO,2CAAA,CACP,+BAA+B;EACtD,OAAO;CACT;CAMA,cAJgB,cAAc,OAAO,KAAK,GAItB,CAAC,CAHH,cAChB,IAAI,IAAI,mCAAmC,OAAO,KAAK,GAAG,CAE9B,CAAC;CAC/B,OAAO;AACT;;;ACtXA,MAAM,+BAA+B;AACrC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,qDACJ;AAGF,MAAM,2BAA2B,OAAO;AACxC,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,yBAAyB;CAC7B,aAAa;CACb,WAAW;CACX,SAAS;AACX;AACA,IAAI,+BAA+B;AACnC,IAAI,kCAAkC;AA0CtC,eAAsB,iBACpB,OACyB;CACzB,MAAM,MAAM,cAAc;EACxB,aAAa,MAAM;EACnB,UAAU,MAAM;CAClB,CAAC;CAED,IAAI,yBAAyB,GAAG;EAC9B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,UAAU,wBAAwB,GAAG;EAC3C,IAAI,6BAA6B,GAC/B,MAAM,8BAA8B;GAClC;GACA,SAAS;GACT,aAAa,MAAM;EACrB,CAAC;OAED,MAAM,IAAI,MAAM,kDAAkD;EAEpE,OAAO;GACL,UAAU;GACV,SAAS;GACT;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,aAAa,wBAAwB,GAAG;EAC9C,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,gCAAgC,KAAK;EACrC,OAAO;GAAE,UAAU;GAAiB,KAAK;EAAW;CACtD;CAGF,IAAI,QAAQ,aAAa,SACvB,IAAI;EACF,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB;IACA,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV;GACF;EACF;EACA,MAAM,IAAI,MACR,mDAAmD,eAAe,KAAK,GACzE;CACF;CAGF,IAAI,sBAAsB,GAAG;EAC3B,MAAM,qBAAqB;GACzB;GACA,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV;EACF;CACF;CAEA,MAAM,IAAI,MACR,oDAAoD,QAAQ,SAAS,SAC5D,0BAA0B,oCACrC;AACF;AAEA,eAAsB,gBACpB,KACgC;CAChC,IAAI;EACF,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;GAGpE,OAAO,wBAAwB,MADX,6BAA6B,GAAG,CAChB;EACtC;EACA,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,OAAO,EAAE,QAAQ,UAAU;CAC7B,SAAS,OAAO;EACd,OAAO;GACL,cAAc,eAAe,KAAK;GAClC,QAAQ;EACV;CACF;AACF;AAEA,eAAsB,kBAAkB,KAAoC;CAC1E,IAAI,IAAI,aAAa,kBAAkB;EACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,+BAA+B,GAAG;EACxC;CACF;CACA,IAAI,IAAI,aAAa,iBAAiB;EACpC,MAAM,wBAAwB,GAAG;EACjC;CACF;CACA,IAAI,IAAI,aAAa,iBACnB,MAAM,wBAAwB,GAAG;AAErC;AAEA,SAAgB,iBAAiB,OAAyC;CACxE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO;CAET,MAAM,SAAS;CACf,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,aAAa,kBACf,OAAO,QACL,gBAAgB,OAAO,OAAO,KAC5B,gBAAgB,OAAO,OAAO,KAC9B,OAAO,gBAAgB,KAAA,CAC3B;CAEF,IAAI,aAAa,mBAAmB,aAAa,iBAC/C,OAAO,sBAAsB,OAAO,GAAG,MAAM;CAE/C,OAAO;AACT;AAEA,SAAS,cAAc,OAGZ;CACT,MAAM,UAAU,QAAQ,gBAAgB,CAAC;CACzC,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,GAAG,MAAM,SAAS,IAAI,MAAM,YAAY,IAAI,SAAS,CAAC,CAC7D,OAAO,KAAK;AACjB;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,iBAAiB,IAAI,GAAG,WAAW;AAC5C;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,OAAO,KAAK;AAC5E;AAEA,SAAS,+BAAwC;CAC/C,OAAO,qBAAqB;AAC9B;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,YAAY,MAAM,oBACtB,8BACA,MAAM,aACN,MAAM,GACR;CACA,MAAM,MAAM,mBAAmB,GAAG,EAAE,WAAW,KAAK,CAAC;CAIrD,MAAM,UAAU,sBAAsB,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,EAAE,KAAK;EACzE,UAAU;EACV,MAAM;CACR,CAAC;AACH;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,YAAY,MAAM,SACtB,sBAAsB,MAAM,GAAG,GAC/B,MACF,CAAC,CAAC,OAAO,UAAU;EACjB,IAAIC,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CAAC;CACD,IAAI,CAAC,WACH,OAAO;CAET,OAAO,oBACL,8BACA,UAAU,KAAK,GACf,MAAM,GACR;AACF;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,sBAAsB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,4BAA4B;CAClC,MAAM,OAAO,kBAAkB,MAAM,GAAG;CACxC,MAAM,UAAU,MAAM,GAAG,MAAM,YAAY,KAAK;EAC9C,UAAU;EACV,MAAM;CACR,CAAC;CACD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,MAAM,GAAK;AAE3B;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,MAAM,MAAM,SAAS,kBAAkB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAC9D,UAAU;EACT,IAAIA,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,OAAO,MAAM,IAAI,KAAK,IAAI;AAC5B;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,kBAAkB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxD;AAEA,SAAS,qBAA6B;CACpC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,QAAQ;AACjD;AAEA,SAAS,sBAAsB,KAAqB;CAClD,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,kBAAkB,KAAqB;CAC9C,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,wBAAiC;CACxC,IAAI,QAAQ,IAAI,+BAA+B,KAAK;EAClD,qBAAqB,KAAK;EAC1B,OAAO;CACT;CAIA,MAAM,kBAAkB,CAAC,4BAA4B;CACrD,IAAI,iBACF,qBAAqB,UAAU;CAEjC,OAAO;AACT;AAEA,SAAS,gCAAgC,OAAsB;CAC7D,IAAI,iCACF;CAEF,kCAAkC;CAClC,MAAM,qBAAqB,qBAAqB,IAC5C,oFACA;CACJ,QAAQ,KACN,8JAGK,mBAAmB,YAAY,eAAe,KAAK,GAC1D;AACF;AAEA,SAAS,qBAAqB,QAAkC;CAC9D,IAAI,8BACF;CAEF,+BAA+B;CAE/B,MAAM,aACJ,WAAW,QACP,cAAc,0BAA0B,MACxC,sCAAsC,QAAQ,SAAS;CAC7D,QAAQ,KACN,oEAAoE,WAAW,WACpE,0BAA0B,0FAEvC;AACF;AAEA,SAAS,2BAAoC;CAC3C,OAAO,QAAQ,IAAI,kCAAkC;AACvD;AAEA,SAAS,8BAAuC;CAC9C,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa;AAC/D;AAEA,eAAe,8BAA6C;CAC1D,MAAM,YAAY,mBAAmB;CACrC,MAAM,MAAM,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACvD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,WAAW,GAAK;AAEhC;AAEA,eAAe,oBACb,QACA,OACA,SACiB;CACjB,MAAM,UAAU,KAAK,UAAU;EAAE;EAAO;CAAQ,CAAC;CAajD,QAAO,MAZc,WACnB,kBACA;EACE;EACA;EACA;EACA;EACA;EACA;CACF,GACA,OACF,EAAA,CACc,OAAO,KAAK;AAC5B;AAEA,eAAe,WACb,SACA,MACA,cAC6C;CAC7C,IAAI;EACF,MAAM,EAAE,aAAa,MAAM,OAAO;EAwClC,OAAO,MAvCc,IAAI,SACtB,SAAS,WAAW;GACnB,IAAI,SAAS;GACb,IAAI,SAAS;GAEb,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAAC;GAEnE,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GACD,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GAED,MAAM,GAAG,UAAU,UAAU;IAC3B,OAAO,eAAe,OAAO,OAAO,CAAC;GACvC,CAAC;GAED,MAAM,GAAG,UAAU,SAAS;IAC1B,IAAI,SAAS,GAAG;KACd,QAAQ;MAAE;MAAQ;KAAO,CAAC;KAC1B;IACF;IACA,OACE,eACE,EACE,SAAS,mBAAmB,QAAQ,mBAAmB,OACzD,GACA,OACF,CACF;GACF,CAAC;GAED,MAAM,OAAO,MAAM,YAAY;GAC/B,MAAM,OAAO,IAAI;EACnB,CACF;CAEF,SAAS,OAAO;EACd,MAAM,eAAe,OAAO,OAAO;CACrC;AACF;AAEA,SAAS,eACP,OACA,SACoE;CACpE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,uBAAO,IAAI,MAAM,mBAAmB,QAAQ,KAAK,OAAO,KAAK,GAAG;CAElE,MAAM,IAAI;CAKV,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;CACnD,MAAM,eAAe,CAAC,mBAAmB,QAAQ,EAAE;CACnD,IAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,GAChD,aAAa,KAAK,WAAW,EAAE,OAAO,KAAK,GAAG;MACzC,IAAI,EAAE,SACX,aAAa,KAAK,EAAE,OAAO;CAE7B,MAAM,UAAU,IAAI,MAAM,aAAa,KAAK,IAAI,CAAC;CAKjD,QAAQ,OAAO;CACf,QAAQ,SAAS,EAAE;CACnB,QAAQ,SAAS,EAAE;CACnB,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;AAClC;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,gBAAgB,KAAK;CACxC,IAAI,CAAC,uBAAuB,KAAK,UAAU,GACzC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,yBAAyB,OAAwB;CACxD,MAAM,aAAa,sBAAsB,KAAK;CAC9C,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAS,eAAe,OAAqC;CAC3D,IAAI,UAAU,MACZ,OAAO;CAET,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA6C;CAC5E,MAAM,cAAc,eAAe,KAAK;CACxC,IAAI,CAAC,aACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO;EACL;EACA,QAAQ;CACV;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAEf,OAAO,OAAO,KAAK;AACrB;AAEA,SAASA,sBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;AAEV,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;;;;;;;;;;;;ACncV,MAAM,sBAAsB;AAO5B,IAAI,oBAA8C;AAElD,eAAsB,oBACpB,UAAsC,CAAC,GACN;CACjC,MAAM,aAAa,MAAM,yBAAyB;CAClD,QAAQ,WAAW,OAAnB;EACE,KAAK;EACL,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK,SACH;EACF,SACE,OAAO;CACX;CACA,IAAI,CAAC,QAAQ,gBACX,OAAO;CAGT,MAAM,mBAAmB,MAAM,0BAA0B,WAAW,OAAO;CAC3E,IAAI,iBAAiB,UAAU,SAC7B,OAAO;CAET,IAAI,iBAAiB,UAAU,WAC7B,OAAO;CAGT,OAAO;EACL,YAAY,mCAAmC,iBAAiB,KAAK;EACrE,OAAO,iBAAiB;EACxB,SAAS;CACX;AACF;AAKA,eAAsB,4BAAoD;CAIxE,MAAM,eAAc,MAHI,oBAAoB,EAC1C,gBAAgB,MAClB,CAAC,CAAC,CAAC,YAAY,IAAI,EAAA,EACY,SAAS,MAAM,IAAI,KAAK,KAAK;CAC5D,OAAO,YAAY,SAAS,IAAI,cAAc;AAChD;AAEA,eAAsB,eAAe,OAanB;CAChB,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAG7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAGzC,MAAM,yBAAyB;CAG/B,MAAM,mBAAmB,mBAAkB,MADb,mBAAmB,EAAA,EACW,QAAQ;CACpE,MAAM,WAAW,MAAM,iBAAiB;EACtC;EACA;EACA;CACF,CAAC;CAED,MAAM,UAAyB;EAC7B,GAAG;EACH;EACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;EACzD;EACA;EACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;EAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;EACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;EAC5C,GAAG,qBAAqB,MAAM,IAAI;EAClC,GAAG,+BAA+B,MAAM,kBAAkB;CAC5D;CAEA,MAAM,OAAO,gBAAgB;CAC7B,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAEhE,IAAI;EACF,MAAM,+BAA+B;GAAE;GAAa;EAAS,CAAC;EAC9D,MAAM,8BAA8B,MAAM,OAAO;CACnD,SAAS,OAAO;EACd,MAAM,oCAAoC,QAAQ;EAClD,MAAM;CACR;CAEA,iBAAiB;EACf;EACA,SAAS,uBAAuB;GAAE;GAAa;EAAQ,CAAC;CAC1D,CAAC;CACD,IACE,oBACA,CAAC,wBAAwB,kBAAkB,QAAQ,GAEnD,MAAM,oCAAoC,gBAAgB;AAE9D;AAUA,eAAsB,yBAA8D;CAClF,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;CAGT,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,eAAe,YAAY,YAC/B,OAAO;CAGT,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,QAAQ,kBAAkB;CAC9D;AACF;AAEA,eAAsB,oCACpB,oBACe;CACf,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,MAAM,wDAAwD;CAG1E,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,YAAY,aAAa,eAAe,YAAY,YACxD,MAAM,IAAI,MACR,4DACF;CAGF,MAAM,cAA6B;EACjC,GAAG;EACH;EACA;EACA;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,kBAAkB;CACtD;CAEA,MAAM,8BAA8B,gBAAgB,GAAG,WAAW;CAClE,MAAM,uBAAuB,sBAAsB,OAAO;CAC1D,IAAI,sBACF,iBAAiB;EACf,SAAS;EACT,SAAS,uBAAuB;GAC9B,aAAa,qBAAqB;GAClC,SAAS;EACX,CAAC;CACH,CAAC;AAEL;AAEA,eAAsB,mBAAoD;CACxE,oBAAoB;CACpB,MAAM,yBAAyB;CAC/B,MAAM,kBAAkB,MAAM,sBAAsB;CACpD,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,KAAK,iBAAiB,QAAQ,QAAQ,GACvD,MAAM,oCAAoC,QAAQ,QAAQ;CAE5D,MAAM,kBAAkB;CACxB,OAAO,EAAE,gBAAgB;AAC3B;AAEA,eAAe,2BAA0C;CACvD,MAAM,UAAU,MAAM,wBAAwB;CAC9C,IAAI,QAAQ,UAAU,WAAW,GAC/B;CAGF,MAAM,YAA8B,CAAC;CACrC,KAAK,MAAM,YAAY,QAAQ,WAC7B,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,UAAU,KAAK,QAAQ;CACzB;CAEF,MAAM,2BAA2B,SAAS;AAC5C;AAEA,eAAe,oCACb,UACe;CACf,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,MAAM,UAAU,MAAM,wBAAwB;EAC9C,IACE,QAAQ,UAAU,MAAM,QAAQ,wBAAwB,KAAK,QAAQ,CAAC,GAEtE;EAEF,MAAM,2BAA2B,CAAC,GAAG,QAAQ,WAAW,QAAQ,CAAC;CACnE;AACF;AAEA,eAAe,0BAA0D;CACvE,MAAM,MAAM,MAAM,SAAS,wBAAwB,GAAG,MAAM,CAAC,CAAC,OAC3D,UAAU;EACT,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,IAAI,QAAQ,MACV,OAAO;EAAE,GAAG;EAAG,WAAW,CAAC;CAAE;CAG/B,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C;CACjE;CACA,IACE,EAAE,SAAS,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,SAAS,IAEtE,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,YAAY,OAAO,UAAU,OAAO,gBAAgB;CAC1D,IAAI,UAAU,WAAW,OAAO,UAAU,QACxC,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO;EAAE,GAAG;EAAG;CAAU;AAC3B;AAEA,eAAe,2BACb,WACe;CACf,MAAM,OAAO,wBAAwB;CACrC,IAAI,UAAU,WAAW,GAAG;EAC1B,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;EAC9B;CACF;CACA,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAChE,MAAM,oBAAoB,MAAM;EAAE,GAAG;EAAG;CAAU,CAAC;AACrD;AAEA,SAAS,0BAAkC;CACzC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,4BAA4B;AACrE;AAEA,eAAe,wBAA0C;CACvD,IAAI;EACF,MAAM,SAAS,gBAAgB,GAAG,MAAM;EACxC,OAAO;CACT,SAAS,OAAO;EACd,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR;AACF;AAEA,eAAe,2BAA2D;CACxE,MAAM,UAAU,MAAM,mBAAmB;CACzC,IAAI,SAAS,MAAM,GACjB,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,IAAI,CAAC,UACH,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,aAAa,eAAe,YAAY,YAC5C,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,IAAI,UAAU,sBAAsB,OAAO;CAC3C,IAAI,CAAC,SAAS;EACZ,MAAM,cAAc,MAAM,gBAAgB,QAAQ;EAClD,IAAI,YAAY,WAAW,WACzB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,IAAI,YAAY,WAAW,eACzB,OAAO;GACL,cAAc,YAAY;GAC1B,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,UAAU,uBAAuB;GAC/B,aAAa,YAAY;GACzB,SAAS;IACP,GAAG;IACH,GAAG;IACH;IACA;IACA;IACA;IACA;GACF;EACF,CAAC;EACD,iBAAiB;GAAE;GAAS;EAAQ,CAAC;CACvC;CAEA,IAAI,UAAU,QAAQ,SAAS,GAC7B,OAAO;EACL,YAAY;EACZ,OAAO;EACP;CACF;CAGF,OAAO;EACL,OAAO;EACP;CACF;AACF;AAEA,eAAe,+BAA+B,OAG5B;CAChB,MAAM,WAAW,MAAM,gBAAgB,MAAM,QAAQ;CACrD,IACE,SAAS,WAAW,WACpB,SAAS,gBAAgB,MAAM,aAE/B;CAEF,IAAI,SAAS,WAAW,eACtB,MAAM,IAAI,MACR,8CAA8C,SAAS,cACzD;CAEF,MAAM,IAAI,MAAM,2CAA2C;AAC7D;AAEA,SAAS,uBAAuB,OAGV;CACpB,OAAO;EACL,GAAG;EACH,aAAa,MAAM;EACnB,WAAW,MAAM,QAAQ;EACzB,aAAa,MAAM,QAAQ;EAC3B,UAAU,MAAM,QAAQ;EACxB,WAAW,MAAM,QAAQ;EACzB,GAAI,OAAO,MAAM,QAAQ,cAAc,YACvC,MAAM,QAAQ,UAAU,KAAK,IACzB,EAAE,WAAW,MAAM,QAAQ,UAAU,KAAK,EAAE,IAC5C,CAAC;EACL,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;AACF;AAEA,SAAS,iBAAiB,OAGjB;CACP,oBAAoB;EAClB,YAAY,2BAA2B,MAAM,OAAO;EACpD,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,sBACP,SAC0B;CAC1B,MAAM,aAAa,2BAA2B,OAAO;CACrD,OAAO,mBAAmB,eAAe,aACrC,kBAAkB,UAClB;AACN;AAEA,SAAS,2BAA2B,SAAyC;CAC3E,OAAO,GAAG,gBAAgB,EAAE,IAAI,KAAK,UAAU,OAAO;AACxD;AAEA,SAAS,wBACP,MACA,OACS;CACT,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,kBAAkB,OAAuC;CAChE,IAAI,CAAC,iBAAiB,KAAK,GACzB,OAAO;CAET,OAAO;AACT;AAEA,eAAe,0BACb,SACsC;CACtC,IAAI,WAAW;CACf,IAAI;EACF,WAAW,eAAe,QAAQ,aAAa,uBAAuB;CACxE,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;CACA,IAAI;EACF,MAAM,YAAY,8BAA8B,QAAQ;EACxD,MAAM,WAAW,MAAM,MAAM,UAAU;GACrC,QAAQ;GACR,SAAS,EACP,eAAe,GAAG,mBAAmB,QAAQ,SAAS,EAAE,GAAG,QAAQ,cACrE;GACA,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,EAAE,OAAO,UAAU;EAE5B,IAAI,CAAC,SAAS,IAGZ,OAAO,EAAE,OAAO,UAAU;EAI5B,IAAI,CAAC,wBAAwB,MADP,kBAAkB,QAAQ,CACZ,GAClC,OAAO,EAAE,OAAO,UAAU;EAE5B,OAAO,EAAE,OAAO,QAAQ;CAC1B,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;AACF;AAEA,SAAS,8BAA8B,UAA0B;CAC/D,MAAM,MAAM,eAAe,QAAQ;CACnC,IAAI,OAAO,mBAAmB,IAAI,QAAQ,GACxC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,mBAAmB,UAA2B;CACrD,OACE,aAAa,eAAe,aAAa,eAAe,aAAa;AAEzE;AAEA,SAAS,wBAAwB,SAA2B;CAC1D,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO;CAGT,OACE,SAAU,QAAoC,OAAO,KACrD,SAAU,QAAoC,IAAI;AAEtD;AAEA,SAAS,UAAU,WAAwC;CACzD,IAAI,CAAC,WACH,OAAO;CAET,MAAM,cAAc,KAAK,MAAM,SAAS;CACxC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO;CAET,OAAO,eAAe,KAAK,IAAI;AACjC;AAEA,SAAS,mCACP,OAC4B;CAC5B,QAAQ,OAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SAEE,MAAM,IAAI,MACR,0CAA0CC,OAC5C;CAEJ;AACF;AAEA,eAAe,qBAA6D;CAC1E,MAAM,MAAM,MAAM,SAAS,gBAAgB,GAAG,MAAM,CAAC,CAAC,YAAY,IAAI;CACtE,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,kBAA0B;CACjC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,cAAc;AACvD;AAEA,eAAe,8BACb,MACA,SACe;CACf,MAAM,oBAAoB,MAAM,OAAO;AACzC;AAEA,eAAe,oBACb,MACA,SACe;CACf,MAAM,WAAW,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CACxE,IAAI;EACF,MAAM,OAAO,MAAM,KAAK,UAAU,MAAM,GAAK;EAC7C,IAAI;GACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;GACpE,MAAM,KAAK,KAAK;EAClB,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;EAEA,MAAM,OAAO,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,MAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EACzD,MAAM;CACR;AACF;AAEA,SAAS,oBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,SAAS,qBAAqB,OAM5B;CACA,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO,CAAC;CAEV,MAAM,SAAS;CACf,MAAM,KAAK,wBAAwB,OAAO,EAAE;CAC5C,MAAM,QAAQ,wBAAwB,OAAO,KAAK;CAClD,MAAM,OAAO,wBAAwB,OAAO,IAAI;CAChD,IAAI,EAAE,MAAM,SAAS,OACnB,OAAO,CAAC;CAEV,OAAO,EACL,MAAM;EACJ,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;EACnB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EACzB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;CACzB,EACF;AACF;AAEA,SAAS,+BAA+B,OAEtC;CACA,MAAM,qBAAqB,kCAAkC,KAAK;CAClE,OAAO,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AACxD;AAEA,SAAgB,kCACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,MAAM,KAAK,wBAAwB,MAAM,EAAE;CAC3C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,WAAW,2BAA2B,KAAK;CACjD,IAAI,EAAE,MAAM,QAAQ,OAClB,OAAO;CAET,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC;AACF;AAeA,SAAS,mBAAmB,OAAuB;CACjD,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA+B;CAC9D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,2BAA2B,OAAyC;CAC3E,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,OAAO;CAIT,OADiB,yBAAyB,MAAM,QAClC,CAAC,EAAE,aAAa;AAChC;AAEA,SAAS,yBACP,UACgC;CAChC,IAAI,aAAa,QAAQ,aAAa,KAAA,GACpC,OAAO;CAGT,IAAI,OAAO,aAAa,UACtB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,QAAQ;EAClC,OAAO,SAAS,MAAM,IAAI,SAAS;CACrC,QAAQ;EACN,OAAO;CACT;CAGF,OAAO,SAAS,QAAQ,IAAI,WAAW;AACzC;AAEA,SAAS,eAAe,SAAiB,UAA0B;CACjE,MAAM,MAAM,IAAI,IAAI,OAAO;CAK3B,IAAI,WAAW,GAJY,IAAI,SAAS,QAAQ,qBAAqB,EAIlC,IAHR,SAAS,WAAW,GAAG,IAC9C,WACA,IAAI,gBACuD;CAC/D,IAAI,SAAS;CACb,IAAI,OAAO;CACX,OAAO,IAAI,SAAS;AACtB;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAEA,eAAe,kBAAkB,UAAsC;CACrE,MAAM,MAAM,MAAM,SAAS,KAAK;CAChC,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO,EAAE,SAAS,IAAI;CACxB;AACF;AAEA,eAAe,oBAAmC;CAChD,MAAM,GAAG,gBAAgB,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7C"}

package/dist/{command-DmVde7c-.js → command-NA54nJ63.js}

@@ -1,12 +1,12 @@
 #!/usr/bin/env node
 
 import { $ as runWithHeldLock, $t as runtimeAgentControllerConversationIdMappingSpecSchema, At as openMeldBackupsDir, B as toSpaceRemoveMembersUrl, Bt as resolveDefaultOpenMeldHomeDirname, C as updateConfiguredDeviceRuntimeState, Ct as deviceOpenClawProfileBootstrapPath, D as normalizeBaseUrl, Dt as legacyAccountProfileSpacesDir, Et as isPublishedOpenMeldHome, Ft as openMeldRootDir, Gt as resolveOpenMeldRootDir, H as toSpaceUpdatesUrl, I as toSpaceLeaveUrl, It as openMeldVersionsDir, Jt as skillsDir, K as isOpenMeldLockError, Kt as runtimeDir, L as toSpaceMembersUrl, M as toSpaceCursorUrl, Mt as openMeldManagedBinaryPath, N as toSpaceDeleteUrl, Nt as openMeldManagedVersionBinaryPath, O as toDaemonRouteObservationUrl, Ot as normalizeAccountKey, Pt as openMeldManagedVersionDir, Q as resolveOpenMeldOrphanedLockIssue, R as toSpaceMetaUrl, S as setConfiguredSkillsConfig, St as accountsDir, T as updateConfiguredSkillsConfig, Tt as deviceOpenClawProfileWorkspaceDir, U as toSpaceWsUrl, Ut as resolveOpenMeldEnvPreset, Vt as resolveExplicitOpenMeldEnvPreset, W as acquireLock, Wt as resolveOpenMeldPresetOwnedPathInput, Xt as systemDir, Zt as formatLocalMachineIssueMessage, _ as getConfiguredViewCustomization, _t as OPENMELD_HOME_ENV_KEY, a as resolveBaseUrl, an as buildAgentControllerConversationRef, at as resolveCliContext, bt as accountProfileViewPath, c as resolveExplicitGatewayUrlOrThrow, cn as HOSTED_CENTER_AGENT_CONTROLLER_REF, d as createDefaultRuntimeAgentControllerSettings, dn as buildAgentControllerRoutingKey, dt as assessLocalMachineFailure, en as runtimeAgentControllerLaunchContractSchema, f as getConfiguredDaemonDispatchLimits, fn as canonicalizeAgentControllerRef, g as getConfiguredSkillsConfig, gn as parseAgentControllerRef$1, h as getConfiguredOpenMeldToolsMaintenance, hn as normalizeKnownBuiltinAgentControllerId, i as normalizeGatewayBaseUrlOrNull, it as readCliContextState, j as toSpaceCreateUrl, jt as openMeldBinDir, kt as normalizeOpenMeldProfileId, l as DEFAULT_RUNTIME_AGENT_TRANSPORT_MODE, ln as HOSTED_CENTER_AGENT_CONTROLLER_REF_ID, lt as resolveOpenMeldLaneDescriptor, mn as normalizeBuiltinAgentControllerId, nn as runtimeStreamingModeSchema, o as resolveBaseUrlOrNull, on as conversationPolicySchema, ot as resolveCliContextId, p as getConfiguredDeviceRuntimeState, pn as canonicalizeBuiltinAgentControllerRef, pt as createBackgroundExecutionBlockedIssue, q as isOpenMeldOrphanedLockError, qt as runtimeLogsDir, r as normalizeGatewayBaseUrl, rn as runtimeTransportModeSchema, rt as listCliContextStates, s as resolveDefaultGatewayBaseUrl, sn as resolveBuiltinAgentControllerConversationKind, st as writeCliContextState, v as getRuntimeConfigReadHealth, vt as accountProfileLocalMetaPath, wt as deviceOpenClawProfileDir, x as setConfiguredOpenMeldToolsMaintenance, xt as accountProfileWorkspacePath, y as resolveRuntimeSkillsCustomTargetId, yt as accountProfileSpaceCacheDir, z as toSpacePasswordUrl } from "./base-url-PkgATS5u.js";
-import { A as MAX_TEXT_LENGTH, At as createCenterAgentRoutineResponseSchema, B as sleep, C as createSpaceApi, D as toStructuredApiClientFailure, Dt as organizationComputersResponseSchema, E as resolveProfileSpaceHistoryGatewayHost, Et as profileErrorResponseSchema, F as OPENMELD_HEADER_PROFILE_ID, Ft as resumeCenterAgentRoutineResponseSchema, Gt as localProjectControlDaemonFrameSchema, H as getSpaceUpdatesResponseSchema, It as updateCenterAgentRoutineResponseSchema, Jt as postSpaceMembersResponseSchema, Kt as localProjectControlDiscoverProjectsResponseSchema, L as OPENMELD_HEADER_REQUEST_ID, M as parseIncoming$1, Mt as listCenterAgentRoutineRunsResponseSchema, N as parseServerErrorFrame$1, Nt as listCenterAgentRoutinesResponseSchema, O as DAEMON_STREAM_KEEPALIVE_PING, Ot as submitFeedbackIssueRequestSchema, P as resolveCustomMentionAliasOverride, Pt as pauseCenterAgentRoutineResponseSchema, Q as submitAgentControllerTaskLifecycleEventItemSchema, Rt as AGENT_ACTIVITY_PRESENCE_TTL_MAX_MS, S as createRuntimeReportingApi, St as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, T as resolveAccountSpaceIndexGatewayHost, Tt as profileCapabilitiesResponseSchema, U as SPACE_DISPATCH_TRACE_PROMPT_PREVIEW_MAX_CHARS, Ut as agentActivitySnapshotResponseSchema, V as toErrorMessage$42, Wt as localProjectControlConnectionSchema, Xt as spaceMemberDirectoryEntrySchema, Yt as removeSpaceMembersResponseSchema, Zt as spaceMemberDirectorySchema, _n as agentControllerPermissionModeSchema, _t as organizationSkillReleaseSummarySchema, a as buildSpaceAttachmentDownloadPath, an as createProjectResponseSchema, at as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, bt as organizationDirectoryResponseSchema, c as createAgentProfileBindingApi, cn as updateProjectResponseSchema, ct as computerFileAccessPolicyInputSchema, d as createCurrentDeviceApi, dt as organizationSpaceDirectoryWithMemberCountsResponseSchema, ft as spaceCreatorSchema, g as createOrganizationApi, h as createOpenMeldApiClient, ht as listOrganizationSkillsResponseSchema, i as buildProfileSpaceHistoryUpsertPath, in as archiveProjectResponseSchema, it as gatewayErrorEnvelopeSchema, j as parseEnvelope$1, jt as deleteCenterAgentRoutineResponseSchema, kt as submitFeedbackIssueResponseSchema, ln as centerAgentToolSpeakerSchema, lt as computerFileAccessPolicySchema, m as createLocalRuntimeExpectedRoutesApi, mt as getOrganizationSkillResponseSchema, n as OpenMeldApiClientInvalidResponseError, o as createAccountSpaceIndexApi, on as listProjectsResponseSchema, ot as OPENMELD_RUNTIME_CAPABILITIES_HEADER, p as createFetchTransport, pt as spaceMetaSchema, qt as leaveSpaceResponseSchema, r as buildProfileSpaceHistoryStatusPath, rn as observedLocalAgentSessionSchema, s as createAgentActivityApi, sn as projectSchema, st as computerFileAccessDaemonFrameSchema, t as OpenMeldApiClientHttpError, tn as agentActivitySessionInventoryResponseSchema, un as openCodePermissionConfigSchema, ut as modelCatalogSchema, vn as agentControllerCollaborationModeSchema, vt as organizationSkillSummarySchema, wt as authProfileManagedRoleSchema, xt as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, y as createProfileSpaceHistoryApi, yn as toLegacySpaceAddressingWireValue, z as toErrorMessage$43, zt as agentActivityEventSchema } from "./dist-Bypn86JC.js";
-import { $t as skippedDaemonProfileSchema, A as runtimeTransportRegisterSessionResponseSchema, An as AGENT_INTERACTION_DEFAULT_TIMEOUT_MS, Ar as profileWorkspaceModeSchema, B as openMeldDaemonTaskResultPayloadSchema, Bn as localCliComponentUpdateProjectionSchema, Br as resolvePublicAgentFailureRecovery, Bt as resolveSpaceFileMimeType, C as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, Cr as MAX_PROFILE_WORKING_DIRECTORY_LENGTH, D as runtimeTransportOpenMeldToolsControlFramePayloadSchema, E as runtimeTransportLookupRouteOwnerServiceEvidenceSchema, Er as openMeldRuntimeProfileIdSchema, Fn as formatLocalComponentsSummaryDescription, Fr as trimmedStringFromUnknown, G as localFolderPickerDaemonFrameSchema, H as openMeldSpaceEgressActionSchema, Hr as shouldPreferMappedPublicAgentFailureReason, I as runtimeTransportSubmitTaskResultRequestSchema, In as formatLocalComponentsSummaryLabel, Ir as MAX_TEXT_LENGTH$1, Jn as openMeldToolsUpdateOperationPhaseSchema, K as localFolderPickerHelperProtocolResultSchema, Kr as resolveCommandAgentWorkActivity, Ln as formatLocalSetupActionDescription, Lr as resolveDetailedPublicAgentFailureReason$1, M as runtimeTransportResumeControllerConversationFramePayloadSchema, Mn as agentInteractionRequestSchema, N as runtimeTransportResumeControllerConversationResultFramePayloadSchema, Nn as agentInteractionResolutionSchema, O as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, P as runtimeTransportRouteCatalogChangedFramePayloadSchema, Pt as SPACE_FILE_MAX_SIZE_BYTES, R as openMeldDaemonTaskResultEnvelopeWriteSchema, Rn as formatLocalSetupActionLabel, Rr as resolveMappedPublicAgentFailureReason, S as runtimeTransportLocalAgentControlManageInstallationFramePayloadSchema, Sn as resolveMessageEnvelopeTargetField, Sr as openMeldRequestContextSchema, T as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, Tr as normalizeOptionalWorkingDirectory, U as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, Vr as sanitizeDispatchErrorSummary, W as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, Wn as localServiceComponentUpdateProjectionSchema, Wt as spaceFileNameSchema, Xt as openMeldDaemonControlPlaneRequestSchema, Zn as openMeldToolsUpdateRequestSourceSchema, Zt as openMeldDaemonControlPlaneResponseSchema, _ as runtimeTransportHeartbeatRequestSchema, _n as collectCanonicalMentionTextFragments, a as runtimeTransportCapabilitiesSchema, ar as runtimeCoordinatorExecutionTokenEnvelopeSchema, b as runtimeTransportLocalAgentControlForkSessionFramePayloadSchema, c as runtimeTransportDispatchInteractionRequestSchema, d as runtimeTransportDispatchPreviewEndRequestSchema, dr as resolveSingleSpaceMentionLabels, en as providerDispatchRuntimeContextSchema, f as runtimeTransportDispatchPreviewRequestSchema, fr as resolveSpaceMentionLabels, g as runtimeTransportForkAgentSessionResultSchema, gn as MESSAGE_MENTION_TYPE_VALUES, gt as SPACE_MENTION_REJECT_NOTICE_PURPOSE, h as runtimeTransportErrorCodeSchema, ht as SPACE_MEMBER_REMOVE_NOTICE_PURPOSE, i as localWakeRouteReportSchema, j as runtimeTransportRejectedProfileRegistrationSchema, k as runtimeTransportRegisterSessionRequestSchema, l as runtimeTransportDispatchInteractionResponseFramePayloadSchema, lr as normalizeSpacePasswordText, m as runtimeTransportDispatchToolActivityRequestSchema, mt as SPACE_MEMBER_JOIN_NOTICE_PURPOSE, n as daemonExecutionCompatibilitySchema, o as runtimeTransportDeliverDispatchRequestSchema, or as runtimeTransportDeliveryExecutionIdentitySchema, p as runtimeTransportDispatchRuntimeEvidenceRequestSchema, q as localFolderPickerHelperResultSchema, qn as openMeldToolsUpdateAttemptSchema, r as daemonStreamFrameSchema, s as runtimeTransportDispatchInteractionDeliveredRequestSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, tn as conversationExecutionStateSchema, tr as parseOptionalClientMessageId, u as runtimeTransportDispatchLifecycleRequestSchema, ut as CONVERSATION_CONTINUITY_WARNING_PURPOSE, v as runtimeTransportHeartbeatResponseSchema, vn as formatCanonicalMentionLiteral, vt as sanitizeSignalTextPreview, w as runtimeTransportLocalAgentControlSetEnabledFramePayloadSchema, wr as agentProfileIdSchema, x as runtimeTransportLocalAgentControlInterruptFramePayloadSchema, xn as normalizeMessageEnvelope, y as runtimeTransportLocalAgentControlCancelFramePayloadSchema, yn as getSpaceMessageAddressingRelationSupportForTargetKind, z as openMeldDaemonTaskResultOpenClawGatewayVisibilityStatusSchema, zn as installedLocalComponentsSnapshotSchema, zr as resolvePublicAgentAvailabilityCopy } from "./runtime-transport-CJRu8NiO.js";
+import { A as MAX_TEXT_LENGTH, At as createCenterAgentRoutineResponseSchema, B as sleep, C as createSpaceApi, D as toStructuredApiClientFailure, Dt as organizationComputersResponseSchema, E as resolveProfileSpaceHistoryGatewayHost, Et as profileErrorResponseSchema, F as OPENMELD_HEADER_PROFILE_ID, Ft as resumeCenterAgentRoutineResponseSchema, Gt as localProjectControlDaemonFrameSchema, H as getSpaceUpdatesResponseSchema, It as updateCenterAgentRoutineResponseSchema, Jt as postSpaceMembersResponseSchema, Kt as localProjectControlDiscoverProjectsResponseSchema, L as OPENMELD_HEADER_REQUEST_ID, M as parseIncoming$1, Mt as listCenterAgentRoutineRunsResponseSchema, N as parseServerErrorFrame$1, Nt as listCenterAgentRoutinesResponseSchema, O as DAEMON_STREAM_KEEPALIVE_PING, Ot as submitFeedbackIssueRequestSchema, P as resolveCustomMentionAliasOverride, Pt as pauseCenterAgentRoutineResponseSchema, Q as submitAgentControllerTaskLifecycleEventItemSchema, Rt as AGENT_ACTIVITY_PRESENCE_TTL_MAX_MS, S as createRuntimeReportingApi, St as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_MESSAGE, T as resolveAccountSpaceIndexGatewayHost, Tt as profileCapabilitiesResponseSchema, U as SPACE_DISPATCH_TRACE_PROMPT_PREVIEW_MAX_CHARS, Ut as agentActivitySnapshotResponseSchema, V as toErrorMessage$42, Wt as localProjectControlConnectionSchema, Xt as spaceMemberDirectoryEntrySchema, Yt as removeSpaceMembersResponseSchema, Zt as spaceMemberDirectorySchema, _n as agentControllerPermissionModeSchema, _t as organizationSkillReleaseSummarySchema, a as buildSpaceAttachmentDownloadPath, an as createProjectResponseSchema, at as COMPUTER_FILE_ACCESS_RUNTIME_CAPABILITY, bt as organizationDirectoryResponseSchema, c as createAgentProfileBindingApi, cn as updateProjectResponseSchema, ct as computerFileAccessPolicyInputSchema, d as createCurrentDeviceApi, dt as organizationSpaceDirectoryWithMemberCountsResponseSchema, ft as spaceCreatorSchema, g as createOrganizationApi, h as createOpenMeldApiClient, ht as listOrganizationSkillsResponseSchema, i as buildProfileSpaceHistoryUpsertPath, in as archiveProjectResponseSchema, it as gatewayErrorEnvelopeSchema, j as parseEnvelope$1, jt as deleteCenterAgentRoutineResponseSchema, kt as submitFeedbackIssueResponseSchema, ln as centerAgentToolSpeakerSchema, lt as computerFileAccessPolicySchema, m as createLocalRuntimeExpectedRoutesApi, mt as getOrganizationSkillResponseSchema, n as OpenMeldApiClientInvalidResponseError, o as createAccountSpaceIndexApi, on as listProjectsResponseSchema, ot as OPENMELD_RUNTIME_CAPABILITIES_HEADER, p as createFetchTransport, pt as spaceMetaSchema, qt as leaveSpaceResponseSchema, r as buildProfileSpaceHistoryStatusPath, rn as observedLocalAgentSessionSchema, s as createAgentActivityApi, sn as projectSchema, st as computerFileAccessDaemonFrameSchema, t as OpenMeldApiClientHttpError, tn as agentActivitySessionInventoryResponseSchema, un as openCodePermissionConfigSchema, ut as modelCatalogSchema, vn as agentControllerCollaborationModeSchema, vt as organizationSkillSummarySchema, wt as authProfileManagedRoleSchema, xt as ADDITIONAL_HUMAN_PROFILE_CREATION_DISABLED_CODE, y as createProfileSpaceHistoryApi, yn as toLegacySpaceAddressingWireValue, z as toErrorMessage$43, zt as agentActivityEventSchema } from "./dist-BvewFyUz.js";
+import { $t as skippedDaemonProfileSchema, A as runtimeTransportRegisterSessionResponseSchema, An as AGENT_INTERACTION_DEFAULT_TIMEOUT_MS, Ar as profileWorkspaceModeSchema, B as openMeldDaemonTaskResultPayloadSchema, Bn as localCliComponentUpdateProjectionSchema, Br as resolvePublicAgentFailureRecovery, Bt as resolveSpaceFileMimeType, C as runtimeTransportLocalAgentControlRefreshCatalogFramePayloadSchema, Cr as MAX_PROFILE_WORKING_DIRECTORY_LENGTH, D as runtimeTransportOpenMeldToolsControlFramePayloadSchema, E as runtimeTransportLookupRouteOwnerServiceEvidenceSchema, Er as openMeldRuntimeProfileIdSchema, Fn as formatLocalComponentsSummaryDescription, Fr as trimmedStringFromUnknown, G as localFolderPickerDaemonFrameSchema, H as openMeldSpaceEgressActionSchema, Hr as shouldPreferMappedPublicAgentFailureReason, I as runtimeTransportSubmitTaskResultRequestSchema, In as formatLocalComponentsSummaryLabel, Ir as MAX_TEXT_LENGTH$1, Jn as openMeldToolsUpdateOperationPhaseSchema, K as localFolderPickerHelperProtocolResultSchema, Kr as resolveCommandAgentWorkActivity, Ln as formatLocalSetupActionDescription, Lr as resolveDetailedPublicAgentFailureReason$1, M as runtimeTransportResumeControllerConversationFramePayloadSchema, Mn as agentInteractionRequestSchema, N as runtimeTransportResumeControllerConversationResultFramePayloadSchema, Nn as agentInteractionResolutionSchema, O as runtimeTransportOpenMeldToolsControlResultFramePayloadSchema, P as runtimeTransportRouteCatalogChangedFramePayloadSchema, Pt as SPACE_FILE_MAX_SIZE_BYTES, R as openMeldDaemonTaskResultEnvelopeWriteSchema, Rn as formatLocalSetupActionLabel, Rr as resolveMappedPublicAgentFailureReason, S as runtimeTransportLocalAgentControlManageInstallationFramePayloadSchema, Sn as resolveMessageEnvelopeTargetField, Sr as openMeldRequestContextSchema, T as runtimeTransportLocalAgentControlSetProfileWorkspaceFramePayloadSchema, Tr as normalizeOptionalWorkingDirectory, U as LOCAL_FOLDER_PICKER_RUNTIME_CAPABILITY, Vr as sanitizeDispatchErrorSummary, W as OPENMELD_LOCAL_FOLDER_PICKER_CAPABILITY_HEADER, Wn as localServiceComponentUpdateProjectionSchema, Wt as spaceFileNameSchema, Xt as openMeldDaemonControlPlaneRequestSchema, Zn as openMeldToolsUpdateRequestSourceSchema, Zt as openMeldDaemonControlPlaneResponseSchema, _ as runtimeTransportHeartbeatRequestSchema, _n as collectCanonicalMentionTextFragments, a as runtimeTransportCapabilitiesSchema, ar as runtimeCoordinatorExecutionTokenEnvelopeSchema, b as runtimeTransportLocalAgentControlForkSessionFramePayloadSchema, c as runtimeTransportDispatchInteractionRequestSchema, d as runtimeTransportDispatchPreviewEndRequestSchema, dr as resolveSingleSpaceMentionLabels, en as providerDispatchRuntimeContextSchema, f as runtimeTransportDispatchPreviewRequestSchema, fr as resolveSpaceMentionLabels, g as runtimeTransportForkAgentSessionResultSchema, gn as MESSAGE_MENTION_TYPE_VALUES, gt as SPACE_MENTION_REJECT_NOTICE_PURPOSE, h as runtimeTransportErrorCodeSchema, ht as SPACE_MEMBER_REMOVE_NOTICE_PURPOSE, i as localWakeRouteReportSchema, j as runtimeTransportRejectedProfileRegistrationSchema, k as runtimeTransportRegisterSessionRequestSchema, l as runtimeTransportDispatchInteractionResponseFramePayloadSchema, lr as normalizeSpacePasswordText, m as runtimeTransportDispatchToolActivityRequestSchema, mt as SPACE_MEMBER_JOIN_NOTICE_PURPOSE, n as daemonExecutionCompatibilitySchema, o as runtimeTransportDeliverDispatchRequestSchema, or as runtimeTransportDeliveryExecutionIdentitySchema, p as runtimeTransportDispatchRuntimeEvidenceRequestSchema, q as localFolderPickerHelperResultSchema, qn as openMeldToolsUpdateAttemptSchema, r as daemonStreamFrameSchema, s as runtimeTransportDispatchInteractionDeliveredRequestSchema, t as CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH, tn as conversationExecutionStateSchema, tr as parseOptionalClientMessageId, u as runtimeTransportDispatchLifecycleRequestSchema, ut as CONVERSATION_CONTINUITY_WARNING_PURPOSE, v as runtimeTransportHeartbeatResponseSchema, vn as formatCanonicalMentionLiteral, vt as sanitizeSignalTextPreview, w as runtimeTransportLocalAgentControlSetEnabledFramePayloadSchema, wr as agentProfileIdSchema, x as runtimeTransportLocalAgentControlInterruptFramePayloadSchema, xn as normalizeMessageEnvelope, y as runtimeTransportLocalAgentControlCancelFramePayloadSchema, yn as getSpaceMessageAddressingRelationSupportForTargetKind, z as openMeldDaemonTaskResultOpenClawGatewayVisibilityStatusSchema, zn as installedLocalComponentsSnapshotSchema, zr as resolvePublicAgentAvailabilityCopy } from "./runtime-transport-DCZK5hCV.js";
 import { r as daemonServiceLaneSchema, t as daemonServiceContractSchema } from "./service-contract-CRyDcIIf.js";
 import { A as isDaemonServiceRuntimeHeartbeatStale, B as setDaemonServiceRuntimeState, C as daemonServiceStableExecutableWrapperPath, D as getDaemonRuntimeStatus, E as ensureDaemonControlPlaneToken, F as releaseDaemonServiceLifecycleLock, G as withDaemonServiceStopLock, H as withDaemonServiceReconcileLock, I as resolveDaemonControlPlaneEndpoint, K as readDaemonLocalStateFile, L as resolveDaemonServiceRuntimeMetadata, M as readDaemonServiceLifecycleLockMeta, N as readDaemonServiceLifecycleLockMetaWithCleanup, O as getDaemonStatus, P as readDaemonServiceRuntimeSnapshot, R as restoreDaemonInstallStateSnapshot, S as daemonServiceRepairJournalPath, T as daemonStatePath, U as withDaemonServiceRegistrationMutationLock, V as uninstallDaemon, W as withDaemonServiceRunLock, _ as daemonRuntimeServiceManagerPath, a as DAEMON_SERVICE_RUNTIME_CONTROLLER_ENV, b as daemonServiceLegacyExecutableWrapperPath, c as DAEMON_SERVICE_RUNTIME_STATE_SCHEMA, d as clearDaemonServiceRuntimeState, f as daemonDispatchJournalPath, g as daemonRuntimeRootPath, h as daemonRuntimeDataPath, i as DAEMON_SERVICE_RUNTIME_AUTO_START_ENV, j as readDaemonControlPlaneToken, k as installDaemon, l as DAEMON_SERVICE_RUNTIME_SYSTEM_SERVICE_ENV, m as daemonRuntimeBundlesPath, n as writeDaemonRuntimeLease, o as DAEMON_SERVICE_RUNTIME_DETACHED_ENV, p as daemonLifecycleJournalPath, q as writeDaemonLocalStateFile, r as DAEMON_HEARTBEAT_STALE_MS, s as DAEMON_SERVICE_RUNTIME_MODE_ENV, t as readDaemonRuntimeLease, u as acquireDaemonServiceLifecycleLock, v as daemonRuntimeStateRootPath, w as daemonServiceStableLauncherPath, x as daemonServiceRecognizedExecutableWrapperPaths, y as daemonServiceActiveBundleStatePath, z as rotateDaemonControlPlaneTokenIfExpired } from "./daemon-runtime-lease-Cath1v3w.js";
-import { D as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS$1, E as OPENCLAW_CLI_TIMEOUT_MS$1, M as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS$1, N as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS$1, O as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS$1, S as MAX_HEARTBEAT_INTERVAL_MS$2, _ as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS$1, d as resolveOpenMeldDistribution, f as CATALOG_SYNC_RETRY_INTERVAL_MS$1, g as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS$1, h as DAEMON_STREAM_CONNECT_TIMEOUT_MS$1, i as getAuthSessionState, j as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS$1, k as REGISTER_RESPONSE_TIMEOUT_MS$1, m as DAEMON_RUNTIME_CONTRACT_EPOCH$1, n as clearAuthSession, p as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS$1, s as setAuthSession, u as isBinaryDistribution, v as DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS$1, w as MIN_HEARTBEAT_INTERVAL_MS$2, x as HEARTBEAT_RESPONSE_TIMEOUT_MS$1, y as DEFAULT_HEARTBEAT_INTERVAL_MS$1 } from "./auth-session-Bcfr1k3c.js";
-import { a as buildOpenMeldProfileIdentityRequestHeadersWithAuth, c as buildRequestAuthHeaders, d as buildOpenMeldRequestContextFromProfile, f as buildOpenMeldRequestContextFromProfileIdentity, i as resolveSpaceRequestTimeoutMsForDiagnostics, l as canAttachAuthTokenToRequest, m as resolveAuthRequestCompatibility, n as createCliApiClientFoundation, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, r as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, u as resolveAuthTokenAttachment } from "./api-client-foundation-DhvXlRGR.js";
+import { D as PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS$1, E as OPENCLAW_CLI_TIMEOUT_MS$1, M as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS$1, N as RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS$1, O as PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS$1, S as MAX_HEARTBEAT_INTERVAL_MS$2, _ as DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS$1, d as resolveOpenMeldDistribution, f as CATALOG_SYNC_RETRY_INTERVAL_MS$1, g as DAEMON_STREAM_KEEPALIVE_INTERVAL_MS$1, h as DAEMON_STREAM_CONNECT_TIMEOUT_MS$1, i as getAuthSessionState, j as RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS$1, k as REGISTER_RESPONSE_TIMEOUT_MS$1, m as DAEMON_RUNTIME_CONTRACT_EPOCH$1, n as clearAuthSession, p as CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS$1, s as setAuthSession, u as isBinaryDistribution, v as DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS$1, w as MIN_HEARTBEAT_INTERVAL_MS$2, x as HEARTBEAT_RESPONSE_TIMEOUT_MS$1, y as DEFAULT_HEARTBEAT_INTERVAL_MS$1 } from "./auth-session-B_VxWQiU.js";
+import { a as buildOpenMeldProfileIdentityRequestHeadersWithAuth, c as buildRequestAuthHeaders, d as buildOpenMeldRequestContextFromProfile, f as buildOpenMeldRequestContextFromProfileIdentity, i as resolveSpaceRequestTimeoutMsForDiagnostics, l as canAttachAuthTokenToRequest, m as resolveAuthRequestCompatibility, n as createCliApiClientFoundation, o as buildOpenMeldProfileRequestHeadersWithAuth, p as deriveAuthBaseUrlFromGatewayUrl, r as fetchSpaceRequestWithTimeout, s as buildOpenMeldRequestContextHeadersWithAuth, u as resolveAuthTokenAttachment } from "./api-client-foundation-BMW8SgH8.js";
 import { createRequire } from "node:module";
 import { homedir, tmpdir, userInfo } from "node:os";
 import * as z$1 from "zod/v4";
@@ -35,8 +35,8 @@ import { Box, Container, Editor, Key, ProcessTerminal, TUI, Text, getEditorKeybi
 var package_default = {
 	$schema: "https://www.schemastore.org/package.json",
 	name: "openmeld",
-	version: "0.3.107",
-	openMeldReleaseDate: "2026-08-25",
+	version: "0.3.108",
+	openMeldReleaseDate: "2026-08-26",
 	description: "OpenMeld CLI - https://openmeld.ai",
 	license: "MIT",
 	type: "module",
@@ -17832,7 +17832,7 @@ function resolveOpenMeldAccountContext(input) {
 	};
 }
 async function resolveCurrentOpenMeldAccountContext() {
-	const { getAuthSessionMetadata } = await import("./auth-session-Bcfr1k3c.js").then((n) => n.t);
+	const { getAuthSessionMetadata } = await import("./auth-session-B_VxWQiU.js").then((n) => n.t);
 	return resolveOpenMeldAccountContext({ session: await getAuthSessionMetadata().catch(() => null) });
 }
 function resolveHostKey(baseUrl) {
@@ -20717,6 +20717,11 @@ async function readDaemonBundleDependencyManifest(input) {
 }
 async function resolveDaemonDependencyPackageRoot(input) {
 	const resolver = createRequire(join(input.resolverPackageRootPath, "package.json"));
+	const dependencyPackageRootPath = await resolveDaemonDependencyPackageRootFromManifest({
+		dependencyName: input.dependencyName,
+		resolver
+	});
+	if (dependencyPackageRootPath) return dependencyPackageRootPath;
 	try {
 		return await findDaemonDependencyPackageRoot(await realpath(resolver.resolve(input.dependencyName)));
 	} catch (error) {
@@ -20732,6 +20737,14 @@ async function resolveDaemonDependencyPackageRoot(input) {
 		throw error;
 	}
 }
+async function resolveDaemonDependencyPackageRootFromManifest(input) {
+	try {
+		return dirname(await realpath(input.resolver.resolve(`${input.dependencyName}/package.json`)));
+	} catch (error) {
+		if (isPackageEntryResolutionError(error)) return null;
+		throw error;
+	}
+}
 async function findDaemonDependencyPackageRootFromResolutionPaths(input) {
 	const resolutionPaths = input.resolver.resolve.paths(input.dependencyName);
 	if (!resolutionPaths) return null;
@@ -37223,9 +37236,9 @@ function createModelCatalogReadSession(input) {
 async function readModelCatalogOnce(baseUrl) {
 	try {
 		const [apiClient, baseUrlModule, clientFoundationModule] = await Promise.all([
-			import("./dist-Bypn86JC.js").then((n) => n.w),
+			import("./dist-BvewFyUz.js").then((n) => n.w),
 			import("./base-url-PkgATS5u.js").then((n) => n.n),
-			import("./api-client-foundation-DhvXlRGR.js").then((n) => n.t)
+			import("./api-client-foundation-BMW8SgH8.js").then((n) => n.t)
 		]);
 		if (typeof apiClient.createConfigApi !== "function") throw new Error("config api client is unavailable");
 		const resolvedBaseUrl = baseUrl ?? await baseUrlModule.resolveBaseUrl();
@@ -108209,4 +108222,4 @@ function isHumanInteractiveSpaceRuntime(runtime) {
 //#endregion
 export { runAgentsRepair as $, installAgentActivityIntegrations as $a, readDaemonServiceJobCrashExitCode as $i, formatDaemonServiceMissingRecommendation as $n, resolveOpenClawLocalDiagnosticsValue as $r, readBundledOpenMeldCliSkillDocumentByPath as $t, assertFullSignalIdArgument as A, updateOpenMeldProfile as Aa, resolveNativeAgentControllerPermissionModeForController as Ai, upsertSpaceConfig as An, setDefaultProjectConnection as Ao, DualViewGuideError as Ar, shouldEmitAgentOverview as At, persistAgentTransportSelection as B, resolveAuthenticationGuidanceFromMessage as Ba, assessServerRequiredVersion as Bi, promptSearchMultiselect as Bn, outJsonLine as Bo, runPendingDaemonServiceUpdate as Br, parseJsonResponse$1 as Bt, toSpaceMetaUpsertInput as C, resolveOpenMeldProfileOrNull as Ca, getAgentControllerPermissionModeFieldLabel as Ci, submitRuntimeAgentControllerReport as Cn, removeProjectOutbox as Co, SPACE_ADD_MEMBERS_PROGRESS_HEARTBEAT_MS as Cr, runDaemonTeardownStrict as Ct, formatHumanReadTargetList as D, listOpenMeldProfiles as Da, resolveAgentExecutionStatus as Di, resolveLocalAgentControllerLaunchability as Dn, migrateProjectBindingStore as Do, registerAuthLoginRequestOptions as Dr, reconcileCliVersionView as Dt, buildHumanReplyContextSummary as E, deleteOpenMeldProfile as Ea, resolveAgentControllerPermissionModeForController as Ei, resolveLocalAgentControllerBlockerReasonCodes as En, listProjectConnectionsWithStatus as Eo, registerDaemonControlTargetOptions as Er, buildProfileWorkspaceRows as Et, emitSpaceAgentOverview as F, buildAgentAuthenticationGuide as Fa, buildDaemonServiceTargetSpec as Fi, buildSignalMessageReadProjection as Fn, renderInfoCard as Fo, SPACE_CONTRACT_ALLOWED_ACTION_ORDER as Fr, fetchSpaceMeta as Ft, runAgentsCustomList as G, LocalDaemonControlPlaneClientError as Ga, resetCurrentCommandCheckState as Gi, isCliUpdateCheckApplicable as Gn, cliJsonSkillsLoadEnvelopeSchema as Go, resolveServiceReadinessFromServiceStatus as Gr, runDaemonStartDecisionPrompt as Gt, runAgents as H, setProfileDefaultView as Ha, finishCurrentCommandCheckScope as Hi, isReturnKeypress as Hn, cliBinaryDeltaPatchSchema as Ho, ensureDaemonRuntimePaths as Hr, writeInstalledLocalComponentsSnapshot as Ht, emitSpaceCliAgentOverview as I, buildHumanAuthenticationCard as Ia, resolveDaemonServiceAlignmentDecision as Ii, buildSpaceRoundReadProjection as In, renderTextInfoCard as Io, areAllowedActionsEquivalent as Ir, updateSpaceMeta as It, runAgentsDetect as J, registerAgentActivityRoute as Ja, resolveVersionChangeDirection as Ji, readDispatchSpaceActionContextFromEnv as Jn, organizationJoinLinkErrorResponseSchema as Jo, formatAgentReplyReadinessLabel as Jr, runSkillsEnsure as Jt, runAgentsCustomRemove as K, requestLocalAgentActivitySync as Ka, startCurrentCommandCheckScope as Ki, assertDispatchOwnedRuntimePublicWriteAllowed as Kn, cliJsonSkillsShowEnvelopeSchema as Ko, resolveDaemonServiceFreshnessWarning as Kr, collectSkillsReadinessSnapshot as Kt, prepareLocalAgentReadiness as L, createAuthenticationError as La, classifyDaemonServiceRunStartability as Li, buildUpdatesReplyWorkflowProjection as Ln, sanitizeTerminalDisplayText as Lo, buildAgentFacingPublicationModeGuideLines as Lr, readGatewayJsonResponse as Lt, prepareAuthenticatedSpaceCommandContext as M, clearSelectedOpenMeldProfileId as Ma, buildDaemonRouteObservationPresentation as Mi, buildDispatchResultMessageReadProjection as Mn, canonicalizeLocalProjectPath as Mo, buildDualViewGuideMessage as Mr, readDaemonStartFailureLogTailLines as Mt, resolveOpenMeldProfileForSpaceCommand as N, getSelectedOpenMeldProfileId as Na, buildOnboardingPlan as Ni, buildDispatchResultReplyWorkflowProjection as Nn, enqueueControllerTaskLifecycleEventWhileLocked as No, formatAgentOverviewPayload as Nr, fetchSpaceUpdates as Nt, parseEnvelope as O, primeOpenMeldProfilesSessionCache as Oa, resolveAgentProfileEditCapabilities as Oi, resolveLocalAgentControllerReportDecision as On, removeProjectConnection as Oo, registerBuiltinAgentSelectionOptions as Or, emitDaemonAgentOverview as Ot, resolveSpaceAccessLabel as P, setSelectedOpenMeldProfileId as Pa, getSetupFlowCopy as Pi, buildSignalIndex as Pn, readControllerTaskLifecycleOutboxHealth as Po, OPENMELD_AGENT_MENTAL_MODEL_LINES as Pr, createCliSpaceApi as Pt, runAgentsManage as Q, defaultManagedIntegrationPaths as Qa, isDaemonServiceJobNeverSpawned as Qi, formatDaemonServiceDowngradeBlockedRecommendation as Qn, resolveGatewayChainReadiness as Qr, ensureLocalSkills as Qt, buildReplyReadinessGuidance as R, resolveAuthenticationGuidance as Ra, classifyDaemonServiceWakeability as Ri, createSpaceMemberIdentityIndex as Rn, emitCliJsonEnvelope as Ro, canonicalizeAllowedActions as Rr, readGatewayTextResponse as Rt, loadSpaceSignalIndexOrNull as S, requireOpenMeldProfile as Sa, getAgentControllerPermissionModeDisplayMetadata as Si, submitProfileRuntimeAgentControllerReport as Sn, readAgentActivityOutboxHealth as So, registerSpaceMemberSelectionOptions as Sr, runDaemonStop as St, buildFormalSignalReadPayload as T, createOpenMeldHumanProfile as Ta, parseAgentControllerRef as Ti, collectLocalAgentControllerInventory as Tn, listProjectBindings as To, getCliVersionInfo as Tr, buildProfileWorkspacePresentation as Tt, runAgentsConfig as U, LocalProjectConnectionError as Ua, getCurrentCommandCheckState as Ui, runInteractivePrompt as Un, cliJsonOutputEnvelopeSchema as Uo, resolveDaemonDeviceId as Ur, resolveDaemonServiceParticipationStatus as Ut, resolveAgentProfileSetup as V, getProfileDefaultView as Va, resolveOpenMeldEnvironmentTarget as Vi, promptSearchSelect as Vn, outLine as Vo, scheduleDaemonServiceUpdate as Vr, resolveLocalComponentsStatus as Vt, runAgentsCustomAdd as W, validateLocalProjectConnectionPath as Wa, isCurrentCommandCheckScopeActive as Wi, assessCliUpdate as Wn, cliJsonSkillsListEnvelopeSchema as Wo, formatDaemonFailureContextText as Wr, runDaemonServiceParticipationGate as Wt, runAgentsEnable as X, unregisterAgentActivityRoute as Xa, readCurrentObservedDaemonRuntimeStatus as Xi, formatElapsedTime as Xn, compareAgentControllerRefsForDisplay as Xo, formatHumanReplyReadinessReason as Xr, runSkillsUninstall as Xt, runAgentsDisable as Y, resolveAgentActivityRouteForPath as Ya, readCurrentDaemonRuntimeContext as Yi, writeDispatchSpaceActionRecord as Yn, revokeOrganizationJoinLinkResponseSchema as Yo, formatDeviceReplyReadinessLabel as Yr, runSkillsInstall as Yt, runAgentsList as Z, AGENT_ACTIVITY_INTEGRATION_OWNER as Za, getDaemonSystemServiceLogPath as Zi, resolveElapsedTimeMs as Zn, package_default as Zo, mapAgentReplyReadinessToLegacyAutoReply as Zr, runSkillsUpdate as Zt, runSpaceWriteWithPasswordRetry as _, formatMessage as _a, listBuiltinAgentsRegistryEntries as _i, ensureAgentProfileRuntimeBinding as _n, resolveObservedAgentActivityBinding as _o, createStartAgentIdentityGuideError as _r, runDaemonInterrupt as _t, runSpaceDelete as a, ensureVersionStateReady as aa, normalizeCustomProfileWorkspacePath as ai, evaluateCommandAuthentication as an, formatOpenMeldCliCommands as ao, createResetConfirmationGuideError as ar, printOpenMeldBanner as at, buildIdentityOnlyMembersSnapshotForReadProjection as b, resolveViewProfileKey as ba, buildAgentControllerRef as bi, assessActionParticipationCandidate as bn, enqueueAgentActivityHookEvent as bo, getCommandEntryContract as br, runDaemonSnapshot as bt, runSpaceLeave as c, readVersionState as ca, setCustomProfileWorkspace as ci, runAuthMenu as cn, formatProfileAwareOpenMeldCliCommands as co, createSpaceContractSetGuideError as cr, renderOpenMeldLogo as ct, runSpaceRemoveMembers as d, toStartBackgroundHelperExecutionCompatibility as da, describeProfileWorkspacePathValidationFailure as di, buildAuthStatusSnapshot as dn, syncLocalAgentActivity as do, createSpacePublicationSetGuideError as dr, resolveSpaceSendText as dt, resolveDaemonServiceManager as ea, readRecentDaemonLifecycleEvents as ei, readRuntimeReportingHealthState as en, readAgentActivityIntegrationStatus as eo, canUseInteractivePrompts as er, runAgentsShow as et, runSpaceSend as f, resolveCurrentDaemonExpectedVersion as fa, syncDeviceRuntimeStateProjection as fi, formatActiveOrganizationLabel as fn, readDaemonServiceContract as fo, createSpaceRemoveMembersGuideError as fr, runDaemon as ft, runSpaceReadWithPasswordRetry as g, createPresenter as ga, reconcileNewRunnableBuiltinAgentsForSetup as gi, promptTextEntry as gn, buildAgentActivityEvent as go, createSpaceUpdatesGuideError as gr, runDaemonInstall as gt, uploadPreparedSpaceFiles as h, renderHumanTextErrorCard as ha, listAgentTargetStates as hi, resolveCreateProfileName as hn, removeAgentActivityContextCache as ho, createSpaceTargetGuideError as hr, runDaemonCancel as ht, runSpaceCreate as i, compareSemver as ia, ensureOpenMeldManagedProfileWorkspace as ii, ensureCommandAuthenticationOrCancel as in, formatOpenMeldCliCommand as io, createProfileMenuGuideError as ir, colorizeDisplayProfileLabel as it, assertValidSpaceIdTarget as j, alignSelectedOpenMeldProfileStorage as ja, PREPARE_SESSION_RECONNECT_GRACE_MS as ji, assertNoRemovedCcSpaceAddressingSyntax as jn, unbindProject as jo, formatDualViewGuideForDisplay as jr, runDaemonStartupPreflight as jt, isSpaceCommandOutputHandledError as k, resolveOpenMeldProfile as ka, resolveEvidenceSyncHealth as ki, inspectSpaceCacheFile as kn, runIfAgentActivityBindingGenerationIsCurrent as ko, buildAgentOverviewFromContract as kr, createDelayedSpinner as kt, runSpaceList as l, writeVersionState as la, setOpenMeldManagedProfileWorkspace as li, runAuthStatus as ln, resolveSetupFollowUpCliEntryCommand as lo, createSpaceLeaveGuideError as lr, renderOpenMeldTagline as lt, prepareRequestedSpaceSendFiles as m, renderHumanErrorCard as ma, resolveAgentProfilePrimaryAgentControllerReport as mi, resolveCreateProfileKind as mn, readAgentActivityContextForPath as mo, createSpaceSubcommandTargetGuideError as mr, runDaemonBackgroundStartForDecision as mt, promptAndConfirmSpacePassword as n, performManagedInstall as na, createModelCatalogReadSession as ni, connectWebSocket as nn, uninstallAgentActivityIntegrations as no, createProfileActionGuideError as nr, postLocalParticipationMutationReconcile as nt, runSpaceHistory as o, fetchLatestCliBinaryRelease as oa, readProfileWorkspaceConfig as oi, runAuthLogin as on, formatOpenMeldCliLine as oo, createSpaceAddMembersGuideError as or, renderOpenMeldBrandBlockLines as ot, runSpaceWatch as p, buildHumanErrorCopy as pa, createPrimaryBindingReadSession as pi, createProfileByKind as pn, upsertDaemonServiceContract as po, createSpaceResultGuideError as pr, runDaemonAutostart as pt, runAgentsCustomUpdate as q, isAgentActivityRouteRegistered as qa, inspectDaemonServiceInventory as qi, readDispatchOwnedRuntimeGuard as qn, getOrganizationJoinLinkResponseSchema as qo, resolveCurrentReplyReadinessSnapshot as qr, runSkillsCheck as qt, runSpaceAddMembers as r, buildNextVersionState as ra, resolveProfileWorkspaceRuntime as ri, buildCommandAuthenticationPromptMessage as rn, formatInlineOpenMeldCliCommands as ro, createProfileCreateGuideError as rr, colorizeAgentLabel as rt, runSpaceJoin as s, fetchLatestPackageInfo as sa, resolveConfiguredProfileWorkspacePath as si, runAuthLogout as sn, formatOpenMeldCliTextBlock as so, createSpaceAliasTargetGuideError as sr, renderOpenMeldHeader as st, buildCreateSpacePasswordPromptConfig as t, buildInstallSelfJsonPayload as ta, syncProfileWorkspaceState as ti, readRecentDaemonDispatchJournalEvents as tn, resolveAgentActivityDispatcherCommand as to, createDoctorFailedGuideError as tr, formatTransportModeDisplay as tt, runSpacePassword as u, resolveDaemonRuntimeContractCompatibility as ua, validateCustomProfileWorkspacePath as ui, buildAuthStatusRows as un, resolveUserFacingCliEntryCommand as uo, createSpaceMenuGuideError as ur, resolveGatewayWebOrigin as ut, buildHumanReadSignalsTranscriptItems as v, parseCliViewMode as va, notifyDaemonRouteCatalogChanged as vi, formatServiceParticipationReadinessLabel as vn, normalizeSharedSessionTitle as vo, createStartAuthenticationGuideError as vr, runDaemonReinstall as vt, buildFormalDispatchResultReadPayload as w, createOpenMeldAgentProfile as wa, listAgentControllerPermissionModeOptions as wi, submitRuntimeAgentControllerReports as wn, bindProject as wo, registerSkillsTargetSelectionOptions as wr, runDaemonUninstall as wt, loadSpaceIdentityDirectoryOrNull as x, isSelectedOpenMeldProfileRequiredError as xa, createAgentExecutionStatusDisplayRows as xi, computeRetryDelayMs as xn, removeProjectInbox as xo, getCommandHintsFromContract as xr, runDaemonStatusFlow as xt, emitHumanReadSignalsTextProjection as y, resolveRuntimeContext as ya, resolveLocalRegistryAgentIdFromAgentControllerRef as yi, resolveServiceParticipationReadiness as yn, readCodexSessionTitles as yo, createUpgradeConfirmationGuideError as yr, runDaemonRunAfterEntryChecks as yt, resolveHumanControllerDisplayName as z, resolveAuthenticationGuidanceFromError as za, resolveServiceUpdateUrgency as zi, formatRemovedCcRelationMessage as zn, errLine as zo, readOpenMeldToolsUpdateContextFromEnv as zr, toStructuredGatewayFailure as zt };
 
-//# sourceMappingURL=command-DmVde7c-.js.map
+//# sourceMappingURL=command-NA54nJ63.js.map