openmeld 0.3.196 → 0.3.198

package/dist/{auth-session-nklLwM9D.js.map → auth-session-BjZX32Cm.js.map}

@@ -1 +1 @@
-{"version":3,"file":"auth-session-nklLwM9D.js","names":["delay","toErrorMessage","toErrorMessage","isFileNotFoundError","exhaustiveState"],"sources":["../../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js","../src/strategy-constants.ts","../src/config/auth-session-expiry.ts","../src/config/auth-session-transition-lock.ts","../src/runtime/distribution.ts","../src/config/macos-native-keychain.ts","../src/config/token-store.ts","../src/config/auth-session.ts"],"sourcesContent":["import * as z$1 from \"zod/v4\";\n//#region src/schemas/local-machine/macos-keychain-helper.ts\nconst MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION = 2;\nconst MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = \"disallow\";\nconst macOsKeychainServiceSchema = z$1.string().trim().min(1).max(512);\nconst macOsKeychainAccountSchema = z$1.string().trim().min(1).max(512);\nconst macOsKeychainAccessTokenSchema = z$1.string().min(1).max(65536);\nconst macOsKeychainHelperOperationSchema = z$1.enum([\n\t\"store\",\n\t\"read\",\n\t\"delete\"\n]);\nconst macOsKeychainHelperRequestSchema = z$1.discriminatedUnion(\"operation\", [\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"store\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\taccessToken: macOsKeychainAccessTokenSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"read\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"delete\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t})\n]);\nconst macOsKeychainHelperMutationSuccessSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(true),\n\toperation: z$1.enum([\"store\", \"delete\"])\n});\nconst macOsKeychainHelperReadSuccessSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(true),\n\toperation: z$1.literal(\"read\"),\n\taccessToken: z$1.union([macOsKeychainAccessTokenSchema, z$1.null()])\n});\nconst macOsKeychainHelperErrorSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(false),\n\toperation: macOsKeychainHelperOperationSchema,\n\terrorMessage: z$1.string().trim().min(1).max(2048)\n});\nconst macOsKeychainHelperResponseSchema = z$1.union([\n\tmacOsKeychainHelperMutationSuccessSchema,\n\tmacOsKeychainHelperReadSuccessSchema,\n\tmacOsKeychainHelperErrorSchema\n]);\n//#endregion\nexport { MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION, MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION, macOsKeychainHelperOperationSchema, macOsKeychainHelperRequestSchema, macOsKeychainHelperResponseSchema };\n\n//# sourceMappingURL=macos-keychain-helper.js.map","import { CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from \"@openmeld/schemas\";\n\n// CLI and local daemon timing policy values. Keep this deployment-local; Core\n// and Web have their own constants files even when values intentionally match.\nexport const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 30_000;\nexport const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8000;\nexport const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;\nexport const DEFAULT_WEB_AGENT_SELECTION_TIMEOUT_MS = 30 * 60 * 1000;\nexport const DEFAULT_WEB_AGENT_SELECTION_POLL_INTERVAL_MS = 2000;\nexport const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS = 60_000;\nexport const MIN_SPACE_REQUEST_TIMEOUT_MS = 1000;\nexport const MAX_SPACE_REQUEST_TIMEOUT_MS = 120_000;\nexport const DEFAULT_HEARTBEAT_INTERVAL_MS = 25_000;\nexport const MIN_HEARTBEAT_INTERVAL_MS = 5000;\nexport const MAX_HEARTBEAT_INTERVAL_MS = 60_000;\n// Daemon stream keepalive PING cadence. Sub-idle (below the gateway/Cloudflare\n// idle-eviction window) and independent of the heartbeat, so a quiet daemon\n// socket stays warm even when no heartbeat is due. Carries no lease/readiness.\nexport const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 20_000;\n// Each keepalive PING must see the hub's auto-answered PONG within this\n// window, or the socket is treated as half-open and terminated so the normal\n// reconnect path (which also redelivers in-flight dispatch pushes) can run.\n// Without this deadline a half-open socket is only detected by the heartbeat\n// failure path, which can take ~40s+ at the idle-grown heartbeat interval.\nexport const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 10_000;\nexport const CATALOG_SYNC_INTERVAL_MULTIPLIER = 3;\nexport const MIN_CATALOG_SYNC_INTERVAL_MS = 15_000;\nexport const MAX_CATALOG_SYNC_INTERVAL_MS = 45_000;\nexport const CATALOG_SYNC_RETRY_INTERVAL_MS = 5000;\nexport const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1000;\nexport const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 60_000;\nexport const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15_000;\nexport const REGISTER_RESPONSE_TIMEOUT_MS = 10_000;\nexport const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15_000;\nexport const DAEMON_RUNTIME_CONTRACT_EPOCH =\n  CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;\nexport const OPENCLAW_CLI_TIMEOUT_MS = 30_000;\n","export type AuthSessionExpiryEligibility =\n  | { status: \"no_expiry\" }\n  | { expiresAtMs: number; status: \"valid\" }\n  | { expiresAtMs: number; status: \"expired\" }\n  | { status: \"invalid\" };\n\nexport function resolveAuthSessionExpiryEligibility(\n  expiresAt: string | undefined,\n  nowMs = Date.now()\n): AuthSessionExpiryEligibility {\n  const normalized = String(expiresAt ?? \"\").trim();\n  if (!normalized) {\n    return { status: \"no_expiry\" };\n  }\n\n  const expiresAtMs = Date.parse(normalized);\n  if (Number.isNaN(expiresAtMs)) {\n    return { status: \"invalid\" };\n  }\n  return expiresAtMs <= nowMs\n    ? { expiresAtMs, status: \"expired\" }\n    : { expiresAtMs, status: \"valid\" };\n}\n","import { setTimeout as delay } from \"node:timers/promises\";\nimport { acquireLock, isOpenMeldLockError, runWithHeldLock } from \"./lock\";\n\nconst AUTH_SESSION_LOCK_KEY = \"session-transition-mutation\";\nconst AUTH_SESSION_CANDIDATE_REFRESH_LOCK_KEY = \"candidate-session-refresh\";\nconst AUTH_SESSION_LOCK_PROFILE = \"auth-session\";\nconst AUTH_SESSION_LOCK_RETRY_DELAY_MS = 20;\nconst AUTH_SESSION_LOCK_WAIT_MS = 10_000;\n\nexport async function withAuthSessionTransitionMutationLock<T>(\n  operation: () => Promise<T>\n): Promise<T> {\n  return await withAuthSessionLock({\n    component: \"auth_session_transition\",\n    key: AUTH_SESSION_LOCK_KEY,\n    operation,\n  });\n}\n\nexport async function withAuthSessionCandidateRefreshLock<T>(\n  operation: () => Promise<T>\n): Promise<T> {\n  return await withAuthSessionLock({\n    component: \"auth_session_candidate_refresh\",\n    key: AUTH_SESSION_CANDIDATE_REFRESH_LOCK_KEY,\n    operation,\n  });\n}\n\nasync function withAuthSessionLock<T>(input: {\n  component: string;\n  key: string;\n  operation: () => Promise<T>;\n}): Promise<T> {\n  const lock = await acquireAuthSessionLock(input);\n  return await runWithHeldLock({\n    lock,\n    run: input.operation,\n    releaseContext: {\n      component: input.component,\n      lockKey: input.key,\n    },\n  });\n}\n\nasync function acquireAuthSessionLock(input: {\n  component: string;\n  key: string;\n}) {\n  const deadline = Date.now() + AUTH_SESSION_LOCK_WAIT_MS;\n  while (true) {\n    try {\n      return await acquireLock({\n        key: input.key,\n        meta: { component: input.component },\n        openMeldProfileId: AUTH_SESSION_LOCK_PROFILE,\n      });\n    } catch (error) {\n      if (!(isOpenMeldLockError(error) && Date.now() < deadline)) {\n        throw error;\n      }\n      await delay(AUTH_SESSION_LOCK_RETRY_DELAY_MS);\n    }\n  }\n}\n","/**\n * Build-time distribution marker.\n *\n * `OpenMeldDistribution` records how this CLI build is shipped and run. It is\n * orthogonal to the runtime lane / env preset (prod | dev-local | canary):\n *\n * - `npm`: shipped as the `openmeld` npm package, run via `node dist/*.js`; the\n *   OpenMeld Service daemon runs as a self-contained node bundle (dist copy +\n *   node_modules dependency closure).\n * - `binary`: shipped as a precompiled single binary (`bun build --compile`),\n *   run and self-installed as one executable; the daemon runs the same binary\n *   via its `service run` subcommand.\n *\n * The value is injected at build time (tsdown defines `\"npm\"`;\n * `scripts/release/build-cli-binary.mjs` defines `\"binary\"` via Bun `--define`)\n * so distribution-mode branching never guesses from paths and cannot be spoofed\n * by a runtime environment variable.\n */\ndeclare const __OPENMELD_DISTRIBUTION__: string | undefined;\n\nexport type OpenMeldDistribution = \"binary\" | \"npm\";\n\nconst BINARY_DISTRIBUTION: OpenMeldDistribution = \"binary\";\nconst NPM_DISTRIBUTION: OpenMeldDistribution = \"npm\";\n\n/**\n * The distribution form this CLI build was compiled for. Falls back to `npm`\n * when the marker is absent (e.g. under Vitest, where no build-time define\n * runs), which keeps the safe, path-independent default.\n */\nexport function resolveOpenMeldDistribution(): OpenMeldDistribution {\n  const injected =\n    typeof __OPENMELD_DISTRIBUTION__ === \"string\"\n      ? __OPENMELD_DISTRIBUTION__\n      : undefined;\n  return injected === BINARY_DISTRIBUTION\n    ? BINARY_DISTRIBUTION\n    : NPM_DISTRIBUTION;\n}\n\nexport function isBinaryDistribution(): boolean {\n  return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;\n}\n","import { spawn } from \"node:child_process\";\nimport { createRequire } from \"node:module\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n  MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n  type MacOsKeychainHelperRequest,\n  macOsKeychainHelperRequestSchema,\n  macOsKeychainHelperResponseSchema,\n} from \"@openmeld/schemas\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\n\nconst MAC_OS_KEYCHAIN_HELPER_ARG = \"__openmeld_macos_keychain_helper\";\nconst HELPER_OUTPUT_MAX_BYTES = 128 * 1024;\nconst OS_STATUS_PATTERN = /OSStatus (-?\\d+)/u;\nexport const MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS = 5000;\n\ntype MacOsKeychainAddon = {\n  isParentSameExecutable(): boolean;\n  read(service: string, account: string): string | null;\n  remove(service: string, account: string): void;\n  store(service: string, account: string, accessToken: string): void;\n};\n\ntype KeychainAddress = {\n  account: string;\n  service: string;\n};\n\ntype MacOsKeychainHelperRequestInput =\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"read\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"store\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"delete\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >;\ntype MacOsKeychainHelperReadRequestInput = Extract<\n  MacOsKeychainHelperRequestInput,\n  { operation: \"read\" }\n>;\ntype MacOsKeychainHelperMutationRequestInput = Exclude<\n  MacOsKeychainHelperRequestInput,\n  MacOsKeychainHelperReadRequestInput\n>;\n\nlet loadedAddon: MacOsKeychainAddon | null = null;\nlet unresponsiveKeychainError: Error | null = null;\nlet keychainRetryAt = 0;\nlet lastKeychainFailureCode: string | null = null;\nexport const MAC_OS_KEYCHAIN_RETRY_DELAY_MS = 30_000;\n\nexport async function storeMacOsNativeKeychainToken(\n  input: KeychainAddress & { accessToken: string }\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"store\",\n      service: input.service,\n      account: input.account,\n      accessToken: input.accessToken,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.store(input.service, input.account, input.accessToken);\n}\n\nexport async function readMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<string | null> {\n  if (isBinaryDistribution()) {\n    return await runBoundedMacOsNativeKeychainRequest({\n      operation: \"read\",\n      service: input.service,\n      account: input.account,\n    });\n  }\n  const addon = await loadAddon();\n  return addon.read(input.service, input.account);\n}\n\nexport async function deleteMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"delete\",\n      service: input.service,\n      account: input.account,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.remove(input.service, input.account);\n}\n\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperReadRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<string | null>;\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperMutationRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<undefined>;\nexport async function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperRequestInput,\n  options: { timeoutMs?: number } = {}\n): Promise<string | null | undefined> {\n  const request = macOsKeychainHelperRequestSchema.parse({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n    ...input,\n  });\n  const timeoutMs = options.timeoutMs ?? MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS;\n  if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) {\n    throw new Error(\"macOS Keychain helper timeout must be a positive integer\");\n  }\n\n  return await new Promise<string | null | undefined>((resolve, reject) => {\n    const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {\n      env: process.env,\n      shell: false,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      windowsHide: true,\n    });\n    let settled = false;\n    let stdout = \"\";\n    let stderr = \"\";\n\n    const clearDeadline = () => {\n      clearTimeout(deadline);\n    };\n    const rejectOnce = (error: Error) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearDeadline();\n      reject(error);\n    };\n    const deadline = setTimeout(() => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      child.kill(\"SIGKILL\");\n      reject(\n        new MacOsNativeKeychainTimeoutError(\n          `macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`\n        )\n      );\n    }, timeoutMs);\n\n    child.stdout.setEncoding(\"utf8\");\n    child.stderr.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: unknown) => {\n      stdout += String(chunk);\n      if (Buffer.byteLength(stdout, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        child.kill(\"SIGKILL\");\n        rejectOnce(new Error(\"macOS Keychain helper output was too large\"));\n      }\n    });\n    child.stderr.on(\"data\", (chunk: unknown) => {\n      stderr += String(chunk);\n      if (Buffer.byteLength(stderr, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        stderr = stderr.slice(-HELPER_OUTPUT_MAX_BYTES);\n      }\n    });\n    child.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper could not start: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.stdin.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper input failed: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.once(\"close\", (code) => {\n      if (settled) {\n        return;\n      }\n      clearDeadline();\n      settled = true;\n      try {\n        resolve(\n          parseMacOsKeychainHelperResult({\n            code,\n            operation: request.operation,\n            stderr,\n            stdout,\n          })\n        );\n      } catch (error) {\n        reject(toError(error));\n      }\n    });\n\n    child.stdin.end(JSON.stringify(request), \"utf8\");\n  });\n}\n\nexport async function runMacOsNativeKeychainHelperIfRequested(\n  argv: readonly string[] = process.argv\n): Promise<boolean> {\n  if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) {\n    return false;\n  }\n  if (!(isBinaryDistribution() && process.platform === \"darwin\")) {\n    throw new Error(\n      \"the internal macOS Keychain helper is only available in the macOS binary\"\n    );\n  }\n\n  const addon = await loadAddon();\n  if (!addon.isParentSameExecutable()) {\n    throw new Error(\n      \"the internal macOS Keychain helper is reserved for an OpenMeld child process\"\n    );\n  }\n\n  const rawRequest = await readHelperStdin();\n  let json: unknown;\n  try {\n    json = JSON.parse(rawRequest);\n  } catch {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n  const request = macOsKeychainHelperRequestSchema.safeParse(json);\n  if (!request.success) {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n\n  const response = await executeHelperRequest(request.data).catch((error) => ({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: false as const,\n    operation: request.data.operation,\n    errorMessage: truncateErrorMessage(toErrorMessage(error)),\n  }));\n  process.stdout.write(JSON.stringify(response));\n  return true;\n}\n\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperReadRequestInput\n): Promise<string | null>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperMutationRequestInput\n): Promise<undefined>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperRequestInput\n): Promise<string | null | undefined> {\n  if (unresponsiveKeychainError && Date.now() < keychainRetryAt) {\n    throw unresponsiveKeychainError;\n  }\n  try {\n    if (input.operation === \"read\") {\n      const result = await runMacOsNativeKeychainRequestInChild(input);\n      noteKeychainRecovery();\n      return result;\n    }\n    await runMacOsNativeKeychainRequestInChild(input);\n    noteKeychainRecovery();\n  } catch (error) {\n    const timedOut = error instanceof MacOsNativeKeychainTimeoutError;\n    if (error instanceof MacOsNativeKeychainTimeoutError) {\n      unresponsiveKeychainError = error;\n      keychainRetryAt = Date.now() + MAC_OS_KEYCHAIN_RETRY_DELAY_MS;\n    }\n    const osStatus = OS_STATUS_PATTERN.exec(toErrorMessage(error))?.[1];\n    let reasonCode = osStatus ? \"keychain_os_error\" : \"keychain_helper_failed\";\n    if (timedOut) {\n      reasonCode = \"keychain_helper_timeout\";\n    }\n    const failureCode = `${reasonCode}:${osStatus ?? \"none\"}`;\n    if (lastKeychainFailureCode !== failureCode) {\n      lastKeychainFailureCode = failureCode;\n      console.warn(\n        JSON.stringify({\n          event: \"cli.keychain.readiness_failed\",\n          observedAt: new Date().toISOString(),\n          reasonCode,\n          ...(osStatus ? { osStatus: Number(osStatus) } : {}),\n          operation: input.operation,\n          timeoutMs: MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS,\n          ...(timedOut ? { retryAfterMs: MAC_OS_KEYCHAIN_RETRY_DELAY_MS } : {}),\n        })\n      );\n    }\n    throw error;\n  }\n}\n\nfunction noteKeychainRecovery(): void {\n  if (lastKeychainFailureCode) {\n    console.warn(\n      JSON.stringify({\n        event: \"cli.keychain.readiness_recovered\",\n        observedAt: new Date().toISOString(),\n      })\n    );\n  }\n  unresponsiveKeychainError = null;\n  keychainRetryAt = 0;\n  lastKeychainFailureCode = null;\n}\n\nfunction parseMacOsKeychainHelperResult(input: {\n  code: number | null;\n  operation: MacOsKeychainHelperRequest[\"operation\"];\n  stderr: string;\n  stdout: string;\n}): string | null | undefined {\n  if (input.code !== 0) {\n    throw new Error(\n      `macOS Keychain helper exited with code ${input.code ?? \"unknown\"}${\n        input.stderr.trim() ? `: ${input.stderr.trim()}` : \"\"\n      }`\n    );\n  }\n\n  let rawResponse: unknown;\n  try {\n    rawResponse = JSON.parse(input.stdout);\n  } catch {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);\n  if (!(parsed.success && parsed.data.operation === input.operation)) {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  if (!parsed.data.ok) {\n    throw new Error(parsed.data.errorMessage);\n  }\n  return parsed.data.operation === \"read\" ? parsed.data.accessToken : undefined;\n}\n\nasync function executeHelperRequest(input: MacOsKeychainHelperRequest) {\n  const addon = await loadAddon();\n  if (input.operation === \"store\") {\n    addon.store(input.service, input.account, input.accessToken);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"store\" as const,\n    };\n  }\n  if (input.operation === \"delete\") {\n    addon.remove(input.service, input.account);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"delete\" as const,\n    };\n  }\n  return {\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: true as const,\n    operation: \"read\" as const,\n    accessToken: addon.read(input.service, input.account),\n  };\n}\n\nasync function readHelperStdin(): Promise<string> {\n  let raw = \"\";\n  process.stdin.setEncoding(\"utf8\");\n  for await (const chunk of process.stdin) {\n    raw += String(chunk);\n    if (Buffer.byteLength(raw, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n      throw new Error(\"macOS Keychain helper request was too large\");\n    }\n  }\n  return raw;\n}\n\nfunction truncateErrorMessage(message: string): string {\n  const normalized = message.trim() || \"macOS Keychain operation failed\";\n  return normalized.slice(0, 2048);\n}\n\nfunction formatTimeout(timeoutMs: number): string {\n  return timeoutMs % 1000 === 0\n    ? `${timeoutMs / 1000} seconds`\n    : `${timeoutMs} ms`;\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\nclass MacOsNativeKeychainTimeoutError extends Error {\n  override readonly name = \"MacOsNativeKeychainTimeoutError\";\n}\n\nasync function loadAddon(): Promise<MacOsKeychainAddon> {\n  if (loadedAddon) {\n    return loadedAddon;\n  }\n  if (process.platform !== \"darwin\") {\n    throw new Error(\"macOS Keychain is only available on macOS\");\n  }\n\n  if (isBinaryDistribution()) {\n    const embedded = await import(\"./macos-native-keychain-embedded\");\n    loadedAddon = embedded.loadEmbeddedMacOsKeychainAddon();\n    return loadedAddon;\n  }\n\n  const require = createRequire(import.meta.url);\n  const addonPath = fileURLToPath(\n    new URL(\"./native/openmeld-keychain.node\", import.meta.url)\n  );\n  loadedAddon = require(addonPath) as MacOsKeychainAddon;\n  return loadedAddon;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\nimport {\n  deleteMacOsNativeKeychainToken,\n  readMacOsNativeKeychainToken,\n  storeMacOsNativeKeychainToken,\n} from \"./macos-native-keychain\";\nimport { openMeldRootDir } from \"./paths\";\n\nconst TOKEN_STORE_KEYCHAIN_SERVICE = \"sh.openmeld.auth.token\";\nconst INSECURE_FALLBACK_ENV_KEY = \"OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN\";\nconst FORCE_INSECURE_STORE_ENV_KEY = \"OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN\";\nconst MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE =\n  \"macOS Keychain access is unavailable in this OpenMeld distribution. \" +\n  \"OpenMeld will not open an authorization window from an unattended process. \" +\n  \"Run setup or login with the current packaged OpenMeld CLI.\";\nconst COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;\nconst EXEC_FILE_BASE_OPTIONS = {\n  windowsHide: true,\n  maxBuffer: COMMAND_MAX_BUFFER_BYTES,\n  timeout: COMMAND_TIMEOUT_MS,\n} as const;\nlet insecureFallbackWarningShown = false;\nlet macOsPrivateStorageWarningShown = false;\n\ntype MacOsTokenRef = {\n  provider: \"macos-keychain\";\n  service: string;\n  account: string;\n};\n\ntype WindowsDpapiTokenRef = {\n  provider: \"windows-dpapi\";\n  key: string;\n};\n\ntype InsecureFileTokenRef = {\n  provider: \"insecure-file\";\n  key: string;\n};\n\nexport type StoredTokenRef =\n  | MacOsTokenRef\n  | WindowsDpapiTokenRef\n  | InsecureFileTokenRef;\n\nexport type AccessTokenReadResult =\n  | {\n      accessToken: string;\n      status: \"found\";\n    }\n  | {\n      status: \"missing\";\n    }\n  | {\n      errorMessage: string;\n      status: \"unavailable\";\n    };\n\ntype StoreTokenInput = {\n  accessToken: string;\n  authBaseUrl: string;\n  clientId: string;\n  unique?: boolean;\n};\n\nexport async function storeAccessToken(\n  input: StoreTokenInput\n): Promise<StoredTokenRef> {\n  const key = buildTokenKey({\n    authBaseUrl: input.authBaseUrl,\n    clientId: input.clientId,\n  });\n  const storageKey = input.unique ? buildUniqueTokenFileKey(key) : key;\n\n  if (shouldForceInsecureStore()) {\n    await setInsecureFileToken({\n      key: storageKey,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key: storageKey,\n    };\n  }\n\n  if (process.platform === \"darwin\") {\n    try {\n      const account = buildUniqueMacOsAccount(key);\n      if (shouldUseNativeMacOsKeychain()) {\n        await storeMacOsNativeKeychainToken({\n          account,\n          service: TOKEN_STORE_KEYCHAIN_SERVICE,\n          accessToken: input.accessToken,\n        });\n      } else {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      return {\n        provider: \"macos-keychain\",\n        service: TOKEN_STORE_KEYCHAIN_SERVICE,\n        account,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key: storageKey,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key: storageKey,\n        };\n      }\n      const privateKey = buildUniqueTokenFileKey(key);\n      await setInsecureFileToken({\n        key: privateKey,\n        accessToken: input.accessToken,\n      });\n      warnMacOsPrivateStorageFallback(error);\n      return { provider: \"insecure-file\", key: privateKey };\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      await setWindowsDpapiToken({\n        key: storageKey,\n        accessToken: input.accessToken,\n      });\n      return {\n        provider: \"windows-dpapi\",\n        key: storageKey,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key: storageKey,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key: storageKey,\n        };\n      }\n      throw new Error(\n        `failed to store access token via Windows DPAPI: ${toErrorMessage(error)}`\n      );\n    }\n  }\n\n  if (allowInsecureFallback()) {\n    await setInsecureFileToken({\n      key: storageKey,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key: storageKey,\n    };\n  }\n\n  throw new Error(\n    `secure token storage is unavailable on platform \"${process.platform}\". ` +\n      `Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`\n  );\n}\n\nexport async function readAccessToken(\n  ref: StoredTokenRef\n): Promise<AccessTokenReadResult> {\n  try {\n    if (ref.provider === \"macos-keychain\") {\n      if (!shouldUseNativeMacOsKeychain()) {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      const token = await readMacOsNativeKeychainToken(ref);\n      return toAccessTokenReadResult(token);\n    }\n    if (ref.provider === \"windows-dpapi\") {\n      return toAccessTokenReadResult(await getWindowsDpapiToken(ref));\n    }\n    if (ref.provider === \"insecure-file\") {\n      return toAccessTokenReadResult(await getInsecureFileToken(ref));\n    }\n    return { status: \"missing\" };\n  } catch (error) {\n    return {\n      errorMessage: toErrorMessage(error),\n      status: \"unavailable\",\n    };\n  }\n}\n\nexport async function deleteAccessToken(ref: StoredTokenRef): Promise<void> {\n  if (ref.provider === \"macos-keychain\") {\n    if (!shouldUseNativeMacOsKeychain()) {\n      throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n    }\n    await deleteMacOsNativeKeychainToken(ref);\n    return;\n  }\n  if (ref.provider === \"windows-dpapi\") {\n    await deleteWindowsDpapiToken(ref);\n    return;\n  }\n  if (ref.provider === \"insecure-file\") {\n    await deleteInsecureFileToken(ref);\n  }\n}\n\nexport function isStoredTokenRef(value: unknown): value is StoredTokenRef {\n  if (!(value && typeof value === \"object\")) {\n    return false;\n  }\n  const record = value as Record<string, unknown>;\n  const provider = normalizeString(record.provider);\n  if (provider === \"macos-keychain\") {\n    return Boolean(\n      normalizeString(record.service) &&\n        normalizeString(record.account) &&\n        record.accessGroup === undefined\n    );\n  }\n  if (provider === \"windows-dpapi\" || provider === \"insecure-file\") {\n    return normalizeTokenFileKey(record.key) !== null;\n  }\n  return false;\n}\n\nfunction buildTokenKey(input: {\n  authBaseUrl: string;\n  clientId: string;\n}): string {\n  const rootDir = resolve(openMeldRootDir());\n  return createHash(\"sha256\")\n    .update(`${input.clientId}\\n${input.authBaseUrl}\\n${rootDir}`)\n    .digest(\"hex\");\n}\n\nfunction buildUniqueMacOsAccount(key: string): string {\n  return `openmeld-auth-${key}-${randomUUID()}`;\n}\n\nfunction buildUniqueTokenFileKey(key: string): string {\n  return createHash(\"sha256\").update(`${key}\\n${randomUUID()}`).digest(\"hex\");\n}\n\nfunction shouldUseNativeMacOsKeychain(): boolean {\n  return isBinaryDistribution();\n}\n\nasync function setWindowsDpapiToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  const encrypted = await runPowerShellScript(\n    WINDOWS_DPAPI_ENCRYPT_SCRIPT,\n    input.accessToken,\n    input.key\n  );\n  await mkdir(tokenDirectoryPath(), { recursive: true });\n  // NOTE: `mode: 0o600` is POSIX-only and Windows ignores it.\n  // For `tokenDirectoryPath()` + `windowsDpapiTokenPath()` we rely on DPAPI\n  // and Windows ACLs for equivalent protection.\n  await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n}\n\nasync function getWindowsDpapiToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const encrypted = await readFile(\n    windowsDpapiTokenPath(input.key),\n    \"utf8\"\n  ).catch((error) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw error;\n  });\n  if (!encrypted) {\n    return null;\n  }\n  return runPowerShellScript(\n    WINDOWS_DPAPI_DECRYPT_SCRIPT,\n    encrypted.trim(),\n    input.key\n  );\n}\n\nasync function deleteWindowsDpapiToken(input: { key: string }): Promise<void> {\n  await rm(windowsDpapiTokenPath(input.key), { force: true });\n}\n\nasync function setInsecureFileToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  await ensurePrivateTokenDirectory();\n  const path = insecureTokenPath(input.key);\n  await writeFile(path, `${input.accessToken}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  if (process.platform !== \"win32\") {\n    await chmod(path, 0o600);\n  }\n}\n\nasync function getInsecureFileToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const raw = await readFile(insecureTokenPath(input.key), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  return raw ? raw.trim() : null;\n}\n\nasync function deleteInsecureFileToken(input: { key: string }): Promise<void> {\n  await rm(insecureTokenPath(input.key), { force: true });\n}\n\nfunction tokenDirectoryPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"tokens\");\n}\n\nfunction windowsDpapiTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);\n}\n\nfunction insecureTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);\n}\n\nfunction allowInsecureFallback(): boolean {\n  if (process.env[INSECURE_FALLBACK_ENV_KEY] === \"1\") {\n    warnInsecureFallback(\"env\");\n    return true;\n  }\n  // Known downgrade behavior:\n  // On platforms without native secure-store support, OpenMeld currently falls back\n  // to local file token storage by default for compatibility.\n  const fallbackEnabled = !isNativeSecureStorePlatform();\n  if (fallbackEnabled) {\n    warnInsecureFallback(\"platform\");\n  }\n  return fallbackEnabled;\n}\n\nfunction warnMacOsPrivateStorageFallback(error: unknown): void {\n  if (macOsPrivateStorageWarningShown) {\n    return;\n  }\n  macOsPrivateStorageWarningShown = true;\n  const storageExpectation = isBinaryDistribution()\n    ? \"This session stays in private local storage unless a later sign-in replaces it.\"\n    : \"This npm installation cannot use macOS Keychain. This session stays in private local storage.\";\n  console.warn(\n    \"[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this \" +\n      \"session in a private file protected for your macOS user account, so \" +\n      \"setup can continue. \" +\n      `${storageExpectation} Details: ${toErrorMessage(error)}`\n  );\n}\n\nfunction warnInsecureFallback(reason: \"env\" | \"platform\"): void {\n  if (insecureFallbackWarningShown) {\n    return;\n  }\n  insecureFallbackWarningShown = true;\n\n  const reasonText =\n    reason === \"env\"\n      ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1`\n      : `enabled automatically on platform \"${process.platform}\"`;\n  console.warn(\n    `[openmeld auth] plaintext file token storage fallback is active (${reasonText}). ` +\n      `Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, ` +\n      \"and prefer macOS or Windows for native secure token storage.\"\n  );\n}\n\nfunction shouldForceInsecureStore(): boolean {\n  return process.env[FORCE_INSECURE_STORE_ENV_KEY] === \"1\";\n}\n\nfunction isNativeSecureStorePlatform(): boolean {\n  return process.platform === \"darwin\" || process.platform === \"win32\";\n}\n\nasync function ensurePrivateTokenDirectory(): Promise<void> {\n  const directory = tokenDirectoryPath();\n  await mkdir(directory, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\") {\n    await chmod(directory, 0o700);\n  }\n}\n\nasync function runPowerShellScript(\n  script: string,\n  token: string,\n  entropy: string\n): Promise<string> {\n  const payload = JSON.stringify({ token, entropy });\n  const result = await runCommand(\n    \"powershell.exe\",\n    [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-ExecutionPolicy\",\n      \"Bypass\",\n      \"-Command\",\n      script,\n    ],\n    payload\n  );\n  return result.stdout.trim();\n}\n\nasync function runCommand(\n  command: string,\n  args: string[],\n  stdinPayload: string\n): Promise<{ stdout: string; stderr: string }> {\n  try {\n    const { execFile } = await import(\"node:child_process\");\n    const output = await new Promise<{ stdout: string; stderr: string }>(\n      (resolve, reject) => {\n        let stdout = \"\";\n        let stderr = \"\";\n\n        const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });\n\n        child.stdout?.setEncoding(\"utf8\");\n        child.stderr?.setEncoding(\"utf8\");\n        child.stdout?.on(\"data\", (chunk: unknown) => {\n          stdout += String(chunk);\n        });\n        child.stderr?.on(\"data\", (chunk: unknown) => {\n          stderr += String(chunk);\n        });\n\n        child.on(\"error\", (error) => {\n          reject(toCommandError(error, command));\n        });\n\n        child.on(\"close\", (code) => {\n          if (code === 0) {\n            resolve({ stdout, stderr });\n            return;\n          }\n          reject(\n            toCommandError(\n              {\n                message: `command failed (${command}) with exit code ${code}`,\n              },\n              command\n            )\n          );\n        });\n\n        child.stdin?.write(stdinPayload);\n        child.stdin?.end();\n      }\n    );\n    return output;\n  } catch (error) {\n    throw toCommandError(error, command);\n  }\n}\n\nfunction toCommandError(\n  error: unknown,\n  command: string\n): Error & { code?: number | null; stdout?: string; stderr?: string } {\n  if (!(error && typeof error === \"object\")) {\n    return new Error(`command failed (${command}): ${String(error)}`);\n  }\n  const e = error as NodeJS.ErrnoException & {\n    stdout?: string;\n    stderr?: string;\n    code?: number | null | string;\n  };\n  const code = typeof e.code === \"number\" ? e.code : null;\n  const messageParts = [`command failed (${command})`];\n  if (typeof e.stderr === \"string\" && e.stderr.trim()) {\n    messageParts.push(`stderr: ${e.stderr.trim()}`);\n  } else if (e.message) {\n    messageParts.push(e.message);\n  }\n  const wrapped = new Error(messageParts.join(\"; \")) as Error & {\n    code?: number | null;\n    stdout?: string;\n    stderr?: string;\n  };\n  wrapped.code = code;\n  wrapped.stdout = e.stdout;\n  wrapped.stderr = e.stderr;\n  return wrapped;\n}\n\nfunction normalizeString(value: unknown): string {\n  return String(value ?? \"\").trim();\n}\n\nfunction normalizeTokenFileKey(value: unknown): string | null {\n  const normalized = normalizeString(value);\n  if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction requireValidTokenFileKey(value: unknown): string {\n  const normalized = normalizeTokenFileKey(value);\n  if (normalized === null) {\n    throw new Error(\"stored token key is invalid\");\n  }\n  return normalized;\n}\n\nfunction normalizeToken(value: string | null): string | null {\n  if (value === null) {\n    return null;\n  }\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction toAccessTokenReadResult(value: string | null): AccessTokenReadResult {\n  const accessToken = normalizeToken(value);\n  if (!accessToken) {\n    return { status: \"missing\" };\n  }\n  return {\n    accessToken,\n    status: \"found\",\n  };\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  return String(error);\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nconst WINDOWS_DPAPI_ENCRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Convert]::ToBase64String($cipher)\",\n].join(\";\");\n\nconst WINDOWS_DPAPI_DECRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$cipher=[System.Convert]::FromBase64String($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Text.Encoding]::UTF8.GetString($plain)\",\n].join(\";\");\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { link, mkdir, open, readFile, rename, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  DEFAULT_REMOTE_SESSION_TIMEOUT_MS,\n  LOOPBACK_REMOTE_SESSION_TIMEOUT_MS,\n} from \"../strategy-constants\";\nimport {\n  CURRENT_PROCESS_START_IDENTITY,\n  isProcessIdentityAlive,\n} from \"../system/process-identity\";\nimport { resolveAuthSessionExpiryEligibility } from \"./auth-session-expiry\";\nimport {\n  withAuthSessionCandidateRefreshLock,\n  withAuthSessionTransitionMutationLock,\n} from \"./auth-session-transition-lock\";\nimport { isLoopbackHostname } from \"./loopback-hostname\";\nimport { openMeldRootDir } from \"./paths\";\nimport {\n  deleteAccessToken,\n  isStoredTokenRef,\n  readAccessToken,\n  type StoredTokenRef,\n  storeAccessToken,\n} from \"./token-store\";\n\ntype AuthSessionV1 = {\n  v: 1;\n  tokenRef: StoredTokenRef;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype PendingTokenCleanupV1 = {\n  v: 1;\n  tokenRefs: StoredTokenRef[];\n};\n\ntype AuthSessionTransitionJournalV1 = {\n  v: 1;\n  id: string;\n  state: \"pending\" | \"recovery_required\" | \"committed\";\n  ownerPid: number;\n  ownerProcessStartedAt: string;\n  previousPayload: AuthSessionV1 | null;\n  candidatePayload: AuthSessionV1;\n  candidateCredentialRefreshVersion?: 1;\n  candidateTokenRefs?: StoredTokenRef[];\n  candidateServiceProcesses?: ProcessIdentity[];\n  /** @deprecated Read and write until in-flight v1 journals from older builds expire. */\n  candidateServiceProcess?: ProcessIdentity;\n  computerHandoff?: {\n    gatewayUrl: string;\n    serviceReconciledAt?: string;\n    remoteSessionRevokedAt?: string;\n    lastRecoveryFailure?: {\n      at: string;\n      message: string;\n      phase: \"service\" | \"remote_session\" | \"local_cleanup\";\n      endpoint?: string;\n      status?: number | null;\n    };\n  };\n};\n\ntype ProcessIdentity = {\n  ownerPid: number;\n  ownerProcessStartedAt: string;\n};\n\nconst MAX_CANDIDATE_SERVICE_PROCESSES = 16;\nconst MAX_CANDIDATE_TOKEN_REFS = 64;\n\nclass AuthSessionStorageError extends Error {\n  readonly reason: \"corrupt\" | \"unreadable\";\n\n  constructor(input: {\n    message: string;\n    reason: \"corrupt\" | \"unreadable\";\n    cause?: unknown;\n  }) {\n    super(\n      input.message,\n      input.cause === undefined ? undefined : { cause: input.cause }\n    );\n    this.name = \"AuthSessionStorageError\";\n    this.reason = input.reason;\n  }\n}\n\nexport class AuthSessionRecoveryInProgressError extends Error {\n  constructor() {\n    super(\n      \"OpenMeld is still finishing an interrupted Computer sign-in recovery. The current sign-in was not changed; retry after the recovery cleanup succeeds.\"\n    );\n    this.name = \"AuthSessionRecoveryInProgressError\";\n  }\n}\n\nexport class AuthSessionChangedBeforeTransitionError extends Error {\n  readonly reason = \"previous_session_changed\" as const;\n\n  constructor() {\n    super(\n      \"The current Computer sign-in changed while OpenMeld was waiting to start this account switch. Run the setup command again to review the current account before switching. No local sign-in state was changed.\"\n    );\n    this.name = \"AuthSessionChangedBeforeTransitionError\";\n  }\n}\n\nexport class AuthSessionTransitionConflictError extends Error {\n  readonly previousOwnerRestored: boolean;\n  readonly reason:\n    | \"journal_missing\"\n    | \"journal_not_pending\"\n    | \"journal_replaced\";\n\n  constructor(input: {\n    previousOwnerRestored: boolean;\n    reason: \"journal_missing\" | \"journal_not_pending\" | \"journal_replaced\";\n  }) {\n    const conflict = {\n      journal_missing: \"missing\",\n      journal_not_pending: \"no longer pending\",\n      journal_replaced: \"owned by another sign-in\",\n    }[input.reason];\n    const outcome = input.previousOwnerRestored\n      ? \"The previous sign-in was restored.\"\n      : \"No local sign-in state was changed.\";\n    super(`The auth session transition journal is ${conflict}. ${outcome}`);\n    this.name = \"AuthSessionTransitionConflictError\";\n    this.reason = input.reason;\n    this.previousOwnerRestored = input.previousOwnerRestored;\n  }\n}\n\nexport type ClearAuthSessionResult = {\n  hadLocalSession: boolean;\n  preservedSessionPath?: string;\n};\n\nexport type StoredActiveOrganization = {\n  id: string;\n  slug: string;\n  name: string;\n  role?: string;\n  personal?: boolean;\n};\n\nexport type StoredAuthSession = {\n  v: 1;\n  accessToken: string;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type AuthSessionInput = {\n  accessToken: string;\n  tokenType?: string;\n  authBaseUrl: string;\n  clientId: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization | null;\n};\n\nexport type AuthSessionTransition = {\n  previousSession: StoredAuthSession | null;\n  commit: () => Promise<void>;\n  rollback: () => Promise<void>;\n};\n\nexport type AuthSessionTransitionContext = {\n  computerHandoff?: {\n    gatewayUrl: string;\n  };\n  expectedPreviousSession?: AuthSessionMetadata | null;\n};\n\nexport type InterruptedComputerAuthSessionRecovery = {\n  gatewayUrl: string;\n  id: string;\n  previousSession: StoredAuthSession | null;\n  serviceReconciled: boolean;\n} & (\n  | { remoteSessionRevoked: true; candidateSession: null }\n  | {\n      remoteSessionRevoked: false;\n      candidateSession: StoredAuthSession & {\n        user: NonNullable<StoredAuthSession[\"user\"]> & { id: string };\n      };\n    }\n);\n\nexport type AuthSessionState =\n  | \"missing\"\n  | \"valid\"\n  | \"expired\"\n  | \"invalid\"\n  | \"revoked\";\n\nexport type AuthSessionStateReasonCode =\n  | \"remote_session_invalid\"\n  | \"remote_session_revoked\"\n  | \"session_expired\"\n  | \"session_expiry_invalid\"\n  | \"session_metadata_invalid\"\n  | \"session_missing\"\n  | \"session_token_missing\"\n  | \"session_token_ref_invalid\"\n  | \"session_token_unavailable\";\n\nexport type AuthSessionStateResult = {\n  errorMessage?: string;\n  reasonCode?: AuthSessionStateReasonCode;\n  state: AuthSessionState;\n  session: StoredAuthSession | null;\n};\n\nexport type AuthSessionMetadata = {\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype GetAuthSessionStateOptions = {\n  // Keep normal requests local-first, but let the server recover a stale local\n  // expiry before callers stop attaching an otherwise usable credential.\n  refreshExpired?: boolean;\n  // Ask the server to validate even a locally current session.\n  validateRemote?: boolean;\n};\n\ntype LocalAuthSessionState =\n  | {\n      errorMessage?: string;\n      reasonCode: Exclude<\n        AuthSessionStateReasonCode,\n        \"remote_session_invalid\" | \"remote_session_revoked\" | \"session_expired\"\n      >;\n      state: \"missing\" | \"invalid\";\n      session: null;\n    }\n  | {\n      reasonCode: \"session_expired\";\n      state: \"expired\";\n      session: StoredAuthSession;\n    }\n  | {\n      state: \"valid\";\n      session: StoredAuthSession;\n    };\n\ntype RemoteAuthSessionState = \"valid\" | \"invalid\" | \"revoked\" | \"unknown\";\ntype RemoteAuthSessionValidation =\n  | {\n      accessToken?: string;\n      expiresAt?: string;\n      state: \"valid\";\n    }\n  | {\n      state: Exclude<RemoteAuthSessionState, \"valid\">;\n    };\nconst TRAILING_SLASHES_RE = /\\/+$/u;\n\ntype CachedAuthSession = {\n  payloadKey: string;\n  session: StoredAuthSession;\n};\n\nlet cachedAuthSession: CachedAuthSession | null = null;\nconst activeAuthSessionTransitionIds = new Set<string>();\n\nexport async function getAuthSessionState(\n  options: GetAuthSessionStateOptions = {}\n): Promise<AuthSessionStateResult> {\n  return await getAuthSessionStateWithCandidateRefreshFence(options, false);\n}\n\nasync function getAuthSessionStateWithCandidateRefreshFence(\n  options: GetAuthSessionStateOptions,\n  candidateRefreshFenceHeld: boolean\n): Promise<AuthSessionStateResult> {\n  const localState = await getLocalAuthSessionState();\n  const localPayloadKey = cachedAuthSession?.payloadKey ?? null;\n  const shouldValidateRemote =\n    options.validateRemote === true ||\n    (options.refreshExpired === true && localState.state === \"expired\");\n  switch (localState.state) {\n    case \"missing\":\n    case \"invalid\":\n      return localState;\n    case \"expired\":\n      if (!shouldValidateRemote) {\n        return localState;\n      }\n      break;\n    case \"valid\":\n      break;\n    default:\n      return localState;\n  }\n  if (!shouldValidateRemote) {\n    return localState;\n  }\n  if (\n    !candidateRefreshFenceHeld &&\n    (await shouldFencePendingCandidateRemoteValidation())\n  ) {\n    return await withAuthSessionCandidateRefreshLock(\n      async () =>\n        await getAuthSessionStateWithCandidateRefreshFence(options, true)\n    );\n  }\n\n  const remoteValidation = await getRemoteAuthSessionState(localState.session);\n  if (remoteValidation.state === \"valid\") {\n    return await resolveRemotelyValidatedAuthSession({\n      localPayloadKey,\n      localState,\n      remoteValidation,\n    });\n  }\n  if (remoteValidation.state === \"unknown\") {\n    if (localState.state === \"expired\" && options.refreshExpired === true) {\n      // A stale local timestamp is not authorization truth. Preserve the\n      // session so the shared request-attachment owner can reject the known\n      // expiry without discarding credentials that a later refresh may renew.\n      return {\n        state: \"valid\",\n        session: localState.session,\n      };\n    }\n    return localState;\n  }\n\n  return {\n    reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),\n    state: remoteValidation.state,\n    session: null,\n  };\n}\n\nasync function shouldFencePendingCandidateRemoteValidation(): Promise<boolean> {\n  const journal = await readAuthSessionTransitionJournal();\n  return Boolean(\n    journal?.state === \"pending\" &&\n      journal.candidateCredentialRefreshVersion === 1 &&\n      isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal)\n  );\n}\n\nasync function resolveRemotelyValidatedAuthSession(input: {\n  localPayloadKey: string | null;\n  localState: Extract<LocalAuthSessionState, { state: \"expired\" | \"valid\" }>;\n  remoteValidation: Extract<RemoteAuthSessionValidation, { state: \"valid\" }>;\n}): Promise<AuthSessionStateResult> {\n  if (\n    !input.remoteValidation.expiresAt ||\n    isExpired(input.remoteValidation.expiresAt)\n  ) {\n    return input.localState;\n  }\n\n  let refreshedSession: StoredAuthSession | null;\n  try {\n    refreshedSession = await persistRemoteSessionRefresh({\n      accessToken:\n        input.remoteValidation.accessToken ??\n        input.localState.session.accessToken,\n      expectedPayloadKey: input.localPayloadKey,\n      expiresAt: input.remoteValidation.expiresAt,\n      previousAccessToken: input.localState.session.accessToken,\n    });\n  } catch (error) {\n    if (!(error instanceof AuthSessionRecoveryInProgressError)) {\n      throw error;\n    }\n    // Remote validation already proved this exact in-memory session is valid.\n    // Another process may still own the Computer handoff transaction, so this\n    // reader cannot persist the refreshed token or expiry yet. Keep using the\n    // validated session in memory instead of falling back to the committed\n    // session file, which is intentionally absent on a fresh Computer.\n    return {\n      state: \"valid\",\n      session: {\n        ...input.localState.session,\n        accessToken:\n          input.remoteValidation.accessToken ??\n          input.localState.session.accessToken,\n        expiresAt: input.remoteValidation.expiresAt,\n      },\n    };\n  }\n\n  if (!refreshedSession) {\n    return await getLocalAuthSessionState();\n  }\n  return {\n    state: \"valid\",\n    session: refreshedSession,\n  };\n}\n\n// The signed-in owner user id from the local session, or null when signed\n// out. Callers use this as the expected owner for service account-alignment\n// checks; it never validates remotely.\nexport async function getCurrentAuthOwnerUserId(): Promise<string | null> {\n  const authState = await getAuthSessionState({\n    validateRemote: false,\n  }).catch(() => null);\n  const ownerUserId = authState?.session?.user?.id?.trim() ?? \"\";\n  return ownerUserId.length > 0 ? ownerUserId : null;\n}\n\nexport async function setAuthSession(input: AuthSessionInput): Promise<void> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    await retryPendingTokenCleanup();\n\n    const previousPayload = await readSessionPayloadFile();\n    const previousTokenRef = normalizeTokenRef(previousPayload?.tokenRef);\n    const tokenRef = await storeAccessToken({\n      accessToken,\n      authBaseUrl,\n      clientId,\n    });\n\n    const payload: AuthSessionV1 = {\n      v: 1,\n      tokenRef,\n      tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n      authBaseUrl,\n      clientId,\n      createdAt: new Date().toISOString(),\n      ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n      ...(input.scope ? { scope: input.scope } : {}),\n      ...buildAuthUserPayload(input.user),\n      ...buildActiveOrganizationPayload(input.activeOrganization),\n    };\n\n    const path = authSessionPath();\n    await ensureAuthSessionDirectory();\n\n    try {\n      await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n      await writeSessionPayloadAtomically(path, payload);\n    } catch (error) {\n      await deleteAccessTokenOrRetainForCleanup(tokenRef);\n      throw error;\n    }\n\n    cacheAuthSession({\n      payload,\n      session: buildStoredAuthSession({ accessToken, payload }),\n    });\n    if (\n      previousTokenRef &&\n      !areStoredTokenRefsEqual(previousTokenRef, tokenRef)\n    ) {\n      await deleteAccessTokenOrRetainForCleanup(previousTokenRef);\n    }\n  });\n}\n\nexport async function beginAuthSessionTransition(\n  input: AuthSessionInput,\n  context: AuthSessionTransitionContext = {}\n): Promise<AuthSessionTransition> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    await retryPendingTokenCleanup();\n    await ensureAuthSessionDirectory();\n    const previousPayload = await readSessionPayloadFile();\n    const previousState = await getLocalAuthSessionState({ recover: false });\n    const previousSession =\n      previousState.state === \"valid\" || previousState.state === \"expired\"\n        ? previousState.session\n        : null;\n    assertExpectedPreviousSession({\n      current: buildAuthSessionMetadata(previousPayload),\n      expected: context.expectedPreviousSession,\n    });\n    const tokenRef = await storeAccessToken({\n      accessToken,\n      authBaseUrl,\n      clientId,\n      unique: true,\n    });\n    const nextPayload: AuthSessionV1 = {\n      v: 1,\n      tokenRef,\n      tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n      authBaseUrl,\n      clientId,\n      createdAt: new Date().toISOString(),\n      ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n      ...(input.scope ? { scope: input.scope } : {}),\n      ...buildAuthUserPayload(input.user),\n      ...buildActiveOrganizationPayload(input.activeOrganization),\n    };\n    const journal: AuthSessionTransitionJournalV1 = {\n      v: 1,\n      id: randomUUID(),\n      state: \"pending\",\n      ownerPid: process.pid,\n      ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n      previousPayload:\n        previousPayload?.v === 1 ? (previousPayload as AuthSessionV1) : null,\n      candidatePayload: nextPayload,\n      candidateCredentialRefreshVersion: 1,\n      candidateTokenRefs: [tokenRef],\n      ...(context.computerHandoff\n        ? {\n            computerHandoff: {\n              gatewayUrl: context.computerHandoff.gatewayUrl,\n            },\n          }\n        : {}),\n    };\n    let journalClaimed = false;\n    try {\n      await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n      await claimAuthSessionTransitionJournal(journal);\n      journalClaimed = true;\n      activeAuthSessionTransitionIds.add(journal.id);\n    } catch (error) {\n      activeAuthSessionTransitionIds.delete(journal.id);\n      if (journalClaimed) {\n        await restoreTransitionPreviousPayload(journal).catch(() => undefined);\n        await removeAuthSessionTransitionJournalIfOwned(journal).catch(\n          () => undefined\n        );\n      }\n      await deleteAccessTokenOrRetainForCleanup(tokenRef);\n      throw error;\n    }\n    cacheAuthSession({\n      payload: nextPayload,\n      session: buildStoredAuthSession({ accessToken, payload: nextPayload }),\n    });\n\n    let settlement: \"committed\" | \"pending\" | \"rolled_back\" = \"pending\";\n    const assertTransitionPending = () => {\n      if (settlement !== \"pending\") {\n        throw new Error(\"auth session transition is already settled\");\n      }\n    };\n    const isPreviousSessionCurrent = (\n      currentPayload: Partial<AuthSessionV1> | null\n    ) => {\n      if (!journal.previousPayload) {\n        return currentPayload === null;\n      }\n      return (\n        currentPayload?.v === 1 &&\n        buildAuthSessionPayloadKey(currentPayload) ===\n          buildAuthSessionPayloadKey(journal.previousPayload)\n      );\n    };\n    const isCandidateSessionCurrent = (\n      currentPayload: Partial<AuthSessionV1> | null,\n      candidatePayload: Partial<AuthSessionV1> = nextPayload\n    ) =>\n      currentPayload?.v === 1 &&\n      buildAuthSessionPayloadKey(currentPayload) ===\n        buildAuthSessionPayloadKey(candidatePayload);\n    const assertPreviousSessionCurrent = async () => {\n      const currentPayload = await readSessionPayloadFile();\n      if (!isPreviousSessionCurrent(currentPayload)) {\n        throw new Error(\n          \"auth session changed before the setup transition completed\"\n        );\n      }\n    };\n    const assertTransitionSessionCurrent = async (\n      candidatePayload: Partial<AuthSessionV1> = nextPayload\n    ) => {\n      const currentPayload = await readSessionPayloadFile();\n      if (\n        !(\n          isPreviousSessionCurrent(currentPayload) ||\n          isCandidateSessionCurrent(currentPayload, candidatePayload)\n        )\n      ) {\n        throw new Error(\n          \"auth session changed before the setup transition completed\"\n        );\n      }\n    };\n    const restoreMissingJournalTransition = async () => {\n      const currentPayload = await readSessionPayloadFile();\n      if (\n        !(\n          isPreviousSessionCurrent(currentPayload) ||\n          isCandidateSessionCurrent(currentPayload)\n        )\n      ) {\n        try {\n          await cleanupTransitionTokensNotReferencedByCurrentSession({\n            currentPayload,\n            journal,\n          });\n        } finally {\n          activeAuthSessionTransitionIds.delete(journal.id);\n        }\n        throw new AuthSessionTransitionConflictError({\n          previousOwnerRestored: false,\n          reason: \"journal_missing\",\n        });\n      }\n\n      await claimAuthSessionTransitionJournal(journal);\n      try {\n        await restoreTransitionPreviousPayload(journal, previousSession);\n        settlement = \"rolled_back\";\n        await deleteAccessTokenOrRetainForCleanup(tokenRef).catch(\n          (error: unknown) => {\n            logDeferredAuthSessionTransitionCleanup({\n              error,\n              transitionId: journal.id,\n            });\n          }\n        );\n      } finally {\n        activeAuthSessionTransitionIds.delete(journal.id);\n        await removeAuthSessionTransitionJournalIfOwned(journal);\n      }\n    };\n\n    return {\n      previousSession,\n      commit: async () =>\n        await withAuthSessionTransitionMutationLock(async () => {\n          assertTransitionPending();\n          const currentJournal =\n            await readOwnedPendingAuthSessionTransition(journal);\n          if (currentJournal.status === \"missing\") {\n            await restoreMissingJournalTransition();\n            throw new AuthSessionTransitionConflictError({\n              previousOwnerRestored: true,\n              reason: \"journal_missing\",\n            });\n          }\n          if (currentJournal.status !== \"current\") {\n            activeAuthSessionTransitionIds.delete(journal.id);\n            throw new AuthSessionTransitionConflictError({\n              previousOwnerRestored: false,\n              reason: currentJournal.status,\n            });\n          }\n          const committedPayload = currentJournal.journal.candidatePayload;\n          const committedSession =\n            await readStoredAuthSessionFromPayload(committedPayload);\n          await assertPreviousSessionCurrent();\n          await writeSessionPayloadAtomically(\n            authSessionPath(),\n            committedPayload\n          );\n          cacheAuthSession({\n            payload: committedPayload,\n            session: committedSession,\n          });\n          const committedJournal: AuthSessionTransitionJournalV1 = {\n            ...currentJournal.journal,\n            state: \"committed\",\n          };\n          await writeAuthSessionTransitionJournalIfOwned(\n            currentJournal.journal,\n            committedJournal\n          );\n          settlement = \"committed\";\n          activeAuthSessionTransitionIds.delete(journal.id);\n          await finalizeCommittedAuthSessionTransition(committedJournal).catch(\n            (error: unknown) => {\n              logDeferredAuthSessionTransitionCleanup({\n                error,\n                transitionId: journal.id,\n              });\n            }\n          );\n        }),\n      rollback: async () =>\n        await withAuthSessionTransitionMutationLock(async () => {\n          if (settlement === \"rolled_back\") {\n            return;\n          }\n          assertTransitionPending();\n          const currentJournal =\n            await readOwnedPendingAuthSessionTransition(journal);\n          if (currentJournal.status === \"missing\") {\n            await restoreMissingJournalTransition();\n            return;\n          }\n          if (currentJournal.status !== \"current\") {\n            activeAuthSessionTransitionIds.delete(journal.id);\n            throw new AuthSessionTransitionConflictError({\n              previousOwnerRestored: false,\n              reason: currentJournal.status,\n            });\n          }\n          await assertTransitionSessionCurrent(\n            currentJournal.journal.candidatePayload\n          );\n          await restoreTransitionPreviousPayload(\n            currentJournal.journal,\n            previousSession\n          );\n          settlement = \"rolled_back\";\n          activeAuthSessionTransitionIds.delete(journal.id);\n          stopRegisteredCandidateService(currentJournal.journal);\n          if (currentJournal.journal.computerHandoff) {\n            await writeAuthSessionTransitionJournalIfOwned(\n              currentJournal.journal,\n              {\n                ...currentJournal.journal,\n                state: \"recovery_required\",\n              }\n            );\n            return;\n          }\n          await cleanupCandidateTokenRefs(currentJournal.journal);\n          await removeAuthSessionTransitionJournalIfOwned(\n            currentJournal.journal\n          );\n        }),\n    };\n  });\n}\n\ntype OwnedPendingAuthSessionTransition =\n  | { status: \"current\"; journal: AuthSessionTransitionJournalV1 }\n  | { status: \"missing\" }\n  | { status: \"journal_not_pending\"; journal: AuthSessionTransitionJournalV1 }\n  | { status: \"journal_replaced\"; journal: AuthSessionTransitionJournalV1 };\n\nasync function readOwnedPendingAuthSessionTransition(\n  expected: AuthSessionTransitionJournalV1\n): Promise<OwnedPendingAuthSessionTransition> {\n  const currentJournal = await readAuthSessionTransitionJournal();\n  if (!currentJournal) {\n    return { status: \"missing\" };\n  }\n  if (!hasSameAuthSessionTransitionIdentity(expected, currentJournal)) {\n    return { status: \"journal_replaced\", journal: currentJournal };\n  }\n  if (currentJournal.state !== \"pending\") {\n    return { status: \"journal_not_pending\", journal: currentJournal };\n  }\n  return { status: \"current\", journal: currentJournal };\n}\n\nexport async function getInterruptedComputerAuthSessionRecovery(): Promise<InterruptedComputerAuthSessionRecovery | null> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await recoverInterruptedAuthSessionTransitionWithOwnership();\n    const journal = await readAuthSessionTransitionJournal();\n    if (!(journal?.state === \"recovery_required\" && journal.computerHandoff)) {\n      return null;\n    }\n\n    // Revocation is durable. Finishing local cleanup must not require reading\n    // a credential that has already been revoked (and may already be deleted).\n    if (journal.computerHandoff.remoteSessionRevokedAt) {\n      if (journal.computerHandoff.serviceReconciledAt) {\n        await cleanupCandidateTokenRefs(journal);\n        await removeAuthSessionTransitionJournalIfOwned(journal);\n        return null;\n      }\n      return {\n        candidateSession: null,\n        gatewayUrl: journal.computerHandoff.gatewayUrl,\n        id: journal.id,\n        previousSession: await readRecoverablePreviousSession(\n          journal.previousPayload\n        ),\n        remoteSessionRevoked: true,\n        serviceReconciled: Boolean(journal.computerHandoff.serviceReconciledAt),\n      };\n    }\n\n    const candidateSession = await readStoredAuthSessionFromPayloadIfPresent(\n      journal.candidatePayload\n    );\n    if (!candidateSession) {\n      throw new AuthSessionStorageError({\n        message: \"auth session recovery token is missing\",\n        reason: \"corrupt\",\n      });\n    }\n    const candidateOwnerUserId = normalizeOptionalString(\n      candidateSession.user?.id\n    );\n    if (!candidateOwnerUserId) {\n      throw new AuthSessionStorageError({\n        message:\n          \"computer auth recovery candidate is missing its owner user id\",\n        reason: \"corrupt\",\n      });\n    }\n\n    return {\n      candidateSession: {\n        ...candidateSession,\n        user: { ...candidateSession.user, id: candidateOwnerUserId },\n      },\n      gatewayUrl: journal.computerHandoff.gatewayUrl,\n      id: journal.id,\n      previousSession: await readRecoverablePreviousSession(\n        journal.previousPayload\n      ),\n      remoteSessionRevoked: false,\n      serviceReconciled: Boolean(journal.computerHandoff.serviceReconciledAt),\n    };\n  });\n}\n\nexport async function markInterruptedComputerAuthSessionRecovery(input: {\n  id: string;\n  phase: \"service\" | \"remote_session\";\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const journal = await readRequiredComputerAuthRecoveryJournal(input.id);\n    await writeAuthSessionTransitionJournalIfOwned(journal, {\n      ...journal,\n      computerHandoff: {\n        ...journal.computerHandoff,\n        ...(input.phase === \"service\"\n          ? { serviceReconciledAt: new Date().toISOString() }\n          : { remoteSessionRevokedAt: new Date().toISOString() }),\n        lastRecoveryFailure: undefined,\n      },\n    });\n  });\n}\n\nexport async function recordInterruptedComputerAuthSessionRecoveryFailure(input: {\n  endpoint?: string;\n  id: string;\n  message: string;\n  phase: \"service\" | \"remote_session\" | \"local_cleanup\";\n  status?: number | null;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    await recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership(\n      input\n    );\n  });\n}\n\nasync function recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership(input: {\n  endpoint?: string;\n  id: string;\n  message: string;\n  phase: \"service\" | \"remote_session\" | \"local_cleanup\";\n  status?: number | null;\n}): Promise<void> {\n  const journal = await readRequiredComputerAuthRecoveryJournal(input.id);\n  await writeAuthSessionTransitionJournalIfOwned(journal, {\n    ...journal,\n    computerHandoff: {\n      ...journal.computerHandoff,\n      lastRecoveryFailure: {\n        at: new Date().toISOString(),\n        message: input.message,\n        phase: input.phase,\n        ...(input.endpoint ? { endpoint: input.endpoint } : {}),\n        ...(input.status === undefined ? {} : { status: input.status }),\n      },\n    },\n  });\n}\n\nexport async function completeInterruptedComputerAuthSessionRecovery(\n  id: string\n): Promise<boolean> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    const journal = await readRequiredComputerAuthRecoveryJournal(id);\n    if (\n      !(\n        journal.computerHandoff.serviceReconciledAt &&\n        journal.computerHandoff.remoteSessionRevokedAt\n      )\n    ) {\n      throw new Error(\n        \"computer auth recovery cannot complete before service and remote-session cleanup\"\n      );\n    }\n    try {\n      await cleanupCandidateTokenRefs(journal);\n      await removeAuthSessionTransitionJournalIfOwned(journal);\n      return true;\n    } catch (error) {\n      await recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership({\n        id,\n        message: toErrorMessage(error),\n        phase: \"local_cleanup\",\n      }).catch(() => undefined);\n      logDeferredAuthSessionTransitionCleanup({ error, transitionId: id });\n      return false;\n    }\n  });\n}\n\nexport async function getAuthSession(): Promise<StoredAuthSession | null> {\n  const localState = await getLocalAuthSessionState();\n  if (localState.state === \"missing\" || localState.state === \"invalid\") {\n    return null;\n  }\n  return localState.session;\n}\n\nexport async function getAuthSessionMetadata(): Promise<AuthSessionMetadata | null> {\n  const payload = await readSessionPayload();\n  return buildAuthSessionMetadata(payload);\n}\n\nfunction buildAuthSessionMetadata(\n  payload: Partial<AuthSessionV1> | null\n): AuthSessionMetadata | null {\n  if (payload?.v !== 1) {\n    return null;\n  }\n\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(authBaseUrl && clientId && createdAt)) {\n    return null;\n  }\n\n  return {\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(payload.activeOrganization),\n  };\n}\n\nexport async function updateAuthSessionActiveOrganization(\n  activeOrganization: StoredActiveOrganization | null\n): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    const payload = await readSessionPayloadFile();\n    if (payload?.v !== 1) {\n      throw new Error(\"cannot update active organization without auth session\");\n    }\n\n    const tokenRef = normalizeTokenRef(payload.tokenRef);\n    const tokenType = normalizeOptionalString(payload.tokenType);\n    const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n    const clientId = normalizeOptionalString(payload.clientId);\n    const createdAt = normalizeOptionalString(payload.createdAt);\n    if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) {\n      throw new Error(\n        \"cannot update active organization for invalid auth session\"\n      );\n    }\n\n    const nextPayload: AuthSessionV1 = {\n      v: 1,\n      tokenRef,\n      tokenType,\n      authBaseUrl,\n      clientId,\n      createdAt,\n      ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n        ? { expiresAt: payload.expiresAt.trim() }\n        : {}),\n      ...(typeof payload.scope === \"string\" && payload.scope.trim()\n        ? { scope: payload.scope.trim() }\n        : {}),\n      ...buildAuthUserPayload(payload.user),\n      ...buildActiveOrganizationPayload(activeOrganization),\n    };\n\n    await writeSessionPayloadAtomically(authSessionPath(), nextPayload);\n    const currentCachedSession = readCachedAuthSession(payload);\n    if (currentCachedSession) {\n      cacheAuthSession({\n        payload: nextPayload,\n        session: buildStoredAuthSession({\n          accessToken: currentCachedSession.accessToken,\n          payload: nextPayload,\n        }),\n      });\n    }\n  });\n}\n\nexport async function clearAuthSession(): Promise<ClearAuthSessionResult> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    cachedAuthSession = null;\n    await retryPendingTokenCleanup();\n    const hadLocalSession = await authSessionFileExists();\n    let payload: Partial<AuthSessionV1> | null;\n    try {\n      payload = await readSessionPayloadFile();\n    } catch (error) {\n      if (\n        !(\n          error instanceof AuthSessionStorageError && error.reason === \"corrupt\"\n        )\n      ) {\n        throw error;\n      }\n      // Explicit logout may recover malformed metadata, but must preserve the\n      // original evidence and never guess which Keychain item it referred to.\n      const preservedSessionPath = join(\n        openMeldRootDir(),\n        \"auth\",\n        `session-corrupt-${randomUUID()}.json`\n      );\n      await rename(authSessionPath(), preservedSessionPath);\n      return { hadLocalSession, preservedSessionPath };\n    }\n    if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) {\n      await deleteAccessTokenOrRetainForCleanup(payload.tokenRef);\n    }\n    await removeSessionFile();\n    return { hadLocalSession };\n  });\n}\n\nexport async function assertAuthSessionMutationAvailable(): Promise<void> {\n  await withAuthSessionTransitionMutationLock(\n    assertAuthSessionMutationAvailableWithOwnership\n  );\n}\n\nasync function assertAuthSessionMutationAvailableWithOwnership(): Promise<void> {\n  await recoverInterruptedAuthSessionTransitionWithOwnership();\n  if (await readAuthSessionTransitionJournal()) {\n    throw new AuthSessionRecoveryInProgressError();\n  }\n}\n\nasync function retryPendingTokenCleanup(): Promise<void> {\n  const pending = await readPendingTokenCleanup();\n  if (pending.tokenRefs.length === 0) {\n    return;\n  }\n\n  const remaining: StoredTokenRef[] = [];\n  for (const tokenRef of pending.tokenRefs) {\n    try {\n      await deleteAccessToken(tokenRef);\n    } catch {\n      remaining.push(tokenRef);\n    }\n  }\n  await persistPendingTokenCleanup(remaining);\n}\n\nasync function deleteAccessTokenOrRetainForCleanup(\n  tokenRef: StoredTokenRef\n): Promise<void> {\n  try {\n    await deleteAccessToken(tokenRef);\n  } catch {\n    const pending = await readPendingTokenCleanup();\n    if (\n      pending.tokenRefs.some((ref) => areStoredTokenRefsEqual(ref, tokenRef))\n    ) {\n      return;\n    }\n    await persistPendingTokenCleanup([...pending.tokenRefs, tokenRef]);\n  }\n}\n\nasync function readPendingTokenCleanup(): Promise<PendingTokenCleanupV1> {\n  const raw = await readFile(pendingTokenCleanupPath(), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  if (raw === null) {\n    return { v: 1, tokenRefs: [] };\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  if (\n    !(isRecord(parsed) && parsed.v === 1 && Array.isArray(parsed.tokenRefs))\n  ) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  const tokenRefs = parsed.tokenRefs.filter(isStoredTokenRef);\n  if (tokenRefs.length !== parsed.tokenRefs.length) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  return { v: 1, tokenRefs };\n}\n\nasync function persistPendingTokenCleanup(\n  tokenRefs: StoredTokenRef[]\n): Promise<void> {\n  const path = pendingTokenCleanupPath();\n  if (tokenRefs.length === 0) {\n    await rm(path, { force: true });\n    return;\n  }\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n  await writeJsonAtomically(path, { v: 1, tokenRefs });\n}\n\nfunction pendingTokenCleanupPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"pending-token-cleanup.json\");\n}\n\nasync function authSessionFileExists(): Promise<boolean> {\n  try {\n    await readFile(authSessionPath(), \"utf8\");\n    return true;\n  } catch (error) {\n    if (isFileNotFoundError(error)) {\n      return false;\n    }\n    throw error;\n  }\n}\n\nasync function getLocalAuthSessionState(\n  options: { recover?: boolean } = {}\n): Promise<LocalAuthSessionState> {\n  let payload: Partial<AuthSessionV1> | null;\n  try {\n    payload =\n      options.recover === false\n        ? await readSessionPayloadFile()\n        : await readSessionPayload();\n  } catch (error) {\n    if (error instanceof AuthSessionStorageError) {\n      return {\n        errorMessage: error.message,\n        reasonCode: \"session_metadata_invalid\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    throw error;\n  }\n  if (payload?.v !== 1) {\n    return {\n      reasonCode: \"session_missing\",\n      state: \"missing\",\n      session: null,\n    };\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  if (!tokenRef) {\n    return {\n      reasonCode: \"session_token_ref_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenType && authBaseUrl && clientId && createdAt)) {\n    return {\n      reasonCode: \"session_metadata_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  let session = readCachedAuthSession(payload);\n  if (!session) {\n    const accessToken = await readAccessToken(tokenRef);\n    if (accessToken.status === \"missing\") {\n      return {\n        reasonCode: \"session_token_missing\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    if (accessToken.status === \"unavailable\") {\n      return {\n        errorMessage: accessToken.errorMessage,\n        reasonCode: \"session_token_unavailable\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    session = buildStoredAuthSession({\n      accessToken: accessToken.accessToken,\n      payload: {\n        ...payload,\n        v: 1,\n        tokenRef,\n        tokenType,\n        authBaseUrl,\n        clientId,\n        createdAt,\n      },\n    });\n    cacheAuthSession({ payload, session });\n  }\n\n  const expiryEligibility = resolveAuthSessionExpiryEligibility(\n    session.expiresAt\n  );\n  if (expiryEligibility.status === \"invalid\") {\n    return {\n      reasonCode: \"session_expiry_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n  if (expiryEligibility.status === \"expired\") {\n    return {\n      reasonCode: \"session_expired\",\n      state: \"expired\",\n      session,\n    };\n  }\n\n  return {\n    state: \"valid\",\n    session,\n  };\n}\n\nasync function assertStoredAccessTokenReloads(input: {\n  accessToken: string;\n  tokenRef: StoredTokenRef;\n}): Promise<void> {\n  const reloaded = await readAccessToken(input.tokenRef);\n  if (\n    reloaded.status === \"found\" &&\n    reloaded.accessToken === input.accessToken\n  ) {\n    return;\n  }\n  if (reloaded.status === \"unavailable\") {\n    throw new Error(\n      `stored access token could not be reloaded: ${reloaded.errorMessage}`\n    );\n  }\n  throw new Error(\"stored access token could not be reloaded\");\n}\n\nfunction buildStoredAuthSession(input: {\n  accessToken: string;\n  payload: AuthSessionV1;\n}): StoredAuthSession {\n  return {\n    v: 1,\n    accessToken: input.accessToken,\n    tokenType: input.payload.tokenType,\n    authBaseUrl: input.payload.authBaseUrl,\n    clientId: input.payload.clientId,\n    createdAt: input.payload.createdAt,\n    ...(typeof input.payload.expiresAt === \"string\" &&\n    input.payload.expiresAt.trim()\n      ? { expiresAt: input.payload.expiresAt.trim() }\n      : {}),\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n}\n\nfunction assertExpectedPreviousSession(input: {\n  current: AuthSessionMetadata | null;\n  expected: AuthSessionMetadata | null | undefined;\n}): void {\n  if (input.expected === undefined) {\n    return;\n  }\n  if (\n    buildStoredAuthSessionIdentity(input.current) !==\n    buildStoredAuthSessionIdentity(input.expected)\n  ) {\n    throw new AuthSessionChangedBeforeTransitionError();\n  }\n}\n\nfunction buildStoredAuthSessionIdentity(\n  session: AuthSessionMetadata | null\n): string {\n  if (!session) {\n    return \"missing\";\n  }\n  // Token rotation, expiry refresh, display metadata, and Organization\n  // selection do not change the signed-in Computer session the user reviewed.\n  // createdAt changes on every committed login, while user.id catches a real\n  // cross-account replacement even if two sessions are created together.\n  const identitySource = JSON.stringify([\n    session.authBaseUrl,\n    session.clientId,\n    session.createdAt,\n    session.user?.id ?? null,\n  ]);\n  return createHash(\"sha256\").update(identitySource).digest(\"base64url\");\n}\n\nasync function cleanupTransitionTokensNotReferencedByCurrentSession(input: {\n  currentPayload: Partial<AuthSessionV1> | null;\n  journal: AuthSessionTransitionJournalV1;\n}): Promise<void> {\n  const currentTokenRef = normalizeTokenRef(input.currentPayload?.tokenRef);\n  const previousTokenRef = normalizeTokenRef(\n    input.journal.previousPayload?.tokenRef\n  );\n  const transitionTokenRefs = [\n    ...(previousTokenRef ? [previousTokenRef] : []),\n    ...getCandidateTokenRefs(input.journal),\n  ];\n\n  for (const [index, tokenRef] of transitionTokenRefs.entries()) {\n    const alreadyHandled = transitionTokenRefs\n      .slice(0, index)\n      .some((previousRef) => areStoredTokenRefsEqual(previousRef, tokenRef));\n    if (\n      alreadyHandled ||\n      (currentTokenRef && areStoredTokenRefsEqual(currentTokenRef, tokenRef))\n    ) {\n      continue;\n    }\n    await deleteAccessTokenOrRetainForCleanup(tokenRef);\n  }\n}\n\nfunction cacheAuthSession(input: {\n  payload: Partial<AuthSessionV1>;\n  session: StoredAuthSession;\n}): void {\n  cachedAuthSession = {\n    payloadKey: buildAuthSessionPayloadKey(input.payload),\n    session: input.session,\n  };\n}\n\nfunction readCachedAuthSession(\n  payload: Partial<AuthSessionV1>\n): StoredAuthSession | null {\n  const payloadKey = buildAuthSessionPayloadKey(payload);\n  return cachedAuthSession?.payloadKey === payloadKey\n    ? cachedAuthSession.session\n    : null;\n}\n\nfunction buildAuthSessionPayloadKey(payload: Partial<AuthSessionV1>): string {\n  return `${authSessionPath()}\\n${JSON.stringify(payload)}`;\n}\n\nfunction areStoredTokenRefsEqual(\n  left: StoredTokenRef,\n  right: StoredTokenRef\n): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction getUniqueTokenRefs(tokenRefs: StoredTokenRef[]): StoredTokenRef[] {\n  const uniqueTokenRefs: StoredTokenRef[] = [];\n  for (const tokenRef of tokenRefs) {\n    if (\n      !uniqueTokenRefs.some((existing) =>\n        areStoredTokenRefsEqual(existing, tokenRef)\n      )\n    ) {\n      uniqueTokenRefs.push(tokenRef);\n    }\n  }\n  return uniqueTokenRefs;\n}\n\nfunction getCandidateTokenRefs(\n  journal: AuthSessionTransitionJournalV1\n): StoredTokenRef[] {\n  return getUniqueTokenRefs([\n    ...(journal.candidateTokenRefs ?? []),\n    journal.candidatePayload.tokenRef,\n  ]);\n}\n\nasync function cleanupCandidateTokenRefs(\n  journal: AuthSessionTransitionJournalV1,\n  keepTokenRef?: StoredTokenRef\n): Promise<void> {\n  for (const tokenRef of getCandidateTokenRefs(journal)) {\n    if (keepTokenRef && areStoredTokenRefsEqual(keepTokenRef, tokenRef)) {\n      continue;\n    }\n    await deleteAccessTokenOrRetainForCleanup(tokenRef);\n  }\n}\n\nasync function persistRemoteSessionRefresh(input: {\n  accessToken: string;\n  expectedPayloadKey: string | null;\n  expiresAt: string;\n  previousAccessToken: string;\n}): Promise<StoredAuthSession | null> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await recoverInterruptedAuthSessionTransitionWithOwnership();\n    const transitionJournal = await readAuthSessionTransitionJournal();\n    if (transitionJournal) {\n      if (\n        transitionJournal.state === \"pending\" &&\n        transitionJournal.candidateCredentialRefreshVersion === 1 &&\n        isAuthSessionTransitionCandidateVisibleToCurrentProcess(\n          transitionJournal\n        ) &&\n        input.expectedPayloadKey !== null &&\n        buildAuthSessionPayloadKey(transitionJournal.candidatePayload) ===\n          input.expectedPayloadKey\n      ) {\n        return await persistPendingCandidateRemoteSessionRefresh({\n          ...input,\n          journal: transitionJournal,\n        });\n      }\n      throw new AuthSessionRecoveryInProgressError();\n    }\n    return await persistCommittedRemoteSessionRefresh(input);\n  });\n}\n\nasync function persistCommittedRemoteSessionRefresh(input: {\n  accessToken: string;\n  expectedPayloadKey: string | null;\n  expiresAt: string;\n  previousAccessToken: string;\n}): Promise<StoredAuthSession | null> {\n  const payload = await readSessionPayloadFile();\n  if (\n    payload?.v !== 1 ||\n    input.expectedPayloadKey === null ||\n    buildAuthSessionPayloadKey(payload) !== input.expectedPayloadKey\n  ) {\n    return null;\n  }\n  const refresh = await prepareRemoteSessionRefresh({\n    ...input,\n    payload,\n    uniqueTokenRef: false,\n  });\n  if (!refresh) {\n    return null;\n  }\n\n  try {\n    await assertStoredAccessTokenReloads({\n      accessToken: refresh.nextSession.accessToken,\n      tokenRef: refresh.nextTokenRef,\n    });\n    await writeSessionPayloadAtomically(authSessionPath(), refresh.nextPayload);\n  } catch (error) {\n    await cleanupFailedRemoteSessionRefresh(refresh);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload: refresh.nextPayload,\n    session: refresh.nextSession,\n  });\n  if (!areStoredTokenRefsEqual(refresh.currentTokenRef, refresh.nextTokenRef)) {\n    await deleteAccessTokenOrRetainForCleanup(refresh.currentTokenRef);\n  }\n  return refresh.nextSession;\n}\n\nasync function persistPendingCandidateRemoteSessionRefresh(input: {\n  accessToken: string;\n  expiresAt: string;\n  journal: AuthSessionTransitionJournalV1;\n  previousAccessToken: string;\n}): Promise<StoredAuthSession | null> {\n  const refresh = await prepareRemoteSessionRefresh({\n    ...input,\n    payload: input.journal.candidatePayload,\n    uniqueTokenRef: true,\n  });\n  if (!refresh) {\n    return null;\n  }\n  const candidateTokenRefs = getUniqueTokenRefs([\n    ...getCandidateTokenRefs(input.journal),\n    refresh.nextTokenRef,\n  ]);\n  if (candidateTokenRefs.length > MAX_CANDIDATE_TOKEN_REFS) {\n    await cleanupFailedRemoteSessionRefresh(refresh);\n    throw new AuthSessionStorageError({\n      message: `auth session transition has more than ${String(MAX_CANDIDATE_TOKEN_REFS)} candidate token rotations`,\n      reason: \"unreadable\",\n    });\n  }\n  const nextJournal: AuthSessionTransitionJournalV1 = {\n    ...input.journal,\n    candidatePayload: refresh.nextPayload,\n    candidateTokenRefs,\n  };\n\n  try {\n    await assertStoredAccessTokenReloads({\n      accessToken: refresh.nextSession.accessToken,\n      tokenRef: refresh.nextTokenRef,\n    });\n    await writeAuthSessionTransitionJournalIfOwned(input.journal, nextJournal);\n  } catch (error) {\n    await cleanupFailedRemoteSessionRefresh(refresh);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload: refresh.nextPayload,\n    session: refresh.nextSession,\n  });\n  return refresh.nextSession;\n}\n\ntype PreparedRemoteSessionRefresh = {\n  currentTokenRef: StoredTokenRef;\n  nextPayload: AuthSessionV1;\n  nextSession: StoredAuthSession;\n  nextTokenRef: StoredTokenRef;\n};\n\nasync function prepareRemoteSessionRefresh(input: {\n  accessToken: string;\n  expiresAt: string;\n  payload: Partial<AuthSessionV1>;\n  previousAccessToken: string;\n  uniqueTokenRef: boolean;\n}): Promise<PreparedRemoteSessionRefresh | null> {\n  const currentTokenRef = normalizeTokenRef(input.payload.tokenRef);\n  const tokenType = normalizeOptionalString(input.payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(input.payload.authBaseUrl);\n  const clientId = normalizeOptionalString(input.payload.clientId);\n  const createdAt = normalizeOptionalString(input.payload.createdAt);\n  const nextAccessToken = normalizeOptionalString(input.accessToken);\n  if (\n    !(\n      currentTokenRef &&\n      tokenType &&\n      authBaseUrl &&\n      clientId &&\n      createdAt &&\n      nextAccessToken\n    )\n  ) {\n    return null;\n  }\n\n  const nextTokenRef =\n    nextAccessToken === input.previousAccessToken\n      ? currentTokenRef\n      : await storeAccessToken({\n          accessToken: nextAccessToken,\n          authBaseUrl,\n          clientId,\n          unique: input.uniqueTokenRef,\n        });\n  const nextPayload: AuthSessionV1 = {\n    v: 1,\n    tokenRef: nextTokenRef,\n    tokenType,\n    authBaseUrl,\n    clientId,\n    createdAt,\n    expiresAt: input.expiresAt,\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n  return {\n    currentTokenRef,\n    nextPayload,\n    nextSession: buildStoredAuthSession({\n      accessToken: nextAccessToken,\n      payload: nextPayload,\n    }),\n    nextTokenRef,\n  };\n}\n\nasync function cleanupFailedRemoteSessionRefresh(\n  refresh: PreparedRemoteSessionRefresh\n): Promise<void> {\n  if (!areStoredTokenRefsEqual(refresh.currentTokenRef, refresh.nextTokenRef)) {\n    await deleteAccessTokenOrRetainForCleanup(refresh.nextTokenRef);\n  }\n}\n\nfunction normalizeTokenRef(input: unknown): StoredTokenRef | null {\n  if (!isStoredTokenRef(input)) {\n    return null;\n  }\n  return input;\n}\n\nasync function getRemoteAuthSessionState(\n  session: StoredAuthSession\n): Promise<RemoteAuthSessionValidation> {\n  let endpoint = \"\";\n  try {\n    endpoint = toAuthEndpoint(session.authBaseUrl, \"/api/auth/get-session\");\n  } catch {\n    return { state: \"invalid\" };\n  }\n  try {\n    const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);\n    const response = await fetch(endpoint, {\n      method: \"GET\",\n      headers: {\n        Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}`,\n      },\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n\n    if (response.status === 401 || response.status === 403) {\n      return { state: \"revoked\" };\n    }\n    if (!response.ok) {\n      // Preserve local credentials on upstream/transient failures.\n      // Non-auth HTTP errors should be retried instead of treated as revocation.\n      return { state: \"unknown\" };\n    }\n\n    const payload = await parseResponseJson(response);\n    if (!hasActiveSessionPayload(payload)) {\n      return { state: \"invalid\" };\n    }\n    return {\n      state: \"valid\",\n      ...readRemoteAccessToken(response),\n      ...readRemoteSessionExpiration(payload),\n    };\n  } catch {\n    return { state: \"unknown\" };\n  }\n}\n\nfunction readRemoteAccessToken(response: Response): {\n  accessToken?: string;\n} {\n  const accessToken = normalizeOptionalString(\n    response.headers.get(\"set-auth-token\")\n  );\n  return accessToken ? { accessToken } : {};\n}\n\nfunction readRemoteSessionExpiration(payload: unknown): {\n  expiresAt?: string;\n} {\n  if (!isRecord(payload)) {\n    return {};\n  }\n  const session = payload.session;\n  if (!isRecord(session)) {\n    return {};\n  }\n  const expiresAt = normalizeOptionalString(session.expiresAt);\n  if (!expiresAt) {\n    return {};\n  }\n  const expiresAtMs = Date.parse(expiresAt);\n  if (Number.isNaN(expiresAtMs)) {\n    return {};\n  }\n  return { expiresAt: new Date(expiresAtMs).toISOString() };\n}\n\nfunction resolveRemoteSessionTimeoutMs(endpoint: string): number {\n  const url = parseUrlOrNull(endpoint);\n  if (url && isLoopbackHostname(url.hostname)) {\n    return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;\n  }\n  return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction hasActiveSessionPayload(payload: unknown): boolean {\n  if (!isRecord(payload)) {\n    return false;\n  }\n\n  return (\n    isRecord((payload as Record<string, unknown>).session) &&\n    isRecord((payload as Record<string, unknown>).user)\n  );\n}\n\nfunction isExpired(expiresAt: string | undefined): boolean {\n  return resolveAuthSessionExpiryEligibility(expiresAt).status === \"expired\";\n}\n\nfunction resolveRemoteAuthSessionReasonCode(\n  state: Exclude<RemoteAuthSessionState, \"valid\" | \"unknown\">\n): AuthSessionStateReasonCode {\n  switch (state) {\n    case \"invalid\":\n      return \"remote_session_invalid\";\n    case \"revoked\":\n      return \"remote_session_revoked\";\n    default: {\n      const exhaustiveState: never = state;\n      throw new Error(\n        `unsupported remote auth session state: ${exhaustiveState}`\n      );\n    }\n  }\n}\n\nasync function readSessionPayload(): Promise<Partial<AuthSessionV1> | null> {\n  await recoverInterruptedAuthSessionTransition();\n  const journal = await readAuthSessionTransitionJournal();\n  if (journal?.state === \"pending\") {\n    const candidateVisible =\n      isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal);\n    if (candidateVisible) {\n      return journal.candidatePayload;\n    }\n  }\n  return await readSessionPayloadFile();\n}\n\nfunction isAuthSessionTransitionCandidateVisibleToCurrentProcess(\n  journal: AuthSessionTransitionJournalV1\n): boolean {\n  if (activeAuthSessionTransitionIds.has(journal.id)) {\n    return true;\n  }\n  return getRegisteredCandidateServiceProcesses(journal).some(\n    (candidateServiceProcess) =>\n      isSameProcessIdentity(candidateServiceProcess, {\n        ownerPid: process.pid,\n        ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n      })\n  );\n}\n\nasync function readSessionPayloadFile(): Promise<Partial<AuthSessionV1> | null> {\n  const path = authSessionPath();\n  const raw = await readFile(path, \"utf8\").catch((error: unknown) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw new AuthSessionStorageError({\n      message: `current auth session metadata could not be read at ${path}: ${toErrorMessage(error)}`,\n      reason: \"unreadable\",\n      cause: error,\n    });\n  });\n  if (raw === null) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw) as Partial<AuthSessionV1>;\n  } catch (error) {\n    throw new AuthSessionStorageError({\n      message: `current auth session metadata is corrupt at ${path}`,\n      reason: \"corrupt\",\n      cause: error,\n    });\n  }\n}\n\nasync function recoverInterruptedAuthSessionTransition(): Promise<void> {\n  // Committed session reads do not mutate state. Only enter the recovery\n  // critical section when a durable transition actually needs inspection.\n  // The locked operation rereads the journal before making any changes.\n  if (!(await readAuthSessionTransitionJournal())) {\n    return;\n  }\n  await withAuthSessionTransitionMutationLock(\n    recoverInterruptedAuthSessionTransitionWithOwnership\n  );\n}\n\nasync function recoverInterruptedAuthSessionTransitionWithOwnership(): Promise<void> {\n  let journal = await readAuthSessionTransitionJournal();\n  if (!journal) {\n    return;\n  }\n  if (activeAuthSessionTransitionIds.has(journal.id)) {\n    return;\n  }\n  if (\n    journal.state === \"pending\" &&\n    isProcessIdentityAlive({\n      ownerPid: journal.ownerPid,\n      ownerProcessStartedAt: journal.ownerProcessStartedAt,\n    })\n  ) {\n    journal = await registerCurrentCandidateServiceProcess(journal);\n    return;\n  }\n\n  if (journal.state === \"pending\") {\n    await restoreTransitionPreviousPayload(journal);\n    stopRegisteredCandidateService(journal);\n    if (journal.computerHandoff) {\n      await writeAuthSessionTransitionJournalIfOwned(journal, {\n        ...journal,\n        state: \"recovery_required\",\n      });\n      return;\n    }\n    await cleanupCandidateTokenRefs(journal);\n    await removeAuthSessionTransitionJournalIfOwned(journal);\n    return;\n  }\n  if (journal.state === \"recovery_required\") {\n    stopRegisteredCandidateService(journal);\n    return;\n  }\n\n  if (journal.state === \"committed\") {\n    const currentPayload = await readSessionPayloadFile();\n    if (\n      currentPayload?.v !== 1 ||\n      buildAuthSessionPayloadKey(currentPayload) !==\n        buildAuthSessionPayloadKey(journal.candidatePayload)\n    ) {\n      throw new AuthSessionStorageError({\n        message:\n          \"committed auth session transition does not match current session metadata\",\n        reason: \"corrupt\",\n      });\n    }\n    await finalizeCommittedAuthSessionTransition(journal).catch(\n      (error: unknown) => {\n        logDeferredAuthSessionTransitionCleanup({\n          error,\n          transitionId: journal.id,\n        });\n      }\n    );\n  }\n}\n\nasync function finalizeCommittedAuthSessionTransition(\n  journal: AuthSessionTransitionJournalV1\n): Promise<void> {\n  const previousTokenRef = normalizeTokenRef(journal.previousPayload?.tokenRef);\n  if (\n    previousTokenRef &&\n    !areStoredTokenRefsEqual(\n      previousTokenRef,\n      journal.candidatePayload.tokenRef\n    )\n  ) {\n    await deleteAccessTokenOrRetainForCleanup(previousTokenRef);\n  }\n  await cleanupCandidateTokenRefs(journal, journal.candidatePayload.tokenRef);\n  await removeAuthSessionTransitionJournalIfOwned(journal);\n}\n\nasync function registerCurrentCandidateServiceProcess(\n  journal: AuthSessionTransitionJournalV1\n): Promise<AuthSessionTransitionJournalV1> {\n  if (!isCurrentProcessCandidateService()) {\n    return journal;\n  }\n  const currentProcess: ProcessIdentity = {\n    ownerPid: process.pid,\n    ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n  };\n  if (\n    getRegisteredCandidateServiceProcesses(journal).some(\n      (candidateServiceProcess) =>\n        isSameProcessIdentity(candidateServiceProcess, currentProcess)\n    )\n  ) {\n    return journal;\n  }\n  const currentJournal = await readAuthSessionTransitionJournal();\n  if (currentJournal?.id !== journal.id || currentJournal.state !== \"pending\") {\n    return currentJournal ?? journal;\n  }\n  const candidateServiceProcesses = getRegisteredCandidateServiceProcesses(\n    currentJournal\n  ).filter(isProcessIdentityAlive);\n  candidateServiceProcesses.push(currentProcess);\n  if (candidateServiceProcesses.length > MAX_CANDIDATE_SERVICE_PROCESSES) {\n    throw new Error(\n      `auth session transition has more than ${String(MAX_CANDIDATE_SERVICE_PROCESSES)} live candidate OpenMeld Service processes`\n    );\n  }\n  const updatedJournal = {\n    ...currentJournal,\n    candidateServiceProcesses,\n    candidateServiceProcess: currentProcess,\n  };\n  await writeAuthSessionTransitionJournalIfOwned(\n    currentJournal,\n    updatedJournal\n  );\n  return updatedJournal;\n}\n\nfunction stopRegisteredCandidateService(\n  journal: AuthSessionTransitionJournalV1\n): void {\n  for (const candidateServiceProcess of getRegisteredCandidateServiceProcesses(\n    journal\n  )) {\n    if (!isProcessIdentityAlive(candidateServiceProcess)) {\n      continue;\n    }\n    try {\n      process.kill(candidateServiceProcess.ownerPid, \"SIGTERM\");\n    } catch (error) {\n      if (!isFileNotFoundErrorCode(error, \"ESRCH\")) {\n        throw new AuthSessionStorageError({\n          message: `candidate OpenMeld Service process ${String(candidateServiceProcess.ownerPid)} could not be stopped: ${toErrorMessage(error)}`,\n          reason: \"unreadable\",\n          cause: error,\n        });\n      }\n    }\n  }\n}\n\nfunction getRegisteredCandidateServiceProcesses(\n  journal: AuthSessionTransitionJournalV1\n): ProcessIdentity[] {\n  const candidates = [\n    ...(journal.candidateServiceProcesses ?? []),\n    ...(journal.candidateServiceProcess\n      ? [journal.candidateServiceProcess]\n      : []),\n  ];\n  const uniqueCandidates: ProcessIdentity[] = [];\n  for (const candidate of candidates) {\n    if (\n      !uniqueCandidates.some((existing) =>\n        isSameProcessIdentity(existing, candidate)\n      )\n    ) {\n      uniqueCandidates.push(candidate);\n    }\n  }\n  return uniqueCandidates;\n}\n\nfunction isSameProcessIdentity(\n  left: ProcessIdentity,\n  right: ProcessIdentity\n): boolean {\n  return (\n    left.ownerPid === right.ownerPid &&\n    left.ownerProcessStartedAt === right.ownerProcessStartedAt\n  );\n}\n\nfunction isCurrentProcessCandidateService(): boolean {\n  const runtimeMode = String(\n    process.env.OPENMELD_DAEMON_RUNTIME_MODE ?? \"\"\n  ).trim();\n  return runtimeMode === \"background\" || runtimeMode === \"foreground\";\n}\n\nasync function readStoredAuthSessionFromPayload(\n  payload: AuthSessionV1\n): Promise<StoredAuthSession> {\n  const session = await readStoredAuthSessionFromPayloadIfPresent(payload);\n  if (!session) {\n    throw new AuthSessionStorageError({\n      message: \"auth session recovery token is missing\",\n      reason: \"corrupt\",\n    });\n  }\n  return session;\n}\n\nasync function readStoredAuthSessionFromPayloadIfPresent(\n  payload: AuthSessionV1\n): Promise<StoredAuthSession | null> {\n  const accessToken = await readAccessToken(payload.tokenRef);\n  if (accessToken.status === \"missing\") {\n    return null;\n  }\n  if (accessToken.status === \"unavailable\") {\n    throw new AuthSessionStorageError({\n      message: accessToken.errorMessage,\n      reason: \"unreadable\",\n    });\n  }\n  return buildStoredAuthSession({\n    accessToken: accessToken.accessToken,\n    payload,\n  });\n}\n\nasync function readRecoverablePreviousSession(\n  payload: AuthSessionV1 | null\n): Promise<StoredAuthSession | null> {\n  if (!payload) {\n    return null;\n  }\n  const token = await readAccessToken(payload.tokenRef);\n  // The rollback has already restored the original payload. An unreadable\n  // credential cannot restart a Service, but must not prevent cleanup of the\n  // failed candidate or permanently block a fresh authorization attempt.\n  return token.status === \"found\"\n    ? buildStoredAuthSession({ accessToken: token.accessToken, payload })\n    : null;\n}\n\nasync function readRequiredComputerAuthRecoveryJournal(id: string): Promise<\n  AuthSessionTransitionJournalV1 & {\n    computerHandoff: NonNullable<\n      AuthSessionTransitionJournalV1[\"computerHandoff\"]\n    >;\n  }\n> {\n  const journal = await readAuthSessionTransitionJournal();\n  if (\n    journal?.id !== id ||\n    journal.state !== \"recovery_required\" ||\n    !journal.computerHandoff\n  ) {\n    throw new Error(\"computer auth recovery is no longer current\");\n  }\n  return journal as AuthSessionTransitionJournalV1 & {\n    computerHandoff: NonNullable<\n      AuthSessionTransitionJournalV1[\"computerHandoff\"]\n    >;\n  };\n}\n\nfunction logDeferredAuthSessionTransitionCleanup(input: {\n  error: unknown;\n  transitionId: string;\n}): void {\n  console.warn(\"[openmeld.auth.session_transition_cleanup_deferred]\", {\n    error: toErrorMessage(input.error),\n    transitionId: input.transitionId,\n  });\n}\n\nasync function restoreTransitionPreviousPayload(\n  journal: AuthSessionTransitionJournalV1,\n  previousSession?: StoredAuthSession | null\n): Promise<void> {\n  cachedAuthSession = null;\n  if (!journal.previousPayload) {\n    await removeSessionFile();\n    return;\n  }\n  await writeSessionPayloadAtomically(\n    authSessionPath(),\n    journal.previousPayload\n  );\n  if (previousSession) {\n    cacheAuthSession({\n      payload: journal.previousPayload,\n      session: previousSession,\n    });\n  }\n}\n\nasync function readAuthSessionTransitionJournal(): Promise<AuthSessionTransitionJournalV1 | null> {\n  const path = authSessionTransitionPath();\n  const raw = await readFile(path, \"utf8\").catch((error: unknown) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw new AuthSessionStorageError({\n      message: `auth session transition state could not be read at ${path}: ${toErrorMessage(error)}`,\n      reason: \"unreadable\",\n      cause: error,\n    });\n  });\n  if (raw === null) {\n    return null;\n  }\n  let value: unknown;\n  try {\n    value = JSON.parse(raw);\n  } catch (error) {\n    throw new AuthSessionStorageError({\n      message: `auth session transition state is corrupt at ${path}`,\n      reason: \"corrupt\",\n      cause: error,\n    });\n  }\n  if (!isAuthSessionTransitionJournal(value)) {\n    throw new AuthSessionStorageError({\n      message: `auth session transition state is corrupt at ${path}`,\n      reason: \"corrupt\",\n    });\n  }\n  return value;\n}\n\nfunction isAuthSessionTransitionJournal(\n  value: unknown\n): value is AuthSessionTransitionJournalV1 {\n  if (!isRecord(value)) {\n    return false;\n  }\n  return (\n    value.v === 1 &&\n    typeof value.id === \"string\" &&\n    value.id.length > 0 &&\n    (value.state === \"pending\" ||\n      value.state === \"recovery_required\" ||\n      value.state === \"committed\") &&\n    Number.isSafeInteger(value.ownerPid) &&\n    Number(value.ownerPid) > 0 &&\n    typeof value.ownerProcessStartedAt === \"string\" &&\n    value.ownerProcessStartedAt.length > 0 &&\n    (value.previousPayload === null ||\n      isAuthSessionPayload(value.previousPayload)) &&\n    isAuthSessionPayload(value.candidatePayload) &&\n    (value.candidateCredentialRefreshVersion === undefined ||\n      value.candidateCredentialRefreshVersion === 1) &&\n    isOptionalStoredTokenRefList(value.candidateTokenRefs) &&\n    isOptionalProcessIdentityList(value.candidateServiceProcesses) &&\n    isOptionalProcessIdentity(value.candidateServiceProcess) &&\n    isOptionalComputerHandoffRecovery(value.computerHandoff)\n  );\n}\n\nfunction isOptionalStoredTokenRefList(value: unknown): boolean {\n  return (\n    value === undefined ||\n    (Array.isArray(value) &&\n      value.length <= MAX_CANDIDATE_TOKEN_REFS &&\n      value.every((tokenRef) => isStoredTokenRef(tokenRef)))\n  );\n}\n\nfunction isOptionalProcessIdentityList(value: unknown): boolean {\n  return (\n    value === undefined ||\n    (Array.isArray(value) &&\n      value.length <= MAX_CANDIDATE_SERVICE_PROCESSES &&\n      value.every((candidate) => isProcessIdentity(candidate)))\n  );\n}\n\nfunction isOptionalProcessIdentity(value: unknown): boolean {\n  return value === undefined || isProcessIdentity(value);\n}\n\nfunction isProcessIdentity(value: unknown): value is ProcessIdentity {\n  return (\n    isRecord(value) &&\n    Number.isSafeInteger(value.ownerPid) &&\n    Number(value.ownerPid) > 0 &&\n    typeof value.ownerProcessStartedAt === \"string\" &&\n    value.ownerProcessStartedAt.length > 0\n  );\n}\n\nfunction isOptionalComputerHandoffRecovery(value: unknown): boolean {\n  if (value === undefined) {\n    return true;\n  }\n  if (!(isRecord(value) && typeof value.gatewayUrl === \"string\")) {\n    return false;\n  }\n  return (\n    (value.serviceReconciledAt === undefined ||\n      typeof value.serviceReconciledAt === \"string\") &&\n    (value.remoteSessionRevokedAt === undefined ||\n      typeof value.remoteSessionRevokedAt === \"string\") &&\n    (value.lastRecoveryFailure === undefined ||\n      isComputerHandoffRecoveryFailure(value.lastRecoveryFailure))\n  );\n}\n\nfunction isComputerHandoffRecoveryFailure(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    typeof value.at === \"string\" &&\n    typeof value.message === \"string\" &&\n    (value.phase === \"service\" ||\n      value.phase === \"remote_session\" ||\n      value.phase === \"local_cleanup\") &&\n    (value.endpoint === undefined || typeof value.endpoint === \"string\") &&\n    (value.status === undefined ||\n      value.status === null ||\n      typeof value.status === \"number\")\n  );\n}\n\nfunction isAuthSessionPayload(value: unknown): value is AuthSessionV1 {\n  return isRecord(value) && value.v === 1 && isStoredTokenRef(value.tokenRef);\n}\n\nasync function writeAuthSessionTransitionJournalIfOwned(\n  expected: AuthSessionTransitionJournalV1,\n  next: AuthSessionTransitionJournalV1\n): Promise<void> {\n  if (!hasSameAuthSessionTransitionIdentity(expected, next)) {\n    throw new Error(\"auth session transition identity cannot change\");\n  }\n  const current = await readAuthSessionTransitionJournal();\n  if (!current) {\n    throw new AuthSessionTransitionConflictError({\n      previousOwnerRestored: false,\n      reason: \"journal_missing\",\n    });\n  }\n  if (!hasSameAuthSessionTransitionIdentity(expected, current)) {\n    throw new AuthSessionTransitionConflictError({\n      previousOwnerRestored: false,\n      reason: \"journal_replaced\",\n    });\n  }\n  await writeJsonAtomically(authSessionTransitionPath(), next);\n}\n\nasync function claimAuthSessionTransitionJournal(\n  journal: AuthSessionTransitionJournalV1\n): Promise<void> {\n  const path = authSessionTransitionPath();\n  const claimPath = `${path}.claim-${process.pid}-${Date.now()}-${randomUUID()}`;\n  const file = await open(claimPath, \"wx\", 0o600);\n  let failure: unknown;\n  try {\n    await file.writeFile(`${JSON.stringify(journal, null, 2)}\\n`, \"utf8\");\n    await file.sync();\n  } catch (error) {\n    failure = error;\n  }\n  try {\n    await file.close();\n  } catch (error) {\n    failure ??= error;\n  }\n  if (failure !== undefined) {\n    await rm(claimPath, { force: true }).catch(() => undefined);\n    throw failure;\n  }\n\n  try {\n    await link(claimPath, path);\n  } catch (error) {\n    if (isFileNotFoundErrorCode(error, \"EEXIST\")) {\n      throw new AuthSessionRecoveryInProgressError();\n    }\n    throw error;\n  } finally {\n    await rm(claimPath, { force: true }).catch(() => undefined);\n  }\n}\n\nasync function removeAuthSessionTransitionJournalIfOwned(\n  expected: AuthSessionTransitionJournalV1\n): Promise<void> {\n  const currentJournal = await readAuthSessionTransitionJournal();\n  if (!currentJournal) {\n    return;\n  }\n  if (!hasSameAuthSessionTransitionIdentity(expected, currentJournal)) {\n    throw new AuthSessionTransitionConflictError({\n      previousOwnerRestored: false,\n      reason: \"journal_replaced\",\n    });\n  }\n  await rm(authSessionTransitionPath(), { force: true });\n}\n\nfunction hasSameAuthSessionTransitionIdentity(\n  left: AuthSessionTransitionJournalV1,\n  right: AuthSessionTransitionJournalV1\n): boolean {\n  return (\n    left.id === right.id &&\n    left.ownerPid === right.ownerPid &&\n    left.ownerProcessStartedAt === right.ownerProcessStartedAt\n  );\n}\n\nfunction authSessionTransitionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session-transition.json\");\n}\n\nfunction authSessionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session.json\");\n}\n\nasync function ensureAuthSessionDirectory(): Promise<void> {\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n}\n\nasync function writeSessionPayloadAtomically(\n  path: string,\n  payload: AuthSessionV1\n): Promise<void> {\n  await writeJsonAtomically(path, payload);\n}\n\nasync function writeJsonAtomically(\n  path: string,\n  payload: unknown\n): Promise<void> {\n  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;\n  try {\n    const file = await open(tempPath, \"wx\", 0o600);\n    try {\n      await file.writeFile(`${JSON.stringify(payload, null, 2)}\\n`, \"utf8\");\n      await file.sync();\n    } finally {\n      await file.close();\n    }\n\n    await rename(tempPath, path);\n  } catch (error) {\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nfunction isFileNotFoundErrorCode(error: unknown, code: string): boolean {\n  return Boolean(\n    error && typeof error === \"object\" && \"code\" in error && error.code === code\n  );\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error && error.message.trim()\n    ? error.message.trim()\n    : String(error ?? \"unknown error\");\n}\n\nfunction buildAuthUserPayload(value: unknown): {\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n} {\n  if (!(value && typeof value === \"object\")) {\n    return {};\n  }\n  const record = value as Record<string, unknown>;\n  const id = normalizeOptionalString(record.id);\n  const email = normalizeOptionalString(record.email);\n  const name = normalizeOptionalString(record.name);\n  if (!(id || email || name)) {\n    return {};\n  }\n  return {\n    user: {\n      ...(id ? { id } : {}),\n      ...(email ? { email } : {}),\n      ...(name ? { name } : {}),\n    },\n  };\n}\n\nfunction buildActiveOrganizationPayload(value: unknown): {\n  activeOrganization?: StoredActiveOrganization;\n} {\n  const activeOrganization = normalizeStoredActiveOrganization(value);\n  return activeOrganization ? { activeOrganization } : {};\n}\n\nexport function normalizeStoredActiveOrganization(\n  value: unknown\n): StoredActiveOrganization | null {\n  if (!isRecord(value)) {\n    return null;\n  }\n  const id = normalizeOptionalString(value.id);\n  const slug = normalizeOptionalString(value.slug);\n  const name = normalizeOptionalString(value.name);\n  const role = normalizeOptionalString(value.role);\n  const personal = readOrganizationIsPersonal(value);\n  if (!(id && slug && name)) {\n    return null;\n  }\n  return {\n    id,\n    slug,\n    name,\n    ...(role ? { role } : {}),\n    ...(personal ? { personal } : {}),\n  };\n}\n\nexport function readActiveOrganizationIdFromSessionPayload(\n  payload: unknown\n): string | null {\n  if (!isRecord(payload)) {\n    return null;\n  }\n  return (\n    (isRecord(payload.session)\n      ? normalizeOptionalString(payload.session.activeOrganizationId)\n      : null) ?? normalizeOptionalString(payload.activeOrganizationId)\n  );\n}\n\nfunction normalizeTokenType(value: string): string {\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : \"Bearer\";\n}\n\nfunction normalizeOptionalString(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction readOrganizationIsPersonal(value: Record<string, unknown>): boolean {\n  if (value.personal === true || value.isPersonal === true) {\n    return true;\n  }\n\n  const metadata = readOrganizationMetadata(value.metadata);\n  return metadata?.personal === true;\n}\n\nfunction readOrganizationMetadata(\n  metadata: unknown\n): Record<string, unknown> | null {\n  if (metadata === null || metadata === undefined) {\n    return null;\n  }\n\n  if (typeof metadata === \"string\") {\n    try {\n      const parsed = JSON.parse(metadata) as unknown;\n      return isRecord(parsed) ? parsed : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return isRecord(metadata) ? metadata : null;\n}\n\nfunction toAuthEndpoint(baseUrl: string, pathname: string): string {\n  const url = new URL(baseUrl);\n  const normalizedBasePath = url.pathname.replace(TRAILING_SLASHES_RE, \"\");\n  const normalizedPathname = pathname.startsWith(\"/\")\n    ? pathname\n    : `/${pathname}`;\n  url.pathname = `${normalizedBasePath}${normalizedPathname}` || \"/\";\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\nasync function parseResponseJson(response: Response): Promise<unknown> {\n  const raw = await response.text();\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return { message: raw };\n  }\n}\n\nasync function removeSessionFile(): Promise<void> {\n  await rm(authSessionPath(), { force: true });\n}\n"],"mappings":";;;;;;;;;;;;;;AAGA,MAAM,6CAA6C;AACnD,MAAM,6BAA6B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrE,MAAM,6BAA6B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrE,MAAM,iCAAiC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;AACpE,MAAM,qCAAqC,IAAI,KAAK;CACnD;CACA;CACA;AACD,CAAC;AACD,MAAM,mCAAmC,IAAI,mBAAmB,aAAa;CAC5E,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,OAAO;EAC9B,SAAS;EACT,SAAS;EACT,aAAa;EACb,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;CACD,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,MAAM;EAC7B,SAAS;EACT,SAAS;EACT,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;CACD,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,QAAQ;EAC/B,SAAS;EACT,SAAS;EACT,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;AACF,CAAC;AACD,MAAM,2CAA2C,IAAI,aAAa;CACjE,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,IAAI;CACpB,WAAW,IAAI,KAAK,CAAC,SAAS,QAAQ,CAAC;AACxC,CAAC;AACD,MAAM,uCAAuC,IAAI,aAAa;CAC7D,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,IAAI;CACpB,WAAW,IAAI,QAAQ,MAAM;CAC7B,aAAa,IAAI,MAAM,CAAC,gCAAgC,IAAI,KAAK,CAAC,CAAC;AACpE,CAAC;AACD,MAAM,iCAAiC,IAAI,aAAa;CACvD,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,KAAK;CACrB,WAAW;CACX,cAAc,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAClD,CAAC;AACD,MAAM,oCAAoC,IAAI,MAAM;CACnD;CACA;CACA;AACD,CAAC;;;ACrDD,MAAa,mCAAmC;AAChD,MAAa,oCAAoC;AACjD,MAAa,qCAAqC;AAGlD,MAAa,mCAAmC;AAEhD,MAAa,+BAA+B;AAC5C,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,4BAA4B;AACzC,MAAa,4BAA4B;AAIzC,MAAa,sCAAsC;AAMnD,MAAa,0CAA0C;AAIvD,MAAa,iCAAiC;AAC9C,MAAa,uCAAuC;AACpD,MAAa,gCAAgC;AAC7C,MAAa,mDAAmD,IAAI;AACpE,MAAa,yDAAyD;AACtE,MAAa,+CAA+C,IAAI;AAChE,MAAa,qDAAqD;AAClE,MAAa,wCAAwC;AACrD,MAAa,mCAAmC;AAChD,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,gCACX;AACF,MAAa,0BAA0B;;;ACpCvC,SAAgB,oCACd,WACA,QAAQ,KAAK,IAAI,GACa;CAC9B,MAAM,aAAa,OAAO,aAAa,EAAE,CAAC,CAAC,KAAK;CAChD,IAAI,CAAC,YACH,OAAO,EAAE,QAAQ,YAAY;CAG/B,MAAM,cAAc,KAAK,MAAM,UAAU;CACzC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO,eAAe,QAClB;EAAE;EAAa,QAAQ;CAAU,IACjC;EAAE;EAAa,QAAQ;CAAQ;AACrC;;;ACnBA,MAAM,wBAAwB;AAC9B,MAAM,0CAA0C;AAChD,MAAM,4BAA4B;AAClC,MAAM,mCAAmC;AACzC,MAAM,4BAA4B;AAElC,eAAsB,sCACpB,WACY;CACZ,OAAO,MAAM,oBAAoB;EAC/B,WAAW;EACX,KAAK;EACL;CACF,CAAC;AACH;AAEA,eAAsB,oCACpB,WACY;CACZ,OAAO,MAAM,oBAAoB;EAC/B,WAAW;EACX,KAAK;EACL;CACF,CAAC;AACH;AAEA,eAAe,oBAAuB,OAIvB;CAEb,OAAO,MAAM,gBAAgB;EAC3B,MAAA,MAFiB,uBAAuB,KAAK;EAG7C,KAAK,MAAM;EACX,gBAAgB;GACd,WAAW,MAAM;GACjB,SAAS,MAAM;EACjB;CACF,CAAC;AACH;AAEA,eAAe,uBAAuB,OAGnC;CACD,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,MACL,IAAI;EACF,OAAO,MAAM,YAAY;GACvB,KAAK,MAAM;GACX,MAAM,EAAE,WAAW,MAAM,UAAU;GACnC,mBAAmB;EACrB,CAAC;CACH,SAAS,OAAO;EACd,IAAI,EAAE,oBAAoB,KAAK,KAAK,KAAK,IAAI,IAAI,WAC/C,MAAM;EAER,MAAMA,aAAM,gCAAgC;CAC9C;AAEJ;;;AC1CA,MAAM,sBAA4C;AAClD,MAAM,mBAAyC;;;;;;AAO/C,SAAgB,8BAAoD;CAKlE,OAEI;AACN;AAEA,SAAgB,uBAAgC;CAC9C,OAAO,4BAA4B,MAAM;AAC3C;;;AC9BA,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AACtC,MAAM,oBAAoB;AAC1B,MAAa,oCAAoC;AAoCjD,IAAI,cAAyC;AAC7C,IAAI,4BAA0C;AAC9C,IAAI,kBAAkB;AACtB,IAAI,0BAAyC;AAC7C,MAAa,iCAAiC;AAE9C,eAAsB,8BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;GACf,aAAa,MAAM;EACrB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;AAC7D;AAEA,eAAsB,6BACpB,OACwB;CACxB,IAAI,qBAAqB,GACvB,OAAO,MAAM,qCAAqC;EAChD,WAAW;EACX,SAAS,MAAM;EACf,SAAS,MAAM;CACjB,CAAC;CAGH,QAAO,MADa,UAAU,EAAA,CACjB,KAAK,MAAM,SAAS,MAAM,OAAO;AAChD;AAEA,eAAsB,+BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;EACjB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,OAAO,MAAM,SAAS,MAAM,OAAO;AAC3C;AAUA,eAAsB,qCACpB,OACA,UAAkC,CAAC,GACC;CACpC,MAAM,UAAU,iCAAiC,MAAM;EACrD,eAAA;EACA,2BAA2B;EAC3B,GAAG;CACL,CAAC;CACD,MAAM,YAAY,QAAQ,aAAA;CAC1B,IAAI,EAAE,OAAO,cAAc,SAAS,KAAK,YAAY,IACnD,MAAM,IAAI,MAAM,0DAA0D;CAG5E,OAAO,MAAM,IAAI,SAAoC,SAAS,WAAW;EACvE,MAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,0BAA0B,GAAG;GAClE,KAAK,QAAQ;GACb,OAAO;GACP,OAAO;IAAC;IAAQ;IAAQ;GAAM;GAC9B,aAAa;EACf,CAAC;EACD,IAAI,UAAU;EACd,IAAI,SAAS;EACb,IAAI,SAAS;EAEb,MAAM,sBAAsB;GAC1B,aAAa,QAAQ;EACvB;EACA,MAAM,cAAc,UAAiB;GACnC,IAAI,SACF;GAEF,UAAU;GACV,cAAc;GACd,OAAO,KAAK;EACd;EACA,MAAM,WAAW,iBAAiB;GAChC,IAAI,SACF;GAEF,UAAU;GACV,MAAM,KAAK,SAAS;GACpB,OACE,IAAI,gCACF,yCAAyC,cAAc,SAAS,GAClE,CACF;EACF,GAAG,SAAS;EAEZ,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBAAyB;IAC/D,MAAM,KAAK,SAAS;IACpB,2BAAW,IAAI,MAAM,4CAA4C,CAAC;GACpE;EACF,CAAC;EACD,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBACtC,SAAS,OAAO,MAAM,OAAwB;EAElD,CAAC;EACD,MAAM,KAAK,UAAU,UAAU;GAC7B,2BACE,IAAI,MACF,0CAA0CC,iBAAe,KAAK,GAChE,CACF;EACF,CAAC;EACD,MAAM,MAAM,KAAK,UAAU,UAAU;GACnC,2BACE,IAAI,MACF,uCAAuCA,iBAAe,KAAK,GAC7D,CACF;EACF,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SACF;GAEF,cAAc;GACd,UAAU;GACV,IAAI;IACF,QACE,+BAA+B;KAC7B;KACA,WAAW,QAAQ;KACnB;KACA;IACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,OAAO,QAAQ,KAAK,CAAC;GACvB;EACF,CAAC;EAED,MAAM,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG,MAAM;CACjD,CAAC;AACH;AAEA,eAAsB,wCACpB,OAA0B,QAAQ,MAChB;CAClB,IAAI,CAAC,KAAK,SAAS,0BAA0B,GAC3C,OAAO;CAET,IAAI,EAAE,qBAAqB,KAAK,QAAQ,aAAa,WACnD,MAAM,IAAI,MACR,0EACF;CAIF,IAAI,EAAC,MADe,UAAU,EAAA,CACnB,uBAAuB,GAChC,MAAM,IAAI,MACR,8EACF;CAGF,MAAM,aAAa,MAAM,gBAAgB;CACzC,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,UAAU;CAC9B,QAAQ;EACN,MAAM,IAAI,MAAM,uCAAuC;CACzD;CACA,MAAM,UAAU,iCAAiC,UAAU,IAAI;CAC/D,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,WAAW,MAAM,qBAAqB,QAAQ,IAAI,CAAC,CAAC,OAAO,WAAW;EAC1E,eAAA;EACA,IAAI;EACJ,WAAW,QAAQ,KAAK;EACxB,cAAc,qBAAqBA,iBAAe,KAAK,CAAC;CAC1D,EAAE;CACF,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,CAAC;CAC7C,OAAO;AACT;AAQA,eAAe,qCACb,OACoC;CACpC,IAAI,6BAA6B,KAAK,IAAI,IAAI,iBAC5C,MAAM;CAER,IAAI;EACF,IAAI,MAAM,cAAc,QAAQ;GAC9B,MAAM,SAAS,MAAM,qCAAqC,KAAK;GAC/D,qBAAqB;GACrB,OAAO;EACT;EACA,MAAM,qCAAqC,KAAK;EAChD,qBAAqB;CACvB,SAAS,OAAO;EACd,MAAM,WAAW,iBAAiB;EAClC,IAAI,iBAAiB,iCAAiC;GACpD,4BAA4B;GAC5B,kBAAkB,KAAK,IAAI,IAAI;EACjC;EACA,MAAM,WAAW,kBAAkB,KAAKA,iBAAe,KAAK,CAAC,CAAC,GAAG;EACjE,IAAI,aAAa,WAAW,sBAAsB;EAClD,IAAI,UACF,aAAa;EAEf,MAAM,cAAc,GAAG,WAAW,GAAG,YAAY;EACjD,IAAI,4BAA4B,aAAa;GAC3C,0BAA0B;GAC1B,QAAQ,KACN,KAAK,UAAU;IACb,OAAO;IACP,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;IACnC;IACA,GAAI,WAAW,EAAE,UAAU,OAAO,QAAQ,EAAE,IAAI,CAAC;IACjD,WAAW,MAAM;IACjB,WAAW;IACX,GAAI,WAAW,EAAE,cAAc,+BAA+B,IAAI,CAAC;GACrE,CAAC,CACH;EACF;EACA,MAAM;CACR;AACF;AAEA,SAAS,uBAA6B;CACpC,IAAI,yBACF,QAAQ,KACN,KAAK,UAAU;EACb,OAAO;EACP,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;CACrC,CAAC,CACH;CAEF,4BAA4B;CAC5B,kBAAkB;CAClB,0BAA0B;AAC5B;AAEA,SAAS,+BAA+B,OAKV;CAC5B,IAAI,MAAM,SAAS,GACjB,MAAM,IAAI,MACR,0CAA0C,MAAM,QAAQ,YACtD,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,IAEvD;CAGF,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,MAAM,MAAM;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,MAAM,SAAS,kCAAkC,UAAU,WAAW;CACtE,IAAI,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,MAAM,YACtD,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,CAAC,OAAO,KAAK,IACf,MAAM,IAAI,MAAM,OAAO,KAAK,YAAY;CAE1C,OAAO,OAAO,KAAK,cAAc,SAAS,OAAO,KAAK,cAAc,KAAA;AACtE;AAEA,eAAe,qBAAqB,OAAmC;CACrE,MAAM,QAAQ,MAAM,UAAU;CAC9B,IAAI,MAAM,cAAc,SAAS;EAC/B,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;EAC3D,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,IAAI,MAAM,cAAc,UAAU;EAChC,MAAM,OAAO,MAAM,SAAS,MAAM,OAAO;EACzC,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,OAAO;EACL,eAAA;EACA,IAAI;EACJ,WAAW;EACX,aAAa,MAAM,KAAK,MAAM,SAAS,MAAM,OAAO;CACtD;AACF;AAEA,eAAe,kBAAmC;CAChD,IAAI,MAAM;CACV,QAAQ,MAAM,YAAY,MAAM;CAChC,WAAW,MAAM,SAAS,QAAQ,OAAO;EACvC,OAAO,OAAO,KAAK;EACnB,IAAI,OAAO,WAAW,KAAK,MAAM,IAAI,yBACnC,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,SAAyB;CAErD,QADmB,QAAQ,KAAK,KAAK,kCAAA,CACnB,MAAM,GAAG,IAAI;AACjC;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,YAAY,QAAS,IACxB,GAAG,YAAY,IAAK,YACpB,GAAG,UAAU;AACnB;AAEA,SAASA,iBAAe,OAAwB;CAC9C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,OAAyB;AAC3B;AAEA,eAAe,YAAyC;CACtD,IAAI,aACF,OAAO;CAET,IAAI,QAAQ,aAAa,UACvB,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,qBAAqB,GAAG;EAE1B,eAAc,MADS,OAAO,2CAAA,CACP,+BAA+B;EACtD,OAAO;CACT;CAMA,cAJgB,cAAc,OAAO,KAAK,GAItB,CAAC,CAHH,cAChB,IAAI,IAAI,mCAAmC,OAAO,KAAK,GAAG,CAE9B,CAAC;CAC/B,OAAO;AACT;;;ACjaA,MAAM,+BAA+B;AACrC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,qDACJ;AAGF,MAAM,2BAA2B,OAAO;AACxC,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,yBAAyB;CAC7B,aAAa;CACb,WAAW;CACX,SAAS;AACX;AACA,IAAI,+BAA+B;AACnC,IAAI,kCAAkC;AA2CtC,eAAsB,iBACpB,OACyB;CACzB,MAAM,MAAM,cAAc;EACxB,aAAa,MAAM;EACnB,UAAU,MAAM;CAClB,CAAC;CACD,MAAM,aAAa,MAAM,SAAS,wBAAwB,GAAG,IAAI;CAEjE,IAAI,yBAAyB,GAAG;EAC9B,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV,KAAK;EACP;CACF;CAEA,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,UAAU,wBAAwB,GAAG;EAC3C,IAAI,6BAA6B,GAC/B,MAAM,8BAA8B;GAClC;GACA,SAAS;GACT,aAAa,MAAM;EACrB,CAAC;OAED,MAAM,IAAI,MAAM,kDAAkD;EAEpE,OAAO;GACL,UAAU;GACV,SAAS;GACT;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB,KAAK;IACL,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV,KAAK;GACP;EACF;EACA,MAAM,aAAa,wBAAwB,GAAG;EAC9C,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,gCAAgC,KAAK;EACrC,OAAO;GAAE,UAAU;GAAiB,KAAK;EAAW;CACtD;CAGF,IAAI,QAAQ,aAAa,SACvB,IAAI;EACF,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV,KAAK;EACP;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB,KAAK;IACL,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV,KAAK;GACP;EACF;EACA,MAAM,IAAI,MACR,mDAAmDC,iBAAe,KAAK,GACzE;CACF;CAGF,IAAI,sBAAsB,GAAG;EAC3B,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV,KAAK;EACP;CACF;CAEA,MAAM,IAAI,MACR,oDAAoD,QAAQ,SAAS,SAC5D,0BAA0B,oCACrC;AACF;AAEA,eAAsB,gBACpB,KACgC;CAChC,IAAI;EACF,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;GAGpE,OAAO,wBAAwB,MADX,6BAA6B,GAAG,CAChB;EACtC;EACA,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,OAAO,EAAE,QAAQ,UAAU;CAC7B,SAAS,OAAO;EACd,OAAO;GACL,cAAcA,iBAAe,KAAK;GAClC,QAAQ;EACV;CACF;AACF;AAEA,eAAsB,kBAAkB,KAAoC;CAC1E,IAAI,IAAI,aAAa,kBAAkB;EACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,+BAA+B,GAAG;EACxC;CACF;CACA,IAAI,IAAI,aAAa,iBAAiB;EACpC,MAAM,wBAAwB,GAAG;EACjC;CACF;CACA,IAAI,IAAI,aAAa,iBACnB,MAAM,wBAAwB,GAAG;AAErC;AAEA,SAAgB,iBAAiB,OAAyC;CACxE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO;CAET,MAAM,SAAS;CACf,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,aAAa,kBACf,OAAO,QACL,gBAAgB,OAAO,OAAO,KAC5B,gBAAgB,OAAO,OAAO,KAC9B,OAAO,gBAAgB,KAAA,CAC3B;CAEF,IAAI,aAAa,mBAAmB,aAAa,iBAC/C,OAAO,sBAAsB,OAAO,GAAG,MAAM;CAE/C,OAAO;AACT;AAEA,SAAS,cAAc,OAGZ;CACT,MAAM,UAAU,QAAQ,gBAAgB,CAAC;CACzC,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,GAAG,MAAM,SAAS,IAAI,MAAM,YAAY,IAAI,SAAS,CAAC,CAC7D,OAAO,KAAK;AACjB;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,iBAAiB,IAAI,GAAG,WAAW;AAC5C;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,OAAO,KAAK;AAC5E;AAEA,SAAS,+BAAwC;CAC/C,OAAO,qBAAqB;AAC9B;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,YAAY,MAAM,oBACtB,8BACA,MAAM,aACN,MAAM,GACR;CACA,MAAM,MAAM,mBAAmB,GAAG,EAAE,WAAW,KAAK,CAAC;CAIrD,MAAM,UAAU,sBAAsB,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,EAAE,KAAK;EACzE,UAAU;EACV,MAAM;CACR,CAAC;AACH;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,YAAY,MAAM,SACtB,sBAAsB,MAAM,GAAG,GAC/B,MACF,CAAC,CAAC,OAAO,UAAU;EACjB,IAAIC,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CAAC;CACD,IAAI,CAAC,WACH,OAAO;CAET,OAAO,oBACL,8BACA,UAAU,KAAK,GACf,MAAM,GACR;AACF;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,sBAAsB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,4BAA4B;CAClC,MAAM,OAAO,kBAAkB,MAAM,GAAG;CACxC,MAAM,UAAU,MAAM,GAAG,MAAM,YAAY,KAAK;EAC9C,UAAU;EACV,MAAM;CACR,CAAC;CACD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,MAAM,GAAK;AAE3B;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,MAAM,MAAM,SAAS,kBAAkB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAC9D,UAAU;EACT,IAAIA,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,OAAO,MAAM,IAAI,KAAK,IAAI;AAC5B;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,kBAAkB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxD;AAEA,SAAS,qBAA6B;CACpC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,QAAQ;AACjD;AAEA,SAAS,sBAAsB,KAAqB;CAClD,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,kBAAkB,KAAqB;CAC9C,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,wBAAiC;CACxC,IAAI,QAAQ,IAAI,+BAA+B,KAAK;EAClD,qBAAqB,KAAK;EAC1B,OAAO;CACT;CAIA,MAAM,kBAAkB,CAAC,4BAA4B;CACrD,IAAI,iBACF,qBAAqB,UAAU;CAEjC,OAAO;AACT;AAEA,SAAS,gCAAgC,OAAsB;CAC7D,IAAI,iCACF;CAEF,kCAAkC;CAClC,MAAM,qBAAqB,qBAAqB,IAC5C,oFACA;CACJ,QAAQ,KACN,8JAGK,mBAAmB,YAAYD,iBAAe,KAAK,GAC1D;AACF;AAEA,SAAS,qBAAqB,QAAkC;CAC9D,IAAI,8BACF;CAEF,+BAA+B;CAE/B,MAAM,aACJ,WAAW,QACP,cAAc,0BAA0B,MACxC,sCAAsC,QAAQ,SAAS;CAC7D,QAAQ,KACN,oEAAoE,WAAW,WACpE,0BAA0B,0FAEvC;AACF;AAEA,SAAS,2BAAoC;CAC3C,OAAO,QAAQ,IAAI,kCAAkC;AACvD;AAEA,SAAS,8BAAuC;CAC9C,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa;AAC/D;AAEA,eAAe,8BAA6C;CAC1D,MAAM,YAAY,mBAAmB;CACrC,MAAM,MAAM,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACvD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,WAAW,GAAK;AAEhC;AAEA,eAAe,oBACb,QACA,OACA,SACiB;CACjB,MAAM,UAAU,KAAK,UAAU;EAAE;EAAO;CAAQ,CAAC;CAajD,QAAO,MAZc,WACnB,kBACA;EACE;EACA;EACA;EACA;EACA;EACA;CACF,GACA,OACF,EAAA,CACc,OAAO,KAAK;AAC5B;AAEA,eAAe,WACb,SACA,MACA,cAC6C;CAC7C,IAAI;EACF,MAAM,EAAE,aAAa,MAAM,OAAO;EAwClC,OAAO,MAvCc,IAAI,SACtB,SAAS,WAAW;GACnB,IAAI,SAAS;GACb,IAAI,SAAS;GAEb,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAAC;GAEnE,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GACD,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GAED,MAAM,GAAG,UAAU,UAAU;IAC3B,OAAO,eAAe,OAAO,OAAO,CAAC;GACvC,CAAC;GAED,MAAM,GAAG,UAAU,SAAS;IAC1B,IAAI,SAAS,GAAG;KACd,QAAQ;MAAE;MAAQ;KAAO,CAAC;KAC1B;IACF;IACA,OACE,eACE,EACE,SAAS,mBAAmB,QAAQ,mBAAmB,OACzD,GACA,OACF,CACF;GACF,CAAC;GAED,MAAM,OAAO,MAAM,YAAY;GAC/B,MAAM,OAAO,IAAI;EACnB,CACF;CAEF,SAAS,OAAO;EACd,MAAM,eAAe,OAAO,OAAO;CACrC;AACF;AAEA,SAAS,eACP,OACA,SACoE;CACpE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,uBAAO,IAAI,MAAM,mBAAmB,QAAQ,KAAK,OAAO,KAAK,GAAG;CAElE,MAAM,IAAI;CAKV,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;CACnD,MAAM,eAAe,CAAC,mBAAmB,QAAQ,EAAE;CACnD,IAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,GAChD,aAAa,KAAK,WAAW,EAAE,OAAO,KAAK,GAAG;MACzC,IAAI,EAAE,SACX,aAAa,KAAK,EAAE,OAAO;CAE7B,MAAM,UAAU,IAAI,MAAM,aAAa,KAAK,IAAI,CAAC;CAKjD,QAAQ,OAAO;CACf,QAAQ,SAAS,EAAE;CACnB,QAAQ,SAAS,EAAE;CACnB,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;AAClC;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,gBAAgB,KAAK;CACxC,IAAI,CAAC,uBAAuB,KAAK,UAAU,GACzC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,yBAAyB,OAAwB;CACxD,MAAM,aAAa,sBAAsB,KAAK;CAC9C,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAS,eAAe,OAAqC;CAC3D,IAAI,UAAU,MACZ,OAAO;CAET,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA6C;CAC5E,MAAM,cAAc,eAAe,KAAK;CACxC,IAAI,CAAC,aACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO;EACL;EACA,QAAQ;CACV;AACF;AAEA,SAASA,iBAAe,OAAwB;CAC9C,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAEf,OAAO,OAAO,KAAK;AACrB;AAEA,SAASC,sBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;AAEV,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;;;AC1fV,MAAM,kCAAkC;AACxC,MAAM,2BAA2B;AAEjC,IAAM,0BAAN,cAAsC,MAAM;CAC1C;CAEA,YAAY,OAIT;EACD,MACE,MAAM,SACN,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,CAC/D;EACA,KAAK,OAAO;EACZ,KAAK,SAAS,MAAM;CACtB;AACF;AAEA,IAAa,qCAAb,cAAwD,MAAM;CAC5D,cAAc;EACZ,MACE,uJACF;EACA,KAAK,OAAO;CACd;AACF;AAEA,IAAa,0CAAb,cAA6D,MAAM;CACjE,SAAkB;CAElB,cAAc;EACZ,MACE,+MACF;EACA,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qCAAb,cAAwD,MAAM;CAC5D;CACA;CAKA,YAAY,OAGT;EACD,MAAM,WAAW;GACf,iBAAiB;GACjB,qBAAqB;GACrB,kBAAkB;EACpB,EAAE,MAAM;EACR,MAAM,UAAU,MAAM,wBAClB,uCACA;EACJ,MAAM,0CAA0C,SAAS,IAAI,SAAS;EACtE,KAAK,OAAO;EACZ,KAAK,SAAS,MAAM;EACpB,KAAK,wBAAwB,MAAM;CACrC;AACF;AAwJA,MAAM,sBAAsB;AAO5B,IAAI,oBAA8C;AAClD,MAAM,iDAAiC,IAAI,IAAY;AAEvD,eAAsB,oBACpB,UAAsC,CAAC,GACN;CACjC,OAAO,MAAM,6CAA6C,SAAS,KAAK;AAC1E;AAEA,eAAe,6CACb,SACA,2BACiC;CACjC,MAAM,aAAa,MAAM,yBAAyB;CAClD,MAAM,kBAAkB,mBAAmB,cAAc;CACzD,MAAM,uBACJ,QAAQ,mBAAmB,QAC1B,QAAQ,mBAAmB,QAAQ,WAAW,UAAU;CAC3D,QAAQ,WAAW,OAAnB;EACE,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK;GACH,IAAI,CAAC,sBACH,OAAO;GAET;EACF,KAAK,SACH;EACF,SACE,OAAO;CACX;CACA,IAAI,CAAC,sBACH,OAAO;CAET,IACE,CAAC,6BACA,MAAM,4CAA4C,GAEnD,OAAO,MAAM,oCACX,YACE,MAAM,6CAA6C,SAAS,IAAI,CACpE;CAGF,MAAM,mBAAmB,MAAM,0BAA0B,WAAW,OAAO;CAC3E,IAAI,iBAAiB,UAAU,SAC7B,OAAO,MAAM,oCAAoC;EAC/C;EACA;EACA;CACF,CAAC;CAEH,IAAI,iBAAiB,UAAU,WAAW;EACxC,IAAI,WAAW,UAAU,aAAa,QAAQ,mBAAmB,MAI/D,OAAO;GACL,OAAO;GACP,SAAS,WAAW;EACtB;EAEF,OAAO;CACT;CAEA,OAAO;EACL,YAAY,mCAAmC,iBAAiB,KAAK;EACrE,OAAO,iBAAiB;EACxB,SAAS;CACX;AACF;AAEA,eAAe,8CAAgE;CAC7E,MAAM,UAAU,MAAM,iCAAiC;CACvD,OAAO,QACL,SAAS,UAAU,aACjB,QAAQ,sCAAsC,KAC9C,wDAAwD,OAAO,CACnE;AACF;AAEA,eAAe,oCAAoC,OAIf;CAClC,IACE,CAAC,MAAM,iBAAiB,aACxB,UAAU,MAAM,iBAAiB,SAAS,GAE1C,OAAO,MAAM;CAGf,IAAI;CACJ,IAAI;EACF,mBAAmB,MAAM,4BAA4B;GACnD,aACE,MAAM,iBAAiB,eACvB,MAAM,WAAW,QAAQ;GAC3B,oBAAoB,MAAM;GAC1B,WAAW,MAAM,iBAAiB;GAClC,qBAAqB,MAAM,WAAW,QAAQ;EAChD,CAAC;CACH,SAAS,OAAO;EACd,IAAI,EAAE,iBAAiB,qCACrB,MAAM;EAOR,OAAO;GACL,OAAO;GACP,SAAS;IACP,GAAG,MAAM,WAAW;IACpB,aACE,MAAM,iBAAiB,eACvB,MAAM,WAAW,QAAQ;IAC3B,WAAW,MAAM,iBAAiB;GACpC;EACF;CACF;CAEA,IAAI,CAAC,kBACH,OAAO,MAAM,yBAAyB;CAExC,OAAO;EACL,OAAO;EACP,SAAS;CACX;AACF;AAKA,eAAsB,4BAAoD;CAIxE,MAAM,eAAc,MAHI,oBAAoB,EAC1C,gBAAgB,MAClB,CAAC,CAAC,CAAC,YAAY,IAAI,EAAA,EACY,SAAS,MAAM,IAAI,KAAK,KAAK;CAC5D,OAAO,YAAY,SAAS,IAAI,cAAc;AAChD;AAEA,eAAsB,eAAe,OAAwC;CAC3E,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAG7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAGzC,MAAM,sCAAsC,YAAY;EACtD,MAAM,gDAAgD;EACtD,MAAM,yBAAyB;EAG/B,MAAM,mBAAmB,mBAAkB,MADb,uBAAuB,EAAA,EACO,QAAQ;EACpE,MAAM,WAAW,MAAM,iBAAiB;GACtC;GACA;GACA;EACF,CAAC;EAED,MAAM,UAAyB;GAC7B,GAAG;GACH;GACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;GACzD;GACA;GACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;GAC5C,GAAG,qBAAqB,MAAM,IAAI;GAClC,GAAG,+BAA+B,MAAM,kBAAkB;EAC5D;EAEA,MAAM,OAAO,gBAAgB;EAC7B,MAAM,2BAA2B;EAEjC,IAAI;GACF,MAAM,+BAA+B;IAAE;IAAa;GAAS,CAAC;GAC9D,MAAM,8BAA8B,MAAM,OAAO;EACnD,SAAS,OAAO;GACd,MAAM,oCAAoC,QAAQ;GAClD,MAAM;EACR;EAEA,iBAAiB;GACf;GACA,SAAS,uBAAuB;IAAE;IAAa;GAAQ,CAAC;EAC1D,CAAC;EACD,IACE,oBACA,CAAC,wBAAwB,kBAAkB,QAAQ,GAEnD,MAAM,oCAAoC,gBAAgB;CAE9D,CAAC;AACH;AAEA,eAAsB,2BACpB,OACA,UAAwC,CAAC,GACT;CAChC,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAE5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAE7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAGzC,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,gDAAgD;EACtD,MAAM,yBAAyB;EAC/B,MAAM,2BAA2B;EACjC,MAAM,kBAAkB,MAAM,uBAAuB;EACrD,MAAM,gBAAgB,MAAM,yBAAyB,EAAE,SAAS,MAAM,CAAC;EACvE,MAAM,kBACJ,cAAc,UAAU,WAAW,cAAc,UAAU,YACvD,cAAc,UACd;EACN,8BAA8B;GAC5B,SAAS,yBAAyB,eAAe;GACjD,UAAU,QAAQ;EACpB,CAAC;EACD,MAAM,WAAW,MAAM,iBAAiB;GACtC;GACA;GACA;GACA,QAAQ;EACV,CAAC;EACD,MAAM,cAA6B;GACjC,GAAG;GACH;GACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;GACzD;GACA;GACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;GAC5C,GAAG,qBAAqB,MAAM,IAAI;GAClC,GAAG,+BAA+B,MAAM,kBAAkB;EAC5D;EACA,MAAM,UAA0C;GAC9C,GAAG;GACH,IAAI,WAAW;GACf,OAAO;GACP,UAAU,QAAQ;GAClB,uBAAuB;GACvB,iBACE,iBAAiB,MAAM,IAAK,kBAAoC;GAClE,kBAAkB;GAClB,mCAAmC;GACnC,oBAAoB,CAAC,QAAQ;GAC7B,GAAI,QAAQ,kBACR,EACE,iBAAiB,EACf,YAAY,QAAQ,gBAAgB,WACtC,EACF,IACA,CAAC;EACP;EACA,IAAI,iBAAiB;EACrB,IAAI;GACF,MAAM,+BAA+B;IAAE;IAAa;GAAS,CAAC;GAC9D,MAAM,kCAAkC,OAAO;GAC/C,iBAAiB;GACjB,+BAA+B,IAAI,QAAQ,EAAE;EAC/C,SAAS,OAAO;GACd,+BAA+B,OAAO,QAAQ,EAAE;GAChD,IAAI,gBAAgB;IAClB,MAAM,iCAAiC,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;IACrE,MAAM,0CAA0C,OAAO,CAAC,CAAC,YACjD,KAAA,CACR;GACF;GACA,MAAM,oCAAoC,QAAQ;GAClD,MAAM;EACR;EACA,iBAAiB;GACf,SAAS;GACT,SAAS,uBAAuB;IAAE;IAAa,SAAS;GAAY,CAAC;EACvE,CAAC;EAED,IAAI,aAAsD;EAC1D,MAAM,gCAAgC;GACpC,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;EAEhE;EACA,MAAM,4BACJ,mBACG;GACH,IAAI,CAAC,QAAQ,iBACX,OAAO,mBAAmB;GAE5B,OACE,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,QAAQ,eAAe;EAExD;EACA,MAAM,6BACJ,gBACA,mBAA2C,gBAE3C,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,gBAAgB;EAC/C,MAAM,+BAA+B,YAAY;GAC/C,MAAM,iBAAiB,MAAM,uBAAuB;GACpD,IAAI,CAAC,yBAAyB,cAAc,GAC1C,MAAM,IAAI,MACR,4DACF;EAEJ;EACA,MAAM,iCAAiC,OACrC,mBAA2C,gBACxC;GACH,MAAM,iBAAiB,MAAM,uBAAuB;GACpD,IACE,EACE,yBAAyB,cAAc,KACvC,0BAA0B,gBAAgB,gBAAgB,IAG5D,MAAM,IAAI,MACR,4DACF;EAEJ;EACA,MAAM,kCAAkC,YAAY;GAClD,MAAM,iBAAiB,MAAM,uBAAuB;GACpD,IACE,EACE,yBAAyB,cAAc,KACvC,0BAA0B,cAAc,IAE1C;IACA,IAAI;KACF,MAAM,qDAAqD;MACzD;MACA;KACF,CAAC;IACH,UAAU;KACR,+BAA+B,OAAO,QAAQ,EAAE;IAClD;IACA,MAAM,IAAI,mCAAmC;KAC3C,uBAAuB;KACvB,QAAQ;IACV,CAAC;GACH;GAEA,MAAM,kCAAkC,OAAO;GAC/C,IAAI;IACF,MAAM,iCAAiC,SAAS,eAAe;IAC/D,aAAa;IACb,MAAM,oCAAoC,QAAQ,CAAC,CAAC,OACjD,UAAmB;KAClB,wCAAwC;MACtC;MACA,cAAc,QAAQ;KACxB,CAAC;IACH,CACF;GACF,UAAU;IACR,+BAA+B,OAAO,QAAQ,EAAE;IAChD,MAAM,0CAA0C,OAAO;GACzD;EACF;EAEA,OAAO;GACL;GACA,QAAQ,YACN,MAAM,sCAAsC,YAAY;IACtD,wBAAwB;IACxB,MAAM,iBACJ,MAAM,sCAAsC,OAAO;IACrD,IAAI,eAAe,WAAW,WAAW;KACvC,MAAM,gCAAgC;KACtC,MAAM,IAAI,mCAAmC;MAC3C,uBAAuB;MACvB,QAAQ;KACV,CAAC;IACH;IACA,IAAI,eAAe,WAAW,WAAW;KACvC,+BAA+B,OAAO,QAAQ,EAAE;KAChD,MAAM,IAAI,mCAAmC;MAC3C,uBAAuB;MACvB,QAAQ,eAAe;KACzB,CAAC;IACH;IACA,MAAM,mBAAmB,eAAe,QAAQ;IAChD,MAAM,mBACJ,MAAM,iCAAiC,gBAAgB;IACzD,MAAM,6BAA6B;IACnC,MAAM,8BACJ,gBAAgB,GAChB,gBACF;IACA,iBAAiB;KACf,SAAS;KACT,SAAS;IACX,CAAC;IACD,MAAM,mBAAmD;KACvD,GAAG,eAAe;KAClB,OAAO;IACT;IACA,MAAM,yCACJ,eAAe,SACf,gBACF;IACA,aAAa;IACb,+BAA+B,OAAO,QAAQ,EAAE;IAChD,MAAM,uCAAuC,gBAAgB,CAAC,CAAC,OAC5D,UAAmB;KAClB,wCAAwC;MACtC;MACA,cAAc,QAAQ;KACxB,CAAC;IACH,CACF;GACF,CAAC;GACH,UAAU,YACR,MAAM,sCAAsC,YAAY;IACtD,IAAI,eAAe,eACjB;IAEF,wBAAwB;IACxB,MAAM,iBACJ,MAAM,sCAAsC,OAAO;IACrD,IAAI,eAAe,WAAW,WAAW;KACvC,MAAM,gCAAgC;KACtC;IACF;IACA,IAAI,eAAe,WAAW,WAAW;KACvC,+BAA+B,OAAO,QAAQ,EAAE;KAChD,MAAM,IAAI,mCAAmC;MAC3C,uBAAuB;MACvB,QAAQ,eAAe;KACzB,CAAC;IACH;IACA,MAAM,+BACJ,eAAe,QAAQ,gBACzB;IACA,MAAM,iCACJ,eAAe,SACf,eACF;IACA,aAAa;IACb,+BAA+B,OAAO,QAAQ,EAAE;IAChD,+BAA+B,eAAe,OAAO;IACrD,IAAI,eAAe,QAAQ,iBAAiB;KAC1C,MAAM,yCACJ,eAAe,SACf;MACE,GAAG,eAAe;MAClB,OAAO;KACT,CACF;KACA;IACF;IACA,MAAM,0BAA0B,eAAe,OAAO;IACtD,MAAM,0CACJ,eAAe,OACjB;GACF,CAAC;EACL;CACF,CAAC;AACH;AAQA,eAAe,sCACb,UAC4C;CAC5C,MAAM,iBAAiB,MAAM,iCAAiC;CAC9D,IAAI,CAAC,gBACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,IAAI,CAAC,qCAAqC,UAAU,cAAc,GAChE,OAAO;EAAE,QAAQ;EAAoB,SAAS;CAAe;CAE/D,IAAI,eAAe,UAAU,WAC3B,OAAO;EAAE,QAAQ;EAAuB,SAAS;CAAe;CAElE,OAAO;EAAE,QAAQ;EAAW,SAAS;CAAe;AACtD;AAEA,eAAsB,4CAAoG;CACxH,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,qDAAqD;EAC3D,MAAM,UAAU,MAAM,iCAAiC;EACvD,IAAI,EAAE,SAAS,UAAU,uBAAuB,QAAQ,kBACtD,OAAO;EAKT,IAAI,QAAQ,gBAAgB,wBAAwB;GAClD,IAAI,QAAQ,gBAAgB,qBAAqB;IAC/C,MAAM,0BAA0B,OAAO;IACvC,MAAM,0CAA0C,OAAO;IACvD,OAAO;GACT;GACA,OAAO;IACL,kBAAkB;IAClB,YAAY,QAAQ,gBAAgB;IACpC,IAAI,QAAQ;IACZ,iBAAiB,MAAM,+BACrB,QAAQ,eACV;IACA,sBAAsB;IACtB,mBAAmB,QAAQ,QAAQ,gBAAgB,mBAAmB;GACxE;EACF;EAEA,MAAM,mBAAmB,MAAM,0CAC7B,QAAQ,gBACV;EACA,IAAI,CAAC,kBACH,MAAM,IAAI,wBAAwB;GAChC,SAAS;GACT,QAAQ;EACV,CAAC;EAEH,MAAM,uBAAuB,wBAC3B,iBAAiB,MAAM,EACzB;EACA,IAAI,CAAC,sBACH,MAAM,IAAI,wBAAwB;GAChC,SACE;GACF,QAAQ;EACV,CAAC;EAGH,OAAO;GACL,kBAAkB;IAChB,GAAG;IACH,MAAM;KAAE,GAAG,iBAAiB;KAAM,IAAI;IAAqB;GAC7D;GACA,YAAY,QAAQ,gBAAgB;GACpC,IAAI,QAAQ;GACZ,iBAAiB,MAAM,+BACrB,QAAQ,eACV;GACA,sBAAsB;GACtB,mBAAmB,QAAQ,QAAQ,gBAAgB,mBAAmB;EACxE;CACF,CAAC;AACH;AAEA,eAAsB,2CAA2C,OAG/C;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,wCAAwC,MAAM,EAAE;EACtE,MAAM,yCAAyC,SAAS;GACtD,GAAG;GACH,iBAAiB;IACf,GAAG,QAAQ;IACX,GAAI,MAAM,UAAU,YAChB,EAAE,sCAAqB,IAAI,KAAK,EAAA,CAAE,YAAY,EAAE,IAChD,EAAE,yCAAwB,IAAI,KAAK,EAAA,CAAE,YAAY,EAAE;IACvD,qBAAqB,KAAA;GACvB;EACF,CAAC;CACH,CAAC;AACH;AAEA,eAAsB,oDAAoD,OAMxD;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,iEACJ,KACF;CACF,CAAC;AACH;AAEA,eAAe,iEAAiE,OAM9D;CAChB,MAAM,UAAU,MAAM,wCAAwC,MAAM,EAAE;CACtE,MAAM,yCAAyC,SAAS;EACtD,GAAG;EACH,iBAAiB;GACf,GAAG,QAAQ;GACX,qBAAqB;IACnB,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;IAC3B,SAAS,MAAM;IACf,OAAO,MAAM;IACb,GAAI,MAAM,WAAW,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;IACrD,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;GAC/D;EACF;CACF,CAAC;AACH;AAEA,eAAsB,+CACpB,IACkB;CAClB,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,UAAU,MAAM,wCAAwC,EAAE;EAChE,IACE,EACE,QAAQ,gBAAgB,uBACxB,QAAQ,gBAAgB,yBAG1B,MAAM,IAAI,MACR,kFACF;EAEF,IAAI;GACF,MAAM,0BAA0B,OAAO;GACvC,MAAM,0CAA0C,OAAO;GACvD,OAAO;EACT,SAAS,OAAO;GACd,MAAM,iEAAiE;IACrE;IACA,SAAS,eAAe,KAAK;IAC7B,OAAO;GACT,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;GACxB,wCAAwC;IAAE;IAAO,cAAc;GAAG,CAAC;GACnE,OAAO;EACT;CACF,CAAC;AACH;AAUA,eAAsB,yBAA8D;CAElF,OAAO,yBAAyB,MADV,mBAAmB,CACF;AACzC;AAEA,SAAS,yBACP,SAC4B;CAC5B,IAAI,SAAS,MAAM,GACjB,OAAO;CAGT,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,eAAe,YAAY,YAC/B,OAAO;CAGT,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,QAAQ,kBAAkB;CAC9D;AACF;AAEA,eAAsB,oCACpB,oBACe;CACf,MAAM,sCAAsC,YAAY;EACtD,MAAM,gDAAgD;EACtD,MAAM,UAAU,MAAM,uBAAuB;EAC7C,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,MAAM,wDAAwD;EAG1E,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;EACnD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;EAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;EAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;EACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;EAC3D,IAAI,EAAE,YAAY,aAAa,eAAe,YAAY,YACxD,MAAM,IAAI,MACR,4DACF;EAGF,MAAM,cAA6B;GACjC,GAAG;GACH;GACA;GACA;GACA;GACA;GACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;GACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;GACL,GAAG,qBAAqB,QAAQ,IAAI;GACpC,GAAG,+BAA+B,kBAAkB;EACtD;EAEA,MAAM,8BAA8B,gBAAgB,GAAG,WAAW;EAClE,MAAM,uBAAuB,sBAAsB,OAAO;EAC1D,IAAI,sBACF,iBAAiB;GACf,SAAS;GACT,SAAS,uBAAuB;IAC9B,aAAa,qBAAqB;IAClC,SAAS;GACX,CAAC;EACH,CAAC;CAEL,CAAC;AACH;AAEA,eAAsB,mBAAoD;CACxE,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,gDAAgD;EACtD,oBAAoB;EACpB,MAAM,yBAAyB;EAC/B,MAAM,kBAAkB,MAAM,sBAAsB;EACpD,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,uBAAuB;EACzC,SAAS,OAAO;GACd,IACE,EACE,iBAAiB,2BAA2B,MAAM,WAAW,YAG/D,MAAM;GAIR,MAAM,uBAAuB,KAC3B,gBAAgB,GAChB,QACA,mBAAmB,WAAW,EAAE,MAClC;GACA,MAAM,OAAO,gBAAgB,GAAG,oBAAoB;GACpD,OAAO;IAAE;IAAiB;GAAqB;EACjD;EACA,IAAI,SAAS,MAAM,KAAK,iBAAiB,QAAQ,QAAQ,GACvD,MAAM,oCAAoC,QAAQ,QAAQ;EAE5D,MAAM,kBAAkB;EACxB,OAAO,EAAE,gBAAgB;CAC3B,CAAC;AACH;AAEA,eAAsB,qCAAoD;CACxE,MAAM,sCACJ,+CACF;AACF;AAEA,eAAe,kDAAiE;CAC9E,MAAM,qDAAqD;CAC3D,IAAI,MAAM,iCAAiC,GACzC,MAAM,IAAI,mCAAmC;AAEjD;AAEA,eAAe,2BAA0C;CACvD,MAAM,UAAU,MAAM,wBAAwB;CAC9C,IAAI,QAAQ,UAAU,WAAW,GAC/B;CAGF,MAAM,YAA8B,CAAC;CACrC,KAAK,MAAM,YAAY,QAAQ,WAC7B,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,UAAU,KAAK,QAAQ;CACzB;CAEF,MAAM,2BAA2B,SAAS;AAC5C;AAEA,eAAe,oCACb,UACe;CACf,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,MAAM,UAAU,MAAM,wBAAwB;EAC9C,IACE,QAAQ,UAAU,MAAM,QAAQ,wBAAwB,KAAK,QAAQ,CAAC,GAEtE;EAEF,MAAM,2BAA2B,CAAC,GAAG,QAAQ,WAAW,QAAQ,CAAC;CACnE;AACF;AAEA,eAAe,0BAA0D;CACvE,MAAM,MAAM,MAAM,SAAS,wBAAwB,GAAG,MAAM,CAAC,CAAC,OAC3D,UAAU;EACT,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,IAAI,QAAQ,MACV,OAAO;EAAE,GAAG;EAAG,WAAW,CAAC;CAAE;CAG/B,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C;CACjE;CACA,IACE,EAAE,SAAS,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,SAAS,IAEtE,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,YAAY,OAAO,UAAU,OAAO,gBAAgB;CAC1D,IAAI,UAAU,WAAW,OAAO,UAAU,QACxC,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO;EAAE,GAAG;EAAG;CAAU;AAC3B;AAEA,eAAe,2BACb,WACe;CACf,MAAM,OAAO,wBAAwB;CACrC,IAAI,UAAU,WAAW,GAAG;EAC1B,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;EAC9B;CACF;CACA,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAChE,MAAM,oBAAoB,MAAM;EAAE,GAAG;EAAG;CAAU,CAAC;AACrD;AAEA,SAAS,0BAAkC;CACzC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,4BAA4B;AACrE;AAEA,eAAe,wBAA0C;CACvD,IAAI;EACF,MAAM,SAAS,gBAAgB,GAAG,MAAM;EACxC,OAAO;CACT,SAAS,OAAO;EACd,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR;AACF;AAEA,eAAe,yBACb,UAAiC,CAAC,GACF;CAChC,IAAI;CACJ,IAAI;EACF,UACE,QAAQ,YAAY,QAChB,MAAM,uBAAuB,IAC7B,MAAM,mBAAmB;CACjC,SAAS,OAAO;EACd,IAAI,iBAAiB,yBACnB,OAAO;GACL,cAAc,MAAM;GACpB,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,MAAM;CACR;CACA,IAAI,SAAS,MAAM,GACjB,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,IAAI,CAAC,UACH,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,aAAa,eAAe,YAAY,YAC5C,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,IAAI,UAAU,sBAAsB,OAAO;CAC3C,IAAI,CAAC,SAAS;EACZ,MAAM,cAAc,MAAM,gBAAgB,QAAQ;EAClD,IAAI,YAAY,WAAW,WACzB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,IAAI,YAAY,WAAW,eACzB,OAAO;GACL,cAAc,YAAY;GAC1B,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,UAAU,uBAAuB;GAC/B,aAAa,YAAY;GACzB,SAAS;IACP,GAAG;IACH,GAAG;IACH;IACA;IACA;IACA;IACA;GACF;EACF,CAAC;EACD,iBAAiB;GAAE;GAAS;EAAQ,CAAC;CACvC;CAEA,MAAM,oBAAoB,oCACxB,QAAQ,SACV;CACA,IAAI,kBAAkB,WAAW,WAC/B,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAEF,IAAI,kBAAkB,WAAW,WAC/B,OAAO;EACL,YAAY;EACZ,OAAO;EACP;CACF;CAGF,OAAO;EACL,OAAO;EACP;CACF;AACF;AAEA,eAAe,+BAA+B,OAG5B;CAChB,MAAM,WAAW,MAAM,gBAAgB,MAAM,QAAQ;CACrD,IACE,SAAS,WAAW,WACpB,SAAS,gBAAgB,MAAM,aAE/B;CAEF,IAAI,SAAS,WAAW,eACtB,MAAM,IAAI,MACR,8CAA8C,SAAS,cACzD;CAEF,MAAM,IAAI,MAAM,2CAA2C;AAC7D;AAEA,SAAS,uBAAuB,OAGV;CACpB,OAAO;EACL,GAAG;EACH,aAAa,MAAM;EACnB,WAAW,MAAM,QAAQ;EACzB,aAAa,MAAM,QAAQ;EAC3B,UAAU,MAAM,QAAQ;EACxB,WAAW,MAAM,QAAQ;EACzB,GAAI,OAAO,MAAM,QAAQ,cAAc,YACvC,MAAM,QAAQ,UAAU,KAAK,IACzB,EAAE,WAAW,MAAM,QAAQ,UAAU,KAAK,EAAE,IAC5C,CAAC;EACL,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;AACF;AAEA,SAAS,8BAA8B,OAG9B;CACP,IAAI,MAAM,aAAa,KAAA,GACrB;CAEF,IACE,+BAA+B,MAAM,OAAO,MAC5C,+BAA+B,MAAM,QAAQ,GAE7C,MAAM,IAAI,wCAAwC;AAEtD;AAEA,SAAS,+BACP,SACQ;CACR,IAAI,CAAC,SACH,OAAO;CAMT,MAAM,iBAAiB,KAAK,UAAU;EACpC,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ,MAAM,MAAM;CACtB,CAAC;CACD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,OAAO,WAAW;AACvE;AAEA,eAAe,qDAAqD,OAGlD;CAChB,MAAM,kBAAkB,kBAAkB,MAAM,gBAAgB,QAAQ;CACxE,MAAM,mBAAmB,kBACvB,MAAM,QAAQ,iBAAiB,QACjC;CACA,MAAM,sBAAsB,CAC1B,GAAI,mBAAmB,CAAC,gBAAgB,IAAI,CAAC,GAC7C,GAAG,sBAAsB,MAAM,OAAO,CACxC;CAEA,KAAK,MAAM,CAAC,OAAO,aAAa,oBAAoB,QAAQ,GAAG;EAI7D,IAHuB,oBACpB,MAAM,GAAG,KAAK,CAAC,CACf,MAAM,gBAAgB,wBAAwB,aAAa,QAAQ,CAEvD,KACZ,mBAAmB,wBAAwB,iBAAiB,QAAQ,GAErE;EAEF,MAAM,oCAAoC,QAAQ;CACpD;AACF;AAEA,SAAS,iBAAiB,OAGjB;CACP,oBAAoB;EAClB,YAAY,2BAA2B,MAAM,OAAO;EACpD,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,sBACP,SAC0B;CAC1B,MAAM,aAAa,2BAA2B,OAAO;CACrD,OAAO,mBAAmB,eAAe,aACrC,kBAAkB,UAClB;AACN;AAEA,SAAS,2BAA2B,SAAyC;CAC3E,OAAO,GAAG,gBAAgB,EAAE,IAAI,KAAK,UAAU,OAAO;AACxD;AAEA,SAAS,wBACP,MACA,OACS;CACT,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,mBAAmB,WAA+C;CACzE,MAAM,kBAAoC,CAAC;CAC3C,KAAK,MAAM,YAAY,WACrB,IACE,CAAC,gBAAgB,MAAM,aACrB,wBAAwB,UAAU,QAAQ,CAC5C,GAEA,gBAAgB,KAAK,QAAQ;CAGjC,OAAO;AACT;AAEA,SAAS,sBACP,SACkB;CAClB,OAAO,mBAAmB,CACxB,GAAI,QAAQ,sBAAsB,CAAC,GACnC,QAAQ,iBAAiB,QAC3B,CAAC;AACH;AAEA,eAAe,0BACb,SACA,cACe;CACf,KAAK,MAAM,YAAY,sBAAsB,OAAO,GAAG;EACrD,IAAI,gBAAgB,wBAAwB,cAAc,QAAQ,GAChE;EAEF,MAAM,oCAAoC,QAAQ;CACpD;AACF;AAEA,eAAe,4BAA4B,OAKL;CACpC,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,qDAAqD;EAC3D,MAAM,oBAAoB,MAAM,iCAAiC;EACjE,IAAI,mBAAmB;GACrB,IACE,kBAAkB,UAAU,aAC5B,kBAAkB,sCAAsC,KACxD,wDACE,iBACF,KACA,MAAM,uBAAuB,QAC7B,2BAA2B,kBAAkB,gBAAgB,MAC3D,MAAM,oBAER,OAAO,MAAM,4CAA4C;IACvD,GAAG;IACH,SAAS;GACX,CAAC;GAEH,MAAM,IAAI,mCAAmC;EAC/C;EACA,OAAO,MAAM,qCAAqC,KAAK;CACzD,CAAC;AACH;AAEA,eAAe,qCAAqC,OAKd;CACpC,MAAM,UAAU,MAAM,uBAAuB;CAC7C,IACE,SAAS,MAAM,KACf,MAAM,uBAAuB,QAC7B,2BAA2B,OAAO,MAAM,MAAM,oBAE9C,OAAO;CAET,MAAM,UAAU,MAAM,4BAA4B;EAChD,GAAG;EACH;EACA,gBAAgB;CAClB,CAAC;CACD,IAAI,CAAC,SACH,OAAO;CAGT,IAAI;EACF,MAAM,+BAA+B;GACnC,aAAa,QAAQ,YAAY;GACjC,UAAU,QAAQ;EACpB,CAAC;EACD,MAAM,8BAA8B,gBAAgB,GAAG,QAAQ,WAAW;CAC5E,SAAS,OAAO;EACd,MAAM,kCAAkC,OAAO;EAC/C,MAAM;CACR;CAEA,iBAAiB;EACf,SAAS,QAAQ;EACjB,SAAS,QAAQ;CACnB,CAAC;CACD,IAAI,CAAC,wBAAwB,QAAQ,iBAAiB,QAAQ,YAAY,GACxE,MAAM,oCAAoC,QAAQ,eAAe;CAEnE,OAAO,QAAQ;AACjB;AAEA,eAAe,4CAA4C,OAKrB;CACpC,MAAM,UAAU,MAAM,4BAA4B;EAChD,GAAG;EACH,SAAS,MAAM,QAAQ;EACvB,gBAAgB;CAClB,CAAC;CACD,IAAI,CAAC,SACH,OAAO;CAET,MAAM,qBAAqB,mBAAmB,CAC5C,GAAG,sBAAsB,MAAM,OAAO,GACtC,QAAQ,YACV,CAAC;CACD,IAAI,mBAAmB,SAAS,0BAA0B;EACxD,MAAM,kCAAkC,OAAO;EAC/C,MAAM,IAAI,wBAAwB;GAChC,SAAS,yCAAyC,OAAO,wBAAwB,EAAE;GACnF,QAAQ;EACV,CAAC;CACH;CACA,MAAM,cAA8C;EAClD,GAAG,MAAM;EACT,kBAAkB,QAAQ;EAC1B;CACF;CAEA,IAAI;EACF,MAAM,+BAA+B;GACnC,aAAa,QAAQ,YAAY;GACjC,UAAU,QAAQ;EACpB,CAAC;EACD,MAAM,yCAAyC,MAAM,SAAS,WAAW;CAC3E,SAAS,OAAO;EACd,MAAM,kCAAkC,OAAO;EAC/C,MAAM;CACR;CAEA,iBAAiB;EACf,SAAS,QAAQ;EACjB,SAAS,QAAQ;CACnB,CAAC;CACD,OAAO,QAAQ;AACjB;AASA,eAAe,4BAA4B,OAMM;CAC/C,MAAM,kBAAkB,kBAAkB,MAAM,QAAQ,QAAQ;CAChE,MAAM,YAAY,wBAAwB,MAAM,QAAQ,SAAS;CACjE,MAAM,cAAc,wBAAwB,MAAM,QAAQ,WAAW;CACrE,MAAM,WAAW,wBAAwB,MAAM,QAAQ,QAAQ;CAC/D,MAAM,YAAY,wBAAwB,MAAM,QAAQ,SAAS;CACjE,MAAM,kBAAkB,wBAAwB,MAAM,WAAW;CACjE,IACE,EACE,mBACA,aACA,eACA,YACA,aACA,kBAGF,OAAO;CAGT,MAAM,eACJ,oBAAoB,MAAM,sBACtB,kBACA,MAAM,iBAAiB;EACrB,aAAa;EACb;EACA;EACA,QAAQ,MAAM;CAChB,CAAC;CACP,MAAM,cAA6B;EACjC,GAAG;EACH,UAAU;EACV;EACA;EACA;EACA;EACA,WAAW,MAAM;EACjB,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;CACA,OAAO;EACL;EACA;EACA,aAAa,uBAAuB;GAClC,aAAa;GACb,SAAS;EACX,CAAC;EACD;CACF;AACF;AAEA,eAAe,kCACb,SACe;CACf,IAAI,CAAC,wBAAwB,QAAQ,iBAAiB,QAAQ,YAAY,GACxE,MAAM,oCAAoC,QAAQ,YAAY;AAElE;AAEA,SAAS,kBAAkB,OAAuC;CAChE,IAAI,CAAC,iBAAiB,KAAK,GACzB,OAAO;CAET,OAAO;AACT;AAEA,eAAe,0BACb,SACsC;CACtC,IAAI,WAAW;CACf,IAAI;EACF,WAAW,eAAe,QAAQ,aAAa,uBAAuB;CACxE,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;CACA,IAAI;EACF,MAAM,YAAY,8BAA8B,QAAQ;EACxD,MAAM,WAAW,MAAM,MAAM,UAAU;GACrC,QAAQ;GACR,SAAS,EACP,eAAe,GAAG,mBAAmB,QAAQ,SAAS,EAAE,GAAG,QAAQ,cACrE;GACA,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,EAAE,OAAO,UAAU;EAE5B,IAAI,CAAC,SAAS,IAGZ,OAAO,EAAE,OAAO,UAAU;EAG5B,MAAM,UAAU,MAAM,kBAAkB,QAAQ;EAChD,IAAI,CAAC,wBAAwB,OAAO,GAClC,OAAO,EAAE,OAAO,UAAU;EAE5B,OAAO;GACL,OAAO;GACP,GAAG,sBAAsB,QAAQ;GACjC,GAAG,4BAA4B,OAAO;EACxC;CACF,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;AACF;AAEA,SAAS,sBAAsB,UAE7B;CACA,MAAM,cAAc,wBAClB,SAAS,QAAQ,IAAI,gBAAgB,CACvC;CACA,OAAO,cAAc,EAAE,YAAY,IAAI,CAAC;AAC1C;AAEA,SAAS,4BAA4B,SAEnC;CACA,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO,CAAC;CAEV,MAAM,UAAU,QAAQ;CACxB,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO,CAAC;CAEV,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,CAAC,WACH,OAAO,CAAC;CAEV,MAAM,cAAc,KAAK,MAAM,SAAS;CACxC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO,CAAC;CAEV,OAAO,EAAE,WAAW,IAAI,KAAK,WAAW,CAAC,CAAC,YAAY,EAAE;AAC1D;AAEA,SAAS,8BAA8B,UAA0B;CAC/D,MAAM,MAAM,eAAe,QAAQ;CACnC,IAAI,OAAO,mBAAmB,IAAI,QAAQ,GACxC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,wBAAwB,SAA2B;CAC1D,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO;CAGT,OACE,SAAU,QAAoC,OAAO,KACrD,SAAU,QAAoC,IAAI;AAEtD;AAEA,SAAS,UAAU,WAAwC;CACzD,OAAO,oCAAoC,SAAS,CAAC,CAAC,WAAW;AACnE;AAEA,SAAS,mCACP,OAC4B;CAC5B,QAAQ,OAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SAEE,MAAM,IAAI,MACR,0CAA0CC,OAC5C;CAEJ;AACF;AAEA,eAAe,qBAA6D;CAC1E,MAAM,wCAAwC;CAC9C,MAAM,UAAU,MAAM,iCAAiC;CACvD,IAAI,SAAS,UAAU;MAEnB,wDAAwD,OACvC,GACjB,OAAO,QAAQ;CAAA;CAGnB,OAAO,MAAM,uBAAuB;AACtC;AAEA,SAAS,wDACP,SACS;CACT,IAAI,+BAA+B,IAAI,QAAQ,EAAE,GAC/C,OAAO;CAET,OAAO,uCAAuC,OAAO,CAAC,CAAC,MACpD,4BACC,sBAAsB,yBAAyB;EAC7C,UAAU,QAAQ;EAClB,uBAAuB;CACzB,CAAC,CACL;AACF;AAEA,eAAe,yBAAiE;CAC9E,MAAM,OAAO,gBAAgB;CAC7B,MAAM,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACjE,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM,IAAI,wBAAwB;GAChC,SAAS,sDAAsD,KAAK,IAAI,eAAe,KAAK;GAC5F,QAAQ;GACR,OAAO;EACT,CAAC;CACH,CAAC;CACD,IAAI,QAAQ,MACV,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,SAAS,OAAO;EACd,MAAM,IAAI,wBAAwB;GAChC,SAAS,+CAA+C;GACxD,QAAQ;GACR,OAAO;EACT,CAAC;CACH;AACF;AAEA,eAAe,0CAAyD;CAItE,IAAI,CAAE,MAAM,iCAAiC,GAC3C;CAEF,MAAM,sCACJ,oDACF;AACF;AAEA,eAAe,uDAAsE;CACnF,IAAI,UAAU,MAAM,iCAAiC;CACrD,IAAI,CAAC,SACH;CAEF,IAAI,+BAA+B,IAAI,QAAQ,EAAE,GAC/C;CAEF,IACE,QAAQ,UAAU,aAClB,uBAAuB;EACrB,UAAU,QAAQ;EAClB,uBAAuB,QAAQ;CACjC,CAAC,GACD;EACA,UAAU,MAAM,uCAAuC,OAAO;EAC9D;CACF;CAEA,IAAI,QAAQ,UAAU,WAAW;EAC/B,MAAM,iCAAiC,OAAO;EAC9C,+BAA+B,OAAO;EACtC,IAAI,QAAQ,iBAAiB;GAC3B,MAAM,yCAAyC,SAAS;IACtD,GAAG;IACH,OAAO;GACT,CAAC;GACD;EACF;EACA,MAAM,0BAA0B,OAAO;EACvC,MAAM,0CAA0C,OAAO;EACvD;CACF;CACA,IAAI,QAAQ,UAAU,qBAAqB;EACzC,+BAA+B,OAAO;EACtC;CACF;CAEA,IAAI,QAAQ,UAAU,aAAa;EACjC,MAAM,iBAAiB,MAAM,uBAAuB;EACpD,IACE,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,QAAQ,gBAAgB,GAErD,MAAM,IAAI,wBAAwB;GAChC,SACE;GACF,QAAQ;EACV,CAAC;EAEH,MAAM,uCAAuC,OAAO,CAAC,CAAC,OACnD,UAAmB;GAClB,wCAAwC;IACtC;IACA,cAAc,QAAQ;GACxB,CAAC;EACH,CACF;CACF;AACF;AAEA,eAAe,uCACb,SACe;CACf,MAAM,mBAAmB,kBAAkB,QAAQ,iBAAiB,QAAQ;CAC5E,IACE,oBACA,CAAC,wBACC,kBACA,QAAQ,iBAAiB,QAC3B,GAEA,MAAM,oCAAoC,gBAAgB;CAE5D,MAAM,0BAA0B,SAAS,QAAQ,iBAAiB,QAAQ;CAC1E,MAAM,0CAA0C,OAAO;AACzD;AAEA,eAAe,uCACb,SACyC;CACzC,IAAI,CAAC,iCAAiC,GACpC,OAAO;CAET,MAAM,iBAAkC;EACtC,UAAU,QAAQ;EAClB,uBAAuB;CACzB;CACA,IACE,uCAAuC,OAAO,CAAC,CAAC,MAC7C,4BACC,sBAAsB,yBAAyB,cAAc,CACjE,GAEA,OAAO;CAET,MAAM,iBAAiB,MAAM,iCAAiC;CAC9D,IAAI,gBAAgB,OAAO,QAAQ,MAAM,eAAe,UAAU,WAChE,OAAO,kBAAkB;CAE3B,MAAM,4BAA4B,uCAChC,cACF,CAAC,CAAC,OAAO,sBAAsB;CAC/B,0BAA0B,KAAK,cAAc;CAC7C,IAAI,0BAA0B,SAAS,iCACrC,MAAM,IAAI,MACR,yCAAyC,OAAO,+BAA+B,EAAE,2CACnF;CAEF,MAAM,iBAAiB;EACrB,GAAG;EACH;EACA,yBAAyB;CAC3B;CACA,MAAM,yCACJ,gBACA,cACF;CACA,OAAO;AACT;AAEA,SAAS,+BACP,SACM;CACN,KAAK,MAAM,2BAA2B,uCACpC,OACF,GAAG;EACD,IAAI,CAAC,uBAAuB,uBAAuB,GACjD;EAEF,IAAI;GACF,QAAQ,KAAK,wBAAwB,UAAU,SAAS;EAC1D,SAAS,OAAO;GACd,IAAI,CAAC,wBAAwB,OAAO,OAAO,GACzC,MAAM,IAAI,wBAAwB;IAChC,SAAS,sCAAsC,OAAO,wBAAwB,QAAQ,EAAE,yBAAyB,eAAe,KAAK;IACrI,QAAQ;IACR,OAAO;GACT,CAAC;EAEL;CACF;AACF;AAEA,SAAS,uCACP,SACmB;CACnB,MAAM,aAAa,CACjB,GAAI,QAAQ,6BAA6B,CAAC,GAC1C,GAAI,QAAQ,0BACR,CAAC,QAAQ,uBAAuB,IAChC,CAAC,CACP;CACA,MAAM,mBAAsC,CAAC;CAC7C,KAAK,MAAM,aAAa,YACtB,IACE,CAAC,iBAAiB,MAAM,aACtB,sBAAsB,UAAU,SAAS,CAC3C,GAEA,iBAAiB,KAAK,SAAS;CAGnC,OAAO;AACT;AAEA,SAAS,sBACP,MACA,OACS;CACT,OACE,KAAK,aAAa,MAAM,YACxB,KAAK,0BAA0B,MAAM;AAEzC;AAEA,SAAS,mCAA4C;CACnD,MAAM,cAAc,OAClB,QAAQ,IAAI,gCAAgC,EAC9C,CAAC,CAAC,KAAK;CACP,OAAO,gBAAgB,gBAAgB,gBAAgB;AACzD;AAEA,eAAe,iCACb,SAC4B;CAC5B,MAAM,UAAU,MAAM,0CAA0C,OAAO;CACvE,IAAI,CAAC,SACH,MAAM,IAAI,wBAAwB;EAChC,SAAS;EACT,QAAQ;CACV,CAAC;CAEH,OAAO;AACT;AAEA,eAAe,0CACb,SACmC;CACnC,MAAM,cAAc,MAAM,gBAAgB,QAAQ,QAAQ;CAC1D,IAAI,YAAY,WAAW,WACzB,OAAO;CAET,IAAI,YAAY,WAAW,eACzB,MAAM,IAAI,wBAAwB;EAChC,SAAS,YAAY;EACrB,QAAQ;CACV,CAAC;CAEH,OAAO,uBAAuB;EAC5B,aAAa,YAAY;EACzB;CACF,CAAC;AACH;AAEA,eAAe,+BACb,SACmC;CACnC,IAAI,CAAC,SACH,OAAO;CAET,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,QAAQ;CAIpD,OAAO,MAAM,WAAW,UACpB,uBAAuB;EAAE,aAAa,MAAM;EAAa;CAAQ,CAAC,IAClE;AACN;AAEA,eAAe,wCAAwC,IAMrD;CACA,MAAM,UAAU,MAAM,iCAAiC;CACvD,IACE,SAAS,OAAO,MAChB,QAAQ,UAAU,uBAClB,CAAC,QAAQ,iBAET,MAAM,IAAI,MAAM,6CAA6C;CAE/D,OAAO;AAKT;AAEA,SAAS,wCAAwC,OAGxC;CACP,QAAQ,KAAK,uDAAuD;EAClE,OAAO,eAAe,MAAM,KAAK;EACjC,cAAc,MAAM;CACtB,CAAC;AACH;AAEA,eAAe,iCACb,SACA,iBACe;CACf,oBAAoB;CACpB,IAAI,CAAC,QAAQ,iBAAiB;EAC5B,MAAM,kBAAkB;EACxB;CACF;CACA,MAAM,8BACJ,gBAAgB,GAChB,QAAQ,eACV;CACA,IAAI,iBACF,iBAAiB;EACf,SAAS,QAAQ;EACjB,SAAS;CACX,CAAC;AAEL;AAEA,eAAe,mCAAmF;CAChG,MAAM,OAAO,0BAA0B;CACvC,MAAM,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACjE,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM,IAAI,wBAAwB;GAChC,SAAS,sDAAsD,KAAK,IAAI,eAAe,KAAK;GAC5F,QAAQ;GACR,OAAO;EACT,CAAC;CACH,CAAC;CACD,IAAI,QAAQ,MACV,OAAO;CAET,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,GAAG;CACxB,SAAS,OAAO;EACd,MAAM,IAAI,wBAAwB;GAChC,SAAS,+CAA+C;GACxD,QAAQ;GACR,OAAO;EACT,CAAC;CACH;CACA,IAAI,CAAC,+BAA+B,KAAK,GACvC,MAAM,IAAI,wBAAwB;EAChC,SAAS,+CAA+C;EACxD,QAAQ;CACV,CAAC;CAEH,OAAO;AACT;AAEA,SAAS,+BACP,OACyC;CACzC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,OACE,MAAM,MAAM,KACZ,OAAO,MAAM,OAAO,YACpB,MAAM,GAAG,SAAS,MACjB,MAAM,UAAU,aACf,MAAM,UAAU,uBAChB,MAAM,UAAU,gBAClB,OAAO,cAAc,MAAM,QAAQ,KACnC,OAAO,MAAM,QAAQ,IAAI,KACzB,OAAO,MAAM,0BAA0B,YACvC,MAAM,sBAAsB,SAAS,MACpC,MAAM,oBAAoB,QACzB,qBAAqB,MAAM,eAAe,MAC5C,qBAAqB,MAAM,gBAAgB,MAC1C,MAAM,sCAAsC,KAAA,KAC3C,MAAM,sCAAsC,MAC9C,6BAA6B,MAAM,kBAAkB,KACrD,8BAA8B,MAAM,yBAAyB,KAC7D,0BAA0B,MAAM,uBAAuB,KACvD,kCAAkC,MAAM,eAAe;AAE3D;AAEA,SAAS,6BAA6B,OAAyB;CAC7D,OACE,UAAU,KAAA,KACT,MAAM,QAAQ,KAAK,KAClB,MAAM,UAAU,4BAChB,MAAM,OAAO,aAAa,iBAAiB,QAAQ,CAAC;AAE1D;AAEA,SAAS,8BAA8B,OAAyB;CAC9D,OACE,UAAU,KAAA,KACT,MAAM,QAAQ,KAAK,KAClB,MAAM,UAAU,mCAChB,MAAM,OAAO,cAAc,kBAAkB,SAAS,CAAC;AAE7D;AAEA,SAAS,0BAA0B,OAAyB;CAC1D,OAAO,UAAU,KAAA,KAAa,kBAAkB,KAAK;AACvD;AAEA,SAAS,kBAAkB,OAA0C;CACnE,OACE,SAAS,KAAK,KACd,OAAO,cAAc,MAAM,QAAQ,KACnC,OAAO,MAAM,QAAQ,IAAI,KACzB,OAAO,MAAM,0BAA0B,YACvC,MAAM,sBAAsB,SAAS;AAEzC;AAEA,SAAS,kCAAkC,OAAyB;CAClE,IAAI,UAAU,KAAA,GACZ,OAAO;CAET,IAAI,EAAE,SAAS,KAAK,KAAK,OAAO,MAAM,eAAe,WACnD,OAAO;CAET,QACG,MAAM,wBAAwB,KAAA,KAC7B,OAAO,MAAM,wBAAwB,cACtC,MAAM,2BAA2B,KAAA,KAChC,OAAO,MAAM,2BAA2B,cACzC,MAAM,wBAAwB,KAAA,KAC7B,iCAAiC,MAAM,mBAAmB;AAEhE;AAEA,SAAS,iCAAiC,OAAyB;CACjE,OACE,SAAS,KAAK,KACd,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,YAAY,aACxB,MAAM,UAAU,aACf,MAAM,UAAU,oBAChB,MAAM,UAAU,qBACjB,MAAM,aAAa,KAAA,KAAa,OAAO,MAAM,aAAa,cAC1D,MAAM,WAAW,KAAA,KAChB,MAAM,WAAW,QACjB,OAAO,MAAM,WAAW;AAE9B;AAEA,SAAS,qBAAqB,OAAwC;CACpE,OAAO,SAAS,KAAK,KAAK,MAAM,MAAM,KAAK,iBAAiB,MAAM,QAAQ;AAC5E;AAEA,eAAe,yCACb,UACA,MACe;CACf,IAAI,CAAC,qCAAqC,UAAU,IAAI,GACtD,MAAM,IAAI,MAAM,gDAAgD;CAElE,MAAM,UAAU,MAAM,iCAAiC;CACvD,IAAI,CAAC,SACH,MAAM,IAAI,mCAAmC;EAC3C,uBAAuB;EACvB,QAAQ;CACV,CAAC;CAEH,IAAI,CAAC,qCAAqC,UAAU,OAAO,GACzD,MAAM,IAAI,mCAAmC;EAC3C,uBAAuB;EACvB,QAAQ;CACV,CAAC;CAEH,MAAM,oBAAoB,0BAA0B,GAAG,IAAI;AAC7D;AAEA,eAAe,kCACb,SACe;CACf,MAAM,OAAO,0BAA0B;CACvC,MAAM,YAAY,GAAG,KAAK,SAAS,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CAC3E,MAAM,OAAO,MAAM,KAAK,WAAW,MAAM,GAAK;CAC9C,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;EACpE,MAAM,KAAK,KAAK;CAClB,SAAS,OAAO;EACd,UAAU;CACZ;CACA,IAAI;EACF,MAAM,KAAK,MAAM;CACnB,SAAS,OAAO;EACd,YAAY;CACd;CACA,IAAI,YAAY,KAAA,GAAW;EACzB,MAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EAC1D,MAAM;CACR;CAEA,IAAI;EACF,MAAM,KAAK,WAAW,IAAI;CAC5B,SAAS,OAAO;EACd,IAAI,wBAAwB,OAAO,QAAQ,GACzC,MAAM,IAAI,mCAAmC;EAE/C,MAAM;CACR,UAAU;EACR,MAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5D;AACF;AAEA,eAAe,0CACb,UACe;CACf,MAAM,iBAAiB,MAAM,iCAAiC;CAC9D,IAAI,CAAC,gBACH;CAEF,IAAI,CAAC,qCAAqC,UAAU,cAAc,GAChE,MAAM,IAAI,mCAAmC;EAC3C,uBAAuB;EACvB,QAAQ;CACV,CAAC;CAEH,MAAM,GAAG,0BAA0B,GAAG,EAAE,OAAO,KAAK,CAAC;AACvD;AAEA,SAAS,qCACP,MACA,OACS;CACT,OACE,KAAK,OAAO,MAAM,MAClB,KAAK,aAAa,MAAM,YACxB,KAAK,0BAA0B,MAAM;AAEzC;AAEA,SAAS,4BAAoC;CAC3C,OAAO,KAAK,gBAAgB,GAAG,QAAQ,yBAAyB;AAClE;AAEA,SAAS,kBAA0B;CACjC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,cAAc;AACvD;AAEA,eAAe,6BAA4C;CACzD,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAClE;AAEA,eAAe,8BACb,MACA,SACe;CACf,MAAM,oBAAoB,MAAM,OAAO;AACzC;AAEA,eAAe,oBACb,MACA,SACe;CACf,MAAM,WAAW,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CACxE,IAAI;EACF,MAAM,OAAO,MAAM,KAAK,UAAU,MAAM,GAAK;EAC7C,IAAI;GACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;GACpE,MAAM,KAAK,KAAK;EAClB,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;EAEA,MAAM,OAAO,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,MAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EACzD,MAAM;CACR;AACF;AAEA,SAAS,oBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,SAAS,wBAAwB,OAAgB,MAAuB;CACtE,OAAO,QACL,SAAS,OAAO,UAAU,YAAY,UAAU,SAAS,MAAM,SAAS,IAC1E;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,OAAO,iBAAiB,SAAS,MAAM,QAAQ,KAAK,IAChD,MAAM,QAAQ,KAAK,IACnB,OAAO,SAAS,eAAe;AACrC;AAEA,SAAS,qBAAqB,OAM5B;CACA,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO,CAAC;CAEV,MAAM,SAAS;CACf,MAAM,KAAK,wBAAwB,OAAO,EAAE;CAC5C,MAAM,QAAQ,wBAAwB,OAAO,KAAK;CAClD,MAAM,OAAO,wBAAwB,OAAO,IAAI;CAChD,IAAI,EAAE,MAAM,SAAS,OACnB,OAAO,CAAC;CAEV,OAAO,EACL,MAAM;EACJ,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;EACnB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EACzB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;CACzB,EACF;AACF;AAEA,SAAS,+BAA+B,OAEtC;CACA,MAAM,qBAAqB,kCAAkC,KAAK;CAClE,OAAO,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AACxD;AAEA,SAAgB,kCACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,MAAM,KAAK,wBAAwB,MAAM,EAAE;CAC3C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,WAAW,2BAA2B,KAAK;CACjD,IAAI,EAAE,MAAM,QAAQ,OAClB,OAAO;CAET,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC;AACF;AAeA,SAAS,mBAAmB,OAAuB;CACjD,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA+B;CAC9D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,2BAA2B,OAAyC;CAC3E,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,OAAO;CAIT,OADiB,yBAAyB,MAAM,QAClC,CAAC,EAAE,aAAa;AAChC;AAEA,SAAS,yBACP,UACgC;CAChC,IAAI,aAAa,QAAQ,aAAa,KAAA,GACpC,OAAO;CAGT,IAAI,OAAO,aAAa,UACtB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,QAAQ;EAClC,OAAO,SAAS,MAAM,IAAI,SAAS;CACrC,QAAQ;EACN,OAAO;CACT;CAGF,OAAO,SAAS,QAAQ,IAAI,WAAW;AACzC;AAEA,SAAS,eAAe,SAAiB,UAA0B;CACjE,MAAM,MAAM,IAAI,IAAI,OAAO;CAK3B,IAAI,WAAW,GAJY,IAAI,SAAS,QAAQ,qBAAqB,EAIlC,IAHR,SAAS,WAAW,GAAG,IAC9C,WACA,IAAI,gBACuD;CAC/D,IAAI,SAAS;CACb,IAAI,OAAO;CACX,OAAO,IAAI,SAAS;AACtB;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAEA,eAAe,kBAAkB,UAAsC;CACrE,MAAM,MAAM,MAAM,SAAS,KAAK;CAChC,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO,EAAE,SAAS,IAAI;CACxB;AACF;AAEA,eAAe,oBAAmC;CAChD,MAAM,GAAG,gBAAgB,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7C"}
+{"version":3,"file":"auth-session-BjZX32Cm.js","names":["delay","toErrorMessage","toErrorMessage","isFileNotFoundError","exhaustiveState"],"sources":["../../../packages/schemas/dist/schemas/local-machine/macos-keychain-helper.js","../src/strategy-constants.ts","../src/config/auth-session-expiry.ts","../src/config/auth-session-transition-lock.ts","../src/runtime/distribution.ts","../src/config/macos-native-keychain.ts","../src/config/token-store.ts","../src/config/auth-session.ts"],"sourcesContent":["import * as z$1 from \"zod/v4\";\n//#region src/schemas/local-machine/macos-keychain-helper.ts\nconst MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION = 2;\nconst MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION = \"disallow\";\nconst macOsKeychainServiceSchema = z$1.string().trim().min(1).max(512);\nconst macOsKeychainAccountSchema = z$1.string().trim().min(1).max(512);\nconst macOsKeychainAccessTokenSchema = z$1.string().min(1).max(65536);\nconst macOsKeychainHelperOperationSchema = z$1.enum([\n\t\"store\",\n\t\"read\",\n\t\"delete\"\n]);\nconst macOsKeychainHelperRequestSchema = z$1.discriminatedUnion(\"operation\", [\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"store\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\taccessToken: macOsKeychainAccessTokenSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"read\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t}),\n\tz$1.strictObject({\n\t\tschemaVersion: z$1.literal(2),\n\t\toperation: z$1.literal(\"delete\"),\n\t\tservice: macOsKeychainServiceSchema,\n\t\taccount: macOsKeychainAccountSchema,\n\t\tauthenticationInteraction: z$1.literal(MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION)\n\t})\n]);\nconst macOsKeychainHelperMutationSuccessSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(true),\n\toperation: z$1.enum([\"store\", \"delete\"])\n});\nconst macOsKeychainHelperReadSuccessSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(true),\n\toperation: z$1.literal(\"read\"),\n\taccessToken: z$1.union([macOsKeychainAccessTokenSchema, z$1.null()])\n});\nconst macOsKeychainHelperErrorSchema = z$1.strictObject({\n\tschemaVersion: z$1.literal(2),\n\tok: z$1.literal(false),\n\toperation: macOsKeychainHelperOperationSchema,\n\terrorMessage: z$1.string().trim().min(1).max(2048)\n});\nconst macOsKeychainHelperResponseSchema = z$1.union([\n\tmacOsKeychainHelperMutationSuccessSchema,\n\tmacOsKeychainHelperReadSuccessSchema,\n\tmacOsKeychainHelperErrorSchema\n]);\n//#endregion\nexport { MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION, MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION, macOsKeychainHelperOperationSchema, macOsKeychainHelperRequestSchema, macOsKeychainHelperResponseSchema };\n\n//# sourceMappingURL=macos-keychain-helper.js.map","import { CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH } from \"@openmeld/schemas\";\n\n// CLI and local daemon timing policy values. Keep this deployment-local; Core\n// and Web have their own constants files even when values intentionally match.\nexport const DEFAULT_GATEWAY_CHAIN_TIMEOUT_MS = 30_000;\nexport const DEFAULT_REMOTE_SESSION_TIMEOUT_MS = 8000;\nexport const LOOPBACK_REMOTE_SESSION_TIMEOUT_MS = 1500;\nexport const DEFAULT_WEB_AGENT_SELECTION_TIMEOUT_MS = 30 * 60 * 1000;\nexport const DEFAULT_WEB_AGENT_SELECTION_POLL_INTERVAL_MS = 2000;\nexport const DEFAULT_SPACE_REQUEST_TIMEOUT_MS = 10_000;\nexport const DEFAULT_SPACE_CONVERSATION_VALIDATE_TIMEOUT_MS = 60_000;\nexport const MIN_SPACE_REQUEST_TIMEOUT_MS = 1000;\nexport const MAX_SPACE_REQUEST_TIMEOUT_MS = 120_000;\nexport const DEFAULT_HEARTBEAT_INTERVAL_MS = 25_000;\nexport const MIN_HEARTBEAT_INTERVAL_MS = 5000;\nexport const MAX_HEARTBEAT_INTERVAL_MS = 60_000;\n// Daemon stream keepalive PING cadence. Sub-idle (below the gateway/Cloudflare\n// idle-eviction window) and independent of the heartbeat, so a quiet daemon\n// socket stays warm even when no heartbeat is due. Carries no lease/readiness.\nexport const DAEMON_STREAM_KEEPALIVE_INTERVAL_MS = 20_000;\n// Each keepalive PING must see the hub's auto-answered PONG within this\n// window, or the socket is treated as half-open and terminated so the normal\n// reconnect path (which also redelivers in-flight dispatch pushes) can run.\n// Without this deadline a half-open socket is only detected by the heartbeat\n// failure path, which can take ~40s+ at the idle-grown heartbeat interval.\nexport const DAEMON_STREAM_KEEPALIVE_PONG_TIMEOUT_MS = 10_000;\nexport const CATALOG_SYNC_INTERVAL_MULTIPLIER = 3;\nexport const MIN_CATALOG_SYNC_INTERVAL_MS = 15_000;\nexport const MAX_CATALOG_SYNC_INTERVAL_MS = 45_000;\nexport const CATALOG_SYNC_RETRY_INTERVAL_MS = 5000;\nexport const CATALOG_SYNC_SIGNAL_POLL_INTERVAL_MS = 1000;\nexport const ROUTE_CATALOG_LOAD_TIMEOUT_MS = 15_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const RUNTIME_AGENT_CONTROLLER_REPORT_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_INTERVAL_MS = 5 * 60_000;\nexport const PROVIDER_CONVERSATION_PROOF_SYNC_RETRY_INTERVAL_MS = 60_000;\nexport const RUNTIME_STATE_PERSIST_MIN_INTERVAL_MS = 60_000;\nexport const DAEMON_STREAM_CONNECT_TIMEOUT_MS = 15_000;\nexport const REGISTER_RESPONSE_TIMEOUT_MS = 10_000;\nexport const HEARTBEAT_RESPONSE_TIMEOUT_MS = 15_000;\nexport const DAEMON_RUNTIME_CONTRACT_EPOCH =\n  CURRENT_DAEMON_EXECUTION_CONTRACT_EPOCH;\nexport const OPENCLAW_CLI_TIMEOUT_MS = 30_000;\n","export type AuthSessionExpiryEligibility =\n  | { status: \"no_expiry\" }\n  | { expiresAtMs: number; status: \"valid\" }\n  | { expiresAtMs: number; status: \"expired\" }\n  | { status: \"invalid\" };\n\nexport function resolveAuthSessionExpiryEligibility(\n  expiresAt: string | undefined,\n  nowMs = Date.now()\n): AuthSessionExpiryEligibility {\n  const normalized = String(expiresAt ?? \"\").trim();\n  if (!normalized) {\n    return { status: \"no_expiry\" };\n  }\n\n  const expiresAtMs = Date.parse(normalized);\n  if (Number.isNaN(expiresAtMs)) {\n    return { status: \"invalid\" };\n  }\n  return expiresAtMs <= nowMs\n    ? { expiresAtMs, status: \"expired\" }\n    : { expiresAtMs, status: \"valid\" };\n}\n","import { setTimeout as delay } from \"node:timers/promises\";\nimport { acquireLock, isOpenMeldLockError, runWithHeldLock } from \"./lock\";\n\nconst AUTH_SESSION_LOCK_KEY = \"session-transition-mutation\";\nconst AUTH_SESSION_CANDIDATE_REFRESH_LOCK_KEY = \"candidate-session-refresh\";\nconst AUTH_SESSION_LOCK_PROFILE = \"auth-session\";\nconst AUTH_SESSION_LOCK_RETRY_DELAY_MS = 20;\nconst AUTH_SESSION_LOCK_WAIT_MS = 10_000;\n\nexport async function withAuthSessionTransitionMutationLock<T>(\n  operation: () => Promise<T>\n): Promise<T> {\n  return await withAuthSessionLock({\n    component: \"auth_session_transition\",\n    key: AUTH_SESSION_LOCK_KEY,\n    operation,\n  });\n}\n\nexport async function withAuthSessionCandidateRefreshLock<T>(\n  operation: () => Promise<T>\n): Promise<T> {\n  return await withAuthSessionLock({\n    component: \"auth_session_candidate_refresh\",\n    key: AUTH_SESSION_CANDIDATE_REFRESH_LOCK_KEY,\n    operation,\n  });\n}\n\nasync function withAuthSessionLock<T>(input: {\n  component: string;\n  key: string;\n  operation: () => Promise<T>;\n}): Promise<T> {\n  const lock = await acquireAuthSessionLock(input);\n  return await runWithHeldLock({\n    lock,\n    run: input.operation,\n    releaseContext: {\n      component: input.component,\n      lockKey: input.key,\n    },\n  });\n}\n\nasync function acquireAuthSessionLock(input: {\n  component: string;\n  key: string;\n}) {\n  const deadline = Date.now() + AUTH_SESSION_LOCK_WAIT_MS;\n  while (true) {\n    try {\n      return await acquireLock({\n        key: input.key,\n        meta: { component: input.component },\n        openMeldProfileId: AUTH_SESSION_LOCK_PROFILE,\n      });\n    } catch (error) {\n      if (!(isOpenMeldLockError(error) && Date.now() < deadline)) {\n        throw error;\n      }\n      await delay(AUTH_SESSION_LOCK_RETRY_DELAY_MS);\n    }\n  }\n}\n","/**\n * Build-time distribution marker.\n *\n * `OpenMeldDistribution` records how this CLI build is shipped and run. It is\n * orthogonal to the runtime lane / env preset (prod | dev-local | canary):\n *\n * - `npm`: shipped as the `openmeld` npm package, run via `node dist/*.js`; the\n *   OpenMeld Service daemon runs as a self-contained node bundle (dist copy +\n *   node_modules dependency closure).\n * - `binary`: shipped as a precompiled single binary (`bun build --compile`),\n *   run and self-installed as one executable; the daemon runs the same binary\n *   via its `service run` subcommand.\n *\n * The value is injected at build time (tsdown defines `\"npm\"`;\n * `scripts/release/build-cli-binary.mjs` defines `\"binary\"` via Bun `--define`)\n * so distribution-mode branching never guesses from paths and cannot be spoofed\n * by a runtime environment variable.\n */\ndeclare const __OPENMELD_DISTRIBUTION__: string | undefined;\n\nexport type OpenMeldDistribution = \"binary\" | \"npm\";\n\nconst BINARY_DISTRIBUTION: OpenMeldDistribution = \"binary\";\nconst NPM_DISTRIBUTION: OpenMeldDistribution = \"npm\";\n\n/**\n * The distribution form this CLI build was compiled for. Falls back to `npm`\n * when the marker is absent (e.g. under Vitest, where no build-time define\n * runs), which keeps the safe, path-independent default.\n */\nexport function resolveOpenMeldDistribution(): OpenMeldDistribution {\n  const injected =\n    typeof __OPENMELD_DISTRIBUTION__ === \"string\"\n      ? __OPENMELD_DISTRIBUTION__\n      : undefined;\n  return injected === BINARY_DISTRIBUTION\n    ? BINARY_DISTRIBUTION\n    : NPM_DISTRIBUTION;\n}\n\nexport function isBinaryDistribution(): boolean {\n  return resolveOpenMeldDistribution() === BINARY_DISTRIBUTION;\n}\n","import { spawn } from \"node:child_process\";\nimport { createRequire } from \"node:module\";\nimport { fileURLToPath } from \"node:url\";\nimport {\n  MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n  MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n  type MacOsKeychainHelperRequest,\n  macOsKeychainHelperRequestSchema,\n  macOsKeychainHelperResponseSchema,\n} from \"@openmeld/schemas\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\n\nconst MAC_OS_KEYCHAIN_HELPER_ARG = \"__openmeld_macos_keychain_helper\";\nconst HELPER_OUTPUT_MAX_BYTES = 128 * 1024;\nconst OS_STATUS_PATTERN = /OSStatus (-?\\d+)/u;\nexport const MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS = 5000;\n\ntype MacOsKeychainAddon = {\n  isParentSameExecutable(): boolean;\n  read(service: string, account: string): string | null;\n  remove(service: string, account: string): void;\n  store(service: string, account: string, accessToken: string): void;\n};\n\ntype KeychainAddress = {\n  account: string;\n  service: string;\n};\n\ntype MacOsKeychainHelperRequestInput =\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"read\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"store\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >\n  | Omit<\n      Extract<MacOsKeychainHelperRequest, { operation: \"delete\" }>,\n      \"authenticationInteraction\" | \"schemaVersion\"\n    >;\ntype MacOsKeychainHelperReadRequestInput = Extract<\n  MacOsKeychainHelperRequestInput,\n  { operation: \"read\" }\n>;\ntype MacOsKeychainHelperMutationRequestInput = Exclude<\n  MacOsKeychainHelperRequestInput,\n  MacOsKeychainHelperReadRequestInput\n>;\n\nlet loadedAddon: MacOsKeychainAddon | null = null;\nlet unresponsiveKeychainError: Error | null = null;\nlet keychainRetryAt = 0;\nlet lastKeychainFailureCode: string | null = null;\nexport const MAC_OS_KEYCHAIN_RETRY_DELAY_MS = 30_000;\n\nexport async function storeMacOsNativeKeychainToken(\n  input: KeychainAddress & { accessToken: string }\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"store\",\n      service: input.service,\n      account: input.account,\n      accessToken: input.accessToken,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.store(input.service, input.account, input.accessToken);\n}\n\nexport async function readMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<string | null> {\n  if (isBinaryDistribution()) {\n    return await runBoundedMacOsNativeKeychainRequest({\n      operation: \"read\",\n      service: input.service,\n      account: input.account,\n    });\n  }\n  const addon = await loadAddon();\n  return addon.read(input.service, input.account);\n}\n\nexport async function deleteMacOsNativeKeychainToken(\n  input: KeychainAddress\n): Promise<void> {\n  if (isBinaryDistribution()) {\n    await runBoundedMacOsNativeKeychainRequest({\n      operation: \"delete\",\n      service: input.service,\n      account: input.account,\n    });\n    return;\n  }\n  const addon = await loadAddon();\n  addon.remove(input.service, input.account);\n}\n\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperReadRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<string | null>;\nexport function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperMutationRequestInput,\n  options?: { timeoutMs?: number }\n): Promise<undefined>;\nexport async function runMacOsNativeKeychainRequestInChild(\n  input: MacOsKeychainHelperRequestInput,\n  options: { timeoutMs?: number } = {}\n): Promise<string | null | undefined> {\n  const request = macOsKeychainHelperRequestSchema.parse({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    authenticationInteraction: MAC_OS_KEYCHAIN_AUTHENTICATION_INTERACTION,\n    ...input,\n  });\n  const timeoutMs = options.timeoutMs ?? MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS;\n  if (!(Number.isSafeInteger(timeoutMs) && timeoutMs > 0)) {\n    throw new Error(\"macOS Keychain helper timeout must be a positive integer\");\n  }\n\n  return await new Promise<string | null | undefined>((resolve, reject) => {\n    const child = spawn(process.execPath, [MAC_OS_KEYCHAIN_HELPER_ARG], {\n      env: process.env,\n      shell: false,\n      stdio: [\"pipe\", \"pipe\", \"pipe\"],\n      windowsHide: true,\n    });\n    let settled = false;\n    let stdout = \"\";\n    let stderr = \"\";\n\n    const clearDeadline = () => {\n      clearTimeout(deadline);\n    };\n    const rejectOnce = (error: Error) => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      clearDeadline();\n      reject(error);\n    };\n    const deadline = setTimeout(() => {\n      if (settled) {\n        return;\n      }\n      settled = true;\n      child.kill(\"SIGKILL\");\n      reject(\n        new MacOsNativeKeychainTimeoutError(\n          `macOS Keychain did not respond within ${formatTimeout(timeoutMs)}`\n        )\n      );\n    }, timeoutMs);\n\n    child.stdout.setEncoding(\"utf8\");\n    child.stderr.setEncoding(\"utf8\");\n    child.stdout.on(\"data\", (chunk: unknown) => {\n      stdout += String(chunk);\n      if (Buffer.byteLength(stdout, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        child.kill(\"SIGKILL\");\n        rejectOnce(new Error(\"macOS Keychain helper output was too large\"));\n      }\n    });\n    child.stderr.on(\"data\", (chunk: unknown) => {\n      stderr += String(chunk);\n      if (Buffer.byteLength(stderr, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n        stderr = stderr.slice(-HELPER_OUTPUT_MAX_BYTES);\n      }\n    });\n    child.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper could not start: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.stdin.once(\"error\", (error) => {\n      rejectOnce(\n        new Error(\n          `macOS Keychain helper input failed: ${toErrorMessage(error)}`\n        )\n      );\n    });\n    child.once(\"close\", (code) => {\n      if (settled) {\n        return;\n      }\n      clearDeadline();\n      settled = true;\n      try {\n        resolve(\n          parseMacOsKeychainHelperResult({\n            code,\n            operation: request.operation,\n            stderr,\n            stdout,\n          })\n        );\n      } catch (error) {\n        reject(toError(error));\n      }\n    });\n\n    child.stdin.end(JSON.stringify(request), \"utf8\");\n  });\n}\n\nexport async function runMacOsNativeKeychainHelperIfRequested(\n  argv: readonly string[] = process.argv\n): Promise<boolean> {\n  if (!argv.includes(MAC_OS_KEYCHAIN_HELPER_ARG)) {\n    return false;\n  }\n  if (!(isBinaryDistribution() && process.platform === \"darwin\")) {\n    throw new Error(\n      \"the internal macOS Keychain helper is only available in the macOS binary\"\n    );\n  }\n\n  const addon = await loadAddon();\n  if (!addon.isParentSameExecutable()) {\n    throw new Error(\n      \"the internal macOS Keychain helper is reserved for an OpenMeld child process\"\n    );\n  }\n\n  const rawRequest = await readHelperStdin();\n  let json: unknown;\n  try {\n    json = JSON.parse(rawRequest);\n  } catch {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n  const request = macOsKeychainHelperRequestSchema.safeParse(json);\n  if (!request.success) {\n    throw new Error(\"invalid macOS Keychain helper request\");\n  }\n\n  const response = await executeHelperRequest(request.data).catch((error) => ({\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: false as const,\n    operation: request.data.operation,\n    errorMessage: truncateErrorMessage(toErrorMessage(error)),\n  }));\n  process.stdout.write(JSON.stringify(response));\n  return true;\n}\n\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperReadRequestInput\n): Promise<string | null>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperMutationRequestInput\n): Promise<undefined>;\nasync function runBoundedMacOsNativeKeychainRequest(\n  input: MacOsKeychainHelperRequestInput\n): Promise<string | null | undefined> {\n  if (unresponsiveKeychainError && Date.now() < keychainRetryAt) {\n    throw unresponsiveKeychainError;\n  }\n  try {\n    if (input.operation === \"read\") {\n      const result = await runMacOsNativeKeychainRequestInChild(input);\n      noteKeychainRecovery();\n      return result;\n    }\n    await runMacOsNativeKeychainRequestInChild(input);\n    noteKeychainRecovery();\n  } catch (error) {\n    const timedOut = error instanceof MacOsNativeKeychainTimeoutError;\n    if (error instanceof MacOsNativeKeychainTimeoutError) {\n      unresponsiveKeychainError = error;\n      keychainRetryAt = Date.now() + MAC_OS_KEYCHAIN_RETRY_DELAY_MS;\n    }\n    const osStatus = OS_STATUS_PATTERN.exec(toErrorMessage(error))?.[1];\n    let reasonCode = osStatus ? \"keychain_os_error\" : \"keychain_helper_failed\";\n    if (timedOut) {\n      reasonCode = \"keychain_helper_timeout\";\n    }\n    const failureCode = `${reasonCode}:${osStatus ?? \"none\"}`;\n    if (lastKeychainFailureCode !== failureCode) {\n      lastKeychainFailureCode = failureCode;\n      console.warn(\n        JSON.stringify({\n          event: \"cli.keychain.readiness_failed\",\n          observedAt: new Date().toISOString(),\n          reasonCode,\n          ...(osStatus ? { osStatus: Number(osStatus) } : {}),\n          operation: input.operation,\n          timeoutMs: MAC_OS_KEYCHAIN_HELPER_TIMEOUT_MS,\n          ...(timedOut ? { retryAfterMs: MAC_OS_KEYCHAIN_RETRY_DELAY_MS } : {}),\n        })\n      );\n    }\n    throw error;\n  }\n}\n\nfunction noteKeychainRecovery(): void {\n  if (lastKeychainFailureCode) {\n    console.warn(\n      JSON.stringify({\n        event: \"cli.keychain.readiness_recovered\",\n        observedAt: new Date().toISOString(),\n      })\n    );\n  }\n  unresponsiveKeychainError = null;\n  keychainRetryAt = 0;\n  lastKeychainFailureCode = null;\n}\n\nfunction parseMacOsKeychainHelperResult(input: {\n  code: number | null;\n  operation: MacOsKeychainHelperRequest[\"operation\"];\n  stderr: string;\n  stdout: string;\n}): string | null | undefined {\n  if (input.code !== 0) {\n    throw new Error(\n      `macOS Keychain helper exited with code ${input.code ?? \"unknown\"}${\n        input.stderr.trim() ? `: ${input.stderr.trim()}` : \"\"\n      }`\n    );\n  }\n\n  let rawResponse: unknown;\n  try {\n    rawResponse = JSON.parse(input.stdout);\n  } catch {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  const parsed = macOsKeychainHelperResponseSchema.safeParse(rawResponse);\n  if (!(parsed.success && parsed.data.operation === input.operation)) {\n    throw new Error(\"macOS Keychain helper returned an invalid response\");\n  }\n  if (!parsed.data.ok) {\n    throw new Error(parsed.data.errorMessage);\n  }\n  return parsed.data.operation === \"read\" ? parsed.data.accessToken : undefined;\n}\n\nasync function executeHelperRequest(input: MacOsKeychainHelperRequest) {\n  const addon = await loadAddon();\n  if (input.operation === \"store\") {\n    addon.store(input.service, input.account, input.accessToken);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"store\" as const,\n    };\n  }\n  if (input.operation === \"delete\") {\n    addon.remove(input.service, input.account);\n    return {\n      schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n      ok: true as const,\n      operation: \"delete\" as const,\n    };\n  }\n  return {\n    schemaVersion: MAC_OS_KEYCHAIN_HELPER_SCHEMA_VERSION,\n    ok: true as const,\n    operation: \"read\" as const,\n    accessToken: addon.read(input.service, input.account),\n  };\n}\n\nasync function readHelperStdin(): Promise<string> {\n  let raw = \"\";\n  process.stdin.setEncoding(\"utf8\");\n  for await (const chunk of process.stdin) {\n    raw += String(chunk);\n    if (Buffer.byteLength(raw, \"utf8\") > HELPER_OUTPUT_MAX_BYTES) {\n      throw new Error(\"macOS Keychain helper request was too large\");\n    }\n  }\n  return raw;\n}\n\nfunction truncateErrorMessage(message: string): string {\n  const normalized = message.trim() || \"macOS Keychain operation failed\";\n  return normalized.slice(0, 2048);\n}\n\nfunction formatTimeout(timeoutMs: number): string {\n  return timeoutMs % 1000 === 0\n    ? `${timeoutMs / 1000} seconds`\n    : `${timeoutMs} ms`;\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error ? error.message : String(error);\n}\n\nfunction toError(error: unknown): Error {\n  return error instanceof Error ? error : new Error(String(error));\n}\n\nclass MacOsNativeKeychainTimeoutError extends Error {\n  override readonly name = \"MacOsNativeKeychainTimeoutError\";\n}\n\nasync function loadAddon(): Promise<MacOsKeychainAddon> {\n  if (loadedAddon) {\n    return loadedAddon;\n  }\n  if (process.platform !== \"darwin\") {\n    throw new Error(\"macOS Keychain is only available on macOS\");\n  }\n\n  if (isBinaryDistribution()) {\n    const embedded = await import(\"./macos-native-keychain-embedded\");\n    loadedAddon = embedded.loadEmbeddedMacOsKeychainAddon();\n    return loadedAddon;\n  }\n\n  const require = createRequire(import.meta.url);\n  const addonPath = fileURLToPath(\n    new URL(\"./native/openmeld-keychain.node\", import.meta.url)\n  );\n  loadedAddon = require(addonPath) as MacOsKeychainAddon;\n  return loadedAddon;\n}\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { chmod, mkdir, readFile, rm, writeFile } from \"node:fs/promises\";\nimport { join, resolve } from \"node:path\";\nimport { isBinaryDistribution } from \"../runtime/distribution\";\nimport {\n  deleteMacOsNativeKeychainToken,\n  readMacOsNativeKeychainToken,\n  storeMacOsNativeKeychainToken,\n} from \"./macos-native-keychain\";\nimport { openMeldRootDir } from \"./paths\";\n\nconst TOKEN_STORE_KEYCHAIN_SERVICE = \"sh.openmeld.auth.token\";\nconst INSECURE_FALLBACK_ENV_KEY = \"OPENMELD_AUTH_ALLOW_INSECURE_FILE_TOKEN\";\nconst FORCE_INSECURE_STORE_ENV_KEY = \"OPENMELD_AUTH_FORCE_INSECURE_FILE_TOKEN\";\nconst MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE =\n  \"macOS Keychain access is unavailable in this OpenMeld distribution. \" +\n  \"OpenMeld will not open an authorization window from an unattended process. \" +\n  \"Run setup or login with the current packaged OpenMeld CLI.\";\nconst COMMAND_MAX_BUFFER_BYTES = 1024 * 1024;\nconst COMMAND_TIMEOUT_MS = 30_000;\nconst TOKEN_FILE_KEY_PATTERN = /^[a-f0-9]{64}$/u;\nconst EXEC_FILE_BASE_OPTIONS = {\n  windowsHide: true,\n  maxBuffer: COMMAND_MAX_BUFFER_BYTES,\n  timeout: COMMAND_TIMEOUT_MS,\n} as const;\nlet insecureFallbackWarningShown = false;\nlet macOsPrivateStorageWarningShown = false;\n\ntype MacOsTokenRef = {\n  provider: \"macos-keychain\";\n  service: string;\n  account: string;\n};\n\ntype WindowsDpapiTokenRef = {\n  provider: \"windows-dpapi\";\n  key: string;\n};\n\ntype InsecureFileTokenRef = {\n  provider: \"insecure-file\";\n  key: string;\n};\n\nexport type StoredTokenRef =\n  | MacOsTokenRef\n  | WindowsDpapiTokenRef\n  | InsecureFileTokenRef;\n\nexport type AccessTokenReadResult =\n  | {\n      accessToken: string;\n      status: \"found\";\n    }\n  | {\n      status: \"missing\";\n    }\n  | {\n      errorMessage: string;\n      status: \"unavailable\";\n    };\n\ntype StoreTokenInput = {\n  accessToken: string;\n  authBaseUrl: string;\n  clientId: string;\n  unique?: boolean;\n};\n\nexport async function storeAccessToken(\n  input: StoreTokenInput\n): Promise<StoredTokenRef> {\n  const key = buildTokenKey({\n    authBaseUrl: input.authBaseUrl,\n    clientId: input.clientId,\n  });\n  const storageKey = input.unique ? buildUniqueTokenFileKey(key) : key;\n\n  if (shouldForceInsecureStore()) {\n    await setInsecureFileToken({\n      key: storageKey,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key: storageKey,\n    };\n  }\n\n  if (process.platform === \"darwin\") {\n    try {\n      const account = buildUniqueMacOsAccount(key);\n      if (shouldUseNativeMacOsKeychain()) {\n        await storeMacOsNativeKeychainToken({\n          account,\n          service: TOKEN_STORE_KEYCHAIN_SERVICE,\n          accessToken: input.accessToken,\n        });\n      } else {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      return {\n        provider: \"macos-keychain\",\n        service: TOKEN_STORE_KEYCHAIN_SERVICE,\n        account,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key: storageKey,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key: storageKey,\n        };\n      }\n      const privateKey = buildUniqueTokenFileKey(key);\n      await setInsecureFileToken({\n        key: privateKey,\n        accessToken: input.accessToken,\n      });\n      warnMacOsPrivateStorageFallback(error);\n      return { provider: \"insecure-file\", key: privateKey };\n    }\n  }\n\n  if (process.platform === \"win32\") {\n    try {\n      await setWindowsDpapiToken({\n        key: storageKey,\n        accessToken: input.accessToken,\n      });\n      return {\n        provider: \"windows-dpapi\",\n        key: storageKey,\n      };\n    } catch (error) {\n      if (allowInsecureFallback()) {\n        await setInsecureFileToken({\n          key: storageKey,\n          accessToken: input.accessToken,\n        });\n        return {\n          provider: \"insecure-file\",\n          key: storageKey,\n        };\n      }\n      throw new Error(\n        `failed to store access token via Windows DPAPI: ${toErrorMessage(error)}`\n      );\n    }\n  }\n\n  if (allowInsecureFallback()) {\n    await setInsecureFileToken({\n      key: storageKey,\n      accessToken: input.accessToken,\n    });\n    return {\n      provider: \"insecure-file\",\n      key: storageKey,\n    };\n  }\n\n  throw new Error(\n    `secure token storage is unavailable on platform \"${process.platform}\". ` +\n      `Use ${INSECURE_FALLBACK_ENV_KEY}=1 only for local testing fallback.`\n  );\n}\n\nexport async function readAccessToken(\n  ref: StoredTokenRef\n): Promise<AccessTokenReadResult> {\n  try {\n    if (ref.provider === \"macos-keychain\") {\n      if (!shouldUseNativeMacOsKeychain()) {\n        throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n      }\n      const token = await readMacOsNativeKeychainToken(ref);\n      return toAccessTokenReadResult(token);\n    }\n    if (ref.provider === \"windows-dpapi\") {\n      return toAccessTokenReadResult(await getWindowsDpapiToken(ref));\n    }\n    if (ref.provider === \"insecure-file\") {\n      return toAccessTokenReadResult(await getInsecureFileToken(ref));\n    }\n    return { status: \"missing\" };\n  } catch (error) {\n    return {\n      errorMessage: toErrorMessage(error),\n      status: \"unavailable\",\n    };\n  }\n}\n\nexport async function deleteAccessToken(ref: StoredTokenRef): Promise<void> {\n  if (ref.provider === \"macos-keychain\") {\n    if (!shouldUseNativeMacOsKeychain()) {\n      throw new Error(MAC_OS_KEYCHAIN_NONINTERACTIVE_UNAVAILABLE_MESSAGE);\n    }\n    await deleteMacOsNativeKeychainToken(ref);\n    return;\n  }\n  if (ref.provider === \"windows-dpapi\") {\n    await deleteWindowsDpapiToken(ref);\n    return;\n  }\n  if (ref.provider === \"insecure-file\") {\n    await deleteInsecureFileToken(ref);\n  }\n}\n\nexport function isStoredTokenRef(value: unknown): value is StoredTokenRef {\n  if (!(value && typeof value === \"object\")) {\n    return false;\n  }\n  const record = value as Record<string, unknown>;\n  const provider = normalizeString(record.provider);\n  if (provider === \"macos-keychain\") {\n    return Boolean(\n      normalizeString(record.service) &&\n        normalizeString(record.account) &&\n        record.accessGroup === undefined\n    );\n  }\n  if (provider === \"windows-dpapi\" || provider === \"insecure-file\") {\n    return normalizeTokenFileKey(record.key) !== null;\n  }\n  return false;\n}\n\nfunction buildTokenKey(input: {\n  authBaseUrl: string;\n  clientId: string;\n}): string {\n  const rootDir = resolve(openMeldRootDir());\n  return createHash(\"sha256\")\n    .update(`${input.clientId}\\n${input.authBaseUrl}\\n${rootDir}`)\n    .digest(\"hex\");\n}\n\nfunction buildUniqueMacOsAccount(key: string): string {\n  return `openmeld-auth-${key}-${randomUUID()}`;\n}\n\nfunction buildUniqueTokenFileKey(key: string): string {\n  return createHash(\"sha256\").update(`${key}\\n${randomUUID()}`).digest(\"hex\");\n}\n\nfunction shouldUseNativeMacOsKeychain(): boolean {\n  return isBinaryDistribution();\n}\n\nasync function setWindowsDpapiToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  const encrypted = await runPowerShellScript(\n    WINDOWS_DPAPI_ENCRYPT_SCRIPT,\n    input.accessToken,\n    input.key\n  );\n  await mkdir(tokenDirectoryPath(), { recursive: true });\n  // NOTE: `mode: 0o600` is POSIX-only and Windows ignores it.\n  // For `tokenDirectoryPath()` + `windowsDpapiTokenPath()` we rely on DPAPI\n  // and Windows ACLs for equivalent protection.\n  await writeFile(windowsDpapiTokenPath(input.key), `${encrypted.trim()}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n}\n\nasync function getWindowsDpapiToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const encrypted = await readFile(\n    windowsDpapiTokenPath(input.key),\n    \"utf8\"\n  ).catch((error) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw error;\n  });\n  if (!encrypted) {\n    return null;\n  }\n  return runPowerShellScript(\n    WINDOWS_DPAPI_DECRYPT_SCRIPT,\n    encrypted.trim(),\n    input.key\n  );\n}\n\nasync function deleteWindowsDpapiToken(input: { key: string }): Promise<void> {\n  await rm(windowsDpapiTokenPath(input.key), { force: true });\n}\n\nasync function setInsecureFileToken(input: {\n  key: string;\n  accessToken: string;\n}): Promise<void> {\n  await ensurePrivateTokenDirectory();\n  const path = insecureTokenPath(input.key);\n  await writeFile(path, `${input.accessToken}\\n`, {\n    encoding: \"utf8\",\n    mode: 0o600,\n  });\n  if (process.platform !== \"win32\") {\n    await chmod(path, 0o600);\n  }\n}\n\nasync function getInsecureFileToken(input: {\n  key: string;\n}): Promise<string | null> {\n  const raw = await readFile(insecureTokenPath(input.key), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  return raw ? raw.trim() : null;\n}\n\nasync function deleteInsecureFileToken(input: { key: string }): Promise<void> {\n  await rm(insecureTokenPath(input.key), { force: true });\n}\n\nfunction tokenDirectoryPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"tokens\");\n}\n\nfunction windowsDpapiTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.dpapi`);\n}\n\nfunction insecureTokenPath(key: string): string {\n  return join(tokenDirectoryPath(), `${requireValidTokenFileKey(key)}.token`);\n}\n\nfunction allowInsecureFallback(): boolean {\n  if (process.env[INSECURE_FALLBACK_ENV_KEY] === \"1\") {\n    warnInsecureFallback(\"env\");\n    return true;\n  }\n  // Known downgrade behavior:\n  // On platforms without native secure-store support, OpenMeld currently falls back\n  // to local file token storage by default for compatibility.\n  const fallbackEnabled = !isNativeSecureStorePlatform();\n  if (fallbackEnabled) {\n    warnInsecureFallback(\"platform\");\n  }\n  return fallbackEnabled;\n}\n\nfunction warnMacOsPrivateStorageFallback(error: unknown): void {\n  if (macOsPrivateStorageWarningShown) {\n    return;\n  }\n  macOsPrivateStorageWarningShown = true;\n  const storageExpectation = isBinaryDistribution()\n    ? \"This session stays in private local storage unless a later sign-in replaces it.\"\n    : \"This npm installation cannot use macOS Keychain. This session stays in private local storage.\";\n  console.warn(\n    \"[openmeld auth] macOS Keychain is unavailable. OpenMeld saved this \" +\n      \"session in a private file protected for your macOS user account, so \" +\n      \"setup can continue. \" +\n      `${storageExpectation} Details: ${toErrorMessage(error)}`\n  );\n}\n\nfunction warnInsecureFallback(reason: \"env\" | \"platform\"): void {\n  if (insecureFallbackWarningShown) {\n    return;\n  }\n  insecureFallbackWarningShown = true;\n\n  const reasonText =\n    reason === \"env\"\n      ? `enabled by ${INSECURE_FALLBACK_ENV_KEY}=1`\n      : `enabled automatically on platform \"${process.platform}\"`;\n  console.warn(\n    `[openmeld auth] plaintext file token storage fallback is active (${reasonText}). ` +\n      `Unset ${INSECURE_FALLBACK_ENV_KEY} to disable explicit opt-in, ` +\n      \"and prefer macOS or Windows for native secure token storage.\"\n  );\n}\n\nfunction shouldForceInsecureStore(): boolean {\n  return process.env[FORCE_INSECURE_STORE_ENV_KEY] === \"1\";\n}\n\nfunction isNativeSecureStorePlatform(): boolean {\n  return process.platform === \"darwin\" || process.platform === \"win32\";\n}\n\nasync function ensurePrivateTokenDirectory(): Promise<void> {\n  const directory = tokenDirectoryPath();\n  await mkdir(directory, { recursive: true, mode: 0o700 });\n  if (process.platform !== \"win32\") {\n    await chmod(directory, 0o700);\n  }\n}\n\nasync function runPowerShellScript(\n  script: string,\n  token: string,\n  entropy: string\n): Promise<string> {\n  const payload = JSON.stringify({ token, entropy });\n  const result = await runCommand(\n    \"powershell.exe\",\n    [\n      \"-NoProfile\",\n      \"-NonInteractive\",\n      \"-ExecutionPolicy\",\n      \"Bypass\",\n      \"-Command\",\n      script,\n    ],\n    payload\n  );\n  return result.stdout.trim();\n}\n\nasync function runCommand(\n  command: string,\n  args: string[],\n  stdinPayload: string\n): Promise<{ stdout: string; stderr: string }> {\n  try {\n    const { execFile } = await import(\"node:child_process\");\n    const output = await new Promise<{ stdout: string; stderr: string }>(\n      (resolve, reject) => {\n        let stdout = \"\";\n        let stderr = \"\";\n\n        const child = execFile(command, args, { ...EXEC_FILE_BASE_OPTIONS });\n\n        child.stdout?.setEncoding(\"utf8\");\n        child.stderr?.setEncoding(\"utf8\");\n        child.stdout?.on(\"data\", (chunk: unknown) => {\n          stdout += String(chunk);\n        });\n        child.stderr?.on(\"data\", (chunk: unknown) => {\n          stderr += String(chunk);\n        });\n\n        child.on(\"error\", (error) => {\n          reject(toCommandError(error, command));\n        });\n\n        child.on(\"close\", (code) => {\n          if (code === 0) {\n            resolve({ stdout, stderr });\n            return;\n          }\n          reject(\n            toCommandError(\n              {\n                message: `command failed (${command}) with exit code ${code}`,\n              },\n              command\n            )\n          );\n        });\n\n        child.stdin?.write(stdinPayload);\n        child.stdin?.end();\n      }\n    );\n    return output;\n  } catch (error) {\n    throw toCommandError(error, command);\n  }\n}\n\nfunction toCommandError(\n  error: unknown,\n  command: string\n): Error & { code?: number | null; stdout?: string; stderr?: string } {\n  if (!(error && typeof error === \"object\")) {\n    return new Error(`command failed (${command}): ${String(error)}`);\n  }\n  const e = error as NodeJS.ErrnoException & {\n    stdout?: string;\n    stderr?: string;\n    code?: number | null | string;\n  };\n  const code = typeof e.code === \"number\" ? e.code : null;\n  const messageParts = [`command failed (${command})`];\n  if (typeof e.stderr === \"string\" && e.stderr.trim()) {\n    messageParts.push(`stderr: ${e.stderr.trim()}`);\n  } else if (e.message) {\n    messageParts.push(e.message);\n  }\n  const wrapped = new Error(messageParts.join(\"; \")) as Error & {\n    code?: number | null;\n    stdout?: string;\n    stderr?: string;\n  };\n  wrapped.code = code;\n  wrapped.stdout = e.stdout;\n  wrapped.stderr = e.stderr;\n  return wrapped;\n}\n\nfunction normalizeString(value: unknown): string {\n  return String(value ?? \"\").trim();\n}\n\nfunction normalizeTokenFileKey(value: unknown): string | null {\n  const normalized = normalizeString(value);\n  if (!TOKEN_FILE_KEY_PATTERN.test(normalized)) {\n    return null;\n  }\n  return normalized;\n}\n\nfunction requireValidTokenFileKey(value: unknown): string {\n  const normalized = normalizeTokenFileKey(value);\n  if (normalized === null) {\n    throw new Error(\"stored token key is invalid\");\n  }\n  return normalized;\n}\n\nfunction normalizeToken(value: string | null): string | null {\n  if (value === null) {\n    return null;\n  }\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction toAccessTokenReadResult(value: string | null): AccessTokenReadResult {\n  const accessToken = normalizeToken(value);\n  if (!accessToken) {\n    return { status: \"missing\" };\n  }\n  return {\n    accessToken,\n    status: \"found\",\n  };\n}\n\nfunction toErrorMessage(error: unknown): string {\n  if (error instanceof Error) {\n    return error.message;\n  }\n  return String(error);\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nconst WINDOWS_DPAPI_ENCRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$plain=[System.Text.Encoding]::UTF8.GetBytes($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$cipher=[System.Security.Cryptography.ProtectedData]::Protect($plain,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Convert]::ToBase64String($cipher)\",\n].join(\";\");\n\nconst WINDOWS_DPAPI_DECRYPT_SCRIPT = [\n  \"$ErrorActionPreference='Stop'\",\n  \"$rawInput = [Console]::In.ReadToEnd()\",\n  \"$payload = $rawInput | ConvertFrom-Json\",\n  \"$cipher=[System.Convert]::FromBase64String($payload.token)\",\n  \"$entropy=[System.Text.Encoding]::UTF8.GetBytes($payload.entropy)\",\n  \"$plain=[System.Security.Cryptography.ProtectedData]::Unprotect($cipher,$entropy,[System.Security.Cryptography.DataProtectionScope]::CurrentUser)\",\n  \"[System.Text.Encoding]::UTF8.GetString($plain)\",\n].join(\";\");\n","import { createHash, randomUUID } from \"node:crypto\";\nimport { link, mkdir, open, readFile, rename, rm } from \"node:fs/promises\";\nimport { join } from \"node:path\";\nimport {\n  DEFAULT_REMOTE_SESSION_TIMEOUT_MS,\n  LOOPBACK_REMOTE_SESSION_TIMEOUT_MS,\n} from \"../strategy-constants\";\nimport {\n  CURRENT_PROCESS_START_IDENTITY,\n  isProcessIdentityAlive,\n} from \"../system/process-identity\";\nimport { resolveAuthSessionExpiryEligibility } from \"./auth-session-expiry\";\nimport {\n  withAuthSessionCandidateRefreshLock,\n  withAuthSessionTransitionMutationLock,\n} from \"./auth-session-transition-lock\";\nimport { isLoopbackHostname } from \"./loopback-hostname\";\nimport { openMeldRootDir } from \"./paths\";\nimport {\n  deleteAccessToken,\n  isStoredTokenRef,\n  readAccessToken,\n  type StoredTokenRef,\n  storeAccessToken,\n} from \"./token-store\";\n\ntype AuthSessionV1 = {\n  v: 1;\n  tokenRef: StoredTokenRef;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype PendingTokenCleanupV1 = {\n  v: 1;\n  tokenRefs: StoredTokenRef[];\n};\n\ntype AuthSessionTransitionJournalV1 = {\n  v: 1;\n  id: string;\n  state: \"pending\" | \"recovery_required\" | \"committed\";\n  ownerPid: number;\n  ownerProcessStartedAt: string;\n  previousPayload: AuthSessionV1 | null;\n  candidatePayload: AuthSessionV1;\n  candidateCredentialRefreshVersion?: 1;\n  candidateTokenRefs?: StoredTokenRef[];\n  candidateServiceProcesses?: ProcessIdentity[];\n  /** @deprecated Read and write until in-flight v1 journals from older builds expire. */\n  candidateServiceProcess?: ProcessIdentity;\n  computerHandoff?: {\n    gatewayUrl: string;\n    serviceReconciledAt?: string;\n    remoteSessionRevokedAt?: string;\n    lastRecoveryFailure?: {\n      at: string;\n      message: string;\n      phase: \"service\" | \"remote_session\" | \"local_cleanup\";\n      endpoint?: string;\n      status?: number | null;\n    };\n  };\n};\n\ntype ProcessIdentity = {\n  ownerPid: number;\n  ownerProcessStartedAt: string;\n};\n\nconst MAX_CANDIDATE_SERVICE_PROCESSES = 16;\nconst MAX_CANDIDATE_TOKEN_REFS = 64;\n\nclass AuthSessionStorageError extends Error {\n  readonly reason: \"corrupt\" | \"unreadable\";\n\n  constructor(input: {\n    message: string;\n    reason: \"corrupt\" | \"unreadable\";\n    cause?: unknown;\n  }) {\n    super(\n      input.message,\n      input.cause === undefined ? undefined : { cause: input.cause }\n    );\n    this.name = \"AuthSessionStorageError\";\n    this.reason = input.reason;\n  }\n}\n\nexport class AuthSessionRecoveryInProgressError extends Error {\n  constructor() {\n    super(\n      \"OpenMeld is still finishing an interrupted Computer sign-in recovery. The current sign-in was not changed; retry after the recovery cleanup succeeds.\"\n    );\n    this.name = \"AuthSessionRecoveryInProgressError\";\n  }\n}\n\nexport class AuthSessionChangedBeforeTransitionError extends Error {\n  readonly reason = \"previous_session_changed\" as const;\n\n  constructor() {\n    super(\n      \"The current Computer sign-in changed while OpenMeld was waiting to start this account switch. Run the setup command again to review the current account before switching. No local sign-in state was changed.\"\n    );\n    this.name = \"AuthSessionChangedBeforeTransitionError\";\n  }\n}\n\nexport class AuthSessionTransitionConflictError extends Error {\n  readonly previousOwnerRestored: boolean;\n  readonly reason:\n    | \"journal_missing\"\n    | \"journal_not_pending\"\n    | \"journal_replaced\";\n\n  constructor(input: {\n    previousOwnerRestored: boolean;\n    reason: \"journal_missing\" | \"journal_not_pending\" | \"journal_replaced\";\n  }) {\n    const conflict = {\n      journal_missing: \"missing\",\n      journal_not_pending: \"no longer pending\",\n      journal_replaced: \"owned by another sign-in\",\n    }[input.reason];\n    const outcome = input.previousOwnerRestored\n      ? \"The previous sign-in was restored.\"\n      : \"No local sign-in state was changed.\";\n    super(`The auth session transition journal is ${conflict}. ${outcome}`);\n    this.name = \"AuthSessionTransitionConflictError\";\n    this.reason = input.reason;\n    this.previousOwnerRestored = input.previousOwnerRestored;\n  }\n}\n\nexport type ClearAuthSessionResult = {\n  hadLocalSession: boolean;\n  preservedSessionPath?: string;\n};\n\nexport type StoredActiveOrganization = {\n  id: string;\n  slug: string;\n  name: string;\n  role?: string;\n  personal?: boolean;\n};\n\nexport type StoredAuthSession = {\n  v: 1;\n  accessToken: string;\n  tokenType: string;\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\nexport type AuthSessionInput = {\n  accessToken: string;\n  tokenType?: string;\n  authBaseUrl: string;\n  clientId: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization | null;\n};\n\nexport type AuthSessionTransition = {\n  previousSession: StoredAuthSession | null;\n  commit: () => Promise<void>;\n  rollback: () => Promise<void>;\n};\n\nexport type AuthSessionTransitionContext = {\n  computerHandoff?: {\n    gatewayUrl: string;\n  };\n  expectedPreviousSession?: AuthSessionMetadata | null;\n};\n\nexport type InterruptedComputerAuthSessionRecovery = {\n  gatewayUrl: string;\n  id: string;\n  previousSession: StoredAuthSession | null;\n  serviceReconciled: boolean;\n} & (\n  | { remoteSessionRevoked: true; candidateSession: null }\n  | {\n      remoteSessionRevoked: false;\n      candidateSession: StoredAuthSession & {\n        user: NonNullable<StoredAuthSession[\"user\"]> & { id: string };\n      };\n    }\n);\n\nexport type AuthSessionState =\n  | \"missing\"\n  | \"valid\"\n  | \"expired\"\n  | \"invalid\"\n  | \"revoked\";\n\nexport type AuthSessionStateReasonCode =\n  | \"remote_session_invalid\"\n  | \"remote_session_revoked\"\n  | \"session_expired\"\n  | \"session_expiry_invalid\"\n  | \"session_metadata_invalid\"\n  | \"session_missing\"\n  | \"session_token_missing\"\n  | \"session_token_ref_invalid\"\n  | \"session_token_unavailable\";\n\nexport type AuthSessionStateResult = {\n  errorMessage?: string;\n  reasonCode?: AuthSessionStateReasonCode;\n  state: AuthSessionState;\n  session: StoredAuthSession | null;\n};\n\nexport type AuthSessionMetadata = {\n  authBaseUrl: string;\n  clientId: string;\n  createdAt: string;\n  expiresAt?: string;\n  scope?: string;\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n  activeOrganization?: StoredActiveOrganization;\n};\n\ntype GetAuthSessionStateOptions = {\n  // Keep normal requests local-first, but let the server recover a stale local\n  // expiry before callers stop attaching an otherwise usable credential.\n  refreshExpired?: boolean;\n  // Ask the server to validate even a locally current session.\n  validateRemote?: boolean;\n};\n\ntype LocalAuthSessionState =\n  | {\n      errorMessage?: string;\n      reasonCode: Exclude<\n        AuthSessionStateReasonCode,\n        \"remote_session_invalid\" | \"remote_session_revoked\" | \"session_expired\"\n      >;\n      state: \"missing\" | \"invalid\";\n      session: null;\n    }\n  | {\n      reasonCode: \"session_expired\";\n      state: \"expired\";\n      session: StoredAuthSession;\n    }\n  | {\n      state: \"valid\";\n      session: StoredAuthSession;\n    };\n\ntype RemoteAuthSessionState = \"valid\" | \"invalid\" | \"revoked\" | \"unknown\";\ntype RemoteAuthSessionValidation =\n  | {\n      accessToken?: string;\n      expiresAt?: string;\n      state: \"valid\";\n    }\n  | {\n      state: Exclude<RemoteAuthSessionState, \"valid\">;\n    };\nconst TRAILING_SLASHES_RE = /\\/+$/u;\n\ntype CachedAuthSession = {\n  payloadKey: string;\n  session: StoredAuthSession;\n};\n\nlet cachedAuthSession: CachedAuthSession | null = null;\nconst activeAuthSessionTransitionIds = new Set<string>();\n\nexport async function getAuthSessionState(\n  options: GetAuthSessionStateOptions = {}\n): Promise<AuthSessionStateResult> {\n  return await getAuthSessionStateWithCandidateRefreshFence(options, false);\n}\n\nasync function getAuthSessionStateWithCandidateRefreshFence(\n  options: GetAuthSessionStateOptions,\n  candidateRefreshFenceHeld: boolean\n): Promise<AuthSessionStateResult> {\n  const localState = await getLocalAuthSessionState();\n  const localPayloadKey = cachedAuthSession?.payloadKey ?? null;\n  const shouldValidateRemote =\n    options.validateRemote === true ||\n    (options.refreshExpired === true && localState.state === \"expired\");\n  switch (localState.state) {\n    case \"missing\":\n    case \"invalid\":\n      return localState;\n    case \"expired\":\n      if (!shouldValidateRemote) {\n        return localState;\n      }\n      break;\n    case \"valid\":\n      break;\n    default:\n      return localState;\n  }\n  if (!shouldValidateRemote) {\n    return localState;\n  }\n  if (\n    !candidateRefreshFenceHeld &&\n    (await shouldFencePendingCandidateRemoteValidation())\n  ) {\n    return await withAuthSessionCandidateRefreshLock(\n      async () =>\n        await getAuthSessionStateWithCandidateRefreshFence(options, true)\n    );\n  }\n\n  const remoteValidation = await getRemoteAuthSessionState(localState.session);\n  if (remoteValidation.state === \"valid\") {\n    return await resolveRemotelyValidatedAuthSession({\n      localPayloadKey,\n      localState,\n      remoteValidation,\n    });\n  }\n  if (remoteValidation.state === \"unknown\") {\n    if (localState.state === \"expired\" && options.refreshExpired === true) {\n      // A stale local timestamp is not authorization truth. Preserve the\n      // session so the shared request-attachment owner can reject the known\n      // expiry without discarding credentials that a later refresh may renew.\n      return {\n        state: \"valid\",\n        session: localState.session,\n      };\n    }\n    return localState;\n  }\n\n  return {\n    reasonCode: resolveRemoteAuthSessionReasonCode(remoteValidation.state),\n    state: remoteValidation.state,\n    session: null,\n  };\n}\n\nasync function shouldFencePendingCandidateRemoteValidation(): Promise<boolean> {\n  const journal = await readAuthSessionTransitionJournal();\n  return Boolean(\n    journal?.state === \"pending\" &&\n      journal.candidateCredentialRefreshVersion === 1 &&\n      isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal)\n  );\n}\n\nasync function resolveRemotelyValidatedAuthSession(input: {\n  localPayloadKey: string | null;\n  localState: Extract<LocalAuthSessionState, { state: \"expired\" | \"valid\" }>;\n  remoteValidation: Extract<RemoteAuthSessionValidation, { state: \"valid\" }>;\n}): Promise<AuthSessionStateResult> {\n  if (\n    !input.remoteValidation.expiresAt ||\n    isExpired(input.remoteValidation.expiresAt)\n  ) {\n    return input.localState;\n  }\n\n  let refreshedSession: StoredAuthSession | null;\n  try {\n    refreshedSession = await persistRemoteSessionRefresh({\n      accessToken:\n        input.remoteValidation.accessToken ??\n        input.localState.session.accessToken,\n      expectedPayloadKey: input.localPayloadKey,\n      expiresAt: input.remoteValidation.expiresAt,\n      previousAccessToken: input.localState.session.accessToken,\n    });\n  } catch (error) {\n    if (!(error instanceof AuthSessionRecoveryInProgressError)) {\n      throw error;\n    }\n    // Remote validation already proved this exact in-memory session is valid.\n    // Another process may still own the Computer handoff transaction, so this\n    // reader cannot persist the refreshed token or expiry yet. Keep using the\n    // validated session in memory instead of falling back to the committed\n    // session file, which is intentionally absent on a fresh Computer.\n    return {\n      state: \"valid\",\n      session: {\n        ...input.localState.session,\n        accessToken:\n          input.remoteValidation.accessToken ??\n          input.localState.session.accessToken,\n        expiresAt: input.remoteValidation.expiresAt,\n      },\n    };\n  }\n\n  if (!refreshedSession) {\n    return await getLocalAuthSessionState();\n  }\n  return {\n    state: \"valid\",\n    session: refreshedSession,\n  };\n}\n\n// The signed-in owner user id from the local session, or null when signed\n// out. Callers use this as the expected owner for service account-alignment\n// checks; it never validates remotely.\nexport async function getCurrentAuthOwnerUserId(): Promise<string | null> {\n  const authState = await getAuthSessionState({\n    validateRemote: false,\n  }).catch(() => null);\n  const ownerUserId = authState?.session?.user?.id?.trim() ?? \"\";\n  return ownerUserId.length > 0 ? ownerUserId : null;\n}\n\nexport async function setAuthSession(input: AuthSessionInput): Promise<void> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    await retryPendingTokenCleanup();\n\n    const previousPayload = await readSessionPayloadFile();\n    const previousTokenRef = normalizeTokenRef(previousPayload?.tokenRef);\n    const tokenRef = await storeAccessToken({\n      accessToken,\n      authBaseUrl,\n      clientId,\n    });\n\n    const payload: AuthSessionV1 = {\n      v: 1,\n      tokenRef,\n      tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n      authBaseUrl,\n      clientId,\n      createdAt: new Date().toISOString(),\n      ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n      ...(input.scope ? { scope: input.scope } : {}),\n      ...buildAuthUserPayload(input.user),\n      ...buildActiveOrganizationPayload(input.activeOrganization),\n    };\n\n    const path = authSessionPath();\n    await ensureAuthSessionDirectory();\n\n    try {\n      await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n      await writeSessionPayloadAtomically(path, payload);\n    } catch (error) {\n      await deleteAccessTokenOrRetainForCleanup(tokenRef);\n      throw error;\n    }\n\n    cacheAuthSession({\n      payload,\n      session: buildStoredAuthSession({ accessToken, payload }),\n    });\n    if (\n      previousTokenRef &&\n      !areStoredTokenRefsEqual(previousTokenRef, tokenRef)\n    ) {\n      await deleteAccessTokenOrRetainForCleanup(previousTokenRef);\n    }\n  });\n}\n\nexport async function beginAuthSessionTransition(\n  input: AuthSessionInput,\n  context: AuthSessionTransitionContext = {}\n): Promise<AuthSessionTransition> {\n  const accessToken = String(input.accessToken ?? \"\").trim();\n  if (!accessToken) {\n    throw new Error(\"access token is required\");\n  }\n  const authBaseUrl = String(input.authBaseUrl ?? \"\").trim();\n  if (!authBaseUrl) {\n    throw new Error(\"auth base URL is required\");\n  }\n  const clientId = String(input.clientId ?? \"\").trim();\n  if (!clientId) {\n    throw new Error(\"client_id is required\");\n  }\n\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    await retryPendingTokenCleanup();\n    await ensureAuthSessionDirectory();\n    const previousPayload = await readSessionPayloadFile();\n    const previousState = await getLocalAuthSessionState({ recover: false });\n    const previousSession =\n      previousState.state === \"valid\" || previousState.state === \"expired\"\n        ? previousState.session\n        : null;\n    assertExpectedPreviousSession({\n      current: buildAuthSessionMetadata(previousPayload),\n      expected: context.expectedPreviousSession,\n    });\n    const tokenRef = await storeAccessToken({\n      accessToken,\n      authBaseUrl,\n      clientId,\n      unique: true,\n    });\n    const nextPayload: AuthSessionV1 = {\n      v: 1,\n      tokenRef,\n      tokenType: String(input.tokenType ?? \"Bearer\").trim() || \"Bearer\",\n      authBaseUrl,\n      clientId,\n      createdAt: new Date().toISOString(),\n      ...(input.expiresAt ? { expiresAt: input.expiresAt } : {}),\n      ...(input.scope ? { scope: input.scope } : {}),\n      ...buildAuthUserPayload(input.user),\n      ...buildActiveOrganizationPayload(input.activeOrganization),\n    };\n    const journal: AuthSessionTransitionJournalV1 = {\n      v: 1,\n      id: randomUUID(),\n      state: \"pending\",\n      ownerPid: process.pid,\n      ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n      previousPayload:\n        previousPayload?.v === 1 ? (previousPayload as AuthSessionV1) : null,\n      candidatePayload: nextPayload,\n      candidateCredentialRefreshVersion: 1,\n      candidateTokenRefs: [tokenRef],\n      ...(context.computerHandoff\n        ? {\n            computerHandoff: {\n              gatewayUrl: context.computerHandoff.gatewayUrl,\n            },\n          }\n        : {}),\n    };\n    let journalClaimed = false;\n    try {\n      await assertStoredAccessTokenReloads({ accessToken, tokenRef });\n      await claimAuthSessionTransitionJournal(journal);\n      journalClaimed = true;\n      activeAuthSessionTransitionIds.add(journal.id);\n    } catch (error) {\n      activeAuthSessionTransitionIds.delete(journal.id);\n      if (journalClaimed) {\n        await restoreTransitionPreviousPayload(journal).catch(() => undefined);\n        await removeAuthSessionTransitionJournalIfOwned(journal).catch(\n          () => undefined\n        );\n      }\n      await deleteAccessTokenOrRetainForCleanup(tokenRef);\n      throw error;\n    }\n    cacheAuthSession({\n      payload: nextPayload,\n      session: buildStoredAuthSession({ accessToken, payload: nextPayload }),\n    });\n\n    let settlement: \"committed\" | \"pending\" | \"rolled_back\" = \"pending\";\n    const assertTransitionPending = () => {\n      if (settlement !== \"pending\") {\n        throw new Error(\"auth session transition is already settled\");\n      }\n    };\n    const isPreviousSessionCurrent = (\n      currentPayload: Partial<AuthSessionV1> | null\n    ) => {\n      if (!journal.previousPayload) {\n        return currentPayload === null;\n      }\n      return (\n        currentPayload?.v === 1 &&\n        buildAuthSessionPayloadKey(currentPayload) ===\n          buildAuthSessionPayloadKey(journal.previousPayload)\n      );\n    };\n    const isCandidateSessionCurrent = (\n      currentPayload: Partial<AuthSessionV1> | null,\n      candidatePayload: Partial<AuthSessionV1> = nextPayload\n    ) =>\n      currentPayload?.v === 1 &&\n      buildAuthSessionPayloadKey(currentPayload) ===\n        buildAuthSessionPayloadKey(candidatePayload);\n    const assertPreviousSessionCurrent = async () => {\n      const currentPayload = await readSessionPayloadFile();\n      if (!isPreviousSessionCurrent(currentPayload)) {\n        throw new Error(\n          \"auth session changed before the setup transition completed\"\n        );\n      }\n    };\n    const assertTransitionSessionCurrent = async (\n      candidatePayload: Partial<AuthSessionV1> = nextPayload\n    ) => {\n      const currentPayload = await readSessionPayloadFile();\n      if (\n        !(\n          isPreviousSessionCurrent(currentPayload) ||\n          isCandidateSessionCurrent(currentPayload, candidatePayload)\n        )\n      ) {\n        throw new Error(\n          \"auth session changed before the setup transition completed\"\n        );\n      }\n    };\n    const restoreMissingJournalTransition = async () => {\n      const currentPayload = await readSessionPayloadFile();\n      if (\n        !(\n          isPreviousSessionCurrent(currentPayload) ||\n          isCandidateSessionCurrent(currentPayload)\n        )\n      ) {\n        try {\n          await cleanupTransitionTokensNotReferencedByCurrentSession({\n            currentPayload,\n            journal,\n          });\n        } finally {\n          activeAuthSessionTransitionIds.delete(journal.id);\n        }\n        throw new AuthSessionTransitionConflictError({\n          previousOwnerRestored: false,\n          reason: \"journal_missing\",\n        });\n      }\n\n      await claimAuthSessionTransitionJournal(journal);\n      try {\n        await restoreTransitionPreviousPayload(journal, previousSession);\n        settlement = \"rolled_back\";\n        await deleteAccessTokenOrRetainForCleanup(tokenRef).catch(\n          (error: unknown) => {\n            logDeferredAuthSessionTransitionCleanup({\n              error,\n              transitionId: journal.id,\n            });\n          }\n        );\n      } finally {\n        activeAuthSessionTransitionIds.delete(journal.id);\n        await removeAuthSessionTransitionJournalIfOwned(journal);\n      }\n    };\n\n    return {\n      previousSession,\n      commit: async () =>\n        await withAuthSessionTransitionMutationLock(async () => {\n          assertTransitionPending();\n          const currentJournal =\n            await readOwnedPendingAuthSessionTransition(journal);\n          if (currentJournal.status === \"missing\") {\n            await restoreMissingJournalTransition();\n            throw new AuthSessionTransitionConflictError({\n              previousOwnerRestored: true,\n              reason: \"journal_missing\",\n            });\n          }\n          if (currentJournal.status !== \"current\") {\n            activeAuthSessionTransitionIds.delete(journal.id);\n            throw new AuthSessionTransitionConflictError({\n              previousOwnerRestored: false,\n              reason: currentJournal.status,\n            });\n          }\n          const committedPayload = currentJournal.journal.candidatePayload;\n          const committedSession =\n            await readStoredAuthSessionFromPayload(committedPayload);\n          await assertPreviousSessionCurrent();\n          await writeSessionPayloadAtomically(\n            authSessionPath(),\n            committedPayload\n          );\n          cacheAuthSession({\n            payload: committedPayload,\n            session: committedSession,\n          });\n          const committedJournal: AuthSessionTransitionJournalV1 = {\n            ...currentJournal.journal,\n            state: \"committed\",\n          };\n          await writeAuthSessionTransitionJournalIfOwned(\n            currentJournal.journal,\n            committedJournal\n          );\n          settlement = \"committed\";\n          activeAuthSessionTransitionIds.delete(journal.id);\n          await finalizeCommittedAuthSessionTransition(committedJournal).catch(\n            (error: unknown) => {\n              logDeferredAuthSessionTransitionCleanup({\n                error,\n                transitionId: journal.id,\n              });\n            }\n          );\n        }),\n      rollback: async () =>\n        await withAuthSessionTransitionMutationLock(async () => {\n          if (settlement === \"rolled_back\") {\n            return;\n          }\n          assertTransitionPending();\n          const currentJournal =\n            await readOwnedPendingAuthSessionTransition(journal);\n          if (currentJournal.status === \"missing\") {\n            await restoreMissingJournalTransition();\n            return;\n          }\n          if (currentJournal.status !== \"current\") {\n            activeAuthSessionTransitionIds.delete(journal.id);\n            throw new AuthSessionTransitionConflictError({\n              previousOwnerRestored: false,\n              reason: currentJournal.status,\n            });\n          }\n          await assertTransitionSessionCurrent(\n            currentJournal.journal.candidatePayload\n          );\n          await restoreTransitionPreviousPayload(\n            currentJournal.journal,\n            previousSession\n          );\n          settlement = \"rolled_back\";\n          activeAuthSessionTransitionIds.delete(journal.id);\n          stopRegisteredCandidateService(currentJournal.journal);\n          if (currentJournal.journal.computerHandoff) {\n            await writeAuthSessionTransitionJournalIfOwned(\n              currentJournal.journal,\n              {\n                ...currentJournal.journal,\n                state: \"recovery_required\",\n              }\n            );\n            return;\n          }\n          await cleanupCandidateTokenRefs(currentJournal.journal);\n          await removeAuthSessionTransitionJournalIfOwned(\n            currentJournal.journal\n          );\n        }),\n    };\n  });\n}\n\ntype OwnedPendingAuthSessionTransition =\n  | { status: \"current\"; journal: AuthSessionTransitionJournalV1 }\n  | { status: \"missing\" }\n  | { status: \"journal_not_pending\"; journal: AuthSessionTransitionJournalV1 }\n  | { status: \"journal_replaced\"; journal: AuthSessionTransitionJournalV1 };\n\nasync function readOwnedPendingAuthSessionTransition(\n  expected: AuthSessionTransitionJournalV1\n): Promise<OwnedPendingAuthSessionTransition> {\n  const currentJournal = await readAuthSessionTransitionJournal();\n  if (!currentJournal) {\n    return { status: \"missing\" };\n  }\n  if (!hasSameAuthSessionTransitionIdentity(expected, currentJournal)) {\n    return { status: \"journal_replaced\", journal: currentJournal };\n  }\n  if (currentJournal.state !== \"pending\") {\n    return { status: \"journal_not_pending\", journal: currentJournal };\n  }\n  return { status: \"current\", journal: currentJournal };\n}\n\nexport async function getInterruptedComputerAuthSessionRecovery(): Promise<InterruptedComputerAuthSessionRecovery | null> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await recoverInterruptedAuthSessionTransitionWithOwnership();\n    const journal = await readAuthSessionTransitionJournal();\n    if (!(journal?.state === \"recovery_required\" && journal.computerHandoff)) {\n      return null;\n    }\n\n    // Revocation is durable. Finishing local cleanup must not require reading\n    // a credential that has already been revoked (and may already be deleted).\n    if (journal.computerHandoff.remoteSessionRevokedAt) {\n      if (journal.computerHandoff.serviceReconciledAt) {\n        await cleanupCandidateTokenRefs(journal);\n        await removeAuthSessionTransitionJournalIfOwned(journal);\n        return null;\n      }\n      return {\n        candidateSession: null,\n        gatewayUrl: journal.computerHandoff.gatewayUrl,\n        id: journal.id,\n        previousSession: await readRecoverablePreviousSession(\n          journal.previousPayload\n        ),\n        remoteSessionRevoked: true,\n        serviceReconciled: Boolean(journal.computerHandoff.serviceReconciledAt),\n      };\n    }\n\n    const candidateSession = await readStoredAuthSessionFromPayloadIfPresent(\n      journal.candidatePayload\n    );\n    if (!candidateSession) {\n      throw new AuthSessionStorageError({\n        message: \"auth session recovery token is missing\",\n        reason: \"corrupt\",\n      });\n    }\n    const candidateOwnerUserId = normalizeOptionalString(\n      candidateSession.user?.id\n    );\n    if (!candidateOwnerUserId) {\n      throw new AuthSessionStorageError({\n        message:\n          \"computer auth recovery candidate is missing its owner user id\",\n        reason: \"corrupt\",\n      });\n    }\n\n    return {\n      candidateSession: {\n        ...candidateSession,\n        user: { ...candidateSession.user, id: candidateOwnerUserId },\n      },\n      gatewayUrl: journal.computerHandoff.gatewayUrl,\n      id: journal.id,\n      previousSession: await readRecoverablePreviousSession(\n        journal.previousPayload\n      ),\n      remoteSessionRevoked: false,\n      serviceReconciled: Boolean(journal.computerHandoff.serviceReconciledAt),\n    };\n  });\n}\n\nexport async function markInterruptedComputerAuthSessionRecovery(input: {\n  id: string;\n  phase: \"service\" | \"remote_session\";\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    const journal = await readRequiredComputerAuthRecoveryJournal(input.id);\n    await writeAuthSessionTransitionJournalIfOwned(journal, {\n      ...journal,\n      computerHandoff: {\n        ...journal.computerHandoff,\n        ...(input.phase === \"service\"\n          ? { serviceReconciledAt: new Date().toISOString() }\n          : { remoteSessionRevokedAt: new Date().toISOString() }),\n        lastRecoveryFailure: undefined,\n      },\n    });\n  });\n}\n\nexport async function recordInterruptedComputerAuthSessionRecoveryFailure(input: {\n  endpoint?: string;\n  id: string;\n  message: string;\n  phase: \"service\" | \"remote_session\" | \"local_cleanup\";\n  status?: number | null;\n}): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    await recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership(\n      input\n    );\n  });\n}\n\nasync function recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership(input: {\n  endpoint?: string;\n  id: string;\n  message: string;\n  phase: \"service\" | \"remote_session\" | \"local_cleanup\";\n  status?: number | null;\n}): Promise<void> {\n  const journal = await readRequiredComputerAuthRecoveryJournal(input.id);\n  await writeAuthSessionTransitionJournalIfOwned(journal, {\n    ...journal,\n    computerHandoff: {\n      ...journal.computerHandoff,\n      lastRecoveryFailure: {\n        at: new Date().toISOString(),\n        message: input.message,\n        phase: input.phase,\n        ...(input.endpoint ? { endpoint: input.endpoint } : {}),\n        ...(input.status === undefined ? {} : { status: input.status }),\n      },\n    },\n  });\n}\n\nexport async function completeInterruptedComputerAuthSessionRecovery(\n  id: string\n): Promise<boolean> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    const journal = await readRequiredComputerAuthRecoveryJournal(id);\n    if (\n      !(\n        journal.computerHandoff.serviceReconciledAt &&\n        journal.computerHandoff.remoteSessionRevokedAt\n      )\n    ) {\n      throw new Error(\n        \"computer auth recovery cannot complete before service and remote-session cleanup\"\n      );\n    }\n    try {\n      await cleanupCandidateTokenRefs(journal);\n      await removeAuthSessionTransitionJournalIfOwned(journal);\n      return true;\n    } catch (error) {\n      await recordInterruptedComputerAuthSessionRecoveryFailureWithOwnership({\n        id,\n        message: toErrorMessage(error),\n        phase: \"local_cleanup\",\n      }).catch(() => undefined);\n      logDeferredAuthSessionTransitionCleanup({ error, transitionId: id });\n      return false;\n    }\n  });\n}\n\nexport async function getAuthSession(): Promise<StoredAuthSession | null> {\n  const localState = await getLocalAuthSessionState();\n  if (localState.state === \"missing\" || localState.state === \"invalid\") {\n    return null;\n  }\n  return localState.session;\n}\n\nexport async function getAuthSessionMetadata(): Promise<AuthSessionMetadata | null> {\n  const payload = await readSessionPayload();\n  return buildAuthSessionMetadata(payload);\n}\n\nfunction buildAuthSessionMetadata(\n  payload: Partial<AuthSessionV1> | null\n): AuthSessionMetadata | null {\n  if (payload?.v !== 1) {\n    return null;\n  }\n\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(authBaseUrl && clientId && createdAt)) {\n    return null;\n  }\n\n  return {\n    authBaseUrl,\n    clientId,\n    createdAt,\n    ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n      ? { expiresAt: payload.expiresAt.trim() }\n      : {}),\n    ...(typeof payload.scope === \"string\" && payload.scope.trim()\n      ? { scope: payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(payload.user),\n    ...buildActiveOrganizationPayload(payload.activeOrganization),\n  };\n}\n\nexport async function updateAuthSessionActiveOrganization(\n  activeOrganization: StoredActiveOrganization | null\n): Promise<void> {\n  await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    const payload = await readSessionPayloadFile();\n    if (payload?.v !== 1) {\n      throw new Error(\"cannot update active organization without auth session\");\n    }\n\n    const tokenRef = normalizeTokenRef(payload.tokenRef);\n    const tokenType = normalizeOptionalString(payload.tokenType);\n    const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n    const clientId = normalizeOptionalString(payload.clientId);\n    const createdAt = normalizeOptionalString(payload.createdAt);\n    if (!(tokenRef && tokenType && authBaseUrl && clientId && createdAt)) {\n      throw new Error(\n        \"cannot update active organization for invalid auth session\"\n      );\n    }\n\n    const nextPayload: AuthSessionV1 = {\n      v: 1,\n      tokenRef,\n      tokenType,\n      authBaseUrl,\n      clientId,\n      createdAt,\n      ...(typeof payload.expiresAt === \"string\" && payload.expiresAt.trim()\n        ? { expiresAt: payload.expiresAt.trim() }\n        : {}),\n      ...(typeof payload.scope === \"string\" && payload.scope.trim()\n        ? { scope: payload.scope.trim() }\n        : {}),\n      ...buildAuthUserPayload(payload.user),\n      ...buildActiveOrganizationPayload(activeOrganization),\n    };\n\n    await writeSessionPayloadAtomically(authSessionPath(), nextPayload);\n    const currentCachedSession = readCachedAuthSession(payload);\n    if (currentCachedSession) {\n      cacheAuthSession({\n        payload: nextPayload,\n        session: buildStoredAuthSession({\n          accessToken: currentCachedSession.accessToken,\n          payload: nextPayload,\n        }),\n      });\n    }\n  });\n}\n\nexport async function clearAuthSession(): Promise<ClearAuthSessionResult> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await assertAuthSessionMutationAvailableWithOwnership();\n    cachedAuthSession = null;\n    await retryPendingTokenCleanup();\n    const hadLocalSession = await authSessionFileExists();\n    let payload: Partial<AuthSessionV1> | null;\n    try {\n      payload = await readSessionPayloadFile();\n    } catch (error) {\n      if (\n        !(\n          error instanceof AuthSessionStorageError && error.reason === \"corrupt\"\n        )\n      ) {\n        throw error;\n      }\n      // Explicit logout may recover malformed metadata, but must preserve the\n      // original evidence and never guess which Keychain item it referred to.\n      const preservedSessionPath = join(\n        openMeldRootDir(),\n        \"auth\",\n        `session-corrupt-${randomUUID()}.json`\n      );\n      await rename(authSessionPath(), preservedSessionPath);\n      return { hadLocalSession, preservedSessionPath };\n    }\n    if (payload?.v === 1 && isStoredTokenRef(payload.tokenRef)) {\n      await deleteAccessTokenOrRetainForCleanup(payload.tokenRef);\n    }\n    await removeSessionFile();\n    return { hadLocalSession };\n  });\n}\n\nexport async function assertAuthSessionMutationAvailable(): Promise<void> {\n  await withAuthSessionTransitionMutationLock(\n    assertAuthSessionMutationAvailableWithOwnership\n  );\n}\n\nasync function assertAuthSessionMutationAvailableWithOwnership(): Promise<void> {\n  await recoverInterruptedAuthSessionTransitionWithOwnership();\n  if (await readAuthSessionTransitionJournal()) {\n    throw new AuthSessionRecoveryInProgressError();\n  }\n}\n\nasync function retryPendingTokenCleanup(): Promise<void> {\n  const pending = await readPendingTokenCleanup();\n  if (pending.tokenRefs.length === 0) {\n    return;\n  }\n\n  const remaining: StoredTokenRef[] = [];\n  for (const tokenRef of pending.tokenRefs) {\n    try {\n      await deleteAccessToken(tokenRef);\n    } catch {\n      remaining.push(tokenRef);\n    }\n  }\n  await persistPendingTokenCleanup(remaining);\n}\n\nasync function deleteAccessTokenOrRetainForCleanup(\n  tokenRef: StoredTokenRef\n): Promise<void> {\n  try {\n    await deleteAccessToken(tokenRef);\n  } catch {\n    const pending = await readPendingTokenCleanup();\n    if (\n      pending.tokenRefs.some((ref) => areStoredTokenRefsEqual(ref, tokenRef))\n    ) {\n      return;\n    }\n    await persistPendingTokenCleanup([...pending.tokenRefs, tokenRef]);\n  }\n}\n\nasync function readPendingTokenCleanup(): Promise<PendingTokenCleanupV1> {\n  const raw = await readFile(pendingTokenCleanupPath(), \"utf8\").catch(\n    (error) => {\n      if (isFileNotFoundError(error)) {\n        return null;\n      }\n      throw error;\n    }\n  );\n  if (raw === null) {\n    return { v: 1, tokenRefs: [] };\n  }\n\n  let parsed: unknown;\n  try {\n    parsed = JSON.parse(raw);\n  } catch {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  if (\n    !(isRecord(parsed) && parsed.v === 1 && Array.isArray(parsed.tokenRefs))\n  ) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  const tokenRefs = parsed.tokenRefs.filter(isStoredTokenRef);\n  if (tokenRefs.length !== parsed.tokenRefs.length) {\n    throw new Error(\"pending access-token cleanup state is invalid\");\n  }\n  return { v: 1, tokenRefs };\n}\n\nasync function persistPendingTokenCleanup(\n  tokenRefs: StoredTokenRef[]\n): Promise<void> {\n  const path = pendingTokenCleanupPath();\n  if (tokenRefs.length === 0) {\n    await rm(path, { force: true });\n    return;\n  }\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n  await writeJsonAtomically(path, { v: 1, tokenRefs });\n}\n\nfunction pendingTokenCleanupPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"pending-token-cleanup.json\");\n}\n\nasync function authSessionFileExists(): Promise<boolean> {\n  try {\n    await readFile(authSessionPath(), \"utf8\");\n    return true;\n  } catch (error) {\n    if (isFileNotFoundError(error)) {\n      return false;\n    }\n    throw error;\n  }\n}\n\nasync function getLocalAuthSessionState(\n  options: { recover?: boolean } = {}\n): Promise<LocalAuthSessionState> {\n  let payload: Partial<AuthSessionV1> | null;\n  try {\n    payload =\n      options.recover === false\n        ? await readSessionPayloadFile()\n        : await readSessionPayload();\n  } catch (error) {\n    if (error instanceof AuthSessionStorageError) {\n      return {\n        errorMessage: error.message,\n        reasonCode: \"session_metadata_invalid\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    throw error;\n  }\n  if (payload?.v !== 1) {\n    return {\n      reasonCode: \"session_missing\",\n      state: \"missing\",\n      session: null,\n    };\n  }\n\n  const tokenRef = normalizeTokenRef(payload.tokenRef);\n  if (!tokenRef) {\n    return {\n      reasonCode: \"session_token_ref_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  const tokenType = normalizeOptionalString(payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(payload.authBaseUrl);\n  const clientId = normalizeOptionalString(payload.clientId);\n  const createdAt = normalizeOptionalString(payload.createdAt);\n  if (!(tokenType && authBaseUrl && clientId && createdAt)) {\n    return {\n      reasonCode: \"session_metadata_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n\n  let session = readCachedAuthSession(payload);\n  if (!session) {\n    const accessToken = await readAccessToken(tokenRef);\n    if (accessToken.status === \"missing\") {\n      return {\n        reasonCode: \"session_token_missing\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    if (accessToken.status === \"unavailable\") {\n      return {\n        errorMessage: accessToken.errorMessage,\n        reasonCode: \"session_token_unavailable\",\n        state: \"invalid\",\n        session: null,\n      };\n    }\n    session = buildStoredAuthSession({\n      accessToken: accessToken.accessToken,\n      payload: {\n        ...payload,\n        v: 1,\n        tokenRef,\n        tokenType,\n        authBaseUrl,\n        clientId,\n        createdAt,\n      },\n    });\n    cacheAuthSession({ payload, session });\n  }\n\n  const expiryEligibility = resolveAuthSessionExpiryEligibility(\n    session.expiresAt\n  );\n  if (expiryEligibility.status === \"invalid\") {\n    return {\n      reasonCode: \"session_expiry_invalid\",\n      state: \"invalid\",\n      session: null,\n    };\n  }\n  if (expiryEligibility.status === \"expired\") {\n    return {\n      reasonCode: \"session_expired\",\n      state: \"expired\",\n      session,\n    };\n  }\n\n  return {\n    state: \"valid\",\n    session,\n  };\n}\n\nasync function assertStoredAccessTokenReloads(input: {\n  accessToken: string;\n  tokenRef: StoredTokenRef;\n}): Promise<void> {\n  const reloaded = await readAccessToken(input.tokenRef);\n  if (\n    reloaded.status === \"found\" &&\n    reloaded.accessToken === input.accessToken\n  ) {\n    return;\n  }\n  if (reloaded.status === \"unavailable\") {\n    throw new Error(\n      `stored access token could not be reloaded: ${reloaded.errorMessage}`\n    );\n  }\n  throw new Error(\"stored access token could not be reloaded\");\n}\n\nfunction buildStoredAuthSession(input: {\n  accessToken: string;\n  payload: AuthSessionV1;\n}): StoredAuthSession {\n  return {\n    v: 1,\n    accessToken: input.accessToken,\n    tokenType: input.payload.tokenType,\n    authBaseUrl: input.payload.authBaseUrl,\n    clientId: input.payload.clientId,\n    createdAt: input.payload.createdAt,\n    ...(typeof input.payload.expiresAt === \"string\" &&\n    input.payload.expiresAt.trim()\n      ? { expiresAt: input.payload.expiresAt.trim() }\n      : {}),\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n}\n\nfunction assertExpectedPreviousSession(input: {\n  current: AuthSessionMetadata | null;\n  expected: AuthSessionMetadata | null | undefined;\n}): void {\n  if (input.expected === undefined) {\n    return;\n  }\n  if (\n    buildStoredAuthSessionIdentity(input.current) !==\n    buildStoredAuthSessionIdentity(input.expected)\n  ) {\n    throw new AuthSessionChangedBeforeTransitionError();\n  }\n}\n\nfunction buildStoredAuthSessionIdentity(\n  session: AuthSessionMetadata | null\n): string {\n  if (!session) {\n    return \"missing\";\n  }\n  // Token rotation, expiry refresh, display metadata, and Organization\n  // selection do not change the signed-in Computer session the user reviewed.\n  // createdAt changes on every committed login, while user.id catches a real\n  // cross-account replacement even if two sessions are created together.\n  const identitySource = JSON.stringify([\n    session.authBaseUrl,\n    session.clientId,\n    session.createdAt,\n    session.user?.id ?? null,\n  ]);\n  return createHash(\"sha256\").update(identitySource).digest(\"base64url\");\n}\n\nasync function cleanupTransitionTokensNotReferencedByCurrentSession(input: {\n  currentPayload: Partial<AuthSessionV1> | null;\n  journal: AuthSessionTransitionJournalV1;\n}): Promise<void> {\n  const currentTokenRef = normalizeTokenRef(input.currentPayload?.tokenRef);\n  const previousTokenRef = normalizeTokenRef(\n    input.journal.previousPayload?.tokenRef\n  );\n  const transitionTokenRefs = [\n    ...(previousTokenRef ? [previousTokenRef] : []),\n    ...getCandidateTokenRefs(input.journal),\n  ];\n\n  for (const [index, tokenRef] of transitionTokenRefs.entries()) {\n    const alreadyHandled = transitionTokenRefs\n      .slice(0, index)\n      .some((previousRef) => areStoredTokenRefsEqual(previousRef, tokenRef));\n    if (\n      alreadyHandled ||\n      (currentTokenRef && areStoredTokenRefsEqual(currentTokenRef, tokenRef))\n    ) {\n      continue;\n    }\n    await deleteAccessTokenOrRetainForCleanup(tokenRef);\n  }\n}\n\nfunction cacheAuthSession(input: {\n  payload: Partial<AuthSessionV1>;\n  session: StoredAuthSession;\n}): void {\n  cachedAuthSession = {\n    payloadKey: buildAuthSessionPayloadKey(input.payload),\n    session: input.session,\n  };\n}\n\nfunction readCachedAuthSession(\n  payload: Partial<AuthSessionV1>\n): StoredAuthSession | null {\n  const payloadKey = buildAuthSessionPayloadKey(payload);\n  return cachedAuthSession?.payloadKey === payloadKey\n    ? cachedAuthSession.session\n    : null;\n}\n\nfunction buildAuthSessionPayloadKey(payload: Partial<AuthSessionV1>): string {\n  return `${authSessionPath()}\\n${JSON.stringify(payload)}`;\n}\n\nfunction areStoredTokenRefsEqual(\n  left: StoredTokenRef,\n  right: StoredTokenRef\n): boolean {\n  return JSON.stringify(left) === JSON.stringify(right);\n}\n\nfunction getUniqueTokenRefs(tokenRefs: StoredTokenRef[]): StoredTokenRef[] {\n  const uniqueTokenRefs: StoredTokenRef[] = [];\n  for (const tokenRef of tokenRefs) {\n    if (\n      !uniqueTokenRefs.some((existing) =>\n        areStoredTokenRefsEqual(existing, tokenRef)\n      )\n    ) {\n      uniqueTokenRefs.push(tokenRef);\n    }\n  }\n  return uniqueTokenRefs;\n}\n\nfunction getCandidateTokenRefs(\n  journal: AuthSessionTransitionJournalV1\n): StoredTokenRef[] {\n  return getUniqueTokenRefs([\n    ...(journal.candidateTokenRefs ?? []),\n    journal.candidatePayload.tokenRef,\n  ]);\n}\n\nasync function cleanupCandidateTokenRefs(\n  journal: AuthSessionTransitionJournalV1,\n  keepTokenRef?: StoredTokenRef\n): Promise<void> {\n  for (const tokenRef of getCandidateTokenRefs(journal)) {\n    if (keepTokenRef && areStoredTokenRefsEqual(keepTokenRef, tokenRef)) {\n      continue;\n    }\n    await deleteAccessTokenOrRetainForCleanup(tokenRef);\n  }\n}\n\nasync function persistRemoteSessionRefresh(input: {\n  accessToken: string;\n  expectedPayloadKey: string | null;\n  expiresAt: string;\n  previousAccessToken: string;\n}): Promise<StoredAuthSession | null> {\n  return await withAuthSessionTransitionMutationLock(async () => {\n    await recoverInterruptedAuthSessionTransitionWithOwnership();\n    const transitionJournal = await readAuthSessionTransitionJournal();\n    if (transitionJournal) {\n      if (\n        transitionJournal.state === \"pending\" &&\n        transitionJournal.candidateCredentialRefreshVersion === 1 &&\n        isAuthSessionTransitionCandidateVisibleToCurrentProcess(\n          transitionJournal\n        ) &&\n        input.expectedPayloadKey !== null &&\n        buildAuthSessionPayloadKey(transitionJournal.candidatePayload) ===\n          input.expectedPayloadKey\n      ) {\n        return await persistPendingCandidateRemoteSessionRefresh({\n          ...input,\n          journal: transitionJournal,\n        });\n      }\n      throw new AuthSessionRecoveryInProgressError();\n    }\n    return await persistCommittedRemoteSessionRefresh(input);\n  });\n}\n\nasync function persistCommittedRemoteSessionRefresh(input: {\n  accessToken: string;\n  expectedPayloadKey: string | null;\n  expiresAt: string;\n  previousAccessToken: string;\n}): Promise<StoredAuthSession | null> {\n  const payload = await readSessionPayloadFile();\n  if (\n    payload?.v !== 1 ||\n    input.expectedPayloadKey === null ||\n    buildAuthSessionPayloadKey(payload) !== input.expectedPayloadKey\n  ) {\n    return null;\n  }\n  const refresh = await prepareRemoteSessionRefresh({\n    ...input,\n    payload,\n    uniqueTokenRef: false,\n  });\n  if (!refresh) {\n    return null;\n  }\n\n  try {\n    await assertStoredAccessTokenReloads({\n      accessToken: refresh.nextSession.accessToken,\n      tokenRef: refresh.nextTokenRef,\n    });\n    await writeSessionPayloadAtomically(authSessionPath(), refresh.nextPayload);\n  } catch (error) {\n    await cleanupFailedRemoteSessionRefresh(refresh);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload: refresh.nextPayload,\n    session: refresh.nextSession,\n  });\n  if (!areStoredTokenRefsEqual(refresh.currentTokenRef, refresh.nextTokenRef)) {\n    await deleteAccessTokenOrRetainForCleanup(refresh.currentTokenRef);\n  }\n  return refresh.nextSession;\n}\n\nasync function persistPendingCandidateRemoteSessionRefresh(input: {\n  accessToken: string;\n  expiresAt: string;\n  journal: AuthSessionTransitionJournalV1;\n  previousAccessToken: string;\n}): Promise<StoredAuthSession | null> {\n  const refresh = await prepareRemoteSessionRefresh({\n    ...input,\n    payload: input.journal.candidatePayload,\n    uniqueTokenRef: true,\n  });\n  if (!refresh) {\n    return null;\n  }\n  const candidateTokenRefs = getUniqueTokenRefs([\n    ...getCandidateTokenRefs(input.journal),\n    refresh.nextTokenRef,\n  ]);\n  if (candidateTokenRefs.length > MAX_CANDIDATE_TOKEN_REFS) {\n    await cleanupFailedRemoteSessionRefresh(refresh);\n    throw new AuthSessionStorageError({\n      message: `auth session transition has more than ${String(MAX_CANDIDATE_TOKEN_REFS)} candidate token rotations`,\n      reason: \"unreadable\",\n    });\n  }\n  const nextJournal: AuthSessionTransitionJournalV1 = {\n    ...input.journal,\n    candidatePayload: refresh.nextPayload,\n    candidateTokenRefs,\n  };\n\n  try {\n    await assertStoredAccessTokenReloads({\n      accessToken: refresh.nextSession.accessToken,\n      tokenRef: refresh.nextTokenRef,\n    });\n    await writeAuthSessionTransitionJournalIfOwned(input.journal, nextJournal);\n  } catch (error) {\n    await cleanupFailedRemoteSessionRefresh(refresh);\n    throw error;\n  }\n\n  cacheAuthSession({\n    payload: refresh.nextPayload,\n    session: refresh.nextSession,\n  });\n  return refresh.nextSession;\n}\n\ntype PreparedRemoteSessionRefresh = {\n  currentTokenRef: StoredTokenRef;\n  nextPayload: AuthSessionV1;\n  nextSession: StoredAuthSession;\n  nextTokenRef: StoredTokenRef;\n};\n\nasync function prepareRemoteSessionRefresh(input: {\n  accessToken: string;\n  expiresAt: string;\n  payload: Partial<AuthSessionV1>;\n  previousAccessToken: string;\n  uniqueTokenRef: boolean;\n}): Promise<PreparedRemoteSessionRefresh | null> {\n  const currentTokenRef = normalizeTokenRef(input.payload.tokenRef);\n  const tokenType = normalizeOptionalString(input.payload.tokenType);\n  const authBaseUrl = normalizeOptionalString(input.payload.authBaseUrl);\n  const clientId = normalizeOptionalString(input.payload.clientId);\n  const createdAt = normalizeOptionalString(input.payload.createdAt);\n  const nextAccessToken = normalizeOptionalString(input.accessToken);\n  if (\n    !(\n      currentTokenRef &&\n      tokenType &&\n      authBaseUrl &&\n      clientId &&\n      createdAt &&\n      nextAccessToken\n    )\n  ) {\n    return null;\n  }\n\n  const nextTokenRef =\n    nextAccessToken === input.previousAccessToken\n      ? currentTokenRef\n      : await storeAccessToken({\n          accessToken: nextAccessToken,\n          authBaseUrl,\n          clientId,\n          unique: input.uniqueTokenRef,\n        });\n  const nextPayload: AuthSessionV1 = {\n    v: 1,\n    tokenRef: nextTokenRef,\n    tokenType,\n    authBaseUrl,\n    clientId,\n    createdAt,\n    expiresAt: input.expiresAt,\n    ...(typeof input.payload.scope === \"string\" && input.payload.scope.trim()\n      ? { scope: input.payload.scope.trim() }\n      : {}),\n    ...buildAuthUserPayload(input.payload.user),\n    ...buildActiveOrganizationPayload(input.payload.activeOrganization),\n  };\n  return {\n    currentTokenRef,\n    nextPayload,\n    nextSession: buildStoredAuthSession({\n      accessToken: nextAccessToken,\n      payload: nextPayload,\n    }),\n    nextTokenRef,\n  };\n}\n\nasync function cleanupFailedRemoteSessionRefresh(\n  refresh: PreparedRemoteSessionRefresh\n): Promise<void> {\n  if (!areStoredTokenRefsEqual(refresh.currentTokenRef, refresh.nextTokenRef)) {\n    await deleteAccessTokenOrRetainForCleanup(refresh.nextTokenRef);\n  }\n}\n\nfunction normalizeTokenRef(input: unknown): StoredTokenRef | null {\n  if (!isStoredTokenRef(input)) {\n    return null;\n  }\n  return input;\n}\n\nasync function getRemoteAuthSessionState(\n  session: StoredAuthSession\n): Promise<RemoteAuthSessionValidation> {\n  let endpoint = \"\";\n  try {\n    endpoint = toAuthEndpoint(session.authBaseUrl, \"/api/auth/get-session\");\n  } catch {\n    return { state: \"invalid\" };\n  }\n  try {\n    const timeoutMs = resolveRemoteSessionTimeoutMs(endpoint);\n    const response = await fetch(endpoint, {\n      method: \"GET\",\n      headers: {\n        Authorization: `${normalizeTokenType(session.tokenType)} ${session.accessToken}`,\n      },\n      signal: AbortSignal.timeout(timeoutMs),\n    });\n\n    if (response.status === 401 || response.status === 403) {\n      return { state: \"revoked\" };\n    }\n    if (!response.ok) {\n      // Preserve local credentials on upstream/transient failures.\n      // Non-auth HTTP errors should be retried instead of treated as revocation.\n      return { state: \"unknown\" };\n    }\n\n    const payload = await parseResponseJson(response);\n    if (!hasActiveSessionPayload(payload)) {\n      return { state: \"invalid\" };\n    }\n    return {\n      state: \"valid\",\n      ...readRemoteAccessToken(response),\n      ...readRemoteSessionExpiration(payload),\n    };\n  } catch {\n    return { state: \"unknown\" };\n  }\n}\n\nfunction readRemoteAccessToken(response: Response): {\n  accessToken?: string;\n} {\n  const accessToken = normalizeOptionalString(\n    response.headers.get(\"set-auth-token\")\n  );\n  return accessToken ? { accessToken } : {};\n}\n\nfunction readRemoteSessionExpiration(payload: unknown): {\n  expiresAt?: string;\n} {\n  if (!isRecord(payload)) {\n    return {};\n  }\n  const session = payload.session;\n  if (!isRecord(session)) {\n    return {};\n  }\n  const expiresAt = normalizeOptionalString(session.expiresAt);\n  if (!expiresAt) {\n    return {};\n  }\n  const expiresAtMs = Date.parse(expiresAt);\n  if (Number.isNaN(expiresAtMs)) {\n    return {};\n  }\n  return { expiresAt: new Date(expiresAtMs).toISOString() };\n}\n\nfunction resolveRemoteSessionTimeoutMs(endpoint: string): number {\n  const url = parseUrlOrNull(endpoint);\n  if (url && isLoopbackHostname(url.hostname)) {\n    return LOOPBACK_REMOTE_SESSION_TIMEOUT_MS;\n  }\n  return DEFAULT_REMOTE_SESSION_TIMEOUT_MS;\n}\n\nfunction parseUrlOrNull(value: string): URL | null {\n  try {\n    return new URL(value);\n  } catch {\n    return null;\n  }\n}\n\nfunction hasActiveSessionPayload(payload: unknown): boolean {\n  if (!isRecord(payload)) {\n    return false;\n  }\n\n  return (\n    isRecord((payload as Record<string, unknown>).session) &&\n    isRecord((payload as Record<string, unknown>).user)\n  );\n}\n\nfunction isExpired(expiresAt: string | undefined): boolean {\n  return resolveAuthSessionExpiryEligibility(expiresAt).status === \"expired\";\n}\n\nfunction resolveRemoteAuthSessionReasonCode(\n  state: Exclude<RemoteAuthSessionState, \"valid\" | \"unknown\">\n): AuthSessionStateReasonCode {\n  switch (state) {\n    case \"invalid\":\n      return \"remote_session_invalid\";\n    case \"revoked\":\n      return \"remote_session_revoked\";\n    default: {\n      const exhaustiveState: never = state;\n      throw new Error(\n        `unsupported remote auth session state: ${exhaustiveState}`\n      );\n    }\n  }\n}\n\nasync function readSessionPayload(): Promise<Partial<AuthSessionV1> | null> {\n  await recoverInterruptedAuthSessionTransition();\n  const journal = await readAuthSessionTransitionJournal();\n  if (journal?.state === \"pending\") {\n    const candidateVisible =\n      isAuthSessionTransitionCandidateVisibleToCurrentProcess(journal);\n    if (candidateVisible) {\n      return journal.candidatePayload;\n    }\n  }\n  return await readSessionPayloadFile();\n}\n\nfunction isAuthSessionTransitionCandidateVisibleToCurrentProcess(\n  journal: AuthSessionTransitionJournalV1\n): boolean {\n  if (activeAuthSessionTransitionIds.has(journal.id)) {\n    return true;\n  }\n  return getRegisteredCandidateServiceProcesses(journal).some(\n    (candidateServiceProcess) =>\n      isSameProcessIdentity(candidateServiceProcess, {\n        ownerPid: process.pid,\n        ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n      })\n  );\n}\n\nasync function readSessionPayloadFile(): Promise<Partial<AuthSessionV1> | null> {\n  const path = authSessionPath();\n  const raw = await readFile(path, \"utf8\").catch((error: unknown) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw new AuthSessionStorageError({\n      message: `current auth session metadata could not be read at ${path}: ${toErrorMessage(error)}`,\n      reason: \"unreadable\",\n      cause: error,\n    });\n  });\n  if (raw === null) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw) as Partial<AuthSessionV1>;\n  } catch (error) {\n    throw new AuthSessionStorageError({\n      message: `current auth session metadata is corrupt at ${path}`,\n      reason: \"corrupt\",\n      cause: error,\n    });\n  }\n}\n\nasync function recoverInterruptedAuthSessionTransition(): Promise<void> {\n  // Committed session reads do not mutate state. Only enter the recovery\n  // critical section when a durable transition actually needs inspection.\n  // The locked operation rereads the journal before making any changes.\n  if (!(await readAuthSessionTransitionJournal())) {\n    return;\n  }\n  await withAuthSessionTransitionMutationLock(\n    recoverInterruptedAuthSessionTransitionWithOwnership\n  );\n}\n\nasync function recoverInterruptedAuthSessionTransitionWithOwnership(): Promise<void> {\n  let journal = await readAuthSessionTransitionJournal();\n  if (!journal) {\n    return;\n  }\n  if (activeAuthSessionTransitionIds.has(journal.id)) {\n    return;\n  }\n  if (\n    journal.state === \"pending\" &&\n    isProcessIdentityAlive({\n      ownerPid: journal.ownerPid,\n      ownerProcessStartedAt: journal.ownerProcessStartedAt,\n    })\n  ) {\n    journal = await registerCurrentCandidateServiceProcess(journal);\n    return;\n  }\n\n  if (journal.state === \"pending\") {\n    await restoreTransitionPreviousPayload(journal);\n    stopRegisteredCandidateService(journal);\n    if (journal.computerHandoff) {\n      await writeAuthSessionTransitionJournalIfOwned(journal, {\n        ...journal,\n        state: \"recovery_required\",\n      });\n      return;\n    }\n    await cleanupCandidateTokenRefs(journal);\n    await removeAuthSessionTransitionJournalIfOwned(journal);\n    return;\n  }\n  if (journal.state === \"recovery_required\") {\n    stopRegisteredCandidateService(journal);\n    return;\n  }\n\n  if (journal.state === \"committed\") {\n    const currentPayload = await readSessionPayloadFile();\n    if (\n      currentPayload?.v !== 1 ||\n      buildAuthSessionPayloadKey(currentPayload) !==\n        buildAuthSessionPayloadKey(journal.candidatePayload)\n    ) {\n      throw new AuthSessionStorageError({\n        message:\n          \"committed auth session transition does not match current session metadata\",\n        reason: \"corrupt\",\n      });\n    }\n    await finalizeCommittedAuthSessionTransition(journal).catch(\n      (error: unknown) => {\n        logDeferredAuthSessionTransitionCleanup({\n          error,\n          transitionId: journal.id,\n        });\n      }\n    );\n  }\n}\n\nasync function finalizeCommittedAuthSessionTransition(\n  journal: AuthSessionTransitionJournalV1\n): Promise<void> {\n  const previousTokenRef = normalizeTokenRef(journal.previousPayload?.tokenRef);\n  if (\n    previousTokenRef &&\n    !areStoredTokenRefsEqual(\n      previousTokenRef,\n      journal.candidatePayload.tokenRef\n    )\n  ) {\n    await deleteAccessTokenOrRetainForCleanup(previousTokenRef);\n  }\n  await cleanupCandidateTokenRefs(journal, journal.candidatePayload.tokenRef);\n  await removeAuthSessionTransitionJournalIfOwned(journal);\n}\n\nasync function registerCurrentCandidateServiceProcess(\n  journal: AuthSessionTransitionJournalV1\n): Promise<AuthSessionTransitionJournalV1> {\n  if (!isCurrentProcessCandidateService()) {\n    return journal;\n  }\n  const currentProcess: ProcessIdentity = {\n    ownerPid: process.pid,\n    ownerProcessStartedAt: CURRENT_PROCESS_START_IDENTITY,\n  };\n  if (\n    getRegisteredCandidateServiceProcesses(journal).some(\n      (candidateServiceProcess) =>\n        isSameProcessIdentity(candidateServiceProcess, currentProcess)\n    )\n  ) {\n    return journal;\n  }\n  const currentJournal = await readAuthSessionTransitionJournal();\n  if (currentJournal?.id !== journal.id || currentJournal.state !== \"pending\") {\n    return currentJournal ?? journal;\n  }\n  const candidateServiceProcesses = getRegisteredCandidateServiceProcesses(\n    currentJournal\n  ).filter(isProcessIdentityAlive);\n  candidateServiceProcesses.push(currentProcess);\n  if (candidateServiceProcesses.length > MAX_CANDIDATE_SERVICE_PROCESSES) {\n    throw new Error(\n      `auth session transition has more than ${String(MAX_CANDIDATE_SERVICE_PROCESSES)} live candidate OpenMeld Service processes`\n    );\n  }\n  const updatedJournal = {\n    ...currentJournal,\n    candidateServiceProcesses,\n    candidateServiceProcess: currentProcess,\n  };\n  await writeAuthSessionTransitionJournalIfOwned(\n    currentJournal,\n    updatedJournal\n  );\n  return updatedJournal;\n}\n\nfunction stopRegisteredCandidateService(\n  journal: AuthSessionTransitionJournalV1\n): void {\n  for (const candidateServiceProcess of getRegisteredCandidateServiceProcesses(\n    journal\n  )) {\n    if (!isProcessIdentityAlive(candidateServiceProcess)) {\n      continue;\n    }\n    try {\n      process.kill(candidateServiceProcess.ownerPid, \"SIGTERM\");\n    } catch (error) {\n      if (!isFileNotFoundErrorCode(error, \"ESRCH\")) {\n        throw new AuthSessionStorageError({\n          message: `candidate OpenMeld Service process ${String(candidateServiceProcess.ownerPid)} could not be stopped: ${toErrorMessage(error)}`,\n          reason: \"unreadable\",\n          cause: error,\n        });\n      }\n    }\n  }\n}\n\nfunction getRegisteredCandidateServiceProcesses(\n  journal: AuthSessionTransitionJournalV1\n): ProcessIdentity[] {\n  const candidates = [\n    ...(journal.candidateServiceProcesses ?? []),\n    ...(journal.candidateServiceProcess\n      ? [journal.candidateServiceProcess]\n      : []),\n  ];\n  const uniqueCandidates: ProcessIdentity[] = [];\n  for (const candidate of candidates) {\n    if (\n      !uniqueCandidates.some((existing) =>\n        isSameProcessIdentity(existing, candidate)\n      )\n    ) {\n      uniqueCandidates.push(candidate);\n    }\n  }\n  return uniqueCandidates;\n}\n\nfunction isSameProcessIdentity(\n  left: ProcessIdentity,\n  right: ProcessIdentity\n): boolean {\n  return (\n    left.ownerPid === right.ownerPid &&\n    left.ownerProcessStartedAt === right.ownerProcessStartedAt\n  );\n}\n\nfunction isCurrentProcessCandidateService(): boolean {\n  const runtimeMode = String(\n    process.env.OPENMELD_DAEMON_RUNTIME_MODE ?? \"\"\n  ).trim();\n  return runtimeMode === \"background\" || runtimeMode === \"foreground\";\n}\n\nasync function readStoredAuthSessionFromPayload(\n  payload: AuthSessionV1\n): Promise<StoredAuthSession> {\n  const session = await readStoredAuthSessionFromPayloadIfPresent(payload);\n  if (!session) {\n    throw new AuthSessionStorageError({\n      message: \"auth session recovery token is missing\",\n      reason: \"corrupt\",\n    });\n  }\n  return session;\n}\n\nasync function readStoredAuthSessionFromPayloadIfPresent(\n  payload: AuthSessionV1\n): Promise<StoredAuthSession | null> {\n  const accessToken = await readAccessToken(payload.tokenRef);\n  if (accessToken.status === \"missing\") {\n    return null;\n  }\n  if (accessToken.status === \"unavailable\") {\n    throw new AuthSessionStorageError({\n      message: accessToken.errorMessage,\n      reason: \"unreadable\",\n    });\n  }\n  return buildStoredAuthSession({\n    accessToken: accessToken.accessToken,\n    payload,\n  });\n}\n\nasync function readRecoverablePreviousSession(\n  payload: AuthSessionV1 | null\n): Promise<StoredAuthSession | null> {\n  if (!payload) {\n    return null;\n  }\n  const token = await readAccessToken(payload.tokenRef);\n  // The rollback has already restored the original payload. An unreadable\n  // credential cannot restart a Service, but must not prevent cleanup of the\n  // failed candidate or permanently block a fresh authorization attempt.\n  return token.status === \"found\"\n    ? buildStoredAuthSession({ accessToken: token.accessToken, payload })\n    : null;\n}\n\nasync function readRequiredComputerAuthRecoveryJournal(id: string): Promise<\n  AuthSessionTransitionJournalV1 & {\n    computerHandoff: NonNullable<\n      AuthSessionTransitionJournalV1[\"computerHandoff\"]\n    >;\n  }\n> {\n  const journal = await readAuthSessionTransitionJournal();\n  if (\n    journal?.id !== id ||\n    journal.state !== \"recovery_required\" ||\n    !journal.computerHandoff\n  ) {\n    throw new Error(\"computer auth recovery is no longer current\");\n  }\n  return journal as AuthSessionTransitionJournalV1 & {\n    computerHandoff: NonNullable<\n      AuthSessionTransitionJournalV1[\"computerHandoff\"]\n    >;\n  };\n}\n\nfunction logDeferredAuthSessionTransitionCleanup(input: {\n  error: unknown;\n  transitionId: string;\n}): void {\n  console.warn(\"[openmeld.auth.session_transition_cleanup_deferred]\", {\n    error: toErrorMessage(input.error),\n    transitionId: input.transitionId,\n  });\n}\n\nasync function restoreTransitionPreviousPayload(\n  journal: AuthSessionTransitionJournalV1,\n  previousSession?: StoredAuthSession | null\n): Promise<void> {\n  cachedAuthSession = null;\n  if (!journal.previousPayload) {\n    await removeSessionFile();\n    return;\n  }\n  await writeSessionPayloadAtomically(\n    authSessionPath(),\n    journal.previousPayload\n  );\n  if (previousSession) {\n    cacheAuthSession({\n      payload: journal.previousPayload,\n      session: previousSession,\n    });\n  }\n}\n\nasync function readAuthSessionTransitionJournal(): Promise<AuthSessionTransitionJournalV1 | null> {\n  const path = authSessionTransitionPath();\n  const raw = await readFile(path, \"utf8\").catch((error: unknown) => {\n    if (isFileNotFoundError(error)) {\n      return null;\n    }\n    throw new AuthSessionStorageError({\n      message: `auth session transition state could not be read at ${path}: ${toErrorMessage(error)}`,\n      reason: \"unreadable\",\n      cause: error,\n    });\n  });\n  if (raw === null) {\n    return null;\n  }\n  let value: unknown;\n  try {\n    value = JSON.parse(raw);\n  } catch (error) {\n    throw new AuthSessionStorageError({\n      message: `auth session transition state is corrupt at ${path}`,\n      reason: \"corrupt\",\n      cause: error,\n    });\n  }\n  if (!isAuthSessionTransitionJournal(value)) {\n    throw new AuthSessionStorageError({\n      message: `auth session transition state is corrupt at ${path}`,\n      reason: \"corrupt\",\n    });\n  }\n  return value;\n}\n\nfunction isAuthSessionTransitionJournal(\n  value: unknown\n): value is AuthSessionTransitionJournalV1 {\n  if (!isRecord(value)) {\n    return false;\n  }\n  return (\n    value.v === 1 &&\n    typeof value.id === \"string\" &&\n    value.id.length > 0 &&\n    (value.state === \"pending\" ||\n      value.state === \"recovery_required\" ||\n      value.state === \"committed\") &&\n    Number.isSafeInteger(value.ownerPid) &&\n    Number(value.ownerPid) > 0 &&\n    typeof value.ownerProcessStartedAt === \"string\" &&\n    value.ownerProcessStartedAt.length > 0 &&\n    (value.previousPayload === null ||\n      isAuthSessionPayload(value.previousPayload)) &&\n    isAuthSessionPayload(value.candidatePayload) &&\n    (value.candidateCredentialRefreshVersion === undefined ||\n      value.candidateCredentialRefreshVersion === 1) &&\n    isOptionalStoredTokenRefList(value.candidateTokenRefs) &&\n    isOptionalProcessIdentityList(value.candidateServiceProcesses) &&\n    isOptionalProcessIdentity(value.candidateServiceProcess) &&\n    isOptionalComputerHandoffRecovery(value.computerHandoff)\n  );\n}\n\nfunction isOptionalStoredTokenRefList(value: unknown): boolean {\n  return (\n    value === undefined ||\n    (Array.isArray(value) &&\n      value.length <= MAX_CANDIDATE_TOKEN_REFS &&\n      value.every((tokenRef) => isStoredTokenRef(tokenRef)))\n  );\n}\n\nfunction isOptionalProcessIdentityList(value: unknown): boolean {\n  return (\n    value === undefined ||\n    (Array.isArray(value) &&\n      value.length <= MAX_CANDIDATE_SERVICE_PROCESSES &&\n      value.every((candidate) => isProcessIdentity(candidate)))\n  );\n}\n\nfunction isOptionalProcessIdentity(value: unknown): boolean {\n  return value === undefined || isProcessIdentity(value);\n}\n\nfunction isProcessIdentity(value: unknown): value is ProcessIdentity {\n  return (\n    isRecord(value) &&\n    Number.isSafeInteger(value.ownerPid) &&\n    Number(value.ownerPid) > 0 &&\n    typeof value.ownerProcessStartedAt === \"string\" &&\n    value.ownerProcessStartedAt.length > 0\n  );\n}\n\nfunction isOptionalComputerHandoffRecovery(value: unknown): boolean {\n  if (value === undefined) {\n    return true;\n  }\n  if (!(isRecord(value) && typeof value.gatewayUrl === \"string\")) {\n    return false;\n  }\n  return (\n    (value.serviceReconciledAt === undefined ||\n      typeof value.serviceReconciledAt === \"string\") &&\n    (value.remoteSessionRevokedAt === undefined ||\n      typeof value.remoteSessionRevokedAt === \"string\") &&\n    (value.lastRecoveryFailure === undefined ||\n      isComputerHandoffRecoveryFailure(value.lastRecoveryFailure))\n  );\n}\n\nfunction isComputerHandoffRecoveryFailure(value: unknown): boolean {\n  return (\n    isRecord(value) &&\n    typeof value.at === \"string\" &&\n    typeof value.message === \"string\" &&\n    (value.phase === \"service\" ||\n      value.phase === \"remote_session\" ||\n      value.phase === \"local_cleanup\") &&\n    (value.endpoint === undefined || typeof value.endpoint === \"string\") &&\n    (value.status === undefined ||\n      value.status === null ||\n      typeof value.status === \"number\")\n  );\n}\n\nfunction isAuthSessionPayload(value: unknown): value is AuthSessionV1 {\n  return isRecord(value) && value.v === 1 && isStoredTokenRef(value.tokenRef);\n}\n\nasync function writeAuthSessionTransitionJournalIfOwned(\n  expected: AuthSessionTransitionJournalV1,\n  next: AuthSessionTransitionJournalV1\n): Promise<void> {\n  if (!hasSameAuthSessionTransitionIdentity(expected, next)) {\n    throw new Error(\"auth session transition identity cannot change\");\n  }\n  const current = await readAuthSessionTransitionJournal();\n  if (!current) {\n    throw new AuthSessionTransitionConflictError({\n      previousOwnerRestored: false,\n      reason: \"journal_missing\",\n    });\n  }\n  if (!hasSameAuthSessionTransitionIdentity(expected, current)) {\n    throw new AuthSessionTransitionConflictError({\n      previousOwnerRestored: false,\n      reason: \"journal_replaced\",\n    });\n  }\n  await writeJsonAtomically(authSessionTransitionPath(), next);\n}\n\nasync function claimAuthSessionTransitionJournal(\n  journal: AuthSessionTransitionJournalV1\n): Promise<void> {\n  const path = authSessionTransitionPath();\n  const claimPath = `${path}.claim-${process.pid}-${Date.now()}-${randomUUID()}`;\n  const file = await open(claimPath, \"wx\", 0o600);\n  let failure: unknown;\n  try {\n    await file.writeFile(`${JSON.stringify(journal, null, 2)}\\n`, \"utf8\");\n    await file.sync();\n  } catch (error) {\n    failure = error;\n  }\n  try {\n    await file.close();\n  } catch (error) {\n    failure ??= error;\n  }\n  if (failure !== undefined) {\n    await rm(claimPath, { force: true }).catch(() => undefined);\n    throw failure;\n  }\n\n  try {\n    await link(claimPath, path);\n  } catch (error) {\n    if (isFileNotFoundErrorCode(error, \"EEXIST\")) {\n      throw new AuthSessionRecoveryInProgressError();\n    }\n    throw error;\n  } finally {\n    await rm(claimPath, { force: true }).catch(() => undefined);\n  }\n}\n\nasync function removeAuthSessionTransitionJournalIfOwned(\n  expected: AuthSessionTransitionJournalV1\n): Promise<void> {\n  const currentJournal = await readAuthSessionTransitionJournal();\n  if (!currentJournal) {\n    return;\n  }\n  if (!hasSameAuthSessionTransitionIdentity(expected, currentJournal)) {\n    throw new AuthSessionTransitionConflictError({\n      previousOwnerRestored: false,\n      reason: \"journal_replaced\",\n    });\n  }\n  await rm(authSessionTransitionPath(), { force: true });\n}\n\nfunction hasSameAuthSessionTransitionIdentity(\n  left: AuthSessionTransitionJournalV1,\n  right: AuthSessionTransitionJournalV1\n): boolean {\n  return (\n    left.id === right.id &&\n    left.ownerPid === right.ownerPid &&\n    left.ownerProcessStartedAt === right.ownerProcessStartedAt\n  );\n}\n\nfunction authSessionTransitionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session-transition.json\");\n}\n\nfunction authSessionPath(): string {\n  return join(openMeldRootDir(), \"auth\", \"session.json\");\n}\n\nasync function ensureAuthSessionDirectory(): Promise<void> {\n  await mkdir(join(openMeldRootDir(), \"auth\"), { recursive: true });\n}\n\nasync function writeSessionPayloadAtomically(\n  path: string,\n  payload: AuthSessionV1\n): Promise<void> {\n  await writeJsonAtomically(path, payload);\n}\n\nasync function writeJsonAtomically(\n  path: string,\n  payload: unknown\n): Promise<void> {\n  const tempPath = `${path}.tmp-${process.pid}-${Date.now()}-${randomUUID()}`;\n  try {\n    const file = await open(tempPath, \"wx\", 0o600);\n    try {\n      await file.writeFile(`${JSON.stringify(payload, null, 2)}\\n`, \"utf8\");\n      await file.sync();\n    } finally {\n      await file.close();\n    }\n\n    await rename(tempPath, path);\n  } catch (error) {\n    await rm(tempPath, { force: true }).catch(() => undefined);\n    throw error;\n  }\n}\n\nfunction isFileNotFoundError(error: unknown): boolean {\n  return Boolean(\n    error &&\n      typeof error === \"object\" &&\n      \"code\" in error &&\n      error.code === \"ENOENT\"\n  );\n}\n\nfunction isFileNotFoundErrorCode(error: unknown, code: string): boolean {\n  return Boolean(\n    error && typeof error === \"object\" && \"code\" in error && error.code === code\n  );\n}\n\nfunction toErrorMessage(error: unknown): string {\n  return error instanceof Error && error.message.trim()\n    ? error.message.trim()\n    : String(error ?? \"unknown error\");\n}\n\nfunction buildAuthUserPayload(value: unknown): {\n  user?: {\n    id?: string;\n    email?: string;\n    name?: string;\n  };\n} {\n  if (!(value && typeof value === \"object\")) {\n    return {};\n  }\n  const record = value as Record<string, unknown>;\n  const id = normalizeOptionalString(record.id);\n  const email = normalizeOptionalString(record.email);\n  const name = normalizeOptionalString(record.name);\n  if (!(id || email || name)) {\n    return {};\n  }\n  return {\n    user: {\n      ...(id ? { id } : {}),\n      ...(email ? { email } : {}),\n      ...(name ? { name } : {}),\n    },\n  };\n}\n\nfunction buildActiveOrganizationPayload(value: unknown): {\n  activeOrganization?: StoredActiveOrganization;\n} {\n  const activeOrganization = normalizeStoredActiveOrganization(value);\n  return activeOrganization ? { activeOrganization } : {};\n}\n\nexport function normalizeStoredActiveOrganization(\n  value: unknown\n): StoredActiveOrganization | null {\n  if (!isRecord(value)) {\n    return null;\n  }\n  const id = normalizeOptionalString(value.id);\n  const slug = normalizeOptionalString(value.slug);\n  const name = normalizeOptionalString(value.name);\n  const role = normalizeOptionalString(value.role);\n  const personal = readOrganizationIsPersonal(value);\n  if (!(id && slug && name)) {\n    return null;\n  }\n  return {\n    id,\n    slug,\n    name,\n    ...(role ? { role } : {}),\n    ...(personal ? { personal } : {}),\n  };\n}\n\nexport function readActiveOrganizationIdFromSessionPayload(\n  payload: unknown\n): string | null {\n  if (!isRecord(payload)) {\n    return null;\n  }\n  return (\n    (isRecord(payload.session)\n      ? normalizeOptionalString(payload.session.activeOrganizationId)\n      : null) ?? normalizeOptionalString(payload.activeOrganizationId)\n  );\n}\n\nfunction normalizeTokenType(value: string): string {\n  const normalized = value.trim();\n  return normalized.length > 0 ? normalized : \"Bearer\";\n}\n\nfunction normalizeOptionalString(value: unknown): string | null {\n  const normalized = String(value ?? \"\").trim();\n  return normalized.length > 0 ? normalized : null;\n}\n\nfunction readOrganizationIsPersonal(value: Record<string, unknown>): boolean {\n  if (value.personal === true || value.isPersonal === true) {\n    return true;\n  }\n\n  const metadata = readOrganizationMetadata(value.metadata);\n  return metadata?.personal === true;\n}\n\nfunction readOrganizationMetadata(\n  metadata: unknown\n): Record<string, unknown> | null {\n  if (metadata === null || metadata === undefined) {\n    return null;\n  }\n\n  if (typeof metadata === \"string\") {\n    try {\n      const parsed = JSON.parse(metadata) as unknown;\n      return isRecord(parsed) ? parsed : null;\n    } catch {\n      return null;\n    }\n  }\n\n  return isRecord(metadata) ? metadata : null;\n}\n\nfunction toAuthEndpoint(baseUrl: string, pathname: string): string {\n  const url = new URL(baseUrl);\n  const normalizedBasePath = url.pathname.replace(TRAILING_SLASHES_RE, \"\");\n  const normalizedPathname = pathname.startsWith(\"/\")\n    ? pathname\n    : `/${pathname}`;\n  url.pathname = `${normalizedBasePath}${normalizedPathname}` || \"/\";\n  url.search = \"\";\n  url.hash = \"\";\n  return url.toString();\n}\n\nfunction isRecord(value: unknown): value is Record<string, unknown> {\n  return Boolean(value && typeof value === \"object\");\n}\n\nasync function parseResponseJson(response: Response): Promise<unknown> {\n  const raw = await response.text();\n  if (!raw) {\n    return null;\n  }\n  try {\n    return JSON.parse(raw);\n  } catch {\n    return { message: raw };\n  }\n}\n\nasync function removeSessionFile(): Promise<void> {\n  await rm(authSessionPath(), { force: true });\n}\n"],"mappings":";;;;;;;;;;;;;;AAGA,MAAM,6CAA6C;AACnD,MAAM,6BAA6B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrE,MAAM,6BAA6B,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,GAAG;AACrE,MAAM,iCAAiC,IAAI,OAAO,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,KAAK;AACpE,MAAM,qCAAqC,IAAI,KAAK;CACnD;CACA;CACA;AACD,CAAC;AACD,MAAM,mCAAmC,IAAI,mBAAmB,aAAa;CAC5E,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,OAAO;EAC9B,SAAS;EACT,SAAS;EACT,aAAa;EACb,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;CACD,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,MAAM;EAC7B,SAAS;EACT,SAAS;EACT,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;CACD,IAAI,aAAa;EAChB,eAAe,IAAI,QAAQ,CAAC;EAC5B,WAAW,IAAI,QAAQ,QAAQ;EAC/B,SAAS;EACT,SAAS;EACT,2BAA2B,IAAI,QAAQ,0CAA0C;CAClF,CAAC;AACF,CAAC;AACD,MAAM,2CAA2C,IAAI,aAAa;CACjE,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,IAAI;CACpB,WAAW,IAAI,KAAK,CAAC,SAAS,QAAQ,CAAC;AACxC,CAAC;AACD,MAAM,uCAAuC,IAAI,aAAa;CAC7D,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,IAAI;CACpB,WAAW,IAAI,QAAQ,MAAM;CAC7B,aAAa,IAAI,MAAM,CAAC,gCAAgC,IAAI,KAAK,CAAC,CAAC;AACpE,CAAC;AACD,MAAM,iCAAiC,IAAI,aAAa;CACvD,eAAe,IAAI,QAAQ,CAAC;CAC5B,IAAI,IAAI,QAAQ,KAAK;CACrB,WAAW;CACX,cAAc,IAAI,OAAO,CAAC,CAAC,KAAK,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,IAAI;AAClD,CAAC;AACD,MAAM,oCAAoC,IAAI,MAAM;CACnD;CACA;CACA;AACD,CAAC;;;ACrDD,MAAa,mCAAmC;AAChD,MAAa,oCAAoC;AACjD,MAAa,qCAAqC;AAGlD,MAAa,mCAAmC;AAEhD,MAAa,+BAA+B;AAC5C,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,4BAA4B;AACzC,MAAa,4BAA4B;AAIzC,MAAa,sCAAsC;AAMnD,MAAa,0CAA0C;AAIvD,MAAa,iCAAiC;AAC9C,MAAa,uCAAuC;AACpD,MAAa,gCAAgC;AAC7C,MAAa,mDAAmD,IAAI;AACpE,MAAa,yDAAyD;AACtE,MAAa,+CAA+C,IAAI;AAChE,MAAa,qDAAqD;AAClE,MAAa,wCAAwC;AACrD,MAAa,mCAAmC;AAChD,MAAa,+BAA+B;AAC5C,MAAa,gCAAgC;AAC7C,MAAa,gCACX;AACF,MAAa,0BAA0B;;;ACpCvC,SAAgB,oCACd,WACA,QAAQ,KAAK,IAAI,GACa;CAC9B,MAAM,aAAa,OAAO,aAAa,EAAE,CAAC,CAAC,KAAK;CAChD,IAAI,CAAC,YACH,OAAO,EAAE,QAAQ,YAAY;CAG/B,MAAM,cAAc,KAAK,MAAM,UAAU;CACzC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO,eAAe,QAClB;EAAE;EAAa,QAAQ;CAAU,IACjC;EAAE;EAAa,QAAQ;CAAQ;AACrC;;;ACnBA,MAAM,wBAAwB;AAC9B,MAAM,0CAA0C;AAChD,MAAM,4BAA4B;AAClC,MAAM,mCAAmC;AACzC,MAAM,4BAA4B;AAElC,eAAsB,sCACpB,WACY;CACZ,OAAO,MAAM,oBAAoB;EAC/B,WAAW;EACX,KAAK;EACL;CACF,CAAC;AACH;AAEA,eAAsB,oCACpB,WACY;CACZ,OAAO,MAAM,oBAAoB;EAC/B,WAAW;EACX,KAAK;EACL;CACF,CAAC;AACH;AAEA,eAAe,oBAAuB,OAIvB;CAEb,OAAO,MAAM,gBAAgB;EAC3B,MAAA,MAFiB,uBAAuB,KAAK;EAG7C,KAAK,MAAM;EACX,gBAAgB;GACd,WAAW,MAAM;GACjB,SAAS,MAAM;EACjB;CACF,CAAC;AACH;AAEA,eAAe,uBAAuB,OAGnC;CACD,MAAM,WAAW,KAAK,IAAI,IAAI;CAC9B,OAAO,MACL,IAAI;EACF,OAAO,MAAM,YAAY;GACvB,KAAK,MAAM;GACX,MAAM,EAAE,WAAW,MAAM,UAAU;GACnC,mBAAmB;EACrB,CAAC;CACH,SAAS,OAAO;EACd,IAAI,EAAE,oBAAoB,KAAK,KAAK,KAAK,IAAI,IAAI,WAC/C,MAAM;EAER,MAAMA,aAAM,gCAAgC;CAC9C;AAEJ;;;AC1CA,MAAM,sBAA4C;AAClD,MAAM,mBAAyC;;;;;;AAO/C,SAAgB,8BAAoD;CAKlE,OAEI;AACN;AAEA,SAAgB,uBAAgC;CAC9C,OAAO,4BAA4B,MAAM;AAC3C;;;AC9BA,MAAM,6BAA6B;AACnC,MAAM,0BAA0B,MAAM;AACtC,MAAM,oBAAoB;AAC1B,MAAa,oCAAoC;AAoCjD,IAAI,cAAyC;AAC7C,IAAI,4BAA0C;AAC9C,IAAI,kBAAkB;AACtB,IAAI,0BAAyC;AAC7C,MAAa,iCAAiC;AAE9C,eAAsB,8BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;GACf,aAAa,MAAM;EACrB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;AAC7D;AAEA,eAAsB,6BACpB,OACwB;CACxB,IAAI,qBAAqB,GACvB,OAAO,MAAM,qCAAqC;EAChD,WAAW;EACX,SAAS,MAAM;EACf,SAAS,MAAM;CACjB,CAAC;CAGH,QAAO,MADa,UAAU,EAAA,CACjB,KAAK,MAAM,SAAS,MAAM,OAAO;AAChD;AAEA,eAAsB,+BACpB,OACe;CACf,IAAI,qBAAqB,GAAG;EAC1B,MAAM,qCAAqC;GACzC,WAAW;GACX,SAAS,MAAM;GACf,SAAS,MAAM;EACjB,CAAC;EACD;CACF;CAEA,CAAA,MADoB,UAAU,EAAA,CACxB,OAAO,MAAM,SAAS,MAAM,OAAO;AAC3C;AAUA,eAAsB,qCACpB,OACA,UAAkC,CAAC,GACC;CACpC,MAAM,UAAU,iCAAiC,MAAM;EACrD,eAAA;EACA,2BAA2B;EAC3B,GAAG;CACL,CAAC;CACD,MAAM,YAAY,QAAQ,aAAA;CAC1B,IAAI,EAAE,OAAO,cAAc,SAAS,KAAK,YAAY,IACnD,MAAM,IAAI,MAAM,0DAA0D;CAG5E,OAAO,MAAM,IAAI,SAAoC,SAAS,WAAW;EACvE,MAAM,QAAQ,MAAM,QAAQ,UAAU,CAAC,0BAA0B,GAAG;GAClE,KAAK,QAAQ;GACb,OAAO;GACP,OAAO;IAAC;IAAQ;IAAQ;GAAM;GAC9B,aAAa;EACf,CAAC;EACD,IAAI,UAAU;EACd,IAAI,SAAS;EACb,IAAI,SAAS;EAEb,MAAM,sBAAsB;GAC1B,aAAa,QAAQ;EACvB;EACA,MAAM,cAAc,UAAiB;GACnC,IAAI,SACF;GAEF,UAAU;GACV,cAAc;GACd,OAAO,KAAK;EACd;EACA,MAAM,WAAW,iBAAiB;GAChC,IAAI,SACF;GAEF,UAAU;GACV,MAAM,KAAK,SAAS;GACpB,OACE,IAAI,gCACF,yCAAyC,cAAc,SAAS,GAClE,CACF;EACF,GAAG,SAAS;EAEZ,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,YAAY,MAAM;EAC/B,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBAAyB;IAC/D,MAAM,KAAK,SAAS;IACpB,2BAAW,IAAI,MAAM,4CAA4C,CAAC;GACpE;EACF,CAAC;EACD,MAAM,OAAO,GAAG,SAAS,UAAmB;GAC1C,UAAU,OAAO,KAAK;GACtB,IAAI,OAAO,WAAW,QAAQ,MAAM,IAAI,yBACtC,SAAS,OAAO,MAAM,OAAwB;EAElD,CAAC;EACD,MAAM,KAAK,UAAU,UAAU;GAC7B,2BACE,IAAI,MACF,0CAA0CC,iBAAe,KAAK,GAChE,CACF;EACF,CAAC;EACD,MAAM,MAAM,KAAK,UAAU,UAAU;GACnC,2BACE,IAAI,MACF,uCAAuCA,iBAAe,KAAK,GAC7D,CACF;EACF,CAAC;EACD,MAAM,KAAK,UAAU,SAAS;GAC5B,IAAI,SACF;GAEF,cAAc;GACd,UAAU;GACV,IAAI;IACF,QACE,+BAA+B;KAC7B;KACA,WAAW,QAAQ;KACnB;KACA;IACF,CAAC,CACH;GACF,SAAS,OAAO;IACd,OAAO,QAAQ,KAAK,CAAC;GACvB;EACF,CAAC;EAED,MAAM,MAAM,IAAI,KAAK,UAAU,OAAO,GAAG,MAAM;CACjD,CAAC;AACH;AAEA,eAAsB,wCACpB,OAA0B,QAAQ,MAChB;CAClB,IAAI,CAAC,KAAK,SAAS,0BAA0B,GAC3C,OAAO;CAET,IAAI,EAAE,qBAAqB,KAAK,QAAQ,aAAa,WACnD,MAAM,IAAI,MACR,0EACF;CAIF,IAAI,EAAC,MADe,UAAU,EAAA,CACnB,uBAAuB,GAChC,MAAM,IAAI,MACR,8EACF;CAGF,MAAM,aAAa,MAAM,gBAAgB;CACzC,IAAI;CACJ,IAAI;EACF,OAAO,KAAK,MAAM,UAAU;CAC9B,QAAQ;EACN,MAAM,IAAI,MAAM,uCAAuC;CACzD;CACA,MAAM,UAAU,iCAAiC,UAAU,IAAI;CAC/D,IAAI,CAAC,QAAQ,SACX,MAAM,IAAI,MAAM,uCAAuC;CAGzD,MAAM,WAAW,MAAM,qBAAqB,QAAQ,IAAI,CAAC,CAAC,OAAO,WAAW;EAC1E,eAAA;EACA,IAAI;EACJ,WAAW,QAAQ,KAAK;EACxB,cAAc,qBAAqBA,iBAAe,KAAK,CAAC;CAC1D,EAAE;CACF,QAAQ,OAAO,MAAM,KAAK,UAAU,QAAQ,CAAC;CAC7C,OAAO;AACT;AAQA,eAAe,qCACb,OACoC;CACpC,IAAI,6BAA6B,KAAK,IAAI,IAAI,iBAC5C,MAAM;CAER,IAAI;EACF,IAAI,MAAM,cAAc,QAAQ;GAC9B,MAAM,SAAS,MAAM,qCAAqC,KAAK;GAC/D,qBAAqB;GACrB,OAAO;EACT;EACA,MAAM,qCAAqC,KAAK;EAChD,qBAAqB;CACvB,SAAS,OAAO;EACd,MAAM,WAAW,iBAAiB;EAClC,IAAI,iBAAiB,iCAAiC;GACpD,4BAA4B;GAC5B,kBAAkB,KAAK,IAAI,IAAI;EACjC;EACA,MAAM,WAAW,kBAAkB,KAAKA,iBAAe,KAAK,CAAC,CAAC,GAAG;EACjE,IAAI,aAAa,WAAW,sBAAsB;EAClD,IAAI,UACF,aAAa;EAEf,MAAM,cAAc,GAAG,WAAW,GAAG,YAAY;EACjD,IAAI,4BAA4B,aAAa;GAC3C,0BAA0B;GAC1B,QAAQ,KACN,KAAK,UAAU;IACb,OAAO;IACP,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;IACnC;IACA,GAAI,WAAW,EAAE,UAAU,OAAO,QAAQ,EAAE,IAAI,CAAC;IACjD,WAAW,MAAM;IACjB,WAAW;IACX,GAAI,WAAW,EAAE,cAAc,+BAA+B,IAAI,CAAC;GACrE,CAAC,CACH;EACF;EACA,MAAM;CACR;AACF;AAEA,SAAS,uBAA6B;CACpC,IAAI,yBACF,QAAQ,KACN,KAAK,UAAU;EACb,OAAO;EACP,6BAAY,IAAI,KAAK,EAAA,CAAE,YAAY;CACrC,CAAC,CACH;CAEF,4BAA4B;CAC5B,kBAAkB;CAClB,0BAA0B;AAC5B;AAEA,SAAS,+BAA+B,OAKV;CAC5B,IAAI,MAAM,SAAS,GACjB,MAAM,IAAI,MACR,0CAA0C,MAAM,QAAQ,YACtD,MAAM,OAAO,KAAK,IAAI,KAAK,MAAM,OAAO,KAAK,MAAM,IAEvD;CAGF,IAAI;CACJ,IAAI;EACF,cAAc,KAAK,MAAM,MAAM,MAAM;CACvC,QAAQ;EACN,MAAM,IAAI,MAAM,oDAAoD;CACtE;CACA,MAAM,SAAS,kCAAkC,UAAU,WAAW;CACtE,IAAI,EAAE,OAAO,WAAW,OAAO,KAAK,cAAc,MAAM,YACtD,MAAM,IAAI,MAAM,oDAAoD;CAEtE,IAAI,CAAC,OAAO,KAAK,IACf,MAAM,IAAI,MAAM,OAAO,KAAK,YAAY;CAE1C,OAAO,OAAO,KAAK,cAAc,SAAS,OAAO,KAAK,cAAc,KAAA;AACtE;AAEA,eAAe,qBAAqB,OAAmC;CACrE,MAAM,QAAQ,MAAM,UAAU;CAC9B,IAAI,MAAM,cAAc,SAAS;EAC/B,MAAM,MAAM,MAAM,SAAS,MAAM,SAAS,MAAM,WAAW;EAC3D,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,IAAI,MAAM,cAAc,UAAU;EAChC,MAAM,OAAO,MAAM,SAAS,MAAM,OAAO;EACzC,OAAO;GACL,eAAA;GACA,IAAI;GACJ,WAAW;EACb;CACF;CACA,OAAO;EACL,eAAA;EACA,IAAI;EACJ,WAAW;EACX,aAAa,MAAM,KAAK,MAAM,SAAS,MAAM,OAAO;CACtD;AACF;AAEA,eAAe,kBAAmC;CAChD,IAAI,MAAM;CACV,QAAQ,MAAM,YAAY,MAAM;CAChC,WAAW,MAAM,SAAS,QAAQ,OAAO;EACvC,OAAO,OAAO,KAAK;EACnB,IAAI,OAAO,WAAW,KAAK,MAAM,IAAI,yBACnC,MAAM,IAAI,MAAM,6CAA6C;CAEjE;CACA,OAAO;AACT;AAEA,SAAS,qBAAqB,SAAyB;CAErD,QADmB,QAAQ,KAAK,KAAK,kCAAA,CACnB,MAAM,GAAG,IAAI;AACjC;AAEA,SAAS,cAAc,WAA2B;CAChD,OAAO,YAAY,QAAS,IACxB,GAAG,YAAY,IAAK,YACpB,GAAG,UAAU;AACnB;AAEA,SAASA,iBAAe,OAAwB;CAC9C,OAAO,iBAAiB,QAAQ,MAAM,UAAU,OAAO,KAAK;AAC9D;AAEA,SAAS,QAAQ,OAAuB;CACtC,OAAO,iBAAiB,QAAQ,QAAQ,IAAI,MAAM,OAAO,KAAK,CAAC;AACjE;AAEA,IAAM,kCAAN,cAA8C,MAAM;CAClD,OAAyB;AAC3B;AAEA,eAAe,YAAyC;CACtD,IAAI,aACF,OAAO;CAET,IAAI,QAAQ,aAAa,UACvB,MAAM,IAAI,MAAM,2CAA2C;CAG7D,IAAI,qBAAqB,GAAG;EAE1B,eAAc,MADS,OAAO,2CAAA,CACP,+BAA+B;EACtD,OAAO;CACT;CAMA,cAJgB,cAAc,OAAO,KAAK,GAItB,CAAC,CAHH,cAChB,IAAI,IAAI,mCAAmC,OAAO,KAAK,GAAG,CAE9B,CAAC;CAC/B,OAAO;AACT;;;ACjaA,MAAM,+BAA+B;AACrC,MAAM,4BAA4B;AAClC,MAAM,+BAA+B;AACrC,MAAM,qDACJ;AAGF,MAAM,2BAA2B,OAAO;AACxC,MAAM,qBAAqB;AAC3B,MAAM,yBAAyB;AAC/B,MAAM,yBAAyB;CAC7B,aAAa;CACb,WAAW;CACX,SAAS;AACX;AACA,IAAI,+BAA+B;AACnC,IAAI,kCAAkC;AA2CtC,eAAsB,iBACpB,OACyB;CACzB,MAAM,MAAM,cAAc;EACxB,aAAa,MAAM;EACnB,UAAU,MAAM;CAClB,CAAC;CACD,MAAM,aAAa,MAAM,SAAS,wBAAwB,GAAG,IAAI;CAEjE,IAAI,yBAAyB,GAAG;EAC9B,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV,KAAK;EACP;CACF;CAEA,IAAI,QAAQ,aAAa,UACvB,IAAI;EACF,MAAM,UAAU,wBAAwB,GAAG;EAC3C,IAAI,6BAA6B,GAC/B,MAAM,8BAA8B;GAClC;GACA,SAAS;GACT,aAAa,MAAM;EACrB,CAAC;OAED,MAAM,IAAI,MAAM,kDAAkD;EAEpE,OAAO;GACL,UAAU;GACV,SAAS;GACT;EACF;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB,KAAK;IACL,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV,KAAK;GACP;EACF;EACA,MAAM,aAAa,wBAAwB,GAAG;EAC9C,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,gCAAgC,KAAK;EACrC,OAAO;GAAE,UAAU;GAAiB,KAAK;EAAW;CACtD;CAGF,IAAI,QAAQ,aAAa,SACvB,IAAI;EACF,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV,KAAK;EACP;CACF,SAAS,OAAO;EACd,IAAI,sBAAsB,GAAG;GAC3B,MAAM,qBAAqB;IACzB,KAAK;IACL,aAAa,MAAM;GACrB,CAAC;GACD,OAAO;IACL,UAAU;IACV,KAAK;GACP;EACF;EACA,MAAM,IAAI,MACR,mDAAmDC,iBAAe,KAAK,GACzE;CACF;CAGF,IAAI,sBAAsB,GAAG;EAC3B,MAAM,qBAAqB;GACzB,KAAK;GACL,aAAa,MAAM;EACrB,CAAC;EACD,OAAO;GACL,UAAU;GACV,KAAK;EACP;CACF;CAEA,MAAM,IAAI,MACR,oDAAoD,QAAQ,SAAS,SAC5D,0BAA0B,oCACrC;AACF;AAEA,eAAsB,gBACpB,KACgC;CAChC,IAAI;EACF,IAAI,IAAI,aAAa,kBAAkB;GACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;GAGpE,OAAO,wBAAwB,MADX,6BAA6B,GAAG,CAChB;EACtC;EACA,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,IAAI,IAAI,aAAa,iBACnB,OAAO,wBAAwB,MAAM,qBAAqB,GAAG,CAAC;EAEhE,OAAO,EAAE,QAAQ,UAAU;CAC7B,SAAS,OAAO;EACd,OAAO;GACL,cAAcA,iBAAe,KAAK;GAClC,QAAQ;EACV;CACF;AACF;AAEA,eAAsB,kBAAkB,KAAoC;CAC1E,IAAI,IAAI,aAAa,kBAAkB;EACrC,IAAI,CAAC,6BAA6B,GAChC,MAAM,IAAI,MAAM,kDAAkD;EAEpE,MAAM,+BAA+B,GAAG;EACxC;CACF;CACA,IAAI,IAAI,aAAa,iBAAiB;EACpC,MAAM,wBAAwB,GAAG;EACjC;CACF;CACA,IAAI,IAAI,aAAa,iBACnB,MAAM,wBAAwB,GAAG;AAErC;AAEA,SAAgB,iBAAiB,OAAyC;CACxE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO;CAET,MAAM,SAAS;CACf,MAAM,WAAW,gBAAgB,OAAO,QAAQ;CAChD,IAAI,aAAa,kBACf,OAAO,QACL,gBAAgB,OAAO,OAAO,KAC5B,gBAAgB,OAAO,OAAO,KAC9B,OAAO,gBAAgB,KAAA,CAC3B;CAEF,IAAI,aAAa,mBAAmB,aAAa,iBAC/C,OAAO,sBAAsB,OAAO,GAAG,MAAM;CAE/C,OAAO;AACT;AAEA,SAAS,cAAc,OAGZ;CACT,MAAM,UAAU,QAAQ,gBAAgB,CAAC;CACzC,OAAO,WAAW,QAAQ,CAAC,CACxB,OAAO,GAAG,MAAM,SAAS,IAAI,MAAM,YAAY,IAAI,SAAS,CAAC,CAC7D,OAAO,KAAK;AACjB;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,iBAAiB,IAAI,GAAG,WAAW;AAC5C;AAEA,SAAS,wBAAwB,KAAqB;CACpD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,GAAG,IAAI,IAAI,WAAW,GAAG,CAAC,CAAC,OAAO,KAAK;AAC5E;AAEA,SAAS,+BAAwC;CAC/C,OAAO,qBAAqB;AAC9B;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,YAAY,MAAM,oBACtB,8BACA,MAAM,aACN,MAAM,GACR;CACA,MAAM,MAAM,mBAAmB,GAAG,EAAE,WAAW,KAAK,CAAC;CAIrD,MAAM,UAAU,sBAAsB,MAAM,GAAG,GAAG,GAAG,UAAU,KAAK,EAAE,KAAK;EACzE,UAAU;EACV,MAAM;CACR,CAAC;AACH;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,YAAY,MAAM,SACtB,sBAAsB,MAAM,GAAG,GAC/B,MACF,CAAC,CAAC,OAAO,UAAU;EACjB,IAAIC,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CAAC;CACD,IAAI,CAAC,WACH,OAAO;CAET,OAAO,oBACL,8BACA,UAAU,KAAK,GACf,MAAM,GACR;AACF;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,sBAAsB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AAC5D;AAEA,eAAe,qBAAqB,OAGlB;CAChB,MAAM,4BAA4B;CAClC,MAAM,OAAO,kBAAkB,MAAM,GAAG;CACxC,MAAM,UAAU,MAAM,GAAG,MAAM,YAAY,KAAK;EAC9C,UAAU;EACV,MAAM;CACR,CAAC;CACD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,MAAM,GAAK;AAE3B;AAEA,eAAe,qBAAqB,OAET;CACzB,MAAM,MAAM,MAAM,SAAS,kBAAkB,MAAM,GAAG,GAAG,MAAM,CAAC,CAAC,OAC9D,UAAU;EACT,IAAIA,sBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,OAAO,MAAM,IAAI,KAAK,IAAI;AAC5B;AAEA,eAAe,wBAAwB,OAAuC;CAC5E,MAAM,GAAG,kBAAkB,MAAM,GAAG,GAAG,EAAE,OAAO,KAAK,CAAC;AACxD;AAEA,SAAS,qBAA6B;CACpC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,QAAQ;AACjD;AAEA,SAAS,sBAAsB,KAAqB;CAClD,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,kBAAkB,KAAqB;CAC9C,OAAO,KAAK,mBAAmB,GAAG,GAAG,yBAAyB,GAAG,EAAE,OAAO;AAC5E;AAEA,SAAS,wBAAiC;CACxC,IAAI,QAAQ,IAAI,+BAA+B,KAAK;EAClD,qBAAqB,KAAK;EAC1B,OAAO;CACT;CAIA,MAAM,kBAAkB,CAAC,4BAA4B;CACrD,IAAI,iBACF,qBAAqB,UAAU;CAEjC,OAAO;AACT;AAEA,SAAS,gCAAgC,OAAsB;CAC7D,IAAI,iCACF;CAEF,kCAAkC;CAClC,MAAM,qBAAqB,qBAAqB,IAC5C,oFACA;CACJ,QAAQ,KACN,8JAGK,mBAAmB,YAAYD,iBAAe,KAAK,GAC1D;AACF;AAEA,SAAS,qBAAqB,QAAkC;CAC9D,IAAI,8BACF;CAEF,+BAA+B;CAE/B,MAAM,aACJ,WAAW,QACP,cAAc,0BAA0B,MACxC,sCAAsC,QAAQ,SAAS;CAC7D,QAAQ,KACN,oEAAoE,WAAW,WACpE,0BAA0B,0FAEvC;AACF;AAEA,SAAS,2BAAoC;CAC3C,OAAO,QAAQ,IAAI,kCAAkC;AACvD;AAEA,SAAS,8BAAuC;CAC9C,OAAO,QAAQ,aAAa,YAAY,QAAQ,aAAa;AAC/D;AAEA,eAAe,8BAA6C;CAC1D,MAAM,YAAY,mBAAmB;CACrC,MAAM,MAAM,WAAW;EAAE,WAAW;EAAM,MAAM;CAAM,CAAC;CACvD,IAAI,QAAQ,aAAa,SACvB,MAAM,MAAM,WAAW,GAAK;AAEhC;AAEA,eAAe,oBACb,QACA,OACA,SACiB;CACjB,MAAM,UAAU,KAAK,UAAU;EAAE;EAAO;CAAQ,CAAC;CAajD,QAAO,MAZc,WACnB,kBACA;EACE;EACA;EACA;EACA;EACA;EACA;CACF,GACA,OACF,EAAA,CACc,OAAO,KAAK;AAC5B;AAEA,eAAe,WACb,SACA,MACA,cAC6C;CAC7C,IAAI;EACF,MAAM,EAAE,aAAa,MAAM,OAAO;EAwClC,OAAO,MAvCc,IAAI,SACtB,SAAS,WAAW;GACnB,IAAI,SAAS;GACb,IAAI,SAAS;GAEb,MAAM,QAAQ,SAAS,SAAS,MAAM,EAAE,GAAG,uBAAuB,CAAC;GAEnE,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,YAAY,MAAM;GAChC,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GACD,MAAM,QAAQ,GAAG,SAAS,UAAmB;IAC3C,UAAU,OAAO,KAAK;GACxB,CAAC;GAED,MAAM,GAAG,UAAU,UAAU;IAC3B,OAAO,eAAe,OAAO,OAAO,CAAC;GACvC,CAAC;GAED,MAAM,GAAG,UAAU,SAAS;IAC1B,IAAI,SAAS,GAAG;KACd,QAAQ;MAAE;MAAQ;KAAO,CAAC;KAC1B;IACF;IACA,OACE,eACE,EACE,SAAS,mBAAmB,QAAQ,mBAAmB,OACzD,GACA,OACF,CACF;GACF,CAAC;GAED,MAAM,OAAO,MAAM,YAAY;GAC/B,MAAM,OAAO,IAAI;EACnB,CACF;CAEF,SAAS,OAAO;EACd,MAAM,eAAe,OAAO,OAAO;CACrC;AACF;AAEA,SAAS,eACP,OACA,SACoE;CACpE,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,uBAAO,IAAI,MAAM,mBAAmB,QAAQ,KAAK,OAAO,KAAK,GAAG;CAElE,MAAM,IAAI;CAKV,MAAM,OAAO,OAAO,EAAE,SAAS,WAAW,EAAE,OAAO;CACnD,MAAM,eAAe,CAAC,mBAAmB,QAAQ,EAAE;CACnD,IAAI,OAAO,EAAE,WAAW,YAAY,EAAE,OAAO,KAAK,GAChD,aAAa,KAAK,WAAW,EAAE,OAAO,KAAK,GAAG;MACzC,IAAI,EAAE,SACX,aAAa,KAAK,EAAE,OAAO;CAE7B,MAAM,UAAU,IAAI,MAAM,aAAa,KAAK,IAAI,CAAC;CAKjD,QAAQ,OAAO;CACf,QAAQ,SAAS,EAAE;CACnB,QAAQ,SAAS,EAAE;CACnB,OAAO;AACT;AAEA,SAAS,gBAAgB,OAAwB;CAC/C,OAAO,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;AAClC;AAEA,SAAS,sBAAsB,OAA+B;CAC5D,MAAM,aAAa,gBAAgB,KAAK;CACxC,IAAI,CAAC,uBAAuB,KAAK,UAAU,GACzC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,yBAAyB,OAAwB;CACxD,MAAM,aAAa,sBAAsB,KAAK;CAC9C,IAAI,eAAe,MACjB,MAAM,IAAI,MAAM,6BAA6B;CAE/C,OAAO;AACT;AAEA,SAAS,eAAe,OAAqC;CAC3D,IAAI,UAAU,MACZ,OAAO;CAET,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA6C;CAC5E,MAAM,cAAc,eAAe,KAAK;CACxC,IAAI,CAAC,aACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,OAAO;EACL;EACA,QAAQ;CACV;AACF;AAEA,SAASA,iBAAe,OAAwB;CAC9C,IAAI,iBAAiB,OACnB,OAAO,MAAM;CAEf,OAAO,OAAO,KAAK;AACrB;AAEA,SAASC,sBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;AAEV,MAAM,+BAA+B;CACnC;CACA;CACA;CACA;CACA;CACA;CACA;AACF,CAAC,CAAC,KAAK,GAAG;;;AC1fV,MAAM,kCAAkC;AACxC,MAAM,2BAA2B;AAEjC,IAAM,0BAAN,cAAsC,MAAM;CAC1C;CAEA,YAAY,OAIT;EACD,MACE,MAAM,SACN,MAAM,UAAU,KAAA,IAAY,KAAA,IAAY,EAAE,OAAO,MAAM,MAAM,CAC/D;EACA,KAAK,OAAO;EACZ,KAAK,SAAS,MAAM;CACtB;AACF;AAEA,IAAa,qCAAb,cAAwD,MAAM;CAC5D,cAAc;EACZ,MACE,uJACF;EACA,KAAK,OAAO;CACd;AACF;AAEA,IAAa,0CAAb,cAA6D,MAAM;CACjE,SAAkB;CAElB,cAAc;EACZ,MACE,+MACF;EACA,KAAK,OAAO;CACd;AACF;AAEA,IAAa,qCAAb,cAAwD,MAAM;CAC5D;CACA;CAKA,YAAY,OAGT;EACD,MAAM,WAAW;GACf,iBAAiB;GACjB,qBAAqB;GACrB,kBAAkB;EACpB,EAAE,MAAM;EACR,MAAM,UAAU,MAAM,wBAClB,uCACA;EACJ,MAAM,0CAA0C,SAAS,IAAI,SAAS;EACtE,KAAK,OAAO;EACZ,KAAK,SAAS,MAAM;EACpB,KAAK,wBAAwB,MAAM;CACrC;AACF;AAwJA,MAAM,sBAAsB;AAO5B,IAAI,oBAA8C;AAClD,MAAM,iDAAiC,IAAI,IAAY;AAEvD,eAAsB,oBACpB,UAAsC,CAAC,GACN;CACjC,OAAO,MAAM,6CAA6C,SAAS,KAAK;AAC1E;AAEA,eAAe,6CACb,SACA,2BACiC;CACjC,MAAM,aAAa,MAAM,yBAAyB;CAClD,MAAM,kBAAkB,mBAAmB,cAAc;CACzD,MAAM,uBACJ,QAAQ,mBAAmB,QAC1B,QAAQ,mBAAmB,QAAQ,WAAW,UAAU;CAC3D,QAAQ,WAAW,OAAnB;EACE,KAAK;EACL,KAAK,WACH,OAAO;EACT,KAAK;GACH,IAAI,CAAC,sBACH,OAAO;GAET;EACF,KAAK,SACH;EACF,SACE,OAAO;CACX;CACA,IAAI,CAAC,sBACH,OAAO;CAET,IACE,CAAC,6BACA,MAAM,4CAA4C,GAEnD,OAAO,MAAM,oCACX,YACE,MAAM,6CAA6C,SAAS,IAAI,CACpE;CAGF,MAAM,mBAAmB,MAAM,0BAA0B,WAAW,OAAO;CAC3E,IAAI,iBAAiB,UAAU,SAC7B,OAAO,MAAM,oCAAoC;EAC/C;EACA;EACA;CACF,CAAC;CAEH,IAAI,iBAAiB,UAAU,WAAW;EACxC,IAAI,WAAW,UAAU,aAAa,QAAQ,mBAAmB,MAI/D,OAAO;GACL,OAAO;GACP,SAAS,WAAW;EACtB;EAEF,OAAO;CACT;CAEA,OAAO;EACL,YAAY,mCAAmC,iBAAiB,KAAK;EACrE,OAAO,iBAAiB;EACxB,SAAS;CACX;AACF;AAEA,eAAe,8CAAgE;CAC7E,MAAM,UAAU,MAAM,iCAAiC;CACvD,OAAO,QACL,SAAS,UAAU,aACjB,QAAQ,sCAAsC,KAC9C,wDAAwD,OAAO,CACnE;AACF;AAEA,eAAe,oCAAoC,OAIf;CAClC,IACE,CAAC,MAAM,iBAAiB,aACxB,UAAU,MAAM,iBAAiB,SAAS,GAE1C,OAAO,MAAM;CAGf,IAAI;CACJ,IAAI;EACF,mBAAmB,MAAM,4BAA4B;GACnD,aACE,MAAM,iBAAiB,eACvB,MAAM,WAAW,QAAQ;GAC3B,oBAAoB,MAAM;GAC1B,WAAW,MAAM,iBAAiB;GAClC,qBAAqB,MAAM,WAAW,QAAQ;EAChD,CAAC;CACH,SAAS,OAAO;EACd,IAAI,EAAE,iBAAiB,qCACrB,MAAM;EAOR,OAAO;GACL,OAAO;GACP,SAAS;IACP,GAAG,MAAM,WAAW;IACpB,aACE,MAAM,iBAAiB,eACvB,MAAM,WAAW,QAAQ;IAC3B,WAAW,MAAM,iBAAiB;GACpC;EACF;CACF;CAEA,IAAI,CAAC,kBACH,OAAO,MAAM,yBAAyB;CAExC,OAAO;EACL,OAAO;EACP,SAAS;CACX;AACF;AAKA,eAAsB,4BAAoD;CAIxE,MAAM,eAAc,MAHI,oBAAoB,EAC1C,gBAAgB,MAClB,CAAC,CAAC,CAAC,YAAY,IAAI,EAAA,EACY,SAAS,MAAM,IAAI,KAAK,KAAK;CAC5D,OAAO,YAAY,SAAS,IAAI,cAAc;AAChD;AAEA,eAAsB,eAAe,OAAwC;CAC3E,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAG5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAG7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAGzC,MAAM,sCAAsC,YAAY;EACtD,MAAM,gDAAgD;EACtD,MAAM,yBAAyB;EAG/B,MAAM,mBAAmB,mBAAkB,MADb,uBAAuB,EAAA,EACO,QAAQ;EACpE,MAAM,WAAW,MAAM,iBAAiB;GACtC;GACA;GACA;EACF,CAAC;EAED,MAAM,UAAyB;GAC7B,GAAG;GACH;GACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;GACzD;GACA;GACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;GAC5C,GAAG,qBAAqB,MAAM,IAAI;GAClC,GAAG,+BAA+B,MAAM,kBAAkB;EAC5D;EAEA,MAAM,OAAO,gBAAgB;EAC7B,MAAM,2BAA2B;EAEjC,IAAI;GACF,MAAM,+BAA+B;IAAE;IAAa;GAAS,CAAC;GAC9D,MAAM,8BAA8B,MAAM,OAAO;EACnD,SAAS,OAAO;GACd,MAAM,oCAAoC,QAAQ;GAClD,MAAM;EACR;EAEA,iBAAiB;GACf;GACA,SAAS,uBAAuB;IAAE;IAAa;GAAQ,CAAC;EAC1D,CAAC;EACD,IACE,oBACA,CAAC,wBAAwB,kBAAkB,QAAQ,GAEnD,MAAM,oCAAoC,gBAAgB;CAE9D,CAAC;AACH;AAEA,eAAsB,2BACpB,OACA,UAAwC,CAAC,GACT;CAChC,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,0BAA0B;CAE5C,MAAM,cAAc,OAAO,MAAM,eAAe,EAAE,CAAC,CAAC,KAAK;CACzD,IAAI,CAAC,aACH,MAAM,IAAI,MAAM,2BAA2B;CAE7C,MAAM,WAAW,OAAO,MAAM,YAAY,EAAE,CAAC,CAAC,KAAK;CACnD,IAAI,CAAC,UACH,MAAM,IAAI,MAAM,uBAAuB;CAGzC,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,gDAAgD;EACtD,MAAM,yBAAyB;EAC/B,MAAM,2BAA2B;EACjC,MAAM,kBAAkB,MAAM,uBAAuB;EACrD,MAAM,gBAAgB,MAAM,yBAAyB,EAAE,SAAS,MAAM,CAAC;EACvE,MAAM,kBACJ,cAAc,UAAU,WAAW,cAAc,UAAU,YACvD,cAAc,UACd;EACN,8BAA8B;GAC5B,SAAS,yBAAyB,eAAe;GACjD,UAAU,QAAQ;EACpB,CAAC;EACD,MAAM,WAAW,MAAM,iBAAiB;GACtC;GACA;GACA;GACA,QAAQ;EACV,CAAC;EACD,MAAM,cAA6B;GACjC,GAAG;GACH;GACA,WAAW,OAAO,MAAM,aAAa,QAAQ,CAAC,CAAC,KAAK,KAAK;GACzD;GACA;GACA,4BAAW,IAAI,KAAK,EAAA,CAAE,YAAY;GAClC,GAAI,MAAM,YAAY,EAAE,WAAW,MAAM,UAAU,IAAI,CAAC;GACxD,GAAI,MAAM,QAAQ,EAAE,OAAO,MAAM,MAAM,IAAI,CAAC;GAC5C,GAAG,qBAAqB,MAAM,IAAI;GAClC,GAAG,+BAA+B,MAAM,kBAAkB;EAC5D;EACA,MAAM,UAA0C;GAC9C,GAAG;GACH,IAAI,WAAW;GACf,OAAO;GACP,UAAU,QAAQ;GAClB,uBAAuB;GACvB,iBACE,iBAAiB,MAAM,IAAK,kBAAoC;GAClE,kBAAkB;GAClB,mCAAmC;GACnC,oBAAoB,CAAC,QAAQ;GAC7B,GAAI,QAAQ,kBACR,EACE,iBAAiB,EACf,YAAY,QAAQ,gBAAgB,WACtC,EACF,IACA,CAAC;EACP;EACA,IAAI,iBAAiB;EACrB,IAAI;GACF,MAAM,+BAA+B;IAAE;IAAa;GAAS,CAAC;GAC9D,MAAM,kCAAkC,OAAO;GAC/C,iBAAiB;GACjB,+BAA+B,IAAI,QAAQ,EAAE;EAC/C,SAAS,OAAO;GACd,+BAA+B,OAAO,QAAQ,EAAE;GAChD,IAAI,gBAAgB;IAClB,MAAM,iCAAiC,OAAO,CAAC,CAAC,YAAY,KAAA,CAAS;IACrE,MAAM,0CAA0C,OAAO,CAAC,CAAC,YACjD,KAAA,CACR;GACF;GACA,MAAM,oCAAoC,QAAQ;GAClD,MAAM;EACR;EACA,iBAAiB;GACf,SAAS;GACT,SAAS,uBAAuB;IAAE;IAAa,SAAS;GAAY,CAAC;EACvE,CAAC;EAED,IAAI,aAAsD;EAC1D,MAAM,gCAAgC;GACpC,IAAI,eAAe,WACjB,MAAM,IAAI,MAAM,4CAA4C;EAEhE;EACA,MAAM,4BACJ,mBACG;GACH,IAAI,CAAC,QAAQ,iBACX,OAAO,mBAAmB;GAE5B,OACE,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,QAAQ,eAAe;EAExD;EACA,MAAM,6BACJ,gBACA,mBAA2C,gBAE3C,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,gBAAgB;EAC/C,MAAM,+BAA+B,YAAY;GAC/C,MAAM,iBAAiB,MAAM,uBAAuB;GACpD,IAAI,CAAC,yBAAyB,cAAc,GAC1C,MAAM,IAAI,MACR,4DACF;EAEJ;EACA,MAAM,iCAAiC,OACrC,mBAA2C,gBACxC;GACH,MAAM,iBAAiB,MAAM,uBAAuB;GACpD,IACE,EACE,yBAAyB,cAAc,KACvC,0BAA0B,gBAAgB,gBAAgB,IAG5D,MAAM,IAAI,MACR,4DACF;EAEJ;EACA,MAAM,kCAAkC,YAAY;GAClD,MAAM,iBAAiB,MAAM,uBAAuB;GACpD,IACE,EACE,yBAAyB,cAAc,KACvC,0BAA0B,cAAc,IAE1C;IACA,IAAI;KACF,MAAM,qDAAqD;MACzD;MACA;KACF,CAAC;IACH,UAAU;KACR,+BAA+B,OAAO,QAAQ,EAAE;IAClD;IACA,MAAM,IAAI,mCAAmC;KAC3C,uBAAuB;KACvB,QAAQ;IACV,CAAC;GACH;GAEA,MAAM,kCAAkC,OAAO;GAC/C,IAAI;IACF,MAAM,iCAAiC,SAAS,eAAe;IAC/D,aAAa;IACb,MAAM,oCAAoC,QAAQ,CAAC,CAAC,OACjD,UAAmB;KAClB,wCAAwC;MACtC;MACA,cAAc,QAAQ;KACxB,CAAC;IACH,CACF;GACF,UAAU;IACR,+BAA+B,OAAO,QAAQ,EAAE;IAChD,MAAM,0CAA0C,OAAO;GACzD;EACF;EAEA,OAAO;GACL;GACA,QAAQ,YACN,MAAM,sCAAsC,YAAY;IACtD,wBAAwB;IACxB,MAAM,iBACJ,MAAM,sCAAsC,OAAO;IACrD,IAAI,eAAe,WAAW,WAAW;KACvC,MAAM,gCAAgC;KACtC,MAAM,IAAI,mCAAmC;MAC3C,uBAAuB;MACvB,QAAQ;KACV,CAAC;IACH;IACA,IAAI,eAAe,WAAW,WAAW;KACvC,+BAA+B,OAAO,QAAQ,EAAE;KAChD,MAAM,IAAI,mCAAmC;MAC3C,uBAAuB;MACvB,QAAQ,eAAe;KACzB,CAAC;IACH;IACA,MAAM,mBAAmB,eAAe,QAAQ;IAChD,MAAM,mBACJ,MAAM,iCAAiC,gBAAgB;IACzD,MAAM,6BAA6B;IACnC,MAAM,8BACJ,gBAAgB,GAChB,gBACF;IACA,iBAAiB;KACf,SAAS;KACT,SAAS;IACX,CAAC;IACD,MAAM,mBAAmD;KACvD,GAAG,eAAe;KAClB,OAAO;IACT;IACA,MAAM,yCACJ,eAAe,SACf,gBACF;IACA,aAAa;IACb,+BAA+B,OAAO,QAAQ,EAAE;IAChD,MAAM,uCAAuC,gBAAgB,CAAC,CAAC,OAC5D,UAAmB;KAClB,wCAAwC;MACtC;MACA,cAAc,QAAQ;KACxB,CAAC;IACH,CACF;GACF,CAAC;GACH,UAAU,YACR,MAAM,sCAAsC,YAAY;IACtD,IAAI,eAAe,eACjB;IAEF,wBAAwB;IACxB,MAAM,iBACJ,MAAM,sCAAsC,OAAO;IACrD,IAAI,eAAe,WAAW,WAAW;KACvC,MAAM,gCAAgC;KACtC;IACF;IACA,IAAI,eAAe,WAAW,WAAW;KACvC,+BAA+B,OAAO,QAAQ,EAAE;KAChD,MAAM,IAAI,mCAAmC;MAC3C,uBAAuB;MACvB,QAAQ,eAAe;KACzB,CAAC;IACH;IACA,MAAM,+BACJ,eAAe,QAAQ,gBACzB;IACA,MAAM,iCACJ,eAAe,SACf,eACF;IACA,aAAa;IACb,+BAA+B,OAAO,QAAQ,EAAE;IAChD,+BAA+B,eAAe,OAAO;IACrD,IAAI,eAAe,QAAQ,iBAAiB;KAC1C,MAAM,yCACJ,eAAe,SACf;MACE,GAAG,eAAe;MAClB,OAAO;KACT,CACF;KACA;IACF;IACA,MAAM,0BAA0B,eAAe,OAAO;IACtD,MAAM,0CACJ,eAAe,OACjB;GACF,CAAC;EACL;CACF,CAAC;AACH;AAQA,eAAe,sCACb,UAC4C;CAC5C,MAAM,iBAAiB,MAAM,iCAAiC;CAC9D,IAAI,CAAC,gBACH,OAAO,EAAE,QAAQ,UAAU;CAE7B,IAAI,CAAC,qCAAqC,UAAU,cAAc,GAChE,OAAO;EAAE,QAAQ;EAAoB,SAAS;CAAe;CAE/D,IAAI,eAAe,UAAU,WAC3B,OAAO;EAAE,QAAQ;EAAuB,SAAS;CAAe;CAElE,OAAO;EAAE,QAAQ;EAAW,SAAS;CAAe;AACtD;AAEA,eAAsB,4CAAoG;CACxH,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,qDAAqD;EAC3D,MAAM,UAAU,MAAM,iCAAiC;EACvD,IAAI,EAAE,SAAS,UAAU,uBAAuB,QAAQ,kBACtD,OAAO;EAKT,IAAI,QAAQ,gBAAgB,wBAAwB;GAClD,IAAI,QAAQ,gBAAgB,qBAAqB;IAC/C,MAAM,0BAA0B,OAAO;IACvC,MAAM,0CAA0C,OAAO;IACvD,OAAO;GACT;GACA,OAAO;IACL,kBAAkB;IAClB,YAAY,QAAQ,gBAAgB;IACpC,IAAI,QAAQ;IACZ,iBAAiB,MAAM,+BACrB,QAAQ,eACV;IACA,sBAAsB;IACtB,mBAAmB,QAAQ,QAAQ,gBAAgB,mBAAmB;GACxE;EACF;EAEA,MAAM,mBAAmB,MAAM,0CAC7B,QAAQ,gBACV;EACA,IAAI,CAAC,kBACH,MAAM,IAAI,wBAAwB;GAChC,SAAS;GACT,QAAQ;EACV,CAAC;EAEH,MAAM,uBAAuB,wBAC3B,iBAAiB,MAAM,EACzB;EACA,IAAI,CAAC,sBACH,MAAM,IAAI,wBAAwB;GAChC,SACE;GACF,QAAQ;EACV,CAAC;EAGH,OAAO;GACL,kBAAkB;IAChB,GAAG;IACH,MAAM;KAAE,GAAG,iBAAiB;KAAM,IAAI;IAAqB;GAC7D;GACA,YAAY,QAAQ,gBAAgB;GACpC,IAAI,QAAQ;GACZ,iBAAiB,MAAM,+BACrB,QAAQ,eACV;GACA,sBAAsB;GACtB,mBAAmB,QAAQ,QAAQ,gBAAgB,mBAAmB;EACxE;CACF,CAAC;AACH;AAEA,eAAsB,2CAA2C,OAG/C;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,UAAU,MAAM,wCAAwC,MAAM,EAAE;EACtE,MAAM,yCAAyC,SAAS;GACtD,GAAG;GACH,iBAAiB;IACf,GAAG,QAAQ;IACX,GAAI,MAAM,UAAU,YAChB,EAAE,sCAAqB,IAAI,KAAK,EAAA,CAAE,YAAY,EAAE,IAChD,EAAE,yCAAwB,IAAI,KAAK,EAAA,CAAE,YAAY,EAAE;IACvD,qBAAqB,KAAA;GACvB;EACF,CAAC;CACH,CAAC;AACH;AAEA,eAAsB,oDAAoD,OAMxD;CAChB,MAAM,sCAAsC,YAAY;EACtD,MAAM,iEACJ,KACF;CACF,CAAC;AACH;AAEA,eAAe,iEAAiE,OAM9D;CAChB,MAAM,UAAU,MAAM,wCAAwC,MAAM,EAAE;CACtE,MAAM,yCAAyC,SAAS;EACtD,GAAG;EACH,iBAAiB;GACf,GAAG,QAAQ;GACX,qBAAqB;IACnB,qBAAI,IAAI,KAAK,EAAA,CAAE,YAAY;IAC3B,SAAS,MAAM;IACf,OAAO,MAAM;IACb,GAAI,MAAM,WAAW,EAAE,UAAU,MAAM,SAAS,IAAI,CAAC;IACrD,GAAI,MAAM,WAAW,KAAA,IAAY,CAAC,IAAI,EAAE,QAAQ,MAAM,OAAO;GAC/D;EACF;CACF,CAAC;AACH;AAEA,eAAsB,+CACpB,IACkB;CAClB,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,UAAU,MAAM,wCAAwC,EAAE;EAChE,IACE,EACE,QAAQ,gBAAgB,uBACxB,QAAQ,gBAAgB,yBAG1B,MAAM,IAAI,MACR,kFACF;EAEF,IAAI;GACF,MAAM,0BAA0B,OAAO;GACvC,MAAM,0CAA0C,OAAO;GACvD,OAAO;EACT,SAAS,OAAO;GACd,MAAM,iEAAiE;IACrE;IACA,SAAS,eAAe,KAAK;IAC7B,OAAO;GACT,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;GACxB,wCAAwC;IAAE;IAAO,cAAc;GAAG,CAAC;GACnE,OAAO;EACT;CACF,CAAC;AACH;AAUA,eAAsB,yBAA8D;CAElF,OAAO,yBAAyB,MADV,mBAAmB,CACF;AACzC;AAEA,SAAS,yBACP,SAC4B;CAC5B,IAAI,SAAS,MAAM,GACjB,OAAO;CAGT,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,eAAe,YAAY,YAC/B,OAAO;CAGT,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;EACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;EACL,GAAG,qBAAqB,QAAQ,IAAI;EACpC,GAAG,+BAA+B,QAAQ,kBAAkB;CAC9D;AACF;AAEA,eAAsB,oCACpB,oBACe;CACf,MAAM,sCAAsC,YAAY;EACtD,MAAM,gDAAgD;EACtD,MAAM,UAAU,MAAM,uBAAuB;EAC7C,IAAI,SAAS,MAAM,GACjB,MAAM,IAAI,MAAM,wDAAwD;EAG1E,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;EACnD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;EAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;EAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;EACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;EAC3D,IAAI,EAAE,YAAY,aAAa,eAAe,YAAY,YACxD,MAAM,IAAI,MACR,4DACF;EAGF,MAAM,cAA6B;GACjC,GAAG;GACH;GACA;GACA;GACA;GACA;GACA,GAAI,OAAO,QAAQ,cAAc,YAAY,QAAQ,UAAU,KAAK,IAChE,EAAE,WAAW,QAAQ,UAAU,KAAK,EAAE,IACtC,CAAC;GACL,GAAI,OAAO,QAAQ,UAAU,YAAY,QAAQ,MAAM,KAAK,IACxD,EAAE,OAAO,QAAQ,MAAM,KAAK,EAAE,IAC9B,CAAC;GACL,GAAG,qBAAqB,QAAQ,IAAI;GACpC,GAAG,+BAA+B,kBAAkB;EACtD;EAEA,MAAM,8BAA8B,gBAAgB,GAAG,WAAW;EAClE,MAAM,uBAAuB,sBAAsB,OAAO;EAC1D,IAAI,sBACF,iBAAiB;GACf,SAAS;GACT,SAAS,uBAAuB;IAC9B,aAAa,qBAAqB;IAClC,SAAS;GACX,CAAC;EACH,CAAC;CAEL,CAAC;AACH;AAEA,eAAsB,mBAAoD;CACxE,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,gDAAgD;EACtD,oBAAoB;EACpB,MAAM,yBAAyB;EAC/B,MAAM,kBAAkB,MAAM,sBAAsB;EACpD,IAAI;EACJ,IAAI;GACF,UAAU,MAAM,uBAAuB;EACzC,SAAS,OAAO;GACd,IACE,EACE,iBAAiB,2BAA2B,MAAM,WAAW,YAG/D,MAAM;GAIR,MAAM,uBAAuB,KAC3B,gBAAgB,GAChB,QACA,mBAAmB,WAAW,EAAE,MAClC;GACA,MAAM,OAAO,gBAAgB,GAAG,oBAAoB;GACpD,OAAO;IAAE;IAAiB;GAAqB;EACjD;EACA,IAAI,SAAS,MAAM,KAAK,iBAAiB,QAAQ,QAAQ,GACvD,MAAM,oCAAoC,QAAQ,QAAQ;EAE5D,MAAM,kBAAkB;EACxB,OAAO,EAAE,gBAAgB;CAC3B,CAAC;AACH;AAEA,eAAsB,qCAAoD;CACxE,MAAM,sCACJ,+CACF;AACF;AAEA,eAAe,kDAAiE;CAC9E,MAAM,qDAAqD;CAC3D,IAAI,MAAM,iCAAiC,GACzC,MAAM,IAAI,mCAAmC;AAEjD;AAEA,eAAe,2BAA0C;CACvD,MAAM,UAAU,MAAM,wBAAwB;CAC9C,IAAI,QAAQ,UAAU,WAAW,GAC/B;CAGF,MAAM,YAA8B,CAAC;CACrC,KAAK,MAAM,YAAY,QAAQ,WAC7B,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,UAAU,KAAK,QAAQ;CACzB;CAEF,MAAM,2BAA2B,SAAS;AAC5C;AAEA,eAAe,oCACb,UACe;CACf,IAAI;EACF,MAAM,kBAAkB,QAAQ;CAClC,QAAQ;EACN,MAAM,UAAU,MAAM,wBAAwB;EAC9C,IACE,QAAQ,UAAU,MAAM,QAAQ,wBAAwB,KAAK,QAAQ,CAAC,GAEtE;EAEF,MAAM,2BAA2B,CAAC,GAAG,QAAQ,WAAW,QAAQ,CAAC;CACnE;AACF;AAEA,eAAe,0BAA0D;CACvE,MAAM,MAAM,MAAM,SAAS,wBAAwB,GAAG,MAAM,CAAC,CAAC,OAC3D,UAAU;EACT,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR,CACF;CACA,IAAI,QAAQ,MACV,OAAO;EAAE,GAAG;EAAG,WAAW,CAAC;CAAE;CAG/B,IAAI;CACJ,IAAI;EACF,SAAS,KAAK,MAAM,GAAG;CACzB,QAAQ;EACN,MAAM,IAAI,MAAM,+CAA+C;CACjE;CACA,IACE,EAAE,SAAS,MAAM,KAAK,OAAO,MAAM,KAAK,MAAM,QAAQ,OAAO,SAAS,IAEtE,MAAM,IAAI,MAAM,+CAA+C;CAEjE,MAAM,YAAY,OAAO,UAAU,OAAO,gBAAgB;CAC1D,IAAI,UAAU,WAAW,OAAO,UAAU,QACxC,MAAM,IAAI,MAAM,+CAA+C;CAEjE,OAAO;EAAE,GAAG;EAAG;CAAU;AAC3B;AAEA,eAAe,2BACb,WACe;CACf,MAAM,OAAO,wBAAwB;CACrC,IAAI,UAAU,WAAW,GAAG;EAC1B,MAAM,GAAG,MAAM,EAAE,OAAO,KAAK,CAAC;EAC9B;CACF;CACA,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;CAChE,MAAM,oBAAoB,MAAM;EAAE,GAAG;EAAG;CAAU,CAAC;AACrD;AAEA,SAAS,0BAAkC;CACzC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,4BAA4B;AACrE;AAEA,eAAe,wBAA0C;CACvD,IAAI;EACF,MAAM,SAAS,gBAAgB,GAAG,MAAM;EACxC,OAAO;CACT,SAAS,OAAO;EACd,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM;CACR;AACF;AAEA,eAAe,yBACb,UAAiC,CAAC,GACF;CAChC,IAAI;CACJ,IAAI;EACF,UACE,QAAQ,YAAY,QAChB,MAAM,uBAAuB,IAC7B,MAAM,mBAAmB;CACjC,SAAS,OAAO;EACd,IAAI,iBAAiB,yBACnB,OAAO;GACL,cAAc,MAAM;GACpB,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,MAAM;CACR;CACA,IAAI,SAAS,MAAM,GACjB,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,WAAW,kBAAkB,QAAQ,QAAQ;CACnD,IAAI,CAAC,UACH,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,MAAM,cAAc,wBAAwB,QAAQ,WAAW;CAC/D,MAAM,WAAW,wBAAwB,QAAQ,QAAQ;CACzD,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,EAAE,aAAa,eAAe,YAAY,YAC5C,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAGF,IAAI,UAAU,sBAAsB,OAAO;CAC3C,IAAI,CAAC,SAAS;EACZ,MAAM,cAAc,MAAM,gBAAgB,QAAQ;EAClD,IAAI,YAAY,WAAW,WACzB,OAAO;GACL,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,IAAI,YAAY,WAAW,eACzB,OAAO;GACL,cAAc,YAAY;GAC1B,YAAY;GACZ,OAAO;GACP,SAAS;EACX;EAEF,UAAU,uBAAuB;GAC/B,aAAa,YAAY;GACzB,SAAS;IACP,GAAG;IACH,GAAG;IACH;IACA;IACA;IACA;IACA;GACF;EACF,CAAC;EACD,iBAAiB;GAAE;GAAS;EAAQ,CAAC;CACvC;CAEA,MAAM,oBAAoB,oCACxB,QAAQ,SACV;CACA,IAAI,kBAAkB,WAAW,WAC/B,OAAO;EACL,YAAY;EACZ,OAAO;EACP,SAAS;CACX;CAEF,IAAI,kBAAkB,WAAW,WAC/B,OAAO;EACL,YAAY;EACZ,OAAO;EACP;CACF;CAGF,OAAO;EACL,OAAO;EACP;CACF;AACF;AAEA,eAAe,+BAA+B,OAG5B;CAChB,MAAM,WAAW,MAAM,gBAAgB,MAAM,QAAQ;CACrD,IACE,SAAS,WAAW,WACpB,SAAS,gBAAgB,MAAM,aAE/B;CAEF,IAAI,SAAS,WAAW,eACtB,MAAM,IAAI,MACR,8CAA8C,SAAS,cACzD;CAEF,MAAM,IAAI,MAAM,2CAA2C;AAC7D;AAEA,SAAS,uBAAuB,OAGV;CACpB,OAAO;EACL,GAAG;EACH,aAAa,MAAM;EACnB,WAAW,MAAM,QAAQ;EACzB,aAAa,MAAM,QAAQ;EAC3B,UAAU,MAAM,QAAQ;EACxB,WAAW,MAAM,QAAQ;EACzB,GAAI,OAAO,MAAM,QAAQ,cAAc,YACvC,MAAM,QAAQ,UAAU,KAAK,IACzB,EAAE,WAAW,MAAM,QAAQ,UAAU,KAAK,EAAE,IAC5C,CAAC;EACL,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;AACF;AAEA,SAAS,8BAA8B,OAG9B;CACP,IAAI,MAAM,aAAa,KAAA,GACrB;CAEF,IACE,+BAA+B,MAAM,OAAO,MAC5C,+BAA+B,MAAM,QAAQ,GAE7C,MAAM,IAAI,wCAAwC;AAEtD;AAEA,SAAS,+BACP,SACQ;CACR,IAAI,CAAC,SACH,OAAO;CAMT,MAAM,iBAAiB,KAAK,UAAU;EACpC,QAAQ;EACR,QAAQ;EACR,QAAQ;EACR,QAAQ,MAAM,MAAM;CACtB,CAAC;CACD,OAAO,WAAW,QAAQ,CAAC,CAAC,OAAO,cAAc,CAAC,CAAC,OAAO,WAAW;AACvE;AAEA,eAAe,qDAAqD,OAGlD;CAChB,MAAM,kBAAkB,kBAAkB,MAAM,gBAAgB,QAAQ;CACxE,MAAM,mBAAmB,kBACvB,MAAM,QAAQ,iBAAiB,QACjC;CACA,MAAM,sBAAsB,CAC1B,GAAI,mBAAmB,CAAC,gBAAgB,IAAI,CAAC,GAC7C,GAAG,sBAAsB,MAAM,OAAO,CACxC;CAEA,KAAK,MAAM,CAAC,OAAO,aAAa,oBAAoB,QAAQ,GAAG;EAI7D,IAHuB,oBACpB,MAAM,GAAG,KAAK,CAAC,CACf,MAAM,gBAAgB,wBAAwB,aAAa,QAAQ,CAEvD,KACZ,mBAAmB,wBAAwB,iBAAiB,QAAQ,GAErE;EAEF,MAAM,oCAAoC,QAAQ;CACpD;AACF;AAEA,SAAS,iBAAiB,OAGjB;CACP,oBAAoB;EAClB,YAAY,2BAA2B,MAAM,OAAO;EACpD,SAAS,MAAM;CACjB;AACF;AAEA,SAAS,sBACP,SAC0B;CAC1B,MAAM,aAAa,2BAA2B,OAAO;CACrD,OAAO,mBAAmB,eAAe,aACrC,kBAAkB,UAClB;AACN;AAEA,SAAS,2BAA2B,SAAyC;CAC3E,OAAO,GAAG,gBAAgB,EAAE,IAAI,KAAK,UAAU,OAAO;AACxD;AAEA,SAAS,wBACP,MACA,OACS;CACT,OAAO,KAAK,UAAU,IAAI,MAAM,KAAK,UAAU,KAAK;AACtD;AAEA,SAAS,mBAAmB,WAA+C;CACzE,MAAM,kBAAoC,CAAC;CAC3C,KAAK,MAAM,YAAY,WACrB,IACE,CAAC,gBAAgB,MAAM,aACrB,wBAAwB,UAAU,QAAQ,CAC5C,GAEA,gBAAgB,KAAK,QAAQ;CAGjC,OAAO;AACT;AAEA,SAAS,sBACP,SACkB;CAClB,OAAO,mBAAmB,CACxB,GAAI,QAAQ,sBAAsB,CAAC,GACnC,QAAQ,iBAAiB,QAC3B,CAAC;AACH;AAEA,eAAe,0BACb,SACA,cACe;CACf,KAAK,MAAM,YAAY,sBAAsB,OAAO,GAAG;EACrD,IAAI,gBAAgB,wBAAwB,cAAc,QAAQ,GAChE;EAEF,MAAM,oCAAoC,QAAQ;CACpD;AACF;AAEA,eAAe,4BAA4B,OAKL;CACpC,OAAO,MAAM,sCAAsC,YAAY;EAC7D,MAAM,qDAAqD;EAC3D,MAAM,oBAAoB,MAAM,iCAAiC;EACjE,IAAI,mBAAmB;GACrB,IACE,kBAAkB,UAAU,aAC5B,kBAAkB,sCAAsC,KACxD,wDACE,iBACF,KACA,MAAM,uBAAuB,QAC7B,2BAA2B,kBAAkB,gBAAgB,MAC3D,MAAM,oBAER,OAAO,MAAM,4CAA4C;IACvD,GAAG;IACH,SAAS;GACX,CAAC;GAEH,MAAM,IAAI,mCAAmC;EAC/C;EACA,OAAO,MAAM,qCAAqC,KAAK;CACzD,CAAC;AACH;AAEA,eAAe,qCAAqC,OAKd;CACpC,MAAM,UAAU,MAAM,uBAAuB;CAC7C,IACE,SAAS,MAAM,KACf,MAAM,uBAAuB,QAC7B,2BAA2B,OAAO,MAAM,MAAM,oBAE9C,OAAO;CAET,MAAM,UAAU,MAAM,4BAA4B;EAChD,GAAG;EACH;EACA,gBAAgB;CAClB,CAAC;CACD,IAAI,CAAC,SACH,OAAO;CAGT,IAAI;EACF,MAAM,+BAA+B;GACnC,aAAa,QAAQ,YAAY;GACjC,UAAU,QAAQ;EACpB,CAAC;EACD,MAAM,8BAA8B,gBAAgB,GAAG,QAAQ,WAAW;CAC5E,SAAS,OAAO;EACd,MAAM,kCAAkC,OAAO;EAC/C,MAAM;CACR;CAEA,iBAAiB;EACf,SAAS,QAAQ;EACjB,SAAS,QAAQ;CACnB,CAAC;CACD,IAAI,CAAC,wBAAwB,QAAQ,iBAAiB,QAAQ,YAAY,GACxE,MAAM,oCAAoC,QAAQ,eAAe;CAEnE,OAAO,QAAQ;AACjB;AAEA,eAAe,4CAA4C,OAKrB;CACpC,MAAM,UAAU,MAAM,4BAA4B;EAChD,GAAG;EACH,SAAS,MAAM,QAAQ;EACvB,gBAAgB;CAClB,CAAC;CACD,IAAI,CAAC,SACH,OAAO;CAET,MAAM,qBAAqB,mBAAmB,CAC5C,GAAG,sBAAsB,MAAM,OAAO,GACtC,QAAQ,YACV,CAAC;CACD,IAAI,mBAAmB,SAAS,0BAA0B;EACxD,MAAM,kCAAkC,OAAO;EAC/C,MAAM,IAAI,wBAAwB;GAChC,SAAS,yCAAyC,OAAO,wBAAwB,EAAE;GACnF,QAAQ;EACV,CAAC;CACH;CACA,MAAM,cAA8C;EAClD,GAAG,MAAM;EACT,kBAAkB,QAAQ;EAC1B;CACF;CAEA,IAAI;EACF,MAAM,+BAA+B;GACnC,aAAa,QAAQ,YAAY;GACjC,UAAU,QAAQ;EACpB,CAAC;EACD,MAAM,yCAAyC,MAAM,SAAS,WAAW;CAC3E,SAAS,OAAO;EACd,MAAM,kCAAkC,OAAO;EAC/C,MAAM;CACR;CAEA,iBAAiB;EACf,SAAS,QAAQ;EACjB,SAAS,QAAQ;CACnB,CAAC;CACD,OAAO,QAAQ;AACjB;AASA,eAAe,4BAA4B,OAMM;CAC/C,MAAM,kBAAkB,kBAAkB,MAAM,QAAQ,QAAQ;CAChE,MAAM,YAAY,wBAAwB,MAAM,QAAQ,SAAS;CACjE,MAAM,cAAc,wBAAwB,MAAM,QAAQ,WAAW;CACrE,MAAM,WAAW,wBAAwB,MAAM,QAAQ,QAAQ;CAC/D,MAAM,YAAY,wBAAwB,MAAM,QAAQ,SAAS;CACjE,MAAM,kBAAkB,wBAAwB,MAAM,WAAW;CACjE,IACE,EACE,mBACA,aACA,eACA,YACA,aACA,kBAGF,OAAO;CAGT,MAAM,eACJ,oBAAoB,MAAM,sBACtB,kBACA,MAAM,iBAAiB;EACrB,aAAa;EACb;EACA;EACA,QAAQ,MAAM;CAChB,CAAC;CACP,MAAM,cAA6B;EACjC,GAAG;EACH,UAAU;EACV;EACA;EACA;EACA;EACA,WAAW,MAAM;EACjB,GAAI,OAAO,MAAM,QAAQ,UAAU,YAAY,MAAM,QAAQ,MAAM,KAAK,IACpE,EAAE,OAAO,MAAM,QAAQ,MAAM,KAAK,EAAE,IACpC,CAAC;EACL,GAAG,qBAAqB,MAAM,QAAQ,IAAI;EAC1C,GAAG,+BAA+B,MAAM,QAAQ,kBAAkB;CACpE;CACA,OAAO;EACL;EACA;EACA,aAAa,uBAAuB;GAClC,aAAa;GACb,SAAS;EACX,CAAC;EACD;CACF;AACF;AAEA,eAAe,kCACb,SACe;CACf,IAAI,CAAC,wBAAwB,QAAQ,iBAAiB,QAAQ,YAAY,GACxE,MAAM,oCAAoC,QAAQ,YAAY;AAElE;AAEA,SAAS,kBAAkB,OAAuC;CAChE,IAAI,CAAC,iBAAiB,KAAK,GACzB,OAAO;CAET,OAAO;AACT;AAEA,eAAe,0BACb,SACsC;CACtC,IAAI,WAAW;CACf,IAAI;EACF,WAAW,eAAe,QAAQ,aAAa,uBAAuB;CACxE,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;CACA,IAAI;EACF,MAAM,YAAY,8BAA8B,QAAQ;EACxD,MAAM,WAAW,MAAM,MAAM,UAAU;GACrC,QAAQ;GACR,SAAS,EACP,eAAe,GAAG,mBAAmB,QAAQ,SAAS,EAAE,GAAG,QAAQ,cACrE;GACA,QAAQ,YAAY,QAAQ,SAAS;EACvC,CAAC;EAED,IAAI,SAAS,WAAW,OAAO,SAAS,WAAW,KACjD,OAAO,EAAE,OAAO,UAAU;EAE5B,IAAI,CAAC,SAAS,IAGZ,OAAO,EAAE,OAAO,UAAU;EAG5B,MAAM,UAAU,MAAM,kBAAkB,QAAQ;EAChD,IAAI,CAAC,wBAAwB,OAAO,GAClC,OAAO,EAAE,OAAO,UAAU;EAE5B,OAAO;GACL,OAAO;GACP,GAAG,sBAAsB,QAAQ;GACjC,GAAG,4BAA4B,OAAO;EACxC;CACF,QAAQ;EACN,OAAO,EAAE,OAAO,UAAU;CAC5B;AACF;AAEA,SAAS,sBAAsB,UAE7B;CACA,MAAM,cAAc,wBAClB,SAAS,QAAQ,IAAI,gBAAgB,CACvC;CACA,OAAO,cAAc,EAAE,YAAY,IAAI,CAAC;AAC1C;AAEA,SAAS,4BAA4B,SAEnC;CACA,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO,CAAC;CAEV,MAAM,UAAU,QAAQ;CACxB,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO,CAAC;CAEV,MAAM,YAAY,wBAAwB,QAAQ,SAAS;CAC3D,IAAI,CAAC,WACH,OAAO,CAAC;CAEV,MAAM,cAAc,KAAK,MAAM,SAAS;CACxC,IAAI,OAAO,MAAM,WAAW,GAC1B,OAAO,CAAC;CAEV,OAAO,EAAE,WAAW,IAAI,KAAK,WAAW,CAAC,CAAC,YAAY,EAAE;AAC1D;AAEA,SAAS,8BAA8B,UAA0B;CAC/D,MAAM,MAAM,eAAe,QAAQ;CACnC,IAAI,OAAO,mBAAmB,IAAI,QAAQ,GACxC,OAAO;CAET,OAAO;AACT;AAEA,SAAS,eAAe,OAA2B;CACjD,IAAI;EACF,OAAO,IAAI,IAAI,KAAK;CACtB,QAAQ;EACN,OAAO;CACT;AACF;AAEA,SAAS,wBAAwB,SAA2B;CAC1D,IAAI,CAAC,SAAS,OAAO,GACnB,OAAO;CAGT,OACE,SAAU,QAAoC,OAAO,KACrD,SAAU,QAAoC,IAAI;AAEtD;AAEA,SAAS,UAAU,WAAwC;CACzD,OAAO,oCAAoC,SAAS,CAAC,CAAC,WAAW;AACnE;AAEA,SAAS,mCACP,OAC4B;CAC5B,QAAQ,OAAR;EACE,KAAK,WACH,OAAO;EACT,KAAK,WACH,OAAO;EACT,SAEE,MAAM,IAAI,MACR,0CAA0CC,OAC5C;CAEJ;AACF;AAEA,eAAe,qBAA6D;CAC1E,MAAM,wCAAwC;CAC9C,MAAM,UAAU,MAAM,iCAAiC;CACvD,IAAI,SAAS,UAAU;MAEnB,wDAAwD,OACvC,GACjB,OAAO,QAAQ;CAAA;CAGnB,OAAO,MAAM,uBAAuB;AACtC;AAEA,SAAS,wDACP,SACS;CACT,IAAI,+BAA+B,IAAI,QAAQ,EAAE,GAC/C,OAAO;CAET,OAAO,uCAAuC,OAAO,CAAC,CAAC,MACpD,4BACC,sBAAsB,yBAAyB;EAC7C,UAAU,QAAQ;EAClB,uBAAuB;CACzB,CAAC,CACL;AACF;AAEA,eAAe,yBAAiE;CAC9E,MAAM,OAAO,gBAAgB;CAC7B,MAAM,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACjE,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM,IAAI,wBAAwB;GAChC,SAAS,sDAAsD,KAAK,IAAI,eAAe,KAAK;GAC5F,QAAQ;GACR,OAAO;EACT,CAAC;CACH,CAAC;CACD,IAAI,QAAQ,MACV,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,SAAS,OAAO;EACd,MAAM,IAAI,wBAAwB;GAChC,SAAS,+CAA+C;GACxD,QAAQ;GACR,OAAO;EACT,CAAC;CACH;AACF;AAEA,eAAe,0CAAyD;CAItE,IAAI,CAAE,MAAM,iCAAiC,GAC3C;CAEF,MAAM,sCACJ,oDACF;AACF;AAEA,eAAe,uDAAsE;CACnF,IAAI,UAAU,MAAM,iCAAiC;CACrD,IAAI,CAAC,SACH;CAEF,IAAI,+BAA+B,IAAI,QAAQ,EAAE,GAC/C;CAEF,IACE,QAAQ,UAAU,aAClB,uBAAuB;EACrB,UAAU,QAAQ;EAClB,uBAAuB,QAAQ;CACjC,CAAC,GACD;EACA,UAAU,MAAM,uCAAuC,OAAO;EAC9D;CACF;CAEA,IAAI,QAAQ,UAAU,WAAW;EAC/B,MAAM,iCAAiC,OAAO;EAC9C,+BAA+B,OAAO;EACtC,IAAI,QAAQ,iBAAiB;GAC3B,MAAM,yCAAyC,SAAS;IACtD,GAAG;IACH,OAAO;GACT,CAAC;GACD;EACF;EACA,MAAM,0BAA0B,OAAO;EACvC,MAAM,0CAA0C,OAAO;EACvD;CACF;CACA,IAAI,QAAQ,UAAU,qBAAqB;EACzC,+BAA+B,OAAO;EACtC;CACF;CAEA,IAAI,QAAQ,UAAU,aAAa;EACjC,MAAM,iBAAiB,MAAM,uBAAuB;EACpD,IACE,gBAAgB,MAAM,KACtB,2BAA2B,cAAc,MACvC,2BAA2B,QAAQ,gBAAgB,GAErD,MAAM,IAAI,wBAAwB;GAChC,SACE;GACF,QAAQ;EACV,CAAC;EAEH,MAAM,uCAAuC,OAAO,CAAC,CAAC,OACnD,UAAmB;GAClB,wCAAwC;IACtC;IACA,cAAc,QAAQ;GACxB,CAAC;EACH,CACF;CACF;AACF;AAEA,eAAe,uCACb,SACe;CACf,MAAM,mBAAmB,kBAAkB,QAAQ,iBAAiB,QAAQ;CAC5E,IACE,oBACA,CAAC,wBACC,kBACA,QAAQ,iBAAiB,QAC3B,GAEA,MAAM,oCAAoC,gBAAgB;CAE5D,MAAM,0BAA0B,SAAS,QAAQ,iBAAiB,QAAQ;CAC1E,MAAM,0CAA0C,OAAO;AACzD;AAEA,eAAe,uCACb,SACyC;CACzC,IAAI,CAAC,iCAAiC,GACpC,OAAO;CAET,MAAM,iBAAkC;EACtC,UAAU,QAAQ;EAClB,uBAAuB;CACzB;CACA,IACE,uCAAuC,OAAO,CAAC,CAAC,MAC7C,4BACC,sBAAsB,yBAAyB,cAAc,CACjE,GAEA,OAAO;CAET,MAAM,iBAAiB,MAAM,iCAAiC;CAC9D,IAAI,gBAAgB,OAAO,QAAQ,MAAM,eAAe,UAAU,WAChE,OAAO,kBAAkB;CAE3B,MAAM,4BAA4B,uCAChC,cACF,CAAC,CAAC,OAAO,sBAAsB;CAC/B,0BAA0B,KAAK,cAAc;CAC7C,IAAI,0BAA0B,SAAS,iCACrC,MAAM,IAAI,MACR,yCAAyC,OAAO,+BAA+B,EAAE,2CACnF;CAEF,MAAM,iBAAiB;EACrB,GAAG;EACH;EACA,yBAAyB;CAC3B;CACA,MAAM,yCACJ,gBACA,cACF;CACA,OAAO;AACT;AAEA,SAAS,+BACP,SACM;CACN,KAAK,MAAM,2BAA2B,uCACpC,OACF,GAAG;EACD,IAAI,CAAC,uBAAuB,uBAAuB,GACjD;EAEF,IAAI;GACF,QAAQ,KAAK,wBAAwB,UAAU,SAAS;EAC1D,SAAS,OAAO;GACd,IAAI,CAAC,wBAAwB,OAAO,OAAO,GACzC,MAAM,IAAI,wBAAwB;IAChC,SAAS,sCAAsC,OAAO,wBAAwB,QAAQ,EAAE,yBAAyB,eAAe,KAAK;IACrI,QAAQ;IACR,OAAO;GACT,CAAC;EAEL;CACF;AACF;AAEA,SAAS,uCACP,SACmB;CACnB,MAAM,aAAa,CACjB,GAAI,QAAQ,6BAA6B,CAAC,GAC1C,GAAI,QAAQ,0BACR,CAAC,QAAQ,uBAAuB,IAChC,CAAC,CACP;CACA,MAAM,mBAAsC,CAAC;CAC7C,KAAK,MAAM,aAAa,YACtB,IACE,CAAC,iBAAiB,MAAM,aACtB,sBAAsB,UAAU,SAAS,CAC3C,GAEA,iBAAiB,KAAK,SAAS;CAGnC,OAAO;AACT;AAEA,SAAS,sBACP,MACA,OACS;CACT,OACE,KAAK,aAAa,MAAM,YACxB,KAAK,0BAA0B,MAAM;AAEzC;AAEA,SAAS,mCAA4C;CACnD,MAAM,cAAc,OAClB,QAAQ,IAAI,gCAAgC,EAC9C,CAAC,CAAC,KAAK;CACP,OAAO,gBAAgB,gBAAgB,gBAAgB;AACzD;AAEA,eAAe,iCACb,SAC4B;CAC5B,MAAM,UAAU,MAAM,0CAA0C,OAAO;CACvE,IAAI,CAAC,SACH,MAAM,IAAI,wBAAwB;EAChC,SAAS;EACT,QAAQ;CACV,CAAC;CAEH,OAAO;AACT;AAEA,eAAe,0CACb,SACmC;CACnC,MAAM,cAAc,MAAM,gBAAgB,QAAQ,QAAQ;CAC1D,IAAI,YAAY,WAAW,WACzB,OAAO;CAET,IAAI,YAAY,WAAW,eACzB,MAAM,IAAI,wBAAwB;EAChC,SAAS,YAAY;EACrB,QAAQ;CACV,CAAC;CAEH,OAAO,uBAAuB;EAC5B,aAAa,YAAY;EACzB;CACF,CAAC;AACH;AAEA,eAAe,+BACb,SACmC;CACnC,IAAI,CAAC,SACH,OAAO;CAET,MAAM,QAAQ,MAAM,gBAAgB,QAAQ,QAAQ;CAIpD,OAAO,MAAM,WAAW,UACpB,uBAAuB;EAAE,aAAa,MAAM;EAAa;CAAQ,CAAC,IAClE;AACN;AAEA,eAAe,wCAAwC,IAMrD;CACA,MAAM,UAAU,MAAM,iCAAiC;CACvD,IACE,SAAS,OAAO,MAChB,QAAQ,UAAU,uBAClB,CAAC,QAAQ,iBAET,MAAM,IAAI,MAAM,6CAA6C;CAE/D,OAAO;AAKT;AAEA,SAAS,wCAAwC,OAGxC;CACP,QAAQ,KAAK,uDAAuD;EAClE,OAAO,eAAe,MAAM,KAAK;EACjC,cAAc,MAAM;CACtB,CAAC;AACH;AAEA,eAAe,iCACb,SACA,iBACe;CACf,oBAAoB;CACpB,IAAI,CAAC,QAAQ,iBAAiB;EAC5B,MAAM,kBAAkB;EACxB;CACF;CACA,MAAM,8BACJ,gBAAgB,GAChB,QAAQ,eACV;CACA,IAAI,iBACF,iBAAiB;EACf,SAAS,QAAQ;EACjB,SAAS;CACX,CAAC;AAEL;AAEA,eAAe,mCAAmF;CAChG,MAAM,OAAO,0BAA0B;CACvC,MAAM,MAAM,MAAM,SAAS,MAAM,MAAM,CAAC,CAAC,OAAO,UAAmB;EACjE,IAAI,oBAAoB,KAAK,GAC3B,OAAO;EAET,MAAM,IAAI,wBAAwB;GAChC,SAAS,sDAAsD,KAAK,IAAI,eAAe,KAAK;GAC5F,QAAQ;GACR,OAAO;EACT,CAAC;CACH,CAAC;CACD,IAAI,QAAQ,MACV,OAAO;CAET,IAAI;CACJ,IAAI;EACF,QAAQ,KAAK,MAAM,GAAG;CACxB,SAAS,OAAO;EACd,MAAM,IAAI,wBAAwB;GAChC,SAAS,+CAA+C;GACxD,QAAQ;GACR,OAAO;EACT,CAAC;CACH;CACA,IAAI,CAAC,+BAA+B,KAAK,GACvC,MAAM,IAAI,wBAAwB;EAChC,SAAS,+CAA+C;EACxD,QAAQ;CACV,CAAC;CAEH,OAAO;AACT;AAEA,SAAS,+BACP,OACyC;CACzC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,OACE,MAAM,MAAM,KACZ,OAAO,MAAM,OAAO,YACpB,MAAM,GAAG,SAAS,MACjB,MAAM,UAAU,aACf,MAAM,UAAU,uBAChB,MAAM,UAAU,gBAClB,OAAO,cAAc,MAAM,QAAQ,KACnC,OAAO,MAAM,QAAQ,IAAI,KACzB,OAAO,MAAM,0BAA0B,YACvC,MAAM,sBAAsB,SAAS,MACpC,MAAM,oBAAoB,QACzB,qBAAqB,MAAM,eAAe,MAC5C,qBAAqB,MAAM,gBAAgB,MAC1C,MAAM,sCAAsC,KAAA,KAC3C,MAAM,sCAAsC,MAC9C,6BAA6B,MAAM,kBAAkB,KACrD,8BAA8B,MAAM,yBAAyB,KAC7D,0BAA0B,MAAM,uBAAuB,KACvD,kCAAkC,MAAM,eAAe;AAE3D;AAEA,SAAS,6BAA6B,OAAyB;CAC7D,OACE,UAAU,KAAA,KACT,MAAM,QAAQ,KAAK,KAClB,MAAM,UAAU,4BAChB,MAAM,OAAO,aAAa,iBAAiB,QAAQ,CAAC;AAE1D;AAEA,SAAS,8BAA8B,OAAyB;CAC9D,OACE,UAAU,KAAA,KACT,MAAM,QAAQ,KAAK,KAClB,MAAM,UAAU,mCAChB,MAAM,OAAO,cAAc,kBAAkB,SAAS,CAAC;AAE7D;AAEA,SAAS,0BAA0B,OAAyB;CAC1D,OAAO,UAAU,KAAA,KAAa,kBAAkB,KAAK;AACvD;AAEA,SAAS,kBAAkB,OAA0C;CACnE,OACE,SAAS,KAAK,KACd,OAAO,cAAc,MAAM,QAAQ,KACnC,OAAO,MAAM,QAAQ,IAAI,KACzB,OAAO,MAAM,0BAA0B,YACvC,MAAM,sBAAsB,SAAS;AAEzC;AAEA,SAAS,kCAAkC,OAAyB;CAClE,IAAI,UAAU,KAAA,GACZ,OAAO;CAET,IAAI,EAAE,SAAS,KAAK,KAAK,OAAO,MAAM,eAAe,WACnD,OAAO;CAET,QACG,MAAM,wBAAwB,KAAA,KAC7B,OAAO,MAAM,wBAAwB,cACtC,MAAM,2BAA2B,KAAA,KAChC,OAAO,MAAM,2BAA2B,cACzC,MAAM,wBAAwB,KAAA,KAC7B,iCAAiC,MAAM,mBAAmB;AAEhE;AAEA,SAAS,iCAAiC,OAAyB;CACjE,OACE,SAAS,KAAK,KACd,OAAO,MAAM,OAAO,YACpB,OAAO,MAAM,YAAY,aACxB,MAAM,UAAU,aACf,MAAM,UAAU,oBAChB,MAAM,UAAU,qBACjB,MAAM,aAAa,KAAA,KAAa,OAAO,MAAM,aAAa,cAC1D,MAAM,WAAW,KAAA,KAChB,MAAM,WAAW,QACjB,OAAO,MAAM,WAAW;AAE9B;AAEA,SAAS,qBAAqB,OAAwC;CACpE,OAAO,SAAS,KAAK,KAAK,MAAM,MAAM,KAAK,iBAAiB,MAAM,QAAQ;AAC5E;AAEA,eAAe,yCACb,UACA,MACe;CACf,IAAI,CAAC,qCAAqC,UAAU,IAAI,GACtD,MAAM,IAAI,MAAM,gDAAgD;CAElE,MAAM,UAAU,MAAM,iCAAiC;CACvD,IAAI,CAAC,SACH,MAAM,IAAI,mCAAmC;EAC3C,uBAAuB;EACvB,QAAQ;CACV,CAAC;CAEH,IAAI,CAAC,qCAAqC,UAAU,OAAO,GACzD,MAAM,IAAI,mCAAmC;EAC3C,uBAAuB;EACvB,QAAQ;CACV,CAAC;CAEH,MAAM,oBAAoB,0BAA0B,GAAG,IAAI;AAC7D;AAEA,eAAe,kCACb,SACe;CACf,MAAM,OAAO,0BAA0B;CACvC,MAAM,YAAY,GAAG,KAAK,SAAS,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CAC3E,MAAM,OAAO,MAAM,KAAK,WAAW,MAAM,GAAK;CAC9C,IAAI;CACJ,IAAI;EACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;EACpE,MAAM,KAAK,KAAK;CAClB,SAAS,OAAO;EACd,UAAU;CACZ;CACA,IAAI;EACF,MAAM,KAAK,MAAM;CACnB,SAAS,OAAO;EACd,YAAY;CACd;CACA,IAAI,YAAY,KAAA,GAAW;EACzB,MAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EAC1D,MAAM;CACR;CAEA,IAAI;EACF,MAAM,KAAK,WAAW,IAAI;CAC5B,SAAS,OAAO;EACd,IAAI,wBAAwB,OAAO,QAAQ,GACzC,MAAM,IAAI,mCAAmC;EAE/C,MAAM;CACR,UAAU;EACR,MAAM,GAAG,WAAW,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;CAC5D;AACF;AAEA,eAAe,0CACb,UACe;CACf,MAAM,iBAAiB,MAAM,iCAAiC;CAC9D,IAAI,CAAC,gBACH;CAEF,IAAI,CAAC,qCAAqC,UAAU,cAAc,GAChE,MAAM,IAAI,mCAAmC;EAC3C,uBAAuB;EACvB,QAAQ;CACV,CAAC;CAEH,MAAM,GAAG,0BAA0B,GAAG,EAAE,OAAO,KAAK,CAAC;AACvD;AAEA,SAAS,qCACP,MACA,OACS;CACT,OACE,KAAK,OAAO,MAAM,MAClB,KAAK,aAAa,MAAM,YACxB,KAAK,0BAA0B,MAAM;AAEzC;AAEA,SAAS,4BAAoC;CAC3C,OAAO,KAAK,gBAAgB,GAAG,QAAQ,yBAAyB;AAClE;AAEA,SAAS,kBAA0B;CACjC,OAAO,KAAK,gBAAgB,GAAG,QAAQ,cAAc;AACvD;AAEA,eAAe,6BAA4C;CACzD,MAAM,MAAM,KAAK,gBAAgB,GAAG,MAAM,GAAG,EAAE,WAAW,KAAK,CAAC;AAClE;AAEA,eAAe,8BACb,MACA,SACe;CACf,MAAM,oBAAoB,MAAM,OAAO;AACzC;AAEA,eAAe,oBACb,MACA,SACe;CACf,MAAM,WAAW,GAAG,KAAK,OAAO,QAAQ,IAAI,GAAG,KAAK,IAAI,EAAE,GAAG,WAAW;CACxE,IAAI;EACF,MAAM,OAAO,MAAM,KAAK,UAAU,MAAM,GAAK;EAC7C,IAAI;GACF,MAAM,KAAK,UAAU,GAAG,KAAK,UAAU,SAAS,MAAM,CAAC,EAAE,KAAK,MAAM;GACpE,MAAM,KAAK,KAAK;EAClB,UAAU;GACR,MAAM,KAAK,MAAM;EACnB;EAEA,MAAM,OAAO,UAAU,IAAI;CAC7B,SAAS,OAAO;EACd,MAAM,GAAG,UAAU,EAAE,OAAO,KAAK,CAAC,CAAC,CAAC,YAAY,KAAA,CAAS;EACzD,MAAM;CACR;AACF;AAEA,SAAS,oBAAoB,OAAyB;CACpD,OAAO,QACL,SACE,OAAO,UAAU,YACjB,UAAU,SACV,MAAM,SAAS,QACnB;AACF;AAEA,SAAS,wBAAwB,OAAgB,MAAuB;CACtE,OAAO,QACL,SAAS,OAAO,UAAU,YAAY,UAAU,SAAS,MAAM,SAAS,IAC1E;AACF;AAEA,SAAS,eAAe,OAAwB;CAC9C,OAAO,iBAAiB,SAAS,MAAM,QAAQ,KAAK,IAChD,MAAM,QAAQ,KAAK,IACnB,OAAO,SAAS,eAAe;AACrC;AAEA,SAAS,qBAAqB,OAM5B;CACA,IAAI,EAAE,SAAS,OAAO,UAAU,WAC9B,OAAO,CAAC;CAEV,MAAM,SAAS;CACf,MAAM,KAAK,wBAAwB,OAAO,EAAE;CAC5C,MAAM,QAAQ,wBAAwB,OAAO,KAAK;CAClD,MAAM,OAAO,wBAAwB,OAAO,IAAI;CAChD,IAAI,EAAE,MAAM,SAAS,OACnB,OAAO,CAAC;CAEV,OAAO,EACL,MAAM;EACJ,GAAI,KAAK,EAAE,GAAG,IAAI,CAAC;EACnB,GAAI,QAAQ,EAAE,MAAM,IAAI,CAAC;EACzB,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;CACzB,EACF;AACF;AAEA,SAAS,+BAA+B,OAEtC;CACA,MAAM,qBAAqB,kCAAkC,KAAK;CAClE,OAAO,qBAAqB,EAAE,mBAAmB,IAAI,CAAC;AACxD;AAEA,SAAgB,kCACd,OACiC;CACjC,IAAI,CAAC,SAAS,KAAK,GACjB,OAAO;CAET,MAAM,KAAK,wBAAwB,MAAM,EAAE;CAC3C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,OAAO,wBAAwB,MAAM,IAAI;CAC/C,MAAM,WAAW,2BAA2B,KAAK;CACjD,IAAI,EAAE,MAAM,QAAQ,OAClB,OAAO;CAET,OAAO;EACL;EACA;EACA;EACA,GAAI,OAAO,EAAE,KAAK,IAAI,CAAC;EACvB,GAAI,WAAW,EAAE,SAAS,IAAI,CAAC;CACjC;AACF;AAeA,SAAS,mBAAmB,OAAuB;CACjD,MAAM,aAAa,MAAM,KAAK;CAC9B,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,wBAAwB,OAA+B;CAC9D,MAAM,aAAa,OAAO,SAAS,EAAE,CAAC,CAAC,KAAK;CAC5C,OAAO,WAAW,SAAS,IAAI,aAAa;AAC9C;AAEA,SAAS,2BAA2B,OAAyC;CAC3E,IAAI,MAAM,aAAa,QAAQ,MAAM,eAAe,MAClD,OAAO;CAIT,OADiB,yBAAyB,MAAM,QAClC,CAAC,EAAE,aAAa;AAChC;AAEA,SAAS,yBACP,UACgC;CAChC,IAAI,aAAa,QAAQ,aAAa,KAAA,GACpC,OAAO;CAGT,IAAI,OAAO,aAAa,UACtB,IAAI;EACF,MAAM,SAAS,KAAK,MAAM,QAAQ;EAClC,OAAO,SAAS,MAAM,IAAI,SAAS;CACrC,QAAQ;EACN,OAAO;CACT;CAGF,OAAO,SAAS,QAAQ,IAAI,WAAW;AACzC;AAEA,SAAS,eAAe,SAAiB,UAA0B;CACjE,MAAM,MAAM,IAAI,IAAI,OAAO;CAK3B,IAAI,WAAW,GAJY,IAAI,SAAS,QAAQ,qBAAqB,EAIlC,IAHR,SAAS,WAAW,GAAG,IAC9C,WACA,IAAI,gBACuD;CAC/D,IAAI,SAAS;CACb,IAAI,OAAO;CACX,OAAO,IAAI,SAAS;AACtB;AAEA,SAAS,SAAS,OAAkD;CAClE,OAAO,QAAQ,SAAS,OAAO,UAAU,QAAQ;AACnD;AAEA,eAAe,kBAAkB,UAAsC;CACrE,MAAM,MAAM,MAAM,SAAS,KAAK;CAChC,IAAI,CAAC,KACH,OAAO;CAET,IAAI;EACF,OAAO,KAAK,MAAM,GAAG;CACvB,QAAQ;EACN,OAAO,EAAE,SAAS,IAAI;CACxB;AACF;AAEA,eAAe,oBAAmC;CAChD,MAAM,GAAG,gBAAgB,GAAG,EAAE,OAAO,KAAK,CAAC;AAC7C"}